diff --git a/.codespellrc b/.codespellrc
index 82b2e1396d..038fb65244 100644
--- a/.codespellrc
+++ b/.codespellrc
@@ -19,4 +19,5 @@ ignore-regex = \b[a-z]+[A-Z]\w*\b|\b[A-Z][a-z]+[A-Z]\w*\b
 # thirdparty: literal Maven groupId `org.apache.hadoop.thirdparty` (external, cannot rename)
 # unknwon: GitHub username / Go module path (`github.com/unknwon/goconfig`)
 # atleast: CLI mode literal string in test/benchmark/fuse_db/bin/sqlite_verify.py
-ignore-words-list = visibles,fo,te,ser,bject,unparseable,keep-alives,tread,anc,ue,auther,thirdparty,unknwon,atleast
+# sme: local variable for a *streamMutateError in mount tests
+ignore-words-list = visibles,fo,te,ser,bject,unparseable,keep-alives,tread,anc,ue,auther,thirdparty,unknwon,atleast,sme
diff --git a/.github/actions/cleanup-stale-fuse-mounts/action.yml b/.github/actions/cleanup-stale-fuse-mounts/action.yml
new file mode 100644
index 0000000000..7e6ddab7bd
--- /dev/null
+++ b/.github/actions/cleanup-stale-fuse-mounts/action.yml
@@ -0,0 +1,11 @@
+name: Clean up stale SeaweedFS test mounts
+description: Detach disconnected FUSE test mounts left by earlier jobs on a shared runner.
+runs:
+  using: composite
+  steps:
+    - name: Unmount disconnected SeaweedFS test mounts
+      if: runner.os == 'Linux' && runner.environment == 'self-hosted'
+      shell: bash
+      env:
+        CLEANUP_SCRIPT: ${{ github.action_path }}/cleanup.py
+      run: python3 "$CLEANUP_SCRIPT"
diff --git a/.github/actions/cleanup-stale-fuse-mounts/cleanup.py b/.github/actions/cleanup-stale-fuse-mounts/cleanup.py
new file mode 100644
index 0000000000..ad17a767fa
--- /dev/null
+++ b/.github/actions/cleanup-stale-fuse-mounts/cleanup.py
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""Detach disconnected SeaweedFS integration-test mounts without touching live ones."""
+
+import errno
+import os
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import sys
+import tempfile
+
+
+def test_mounts(mountinfo):
+    """Read the kernel table directly: traversing a stale mount may block."""
+    roots = {tempfile.gettempdir(), "/tmp", "/var/tmp"}
+    for line in mountinfo.splitlines():
+        fields, filesystem = line.split(" - ", 1)
+        if filesystem.split()[0].split(".")[0] != "fuse":
+            continue
+        fields = fields.split()
+        # mountinfo escapes whitespace and backslashes with octal sequences.
+        target = re.sub(r"\\([0-7]{3})", lambda m: chr(int(m[1], 8)), fields[4])
+        path = Path(target)
+        # Test mounts are a mount* leaf under a seaweedfs_fuse_* scratch dir
+        # (seaweedfs_fuse_test_*/mount, seaweedfs_fuse_failover_*/mount0, ...)
+        # or the posix-compliance workflow's fixed /tmp/seaweedfs/mount.
+        if (not path.name.startswith("mount")
+                or str(path.parent.parent) not in roots
+                or not (path.parent.name.startswith("seaweedfs_fuse")
+                        or path.parent.name == "seaweedfs")):
+            continue
+        yield fields[0], target
+
+
+def mounted(mount_id, target):
+    return (mount_id, target) in test_mounts(Path("/proc/self/mountinfo").read_text())
+
+
+def cleanup():
+    failed = False
+    for mount_id, target in test_mounts(Path("/proc/self/mountinfo").read_text()):
+        try:
+            # A separate, bounded probe prevents a wedged FUSE daemon from
+            # hanging cleanup. Only ENOTCONN proves the daemon disconnected;
+            # a timeout or another error is not enough to detach a live mount.
+            probe = subprocess.run(
+                [sys.executable, __file__, "--probe", target], timeout=5,
+                capture_output=True, check=False,
+            )
+        except subprocess.TimeoutExpired:
+            print(f"::warning::FUSE probe timed out; leaving {target} mounted")
+            continue
+        if probe.returncode != errno.ENOTCONN or not mounted(mount_id, target):
+            continue
+
+        print(f"Unmounting disconnected FUSE test mount: {target}", flush=True)
+        # Lazy unmount detaches a dead mount even when an old process still
+        # holds it open. Prefer the unprivileged FUSE helper; sudo is fallback.
+        for command in (
+            ["fusermount3", "-uz", "--", target],
+            ["fusermount", "-uz", "--", target],
+            ["sudo", "-n", "umount", "-l", "--", target],
+        ):
+            try:
+                subprocess.run(command, timeout=10, check=False)
+            except (OSError, subprocess.TimeoutExpired) as error:
+                print(f"{command[0]}: {error}", file=sys.stderr)
+            if not mounted(mount_id, target):
+                break
+        else:
+            print(f"::error::Could not unmount disconnected FUSE test mount: {target}")
+            failed = True
+            continue
+        # The detached mount's parent still holds the crashed run's data and
+        # logs; test_mounts only yields targets under a SeaweedFS test dir in
+        # a temp root, so the parent is safe to reclaim here.
+        shutil.rmtree(Path(target).parent, ignore_errors=True)
+    return int(failed)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) == 3 and sys.argv[1] == "--probe":
+        try:
+            os.stat(sys.argv[2])
+        except OSError as error:
+            sys.exit(error.errno)
+        sys.exit(0)
+    sys.exit(cleanup())
diff --git a/.github/actions/cleanup-stale-fuse-mounts/test_cleanup.py b/.github/actions/cleanup-stale-fuse-mounts/test_cleanup.py
new file mode 100644
index 0000000000..b8ee3fa028
--- /dev/null
+++ b/.github/actions/cleanup-stale-fuse-mounts/test_cleanup.py
@@ -0,0 +1,137 @@
+import errno
+import importlib.util
+from pathlib import Path
+import subprocess
+import unittest
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location("cleanup", Path(__file__).with_name("cleanup.py"))
+cleanup = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(cleanup)
+
+TARGET = "/tmp/seaweedfs_fuse_test_123/mount"
+MOUNTINFO = f"42 1 0:9 / {TARGET} rw - fuse.seaweedfs seaweedfs rw\n"
+
+
+class CleanupTests(unittest.TestCase):
+    def run_cleanup(self, results, mounted=True):
+        with patch.object(cleanup.Path, "read_text", return_value=MOUNTINFO), \
+                patch.object(cleanup, "mounted", side_effect=mounted if isinstance(mounted, list) else None,
+                             return_value=mounted) as check, \
+                patch.object(cleanup.shutil, "rmtree") as rmtree, \
+                patch.object(cleanup.subprocess, "run", side_effect=results) as run:
+            status = cleanup.cleanup()
+        return status, run, check, rmtree
+
+    def result(self, status):
+        return subprocess.CompletedProcess([], status)
+
+    def test_only_fuse_integration_test_mounts_are_candidates(self):
+        rows = MOUNTINFO
+        rows += MOUNTINFO.replace("fuse.seaweedfs", "ext4")
+        rows += MOUNTINFO.replace(TARGET, "/mnt/production")
+        rows += MOUNTINFO.replace(TARGET, "/tmp/seaweedfs_fuse_test_123/data")
+        rows += MOUNTINFO.replace(TARGET, "/home/user/seaweedfs_fuse_test_123/mount")
+        rows += MOUNTINFO.replace(TARGET, "/tmp/seaweedfs/data")
+        self.assertEqual(list(cleanup.test_mounts(rows)), [("42", TARGET)])
+
+    def test_all_test_mount_layouts_are_candidates(self):
+        targets = (
+            "/tmp/seaweedfs_fuse_test_123/mount",
+            "/tmp/seaweedfs_fuse_failover_456/mount0",
+            "/tmp/seaweedfs_fuse_failover_456/mount1",
+            "/var/tmp/seaweedfs_fuse_p2p_test_789/mount2",
+            "/tmp/seaweedfs/mount",
+        )
+        rows = "".join(
+            MOUNTINFO.replace("42", str(40 + i)).replace(TARGET, target)
+            for i, target in enumerate(targets)
+        )
+        self.assertEqual(
+            list(cleanup.test_mounts(rows)),
+            [(str(40 + i), target) for i, target in enumerate(targets)],
+        )
+
+    def test_mountinfo_paths_are_unescaped_once(self):
+        target = "/tmp/seaweedfs_fuse_test_space and\\slash/mount"
+        encoded = target.replace("\\", r"\134").replace(" ", r"\040")
+        rows = MOUNTINFO.replace(TARGET, encoded)
+        self.assertEqual(list(cleanup.test_mounts(rows)), [("42", target)])
+
+    def test_no_mounts_is_a_noop(self):
+        with patch.object(cleanup.Path, "read_text", return_value=""), \
+                patch.object(cleanup.subprocess, "run") as run:
+            self.assertEqual(cleanup.cleanup(), 0)
+        run.assert_not_called()
+
+    def test_healthy_mount_is_untouched(self):
+        status, run, _, _ = self.run_cleanup([self.result(0)])
+        self.assertEqual(status, 0)
+        self.assertEqual(run.call_count, 1)
+
+    def test_other_probe_errors_are_untouched(self):
+        for error in (errno.EACCES, errno.ENOENT, errno.EIO):
+            with self.subTest(error=error):
+                status, run, _, _ = self.run_cleanup([self.result(error)])
+                self.assertEqual(status, 0)
+                self.assertEqual(run.call_count, 1)
+
+    def test_probe_timeout_does_not_detach_a_possibly_live_mount(self):
+        status, run, _, _ = self.run_cleanup([subprocess.TimeoutExpired("probe", 5)])
+        self.assertEqual(status, 0)
+        self.assertEqual(run.call_count, 1)
+
+    def test_disconnected_mount_is_lazily_unmounted(self):
+        status, run, _, _ = self.run_cleanup([self.result(errno.ENOTCONN), self.result(0)], [True, False])
+        self.assertEqual(status, 0)
+        self.assertEqual(run.call_args_list[1].args[0], ["fusermount3", "-uz", "--", TARGET])
+        self.assertEqual(run.call_args_list[0].kwargs["timeout"], 5)
+        self.assertEqual(run.call_args_list[1].kwargs["timeout"], 10)
+
+    def test_replaced_or_removed_mount_is_untouched(self):
+        status, run, _, _ = self.run_cleanup([self.result(errno.ENOTCONN)], False)
+        self.assertEqual(status, 0)
+        self.assertEqual(run.call_count, 1)
+
+    def test_mount_identity_is_checked_without_stat(self):
+        with patch.object(cleanup.Path, "read_text", return_value=MOUNTINFO):
+            self.assertTrue(cleanup.mounted("42", TARGET))
+            self.assertFalse(cleanup.mounted("43", TARGET))
+
+    def test_missing_or_timed_out_helper_uses_fallback(self):
+        for error in (FileNotFoundError(), subprocess.TimeoutExpired("fusermount3", 10)):
+            with self.subTest(error=error):
+                status, run, _, _ = self.run_cleanup(
+                    [self.result(errno.ENOTCONN), error, self.result(0)], [True, True, False])
+                self.assertEqual(status, 0)
+                self.assertEqual(run.call_args.args[0], ["fusermount", "-uz", "--", TARGET])
+
+    def test_failed_helpers_fall_back_to_sudo(self):
+        status, run, _, _ = self.run_cleanup(
+            [self.result(errno.ENOTCONN), self.result(1), self.result(1), self.result(0)],
+            [True, True, True, False])
+        self.assertEqual(status, 0)
+        self.assertEqual(run.call_args.args[0], ["sudo", "-n", "umount", "-l", "--", TARGET])
+
+    def test_cleanup_fails_when_stale_mount_remains(self):
+        status, run, _, rmtree = self.run_cleanup(
+            [self.result(errno.ENOTCONN), self.result(1), self.result(1), self.result(1)])
+        self.assertEqual(status, 1)
+        self.assertEqual(run.call_count, 4)
+        rmtree.assert_not_called()
+
+    def test_unmounted_test_dir_is_reclaimed(self):
+        status, _, _, rmtree = self.run_cleanup(
+            [self.result(errno.ENOTCONN), self.result(0)], [True, False])
+        self.assertEqual(status, 0)
+        rmtree.assert_called_once_with(Path(TARGET).parent, ignore_errors=True)
+
+    def test_probe_process_reports_errno(self):
+        for target, expected in ((str(Path(__file__)), 0), (str(Path(__file__) / "absent"), errno.ENOTDIR)):
+            with self.subTest(target=target):
+                result = subprocess.run([cleanup.sys.executable, cleanup.__file__, "--probe", target], check=False)
+                self.assertEqual(result.returncode, expected)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/actions/fix-fusermount-setuid/action.yml b/.github/actions/fix-fusermount-setuid/action.yml
index 7aad5bf482..5b0428c713 100644
--- a/.github/actions/fix-fusermount-setuid/action.yml
+++ b/.github/actions/fix-fusermount-setuid/action.yml
@@ -23,8 +23,14 @@ runs:
 
         bin=$(command -v fusermount3 || true)
         if [ -z "$bin" ]; then
-          echo "no fusermount3 in PATH" >&2
-          exit 1
+          # Self-hosted runners are not guaranteed to carry fuse3.
+          sudo apt-get update
+          sudo apt-get install -y fuse3
+          bin=$(command -v fusermount3 || true)
+          if [ -z "$bin" ]; then
+            echo "no fusermount3 in PATH after installing fuse3" >&2
+            exit 1
+          fi
         fi
         if can_mount "$bin"; then
           ls -l "$bin"
diff --git a/.github/actions/sign-image/action.yml b/.github/actions/sign-image/action.yml
new file mode 100644
index 0000000000..82cc046c08
--- /dev/null
+++ b/.github/actions/sign-image/action.yml
@@ -0,0 +1,44 @@
+name: Sign container images
+description: >
+  Keyless cosign signature on each image, then a verification pass against the
+  identity the signature should carry, so a misconfigured job fails here and not
+  on someone's cluster. That identity is the calling workflow's own,
+  https://github.com/<owner>/<repo>/.github/workflows/<file>@<ref>.
+  The calling job needs `id-token: write` and a registry login for every image.
+
+inputs:
+  images:
+    description: Image references by digest (name@sha256:...), whitespace separated.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Install cosign
+      uses: sigstore/cosign-installer@v4.1.2
+
+    - name: Sign
+      shell: bash
+      env:
+        IMAGES: ${{ inputs.images }}
+      run: |
+        set -euo pipefail
+        # The .sig tag layout: the OCI-referrer bundle cosign 3 writes by default
+        # is not read by the Kyverno and policy-controller releases in use today.
+        # Cosign 3 also defaults to --use-signing-config, which insists on a
+        # bundle for its output; turning it off falls back to the default
+        # Fulcio and Rekor URLs, which is all the .sig layout ever used.
+        cosign sign --yes --recursive \
+          --new-bundle-format=false --use-signing-config=false \
+          $IMAGES
+
+    - name: Verify
+      shell: bash
+      env:
+        IMAGES: ${{ inputs.images }}
+      run: |
+        set -euo pipefail
+        cosign verify \
+          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+          --certificate-identity "https://github.com/$GITHUB_WORKFLOW_REF" \
+          $IMAGES
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2e7a327bd3..b4cd98f77c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +1,14 @@
 version: 2
 updates:
 - package-ecosystem: "github-actions"
-  directory: "/"
+  directories:
+    - "/"
+    - "/.github/actions/sign-image"
   schedule:
       interval: "weekly"
 - package-ecosystem: gomod
   directory: "/"
   schedule:
     interval: weekly
+  ignore:
+    - dependency-name: "github.com/seaweedfs/goexif"
diff --git a/.github/scripts/helm_jwt_keys.py b/.github/scripts/helm_jwt_keys.py
new file mode 100755
index 0000000000..8b79984203
--- /dev/null
+++ b/.github/scripts/helm_jwt_keys.py
@@ -0,0 +1,240 @@
+#!/usr/bin/env python3
+"""Check JWT extraction and, with --context, real Helm upgrade persistence."""
+
+import argparse
+import base64
+import json
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import uuid
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # CI also exercises Python 3.10.
+    import tomli as tomllib
+
+
+ROOT = Path(__file__).resolve().parents[2]
+CHART = ROOT / "k8s/charts/seaweedfs"
+SECTIONS = ("jwt.signing", "jwt.signing.read", "jwt.filer_signing", "jwt.filer_signing.read")
+KEYS = {section: f"active-{index}" for index, section in enumerate(SECTIONS)}
+ESCAPED_HEADER = '["jw\\u0074".signing]\nkey = "existing"'
+
+
+def run(*args):
+    return subprocess.run(args, check=True, text=True, capture_output=True).stdout
+
+
+def keys(raw):
+    document = tomllib.loads(raw)
+    result = {}
+    for section in SECTIONS:
+        table = document
+        for part in section.split("."):
+            table = table.get(part, {})
+        if "key" in table:
+            result[section] = table["key"]
+    return result
+
+
+def fixtures():
+    canonical = "\n".join(f'[{section}]\nkey = "{value}"' for section, value in KEYS.items())
+    yield "canonical / final line without newline", canonical
+    yield "commented stale keys", canonical.replace("key =", '# key = "stale"\nkey =')
+    yield "commented headers / mixed line endings", "\n".join(
+        f'# [{section}]\r\n# key = "stale"\r\n[{section}]\nkey = "{value}"'
+        for section, value in KEYS.items()
+    )
+    yield "indented headers and keys / trailing comments", "\n".join(
+        f' \t[ {section} ] \t# header [note]\n \tkey \t= \t"{value}" # key comment'
+        for section, value in KEYS.items()
+    )
+    yield "CRLF", canonical.replace("\n", "\r\n")
+    yield "quoted and spaced section names", "\n".join(
+        f'["{section.split(".")[0]}" . \'{section.split(".")[1]}\''
+        + (f' . "{section.split(".")[2]}"' if section.count(".") == 2 else "")
+        + f'] # original table\nkey = "{value}"'
+        for section, value in KEYS.items()
+    )
+    yield "unrelated quoted header before JWT keys", '["custom section"]\nkey = "other"\n' + canonical
+    yield "brackets in comments", canonical.replace("key =", "# consult [notes]\nkey =")
+    yield "quoted values and quoted key names", "\n".join((
+        '[jwt.signing]\n"key" = "brackets[inside]#value"',
+        "[jwt.signing.read]\n'key' = 'literal\\path[#value]'",
+        r'[jwt.filer_signing]' + '\n' + r'key = "escaped\"quote\\slash\u0041"',
+        '[jwt.filer_signing.read]\nkey = ""',
+    ))
+    yield "absent keys and sections / unrelated key", '\n'.join((
+        '[jwt.signing]\nexpires_after_seconds = 10',
+        '[jwt.signing.read]\nkey = "read-only"',
+        '[unrelated]\nkey = "not-a-jwt-key"',
+        '# [jwt.filer_signing]\n# key = "not-active"',
+    ))
+    yield "no existing security.toml", ""
+
+
+def check_generated(value):
+    decoded = base64.b64decode(value, validate=True).decode("ascii")
+    assert len(decoded) == 10 and decoded.isascii() and decoded.isalnum(), "invalid generated JWT key"
+
+
+def check_helpers(helm, reference_helm):
+    # Exercise the real helper, not a second implementation of its matching rules.
+    with tempfile.TemporaryDirectory(prefix="helm-jwt-helper-") as directory:
+        chart = Path(directory)
+        (chart / "templates").mkdir()
+        (chart / "Chart.yaml").write_text("apiVersion: v2\nname: jwt-regression\nversion: 0.0.0\n")
+        shutil.copyfile(CHART / "templates/shared/_helpers.tpl", chart / "templates/_helpers.tpl")
+        entries = [
+            json.dumps(section) + ': {{ include "seaweedfs.existingTomlKey" (list '
+            + json.dumps(section) + ' .Values.raw) | toJson }}'
+            for section in SECTIONS
+        ]
+        template = chart / "templates/keys.yaml"
+        prefix = '{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"keys"},"data":{'
+        helper_template = prefix + ",".join(entries) + "}}"
+        reference_entries = [
+            json.dumps(section) + ': {{ dig '
+            + " ".join(json.dumps(part) for part in section.split("."))
+            + ' "key" "__ABSENT__" (fromToml .Values.raw) | toJson }}'
+            for section in SECTIONS
+        ]
+        reference_template = prefix + ",".join(reference_entries) + "}}"
+
+        def render(binary, source, raw):
+            template.write_text(source)
+            values = chart / "input.json"
+            values.write_text(json.dumps({"raw": raw}))
+            output = run(binary, "template", "keys", str(chart), "-f", str(values))
+            return json.loads(output[output.index("{"):])["data"]
+
+        for name, raw in fixtures():
+            expected = keys(raw)
+            tokens = render(helm, helper_template, raw)
+            actual = {section: tomllib.loads("key = " + token)["key"]
+                      for section, token in tokens.items() if token != ""}
+            assert actual == expected, f"{name}: extracted keys differ from stored TOML"
+            if reference_helm:
+                reference = render(reference_helm, reference_template, raw)
+                reference = {section: value for section, value in reference.items() if value != "__ABSENT__"}
+                assert actual == reference, f"{name}: keys differ from fromToml/dig"
+            print(f"PASS helper: {name}")
+
+        # A present but unsupported value must not silently become a fresh key.
+        try:
+            render(helm, helper_template, '[jwt.signing]\nkey = """multi\nline"""')
+        except subprocess.CalledProcessError as error:
+            assert "refusing to replace an existing key" in error.stderr, error.stderr
+        else:
+            raise AssertionError("multiline existing key was silently accepted or replaced")
+        print("PASS helper: unsupported existing value fails without rotation")
+
+        try:
+            render(helm, helper_template, ESCAPED_HEADER)
+        except subprocess.CalledProcessError as error:
+            assert "unsupported quoted section header" in error.stderr, error.stderr
+        else:
+            raise AssertionError("unsupported quoted header silently rotated its key")
+        print("PASS helper: unsupported quoted header fails without rotation")
+
+
+def check_upgrades(helm, context):
+    namespace = "jwt-key-persist-" + uuid.uuid4().hex[:8]
+    current = "jk-seaweedfs-security-config"
+    legacy = "seaweedfs-security-config"
+    kubectl = ["kubectl", "--context", context, "-n", namespace]
+    release_args = ["jk", str(CHART), "--kube-context", context, "-n", namespace]
+    # No workload is needed to exercise Helm's real ConfigMap lookup and update.
+    for setting in (
+        "master.enabled=false", "volume.enabled=false", "filer.enabled=false",
+        "global.seaweedfs.createClusterRole=false",
+        "global.seaweedfs.securityConfig.jwtSigning.volumeWrite=true",
+        "global.seaweedfs.securityConfig.jwtSigning.volumeRead=true",
+        "global.seaweedfs.securityConfig.jwtSigning.filerWrite=true",
+        "global.seaweedfs.securityConfig.jwtSigning.filerRead=true",
+    ):
+        release_args += ["--set", setting]
+
+    def stored():
+        cm = json.loads(run(*kubectl, "get", "configmap", current, "-o", "json"))
+        return keys(cm["data"]["security.toml"])
+
+    def upgrade():
+        run(helm, "upgrade", *release_args)
+        return stored()
+
+    def patch(raw):
+        # Seed previous-release content without taking Helm 4's SSA ownership.
+        run(*kubectl, "patch", "configmap", current, "--type=merge", "--field-manager=helm", "-p",
+            json.dumps({"data": {"security.toml": raw}}))
+
+    run(*kubectl, "create", "namespace", namespace)
+    try:
+        run(helm, "install", *release_args)
+        initial = stored()
+        assert set(initial) == set(SECTIONS), "install omitted a JWT section"
+        for value in initial.values():
+            check_generated(value)
+        assert upgrade() == initial, "no-op upgrade changed an existing key"
+        print("PASS upgrade: all four generated keys persist")
+
+        for name, raw in fixtures():
+            patch(raw)
+            actual = upgrade()
+            expected = keys(raw)
+            assert set(actual) == set(SECTIONS), f"{name}: upgrade omitted a JWT section"
+            for section in SECTIONS:
+                if section in expected:
+                    assert actual[section] == expected[section], f"{name}: changed {section}"
+                else:
+                    check_generated(actual[section])
+            assert upgrade() == actual, f"{name}: subsequent upgrade changed a key"
+            print(f"PASS upgrade: {name}")
+
+        # Migration from the old chart name, followed by precedence of the current name.
+        legacy_raw = "\n".join(f'[{section}]\nkey = "legacy-{index}"'
+                               for index, section in enumerate(SECTIONS))
+        run(*kubectl, "create", "configmap", legacy, "--from-literal=security.toml=" + legacy_raw)
+        run(*kubectl, "delete", "configmap", current)
+        assert upgrade() == keys(legacy_raw), "legacy ConfigMap keys were not preserved"
+        print("PASS upgrade: legacy ConfigMap migration")
+        current_raw = next(fixtures())[1]
+        patch(current_raw)
+        assert upgrade() == keys(current_raw), "legacy ConfigMap overrode current ConfigMap"
+        print("PASS upgrade: current ConfigMap takes precedence")
+
+        patch(ESCAPED_HEADER)
+        try:
+            upgrade()
+        except subprocess.CalledProcessError as error:
+            assert "unsupported quoted section header" in error.stderr, error.stderr
+        else:
+            raise AssertionError("unsupported quoted header silently rotated its key")
+        assert keys(run(*kubectl, "get", "configmap", current, "-o",
+                        "jsonpath={.data.security\\.toml}"))["jwt.signing"] == "existing"
+        print("PASS upgrade: unsupported quoted header leaves stored key untouched")
+    finally:
+        run(*kubectl, "delete", "namespace", namespace, "--wait=false")
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--helm", default="helm")
+    parser.add_argument("--reference-helm", help="Helm >=3.17 binary for differential checks")
+    parser.add_argument("--context", help="explicit disposable Kubernetes context for live upgrade checks")
+    args = parser.parse_args()
+    print(run(args.helm, "version", "--short").strip())
+    check_helpers(args.helm, args.reference_helm)
+    if args.context:
+        check_upgrades(args.helm, args.context)
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except subprocess.CalledProcessError as error:
+        print(error.stderr, file=sys.stderr)
+        sys.exit(error.returncode)
diff --git a/.github/scripts/star_history.py b/.github/scripts/star_history.py
new file mode 100644
index 0000000000..fa61a8bcd7
--- /dev/null
+++ b/.github/scripts/star_history.py
@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""Render the repository's star history to note/star_history.svg.
+
+Uses the GitHub REST stargazers endpoint with the starred-at accept header,
+which caps at 40,000 entries (400 pages of 100). The chart is regenerated on
+a schedule; if the repo grows past that cap the script stops at 40,000 and
+logs a warning rather than under-reporting.
+"""
+import json
+import os
+import sys
+import urllib.request
+from datetime import datetime
+
+import matplotlib
+
+matplotlib.use("Agg")
+import matplotlib.pyplot as plt  # noqa: E402
+from matplotlib.dates import AutoDateLocator, DateFormatter  # noqa: E402
+
+REPO = "seaweedfs/seaweedfs"
+TOKEN = os.environ["GITHUB_TOKEN"]
+OUT = os.environ.get("OUT", "note/star_history.svg")
+PAGE_CAP = 400  # GitHub's hard limit on stargazer pagination
+
+
+def fetch_stargazers():
+    stars = []
+    page = 1
+    while page <= PAGE_CAP:
+        url = f"https://api.github.com/repos/{REPO}/stargazers?per_page=100&page={page}"
+        req = urllib.request.Request(
+            url,
+            headers={
+                "Accept": "application/vnd.github.star+json",
+                "Authorization": f"Bearer {TOKEN}",
+                "X-GitHub-Api-Version": "2022-11-28",
+                "User-Agent": "seaweedfs-star-history",
+            },
+        )
+        with urllib.request.urlopen(req) as resp:
+            batch = json.load(resp)
+        if not batch:
+            break
+        for u in batch:
+            sa = u.get("starred_at")
+            if sa:
+                stars.append(datetime.fromisoformat(sa.replace("Z", "+00:00")))
+        if len(batch) < 100:
+            break
+        page += 1
+    if page > PAGE_CAP:
+        print(
+            f"::warning::Hit the {PAGE_CAP}-page stargazer pagination cap; "
+            "chart reflects the first 40,000 stars only."
+        )
+    return stars
+
+
+def render(stars, out):
+    stars.sort()
+    counts = list(range(1, len(stars) + 1))
+    fig, ax = plt.subplots(figsize=(10, 6), dpi=130)
+    ax.plot(stars, counts, color="#0969da", linewidth=1.6)
+    ax.set_xlabel("Date")
+    ax.set_ylabel("Stars")
+    ax.set_title(f"{REPO} star history")
+    ax.grid(True, linestyle="--", alpha=0.3)
+    ax.xaxis.set_major_locator(AutoDateLocator())
+    ax.xaxis.set_major_formatter(DateFormatter("%Y-%m"))
+    fig.autofmt_xdate()
+    fig.tight_layout()
+    fig.savefig(out, format="svg", transparent=False)
+    plt.close(fig)
+
+
+def main():
+    stars = fetch_stargazers()
+    if not stars:
+        print("::error::No stargazers fetched; not updating the chart.")
+        sys.exit(1)
+    render(stars, OUT)
+    print(f"Rendered {len(stars)} stars to {OUT}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/workflows/action-tests.yml b/.github/workflows/action-tests.yml
new file mode 100644
index 0000000000..88f33ed93c
--- /dev/null
+++ b/.github/workflows/action-tests.yml
@@ -0,0 +1,30 @@
+name: "actions: unit tests"
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - '.github/actions/**'
+      - '.github/workflows/action-tests.yml'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - '.github/actions/**'
+      - '.github/workflows/action-tests.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
+permissions:
+  contents: read
+
+jobs:
+  cleanup-stale-fuse-mounts:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+
+      - name: Run cleanup action unit tests
+        run: python3 .github/actions/cleanup-stale-fuse-mounts/test_cleanup.py
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 33d2c10e3b..79adf73c98 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,8 +9,8 @@ on:
       - '.github/workflows/codeql.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/codeql
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 jobs:
   CodeQL-Build:
@@ -25,9 +25,15 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.4
+        uses: github/codeql-action/init@v4.39.0
         # Override language selection by uncommenting this and choosing your languages
         with:
           languages: go
@@ -35,7 +41,7 @@ jobs:
       # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.37.4
+        uses: github/codeql-action/autobuild@v4.39.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -49,4 +55,4 @@ jobs:
       #     make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.4
+        uses: github/codeql-action/analyze@v4.39.0
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 9c4d99a79e..a7be2ead3b 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -8,6 +8,10 @@ on:
   pull_request:
     branches: [master]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/container_dev.yml b/.github/workflows/container_dev.yml
index 8d72fa4a7c..2c30f861a2 100644
--- a/.github/workflows/container_dev.yml
+++ b/.github/workflows/container_dev.yml
@@ -6,17 +6,23 @@ on:
     paths:
       - 'weed/**'
       - 'seaweed-volume/**'
+      - 'seaweed-common/**'
+      - 'seaweed-worker/**'
       - 'docker/**'
       - 'go.mod'
       - 'go.sum'
       - '.github/workflows/container_dev.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
 jobs:
 
-  # ── Pre-build Rust volume server binaries natively ──────────────────
+  # ── Pre-build the Rust binaries natively ────────────────────────────
   build-rust-binaries:
     runs-on: ubuntu-22.04
     strategy:
@@ -31,9 +37,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -52,16 +55,33 @@ jobs:
           echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-docker-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+            seaweed-worker/target/${{ matrix.target }}/release
+          key: rust-docker-dev-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
           restore-keys: |
             rust-docker-dev-${{ matrix.target }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          # The version from the lock, not whatever else a restored cache holds.
+          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
+          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
+          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
+          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       - name: Build normal variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
@@ -70,15 +90,26 @@ jobs:
           cargo build --release --target ${{ matrix.target }} --no-default-features
           cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
 
+      - name: Build the Rust maintenance worker
+        run: |
+          cd seaweed-worker
+          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
+          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: rust-volume-${{ matrix.arch }}
-          path: weed-volume-normal-${{ matrix.arch }}
+          name: rust-bins-${{ matrix.arch }}
+          path: |
+            weed-volume-normal-${{ matrix.arch }}
+            weed-worker-${{ matrix.arch }}
 
   build-dev-containers:
     needs: [build-rust-binaries]
     runs-on: [ubuntu-latest]
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout
@@ -87,7 +118,7 @@ jobs:
       - name: Download pre-built Rust binaries
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-volume-*
+          pattern: rust-bins-*
           merge-multiple: true
           path: ./rust-bins
 
@@ -101,7 +132,16 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
+          mkdir -p docker/weed-worker-prebuilt
+          for arch in amd64 arm64; do
+            src="./rust-bins/weed-worker-${arch}"
+            if [ -f "$src" ]; then
+              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
+              echo "Placed pre-built Rust worker for ${arch}"
+            fi
+          done
           ls -la docker/weed-volume-prebuilt/
+          ls -la docker/weed-worker-prebuilt/
 
       - name: Docker meta
         id: docker_meta
@@ -118,7 +158,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
 
       - name: Create BuildKit config
         run: |
@@ -149,6 +189,7 @@ jobs:
           password: ${{ secrets.GHCR_TOKEN }}
 
       - name: Build
+        id: build
         uses: docker/build-push-action@v7
         with:
           context: ./docker
@@ -157,3 +198,17 @@ jobs:
           platforms: linux/amd64, linux/arm64
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          # Key the checkout layer on the pushed sha so cached layers can't
+          # serve stale code; the Dockerfile fetch fallback picks it up.
+          build-args: |
+            BRANCH=${{ github.sha }}
+
+      - name: Sign
+        if: github.event_name != 'pull_request'
+        uses: ./.github/actions/sign-image
+        with:
+          images: >-
+            chrislusf/seaweedfs@${{ steps.build.outputs.digest }}
+            ghcr.io/chrislusf/seaweedfs@${{ steps.build.outputs.digest }}
diff --git a/.github/workflows/container_foundationdb_version.yml b/.github/workflows/container_foundationdb_version.yml
index 5e2ac35e14..b976a9b245 100644
--- a/.github/workflows/container_foundationdb_version.yml
+++ b/.github/workflows/container_foundationdb_version.yml
@@ -24,12 +24,19 @@ on:
         required: false
         default: ''
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.event.inputs.image_tag || format('foundationdb_{0}_seaweedfs_{1}', github.event.inputs.fdb_version || '7.4.5', github.event.inputs.seaweedfs_ref || github.ref_name) }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
 jobs:
   build-foundationdb-image:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout
@@ -61,6 +68,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Run FoundationDB tagged tests
         env:
@@ -126,7 +134,7 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -154,6 +162,7 @@ jobs:
           fi
 
       - name: Build and push image
+        id: build
         uses: docker/build-push-action@v7
         with:
           context: ./docker
@@ -171,3 +180,8 @@ jobs:
             org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
             org.opencontainers.image.vendor=Chris Lu
 
+      - name: Sign
+        if: github.event_name != 'pull_request'
+        uses: ./.github/actions/sign-image
+        with:
+          images: chrislusf/seaweedfs@${{ steps.build.outputs.digest }}
diff --git a/.github/workflows/container_latest.yml b/.github/workflows/container_latest.yml
index d760006b99..8eccfc89d4 100644
--- a/.github/workflows/container_latest.yml
+++ b/.github/workflows/container_latest.yml
@@ -30,6 +30,11 @@ on:
         type: boolean
         default: false
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.event.inputs.image_tag || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 permissions:
   contents: read
   security-events: write
@@ -59,7 +64,7 @@ jobs:
             echo "publish=true" >> "$GITHUB_OUTPUT"
           fi
 
-  # ── Pre-build Rust volume server binaries natively ──────────────────
+  # ── Pre-build the Rust binaries natively ────────────────────────────
   build-rust-binaries:
     runs-on: ubuntu-22.04
     strategy:
@@ -76,9 +81,6 @@ jobs:
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
 
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -97,16 +99,33 @@ jobs:
           echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+            seaweed-worker/target/${{ matrix.target }}/release
+          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
           restore-keys: |
             rust-docker-${{ matrix.target }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          # The version from the lock, not whatever else a restored cache holds.
+          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
+          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
+          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
+          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       - name: Build large-disk variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
@@ -123,20 +142,27 @@ jobs:
           cargo build --release --target ${{ matrix.target }} --no-default-features
           cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
 
+      - name: Build the Rust maintenance worker
+        run: |
+          cd seaweed-worker
+          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
+          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: rust-volume-${{ matrix.arch }}
+          name: rust-bins-${{ matrix.arch }}
           path: |
             weed-volume-large-disk-${{ matrix.arch }}
             weed-volume-normal-${{ matrix.arch }}
+            weed-worker-${{ matrix.arch }}
 
   build:
     needs: [setup, build-rust-binaries]
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        platform: [amd64, arm64, arm, 386]
+        platform: [amd64, arm64, arm, 386, ppc64le, s390x]
         variant: ${{ fromJSON(needs.setup.outputs.variants) }}
 
     steps:
@@ -144,10 +170,13 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Free Disk Space
         run: |
           echo "Available disk space before cleanup:"
-          df -h
+          timeout 15 df -h || true
           # Remove pre-installed tools
           sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
           # Clean package managers
@@ -159,7 +188,7 @@ jobs:
           [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
           [ -d /go/pkg ] && rm -rf /go/pkg || true
           echo "Available disk space after cleanup:"
-          df -h
+          timeout 15 df -h || true
       
       - name: Configure variant
         id: config
@@ -177,7 +206,7 @@ jobs:
       - name: Download pre-built Rust binaries
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-volume-*
+          pattern: rust-bins-*
           merge-multiple: true
           path: ./rust-bins
 
@@ -191,7 +220,16 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
+          mkdir -p docker/weed-worker-prebuilt
+          for arch in amd64 arm64; do
+            src="./rust-bins/weed-worker-${arch}"
+            if [ -f "$src" ]; then
+              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
+              echo "Placed pre-built Rust worker for ${arch}"
+            fi
+          done
           ls -la docker/weed-volume-prebuilt/
+          ls -la docker/weed-worker-prebuilt/
 
       - name: Docker meta
         id: docker_meta
@@ -207,7 +245,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       - name: Set up QEMU
         if: matrix.platform != 'amd64'
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
       - name: Create BuildKit config
         run: |
           cat > /tmp/buildkitd.toml <<EOF
@@ -289,7 +327,7 @@ jobs:
         if: needs.setup.outputs.publish != 'true'
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-volume-*
+          pattern: rust-bins-*
           merge-multiple: true
           path: ./rust-bins
       - name: Place Rust binaries in Docker context for local scan
@@ -307,7 +345,16 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
+          mkdir -p docker/weed-worker-prebuilt
+          for arch in amd64 arm64; do
+            src="./rust-bins/weed-worker-${arch}"
+            if [ -f "$src" ]; then
+              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
+              echo "Placed pre-built Rust worker for ${arch}"
+            fi
+          done
           ls -la docker/weed-volume-prebuilt/
+          ls -la docker/weed-worker-prebuilt/
       - name: Create BuildKit config for local scan build
         if: needs.setup.outputs.publish != 'true'
         run: |
@@ -367,7 +414,7 @@ jobs:
           output: trivy-results.sarif
           exit-code: '0'
       - name: Upload Trivy scan results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4.37.4
+        uses: github/codeql-action/upload-sarif@v4.39.0
         if: always()
         with:
           sarif_file: trivy-results.sarif
@@ -403,15 +450,19 @@ jobs:
     runs-on: ubuntu-latest
     needs: [setup, build, trivy-scan]
     if: needs.setup.outputs.publish == 'true' && github.event_name != 'pull_request'
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       matrix:
         variant: ${{ fromJSON(needs.setup.outputs.variants) }}
     steps:
-      - name: Checkout
+      - name: Checkout the signing action
         uses: actions/checkout@v7
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }}
-      
+          sparse-checkout: .github/actions
+          persist-credentials: false
+
       - name: Configure variant
         id: config
         run: |
@@ -444,21 +495,31 @@ jobs:
         run: |
           # Install crane for efficient multi-arch image copying
           cd $(mktemp -d)
-          curl -sL "https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz" | tar xz
+          curl -sLO https://github.com/google/go-containerregistry/releases/download/v0.22.0/go-containerregistry_Linux_x86_64.tar.gz
+          echo "edb74d53fad9a596860f59d1c5d04a43dfb5f441dc71f57060dd0bf39483c833  go-containerregistry_Linux_x86_64.tar.gz" | sha256sum -c -
+          tar xzf go-containerregistry_Linux_x86_64.tar.gz crane
           sudo mv crane /usr/local/bin/
           crane version
       - name: Create and push manifest
+        id: manifest
+        env:
+          BASE_TAG: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}
         run: |
           SUFFIX="${{ steps.config.outputs.tag_suffix }}"
-          BASE_TAG="${{ github.event_name == 'workflow_dispatch' && github.event.inputs.image_tag || 'latest' }}"
           
           # Create manifest on GHCR first (no rate limits)
           echo "Creating GHCR manifest (no rate limits)..."
           docker buildx imagetools create -t ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
+            --metadata-file /tmp/manifest.json \
             ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
             ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
             ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386 \
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-ppc64le \
+            ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-s390x
+          # The copy and the signature below use the digest this run pushed, not whatever the tag points at by then.
+          DIGEST=$(jq -er '."containerimage.descriptor".digest' /tmp/manifest.json)
+          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
           
           # Copy the complete multi-arch image from GHCR to Docker Hub
           # This only requires one pull from GHCR (no rate limit) and one push to Docker Hub
@@ -494,16 +555,25 @@ jobs:
           # Use crane or skopeo to copy, fallback to docker if not available
           if command -v crane &> /dev/null; then
             echo "Using crane to copy..."
-            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
+            retry_with_backoff crane copy ghcr.io/chrislusf/seaweedfs@${DIGEST} chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
           elif command -v skopeo &> /dev/null; then
             echo "Using skopeo to copy..."
-            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} docker://chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
+            retry_with_backoff skopeo copy --all docker://ghcr.io/chrislusf/seaweedfs@${DIGEST} docker://chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}
           else
-            echo "Using docker buildx imagetools (pulling 4 images from Docker Hub)..."
+            echo "Using docker buildx imagetools (pulling 6 images from Docker Hub)..."
             # Fallback: create manifest directly on Docker Hub (pulls from Docker Hub - rate limited)
             retry_with_backoff docker buildx imagetools create -t chrislusf/seaweedfs:${BASE_TAG}${SUFFIX} \
               ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-amd64 \
               ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm64 \
               ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-arm \
-              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-386 \
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-ppc64le \
+              ghcr.io/chrislusf/seaweedfs:${BASE_TAG}${SUFFIX}-s390x
           fi
+
+      - name: Sign
+        uses: ./.github/actions/sign-image
+        with:
+          images: >-
+            ghcr.io/chrislusf/seaweedfs@${{ steps.manifest.outputs.digest }}
+            chrislusf/seaweedfs@${{ steps.manifest.outputs.digest }}
diff --git a/.github/workflows/container_release_foundationdb.yml b/.github/workflows/container_release_foundationdb.yml
index ebb098aab0..2050d99604 100644
--- a/.github/workflows/container_release_foundationdb.yml
+++ b/.github/workflows/container_release_foundationdb.yml
@@ -11,6 +11,11 @@ on:
         required: true
         default: ''
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || format('refs/tags/{0}', github.event.inputs.release_tag) || github.run_id }}
+  cancel-in-progress: false
+  queue: max
+
 permissions:
   contents: read
 
@@ -21,6 +26,9 @@ jobs:
 
   build-large-release-container_foundationdb:
     runs-on: [ubuntu-latest]
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       -
@@ -43,7 +51,7 @@ jobs:
             org.opencontainers.image.vendor=Chris Lu
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
       -
         name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
@@ -65,6 +73,7 @@ jobs:
           fi
       -
         name: Build
+        id: build
         uses: docker/build-push-action@v7
         with:
           context: ./docker
@@ -76,4 +85,10 @@ jobs:
           platforms: linux/amd64
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
+      -
+        name: Sign
+        if: github.event_name != 'pull_request'
+        uses: ./.github/actions/sign-image
+        with:
+          images: chrislusf/seaweedfs@${{ steps.build.outputs.digest }}
 
diff --git a/.github/workflows/container_release_unified.yml b/.github/workflows/container_release_unified.yml
index 31cba7e6d5..17d976509e 100644
--- a/.github/workflows/container_release_unified.yml
+++ b/.github/workflows/container_release_unified.yml
@@ -25,7 +25,7 @@ on:
       rocksdb_version:
         description: 'RocksDB git tag to use when variant=rocksdb'
         required: false
-        default: 'v10.10.1'
+        default: 'v11.1.2'
 
 permissions:
   contents: read
@@ -42,9 +42,10 @@ concurrency:
 
 jobs:
 
-  # ── Pre-build Rust volume server binaries natively ──────────────────
-  # Cross-compiles for amd64 and arm64 without QEMU, turning a 5-hour
-  # emulated cargo build into ~15 minutes of native compilation.
+  # ── Pre-build the Rust binaries natively ────────────────────────────
+  # The volume server and the Rust maintenance worker, cross-compiled for
+  # amd64 and arm64 without QEMU, turning a 5-hour emulated cargo build into
+  # ~15 minutes of native compilation.
   build-rust-binaries:
     runs-on: ubuntu-22.04
     strategy:
@@ -59,9 +60,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7
 
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -80,16 +78,33 @@ jobs:
           echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+            seaweed-worker/target/${{ matrix.target }}/release
+          key: rust-docker-${{ matrix.target }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-worker/Cargo.lock') }}
           restore-keys: |
             rust-docker-${{ matrix.target }}-
 
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          # The version from the lock, not whatever else a restored cache holds.
+          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
+          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
+          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
+          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
       - name: Build large-disk variant
         env:
           SEAWEEDFS_COMMIT: ${{ github.sha }}
@@ -106,13 +121,20 @@ jobs:
           cargo build --release --target ${{ matrix.target }} --no-default-features
           cp target/${{ matrix.target }}/release/weed-volume ../weed-volume-normal-${{ matrix.arch }}
 
+      - name: Build the Rust maintenance worker
+        run: |
+          cd seaweed-worker
+          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
+          cp target/${{ matrix.target }}/release/weed-worker ../weed-worker-${{ matrix.arch }}
+
       - name: Upload artifacts
         uses: actions/upload-artifact@v7
         with:
-          name: rust-volume-${{ matrix.arch }}
+          name: rust-bins-${{ matrix.arch }}
           path: |
             weed-volume-large-disk-${{ matrix.arch }}
             weed-volume-normal-${{ matrix.arch }}
+            weed-worker-${{ matrix.arch }}
 
   # One job per (variant, platform) on a native runner, pushed by digest;
   # the merge job stitches the digests into one multi-arch tag.
@@ -128,12 +150,16 @@ jobs:
           - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/arm64,  arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
           - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/arm/v7, arch: armv7, runner: ubuntu-latest,    qemu: true }
           - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/386,    arch: i386,  runner: ubuntu-latest,    qemu: false }
+          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/ppc64le, arch: ppc64le, runner: ubuntu-latest,  qemu: true }
+          - { variant: normal, tag_suffix: "",             dockerfile: ./docker/Dockerfile.go_build, build_args: "",               rust_variant: normal,     platform: linux/s390x,   arch: s390x, runner: ubuntu-latest,    qemu: true }
 
           # Large disk - multi-arch
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/amd64,  arch: amd64, runner: ubuntu-latest,    qemu: false }
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/arm64,  arch: arm64, runner: ubuntu-24.04-arm, qemu: false }
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/arm/v7, arch: armv7, runner: ubuntu-latest,    qemu: true }
           - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/386,    arch: i386,  runner: ubuntu-latest,    qemu: false }
+          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/ppc64le, arch: ppc64le, runner: ubuntu-latest,  qemu: true }
+          - { variant: large_disk, tag_suffix: _large_disk, dockerfile: ./docker/Dockerfile.go_build, build_args: TAGS=5BytesOffset, rust_variant: large-disk, platform: linux/s390x,   arch: s390x, runner: ubuntu-latest,    qemu: true }
 
           # Full tags - multi-arch
           - { variant: full, tag_suffix: _full, dockerfile: ./docker/Dockerfile.go_build, build_args: "TAGS=elastic,gocdk,rclone,sqlite,tarantool,tikv,ydb", rust_variant: normal, platform: linux/amd64, arch: amd64, runner: ubuntu-latest,    qemu: false }
@@ -154,11 +180,15 @@ jobs:
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Download pre-built Rust binaries
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         uses: actions/download-artifact@v8
         with:
-          pattern: rust-volume-*
+          pattern: rust-bins-*
           merge-multiple: true
           path: ./rust-bins
 
@@ -173,7 +203,16 @@ jobs:
               echo "Placed pre-built Rust binary for ${arch}"
             fi
           done
+          mkdir -p docker/weed-worker-prebuilt
+          for arch in amd64 arm64; do
+            src="./rust-bins/weed-worker-${arch}"
+            if [ -f "$src" ]; then
+              cp "$src" "docker/weed-worker-prebuilt/weed-worker-${arch}"
+              echo "Placed pre-built Rust worker for ${arch}"
+            fi
+          done
           ls -la docker/weed-volume-prebuilt/
+          ls -la docker/weed-worker-prebuilt/
 
       - name: Free Disk Space
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -184,7 +223,7 @@ jobs:
           sudo docker system prune -af --volumes
           [ -d ~/.cache/go-build ] && rm -rf ~/.cache/go-build || true
           [ -d /go/pkg ] && rm -rf /go/pkg || true
-          df -h
+          timeout 15 df -h || true
 
       - name: Docker meta
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -201,7 +240,7 @@ jobs:
 
       - name: Set up QEMU
         if: (github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant) && matrix.qemu
-        uses: docker/setup-qemu-action@v4.2.0
+        uses: docker/setup-qemu-action@v4.4.0
 
       - name: Create BuildKit config
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -236,8 +275,11 @@ jobs:
           file: ${{ matrix.dockerfile }}
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.docker_meta.outputs.labels }}
-          # Flat single-platform manifest so imagetools create assembles cleanly.
-          provenance: false
+          # mode=max keeps resolvedDependencies complete and records the
+          # builder identity; attestations ride inside each pushed index and
+          # survive the imagetools merge into the multi-arch manifest.
+          provenance: mode=max
+          sbom: true
           outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
           cache-from: type=gha,scope=${{ matrix.variant }}-${{ matrix.arch }}
           # max only for rocksdb: its RocksDB compile is sha-independent and worth
@@ -247,7 +289,7 @@ jobs:
             ${{ matrix.build_args }}
             BUILDKIT_INLINE_CACHE=1
             BRANCH=${{ github.sha }}
-            ${{ matrix.variant == 'rocksdb' && format('ROCKSDB_VERSION={0}', github.event.inputs.rocksdb_version || 'v10.10.1') || '' }}
+            ${{ matrix.variant == 'rocksdb' && format('ROCKSDB_VERSION={0}', github.event.inputs.rocksdb_version || 'v11.1.2') || '' }}
 
       - name: Export digest
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -265,10 +307,16 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
-  # Assemble each variant's per-platform digests into one tag, then mirror to Docker Hub.
+  # Assemble each variant's per-platform digests into one tag, mirror it to
+  # Docker Hub, and sign the result on both registries.
   merge:
     needs: [build]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -279,6 +327,13 @@ jobs:
           - { variant: large_disk_full, tag_suffix: _large_disk_full }
           - { variant: rocksdb,         tag_suffix: _large_disk_rocksdb }
     steps:
+      - name: Checkout the signing action
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: .github/actions
+          persist-credentials: false
+
       - name: Download digests
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         uses: actions/download-artifact@v8
@@ -301,12 +356,17 @@ jobs:
 
       - name: Create multi-arch tag on GHCR
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
+        id: manifest
         working-directory: /tmp/digests
         run: |
           docker buildx imagetools create \
             -t ${{ env.IMAGE }}:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }} \
+            --metadata-file /tmp/manifest.json \
             $(printf '${{ env.IMAGE }}@sha256:%s ' *)
           docker buildx imagetools inspect ${{ env.IMAGE }}:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
+          # The copy and the signature below use the digest this run pushed, not whatever the tag points at by then.
+          digest=$(jq -er '."containerimage.descriptor".digest' /tmp/manifest.json)
+          echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
       - name: Login to Docker Hub
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
@@ -319,7 +379,9 @@ jobs:
         if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
         run: |
           cd $(mktemp -d)
-          curl -sL "https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz" | tar xz
+          curl -sLO https://github.com/google/go-containerregistry/releases/download/v0.22.0/go-containerregistry_Linux_x86_64.tar.gz
+          echo "edb74d53fad9a596860f59d1c5d04a43dfb5f441dc71f57060dd0bf39483c833  go-containerregistry_Linux_x86_64.tar.gz" | sha256sum -c -
+          tar xzf go-containerregistry_Linux_x86_64.tar.gz crane
           sudo mv crane /usr/local/bin/
           crane version
 
@@ -350,10 +412,57 @@ jobs:
 
           echo "Copying ${{ matrix.variant }} from GHCR to Docker Hub..."
           retry_with_backoff crane copy \
-            ${{ env.IMAGE }}:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }} \
+            ${{ env.IMAGE }}@${{ steps.manifest.outputs.digest }} \
             chrislusf/seaweedfs:${{ env.RELEASE_TAG }}${{ matrix.tag_suffix }}
           echo "Copied ${{ matrix.variant }} to Docker Hub"
 
+      - name: Sign ${{ matrix.variant }}
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
+        uses: ./.github/actions/sign-image
+        with:
+          images: >-
+            ${{ env.IMAGE }}@${{ steps.manifest.outputs.digest }}
+            chrislusf/seaweedfs@${{ steps.manifest.outputs.digest }}
+
+      # Attest the merged multi-arch digest itself, so digest-pinning consumers
+      # can verify provenance against the exact index they pull. Both steps
+      # reuse the GHCR login above and push as OCI referrers.
+      - name: Attest build provenance for ${{ matrix.variant }}
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-name: ${{ env.IMAGE }}
+          subject-digest: ${{ steps.manifest.outputs.digest }}
+          push-to-registry: true
+
+      # SBOMs are generated and attested per platform manifest: an index-wide
+      # scan only describes syft's default platform, while the manifests it
+      # merges differ (some ship the real binary, others placeholders), so the
+      # SBOM has to be bound to the platform digest a consumer actually pulls.
+      - name: Install syft
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
+        uses: anchore/sbom-action/download-syft@v0
+
+      - name: Attest per-platform SBOMs for ${{ matrix.variant }}
+        if: github.event_name != 'workflow_dispatch' || github.event.inputs.variant == 'all' || github.event.inputs.variant == matrix.variant
+        working-directory: /tmp/digests
+        run: |
+          set -euo pipefail
+          for f in *; do
+            # Each saved digest is an OCI index (image + attestation manifests);
+            # scan and attest the image manifest a same-platform pull resolves.
+            ref="${{ env.IMAGE }}@sha256:${f}"
+            image=$(crane manifest "$ref" | jq -r '
+              [.manifests[]? | select((.annotations["vnd.docker.reference.type"] // "") != "attestation-manifest"
+                and (.platform.os // "unknown") != "unknown") | .digest][0] // empty')
+            ref="${{ env.IMAGE }}@${image:-sha256:${f}}"
+            syft "registry:${ref}" -o "spdx-json=/tmp/sbom-${f}.spdx.json"
+            cosign attest --yes \
+              --predicate "/tmp/sbom-${f}.spdx.json" \
+              --type spdxjson \
+              "$ref"
+          done
+
   # Report-only trivy scan: uploads fixable HIGH/CRITICAL findings to GitHub
   # Security for visibility, but never blocks the release. Releases (including
   # `latest`) ship regardless — vulnerabilities are tracked, not gated, since
@@ -392,7 +501,9 @@ jobs:
           scanners: vuln
           vuln-type: os,library
           severity: HIGH,CRITICAL
-          ignore-unfixed: true
+          # Keep unfixed findings in the report so digest-pinning consumers see
+          # the complete picture, not just what a patch could resolve.
+          ignore-unfixed: false
           limit-severities-for-sarif: true
           format: sarif
           output: trivy-results.sarif
@@ -400,7 +511,7 @@ jobs:
 
       - name: Upload Trivy scan results to GitHub Security
         if: always()
-        uses: github/codeql-action/upload-sarif@v4.37.4
+        uses: github/codeql-action/upload-sarif@v4.39.0
         with:
           sarif_file: trivy-results.sarif
           category: trivy-${{ matrix.variant }}
@@ -409,7 +520,8 @@ jobs:
   # image. crane tag adds an extra tag to an existing manifest — no rebuild,
   # no QEMU, no separate workflow. Replaces the old container_latest.yml
   # rebuild that often failed or lagged behind the release. Independent of
-  # trivy-scan: vuln findings are reported but do not block `latest`.
+  # trivy-scan: vuln findings are reported but do not block `latest`. The
+  # cosign signature is attached to the digest, so `latest` carries it too.
   tag-latest:
     runs-on: ubuntu-latest
     needs: [merge]
@@ -438,7 +550,9 @@ jobs:
       - name: Install crane
         run: |
           cd $(mktemp -d)
-          curl -sL "https://github.com/google/go-containerregistry/releases/latest/download/go-containerregistry_Linux_x86_64.tar.gz" | tar xz
+          curl -sLO https://github.com/google/go-containerregistry/releases/download/v0.22.0/go-containerregistry_Linux_x86_64.tar.gz
+          echo "edb74d53fad9a596860f59d1c5d04a43dfb5f441dc71f57060dd0bf39483c833  go-containerregistry_Linux_x86_64.tar.gz" | sha256sum -c -
+          tar xzf go-containerregistry_Linux_x86_64.tar.gz crane
           sudo mv crane /usr/local/bin/
           crane version
 
diff --git a/.github/workflows/container_rocksdb_version.yml b/.github/workflows/container_rocksdb_version.yml
index 0ab6eeb3e9..0d3b5f2b8f 100644
--- a/.github/workflows/container_rocksdb_version.yml
+++ b/.github/workflows/container_rocksdb_version.yml
@@ -4,9 +4,9 @@ on:
   workflow_dispatch:
     inputs:
       rocksdb_version:
-        description: 'RocksDB git tag or branch to build (e.g. v10.10.1)'
+        description: 'RocksDB git tag or branch to build (e.g. v11.1.2)'
         required: true
-        default: 'v10.10.1'
+        default: 'v11.1.2'
       seaweedfs_ref:
         description: 'SeaweedFS git tag, branch, or commit to build'
         required: true
@@ -16,12 +16,20 @@ on:
         required: false
         default: ''
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.inputs.image_tag || format('rocksdb_{0}_seaweedfs_{1}', github.event.inputs.rocksdb_version, github.event.inputs.seaweedfs_ref) }}
+  cancel-in-progress: false
+  queue: max
+
 permissions:
   contents: read
 
 jobs:
   build-rocksdb-image:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - name: Checkout
@@ -82,7 +90,7 @@ jobs:
           echo "seaweedfs_ref=$seaweed" >> "$GITHUB_OUTPUT"
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v1
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v1
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v1
@@ -94,6 +102,7 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Build and push image
+        id: build
         uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v2
         with:
           context: ./docker
@@ -108,3 +117,8 @@ jobs:
             org.opencontainers.image.title=seaweedfs
             org.opencontainers.image.description=SeaweedFS is a distributed storage system for blobs, objects, files, and data lake, to store and serve billions of files fast!
             org.opencontainers.image.vendor=Chris Lu
+
+      - name: Sign
+        uses: ./.github/actions/sign-image
+        with:
+          images: chrislusf/seaweedfs@${{ steps.build.outputs.digest }}
diff --git a/.github/workflows/deploy_telemetry.yml b/.github/workflows/deploy_telemetry.yml
index 2c67e51f8d..2f45c64176 100644
--- a/.github/workflows/deploy_telemetry.yml
+++ b/.github/workflows/deploy_telemetry.yml
@@ -27,6 +27,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'telemetry/server/go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Build Telemetry Server
         if: github.event_name == 'workflow_dispatch' && inputs.deploy
@@ -35,11 +36,48 @@ jobs:
           cd telemetry/server
           go mod tidy
           echo "Building telemetry server..."
-          GOOS=linux GOARCH=amd64 go build -o ../../telemetry-server .
+          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ../../telemetry-server .
           cd ../..
           ls -la telemetry-server
           echo "Build completed successfully"
 
+      - name: Generate Service Configuration
+        if: github.event_name == 'workflow_dispatch' && (inputs.setup || inputs.deploy)
+        env:
+          REMOTE_USER: ${{ secrets.TELEMETRY_USER }}
+        run: |
+          # Create systemd service file
+          echo "
+          [Unit]
+          Description=SeaweedFS Telemetry Server
+          After=network.target
+
+          [Service]
+          Type=simple
+          User=$REMOTE_USER
+          WorkingDirectory=/home/$REMOTE_USER/seaweedfs-telemetry
+          ExecStart=/bin/sh -c 'exec /home/$REMOTE_USER/seaweedfs-telemetry/bin/telemetry-server -port=8353 >>/home/$REMOTE_USER/seaweedfs-telemetry/logs/telemetry.log 2>>/home/$REMOTE_USER/seaweedfs-telemetry/logs/telemetry.error.log'
+          Restart=always
+          RestartSec=5
+
+          [Install]
+          WantedBy=multi-user.target" > telemetry.service
+
+          # Setup logrotate configuration
+          echo "# SeaweedFS Telemetry service log rotation
+          /home/$REMOTE_USER/seaweedfs-telemetry/logs/*.log {
+              daily
+              rotate 30
+              compress
+              delaycompress
+              missingok
+              notifempty
+              create 644 $REMOTE_USER $REMOTE_USER
+              postrotate
+                  systemctl restart telemetry.service
+              endscript
+          }" > telemetry_logrotate
+
       - name: First-time Server Setup
         if: github.event_name == 'workflow_dispatch' && inputs.setup
         env:
@@ -61,40 +99,6 @@ jobs:
             touch ~/seaweedfs-telemetry/logs/telemetry.log ~/seaweedfs-telemetry/logs/telemetry.error.log && \
             chmod 644 ~/seaweedfs-telemetry/logs/*.log"
 
-          # Create systemd service file
-          echo "
-          [Unit]
-          Description=SeaweedFS Telemetry Server
-          After=network.target
-
-          [Service]
-          Type=simple
-          User=$REMOTE_USER
-          WorkingDirectory=/home/$REMOTE_USER/seaweedfs-telemetry
-          ExecStart=/home/$REMOTE_USER/seaweedfs-telemetry/bin/telemetry-server -port=8353
-          Restart=always
-          RestartSec=5
-          StandardOutput=append:/home/$REMOTE_USER/seaweedfs-telemetry/logs/telemetry.log
-          StandardError=append:/home/$REMOTE_USER/seaweedfs-telemetry/logs/telemetry.error.log
-
-          [Install]
-          WantedBy=multi-user.target" > telemetry.service
-
-          # Setup logrotate configuration
-          echo "# SeaweedFS Telemetry service log rotation
-          /home/$REMOTE_USER/seaweedfs-telemetry/logs/*.log {
-              daily
-              rotate 30
-              compress
-              delaycompress
-              missingok
-              notifempty
-              create 644 $REMOTE_USER $REMOTE_USER
-              postrotate
-                  systemctl restart telemetry.service
-              endscript
-          }" > telemetry_logrotate
-
           # Copy configuration files
           scp -i ~/.ssh/deploy_key telemetry/grafana-dashboard.json $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
           scp -i ~/.ssh/deploy_key telemetry/prometheus.yml $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
@@ -137,11 +141,18 @@ jobs:
           scp -i ~/.ssh/deploy_key telemetry/grafana-dashboard.json $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
           scp -i ~/.ssh/deploy_key telemetry/prometheus.yml $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
 
+          # Copy updated service and logrotate files
+          scp -i ~/.ssh/deploy_key telemetry.service telemetry_logrotate $REMOTE_USER@$REMOTE_HOST:~/seaweedfs-telemetry/
+
           # Check if service exists and deploy accordingly
           ssh -i ~/.ssh/deploy_key $REMOTE_USER@$REMOTE_HOST "
             if systemctl list-unit-files telemetry.service >/dev/null 2>&1; then
               echo 'Service exists, performing update...'
+              set -e
               sudo systemctl stop telemetry.service
+              sudo mv ~/seaweedfs-telemetry/telemetry.service /etc/systemd/system/
+              sudo mv ~/seaweedfs-telemetry/telemetry_logrotate /etc/logrotate.d/seaweedfs-telemetry
+              sudo systemctl daemon-reload
               mkdir -p ~/seaweedfs-telemetry/bin
               mv ~/seaweedfs-telemetry/tmp/telemetry-server ~/seaweedfs-telemetry/bin/
               chmod +x ~/seaweedfs-telemetry/bin/telemetry-server
diff --git a/.github/workflows/depsreview.yml b/.github/workflows/depsreview.yml
index e4338c240a..0ba5dbcd2c 100644
--- a/.github/workflows/depsreview.yml
+++ b/.github/workflows/depsreview.yml
@@ -1,6 +1,10 @@
 name: 'Dependency Review'
 on: [pull_request]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index a0aa5c7965..363627df27 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -19,8 +19,8 @@ on:
       - '.github/workflows/e2e.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/e2e
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -42,6 +42,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
     - name: Configure Docker Hub mirror
       run: |
@@ -52,6 +53,7 @@ jobs:
       uses: docker/setup-buildx-action@v4
       
     - name: Cache Docker layers
+      if: runner.environment == 'github-hosted'
       uses: actions/cache@v6
       with:
         path: /tmp/.buildx-cache
@@ -61,13 +63,10 @@ jobs:
 
     - name: Install dependencies
       run: |
-        # Use faster mirrors and install with timeout
         sudo rm -f /etc/apt/sources.list.d/azure-cli.list /etc/apt/sources.list.d/microsoft-prod.list
-        echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs) main restricted universe multiverse" | sudo tee /etc/apt/sources.list
-        echo "deb http://azure.archive.ubuntu.com/ubuntu/ $(lsb_release -cs)-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list
-        
-        sudo apt-get update --fix-missing
-        sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends fuse
+        # Same helper the e2e image installs through: the runner's own list is
+        # azure-only too, and an outage there fails this step outright.
+        sudo ./apt-install fuse
         
         # Verify FUSE installation
         echo "FUSE version: $(fusermount --version 2>&1 || echo 'fusermount not found')"
diff --git a/.github/workflows/ec-integration-tests.yml b/.github/workflows/ec-integration-tests.yml
index d510d63b8b..a1ddfa8e65 100644
--- a/.github/workflows/ec-integration-tests.yml
+++ b/.github/workflows/ec-integration-tests.yml
@@ -18,6 +18,10 @@ on:
       - 'go.sum'
       - '.github/workflows/ec-integration-tests.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
@@ -30,7 +34,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
+        cache: ${{ runner.environment == 'github-hosted' }}
+        go-version: ^1.26
       id: go
 
     - name: Check out code into the Go module directory
@@ -43,7 +48,10 @@ jobs:
     - name: Run EC Integration Tests
       working-directory: test/erasure_coding
       run: |
-        go test -v
+        # The suite now includes the interruption matrix and runs close to Go's
+        # default 10m binary timeout on slower runners; bound it by the job's
+        # 30m budget instead.
+        go test -v -timeout 25m
 
     - name: Collect server logs on failure
       if: failure()
diff --git a/.github/workflows/fuse-dlm-integration.yml b/.github/workflows/fuse-dlm-integration.yml
index 6ce3f0724c..869eae40ad 100644
--- a/.github/workflows/fuse-dlm-integration.yml
+++ b/.github/workflows/fuse-dlm-integration.yml
@@ -19,8 +19,8 @@ on:
       - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/fuse-dlm-integration
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -39,11 +39,13 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
-      - name: Install FUSE dependencies
+      - name: Configure FUSE
         run: |
-          sudo apt-get update
-          sudo apt-get install -y libfuse3-dev
+          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
+          # and go-fuse is pure Go, so the libfuse headers were never linked
+          # against.
           echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
           sudo chmod 644 /etc/fuse.conf
 
diff --git a/.github/workflows/fuse-failover.yml b/.github/workflows/fuse-failover.yml
new file mode 100644
index 0000000000..2c03cf9369
--- /dev/null
+++ b/.github/workflows/fuse-failover.yml
@@ -0,0 +1,80 @@
+name: "FUSE Volume Server Failover Tests"
+
+on:
+  pull_request:
+    paths:
+      - 'weed/command/mount*.go'
+      - 'weed/mount/**'
+      - 'weed/filer/**'
+      - 'weed/wdclient/**'
+      - 'weed/operation/upload_content.go'
+      - 'test/fuse_failover/**'
+      - '.github/workflows/fuse-failover.yml'
+      - '.github/actions/fix-fusermount-setuid/**'
+  push:
+    branches: [master]
+    paths:
+      - 'weed/command/mount*.go'
+      - 'weed/mount/**'
+      - 'weed/filer/**'
+      - 'weed/wdclient/**'
+      - 'weed/operation/upload_content.go'
+      - 'test/fuse_failover/**'
+      - '.github/workflows/fuse-failover.yml'
+      - '.github/actions/fix-fusermount-setuid/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
+permissions:
+  contents: read
+
+jobs:
+  fuse-failover:
+    name: FUSE Volume Server Failover
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+
+      - name: Configure FUSE
+        run: |
+          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
+          # and go-fuse is pure Go, so the libfuse headers were never linked
+          # against.
+          echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
+          sudo chmod 644 /etc/fuse.conf
+
+      - name: Repair the fusermount3 setuid bit
+        uses: ./.github/actions/fix-fusermount-setuid
+
+      - name: Build SeaweedFS
+        run: go build -o weed/weed -buildvcs=false ./weed
+
+      - name: Run failover integration tests
+        timeout-minutes: 35
+        env:
+          WEED_BINARY: ${{ github.workspace }}/weed/weed
+        run: go test -v -count=1 -timeout=30m ./test/fuse_failover/...
+
+      - name: Upload logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: fuse-failover-test-logs
+          path: /tmp/seaweedfs-fuse-failover-logs/
+          retention-days: 3
diff --git a/.github/workflows/fuse-integration.yml b/.github/workflows/fuse-integration.yml
index 72bb23ad57..f45e3ed0a1 100644
--- a/.github/workflows/fuse-integration.yml
+++ b/.github/workflows/fuse-integration.yml
@@ -17,8 +17,8 @@ on:
       - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
-  group: ${{ github.head_ref }}/fuse-integration
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -37,13 +37,12 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
-    - name: Install FUSE and dependencies
+    - name: Configure FUSE
       run: |
-        sudo apt-get update
-        # fuse3 is pre-installed on ubuntu-22.04 runners and conflicts
-        # with the legacy fuse package, so only install the dev headers.
-        sudo apt-get install -y libfuse3-dev
+        # Nothing to install: fuse3 ships fusermount3 and is pre-installed, and
+        # go-fuse is pure Go, so the libfuse headers were never linked against.
         # Allow non-root FUSE mounts with allow_other
         echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
         sudo chmod 644 /etc/fuse.conf
diff --git a/.github/workflows/fuse-p2p-integration.yml b/.github/workflows/fuse-p2p-integration.yml
index 8cdc181470..a65f5ddbc2 100644
--- a/.github/workflows/fuse-p2p-integration.yml
+++ b/.github/workflows/fuse-p2p-integration.yml
@@ -25,8 +25,8 @@ on:
       - '.github/actions/fix-fusermount-setuid/**'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/fuse-p2p-integration
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -41,15 +41,20 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
-      - name: Install FUSE dependencies
+      - name: Configure FUSE
         run: |
-          sudo apt-get update
-          sudo apt-get install -y libfuse3-dev
+          # Nothing to install: fuse3 ships fusermount3 and is pre-installed,
+          # and go-fuse is pure Go, so the libfuse headers were never linked
+          # against.
           echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
           sudo chmod 644 /etc/fuse.conf
 
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index a2c5364ce2..0a06fbf6be 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -17,8 +17,8 @@ on:
       - '.github/workflows/go.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/go
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -35,6 +35,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
     - name: Get dependencies
       run: |
         cd weed; go get -v -t -d ./...
@@ -57,6 +58,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
     - name: Go Vet linux/386 (type-checks code and tests for 32-bit int overflows)
       run: |
         GOOS=linux GOARCH=386 go vet ./... 2>&1 | grep -v "MessageState contains sync.Mutex" | grep -v "IdentityAccessManagement contains sync.RWMutex" | tee vet-32bit-output.txt
@@ -72,6 +74,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
     - name: Build
       run: cd weed; go build -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v .
 
@@ -94,6 +97,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
     # Nothing else on a PR compiles these, so per-OS syscall constants creep
     # back into shared files unnoticed and only a release build catches it.
     - name: Cross-compile
@@ -111,6 +115,16 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    services:
+      redis:
+        image: redis:8
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
     steps:
     - name: Check out code into the Go module directory
       uses: actions/checkout@v7
@@ -118,7 +132,10 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
     - name: Test
+      env:
+        RUN_REDIS_TESTS: "1"
       run: cd weed; go test -tags "elastic gocdk sqlite ydb tarantool tikv rclone" -v ./...
 
   test-32bit:
@@ -131,8 +148,28 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
     # 386 test binaries run natively on the amd64 runner. This catches what vet
     # can't: unaligned 64-bit atomics and arithmetic that wraps at runtime.
     # -short skips the e2e suites already covered on amd64.
     - name: Test linux/386
       run: cd weed; GOOS=linux GOARCH=386 go test -short ./...
+
+  build-azurekms:
+    name: Build and test with azurekms tag
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v7
+    - name: Set up Go
+      uses: actions/setup-go@v7
+      with:
+        go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
+    # weed/kms/azure is excluded from every default build, so without this
+    # nothing compiles it and tag-gated code silently rots.
+    - name: Build and test with azurekms
+      run: |
+        cd weed
+        go build -tags azurekms ./...
+        go test -tags azurekms ./kms/...
diff --git a/.github/workflows/helm_ci.yml b/.github/workflows/helm_ci.yml
index 554f85fbc4..0a75617d79 100644
--- a/.github/workflows/helm_ci.yml
+++ b/.github/workflows/helm_ci.yml
@@ -3,10 +3,14 @@ name: "helm: lint and test charts"
 on:
   push:
     branches: [ master ]
-    paths: ['k8s/**']
+    paths: ['k8s/**', '.github/workflows/helm_ci.yml', '.github/scripts/helm_jwt_keys.py']
   pull_request:
     branches: [ master ]
-    paths: ['k8s/**']
+    paths: ['k8s/**', '.github/workflows/helm_ci.yml', '.github/scripts/helm_jwt_keys.py']
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -20,6 +24,14 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up Helm before fromToml was available
+        uses: azure/setup-helm@v5
+        with:
+          version: v3.16.3
+
+      - name: Record legacy Helm binary
+        run: echo "HELM_LEGACY=$(command -v helm)" >> "$GITHUB_ENV"
+
       - name: Set up Helm
         uses: azure/setup-helm@v5
         with:
@@ -31,7 +43,7 @@ jobs:
           check-latest: true
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.8.0
+        uses: helm/chart-testing-action@v2.9.0
 
       - name: Run chart-testing (list-changed)
         id: list-changed
@@ -44,6 +56,17 @@ jobs:
       - name: Run chart-testing (lint)
         run: ct lint --target-branch ${{ github.event.repository.default_branch }} --all --validate-maintainers=false --chart-dirs k8s/charts
 
+      - name: Verify legacy Helm rendering
+        run: |
+          "$HELM_LEGACY" lint k8s/charts/seaweedfs
+          "$HELM_LEGACY" template test k8s/charts/seaweedfs > "$RUNNER_TEMP/legacy-default.yaml"
+          "$HELM_LEGACY" template test k8s/charts/seaweedfs \
+            --set global.seaweedfs.securityConfig.jwtSigning.volumeRead=true \
+            --set global.seaweedfs.securityConfig.jwtSigning.filerWrite=true \
+            --set global.seaweedfs.securityConfig.jwtSigning.filerRead=true \
+            > "$RUNNER_TEMP/legacy-jwt.yaml"
+
+
       - name: Verify template rendering
         run: |
           set -e
@@ -57,17 +80,164 @@ jobs:
           helm template test $CHART_DIR --set s3.enabled=true > /tmp/s3.yaml
           grep -q "kind: Deployment" /tmp/s3.yaml && grep -q "seaweedfs-s3" /tmp/s3.yaml
           echo "S3 deployment renders correctly"
-          
+
+          echo "=== Testing S3 rollout settings ==="
+          helm template test $CHART_DIR --show-only templates/s3/s3-deployment.yaml \
+            --set s3.enabled=true > /tmp/s3-rollout-defaults.yaml
+          grep -q "terminationGracePeriodSeconds: 10$" /tmp/s3-rollout-defaults.yaml
+          test "$(grep -cE '^  strategy:|^ +lifecycle:' /tmp/s3-rollout-defaults.yaml)" -eq 0
+          helm template test $CHART_DIR --show-only templates/s3/s3-deployment.yaml \
+            --set s3.enabled=true \
+            --set s3.terminationGracePeriodSeconds=30 \
+            --set s3.updateStrategy.type=RollingUpdate \
+            --set s3.updateStrategy.rollingUpdate.maxUnavailable=0 \
+            --set-string 's3.lifecycle.preStop.exec.command={sleep,5}' \
+            > /tmp/s3-rollout.yaml
+          grep -q "terminationGracePeriodSeconds: 30$" /tmp/s3-rollout.yaml
+          grep -A 4 "^  strategy:" /tmp/s3-rollout.yaml | grep -q "maxUnavailable: 0"
+          grep -A 4 "^  strategy:" /tmp/s3-rollout.yaml | grep -q "type: RollingUpdate"
+          grep -A 5 "^          lifecycle:" /tmp/s3-rollout.yaml | grep -q -- "- sleep"
+          echo "S3 rollout settings render correctly"
+
+          echo "=== Testing the S3 config checksum is stable across renders ==="
+          # s3-secret.yaml keeps its generated keys with lookup. Hashing the rendered
+          # Secret drew new keys for the checksum whenever lookup found nothing (on
+          # install), so the first upgrade changed the checksum and restarted the
+          # filer and S3 pods although nothing had changed.
+          s3_checksum() {  # <template> <helm args...>: the checksum/s3config of one workload
+            local template=$1; shift
+            local sum
+            sum=$(helm template test $CHART_DIR --show-only "$template" "$@" \
+              | grep 'checksum/s3config:' | awk '{print $2}')
+            test -n "$sum" || { echo "no checksum/s3config in $template" >&2; return 1; }
+            echo "$sum"
+          }
+          s3_auth_args=(--set s3.enabled=true --set s3.enableAuth=true)
+          s3_sum=$(s3_checksum templates/s3/s3-deployment.yaml "${s3_auth_args[@]}")
+          filer_sum=$(s3_checksum templates/filer/filer-statefulset.yaml "${s3_auth_args[@]}")
+          test "$s3_sum" = "$filer_sum"   # one Secret, one checksum
+          test "$s3_sum" = "$(s3_checksum templates/s3/s3-deployment.yaml "${s3_auth_args[@]}")"
+          s3_creds_sum=$(s3_checksum templates/s3/s3-deployment.yaml "${s3_auth_args[@]}" \
+            --set s3.credentials.admin.accessKey=a --set s3.credentials.admin.secretKey=b)
+          test "$s3_sum" != "$s3_creds_sum"
+          filer_audit_sum=$(s3_checksum templates/filer/filer-statefulset.yaml "${s3_auth_args[@]}" \
+            --set-json 'filer.s3.auditLogConfig={"fluent_port":24224}')
+          test "$filer_sum" != "$filer_audit_sum"
+          # Settings the Secret does not read must not restart the S3 and filer pods.
+          test "$filer_sum" = "$(s3_checksum templates/filer/filer-statefulset.yaml "${s3_auth_args[@]}" \
+            --set s3.replicas=3 --set s3.resources.limits.cpu=1)"
+          all_in_one_args=(--set allInOne.enabled=true --set allInOne.s3.enabled=true --set allInOne.s3.enableAuth=true)
+          aio_sum=$(s3_checksum templates/all-in-one/all-in-one-deployment.yaml "${all_in_one_args[@]}")
+          test "$aio_sum" = "$(s3_checksum templates/all-in-one/all-in-one-deployment.yaml "${all_in_one_args[@]}")"
+          aio_creds_sum=$(s3_checksum templates/all-in-one/all-in-one-deployment.yaml "${all_in_one_args[@]}" \
+            --set s3.credentials.admin.accessKey=a --set s3.credentials.admin.secretKey=b)
+          test "$aio_sum" != "$aio_creds_sum"
+          echo "S3 config checksum is stable and follows only what the S3 Secret reads"
+
+          echo "=== Testing S3 credentials from an existing secret ==="
+          credential_args=(
+            --set s3.credentials.admin.existingSecret=minio-root
+            --set s3.credentials.admin.accessKeyKey=root-user
+            --set s3.credentials.admin.secretKeyKey=root-password
+            --set s3.credentials.read.existingSecret=minio-root
+          )
+          for workload in \
+            "s3.enabled=true,s3.enableAuth=true" \
+            "filer.s3.enabled=true,filer.s3.enableAuth=true" \
+            "allInOne.enabled=true,allInOne.s3.enabled=true,allInOne.s3.enableAuth=true"
+          do
+            helm template test $CHART_DIR --set "$workload" "${credential_args[@]}" > /tmp/s3-existing-credentials.yaml
+            # The identities file names the variables, and each is bound to the key it was pointed at.
+            grep -q 'accessKey":"${SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID}' /tmp/s3-existing-credentials.yaml
+            grep -q 'secretKey":"${SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY}' /tmp/s3-existing-credentials.yaml
+            grep -q 'accessKey":"${SEAWEEDFS_S3_READ_ACCESS_KEY_ID}' /tmp/s3-existing-credentials.yaml
+            for pair in \
+              "SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID root-user" \
+              "SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY root-password" \
+              "SEAWEEDFS_S3_READ_ACCESS_KEY_ID read_access_key_id" \
+              "SEAWEEDFS_S3_READ_SECRET_ACCESS_KEY read_secret_access_key"
+            do
+              set -- $pair
+              grep -A 4 -- "- name: $1\$" /tmp/s3-existing-credentials.yaml | grep -q "name: \"minio-root\""
+              grep -A 4 -- "- name: $1\$" /tmp/s3-existing-credentials.yaml | grep -q "key: \"$2\""
+            done
+            # The keys stay in the user's secret rather than being copied into the chart's.
+            ! grep -qE "^  (admin|read)_(access_key_id|secret_access_key):" /tmp/s3-existing-credentials.yaml
+            echo "S3 credentials reference the existing secret for $workload"
+          done
+
+          echo "=== Testing ingress labels ==="
+          helm template test $CHART_DIR --set s3.enabled=true,s3.ingress.enabled=true \
+            --set s3.ingress.labels.external-dns=s3 > /tmp/s3-ingress-labels.yaml
+          grep -A 12 "^kind: Ingress" /tmp/s3-ingress-labels.yaml | grep -q "^    external-dns: s3"
+          echo "S3 ingress renders custom labels"
+
+          echo "=== Testing HTTPRoute ==="
+          helm template test $CHART_DIR --show-only templates/s3/s3-httproute.yaml \
+            --set s3.enabled=true,s3.httpRoute.enabled=true \
+            --set 's3.httpRoute.parentRefs[0].name=gateway' > /tmp/s3-httproute.yaml
+          grep -q "^kind: HTTPRoute" /tmp/s3-httproute.yaml
+          grep -A 4 -- '- group: ""' /tmp/s3-httproute.yaml | grep -q "name: test-seaweedfs-s3$"
+          grep -A 4 -- '- group: ""' /tmp/s3-httproute.yaml | grep -q "port: 8333$"
+          echo "S3 HTTPRoute routes to the s3 service by default"
+          helm template test $CHART_DIR --show-only templates/s3/s3-httproute.yaml \
+            --set filer.s3.enabled=true,filer.s3.port=8334,s3.httpRoute.enabled=true > /tmp/filer-s3-httproute.yaml
+          grep -A 4 -- '- group: ""' /tmp/filer-s3-httproute.yaml | grep -q "port: 8334$"
+          echo "S3 on filer HTTPRoute uses filer.s3.port"
+          helm template test $CHART_DIR --show-only templates/master/master-httproute.yaml \
+            --set allInOne.enabled=true,master.enabled=false,master.httpRoute.enabled=true > /tmp/allinone-master-httproute.yaml
+          grep -A 4 -- '- group: ""' /tmp/allinone-master-httproute.yaml | grep -q "name: test-seaweedfs-all-in-one$"
+          echo "All-in-one master HTTPRoute routes to the all-in-one service"
+
           echo "=== Testing with all-in-one mode ==="
           helm template test $CHART_DIR --set allInOne.enabled=true > /tmp/allinone.yaml
           grep -q "seaweedfs-all-in-one" /tmp/allinone.yaml
           echo "All-in-one deployment renders correctly"
+
+          echo "=== Testing the all-in-one s3 secret is created by every flag that mounts it ==="
+          for auth in allInOne.s3.enableAuth s3.enableAuth filer.s3.enableAuth; do
+            helm template test $CHART_DIR \
+              --set allInOne.enabled=true --set allInOne.s3.enabled=true --set "$auth=true" \
+              > /tmp/allinone-s3-auth.yaml
+            grep -q "secretName: test-seaweedfs-s3-secret" /tmp/allinone-s3-auth.yaml
+            grep -q "name: test-seaweedfs-s3-secret" /tmp/allinone-s3-auth.yaml
+            echo "All-in-one s3 secret renders for $auth"
+          done
           
           echo "=== Testing with security enabled ==="
           helm template test $CHART_DIR --set global.seaweedfs.enableSecurity=true > /tmp/security.yaml
           grep -q "security-config" /tmp/security.yaml
           echo "Security configuration renders correctly"
 
+          echo "=== Testing secure bucket-creation hook certificate mounts ==="
+          helm template test $CHART_DIR \
+            --show-only templates/shared/post-install-bucket-hook.yaml \
+            --set s3.enabled=true \
+            --set 's3.createBuckets[0].name=data' \
+            --set global.seaweedfs.enableSecurity=true \
+            > /tmp/security-bucket-hook.yaml
+          test "$(grep -cE '^[[:space:]]*- name: ca-cert$' /tmp/security-bucket-hook.yaml)" -eq 2
+          test "$(grep -cE '^[[:space:]]*- name: client-cert$' /tmp/security-bucket-hook.yaml)" -eq 2
+          grep -q 'mountPath: /usr/local/share/ca-certificates/ca/' /tmp/security-bucket-hook.yaml
+          grep -q 'mountPath: /usr/local/share/ca-certificates/client/' /tmp/security-bucket-hook.yaml
+          grep -q 'secretName: test-seaweedfs-ca-cert' /tmp/security-bucket-hook.yaml
+          grep -q 'secretName: test-seaweedfs-client-cert' /tmp/security-bucket-hook.yaml
+          echo "Secure bucket-creation hook mounts its CA and client certificate"
+
+          echo ""
+          echo "=== Testing admin.allowInsecureBind satisfies the admin auth render guard ==="
+          helm template test $CHART_DIR --set admin.enabled=true --set admin.allowInsecureBind=true \
+            > /tmp/admin-allow-insecure-bind.yaml
+          grep -q -- "-allowInsecureBind" /tmp/admin-allow-insecure-bind.yaml
+          echo "admin.allowInsecureBind renders -allowInsecureBind and passes the render guard"
+
+          if helm template test $CHART_DIR --set admin.enabled=true > /tmp/admin-no-auth.yaml 2>/tmp/admin-no-auth.err; then
+            echo "FAIL: admin.enabled=true with no auth configured should fail to render"
+            exit 1
+          fi
+          grep -q "admin.allowInsecureBind" /tmp/admin-no-auth.err
+          echo "admin with no auth configured still fails the render guard, and the guard mentions admin.allowInsecureBind"
+
           echo ""
           echo "=== Testing JWT expiration overrides ==="
           helm template test $CHART_DIR \
@@ -179,6 +349,9 @@ jobs:
           out = render({
               "global.seaweedfs.securityConfig.jwtSigning.filerWrite": "true",
               "admin.enabled": "true",
+              # admin.ip defaults to 0.0.0.0 (non-loopback), which weed admin 4.46
+              # refuses to bind without authentication.
+              "admin.secret.adminPassword": "ci-admin-password",
           })
           cm = configmap(out, "test-seaweedfs-security-config")
           if cm is None:
@@ -440,6 +613,41 @@ jobs:
             --set filer.s3.enableAuth=true > /tmp/filer-s3.yaml
           echo "Filer S3 gateway renders correctly"
           
+          echo "=== Testing the mysql filer store gates its secret and env ==="
+          helm template test $CHART_DIR \
+            --set-string filer.extraEnvironmentVars.WEED_MONGODB_ENABLED=true \
+            --set-string filer.extraEnvironmentVars.WEED_LEVELDB2_ENABLED=false > /tmp/filer-mongodb.yaml
+          ! grep -q "db-secret" /tmp/filer-mongodb.yaml
+          ! grep -q "WEED_MYSQL" /tmp/filer-mongodb.yaml
+          grep -q "name: WEED_MONGODB_ENABLED" /tmp/filer-mongodb.yaml
+          helm template test $CHART_DIR \
+            --set-string filer.extraEnvironmentVars.WEED_MYSQL_ENABLED=true > /tmp/filer-mysql.yaml
+          grep -q "name: test-seaweedfs-db-secret" /tmp/filer-mysql.yaml
+          grep -q "name: WEED_MYSQL_USERNAME" /tmp/filer-mysql.yaml
+          grep -q "name: WEED_MYSQL_PASSWORD" /tmp/filer-mysql.yaml
+          grep -q "name: WEED_MYSQL_HOSTNAME" /tmp/filer-mysql.yaml
+          # Secret-backed keys follow the same rule as the plain ones.
+          helm template test $CHART_DIR \
+            --set filer.secretExtraEnvironmentVars.WEED_MYSQL_PASSWORD.secretKeyRef.name=db \
+            --set filer.secretExtraEnvironmentVars.WEED_MYSQL_PASSWORD.secretKeyRef.key=password > /tmp/filer-mysql-off-secret.yaml
+          ! grep -q "WEED_MYSQL" /tmp/filer-mysql-off-secret.yaml
+          helm template test $CHART_DIR \
+            --set-string filer.extraEnvironmentVars.WEED_MYSQL_ENABLED=true \
+            --set filer.secretExtraEnvironmentVars.WEED_MYSQL_PASSWORD.secretKeyRef.name=db \
+            --set filer.secretExtraEnvironmentVars.WEED_MYSQL_PASSWORD.secretKeyRef.key=password > /tmp/filer-mysql-on-secret.yaml
+          grep -A 4 -- "- name: WEED_MYSQL_PASSWORD$" /tmp/filer-mysql-on-secret.yaml | grep -q "name: db"
+          # A flag the chart cannot read counts as selected, not as off.
+          helm template test $CHART_DIR \
+            --set filer.secretExtraEnvironmentVars.WEED_MYSQL_ENABLED.secretKeyRef.name=store \
+            --set filer.secretExtraEnvironmentVars.WEED_MYSQL_ENABLED.secretKeyRef.key=enabled > /tmp/filer-mysql-secret.yaml
+          grep -q "name: test-seaweedfs-db-secret" /tmp/filer-mysql-secret.yaml
+          grep -q "name: WEED_MYSQL_HOSTNAME" /tmp/filer-mysql-secret.yaml
+          helm template test $CHART_DIR \
+            --set-string filer.extraEnvironmentVars.WEED_MYSQL2_HOSTNAME=other > /tmp/filer-mysql2.yaml
+          grep -q "name: WEED_MYSQL2_HOSTNAME" /tmp/filer-mysql2.yaml
+          ! grep -q "WEED_MYSQL_" /tmp/filer-mysql2.yaml
+          echo "The mysql secret and env follow the selected filer store"
+
           echo "=== Testing SFTP enabled ==="
           helm template test $CHART_DIR --set sftp.enabled=true > /tmp/sftp.yaml
           grep -q "seaweedfs-sftp" /tmp/sftp.yaml
@@ -618,6 +826,168 @@ jobs:
           helm template test $CHART_DIR --set cosi.enabled=true > /tmp/cosi.yaml
           grep -q "seaweedfs-cosi" /tmp/cosi.yaml
           echo "COSI driver renders correctly"
+
+          echo ""
+          echo "=== Testing configurable pod and container security contexts ==="
+          helm template test $CHART_DIR > /tmp/security-context-defaults.yaml
+
+          security_context_args=()
+          for component in master volume filer s3 sftp admin worker allInOne cosi; do
+            security_context_args+=(
+              --set "$component.podSecurityContext.enabled=true"
+              --set "$component.podSecurityContext.seccompProfile.type=RuntimeDefault"
+              --set "$component.containerSecurityContext.enabled=true"
+              --set "$component.containerSecurityContext.privileged=false"
+              --set "$component.containerSecurityContext.allowPrivilegeEscalation=false"
+              --set "$component.containerSecurityContext.readOnlyRootFilesystem=true"
+              --set "$component.containerSecurityContext.capabilities.drop[0]=ALL"
+              --set "$component.containerSecurityContext.seccompProfile.type=RuntimeDefault"
+            )
+          done
+
+          helm template test $CHART_DIR \
+            "${security_context_args[@]}" \
+            --set s3.enabled=true \
+            --set s3.createBuckets[0].name=test \
+            --set sftp.enabled=true \
+            --set admin.enabled=true \
+            --set admin.secret.adminPassword=ci-admin-password \
+            --set worker.enabled=true \
+            --set volume.idx.type=hostPath \
+            --set volume.idx.hostPathPrefix=/tmp \
+            --set cosi.enabled=true \
+            --set global.seaweedfs.tmpDir.sizeLimit=64Mi > /tmp/security-contexts.yaml
+          helm template test $CHART_DIR \
+            "${security_context_args[@]}" \
+            --set allInOne.enabled=true \
+            --set master.enabled=false \
+            --set volume.enabled=false \
+            --set filer.enabled=false \
+            --set global.seaweedfs.tmpDir.sizeLimit=64Mi > /tmp/security-contexts-aio.yaml
+          python3 - /tmp/security-context-defaults.yaml /tmp/security-contexts.yaml /tmp/security-contexts-aio.yaml <<'PYEOF'
+          import sys
+
+          import yaml
+
+          errors = []
+          workloads = 0
+          containers = 0
+          chart_managed_init_containers = 0
+          components = set()
+
+          def validate_container(workload_name, container):
+              context = container.get("securityContext", {})
+              prefix = f"{workload_name}/{container['name']}"
+              if "enabled" in context:
+                  errors.append(f"{prefix}: internal enabled flag leaked into container securityContext")
+              if context.get("privileged") is not False:
+                  errors.append(f"{prefix}: privileged is not false")
+              if context.get("allowPrivilegeEscalation") is not False:
+                  errors.append(f"{prefix}: allowPrivilegeEscalation is not false")
+              if context.get("readOnlyRootFilesystem") is not True:
+                  errors.append(f"{prefix}: readOnlyRootFilesystem is not true")
+              if context.get("capabilities", {}).get("drop") != ["ALL"]:
+                  errors.append(f"{prefix}: capabilities.drop is not exactly [ALL]")
+              if context.get("seccompProfile", {}).get("type") != "RuntimeDefault":
+                  errors.append(f"{prefix}: seccompProfile is not RuntimeDefault")
+              mounts = {mount["name"]: mount for mount in container.get("volumeMounts", [])}
+              if mounts.get("seaweedfs-tmp", {}).get("mountPath") != "/tmp":
+                  errors.append(f"{prefix}: writable temporary volume is not mounted at /tmp")
+
+          with open(sys.argv[1]) as stream:
+              default_documents = [document for document in yaml.safe_load_all(stream) if document]
+          for document in default_documents:
+              if document.get("kind") not in ("Deployment", "StatefulSet", "Job"):
+                  continue
+              name = document["metadata"]["name"]
+              pod = document["spec"]["template"]["spec"]
+              if "securityContext" in pod:
+                  errors.append(f"{name}: pod securityContext should be absent by default")
+              if any(volume["name"] == "seaweedfs-tmp" for volume in pod.get("volumes", [])):
+                  errors.append(f"{name}: writable /tmp volume should be absent by default")
+              for container in pod.get("containers", []):
+                  if "securityContext" in container:
+                      errors.append(
+                          f"{name}/{container['name']}: container securityContext "
+                          f"should be absent by default"
+                      )
+                  if any(
+                      mount["name"] == "seaweedfs-tmp"
+                      for mount in container.get("volumeMounts", [])
+                  ):
+                      errors.append(
+                          f"{name}/{container['name']}: writable /tmp mount "
+                          f"should be absent by default"
+                      )
+
+          for path in sys.argv[2:]:
+              with open(path) as stream:
+                  documents = [document for document in yaml.safe_load_all(stream) if document]
+              for document in documents:
+                  if document.get("kind") not in ("Deployment", "StatefulSet", "Job"):
+                      continue
+                  workloads += 1
+                  name = document["metadata"]["name"]
+                  pod = document["spec"]["template"]["spec"]
+                  volumes = {volume["name"]: volume for volume in pod.get("volumes", [])}
+                  temporary = volumes.get("seaweedfs-tmp", {}).get("emptyDir")
+                  if temporary is None:
+                      errors.append(f"{name}: writable /tmp emptyDir is missing")
+                  elif temporary.get("sizeLimit") != "64Mi":
+                      errors.append(f"{name}: temporary volume sizeLimit is not 64Mi")
+                  component = document["spec"]["template"]["metadata"]["labels"].get("app.kubernetes.io/component")
+                  if component:
+                      components.add(component)
+                  else:
+                      errors.append(f"{name}: app.kubernetes.io/component label is missing")
+                  pod_context = pod.get("securityContext", {})
+                  if "enabled" in pod_context:
+                      errors.append(f"{name}: internal enabled flag leaked into pod securityContext")
+                  if pod_context.get("seccompProfile", {}).get("type") != "RuntimeDefault":
+                      errors.append(f"{name}: pod seccompProfile is not RuntimeDefault")
+                  for container in pod.get("containers", []):
+                      containers += 1
+                      validate_container(name, container)
+                  for container in pod.get("initContainers", []):
+                      if container["name"] != "seaweedfs-vol-move-idx":
+                          continue
+                      chart_managed_init_containers += 1
+                      validate_container(name, container)
+
+          expected_components = {
+              "master", "volume", "filer", "s3", "sftp", "admin", "worker",
+              "objectstorage-provisioner", "bucket-hook", "seaweedfs-all-in-one",
+          }
+          if components != expected_components:
+              errors.append(
+                  f"security context workload coverage is incomplete: "
+                  f"expected {sorted(expected_components)}, got {sorted(components)}"
+              )
+          if workloads != 10 or containers != 12:
+              errors.append(
+                  f"expected 10 workloads and 12 containers, got "
+                  f"{workloads} workloads and {containers} containers"
+              )
+          if chart_managed_init_containers != 1:
+              errors.append(
+                  f"expected one chart-managed seaweedfs-vol-move-idx init container, "
+                  f"got {chart_managed_init_containers}"
+              )
+
+          if errors:
+              print("\n".join(f"FAIL: {error}" for error in errors), file=sys.stderr)
+              sys.exit(1)
+          print(f"Validated security contexts on {workloads} workloads and {containers} containers")
+          PYEOF
+
+          # The resize hook depends on lookup finding a live StatefulSet and
+          # therefore cannot render during helm template. Keep static coverage
+          # for both security-context blocks.
+          grep -Fqx '      securityContext: {{- omit .Values.volume.podSecurityContext "enabled" | toYaml | nindent 8 }}' \
+            "$CHART_DIR/templates/volume/volume-resize-hook.yaml"
+          grep -Fqx '          securityContext: {{- omit .Values.volume.containerSecurityContext "enabled" | toYaml | nindent 12 }}' \
+            "$CHART_DIR/templates/volume/volume-resize-hook.yaml"
+          echo "Volume resize hook security contexts are covered"
           
           echo ""
           echo "=== Testing long release name: service names match DNS references ==="
@@ -1058,6 +1428,9 @@ jobs:
               "s3.enabled": "true",
               "sftp.enabled": "true",
               "admin.enabled": "true",
+              # admin.ip defaults to 0.0.0.0 (non-loopback), which weed admin 4.46
+              # refuses to bind without authentication.
+              "admin.secret.adminPassword": "ci-admin-password",
               "worker.enabled": "true",
               "cosi.enabled": "true",
               "s3.createBuckets[0].name": "b",
@@ -1254,7 +1627,7 @@ jobs:
           # Which means egress on its own must render for a release that runs
           # neither COSI nor a resize: no component of it reaches the API server,
           # so nothing may demand a CIDR for one.
-          for label, values in {"defaults": {}, "admin": {"admin.enabled": "true"}}.items():
+          for label, values in {"defaults": {}, "admin": {"admin.enabled": "true", "admin.secret.adminPassword": "ci-admin-password"}}.items():
               try:
                   render(dict(values, **{"networkPolicy.enabled": "true",
                                          "networkPolicy.egress.enabled": "true"}))
@@ -1315,6 +1688,9 @@ jobs:
 
           ALL_ON = {
               "admin.enabled": "true",
+              # admin.ip defaults to 0.0.0.0 (non-loopback), which weed admin 4.46
+              # refuses to bind without authentication.
+              "admin.secret.adminPassword": "ci-admin-password",
               "s3.enabled": "true",
               "sftp.enabled": "true",
               "worker.enabled": "true",
@@ -1472,11 +1848,109 @@ jobs:
 
           echo "All template rendering tests passed!"
 
+      - name: Resolve an image tag that is published
+        run: |
+          set -e
+          # A release bumps appVersion on master ~40 minutes before the container
+          # build publishes that tag, and this workflow runs on the bump commit.
+          # Install the last released image for the length of that window instead
+          # of failing on ImagePullBackOff.
+          IMAGE=$(helm template test k8s/charts/seaweedfs \
+            -s templates/master/master-statefulset.yaml | awk '$1 == "image:" {print $2; exit}')
+          REPO=${IMAGE%:*}
+          TAG=${IMAGE##*:}
+          # Anything but a published tag installs latest, which between releases
+          # is the same digest as the chart's own appVersion, so a registry blip
+          # costs nothing while failing the job on one would cost a red build.
+          STATUS=$(curl -sSL --connect-timeout 5 --max-time 15 -o /dev/null \
+            -w '%{http_code}' "https://hub.docker.com/v2/repositories/$REPO/tags/$TAG" || true)
+          if [ "$STATUS" = 200 ]; then
+            echo "installing $IMAGE"
+          else
+            echo "$IMAGE is unavailable (HTTP ${STATUS:-none}), installing $REPO:latest"
+            TAG=latest
+          fi
+          echo "IMAGE_TAG=$TAG" >> $GITHUB_ENV
+
       - name: Create kind cluster
-        uses: helm/kind-action@v1.14.0
+        uses: helm/kind-action@v1.15.1
+
+      - name: Verify volume resize hook security contexts
+        run: |
+          set -e
+          CHART_DIR="k8s/charts/seaweedfs"
+          NS="resize-hook-security"
+          kubectl create namespace "$NS"
+          kubectl apply -n "$NS" -f - <<'EOF'
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          metadata:
+            name: data1-resize-seaweedfs-volume-0
+          spec:
+            accessModes:
+              - ReadWriteOnce
+            resources:
+              requests:
+                storage: 1Gi
+          EOF
+
+          helm template resize "$CHART_DIR" -n "$NS" --dry-run=server \
+            --set volume.dataDirs[0].name=data1 \
+            --set volume.dataDirs[0].type=persistentVolumeClaim \
+            --set volume.dataDirs[0].size=2Gi \
+            --set volume.podSecurityContext.enabled=true \
+            --set volume.podSecurityContext.seccompProfile.type=RuntimeDefault \
+            --set volume.containerSecurityContext.enabled=true \
+            --set volume.containerSecurityContext.privileged=false \
+            --set volume.containerSecurityContext.allowPrivilegeEscalation=false \
+            --set volume.containerSecurityContext.readOnlyRootFilesystem=true \
+            --set volume.containerSecurityContext.capabilities.drop[0]=ALL \
+            --set volume.containerSecurityContext.seccompProfile.type=RuntimeDefault \
+            --set global.seaweedfs.tmpDir.sizeLimit=64Mi \
+            > /tmp/security-context-resize-hook.yaml
+
+          python3 - /tmp/security-context-resize-hook.yaml <<'PYEOF'
+          import sys
+
+          import yaml
+
+          with open(sys.argv[1]) as stream:
+              documents = [document for document in yaml.safe_load_all(stream) if document]
+
+          jobs = [
+              document for document in documents
+              if document.get("kind") == "Job"
+              and document["metadata"]["name"].endswith("-volume-resize-hook")
+          ]
+          if len(jobs) != 1:
+              raise AssertionError(f"expected one volume resize hook Job, got {len(jobs)}")
+
+          pod = jobs[0]["spec"]["template"]["spec"]
+          assert pod["securityContext"] == {
+              "seccompProfile": {"type": "RuntimeDefault"},
+          }
+          assert len(pod["containers"]) == 1
+          assert pod["containers"][0]["securityContext"] == {
+              "allowPrivilegeEscalation": False,
+              "capabilities": {"drop": ["ALL"]},
+              "privileged": False,
+              "readOnlyRootFilesystem": True,
+              "seccompProfile": {"type": "RuntimeDefault"},
+          }
+          assert pod["containers"][0]["volumeMounts"] == [
+              {"mountPath": "/tmp", "name": "seaweedfs-tmp"},
+          ]
+          assert pod["volumes"] == [
+              {"emptyDir": {"sizeLimit": "64Mi"}, "name": "seaweedfs-tmp"},
+          ]
+          PYEOF
+          kubectl delete namespace "$NS"
+          echo "Volume resize hook security contexts render correctly"
 
       - name: Run chart-testing (install)
-        run: ct install --target-branch ${{ github.event.repository.default_branch }} --all --chart-dirs k8s/charts
+        run: |
+          ct install --target-branch ${{ github.event.repository.default_branch }} --all --chart-dirs k8s/charts \
+            --helm-extra-set-args "--set=image.tag=$IMAGE_TAG"
 
       - name: Verify SFTP host key secret lifecycle
         run: |
@@ -1484,7 +1958,7 @@ jobs:
           CHART_DIR="k8s/charts/seaweedfs"
           NS="sftp-hostkey"
           SECRET="hk-seaweedfs-sftp-ssh-secret"
-          SFTP_ARGS="--set sftp.enabled=true --set master.enabled=false --set volume.enabled=false --set filer.enabled=false"
+          SFTP_ARGS="--set image.tag=$IMAGE_TAG --set sftp.enabled=true --set master.enabled=false --set volume.enabled=false --set filer.enabled=false"
           kubectl create namespace "$NS"
 
           echo "=== install generates a host key, upgrade keeps it ==="
@@ -1523,6 +1997,16 @@ jobs:
           kubectl delete namespace "$NS"
           echo "SFTP host key lifecycle tests passed"
 
+      - name: Verify JWT signing key persistence across upgrades
+        run: |
+          # chart-testing puts its pip-less venv first on PATH; use setup-python.
+          PYTHON="$pythonLocation/bin/python3"
+          "$PYTHON" -m pip install tomli==2.2.1
+          CONTEXT=$(kubectl config current-context)
+          "$PYTHON" .github/scripts/helm_jwt_keys.py --context "$CONTEXT"
+          "$PYTHON" .github/scripts/helm_jwt_keys.py --helm "$HELM_LEGACY" \
+            --reference-helm helm --context "$CONTEXT"
+
       - name: Verify install into a default-deny namespace
         run: |
           set -e
@@ -1561,6 +2045,7 @@ jobs:
           # release if the hook Job does not finish, so a clean install is the
           # assertion.
           helm install np $CHART_DIR -n "$NS" --wait --timeout 8m \
+            --set image.tag=$IMAGE_TAG \
             --set s3.enabled=true \
             --set s3.createBuckets[0].name=testbucket \
             --set networkPolicy.enabled=true \
diff --git a/.github/workflows/java_integration_tests.yml b/.github/workflows/java_integration_tests.yml
index 0d945cd1eb..cdb61b3faf 100644
--- a/.github/workflows/java_integration_tests.yml
+++ b/.github/workflows/java_integration_tests.yml
@@ -14,6 +14,10 @@ on:
       - 'weed/**'
       - '.github/workflows/java_integration_tests.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 jobs:
   test:
     name: Java Integration Tests
@@ -31,14 +35,15 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
       
       - name: Set up Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
-          cache: 'maven'
+          cache: ${{ runner.environment == 'github-hosted' && 'maven' || '' }}
       
       - name: Build SeaweedFS
         run: |
@@ -55,6 +60,7 @@ jobs:
           # Start SeaweedFS with optimized settings for CI
           # Include S3 API for s3copier integration tests
           weed server -dir="$WEED_DATA_DIR" \
+            -ip=127.0.0.1 -ip.bind=127.0.0.1 \
             -master.raftHashicorp \
             -master.electionTimeout=1s \
             -master.volumeSizeLimitMB=100 \
diff --git a/.github/workflows/java_release.yml b/.github/workflows/java_release.yml
index 08dd16c980..3cde5af868 100644
--- a/.github/workflows/java_release.yml
+++ b/.github/workflows/java_release.yml
@@ -73,11 +73,11 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           java-version: '17'
           distribution: 'temurin'
-          cache: 'maven'
+          cache: ${{ runner.environment == 'github-hosted' && 'maven' || '' }}
           server-id: central
           server-username: MAVEN_CENTRAL_USERNAME
           server-password: MAVEN_CENTRAL_PASSWORD
diff --git a/.github/workflows/java_unit_tests.yml b/.github/workflows/java_unit_tests.yml
index 5dfc8e6fed..ed29f8dab3 100644
--- a/.github/workflows/java_unit_tests.yml
+++ b/.github/workflows/java_unit_tests.yml
@@ -12,6 +12,10 @@ on:
       - 'other/java/**'
       - '.github/workflows/java_unit_tests.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 jobs:
   test:
     name: Java Unit Tests
@@ -26,11 +30,11 @@ jobs:
         uses: actions/checkout@v7
       
       - name: Set up Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           java-version: ${{ matrix.java }}
           distribution: 'temurin'
-          cache: 'maven'
+          cache: ${{ runner.environment == 'github-hosted' && 'maven' || '' }}
       
       - name: Build and Install SeaweedFS Client
         working-directory: other/java/client
diff --git a/.github/workflows/kafka-quicktest.yml b/.github/workflows/kafka-quicktest.yml
index cf8e898c8a..f48c5487df 100644
--- a/.github/workflows/kafka-quicktest.yml
+++ b/.github/workflows/kafka-quicktest.yml
@@ -24,8 +24,8 @@ on:
   workflow_dispatch:  # Allow manual trigger
 
 concurrency:
-  group: ${{ github.head_ref }}/kafka-quicktest
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -42,8 +42,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
-        cache: true
+        go-version: ^1.26
+        cache: ${{ runner.environment == 'github-hosted' }}
         cache-dependency-path: |
           **/go.sum
       id: go
diff --git a/.github/workflows/kafka-tests.yml b/.github/workflows/kafka-tests.yml
index 7d82844fb2..4a59cb6724 100644
--- a/.github/workflows/kafka-tests.yml
+++ b/.github/workflows/kafka-tests.yml
@@ -23,8 +23,8 @@ on:
       - '.github/workflows/kafka-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/kafka-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 # Force different runners for better isolation
 env:
@@ -43,7 +43,7 @@ jobs:
       matrix:
         container-id: [unit-tests-1]
     container:
-      image: golang:1.24-alpine
+      image: golang:1.26-alpine
       options: --cpus 1.0 --memory 1g --hostname kafka-unit-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -53,7 +53,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
+        cache: ${{ runner.environment == 'github-hosted' }}
+        go-version: ^1.26
       id: go
 
     - name: Check out code
@@ -87,7 +88,7 @@ jobs:
       matrix:
         container-id: [integration-1]
     container:
-      image: golang:1.24-alpine
+      image: golang:1.26-alpine
       options: --cpus 2.0 --memory 2g --ulimit nofile=1024:1024 --hostname kafka-integration-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 2
@@ -98,7 +99,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
+        cache: ${{ runner.environment == 'github-hosted' }}
+        go-version: ^1.26
       id: go
 
     - name: Check out code
@@ -134,7 +136,7 @@ jobs:
       matrix:
         container-id: [e2e-1]
     container:
-      image: golang:1.24-alpine
+      image: golang:1.26-alpine
       options: --cpus 2.0 --memory 2g --hostname kafka-e2e-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 2
@@ -148,8 +150,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
-        cache: true
+        go-version: ^1.26
+        cache: ${{ runner.environment == 'github-hosted' }}
         cache-dependency-path: |
           **/go.sum
       id: go
@@ -313,7 +315,7 @@ jobs:
       matrix:
         container-id: [consumer-group-1]
     container:
-      image: golang:1.24-alpine
+      image: golang:1.26-alpine
       options: --cpus 1.0 --memory 2g --ulimit nofile=512:512 --hostname kafka-consumer-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -327,8 +329,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
-        cache: true
+        go-version: ^1.26
+        cache: ${{ runner.environment == 'github-hosted' }}
         cache-dependency-path: |
           **/go.sum
       id: go
@@ -475,7 +477,7 @@ jobs:
       matrix:
         container-id: [client-compat-1]
     container:
-      image: golang:1.24-alpine
+      image: golang:1.26-alpine
       options: --cpus 1.0 --memory 1.5g --shm-size 256m --hostname kafka-client-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -489,8 +491,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
-        cache: true
+        go-version: ^1.26
+        cache: ${{ runner.environment == 'github-hosted' }}
         cache-dependency-path: |
           **/go.sum
       id: go
@@ -633,7 +635,7 @@ jobs:
       matrix:
         container-id: [smq-integration-1]
     container:
-      image: golang:1.24-alpine
+      image: golang:1.26-alpine
       options: --cpus 1.0 --memory 2g --hostname kafka-smq-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -647,8 +649,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
-        cache: true
+        go-version: ^1.26
+        cache: ${{ runner.environment == 'github-hosted' }}
         cache-dependency-path: |
           **/go.sum
       id: go
@@ -794,7 +796,7 @@ jobs:
       matrix:
         container-id: [protocol-1]
     container:
-      image: golang:1.24-alpine
+      image: golang:1.26-alpine
       options: --cpus 1.0 --memory 1g --tmpfs /tmp:exec --hostname kafka-protocol-${{ matrix.container-id }}
     env:
       GOMAXPROCS: 1
@@ -805,7 +807,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
+        cache: ${{ runner.environment == 'github-hosted' }}
+        go-version: ^1.26
       id: go
 
     - name: Check out code
diff --git a/.github/workflows/kms-tests.yml b/.github/workflows/kms-tests.yml
index 3c997fd523..6b77a896f1 100644
--- a/.github/workflows/kms-tests.yml
+++ b/.github/workflows/kms-tests.yml
@@ -19,8 +19,8 @@ on:
       - 'test/kms/**'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}-kms-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -43,6 +43,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -88,6 +89,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
diff --git a/.github/workflows/master-cold-start-tests.yml b/.github/workflows/master-cold-start-tests.yml
index bd0ed72243..bc96b833bf 100644
--- a/.github/workflows/master-cold-start-tests.yml
+++ b/.github/workflows/master-cold-start-tests.yml
@@ -21,8 +21,8 @@ on:
       - '.github/workflows/master-cold-start-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/master-cold-start-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -42,6 +42,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Build weed binary
         run: |
diff --git a/.github/workflows/metadata-subscribe-tests.yml b/.github/workflows/metadata-subscribe-tests.yml
index b47c16b9cd..b0bb96bc25 100644
--- a/.github/workflows/metadata-subscribe-tests.yml
+++ b/.github/workflows/metadata-subscribe-tests.yml
@@ -25,8 +25,8 @@ on:
       - '.github/workflows/metadata-subscribe-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/metadata-subscribe-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -48,6 +48,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
         
     - name: Build SeaweedFS
       run: |
diff --git a/.github/workflows/mount-benchmark.yml b/.github/workflows/mount-benchmark.yml
new file mode 100644
index 0000000000..206e082243
--- /dev/null
+++ b/.github/workflows/mount-benchmark.yml
@@ -0,0 +1,205 @@
+name: "mount: benchmark"
+
+# Manual benchmark: native WinFsp mount vs rclone+WebDAV on the same Windows
+# runner, with a Linux FUSE mount of the same build as a reference. Numbers
+# from shared runners are noisy; this is for finding factor-of-N gaps, not
+# regressions of a few percent.
+on:
+  workflow_dispatch:
+  push:
+    branches: [ 'winfsp-bench**' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
+permissions:
+  contents: read
+
+jobs:
+  bench-windows:
+    name: Windows native vs rclone
+    runs-on: windows-latest
+    timeout-minutes: 60
+    env:
+      CGO_ENABLED: 0
+
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+
+    - uses: actions/setup-go@v7
+      with:
+        go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
+
+    - name: Install WinFsp and rclone
+      run: choco install winfsp rclone -y --no-progress
+
+    - name: Build weed.exe
+      run: go build -o weed.exe ./weed
+
+    - name: Benchmark both mounts
+      shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+
+        function Test-Port($port) {
+          $client = New-Object System.Net.Sockets.TcpClient
+          try { $client.Connect('127.0.0.1', $port); return $client.Connected }
+          catch { return $false }
+          finally { $client.Dispose() }
+        }
+
+        function Wait-Drive($drive, $what) {
+          $deadline = (Get-Date).AddMinutes(2)
+          while ((Get-Date) -lt $deadline) {
+            if (Test-Path "${drive}\") { Write-Host "$what is mounted on $drive"; return }
+            Start-Sleep -Seconds 2
+          }
+          throw "$what never appeared on $drive"
+        }
+
+        function Invoke-Bench($dir, $label, $out) {
+          Write-Host "::group::bench $label"
+          & go run ./test/mount_bench -dir $dir -label $label -filer 127.0.0.1:8888 -out $out
+          $code = $LASTEXITCODE
+          Write-Host "::endgroup::"
+          if ($code -ne 0) { throw "bench $label failed with exit $code" }
+        }
+
+        New-Item -ItemType Directory -Force -Path C:\seaweed-data | Out-Null
+        Start-Process -FilePath .\weed.exe `
+          -ArgumentList '-logtostderr','mini','-dir=C:\seaweed-data','-ip=127.0.0.1' `
+          -RedirectStandardOutput C:\seaweed-mini.log -RedirectStandardError C:\seaweed-mini.err.log
+
+        $deadline = (Get-Date).AddMinutes(3)
+        while ((Get-Date) -lt $deadline) {
+          if ((Test-Port 8888) -and (Test-Port 18888) -and (Test-Port 7333)) { break }
+          Start-Sleep -Seconds 3
+        }
+        if (-not ((Test-Port 8888) -and (Test-Port 18888) -and (Test-Port 7333))) {
+          Get-Content C:\seaweed-mini.log, C:\seaweed-mini.err.log -ErrorAction SilentlyContinue
+          throw "mini cluster never came up"
+        }
+        Write-Host "filer on 8888/18888, webdav on 7333"
+
+        # --- native WinFsp mount ---
+        Start-Process -FilePath .\weed.exe `
+          -ArgumentList '-logtostderr','mount','-filer=127.0.0.1:8888','-dir=S:' `
+          -RedirectStandardOutput C:\seaweed-mount.log -RedirectStandardError C:\seaweed-mount.err.log
+        Wait-Drive 'S:' 'weed mount'
+
+        Invoke-Bench 'S:\bench-native' 'winfsp-native' 'C:\results-native.json'
+
+        Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
+          Where-Object { $_.CommandLine -like '*mount*' } |
+          ForEach-Object { Stop-Process -Id $_.ProcessId -Force }
+        $deadline = (Get-Date).AddMinutes(1)
+        while ((Get-Date) -lt $deadline -and (Test-Path S:\)) { Start-Sleep -Seconds 2 }
+
+        # --- rclone + WebDAV on the same WinFsp ---
+        # rclone serves listings from a directory cache it fills lazily, so the
+        # big-listing files have to exist before it mounts or it never sees them.
+        & go run ./test/mount_bench -filer 127.0.0.1:8888 -seed bench-rclone/biglist
+        if ($LASTEXITCODE -ne 0) { throw "seeding failed" }
+
+        $env:RCLONE_CONFIG_SEAWEED_TYPE = 'webdav'
+        $env:RCLONE_CONFIG_SEAWEED_URL = 'http://127.0.0.1:7333'
+        $env:RCLONE_CONFIG_SEAWEED_VENDOR = 'other'
+        Start-Process -FilePath rclone `
+          -ArgumentList 'mount','seaweed:','T:','--vfs-cache-mode=writes','-v','--log-file=C:\rclone.log'
+        Wait-Drive 'T:' 'rclone mount'
+
+        Invoke-Bench 'T:\bench-rclone' 'rclone-webdav' 'C:\results-rclone.json'
+
+        Stop-Process -Name rclone -Force -ErrorAction SilentlyContinue
+
+        # --- comparison ---
+        $table = & go run ./test/mount_bench -compare C:\results-native.json,C:\results-rclone.json
+        $table | Write-Host
+        "## Windows: native WinFsp vs rclone+WebDAV" | Out-File -Append $env:GITHUB_STEP_SUMMARY
+        $table | Out-File -Append $env:GITHUB_STEP_SUMMARY
+
+    - name: Logs
+      if: always()
+      shell: pwsh
+      run: |
+        foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\rclone.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
+          if (Test-Path $f) { Write-Host "===== $f"; Get-Content $f -Tail 100 }
+        }
+
+    - name: Results
+      if: always()
+      uses: actions/upload-artifact@v7
+      with:
+        name: results-windows
+        path: C:\results-*.json
+        if-no-files-found: ignore
+
+  bench-linux:
+    name: Linux FUSE reference
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
+
+    - uses: actions/setup-go@v7
+      with:
+        go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
+
+    - name: Repair the fusermount3 setuid bit
+      uses: ./.github/actions/fix-fusermount-setuid
+
+    - name: Allow non-root FUSE mounts with allow_other
+      run: |
+        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
+        sudo chmod 644 /etc/fuse.conf
+
+    - name: Build weed
+      run: go build -o /tmp/weed ./weed
+
+    - name: Benchmark FUSE mount
+      run: |
+        set -e
+        mkdir -p /tmp/seaweed-data
+        /tmp/weed -logtostderr mini -dir=/tmp/seaweed-data -ip=127.0.0.1 > /tmp/mini.log 2>&1 &
+
+        for i in $(seq 1 60); do
+          if nc -z 127.0.0.1 8888 && nc -z 127.0.0.1 18888; then break; fi
+          sleep 3
+        done
+        nc -z 127.0.0.1 8888 || { cat /tmp/mini.log; echo "filer never came up"; exit 1; }
+
+        mkdir -p "$HOME/mnt"
+        /tmp/weed -logtostderr mount -filer=127.0.0.1:8888 -dir="$HOME/mnt" > /tmp/mount.log 2>&1 &
+        for i in $(seq 1 60); do
+          if mountpoint -q "$HOME/mnt"; then break; fi
+          sleep 2
+        done
+        mountpoint -q "$HOME/mnt" || { cat /tmp/mount.log; echo "mount never appeared"; exit 1; }
+
+        go run ./test/mount_bench -dir "$HOME/mnt/bench-linux" -label linux-fuse -filer 127.0.0.1:8888 -out /tmp/results-linux.json
+
+        {
+          echo "## Linux FUSE reference"
+          go run ./test/mount_bench -compare /tmp/results-linux.json
+        } >> "$GITHUB_STEP_SUMMARY"
+
+    - name: Logs
+      if: always()
+      run: |
+        tail -n 100 /tmp/mount.log /tmp/mini.log 2>/dev/null || true
+
+    - name: Results
+      if: always()
+      uses: actions/upload-artifact@v7
+      with:
+        name: results-linux
+        path: /tmp/results-linux.json
+        if-no-files-found: ignore
diff --git a/.github/workflows/mount-windows-conformance.yml b/.github/workflows/mount-windows-conformance.yml
index 6d490c5d8a..c58d063575 100644
--- a/.github/workflows/mount-windows-conformance.yml
+++ b/.github/workflows/mount-windows-conformance.yml
@@ -24,8 +24,8 @@ on:
       - '.github/workflows/mount-windows-conformance.yml'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -49,6 +49,7 @@ jobs:
     - uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
     # cgofuse loads winfsp-x64.dll at run time, so WinFsp is needed here but
     # not to build.
diff --git a/.github/workflows/mount-windows.yml b/.github/workflows/mount-windows.yml
index cd9db56854..7954176ce7 100644
--- a/.github/workflows/mount-windows.yml
+++ b/.github/workflows/mount-windows.yml
@@ -24,8 +24,8 @@ on:
       - '.github/workflows/mount-windows.yml'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -49,6 +49,7 @@ jobs:
     - uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
     # cgofuse loads winfsp-x64.dll at run time, so WinFsp is needed here but
     # not to build.
@@ -185,8 +186,19 @@ jobs:
         if (Test-Path S:\walk) { throw "directory survived recursive delete" }
         Write-Host "::endgroup::"
 
+        # Tear down everything we started so the runner's later steps (Logs,
+        # post-checkout) launch into a clean environment. A WinFsp mount left
+        # active and a weed.exe holding winfsp-x64.dll have been seen to make
+        # the next step's pwsh.exe fail with STATUS_DLL_INIT_FAILED
+        # (0xC0000142), which fails a job whose actual test step passed.
+        try { Stop-Mount } catch { Write-Host "no mount to stop at teardown: $_" }
+        Get-CimInstance Win32_Process -Filter "Name = 'weed.exe'" |
+          ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+        Start-Sleep -Seconds 3
+
     - name: Logs
       if: always()
+      continue-on-error: true
       shell: pwsh
       run: |
         foreach ($f in 'C:\seaweed-mount.log','C:\seaweed-mount.err.log','C:\seaweed-remount.log','C:\seaweed-remount.err.log','C:\seaweed-remount2.log','C:\seaweed-remount2.err.log','C:\seaweed-dirmount.log','C:\seaweed-dirmount.err.log','C:\seaweed-mini.log','C:\seaweed-mini.err.log') {
diff --git a/.github/workflows/multi-master-tests.yml b/.github/workflows/multi-master-tests.yml
index 2e0cfe8d95..af282120b8 100644
--- a/.github/workflows/multi-master-tests.yml
+++ b/.github/workflows/multi-master-tests.yml
@@ -21,8 +21,8 @@ on:
       - '.github/workflows/multi-master-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/multi-master-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -40,6 +40,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Install SeaweedFS
         run: |
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index cd5c521da3..0d22915b22 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -8,6 +8,7 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'seaweed-volume/**'
+      - 'seaweed-common/**'
       - 'test/perf/**'
       - '.github/workflows/performance.yml'
   workflow_dispatch:
@@ -44,8 +45,8 @@ on:
         type: string
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/performance
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -66,6 +67,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Build weed
         run: go build -o weed_bin ./weed
@@ -174,17 +176,14 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
-
-      - name: Install protobuf compiler
-        if: matrix.impl == 'rust'
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Install Rust toolchain
         if: matrix.impl == 'rust'
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo registry and target
-        if: matrix.impl == 'rust'
+        if: matrix.impl == 'rust' && runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
@@ -330,17 +329,14 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
-
-      - name: Install protobuf compiler
-        if: matrix.impl == 'rust'
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Install Rust toolchain
         if: matrix.impl == 'rust'
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo registry and target
-        if: matrix.impl == 'rust'
+        if: matrix.impl == 'rust' && runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
diff --git a/.github/workflows/pjdfstest.yml b/.github/workflows/pjdfstest.yml
index 80845380ca..a88d19d48a 100644
--- a/.github/workflows/pjdfstest.yml
+++ b/.github/workflows/pjdfstest.yml
@@ -38,15 +38,23 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
     - name: Start local Docker registry
-      run: docker run -d --restart=always -p 5000:5000 --name registry registry:2
+      run: |
+        if ! docker start registry 2>/dev/null; then
+          docker rm -f registry >/dev/null 2>&1 || true
+          docker run -d --restart=always -p 5000:5000 --name registry registry:2
+        fi
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v4
       with:
         driver-opts: network=host
 
+    - name: Set up Docker Compose
+      uses: docker/setup-compose-action@v2
+
     - name: Build weed race binary
       run: |
         cd docker
diff --git a/.github/workflows/plugin-workers.yml b/.github/workflows/plugin-workers.yml
index b3f10551c4..55d3f56478 100644
--- a/.github/workflows/plugin-workers.yml
+++ b/.github/workflows/plugin-workers.yml
@@ -18,6 +18,10 @@ on:
       - 'go.sum'
       - '.github/workflows/plugin-workers.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
@@ -41,6 +45,7 @@ jobs:
       - name: Set up Go 1.x
         uses: actions/setup-go@v7
         with:
+          cache: ${{ runner.environment == 'github-hosted' }}
           go-version: ^1.26
         id: go
 
diff --git a/.github/workflows/posix-compliance.yml b/.github/workflows/posix-compliance.yml
new file mode 100644
index 0000000000..66efc0de44
--- /dev/null
+++ b/.github/workflows/posix-compliance.yml
@@ -0,0 +1,791 @@
+name: POSIX Compliance Tests
+
+on:
+  push:
+    branches: [ main, master, develop ]
+    paths:
+      - 'weed/mount/**'
+      - 'weed/command/mount*'
+      - 'weed/command/fuse*'
+      - 'test/fuse_integration/**'
+  pull_request:
+    branches: [ main, master, develop ]
+    paths:
+      - 'weed/mount/**'
+      - 'weed/command/mount*'
+      - 'weed/command/fuse*'
+      - 'test/fuse_integration/**'
+  workflow_dispatch:
+    inputs:
+      test_type:
+        description: 'Type of POSIX tests to run (default: full for comprehensive testing)'
+        required: true
+        default: 'full'
+        type: choice
+        options:
+        - critical
+        - basic
+        - extended
+        - full
+      enable_external_tests:
+        description: 'Run external test suites (slower)'
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+env:
+  GO_VERSION: '1.26'
+  TIMEOUT: '45m'
+
+jobs:
+  posix-compliance-ubuntu:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    
+    strategy:
+      matrix:
+        fuse-version: ['2.9', '3.0']
+      fail-fast: false
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+      with:
+        fetch-depth: 1
+    
+    - name: Clean up stale FUSE mounts
+      uses: ./.github/actions/cleanup-stale-fuse-mounts
+
+    - name: Set up Go ${{ env.GO_VERSION }}
+      uses: actions/setup-go@v7
+      with:
+        go-version: ${{ env.GO_VERSION }}
+        cache: ${{ runner.environment == 'github-hosted' }}
+        cache-dependency-path: |
+          go.sum
+          test/fuse_integration/go.sum
+    
+    - name: Install system dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y \
+          attr \
+          acl \
+          build-essential \
+          git \
+          python3-pip
+        
+        # Install FUSE version specific packages
+        if [ "${{ matrix.fuse-version }}" = "2.9" ]; then
+          echo "Installing FUSE 2.9..."
+          sudo apt-get install -y fuse libfuse-dev
+        elif [ "${{ matrix.fuse-version }}" = "3.0" ]; then
+          echo "Installing FUSE 3.0..."
+          sudo apt-get install -y fuse3 libfuse3-dev
+          # Also install fuse2 for compatibility if needed
+          sudo apt-get install -y fuse libfuse-dev
+        fi
+    
+    - name: Set up user permissions for FUSE
+      run: |
+        # Create fuse group if it doesn't exist
+        sudo groupadd -f fuse
+        
+        # Add user to fuse group
+        sudo usermod -a -G fuse $USER
+        
+        # Set permissions on FUSE device
+        sudo chmod 666 /dev/fuse
+
+        # Allow non-root mounts to pass -o allow_other (weed -allowOthers)
+        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
+        sudo chmod 644 /etc/fuse.conf
+
+        # Ensure fuse module is loaded
+        sudo modprobe fuse || true
+        
+        # Verify setup
+        echo "FUSE setup verification:"
+        ls -la /dev/fuse
+        groups $USER | grep fuse || echo "User not in fuse group yet (will be effective after login)"
+        lsmod | grep fuse || echo "FUSE module not loaded"
+    
+    - name: Install external test tools
+      if: ${{ github.event.inputs.enable_external_tests == 'true' }}
+      run: |
+        # Install nfstest for POSIX API verification
+        pip3 install --user nfstest
+        
+        # Install FIO for performance testing
+        sudo apt-get install -y fio
+        
+        # Install additional test utilities
+        sudo apt-get install -y stress-ng
+    
+    - name: Build SeaweedFS
+      run: |
+        make
+        # Verify binary exists and is executable (it's installed to GOPATH/bin)
+        weed version
+        
+        # Make weed binary available in PATH (it's already there from go install)
+        sudo cp $(which weed) /usr/local/bin/weed
+        which weed
+        weed version
+    
+    - name: Set up SeaweedFS cluster
+      run: |
+        start_and_wait() {
+            local name=$1
+            local url=$2
+            local pidfile=$3
+            shift 3
+            local cmd="$@"
+
+            echo "Starting $name..."
+            $cmd > "/tmp/seaweedfs/$name.log" 2>&1 &
+            local pid=$!
+            echo $pid > "$pidfile"
+
+            echo "Waiting for $name to start..."
+            for i in {1..30}; do
+                if curl -sf "$url" > /dev/null 2>&1; then
+                    echo "$name is ready"
+                    return 0
+                fi
+                if [ $i -eq 30 ]; then
+                    echo "$name failed to start"
+                    cat "/tmp/seaweedfs/$name.log"
+                    exit 1
+                fi
+                sleep 2
+            done
+        }
+
+        mkdir -p /tmp/seaweedfs/{master,volume,filer,mount}
+
+        start_and_wait "master" "http://127.0.0.1:9333/cluster/status" "/tmp/seaweedfs/master.pid" \
+            "weed master -ip=127.0.0.1 -port=9333 -mdir=/tmp/seaweedfs/master -raftBootstrap=true"
+
+        start_and_wait "volume" "http://127.0.0.1:8080/status" "/tmp/seaweedfs/volume.pid" \
+            "weed volume -mserver=127.0.0.1:9333 -ip=127.0.0.1 -port=8080 -dir=/tmp/seaweedfs/volume -max=100"
+
+        start_and_wait "filer" "http://127.0.0.1:8888/" "/tmp/seaweedfs/filer.pid" \
+            "weed filer -master=127.0.0.1:9333 -ip=127.0.0.1 -port=8888"
+
+        echo "SeaweedFS cluster status:"
+        curl -s http://127.0.0.1:9333/cluster/status || true
+    
+    - name: Set up FUSE mount
+      run: |
+        # Create mount point
+        MOUNT_POINT="/tmp/seaweedfs/mount"
+        mkdir -p $MOUNT_POINT
+        
+        echo "Mounting SeaweedFS FUSE filesystem..."
+        # Mount SeaweedFS FUSE filesystem in background
+        weed mount \
+          -filer=127.0.0.1:8888 \
+          -dir=$MOUNT_POINT \
+          -filer.path=/ \
+          -dirAutoCreate=true \
+          -allowOthers=true \
+          -nonempty=true \
+          > /tmp/seaweedfs/mount.log 2>&1 &
+        MOUNT_PID=$!
+        echo $MOUNT_PID > /tmp/seaweedfs/mount.pid
+        
+        # Wait for mount to be ready. The mount point directory already
+        # exists, so only a real mount counts — a directory listing would
+        # pass on the local disk even if weed mount died.
+        echo "Waiting for FUSE mount to be ready..."
+        for i in {1..30}; do
+          if mountpoint -q $MOUNT_POINT 2>/dev/null; then
+            echo "FUSE mount is ready"
+            break
+          fi
+          if ! kill -0 $MOUNT_PID 2>/dev/null; then
+            echo "FUSE mount process exited"
+            cat /tmp/seaweedfs/mount.log
+            exit 1
+          fi
+          if [ $i -eq 30 ]; then
+            echo "FUSE mount failed to be ready"
+            cat /tmp/seaweedfs/mount.log
+            echo "Mount status:"
+            mount | grep fuse || echo "No FUSE mounts found"
+            ps aux | grep weed || echo "No weed processes found"
+            exit 1
+          fi
+          sleep 2
+        done
+        
+        # Verify mount is working
+        echo "Testing FUSE mount functionality..."
+        echo "test" > $MOUNT_POINT/test_file.txt
+        if [ "$(cat $MOUNT_POINT/test_file.txt)" = "test" ]; then
+          echo "FUSE mount is working correctly"
+          rm $MOUNT_POINT/test_file.txt
+        else
+          echo "FUSE mount is not working properly"
+          exit 1
+        fi
+        
+        # Export mount point for tests
+        echo "SEAWEEDFS_MOUNT_POINT=$MOUNT_POINT" >> $GITHUB_ENV
+    
+    - name: Set up test environment
+      run: |
+        cd test/fuse_integration
+        
+        # Initialize Go module for tests
+        if [ ! -f go.mod ]; then
+          go mod init seaweedfs-posix-tests
+          go mod tidy
+        fi
+        
+        # Create reports directory
+        mkdir -p reports
+        
+        # Set up external tools if requested
+        # Note: External tools setup is now optional and won't fail the build
+        if [ "${{ github.event.inputs.enable_external_tests }}" = "true" ]; then
+          echo "Setting up external POSIX testing tools..."
+          make -f posix_Makefile setup-external-tools || true
+          # setup-external-tools exits 0 even when a sub-target failed, so
+          # require the tools only when they are actually installed
+          if [ -d external_tools/pjdfstest ] && command -v nfstest_posix >/dev/null 2>&1; then
+            export POSIX_REQUIRE_EXTERNAL_TOOLS="true"
+            echo "POSIX_REQUIRE_EXTERNAL_TOOLS=true" >> $GITHUB_ENV
+            echo "✅ External tools setup completed successfully"
+          else
+            echo "⚠️  External tools setup incomplete - continuing with basic tests only"
+            echo "External tools will be skipped but tests will continue"
+            echo "This is expected behavior when build tools are not available"
+          fi
+        fi
+        
+        # Verify SeaweedFS cluster is accessible
+        echo "Verifying SeaweedFS cluster accessibility..."
+        curl -sf http://127.0.0.1:9333/cluster/status
+        curl -sf http://127.0.0.1:8080/status  
+        curl -sf http://127.0.0.1:8888/
+        
+        # Verify mount point
+        echo "Mount point: $SEAWEEDFS_MOUNT_POINT"
+        ls -la $SEAWEEDFS_MOUNT_POINT
+        
+        # Verify mount is actually working by testing file operations
+        echo "Verifying SeaweedFS mount functionality..."
+        TEST_FILE="$SEAWEEDFS_MOUNT_POINT/.mount_verification_test"
+        echo "SeaweedFS mount test" > "$TEST_FILE"
+        if [ "$(cat "$TEST_FILE")" = "SeaweedFS mount test" ]; then
+          echo "✅ Mount verification successful"
+          rm -f "$TEST_FILE"
+        else
+          echo "❌ Mount verification failed - mount may not be working properly"
+          exit 1
+        fi
+        
+        # Check if this is actually a FUSE mount — the plain directory created
+        # above passes the file test, so without this the suite can run
+        # against the local disk and report a pass it never earned
+        if mount | grep -q "$SEAWEEDFS_MOUNT_POINT"; then
+          echo "✅ FUSE mount detected:"
+          mount | grep "$SEAWEEDFS_MOUNT_POINT"
+        else
+          echo "❌ Mount point not found in mount table - refusing to test a local directory"
+          exit 1
+        fi
+    
+    - name: Run POSIX compliance tests
+      id: posix-tests
+      env:
+        SEAWEEDFS_MOUNT_POINT: ${{ env.SEAWEEDFS_MOUNT_POINT }}
+        POSIX_REQUIRE_EXTERNAL_TOOLS: ${{ env.POSIX_REQUIRE_EXTERNAL_TOOLS }}
+      run: |
+        cd test/fuse_integration
+        
+        # Determine which tests to run
+        TEST_TYPE="${{ github.event.inputs.test_type }}"
+        if [ -z "$TEST_TYPE" ]; then
+          TEST_TYPE="full"
+        fi
+        
+        echo "Running POSIX tests: $TEST_TYPE"
+        if [ "$TEST_TYPE" = "full" ]; then
+          echo "🚀 Running COMPREHENSIVE POSIX test suite (including external test suites)"
+        else
+          echo "Using mount point: $SEAWEEDFS_MOUNT_POINT"
+        fi
+        
+        # Set test configuration to use our mounted filesystem
+        export TEST_MOUNT_POINT="$SEAWEEDFS_MOUNT_POINT"
+        export TEST_SKIP_CLUSTER_SETUP="true"
+        
+        # Debug: Show environment variables
+        echo "🔍 Test Environment:"
+        echo "  TEST_MOUNT_POINT=$TEST_MOUNT_POINT"
+        echo "  TEST_SKIP_CLUSTER_SETUP=$TEST_SKIP_CLUSTER_SETUP"
+        echo "  SEAWEEDFS_MOUNT_POINT=$SEAWEEDFS_MOUNT_POINT"
+        
+        case "$TEST_TYPE" in
+          "critical")
+            echo "Running critical POSIX tests (basic compliance only)..."
+            make -f posix_Makefile test-posix-critical
+            ;;
+          "basic")
+            echo "Running basic POSIX tests (core file operations)..."
+            make -f posix_Makefile test-posix-basic
+            ;;
+          "extended")
+            echo "Running extended POSIX tests (including advanced features)..."
+            make -f posix_Makefile test-posix-extended
+            ;;
+          "full")
+            echo "🚀 Running COMPREHENSIVE POSIX test suite (all tests including external)..."
+            echo "   This includes: basic, extended, and external test suites"
+            echo "   External suites: pjdfstest, nfstest_posix, and custom stress tests"
+            make -f posix_Makefile test-posix-full
+            ;;
+          *)
+            echo "Unknown test type: $TEST_TYPE, defaulting to full suite"
+            echo "🚀 Running full POSIX test suite (all tests including external)..."
+            make -f posix_Makefile test-posix-full
+            ;;
+        esac
+    
+    - name: Run external test suites
+      if: ${{ github.event.inputs.enable_external_tests == 'true' }}
+      continue-on-error: true
+      run: |
+        cd test/fuse_integration
+        
+        # Point the external suites at the same mount as the Go tests;
+        # without these the Makefile falls back to a local-disk path.
+        export TEST_MOUNT_POINT="$SEAWEEDFS_MOUNT_POINT"
+        export TEST_SKIP_CLUSTER_SETUP="true"
+        
+        # Run external tests (may fail on some systems)
+        make -f posix_Makefile test-nfstest-posix || echo "nfstest failed or not available"
+        make -f posix_Makefile test-fio-posix || echo "FIO tests failed or not available"
+    
+    - name: Generate compliance report
+      if: always()
+      run: |
+        cd test/fuse_integration
+        make -f posix_Makefile generate-report
+    
+    - name: Collect system information for debugging
+      if: failure()
+      run: |
+        cd test/fuse_integration
+        mkdir -p reports/debug
+        
+        echo "System Information" > reports/debug/system_info.txt
+        uname -a >> reports/debug/system_info.txt
+        echo "" >> reports/debug/system_info.txt
+        
+        echo "Mount Information" >> reports/debug/system_info.txt
+        mount >> reports/debug/system_info.txt
+        echo "" >> reports/debug/system_info.txt
+        
+        echo "Disk Space" >> reports/debug/system_info.txt
+        timeout 15 df -h >> reports/debug/system_info.txt || true
+        echo "" >> reports/debug/system_info.txt
+        
+        echo "Memory Information" >> reports/debug/system_info.txt
+        free -h >> reports/debug/system_info.txt
+        echo "" >> reports/debug/system_info.txt
+        
+        echo "FUSE Information" >> reports/debug/system_info.txt
+        ls -la /dev/fuse >> reports/debug/system_info.txt
+        lsmod | grep fuse >> reports/debug/system_info.txt
+        echo "" >> reports/debug/system_info.txt
+        
+        echo "SeaweedFS Version" >> reports/debug/system_info.txt
+        weed version >> reports/debug/system_info.txt
+        echo "" >> reports/debug/system_info.txt
+        
+        echo "Go Version" >> reports/debug/system_info.txt
+        go version >> reports/debug/system_info.txt
+        echo "" >> reports/debug/system_info.txt
+        
+        echo "Running Processes" >> reports/debug/system_info.txt
+        ps aux | grep -E "(weed|fuse)" >> reports/debug/system_info.txt
+        echo "" >> reports/debug/system_info.txt
+        
+        # Collect SeaweedFS service logs
+        echo "=== SeaweedFS Service Logs ===" >> reports/debug/system_info.txt
+        if [ -f /tmp/seaweedfs/master.log ]; then
+          echo "Master Log:" >> reports/debug/system_info.txt
+          tail -50 /tmp/seaweedfs/master.log >> reports/debug/system_info.txt
+          echo "" >> reports/debug/system_info.txt
+        fi
+        
+        if [ -f /tmp/seaweedfs/volume.log ]; then
+          echo "Volume Log:" >> reports/debug/system_info.txt
+          tail -50 /tmp/seaweedfs/volume.log >> reports/debug/system_info.txt
+          echo "" >> reports/debug/system_info.txt
+        fi
+        
+        if [ -f /tmp/seaweedfs/filer.log ]; then
+          echo "Filer Log:" >> reports/debug/system_info.txt
+          tail -50 /tmp/seaweedfs/filer.log >> reports/debug/system_info.txt
+          echo "" >> reports/debug/system_info.txt
+        fi
+        
+        if [ -f /tmp/seaweedfs/mount.log ]; then
+          echo "Mount Log:" >> reports/debug/system_info.txt
+          tail -50 /tmp/seaweedfs/mount.log >> reports/debug/system_info.txt
+          echo "" >> reports/debug/system_info.txt
+        fi
+        
+        # Copy full logs as separate files
+        if [ -f /tmp/seaweedfs/master.log ]; then
+          cp /tmp/seaweedfs/master.log reports/debug/master.log
+        fi
+        if [ -f /tmp/seaweedfs/volume.log ]; then
+          cp /tmp/seaweedfs/volume.log reports/debug/volume.log  
+        fi
+        if [ -f /tmp/seaweedfs/filer.log ]; then
+          cp /tmp/seaweedfs/filer.log reports/debug/filer.log
+        fi
+        if [ -f /tmp/seaweedfs/mount.log ]; then
+          cp /tmp/seaweedfs/mount.log reports/debug/mount.log
+        fi
+    
+    - name: Cleanup SeaweedFS cluster and FUSE mount
+      if: always()
+      run: |
+        stop_process() {
+            local name=$1
+            local pidfile=$2
+            if [ -f "$pidfile" ]; then
+                local pid=$(cat "$pidfile")
+                if kill -0 $pid 2>/dev/null; then
+                    echo "Stopping $name process (PID: $pid)..."
+                    kill -TERM $pid || true
+                    sleep 2
+                    kill -KILL $pid 2>/dev/null || true
+                fi
+            fi
+        }
+
+        echo "Cleaning up SeaweedFS cluster and FUSE mount..."
+        
+        MOUNT_POINT="/tmp/seaweedfs/mount"
+        if mountpoint -q $MOUNT_POINT 2>/dev/null; then
+          echo "Unmounting FUSE filesystem..."
+          fusermount -u $MOUNT_POINT || umount $MOUNT_POINT || true
+        fi
+        
+        stop_process "mount" "/tmp/seaweedfs/mount.pid"
+        stop_process "filer" "/tmp/seaweedfs/filer.pid"
+        stop_process "volume" "/tmp/seaweedfs/volume.pid"
+        stop_process "master" "/tmp/seaweedfs/master.pid"
+        
+        pkill -f "weed " || true
+        
+        fusermount -u $MOUNT_POINT 2>/dev/null || true
+        umount $MOUNT_POINT 2>/dev/null || true
+        
+        rm -rf /tmp/seaweedfs || true
+        
+        echo "Cleanup completed"
+    
+
+    - name: Upload test results
+      uses: actions/upload-artifact@v7
+      if: always()
+      with:
+        name: posix-test-results-ubuntu-fuse${{ matrix.fuse-version }}
+        path: |
+          test/fuse_integration/reports/
+          test/fuse_integration/*.log
+        retention-days: 30
+    
+    - name: Upload test coverage
+      uses: actions/upload-artifact@v7
+      if: always() && (github.event.inputs.test_type == 'full' || github.event.inputs.test_type == 'extended')
+      with:
+        name: posix-coverage-ubuntu
+        path: test/fuse_integration/reports/posix_coverage.html
+        retention-days: 14
+    
+    - name: Comment PR with results
+      if: github.event_name == 'pull_request' && always()
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const fs = require('fs');
+          const path = require('path');
+          
+          const reportPath = 'test/fuse_integration/reports/posix_compliance_summary.txt';
+          
+          if (fs.existsSync(reportPath)) {
+            const report = fs.readFileSync(reportPath, 'utf8');
+            const comment = `## POSIX Compliance Test Results
+            
+            **Go Version:** ${{ env.GO_VERSION }}
+            **FUSE Version:** ${{ matrix.fuse-version }}
+            **Test Type:** ${{ github.event.inputs.test_type || 'full' }}
+            
+            <details>
+            <summary>Test Summary</summary>
+            
+            \`\`\`
+            ${report}
+            \`\`\`
+            </details>
+            
+            📊 Full results available in [test artifacts](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+            `;
+            
+            try {
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: comment
+              });
+            } catch (err) {
+              console.log('Could not post PR comment: ' + err.message);
+            }
+          }
+
+  posix-compliance-macos:
+    runs-on: macos-latest
+    timeout-minutes: 60
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+    
+    - name: Set up Go
+      uses: actions/setup-go@v7
+      with:
+        go-version: ${{ env.GO_VERSION }}
+        cache: ${{ runner.environment == 'github-hosted' }}
+    
+    - name: Install macFUSE
+      run: |
+        # Install macFUSE
+        brew install macfuse
+        
+        # Note: macFUSE may require system extension approval on macOS
+        # This step may need manual intervention in some cases
+    
+    - name: Build SeaweedFS
+      run: |
+        make
+        # Verify binary exists and is executable (it's installed to GOPATH/bin)
+        weed version
+    
+    - name: Run critical POSIX tests (macOS)
+      continue-on-error: true  # macOS FUSE can be more restrictive
+      run: |
+        cd test/fuse_integration
+        
+        if [ ! -f go.mod ]; then
+          go mod init seaweedfs-posix-tests
+          go mod tidy
+        fi
+        
+        mkdir -p reports
+        
+        # Run basic tests only on macOS due to FUSE limitations
+        make -f posix_Makefile test-posix-critical
+    
+    - name: Upload macOS test results
+      uses: actions/upload-artifact@v7
+      if: always()
+      with:
+        name: posix-test-results-macos
+        path: |
+          test/fuse_integration/reports/
+          test/fuse_integration/*.log
+        retention-days: 30
+
+  security-analysis:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+    
+    - name: Set up Go
+      uses: actions/setup-go@v7
+      with:
+        go-version: ${{ env.GO_VERSION }}
+        cache: ${{ runner.environment == 'github-hosted' }}
+    
+    - name: Install security analysis tools
+      run: |
+        echo "Installing staticcheck for security analysis..."
+        go install honnef.co/go/tools/cmd/staticcheck@latest
+    
+    - name: Run security analysis on FUSE code
+      run: |
+        # Analyze mount and FUSE-related code for security and quality issues
+        echo "Running staticcheck security analysis..."
+        
+        # Run staticcheck on FUSE-related code
+        echo "Analyzing FUSE mount code..."
+        staticcheck ./weed/mount/... > staticcheck-report.txt 2>&1 || true
+        staticcheck ./weed/command/mount* ./weed/command/fuse* >> staticcheck-report.txt 2>&1 || true
+        
+        # Convert to JSON format for consistency
+        echo "{" > gosec-report.json
+        echo "  \"tool\": \"staticcheck\"," >> gosec-report.json
+        echo "  \"timestamp\": \"$(date -Iseconds)\"," >> gosec-report.json
+        echo "  \"issues\": [" >> gosec-report.json
+        
+        if [ -s staticcheck-report.txt ]; then
+          echo "    \"$(cat staticcheck-report.txt | head -20 | sed 's/"/\\"/g' | tr '\n' ' ')\"" >> gosec-report.json
+        fi
+        
+        echo "  ]," >> gosec-report.json
+        echo "  \"stats\": {" >> gosec-report.json
+        echo "    \"files_analyzed\": $(find ./weed/mount ./weed/command -name '*.go' | wc -l)," >> gosec-report.json
+        echo "    \"issues_found\": $(wc -l < staticcheck-report.txt 2>/dev/null || echo 0)" >> gosec-report.json
+        echo "  }" >> gosec-report.json
+        echo "}" >> gosec-report.json
+        
+        echo "Security analysis completed"
+        echo "Issues found: $(wc -l < staticcheck-report.txt 2>/dev/null || echo 0)"
+    
+    - name: Upload security analysis results
+      uses: actions/upload-artifact@v7
+      if: always()
+      with:
+        name: security-analysis-results
+        path: gosec-report.json
+        retention-days: 30
+
+  performance-baseline:
+    runs-on: ubuntu-latest
+    if: github.event.inputs.test_type == 'full' || github.event_name == 'schedule'
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+    
+    - name: Set up Go
+      uses: actions/setup-go@v7
+      with:
+        go-version: ${{ env.GO_VERSION }}
+        cache: ${{ runner.environment == 'github-hosted' }}
+    
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y fuse libfuse-dev fio
+        sudo usermod -a -G fuse $USER
+        sudo chmod 666 /dev/fuse
+        # The posix suites mount with -allowOthers; allow_other needs this
+        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
+    
+    - name: Build SeaweedFS
+      run: make
+    
+    - name: Run performance baseline tests
+      run: |
+        cd test/fuse_integration
+        
+        if [ ! -f go.mod ]; then
+          go mod init seaweedfs-posix-tests
+          go mod tidy
+        fi
+        
+        mkdir -p reports
+        
+        # Run performance benchmarks
+        make -f posix_Makefile benchmark-posix
+        # This job has no FUSE mount, so the fio suite can only skip; keep the
+        # run green but honest about producing no mounted-FS results
+        make -f posix_Makefile test-fio-posix || echo "FIO skipped - no mounted filesystem in this job"
+    
+    - name: Store performance baseline
+      uses: actions/upload-artifact@v7
+      with:
+        name: performance-baseline-results
+        path: |
+          test/fuse_integration/reports/posix_benchmark_results.log
+          test/fuse_integration/reports/fio_*_results.log
+        retention-days: 90
+
+  # Schedule regular compliance checks
+  scheduled-compliance-check:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule'
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v7
+    
+    - name: Set up Go
+      uses: actions/setup-go@v7
+      with:
+        go-version: ${{ env.GO_VERSION }}
+        cache: ${{ runner.environment == 'github-hosted' }}
+    
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y fuse libfuse-dev
+        pip3 install --user nfstest
+        # The posix suites mount with -allowOthers; allow_other needs this
+        echo 'user_allow_other' | sudo tee -a /etc/fuse.conf
+    
+    - name: Build SeaweedFS
+      run: make
+    
+    - name: Run comprehensive compliance check
+      run: |
+        cd test/fuse_integration
+        make -f posix_Makefile test-posix-full
+        make -f posix_Makefile generate-report
+    
+    - name: Create compliance issue if tests fail
+      if: failure()
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const issue = await github.rest.issues.create({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            title: 'POSIX Compliance Check Failed - ' + new Date().toISOString().split('T')[0],
+            body: `## POSIX Compliance Check Failure
+            
+            The scheduled POSIX compliance check has failed. This may indicate:
+            
+            - Regression in FUSE mount functionality
+            - Changes affecting POSIX compatibility
+            - Infrastructure issues with the test environment
+            
+            **Action Required:** Review the test results and investigate any failures.
+            
+            **Test Run:** [Workflow Run](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})
+            
+            **Date:** ${new Date().toISOString()}
+            
+            ---
+            This issue was automatically created by the POSIX compliance workflow.
+            `,
+            labels: ['bug', 'posix-compliance', 'automated-issue']
+          });
+          
+          console.log('Created issue:', issue.data.number);
+
+# Schedule this workflow to run weekly
+# Uncomment the following lines to enable scheduled runs:
+#  schedule:
+#    - cron: '0 2 * * 1'  # Every Monday at 2 AM UTC
+
diff --git a/.github/workflows/postgres-tests.yml b/.github/workflows/postgres-tests.yml
index 3acefddd37..bbcef063bf 100644
--- a/.github/workflows/postgres-tests.yml
+++ b/.github/workflows/postgres-tests.yml
@@ -23,8 +23,8 @@ on:
       - '.github/workflows/postgres-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/postgres-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -41,7 +41,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
+        cache: ${{ runner.environment == 'github-hosted' }}
+        go-version: ^1.26
       id: go
 
     - name: Check out code
@@ -56,6 +57,7 @@ jobs:
       uses: docker/setup-buildx-action@v4
 
     - name: Cache Docker layers
+      if: runner.environment == 'github-hosted'
       uses: actions/cache@v6
       with:
         path: /tmp/.buildx-cache
diff --git a/.github/workflows/release_version_bump.yml b/.github/workflows/release_version_bump.yml
index 965d2835a3..3ad9633fa4 100644
--- a/.github/workflows/release_version_bump.yml
+++ b/.github/workflows/release_version_bump.yml
@@ -1,4 +1,17 @@
-name: "release: bump version"
+name: "release: bump version and cut the release"
+
+# One entry point for a SeaweedFS release:
+#   1. bump MAJOR/MINOR in constants.go and the Helm Chart.yaml, commit to master
+#   2. push the <appVersion> tag, which fans out to the workflows that trigger on
+#      `push: tags` (binaries_release*, container_release_unified, helm_manual_release)
+#   3. create the GitHub release, with GitHub's generated notes
+#   4. dispatch "Prepare release" in seaweedfs-csi-driver and seaweedfs-operator,
+#      which pick up the new master through `go get -u`, and wait for both
+#
+# Events raised by the default GITHUB_TOKEN do not start other workflows, and it
+# cannot reach the other two repositories at all. Add a repo secret RELEASE_PAT
+# with `contents: write` here and `actions: write` on the csi-driver and operator
+# repos. Without it the tag is still pushed, but nothing downstream of it runs.
 
 on:
   workflow_dispatch:
@@ -14,15 +27,37 @@ on:
         description: "Explicit MAJOR.MINOR to set, e.g. 4.36 (overrides 'bump')"
         type: string
         required: false
-
-permissions:
-  contents: write
+      downstream:
+        description: "Also release the CSI driver and the operator"
+        type: boolean
+        default: true
+      dry_run:
+        description: "Show the version bump, but change nothing"
+        type: boolean
+        default: false
 
 jobs:
-  bump-version:
+  release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      app_version: ${{ steps.compute.outputs.app_version }}
+      sha: ${{ steps.tag.outputs.sha }}
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: master
+          fetch-depth: 0
+          token: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+
+      - name: Check the release token
+        env:
+          HAS_PAT: ${{ secrets.RELEASE_PAT != '' }}
+        run: |
+          if [ "$HAS_PAT" != "true" ]; then
+            echo "::warning::RELEASE_PAT is not set. The tag will be pushed with GITHUB_TOKEN, so the binary, container and helm workflows will not start on their own."
+          fi
 
       - name: Compute new version
         id: compute
@@ -99,17 +134,145 @@ jobs:
           sed -i -E "s/^version:.*/version: ${CHART_VERSION}/" "$CHART"
           cat "$CHART"
 
-      - name: Commit and push
+      - name: Commit, and push the tag
+        id: tag
         env:
-          APP_VERSION: ${{ steps.compute.outputs.app_version }}
+          TAG: ${{ steps.compute.outputs.app_version }}
+          DRY_RUN: ${{ inputs.dry_run }}
         run: |
           set -euo pipefail
-          if git diff --quiet; then
-            echo "No version change to commit."
+          if git ls-remote --exit-code --tags origin "refs/tags/${TAG}" >/dev/null 2>&1; then
+            echo "::error::Tag ${TAG} already exists."
+            exit 1
+          fi
+          if [ "$DRY_RUN" = "true" ]; then
+            git --no-pager diff --stat
+            echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add weed/util/version/constants.go k8s/charts/seaweedfs/Chart.yaml
-          git commit -m "${APP_VERSION}"
-          git push
+          if git diff --quiet; then
+            echo "::warning::Version files are already at ${TAG}; tagging the current HEAD."
+          else
+            git add weed/util/version/constants.go k8s/charts/seaweedfs/Chart.yaml
+            git commit -m "${TAG}"
+            git push
+          fi
+
+          # Push the tag with git so the `push: tags` triggers fire. Creating the
+          # tag through the release API alone would only emit a `create` event.
+          git tag "$TAG"
+          git push origin "$TAG"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - name: Create the release
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT || secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.compute.outputs.app_version }}
+        run: gh release create "$TAG" --title "$TAG" --generate-notes --verify-tag
+
+  downstream:
+    needs: release
+    if: ${{ inputs.downstream && !inputs.dry_run }}
+    runs-on: ubuntu-latest
+    # The wait below puts no bound of its own on runner-queue time; this does.
+    timeout-minutes: 120
+    permissions: {}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - repo: seaweedfs/seaweedfs-csi-driver
+            workflow: prepare_release.yaml
+          - repo: seaweedfs/seaweedfs-operator
+            workflow: prepare_release.yml
+    steps:
+      - name: Release ${{ matrix.repo }}
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          REPO: ${{ matrix.repo }}
+          WORKFLOW: ${{ matrix.workflow }}
+          SHA: ${{ needs.release.outputs.sha }}
+          MODULE: github.com/seaweedfs/seaweedfs
+        run: |
+          set -euo pipefail
+          if [ -z "${GH_TOKEN}" ]; then
+            echo "::error::RELEASE_PAT with actions:write on ${REPO} is required to release it"
+            exit 1
+          fi
+
+          # The dispatched workflow pins seaweedfs with `go get -u ...@latest`, so
+          # wait until the proxy serves the release commit as the tip. Asking for
+          # the commit by name is what makes the proxy fetch it. The proxy can
+          # take longer than five minutes to refresh @latest after a new tag.
+          for _ in $(seq 120); do
+            curl -sf "https://proxy.golang.org/${MODULE}/@v/${SHA}.info" >/dev/null || true
+            TIP=$(curl -sf "https://proxy.golang.org/${MODULE}/@latest" | jq -r '.Origin.Hash // ""' || true)
+            [ "$TIP" = "$SHA" ] && break
+            sleep 10
+          done
+          if [ "$TIP" != "$SHA" ]; then
+            echo "::error::the module proxy still serves ${TIP} as the tip, so ${REPO} would pin a pre-release commit. Run ${WORKFLOW} there once it catches up."
+            exit 1
+          fi
+
+          # The dispatched workflow publishes the release as its last step, so
+          # its conclusion decides success. Wait on the run, not on a wall
+          # clock: time it spends queued for a runner must not count against
+          # the budget. A dispatch does not return its run id, so take the
+          # newest workflow_dispatch run created since ours; a concurrent
+          # dispatch would be performing this same release, and waiting on it
+          # is just as good.
+          released() { gh api "repos/${REPO}/releases?per_page=30" --jq '[.[].tag_name]'; }
+
+          BEFORE=$(released)
+          # A minute early, so runner clock skew cannot hide the run.
+          DISPATCHED_AT=$(date -u -d '1 minute ago' '+%Y-%m-%dT%H:%M:%SZ')
+          gh workflow run -R "$REPO" "$WORKFLOW" --ref master -f bump=patch -f update_seaweedfs=true
+
+          RUN_ID=""
+          for _ in $(seq 12); do
+            sleep 10
+            RUN_ID=$(gh api -X GET "repos/${REPO}/actions/workflows/${WORKFLOW}/runs" \
+              -f event=workflow_dispatch -f "created=>=${DISPATCHED_AT}" \
+              --jq '(.workflow_runs | sort_by(.created_at) | last | .id) // empty' || true)
+            [ -n "$RUN_ID" ] && break
+          done
+          if [ -z "$RUN_ID" ]; then
+            echo "::error::the dispatch created no ${WORKFLOW} run in ${REPO}; see https://github.com/${REPO}/actions/workflows/${WORKFLOW}"
+            exit 1
+          fi
+          RUN_URL="https://github.com/${REPO}/actions/runs/${RUN_ID}"
+          echo "waiting on ${RUN_URL}"
+
+          # 20 minutes of execution; polls that find the run still queued do
+          # not consume it.
+          RUNNING=0
+          STATE=""
+          while :; do
+            sleep 15
+            STATE=$(gh api "repos/${REPO}/actions/runs/${RUN_ID}" \
+              --jq '.status + "/" + (.conclusion // "")' || true)
+            case "$STATE" in
+              completed/*) break ;;
+              in_progress/*) RUNNING=$((RUNNING + 1)) ;;
+            esac
+            if [ "$RUNNING" -gt 80 ]; then
+              echo "::error::${RUN_URL} has been executing for over 20 minutes; giving up on it"
+              exit 1
+            fi
+          done
+          if [ "$STATE" != "completed/success" ]; then
+            echo "::error::${RUN_URL} concluded '${STATE#completed/}'"
+            exit 1
+          fi
+
+          NEW=$(released | jq -c --argjson before "$BEFORE" '. - $before')
+          if [ "$(jq length <<<"$NEW")" -eq 0 ]; then
+            echo "::error::${RUN_URL} succeeded but ${REPO} shows no new release"
+            exit 1
+          fi
+          echo "${REPO} released $(jq -r 'join(", ")' <<<"$NEW")"
diff --git a/.github/workflows/rust-volume-server-tests.yml b/.github/workflows/rust-volume-server-tests.yml
index 6f2417296b..e6223aef29 100644
--- a/.github/workflows/rust-volume-server-tests.yml
+++ b/.github/workflows/rust-volume-server-tests.yml
@@ -5,6 +5,7 @@ on:
     branches: [ master ]
     paths:
       - 'seaweed-volume/**'
+      - 'seaweed-common/**'
       - 'test/volume_server/**'
       - 'weed/pb/volume_server.proto'
       - 'weed/pb/volume_server_pb/**'
@@ -13,60 +14,46 @@ on:
     branches: [ master, main ]
     paths:
       - 'seaweed-volume/**'
+      - 'seaweed-common/**'
       - 'test/volume_server/**'
       - 'weed/pb/volume_server.proto'
       - 'weed/pb/volume_server_pb/**'
       - '.github/workflows/rust-volume-server-tests.yml'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
 
 
 jobs:
-  rust-unit-tests:
-    name: Rust Unit Tests
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-
+  changes:
+    name: Detect changed paths
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      rust: ${{ steps.filter.outputs.rust }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
-
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
+          fetch-depth: 0
 
-      - name: Build Rust volume server
-        run: cd seaweed-volume && cargo build --release
+      - name: Filter changed paths
+        id: filter
+        uses: dorny/paths-filter@v4
+        with:
+          filters: |
+            rust:
+              - 'seaweed-volume/**'
+              - '.github/workflows/rust-volume-server-tests.yml'
 
-      - name: Run Rust unit tests
-        run: cd seaweed-volume && cargo test
-
-  rust-integration-tests:
-    name: Rust Integration Tests
+  build-test-binaries:
+    name: Build Test Binaries
     runs-on: ubuntu-22.04
     timeout-minutes: 30
 
@@ -78,9 +65,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
-
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -92,13 +77,14 @@ jobs:
         run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
           restore-keys: |
             rust-${{ steps.toolchain.outputs.fingerprint }}-
 
@@ -112,6 +98,146 @@ jobs:
       - name: Build Rust volume binary
         run: cd seaweed-volume && cargo build --release
 
+      - name: Package binaries
+        run: tar cf rust-test-binaries.tar weed/weed seaweed-volume/target/release/weed-volume
+
+      - name: Upload test binaries
+        uses: actions/upload-artifact@v7
+        with:
+          # archive layout mirrors the workspace: weed/weed and
+          # seaweed-volume/target/release/weed-volume
+          name: rust-test-binaries
+          if-no-files-found: error
+          retention-days: 1
+          path: rust-test-binaries.tar
+
+  rust-unit-tests:
+    name: Rust Unit Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
+      # target/ can carry C objects built against a different glibc than we link against.
+      - name: Fingerprint build toolchain
+        id: toolchain
+        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            seaweed-volume/target
+          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock', 'seaweed-common/Cargo.lock') }}
+          restore-keys: |
+            rust-${{ steps.toolchain.outputs.fingerprint }}-
+
+      - name: Build Rust volume server
+        run: cd seaweed-volume && cargo build --release
+
+      # The crate is warning-free under clippy as of the sweep that added
+      # this step. Uncomment to make that a gate; `[lints.clippy]` in
+      # seaweed-volume/Cargo.toml is where crate-wide exceptions live.
+      # - name: Clippy
+      #   run: cd seaweed-volume && cargo clippy --all-targets -- -D warnings
+
+      # The crate is rustfmt-clean as of the PR that added this step.
+      # Uncomment to keep it that way.
+      # - name: Check formatting
+      #   run: cd seaweed-volume && cargo fmt --check
+
+      # seaweed-common is a path dependency of this crate, not a member of its
+      # workspace, so the run below does not reach its own tests. It builds into
+      # this job's cached target directory, and the cache key above covers the
+      # shared crate's lock, so the aws-lc-sys that rustls pulls in is restored
+      # with the cache instead of compiled from scratch on every run.
+      - name: Run shared-crate unit tests
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/seaweed-volume/target
+        run: cd seaweed-common && cargo test
+
+      - name: Run Rust unit tests
+        run: cd seaweed-volume && cargo test
+
+      - name: Run Rust unit tests (redb experimental cursor)
+        run: cd seaweed-volume && cargo test --features redb-experimental-cursor --lib storage::needle_map
+
+  rust-unit-tests-windows:
+    name: Rust Unit Tests (Windows)
+    runs-on: windows-latest
+    timeout-minutes: 30
+    needs: [changes]
+    if: needs.changes.outputs.rust == 'true'
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      # No glibc on Windows: key the cache on the toolchain and OS only.
+      - name: Fingerprint build toolchain
+        id: toolchain
+        run: echo "fingerprint=windows-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            seaweed-volume/target
+          key: rust-windows-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
+          restore-keys: |
+            rust-windows-${{ steps.toolchain.outputs.fingerprint }}-
+
+      - name: Run Rust unit tests
+        run: cd seaweed-volume && cargo test
+
+      - name: Run Rust unit tests (redb experimental cursor)
+        run: cd seaweed-volume && cargo test --features redb-experimental-cursor --lib storage::needle_map
+
+  rust-integration-tests:
+    name: Rust Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    needs: [build-test-binaries]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+
+      - name: Download test binaries
+        uses: actions/download-artifact@v7
+        with:
+          name: rust-test-binaries
+
+      - name: Restore binaries
+        run: |
+          tar xf rust-test-binaries.tar
+          chmod +x weed/weed seaweed-volume/target/release/weed-volume
+          ./weed/weed version
+
       - name: Run integration tests
         env:
           WEED_BINARY: ${{ github.workspace }}/weed/weed
@@ -146,6 +272,7 @@ jobs:
     name: Go Tests with Rust Volume (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
     runs-on: ubuntu-22.04
     timeout-minutes: 45
+    needs: [build-test-binaries]
     env:
       # Keep in step with the length of matrix.shard below.
       SHARD_COUNT: 3
@@ -163,39 +290,19 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
-      # target/ can carry C objects built against a different glibc than we link against.
-      - name: Fingerprint build toolchain
-        id: toolchain
-        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
-
-      - name: Cache cargo registry and target
-        uses: actions/cache@v6
+      - name: Download test binaries
+        uses: actions/download-artifact@v7
         with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            seaweed-volume/target
-          key: rust-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-volume/Cargo.lock') }}
-          restore-keys: |
-            rust-${{ steps.toolchain.outputs.fingerprint }}-
+          name: rust-test-binaries
 
-      - name: Build Go weed binary
+      - name: Restore binaries
         run: |
-          cd weed
-          go build -tags 5BytesOffset -o weed .
-          chmod +x weed
-          ./weed version
-
-      - name: Build Rust volume binary
-        run: cd seaweed-volume && cargo build --release
+          tar xf rust-test-binaries.tar
+          chmod +x weed/weed seaweed-volume/target/release/weed-volume
+          ./weed/weed version
+          ./seaweed-volume/target/release/weed-volume --help >/dev/null || true
 
       # Dealing the listed tests out one by one keeps the shards even. Bucketing
       # them by first letter did not: names cluster, so ^Test[I-S] drew 50 of
diff --git a/.github/workflows/rust-worker-tests.yml b/.github/workflows/rust-worker-tests.yml
new file mode 100644
index 0000000000..7bfaecb695
--- /dev/null
+++ b/.github/workflows/rust-worker-tests.yml
@@ -0,0 +1,107 @@
+name: "Rust Plugin Worker Tests"
+
+on:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'seaweed-worker/**'
+      - 'seaweed-common/**'
+      - 'weed/pb/plugin.proto'
+      - '.github/workflows/rust-worker-tests.yml'
+  push:
+    branches: [ master, main ]
+    paths:
+      - 'seaweed-worker/**'
+      - 'seaweed-common/**'
+      - 'weed/pb/plugin.proto'
+      - '.github/workflows/rust-worker-tests.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
+permissions:
+  contents: read
+
+jobs:
+  rust-worker-build:
+    name: Rust Plugin Worker Build and Unit Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      # cargo tracks its own inputs but not the runner's C toolchain, so a cached
+      # target/ can carry C objects built against a different glibc than we link against.
+      - name: Fingerprint build toolchain
+        id: toolchain
+        run: echo "fingerprint=$(getconf GNU_LIBC_VERSION | tr ' ' '-')-rustc-$(rustc -V | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+
+      - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            seaweed-worker/target/release
+          key: rust-worker-${{ steps.toolchain.outputs.fingerprint }}-${{ hashFiles('seaweed-worker/Cargo.lock', 'seaweed-common/Cargo.lock') }}
+          restore-keys: |
+            rust-worker-${{ steps.toolchain.outputs.fingerprint }}-
+
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          # The version from the lock, not whatever else a restored cache holds.
+          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
+          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
+          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
+          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
+      # The release profile is what ships, and it is where the release and the
+      # container builds would otherwise discover a break for the first time.
+      - name: Build the plugin workers
+        run: cd seaweed-worker && cargo build --release
+
+      # The workspace is warning-free under clippy as of the sweep that added
+      # this step. Uncomment to make that a gate; `[workspace.lints.clippy]`
+      # in seaweed-worker/Cargo.toml is where crate-wide exceptions live.
+      # - name: Clippy
+      #   run: cd seaweed-worker && cargo clippy --workspace --all-targets -- -D warnings
+
+      # The workspace is rustfmt-clean as of the PR that added this step.
+      # Uncomment to keep it that way.
+      # - name: Check formatting
+      #   run: cd seaweed-worker && cargo fmt --all --check
+
+      # seaweed-common is a path dependency of core and lance, not a member of
+      # this workspace, so `--workspace` below does not reach its own tests.
+      # Release and this job's cached target directory, and the cache key above
+      # covers the shared crate's lock. That lock pins the same rustls and
+      # aws-lc-sys this workspace resolves, so the release build above has
+      # already paid for them.
+      - name: Run shared-crate unit tests
+        env:
+          CARGO_TARGET_DIR: ${{ github.workspace }}/seaweed-worker/target
+        run: cd seaweed-common && cargo test --release
+
+      # The tests that need a live gateway skip themselves without one, the way
+      # the Go integration tests skip without Docker; the lifecycle suite in
+      # test/s3tables/lifecycle is what runs them against a real cluster.
+      # Release, so this reuses the build above rather than compiling lance,
+      # arrow and datafusion a second time in another profile.
+      - name: Run unit tests
+        run: cd seaweed-worker && cargo test --release --workspace
diff --git a/.github/workflows/rust_binaries_dev.yml b/.github/workflows/rust_binaries_dev.yml
index 9c4aacc716..e49abdbbd8 100644
--- a/.github/workflows/rust_binaries_dev.yml
+++ b/.github/workflows/rust_binaries_dev.yml
@@ -5,6 +5,7 @@ on:
     branches: [ master ]
     paths:
       - 'seaweed-volume/**'
+      - 'seaweed-common/**'
       - '.github/workflows/rust_binaries_dev.yml'
 
 permissions:
@@ -41,13 +42,11 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
@@ -110,15 +109,13 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install protobuf compiler
-        run: brew install protobuf
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
diff --git a/.github/workflows/rust_binaries_release.yml b/.github/workflows/rust_binaries_release.yml
index 46c596fc30..f9446a917a 100644
--- a/.github/workflows/rust_binaries_release.yml
+++ b/.github/workflows/rust_binaries_release.yml
@@ -1,4 +1,4 @@
-name: "rust: build versioned volume server binaries"
+name: "rust: build versioned binaries"
 
 on:
   push:
@@ -28,9 +28,6 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install protobuf compiler
-        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
@@ -51,6 +48,7 @@ jobs:
           echo "OPENSSL_LIB_DIR=/usr/lib/aarch64-linux-gnu" >> "$GITHUB_ENV"
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
@@ -116,6 +114,103 @@ jobs:
             weed-volume_${{ matrix.asset_suffix }}.tar.gz
             weed-volume_${{ matrix.asset_suffix }}.tar.gz.md5
 
+  # The Rust maintenance worker: Linux only, because it runs beside the cluster
+  # it maintains rather than on a laptop, and its dependency tree (lance, arrow,
+  # datafusion) makes every extra target an expensive build.
+  build-rust-worker-linux:
+    permissions:
+      contents: write
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            asset_suffix: linux_amd64
+          - target: aarch64-unknown-linux-gnu
+            asset_suffix: linux_arm64
+            cross: true
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # The upload step is handed a token explicitly; a cargo build script
+          # should not find another one sitting in the checkout's git config.
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross-compilation tools
+        if: matrix.cross
+        run: |
+          sudo dpkg --add-architecture arm64
+          sudo sed -i 's/^deb /deb [arch=amd64] /' /etc/apt/sources.list
+          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy main restricted universe multiverse" | sudo tee /etc/apt/sources.list.d/arm64.list
+          echo "deb [arch=arm64] http://ports.ubuntu.com/ jammy-updates main restricted universe multiverse" | sudo tee -a /etc/apt/sources.list.d/arm64.list
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu
+          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
+
+      - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            seaweed-worker/target/${{ matrix.target }}/release
+          key: rust-worker-release-${{ matrix.target }}-${{ hashFiles('seaweed-worker/Cargo.lock') }}
+          restore-keys: |
+            rust-worker-release-${{ matrix.target }}-
+
+      # lance's build scripts compile their own protos and look for a protoc.
+      # Point them at the one protoc-bin-vendored ships, which seaweed-worker's
+      # own build already uses, so no job depends on a system package and every
+      # build sees the same version.
+      - name: Use the vendored protoc
+        run: |
+          cd seaweed-worker
+          cargo fetch
+          # The version from the lock, not whatever else a restored cache holds.
+          version=$(awk '/^name = "protoc-bin-vendored-linux-x86_64"$/{found=1; next} found && /^version = /{gsub(/"/,"",$3); print $3; exit}' Cargo.lock)
+          test -n "$version" || { echo "protoc-bin-vendored-linux-x86_64 is not in Cargo.lock" >&2; exit 1; }
+          protoc=$(find ~/.cargo/registry/src -path "*protoc-bin-vendored-linux-x86_64-$version/bin/protoc" | head -1)
+          test -x "$protoc" || { echo "no vendored protoc $version in the registry" >&2; exit 1; }
+          echo "PROTOC=$protoc" >> "$GITHUB_ENV"
+
+      - name: Build the Rust maintenance worker
+        run: |
+          cd seaweed-worker
+          cargo build --release -p weed-lance-worker --target ${{ matrix.target }}
+
+      - name: Package binary
+        run: |
+          cp seaweed-worker/target/${{ matrix.target }}/release/weed-worker weed-worker
+          tar czf weed-worker_${{ matrix.asset_suffix }}.tar.gz weed-worker
+          rm weed-worker
+          md5sum weed-worker_${{ matrix.asset_suffix }}.tar.gz > weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
+
+      - name: Upload release assets
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: softprops/action-gh-release@v3
+        with:
+          files: |
+            weed-worker_${{ matrix.asset_suffix }}.tar.gz
+            weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload artifacts
+        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: rust-worker-${{ matrix.asset_suffix }}
+          path: |
+            weed-worker_${{ matrix.asset_suffix }}.tar.gz
+            weed-worker_${{ matrix.asset_suffix }}.tar.gz.md5
+
   build-rust-volume-darwin:
     permissions:
       contents: write
@@ -131,15 +226,13 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install protobuf compiler
-        run: brew install protobuf
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.target }}
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
@@ -211,13 +304,11 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - name: Install protobuf compiler
-        run: choco install protoc -y
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo registry and target
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: |
diff --git a/.github/workflows/s3-etag-acl-tests.yml b/.github/workflows/s3-etag-acl-tests.yml
index 12425f6f70..5f8754a372 100644
--- a/.github/workflows/s3-etag-acl-tests.yml
+++ b/.github/workflows/s3-etag-acl-tests.yml
@@ -21,8 +21,8 @@ on:
       - '.github/workflows/s3-etag-acl-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-etag-acl-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -40,6 +40,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Install SeaweedFS
         run: |
diff --git a/.github/workflows/s3-example-integration-tests.yml b/.github/workflows/s3-example-integration-tests.yml
index 23e2967735..d0855c65ca 100644
--- a/.github/workflows/s3-example-integration-tests.yml
+++ b/.github/workflows/s3-example-integration-tests.yml
@@ -13,8 +13,8 @@ on:
       - '.github/workflows/s3-example-integration-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/s3-integration-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -33,6 +33,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Build SeaweedFS
@@ -64,6 +65,14 @@ jobs:
           echo "=== Running S3 Empty Directory Marker Tests ==="
           go test -v -timeout=180s -run TestS3ListObjectsEmptyDirectoryMarkers ./...
 
+      - name: Run S3 Prefix Object Tests
+        timeout-minutes: 15
+        working-directory: test/s3/normal
+        run: |
+          set -x
+          echo "=== Running S3 Prefix Object Tests ==="
+          go test -v -timeout=180s -run TestS3PrefixObjectKeys ./...
+
       - name: Run IAM Integration Tests
         timeout-minutes: 15
         working-directory: test/s3/normal
diff --git a/.github/workflows/s3-filer-group-tests.yml b/.github/workflows/s3-filer-group-tests.yml
index bda1ac2bca..d714ca98e3 100644
--- a/.github/workflows/s3-filer-group-tests.yml
+++ b/.github/workflows/s3-filer-group-tests.yml
@@ -12,8 +12,8 @@ on:
       - '.github/workflows/s3-filer-group-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/s3-filer-group-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -32,10 +32,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -50,7 +54,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Filer Group Tests ==="
           
           # Run tests with automatic server management
diff --git a/.github/workflows/s3-go-tests.yml b/.github/workflows/s3-go-tests.yml
index 19944e9eb1..1260e5af41 100644
--- a/.github/workflows/s3-go-tests.yml
+++ b/.github/workflows/s3-go-tests.yml
@@ -12,8 +12,8 @@ on:
       - '.github/workflows/s3-go-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/s3-go-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -35,10 +35,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -53,7 +57,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Tests ==="
           
           # Run tests with automatic server management
@@ -103,6 +107,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -151,6 +156,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -198,10 +204,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -216,7 +226,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Tests ==="
           
           # Run tests with automatic server management
@@ -283,6 +293,7 @@ jobs:
           - TestLifecycleSuspendedVersioningExpiration
           - TestLifecycleTagFilter
           - TestLifecycleVersionedBucketCreatesDeleteMarker
+          - TestLifecycleVersionedBucketExpiresOnSecondRun
 
     steps:
       - name: Check out code
@@ -292,6 +303,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -333,10 +345,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -351,7 +367,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Tests ==="
           make test-with-server
 
@@ -391,10 +407,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -409,7 +429,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Tests ==="
           
           # Run tests with automatic server management
@@ -459,6 +479,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -508,6 +529,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -576,6 +598,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -631,6 +654,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
diff --git a/.github/workflows/s3-iam-tests.yml b/.github/workflows/s3-iam-tests.yml
index 121f835083..9d57baf978 100644
--- a/.github/workflows/s3-iam-tests.yml
+++ b/.github/workflows/s3-iam-tests.yml
@@ -20,8 +20,8 @@ on:
       - '.github/workflows/s3-iam-tests.yml'
   
 concurrency:
-  group: ${{ github.head_ref }}/s3-iam-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -45,6 +45,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Get dependencies
@@ -90,10 +91,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -109,7 +114,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting S3 IAM Integration Tests (${{ matrix.test-type }}) ==="
           
           # Set WEED_BINARY to use the installed version
@@ -208,6 +213,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -268,6 +274,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
diff --git a/.github/workflows/s3-keycloak-tests.yml b/.github/workflows/s3-keycloak-tests.yml
index d2677431c1..f3955ca3fc 100644
--- a/.github/workflows/s3-keycloak-tests.yml
+++ b/.github/workflows/s3-keycloak-tests.yml
@@ -16,8 +16,8 @@ on:
       - '.github/workflows/s3-keycloak-tests.yml'
   
 concurrency:
-  group: ${{ github.head_ref }}/s3-keycloak-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -37,10 +37,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -56,7 +60,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting S3 Keycloak Integration Tests ==="
           
           # Set WEED_BINARY to use the installed version
diff --git a/.github/workflows/s3-mutation-regression-tests.yml b/.github/workflows/s3-mutation-regression-tests.yml
index acf09a8f27..d352215176 100644
--- a/.github/workflows/s3-mutation-regression-tests.yml
+++ b/.github/workflows/s3-mutation-regression-tests.yml
@@ -12,8 +12,8 @@ on:
       - '.github/workflows/s3-mutation-regression-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/s3-mutation-regression-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -32,6 +32,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Run S3 versioning regression tests
         timeout-minutes: 20
@@ -85,6 +86,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Run S3 delete regression tests
         timeout-minutes: 15
@@ -123,6 +125,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Build SeaweedFS
         run: |
diff --git a/.github/workflows/s3-parquet-tests.yml b/.github/workflows/s3-parquet-tests.yml
index 92e47b8f01..d0a99b04be 100644
--- a/.github/workflows/s3-parquet-tests.yml
+++ b/.github/workflows/s3-parquet-tests.yml
@@ -23,6 +23,10 @@ env:
   S3_ENDPOINT_URL: http://localhost:8333
   BUCKET_NAME: test-parquet-bucket
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 jobs:
   parquet-integration-tests:
     name: PyArrow Parquet Tests (Python ${{ matrix.python-version }})
@@ -41,14 +45,14 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: ^1.25
-          cache: true
+          go-version: ^1.26
+          cache: ${{ runner.environment == 'github-hosted' }}
       
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
-          cache: 'pip'
+          cache: ${{ runner.environment == 'github-hosted' && 'pip' || '' }}
           cache-dependency-path: 'test/s3/parquet/requirements.txt'
       
       - name: Install system dependencies
@@ -139,7 +143,8 @@ jobs:
   unit-tests:
     name: Go Unit Tests (Implicit Directory)
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # Leave time for setup and the focused run before the nine-minute suite.
+    timeout-minutes: 20
     
     steps:
       - name: Checkout code
@@ -148,8 +153,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
-          go-version: ^1.25
-          cache: true
+          go-version: ^1.26
+          cache: ${{ runner.environment == 'github-hosted' }}
       
       - name: Run Go unit tests
         run: |
@@ -159,5 +164,5 @@ jobs:
       - name: Run all S3 API tests
         run: |
           cd weed/s3api
-          go test -v -timeout 5m
+          go test -v -timeout 9m
 
diff --git a/.github/workflows/s3-policy-tests.yml b/.github/workflows/s3-policy-tests.yml
index 7bb900c150..2fbeff3474 100644
--- a/.github/workflows/s3-policy-tests.yml
+++ b/.github/workflows/s3-policy-tests.yml
@@ -24,8 +24,8 @@ on:
       - '.github/workflows/s3-policy-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/s3-policy-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -49,6 +49,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Get dependencies
@@ -88,10 +89,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -106,7 +111,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           
           echo "=== Starting S3 Policy Variables Integration Tests ==="
           
@@ -197,10 +202,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -215,7 +224,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           
           echo "=== Starting S3 Policy Enforcement Tests (${{ matrix.test-case }}) ==="
           
@@ -319,6 +328,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -406,6 +416,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
diff --git a/.github/workflows/s3-proxy-signature-tests.yml b/.github/workflows/s3-proxy-signature-tests.yml
index a8cc6c3679..ded2068737 100644
--- a/.github/workflows/s3-proxy-signature-tests.yml
+++ b/.github/workflows/s3-proxy-signature-tests.yml
@@ -21,8 +21,8 @@ on:
       - '.github/workflows/s3-proxy-signature-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-proxy-signature-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -40,6 +40,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
diff --git a/.github/workflows/s3-sdk-v2-routing-tests.yml b/.github/workflows/s3-sdk-v2-routing-tests.yml
index e63528e145..65aac2004a 100644
--- a/.github/workflows/s3-sdk-v2-routing-tests.yml
+++ b/.github/workflows/s3-sdk-v2-routing-tests.yml
@@ -15,8 +15,8 @@ on:
       - '.github/workflows/s3-sdk-v2-routing-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/s3-sdk-v2-routing-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -34,6 +34,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Install SeaweedFS
         run: |
diff --git a/.github/workflows/s3-snowflake-tests.yml b/.github/workflows/s3-snowflake-tests.yml
new file mode 100644
index 0000000000..94163e36cd
--- /dev/null
+++ b/.github/workflows/s3-snowflake-tests.yml
@@ -0,0 +1,107 @@
+name: "Snowflake S3Compat API tests"
+
+on:
+  push:
+    branches: [ master ]
+    paths:
+      - 'weed/s3api/**'
+      - 'weed/filer/**'
+      - 'weed/server/**'
+      - 'weed/iam/**'
+      - 'weed/command/**'
+      - 'weed/storage/**'
+      - 'weed/operation/**'
+      - 'weed/wdclient/**'
+      - 'weed/cluster/**'
+      - 'weed/pb/**'
+      - 'test/s3/snowflake/**'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/s3-snowflake-tests.yml'
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'weed/s3api/**'
+      - 'weed/filer/**'
+      - 'weed/server/**'
+      - 'weed/iam/**'
+      - 'weed/command/**'
+      - 'weed/storage/**'
+      - 'weed/operation/**'
+      - 'weed/wdclient/**'
+      - 'weed/cluster/**'
+      - 'weed/pb/**'
+      - 'test/s3/snowflake/**'
+      - 'go.mod'
+      - 'go.sum'
+      - '.github/workflows/s3-snowflake-tests.yml'
+
+concurrency:
+  group: ${{ github.event.pull_request.number || github.ref }}/s3-snowflake-tests
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  snowflake-s3compat-tests:
+    name: Snowflake S3Compat API tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    env:
+      WORK_DIR: /tmp/seaweedfs-snowflake-tests
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+        id: go
+
+      - name: Set up Java
+        uses: actions/setup-java@v6
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: ${{ runner.environment == 'github-hosted' && 'maven' || '' }}
+
+      - name: Install SeaweedFS
+        run: |
+          cd weed
+          go install -buildvcs=false
+          weed version
+
+      - name: Run Snowflake S3Compat API tests
+        timeout-minutes: 20
+        run: |
+          # Starts weed server, creates the buckets/objects the suite needs,
+          # clones the upstream suite, and runs mvn -Dtest=S3CompatApiTest.
+          bash test/s3/snowflake/run.sh
+
+      - name: Show logs on failure
+        if: failure()
+        run: |
+          echo "=== SeaweedFS Server Log ==="
+          tail -200 "$WORK_DIR/weed.log" || echo "No server log"
+          echo ""
+          echo "=== Surefire results ==="
+          cat "$WORK_DIR"/snowflake-s3compat-api-test-suite/s3compatapi/target/surefire-reports/*.txt 2>/dev/null || echo "No surefire reports"
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: snowflake-s3compat-surefire-reports
+          path: /tmp/seaweedfs-snowflake-tests/snowflake-s3compat-api-test-suite/s3compatapi/target/surefire-reports/
+          retention-days: 14
+
+      - name: Cleanup
+        if: always()
+        run: |
+          pkill -9 -f "weed server" || true
+          rm -rf "$WORK_DIR" || true
diff --git a/.github/workflows/s3-spark-tests.yml b/.github/workflows/s3-spark-tests.yml
index c8682992de..59fae691a8 100644
--- a/.github/workflows/s3-spark-tests.yml
+++ b/.github/workflows/s3-spark-tests.yml
@@ -11,8 +11,8 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.head_ref }}/s3-spark-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -27,10 +27,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -56,7 +60,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting S3 Spark Integration Tests ==="
 
           go test -v -timeout 30m . 2>&1 | tee test-output.log || {
diff --git a/.github/workflows/s3-sse-tests.yml b/.github/workflows/s3-sse-tests.yml
index d1e2102203..2ea0531f0a 100644
--- a/.github/workflows/s3-sse-tests.yml
+++ b/.github/workflows/s3-sse-tests.yml
@@ -23,8 +23,8 @@ on:
       - 'test/s3/sse/**'
   
 concurrency:
-  group: ${{ github.head_ref }}/s3-sse-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -46,10 +46,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -64,7 +68,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting SSE Tests ==="
           
           # Run tests with automatic server management
@@ -118,6 +122,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -166,6 +171,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -215,6 +221,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -264,6 +271,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -315,6 +323,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -363,6 +372,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
diff --git a/.github/workflows/s3-tables-tests.yml b/.github/workflows/s3-tables-tests.yml
index 4085ab54d1..19674a3325 100644
--- a/.github/workflows/s3-tables-tests.yml
+++ b/.github/workflows/s3-tables-tests.yml
@@ -6,11 +6,16 @@ on:
       - 'weed/s3api/**'
       - 'weed/filer/**'
       - 'weed/server/**'
+      - 'weed/worker/tasks/iceberg/**'
       - 'test/s3tables/**'
       - 'go.mod'
       - 'go.sum'
       - '.github/workflows/s3-tables-tests.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
@@ -25,10 +30,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Run go mod tidy
@@ -47,7 +56,8 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          # A stale FUSE mount can hang or fail df; keep diagnostics best effort.
+          timeout 15 df -h || true
           echo "=== Starting S3 Tables Tests ==="
           
           # Run S3 Tables integration tests
@@ -85,10 +95,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -108,7 +122,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Iceberg Catalog Tests ==="
           
           # Run Iceberg catalog integration tests using Makefile (handles build)
@@ -146,10 +160,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -178,7 +196,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Trino Iceberg Catalog Tests ==="
           
           # Run Trino + Iceberg catalog integration tests
@@ -216,10 +234,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -249,7 +271,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           docker info
           echo "=== Starting Dremio Iceberg Catalog Tests ==="
 
@@ -289,10 +311,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -322,7 +348,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           docker info
           echo "=== Starting Doris Iceberg Catalog Tests ==="
 
@@ -354,18 +380,32 @@ jobs:
           retention-days: 3
 
   clickhouse-iceberg-catalog-tests:
-    name: ClickHouse Iceberg Catalog Integration Tests
+    name: ClickHouse Iceberg Catalog Integration Tests (${{ matrix.tag }})
     runs-on: ubuntu-22.04
     timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Pinned baseline, and latest so new ClickHouse releases are
+          # exercised without a code change.
+          - clickhouse-image: clickhouse/clickhouse-server:25.8
+            tag: "25.8"
+          - clickhouse-image: clickhouse/clickhouse-server:latest
+            tag: latest
 
     steps:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -376,7 +416,7 @@ jobs:
       - name: Pre-pull images
         run: |
           pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
-          pull clickhouse/clickhouse-server:25.8
+          pull ${{ matrix.clickhouse-image }}
           pull python:3.11-slim
 
       - name: Run go mod tidy
@@ -389,13 +429,15 @@ jobs:
       - name: Run ClickHouse Iceberg Catalog Integration Tests
         timeout-minutes: 25
         working-directory: test/s3tables/catalog_clickhouse
+        env:
+          CLICKHOUSE_IMAGE: ${{ matrix.clickhouse-image }}
         run: |
           set -x
           set -o pipefail
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           docker info
           echo "=== Starting ClickHouse Iceberg Catalog Tests ==="
 
@@ -422,10 +464,125 @@ jobs:
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: clickhouse-iceberg-catalog-test-logs
+          name: clickhouse-iceberg-catalog-test-logs-${{ matrix.tag }}
           path: test/s3tables/catalog_clickhouse/test-output.log
           retention-days: 3
 
+  olake-iceberg-catalog-tests:
+    name: OLake Iceberg Catalog Integration Tests (${{ matrix.tag }})
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Pinned baseline, and latest so new OLake releases are exercised
+          # without a code change. OLake's Iceberg writer is a Java sidecar
+          # whose Iceberg version moves independently of the Go release, so
+          # the latest leg is the one that catches library drift.
+          - olake-image: olakego/source-postgres:v0.10.1
+            tag: "v0.10.1"
+          - olake-image: olakego/source-postgres:latest
+            tag: latest
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+        id: go
+
+      - name: Configure Docker Hub mirror
+        run: |
+          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+
+      - name: Pre-pull images
+        run: |
+          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
+          pull ${{ matrix.olake-image }}
+          pull postgres:16
+          pull python:3.11-slim
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Install SeaweedFS
+        run: |
+          go install -buildvcs=false ./weed
+
+      - name: Run OLake Iceberg Catalog Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/catalog_olake
+        env:
+          OLAKE_IMAGE: ${{ matrix.olake-image }}
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          timeout 15 df -h || true
+          docker info
+          echo "=== Starting OLake Iceberg Catalog Tests ==="
+
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "OLake Iceberg catalog integration tests failed"
+            exit 1
+          }
+
+      # The suite skips itself when Docker is unavailable, so a green job is not
+      # by itself evidence that anything ran. Assert execution explicitly.
+      - name: Assert the suite actually ran
+        working-directory: test/s3tables/catalog_olake
+        run: |
+          log=test-output.log
+          if [ ! -f "$log" ]; then
+            echo "::error::no test-output.log; the suite did not run"
+            exit 1
+          fi
+          passes=$(grep -c '^--- PASS' "$log" || true)
+          skips=$(grep -c '^--- SKIP' "$log" || true)
+          echo "top-level PASS=$passes SKIP=$skips"
+          if [ "$skips" -gt 0 ]; then
+            echo "::error::the OLake suite skipped $skips top-level test(s); the environment it needs was not provisioned, so this job proves nothing"
+            grep '^--- SKIP' "$log" | head -20
+            exit 1
+          fi
+          if [ "$passes" -lt 1 ]; then
+            echo "::error::the OLake suite recorded no passing top-level test"
+            exit 1
+          fi
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog_olake
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker|olake|postgres)" || true
+          echo "=== Containers ==="
+          docker ps -a | head -30 || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: olake-iceberg-catalog-test-logs-${{ matrix.tag }}
+          path: test/s3tables/catalog_olake/test-output.log
+          retention-days: 3
+
   polaris-integration-tests:
     name: Polaris Integration Tests
     runs-on: ubuntu-22.04
@@ -435,10 +592,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Run go mod tidy
@@ -466,7 +627,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Polaris Tests ==="
 
           go test -v -timeout 20m ./test/s3tables/polaris 2>&1 | tee test/s3tables/polaris/test-output.log || {
@@ -503,10 +664,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -535,7 +700,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Spark Iceberg Catalog Tests ==="
           
           # Run Spark + Iceberg catalog integration tests
@@ -573,10 +738,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -606,7 +775,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting RisingWave Catalog Tests ==="
           
           # Run RisingWave catalog integration tests
@@ -644,10 +813,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -661,6 +834,7 @@ jobs:
 
       - name: Restore python:3 image cache
         id: python-image
+        if: runner.environment == 'github-hosted'
         uses: actions/cache@v6
         with:
           path: /tmp/python3-image.tar
@@ -700,7 +874,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting STS Integration Tests ==="
           
           # Run STS integration tests
@@ -738,10 +912,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Run go mod tidy
@@ -760,7 +938,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting Lakekeeper Integration Tests ==="
           
           # Run Lakekeeper integration tests
@@ -798,10 +976,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Configure Docker Hub mirror
@@ -831,7 +1013,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           docker info
           echo "=== Starting Unity Catalog Tests ==="
 
@@ -862,6 +1044,306 @@ jobs:
           path: test/s3tables/unity_catalog/test-output.log
           retention-days: 3
 
+  lancedb-namespace-tests:
+    name: LanceDB Namespace Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+        id: go
+
+      - name: Configure Docker Hub mirror
+        run: |
+          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+
+      - name: Pre-pull images
+        run: |
+          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
+          pull python:3.11-slim
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Build SeaweedFS
+        run: |
+          cd weed && go build -buildvcs=false .
+
+      - name: Run LanceDB Namespace Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/catalog_lancedb
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          timeout 15 df -h || true
+          docker info
+          echo "=== Starting LanceDB Namespace Tests ==="
+
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "LanceDB namespace integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog_lancedb
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: lancedb-namespace-test-logs
+          path: test/s3tables/catalog_lancedb/test-output.log
+          retention-days: 3
+
+  table-lifecycle-tests:
+    name: Table Lifecycle Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+        id: go
+
+      - name: Configure Docker Hub mirror
+        run: |
+          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+
+      - name: Pre-pull images
+        run: |
+          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
+          pull python:3.11-slim
+          pull duckdb/duckdb:latest
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Build SeaweedFS
+        run: |
+          cd weed && go build -buildvcs=false .
+
+      - name: Run Table Lifecycle Integration Tests
+        timeout-minutes: 35
+        working-directory: test/s3tables/lifecycle
+        env:
+          # The Rust worker's own tests cover its handlers; a cold build of the
+          # lance crate costs more here than the layer it would be checking.
+          WEED_LANCE_MAINTENANCE: library
+        run: |
+          set -x
+          set -o pipefail
+          go test -v -timeout 30m . 2>&1 | tee test-output.log || {
+            echo "Table lifecycle integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/lifecycle
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: table-lifecycle-test-logs
+          path: test/s3tables/lifecycle/test-output.log
+          retention-days: 3
+
+  duckdb-lance-tests:
+    name: DuckDB Lance Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          # The job uploads a test log on failure; nothing here needs to push,
+          # so do not leave a token in the checkout for it to pick up.
+          persist-credentials: false
+
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+        id: go
+
+      - name: Configure Docker Hub mirror
+        run: |
+          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+
+      - name: Pre-pull images
+        run: |
+          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
+          pull duckdb/duckdb:latest
+          pull python:3.11-slim
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Build SeaweedFS
+        run: |
+          cd weed && go build -buildvcs=false .
+
+      - name: Run DuckDB Lance Integration Tests
+        timeout-minutes: 25
+        working-directory: test/s3tables/catalog_duckdb_lance
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          timeout 15 df -h || true
+          docker info
+          echo "=== Starting DuckDB Lance Tests ==="
+
+          go test -v -timeout 20m . 2>&1 | tee test-output.log || {
+            echo "DuckDB Lance integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog_duckdb_lance
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker|duckdb)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: duckdb-lance-test-logs
+          path: test/s3tables/catalog_duckdb_lance/test-output.log
+          retention-days: 3
+
+  spark-lance-namespace-tests:
+    name: Spark Lance Namespace Integration Tests
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v7
+        with:
+          # The job uploads a test log on failure; nothing here needs to push,
+          # so do not leave a token in the checkout for it to pick up.
+          persist-credentials: false
+
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+        id: go
+
+      - name: Configure Docker Hub mirror
+        run: |
+          echo '{"registry-mirrors": ["https://mirror.gcr.io"]}' | sudo tee /etc/docker/daemon.json
+          sudo systemctl restart docker
+
+      - name: Pre-pull images
+        run: |
+          pull() { for i in 1 2 3; do docker pull "$1" && return 0; sleep 15; done; return 1; }
+          pull apache/spark:3.5.1
+
+      - name: Run go mod tidy
+        run: go mod tidy
+
+      - name: Build SeaweedFS
+        run: |
+          cd weed && go build -buildvcs=false .
+
+      - name: Run Spark Lance Namespace Integration Tests
+        timeout-minutes: 35
+        working-directory: test/s3tables/catalog_spark_lance
+        run: |
+          set -x
+          set -o pipefail
+          echo "=== System Information ==="
+          uname -a
+          free -h
+          timeout 15 df -h || true
+          docker info
+          echo "=== Starting Spark Lance Namespace Tests ==="
+
+          go test -v -timeout 30m . 2>&1 | tee test-output.log || {
+            echo "Spark Lance namespace integration tests failed"
+            exit 1
+          }
+
+      - name: Show test output on failure
+        if: failure()
+        working-directory: test/s3tables/catalog_spark_lance
+        run: |
+          echo "=== Test Output ==="
+          if [ -f test-output.log ]; then
+            tail -200 test-output.log
+          fi
+
+          echo "=== Process information ==="
+          ps aux | grep -E "(weed|test|docker|spark)" || true
+
+      - name: Upload test logs on failure
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: spark-lance-namespace-test-logs
+          path: test/s3tables/catalog_spark_lance/test-output.log
+          retention-days: 3
+
   s3-tables-build-verification:
     name: S3 Tables Build Verification
     runs-on: ubuntu-22.04
@@ -875,6 +1357,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Verify S3 Tables Package Builds
@@ -940,6 +1423,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Check Go Format
@@ -991,6 +1475,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Run Go Vet
diff --git a/.github/workflows/s3tests.yml b/.github/workflows/s3tests.yml
index 6ac67ab368..971cd033d5 100644
--- a/.github/workflows/s3tests.yml
+++ b/.github/workflows/s3tests.yml
@@ -25,8 +25,8 @@ on:
       - '.github/workflows/s3tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/s3tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -44,6 +44,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Set up Python
@@ -57,9 +58,9 @@ jobs:
           cd s3-tests
           sudo apt-get update -qq
           sudo apt-get install -y -qq libxml2-dev libxslt1-dev zlib1g-dev
-          pip install -r requirements.txt
-          pip install tox
-          pip install -e .
+          python3 -m pip install -r requirements.txt
+          python3 -m pip install tox
+          python3 -m pip install -e .
 
       - name: Fix S3 tests bucket creation conflicts
         run: |
@@ -128,6 +129,9 @@ jobs:
           echo "All SeaweedFS components are ready!"
           cd ../s3-tests
           sed -i "s/assert prefixes == \['foo%2B1\/', 'foo\/', 'quux%20ab\/'\]/assert prefixes == \['foo\/', 'foo%2B1\/', 'quux%20ab\/'\]/" s3tests/functional/test_s3.py
+          # The suite expects RGW's 400 InvalidPart for a partNumber past the last
+          # part; AWS answers 416 InvalidPartNumber, which is what we return.
+          sed -i "/# request PartNumber out of range/,+4{s/assert status == 400/assert status == 416/; s/assert error_code == 'InvalidPart'/assert error_code == 'InvalidPartNumber'/}" s3tests/functional/test_s3.py
           
           # Debug: Show the config file contents
           echo "=== S3 Config File Contents ==="
@@ -286,6 +290,11 @@ jobs:
           s3tests/functional/test_s3.py::test_object_write_check_etag \
           s3tests/functional/test_s3.py::test_object_write_cache_control \
           s3tests/functional/test_s3.py::test_object_write_expires \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_s3 \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_kms \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_s3_kms \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_bad_enc_kms \
+          s3tests/functional/test_s3.py::test_object_content_encoding_aws_chunked \
           s3tests/functional/test_s3.py::test_object_write_read_update_read_delete \
           s3tests/functional/test_s3.py::test_object_metadata_replaced_on_put \
           s3tests/functional/test_s3.py::test_object_write_file \
@@ -308,6 +317,7 @@ jobs:
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_good \
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_failed \
           s3tests/functional/test_s3.py::test_get_object_ifunmodifiedsince_failed \
+          s3tests/functional/test_s3.py::test_get_checksum_object_attributes \
           s3tests/functional/test_s3.py::test_bucket_head \
           s3tests/functional/test_s3.py::test_bucket_head_notexist \
           s3tests/functional/test_s3.py::test_object_raw_authenticated \
@@ -387,6 +397,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Set up Python
@@ -400,9 +411,9 @@ jobs:
           cd s3-tests
           sudo apt-get update -qq
           sudo apt-get install -y -qq libxml2-dev libxslt1-dev zlib1g-dev
-          pip install -r requirements.txt
-          pip install tox
-          pip install -e .
+          python3 -m pip install -r requirements.txt
+          python3 -m pip install tox
+          python3 -m pip install -e .
 
       - name: Fix S3 tests bucket creation conflicts
         run: |
@@ -557,6 +568,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Set up Python
@@ -570,9 +582,9 @@ jobs:
           cd s3-tests
           sudo apt-get update -qq
           sudo apt-get install -y -qq libxml2-dev libxslt1-dev zlib1g-dev
-          pip install -r requirements.txt
-          pip install tox
-          pip install -e .
+          python3 -m pip install -r requirements.txt
+          python3 -m pip install tox
+          python3 -m pip install -e .
 
       - name: Run S3 CORS tests
         timeout-minutes: 10
@@ -682,6 +694,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Run SeaweedFS Custom S3 Copy tests
@@ -784,6 +797,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Set up Python
@@ -797,9 +811,9 @@ jobs:
           cd s3-tests
           sudo apt-get update -qq
           sudo apt-get install -y -qq libxml2-dev libxslt1-dev zlib1g-dev
-          pip install -r requirements.txt
-          pip install tox
-          pip install -e .
+          python3 -m pip install -r requirements.txt
+          python3 -m pip install tox
+          python3 -m pip install -e .
 
       - name: Run Ceph S3 tests with SQL store
         timeout-minutes: 15
@@ -968,6 +982,9 @@ jobs:
           echo "All SeaweedFS components are ready!"
           cd ../s3-tests
           sed -i "s/assert prefixes == \['foo%2B1\/', 'foo\/', 'quux%20ab\/'\]/assert prefixes == \['foo\/', 'foo%2B1\/', 'quux%20ab\/'\]/" s3tests/functional/test_s3.py
+          # The suite expects RGW's 400 InvalidPart for a partNumber past the last
+          # part; AWS answers 416 InvalidPartNumber, which is what we return.
+          sed -i "/# request PartNumber out of range/,+4{s/assert status == 400/assert status == 416/; s/assert error_code == 'InvalidPart'/assert error_code == 'InvalidPartNumber'/}" s3tests/functional/test_s3.py
           # Create and update s3tests.conf to use port 8004
           cp ../docker/compose/s3tests.conf ../docker/compose/s3tests-sql.conf
           sed -i 's/port = 8000/port = 8004/g' ../docker/compose/s3tests-sql.conf
@@ -1143,6 +1160,11 @@ jobs:
           s3tests/functional/test_s3.py::test_object_write_check_etag \
           s3tests/functional/test_s3.py::test_object_write_cache_control \
           s3tests/functional/test_s3.py::test_object_write_expires \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_s3 \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_c_kms \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_s3_kms \
+          s3tests/functional/test_s3.py::test_put_obj_enc_conflict_bad_enc_kms \
+          s3tests/functional/test_s3.py::test_object_content_encoding_aws_chunked \
           s3tests/functional/test_s3.py::test_object_write_read_update_read_delete \
           s3tests/functional/test_s3.py::test_object_metadata_replaced_on_put \
           s3tests/functional/test_s3.py::test_object_write_file \
@@ -1165,6 +1187,7 @@ jobs:
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_good \
           s3tests/functional/test_s3.py::test_get_object_ifmodifiedsince_failed \
           s3tests/functional/test_s3.py::test_get_object_ifunmodifiedsince_failed \
+          s3tests/functional/test_s3.py::test_get_checksum_object_attributes \
           s3tests/functional/test_s3.py::test_bucket_head \
           s3tests/functional/test_s3.py::test_bucket_head_notexist \
           s3tests/functional/test_s3.py::test_object_raw_authenticated \
diff --git a/.github/workflows/samba-integration.yml b/.github/workflows/samba-integration.yml
index 082ec5a6df..94b9d670d3 100644
--- a/.github/workflows/samba-integration.yml
+++ b/.github/workflows/samba-integration.yml
@@ -40,15 +40,23 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
     - name: Start local Docker registry
-      run: docker run -d --restart=always -p 5000:5000 --name registry registry:2
+      run: |
+        if ! docker start registry 2>/dev/null; then
+          docker rm -f registry >/dev/null 2>&1 || true
+          docker run -d --restart=always -p 5000:5000 --name registry registry:2
+        fi
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v4
       with:
         driver-opts: network=host
 
+    - name: Set up Docker Compose
+      uses: docker/setup-compose-action@v2
+
     - name: Build weed race binary
       run: |
         cd docker
diff --git a/.github/workflows/sftp-tests.yml b/.github/workflows/sftp-tests.yml
index 377608dcf3..0930b06b92 100644
--- a/.github/workflows/sftp-tests.yml
+++ b/.github/workflows/sftp-tests.yml
@@ -17,8 +17,8 @@ on:
       - '.github/workflows/sftp-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref }}/sftp-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -40,6 +40,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
         
     - name: Install dependencies
       run: |
diff --git a/.github/workflows/spark-integration-tests.yml b/.github/workflows/spark-integration-tests.yml
index 0be1e3005c..8aec50f8bd 100644
--- a/.github/workflows/spark-integration-tests.yml
+++ b/.github/workflows/spark-integration-tests.yml
@@ -15,6 +15,10 @@ on:
       - '.github/workflows/spark-integration-tests.yml'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
   checks: write
@@ -34,16 +38,17 @@ jobs:
       uses: actions/checkout@v7
 
     - name: Set up JDK 11
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@v6
       with:
         java-version: '11'
         distribution: 'temurin'
-        cache: maven
+        cache: ${{ runner.environment == 'github-hosted' && 'maven' || '' }}
 
     - name: Set up Go
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
     - name: Build SeaweedFS binary
       run: |
diff --git a/.github/workflows/star_history.yml b/.github/workflows/star_history.yml
new file mode 100644
index 0000000000..016dd86c63
--- /dev/null
+++ b/.github/workflows/star_history.yml
@@ -0,0 +1,73 @@
+---
+name: Star History
+
+on:
+  schedule:
+    - cron: "0 0 * * *"  # daily, 00:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  # Only one chart regeneration per branch at a time so overlapping runs never
+  # conflict on note/star_history.svg during rebase. Scoped by ref so a manual
+  # run on another branch can't cancel the daily master update.
+  group: star-history-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
+jobs:
+  render:
+    name: Regenerate star history chart
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Full history so the chart commit can rebase onto a moved master.
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.x"
+          cache: ${{ runner.environment == 'github-hosted' && 'pip' || '' }}
+          cache-dependency-path: .github/scripts/star_history.py
+
+      - name: Install matplotlib
+        run: pip install matplotlib
+
+      - name: Render chart
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python .github/scripts/star_history.py
+
+      - name: Commit if changed
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          if git diff --quiet -- note/star_history.svg; then
+            echo "No changes to the chart."
+            exit 0
+          fi
+          git add note/star_history.svg
+          git commit -m "docs: regenerate star history chart"
+          # Rebase and retry so a concurrent push to master doesn't lose the chart.
+          for attempt in 1 2 3 4 5; do
+            if [ "$attempt" -gt 1 ]; then
+              # Guard the rebase: a transient fetch error or conflict must not
+              # abort the fail-fast shell before the remaining attempts run.
+              if ! git pull --rebase origin "$GITHUB_REF_NAME"; then
+                echo "rebase failed (attempt ${attempt}); aborting and retrying"
+                git rebase --abort || true
+                continue
+              fi
+            fi
+            if git push origin HEAD:"$GITHUB_REF_NAME"; then
+              exit 0
+            fi
+            echo "push rejected (attempt ${attempt}); will rebase and retry"
+          done
+          echo "::error::could not push star history chart after retries"
+          exit 1
diff --git a/.github/workflows/telemetry-integration.yml b/.github/workflows/telemetry-integration.yml
index 68dd2d1b79..b7aa690fb6 100644
--- a/.github/workflows/telemetry-integration.yml
+++ b/.github/workflows/telemetry-integration.yml
@@ -14,6 +14,10 @@ on:
       - 'weed/telemetry/**'
       - '.github/workflows/telemetry-integration.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
@@ -30,6 +34,7 @@ jobs:
       uses: actions/setup-go@v7
       with:
         go-version-file: 'go.mod'
+        cache: ${{ runner.environment == 'github-hosted' }}
 
     - name: Build telemetry server
       run: cd telemetry/server && go build -o telemetry-server .
diff --git a/.github/workflows/terraform_ci.yml b/.github/workflows/terraform_ci.yml
index 1e905e6f0e..b2bcca7500 100644
--- a/.github/workflows/terraform_ci.yml
+++ b/.github/workflows/terraform_ci.yml
@@ -8,6 +8,10 @@ on:
     branches: [ master ]
     paths: ['terraform/**', '.github/workflows/terraform_ci.yml']
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
@@ -62,6 +66,7 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Build weed
         run: go build -o "$RUNNER_TEMP/weed" ./weed
diff --git a/.github/workflows/test-s3-over-https-using-awscli.yml b/.github/workflows/test-s3-over-https-using-awscli.yml
index 5a01f40bcd..8ccb35eeb7 100644
--- a/.github/workflows/test-s3-over-https-using-awscli.yml
+++ b/.github/workflows/test-s3-over-https-using-awscli.yml
@@ -27,6 +27,10 @@ defaults:
   run:
     working-directory: weed
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 jobs:
   awscli-tests:
     runs-on: ubuntu-latest
@@ -36,7 +40,8 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: ^1.25
+          go-version: ^1.26
+          cache: ${{ runner.environment == 'github-hosted' }}
 
       - name: Build SeaweedFS
         run: |
@@ -86,7 +91,11 @@ jobs:
           set -e
           dd if=/dev/urandom of=generated bs=1M count=32
           aws --no-verify-ssl s3 cp --no-progress generated s3://bucket/test-multipart
-          aws --no-verify-ssl s3 cp --no-progress s3://bucket/test-multipart downloaded
+          for i in 1 2 3 4 5; do
+            aws --no-verify-ssl s3 cp --no-progress s3://bucket/test-multipart downloaded && break
+            if [ "$i" -eq 5 ]; then exit 1; fi
+            sleep 2
+          done
           diff -q generated downloaded
           rm -f generated downloaded
 
diff --git a/.github/workflows/tls-rotation-tests.yml b/.github/workflows/tls-rotation-tests.yml
index 2e13de33a9..669ca4794e 100644
--- a/.github/workflows/tls-rotation-tests.yml
+++ b/.github/workflows/tls-rotation-tests.yml
@@ -18,6 +18,10 @@ on:
       - 'go.sum'
       - '.github/workflows/tls-rotation-tests.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
@@ -30,7 +34,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
+        cache: ${{ runner.environment == 'github-hosted' }}
+        go-version: ^1.26
       id: go
 
     - name: Check out code into the Go module directory
diff --git a/.github/workflows/tus-tests.yml b/.github/workflows/tus-tests.yml
index 9e7f4e1c1f..1140c7f505 100644
--- a/.github/workflows/tus-tests.yml
+++ b/.github/workflows/tus-tests.yml
@@ -11,8 +11,8 @@ on:
       - '.github/workflows/tus-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/tus-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -31,10 +31,14 @@ jobs:
       - name: Check out code
         uses: actions/checkout@v7
 
+      - name: Clean up stale FUSE mounts
+        uses: ./.github/actions/cleanup-stale-fuse-mounts
+
       - name: Set up Go
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
         id: go
 
       - name: Install SeaweedFS
@@ -49,7 +53,7 @@ jobs:
           echo "=== System Information ==="
           uname -a
           free -h
-          df -h
+          timeout 15 df -h || true
           echo "=== Starting TUS Tests ==="
           
           # Run tests with automatic server management
diff --git a/.github/workflows/vacuum-integration-tests.yml b/.github/workflows/vacuum-integration-tests.yml
index 889b9f116e..93eefec26e 100644
--- a/.github/workflows/vacuum-integration-tests.yml
+++ b/.github/workflows/vacuum-integration-tests.yml
@@ -18,6 +18,10 @@ on:
       - 'go.sum'
       - '.github/workflows/vacuum-integration-tests.yml'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
+
 permissions:
   contents: read
 
@@ -30,7 +34,8 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v7
       with:
-        go-version: ^1.25
+        cache: ${{ runner.environment == 'github-hosted' }}
+        go-version: ^1.26
       id: go
 
     - name: Check out code into the Go module directory
diff --git a/.github/workflows/volume-server-integration-tests.yml b/.github/workflows/volume-server-integration-tests.yml
index c1874fa198..b1a4569111 100644
--- a/.github/workflows/volume-server-integration-tests.yml
+++ b/.github/workflows/volume-server-integration-tests.yml
@@ -21,8 +21,8 @@ on:
       - '.github/workflows/volume-server-integration-tests.yml'
 
 concurrency:
-  group: ${{ github.head_ref || github.ref }}/volume-server-integration-tests
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || (github.event_name == 'push' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && !startsWith(github.ref, 'refs/tags/')) }}
 
 permissions:
   contents: read
@@ -33,10 +33,44 @@ env:
   SHARD_COUNT: 3
 
 jobs:
+  build-weed:
+    name: Build SeaweedFS Binary
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v7
+        with:
+          go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
+
+      - name: Build SeaweedFS binary
+        run: |
+          cd weed
+          go build -o weed .
+          chmod +x weed
+          ./weed version
+
+      - name: Package binary
+        run: tar cf weed-binary.tar weed/weed
+
+      - name: Upload binary
+        uses: actions/upload-artifact@v7
+        with:
+          name: weed-binary
+          if-no-files-found: error
+          retention-days: 1
+          path: weed-binary.tar
+
   volume-server-integration-tests:
     name: Volume Server Integration Tests (${{ matrix.test-type }} - Shard ${{ matrix.shard }})
     runs-on: ubuntu-22.04
     timeout-minutes: 45
+    needs: [build-weed]
     strategy:
       fail-fast: false
       matrix:
@@ -51,13 +85,18 @@ jobs:
         uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
+          cache: ${{ runner.environment == 'github-hosted' }}
 
-      - name: Build SeaweedFS binary
+      - name: Download binary
+        uses: actions/download-artifact@v7
+        with:
+          name: weed-binary
+
+      - name: Restore binary
         run: |
-          cd weed
-          go build -o weed .
-          chmod +x weed
-          ./weed version
+          tar xf weed-binary.tar
+          chmod +x weed/weed
+          ./weed/weed version
 
       # Dealing the listed tests out one by one keeps the shards even. Bucketing
       # them by first letter did not: names cluster, so ^Test[I-S] drew 50 of
diff --git a/.gitignore b/.gitignore
index 2306882feb..c383623df9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -116,7 +116,6 @@ test/s3/versioning/weed-test.log
 /docker/admin_integration/data
 docker/agent_pub_record
 docker/admin_integration/weed-local
-/seaweedfs-rdma-sidecar/bin
 /test/s3/encryption/filerldb2
 /test/s3/sse/filerldb2
 test/s3/sse/weed-test.log
@@ -145,3 +144,4 @@ weed_bin
 telemetry/server/telemetry-server
 .aider*
 /seaweed-volume/docs
+__pycache__/
diff --git a/README.md b/README.md
index eea7207755..95e518f7b5 100644
--- a/README.md
+++ b/README.md
@@ -12,425 +12,260 @@
 
 ![SeaweedFS Logo](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/seaweedfs.png)
 
-<h2 align="center"><a href="https://www.patreon.com/seaweedfs">Sponsor SeaweedFS via Patreon</a></h2>
+SeaweedFS is a simple and highly scalable distributed file system. There are two objectives:
 
-SeaweedFS is an independent Apache-licensed open source project with its ongoing development made
-possible entirely thanks to the support of these awesome [backers](https://github.com/seaweedfs/seaweedfs/blob/master/backers.md).
-If you'd like to grow SeaweedFS even stronger, please consider joining our
-<a href="https://www.patreon.com/seaweedfs">sponsors on Patreon</a>.
+1. to store billions of files!
+2. to serve the files fast!
 
-Your support will be really appreciated by me and other supporters!
-
-<!--
-<h4 align="center">Platinum</h4>
-
-<p align="center">
-  <a href="" target="_blank">
-    Add your name or icon here
-  </a>
-</p>
--->
-
-### Gold Sponsors
-[![nodion](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_nodion.png)](https://www.nodion.com)
-[![piknik](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/piknik.png)](https://www.piknik.com)
-[![keepsec](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/keepsec.png)](https://www.keepsec.ca)
-[![zyner](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_zyner.png)](https://zyner.org)
-
----
+One `weed` binary serves an S3 object store, a POSIX file system, and a lakehouse with S3 Tables, all over the same data. Each blob is one disk read away, capacity grows by starting another volume server, and cloud storage can be cached or tiered transparently. Both read and write operations have O(1) complexity and can run at the full speed supported by the underlying hardware.
 
 - [Download Binaries for different platforms](https://github.com/seaweedfs/seaweedfs/releases/latest)
-- [SeaweedFS on Slack](https://join.slack.com/t/seaweedfs/shared_invite/enQtMzI4MTMwMjU2MzA3LTEyYzZmZWYzOGQ3MDJlZWMzYmI0OTE4OTJiZjJjODBmMzUxNmYwODg0YjY3MTNlMjBmZDQ1NzQ5NDJhZWI2ZmY)
-- [SeaweedFS on Twitter](https://twitter.com/SeaweedFS)
-- [SeaweedFS on Telegram](https://t.me/Seaweedfs) 
-- [SeaweedFS on Reddit](https://www.reddit.com/r/SeaweedFS/)
-- [SeaweedFS Mailing List](https://groups.google.com/d/forum/seaweedfs)
 - [Wiki Documentation](https://github.com/seaweedfs/seaweedfs/wiki)
-- [SeaweedFS White Paper](https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS_Architecture.pdf)
-- [SeaweedFS Introduction Slides 2025.5](https://docs.google.com/presentation/d/1tdkp45J01oRV68dIm4yoTXKJDof-EhainlA0LMXexQE/edit?usp=sharing)
-- [SeaweedFS Introduction Slides 2021.5](https://docs.google.com/presentation/d/1DcxKWlINc-HNCjhYeERkpGXXm6nTCES8mi2W5G0Z4Ts/edit?usp=sharing)
-- [SeaweedFS Introduction Slides 2019.3](https://www.slideshare.net/chrislusf/seaweedfs-introduction)
+- [HTTP REST API](REST_API.md) for the filer, master, and volume servers
+- Community: [Slack](https://join.slack.com/t/seaweedfs/shared_invite/enQtMzI4MTMwMjU2MzA3LTEyYzZmZWYzOGQ3MDJlZWMzYmI0OTE4OTJiZjJjODBmMzUxNmYwODg0YjY3MTNlMjBmZDQ1NzQ5NDJhZWI2ZmY), [Twitter](https://twitter.com/SeaweedFS), [Telegram](https://t.me/Seaweedfs), [Reddit](https://www.reddit.com/r/SeaweedFS/), [Mailing List](https://groups.google.com/d/forum/seaweedfs)
+- [SeaweedFS White Paper](https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS_Architecture.pdf) and introduction slides: [2025.5](https://docs.google.com/presentation/d/1tdkp45J01oRV68dIm4yoTXKJDof-EhainlA0LMXexQE/edit?usp=sharing), [2021.5](https://docs.google.com/presentation/d/1DcxKWlINc-HNCjhYeERkpGXXm6nTCES8mi2W5G0Z4Ts/edit?usp=sharing), [2019.3](https://www.slideshare.net/chrislusf/seaweedfs-introduction)
 
 Table of Contents
 =================
 
 * [Quick Start](#quick-start)
-    * [Quick Start with weed mini](#quick-start-with-weed-mini)
-    * [Quick Start for S3 API on Docker](#quick-start-for-s3-api-on-docker)
-* [Introduction](#introduction)
-* [Features](#features)
-    * [Additional Features](#additional-features)
-    * [Filer Features](#filer-features)
-* [Example: Using Seaweed Object Store](#example-using-seaweed-object-store)
-* [Architecture](#object-store-architecture)
-* [Compared to Other File Systems](#compared-to-other-file-systems)
+    * [One command](#one-command)
+    * [Docker](#docker)
+    * [Docker Compose](#docker-compose)
+    * [Kubernetes with Helm](#kubernetes-with-helm)
+    * [Build from source](#build-from-source)
+    * [Scale out](#scale-out)
+* [Why SeaweedFS](#why-seaweedfs)
+    * [Fast](#fast)
+    * [Scalable](#scalable)
+    * [The most complete S3 API](#the-most-complete-s3-api)
+    * [A data warehouse with S3 Tables](#a-data-warehouse-with-s3-tables)
+    * [A fast cache for cloud storage](#a-fast-cache-for-cloud-storage)
+    * [Active-active replication and more](#active-active-replication-and-more)
+* [Architecture](#architecture)
+* [Compared to Other Systems](#compared-to-other-systems)
     * [Compared to HDFS](#compared-to-hdfs)
     * [Compared to GlusterFS, Ceph](#compared-to-glusterfs-ceph)
-    * [Compared to GlusterFS](#compared-to-glusterfs)
+    * [Compared to MooseFS](#compared-to-moosefs)
     * [Compared to Ceph](#compared-to-ceph)
-    * [Compared to Minio](#compared-to-minio)
-* [Dev Plan](#dev-plan)
-* [Installation Guide](#installation-guide)
-* [Disk Related Topics](#disk-related-topics)
+    * [Compared to MinIO, RustFS](#compared-to-minio-rustfs)
 * [Benchmark](#benchmark)
 * [Enterprise](#enterprise)
 * [License](#license)
+* [Sponsors](#sponsors)
 
 # Quick Start #
 
+## One command ##
 
-## Quick Start with weed mini ##
+Download the latest binary from the [releases](https://github.com/seaweedfs/seaweedfs/releases/latest) page and unzip the single `weed` (or `weed.exe`) file, or let the install script put it in `/usr/local/bin`:
 
-Download the latest binary from https://github.com/seaweedfs/seaweedfs/releases and unzip the single `weed` (or `weed.exe`) file, or run `go install github.com/seaweedfs/seaweedfs/weed@latest`. Then start a ready-to-use S3 object store with credentials and a pre-created bucket in one command:
+```bash
+curl -fsSL https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/install.sh | bash
+```
+
+Then start a ready-to-use S3 object store:
 
 ```bash
 AWS_ACCESS_KEY_ID=admin \
 AWS_SECRET_ACCESS_KEY=secret \
 S3_BUCKET=my-bucket \
-./weed mini -dir=/data
+./weed mini -dir=./data
 ```
 
-That's it — the S3 endpoint is at http://localhost:8333, `my-bucket` already exists, and `admin`/`secret` are valid credentials. `S3_BUCKET` accepts a comma-separated list (e.g. `raw,processed`); use `S3_TABLE_BUCKET` for S3 Tables (Iceberg) buckets. Drop any of the env vars to skip that piece (no AWS keys → S3 runs in unauthenticated "Allow All" mode for development).
+That's it. The S3 endpoint is at http://localhost:8333, `my-bucket` exists, and `admin`/`secret` are valid credentials:
 
-The same command starts everything else too:
-- **S3 Endpoint**: http://localhost:8333
-- **Master UI**: http://localhost:9333
-- **Volume Server**: http://localhost:9340
-- **Filer UI**: http://localhost:8888
-- **WebDAV**: http://localhost:7333
-- **Admin UI**: http://localhost:23646
+```bash
+AWS_ACCESS_KEY_ID=admin AWS_SECRET_ACCESS_KEY=secret \
+  aws --endpoint-url http://localhost:8333 s3 cp README.md s3://my-bucket/
+```
+
+The same process also runs the master, a volume server, the filer, WebDAV, the Iceberg REST catalog, and the Admin UI. Add `S3_TABLE_BUCKET=warehouse` to also create an Iceberg table bucket, or `warehouse:LANCE` for a Lance one. Drop the AWS keys to run without authentication for development.
+
+Without Admin authentication or mTLS, `weed mini` binds the Admin UI/API and its worker gRPC control plane to loopback rather than `-ip.bind`. Set `WEED_ADMIN_PASSWORD` or configure `https.admin` mTLS to keep the network bind. Remote workers must opt in with `-admin.worker.ip=<address>` and should configure `grpc.admin` mTLS. `-admin.allowInsecureBind` restores the legacy unauthenticated network bind and should only be used on an isolated network.
 
 > macOS: if the binary is quarantined, run `xattr -d com.apple.quarantine ./weed` first.
 
-Perfect for development, testing, learning SeaweedFS, and single-node deployments. To scale out, add more volume servers by running `weed volume -dir="/some/data/dir2" -master="<master_host>:9333" -port=8081` locally, on another machine, or on thousands of machines.
+`weed mini` is auto-tuned for one node and is fine for single-node production, such as an S3 gateway that issues presigned URLs. See [Quick Start with weed mini][WeedMini].
 
-## Quick Start for S3 API on Docker ##
+## Docker ##
 
 ```bash
-docker run -p 8333:8333 \
+docker run -p 8333:8333 -v weed-data:/data \
   -e AWS_ACCESS_KEY_ID=admin \
   -e AWS_SECRET_ACCESS_KEY=secret \
   -e S3_BUCKET=my-bucket \
   chrislusf/seaweedfs
 ```
 
-Same behavior as the `weed mini` command above — the S3 endpoint is at http://localhost:8333 with `my-bucket` pre-created. Drop the env vars to run anonymously for development.
+Same behavior as the `weed mini` command above.
 
-# Introduction #
+## Docker Compose ##
 
-SeaweedFS is a simple and highly scalable distributed file system. There are two objectives:
+To run master, volume server, filer, S3, and WebDAV as separate services:
 
-1. to store billions of files!
-2. to serve the files fast!
+```bash
+wget https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/docker/seaweedfs-compose.yml
+wget -P prometheus https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/docker/prometheus/prometheus.yml
+docker compose -f seaweedfs-compose.yml -p seaweedfs up
+```
 
-SeaweedFS started as a blob store to handle small files efficiently. 
-Instead of managing all file metadata in a central master, 
-the central master only manages volumes on volume servers, 
-and these volume servers manage files and their metadata. 
-This relieves concurrency pressure from the central master and spreads file metadata into volume servers, 
-allowing faster file access (O(1), usually just one disk read operation).
+[Docker Compose for S3][DockerComposeS3] adds credentials, and the [docker/compose](docker/compose) folder has variants for replication, mounts, message queues, and more.
 
-There is only 40 bytes of disk storage overhead for each file's metadata. 
-It is so simple with O(1) disk reads that you are welcome to challenge the performance with your actual use cases.
+## Kubernetes with Helm ##
 
-SeaweedFS started by implementing [Facebook's Haystack design paper](http://www.usenix.org/event/osdi10/tech/full_papers/Beaver.pdf). 
-Also, SeaweedFS implements erasure coding with ideas from 
-[f4: Facebook’s Warm BLOB Storage System](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and has a lot of similarities with [Facebook’s Tectonic Filesystem](https://www.usenix.org/system/files/fast21-pan.pdf) and [Google's Colossus File System](https://cloud.google.com/blog/products/storage-data-transfer/a-peek-behind-colossus-googles-file-system)
+```bash
+helm repo add seaweedfs https://seaweedfs.github.io/seaweedfs/helm
+helm install seaweedfs seaweedfs/seaweedfs -n seaweedfs --create-namespace -f values.yaml
+```
 
-On top of the blob store, optional [Filer] can support directories and POSIX attributes. 
-Filer is a separate linearly-scalable stateless server with customizable metadata stores, 
-e.g., MySql, Postgres, Redis, Cassandra, HBase, Mongodb, Elastic Search, LevelDB, RocksDB, Sqlite, MemSql, TiDB, Etcd, CockroachDB, YDB, etc.
+A production-shaped `values.yaml` for a three-node cluster: two copies of every write, three masters, and an S3 endpoint with credentials and a bucket.
 
-SeaweedFS can transparently integrate with the cloud. 
-With hot data on local cluster, and warm data on the cloud with O(1) access time, 
-SeaweedFS can achieve both fast local access time and elastic cloud storage capacity.
-What's more, the cloud storage access API cost is minimized. 
-Faster and cheaper than direct cloud storage!
+```yaml
+global:
+  seaweedfs:
+    enableReplication: true
+    replicationPlacement: "001"   # one extra copy on another server; "002" for two
 
-SeaweedFS also ships a built-in **Iceberg REST Catalog**, turning the same cluster into a self-contained lakehouse.
-Spark, Trino, Dremio, DuckDB, and RisingWave can query Iceberg tables directly — no Hive Metastore, Glue, or
-external catalog service required. Storage and table metadata live in one system, simplifying on-prem and
-small-team analytics stacks.
+master:
+  replicas: 3
+  data:
+    type: persistentVolumeClaim   # the cluster's default storage class; add storageClass to pick one
+    size: 1Gi
+
+volume:
+  replicas: 3                     # at least 1 + the sum of the replication digits
+  dataDirs:
+    - name: data
+      type: persistentVolumeClaim
+      size: 500Gi
+      maxVolumes: 0               # size the volume count from the disk
+
+filer:
+  replicas: 2
+  data:
+    type: persistentVolumeClaim
+    size: 20Gi
+
+s3:
+  enabled: true
+  replicas: 2
+  enableAuth: true
+  credentials:
+    admin:
+      accessKey: admin
+      secretKey: change-me
+  createBuckets:
+    - name: app-storage
+```
+
+The S3 endpoint is the `seaweedfs-s3` service on port 8333. [Helm Chart Recipes][HelmRecipes] has values for a development cluster, a lakehouse with the Iceberg catalog exposed, filer metadata on PostgreSQL, and node-local disks. The [SeaweedFS Operator][Operator] and the [CSI driver][SeaweedFsCsiDriver] are the other Kubernetes paths.
+
+## Build from source ##
+
+```bash
+git clone https://github.com/seaweedfs/seaweedfs.git
+cd seaweedfs/weed && make install
+```
+
+`weed` lands in `$GOPATH/bin`. [Getting Started][GettingStarted] covers running master, volume, filer, and S3 as separate processes.
+
+## Scale out ##
+
+Capacity is a volume server. Start one on any machine with disk and point it at the master:
+
+```bash
+weed volume -dir=/data -master=<master_host>:9333
+```
+
+Nothing rebalances until you ask it to. Throughput is a filer or S3 gateway; they are stateless, so run as many as you need behind a load balancer. [Production Setup][ProductionSetup] walks through a multi-node cluster.
 
 [Back to TOC](#table-of-contents)
 
-# Features #
-## Additional Blob Store Features ##
-* Support different replication levels, with rack and data center aware.
-* Automatic master servers failover - no single point of failure (SPOF).
-* Automatic compression depending on file MIME type.
-* Automatic compaction to reclaim disk space after deletion or update.
-* [Automatic entry TTL expiration][VolumeServerTTL].
-* Flexible Capacity Expansion: Any server with some disk space can add to the total storage space.
-* Adding/Removing servers does **not** cause any data re-balancing unless triggered by admin commands.
-* Optional picture resizing.
-* Support ETag, Accept-Range, Last-Modified, etc.
-* Support in-memory/leveldb/readonly mode tuning for memory/performance balance.
-* Support rebalancing the writable and readonly volumes.
-* [Customizable Multiple Storage Tiers][TieredStorage]: Customizable storage disk types to balance performance and cost.
-* [Transparent cloud integration][CloudTier]: unlimited capacity via tiered cloud storage for warm data.
-* [Erasure Coding for warm storage][ErasureCoding]  Rack-Aware 10.4 erasure coding reduces storage cost and increases availability. Enterprise version can customize EC ratio.
+# Why SeaweedFS #
+
+## Fast ##
+
+* One disk read per blob. A small file is one blob; a large file is split into chunks of a few MB, each its own blob. A volume server keeps a 16-byte index entry per blob in memory and reads it in a single seek, also for erasure-coded data.
+* The master is not in the read path. Clients cache the volume-to-server mapping and talk to volume servers directly.
+* 40 bytes of metadata per file on disk. Small files are packed into append-only volume files, so there is no per-file inode, no per-file metadata file, no fragmentation, and writes are SSD friendly.
+* Hot data is replicated; [erasure coding][ErasureCoding] is applied to warm data in the background, so writes never pay the encoding cost.
+* The [Rust volume server][RustVolume] is a drop-in for higher throughput and lower tail latency on the same on-disk format.
+
+On one laptop, [`weed benchmark`][Benchmarks] writes 1KB files at 15,700 per second and reads them back at 47,000 per second, and a mixed S3 [warp][S3Benchmark] run totals 3.2 GiB/s. Numbers are in the [Benchmark](#benchmark) section; throughput grows with volume servers and gateways.
+
+## Scalable ##
+
+* The master tracks volumes, not files. A cluster with billions of files has a few thousand volumes, so the master stays small. One master is enough for most clusters; run three for [Raft failover][FailoverMaster].
+* Adding a server adds capacity with no data reshuffle. Balancing, vacuum, erasure coding, and repair run on demand from [`weed shell`][WeedShell] or the [maintenance worker][Worker].
+* Filer and S3 gateways are stateless and scale linearly. Directory metadata lives in a [store you already run][FilerStores]: LevelDB, RocksDB, SQLite, MySQL, PostgreSQL, Cassandra, HBase, MongoDB, Redis, Elasticsearch, etcd, TiKV, FoundationDB, YDB, ArangoDB, Tarantool, and MySQL or PostgreSQL compatible databases such as TiDB, CockroachDB, and MemSQL.
+* Rack and data center aware [replication][Replication], [tiered storage][TieredStorage] across disk types, and [transparent cloud tiering][CloudTier] for unlimited capacity.
+* Files from a byte to [tens of TB][SuperLargeFiles]. Volumes up to 8TB with the large-disk build.
+
+## The most complete S3 API ##
+
+The S3 gateway implements the object, bucket, S3 Tables, IAM, and STS APIs on one endpoint, so the AWS SDKs and CLI, rclone, restic, Spark, and Trino work unchanged.
+
+| API | Operations |
+| --- | --- |
+| S3 bucket and object | 73 |
+| S3 Tables | 36 |
+| IAM | 39 |
+| STS | 5 |
+
+* [Versioning][Versioning], [Object Lock][ObjectLock] with retention and legal hold, [lifecycle][Lifecycle] rules, tagging, [CORS][CORS], [conditional reads and writes][ConditionalOps], checksums, presigned URLs, browser POST uploads, multipart uploads, and an atomic [RenameObject][RenameObject].
+* [Bucket policies][BucketPolicies] with [conditions][PolicyConditions] and [variables][PolicyVariables]; IAM users, groups, and policies; STS with [OIDC][OIDC], LDAP, and [Kubernetes service accounts][K8sSA].
+* [SSE-S3, SSE-KMS, and SSE-C][SSE] server-side encryption, with OpenBao and Vault, AWS KMS, Azure Key Vault, and GCP KMS as key providers.
+* [Audit log][AuditLog], [bucket quota][BucketQuota], and [rate limiting][RateLimiting].
+* Each bucket is its own collection, so deleting a bucket is instant.
+
+The full operation list is in [Amazon S3 API][AmazonS3API], and [Supported APIs vs MinIO][S3vsMinio] compares. The S3 compatibility suite and the SDK, IAM, SSE, policy, and Spark integration tests run in CI on every change.
+
+## A data warehouse with S3 Tables ##
+
+SeaweedFS is a lakehouse in one system. [S3 Table Buckets][S3TableBucket] hold Apache Iceberg tables by default, or [Lance][LanceCatalog] tables for vectors and multimodal data, and the built-in [Iceberg REST Catalog][IcebergCatalog] and Lance namespace serve them directly. There is no Hive Metastore, Glue, or separate catalog service to deploy, secure, and back up.
+
+* Query engines operate on the same tables at the same time: [Spark][SparkIceberg], [Trino][TrinoIceberg], [Dremio][DremioIceberg], [DuckDB][DuckDBIceberg], [Apache Doris][DorisIceberg], [RisingWave][RisingWaveIceberg], ClickHouse, and [LanceDB][LanceDB]. Catalog commits are atomic compare-and-swap, so concurrent writers are safe. [Lakekeeper][Lakekeeper] can front the same storage with STS-vended credentials. [OLake Go][OLake] is a high-performance, open-source EL (Extract–Load) platform that bridges operational databases and open lakehouse storage - writing Apache Iceberg tables or Parquet files on Amazon S3.
+* [Automated table maintenance][IcebergMaintenance]: compaction, snapshot expiration, orphan file removal, and manifest rewriting, configured per bucket or table through the S3 Tables maintenance APIs, and the same for [Lance][LanceMaintenance].
+* IAM at the bucket, namespace, and table level with standard bucket policies, see [S3 Tables Security][S3TablesSecurity].
+* A [Hadoop compatible file system][Hadoop] for Spark, Flink, and HBase.
+
+`S3_TABLE_BUCKET=warehouse ./weed mini -dir=./data` brings the whole stack up on a laptop.
+
+## A fast cache for cloud storage ##
+
+[Cloud Drive][CloudDrive] mounts a bucket from S3, Google Cloud Storage, Azure, Backblaze B2, Wasabi, Storj, or any S3-compatible store into SeaweedFS and serves it at local speed:
+
+* Metadata is pulled once, so listing, stat, and directory walks cost no cloud API calls.
+* File content is downloaded once, on first read or [warmed][CacheRemote] by folder, name pattern, size, or age, and cached with the capacity of the whole cluster: cache everything, no churn.
+* Local writes complete at local latency and are written back to the cloud asynchronously in the cloud's native layout, so other tools keep reading the bucket directly.
+* Uncache by the same rules to free local disk while keeping the metadata.
+
+[Cloud Tier][CloudTier] goes the other direction, moving whole warm volumes to cloud storage while keeping one-read access, and the [Gateway to Remote Object Storage][GatewayToRemoteObjectStore] mirrors every bucket to a remote store. Faster and cheaper than reading the cloud directly.
+
+## Active-active replication and more ##
+
+* [Active-active or active-passive replication][ActiveActiveAsyncReplication] between clusters, continuous and resumable, for the whole tree or chosen folders, across data centers.
+* [Filer store replication][FilerStoreReplication] for metadata HA, [async backup][AsyncBackup] to cloud storage, [metadata backup][MetaBackup], and [change data capture][CDC] with [webhooks][Webhook] on every metadata event.
+* The same data as a [FUSE mount][Mount] on Linux, macOS, and [Windows][MountWindows], over [WebDAV][WebDAV], [SFTP][SFTP], HDFS, HTTP, and [TUS resumable uploads][TUS]; on Kubernetes through the [CSI driver][SeaweedFsCsiDriver] and [Operator][Operator].
+* [AES256-GCM encryption at rest][FilerDataEncryption], TLS and mTLS between components, JWT-signed volume access, and [FIPS][FIPS] builds.
+* [Admin UI][AdminUI], Prometheus [metrics][Metrics], [TTL][VolumeServerTTL] per file or volume, automatic compression and compaction, and [seaweed-up][SeaweedUp] for bare-metal clusters.
 
 [Back to TOC](#table-of-contents)
 
-## Filer Features ##
-* [Filer server][Filer] provides "normal" directories and files via HTTP.
-* [File TTL][FilerTTL] automatically expires file metadata and actual file data.
-* [Mount filer][Mount] reads and writes files directly as a local directory via FUSE.
-* [Filer Store Replication][FilerStoreReplication] enables HA for filer meta data stores.
-* [Active-Active Replication][ActiveActiveAsyncReplication] enables asynchronous one-way or two-way cross cluster continuous replication.
-* [Amazon S3 compatible API][AmazonS3API] accesses files with S3 tooling.
-* [Hadoop Compatible File System][Hadoop] accesses files from Hadoop/Spark/Flink/etc or even runs HBase.
-* [Async Replication To Cloud][BackupToCloud] has extremely fast local access and backups to Amazon S3, Google Cloud Storage, Azure, BackBlaze.
-* [WebDAV] accesses as a mapped drive on Mac and Windows, or from mobile devices.
-* [AES256-GCM Encrypted Storage][FilerDataEncryption] safely stores the encrypted data.
-* [Super Large Files][SuperLargeFiles] stores large or super large files in tens of TB.
-* [Cloud Drive][CloudDrive] mounts cloud storage to local cluster, cached for fast read and write with asynchronous write back.
-* [Gateway to Remote Object Store][GatewayToRemoteObjectStore] mirrors bucket operations to remote object storage, in addition to [Cloud Drive][CloudDrive]
+# Architecture #
 
-## Data Lakehouse Features ##
-* [S3 Table Buckets][S3TableBucket] expose a dedicated namespace for Iceberg tables with strict layout validation.
-* Built-in [Iceberg REST Catalog][IcebergCatalog] runs alongside the S3 endpoint — no external metastore needed.
-* Native integrations with [Apache Spark][SparkIceberg], [Trino][TrinoIceberg], [Dremio][DremioIceberg], [DuckDB][DuckDBIceberg], and [RisingWave][RisingWaveIceberg].
-* [Automated table maintenance][IcebergMaintenance]: compaction, snapshot expiration, orphan removal, manifest rewriting.
-* Granular IAM at the bucket, namespace, and table level via standard S3 bucket policies.
+![SeaweedFS Architecture](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/SeaweedFS_Architecture.png)
 
-## Kubernetes ##
-* [Kubernetes CSI Driver][SeaweedFsCsiDriver] A Container Storage Interface (CSI) Driver. [![Docker Pulls](https://img.shields.io/docker/pulls/chrislusf/seaweedfs-csi-driver.svg?maxAge=4800)](https://hub.docker.com/r/chrislusf/seaweedfs-csi-driver/)
-* [SeaweedFS Operator](https://github.com/seaweedfs/seaweedfs-operator)
-
-[Filer]: https://github.com/seaweedfs/seaweedfs/wiki/Directories-and-Files
-[SuperLargeFiles]: https://github.com/seaweedfs/seaweedfs/wiki/Data-Structure-for-Large-Files
-[Mount]: https://github.com/seaweedfs/seaweedfs/wiki/FUSE-Mount
-[AmazonS3API]: https://github.com/seaweedfs/seaweedfs/wiki/Amazon-S3-API
-[BackupToCloud]: https://github.com/seaweedfs/seaweedfs/wiki/Async-Replication-to-Cloud
-[Hadoop]: https://github.com/seaweedfs/seaweedfs/wiki/Hadoop-Compatible-File-System
-[WebDAV]: https://github.com/seaweedfs/seaweedfs/wiki/WebDAV
-[ErasureCoding]: https://github.com/seaweedfs/seaweedfs/wiki/Erasure-coding-for-warm-storage
-[TieredStorage]: https://github.com/seaweedfs/seaweedfs/wiki/Tiered-Storage
-[CloudTier]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Tier
-[FilerDataEncryption]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Data-Encryption
-[FilerTTL]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Stores
-[VolumeServerTTL]: https://github.com/seaweedfs/seaweedfs/wiki/Store-file-with-a-Time-To-Live
-[SeaweedFsCsiDriver]: https://github.com/seaweedfs/seaweedfs-csi-driver
-[ActiveActiveAsyncReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Active-Active-cross-cluster-continuous-synchronization
-[FilerStoreReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication
-[KeyLargeValueStore]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-as-a-Key-Large-Value-Store
-[CloudDrive]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Drive-Architecture
-[GatewayToRemoteObjectStore]: https://github.com/seaweedfs/seaweedfs/wiki/Gateway-to-Remote-Object-Storage
-[S3TableBucket]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Table-Bucket
-[IcebergCatalog]: https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS-Iceberg-Catalog
-[IcebergMaintenance]: https://github.com/seaweedfs/seaweedfs/wiki/Iceberg-Table-Maintenance
-[SparkIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Spark-Iceberg-Integration
-[TrinoIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Trino-Iceberg-Integration
-[DremioIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Dremio-Iceberg-Integration
-[DuckDBIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/DuckDB-Iceberg-Integration
-[RisingWaveIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/RisingWave-Iceberg-Integration
+* **Master** servers, one or a Raft group of three, track which volume lives on which volume server and hand out file ids. They are not in the read path.
+* **Volume** servers store blobs in append-only volume files, keep a 16-byte in-memory index per blob, and replicate or erasure-code at the volume level.
+* **Filer** servers add directories and files on top, with metadata in a store of your choice, and expose HTTP, S3, WebDAV, SFTP, FUSE, and the table catalogs.
 
+The blob store started from [Facebook's Haystack](http://www.usenix.org/event/osdi10/tech/full_papers/Beaver.pdf), erasure coding takes ideas from [f4](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper-muralidhar.pdf), and the whole has a lot in common with [Tectonic](https://www.usenix.org/system/files/fast21-pan.pdf) and [Colossus](https://cloud.google.com/blog/products/storage-data-transfer/a-peek-behind-colossus-googles-file-system). How file ids are assigned, written, and looked up, and why a master that tracks volumes scales, is in [Blob Store Architecture][BlobStoreArchitecture]; the services are in [Components][Components] and the [white paper][WhitePaper].
 
 [Back to TOC](#table-of-contents)
 
-## Example: Using Seaweed Blob Store ##
-
-By default, the master node runs on port 9333, and the volume nodes run on port 8080.
-Let's start one master node, and two volume nodes on port 8080 and 8081. Ideally, they should be started from different machines. We'll use localhost as an example.
-
-SeaweedFS uses HTTP REST operations to read, write, and delete. The responses are in JSON or JSONP format.
-
-### Start Master Server ###
-
-```
-> ./weed master
-```
-
-### Start Volume Servers ###
-
-```
-> weed volume -dir="/tmp/data1" -max=5  -master="localhost:9333" -port=8080 &
-> weed volume -dir="/tmp/data2" -max=10 -master="localhost:9333" -port=8081 &
-```
-
-### Write A Blob ###
-
-A blob, also referred as a needle, a chunk, or mistakenly as a file, is just a byte array. It can have attributes, such as name, mime type, create or update time, etc. But basically it is just a byte array of a relatively small size, such as 2 MB ~ 64 MB. The size is not fixed.
-
-To upload a blob: first, send a HTTP POST, PUT, or GET request to `/dir/assign` to get an `fid` and a volume server URL:
-
-```
-> curl http://localhost:9333/dir/assign
-{"count":1,"fid":"3,01637037d6","url":"127.0.0.1:8080","publicUrl":"localhost:8080"}
-```
-
-Second, to store the blob content, send a HTTP multi-part POST request to `url + '/' + fid` from the response:
-
-```
-> curl -F file=@/home/chris/myphoto.jpg http://127.0.0.1:8080/3,01637037d6
-{"name":"myphoto.jpg","size":43234,"eTag":"1cc0118e"}
-```
-
-To update, send another POST request with updated blob content.
-
-For deletion, send an HTTP DELETE request to the same `url + '/' + fid` URL:
-
-```
-> curl -X DELETE http://127.0.0.1:8080/3,01637037d6
-```
-
-### Save Blob Id ###
-
-Now, you can save the `fid`, 3,01637037d6 in this case, to a database field.
-
-The number 3 at the start represents a volume id. After the comma, it's one file key, 01, and a file cookie, 637037d6.
-
-The volume id is an unsigned 32-bit integer. The file key is an unsigned 64-bit integer. The file cookie is an unsigned 32-bit integer, used to prevent URL guessing.
-
-The file key and file cookie are both coded in hex. You can store the <volume id, file key, file cookie> tuple in your own format, or simply store the `fid` as a string.
-
-If stored as a string, in theory, you would need 8+1+16+8=33 bytes. A char(33) would be enough, if not more than enough, since most uses will not need 2^32 volumes.
-
-If space is really a concern, you can store the file id in the binary format. You would need one 4-byte integer for volume id, 8-byte long number for file key, and a 4-byte integer for the file cookie. So 16 bytes are more than enough.
-
-### Read a Blob ###
-
-Here is an example of how to render the URL.
-
-First look up the volume server's URLs by the file's volumeId:
-
-```
-> curl http://localhost:9333/dir/lookup?volumeId=3
-{"volumeId":"3","locations":[{"publicUrl":"localhost:8080","url":"localhost:8080"}]}
-```
-
-Since (usually) there are not too many volume servers, and volumes don't move often, you can cache the results most of the time. Depending on the replication type, one volume can have multiple replica locations. Just randomly pick one location to read.
-
-Now you can take the public URL, render the URL or directly read from the volume server via URL:
-
-```
- http://localhost:8080/3,01637037d6.jpg
-```
-
-Notice we add a file extension ".jpg" here. It's optional and just one way for the client to specify the file content type.
-
-If you want a nicer URL, you can use one of these alternative URL formats:
-
-```
- http://localhost:8080/3/01637037d6/my_preferred_name.jpg
- http://localhost:8080/3/01637037d6.jpg
- http://localhost:8080/3,01637037d6.jpg
- http://localhost:8080/3/01637037d6
- http://localhost:8080/3,01637037d6
-```
-
-If you want to get a scaled version of an image, you can add some params:
-
-```
-http://localhost:8080/3/01637037d6.jpg?height=200&width=200
-http://localhost:8080/3/01637037d6.jpg?height=200&width=200&mode=fit
-http://localhost:8080/3/01637037d6.jpg?height=200&width=200&mode=fill
-```
-
-### Rack-Aware and Data Center-Aware Replication ###
-
-SeaweedFS applies the replication strategy at a volume level. So, when you are getting a blob id, you can specify the replication strategy. For example:
-
-```
-curl http://localhost:9333/dir/assign?replication=001
-```
-
-The replication parameter options are:
-
-```
-000: no replication
-001: replicate once on the same rack
-010: replicate once on a different rack, but same data center
-100: replicate once on a different data center
-200: replicate twice on two different data center
-110: replicate once on a different rack, and once on a different data center
-```
-
-More details about replication can be found [on the wiki][Replication].
-
-[Replication]: https://github.com/seaweedfs/seaweedfs/wiki/Replication
-
-You can also set the default replication strategy when starting the master server.
-
-### Allocate Blob Key on Specific Data Center ###
-
-Volume servers can be started with a specific data center name:
-
-```
- weed volume -dir=/tmp/1 -port=8080 -dataCenter=dc1
- weed volume -dir=/tmp/2 -port=8081 -dataCenter=dc2
-```
-
-When requesting a blob key, an optional "dataCenter" parameter can limit the assigned volume to the specific data center. For example, this specifies that the assigned volume should be limited to 'dc1':
-
-```
- http://localhost:9333/dir/assign?dataCenter=dc1
-```
-
-### Other Features ###
-  * [No Single Point of Failure][feat-1]
-  * [Insert with your own keys][feat-2]
-  * [Chunking large files][feat-3]
-  * [Collection as a Simple Name Space][feat-4]
-
-[feat-1]: https://github.com/seaweedfs/seaweedfs/wiki/Failover-Master-Server
-[feat-2]: https://github.com/seaweedfs/seaweedfs/wiki/Optimization#insert-with-your-own-keys
-[feat-3]: https://github.com/seaweedfs/seaweedfs/wiki/Optimization#upload-large-files
-[feat-4]: https://github.com/seaweedfs/seaweedfs/wiki/Optimization#collection-as-a-simple-name-space
-
-[Back to TOC](#table-of-contents)
-
-## Blob Store Architecture ##
-
-Usually distributed file systems split each file into chunks. A central server keeps a mapping of filenames to chunks, and also which chunks each chunk server has.
-
-The main drawback is that the central server can't handle many small files efficiently, and since all read requests need to go through the central master, so it might not scale well for many concurrent users.
-
-Instead of managing chunks, SeaweedFS manages data volumes in the master server. Each data volume is 32GB in size, and can hold a lot of blobs. And each storage node can have many data volumes. So the master node only needs to store the metadata about the volumes, which is a fairly small amount of data and is generally stable.
-
-The actual blob metadata, which are the blob volume, offset, and size, is stored in each volume on volume servers. Since each volume server only manages metadata of blobs on its own disk, with only 16 bytes for each blob, all access can read the metadata just from memory and only needs one disk operation to actually read file data.
-
-For comparison, consider that an xfs inode structure in Linux is 536 bytes.
-
-### Master Server and Volume Server ###
-
-The architecture is fairly simple. The actual data is stored in volumes on storage nodes. One volume server can have multiple volumes, and can both support read and write access with basic authentication.
-
-All volumes are managed by a master server. The master server contains the volume id to volume server mapping. This is fairly static information, and can be easily cached.
-
-On each write request, the master server also generates a file key, which is a growing 64-bit unsigned integer. Since write requests are not generally as frequent as read requests, one master server should be able to handle the concurrency well.
-
-### Write and Read files ###
-
-When a client sends a write request, the master server returns (volume id, file key, file cookie, volume node URL) for the blob. The client then contacts the volume node and POSTs the blob content.
-
-When a client needs to read a blob based on (volume id, file key, file cookie), it asks the master server by the volume id for the (volume node URL, volume node public URL), or retrieves this from a cache. Then the client can GET the content, or just render the URL on web pages and let browsers fetch the content.
-
-### Saving memory ###
-
-All blob metadata stored on a volume server is readable from memory without disk access. Each file takes just a 16-byte map entry of <64bit key, 32bit offset, 32bit size>. Of course, each map entry has its own space cost for the map. But usually the disk space runs out before the memory does.
-
-### Tiered Storage to the cloud ###
-
-The local volume servers are much faster, while cloud storages have elastic capacity and are actually more cost-efficient if not accessed often (usually free to upload, but relatively costly to access). With the append-only structure and O(1) access time, SeaweedFS can take advantage of both local and cloud storage by offloading the warm data to the cloud.
-
-Usually hot data are fresh and warm data are old. SeaweedFS puts the newly created volumes on local servers, and optionally upload the older volumes on the cloud. If the older data are accessed less often, this literally gives you unlimited capacity with limited local servers, and still fast for new data. 
-
-With the O(1) access time, the network latency cost is kept at minimum. 
-
-If the hot/warm data is split as 20/80, with 20 servers, you can achieve storage capacity of 100 servers. That's a cost saving of 80%! Or you can repurpose the 80 servers to store new data also, and get 5X storage throughput.
-
-[Back to TOC](#table-of-contents)
-
-## SeaweedFS Filer ##
-
-Built on top of the blob store, SeaweedFS Filer adds directory structure to create a file system. The directory structure is an interface that is implemented in many key-value stores or databases.
-
-The content of a file is mapped to one or many blobs, distributed to multiple volumes on multiple volume servers.
-
-## Compared to Other File Systems ##
+# Compared to Other Systems #
 
 Most other distributed file systems seem more complicated than necessary.
 
@@ -438,9 +273,7 @@ SeaweedFS is meant to be fast and simple, in both setup and operation. If you do
 
 SeaweedFS is constantly moving forward. Same with other systems. These comparisons can be outdated quickly. Please help to keep them updated.
 
-[Back to TOC](#table-of-contents)
-
-### Compared to HDFS ###
+## Compared to HDFS ##
 
 HDFS uses the chunk approach for each file, and is ideal for storing large files.
 
@@ -448,9 +281,7 @@ SeaweedFS is ideal for serving relatively smaller files quickly and concurrently
 
 SeaweedFS can also store extra large files by splitting them into manageable data chunks, and store the file ids of the data chunks into a meta chunk. This is managed by "weed upload/download" tool, and the weed master or volume servers are agnostic about it.
 
-[Back to TOC](#table-of-contents)
-
-### Compared to GlusterFS, Ceph ###
+## Compared to GlusterFS, Ceph ##
 
 The architectures are mostly the same. SeaweedFS aims to store and read files fast, with a simple and flat architecture. The main differences are
 
@@ -466,27 +297,18 @@ The architectures are mostly the same. SeaweedFS aims to store and read files fa
 | GlusterFS      | hashing          |                  | FUSE, NFS          |          |                           |
 | Ceph           | hashing + rules  |                  | FUSE               | Yes      |                           |
 | MooseFS        | in memory        |                  | FUSE               |       | No                          |
-| MinIO          | separate meta file for each file  |                  |         | Yes   | No                          |
+| MinIO          | separate meta file per drive for each file  |                  |         | Yes   | No                          |
+| RustFS         | separate meta file per drive for each file  |                  |         | Yes   | No                          |
 
-[Back to TOC](#table-of-contents)
+GlusterFS stores files, both directories and content, in configurable volumes called "bricks". It hashes the path and filename into ids, and assigned to virtual volumes, and then mapped to "bricks".
 
-### Compared to GlusterFS ###
-
-GlusterFS stores files, both directories and content, in configurable volumes called "bricks".
-
-GlusterFS hashes the path and filename into ids, and assigned to virtual volumes, and then mapped to "bricks".
-
-[Back to TOC](#table-of-contents)
-
-### Compared to MooseFS ###
+## Compared to MooseFS ##
 
 MooseFS chooses to neglect small file issue. From moosefs 3.0 manual, "even a small file will occupy 64KiB plus additionally 4KiB of checksums and 1KiB for the header", because it "was initially designed for keeping large amounts (like several thousands) of very big files"
 
-MooseFS Master Server keeps all meta data in memory. Same issue as HDFS namenode. 
+MooseFS Master Server keeps all meta data in memory. Same issue as HDFS namenode.
 
-[Back to TOC](#table-of-contents)
-
-### Compared to Ceph ###
+## Compared to Ceph ##
 
 Ceph can be setup similar to SeaweedFS as a key->blob store. It is much more complicated, with the need to support layers on top of it. [Here is a more detailed comparison](https://github.com/seaweedfs/seaweedfs/issues/120)
 
@@ -506,134 +328,39 @@ SeaweedFS Filer uses off-the-shelf stores, such as MySql, Postgres, Sqlite, Mong
 | Volume  | OSD | optimized for small files |
 | Filer  | Ceph FS | linearly scalable, Customizable, O(1) or O(logN) |
 
-[Back to TOC](#table-of-contents)
+## Compared to MinIO, RustFS ##
 
-### Compared to MinIO ###
+Please note, as Apr 25, 2026 MinIO ceased development. It's strongly discouraged to use that unmaintained software with multiple security bugs. RustFS is a MinIO reimplementation in Rust, Apache 2.0 licensed and still developed, keeping MinIO's storage model down to a byte-compatible on-disk format. So the points below apply to both.
 
-Please note, as Apr 25, 2026 MinIO ceased development. It's strongly discouraged to use that unmaintained software with multiple security bugs.
+MinIO followed AWS S3 closely and was ideal for testing for S3 API. It had good UI, policies, versionings, etc. SeaweedFS is trying to catch up here.
 
-MinIO followed AWS S3 closely and was ideal for testing for S3 API. It had good UI, policies, versionings, etc. SeaweedFS is trying to catch up here. 
+The metadata are in simple files. Each file write incurs extra writes to the corresponding meta file, on every drive of the erasure set. Changing only tags or retention rewrites that meta file on all of them, so the write amplification does not shrink with object size.
 
-MinIO metadata were in simple files. Each file write will incur extra writes to corresponding meta file.
-
-MinIO did not have optimization for lots of small files. The files were simply stored as is to local disks.
+There is no optimization for lots of small files. The files are simply stored as is to local disks.
 Plus the extra meta file and shards for erasure coding, it only amplifies the LOSF problem.
 
-MinIO had multiple disk IO to read one file. SeaweedFS has O(1) disk reads, even for erasure coded files.
+Multiple disk IO are needed to read one file. SeaweedFS has O(1) disk reads, even for erasure coded files.
 
-MinIO had full-time erasure coding. SeaweedFS uses replication on hot data for faster speed and optionally applies erasure coding on warm data.
+Erasure coding is full-time. SeaweedFS uses replication on hot data for faster speed and optionally applies erasure coding on warm data.
 
-MinIO did not have POSIX-like API support.
+No POSIX-like API support.
 
-MinIO had specific requirements on storage layout. It is not flexible to adjust capacity. In SeaweedFS, just start one volume server pointing to the master. That's all.
-
-## Dev Plan ##
-
-* More tools and documentation, on how to manage and scale the system.
-* Read and write stream data.
-* Support structured data.
-
-This is a super exciting project! And we need helpers and [support](https://www.patreon.com/seaweedfs)!
+There are specific requirements on storage layout, which makes it hard to scale out and to maintain. An erasure set must be 2 to 16 drives and must divide the drive list symmetrically, and capacity grows or shrinks a whole pool at a time. In SeaweedFS, just start one volume server pointing to the master. That's all.
 
 [Back to TOC](#table-of-contents)
 
-## Installation Guide ##
+# Benchmark #
 
-> Installation guide for users who are not familiar with golang
+Unscientific single-machine numbers from a MacBook with an SSD. [`weed benchmark`][Benchmarks], 1 million 1KB files, concurrency 16:
 
-Step 1: install go on your machine and setup the environment by following the instructions at:
+| | Requests per second | p50 | p99 |
+| --- | --- | --- | --- |
+| Write | 15,708 | 0.8 ms | 2.6 ms |
+| Random read | 47,019 | 0.3 ms | 0.7 ms |
 
-https://golang.org/doc/install
-
-make sure to define your $GOPATH
-
-
-Step 2: checkout this repo:
-```bash
-git clone https://github.com/seaweedfs/seaweedfs.git
-```
-Step 3: download, compile, and install the project by executing the following command
-
-```bash
-cd seaweedfs/weed && make install
-```
-
-Once this is done, you will find the executable "weed" in your `$GOPATH/bin` directory
-
-For more installation options, including how to run with Docker, see the [Getting Started guide](https://github.com/seaweedfs/seaweedfs/wiki/Getting-Started).
-
-[Back to TOC](#table-of-contents)
-
-## Disk Related Topics ##
-
-### Hard Drive Performance ###
-
-When testing read performance on SeaweedFS, it basically becomes a performance test of your hard drive's random read speed. Hard drives usually get 100MB/s~200MB/s.
-
-### Solid State Disk ###
-
-To modify or delete small files, SSD must delete a whole block at a time, and move content in existing blocks to a new block. SSD is fast when brand new, but will get fragmented over time and you have to garbage collect, compacting blocks. SeaweedFS is friendly to SSD since it is append-only. Deletion and compaction are done on volume level in the background, not slowing reading and not causing fragmentation.
-
-[Back to TOC](#table-of-contents)
-
-## Benchmark ##
-
-My Own Unscientific Single Machine Results on Mac Book with Solid State Disk, CPU: 1 Intel Core i7 2.6GHz.
-
-Write 1 million 1KB file:
-```
-Concurrency Level:      16
-Time taken for tests:   66.753 seconds
-Completed requests:      1048576
-Failed requests:        0
-Total transferred:      1106789009 bytes
-Requests per second:    15708.23 [#/sec]
-Transfer rate:          16191.69 [Kbytes/sec]
-
-Connection Times (ms)
-              min      avg        max      std
-Total:        0.3      1.0       84.3      0.9
-
-Percentage of the requests served within a certain time (ms)
-   50%      0.8 ms
-   66%      1.0 ms
-   75%      1.1 ms
-   80%      1.2 ms
-   90%      1.4 ms
-   95%      1.7 ms
-   98%      2.1 ms
-   99%      2.6 ms
-  100%     84.3 ms
-```
-
-Randomly read 1 million files:
-```
-Concurrency Level:      16
-Time taken for tests:   22.301 seconds
-Completed requests:      1048576
-Failed requests:        0
-Total transferred:      1106812873 bytes
-Requests per second:    47019.38 [#/sec]
-Transfer rate:          48467.57 [Kbytes/sec]
-
-Connection Times (ms)
-              min      avg        max      std
-Total:        0.0      0.3       54.1      0.2
-
-Percentage of the requests served within a certain time (ms)
-   50%      0.3 ms
-   90%      0.4 ms
-   98%      0.6 ms
-   99%      0.7 ms
-  100%     54.1 ms
-```
-
-### Run WARP and launch a mixed benchmark. ###
+`make benchmark` runs [warp][S3Benchmark] mixed S3 traffic against a local `weed server`:
 
 ```
-make benchmark
-warp: Benchmark data written to "warp-mixed-2025-12-05[194844]-kBpU.csv.zst"
-
 Mixed operations.
 Operation: DELETE, 10%, Concurrency: 20, Ran 42s.
  * Throughput: 55.13 obj/s
@@ -650,17 +377,19 @@ Operation: STAT, 30%, Concurrency: 20, Ran 42s.
 Cluster Total: 3302.88 MiB/s, 550.51 obj/s over 43s.
 ```
 
+Read throughput is bounded by the random read speed of the disks, and grows with every volume server added. More numbers, including multi-node, FUSE, and Hadoop, are in [Benchmarks][Benchmarks], [S3 API Benchmark][S3Benchmark], [FIO benchmark][FIO], and [Independent Benchmarks][IndependentBenchmarks].
+
 [Back to TOC](#table-of-contents)
 
-## Enterprise ##
+# Enterprise #
 
-For enterprise users, please visit [seaweedfs.com](https://seaweedfs.com) for the SeaweedFS Enterprise Edition, 
-which has advanced features, including data recovery, self-healing storage, 
+For enterprise users, please visit [seaweedfs.com](https://seaweedfs.com) for the SeaweedFS Enterprise Edition,
+which has advanced features, including data recovery, self-healing storage,
 customizable erasure coding, EC vacuum and repair, etc.
 
 [Back to TOC](#table-of-contents)
 
-## License ##
+# License #
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -674,9 +403,115 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 
-The text of this page is available for modification and reuse under the terms of the Creative Commons Attribution-Sharealike 3.0 Unported License and the GNU Free Documentation License (unversioned, with no invariant sections, front-cover texts, or back-cover texts).
+[Back to TOC](#table-of-contents)
+
+# Sponsors #
+
+<h3 align="center"><a href="https://www.patreon.com/seaweedfs">Sponsor SeaweedFS via Patreon</a></h3>
+
+SeaweedFS is an independent Apache-licensed open source project with its ongoing development made
+possible entirely thanks to the support of these awesome [backers](https://github.com/seaweedfs/seaweedfs/blob/master/backers.md).
+If you'd like to grow SeaweedFS even stronger, please consider joining our
+<a href="https://www.patreon.com/seaweedfs">sponsors on Patreon</a>.
+
+Your support will be really appreciated by me and other supporters!
+
+<!--
+<h4 align="center">Platinum</h4>
+
+<p align="center">
+  <a href="" target="_blank">
+    <img src="https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_nodion.png" width="200" alt="nodion">
+  </a>
+</p>
+-->
+
+### Gold Sponsors
+[![nodion](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_nodion.png)](https://www.nodion.com)
+[![piknik](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/piknik.png)](https://www.piknik.com)
+[![keepsec](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/keepsec.png)](https://www.keepsec.ca)
+[![zyner](https://raw.githubusercontent.com/seaweedfs/seaweedfs/master/note/sponsor_zyner.png)](https://zyner.org)
 
 [Back to TOC](#table-of-contents)
 
-## Stargazers over time
-[![Stargazers over time](https://starchart.cc/seaweedfs/seaweedfs.svg?variant=adaptive)](https://starchart.cc/seaweedfs/seaweedfs)
+## Star History
+
+![Star History](note/star_history.svg)
+
+[WeedMini]: https://github.com/seaweedfs/seaweedfs/wiki/Quick-Start-with-weed-mini
+[DockerComposeS3]: https://github.com/seaweedfs/seaweedfs/wiki/Docker-Compose-for-S3
+[HelmRecipes]: https://github.com/seaweedfs/seaweedfs/wiki/Helm-Chart-Recipes
+[Operator]: https://github.com/seaweedfs/seaweedfs-operator
+[SeaweedFsCsiDriver]: https://github.com/seaweedfs/seaweedfs-csi-driver
+[GettingStarted]: https://github.com/seaweedfs/seaweedfs/wiki/Getting-Started
+[ProductionSetup]: https://github.com/seaweedfs/seaweedfs/wiki/Production-Setup
+[ErasureCoding]: https://github.com/seaweedfs/seaweedfs/wiki/Erasure-Coding-for-warm-storage
+[RustVolume]: https://github.com/seaweedfs/seaweedfs/wiki/Rust-Volume-Server
+[Benchmarks]: https://github.com/seaweedfs/seaweedfs/wiki/Benchmarks
+[S3Benchmark]: https://github.com/seaweedfs/seaweedfs/wiki/S3-API-Benchmark
+[FIO]: https://github.com/seaweedfs/seaweedfs/wiki/FIO-benchmark
+[IndependentBenchmarks]: https://github.com/seaweedfs/seaweedfs/wiki/Independent-Benchmarks
+[FailoverMaster]: https://github.com/seaweedfs/seaweedfs/wiki/Failover-Master-Server
+[WeedShell]: https://github.com/seaweedfs/seaweedfs/wiki/weed-shell
+[Worker]: https://github.com/seaweedfs/seaweedfs/wiki/Worker
+[FilerStores]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Stores
+[Replication]: https://github.com/seaweedfs/seaweedfs/wiki/Replication
+[TieredStorage]: https://github.com/seaweedfs/seaweedfs/wiki/Tiered-Storage
+[CloudTier]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Tier
+[SuperLargeFiles]: https://github.com/seaweedfs/seaweedfs/wiki/Data-Structure-for-Large-Files
+[Versioning]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Object-Versioning
+[ObjectLock]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Object-Lock-and-Retention
+[Lifecycle]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Lifecycle
+[CORS]: https://github.com/seaweedfs/seaweedfs/wiki/S3-CORS
+[ConditionalOps]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Conditional-Operations
+[RenameObject]: https://github.com/seaweedfs/seaweedfs/wiki/S3-RenameObject
+[BucketPolicies]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Bucket-Policies
+[PolicyConditions]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Policy-Conditions
+[PolicyVariables]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Policy-Variables
+[OIDC]: https://github.com/seaweedfs/seaweedfs/wiki/OIDC-Integration
+[K8sSA]: https://github.com/seaweedfs/seaweedfs/wiki/Kubernetes-ServiceAccount-Authentication
+[SSE]: https://github.com/seaweedfs/seaweedfs/wiki/Server-Side-Encryption
+[AuditLog]: https://github.com/seaweedfs/seaweedfs/wiki/S3-API-Audit-log
+[BucketQuota]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Bucket-Quota
+[RateLimiting]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Rate-Limiting
+[AmazonS3API]: https://github.com/seaweedfs/seaweedfs/wiki/Amazon-S3-API
+[S3vsMinio]: https://github.com/seaweedfs/seaweedfs/wiki/Supported-APIs-vs-Minio
+[S3TableBucket]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Table-Bucket
+[LanceCatalog]: https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS-Lance-Catalog
+[IcebergCatalog]: https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS-Iceberg-Catalog
+[SparkIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Spark-Iceberg-Integration
+[TrinoIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Trino-Iceberg-Integration
+[DremioIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Dremio-Iceberg-Integration
+[DuckDBIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/DuckDB-Iceberg-Integration
+[DorisIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/Doris-Iceberg-Integration
+[RisingWaveIceberg]: https://github.com/seaweedfs/seaweedfs/wiki/RisingWave-Iceberg-Integration
+[LanceDB]: https://github.com/seaweedfs/seaweedfs/wiki/LanceDB-Integration
+[Lakekeeper]: https://github.com/seaweedfs/seaweedfs/wiki/Lakekeeper-Iceberg-Integration
+[OLake]: https://github.com/seaweedfs/seaweedfs/wiki/OLake-Go-Iceberg-Integration
+[IcebergMaintenance]: https://github.com/seaweedfs/seaweedfs/wiki/Iceberg-Table-Maintenance
+[LanceMaintenance]: https://github.com/seaweedfs/seaweedfs/wiki/Lance-Maintenance-Worker
+[S3TablesSecurity]: https://github.com/seaweedfs/seaweedfs/wiki/S3-Tables-Security
+[Hadoop]: https://github.com/seaweedfs/seaweedfs/wiki/Hadoop-Compatible-File-System
+[CloudDrive]: https://github.com/seaweedfs/seaweedfs/wiki/Cloud-Drive-Architecture
+[CacheRemote]: https://github.com/seaweedfs/seaweedfs/wiki/Cache-Remote-Storage
+[GatewayToRemoteObjectStore]: https://github.com/seaweedfs/seaweedfs/wiki/Gateway-to-Remote-Object-Storage
+[ActiveActiveAsyncReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Active-Active-cross-cluster-continuous-synchronization
+[FilerStoreReplication]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication
+[AsyncBackup]: https://github.com/seaweedfs/seaweedfs/wiki/Async-Backup
+[MetaBackup]: https://github.com/seaweedfs/seaweedfs/wiki/Async-Filer-Metadata-Backup
+[CDC]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Change-Data-Capture
+[Webhook]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Notification-Webhook
+[Mount]: https://github.com/seaweedfs/seaweedfs/wiki/FUSE-Mount
+[MountWindows]: https://github.com/seaweedfs/seaweedfs/wiki/Mount-on-Windows
+[WebDAV]: https://github.com/seaweedfs/seaweedfs/wiki/WebDAV
+[SFTP]: https://github.com/seaweedfs/seaweedfs/wiki/SFTP-Server
+[TUS]: https://github.com/seaweedfs/seaweedfs/wiki/TUS-Resumable-Uploads
+[FilerDataEncryption]: https://github.com/seaweedfs/seaweedfs/wiki/Filer-Data-Encryption
+[FIPS]: https://github.com/seaweedfs/seaweedfs/wiki/Cryptography-and-FIPS-Compliance
+[AdminUI]: https://github.com/seaweedfs/seaweedfs/wiki/Admin-UI
+[Metrics]: https://github.com/seaweedfs/seaweedfs/wiki/System-Metrics
+[VolumeServerTTL]: https://github.com/seaweedfs/seaweedfs/wiki/Store-file-with-a-Time-To-Live
+[SeaweedUp]: https://github.com/seaweedfs/seaweedfs/wiki/Deployment-with-seaweed-up
+[BlobStoreArchitecture]: https://github.com/seaweedfs/seaweedfs/wiki/Blob-Store-Architecture
+[Components]: https://github.com/seaweedfs/seaweedfs/wiki/Components
+[WhitePaper]: https://github.com/seaweedfs/seaweedfs/wiki/SeaweedFS_Architecture.pdf
diff --git a/REST_API.md b/REST_API.md
new file mode 100644
index 0000000000..a8315a5fd5
--- /dev/null
+++ b/REST_API.md
@@ -0,0 +1,344 @@
+# SeaweedFS HTTP REST API
+
+SeaweedFS exposes three HTTP surfaces:
+
+| Service | Default port | Addressing |
+|---------|--------------|------------|
+| Filer | 8888 | File system paths (`/dir/name`) |
+| Master | 9333 | File id assignment and cluster topology |
+| Volume server | 8080 | File content by file id (`vid,fid`) |
+
+Most clients only need the filer API (paths) or the S3 API. The master and
+volume APIs are the lower-level blob store interface.
+
+Conventions applying to all three:
+
+- Responses are JSON unless noted otherwise. Append `&pretty=y` to pretty-print.
+- A file id (`fid`) has the form `volumeId,fileKeyCookie`, e.g. `3,01637037d6`.
+  An optional suffix selects a reserved id from a `count` assignment
+  (`3,01637037d6_1`, `_2`, ...), and an optional extension
+  (`3,01637037d6.jpg`) sets the content type on reads.
+- `replication` is a 3-digit replica placement `xyz`: `x` copies in other
+  data centers, `y` on other racks in the same data center, `z` on other
+  volume servers on the same rack. `000` = no replication, `001` = one copy
+  on the same rack, `010` = one copy on a different rack, `100` = one copy in
+  another data center, `200` = two copies in two other data centers, `110` =
+  one copy in another data center plus one on another rack.
+- `ttl` units: `m` minute, `h` hour, `d` day, `w` week, `M` month, `y` year.
+
+## Filer API (port 8888)
+
+The filer presents a POSIX-like namespace over the volume servers.
+
+### Upload a file
+
+```bash
+# PUT the raw body to the target path
+curl -T /home/chris/myphoto.jpg "http://localhost:8888/dir/myphoto.jpg"
+
+# or POST as multipart form (the part filename becomes the entry name)
+curl -F file=@/home/chris/myphoto.jpg "http://localhost:8888/dir/"
+```
+
+Response `201 Created`:
+
+```json
+{"name":"myphoto.jpg","size":43234,"eTag":"0x6c656...","mtime":"...","chunks":[...]}
+```
+
+Query parameters:
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `collection` | collection name | empty |
+| `replication` | replica placement code | filer default |
+| `ttl` | file expiration, e.g. `3d` | never |
+| `disk` | disk type to store on | filer default |
+| `fsync` | `true` fsyncs on the volume server | false |
+| `dataCenter` | preferred data center | empty |
+| `rack` | preferred rack | empty |
+| `dataNode` | preferred volume server | empty |
+| `saveInside` | store small content inside the metadata instead of a volume | false |
+| `maxMB` | split the upload into chunks of this many MB | filer `-maxMB` |
+| `mode` | unix permission bits, e.g. `0644` | `0660` |
+| `op` | `append` appends to an existing file | overwrite |
+| `skipCheckParentDir` | `true` skips the parent-directory existence check | false |
+
+### Create a directory
+
+```bash
+curl -X POST "http://localhost:8888/dir/newdir/"
+```
+
+A POST to a path ending in `/` with no content creates the directory,
+including missing parents.
+
+### Read a file
+
+```bash
+curl "http://localhost:8888/dir/myphoto.jpg"
+```
+
+Supports `Range` requests (`Accept-Ranges: bytes`), `ETag`, and the
+`If-None-Match` / `If-Modified-Since` conditional headers. `HEAD` returns
+headers only. Entry headers stored as extended attributes are echoed back,
+minus internal `Seaweed-` and `xattr-` keys.
+
+Entry metadata instead of content:
+
+```bash
+curl "http://localhost:8888/dir/myphoto.jpg?metadata=true"
+```
+
+`metadata=true&resolveManifest=true` additionally resolves chunked-manifest
+entries into their real chunk list.
+
+### List a directory
+
+```bash
+curl -H "Accept: application/json" "http://localhost:8888/dir/?limit=10&lastFileName=a.jpg"
+```
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `limit` | max entries per page | filer `-dirListLimit` |
+| `lastFileName` | resume listing after this entry name | empty |
+| `namePattern` | include only names matching the wildcard | empty |
+| `namePatternExclude` | exclude names matching the wildcard | empty |
+
+The JSON response carries `Path`, `Entries`, `Limit`, `LastFileName`,
+`ShouldDisplayLoadMore`, and `EmptyFolder`. Without the `Accept` header the
+filer renders its HTML browser.
+
+### Move and copy
+
+```bash
+curl -X POST "http://localhost:8888/dir/newname.jpg?mv.from=/dir/myphoto.jpg"
+curl -X POST "http://localhost:8888/dir/copy.jpg?cp.from=/dir/myphoto.jpg"
+```
+
+`mv.from` renames or moves the source to the request path (`204 No Content`).
+`cp.from` copies it.
+
+### Append
+
+```bash
+curl -T chunk2.bin "http://localhost:8888/dir/file.bin?op=append"
+```
+
+### Delete
+
+```bash
+curl -X DELETE "http://localhost:8888/dir/myphoto.jpg"
+curl -X DELETE "http://localhost:8888/dir/?recursive=true"
+```
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `recursive` | delete a non-empty directory tree | false; when the filer runs with `filer.options.recursive_delete=true`, deletes are recursive unless `recursive=false` |
+| `ignoreRecursiveError` | keep deleting remaining entries after an error | false |
+| `skipChunkDeletion` | remove only the metadata, keep volume data | false |
+
+### Tagging
+
+Tags are carried as `Seaweed-`-prefixed request headers, not query
+parameters; `?tagging` selects the tagging handler and `?tagging=K1,K2`
+lists the keys to remove. Header names are canonicalized on write
+(`Seaweed-k1` is stored as `Seaweed-K1`), and the delete list is matched
+case-sensitively against the stored names.
+
+```bash
+curl -X PUT -H "Seaweed-k1: v1" -H "Seaweed-k2: v2" "http://localhost:8888/dir/file.jpg?tagging"
+curl -X DELETE "http://localhost:8888/dir/file.jpg?tagging=K1,K2"
+```
+
+### Read by file id
+
+```bash
+curl "http://localhost:8888/?proxyChunkId=3,01637037d6"
+```
+
+The filer proxies the chunk read to the right volume server, so only the
+filer port needs to be exposed.
+
+### Resumable uploads
+
+The filer serves the [TUS protocol](https://tus.io/) for resumable uploads
+(`POST`, `PATCH`, `HEAD` on upload URLs). It is enabled by default at
+`/.tus`; `-tusBasePath` changes the endpoint base path.
+
+### Health
+
+`GET /healthz` and `GET /readyz` return `200 OK`.
+
+## Master API (port 9333)
+
+Write-affecting endpoints are automatically proxied to the current leader, so
+any master in the quorum can serve them.
+
+### Assign a file id
+
+```bash
+curl "http://localhost:9333/dir/assign?count=1&replication=001&collection=turbo&dataCenter=dc1&ttl=3d&disk=ssd"
+{"count":1,"fid":"3,01637037d6","url":"127.0.0.1:8080","publicUrl":"localhost:8080"}
+```
+
+Upload the file content to `http://<url>/<fid>` afterwards. With `count>1`,
+use `<fid>_1`, `<fid>_2`, ... for the additional ids.
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `count` | file ids to reserve | 1 |
+| `collection` | collection name | empty |
+| `dataCenter` | preferred data center | empty |
+| `rack` | preferred rack | empty |
+| `dataNode` | preferred volume server | empty |
+| `replication` | replica placement | master `-defaultReplication` |
+| `ttl` | file expiration, e.g. `3d` | never |
+| `disk` | disk type | empty |
+| `dataSize` | expected file size in bytes | 0 |
+| `preallocate` | bytes to preallocate for new volumes | master `-volumePreallocate` |
+| `writableVolumeCount` | grow this many volumes when none are writable | master default |
+| `memoryMapMaxSizeMb` | memory-mapped file size (Windows) | 0 |
+
+### Look up a volume or file id
+
+```bash
+curl "http://localhost:9333/dir/lookup?volumeId=3"
+{"locations":[{"url":"localhost:8080","publicUrl":"localhost:8080"}]}
+```
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `volumeId` | volume id; a full `vid,fid` is accepted too | required |
+| `fileId` | like `volumeId`, but also returns a write JWT when security is on | empty |
+| `collection` | speeds up the lookup | empty |
+| `read` | `yes` generates a read JWT instead of a write JWT | empty |
+
+### Store a file in one call
+
+```bash
+curl -F file=@/home/chris/report.pdf "http://localhost:9333/submit?collection=turbo&replication=001"
+{"fileName":"report.pdf","fid":"3,01637037d6","fileUrl":"localhost:8080/3,01637037d6","size":43234,"eTag":"0x6c656..."}
+```
+
+`POST /submit` accepts multipart file data plus the `dir/assign` placement
+parameters (`count`, `collection`, `dataCenter`, `rack`, `replication`,
+`ttl`, `disk`), assigns a file id, uploads to the volume server, and returns
+the result.
+
+### Redirect to a file
+
+```bash
+curl -v "http://localhost:9333/3,01637037d6"
+```
+
+`GET /{fileId}` answers `308 Permanent Redirect` to a volume server holding
+the file, preserving the query string (e.g. image-resize parameters).
+
+### Cluster status
+
+```bash
+curl "http://localhost:9333/dir/status?pretty=y"   # full topology tree
+curl "http://localhost:9333/vol/status?pretty=y"   # every volume on every node
+curl "http://localhost:9333/collection/info?collection=turbo"
+curl "http://localhost:9333/collection/info?collection=turbo&detail=true"
+```
+
+`collection/info` returns aggregated `TotalSize`, `FileCount`, `UsedSize`,
+`VolumeCount`; `detail=true` splits them per volume layout.
+
+### Grow volumes
+
+```bash
+curl "http://localhost:9333/vol/grow?count=4&replication=001&collection=turbo&ttl=5d&disk=ssd&dataCenter=dc1&rack=rack1"
+{"count":4}
+```
+
+`count` is required; the placement parameters match `dir/assign`. One volume
+serves one write at a time, so pre-allocated volumes raise write concurrency.
+
+### Vacuum deleted space
+
+```bash
+curl "http://localhost:9333/vol/vacuum?garbageThreshold=0.4"
+```
+
+| Parameter | Description | Default |
+|-----------|-------------|---------|
+| `garbageThreshold` | minimum deleted-bytes ratio before a volume is compacted | master `-garbageThreshold` (0.3) |
+
+Vacuuming makes a volume read-only, copies live needles to a new volume, and
+swaps it in.
+
+### Delete a collection
+
+```bash
+curl "http://localhost:9333/col/delete?collection=benchmark"
+```
+
+Deletes all volumes of the collection, including erasure-coded shards.
+`204 No Content` on success.
+
+### Health
+
+```bash
+curl -I "http://localhost:9333/healthz"     # liveness
+curl -I "http://localhost:9333/readyz"      # readiness
+curl "http://localhost:9333/"               # web UI
+```
+
+## Volume server API (port 8080)
+
+The volume server stores file content by file id. Clients normally get the
+volume URL from `dir/assign` or `dir/lookup`.
+
+### Upload
+
+```bash
+curl -F file=@/home/chris/myphoto.jpg "http://127.0.0.1:8080/3,01637037d6"
+{"name":"myphoto.jpg","size":43234,"eTag":"0x6c656...","mime":"image/jpeg","contentMd5":"..."}
+```
+
+PUT or POST the body (or a multipart `file` part) to `/{vid},{fid}`.
+`204 No Content` is returned when the content is unchanged. `?ts=<unix>`
+sets the stored modification time.
+
+### Read
+
+```bash
+curl "http://127.0.0.1:8080/3,01637037d6"
+curl "http://127.0.0.1:8080/3,01637037d6.jpg"        # sets Content-Type from the extension
+```
+
+Supports `Range` and `HEAD`. Image files can be resized server-side:
+
+| Parameter | Description |
+|-----------|-------------|
+| `width`, `height` | resize bounds in pixels |
+| `mode` | `fit` (contain) or `fill` (cover); omitted resizes to `width`/`height` |
+| `crop_x1`, `crop_y1`, `crop_x2`, `crop_y2` | explicit crop rectangle |
+| `cm` | `false` returns the chunk-manifest blob instead of resolving it |
+| `readDeleted` | `true` reads soft-deleted needles |
+| `collection` | passed through redirects for the right volume |
+
+### Delete
+
+```bash
+curl -X DELETE "http://127.0.0.1:8080/3,01637037d6"
+{"size":43234}
+```
+
+`?ts=<unix>` sets the deletion timestamp. Replicated volumes propagate the
+delete to every replica.
+
+### Status
+
+```bash
+curl "http://localhost:8080/status?pretty=y"  # disk and volume inventory
+curl -I "http://localhost:8080/healthz"       # liveness/readiness
+```
+
+`OPTIONS` preflights answer CORS headers. When `-port.public` differs from
+`-port`, the volume server opens a separate read-only public listener on
+that port; `-publicUrl` sets the address it advertises to clients.
diff --git a/VOLUME_SERVER_RUST_PLAN.md b/VOLUME_SERVER_RUST_PLAN.md
index 1c402336fd..4097b4d9f4 100644
--- a/VOLUME_SERVER_RUST_PLAN.md
+++ b/VOLUME_SERVER_RUST_PLAN.md
@@ -169,6 +169,7 @@ seaweed-volume/
    - `--memprofile`
    - `--compactionMBps` (default 0)
    - `--maintenanceMBps` (default 0)
+   - `--compactionMaxParallelCommits` (default 0)
    - `--fileSizeLimitMB` (default 256)
    - `--concurrentUploadLimitMB` (default 0)
    - `--concurrentDownloadLimitMB` (default 0)
diff --git a/design-cloudstack-provider.md b/design-cloudstack-provider.md
new file mode 100644
index 0000000000..24e99db454
--- /dev/null
+++ b/design-cloudstack-provider.md
@@ -0,0 +1,418 @@
+# SeaweedFS as an Apache CloudStack Object Storage Provider
+
+A CloudStack ObjectStore plugin that makes SeaweedFS a first-class object storage
+backend inside Apache CloudStack, alongside the existing MinIO and Ceph RGW
+providers. This is a collaboration with proIO (Swen), who builds private clouds on
+CloudStack and wants SeaweedFS as a storage option.
+
+## The request
+
+> We can only add MinIO and Ceph as object storage [in CloudStack] today. I want
+> to get SeaweedFS into this project... What we need is to build a provider which
+> does the communication between Cloudstack and SeaweedFS.
+
+This is **not** a SeaweedFS-side feature. The work lives in the Apache CloudStack
+repo (Java): a new plugin under `plugins/storage/object/seaweedfs/` that implements
+CloudStack's ObjectStore plugin framework and talks to SeaweedFS over its S3 and
+IAM APIs. SeaweedFS itself needs no changes for the core to work — its S3 API
+already covers every bucket operation CloudStack requires, and its IAM API covers
+user/credential management.
+
+## How the CloudStack ObjectStore framework works
+
+CloudStack 4.18+ introduced an Object Storage framework. An admin registers an
+object storage pool via `addObjectStoragePool` (URL + provider + credentials);
+tenants then create and manage buckets on it through CloudStack APIs. CloudStack
+manages pool and bucket lifecycle; the underlying provider handles the actual
+object protocol.
+
+A provider is a plugin module implementing three interfaces:
+
+### 1. `ObjectStoreProvider` — registration
+
+`MinIOObjectStoreProviderImpl` is the reference. It is a Spring `@Component` that:
+- Returns a provider name (`"MinIO"`)
+- Returns `DataStoreProviderType.OBJECT`
+- In `configure()`, injects the lifecycle and driver implementations and calls
+  `storeMgr.registerDriver(name, driver)`
+
+### 2. `ObjectStoreLifeCycle` — pool add/remove
+
+`MinIOObjectStoreLifeCycleImpl.initialize()` reads the URL, name, and
+`accesskey`/`secretkey` details from the `addObjectStoragePool` call, tests the
+connection by listing buckets, and persists an `ObjectStoreVO` via
+`ObjectStoreHelper`. The other methods (attachCluster/Host/Zone, maintain,
+deleteDataStore) are no-ops for object storage.
+
+### 3. `ObjectStoreDriver` — bucket + user operations
+
+`ObjectStoreDriver` (in `engine/storage/.../object/ObjectStoreDriver.java`) extends
+`DataStoreDriver` and defines the bucket/user contract. Every provider must
+implement:
+
+| Method | Purpose |
+| --- | --- |
+| `createBucket(Bucket, boolean objectLock)` | Create a bucket |
+| `listBuckets(long storeId)` | List all buckets |
+| `deleteBucket(BucketTO, long storeId)` | Delete a bucket |
+| `createUser(long accountId, long storeId)` | Provision a user + credentials for a CloudStack account |
+| `setBucketPolicy` / `getBucketPolicy` / `deleteBucketPolicy` | Bucket policy CRUD |
+| `setBucketEncryption` / `deleteBucketEncryption` | SSE config |
+| `setBucketVersioning` / `deleteBucketVersioning` | Versioning enable/suspend |
+| `setBucketQuota(BucketTO, long storeId, long size)` | Per-bucket quota |
+| `getAllBucketsUsage(long storeId)` | Usage map for billing/accounting |
+| `getBucketAcl` / `setBucketAcl` | ACLs (MinIO/Ceph return null / no-op) |
+
+`BaseObjectStoreDriverImpl` provides no-op defaults for the `DataStoreDriver`
+methods (`createAsync`, `deleteAsync`, `copyAsync`, `canCopy`, `resize`,
+`getTO`, `getStoreTO`), so object-store providers only implement the bucket/user
+methods above.
+
+## How the four existing providers differ (and where SeaweedFS lands)
+
+CloudStack ships four object-store providers. Three are relevant; the simulator
+is a test stub.
+
+| Concern | MinIO | Ceph RGW | Cloudian HyperStore | SeaweedFS |
+| --- | --- | --- | --- | --- |
+| Bucket CRUD | `MinioClient` (S3) | `AmazonS3` (AWS SDK v1) | `AmazonS3` (AWS SDK v1) | `AmazonS3` (AWS SDK v1) |
+| Bucket policy | `MinioClient` | `AmazonS3` | `AmazonS3` | `AmazonS3` |
+| Versioning | `MinioClient` | `AmazonS3` | `AmazonS3` | `AmazonS3` |
+| Encryption | `MinioClient` | not implemented | `AmazonS3` | `AmazonS3` |
+| **User creation** | `MinioAdminClient` | `RgwAdmin` | **`AmazonIdentityManagement`** | **`AmazonIdentityManagement`** |
+| **Per-bucket quota** | `MinioAdminClient` | `RgwAdmin` | **not supported** (throws) | **S3 extension** (`PUT /{bucket}?seaweedfs-quota`, SigV4, `s3:PutBucketQuota`) |
+| **Usage reporting** | `MinioAdminClient` | `RgwAdmin` | Cloudian admin API | S3 `ListObjectsV2` (MVP); Prometheus / SOSAPI `capacity.xml` (recommended) |
+
+**Cloudian HyperStore is the direct precedent.** It is an S3-compatible store
+that, like SeaweedFS, manages users via the **standard AWS IAM API** using the
+AWS IAM Java SDK (`com.amazonaws.services.identitymanagement`). Its driver
+(`CloudianHyperStoreObjectStoreDriverImpl`) and util
+(`CloudianHyperStoreUtil`) are the template this design follows almost line for
+line. Cloudian even validates the quota limitation the same way this design
+proposes for the MVP: `setBucketQuota` throws for any non-zero size and only
+accepts `0` (no quota).
+
+The SeaweedFS plugin is therefore a **simpler Cloudian** — same AWS S3 + IAM SDK
+clients, same store-details keys (`s3Url`, `iamUrl`, `accesskey`, `secretkey`),
+same IAM-user-with-restricted-policy pattern, but with no proprietary admin
+client at all (Cloudian has its own `CloudianClient` for its admin API; SeaweedFS
+needs only S3 + IAM). For quota, the plugin uses a narrow SeaweedFS S3 extension
+(see below); for usage reporting, it falls back to S3 `ListObjectsV2` in the MVP
+and recommends Prometheus or SOSAPI `capacity.xml` for production scale.
+
+### Quota via the S3 `?seaweedfs-quota` extension
+
+SeaweedFS supports bucket quota natively (server-side enforcement via a
+read-only flag when usage exceeds the limit). Rather than exposing the broad
+admin REST API (which would require a global bearer token and grant cluster-wide
+admin access), the integration uses a **narrow, scoped S3 subresource**:
+
+- `PUT /{bucket}?seaweedfs-quota` — set bucket quota (IAM permission `s3:PutBucketQuota`)
+- `GET /{bucket}?seaweedfs-quota` — get bucket quota (IAM permission `s3:GetBucketQuota`)
+
+**PUT request body** (JSON):
+```json
+{"quota_size": 100, "quota_unit": "GB", "quota_enabled": true}
+```
+
+**GET response body** (JSON):
+```json
+{"quota_size": 107374182400, "quota_unit": "B", "quota_enabled": true}
+```
+
+Note: GET always returns `quota_unit: "B"` and the absolute byte count, not
+the original unit. A disabled-but-retained quota returns a positive
+`quota_size` with `quota_enabled: false`.
+
+Quota is stored on the bucket's filer entry (positive = enabled, negative =
+disabled but retained, zero = no quota), matching the existing admin REST API
+behavior. When quota is cleared, the bucket's read-only flag is also lifted.
+
+**Authentication** uses the existing S3 SigV4 flow — no new global secret is
+needed. The CloudStack service credential (the `accesskey`/`secretkey` on the
+object store) is the admin credential used for all driver operations: bucket
+CRUD, IAM user provisioning, and quota management. It must have broad S3 and
+IAM permissions. The per-account IAM users created by `createUser` are the
+ones with restricted permissions (full S3 access except bucket
+creation/deletion). A future hardening could split quota management onto a
+separate credential scoped to only `s3:PutBucketQuota`/`s3:GetBucketQuota`,
+but the MVP uses the single admin credential for simplicity, matching how
+the MinIO and Ceph providers work.
+
+The plugin's `setBucketQuota` signs and sends the `PUT /{bucket}?seaweedfs-quota`
+request using the AWS SDK v1 `AWSS3V4Signer` for SigV4 signing, then sends the
+signed request via `java.net.http.HttpClient` (the AWS S3 SDK doesn't natively
+support custom subresources, so we sign manually and send the request
+ourselves). The `seaweedfs-quota` query parameter is included in the signed
+canonical query string.
+
+### Usage reporting
+
+`getAllBucketsUsage` must return a `Map<String, Long>` of bucket name → size.
+MinIO uses `MinioAdminClient.getDataUsageInfo`; Ceph uses
+`RgwAdmin.listBucketInfo`. SeaweedFS has no admin rollup endpoint, so the MVP
+plugin computes it by listing buckets and summing object sizes via S3
+`ListObjectsV2` — expensive for large stores.
+
+For production scale, SeaweedFS already exposes per-bucket size in:
+- **Prometheus metrics** (`bucket_size_bytes` gauge, refreshed every minute)
+- **SOSAPI `capacity.xml`** (reports capacity, available space, and usage
+  through the S3 endpoint)
+
+Operators should consume one of those instead of S3 list-based aggregation for
+large deployments. The MVP's list-based approach is correct but slow; flag it as
+a known limitation.
+
+## SeaweedFS API surface (what the plugin relies on)
+
+SeaweedFS exposes two relevant APIs, both AWS-compatible:
+
+### S3 API (`weed s3`)
+Full S3-compatible surface. Confirmed against the SeaweedFS S3 wiki and code:
+- `CreateBucket`, `HeadBucket`, `ListBuckets`, `DeleteBucket`
+- `PutBucketPolicy`, `GetBucketPolicy`, `DeleteBucketPolicy`
+- `PutBucketVersioning` (Enabled / Suspended), `GetBucketVersioning`
+- `PutBucketEncryption`, `GetBucketEncryption`, `DeleteBucketEncryption`
+- `PutBucketAcl`, `GetBucketAcl`
+- `ListObjectsV2`, `HeadObject`, `GetObject`, `PutObject`, `DeleteObject`
+- Bucket quota via extended attributes / `s3.bucket.quota` (enforced server-side,
+  surfaced as a read-only state when exceeded — see PR #10224)
+
+### IAM API (`weed iam` / `iamapi`)
+AWS IAM-compatible REST endpoints, implemented in `weed/iamapi/`. Confirmed by
+the test suite which uses the **AWS IAM SDK** (`aws-sdk-go/service/iam`) against
+the same handlers CloudStack would call:
+- `CreateUser`, `DeleteUser`, `ListUsers`, `GetUser`
+- `CreateAccessKey`, `DeleteAccessKey`, `ListAccessKeys`
+- `PutUserPolicy`, `GetUserPolicy`, `DeleteUserPolicy`
+- `AttachUserPolicy`, `ListAttachedUserPolicies`
+
+This means the CloudStack plugin can manage SeaweedFS users with the **AWS IAM
+Java SDK** (`com.amazonaws.services.identitymanagement.AmazonIdentityManagement`),
+exactly the way the AWS IAM Go SDK is used in SeaweedFS's own tests. No proprietary
+admin client is needed. **Cloudian HyperStore already does exactly this** in the
+CloudStack tree — the SeaweedFS plugin follows the same pattern.
+
+## Design
+
+### Module layout
+
+New CloudStack plugin module, mirroring `plugins/storage/object/cloudian/`
+(the closest precedent — same AWS S3 + IAM SDK approach):
+
+```
+plugins/storage/object/seaweedfs/
+  pom.xml
+  src/main/java/org/apache/cloudstack/storage/datastore/
+    driver/SeaweedFSObjectStoreDriverImpl.java
+    lifecycle/SeaweedFSObjectStoreLifeCycleImpl.java
+    provider/SeaweedFSObjectStoreProviderImpl.java
+    util/SeaweedFSObjectStoreUtil.java
+  src/test/java/org/apache/cloudstack/storage/datastore/
+    driver/SeaweedFSObjectStoreDriverImplTest.java
+    provider/SeaweedFSObjectStoreProviderImplTest.java
+  src/main/resources/META-INF/cloudstack/storage-object-seaweedfs/
+    module.properties
+    spring-storage-object-seaweedfs-context.xml
+```
+
+### `SeaweedFSObjectStoreProviderImpl`
+
+Direct copy of `MinIOObjectStoreProviderImpl` with `providerName = "SeaweedFS"`,
+injecting the SeaweedFS lifecycle and driver. Registers via
+`storeMgr.registerDriver`.
+
+### `SeaweedFSObjectStoreLifeCycleImpl`
+
+Copy of `MinIOObjectStoreLifeCycleImpl`. `initialize()` reads `url`, `name`,
+`accesskey`, `secretkey` from the `addObjectStoragePool` details map, tests the
+connection by calling `AmazonS3.listBuckets()` against the SeaweedFS S3 endpoint,
+and persists the `ObjectStoreVO`. No proprietary client needed — the AWS S3 SDK
+is enough for the health check.
+
+### `SeaweedFSObjectStoreDriverImpl`
+
+The substantive class. Uses two AWS SDK v1 clients (same dependency Ceph already
+pulls in, so no new CloudStack dependency):
+
+- `AmazonS3` for bucket operations (path-style, endpoint-pinned, `us-east-1`
+  region placeholder — same as Ceph's `getS3Client`)
+- `AmazonIdentityManagement` for user/credential operations, pointed at the
+  SeaweedFS IAM endpoint
+
+#### Bucket operations — straightforward S3
+
+| Interface method | Implementation |
+| --- | --- |
+| `createBucket` | `s3.createBucket(name)`; reject if `doesBucketExistV2`; persist access/secret key + URL on `BucketVO` (same as Ceph) |
+| `listBuckets` | `s3.listBuckets()` → wrap as `BucketObject` (same as Ceph) |
+| `deleteBucket` | `s3.deleteBucket(name)` (same as Ceph) |
+| `setBucketPolicy` | `s3.setBucketPolicy(...)` with the same public/private JSON the MinIO/Ceph drivers build |
+| `getBucketPolicy` / `deleteBucketPolicy` | `s3.getBucketPolicy` / `s3.deleteBucketPolicy` |
+| `setBucketVersioning` | `s3.setBucketVersioningConfiguration(Enabled)` |
+| `deleteBucketVersioning` | `s3.setBucketVersioningConfiguration(Suspended)` |
+| `setBucketEncryption` | `s3.setBucketEncryptionConfiguration(SSE-S3 rule)` |
+| `deleteBucketEncryption` | `s3.deleteBucketEncryptionConfiguration` |
+| `getBucketAcl` / `setBucketAcl` | no-op / null (same as MinIO and Ceph) |
+
+#### User creation — the key difference
+
+MinIO calls `MinioAdminClient.addUser`; Ceph calls `RgwAdmin.createUser`. SeaweedFS
+exposes the standard AWS IAM API, so the plugin calls:
+
+```java
+AmazonIdentityManagement iam = getIamClient(storeId);
+String userName = "acs-" + account.getUuid();
+
+// CreateUser (idempotent — check GetUser first, like Ceph does)
+iam.createUser(new CreateUserRequest(userName));
+
+// CreateAccessKey → returns the access key + secret key to persist
+CreateAccessKeyResult result = iam.createAccessKey(
+    new CreateAccessKeyRequest().withUserName(userName));
+AccessKey key = result.getAccessKey();
+
+// Persist per-account, same pattern as Ceph's CEPH_ACCESS_KEY/CEPH_SECRET_KEY
+details.put(SEAWEEDFS_ACCESS_KEY, key.getAccessKeyId());
+details.put(SEAWEEDFS_SECRET_KEY, key.getSecretAccessKey());
+_accountDetailsDao.persist(accountId, details);
+```
+
+This is the cleanest mapping of the three providers: no proprietary admin client,
+just the AWS IAM SDK that CloudStack already has access to. The IAM endpoint URL
+is provided as `iamUrl` in the store details. If `iamUrl` is omitted, the driver
+defaults it to `s3Url` — SeaweedFS registers its embedded IAM API at `POST /` on
+the same S3 endpoint (`UnifiedPostHandler` in `s3api_server.go`), so the IAM
+endpoint is the same as the S3 endpoint unless the deployment runs a separate
+`weed iam` server.
+
+#### Bucket quota — S3 `?seaweedfs-quota` extension
+
+This is the one genuine gap. MinIO and Ceph both have an admin API to set a
+per-bucket quota that the backend enforces. SeaweedFS enforces bucket quota
+server-side, but the configuration path was **not exposed over a standard S3 or
+IAM API** — it was only set via the admin REST API or shell commands.
+
+The integration adds a **narrow S3 subresource** to SeaweedFS:
+- `PUT /{bucket}?seaweedfs-quota` — set bucket quota (IAM permission `s3:PutBucketQuota`)
+- `GET /{bucket}?seaweedfs-quota` — get bucket quota (IAM permission `s3:GetBucketQuota`)
+
+This is implemented in SeaweedFS PR #11279. It uses SigV4 authentication and
+dedicated IAM permissions, so the CloudStack service credential can be scoped
+to quota management only — no global admin token, no cluster-wide admin access.
+The enforcement already exists (PR #10224); this PR only adds the HTTP
+configuration surface.
+
+An earlier approach (PR #11278, closed) added bearer-token auth to the broad
+admin REST API. After review, that was unnecessary for this integration —
+static S3 config plus standard S3 APIs plus one scoped quota mutation API is
+sufficient and far safer.
+
+> **Note on AWS tools compatibility.** `?seaweedfs-quota` is a SeaweedFS-specific
+> S3 subresource, not part of the AWS S3 API. Standard AWS tools (`aws s3api`,
+> `s3cmd`, `rclone`) cannot call it directly. This is the same limitation MinIO
+> and Ceph have — MinIO quota lives behind a separate admin API (`mc admin
+> bucket quota`), and Ceph quota lives behind the Admin Ops API
+> (`radosgw-admin quota set`). Neither is callable via `aws s3api` either.
+> SeaweedFS's approach is the closest to standard S3 because it uses the same
+> endpoint and same SigV4 credentials, just with a custom query parameter.
+> Interactive quota management remains available via `weed shell`; the S3
+> extension exists for programmatic integration (CloudStack) where the
+> integrator can sign SigV4 requests but cannot run shell commands.
+
+#### Usage reporting
+
+`getAllBucketsUsage` must return a `Map<String, Long>` of bucket name → size.
+MinIO uses `MinioAdminClient.getDataUsageInfo`; Ceph uses
+`RgwAdmin.listBucketInfo`. SeaweedFS has no admin rollup endpoint, so the MVP
+plugin computes it by listing buckets and summing object sizes via S3
+`ListObjectsV2` — expensive for large stores. Better options exist in
+SeaweedFS already:
+- **Prometheus metrics** (`bucket_size_bytes` gauge, refreshed every minute)
+- **SOSAPI `capacity.xml`** (reports capacity, available space, and usage
+  through the S3 endpoint — note: the current "return zero on backend error"
+  behavior should be validated before using it for billing)
+
+For the MVP, `listBuckets` + per-bucket size via the S3 API is correct but slow;
+flag it as a known limitation. Operators should consume Prometheus or SOSAPI
+for production-scale usage reporting.
+
+### Spring wiring
+
+`spring-storage-object-seaweedfs-context.xml` registers the provider bean,
+identical to the MinIO one. `module.properties` sets
+`name=storage-object-seaweedfs`, `parent=storage`.
+
+### `pom.xml`
+
+Depends on `aws-java-sdk-s3` and `aws-java-sdk-iam` — both already in the
+CloudStack dependency tree (Ceph uses the S3 SDK; the IAM SDK is the standard AWS
+bundle). No new third-party dependency, unlike MinIO which pulls in the MinIO
+Java client.
+
+## What changes on the SeaweedFS side
+
+**One narrow S3 extension is required for quota management.** SeaweedFS PR #11279
+adds the `?seaweedfs-quota` S3 subresource:
+
+- `PUT /{bucket}?seaweedfs-quota` — set bucket quota (IAM permission `s3:PutBucketQuota`)
+- `GET /{bucket}?seaweedfs-quota` — get bucket quota (IAM permission `s3:GetBucketQuota`)
+
+This is authenticated via standard S3 SigV4 and authorized via dedicated IAM
+permissions, so no global admin token is needed. The enforcement already exists
+(PR #10224); this PR only adds the HTTP configuration surface.
+
+One follow-up improvement on the SeaweedFS side would close the usage reporting
+gap:
+
+1. **Validate SOSAPI `capacity.xml` usage calculation** — the current "return
+   zero on backend error" behavior should be validated before using it for
+   billing. If reliable, CloudStack can consume it directly instead of
+   list-based aggregation.
+
+## Open questions for proIO / Swen
+
+1. **IAM endpoint path.** ~~Where does `weed iam` listen relative to the S3
+   endpoint in a typical proIO deployment?~~ **Resolved.** SeaweedFS registers
+   its embedded IAM API at `POST /` on the same S3 endpoint
+   (`UnifiedPostHandler`), so the driver defaults `iamUrl` to `s3Url`. A
+   separate `iamUrl` is only needed if the deployment runs a standalone
+   `weed iam` server on a different host/port.
+2. **Quota requirements.** Do proIO's customers need server-enforced per-bucket
+   quotas, or is CloudStack-side accounting sufficient for the first release?
+   The `?seaweedfs-quota` S3 extension (PR #11279) provides server-enforced
+   quotas via a scoped credential; this is the recommended path.
+3. **Object Lock.** `createBucket` takes an `objectLock` boolean. MinIO supports
+   it; Ceph ignores it. SeaweedFS has Object Lock support. Should the plugin pass
+   it through?
+4. **Contribution model.** Does proIO want to submit the PR to
+   `apache/cloudstack` themselves (with SeaweedFS maintainers as reviewers), or
+   the reverse? Apache CloudStack requires an ICLA for non-trivial contributions.
+
+## Files
+
+All in the `apache/cloudstack` repo (new module):
+
+| File | Purpose |
+| --- | --- |
+| `plugins/storage/object/seaweedfs/pom.xml` | Maven module |
+| `.../datastore/util/SeaweedFSObjectStoreUtil.java` | S3 + IAM client builders, constants, URL validators |
+| `.../datastore/provider/SeaweedFSObjectStoreProviderImpl.java` | Spring provider registration |
+| `.../datastore/lifecycle/SeaweedFSObjectStoreLifeCycleImpl.java` | Pool add/health-check |
+| `.../datastore/driver/SeaweedFSObjectStoreDriverImpl.java` | Bucket + user ops via S3 + IAM SDK |
+| `.../resources/META-INF/cloudstack/storage-object-seaweedfs/module.properties` | Module name |
+| `.../resources/META-INF/cloudstack/storage-object-seaweedfs/spring-storage-object-seaweedfs-context.xml` | Spring bean |
+| `plugins/pom.xml` | Register `storage/object/seaweedfs` module |
+
+No files in `seaweedfs/seaweedfs` for the MVP.
+
+### SeaweedFS-side changes (PR #11279)
+
+| File | Purpose |
+| --- | --- |
+| `weed/s3api/s3_constants/s3_action_strings.go` | Add `S3_ACTION_PUT_BUCKET_QUOTA` and `S3_ACTION_GET_BUCKET_QUOTA` |
+| `weed/s3api/s3_constants/s3_actions.go` | Add coarse-grained `ACTION_PUT_BUCKET_QUOTA` and `ACTION_GET_BUCKET_QUOTA` |
+| `weed/s3api/s3_action_resolver.go` | Map `seaweedfs-quota` query param to fine-grained s3: actions |
+| `weed/s3api/s3api_bucket_quota_handlers.go` | New — `PutBucketQuotaHandler` and `GetBucketQuotaHandler` |
+| `weed/s3api/s3api_bucket_quota_handlers_test.go` | New — tests for unit conversion, validation, and error paths |
+| `weed/s3api/s3api_server.go` | Register the two routes in the bucket subrouter |
diff --git a/design-lance-catalog.md b/design-lance-catalog.md
new file mode 100644
index 0000000000..a942ed6ad2
--- /dev/null
+++ b/design-lance-catalog.md
@@ -0,0 +1,696 @@
+# Lance Catalog for SeaweedFS
+
+A second catalog surface next to the Iceberg REST catalog, speaking the Lance Namespace
+REST spec, over the same table buckets and the same filer.
+
+## Why
+
+Gravitino 1.1 added a Lance REST service and 1.3 ships it as a standalone server; Lakekeeper
+added Lance in the same window by a completely different route. That is the useful signal:
+two unrelated catalogs decided independently that Lance had to be first-class, not a niche.
+The client side is already there — `lance-spark` (`LanceNamespaceSparkCatalog`
+with `impl=rest`), `lance-ray`, and the generated Python/Java/Rust clients all talk the same
+OpenAPI. Implementing the spec means those engines work against SeaweedFS with no
+SeaweedFS-specific code on the client.
+
+The second reason is that Gravitino's own documentation names the gap it cannot close:
+DuckDB, pandas and DataFusion "do not support Lance REST natively yet" and have to fetch a
+location from the catalog and then open the dataset directly. Gravitino cannot help there,
+because it does not own the storage. SeaweedFS does. That is the whole design opportunity
+below.
+
+## Prior art: three families
+
+Upstream lists twelve catalog implementations, and they fall into three shapes. Knowing
+which one we are building matters more than any individual API decision.
+
+**1. Storage-native, no service.** The Lance Directory Catalog. V1 is a directory listing
+where every `<name>.lance/` child of a prefix is a table; V2 adds a `__manifest` table —
+itself a Lance table — holding `object_id`/`object_type`/`location` rows, with nested
+namespaces, hash-prefixed table directories, and optional managed versioning. No server, no
+credentials, no governance. This is the floor every other implementation has to beat.
+
+**2. Protocol-native server.** Someone implements the Lance Namespace REST OpenAPI and
+clients connect with `impl=rest`. Gravitino is the only one of the twelve that does this,
+and it is what this design proposes.
+
+**3. Client-side adapters onto an existing catalog.** Nine of the twelve. The Lance client
+translates namespace operations into whatever the backing catalog already speaks: Apache
+Polaris, Unity Catalog, AWS Glue, Hive Metastore v2 and v3, Google BigLake, Dataproc,
+Microsoft OneLake — and Apache Iceberg REST. Two flavors:
+
+- Catalogs with a real non-Iceberg table concept mark the format directly. Polaris uses its
+  Generic Table API with `format = lance`; Unity uses an `EXTERNAL` table with
+  `table_type=lance` in properties and the path in `storage_location`; Glue uses
+  `EXTERNAL_TABLE` plus `table_type=lance` in `Parameters`, path in
+  `StorageDescriptor.Location`.
+- Catalogs with no such concept fake one. The Iceberg REST adapter registers **a regular
+  Iceberg table with a dummy schema — a single nullable string column named `dummy`** —
+  carrying the property `table_type=lance`, and treats the Iceberg table location as the
+  Lance dataset root.
+
+Every adapter in family 3 lands in the same place: `DeclareTable`/`ListTables`/
+`DescribeTable`/`DeregisterTable` only, `DropNamespace` in RESTRICT mode only,
+`load_detailed_metadata=false` only, and `managed_versioning=false`. They are a name-to-
+location map and nothing more.
+
+Lakekeeper is the instructive outlier. It has the same generic-table concept Polaris has,
+but no upstream adapter exists for it — there is no `lance-namespace` reference anywhere in
+its repository and no page for it in the supported-catalogs list. So Polaris's generic tables
+are reachable from a stock Lance client and Lakekeeper's are not, despite being the same
+idea. Shipping the concept is not the same as shipping the integration.
+
+## Gravitino and Lakekeeper: the two opposite bets
+
+Both shipped Lance support in the same window and did not build the same thing.
+
+**Gravitino implements the protocol.** Its `lance/` module serves the Lance Namespace REST
+spec on its own port (`:9101/lance`), so stock `lance-spark` and `lance-ray` connect with
+`impl=rest` and no vendor-specific client. The cost is governance: storage credentials are
+static properties on the catalog (`lance.storage.access_key_id`, `secret_access_key`,
+`endpoint`, `region`, `allow_http`), optionally overridden per table, handed to the engine
+as-is. No STS, no expiry, no per-table scoping.
+
+**Lakekeeper refuses the protocol and governs the object instead.** There is no
+`lance-namespace` anywhere in the repository; Lance arrived in 0.13.0 (2026-06-30, issue
+#1673 `Generic Table API with Lance`) as one `format` string on a Lakekeeper-native Generic
+Table API:
+
+```
+POST/GET/DELETE /lakekeeper/v1/{prefix}/namespaces/{ns}/generic-tables[/{table}]
+GET             /lakekeeper/v1/{prefix}/namespaces/{ns}/generic-tables/{table}/credentials
+POST            /lakekeeper/v1/{prefix}/generic-tables/rename
+```
+
+`format` is opaque, `schema` and `statistics` are stored but never validated, and the
+catalog writes no format-specific metadata — engines go straight to the location. In
+exchange Lance tables get everything Iceberg tables get: STS-vended prefix-scoped
+credentials, OpenFGA per-action permissions (16 actions), soft-delete with undrop, a
+protection flag, rename, pagination, and name uniqueness across Iceberg tables, views and
+generic tables in one namespace. The price is that no stock Lance client can talk to it —
+you need `pylakekeeper`, which exists mainly to translate vended credentials into
+`lance_storage_options`.
+
+So: protocol fidelity and weak governance, or strong governance and client lock-in. Both
+documented their limit honestly, and it is the same limit. Lakekeeper's capability table
+says it outright — "Commit coordination: the catalog does not arbitrate writes — engines
+write directly." Gravitino does not claim it either. Neither of them coordinates a Lance
+commit, which is exactly the thing a store can do and a control plane cannot.
+
+We do not have to choose. Serve the Lance protocol natively the way Gravitino does, over
+the `s3tables` entries that already carry ARNs, policies, tags and maintenance config, and
+the governance comes from the layer underneath rather than from a proprietary API on top.
+That is only available to us because we are the store, which is also what makes the third
+option — arbitrating the commit — available.
+
+## We are probably already a Lance catalog, and that is a problem
+
+The Iceberg REST adapter does not care whose Iceberg catalog it is talking to. It needs
+`/v1/config?warehouse=`, `/v1/{prefix}/namespaces`, `/v1/{prefix}/namespaces/{ns}/tables`
+and unit-separator (`\x1F`) multi-level namespaces. We serve all of those, and
+`parseNamespace` in `weed/s3api/iceberg/utils.go:22` already splits on `\x1F`. So a stock
+Lance client pointed at our Iceberg catalog on :8181 with the Iceberg impl should already
+create, list, describe and deregister Lance tables today, with no SeaweedFS change at all.
+
+That is worth testing before writing a line of the design above, for two reasons. It is a
+free baseline — and possibly a free announcement. And it is a data-loss hazard.
+
+A Lance table registered this way is an Iceberg table whose metadata references no data
+files, sitting on top of a Lance dataset that uses `data/` for its fragments — the same
+subdirectory name Iceberg uses. The maintenance worker's orphan cleaner walks exactly
+`<table>/metadata` and `<table>/data`, and deletes every file not referenced by a snapshot
+and older than `orphan_older_than_hours`
+(`weed/worker/tasks/iceberg/operations.go:331`, default 72). Against an adapter-registered
+Lance table, every fragment is unreferenced by construction. Run maintenance and the
+dataset is deleted.
+
+Maintenance is disabled by default (`handler.go:334`), so this is a latent hazard rather
+than a live one: it needs an operator to enable Iceberg maintenance on a bucket that also
+holds adapter-registered Lance tables. But it costs nothing to close — detection should
+skip any table carrying a non-Iceberg format marker (`table_type` property, or
+`Format != "ICEBERG"` once the format field is honest), and that guard is worth landing on
+its own regardless of whether the rest of this design ever gets built. It is the same
+"catalog-only, no maintenance" marker the generic-format question needs.
+
+## Where we differ from Gravitino
+
+Gravitino is a metadata service in front of somebody else's object store:
+
+```
+  Spark / Ray                  Spark / Ray / pandas / duckdb
+      |                              |
+  Lance REST                    Lance REST          (direct S3)
+      |                              |                   |
+  Gravitino                     SeaweedFS S3 gateway ----+
+      |                              |
+   S3 keys handed out           SeaweedFS filer + volumes
+      |
+  somebody else's S3
+```
+
+It resolves a name to a location plus `lance.storage.*` credentials, and steps out of the
+way. Everything a Lance table actually is — `_versions/`, `data/`, `_indices/` — is opaque
+to it.
+
+We are the store. Three things follow that Gravitino cannot do:
+
+1. The catalog and a plain directory listing can be made to agree, so a client with no
+   catalog at all still sees the right tables.
+2. `_versions/` is a filer directory listing, not an object-store `LIST`. Version history
+   is cheap and can back the admin UI.
+3. We can offer a genuinely atomic commit reservation. Lance's commit protocol needs
+   put-if-not-exists; our S3 layer does not currently provide one (see
+   [Commit safety](#commit-safety)). The filer does.
+
+## Placement
+
+The Iceberg catalog is a thin HTTP shell over `s3tables.Manager`; the storage work lives in
+`weed/s3api/s3tables`. Table buckets live under `TablesPath = s3_constants.DefaultBucketsPath`,
+i.e. the same filer tree the S3 gateway serves, so `s3://bucket/ns/table/` is simultaneously
+a catalog entry and an S3 prefix. Catalog entries are filer directories carrying `s3tables.*`
+extended attributes. `Table.Format` already exists and is hard-checked against `"ICEBERG"`
+in `weed/s3api/s3tables/handler_table.go:48`.
+
+So:
+
+```
+weed/s3api/lance/          new: HTTP surface, id codec, error model
+weed/s3api/s3tables/       extended: Format "LANCE", lance state xattr, version entries
+weed/command/s3.go         new: -port.lance (default 9101), startLanceServer
+```
+
+`Format: "LANCE"` on the table entry is the whole storage-model change for phase 1.
+Everything else — namespaces, ARNs, policies, tags, ownership — is shared verbatim.
+
+```
+                        s3tables.Manager (filer)
+                                 |
+        +------------------------+------------------------+
+        |                                                 |
+  weed/s3api/iceberg                              weed/s3api/lance
+   Iceberg REST :8181                              Lance REST :9101
+        |                                                 |
+  Iceberg tables                                   Lance datasets
+        \                                                 /
+         +-------------------- s3 :8333 -----------------+
+                                 |
+                         SeaweedFS volumes
+```
+
+## Identifier mapping
+
+Lance identifiers are `["ns", ..., "table"]`, encoded in the URL as a single string joined
+by a delimiter that defaults to `$`. The delimiter alone means the root namespace, so
+`/v1/namespace/$/list` lists the root's children.
+
+Iceberg had to invent a warehouse selector because its identifier is flat and every table
+bucket is a separate catalog. Lance does not need that — its identifier is already
+hierarchical, and Gravitino uses exactly three levels (`["lance_catalog", "sales", "orders"]`).
+That maps onto us without inventing anything:
+
+```
+  $                            root      -> list of table buckets
+  $analytics                   level 1   -> a table bucket
+  $analytics$sales             level 2   -> a namespace in that bucket
+  $analytics$sales$orders      table
+```
+
+`spark.sql.catalog.lance.parent = analytics` then makes `sales.orders` resolve, which is the
+same shape Gravitino's Spark example uses.
+
+Levels 2..N join into one `s3tables` namespace with `.`, matching what the Iceberg catalog
+already does with `flattenNamespacePath`. The flattened form is only the directory name —
+`namespaceMetadata.Namespace []string` in the xattr keeps the authoritative parts, so the
+mapping stays invertible even though `.` is a legal character inside a namespace part.
+Reject `$` in any name part with `InvalidInput`; our charsets already exclude it, so no
+escaping scheme is needed.
+
+Root-level `ListNamespaces` returning table buckets means an unauthenticated or
+broadly-scoped caller can enumerate buckets. Filter it through the same
+`s3tables/permissions.go` check `ListTableBuckets` uses, not a separate path.
+
+`CreateNamespace` on a one-part identifier creates a table bucket, and it does so only if
+the caller is permitted to — the namespace never creates a bucket as a side effect of
+creating something inside it. A table bucket is a tenant resource with its own policy, ARN
+and lifecycle, and conjuring one because a client said `CREATE SCHEMA` is a privilege
+escalation dressed as a convenience. Lakekeeper draws the same line explicitly: its client
+creates tables, not warehouses.
+
+## Storage layout
+
+Lay tables out as:
+
+```
+s3://<table-bucket>/<flattened-namespace>/<table>/
+    data/
+    _versions/
+    _indices/
+```
+
+**Built without the `.lance` suffix this design originally proposed.** The suffix would have
+made every namespace prefix a valid Lance Directory Catalog V1 root, since V1 recognises a
+table by exactly that naming. It does not survive contact with the storage layer: the
+catalog entry *is* the dataset directory, `validateTableName` excludes `.` from the charset,
+and a suffixed entry name would leak into ARNs, policy documents and the S3 Tables API,
+where the same table would answer to two different names. Making `GetTablePath` format-aware
+instead spreads an "unless it is Lance" branch through code that has no business knowing —
+the exact cross-cutting cost this design rejects family 3 for.
+
+So one name, one directory. What survives is direct access by URI, which is the larger half
+of the story and needs no naming convention at all:
+
+```python
+# with the catalog
+spark.sql("SELECT * FROM lance.sales.orders")
+
+# without it, same bytes
+lance.dataset("s3://analytics/sales/orders")
+```
+
+DuckDB, pandas and DataFusion still reach the data with no catalog running, which is the gap
+Gravitino's documentation admits to. What they no longer get for free is *enumeration* — a
+directory-catalog client pointed at the namespace prefix will not list these as tables. If
+that turns out to matter, the cheapest fix is a repair-style tool that materialises `.lance`
+aliases, not a rename of the catalog entry.
+
+Note also that the directory catalog's own V2 mode puts child-namespace tables in
+`<hash>_<ns$table>` directories at the root and creates no physical subdirectories for
+namespaces, so full directory-catalog fidelity was never on offer anyway. We are a
+server-backed catalog; the human-readable prefix layout is worth more than partial V1
+lookalike behaviour.
+
+## The table bucket was not a neutral container
+
+This design assumed a table bucket is a place to put a table's files. It is
+not: `validateTableBucketObjectPath` runs on every S3 write into one and
+validated the path against Iceberg's layout, so a Lance client got 403 on
+`data/*.lance`, on `_versions/`, and on `_transactions/` — a directory Lance
+writes that neither the spec documentation nor this design anticipated. Nothing
+about the catalog worked end to end until that changed.
+
+The layout guard now admits the union of what the supported formats write, and
+treats any underscore-prefixed top-level directory as belonging to the format,
+checking only that the path stays inside the table. Enumerating Lance's
+internal directories by name is exactly the mistake that missed
+`_transactions`. Iceberg writes none of them, so it loses nothing.
+
+Found by pointing the real Python client at a running gateway, not by reading
+the spec. Worth remembering for the next format: the premise to check first is
+whether the storage layer will accept its files at all.
+
+## Table lifecycle
+
+Lance has three table states, and the spec pins them to marker files:
+
+| State | Marker | Created by | Visible in ListTables |
+| --- | --- | --- | --- |
+| declared | `.lance-reserved` | `DeclareTable` | yes, when `include_declared=true` |
+| created | `_versions/` present | client writes, or `CreateTable` | yes |
+| deregistered | `.lance-deregistered` | `DeregisterTable` | no; data preserved |
+
+Record the state in an xattr (`s3tables.lanceState`) on the catalog entry *and* write the
+marker file into the table directory. The xattr is what the catalog reads; the marker is
+what keeps a directory-catalog client honest. Dual-write is the price of the interop claim
+above, and it is one extra filer write on three rarely-called operations.
+
+`DeclareTable` is the operation `lance-spark` actually calls on `CREATE TABLE` (it replaced
+the legacy `create-empty`), so it is not optional in practice even though the spec marks
+only a subset as required.
+
+`DeregisterTable` preserving data is the same shape as our Iceberg rename, where the catalog
+entry moves and the data stays put — reuse `TableDataDirFromMetadataLocation`'s idea rather
+than re-deriving the data path from the catalog name.
+
+## Commit safety
+
+This is the part I got wrong, and the correction removed a feature rather than adding one.
+
+Lance commits a version by writing `_versions/{v}.manifest` with put-if-not-exists: exactly
+one writer is supposed to win, and the loser rebases. In lance 10 that path is not optional
+and needs nothing bolted on — `commit_handler_from_url` hands every `s3://` dataset a
+`ConditionalPutCommitHandler`, which calls `put_opts` with `PutMode::Create`, which
+object_store's S3 backend sends as `If-None-Match: *`.
+
+I originally read our gateway as evaluating that header check-then-act, and designed around
+it. That was already out of date. `buildWriteCondition`
+(`weed/s3api/s3api_object_routed_write.go`) reduces `If-None-Match: *` to a filer
+`WriteCondition{IF_NOT_EXISTS}`, and `putToFiler` routes the create to the object's owner
+filer, which evaluates the precondition under its per-path lock; when routing is not
+available it falls back to the object write lock, which evaluates it under the lock too.
+Either way it is atomic. Sixteen concurrent writers of the same fresh key get one 200 and
+fifteen 412s, repeatedly.
+
+So the store already has the primitive Lance needs, cluster-wide, for every conditional-PUT
+client and not just this one.
+
+### What that removed
+
+An earlier draft of this design offered the catalog as an **external manifest store**:
+`managed_versioning: true` plus `CreateTableVersion` and friends, with the reserve step as a
+filer `CreateEntry` with `o_excl`. It was implemented, tested, and shipped behind a default-off
+flag — and it should not exist.
+
+- It solves a problem this store does not have. The spec offers that path for stores that
+  cannot order commits themselves.
+- It moves a table's version history out of the dataset and into the catalog, so a reader
+  that does not go through this namespace no longer sees the whole picture. That is a real
+  cost paid for nothing.
+- lance 10 cannot even use it past the first commit: `NamespaceManifestStore::put_if_not_exists`
+  answers "put_if_not_exists is not supported for namespace-backed stores", which is exactly
+  what a second `append` needs.
+
+The version operations now answer `Unsupported` alongside the other operations the catalog
+does not serve, and `managed_versioning` is answered `false`. The property they were
+protecting is covered instead by a test that races eight writers at the manifest key through
+S3 and asserts one wins — testing the path Lance actually takes.
+
+## Credential vending
+
+Iceberg needed a header (`X-Iceberg-Access-Delegation: vended-credentials`) and a bespoke
+response shape. Lance has it in the spec: `vend_credentials: true` on the request,
+`storage_options` on the response, with `expires_at_millis` as the well-known expiry key.
+
+Reuse the existing vendor interface unchanged — `iceberg.CredentialVendor` /
+`STSService.AssumeRoleForPrincipal` scoped to the table prefix (#10777) — and map its output
+to the storage options Lance passes through to `object_store`:
+
+```
+aws_access_key_id, aws_secret_access_key, aws_session_token,
+aws_region, aws_endpoint, allow_http, expires_at_millis
+```
+
+Those are the names `pylakekeeper` emits as `lance_storage_options`, which is the shape
+Lakekeeper's tested S3 path actually feeds to Lance. `object_store` also accepts the
+un-prefixed aliases (`endpoint`, `region`) that the directory catalog's `storage.` prefix
+strips down to and that Gravitino's `lance.storage.endpoint` resolves to, but the `aws_`
+forms are the ones with a tested integration behind them, so emit those. `aws_endpoint`
+should come from `deriveS3AdvertisedEndpoint()`, the same source the Iceberg `FileIO` config
+uses, and `allow_http` must be set when that endpoint is plain HTTP or every read fails with
+a TLS error that looks like a credential problem — Lakekeeper vends both automatically for
+exactly this reason, and calls out that there is then no per-vendor branch in client code.
+
+We emit this server-side, in the `storage_options` field the Lance spec already defines,
+which is strictly better than Lakekeeper's arrangement: no client library has to translate
+anything, so vending works from any stock Lance client rather than only from theirs.
+
+Guard the same way #10777 had to after review: bucket-scoped list grants need an `s3:prefix`
+condition, and a location containing `*` or `?` must be refused rather than widened into a
+resource pattern.
+
+## Auth and authorization
+
+Authentication reuses `S3Authenticator` and `CredentialValidator` as-is. The Lance spec maps
+identity to headers — `api_key` to `x-api-key`, `auth_token` to `Authorization: Bearer` — and
+SigV4 keeps working because it is the same authenticator the Iceberg catalog already fronts.
+
+Authorization needs nothing new. A Lance table gets the same ARN shape,
+`arn:aws:s3tables:...:bucket/B/table/NS/T`, so every existing table-bucket policy covers
+Lance tables with no new policy language and no second permission model. Route it through
+`s3tables/permissions.go` and inherit the `DefaultAllow` semantics the Iceberg server already
+mirrors from the S3 port.
+
+One spec quirk worth honoring: request context entries prefixed `header.` become request
+headers, and every response header comes back as a `header.`-prefixed context entry. Echoing
+`x-request-id` through it costs nothing and makes tracing work.
+
+## What to take from Lakekeeper
+
+Rejecting Lakekeeper's API shape does not mean rejecting what it learned building it.
+
+**Deregister is soft-delete, so implement it as one.** Lakekeeper gives generic tables
+soft-deletion with undrop and a `protected` flag that makes a drop require `force=true`.
+Lance already has the concept — `DeregisterTable` preserves the data and hides the table —
+so the `.lance-deregistered` marker is a soft-delete by another name, and a re-register is
+an undrop. A protection flag on table-bucket entries is worth having regardless of Lance:
+it is a few lines against the existing xattrs and it applies to Iceberg tables too.
+
+**Enforce one identifier space across entry kinds.** Lakekeeper rejects a generic table
+whose name collides with an Iceberg table or view in the same namespace. Our catalog entries
+already share one filer directory and already carry `s3tables.entryType`, so this is
+structurally true — but it has to be enforced deliberately on every path, or a Lance handler
+happily loads an Iceberg table's directory and vice versa. That is the same crossover bug
+class as the view/table rename authorization fixed in #10776; the `catalogEntryKind` pattern
+from that change is the thing to reuse rather than re-derive.
+
+**A re-vend path matters more than it looks.** Lakekeeper exposes `/credentials` separately
+from load, because STS credentials expire in the middle of long jobs and re-loading the
+whole table to refresh them is wasteful. In Lance the spec's answer is another
+`DescribeTable` with `vend_credentials: true`, which is fine — but it means `DescribeTable`
+must stay cheap when `load_detailed_metadata` is false, which is another reason not to open
+the dataset on that path.
+
+**Generic tables are a cheap orthogonal win.** Lakekeeper's real insight is that Delta,
+Parquet, CSV, Vortex and Paimon all get governance for free once the catalog stops caring
+what the format is. Our `Table.Format` field already exists and the only thing stopping it
+is the hard `"ICEBERG"` check in `handler_table.go:48`. Loosening that and letting the S3
+Tables API register a table with an arbitrary format and a location — no metadata, no
+commits — is a small change that makes every format cataloguable. It is independent of this
+design and probably worth doing first, since `Format: "LANCE"` is then just a value rather
+than a special case.
+
+**Skip remote signing.** It is Lakekeeper's fallback for S3-compatible stores with no STS,
+and their own documentation notes that Lance will not use it — format libraries with their
+own S3 client expect static credentials and do not implement the Iceberg signer protocol. We
+have STS, so vended credentials are the path, and the signer is not worth building for a
+client that cannot consume it.
+
+## Errors
+
+Lance uses `{code, error, detail, instance}` with numeric codes, not Iceberg's exception-type
+strings. The mapping is mechanical:
+
+| HTTP | code | when |
+| --- | --- | --- |
+| 400 | 13 InvalidInput | charset violations, malformed id, route/body mismatch |
+| 401 | 16 Unauthenticated | |
+| 403 | 15 PermissionDenied | |
+| 404 | 1 NamespaceNotFound, 4 TableNotFound, 11 TableVersionNotFound | |
+| 409 | 2/5 AlreadyExists, 3 NamespaceNotEmpty, 14 ConcurrentModification | |
+| 501 | 0 Unsupported | every phase-3 data operation |
+
+Route/body mismatch is a spec requirement, not a nicety: when the identifier appears in both
+the path and the body and they disagree, the server must return 400. Cheap to get right at
+the decode step, annoying to retrofit.
+
+## Route surface
+
+Phase 0 is not in this table: point a stock Lance client at the existing Iceberg catalog
+with the Iceberg impl, see how far it gets, and land the maintenance guard either way. That
+tells us what the native server actually has to beat.
+
+Phase 1, the whole `lance-spark` and `lance-ray` contract:
+
+```
+POST /v1/namespace/{id}/create         CreateNamespace       mode: Create|ExistOk|Overwrite
+GET  /v1/namespace/{id}/list           ListNamespaces
+POST /v1/namespace/{id}/describe       DescribeNamespace
+POST /v1/namespace/{id}/drop           DropNamespace         mode: Fail|Skip, behavior: Restrict|Cascade
+POST /v1/namespace/{id}/exists         NamespaceExists
+GET  /v1/namespace/{id}/table/list     ListTables            ?include_declared, ?page_token, ?limit
+GET  /v1/table                         ListAllTables
+POST /v1/table/{id}/declare            DeclareTable
+POST /v1/table/{id}/describe           DescribeTable         ?with_table_uri, ?load_detailed_metadata, ?check_declared
+POST /v1/table/{id}/exists             TableExists
+POST /v1/table/{id}/register           RegisterTable         mode: Create|Overwrite
+POST /v1/table/{id}/deregister         DeregisterTable
+POST /v1/table/{id}/drop               DropTable
+POST /v1/table/{id}/rename             RenameTable
+```
+
+`DescribeTable` with `load_detailed_metadata=false` needs only `location`, which is the
+common case and which we can answer from xattrs alone. With `load_detailed_metadata=true`
+the spec wants `version`, `schema` and `stats`, which means reading the Lance manifest. For
+phase 1, return the fields we can derive from the filer — `version` from the highest entry in
+`_versions/`, given V2 naming is `{u64::MAX - version:020}.manifest` and V1 is
+`{version}.manifest` — and omit `schema`/`stats` rather than fabricating them. The spec
+tolerates a partial response here; it does not tolerate a wrong one.
+
+Phase 2 was the five version operations plus `managed_versioning`; it was built and then
+removed, for the reasons under Commit safety.
+
+Phase 3 is the data plane: `CreateTable`, `InsertIntoTable`, `MergeInsertIntoTable`,
+`UpdateTable`, `DeleteFromTable`, `QueryTable`, `CountTableRows`, and the index and tag
+operations. These exchange Arrow IPC, and more to the point they require reading and writing
+the Lance file format, for which no Go implementation exists. Return `Unsupported` (code 0)
+and say so in the docs. `arrow-go/v18` is already an indirect dependency, so Arrow framing is
+not the blocker — Lance is.
+
+## Does a Lance table need maintenance?
+
+Yes, and one part of it has no Iceberg equivalent. The client exposes three jobs:
+
+- `optimize.compact_files()` — Lance writes a fragment per write batch, so a table fed by
+  small appends accumulates small files exactly the way an Iceberg table does.
+- `optimize.optimize_indices()` — **rows written after an index was built are not covered by
+  it.** A vector search against a stale index silently misses recent data. That is a
+  correctness-shaped failure, not a slow query, and it is specific to what people use Lance
+  for.
+- `cleanup_old_versions()` — every version is retained until something removes it. Lance can
+  do this itself: `optimize.enable_auto_cleanup()` sets it on the dataset, so this one need
+  not be an external job at all.
+
+None of it can run in the Go worker. All three read and rewrite Lance files, which needs
+Lance format code that does not exist in Go, and there is no useful subset either: deciding
+which fragments an old version still references means parsing Lance manifests.
+
+So the maintenance worker must not touch a Lance table, and it declines by reading the format
+the catalog recorded rather than by failing to parse Iceberg metadata.
+
+## The worker can be Rust, and it is not a sidecar
+
+The Go worker is not the only worker. `weed/pb/plugin.proto` defines `PluginControlService`,
+a language-agnostic gRPC stream that external maintenance workers connect on: the worker
+opens `WorkerStream`, sends `WorkerHello` with the job types it can `detect` and `execute`,
+answers `RequestConfigSchema` with a `JobTypeDescriptor`, replies to `RunDetectionRequest`
+with `JobProposal`s and to `ExecuteJobRequest` with `JobProgressUpdate`s and `JobCompleted`.
+`weed worker -admin=host:12535` is the Go reference implementation of exactly that contract,
+from outside the admin process.
+
+Nothing in it is Go-specific, and the Rust toolchain is already in the tree.
+`seaweed-volume/build.rs` compiles protos straight out of `../weed/pb/` with `tonic_build`,
+including `filer.proto`, on tonic 0.12 and prost 0.13. A Lance worker is that same build
+with `plugin.proto` added and the `lance` crate as a dependency — the real one, no FFI and
+no Python.
+
+Three job types, one per real maintenance operation:
+
+| Job type | Calls | Detected from |
+| --- | --- | --- |
+| `lance_compact` | `optimize.compact_files` | fragment count and sizes |
+| `lance_optimize_indices` | `optimize.optimize_indices` | rows an index does not cover |
+| `lance_cleanup_versions` | `cleanup_old_versions` | version count and age |
+
+What the existing machinery then supplies for free is the part worth noticing. Scheduling,
+retries, dedupe by `dedupe_key`, progress reporting, per-job concurrency limits and the
+admin settings page all come from the protocol: a worker that answers `RequestConfigSchema`
+with a descriptor gets its configuration form rendered in the admin UI without a line of Go
+or templ. A Rust worker is a first-class maintenance worker, not an appendage.
+
+The remaining wiring is small and mostly decided already. `RunDetectionRequest` carries a
+`ClusterContext` with filer and S3 addresses plus a free-form `metadata` map, which is where
+the Lance namespace URL goes; the worker lists Lance tables from the namespace, which is the
+catalog of record and already filters by format. It gets at the data by asking
+`DescribeTable` for `storage_options` with `vend_credentials`, so the worker is just another
+client of the STS path rather than a component with its own credentials. And when it commits
+a compaction it goes through `CreateTableVersion` like any other writer, which is what
+managed versioning was for.
+
+## The worker is also the only thing that can describe the table
+
+Admin can render an Iceberg table because it can read Iceberg metadata. It cannot read
+Lance: it knows the dataset's location and its format string, and that is the whole of it.
+The details page showed a location and two empty panels, which is an honest answer and a
+useless one.
+
+The worker already knows. Detection opens every dataset to decide whether it needs
+compacting, so at that moment it holds the schema, the row count, the fragment count and
+the version count. It just had no way to say so — every message on the stream was about
+work.
+
+So `WorkerObservations` is a body on `WorkerToAdminMessage`: a repeated `ObjectObservation`
+of `object_id`, `object_kind`, `format`, and a `ConfigValue` map the worker fills with
+whatever it can cheaply say. Admin keeps the last observation per object and serves it back
+with the time it was taken and the worker that took it. Nothing schedules from it, and it is
+not authoritative — it is a cache with its staleness on the label, which is why the page
+badges it rather than presenting it as metadata it read itself.
+
+The keys are the worker's to choose, which keeps the protocol out of the business of knowing
+what a Lance table is. A worker for any other format admin cannot parse describes itself the
+same way.
+
+## A bucket declares its format
+
+Format was recorded per table, which is enough for the storage layer and not enough for
+anything that has to answer a question about a bucket. The admin UI printed one Iceberg
+endpoint for every bucket, including the ones holding Lance datasets, where that endpoint
+serves nothing; an empty bucket had no format at all.
+
+So `CreateTableBucket` takes an optional `format`, stored with the rest of the bucket
+metadata. Empty means `ICEBERG` - what AWS S3 Tables serves, and therefore what an SDK
+that has never heard of the field means. `CreateTable` refuses another format, and
+`CreateView` refuses outright outside an Iceberg bucket, a view being Iceberg metadata.
+The Lance namespace declares `LANCE` for the buckets it creates.
+
+**Enforced rather than defaulted**, because the point of showing a format at all is the
+endpoint that follows from it, and that endpoint is only truthful if the bucket holds one
+format. **Buckets that already exist stay undeclared** and keep taking anything: nothing is
+migrated, and the UI shows "unset" as a fact about the bucket's age rather than a fault.
+That state is also the only way to hold both formats at once, which is what the
+Iceberg-REST adapter path produces.
+
+## Sample rows are fetched, not cached
+
+The same asymmetry has a second half. Admin renders an Iceberg table's rows by
+reading its Parquet files directly; for Lance it has nothing to read with, so the data
+page offered a Browse Data button that led to an empty grid.
+
+`RequestObjectPreview` / `ObjectPreviewResponse` mirror the config-schema round trip
+already on the stream: admin asks, the worker scans the dataset and hands back rows it
+has already rendered as text, because it is the only side that knows the types. Admin
+picks the worker from the observation store, so the one that last described a table is
+the one asked to read it.
+
+The rows are deliberately not cached, and that is the line between the two channels. An
+observation describes an object, so a copy with a timestamp on it is useful. Rows are the
+object's contents: a copy held in admin would be stale, larger, and nobody's business.
+The page fetches on load, bounded, or says why it cannot.
+
+## The sidecar question
+
+The data plane is a different problem, and this design previously conflated the two.
+Maintenance rides the worker protocol; `QueryTable` and `InsertIntoTable` do not, because
+they are synchronous REST operations on the namespace's own surface. Serving those means a
+Rust process that answers HTTP, either behind the Go namespace as a proxy target or in front
+of it. It would make SeaweedFS a store you can run vector search *in* rather than one you
+read vectors *out of*, which is the larger prize and the reason to keep the option open.
+
+Neither should gate phase 1. Phases 1 and 2 are pure Go over the filer and are worth
+shipping on their own — they are what makes Spark and Ray work.
+
+## Testing
+
+Mirror the Iceberg package: `httptest` plus a fake filer client for the handler tests, in
+`weed/s3api/lance`. Then an integration suite under `test/s3tables/catalog/` next to the
+existing `pyiceberg_test.go`, driving the generated Python `lance-namespace` client against
+a live gateway. Three things that suite must cover and unit tests cannot:
+
+- the storage-options key names actually work, i.e. a client that gets `storage_options` from
+  `DescribeTable` can open the dataset;
+- a table created through the catalog is visible to `lance.dataset()` by URI and to a V1
+  directory-catalog client rooted at the namespace prefix;
+- concurrent writers do not lose a commit, which is the phase-2 acceptance test and the
+  thing that justifies the external manifest store.
+
+Phase 1 is validated: `lance_namespace` 0.11.1 with `impl=rest` drives the namespace,
+`lance.write_dataset` writes to the vended location with the vended `storage_options`, and
+the rows read back. Note that this client version drops `check_declared` and
+`include_declared` on the wire, so `is_only_declared` reads null through it however the
+server behaves.
+
+The commit path is validated at both levels. The mechanism: eight writers race the same
+manifest key through S3 with `If-None-Match: *`, and exactly one wins. The property that
+actually matters, which single-winner exclusivity does not by itself establish: eight
+writers append to one dataset concurrently through lance, and afterwards every batch is
+still there — the losers saw the conflict, rebased, and committed again. That second test
+is also the sequence managed versioning could not complete at all, since its store answers
+"put_if_not_exists is not supported" to the second commit.
+
+One more that belongs in the Iceberg suite, not this one: a Lance dataset registered through
+the Iceberg adapter must survive a full maintenance pass. Reading the code, that test should
+fail today; it has not been run.
+
+## Open questions
+
+- Root-level `ListNamespaces` enumerating table buckets is convenient and is a listing
+  surface we do not have on the Iceberg side. Decide whether it is gated behind a flag.
+- Whether the `.lance` directory suffix is worth the divergence from the Iceberg layout. I
+  think yes — it is what makes the catalog optional — but it means the two catalogs' tables
+  do not look alike on disk, and the admin UI has to know that.
+- Names: our charsets are lowercase-only and Lance identifiers are arbitrary strings. Reject
+  and document, as Iceberg does, or case-fold. Rejecting is right, but see #10734 for how
+  case handling bites when only one side normalizes.
+- Whether to land generic-format registration first. Dropping the `"ICEBERG"` check and
+  letting a table carry an arbitrary format plus a location is smaller than this whole
+  design, gets Delta and Parquet catalogued as a side effect, and turns `Format: "LANCE"`
+  into an ordinary value. The argument against is that it invites tables the maintenance
+  worker cannot service, so it needs a "catalog-only, no maintenance" marker to be honest.
diff --git a/docker/Dockerfile.e2e b/docker/Dockerfile.e2e
index 99b2b91637..4ffad1c15e 100644
--- a/docker/Dockerfile.e2e
+++ b/docker/Dockerfile.e2e
@@ -2,25 +2,21 @@ FROM ubuntu:22.04
 
 LABEL author="Chris Lu"
 
-# Use Azure's Ubuntu mirror — much faster than archive.ubuntu.com from GitHub-hosted runners,
-# which have been hanging long enough on Ign:/retry to trip the 10-min step timeout.
 # Note: This e2e test image intentionally runs as root for simplicity and compatibility.
 # Production images (Dockerfile.go_build) use proper user isolation with su-exec.
 # For testing purposes, running as root avoids permission complexities and dependency
 # on Alpine-specific tools like su-exec (not available in Ubuntu repos).
-RUN sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g; s|http://security.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' /etc/apt/sources.list && \
-    apt-get -o Acquire::http::Timeout=15 update && \
-    DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::http::Timeout=15 install -y \
-    --no-install-recommends \
-    --no-install-suggests \
-    curl \
-    fio \
-    fuse \
-    ca-certificates \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/* \
-    && rm -rf /tmp/* \
-    && rm -rf /var/tmp/*
+
+# apt-install prefers Azure's mirror, which archive.ubuntu.com is slow enough from
+# GitHub-hosted runners to justify, and falls through to archive.ubuntu.com when
+# Azure is unreachable - which it periodically is, and Acquire::Retries against a
+# single mirror just retries a dead host. Images built FROM this one install
+# through it for the same reason.
+COPY apt-install /usr/local/bin/apt-install
+RUN chmod +x /usr/local/bin/apt-install && \
+    apt-install curl fio fuse ca-certificates && \
+    rm -rf /tmp/* /var/tmp/*
+
 RUN mkdir -p /etc/seaweedfs /data/filerldb2
 
 COPY ./weed /usr/bin/
diff --git a/docker/Dockerfile.foundationdb_large b/docker/Dockerfile.foundationdb_large
index aec40acdc2..9ec3e137fc 100644
--- a/docker/Dockerfile.foundationdb_large
+++ b/docker/Dockerfile.foundationdb_large
@@ -1,4 +1,4 @@
-FROM golang:1.25 AS builder
+FROM golang:1.26 AS builder
 
 RUN apt-get update && \
     apt-get install -y build-essential wget ca-certificates && \
diff --git a/docker/Dockerfile.go_build b/docker/Dockerfile.go_build
index 2857482983..a2eb20568d 100644
--- a/docker/Dockerfile.go_build
+++ b/docker/Dockerfile.go_build
@@ -1,6 +1,6 @@
 # Pin the builder to the host arch and cross-compile the (CGO-free) Go binary,
 # so arm64/arm/386 targets skip QEMU emulation of the whole compile.
-FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder
 RUN apk add git g++ fuse
 RUN mkdir -p /go/src/github.com/seaweedfs/
 ARG BRANCH=${BRANCH:-master}
@@ -14,6 +14,9 @@ RUN cd /go/src/github.com/seaweedfs/seaweedfs && \
       git checkout $BRANCH) || \
      (echo "ERROR: Branch/commit $BRANCH not found in repository" && \
       echo "Available branches:" && git branch -a && exit 1))
+# seaweed-common only exists on revisions that have it; a BRANCH predating it
+# still needs the directory so the COPY into rust_builder below never fails.
+RUN mkdir -p /go/src/github.com/seaweedfs/seaweedfs/seaweed-common
 ARG TARGETOS TARGETARCH TARGETVARIANT
 RUN cd /go/src/github.com/seaweedfs/seaweedfs/weed \
   && export LDFLAGS="-X github.com/seaweedfs/seaweedfs/weed/util/version.COMMIT=$(git rev-parse --short HEAD)" \
@@ -29,7 +32,11 @@ FROM alpine:3.23 as rust_builder
 ARG TARGETARCH
 ARG TAGS
 COPY weed-volume-prebuilt/ /prebuilt/
+COPY weed-worker-prebuilt/ /prebuilt-worker/
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-volume /build/seaweed-volume
+# seaweed-common is a path dependency of seaweed-volume that lives beside it,
+# so the source build below needs it in the same relative position.
+COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/seaweed-common /build/seaweed-common
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/weed /build/weed
 WORKDIR /build/seaweed-volume
 RUN if [ -f "/prebuilt/weed-volume-${TARGETARCH}" ]; then \
@@ -47,16 +54,30 @@ RUN if [ -f "/prebuilt/weed-volume-${TARGETARCH}" ]; then \
       echo "Skipping Rust build for $TARGETARCH (unsupported)" && \
       touch /weed-volume; \
     fi
+# The Rust maintenance worker is taken pre-built or not at all: the lance jobs
+# it carries pull in arrow and datafusion, a far larger dependency tree than
+# the image build can carry, so an architecture CI did not build for gets the
+# same empty placeholder the entrypoint refuses to exec.
+RUN if [ -f "/prebuilt-worker/weed-worker-${TARGETARCH}" ]; then \
+      echo "Using pre-built Rust worker for ${TARGETARCH}" && \
+      cp "/prebuilt-worker/weed-worker-${TARGETARCH}" /weed-worker; \
+    else \
+      echo "No pre-built Rust worker for ${TARGETARCH}" && \
+      touch /weed-worker; \
+    fi
+
 # Pre-built binaries arrive via GitHub Actions artifacts, which drop the
 # executable bit, so the copied file is 0644 and exec fails with "Permission
-# denied". Restore it (no-op for the empty placeholder, which stays size 0).
-RUN chmod 0755 /weed-volume
+# denied". Restore it (no-op for the empty placeholders, which stay size 0).
+RUN chmod 0755 /weed-volume /weed-worker
 
 FROM alpine AS final
 LABEL author="Chris Lu"
 COPY --from=builder /go/bin/weed /usr/bin/
 # Copy Rust volume server binary (real binary on amd64/arm64, empty placeholder on other platforms)
 COPY --from=rust_builder /weed-volume /usr/bin/weed-volume
+# Same for the Rust maintenance worker, which serves Lance table buckets
+COPY --from=rust_builder /weed-worker /usr/bin/weed-worker
 RUN mkdir -p /etc/seaweedfs
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/filer.toml /etc/seaweedfs/filer.toml
 COPY --from=builder /go/src/github.com/seaweedfs/seaweedfs/docker/entrypoint.sh /entrypoint.sh
diff --git a/docker/Dockerfile.rocksdb_dev_env b/docker/Dockerfile.rocksdb_dev_env
index 20123db640..2b6b0431b1 100644
--- a/docker/Dockerfile.rocksdb_dev_env
+++ b/docker/Dockerfile.rocksdb_dev_env
@@ -1,9 +1,9 @@
-FROM golang:1.25 AS builder
+FROM golang:1.26 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev
 
-ARG ROCKSDB_VERSION=v10.10.1
+ARG ROCKSDB_VERSION=v11.1.2
 ENV ROCKSDB_VERSION=${ROCKSDB_VERSION}
 
 # build RocksDB
diff --git a/docker/Dockerfile.rocksdb_large b/docker/Dockerfile.rocksdb_large
index 0274d29405..757af7e64d 100644
--- a/docker/Dockerfile.rocksdb_large
+++ b/docker/Dockerfile.rocksdb_large
@@ -1,9 +1,9 @@
-FROM golang:1.25 AS builder
+FROM golang:1.26 AS builder
 
 RUN apt-get update
 RUN apt-get install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev
 
-ARG ROCKSDB_VERSION=v10.10.1
+ARG ROCKSDB_VERSION=v11.1.2
 ENV ROCKSDB_VERSION=${ROCKSDB_VERSION}
 
 # build RocksDB
diff --git a/docker/README.md b/docker/README.md
index bec6c4bf96..731587ca19 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -31,6 +31,49 @@ docker compose -f seaweedfs-dev-compose.yml -p seaweedfs up
 
 ```
 
+## Verify an image signature
+
+Every image CI pushes to `chrislusf/seaweedfs` and `ghcr.io/chrislusf/seaweedfs` is signed with [cosign](https://docs.sigstore.dev/cosign/verifying/verify/), keyless, by the GitHub Actions workflow that built it, so there is no key to fetch or pin. The signature is attached to the image digest and covers the multi-arch index and each platform image in it; `latest` is the release image under another tag and verifies the same way. Images published before September 2026 predate signing.
+
+```bash
+cosign verify \
+  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+  --certificate-identity-regexp '^https://github.com/seaweedfs/seaweedfs/\.github/workflows/container_release_unified\.yml@' \
+  chrislusf/seaweedfs:latest
+```
+
+cosign prints the digest it verified. Deploy by that digest, or let an admission controller resolve the tag, so what runs is what was checked.
+
+The identity is `https://github.com/seaweedfs/seaweedfs/.github/workflows/<workflow>@<ref>`. The ref is `refs/tags/<version>` for a release and `refs/heads/master` when a variant was republished by hand. The workflow is `container_release_unified.yml` for the release images, `container_dev.yml` for `dev`, `container_latest.yml` for a `latest` rebuilt by hand, `container_release_foundationdb.yml` for the `_large_disk_foundationdb` release image, and `container_foundationdb_version.yml` or `container_rocksdb_version.yml` for the per-version builds. The regexp above accepts release images only; `container_[a-z_]+\.yml@` accepts everything this repository publishes, `dev` included.
+
+The same check as a Kyverno policy, release images only:
+
+```yaml
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: verify-seaweedfs-images
+spec:
+  validationFailureAction: Enforce
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: signed-by-the-release-workflow
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "docker.io/chrislusf/seaweedfs:*"
+            - "ghcr.io/chrislusf/seaweedfs:*"
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    subject: https://github.com/seaweedfs/seaweedfs/.github/workflows/container_release_unified.yml@refs/tags/*
+```
+
 ## Local Development
 
 ```bash
diff --git a/docker/admin_integration/Dockerfile.local b/docker/admin_integration/Dockerfile.local
index 9795b6ea36..e4b6a511c6 100644
--- a/docker/admin_integration/Dockerfile.local
+++ b/docker/admin_integration/Dockerfile.local
@@ -1,11 +1,14 @@
 FROM alpine:latest
 
 # Install required packages
-RUN apk add --no-cache \
+RUN apk upgrade --no-cache && \
+    apk add --no-cache \
     ca-certificates \
     fuse \
     curl \
-    jq
+    jq \
+    libcrypto3 \
+    libssl3
 
 # Copy our locally built binary
 COPY weed-local /usr/bin/weed
diff --git a/docker/admin_integration/EC-TESTING-README.md b/docker/admin_integration/EC-TESTING-README.md
index 57e0a59854..e9e13d8530 100644
--- a/docker/admin_integration/EC-TESTING-README.md
+++ b/docker/admin_integration/EC-TESTING-README.md
@@ -21,7 +21,7 @@ The testing environment uses **official SeaweedFS commands** and includes:
 - **1 Master Server** (port 9333) - Coordinates the cluster with 50MB volume size limit
 - **6 Volume Servers** (ports 8080-8085) - Distributed across 2 data centers and 3 racks for diversity  
 - **1 Filer** (port 8888) - Provides file system interface
-- **1 Admin Server** (port 23646) - Detects volumes needing EC and manages workers using official `admin` command
+- **1 Admin Server** (port 12535) - Detects volumes needing EC and manages workers using official `admin` command
 - **3 EC Workers** - Execute erasure coding tasks using official `worker` command with task-specific working directories
 - **1 Load Generator** - Continuously writes and deletes files using SeaweedFS shell commands
 - **1 Monitor** - Tracks cluster health and EC progress using shell scripts
@@ -47,7 +47,7 @@ This provides:
 - Docker and Docker Compose installed
 - GNU Make installed
 - At least 4GB RAM available for containers
-- Ports 8080-8085, 8888, 9333, 23646 available
+- Ports 8080-8085, 8888, 9333, 12535 available
 
 ### Start the Environment
 
@@ -127,7 +127,7 @@ Run `make help` to see all available targets:
 |---------|-----|-------------|
 | Master UI | http://localhost:9333 | Cluster status and topology |
 | Filer | http://localhost:8888 | File operations |
-| Admin Server | http://localhost:23646/ | Task management |
+| Admin Server | http://localhost:12535/ | Task management |
 | Monitor | http://localhost:9999/status | Complete cluster monitoring |
 | Volume Servers | http://localhost:8080-8085/status | Individual volume server stats |
 
diff --git a/docker/admin_integration/Makefile b/docker/admin_integration/Makefile
index 68fb0cec6f..2997143aa6 100644
--- a/docker/admin_integration/Makefile
+++ b/docker/admin_integration/Makefile
@@ -26,7 +26,7 @@ build-and-restart: build ## Build with latest changes and restart services
 	@echo "2️⃣ Recreating workers to reconnect..."
 	@docker-compose -f $(COMPOSE_FILE) up -d worker1 worker2 worker3
 	@echo "✅ All services recreated with latest changes!"
-	@echo "🌐 Admin UI: http://localhost:23646/"
+	@echo "🌐 Admin UI: http://localhost:12535/"
 	@echo "💡 Workers will reconnect to the new admin server"
 
 restart-workers: ## Restart all workers to reconnect to admin server
@@ -64,7 +64,7 @@ start: ## Start the complete SeaweedFS cluster with admin and workers
 	@echo "✅ Cluster started!"
 	@echo ""
 	@echo "📊 Access points:"
-	@echo "  • Admin UI:      http://localhost:23646/"
+	@echo "  • Admin UI:      http://localhost:12535/"
 	@echo "  • Master UI:     http://localhost:9333/"
 	@echo "  • Filer:         http://localhost:8888/"
 	@echo ""
@@ -107,7 +107,7 @@ start-staged: ## Start services in proper order with delays
 	@echo "✅ All services started!"
 	@echo ""
 	@echo "📊 Access points:"
-	@echo "  • Admin UI:      http://localhost:23646/"
+	@echo "  • Admin UI:      http://localhost:12535/"
 	@echo "  • Master UI:     http://localhost:9333/"
 	@echo "  • Filer:         http://localhost:8888/"
 	@echo ""
@@ -136,7 +136,7 @@ status: ## Check the status of all services
 	@echo "Master:"
 	@curl -s http://localhost:9333/cluster/status | jq '.IsLeader' 2>/dev/null || echo "  ❌ Master not ready"
 	@echo "Admin:"
-	@curl -s http://localhost:23646/ | grep -q "Admin" && echo "  ✅ Admin ready" || echo "  ❌ Admin not ready"
+	@curl -s http://localhost:12535/ | grep -q "Admin" && echo "  ✅ Admin ready" || echo "  ❌ Admin not ready"
 
 logs: ## Show logs from all services
 	@echo "📜 Following logs from all services..."
@@ -157,7 +157,7 @@ master-logs: ## Show logs from master server
 
 admin-ui: ## Open admin UI in browser (macOS)
 	@echo "🌐 Opening admin UI in browser..."
-	@open http://localhost:23646/ || echo "💡 Manually open: http://localhost:23646/"
+	@open http://localhost:12535/ || echo "💡 Manually open: http://localhost:12535/"
 
 test: ## Run integration test to verify task assignment and completion
 	@echo "🧪 Running Admin-Worker Integration Test"
@@ -166,11 +166,11 @@ test: ## Run integration test to verify task assignment and completion
 	@echo "1️⃣ Checking cluster health..."
 	@sleep 5
 	@curl -s http://localhost:9333/cluster/status | jq '.IsLeader' > /dev/null && echo "✅ Master healthy" || echo "❌ Master not ready"
-	@curl -s http://localhost:23646/ | grep -q "Admin" && echo "✅ Admin healthy" || echo "❌ Admin not ready"
+	@curl -s http://localhost:12535/ | grep -q "Admin" && echo "✅ Admin healthy" || echo "❌ Admin not ready"
 	@echo ""
 	@echo "2️⃣ Checking worker registration..."
 	@sleep 10
-	@echo "💡 Check admin UI for connected workers: http://localhost:23646/"
+	@echo "💡 Check admin UI for connected workers: http://localhost:12535/"
 	@echo ""
 	@echo "3️⃣ Generating load to trigger EC tasks..."
 	@echo "📝 Creating test files to fill volumes..."
@@ -193,13 +193,13 @@ test: ## Run integration test to verify task assignment and completion
 	@echo "   • EC shards being distributed"
 	@echo ""
 	@echo "✅ Integration test setup complete!"
-	@echo "📊 Monitor progress at: http://localhost:23646/"
+	@echo "📊 Monitor progress at: http://localhost:12535/"
 
 quick-test: ## Quick verification that core services are running
 	@echo "⚡ Quick Health Check"
 	@echo "===================="
 	@echo "Master:  $$(curl -s http://localhost:9333/cluster/status | jq -r '.IsLeader // "not ready"')"
-	@echo "Admin:   $$(curl -s http://localhost:23646/ | grep -q "Admin" && echo "ready" || echo "not ready")"
+	@echo "Admin:   $$(curl -s http://localhost:12535/ | grep -q "Admin" && echo "ready" || echo "not ready")"
 	@echo "Workers: $$(docker-compose -f $(COMPOSE_FILE) ps worker1 worker2 worker3 | grep -c Up) running"
 
 validate: ## Validate integration test configuration
@@ -223,7 +223,7 @@ demo: start ## Start cluster and run demonstration
 	@echo "  • Load generator (creates files continuously)"
 	@echo ""
 	@echo "📊 Watch the process:"
-	@echo "  1. Visit: http://localhost:23646/"
+	@echo "  1. Visit: http://localhost:12535/"
 	@echo "  2. Observe workers connecting"
 	@echo "  3. Watch tasks being created and assigned"
 	@echo "  4. See tasks progress from pending → completed"
@@ -244,13 +244,13 @@ vacuum-test: ## Create test data with garbage and verify vacuum detection
 	@echo ""
 	@echo "1️⃣ Checking cluster health..."
 	@curl -s http://localhost:9333/cluster/status | jq '.IsLeader' > /dev/null && echo "✅ Master ready" || (echo "❌ Master not ready. Run 'make start' first." && exit 1)
-	@curl -s http://localhost:23646/ | grep -q "Admin" && echo "✅ Admin ready" || (echo "❌ Admin not ready. Run 'make start' first." && exit 1)
+	@curl -s http://localhost:12535/ | grep -q "Admin" && echo "✅ Admin ready" || (echo "❌ Admin not ready. Run 'make start' first." && exit 1)
 	@echo ""
 	@echo "2️⃣ Creating test data with garbage..."
 	@docker-compose -f $(COMPOSE_FILE) exec vacuum-tester go run create_vacuum_test_data.go -files=25 -delete=0.5 -size=200
 	@echo ""
 	@echo "3️⃣ Configuration Instructions:"
-	@echo "   Visit: http://localhost:23646/maintenance/config/vacuum"
+	@echo "   Visit: http://localhost:12535/maintenance/config/vacuum"
 	@echo "   Set for testing:"
 	@echo "     • Enable Vacuum Tasks: ✅ Checked"
 	@echo "     • Garbage Threshold: 0.20 (20%)"
@@ -258,7 +258,7 @@ vacuum-test: ## Create test data with garbage and verify vacuum detection
 	@echo "     • Min Volume Age: [0] [Minutes]"
 	@echo "     • Max Concurrent: 2"
 	@echo ""
-	@echo "4️⃣ Monitor vacuum tasks at: http://localhost:23646/maintenance"
+	@echo "4️⃣ Monitor vacuum tasks at: http://localhost:12535/maintenance"
 	@echo ""
 	@echo "💡 Use 'make vacuum-status' to check volume garbage ratios"
 
@@ -335,8 +335,8 @@ vacuum-help: ## Show vacuum testing help and examples
 	@echo "  make vacuum-demo           # Full guided demonstration"
 	@echo ""
 	@echo "Configuration:"
-	@echo "  Visit: http://localhost:23646/maintenance/config/vacuum"
-	@echo "  Monitor: http://localhost:23646/maintenance"
+	@echo "  Visit: http://localhost:12535/maintenance/config/vacuum"
+	@echo "  Monitor: http://localhost:12535/maintenance"
 	@echo ""
 	@echo "Custom Parameters:"
 	@echo "  make vacuum-data FILES=50 DELETE=0.8 SIZE=200"
diff --git a/docker/admin_integration/create_vacuum_test_data.go b/docker/admin_integration/create_vacuum_test_data.go
index 46acdd4cd3..1679d98b4d 100644
--- a/docker/admin_integration/create_vacuum_test_data.go
+++ b/docker/admin_integration/create_vacuum_test_data.go
@@ -243,7 +243,7 @@ func printTestingInstructions() {
 	fmt.Println("🧪 Testing Instructions:")
 	fmt.Println()
 	fmt.Println("1. Configure Vacuum for Testing:")
-	fmt.Println("   Visit: http://localhost:23646/maintenance/config/vacuum")
+	fmt.Println("   Visit: http://localhost:12535/maintenance/config/vacuum")
 	fmt.Println("   Set:")
 	fmt.Printf("   - Garbage Percentage Threshold: 20 (20%% - lower than default 30)\n")
 	fmt.Printf("   - Scan Interval: [30] [Seconds] (faster than default)\n")
@@ -253,7 +253,7 @@ func printTestingInstructions() {
 	fmt.Println()
 
 	fmt.Println("2. Monitor Vacuum Tasks:")
-	fmt.Println("   Visit: http://localhost:23646/maintenance")
+	fmt.Println("   Visit: http://localhost:12535/maintenance")
 	fmt.Println("   Watch for vacuum tasks to appear in the queue")
 	fmt.Println()
 
diff --git a/docker/admin_integration/demo_vacuum_testing.sh b/docker/admin_integration/demo_vacuum_testing.sh
index 6835e14cc1..a0c8678778 100755
--- a/docker/admin_integration/demo_vacuum_testing.sh
+++ b/docker/admin_integration/demo_vacuum_testing.sh
@@ -7,7 +7,7 @@ echo ""
 # Check if SeaweedFS is running
 echo "📋 Checking SeaweedFS status..."
 MASTER_URL="${MASTER_HOST:-master:9333}"
-ADMIN_URL="${ADMIN_HOST:-admin:23646}"
+ADMIN_URL="${ADMIN_HOST:-admin:12535}"
 
 if ! curl -s http://$MASTER_URL/cluster/status > /dev/null; then
     echo "❌ SeaweedFS master not running at $MASTER_URL"
@@ -42,7 +42,7 @@ echo ""
 
 # Phase 3: Configure vacuum
 echo "⚙️  Phase 3: Vacuum configuration instructions..."
-echo "   1. Visit: http://localhost:23646/maintenance/config/vacuum"
+echo "   1. Visit: http://localhost:12535/maintenance/config/vacuum"
 echo "   2. Set these values for testing:"
 echo "      - Enable Vacuum Tasks: ✅ Checked"
 echo "      - Garbage Threshold: 0.30"
@@ -57,7 +57,7 @@ echo ""
 
 # Phase 4: Monitor tasks
 echo "🎯 Phase 4: Monitoring vacuum tasks..."
-echo "   Visit: http://localhost:23646/maintenance"
+echo "   Visit: http://localhost:12535/maintenance"
 echo "   You should see vacuum tasks appear within 30 seconds"
 echo ""
 
@@ -93,9 +93,9 @@ echo ""
 echo "🎉 Demo Complete!"
 echo ""
 echo "🔍 Things to check:"
-echo "   1. Maintenance Queue: http://localhost:23646/maintenance"
+echo "   1. Maintenance Queue: http://localhost:12535/maintenance"
 echo "   2. Volume Status: http://localhost:9333/vol/status"
-echo "   3. Admin Dashboard: http://localhost:23646"
+echo "   3. Admin Dashboard: http://localhost:12535"
 echo ""
 echo "💡 Next Steps:"
 echo "   - Try different garbage thresholds (0.10, 0.50, 0.80)"
diff --git a/docker/admin_integration/docker-compose-ec-test.yml b/docker/admin_integration/docker-compose-ec-test.yml
index 1726e61fa5..619b45e8c5 100644
--- a/docker/admin_integration/docker-compose-ec-test.yml
+++ b/docker/admin_integration/docker-compose-ec-test.yml
@@ -114,9 +114,9 @@ services:
   admin:
     image: chrislusf/seaweedfs:local
     ports:
-      - "23646:23646"      # HTTP admin interface (default port)
-      - "33646:33646"      # gRPC worker communication (23646 + 10000)
-    command: "-v=2 admin -port=23646 -masters=master:9333 -dataDir=/data"
+      - "12535:12535"      # HTTP admin interface (default port)
+      - "22535:22535"      # gRPC worker communication (12535 + 10000)
+    command: "-v=2 admin -port=12535 -masters=master:9333 -dataDir=/data"
     depends_on:
       - master
       - filer
@@ -127,7 +127,7 @@ services:
 
   worker1:
     image: chrislusf/seaweedfs:local
-    command: "-v=2 worker -admin=admin:23646 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
+    command: "-v=2 worker -admin=admin:12535 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
     depends_on:
       - admin
     volumes:
@@ -139,7 +139,7 @@ services:
 
   worker2:
     image: chrislusf/seaweedfs:local
-    command: "-v=2 worker -admin=admin:23646 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
+    command: "-v=2 worker -admin=admin:12535 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
     depends_on:
       - admin
     volumes:
@@ -151,7 +151,7 @@ services:
 
   worker3:
     image: chrislusf/seaweedfs:local
-    command: "-v=2 worker -admin=admin:23646 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
+    command: "-v=2 worker -admin=admin:12535 -capabilities=erasure_coding,vacuum -maxConcurrent=2"
     depends_on:
       - admin
     volumes:
@@ -199,7 +199,7 @@ services:
         curl -s http://master:9333/cluster/status | jq '.IsLeader, .Peers' || echo 'Master not ready';
         echo;
         echo 'Admin status:';
-        curl -s http://admin:23646/ | grep -o 'Admin.*Interface' || echo 'Admin not ready';
+        curl -s http://admin:12535/ | grep -o 'Admin.*Interface' || echo 'Admin not ready';
         echo;
         echo 'Volume count by server:';
         curl -s http://master:9333/vol/status | jq '.Volumes | length' || echo 'Volumes not ready';
@@ -237,4 +237,4 @@ services:
       - seaweed_net
     environment:
       - MASTER_HOST=master:9333
-      - ADMIN_HOST=admin:23646 
\ No newline at end of file
+      - ADMIN_HOST=admin:12535 
\ No newline at end of file
diff --git a/docker/admin_integration/test-integration.sh b/docker/admin_integration/test-integration.sh
index b355b1dfd4..0b811ca3b2 100755
--- a/docker/admin_integration/test-integration.sh
+++ b/docker/admin_integration/test-integration.sh
@@ -23,7 +23,7 @@ else
 fi
 
 echo -e "${BLUE}2. Checking if required ports are available...${NC}"
-for port in 9333 8080 8081 8082 8083 8084 8085 8888 23646; do
+for port in 9333 8080 8081 8082 8083 8084 8085 8888 12535; do
     if lsof -i :$port > /dev/null 2>&1; then
         echo -e "${YELLOW}⚠️  Port $port is in use${NC}"
     else
@@ -41,7 +41,7 @@ else
 fi
 
 echo -e "${BLUE}4. Verifying admin server configuration...${NC}"
-if docker-compose -f docker-compose-ec-test.yml config | grep -q "admin:23646"; then
+if docker-compose -f docker-compose-ec-test.yml config | grep -q "admin:12535"; then
     echo -e "${GREEN}✅ Admin server port configuration is correct${NC}"
 else
     echo -e "${RED}❌ Admin server port configuration is incorrect${NC}"
diff --git a/docker/apt-install b/docker/apt-install
new file mode 100755
index 0000000000..8dfd999d39
--- /dev/null
+++ b/docker/apt-install
@@ -0,0 +1,25 @@
+#!/bin/sh
+# Install packages, falling through to the next Ubuntu mirror when one is
+# unreachable. See docker/Dockerfile.e2e.
+set -e
+
+# Every rewrite starts from the pristine list, so a mirror that just failed does
+# not become the pattern the next rewrite has to match.
+[ -f /etc/apt/sources.list.orig ] || cp /etc/apt/sources.list /etc/apt/sources.list.orig
+
+for mirror in azure.archive.ubuntu.com archive.ubuntu.com; do
+	# Any archive host, so this works whether the pristine list came from the
+	# base image (archive.ubuntu.com) or a CI runner (azure.archive.ubuntu.com).
+	sed "s|http://[a-z0-9.]*archive\.ubuntu\.com/ubuntu|http://$mirror/ubuntu|g; s|http://security\.ubuntu\.com/ubuntu|http://$mirror/ubuntu|g" \
+		/etc/apt/sources.list.orig > /etc/apt/sources.list
+	if apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=15 update && \
+		DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::Retries=3 -o Acquire::http::Timeout=15 install -y \
+			--no-install-recommends --no-install-suggests "$@"; then
+		apt-get clean
+		rm -rf /var/lib/apt/lists/*
+		exit 0
+	fi
+	echo "apt: $mirror unreachable, trying the next mirror" >&2
+done
+
+exit 1
diff --git a/docker/compose/master-cloud.toml b/docker/compose/master-cloud.toml
index 29324772cc..27bf3f0fed 100644
--- a/docker/compose/master-cloud.toml
+++ b/docker/compose/master-cloud.toml
@@ -30,3 +30,5 @@ sleep_minutes = 17          # sleep minutes between each script execution
 	bucket = "volume_bucket"    # an existing bucket
 	endpoint = "http://server2:8333"
 	storage_class = "STANDARD_IA"
+	# upload_concurrency = 5     # concurrent multipart part uploads per volume (volume.tier.upload -concurrent overrides)
+	# download_concurrency = 5   # concurrent multipart part downloads per volume (volume.tier.download -concurrent overrides)
diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh
index 7ce0595ecd..0bbd507871 100755
--- a/docker/entrypoint.sh
+++ b/docker/entrypoint.sh
@@ -90,6 +90,16 @@ case "$1" in
   	exec /usr/bin/weed-volume $ARGS $@
 	;;
 
+  'worker-rust')
+  	shift
+  	if [ ! -s /usr/bin/weed-worker ]; then
+  	  echo "Error: Rust maintenance worker is not available on this platform ($(uname -m))." >&2
+  	  echo "Use 'worker' for the Go maintenance worker instead." >&2
+  	  exit 1
+  	fi
+  	exec /usr/bin/weed-worker "$@"
+	;;
+
   'server')
   	ARGS="-dir=/data -volume.max=0 -master.volumeSizeLimitMB=1024"
   	if isArgPassed "-volume.max" "$@"; then
diff --git a/docker/prometheus/prometheus.yml b/docker/prometheus/prometheus.yml
index 2f0ead441a..3fd4c3eeba 100644
--- a/docker/prometheus/prometheus.yml
+++ b/docker/prometheus/prometheus.yml
@@ -11,4 +11,8 @@ scrape_configs:
           - 'master:9324'
           - 'volume:9325'
           - 'filer:9326'
-          - 's3:9327'
\ No newline at end of file
+          - 's3:9327'
+          # A plugin worker publishes its own metrics when started with
+          # -metricsPort (Go) or --metrics-port (Rust). 9328 continues the
+          # series, since 9327 is already the S3 gateway's.
+          # - 'worker:9328'
diff --git a/docker/seaweedfs-dev-compose.yml b/docker/seaweedfs-dev-compose.yml
index 47c3598acb..5fafecfa7d 100644
--- a/docker/seaweedfs-dev-compose.yml
+++ b/docker/seaweedfs-dev-compose.yml
@@ -45,7 +45,7 @@ services:
   admin:
     image: chrislusf/seaweedfs:dev # use a remote dev image
     ports:
-      - 23646:23646
+      - 12535:12535
     command: 'admin -master=master:9333'
     depends_on:
       - master
diff --git a/docker/weed-worker-prebuilt/.gitkeep b/docker/weed-worker-prebuilt/.gitkeep
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/go.mod b/go.mod
index bb98743fcc..ccfaa9ab5d 100644
--- a/go.mod
+++ b/go.mod
@@ -1,20 +1,20 @@
 module github.com/seaweedfs/seaweedfs
 
-go 1.25.8
+go 1.26.6
 
 require (
 	cloud.google.com/go v0.123.0 // indirect
-	cloud.google.com/go/pubsub v1.51.0
-	cloud.google.com/go/storage v1.64.0
+	cloud.google.com/go/pubsub v1.51.1
+	cloud.google.com/go/storage v1.67.0
 	github.com/Shopify/sarama v1.38.1
 	github.com/aws/aws-sdk-go v1.55.8
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bwmarrin/snowflake v0.3.0
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/coreos/go-semver v0.3.1 // indirect
-	github.com/coreos/go-systemd/v22 v22.6.0 // indirect
+	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dustin/go-humanize v1.0.1
+	github.com/dustin/go-humanize v1.1.0
 	github.com/eapache/go-resiliency v1.6.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
@@ -23,16 +23,16 @@ require (
 	github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 // indirect
 	github.com/facebookgo/stats v0.0.0-20151006221625-1b76add642e4
 	github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-redsync/redsync/v4 v4.17.0
-	github.com/go-sql-driver/mysql v1.10.0
+	github.com/fsnotify/fsnotify v1.10.1 // indirect
+	github.com/go-redsync/redsync/v4 v4.18.0
+	github.com/go-sql-driver/mysql v1.10.1
 	github.com/go-zookeeper/zk v1.0.4 // indirect
 	github.com/golang/protobuf v1.5.4
 	github.com/golang/snappy v1.0.0
 	github.com/google/btree v1.1.3
 	github.com/google/uuid v1.6.0
 	github.com/google/wire v0.7.0 // indirect
-	github.com/googleapis/gax-go/v2 v2.23.0 // indirect
+	github.com/googleapis/gax-go/v2 v2.24.1 // indirect
 	github.com/gorilla/mux v1.8.1
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -44,12 +44,12 @@ require (
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/json-iterator/go v1.1.12
 	github.com/karlseguin/ccache/v2 v2.0.8
-	github.com/klauspost/compress v1.19.1
-	github.com/klauspost/reedsolomon v1.14.1
+	github.com/klauspost/compress v1.20.3
+	github.com/klauspost/reedsolomon v1.14.2
 	github.com/kurin/blazer v0.5.3
-	github.com/linxGnu/grocksdb v1.10.8
+	github.com/linxGnu/grocksdb v1.11.1
 	github.com/mailru/easyjson v0.9.2 // indirect
-	github.com/mattn/go-isatty v0.0.23 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/olivere/elastic/v7 v7.0.32
@@ -59,21 +59,21 @@ require (
 	github.com/posener/complete v1.2.3
 	github.com/pquerna/cachecontrol v0.2.0
 	github.com/prometheus/client_golang v1.24.1
-	github.com/prometheus/client_model v0.6.2
-	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1
+	github.com/prometheus/client_model v0.6.3
+	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/procfs v0.22.0
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/seaweedfs/goexif v1.0.3
-	github.com/seaweedfs/raft v1.2.0
+	github.com/seaweedfs/raft v1.2.2
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/viper v1.21.0
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203
 	github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965
-	github.com/tidwall/gjson v1.18.0
+	github.com/tidwall/gjson v1.20.0
 	github.com/tidwall/match v1.2.0
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/tsuna/gohbase v0.0.0-20201125011725-348991136365
@@ -84,82 +84,83 @@ require (
 	github.com/xdg-go/scram v1.2.0
 	github.com/xdg-go/stringprep v1.0.4 // indirect
 	github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
-	go.etcd.io/etcd/client/v3 v3.6.12
+	go.etcd.io/etcd/client/v3 v3.7.1
 	go.mongodb.org/mongo-driver v1.17.9
 	go.opencensus.io v0.24.0 // indirect
-	gocloud.dev v0.46.0
+	gocloud.dev v0.47.0
 	gocloud.dev/pubsub/natspubsub v0.46.0
-	gocloud.dev/pubsub/rabbitpubsub v0.46.0
-	golang.org/x/crypto v0.54.0
-	golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597
-	golang.org/x/image v0.44.0
-	golang.org/x/net v0.57.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sys v0.47.0
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/tools v0.48.0 // indirect
+	gocloud.dev/pubsub/rabbitpubsub v0.47.0
+	golang.org/x/crypto v0.58.0
+	golang.org/x/exp v0.0.0-20260813180055-c1d0aacb2297
+	golang.org/x/image v0.46.0
+	golang.org/x/net v0.61.0
+	golang.org/x/oauth2 v0.37.0
+	golang.org/x/sys v0.49.0
+	golang.org/x/text v0.43.0 // indirect
+	golang.org/x/tools v0.51.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
-	google.golang.org/api v0.289.0
-	google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 // indirect
-	google.golang.org/grpc v1.84.0-dev.0.20260723093437-b6eac429d7b6
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/api v0.297.0
+	google.golang.org/genproto v0.0.0-20260904194346-d0f1323225a4 // indirect
+	google.golang.org/grpc v1.85.0-dev.0.20260915183914-4e49413dcab7
+	google.golang.org/protobuf v1.36.12
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	modernc.org/b v1.0.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
-	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.53.0
+	modernc.org/memory v1.12.1 // indirect
+	modernc.org/sqlite v1.60.1
 )
 
 require (
-	cloud.google.com/go/kms v1.31.0
+	cloud.google.com/go/kms v1.35.0
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys v0.10.0
 	github.com/DATA-DOG/go-sqlmock v1.5.2
 	github.com/Jille/raft-grpc-transport v1.6.1
 	github.com/ThreeDotsLabs/watermill v1.5.2
-	github.com/a-h/templ v0.3.1020
+	github.com/a-h/templ v0.3.1070
 	github.com/apache/cassandra-gocql-driver/v2 v2.1.2
-	github.com/apache/iceberg-go v0.6.0
+	github.com/apache/iceberg-go v0.7.0
 	github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3
 	github.com/arangodb/go-driver v1.6.9
 	github.com/armon/go-metrics v0.4.1
-	github.com/aws/aws-sdk-go-v2 v1.43.2
-	github.com/aws/aws-sdk-go-v2/config v1.32.33
-	github.com/aws/aws-sdk-go-v2/credentials v1.19.32
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.105.2
+	github.com/aws/aws-sdk-go-v2 v1.47.3
+	github.com/aws/aws-sdk-go-v2/config v1.33.6
+	github.com/aws/aws-sdk-go-v2/credentials v1.20.6
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.114.1
 	github.com/cespare/xxhash/v2 v2.3.0
 	github.com/cognusion/imaging v1.0.4
 	github.com/fluent/fluent-logger-golang v1.10.1
-	github.com/getsentry/sentry-go v0.44.1
-	github.com/go-ldap/ldap/v3 v3.4.13
+	github.com/getsentry/sentry-go v0.49.0
+	github.com/go-ldap/ldap/v3 v3.4.14
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	github.com/hashicorp/raft v1.7.3
-	github.com/hashicorp/raft-boltdb/v2 v2.3.1
+	github.com/hashicorp/raft v1.8.0
+	github.com/hashicorp/raft-boltdb/v2 v2.4.2
 	github.com/hashicorp/vault/api v1.23.0
-	github.com/jhump/protoreflect v1.18.0
+	github.com/jhump/protoreflect v1.18.1
 	github.com/linkedin/goavro/v2 v2.15.0
 	github.com/minio/crc64nvme v1.1.1
 	github.com/orcaman/concurrent-map/v2 v2.0.1
-	github.com/parquet-go/parquet-go v0.30.1
+	github.com/parquet-go/parquet-go v0.32.0
 	github.com/pkg/sftp v1.13.11
-	github.com/rabbitmq/amqp091-go v1.11.0
-	github.com/rclone/rclone v1.75.0
+	github.com/rabbitmq/amqp091-go v1.15.0
+	github.com/rclone/rclone v1.75.1
 	github.com/rdleal/intervalst v1.5.0
-	github.com/redis/go-redis/v9 v9.21.0
+	github.com/redis/go-redis/v9 v9.22.0
 	github.com/schollz/progressbar/v3 v3.19.1
 	github.com/seaweedfs/go-fuse/v2 v2.9.4
-	github.com/shirou/gopsutil/v4 v4.26.6
+	github.com/shirou/gopsutil/v4 v4.26.7
 	github.com/tarantool/go-option v1.1.0
-	github.com/tarantool/go-tarantool/v3 v3.0.0
-	github.com/testcontainers/testcontainers-go v0.43.0
+	github.com/tarantool/go-tarantool/v3 v3.0.2
+	github.com/testcontainers/testcontainers-go v0.44.0
 	github.com/tikv/client-go/v2 v2.0.7
+	github.com/twmb/avro v1.9.0
 	github.com/xeipuuv/gojsonschema v1.2.0
-	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.2
-	github.com/ydb-platform/ydb-go-sdk/v3 v3.146.3
-	go.etcd.io/etcd/client/pkg/v3 v3.6.12
-	go.uber.org/atomic v1.11.0
-	golang.org/x/sync v0.22.0
+	github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.3
+	github.com/ydb-platform/ydb-go-sdk/v3 v3.155.1
+	go.etcd.io/etcd/client/pkg/v3 v3.7.1
+	go.uber.org/atomic v1.12.0
+	golang.org/x/sync v0.24.0
 	golang.org/x/tools/godoc v0.1.0-deprecated
 	google.golang.org/grpc/security/advancedtls v1.0.0
 )
@@ -167,37 +168,36 @@ require (
 require github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 // indirect
 
 require (
-	atomicgo.dev/cursor v0.2.0 // indirect
-	atomicgo.dev/keyboard v0.2.9 // indirect
-	atomicgo.dev/schedule v0.1.0 // indirect
 	cloud.google.com/go/longrunning v1.2.0 // indirect
-	cloud.google.com/go/pubsub/v2 v2.6.0 // indirect
+	cloud.google.com/go/pubsub/v2 v2.7.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/storage/internal v0.1.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/FilenCloudDienste/filen-sdk-go v0.0.39 // indirect
 	github.com/ProtonMail/gopenpgp/v3 v3.4.1 // indirect
+	github.com/RoaringBitmap/roaring/v2 v2.26.0 // indirect
 	github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anchore/go-lzo v0.1.1 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
-	github.com/apache/arrow-go/v18 v18.7.0 // indirect
+	github.com/apache/arrow-go/v18 v18.8.0 // indirect
 	github.com/apache/thrift v0.24.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/signin v1.5.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.10.1 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bazelbuild/rules_go v0.46.0 // indirect
 	github.com/biogo/store v0.0.0-20201120204734-aad293a2328f // indirect
+	github.com/bits-and-blooms/bitset v1.24.4 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/boombuler/barcode v1.1.0 // indirect
 	github.com/buger/jsonparser v1.2.0 // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/clipperhouse/uax29/v2 v2.7.0 // indirect
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
-	github.com/cockroachdb/errors v1.11.3 // indirect
+	github.com/cockroachdb/errors v1.14.0 // indirect
 	github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect
 	github.com/cockroachdb/redact v1.1.5 // indirect
 	github.com/cockroachdb/version v0.0.0-20250314144055-3860cd14adf2 // indirect
-	github.com/containerd/console v1.0.5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
@@ -206,16 +206,16 @@ require (
 	github.com/dave/dst v0.27.2 // indirect
 	github.com/diskfs/go-diskfs v1.9.4 // indirect
 	github.com/distribution/reference v0.6.0 // indirect
-	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/go-connections v0.7.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dromara/dongle v1.0.1 // indirect
+	github.com/geoarrow/geoarrow-go v0.0.0-20260403143023-f54751c3e3a1 // indirect
 	github.com/gin-gonic/gin v1.11.0 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/gookit/color v1.6.0 // indirect
 	github.com/gopherjs/gopherjs v1.17.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
@@ -232,20 +232,20 @@ require (
 	github.com/jtolds/gls v4.20.0+incompatible // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.12.0 // indirect
-	github.com/lithammer/fuzzysearch v1.1.8 // indirect
+	github.com/lib/pq v1.12.3 // indirect
 	github.com/lithammer/shortuuid/v3 v3.0.7 // indirect
 	github.com/lpar/calendar v0.2.0 // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/go-archive v0.2.0 // indirect
-	github.com/moby/moby/api v1.54.2 // indirect
-	github.com/moby/moby/client v0.4.0 // indirect
+	github.com/moby/go-archive v0.3.0 // indirect
+	github.com/moby/moby/api v1.55.0 // indirect
+	github.com/moby/moby/client v0.5.0 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
-	github.com/moby/sys/sequential v0.6.0 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/sequential v0.7.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.2 // indirect
+	github.com/mschoch/smat v0.2.0 // indirect
 	github.com/oklog/ulid/v2 v2.1.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
@@ -255,10 +255,9 @@ require (
 	github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 // indirect
 	github.com/pierrre/geohash v1.0.0 // indirect
 	github.com/pquerna/otp v1.5.0 // indirect
-	github.com/pterm/pterm v0.12.83 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/rclone/Proton-API-Bridge v1.0.4 // indirect
-	github.com/rclone/go-proton-api v1.0.3 // indirect
+	github.com/rclone/Proton-API-Bridge v1.0.5 // indirect
+	github.com/rclone/go-proton-api v1.0.4 // indirect
 	github.com/rogpeppe/go-internal v1.15.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/sasha-s/go-deadlock v0.3.1 // indirect
@@ -268,7 +267,6 @@ require (
 	github.com/substrait-io/substrait v0.87.0 // indirect
 	github.com/substrait-io/substrait-go/v8 v8.1.1 // indirect
 	github.com/substrait-io/substrait-protobuf/go v0.85.0 // indirect
-	github.com/twmb/avro v1.7.2 // indirect
 	github.com/twpayne/go-geom v1.6.1 // indirect
 	github.com/twpayne/go-kml/v3 v3.2.1 // indirect
 	github.com/tyler-smith/go-bip39 v1.1.0 // indirect
@@ -276,67 +274,66 @@ require (
 	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
-	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/zeebo/xxh3 v1.1.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect
-	go.opentelemetry.io/otel/exporters/zipkin v1.36.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 // indirect
+	go.opentelemetry.io/otel/exporters/zipkin v1.45.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/mock v0.5.2 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.38.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/mod v0.41.0 // indirect
 	gonum.org/v1/gonum v0.17.0 // indirect
 )
 
 require (
-	cel.dev/expr v0.25.2 // indirect
-	cloud.google.com/go/auth v0.20.0 // indirect
+	cel.dev/expr v0.25.3 // indirect
+	cloud.google.com/go/auth v0.23.2 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
-	cloud.google.com/go/iam v1.11.0 // indirect
-	cloud.google.com/go/monitoring v1.29.0 // indirect
+	cloud.google.com/go/iam v1.13.0 // indirect
+	cloud.google.com/go/monitoring v1.30.0 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.2
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.2
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.7.0 // indirect
 	github.com/Azure/go-ntlmssp v0.1.1 // indirect
-	github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 // indirect
 	github.com/Files-com/files-sdk-go/v3 v3.3.194 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.34.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.37.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.61.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.61.0 // indirect
 	github.com/IBM/go-sdk-core/v5 v5.23.1 // indirect
 	github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
 	github.com/ProtonMail/bcrypt v0.0.0-20211005172633-e235017c1baf // indirect
 	github.com/ProtonMail/gluon v0.17.1-0.20230724134000-308be39be96e // indirect
 	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/ProtonMail/go-srp v0.0.7 // indirect
 	github.com/PuerkitoBio/goquery v1.12.0 // indirect
 	github.com/abbot/go-http-auth v0.4.0 // indirect
-	github.com/andybalholm/brotli v1.2.2 // indirect
+	github.com/andybalholm/brotli v1.2.6 // indirect
 	github.com/andybalholm/cascadia v1.3.4 // indirect
 	github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc // indirect
 	github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.34 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sns v1.39.14 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sqs v1.42.24 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.33.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.45.2
-	github.com/aws/smithy-go v1.27.5
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sns v1.46.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.51.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.38.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.51.1
+	github.com/aws/smithy-go v1.28.5
 	github.com/boltdb/bolt v1.3.1 // indirect
 	github.com/bradenaw/juniper v0.15.3 // indirect
 	github.com/buengese/sgzip v0.1.1 // indirect
@@ -354,21 +351,21 @@ require (
 	github.com/d4l3k/messagediff v1.2.1 // indirect
 	github.com/dgryski/go-farm v0.0.0-20200201041132-a6ae2369ad13 // indirect
 	github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.4.0 // indirect
-	github.com/ebitengine/purego v0.10.1 // indirect
+	github.com/ebitengine/purego v0.10.2 // indirect
 	github.com/elastic/gosigar v0.14.3 // indirect
 	github.com/emersion/go-message v0.18.2 // indirect
 	github.com/emersion/go-vcard v0.0.0-20260618161152-d854b7e0e2d3 // indirect
-	github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect
+	github.com/envoyproxy/go-control-plane/envoy v1.39.1-0.20260819172001-e6e3fd93e4be // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect
-	github.com/fatih/color v1.18.0 // indirect
+	github.com/fatih/color v1.19.0 // indirect
 	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/flynn/noise v1.1.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
-	github.com/go-chi/chi/v5 v5.3.1 // indirect
+	github.com/go-chi/chi/v5 v5.4.0 // indirect
 	github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 // indirect
-	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-openapi/errors v0.22.8 // indirect
@@ -383,19 +380,19 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.18 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.21 // indirect
 	github.com/gorilla/schema v1.4.1 // indirect
 	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/sessions v1.4.0
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
-	github.com/hashicorp/go-metrics v0.5.4 // indirect
-	github.com/hashicorp/go-msgpack/v2 v2.1.2 // indirect
+	github.com/hashicorp/go-metrics v0.7.0 // indirect
+	github.com/hashicorp/go-msgpack/v2 v2.1.5 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
-	github.com/hashicorp/golang-lru v0.6.0 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
@@ -433,10 +430,10 @@ require (
 	github.com/oracle/oci-go-sdk/v65 v65.121.0 // indirect
 	github.com/panjf2000/ants/v2 v2.12.1 // indirect
 	github.com/patrickmn/go-cache v2.1.0+incompatible // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
-	github.com/pierrec/lz4/v4 v4.1.27
+	github.com/pierrec/lz4/v4 v4.1.29
 	github.com/pingcap/errors v0.11.5-0.20211224045212-9687c2b0f87c // indirect
 	github.com/pingcap/failpoint v0.0.0-20220801062533-2eaa32854a6c // indirect
 	github.com/pingcap/kvproto v0.0.0-20230403051650-e166ae588106 // indirect
@@ -473,36 +470,36 @@ require (
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/winfsp/cgofuse v1.6.1-0.20260126094232-f2c4fccdb286
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e // indirect
-	github.com/ydb-platform/ydb-go-genproto v0.0.0-20260428144813-1c07baab7f7b // indirect
-	github.com/ydb-platform/ydb-go-yc v0.12.1 // indirect
-	github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 // indirect
+	github.com/yandex-cloud/go-genproto v0.0.0-20240819112322-98a264d392f6 // indirect
+	github.com/ydb-platform/ydb-go-genproto v0.0.0-20260810122915-65bfd5c4b705 // indirect
+	github.com/ydb-platform/ydb-go-yc v0.12.5 // indirect
+	github.com/ydb-platform/ydb-go-yc-metadata v0.6.2 // indirect
 	github.com/yunify/qingstor-sdk-go/v3 v3.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
 	go.etcd.io/bbolt v1.5.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.6.12 // indirect
+	go.etcd.io/etcd/api/v3 v3.7.1 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
-	go.opentelemetry.io/otel v1.44.0 // indirect
-	go.opentelemetry.io/otel/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
-	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.46.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
+	go.opentelemetry.io/otel v1.46.0 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.46.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/trace v1.46.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.1 // indirect
-	golang.org/x/term v0.45.0
-	golang.org/x/time v0.15.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d // indirect
+	go.uber.org/zap v1.28.0 // indirect
+	golang.org/x/term v0.47.0
+	golang.org/x/time v0.16.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/validator.v2 v2.0.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	modernc.org/libc v1.73.4 // indirect
+	modernc.org/libc v1.77.1 // indirect
 	moul.io/http2curl/v2 v2.3.0 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 	storj.io/common v0.0.0-20260629224719-ba1bff0a7846 // indirect
@@ -515,13 +512,6 @@ require (
 
 // replace github.com/seaweedfs/raft => /Users/chrislu/go/src/github.com/seaweedfs/raft
 
-// apache/thrift v0.23.0 fixes CVE-2026-41602 but compares int against the
-// untyped math.MaxUint32 in lib/go/thrift/framed_transport.go, which overflows
-// int on 32-bit GOARCHes (e.g. openbsd/arm, linux/arm) and fails to compile.
-// Upstream fixed the range check post-release; pin to that commit until the
-// next tagged release carries both the CVE fix and the 32-bit fix.
-replace github.com/apache/thrift => github.com/apache/thrift v0.23.1-0.20260429145742-d2acd3c49e58
-
 // tyler-smith/go-bip39 was deleted from GitHub, so `go mod download` fails for
 // anyone resolving it directly (GOPROXY=direct). It only reaches us transitively
 // through rclone's internxt backend, which calls IsMnemonicValid and NewSeed.
diff --git a/go.sum b/go.sum
index 6f8bb55f91..a9f7da602a 100644
--- a/go.sum
+++ b/go.sum
@@ -1,562 +1,43 @@
-atomicgo.dev/assert v0.0.2 h1:FiKeMiZSgRrZsPo9qn/7vmr7mCsh5SZyXY4YGYiYwrg=
-atomicgo.dev/assert v0.0.2/go.mod h1:ut4NcI3QDdJtlmAxQULOmA13Gz6e2DWbSAS8RUOmNYQ=
-atomicgo.dev/cursor v0.2.0 h1:H6XN5alUJ52FZZUkI7AlJbUc1aW38GWZalpYRPpoPOw=
-atomicgo.dev/cursor v0.2.0/go.mod h1:Lr4ZJB3U7DfPPOkbH7/6TOtJ4vFGHlgj1nc+n900IpU=
-atomicgo.dev/keyboard v0.2.9 h1:tOsIid3nlPLZ3lwgG8KZMp/SFmr7P0ssEN5JUsm78K8=
-atomicgo.dev/keyboard v0.2.9/go.mod h1:BC4w9g00XkxH/f1HXhW2sXmJFOCWbKn9xrOunSFtExQ=
-atomicgo.dev/schedule v0.1.0 h1:nTthAbhZS5YZmgYbb2+DH8uQIZcTlIrd4eYr3UQxEjs=
-atomicgo.dev/schedule v0.1.0/go.mod h1:xeUa3oAkiuHYh8bKiQBRojqAMq3PXXbJujjb0hw8pEU=
-cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
-cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
+cel.dev/expr v0.25.3 h1:A2jO8jwOugrrovveCWfj0KEZOfqiLgAcwjpHPhzIGw0=
+cel.dev/expr v0.25.3/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
-cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
-cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
-cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
-cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
-cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
-cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
-cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
-cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
-cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
-cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
-cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
-cloud.google.com/go v0.100.1/go.mod h1:fs4QogzfH5n2pBXBP9vRiU+eCny7lD2vmFZy79Iuw1U=
-cloud.google.com/go v0.100.2/go.mod h1:4Xra9TjzAeYHrl5+oeLlzbM2k3mjVhZh4UqTZ//w99A=
-cloud.google.com/go v0.102.0/go.mod h1:oWcCzKlqJ5zgHQt9YsaeTY9KzIvjyy0ArmiBUgpQ+nc=
-cloud.google.com/go v0.102.1/go.mod h1:XZ77E9qnTEnrgEOvr4xzfdX5TRo7fB4T2F4O6+34hIU=
-cloud.google.com/go v0.104.0/go.mod h1:OO6xxXdJyvuJPcEPBLN9BJPD+jep5G1+2U5B5gkRYtA=
-cloud.google.com/go v0.105.0/go.mod h1:PrLgOJNe5nfE9UMxKxgXj4mD3voiP+YQ6gdt6KMFOKM=
-cloud.google.com/go v0.107.0/go.mod h1:wpc2eNrD7hXUTy8EKS10jkxpZBjASrORK7goS+3YX2I=
-cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY=
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
-cloud.google.com/go/accessapproval v1.4.0/go.mod h1:zybIuC3KpDOvotz59lFe5qxRZx6C75OtwbisN56xYB4=
-cloud.google.com/go/accessapproval v1.5.0/go.mod h1:HFy3tuiGvMdcd/u+Cu5b9NkO1pEICJ46IR82PoUdplw=
-cloud.google.com/go/accessapproval v1.6.0/go.mod h1:R0EiYnwV5fsRFiKZkPHr6mwyk2wxUJ30nL4j2pcFY2E=
-cloud.google.com/go/accesscontextmanager v1.3.0/go.mod h1:TgCBehyr5gNMz7ZaH9xubp+CE8dkrszb4oK9CWyvD4o=
-cloud.google.com/go/accesscontextmanager v1.4.0/go.mod h1:/Kjh7BBu/Gh83sv+K60vN9QE5NJcd80sU33vIe2IFPE=
-cloud.google.com/go/accesscontextmanager v1.6.0/go.mod h1:8XCvZWfYw3K/ji0iVnp+6pu7huxoQTLmxAbVjbloTtM=
-cloud.google.com/go/aiplatform v1.22.0/go.mod h1:ig5Nct50bZlzV6NvKaTwmplLLddFx0YReh9WfTO5jKw=
-cloud.google.com/go/aiplatform v1.24.0/go.mod h1:67UUvRBKG6GTayHKV8DBv2RtR1t93YRu5B1P3x99mYY=
-cloud.google.com/go/aiplatform v1.27.0/go.mod h1:Bvxqtl40l0WImSb04d0hXFU7gDOiq9jQmorivIiWcKg=
-cloud.google.com/go/aiplatform v1.35.0/go.mod h1:7MFT/vCaOyZT/4IIFfxH4ErVg/4ku6lKv3w0+tFTgXQ=
-cloud.google.com/go/analytics v0.11.0/go.mod h1:DjEWCu41bVbYcKyvlws9Er60YE4a//bK6mnhWvQeFNI=
-cloud.google.com/go/analytics v0.12.0/go.mod h1:gkfj9h6XRf9+TS4bmuhPEShsh3hH8PAZzm/41OOhQd4=
-cloud.google.com/go/analytics v0.18.0/go.mod h1:ZkeHGQlcIPkw0R/GW+boWHhCOR43xz9RN/jn7WcqfIE=
-cloud.google.com/go/apigateway v1.3.0/go.mod h1:89Z8Bhpmxu6AmUxuVRg/ECRGReEdiP3vQtk4Z1J9rJk=
-cloud.google.com/go/apigateway v1.4.0/go.mod h1:pHVY9MKGaH9PQ3pJ4YLzoj6U5FUDeDFBllIz7WmzJoc=
-cloud.google.com/go/apigateway v1.5.0/go.mod h1:GpnZR3Q4rR7LVu5951qfXPJCHquZt02jf7xQx7kpqN8=
-cloud.google.com/go/apigeeconnect v1.3.0/go.mod h1:G/AwXFAKo0gIXkPTVfZDd2qA1TxBXJ3MgMRBQkIi9jc=
-cloud.google.com/go/apigeeconnect v1.4.0/go.mod h1:kV4NwOKqjvt2JYR0AoIWo2QGfoRtn/pkS3QlHp0Ni04=
-cloud.google.com/go/apigeeconnect v1.5.0/go.mod h1:KFaCqvBRU6idyhSNyn3vlHXc8VMDJdRmwDF6JyFRqZ8=
-cloud.google.com/go/apigeeregistry v0.4.0/go.mod h1:EUG4PGcsZvxOXAdyEghIdXwAEi/4MEaoqLMLDMIwKXY=
-cloud.google.com/go/apigeeregistry v0.5.0/go.mod h1:YR5+s0BVNZfVOUkMa5pAR2xGd0A473vA5M7j247o1wM=
-cloud.google.com/go/apikeys v0.4.0/go.mod h1:XATS/yqZbaBK0HOssf+ALHp8jAlNHUgyfprvNcBIszU=
-cloud.google.com/go/apikeys v0.5.0/go.mod h1:5aQfwY4D+ewMMWScd3hm2en3hCj+BROlyrt3ytS7KLI=
-cloud.google.com/go/appengine v1.4.0/go.mod h1:CS2NhuBuDXM9f+qscZ6V86m1MIIqPj3WC/UoEuR1Sno=
-cloud.google.com/go/appengine v1.5.0/go.mod h1:TfasSozdkFI0zeoxW3PTBLiNqRmzraodCWatWI9Dmak=
-cloud.google.com/go/appengine v1.6.0/go.mod h1:hg6i0J/BD2cKmDJbaFSYHFyZkgBEfQrDg/X0V5fJn84=
-cloud.google.com/go/area120 v0.5.0/go.mod h1:DE/n4mp+iqVyvxHN41Vf1CR602GiHQjFPusMFW6bGR4=
-cloud.google.com/go/area120 v0.6.0/go.mod h1:39yFJqWVgm0UZqWTOdqkLhjoC7uFfgXRC8g/ZegeAh0=
-cloud.google.com/go/area120 v0.7.1/go.mod h1:j84i4E1RboTWjKtZVWXPqvK5VHQFJRF2c1Nm69pWm9k=
-cloud.google.com/go/artifactregistry v1.6.0/go.mod h1:IYt0oBPSAGYj/kprzsBjZ/4LnG/zOcHyFHjWPCi6SAQ=
-cloud.google.com/go/artifactregistry v1.7.0/go.mod h1:mqTOFOnGZx8EtSqK/ZWcsm/4U8B77rbcLP6ruDU2Ixk=
-cloud.google.com/go/artifactregistry v1.8.0/go.mod h1:w3GQXkJX8hiKN0v+at4b0qotwijQbYUqF2GWkZzAhC0=
-cloud.google.com/go/artifactregistry v1.9.0/go.mod h1:2K2RqvA2CYvAeARHRkLDhMDJ3OXy26h3XW+3/Jh2uYc=
-cloud.google.com/go/artifactregistry v1.11.2/go.mod h1:nLZns771ZGAwVLzTX/7Al6R9ehma4WUEhZGWV6CeQNQ=
-cloud.google.com/go/asset v1.5.0/go.mod h1:5mfs8UvcM5wHhqtSv8J1CtxxaQq3AdBxxQi2jGW/K4o=
-cloud.google.com/go/asset v1.7.0/go.mod h1:YbENsRK4+xTiL+Ofoj5Ckf+O17kJtgp3Y3nn4uzZz5s=
-cloud.google.com/go/asset v1.8.0/go.mod h1:mUNGKhiqIdbr8X7KNayoYvyc4HbbFO9URsjbytpUaW0=
-cloud.google.com/go/asset v1.9.0/go.mod h1:83MOE6jEJBMqFKadM9NLRcs80Gdw76qGuHn8m3h8oHQ=
-cloud.google.com/go/asset v1.10.0/go.mod h1:pLz7uokL80qKhzKr4xXGvBQXnzHn5evJAEAtZiIb0wY=
-cloud.google.com/go/asset v1.11.1/go.mod h1:fSwLhbRvC9p9CXQHJ3BgFeQNM4c9x10lqlrdEUYXlJo=
-cloud.google.com/go/assuredworkloads v1.5.0/go.mod h1:n8HOZ6pff6re5KYfBXcFvSViQjDwxFkAkmUFffJRbbY=
-cloud.google.com/go/assuredworkloads v1.6.0/go.mod h1:yo2YOk37Yc89Rsd5QMVECvjaMKymF9OP+QXWlKXUkXw=
-cloud.google.com/go/assuredworkloads v1.7.0/go.mod h1:z/736/oNmtGAyU47reJgGN+KVoYoxeLBoj4XkKYscNI=
-cloud.google.com/go/assuredworkloads v1.8.0/go.mod h1:AsX2cqyNCOvEQC8RMPnoc0yEarXQk6WEKkxYfL6kGIo=
-cloud.google.com/go/assuredworkloads v1.9.0/go.mod h1:kFuI1P78bplYtT77Tb1hi0FMxM0vVpRC7VVoJC3ZoT0=
-cloud.google.com/go/assuredworkloads v1.10.0/go.mod h1:kwdUQuXcedVdsIaKgKTp9t0UJkE5+PAVNhdQm4ZVq2E=
-cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
-cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
+cloud.google.com/go/auth v0.23.2 h1:pxSCpfiji41hpzpPdMCftEUCezpgpqmmDdYiAjCKXxo=
+cloud.google.com/go/auth v0.23.2/go.mod h1:4DhBRcqvtljQN3dJ57qtqbib5ZGCYE5f2crfiiC2EM0=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
-cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
-cloud.google.com/go/automl v1.6.0/go.mod h1:ugf8a6Fx+zP0D59WLhqgTDsQI9w07o64uf/Is3Nh5p8=
-cloud.google.com/go/automl v1.7.0/go.mod h1:RL9MYCCsJEOmt0Wf3z9uzG0a7adTT1fe+aObgSpkCt8=
-cloud.google.com/go/automl v1.8.0/go.mod h1:xWx7G/aPEe/NP+qzYXktoBSDfjO+vnKMGgsApGJJquM=
-cloud.google.com/go/automl v1.12.0/go.mod h1:tWDcHDp86aMIuHmyvjuKeeHEGq76lD7ZqfGLN6B0NuU=
-cloud.google.com/go/baremetalsolution v0.3.0/go.mod h1:XOrocE+pvK1xFfleEnShBlNAXf+j5blPPxrhjKgnIFc=
-cloud.google.com/go/baremetalsolution v0.4.0/go.mod h1:BymplhAadOO/eBa7KewQ0Ppg4A4Wplbn+PsFKRLo0uI=
-cloud.google.com/go/baremetalsolution v0.5.0/go.mod h1:dXGxEkmR9BMwxhzBhV0AioD0ULBmuLZI8CdwalUxuss=
-cloud.google.com/go/batch v0.3.0/go.mod h1:TR18ZoAekj1GuirsUsR1ZTKN3FC/4UDnScjT8NXImFE=
-cloud.google.com/go/batch v0.4.0/go.mod h1:WZkHnP43R/QCGQsZ+0JyG4i79ranE2u8xvjq/9+STPE=
-cloud.google.com/go/batch v0.7.0/go.mod h1:vLZN95s6teRUqRQ4s3RLDsH8PvboqBK+rn1oevL159g=
-cloud.google.com/go/beyondcorp v0.2.0/go.mod h1:TB7Bd+EEtcw9PCPQhCJtJGjk/7TC6ckmnSFS+xwTfm4=
-cloud.google.com/go/beyondcorp v0.3.0/go.mod h1:E5U5lcrcXMsCuoDNyGrpyTm/hn7ne941Jz2vmksAxW8=
-cloud.google.com/go/beyondcorp v0.4.0/go.mod h1:3ApA0mbhHx6YImmuubf5pyW8srKnCEPON32/5hj+RmM=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/bigquery v1.42.0/go.mod h1:8dRTJxhtG+vwBKzE5OseQn/hiydoQN3EedCaOdYmxRA=
-cloud.google.com/go/bigquery v1.43.0/go.mod h1:ZMQcXHsl+xmU1z36G2jNGZmKp9zNY5BUua5wDgmNCfw=
-cloud.google.com/go/bigquery v1.44.0/go.mod h1:0Y33VqXTEsbamHJvJHdFmtqHvMIY28aK1+dFsvaChGc=
-cloud.google.com/go/bigquery v1.48.0/go.mod h1:QAwSz+ipNgfL5jxiaK7weyOhzdoAy1zFm0Nf1fysJac=
-cloud.google.com/go/billing v1.4.0/go.mod h1:g9IdKBEFlItS8bTtlrZdVLWSSdSyFUZKXNS02zKMOZY=
-cloud.google.com/go/billing v1.5.0/go.mod h1:mztb1tBc3QekhjSgmpf/CV4LzWXLzCArwpLmP2Gm88s=
-cloud.google.com/go/billing v1.6.0/go.mod h1:WoXzguj+BeHXPbKfNWkqVtDdzORazmCjraY+vrxcyvI=
-cloud.google.com/go/billing v1.7.0/go.mod h1:q457N3Hbj9lYwwRbnlD7vUpyjq6u5U1RAOArInEiD5Y=
-cloud.google.com/go/billing v1.12.0/go.mod h1:yKrZio/eu+okO/2McZEbch17O5CB5NpZhhXG6Z766ss=
-cloud.google.com/go/binaryauthorization v1.1.0/go.mod h1:xwnoWu3Y84jbuHa0zd526MJYmtnVXn0syOjaJgy4+dM=
-cloud.google.com/go/binaryauthorization v1.2.0/go.mod h1:86WKkJHtRcv5ViNABtYMhhNWRrD1Vpi//uKEy7aYEfI=
-cloud.google.com/go/binaryauthorization v1.3.0/go.mod h1:lRZbKgjDIIQvzYQS1p99A7/U1JqvqeZg0wiI5tp6tg0=
-cloud.google.com/go/binaryauthorization v1.4.0/go.mod h1:tsSPQrBd77VLplV70GUhBf/Zm3FsKmgSqgm4UmiDItk=
-cloud.google.com/go/binaryauthorization v1.5.0/go.mod h1:OSe4OU1nN/VswXKRBmciKpo9LulY41gch5c68htf3/Q=
-cloud.google.com/go/certificatemanager v1.3.0/go.mod h1:n6twGDvcUBFu9uBgt4eYvvf3sQ6My8jADcOVwHmzadg=
-cloud.google.com/go/certificatemanager v1.4.0/go.mod h1:vowpercVFyqs8ABSmrdV+GiFf2H/ch3KyudYQEMM590=
-cloud.google.com/go/certificatemanager v1.6.0/go.mod h1:3Hh64rCKjRAX8dXgRAyOcY5vQ/fE1sh8o+Mdd6KPgY8=
-cloud.google.com/go/channel v1.8.0/go.mod h1:W5SwCXDJsq/rg3tn3oG0LOxpAo6IMxNa09ngphpSlnk=
-cloud.google.com/go/channel v1.9.0/go.mod h1:jcu05W0my9Vx4mt3/rEHpfxc9eKi9XwsdDL8yBMbKUk=
-cloud.google.com/go/channel v1.11.0/go.mod h1:IdtI0uWGqhEeatSB62VOoJ8FSUhJ9/+iGkJVqp74CGE=
-cloud.google.com/go/cloudbuild v1.3.0/go.mod h1:WequR4ULxlqvMsjDEEEFnOG5ZSRSgWOywXYDb1vPE6U=
-cloud.google.com/go/cloudbuild v1.4.0/go.mod h1:5Qwa40LHiOXmz3386FrjrYM93rM/hdRr7b53sySrTqA=
-cloud.google.com/go/cloudbuild v1.7.0/go.mod h1:zb5tWh2XI6lR9zQmsm1VRA+7OCuve5d8S+zJUul8KTg=
-cloud.google.com/go/clouddms v1.3.0/go.mod h1:oK6XsCDdW4Ib3jCCBugx+gVjevp2TMXFtgxvPSee3OM=
-cloud.google.com/go/clouddms v1.4.0/go.mod h1:Eh7sUGCC+aKry14O1NRljhjyrr0NFC0G2cjwX0cByRk=
-cloud.google.com/go/clouddms v1.5.0/go.mod h1:QSxQnhikCLUw13iAbffF2CZxAER3xDGNHjsTAkQJcQA=
-cloud.google.com/go/cloudtasks v1.5.0/go.mod h1:fD92REy1x5woxkKEkLdvavGnPJGEn8Uic9nWuLzqCpY=
-cloud.google.com/go/cloudtasks v1.6.0/go.mod h1:C6Io+sxuke9/KNRkbQpihnW93SWDU3uXt92nu85HkYI=
-cloud.google.com/go/cloudtasks v1.7.0/go.mod h1:ImsfdYWwlWNJbdgPIIGJWC+gemEGTBK/SunNQQNCAb4=
-cloud.google.com/go/cloudtasks v1.8.0/go.mod h1:gQXUIwCSOI4yPVK7DgTVFiiP0ZW/eQkydWzwVMdHxrI=
-cloud.google.com/go/cloudtasks v1.9.0/go.mod h1:w+EyLsVkLWHcOaqNEyvcKAsWp9p29dL6uL9Nst1cI7Y=
-cloud.google.com/go/compute v0.1.0/go.mod h1:GAesmwr110a34z04OlxYkATPBEfVhkymfTBXtfbBFow=
-cloud.google.com/go/compute v1.3.0/go.mod h1:cCZiE1NHEtai4wiufUhW8I8S1JKkAnhnQJWM7YD99wM=
-cloud.google.com/go/compute v1.5.0/go.mod h1:9SMHyhJlzhlkJqrPAc839t2BZFTSk6Jdj6mkzQJeu0M=
-cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz/FMzPu0s=
-cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
-cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
-cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
-cloud.google.com/go/compute v1.12.0/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU=
-cloud.google.com/go/compute v1.12.1/go.mod h1:e8yNOBcBONZU1vJKCvCoDw/4JQsA0dpM4x/6PIIOocU=
-cloud.google.com/go/compute v1.13.0/go.mod h1:5aPTS0cUNMIc1CE546K+Th6weJUNQErARyZtRXDJ8GE=
-cloud.google.com/go/compute v1.14.0/go.mod h1:YfLtxrj9sU4Yxv+sXzZkyPjEyPBZfXHUvjxega5vAdo=
-cloud.google.com/go/compute v1.15.1/go.mod h1:bjjoF/NtFUrkD/urWfdHaKuOPDR5nWIs63rR+SXhcpA=
-cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
-cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
-cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
-cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
 cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
-cloud.google.com/go/contactcenterinsights v1.3.0/go.mod h1:Eu2oemoePuEFc/xKFPjbTuPSj0fYJcPls9TFlPNnHHY=
-cloud.google.com/go/contactcenterinsights v1.4.0/go.mod h1:L2YzkGbPsv+vMQMCADxJoT9YiTTnSEd6fEvCeHTYVck=
-cloud.google.com/go/contactcenterinsights v1.6.0/go.mod h1:IIDlT6CLcDoyv79kDv8iWxMSTZhLxSCofVV5W6YFM/w=
-cloud.google.com/go/container v1.6.0/go.mod h1:Xazp7GjJSeUYo688S+6J5V+n/t+G5sKBTFkKNudGRxg=
-cloud.google.com/go/container v1.7.0/go.mod h1:Dp5AHtmothHGX3DwwIHPgq45Y8KmNsgN3amoYfxVkLo=
-cloud.google.com/go/container v1.13.1/go.mod h1:6wgbMPeQRw9rSnKBCAJXnds3Pzj03C4JHamr8asWKy4=
-cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I=
-cloud.google.com/go/containeranalysis v0.6.0/go.mod h1:HEJoiEIu+lEXM+k7+qLCci0h33lX3ZqoYFdmPcoO7s4=
-cloud.google.com/go/containeranalysis v0.7.0/go.mod h1:9aUL+/vZ55P2CXfuZjS4UjQ9AgXoSw8Ts6lemfmxBxI=
-cloud.google.com/go/datacatalog v1.3.0/go.mod h1:g9svFY6tuR+j+hrTw3J2dNcmI0dzmSiyOzm8kpLq0a0=
-cloud.google.com/go/datacatalog v1.5.0/go.mod h1:M7GPLNQeLfWqeIm3iuiruhPzkt65+Bx8dAKvScX8jvs=
-cloud.google.com/go/datacatalog v1.6.0/go.mod h1:+aEyF8JKg+uXcIdAmmaMUmZ3q1b/lKLtXCmXdnc0lbc=
-cloud.google.com/go/datacatalog v1.7.0/go.mod h1:9mEl4AuDYWw81UGc41HonIHH7/sn52H0/tc8f8ZbZIE=
-cloud.google.com/go/datacatalog v1.8.0/go.mod h1:KYuoVOv9BM8EYz/4eMFxrr4DUKhGIOXxZoKYF5wdISM=
-cloud.google.com/go/datacatalog v1.8.1/go.mod h1:RJ58z4rMp3gvETA465Vg+ag8BGgBdnRPEMMSTr5Uv+M=
-cloud.google.com/go/datacatalog v1.12.0/go.mod h1:CWae8rFkfp6LzLumKOnmVh4+Zle4A3NXLzVJ1d1mRm0=
-cloud.google.com/go/dataflow v0.6.0/go.mod h1:9QwV89cGoxjjSR9/r7eFDqqjtvbKxAK2BaYU6PVk9UM=
-cloud.google.com/go/dataflow v0.7.0/go.mod h1:PX526vb4ijFMesO1o202EaUmouZKBpjHsTlCtB4parQ=
-cloud.google.com/go/dataflow v0.8.0/go.mod h1:Rcf5YgTKPtQyYz8bLYhFoIV/vP39eL7fWNcSOyFfLJE=
-cloud.google.com/go/dataform v0.3.0/go.mod h1:cj8uNliRlHpa6L3yVhDOBrUXH+BPAO1+KFMQQNSThKo=
-cloud.google.com/go/dataform v0.4.0/go.mod h1:fwV6Y4Ty2yIFL89huYlEkwUPtS7YZinZbzzj5S9FzCE=
-cloud.google.com/go/dataform v0.5.0/go.mod h1:GFUYRe8IBa2hcomWplodVmUx/iTL0FrsauObOM3Ipr0=
-cloud.google.com/go/dataform v0.6.0/go.mod h1:QPflImQy33e29VuapFdf19oPbE4aYTJxr31OAPV+ulA=
-cloud.google.com/go/datafusion v1.4.0/go.mod h1:1Zb6VN+W6ALo85cXnM1IKiPw+yQMKMhB9TsTSRDo/38=
-cloud.google.com/go/datafusion v1.5.0/go.mod h1:Kz+l1FGHB0J+4XF2fud96WMmRiq/wj8N9u007vyXZ2w=
-cloud.google.com/go/datafusion v1.6.0/go.mod h1:WBsMF8F1RhSXvVM8rCV3AeyWVxcC2xY6vith3iw3S+8=
-cloud.google.com/go/datalabeling v0.5.0/go.mod h1:TGcJ0G2NzcsXSE/97yWjIZO0bXj0KbVlINXMG9ud42I=
-cloud.google.com/go/datalabeling v0.6.0/go.mod h1:WqdISuk/+WIGeMkpw/1q7bK/tFEZxsrFJOJdY2bXvTQ=
-cloud.google.com/go/datalabeling v0.7.0/go.mod h1:WPQb1y08RJbmpM3ww0CSUAGweL0SxByuW2E+FU+wXcM=
-cloud.google.com/go/dataplex v1.3.0/go.mod h1:hQuRtDg+fCiFgC8j0zV222HvzFQdRd+SVX8gdmFcZzA=
-cloud.google.com/go/dataplex v1.4.0/go.mod h1:X51GfLXEMVJ6UN47ESVqvlsRplbLhcsAt0kZCCKsU0A=
-cloud.google.com/go/dataplex v1.5.2/go.mod h1:cVMgQHsmfRoI5KFYq4JtIBEUbYwc3c7tXmIDhRmNNVQ=
-cloud.google.com/go/dataproc v1.7.0/go.mod h1:CKAlMjII9H90RXaMpSxQ8EU6dQx6iAYNPcYPOkSbi8s=
-cloud.google.com/go/dataproc v1.8.0/go.mod h1:5OW+zNAH0pMpw14JVrPONsxMQYMBqJuzORhIBfBn9uI=
-cloud.google.com/go/dataproc v1.12.0/go.mod h1:zrF3aX0uV3ikkMz6z4uBbIKyhRITnxvr4i3IjKsKrw4=
-cloud.google.com/go/dataqna v0.5.0/go.mod h1:90Hyk596ft3zUQ8NkFfvICSIfHFh1Bc7C4cK3vbhkeo=
-cloud.google.com/go/dataqna v0.6.0/go.mod h1:1lqNpM7rqNLVgWBJyk5NF6Uen2PHym0jtVJonplVsDA=
-cloud.google.com/go/dataqna v0.7.0/go.mod h1:Lx9OcIIeqCrw1a6KdO3/5KMP1wAmTc0slZWwP12Qq3c=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/datastore v1.10.0/go.mod h1:PC5UzAmDEkAmkfaknstTYbNpgE49HAgW2J1gcgUfmdM=
-cloud.google.com/go/datastream v1.2.0/go.mod h1:i/uTP8/fZwgATHS/XFu0TcNUhuA0twZxxQ3EyCUQMwo=
-cloud.google.com/go/datastream v1.3.0/go.mod h1:cqlOX8xlyYF/uxhiKn6Hbv6WjwPPuI9W2M9SAXwaLLQ=
-cloud.google.com/go/datastream v1.4.0/go.mod h1:h9dpzScPhDTs5noEMQVWP8Wx8AFBRyS0s8KWPx/9r0g=
-cloud.google.com/go/datastream v1.5.0/go.mod h1:6TZMMNPwjUqZHBKPQ1wwXpb0d5VDVPl2/XoS5yi88q4=
-cloud.google.com/go/datastream v1.6.0/go.mod h1:6LQSuswqLa7S4rPAOZFVjHIG3wJIjZcZrw8JDEDJuIs=
-cloud.google.com/go/deploy v1.4.0/go.mod h1:5Xghikd4VrmMLNaF6FiRFDlHb59VM59YoDQnOUdsH/c=
-cloud.google.com/go/deploy v1.5.0/go.mod h1:ffgdD0B89tToyW/U/D2eL0jN2+IEV/3EMuXHA0l4r+s=
-cloud.google.com/go/deploy v1.6.0/go.mod h1:f9PTHehG/DjCom3QH0cntOVRm93uGBDt2vKzAPwpXQI=
-cloud.google.com/go/dialogflow v1.15.0/go.mod h1:HbHDWs33WOGJgn6rfzBW1Kv807BE3O1+xGbn59zZWI4=
-cloud.google.com/go/dialogflow v1.16.1/go.mod h1:po6LlzGfK+smoSmTBnbkIZY2w8ffjz/RcGSS+sh1el0=
-cloud.google.com/go/dialogflow v1.17.0/go.mod h1:YNP09C/kXA1aZdBgC/VtXX74G/TKn7XVCcVumTflA+8=
-cloud.google.com/go/dialogflow v1.18.0/go.mod h1:trO7Zu5YdyEuR+BhSNOqJezyFQ3aUzz0njv7sMx/iek=
-cloud.google.com/go/dialogflow v1.19.0/go.mod h1:JVmlG1TwykZDtxtTXujec4tQ+D8SBFMoosgy+6Gn0s0=
-cloud.google.com/go/dialogflow v1.29.0/go.mod h1:b+2bzMe+k1s9V+F2jbJwpHPzrnIyHihAdRFMtn2WXuM=
-cloud.google.com/go/dialogflow v1.31.0/go.mod h1:cuoUccuL1Z+HADhyIA7dci3N5zUssgpBJmCzI6fNRB4=
-cloud.google.com/go/dlp v1.6.0/go.mod h1:9eyB2xIhpU0sVwUixfBubDoRwP+GjeUoxxeueZmqvmM=
-cloud.google.com/go/dlp v1.7.0/go.mod h1:68ak9vCiMBjbasxeVD17hVPxDEck+ExiHavX8kiHG+Q=
-cloud.google.com/go/dlp v1.9.0/go.mod h1:qdgmqgTyReTz5/YNSSuueR8pl7hO0o9bQ39ZhtgkWp4=
-cloud.google.com/go/documentai v1.7.0/go.mod h1:lJvftZB5NRiFSX4moiye1SMxHx0Bc3x1+p9e/RfXYiU=
-cloud.google.com/go/documentai v1.8.0/go.mod h1:xGHNEB7CtsnySCNrCFdCyyMz44RhFEEX2Q7UD0c5IhU=
-cloud.google.com/go/documentai v1.9.0/go.mod h1:FS5485S8R00U10GhgBC0aNGrJxBP8ZVpEeJ7PQDZd6k=
-cloud.google.com/go/documentai v1.10.0/go.mod h1:vod47hKQIPeCfN2QS/jULIvQTugbmdc0ZvxxfQY1bg4=
-cloud.google.com/go/documentai v1.16.0/go.mod h1:o0o0DLTEZ+YnJZ+J4wNfTxmDVyrkzFvttBXXtYRMHkM=
-cloud.google.com/go/domains v0.6.0/go.mod h1:T9Rz3GasrpYk6mEGHh4rymIhjlnIuB4ofT1wTxDeT4Y=
-cloud.google.com/go/domains v0.7.0/go.mod h1:PtZeqS1xjnXuRPKE/88Iru/LdfoRyEHYA9nFQf4UKpg=
-cloud.google.com/go/domains v0.8.0/go.mod h1:M9i3MMDzGFXsydri9/vW+EWz9sWb4I6WyHqdlAk0idE=
-cloud.google.com/go/edgecontainer v0.1.0/go.mod h1:WgkZ9tp10bFxqO8BLPqv2LlfmQF1X8lZqwW4r1BTajk=
-cloud.google.com/go/edgecontainer v0.2.0/go.mod h1:RTmLijy+lGpQ7BXuTDa4C4ssxyXT34NIuHIgKuP4s5w=
-cloud.google.com/go/edgecontainer v0.3.0/go.mod h1:FLDpP4nykgwwIfcLt6zInhprzw0lEi2P1fjO6Ie0qbc=
-cloud.google.com/go/errorreporting v0.3.0/go.mod h1:xsP2yaAp+OAW4OIm60An2bbLpqIhKXdWR/tawvl7QzU=
-cloud.google.com/go/essentialcontacts v1.3.0/go.mod h1:r+OnHa5jfj90qIfZDO/VztSFqbQan7HV75p8sA+mdGI=
-cloud.google.com/go/essentialcontacts v1.4.0/go.mod h1:8tRldvHYsmnBCHdFpvU+GL75oWiBKl80BiqlFh9tp+8=
-cloud.google.com/go/essentialcontacts v1.5.0/go.mod h1:ay29Z4zODTuwliK7SnX8E86aUF2CTzdNtvv42niCX0M=
-cloud.google.com/go/eventarc v1.7.0/go.mod h1:6ctpF3zTnaQCxUjHUdcfgcA1A2T309+omHZth7gDfmc=
-cloud.google.com/go/eventarc v1.8.0/go.mod h1:imbzxkyAU4ubfsaKYdQg04WS1NvncblHEup4kvF+4gw=
-cloud.google.com/go/eventarc v1.10.0/go.mod h1:u3R35tmZ9HvswGRBnF48IlYgYeBcPUCjkr4BTdem2Kw=
-cloud.google.com/go/filestore v1.3.0/go.mod h1:+qbvHGvXU1HaKX2nD0WEPo92TP/8AQuCVEBXNY9z0+w=
-cloud.google.com/go/filestore v1.4.0/go.mod h1:PaG5oDfo9r224f8OYXURtAsY+Fbyq/bLYoINEK8XQAI=
-cloud.google.com/go/filestore v1.5.0/go.mod h1:FqBXDWBp4YLHqRnVGveOkHDf8svj9r5+mUDLupOWEDs=
-cloud.google.com/go/firestore v1.9.0/go.mod h1:HMkjKHNTtRyZNiMzu7YAsLr9K3X2udY2AMwDaMEQiiE=
-cloud.google.com/go/functions v1.6.0/go.mod h1:3H1UA3qiIPRWD7PeZKLvHZ9SaQhR26XIJcC0A5GbvAk=
-cloud.google.com/go/functions v1.7.0/go.mod h1:+d+QBcWM+RsrgZfV9xo6KfA1GlzJfxcfZcRPEhDDfzg=
-cloud.google.com/go/functions v1.8.0/go.mod h1:RTZ4/HsQjIqIYP9a9YPbU+QFoQsAlYgrwOXJWHn1POY=
-cloud.google.com/go/functions v1.9.0/go.mod h1:Y+Dz8yGguzO3PpIjhLTbnqV1CWmgQ5UwtlpzoyquQ08=
-cloud.google.com/go/functions v1.10.0/go.mod h1:0D3hEOe3DbEvCXtYOZHQZmD+SzYsi1YbI7dGvHfldXw=
-cloud.google.com/go/gaming v1.5.0/go.mod h1:ol7rGcxP/qHTRQE/RO4bxkXq+Fix0j6D4LFPzYTIrDM=
-cloud.google.com/go/gaming v1.6.0/go.mod h1:YMU1GEvA39Qt3zWGyAVA9bpYz/yAhTvaQ1t2sK4KPUA=
-cloud.google.com/go/gaming v1.7.0/go.mod h1:LrB8U7MHdGgFG851iHAfqUdLcKBdQ55hzXy9xBJz0+w=
-cloud.google.com/go/gaming v1.8.0/go.mod h1:xAqjS8b7jAVW0KFYeRUxngo9My3f33kFmua++Pi+ggM=
-cloud.google.com/go/gaming v1.9.0/go.mod h1:Fc7kEmCObylSWLO334NcO+O9QMDyz+TKC4v1D7X+Bc0=
-cloud.google.com/go/gkebackup v0.2.0/go.mod h1:XKvv/4LfG829/B8B7xRkk8zRrOEbKtEam6yNfuQNH60=
-cloud.google.com/go/gkebackup v0.3.0/go.mod h1:n/E671i1aOQvUxT541aTkCwExO/bTer2HDlj4TsBRAo=
-cloud.google.com/go/gkebackup v0.4.0/go.mod h1:byAyBGUwYGEEww7xsbnUTBHIYcOPy/PgUWUtOeRm9Vg=
-cloud.google.com/go/gkeconnect v0.5.0/go.mod h1:c5lsNAg5EwAy7fkqX/+goqFsU1Da/jQFqArp+wGNr/o=
-cloud.google.com/go/gkeconnect v0.6.0/go.mod h1:Mln67KyU/sHJEBY8kFZ0xTeyPtzbq9StAVvEULYK16A=
-cloud.google.com/go/gkeconnect v0.7.0/go.mod h1:SNfmVqPkaEi3bF/B3CNZOAYPYdg7sU+obZ+QTky2Myw=
-cloud.google.com/go/gkehub v0.9.0/go.mod h1:WYHN6WG8w9bXU0hqNxt8rm5uxnk8IH+lPY9J2TV7BK0=
-cloud.google.com/go/gkehub v0.10.0/go.mod h1:UIPwxI0DsrpsVoWpLB0stwKCP+WFVG9+y977wO+hBH0=
-cloud.google.com/go/gkehub v0.11.0/go.mod h1:JOWHlmN+GHyIbuWQPl47/C2RFhnFKH38jH9Ascu3n0E=
-cloud.google.com/go/gkemulticloud v0.3.0/go.mod h1:7orzy7O0S+5kq95e4Hpn7RysVA7dPs8W/GgfUtsPbrA=
-cloud.google.com/go/gkemulticloud v0.4.0/go.mod h1:E9gxVBnseLWCk24ch+P9+B2CoDFJZTyIgLKSalC7tuI=
-cloud.google.com/go/gkemulticloud v0.5.0/go.mod h1:W0JDkiyi3Tqh0TJr//y19wyb1yf8llHVto2Htf2Ja3Y=
-cloud.google.com/go/grafeas v0.2.0/go.mod h1:KhxgtF2hb0P191HlY5besjYm6MqTSTj3LSI+M+ByZHc=
-cloud.google.com/go/gsuiteaddons v1.3.0/go.mod h1:EUNK/J1lZEZO8yPtykKxLXI6JSVN2rg9bN8SXOa0bgM=
-cloud.google.com/go/gsuiteaddons v1.4.0/go.mod h1:rZK5I8hht7u7HxFQcFei0+AtfS9uSushomRlg+3ua1o=
-cloud.google.com/go/gsuiteaddons v1.5.0/go.mod h1:TFCClYLd64Eaa12sFVmUyG62tk4mdIsI7pAnSXRkcFo=
-cloud.google.com/go/iam v0.1.0/go.mod h1:vcUNEa0pEm0qRVpmWepWaFMIAI8/hjB9mO8rNCJtF6c=
-cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
-cloud.google.com/go/iam v0.5.0/go.mod h1:wPU9Vt0P4UmCux7mqtRu6jcpPAb74cP1fh50J3QpkUc=
-cloud.google.com/go/iam v0.6.0/go.mod h1:+1AH33ueBne5MzYccyMHtEKqLE4/kJOibtffMHDMFMc=
-cloud.google.com/go/iam v0.7.0/go.mod h1:H5Br8wRaDGNc8XP3keLc4unfUUZeyH3Sfl9XpQEYOeg=
-cloud.google.com/go/iam v0.8.0/go.mod h1:lga0/y3iH6CX7sYqypWJ33hf7kkfXJag67naqGESjkE=
-cloud.google.com/go/iam v0.11.0/go.mod h1:9PiLDanza5D+oWFZiH1uG+RnRCfEGKoyl6yo4cgWZGY=
-cloud.google.com/go/iam v0.12.0/go.mod h1:knyHGviacl11zrtZUoDuYpDgLjvr28sLQaG0YB2GYAY=
-cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM=
-cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4=
-cloud.google.com/go/iap v1.4.0/go.mod h1:RGFwRJdihTINIe4wZ2iCP0zF/qu18ZwyKxrhMhygBEc=
-cloud.google.com/go/iap v1.5.0/go.mod h1:UH/CGgKd4KyohZL5Pt0jSKE4m3FR51qg6FKQ/z/Ix9A=
-cloud.google.com/go/iap v1.6.0/go.mod h1:NSuvI9C/j7UdjGjIde7t7HBz+QTwBcapPE07+sSRcLk=
-cloud.google.com/go/ids v1.1.0/go.mod h1:WIuwCaYVOzHIj2OhN9HAwvW+DBdmUAdcWlFxRl+KubM=
-cloud.google.com/go/ids v1.2.0/go.mod h1:5WXvp4n25S0rA/mQWAg1YEEBBq6/s+7ml1RDCW1IrcY=
-cloud.google.com/go/ids v1.3.0/go.mod h1:JBdTYwANikFKaDP6LtW5JAi4gubs57SVNQjemdt6xV4=
-cloud.google.com/go/iot v1.3.0/go.mod h1:r7RGh2B61+B8oz0AGE+J72AhA0G7tdXItODWsaA2oLs=
-cloud.google.com/go/iot v1.4.0/go.mod h1:dIDxPOn0UvNDUMD8Ger7FIaTuvMkj+aGk94RPP0iV+g=
-cloud.google.com/go/iot v1.5.0/go.mod h1:mpz5259PDl3XJthEmh9+ap0affn/MqNSP4My77Qql9o=
-cloud.google.com/go/kms v1.4.0/go.mod h1:fajBHndQ+6ubNw6Ss2sSd+SWvjL26RNo/dr7uxsnnOA=
-cloud.google.com/go/kms v1.5.0/go.mod h1:QJS2YY0eJGBg3mnDfuaCyLauWwBJiHRboYxJ++1xJNg=
-cloud.google.com/go/kms v1.6.0/go.mod h1:Jjy850yySiasBUDi6KFUwUv2n1+o7QZFyuUJg6OgjA0=
-cloud.google.com/go/kms v1.9.0/go.mod h1:qb1tPTgfF9RQP8e1wq4cLFErVuTJv7UsSC915J8dh3w=
-cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE=
-cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U=
-cloud.google.com/go/language v1.4.0/go.mod h1:F9dRpNFQmJbkaop6g0JhSBXCNlO90e1KWx5iDdxbWic=
-cloud.google.com/go/language v1.6.0/go.mod h1:6dJ8t3B+lUYfStgls25GusK04NLh3eDLQnWM3mdEbhI=
-cloud.google.com/go/language v1.7.0/go.mod h1:DJ6dYN/W+SQOjF8e1hLQXMF21AkH2w9wiPzPCJa2MIE=
-cloud.google.com/go/language v1.8.0/go.mod h1:qYPVHf7SPoNNiCL2Dr0FfEFNil1qi3pQEyygwpgVKB8=
-cloud.google.com/go/language v1.9.0/go.mod h1:Ns15WooPM5Ad/5no/0n81yUetis74g3zrbeJBE+ptUY=
-cloud.google.com/go/lifesciences v0.5.0/go.mod h1:3oIKy8ycWGPUyZDR/8RNnTOYevhaMLqh5vLUXs9zvT8=
-cloud.google.com/go/lifesciences v0.6.0/go.mod h1:ddj6tSX/7BOnhxCSd3ZcETvtNr8NZ6t/iPhY2Tyfu08=
-cloud.google.com/go/lifesciences v0.8.0/go.mod h1:lFxiEOMqII6XggGbOnKiyZ7IBwoIqA84ClvoezaA/bo=
-cloud.google.com/go/logging v1.6.1/go.mod h1:5ZO0mHHbvm8gEmeEUHrmDlTDSu5imF6MUP9OfilNXBw=
-cloud.google.com/go/logging v1.7.0/go.mod h1:3xjP2CjkM3ZkO73aj4ASA5wRPGGCRrPIAeNqVNkzY8M=
-cloud.google.com/go/logging v1.18.0 h1:KhzZq+1cSkPH9YUaKLLhLtQxIHitVayBmk0sGfoM9+k=
-cloud.google.com/go/logging v1.18.0/go.mod h1:ZGKnpBaURITh+g/uom2VhbiFoFWvejcrHPDhxFtU/gI=
-cloud.google.com/go/longrunning v0.1.1/go.mod h1:UUFxuDWkv22EuY93jjmDMFT5GPQKeFVJBIF6QlTqdsE=
-cloud.google.com/go/longrunning v0.3.0/go.mod h1:qth9Y41RRSUE69rDcOn6DdK3HfQfsUI0YSmW3iIlLJc=
-cloud.google.com/go/longrunning v0.4.1/go.mod h1:4iWDqhBZ70CvZ6BfETbvam3T8FMvLK+eFj0E6AaRQTo=
+cloud.google.com/go/iam v1.13.0 h1:ufT3FPT5rFFXu6UtLkNoxaOaV5EuA1dsSkmemCSTo6U=
+cloud.google.com/go/iam v1.13.0/go.mod h1:gHXdDEiPDvqd1q1KwBDGQlgZY/BwY760zU2LhOZS5w0=
+cloud.google.com/go/kms v1.35.0 h1:nJ/ktaqspx1nPM9vIcO0SHbhqCAm8nvAxL1siuVgKm0=
+cloud.google.com/go/kms v1.35.0/go.mod h1:0++71pIHvJL+GmMa8K4jOWFq7gNOX3jm2PRMSJwTKJw=
+cloud.google.com/go/logging v1.19.1 h1:7SsLhyTDBDrJw+Ll6Ns3I2mByqHXvJUc3rGjSlwiWgU=
+cloud.google.com/go/logging v1.19.1/go.mod h1:2IkQ/d8jVJqV2qW8ZUGUiMjdZG1gkLD2JReGbZ8isqg=
 cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM=
 cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0=
-cloud.google.com/go/managedidentities v1.3.0/go.mod h1:UzlW3cBOiPrzucO5qWkNkh0w33KFtBJU281hacNvsdE=
-cloud.google.com/go/managedidentities v1.4.0/go.mod h1:NWSBYbEMgqmbZsLIyKvxrYbtqOsxY1ZrGM+9RgDqInM=
-cloud.google.com/go/managedidentities v1.5.0/go.mod h1:+dWcZ0JlUmpuxpIDfyP5pP5y0bLdRwOS4Lp7gMni/LA=
-cloud.google.com/go/maps v0.1.0/go.mod h1:BQM97WGyfw9FWEmQMpZ5T6cpovXXSd1cGmFma94eubI=
-cloud.google.com/go/maps v0.6.0/go.mod h1:o6DAMMfb+aINHz/p/jbcY+mYeXBoZoxTfdSQ8VAJaCw=
-cloud.google.com/go/mediatranslation v0.5.0/go.mod h1:jGPUhGTybqsPQn91pNXw0xVHfuJ3leR1wj37oU3y1f4=
-cloud.google.com/go/mediatranslation v0.6.0/go.mod h1:hHdBCTYNigsBxshbznuIMFNe5QXEowAuNmmC7h8pu5w=
-cloud.google.com/go/mediatranslation v0.7.0/go.mod h1:LCnB/gZr90ONOIQLgSXagp8XUW1ODs2UmUMvcgMfI2I=
-cloud.google.com/go/memcache v1.4.0/go.mod h1:rTOfiGZtJX1AaFUrOgsMHX5kAzaTQ8azHiuDoTPzNsE=
-cloud.google.com/go/memcache v1.5.0/go.mod h1:dk3fCK7dVo0cUU2c36jKb4VqKPS22BTkf81Xq617aWM=
-cloud.google.com/go/memcache v1.6.0/go.mod h1:XS5xB0eQZdHtTuTF9Hf8eJkKtR3pVRCcvJwtm68T3rA=
-cloud.google.com/go/memcache v1.7.0/go.mod h1:ywMKfjWhNtkQTxrWxCkCFkoPjLHPW6A7WOTVI8xy3LY=
-cloud.google.com/go/memcache v1.9.0/go.mod h1:8oEyzXCu+zo9RzlEaEjHl4KkgjlNDaXbCQeQWlzNFJM=
-cloud.google.com/go/metastore v1.5.0/go.mod h1:2ZNrDcQwghfdtCwJ33nM0+GrBGlVuh8rakL3vdPY3XY=
-cloud.google.com/go/metastore v1.6.0/go.mod h1:6cyQTls8CWXzk45G55x57DVQ9gWg7RiH65+YgPsNh9s=
-cloud.google.com/go/metastore v1.7.0/go.mod h1:s45D0B4IlsINu87/AsWiEVYbLaIMeUSoxlKKDqBGFS8=
-cloud.google.com/go/metastore v1.8.0/go.mod h1:zHiMc4ZUpBiM7twCIFQmJ9JMEkDSyZS9U12uf7wHqSI=
-cloud.google.com/go/metastore v1.10.0/go.mod h1:fPEnH3g4JJAk+gMRnrAnoqyv2lpUCqJPWOodSaf45Eo=
-cloud.google.com/go/monitoring v1.7.0/go.mod h1:HpYse6kkGo//7p6sT0wsIC6IBDET0RhIsnmlA53dvEk=
-cloud.google.com/go/monitoring v1.8.0/go.mod h1:E7PtoMJ1kQXWxPjB6mv2fhC5/15jInuulFdYYtlcvT4=
-cloud.google.com/go/monitoring v1.12.0/go.mod h1:yx8Jj2fZNEkL/GYZyTLS4ZtZEZN8WtDEiEqG4kLK50w=
-cloud.google.com/go/monitoring v1.29.0 h1:AHhDsFaSax1/4k+qlIDX/SDGe6hggnfXJ9dkgD9qBPY=
-cloud.google.com/go/monitoring v1.29.0/go.mod h1:72NOVjJXHY/HBfoLT0+qlCZBT059+9VXLeAnL2PeeVM=
-cloud.google.com/go/networkconnectivity v1.4.0/go.mod h1:nOl7YL8odKyAOtzNX73/M5/mGZgqqMeryi6UPZTk/rA=
-cloud.google.com/go/networkconnectivity v1.5.0/go.mod h1:3GzqJx7uhtlM3kln0+x5wyFvuVH1pIBJjhCpjzSt75o=
-cloud.google.com/go/networkconnectivity v1.6.0/go.mod h1:OJOoEXW+0LAxHh89nXd64uGG+FbQoeH8DtxCHVOMlaM=
-cloud.google.com/go/networkconnectivity v1.7.0/go.mod h1:RMuSbkdbPwNMQjB5HBWD5MpTBnNm39iAVpC3TmsExt8=
-cloud.google.com/go/networkconnectivity v1.10.0/go.mod h1:UP4O4sWXJG13AqrTdQCD9TnLGEbtNRqjuaaA7bNjF5E=
-cloud.google.com/go/networkmanagement v1.4.0/go.mod h1:Q9mdLLRn60AsOrPc8rs8iNV6OHXaGcDdsIQe1ohekq8=
-cloud.google.com/go/networkmanagement v1.5.0/go.mod h1:ZnOeZ/evzUdUsnvRt792H0uYEnHQEMaz+REhhzJRcf4=
-cloud.google.com/go/networkmanagement v1.6.0/go.mod h1:5pKPqyXjB/sgtvB5xqOemumoQNB7y95Q7S+4rjSOPYY=
-cloud.google.com/go/networksecurity v0.5.0/go.mod h1:xS6fOCoqpVC5zx15Z/MqkfDwH4+m/61A3ODiDV1xmiQ=
-cloud.google.com/go/networksecurity v0.6.0/go.mod h1:Q5fjhTr9WMI5mbpRYEbiexTzROf7ZbDzvzCrNl14nyU=
-cloud.google.com/go/networksecurity v0.7.0/go.mod h1:mAnzoxx/8TBSyXEeESMy9OOYwo1v+gZ5eMRnsT5bC8k=
-cloud.google.com/go/notebooks v1.2.0/go.mod h1:9+wtppMfVPUeJ8fIWPOq1UnATHISkGXGqTkxeieQ6UY=
-cloud.google.com/go/notebooks v1.3.0/go.mod h1:bFR5lj07DtCPC7YAAJ//vHskFBxA5JzYlH68kXVdk34=
-cloud.google.com/go/notebooks v1.4.0/go.mod h1:4QPMngcwmgb6uw7Po99B2xv5ufVoIQ7nOGDyL4P8AgA=
-cloud.google.com/go/notebooks v1.5.0/go.mod h1:q8mwhnP9aR8Hpfnrc5iN5IBhrXUy8S2vuYs+kBJ/gu0=
-cloud.google.com/go/notebooks v1.7.0/go.mod h1:PVlaDGfJgj1fl1S3dUwhFMXFgfYGhYQt2164xOMONmE=
-cloud.google.com/go/optimization v1.1.0/go.mod h1:5po+wfvX5AQlPznyVEZjGJTMr4+CAkJf2XSTQOOl9l4=
-cloud.google.com/go/optimization v1.2.0/go.mod h1:Lr7SOHdRDENsh+WXVmQhQTrzdu9ybg0NecjHidBq6xs=
-cloud.google.com/go/optimization v1.3.1/go.mod h1:IvUSefKiwd1a5p0RgHDbWCIbDFgKuEdB+fPPuP0IDLI=
-cloud.google.com/go/orchestration v1.3.0/go.mod h1:Sj5tq/JpWiB//X/q3Ngwdl5K7B7Y0KZ7bfv0wL6fqVA=
-cloud.google.com/go/orchestration v1.4.0/go.mod h1:6W5NLFWs2TlniBphAViZEVhrXRSMgUGDfW7vrWKvsBk=
-cloud.google.com/go/orchestration v1.6.0/go.mod h1:M62Bevp7pkxStDfFfTuCOaXgaaqRAga1yKyoMtEoWPQ=
-cloud.google.com/go/orgpolicy v1.4.0/go.mod h1:xrSLIV4RePWmP9P3tBl8S93lTmlAxjm06NSm2UTmKvE=
-cloud.google.com/go/orgpolicy v1.5.0/go.mod h1:hZEc5q3wzwXJaKrsx5+Ewg0u1LxJ51nNFlext7Tanwc=
-cloud.google.com/go/orgpolicy v1.10.0/go.mod h1:w1fo8b7rRqlXlIJbVhOMPrwVljyuW5mqssvBtU18ONc=
-cloud.google.com/go/osconfig v1.7.0/go.mod h1:oVHeCeZELfJP7XLxcBGTMBvRO+1nQ5tFG9VQTmYS2Fs=
-cloud.google.com/go/osconfig v1.8.0/go.mod h1:EQqZLu5w5XA7eKizepumcvWx+m8mJUhEwiPqWiZeEdg=
-cloud.google.com/go/osconfig v1.9.0/go.mod h1:Yx+IeIZJ3bdWmzbQU4fxNl8xsZ4amB+dygAwFPlvnNo=
-cloud.google.com/go/osconfig v1.10.0/go.mod h1:uMhCzqC5I8zfD9zDEAfvgVhDS8oIjySWh+l4WK6GnWw=
-cloud.google.com/go/osconfig v1.11.0/go.mod h1:aDICxrur2ogRd9zY5ytBLV89KEgT2MKB2L/n6x1ooPw=
-cloud.google.com/go/oslogin v1.4.0/go.mod h1:YdgMXWRaElXz/lDk1Na6Fh5orF7gvmJ0FGLIs9LId4E=
-cloud.google.com/go/oslogin v1.5.0/go.mod h1:D260Qj11W2qx/HVF29zBg+0fd6YCSjSqLUkY/qEenQU=
-cloud.google.com/go/oslogin v1.6.0/go.mod h1:zOJ1O3+dTU8WPlGEkFSh7qeHPPSoxrcMbbK1Nm2iX70=
-cloud.google.com/go/oslogin v1.7.0/go.mod h1:e04SN0xO1UNJ1M5GP0vzVBFicIe4O53FOfcixIqTyXo=
-cloud.google.com/go/oslogin v1.9.0/go.mod h1:HNavntnH8nzrn8JCTT5fj18FuJLFJc4NaZJtBnQtKFs=
-cloud.google.com/go/phishingprotection v0.5.0/go.mod h1:Y3HZknsK9bc9dMi+oE8Bim0lczMU6hrX0UpADuMefr0=
-cloud.google.com/go/phishingprotection v0.6.0/go.mod h1:9Y3LBLgy0kDTcYET8ZH3bq/7qni15yVUoAxiFxnlSUA=
-cloud.google.com/go/phishingprotection v0.7.0/go.mod h1:8qJI4QKHoda/sb/7/YmMQ2omRLSLYSu9bU0EKCNI+Lk=
-cloud.google.com/go/policytroubleshooter v1.3.0/go.mod h1:qy0+VwANja+kKrjlQuOzmlvscn4RNsAc0e15GGqfMxg=
-cloud.google.com/go/policytroubleshooter v1.4.0/go.mod h1:DZT4BcRw3QoO8ota9xw/LKtPa8lKeCByYeKTIf/vxdE=
-cloud.google.com/go/policytroubleshooter v1.5.0/go.mod h1:Rz1WfV+1oIpPdN2VvvuboLVRsB1Hclg3CKQ53j9l8vw=
-cloud.google.com/go/privatecatalog v0.5.0/go.mod h1:XgosMUvvPyxDjAVNDYxJ7wBW8//hLDDYmnsNcMGq1K0=
-cloud.google.com/go/privatecatalog v0.6.0/go.mod h1:i/fbkZR0hLN29eEWiiwue8Pb+GforiEIBnV9yrRUOKI=
-cloud.google.com/go/privatecatalog v0.7.0/go.mod h1:2s5ssIFO69F5csTXcwBP7NPFTZvps26xGzvQ2PQaBYg=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/pubsub v1.26.0/go.mod h1:QgBH3U/jdJy/ftjPhTkyXNj543Tin1pRYcdcPRnFIRI=
-cloud.google.com/go/pubsub v1.27.1/go.mod h1:hQN39ymbV9geqBnfQq6Xf63yNhUAhv9CZhzp5O6qsW0=
-cloud.google.com/go/pubsub v1.28.0/go.mod h1:vuXFpwaVoIPQMGXqRyUQigu/AX1S3IWugR9xznmcXX8=
-cloud.google.com/go/pubsub v1.51.0 h1:XOaCejsqX7EEtUdQz+WPag66wWsUUGliyCOfGPKfo90=
-cloud.google.com/go/pubsub v1.51.0/go.mod h1:NERXf11sd82UV3VnflcUj8POIyQUXT/QwrKlxD8di/I=
-cloud.google.com/go/pubsub/v2 v2.6.0 h1:8pjR0id+GTB+krKx5G6AGJoYrHog58w2Q89PCOrfM64=
-cloud.google.com/go/pubsub/v2 v2.6.0/go.mod h1:4anqvV/w8Pcgu2tO0qr2XgsF3GXHowzryfQ5gOnVmWY=
-cloud.google.com/go/pubsublite v1.5.0/go.mod h1:xapqNQ1CuLfGi23Yda/9l4bBCKz/wC3KIJ5gKcxveZg=
-cloud.google.com/go/pubsublite v1.6.0/go.mod h1:1eFCS0U11xlOuMFV/0iBqw3zP12kddMeCbj/F3FSj9k=
-cloud.google.com/go/recaptchaenterprise v1.3.1/go.mod h1:OdD+q+y4XGeAlxRaMn1Y7/GveP6zmq76byL6tjPE7d4=
-cloud.google.com/go/recaptchaenterprise/v2 v2.1.0/go.mod h1:w9yVqajwroDNTfGuhmOjPDN//rZGySaf6PtFVcSCa7o=
-cloud.google.com/go/recaptchaenterprise/v2 v2.2.0/go.mod h1:/Zu5jisWGeERrd5HnlS3EUGb/D335f9k51B/FVil0jk=
-cloud.google.com/go/recaptchaenterprise/v2 v2.3.0/go.mod h1:O9LwGCjrhGHBQET5CA7dd5NwwNQUErSgEDit1DLNTdo=
-cloud.google.com/go/recaptchaenterprise/v2 v2.4.0/go.mod h1:Am3LHfOuBstrLrNCBrlI5sbwx9LBg3te2N6hGvHn2mE=
-cloud.google.com/go/recaptchaenterprise/v2 v2.5.0/go.mod h1:O8LzcHXN3rz0j+LBC91jrwI3R+1ZSZEWrfL7XHgNo9U=
-cloud.google.com/go/recaptchaenterprise/v2 v2.6.0/go.mod h1:RPauz9jeLtB3JVzg6nCbe12qNoaa8pXc4d/YukAmcnA=
-cloud.google.com/go/recommendationengine v0.5.0/go.mod h1:E5756pJcVFeVgaQv3WNpImkFP8a+RptV6dDLGPILjvg=
-cloud.google.com/go/recommendationengine v0.6.0/go.mod h1:08mq2umu9oIqc7tDy8sx+MNJdLG0fUi3vaSVbztHgJ4=
-cloud.google.com/go/recommendationengine v0.7.0/go.mod h1:1reUcE3GIu6MeBz/h5xZJqNLuuVjNg1lmWMPyjatzac=
-cloud.google.com/go/recommender v1.5.0/go.mod h1:jdoeiBIVrJe9gQjwd759ecLJbxCDED4A6p+mqoqDvTg=
-cloud.google.com/go/recommender v1.6.0/go.mod h1:+yETpm25mcoiECKh9DEScGzIRyDKpZ0cEhWGo+8bo+c=
-cloud.google.com/go/recommender v1.7.0/go.mod h1:XLHs/W+T8olwlGOgfQenXBTbIseGclClff6lhFVe9Bs=
-cloud.google.com/go/recommender v1.8.0/go.mod h1:PkjXrTT05BFKwxaUxQmtIlrtj0kph108r02ZZQ5FE70=
-cloud.google.com/go/recommender v1.9.0/go.mod h1:PnSsnZY7q+VL1uax2JWkt/UegHssxjUVVCrX52CuEmQ=
-cloud.google.com/go/redis v1.7.0/go.mod h1:V3x5Jq1jzUcg+UNsRvdmsfuFnit1cfe3Z/PGyq/lm4Y=
-cloud.google.com/go/redis v1.8.0/go.mod h1:Fm2szCDavWzBk2cDKxrkmWBqoCiL1+Ctwq7EyqBCA/A=
-cloud.google.com/go/redis v1.9.0/go.mod h1:HMYQuajvb2D0LvMgZmLDZW8V5aOC/WxstZHiy4g8OiA=
-cloud.google.com/go/redis v1.10.0/go.mod h1:ThJf3mMBQtW18JzGgh41/Wld6vnDDc/F/F35UolRZPM=
-cloud.google.com/go/redis v1.11.0/go.mod h1:/X6eicana+BWcUda5PpwZC48o37SiFVTFSs0fWAJ7uQ=
-cloud.google.com/go/resourcemanager v1.3.0/go.mod h1:bAtrTjZQFJkiWTPDb1WBjzvc6/kifjj4QBYuKCCoqKA=
-cloud.google.com/go/resourcemanager v1.4.0/go.mod h1:MwxuzkumyTX7/a3n37gmsT3py7LIXwrShilPh3P1tR0=
-cloud.google.com/go/resourcemanager v1.5.0/go.mod h1:eQoXNAiAvCf5PXxWxXjhKQoTMaUSNrEfg+6qdf/wots=
-cloud.google.com/go/resourcesettings v1.3.0/go.mod h1:lzew8VfESA5DQ8gdlHwMrqZs1S9V87v3oCnKCWoOuQU=
-cloud.google.com/go/resourcesettings v1.4.0/go.mod h1:ldiH9IJpcrlC3VSuCGvjR5of/ezRrOxFtpJoJo5SmXg=
-cloud.google.com/go/resourcesettings v1.5.0/go.mod h1:+xJF7QSG6undsQDfsCJyqWXyBwUoJLhetkRMDRnIoXA=
-cloud.google.com/go/retail v1.8.0/go.mod h1:QblKS8waDmNUhghY2TI9O3JLlFk8jybHeV4BF19FrE4=
-cloud.google.com/go/retail v1.9.0/go.mod h1:g6jb6mKuCS1QKnH/dpu7isX253absFl6iE92nHwlBUY=
-cloud.google.com/go/retail v1.10.0/go.mod h1:2gDk9HsL4HMS4oZwz6daui2/jmKvqShXKQuB2RZ+cCc=
-cloud.google.com/go/retail v1.11.0/go.mod h1:MBLk1NaWPmh6iVFSz9MeKG/Psyd7TAgm6y/9L2B4x9Y=
-cloud.google.com/go/retail v1.12.0/go.mod h1:UMkelN/0Z8XvKymXFbD4EhFJlYKRx1FGhQkVPU5kF14=
-cloud.google.com/go/run v0.2.0/go.mod h1:CNtKsTA1sDcnqqIFR3Pb5Tq0usWxJJvsWOCPldRU3Do=
-cloud.google.com/go/run v0.3.0/go.mod h1:TuyY1+taHxTjrD0ZFk2iAR+xyOXEA0ztb7U3UNA0zBo=
-cloud.google.com/go/run v0.8.0/go.mod h1:VniEnuBwqjigv0A7ONfQUaEItaiCRVujlMqerPPiktM=
-cloud.google.com/go/scheduler v1.4.0/go.mod h1:drcJBmxF3aqZJRhmkHQ9b3uSSpQoltBPGPxGAWROx6s=
-cloud.google.com/go/scheduler v1.5.0/go.mod h1:ri073ym49NW3AfT6DZi21vLZrG07GXr5p3H1KxN5QlI=
-cloud.google.com/go/scheduler v1.6.0/go.mod h1:SgeKVM7MIwPn3BqtcBntpLyrIJftQISRrYB5ZtT+KOk=
-cloud.google.com/go/scheduler v1.7.0/go.mod h1:jyCiBqWW956uBjjPMMuX09n3x37mtyPJegEWKxRsn44=
-cloud.google.com/go/scheduler v1.8.0/go.mod h1:TCET+Y5Gp1YgHT8py4nlg2Sew8nUHMqcpousDgXJVQc=
-cloud.google.com/go/secretmanager v1.6.0/go.mod h1:awVa/OXF6IiyaU1wQ34inzQNc4ISIDIrId8qE5QGgKA=
-cloud.google.com/go/secretmanager v1.8.0/go.mod h1:hnVgi/bN5MYHd3Gt0SPuTPPp5ENina1/LxM+2W9U9J4=
-cloud.google.com/go/secretmanager v1.9.0/go.mod h1:b71qH2l1yHmWQHt9LC80akm86mX8AL6X1MA01dW8ht4=
-cloud.google.com/go/secretmanager v1.10.0/go.mod h1:MfnrdvKMPNra9aZtQFvBcvRU54hbPD8/HayQdlUgJpU=
-cloud.google.com/go/security v1.5.0/go.mod h1:lgxGdyOKKjHL4YG3/YwIL2zLqMFCKs0UbQwgyZmfJl4=
-cloud.google.com/go/security v1.7.0/go.mod h1:mZklORHl6Bg7CNnnjLH//0UlAlaXqiG7Lb9PsPXLfD0=
-cloud.google.com/go/security v1.8.0/go.mod h1:hAQOwgmaHhztFhiQ41CjDODdWP0+AE1B3sX4OFlq+GU=
-cloud.google.com/go/security v1.9.0/go.mod h1:6Ta1bO8LXI89nZnmnsZGp9lVoVWXqsVbIq/t9dzI+2Q=
-cloud.google.com/go/security v1.10.0/go.mod h1:QtOMZByJVlibUT2h9afNDWRZ1G96gVywH8T5GUSb9IA=
-cloud.google.com/go/security v1.12.0/go.mod h1:rV6EhrpbNHrrxqlvW0BWAIawFWq3X90SduMJdFwtLB8=
-cloud.google.com/go/securitycenter v1.13.0/go.mod h1:cv5qNAqjY84FCN6Y9z28WlkKXyWsgLO832YiWwkCWcU=
-cloud.google.com/go/securitycenter v1.14.0/go.mod h1:gZLAhtyKv85n52XYWt6RmeBdydyxfPeTrpToDPw4Auc=
-cloud.google.com/go/securitycenter v1.15.0/go.mod h1:PeKJ0t8MoFmmXLXWm41JidyzI3PJjd8sXWaVqg43WWk=
-cloud.google.com/go/securitycenter v1.16.0/go.mod h1:Q9GMaLQFUD+5ZTabrbujNWLtSLZIZF7SAR0wWECrjdk=
-cloud.google.com/go/securitycenter v1.18.1/go.mod h1:0/25gAzCM/9OL9vVx4ChPeM/+DlfGQJDwBy/UC8AKK0=
-cloud.google.com/go/servicecontrol v1.4.0/go.mod h1:o0hUSJ1TXJAmi/7fLJAedOovnujSEvjKCAFNXPQ1RaU=
-cloud.google.com/go/servicecontrol v1.5.0/go.mod h1:qM0CnXHhyqKVuiZnGKrIurvVImCs8gmqWsDoqe9sU1s=
-cloud.google.com/go/servicecontrol v1.11.0/go.mod h1:kFmTzYzTUIuZs0ycVqRHNaNhgR+UMUpw9n02l/pY+mc=
-cloud.google.com/go/servicedirectory v1.4.0/go.mod h1:gH1MUaZCgtP7qQiI+F+A+OpeKF/HQWgtAddhTbhL2bs=
-cloud.google.com/go/servicedirectory v1.5.0/go.mod h1:QMKFL0NUySbpZJ1UZs3oFAmdvVxhhxB6eJ/Vlp73dfg=
-cloud.google.com/go/servicedirectory v1.6.0/go.mod h1:pUlbnWsLH9c13yGkxCmfumWEPjsRs1RlmJ4pqiNjVL4=
-cloud.google.com/go/servicedirectory v1.7.0/go.mod h1:5p/U5oyvgYGYejufvxhgwjL8UVXjkuw7q5XcG10wx1U=
-cloud.google.com/go/servicedirectory v1.8.0/go.mod h1:srXodfhY1GFIPvltunswqXpVxFPpZjf8nkKQT7XcXaY=
-cloud.google.com/go/servicemanagement v1.4.0/go.mod h1:d8t8MDbezI7Z2R1O/wu8oTggo3BI2GKYbdG4y/SJTco=
-cloud.google.com/go/servicemanagement v1.5.0/go.mod h1:XGaCRe57kfqu4+lRxaFEAuqmjzF0r+gWHjWqKqBvKFo=
-cloud.google.com/go/servicemanagement v1.6.0/go.mod h1:aWns7EeeCOtGEX4OvZUWCCJONRZeFKiptqKf1D0l/Jc=
-cloud.google.com/go/serviceusage v1.3.0/go.mod h1:Hya1cozXM4SeSKTAgGXgj97GlqUvF5JaoXacR1JTP/E=
-cloud.google.com/go/serviceusage v1.4.0/go.mod h1:SB4yxXSaYVuUBYUml6qklyONXNLt83U0Rb+CXyhjEeU=
-cloud.google.com/go/serviceusage v1.5.0/go.mod h1:w8U1JvqUqwJNPEOTQjrMHkw3IaIFLoLsPLvsE3xueec=
-cloud.google.com/go/shell v1.3.0/go.mod h1:VZ9HmRjZBsjLGXusm7K5Q5lzzByZmJHf1d0IWHEN5X4=
-cloud.google.com/go/shell v1.4.0/go.mod h1:HDxPzZf3GkDdhExzD/gs8Grqk+dmYcEjGShZgYa9URw=
-cloud.google.com/go/shell v1.6.0/go.mod h1:oHO8QACS90luWgxP3N9iZVuEiSF84zNyLytb+qE2f9A=
-cloud.google.com/go/spanner v1.41.0/go.mod h1:MLYDBJR/dY4Wt7ZaMIQ7rXOTLjYrmxLE/5ve9vFfWos=
-cloud.google.com/go/spanner v1.44.0/go.mod h1:G8XIgYdOK+Fbcpbs7p2fiprDw4CaZX63whnSMLVBxjk=
-cloud.google.com/go/speech v1.6.0/go.mod h1:79tcr4FHCimOp56lwC01xnt/WPJZc4v3gzyT7FoBkCM=
-cloud.google.com/go/speech v1.7.0/go.mod h1:KptqL+BAQIhMsj1kOP2la5DSEEerPDuOP/2mmkhHhZQ=
-cloud.google.com/go/speech v1.8.0/go.mod h1:9bYIl1/tjsAnMgKGHKmBZzXKEkGgtU+MpdDPTE9f7y0=
-cloud.google.com/go/speech v1.9.0/go.mod h1:xQ0jTcmnRFFM2RfX/U+rk6FQNUF6DQlydUSyoooSpco=
-cloud.google.com/go/speech v1.14.1/go.mod h1:gEosVRPJ9waG7zqqnsHpYTOoAS4KouMRLDFMekpJ0J0=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
-cloud.google.com/go/storage v1.22.1/go.mod h1:S8N1cAStu7BOeFfE8KAQzmyyLkK8p/vmRq6kuBTW58Y=
-cloud.google.com/go/storage v1.23.0/go.mod h1:vOEEDNFnciUMhBeT6hsJIn3ieU5cFRmzeLgDvXzfIXc=
-cloud.google.com/go/storage v1.27.0/go.mod h1:x9DOL8TK/ygDUMieqwfhdpQryTeEkhGKMi80i/iqR2s=
-cloud.google.com/go/storage v1.28.1/go.mod h1:Qnisd4CqDdo6BGs2AD5LLnEsmSQ80wQ5ogcBBKhU86Y=
-cloud.google.com/go/storage v1.64.0 h1:KLpxI/oX9LxeRsNqn877d2WyeT3ryiEwnGt8pwcSPZg=
-cloud.google.com/go/storage v1.64.0/go.mod h1:lWyAtwvDZHdL3k68WVKbESP6bmWaV23ZJJ/JEVw/ZaQ=
-cloud.google.com/go/storagetransfer v1.5.0/go.mod h1:dxNzUopWy7RQevYFHewchb29POFv3/AaBgnhqzqiK0w=
-cloud.google.com/go/storagetransfer v1.6.0/go.mod h1:y77xm4CQV/ZhFZH75PLEXY0ROiS7Gh6pSKrM8dJyg6I=
-cloud.google.com/go/storagetransfer v1.7.0/go.mod h1:8Giuj1QNb1kfLAiWM1bN6dHzfdlDAVC9rv9abHot2W4=
-cloud.google.com/go/talent v1.1.0/go.mod h1:Vl4pt9jiHKvOgF9KoZo6Kob9oV4lwd/ZD5Cto54zDRw=
-cloud.google.com/go/talent v1.2.0/go.mod h1:MoNF9bhFQbiJ6eFD3uSsg0uBALw4n4gaCaEjBw9zo8g=
-cloud.google.com/go/talent v1.3.0/go.mod h1:CmcxwJ/PKfRgd1pBjQgU6W3YBwiewmUzQYH5HHmSCmM=
-cloud.google.com/go/talent v1.4.0/go.mod h1:ezFtAgVuRf8jRsvyE6EwmbTK5LKciD4KVnHuDEFmOOA=
-cloud.google.com/go/talent v1.5.0/go.mod h1:G+ODMj9bsasAEJkQSzO2uHQWXHHXUomArjWQQYkqK6c=
-cloud.google.com/go/texttospeech v1.4.0/go.mod h1:FX8HQHA6sEpJ7rCMSfXuzBcysDAuWusNNNvN9FELDd8=
-cloud.google.com/go/texttospeech v1.5.0/go.mod h1:oKPLhR4n4ZdQqWKURdwxMy0uiTS1xU161C8W57Wkea4=
-cloud.google.com/go/texttospeech v1.6.0/go.mod h1:YmwmFT8pj1aBblQOI3TfKmwibnsfvhIBzPXcW4EBovc=
-cloud.google.com/go/tpu v1.3.0/go.mod h1:aJIManG0o20tfDQlRIej44FcwGGl/cD0oiRyMKG19IQ=
-cloud.google.com/go/tpu v1.4.0/go.mod h1:mjZaX8p0VBgllCzF6wcU2ovUXN9TONFLd7iz227X2Xg=
-cloud.google.com/go/tpu v1.5.0/go.mod h1:8zVo1rYDFuW2l4yZVY0R0fb/v44xLh3llq7RuV61fPM=
-cloud.google.com/go/trace v1.3.0/go.mod h1:FFUE83d9Ca57C+K8rDl/Ih8LwOzWIV1krKgxg6N0G28=
-cloud.google.com/go/trace v1.4.0/go.mod h1:UG0v8UBqzusp+z63o7FK74SdFE+AXpCLdFb1rshXG+Y=
-cloud.google.com/go/trace v1.8.0/go.mod h1:zH7vcsbAhklH8hWFig58HvxcxyQbaIqMarMg9hn5ECA=
+cloud.google.com/go/monitoring v1.30.0 h1:r/d+JUbyKmJ8b07iznuKfzVzrIXTWxHQ3lBRm3x2LlY=
+cloud.google.com/go/monitoring v1.30.0/go.mod h1:htlUR0QWVMrjFzZmN4LGnMAve9xB/eduwjmINxVZ8RM=
+cloud.google.com/go/pubsub v1.51.1 h1:R3G1wCOxBO7jRpL8x2pdZMv1GAJDF6ax/m2zPOtvTNE=
+cloud.google.com/go/pubsub v1.51.1/go.mod h1:y2T0IKtW1iWwVvazYaRpqOAFO4gy2+O7dTDt9TWY/5U=
+cloud.google.com/go/pubsub/v2 v2.7.0 h1:MFrBTZZa6PDWZzCi4NJRsHKMm2w0a4oAaYNqwjgbQTE=
+cloud.google.com/go/pubsub/v2 v2.7.0/go.mod h1:JaFvWNVRk3Knoil/4M1ECeLOaI9D8drbmJWypQlK5aM=
+cloud.google.com/go/storage v1.67.0 h1:8xD3NvKuHE4c+b/kmSIVBdTc0BiOjplx+KecKGR9fr8=
+cloud.google.com/go/storage v1.67.0/go.mod h1:UsS9OgFg/XHOSYakQ8ZtLWWeyGkk1WnmD/GsGfN0BHM=
 cloud.google.com/go/trace v1.16.0 h1:GmQovzFc5F0CNfl0VLgL64aoTtu7xsM0YajW2GlG9+E=
 cloud.google.com/go/trace v1.16.0/go.mod h1:r+bdAn16dKLSV1G2D5v3e58IlQlizfxWrUfjx7kM7X0=
-cloud.google.com/go/translate v1.3.0/go.mod h1:gzMUwRjvOqj5i69y/LYLd8RrNQk+hOmIXTi9+nb3Djs=
-cloud.google.com/go/translate v1.4.0/go.mod h1:06Dn/ppvLD6WvA5Rhdp029IX2Mi3Mn7fpMRLPvXT5Wg=
-cloud.google.com/go/translate v1.6.0/go.mod h1:lMGRudH1pu7I3n3PETiOB2507gf3HnfLV8qlkHZEyos=
-cloud.google.com/go/video v1.8.0/go.mod h1:sTzKFc0bUSByE8Yoh8X0mn8bMymItVGPfTuUBUyRgxk=
-cloud.google.com/go/video v1.9.0/go.mod h1:0RhNKFRF5v92f8dQt0yhaHrEuH95m068JYOvLZYnJSw=
-cloud.google.com/go/video v1.13.0/go.mod h1:ulzkYlYgCp15N2AokzKjy7MQ9ejuynOJdf1tR5lGthk=
-cloud.google.com/go/videointelligence v1.6.0/go.mod h1:w0DIDlVRKtwPCn/C4iwZIJdvC69yInhW0cfi+p546uU=
-cloud.google.com/go/videointelligence v1.7.0/go.mod h1:k8pI/1wAhjznARtVT9U1llUaFNPh7muw8QyOUpavru4=
-cloud.google.com/go/videointelligence v1.8.0/go.mod h1:dIcCn4gVDdS7yte/w+koiXn5dWVplOZkE+xwG9FgK+M=
-cloud.google.com/go/videointelligence v1.9.0/go.mod h1:29lVRMPDYHikk3v8EdPSaL8Ku+eMzDljjuvRs105XoU=
-cloud.google.com/go/videointelligence v1.10.0/go.mod h1:LHZngX1liVtUhZvi2uNS0VQuOzNi2TkY1OakiuoUOjU=
-cloud.google.com/go/vision v1.2.0/go.mod h1:SmNwgObm5DpFBme2xpyOyasvBc1aPdjvMk2bBk0tKD0=
-cloud.google.com/go/vision/v2 v2.2.0/go.mod h1:uCdV4PpN1S0jyCyq8sIM42v2Y6zOLkZs+4R9LrGYwFo=
-cloud.google.com/go/vision/v2 v2.3.0/go.mod h1:UO61abBx9QRMFkNBbf1D8B1LXdS2cGiiCRx0vSpZoUo=
-cloud.google.com/go/vision/v2 v2.4.0/go.mod h1:VtI579ll9RpVTrdKdkMzckdnwMyX2JILb+MhPqRbPsY=
-cloud.google.com/go/vision/v2 v2.5.0/go.mod h1:MmaezXOOE+IWa+cS7OhRRLK2cNv1ZL98zhqFFZaaH2E=
-cloud.google.com/go/vision/v2 v2.6.0/go.mod h1:158Hes0MvOS9Z/bDMSFpjwsUrZ5fPrdwuyyvKSGAGMY=
-cloud.google.com/go/vmmigration v1.2.0/go.mod h1:IRf0o7myyWFSmVR1ItrBSFLFD/rJkfDCUTO4vLlJvsE=
-cloud.google.com/go/vmmigration v1.3.0/go.mod h1:oGJ6ZgGPQOFdjHuocGcLqX4lc98YQ7Ygq8YQwHh9A7g=
-cloud.google.com/go/vmmigration v1.5.0/go.mod h1:E4YQ8q7/4W9gobHjQg4JJSgXXSgY21nA5r8swQV+Xxc=
-cloud.google.com/go/vmwareengine v0.1.0/go.mod h1:RsdNEf/8UDvKllXhMz5J40XxDrNJNN4sagiox+OI208=
-cloud.google.com/go/vmwareengine v0.2.2/go.mod h1:sKdctNJxb3KLZkE/6Oui94iw/xs9PRNC2wnNLXsHvH8=
-cloud.google.com/go/vpcaccess v1.4.0/go.mod h1:aQHVbTWDYUR1EbTApSVvMq1EnT57ppDmQzZ3imqIk4w=
-cloud.google.com/go/vpcaccess v1.5.0/go.mod h1:drmg4HLk9NkZpGfCmZ3Tz0Bwnm2+DKqViEpeEpOq0m8=
-cloud.google.com/go/vpcaccess v1.6.0/go.mod h1:wX2ILaNhe7TlVa4vC5xce1bCnqE3AeH27RV31lnmZes=
-cloud.google.com/go/webrisk v1.4.0/go.mod h1:Hn8X6Zr+ziE2aNd8SliSDWpEnSS1u4R9+xXZmFiHmGE=
-cloud.google.com/go/webrisk v1.5.0/go.mod h1:iPG6fr52Tv7sGk0H6qUFzmL3HHZev1htXuWDEEsqMTg=
-cloud.google.com/go/webrisk v1.6.0/go.mod h1:65sW9V9rOosnc9ZY7A7jsy1zoHS5W9IAXv6dGqhMQMc=
-cloud.google.com/go/webrisk v1.7.0/go.mod h1:mVMHgEYH0r337nmt1JyLthzMr6YxwN1aAIEc2fTcq7A=
-cloud.google.com/go/webrisk v1.8.0/go.mod h1:oJPDuamzHXgUc+b8SiHRcVInZQuybnvEW72PqTc7sSg=
-cloud.google.com/go/websecurityscanner v1.3.0/go.mod h1:uImdKm2wyeXQevQJXeh8Uun/Ym1VqworNDlBXQevGMo=
-cloud.google.com/go/websecurityscanner v1.4.0/go.mod h1:ebit/Fp0a+FWu5j4JOmJEV8S8CzdTkAS77oDsiSqYWQ=
-cloud.google.com/go/websecurityscanner v1.5.0/go.mod h1:Y6xdCPy81yi0SQnDY1xdNTNpfY1oAgXUlcfN3B3eSng=
-cloud.google.com/go/workflows v1.6.0/go.mod h1:6t9F5h/unJz41YqfBmqSASJSXccBLtD1Vwf+KmJENM0=
-cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoISEXH2bcHC3M=
-cloud.google.com/go/workflows v1.8.0/go.mod h1:ysGhmEajwZxGn1OhGOGKsTXc5PyxOc0vfKf5Af+to4M=
-cloud.google.com/go/workflows v1.9.0/go.mod h1:ZGkj1aFIOd9c8Gerkjjq7OW7I5+l6cSvT3ujaO/WwSA=
-cloud.google.com/go/workflows v1.10.0/go.mod h1:fZ8LmRmZQWacon9UCX1r/g/DfAXx5VcPALq2CxzdePw=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
-git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.2 h1:utpeoEeZjd+A8J41zvoLsOOrqXHhX1Kx/X/tCW9dEYQ=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.2/go.mod h1:iptorS+VYKFL2N6PnebpS91dubG35eAOEERnT4PJbQU=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1/go.mod h1:oXtinPO4OLj9d1DOTrqrL1oRwGhcqadvAmrl6wTeGlk=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
@@ -567,61 +48,52 @@ github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1 h1:FbH3BbSb4bvGlu
 github.com/Azure/azure-sdk-for-go/sdk/keyvault/internal v0.7.1/go.mod h1:9V2j0jn9jDEkCkv8w/bKTNppX/d0FVA1ud77xCIP4KA=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1 h1:/Zt+cDPnpC3OVDm/JKLOs7M2DKmLRIIp3XIx9pHHiig=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.8.1/go.mod h1:Ng3urmn6dYe8gnbCMoHHVl5APYz2txho3koEkV2o2HA=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0 h1:irsmOWwkp0KCTTNS5e2hdFeIvSQClQo2No3IaNmL3Vw=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0/go.mod h1:GWcBkQj3MqN7ozHKLaCCAuNLiXoIGv2RtanfAwSjY/Y=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.2 h1:tQJdgQjbKKffEiMOKJmcQPkY01eFHRqWIZVefqP44nI=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.2/go.mod h1:kTkpJchXAdO7LGkKZP97a+Ou8TgaF4NT6MHwOIy5uSQ=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.7.0 h1:cuiKf1UVyWHu+XSQghPZR/qEF43JIcuk2CDqMlPiT6M=
 github.com/Azure/azure-sdk-for-go/sdk/storage/azfile v1.7.0/go.mod h1:9JSyvgXLPAOC4jfhgZg58XeU2FJHsGmxuYSclCFQ4ZY=
+github.com/Azure/azure-sdk-for-go/sdk/storage/internal v0.1.0 h1:X/bTwe0qpvmvPPutc+LWo7T4cKMqDP9JHP4k+Co9ZB4=
+github.com/Azure/azure-sdk-for-go/sdk/storage/internal v0.1.0/go.mod h1:+kX7ahyFelQ42F3RScM2CFgHJljp0phc/FieKLYVpFI=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
 github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
 github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM=
 github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=
-github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 h1:MDT4FxAPve5FnYn6vOL1r7RCRDG+l9cI7a5LlCuHsqA=
+github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Codefor/geohash v0.0.0-20140723084247-1b41c28e3a9d h1:iG9B49Q218F/XxXNRM7k/vWf7MKmLIS8AcJV9cGN4nA=
 github.com/Codefor/geohash v0.0.0-20140723084247-1b41c28e3a9d/go.mod h1:RVnhzAX71far8Kc3TQeA0k/dcaEKUnTDSOyet/JCmGI=
 github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
 github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
 github.com/DataDog/datadog-go v3.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/DataDog/zstd v1.5.2/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
-github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e h1:rd4bOvKmDIx0WeTv9Qz+hghsgyjikFiPrseXHlKepO0=
-github.com/DefangLabs/secret-detector v0.0.0-20250403165618-22662109213e/go.mod h1:blbwPQh4DTlCZEfk1BLU4oMIhLda2U+A840Uag9DsZw=
+github.com/DefangLabs/secret-detector v0.0.0-20250811234530-d4b4214cd679 h1:qNT7R4qrN+5u5ajSbqSW1opHP4LA8lzA+ASyw5MQZjs=
+github.com/DefangLabs/secret-detector v0.0.0-20250811234530-d4b4214cd679/go.mod h1:blbwPQh4DTlCZEfk1BLU4oMIhLda2U+A840Uag9DsZw=
 github.com/FilenCloudDienste/filen-sdk-go v0.0.39 h1:tgV5jYL6dsXop9TpDTIQU6UwJjws122HrwskaEE/igY=
 github.com/FilenCloudDienste/filen-sdk-go v0.0.39/go.mod h1:0cBhKXQg49XbKZZfk5TCDa3sVLP+xMxZTWL+7KY0XR0=
 github.com/Files-com/files-sdk-go/v3 v3.3.194 h1:dtOFxSTWWRpkmvXa6ycNiw8dVDu1wkgzcXyVV1VafNc=
 github.com/Files-com/files-sdk-go/v3 v3.3.194/go.mod h1:rl0WumSN9gSo775DgvQv+wMQ8rlb0ES/1hU5jkMtLXg=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.34.0 h1:yzIYdwuro811Z27D3T80Wkd3rqZzb0K43nner7Eh1yE=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.34.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0 h1:jLdiS1vO+XJFyDSWRHBx56r4s/NNtcl5J6KyCcWUX/w=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.57.0/go.mod h1:8lmpHY+1VRoteiOwyrQMDt1YGXOrFKCz+1wJW7n3ODY=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.57.0 h1:cSjUzZ7KU8hicTgzaSv9NmSyM9fTVK3y5lsBUl3wOis=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.57.0/go.mod h1:dzcEjy1WJ0Q4u9twNR3LcLhNoYMRCrMCMafpxa0TjPQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0 h1:RoO5+d7uCmDqovLrHCr2/BuViUXvdcrNxyNM1pN9dDQ=
-github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.57.0/go.mod h1:YqwkQPrWSC7+byyc1VlKbWLBF5JsW5IoL6xUkemYSXk=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.37.0 h1:edOuLWehuDlQ68roBF900Y09jvBoJP5W5d/wusz9nWY=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.37.0/go.mod h1:iIyrdhveU5Ow84ipRlxtjCOQnIM0DiqSMxuxm50xwZY=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.61.0 h1:BeC1Bub7Ttk33TF8v3ZeQ2L8acvz4ZLqtQuLyJAZquc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.61.0/go.mod h1:UgG/Xn9+NXb1/ueSczIFxyuya3hs3srFDiZG2JrpJwY=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.61.0 h1:eSgSuKdcpY7RTN1oXSzC6S39rPBImn03ubLMsWK4RRg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.61.0/go.mod h1:ifhe5teRNcbxg9p353DhOkOgczzL/IBLYFqT1cm1zpM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.61.0 h1:KhpL26/GviYITHMCEGGqT/l50siFaBCBBKrjv6Z0G/k=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.61.0/go.mod h1:sg6Wqbl0BKKZ5zKnQj2q0qic/3ziF894SCx1LpbX37Y=
 github.com/IBM/go-sdk-core/v5 v5.23.1 h1:fxLusCG+GlGY1SM7BYAAiiSFhzKUs5zqs0P8knDqeFU=
 github.com/IBM/go-sdk-core/v5 v5.23.1/go.mod h1:yO+OQpByKDLTvpEcsFFexgzpeR8eRfCFWAYzxkAu4bk=
 github.com/Jille/raft-grpc-transport v1.6.1 h1:gN3sjapb+fVbiebS7AfQQgbV2ecTOI7ur7NPPC7Mhoc=
 github.com/Jille/raft-grpc-transport v1.6.1/go.mod h1:HbOjEdu/yzCJ/mjTF6wEOJNbAUpHfU2UOA2hVD4CNFg=
-github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
-github.com/MarvinJWendt/testza v0.1.0/go.mod h1:7AxNvlfeHP7Z/hDQ5JtE3OKYT3XFUeLCDE2DQninSqs=
-github.com/MarvinJWendt/testza v0.2.1/go.mod h1:God7bhG8n6uQxwdScay+gjm9/LnO4D3kkcZX4hv9Rp8=
-github.com/MarvinJWendt/testza v0.2.8/go.mod h1:nwIcjmr0Zz+Rcwfh3/4UhBp7ePKVhuBExvZqnKYWlII=
-github.com/MarvinJWendt/testza v0.2.10/go.mod h1:pd+VWsoGUiFtq+hRKSU1Bktnn+DMCSrDrXDpX2bG66k=
-github.com/MarvinJWendt/testza v0.2.12/go.mod h1:JOIegYyV7rX+7VZ9r77L/eH6CfJHHzXjB69adAhzZkI=
-github.com/MarvinJWendt/testza v0.3.0/go.mod h1:eFcL4I0idjtIx8P9C6KkAuLgATNKpX4/2oUqKc6bF2c=
-github.com/MarvinJWendt/testza v0.4.2/go.mod h1:mSdhXiKH8sg/gQehJ63bINcCKp7RtYewEjXsvsVUPbE=
-github.com/MarvinJWendt/testza v0.5.2 h1:53KDo64C1z/h/d/stCYCPY69bt/OSwjq5KpFNwi+zB4=
-github.com/MarvinJWendt/testza v0.5.2/go.mod h1:xu53QFE5sCdjtMCKk8YMQ2MnymimEctc4n3EjyIYvEY=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd h1:nzE1YQBdx1bq9IlZinHa+HVffy+NmVRoKr+wHN8fpLE=
 github.com/Max-Sum/base32768 v0.0.0-20230304063302-18e6ce5945fd/go.mod h1:C8yoIfvESpM3GD07OCHU7fqI7lhwyZ2Td1rbNbTAhnc=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 h1:0kQAzHq8vLs7Pptv+7TxjdETLf/nIqJpIB4oC6Ba4vY=
+github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/ProtonMail/bcrypt v0.0.0-20210511135022-227b4adcab57/go.mod h1:HecWFHognK8GfRDGnFQbW/LiV7A3MX3gZVs45vk5h8I=
 github.com/ProtonMail/bcrypt v0.0.0-20211005172633-e235017c1baf h1:yc9daCCYUefEs69zUkSzubzjBbL+cmOXgnmt9Fyd9ug=
@@ -637,6 +109,8 @@ github.com/ProtonMail/gopenpgp/v3 v3.4.1 h1:K7uUhSHSJxORZ+RuHpilTT6S4MA2whCRlXNw
 github.com/ProtonMail/gopenpgp/v3 v3.4.1/go.mod h1:bGdV9f6edhmd581wzXsQCTKdH8bXBbyhkgDKPjwPc6U=
 github.com/PuerkitoBio/goquery v1.12.0 h1:pAcL4g3WRXekcB9AU/y1mbKez2dbY2AajVhtkO8RIBo=
 github.com/PuerkitoBio/goquery v1.12.0/go.mod h1:802ej+gV2y7bbIhOIoPY5sT183ZW0YFofScC4q/hIpQ=
+github.com/RoaringBitmap/roaring/v2 v2.26.0 h1:K30ZxF4vZcIKvJsbmgfiep2K64f+dILJqkYGoj4xnwU=
+github.com/RoaringBitmap/roaring/v2 v2.26.0/go.mod h1:BZufmFbox589n3j5eOmyTaLSGXbRLc2LmQvjKjzSEGU=
 github.com/Sereal/Sereal/Go/sereal v0.0.0-20231009093132-b9187f1a92c6/go.mod h1:JwrycNnC8+sZPDyzM3MQ86LvaGzSpfxg885KOOwFRW4=
 github.com/Shopify/sarama v1.38.1 h1:lqqPUPQZ7zPqYlWpTh+LQ9bhYNu2xJL6k1SJN4WVe2A=
 github.com/Shopify/sarama v1.38.1/go.mod h1:iwv9a67Ha8VNa+TifujYoWGxWnu2kNVAQdSdZ4X2o5g=
@@ -646,8 +120,8 @@ github.com/ThreeDotsLabs/watermill v1.5.2 h1:0ES33Eq1jEsP/pWvtE4n8bE0bs+9Jq7boT7
 github.com/ThreeDotsLabs/watermill v1.5.2/go.mod h1:i9/968UriGphWfEbfMuYSD1qFbYRjb0mE0r+rV0FPp4=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb h1:wumPkzt4zaxO4rHPBrjDK8iZMR41C1qs7njNqlacwQg=
 github.com/TomiHiltunen/geohash-golang v0.0.0-20150112065804-b3e4e625abfb/go.mod h1:QiYsIBRQEO+Z4Rz7GoI+dsHVneZNONvhczuA+llOZNM=
-github.com/a-h/templ v0.3.1020 h1:ypAT/L5ySWEnZ6Zft/5yfoWXYYkhFNvEFOeeqecg4tw=
-github.com/a-h/templ v0.3.1020/go.mod h1:A2DlK61v+K+NRoGnhmYbNYVmtYHcFO5/AisMvBdDxTM=
+github.com/a-h/templ v0.3.1070 h1:3iCOXHXqFXa99OQzgkUOLJbNzv/QjFGLwKZkBAg+ADA=
+github.com/a-h/templ v0.3.1070/go.mod h1:iIqB3g2RHBe/WlnPwa+Bvhh1TKXHWLRnBD9NWHOLm78=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0 h1:iLDOF0rdGTrol/q8OfPIIs5kLD8XvA2q75o6Uq/tgak=
 github.com/a1ex3/zstd-seekable-format-go/pkg v0.10.0/go.mod h1:DrEWcQJjz7t5iF2duaiyhg4jyoF0kxOD6LtECNGkZ/Q=
 github.com/aalpar/deheap v1.1.2 h1:MABHLcnjqsffb8GLkUFDigqpBBxOMz0DoKM9QfELeTw=
@@ -658,10 +132,6 @@ github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d h1:licZJFw2RwpH
 github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d/go.mod h1:asat636LX7Bqt5lYEZ27JNDcqxfjdBQuJ/MM4CN/Lzo=
 github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
 github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
-github.com/ajstarks/deck v0.0.0-20200831202436-30c9fc6549a9/go.mod h1:JynElWSGnm/4RlzPXRlREEwqTHAN3T56Bv2ITsFT3gY=
-github.com/ajstarks/deck/generate v0.0.0-20210309230005-c3f852c02e19/go.mod h1:T13YZdzov6OU0A1+RfKZiZN9ca6VeKdBdyDV+BY97Tk=
-github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
-github.com/ajstarks/svgo v0.0.0-20211024235047-1546f124cd8b/go.mod h1:1KcenG0jGWcpt8ov532z81sp/kMMUG485J2InIOyADM=
 github.com/alecthomas/assert/v2 v2.10.0 h1:jjRCHsj6hBJhkmhznrCzoNpbA3zqy0fYiUcYZP/GkPY=
 github.com/alecthomas/assert/v2 v2.10.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
@@ -670,14 +140,12 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/anchore/go-lzo v0.1.1 h1:IwL/fvkdtlIrYIXck6WxZ3nb8WjjHziYYmGxlooyOnM=
 github.com/anchore/go-lzo v0.1.1/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
-github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
-github.com/andybalholm/brotli v1.2.2 h1:HzTuoo2ErYQqf5qvcJInB8uvqSVxRttzkFexPWtnceM=
-github.com/andybalholm/brotli v1.2.2/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.6 h1:ftYnfj6usCp+UGV5kSJ3+chpMQgU+gJf/AxsUQ52REI=
+github.com/andybalholm/brotli v1.2.6/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/andybalholm/cascadia v1.3.4 h1:vM2lgh0Vru9Vwyfm4cQqWP2HHMW0u0+2PAW7Q38Qufg=
 github.com/andybalholm/cascadia v1.3.4/go.mod h1:BLRmbRjpEtNKieZOCCvYj4RqN+KRA41GBe/5O+G93kM=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -685,15 +153,14 @@ github.com/antithesishq/antithesis-sdk-go v0.6.0-default-no-op h1:kpBdlEPbRvff0m
 github.com/antithesishq/antithesis-sdk-go v0.6.0-default-no-op/go.mod h1:IUpT2DPAKh6i/YhSbt6Gl3v2yvUZjmKncl7U91fup7E=
 github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
 github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
-github.com/apache/arrow-go/v18 v18.7.0 h1:Vw/i+cJyebUofT7JlqFpe65LrmwxULn166jjwStM4HY=
-github.com/apache/arrow-go/v18 v18.7.0/go.mod h1:PM6IigLJkdMwIpeHXnymo+xZ52f42a9EYiLtRel4p/A=
-github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
+github.com/apache/arrow-go/v18 v18.8.0 h1:BLOzbPv7bxMPgXPacAg6HQjnxupYsZzC4tf+FkqPU/M=
+github.com/apache/arrow-go/v18 v18.8.0/go.mod h1:uJCFfCwq0KsxCmsCfQg4ft+LsW+iHYzAXiSDh5ug/8U=
 github.com/apache/cassandra-gocql-driver/v2 v2.1.2 h1:lu/p0Db2av18enHJvWJQoChLssI0P+AR06STq4VdvCc=
 github.com/apache/cassandra-gocql-driver/v2 v2.1.2/go.mod h1:QH/asJjB3mHvY6Dot6ZKMMpTcOrWJ8i9GhsvG1g0PK4=
-github.com/apache/iceberg-go v0.6.0 h1:tOVhC5BhBOEgPTowo5AVrPnAgsDo00qEbUPprFcLd4s=
-github.com/apache/iceberg-go v0.6.0/go.mod h1:kESfDlyaW/6hK0WW6TzA4EWps+0NMhhrDYE4qajVjlo=
-github.com/apache/thrift v0.23.1-0.20260429145742-d2acd3c49e58 h1:rDLE+tSW60VzRD7v5I+DU22Mjhmm+mfLc5Xl5dHkx6w=
-github.com/apache/thrift v0.23.1-0.20260429145742-d2acd3c49e58/go.mod h1:zPt6WxgvTOM6hF92y8C+MkEM5LMxZuk4JcQOiU4Esvs=
+github.com/apache/iceberg-go v0.7.0 h1:bTD6Pb4uM4sWcMfIx0/cV1haHMc84r+CvPieUqYzD4I=
+github.com/apache/iceberg-go v0.7.0/go.mod h1:oGz5MX3/m3GDc6acsrwbdHChj28jZH8MVDWqUrW6WQQ=
+github.com/apache/thrift v0.24.0 h1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=
+github.com/apache/thrift v0.24.0/go.mod h1:zPt6WxgvTOM6hF92y8C+MkEM5LMxZuk4JcQOiU4Esvs=
 github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3 h1:WZaTKNHCfcw7fWSR6/RKnCldVzvYZC+Y20Su4lffEIg=
 github.com/apple/foundationdb/bindings/go v0.0.0-20250911184653-27f7192f47c3/go.mod h1:OMVSB21p9+xQUIqlGizHPZfjK+SHws1ht+ZytVDoz9U=
 github.com/appscode/go-querystring v0.0.0-20170504095604-0126cfb3f1dc h1:LoL75er+LKDHDUfU5tRvFwxH0LjPpZN8OoG8Ll+liGU=
@@ -704,53 +171,52 @@ github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e h1:Xg+hGrY2
 github.com/arangodb/go-velocypack v0.0.0-20200318135517-5af53c29c67e/go.mod h1:mq7Shfa/CaixoDxiyAAc5jZ6CVBAyPaNQCGS7mkj4Ho=
 github.com/armon/go-metrics v0.4.1 h1:hR91U9KYmb6bLBYLQjyM+3j+rcd/UhE+G78SFnF8gJA=
 github.com/armon/go-metrics v0.4.1/go.mod h1:E6amYzXo6aW1tqzoZGT755KkbgrJsSdpwZ+3JqfkOG4=
-github.com/atomicgo/cursor v0.0.1/go.mod h1:cBON2QmmrysudxNBFthvMtN32r3jxVRIvzkUiF/RuIk=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
-github.com/aws/aws-sdk-go-v2 v1.43.2 h1:cl+IXwWb3qazClUcm08tGSsB6OiuV83JVJO9B0jQcPc=
-github.com/aws/aws-sdk-go-v2 v1.43.2/go.mod h1:WEzLKBh/mEjXvx1FtQMWgSxMSTVqxQzjkRtk5fa3wkg=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14 h1:3IZY0XAJquT3aHzbkHfPzy4ACPcEjVG0x87KOwtpqGY=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.14/go.mod h1:zwM6veDkhGgQFqkBy+uT28AAYpLu+uFMlPl+rCg/73E=
-github.com/aws/aws-sdk-go-v2/config v1.32.33 h1:M1m/Q6f0OKDEDGwhiNOqx1OjTdrewe3v+GDbHmKczWk=
-github.com/aws/aws-sdk-go-v2/config v1.32.33/go.mod h1:fGj1iQj2QpIZzp7jE4aQQ+71TE8cd4z9K4+xCd6EqmE=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.32 h1:eNE0JnIblBo1NCvd3tqEYuZz9XDefn69R74CHd3nT7U=
-github.com/aws/aws-sdk-go-v2/credentials v1.19.32/go.mod h1:yYJu+6tqKUYZuJSYcpSGjz/6sV/SUaAaKIufnWKx2OU=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33 h1:MobhiR6KIerWxmO74Zit5I3379+mSc2DOdZ3DeRFB9w=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.33/go.mod h1:xu02847OdZfNr/jAfZpHtyRk0b3v4d0kaoxNHxZGG/w=
+github.com/aws/aws-sdk-go-v2 v1.47.3 h1:HRoT/MkNi3bjO5xF4dCzLzvVmkvRGHj3/cLINDnJejk=
+github.com/aws/aws-sdk-go-v2 v1.47.3/go.mod h1:xSl+OSI5ZUw6bSMupWc218zE5Pl+65MCCu3ySWFY99A=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 h1:GPRlPwz40I2B2VrBEASOA3Bi77NyeqejNLkifosX0rs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20/go.mod h1:g7PNzKcsOKWb4fkSRBA7BZVAS6Y8IcxzN+nRohhQ1Q8=
+github.com/aws/aws-sdk-go-v2/config v1.33.6 h1:MBjkSTLczek/UgiK+EYPIoRTqE7gP8vtW3OFbFo7Nug=
+github.com/aws/aws-sdk-go-v2/config v1.33.6/go.mod h1:grRAFzdAZJrwcbasJRg2MPvIrVjtlfXllHssN6+E1JE=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.6 h1:NpAFXCU7NzXNkdGK3zQTtsRJ+3v9tZQV0xcdRw8uBdw=
+github.com/aws/aws-sdk-go-v2/credentials v1.20.6/go.mod h1:mcZCoiPnyMvP8VMNbygNX5lLqSlkYJIMPODylQMurOk=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1 h1:8gALAAmacnIXh+z6VkdDanv4/IkG5APdg4DZLDTmLog=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.1/go.mod h1:Z7IJhJU+poOdJjUR2wpyY21ossQ1XS/R3Lk9Msq5kM4=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.34 h1:Pn7OsMwBLbkZ6OnCxWHAjf0L/22H8cnhxZC0uPwtMtg=
 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.34/go.mod h1:eToXR/Gk1uqpn04eSmdgVXwfS0WvH8aG4eBFr8ygbpU=
-github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.2.3 h1:w5OoDiMN6x53ROmiIImGzmVcxXv2q1GXY+aKV4WAJYM=
-github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.2.3/go.mod h1:dAhgYp776bX3LuWvnSCFwQEjNs6fuFg7YXIy5PXcP3Q=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33 h1:HAp1wLFZzch054uh3FK7rcVYg4v7J2FxVf3h3IGNZas=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.33/go.mod h1:mJk5fmqnF+WUlMdPG37pR2Fh3oh6r8F6ZGUgPKvzu0c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33 h1:0YA0aCKgsJyno6xkFfaIgjE3/wK08+Qxo9nQfe1UrWM=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.33/go.mod h1:UZqj4WIdTH+ga8Y/DgpAuy/8cGjM3h7gDCliJYGg2SE=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34 h1:HQYnjFnXpX8EbPW5M1QT8mXzesRPwly0HEPTcFlS02Y=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.34/go.mod h1:tGzj56niKYZBbDIRhwPGDqrULzmWv5b6uBQGqyNaFZw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14 h1:SA43nfaY7+1jjMNIc2ywu99JLJLButtIdLP6j+bT870=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.14/go.mod h1:Du3llKcwbQvHsTXSLzTOGQz0DTDBMEzdg7DAGu7inrY=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23 h1:9Fjh6fi/U5JEStVZijmaMpUwE/gvBJj7x2B/PjbO9To=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.23/go.mod h1:iMoT2f1tClxrWAAnKCXjZQ6LOmfLrMG14wmnWpM+F14=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33 h1:mqI7OrxN/DUH85F5OqVn3cIfuZ3+HVcebUm2N8mLlgQ=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.33/go.mod h1:eZ5jdEpvaaOU8nWWE4cTAJETSEA5FZoWxvNRao4piHY=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31 h1:uao4A3QZ5UmB326V6KF+qRpv9Tjz7IlnlnTbbANntlU=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.31/go.mod h1:I/1+z0VwL1GhQyLgkoHDlygpUZ+iTAwOQ/NsftiUL2I=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.105.2 h1:5C00eQYpTrgQXnp6V3P6P7zPElna3AXvlukbANE6nJI=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.105.2/go.mod h1:zdmCoFO/dSI7GlrwsPqFJI+WlFnSU4Tc8TJnlXrM1Do=
-github.com/aws/aws-sdk-go-v2/service/signin v1.5.2 h1:EjI1CZzDcBxPkTa3j1BdtIrUDbqnOGssFMeyUS+6W0I=
-github.com/aws/aws-sdk-go-v2/service/signin v1.5.2/go.mod h1:vN3eb5H8MEAZ4dx0F5Wc9LT8eb3eW7bZZ5BjGJdbw9k=
-github.com/aws/aws-sdk-go-v2/service/sns v1.39.14 h1:p8WdWDh5AwSZdp19Haa3XMyPCICi9Z375a/Nu3IIEZY=
-github.com/aws/aws-sdk-go-v2/service/sns v1.39.14/go.mod h1:NKVY7DER6VXHkt2I/ycmHakALNboi3Rqwt4eEf/1Cnk=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.42.24 h1:JP2wjWGmUp8lTCZb13Dv0Eciyc1jbO8pd0HZVMHFlrc=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.42.24/go.mod h1:Ql9ziDutk8ERAN9HMaYANCW3lop451ppebkxEJMLCTM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.33.2 h1:zMP1FDFE08L7sM5f1QqkH/ZgKKg8Uc0Dz7KhSSYqWkw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.33.2/go.mod h1:0LoIZSUKjdo2BleHfT1hv/jlD33LQS00IrBlzoUsoUQ=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2 h1:9eTqUYl+SyVmaRPMyBXSO9wwqC6TRwZB82pKENK2hdQ=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.2/go.mod h1:DThweuz22kiLc7lGHop5vQ9c3bx5W6Azs/YqSHa2fu8=
-github.com/aws/aws-sdk-go-v2/service/sts v1.45.2 h1:EJd8vZO3E8SE6nmPqxuxlQ1NeSb8as50sf6eGdV4Saw=
-github.com/aws/aws-sdk-go-v2/service/sts v1.45.2/go.mod h1:OgpPvKzsO2Ranjpli/20djMkg6UrV5mw4W3pZpq1Mqo=
-github.com/aws/smithy-go v1.27.5 h1:d1ro7KpYOYwP6m73YFa+Kc/A130VsAdX68SpsJwARMM=
-github.com/aws/smithy-go v1.27.5/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.4.3 h1:vsFkmFrfzODkxVbyuPLscv5j5lC8KbG48LZwV+p56Y0=
+github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.4.3/go.mod h1:pjQYVtvVBEtlsf2p6nXMsjPuDaWs9GM44FMdHbmnmYU=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4 h1:CLq4+8UHCI+ZZYl/EuJxXovaIVN2xeeT8JV+dsApQ5E=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.4/go.mod h1:Wv4q5sAM04xAMkoOedxLx2inVf6K5FdxYp+A61L+q/0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4 h1:dD4MR81I7YkpEBRk6UP9rocC2QnT3qVuXwzlYTtfGEs=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.4/go.mod h1:EcXV1kAFd5XwSkDHlj94gnF3q5CkJyYiIJfH8N0VmrE=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4 h1:7Wo47d/xn/7KttCSBd8EGYeZ7ULRFRkUHr6vkZPBzVQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.4/go.mod h1:tDB2IVC1xC3vX8o+6uRlzhTxP3g1b77CZXFX/oD2FnQ=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5 h1:/TYsZXdA8UTa+WCtCYSAJIr1vwl0+eho6TUgJGwFFO8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.5/go.mod h1:qPqp1Uwd/BqdhPufv6oem9j5J7HNsgc2V22dUiDPn+s=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4 h1:29SvnfGhXjTl8ONxFwbj2rs6lbhiFXD2CgFQmbT/bXY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.4/go.mod h1:wm04I5DMuNVvZHFe/dHnUxincvNbbK7AiNBbYsQivek=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4 h1:pPiWfgeNxqluKEph7hvU88kuGKBPOWzO+Dk9t2zqqNs=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.4/go.mod h1:YlwGoIUDG/3kBQbdNOVs/xKZ9J01G8e/6D1mRBj9uTk=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.114.1 h1:9T6eO8/WXhij4PQaa2WaYsdekSCmT9Hw66Pw0S8do0Q=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.114.1/go.mod h1:9APRWGLFITKD+xzWSIyT9V7QV4bNlEuIieWlzXgGFlI=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.1 h1:DzCCWLzcIRQ77F3DEUljud7bEjTgFOIKXP52NmVRyhU=
+github.com/aws/aws-sdk-go-v2/service/signin v1.10.1/go.mod h1:xpo/geVldu8payT375WekctUzopG/hBU7miiqItMUlw=
+github.com/aws/aws-sdk-go-v2/service/sns v1.46.0 h1:fD02zeo2Kc4hlFUvGX3FfA+gGOwd4BBcYgPDHDEzx9Y=
+github.com/aws/aws-sdk-go-v2/service/sns v1.46.0/go.mod h1:/lB2ILjoT5/q0zSwtHnrJPjXBvjalnEIl0IgSEdvHec=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.51.0 h1:FghdY9ebeZf9iIan9J0xfBEID8arYibNBeZ1XHvs4oA=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.51.0/go.mod h1:wu7uOJ/2nAdenjvhHikeF6j0al99kfPVG6ZDU4e76OY=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.1 h1:Umtl/0YZhng4xndfW3lKJrYYP7NLEjI6bGXVomwLcs0=
+github.com/aws/aws-sdk-go-v2/service/sso v1.38.1/go.mod h1:rRD/dnm7q0HYE/I5TMaPgkWyyUGLcwuxHLABsLnQ3e0=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1 h1:orIWdNiLgzrhu/11RcPPKO/SBzUUymbUQuZbSPImghg=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.1/go.mod h1:skwM/xsbR/1ReUTesv9BhpJp1VjajR7DWQnuVLwiXsQ=
+github.com/aws/aws-sdk-go-v2/service/sts v1.51.1 h1:0HOqZXRvMytH6bFHVIc0oJX07sZjfhz0zXtjs6gdE8s=
+github.com/aws/aws-sdk-go-v2/service/sts v1.51.1/go.mod h1:26zA0GhDrLo+yiLI2yXWxqB1PdsShfLikoI7GOEgugM=
+github.com/aws/smithy-go v1.28.5 h1:OqbqKtzY9NUnr2yAe9+hiTdFb20tNaK/lI0PMOGXX9k=
+github.com/aws/smithy-go v1.28.5/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
 github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
 github.com/bazelbuild/rules_go v0.46.0 h1:CTefzjN/D3Cdn3rkrM6qMWuQj59OBcuOjyIp3m4hZ7s=
@@ -762,13 +228,13 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/biogo/store v0.0.0-20201120204734-aad293a2328f h1:+6okTAeUsUrdQr/qN7fIODzowrjjCrnJDg/gkYqcSXY=
 github.com/biogo/store v0.0.0-20201120204734-aad293a2328f/go.mod h1:z52shMwD6SGwRg2iYFjjDwX5Ene4ENTw6HfXraUy/08=
+github.com/bits-and-blooms/bitset v1.24.4 h1:95H15Og1clikBrKr/DuzMXkQzECs1M6hhoGXLwLQOZE=
+github.com/bits-and-blooms/bitset v1.24.4/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/blevesearch/snowballstem v0.9.0 h1:lMQ189YspGP6sXvZQ4WZ+MLawfV8wOmPoD/iWeNXm8s=
 github.com/blevesearch/snowballstem v0.9.0/go.mod h1:PivSj3JMc8WuaFkTSRDW2SlrulNWPl4ABg1tC/hlgLs=
 github.com/boltdb/bolt v1.3.1 h1:JQmyP4ZBrce+ZQu0dY660FMfatumYDLun9hBCUVIkF4=
 github.com/boltdb/bolt v1.3.1/go.mod h1:clJnj/oiGkjum5o1McbSZDSLxVThjynRyGBgiAx27Ps=
-github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
-github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/boombuler/barcode v1.1.0 h1:ChaYjBR63fr4LFyGn8E8nt7dBSt3MiU3zMOZqFvVkHo=
 github.com/boombuler/barcode v1.1.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bradenaw/juniper v0.15.3 h1:RHIAMEDTpvmzV1wg1jMAHGOoI2oJUSPx3lxRldXnFGo=
@@ -801,20 +267,14 @@ github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyY
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
 github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chengxilo/virtualterm v1.0.4 h1:Z6IpERbRVlfB8WkOmtbHiDbBANU7cimRIof7mk9/PwM=
 github.com/chengxilo/virtualterm v1.0.4/go.mod h1:DyxxBZz/x1iqJjFxTFcr6/x+jSpqN0iwWCOK1q10rlY=
 github.com/chilts/sid v0.0.0-20190607042430-660e94789ec9 h1:z0uK8UQqjMVYzvk4tiiu3obv2B44+XBsvgEJREQfnO8=
 github.com/chilts/sid v0.0.0-20190607042430-660e94789ec9/go.mod h1:Jl2neWsQaDanWORdqZ4emBl50J4/aRBBS4FyyG9/PFo=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible/go.mod h1:nmEj6Dob7S7YxXgwXpfOuvO54S+tGdZdw9fuRZt25Ag=
 github.com/circonus-labs/circonusllhist v0.1.3/go.mod h1:kMXHVDlOchFAehlya5ePtbp5jckzBHf4XRpQvBOLI+I=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
@@ -832,24 +292,18 @@ github.com/cloudsoda/sddl v0.0.0-20250224235906-926454e91efc/go.mod h1:uvR42Hb/t
 github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
 github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/udpa/go v0.0.0-20220112060539-c52dc94e7fbe/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20220314180256-7f1daf1720fc/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20230310173818-32f1caf87195/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/cockroachdb/apd/v3 v3.2.1 h1:U+8j7t0axsIgvQUqthuNm82HIrYXodOV2iWLWtEaIwg=
 github.com/cockroachdb/apd/v3 v3.2.1/go.mod h1:klXJcjp+FffLTHlhIG69tezTDvdP065naDsHzKhYSqc=
-github.com/cockroachdb/errors v1.11.3 h1:5bA+k2Y6r+oz/6Z/RFlNeVCesGARKuC6YymtcDrbC/I=
-github.com/cockroachdb/errors v1.11.3/go.mod h1:m4UIW4CDjx+R5cybPsNrRbreomiFqt8o1h1wUVazSd8=
+github.com/cockroachdb/errors v1.14.0 h1:EfdVEJpN3z8rPMo43Yit59LxoiIa470fSXpZXuEs+ZI=
+github.com/cockroachdb/errors v1.14.0/go.mod h1:xRa70jZ9sNBQmISt5KmJmAD++E4dQHm89oCRiZGEdq0=
 github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 h1:ASDL+UJcILMqgNeV5jiqR4j+sTuvQNHdf2chuKj1M5k=
 github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506/go.mod h1:Mw7HqKr2kdtu6aYGn3tPmAftiP3QPX63LdK/zcariIo=
 github.com/cockroachdb/redact v1.1.5 h1:u1PMllDkdFfPWaNGMyLD1+so+aq3uUItthCFqzwPJ30=
@@ -860,17 +314,16 @@ github.com/cognusion/imaging v1.0.4 h1:hrmWVa4S9fiLJJFKEHYYRNBUnHEKZD8/oxnC77xTU
 github.com/cognusion/imaging v1.0.4/go.mod h1:X1mPSSZpMyiva54chCO/1NROp+b6xG4uMcud8VLii+U=
 github.com/colinmarc/hdfs/v2 v2.4.0 h1:v6R8oBx/Wu9fHpdPoJJjpGSUxo8NhHIwrwsfhFvU9W0=
 github.com/colinmarc/hdfs/v2 v2.4.0/go.mod h1:0NAO+/3knbMx6+5pCv+Hcbaz4xn/Zzbn9+WIib2rKVI=
-github.com/compose-spec/compose-go/v2 v2.10.2 h1:USa1NUbDcl/cjb8T9iwnuFsnO79H+2ho2L5SjFKz3uI=
-github.com/compose-spec/compose-go/v2 v2.10.2/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg=
-github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
+github.com/compose-spec/compose-go/v2 v2.12.1 h1:+xBZNxcgSus4atQJwXPEdhHRgCEyZmj/BuqN5m33Ou0=
+github.com/compose-spec/compose-go/v2 v2.12.1/go.mod h1:ZU6zlcweCZKyiB7BVfCizQT9XmkEIMFE+PRZydVcsZg=
 github.com/containerd/console v1.0.5 h1:R0ymNeydRqH2DmakFNdmjR2k0t7UPuiOV/N/27/qqsc=
 github.com/containerd/console v1.0.5/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
-github.com/containerd/containerd/api v1.10.0 h1:5n0oHYVBwN4VhoX9fFykCV9dF1/BvAXeg2F8W6UYq1o=
-github.com/containerd/containerd/api v1.10.0/go.mod h1:NBm1OAk8ZL+LG8R0ceObGxT5hbUYj7CzTmR3xh0DlMM=
-github.com/containerd/containerd/v2 v2.2.2 h1:mjVQdtfryzT7lOqs5EYUFZm8ioPVjOpkSoG1GJPxEMY=
-github.com/containerd/containerd/v2 v2.2.2/go.mod h1:5Jhevmv6/2J+Iu/A2xXAdUIdI5Ah/hfyO7okJ4AFIdY=
-github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
-github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
+github.com/containerd/containerd/api v1.11.1 h1:h8nfoDW9+fNsC/9TwiAHj8B1GzXKtR4eFtkhi/X5RLU=
+github.com/containerd/containerd/api v1.11.1/go.mod h1:CaQFRu+N1MtbgL6JDOJLUB1hCKESU1lD6MuTJhgtdlw=
+github.com/containerd/containerd/v2 v2.2.8 h1:8nnNE5FqBmofd3lccku8GbWi6d1TO4rrcB2E/0o+HU0=
+github.com/containerd/containerd/v2 v2.2.8/go.mod h1:lTw+wrjREio28N9+3umHS73C6Cs1mxrhczBcAliInuI=
+github.com/containerd/continuity v0.5.0 h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg=
+github.com/containerd/continuity v0.5.0/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
@@ -881,12 +334,12 @@ github.com/containerd/platforms v1.0.0-rc.4 h1:M42JrUT4zfZTqtkUwkr0GzmUWbfyO5VO0
 github.com/containerd/platforms v1.0.0-rc.4/go.mod h1:lKlMXyLybmBedS/JJm11uDofzI8L2v0J2ZbYvNsbq1A=
 github.com/containerd/ttrpc v1.2.8 h1:xbVu6D4qF2jihdh9rDVOKqUMiFBQk6YctTdo1zk087Y=
 github.com/containerd/ttrpc v1.2.8/go.mod h1:wyZW2K79t4Hfcxl+GUvkZqRBzJlqFFvgEeeWXa42tyE=
-github.com/containerd/typeurl/v2 v2.2.3 h1:yNA/94zxWdvYACdYO8zofhrTVuQY73fFU1y++dYSw40=
-github.com/containerd/typeurl/v2 v2.2.3/go.mod h1:95ljDnPfD3bAbDJRugOiShd/DlAAsxGtUBhJxIn7SCk=
+github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=
+github.com/containerd/typeurl/v2 v2.3.0/go.mod h1:Qk+PAdUYArVj41TnGi6rJ+48RF0PkcTc4i/taoBcK0w=
 github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
 github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
-github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=
-github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU=
+github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
+github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
 github.com/cosmos/go-bip39 v1.0.0 h1:pcomnQdrdH22njcAatO0yWojsUnCO3y2tNoV1cb6hHY=
 github.com/cosmos/go-bip39 v1.0.0/go.mod h1:RNJv0H/pOIVgxw6KS7QeX2a0Uo0aKUlfhZ4xuwvCdJw=
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
@@ -926,38 +379,36 @@ github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
 github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
 github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
 github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
-github.com/docker/buildx v0.33.0 h1:xuZeuQe/C/2tvLDgiIA6+Ynq3FFWSfsGNWIHM3q1hD8=
-github.com/docker/buildx v0.33.0/go.mod h1:7JVma62htERKE5iy5YD1q64PKiAHUzXuhSBd4oq3I74=
-github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM=
-github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/compose/v5 v5.1.2 h1:HxtfGZA0DESw/+hvrNJDjM8VKmCond7OkmgVJCHku48=
-github.com/docker/compose/v5 v5.1.2/go.mod h1:JJ2H+lRSugOH50/zxCbkBwN8jU91qDtRCp7gEHWZdgo=
+github.com/docker/buildx v0.35.0 h1:5r/ZcAC0s2oZ1XOJHvYFYbj44I4rxRsIdfsRBeXClks=
+github.com/docker/buildx v0.35.0/go.mod h1:kO/9ZBoZmhi1OsZbeLJqWclckB2TKu/yeW6aj6xxdt0=
+github.com/docker/cli v29.6.0+incompatible h1:nw9himxMMZ7eIeherJNlKQq+acnlzGgHd+4uf10QRSc=
+github.com/docker/cli v29.6.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/compose/v5 v5.2.0 h1:WuZgtAM91BjFWy7xMKcM2Huq9OksVqRgkgBKFiEXs2Q=
+github.com/docker/compose/v5 v5.2.0/go.mod h1:tjYsBMooQQZ8XGtVoUnc+/T9peXtkMmTdmMakW8/ZXE=
 github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM=
 github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY=
-github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
-github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
-github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
+github.com/docker/docker-credential-helpers v0.9.8 h1:bIREROb7So6PRlq6KTtdS9MPEjC29OQRkFNlvK2OX8Q=
+github.com/docker/docker-credential-helpers v0.9.8/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c=
+github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c=
+github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dromara/dongle v1.0.1 h1:si/7UP/EXxnFVZok1cNos70GiMGxInAYMilHQFP5dJs=
 github.com/dromara/dongle v1.0.1/go.mod h1:ebFhTaDgxaDIKppycENTWlBsxz8mWCPWOLnsEgDpMv4=
 github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.4.0 h1:OYMx56y2as2FIM6QuS5HGXC2AYtf5xv/2n6INaluF4Y=
 github.com/dropbox/dropbox-sdk-go-unofficial/v6 v6.4.0/go.mod h1:gDXhl0OElhzYoDsYWHr1RXjpxjGeLzEvjYzH7sZV73k=
 github.com/dsnet/try v0.0.3 h1:ptR59SsrcFUYbT/FhAbKTV6iLkeD6O18qfIWRml2fqI=
 github.com/dsnet/try v0.0.3/go.mod h1:WBM8tRpUmnXXhY1U6/S8dt6UWdHTQ7y8A5YSkRCkq40=
-github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
+github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/eapache/go-resiliency v1.6.0 h1:CqGDTLtpwuWKn6Nj3uNUdflaq+/kIPsg0gfNzHton30=
 github.com/eapache/go-resiliency v1.6.0/go.mod h1:5yPzW0MIvSe0JDsv0v+DvcjEv2FyD6iZYSs1ZI+iQho=
 github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 h1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws=
 github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3/go.mod h1:YvSRo5mw33fLEx1+DlK6L2VV43tJt5Eyel9n9XBcR+0=
 github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
-github.com/ebitengine/purego v0.10.1 h1:dewVBCBT2GaMu1SrNTYxQhgQBethzfhiwvZiLGP/qyY=
-github.com/ebitengine/purego v0.10.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
+github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203 h1:XBBHcIb256gUJtLmY22n99HaZTz+r2Z51xUPi01m3wg=
 github.com/eiannone/keyboard v0.0.0-20220611211555-0d226195f203/go.mod h1:E1jcSv8FaEny+OP/5k9UxZVw9YFWGj7eI4KR/iOBqCg=
 github.com/elastic/gosigar v0.14.3 h1:xwkKwPia+hSfg9GqrCUKYdId102m9qTJIIr7egmK/uo=
@@ -972,24 +423,16 @@ github.com/emmansun/gmsm v0.15.5/go.mod h1:2m4jygryohSWkaSduFErgCwQKab5BNjURoFrn
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
 github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
-github.com/envoyproxy/go-control-plane v0.10.3/go.mod h1:fJJn/j26vwOu972OllsvAgJJM//w9BV6Fxbg2LuVd34=
-github.com/envoyproxy/go-control-plane v0.11.0/go.mod h1:VnHyVMpzcLvCFt9yUz1UnCwHLhwx1WguiVDV7pTG/tI=
 github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
 github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
-github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
+github.com/envoyproxy/go-control-plane/envoy v1.39.1-0.20260819172001-e6e3fd93e4be h1:SWe0x6yfglnxuvOiYgTTnNq7QD/yvqthOh1RBI8Bj8w=
+github.com/envoyproxy/go-control-plane/envoy v1.39.1-0.20260819172001-e6e3fd93e4be/go.mod h1:PYEOlng9XcrulfyWpm49jECTPV0LT4q8cO7fLW/xwgk=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
 github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/envoyproxy/protoc-gen-validate v0.6.7/go.mod h1:dyJXwwfPK2VSqiB9Klm1J6romD608Ba7Hij42vrOBCo=
-github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0++PMirau2/yoOwVac3AbF2w=
-github.com/envoyproxy/protoc-gen-validate v0.10.0/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
 github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
 github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
 github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a h1:yDWHCSQ40h88yih2JAcL6Ls/kVkSE8GFACTGVnMPruw=
@@ -1005,16 +448,14 @@ github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4/go.mod h1:5tD+ne
 github.com/fanixk/geohash v0.0.0-20150324002647-c1f9b5fa157a h1:Fyfh/dsHFrC6nkX7H7+nFdTd1wROlX/FxEIWVpKYf1U=
 github.com/fanixk/geohash v0.0.0-20150324002647-c1f9b5fa157a/go.mod h1:UgNw+PTmmGN8rV7RvjvnBMsoTU8ZXXnaT3hYsDTBlgQ=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/fluent/fluent-logger-golang v1.10.1 h1:wu54iN1O2afll5oQrtTjhgZRwWcfOeFFzwRsEkABfFQ=
 github.com/fluent/fluent-logger-golang v1.10.1/go.mod h1:qOuXG4ZMrXaSTk12ua+uAb21xfNYOzn0roAtp7mfGAE=
 github.com/flynn/noise v1.1.0 h1:KjPQoQCEFdZDiP03phOvGi11+SVVhBG2wOWAorLsstg=
 github.com/flynn/noise v1.1.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
-github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
-github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
@@ -1023,54 +464,46 @@ github.com/fsnotify/fsevents v0.2.0 h1:BRlvlqjvNTfogHfeBOFvSC9N0Ddy+wzQCQukyoD7o
 github.com/fsnotify/fsevents v0.2.0/go.mod h1:B3eEk39i4hz8y1zaWS/wPrAP4O6wkIl7HQwKBr1qH/w=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx59Ho=
+github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo=
 github.com/fvbommel/sortorder v1.1.0 h1:fUmoe+HLsBTctBDoaBwpQo5N+nrCp8g/BjKb/6ZQmYw=
 github.com/fvbommel/sortorder v1.1.0/go.mod h1:uk88iVf1ovNn1iLfgUVU2F9o5eO30ui720w+kxuqRs0=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
 github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/geoarrow/geoarrow-go v0.0.0-20260403143023-f54751c3e3a1 h1:8VcjuP5pKZ717K4zOLS9Lm4Zsn8JwD9X+CQGFCiRT2E=
+github.com/geoarrow/geoarrow-go v0.0.0-20260403143023-f54751c3e3a1/go.mod h1:XMOIOA5J96jEzAOpBROPyz0n14sHsooeF+y2FtGdrCY=
 github.com/geoffgarside/ber v1.2.0 h1:/loowoRcs/MWLYmGX9QtIAbA+V/FrnVLsMMPhwiRm64=
 github.com/geoffgarside/ber v1.2.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
-github.com/getsentry/sentry-go v0.44.1 h1:/cPtrA5qB7uMRrhgSn9TYtcEF36auGP3Y6+ThvD/yaI=
-github.com/getsentry/sentry-go v0.44.1/go.mod h1:XDotiNZbgf5U8bPDUAfvcFmOnMQQceESxyKaObSssW0=
+github.com/getsentry/sentry-go v0.49.0 h1:Ehejknu1l023Ub7QoRBVLAI7g3Jnhqku4oWx4B4Sh5s=
+github.com/getsentry/sentry-go v0.49.0/go.mod h1:nuMJAoCfe1u0Bts2ocyNI+TW8HT84vRMqwA5Qq/SKUI=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
 github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
 github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
 github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
-github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
-github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
+github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-chi/chi/v5 v5.4.0 h1:+ufzvFTGKyin26Or5DLrlIDq4ygIDBVcj7oVNeeaYFE=
+github.com/go-chi/chi/v5 v5.4.0/go.mod h1:d1IG7GtKPSjPyBP365PH8sAGVHk3qfB/IhjFNRH1wWM=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348 h1:JnrjqG5iR07/8k7NqrLNilRsl3s1EPRQEGvbPyOce68=
 github.com/go-darwin/apfs v0.0.0-20211011131704-f84b94dbf348/go.mod h1:Czxo/d1g948LtrALAZdL04TL/HnkopquAjxYUuI02bo=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
-github.com/go-fonts/dejavu v0.1.0/go.mod h1:4Wt4I4OU2Nq9asgDCteaAaWZOV24E+0/Pwo0gppep4g=
-github.com/go-fonts/latin-modern v0.2.0/go.mod h1:rQVLdDMK+mK1xscDwsqM5J8U2jrRa3T0ecnM9pNujks=
-github.com/go-fonts/liberation v0.1.1/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2HYqyqAO9z7GY=
-github.com/go-fonts/liberation v0.2.0/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2HYqyqAO9z7GY=
-github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY=
 github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA=
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
-github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
+github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
-github.com/go-latex/latex v0.0.0-20210823091927-c0d11ff05a81/go.mod h1:SX0U8uGpxhq9o2S/CELCSUxEWWAuoCUcVCQWv7G2OCk=
-github.com/go-ldap/ldap/v3 v3.4.13 h1:+x1nG9h+MZN7h/lUi5Q3UZ0fJ1GyDQYbPvbuH38baDQ=
-github.com/go-ldap/ldap/v3 v3.4.13/go.mod h1:LxsGZV6vbaK0sIvYfsv47rfh4ca0JXokCoKjZxsszv0=
+github.com/go-ldap/ldap/v3 v3.4.14 h1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=
+github.com/go-ldap/ldap/v3 v3.4.14/go.mod h1:S4eJUMUNjDkE0ZJtIZdybwyb03sGGLW6gxXT1Hs8VKA=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
 github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
@@ -1082,8 +515,6 @@ github.com/go-openapi/strfmt v0.27.0 h1:kbcTeaD9TXuXD0hhMXzuYa1sdTo6+dWGvwjW93E8
 github.com/go-openapi/strfmt v0.27.0/go.mod h1:s/qhDqfY72irigXUGJmtgid2Rm+3tnz3k8hZaRmvWYc=
 github.com/go-openapi/testify/v2 v2.6.0 h1:5PKH2HE7YJ/LuRPQGvSxBRlFXNQhSetBLlGAgUEu3ug=
 github.com/go-openapi/testify/v2 v2.6.0/go.mod h1:SgsVHtfooshd0tublTtJ50FPKhujf47YRqauXXOUxfw=
-github.com/go-pdf/fpdf v0.5.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
-github.com/go-pdf/fpdf v0.6.0/go.mod h1:HzcnA+A23uwogo0tp9yU+l3V+KXhiESpt1PMayhOh5M=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -1098,12 +529,12 @@ github.com/go-redis/redis/v7 v7.4.1 h1:PASvf36gyUpr2zdOUS/9Zqc80GbM+9BDyiJSJDDOr
 github.com/go-redis/redis/v7 v7.4.1/go.mod h1:JDNMw23GTyLNC4GZu9njt15ctBQVn7xjRfnwdHj/Dcg=
 github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
 github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-redsync/redsync/v4 v4.17.0 h1:FFJ+uxZs44y4Sq10//IFKic9T94AYl+u3Sog98AHzBo=
-github.com/go-redsync/redsync/v4 v4.17.0/go.mod h1:CKVA6qwT07S/916i+Yd9h1/8YFQhCCpPYTQhvvYytJo=
+github.com/go-redsync/redsync/v4 v4.18.0 h1:DDM09PEhmNTf/vziolf2x6391y1hHxF5vQ4ytHl9xQc=
+github.com/go-redsync/redsync/v4 v4.18.0/go.mod h1:yuoqcQ55FS1VypSeVTMqFsJqTdWpEH5eA4MQGKJ9c4M=
 github.com/go-resty/resty/v2 v2.17.2 h1:FQW5oHYcIlkCNrMD2lloGScxcHJ0gkjshV3qcQAyHQk=
 github.com/go-resty/resty/v2 v2.17.2/go.mod h1:kCKZ3wWmwJaNc7S29BRtUhJwy7iqmn+2mLtQrOyQlVA=
-github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
-github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
+github.com/go-sql-driver/mysql v1.10.1 h1:arlSnNLq6a5yxGxV7qg9lF4j0C+KwD6NbQyKr9QL6ME=
+github.com/go-sql-driver/mysql v1.10.1/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
@@ -1115,7 +546,6 @@ github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlnd
 github.com/go-zookeeper/zk v1.0.2/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
 github.com/go-zookeeper/zk v1.0.4 h1:DPzxraQx7OrPyXq2phlGlNSIyWEsAox0RJmjTseMV6I=
 github.com/go-zookeeper/zk v1.0.4/go.mod h1:nOB03cncLtlp4t+UAkGSV+9beXP/akpekBwL+UX1Qcw=
-github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
 github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
@@ -1125,40 +555,24 @@ github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v4 v4.4.1/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
-github.com/golang-jwt/jwt/v4 v4.4.3/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
 github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551 h1:gtexQ/VGyN+VVFRXSFiguSNcXmS6rkKT+X7FdIrTtfo=
 github.com/golang/geo v0.0.0-20210211234256-740aa86cb551/go.mod h1:QZ0nwyI2jOfgRAoBvP+ab5aRr7c9x7lhGEJrKvBwjWI=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
-github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
 github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/mock v1.7.0-rc.1 h1:YojYx61/OLFsiv6Rw1Z96LpldJIy31o+UHmwAUMJ6/U=
 github.com/golang/mock v1.7.0-rc.1/go.mod h1:s42URUywIqd+OcERslBJvOjepvNymP31m3q8d/GkuRs=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
 github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
@@ -1168,44 +582,32 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
-github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v1.0.0 h1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=
 github.com/golang/snappy v1.0.0/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/gomodule/redigo v1.9.3 h1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=
 github.com/gomodule/redigo v1.9.3/go.mod h1:KsU3hiK/Ay8U42qpaJk+kuNa3C+spxapWpM+ywhcgtw=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50 h1:T0YCYlZLzmdsd0bsozI4ecxk03KYOiszof14y7ekQFw=
 github.com/google/flatbuffers/go v0.0.0-20230108230133-3b8644d32c50/go.mod h1:qmRCJW6OqZkfBt584Cmq1im0f4367CLrdABrq5lMOWo=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-replayers/grpcreplay v1.3.0 h1:1Keyy0m1sIpqstQmgz307zhiJ1pV4uIlFds5weTmxbo=
-github.com/google/go-replayers/grpcreplay v1.3.0/go.mod h1:v6NgKtkijC0d3e3RW8il6Sy5sqRVUwoQa4mHOGEy8DI=
+github.com/google/go-replayers/grpcreplay v1.5.1 h1:R90FMYaA6GQNhi/GG0D4zS14HEQ+wpO8bQAV0Qwyt08=
+github.com/google/go-replayers/grpcreplay v1.5.1/go.mod h1:42YCe31fkUrhRo+haVAfLse+gNqGI1iO1wdNR+sWY9U=
 github.com/google/go-replayers/httpreplay v1.2.0 h1:VM1wEyyjaoU53BwrOnaf9VhAyQQEEioJvFYxYcLRKzk=
 github.com/google/go-replayers/httpreplay v1.2.0/go.mod h1:WahEFFZZ7a1P4VM1qEeHy+tME4bwyqPcwWbNlUI1Mcg=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
@@ -1213,70 +615,24 @@ github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
-github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
 github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
 github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
-github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
+github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
 github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/wire v0.7.0 h1:JxUKI6+CVBgCO2WToKy/nQk0sS+amI9z9EjVmdaocj4=
 github.com/google/wire v0.7.0/go.mod h1:n6YbUQD9cPKTnHXEBN2DXlOp/mVADhVErcMFb0v3J18=
-github.com/googleapis/enterprise-certificate-proxy v0.0.0-20220520183353-fd19c99a87aa/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.1.0/go.mod h1:17drOmN3MwGY7t0e+Ei9b45FFGA3fBs3x36SsCg1hq8=
-github.com/googleapis/enterprise-certificate-proxy v0.2.0/go.mod h1:8C0jb7/mgJe/9KK8Lm7X9ctZC2t60YyIpYEI16jx0Qg=
-github.com/googleapis/enterprise-certificate-proxy v0.2.1/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k=
-github.com/googleapis/enterprise-certificate-proxy v0.3.18 h1:hvVi34VucdrV1IIsiWuqYM8kutw/92MxNEFxCJZEh0k=
-github.com/googleapis/enterprise-certificate-proxy v0.3.18/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
-github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
-github.com/googleapis/gax-go/v2 v2.2.0/go.mod h1:as02EH8zWkzwUoLbBaFeQ+arQaj/OthfcblKl4IGNaM=
-github.com/googleapis/gax-go/v2 v2.3.0/go.mod h1:b8LNqSzNabLiUpXKkY7HAR5jr6bIT99EXz9pXxye9YM=
-github.com/googleapis/gax-go/v2 v2.4.0/go.mod h1:XOTVJ59hdnfJLIP/dh8n5CGryZR2LxK9wbMD5+iXC6c=
-github.com/googleapis/gax-go/v2 v2.5.1/go.mod h1:h6B0KMMFNtI2ddbGJn3T3ZbwkeT6yqEF02fYlzkUCyo=
-github.com/googleapis/gax-go/v2 v2.6.0/go.mod h1:1mjbznJAPHFpesgE5ucqfYEscaz5kMdcIDwU/6+DDoY=
-github.com/googleapis/gax-go/v2 v2.7.0/go.mod h1:TEop28CZZQ2y+c0VxMUmu1lV+fQx57QpBWsYpwqHJx8=
-github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=
-github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=
-github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+cLsWGBF62rFAi7WjWO4=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
-github.com/gookit/assert v0.1.1/go.mod h1:jS5bmIVQZTIwk42uXl4lyj4iaaxx32tqH16CFj0VX2E=
-github.com/gookit/color v1.4.2/go.mod h1:fqRyamkC1W8uxl+lxCQxOT09l/vYfZ+QeiX3rKQHCoQ=
-github.com/gookit/color v1.5.0/go.mod h1:43aQb+Zerm/BWh2GnrgOQm7ffz7tvQXEKV6BFMl7wAo=
-github.com/gookit/color v1.6.0 h1:JjJXBTk1ETNyqyilJhkTXJYYigHG24TM9Xa2M1xAhRA=
-github.com/gookit/color v1.6.0/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs=
+github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedur3D3z7kI6HiLX9g3TiAN4/DFU=
+github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
+github.com/googleapis/gax-go/v2 v2.24.1 h1:AtqTN21IXMMWo99LiEVAiBfNNQmO40d8xUfZI640mc0=
+github.com/googleapis/gax-go/v2 v2.24.1/go.mod h1:bWeBei0NVwaNZKb2y1HUBS7gLXIF3/Tu3pq7j8D2Tb0=
 github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
 github.com/gopherjs/gopherjs v1.17.2/go.mod h1:pRRIvn/QzFLrKfvEz3qUuEhtE/zLCWfreZ6J5gM2i+k=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
@@ -1293,10 +649,8 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDa
 github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4ZsPv9hVvWI6+ch50m39Pf2Ks=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -1309,13 +663,13 @@ github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVH
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-immutable-radix v1.3.1 h1:DKHmCUm2hRBK510BaiZlwvpD40f8bJFeZnpfm2KLowc=
 github.com/hashicorp/go-immutable-radix v1.3.1/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
-github.com/hashicorp/go-metrics v0.5.4 h1:8mmPiIJkTPPEbAiV97IxdAGNdRdaWwVap1BU6elejKY=
-github.com/hashicorp/go-metrics v0.5.4/go.mod h1:CG5yz4NZ/AI/aQt9Ucm/vdBnbh7fvmv4lxZ350i+QQI=
+github.com/hashicorp/go-metrics v0.7.0 h1:lLWieZTcbzZT+rY0zrqKbyryXG8RIajdUjmM0+R79eg=
+github.com/hashicorp/go-metrics v0.7.0/go.mod h1:8T/Es8FPTfQvY7azBPGyrwXwwg7mbA9/TmQ1/lWfxb4=
 github.com/hashicorp/go-msgpack v0.5.5 h1:i9R9JSrqIz0QVLz3sz+i3YJdT7TTSLcfLLzJi9aZTuI=
 github.com/hashicorp/go-msgpack v0.5.5/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
 github.com/hashicorp/go-msgpack/v2 v2.1.1/go.mod h1:upybraOAblm4S7rx0+jeNy+CWWhzywQsSRV5033mMu4=
-github.com/hashicorp/go-msgpack/v2 v2.1.2 h1:4Ee8FTp834e+ewB71RDrQ0VKpyFdrKOjvYtnQ/ltVj0=
-github.com/hashicorp/go-msgpack/v2 v2.1.2/go.mod h1:upybraOAblm4S7rx0+jeNy+CWWhzywQsSRV5033mMu4=
+github.com/hashicorp/go-msgpack/v2 v2.1.5 h1:Ue879bPnutj/hXfmUk6s/jtIK90XxgiUIcXRl656T44=
+github.com/hashicorp/go-msgpack/v2 v2.1.5/go.mod h1:bjCsRXpZ7NsJdk45PoCQnzRGDaK8TKm5ZnDI/9y3J4M=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
@@ -1337,31 +691,27 @@ github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/b
 github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
 github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
-github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
-github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
+github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/hashicorp/raft v1.7.0/go.mod h1:N1sKh6Vn47mrWvEArQgILTyng8GoDRNYlgKyK7PMjs0=
-github.com/hashicorp/raft v1.7.3 h1:DxpEqZJysHN0wK+fviai5mFcSYsCkNpFUl1xpAW8Rbo=
-github.com/hashicorp/raft v1.7.3/go.mod h1:DfvCGFxpAUPE0L4Uc8JLlTPtc3GzSbdH0MTJCLgnmJQ=
+github.com/hashicorp/raft v1.8.0 h1:YbfecBcuTar/LNFEDfVTpqu9Aw+MczTk7MYczvy+62k=
+github.com/hashicorp/raft v1.8.0/go.mod h1:agL5fncrpEsbxr5P5KOd2srskDwPY18opjXN5x0661s=
 github.com/hashicorp/raft-boltdb v0.0.0-20230125174641-2a8082862702 h1:RLKEcCuKcZ+qp2VlaaZsYZfLOmIiuJNpEi48Rl8u9cQ=
 github.com/hashicorp/raft-boltdb v0.0.0-20230125174641-2a8082862702/go.mod h1:nTakvJ4XYq45UXtn0DbwR4aU9ZdjlnIenpbs6Cd+FM0=
-github.com/hashicorp/raft-boltdb/v2 v2.3.1 h1:ackhdCNPKblmOhjEU9+4lHSJYFkJd6Jqyvj6eW9pwkc=
-github.com/hashicorp/raft-boltdb/v2 v2.3.1/go.mod h1:n4S+g43dXF1tqDT+yzcXHhXM6y7MrlUd3TTwGRcUvQE=
+github.com/hashicorp/raft-boltdb/v2 v2.4.2 h1:r2RRgZ6ajT+VH8/9yC5mfoKAlt3KrYiUDhfbUSmaoTs=
+github.com/hashicorp/raft-boltdb/v2 v2.4.2/go.mod h1:+wvKK1thWEqM7amY1MXjtQpkm+b9KNUXks0fcus5ZGU=
 github.com/hashicorp/vault/api v1.23.0 h1:gXgluBsSECfRWTSW9niY2jwg2e9mMJc4WoHNv4g3h6A=
 github.com/hashicorp/vault/api v1.23.0/go.mod h1:zransKiB9ftp+kgY8ydjnvCU7Wk8i9L0DYWpXeMj9ko=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
-github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/in-toto/attestation v1.1.2 h1:MBFn6lsMq6dptQZJBhalXTcWMb/aJy3V+GX3VYj/V1E=
-github.com/in-toto/attestation v1.1.2/go.mod h1:gYFddHMZj3DiQ0b62ltNi1Vj5rC879bTmBbrv9CRHpM=
+github.com/in-toto/attestation v1.2.0 h1:aPRUZ3azbqD7yEBD5fP3TD8Dszf+YHo284SOcpahjQk=
+github.com/in-toto/attestation v1.2.0/go.mod h1:r79G45gOmzPismgObLSL+rZTFxUgZLOQJI6LofTZgXk=
 github.com/in-toto/in-toto-golang v0.11.0 h1:nfidMYBFx+E0lnmX5KUnN2Pdm8zdNKal1ayjJuzzRoA=
 github.com/in-toto/in-toto-golang v0.11.0/go.mod h1:u3PjTnwFKjp5a1YCcw8SJg0G+tMeKfVoWsWeFMDCMtw=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -1392,8 +742,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
-github.com/jhump/protoreflect v1.18.0 h1:TOz0MSR/0JOZ5kECB/0ufGnC2jdsgZ123Rd/k4Z5/2w=
-github.com/jhump/protoreflect v1.18.0/go.mod h1:ezWcltJIVF4zYdIFM+D/sHV4Oh5LNU08ORzCGfwvTz8=
+github.com/jhump/protoreflect v1.18.1 h1:h4odAaLg9wyn7yHxMF7sSkJ7JfLwK1oy37/1Pi212GE=
+github.com/jhump/protoreflect v1.18.1/go.mod h1:I2yar2oJEMf0k4EMryPzfV0tvGwN/SejJziYBOpETQo=
 github.com/jhump/protoreflect/v2 v2.0.0-beta.1 h1:Dw1rslK/VotaUGYsv53XVWITr+5RCPXfvvlGrM/+B6w=
 github.com/jhump/protoreflect/v2 v2.0.0-beta.1/go.mod h1:D9LBEowZyv8/iSu97FU2zmXG3JxVTmNw21mu63niFzU=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
@@ -1406,28 +756,19 @@ github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9Y
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
-github.com/jonboulle/clockwork v0.3.0/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
 github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
-github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
 github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/jtolio/noiseconn v0.0.0-20231127013910-f6d9ecbf1de7 h1:JcltaO1HXM5S2KYOYcKgAV7slU0xPy1OcvrVgn98sRQ=
 github.com/jtolio/noiseconn v0.0.0-20231127013910-f6d9ecbf1de7/go.mod h1:MEkhEPFwP3yudWO0lj6vfYpLIB+3eIcuIW+e0AZzUQk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
-github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
-github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
-github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
 github.com/jzelinskie/whirlpool v0.0.0-20201016144138-0675e54bb004 h1:G+9t9cEtnC9jFiTxyptEKuNIAbiN5ZCQzX2a74lj3xg=
 github.com/jzelinskie/whirlpool v0.0.0-20201016144138-0675e54bb004/go.mod h1:KmHnJWQrgEvbuy0vcvj00gtMqbvNn1L+3YUZLK/B92c=
 github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 h1:uC1QfSlInpQF+M0ao65imhwqKnz3Q2z/d8PWZRMQvDM=
@@ -1438,25 +779,18 @@ github.com/karlseguin/ccache/v2 v2.0.8 h1:lT38cE//uyf6KcFok0rlgXtGFBWxkI6h/qg4tb
 github.com/karlseguin/ccache/v2 v2.0.8/go.mod h1:2BDThcfQMf/c0jnZowt16eW405XIqZPavt+HoYEtcxQ=
 github.com/karlseguin/expect v1.0.2-0.20190806010014-778a5f0c6003 h1:vJ0Snvo+SLMY72r5J4sEfkuE7AFbixEP2qRbEcum/wA=
 github.com/karlseguin/expect v1.0.2-0.20190806010014-778a5f0c6003/go.mod h1:zNBxMY8P21owkeogJELCLeHIt+voOSduHYTFUbwRAV8=
-github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
 github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
-github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
-github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
-github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
-github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.0.10/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
+github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
+github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
 github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
-github.com/klauspost/reedsolomon v1.14.1 h1:swE9kzyWXD/wVG+l5Pe8bWnQ0giIY7D1GjCBKk3kG2U=
-github.com/klauspost/reedsolomon v1.14.1/go.mod h1:yjqqjgMTQkBUHSG97/rm4zipffCNbCiZcB3kTqr++sQ=
+github.com/klauspost/reedsolomon v1.14.2 h1:SafJYwpBBQBI6amHUygcjxZjXeN2HpiENHQDwuPWCCQ=
+github.com/klauspost/reedsolomon v1.14.2/go.mod h1:yjqqjgMTQkBUHSG97/rm4zipffCNbCiZcB3kTqr++sQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/koofr/go-httpclient v0.0.0-20240520111329-e20f8f203988 h1:CjEMN21Xkr9+zwPmZPaJJw+apzVbjGL5uK/6g9Q2jGU=
 github.com/koofr/go-httpclient v0.0.0-20240520111329-e20f8f203988/go.mod h1:/agobYum3uo/8V6yPVnq+R82pyVGCeuWW5arT4Txn8A=
 github.com/koofr/go-koofrclient v0.0.0-20221207135200-cbd7fc9ad6a6 h1:FHVoZMOVRA+6/y4yRlbiR3WvsrOcKBd/f64H7YiWR2U=
@@ -1467,7 +801,6 @@ github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFB
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -1482,23 +815,18 @@ github.com/lanrat/extsort v1.4.2 h1:akbLIdo4PhNZtvjpaWnbXtGMmLtnGzXplkzfgl+XTTY=
 github.com/lanrat/extsort v1.4.2/go.mod h1:hceP6kxKPKebjN1RVrDBXMXXECbaI41Y94tt6MDazc4=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/lib/pq v1.12.0 h1:mC1zeiNamwKBecjHarAr26c/+d8V5w/u4J0I/yASbJo=
-github.com/lib/pq v1.12.0/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
+github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ=
+github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/linkedin/goavro/v2 v2.15.0 h1:pDj1UrjUOO62iXhgBiE7jQkpNIc5/tA5eZsgolMjgVI=
 github.com/linkedin/goavro/v2 v2.15.0/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk=
-github.com/linxGnu/grocksdb v1.10.8 h1:Nau01Hhm/0kaVTR6d4viwD6npYbnDvZAfzwJCLzKRYo=
-github.com/linxGnu/grocksdb v1.10.8/go.mod h1:OLQKZwiKwaJiAVCsOzWKvwiLwfZ5Vz8Md5TYR7t7pM8=
-github.com/lithammer/fuzzysearch v1.1.8 h1:/HIuJnjHuXS8bKaiTMeeDlW2/AyIWk2brx1V8LFgLN4=
-github.com/lithammer/fuzzysearch v1.1.8/go.mod h1:IdqeyBClc3FFqSzYq/MXESsS4S0FsZ5ajtkr5xPLts4=
+github.com/linxGnu/grocksdb v1.11.1 h1:/gjcsviJimrQCDDlQCVuvzmeVAvgapQKaFQkQSe48bQ=
+github.com/linxGnu/grocksdb v1.11.1/go.mod h1:WaN+XviOp90uf+bYQ0s4y6DxXedPPMb4QwIsqMd3LdU=
 github.com/lithammer/shortuuid/v3 v3.0.7 h1:trX0KTHy4Pbwo/6ia8fscyHoGA+mf1jWbPJVuvyJQQ8=
 github.com/lithammer/shortuuid/v3 v3.0.7/go.mod h1:vMk8ke37EmiewwolSO1NLW8vP4ZaKlRuDIi8tWWmAts=
 github.com/lpar/calendar v0.2.0 h1:A1kxv6sbvBHFUkd2XotanIRqEXQGreQOeuGhkJqIaRA=
 github.com/lpar/calendar v0.2.0/go.mod h1:fsVJa4o2NvXYzaCE5RXMadqbZzWEhNCGOUPVHTIZdjc=
 github.com/lufia/plan9stats v0.0.0-20260627054121-477a66015f15 h1:YkjVPl/YH5XlJ+/NiwzJtPYXXKRcyjmEUhsDci6YK3c=
 github.com/lufia/plan9stats v0.0.0-20260627054121-477a66015f15/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
-github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
-github.com/lyft/protoc-gen-star/v2 v2.0.1/go.mod h1:RcCdONR2ScXaYnQC5tUzxzlpA3WVYF7/opLeUgcQs/o=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
@@ -1510,21 +838,16 @@ github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy
 github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.23 h1:cYwCQTQf3HB6xUC+BtyCLZNr7IzbOmoZbmssVNzSyiQ=
-github.com/mattn/go-isatty v0.0.23/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
 github.com/mattn/go-runewidth v0.0.3/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
-github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU=
 github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs=
-github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
-github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
-github.com/mattn/go-sqlite3 v1.14.14/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-shellwords v1.0.13 h1:DC0OMEpGjm6LfNFU4ckYcvbQKyp2vE8atyFGXNtDcf4=
+github.com/mattn/go-shellwords v1.0.13/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.14.34 h1:3NtcvcUnFBPsuRcno8pUtupspG/GM+9nZ88zgJcp6Zk=
 github.com/mattn/go-sqlite3 v1.14.34/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY=
-github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
 github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/highwayhash v1.0.4-0.20251030100505-070ab1a87a76 h1:KGuD/pM2JpL9FAYvBrnBBeENKZNh6eNtjqytV6TYjnk=
@@ -1539,18 +862,18 @@ github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4 h1:BpfhmL
 github.com/mitchellh/mapstructure v1.5.1-0.20220423185008-bf980b35cac4/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mmcloughlin/geohash v0.9.0 h1:FihR004p/aE1Sju6gcVq5OLDqGcMnpBY+8moBqIsVOs=
 github.com/mmcloughlin/geohash v0.9.0/go.mod h1:oNZxQo5yWJh0eMQEP/8hwQuVx9Z9tjwFUqcTB1SmG0c=
-github.com/moby/buildkit v0.29.0 h1:wxLEFbCOJntEDjSNNN2YWd8zxltZxT5muDQ0LzpbtpU=
-github.com/moby/buildkit v0.29.0/go.mod h1:Dmv2FeDe34t75QuzeU87rBoZpAAkcpT5zeu4hXzmASc=
+github.com/moby/buildkit v0.31.1 h1:j3p55abBl4kiXXPZgYX+6zWgB2aefqHXoPown12fIzU=
+github.com/moby/buildkit v0.31.1/go.mod h1:YM5iNEbNCc6L1Zt3YWFB/aXNLufvf4Rcu0DPlc9HwQg=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
-github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
+github.com/moby/go-archive v0.3.0 h1:nos4BtzzUIqB406BgQnWGMI4qib9BZ8XUHU+ucv/n1c=
+github.com/moby/go-archive v0.3.0/go.mod h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
-github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
-github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
-github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
-github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
+github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc=
+github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.5.0 h1:5XhyPk2fuOWf6RlSFa3MkIIgDZkF25xToXW8Q/BH7cc=
+github.com/moby/moby/client v0.5.0/go.mod h1:rcVpF8ncl9vo5gaIBdol6CnbEtSj1uxMvEV/UrykF/s=
 github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
 github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
@@ -1559,14 +882,14 @@ github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCnd
 github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I=
 github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
 github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
-github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
-github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/sequential v0.7.0 h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8=
+github.com/moby/sys/sequential v0.7.0/go.mod h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o=
 github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
 github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8=
 github.com/moby/sys/symlink v0.3.0 h1:GZX89mEZ9u53f97npBy4Rc3vJKj7JBDj/PN2I22GrNU=
 github.com/moby/sys/symlink v0.3.0/go.mod h1:3eNdhduHmYPcgsJtZXW1W4XUJdZGBIkttZ8xKqPUJq0=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -1582,10 +905,11 @@ github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8
 github.com/montanaflynn/stats v0.7.1/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ=
 github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw=
+github.com/mschoch/smat v0.2.0 h1:8imxQsjDm8yFEAVBe7azKmKSgzSkZXDuKkSq9374khM=
+github.com/mschoch/smat v0.2.0/go.mod h1:kc9mz7DoBKqDyiRL7VZN8KvXQMWeTaVnttLRXOlotKw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
-github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/nats-io/jwt/v2 v2.8.1 h1:V0xpGuD/N8Mi+fQNDynXohVvp7ZztevW5io8CUWlPmU=
 github.com/nats-io/jwt/v2 v2.8.1/go.mod h1:nWnOEEiVMiKHQpnAy4eXlizVEtSfzacZ1Q43LIRavZg=
 github.com/nats-io/nats-server/v2 v2.11.15 h1:StSf9TINInaZtr4oww2+kXmfwa9SkN//g/LwS19/UJ0=
@@ -1636,15 +960,15 @@ github.com/parquet-go/bitpack v1.0.0 h1:AUqzlKzPPXf2bCdjfj4sTeacrUwsT7NlcYDMUQxP
 github.com/parquet-go/bitpack v1.0.0/go.mod h1:XnVk9TH+O40eOOmvpAVZ7K2ocQFrQwysLMnc6M/8lgs=
 github.com/parquet-go/jsonlite v1.0.0 h1:87QNdi56wOfsE5bdgas0vRzHPxfJgzrXGml1zZdd7VU=
 github.com/parquet-go/jsonlite v1.0.0/go.mod h1:nDjpkpL4EOtqs6NQugUsi0Rleq9sW/OtC1NnZEnxzF0=
-github.com/parquet-go/parquet-go v0.30.1 h1:Oy6ganNrAdFiVwy7wNmWagfPTWA2X9Z3tVHBc7JtuX8=
-github.com/parquet-go/parquet-go v0.30.1/go.mod h1:navtkAYr2LGoJVp141oXPlO/sxLvaOe3la2JEoD8+rg=
+github.com/parquet-go/parquet-go v0.32.0 h1:NWDqTUHfrCS4cJP/Fj2HlxvqsrVedWG3sayMkf+znzM=
+github.com/parquet-go/parquet-go v0.32.0/go.mod h1:navtkAYr2LGoJVp141oXPlO/sxLvaOe3la2JEoD8+rg=
 github.com/pascaldekloe/goe v0.1.0 h1:cBOtyMzM9HTpWjXfbbunk26uA6nG3a8n06Wieeh0MwY=
 github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14 h1:XeOYlK9W1uCmhjJSsY78Mcuh7MVkNjTzmHx1yBzizSU=
 github.com/pengsrc/go-shared v0.2.1-0.20190131101655-1999055a4a14/go.mod h1:jVblp62SafmidSkvWrXyxAme3gaTfEtWwRPGz5cpvHg=
 github.com/peterh/liner v1.2.2 h1:aJ4AOodmL+JxOZZEL2u9iJf8omNRpqHc/EbrK+3mAXw=
@@ -1655,12 +979,8 @@ github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741/go.mod h1:pxMtw7c
 github.com/philhofer/fwd v1.1.2/go.mod h1:qkPdfjR2SIEbspLqpe1tO4n5yICnr2DY7mqEx2tUTP0=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
-github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
-github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
-github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
-github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
-github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=
-github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pierrec/lz4/v4 v4.1.29 h1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=
+github.com/pierrec/lz4/v4 v4.1.29/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
 github.com/pierrre/compare v1.0.2 h1:k4IUsHgh+dbcAOIWCfxVa/7G6STjADH2qmhomv+1quc=
 github.com/pierrre/compare v1.0.2/go.mod h1:8UvyRHH+9HS8Pczdd2z5x/wvv67krDwVxoOndaIIDVU=
 github.com/pierrre/geohash v1.0.0 h1:f/zfjdV4rVofTCz1FhP07T+EMQAvcMM2ioGZVt+zqjI=
@@ -1685,8 +1005,6 @@ github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
 github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
 github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
 github.com/pkg/xattr v0.4.12 h1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=
@@ -1708,39 +1026,23 @@ github.com/pquerna/otp v1.5.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.4.0/go.mod h1:e9GMxYsXl05ICDXkRhurwBS4Q3OK1iX/F2sw+iXX5zU=
-github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.11.1/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.9.1/go.mod h1:yhUN8i9wzaXS3w1O07YhxHEBxD+W35wd8bs7vj7HSQ4=
-github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=
+github.com/prometheus/common v0.71.0/go.mod h1:CLJ5H8TEsGX8bl31BdMkfhIZ+QmZ9tBPPotUxUbfcmk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
-github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
-github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
-github.com/pterm/pterm v0.12.27/go.mod h1:PhQ89w4i95rhgE+xedAoqous6K9X+r6aSOI2eFF7DZI=
-github.com/pterm/pterm v0.12.29/go.mod h1:WI3qxgvoQFFGKGjGnJR849gU0TsEOvKn5Q8LlY1U7lg=
-github.com/pterm/pterm v0.12.30/go.mod h1:MOqLIyMOgmTDz9yorcYbcw+HsgoZo3BQfg2wtl3HEFE=
-github.com/pterm/pterm v0.12.31/go.mod h1:32ZAWZVXD7ZfG0s8qqHXePte42kdz8ECtRyEejaWgXU=
-github.com/pterm/pterm v0.12.33/go.mod h1:x+h2uL+n7CP/rel9+bImHD5lF3nM9vJj80k9ybiiTTE=
-github.com/pterm/pterm v0.12.36/go.mod h1:NjiL09hFhT/vWjQHSj1athJpx6H8cjpHXNAK5bUw8T8=
-github.com/pterm/pterm v0.12.40/go.mod h1:ffwPLwlbXxP+rxT0GsgDTzS3y3rmpAO1NMjUkGTYf8s=
-github.com/pterm/pterm v0.12.83 h1:ie+YmGmA727VuhxBlyGr74Ks+7McV6kT99IB8EU80aA=
-github.com/pterm/pterm v0.12.83/go.mod h1:xlgc6bFWyJIMtmLJvGim+L7jhSReilOlOnodeIYe4Tk=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
 github.com/putdotio/go-putio/putio v0.0.0-20200123120452-16d982cac2b8 h1:Y258uzXU/potCYnQd1r6wlAnoMB68BiCkCcCnKx1SH8=
 github.com/putdotio/go-putio/putio v0.0.0-20200123120452-16d982cac2b8/go.mod h1:bSJjRokAHHOhA+XFxplld8w2R/dXLH7Z3BZ532vhFwU=
 github.com/puzpuzpuz/xsync/v3 v3.5.1 h1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=
@@ -1749,25 +1051,24 @@ github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
 github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
 github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
-github.com/rabbitmq/amqp091-go v1.11.0 h1:HxIctVm9Gid/Vtn706necmZ7Wj6pgGI2eqplRbEY8O8=
-github.com/rabbitmq/amqp091-go v1.11.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
-github.com/rclone/Proton-API-Bridge v1.0.4 h1:uGQJRjQC1hVLd5kqLsXc6CWO6oqrVeLoKQYoHapEZDg=
-github.com/rclone/Proton-API-Bridge v1.0.4/go.mod h1:VTPBYZotKAeDLlAzxU2O/s14NXk9FxUt9hn1jhH2iY8=
-github.com/rclone/go-proton-api v1.0.3 h1:3gBTzR+j0dYiTwtj9yKIdN/aV3W2a8KIPKp0GArojyQ=
-github.com/rclone/go-proton-api v1.0.3/go.mod h1:QAlkFfswzrBuxvCORWV8rZdddg52hahMN98CFWoFW1E=
-github.com/rclone/rclone v1.75.0 h1:3ARHem4jXWltvl+b0PvDAG8s6J/inHd5BRzfwMRb3W8=
-github.com/rclone/rclone v1.75.0/go.mod h1:PGLJUW/WSIJCysALqUcxmaCFyfMXUevf8CbuoOwsAdU=
+github.com/rabbitmq/amqp091-go v1.15.0 h1:LEQL4/yp48/Wigt6A6XOu18RQRo8ZHtB5I/KZJn+gkw=
+github.com/rabbitmq/amqp091-go v1.15.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
+github.com/rclone/Proton-API-Bridge v1.0.5 h1:K1++Qtk3PvgkiCCiv6Pahju1TMOzKY6VSwiwT7XLAVc=
+github.com/rclone/Proton-API-Bridge v1.0.5/go.mod h1:vCeOPhlXzevN0AFojgh1zsjhetiShy/ArvJ/xkFUDWk=
+github.com/rclone/go-proton-api v1.0.4 h1:AJW0e9pB4j0hVK4WqyGErFwaI+5MUQWPCtj5FYYxtPg=
+github.com/rclone/go-proton-api v1.0.4/go.mod h1:QAlkFfswzrBuxvCORWV8rZdddg52hahMN98CFWoFW1E=
+github.com/rclone/rclone v1.75.1 h1:kIxQcoDLj2Gke/gMSHK7OnxhX1Gu1cJBLP1kJZoaFp0=
+github.com/rclone/rclone v1.75.1/go.mod h1:4zmMjGatCkSJPRZDpo+7y3xOl8S29EMUyKvZop5mHr4=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rdleal/intervalst v1.5.0 h1:SEB9bCFz5IqD1yhfH1Wv8IBnY/JQxDplwkxHjT6hamU=
 github.com/rdleal/intervalst v1.5.0/go.mod h1:xO89Z6BC+LQDH+IPQQw/OESt5UADgFD41tYMUINGpxQ=
-github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAtL9E=
-github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA=
-github.com/redis/rueidis v1.0.76 h1:RdDWuvlYBSp+bTrBvaXqJnNEL3VVzsnjo+0psPFgLc4=
-github.com/redis/rueidis v1.0.76/go.mod h1:UsfHPSbomB6QAVMk4iiFkzRy0nh9o7scDGa+SitvBY4=
-github.com/redis/rueidis/rueidiscompat v1.0.76 h1:7LikbiqCQqCsZXeZ+akgZMnjIV/J0VHih9PIX4gGZC4=
-github.com/redis/rueidis/rueidiscompat v1.0.76/go.mod h1:UatQQLVj4QMIsZtpvRWY28qm6r2d72idhcS+C/RM+Zg=
-github.com/rekby/fixenv v0.3.2/go.mod h1:/b5LRc06BYJtslRtHKxsPWFT/ySpHV+rWvzTg+XWk4c=
+github.com/redis/go-redis/v9 v9.22.0 h1:laDvpYXTJtZLloinw1fA5Kqd6HAEH2XKxOkG/PDq2F0=
+github.com/redis/go-redis/v9 v9.22.0/go.mod h1:y2g0Wj8rQvuK0ELM+oxSudcLtC09JScs98I/X9gRWY4=
+github.com/redis/rueidis v1.0.77 h1:ZR41bgJcm7oRFb3aSDPrRhC0eonDSrPzjvvZvHIlNjM=
+github.com/redis/rueidis v1.0.77/go.mod h1:L8mnCQJJaSNL6I4pIR6Rz732HTGS9vmuXm0yT9dRvjo=
+github.com/redis/rueidis/rueidiscompat v1.0.77 h1:S1xiLQsFv8XQ46e0LelC8ihGqbDzVRocXXZLzVAeh64=
+github.com/redis/rueidis/rueidiscompat v1.0.77/go.mod h1:aXCvRVUTvTHZY0owHuz9JjveO1hyuzyDWrpJh8/E3Ds=
 github.com/rekby/fixenv v0.6.1 h1:jUFiSPpajT4WY2cYuc++7Y1zWrnCxnovGCIX72PZniM=
 github.com/rekby/fixenv v0.6.1/go.mod h1:/b5LRc06BYJtslRtHKxsPWFT/ySpHV+rWvzTg+XWk4c=
 github.com/relvacode/iso8601 v1.7.0 h1:BXy+V60stMP6cpswc+a93Mq3e65PfXCgDFfhvNNGrdo=
@@ -1777,19 +1078,14 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rfjakob/eme v1.2.0 h1:8dAHL+WVAw06+7DkRKnRiFp1JL3QjcJEZFqDnndUaSI=
 github.com/rfjakob/eme v1.2.0/go.mod h1:cVvpasglm/G3ngEfcfT/Wt0GwhkuO32pf/poW6Nyk1k=
-github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
 github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
-github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
-github.com/ruudk/golang-pdf417 v0.0.0-20201230142125-a7e3863a1245/go.mod h1:pQAZKsJ8yyVxGRWYNEm9oFB8ieLgKFnamEyDmSA0BRk=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 h1:OkMGxebDjyw0ULyrTYWeN0UNCCkmCWfjPnIA2W6oviI=
@@ -1798,8 +1094,8 @@ github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDc
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/samber/lo v1.53.0 h1:t975lj2py4kJPQ6haz1QMgtId2gtmfktACxIXArw3HM=
 github.com/samber/lo v1.53.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.1 h1:PKK9DyHxif4LZo+uQSgXNqs0jj5+xZwwfKHgph2lxBw=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.1/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
+github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sasha-s/go-deadlock v0.3.1 h1:sqv7fDNShgjcaxkO0JNcOAlr8B9+cV5Ey/OB71efZx0=
 github.com/sasha-s/go-deadlock v0.3.1/go.mod h1:F73l+cr82YSh10GxyRI6qZiCgK64VaZjwesgfQ1/iLM=
 github.com/schollz/progressbar/v3 v3.19.1 h1:iv8BgwOvdML/S3p84uBpy/IMigv4U9594vPZYa2EdrU=
@@ -1810,26 +1106,25 @@ github.com/seaweedfs/go-fuse/v2 v2.9.4 h1:ACyloiuopdhRSjdLLeSWbsVaemMPskORaRF01T
 github.com/seaweedfs/go-fuse/v2 v2.9.4/go.mod h1:zABdmWEa6A0bwaBeEOBUeUkGIZlxUhcdv+V1Dcc/U/I=
 github.com/seaweedfs/goexif v1.0.3 h1:ve/OjI7dxPW8X9YQsv3JuVMaxEyF9Rvfd04ouL+Bz30=
 github.com/seaweedfs/goexif v1.0.3/go.mod h1:Oni780Z236sXpIQzk1XoJlTwqrJ02smEin9zQeff7Fk=
-github.com/seaweedfs/raft v1.2.0 h1:Ez4Hw9ifBbTT7wg54DvGHBjw1vRlTb4roH0TKl0Oj9Y=
-github.com/seaweedfs/raft v1.2.0/go.mod h1:fgs/rAVEzjQ7e04XMzG3eJhwZZRmBW+2uRtjakeCGeU=
-github.com/secure-systems-lab/go-securesystemslib v0.10.0 h1:l+H5ErcW0PAehBNrBxoGv1jjNpGYdZ9RcheFkB2WI14=
-github.com/secure-systems-lab/go-securesystemslib v0.10.0/go.mod h1:MRKONWmRoFzPNQ9USRF9i1mc7MvAVvF1LlW8X5VWDvk=
+github.com/seaweedfs/raft v1.2.2 h1:5OiCQbia7J83WE0whlRGj5oBCEfixqfoOTOeY1IQDXM=
+github.com/seaweedfs/raft v1.2.2/go.mod h1:fgs/rAVEzjQ7e04XMzG3eJhwZZRmBW+2uRtjakeCGeU=
+github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGvPLoKZLv9YvwPYVr0473BdtFs=
+github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
 github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
-github.com/shirou/gopsutil/v4 v4.26.6 h1:Mzr/npDtQC/xpeEuQKHZt8Zo9CmPvhTj8nkR8w5TLDs=
-github.com/shirou/gopsutil/v4 v4.26.6/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
-github.com/sigstore/sigstore v1.10.4 h1:ytOmxMgLdcUed3w1SbbZOgcxqwMG61lh1TmZLN+WeZE=
-github.com/sigstore/sigstore v1.10.4/go.mod h1:tDiyrdOref3q6qJxm2G+JHghqfmvifB7hw+EReAfnbI=
-github.com/sigstore/sigstore-go v1.1.4 h1:wTTsgCHOfqiEzVyBYA6mDczGtBkN7cM8mPpjJj5QvMg=
-github.com/sigstore/sigstore-go v1.1.4/go.mod h1:2U/mQOT9cjjxrtIUeKDVhL+sHBKsnWddn8URlswdBsg=
+github.com/shirou/gopsutil/v4 v4.26.7 h1:IXzpHz/dkMRYAhKkOXr1HB6SuzWU3eoyyeWe7g3bNZc=
+github.com/shirou/gopsutil/v4 v4.26.7/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
+github.com/sigstore/sigstore v1.10.8 h1:1Mgkxvkw4AXMfIP1DOjc6kw0GkUgA8pGVpveN/EfOq4=
+github.com/sigstore/sigstore v1.10.8/go.mod h1:f9+B/4iaYimvUkySyb2mvc73n3RLqNn24grHZM/ET8M=
+github.com/sigstore/sigstore-go v1.2.1 h1:YWP/rDbBaEBvtbkj6xtwsSj38ZCFEhTVVadNOXjVe3A=
+github.com/sigstore/sigstore-go v1.2.1/go.mod h1:I8BqVwAb/SaQJ5pBu5IDFY+ksq8O/1/kCag8XUgrsko=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.5.0/go.mod h1:+F7Ogzej0PZc/94MaYx/nvG9jOFMD2osvC3s+Squfpo=
-github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
 github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
@@ -1850,9 +1145,6 @@ github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cw
 github.com/spacemonkeygo/monkit/v3 v3.0.25-0.20251022131615-eb24eb109368 h1:GyYC5Ntqk/yy9lEIGE7chdIvt4zP44taycwd9YDSGdc=
 github.com/spacemonkeygo/monkit/v3 v3.0.25-0.20251022131615-eb24eb109368/go.mod h1:XkZYGzknZwkD0AKUnZaSXhRiVTLCkq7CWVa3IsE72gA=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
-github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
-github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
@@ -1884,10 +1176,9 @@ github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203 h1:QVqDTf3h2WHt08YuiTGPZLls0Wq99X9bWd0Q5ZSBesM=
 github.com/stvp/tempredis v0.0.0-20181119212430-b82af8480203/go.mod h1:oqN97ltKNihBbwlX8dLpwxCl3+HnXKV/R0e+sRLd9C8=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
@@ -1907,19 +1198,18 @@ github.com/tarantool/go-iproto v1.1.0 h1:HULVOIHsiehI+FnHfM7wMDntuzUddO09DKqu2Wn
 github.com/tarantool/go-iproto v1.1.0/go.mod h1:LNCtdyZxojUed8SbOiYHoc3v9NvaZTB7p96hUySMlIo=
 github.com/tarantool/go-option v1.1.0 h1:ShoOhNsdL41sRpm4hXCRDjV8H0WzPkd4UnKhLKbW//w=
 github.com/tarantool/go-option v1.1.0/go.mod h1:hMr9z2JXOWlgdCBpCPSL2nwp8718GKYvNBJ+ZuzJbCo=
-github.com/tarantool/go-tarantool/v3 v3.0.0 h1:zsIXS4nvSSXqZWtN/f1Bfuq973j6J85O5U/8RYQCRcE=
-github.com/tarantool/go-tarantool/v3 v3.0.0/go.mod h1:TXxLWhUCgdxXFfelnTSkq+goKRTRj660zxq4/WXPe8k=
-github.com/testcontainers/testcontainers-go v0.43.0 h1:oEQx5MW2DGd9z3AeEQfB2lPM0eLs7ztyaGRu75bFo5A=
-github.com/testcontainers/testcontainers-go v0.43.0/go.mod h1:+VxkT2NQnKOZPKi6praMuMKYHYyOGXr0XSBSlSMCzFo=
-github.com/testcontainers/testcontainers-go/modules/compose v0.42.0 h1:+t1ZN31TD36cwxmeLqGwe7wIdvblBm0Z+vlj4SX8Mv0=
-github.com/testcontainers/testcontainers-go/modules/compose v0.42.0/go.mod h1:CfMpouDHqNTCHC8CijEURU2ZotTV3QhH6pXd48s6ofk=
+github.com/tarantool/go-tarantool/v3 v3.0.2 h1:9ZtHllun80QX7KS9tqd3dXa+QAu2BfqFtX1ZWcNnaW8=
+github.com/tarantool/go-tarantool/v3 v3.0.2/go.mod h1:TXxLWhUCgdxXFfelnTSkq+goKRTRj660zxq4/WXPe8k=
+github.com/testcontainers/testcontainers-go v0.44.0 h1:/Fwh6HY1mIikhnm9e7HwoxGycx0lzRAE0f5VQpjFxzI=
+github.com/testcontainers/testcontainers-go v0.44.0/go.mod h1:IcnwQrYTO86xHXu5bvMaBH7ATlbS3Qn1M1QWW3c66rE=
+github.com/testcontainers/testcontainers-go/modules/compose v0.44.0 h1:8YcW51jhgpkkiRVe10Wj9TCBthJmoNpU2fK5WSf7TQ8=
+github.com/testcontainers/testcontainers-go/modules/compose v0.44.0/go.mod h1:0du5YaH5n8Of4bDM/RwIt421Q14kvqrXZ0mB8EjuMoo=
 github.com/the42/cartconvert v0.0.0-20131203171324-aae784c392b8 h1:I4DY8wLxJXCrMYzDM6lKCGc3IQwJX0PlTLsd3nQqI3c=
 github.com/the42/cartconvert v0.0.0-20131203171324-aae784c392b8/go.mod h1:fWO/msnJVhHqN1yX6OBoxSyfj7TEj1hHiL8bJSQsK30=
 github.com/tiancaiamao/gp v0.0.0-20221230034425-4025bc8a4d4a h1:J/YdBZ46WKpXsxsW93SG+q0F8KI+yFrcIDT4c/RNoc4=
 github.com/tiancaiamao/gp v0.0.0-20221230034425-4025bc8a4d4a/go.mod h1:h4xBhSNtOeEosLJ4P7JyKXX7Cabg7AVkWCK5gV2vOrM=
-github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
-github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/gjson v1.20.0 h1:+agJ3rEzKcCXKDKo0ml26UROcpcAlnZyjq+TjbY5Fto=
+github.com/tidwall/gjson v1.20.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
 github.com/tidwall/match v1.2.0 h1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=
 github.com/tidwall/match v1.2.0/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
@@ -1941,8 +1231,8 @@ github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc h1:9lRDQMhESg+zvGYm
 github.com/tmthrgd/go-hex v0.0.0-20190904060850-447a3041c3bc/go.mod h1:bciPuU6GHm1iF1pBvUfxfsH0Wmnc2VbpgvbI9ZWuIRs=
 github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 h1:r0p7fK56l8WPequOaR3i9LBqfPtEdXIQbUTzT55iqT4=
 github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY=
-github.com/tonistiigi/fsutil v0.0.0-20251211185533-a2aa163d723f h1:Z4NEQ86qFl1mHuCu9gwcE+EYCwDKfXAYXZbdIXyxmEA=
-github.com/tonistiigi/fsutil v0.0.0-20251211185533-a2aa163d723f/go.mod h1:BKdcez7BiVtBvIcef90ZPc6ebqIWr4JWD7+EvLm6J98=
+github.com/tonistiigi/fsutil v0.0.0-20260609174605-b61e79c0c046 h1:j29MScUISj0S98EHdM6/pzKgqppfswl9OZ7OVpnQdzE=
+github.com/tonistiigi/fsutil v0.0.0-20260609174605-b61e79c0c046/go.mod h1:K5zrLch9UaSGNiek5XHZeqZUf1zPWJHqDfLIcnpquQ4=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 h1:2f304B10LaZdB8kkVEaoXvAMVan2tl9AiK4G0odjQtE=
 github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0/go.mod h1:278M4p8WsNh3n4a1eqiFcV2FGk7wE5fwUpUom9mK9lE=
 github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea h1:SXhTLE6pb6eld/v/cCndK0AMpt1wiVFb/YYmqB3/QG0=
@@ -1954,8 +1244,8 @@ github.com/tsuna/gohbase v0.0.0-20201125011725-348991136365/go.mod h1:zj0GJHGvyf
 github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/twmb/avro v1.7.2 h1:cmrEBRSbELRqsg/dRkQvVWuOaR2EfGifHIt/2iJ9lfI=
-github.com/twmb/avro v1.7.2/go.mod h1:X0fT1dY2xcbV4YuCE4mYro+qljHl4kUF5uA/2z1rgSk=
+github.com/twmb/avro v1.9.0 h1:JSiqewo3AANj7vlVCQXBsIZTA3LiiBble7Xp8T4lbtA=
+github.com/twmb/avro v1.9.0/go.mod h1:X0fT1dY2xcbV4YuCE4mYro+qljHl4kUF5uA/2z1rgSk=
 github.com/twmb/murmur3 v1.1.8 h1:8Yt9taO/WN3l08xErzjeschgZU2QSrwm1kclYq+0aRg=
 github.com/twmb/murmur3 v1.1.8/go.mod h1:Qq/R7NUyOfr65zD+6Q5IHKsJLwP7exErjN6lyyq3OSQ=
 github.com/twpayne/go-geom v1.6.1 h1:iLE+Opv0Ihm/ABIcvQFGIiFBXd76oBIar9drAwHFhR4=
@@ -2021,41 +1311,30 @@ github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
 github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
 github.com/xhit/go-str2duration/v2 v2.1.0/go.mod h1:ohY8p+0f07DiV6Em5LKB0s2YpLtXVyJfNt1+BlmyAsU=
-github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
-github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/xyproto/randomstring v1.0.5 h1:YtlWPoRdgMu3NZtP45drfy1GKoojuR7hmRcnhZqKjWU=
 github.com/xyproto/randomstring v1.0.5/go.mod h1:rgmS5DeNXLivK7YprL0pY+lTuhNQW3iGxZ18UQApw/E=
-github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e h1:9LPdmD1vqadsDQUva6t2O9MbnyvoOgo8nFNPaOIH5U8=
-github.com/yandex-cloud/go-genproto v0.0.0-20211115083454-9ca41db5ed9e/go.mod h1:HEUYX/p8966tMUHHT+TsS0hF/Ca/NYwqprC5WXSDMfE=
-github.com/ydb-platform/ydb-go-genproto v0.0.0-20221215182650-986f9d10542f/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
-github.com/ydb-platform/ydb-go-genproto v0.0.0-20230528143953-42c825ace222/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
-github.com/ydb-platform/ydb-go-genproto v0.0.0-20260428144813-1c07baab7f7b h1:xeiobG1riqe6dTMZuTcOvwOY0BbFidSk3gRLyVeLfJA=
-github.com/ydb-platform/ydb-go-genproto v0.0.0-20260428144813-1c07baab7f7b/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
-github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.2 h1:e2nGQPGC5OEPBWlMnLPFpdgyqNA8iTOPiZShCrv6944=
-github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.2/go.mod h1:9YzkhlIymWaJGX6KMU3vh5sOf3UKbCXkG/ZdjaI3zNM=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.44.0/go.mod h1:oSLwnuilwIpaF5bJJMAofnGgzPJusoI3zWMNb8I+GnM=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.47.3/go.mod h1:bWnOIcUHd7+Sl7DN+yhyY1H/I61z53GczvwJgXMgvj0=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.146.3 h1:0ybsLjWJ25M8XXGXk7NfjhO+s8bqBcGGWt8iB2DQiHQ=
-github.com/ydb-platform/ydb-go-sdk/v3 v3.146.3/go.mod h1:b9NEO6mgaiqsnOMkS003uS82XsKh6GL+ZTFfPqXWz+c=
-github.com/ydb-platform/ydb-go-yc v0.12.1 h1:qw3Fa+T81+Kpu5Io2vYHJOwcrYrVjgJlT6t/0dOXJrA=
-github.com/ydb-platform/ydb-go-yc v0.12.1/go.mod h1:t/ZA4ECdgPWjAb4jyDe8AzQZB5dhpGbi3iCahFaNwBY=
-github.com/ydb-platform/ydb-go-yc-metadata v0.6.1 h1:9E5q8Nsy2RiJMZDNVy0A3KUrIMBPakJ2VgloeWbcI84=
-github.com/ydb-platform/ydb-go-yc-metadata v0.6.1/go.mod h1:NW4LXW2WhY2tLAwCBHBuHAwRUVF5lsscaSPjdAFKldc=
+github.com/yandex-cloud/go-genproto v0.0.0-20240819112322-98a264d392f6 h1:w57l27dDkJTVSi8hM3H/WVkiv+CsJwAIweqO6pFdljk=
+github.com/yandex-cloud/go-genproto v0.0.0-20240819112322-98a264d392f6/go.mod h1:HEUYX/p8966tMUHHT+TsS0hF/Ca/NYwqprC5WXSDMfE=
+github.com/ydb-platform/ydb-go-genproto v0.0.0-20260810122915-65bfd5c4b705 h1:7VKlOrBIQ8L8acJ9wFCt6lWzLDbOhc05VLpL31743tU=
+github.com/ydb-platform/ydb-go-genproto v0.0.0-20260810122915-65bfd5c4b705/go.mod h1:Er+FePu1dNUieD+XTMDduGpQuCPssK5Q4BjF+IIXJ3I=
+github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.3 h1:A48PcmIETWwbEMIGwndv52uME6J1eJ28MBgF7HVR74o=
+github.com/ydb-platform/ydb-go-sdk-auth-environ v0.5.3/go.mod h1:oRGF+67GWLbtNzqGygsPIUsjXmsRXD1KS5m3o5ppm2k=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.155.1 h1:ZMByYe53zZ9R1o23fxJsbNhjzKFQkzpXm6uGj8gWHXQ=
+github.com/ydb-platform/ydb-go-sdk/v3 v3.155.1/go.mod h1:dJXJ1u00IqO8Vsph8fWmYj8b1E7jyphnvJPqA69emBY=
+github.com/ydb-platform/ydb-go-yc v0.12.5 h1:qYIeU1N6a92FaDA0+/vR55l5IzRF50MeLZwUWwvy2xQ=
+github.com/ydb-platform/ydb-go-yc v0.12.5/go.mod h1:DlSltVQKEdXJotaAYwoHzMGDF9EJw5S3hg3LXe/5yYw=
+github.com/ydb-platform/ydb-go-yc-metadata v0.6.2 h1:CZFawwHjLcjsxcl/g0dGIXbI2r41okPGLCydF4qTHcc=
+github.com/ydb-platform/ydb-go-yc-metadata v0.6.2/go.mod h1:mU1NRwVEHF+WyO1q6etWycy17N/S5288uUbsMvvk9ps=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78/go.mod h1:aL8wCCfTfSfmXjznFBSZNN13rSJjlIOI1fUNAtF7rmI=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
-github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yunify/qingstor-sdk-go/v3 v3.2.0 h1:9sB2WZMgjwSUNZhrgvaNGazVltoFUUfuS9f0uCWtTr8=
 github.com/yunify/qingstor-sdk-go/v3 v3.2.0/go.mod h1:KciFNuMu6F4WLk9nGwwK69sCGKLCdd9f97ac/wfumS4=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/assert v1.3.1 h1:vukIABvugfNMZMQO1ABsyQDJDTVQbn+LWSMy1ol1h6A=
 github.com/zeebo/assert v1.3.1/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
 github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
@@ -2066,76 +1345,66 @@ github.com/zeebo/mwc v0.0.7 h1:0NerGhCww6ZQx+/xCx5iwznftveokvto1KILpYfENZk=
 github.com/zeebo/mwc v0.0.7/go.mod h1:0B32or6moOig1YGuqMoimBpU9QK9uYaGG2bBOuddqtE=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
 github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
 go.einride.tech/aip v0.83.0 h1:TI21IdeOnLTwZEJ3BxtImIZk6bsN2Q+sd0x99SLiQ+M=
 go.einride.tech/aip v0.83.0/go.mod h1:E8+wdTApA70odnpFzJgsGogHozC2JCIhFJBKPr8bVig=
 go.etcd.io/bbolt v1.5.0 h1:S7GAl7Fxv12yohbwFfIbQCGDWbQbtDGPET4P/bD4lxU=
 go.etcd.io/bbolt v1.5.0/go.mod h1:mkltfYE5aUHQxUct9N9V+Kp7aSjFqjgrhcXIS70Lrdk=
-go.etcd.io/etcd/api/v3 v3.6.12 h1:OLOZUKEuAA36TR48F0cIaa8FdzrWygjyfrJxXg4iDgs=
-go.etcd.io/etcd/api/v3 v3.6.12/go.mod h1:p14EIQXHbuOQbVvL/WEes5uqKnxP9AgKJgpjbMVvzvE=
-go.etcd.io/etcd/client/pkg/v3 v3.6.12 h1:36zzB+pQOdHbhN+kH2iJz/K8bJn0ZLtLfPPO7jozTDo=
-go.etcd.io/etcd/client/pkg/v3 v3.6.12/go.mod h1:hh2+ZXtfLzs3o6mn92ntgNPBrTJJOvXqICM5g3L3DMY=
-go.etcd.io/etcd/client/v3 v3.6.12 h1:kMSP6JcPZMqSJiX+TXdUIBU/4eXEZWBAaui4VihMbIc=
-go.etcd.io/etcd/client/v3 v3.6.12/go.mod h1:CMs6fJWYiZQk4ytFjd4lE1diOvvRMmtbbn/alZXd3dQ=
+go.etcd.io/etcd/api/v3 v3.7.1 h1:KJG0/DcWGfe3Y1otDf/fsBf0TSSgpxZ5RO/L8SFt73E=
+go.etcd.io/etcd/api/v3 v3.7.1/go.mod h1:8bXIpCMeV7E3/XL0Ix123ATn3dB+0V7d9zklHbB0m78=
+go.etcd.io/etcd/client/pkg/v3 v3.7.1 h1:rKYsj3pRkR0eK3yjT3XOgrhqfmIfj9pzNgxjh7mfFv4=
+go.etcd.io/etcd/client/pkg/v3 v3.7.1/go.mod h1:cnzZGIUzSfjEwLC6UBVsSXlEK1eepS/JUD7wE6PLRT0=
+go.etcd.io/etcd/client/v3 v3.7.1 h1:0PEMMC0KuZmVIN+RAbdqfkZ45pYTgKVtmBEbRCvZFUg=
+go.etcd.io/etcd/client/v3 v3.7.1/go.mod h1:ffNqALa8tRCYhYo1F9oR489y23K39Gz+BSR3ApAGYq0=
 go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5tU=
 go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=
-go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 h1:0Qx7VGBacMm9ZENQ7TnNObTYI4ShC+lHI16seduaxZo=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0/go.mod h1:Sje3i3MjSPKTSPvVWCaL8ugBzJwik3u4smCjUeuupqg=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0 h1:2pn7OzMewmYRiNtv1doZnLo3gONcnMHlFnmOR8Vgt+8=
-go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.63.0/go.mod h1:rjbQTDEPQymPE0YnRQp9/NuPwwtL0sesz/fnqRW/v84=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q=
-go.opentelemetry.io/otel/exporters/zipkin v1.36.0 h1:s0n95ya5tOG03exJ5JySOdJFtwGo4ZQ+KeY7Zro4CLI=
-go.opentelemetry.io/otel/exporters/zipkin v1.36.0/go.mod h1:m9wRxtKA2MZ1HcnNC4BKI+9aYe434qRZTCvI7QGUN7Y=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
-go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
+go.opentelemetry.io/contrib/detectors/gcp v1.46.0 h1:PI8dGkqDaQkwJ8kOopqMhDTbrnK3UIeG/RCHH4HErbo=
+go.opentelemetry.io/contrib/detectors/gcp v1.46.0/go.mod h1:nsrN5c/sOLoY2vsPxN/rQ0V0nvGrWJCqcW4UXLtqNG8=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0 h1:B2h3uqicet1CT2N5TOFhS+Gq++9i0/CLmaxvhmhtP5s=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.71.0/go.mod h1:dylvB+ZiiwMvsDij9O84Uy7SijLgHMX4mbkncds+4Sw=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.69.0 h1:MCcYL7J6Vt/X0kjqbMZkekCmwsurbQRbL69vkiye2lk=
+go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.69.0/go.mod h1:3jnStNwSufK+f5ktjL4EPcwtig4rtd81NS70lqHuXl8=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0 h1:qkDYCAFiZXLcs1L4aY+tP2wguQ4kURANqHOQMA2et2s=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.46.0/go.mod h1:tkipS4DRzmpAmvg+Gw4++O1IdDq6TVDnvnYU6cmbQVs=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 h1:RuynHbfU8JUEw7DyONgkVYg2SVtsoF28y0LGIr69jgA=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0/go.mod h1:qZF+/lBs71APw8mlnEZcqZHMzqrYrsFiJOv83lX1OGo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 h1:OFnwLJr+pF3iHrlGSzbxyuo6/6HyBlnlN1CWEJmBVcw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0/go.mod h1:716wFneO0ov19A2beH5hjfh9AK5z/VWNAtDijp1Y0/g=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0 h1:w53CDeOA/Kurp7yRsegSr6pbbr759dOvJ+yNmWM6Hxs=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.46.0/go.mod h1:BOmGMCbAtvcJiSJ+hLuhgPLdDbimnraSl8irz3iY8sY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0 h1:QBajQ2SrwQijzHyZbQlPsuIzpl/ll8DY6wPWsajeGcI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.45.0/go.mod h1:08ZQLjrPLQ6R4kAXvuOvODEer5Yh4CoFvll5qB2BCI8=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.46.0 h1:PR9eAf7o0dQs3hshZNZpE9aW2dXWX/KdDf6pJilVD3U=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.46.0/go.mod h1:2Z4KyNdH1uuzivdinyfGsxzNNT/Rl45pwtVwfYVI0xk=
+go.opentelemetry.io/otel/exporters/zipkin v1.45.0 h1:KN3btaILMTxR4QDHVGAO87lq5ButzK7l+kIfLuxQ1oA=
+go.opentelemetry.io/otel/exporters/zipkin v1.45.0/go.mod h1:yNcodmUclM4InyWoOwX/YW4Jri0Gj5FWAlM+NqCrtqY=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
+go.opentelemetry.io/otel/metric/x v0.68.0 h1:TA/cBT23D3MnxYPwHL7YFOdYGdx0A0v+s7Mzotpd1dU=
+go.opentelemetry.io/otel/metric/x v0.68.0/go.mod h1:agudOmvWhwUTjgibWDzxD2PoWYnpw5Ht5jISYOD2Hd4=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
+go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
+go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
+go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
-go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g=
-go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk=
+go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
+go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
 go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/atomic v1.12.0 h1:BvcXdFKuviU4fTL/f+SxdQ5qJX/Jix8pAkgdUcb3XOE=
+go.uber.org/atomic v1.12.0/go.mod h1:I6c4cg+6HCxRjfjSsYtApoFILnpc0CGUdGkXVqbYVNk=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
 go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -2148,107 +1417,59 @@ go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
 go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
-go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
-go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=
+go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
-go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-gocloud.dev v0.46.0 h1:niIuZwSjMtBx8K+ITB2s5kZullB13PGOS2ZoQPZxQ4Q=
-gocloud.dev v0.46.0/go.mod h1:ACQe+2qO+hEO+pdcvvsM+RB63r8TyGD1W3ESCLFyzvM=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+gocloud.dev v0.47.0 h1:qN4/0vtutn97f1X5ziisf3WXuaFL9AR0FIRnyJRYzgA=
+gocloud.dev v0.47.0/go.mod h1:OdMnyXQRhM17U0a0DwU57pe0c01qN3lJNmaeeRYW0D0=
 gocloud.dev/pubsub/natspubsub v0.46.0 h1:cTmJnWOmhb3dYRzX7PvNkq2m5mQdBLFFxZbl/21pfjk=
 gocloud.dev/pubsub/natspubsub v0.46.0/go.mod h1:hbEEsNt6mGQoonGQi39VOjHfx2f13DOmWouh4hGsfrU=
-gocloud.dev/pubsub/rabbitpubsub v0.46.0 h1:uWJ8z/F8xYxoTlBafTweoKvX2V85cwtN+/+nyRRtjZ0=
-gocloud.dev/pubsub/rabbitpubsub v0.46.0/go.mod h1:Ef5XHxv17zV9B3U9xoYAqJ8Rutslxt5Emb5e1cScuXc=
+gocloud.dev/pubsub/rabbitpubsub v0.47.0 h1:iDSspbLlDbPL2avESbDfMNBK4r3B6H04Ejx+/hqh9JE=
+gocloud.dev/pubsub/rabbitpubsub v0.47.0/go.mod h1:2tSZnGnGLPw2ayW4pVaUmnA1LCjP7rekpXPkaBUZt0o=
 golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
 golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.4.0/go.mod h1:3quD/ATkf6oY+rnes5c3ExXTbLc8mueNue5/DoinL80=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
-golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191002040644-a1355ae1e2c3/go.mod h1:NOZ3BPKG0ec/BKJQgnvsSFpcKLM5xXVWnvZS97DWHgE=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597 h1:qLvzZeaANDgyVOA8pyHCOStGlXn0rseXma+GQjeuv2g=
-golang.org/x/exp v0.0.0-20260709172345-9ea1abe57597/go.mod h1:EdfpwwqSu+0Li0mzskwHU6FWDV3t9Q+RZDo3QMUtL3Q=
-golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20200119044424-58c23975cae1/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20200430140353-33d19683fad8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20200618115811-c13761719519/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20201208152932-35266b937fa6/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20210216034530-4410531fe030/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.0.0-20210607152325-775e3b0c77b9/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.0.0-20210628002857-a66eb6448b8d/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.0.0-20211028202545-6944b10bf410/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.0.0-20220302094943-723b81ca9867/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
-golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
+golang.org/x/exp v0.0.0-20260813180055-c1d0aacb2297 h1:YXnL44eJ77R+ji4/ooy8UsXIhz+lbi2Qgdlc8iRN0gY=
+golang.org/x/exp v0.0.0-20260813180055-c1d0aacb2297/go.mod h1:Mkmymgv+uMpSQ/XxJ/7GpdrdYoqm3u72jEbpCLiJmNk=
+golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
+golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
-golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -2257,590 +1478,177 @@ golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220325170049-de3da57026de/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220412020605-290c469a71a5/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220425223048-2871e0cb64e4/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220617184016-355a448f1bc9/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220624214902-1bab6f366d9e/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.0.0-20220909164309-bea034e7d591/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.0.0-20221012135044-0b7e1fb9d458/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.0.0-20221014081412-f15817d10f9b/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
-golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.4.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE=
-golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.16.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw=
+golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
-golang.org/x/oauth2 v0.0.0-20220608161450-d0670ef3b1eb/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220622183110-fd043fe589d2/go.mod h1:jaDAt6Dkxork7LmZnYtzbRWj0W47D86a3TGe0YHBvmE=
-golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20221006150949-b44042a4b9c1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
-golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec=
-golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
-golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
+golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210304124612-50617c2ba197/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211013075003-97ac67df715c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211210111614-af8b64212486/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220227234510-4e6760a101f9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220319134239-a9b59b0215f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220328115105-d36c6a25d886/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220502124256-b6088ccd6cba/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220610221304-9f5ed59c137d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220624220833-87e55d714810/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220829200755-d48e67d00261/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
+golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA=
-golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
-golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
+golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+golang.org/x/time v0.16.0 h1:vMb6ptszcQMkcwiRTAuNNU50gom6++Q/6gY2hDM6VDE=
+golang.org/x/time v0.16.0/go.mod h1:rVKOqvZeKvrDKTQiAHJ7wmwP0RzleSphoEA9RcdLA0s=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190927191325-030b2cf1153e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201124115921-2c860bdd6e78/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20201211185031-d93e913c1a58/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
 golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
-golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
-golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
+golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI=
+golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=
 golang.org/x/tools/godoc v0.1.0-deprecated h1:o+aZ1BOj6Hsx/GBdJO/s815sqftjSnrZZwyYTHODvtk=
 golang.org/x/tools/godoc v0.1.0-deprecated/go.mod h1:qM63CriJ961IHWmnWa9CjZnBndniPt4a3CK0PVB9bIg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY=
 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
-gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
-gonum.org/v1/gonum v0.8.2/go.mod h1:oe/vMfY3deqTw+1EZJhuvEW2iwGF1bW9wwu7XCu0+v0=
-gonum.org/v1/gonum v0.9.3/go.mod h1:TZumC3NeyVQskjXqmyWt4S3bINhy7B4eYwW69EbyX+0=
-gonum.org/v1/gonum v0.11.0/go.mod h1:fSG4YDCxxUZQJ7rKsQrj0gMOg00Il0Z96/qMA4bVQhA=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
-gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
-gonum.org/v1/plot v0.9.0/go.mod h1:3Pcqqmp6RHvJI72kgb8fThyUnav364FOsdDo2aGW5lY=
-gonum.org/v1/plot v0.10.1/go.mod h1:VZW5OlhkL1mysU9vaqNHnsy86inf6Ot+jB3r+BczCEo=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
-google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
-google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
-google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
-google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
-google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
-google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
-google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
-google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
-google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
-google.golang.org/api v0.63.0/go.mod h1:gs4ij2ffTRXwuzzgJl/56BdwJaA194ijkfn++9tDuPo=
-google.golang.org/api v0.67.0/go.mod h1:ShHKP8E60yPsKNw/w8w+VYaj9H6buA5UqDp8dhbQZ6g=
-google.golang.org/api v0.70.0/go.mod h1:Bs4ZM2HGifEvXwd50TtW70ovgJffJYw2oRCOFU/SkfA=
-google.golang.org/api v0.71.0/go.mod h1:4PyU6e6JogV1f9eA4voyrTY2batOLdgZ5qZ5HOCc4j8=
-google.golang.org/api v0.74.0/go.mod h1:ZpfMZOVRMywNyvJFeqL9HRWBgAuRfSjJFpe9QtRRyDs=
-google.golang.org/api v0.75.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
-google.golang.org/api v0.77.0/go.mod h1:pU9QmyHLnzlpar1Mjt4IbapUCy8J+6HD6GeELN69ljA=
-google.golang.org/api v0.78.0/go.mod h1:1Sg78yoMLOhlQTeF+ARBoytAcH1NNyyl390YMy6rKmw=
-google.golang.org/api v0.80.0/go.mod h1:xY3nI94gbvBrE0J6NHXhxOmW97HG7Khjkku6AFB3Hyg=
-google.golang.org/api v0.84.0/go.mod h1:NTsGnUFJMYROtiquksZHBWtHfeMC7iYthki7Eq3pa8o=
-google.golang.org/api v0.85.0/go.mod h1:AqZf8Ep9uZ2pyTvgL+x0D3Zt0eoT9b5E8fmzfu6FO2g=
-google.golang.org/api v0.90.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
-google.golang.org/api v0.93.0/go.mod h1:+Sem1dnrKlrXMR/X0bPnMWyluQe4RsNoYfmNLhOIkzw=
-google.golang.org/api v0.95.0/go.mod h1:eADj+UBuxkh5zlrSntJghuNeg8HwQ1w5lTKkuqaETEI=
-google.golang.org/api v0.96.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
-google.golang.org/api v0.97.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
-google.golang.org/api v0.98.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
-google.golang.org/api v0.99.0/go.mod h1:1YOf74vkVndF7pG6hIHuINsM7eWwpVTAfNMNiL91A08=
-google.golang.org/api v0.100.0/go.mod h1:ZE3Z2+ZOr87Rx7dqFsdRQkRBk36kDtp/h+QpHbB7a70=
-google.golang.org/api v0.102.0/go.mod h1:3VFl6/fzoA+qNuS1N1/VfXY4LjoXN/wzeIp7TweWwGo=
-google.golang.org/api v0.103.0/go.mod h1:hGtW6nK1AC+d9si/UBhw8Xli+QMOf6xyNAyJw4qU9w0=
-google.golang.org/api v0.106.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
-google.golang.org/api v0.107.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
-google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/O9MY=
-google.golang.org/api v0.110.0/go.mod h1:7FC4Vvx1Mooxh8C5HWjzZHcavuS2f6pmJpZx60ca7iI=
-google.golang.org/api v0.289.0 h1:DmH0c6NigNFmsvsohM9bxv+MzVhag3aGHnojA5fFQjc=
-google.golang.org/api v0.289.0/go.mod h1:weJZ3lldHFYI0DBFNKpJelUDNnusTt5YaOEgxvt8ci8=
+google.golang.org/api v0.297.0 h1:WktxTsnnx0yZNnsR6j0q6hR21RnnK81FHTOPy/ux4OE=
+google.golang.org/api v0.297.0/go.mod h1:S4m8x0M6OkQpkOzGk1y9JG2sm4fFQrMh6dxzjCTszhE=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210329143202-679c6ae281ee/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
-google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
-google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
-google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
-google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
-google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
-google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
-google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
 google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
-google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20211221195035-429b39de9b1c/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220126215142-9970aeb2e350/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220207164111-0872dc986b00/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220222213610-43724f9ea8cf/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220304144024-325a89244dc8/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220310185008-1973136f34c6/go.mod h1:kGP+zUP2Ddo0ayMi4YuN7C3WZyJvGLZRh8Z5wnAqvEI=
-google.golang.org/genproto v0.0.0-20220324131243-acbaeb5b85eb/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
-google.golang.org/genproto v0.0.0-20220329172620-7be39ac1afc7/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220407144326-9054f6ed7bac/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220413183235-5e96e2839df9/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220414192740-2d67ff6cf2b4/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220421151946-72621c1f0bd3/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220429170224-98d788798c3e/go.mod h1:8w6bsBMX6yCPbAVTeqQHvzxW0EIFigd5lZyahWgyfDo=
-google.golang.org/genproto v0.0.0-20220502173005-c8bf987b8c21/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220518221133-4f43b3371335/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220523171625-347a074981d8/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
-google.golang.org/genproto v0.0.0-20220608133413-ed9918b62aac/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220616135557-88e70c0c3a90/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220617124728-180714bec0ad/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220624142145-8cd45d7dbd1f/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220628213854-d9e0b6570c03/go.mod h1:KEWEmljWE5zPzLBa/oHl6DaEt9LmfH6WtH1OHIvleBA=
-google.golang.org/genproto v0.0.0-20220722212130-b98a9ff5e252/go.mod h1:GkXuJDJ6aQ7lnJcRF+SJVgFdQhypqgl3LB1C9vabdRE=
-google.golang.org/genproto v0.0.0-20220801145646-83ce21fca29f/go.mod h1:iHe1svFLAZg9VWz891+QbRMwUv9O/1Ww+/mngYeThbc=
-google.golang.org/genproto v0.0.0-20220815135757-37a418bb8959/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220817144833-d7fd3f11b9b1/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220822174746-9e6da59bd2fc/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220829144015-23454907ede3/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220829175752-36a9c930ecbf/go.mod h1:dbqgFATTzChvnt+ujMdZwITVAJHFtfyN1qUhDqEiIlk=
-google.golang.org/genproto v0.0.0-20220913154956-18f8339a66a5/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220914142337-ca0e39ece12f/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220915135415-7fd63a7952de/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220916172020-2692e8806bfa/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220919141832-68c03719ef51/go.mod h1:0Nb8Qy+Sk5eDzHnzlStwW3itdNaWoZA5XeSG+R3JHSo=
-google.golang.org/genproto v0.0.0-20220920201722-2b89144ce006/go.mod h1:ht8XFiar2npT/g4vkk7O0WYS1sHOHbdujxbEp7CJWbw=
-google.golang.org/genproto v0.0.0-20220926165614-551eb538f295/go.mod h1:woMGP53BroOrRY3xTxlbr8Y3eB/nzAvvFM83q7kG2OI=
-google.golang.org/genproto v0.0.0-20220926220553-6981cbe3cfce/go.mod h1:woMGP53BroOrRY3xTxlbr8Y3eB/nzAvvFM83q7kG2OI=
-google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqwhZAwq4wsRUaVG555sVgsNmIjRtO7t/JH29U=
-google.golang.org/genproto v0.0.0-20221014173430-6e2ab493f96b/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
-google.golang.org/genproto v0.0.0-20221014213838-99cd37c6964a/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
-google.golang.org/genproto v0.0.0-20221024153911-1573dae28c9c/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s=
-google.golang.org/genproto v0.0.0-20221024183307-1bc688fe9f3e/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s=
-google.golang.org/genproto v0.0.0-20221027153422-115e99e71e1c/go.mod h1:CGI5F/G+E5bKwmfYo09AXuVN4dD894kIKUFmVbP2/Fo=
-google.golang.org/genproto v0.0.0-20221109142239-94d6d90a7d66/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221114212237-e4508ebdbee1/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221117204609-8f9c96812029/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221118155620-16455021b5e6/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221201164419-0e50fba7f41c/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221201204527-e3fa12d562f3/go.mod h1:rZS5c/ZVYMaOGBfO68GWtjOw/eLaZM1X6iVtgjZ+EWg=
-google.golang.org/genproto v0.0.0-20221202195650-67e5cbc046fd/go.mod h1:cTsE614GARnxrLsqKREzmNYJACSWWpAWdNMwnD7c2BE=
-google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230112194545-e10362b5ecf9/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230113154510-dbe35b8444a5/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230123190316-2c411cf9d197/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230124163310-31e0e69b6fc2/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230125152338-dcaf20b6aeaa/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230127162408-596548ed4efa/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230209215440-0dfe4f8abfcc/go.mod h1:RGgjbofJ8xD9Sq1VVhDM1Vok1vRONV+rg+CjzG4SZKM=
-google.golang.org/genproto v0.0.0-20230216225411-c8e22ba71e44/go.mod h1:8B0gmkoRebU8ukX6HP+4wrVQUY1+6PkQ44BSyIlflHA=
-google.golang.org/genproto v0.0.0-20230222225845-10f96fb3dbec/go.mod h1:3Dl5ZL0q0isWJt+FVcfpQyirqemEuLAK/iFvg1UP1Hw=
-google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4/go.mod h1:NWraEVixdDnqcqQ30jipen1STv2r/n24Wb7twVTGR4s=
-google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94 h1:YJjbgu+dkp5kUJLfpMyCLfBIWZb/FcJyuLeo1gVBOuo=
-google.golang.org/genproto v0.0.0-20260519071638-aa98bba5eb94/go.mod h1:RRHjglSYABVCWpQ7USCpdfhcd9t4PkajvVwyynZizTc=
-google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800 h1:admdQBe8jR3VWhBsUrAOaF2Qw6K/+p5pSm1GN8+6Fw4=
-google.golang.org/genproto/googleapis/api v0.0.0-20260706201446-f0a921348800/go.mod h1:FPk7EXUKMtImne7AmknoYjT4QXqKIzzRbeQIXzLk6fQ=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d h1:Jkpk39hlTZOIp3RbfvNX9R8Hv+Sw0X89nlU/xFOErsc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260715232425-e75dac1f907d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto v0.0.0-20260904194346-d0f1323225a4 h1:6QRNo34FxJcE1LG6XfnmaQ17m6w21oXaKlKoBaF+UqE=
+google.golang.org/genproto v0.0.0-20260904194346-d0f1323225a4/go.mod h1:eifJ91nefXnfP/bMkZsACVGm14ZtEL4eUXRLTryfbY4=
+google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4 h1:NCe/UiklGd/9xjT+ROBVhJ1kf6TRQaFedsR+z7u1gvo=
+google.golang.org/genproto/googleapis/api v0.0.0-20260904194346-d0f1323225a4/go.mod h1:fJ2lYaWjqNknJyQBOCd0fA3HnEElJqGplH71a2txi+g=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 h1:5t+ZydAFj5kGVLrgCvLmpmCf9ylGRd64hpEronfRaws=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
-google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
-google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
-google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
-google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.47.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.50.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.51.0/go.mod h1:wgNDFcnuBGmxLKI/qn4T+m5BtEBYXJPvibbUPsAIPww=
-google.golang.org/grpc v1.52.0/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5vorUY=
-google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
-google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
-google.golang.org/grpc v1.84.0-dev.0.20260723093437-b6eac429d7b6 h1:HfjjkdGIa8u9sP9EW5WCygy0kQDuTI/Tax4j//t24Fo=
-google.golang.org/grpc v1.84.0-dev.0.20260723093437-b6eac429d7b6/go.mod h1:ljCht0DrxQrXBDRTZp52Qxh3Ffk8CdYm2sj4O2QN2C0=
-google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
+google.golang.org/grpc v1.85.0-dev.0.20260915183914-4e49413dcab7 h1:5+EEM1fC0yjOZID0NUZVrE2+8M/+1TclNrSz/l1xMYs=
+google.golang.org/grpc v1.85.0-dev.0.20260915183914-4e49413dcab7/go.mod h1:Ovl0ECo4xx5r4kn/6d4BPSNB7OIFuu6EAjOzjtVAKaM=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
 google.golang.org/grpc/security/advancedtls v1.0.0 h1:/KQ7VP/1bs53/aopk9QhuPyFAp9Dm9Ejix3lzYkCrDA=
@@ -2853,23 +1661,20 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -2890,96 +1695,52 @@ gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.1.3/go.mod h1:NgwopIslSNH47DimFoV78dnkksY2EFtX0ajyb3K/las=
-lukechampine.com/uint128 v1.1.1/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
-lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
 modernc.org/b v1.0.0 h1:vpvqeyp17ddcQWF29Czawql4lDdABCDRbXRAS4+aF2o=
 modernc.org/b v1.0.0/go.mod h1:uZWcZfRj1BpYzfN9JTerzlNUnnPsV9O2ZA8JsRcubNg=
-modernc.org/cc/v3 v3.36.0/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/cc/v3 v3.36.2/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/cc/v3 v3.36.3/go.mod h1:NFUHyPn4ekoC/JHeZFfZurN6ixxawE1BnVonP/oahEI=
-modernc.org/cc/v4 v4.28.4 h1:Hd/4Es+MBj+/7hSdZaisNyu6bv3V0Dp2MdllyfqaH+c=
-modernc.org/cc/v4 v4.28.4/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v3 v3.0.0-20220428102840-41399a37e894/go.mod h1:eI31LL8EwEBKPpNpA4bU1/i+sKOwOrQy8D87zWUcRZc=
-modernc.org/ccgo/v3 v3.0.0-20220430103911-bc99d88307be/go.mod h1:bwdAnOoaIt8Ax9YdWGjxWsdkPcZyRPHqrOvJxaKAKGw=
-modernc.org/ccgo/v3 v3.16.4/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
-modernc.org/ccgo/v3 v3.16.6/go.mod h1:tGtX0gE9Jn7hdZFeU88slbTh1UtCYKusWOoCJuvkWsQ=
-modernc.org/ccgo/v3 v3.16.8/go.mod h1:zNjwkizS+fIFDrDjIAgBSCLkWbJuHF+ar3QRn+Z9aws=
-modernc.org/ccgo/v3 v3.16.9/go.mod h1:zNMzC9A9xeNUepy6KuZBbugn3c0Mc9TeiJO4lgvkJDo=
-modernc.org/ccgo/v4 v4.34.4 h1:OVnSOWQjVKOYkFxoHYB+qQmSHK5gqMqARM+K9DpR/Ws=
-modernc.org/ccgo/v4 v4.34.4/go.mod h1:qdKqE8FNIYyysougB1RX9MxCzp5oJOcQXSobANJ4TuE=
-modernc.org/ccorpus v1.11.6/go.mod h1:2gEUTrWqdpH2pXsmTM1ZkjeSrUWDpjMu2T6m29L/ErQ=
+modernc.org/cc/v4 v4.29.7 h1:q+NXGJ0bK3b4TXFYQQVr9pYETGnmwFWkrUzJnMya/Tg=
+modernc.org/cc/v4 v4.29.7/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.36.1 h1:ZNIUZAryN0UgnJwtyxrdEzcFc3yD4Cu4AzjfPXsLsIE=
+modernc.org/ccgo/v4 v4.36.1/go.mod h1:rrtGc2QkS239nYb/mQNuBMyjq3/y3ZXWbBjPoV3wqzA=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
-modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.5 h1:21ldfPfRYE31Tb7B3mwAK8gy1AxP4+dKjrOQPfqakoc=
+modernc.org/gc/v3 v3.1.5/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
-modernc.org/libc v0.0.0-20220428101251-2d5f3daf273b/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.16.0/go.mod h1:N4LD6DBE9cf+Dzf9buBlzVJndKr/iJHG97vGLHYnb5A=
-modernc.org/libc v1.16.1/go.mod h1:JjJE0eu4yeK7tab2n4S1w8tlWd9MxXLRzheaRnAKymU=
-modernc.org/libc v1.16.17/go.mod h1:hYIV5VZczAmGZAnG15Vdngn5HSF5cSkbvfz2B7GRuVU=
-modernc.org/libc v1.16.19/go.mod h1:p7Mg4+koNjc8jkqwcoFBJx7tXkpj00G77X7A72jXPXA=
-modernc.org/libc v1.17.0/go.mod h1:XsgLldpP4aWlPlsjqKRdHPqCxCjISdHfM/yeWC5GyW0=
-modernc.org/libc v1.17.1/go.mod h1:FZ23b+8LjxZs7XtFMbSzL/EhPxNbfZbErxEHc7cbD9s=
-modernc.org/libc v1.73.4 h1:+ra4Ui8ngyt8HDcO1FTDPWlkAh6yOdaO2yAoh8MddQA=
-modernc.org/libc v1.73.4/go.mod h1:DXZ3eO8qMCNn2SnmTNCiC71nJ9Rcq3PsnpU6Vc4rWK8=
+modernc.org/libc v1.77.1 h1:Ct8j47QtiZ1Enj2DtFXQtUqrPCAjdCmPjtCuvrYQ0Hs=
+modernc.org/libc v1.77.1/go.mod h1:87/pZ4L6nD1zqW4nItuS12YO7hN1igAah34xjnQo/W0=
 modernc.org/mathutil v1.1.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/mathutil v1.4.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
-modernc.org/mathutil v1.5.0/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
-modernc.org/memory v1.1.1/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
-modernc.org/memory v1.2.0/go.mod h1:/0wo5ibyrQiaoUoH7f9D8dnglAmILJ5/cxZlRECf+Nw=
-modernc.org/memory v1.2.1/go.mod h1:PkUhL0Mugw21sHPeskwZW4D6VscE/GQJOnIpCnW6pSU=
-modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
-modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
-modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
-modernc.org/opt v0.1.3/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
+modernc.org/memory v1.12.1 h1:nFMiWrpStgZczNl6XI9GnIk/rWhYIyHGUaR04pGbp9g=
+modernc.org/memory v1.12.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
 modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.18.1/go.mod h1:6ho+Gow7oX5V+OiOQ6Tr4xeqbx13UZ6t+Fw9IRUG4d4=
-modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
-modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
+modernc.org/sqlite v1.60.1 h1:/blz53O951KWFOso4QQvEs/Fq6cDBKLtMVrYNSeJVKw=
+modernc.org/sqlite v1.60.1/go.mod h1:1dIoEagfDE72QytD5scH1lxARtaUgKgHC/NuApA27r0=
 modernc.org/strutil v1.1.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
-modernc.org/strutil v1.1.1/go.mod h1:DE+MQQ/hjKBZS2zNInV5hhcipt5rLPWkmpbGeW5mmdw=
-modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
-modernc.org/tcl v1.13.1/go.mod h1:XOLfOwzhkljL4itZkK6T72ckMgvj0BDsnKNdZVUOecw=
-modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
-modernc.org/z v1.5.1/go.mod h1:eWFB510QWW5Th9YGZT81s+LwvaAs3Q2yr4sP0rmLkv8=
 moul.io/http2curl/v2 v2.3.0 h1:9r3JfDzWPcbIklMOs2TnIFzDYvfAZvjeavG6EzP7jYs=
 moul.io/http2curl/v2 v2.3.0/go.mod h1:RW4hyBjTWSYDOxapodpNEtX0g5Eb16sxklBqmd2RHcE=
 pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
 pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
 sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
diff --git a/install.sh b/install.sh
index f9a406dceb..8bede247af 100755
--- a/install.sh
+++ b/install.sh
@@ -9,7 +9,7 @@
 #   curl -fsSL ... | bash -s -- --version 4.34 --dir /usr/local/bin
 #
 # Options:
-#   --component COMP   Which binary to install: weed, volume-rust, all (default: weed)
+#   --component COMP   Which binary to install: weed, volume-rust, worker-rust, all (default: weed)
 #   --version VER      Release version tag (default: latest)
 #   --large-disk       Use large disk variant (5-byte offset, 8TB max volume)
 #   --dir DIR          Installation directory (default: /usr/local/bin)
@@ -22,6 +22,7 @@ COMPONENT="weed"
 VERSION=""
 LARGE_DISK=false
 INSTALL_DIR="/usr/local/bin"
+WORKER_INSTALLED=false
 
 # Colors (if terminal supports them)
 if [ -t 1 ]; then
@@ -128,6 +129,33 @@ rust_asset_name() {
     fi
 }
 
+# Does a release carry this asset? Answers 0 for yes and 1 for a 404, and stops
+# the installer on anything else: a rate limit or a network blip must not read
+# as "this release predates the binary" and quietly skip it.
+asset_exists() {
+    local url="$1" code=""
+    if command -v curl &>/dev/null; then
+        code="$(curl -sL -o /dev/null -I -w '%{http_code}' "$url" || true)"
+    elif command -v wget &>/dev/null; then
+        # --spider's exit status folds 404 in with every other server error, so
+        # read the status line itself; -S prints one per redirect hop.
+        code="$(wget -S --spider -q -O /dev/null "$url" 2>&1 | awk '/^ *HTTP\// {c=$2} END {print c}')"
+    fi
+
+    case "$code" in
+        200) return 0 ;;
+        404) return 1 ;;
+        *)   error "Could not check ${url} (HTTP ${code:-none}). Retry, or install components one at a time." ;;
+    esac
+}
+
+# Build Rust maintenance worker asset name. No large-disk variant: the worker
+# maintains tables through the namespace and never opens a volume file.
+worker_asset_name() {
+    local os="$1" arch="$2"
+    echo "weed-worker_${os}_${arch}.tar.gz"
+}
+
 # Install a single component
 install_component() {
     local component="$1" os="$2" arch="$3"
@@ -204,10 +232,48 @@ install_component() {
             ok "Installed weed-volume to ${INSTALL_DIR}/${dest_name}"
             ;;
 
+        worker-rust)
+            # Published for linux only: the worker runs beside the cluster it
+            # maintains, and its dependency tree makes every extra target an
+            # expensive build.
+            case "$os" in
+                linux) ;;
+                *) error "Rust maintenance worker is not available for ${os}. Supported: linux" ;;
+            esac
+            case "$arch" in
+                amd64|arm64) ;;
+                *) error "Rust maintenance worker is not available for ${arch}. Supported: amd64, arm64" ;;
+            esac
+
+            asset_name="$(worker_asset_name "$os" "$arch")"
+            download_url="https://github.com/${REPO}/releases/download/${VERSION}/${asset_name}"
+            download "$download_url" "${tmpdir}/${asset_name}"
+
+            info "Extracting ${asset_name}..."
+            tar xzf "${tmpdir}/${asset_name}" -C "$tmpdir"
+
+            local worker_bin
+            worker_bin="$(find "$tmpdir" -name 'weed-worker' -type f | head -1)"
+            if [ -z "$worker_bin" ]; then
+                error "Could not find weed-worker binary in archive"
+            fi
+
+            chmod +x "$worker_bin"
+            install_binary "$worker_bin" "weed-worker"
+            WORKER_INSTALLED=true
+            ok "Installed weed-worker to ${INSTALL_DIR}/weed-worker"
+            ;;
+
         *)
-            error "Unknown component: ${component}. Use: weed, volume-rust, all"
+            error "Unknown component: ${component}. Use: weed, volume-rust, worker-rust, all"
             ;;
     esac
+
+    # The trap is per-process, so a later component's would replace this one and
+    # leave the earlier extraction behind. Clean up here and hand the trap back;
+    # the error paths above exit, which still fires it.
+    rm -rf "$tmpdir"
+    trap - EXIT
 }
 
 # Copy binary to install dir, using sudo if needed
@@ -251,6 +317,16 @@ main() {
         all)
             install_component "weed" "$os" "$arch"
             install_component "volume-rust" "$os" "$arch"
+            # The worker is published for linux amd64/arm64 only, and only by
+            # releases new enough to carry it; skip either case rather than fail
+            # an install that has already put two binaries in place.
+            if [ "$os" != "linux" ] || { [ "$arch" != "amd64" ] && [ "$arch" != "arm64" ]; }; then
+                warn "Skipping the Rust maintenance worker: no build for ${os}/${arch}"
+            elif ! asset_exists "https://github.com/${REPO}/releases/download/${VERSION}/$(worker_asset_name "$os" "$arch")"; then
+                warn "Skipping the Rust maintenance worker: ${VERSION} does not carry one"
+            else
+                install_component "worker-rust" "$os" "$arch"
+            fi
             ;;
         *)
             install_component "$COMPONENT" "$os" "$arch"
@@ -265,11 +341,17 @@ main() {
     if [ "$COMPONENT" = "volume-rust" ] || [ "$COMPONENT" = "all" ]; then
         info "  weed-volume:  ${INSTALL_DIR}/weed-volume"
     fi
+    if [ "$WORKER_INSTALLED" = true ]; then
+        info "  weed-worker:     ${INSTALL_DIR}/weed-worker"
+    fi
     echo ""
     info "Quick start:"
     info "  weed master                          # Start master server"
     info "  weed volume -mserver=localhost:9333   # Start Go volume server"
     info "  weed-volume -mserver localhost:9333 # Start Rust volume server"
+    if [ "$WORKER_INSTALLED" = true ]; then
+        info "  weed-worker --admin localhost:12535  # Start the Rust maintenance worker"
+    fi
 }
 
 main
diff --git a/k8s/charts/seaweedfs/Chart.yaml b/k8s/charts/seaweedfs/Chart.yaml
index 3d95e0c34e..247b5bd06c 100644
--- a/k8s/charts/seaweedfs/Chart.yaml
+++ b/k8s/charts/seaweedfs/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 description: SeaweedFS
 name: seaweedfs
-appVersion: "4.41"
+appVersion: "4.49"
 # Dev note: Trigger a helm chart release by `git tag -a helm-<version>`
-version: 4.41.0
+version: 4.49.0
diff --git a/k8s/charts/seaweedfs/README.md b/k8s/charts/seaweedfs/README.md
index 7edde6754a..d6a23cb431 100644
--- a/k8s/charts/seaweedfs/README.md
+++ b/k8s/charts/seaweedfs/README.md
@@ -22,11 +22,24 @@ helm install --values=values.yaml seaweedfs seaweedfs/seaweedfs
 ## Info:
 * master/filer/volume are stateful sets with anti-affinity on the hostname,
 so your deployment will be spread/HA.
-* chart is using memsql(mysql) as the filer backend to enable HA (multiple filer instances) and backup/HA memsql can provide.
-* mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV.
+* leveldb2 is the default filer backend; a mysql-compatible database (memsql, ...) enables HA (multiple filer instances) and the backup/HA it can provide.
+* with `filer.extraEnvironmentVars.WEED_MYSQL_ENABLED` set to `"true"`, mysql user/password are created in a k8s secret (default: `<release>-seaweedfs-db-secret`) and injected to the filer with ENV. On any other store neither the secret nor the `WEED_MYSQL_*` env, plain or secret-backed, is rendered.
 * cert config exists and can be enabled, but not been tested, requires cert-manager to be installed.
 
 ## Prerequisites
+
+The chart's templates render with Helm 3.16.3 and newer versions tested in CI.
+Earlier Helm versions are not covered by this chart's compatibility checks.
+When JWT signing is enabled, a live upgrade reuses keys from the existing
+security ConfigMap (including the legacy ConfigMap name); a key absent from
+that ConfigMap is generated. Plain `helm template` does not read cluster state;
+use an install and upgrade against a cluster to check key persistence.
+
+The key reader supports single-line quoted TOML strings in JWT sections,
+including indented assignments, quoted key names, and bare or simply quoted
+section-name segments. An unsupported value or quoted header fails the upgrade
+rather than silently rotating a key.
+
 ### Database
 
 leveldb is the default database, this supports multiple filer replicas that will [sync automatically](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication), with some [limitations](https://github.com/seaweedfs/seaweedfs/wiki/Filer-Store-Replication#limitation).
@@ -286,9 +299,35 @@ metadata:
     app.kubernetes.io/component: s3
 stringData:
   # this key must be an inline json config file
-  seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"snu8yoP6QAlY0ne4","secretKey":"PNzBcmeLNEdR0oviwm04NQAicOrDH1Km"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"SCigFee6c5lbi04A","secretKey":"kgFhbT38R8WUYVtiFQ1OiSVOrYr3NKku"}],"actions":["Read"]}]}'
+  seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"snu8yoP6QAlY0ne4","secretKey":"PNzBcmeLNEdR0oviwm04NQAicOrDH1Km"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"SCigFee6c5lbi04A","secretKey":"kgFhbT38R8WUYVtiFQ1OiSVOrYr3NKku"}],"actions":["Read","List"]}]}'
 ```
 
+#### Source S3 credentials from an existing Secret
+
+To keep the keys out of `values.yaml` while still letting the chart generate the
+identities file, point an identity at an existing Secret:
+
+```yaml
+s3:
+  enabled: true
+  enableAuth: true
+  credentials:
+    admin:
+      existingSecret: minio-root
+      accessKeyKey: root-user
+      secretKeyKey: root-password
+```
+
+`accessKeyKey` and `secretKeyKey` default to the chart's own key names
+(`admin_access_key_id`, `admin_secret_access_key`, and the `read_` pair). The
+generated `seaweedfs_s3_config` references the keys as `${SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID}`
+and the gateway resolves them from the environment, which the chart wires up
+from the Secret. Nothing is read from the cluster at render time, so
+`helm template`, `--dry-run` and an Argo CD diff all render what an install
+applies. Rotating a key in the Secret takes effect on the next pod restart, as
+with any other environment variable. The COSI driver parses the config itself
+and does not resolve these references.
+
 ## Admin Component
 
 The admin component provides a modern web-based administration interface for managing SeaweedFS clusters. It includes:
@@ -306,8 +345,9 @@ To enable the admin interface, add the following to your values.yaml:
 ```yaml
 admin:
   enabled: true
-  port: 23646
-  grpcPort: 33646  # For worker connections
+  port: 12535
+  grpcPort: 22535  # For worker connections
+  legacyPort: 23646  # Compat: also serve http + gRPC (+10000) for pre-12535 clients
   secret:
     adminUser: "admin"
     adminPassword: "your-secure-password"  # Leave empty to disable auth
@@ -325,7 +365,9 @@ admin:
     className: "nginx"
 ```
 
-The admin interface will be available at `http://<admin-service>:23646` (or via ingress). Workers connect to the admin server via gRPC on port `33646`.
+The admin interface will be available at `http://<admin-service>:12535` (or via ingress). Workers connect to the admin server via gRPC on port `22535`.
+
+For backward compatibility with older clients and workers, admin also serves the previous default ports: HTTP on `23646` and gRPC on `33646` (legacyPort + 10000). The Service and NetworkPolicy expose both. Set `admin.legacyPort: 0` to disable.
 
 ### Admin Authentication
 
@@ -337,6 +379,30 @@ If `adminPassword` is empty or not set, the admin interface runs without authent
 
 As an alternative, a kubernetes Secret can be used (`admin.secret.existingSecret`).
 
+### Admin listen address
+
+Since SeaweedFS 4.46, `weed admin` defaults to listening on loopback (`127.0.0.1`).
+The chart's httpGet readiness/liveness probes dial the pod IP, so the admin
+server must bind a non-loopback address for the probes to succeed. The chart
+therefore passes `-ip={{ .Values.admin.ip }}`, defaulting `admin.ip` to `0.0.0.0`
+(the pre-4.46 behaviour of listening on all interfaces).
+
+Binding a non-loopback address requires authentication: `weed admin` refuses to
+start on a non-loopback address without `-adminPassword`, so the chart fails at
+render time if `admin.ip` is non-loopback and authentication is not configured via
+`admin.secret.adminPassword`, `admin.secret.existingSecret`, or
+`WEED_ADMIN_PASSWORD` supplied through `admin.extraEnvironmentVars` /
+`admin.secretExtraEnvironmentVars`. Setting `admin.allowInsecureBind` renders
+`-allowInsecureBind` and bypasses this guard; it leaves the admin API
+unauthenticated on the network, so use it only when access is otherwise
+restricted (e.g. network policies). The whole `127.0.0.0/8` range and `::1` are
+treated as loopback (matching `weed admin`); `localhost` is treated as
+non-loopback. Set `admin.ip` to a loopback address only if you also replace the
+httpGet probes (e.g. with an `exec` probe that checks `127.0.0.1`).
+
+The `-ip` flag requires SeaweedFS 4.46 or newer; pinning `admin.imageOverride`
+to an older image is not supported with this chart version.
+
 ### Admin Data Persistence
 
 The admin component can store configuration and maintenance data. You can configure storage in several ways:
@@ -373,7 +439,7 @@ worker:
   # Auto-discovery only works if the admin is in the same namespace and same Helm release.
   # For cross-namespace or separate release scenarios, explicitly set this value.
   # Example: If main SeaweedFS is deployed in "production" namespace:
-  #   adminServer: "seaweedfs-admin.production.svc:33646"
+  #   adminServer: "seaweedfs-admin.production.svc:22535"
   adminServer: ""
   
   # Workers need storage for task execution
@@ -439,8 +505,8 @@ worker:
   # REQUIRED: Point to the admin service of your main SeaweedFS release
   # Replace <namespace> with the namespace where your main seaweedfs is deployed
   # Example: If deploying in namespace "production":
-  #   adminServer: "seaweedfs-admin.production.svc:33646"
-  adminServer: "seaweedfs-admin.<namespace>.svc:33646"
+  #   adminServer: "seaweedfs-admin.production.svc:22535"
+  adminServer: "seaweedfs-admin.<namespace>.svc:22535"
 ```
 
 **values-worker-balance.yaml** (for balance operations):
@@ -465,8 +531,8 @@ worker:
   # REQUIRED: Point to the admin service of your main SeaweedFS release
   # Replace <namespace> with the namespace where your main seaweedfs is deployed
   # Example: If deploying in namespace "production":
-  #   adminServer: "seaweedfs-admin.production.svc:33646"
-  adminServer: "seaweedfs-admin.<namespace>.svc:33646"
+  #   adminServer: "seaweedfs-admin.production.svc:22535"
+  adminServer: "seaweedfs-admin.<namespace>.svc:22535"
 ```
 
 Deploy the specialized workers as separate releases:
@@ -479,6 +545,26 @@ helm install seaweedfs-worker-vacuum seaweedfs/seaweedfs -f values-worker-vacuum
 helm install seaweedfs-worker-balance seaweedfs/seaweedfs -f values-worker-balance.yaml
 ```
 
+## Gateway API
+
+Every component with an `ingress` block (master, volume, filer, s3 and admin) can also be exposed through a [Gateway API](https://gateway-api.sigs.k8s.io/) `HTTPRoute`, for clusters that route through a Gateway instead of an Ingress controller. `<component>.httpRoute` sits next to `<component>.ingress` and is disabled by default. The chart does not create the Gateway, so point `parentRefs` at one that already exists, and the `gateway.networking.k8s.io/v1` CRDs must be installed.
+
+```yaml
+s3:
+  httpRoute:
+    enabled: true
+    parentRefs:
+      - group: gateway.networking.k8s.io
+        kind: Gateway
+        name: my-gateway
+        namespace: gateway-system
+        sectionName: https
+    hostnames:
+      - s3.example.com
+```
+
+With `rules` left empty the route sends all traffic to the component's own Service and port. A rule may set `matches`, `filters`, `timeouts` and `backendRefs`, and a rule without `backendRefs` still routes to that Service. In all-in-one mode the master, volume, filer and s3 routes target the all-in-one Service. When S3 runs only on the filer (`filer.s3.enabled` without `s3.enabled`), the s3 route uses `filer.s3.port`.
+
 ## Network Policies
 
 In a namespace with a default-deny policy the install hangs: the components cannot resolve each other, and the post-install bucket hook waits on the master and filer until it gives up. `networkPolicy.enabled` renders one `NetworkPolicy` per component, selecting its pods by the standard `app.kubernetes.io/{name,instance,component}` labels and admitting traffic from the other pods of the release on the ports that component listens on.
@@ -520,6 +606,23 @@ Two things worth knowing before you turn this on:
 
 The DNS selectors default to CoreDNS as kubeadm, kind and the managed offerings from AWS, Google and Azure install it. On OpenShift, override `egress.dnsNamespaceSelector` and `egress.dnsPodSelector` to match `openshift-dns`; see the comment in `values.yaml`.
 
+## Pod and container security contexts
+
+Pod and container security contexts are configurable independently for every built-in workload and remain empty by default for backwards compatibility. The examples in `values.yaml` show how to enable a `RuntimeDefault` seccomp profile, disable privilege escalation and privileged mode, drop all Linux capabilities, and use a read-only root filesystem.
+
+SeaweedFS uses `/tmp` for Unix sockets, temporary uploads, worker task files, and other runtime data. When `readOnlyRootFilesystem` is enabled for a built-in component, the chart mounts a writable `emptyDir` at `/tmp` for its chart-managed containers. Its optional size limit can be configured globally:
+
+```yaml
+global:
+  seaweedfs:
+    tmpDir:
+      sizeLimit: 1Gi
+```
+
+The chart does not enable `runAsNonRoot` by default because its default `hostPath` storage may be owned by root. To enforce the Kubernetes `restricted` Pod Security Standard, use storage that is writable by a non-root user and configure `runAsNonRoot` or use the OpenShift overrides below.
+
+Security contexts configured for a component also apply to the chart-managed helper containers for that component. User-provided init containers and sidecars must define their own container security context and writable mounts.
+
 ## OpenShift Support
 
 SeaweedFS can be deployed on OpenShift or any cluster enforcing the Kubernetes "restricted" Pod Security Standard. By default, OpenShift blocks containers that run as root or use `hostPath` volumes.
@@ -528,6 +631,7 @@ To deploy on OpenShift, use the provided `openshift-values.yaml` which overrides
 1. Use `PersistentVolumeClaims` instead of `hostPath`.
 2. Enable `runAsNonRoot` and omit hardcoded UIDs to allow OpenShift to assign valid UIDs automatically.
 3. Apply appropriate `seccompProfile` and drop capabilities.
+4. Use a read-only root filesystem with writable temporary storage at `/tmp`.
 
 Usage:
 ```bash
diff --git a/k8s/charts/seaweedfs/ci/admin-values.yaml b/k8s/charts/seaweedfs/ci/admin-values.yaml
new file mode 100644
index 0000000000..021d5302cf
--- /dev/null
+++ b/k8s/charts/seaweedfs/ci/admin-values.yaml
@@ -0,0 +1,7 @@
+# Admin install: exercises the admin StatefulSet, which passes -ip (default
+# 0.0.0.0) and therefore requires authentication to bind a non-loopback address.
+admin:
+  enabled: true
+  secret:
+    adminUser: "admin"
+    adminPassword: "ci-admin-password"
diff --git a/k8s/charts/seaweedfs/openshift-values.yaml b/k8s/charts/seaweedfs/openshift-values.yaml
index 3846f72979..e844e7833e 100644
--- a/k8s/charts/seaweedfs/openshift-values.yaml
+++ b/k8s/charts/seaweedfs/openshift-values.yaml
@@ -15,6 +15,7 @@
 #      automatically assign a valid UID from the namespace's allocated range.
 #   3. Dropping all Linux capabilities and setting allowPrivilegeEscalation: false
 #   4. Enabling RuntimeDefault seccompProfile
+#   5. Using a read-only root filesystem with writable temporary storage
 #
 # Usage:
 #   helm install seaweedfs seaweedfs/seaweedfs \
@@ -49,6 +50,7 @@ master:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
@@ -76,6 +78,7 @@ volume:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
@@ -101,6 +104,7 @@ filer:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
@@ -125,6 +129,7 @@ s3:
   containerSecurityContext:
     enabled: true
     allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
     capabilities:
       drop: ["ALL"]
     runAsNonRoot: true
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml b/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
new file mode 100644
index 0000000000..e54ea78027
--- /dev/null
+++ b/k8s/charts/seaweedfs/templates/admin/admin-httproute.yaml
@@ -0,0 +1,55 @@
+{{- if and .Values.admin.enabled .Values.admin.httpRoute.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "seaweedfs.componentName" (list . "admin") }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.admin.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: admin
+    {{- with .Values.admin.httpRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- with .Values.admin.httpRoute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.admin.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.admin.httpRoute.rules | default (list dict) }}
+    - backendRefs:
+        {{- with .backendRefs }}
+        {{- toYaml . | nindent 8 }}
+        {{- else }}
+        - group: ""
+          kind: Service
+          name: {{ include "seaweedfs.componentName" (list $ "admin") }}
+          namespace: {{ $.Release.Namespace }}
+          port: {{ $.Values.admin.port }}
+          weight: 1
+        {{- end }}
+      {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .filters }}
+      filters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .timeouts }}
+      timeouts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml b/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
index d5106d1635..1d9bd8b71d 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-ingress.yaml
@@ -23,6 +23,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: admin
+    {{- with .Values.admin.ingress.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.admin.ingress.className }}
   ingressClassName: {{ .Values.admin.ingress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-service.yaml b/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
index 8b7567a2c9..c10960f683 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-service.yaml
@@ -21,6 +21,7 @@ spec:
   {{- $nodePorts = .Values.admin.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
+  {{- include "seaweedfs.service.loadBalancerFields" .Values.admin.service }}
   ports:
   - name: "http"
     port: {{ .Values.admin.port }}
@@ -36,6 +37,16 @@ spec:
     nodePort: {{ $nodePorts.grpc }}
     {{- end }}
     protocol: TCP
+  {{- if gt (int .Values.admin.legacyPort) 0 }}
+  - name: "legacy-http"
+    port: {{ .Values.admin.legacyPort }}
+    targetPort: {{ .Values.admin.legacyPort }}
+    protocol: TCP
+  - name: "legacy-grpc"
+    port: {{ add (int .Values.admin.legacyPort) 10000 }}
+    targetPort: {{ add (int .Values.admin.legacyPort) 10000 }}
+    protocol: TCP
+  {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
diff --git a/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml b/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
index d1c0dc73a1..35d2d4be2c 100644
--- a/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/admin/admin-statefulset.yaml
@@ -6,6 +6,11 @@
 {{- if and (not .Values.admin.masters) (not .Values.global.seaweedfs.masterServer) (not .Values.master.enabled) }}
 {{- fail "admin.masters or global.seaweedfs.masterServer must be set if master.enabled is false" -}}
 {{- end }}
+{{- $adminAuthEnabled := include "seaweedfs.admin.authEnabled" . }}
+{{- $adminIp := .Values.admin.ip | default "0.0.0.0" }}
+{{- if and (not (include "seaweedfs.admin.isLoopbackIp" $adminIp)) (ne $adminAuthEnabled "true") }}
+{{- fail (printf "admin.ip is set to %q (non-loopback) but admin authentication is not configured. Since `weed admin` 4.46 refuses to bind a non-loopback address without authentication, the admin container would exit on startup. Set admin.secret.adminPassword or admin.secret.existingSecret, or supply WEED_ADMIN_PASSWORD via admin.extraEnvironmentVars / admin.secretExtraEnvironmentVars, or set admin.ip to a loopback address such as 127.0.0.1 (note: a loopback bind makes the chart's httpGet readiness/liveness probes fail), or set admin.allowInsecureBind to true to opt out via -allowInsecureBind (INSECURE: exposes the admin API unauthenticated on the network)." $adminIp) -}}
+{{- end }}
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -69,6 +74,9 @@ spec:
       {{- if .Values.admin.priorityClassName }}
       priorityClassName: {{ .Values.admin.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.admin.schedulerName }}
+      schedulerName: {{ .Values.admin.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
       {{- if .Values.admin.serviceAccountName }}
       serviceAccountName: {{ .Values.admin.serviceAccountName | quote }}
@@ -159,27 +167,35 @@ spec:
               -v={{ .Values.global.seaweedfs.loggingLevel }} \
               {{- end }}
               admin \
+              -ip={{ .Values.admin.ip | default "0.0.0.0" }} \
               -port={{ .Values.admin.port }} \
               -port.grpc={{ .Values.admin.grpcPort }} \
+              {{- if ne (int .Values.admin.legacyPort) 23646 }}
+              -port.legacy={{ .Values.admin.legacyPort }} \
+              {{- end }}
               {{- if or (eq .Values.admin.data.type "hostPath") (eq .Values.admin.data.type "persistentVolumeClaim") (eq .Values.admin.data.type "emptyDir") (eq .Values.admin.data.type "existingClaim") }}
               -dataDir=/data \
               {{- else if .Values.admin.dataDir }}
               -dataDir={{ .Values.admin.dataDir }} \
               {{- end }}
               {{- if .Values.admin.masters }}
-              -masters={{ .Values.admin.masters }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
+              -masters={{ .Values.admin.masters }} \
               {{- else if .Values.global.seaweedfs.masterServer }}
-              -masters={{ .Values.global.seaweedfs.masterServer }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
+              -masters={{ .Values.global.seaweedfs.masterServer }} \
               {{- else }}
-              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }}{{- if or $urlPrefix .Values.admin.extraArgs }} \{{ end }}
+              -masters={{ range $index := until (.Values.master.replicas | int) }}${SEAWEEDFS_FULLNAME}-master-{{ $index }}.${SEAWEEDFS_FULLNAME}-master.{{ $.Release.Namespace }}:{{ $.Values.master.port }}{{ if lt $index (sub ($.Values.master.replicas | int) 1) }},{{ end }}{{ end }} \
               {{- end }}
               {{- if $urlPrefix }}
-              -urlPrefix={{ $urlPrefix }}{{- if .Values.admin.extraArgs }} \{{ end }}
+              -urlPrefix={{ $urlPrefix }} \
+              {{- end }}
+              {{- if .Values.admin.allowInsecureBind }}
+              -allowInsecureBind \
               {{- end }}
               {{- range $index, $arg := .Values.admin.extraArgs }}
               {{ $arg }}{{- if lt $index (sub (len $.Values.admin.extraArgs) 1) }} \{{ end }}
               {{- end }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.admin.containerSecurityContext (tpl (.Values.admin.extraVolumeMounts | default "") .) (tpl (.Values.admin.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.admin.data.type "hostPath") (eq .Values.admin.data.type "persistentVolumeClaim") (eq .Values.admin.data.type "emptyDir") (eq .Values.admin.data.type "existingClaim") }}
             - name: admin-data
               mountPath: /data
@@ -220,6 +236,12 @@ spec:
               name: http
             - containerPort: {{ .Values.admin.grpcPort }}
               name: grpc
+            {{- if gt (int .Values.admin.legacyPort) 0 }}
+            - containerPort: {{ .Values.admin.legacyPort }}
+              name: legacy-http
+            - containerPort: {{ add (int .Values.admin.legacyPort) 10000 }}
+              name: legacy-grpc
+            {{- end }}
           {{- if .Values.admin.readinessProbe.enabled }}
           readinessProbe:
             httpGet:
@@ -255,6 +277,7 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.admin.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.admin.containerSecurityContext (tpl (.Values.admin.extraVolumeMounts | default "") .) (tpl (.Values.admin.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if eq .Values.admin.data.type "hostPath" }}
         - name: admin-data
           hostPath:
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
index 07ffc85ec4..37ef19c896 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-deployment.yaml
@@ -37,13 +37,17 @@ spec:
         {{- with .Values.allInOne.podLabels }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
+      {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.allInOne.podAnnotations | default dict) }}
+      {{- $existingS3ConfigSecret := or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret }}
+      {{- if $existingS3ConfigSecret }}
+      {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace $existingS3ConfigSecret) | default dict }}
+      {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
+      {{- else }}
+      {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
+      {{- end }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
       annotations:
-        {{- with .Values.podAnnotations }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
-        {{- with .Values.allInOne.podAnnotations }}
-        {{- toYaml . | nindent 8 }}
-        {{- end }}
+        {{- toYaml $podAnnotations | nindent 8 }}
     spec:
       restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.allInOne.restartPolicy }}
       {{- if .Values.allInOne.affinity }}
@@ -64,6 +68,9 @@ spec:
       {{- if .Values.allInOne.priorityClassName }}
       priorityClassName: {{ .Values.allInOne.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.allInOne.schedulerName }}
+      schedulerName: {{ .Values.allInOne.schedulerName | quote }}
+      {{- end }}
       {{- if .Values.allInOne.serviceAccountName }}
       serviceAccountName: {{ .Values.allInOne.serviceAccountName | quote }}
       {{- end }}
@@ -81,6 +88,9 @@ spec:
           imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
           env:
             {{- include "seaweedfs.licenseEnv" . | nindent 12 }}
+            {{- if and .Values.allInOne.s3.enabled (or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth) }}
+            {{- include "seaweedfs.s3.credentialEnv" . | nindent 12 }}
+            {{- end }}
             {{- /* Determine default cluster alias and the corresponding env var keys to avoid conflicts */}}
             {{- $mergedExtraEnvironmentVars := dict }}
             {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.allInOne "target" $mergedExtraEnvironmentVars) }}
@@ -296,6 +306,7 @@ spec:
               {{- end }}
 
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.allInOne.containerSecurityContext (tpl (.Values.allInOne.extraVolumeMounts | default "") .) (tpl (.Values.allInOne.extraVolumes | default "") .)) | nindent 12 }}
             - name: data
               mountPath: /data
             {{- if and .Values.allInOne.s3.enabled (or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth) }}
@@ -423,6 +434,7 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.allInOne.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.allInOne.containerSecurityContext (tpl (.Values.allInOne.extraVolumeMounts | default "") .) (tpl (.Values.allInOne.extraVolumes | default "") .) false) | nindent 8 }}
         {{- include "seaweedfs.licenseVolume" . | nindent 8 }}
         - name: data
           {{- if eq .Values.allInOne.data.type "hostPath" }}
diff --git a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
index 467c6fe1a9..5201f607be 100644
--- a/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
+++ b/k8s/charts/seaweedfs/templates/all-in-one/all-in-one-service.yml
@@ -21,6 +21,7 @@ spec:
   {{- $nodePorts = .Values.allInOne.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
+  {{- include "seaweedfs.service.loadBalancerFields" .Values.allInOne.service }}
   internalTrafficPolicy: {{ .Values.allInOne.service.internalTrafficPolicy | default "Cluster" }}
   {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) .Values.allInOne.s3.trafficDistribution }}
   trafficDistribution: {{ include "seaweedfs.trafficDistribution" (dict "value" .Values.allInOne.s3.trafficDistribution "Capabilities" .Capabilities) }}
diff --git a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
index defe448e6e..196ce192ee 100644
--- a/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
+++ b/k8s/charts/seaweedfs/templates/cert/admin-cert.yaml
@@ -25,6 +25,10 @@ spec:
     organizations:
     - "SeaweedFS CA"
   dnsNames:
+    - '{{ include "seaweedfs.fullname" . }}-admin'
+    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
+    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
+    - '{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc.cluster.local'
     - '*.{{ include "seaweedfs.fullname" . }}-admin'
     - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}'
     - '*.{{ include "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}.svc'
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
index b5c1035757..bf4127992f 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
@@ -28,6 +28,13 @@ rules:
     - "update"
     - "create"
     - "delete"
+- apiGroups: ["objectstorage.k8s.io"]
+  resources:
+    - "bucketclasses"
+  verbs:
+    - "get"
+    - "list"
+    - "watch"
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs:
@@ -61,7 +68,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
   - kind: ServiceAccount
-    name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
+    name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
index aefc9d369f..a3cb650cef 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
@@ -57,8 +57,11 @@ spec:
       {{- if .Values.cosi.priorityClassName }}
       priorityClassName: {{ .Values.cosi.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.cosi.schedulerName }}
+      schedulerName: {{ .Values.cosi.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
-      serviceAccountName: {{ include "seaweedfs.componentName" (list . "objectstorage-provisioner") }}
+      serviceAccountName: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
       {{- if .Values.cosi.initContainers }}
       initContainers:
         {{ tpl .Values.cosi.initContainers . | nindent 8 | trim }}
@@ -110,6 +113,7 @@ spec:
             {{- end -}}
             {{- end }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.cosi.containerSecurityContext (tpl (.Values.cosi.extraVolumeMounts | default "") .) (tpl (.Values.cosi.extraVolumes | default "") .)) | nindent 12 }}
             - mountPath: /var/lib/cosi
               name: socket
             {{- if .Values.cosi.enableAuth }}
@@ -145,6 +149,9 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if .Values.cosi.containerSecurityContext.enabled }}
+          securityContext: {{- omit .Values.cosi.containerSecurityContext "enabled" | toYaml | nindent 12 }}
+          {{- end }}
         - name: seaweedfs-cosi-sidecar
           image: "{{ .Values.cosi.sidecar.image }}"
           imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
@@ -156,6 +163,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.cosi.containerSecurityContext "" "") | nindent 12 }}
             - mountPath: /var/lib/cosi
               name: socket
           {{- with .Values.cosi.sidecar.resources }}
@@ -169,6 +177,7 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.cosi.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.cosi.containerSecurityContext (tpl (.Values.cosi.extraVolumeMounts | default "") .) (tpl (.Values.cosi.extraVolumes | default "") .) true) | nindent 8 }}
         - name: socket
           emptyDir: {}
         {{- if .Values.cosi.enableAuth }}
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
index 6d0a4bc387..5df150469a 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
+  name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml b/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
index c1c2f7d789..8c150971d4 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-grpc-ingressroutetcp.yaml
@@ -24,6 +24,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with .Values.filer.ingresses.grpc.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   {{- if $securityEnabled }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml b/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
new file mode 100644
index 0000000000..e655c1c196
--- /dev/null
+++ b/k8s/charts/seaweedfs/templates/filer/filer-httproute.yaml
@@ -0,0 +1,57 @@
+{{- $filerEnabled := or .Values.filer.enabled .Values.allInOne.enabled }}
+{{- if and $filerEnabled .Values.filer.httpRoute.enabled }}
+{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "filer")) .Values.allInOne.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "seaweedfs.componentName" (list . "filer") }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.filer.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: filer
+    {{- with .Values.filer.httpRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- with .Values.filer.httpRoute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.filer.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.filer.httpRoute.rules | default (list dict) }}
+    - backendRefs:
+        {{- with .backendRefs }}
+        {{- toYaml . | nindent 8 }}
+        {{- else }}
+        - group: ""
+          kind: Service
+          name: {{ $serviceName }}
+          namespace: {{ $.Release.Namespace }}
+          port: {{ $.Values.filer.port }}
+          weight: 1
+        {{- end }}
+      {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .filters }}
+      filters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .timeouts }}
+      timeouts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml b/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
index b747cd2d86..335f250b0d 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-ingress.yaml
@@ -29,6 +29,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with .Values.filer.ingresses.http.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.http.className }}
   ingressClassName: {{ .Values.filer.ingresses.http.className | quote }}
@@ -87,6 +90,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+    {{- with .Values.filer.ingresses.grpc.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.filer.ingresses.grpc.className }}
   ingressClassName: {{ .Values.filer.ingresses.grpc.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml b/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
index d3d585bfb8..ae0a1a7408 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-service-client.yaml
@@ -10,9 +10,6 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
-{{- if .Values.filer.metricsPort }}
-    monitoring: "true"
-{{- end }}
 {{- if .Values.filer.annotations }}
   annotations:
     {{- toYaml .Values.filer.annotations | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-service.yaml b/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
index f7ceaf8a2c..1141927eb9 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-service.yaml
@@ -10,6 +10,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: filer
+{{- if .Values.filer.metricsPort }}
+    monitoring: "true"
+{{- end }}
   annotations:
     service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
 {{- if .Values.filer.annotations }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
index 2587572665..f2552ce68b 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-servicemonitor.yaml
@@ -30,6 +30,7 @@ spec:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
       app.kubernetes.io/instance: {{ .Release.Name }}
       app.kubernetes.io/component: filer
+      monitoring: "true"
 {{- end }}
 {{- end }}
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml b/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
index a76dcb6b5b..01210f6171 100644
--- a/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/filer/filer-statefulset.yaml
@@ -43,19 +43,15 @@ spec:
       {{- with .Values.filer.podLabels }}
       {{- toYaml . | nindent 8 }}
       {{- end }}
-      annotations:
-      {{- with .Values.podAnnotations }}
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.filer.podAnnotations }}
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
+      {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.filer.podAnnotations | default dict) }}
       {{- if .Values.filer.s3.existingConfigSecret }}
-        {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.filer.s3.existingConfigSecret) | default dict }}
-        checksum/s3config: {{ $configSecret | toYaml | sha256sum }}
+      {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.filer.s3.existingConfigSecret) | default dict }}
+      {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
       {{- else }}
-        checksum/s3config: {{ include (print .Template.BasePath "/s3/s3-secret.yaml") . | sha256sum }}
+      {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
       {{- end }}
+      annotations:
+        {{- toYaml $podAnnotations | nindent 8 }}
     spec:
       restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.filer.restartPolicy }}
       {{- if .Values.filer.affinity }}
@@ -76,6 +72,9 @@ spec:
       {{- if .Values.filer.priorityClassName }}
       priorityClassName: {{ .Values.filer.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.filer.schedulerName }}
+      schedulerName: {{ .Values.filer.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
       {{- if .Values.filer.initContainers }}
       initContainers:
@@ -89,6 +88,7 @@ spec:
           image: {{ template "seaweedfs.filer.image" . }}
           imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
           env:
+            {{- $mysqlEnabled := include "seaweedfs.filer.mysqlEnabled" . }}
             - name: POD_IP
               valueFrom:
                 fieldRef:
@@ -101,6 +101,7 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
+            {{- if $mysqlEnabled }}
             - name: WEED_MYSQL_USERNAME
               valueFrom:
                 secretKeyRef:
@@ -113,10 +114,21 @@ spec:
                   name: {{ include "seaweedfs.fullname" . }}-db-secret
                   key: password
                   optional: true
+            {{- end }}
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
+            {{- if and .Values.filer.s3.enabled .Values.filer.s3.enableAuth }}
+            {{- include "seaweedfs.s3.credentialEnv" . | nindent 12 }}
+            {{- end }}
             {{- $mergedExtraEnvironmentVars := dict }}
             {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.filer "target" $mergedExtraEnvironmentVars) }}
+            {{- if not $mysqlEnabled }}
+            {{- range $key := keys $mergedExtraEnvironmentVars }}
+            {{- if hasPrefix "WEED_MYSQL_" $key }}
+            {{- $_ := unset $mergedExtraEnvironmentVars $key }}
+            {{- end }}
+            {{- end }}
+            {{- end }}
             {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
             {{- $value := index $mergedExtraEnvironmentVars $key }}
             - name: {{ $key }}
@@ -129,10 +141,12 @@ spec:
             {{- end }}
             {{- if .Values.filer.secretExtraEnvironmentVars }}
             {{- range $key, $value := .Values.filer.secretExtraEnvironmentVars }}
+            {{- if or $mysqlEnabled (not (hasPrefix "WEED_MYSQL_" $key)) }}
             - name: {{ $key }}
               valueFrom: {{ toYaml $value | nindent 16 }}
             {{- end }}
             {{- end }}
+            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"
@@ -215,6 +229,7 @@ spec:
               {{ . }} \
               {{- end }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.filer.containerSecurityContext (tpl (.Values.filer.extraVolumeMounts | default "") .) (tpl (.Values.filer.extraVolumes | default "") .)) | nindent 12 }}
             {{- if (or (eq .Values.filer.logs.type "hostPath") (eq .Values.filer.logs.type "persistentVolumeClaim") (eq .Values.filer.logs.type "emptyDir")) }}
             - name: seaweedfs-filer-log-volume
               mountPath: "/logs/"
@@ -323,6 +338,7 @@ spec:
         {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.filer.sidecars "context" $) | nindent 8 }}
         {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.filer.containerSecurityContext (tpl (.Values.filer.extraVolumeMounts | default "") .) (tpl (.Values.filer.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if eq .Values.filer.logs.type "hostPath" }}
         - name: seaweedfs-filer-log-volume
           hostPath:
diff --git a/k8s/charts/seaweedfs/templates/master/master-httproute.yaml b/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
new file mode 100644
index 0000000000..ad6e685e8c
--- /dev/null
+++ b/k8s/charts/seaweedfs/templates/master/master-httproute.yaml
@@ -0,0 +1,57 @@
+{{- $masterEnabled := or .Values.master.enabled .Values.allInOne.enabled }}
+{{- if and $masterEnabled .Values.master.httpRoute.enabled }}
+{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "master")) .Values.allInOne.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "seaweedfs.componentName" (list . "master") }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.master.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: master
+    {{- with .Values.master.httpRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- with .Values.master.httpRoute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.master.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.master.httpRoute.rules | default (list dict) }}
+    - backendRefs:
+        {{- with .backendRefs }}
+        {{- toYaml . | nindent 8 }}
+        {{- else }}
+        - group: ""
+          kind: Service
+          name: {{ $serviceName }}
+          namespace: {{ $.Release.Namespace }}
+          port: {{ $.Values.master.port }}
+          weight: 1
+        {{- end }}
+      {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .filters }}
+      filters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .timeouts }}
+      timeouts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/k8s/charts/seaweedfs/templates/master/master-ingress.yaml b/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
index 75319709a7..9ec8819a2b 100644
--- a/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-ingress.yaml
@@ -21,6 +21,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: master
+    {{- with .Values.master.ingress.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   ingressClassName: {{ .Values.master.ingress.className | quote }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml b/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
index 21f29f095b..08a371c30c 100644
--- a/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/master/master-statefulset.yaml
@@ -43,13 +43,10 @@ spec:
       {{- with .Values.master.podLabels }}
       {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.master.podAnnotations | default dict) }}
+      {{- $_ := set $podAnnotations "checksum/master-config" (include (print .Template.BasePath "/master/master-configmap.yaml") . | sha256sum) }}
       annotations:
-      {{ with .Values.podAnnotations }}
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.master.podAnnotations }}
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- toYaml $podAnnotations | nindent 8 }}
     spec:
       restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.master.restartPolicy }}
       {{- if .Values.master.affinity }}
@@ -69,6 +66,9 @@ spec:
       {{- if .Values.master.priorityClassName }}
       priorityClassName: {{ .Values.master.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.master.schedulerName }}
+      schedulerName: {{ .Values.master.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
       serviceAccountName: {{ .Values.master.serviceAccountName | default (include "seaweedfs.serviceAccountName" .) | quote }} # for deleting statefulset pods after migration
       {{- if .Values.master.initContainers }}
@@ -179,6 +179,7 @@ spec:
               {{ . }} \
               {{- end }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.master.containerSecurityContext (tpl (.Values.master.extraVolumeMounts | default "") .) (tpl (.Values.master.extraVolumes | default "") .)) | nindent 12 }}
             - name : data-{{ .Release.Namespace }}
               mountPath: /data
             {{- if or (eq .Values.master.logs.type "hostPath") (eq .Values.master.logs.type "persistentVolumeClaim") (eq .Values.master.logs.type "emptyDir") }}
@@ -258,6 +259,7 @@ spec:
         {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.master.sidecars "context" $) | nindent 8 }}
         {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.master.containerSecurityContext (tpl (.Values.master.extraVolumeMounts | default "") .) (tpl (.Values.master.extraVolumes | default "") .) false) | nindent 8 }}
         {{- include "seaweedfs.licenseVolume" . | nindent 8 }}
         {{- if eq .Values.master.logs.type "hostPath" }}
         - name: seaweedfs-master-log-volume
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
index db231fc965..2d40f0ff84 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-deployment.yaml
@@ -17,6 +17,10 @@ metadata:
 {{- end }}
 spec:
   replicas: {{ .Values.s3.replicas }}
+  {{- with .Values.s3.updateStrategy }}
+  strategy:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
@@ -35,13 +39,15 @@ spec:
       {{- with .Values.s3.podLabels }}
       {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $podAnnotations := mergeOverwrite (deepCopy (.Values.podAnnotations | default dict)) (.Values.s3.podAnnotations | default dict) }}
+      {{- if .Values.s3.existingConfigSecret }}
+      {{- $configSecret := (lookup "v1" "Secret" .Release.Namespace .Values.s3.existingConfigSecret) | default dict }}
+      {{- $_ := set $podAnnotations "checksum/s3config" ($configSecret | toYaml | sha256sum) }}
+      {{- else }}
+      {{- $_ := set $podAnnotations "checksum/s3config" (include "seaweedfs.s3.configChecksum" .) }}
+      {{- end }}
       annotations:
-      {{ with .Values.podAnnotations }}
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.s3.podAnnotations }}
-      {{- toYaml . | nindent 8 }}
-      {{- end }}
+        {{- toYaml $podAnnotations | nindent 8 }}
     spec:
       restartPolicy: {{ default .Values.global.seaweedfs.restartPolicy .Values.s3.restartPolicy }}
       {{- if .Values.s3.affinity }}
@@ -57,10 +63,13 @@ spec:
         {{ tpl .Values.s3.tolerations . | nindent 8 | trim }}
       {{- end }}
       {{- include "seaweedfs.imagePullSecrets" . | nindent 6 }}
-      terminationGracePeriodSeconds: 10
+      terminationGracePeriodSeconds: {{ .Values.s3.terminationGracePeriodSeconds }}
       {{- if .Values.s3.priorityClassName }}
       priorityClassName: {{ .Values.s3.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.s3.schedulerName }}
+      schedulerName: {{ .Values.s3.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
       {{- if .Values.s3.serviceAccountName }}
       serviceAccountName: {{ .Values.s3.serviceAccountName | quote }}
@@ -91,6 +100,9 @@ spec:
                   fieldPath: metadata.namespace
             - name: SEAWEEDFS_FULLNAME
               value: "{{ include "seaweedfs.fullname" . }}"
+            {{- if .Values.s3.enableAuth }}
+            {{- include "seaweedfs.s3.credentialEnv" . | nindent 12 }}
+            {{- end }}
             {{- $mergedExtraEnvironmentVars := dict }}
             {{- include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.s3 "target" $mergedExtraEnvironmentVars) }}
             {{- range $key := keys $mergedExtraEnvironmentVars | sortAlpha }}
@@ -143,10 +155,13 @@ spec:
               {{- if .Values.s3.icebergPort }}
               -port.iceberg={{ .Values.s3.icebergPort }} \
               {{- end }}
+              {{- /* rendered even when 0: an if would drop the flag and weed would serve its default */}}
+              -port.lance={{ .Values.s3.lancePort | default 0 }} \
               {{- range .Values.s3.extraArgs }}
               {{ . }} \
               {{- end }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.s3.containerSecurityContext (tpl (.Values.s3.extraVolumeMounts | default "") .) (tpl (.Values.s3.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.s3.logs.type "hostPath") (eq .Values.s3.logs.type "emptyDir") }}
             - name: logs
               mountPath: "/logs/"
@@ -192,6 +207,10 @@ spec:
             - containerPort: {{ .Values.s3.icebergPort }}
               name: swfs-iceberg
             {{- end }}
+            {{- if .Values.s3.lancePort }}
+            - containerPort: {{ .Values.s3.lancePort }}
+              name: swfs-lance
+            {{- end }}
             {{- if .Values.s3.metricsPort }}
             - containerPort: {{ .Values.s3.metricsPort }}
               name: metrics
@@ -220,6 +239,10 @@ spec:
             failureThreshold: {{ .Values.s3.livenessProbe.failureThreshold }}
             timeoutSeconds: {{ .Values.s3.livenessProbe.timeoutSeconds }}
           {{- end }}
+          {{- with .Values.s3.lifecycle }}
+          lifecycle:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- with .Values.s3.resources }}
           resources:
             {{- toYaml . | nindent 12 }}
@@ -231,6 +254,7 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.s3.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.s3.containerSecurityContext (tpl (.Values.s3.extraVolumeMounts | default "") .) (tpl (.Values.s3.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if .Values.s3.enableAuth }}
         - name: config-users
           secret:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml b/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
new file mode 100644
index 0000000000..33f477709a
--- /dev/null
+++ b/k8s/charts/seaweedfs/templates/s3/s3-httproute.yaml
@@ -0,0 +1,64 @@
+{{- $s3Enabled := or .Values.s3.enabled (and .Values.filer.s3.enabled (not .Values.allInOne.enabled)) (and .Values.allInOne.enabled .Values.allInOne.s3.enabled) }}
+{{- if and $s3Enabled .Values.s3.httpRoute.enabled }}
+{{- $serviceName := include "seaweedfs.componentName" (list . "s3") }}
+{{- $s3Port := .Values.filer.s3.port }}
+{{- if and .Values.allInOne.enabled .Values.allInOne.s3.enabled }}
+{{- $serviceName = include "seaweedfs.componentName" (list . "all-in-one") }}
+{{- $s3Port = .Values.allInOne.s3.port | default .Values.s3.port }}
+{{- else if .Values.s3.enabled }}
+{{- $s3Port = .Values.s3.port }}
+{{- end }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "seaweedfs.componentName" (list . "s3") }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.s3.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: s3
+    {{- with .Values.s3.httpRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- with .Values.s3.httpRoute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.s3.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.s3.httpRoute.rules | default (list dict) }}
+    - backendRefs:
+        {{- with .backendRefs }}
+        {{- toYaml . | nindent 8 }}
+        {{- else }}
+        - group: ""
+          kind: Service
+          name: {{ $serviceName }}
+          namespace: {{ $.Release.Namespace }}
+          port: {{ $s3Port }}
+          weight: 1
+        {{- end }}
+      {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .filters }}
+      filters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .timeouts }}
+      timeouts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
index 5a760d7e9e..322880c75d 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-iceberg-ingress.yaml
@@ -41,6 +41,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3-iceberg
+    {{- with .Values.s3.icebergIngress.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   {{- if .Values.s3.icebergIngress.className }}
   ingressClassName: {{ .Values.s3.icebergIngress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
index bc4eee1642..cf55ca45ba 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-ingress.yaml
@@ -32,6 +32,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
+    {{- with .Values.s3.ingress.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   ingressClassName: {{ .Values.s3.ingress.className | quote }}
   tls:
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml b/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
new file mode 100644
index 0000000000..eeca7b02e6
--- /dev/null
+++ b/k8s/charts/seaweedfs/templates/s3/s3-lance-ingress.yaml
@@ -0,0 +1,64 @@
+{{- define "seaweedfs.s3.lance.ingress.paths" -}}
+paths:
+- path: {{ .Values.s3.lanceIngress.path | quote }}
+  pathType: {{ .Values.s3.lanceIngress.pathType | quote }}
+  backend:
+    {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+    service:
+      name: {{ include "seaweedfs.componentName" (list . "s3") }}
+      port:
+        number: {{ .Values.s3.lancePort }}
+    {{- else }}
+    serviceName: {{ include "seaweedfs.componentName" (list . "s3") }}
+    servicePort: {{ .Values.s3.lancePort }}
+    {{- end }}
+{{- end -}}
+{{- if and .Values.s3.enabled .Values.s3.lancePort .Values.s3.lanceIngress.enabled }}
+{{- $hosts := list }}
+{{- if kindIs "slice" .Values.s3.lanceIngress.host }}
+  {{- $hosts = .Values.s3.lanceIngress.host }}
+{{- else if .Values.s3.lanceIngress.host }}
+  {{- $hosts = list .Values.s3.lanceIngress.host }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }}
+apiVersion: networking.k8s.io/v1beta1
+{{- else }}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: ingress-{{ include "seaweedfs.fullname" . }}-s3-lance
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.s3.lanceIngress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: s3-lance
+    {{- with .Values.s3.lanceIngress.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- if .Values.s3.lanceIngress.className }}
+  ingressClassName: {{ .Values.s3.lanceIngress.className | quote }}
+  {{- end }}
+  tls:
+    {{ .Values.s3.lanceIngress.tls | default list | toYaml | nindent 6}}
+  rules:
+{{- if $hosts }}
+{{- range $host := $hosts }}
+  - host: {{ $host | quote }}
+    http:
+      {{- include "seaweedfs.s3.lance.ingress.paths" $ | nindent 6 }}
+{{- end }}
+{{- else }}
+  - http:
+      {{- include "seaweedfs.s3.lance.ingress.paths" . | nindent 4 }}
+{{- end }}
+{{- end }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
index 5a2ab67741..595d9091dc 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-secret.yaml
@@ -1,4 +1,7 @@
-{{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) }}
+{{- /* Mirrors the condition the all-in-one deployment mounts this secret under,
+       so the flags that make it mount are exactly the flags that create it. */}}
+{{- $allInOneAuth := and .Values.allInOne.enabled .Values.allInOne.s3.enabled (or .Values.allInOne.s3.enableAuth .Values.s3.enableAuth .Values.filer.s3.enableAuth) (not (or .Values.allInOne.s3.existingConfigSecret .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret)) }}
+{{- if or (and (or .Values.s3.enabled .Values.allInOne.enabled) .Values.s3.enableAuth (not .Values.s3.existingConfigSecret)) (and .Values.filer.s3.enabled .Values.filer.s3.enableAuth (not .Values.filer.s3.existingConfigSecret)) $allInOneAuth }}
 {{- $secretName := printf "%s-s3-secret" (include "seaweedfs.fullname" .) }}
 {{- $legacySecretName := "seaweedfs-s3-secret" }}
 {{- $lookupName := $secretName }}
@@ -14,14 +17,20 @@
 {{- $adminCreds := $creds.admin | default dict -}}
 {{- $access_key_admin := $adminCreds.accessKey -}}
 {{- $secret_key_admin := $adminCreds.secretKey -}}
-{{- if not (and $access_key_admin $secret_key_admin) -}}
+{{- if $adminCreds.existingSecret -}}
+  {{- $access_key_admin = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "admin" "accessKey")) -}}
+  {{- $secret_key_admin = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "admin" "secretKey")) -}}
+{{- else if not (and $access_key_admin $secret_key_admin) -}}
   {{- $access_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
   {{- $secret_key_admin = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "admin_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
 {{- $readCreds := $creds.read | default dict -}}
 {{- $access_key_read := $readCreds.accessKey -}}
 {{- $secret_key_read := $readCreds.secretKey -}}
-{{- if not (and $access_key_read $secret_key_read) -}}
+{{- if $readCreds.existingSecret -}}
+  {{- $access_key_read = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "read" "accessKey")) -}}
+  {{- $secret_key_read = printf "${%s}" (include "seaweedfs.s3.credentialEnvName" (list "read" "secretKey")) -}}
+{{- else if not (and $access_key_read $secret_key_read) -}}
   {{- $access_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_access_key_id" "length" 20 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
   {{- $secret_key_read = include "seaweedfs.getOrGeneratePassword" (dict "namespace" .Release.Namespace "secretName" $secretName "key" "read_secret_access_key" "length" 40 "existingSecret" (ternary $existingSecret nil $reuse)) -}}
 {{- end -}}
@@ -41,11 +50,17 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: s3
 stringData:
+  {{- /* An identity read from an existing Secret keeps its keys there; the
+         config below names the environment variables carrying them. */}}
+  {{- if not $adminCreds.existingSecret }}
   admin_access_key_id: {{ $access_key_admin }}
   admin_secret_access_key: {{ $secret_key_admin }}
+  {{- end }}
+  {{- if not $readCreds.existingSecret }}
   read_access_key_id: {{ $access_key_read }}
   read_secret_access_key: {{ $secret_key_read }}
-  seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"{{ $access_key_admin }}","secretKey":"{{ $secret_key_admin }}"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"{{ $access_key_read }}","secretKey":"{{ $secret_key_read }}"}],"actions":["Read"]}]}'
+  {{- end }}
+  seaweedfs_s3_config: '{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"{{ $access_key_admin }}","secretKey":"{{ $secret_key_admin }}"}],"actions":["Admin","Read","Write"]},{"name":"anvReadOnly","credentials":[{"accessKey":"{{ $access_key_read }}","secretKey":"{{ $secret_key_read }}"}],"actions":["Read","List"]}]}'
   {{- if .Values.filer.s3.auditLogConfig }}
   filer_s3_auditLogConfig.json: |
     {{ toJson .Values.filer.s3.auditLogConfig | nindent 4 }}
diff --git a/k8s/charts/seaweedfs/templates/s3/s3-service.yaml b/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
index 9537c3dceb..b5aba6a866 100644
--- a/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
+++ b/k8s/charts/seaweedfs/templates/s3/s3-service.yaml
@@ -21,6 +21,7 @@ spec:
   {{- $nodePorts = .Values.s3.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
+  {{- include "seaweedfs.service.loadBalancerFields" .Values.s3.service }}
   internalTrafficPolicy: {{ .Values.s3.internalTrafficPolicy | default "Cluster" }}
   {{- $td := .Values.s3.trafficDistribution | default .Values.filer.s3.trafficDistribution }}
   {{- if and (semverCompare ">=1.31-0" .Capabilities.KubeVersion.GitVersion) $td }}
@@ -43,6 +44,15 @@ spec:
 {{- end }}
     protocol: TCP
 {{- end }}
+{{- if and .Values.s3.enabled .Values.s3.lancePort }}
+  - name: "swfs-lance"
+    port: {{ .Values.s3.lancePort }}
+    targetPort: {{ .Values.s3.lancePort }}
+{{- if $nodePorts.lance }}
+    nodePort: {{ $nodePorts.lance }}
+{{- end }}
+    protocol: TCP
+{{- end }}
 {{- if and .Values.s3.enabled .Values.s3.httpsPort }}
   - name: "swfs-s3-tls"
     port: {{ .Values.s3.httpsPort }}
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
index 7e54dbfb3c..dd75336ca1 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-deployment.yaml
@@ -61,6 +61,9 @@ spec:
       {{- if .Values.sftp.priorityClassName }}
       priorityClassName: {{ .Values.sftp.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.sftp.schedulerName }}
+      schedulerName: {{ .Values.sftp.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
       {{- if .Values.sftp.serviceAccountName }}
       serviceAccountName: {{ .Values.sftp.serviceAccountName | quote }}
@@ -167,6 +170,7 @@ spec:
               -userStoreFile=/etc/sw/seaweedfs_sftp_config \
               -filer={{ include "seaweedfs.componentName" (list . "filer-client") }}.{{ .Release.Namespace }}:{{ .Values.filer.port }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.sftp.containerSecurityContext (tpl (.Values.sftp.extraVolumeMounts | default "") .) (tpl (.Values.sftp.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.sftp.logs.type "hostPath") (eq .Values.sftp.logs.type "emptyDir") }}
             - name: logs
               mountPath: "/logs/"
@@ -246,6 +250,7 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.sftp.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.sftp.containerSecurityContext (tpl (.Values.sftp.extraVolumeMounts | default "") .) (tpl (.Values.sftp.extraVolumes | default "") .) false) | nindent 8 }}
         {{- if .Values.sftp.enableAuth }}
         - name: config-users
           secret:
diff --git a/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml b/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
index 14cf09d7ac..aae3bdec12 100644
--- a/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
+++ b/k8s/charts/seaweedfs/templates/sftp/sftp-service.yaml
@@ -21,6 +21,7 @@ spec:
   {{- $nodePorts = .Values.sftp.service.nodePorts | default dict }}
   {{- end }}
   type: {{ $serviceType }}
+  {{- include "seaweedfs.service.loadBalancerFields" .Values.sftp.service }}
   internalTrafficPolicy: {{ .Values.sftp.internalTrafficPolicy | default "Cluster" }}
   ports:
   - name: "swfs-sftp"
diff --git a/k8s/charts/seaweedfs/templates/shared/_helpers.tpl b/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
index d09edc6f51..c59aef820c 100644
--- a/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
+++ b/k8s/charts/seaweedfs/templates/shared/_helpers.tpl
@@ -76,6 +76,92 @@ Inject extra environment vars in the format key:value, if populated
 {{- end }}
 {{- end -}}
 
+{{/*
+Writable temporary directory for containers using a read-only root filesystem.
+Input: list of the root context, the component container security context, the
+rendered extraVolumeMounts and extraVolumes, and whether the pod has secondary
+chart-managed containers that mount seaweedfs-tmp. A user-supplied /tmp mount
+only covers the main container, so the volume is still emitted for secondaries;
+a user-supplied seaweedfs-tmp volume is reused rather than duplicated.
+*/}}
+{{- define "seaweedfs.tmpDirCovered" -}}
+{{- regexMatch `(?m)^\s*-?\s*mountPath:\s*['"]?/tmp/?['"]?\s*(#.*)?$` (index . 2) -}}
+{{- end -}}
+
+{{- define "seaweedfs.tmpDirVolume" -}}
+{{- $root := index . 0 -}}
+{{- $securityContext := index . 1 -}}
+{{- if and $securityContext.enabled $securityContext.readOnlyRootFilesystem
+  (or (index . 4) (ne (include "seaweedfs.tmpDirCovered" .) "true"))
+  (not (regexMatch `(?m)^\s*-?\s*name:\s*['"]?seaweedfs-tmp['"]?\s*(#.*)?$` (index . 3))) }}
+- name: seaweedfs-tmp
+  {{- with $root.Values.global.seaweedfs.tmpDir.sizeLimit }}
+  emptyDir:
+    sizeLimit: {{ . | quote }}
+  {{- else }}
+  emptyDir: {}
+  {{- end }}
+{{- end }}
+{{- end -}}
+
+{{- define "seaweedfs.tmpDirVolumeMount" -}}
+{{- $securityContext := index . 1 -}}
+{{- if and $securityContext.enabled $securityContext.readOnlyRootFilesystem
+  (ne (include "seaweedfs.tmpDirCovered" .) "true") }}
+- name: seaweedfs-tmp
+  mountPath: /tmp
+{{- end }}
+{{- end -}}
+
+{{/* Whether the mysql filer store is selected; a flag the chart cannot read counts as selected. */}}
+{{- define "seaweedfs.filer.mysqlEnabled" -}}
+{{- $merged := dict -}}
+{{- $_ := include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.filer "target" $merged) -}}
+{{- $enabled := index $merged "WEED_MYSQL_ENABLED" -}}
+{{- if or (kindIs "map" $enabled) (hasKey (.Values.filer.secretExtraEnvironmentVars | default dict) "WEED_MYSQL_ENABLED") -}}
+true
+{{- else if and $enabled (eq (lower (toString $enabled)) "true") -}}
+true
+{{- end -}}
+{{- end -}}
+
+{{/* Classify an admin bind address as loopback, mirroring weed admin's
+     isLoopbackIp (net.ParseIP + IsLoopback). Helm templates cannot call
+     net.ParseIP, so we approximate: valid IPv4 addresses in 127.0.0.0/8
+     (validated via regex to reject malformed values like "127.not-an-ip")
+     and the IPv6 loopback "::1" / its expanded form "0:0:0:0:0:0:0:1" are
+     loopback. Hostnames (e.g. "localhost") and wildcard addresses
+     ("0.0.0.0", "::") are non-loopback, matching the binary, which
+     treats unparseable hostnames as non-loopback to be safe. Other IPv6
+     loopback representations are not matched; the binary's own runtime
+     validation is the authoritative guard. */}}
+{{- define "seaweedfs.admin.isLoopbackIp" -}}
+{{- $ip := toString . -}}
+{{- if or (regexMatch "^127\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}$" $ip) (eq $ip "::1") (eq $ip "0:0:0:0:0:0:0:1") -}}
+true
+{{- end -}}
+{{- end -}}
+
+{{/* Whether the admin non-loopback bind guard is satisfied: admin.secret
+     (adminPassword or existingSecret), WEED_ADMIN_PASSWORD via
+     extraEnvironmentVars / secretExtraEnvironmentVars, or
+     admin.allowInsecureBind. A secret-backed entry counts as enabled even
+     though the chart cannot read its value. */}}
+{{- define "seaweedfs.admin.authEnabled" -}}
+{{- if or .Values.admin.secret.existingSecret .Values.admin.secret.adminPassword .Values.admin.allowInsecureBind -}}
+true
+{{- else -}}
+{{- $merged := dict -}}
+{{- $_ := include "seaweedfs.mergeExtraEnvironmentVars" (dict "global" .Values.global.seaweedfs "component" .Values.admin "target" $merged) -}}
+{{- $envPassword := index $merged "WEED_ADMIN_PASSWORD" -}}
+{{- if or (kindIs "map" $envPassword) (hasKey (.Values.admin.secretExtraEnvironmentVars | default dict) "WEED_ADMIN_PASSWORD") -}}
+true
+{{- else if and $envPassword (ne (toString $envPassword) "") -}}
+true
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
 {{/* Return the proper filer image */}}
 {{- define "seaweedfs.filer.image" -}}
 {{- if .Values.filer.imageOverride -}}
@@ -136,6 +222,15 @@ Inject extra environment vars in the format key:value, if populated
 {{- end -}}
 {{- end -}}
 
+{{/* Lance namespace URL the worker's Lance container maintains; empty when unreachable */}}
+{{- define "seaweedfs.worker.lanceNamespaceUrl" -}}
+{{- if .Values.worker.namespaceUrl -}}
+{{- .Values.worker.namespaceUrl -}}
+{{- else if and .Values.s3.enabled .Values.s3.lancePort -}}
+{{- printf "http://%s.%s:%d" (include "seaweedfs.componentName" (list . "s3")) .Release.Namespace (int .Values.s3.lancePort) -}}
+{{- end -}}
+{{- end -}}
+
 {{/* Return the proper volume image */}}
 {{- define "seaweedfs.volume.image" -}}
 {{- if .Values.volume.imageOverride -}}
@@ -349,6 +444,46 @@ true
 {{- end -}}
 {{- end -}}
 
+{{/* Read a JWT key from the chart's existing security.toml without fromToml
+     (which requires Helm >=3.17). Args: (list "<section>" $raw).
+     Return the single-line TOML string token, including its quotes, so escapes
+     and explicitly empty values survive unchanged. No output means absent.
+     Accept bare or simply quoted dotted header segments. Fail on other quoted
+     headers rather than risk rotating a key hidden by unsupported syntax.
+     This reads the chart's section/key layout, not arbitrary TOML syntax. */}}
+{{- define "seaweedfs.existingTomlKey" -}}
+{{- $section := index . 0 -}}
+{{- $raw := index . 1 -}}
+{{- $parts := list -}}
+{{- range $part := splitList "." $section -}}
+  {{- $escaped := regexQuoteMeta $part -}}
+  {{- $parts = append $parts (printf `(?:%s|"%s"|'%s')` $escaped $escaped $escaped) -}}
+{{- end -}}
+{{- $header := printf `^\[[ \t]*%s[ \t]*\][ \t]*(#.*)?$` (join `[ \t]*\.[ \t]*` $parts) -}}
+{{- $segment := `(?:[A-Za-z0-9_-]+|"[^"\\]*"|'[^']*')` -}}
+{{- $simpleHeader := printf `^\[[ \t]*%s(?:[ \t]*\.[ \t]*%s)*[ \t]*\][ \t]*(#.*)?$` $segment $segment -}}
+{{- $assignment := `^(key|"key"|'key')[ \t]*=[ \t]*` -}}
+{{- $string := `"([^"\\]|\\.)*"|'[^']*'` -}}
+{{- $active := false -}}
+{{- $key := "" -}}
+{{- range $rawLine := splitList "\n" $raw -}}
+  {{- $line := trim $rawLine -}}
+  {{- if hasPrefix "[" $line -}}
+    {{- if and (regexMatch `^\[[^]]*["']` $line) (not (regexMatch $simpleHeader $line)) (eq $key "") -}}
+      {{- fail (printf "security.toml has an unsupported quoted section header; refusing to replace [%s].key" $section) -}}
+    {{- end -}}
+    {{- $active = regexMatch $header $line -}}
+  {{- else if and $active (eq $key "") (regexMatch $assignment $line) -}}
+    {{- $value := regexReplaceAll $assignment $line "" -}}
+    {{- if not (regexMatch (printf `^(%s)[ \t]*(#.*)?$` $string) $value) -}}
+      {{- fail (printf "security.toml [%s].key must be a single-line quoted TOML string; refusing to replace an existing key" $section) -}}
+    {{- end -}}
+    {{- $key = regexFind $string $value -}}
+  {{- end -}}
+{{- end -}}
+{{- $key -}}
+{{- end -}}
+
 {{/* True when the post-install bucket hook Job renders: an S3 endpoint, plus
      buckets to create on it. Read by the Job itself and by its NetworkPolicy,
      which has to appear exactly when the Job does - a Job without its policy
@@ -409,8 +544,9 @@ true
 {{-             $pvcName := printf "%s-%s-%s-%d" $dir.name $seaweedfsName $volumeName $e }}
 {{-             $currentPVC := (lookup "v1" "PersistentVolumeClaim" $.Release.Namespace $pvcName) }}
 {{-             if $currentPVC }}
-{{-               $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage }}
-{{-               $newSize := include "seaweedfs.resource-quantity" $desiredSize }}
+{{- /* include returns a string such as "6.442450944e+10"; convert back to a number, or gt compares lexically */}}
+{{-               $oldSize := include "seaweedfs.resource-quantity" $currentPVC.spec.resources.requests.storage | float64 }}
+{{-               $newSize := include "seaweedfs.resource-quantity" $desiredSize | float64 }}
 {{-               if gt $newSize $oldSize }}
 {{-                 $commands = append $commands (printf "kubectl patch pvc %s-%s-%s-%d -p '{\"spec\":{\"resources\":{\"requests\":{\"storage\":\"%s\"}}}}'" $dir.name $seaweedfsName $volumeName $e $desiredSize) }}
 {{-               end }}
@@ -496,6 +632,39 @@ true
 {{- end }}
 {{- end -}}
 
+{{/* Name of the environment variable carrying one generated S3 credential
+     field, e.g. SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID. The generated identities file
+     names it in place of the key when the key lives in an existing Secret.
+     Usage: include "seaweedfs.s3.credentialEnvName" (list "admin" "accessKey") */}}
+{{- define "seaweedfs.s3.credentialEnvName" -}}
+{{- $identity := index . 0 -}}
+{{- $field := index . 1 -}}
+{{- printf "SEAWEEDFS_S3_%s_%s" (upper $identity) (ternary "ACCESS_KEY_ID" "SECRET_ACCESS_KEY" (eq $field "accessKey")) -}}
+{{- end -}}
+
+{{/* Environment for the S3 identities the chart generates from an existing
+     Secret. The gateway resolves the ${VAR} references the identities file
+     carries, so the keys never enter the rendered manifests and a dry run
+     renders the same as an install. */}}
+{{- define "seaweedfs.s3.credentialEnv" -}}
+{{- $creds := $.Values.s3.credentials | default dict -}}
+{{- range $identity := list "admin" "read" -}}
+{{- $identityCreds := index $creds $identity | default dict -}}
+{{- if $identityCreds.existingSecret }}
+- name: {{ include "seaweedfs.s3.credentialEnvName" (list $identity "accessKey") }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ $identityCreds.existingSecret | quote }}
+      key: {{ default (printf "%s_access_key_id" $identity) $identityCreds.accessKeyKey | quote }}
+- name: {{ include "seaweedfs.s3.credentialEnvName" (list $identity "secretKey") }}
+  valueFrom:
+    secretKeyRef:
+      name: {{ $identityCreds.existingSecret | quote }}
+      key: {{ default (printf "%s_secret_access_key" $identity) $identityCreds.secretKeyKey | quote }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
 {{/* Generate a compatible trafficDistribution value due to "PreferClose" fast deprecation in k8s v1.35.
      Accepts a dict with "value" (the trafficDistribution string) and "Capabilities". */}}
 {{- define "seaweedfs.trafficDistribution" -}}
@@ -503,3 +672,48 @@ true
 {{- and (eq .value "PreferClose") (semverCompare ">=1.35-0" .Capabilities.KubeVersion.GitVersion) | ternary "PreferSameZone" .value -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Render LoadBalancer-specific service fields (loadBalancerClass, loadBalancerIP,
+loadBalancerSourceRanges), only when the service type is LoadBalancer.
+Usage: {{ include "seaweedfs.service.loadBalancerFields" .Values.s3.service }}
+*/}}
+{{- define "seaweedfs.service.loadBalancerFields" -}}
+{{- if eq (.type | default "ClusterIP") "LoadBalancer" }}
+{{- with .loadBalancerClass }}
+  loadBalancerClass: {{ . }}
+{{- end }}
+{{- with .loadBalancerIP }}
+  loadBalancerIP: {{ . }}
+{{- end }}
+{{- with .loadBalancerSourceRanges }}
+  loadBalancerSourceRanges:
+    {{- toYaml . | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Checksum that restarts the S3-serving pods when the generated S3 config changes. It hashes the
+values s3-secret.yaml is built from, not the rendered Secret: that template keeps its generated keys
+with lookup, so rendering it again for a checksum draws new random keys whenever lookup finds
+nothing (on install), and the first upgrade then changed the checksum and restarted the pods
+although nothing had changed. Only the values that template reads are hashed, so scaling the S3
+gateway or changing its resources does not restart the filer. Keep this list in step with
+s3-secret.yaml.
+Keys the chart generated are not part of it. Deleting the Secret to rotate them regenerates them on
+the next upgrade without restarting the pods; restart them afterwards (kubectl rollout restart).
+Folding the stored keys in would bring the first-upgrade restart back, since lookup finds nothing
+on install.
+*/}}
+{{- define "seaweedfs.s3.configChecksum" -}}
+{{- dict
+  "secretName" (include "seaweedfs.fullname" .)
+  "enabled" (list .Values.s3.enabled .Values.filer.s3.enabled .Values.allInOne.enabled .Values.allInOne.s3.enabled)
+  "enableAuth" (list .Values.s3.enableAuth .Values.filer.s3.enableAuth .Values.allInOne.s3.enableAuth)
+  "existingConfigSecret" (list .Values.s3.existingConfigSecret .Values.filer.s3.existingConfigSecret .Values.allInOne.s3.existingConfigSecret)
+  "credentials" .Values.s3.credentials
+  "legacySecret" (list .Values.s3.reuseLegacySecret .Values.s3.legacySecretName)
+  "auditLogConfig" (list .Values.s3.auditLogConfig .Values.filer.s3.auditLogConfig)
+  | toJson | sha256sum -}}
+{{- end -}}
diff --git a/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml b/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
index 91f41bee1f..a9b4e316a6 100644
--- a/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/networkpolicy.yaml
@@ -73,6 +73,9 @@
 {{-   if .Values.s3.icebergPort }}
 {{-     $ports = append $ports .Values.s3.icebergPort }}
 {{-   end }}
+{{-   if .Values.s3.lancePort }}
+{{-     $ports = append $ports .Values.s3.lancePort }}
+{{-   end }}
 {{-   if .Values.s3.metricsPort }}
 {{-     $ports = append $ports .Values.s3.metricsPort }}
 {{-   end }}
@@ -90,13 +93,20 @@
        ClusterRole under global.seaweedfs.createClusterRole is a leftover from a
        migration and is not exercised by any component. */}}
 {{- if .Values.admin.enabled }}
-{{-   $targets = append $targets (dict "component" "admin" "ports" (list .Values.admin.port .Values.admin.grpcPort)) }}
+{{-   $ports := list .Values.admin.port .Values.admin.grpcPort }}
+{{-   if gt (int .Values.admin.legacyPort) 0 }}
+{{-     $ports = concat $ports (list .Values.admin.legacyPort (add (int .Values.admin.legacyPort) 10000)) }}
+{{-   end }}
+{{-   $targets = append $targets (dict "component" "admin" "ports" $ports) }}
 {{- end }}
 {{- if .Values.worker.enabled }}
 {{-   $ports := list }}
 {{-   if .Values.worker.metricsPort }}
 {{-     $ports = append $ports .Values.worker.metricsPort }}
 {{-   end }}
+{{-   if and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
+{{-     $ports = append $ports .Values.worker.lanceMetricsPort }}
+{{-   end }}
 {{-   $targets = append $targets (dict "component" "worker" "ports" $ports) }}
 {{- end }}
 
diff --git a/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml b/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
index 5868c1c54a..3952c73fbf 100644
--- a/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/post-install-bucket-hook.yaml
@@ -16,6 +16,20 @@
 {{- $clusterUpper := upper $clusterAlias }}
 {{- $clusterMasterKey := printf "WEED_CLUSTER_%s_MASTER" $clusterUpper }}
 {{- $clusterFilerKey := printf "WEED_CLUSTER_%s_FILER" $clusterUpper }}
+{{- $podSecurityContext := .Values.filer.podSecurityContext }}
+{{- $containerSecurityContext := .Values.filer.containerSecurityContext }}
+{{- $nodeSelector := .Values.filer.nodeSelector }}
+{{- $tolerations := .Values.filer.tolerations }}
+{{- $createBucketsHook := .Values.filer.s3.createBucketsHook }}
+{{- if .Values.allInOne.enabled }}
+  {{- $podSecurityContext = .Values.allInOne.podSecurityContext }}
+  {{- $containerSecurityContext = .Values.allInOne.containerSecurityContext }}
+  {{- $nodeSelector = .Values.allInOne.nodeSelector }}
+  {{- $tolerations = .Values.allInOne.tolerations }}
+  {{- $createBucketsHook = .Values.allInOne.s3.createBucketsHook }}
+{{- else if .Values.s3.createBuckets }}
+  {{- $createBucketsHook = .Values.s3.createBucketsHook }}
+{{- end }}
 
 {{- /* Check allInOne mode first */}}
 {{- if .Values.allInOne.enabled }}
@@ -70,9 +84,17 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
         app.kubernetes.io/component: bucket-hook
     spec:
+      {{- with $createBucketsHook.affinity }}
+      affinity:
+        {{ tpl . $ | indent 8 | trim }}
+      {{- end }}
       restartPolicy: Never
-      {{- if .Values.filer.podSecurityContext.enabled }}
-      securityContext: {{- omit .Values.filer.podSecurityContext "enabled" | toYaml | nindent 8 }}
+      {{- if $podSecurityContext.enabled }}
+      securityContext: {{- omit $podSecurityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      {{- with coalesce $createBucketsHook.tolerations $tolerations }}
+      tolerations:
+        {{ tpl . $ | indent 8 | trim }}
       {{- end }}
       {{- include "seaweedfs.imagePullSecrets" $ | nindent 6 }}
       containers:
@@ -150,7 +172,8 @@ spec:
             {{- $bucketName := .name }}
             {{- $bucketLock := or .lock .objectLock .withLock }}
             bucket_list=$(/bin/echo 's3.bucket.list' | /usr/bin/weed shell) || { echo "Error listing s3 buckets"; exit 1; }
-            if echo "$bucket_list" | awk '{print $1}' | grep -Fxq "{{ $bucketName }}"; then
+            {{- /* One awk: grep -q exits early, awk takes SIGPIPE, pipefail fails the test. */}}
+            if printf '%s\n' "$bucket_list" | awk -v bucket="{{ $bucketName }}" '$1 "" == bucket { found = 1 } END { exit !found }'; then
               echo "Bucket '{{ $bucketName }}' already exists, skipping creation."
             else
               echo "Creating bucket '{{ $bucketName }}'..."
@@ -202,8 +225,9 @@ spec:
                 /usr/bin/weed shell
           {{- end }}  
           {{- end }}
-        {{- if or $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
+        {{- if or (and $containerSecurityContext.enabled $containerSecurityContext.readOnlyRootFilesystem) $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
         volumeMounts:
+          {{- include "seaweedfs.tmpDirVolumeMount" (list . $containerSecurityContext "" "") | nindent 10 }}
           {{- if $enableAuth }}
           - name: config-users
             mountPath: /etc/sw
@@ -215,6 +239,14 @@ spec:
             mountPath: /etc/seaweedfs/security.toml
             subPath: security.toml
           {{- end }}
+          {{- if .Values.global.seaweedfs.enableSecurity }}
+          - name: ca-cert
+            readOnly: true
+            mountPath: /usr/local/share/ca-certificates/ca/
+          - name: client-cert
+            readOnly: true
+            mountPath: /usr/local/share/ca-certificates/client/
+          {{- end }}
         {{- end }}
         ports:
           - containerPort: {{ .Values.master.port }}
@@ -229,11 +261,12 @@ spec:
         resources:
           {{- toYaml . | nindent 10 }}
         {{- end }}
-        {{- if .Values.filer.containerSecurityContext.enabled }}
-        securityContext: {{- omit .Values.filer.containerSecurityContext "enabled" | toYaml | nindent 12 }}
+        {{- if $containerSecurityContext.enabled }}
+        securityContext: {{- omit $containerSecurityContext "enabled" | toYaml | nindent 12 }}
         {{- end }}
-    {{- if or $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
+    {{- if or (and $containerSecurityContext.enabled $containerSecurityContext.readOnlyRootFilesystem) $enableAuth (include "seaweedfs.securityConfigEnabled" .) }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . $containerSecurityContext "" "" false) | nindent 8 }}
         {{- if $enableAuth }}
         - name: config-users
           secret:
@@ -249,5 +282,17 @@ spec:
           configMap:
             name: {{ include "seaweedfs.fullname" . }}-security-config
         {{- end }}
+        {{- if .Values.global.seaweedfs.enableSecurity }}
+        - name: ca-cert
+          secret:
+            secretName: {{ include "seaweedfs.fullname" . }}-ca-cert
+        - name: client-cert
+          secret:
+            secretName: {{ include "seaweedfs.fullname" . }}-client-cert
+        {{- end }}
     {{- end }}
+      {{- with coalesce $createBucketsHook.nodeSelector $nodeSelector }}
+      nodeSelector:
+        {{ tpl . $ | indent 8 | trim }}
+      {{- end }}
 {{- end }}
diff --git a/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml b/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
index 1c7f050e11..d72c26a078 100644
--- a/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/secret-seaweedfs-db.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.filer.enabled }}
+{{- if and .Values.filer.enabled (include "seaweedfs.filer.mysqlEnabled" .) }}
 apiVersion: v1
 kind: Secret
 type: Opaque
diff --git a/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml b/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
index a067e1de9f..e840e62f8a 100644
--- a/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
+++ b/k8s/charts/seaweedfs/templates/shared/security-configmap.yaml
@@ -18,7 +18,7 @@ data:
   {{- $legacyName := printf "%s-%s" (include "seaweedfs.name" .) "security-config" }}
   {{- $existing = lookup "v1" "ConfigMap" .Release.Namespace $legacyName }}
   {{- end }}
-  {{- $securityConfig := fromToml (dig "data" "security.toml" "" $existing) }}
+  {{- $existingToml := dig "data" "security.toml" "" $existing }}
   {{- $securityConfigValues := .Values.global.seaweedfs.securityConfig | default dict }}
   {{- $jwtSigning := $securityConfigValues.jwtSigning | default dict }}
   {{- $expiresAfterSeconds := $jwtSigning.expiresAfterSeconds | default dict }}
@@ -29,7 +29,7 @@ data:
     # the jwt signing key is read by master and volume server
     # the jwt defaults to expire after 10 seconds
     [jwt.signing]
-    key = "{{ dig "jwt" "signing" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
+    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.signing" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
     {{- if gt (int $expiresAfterSeconds.volumeWrite) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.volumeWrite }}
     {{- end }}
@@ -41,7 +41,7 @@ data:
     # - the Volume server validates the JWT on reading
     # the jwt defaults to expire after 60 seconds
     [jwt.signing.read]
-    key = "{{ dig "jwt" "signing" "read" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
+    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.signing.read" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
     {{- if gt (int $expiresAfterSeconds.volumeRead) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.volumeRead }}
     {{- end }}
@@ -53,7 +53,7 @@ data:
     # - the Filer server validates the JWT on writing
     # the jwt defaults to expire after 10 seconds
     [jwt.filer_signing]
-    key = "{{ dig "jwt" "filer_signing" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
+    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.filer_signing" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
     {{- if gt (int $expiresAfterSeconds.filerWrite) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.filerWrite }}
     {{- end }}
@@ -65,7 +65,7 @@ data:
     # - the Filer server validates the JWT on reading
     # the jwt defaults to expire after 60 seconds
     [jwt.filer_signing.read]
-    key = "{{ dig "jwt" "filer_signing" "read" "key" (randAlphaNum 10 | b64enc) $securityConfig }}"
+    key = {{ include "seaweedfs.existingTomlKey" (list "jwt.filer_signing.read" $existingToml) | default (randAlphaNum 10 | b64enc | quote) }}
     {{- if gt (int $expiresAfterSeconds.filerRead) 0 }}
     expires_after_seconds = {{ int $expiresAfterSeconds.filerRead }}
     {{- end }}
@@ -97,6 +97,19 @@ data:
     cert = "/usr/local/share/ca-certificates/worker/tls.crt"
     key  = "/usr/local/share/ca-certificates/worker/tls.key"
 
+    {{- /* S3 gRPC server identity (weed s3 -port.grpc, default httpPort+10000).
+      Without this section, LoadServerTLS("grpc.s3") returns nil and the S3
+      server serves its internal gRPC (IAM cache propagation, s3 lifecycle
+      delete RPCs) as plaintext, while peers dial it with mTLS credentials:
+      "tls: first record does not look like a TLS handshake".
+      Always uses the internal CA-signed client certificate (already mounted
+      on s3 pods by s3-deployment.yaml). Deliberately NOT s3.tlsSecret: that
+      secret is for the public HTTPS listener and may be issued by a public
+      CA which internal gRPC peers (trusting only grpc.ca) would reject. */}}
+    [grpc.s3]
+    cert = "/usr/local/share/ca-certificates/client/tls.crt"
+    key  = "/usr/local/share/ca-certificates/client/tls.key"
+
     # use this for any place needs a grpc client
     # i.e., "weed backup|benchmark|filer.copy|filer.replicate|mount|s3|upload"
     [grpc.client]
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml b/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
new file mode 100644
index 0000000000..0fe815878e
--- /dev/null
+++ b/k8s/charts/seaweedfs/templates/volume/volume-httproute.yaml
@@ -0,0 +1,57 @@
+{{- $volumeEnabled := or .Values.volume.enabled .Values.allInOne.enabled }}
+{{- if and $volumeEnabled .Values.volume.httpRoute.enabled }}
+{{- $serviceName := ternary (include "seaweedfs.componentName" (list . "all-in-one")) (include "seaweedfs.componentName" (list . "volume")) .Values.allInOne.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "seaweedfs.componentName" (list . "volume") }}
+  namespace: {{ .Release.Namespace }}
+  {{- with .Values.volume.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: volume
+    {{- with .Values.volume.httpRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- with .Values.volume.httpRoute.parentRefs }}
+  parentRefs:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.volume.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.volume.httpRoute.rules | default (list dict) }}
+    - backendRefs:
+        {{- with .backendRefs }}
+        {{- toYaml . | nindent 8 }}
+        {{- else }}
+        - group: ""
+          kind: Service
+          name: {{ $serviceName }}
+          namespace: {{ $.Release.Namespace }}
+          port: {{ $.Values.volume.port }}
+          weight: 1
+        {{- end }}
+      {{- with .matches }}
+      matches:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .filters }}
+      filters:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .timeouts }}
+      timeouts:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml b/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
index b36c29867f..15d24de5fa 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-ingress.yaml
@@ -27,6 +27,9 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: volume
+    {{- with .Values.volume.ingress.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
 spec:
   {{- if and (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) .Values.volume.ingress.className }}
   ingressClassName: {{ .Values.volume.ingress.className | quote }}
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml b/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
index caa5cd4303..b6d3285722 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-resize-hook.yaml
@@ -30,15 +30,46 @@ spec:
         app.kubernetes.io/instance: {{ .Release.Name | quote }}
         app.kubernetes.io/component: volume-resize-hook
     spec:
+      {{- with .Values.volume.resizeHook.affinity }}
+      affinity:
+        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
+      {{- end }}
       serviceAccountName: {{ $seaweedfsName }}-volume-resize-hook
       restartPolicy: Never
+      {{- if .Values.volume.podSecurityContext.enabled }}
+      securityContext: {{- omit .Values.volume.podSecurityContext "enabled" | toYaml | nindent 8 }}
+      {{- end }}
+      {{- with coalesce .Values.volume.resizeHook.tolerations .Values.volume.tolerations }}
+      tolerations:
+        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
+      {{- end }}
       containers:
         - name: resize
           image: {{ .Values.volume.resizeHook.image }}
+          {{- if and .Values.volume.containerSecurityContext.enabled .Values.volume.containerSecurityContext.readOnlyRootFilesystem }}
+          env:
+            - name: HOME
+              value: /tmp
+          {{- end }}
           command: ["sh", "-xec"]
           args:
             - |
 {{ $commands | indent 14 }}
+          {{- if and .Values.volume.containerSecurityContext.enabled .Values.volume.containerSecurityContext.readOnlyRootFilesystem }}
+          volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.volume.containerSecurityContext "" "") | nindent 12 }}
+          {{- end }}
+          {{- if .Values.volume.containerSecurityContext.enabled }}
+          securityContext: {{- omit .Values.volume.containerSecurityContext "enabled" | toYaml | nindent 12 }}
+          {{- end }}
+      {{- if and .Values.volume.containerSecurityContext.enabled .Values.volume.containerSecurityContext.readOnlyRootFilesystem }}
+      volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.volume.containerSecurityContext "" "" false) | nindent 8 }}
+      {{- end }}
+      {{- with coalesce .Values.volume.resizeHook.nodeSelector .Values.volume.nodeSelector }}
+      nodeSelector:
+        {{ tpl (printf "{{ $volumeName := \"volume\" }}%s" .) $ | indent 8 | trim }}
+      {{- end }}
 ---
 apiVersion: v1
 kind: ServiceAccount
diff --git a/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml b/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
index 625e182272..4f36c77913 100644
--- a/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
+++ b/k8s/charts/seaweedfs/templates/volume/volume-statefulset.yaml
@@ -73,6 +73,9 @@ spec:
       {{- if $volume.priorityClassName }}
       priorityClassName: {{ $volume.priorityClassName | quote }}
       {{- end }}
+      {{- if $volume.schedulerName }}
+      schedulerName: {{ $volume.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
       serviceAccountName: {{ $volume.serviceAccountName | default (include "seaweedfs.serviceAccountName" $) | quote }} # for deleting statefulset pods after migration
       {{- $initContainers_exists := include "seaweedfs.volume.initContainers_exists" $ -}}
@@ -101,6 +104,7 @@ spec:
                 fi
               done
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list $ $volume.containerSecurityContext "" "") | nindent 12 }}
             - name: idx
               mountPath: /idx
           {{- range $dir :=  $volume.dataDirs }}
@@ -221,6 +225,7 @@ spec:
                 {{ . }} \
                 {{- end }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list $ $volume.containerSecurityContext (tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName ($volume.extraVolumeMounts | default "")) $) (tpl ($volume.extraVolumes | default "") $)) | nindent 12 }}
             {{- range $dir := $volume.dataDirs }}
             {{- if not ( eq $dir.type "custom" ) }}
             - name: {{ $dir.name }}
@@ -303,6 +308,7 @@ spec:
       {{- include "seaweedfs.tplvalues.render" (dict "value" (printf "{{ $volumeName := \"%s\" }}%s" $volumeName $volume.sidecars) "context" $) | nindent 8 }}
       {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list $ $volume.containerSecurityContext (tpl (printf "{{ $volumeName := \"%s\" }}%s" $volumeName ($volume.extraVolumeMounts | default "")) $) (tpl ($volume.extraVolumes | default "") $) (and $initContainers_exists $volume.idx)) | nindent 8 }}
 
      {{- range $dir := $volume.dataDirs }}
 
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml b/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
index 1b9d80099d..7607b72287 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-deployment.yaml
@@ -64,6 +64,9 @@ spec:
       {{- if .Values.worker.priorityClassName }}
       priorityClassName: {{ .Values.worker.priorityClassName | quote }}
       {{- end }}
+      {{- if .Values.worker.schedulerName }}
+      schedulerName: {{ .Values.worker.schedulerName | quote }}
+      {{- end }}
       enableServiceLinks: false
       {{- if .Values.worker.serviceAccountName }}
       serviceAccountName: {{ .Values.worker.serviceAccountName | quote }}
@@ -141,6 +144,7 @@ spec:
               {{ $arg }}{{- if lt $index (sub (len $.Values.worker.extraArgs) 1) }} \{{ end }}
               {{- end }}
           volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.worker.containerSecurityContext (tpl (.Values.worker.extraVolumeMounts | default "") .) (tpl (.Values.worker.extraVolumes | default "") .)) | nindent 12 }}
             {{- if or (eq .Values.worker.data.type "hostPath") (eq .Values.worker.data.type "emptyDir") (eq .Values.worker.data.type "existingClaim") }}
             - name: worker-data
               mountPath: {{ .Values.worker.workingDir }}
@@ -220,10 +224,87 @@ spec:
           {{- if .Values.worker.containerSecurityContext.enabled }}
           securityContext: {{- omit .Values.worker.containerSecurityContext "enabled" | toYaml | nindent 12 }}
           {{- end }}
+        {{- if include "seaweedfs.worker.lanceNamespaceUrl" . }}
+        - name: worker-lance
+          image: {{ template "seaweedfs.worker.image" . }}
+          imagePullPolicy: {{ default "IfNotPresent" .Values.global.seaweedfs.imagePullPolicy }}
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            {{- /* the URL crosses a shell line; metacharacters must arrive as data, not syntax */}}
+            - name: LANCE_NAMESPACE_URL
+              value: {{ include "seaweedfs.worker.lanceNamespaceUrl" . | quote }}
+          command:
+            - "/bin/sh"
+            - "-ec"
+            - |
+              {{- /* the armv7/386 placeholder is empty; exec of it becomes the shell and exits 0 */}}
+              if [ ! -s /usr/bin/weed-worker ]; then
+                echo "the Rust worker is not available on this platform ($(uname -m)); it ships for amd64 and arm64" >&2
+                exit 1
+              fi
+              exec /usr/bin/weed-worker \
+              --id="$POD_NAME" \
+              {{- if .Values.worker.adminServer }}
+              --admin={{ .Values.worker.adminServer }} \
+              {{- else }}
+              --admin={{ template "seaweedfs.fullname" . }}-admin.{{ .Release.Namespace }}:{{ .Values.admin.port }}{{ if .Values.admin.grpcPort }}.{{ .Values.admin.grpcPort }}{{ end }} \
+              {{- end }}
+              --namespace="$LANCE_NAMESPACE_URL" \
+              {{- if .Values.global.seaweedfs.enableSecurity }}
+              --tls-ca=/usr/local/share/ca-certificates/ca/tls.crt \
+              --tls-cert=/usr/local/share/ca-certificates/worker/tls.crt \
+              --tls-key=/usr/local/share/ca-certificates/worker/tls.key \
+              {{- end }}
+              {{- if .Values.worker.lanceMetricsPort }}
+              --metrics-port={{ .Values.worker.lanceMetricsPort }} \
+              --metrics-ip=0.0.0.0 \
+              {{- end }}
+              --max-concurrency={{ .Values.worker.maxExecute }}
+          volumeMounts:
+            {{- include "seaweedfs.tmpDirVolumeMount" (list . .Values.worker.containerSecurityContext "" "") | nindent 12 }}
+            {{- if .Values.global.seaweedfs.enableSecurity }}
+            - name: ca-cert
+              readOnly: true
+              mountPath: /usr/local/share/ca-certificates/ca/
+            - name: worker-cert
+              readOnly: true
+              mountPath: /usr/local/share/ca-certificates/worker/
+            {{- end }}
+          {{- if .Values.worker.lanceMetricsPort }}
+          ports:
+            - containerPort: {{ .Values.worker.lanceMetricsPort }}
+              name: lance-metrics
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: lance-metrics
+            initialDelaySeconds: 30
+            periodSeconds: 60
+            successThreshold: 1
+            failureThreshold: 5
+            timeoutSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: lance-metrics
+            initialDelaySeconds: 20
+            periodSeconds: 15
+            successThreshold: 1
+            failureThreshold: 3
+            timeoutSeconds: 10
+          {{- end }}
+          {{- if .Values.worker.containerSecurityContext.enabled }}
+          securityContext: {{- omit .Values.worker.containerSecurityContext "enabled" | toYaml | nindent 12 }}
+          {{- end }}
+        {{- end }}
       {{- if .Values.worker.sidecars }}
       {{- include "seaweedfs.tplvalues.render" (dict "value" .Values.worker.sidecars "context" $) | nindent 8 }}
       {{- end }}
       volumes:
+        {{- include "seaweedfs.tmpDirVolume" (list . .Values.worker.containerSecurityContext (tpl (.Values.worker.extraVolumeMounts | default "") .) (tpl (.Values.worker.extraVolumes | default "") .) (ne (include "seaweedfs.worker.lanceNamespaceUrl" .) "")) | nindent 8 }}
         {{- if eq .Values.worker.data.type "hostPath" }}
         - name: worker-data
           hostPath:
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-service.yaml b/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
index d78e0cf781..6c0ae8b701 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-service.yaml
@@ -12,13 +12,22 @@ metadata:
     app.kubernetes.io/component: worker
 spec:
   clusterIP: None  # Headless service
-  {{- if .Values.worker.metricsPort }}
+  {{- $lanceMetrics := and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
+  {{- if or .Values.worker.metricsPort $lanceMetrics }}
   ports:
+  {{- if .Values.worker.metricsPort }}
   - name: "metrics"
     port: {{ .Values.worker.metricsPort }}
     targetPort: {{ .Values.worker.metricsPort }}
     protocol: TCP
   {{- end }}
+  {{- if $lanceMetrics }}
+  - name: "lance-metrics"
+    port: {{ .Values.worker.lanceMetricsPort }}
+    targetPort: {{ .Values.worker.lanceMetricsPort }}
+    protocol: TCP
+  {{- end }}
+  {{- end }}
   selector:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
     app.kubernetes.io/instance: {{ .Release.Name }}
diff --git a/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml b/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
index 8ec4be8705..50cb04f486 100644
--- a/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
+++ b/k8s/charts/seaweedfs/templates/worker/worker-servicemonitor.yaml
@@ -1,6 +1,7 @@
 {{- include "seaweedfs.compat" . -}}
 {{- if .Values.worker.enabled }}
-{{- if .Values.worker.metricsPort }}
+{{- $lanceMetrics := and .Values.worker.lanceMetricsPort (include "seaweedfs.worker.lanceNamespaceUrl" .) }}
+{{- if or .Values.worker.metricsPort $lanceMetrics }}
 {{- if .Values.global.seaweedfs.monitoring.enabled }}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
@@ -22,9 +23,16 @@ metadata:
 {{- end }}
 spec:
   endpoints:
+    {{- if .Values.worker.metricsPort }}
     - interval: 30s
       port: metrics
       scrapeTimeout: 5s
+    {{- end }}
+    {{- if $lanceMetrics }}
+    - interval: 30s
+      port: lance-metrics
+      scrapeTimeout: 5s
+    {{- end }}
   selector:
     matchLabels:
       app.kubernetes.io/name: {{ template "seaweedfs.name" . }}
diff --git a/k8s/charts/seaweedfs/values.yaml b/k8s/charts/seaweedfs/values.yaml
index 417702326f..6c6b8673db 100644
--- a/k8s/charts/seaweedfs/values.yaml
+++ b/k8s/charts/seaweedfs/values.yaml
@@ -25,6 +25,9 @@ global:
     imagePullPolicy: IfNotPresent
     restartPolicy: Always
     loggingLevel: 1
+    # Writable temporary storage used when containers run with a read-only root filesystem.
+    tmpDir:
+      sizeLimit: ""
     enableSecurity: false
     masterServer: null
     # filerWrite: true mounts security.toml on filer + admin without needing
@@ -55,7 +58,7 @@ global:
       gatewayHost: null
       gatewayPort: null
       additionalLabels: {}
-    # if enabled will use global.seaweedfs.replicationPlacement and override master & filer defaultReplicaPlacement config
+    # if enabled will use global.seaweedfs.replicationPlacement and override master.defaultReplication & filer.defaultReplicaPlacement config
     enableReplication: false
     #  replication type is XYZ:
     # X number of replica in other data centers
@@ -190,6 +193,8 @@ master:
   podLabels: {}
 
   # Annotations to be added to the master pods
+  # The chart sets checksum/master-config on master pods; other checksum/* keys
+  # can be used for custom rollouts.
   podAnnotations: {}
 
   # Annotations to be added to the master resources
@@ -242,6 +247,10 @@ master:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
+  # used to specify a custom scheduler for master pods
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
+  schedulerName: ""
+
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -254,6 +263,8 @@ master:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -262,7 +273,16 @@ master:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
   #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   ingress:
@@ -272,6 +292,7 @@ master:
     host: "master.seaweedfs.local"
     path: "/sw-master/?(.*)"
     pathType: ImplementationSpecific
+    labels: {}
     annotations: {}
       # nginx.ingress.kubernetes.io/auth-type: "basic"
       # nginx.ingress.kubernetes.io/auth-secret: "default/ingress-basic-auth-secret"
@@ -290,6 +311,24 @@ master:
       #   sub_filter_once off;
     tls: []
 
+  # Gateway API HTTPRoute, an alternative to the ingress above.
+  httpRoute:
+    enabled: false
+    labels: {}
+    annotations: {}
+    # Gateways this route attaches to, for example:
+    #   - group: gateway.networking.k8s.io
+    #     kind: Gateway
+    #     name: my-gateway
+    #     namespace: gateway-system
+    #     sectionName: https
+    parentRefs: []
+    hostnames: []
+    # Each rule may set matches, filters, timeouts and backendRefs.
+    # A rule without backendRefs routes to the master service.
+    # An empty list routes all traffic there.
+    rules: []
+
   extraEnvironmentVars:
     WEED_MASTER_VOLUME_GROWTH_COPY_1: "7"
     WEED_MASTER_VOLUME_GROWTH_COPY_2: "6"
@@ -398,6 +437,10 @@ volume:
   resizeHook:
     enabled: true
     image: alpine/k8s:1.28.4
+    # nodeSelector and tolerations fall back to the volume server's when unset
+    nodeSelector: ""
+    tolerations: ""
+    affinity: ""
 
   # idx (the volume index) may use a separate PERSISTENT volume:
   #
@@ -535,6 +578,10 @@ volume:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
+  # used to specify a custom scheduler for volume pods
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
+  schedulerName: ""
+
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -549,6 +596,8 @@ volume:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -557,7 +606,16 @@ volume:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
   #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   # used to configure livenessProbe on volume-server containers
@@ -592,6 +650,7 @@ volume:
     host: "volume.seaweedfs.local"
     path: "/"
     pathType: Prefix
+    labels: {}
     annotations:
       nginx.ingress.kubernetes.io/app-root: /ui/index.html
       # nginx.ingress.kubernetes.io/use-regex: "true"
@@ -610,6 +669,24 @@ volume:
       #   sub_filter '/seaweedfsstatic' './seaweedfsstatic';
       #   sub_filter_once off;
 
+  # Gateway API HTTPRoute, an alternative to the ingress above.
+  httpRoute:
+    enabled: false
+    labels: {}
+    annotations: {}
+    # Gateways this route attaches to, for example:
+    #   - group: gateway.networking.k8s.io
+    #     kind: Gateway
+    #     name: my-gateway
+    #     namespace: gateway-system
+    #     sectionName: https
+    parentRefs: []
+    hostnames: []
+    # Each rule may set matches, filters, timeouts and backendRefs.
+    # A rule without backendRefs routes to the volume server service.
+    # An empty list routes all traffic there.
+    rules: []
+
 # Map of named volume groups for topology-aware deployments.
 # Each key inherits all fields from the `volume` section but can override
 # them locally—for example, replicas, nodeSelector, dataCenter, etc.
@@ -763,6 +840,8 @@ filer:
   podLabels: {}
 
   # Annotations to be added to the filer pods
+  # The chart sets checksum/s3config on filer pods; other checksum/* keys can be
+  # used for custom rollouts.
   podAnnotations: {}
 
   # Annotations to be added to the filer resource
@@ -815,6 +894,10 @@ filer:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
+  # used to specify a custom scheduler for filer pods
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/
+  schedulerName: ""
+
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -827,6 +910,8 @@ filer:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -835,7 +920,16 @@ filer:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
   #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   ingresses:
@@ -846,6 +940,7 @@ filer:
       host: "seaweedfs.cluster.local"
       path: "/sw-filer/?(.*)"
       pathType: ImplementationSpecific
+      labels: {}
       annotations: {}
         # nginx.ingress.kubernetes.io/backend-protocol: GRPC
         # nginx.ingress.kubernetes.io/auth-type: "basic"
@@ -872,6 +967,7 @@ filer:
       # whole host, not the HTTP UI's regex path.
       path: "/"
       pathType: Prefix
+      labels: {}
       annotations:
         # Ingress terminates TLS and re-originates gRPC (HTTP/2) to the filer.
         nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
@@ -883,8 +979,27 @@ filer:
         # requires ingress-nginx to run with --enable-ssl-passthrough.
       tls: []
 
+  # Gateway API HTTPRoute, an alternative to the ingress above.
+  httpRoute:
+    enabled: false
+    labels: {}
+    annotations: {}
+    # Gateways this route attaches to, for example:
+    #   - group: gateway.networking.k8s.io
+    #     kind: Gateway
+    #     name: my-gateway
+    #     namespace: gateway-system
+    #     sectionName: https
+    parentRefs: []
+    hostnames: []
+    # Each rule may set matches, filters, timeouts and backendRefs.
+    # A rule without backendRefs routes to the filer service.
+    # An empty list routes all traffic there.
+    rules: []
+
   # extraEnvVars is a list of extra environment variables to set with the stateful set.
   extraEnvironmentVars:
+    # the WEED_MYSQL_* keys and the db credential secret only render while this is "true"
     WEED_MYSQL_ENABLED: "false"
     WEED_MYSQL_HOSTNAME: "mysql-db-host"
     WEED_MYSQL_PORT: "3306"
@@ -972,12 +1087,27 @@ filer:
     #     anonymousRead: false
     createBucketsHook:
       resources: {}
+      # nodeSelector and tolerations fall back to filer's when unset
+      nodeSelector: ""
+      tolerations: ""
+      affinity: ""
 
 s3:
   enabled: false
   imageOverride: null
   restartPolicy: null
   replicas: 1
+  # Deployment update strategy, rendered as the Deployment's strategy
+  # ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
+  # Example:
+  # updateStrategy:
+  #   type: RollingUpdate
+  #   rollingUpdate:
+  #     maxUnavailable: 0
+  #     maxSurge: 25%
+  updateStrategy: {}
+  # Time the s3 pod is given to shut down, including any preStop hook
+  terminationGracePeriodSeconds: 10
   bindAddress: 0.0.0.0
   port: 8333
   # add additional https port
@@ -993,6 +1123,9 @@ s3:
   # Iceberg catalog REST port (Apache Iceberg REST Catalog API)
   # Set to a port number to enable, or 0/null to disable
   icebergPort: null
+  # Lance Namespace port; weed serves 9101 by default, 0 disables it
+  # (and, unless worker.namespaceUrl points elsewhere, the worker's Lance container)
+  lancePort: 9101
   loggingOverrideLevel: null
   # enable user & permission to s3 (need to inject to all services)
   enableAuth: false
@@ -1002,13 +1135,24 @@ s3:
   # Optionally provide explicit credentials for the S3 gateway.
   # When set, these are used in the generated s3 secret instead of
   # auto-generating random credentials.
+  # An identity may instead name an existing Secret to read its keys from. The
+  # generated config then references the keys through environment variables, so
+  # nothing is looked up at render time and a dry run renders what an install
+  # applies. Note the COSI driver parses the config itself and does not resolve
+  # those references.
   # credentials:
   #   admin:
   #     accessKey: ""
   #     secretKey: ""
+  #     existingSecret: ""
+  #     accessKeyKey: admin_access_key_id
+  #     secretKeyKey: admin_secret_access_key
   #   read:
   #     accessKey: ""
   #     secretKey: ""
+  #     existingSecret: ""
+  #     accessKeyKey: read_access_key_id
+  #     secretKeyKey: read_secret_access_key
   auditLogConfig: {}
   # You may specify buckets to be created during the install or upgrade process.
   # Buckets may be exposed publicly by setting `anonymousRead` to `true`
@@ -1047,6 +1191,8 @@ s3:
   podLabels: {}
 
   # Annotations to be added to the s3 pods
+  # The chart sets checksum/s3config on s3 pods; other checksum/* keys can be
+  # used for custom rollouts.
   podAnnotations: {}
 
   # Annotations to be added to the s3 resources
@@ -1074,6 +1220,10 @@ s3:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
+  # used to assign a custom scheduler to server pods
+  # ref: https://kubernetes.io/docs/tasks/extend-kubernetes/configure-multiple-schedulers/
+  schedulerName: ""
+
   # used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -1086,6 +1236,8 @@ s3:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -1094,7 +1246,16 @@ s3:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
   #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   # You can also use emptyDir storage:
@@ -1139,8 +1300,23 @@ s3:
     failureThreshold: 100
     timeoutSeconds: 10
 
+  # Lifecycle hooks for the s3 container. A preStop sleep lets the pod leave
+  # the Service endpoints before it receives SIGTERM; keep it shorter than
+  # terminationGracePeriodSeconds.
+  # ref: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
+  # Example:
+  # lifecycle:
+  #   preStop:
+  #     exec:
+  #       command: ["sleep", "5"]
+  lifecycle: {}
+
   createBucketsHook:
     resources: {}
+    # nodeSelector and tolerations fall back to filer's when unset
+    nodeSelector: ""
+    tolerations: ""
+    affinity: ""
 
   ingress:
     enabled: false
@@ -1149,18 +1325,42 @@ s3:
     host: "seaweedfs.cluster.local"
     path: "/"
     pathType: Prefix
+    labels: {}
     # additional ingress annotations for the s3 endpoint
     annotations: {}
     tls: []
 
+  # Gateway API HTTPRoute, an alternative to the ingress above.
+  httpRoute:
+    enabled: false
+    labels: {}
+    annotations: {}
+    # Gateways this route attaches to, for example:
+    #   - group: gateway.networking.k8s.io
+    #     kind: Gateway
+    #     name: my-gateway
+    #     namespace: gateway-system
+    #     sectionName: https
+    parentRefs: []
+    hostnames: []
+    # Each rule may set matches, filters, timeouts and backendRefs.
+    # A rule without backendRefs routes to the s3 service.
+    # An empty list routes all traffic there.
+    rules: []
+
   # Service settings
   service:
     type: ClusterIP
+    # used only when type is LoadBalancer
+    loadBalancerClass: ""
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       http: null
       https: null
       iceberg: null
+      lance: null
       metrics: null
 
   icebergIngress:
@@ -1169,6 +1369,17 @@ s3:
     host: "seaweedfs-iceberg.cluster.local"
     path: "/"
     pathType: Prefix
+    labels: {}
+    annotations: {}
+    tls: []
+
+  lanceIngress:
+    enabled: false
+    className: ""
+    host: "seaweedfs-lance.cluster.local"
+    path: "/"
+    pathType: Prefix
+    labels: {}
     annotations: {}
     tls: []
 
@@ -1227,8 +1438,35 @@ sftp:
   tolerations: ""
   nodeSelector: ""
   priorityClassName: ""
+  schedulerName: ""
   serviceAccountName: ""
+  # Configure security context for Pod
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # podSecurityContext:
+  #   enabled: true
+  #   runAsUser: 1000
+  #   runAsGroup: 3000
+  #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
+  # Configure security context for Container
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # containerSecurityContext:
+  #   enabled: true
+  #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
+  #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   logs:
@@ -1259,6 +1497,10 @@ sftp:
   # Service settings
   service:
     type: ClusterIP
+    # used only when type is LoadBalancer
+    loadBalancerClass: ""
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       sftp: null
@@ -1269,10 +1511,34 @@ admin:
   imageOverride: null
   restartPolicy: null
   replicas: 1
-  port: 23646  # Default admin port
-  grpcPort: 33646  # Default gRPC port for worker connections
+  port: 12535  # Default admin port
+  grpcPort: 22535  # Default gRPC port for worker connections
+  # Legacy compat port: admin also serves HTTP and worker gRPC (legacyPort +
+  # 10000) on this port so workers and clients from before the 23646 -> 12535
+  # default change keep connecting during migration. 0 disables. The flag is
+  # only passed to the binary when the value differs from its 23646 default,
+  # so the chart keeps installing on releases that predate -port.legacy.
+  legacyPort: 23646
+  # IP address the admin server listens on. Since `weed admin` 4.46 defaults to
+  # loopback (127.0.0.1), the chart must bind a non-loopback address for the
+  # kubelet's httpGet readiness/liveness probes (which dial the pod IP) to ever
+  # succeed. "0.0.0.0" restores the pre-4.46 behaviour of listening on all
+  # interfaces. A non-loopback address requires authentication: set
+  # admin.secret.adminPassword or admin.secret.existingSecret, supply
+  # WEED_ADMIN_PASSWORD via admin.extraEnvironmentVars /
+  # admin.secretExtraEnvironmentVars, or opt out with admin.allowInsecureBind;
+  # otherwise the admin container will exit with a clear error rather than
+  # silently staying unready. The whole
+  # 127.0.0.0/8 range and ::1 are treated as loopback (matching weed admin).
+  # Set to a loopback address only if you also replace the httpGet probes.
+  # Note: the -ip flag requires SeaweedFS 4.46 or newer; pinning
+  # admin.imageOverride to an older image is not supported with this chart.
+  ip: "0.0.0.0"
   loggingOverrideLevel: null
 
+  # INSECURE: allow binding a non-loopback ip without authentication.
+  allowInsecureBind: false
+
   # Admin authentication
   secret:
     # Name of an existing secret containing admin credentials. If set, adminUser and adminPassword below are ignored.
@@ -1351,8 +1617,35 @@ admin:
   tolerations: ""
   nodeSelector: ""
   priorityClassName: ""
+  schedulerName: ""
   serviceAccountName: ""
+  # Configure security context for Pod
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # podSecurityContext:
+  #   enabled: true
+  #   runAsUser: 1000
+  #   runAsGroup: 3000
+  #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
+  # Configure security context for Container
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # containerSecurityContext:
+  #   enabled: true
+  #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
+  #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   extraEnvironmentVars: {}
@@ -1394,12 +1687,35 @@ admin:
     host: "admin.seaweedfs.local"
     path: "/"
     pathType: Prefix
+    labels: {}
     annotations: {}
     tls: []
 
+  # Gateway API HTTPRoute, an alternative to the ingress above.
+  httpRoute:
+    enabled: false
+    labels: {}
+    annotations: {}
+    # Gateways this route attaches to, for example:
+    #   - group: gateway.networking.k8s.io
+    #     kind: Gateway
+    #     name: my-gateway
+    #     namespace: gateway-system
+    #     sectionName: https
+    parentRefs: []
+    hostnames: []
+    # Each rule may set matches, filters, timeouts and backendRefs.
+    # A rule without backendRefs routes to the admin service.
+    # An empty list routes all traffic there.
+    rules: []
+
   service:
     type: ClusterIP
     annotations: {}
+    # used only when type is LoadBalancer
+    loadBalancerClass: ""
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       http: null
@@ -1418,6 +1734,15 @@ worker:
   metricsPort: 9327
   metricsIp: ""  # If empty, defaults to 0.0.0.0
 
+  # The lance_* jobs run in their own container, /usr/bin/weed-worker.
+  # amd64/arm64 only; pin mixed clusters with worker.affinity/nodeSelector.
+
+  # Lance namespace URL override; empty derives it from s3.lancePort.
+  namespaceUrl: ""
+
+  # Metrics port for the Lance worker container; the Go worker keeps metricsPort
+  lanceMetricsPort: 9328
+
   # Admin server to connect to
   adminServer: ""
 
@@ -1493,8 +1818,35 @@ worker:
   tolerations: ""
   nodeSelector: ""
   priorityClassName: ""
+  schedulerName: ""
   serviceAccountName: ""
+  # Configure security context for Pod
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # podSecurityContext:
+  #   enabled: true
+  #   runAsUser: 1000
+  #   runAsGroup: 3000
+  #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
+  # Configure security context for Container
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # containerSecurityContext:
+  #   enabled: true
+  #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
+  #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   extraEnvironmentVars: {}
@@ -1593,6 +1945,10 @@ allInOne:
     #     anonymousRead: false
     createBucketsHook:
       resources: {}
+      # nodeSelector and tolerations fall back to allInOne's when unset
+      nodeSelector: ""
+      tolerations: ""
+      affinity: ""
 
   # SFTP server configuration
   # Note: Most parameters below default to null, which means they inherit from
@@ -1623,6 +1979,10 @@ allInOne:
     annotations: {}  # Annotations for the service
     type: ClusterIP  # Service type (ClusterIP, NodePort, LoadBalancer)
     internalTrafficPolicy: Cluster  # Internal traffic policy
+    # used only when type is LoadBalancer
+    loadBalancerClass: ""
+    loadBalancerIP: ""
+    loadBalancerSourceRanges: []
     # fixed nodePorts, used only when type is NodePort or LoadBalancer
     nodePorts:
       master: null
@@ -1697,6 +2057,8 @@ allInOne:
   initContainers: ""  # Init containers
   sidecars: ""  # Sidecar containers
   annotations: {}  # Annotations for the deployment
+  # The chart sets checksum/master-config and checksum/s3config on all-in-one
+  # pods; other checksum/* keys can be used for custom rollouts.
   podAnnotations: {}  # Annotations for the pods
   podLabels: {}  # Labels for the pods
 
@@ -1732,6 +2094,10 @@ allInOne:
   # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
   priorityClassName: ""
 
+  # Used to assign a custom scheduler to pods
+  # ref: https://kubernetes.io/docs/tasks/extend-kubernetes/configure-multiple-schedulers/
+  schedulerName: ""
+
   # Used to assign a service account.
   # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
   serviceAccountName: ""
@@ -1744,6 +2110,8 @@ allInOne:
   #   runAsUser: 1000
   #   runAsGroup: 3000
   #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
 
   # Configure security context for Container
@@ -1752,7 +2120,16 @@ allInOne:
   # containerSecurityContext:
   #   enabled: true
   #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
   #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
   # Resource management
@@ -1791,9 +2168,39 @@ cosi:
   # should have a secret key called seaweedfs_s3_config with an inline json configure
   existingConfigSecret: null
 
+  # Configure security context for Pod
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # podSecurityContext:
+  #   enabled: true
+  #   runAsUser: 1000
+  #   runAsGroup: 3000
+  #   fsGroup: 2000
+  #   seccompProfile:
+  #     type: RuntimeDefault
   podSecurityContext: {}
+  # Configure security context for Container
+  # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+  # Example:
+  # containerSecurityContext:
+  #   enabled: true
+  #   runAsUser: 2000
+  #   runAsGroup: 3000
+  #   runAsNonRoot: true
+  #   privileged: false
+  #   allowPrivilegeEscalation: false
+  #   readOnlyRootFilesystem: true
+  #   capabilities:
+  #     drop:
+  #       - ALL
+  #   seccompProfile:
+  #     type: RuntimeDefault
   containerSecurityContext: {}
 
+  # used to assign a custom scheduler to cosi pods
+  # ref: https://kubernetes.io/docs/tasks/extend-kubernetes/configure-multiple-schedulers/
+  schedulerName: ""
+
   extraVolumes: ""
   extraVolumeMounts: ""
 
@@ -1823,6 +2230,9 @@ certificates:
 # Labels to be added to all the created pods
 podLabels: {}
 # Annotations to be added to all the created pods
+# The chart sets checksum/master-config and checksum/s3config on pods whose
+# rendered ConfigMaps or Secrets should trigger rollouts. Other checksum/* keys
+# can be used for custom rollout annotations.
 podAnnotations: {}
 
 networkPolicy:
diff --git a/note/icon.svg b/note/icon.svg
new file mode 100644
index 0000000000..e762647c83
--- /dev/null
+++ b/note/icon.svg
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg id="Ebene_2" data-name="Ebene 2" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 512 512">
+  <defs>
+    <style>
+      .cls-1 {
+        fill: url(#Unbenannter_Verlauf_20);
+      }
+
+      .cls-2 {
+        fill: url(#Unbenannter_Verlauf_32);
+      }
+
+      .cls-3 {
+        fill: url(#Unbenannter_Verlauf_42);
+      }
+
+      .cls-4 {
+        fill: #fff;
+      }
+
+      .cls-5 {
+        fill: url(#Unbenannter_Verlauf_12);
+      }
+
+      .cls-6 {
+        fill: url(#Unbenannter_Verlauf_28);
+      }
+    </style>
+    <linearGradient id="Unbenannter_Verlauf_12" data-name="Unbenannter Verlauf 12" x1="19.92" y1="19.92" x2="492.08" y2="492.08" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#0282e9"/>
+      <stop offset=".48" stop-color="#0162bf"/>
+      <stop offset=".87" stop-color="#01469b"/>
+    </linearGradient>
+    <linearGradient id="Unbenannter_Verlauf_42" data-name="Unbenannter Verlauf 42" x1="180.67" y1="151.78" x2="234.43" y2="384.66" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#23b5e6"/>
+      <stop offset=".41" stop-color="#138bcf"/>
+      <stop offset=".86" stop-color="#0158b3"/>
+    </linearGradient>
+    <linearGradient id="Unbenannter_Verlauf_28" data-name="Unbenannter Verlauf 28" x1="275.58" y1="46.33" x2="275.58" y2="466.33" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#9fecf6"/>
+      <stop offset=".49" stop-color="#62dff2"/>
+      <stop offset="1" stop-color="#0a6cb7"/>
+    </linearGradient>
+    <linearGradient id="Unbenannter_Verlauf_20" data-name="Unbenannter Verlauf 20" x1="124.99" y1="226.28" x2="235.06" y2="462.33" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#c9f9fd"/>
+      <stop offset=".29" stop-color="#9fe7f6"/>
+      <stop offset=".93" stop-color="#36bbe5"/>
+      <stop offset="1" stop-color="#2ab6e3"/>
+    </linearGradient>
+    <linearGradient id="Unbenannter_Verlauf_32" data-name="Unbenannter Verlauf 32" x1="358.38" y1="251.34" x2="277.45" y2="473.69" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#43cbee"/>
+      <stop offset=".42" stop-color="#29a1d6"/>
+      <stop offset="1" stop-color="#0161b2"/>
+    </linearGradient>
+  </defs>
+  <g id="seaweedfs">
+    <rect id="background" class="cls-5" width="512" height="512" rx="68" ry="68"/>
+    <circle class="cls-4" cx="366.58" cy="152.44" r="31.33"/>
+    <circle class="cls-4" cx="386.81" cy="223.33" r="18.67"/>
+    <circle class="cls-4" cx="383.69" cy="288" r="9.22"/>
+    <path class="cls-3" d="M177.81,152.44s22.5,8.02,30.17,28.02c7.67,20,3.83,61.31,9.5,81.98s19.33,29,21,45.67-1.67,76-1.67,76c0,0-24-31.89-29.5-64s-21.53-41.06-24.6-65.72c-3.07-24.67.77-32.61,2.1-54.61s-1.84-35.72-7-47.33Z"/>
+    <path class="cls-6" d="M288.58,46.33c-14.56,7.67-42.22,35.22-42.22,79.11s23.11,54.22,23.11,94.22-38.89,48.11-38.89,95.56,21.56,66,21.56,95.56-11.11,55.56-11.11,55.56c0,0,26.97-17.72,33.33-60s-6.89-54.44,7.22-81.78,39-48.22,39-92.89-36.78-89.22-40.89-108.44-2.33-43.22,8.89-76.89Z"/>
+    <path class="cls-1" d="M120.58,228.33s31.72,14.27,41.55,36.5c9.83,22.22,3.45,40.17,17.45,61.17s51,41,56,73.33-7.67,66.33-7.67,66.33c0,0-5.67-59-30.33-73.33s-46.33-35.67-54.33-59-1.33-50.67-5.33-69c-4-18.33-7.33-23.67-17.33-36Z"/>
+    <path class="cls-2" d="M352.25,249.11c-9,5.67-18.87,17.85-21.71,31.2s2.94,19.57-7.06,41.57-22.19,25.28-30.97,49.72.21,35.36-11.33,59.56-23.92,35.17-23.92,35.17c0,0,34.77-8.17,45.69-30.94s5.08-35.22,20.53-52.61,24.67-30.89,27.25-56.72-7.33-26.22,1.53-76.94Z"/>
+  </g>
+</svg>
\ No newline at end of file
diff --git a/note/star_history.svg b/note/star_history.svg
new file mode 100644
index 0000000000..064e5b443b
--- /dev/null
+++ b/note/star_history.svg
@@ -0,0 +1,2027 @@
+<?xml version="1.0" encoding="utf-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+  "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" width="720pt" height="432pt" viewBox="0 0 720 432" xmlns="http://www.w3.org/2000/svg" version="1.1">
+ <metadata>
+  <rdf:RDF xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cc="http://creativecommons.org/ns#" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+   <cc:Work>
+    <dc:type rdf:resource="http://purl.org/dc/dcmitype/StillImage"/>
+    <dc:date>2026-10-24T02:56:41.212930</dc:date>
+    <dc:format>image/svg+xml</dc:format>
+    <dc:creator>
+     <cc:Agent>
+      <dc:title>Matplotlib v3.11.2, https://matplotlib.org/</dc:title>
+     </cc:Agent>
+    </dc:creator>
+   </cc:Work>
+  </rdf:RDF>
+ </metadata>
+ <defs>
+  <style type="text/css">*{stroke-linejoin: round; stroke-linecap: butt}</style>
+ </defs>
+ <g id="figure_1">
+  <g id="patch_1">
+   <path d="M 0 432 
+L 720 432 
+L 720 0 
+L 0 0 
+z
+" style="fill: #ffffff"/>
+  </g>
+  <g id="axes_1">
+   <g id="patch_2">
+    <path d="M 62.261538 371.324361 
+L 709.2 371.324361 
+L 709.2 26.215385 
+L 62.261538 26.215385 
+z
+" style="fill: #ffffff"/>
+   </g>
+   <g id="matplotlib.axis_1">
+    <g id="xtick_1">
+     <g id="line2d_1">
+      <path d="M 65.922519 371.324361 
+L 65.922519 26.215385 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_2">
+      <defs>
+       <path id="mf606daae67" d="M 0 0 
+L 0 3.5 
+" style="stroke: #000000; stroke-width: 0.8"/>
+      </defs>
+      <g>
+       <use xlink:href="#mf606daae67" x="65.922519" y="371.324361" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_1">
+      <!-- 2014-01 -->
+      <g transform="translate(28.53637 405.795531) rotate(-30) scale(0.1 -0.1)">
+       <defs>
+        <path id="DejaVuSans-15" d="M 1228 531 
+L 3431 531 
+L 3431 0 
+L 469 0 
+L 469 531 
+Q 828 903 1448 1529 
+Q 2069 2156 2228 2338 
+Q 2531 2678 2651 2914 
+Q 2772 3150 2772 3378 
+Q 2772 3750 2511 3984 
+Q 2250 4219 1831 4219 
+Q 1534 4219 1204 4116 
+Q 875 4013 500 3803 
+L 500 4441 
+Q 881 4594 1212 4672 
+Q 1544 4750 1819 4750 
+Q 2544 4750 2975 4387 
+Q 3406 4025 3406 3419 
+Q 3406 3131 3298 2873 
+Q 3191 2616 2906 2266 
+Q 2828 2175 2409 1742 
+Q 1991 1309 1228 531 
+z
+" transform="scale(0.015625)"/>
+        <path id="DejaVuSans-13" d="M 2034 4250 
+Q 1547 4250 1301 3770 
+Q 1056 3291 1056 2328 
+Q 1056 1369 1301 889 
+Q 1547 409 2034 409 
+Q 2525 409 2770 889 
+Q 3016 1369 3016 2328 
+Q 3016 3291 2770 3770 
+Q 2525 4250 2034 4250 
+z
+M 2034 4750 
+Q 2819 4750 3233 4129 
+Q 3647 3509 3647 2328 
+Q 3647 1150 3233 529 
+Q 2819 -91 2034 -91 
+Q 1250 -91 836 529 
+Q 422 1150 422 2328 
+Q 422 3509 836 4129 
+Q 1250 4750 2034 4750 
+z
+" transform="scale(0.015625)"/>
+        <path id="DejaVuSans-14" d="M 794 531 
+L 1825 531 
+L 1825 4091 
+L 703 3866 
+L 703 4441 
+L 1819 4666 
+L 2450 4666 
+L 2450 531 
+L 3481 531 
+L 3481 0 
+L 794 0 
+L 794 531 
+z
+" transform="scale(0.015625)"/>
+        <path id="DejaVuSans-17" d="M 2419 4116 
+L 825 1625 
+L 2419 1625 
+L 2419 4116 
+z
+M 2253 4666 
+L 3047 4666 
+L 3047 1625 
+L 3713 1625 
+L 3713 1100 
+L 3047 1100 
+L 3047 0 
+L 2419 0 
+L 2419 1100 
+L 313 1100 
+L 313 1709 
+L 2253 4666 
+z
+" transform="scale(0.015625)"/>
+        <path id="DejaVuSans-10" d="M 313 2009 
+L 1997 2009 
+L 1997 1497 
+L 313 1497 
+L 313 2009 
+z
+" transform="scale(0.015625)"/>
+       </defs>
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-17" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-10" transform="translate(254.5 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(290.578125 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(354.203125 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="xtick_2">
+     <g id="line2d_3">
+      <path d="M 161.693963 371.324361 
+L 161.693963 26.215385 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_4">
+      <g>
+       <use xlink:href="#mf606daae67" x="161.693963" y="371.324361" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_2">
+      <!-- 2016-01 -->
+      <g transform="translate(124.307814 405.795531) rotate(-30) scale(0.1 -0.1)">
+       <defs>
+        <path id="DejaVuSans-19" d="M 2113 2584 
+Q 1688 2584 1439 2293 
+Q 1191 2003 1191 1497 
+Q 1191 994 1439 701 
+Q 1688 409 2113 409 
+Q 2538 409 2786 701 
+Q 3034 994 3034 1497 
+Q 3034 2003 2786 2293 
+Q 2538 2584 2113 2584 
+z
+M 3366 4563 
+L 3366 3988 
+Q 3128 4100 2886 4159 
+Q 2644 4219 2406 4219 
+Q 1781 4219 1451 3797 
+Q 1122 3375 1075 2522 
+Q 1259 2794 1537 2939 
+Q 1816 3084 2150 3084 
+Q 2853 3084 3261 2657 
+Q 3669 2231 3669 1497 
+Q 3669 778 3244 343 
+Q 2819 -91 2113 -91 
+Q 1303 -91 875 529 
+Q 447 1150 447 2328 
+Q 447 3434 972 4092 
+Q 1497 4750 2381 4750 
+Q 2619 4750 2861 4703 
+Q 3103 4656 3366 4563 
+z
+" transform="scale(0.015625)"/>
+       </defs>
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-19" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-10" transform="translate(254.5 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(290.578125 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(354.203125 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="xtick_3">
+     <g id="line2d_5">
+      <path d="M 257.596601 371.324361 
+L 257.596601 26.215385 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_6">
+      <g>
+       <use xlink:href="#mf606daae67" x="257.596601" y="371.324361" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_3">
+      <!-- 2018-01 -->
+      <g transform="translate(220.210452 405.795531) rotate(-30) scale(0.1 -0.1)">
+       <defs>
+        <path id="DejaVuSans-1b" d="M 2034 2216 
+Q 1584 2216 1326 1975 
+Q 1069 1734 1069 1313 
+Q 1069 891 1326 650 
+Q 1584 409 2034 409 
+Q 2484 409 2743 651 
+Q 3003 894 3003 1313 
+Q 3003 1734 2745 1975 
+Q 2488 2216 2034 2216 
+z
+M 1403 2484 
+Q 997 2584 770 2862 
+Q 544 3141 544 3541 
+Q 544 4100 942 4425 
+Q 1341 4750 2034 4750 
+Q 2731 4750 3128 4425 
+Q 3525 4100 3525 3541 
+Q 3525 3141 3298 2862 
+Q 3072 2584 2669 2484 
+Q 3125 2378 3379 2068 
+Q 3634 1759 3634 1313 
+Q 3634 634 3220 271 
+Q 2806 -91 2034 -91 
+Q 1263 -91 848 271 
+Q 434 634 434 1313 
+Q 434 1759 690 2068 
+Q 947 2378 1403 2484 
+z
+M 1172 3481 
+Q 1172 3119 1398 2916 
+Q 1625 2713 2034 2713 
+Q 2441 2713 2670 2916 
+Q 2900 3119 2900 3481 
+Q 2900 3844 2670 4047 
+Q 2441 4250 2034 4250 
+Q 1625 4250 1398 4047 
+Q 1172 3844 1172 3481 
+z
+" transform="scale(0.015625)"/>
+       </defs>
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-1b" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-10" transform="translate(254.5 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(290.578125 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(354.203125 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="xtick_4">
+     <g id="line2d_7">
+      <path d="M 353.368045 371.324361 
+L 353.368045 26.215385 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_8">
+      <g>
+       <use xlink:href="#mf606daae67" x="353.368045" y="371.324361" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_4">
+      <!-- 2020-01 -->
+      <g transform="translate(315.981896 405.795531) rotate(-30) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-15" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-10" transform="translate(254.5 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(290.578125 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(354.203125 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="xtick_5">
+     <g id="line2d_9">
+      <path d="M 449.270683 371.324361 
+L 449.270683 26.215385 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_10">
+      <g>
+       <use xlink:href="#mf606daae67" x="449.270683" y="371.324361" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_5">
+      <!-- 2022-01 -->
+      <g transform="translate(411.884534 405.795531) rotate(-30) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-15" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-15" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-10" transform="translate(254.5 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(290.578125 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(354.203125 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="xtick_6">
+     <g id="line2d_11">
+      <path d="M 545.042127 371.324361 
+L 545.042127 26.215385 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_12">
+      <g>
+       <use xlink:href="#mf606daae67" x="545.042127" y="371.324361" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_6">
+      <!-- 2024-01 -->
+      <g transform="translate(507.655978 405.795531) rotate(-30) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-15" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-17" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-10" transform="translate(254.5 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(290.578125 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(354.203125 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="xtick_7">
+     <g id="line2d_13">
+      <path d="M 640.944765 371.324361 
+L 640.944765 26.215385 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_14">
+      <g>
+       <use xlink:href="#mf606daae67" x="640.944765" y="371.324361" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_7">
+      <!-- 2026-01 -->
+      <g transform="translate(603.558616 405.795531) rotate(-30) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-15" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-19" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-10" transform="translate(254.5 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(290.578125 0)"/>
+       <use xlink:href="#DejaVuSans-14" transform="translate(354.203125 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="text_8">
+     <!-- Date -->
+     <g transform="translate(373.779988 419.473678) scale(0.1 -0.1)">
+      <defs>
+       <path id="DejaVuSans-27" d="M 1259 4147 
+L 1259 519 
+L 2022 519 
+Q 2988 519 3436 956 
+Q 3884 1394 3884 2338 
+Q 3884 3275 3436 3711 
+Q 2988 4147 2022 4147 
+L 1259 4147 
+z
+M 628 4666 
+L 1925 4666 
+Q 3281 4666 3915 4102 
+Q 4550 3538 4550 2338 
+Q 4550 1131 3912 565 
+Q 3275 0 1925 0 
+L 628 0 
+L 628 4666 
+z
+" transform="scale(0.015625)"/>
+       <path id="DejaVuSans-44" d="M 2194 1759 
+Q 1497 1759 1228 1600 
+Q 959 1441 959 1056 
+Q 959 750 1161 570 
+Q 1363 391 1709 391 
+Q 2188 391 2477 730 
+Q 2766 1069 2766 1631 
+L 2766 1759 
+L 2194 1759 
+z
+M 3341 1997 
+L 3341 0 
+L 2766 0 
+L 2766 531 
+Q 2569 213 2275 61 
+Q 1981 -91 1556 -91 
+Q 1019 -91 701 211 
+Q 384 513 384 1019 
+Q 384 1609 779 1909 
+Q 1175 2209 1959 2209 
+L 2766 2209 
+L 2766 2266 
+Q 2766 2663 2505 2880 
+Q 2244 3097 1772 3097 
+Q 1472 3097 1187 3025 
+Q 903 2953 641 2809 
+L 641 3341 
+Q 956 3463 1253 3523 
+Q 1550 3584 1831 3584 
+Q 2591 3584 2966 3190 
+Q 3341 2797 3341 1997 
+z
+" transform="scale(0.015625)"/>
+       <path id="DejaVuSans-57" d="M 1172 4494 
+L 1172 3500 
+L 2356 3500 
+L 2356 3053 
+L 1172 3053 
+L 1172 1153 
+Q 1172 725 1289 603 
+Q 1406 481 1766 481 
+L 2356 481 
+L 2356 0 
+L 1766 0 
+Q 1100 0 847 248 
+Q 594 497 594 1153 
+L 594 3053 
+L 172 3053 
+L 172 3500 
+L 594 3500 
+L 594 4494 
+L 1172 4494 
+z
+" transform="scale(0.015625)"/>
+       <path id="DejaVuSans-48" d="M 3597 1894 
+L 3597 1613 
+L 953 1613 
+Q 991 1019 1311 708 
+Q 1631 397 2203 397 
+Q 2534 397 2845 478 
+Q 3156 559 3463 722 
+L 3463 178 
+Q 3153 47 2828 -22 
+Q 2503 -91 2169 -91 
+Q 1331 -91 842 396 
+Q 353 884 353 1716 
+Q 353 2575 817 3079 
+Q 1281 3584 2069 3584 
+Q 2775 3584 3186 3129 
+Q 3597 2675 3597 1894 
+z
+M 3022 2063 
+Q 3016 2534 2758 2815 
+Q 2500 3097 2075 3097 
+Q 1594 3097 1305 2825 
+Q 1016 2553 972 2059 
+L 3022 2063 
+z
+" transform="scale(0.015625)"/>
+      </defs>
+      <use xlink:href="#DejaVuSans-27"/>
+      <use xlink:href="#DejaVuSans-44" transform="translate(77 0)"/>
+      <use xlink:href="#DejaVuSans-57" transform="translate(138.28125 0)"/>
+      <use xlink:href="#DejaVuSans-48" transform="translate(177.484375 0)"/>
+     </g>
+    </g>
+   </g>
+   <g id="matplotlib.axis_2">
+    <g id="ytick_1">
+     <g id="line2d_15">
+      <path d="M 62.261538 355.646376 
+L 709.2 355.646376 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_16">
+      <defs>
+       <path id="m414e6f122f" d="M 0 0 
+L -3.5 0 
+" style="stroke: #000000; stroke-width: 0.8"/>
+      </defs>
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="355.646376" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_9">
+      <!-- 0 -->
+      <g transform="translate(48.899038 359.445204) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-13"/>
+      </g>
+     </g>
+    </g>
+    <g id="ytick_2">
+     <g id="line2d_17">
+      <path d="M 62.261538 311.716913 
+L 709.2 311.716913 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_18">
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="311.716913" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_10">
+      <!-- 5000 -->
+      <g transform="translate(29.811538 315.515741) scale(0.1 -0.1)">
+       <defs>
+        <path id="DejaVuSans-18" d="M 691 4666 
+L 3169 4666 
+L 3169 4134 
+L 1269 4134 
+L 1269 2991 
+Q 1406 3038 1543 3061 
+Q 1681 3084 1819 3084 
+Q 2600 3084 3056 2656 
+Q 3513 2228 3513 1497 
+Q 3513 744 3044 326 
+Q 2575 -91 1722 -91 
+Q 1428 -91 1123 -41 
+Q 819 9 494 109 
+L 494 744 
+Q 775 591 1075 516 
+Q 1375 441 1709 441 
+Q 2250 441 2565 725 
+Q 2881 1009 2881 1497 
+Q 2881 1984 2565 2268 
+Q 2250 2553 1709 2553 
+Q 1456 2553 1204 2497 
+Q 953 2441 691 2322 
+L 691 4666 
+z
+" transform="scale(0.015625)"/>
+       </defs>
+       <use xlink:href="#DejaVuSans-18"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="ytick_3">
+     <g id="line2d_19">
+      <path d="M 62.261538 267.787451 
+L 709.2 267.787451 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_20">
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="267.787451" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_11">
+      <!-- 10000 -->
+      <g transform="translate(23.449038 271.586279) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-14"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(254.5 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="ytick_4">
+     <g id="line2d_21">
+      <path d="M 62.261538 223.857989 
+L 709.2 223.857989 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_22">
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="223.857989" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_12">
+      <!-- 15000 -->
+      <g transform="translate(23.449038 227.656817) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-14"/>
+       <use xlink:href="#DejaVuSans-18" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(254.5 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="ytick_5">
+     <g id="line2d_23">
+      <path d="M 62.261538 179.928527 
+L 709.2 179.928527 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_24">
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="179.928527" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_13">
+      <!-- 20000 -->
+      <g transform="translate(23.449038 183.727355) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(254.5 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="ytick_6">
+     <g id="line2d_25">
+      <path d="M 62.261538 135.999064 
+L 709.2 135.999064 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_26">
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="135.999064" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_14">
+      <!-- 25000 -->
+      <g transform="translate(23.449038 139.797893) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-15"/>
+       <use xlink:href="#DejaVuSans-18" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(254.5 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="ytick_7">
+     <g id="line2d_27">
+      <path d="M 62.261538 92.069602 
+L 709.2 92.069602 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_28">
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="92.069602" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_15">
+      <!-- 30000 -->
+      <g transform="translate(23.449038 95.86843) scale(0.1 -0.1)">
+       <defs>
+        <path id="DejaVuSans-16" d="M 2597 2516 
+Q 3050 2419 3304 2112 
+Q 3559 1806 3559 1356 
+Q 3559 666 3084 287 
+Q 2609 -91 1734 -91 
+Q 1441 -91 1130 -33 
+Q 819 25 488 141 
+L 488 750 
+Q 750 597 1062 519 
+Q 1375 441 1716 441 
+Q 2309 441 2620 675 
+Q 2931 909 2931 1356 
+Q 2931 1769 2642 2001 
+Q 2353 2234 1838 2234 
+L 1294 2234 
+L 1294 2753 
+L 1863 2753 
+Q 2328 2753 2575 2939 
+Q 2822 3125 2822 3475 
+Q 2822 3834 2567 4026 
+Q 2313 4219 1838 4219 
+Q 1578 4219 1281 4162 
+Q 984 4106 628 3988 
+L 628 4550 
+Q 988 4650 1302 4700 
+Q 1616 4750 1894 4750 
+Q 2613 4750 3031 4423 
+Q 3450 4097 3450 3541 
+Q 3450 3153 3228 2886 
+Q 3006 2619 2597 2516 
+z
+" transform="scale(0.015625)"/>
+       </defs>
+       <use xlink:href="#DejaVuSans-16"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(254.5 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="ytick_8">
+     <g id="line2d_29">
+      <path d="M 62.261538 48.14014 
+L 709.2 48.14014 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke-dasharray: 2.96,1.28; stroke-dashoffset: 0; stroke: #b0b0b0; stroke-opacity: 0.3; stroke-width: 0.8"/>
+     </g>
+     <g id="line2d_30">
+      <g>
+       <use xlink:href="#m414e6f122f" x="62.261538" y="48.14014" style="stroke: #000000; stroke-width: 0.8"/>
+      </g>
+     </g>
+     <g id="text_16">
+      <!-- 35000 -->
+      <g transform="translate(23.449038 51.938968) scale(0.1 -0.1)">
+       <use xlink:href="#DejaVuSans-16"/>
+       <use xlink:href="#DejaVuSans-18" transform="translate(63.625 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(127.25 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(190.875 0)"/>
+       <use xlink:href="#DejaVuSans-13" transform="translate(254.5 0)"/>
+      </g>
+     </g>
+    </g>
+    <g id="text_17">
+     <!-- Stars -->
+     <g transform="translate(17.046695 211.628467) rotate(-90) scale(0.1 -0.1)">
+      <defs>
+       <path id="DejaVuSans-36" d="M 3425 4513 
+L 3425 3897 
+Q 3066 4069 2747 4153 
+Q 2428 4238 2131 4238 
+Q 1616 4238 1336 4038 
+Q 1056 3838 1056 3469 
+Q 1056 3159 1242 3001 
+Q 1428 2844 1947 2747 
+L 2328 2669 
+Q 3034 2534 3370 2195 
+Q 3706 1856 3706 1288 
+Q 3706 609 3251 259 
+Q 2797 -91 1919 -91 
+Q 1588 -91 1214 -16 
+Q 841 59 441 206 
+L 441 856 
+Q 825 641 1194 531 
+Q 1563 422 1919 422 
+Q 2459 422 2753 634 
+Q 3047 847 3047 1241 
+Q 3047 1584 2836 1778 
+Q 2625 1972 2144 2069 
+L 1759 2144 
+Q 1053 2284 737 2584 
+Q 422 2884 422 3419 
+Q 422 4038 858 4394 
+Q 1294 4750 2059 4750 
+Q 2388 4750 2728 4690 
+Q 3069 4631 3425 4513 
+z
+" transform="scale(0.015625)"/>
+       <path id="DejaVuSans-55" d="M 2631 2963 
+Q 2534 3019 2420 3045 
+Q 2306 3072 2169 3072 
+Q 1681 3072 1420 2755 
+Q 1159 2438 1159 1844 
+L 1159 0 
+L 581 0 
+L 581 3500 
+L 1159 3500 
+L 1159 2956 
+Q 1341 3275 1631 3429 
+Q 1922 3584 2338 3584 
+Q 2397 3584 2469 3576 
+Q 2541 3569 2628 3553 
+L 2631 2963 
+z
+" transform="scale(0.015625)"/>
+       <path id="DejaVuSans-56" d="M 2834 3397 
+L 2834 2853 
+Q 2591 2978 2328 3040 
+Q 2066 3103 1784 3103 
+Q 1356 3103 1142 2972 
+Q 928 2841 928 2578 
+Q 928 2378 1081 2264 
+Q 1234 2150 1697 2047 
+L 1894 2003 
+Q 2506 1872 2764 1633 
+Q 3022 1394 3022 966 
+Q 3022 478 2636 193 
+Q 2250 -91 1575 -91 
+Q 1294 -91 989 -36 
+Q 684 19 347 128 
+L 347 722 
+Q 666 556 975 473 
+Q 1284 391 1588 391 
+Q 1994 391 2212 530 
+Q 2431 669 2431 922 
+Q 2431 1156 2273 1281 
+Q 2116 1406 1581 1522 
+L 1381 1569 
+Q 847 1681 609 1914 
+Q 372 2147 372 2553 
+Q 372 3047 722 3315 
+Q 1072 3584 1716 3584 
+Q 2034 3584 2315 3537 
+Q 2597 3491 2834 3397 
+z
+" transform="scale(0.015625)"/>
+      </defs>
+      <use xlink:href="#DejaVuSans-36"/>
+      <use xlink:href="#DejaVuSans-57" transform="translate(63.484375 0)"/>
+      <use xlink:href="#DejaVuSans-44" transform="translate(102.6875 0)"/>
+      <use xlink:href="#DejaVuSans-55" transform="translate(163.96875 0)"/>
+      <use xlink:href="#DejaVuSans-56" transform="translate(205.078125 0)"/>
+     </g>
+    </g>
+   </g>
+   <g id="line2d_31">
+    <path d="M 91.667832 355.63759 
+L 92.501711 355.523373 
+L 96.991197 355.303726 
+L 97.410962 355.25101 
+L 102.937757 355.057721 
+L 102.953022 355.048935 
+L 104.848631 354.873217 
+L 106.003386 354.706285 
+L 107.437254 354.556925 
+L 107.515476 354.530567 
+L 111.037976 354.26699 
+L 112.967437 354.135202 
+L 113.907414 354.003414 
+L 114.355043 353.766195 
+L 114.461635 353.634406 
+L 114.873389 353.47626 
+L 115.035415 353.441117 
+L 115.782915 353.353258 
+L 116.43428 353.230255 
+L 116.563766 352.553741 
+L 116.933369 351.771797 
+L 118.721572 351.560936 
+L 118.834695 351.455505 
+L 119.918443 351.297359 
+L 122.819638 350.972281 
+L 123.678528 350.858064 
+L 124.881538 350.71749 
+L 130.456615 350.190336 
+L 130.556367 350.128835 
+L 134.197203 349.496251 
+L 135.964214 349.346891 
+L 136.100231 349.320533 
+L 136.940143 349.144815 
+L 137.113031 348.969097 
+L 138.500779 348.810951 
+L 140.663794 348.494659 
+L 142.496586 348.362871 
+L 142.7796 348.169581 
+L 142.940941 345.059375 
+L 142.981794 344.690368 
+L 143.089016 344.145642 
+L 143.626551 343.688776 
+L 144.536776 343.223124 
+L 144.809601 343.056192 
+L 145.092076 342.915617 
+L 146.004591 342.713542 
+L 146.599385 342.616897 
+L 153.304701 341.632877 
+L 153.429414 341.325371 
+L 153.659653 341.21994 
+L 154.14338 341.079366 
+L 154.274423 341.035436 
+L 155.207021 340.886076 
+L 156.657248 340.613714 
+L 156.778177 340.543426 
+L 157.974318 340.27985 
+L 167.298383 338.830177 
+L 168.197859 338.61053 
+L 168.308396 338.584172 
+L 168.965897 338.46117 
+L 169.12153 338.346953 
+L 170.192255 338.197593 
+L 170.339571 338.171235 
+L 172.473652 337.907659 
+L 172.632381 337.881301 
+L 175.918009 337.143286 
+L 176.17899 336.906067 
+L 176.415777 336.774279 
+L 177.227933 336.624918 
+L 179.004851 336.414057 
+L 179.501803 336.29984 
+L 180.468594 336.124123 
+L 180.52387 336.097765 
+L 181.586607 335.939619 
+L 181.816864 335.886903 
+L 182.490432 335.711186 
+L 182.711305 335.65847 
+L 183.303712 335.500324 
+L 183.567733 335.430037 
+L 184.616794 335.298249 
+L 186.97637 334.938027 
+L 187.278134 334.850168 
+L 187.483017 334.815025 
+L 188.859895 334.665664 
+L 188.921757 334.639307 
+L 190.329162 334.437231 
+L 190.421061 334.419659 
+L 192.716577 334.024294 
+L 193.387979 333.866148 
+L 193.747402 333.725574 
+L 193.878384 333.655287 
+L 195.081443 333.523498 
+L 195.729557 333.374138 
+L 196.366123 333.24235 
+L 197.103232 333.136919 
+L 199.302956 332.732768 
+L 199.409812 332.671267 
+L 200.054467 332.530693 
+L 201.239003 332.196829 
+L 201.918304 332.06504 
+L 202.053181 332.029897 
+L 202.975633 331.898108 
+L 203.066482 331.880537 
+L 204.370636 331.643317 
+L 205.073297 331.4676 
+L 206.607615 331.151307 
+L 206.762348 331.116164 
+L 208.029856 330.922874 
+L 208.238301 330.843801 
+L 209.372627 330.597796 
+L 209.502428 330.580224 
+L 210.197737 330.422078 
+L 210.324693 327.461233 
+L 210.507189 326.468427 
+L 211.393908 325.739198 
+L 211.527832 325.616195 
+L 211.762671 325.343833 
+L 212.429508 325.124185 
+L 215.821587 324.377384 
+L 216.110398 324.333455 
+L 217.567196 323.982019 
+L 218.296326 323.771158 
+L 219.202628 323.59544 
+L 219.327263 323.542725 
+L 219.906868 323.393364 
+L 220.293158 323.270362 
+L 221.557302 322.813495 
+L 221.758924 322.743208 
+L 222.848411 322.453274 
+L 223.05804 322.400559 
+L 224.84822 322.084266 
+L 224.947212 321.890977 
+L 225.412648 321.759188 
+L 226.165882 321.618614 
+L 226.180733 321.601042 
+L 226.93378 321.451682 
+L 227.150487 321.355037 
+L 228.228326 321.170534 
+L 228.539218 321.073889 
+L 230.314233 320.79274 
+L 230.575307 320.731239 
+L 232.465664 320.423733 
+L 232.578036 320.406161 
+L 233.338883 320.274373 
+L 234.299327 320.063511 
+L 235.334548 319.931723 
+L 235.905956 319.870222 
+L 237.283621 319.641788 
+L 239.959854 319.158564 
+L 242.034809 318.930131 
+L 242.556963 318.780771 
+L 243.353306 318.657768 
+L 243.635279 318.411763 
+L 244.036941 318.279975 
+L 244.153912 318.244831 
+L 246.907383 317.787965 
+L 247.151411 317.726464 
+L 248.128358 317.594675 
+L 249.019697 317.436529 
+L 251.016126 317.146595 
+L 252.23721 316.883018 
+L 252.424192 316.812731 
+L 253.534101 316.575512 
+L 253.669872 316.522797 
+L 254.66292 316.391008 
+L 254.665584 316.382222 
+L 255.780315 316.232862 
+L 256.376882 316.048358 
+L 257.883647 315.881426 
+L 258.191475 315.740852 
+L 259.169303 315.547562 
+L 259.995825 315.345487 
+L 262.104788 314.906192 
+L 262.62759 314.765618 
+L 262.74052 314.721689 
+L 264.728373 314.449326 
+L 265.889386 314.317537 
+L 266.207212 314.212107 
+L 273.946857 312.736077 
+L 274.575843 312.604288 
+L 274.74172 312.551573 
+L 275.9324 312.331926 
+L 276.90318 312.103493 
+L 277.196056 311.998062 
+L 278.44853 311.743271 
+L 279.556695 311.585125 
+L 280.572807 311.435765 
+L 280.749603 311.365478 
+L 281.753217 311.154616 
+L 281.853029 311.110687 
+L 283.908586 310.732893 
+L 283.982784 310.715322 
+L 284.243952 310.592319 
+L 284.948992 310.407815 
+L 286.417999 310.16181 
+L 286.489114 310.144239 
+L 288.00724 309.722516 
+L 288.189127 309.617085 
+L 291.10938 308.958143 
+L 291.629838 308.791211 
+L 292.136842 308.641851 
+L 292.177797 308.606707 
+L 292.608969 308.483705 
+L 293.228799 308.176199 
+L 293.307618 307.543614 
+L 293.496853 305.022063 
+L 294.023012 303.475746 
+L 294.472671 302.983736 
+L 294.595438 302.728945 
+L 295.125536 302.105147 
+L 295.382593 301.964573 
+L 295.57492 301.797641 
+L 295.70747 301.674638 
+L 296.268496 301.525278 
+L 296.633157 301.340774 
+L 296.744104 301.296845 
+L 297.231352 301.165057 
+L 298.704743 300.664261 
+L 299.219674 300.532472 
+L 299.355966 300.479757 
+L 300.022288 300.321611 
+L 300.973933 300.137107 
+L 301.111922 300.075606 
+L 301.879901 299.891102 
+L 301.983557 299.847173 
+L 302.355606 299.706598 
+L 302.67215 299.223374 
+L 304.069436 298.661077 
+L 304.175863 298.599576 
+L 304.698605 298.467788 
+L 305.724057 298.046065 
+L 306.504582 297.826417 
+L 306.714914 297.685843 
+L 306.835973 297.597984 
+L 306.94422 297.545269 
+L 307.628551 297.281692 
+L 307.895854 297.167475 
+L 308.571863 296.982972 
+L 308.724113 296.903899 
+L 309.127521 296.728181 
+L 309.453927 296.534891 
+L 309.508702 296.490962 
+L 311.049977 296.253743 
+L 311.165907 296.218599 
+L 311.817305 296.051667 
+L 312.424426 295.858377 
+L 313.171451 295.629944 
+L 313.392608 295.542085 
+L 316.269141 294.619567 
+L 316.624787 294.470206 
+L 317.734543 294.022126 
+L 317.853359 293.986982 
+L 318.048321 293.934267 
+L 318.483517 293.802479 
+L 318.634246 293.705834 
+L 320.466471 292.950247 
+L 321.575561 292.53731 
+L 321.861235 292.405522 
+L 326.432299 290.850419 
+L 326.782851 290.709844 
+L 326.824262 290.674701 
+L 327.831394 290.46384 
+L 328.392401 290.314479 
+L 328.78727 290.165119 
+L 328.940823 290.086046 
+L 329.530214 289.840041 
+L 330.931062 289.356817 
+L 331.495999 289.198671 
+L 331.563688 289.110812 
+L 332.356256 288.970238 
+L 332.470814 288.79452 
+L 332.94137 288.539729 
+L 333.735094 288.10922 
+L 334.245808 287.968646 
+L 334.34436 287.907145 
+L 335.841545 287.379991 
+L 336.451263 287.151558 
+L 336.946618 286.967054 
+L 337.039675 286.931911 
+L 337.928883 286.747407 
+L 338.074251 286.721049 
+L 338.754824 286.562903 
+L 339.029562 286.492616 
+L 339.368077 286.3784 
+L 339.474808 286.255397 
+L 340.807146 285.851246 
+L 340.945304 285.816102 
+L 341.727413 285.640385 
+L 341.819783 285.614027 
+L 342.455256 285.482238 
+L 342.655846 285.39438 
+L 343.012463 285.262591 
+L 343.106894 285.086873 
+L 344.101113 284.726652 
+L 344.265261 284.638793 
+L 345.068156 284.419146 
+L 345.188001 284.375216 
+L 346.118621 284.181926 
+L 346.213498 284.155569 
+L 346.954048 283.962279 
+L 347.432134 283.804133 
+L 348.554949 283.566914 
+L 348.771353 283.496627 
+L 349.745116 283.162763 
+L 349.879265 283.110048 
+L 350.178859 282.960687 
+L 350.513714 282.820113 
+L 350.780918 282.705896 
+L 351.278539 282.538965 
+L 351.749336 282.205101 
+L 352.458009 281.994239 
+L 352.580842 281.932738 
+L 355.273094 281.054149 
+L 355.379158 280.96629 
+L 355.892089 280.81693 
+L 356.164096 280.746642 
+L 357.56748 280.544567 
+L 358.428008 280.386421 
+L 359.138782 280.210703 
+L 359.351579 280.175559 
+L 360.767931 279.83291 
+L 360.872354 279.797766 
+L 361.663462 279.595691 
+L 362.303918 279.455116 
+L 362.85983 279.253041 
+L 362.964679 279.200325 
+L 363.642756 279.059751 
+L 363.856106 278.927963 
+L 366.517666 278.084517 
+L 366.630125 278.031802 
+L 367.067829 277.86487 
+L 367.83211 277.495862 
+L 368.240262 277.337716 
+L 368.609319 277.17957 
+L 369.41945 276.968709 
+L 369.43169 276.951137 
+L 370.277282 276.784205 
+L 370.371063 276.740276 
+L 371.912081 276.371268 
+L 372.045762 276.318553 
+L 372.435661 276.134049 
+L 372.541374 276.081334 
+L 374.288898 275.466321 
+L 374.892752 275.290603 
+L 375.063304 275.229102 
+L 376.369922 274.851309 
+L 376.513617 274.772236 
+L 376.875405 274.640447 
+L 377.269392 274.289012 
+L 378.20353 274.043007 
+L 378.312253 273.946362 
+L 378.951636 273.77943 
+L 379.449138 273.524639 
+L 380.038141 273.340135 
+L 380.341749 273.217133 
+L 380.851076 273.032629 
+L 382.524238 272.373687 
+L 383.218384 272.11011 
+L 383.838315 271.951964 
+L 384.035195 271.908035 
+L 384.605258 271.6181 
+L 384.667988 271.591743 
+L 385.22394 271.424811 
+L 386.047196 271.117304 
+L 386.810306 270.897657 
+L 386.819953 270.888871 
+L 387.397297 270.757083 
+L 387.524901 270.713153 
+L 388.106587 270.563793 
+L 389.59375 270.106927 
+L 390.218075 269.904851 
+L 390.304771 269.869708 
+L 390.430211 269.746705 
+L 390.664896 267.225154 
+L 390.832116 266.724358 
+L 390.997345 266.531068 
+L 391.22111 266.390494 
+L 391.547836 266.223562 
+L 391.864634 266.074202 
+L 392.01189 265.9512 
+L 393.594565 265.2659 
+L 393.700417 265.204399 
+L 394.776596 264.896892 
+L 395.500839 264.721175 
+L 396.442555 264.352167 
+L 396.553689 264.290666 
+L 399.076618 263.49115 
+L 399.180171 263.420863 
+L 400.927721 262.797064 
+L 401.270774 262.630132 
+L 404.778806 261.321034 
+L 405.261248 261.145316 
+L 405.492864 261.022314 
+L 407.73362 260.424873 
+L 407.930377 260.293085 
+L 408.462093 260.108581 
+L 408.844462 259.915291 
+L 409.195781 259.739574 
+L 410.701577 259.203634 
+L 411.400645 258.940057 
+L 411.569534 258.86977 
+L 412.066765 258.729196 
+L 412.265423 258.641337 
+L 412.995633 258.395332 
+L 413.196341 258.263544 
+L 413.858463 258.03511 
+L 413.949835 258.008753 
+L 414.182964 257.859393 
+L 414.89831 257.551886 
+L 415.748543 257.24438 
+L 415.898969 257.165307 
+L 416.293014 257.024733 
+L 416.912503 256.60301 
+L 417.012505 256.532723 
+L 418.889782 255.900139 
+L 419.05491 255.856209 
+L 419.530157 255.698063 
+L 419.716498 255.61899 
+L 420.339221 255.460844 
+L 420.719804 255.074265 
+L 421.273659 254.898547 
+L 421.818057 254.749187 
+L 422.329097 254.599827 
+L 422.806948 254.388965 
+L 422.926398 254.318678 
+L 423.65141 254.037529 
+L 424.114389 253.914527 
+L 424.323078 253.773953 
+L 425.084579 253.536734 
+L 425.317266 253.484018 
+L 430.49037 251.428119 
+L 430.616759 250.777963 
+L 430.78756 250.575888 
+L 431.917665 249.802729 
+L 432.514267 249.627011 
+L 433.846078 249.091072 
+L 434.229805 248.932926 
+L 435.618945 248.353057 
+L 436.310621 248.212483 
+L 436.371194 248.159767 
+L 436.714356 248.019193 
+L 437.811753 247.685329 
+L 438.363579 247.518397 
+L 438.741099 247.377823 
+L 438.863078 247.289964 
+L 439.926045 246.947314 
+L 440.11939 246.833098 
+L 440.513324 246.666166 
+L 440.65596 246.569521 
+L 441.371468 246.349874 
+L 441.623744 246.226871 
+L 441.876529 246.086297 
+L 442.146104 246.01601 
+L 442.508983 245.866649 
+L 442.935409 245.699717 
+L 443.511737 245.524 
+L 443.592349 245.48007 
+L 444.16765 245.295566 
+L 444.324388 245.172564 
+L 447.965164 243.134237 
+L 448.475064 242.545582 
+L 449.84419 241.921784 
+L 449.942813 241.746066 
+L 450.391549 241.491275 
+L 451.206399 241.060766 
+L 451.572139 240.90262 
+L 451.674391 240.841119 
+L 451.998756 240.647829 
+L 452.304598 240.516041 
+L 452.461911 240.445754 
+L 452.743531 240.287608 
+L 454.337336 239.707739 
+L 454.453719 239.57595 
+L 454.626861 239.435376 
+L 455.160059 239.233301 
+L 455.413621 239.057583 
+L 455.728928 238.925794 
+L 456.057649 238.776434 
+L 459.462911 237.344334 
+L 459.660137 237.212545 
+L 460.299775 237.01047 
+L 460.774164 236.852324 
+L 461.261513 236.650248 
+L 461.660874 236.51846 
+L 462.279943 236.351528 
+L 462.692303 236.079165 
+L 462.950332 235.736515 
+L 463.222181 235.569583 
+L 463.504846 235.429009 
+L 463.741859 235.279649 
+L 467.852014 233.460969 
+L 468.230571 233.311609 
+L 468.675163 233.109534 
+L 469.252973 232.933816 
+L 469.343699 232.854743 
+L 470.07161 232.58238 
+L 470.180794 232.529665 
+L 470.510538 232.353947 
+L 470.762555 232.257302 
+L 473.81554 231.079992 
+L 475.0485 230.605554 
+L 475.513561 230.447408 
+L 475.863997 230.298048 
+L 476.214553 230.157474 
+L 477.278428 229.445816 
+L 477.497523 229.296456 
+L 478.427075 228.778089 
+L 478.562045 228.628728 
+L 479.086627 228.435439 
+L 479.201387 228.365152 
+L 479.403401 228.233363 
+L 479.853918 228.013716 
+L 480.133602 227.802855 
+L 480.237658 227.758925 
+L 481.18435 227.31963 
+L 481.295608 227.249343 
+L 482.426635 226.616759 
+L 482.546311 226.5289 
+L 483.349109 226.010533 
+L 483.488093 225.88753 
+L 483.855929 225.43945 
+L 484.56713 225.123157 
+L 484.758521 225.000155 
+L 485.074485 224.868366 
+L 485.220878 224.815651 
+L 485.405538 224.683863 
+L 485.579617 224.481787 
+L 486.756359 223.893132 
+L 486.856834 223.831631 
+L 487.094 223.691057 
+L 487.32813 223.409908 
+L 487.681074 223.181475 
+L 488.176558 222.953042 
+L 489.351402 222.2941 
+L 489.498759 222.223813 
+L 490.69285 221.723017 
+L 491.023601 221.591229 
+L 491.629103 221.266151 
+L 491.912228 221.081647 
+L 493.560661 220.47542 
+L 493.673399 219.746191 
+L 494.051655 219.280539 
+L 494.422584 219.078463 
+L 495.208773 218.639169 
+L 495.716435 218.410736 
+L 495.907216 218.331663 
+L 496.40607 218.173516 
+L 496.512546 218.129587 
+L 497.156414 217.795723 
+L 497.457437 217.655149 
+L 497.623042 217.540932 
+L 500.031577 216.706272 
+L 501.116156 216.354837 
+L 501.230163 216.28455 
+L 502.220369 215.854041 
+L 502.368695 215.476247 
+L 502.846188 215.195099 
+L 502.972688 215.080882 
+L 503.564142 214.852449 
+L 503.749208 214.711875 
+L 504.126247 214.483442 
+L 504.871057 214.149578 
+L 505.113354 213.991432 
+L 505.211354 213.92993 
+L 505.62616 213.771784 
+L 505.747654 213.710283 
+L 506.012421 213.516993 
+L 506.245345 213.341276 
+L 506.762549 213.112842 
+L 508.715821 212.15518 
+L 509.06499 211.970676 
+L 509.162979 211.900389 
+L 509.227449 211.777387 
+L 509.399138 211.566525 
+L 510.066527 211.188732 
+L 513.146137 209.791775 
+L 513.53685 209.572128 
+L 513.699363 209.413982 
+L 514.117101 209.176763 
+L 514.164815 209.080118 
+L 514.66586 208.948329 
+L 514.769533 208.913186 
+L 515.248981 208.763826 
+L 517.715533 207.57773 
+L 517.928586 207.445942 
+L 518.049031 207.024219 
+L 518.433054 206.74307 
+L 519.034131 206.312562 
+L 519.258045 206.180773 
+L 519.411919 205.925982 
+L 519.660472 205.715121 
+L 519.817935 205.644834 
+L 520.127216 205.50426 
+L 520.416594 205.346113 
+L 520.985047 204.985892 
+L 521.359461 204.827746 
+L 521.464132 204.766245 
+L 521.729166 204.652028 
+L 522.379438 204.379665 
+L 522.437986 204.309378 
+L 522.773807 204.17759 
+L 523.310584 203.878869 
+L 523.67403 203.694366 
+L 524.167758 203.465932 
+L 524.259583 203.395645 
+L 524.849668 203.228713 
+L 524.960206 203.14964 
+L 525.261214 202.973923 
+L 525.450086 202.824562 
+L 525.81973 202.683988 
+L 525.933477 202.622487 
+L 527.657087 201.752683 
+L 528.060216 201.603323 
+L 528.529896 201.427605 
+L 529.045486 201.111313 
+L 530.152509 200.654447 
+L 530.552761 200.478729 
+L 530.914483 200.320583 
+L 530.964738 200.276654 
+L 531.48737 200.109722 
+L 531.595648 200.04822 
+L 532.331125 199.7495 
+L 532.450556 199.696785 
+L 532.713971 199.564996 
+L 533.43913 199.354135 
+L 533.537575 199.318991 
+L 534.075595 199.10813 
+L 534.26606 198.923626 
+L 534.631184 198.739122 
+L 534.786116 198.677621 
+L 535.036102 198.598548 
+L 535.374523 198.431616 
+L 535.486682 198.370115 
+L 535.926612 198.115324 
+L 536.332026 197.948392 
+L 537.143092 197.658458 
+L 537.61636 197.447596 
+L 537.705007 197.412453 
+L 538.169923 197.210377 
+L 538.364941 197.122518 
+L 538.794893 196.9468 
+L 539.66596 196.428433 
+L 539.806927 196.358146 
+L 540.620857 195.997924 
+L 540.912348 195.81342 
+L 542.218976 195.145692 
+L 542.587973 194.97876 
+L 542.781111 194.890901 
+L 543.767607 194.521894 
+L 544.001484 194.434035 
+L 544.347494 194.328604 
+L 544.628891 194.18803 
+L 544.739252 194.108957 
+L 545.488954 193.810237 
+L 545.604821 193.73995 
+L 545.747257 193.687234 
+L 546.126635 193.520302 
+L 546.275381 193.406086 
+L 546.535941 193.212796 
+L 547.520261 192.624141 
+L 547.62606 192.334207 
+L 548.440879 191.833411 
+L 548.748008 191.701623 
+L 548.858258 191.657693 
+L 549.321563 191.218398 
+L 549.423405 187.624968 
+L 549.584107 185.366994 
+L 549.671554 183.644959 
+L 549.838175 182.669725 
+L 549.899065 182.502793 
+L 550.292359 182.063498 
+L 550.634729 181.720849 
+L 550.834472 181.58906 
+L 550.965307 181.457272 
+L 551.163762 181.193695 
+L 551.379284 180.807116 
+L 551.730037 180.561111 
+L 552.166945 180.192103 
+L 552.52449 179.919741 
+L 552.790309 179.717665 
+L 555.576441 177.863842 
+L 555.867975 177.688124 
+L 556.375765 177.389404 
+L 556.82172 177.020396 
+L 557.32287 176.774391 
+L 557.431891 176.71289 
+L 560.042548 175.395006 
+L 560.153858 175.324719 
+L 560.294164 175.263218 
+L 561.080994 174.850281 
+L 561.555562 174.683349 
+L 561.840837 174.481273 
+L 562.016643 174.305555 
+L 562.444524 174.050765 
+L 563.214823 173.585112 
+L 563.512484 173.400609 
+L 564.527696 172.653808 
+L 564.756782 172.522019 
+L 564.997217 172.381445 
+L 565.619852 172.003652 
+L 565.814665 171.871863 
+L 566.337735 171.652216 
+L 566.794839 171.458926 
+L 567.524333 171.107491 
+L 567.871137 170.887843 
+L 568.256813 170.685768 
+L 568.498922 170.536408 
+L 568.980213 170.343118 
+L 569.099374 170.264045 
+L 569.806837 169.921395 
+L 570.023903 169.789607 
+L 570.291821 169.552388 
+L 570.441215 169.411813 
+L 570.586114 169.341526 
+L 571.129747 169.104307 
+L 571.450593 168.788015 
+L 571.548498 168.585939 
+L 571.715342 168.427793 
+L 571.826276 168.366292 
+L 572.096405 168.146645 
+L 572.772138 167.733708 
+L 572.904744 167.619491 
+L 573.58189 167.224126 
+L 573.861125 167.039622 
+L 573.99468 166.951763 
+L 574.308997 166.76726 
+L 576.103554 165.879885 
+L 576.431598 165.695381 
+L 576.805006 165.466948 
+L 577.242245 165.273658 
+L 577.404113 165.194585 
+L 578.568718 164.368711 
+L 578.71585 164.254495 
+L 579.304106 163.894273 
+L 579.430731 163.788842 
+L 579.759584 163.604338 
+L 580.276056 163.314404 
+L 580.394796 163.208973 
+L 580.679381 163.077185 
+L 580.797491 162.962968 
+L 580.923437 162.901467 
+L 581.882339 162.444601 
+L 581.999194 162.33917 
+L 585.12801 160.379916 
+L 585.258906 160.239342 
+L 585.790476 159.800047 
+L 585.98814 159.650687 
+L 587.277191 158.772098 
+L 587.439475 158.139513 
+L 587.640724 157.963796 
+L 587.979107 157.744148 
+L 588.291028 157.498143 
+L 588.401817 157.260924 
+L 588.912505 156.891917 
+L 589.043876 156.839201 
+L 590.083188 156.197831 
+L 590.347592 156.048471 
+L 590.452683 155.969398 
+L 590.9176 155.661892 
+L 591.32224 155.336814 
+L 592.047345 154.985378 
+L 592.280267 154.836018 
+L 592.478638 154.695444 
+L 592.626907 154.572441 
+L 592.97207 154.423081 
+L 593.109252 154.352794 
+L 593.40392 154.212219 
+L 593.513971 154.124361 
+L 593.734632 154.036502 
+L 594.181896 153.764139 
+L 594.417184 153.614779 
+L 595.066531 153.386346 
+L 595.268442 153.263343 
+L 595.865194 152.929479 
+L 596.287491 152.701046 
+L 597.219383 152.358396 
+L 597.399408 152.235394 
+L 598.607822 151.743384 
+L 598.792876 151.620381 
+L 599.302141 151.36559 
+L 599.414105 151.286517 
+L 599.610074 151.084442 
+L 599.693574 150.996583 
+L 599.94577 150.847223 
+L 600.062748 150.785721 
+L 600.48849 150.57486 
+L 601.045372 150.328855 
+L 601.215687 150.179495 
+L 601.509121 150.012563 
+L 601.609278 149.88956 
+L 601.898564 149.713843 
+L 602.086076 149.625984 
+L 602.71068 149.353621 
+L 606.252018 147.66673 
+L 606.593652 147.455868 
+L 606.991795 147.262579 
+L 607.194084 147.051717 
+L 608.11828 146.603637 
+L 608.416907 146.463062 
+L 608.579998 146.383989 
+L 609.1465 146.173128 
+L 609.467257 145.962266 
+L 609.860897 145.839264 
+L 610.533381 145.514186 
+L 610.696451 145.461471 
+L 612.146727 144.705884 
+L 612.480995 144.240232 
+L 612.641077 144.090871 
+L 613.167217 142.957491 
+L 613.349482 142.729058 
+L 613.44346 142.421552 
+L 613.685622 142.201904 
+L 613.802972 142.078902 
+L 614.097795 141.885612 
+L 614.579299 141.314529 
+L 614.890748 141.165169 
+L 615.065583 141.033381 
+L 616.495176 139.952716 
+L 616.80366 139.812142 
+L 617.04363 139.583709 
+L 617.231985 139.381633 
+L 617.334025 139.118056 
+L 617.410175 138.977482 
+L 617.539307 138.863265 
+L 617.706214 138.749049 
+L 617.905087 138.564545 
+L 618.016814 138.450328 
+L 618.208305 138.292182 
+L 618.499009 138.107679 
+L 618.67288 137.949533 
+L 619.098508 137.492666 
+L 619.439428 137.325734 
+L 619.574675 137.255447 
+L 620.024154 136.904011 
+L 620.134296 136.84251 
+L 620.24442 136.807366 
+L 620.518608 136.631649 
+L 620.633985 136.54379 
+L 622.10267 135.375266 
+L 622.371224 135.181976 
+L 622.621546 134.944757 
+L 623.096199 134.707538 
+L 623.268549 134.566964 
+L 623.523388 134.356103 
+L 625.554515 132.888858 
+L 625.707339 132.765856 
+L 626.101959 132.537423 
+L 626.947167 132.150844 
+L 627.39422 131.790622 
+L 627.775879 131.606118 
+L 627.94371 131.483116 
+L 628.64088 131.078965 
+L 628.75961 130.973534 
+L 629.115633 130.762672 
+L 629.350319 130.63967 
+L 629.664487 130.516668 
+L 629.86418 130.420023 
+L 630.076749 130.270663 
+L 630.203856 130.165232 
+L 631.617215 129.093353 
+L 631.736577 128.724345 
+L 631.964355 127.705182 
+L 632.100889 126.018291 
+L 632.789363 123.75153 
+L 632.929056 121.598987 
+L 633.505698 120.175672 
+L 633.63039 119.797879 
+L 634.129491 118.769929 
+L 634.457115 118.53271 
+L 635.029318 118.102201 
+L 635.176727 117.961627 
+L 635.306247 117.856196 
+L 635.458028 117.715622 
+L 636.316529 116.740388 
+L 636.441518 116.301094 
+L 636.496674 116.125376 
+L 636.618373 115.96723 
+L 636.843431 115.835441 
+L 637.246419 115.185285 
+L 637.459773 110.537548 
+L 637.494922 110.168541 
+L 637.610206 109.518385 
+L 637.866771 108.103856 
+L 638.026516 107.444914 
+L 638.10535 107.163765 
+L 638.24559 106.7684 
+L 638.615924 106.118244 
+L 638.73453 105.97767 
+L 638.85289 105.722879 
+L 639.037888 105.345086 
+L 639.281483 105.011222 
+L 639.469124 104.677358 
+L 639.813549 104.194134 
+L 640.960372 101.997661 
+L 641.172219 101.795585 
+L 641.385998 101.523222 
+L 641.576869 101.233288 
+L 641.680152 101.05757 
+L 641.87154 100.750064 
+L 645.299405 96.242901 
+L 645.435857 95.979324 
+L 645.540572 95.786035 
+L 645.714249 95.522458 
+L 646.058453 95.171022 
+L 646.245623 95.00409 
+L 646.358974 94.872302 
+L 646.638761 94.476937 
+L 646.958497 92.869118 
+L 647.099259 92.552826 
+L 647.333262 91.999315 
+L 647.442917 91.832383 
+L 647.607909 91.507305 
+L 647.879206 91.059225 
+L 648.013811 90.760504 
+L 648.10726 90.611144 
+L 648.219945 90.382711 
+L 648.677823 89.460192 
+L 648.811372 89.328404 
+L 649.174395 88.634318 
+L 649.315566 88.405885 
+L 649.543875 88.142308 
+L 649.800837 87.913875 
+L 649.955189 87.597583 
+L 650.081323 87.448223 
+L 650.696973 86.692636 
+L 650.840961 86.525704 
+L 650.953378 86.3412 
+L 651.175232 85.884334 
+L 651.526544 85.524112 
+L 652.096781 84.548878 
+L 653.205367 83.011347 
+L 653.470846 82.7917 
+L 654.367855 81.508959 
+L 655.70398 79.549705 
+L 655.965798 79.338844 
+L 656.085536 79.180698 
+L 656.325513 78.293323 
+L 656.545483 77.353232 
+L 657.448494 75.789343 
+L 657.533899 75.657555 
+L 657.645959 75.534553 
+L 658.995555 73.540155 
+L 659.344072 73.065717 
+L 660.304017 71.712689 
+L 660.525546 71.317324 
+L 661.083841 70.509022 
+L 661.247508 70.227874 
+L 661.976446 69.261425 
+L 662.175169 68.857274 
+L 662.406795 68.540982 
+L 664.650647 65.536207 
+L 664.736808 65.395633 
+L 664.835293 65.27263 
+L 664.990093 65.105698 
+L 665.112501 64.877265 
+L 665.256644 64.683975 
+L 665.391353 64.473114 
+L 665.714396 63.849316 
+L 665.842893 63.585739 
+L 665.952239 63.427593 
+L 666.712913 62.496288 
+L 666.874503 62.285427 
+L 667.058748 62.136067 
+L 667.229078 61.942777 
+L 668.078842 60.756681 
+L 668.185572 60.607321 
+L 668.669643 59.684803 
+L 668.811744 59.544228 
+L 668.965664 59.386082 
+L 669.083789 59.245508 
+L 669.231239 59.104934 
+L 669.789745 58.419634 
+L 669.922105 58.314203 
+L 670.060285 58.094556 
+L 670.282359 57.734334 
+L 670.399304 57.611332 
+L 670.728726 57.303826 
+L 670.983189 57.066607 
+L 671.193012 56.662456 
+L 671.326338 56.434022 
+L 671.459366 56.223161 
+L 671.828871 55.77508 
+L 674.722926 51.663283 
+L 674.851442 51.0922 
+L 675.800675 49.42288 
+L 675.930844 49.168089 
+L 676.032204 48.9748 
+L 676.204813 48.78151 
+L 676.547417 48.034709 
+L 676.604383 47.858991 
+L 676.740144 47.384553 
+L 677.285499 46.400533 
+L 677.376411 46.259959 
+L 677.494035 46.093027 
+L 677.861149 45.460443 
+L 678.039867 45.065078 
+L 678.347986 44.564282 
+L 678.552126 44.142559 
+L 678.757874 43.782337 
+L 679.428898 42.464453 
+L 679.613828 42.165733 
+L 679.793706 41.902156 
+L 679.793706 41.902156 
+" clip-path="url(#p16b1f4eee4)" style="fill: none; stroke: #0969da; stroke-width: 1.6; stroke-linecap: square"/>
+   </g>
+   <g id="patch_3">
+    <path d="M 62.261538 371.324361 
+L 62.261538 26.215385 
+" style="fill: none; stroke: #000000; stroke-width: 0.8; stroke-linejoin: miter; stroke-linecap: square"/>
+   </g>
+   <g id="patch_4">
+    <path d="M 709.2 371.324361 
+L 709.2 26.215385 
+" style="fill: none; stroke: #000000; stroke-width: 0.8; stroke-linejoin: miter; stroke-linecap: square"/>
+   </g>
+   <g id="patch_5">
+    <path d="M 62.261538 371.324361 
+L 709.2 371.324361 
+" style="fill: none; stroke: #000000; stroke-width: 0.8; stroke-linejoin: miter; stroke-linecap: square"/>
+   </g>
+   <g id="patch_6">
+    <path d="M 62.261538 26.215385 
+L 709.2 26.215385 
+" style="fill: none; stroke: #000000; stroke-width: 0.8; stroke-linejoin: miter; stroke-linecap: square"/>
+   </g>
+   <g id="text_18">
+    <!-- seaweedfs/seaweedfs star history -->
+    <g transform="translate(283.974519 20.215385) scale(0.12 -0.12)">
+     <defs>
+      <path id="DejaVuSans-5a" d="M 269 3500 
+L 844 3500 
+L 1563 769 
+L 2278 3500 
+L 2956 3500 
+L 3675 769 
+L 4391 3500 
+L 4966 3500 
+L 4050 0 
+L 3372 0 
+L 2619 2869 
+L 1863 0 
+L 1184 0 
+L 269 3500 
+z
+" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-47" d="M 2906 2969 
+L 2906 4863 
+L 3481 4863 
+L 3481 0 
+L 2906 0 
+L 2906 525 
+Q 2725 213 2448 61 
+Q 2172 -91 1784 -91 
+Q 1150 -91 751 415 
+Q 353 922 353 1747 
+Q 353 2572 751 3078 
+Q 1150 3584 1784 3584 
+Q 2172 3584 2448 3432 
+Q 2725 3281 2906 2969 
+z
+M 947 1747 
+Q 947 1113 1208 752 
+Q 1469 391 1925 391 
+Q 2381 391 2643 752 
+Q 2906 1113 2906 1747 
+Q 2906 2381 2643 2742 
+Q 2381 3103 1925 3103 
+Q 1469 3103 1208 2742 
+Q 947 2381 947 1747 
+z
+" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-49" d="M 2375 4863 
+L 2375 4384 
+L 1825 4384 
+Q 1516 4384 1395 4259 
+Q 1275 4134 1275 3809 
+L 1275 3500 
+L 2222 3500 
+L 2222 3053 
+L 1275 3053 
+L 1275 0 
+L 697 0 
+L 697 3053 
+L 147 3053 
+L 147 3500 
+L 697 3500 
+L 697 3744 
+Q 697 4328 969 4595 
+Q 1241 4863 1831 4863 
+L 2375 4863 
+z
+" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-12" d="M 1625 4666 
+L 2156 4666 
+L 531 -594 
+L 0 -594 
+L 1625 4666 
+z
+" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-3" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-4b" d="M 3513 2113 
+L 3513 0 
+L 2938 0 
+L 2938 2094 
+Q 2938 2591 2744 2837 
+Q 2550 3084 2163 3084 
+Q 1697 3084 1428 2787 
+Q 1159 2491 1159 1978 
+L 1159 0 
+L 581 0 
+L 581 4863 
+L 1159 4863 
+L 1159 2956 
+Q 1366 3272 1645 3428 
+Q 1925 3584 2291 3584 
+Q 2894 3584 3203 3211 
+Q 3513 2838 3513 2113 
+z
+" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-4c" d="M 603 3500 
+L 1178 3500 
+L 1178 0 
+L 603 0 
+L 603 3500 
+z
+M 603 4863 
+L 1178 4863 
+L 1178 4134 
+L 603 4134 
+L 603 4863 
+z
+" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-52" d="M 1959 3097 
+Q 1497 3097 1228 2736 
+Q 959 2375 959 1747 
+Q 959 1119 1226 758 
+Q 1494 397 1959 397 
+Q 2419 397 2687 759 
+Q 2956 1122 2956 1747 
+Q 2956 2369 2687 2733 
+Q 2419 3097 1959 3097 
+z
+M 1959 3584 
+Q 2709 3584 3137 3096 
+Q 3566 2609 3566 1747 
+Q 3566 888 3137 398 
+Q 2709 -91 1959 -91 
+Q 1206 -91 779 398 
+Q 353 888 353 1747 
+Q 353 2609 779 3096 
+Q 1206 3584 1959 3584 
+z
+" transform="scale(0.015625)"/>
+      <path id="DejaVuSans-5c" d="M 2059 -325 
+Q 1816 -950 1584 -1140 
+Q 1353 -1331 966 -1331 
+L 506 -1331 
+L 506 -850 
+L 844 -850 
+Q 1081 -850 1212 -737 
+Q 1344 -625 1503 -206 
+L 1606 56 
+L 191 3500 
+L 800 3500 
+L 1894 763 
+L 2988 3500 
+L 3597 3500 
+L 2059 -325 
+z
+" transform="scale(0.015625)"/>
+     </defs>
+     <use xlink:href="#DejaVuSans-56"/>
+     <use xlink:href="#DejaVuSans-48" transform="translate(52.09375 0)"/>
+     <use xlink:href="#DejaVuSans-44" transform="translate(113.625 0)"/>
+     <use xlink:href="#DejaVuSans-5a" transform="translate(174.90625 0)"/>
+     <use xlink:href="#DejaVuSans-48" transform="translate(256.6875 0)"/>
+     <use xlink:href="#DejaVuSans-48" transform="translate(318.21875 0)"/>
+     <use xlink:href="#DejaVuSans-47" transform="translate(379.75 0)"/>
+     <use xlink:href="#DejaVuSans-49" transform="translate(443.234375 0)"/>
+     <use xlink:href="#DejaVuSans-56" transform="translate(478.4375 0)"/>
+     <use xlink:href="#DejaVuSans-12" transform="translate(530.53125 0)"/>
+     <use xlink:href="#DejaVuSans-56" transform="translate(564.21875 0)"/>
+     <use xlink:href="#DejaVuSans-48" transform="translate(616.3125 0)"/>
+     <use xlink:href="#DejaVuSans-44" transform="translate(677.84375 0)"/>
+     <use xlink:href="#DejaVuSans-5a" transform="translate(739.125 0)"/>
+     <use xlink:href="#DejaVuSans-48" transform="translate(820.90625 0)"/>
+     <use xlink:href="#DejaVuSans-48" transform="translate(882.4375 0)"/>
+     <use xlink:href="#DejaVuSans-47" transform="translate(943.96875 0)"/>
+     <use xlink:href="#DejaVuSans-49" transform="translate(1007.453125 0)"/>
+     <use xlink:href="#DejaVuSans-56" transform="translate(1042.65625 0)"/>
+     <use xlink:href="#DejaVuSans-3" transform="translate(1094.75 0)"/>
+     <use xlink:href="#DejaVuSans-56" transform="translate(1126.53125 0)"/>
+     <use xlink:href="#DejaVuSans-57" transform="translate(1178.625 0)"/>
+     <use xlink:href="#DejaVuSans-44" transform="translate(1217.828125 0)"/>
+     <use xlink:href="#DejaVuSans-55" transform="translate(1279.109375 0)"/>
+     <use xlink:href="#DejaVuSans-3" transform="translate(1320.21875 0)"/>
+     <use xlink:href="#DejaVuSans-4b" transform="translate(1352 0)"/>
+     <use xlink:href="#DejaVuSans-4c" transform="translate(1415.375 0)"/>
+     <use xlink:href="#DejaVuSans-56" transform="translate(1443.15625 0)"/>
+     <use xlink:href="#DejaVuSans-57" transform="translate(1495.25 0)"/>
+     <use xlink:href="#DejaVuSans-52" transform="translate(1534.453125 0)"/>
+     <use xlink:href="#DejaVuSans-55" transform="translate(1595.640625 0)"/>
+     <use xlink:href="#DejaVuSans-5c" transform="translate(1636.75 0)"/>
+    </g>
+   </g>
+  </g>
+ </g>
+ <defs>
+  <clipPath id="p16b1f4eee4">
+   <rect x="62.261538" y="26.215385" width="646.938462" height="345.108977"/>
+  </clipPath>
+ </defs>
+</svg>
diff --git a/other/java/client/src/main/proto/filer.proto b/other/java/client/src/main/proto/filer.proto
index b8beefd71e..93e7e3ed32 100644
--- a/other/java/client/src/main/proto/filer.proto
+++ b/other/java/client/src/main/proto/filer.proto
@@ -13,6 +13,9 @@ service SeaweedFiler {
     rpc LookupDirectoryEntry (LookupDirectoryEntryRequest) returns (LookupDirectoryEntryResponse) {
     }
 
+    rpc LookupDirectoryEntries (LookupDirectoryEntriesRequest) returns (LookupDirectoryEntriesResponse) {
+    }
+
     rpc ListEntries (ListEntriesRequest) returns (stream ListEntriesResponse) {
     }
 
@@ -250,9 +253,11 @@ message CreateEntryRequest {
     repeated int32 signatures = 5;
     bool skip_check_parent_directory = 6;
     // Optional precondition evaluated against the current entry atomically with
-    // the write, under the filer's per-path lock. The caller must route the
-    // key's writes to this entry's owner filer for the check to be authoritative.
+    // the write, under the filer's per-path lock.
     WriteCondition condition = 7;
+    // Set on a create a filer forwarded to the entry's ring owner, so the owner
+    // applies it locally instead of forwarding again. Clients leave it unset.
+    bool is_moved = 8;
 }
 
 // WriteCondition is the precondition the filer evaluates against the existing
@@ -522,6 +527,10 @@ message AtomicRenameEntryRequest {
     string new_directory = 3;
     string new_name = 4;
     repeated int32 signatures = 5;
+    // When true, the rename fails with ErrEntryAlreadyExists if the target
+    // already exists. Lets a caller that authorized the rename without delete
+    // access on an absent target stay safe if one is created concurrently.
+    bool fail_if_target_exists = 6;
 }
 
 message AtomicRenameEntryResponse {
@@ -561,6 +570,9 @@ message AssignVolumeResponse {
     string error = 8;
     Location location = 9;
     repeated Location replicas = 10;
+    // fsync is the storage rule's fsync decision for the assigned path, so the
+    // client can carry it onto the volume server upload request.
+    bool fsync = 11;
 }
 
 message LookupVolumeRequest {
@@ -576,6 +588,7 @@ message Location {
     string public_url = 2;
     uint32 grpc_port = 3;
     string data_center = 4;
+    bool data_in_remote = 5;
 }
 message LookupVolumeResponse {
     map<string, Locations> locations_map = 1;
@@ -662,6 +675,7 @@ message SubscribeMetadataResponse {
     int64 ts_ns = 3;
     repeated SubscribeMetadataResponse events = 4; // batch of additional events (backlog catch-up)
     repeated LogFileChunkRef log_file_refs = 5;    // log file chunk refs for client direct-read
+    int64 flushed_ts_ns = 6; // local log-buffer flush watermark: everything at or below it is on disk
 }
 message ListMetadataSubscribersRequest {
     repeated string client_types = 1; // optional filter by client type, e.g. "mount"; empty = all
@@ -757,7 +771,8 @@ message FilerConf {
         string replication = 3;
         string ttl = 4;
         string disk_type = 5;
-        bool fsync = 6;
+        // unset inherits from the enclosing path rule, set overrides it
+        optional bool fsync = 6;
         uint32 volume_growth_count = 7;
         bool read_only = 8;
         string data_center = 9;
@@ -906,3 +921,40 @@ message MountInfo {
     int64 last_seen_ns = 3;
     string data_center = 4;
 }
+
+// LookupDirectoryEntriesRequest batches independent exact-path lookups into
+// one bounded RPC. Results preserve this order. Empty batches and batches over
+// 4096 requests are rejected. Declared last to keep generated message indices
+// stable.
+message LookupDirectoryEntriesRequest {
+    repeated LookupDirectoryEntryRequest requests = 1;
+    // Cache callers may treat an Entry whose Volume the master no longer
+    // reports as a miss. A lookup the filer could not complete still marks the
+    // Entry with an error. Ordinary filesystem callers keep the fail-closed
+    // error in both cases.
+    bool unavailable_volume_is_miss = 2;
+}
+
+message LookupDirectoryEntryResult {
+    // found reports metadata presence. An error makes this item unusable even
+    // when entry is present, for example when a chunk volume cannot be located.
+    bool found = 1;
+    Entry entry = 2;
+    string error = 3;
+    // Per-entry read fence. Every filer event at or below this position is
+    // reflected in found/entry/error for this item.
+    int64 log_ts_ns = 4;
+    int32 log_signature = 5;
+}
+
+message LookupDirectoryEntriesResponse {
+    repeated LookupDirectoryEntryResult results = 1;
+    // One deduplicated location set for every volume referenced by returned
+    // Entry.chunks. A missing/unavailable volume has an empty Locations value
+    // and marks each affected result with an error.
+    map<string, Locations> locations_map = 2;
+    // Short-lived, exact-FID read capabilities. Direct data-plane clients must
+    // present the matching token to a Volume instead of treating a shared
+    // service credential as authority to read arbitrary needles.
+    map<string, string> read_auth = 3;
+}
diff --git a/other/metrics/grafana_seaweedfs.json b/other/metrics/grafana_seaweedfs.json
index 660f792689..9652c96c28 100644
--- a/other/metrics/grafana_seaweedfs.json
+++ b/other/metrics/grafana_seaweedfs.json
@@ -5869,8 +5869,8 @@
             "type": "prometheus",
             "uid": "${DS_PROMETHEUS}"
           },
-          "title": "Filer Sync Offset Lag",
-          "description": "Seconds behind source (filer.sync); only present when filer sync runs",
+          "title": "Filer Sync Lag",
+          "description": "Seconds the replicated watermark trails the source filer (filer.sync); only present when filer sync runs",
           "type": "timeseries",
           "id": 155,
           "gridPos": {
@@ -5952,10 +5952,10 @@
                 "uid": "${DS_PROMETHEUS}"
               },
               "editorMode": "code",
-              "expr": "time() - (SeaweedFS_filerSync_sync_offset{cluster=~\"$cluster\"} > 0) / 1e9",
+              "expr": "SeaweedFS_filerSync_lag_seconds{cluster=~\"$cluster\"}",
               "range": true,
               "refId": "A",
-              "legendFormat": "{{clientName}} {{path}}"
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}}"
             }
           ],
           "pluginVersion": "10.3.1"
@@ -6055,6 +6055,423 @@
             }
           ],
           "pluginVersion": "10.3.1"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Filer Sync Event Rate",
+          "description": "Metadata events read off the source stream, replicated, and failed after retries (filer.sync)",
+          "type": "timeseries",
+          "id": 230,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 40
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "ops",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "rate(SeaweedFS_filerSync_events_received_total{cluster=~\"$cluster\"}[$__rate_interval])",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}} received"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "rate(SeaweedFS_filerSync_events_processed_total{cluster=~\"$cluster\"}[$__rate_interval])",
+              "range": true,
+              "refId": "B",
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}} processed"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "rate(SeaweedFS_filerSync_events_failed_total{cluster=~\"$cluster\"}[$__rate_interval])",
+              "range": true,
+              "refId": "C",
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}} failed"
+            }
+          ],
+          "pluginVersion": "10.3.1"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Filer Sync Throughput",
+          "description": "Chunk data bytes carried by sync events: the chunk delta, so deletes, renames, and attribute-only updates count zero (filer.sync)",
+          "type": "timeseries",
+          "id": 231,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 40
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "Bps",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "rate(SeaweedFS_filerSync_received_bytes_total{cluster=~\"$cluster\"}[$__rate_interval])",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}} received"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "rate(SeaweedFS_filerSync_processed_bytes_total{cluster=~\"$cluster\"}[$__rate_interval])",
+              "range": true,
+              "refId": "B",
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}} processed"
+            }
+          ],
+          "pluginVersion": "10.3.1"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Filer Sync In-flight Jobs",
+          "description": "Jobs currently replicating; pinned at -concurrency means the sync itself is the bottleneck, near zero means caught up or starved by the source (filer.sync)",
+          "type": "timeseries",
+          "id": 232,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 48
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "short",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "SeaweedFS_filerSync_in_flight_jobs{cluster=~\"$cluster\"}",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}}"
+            }
+          ],
+          "pluginVersion": "10.3.1"
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Filer Sync In-flight Bytes",
+          "description": "Chunk data carried by the jobs currently replicating; distinguishes workers stuck on a few large files from many small ones (filer.sync)",
+          "type": "timeseries",
+          "id": 233,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 48
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "bytes",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "SeaweedFS_filerSync_in_flight_bytes{cluster=~\"$cluster\"}",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "{{sourceFiler}} -> {{targetFiler}} {{path}}"
+            }
+          ],
+          "pluginVersion": "10.3.1"
         }
       ]
     },
@@ -9263,6 +9680,959 @@
         }
       ]
     },
+    {
+      "type": "row",
+      "title": "Plugin Workers",
+      "collapsed": true,
+      "id": 229,
+      "gridPos": {
+        "h": 1,
+        "w": 24,
+        "x": 0,
+        "y": 27
+      },
+      "panels": [
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Plugin Workers Connected",
+          "description": "Workers with a live control stream. Unlike the Admin/Maintenance row, this counts plugin workers, which is what a Rust or Go plugin worker actually is.",
+          "type": "stat",
+          "id": 219,
+          "gridPos": {
+            "h": 4,
+            "w": 6,
+            "x": 0,
+            "y": 28
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [],
+              "unit": "short",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "colorMode": "value",
+            "graphMode": "area",
+            "justifyMode": "auto",
+            "orientation": "auto",
+            "reduceOptions": {
+              "calcs": [
+                "lastNotNull"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "textMode": "auto"
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "count(SeaweedFS_worker_connected{cluster=~\"$cluster\"} == 1) or vector(0)",
+              "instant": true,
+              "range": false,
+              "refId": "A"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Worker Job Failures (1h)",
+          "description": "Jobs that ended in failure across all workers in the last hour.",
+          "type": "stat",
+          "id": 220,
+          "gridPos": {
+            "h": 4,
+            "w": 6,
+            "x": 6,
+            "y": 28
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "thresholds"
+              },
+              "mappings": [],
+              "unit": "short",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "colorMode": "value",
+            "graphMode": "area",
+            "justifyMode": "auto",
+            "orientation": "auto",
+            "reduceOptions": {
+              "calcs": [
+                "lastNotNull"
+              ],
+              "fields": "",
+              "values": false
+            },
+            "textMode": "auto"
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum(increase(SeaweedFS_worker_jobs_total{cluster=~\"$cluster\",result=\"failed\"}[1h])) or vector(0)",
+              "instant": true,
+              "range": false,
+              "refId": "A"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Objects Seen vs Skipped",
+          "description": "A sweep that proposes nothing because there was nothing to do and one that proposes nothing because it could read nothing produce the same proposal count. Skips are the difference, and are the thing to alert on.",
+          "type": "timeseries",
+          "id": 221,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 32
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "ops",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (job_type) (rate(SeaweedFS_worker_objects_seen_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "seen {{job_type}}"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (job_type, reason) (rate(SeaweedFS_worker_objects_skipped_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "B",
+              "legendFormat": "skipped {{job_type}} ({{reason}})"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Detections and Proposals",
+          "description": "Detection sweeps by outcome, and the work they handed to admin.",
+          "type": "timeseries",
+          "id": 222,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 32
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "ops",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (job_type, result) (rate(SeaweedFS_worker_detections_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "detections {{job_type}} ({{result}})"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (job_type) (rate(SeaweedFS_worker_proposals_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "B",
+              "legendFormat": "proposals {{job_type}}"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Jobs Executed",
+          "description": "Jobs run by these workers, by outcome.",
+          "type": "timeseries",
+          "id": 223,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 40
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "ops",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (job_type, result) (rate(SeaweedFS_worker_jobs_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "{{job_type}} ({{result}})"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Job Duration p99",
+          "description": "How long a job takes, per job type.",
+          "type": "timeseries",
+          "id": 224,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 40
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "s",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "histogram_quantile(0.99, sum(rate(SeaweedFS_worker_job_seconds_bucket{cluster=~\"$cluster\"}[$__rate_interval])) by (le, job_type))",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "{{job_type}}"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Worker Slots",
+          "description": "Capacity a worker advertised and how much of it is in use. Held slots are what admin schedules against.",
+          "type": "timeseries",
+          "id": 225,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 48
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "short",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (lane) (SeaweedFS_worker_slots_used{cluster=~\"$cluster\"})",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "used {{lane}}"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (lane) (SeaweedFS_worker_slots_total{cluster=~\"$cluster\"})",
+              "range": true,
+              "refId": "B",
+              "legendFormat": "total {{lane}}"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Control Stream Events",
+          "description": "Connects, closes and failures. A worker that reconnects steadily is usually two workers sharing one id, evicting each other.",
+          "type": "timeseries",
+          "id": 226,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 48
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "ops",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum by (event) (rate(SeaweedFS_worker_stream_events_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "{{event}}"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Lance Maintenance Reclaimed",
+          "description": "What the Lance jobs actually removed. A job that runs every minute and reclaims nothing is a different thing from a job that never runs.",
+          "type": "timeseries",
+          "id": 227,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 0,
+            "y": 56
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "ops",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(SeaweedFS_worker_lance_fragments_removed_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "fragments merged"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(SeaweedFS_worker_lance_rows_indexed_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "B",
+              "legendFormat": "rows indexed"
+            },
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(SeaweedFS_worker_lance_versions_removed_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "C",
+              "legendFormat": "versions removed"
+            }
+          ]
+        },
+        {
+          "datasource": {
+            "type": "prometheus",
+            "uid": "${DS_PROMETHEUS}"
+          },
+          "title": "Storage Reclaimed",
+          "description": "Bytes freed by version cleanup. Its own panel because bytes and counts do not belong on one axis.",
+          "type": "timeseries",
+          "id": 228,
+          "gridPos": {
+            "h": 8,
+            "w": 12,
+            "x": 12,
+            "y": 56
+          },
+          "fieldConfig": {
+            "defaults": {
+              "color": {
+                "mode": "palette-classic"
+              },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": {
+                  "legend": false,
+                  "tooltip": false,
+                  "viz": false
+                },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 4,
+                "scaleDistribution": {
+                  "type": "linear"
+                },
+                "showPoints": "never",
+                "spanNulls": false,
+                "stacking": {
+                  "group": "A",
+                  "mode": "none"
+                },
+                "thresholdsStyle": {
+                  "mode": "off"
+                }
+              },
+              "mappings": [],
+              "unit": "Bps",
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  {
+                    "color": "green",
+                    "value": null
+                  }
+                ]
+              }
+            },
+            "overrides": []
+          },
+          "options": {
+            "legend": {
+              "calcs": [
+                "lastNotNull",
+                "max"
+              ],
+              "displayMode": "table",
+              "placement": "bottom",
+              "showLegend": true
+            },
+            "tooltip": {
+              "mode": "multi",
+              "sort": "desc"
+            }
+          },
+          "targets": [
+            {
+              "datasource": {
+                "type": "prometheus",
+                "uid": "${DS_PROMETHEUS}"
+              },
+              "editorMode": "code",
+              "expr": "sum(rate(SeaweedFS_worker_lance_bytes_reclaimed_total{cluster=~\"$cluster\"}[$__rate_interval]))",
+              "range": true,
+              "refId": "A",
+              "legendFormat": "reclaimed"
+            }
+          ]
+        }
+      ]
+    },
     {
       "type": "row",
       "title": "Go Runtime",
@@ -9272,7 +10642,7 @@
         "h": 1,
         "w": 24,
         "x": 0,
-        "y": 27
+        "y": 28
       },
       "panels": [
         {
diff --git a/seaweed-common/Cargo.lock b/seaweed-common/Cargo.lock
new file mode 100644
index 0000000000..c6ae3d1303
--- /dev/null
+++ b/seaweed-common/Cargo.lock
@@ -0,0 +1,293 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.44.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
+[[package]]
+name = "cc"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "seaweed-common"
+version = "0.1.0"
+dependencies = [
+ "rustls",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
diff --git a/seaweed-common/Cargo.toml b/seaweed-common/Cargo.toml
new file mode 100644
index 0000000000..b521108ce8
--- /dev/null
+++ b/seaweed-common/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "seaweed-common"
+version = "0.1.0"
+edition = "2024"
+# The lower of the two consumers' floors (seaweed-volume 1.91.1,
+# seaweed-worker 1.94.1), so depending on this crate cannot raise either
+# tree's MSRV. Verified with `cargo +1.91.1 check --all-targets`.
+rust-version = "1.91.1"
+description = "Helpers shared by the SeaweedFS Rust volume server and the Rust plugin workers"
+
+# There is no root manifest: seaweed-volume and seaweed-worker are separate
+# cargo trees with their own lockfiles, and this crate is a path dependency of
+# both rather than a member of either. Keeping the lint policy identical in all
+# three manifests is what stops them drifting.
+[lints.clippy]
+# Protobuf message literals keep `..Default::default()` on purpose: it is
+# what lets a proto gain a field without touching every constructor.
+needless_update = "allow"
+
+[dependencies]
+# The same requirement both consumers already write. Cargo unifies all
+# semver-compatible `rustls = "0.23"` requirements into one crate per binary,
+# which is what makes `install_default_crypto_provider` write the same
+# process-wide static the consuming crate reads. rustls is already in both
+# trees (the volume server directly, seaweed-worker-core through tonic's
+# `tls-aws-lc`), so this adds no crate to either graph.
+rustls = "0.23"
diff --git a/seaweed-common/src/address.rs b/seaweed-common/src/address.rs
new file mode 100644
index 0000000000..9f972940cd
--- /dev/null
+++ b/seaweed-common/src/address.rs
@@ -0,0 +1,307 @@
+//! SeaweedFS server addresses, the way the Go tree does them.
+//!
+//! An operator gives a SeaweedFS process an HTTP address and the gRPC port is
+//! derived from it rather than asked for separately: `host:port` means gRPC on
+//! `port + 10000`, and the explicit `host:port.grpcPort` form names it outright.
+//! Dialling the HTTP port by mistake fails as "frame with invalid size", which
+//! reads like a protocol bug rather than a wrong port, so the rule is worth its
+//! own module. Mirrors `pb.ServerToGrpcAddress` in
+//! `weed/pb/grpc_client_server.go`.
+//!
+//! The volume server and the workers each had their own copy of this and the
+//! copies had drifted: the worker's bracketed IPv6 literals and the volume
+//! server's did not, so `::1:19333` produced `::1:29333`, which the HTTP
+//! authority parser rejects. One implementation, two thin wrappers.
+
+use std::fmt;
+use std::num::ParseIntError;
+
+/// SeaweedFS's HTTP↔gRPC port-offset convention.
+pub const GRPC_PORT_OFFSET: u16 = 10000;
+
+/// Why an address could not be turned into a gRPC address.
+///
+/// The `Display` text is the volume server's original wording, because its
+/// `parse_grpc_address` wrapper hands it straight to callers that put it in a
+/// `Status` or an `io::Error`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum AddressError {
+    /// No `:` at all, so there is no port to translate.
+    MissingPort(String),
+    /// The HTTP port of the `host:port.grpcPort` form is not a `u16`. It is
+    /// validated even though it is then discarded, so that a malformed address
+    /// is rejected here instead of failing later as an opaque connect error.
+    InvalidHttpPort { port: String, source: ParseIntError },
+    /// The gRPC port of the `host:port.grpcPort` form is not a `u16`.
+    InvalidGrpcPort { port: String, source: ParseIntError },
+    /// The port of the `host:port` form is not a `u16`.
+    InvalidPort { port: String, source: ParseIntError },
+    /// `port + GRPC_PORT_OFFSET` leaves the TCP port range, e.g. `host:60000`.
+    /// Without the check the cast would wrap silently.
+    ImplicitGrpcPortOutOfRange(u16),
+}
+
+impl fmt::Display for AddressError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::MissingPort(address) => write!(f, "cannot parse address: {address}"),
+            Self::InvalidHttpPort { port, source } => {
+                write!(f, "invalid http port {port:?}: {source}")
+            }
+            Self::InvalidGrpcPort { port, source } => {
+                write!(f, "invalid grpc port {port:?}: {source}")
+            }
+            Self::InvalidPort { port, source } => write!(f, "invalid port {port:?}: {source}"),
+            Self::ImplicitGrpcPortOutOfRange(port) => write!(
+                f,
+                "implicit grpc port out of range: {port} + {GRPC_PORT_OFFSET} = {}",
+                u32::from(*port) + u32::from(GRPC_PORT_OFFSET)
+            ),
+        }
+    }
+}
+
+impl std::error::Error for AddressError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::InvalidHttpPort { source, .. }
+            | Self::InvalidGrpcPort { source, .. }
+            | Self::InvalidPort { source, .. } => Some(source),
+            Self::MissingPort(_) | Self::ImplicitGrpcPortOutOfRange(_) => None,
+        }
+    }
+}
+
+/// Turn a SeaweedFS server address (`"host:port.grpcPort"` or `"host:port"`)
+/// into the `host:grpcPort` form the endpoint builders expect.
+///
+/// With the trailing `.grpcPort` segment that segment *is* the gRPC port;
+/// without it the gRPC port is `port + GRPC_PORT_OFFSET`. An unbracketed IPv6
+/// literal comes back bracketed, because otherwise the port reads as part of
+/// the address.
+pub fn to_grpc_address(server: &str) -> Result<String, AddressError> {
+    // rfind, not find: an IPv6 literal is full of colons and the port is after
+    // the last one.
+    let colon_idx = server
+        .rfind(':')
+        .ok_or_else(|| AddressError::MissingPort(server.to_string()))?;
+    let host = &server[..colon_idx];
+    let port_part = &server[colon_idx + 1..];
+
+    // rfind again rather than split_once: the host may be an IPv4 address, and
+    // only the part after the last colon is being split here anyway.
+    if let Some(dot_idx) = port_part.rfind('.') {
+        let http_port = &port_part[..dot_idx];
+        let grpc_port = &port_part[dot_idx + 1..];
+        http_port
+            .parse::<u16>()
+            .map_err(|source| AddressError::InvalidHttpPort {
+                port: http_port.to_string(),
+                source,
+            })?;
+        let grpc_port =
+            grpc_port
+                .parse::<u16>()
+                .map_err(|source| AddressError::InvalidGrpcPort {
+                    port: grpc_port.to_string(),
+                    source,
+                })?;
+        return Ok(join_host_port(host, grpc_port));
+    }
+
+    let port: u16 = port_part
+        .parse()
+        .map_err(|source| AddressError::InvalidPort {
+            port: port_part.to_string(),
+            source,
+        })?;
+    let grpc_port = port
+        .checked_add(GRPC_PORT_OFFSET)
+        .ok_or(AddressError::ImplicitGrpcPortOutOfRange(port))?;
+    Ok(join_host_port(host, grpc_port))
+}
+
+/// Join a host and a port, bracketing an IPv6 literal that is not bracketed
+/// already. Public because the address rule is not the only place that has to
+/// put a host and a port back together.
+pub fn join_host_port(host: &str, port: u16) -> String {
+    // An IPv6 literal has to keep its brackets or the port reads as part of it.
+    if host.contains(':') && !host.starts_with('[') {
+        format!("[{host}]:{port}")
+    } else {
+        format!("{host}:{port}")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{AddressError, GRPC_PORT_OFFSET, join_host_port, to_grpc_address};
+
+    // ---- the volume server's cases -------------------------------------
+
+    #[test]
+    fn dotted_form_states_the_grpc_port() {
+        assert_eq!(
+            to_grpc_address("127.0.0.1:8080.18080").unwrap(),
+            "127.0.0.1:18080"
+        );
+        assert_eq!(
+            to_grpc_address("192.168.1.66:8080.18080").unwrap(),
+            "192.168.1.66:18080"
+        );
+    }
+
+    #[test]
+    fn implicit_form_adds_the_offset() {
+        assert_eq!(
+            to_grpc_address("127.0.0.1:8080").unwrap(),
+            "127.0.0.1:18080"
+        );
+        assert_eq!(
+            to_grpc_address("192.168.1.66:8080").unwrap(),
+            "192.168.1.66:18080"
+        );
+        assert_eq!(
+            to_grpc_address("localhost:9333").unwrap(),
+            "localhost:19333"
+        );
+    }
+
+    #[test]
+    fn the_dotted_grpc_port_comes_back_normalised() {
+        // The volume server's copy validated this segment as a u16 and then
+        // emitted the original text, so a padded or signed port produced an
+        // authority the URI parser rejects. The parsed value is emitted now.
+        assert_eq!(to_grpc_address("host:8080.018080").unwrap(), "host:18080");
+        assert_eq!(to_grpc_address("host:8080.+18080").unwrap(), "host:18080");
+    }
+
+    #[test]
+    fn an_ipv4_host_is_not_confused_with_the_dotted_port() {
+        // Regression: a naive split on '.' breaks on IP addresses.
+        assert_eq!(
+            to_grpc_address("10.0.0.1:8080.18080").unwrap(),
+            "10.0.0.1:18080"
+        );
+        assert_eq!(to_grpc_address("10.0.0.1:8080").unwrap(), "10.0.0.1:18080");
+    }
+
+    #[test]
+    fn rejects_a_non_numeric_http_port_in_the_dotted_form() {
+        let err = to_grpc_address("host:abc.18080").unwrap_err();
+        assert!(
+            matches!(err, AddressError::InvalidHttpPort { .. }),
+            "{err:?}"
+        );
+        assert!(err.to_string().contains("invalid http port"), "{err}");
+    }
+
+    #[test]
+    fn rejects_a_non_numeric_grpc_port_in_the_dotted_form() {
+        let err = to_grpc_address("host:8080.xyz").unwrap_err();
+        assert!(
+            matches!(err, AddressError::InvalidGrpcPort { .. }),
+            "{err:?}"
+        );
+        assert!(err.to_string().contains("invalid grpc port"), "{err}");
+    }
+
+    #[test]
+    fn rejects_an_implicit_port_that_leaves_the_tcp_range() {
+        let err = to_grpc_address("127.0.0.1:60000").unwrap_err();
+        assert!(
+            matches!(err, AddressError::ImplicitGrpcPortOutOfRange(60000)),
+            "{err:?}"
+        );
+        assert!(err.to_string().contains("out of range"), "{err}");
+    }
+
+    #[test]
+    fn the_messages_are_the_volume_servers_wording_verbatim() {
+        // parse_grpc_address hands these straight to callers that put them in a
+        // Status or an io::Error, so the whole string is the contract, not just
+        // the substring the older tests match on. Only the two variants whose
+        // text is entirely ours are pinned exactly; the other three end in a
+        // std ParseIntError message, which is std's to reword.
+        assert_eq!(
+            to_grpc_address("127.0.0.1:60000").unwrap_err().to_string(),
+            "implicit grpc port out of range: 60000 + 10000 = 70000"
+        );
+        assert_eq!(
+            to_grpc_address("hostname").unwrap_err().to_string(),
+            "cannot parse address: hostname"
+        );
+    }
+
+    #[test]
+    fn rejects_an_address_without_a_port() {
+        for source in ["hostname", "no-colon", "localhost"] {
+            let err = to_grpc_address(source).unwrap_err();
+            assert!(matches!(err, AddressError::MissingPort(_)), "{err:?}");
+            assert!(err.to_string().contains("cannot parse"), "{err}");
+        }
+    }
+
+    // ---- the worker's cases --------------------------------------------
+
+    #[test]
+    fn derives_the_grpc_port() {
+        assert_eq!(
+            to_grpc_address("localhost:23646").unwrap(),
+            "localhost:33646"
+        );
+        assert_eq!(
+            to_grpc_address("127.0.0.1:9333").unwrap(),
+            "127.0.0.1:19333"
+        );
+    }
+
+    #[test]
+    fn honours_an_explicit_grpc_port() {
+        assert_eq!(
+            to_grpc_address("localhost:23646.33999").unwrap(),
+            "localhost:33999"
+        );
+    }
+
+    #[test]
+    fn rejects_what_it_cannot_parse() {
+        let err = to_grpc_address("localhost:notaport").unwrap_err();
+        assert!(matches!(err, AddressError::InvalidPort { .. }), "{err:?}");
+        assert!(err.to_string().contains("invalid port"), "{err}");
+    }
+
+    // ---- IPv6, which only the worker's copy handled --------------------
+
+    #[test]
+    fn brackets_ipv6_literals() {
+        assert_eq!(to_grpc_address("::1:23646").unwrap(), "[::1]:33646");
+        assert_eq!(to_grpc_address("::1:9333").unwrap(), "[::1]:19333");
+        assert_eq!(
+            to_grpc_address("fe80::1:9333.19333").unwrap(),
+            "[fe80::1]:19333"
+        );
+    }
+
+    #[test]
+    fn leaves_an_already_bracketed_literal_alone() {
+        assert_eq!(to_grpc_address("[::1]:9333").unwrap(), "[::1]:19333");
+        assert_eq!(to_grpc_address("[::1]:9333.19333").unwrap(), "[::1]:19333");
+    }
+
+    #[test]
+    fn join_host_port_brackets_only_unbracketed_literals() {
+        assert_eq!(join_host_port("127.0.0.1", 19333), "127.0.0.1:19333");
+        assert_eq!(join_host_port("localhost", 19333), "localhost:19333");
+        assert_eq!(join_host_port("::1", 19333), "[::1]:19333");
+        assert_eq!(join_host_port("[::1]", 19333), "[::1]:19333");
+    }
+
+    // ---- the offset itself ---------------------------------------------
+
+    #[test]
+    fn the_offset_is_the_seaweedfs_convention() {
+        assert_eq!(GRPC_PORT_OFFSET, 10000);
+    }
+}
diff --git a/seaweed-common/src/lib.rs b/seaweed-common/src/lib.rs
new file mode 100644
index 0000000000..817f46216a
--- /dev/null
+++ b/seaweed-common/src/lib.rs
@@ -0,0 +1,11 @@
+//! Helpers the SeaweedFS Rust volume server and the Rust plugin workers both need.
+//!
+//! `seaweed-volume` and `seaweed-worker` are separate cargo trees with separate
+//! lockfiles and no root manifest, so anything both of them need was, until this
+//! crate existed, written twice. The two things in here are the ones where a
+//! second copy is a correctness risk rather than a typing cost: the HTTP↔gRPC
+//! address rule, which two copies had already drifted on, and the process-wide
+//! rustls provider, which only works if every binary installs the same one.
+
+pub mod address;
+pub mod tls;
diff --git a/seaweed-common/src/tls.rs b/seaweed-common/src/tls.rs
new file mode 100644
index 0000000000..63ca7ce607
--- /dev/null
+++ b/seaweed-common/src/tls.rs
@@ -0,0 +1,28 @@
+//! The process-wide rustls crypto provider.
+//!
+//! Both binaries link aws-lc-rs and ring transitively — in the volume server
+//! through the AWS SDK and reqwest, in the lance worker through lance's `aws`
+//! backend and reqwest — so rustls cannot auto-select a provider and tonic's
+//! client TLS panics on first use. Each binary has to pin one, and it has to be
+//! the same one, which is why the choice lives here rather than in either tree.
+
+use rustls::crypto::aws_lc_rs;
+
+/// Pin rustls's process-wide default provider to aws-lc-rs, matching the
+/// volume server's TLS config. Idempotent: the first call wins and every
+/// later one is a no-op, so callers do not have to coordinate.
+pub fn install_default_crypto_provider() {
+    let _ = aws_lc_rs::default_provider().install_default();
+}
+
+#[cfg(test)]
+mod tests {
+    use super::install_default_crypto_provider;
+
+    #[test]
+    fn installing_is_idempotent_and_leaves_a_default_behind() {
+        install_default_crypto_provider();
+        install_default_crypto_provider();
+        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
+    }
+}
diff --git a/seaweed-volume/Cargo.lock b/seaweed-volume/Cargo.lock
index a4c8752585..afabe1c8aa 100644
--- a/seaweed-volume/Cargo.lock
+++ b/seaweed-volume/Cargo.lock
@@ -86,7 +86,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -97,7 +97,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -234,9 +234,9 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.16.2"
+version = "1.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc"
+checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
  "zeroize",
@@ -244,14 +244,15 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.39.1"
+version = "0.45.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83a25cf98105baa966497416dbd42565ce3a8cf8dbfd59803ec9ad46f3126399"
+checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
+ "pkg-config",
 ]
 
 [[package]]
@@ -503,16 +504,18 @@ dependencies = [
  "rustls-pki-types",
  "tokio",
  "tokio-rustls",
- "tower 0.5.3",
+ "tower",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-json"
-version = "0.62.5"
+version = "0.62.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9648b0bb82a2eedd844052c6ad2a1a822d1f8e3adee5fbf668366717e428856a"
+checksum = "701a947f4797e52a911e114a898667c746c39feea467bbd1abd7b3721f702ffa"
 dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
 ]
 
@@ -562,11 +565,12 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.11.6"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "876ab3c9c29791ba4ba02b780a3049e21ec63dabda09268b175272c3733a79e6"
+checksum = "9db177daa6ba8afb9ee1aefcf548c907abcf52065e394ee11a92780057fe0e8c"
 dependencies = [
  "aws-smithy-async",
+ "aws-smithy-runtime-api-macros",
  "aws-smithy-types",
  "bytes",
  "http 0.2.12",
@@ -578,10 +582,32 @@ dependencies = [
 ]
 
 [[package]]
-name = "aws-smithy-types"
-version = "1.4.7"
+name = "aws-smithy-runtime-api-macros"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d73dbfbaa8e4bc57b9045137680b958d274823509a360abfd8e1d514d40c95c"
+checksum = "8d7396fd9500589e62e460e987ecb671bad374934e55ec3b5f498cc7a8a8a7b7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "aws-smithy-schema"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7442cb268338f0eb8278140a107c046756aa01093d8ef5e99628d34ae09c94f5"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "http 1.4.0",
+]
+
+[[package]]
+name = "aws-smithy-types"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32b42fcf341259d85ca10fac9a2f6448a8ec691c6955a18e45bc3b71a85fab85"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -628,13 +654,13 @@ dependencies = [
 
 [[package]]
 name = "axum"
-version = "0.7.9"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
- "async-trait",
  "axum-core",
  "bytes",
+ "form_urlencoded",
  "futures-util",
  "http 1.4.0",
  "http-body 1.0.1",
@@ -648,14 +674,13 @@ dependencies = [
  "multer",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
- "tower 0.5.3",
+ "tower",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -663,19 +688,17 @@ dependencies = [
 
 [[package]]
 name = "axum-core"
-version = "0.4.5"
+version = "0.5.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
- "async-trait",
  "bytes",
- "futures-util",
+ "futures-core",
  "http 1.4.0",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
  "pin-project-lite",
- "rustversion",
  "sync_wrapper",
  "tower-layer",
  "tower-service",
@@ -1327,7 +1350,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1654,19 +1677,13 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http 1.4.0",
- "indexmap 2.13.1",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
  "tracing",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -1860,7 +1877,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.3",
+ "socket2",
  "tokio",
  "tower-service",
  "tracing",
@@ -2027,16 +2044,6 @@ dependencies = [
  "quick-error",
 ]
 
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.13.1"
@@ -2250,9 +2257,9 @@ dependencies = [
 
 [[package]]
 name = "matchit"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "md-5"
@@ -2397,7 +2404,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2619,17 +2626,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
 dependencies = [
  "fixedbitset 0.4.2",
- "indexmap 2.13.1",
+ "indexmap",
 ]
 
 [[package]]
 name = "petgraph"
-version = "0.7.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
  "fixedbitset 0.5.7",
- "indexmap 2.13.1",
+ "hashbrown 0.15.5",
+ "indexmap",
 ]
 
 [[package]]
@@ -2695,6 +2703,12 @@ dependencies = [
  "spki 0.7.3",
 ]
 
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -2836,12 +2850,12 @@ dependencies = [
 
 [[package]]
 name = "prost"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
 dependencies = [
  "bytes",
- "prost-derive 0.13.5",
+ "prost-derive 0.14.4",
 ]
 
 [[package]]
@@ -2867,19 +2881,20 @@ dependencies = [
 
 [[package]]
 name = "prost-build"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
+checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
 dependencies = [
  "heck",
  "itertools 0.14.0",
  "log",
  "multimap",
- "once_cell",
- "petgraph 0.7.1",
+ "petgraph 0.8.3",
  "prettyplease",
- "prost 0.13.5",
- "prost-types 0.13.5",
+ "prost 0.14.4",
+ "prost-types 0.14.4",
+ "pulldown-cmark",
+ "pulldown-cmark-to-cmark",
  "regex",
  "syn",
  "tempfile",
@@ -2900,9 +2915,9 @@ dependencies = [
 
 [[package]]
 name = "prost-derive"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -2922,11 +2937,95 @@ dependencies = [
 
 [[package]]
 name = "prost-types"
-version = "0.13.5"
+version = "0.14.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
 dependencies = [
- "prost 0.13.5",
+ "prost 0.14.4",
+]
+
+[[package]]
+name = "protoc-bin-vendored"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c381df33c98266b5f08186583660090a4ffa0889e76c7e9a5e175f645a67fa"
+dependencies = [
+ "protoc-bin-vendored-linux-aarch_64",
+ "protoc-bin-vendored-linux-ppcle_64",
+ "protoc-bin-vendored-linux-s390_64",
+ "protoc-bin-vendored-linux-x86_32",
+ "protoc-bin-vendored-linux-x86_64",
+ "protoc-bin-vendored-macos-aarch_64",
+ "protoc-bin-vendored-macos-x86_64",
+ "protoc-bin-vendored-win32",
+]
+
+[[package]]
+name = "protoc-bin-vendored-linux-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c350df4d49b5b9e3ca79f7e646fde2377b199e13cfa87320308397e1f37e1a4c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-ppcle_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55a63e6c7244f19b5c6393f025017eb5d793fd5467823a099740a7a4222440c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-s390_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dba5565db4288e935d5330a07c264a4ee8e4a5b4a4e6f4e83fad824cc32f3b0"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8854774b24ee28b7868cd71dccaae8e02a2365e67a4a87a6cd11ee6cdbdf9cf5"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b38b07546580df720fa464ce124c4b03630a6fb83e05c336fea2a241df7e5d78"
+
+[[package]]
+name = "protoc-bin-vendored-macos-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89278a9926ce312e51f1d999fee8825d324d603213344a9a706daa009f1d8092"
+
+[[package]]
+name = "protoc-bin-vendored-macos-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81745feda7ccfb9471d7a4de888f0652e806d5795b61480605d4943176299756"
+
+[[package]]
+name = "protoc-bin-vendored-win32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
+
+[[package]]
+name = "pulldown-cmark"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
+dependencies = [
+ "bitflags 2.11.0",
+ "memchr",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-to-cmark"
+version = "22.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab1ad36992cead65f02aa399a373a42730922f1525d988172634fdefdecb8a60"
+dependencies = [
+ "pulldown-cmark",
 ]
 
 [[package]]
@@ -2954,7 +3053,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.6.3",
+ "socket2",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -2992,7 +3091,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.3",
+ "socket2",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -3096,9 +3195,9 @@ dependencies = [
 
 [[package]]
 name = "redb"
-version = "3.1.3"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ba239c1c1693315d3cc0e601db3b3965543afbf48c41730fdca2f069f510f4a"
+checksum = "de6c3b63e007e90ce536ec2ae4690826136a20ec8dbbbb400daef1bb999d2e36"
 dependencies = [
  "libc",
 ]
@@ -3198,8 +3297,8 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tokio-util",
- "tower 0.5.3",
- "tower-http 0.6.8",
+ "tower",
+ "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -3317,14 +3416,14 @@ dependencies = [
  "errno 0.3.14",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.37"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -3369,9 +3468,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -3420,6 +3519,13 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "seaweed-common"
+version = "0.1.0"
+dependencies = [
+ "rustls",
+]
+
 [[package]]
 name = "sec1"
 version = "0.3.0"
@@ -3595,7 +3701,7 @@ version = "1.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
 dependencies = [
- "errno 0.3.14",
+ "errno 0.2.8",
  "libc",
 ]
 
@@ -3655,16 +3761,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b"
 
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -3672,7 +3768,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3806,7 +3902,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3926,7 +4022,7 @@ dependencies = [
  "parking_lot 0.12.5",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.3",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -4013,7 +4109,7 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.13.1",
+ "indexmap",
  "serde",
  "serde_spanned",
  "toml_datetime",
@@ -4029,11 +4125,10 @@ checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801"
 
 [[package]]
 name = "tonic"
-version = "0.12.3"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
- "async-stream",
  "async-trait",
  "axum",
  "base64",
@@ -4047,13 +4142,12 @@ dependencies = [
  "hyper-util",
  "percent-encoding",
  "pin-project",
- "prost 0.13.5",
- "rustls-pemfile",
- "socket2 0.5.10",
+ "socket2",
+ "sync_wrapper",
  "tokio",
  "tokio-rustls",
  "tokio-stream",
- "tower 0.4.13",
+ "tower",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -4061,49 +4155,55 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.12.3"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11"
+checksum = "c68f61875ac5293cf72e6c8cf0158086428c82c37229e98c840878f1706b0322"
 dependencies = [
  "prettyplease",
  "proc-macro2",
- "prost-build 0.13.5",
- "prost-types 0.13.5",
  "quote",
  "syn",
 ]
 
 [[package]]
-name = "tonic-reflection"
-version = "0.12.3"
+name = "tonic-prost"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "878d81f52e7fcfd80026b7fdb6a9b578b3c3653ba987f87f0dce4b64043cba27"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
 dependencies = [
- "prost 0.13.5",
- "prost-types 0.13.5",
- "tokio",
- "tokio-stream",
+ "bytes",
+ "prost 0.14.4",
  "tonic",
 ]
 
 [[package]]
-name = "tower"
-version = "0.4.13"
+name = "tonic-prost-build"
+version = "0.14.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+checksum = "654e5643eff75d7f8c99197ce1440ed19a3474eada74c12bbac488b2cafdae27"
 dependencies = [
- "futures-core",
- "futures-util",
- "indexmap 1.9.3",
- "pin-project",
- "pin-project-lite",
- "rand 0.8.7",
- "slab",
+ "prettyplease",
+ "proc-macro2",
+ "prost-build 0.14.4",
+ "prost-types 0.14.4",
+ "quote",
+ "syn",
+ "tempfile",
+ "tonic-build",
+]
+
+[[package]]
+name = "tonic-reflection"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acccd136a4bf19810a1fde9c74edc6129b42a66b44d0c1c8aaa67aeb49a146a7"
+dependencies = [
+ "prost 0.14.4",
+ "prost-types 0.14.4",
  "tokio",
- "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
+ "tokio-stream",
+ "tonic",
+ "tonic-prost",
 ]
 
 [[package]]
@@ -4114,26 +4214,12 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
+ "indexmap",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
-[[package]]
-name = "tower-http"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
-dependencies = [
- "bitflags 2.11.0",
- "bytes",
- "http 1.4.0",
- "http-body 1.0.1",
- "http-body-util",
- "pin-project-lite",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -4152,9 +4238,10 @@ dependencies = [
  "http-body 1.0.1",
  "iri-string",
  "pin-project-lite",
- "tower 0.5.3",
+ "tower",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -4431,7 +4518,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
 dependencies = [
  "anyhow",
- "indexmap 2.13.1",
+ "indexmap",
  "wasm-encoder",
  "wasmparser",
 ]
@@ -4457,7 +4544,7 @@ checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
  "bitflags 2.11.0",
  "hashbrown 0.15.5",
- "indexmap 2.13.1",
+ "indexmap",
  "semver",
 ]
 
@@ -4500,6 +4587,7 @@ dependencies = [
  "aws-config",
  "aws-credential-types",
  "aws-sdk-s3",
+ "aws-smithy-runtime-api",
  "aws-types",
  "axum",
  "base64",
@@ -4518,7 +4606,6 @@ dependencies = [
  "image",
  "jsonwebtoken",
  "kamadak-exif",
- "lazy_static",
  "libc",
  "md-5",
  "memmap2",
@@ -4527,8 +4614,9 @@ dependencies = [
  "parking_lot 0.12.5",
  "pprof",
  "prometheus",
- "prost 0.13.5",
- "prost-types 0.13.5",
+ "prost 0.14.4",
+ "prost-types 0.14.4",
+ "protoc-bin-vendored",
  "rand 0.10.2",
  "redb",
  "reed-solomon-erasure",
@@ -4536,6 +4624,7 @@ dependencies = [
  "rustls",
  "rustls-pemfile",
  "rusty-leveldb",
+ "seaweed-common",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -4548,13 +4637,15 @@ dependencies = [
  "tokio-stream",
  "toml",
  "tonic",
- "tonic-build",
+ "tonic-prost",
+ "tonic-prost-build",
  "tonic-reflection",
- "tower 0.4.13",
- "tower-http 0.5.2",
+ "tower",
+ "tower-http",
  "tracing",
  "tracing-subscriber",
  "uuid",
+ "windows-sys 0.61.2",
  "x509-parser",
  "xxhash-rust",
 ]
@@ -4901,7 +4992,7 @@ checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
 dependencies = [
  "anyhow",
  "heck",
- "indexmap 2.13.1",
+ "indexmap",
  "prettyplease",
  "syn",
  "wasm-metadata",
@@ -4932,7 +5023,7 @@ checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
  "bitflags 2.11.0",
- "indexmap 2.13.1",
+ "indexmap",
  "log",
  "serde",
  "serde_derive",
@@ -4951,7 +5042,7 @@ checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
 dependencies = [
  "anyhow",
  "id-arena",
- "indexmap 2.13.1",
+ "indexmap",
  "log",
  "semver",
  "serde",
diff --git a/seaweed-volume/Cargo.toml b/seaweed-volume/Cargo.toml
index 481f7bc12f..29c37d4ff3 100644
--- a/seaweed-volume/Cargo.toml
+++ b/seaweed-volume/Cargo.toml
@@ -1,7 +1,10 @@
 [package]
 name = "weed-volume"
 version = "0.1.0"
-edition = "2021"
+edition = "2024"
+# The edition needs 1.85; the dependency tree needs more. Verified with
+# `cargo +1.91.1 check --all-targets` (1.90 fails on the AWS SDK).
+rust-version = "1.91.1"
 description = "SeaweedFS Volume Server — Rust implementation"
 
 [lib]
@@ -16,33 +19,48 @@ path = "src/main.rs"
 # Disable with --no-default-features for 4-byte offsets (32GB max volume size).
 default = ["5bytes"]
 5bytes = []
+# Unstable redb cursor bulk-load for full_rebuild. Off in production.
+# Pulls redb's experimental_cursor (and therefore experimental-api-5).
+redb-experimental-cursor = ["redb/experimental_cursor"]
+
+[lints.clippy]
+# Protobuf message literals keep `..Default::default()` on purpose: it is
+# what lets a proto gain a field without touching every constructor.
+needless_update = "allow"
+# Every `unsafe` block states its precondition, right above the block.
+undocumented_unsafe_blocks = "warn"
 
 [dependencies]
+# Helpers the Rust plugin workers (seaweed-worker) need as well. A path
+# dependency because the two trees are separate cargo workspaces with no
+# common root manifest.
+seaweed-common = { path = "../seaweed-common" }
+
 # Async runtime
 tokio = { version = "1", features = ["full"] }
 tokio-stream = { version = "0.1", features = ["net"] }
 tokio-io-timeout = "1"
 
 # gRPC + protobuf
-tonic = { version = "0.12", features = ["tls"] }
-tonic-reflection = "0.12"
-prost = "0.13"
-prost-types = "0.13"
+tonic = { version = "0.14", features = ["tls-aws-lc"] }
+tonic-prost = "0.14"
+tonic-reflection = "0.14"
+prost = "0.14"
+prost-types = "0.14"
 
 # HTTP server
-axum = { version = "0.7", features = ["multipart"] }
+axum = { version = "0.8", features = ["multipart"] }
 http-body = "1"
 hyper = { version = "1", features = ["full"] }
 hyper-util = { version = "0.1", features = ["tokio", "service", "server-auto", "http1", "http2"] }
-tower = "0.4"
-tower-http = { version = "0.5", features = ["cors", "trace"] }
+tower = { version = "0.5", features = ["util"] }
+tower-http = { version = "0.6", features = ["cors", "trace"] }
 
 # CLI
 clap = { version = "4", features = ["derive"] }
 
 # Metrics
 prometheus = { version = "0.13", default-features = false, features = ["process"] }
-lazy_static = "1"
 
 # JWT
 jsonwebtoken = { version = "10", features = ["rust_crypto"] }
@@ -57,7 +75,7 @@ rustls-pemfile = "2"
 rusty-leveldb = "3"
 
 # Disk-backed needle map (alternative to in-memory HashMap)
-redb = "3"
+redb = "4"
 
 # Reed-Solomon erasure coding
 reed-solomon-erasure = "6"
@@ -132,11 +150,25 @@ aws-types = "1"
 [target.'cfg(unix)'.dependencies]
 pprof = { version = "0.15", features = ["prost-codec"] }
 
+# GetDiskFreeSpaceExW for per-path disk capacity on Windows (0.61.2 already
+# in the tree via tempfile/mio, so this unifies rather than adding a version).
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Storage_FileSystem"] }
+
 [dev-dependencies]
 tempfile = "3"
+# Paused-time tests drive the write-queue batch window deterministically.
+tokio = { version = "1", features = ["full", "test-util"] }
+# Already a transitive dependency of aws-sdk-s3 at a single locked version;
+# needed directly only for the canned HttpClient in remote_storage::s3 tests.
+aws-smithy-runtime-api = "1"
 
 [build-dependencies]
-tonic-build = "0.12"
+tonic-prost-build = "0.14"
+# Ships protoc with the build so neither CI nor a developer needs a system
+# install, and so the version is pinned rather than whatever the platform's
+# package manager happens to carry.
+protoc-bin-vendored = "3"
 
 [patch.crates-io]
 reed-solomon-erasure = { path = "vendor/reed-solomon-erasure" }
diff --git a/seaweed-volume/README.md b/seaweed-volume/README.md
index 4367a07222..2798a0b4fe 100644
--- a/seaweed-volume/README.md
+++ b/seaweed-volume/README.md
@@ -4,7 +4,10 @@ A drop-in replacement for the [SeaweedFS](https://github.com/seaweedfs/seaweedfs
 
 ## Building
 
-Requires Rust 1.75+ (2021 edition).
+Requires Rust 1.91.1+ (2024 edition), matching `rust-version` in `Cargo.toml`.
+The patch release matters: 1.91.0 does not build. The edition itself only needs
+1.85; the higher floor comes from the dependency tree — chiefly the AWS SDK — so
+it moves with those crates. CI builds on the latest stable.
 
 ```bash
 cd seaweed-volume
@@ -61,10 +64,14 @@ seaweed-volume --port 8080 --master localhost:9333 --dir /data/vol1 --max 7 \
 | `--whiteList` | | Comma-separated IPs with write permission |
 | `--preStopSeconds` | `10` | Graceful drain period before shutdown |
 | `--compactionMBps` | `0` (unlimited) | Compaction I/O rate limit |
+| `--compactionMaxParallelCommits` | `0` (unlimited) | Max concurrent vacuum commits |
 | `--pprof` | `false` | Enable pprof HTTP handlers |
 
 Set `RUST_LOG=debug` (or `trace`, `info`, `warn`) for log level control.
-Set `SEAWEED_WRITE_QUEUE=1` to enable batched async write processing.
+
+Durable (`fsync=true`) uploads always go through per-volume batching workers
+that share one `.dat`/`.idx` sync per batch, matching the Go volume server;
+non-fsync writes take the synchronous path.
 
 ## Features
 
diff --git a/seaweed-volume/build.rs b/seaweed-volume/build.rs
index a42b8bdfc9..fe85f354cd 100644
--- a/seaweed-volume/build.rs
+++ b/seaweed-volume/build.rs
@@ -1,10 +1,23 @@
 fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // Use the protoc that ships with protoc-bin-vendored rather than a system
+    // one, so the build needs no package manager and always sees the same
+    // version. An explicit PROTOC still wins, for packagers supplying their own.
+    if std::env::var_os("PROTOC").is_none() {
+        // SAFETY: a build script's main runs single-threaded before anything
+        // else in this process, so no other thread can be reading the
+        // environment concurrently.
+        unsafe {
+            std::env::set_var("PROTOC", protoc_bin_vendored::protoc_bin_path()?);
+        }
+    }
+
     let out_dir = std::path::PathBuf::from(std::env::var("OUT_DIR")?);
-    tonic_build::configure()
+    tonic_prost_build::configure()
         .build_server(true)
         .build_client(true)
-        // filer.proto uses proto3 optional; older protoc (e.g. 3.12 from ubuntu-22.04 apt)
-        // rejects it without this flag, and newer protoc still accepts the flag
+        // filer.proto uses proto3 optional, which protoc rejects without this
+        // flag before 3.15. The vendored protoc is newer, but it still accepts
+        // the flag, so this keeps a build against an older PROTOC working.
         .protoc_arg("--experimental_allow_proto3_optional")
         .file_descriptor_set_path(out_dir.join("seaweed_descriptor.bin"))
         .compile_protos(
diff --git a/seaweed-volume/proto/master.proto b/seaweed-volume/proto/master.proto
index 37ee52a800..d1cf3dd342 100644
--- a/seaweed-volume/proto/master.proto
+++ b/seaweed-volume/proto/master.proto
@@ -27,6 +27,8 @@ service Seaweed {
   }
   rpc VolumeList (VolumeListRequest) returns (VolumeListResponse) {
   }
+  rpc VolumeListStream (VolumeListRequest) returns (stream VolumeListStreamResponse) {
+  }
   rpc LookupEcVolume (LookupEcVolumeRequest) returns (LookupEcVolumeResponse) {
   }
   rpc VacuumVolume (VacuumVolumeRequest) returns (VacuumVolumeResponse) {
@@ -57,6 +59,8 @@ service Seaweed {
   }
   rpc RaftLeadershipTransfer (RaftLeadershipTransferRequest) returns (RaftLeadershipTransferResponse) {
   }
+  rpc ResumeVolumeGrowth (ResumeVolumeGrowthRequest) returns (ResumeVolumeGrowthResponse) {
+  }
   rpc VolumeGrow (VolumeGrowRequest) returns (VolumeGrowResponse) {
   }
   rpc CollectionStatistics (CollectionStatisticsRequest) returns (CollectionStatisticsResponse) {
@@ -117,6 +121,12 @@ message Heartbeat {
   // place of `volumes`. A master that does not understand this never sets
   // volume_digest_supported, so it keeps being sent the whole list.
   repeated VolumeInformationMessage changed_volumes = 28;
+
+  // Highest volume id this server has ever observed, persisted locally. Fed
+  // by HeartbeatResponse.max_volume_id echoes and by AllocateVolume requests.
+  uint32 max_volume_id_seen = 29;
+  // Topology id of the master cluster this server last heartbeated to.
+  string last_seen_topology_id = 30;
 }
 
 message HeartbeatResponse {
@@ -133,6 +143,12 @@ message HeartbeatResponse {
   // The master compares volume digests, so a server that reports one may send
   // changed_volumes in place of its whole list.
   bool volume_digest_supported = 9;
+  // The leader's current allocation bound; servers persist it and report it
+  // back as max_volume_id_seen so the bound survives master state loss.
+  uint32 max_volume_id = 10;
+  // The leader's cluster identity; a different value reported back later
+  // means the master's state was rebuilt.
+  string topology_id = 11;
 }
 
 message VolumeInformationMessage {
@@ -143,6 +159,7 @@ message VolumeInformationMessage {
   uint64 delete_count = 5;
   uint64 deleted_byte_count = 6;
   bool read_only = 7;
+  bool read_only_can_delete = 17;
   uint32 replica_placement = 8;
   uint32 version = 9;
   uint32 ttl = 10;
@@ -162,6 +179,8 @@ message VolumeShortInformationMessage {
   uint32 ttl = 10;
   string disk_type = 15;
   uint32 disk_id = 16;
+  bool read_only = 17;
+  bool read_only_can_delete = 18;
 }
 
 message VolumeEcShardInformationMessage {
@@ -208,6 +227,9 @@ message KeepConnectedRequest {
   string filer_group = 5;
   string data_center = 6;
   string rack = 7;
+  // A draining filer leaves the lock ring but stays a cluster member, so peers
+  // keep following its metadata until the stream closes.
+  bool leave_lock_ring = 8;
 }
 
 message VolumeLocation {
@@ -220,6 +242,9 @@ message VolumeLocation {
   uint32 grpc_port = 7;
   repeated uint32 new_ec_vids = 8;
   repeated uint32 deleted_ec_vids = 9;
+  repeated uint32 remote_vids = 10;
+  repeated uint32 read_only_vids = 11;
+  repeated uint32 read_only_can_delete_vids = 12;
 }
 
 message ClusterNodeUpdate {
@@ -265,6 +290,9 @@ message Location {
   string public_url = 2;
   uint32 grpc_port = 3;
   string data_center = 4;
+  bool data_in_remote = 5;
+  bool read_only = 6;
+  bool read_only_can_delete = 7;
 }
 
 message AssignRequest {
@@ -291,6 +319,18 @@ message VolumeGrowRequest {
   string data_node = 7;
   uint32 memory_map_max_size_mb = 8;
   string disk_type = 9;
+  // If > 0, grow only when the average fill ratio of the layout's writable
+  // volumes has reached this threshold (e.g. 0.6). Lets callers pre-grow on
+  // fill level with one call, instead of listing volumes to compute the
+  // ratio themselves. Ignored when there are no writable volumes.
+  float grow_avg_fill_threshold = 10;
+}
+
+message ResumeVolumeGrowthRequest {
+}
+
+message ResumeVolumeGrowthResponse {
+  bool was_frozen = 1;
 }
 
 message AssignResponse {
@@ -406,12 +446,44 @@ message TopologyInfo {
   map<string, DiskInfo> diskInfos = 3;
 }
 message VolumeListRequest {
+  // Empty and zero take everything. Only the volumes and ec shards listed
+  // under a disk are selected; the topology and its disk counters are always
+  // reported in full.
+  string collection = 1;
+  repeated uint32 volume_ids = 2;
+  // The one collection the empty string cannot name. A named collection wins.
+  bool default_collection_only = 3;
+  // Empty and zero take everything. Wildcards are supported.
+  string remote_storage_name = 4;
+  bool local_volume_only = 5;
+  // The topology, its disks and their counters alone, without the volumes
+  // and ec shards. Selecting volumes above contradicts this and is refused.
+  // A master that predates this field ignores it and answers in full.
+  bool topology_only = 6;
 }
 message VolumeListResponse {
   TopologyInfo topology_info = 1;
   uint64 volume_size_limit_mb = 2;
 }
 
+// VolumeListStream answers the same request as VolumeList without either end
+// holding every volume in the cluster at once. At 800k volumes the reply is
+// 36MB on the wire but 305MB as messages, which the master built in full
+// before sending any of it.
+message VolumeListStreamResponse {
+  // Sent once, first, listing no volumes: the topology, its disks and their
+  // counters. Every message after carries volumes for one of those disks.
+  VolumeListResponse header = 1;
+  // Which disk this batch is from. A disk arrives over as many batches as it
+  // takes, so append rather than assign.
+  string data_center = 2;
+  string rack = 3;
+  string data_node = 4;
+  string disk_type = 5;
+  repeated VolumeInformationMessage volume_infos = 6;
+  repeated VolumeEcShardInformationMessage ec_shard_infos = 7;
+}
+
 message LookupEcVolumeRequest {
   uint32 volume_id = 1;
 }
@@ -565,4 +637,9 @@ message RaftLeadershipTransferResponse {
 }
 
 message VolumeGrowResponse {
+  // Average fill ratio of the layout's writable volumes at request time
+  // (0 when there are none). Reported whether or not growth was triggered.
+  float avg_fill = 1;
+  // Number of writable volumes at request time.
+  uint32 writable_count = 2;
 }
diff --git a/seaweed-volume/proto/remote.proto b/seaweed-volume/proto/remote.proto
index d79a79df96..c5d81eda57 100644
--- a/seaweed-volume/proto/remote.proto
+++ b/seaweed-volume/proto/remote.proto
@@ -75,4 +75,6 @@ message RemoteStorageLocation {
   string name = 1;
   string bucket = 2;
   string path = 3;
+  int32 listing_cache_ttl_seconds = 4; // 0 = disabled; >0 enables on-demand directory listing with this TTL in seconds
+  optional int32 cache_wait_ms = 5; // unset = size based default; 0 = read straight from the remote without caching
 }
diff --git a/seaweed-volume/proto/volume_server.proto b/seaweed-volume/proto/volume_server.proto
index 39346899e8..895a7274c1 100644
--- a/seaweed-volume/proto/volume_server.proto
+++ b/seaweed-volume/proto/volume_server.proto
@@ -45,6 +45,8 @@ service VolumeServer {
     }
     rpc VolumeUnmount (VolumeUnmountRequest) returns (VolumeUnmountResponse) {
     }
+    rpc VolumeConsolidateIndex (VolumeConsolidateIndexRequest) returns (VolumeConsolidateIndexResponse) {
+    }
     rpc VolumeDelete (VolumeDeleteRequest) returns (VolumeDeleteResponse) {
     }
     rpc VolumeMarkReadonly (VolumeMarkReadonlyRequest) returns (VolumeMarkReadonlyResponse) {
@@ -166,6 +168,7 @@ message VacuumVolumeCheckRequest {
 }
 message VacuumVolumeCheckResponse {
     double garbage_ratio = 1;
+    bool disk_space_low = 4; // the volume is read-only solely because its disk is low on space — a cause compaction itself reclaims
 }
 
 message VacuumVolumeCompactRequest {
@@ -234,6 +237,7 @@ message VolumeIncrementalCopyResponse {
 
 message VolumeMountRequest {
     uint32 volume_id = 1;
+    optional string collection = 2;
 }
 message VolumeMountResponse {
 }
@@ -244,12 +248,22 @@ message VolumeUnmountRequest {
 message VolumeUnmountResponse {
 }
 
+message VolumeConsolidateIndexRequest {
+    uint32 volume_id = 1;
+}
+message VolumeConsolidateIndexResponse {
+}
+
 message VolumeDeleteRequest {
     uint32 volume_id = 1;
     bool only_empty = 2;
     // when true, do not remove the cloud-tier object backing the volume.
     // used for moves where another server is taking over the same .vif.
     bool keep_remote_data = 3;
+    // when true, delete only if every needle is deleted: the volume held
+    // data once but nothing is live anymore. Passing either check,
+    // only_empty or this one, is enough to delete.
+    bool only_garbage = 4;
 }
 message VolumeDeleteResponse {
 }
@@ -257,6 +271,8 @@ message VolumeDeleteResponse {
 message VolumeMarkReadonlyRequest {
     uint32 volume_id = 1;
     bool persist = 2;
+    // reject writes but keep accepting deletes, so expiring data can drain the volume
+    bool can_delete = 3;
 }
 message VolumeMarkReadonlyResponse {
 }
@@ -460,6 +476,7 @@ message VolumeEcShardsDeleteRequest {
     repeated uint32 shard_ids = 3;
     bool full_teardown = 4; // pre-encode cleanup: wipe every EC artifact + generation for this volume, not just shard_ids
     int64 encode_ts_ns = 5; // full_teardown generation fence: delete only a disk whose .vif generation is strictly OLDER than this; preserve same-or-newer, generation 0, and an unreadable .vif. 0 => wipe-all (shell pre-encode / pre-upgrade)
+    uint32 delete_generations_older_than = 6; // post-commit cleanup: delete only staged <base>.*.v<N> artifacts with N strictly below this; 0 disables
 }
 message VolumeEcShardsDeleteResponse {
     bool full_teardown_done = 1; // set by a new server that performed full_teardown; absent from an old server lets the caller detect the silent no-op
@@ -529,6 +546,7 @@ message VolumeEcShardsInfoResponse {
     uint64 volume_size = 2;
     uint64 file_count = 3;
     uint64 file_deleted_count = 4;
+    EcShardConfig ec_shard_config = 10;  // the layout this holder serves reads through; a binary predating a field reports it as unset
 }
 
 message EcShardInfo {
@@ -553,6 +571,7 @@ message ReadVolumeFileStatusResponse {
     string disk_type = 9;
     VolumeInfo volume_info = 10;
     uint32 version = 11;
+    uint64 expire_at_sec = 12; // TTL expiry counted from the last write; 0 when the volume never expires
 }
 
 message DiskStatus {
@@ -594,6 +613,7 @@ message VolumeInfo {
     uint64 expire_at_sec = 6; // expiration time of ec volume
     bool read_only = 7;
     EcShardConfig ec_shard_config = 8; // EC shard configuration (optional, null = use default 10+4)
+    bool read_only_can_delete = 9; // with read_only: writes are rejected but deletes still land
 }
 
 // EcShardConfig specifies erasure coding shard configuration
@@ -601,6 +621,7 @@ message EcShardConfig {
     uint32 data_shards = 1;   // Number of data shards (e.g., 10)
     uint32 parity_shards = 2; // Number of parity shards (e.g., 4)
     int64 encode_ts_ns = 3;   // encode time (unix nanos); a read served from a shard of a different encode run is rejected
+    int64 block_size = 4;     // uniform block layout: each shard is a single contiguous block of this many bytes; 0 = legacy 1GiB/1MiB two-tier layout
 }
 // EcBitrotProtection is the entire content of a bitrot checksum sidecar
 // (<base>.ecsum for the legacy generation, <base>.ecsum.v<N> for vacuum
@@ -703,6 +724,7 @@ enum VolumeScrubMode {
     FULL = 2;
     LOCAL = 3;
     CHECKSUM = 4; // EC only: verify each local shard's raw bytes against the bitrot checksum sidecar
+    READS = 5;    // like FULL, but EC intervals no shard can serve are reconstructed from parity
 }
 
 message ScrubVolumeRequest {
diff --git a/seaweed-volume/src/config.rs b/seaweed-volume/src/config.rs
index d5962d2bb4..cf73731cc1 100644
--- a/seaweed-volume/src/config.rs
+++ b/seaweed-volume/src/config.rs
@@ -1,9 +1,31 @@
 use clap::Parser;
+use std::ffi::OsString;
 use std::net::UdpSocket;
 use std::path::{Path, PathBuf};
 
 use crate::security::tls::TlsPolicy;
 
+/// How this module reads the environment.
+///
+/// Production passes [`process_env`]; tests pass a map. Injecting the lookup
+/// is what lets the tests cover `HOME` and the `WEED_*` overrides without
+/// `std::env::set_var`, which is `unsafe` in Rust 2024 because it races with
+/// every other thread in the process — and the lib test binary runs tokio
+/// runtimes, TLS stacks and AWS clients that read the environment lazily on
+/// threads no test mutex can reach.
+type EnvLookup<'a> = &'a dyn Fn(&str) -> Option<OsString>;
+
+/// The real process environment, as an [`EnvLookup`].
+fn process_env(key: &str) -> Option<OsString> {
+    std::env::var_os(key)
+}
+
+/// `std::env::var`'s view of an [`EnvLookup`]: unset and non-UTF-8 both read
+/// as absent, exactly as `std::env::var(key).ok()` does.
+fn env_string(env: EnvLookup<'_>, key: &str) -> Option<String> {
+    env(key).and_then(|value| value.into_string().ok())
+}
+
 /// SeaweedFS Volume Server (Rust implementation)
 ///
 /// Start a volume server to provide storage spaces.
@@ -64,6 +86,8 @@ pub struct Cli {
     pub rack: String,
 
     /// Choose [memory|redb|redbMedium|redbLarge] mode for memory~performance balance.
+    /// The redb tiers give each volume's on-disk index a 4, 8, or 16 MiB page
+    /// cache respectively; total index memory is roughly (volumes x cache).
     /// `leveldb`/`leveldbMedium`/`leveldbLarge` are accepted as aliases for the
     /// corresponding redb backends (Rust volume server uses redb under the hood).
     #[arg(long = "index", default_value = "memory")]
@@ -101,6 +125,11 @@ pub struct Cli {
     #[arg(long = "maintenanceMBps", default_value_t = 0)]
     pub maintenance_mb_per_second: u32,
 
+    /// Limit how many vacuum commits run at once on this server; queued
+    /// commits hold no volume lock. 0 means unlimited.
+    #[arg(long = "compactionMaxParallelCommits", default_value_t = 0)]
+    pub max_parallel_vacuum_commits: usize,
+
     /// Limit file size to avoid out of memory.
     #[arg(long = "fileSizeLimitMB", default_value_t = 256)]
     pub file_size_limit_mb: u32,
@@ -154,12 +183,22 @@ pub struct Cli {
     pub min_free_space: String,
 
     /// Inflight upload data wait timeout of volume servers.
-    #[arg(long = "inflightUploadDataTimeout", default_value = "60s")]
-    pub inflight_upload_data_timeout: String,
+    /// Go `time.Duration` syntax: `300ms`, `1.5h`, `2h45m`; a bare number other than `0` is rejected.
+    #[arg(
+        long = "inflightUploadDataTimeout",
+        default_value = "60s",
+        value_parser = parse_go_duration
+    )]
+    pub inflight_upload_data_timeout: std::time::Duration,
 
     /// Inflight download data wait timeout of volume servers.
-    #[arg(long = "inflightDownloadDataTimeout", default_value = "60s")]
-    pub inflight_download_data_timeout: String,
+    /// Go `time.Duration` syntax: `300ms`, `1.5h`, `2h45m`; a bare number other than `0` is rejected.
+    #[arg(
+        long = "inflightDownloadDataTimeout",
+        default_value = "60s",
+        value_parser = parse_go_duration
+    )]
+    pub inflight_download_data_timeout: std::time::Duration,
 
     /// <experimental> if true, prevents slow reads from blocking other requests,
     /// but large file read P99 latency will increase.
@@ -194,6 +233,25 @@ pub struct Cli {
     #[arg(long = "volume.allowUntrustedRemoteEndpoints", default_value_t = false)]
     pub allow_untrusted_remote_endpoints: bool,
 
+    /// Minimum bytes an fsync batch gathers before a drained queue flushes
+    /// without waiting.
+    #[arg(long = "fsyncMinBatchBytes", default_value_t = 1024 * 1024)]
+    pub fsync_min_batch_bytes: u64,
+
+    /// Minimum requests an fsync batch gathers before a drained queue flushes
+    /// without waiting.
+    #[arg(long = "fsyncMinBatchRequests", default_value_t = 128)]
+    pub fsync_min_batch_requests: usize,
+
+    /// How long a below-minimum fsync batch waits for more requests once the
+    /// queue drains; 0 flushes immediately.
+    #[arg(
+        long = "fsyncBatchWait",
+        default_value = "500us",
+        value_parser = parse_go_duration
+    )]
+    pub fsync_batch_wait: std::time::Duration,
+
     /// A file of command line options, each line in optionName=optionValue format.
     #[arg(long = "options", default_value = "")]
     pub options: String,
@@ -229,6 +287,8 @@ pub struct VolumeServerConfig {
     pub mem_profile: String,
     pub compaction_byte_per_second: i64,
     pub maintenance_byte_per_second: i64,
+    /// Max concurrent vacuum commits; 0 means unlimited.
+    pub max_parallel_vacuum_commits: usize,
     pub file_size_limit_bytes: i64,
     pub concurrent_upload_limit: i64,
     pub concurrent_download_limit: i64,
@@ -256,17 +316,25 @@ pub struct VolumeServerConfig {
     pub https_client_ca_file: String,
     pub grpc_cert_file: String,
     pub grpc_key_file: String,
+    pub grpc_client_cert_file: String,
+    pub grpc_client_key_file: String,
     pub grpc_ca_file: String,
     pub grpc_allowed_wildcard_domain: String,
     pub grpc_volume_allowed_common_names: Vec<String>,
     pub tls_policy: TlsPolicy,
-    /// Enable batched write queue for improved throughput under load.
-    pub enable_write_queue: bool,
     /// Path to security.toml — stored for SIGHUP reload.
     pub security_file: String,
     /// If true, FetchAndWriteNeedle skips remote S3 endpoint validation
     /// (allows loopback / link-local / metadata hosts).
     pub allow_untrusted_remote_endpoints: bool,
+    /// Minimum bytes an fsync batch gathers before a drained queue flushes
+    /// without waiting.
+    pub fsync_min_batch_bytes: u64,
+    /// Minimum requests an fsync batch gathers before a drained queue flushes
+    /// without waiting.
+    pub fsync_min_batch_requests: usize,
+    /// How long a below-minimum fsync batch waits for stragglers.
+    pub fsync_batch_wait: std::time::Duration,
 }
 
 pub use crate::storage::needle_map::NeedleMapKind;
@@ -330,7 +398,7 @@ pub fn parse_cli() -> VolumeServerConfig {
     let normalized = normalize_args_vec(args);
     let merged = merge_options_file(normalized);
     let cli = Cli::parse_from(merged);
-    resolve_config(cli)
+    resolve_config_with_env(cli, &process_env)
 }
 
 /// Find `-options`/`--options` in args, parse the referenced file, and inject
@@ -367,17 +435,18 @@ fn merge_options_file(args: Vec<String>) -> Vec<String> {
         if arg == "--" {
             break;
         }
-        if arg.starts_with("--") {
-            let key = if let Some(eq) = arg.find('=') {
-                arg[2..eq].to_string()
+        if let Some(long) = arg.strip_prefix("--") {
+            let key = if let Some(eq) = long.find('=') {
+                long[..eq].to_string()
             } else {
-                arg[2..].to_string()
+                long.to_string()
             };
             cli_flags.insert(key);
-        } else if arg.starts_with('-') && arg.len() > 2 {
+        } else if arg.len() > 2
+            && let Some(without_dash) = arg.strip_prefix('-')
+        {
             // Single-dash long option (already normalized to -- at this point,
             // but handle both for safety)
-            let without_dash = &arg[1..];
             let key = if let Some(eq) = without_dash.find('=') {
                 without_dash[..eq].to_string()
             } else {
@@ -397,15 +466,14 @@ fn merge_options_file(args: Vec<String>) -> Vec<String> {
         }
 
         // Split on first `=`, ` `, or `:`
-        let (name, value) =
-            if let Some(pos) = trimmed.find(|c: char| c == '=' || c == ' ' || c == ':') {
-                (
-                    trimmed[..pos].trim().to_string(),
-                    trimmed[pos + 1..].trim().to_string(),
-                )
-            } else {
-                (trimmed.to_string(), String::new())
-            };
+        let (name, value) = if let Some(pos) = trimmed.find(['=', ' ', ':']) {
+            (
+                trimmed[..pos].trim().to_string(),
+                trimmed[pos + 1..].trim().to_string(),
+            )
+        } else {
+            (trimmed.to_string(), String::new())
+        };
 
         // Strip leading dashes from name
         let name = name.trim_start_matches('-').to_string();
@@ -432,10 +500,8 @@ fn merge_options_file(args: Vec<String>) -> Vec<String> {
 /// Extract the options file path from args (looks for --options or -options).
 fn find_options_arg(args: &[String]) -> String {
     for i in 1..args.len() {
-        if args[i] == "--options" || args[i] == "-options" {
-            if i + 1 < args.len() {
-                return args[i + 1].clone();
-            }
+        if (args[i] == "--options" || args[i] == "-options") && i + 1 < args.len() {
+            return args[i + 1].clone();
         }
         if let Some(rest) = args[i].strip_prefix("--options=") {
             return rest.to_string();
@@ -447,97 +513,214 @@ fn find_options_arg(args: &[String]) -> String {
     String::new()
 }
 
-/// Parse a duration string like "60s", "5m", "1h" into a std::time::Duration.
-fn parse_duration(s: &str) -> std::time::Duration {
-    let s = s.trim();
+/// Parse a duration with Go's `time.ParseDuration` grammar, as Go's
+/// `flag.Duration` flags do: `[0-9]*(\.[0-9]*)?<unit>` repeated, units
+/// `ns`/`us`/`µs`/`μs`/`ms`/`s`/`m`/`h`. A bare `0` is the only unit-less
+/// value; a leading sign parses in Go but a negative has no
+/// `std::time::Duration`, so it is an error, not a clamp.
+fn parse_go_duration(s: &str) -> Result<std::time::Duration, String> {
+    let orig = s;
+    let invalid = || format!("time: invalid duration {:?}", orig);
+
+    let mut s = s;
+    if let Some(rest) = s.strip_prefix('-') {
+        if rest.is_empty() {
+            return Err(invalid());
+        }
+        return Err(format!("negative duration {:?} is not supported", orig));
+    }
+    if let Some(rest) = s.strip_prefix('+') {
+        s = rest;
+    }
+    if s == "0" {
+        return Ok(std::time::Duration::ZERO);
+    }
     if s.is_empty() {
-        return std::time::Duration::from_secs(60);
+        return Err(invalid());
     }
-    if let Some(secs) = s.strip_suffix('s') {
-        if let Ok(v) = secs.parse::<u64>() {
-            return std::time::Duration::from_secs(v);
+
+    // Go bounds the total by 1<<63 (int64 nanoseconds): overflow is an error.
+    const MAX: u64 = 1 << 63;
+    let mut total: u64 = 0;
+    let mut bytes = s.as_bytes();
+    while !bytes.is_empty() {
+        if !(bytes[0] == b'.' || bytes[0].is_ascii_digit()) {
+            return Err(invalid());
         }
-    }
-    if let Some(mins) = s.strip_suffix('m') {
-        if let Ok(v) = mins.parse::<u64>() {
-            return std::time::Duration::from_secs(v * 60);
+
+        // Consume [0-9]*
+        let mut i = 0;
+        let mut v: u64 = 0;
+        while i < bytes.len() && bytes[i].is_ascii_digit() {
+            v = v
+                .checked_mul(10)
+                .and_then(|v| v.checked_add(u64::from(bytes[i] - b'0')))
+                .filter(|v| *v <= MAX)
+                .ok_or_else(invalid)?;
+            i += 1;
         }
-    }
-    if let Some(hours) = s.strip_suffix('h') {
-        if let Ok(v) = hours.parse::<u64>() {
-            return std::time::Duration::from_secs(v * 3600);
+        let pre = i != 0;
+        bytes = &bytes[i..];
+
+        // Consume (\.[0-9]*)?
+        let mut f: u64 = 0;
+        let mut scale: f64 = 1.0;
+        let mut post = false;
+        if let Some((b'.', rest)) = bytes.split_first() {
+            bytes = rest;
+            let mut i = 0;
+            let mut overflow = false;
+            while i < bytes.len() && bytes[i].is_ascii_digit() {
+                if !overflow {
+                    // Like Go's leadingFraction, digits past ~19 are dropped.
+                    match f
+                        .checked_mul(10)
+                        .and_then(|f| f.checked_add(u64::from(bytes[i] - b'0')))
+                        .filter(|f| *f <= MAX)
+                    {
+                        Some(next) => {
+                            f = next;
+                            scale *= 10.0;
+                        }
+                        None => overflow = true,
+                    }
+                }
+                i += 1;
+            }
+            post = i != 0;
+            bytes = &bytes[i..];
         }
+        if !pre && !post {
+            return Err(invalid());
+        }
+
+        // Consume the unit: everything up to the next digit or '.'.
+        let unit_len = bytes
+            .iter()
+            .position(|c| *c == b'.' || c.is_ascii_digit())
+            .unwrap_or(bytes.len());
+        if unit_len == 0 {
+            return Err(format!("time: missing unit in duration {:?}", orig));
+        }
+        // The boundary is an ASCII byte or the end, so it is a char boundary.
+        let unit = std::str::from_utf8(&bytes[..unit_len]).map_err(|_| invalid())?;
+        bytes = &bytes[unit_len..];
+        let unit_nanos: u64 = match unit {
+            "ns" => 1,
+            "us" | "\u{00b5}s" | "\u{03bc}s" => 1_000,
+            "ms" => 1_000_000,
+            "s" => 1_000_000_000,
+            "m" => 60 * 1_000_000_000,
+            "h" => 3600 * 1_000_000_000,
+            _ => {
+                return Err(format!(
+                    "time: unknown unit {:?} in duration {:?}",
+                    unit, orig
+                ));
+            }
+        };
+
+        if v > MAX / unit_nanos {
+            return Err(invalid());
+        }
+        v *= unit_nanos;
+        if f > 0 {
+            // Go's float math, so `1.5h` rounds the same way on both sides.
+            v += (f as f64 * (unit_nanos as f64 / scale)) as u64;
+            if v > MAX {
+                return Err(invalid());
+            }
+        }
+        total = total
+            .checked_add(v)
+            .filter(|t| *t <= MAX)
+            .ok_or_else(invalid)?;
     }
-    // Fallback: try parsing as raw seconds
-    if let Ok(v) = s.parse::<u64>() {
-        return std::time::Duration::from_secs(v);
+    if total > MAX - 1 {
+        return Err(invalid());
     }
-    std::time::Duration::from_secs(60)
+    Ok(std::time::Duration::from_nanos(total))
 }
 
-/// Parse minFreeSpace / minFreeSpacePercent into MinFreeSpace values.
-/// Mirrors Go's `util.MustParseMinFreeSpace()`.
-fn parse_min_free_spaces(min_free_space: &str, min_free_space_percent: &str) -> Vec<MinFreeSpace> {
-    // If --minFreeSpace is provided, use it (takes precedence).
+/// Byte-size suffixes of Go's `util.ParseBytes`, lower-cased: SI (`kb`, `k`)
+/// and IEC (`kib`, `ki`) forms, `b`, and no suffix.
+fn byte_unit_multiplier(unit: &str) -> Option<u64> {
+    const K: u64 = 1_000;
+    const KI: u64 = 1 << 10;
+    Some(match unit {
+        "" | "b" => 1,
+        "kb" | "k" => K,
+        "kib" | "ki" => KI,
+        "mb" | "m" => K * K,
+        "mib" | "mi" => KI * KI,
+        "gb" | "g" => K * K * K,
+        "gib" | "gi" => KI * KI * KI,
+        "tb" | "t" => K * K * K * K,
+        "tib" | "ti" => KI * KI * KI * KI,
+        "pb" | "p" => K * K * K * K * K,
+        "pib" | "pi" => KI * KI * KI * KI * KI,
+        "eb" | "e" => K * K * K * K * K * K,
+        "eib" | "ei" => KI * KI * KI * KI * KI * KI,
+        _ => return None,
+    })
+}
+
+/// Parse a human-readable byte count with Go's `util.ParseBytes` grammar:
+/// decimal number, optional whitespace, then a [`byte_unit_multiplier`]
+/// suffix, case-insensitive. `10GiB` → 10737418240, `1.5TB` → 1500000000000.
+///
+/// Thousands commas parse as in Go but never arrive from `-minFreeSpace`,
+/// which is split on commas into per-directory entries first.
+fn parse_bytes(s: &str) -> Result<u64, String> {
+    let digits_end = s
+        .find(|c: char| !(c.is_ascii_digit() || c == '.' || c == ','))
+        .unwrap_or(s.len());
+    let num = s[..digits_end].replace(',', "");
+    let value: f64 = num
+        .parse()
+        .map_err(|e| format!("invalid byte size {:?}: {}", s, e))?;
+    let unit = s[digits_end..].trim().to_lowercase();
+    let multiplier =
+        byte_unit_multiplier(&unit).ok_or_else(|| format!("unhandled size name: {}", unit))?;
+    let bytes = value * multiplier as f64;
+    if bytes >= u64::MAX as f64 {
+        return Err(format!("too large: {}", s));
+    }
+    Ok(bytes as u64)
+}
+
+/// Parse one `-minFreeSpace` entry like Go's `util.ParseMinFreeSpace()`: a
+/// plain number is a percentage in `0..=100`, anything else a byte size
+/// above 100 bytes. `150` errors rather than reading as bytes.
+fn parse_min_free_space(s: &str) -> Result<MinFreeSpace, String> {
+    let s = s.trim();
+    if let Ok(percent) = s.parse::<f64>() {
+        // Go's range check lets NaN through; rejecting it is the one
+        // intentional difference.
+        if !(0.0..=100.0).contains(&percent) {
+            return Err(format!("minFreeSpace is invalid: {:?}", s));
+        }
+        return Ok(MinFreeSpace::Percent(percent));
+    }
+    match parse_bytes(s) {
+        Ok(bytes) if bytes > 100 => Ok(MinFreeSpace::Bytes(bytes)),
+        _ => Err(format!("minFreeSpace is invalid: {:?}", s)),
+    }
+}
+
+/// Parse minFreeSpace / minFreeSpacePercent like Go's
+/// `util.MustParseMinFreeSpace()`: `--minFreeSpace` wins when set, and any
+/// invalid comma-separated entry fails the whole list.
+fn parse_min_free_spaces(
+    min_free_space: &str,
+    min_free_space_percent: &str,
+) -> Result<Vec<MinFreeSpace>, String> {
     let source = if !min_free_space.is_empty() {
         min_free_space
     } else {
         min_free_space_percent
     };
-
-    source
-        .split(',')
-        .map(|s| {
-            let s = s.trim();
-            // Try parsing as a percentage (value <= 100)
-            if let Ok(v) = s.parse::<f64>() {
-                if v <= 100.0 {
-                    return MinFreeSpace::Percent(v);
-                }
-                // Treat as bytes if > 100
-                return MinFreeSpace::Bytes(v as u64);
-            }
-            // Try parsing human-readable bytes: e.g. "10GiB", "500MiB", "1TiB"
-            let s_upper = s.to_uppercase();
-            if let Some(rest) = s_upper.strip_suffix("TIB") {
-                if let Ok(v) = rest.trim().parse::<f64>() {
-                    return MinFreeSpace::Bytes((v * 1024.0 * 1024.0 * 1024.0 * 1024.0) as u64);
-                }
-            }
-            if let Some(rest) = s_upper.strip_suffix("GIB") {
-                if let Ok(v) = rest.trim().parse::<f64>() {
-                    return MinFreeSpace::Bytes((v * 1024.0 * 1024.0 * 1024.0) as u64);
-                }
-            }
-            if let Some(rest) = s_upper.strip_suffix("MIB") {
-                if let Ok(v) = rest.trim().parse::<f64>() {
-                    return MinFreeSpace::Bytes((v * 1024.0 * 1024.0) as u64);
-                }
-            }
-            if let Some(rest) = s_upper.strip_suffix("KIB") {
-                if let Ok(v) = rest.trim().parse::<f64>() {
-                    return MinFreeSpace::Bytes((v * 1024.0) as u64);
-                }
-            }
-            if let Some(rest) = s_upper.strip_suffix("TB") {
-                if let Ok(v) = rest.trim().parse::<f64>() {
-                    return MinFreeSpace::Bytes((v * 1_000_000_000_000.0) as u64);
-                }
-            }
-            if let Some(rest) = s_upper.strip_suffix("GB") {
-                if let Ok(v) = rest.trim().parse::<f64>() {
-                    return MinFreeSpace::Bytes((v * 1_000_000_000.0) as u64);
-                }
-            }
-            if let Some(rest) = s_upper.strip_suffix("MB") {
-                if let Ok(v) = rest.trim().parse::<f64>() {
-                    return MinFreeSpace::Bytes((v * 1_000_000.0) as u64);
-                }
-            }
-            // Default: 1%
-            MinFreeSpace::Percent(1.0)
-        })
-        .collect()
+    source.split(',').map(parse_min_free_space).collect()
 }
 
 /// Parse comma-separated tag groups like "fast:ssd,archive" into per-folder tag vectors.
@@ -580,7 +763,7 @@ fn parse_volume_tags(tags_arg: &str, folder_count: usize) -> Vec<Vec<String>> {
     folder_tags
 }
 
-fn resolve_config(cli: Cli) -> VolumeServerConfig {
+fn resolve_config_with_env(cli: Cli, env: EnvLookup<'_>) -> VolumeServerConfig {
     // Backward compatibility: --mserver overrides --master
     let master_string = if !cli.mserver.is_empty() {
         &cli.mserver
@@ -631,7 +814,9 @@ fn resolve_config(cli: Cli) -> VolumeServerConfig {
 
     // Parse min free spaces
     let mut min_free_spaces =
-        parse_min_free_spaces(&cli.min_free_space, &cli.min_free_space_percent);
+        parse_min_free_spaces(&cli.min_free_space, &cli.min_free_space_percent).unwrap_or_else(
+            |e| panic!("The value specified in -minFreeSpace not a valid value: {e}"),
+        );
     if min_free_spaces.len() == 1 && folder_count > 1 {
         let v = min_free_spaces[0].clone();
         min_free_spaces.resize(folder_count, v);
@@ -735,7 +920,7 @@ fn resolve_config(cli: Cli) -> VolumeServerConfig {
     };
 
     // Parse security config from TOML file
-    let sec = parse_security_config(&cli.security_file);
+    let sec = parse_security_config_with_env(&cli.security_file, env);
 
     // Parse whitelist: merge CLI --whiteList with guard.white_list from security.toml
     let mut white_list: Vec<String> = cli
@@ -746,10 +931,6 @@ fn resolve_config(cli: Cli) -> VolumeServerConfig {
         .collect();
     white_list.extend(sec.guard_white_list.iter().cloned());
 
-    // Parse durations
-    let inflight_upload_data_timeout = parse_duration(&cli.inflight_upload_data_timeout);
-    let inflight_download_data_timeout = parse_duration(&cli.inflight_download_data_timeout);
-
     VolumeServerConfig {
         port: cli.port,
         grpc_port,
@@ -778,11 +959,15 @@ fn resolve_config(cli: Cli) -> VolumeServerConfig {
         mem_profile: cli.mem_profile,
         compaction_byte_per_second: cli.compaction_mb_per_second as i64 * 1024 * 1024,
         maintenance_byte_per_second: cli.maintenance_mb_per_second as i64 * 1024 * 1024,
+        max_parallel_vacuum_commits: cli.max_parallel_vacuum_commits,
         file_size_limit_bytes: cli.file_size_limit_mb as i64 * 1024 * 1024,
         concurrent_upload_limit: cli.concurrent_upload_limit_mb as i64 * 1024 * 1024,
         concurrent_download_limit: cli.concurrent_download_limit_mb as i64 * 1024 * 1024,
-        inflight_upload_data_timeout,
-        inflight_download_data_timeout,
+        inflight_upload_data_timeout: cli.inflight_upload_data_timeout,
+        inflight_download_data_timeout: cli.inflight_download_data_timeout,
+        fsync_min_batch_bytes: cli.fsync_min_batch_bytes,
+        fsync_min_batch_requests: cli.fsync_min_batch_requests,
+        fsync_batch_wait: cli.fsync_batch_wait,
         has_slow_read: cli.has_slow_read,
         read_buffer_size_mb: cli.read_buffer_size_mb,
         ldb_timeout: cli.ldb_timeout,
@@ -805,13 +990,12 @@ fn resolve_config(cli: Cli) -> VolumeServerConfig {
         https_client_ca_file: sec.https_client_ca_file,
         grpc_cert_file: sec.grpc_cert_file,
         grpc_key_file: sec.grpc_key_file,
+        grpc_client_cert_file: sec.grpc_client_cert_file,
+        grpc_client_key_file: sec.grpc_client_key_file,
         grpc_ca_file: sec.grpc_ca_file,
         grpc_allowed_wildcard_domain: sec.grpc_allowed_wildcard_domain,
         grpc_volume_allowed_common_names: sec.grpc_volume_allowed_common_names,
         tls_policy: sec.tls_policy,
-        enable_write_queue: std::env::var("SEAWEED_WRITE_QUEUE")
-            .map(|v| v == "1" || v == "true")
-            .unwrap_or(false),
         security_file: cli.security_file,
         allow_untrusted_remote_endpoints: cli.allow_untrusted_remote_endpoints,
     }
@@ -837,6 +1021,8 @@ pub struct SecurityConfig {
     pub https_client_ca_file: String,
     pub grpc_cert_file: String,
     pub grpc_key_file: String,
+    pub grpc_client_cert_file: String,
+    pub grpc_client_key_file: String,
     pub grpc_ca_file: String,
     pub grpc_allowed_wildcard_domain: String,
     pub grpc_volume_allowed_common_names: Vec<String>,
@@ -882,12 +1068,18 @@ const SECURITY_CONFIG_FILE_NAME: &str = "security.toml";
 /// [grpc.volume]
 /// cert = "/path/to/cert.pem"
 /// key = "/path/to/key.pem"
+/// client_cert = "/path/to/client-cert.pem"
+/// client_key = "/path/to/client-key.pem"
 /// allowed_commonNames = "volume-a.internal,volume-b.internal"
 /// ```
 pub fn parse_security_config(path: &str) -> SecurityConfig {
-    let Some(config_path) = resolve_security_config_path(path) else {
+    parse_security_config_with_env(path, &process_env)
+}
+
+fn parse_security_config_with_env(path: &str, env: EnvLookup<'_>) -> SecurityConfig {
+    let Some(config_path) = resolve_security_config_path(path, env) else {
         let mut cfg = SecurityConfig::default();
-        apply_env_overrides(&mut cfg);
+        apply_env_overrides(&mut cfg, env);
         return cfg;
     };
 
@@ -895,7 +1087,7 @@ pub fn parse_security_config(path: &str) -> SecurityConfig {
         Ok(c) => c,
         Err(_) => {
             let mut cfg = SecurityConfig::default();
-            apply_env_overrides(&mut cfg);
+            apply_env_overrides(&mut cfg, env);
             return cfg;
         }
     };
@@ -977,7 +1169,9 @@ pub fn parse_security_config(path: &str) -> SecurityConfig {
                 },
                 Section::JwtSigning => match key {
                     "key" => cfg.jwt_signing_key = value.as_bytes().to_vec(),
-                    "expires_after_seconds" => cfg.jwt_signing_expires = value.parse().unwrap_or(10),
+                    "expires_after_seconds" => {
+                        cfg.jwt_signing_expires = value.parse().unwrap_or(10)
+                    }
                     _ => {}
                 },
                 Section::HttpsClient => match key {
@@ -1003,6 +1197,8 @@ pub fn parse_security_config(path: &str) -> SecurityConfig {
                 Section::GrpcVolume => match key {
                     "cert" => cfg.grpc_cert_file = value.to_string(),
                     "key" => cfg.grpc_key_file = value.to_string(),
+                    "client_cert" => cfg.grpc_client_cert_file = value.to_string(),
+                    "client_key" => cfg.grpc_client_key_file = value.to_string(),
                     // Go only reads CA from [grpc], not [grpc.volume]
                     "allowed_commonNames" => {
                         cfg.grpc_volume_allowed_common_names =
@@ -1016,20 +1212,20 @@ pub fn parse_security_config(path: &str) -> SecurityConfig {
                     "cipher_suites" => cfg.tls_policy.cipher_suites = value.to_string(),
                     _ => {}
                 },
-                Section::Guard => match key {
-                    "white_list" => {
+                Section::Guard => {
+                    if key == "white_list" {
                         cfg.guard_white_list = value
                             .split(',')
                             .map(|s| s.trim().to_string())
                             .filter(|s| !s.is_empty())
                             .collect();
                     }
-                    _ => {}
-                },
-                Section::Access => match key {
-                    "ui" => cfg.access_ui = value.parse().unwrap_or(false),
-                    _ => {}
-                },
+                }
+                Section::Access => {
+                    if key == "ui" {
+                        cfg.access_ui = value.parse().unwrap_or(false)
+                    }
+                }
                 Section::None => {}
             }
         }
@@ -1047,19 +1243,19 @@ pub fn parse_security_config(path: &str) -> SecurityConfig {
     // Override with WEED_ environment variables (matches Go's Viper convention:
     // prefix WEED_, uppercase, replace . with _).
     // e.g. WEED_JWT_SIGNING_KEY overrides [jwt.signing] key
-    apply_env_overrides(&mut cfg);
+    apply_env_overrides(&mut cfg, env);
 
     cfg
 }
 
-fn resolve_security_config_path(path: &str) -> Option<PathBuf> {
+fn resolve_security_config_path(path: &str, env: EnvLookup<'_>) -> Option<PathBuf> {
     if !path.is_empty() {
         return Some(PathBuf::from(path));
     }
 
     default_security_config_candidates(
         std::env::current_dir().ok().as_deref(),
-        home_dir_from_env().as_deref(),
+        home_dir_from_env(env).as_deref(),
     )
     .into_iter()
     .find(|candidate| candidate.is_file())
@@ -1081,12 +1277,12 @@ fn default_security_config_candidates(
     candidates
 }
 
-fn home_dir_from_env() -> Option<PathBuf> {
-    std::env::var_os("HOME")
+fn home_dir_from_env(env: EnvLookup<'_>) -> Option<PathBuf> {
+    env("HOME")
         .filter(|v| !v.is_empty())
         .map(PathBuf::from)
         .or_else(|| {
-            std::env::var_os("USERPROFILE")
+            env("USERPROFILE")
                 .filter(|v| !v.is_empty())
                 .map(PathBuf::from)
         })
@@ -1094,74 +1290,80 @@ fn home_dir_from_env() -> Option<PathBuf> {
 
 /// Apply WEED_ environment variable overrides to a SecurityConfig.
 /// Matches Go's Viper convention: WEED_ prefix, uppercase, dots replaced with underscores.
-fn apply_env_overrides(cfg: &mut SecurityConfig) {
-    if let Ok(v) = std::env::var("WEED_JWT_SIGNING_KEY") {
+fn apply_env_overrides(cfg: &mut SecurityConfig, env: EnvLookup<'_>) {
+    if let Some(v) = env_string(env, "WEED_JWT_SIGNING_KEY") {
         cfg.jwt_signing_key = v.into_bytes();
     }
-    if let Ok(v) = std::env::var("WEED_JWT_SIGNING_EXPIRES_AFTER_SECONDS") {
+    if let Some(v) = env_string(env, "WEED_JWT_SIGNING_EXPIRES_AFTER_SECONDS") {
         cfg.jwt_signing_expires = v.parse().unwrap_or(cfg.jwt_signing_expires);
     }
-    if let Ok(v) = std::env::var("WEED_JWT_SIGNING_READ_KEY") {
+    if let Some(v) = env_string(env, "WEED_JWT_SIGNING_READ_KEY") {
         cfg.jwt_read_signing_key = v.into_bytes();
     }
-    if let Ok(v) = std::env::var("WEED_JWT_SIGNING_READ_EXPIRES_AFTER_SECONDS") {
+    if let Some(v) = env_string(env, "WEED_JWT_SIGNING_READ_EXPIRES_AFTER_SECONDS") {
         cfg.jwt_read_signing_expires = v.parse().unwrap_or(cfg.jwt_read_signing_expires);
     }
-    if let Ok(v) = std::env::var("WEED_HTTPS_VOLUME_CERT") {
+    if let Some(v) = env_string(env, "WEED_HTTPS_VOLUME_CERT") {
         cfg.https_cert_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_HTTPS_VOLUME_KEY") {
+    if let Some(v) = env_string(env, "WEED_HTTPS_VOLUME_KEY") {
         cfg.https_key_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_HTTPS_VOLUME_CA") {
+    if let Some(v) = env_string(env, "WEED_HTTPS_VOLUME_CA") {
         cfg.https_ca_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_HTTPS_CLIENT_ENABLED") {
+    if let Some(v) = env_string(env, "WEED_HTTPS_CLIENT_ENABLED") {
         cfg.https_client_enabled = v == "true" || v == "1";
     }
-    if let Ok(v) = std::env::var("WEED_HTTPS_CLIENT_CERT") {
+    if let Some(v) = env_string(env, "WEED_HTTPS_CLIENT_CERT") {
         cfg.https_client_cert_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_HTTPS_CLIENT_KEY") {
+    if let Some(v) = env_string(env, "WEED_HTTPS_CLIENT_KEY") {
         cfg.https_client_key_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_HTTPS_CLIENT_CA") {
+    if let Some(v) = env_string(env, "WEED_HTTPS_CLIENT_CA") {
         cfg.https_client_ca_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_GRPC_VOLUME_CERT") {
+    if let Some(v) = env_string(env, "WEED_GRPC_VOLUME_CERT") {
         cfg.grpc_cert_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_GRPC_VOLUME_KEY") {
+    if let Some(v) = env_string(env, "WEED_GRPC_VOLUME_KEY") {
         cfg.grpc_key_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_GRPC_CA") {
+    if let Some(v) = env_string(env, "WEED_GRPC_VOLUME_CLIENT_CERT") {
+        cfg.grpc_client_cert_file = v;
+    }
+    if let Some(v) = env_string(env, "WEED_GRPC_VOLUME_CLIENT_KEY") {
+        cfg.grpc_client_key_file = v;
+    }
+    if let Some(v) = env_string(env, "WEED_GRPC_CA") {
         cfg.grpc_ca_file = v;
-    } else if let Ok(v) = std::env::var("WEED_GRPC_VOLUME_CA") {
+    } else if let Some(v) = env_string(env, "WEED_GRPC_VOLUME_CA") {
         cfg.grpc_ca_file = v;
     }
-    if let Ok(v) = std::env::var("WEED_GRPC_ALLOWED_WILDCARD_DOMAIN") {
+    if let Some(v) = env_string(env, "WEED_GRPC_ALLOWED_WILDCARD_DOMAIN") {
         cfg.grpc_allowed_wildcard_domain = v;
     }
-    if let Ok(v) = std::env::var("WEED_GRPC_VOLUME_ALLOWED_COMMONNAMES") {
+    if let Some(v) = env_string(env, "WEED_GRPC_VOLUME_ALLOWED_COMMONNAMES") {
         cfg.grpc_volume_allowed_common_names = v.split(',').map(|name| name.to_string()).collect();
     }
-    if let Ok(v) = std::env::var("WEED_TLS_MIN_VERSION") {
+    if let Some(v) = env_string(env, "WEED_TLS_MIN_VERSION") {
         cfg.tls_policy.min_version = v;
     }
-    if let Ok(v) = std::env::var("WEED_TLS_MAX_VERSION") {
+    if let Some(v) = env_string(env, "WEED_TLS_MAX_VERSION") {
         cfg.tls_policy.max_version = v;
     }
-    if let Ok(v) = std::env::var("WEED_TLS_CIPHER_SUITES") {
+    if let Some(v) = env_string(env, "WEED_TLS_CIPHER_SUITES") {
         cfg.tls_policy.cipher_suites = v;
     }
-    if let Ok(v) = std::env::var("WEED_GUARD_WHITE_LIST") {
+    if let Some(v) = env_string(env, "WEED_GUARD_WHITE_LIST") {
         cfg.guard_white_list = v
             .split(',')
             .map(|s| s.trim().to_string())
             .filter(|s| !s.is_empty())
             .collect();
     }
-    if let Ok(v) = std::env::var("WEED_ACCESS_UI") {
+    if let Some(v) = env_string(env, "WEED_ACCESS_UI") {
         cfg.access_ui = v == "true" || v == "1";
     }
 }
@@ -1170,12 +1372,11 @@ fn apply_env_overrides(cfg: &mut SecurityConfig) {
 /// Mirrors Go's `util.DetectedHostAddress()`.
 fn detect_host_address() -> String {
     // Connect to a remote address to determine the local outbound IP
-    if let Ok(socket) = UdpSocket::bind("0.0.0.0:0") {
-        if socket.connect("8.8.8.8:80").is_ok() {
-            if let Ok(addr) = socket.local_addr() {
-                return addr.ip().to_string();
-            }
-        }
+    if let Ok(socket) = UdpSocket::bind("0.0.0.0:0")
+        && socket.connect("8.8.8.8:80").is_ok()
+        && let Ok(addr) = socket.local_addr()
+    {
+        return addr.ip().to_string();
     }
     "localhost".to_string()
 }
@@ -1183,32 +1384,21 @@ fn detect_host_address() -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::ffi::OsString;
+    use std::collections::HashMap;
     use std::sync::{Mutex, MutexGuard, OnceLock};
 
+    /// Serialises the tests that move the process working directory against
+    /// the ones that read it. `set_current_dir` is safe, but it is still
+    /// process-global: without this, a `parse_security_config("")` in one test
+    /// would search another test's temporary directory.
+    ///
+    /// Nothing here guards the environment any more — tests inject an
+    /// [`EnvLookup`] instead of mutating the real one.
     fn process_state_lock() -> MutexGuard<'static, ()> {
         static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
         LOCK.get_or_init(|| Mutex::new(())).lock().unwrap()
     }
 
-    fn with_temp_env_var<F: FnOnce()>(key: &str, value: Option<&str>, f: F) {
-        let previous = std::env::var_os(key);
-        match value {
-            Some(v) => std::env::set_var(key, v),
-            None => std::env::remove_var(key),
-        }
-        f();
-        restore_env_var(key, previous);
-    }
-
-    fn restore_env_var(key: &str, value: Option<OsString>) {
-        if let Some(value) = value {
-            std::env::set_var(key, value);
-        } else {
-            std::env::remove_var(key);
-        }
-    }
-
     fn with_temp_current_dir<F: FnOnce()>(dir: &Path, f: F) {
         let previous = std::env::current_dir().unwrap();
         std::env::set_current_dir(dir).unwrap();
@@ -1216,60 +1406,235 @@ mod tests {
         std::env::set_current_dir(previous).unwrap();
     }
 
-    fn with_cleared_security_env<F: FnOnce()>(f: F) {
-        const KEYS: &[&str] = &[
-            "WEED_JWT_SIGNING_KEY",
-            "WEED_JWT_SIGNING_EXPIRES_AFTER_SECONDS",
-            "WEED_JWT_SIGNING_READ_KEY",
-            "WEED_JWT_SIGNING_READ_EXPIRES_AFTER_SECONDS",
-            "WEED_HTTPS_VOLUME_CERT",
-            "WEED_HTTPS_VOLUME_KEY",
-            "WEED_HTTPS_VOLUME_CA",
-            "WEED_HTTPS_CLIENT_ENABLED",
-            "WEED_HTTPS_CLIENT_CERT",
-            "WEED_HTTPS_CLIENT_KEY",
-            "WEED_HTTPS_CLIENT_CA",
-            "WEED_GRPC_VOLUME_CERT",
-            "WEED_GRPC_VOLUME_KEY",
-            "WEED_GRPC_CA",
-            "WEED_GRPC_VOLUME_CA",
-            "WEED_GRPC_ALLOWED_WILDCARD_DOMAIN",
-            "WEED_GRPC_VOLUME_ALLOWED_COMMONNAMES",
-            "WEED_TLS_MIN_VERSION",
-            "WEED_TLS_MAX_VERSION",
-            "WEED_TLS_CIPHER_SUITES",
-            "WEED_GUARD_WHITE_LIST",
-            "WEED_ACCESS_UI",
-        ];
-
-        let previous: Vec<(&str, Option<OsString>)> = KEYS
+    /// The whole environment a test wants the config layer to see, ready to
+    /// pass as `&env`. `&|_| None` is an environment with nothing set at all.
+    fn fake_env(pairs: &[(&str, &str)]) -> impl Fn(&str) -> Option<OsString> + use<> {
+        let map: HashMap<String, OsString> = pairs
             .iter()
-            .map(|key| (*key, std::env::var_os(key)))
+            .map(|(key, value)| ((*key).to_string(), OsString::from(*value)))
             .collect();
+        move |key| map.get(key).cloned()
+    }
 
-        for key in KEYS {
-            std::env::remove_var(key);
-        }
-
-        f();
-
-        for (key, value) in previous {
-            restore_env_var(key, value);
+    #[test]
+    fn test_parse_go_duration_accepts_go_grammar() {
+        use std::time::Duration;
+        let cases = [
+            ("60s", Duration::from_secs(60)),
+            ("5m", Duration::from_secs(300)),
+            ("1h", Duration::from_secs(3600)),
+            ("1.5h", Duration::from_secs(5400)),
+            ("2h45m", Duration::from_secs(2 * 3600 + 45 * 60)),
+            ("300ms", Duration::from_millis(300)),
+            ("1.5s", Duration::from_millis(1500)),
+            ("250us", Duration::from_micros(250)),
+            ("250\u{00b5}s", Duration::from_micros(250)),
+            ("250\u{03bc}s", Duration::from_micros(250)),
+            ("7ns", Duration::from_nanos(7)),
+            (".5s", Duration::from_millis(500)),
+            ("5.s", Duration::from_secs(5)),
+            ("+10s", Duration::from_secs(10)),
+            ("0", Duration::ZERO),
+            ("0s", Duration::ZERO),
+            // Go: fraction digits past the 19th are ignored, not an error.
+            ("1.00000000000000000001s", Duration::from_secs(1)),
+        ];
+        for (input, expected) in cases {
+            assert_eq!(parse_go_duration(input), Ok(expected), "input={:?}", input);
         }
     }
 
     #[test]
-    fn test_parse_duration() {
-        assert_eq!(parse_duration("60s"), std::time::Duration::from_secs(60));
-        assert_eq!(parse_duration("5m"), std::time::Duration::from_secs(300));
-        assert_eq!(parse_duration("1h"), std::time::Duration::from_secs(3600));
-        assert_eq!(parse_duration("30"), std::time::Duration::from_secs(30));
-        assert_eq!(parse_duration(""), std::time::Duration::from_secs(60));
+    fn test_parse_go_duration_rejects_what_go_rejects() {
+        // Each of these makes Go's flag.Duration fail flag parsing; the old
+        // Rust parser turned them all into the 60 s default.
+        let rejected = [
+            "30",                    // bare number other than 0
+            "30sec",                 // unknown unit
+            "abc",                   // no number at all
+            "",                      // empty
+            "1h ",                   // trailing space is not a unit
+            "s",                     // unit without number
+            ".s",                    // dot without digits
+            "1.5",                   // fraction without unit
+            "1h-30m",                // sign is only allowed at the front
+            "-",                     // sign alone
+            "5124095576030432h",     // overflows int64 nanoseconds
+            "307445734561825861m",   // overflows int64 nanoseconds
+            "9223372036854775808ns", // 1<<63, one past int64
+        ];
+        for input in rejected {
+            let result = parse_go_duration(input);
+            assert!(result.is_err(), "input={:?} parsed as {:?}", input, result);
+            let message = result.unwrap_err();
+            assert!(
+                message.contains(&format!("{:?}", input)) || input.is_empty(),
+                "error for {:?} does not name the value: {}",
+                input,
+                message
+            );
+        }
+        // Largest value Go accepts: 1<<63 - 1 nanoseconds.
+        assert_eq!(
+            parse_go_duration("9223372036854775807ns"),
+            Ok(std::time::Duration::from_nanos(i64::MAX as u64))
+        );
+        // Go accepts negatives; std::time::Duration cannot, so it errors.
+        let negative = parse_go_duration("-1s").unwrap_err();
+        assert!(negative.contains("negative"), "{}", negative);
+    }
+
+    /// Clap refuses the flag so the process exits with a usage error, exactly
+    /// where Go's flag package does.
+    #[test]
+    fn test_cli_rejects_invalid_duration_flags() {
+        for value in ["30sec", "abc", "30"] {
+            let result = Cli::try_parse_from(["bin", "--inflightUploadDataTimeout", value]);
+            assert!(
+                result.is_err(),
+                "--inflightUploadDataTimeout={} was accepted as {:?}",
+                value,
+                result.map(|cli| cli.inflight_upload_data_timeout)
+            );
+            let err = Cli::try_parse_from(["bin", "--inflightDownloadDataTimeout", value])
+                .err()
+                .unwrap_or_else(|| panic!("--inflightDownloadDataTimeout={} was accepted", value));
+            assert_eq!(err.kind(), clap::error::ErrorKind::ValueValidation);
+            assert!(err.to_string().contains(value), "{}", err);
+        }
+        let cli = Cli::parse_from(["bin", "--inflightUploadDataTimeout", "1.5h"]);
+        assert_eq!(
+            cli.inflight_upload_data_timeout,
+            std::time::Duration::from_secs(5400)
+        );
+        // The default still parses through the same grammar.
+        let cli = Cli::parse_from(["bin"]);
+        assert_eq!(
+            cli.inflight_upload_data_timeout,
+            std::time::Duration::from_secs(60)
+        );
+        assert_eq!(
+            cli.inflight_download_data_timeout,
+            std::time::Duration::from_secs(60)
+        );
+    }
+
+    #[test]
+    fn test_parse_bytes_matches_go_parse_bytes() {
+        // Expected values are what Go's util.ParseBytes returns (weed/util/bytes_test.go).
+        let cases: [(&str, u64); 14] = [
+            ("42", 42),
+            ("42MB", 42_000_000),
+            ("42 MB", 42_000_000),
+            ("42 mib", 44_040_192),
+            ("42M", 42_000_000),
+            ("100Ki", 100 * 1024),
+            ("10GiB", 10 * 1024 * 1024 * 1024),
+            ("10gib", 10 * 1024 * 1024 * 1024),
+            ("10GB", 10_000_000_000),
+            ("1.5TB", 1_500_000_000_000),
+            // Go's ParseBytes accepts thousands commas; the -minFreeSpace flag
+            // never delivers one (see test_min_free_space_flag_commas_are_list_separators).
+            ("1,024MB", 1_024_000_000),
+            ("1,024", 1024),
+            ("1PiB", 1 << 50),
+            ("1eb", 1_000_000_000_000_000_000),
+        ];
+        for (input, expected) in cases {
+            assert_eq!(parse_bytes(input), Ok(expected), "input={:?}", input);
+        }
+        for input in [
+            "10GiBx",
+            "GiB",
+            "",
+            "-5GB",
+            "1.2.3GB",
+            "10 Gi B",
+            "99999999999999999999EB",
+        ] {
+            assert!(
+                parse_bytes(input).is_err(),
+                "input={:?} was accepted",
+                input
+            );
+        }
+    }
+
+    fn expect_percent(result: Result<MinFreeSpace, String>, expected: f64, input: &str) {
+        match result {
+            Ok(MinFreeSpace::Percent(v)) => {
+                assert!(
+                    (v - expected).abs() < f64::EPSILON,
+                    "input={:?}: {}",
+                    input,
+                    v
+                )
+            }
+            other => panic!(
+                "input={:?}: expected Percent({}), got {:?}",
+                input, expected, other
+            ),
+        }
+    }
+
+    fn expect_bytes(result: Result<MinFreeSpace, String>, expected: u64, input: &str) {
+        match result {
+            Ok(MinFreeSpace::Bytes(v)) => assert_eq!(v, expected, "input={:?}", input),
+            other => panic!(
+                "input={:?}: expected Bytes({}), got {:?}",
+                input, expected, other
+            ),
+        }
+    }
+
+    #[test]
+    fn test_parse_min_free_space_matches_go() {
+        // Fixtures from weed/util/minfreespace_test.go plus the byte-unit table.
+        expect_percent(parse_min_free_space("42"), 42.0, "42");
+        expect_percent(parse_min_free_space(" 42 "), 42.0, " 42 ");
+        expect_percent(parse_min_free_space("50"), 50.0, "50");
+        expect_percent(parse_min_free_space("100"), 100.0, "100");
+        expect_percent(parse_min_free_space("0"), 0.0, "0");
+        expect_percent(parse_min_free_space("2.5"), 2.5, "2.5");
+        expect_bytes(parse_min_free_space("100Ki"), 100 * 1024, "100Ki");
+        expect_bytes(parse_min_free_space("100GiB"), 100 << 30, "100GiB");
+        expect_bytes(parse_min_free_space("42M"), 42_000_000, "42M");
+        expect_bytes(parse_min_free_space(" 42M "), 42_000_000, " 42M ");
+        expect_bytes(parse_min_free_space("10GiB"), 10 << 30, "10GiB");
+        expect_bytes(parse_min_free_space("10gib"), 10 << 30, "10gib");
+        expect_bytes(parse_min_free_space("1.5TB"), 1_500_000_000_000, "1.5TB");
+        // Comma inputs never arrive whole from the flag; see
+        // test_min_free_space_flag_commas_are_list_separators.
+        expect_bytes(parse_min_free_space("1,024MB"), 1_024_000_000, "1,024MB");
+        expect_bytes(parse_min_free_space("1,000"), 1000, "1,000");
+
+        // Go: percent outside 0..=100, or a byte size of at most 100 bytes.
+        for input in [
+            "150", "101", "-1", "1e3", "inf", "nan", "100B", "50B", "0B", "10GiBx", "", "abc",
+            "10 Gi B",
+        ] {
+            let result = parse_min_free_space(input);
+            assert!(
+                result.is_err(),
+                "input={:?} was accepted as {:?}",
+                input,
+                result
+            );
+            assert!(
+                result
+                    .as_ref()
+                    .unwrap_err()
+                    .contains(&format!("{:?}", input.trim())),
+                "error for {:?} does not name the value: {:?}",
+                input,
+                result
+            );
+        }
     }
 
     #[test]
     fn test_parse_min_free_spaces_percent() {
-        let result = parse_min_free_spaces("", "1");
+        let result = parse_min_free_spaces("", "1").unwrap();
         assert_eq!(result.len(), 1);
         match &result[0] {
             MinFreeSpace::Percent(v) => assert!((v - 1.0).abs() < f64::EPSILON),
@@ -1279,7 +1644,7 @@ mod tests {
 
     #[test]
     fn test_parse_min_free_spaces_bytes() {
-        let result = parse_min_free_spaces("10GiB", "");
+        let result = parse_min_free_spaces("10GiB", "").unwrap();
         assert_eq!(result.len(), 1);
         match &result[0] {
             MinFreeSpace::Bytes(v) => assert_eq!(*v, 10 * 1024 * 1024 * 1024),
@@ -1287,6 +1652,87 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_parse_min_free_spaces_list_and_precedence() {
+        // --minFreeSpace wins over --minFreeSpacePercent, as in Go's EmptyTo().
+        let result = parse_min_free_spaces("5, 10GiB", "1").unwrap();
+        assert_eq!(result.len(), 2);
+        assert!(matches!(result[0], MinFreeSpace::Percent(v) if v == 5.0));
+        assert!(matches!(result[1], MinFreeSpace::Bytes(v) if v == 10 << 30));
+        // One bad entry fails the whole list and names that entry.
+        let err = parse_min_free_spaces("5,10GiBx", "1").unwrap_err();
+        assert!(err.contains("\"10GiBx\""), "{}", err);
+        // Both flags empty: Go fatals (ParseMinFreeSpace("") fails) rather than
+        // assuming 1%.
+        assert!(parse_min_free_spaces("", "").is_err());
+    }
+
+    /// A comma in `-minFreeSpace` separates per-directory entries, as in Go's
+    /// `MustParseMinFreeSpace`: `1,024MB` is `1` (percent) and `024MB`, and
+    /// one `-dir` fails the count check.
+    #[test]
+    fn test_min_free_space_flag_commas_are_list_separators() {
+        let result = parse_min_free_spaces("1,024MB", "").unwrap();
+        assert_eq!(result.len(), 2, "{result:?}");
+        assert!(
+            matches!(result[0], MinFreeSpace::Percent(v) if v == 1.0),
+            "{result:?}"
+        );
+        assert!(
+            matches!(result[1], MinFreeSpace::Bytes(v) if v == 24_000_000),
+            "{result:?}"
+        );
+
+        let _guard = process_state_lock();
+        let cli = Cli::parse_from(["bin", "--dir", "/tmp/a", "--minFreeSpace", "1,024MB"]);
+        let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            resolve_config_with_env(cli, &|_| None).min_free_spaces
+        }));
+        assert!(
+            outcome.is_err(),
+            "one -dir with two minFreeSpace entries must abort"
+        );
+    }
+
+    /// Negative control at the startup layer: resolving the config with an
+    /// invalid --minFreeSpace must abort, as Go's MustParseMinFreeSpace does.
+    #[test]
+    fn test_resolve_config_rejects_invalid_min_free_space() {
+        // The security-config search reads the working directory.
+        let _guard = process_state_lock();
+        for (flag, value) in [
+            ("--minFreeSpace", "10GiBx"),
+            ("--minFreeSpace", "150"),
+            ("--minFreeSpace", "50B"),
+            ("--minFreeSpacePercent", "150"),
+            ("--minFreeSpacePercent", "abc"),
+        ] {
+            let cli = Cli::parse_from(["bin", flag, value]);
+            let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+                resolve_config_with_env(cli, &|_| None).min_free_spaces
+            }));
+            let payload = match outcome {
+                Ok(spaces) => panic!("{}={} was accepted as {:?}", flag, value, spaces),
+                Err(payload) => payload,
+            };
+            let message = payload
+                .downcast_ref::<String>()
+                .cloned()
+                .or_else(|| payload.downcast_ref::<&str>().map(|s| s.to_string()))
+                .unwrap_or_default();
+            assert!(
+                message.contains("-minFreeSpace") && message.contains(value),
+                "{}={}: unexpected panic message {:?}",
+                flag,
+                value,
+                message
+            );
+        }
+        let cfg =
+            resolve_config_with_env(Cli::parse_from(["bin", "--minFreeSpace", "100"]), &|_| None);
+        assert!(matches!(cfg.min_free_spaces[0], MinFreeSpace::Percent(v) if v == 100.0));
+    }
+
     #[test]
     fn test_parse_volume_tags_single() {
         let tags = parse_volume_tags("fast:ssd", 3);
@@ -1384,12 +1830,18 @@ mod tests {
 
     #[test]
     fn test_resolve_config_defaults_dir_to_platform_temp_dir() {
-        let cfg = resolve_config(Cli::parse_from(["bin"]));
+        // With no --securityFile, the security-config search reads the process
+        // working directory, so this has to hold the lock against
+        // `with_temp_current_dir`. The environment is injected, not shared.
+        let _guard = process_state_lock();
+        let cfg = resolve_config_with_env(Cli::parse_from(["bin"]), &|_| None);
         assert_eq!(cfg.folders, vec![default_volume_dir()]);
     }
 
     #[test]
     fn test_resolve_config_index_accepts_redb_and_leveldb_aliases() {
+        // As above: the security-config search reads the working directory.
+        let _guard = process_state_lock();
         let pairs = [
             ("memory", NeedleMapKind::InMemory),
             ("redb", NeedleMapKind::Redb),
@@ -1400,14 +1852,14 @@ mod tests {
             ("leveldbLarge", NeedleMapKind::RedbLarge),
         ];
         for (input, expected) in pairs {
-            let cfg = resolve_config(Cli::parse_from(["bin", "--index", input]));
+            let cfg =
+                resolve_config_with_env(Cli::parse_from(["bin", "--index", input]), &|_| None);
             assert_eq!(cfg.index_type, expected, "input={}", input);
         }
     }
 
     #[test]
     fn test_parse_security_config_access_ui() {
-        let _guard = process_state_lock();
         let tmp = tempfile::NamedTempFile::new().unwrap();
         std::fs::write(
             tmp.path(),
@@ -1421,11 +1873,9 @@ ui = true
         )
         .unwrap();
 
-        with_cleared_security_env(|| {
-            let cfg = parse_security_config(tmp.path().to_str().unwrap());
-            assert_eq!(cfg.jwt_signing_key, b"secret");
-            assert!(cfg.access_ui);
-        });
+        let cfg = parse_security_config_with_env(tmp.path().to_str().unwrap(), &|_| None);
+        assert_eq!(cfg.jwt_signing_key, b"secret");
+        assert!(cfg.access_ui);
     }
 
     #[test]
@@ -1442,10 +1892,8 @@ key = "cwd-secret"
         .unwrap();
 
         with_temp_current_dir(tmp.path(), || {
-            with_temp_env_var("WEED_JWT_SIGNING_KEY", None, || {
-                let cfg = parse_security_config("");
-                assert_eq!(cfg.jwt_signing_key, b"cwd-secret");
-            });
+            let cfg = parse_security_config_with_env("", &|_| None);
+            assert_eq!(cfg.jwt_signing_key, b"cwd-secret");
         });
     }
 
@@ -1465,19 +1913,15 @@ key = "home-secret"
         )
         .unwrap();
 
+        let env = fake_env(&[("HOME", home_dir.path().to_str().unwrap())]);
         with_temp_current_dir(current_dir.path(), || {
-            with_temp_env_var("WEED_JWT_SIGNING_KEY", None, || {
-                with_temp_env_var("HOME", Some(home_dir.path().to_str().unwrap()), || {
-                    let cfg = parse_security_config("");
-                    assert_eq!(cfg.jwt_signing_key, b"home-secret");
-                });
-            });
+            let cfg = parse_security_config_with_env("", &env);
+            assert_eq!(cfg.jwt_signing_key, b"home-secret");
         });
     }
 
     #[test]
     fn test_parse_security_config_uses_grpc_root_ca() {
-        let _guard = process_state_lock();
         let tmp = tempfile::NamedTempFile::new().unwrap();
         std::fs::write(
             tmp.path(),
@@ -1492,17 +1936,40 @@ key = "/etc/seaweedfs/volume-key.pem"
         )
         .unwrap();
 
-        with_cleared_security_env(|| {
-            let cfg = parse_security_config(tmp.path().to_str().unwrap());
-            assert_eq!(cfg.grpc_ca_file, "/etc/seaweedfs/grpc-ca.pem");
-            assert_eq!(cfg.grpc_cert_file, "/etc/seaweedfs/volume-cert.pem");
-            assert_eq!(cfg.grpc_key_file, "/etc/seaweedfs/volume-key.pem");
-        });
+        let cfg = parse_security_config_with_env(tmp.path().to_str().unwrap(), &|_| None);
+        assert_eq!(cfg.grpc_ca_file, "/etc/seaweedfs/grpc-ca.pem");
+        assert_eq!(cfg.grpc_cert_file, "/etc/seaweedfs/volume-cert.pem");
+        assert_eq!(cfg.grpc_key_file, "/etc/seaweedfs/volume-key.pem");
+    }
+
+    #[test]
+    fn test_parse_security_config_uses_grpc_volume_client_cert() {
+        let tmp = tempfile::NamedTempFile::new().unwrap();
+        std::fs::write(
+            tmp.path(),
+            r#"
+[grpc.volume]
+cert = "/etc/seaweedfs/volume-cert.pem"
+key = "/etc/seaweedfs/volume-key.pem"
+client_cert = "/etc/seaweedfs/volume-client-cert.pem"
+client_key = "/etc/seaweedfs/volume-client-key.pem"
+"#,
+        )
+        .unwrap();
+
+        let cfg = parse_security_config_with_env(tmp.path().to_str().unwrap(), &|_| None);
+        assert_eq!(
+            cfg.grpc_client_cert_file,
+            "/etc/seaweedfs/volume-client-cert.pem"
+        );
+        assert_eq!(
+            cfg.grpc_client_key_file,
+            "/etc/seaweedfs/volume-client-key.pem"
+        );
     }
 
     #[test]
     fn test_parse_security_config_uses_grpc_peer_name_policy() {
-        let _guard = process_state_lock();
         let tmp = tempfile::NamedTempFile::new().unwrap();
         std::fs::write(
             tmp.path(),
@@ -1516,22 +1983,19 @@ allowed_commonNames = "volume-a.internal,volume-b.internal"
         )
         .unwrap();
 
-        with_cleared_security_env(|| {
-            let cfg = parse_security_config(tmp.path().to_str().unwrap());
-            assert_eq!(cfg.grpc_allowed_wildcard_domain, ".example.com");
-            assert_eq!(
-                cfg.grpc_volume_allowed_common_names,
-                vec![
-                    String::from("volume-a.internal"),
-                    String::from("volume-b.internal")
-                ]
-            );
-        });
+        let cfg = parse_security_config_with_env(tmp.path().to_str().unwrap(), &|_| None);
+        assert_eq!(cfg.grpc_allowed_wildcard_domain, ".example.com");
+        assert_eq!(
+            cfg.grpc_volume_allowed_common_names,
+            vec![
+                String::from("volume-a.internal"),
+                String::from("volume-b.internal")
+            ]
+        );
     }
 
     #[test]
     fn test_parse_security_config_uses_https_client_settings() {
-        let _guard = process_state_lock();
         let tmp = tempfile::NamedTempFile::new().unwrap();
         std::fs::write(
             tmp.path(),
@@ -1545,18 +2009,15 @@ ca = "/etc/seaweedfs/client-ca.pem"
         )
         .unwrap();
 
-        with_cleared_security_env(|| {
-            let cfg = parse_security_config(tmp.path().to_str().unwrap());
-            assert!(cfg.https_client_enabled);
-            assert_eq!(cfg.https_client_cert_file, "/etc/seaweedfs/client-cert.pem");
-            assert_eq!(cfg.https_client_key_file, "/etc/seaweedfs/client-key.pem");
-            assert_eq!(cfg.https_client_ca_file, "/etc/seaweedfs/client-ca.pem");
-        });
+        let cfg = parse_security_config_with_env(tmp.path().to_str().unwrap(), &|_| None);
+        assert!(cfg.https_client_enabled);
+        assert_eq!(cfg.https_client_cert_file, "/etc/seaweedfs/client-cert.pem");
+        assert_eq!(cfg.https_client_key_file, "/etc/seaweedfs/client-key.pem");
+        assert_eq!(cfg.https_client_ca_file, "/etc/seaweedfs/client-ca.pem");
     }
 
     #[test]
     fn test_parse_security_config_uses_tls_policy_settings() {
-        let _guard = process_state_lock();
         let tmp = tempfile::NamedTempFile::new().unwrap();
         std::fs::write(
             tmp.path(),
@@ -1569,15 +2030,13 @@ cipher_suites = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
         )
         .unwrap();
 
-        with_cleared_security_env(|| {
-            let cfg = parse_security_config(tmp.path().to_str().unwrap());
-            assert_eq!(cfg.tls_policy.min_version, "TLS 1.2");
-            assert_eq!(cfg.tls_policy.max_version, "TLS 1.3");
-            assert_eq!(
-                cfg.tls_policy.cipher_suites,
-                "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
-            );
-        });
+        let cfg = parse_security_config_with_env(tmp.path().to_str().unwrap(), &|_| None);
+        assert_eq!(cfg.tls_policy.min_version, "TLS 1.2");
+        assert_eq!(cfg.tls_policy.max_version, "TLS 1.3");
+        assert_eq!(
+            cfg.tls_policy.cipher_suites,
+            "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+        );
     }
 
     #[test]
@@ -1678,16 +2137,15 @@ cipher_suites = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
 
     #[test]
     fn test_env_override_jwt_signing_key() {
+        // No file path, so the search reads the working directory.
         let _guard = process_state_lock();
-        with_temp_env_var("WEED_JWT_SIGNING_KEY", Some("env-secret"), || {
-            let cfg = parse_security_config("");
-            assert_eq!(cfg.jwt_signing_key, b"env-secret");
-        });
+        let env = fake_env(&[("WEED_JWT_SIGNING_KEY", "env-secret")]);
+        let cfg = parse_security_config_with_env("", &env);
+        assert_eq!(cfg.jwt_signing_key, b"env-secret");
     }
 
     #[test]
     fn test_env_override_takes_precedence_over_file() {
-        let _guard = process_state_lock();
         let tmp = tempfile::NamedTempFile::new().unwrap();
         std::fs::write(
             tmp.path(),
@@ -1698,31 +2156,26 @@ key = "file-secret"
         )
         .unwrap();
 
-        with_temp_env_var("WEED_JWT_SIGNING_KEY", Some("env-secret"), || {
-            let cfg = parse_security_config(tmp.path().to_str().unwrap());
-            assert_eq!(cfg.jwt_signing_key, b"env-secret");
-        });
+        let env = fake_env(&[("WEED_JWT_SIGNING_KEY", "env-secret")]);
+        let cfg = parse_security_config_with_env(tmp.path().to_str().unwrap(), &env);
+        assert_eq!(cfg.jwt_signing_key, b"env-secret");
     }
 
     #[test]
     fn test_env_override_guard_white_list() {
+        // No file path, so the search reads the working directory.
         let _guard = process_state_lock();
-        with_temp_env_var(
-            "WEED_GUARD_WHITE_LIST",
-            Some("10.0.0.0/8, 192.168.1.0/24"),
-            || {
-                let cfg = parse_security_config("");
-                assert_eq!(cfg.guard_white_list, vec!["10.0.0.0/8", "192.168.1.0/24"]);
-            },
-        );
+        let env = fake_env(&[("WEED_GUARD_WHITE_LIST", "10.0.0.0/8, 192.168.1.0/24")]);
+        let cfg = parse_security_config_with_env("", &env);
+        assert_eq!(cfg.guard_white_list, vec!["10.0.0.0/8", "192.168.1.0/24"]);
     }
 
     #[test]
     fn test_env_override_access_ui() {
+        // No file path, so the search reads the working directory.
         let _guard = process_state_lock();
-        with_temp_env_var("WEED_ACCESS_UI", Some("true"), || {
-            let cfg = parse_security_config("");
-            assert!(cfg.access_ui);
-        });
+        let env = fake_env(&[("WEED_ACCESS_UI", "true")]);
+        let cfg = parse_security_config_with_env("", &env);
+        assert!(cfg.access_ui);
     }
 }
diff --git a/seaweed-volume/src/lib.rs b/seaweed-volume/src/lib.rs
index c295c983de..a5d95b7576 100644
--- a/seaweed-volume/src/lib.rs
+++ b/seaweed-volume/src/lib.rs
@@ -1,5 +1,6 @@
 pub mod config;
 pub mod images;
+pub mod malloc_tuning;
 pub mod metrics;
 pub mod remote_storage;
 pub mod security;
diff --git a/seaweed-volume/src/main.rs b/seaweed-volume/src/main.rs
index 044193ea48..46fe45289d 100644
--- a/seaweed-volume/src/main.rs
+++ b/seaweed-volume/src/main.rs
@@ -6,21 +6,24 @@ use seaweed_volume::config::{self, VolumeServerConfig};
 use seaweed_volume::metrics;
 use seaweed_volume::pb::volume_server_pb::volume_server_server::VolumeServerServer;
 use seaweed_volume::security::tls::{
-    build_rustls_server_config, build_rustls_server_config_with_grpc_client_auth,
-    install_default_crypto_provider, GrpcClientAuthPolicy, TlsPolicy,
+    GrpcClientAuthPolicy, TlsPolicy, build_rustls_server_config,
+    build_rustls_server_config_with_grpc_client_auth, install_default_crypto_provider,
 };
 use seaweed_volume::security::{Guard, SigningKey};
 #[cfg(unix)]
 use seaweed_volume::server::debug::build_debug_router;
-use seaweed_volume::server::grpc_client::load_outgoing_grpc_tls;
+use seaweed_volume::server::grpc_client::{
+    GRPC_INITIAL_WINDOW_SIZE, GRPC_KEEPALIVE_INTERVAL, GRPC_KEEPALIVE_TIMEOUT,
+    GRPC_MAX_MESSAGE_SIZE, load_outgoing_grpc_tls,
+};
 use seaweed_volume::server::grpc_server::VolumeGrpcService;
 #[cfg(unix)]
 use seaweed_volume::server::profiling::CpuProfileSession;
 use seaweed_volume::server::request_id::GrpcRequestIdLayer;
 use seaweed_volume::server::volume_server::{
-    build_metrics_router, RuntimeMetricsConfig, VolumeServerState,
+    RuntimeMetricsConfig, VolumeServerState, build_metrics_router,
 };
-use seaweed_volume::server::write_queue::WriteQueue;
+use seaweed_volume::server::write_queue::{self, WriteQueue};
 use seaweed_volume::storage::store::Store;
 use seaweed_volume::storage::types::DiskType;
 
@@ -31,14 +34,19 @@ type CpuProfileParam = Option<CpuProfileSession>;
 #[cfg(not(unix))]
 type CpuProfileParam = Option<()>;
 
-const GRPC_MAX_MESSAGE_SIZE: usize = 1 << 30;
-const GRPC_KEEPALIVE_INTERVAL: std::time::Duration = std::time::Duration::from_secs(60);
-const GRPC_KEEPALIVE_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(20);
-const GRPC_INITIAL_WINDOW_SIZE: u32 = 16 * 1024 * 1024;
+// The two settings that only make sense for the inbound server. The rest of
+// this server's HTTP/2 tuning — keepalive, window sizes, message size — is
+// imported from `server::grpc_client` above, which is also what the outgoing
+// clients dial with, so the two directions cannot drift apart.
 const GRPC_MAX_HEADER_LIST_SIZE: u32 = 8 * 1024 * 1024;
 const GRPC_MAX_CONCURRENT_STREAMS: u32 = 1000;
 
 fn main() {
+    // Before anything allocates: stop glibc from training its mmap threshold
+    // upward on our large EC buffers and turning them into heap it never
+    // returns. See seaweed_volume::malloc_tuning for the measurements.
+    let malloc_tuning = seaweed_volume::malloc_tuning::pin_mmap_threshold();
+
     install_default_crypto_provider();
 
     // Initialize tracing
@@ -65,6 +73,19 @@ fn main() {
         "SeaweedFS Volume Server (Rust) v{}",
         seaweed_volume::version::full_version()
     );
+    match malloc_tuning {
+        seaweed_volume::malloc_tuning::MallocTuning::Pinned(bytes) => {
+            info!("pinned glibc M_MMAP_THRESHOLD to {} bytes", bytes)
+        }
+        seaweed_volume::malloc_tuning::MallocTuning::DeferredToEnv => info!(
+            "an allocator mmap-threshold override ({}) is set; leaving glibc's mmap threshold to the environment",
+            seaweed_volume::malloc_tuning::MMAP_THRESHOLD_ENV
+        ),
+        seaweed_volume::malloc_tuning::MallocTuning::Failed => {
+            warn!("mallopt(M_MMAP_THRESHOLD) failed; large freed buffers may stay resident")
+        }
+        seaweed_volume::malloc_tuning::MallocTuning::NotApplicable => {}
+    }
 
     // Register Prometheus metrics
     metrics::register_metrics();
@@ -319,15 +340,20 @@ async fn run(
         rack: config.rack.clone(),
         file_size_limit_bytes: config.file_size_limit_bytes,
         maintenance_byte_per_second: config.maintenance_byte_per_second,
+        vacuum_commit_slots: if config.max_parallel_vacuum_commits > 0 {
+            Some(tokio::sync::Semaphore::new(
+                config.max_parallel_vacuum_commits,
+            ))
+        } else {
+            None
+        },
+        vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
         // Go sets isHeartbeating: true unconditionally at startup
         is_heartbeating: std::sync::atomic::AtomicBool::new(true),
         has_master: !config.masters.is_empty(),
         pre_stop_seconds: config.pre_stop_seconds,
         volume_state_notify: tokio::sync::Notify::new(),
         write_queue: std::sync::OnceLock::new(),
-        s3_tier_registry: std::sync::RwLock::new(
-            seaweed_volume::remote_storage::s3_tier::S3TierRegistry::new(),
-        ),
         read_mode: config.read_mode,
         allow_untrusted_remote_endpoints: config.allow_untrusted_remote_endpoints,
         master_url,
@@ -353,6 +379,9 @@ async fn run(
                 .to_string_lossy()
                 .into_owned()
         },
+        ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+        ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+        ec_decode_tail_notify: tokio::sync::Notify::new(),
     });
 
     // Load persisted state from disk if it exists (matches Go's State.Load on startup)
@@ -404,12 +433,21 @@ async fn run(
         }
     }
 
-    // Initialize the batched write queue if enabled
-    if config.enable_write_queue {
-        info!("Batched write queue enabled");
-        let wq = WriteQueue::new(state.clone(), 128);
-        let _ = state.write_queue.set(wq);
-    }
+    // The write queue is always on: durable (fsync) uploads go through it so
+    // a batch shares one .dat/.idx sync, the way Go's per-volume async writer
+    // group-commits. Non-fsync writes stay on the synchronous path.
+    let min_bytes = usize::try_from(config.fsync_min_batch_bytes)
+        .map_err(|_| "fsyncMinBatchBytes exceeds this platform's maximum usize value")?;
+    let wq = WriteQueue::new(
+        state.clone(),
+        128,
+        write_queue::SyncBatchOption {
+            min_bytes,
+            min_requests: config.fsync_min_batch_requests,
+            wait: config.fsync_batch_wait,
+        },
+    );
+    let _ = state.write_queue.set(wq);
 
     // Set initial metric gauges for concurrent limits and max volumes
     metrics::CONCURRENT_UPLOAD_LIMIT.set(state.concurrent_upload_limit);
@@ -653,8 +691,7 @@ async fn run(
                     })
                     .await
             } else {
-                let incoming =
-                    tokio_stream::wrappers::TcpListenerStream::new(grpc_listener);
+                let incoming = tokio_stream::wrappers::TcpListenerStream::new(grpc_listener);
                 info!("gRPC server listening on {}", grpc_local_addr);
                 build_grpc_server_builder()
                     .layer(GrpcRequestIdLayer)
@@ -1040,15 +1077,17 @@ mod tests {
 
     #[test]
     fn test_grpc_server_tls_returns_none_when_files_are_missing() {
-        assert!(build_grpc_server_tls_acceptor(
-            "/missing/server.crt",
-            "/missing/server.key",
-            "/missing/ca.crt",
-            &TlsPolicy::default(),
-            "",
-            &[],
-        )
-        .is_none());
+        assert!(
+            build_grpc_server_tls_acceptor(
+                "/missing/server.crt",
+                "/missing/server.key",
+                "/missing/ca.crt",
+                &TlsPolicy::default(),
+                "",
+                &[],
+            )
+            .is_none()
+        );
     }
 
     #[test]
@@ -1070,19 +1109,21 @@ mod tests {
             "-----BEGIN CERTIFICATE-----\nZmFrZQ==\n-----END CERTIFICATE-----\n",
         );
 
-        assert!(build_grpc_server_tls_acceptor(
-            &cert,
-            &key,
-            &ca,
-            &TlsPolicy {
-                min_version: "TLS 1.0".to_string(),
-                max_version: "TLS 1.1".to_string(),
-                cipher_suites: String::new(),
-            },
-            "",
-            &[],
-        )
-        .is_none());
+        assert!(
+            build_grpc_server_tls_acceptor(
+                &cert,
+                &key,
+                &ca,
+                &TlsPolicy {
+                    min_version: "TLS 1.0".to_string(),
+                    max_version: "TLS 1.1".to_string(),
+                    cipher_suites: String::new(),
+                },
+                "",
+                &[],
+            )
+            .is_none()
+        );
     }
 
     #[test]
diff --git a/seaweed-volume/src/malloc_tuning.rs b/seaweed-volume/src/malloc_tuning.rs
new file mode 100644
index 0000000000..7eb6e9c2f9
--- /dev/null
+++ b/seaweed-volume/src/malloc_tuning.rs
@@ -0,0 +1,467 @@
+//! Keep glibc from silently converting large short-lived buffers into heap the
+//! process never gives back.
+//!
+//! glibc serves an allocation with `mmap` when it is at least
+//! `M_MMAP_THRESHOLD` (128 KiB by default), and `munmap`s it on free, so the
+//! pages go straight back to the OS. That threshold is **adaptive**: whenever a
+//! block that came from `mmap` is freed, glibc raises the threshold to that
+//! block's size — up to 32 MiB — on the theory that a workload repeatedly
+//! allocating buffers of that size is better served from the heap.
+//!
+//! For a volume server that theory is wrong in a specific, expensive way. EC
+//! reconstruction and needle reassembly allocate large, short-lived buffers.
+//! The first few are mmap'd and freed, which trains the threshold upward; every
+//! later buffer of that size is then carved out of the heap instead. Heap
+//! memory is only returned to the OS from the top of the arena, so those pages
+//! stay resident as anonymous memory for the life of the process. They are
+//! still *reusable* — this is not a leak, and a repeat workload does not grow
+//! the footprint further — but under a hard cgroup `MemoryMax` they are
+//! indistinguishable from a leak, because anonymous pages cannot be reclaimed
+//! under pressure the way page cache can. The retained footprint eats exactly
+//! the headroom that a burst of maintenance work needs, and the process is
+//! OOM-killed while most of its resident memory is free-but-unreturned.
+//!
+//! Measured on a 17-node cluster (EC 10+4, `--index=redb`), one node, two
+//! identical `ec.scrub -mode full` rounds over 10912 EC files each, comparing
+//! the same unit restarted with and without a pinned threshold:
+//!
+//! | | baseline | round 1 | round 2 | 60s idle |
+//! |---|---|---|---|---|
+//! | default (adaptive) | 10 MB | 84 MB | 88 MB | **88 MB** |
+//! | pinned threshold   | 10 MB | 13 MB | 14 MB | **14 MB** |
+//!
+//! 78 MB retained versus 4 MB for identical work. On that cluster's heavier
+//! mixed scrub workloads the same effect reached ~600 MB of retained anonymous
+//! memory per volume server, against a 3 GiB cap.
+//!
+//! Calling `mallopt(M_MMAP_THRESHOLD, ...)` sets the threshold *and* disables
+//! the dynamic adjustment, which is the documented behaviour of setting it
+//! explicitly. We pin it to glibc's own default rather than inventing a value:
+//! the goal is to stop the adaptation, not to second-guess the default.
+
+/// glibc's own default `M_MMAP_THRESHOLD`. Pinning to this value changes
+/// nothing about which allocations use `mmap` on a freshly started process; it
+/// only prevents the threshold from drifting upward later.
+#[cfg(all(target_os = "linux", target_env = "gnu"))]
+const DEFAULT_MMAP_THRESHOLD: libc::c_int = 128 * 1024;
+
+/// Legacy environment variable glibc reads for the same setting. If an operator
+/// has set it, honour their value and do not override it.
+pub const MMAP_THRESHOLD_ENV: &str = "MALLOC_MMAP_THRESHOLD_";
+
+/// Modern glibc tunables environment variable. Operators may set the threshold
+/// via `GLIBC_TUNABLES=glibc.malloc.mmap_threshold=...` instead of the legacy
+/// variable; that override is honoured too.
+pub const GLIBC_TUNABLES_ENV: &str = "GLIBC_TUNABLES";
+
+/// The tunable name within `GLIBC_TUNABLES` that maps to `M_MMAP_THRESHOLD`.
+#[cfg(all(target_os = "linux", target_env = "gnu"))]
+const MMAP_THRESHOLD_TUNABLE: &str = "glibc.malloc.mmap_threshold";
+
+/// Outcome of the tuning attempt, so the caller can log it and tests can assert
+/// on it without inspecting global allocator state.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MallocTuning {
+    /// Threshold pinned to `DEFAULT_MMAP_THRESHOLD`; dynamic adjustment is off.
+    Pinned(i32),
+    /// An allocator override (`MALLOC_MMAP_THRESHOLD_` or
+    /// `GLIBC_TUNABLES=glibc.malloc.mmap_threshold=...`) was set, so the
+    /// operator's value wins.
+    DeferredToEnv,
+    /// `mallopt` reported failure. Not fatal — the server runs, it just keeps
+    /// glibc's adaptive behaviour.
+    Failed,
+    /// Not glibc, so there is no adaptive threshold to pin.
+    NotApplicable,
+}
+
+/// Pin glibc's mmap threshold unless the operator has set an allocator override.
+/// Safe to call more than once; call it before serving traffic, since the point
+/// is to prevent the threshold from being trained upward by early allocations.
+pub fn pin_mmap_threshold() -> MallocTuning {
+    pin_mmap_threshold_inner()
+}
+
+#[cfg(all(target_os = "linux", target_env = "gnu"))]
+fn pin_mmap_threshold_inner() -> MallocTuning {
+    if operator_mmap_threshold_override_active() {
+        return MallocTuning::DeferredToEnv;
+    }
+    // SAFETY: `mallopt` is a libc entry point that takes two ints and mutates
+    // only allocator-internal tunables. It has no preconditions and no effect
+    // on memory this process already owns.
+    let rc = unsafe { libc::mallopt(libc::M_MMAP_THRESHOLD, DEFAULT_MMAP_THRESHOLD) };
+    if rc == 1 {
+        MallocTuning::Pinned(DEFAULT_MMAP_THRESHOLD)
+    } else {
+        MallocTuning::Failed
+    }
+}
+
+#[cfg(not(all(target_os = "linux", target_env = "gnu")))]
+fn pin_mmap_threshold_inner() -> MallocTuning {
+    MallocTuning::NotApplicable
+}
+
+#[cfg(all(target_os = "linux", target_env = "gnu"))]
+fn operator_mmap_threshold_override_active() -> bool {
+    // MALLOC_MMAP_THRESHOLD_: glibc calls atoi(value) then mallopt, which
+    // always sets the threshold and disables dynamic adjustment — even for
+    // empty, negative, or non-numeric values (atoi returns 0). So any presence
+    // of the variable means the operator's override is in effect.
+    std::env::var_os(MMAP_THRESHOLD_ENV).is_some()
+        || usable_glibc_tunable_threshold(std::env::var_os(GLIBC_TUNABLES_ENV))
+}
+
+/// Look for `glibc.malloc.mmap_threshold=<value>` among the colon-separated
+/// tunables in `GLIBC_TUNABLES`. glibc's `parse_tunables_string` (elf/dl-tunables.c)
+/// rejects the **entire** string (returns -1) if it reaches `\0` before finding
+/// `=` in a name (last entry has no `=`), or if any entry's value contains a
+/// duplicate `=`. When `parse_tunables_string` returns -1, `parse_tunables`
+/// prints a warning and returns immediately without applying ANY tunable —
+/// including ones already parsed into the tunables array. We match that by
+/// returning `false` for the entire string on any of those conditions.
+///
+/// glibc parses tunable values with `_dl_strtoul`, which accepts decimal,
+/// `0x` hex, `0` octal, an optional sign (negatives wrap to `unsigned long`),
+/// and requires the entire value to be consumed; we match that with
+/// `dl_strtoul_consumes_all`.
+#[cfg(all(target_os = "linux", target_env = "gnu"))]
+fn usable_glibc_tunable_threshold(tunables: Option<std::ffi::OsString>) -> bool {
+    let s = match tunables.and_then(|v| v.into_string().ok()) {
+        Some(s) => s,
+        None => return false,
+    };
+    if s.is_empty() {
+        return false;
+    }
+
+    // Parse the string character-by-character, matching glibc's
+    // parse_tunables_string logic exactly. Using split(':') would lose the
+    // distinction between an entry terminated by ':' (skip) and one terminated
+    // by '\0' with no '=' (reject entire string).
+    let bytes = s.as_bytes();
+    let mut pos = 0;
+    let mut found_threshold = false;
+
+    loop {
+        // Find where the name ends ('=', ':', or end of string).
+        let name_start = pos;
+        while pos < bytes.len() && bytes[pos] != b'=' && bytes[pos] != b':' {
+            pos += 1;
+        }
+
+        // End of string before '=' → glibc returns -1 (reject entire string).
+        if pos >= bytes.len() {
+            return false;
+        }
+
+        // ':' before '=' → glibc skips this entry and continues.
+        if bytes[pos] == b':' {
+            pos += 1;
+            continue;
+        }
+
+        // Skip the '='.
+        let name_end = pos;
+        pos += 1;
+
+        // Find where the value ends ('=', ':', or end of string).
+        let val_start = pos;
+        while pos < bytes.len() && bytes[pos] != b'=' && bytes[pos] != b':' {
+            pos += 1;
+        }
+
+        // '=' in value → glibc returns -1 (reject entire string).
+        if pos < bytes.len() && bytes[pos] == b'=' {
+            return false;
+        }
+
+        let key = &s[name_start..name_end];
+        let val = &s[val_start..pos];
+
+        if key == MMAP_THRESHOLD_TUNABLE && dl_strtoul_consumes_all(val) {
+            found_threshold = true;
+        }
+
+        // End of string → done.
+        if pos >= bytes.len() {
+            break;
+        }
+
+        // Skip the ':'.
+        pos += 1;
+    }
+
+    found_threshold
+}
+
+/// Replicate glibc's `_dl_strtoul` (elf/dl-misc.c) just enough to determine
+/// whether it would consume the entire string — which is what
+/// `tunable_parse_num` checks (`endptr == strval + len`). Returns `true` if
+/// glibc would accept the value and apply it.
+///
+/// `_dl_strtoul` skips leading spaces/tabs, accepts an optional `+`/`-` sign,
+/// and parses `0x`-prefixed hex, `0`-prefixed octal, or plain decimal. A
+/// negative result wraps to `unsigned long` (`-1` → `SIZE_MAX`). If no digit is
+/// found after the sign, the end pointer stays at the current position — which
+/// still counts as "consumed" when the string is empty or whitespace-only
+/// (value 0). On overflow, `_dl_strtoul` stops at the overflowing digit (endptr
+/// does not reach the end), so `tunable_parse_num` rejects the value.
+#[cfg(all(target_os = "linux", target_env = "gnu"))]
+fn dl_strtoul_consumes_all(s: &str) -> bool {
+    let bytes = s.as_bytes();
+    let mut pos = 0;
+
+    // Skip leading whitespace (spaces and tabs, matching _dl_strtoul).
+    while pos < bytes.len() && (bytes[pos] == b' ' || bytes[pos] == b'\t') {
+        pos += 1;
+    }
+
+    // Optional sign.
+    if pos < bytes.len() && (bytes[pos] == b'-' || bytes[pos] == b'+') {
+        pos += 1;
+    }
+
+    // Must have at least one digit (0-9) to start parsing, unless we're already
+    // at the end (empty / whitespace-only / sign-only → value 0, consumed).
+    if pos >= bytes.len() {
+        return true;
+    }
+    if bytes[pos] < b'0' || bytes[pos] > b'9' {
+        return false;
+    }
+
+    // Determine base: 0x → hex, 0 → octal, else decimal. _dl_strtoul unconditionally
+    // advances past "0x"/"0X" when the first char is '0' and the next is 'x'/'X',
+    // even if no hex digit follows — in that case the digit loop breaks immediately,
+    // endptr reaches the end, and the value is 0.
+    let base: u32 = if bytes[pos] == b'0'
+        && pos + 1 < bytes.len()
+        && (bytes[pos + 1] == b'x' || bytes[pos + 1] == b'X')
+    {
+        pos += 2; // skip "0x"
+        16
+    } else if bytes[pos] == b'0' {
+        8
+    } else {
+        10
+    };
+
+    // Parse digits with overflow detection, matching _dl_strtoul's cutoff/cutlim
+    // logic. On overflow, _dl_strtoul sets endptr to the overflowing digit and
+    // returns UINT64_MAX — so the value is NOT fully consumed and
+    // tunable_parse_num rejects it.
+    let mut result: u64 = 0;
+    let cutoff = u64::MAX / base as u64;
+    let cutlim = u64::MAX % base as u64;
+
+    while pos < bytes.len() {
+        let b = bytes[pos];
+        let digval: u32 = match digit_value(b, base) {
+            Some(v) => v,
+            None => break,
+        };
+        if result > cutoff || (result == cutoff && digval as u64 > cutlim) {
+            // Overflow: _dl_strtoul stops here, endptr points at this digit.
+            return false;
+        }
+        result *= base as u64;
+        result += digval as u64;
+        pos += 1;
+    }
+
+    // The entire string must be consumed (matching tunable_parse_num's check).
+    pos == bytes.len()
+}
+
+/// Returns the numeric value of a digit byte in the given base, or `None` if
+/// the byte is not a valid digit in that base.
+#[cfg(all(target_os = "linux", target_env = "gnu"))]
+fn digit_value(b: u8, base: u32) -> Option<u32> {
+    if (b'0'..=b'0' + (base - 1).min(9) as u8).contains(&b) {
+        return Some((b - b'0') as u32);
+    }
+    if base == 16 {
+        if (b'a'..=b'f').contains(&b) {
+            return Some((b - b'a' + 10) as u32);
+        }
+        if (b'A'..=b'F').contains(&b) {
+            return Some((b - b'A' + 10) as u32);
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn env_override_constants_match_glibc_names() {
+        // Verified against the real accessor rather than a copy of the name, so
+        // renaming the constant cannot silently break the override contract.
+        assert_eq!(MMAP_THRESHOLD_ENV, "MALLOC_MMAP_THRESHOLD_");
+        assert_eq!(GLIBC_TUNABLES_ENV, "GLIBC_TUNABLES");
+    }
+
+    #[test]
+    fn calling_twice_is_stable() {
+        // Startup paths get re-entered in tests and in `weed mini`; the second
+        // call must not report a different outcome from the first.
+        let first = pin_mmap_threshold();
+        let second = pin_mmap_threshold();
+        assert_eq!(first, second);
+    }
+
+    #[cfg(all(target_os = "linux", target_env = "gnu"))]
+    #[test]
+    fn pins_threshold_on_glibc_when_no_override_is_set() {
+        // The env override is not set in the test process, so this exercises the
+        // mallopt path. If an override happens to be present, defer to it.
+        if operator_mmap_threshold_override_active() {
+            assert_eq!(pin_mmap_threshold(), MallocTuning::DeferredToEnv);
+            return;
+        }
+        assert_eq!(
+            pin_mmap_threshold(),
+            MallocTuning::Pinned(DEFAULT_MMAP_THRESHOLD),
+            "mallopt(M_MMAP_THRESHOLD) should succeed on glibc"
+        );
+    }
+
+    #[cfg(not(all(target_os = "linux", target_env = "gnu")))]
+    #[test]
+    fn is_a_noop_off_glibc() {
+        // No glibc adaptive threshold exists off glibc, so there is nothing to
+        // pin regardless of any environment variables that happen to be set.
+        assert_eq!(pin_mmap_threshold(), MallocTuning::NotApplicable);
+    }
+
+    #[cfg(all(target_os = "linux", target_env = "gnu"))]
+    #[test]
+    fn dl_strtoul_consumes_all_matches_glibc_parser() {
+        // Decimal — any non-empty decimal integer is accepted, including
+        // negative (wraps to unsigned) and zero.
+        assert!(dl_strtoul_consumes_all("131072"));
+        assert!(dl_strtoul_consumes_all("0"));
+        assert!(dl_strtoul_consumes_all("-1"));
+        assert!(dl_strtoul_consumes_all("-131072"));
+        // Values above i64::MAX are valid for glibc's unsigned parser.
+        assert!(dl_strtoul_consumes_all("9223372036854775808"));
+        // Hex with 0x prefix.
+        assert!(dl_strtoul_consumes_all("0x20000"));
+        assert!(dl_strtoul_consumes_all("0X20000"));
+        assert!(dl_strtoul_consumes_all("0x0"));
+        // Octal with leading 0.
+        assert!(dl_strtoul_consumes_all("010"));
+        // Leading whitespace (spaces and tabs) is skipped.
+        assert!(dl_strtoul_consumes_all("  131072"));
+        assert!(dl_strtoul_consumes_all("\t0x20000"));
+        // Empty and whitespace-only strings are accepted (value 0).
+        assert!(dl_strtoul_consumes_all(""));
+        assert!(dl_strtoul_consumes_all("  "));
+        assert!(dl_strtoul_consumes_all("\t"));
+        // Sign-only strings are accepted: _dl_strtoul skips the sign, finds no
+        // digit, sets endptr to the position after the sign (== end of string),
+        // and returns 0. tunable_parse_num sees endptr == strval + len → true.
+        assert!(dl_strtoul_consumes_all("-"));
+        assert!(dl_strtoul_consumes_all("+"));
+
+        // Trailing garbage is rejected — _dl_strtoul stops at the first
+        // non-digit and tunable_parse_num requires the entire string consumed.
+        assert!(!dl_strtoul_consumes_all("131072abc"));
+        // In hex mode, a-f are digits, so "0x20000abc" is a valid hex number.
+        // Use a non-hex character like 'g' to test trailing garbage in hex.
+        assert!(!dl_strtoul_consumes_all("0x20000g"));
+        assert!(!dl_strtoul_consumes_all("128K"));
+        // Non-numeric strings are rejected.
+        assert!(!dl_strtoul_consumes_all("abc"));
+        // "0x" with no hex digits: _dl_strtoul advances past "0x", the digit loop
+        // breaks immediately (no hex digit), endptr reaches the end, value is 0.
+        // tunable_parse_num accepts it.
+        assert!(dl_strtoul_consumes_all("0x"));
+        assert!(dl_strtoul_consumes_all("0X"));
+
+        // Overflow: _dl_strtoul stops at the overflowing digit (endptr points
+        // there, not at the end), so tunable_parse_num rejects the value.
+        assert!(!dl_strtoul_consumes_all("18446744073709551616")); // u64::MAX + 1
+        assert!(!dl_strtoul_consumes_all("99999999999999999999")); // 20 nines
+        assert!(!dl_strtoul_consumes_all("0x10000000000000000")); // 2^64
+        // u64::MAX itself is accepted: the last digit (5) equals cutlim (=5),
+        // so the overflow check (digval > cutlim) is false.
+        assert!(dl_strtoul_consumes_all("18446744073709551615")); // u64::MAX
+    }
+
+    #[cfg(all(target_os = "linux", target_env = "gnu"))]
+    #[test]
+    fn usable_glibc_tunable_threshold_detects_mmap_threshold() {
+        // Decimal, hex, octal, negative, and zero values are all accepted by
+        // glibc's _dl_strtoul and cause the threshold to be pinned.
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=131072".into()
+        )));
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=0x20000".into()
+        )));
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=0".into()
+        )));
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=-1".into()
+        )));
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=9223372036854775808".into()
+        )));
+        // u64::MAX is accepted by _dl_strtoul (last digit == cutlim, no overflow).
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=18446744073709551615".into()
+        )));
+        // Appears alongside other tunables.
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.cpu.x=1:glibc.malloc.mmap_threshold=131072".into()
+        )));
+        // Leading ':' is accepted — glibc skips the empty entry and continues.
+        assert!(usable_glibc_tunable_threshold(Some(
+            ":glibc.malloc.mmap_threshold=131072".into()
+        )));
+        // Empty value is accepted by _dl_strtoul (value 0).
+        assert!(usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=".into()
+        )));
+
+        // Non-numeric values are rejected by _dl_strtoul.
+        assert!(!usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=abc".into()
+        )));
+        assert!(!usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=128K".into()
+        )));
+        // A malformed sibling entry (duplicate '=') makes glibc reject the
+        // entire string, so we must not accept the threshold entry either.
+        // This applies regardless of whether the threshold is before or after
+        // the malformed entry — parse_tunables_string returns -1, and
+        // parse_tunables discards all tunables without applying any.
+        assert!(!usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.check=2=2:glibc.malloc.mmap_threshold=131072".into()
+        )));
+        assert!(!usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=262144:glibc.malloc.check=2=2".into()
+        )));
+        // A trailing entry with no '=' makes glibc reject the entire string
+        // (parse_tunables_string hits '\0' before '=' and returns -1).
+        assert!(!usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=262144:glibc.cpu.x".into()
+        )));
+        // A trailing ':' makes glibc reject the entire string (the empty entry
+        // after ':' hits '\0' before '=' and returns -1).
+        assert!(!usable_glibc_tunable_threshold(Some(
+            "glibc.malloc.mmap_threshold=262144:".into()
+        )));
+        // Unrelated tunables do not count.
+        assert!(!usable_glibc_tunable_threshold(Some(
+            "glibc.cpu.x=1".into()
+        )));
+        assert!(!usable_glibc_tunable_threshold(None));
+    }
+}
diff --git a/seaweed-volume/src/metrics.rs b/seaweed-volume/src/metrics.rs
index e495e791d4..45a52a9957 100644
--- a/seaweed-volume/src/metrics.rs
+++ b/seaweed-volume/src/metrics.rs
@@ -3,10 +3,10 @@
 //! Mirrors the Go SeaweedFS volume server metrics.
 
 use prometheus::{
-    self, Encoder, GaugeVec, HistogramOpts, HistogramVec, IntCounterVec, IntGauge, IntGaugeVec,
-    Opts, Registry, TextEncoder,
+    self, Encoder, GaugeVec, HistogramOpts, HistogramVec, IntCounter, IntCounterVec, IntGauge,
+    IntGaugeVec, Opts, Registry, TextEncoder,
 };
-use std::sync::Once;
+use std::sync::{LazyLock, Once};
 
 use crate::version;
 
@@ -16,203 +16,320 @@ pub struct PushGatewayConfig {
     pub interval_seconds: u32,
 }
 
-lazy_static::lazy_static! {
-    pub static ref REGISTRY: Registry = Registry::new();
+pub static REGISTRY: LazyLock<Registry> = LazyLock::new(Registry::new);
 
-    // ---- Request metrics (Go: VolumeServerRequestCounter, VolumeServerRequestHistogram) ----
+// ---- Request metrics (Go: VolumeServerRequestCounter, VolumeServerRequestHistogram) ----
 
-    /// Request counter with labels `type` (HTTP method) and `code` (HTTP status).
-    pub static ref REQUEST_COUNTER: IntCounterVec = IntCounterVec::new(
-        Opts::new("SeaweedFS_volumeServer_request_total", "Volume server requests"),
+/// Request counter with labels `type` (HTTP method) and `code` (HTTP status).
+pub static REQUEST_COUNTER: LazyLock<IntCounterVec> = LazyLock::new(|| {
+    IntCounterVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_request_total",
+            "Volume server requests",
+        ),
         &["type", "code"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Request duration histogram with label `type` (HTTP method).
-    pub static ref REQUEST_DURATION: HistogramVec = HistogramVec::new(
+/// Request duration histogram with label `type` (HTTP method).
+pub static REQUEST_DURATION: LazyLock<HistogramVec> = LazyLock::new(|| {
+    HistogramVec::new(
         HistogramOpts::new(
             "SeaweedFS_volumeServer_request_seconds",
             "Volume server request duration in seconds",
-        ).buckets(exponential_buckets(0.0001, 2.0, 24)),
+        )
+        .buckets(exponential_buckets(0.0001, 2.0, 24)),
         &["type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- Handler counters (Go: VolumeServerHandlerCounter) ----
+// ---- Handler counters (Go: VolumeServerHandlerCounter) ----
 
-    /// Handler-level operation counter with label `type`.
-    pub static ref HANDLER_COUNTER: IntCounterVec = IntCounterVec::new(
-        Opts::new("SeaweedFS_volumeServer_handler_total", "Volume server handler counters"),
+/// Handler-level operation counter with label `type`.
+pub static HANDLER_COUNTER: LazyLock<IntCounterVec> = LazyLock::new(|| {
+    IntCounterVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_handler_total",
+            "Volume server handler counters",
+        ),
         &["type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- Vacuuming metrics (Go: VolumeServerVacuuming*) ----
+// ---- Vacuuming metrics (Go: VolumeServerVacuuming*) ----
 
-    /// Vacuuming compact counter with label `success` (true/false).
-    pub static ref VACUUMING_COMPACT_COUNTER: IntCounterVec = IntCounterVec::new(
-        Opts::new("SeaweedFS_volumeServer_vacuuming_compact_count", "Counter of volume vacuuming Compact counter"),
+/// Vacuuming compact counter with label `success` (true/false).
+pub static VACUUMING_COMPACT_COUNTER: LazyLock<IntCounterVec> = LazyLock::new(|| {
+    IntCounterVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_vacuuming_compact_count",
+            "Counter of volume vacuuming Compact counter",
+        ),
         &["success"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Vacuuming commit counter with label `success` (true/false).
-    pub static ref VACUUMING_COMMIT_COUNTER: IntCounterVec = IntCounterVec::new(
-        Opts::new("SeaweedFS_volumeServer_vacuuming_commit_count", "Counter of volume vacuuming commit counter"),
+/// Vacuuming commit counter with label `success` (true/false).
+pub static VACUUMING_COMMIT_COUNTER: LazyLock<IntCounterVec> = LazyLock::new(|| {
+    IntCounterVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_vacuuming_commit_count",
+            "Counter of volume vacuuming commit counter",
+        ),
         &["success"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Vacuuming duration histogram with label `type` (compact/commit).
-    pub static ref VACUUMING_HISTOGRAM: HistogramVec = HistogramVec::new(
+/// Vacuuming duration histogram with label `type` (compact/commit).
+pub static VACUUMING_HISTOGRAM: LazyLock<HistogramVec> = LazyLock::new(|| {
+    HistogramVec::new(
         HistogramOpts::new(
             "SeaweedFS_volumeServer_vacuuming_seconds",
             "Volume vacuuming duration in seconds",
-        ).buckets(exponential_buckets(0.0001, 2.0, 24)),
+        )
+        .buckets(exponential_buckets(0.0001, 2.0, 24)),
         &["type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- Volume gauges (Go: VolumeServerVolumeGauge, VolumeServerReadOnlyVolumeGauge) ----
+// ---- Volume gauges (Go: VolumeServerVolumeGauge, VolumeServerReadOnlyVolumeGauge) ----
 
-    /// Volumes per collection and type (volume/ec_shards).
-    pub static ref VOLUME_GAUGE: GaugeVec = GaugeVec::new(
+/// Volumes per collection and type (volume/ec_shards).
+pub static VOLUME_GAUGE: LazyLock<GaugeVec> = LazyLock::new(|| {
+    GaugeVec::new(
         Opts::new("SeaweedFS_volumeServer_volumes", "Number of volumes"),
         &["collection", "type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Read-only volumes per collection and type.
-    pub static ref READ_ONLY_VOLUME_GAUGE: GaugeVec = GaugeVec::new(
-        Opts::new("SeaweedFS_volumeServer_read_only_volumes", "Number of read-only volumes."),
+/// Read-only volumes per collection and type.
+pub static READ_ONLY_VOLUME_GAUGE: LazyLock<GaugeVec> = LazyLock::new(|| {
+    GaugeVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_read_only_volumes",
+            "Number of read-only volumes.",
+        ),
         &["collection", "type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Maximum number of volumes this server can hold.
-    pub static ref MAX_VOLUMES: IntGauge = IntGauge::new(
+/// Maximum number of volumes this server can hold.
+pub static MAX_VOLUMES: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new(
         "SeaweedFS_volumeServer_max_volumes",
         "Maximum number of volumes",
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- Disk size gauges (Go: VolumeServerDiskSizeGauge) ----
+// ---- Disk size gauges (Go: VolumeServerDiskSizeGauge) ----
 
-    /// Actual disk size used by volumes per collection and type (normal/deleted_bytes/ec).
-    pub static ref DISK_SIZE_GAUGE: GaugeVec = GaugeVec::new(
-        Opts::new("SeaweedFS_volumeServer_total_disk_size", "Actual disk size used by volumes"),
+/// Actual disk size used by volumes per collection and type (normal/deleted_bytes/ec).
+pub static DISK_SIZE_GAUGE: LazyLock<GaugeVec> = LazyLock::new(|| {
+    GaugeVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_total_disk_size",
+            "Actual disk size used by volumes",
+        ),
         &["collection", "type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- Resource gauges (Go: VolumeServerResourceGauge) ----
+// ---- Resource gauges (Go: VolumeServerResourceGauge) ----
 
-    /// Disk resource usage per directory and type (all/used/free/avail).
-    pub static ref RESOURCE_GAUGE: GaugeVec = GaugeVec::new(
+/// Disk resource usage per directory and type (all/used/free/avail).
+pub static RESOURCE_GAUGE: LazyLock<GaugeVec> = LazyLock::new(|| {
+    GaugeVec::new(
         Opts::new("SeaweedFS_volumeServer_resource", "Server resource usage"),
         &["name", "type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- In-flight gauges (Go: VolumeServerInFlightRequestsGauge, InFlightDownload/UploadSize) ----
+// ---- In-flight gauges (Go: VolumeServerInFlightRequestsGauge, InFlightDownload/UploadSize) ----
 
-    /// In-flight requests per HTTP method.
-    pub static ref INFLIGHT_REQUESTS_GAUGE: IntGaugeVec = IntGaugeVec::new(
-        Opts::new("SeaweedFS_volumeServer_in_flight_requests", "Current number of in-flight requests being handled by volume server."),
+/// In-flight requests per HTTP method.
+pub static INFLIGHT_REQUESTS_GAUGE: LazyLock<IntGaugeVec> = LazyLock::new(|| {
+    IntGaugeVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_in_flight_requests",
+            "Current number of in-flight requests being handled by volume server.",
+        ),
         &["type"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Concurrent download limit in bytes.
-    pub static ref CONCURRENT_DOWNLOAD_LIMIT: IntGauge = IntGauge::new(
+/// Concurrent download limit in bytes.
+pub static CONCURRENT_DOWNLOAD_LIMIT: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new(
         "SeaweedFS_volumeServer_concurrent_download_limit",
         "Limit for total concurrent download size in bytes",
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Concurrent upload limit in bytes.
-    pub static ref CONCURRENT_UPLOAD_LIMIT: IntGauge = IntGauge::new(
+/// Concurrent upload limit in bytes.
+pub static CONCURRENT_UPLOAD_LIMIT: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new(
         "SeaweedFS_volumeServer_concurrent_upload_limit",
         "Limit for total concurrent upload size in bytes",
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Current in-flight download bytes.
-    pub static ref INFLIGHT_DOWNLOAD_SIZE: IntGauge = IntGauge::new(
+/// Current in-flight download bytes.
+pub static INFLIGHT_DOWNLOAD_SIZE: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new(
         "SeaweedFS_volumeServer_in_flight_download_size",
         "In flight total download size.",
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Current in-flight upload bytes.
-    pub static ref INFLIGHT_UPLOAD_SIZE: IntGauge = IntGauge::new(
+/// Current in-flight upload bytes.
+pub static INFLIGHT_UPLOAD_SIZE: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new(
         "SeaweedFS_volumeServer_in_flight_upload_size",
         "In flight total upload size.",
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Upload error counter by HTTP status code. Code "0" = transport error (no response).
-    pub static ref UPLOAD_ERROR_COUNTER: IntCounterVec = IntCounterVec::new(
-        Opts::new("SeaweedFS_upload_error_total",
-            "Counter of upload errors by HTTP status code. Code 0 means transport error (no response received)."),
-        &["code"],
-    ).expect("metric can be created");
+/// Upload error counter by HTTP status code. Code "0" = transport error (no response).
+pub static UPLOAD_ERROR_COUNTER: LazyLock<IntCounterVec> = LazyLock::new(|| {
+    IntCounterVec::new(
+    Opts::new("SeaweedFS_upload_error_total",
+        "Counter of upload errors by HTTP status code. Code 0 means transport error (no response received)."),
+    &["code"],
+).expect("metric can be created")
+});
 
-    // ---- Scrubbing metrics (Go: VolumeServerScrub*) ----
+// ---- Scrubbing metrics (Go: VolumeServerScrub*) ----
 
-    /// Last scrub execution time, as seconds since UNIX epoch, with label `mode`.
-    pub static ref SCRUB_LAST_TIME_SECONDS: GaugeVec = GaugeVec::new(
+/// Last scrub execution time, as seconds since UNIX epoch, with label `mode`.
+pub static SCRUB_LAST_TIME_SECONDS: LazyLock<GaugeVec> = LazyLock::new(|| {
+    GaugeVec::new(
         Opts::new(
             "SeaweedFS_volumeServer_scrub_last_time_seconds",
             "Last scrub execution time, as seconds since UNIX epoch.",
         ),
         &["mode"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Counter of overall volumes with issues detected during scrubbing, with label `mode`.
-    pub static ref SCRUB_VOLUME_FAILURES: IntCounterVec = IntCounterVec::new(
+/// Counter of overall volumes with issues detected during scrubbing, with label `mode`.
+pub static SCRUB_VOLUME_FAILURES: LazyLock<IntCounterVec> = LazyLock::new(|| {
+    IntCounterVec::new(
         Opts::new(
             "SeaweedFS_volumeServer_scrub_volume_failures",
             "Counter of overall volumes with issues detected during scrubbing.",
         ),
         &["mode"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Counter of overall EC shards with issues detected during scrubbing, with label `mode`.
-    pub static ref SCRUB_SHARD_FAILURES: IntCounterVec = IntCounterVec::new(
+/// Counter of overall EC shards with issues detected during scrubbing, with label `mode`.
+pub static SCRUB_SHARD_FAILURES: LazyLock<IntCounterVec> = LazyLock::new(|| {
+    IntCounterVec::new(
         Opts::new(
             "SeaweedFS_volumeServer_scrub_shard_failures",
             "Counter of overall EC shards with issues detected during scrubbing.",
         ),
         &["mode"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- Legacy aliases for backward compat with existing code ----
+/// Counter of storage read/write EIO errors on volumes and EC shards.
+/// Mirrors Go's VolumeServerStorageIoErrorCounter.
+pub static STORAGE_IO_ERROR_COUNTER: LazyLock<IntCounter> = LazyLock::new(|| {
+    IntCounter::new(
+        "SeaweedFS_volumeServer_storage_io_error_total",
+        "Counter of storage read/write EIO errors on volumes and EC shards.",
+    )
+    .expect("metric can be created")
+});
 
-    /// Total number of volumes on this server (flat gauge).
-    pub static ref VOLUMES_TOTAL: IntGauge = IntGauge::new(
-        "volume_server_volumes_total",
-        "Total number of volumes",
-    ).expect("metric can be created");
+/// Number of volumes quarantined due to storage IO errors.
+/// Mirrors Go's VolumeServerIoQuarantineGauge.
+pub static IO_QUARANTINE_GAUGE: LazyLock<IntGaugeVec> = LazyLock::new(|| {
+    IntGaugeVec::new(
+        Opts::new(
+            "SeaweedFS_volumeServer_io_quarantine",
+            "Number of volumes or EC shards quarantined due to storage IO errors.",
+        ),
+        &["kind"],
+    )
+    .expect("metric can be created")
+});
 
-    /// Disk size in bytes per directory.
-    pub static ref DISK_SIZE_BYTES: IntGaugeVec = IntGaugeVec::new(
+// ---- Legacy aliases for backward compat with existing code ----
+
+/// Total number of volumes on this server (flat gauge).
+pub static VOLUMES_TOTAL: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new("volume_server_volumes_total", "Total number of volumes")
+        .expect("metric can be created")
+});
+
+/// Disk size in bytes per directory.
+pub static DISK_SIZE_BYTES: LazyLock<IntGaugeVec> = LazyLock::new(|| {
+    IntGaugeVec::new(
         Opts::new("volume_server_disk_size_bytes", "Disk size in bytes"),
         &["dir"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Disk free bytes per directory.
-    pub static ref DISK_FREE_BYTES: IntGaugeVec = IntGaugeVec::new(
+/// Disk free bytes per directory.
+pub static DISK_FREE_BYTES: LazyLock<IntGaugeVec> = LazyLock::new(|| {
+    IntGaugeVec::new(
         Opts::new("volume_server_disk_free_bytes", "Disk free space in bytes"),
         &["dir"],
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Current number of in-flight requests (flat gauge).
-    pub static ref INFLIGHT_REQUESTS: IntGauge = IntGauge::new(
+/// Current number of in-flight requests (flat gauge).
+pub static INFLIGHT_REQUESTS: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new(
         "volume_server_inflight_requests",
         "Current number of in-flight requests",
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    /// Total number of files stored across all volumes.
-    pub static ref VOLUME_FILE_COUNT: IntGauge = IntGauge::new(
+/// Total number of files stored across all volumes.
+pub static VOLUME_FILE_COUNT: LazyLock<IntGauge> = LazyLock::new(|| {
+    IntGauge::new(
         "volume_server_volume_file_count",
         "Total number of files stored across all volumes",
-    ).expect("metric can be created");
+    )
+    .expect("metric can be created")
+});
 
-    // ---- Build info (Go: BuildInfo) ----
+// ---- Build info (Go: BuildInfo) ----
 
-    /// Build information gauge, always set to 1. Matches Go:
-    /// Namespace="SeaweedFS", Subsystem="build", Name="info",
-    /// labels: version, commit, sizelimit, goos, goarch.
-    pub static ref BUILD_INFO: GaugeVec = GaugeVec::new(
-        Opts::new("SeaweedFS_build_info", "A metric with a constant '1' value labeled by version, commit, sizelimit, goos, and goarch from which SeaweedFS was built."),
-        &["version", "commit", "sizelimit", "goos", "goarch"],
-    ).expect("metric can be created");
-}
+/// Build information gauge, always set to 1. Matches Go:
+/// Namespace="SeaweedFS", Subsystem="build", Name="info",
+/// labels: version, commit, sizelimit, goos, goarch.
+pub static BUILD_INFO: LazyLock<GaugeVec> = LazyLock::new(|| {
+    GaugeVec::new(
+    Opts::new("SeaweedFS_build_info", "A metric with a constant '1' value labeled by version, commit, sizelimit, goos, and goarch from which SeaweedFS was built."),
+    &["version", "commit", "sizelimit", "goos", "goarch"],
+).expect("metric can be created")
+});
 
 /// Generate exponential bucket boundaries for histograms.
 fn exponential_buckets(start: f64, factor: f64, count: usize) -> Vec<f64> {
@@ -232,6 +349,7 @@ pub const DOWNLOAD_LIMIT_COND: &str = "downloadLimitCondition";
 pub const UPLOAD_LIMIT_COND: &str = "uploadLimitCondition";
 pub const READ_PROXY_REQ: &str = "readProxyRequest";
 pub const READ_REDIRECT_REQ: &str = "readRedirectRequest";
+pub const READ_DELETED_NEEDLE: &str = "readDeletedNeedle";
 pub const EMPTY_READ_PROXY_LOC: &str = "emptyReadProxyLocaction";
 pub const FAILED_READ_PROXY_REQ: &str = "failedReadProxyRequest";
 
@@ -283,6 +401,8 @@ pub fn register_metrics() {
             Box::new(SCRUB_LAST_TIME_SECONDS.clone()),
             Box::new(SCRUB_VOLUME_FAILURES.clone()),
             Box::new(SCRUB_SHARD_FAILURES.clone()),
+            Box::new(STORAGE_IO_ERROR_COUNTER.clone()),
+            Box::new(IO_QUARANTINE_GAUGE.clone()),
             // Legacy metrics
             Box::new(VOLUMES_TOTAL.clone()),
             Box::new(DISK_SIZE_BYTES.clone()),
@@ -330,6 +450,16 @@ pub fn delete_collection_metrics(collection: &str) {
     delete_partial_match_collection(&DISK_SIZE_GAUGE, collection);
 }
 
+/// Drop a collection's volume server series once its last volume leaves this
+/// server. These gauges are only ever set for collections still present, so the
+/// values from the heartbeat that saw the last volume would otherwise stand
+/// until the process restarts.
+pub fn delete_volume_server_collection_metrics(collection: &str) {
+    let _ = DISK_SIZE_GAUGE.remove_label_values(&[collection, DISK_SIZE_LABEL_NORMAL]);
+    let _ = DISK_SIZE_GAUGE.remove_label_values(&[collection, DISK_SIZE_LABEL_DELETED_BYTES]);
+    delete_partial_match_collection(&READ_ONLY_VOLUME_GAUGE, collection);
+}
+
 /// Remove all metric entries from a GaugeVec where the "collection" label matches.
 /// This emulates Go's `DeletePartialMatch(prometheus.Labels{"collection": collection})`.
 fn delete_partial_match_collection(gauge: &GaugeVec, collection: &str) {
@@ -348,10 +478,8 @@ fn delete_partial_match_collection(gauge: &GaugeVec, collection: &str) {
                     type_value = Some(label.get_value().to_string());
                 }
             }
-            if matches_collection {
-                if let Some(ref tv) = type_value {
-                    let _ = gauge.remove_label_values(&[collection, tv]);
-                }
+            if matches_collection && let Some(ref tv) = type_value {
+                let _ = gauge.remove_label_values(&[collection, tv]);
             }
         }
     }
@@ -398,7 +526,7 @@ pub async fn push_metrics_once(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use axum::{routing::put, Router};
+    use axum::{Router, routing::put};
     use std::sync::{Arc, Mutex};
 
     #[test]
@@ -470,7 +598,9 @@ mod tests {
         register_metrics();
 
         VOLUME_GAUGE.with_label_values(&["pics", "volume"]).set(2.0);
-        VOLUME_GAUGE.with_label_values(&["pics", "ec_shards"]).set(3.0);
+        VOLUME_GAUGE
+            .with_label_values(&["pics", "ec_shards"])
+            .set(3.0);
         READ_ONLY_VOLUME_GAUGE
             .with_label_values(&["pics", "volume"])
             .set(1.0);
diff --git a/seaweed-volume/src/remote_storage/endpoint_guard.rs b/seaweed-volume/src/remote_storage/endpoint_guard.rs
index 90e051ff62..04efe2ea59 100644
--- a/seaweed-volume/src/remote_storage/endpoint_guard.rs
+++ b/seaweed-volume/src/remote_storage/endpoint_guard.rs
@@ -17,7 +17,7 @@
 //! narrow TOCTOU window (a hostname that resolves to a public IP here and then
 //! flips to a blocked one when the SDK dials) remains as a follow-up.
 
-use std::net::{IpAddr, Ipv4Addr};
+use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
 /// AWS/Azure/GCP IPv4 instance-metadata-service (IMDS) address. It is
 /// link-local and thus already covered by [`is_link_local`], but is named
@@ -74,9 +74,56 @@ fn is_cgnat(ip: IpAddr) -> bool {
     }
 }
 
+/// Returns the IPv4 address carried by an IPv6 transition address -- NAT64
+/// 64:ff9b::/96 (RFC 6052), 6to4 2002::/16 (RFC 3056), Teredo 2001:0000::/32
+/// (RFC 4380), and the deprecated IPv4-compatible ::/96 (RFC 4291) -- or None
+/// when it is not one of those. IPv4-mapped ::ffff:0:0/96 is excluded; it is
+/// already normalized via `to_ipv4_mapped`.
+fn embedded_transition_ipv4(v6: Ipv6Addr) -> Option<Ipv4Addr> {
+    let o = v6.octets();
+    if o[0] == 0x00
+        && o[1] == 0x64
+        && o[2] == 0xff
+        && o[3] == 0x9b
+        && o[4..12].iter().all(|&b| b == 0)
+    {
+        return Some(Ipv4Addr::new(o[12], o[13], o[14], o[15]));
+    }
+    if o[0] == 0x20 && o[1] == 0x02 {
+        return Some(Ipv4Addr::new(o[2], o[3], o[4], o[5]));
+    }
+    if o[0] == 0x20 && o[1] == 0x01 && o[2] == 0x00 && o[3] == 0x00 {
+        // Teredo obfuscates the client IPv4 as its ones' complement.
+        return Some(Ipv4Addr::new(
+            o[12] ^ 0xff,
+            o[13] ^ 0xff,
+            o[14] ^ 0xff,
+            o[15] ^ 0xff,
+        ));
+    }
+    if o[..12].iter().all(|&b| b == 0) {
+        // IPv4-compatible ::a.b.c.d; :: and ::1 are already handled by the
+        // unspecified / loopback checks before extraction runs.
+        return Some(Ipv4Addr::new(o[12], o[13], o[14], o[15]));
+    }
+    None
+}
+
 /// Returns an error if `ip` is not safe to dial from a server that can reach
 /// cluster-internal hosts. Mirrors Go's `checkBlockedIP`.
 pub fn check_blocked_ip(endpoint: &str, ip: IpAddr) -> Result<(), String> {
+    check_blocked_ip_policy(endpoint, ip, false)
+}
+
+/// Like [`check_blocked_ip`], but `allow_private` keeps RFC 1918 / CGNAT
+/// reachable for callers whose target legitimately sits on an internal network
+/// (peer volume servers), while still blocking loopback, link-local (IMDS) and
+/// unspecified. Mirrors Go's `checkBlockedIPPolicy`.
+pub fn check_blocked_ip_policy(
+    endpoint: &str,
+    ip: IpAddr,
+    allow_private: bool,
+) -> Result<(), String> {
     // Normalize IPv4-mapped IPv6 (`::ffff:a.b.c.d`) to its IPv4 form so the
     // IPv4 deny rules apply. The OS routes these to the embedded IPv4 address,
     // so without this `::ffff:127.0.0.1` / `::ffff:169.254.169.254` would slip
@@ -112,17 +159,28 @@ pub fn check_blocked_ip(endpoint: &str, ip: IpAddr) -> Result<(), String> {
             endpoint, ip
         ));
     }
-    if is_private(ip) {
-        return Err(format!(
-            "remote endpoint {:?} resolves to private address {}",
-            endpoint, ip
-        ));
+    if !allow_private {
+        if is_private(ip) {
+            return Err(format!(
+                "remote endpoint {:?} resolves to private address {}",
+                endpoint, ip
+            ));
+        }
+        if is_cgnat(ip) {
+            return Err(format!(
+                "remote endpoint {:?} resolves to CGNAT address {}",
+                endpoint, ip
+            ));
+        }
     }
-    if is_cgnat(ip) {
-        return Err(format!(
-            "remote endpoint {:?} resolves to CGNAT address {}",
-            endpoint, ip
-        ));
+    // IPv6 transition addresses embed an IPv4 destination that routes to the
+    // same host wherever the matching relay exists (common in IPv6-only cloud).
+    // to_ipv4_mapped above only covers ::ffff: mapped addresses, so pull the
+    // embedded IPv4 out of the other forms and re-check it against the rules.
+    if let IpAddr::V6(v6) = ip
+        && let Some(v4) = embedded_transition_ipv4(v6)
+    {
+        return check_blocked_ip_policy(endpoint, IpAddr::V4(v4), allow_private);
     }
     Ok(())
 }
@@ -160,9 +218,7 @@ fn precheck_endpoint(endpoint: &str) -> Result<HostCheck, String> {
 
     // Authority is everything up to the first '/', '?', or '#'.
     let after = &trimmed[scheme_end + 3..];
-    let authority_end = after
-        .find(|c| c == '/' || c == '?' || c == '#')
-        .unwrap_or(after.len());
+    let authority_end = after.find(['/', '?', '#']).unwrap_or(after.len());
     let authority = &after[..authority_end];
 
     // Strip optional userinfo ("user:pass@").
@@ -179,7 +235,7 @@ fn precheck_endpoint(endpoint: &str) -> Result<HostCheck, String> {
                 return Err(format!(
                     "remote endpoint {:?} has a malformed IPv6 host",
                     endpoint
-                ))
+                ));
             }
         }
     } else {
@@ -243,6 +299,125 @@ pub async fn validate_remote_endpoint(endpoint: &str) -> Result<(), String> {
     }
 }
 
+/// Returns an error if `target` could redirect a replica upload away from a peer
+/// volume server. The target must be a bare `host:port` -- a scheme, userinfo,
+/// path, query or fragment can smuggle a different destination into the
+/// formatted upload URL -- whose host is not loopback, link-local (IMDS) or
+/// unspecified. Cluster peers legitimately sit on private networks, so RFC 1918
+/// / CGNAT are allowed. Mirrors Go's `validateReplicaTarget`.
+pub async fn validate_replica_target(target: &str) -> Result<(), String> {
+    let trimmed = target.trim();
+    if trimmed.is_empty() {
+        return Err("replica target is empty".to_string());
+    }
+    if trimmed.contains("://") || trimmed.contains(['/', '?', '#', '@', '\\']) {
+        return Err(format!(
+            "replica target {:?} must be a bare host:port",
+            target
+        ));
+    }
+
+    // Require an explicit host:port, handling `[IPv6]:port`. A bracketless IPv6
+    // literal (which carries its own colons) is rejected; peers are addressed as
+    // `[ipv6]:port`, matching Go's net.SplitHostPort.
+    let host = if let Some(rest) = trimmed.strip_prefix('[') {
+        match rest.split_once(']') {
+            Some((h, port)) if port.starts_with(':') && port.len() > 1 => h,
+            _ => {
+                return Err(format!(
+                    "replica target {:?} must be a bare host:port",
+                    target
+                ));
+            }
+        }
+    } else {
+        match trimmed.rsplit_once(':') {
+            Some((h, port)) if !port.is_empty() && !h.contains(':') => h,
+            _ => {
+                return Err(format!(
+                    "replica target {:?} must be a bare host:port",
+                    target
+                ));
+            }
+        }
+    };
+
+    if host.is_empty() {
+        return Err(format!("replica target {:?} has no host", target));
+    }
+    if is_blocked_imds_host(&host.to_ascii_lowercase()) {
+        return Err(format!(
+            "replica target {:?} targets instance metadata service",
+            target
+        ));
+    }
+    if let Ok(ip) = host.parse::<IpAddr>() {
+        return check_blocked_ip_policy(target, ip, true);
+    }
+
+    let addrs = resolve_host(host).await?;
+    if addrs.is_empty() {
+        return Err(format!(
+            "resolve replica target host {:?}: no addresses",
+            host
+        ));
+    }
+    for ip in addrs {
+        check_blocked_ip_policy(target, ip, true)?;
+    }
+    Ok(())
+}
+
+/// Resolve `host`, re-apply the replica deny list (private peers allowed) to
+/// every resolved address, and connect to the first one that passes -- the
+/// connect-time twin of [`validate_replica_target`], so a hostname whose DNS
+/// answer flips to a blocked address after the up-front check is still refused.
+/// Mirrors Go's `guardedDialerPolicy` with allowPrivate=true.
+pub async fn guarded_tcp_connect(
+    host: &str,
+    port: u16,
+    endpoint: &str,
+) -> std::io::Result<tokio::net::TcpStream> {
+    use std::io::{Error, ErrorKind};
+
+    let denied = |e: String| Error::new(ErrorKind::PermissionDenied, e);
+
+    if is_blocked_imds_host(&host.to_ascii_lowercase()) {
+        return Err(denied(format!(
+            "remote endpoint {:?} targets instance metadata service",
+            endpoint
+        )));
+    }
+    if let Ok(ip) = host.parse::<IpAddr>() {
+        check_blocked_ip_policy(endpoint, ip, true).map_err(denied)?;
+        return tokio::net::TcpStream::connect((ip, port)).await;
+    }
+
+    let lookup = tokio::net::lookup_host((host.to_string(), port));
+    let addrs = tokio::time::timeout(std::time::Duration::from_secs(2), lookup)
+        .await
+        .map_err(|_| {
+            Error::new(
+                ErrorKind::TimedOut,
+                format!("resolve remote endpoint host {:?}: timed out", host),
+            )
+        })??;
+
+    let mut first_block_err: Option<String> = None;
+    for addr in addrs {
+        if let Err(e) = check_blocked_ip_policy(endpoint, addr.ip(), true) {
+            if first_block_err.is_none() {
+                first_block_err = Some(e);
+            }
+            continue;
+        }
+        return tokio::net::TcpStream::connect(addr).await;
+    }
+    Err(denied(first_block_err.unwrap_or_else(|| {
+        format!("resolve remote endpoint host {:?}: no addresses", host)
+    })))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -273,22 +448,30 @@ mod tests {
     #[test]
     fn rejects_empty_and_bad_scheme() {
         assert!(precheck_endpoint("").unwrap_err().contains("empty"));
-        assert!(precheck_endpoint("ftp://example.com/")
-            .unwrap_err()
-            .contains("http or https"));
-        assert!(precheck_endpoint("example.com/")
-            .unwrap_err()
-            .contains("http or https"));
+        assert!(
+            precheck_endpoint("ftp://example.com/")
+                .unwrap_err()
+                .contains("http or https")
+        );
+        assert!(
+            precheck_endpoint("example.com/")
+                .unwrap_err()
+                .contains("http or https")
+        );
     }
 
     #[test]
     fn rejects_imds_hostnames() {
-        assert!(precheck_endpoint("http://metadata.google.internal/")
-            .unwrap_err()
-            .contains("metadata service"));
-        assert!(precheck_endpoint("http://metadata/")
-            .unwrap_err()
-            .contains("metadata service"));
+        assert!(
+            precheck_endpoint("http://metadata.google.internal/")
+                .unwrap_err()
+                .contains("metadata service")
+        );
+        assert!(
+            precheck_endpoint("http://metadata/")
+                .unwrap_err()
+                .contains("metadata service")
+        );
     }
 
     #[test]
@@ -308,52 +491,214 @@ mod tests {
     #[test]
     fn check_blocked_ip_matches_resolved_categories() {
         // Mirror Go's "host resolves to X" cases at the address level.
-        assert!(check_blocked_ip("e", ip("127.0.0.1"))
-            .unwrap_err()
-            .contains("loopback"));
-        assert!(check_blocked_ip("e", ip("169.254.10.20"))
-            .unwrap_err()
-            .contains("link-local"));
-        assert!(check_blocked_ip("e", ip("10.1.2.3"))
-            .unwrap_err()
-            .contains("private"));
-        assert!(check_blocked_ip("e", ip("172.20.0.5"))
-            .unwrap_err()
-            .contains("private"));
-        assert!(check_blocked_ip("e", ip("192.168.1.1"))
-            .unwrap_err()
-            .contains("private"));
-        assert!(check_blocked_ip("e", ip("100.64.0.42"))
-            .unwrap_err()
-            .contains("CGNAT"));
-        assert!(check_blocked_ip("e", ip("fc00::1"))
-            .unwrap_err()
-            .contains("private"));
+        assert!(
+            check_blocked_ip("e", ip("127.0.0.1"))
+                .unwrap_err()
+                .contains("loopback")
+        );
+        assert!(
+            check_blocked_ip("e", ip("169.254.10.20"))
+                .unwrap_err()
+                .contains("link-local")
+        );
+        assert!(
+            check_blocked_ip("e", ip("10.1.2.3"))
+                .unwrap_err()
+                .contains("private")
+        );
+        assert!(
+            check_blocked_ip("e", ip("172.20.0.5"))
+                .unwrap_err()
+                .contains("private")
+        );
+        assert!(
+            check_blocked_ip("e", ip("192.168.1.1"))
+                .unwrap_err()
+                .contains("private")
+        );
+        assert!(
+            check_blocked_ip("e", ip("100.64.0.42"))
+                .unwrap_err()
+                .contains("CGNAT")
+        );
+        assert!(
+            check_blocked_ip("e", ip("fc00::1"))
+                .unwrap_err()
+                .contains("private")
+        );
         assert!(check_blocked_ip("e", ip("52.216.10.10")).is_ok());
         assert!(check_blocked_ip("e", ip("2606:4700:4700::1111")).is_ok());
     }
 
+    #[test]
+    fn rejects_ipv6_transition_addresses() {
+        // Every transition form encoding an internal IPv4 must be blocked.
+        assert!(
+            check_blocked_ip("e", ip("64:ff9b::a9fe:a9fe")) // NAT64 -> IMDS
+                .unwrap_err()
+                .contains("metadata")
+        );
+        assert!(
+            check_blocked_ip("e", ip("64:ff9b::7f00:1")) // NAT64 -> loopback
+                .unwrap_err()
+                .contains("loopback")
+        );
+        assert!(
+            check_blocked_ip("e", ip("2002:a00:1::")) // 6to4 -> 10.0.0.1
+                .unwrap_err()
+                .contains("private")
+        );
+        assert!(
+            check_blocked_ip("e", ip("2001:0:4136:e378:8000:63bf:80ff:fffe")) // Teredo -> loopback
+                .unwrap_err()
+                .contains("loopback")
+        );
+        assert!(
+            check_blocked_ip("e", ip("::7f00:1")) // IPv4-compatible -> loopback
+                .unwrap_err()
+                .contains("loopback")
+        );
+        // A NAT64 address outside the 64:ff9b::/96 well-known prefix is not
+        // decoded (its embedded IPv4 lives elsewhere), so it is left as-is.
+        assert!(check_blocked_ip("e", ip("64:ff9b:1::a9fe:a9fe")).is_ok());
+        // Every transition form embedding a public IPv4 (8.8.8.8) still passes:
+        // NAT64, 6to4, Teredo, IPv4-compatible.
+        assert!(check_blocked_ip("e", ip("64:ff9b::808:808")).is_ok());
+        assert!(check_blocked_ip("e", ip("2002:808:808::")).is_ok());
+        assert!(check_blocked_ip("e", ip("2001::f7f7:f7f7")).is_ok());
+        assert!(check_blocked_ip("e", ip("::808:808")).is_ok());
+        // Bracketed transition literal via the full endpoint path.
+        assert!(
+            precheck_endpoint("http://[64:ff9b::a9fe:a9fe]/")
+                .unwrap_err()
+                .contains("metadata")
+        );
+    }
+
     #[test]
     fn rejects_ipv4_mapped_ipv6() {
         // IPv4-mapped IPv6 must be unmapped so the IPv4 rules catch it.
-        assert!(check_blocked_ip("e", ip("::ffff:127.0.0.1"))
-            .unwrap_err()
-            .contains("loopback"));
-        assert!(check_blocked_ip("e", ip("::ffff:169.254.169.254"))
-            .unwrap_err()
-            .contains("metadata"));
-        assert!(check_blocked_ip("e", ip("::ffff:10.0.0.1"))
-            .unwrap_err()
-            .contains("private"));
+        assert!(
+            check_blocked_ip("e", ip("::ffff:127.0.0.1"))
+                .unwrap_err()
+                .contains("loopback")
+        );
+        assert!(
+            check_blocked_ip("e", ip("::ffff:169.254.169.254"))
+                .unwrap_err()
+                .contains("metadata")
+        );
+        assert!(
+            check_blocked_ip("e", ip("::ffff:10.0.0.1"))
+                .unwrap_err()
+                .contains("private")
+        );
         // A mapped public address still passes, and genuine IPv6 loopback is
         // still caught by the V6 path.
         assert!(check_blocked_ip("e", ip("::ffff:52.216.10.10")).is_ok());
-        assert!(check_blocked_ip("e", ip("::1"))
-            .unwrap_err()
-            .contains("loopback"));
+        assert!(
+            check_blocked_ip("e", ip("::1"))
+                .unwrap_err()
+                .contains("loopback")
+        );
         // Bracketed mapped literal via the full endpoint path.
-        assert!(precheck_endpoint("http://[::ffff:127.0.0.1]/")
-            .unwrap_err()
-            .contains("loopback"));
+        assert!(
+            precheck_endpoint("http://[::ffff:127.0.0.1]/")
+                .unwrap_err()
+                .contains("loopback")
+        );
+    }
+
+    #[test]
+    fn check_blocked_ip_policy_allows_private_peers() {
+        // The replica leg targets peer volume servers, which may be private.
+        assert!(check_blocked_ip_policy("e", ip("10.0.0.7"), true).is_ok());
+        assert!(check_blocked_ip_policy("e", ip("192.168.1.5"), true).is_ok());
+        assert!(check_blocked_ip_policy("e", ip("100.64.0.42"), true).is_ok());
+        // Loopback / IMDS / unspecified stay blocked even when private is allowed.
+        assert!(
+            check_blocked_ip_policy("e", ip("127.0.0.1"), true)
+                .unwrap_err()
+                .contains("loopback")
+        );
+        assert!(
+            check_blocked_ip_policy("e", ip("169.254.169.254"), true)
+                .unwrap_err()
+                .contains("metadata")
+        );
+        assert!(
+            check_blocked_ip_policy("e", ip("0.0.0.0"), true)
+                .unwrap_err()
+                .contains("unspecified")
+        );
+    }
+
+    #[tokio::test]
+    async fn validate_replica_target_rejects_and_allows() {
+        // A path plus a trailing ?a= would otherwise swallow ?type=replicate.
+        assert!(
+            validate_replica_target("127.0.0.1:7000/status/x/?a=")
+                .await
+                .unwrap_err()
+                .contains("bare host:port")
+        );
+        assert!(
+            validate_replica_target("http://10.0.0.7:8080")
+                .await
+                .unwrap_err()
+                .contains("bare host:port")
+        );
+        assert!(
+            validate_replica_target("user@10.0.0.7:8080")
+                .await
+                .unwrap_err()
+                .contains("bare host:port")
+        );
+        assert!(
+            validate_replica_target("10.0.0.7")
+                .await
+                .unwrap_err()
+                .contains("bare host:port")
+        );
+        assert!(
+            validate_replica_target("peer.example.com")
+                .await
+                .unwrap_err()
+                .contains("bare host:port")
+        );
+        assert!(
+            validate_replica_target("127.0.0.1:8080")
+                .await
+                .unwrap_err()
+                .contains("loopback")
+        );
+        assert!(
+            validate_replica_target("[::1]:8080")
+                .await
+                .unwrap_err()
+                .contains("loopback")
+        );
+        assert!(
+            validate_replica_target("169.254.169.254:80")
+                .await
+                .unwrap_err()
+                .contains("metadata")
+        );
+        assert!(
+            validate_replica_target("metadata:80")
+                .await
+                .unwrap_err()
+                .contains("metadata")
+        );
+        assert!(
+            validate_replica_target("")
+                .await
+                .unwrap_err()
+                .contains("empty")
+        );
+        // Legitimate peer volume servers on private networks pass.
+        assert!(validate_replica_target("10.0.0.7:8080").await.is_ok());
+        assert!(validate_replica_target("192.168.1.5:8080").await.is_ok());
+        assert!(validate_replica_target("[fd00::1]:8080").await.is_ok());
     }
 }
diff --git a/seaweed-volume/src/remote_storage/mod.rs b/seaweed-volume/src/remote_storage/mod.rs
index 49be142d6c..b22393e506 100644
--- a/seaweed-volume/src/remote_storage/mod.rs
+++ b/seaweed-volume/src/remote_storage/mod.rs
@@ -7,7 +7,7 @@ pub mod endpoint_guard;
 pub mod s3;
 pub mod s3_tier;
 
-pub use endpoint_guard::validate_remote_endpoint;
+pub use endpoint_guard::{guarded_tcp_connect, validate_remote_endpoint, validate_replica_target};
 
 use crate::pb::remote_pb::{RemoteConf, RemoteStorageLocation};
 
@@ -211,4 +211,36 @@ mod tests {
         };
         assert_eq!(s3_compatible_endpoint(&gcs), None);
     }
+
+    #[test]
+    fn azure_endpoint_has_no_ssrf_path() {
+        // The Go volume server guards the caller-supplied azure endpoint against
+        // SSRF. This server has no azure backend, so there is nothing to dial:
+        // azure is not S3-compatible (the endpoint guard does not apply) and
+        // make_remote_storage_client rejects the type before building a client.
+        let azure = RemoteConf {
+            r#type: "azure".to_string(),
+            azure_endpoint: "https://169.254.169.254/".to_string(),
+            ..Default::default()
+        };
+        assert_eq!(s3_compatible_endpoint(&azure), None);
+        assert!(make_remote_storage_client(&azure).is_err());
+    }
+
+    #[test]
+    fn gcs_credentials_have_no_ssrf_path() {
+        // The Go volume server accepts only static-key gcs credentials and puts
+        // their token endpoint behind the SSRF guard, because the SDK dials
+        // whatever url, file or executable the credentials name. This server has
+        // no gcs backend, so make_remote_storage_client rejects the type before
+        // any credentials are parsed. Anyone adding one must carry both guards
+        // over with it.
+        let gcs = RemoteConf {
+            r#type: "gcs".to_string(),
+            gcs_google_application_credentials: r#"{"type":"external_account","credential_source":{"url":"http://169.254.169.254/"}}"#.to_string(),
+            ..Default::default()
+        };
+        assert_eq!(s3_compatible_endpoint(&gcs), None);
+        assert!(make_remote_storage_client(&gcs).is_err());
+    }
 }
diff --git a/seaweed-volume/src/remote_storage/s3.rs b/seaweed-volume/src/remote_storage/s3.rs
index bac5485ae9..4000984330 100644
--- a/seaweed-volume/src/remote_storage/s3.rs
+++ b/seaweed-volume/src/remote_storage/s3.rs
@@ -2,9 +2,10 @@
 //!
 //! Works with AWS S3, MinIO, SeaweedFS S3, and all S3-compatible providers.
 
-use aws_sdk_s3::config::{BehaviorVersion, Credentials, Region};
-use aws_sdk_s3::primitives::ByteStream;
 use aws_sdk_s3::Client;
+use aws_sdk_s3::config::{BehaviorVersion, Credentials, Region};
+use aws_sdk_s3::error::{DisplayErrorContext, SdkError};
+use aws_sdk_s3::primitives::ByteStream;
 
 use super::{RemoteEntry, RemoteStorageClient, RemoteStorageError};
 use crate::pb::remote_pb::{RemoteConf, RemoteStorageLocation};
@@ -25,6 +26,23 @@ impl S3RemoteStorageClient {
         endpoint: &str,
         force_path_style: bool,
     ) -> Self {
+        let client = Client::from_conf(
+            Self::config_builder(access_key, secret_key, region, endpoint, force_path_style)
+                .build(),
+        );
+
+        S3RemoteStorageClient { client, conf }
+    }
+
+    /// Build the SDK config for the given credentials and endpoint. Split out so
+    /// tests can attach a canned HTTP client before building the [`Client`].
+    fn config_builder(
+        access_key: &str,
+        secret_key: &str,
+        region: &str,
+        endpoint: &str,
+        force_path_style: bool,
+    ) -> aws_sdk_s3::config::Builder {
         let region = if region.is_empty() {
             "us-east-1"
         } else {
@@ -49,9 +67,7 @@ impl S3RemoteStorageClient {
             s3_config = s3_config.endpoint_url(endpoint);
         }
 
-        let client = Client::from_conf(s3_config.build());
-
-        S3RemoteStorageClient { client, conf }
+        s3_config
     }
 }
 
@@ -75,13 +91,14 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             req = req.range(format!("bytes={}-", offset));
         }
 
-        let resp = req.send().await.map_err(|e| {
-            let msg = format!("{}", e);
-            if msg.contains("NoSuchKey") || msg.contains("404") {
+        let resp = req.send().await.map_err(|e| match e {
+            // Go compares `aerr.Code()` to NoSuchKey on GET
+            // (s3_storage_client.go:436): a bare 404 maps to "NotFound"
+            // and stays a generic error, as it does here.
+            SdkError::ServiceError(ref se) if se.err().is_no_such_key() => {
                 RemoteStorageError::ObjectNotFound(format!("{}/{}", loc.bucket, key))
-            } else {
-                RemoteStorageError::Other(format!("s3 get object: {}", e))
             }
+            e => RemoteStorageError::Other(format!("s3 get object: {}", DisplayErrorContext(&e))),
         })?;
 
         let data = resp
@@ -108,7 +125,9 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             .body(ByteStream::from(data.to_vec()))
             .send()
             .await
-            .map_err(|e| RemoteStorageError::Other(format!("s3 put object: {}", e)))?;
+            .map_err(|e| {
+                RemoteStorageError::Other(format!("s3 put object: {}", DisplayErrorContext(&e)))
+            })?;
 
         Ok(RemoteEntry {
             size: data.len() as i64,
@@ -134,13 +153,18 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             .key(key)
             .send()
             .await
-            .map_err(|e| {
-                let msg = format!("{}", e);
-                if msg.contains("404") || msg.contains("NotFound") {
+            .map_err(|e| match e {
+                // Go checks only the raw HTTP status on HEAD
+                // (s3_storage_client.go:373): a HEAD response carries no
+                // error body, so a 404 is not-found whatever code the SDK
+                // assigns, and a non-404 is not.
+                SdkError::ServiceError(ref se) if se.raw().status().as_u16() == 404 => {
                     RemoteStorageError::ObjectNotFound(format!("{}/{}", loc.bucket, key))
-                } else {
-                    RemoteStorageError::Other(format!("s3 head object: {}", e))
                 }
+                e => RemoteStorageError::Other(format!(
+                    "s3 head object: {}",
+                    DisplayErrorContext(&e)
+                )),
             })?;
 
         Ok(RemoteEntry {
@@ -160,18 +184,17 @@ impl RemoteStorageClient for S3RemoteStorageClient {
             .key(key)
             .send()
             .await
-            .map_err(|e| RemoteStorageError::Other(format!("s3 delete object: {}", e)))?;
+            .map_err(|e| {
+                RemoteStorageError::Other(format!("s3 delete object: {}", DisplayErrorContext(&e)))
+            })?;
 
         Ok(())
     }
 
     async fn list_buckets(&self) -> Result<Vec<String>, RemoteStorageError> {
-        let resp = self
-            .client
-            .list_buckets()
-            .send()
-            .await
-            .map_err(|e| RemoteStorageError::Other(format!("s3 list buckets: {}", e)))?;
+        let resp = self.client.list_buckets().send().await.map_err(|e| {
+            RemoteStorageError::Other(format!("s3 list buckets: {}", DisplayErrorContext(&e)))
+        })?;
 
         Ok(resp
             .buckets()
@@ -184,3 +207,178 @@ impl RemoteStorageClient for S3RemoteStorageClient {
         &self.conf
     }
 }
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use aws_sdk_s3::config::http::{HttpRequest, HttpResponse};
+    use aws_sdk_s3::config::retry::RetryConfig;
+    use aws_sdk_s3::config::{HttpClient, RuntimeComponents};
+    use aws_sdk_s3::primitives::SdkBody;
+    use aws_smithy_runtime_api::client::http::{
+        HttpConnector, HttpConnectorFuture, HttpConnectorSettings, SharedHttpConnector,
+    };
+    use aws_smithy_runtime_api::http::StatusCode;
+
+    /// An SDK HTTP client that answers every request with one canned response,
+    /// so the error-mapping paths can be exercised without a network or a
+    /// running S3 server.
+    #[derive(Debug, Clone)]
+    pub(crate) struct CannedResponse {
+        pub(crate) status: u16,
+        pub(crate) body: &'static str,
+    }
+
+    impl HttpConnector for CannedResponse {
+        fn call(&self, _request: HttpRequest) -> HttpConnectorFuture {
+            let status = StatusCode::try_from(self.status).expect("valid HTTP status");
+            HttpConnectorFuture::ready(Ok(HttpResponse::new(status, SdkBody::from(self.body))))
+        }
+    }
+
+    impl HttpClient for CannedResponse {
+        fn http_connector(
+            &self,
+            _settings: &HttpConnectorSettings,
+            _components: &RuntimeComponents,
+        ) -> SharedHttpConnector {
+            SharedHttpConnector::new(self.clone())
+        }
+    }
+
+    fn client_with(status: u16, body: &'static str) -> S3RemoteStorageClient {
+        let config = S3RemoteStorageClient::config_builder(
+            "AKIATEST",
+            "secret",
+            "us-east-1",
+            "http://127.0.0.1:1",
+            true,
+        )
+        .http_client(CannedResponse { status, body })
+        .retry_config(RetryConfig::disabled())
+        .build();
+        S3RemoteStorageClient {
+            client: Client::from_conf(config),
+            conf: RemoteConf::default(),
+        }
+    }
+
+    fn location() -> RemoteStorageLocation {
+        RemoteStorageLocation {
+            name: "remote".to_string(),
+            bucket: "bucket".to_string(),
+            path: "/dir/missing".to_string(),
+            ..Default::default()
+        }
+    }
+
+    pub(crate) const NO_SUCH_KEY: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Key>dir/missing</Key></Error>"#;
+
+    const NOT_FOUND_BODY: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<Error><Code>NotFound</Code><Message>Not Found</Message></Error>"#;
+
+    const ACCESS_DENIED: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<Error><Code>AccessDenied</Code><Message>Access Denied</Message></Error>"#;
+
+    #[tokio::test]
+    async fn get_no_such_key_is_object_not_found() {
+        let err = client_with(404, NO_SUCH_KEY)
+            .read_file(&location(), 0, 0)
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(&err, RemoteStorageError::ObjectNotFound(path) if path == "bucket/dir/missing"),
+            "expected ObjectNotFound, got {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn get_bare_404_is_not_object_not_found() {
+        // Go compares codes, not statuses, on GET: a body-less 404 stays generic.
+        let err = client_with(404, "")
+            .read_file(&location(), 0, 0)
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, RemoteStorageError::Other(_)),
+            "expected Other, got {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn head_404_is_object_not_found() {
+        let err = client_with(404, "")
+            .stat_file(&location())
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(&err, RemoteStorageError::ObjectNotFound(path) if path == "bucket/dir/missing"),
+            "expected ObjectNotFound, got {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn head_404_with_foreign_error_body_is_object_not_found() {
+        // The raw status check makes a 404 not-found whatever body it carries.
+        let err = client_with(404, NO_SUCH_KEY)
+            .stat_file(&location())
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(err, RemoteStorageError::ObjectNotFound(_)),
+            "expected ObjectNotFound, got {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn head_not_found_code_on_a_non_404_status_is_not_object_not_found() {
+        // A NotFound body on a non-404 status stays an error, as in Go.
+        let err = client_with(400, NOT_FOUND_BODY)
+            .stat_file(&location())
+            .await
+            .unwrap_err();
+        assert!(
+            matches!(&err, RemoteStorageError::Other(msg) if msg.contains("NotFound")),
+            "expected Other naming the code, got {err:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn get_access_denied_keeps_service_error_code() {
+        let err = client_with(403, ACCESS_DENIED)
+            .read_file(&location(), 0, 0)
+            .await
+            .unwrap_err();
+        let msg = err.to_string();
+        assert!(
+            matches!(err, RemoteStorageError::Other(_)),
+            "expected Other, got {err:?}"
+        );
+        assert!(
+            msg.contains("AccessDenied"),
+            "message should carry the S3 error code, got: {msg}"
+        );
+        assert!(
+            !msg.ends_with("service error"),
+            "message should not be the bare SdkError Display, got: {msg}"
+        );
+    }
+
+    #[tokio::test]
+    async fn head_access_denied_keeps_service_error_code() {
+        let err = client_with(403, ACCESS_DENIED)
+            .stat_file(&location())
+            .await
+            .unwrap_err();
+        let msg = err.to_string();
+        assert!(
+            matches!(err, RemoteStorageError::Other(_)),
+            "expected Other, got {err:?}"
+        );
+        assert!(
+            msg.contains("AccessDenied"),
+            "message should carry the S3 error code, got: {msg}"
+        );
+    }
+}
diff --git a/seaweed-volume/src/remote_storage/s3_tier.rs b/seaweed-volume/src/remote_storage/s3_tier.rs
index 41900c63c4..1bcea50bb7 100644
--- a/seaweed-volume/src/remote_storage/s3_tier.rs
+++ b/seaweed-volume/src/remote_storage/s3_tier.rs
@@ -7,15 +7,66 @@ use std::collections::HashMap;
 use std::future::Future;
 use std::sync::{Arc, OnceLock, RwLock};
 
-use aws_sdk_s3::config::{BehaviorVersion, Credentials, Region};
-use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use aws_sdk_s3::Client;
+use aws_sdk_s3::config::http::HttpResponse;
+use aws_sdk_s3::config::{BehaviorVersion, Credentials, Region};
+use aws_sdk_s3::error::{DisplayErrorContext, SdkError};
+use aws_sdk_s3::operation::get_object::GetObjectError;
+use aws_sdk_s3::operation::head_object::HeadObjectError;
+use aws_sdk_s3::types::{CompletedMultipartUpload, CompletedPart};
 use tokio::io::{AsyncReadExt, AsyncSeekExt, AsyncWriteExt};
 use tokio::sync::Semaphore;
 
 /// Concurrency limit for multipart upload/download (matches Go's s3manager).
 const CONCURRENCY: usize = 5;
 
+/// A tier transfer failure. The variant is what callers match on; the
+/// message is the operator-facing text.
+#[derive(Debug, thiserror::Error)]
+pub enum TierError {
+    /// The remote object does not exist.
+    #[error("{0}")]
+    NotFound(String),
+    /// An S3 request or a local file operation failed.
+    #[error("{0}")]
+    Io(String),
+    /// The tier I/O runtime could not be built or dropped the task.
+    #[error("{0}")]
+    RuntimeUnavailable(String),
+    /// The progress callback asked to stop.
+    #[error("{0}")]
+    Aborted(String),
+}
+
+// Not-found rules as in remote_storage/s3.rs: HEAD by the raw 404 status,
+// GET by the NoSuchKey code only.
+fn head_object_error(key: &str, e: SdkError<HeadObjectError, HttpResponse>) -> TierError {
+    let message = format!("failed to head object {}: {}", key, DisplayErrorContext(&e));
+    match e {
+        SdkError::ServiceError(ref se) if se.raw().status().as_u16() == 404 => {
+            TierError::NotFound(message)
+        }
+        _ => TierError::Io(message),
+    }
+}
+
+fn get_object_error(
+    key: &str,
+    range: &str,
+    e: SdkError<GetObjectError, HttpResponse>,
+) -> TierError {
+    let message = format!(
+        "failed to get object {} range {}: {}",
+        key,
+        range,
+        DisplayErrorContext(&e)
+    );
+    match e {
+        SdkError::ServiceError(ref se) if se.err().is_no_such_key() => TierError::NotFound(message),
+        _ => TierError::Io(message),
+    }
+}
+
 /// Configuration for an S3 tier backend.
 #[derive(Debug, Clone)]
 pub struct S3TierConfig {
@@ -81,19 +132,23 @@ impl S3TierBackend {
     /// Returns (s3_key, file_size) on success.
     /// The progress callback receives (bytes_uploaded, percentage).
     /// Uses 64MB part size and 5 concurrent uploads (matches Go s3manager).
+    /// `progress_fn` returning `Err` aborts the upload, mirroring Go's
+    /// `fn(progressed, percentage) error` in `s3_upload.go`, where the error
+    /// surfaces out of `ReadAt` and fails the transfer. It is what lets a
+    /// caller that has hung up stop the work it is no longer waiting for.
     pub async fn upload_file<F>(
         &self,
         file_path: &str,
         progress_fn: F,
-    ) -> Result<(String, u64), String>
+    ) -> Result<(String, u64), TierError>
     where
-        F: FnMut(i64, f32) + Send + Sync + 'static,
+        F: FnMut(i64, f32) -> Result<(), String> + Send + Sync + 'static,
     {
         let key = uuid::Uuid::new_v4().to_string();
 
         let metadata = tokio::fs::metadata(file_path)
             .await
-            .map_err(|e| format!("failed to stat file {}: {}", file_path, e))?;
+            .map_err(|e| TierError::Io(format!("failed to stat file {}: {}", file_path, e)))?;
         let file_size = metadata.len();
 
         // Calculate part size: start at 64MB, scale up for very large files (matches Go)
@@ -115,11 +170,16 @@ impl S3TierBackend {
             )
             .send()
             .await
-            .map_err(|e| format!("failed to create multipart upload: {}", e))?;
+            .map_err(|e| {
+                TierError::Io(format!(
+                    "failed to create multipart upload: {}",
+                    DisplayErrorContext(&e)
+                ))
+            })?;
 
         let upload_id = create_resp
             .upload_id()
-            .ok_or_else(|| "no upload_id in multipart upload response".to_string())?
+            .ok_or_else(|| TierError::Io("no upload_id in multipart upload response".to_string()))?
             .to_string();
 
         // Build list of (part_number, offset, size) for all parts
@@ -155,19 +215,21 @@ impl S3TierBackend {
                 let _permit = sem
                     .acquire()
                     .await
-                    .map_err(|e| format!("semaphore error: {}", e))?;
+                    .map_err(|e| TierError::Io(format!("semaphore error: {}", e)))?;
 
                 // Read this part's data from the file at the correct offset
                 let mut file = tokio::fs::File::open(&fp)
                     .await
-                    .map_err(|e| format!("failed to open file {}: {}", fp, e))?;
+                    .map_err(|e| TierError::Io(format!("failed to open file {}: {}", fp, e)))?;
                 file.seek(std::io::SeekFrom::Start(off))
                     .await
-                    .map_err(|e| format!("failed to seek to offset {}: {}", off, e))?;
+                    .map_err(|e| {
+                        TierError::Io(format!("failed to seek to offset {}: {}", off, e))
+                    })?;
                 let mut buf = vec![0u8; size];
-                file.read_exact(&mut buf)
-                    .await
-                    .map_err(|e| format!("failed to read file at offset {}: {}", off, e))?;
+                file.read_exact(&mut buf).await.map_err(|e| {
+                    TierError::Io(format!("failed to read file at offset {}: {}", off, e))
+                })?;
 
                 let upload_part_resp = client
                     .upload_part()
@@ -179,13 +241,20 @@ impl S3TierBackend {
                     .send()
                     .await
                     .map_err(|e| {
-                        format!("failed to upload part {} at offset {}: {}", pn, off, e)
+                        TierError::Io(format!(
+                            "failed to upload part {} at offset {}: {}",
+                            pn,
+                            off,
+                            DisplayErrorContext(&e)
+                        ))
                     })?;
 
                 let e_tag = upload_part_resp.e_tag().unwrap_or_default().to_string();
 
-                // Report progress
-                {
+                // Report progress. The lock is released before the result is
+                // propagated so an aborting callback cannot poison the mutex
+                // for the other parts still in flight.
+                let progress_result = {
                     let mut guard = progress.lock().unwrap();
                     guard.0 += size as u64;
                     let uploaded = guard.0;
@@ -194,10 +263,11 @@ impl S3TierBackend {
                     } else {
                         100.0
                     };
-                    (guard.1)(uploaded as i64, pct);
-                }
+                    (guard.1)(uploaded as i64, pct)
+                };
+                progress_result.map_err(TierError::Aborted)?;
 
-                Ok::<_, String>(
+                Ok::<_, TierError>(
                     CompletedPart::builder()
                         .e_tag(e_tag)
                         .part_number(pn)
@@ -206,29 +276,63 @@ impl S3TierBackend {
             }));
         }
 
-        // Collect results, preserving part order
-        let mut completed_parts = Vec::with_capacity(handles.len());
-        for handle in handles {
-            let part = handle
+        let finish = async {
+            // Collect results, preserving part order
+            let mut completed_parts = Vec::with_capacity(handles.len());
+            for handle in handles {
+                let part = handle
+                    .await
+                    .map_err(|e| TierError::Io(format!("upload task panicked: {}", e)))??;
+                completed_parts.push(part);
+            }
+
+            // Complete multipart upload
+            let completed_upload = CompletedMultipartUpload::builder()
+                .set_parts(Some(completed_parts))
+                .build();
+
+            self.client
+                .complete_multipart_upload()
+                .bucket(&self.bucket)
+                .key(&key)
+                .upload_id(&upload_id)
+                .multipart_upload(completed_upload)
+                .send()
                 .await
-                .map_err(|e| format!("upload task panicked: {}", e))??;
-            completed_parts.push(part);
+                .map_err(|e| {
+                    TierError::Io(format!(
+                        "failed to complete multipart upload: {}",
+                        DisplayErrorContext(&e)
+                    ))
+                })?;
+
+            Ok::<(), TierError>(())
         }
+        .await;
 
-        // Complete multipart upload
-        let completed_upload = CompletedMultipartUpload::builder()
-            .set_parts(Some(completed_parts))
-            .build();
-
-        self.client
-            .complete_multipart_upload()
-            .bucket(&self.bucket)
-            .key(&key)
-            .upload_id(&upload_id)
-            .multipart_upload(completed_upload)
-            .send()
-            .await
-            .map_err(|e| format!("failed to complete multipart upload: {}", e))?;
+        if let Err(e) = finish {
+            // An abandoned multipart upload does not appear in an ordinary
+            // object listing but still accrues storage charges until a
+            // lifecycle rule reaps it. Now that a departing caller aborts the
+            // transfer this is a routine path, not a rare one.
+            if let Err(abort_err) = self
+                .client
+                .abort_multipart_upload()
+                .bucket(&self.bucket)
+                .key(&key)
+                .upload_id(&upload_id)
+                .send()
+                .await
+            {
+                tracing::warn!(
+                    "failed to abort multipart upload {} for key {}: {}",
+                    upload_id,
+                    key,
+                    abort_err
+                );
+            }
+            return Err(e);
+        }
 
         Ok((key, file_size))
     }
@@ -238,14 +342,16 @@ impl S3TierBackend {
     ///
     /// Returns the file size on success.
     /// Uses 64MB part size and 5 concurrent downloads (matches Go s3manager).
+    /// `progress_fn` returning `Err` aborts the download, mirroring Go's
+    /// `fn(progressed, percentage) error` in `s3_download.go`.
     pub async fn download_file<F>(
         &self,
         dest_path: &str,
         key: &str,
         progress_fn: F,
-    ) -> Result<u64, String>
+    ) -> Result<u64, TierError>
     where
-        F: FnMut(i64, f32) + Send + Sync + 'static,
+        F: FnMut(i64, f32) -> Result<(), String> + Send + Sync + 'static,
     {
         // Get file size first
         let head_resp = self
@@ -255,7 +361,7 @@ impl S3TierBackend {
             .key(key)
             .send()
             .await
-            .map_err(|e| format!("failed to head object {}: {}", key, e))?;
+            .map_err(|e| head_object_error(key, e))?;
 
         let file_size = head_resp.content_length().unwrap_or(0) as u64;
 
@@ -267,10 +373,12 @@ impl S3TierBackend {
                 .truncate(true)
                 .open(dest_path)
                 .await
-                .map_err(|e| format!("failed to open dest file {}: {}", dest_path, e))?;
+                .map_err(|e| {
+                    TierError::Io(format!("failed to open dest file {}: {}", dest_path, e))
+                })?;
             file.set_len(file_size)
                 .await
-                .map_err(|e| format!("failed to set file length: {}", e))?;
+                .map_err(|e| TierError::Io(format!("failed to set file length: {}", e)))?;
         }
 
         let part_size: u64 = 64 * 1024 * 1024;
@@ -306,7 +414,7 @@ impl S3TierBackend {
                 let _permit = sem
                     .acquire()
                     .await
-                    .map_err(|e| format!("semaphore error: {}", e))?;
+                    .map_err(|e| TierError::Io(format!("semaphore error: {}", e)))?;
 
                 let end = off + size - 1;
                 let range = format!("bytes={}-{}", off, end);
@@ -318,13 +426,13 @@ impl S3TierBackend {
                     .range(&range)
                     .send()
                     .await
-                    .map_err(|e| format!("failed to get object {} range {}: {}", key, range, e))?;
+                    .map_err(|e| get_object_error(&key, &range, e))?;
 
                 let body = get_resp
                     .body
                     .collect()
                     .await
-                    .map_err(|e| format!("failed to read body: {}", e))?;
+                    .map_err(|e| TierError::Io(format!("failed to read body: {}", e)))?;
                 let bytes = body.into_bytes();
 
                 // Write at the correct offset (like Go's WriteAt)
@@ -332,16 +440,22 @@ impl S3TierBackend {
                     .write(true)
                     .open(&dp)
                     .await
-                    .map_err(|e| format!("failed to open dest file {}: {}", dp, e))?;
+                    .map_err(|e| {
+                        TierError::Io(format!("failed to open dest file {}: {}", dp, e))
+                    })?;
                 file.seek(std::io::SeekFrom::Start(off))
                     .await
-                    .map_err(|e| format!("failed to seek to offset {}: {}", off, e))?;
+                    .map_err(|e| {
+                        TierError::Io(format!("failed to seek to offset {}: {}", off, e))
+                    })?;
                 file.write_all(&bytes)
                     .await
-                    .map_err(|e| format!("failed to write to {}: {}", dp, e))?;
+                    .map_err(|e| TierError::Io(format!("failed to write to {}: {}", dp, e)))?;
 
-                // Report progress
-                {
+                // Report progress. The lock is released before the result is
+                // propagated so an aborting callback cannot poison the mutex
+                // for the other parts still in flight.
+                let progress_result = {
                     let mut guard = progress.lock().unwrap();
                     guard.0 += bytes.len() as u64;
                     let downloaded = guard.0;
@@ -350,10 +464,11 @@ impl S3TierBackend {
                     } else {
                         100.0
                     };
-                    (guard.1)(downloaded as i64, pct);
-                }
+                    (guard.1)(downloaded as i64, pct)
+                };
+                progress_result.map_err(TierError::Aborted)?;
 
-                Ok::<_, String>(())
+                Ok::<_, TierError>(())
             }));
         }
 
@@ -361,7 +476,7 @@ impl S3TierBackend {
         for handle in handles {
             handle
                 .await
-                .map_err(|e| format!("download task panicked: {}", e))??;
+                .map_err(|e| TierError::Io(format!("download task panicked: {}", e)))??;
         }
 
         // fsync the file so its content is durable before the caller trims the .vif
@@ -370,16 +485,21 @@ impl S3TierBackend {
             .write(true)
             .open(dest_path)
             .await
-            .map_err(|e| format!("failed to open {} for fsync: {}", dest_path, e))?;
+            .map_err(|e| TierError::Io(format!("failed to open {} for fsync: {}", dest_path, e)))?;
         synced
             .sync_all()
             .await
-            .map_err(|e| format!("failed to fsync {}: {}", dest_path, e))?;
+            .map_err(|e| TierError::Io(format!("failed to fsync {}: {}", dest_path, e)))?;
 
         Ok(file_size)
     }
 
-    pub async fn read_range(&self, key: &str, offset: u64, size: usize) -> Result<Vec<u8>, String> {
+    pub async fn read_range(
+        &self,
+        key: &str,
+        offset: u64,
+        size: usize,
+    ) -> Result<Vec<u8>, TierError> {
         let end = offset + (size as u64).saturating_sub(1);
         let range = format!("bytes={}-{}", offset, end);
         let resp = self
@@ -390,29 +510,35 @@ impl S3TierBackend {
             .range(&range)
             .send()
             .await
-            .map_err(|e| format!("failed to get object {} range {}: {}", key, range, e))?;
+            .map_err(|e| get_object_error(key, &range, e))?;
 
         let body = resp
             .body
             .collect()
             .await
-            .map_err(|e| format!("failed to read object {} body: {}", key, e))?;
+            .map_err(|e| TierError::Io(format!("failed to read object {} body: {}", key, e)))?;
         Ok(body.into_bytes().to_vec())
     }
 
     /// Delete a file from S3.
-    pub async fn delete_file(&self, key: &str) -> Result<(), String> {
+    pub async fn delete_file(&self, key: &str) -> Result<(), TierError> {
         self.client
             .delete_object()
             .bucket(&self.bucket)
             .key(key)
             .send()
             .await
-            .map_err(|e| format!("failed to delete object {}: {}", key, e))?;
+            .map_err(|e| {
+                TierError::Io(format!(
+                    "failed to delete object {}: {}",
+                    key,
+                    DisplayErrorContext(&e)
+                ))
+            })?;
         Ok(())
     }
 
-    pub fn delete_file_blocking(&self, key: &str) -> Result<(), String> {
+    pub fn delete_file_blocking(&self, key: &str) -> Result<(), TierError> {
         let client = self.client.clone();
         let bucket = self.bucket.clone();
         let key = key.to_string();
@@ -423,7 +549,13 @@ impl S3TierBackend {
                 .key(&key)
                 .send()
                 .await
-                .map_err(|e| format!("failed to delete object {}: {}", key, e))?;
+                .map_err(|e| {
+                    TierError::Io(format!(
+                        "failed to delete object {}: {}",
+                        key,
+                        DisplayErrorContext(&e)
+                    ))
+                })?;
             Ok(())
         })
     }
@@ -433,7 +565,7 @@ impl S3TierBackend {
         key: &str,
         offset: u64,
         size: usize,
-    ) -> Result<Vec<u8>, String> {
+    ) -> Result<Vec<u8>, TierError> {
         let client = self.client.clone();
         let bucket = self.bucket.clone();
         let key = key.to_string();
@@ -447,13 +579,12 @@ impl S3TierBackend {
                 .range(&range)
                 .send()
                 .await
-                .map_err(|e| format!("failed to get object {} range {}: {}", key, range, e))?;
+                .map_err(|e| get_object_error(&key, &range, e))?;
 
-            let body = resp
-                .body
-                .collect()
-                .await
-                .map_err(|e| format!("failed to read object {} body: {}", key, e))?;
+            let body =
+                resp.body.collect().await.map_err(|e| {
+                    TierError::Io(format!("failed to read object {} body: {}", key, e))
+                })?;
             Ok(body.into_bytes().to_vec())
         })
     }
@@ -514,18 +645,279 @@ pub fn global_s3_tier_registry() -> &'static RwLock<S3TierRegistry> {
     GLOBAL_S3_TIER_REGISTRY.get_or_init(|| RwLock::new(S3TierRegistry::new()))
 }
 
-fn block_on_tier_future<F, T>(future: F) -> Result<T, String>
-where
-    F: Future<Output = Result<T, String>> + Send + 'static,
-    T: Send + 'static,
-{
-    std::thread::spawn(move || {
-        let runtime = tokio::runtime::Builder::new_current_thread()
+/// The one process-wide runtime for tiered-S3 I/O issued from synchronous
+/// storage code. A per-call runtime tore down the SDK's pooled connections
+/// after every 64 KiB chunk, re-dialing TLS per read; a long-lived runtime
+/// keeps the pool warm.
+///
+/// Built on first use. A build failure is returned, not cached or panicked:
+/// callers sit inside `Volume::destroy` and needle reads, whose own error
+/// paths must run, and a later call may succeed.
+static TIER_RUNTIME: std::sync::Mutex<Option<tokio::runtime::Runtime>> =
+    std::sync::Mutex::new(None);
+
+fn tier_handle() -> Result<tokio::runtime::Handle, TierError> {
+    let mut slot = TIER_RUNTIME
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner());
+    if slot.is_none() {
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .worker_threads(2)
+            .thread_name("tier-io")
             .enable_all()
             .build()
-            .map_err(|e| format!("failed to build tokio runtime: {}", e))?;
-        runtime.block_on(future)
-    })
-    .join()
-    .map_err(|_| "tier runtime thread panicked".to_string())?
+            .map_err(|e| {
+                TierError::RuntimeUnavailable(format!(
+                    "failed to build the tier I/O tokio runtime: {}",
+                    e
+                ))
+            })?;
+        *slot = Some(runtime);
+    }
+    Ok(slot.as_ref().expect("just initialised").handle().clone())
+}
+
+/// Run `future` on the tier runtime and block the calling thread until it
+/// finishes. The caller may be a worker of *another* tokio runtime, so this
+/// waits on a channel rather than `Handle::block_on`, which panics when
+/// called from inside any runtime context.
+fn block_on_tier_future<F, T>(future: F) -> Result<T, TierError>
+where
+    F: Future<Output = Result<T, TierError>> + Send + 'static,
+    T: Send + 'static,
+{
+    let handle = tier_handle()?;
+    let task = handle.spawn(future);
+    let (tx, rx) = std::sync::mpsc::sync_channel(1);
+    handle.spawn(async move {
+        // The receiver only goes away if the caller was unwound; nothing to
+        // report then.
+        let _ = tx.send(task.await);
+    });
+    match rx.recv() {
+        Ok(Ok(result)) => result,
+        Ok(Err(join_error)) => Err(describe_join_error(join_error)),
+        Err(_) => Err(TierError::RuntimeUnavailable(
+            "tier I/O runtime dropped the task before it finished".to_string(),
+        )),
+    }
+}
+
+/// Turn a `JoinError` into a message that keeps the panic payload, so an
+/// SDK panic surfaces as "boom" rather than a fixed "thread panicked".
+fn describe_join_error(join_error: tokio::task::JoinError) -> TierError {
+    if join_error.is_panic() {
+        let payload = join_error.into_panic();
+        let message = if let Some(s) = payload.downcast_ref::<&str>() {
+            (*s).to_string()
+        } else if let Some(s) = payload.downcast_ref::<String>() {
+            s.clone()
+        } else {
+            "non-string panic payload".to_string()
+        };
+        TierError::Io(format!("tier I/O task panicked: {}", message))
+    } else {
+        TierError::RuntimeUnavailable(format!("tier I/O task failed: {}", join_error))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::remote_storage::s3::tests::{CannedResponse, NO_SUCH_KEY};
+    use std::collections::HashSet;
+    use tokio::runtime::Handle;
+
+    fn probe() -> Result<(tokio::runtime::Id, Option<String>), TierError> {
+        block_on_tier_future(async {
+            Ok((
+                Handle::current().id(),
+                std::thread::current().name().map(str::to_string),
+            ))
+        })
+    }
+
+    #[test]
+    fn block_on_tier_future_reuses_one_runtime() {
+        let (first_runtime, first_thread) = probe().expect("first call");
+        let (second_runtime, second_thread) = probe().expect("second call");
+        assert_eq!(
+            first_runtime, second_runtime,
+            "each call must run on the same long-lived tier runtime"
+        );
+        assert_eq!(first_thread.as_deref(), Some("tier-io"));
+        assert_eq!(second_thread.as_deref(), Some("tier-io"));
+
+        let mut runtimes = HashSet::new();
+        for _ in 0..20 {
+            let (id, _) = probe().expect("probe");
+            runtimes.insert(id);
+        }
+        assert_eq!(runtimes.len(), 1);
+    }
+
+    #[test]
+    fn block_on_tier_future_returns_the_value_and_the_error() {
+        assert_eq!(block_on_tier_future(async { Ok(7u32) }).unwrap(), 7);
+        let err = block_on_tier_future::<_, u32>(async { Err(TierError::NotFound("nope".into())) })
+            .unwrap_err();
+        assert!(
+            matches!(&err, TierError::NotFound(m) if m == "nope"),
+            "{err:?}"
+        );
+    }
+
+    #[test]
+    fn block_on_tier_future_works_from_a_std_thread() {
+        let (id, _) = std::thread::spawn(probe)
+            .join()
+            .expect("probe thread")
+            .expect("probe");
+        assert_eq!(id, tier_handle().expect("tier runtime").id());
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn block_on_tier_future_works_from_spawn_blocking() {
+        let (id, _) = tokio::task::spawn_blocking(probe)
+            .await
+            .expect("spawn_blocking")
+            .expect("probe");
+        assert_eq!(id, tier_handle().expect("tier runtime").id());
+        assert_ne!(id, Handle::current().id());
+    }
+
+    // Called straight from another runtime's async context: the case that
+    // would panic with `Handle::block_on` ("Cannot start a runtime from
+    // within a runtime").
+    #[tokio::test]
+    async fn block_on_tier_future_works_from_a_current_thread_runtime() {
+        let (id, _) = probe().expect("probe");
+        assert_eq!(id, tier_handle().expect("tier runtime").id());
+        assert_ne!(id, Handle::current().id());
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn block_on_tier_future_works_from_a_multi_thread_runtime_worker() {
+        let (id, _) = probe().expect("probe");
+        assert_eq!(id, tier_handle().expect("tier runtime").id());
+        assert_ne!(id, Handle::current().id());
+    }
+
+    #[test]
+    fn block_on_tier_future_reports_the_panic_payload() {
+        let err = block_on_tier_future::<_, ()>(async {
+            if std::hint::black_box(true) {
+                panic!("boom {}", 42);
+            }
+            Ok(())
+        })
+        .expect_err("a panicking future must be an error");
+        assert!(matches!(err, TierError::Io(_)), "got: {err:?}");
+        assert!(err.to_string().contains("boom 42"), "got: {err}");
+        assert!(err.to_string().contains("panicked"), "got: {err}");
+    }
+
+    #[test]
+    fn block_on_tier_future_reports_a_str_panic_payload() {
+        let err = block_on_tier_future::<_, ()>(async {
+            if std::hint::black_box(true) {
+                panic!("static boom");
+            }
+            Ok(())
+        })
+        .expect_err("a panicking future must be an error");
+        assert!(err.to_string().contains("static boom"), "got: {err}");
+    }
+
+    fn backend_answering(status: u16, body: &'static str) -> S3TierBackend {
+        let config = aws_sdk_s3::Config::builder()
+            .behavior_version(BehaviorVersion::latest())
+            .region(Region::new("us-east-1"))
+            .credentials_provider(Credentials::new("AKIATEST", "secret", None, None, "test"))
+            .endpoint_url("http://127.0.0.1:1")
+            .force_path_style(true)
+            .http_client(CannedResponse { status, body })
+            .retry_config(aws_sdk_s3::config::retry::RetryConfig::disabled())
+            .build();
+        S3TierBackend {
+            client: Client::from_conf(config),
+            bucket: "bucket".to_string(),
+            storage_class: "STANDARD".to_string(),
+        }
+    }
+
+    #[tokio::test]
+    async fn download_head_404_is_not_found() {
+        let tmp = tempfile::tempdir().unwrap();
+        let dest = tmp.path().join("1.dat");
+        let err = backend_answering(404, "")
+            .download_file(dest.to_str().unwrap(), "missing", |_, _| Ok(()))
+            .await
+            .unwrap_err();
+        assert!(matches!(err, TierError::NotFound(_)), "{err:?}");
+        assert!(
+            err.to_string()
+                .starts_with("failed to head object missing: "),
+            "{err}"
+        );
+    }
+
+    #[tokio::test]
+    async fn download_head_403_is_io() {
+        let tmp = tempfile::tempdir().unwrap();
+        let dest = tmp.path().join("1.dat");
+        let err = backend_answering(403, "")
+            .download_file(dest.to_str().unwrap(), "denied", |_, _| Ok(()))
+            .await
+            .unwrap_err();
+        assert!(matches!(err, TierError::Io(_)), "{err:?}");
+    }
+
+    #[tokio::test]
+    async fn read_range_no_such_key_is_not_found() {
+        let err = backend_answering(404, NO_SUCH_KEY)
+            .read_range("missing", 0, 8)
+            .await
+            .unwrap_err();
+        assert!(matches!(err, TierError::NotFound(_)), "{err:?}");
+        assert!(
+            err.to_string()
+                .starts_with("failed to get object missing range bytes=0-7: "),
+            "{err}"
+        );
+    }
+
+    #[tokio::test]
+    async fn read_range_bare_404_is_io() {
+        // As in Go, GET is not-found by the NoSuchKey code, not the status.
+        let err = backend_answering(404, "")
+            .read_range("missing", 0, 8)
+            .await
+            .unwrap_err();
+        assert!(matches!(err, TierError::Io(_)), "{err:?}");
+    }
+
+    #[test]
+    fn read_range_blocking_no_such_key_is_not_found() {
+        let err = backend_answering(404, NO_SUCH_KEY)
+            .read_range_blocking("missing", 0, 8)
+            .unwrap_err();
+        assert!(matches!(err, TierError::NotFound(_)), "{err:?}");
+    }
+
+    #[test]
+    fn backend_name_to_type_id_splits_on_dot() {
+        assert_eq!(
+            backend_name_to_type_id("s3"),
+            ("s3".to_string(), "default".to_string())
+        );
+        assert_eq!(
+            backend_name_to_type_id("s3.eu"),
+            ("s3".to_string(), "eu".to_string())
+        );
+        assert_eq!(
+            backend_name_to_type_id("s3.a.b"),
+            (String::new(), String::new())
+        );
+    }
 }
diff --git a/seaweed-volume/src/security.rs b/seaweed-volume/src/security.rs
index b719c3f00d..de4168a6fa 100644
--- a/seaweed-volume/src/security.rs
+++ b/seaweed-volume/src/security.rs
@@ -10,7 +10,7 @@ use std::collections::HashSet;
 use std::net::IpAddr;
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use jsonwebtoken::{decode, encode, Algorithm, DecodingKey, EncodingKey, Header, Validation};
+use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header, Validation, decode, encode};
 use serde::{Deserialize, Serialize};
 
 // ============================================================================
@@ -192,6 +192,13 @@ impl Guard {
         self.is_write_active = !is_empty_whitelist || !self.signing_key.is_empty();
     }
 
+    /// Whether any write-side control is configured: a non-empty whitelist or a
+    /// signing key. Mirrors Go's non-nil `guard` -- when this is false, every
+    /// caller is allowed and admin RPCs need not carry peer info.
+    pub fn is_write_active(&self) -> bool {
+        self.is_write_active
+    }
+
     /// Check if a remote IP is in the whitelist.
     /// Returns true if write security is inactive (no whitelist and no signing key),
     /// if the whitelist is empty, or if the IP matches.
@@ -290,10 +297,10 @@ impl Guard {
 /// Extract host from "host:port" or "[::1]:port" format.
 fn extract_host(addr: &str) -> String {
     // Handle IPv6 with brackets
-    if addr.starts_with('[') {
-        if let Some(end) = addr.find(']') {
-            return addr[1..end].to_string();
-        }
+    if addr.starts_with('[')
+        && let Some(end) = addr.find(']')
+    {
+        return addr[1..end].to_string();
     }
     // Handle host:port
     if let Some(pos) = addr.rfind(':') {
@@ -474,9 +481,11 @@ mod tests {
         let token = gen_jwt(&key, 3600, "3,01637037d6").unwrap();
 
         // Correct file ID
-        assert!(guard
-            .check_jwt_for_file(Some(&token), "3,01637037d6", true)
-            .is_ok());
+        assert!(
+            guard
+                .check_jwt_for_file(Some(&token), "3,01637037d6", true)
+                .is_ok()
+        );
 
         // Wrong file ID
         let err = guard.check_jwt_for_file(Some(&token), "4,deadbeef", true);
diff --git a/seaweed-volume/src/security/tls.rs b/seaweed-volume/src/security/tls.rs
index 21de7a646a..7dd2094b8b 100644
--- a/seaweed-volume/src/security/tls.rs
+++ b/seaweed-volume/src/security/tls.rs
@@ -3,12 +3,12 @@ use std::fmt;
 use std::sync::Arc;
 
 use rustls::client::danger::HandshakeSignatureValid;
-use rustls::crypto::aws_lc_rs;
 use rustls::crypto::CryptoProvider;
+use rustls::crypto::aws_lc_rs;
 use rustls::pki_types::UnixTime;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
-use rustls::server::danger::{ClientCertVerified, ClientCertVerifier};
 use rustls::server::WebPkiClientVerifier;
+use rustls::server::danger::{ClientCertVerified, ClientCertVerifier};
 use rustls::{
     CipherSuite, DigitallySignedStruct, DistinguishedName, RootCertStore, ServerConfig,
     SignatureScheme, SupportedCipherSuite, SupportedProtocolVersion,
@@ -120,10 +120,11 @@ impl ClientCertVerifier for CommonNameVerifier {
 
 // aws-lc-rs and ring both get linked transitively, so rustls can't auto-select
 // a provider and tonic's client TLS panics on first use. Pin the default to
-// aws-lc-rs, matching the server config. Idempotent.
-pub fn install_default_crypto_provider() {
-    let _ = aws_lc_rs::default_provider().install_default();
-}
+// aws-lc-rs, matching the server config. Idempotent. The body lives in
+// seaweed-common so this binary and the Rust plugin workers cannot end up
+// installing different providers; re-exported here so callers keep their
+// import path.
+pub use seaweed_common::tls::install_default_crypto_provider;
 
 pub fn build_rustls_server_config(
     cert_path: &str,
@@ -376,7 +377,7 @@ fn go_tls_version_for_supported(version: &SupportedProtocolVersion) -> GoTlsVers
 
 #[cfg(test)]
 mod tests {
-    use super::{build_supported_versions, common_name_is_allowed, parse_cipher_suites, TlsPolicy};
+    use super::{TlsPolicy, build_supported_versions, common_name_is_allowed, parse_cipher_suites};
     use rustls::crypto::aws_lc_rs;
     use std::collections::HashSet;
 
diff --git a/seaweed-volume/src/server/debug.rs b/seaweed-volume/src/server/debug.rs
index dd1b69cf1b..63bdc63018 100644
--- a/seaweed-volume/src/server/debug.rs
+++ b/seaweed-volume/src/server/debug.rs
@@ -1,9 +1,9 @@
+use axum::Router;
 use axum::body::Body;
 use axum::extract::Query;
-use axum::http::{header, StatusCode};
+use axum::http::{StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use axum::routing::{any, get};
-use axum::Router;
 use pprof::protos::Message;
 use serde::Deserialize;
 
diff --git a/seaweed-volume/src/server/grpc_client.rs b/seaweed-volume/src/server/grpc_client.rs
index 6a2f44964a..9567e43658 100644
--- a/seaweed-volume/src/server/grpc_client.rs
+++ b/seaweed-volume/src/server/grpc_client.rs
@@ -1,16 +1,42 @@
+//! Construction of the volume server's *outgoing* gRPC clients: TLS material,
+//! endpoint tuning, dial bounds, and the three client constructors every call
+//! site goes through.
+//!
+//! The keepalive, window-size and message-size constants below are shared with
+//! the *inbound* server built in `main.rs`, which imports them from here rather
+//! than declaring its own. Changing one therefore changes both directions at
+//! once, which is deliberate: a volume server talks to its peers with the same
+//! HTTP/2 settings it offers them.
+
 use std::error::Error;
 use std::fmt;
 use std::time::Duration;
 
 use hyper::http::Uri;
+use tonic::service::interceptor::InterceptedService;
 use tonic::transport::{Certificate, Channel, ClientTlsConfig, Endpoint, Identity};
+use tonic::{Request, Status};
 
 use crate::config::VolumeServerConfig;
+use crate::pb::filer_pb::seaweed_filer_client::SeaweedFilerClient;
+use crate::pb::master_pb::seaweed_client::SeaweedClient;
+use crate::pb::volume_server_pb::volume_server_client::VolumeServerClient;
+use crate::server::request_id::outgoing_request_id_interceptor;
 
 pub const GRPC_MAX_MESSAGE_SIZE: usize = 1 << 30;
-const GRPC_KEEPALIVE_INTERVAL: Duration = Duration::from_secs(60);
-const GRPC_KEEPALIVE_TIMEOUT: Duration = Duration::from_secs(20);
-const GRPC_INITIAL_WINDOW_SIZE: u32 = 16 * 1024 * 1024;
+pub const GRPC_KEEPALIVE_INTERVAL: Duration = Duration::from_secs(60);
+pub const GRPC_KEEPALIVE_TIMEOUT: Duration = Duration::from_secs(20);
+pub const GRPC_INITIAL_WINDOW_SIZE: u32 = 16 * 1024 * 1024;
+
+/// Bound on the TCP connect of every outgoing dial. `build_grpc_endpoint` is
+/// private and `connect_channel` is the only way out of this module, so every
+/// call site picks this up whether it thinks about timeouts or not.
+///
+/// It bounds the TCP handshake only — tonic hands it to
+/// `HttpConnector::set_connect_timeout`. A peer that completes the handshake
+/// and then stalls in the TLS or HTTP/2 exchange is not covered; callers that
+/// need that bound wrap the whole dial (see `connect_ping_target`).
+const GRPC_CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
 
 #[derive(Clone, Debug)]
 pub struct OutgoingGrpcTlsConfig {
@@ -33,23 +59,33 @@ impl Error for GrpcClientError {}
 pub fn load_outgoing_grpc_tls(
     config: &VolumeServerConfig,
 ) -> Result<Option<OutgoingGrpcTlsConfig>, GrpcClientError> {
-    if config.grpc_cert_file.is_empty()
-        || config.grpc_key_file.is_empty()
-        || config.grpc_ca_file.is_empty()
+    // prefer a dedicated client certificate: CAs may issue certs with only one of the serverAuth/clientAuth EKUs
+    let (cert_file, key_file) = if !config.grpc_client_cert_file.is_empty()
+        && !config.grpc_client_key_file.is_empty()
     {
+        (&config.grpc_client_cert_file, &config.grpc_client_key_file)
+    } else {
+        if !config.grpc_client_cert_file.is_empty() || !config.grpc_client_key_file.is_empty() {
+            tracing::warn!(
+                "grpc.volume.client_cert and grpc.volume.client_key must both be set, falling back to grpc.volume.cert and grpc.volume.key"
+            );
+        }
+        (&config.grpc_cert_file, &config.grpc_key_file)
+    };
+    if cert_file.is_empty() || key_file.is_empty() || config.grpc_ca_file.is_empty() {
         return Ok(None);
     }
 
-    let cert_pem = std::fs::read_to_string(&config.grpc_cert_file).map_err(|e| {
+    let cert_pem = std::fs::read_to_string(cert_file).map_err(|e| {
         GrpcClientError(format!(
             "Failed to read outgoing gRPC cert '{}': {}",
-            config.grpc_cert_file, e
+            cert_file, e
         ))
     })?;
-    let key_pem = std::fs::read_to_string(&config.grpc_key_file).map_err(|e| {
+    let key_pem = std::fs::read_to_string(key_file).map_err(|e| {
         GrpcClientError(format!(
             "Failed to read outgoing gRPC key '{}': {}",
-            config.grpc_key_file, e
+            key_file, e
         ))
     })?;
     let ca_pem = std::fs::read_to_string(&config.grpc_ca_file).map_err(|e| {
@@ -71,7 +107,7 @@ pub fn grpc_endpoint_uri(grpc_host_port: &str, tls: Option<&OutgoingGrpcTlsConfi
     format!("{}://{}", scheme, grpc_host_port)
 }
 
-pub fn build_grpc_endpoint(
+fn build_grpc_endpoint(
     grpc_host_port: &str,
     tls: Option<&OutgoingGrpcTlsConfig>,
 ) -> Result<Endpoint, GrpcClientError> {
@@ -107,6 +143,184 @@ pub fn build_grpc_endpoint(
     Ok(endpoint)
 }
 
+/// Connect `endpoint` through a connector that re-validates every resolved
+/// address at connect time (Go's `guardedDialerPolicy` mirror), pinning a
+/// validated copy/tail source against DNS rebinding. `allow_untrusted`
+/// preserves the plain connect for operators that opted out.
+pub async fn connect_guarded(
+    endpoint: Endpoint,
+    target: &str,
+    allow_untrusted: bool,
+) -> Result<Channel, GrpcClientError> {
+    if allow_untrusted {
+        return endpoint
+            .connect()
+            .await
+            .map_err(|e| GrpcClientError(format!("connect {} failed: {}", target, e)));
+    }
+    let target_owned = target.to_string();
+    let connector = tower::service_fn(move |uri: Uri| {
+        let target = target_owned.clone();
+        async move {
+            let host = uri.host().unwrap_or_default().to_string();
+            let port = uri.port_u16().unwrap_or(80);
+            crate::remote_storage::guarded_tcp_connect(&host, port, &target)
+                .await
+                .map(hyper_util::rt::TokioIo::new)
+        }
+    });
+    endpoint
+        .connect_with_connector(connector)
+        .await
+        .map_err(|e| GrpcClientError(format!("connect {} failed: {}", target, e)))
+}
+
+/// How a dial is bounded.
+///
+/// `connect_timeout` is handed to the TCP connector. `request_timeout` becomes
+/// [`Endpoint::timeout`], which tonic installs as a `GrpcTimeout` layer in
+/// front of *every* request the resulting channel carries — it is not a
+/// property of one call.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct GrpcDialOptions {
+    /// Bound on establishing the connection to the peer.
+    pub connect_timeout: Duration,
+    /// Deadline applied to each RPC on the channel, or `None` to leave them
+    /// unbounded.
+    pub request_timeout: Option<Duration>,
+}
+
+impl GrpcDialOptions {
+    /// A short request/response call: connect within 5 s, answer within 10 s.
+    pub fn unary() -> Self {
+        Self {
+            connect_timeout: GRPC_CONNECT_TIMEOUT,
+            request_timeout: Some(Duration::from_secs(10)),
+        }
+    }
+
+    /// A call the peer may take a while to answer: connect within 5 s, answer
+    /// within 30 s.
+    pub fn long() -> Self {
+        Self {
+            connect_timeout: GRPC_CONNECT_TIMEOUT,
+            request_timeout: Some(Duration::from_secs(30)),
+        }
+    }
+
+    /// A bounded connect with no deadline on the RPCs themselves.
+    ///
+    /// `request_timeout` must stay `None` here. [`Endpoint::timeout`] is not a
+    /// transfer budget: tonic layers it as a `GrpcTimeout` around the
+    /// response future, which resolves when the server's *first response
+    /// headers* arrive, so it bounds how long the peer may take to start
+    /// answering — per request, for every request the channel carries. A 10 s
+    /// value picked to suit one short call would therefore also be the header
+    /// deadline for the `VolumeCopy` that shares the dial, and a busy source
+    /// that takes longer than that to open its file would lose the whole copy.
+    /// `VolumeCopy`, `VolumeTailSender` and `VolumeEcShardsCopy` have never
+    /// carried one.
+    pub fn stream() -> Self {
+        Self {
+            connect_timeout: GRPC_CONNECT_TIMEOUT,
+            request_timeout: None,
+        }
+    }
+}
+
+/// Dial a peer and return a connected channel.
+///
+/// The error carries only the transport failure: every caller already wraps it
+/// with the address and the operation it was attempting.
+pub async fn connect_channel(
+    grpc_host_port: &str,
+    tls: Option<&OutgoingGrpcTlsConfig>,
+    opts: GrpcDialOptions,
+) -> Result<Channel, GrpcClientError> {
+    let mut endpoint =
+        build_grpc_endpoint(grpc_host_port, tls)?.connect_timeout(opts.connect_timeout);
+    if let Some(request_timeout) = opts.request_timeout {
+        endpoint = endpoint.timeout(request_timeout);
+    }
+    endpoint
+        .connect()
+        .await
+        .map_err(|e| GrpcClientError(e.to_string()))
+}
+
+/// Dial a copy/tail source and return a connected channel, re-validating every
+/// resolved address at connect time.
+///
+/// The guarded equivalent of [`connect_channel`]: same `opts` bounds, but the
+/// dial goes through [`connect_guarded`] so a source address that passed
+/// validation cannot be re-pointed by DNS between the check and the connect.
+/// The bounds are applied to the endpoint *before* delegating, so the
+/// `allow_untrusted` opt-out is timed too.
+///
+/// `target` is the caller-facing source address (the unparsed
+/// `"ip:port.grpcPort"` form), which is what the guard pins against; the error
+/// carries only the transport failure, as every caller already wraps it with
+/// the address and the operation it was attempting.
+pub async fn connect_channel_guarded(
+    grpc_host_port: &str,
+    target: &str,
+    tls: Option<&OutgoingGrpcTlsConfig>,
+    opts: GrpcDialOptions,
+    allow_untrusted: bool,
+) -> Result<Channel, GrpcClientError> {
+    let mut endpoint =
+        build_grpc_endpoint(grpc_host_port, tls)?.connect_timeout(opts.connect_timeout);
+    if let Some(request_timeout) = opts.request_timeout {
+        endpoint = endpoint.timeout(request_timeout);
+    }
+    connect_guarded(endpoint, target, allow_untrusted).await
+}
+
+/// The outgoing request-id interceptor as a concrete type, so the client
+/// aliases below can name it.
+pub type RequestIdInterceptor = fn(Request<()>) -> Result<Request<()>, Status>;
+
+/// A volume-server client with the request-id interceptor attached.
+pub type VolumeServerGrpcClient =
+    VolumeServerClient<InterceptedService<Channel, RequestIdInterceptor>>;
+/// A master client with the request-id interceptor attached.
+pub type MasterGrpcClient = SeaweedClient<InterceptedService<Channel, RequestIdInterceptor>>;
+/// A filer client with the request-id interceptor attached.
+pub type FilerGrpcClient = SeaweedFilerClient<InterceptedService<Channel, RequestIdInterceptor>>;
+
+/// Wrap a connected channel in a volume-server client that forwards the
+/// current request id and lifts both message-size limits.
+pub fn volume_server_client(channel: Channel) -> VolumeServerGrpcClient {
+    VolumeServerClient::with_interceptor(
+        channel,
+        outgoing_request_id_interceptor as RequestIdInterceptor,
+    )
+    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+}
+
+/// Wrap a connected channel in a master client that forwards the current
+/// request id and lifts both message-size limits.
+pub fn master_client(channel: Channel) -> MasterGrpcClient {
+    SeaweedClient::with_interceptor(
+        channel,
+        outgoing_request_id_interceptor as RequestIdInterceptor,
+    )
+    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+}
+
+/// Wrap a connected channel in a filer client that forwards the current
+/// request id and lifts both message-size limits.
+pub fn filer_client(channel: Channel) -> FilerGrpcClient {
+    SeaweedFilerClient::with_interceptor(
+        channel,
+        outgoing_request_id_interceptor as RequestIdInterceptor,
+    )
+    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+}
+
 /// Parse a SeaweedFS server address (`"ip:port.grpcPort"` or
 /// `"ip:port"`) into the `host:grpcPort` form `build_grpc_endpoint`
 /// expects. With the trailing `.grpcPort` segment, that segment IS
@@ -116,53 +330,27 @@ pub fn build_grpc_endpoint(
 /// Shared between `grpc_server.rs` and the distributed-EC-read path
 /// in `store_ec.rs` — keep this as the single source of truth so the
 /// HTTP↔gRPC port translation can't drift between callers.
+///
+/// The rule itself lives in `seaweed_common::address`, which the Rust
+/// plugin workers share; this wrapper only flattens the typed error
+/// back to the `String` its callers already handle. Unbracketed IPv6
+/// literals come back bracketed, which this copy used to get wrong.
 pub fn parse_grpc_address(source: &str) -> Result<String, String> {
-    let colon_idx = source
-        .rfind(':')
-        .ok_or_else(|| format!("cannot parse address: {}", source))?;
-    let host = &source[..colon_idx];
-    let port_part = &source[colon_idx + 1..];
-
-    if let Some(dot_idx) = port_part.rfind('.') {
-        // Format: "ip:port.grpcPort". Validate BOTH ports as u16
-        // so a malformed HTTP port (e.g. `host:abc.18080`) is
-        // rejected here rather than tripping a downstream
-        // `build_grpc_endpoint` URI parse failure with a less
-        // useful error.
-        let http_port = &port_part[..dot_idx];
-        let grpc_port = &port_part[dot_idx + 1..];
-        http_port
-            .parse::<u16>()
-            .map_err(|e| format!("invalid http port {:?}: {}", http_port, e))?;
-        grpc_port
-            .parse::<u16>()
-            .map_err(|e| format!("invalid grpc port {:?}: {}", grpc_port, e))?;
-        return Ok(format!("{}:{}", host, grpc_port));
-    }
-
-    // Format: "ip:port" → grpc = port + 10000. Reject inputs whose
-    // implicit grpc port would overflow the TCP port range (e.g.
-    // `host:60000` produces 70000 — invalid). Without this check
-    // the cast silently wraps and the endpoint call later fails
-    // with an opaque connection error.
-    let port: u16 = port_part
-        .parse()
-        .map_err(|e| format!("invalid port {:?}: {}", port_part, e))?;
-    let grpc_port = port as u32 + 10000;
-    if grpc_port > u16::MAX as u32 {
-        return Err(format!(
-            "implicit grpc port out of range: {} + 10000 = {}",
-            port, grpc_port
-        ));
-    }
-    Ok(format!("{}:{}", host, grpc_port))
+    seaweed_common::address::to_grpc_address(source).map_err(|e| e.to_string())
 }
 
 #[cfg(test)]
 mod tests {
-    use super::{build_grpc_endpoint, grpc_endpoint_uri, load_outgoing_grpc_tls};
+    use super::{
+        GrpcDialOptions, build_grpc_endpoint, connect_channel, grpc_endpoint_uri,
+        load_outgoing_grpc_tls, volume_server_client,
+    };
     use crate::config::{NeedleMapKind, ReadMode, VolumeServerConfig};
+    use crate::pb::volume_server_pb;
     use crate::security::tls::TlsPolicy;
+    use crate::server::request_id::scope_request_id;
+    use std::sync::{Arc, Mutex};
+    use std::time::Duration;
 
     const TEST_CERT_PEM: &str = "-----BEGIN CERTIFICATE-----\nMIIBPDCB76ADAgECAhRuRPQgeAu43BT/M7EfAWSdapVdYDAFBgMrZXAwFDESMBAG\nA1UEAwwJbG9jYWxob3N0MB4XDTI2MDcwNTE2MTUyOVoXDTM2MDcwMjE2MTUyOVow\nFDESMBAGA1UEAwwJbG9jYWxob3N0MCowBQYDK2VwAyEAr/3bNIFI+8V32oCiY6y+\nXRFmZpdNQ2g//VtRkT+nQg+jUzBRMB0GA1UdDgQWBBTsy9tLf1zPiXCQfgci6zNi\ndEzRSjAfBgNVHSMEGDAWgBTsy9tLf1zPiXCQfgci6zNidEzRSjAPBgNVHRMBAf8E\nBTADAQH/MAUGAytlcANBAIvsdw0IbvOBBkb9cd7BfMJfIP9pQQrAL03pCRWJFnFh\nSysaLVgFXI4T078IiaM874oO+iB+5vNbWEpc7CkGow4=\n-----END CERTIFICATE-----\n";
     const TEST_KEY_PEM: &str = "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIHbyn71Kk+Y7KT3sBctit7uZpErpoH6qDbFj6P8qGaZH\n-----END PRIVATE KEY-----\n";
@@ -205,10 +393,14 @@ mod tests {
             fix_jpg_orientation: false,
             read_mode: ReadMode::Local,
             allow_untrusted_remote_endpoints: false,
+            fsync_min_batch_bytes: 1024 * 1024,
+            fsync_min_batch_requests: 128,
+            fsync_batch_wait: std::time::Duration::from_micros(500),
             cpu_profile: String::new(),
             mem_profile: String::new(),
             compaction_byte_per_second: 0,
             maintenance_byte_per_second: 0,
+            max_parallel_vacuum_commits: 0,
             file_size_limit_bytes: 0,
             concurrent_upload_limit: 0,
             concurrent_download_limit: 0,
@@ -236,11 +428,12 @@ mod tests {
             https_client_ca_file: String::new(),
             grpc_cert_file: String::new(),
             grpc_key_file: String::new(),
+            grpc_client_cert_file: String::new(),
+            grpc_client_key_file: String::new(),
             grpc_ca_file: String::new(),
             grpc_allowed_wildcard_domain: String::new(),
             grpc_volume_allowed_common_names: vec![],
             tls_policy: TlsPolicy::default(),
-            enable_write_queue: false,
             security_file: String::new(),
         }
     }
@@ -265,6 +458,45 @@ mod tests {
         assert!(load_outgoing_grpc_tls(&config).unwrap().is_none());
     }
 
+    fn write_pem_files(dir: &tempfile::TempDir, config: &mut VolumeServerConfig) {
+        let write = |name: &str, content: &str| {
+            let path = dir.path().join(name);
+            std::fs::write(&path, content).unwrap();
+            path.to_str().unwrap().to_string()
+        };
+        config.grpc_cert_file = write("server.pem", "server-cert");
+        config.grpc_key_file = write("server.key", "server-key");
+        config.grpc_ca_file = write("ca.pem", "ca");
+    }
+
+    #[test]
+    fn test_load_outgoing_grpc_tls_prefers_client_cert() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let mut config = sample_config();
+        write_pem_files(&dir, &mut config);
+        let client_cert = dir.path().join("client.pem");
+        let client_key = dir.path().join("client.key");
+        std::fs::write(&client_cert, "client-cert").unwrap();
+        std::fs::write(&client_key, "client-key").unwrap();
+        config.grpc_client_cert_file = client_cert.to_str().unwrap().to_string();
+        config.grpc_client_key_file = client_key.to_str().unwrap().to_string();
+
+        let tls = load_outgoing_grpc_tls(&config).unwrap().unwrap();
+        assert_eq!(tls.cert_pem, "client-cert");
+        assert_eq!(tls.key_pem, "client-key");
+    }
+
+    #[test]
+    fn test_load_outgoing_grpc_tls_falls_back_to_server_cert() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let mut config = sample_config();
+        write_pem_files(&dir, &mut config);
+
+        let tls = load_outgoing_grpc_tls(&config).unwrap().unwrap();
+        assert_eq!(tls.cert_pem, "server-cert");
+        assert_eq!(tls.key_pem, "server-key");
+    }
+
     #[test]
     fn test_build_grpc_endpoint_without_tls_uses_http_scheme() {
         let endpoint = build_grpc_endpoint("127.0.0.1:19333", None).unwrap();
@@ -316,4 +548,131 @@ mod tests {
         let err = parse_grpc_address("hostname").unwrap_err();
         assert!(err.contains("cannot parse"), "{}", err);
     }
+
+    #[test]
+    fn test_parse_grpc_address_brackets_ipv6_literals() {
+        use super::parse_grpc_address;
+        // This used to come back as `::1:29333`, which is not a valid
+        // authority: `build_grpc_endpoint` reads the last colon as the port
+        // separator and rejects the rest.
+        assert_eq!(parse_grpc_address("::1:19333").unwrap(), "[::1]:29333");
+        assert_eq!(parse_grpc_address("::1:9333.19333").unwrap(), "[::1]:19333");
+        // Already bracketed, so it is left alone.
+        assert_eq!(parse_grpc_address("[::1]:9333").unwrap(), "[::1]:19333");
+    }
+
+    #[test]
+    fn test_build_grpc_endpoint_accepts_an_ipv6_master_address() {
+        use super::parse_grpc_address;
+        let endpoint = build_grpc_endpoint(&parse_grpc_address("::1:9333").unwrap(), None).unwrap();
+        assert_eq!(endpoint.uri().port_u16(), Some(19333));
+    }
+    /// A minimal HTTP/2 server that records the gRPC request headers it is
+    /// sent and answers every call with a trailers-only `unimplemented`. It is
+    /// enough to prove what a helper-built client puts on the wire, without
+    /// standing up the whole `VolumeServer` service behind a tonic server.
+    async fn serve_header_capture() -> (u16, Arc<Mutex<Option<String>>>) {
+        use hyper::service::service_fn;
+        use hyper_util::rt::{TokioExecutor, TokioIo};
+
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let seen: Arc<Mutex<Option<String>>> = Arc::new(Mutex::new(None));
+        let captured = Arc::clone(&seen);
+
+        tokio::spawn(async move {
+            while let Ok((stream, _)) = listener.accept().await {
+                let captured = Arc::clone(&captured);
+                tokio::spawn(async move {
+                    let _ = hyper::server::conn::http2::Builder::new(TokioExecutor::new())
+                        .serve_connection(
+                            TokioIo::new(stream),
+                            service_fn(move |req: hyper::Request<hyper::body::Incoming>| {
+                                let captured = Arc::clone(&captured);
+                                async move {
+                                    let value = req
+                                        .headers()
+                                        .get("x-amz-request-id")
+                                        .and_then(|v| v.to_str().ok())
+                                        .map(str::to_string);
+                                    *captured.lock().unwrap() = value;
+                                    Ok::<_, std::convert::Infallible>(
+                                        hyper::http::Response::builder()
+                                            .status(200)
+                                            .header("content-type", "application/grpc")
+                                            .header("grpc-status", "12")
+                                            .body(tonic::body::Body::empty())
+                                            .unwrap(),
+                                    )
+                                }
+                            }),
+                        )
+                        .await;
+                });
+            }
+        });
+
+        (port, seen)
+    }
+
+    #[tokio::test]
+    async fn test_helper_built_client_sends_the_scoped_request_id() {
+        let (port, seen) = serve_header_capture().await;
+
+        let channel = connect_channel(
+            &format!("127.0.0.1:{}", port),
+            None,
+            GrpcDialOptions::unary(),
+        )
+        .await
+        .expect("dial the header-capturing server");
+
+        let mut client = volume_server_client(channel);
+        // The interceptor has a request id to forward only inside a scope, so
+        // the call has to run inside one for this to test anything.
+        let _ = scope_request_id("REQUEST-ID-ON-THE-WIRE".to_string(), async move {
+            client
+                .ping(volume_server_pb::PingRequest {
+                    target: String::new(),
+                    target_type: String::new(),
+                })
+                .await
+        })
+        .await;
+
+        assert_eq!(
+            seen.lock().unwrap().as_deref(),
+            Some("REQUEST-ID-ON-THE-WIRE"),
+            "a client built by volume_server_client must carry the outgoing request id"
+        );
+    }
+
+    #[test]
+    fn test_dial_presets_match_the_call_sites_they_replace() {
+        assert_eq!(
+            GrpcDialOptions::unary().connect_timeout,
+            Duration::from_secs(5)
+        );
+        assert_eq!(
+            GrpcDialOptions::unary().request_timeout,
+            Some(Duration::from_secs(10))
+        );
+        assert_eq!(
+            GrpcDialOptions::long().connect_timeout,
+            Duration::from_secs(5)
+        );
+        assert_eq!(
+            GrpcDialOptions::long().request_timeout,
+            Some(Duration::from_secs(30))
+        );
+        assert_eq!(
+            GrpcDialOptions::stream().connect_timeout,
+            Duration::from_secs(5)
+        );
+        assert_eq!(
+            GrpcDialOptions::stream().request_timeout,
+            None,
+            "a streaming dial must not put a per-request deadline on the channel"
+        );
+    }
 }
diff --git a/seaweed-volume/src/server/grpc_server.rs b/seaweed-volume/src/server/grpc_server.rs
index 2eb70165c3..92ae99182e 100644
--- a/seaweed-volume/src/server/grpc_server.rs
+++ b/seaweed-volume/src/server/grpc_server.rs
@@ -4,23 +4,28 @@
 //! 48 RPCs: core volume operations are fully implemented, streaming and
 //! EC operations are stubbed with appropriate error messages.
 
+use std::ops::ControlFlow;
 use std::pin::Pin;
-use std::sync::atomic::Ordering;
 use std::sync::Arc;
+use std::sync::atomic::Ordering;
 
 use tokio_stream::Stream;
 use tonic::{Request, Response, Status, Streaming};
 
 use crate::pb::filer_pb;
 use crate::pb::master_pb;
-use crate::pb::master_pb::seaweed_client::SeaweedClient;
 use crate::pb::volume_server_pb;
 use crate::pb::volume_server_pb::volume_server_server::VolumeServer;
-use crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT;
+use crate::storage::erasure_coding::ec_shard::{ShardId, shard_id_try_from};
+use crate::storage::erasure_coding::ecj_merge::EcjIdDecoder;
 use crate::storage::needle::needle::{self, Needle};
 use crate::storage::types::*;
+use crate::storage::volume::VolumeSpec;
 
-use super::grpc_client::{build_grpc_endpoint, GRPC_MAX_MESSAGE_SIZE};
+use super::grpc_client::{
+    GrpcDialOptions, VolumeServerGrpcClient, connect_channel, connect_channel_guarded,
+    filer_client, master_client, volume_server_client,
+};
 use super::volume_server::VolumeServerState;
 
 type BoxStream<T> = Pin<Box<dyn Stream<Item = Result<T, Status>> + Send + 'static>>;
@@ -38,10 +43,45 @@ fn scrub_mode_label(mode: i32) -> &'static str {
         2 => "FULL",
         3 => "LOCAL",
         4 => "CHECKSUM",
+        5 => "READS",
         _ => "UNKNOWN",
     }
 }
 
+/// Go formats the id in decimal; fs.verify matches the "needle not found " prefix.
+fn needle_not_found(needle_id: NeedleId) -> Status {
+    Status::not_found(format!("needle not found {}", needle_id.0))
+}
+
+/// Mirrors Go's `isNotLeaderErr`: the master returns raft's NotLeaderError,
+/// which arrives as an Unknown-status message.
+fn is_not_leader_status(e: &Status) -> bool {
+    e.message().contains("Not current leader")
+}
+
+/// Deadline from the caller's `grpc-timeout` header (TimeoutValue +
+/// H|M|S|m|u|n unit, per the gRPC-over-HTTP2 spec). Tonic's GrpcTimeout layer
+/// drops an over-deadline handler future anyway; parsing it here lets a queued
+/// vacuum commit refuse politely instead of being dropped mid-wait.
+fn grpc_timeout_deadline<T>(request: &Request<T>) -> Option<tokio::time::Instant> {
+    let value = request.metadata().get("grpc-timeout")?.to_str().ok()?;
+    let (digits, unit) = value.split_at(value.len().checked_sub(1)?);
+    if digits.len() > 8 {
+        return None;
+    }
+    let n: u64 = digits.parse().ok()?;
+    let dur = match unit {
+        "H" => std::time::Duration::from_secs(n * 60 * 60),
+        "M" => std::time::Duration::from_secs(n * 60),
+        "S" => std::time::Duration::from_secs(n),
+        "m" => std::time::Duration::from_millis(n),
+        "u" => std::time::Duration::from_micros(n),
+        "n" => std::time::Duration::from_nanos(n),
+        _ => return None,
+    };
+    Some(tokio::time::Instant::now() + dur)
+}
+
 fn unix_now_seconds() -> f64 {
     std::time::SystemTime::now()
         .duration_since(std::time::UNIX_EPOCH)
@@ -51,6 +91,74 @@ fn unix_now_seconds() -> f64 {
 
 /// Record scrub metrics. `broken_shards` is `Some` only for EC scrubs so the
 /// shard-failures family stays untouched on regular volume scrubs (matching Go).
+/// How a scrub reacts to a volume that is not in the store when its turn comes.
+///
+/// Nothing is held across the scan, so the volume set is free to change under a
+/// node-wide scrub: the heartbeat drops a volume that reported an I/O error and
+/// expires an EC volume whose destroy time passed, and a delete or an unmount
+/// can land between any two volumes. Failing there would discard every result
+/// gathered so far and leave every later volume unscrubbed.
+///
+/// `Some(status)` means fail the request; `None` means skip this volume and
+/// keep going. A volume the caller NAMED is always the former — that one is a
+/// caller mistake, not a concurrent change, and callers match on the message.
+fn scrub_vanished_volume(explicit: bool, kind: &str, vid: VolumeId) -> Option<Status> {
+    if explicit {
+        return Some(Status::not_found(format!(
+            "{} id {} not found",
+            kind, vid.0
+        )));
+    }
+    tracing::info!(
+        volume_id = vid.0,
+        "scrub: {} {} is no longer mounted, skipping",
+        kind,
+        vid.0
+    );
+    None
+}
+
+/// How a scrub reacts to a `spawn_blocking` scan that failed to join.
+///
+/// The scan runs on the blocking pool, so a panic in it reaches the loop as a
+/// `JoinError` instead of unwinding here. Propagating it would discard every
+/// volume already scanned AND skip `emit_scrub_metrics`: a panic scrubbing one
+/// volume would hide real corruption found on the others and leave the
+/// staleness alert firing with nothing recorded to explain it. Record it
+/// against this volume and let the loop finish, the same way `scrub_volumes`
+/// treats a per-volume scrub error.
+///
+/// A panic is evidence about the volume, so it counts as broken. A join error
+/// from runtime shutdown is not -- the volume was never scanned, and counting
+/// it would put a false corruption into SCRUB_VOLUME_FAILURES.
+fn record_scrub_join_failure(
+    e: &tokio::task::JoinError,
+    vid: VolumeId,
+    what: &str,
+    broken_volume_ids: &mut Vec<u32>,
+    details: &mut Vec<String>,
+) {
+    if e.is_panic() {
+        tracing::error!(
+            volume_id = vid.0,
+            "scrub: {} task for EC volume {} panicked: {}",
+            what,
+            vid.0,
+            e
+        );
+        broken_volume_ids.push(vid.0);
+        details.push(format!("ecvol {}: {} task panicked: {}", vid.0, what, e));
+    } else {
+        tracing::info!(
+            volume_id = vid.0,
+            "scrub: {} task for EC volume {} was cancelled, skipping",
+            what,
+            vid.0
+        );
+        details.push(format!("ecvol {}: {} task cancelled; skipped", vid.0, what));
+    }
+}
+
 fn emit_scrub_metrics(mode: i32, broken_volumes: usize, broken_shards: Option<usize>) {
     let mode_label = scrub_mode_label(mode);
     crate::metrics::SCRUB_LAST_TIME_SECONDS
@@ -80,9 +188,7 @@ fn save_state_file(
 }
 
 /// Load VolumeServerState from a state.pb file (matches Go's State.Load).
-pub fn load_state_file(
-    path: &str,
-) -> Option<volume_server_pb::VolumeServerState> {
+pub fn load_state_file(path: &str) -> Option<volume_server_pb::VolumeServerState> {
     if path.is_empty() || !std::path::Path::new(path).exists() {
         return None;
     }
@@ -91,6 +197,56 @@ pub fn load_state_file(
     volume_server_pb::VolumeServerState::decode(data.as_slice()).ok()
 }
 
+/// One disk location's stake in an EC volume, as seen by the rebuild handler.
+struct LocInfo {
+    dir: String,
+    idx_dir: String,
+    shard_count: usize,
+    has_ecx: bool,
+}
+
+/// Picks the location a rebuild should write into — the one holding an `.ecx`
+/// and the most shards — and returns every other directory it may have to read
+/// from. Shards are only half of what the rebuild needs: a split
+/// `-dir`/`-dir.idx` layout keeps `.ecx`/`.ecj`/`.vif` with the INDEX, and on a
+/// multi-disk server the chosen disk may hold nothing but shards while this
+/// volume's `.vif` or generation-0 `.ecsum` sits on a sibling. Miss those and
+/// the layout resolution falls back to 10+4 with the legacy striping and
+/// reconstructs through the wrong matrix, so both directories of every other
+/// location are listed. The rebuild's own two are passed separately by the
+/// caller and dropped here, along with empties and duplicates.
+///
+/// Returns `None` when no location holds an `.ecx`, i.e. there is nothing to
+/// rebuild from.
+fn select_rebuild_location(loc_infos: &[LocInfo]) -> Option<(usize, Vec<String>)> {
+    let mut rebuild_loc_idx: Option<usize> = None;
+    let mut other_dirs: Vec<String> = Vec::new();
+
+    for (i, info) in loc_infos.iter().enumerate() {
+        let better = info.has_ecx
+            && rebuild_loc_idx.is_none_or(|prev| info.shard_count > loc_infos[prev].shard_count);
+        if better {
+            if let Some(prev) = rebuild_loc_idx {
+                other_dirs.push(loc_infos[prev].dir.clone());
+                other_dirs.push(loc_infos[prev].idx_dir.clone());
+            }
+            rebuild_loc_idx = Some(i);
+        } else {
+            other_dirs.push(info.dir.clone());
+            other_dirs.push(info.idx_dir.clone());
+        }
+    }
+
+    let rebuild_loc_idx = rebuild_loc_idx?;
+    let rebuild_dir = &loc_infos[rebuild_loc_idx].dir;
+    let rebuild_idx_dir = &loc_infos[rebuild_loc_idx].idx_dir;
+    other_dirs.retain(|d| !d.is_empty() && d != rebuild_dir && d != rebuild_idx_dir);
+    other_dirs.sort();
+    other_dirs.dedup();
+
+    Some((rebuild_loc_idx, other_dirs))
+}
+
 struct WriteThrottler {
     bytes_per_second: i64,
     last_size_counter: i64,
@@ -146,6 +302,12 @@ pub struct VolumeGrpcService {
 }
 
 impl VolumeGrpcService {
+    fn store_read(&self) -> std::sync::RwLockReadGuard<'_, crate::storage::store::Store> {
+        self.state.store.read().unwrap_or_else(|e| {
+            tracing::warn!("recovering poisoned store read lock");
+            e.into_inner()
+        })
+    }
     /// Verifies the gRPC caller is allowed to invoke a destructive admin
     /// operation. Mirrors the Go side's checkGrpcAdminAuth: an empty
     /// whitelist accepts everyone (insecure-by-default for tests and
@@ -155,6 +317,13 @@ impl VolumeGrpcService {
     /// SocketAddr; if it is somehow None we deny, matching "if we don't
     /// know who the caller is, refuse."
     fn check_grpc_admin_auth<T>(&self, request: &Request<T>) -> Result<(), Status> {
+        // Mirror Go's `if vs.guard == nil { return nil }`: with no whitelist and
+        // no signing key, write security is inactive and every caller is allowed.
+        // Real gRPC connections always carry peer info, so requiring it below only
+        // affects in-process callers (tests, upgrades) once a control is enabled.
+        if !self.state.guard.read().unwrap().is_write_active() {
+            return Ok(());
+        }
         let remote = match request.remote_addr() {
             Some(addr) => addr,
             None => {
@@ -170,9 +339,7 @@ impl VolumeGrpcService {
                 host,
                 remote,
             );
-            return Err(Status::permission_denied(format!(
-                "not authorized: {host}"
-            )));
+            return Err(Status::permission_denied(format!("not authorized: {host}")));
         }
         Ok(())
     }
@@ -183,38 +350,56 @@ impl VolumeGrpcService {
         is_readonly: bool,
     ) -> Result<(), Status> {
         // VolumeMarkReadonly mutates raft-replicated master topology, so it must
-        // reach the leader. Prefer the live leader the heartbeat is talking to
-        // (current_master_url), falling back to the static seed before the first
-        // heartbeat — mirrors store_ec.rs and Go's vs.GetMaster(). Sending it to
-        // the static seed fails "not current leader" after any master failover.
-        let master_url = {
-            let live = self.state.current_master_url.read().await.clone();
-            if !live.is_empty() {
-                live
-            } else {
-                self.state.master_url.clone()
-            }
-        };
+        // reach the leader the heartbeat confirmed. On "Not current leader",
+        // ask the seed masters who leads and retry there — mirrors Go's
+        // notifyMasterVolumeReadonly.
+        let master_url = self.state.current_master().await;
         if master_url.is_empty() {
-            return Ok(());
+            if !self.state.has_master {
+                return Ok(());
+            }
+            return Err(Status::unavailable("no master leader known"));
         }
-        let grpc_addr = parse_grpc_address(&master_url).map_err(|e| {
+        match self
+            .volume_mark_readonly_on_master(&master_url, info, is_readonly)
+            .await
+        {
+            Err(e) if is_not_leader_status(&e) => {
+                let leader = super::heartbeat::lookup_leader_from_peers(
+                    &self.state.master_urls,
+                    self.state.outgoing_grpc_tls.as_ref(),
+                )
+                .await
+                .ok_or_else(|| {
+                    Status::unavailable(format!(
+                        "master {} rejected mark-readonly and no peer named a leader",
+                        master_url
+                    ))
+                })?;
+                self.volume_mark_readonly_on_master(&leader, info, is_readonly)
+                    .await
+            }
+            result => result,
+        }
+    }
+
+    async fn volume_mark_readonly_on_master(
+        &self,
+        master_url: &str,
+        info: &MasterVolumeInfo,
+        is_readonly: bool,
+    ) -> Result<(), Status> {
+        let grpc_addr = parse_grpc_address(master_url).map_err(|e| {
             Status::internal(format!("invalid master address {}: {}", master_url, e))
         })?;
-        let endpoint = build_grpc_endpoint(&grpc_addr, self.state.outgoing_grpc_tls.as_ref())
-            .map_err(|e| Status::internal(format!("master address {}: {}", master_url, e)))?
-            .connect_timeout(std::time::Duration::from_secs(5))
-            .timeout(std::time::Duration::from_secs(30));
-        let channel = endpoint
-            .connect()
-            .await
-            .map_err(|e| Status::internal(format!("connect to master {}: {}", master_url, e)))?;
-        let mut client = SeaweedClient::with_interceptor(
-            channel,
-            super::request_id::outgoing_request_id_interceptor,
+        let channel = connect_channel(
+            &grpc_addr,
+            self.state.outgoing_grpc_tls.as_ref(),
+            GrpcDialOptions::long(),
         )
-        .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-        .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+        .await
+        .map_err(|e| Status::internal(format!("connect to master {}: {}", master_url, e)))?;
+        let mut client = master_client(channel);
         client
             .volume_mark_readonly(master_pb::VolumeMarkReadonlyRequest {
                 ip: info.ip.clone(),
@@ -237,14 +422,19 @@ impl VolumeGrpcService {
         Ok(())
     }
 
-    /// Shared helper matching Go's `makeVolumeReadonly(ctx, v, persist)`.
-    /// 1. Check maintenance mode
-    /// 2. Notify master (readonly=true)
-    /// 3. Mark local volume readonly
-    /// 4. Notify master again (cover heartbeat race)
-    async fn make_volume_readonly(&self, vid: VolumeId, persist: bool) -> Result<(), Status> {
-        self.state.check_maintenance()?;
-
+    /// Shared helper matching Go's `makeVolumeReadonly(ctx, v, canDelete, persist)`.
+    /// Not gated on maintenance mode: marking a volume readonly only restricts a
+    /// server that is already meant to be read-only, and it is the first step of
+    /// moving a volume off a server under evacuation (issue #11066).
+    /// 1. Notify master (readonly=true)
+    /// 2. Mark local volume readonly
+    /// 3. Notify master again (cover heartbeat race)
+    async fn make_volume_readonly(
+        &self,
+        vid: VolumeId,
+        can_delete: bool,
+        persist: bool,
+    ) -> Result<(), Status> {
         let info = {
             let store = self.state.store.read().unwrap();
             let (loc_idx, vol) = store
@@ -253,8 +443,8 @@ impl VolumeGrpcService {
             MasterVolumeInfo {
                 volume_id: vid,
                 collection: vol.collection.clone(),
-                replica_placement: vol.super_block.replica_placement.to_byte(),
-                ttl: vol.super_block.ttl.to_u32(),
+                replica_placement: vol.super_block().replica_placement.to_byte(),
+                ttl: vol.super_block().ttl.to_u32(),
                 disk_type: store.locations[loc_idx].disk_type.to_string(),
                 ip: store.ip.clone(),
                 port: store.port,
@@ -264,20 +454,540 @@ impl VolumeGrpcService {
         // Step 1: stop master from redirecting traffic here
         self.notify_master_volume_readonly(&info, true).await?;
 
-        // Step 2: mark local volume readonly
-        {
-            let mut store = self.state.store.write().unwrap();
-            if let Some((_, vol)) = store.find_volume_mut(vid) {
-                vol.set_read_only_persist(persist)
-                    .map_err(|e| Status::internal(e.to_string()))?;
-            }
-            self.state.volume_state_notify.notify_one();
-        }
+        // Step 2: mark local volume readonly; Go's MarkVolumeReadonly errors
+        // when the volume left the store during the step-1 master round trip.
+        let vol = {
+            let store = self.state.store.read().unwrap();
+            store
+                .find_volume(vid)
+                .map(|(_, v)| v)
+                .ok_or_else(|| Status::not_found(format!("volume {} not found", vid)))?
+        };
+        // set_read_only_persist waits out the volume's leased readers; that
+        // wait must not hold a store guard. A detached handle fails closed.
+        vol.set_read_only_persist(can_delete, persist)
+            .map_err(|e| match e {
+                crate::storage::volume::VolumeError::NotFound => {
+                    Status::not_found(format!("volume {} not found", vid))
+                }
+                _ => Status::internal(e.to_string()),
+            })?;
+        self.state.volume_state_notify.notify_one();
 
         // Step 3: notify master again to cover heartbeat race
         self.notify_master_volume_readonly(&info, true).await?;
         Ok(())
     }
+
+    /// The scrub loop over an already-resolved volume list.
+    ///
+    /// Split out of `scrub_volume` so a test can hand it a list containing an
+    /// id that is not in the store: listing and lookup read the same map under
+    /// the same lock, so nothing outside can make an id vanish between them.
+    async fn scrub_volumes(
+        &self,
+        req: &volume_server_pb::ScrubVolumeRequest,
+        vids: Vec<VolumeId>,
+        explicit: bool,
+    ) -> Result<Response<volume_server_pb::ScrubVolumeResponse>, Status> {
+        let mode = req.mode;
+        let mut total_volumes: u64 = 0;
+        let mut total_files: u64 = 0;
+        let mut broken_volume_ids: Vec<u32> = Vec::new();
+        let mut details: Vec<String> = Vec::new();
+        let mut broken_vids: Vec<VolumeId> = Vec::new();
+
+        // Scrub phase. The store read guard is taken PER VOLUME, never across the
+        // whole loop.
+        //
+        // Holding one guard for the entire loop meant a node-wide scrub pinned the
+        // store lock for the full scan of every volume it holds. The periodic
+        // heartbeat takes store.write(); once that writer is pending, a
+        // write-preferring std::sync::RwLock queues every later reader behind it,
+        // so every HTTP handler blocks and the node stops serving and
+        // heart-beating until the scrub finishes. Re-acquiring per volume lets the
+        // writer land between volumes.
+        //
+        // NOTE: v.scrub() still runs under the guard for the duration of ONE
+        // volume, which for a large volume is still a long hold. In
+        // scrub_ec_volume the INDEX, LOCAL and CHECKSUM arms snapshot a plan and
+        // scan with the guard released; FULL/READS releases it across the index
+        // walk but still re-takes it per needle, in
+        // store_ec::scrub_snapshot_under_lock. The same treatment here needs
+        // Volume to expose an equivalent plan and is left as a follow-up.
+        for vid in &vids {
+            // Re-resolve under a fresh guard each iteration; the volume set can
+            // legitimately change between volumes now that the lock is released.
+            let Some((scrub_result, file_count)) = ({
+                let store = self.state.store.read().unwrap();
+                store.find_volume(*vid).map(|(_, v)| {
+                    // INDEX mode (1) calls scrub_index; FULL (2) and LOCAL (3) call scrub
+                    let r = if mode == 1 {
+                        v.scrub_index()
+                    } else {
+                        v.scrub()
+                    };
+                    (r, v.file_count())
+                })
+            }) else {
+                if let Some(status) = scrub_vanished_volume(explicit, "volume", *vid) {
+                    return Err(status);
+                }
+                continue;
+            };
+            total_volumes += 1;
+
+            match scrub_result {
+                Ok((files, broken)) => {
+                    total_files += files;
+                    if !broken.is_empty() {
+                        broken_vids.push(*vid);
+                        broken_volume_ids.push(vid.0);
+                        for msg in broken {
+                            details.push(format!("vol {}: {}", vid.0, msg));
+                        }
+                    }
+                }
+                Err(e) => {
+                    total_files += file_count.max(0) as u64;
+                    broken_vids.push(*vid);
+                    broken_volume_ids.push(vid.0);
+                    details.push(format!("vol {}: scrub error: {}", vid.0, e));
+                }
+            }
+        }
+
+        // Match Go: if mark_broken_volumes_readonly, call makeVolumeReadonly on each broken volume.
+        // Collect errors via errors.Join semantics (return joined error if any fail).
+        let mut errs: Vec<String> = Vec::new();
+        if req.mark_broken_volumes_readonly {
+            for vid in &broken_vids {
+                match self.make_volume_readonly(*vid, false, true).await {
+                    Ok(()) => {
+                        details.push(format!("volume {} is now read-only", vid.0));
+                    }
+                    // The volume was scrubbed, found broken, and then removed —
+                    // the same concurrent teardown the scrub loop tolerates, one
+                    // step later. There is nothing left to mark read-only, and
+                    // failing here would throw away the whole scrub report. Go
+                    // never reaches this at all: it passes makeVolumeReadonly the
+                    // *storage.Volume it already holds, so a volume that left the
+                    // store is still addressable there.
+                    Err(e) if e.code() == tonic::Code::NotFound => {
+                        tracing::info!(
+                            volume_id = vid.0,
+                            "scrub: volume {} vanished before mark-readonly, skipping",
+                            vid.0
+                        );
+                        details.push(format!(
+                            "volume {} vanished before mark-readonly; skipped",
+                            vid.0
+                        ));
+                    }
+                    Err(e) => {
+                        errs.push(e.message().to_string());
+                        details.push(e.message().to_string());
+                    }
+                }
+            }
+        }
+
+        // Record metrics before the post-scrub error check so scrub failures are
+        // persisted even when a follow-up admin action (mark-readonly) fails.
+        emit_scrub_metrics(mode, broken_vids.len(), None);
+
+        if !errs.is_empty() {
+            return Err(Status::internal(errs.join("\n")));
+        }
+
+        Ok(Response::new(volume_server_pb::ScrubVolumeResponse {
+            total_volumes,
+            total_files,
+            broken_volume_ids,
+            details,
+        }))
+    }
+
+    /// The EC scrub loop over an already-resolved volume list. Same split, and
+    /// same vanished-volume rule, as `scrub_volumes` — see its comment.
+    async fn scrub_ec_volumes(
+        &self,
+        req: &volume_server_pb::ScrubEcVolumeRequest,
+        vids: Vec<VolumeId>,
+        explicit: bool,
+    ) -> Result<Response<volume_server_pb::ScrubEcVolumeResponse>, Status> {
+        let mode = req.mode;
+        let force_deleted_needles_check = req.force_deleted_needles_check;
+        let mut total_volumes: u64 = 0;
+        let mut total_files: u64 = 0;
+        let mut broken_volume_ids: Vec<u32> = Vec::new();
+        let mut broken_shard_infos: Vec<volume_server_pb::EcShardInfo> = Vec::new();
+        let mut details: Vec<String> = Vec::new();
+
+        for vid in vids {
+            match mode {
+                1 => {
+                    // INDEX mode: check ecx index integrity only, no shard verification.
+                    // Same shape as the CHECKSUM arm below: snapshot, release
+                    // the store lock, then walk the index.
+                    let Some(plan) = ({
+                        let store = self.state.store.read().unwrap();
+                        store.find_ec_volume(vid).map(|ecv| ecv.scrub_index_plan())
+                    }) else {
+                        if let Some(status) = scrub_vanished_volume(explicit, "EC volume", vid) {
+                            return Err(status);
+                        }
+                        continue;
+                    };
+                    // Counted as attempted BEFORE the join, so a failed join
+                    // cannot silently shrink total_volumes.
+                    total_volumes += 1;
+                    let (count, errs) = match tokio::task::spawn_blocking(move || plan.run()).await
+                    {
+                        Ok(v) => v,
+                        Err(e) => {
+                            record_scrub_join_failure(
+                                &e,
+                                vid,
+                                "index scrub",
+                                &mut broken_volume_ids,
+                                &mut details,
+                            );
+                            continue;
+                        }
+                    };
+                    total_files += count;
+                    if !errs.is_empty() {
+                        broken_volume_ids.push(vid.0);
+                        for msg in errs {
+                            details.push(format!("ecvol {}: {}", vid.0, msg));
+                        }
+                    }
+                }
+                2 | 5 => {
+                    // FULL/READS: Go-parity per-needle local+remote walk, PLUS a TEMPORARY
+                    // local Reed-Solomon parity check. The needle walk only reads
+                    // DATA-shard intervals of LIVE needles, so on its own it can't
+                    // catch silent bitrot in a PARITY shard or an unwalked cold
+                    // region. Go closes that gap with a separate CHECKSUM mode over
+                    // .ecsum, which Rust does not have yet; running both here is a
+                    // deliberate divergence from Go FULL to preserve coverage. Drop
+                    // verify_ec_shards from this arm once mode 4 (CHECKSUM) lands.
+                    //
+                    // The RS recompute needs every shard, so only run it when this
+                    // node holds all data+parity shards (single-node EC); on a
+                    // distributed layout it would report every non-local shard as
+                    // missing. The shards need not share one disk: `verify_ec_shards`
+                    // takes a directory per shard id, so a reconciled volume split
+                    // across this node's disks still qualifies.
+                    // Snapshot under a brief lock; release before await.
+                    let Some((
+                        dirs,
+                        collection,
+                        data_shards,
+                        parity_shards,
+                        all_local,
+                        skipped,
+                        encode_ts_ns,
+                    )) = ({
+                        let store = self.state.store.read().unwrap();
+                        let runtimes = store.find_all_ec_volumes(vid);
+                        crate::storage::erasure_coding::ec_volume::merge_ec_runtimes(&runtimes).map(
+                            |m| {
+                                let total =
+                                    (m.anchor.data_shards + m.anchor.parity_shards) as usize;
+                                let dirs: Vec<Option<String>> = (0..total)
+                                    .map(|id| {
+                                        m.slots
+                                            .get(id)
+                                            .copied()
+                                            .flatten()
+                                            .map(|(owner, _)| owner.dir.clone())
+                                    })
+                                    .collect();
+                                let all_local = dirs.iter().all(|d| d.is_some());
+                                (
+                                    dirs,
+                                    m.anchor.collection.clone(),
+                                    m.anchor.data_shards as usize,
+                                    m.anchor.parity_shards as usize,
+                                    all_local,
+                                    m.skipped,
+                                    m.anchor.encode_ts_ns,
+                                )
+                            },
+                        )
+                    })
+                    else {
+                        if let Some(status) = scrub_vanished_volume(explicit, "EC volume", vid) {
+                            return Err(status);
+                        }
+                        continue;
+                    };
+                    total_volumes += 1;
+
+                    // (1) Per-needle local+remote walk (Go ScrubEcVolume parity).
+                    let (files, mut shard_infos, mut errs) =
+                        crate::server::store_ec::scrub_ec_volume_distributed(
+                            &self.state,
+                            vid,
+                            encode_ts_ns,
+                            force_deleted_needles_check,
+                            mode == 5,
+                        )
+                        .await;
+                    total_files += files as u64;
+
+                    errs.extend(skipped);
+
+                    // (2) Local parity check, gated on all-shards-local. Blocking RS
+                    // verify -> spawn_blocking; inputs are owned, no lock held.
+                    if all_local {
+                        let collection_pc = collection.clone();
+                        let dirs_pc = dirs;
+                        let join = tokio::task::spawn_blocking(move || {
+                            crate::storage::erasure_coding::ec_encoder::verify_ec_shards(
+                                &dirs_pc,
+                                &collection_pc,
+                                vid,
+                                data_shards,
+                                parity_shards,
+                            )
+                        })
+                        .await;
+                        // Unlike the other arms this must NOT `continue`: the
+                        // needle walk above already produced findings for this
+                        // volume, and dropping them here would recreate the bug
+                        // this handles, one scope down. So a panic becomes an
+                        // error for the volume, and a cancellation -- which
+                        // spawn_blocking only reports when the runtime is going
+                        // down, so this response is unlikely to reach anyone --
+                        // records in details that the parity half did not run
+                        // rather than inventing a corruption for it.
+                        let (parity_broken, parity_details) = match join {
+                            Ok(r) => r.unwrap_or_else(|e| {
+                                (Vec::new(), vec![format!("verify_ec_shards: {}", e)])
+                            }),
+                            Err(e) if e.is_panic() => (
+                                Vec::new(),
+                                vec![format!("verify_ec_shards task panicked: {}", e)],
+                            ),
+                            Err(e) => {
+                                details.push(format!(
+                                    "ecvol {}: verify_ec_shards task cancelled; parity check skipped ({})",
+                                    vid.0, e
+                                ));
+                                (Vec::new(), Vec::new())
+                            }
+                        };
+
+                        let mut seen: std::collections::HashSet<u32> =
+                            shard_infos.iter().map(|s| s.shard_id).collect();
+                        for sid in parity_broken {
+                            if seen.insert(sid) {
+                                shard_infos.push(volume_server_pb::EcShardInfo {
+                                    shard_id: sid,
+                                    collection: collection.clone(),
+                                    volume_id: vid.0,
+                                    ..Default::default()
+                                });
+                            }
+                        }
+                        shard_infos.sort_by_key(|s| s.shard_id);
+                        errs.extend(parity_details);
+                    }
+
+                    if !errs.is_empty() || !shard_infos.is_empty() {
+                        broken_volume_ids.push(vid.0);
+                        broken_shard_infos.extend(shard_infos);
+                        for msg in errs {
+                            details.push(format!("ecvol {}: {}", vid.0, msg));
+                        }
+                    }
+                }
+                3 => {
+                    // LOCAL: verify each needle against the locally-held shards.
+                    // Snapshot under a brief lock, then walk with the lock
+                    // RELEASED: this reads every local needle's bytes, which
+                    // under the guard stalls the node. See EcChecksumScrubPlan.
+                    let Some(plan) = ({
+                        let store = self.state.store.read().unwrap();
+                        // Every disk holding this vid, not just the first: a
+                        // reconciled volume's shards are split across runtimes.
+                        crate::storage::erasure_coding::ec_volume::EcLocalScrubPlan::for_volumes(
+                            &store.find_all_ec_volumes(vid),
+                        )
+                    }) else {
+                        if let Some(status) = scrub_vanished_volume(explicit, "EC volume", vid) {
+                            return Err(status);
+                        }
+                        continue;
+                    };
+                    total_volumes += 1;
+                    // Synchronous CPU + file I/O: keep it off the async workers.
+                    let (files, shard_infos, errs) =
+                        match tokio::task::spawn_blocking(move || plan.run()).await {
+                            Ok(v) => v,
+                            Err(e) => {
+                                record_scrub_join_failure(
+                                    &e,
+                                    vid,
+                                    "local scrub",
+                                    &mut broken_volume_ids,
+                                    &mut details,
+                                );
+                                continue;
+                            }
+                        };
+                    total_files += files;
+                    if !errs.is_empty() || !shard_infos.is_empty() {
+                        broken_volume_ids.push(vid.0);
+                        broken_shard_infos.extend(shard_infos);
+                        for msg in errs {
+                            details.push(format!("ecvol {}: {}", vid.0, msg));
+                        }
+                    }
+                }
+                4 => {
+                    // CHECKSUM: verify each local shard's raw bytes against the
+                    // bitrot checksum sidecar, exercising cold parity shards.
+                    // Read-only. Mirrors Go's v.ChecksumScrub().
+                    // Snapshot under a brief lock, then verify with the lock
+                    // RELEASED: this reads every byte of every local shard, which
+                    // under the guard stalls the node. See EcChecksumScrubPlan.
+                    let Some((plan, collection)) = ({
+                        let store = self.state.store.read().unwrap();
+                        let runtimes = store.find_all_ec_volumes(vid);
+                        let collection = runtimes.first().map(|ecv| ecv.collection.clone());
+                        crate::storage::erasure_coding::ec_volume::EcChecksumScrubPlan::for_volumes(
+                            &runtimes,
+                        )
+                        .zip(collection)
+                    }) else {
+                        if let Some(status) = scrub_vanished_volume(explicit, "EC volume", vid) {
+                            return Err(status);
+                        }
+                        continue;
+                    };
+                    total_volumes += 1;
+                    // Synchronous CPU + file I/O: keep it off the async workers.
+                    // `plan.run()`'s first return is blocks scanned, not a file
+                    // count — Go discards it (`_, shardInfos, serrs = v.ChecksumScrub()`)
+                    // so TotalFiles stays a needle/file count and is not inflated
+                    // by the block count.
+                    let (_blocks_scanned, broken, errs) =
+                        match tokio::task::spawn_blocking(move || plan.run()).await {
+                            Ok(v) => v,
+                            Err(e) => {
+                                record_scrub_join_failure(
+                                    &e,
+                                    vid,
+                                    "checksum scrub",
+                                    &mut broken_volume_ids,
+                                    &mut details,
+                                );
+                                continue;
+                            }
+                        };
+                    if !errs.is_empty() || !broken.is_empty() {
+                        broken_volume_ids.push(vid.0);
+                        for b in broken {
+                            broken_shard_infos.push(volume_server_pb::EcShardInfo {
+                                volume_id: vid.0,
+                                collection: collection.clone(),
+                                shard_id: b,
+                                ..Default::default()
+                            });
+                        }
+                        for msg in errs {
+                            details.push(format!("ecvol {}: {}", vid.0, msg));
+                        }
+                    }
+                }
+                _ => unreachable!(), // validated above
+            }
+        }
+
+        emit_scrub_metrics(
+            mode,
+            broken_volume_ids.len(),
+            Some(broken_shard_infos.len()),
+        );
+
+        Ok(Response::new(volume_server_pb::ScrubEcVolumeResponse {
+            total_volumes,
+            total_files,
+            broken_volume_ids,
+            broken_shard_infos,
+            details,
+        }))
+    }
+}
+
+struct EcDecodeClaim<'a>(&'a VolumeServerState, VolumeId);
+
+impl Drop for EcDecodeClaim<'_> {
+    fn drop(&mut self) {
+        self.0
+            .ec_decodes_in_flight
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .remove(&self.1);
+    }
+}
+
+/// Keeps `vid` in `ec_decode_tail` while the decode publishes .idx and
+/// compacts; local .ecj appenders wait that span out rather than commit a
+/// delete the rebuilt index would miss. Dropping — including on panic —
+/// lifts the marker and wakes the waiters.
+struct EcDecodeTailGuard<'a>(&'a VolumeServerState, VolumeId);
+
+impl Drop for EcDecodeTailGuard<'_> {
+    fn drop(&mut self) {
+        self.0
+            .ec_decode_tail
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .remove(&self.1);
+        self.0.ec_decode_tail_notify.notify_waiters();
+    }
+}
+
+/// Whether `vid`'s .ecj appends must wait for the decode publishing tail.
+/// Only meaningful read under the store write lock: a decode can claim the
+/// tail while a caller waits for the decoder's read lock, so membership
+/// tested before acquiring the write lock is stale by commit time.
+pub(crate) fn ec_decode_tail_contains(state: &VolumeServerState, vid: VolumeId) -> bool {
+    state
+        .ec_decode_tail
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .contains(&vid)
+}
+
+/// Blocks a local .ecj append until `vid` leaves `ec_decode_tail`. Mirrors
+/// Go's `EcVolume.ecjFileAccessLock`: decode holds it across journal
+/// catch-up, .idx publication and compaction, so no committed delete falls
+/// between the last catch_up and the .cpd/.cpx swap. Async wait — the
+/// caller holds no lock while sleeping, so decode can never be deadlocked
+/// by the append it is delaying.
+pub(crate) async fn wait_ec_decode_tail(state: &Arc<VolumeServerState>, vid: VolumeId) {
+    loop {
+        let notified = state.ec_decode_tail_notify.notified();
+        tokio::pin!(notified);
+        // Register before testing the set so a tail that ends between the
+        // check and the await still wakes us.
+        notified.as_mut().enable();
+        let in_tail = state
+            .ec_decode_tail
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .contains(&vid);
+        if !in_tail {
+            return;
+        }
+        notified.await;
+    }
 }
 
 #[tonic::async_trait]
@@ -288,6 +998,7 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::BatchDeleteRequest>,
     ) -> Result<Response<volume_server_pb::BatchDeleteResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let mut results = Vec::new();
@@ -324,12 +1035,20 @@ impl VolumeServer for VolumeGrpcService {
                 store.has_ec_volume(file_id.volume_id)
             };
 
-            // Cookie validation (unless skip_cookie_check)
-            if !req.skip_cookie_check {
+            // EC volumes read even when skipping: Go's DeleteEcShardNeedle
+            // does, and its ErrorDeleted is what turns a repeat delete into 304.
+            if !req.skip_cookie_check || is_ec_volume {
                 let original_cookie = n.cookie;
                 if !is_ec_volume {
-                    let store = self.state.store.read().unwrap();
-                    match store.read_volume_needle(file_id.volume_id, &mut n) {
+                    let mut read_option = crate::server::handlers::delete_read_option();
+                    let vol = {
+                        let store = self.state.store.read().unwrap();
+                        store.find_volume(file_id.volume_id).map(|(_, v)| v)
+                    };
+                    match vol
+                        .ok_or(crate::storage::volume::VolumeError::NotFound)
+                        .and_then(|vol| vol.read_needle_with_option(&mut n, &mut read_option))
+                    {
                         Ok(_) => {}
                         Err(e) => {
                             results.push(volume_server_pb::DeleteResult {
@@ -343,48 +1062,53 @@ impl VolumeServer for VolumeGrpcService {
                         }
                     }
                 } else {
-                    // For EC volumes, verify needle exists in ecx index
-                    let store = self.state.store.read().unwrap();
-                    if let Some(ec_vol) = store.find_ec_volume(file_id.volume_id) {
-                        match ec_vol.find_needle_from_ecx(n.id) {
-                            Ok(Some((_, size))) if !size.is_deleted() => {
-                                // Needle exists and is not deleted — cookie check not possible
-                                // for EC volumes without distributed read, so we accept it
-                                n.data_size = size.0 as u32;
-                            }
-                            Ok(_) => {
-                                results.push(volume_server_pb::DeleteResult {
-                                    file_id: fid_str.clone(),
-                                    status: 404,
-                                    error: format!("ec needle {} not found", fid_str),
-                                    size: 0,
-                                    version: 0,
-                                });
-                                continue;
-                            }
-                            Err(e) => {
-                                results.push(volume_server_pb::DeleteResult {
-                                    file_id: fid_str.clone(),
-                                    status: 404,
-                                    error: e.to_string(),
-                                    size: 0,
-                                    version: 0,
-                                });
-                                continue;
-                            }
+                    use crate::server::store_ec::EcMiss;
+                    let read = crate::server::store_ec::read_ec_shard_needle_or_miss(
+                        &self.state,
+                        file_id.volume_id,
+                        n.id,
+                    )
+                    .await;
+                    let error = match read {
+                        Ok(Ok(ec_needle)) => {
+                            n = ec_needle;
+                            None
                         }
-                    } else {
+                        Ok(Err(EcMiss::Deleted)) if req.skip_cookie_check => {
+                            results.push(volume_server_pb::DeleteResult {
+                                file_id: fid_str.clone(),
+                                status: 304,
+                                error: String::new(),
+                                size: 0,
+                                version: 0,
+                            });
+                            continue;
+                        }
+                        Ok(Err(EcMiss::Deleted)) => {
+                            Some(crate::storage::volume::VolumeError::Deleted.to_string())
+                        }
+                        Ok(Err(EcMiss::NotFound)) => Some(
+                            "locate in local ec volume: FindNeedleFromEcx: needle not found"
+                                .to_string(),
+                        ),
+                        Ok(Err(EcMiss::VolumeNotFound)) => {
+                            Some(format!("ec shard {} not found", file_id.volume_id))
+                        }
+                        Err(e) => Some(e.to_string()),
+                    };
+                    if let Some(error) = error {
+                        // Skipping, Go meets the miss inside DeleteEcShardNeedle: a 500.
                         results.push(volume_server_pb::DeleteResult {
                             file_id: fid_str.clone(),
-                            status: 404,
-                            error: format!("ec volume {} not found", file_id.volume_id),
+                            status: if req.skip_cookie_check { 500 } else { 404 },
+                            error,
                             size: 0,
                             version: 0,
                         });
                         continue;
                     }
                 }
-                if n.cookie != original_cookie {
+                if !req.skip_cookie_check && n.cookie != original_cookie {
                     results.push(volume_server_pb::DeleteResult {
                         file_id: fid_str.clone(),
                         status: 400,
@@ -396,8 +1120,8 @@ impl VolumeServer for VolumeGrpcService {
                 }
             }
 
-            // Reject chunk manifest needles
-            if n.is_chunk_manifest() {
+            // Go never reads the needle when skipping, so its manifest check can't fire.
+            if !req.skip_cookie_check && n.is_chunk_manifest() {
                 results.push(volume_server_pb::DeleteResult {
                     file_id: fid_str.clone(),
                     status: 406,
@@ -411,30 +1135,67 @@ impl VolumeServer for VolumeGrpcService {
             n.last_modified = now;
 
             if !is_ec_volume {
-                let mut store = self.state.store.write().unwrap();
-                // Recheck EC state under the write lock before mutating the .dat. The
-                // is_ec_volume snapshot was taken earlier under a separate read lock;
-                // ec.encode mounts EC shards (copied from the .dat) BEFORE deleting the
-                // originals, so the vid can be EC now while the .dat still exists. A
-                // delete_volume_needle here would tombstone that .dat, which the encode
-                // then removes — the delete is lost and the needle resurrected from the
-                // pre-tombstone shards. If the vid is now EC, return a retriable 503 so
-                // the filer requeues the delete onto the EC path.
-                if store.has_ec_volume(file_id.volume_id) {
-                    results.push(volume_server_pb::DeleteResult {
-                        file_id: fid_str.clone(),
-                        status: 503,
-                        error: format!(
-                            "volume {} became ec during delete, try again",
-                            file_id.volume_id
-                        ),
-                        size: 0,
-                        version: 0,
-                    });
-                    continue;
-                }
-                match store.delete_volume_needle(file_id.volume_id, &mut n) {
+                let vol = {
+                    let store = self.state.store.read().unwrap();
+                    // Recheck EC state under the store lock before mutating the .dat. The
+                    // is_ec_volume snapshot was taken earlier under a separate read lock;
+                    // ec.encode mounts EC shards (copied from the .dat) BEFORE deleting the
+                    // originals, so the vid can be EC now while the .dat still exists. A
+                    // delete_volume_needle here would tombstone that .dat, which the encode
+                    // then removes — the delete is lost and the needle resurrected from the
+                    // pre-tombstone shards. If the vid is now EC, return a retriable 503 so
+                    // the filer requeues the delete onto the EC path.
+                    if store.has_ec_volume(file_id.volume_id) {
+                        results.push(volume_server_pb::DeleteResult {
+                            file_id: fid_str.clone(),
+                            status: 503,
+                            error: format!(
+                                "volume {} became ec during delete, try again",
+                                file_id.volume_id
+                            ),
+                            size: 0,
+                            version: 0,
+                        });
+                        continue;
+                    }
+                    store.find_volume(file_id.volume_id).map(|(_, v)| v)
+                };
+                // Matches Store::delete_volume_needle: noWriteOrDelete rejects
+                // first, and the tombstone I/O runs after the store guard drops.
+                let delete_result = match vol {
+                    None => Err(crate::storage::volume::VolumeError::NotFound),
+                    Some(vol) if vol.is_no_write_or_delete() => {
+                        Err(crate::storage::volume::VolumeError::ReadOnly(file_id.volume_id))
+                    }
+                    Some(vol) => vol.delete_needle(&mut n),
+                };
+                match delete_result {
                     Ok(size) => {
+                        // The guard dropped before delete_needle, so ec.encode
+                        // could have mounted EC shards between the recheck and
+                        // the tombstone: the encode would then remove the .dat
+                        // this delete touched and resurrect the needle from
+                        // pre-tombstone shards. If the vid is EC now, return
+                        // the retriable 503 so the filer requeues onto the EC
+                        // path — the same check a delete under the old store
+                        // lock could not race.
+                        let now_ec = {
+                            let store = self.state.store.read().unwrap();
+                            store.has_ec_volume(file_id.volume_id)
+                        };
+                        if now_ec {
+                            results.push(volume_server_pb::DeleteResult {
+                                file_id: fid_str.clone(),
+                                status: 503,
+                                error: format!(
+                                    "volume {} became ec during delete, try again",
+                                    file_id.volume_id
+                                ),
+                                size: 0,
+                                version: 0,
+                            });
+                            continue;
+                        }
                         if size.0 == 0 {
                             results.push(volume_server_pb::DeleteResult {
                                 file_id: fid_str.clone(),
@@ -461,9 +1222,10 @@ impl VolumeServer for VolumeGrpcService {
                         // "try again" token so the filer requeues it and the retry hits
                         // the EC path. A bare exact "not found" would be dropped
                         // permanently by the filer chunk-GC.
-                        if matches!(e, crate::storage::volume::VolumeError::NotFound)
-                            && store.has_ec_volume(file_id.volume_id)
-                        {
+                        if matches!(e, crate::storage::volume::VolumeError::NotFound) && {
+                            let store = self.state.store.read().unwrap();
+                            store.has_ec_volume(file_id.volume_id)
+                        } {
                             results.push(volume_server_pb::DeleteResult {
                                 file_id: fid_str.clone(),
                                 status: 503,
@@ -486,37 +1248,49 @@ impl VolumeServer for VolumeGrpcService {
                     }
                 }
             } else {
-                // EC volume deletion: journal the delete locally (with cookie validation, matching Go)
-                let mut store = self.state.store.write().unwrap();
-                if let Some(ec_vol) = store.find_ec_volume_mut(file_id.volume_id) {
-                    match ec_vol.journal_delete_with_cookie(n.id, n.cookie) {
-                        Ok(()) => {
-                            results.push(volume_server_pb::DeleteResult {
-                                file_id: fid_str.clone(),
-                                status: 202,
-                                error: String::new(),
-                                size: n.data_size,
-                                version: 0,
-                            });
-                        }
-                        Err(e) => {
-                            results.push(volume_server_pb::DeleteResult {
-                                file_id: fid_str.clone(),
-                                status: 500,
-                                error: e.to_string(),
-                                size: 0,
-                                version: 0,
-                            });
-                        }
+                // EC volume deletion: forward the tombstone to a holder of the
+                // needle's primary shard (Go's DeleteEcShardNeedle →
+                // VolumeEcBlobDelete).
+                match crate::server::store_ec::delete_ec_shard_needle_distributed(
+                    &self.state,
+                    file_id.volume_id,
+                    n.id,
+                )
+                .await
+                {
+                    Ok(()) => {
+                        results.push(volume_server_pb::DeleteResult {
+                            file_id: fid_str.clone(),
+                            status: 202,
+                            error: String::new(),
+                            size: n.data_size,
+                            version: 0,
+                        });
+                    }
+                    Err(e) => {
+                        // Needle vanished while the volume stays mounted:
+                        // Go's ErrorDeleted → NotModified. The volume itself
+                        // unmounting means no journal anywhere, so 500 (Go's
+                        // generic error path) lets the caller retry.
+                        let already_gone = e.kind() == std::io::ErrorKind::NotFound
+                            && self
+                                .state
+                                .store
+                                .read()
+                                .unwrap()
+                                .has_ec_volume(file_id.volume_id);
+                        results.push(volume_server_pb::DeleteResult {
+                            file_id: fid_str.clone(),
+                            status: if already_gone { 304 } else { 500 },
+                            error: if already_gone {
+                                String::new()
+                            } else {
+                                e.to_string()
+                            },
+                            size: 0,
+                            version: 0,
+                        });
                     }
-                } else {
-                    results.push(volume_server_pb::DeleteResult {
-                        file_id: fid_str.clone(),
-                        status: 404,
-                        error: format!("ec volume {} not found", file_id.volume_id),
-                        size: 0,
-                        version: 0,
-                    });
                 }
             }
         }
@@ -532,12 +1306,24 @@ impl VolumeServer for VolumeGrpcService {
     ) -> Result<Response<volume_server_pb::VacuumVolumeCheckResponse>, Status> {
         let vid = VolumeId(request.into_inner().volume_id);
         let store = self.state.store.read().unwrap();
-        let garbage_ratio = match store.find_volume(vid) {
-            Some((_, vol)) => vol.garbage_level(),
-            None => return Err(Status::not_found(format!("not found volume id {}", vid))),
+        let (garbage_ratio, disk_space_low) = match store.find_volume(vid) {
+            Some((_, vol)) => {
+                // disk_space_low only counts when it is the sole read-only
+                // cause — an operator mark or I/O quarantine still shields
+                // the volume.
+                let (_, no_write_or_delete, no_write_can_delete, is_low) = vol.read_only_reasons();
+                (
+                    vol.garbage_level(),
+                    is_low && !no_write_or_delete && !no_write_can_delete,
+                )
+            }
+            None => {
+                return Err(crate::storage::volume::VolumeError::VolumeNotFound(vid).into());
+            }
         };
         Ok(Response::new(volume_server_pb::VacuumVolumeCheckResponse {
             garbage_ratio,
+            disk_space_low,
         }))
     }
 
@@ -556,44 +1342,7 @@ impl VolumeServer for VolumeGrpcService {
         let (tx, rx) = tokio::sync::mpsc::channel(16);
 
         tokio::task::spawn_blocking(move || {
-            let compact_start = std::time::Instant::now();
-            let report_interval: i64 = 128 * 1024 * 1024;
-            let next_report = std::sync::atomic::AtomicI64::new(report_interval);
-
-            let tx_clone = tx.clone();
-            let result = {
-                let mut store = state.store.write().unwrap();
-                store.compact_volume(vid, preallocate, 0, |processed| {
-                    let target = next_report.load(std::sync::atomic::Ordering::Relaxed);
-                    if processed > target {
-                        let resp = volume_server_pb::VacuumVolumeCompactResponse {
-                            processed_bytes: processed,
-                            load_avg_1m: 0.0,
-                        };
-                        // If send fails (client disconnected), stop compaction
-                        if tx_clone.blocking_send(Ok(resp)).is_err() {
-                            return false;
-                        }
-                        next_report.store(
-                            processed + report_interval,
-                            std::sync::atomic::Ordering::Relaxed,
-                        );
-                    }
-                    true
-                })
-            };
-
-            let success = result.is_ok();
-            crate::metrics::VACUUMING_HISTOGRAM
-                .with_label_values(&["compact"])
-                .observe(compact_start.elapsed().as_secs_f64());
-            crate::metrics::VACUUMING_COMPACT_COUNTER
-                .with_label_values(&[if success { "true" } else { "false" }])
-                .inc();
-
-            if let Err(e) = result {
-                let _ = tx.blocking_send(Err(Status::internal(e)));
-            }
+            run_vacuum_compact(&state, vid, preallocate, COMPACT_REPORT_INTERVAL, &tx);
         });
 
         let stream = tokio_stream::wrappers::ReceiverStream::new(rx);
@@ -608,8 +1357,12 @@ impl VolumeServer for VolumeGrpcService {
     ) -> Result<Response<volume_server_pb::VacuumVolumeCommitResponse>, Status> {
         self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
+        let deadline = grpc_timeout_deadline(&request);
         let vid = VolumeId(request.into_inner().volume_id);
 
+        let _permit = self.state.acquire_vacuum_commit_slot(deadline).await?;
+        self.state.check_maintenance()?;
+
         // Match Go's store_vacuum.go CommitCompactVolume: skip commit if stopping
         if *self.state.is_stopping.read().unwrap() {
             return Err(Status::internal(format!(
@@ -619,8 +1372,25 @@ impl VolumeServer for VolumeGrpcService {
         }
 
         let commit_start = std::time::Instant::now();
-        let mut store = self.state.store.write().unwrap();
-        let result = store.commit_compact_volume(vid);
+        let result = {
+            let vol = {
+                let store = self.state.store.read().unwrap();
+                store.find_volume(vid).map(|(_, vol)| vol)
+            };
+            match vol {
+                None => Err(crate::storage::volume::VolumeError::VolumeNotFound(vid)),
+                Some(vol) => {
+                    // Go's CommitCompact waits out leased readers under
+                    // dataFileAccessLock — do it without holding the store
+                    // guard, so a slow download stalls only this vacuum.
+                    let _sync_guard = vol.data_file_sync_lock().lock().unwrap();
+                    let _lease = vol.instance().write_lock();
+                    let is_read_only = vol.is_read_only();
+                    vol.commit_compact_held()
+                        .map(|_| (is_read_only, vol.dat_file_size().unwrap_or(0)))
+                }
+            }
+        };
         crate::metrics::VACUUMING_HISTOGRAM
             .with_label_values(&["commit"])
             .observe(commit_start.elapsed().as_secs_f64());
@@ -634,7 +1404,10 @@ impl VolumeServer for VolumeGrpcService {
                     volume_size,
                 },
             )),
-            Err(e) => Err(Status::internal(e)),
+            Err(e) => Err(crate::server::status_with_context(
+                &format!("commit compact volume {vid}"),
+                e,
+            )),
         }
     }
 
@@ -650,7 +1423,10 @@ impl VolumeServer for VolumeGrpcService {
             Ok(()) => Ok(Response::new(
                 volume_server_pb::VacuumVolumeCleanupResponse {},
             )),
-            Err(e) => Err(Status::internal(e)),
+            Err(e) => Err(crate::server::status_with_context(
+                &format!("cleanup volume {vid}"),
+                e,
+            )),
         }
     }
 
@@ -662,9 +1438,9 @@ impl VolumeServer for VolumeGrpcService {
         let collection = &request.into_inner().collection;
         {
             let mut store = self.state.store.write().unwrap();
-            store
-                .delete_collection(collection)
-                .map_err(|e| Status::internal(e))?;
+            store.delete_collection(collection).map_err(|e| {
+                crate::server::status_with_context(&format!("delete collection {collection}"), e)
+            })?;
         }
         // The delta the notify path derives is the only thing that tells the
         // master these slots came free: a heartbeat carries the whole list only
@@ -689,7 +1465,7 @@ impl VolumeServer for VolumeGrpcService {
         } else {
             Some(
                 crate::storage::needle::ttl::TTL::read(&req.ttl)
-                    .map_err(|e| Status::invalid_argument(e))?,
+                    .map_err(Status::invalid_argument)?,
             )
         };
         let disk_type = DiskType::from_string(&req.disk_type);
@@ -704,12 +1480,14 @@ impl VolumeServer for VolumeGrpcService {
         store
             .add_volume(
                 vid,
-                &req.collection,
-                Some(rp),
-                ttl,
-                req.preallocate as u64,
                 disk_type,
-                version,
+                &VolumeSpec {
+                    collection: &req.collection,
+                    replica_placement: Some(rp),
+                    ttl,
+                    preallocate: req.preallocate as u64,
+                    version,
+                },
             )
             .map_err(|e| Status::internal(e.to_string()))?;
         self.state.volume_state_notify.notify_one();
@@ -730,10 +1508,10 @@ impl VolumeServer for VolumeGrpcService {
         Ok(Response::new(volume_server_pb::VolumeSyncStatusResponse {
             volume_id: vid.0,
             collection: vol.collection.clone(),
-            replication: vol.super_block.replica_placement.to_string(),
-            ttl: vol.super_block.ttl.to_string(),
+            replication: vol.super_block().replica_placement.to_string(),
+            ttl: vol.super_block().ttl.to_string(),
             tail_offset: vol.dat_file_size().unwrap_or(0),
-            compact_revision: vol.super_block.compaction_revision as u32,
+            compact_revision: vol.super_block().compaction_revision as u32,
             idx_file_size: vol.idx_file_size(),
             version: vol.version().0 as u32,
         }))
@@ -747,21 +1525,28 @@ impl VolumeServer for VolumeGrpcService {
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
-        // Sync to disk first
+        // A quarantined volume is rejected before the sync does disk I/O for it.
         {
-            let mut store = self.state.store.write().unwrap();
-            if let Some((_, v)) = store.find_volume_mut(vid) {
-                let _ = v.sync_to_disk();
+            let store = self.state.store.read().unwrap();
+            let Some((_, v)) = store.find_volume(vid) else {
+                return Err(Status::not_found(format!("not found volume id {}", vid)));
+            };
+            if let Some(e) = v.unavailable_error() {
+                return Err(Status::unavailable(e.to_string()));
             }
+            let _ = v.sync_to_disk();
         }
 
         let store = self.state.store.read().unwrap();
         let (_, v) = store
             .find_volume(vid)
             .ok_or_else(|| Status::not_found(format!("not found volume id {}", vid)))?;
+        if let Some(e) = v.unavailable_error() {
+            return Err(Status::unavailable(e.to_string()));
+        }
 
         let dat_size = v.dat_file_size().unwrap_or(0);
-        let super_block_size = v.super_block.block_size() as u64;
+        let super_block_size = v.super_block().block_size() as u64;
 
         // If since_ns is very large (after all data), return empty
         if req.since_ns == u64::MAX || dat_size <= super_block_size {
@@ -816,14 +1601,14 @@ impl VolumeServer for VolumeGrpcService {
             Local(std::fs::File),
             Remote(crate::storage::volume::RemoteDatFile),
         }
-        let reader = if v.has_remote_file {
+        let reader = if v.has_remote_file() {
             match v.remote_dat_file() {
                 Some(r) => DatReader::Remote(r),
                 None => {
                     return Err(Status::not_found(format!(
                         "remote dat not loaded for volume id {}",
                         vid
-                    )))
+                    )));
                 }
             }
         } else {
@@ -832,6 +1617,7 @@ impl VolumeServer for VolumeGrpcService {
                 .map_err(|e| Status::internal(format!("open {}: {}", path, e)))?;
             DatReader::Local(file)
         };
+        let state = self.state.clone();
         drop(store);
 
         let total = dat_size - start_offset;
@@ -839,7 +1625,20 @@ impl VolumeServer for VolumeGrpcService {
             Result<volume_server_pb::VolumeIncrementalCopyResponse, Status>,
         >(8);
 
+        // The reader handle is detached from the volume, so each chunk
+        // re-checks that the volume has not been quarantined mid-stream.
         tokio::task::spawn_blocking(move || {
+            macro_rules! bail_if_unavailable {
+                () => {{
+                    let store = state.store.read().unwrap();
+                    if let Some((_, v)) = store.find_volume(vid)
+                        && let Some(e) = v.unavailable_error()
+                    {
+                        let _ = tx.blocking_send(Err(Status::unavailable(e.to_string())));
+                        return;
+                    }
+                }};
+            }
             let buffer_size = 2 * 1024 * 1024u64; // 2MB chunks
             let mut bytes_to_read = total;
             let mut offset = start_offset;
@@ -854,6 +1653,7 @@ impl VolumeServer for VolumeGrpcService {
                         return;
                     }
                     while bytes_to_read > 0 {
+                        bail_if_unavailable!();
                         let chunk = std::cmp::min(bytes_to_read, buffer_size) as usize;
                         let mut buf = vec![0u8; chunk];
                         match reader.read(&mut buf) {
@@ -880,6 +1680,7 @@ impl VolumeServer for VolumeGrpcService {
                     // handle. No store lock is held while the (potentially slow)
                     // S3 fetch runs, so it never blocks store writers.
                     while bytes_to_read > 0 {
+                        bail_if_unavailable!();
                         let chunk = std::cmp::min(bytes_to_read, buffer_size) as usize;
                         match remote.read_slice(offset, chunk) {
                             Ok(buf) if buf.is_empty() => break,
@@ -916,10 +1717,31 @@ impl VolumeServer for VolumeGrpcService {
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
+        // A decode in flight may be mid-compaction on this volume's
+        // .dat/.idx; mounting across the .cpd/.cpx swap could load a mixed
+        // pair. Claim the vid for the mount rather than hold the set lock
+        // through it — the same exclusion for this vid, while unrelated
+        // mounts and decode claims stay unblocked.
+        // Retryable — the caller mounts after the decode RPC returns.
+        if !self
+            .state
+            .ec_decodes_in_flight
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .insert(vid)
+        {
+            return Err(Status::unavailable(format!(
+                "volume {} is being decoded",
+                req.volume_id
+            )));
+        }
+        let _claim = EcDecodeClaim(&self.state, vid);
+
         let mut store = self.state.store.write().unwrap();
         store
-            .mount_volume_by_id(vid)
+            .mount_volume_by_id(vid, req.collection.as_deref())
             .map_err(|e| Status::internal(e.to_string()))?;
+        drop(store);
         self.state.volume_state_notify.notify_one();
 
         Ok(Response::new(volume_server_pb::VolumeMountResponse {}))
@@ -933,32 +1755,57 @@ impl VolumeServer for VolumeGrpcService {
         let vid = VolumeId(request.into_inner().volume_id);
         let mut store = self.state.store.write().unwrap();
         // Go returns nil when volume is not found (idempotent unmount)
-        if store.unmount_volume(vid) {
+        let unmounted = store
+            .unmount_volume(vid)
+            .map_err(|e| crate::server::status_with_context(&format!("unmount volume {vid}"), e))?;
+        if unmounted {
             self.state.volume_state_notify.notify_one();
         }
         Ok(Response::new(volume_server_pb::VolumeUnmountResponse {}))
     }
 
+    async fn volume_consolidate_index(
+        &self,
+        request: Request<volume_server_pb::VolumeConsolidateIndexRequest>,
+    ) -> Result<Response<volume_server_pb::VolumeConsolidateIndexResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
+        self.state.check_maintenance()?;
+        let vid = VolumeId(request.into_inner().volume_id);
+        let mut store = self.state.store.write().unwrap();
+        store
+            .consolidate_volume_index(vid)
+            .map_err(|e| Status::internal(e.to_string()))?;
+        Ok(Response::new(
+            volume_server_pb::VolumeConsolidateIndexResponse {},
+        ))
+    }
+
+    /// Allowed in maintenance mode: it removes data from the server rather than
+    /// adding any, and evacuating a server in maintenance mode ends each move by
+    /// deleting the source copy (issue #11066).
     async fn volume_delete(
         &self,
         request: Request<volume_server_pb::VolumeDeleteRequest>,
     ) -> Result<Response<volume_server_pb::VolumeDeleteResponse>, Status> {
         self.check_grpc_admin_auth(&request)?;
-        self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
         let mut store = self.state.store.write().unwrap();
-        if req.only_empty {
-            let (_, vol) = store
-                .find_volume(vid)
-                .ok_or_else(|| Status::not_found(format!("not found volume id {}", vid)))?;
-            if vol.file_count() > 0 {
-                return Err(Status::failed_precondition("volume not empty"));
+        if req.only_empty || req.only_garbage {
+            let (_, vol) = store.find_volume(vid).ok_or_else(|| {
+                Status::from(crate::storage::volume::VolumeError::VolumeNotFound(vid))
+            })?;
+            let empty_ok = req.only_empty && vol.file_count() == 0;
+            let garbage_ok = req.only_garbage
+                && vol.content_size() > 0
+                && vol.deleted_size() >= vol.content_size();
+            if !empty_ok && !garbage_ok {
+                return Err(Status::from(crate::storage::volume::VolumeError::NotEmpty));
             }
         }
         store
-            .delete_volume(vid, req.only_empty, req.keep_remote_data)
-            .map_err(|e| Status::internal(e.to_string()))?;
+            .delete_volume(vid, req.only_empty, req.only_garbage, req.keep_remote_data)
+            .map_err(|e| crate::server::status_with_context(&format!("delete volume {vid}"), e))?;
         self.state.volume_state_notify.notify_one();
         Ok(Response::new(volume_server_pb::VolumeDeleteResponse {}))
     }
@@ -970,14 +1817,15 @@ impl VolumeServer for VolumeGrpcService {
         self.check_grpc_admin_auth(&request)?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
-        // Go: volume lookup (L239-241) happens before maintenance check (L166 in makeVolumeReadonly)
+        // Go: VolumeMarkReadonly looks the volume up before calling makeVolumeReadonly
         {
             let store = self.state.store.read().unwrap();
             store
                 .find_volume(vid)
                 .ok_or_else(|| Status::not_found(format!("volume {} not found", vid)))?;
         }
-        self.make_volume_readonly(vid, req.persist).await?;
+        self.make_volume_readonly(vid, req.can_delete, req.persist)
+            .await?;
         Ok(Response::new(
             volume_server_pb::VolumeMarkReadonlyResponse {},
         ))
@@ -998,8 +1846,8 @@ impl VolumeServer for VolumeGrpcService {
             MasterVolumeInfo {
                 volume_id: vid,
                 collection: vol.collection.clone(),
-                replica_placement: vol.super_block.replica_placement.to_byte(),
-                ttl: vol.super_block.ttl.to_u32(),
+                replica_placement: vol.super_block().replica_placement.to_byte(),
+                ttl: vol.super_block().ttl.to_u32(),
                 disk_type: store.locations[loc_idx].disk_type.to_string(),
                 ip: store.ip.clone(),
                 port: store.port,
@@ -1010,9 +1858,9 @@ impl VolumeServer for VolumeGrpcService {
 
         // Step 1: mark local volume as writable (save result; Go continues on error)
         let mark_result = {
-            let mut store = self.state.store.write().unwrap();
+            let store = self.state.store.read().unwrap();
             let res = store
-                .find_volume_mut(vid)
+                .find_volume(vid)
                 .ok_or_else(|| Status::not_found(format!("volume {} not found", vid)))
                 .and_then(|(_, vol)| {
                     vol.set_writable()
@@ -1056,14 +1904,18 @@ impl VolumeServer for VolumeGrpcService {
         let mut store = self.state.store.write().unwrap();
 
         // Unmount the volume (Go propagates unmount errors via resp.Error;
-        // Rust unmount_volume returns bool, so not-found falls through to configure_volume)
-        store.unmount_volume(vid);
+        // not-found falls through to configure_volume)
+        if let Err(e) = store.unmount_volume(vid) {
+            return Ok(Response::new(volume_server_pb::VolumeConfigureResponse {
+                error: format!("volume configure unmount {}: {}", vid, e),
+            }));
+        }
 
         // Modify the super block on disk (replica_placement byte)
         if let Err(e) = store.configure_volume(vid, rp) {
             let mut error = format!("volume configure {}: {}", vid, e);
             // Error recovery: try to re-mount anyway
-            if let Err(mount_err) = store.mount_volume_by_id(vid) {
+            if let Err(mount_err) = store.mount_volume_by_id(vid, None) {
                 error += &format!(". Also failed to restore mount: {}", mount_err);
             }
             return Ok(Response::new(volume_server_pb::VolumeConfigureResponse {
@@ -1072,7 +1924,7 @@ impl VolumeServer for VolumeGrpcService {
         }
 
         // Re-mount the volume
-        if let Err(e) = store.mount_volume_by_id(vid) {
+        if let Err(e) = store.mount_volume_by_id(vid, None) {
             return Ok(Response::new(volume_server_pb::VolumeConfigureResponse {
                 error: format!("volume configure mount {}: {}", vid, e),
             }));
@@ -1129,6 +1981,7 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::SetStateRequest>,
     ) -> Result<Response<volume_server_pb::SetStateResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         let req = request.into_inner();
 
         if let Some(new_state) = &req.state {
@@ -1157,8 +2010,12 @@ impl VolumeServer for VolumeGrpcService {
             };
             if let Err(e) = save_state_file(&self.state.state_file_path, &pb) {
                 // Rollback in-memory state on save failure (matches Go)
-                self.state.maintenance.store(prev_maintenance, Ordering::Relaxed);
-                self.state.state_version.store(prev_version, Ordering::Relaxed);
+                self.state
+                    .maintenance
+                    .store(prev_maintenance, Ordering::Relaxed);
+                self.state
+                    .state_version
+                    .store(prev_version, Ordering::Relaxed);
                 return Err(Status::internal(format!("failed to save state: {}", e)));
             }
 
@@ -1181,307 +2038,58 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeCopyRequest>,
     ) -> Result<Response<Self::VolumeCopyStream>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
-        // A pre-existing local replica is NOT deleted up front. Deleting before
-        // the source is confirmed reachable destroys a healthy copy on a
-        // transient source outage (and, on retry, can lose the volume
-        // entirely). The delete is deferred until read_volume_file_status below
-        // proves the source holds the volume; readability alone is the gate.
+        if !self.state.allow_untrusted_remote_endpoints {
+            crate::remote_storage::validate_replica_target(&req.source_data_node)
+                .await
+                .map_err(|e| {
+                    Status::invalid_argument(format!(
+                        "invalid source data node {}: {}",
+                        req.source_data_node, e
+                    ))
+                })?;
+        }
+
+        // A pre-existing local replica is NOT deleted up front; see
+        // delete_existing_replica for why and when.
         let had_existing_volume = {
             let store = self.state.store.read().unwrap();
             store.find_volume(vid).is_some()
         };
 
-        // Parse source_data_node address: "ip:port.grpcPort" or "ip:port" (grpc = port + 10000)
-        let source = &req.source_data_node;
-        let grpc_addr = parse_grpc_address(source).map_err(|e| {
-            Status::internal(format!(
-                "VolumeCopy volume {} invalid source_data_node {}: {}",
-                vid, source, e
-            ))
-        })?;
-
-        let channel = build_grpc_endpoint(&grpc_addr, self.state.outgoing_grpc_tls.as_ref())
-            .map_err(|e| {
-                Status::internal(format!("VolumeCopy volume {} parse source: {}", vid, e))
-            })?
-            .connect()
-            .await
-            .map_err(|e| {
-                Status::internal(format!(
-                    "VolumeCopy volume {} connect to {}: {}",
-                    vid, grpc_addr, e
-                ))
-            })?;
-
-        let mut client =
-            volume_server_pb::volume_server_client::VolumeServerClient::with_interceptor(
-                channel,
-                super::request_id::outgoing_request_id_interceptor,
-            )
-            .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-            .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
-
-        // Get file status from source
-        let vol_info = client
-            .read_volume_file_status(volume_server_pb::ReadVolumeFileStatusRequest {
-                volume_id: req.volume_id,
-            })
-            .await
-            .map_err(|e| Status::internal(format!("read volume file status failed, {}", e)))?
-            .into_inner();
-
-        // Source is reachable and holds the volume: only now is it safe to drop
-        // an existing local replica before overwriting its files.
-        if had_existing_volume {
-            let mut store = self.state.store.write().unwrap();
-            // keep remote data: the inbound copy carries a .vif that may point
-            // at the same cloud-tier object the existing volume references.
-            store.delete_volume(vid, false, true).map_err(|e| {
-                Status::internal(format!("failed to delete existing volume {}: {}", vid, e))
-            })?;
-            drop(store);
-            self.state.volume_state_notify.notify_one();
-        }
-
-        let requested_disk_type = if !req.disk_type.is_empty() {
-            DiskType::from_string(&req.disk_type)
-        } else {
-            DiskType::from_string(&vol_info.disk_type)
-        };
-
-        let has_remote_dat = vol_info
-            .volume_info
-            .as_ref()
-            .map(|vi| !vi.files.is_empty())
-            .unwrap_or(false);
-        // a remote-backed volume only lands its .idx/.vif locally; the .dat stays in the tier
-        let needed_space = if has_remote_dat {
-            vol_info.idx_file_size
-        } else {
-            vol_info.dat_file_size
-        };
-
-        // Find a free disk location using Go's Store.FindFreeLocation semantics.
-        let (data_base, idx_base, selected_disk_type) = {
-            let store = self.state.store.read().unwrap();
-            let Some(loc_idx) = store.find_free_location_predicate(|loc| {
-                loc.disk_type == requested_disk_type
-                    && loc.available_space.load(Ordering::Relaxed) > needed_space
-            }) else {
-                return Err(Status::internal(format!(
-                    "no space left {}",
-                    requested_disk_type.readable_string()
-                )));
-            };
-            let loc = &store.locations[loc_idx];
-            (
-                loc.directory.clone(),
-                loc.idx_directory.clone(),
-                loc.disk_type.clone(),
-            )
-        };
-
-        let data_base_name =
-            crate::storage::volume::volume_file_name(&data_base, &vol_info.collection, vid);
-        let idx_base_name =
-            crate::storage::volume::volume_file_name(&idx_base, &vol_info.collection, vid);
-
-        // Write a .note file to indicate copy in progress. A leftover note
-        // fails the volume load on restart, so a write failure must abort.
-        let note_path = format!("{}.note", data_base_name);
-        std::fs::write(&note_path, format!("copying from {}", source)).map_err(|e| {
-            Status::internal(format!("write .note for volume {}: {}", vid, e))
-        })?;
+        let mut client = self
+            .connect_to_copy_source(vid, &req.source_data_node)
+            .await?;
+        let source_status_before =
+            fetch_source_status_before(&mut client, req.volume_id, vid).await;
+        let source = SourceVolumeStatus::fetch(&mut client, req.volume_id).await?;
+        let dest = self.plan_copy_destination(&req, vid, &source, had_existing_volume)?;
+        dest.write_note(vid, &req.source_data_node)?;
 
         let (tx, rx) =
             tokio::sync::mpsc::channel::<Result<volume_server_pb::VolumeCopyResponse, Status>>(16);
-        let state = self.state.clone();
+        let job = VolumeCopyJob {
+            state: self.state.clone(),
+            req,
+            vid,
+            source,
+            source_status_before,
+            dest,
+            tx,
+        };
 
         tokio::spawn(async move {
-            let result = async {
-                let report_interval: i64 = 128 * 1024 * 1024;
-                let mut next_report_target: i64 = report_interval;
-                let io_byte_per_second = if req.io_byte_per_second > 0 {
-                    req.io_byte_per_second
-                } else {
-                    state.maintenance_byte_per_second
-                };
-                let mut throttler = WriteThrottler::new(io_byte_per_second);
-
-                // Query master for preallocation settings (matching Go VolumeCopy behavior).
-                let mut preallocate_size: i64 = 0;
-                if !has_remote_dat {
-                    let grpc_addr = super::heartbeat::to_grpc_address(&state.master_url);
-                    match super::heartbeat::try_get_master_configuration(
-                        &grpc_addr,
-                        state.outgoing_grpc_tls.as_ref(),
-                    )
-                    .await
-                    {
-                        Ok(resp) => {
-                            if resp.volume_preallocate {
-                                preallocate_size = resp.volume_size_limit_m_b as i64 * 1024 * 1024;
-                            }
-                        }
-                        Err(e) => {
-                            tracing::warn!("get master {} configuration: {}", state.master_url, e);
-                        }
-                    }
-
-                    if preallocate_size > 0 {
-                        let dat_path = format!("{}.dat", data_base_name);
-                        let file = std::fs::File::create(&dat_path).map_err(|e| {
-                            Status::internal(format!(
-                                "create preallocated volume file {}: {}",
-                                dat_path, e
-                            ))
-                        })?;
-                        file.set_len(preallocate_size as u64).map_err(|e| {
-                            Status::internal(format!("preallocate volume file {}: {}", dat_path, e))
-                        })?;
-                    }
-                }
-
-                // Copy .dat file
-                if !has_remote_dat {
-                    let dat_path = format!("{}.dat", data_base_name);
-                    let dat_modified_ts_ns = copy_file_from_source(
-                        &mut client,
-                        false,
-                        &req.collection,
-                        req.volume_id,
-                        vol_info.compaction_revision,
-                        vol_info.dat_file_size,
-                        &dat_path,
-                        ".dat",
-                        false,
-                        true,
-                        Some(&tx),
-                        &mut next_report_target,
-                        report_interval,
-                        &mut throttler,
-                    )
-                    .await
-                    .map_err(|e| Status::internal(e))?;
-                    if dat_modified_ts_ns > 0 {
-                        let _ = set_file_mtime(&dat_path, dat_modified_ts_ns);
-                    }
-                }
-
-                // Copy .idx file
-                let idx_path = format!("{}.idx", idx_base_name);
-                let idx_modified_ts_ns = copy_file_from_source(
-                    &mut client,
-                    false,
-                    &req.collection,
-                    req.volume_id,
-                    vol_info.compaction_revision,
-                    vol_info.idx_file_size,
-                    &idx_path,
-                    ".idx",
-                    false,
-                    false,
-                    None,
-                    &mut next_report_target,
-                    report_interval,
-                    &mut throttler,
-                )
-                .await
-                .map_err(|e| Status::internal(e))?;
-                if idx_modified_ts_ns > 0 {
-                    let _ = set_file_mtime(&idx_path, idx_modified_ts_ns);
-                }
-
-                // Copy .vif file (ignore if not found on source)
-                let vif_path = format!("{}.vif", data_base_name);
-                let vif_modified_ts_ns = copy_file_from_source(
-                    &mut client,
-                    false,
-                    &req.collection,
-                    req.volume_id,
-                    vol_info.compaction_revision,
-                    1024 * 1024,
-                    &vif_path,
-                    ".vif",
-                    false,
-                    true,
-                    None,
-                    &mut next_report_target,
-                    report_interval,
-                    &mut throttler,
-                )
-                .await
-                .map_err(|e| Status::internal(e))?;
-                if vif_modified_ts_ns > 0 {
-                    let _ = set_file_mtime(&vif_path, vif_modified_ts_ns);
-                }
-
-                // Remove the .note file. A leftover note fails the load on the
-                // next restart, so a removal failure must fail the copy.
-                if let Err(e) = std::fs::remove_file(&note_path) {
-                    if e.kind() != std::io::ErrorKind::NotFound {
-                        return Err(Status::internal(format!(
-                            "remove .note for volume {}: {}",
-                            vid, e
-                        )));
-                    }
-                }
-
-                // Verify file sizes
-                if !has_remote_dat {
-                    let dat_path = format!("{}.dat", data_base_name);
-                    check_copy_file_size(&dat_path, vol_info.dat_file_size)?;
-                }
-                if vol_info.idx_file_size > 0 {
-                    check_copy_file_size(&idx_path, vol_info.idx_file_size)?;
-                }
-
-                // Find last_append_at_ns from copied files
-                let last_append_at_ns = if !has_remote_dat {
-                    find_last_append_at_ns(
-                        &idx_path,
-                        &format!("{}.dat", data_base_name),
-                        vol_info.version,
-                    )
-                    .unwrap_or(vol_info.dat_file_timestamp_seconds * 1_000_000_000)
-                } else {
-                    vol_info.dat_file_timestamp_seconds * 1_000_000_000
-                };
-
-                // Mount the volume
-                {
-                    let mut store = state.store.write().unwrap();
-                    store
-                        .mount_volume(vid, &vol_info.collection, selected_disk_type)
-                        .map_err(|e| {
-                            Status::internal(format!("failed to mount volume {}: {}", vid, e))
-                        })?;
-                }
-                state.volume_state_notify.notify_one();
-
-                // Send final response with last_append_at_ns
-                let _ = tx
-                    .send(Ok(volume_server_pb::VolumeCopyResponse {
-                        last_append_at_ns: last_append_at_ns,
-                        processed_bytes: 0,
-                    }))
-                    .await;
-
-                Ok::<(), Status>(())
-            }
-            .await;
-
-            if let Err(e) = result {
-                // Clean up on error
-                let _ = std::fs::remove_file(format!("{}.dat", data_base_name));
-                let _ = std::fs::remove_file(format!("{}.idx", idx_base_name));
-                let _ = std::fs::remove_file(format!("{}.vif", data_base_name));
-                let _ = std::fs::remove_file(&note_path);
-                let _ = tx.send(Err(e)).await;
+            // Tracks whether mount_volume succeeded so the error branch can
+            // unmount (not just unlink) an orphaned replica. A mount that
+            // races a departing caller is the one case where the existing
+            // file-only cleanup leaves the volume loaded in memory.
+            let mut mounted = false;
+            if let Err(e) = job.run(&mut client, &mut mounted).await {
+                job.cleanup_failed_copy(e, mounted).await;
             }
         });
 
@@ -1508,11 +2116,12 @@ impl VolumeServer for VolumeGrpcService {
                 dat_file_timestamp_seconds: mod_time,
                 dat_file_size: vol.dat_file_size().unwrap_or(0),
                 file_count: vol.file_count() as u64,
-                compaction_revision: vol.super_block.compaction_revision as u32,
+                compaction_revision: vol.super_block().compaction_revision as u32,
                 collection: vol.collection.clone(),
                 disk_type: store.locations[loc_idx].disk_type.to_string(),
-                volume_info: Some(vol.volume_info.clone()),
+                volume_info: Some(vol.volume_info().clone()),
                 version: vol.version().0 as u32,
+                expire_at_sec: vol.expire_at_sec(),
             },
         ))
     }
@@ -1523,6 +2132,8 @@ impl VolumeServer for VolumeGrpcService {
         request: Request<volume_server_pb::CopyFileRequest>,
     ) -> Result<Response<Self::CopyFileStream>, Status> {
         let req = request.into_inner();
+        check_volume_file_extension(&req.ext).map_err(Status::invalid_argument)?;
+        check_volume_collection(&req.collection).map_err(Status::invalid_argument)?;
         let vid = VolumeId(req.volume_id);
 
         let file_name: String;
@@ -1530,8 +2141,8 @@ impl VolumeServer for VolumeGrpcService {
         if !req.is_ec_volume {
             // Sync volume to disk before copying (matching Go's v.SyncToDisk())
             {
-                let mut store = self.state.store.write().unwrap();
-                if let Some((_, v)) = store.find_volume_mut(vid) {
+                let store = self.state.store.read().unwrap();
+                if let Some((_, v)) = store.find_volume(vid) {
                     let _ = v.sync_to_disk();
                 }
             }
@@ -1550,7 +2161,7 @@ impl VolumeServer for VolumeGrpcService {
             // must not be used here, or this check spuriously fails on every volume
             // that has ever been compacted even once.
             if req.compaction_revision != u32::MAX
-                && u32::from(v.super_block.compaction_revision) != req.compaction_revision
+                && u32::from(v.super_block().compaction_revision) != req.compaction_revision
             {
                 return Err(Status::failed_precondition(format!(
                     "volume {} is compacted",
@@ -1690,8 +2301,16 @@ impl VolumeServer for VolumeGrpcService {
     ) -> Result<Response<volume_server_pb::ReceiveFileResponse>, Status> {
         self.state.check_maintenance()?;
 
+        use tokio::io::AsyncWriteExt;
+
         let mut stream = request.into_inner();
-        let mut target_file: Option<std::fs::File> = None;
+        // Held while an EC .ecj is received, through the cleanup of a partial
+        // file below. Declared before the file so it is dropped after it.
+        let mut ecj_write: Option<crate::storage::erasure_coding::ecj_registry::EcjWrite> = None;
+        // tokio::fs + BufWriter, as `drain_copy_stream_to_file` below already
+        // does: the chunk writes and the final fsync are disk I/O and must not
+        // run on the runtime worker that is also driving this stream.
+        let mut target_file: Option<tokio::io::BufWriter<tokio::fs::File>> = None;
         let mut file_path: Option<String> = None;
         let mut bytes_written: u64 = 0;
         let mut resp_error: Option<String> = None;
@@ -1700,6 +2319,14 @@ impl VolumeServer for VolumeGrpcService {
             while let Some(req) = stream.message().await? {
                 match req.data {
                     Some(volume_server_pb::receive_file_request::Data::Info(info)) => {
+                        if let Err(e) = check_volume_file_extension(&info.ext) {
+                            resp_error = Some(e);
+                            break;
+                        }
+                        if let Err(e) = check_volume_collection(&info.collection) {
+                            resp_error = Some(e);
+                            break;
+                        }
                         // Determine file path
                         let path = if info.is_ec_volume {
                             let store = self.state.store.read().unwrap();
@@ -1721,9 +2348,9 @@ impl VolumeServer for VolumeGrpcService {
                             // owns the .ecx on disk (volume not yet mounted — relevant
                             // when shards stream in mid-rebuild before any
                             // VolumeEcShardsMount has happened; see #9212), then any
-                            // HDD, then any disk. Pass the build's default data-shard
-                            // count for free-slot maths; the helper takes it as a
-                            // parameter so custom-ratio builds can swap it.
+                            // HDD, then any disk. The free-slot maths uses the
+                            // volume's own data-shard count from its .vif so a
+                            // custom-ratio volume is not scored as 10+4.
                             let vid = VolumeId(info.volume_id);
                             let dir = if info.disk_id > 0 {
                                 let count = store.locations.len();
@@ -1736,11 +2363,16 @@ impl VolumeServer for VolumeGrpcService {
                                 }
                                 Some(store.locations[info.disk_id as usize].directory.clone())
                             } else {
+                                // The mounted-volume refusal above means no disk
+                                // holds an in-memory claim here.
+                                let data_shards =
+                                    store.lookup_ec_data_shards(&info.collection, vid);
                                 store
                                     .find_ec_shard_target_location(
                                         &info.collection,
                                         vid,
-                                        DATA_SHARDS_COUNT as u32,
+                                        data_shards,
+                                        &[],
                                     )
                                     .map(|i| store.locations[i].directory.clone())
                             };
@@ -1798,7 +2430,7 @@ impl VolumeServer for VolumeGrpcService {
                                                 .map(|m| m.len() > 0)
                                                 .unwrap_or(false)
                                         })
-                                }) {
+                                }, None) {
                                     Some(i) => {
                                         let dir = store.locations[i].directory.clone();
                                         drop(store);
@@ -1826,16 +2458,33 @@ impl VolumeServer for VolumeGrpcService {
                             }
                         };
 
-                        target_file = Some(std::fs::File::create(&path).map_err(|e| {
+                        // The mounted check above runs once; a volume can still
+                        // mount on this journal while the stream writes it.
+                        // Registered as a writer before the file is created,
+                        // that mount cannot compact the journal and leave the
+                        // rest of the stream in an unlinked inode.
+                        if info.is_ec_volume && info.ext == ".ecj" && ecj_write.is_none() {
+                            ecj_write = Some(
+                                crate::storage::erasure_coding::ecj_registry::begin_ecj_write_async(
+                                    &path,
+                                )
+                                .await,
+                            );
+                        }
+
+                        let f = tokio::fs::File::create(&path).await.map_err(|e| {
                             Status::internal(format!("failed to create file: {}", e))
-                        })?);
+                        })?;
+                        target_file = Some(tokio::io::BufWriter::new(f));
                         file_path = Some(path);
                     }
                     Some(volume_server_pb::receive_file_request::Data::FileContent(content)) => {
                         if let Some(ref mut f) = target_file {
-                            use std::io::Write;
-                            match f.write(&content) {
-                                Ok(n) => bytes_written += n as u64,
+                            // write_all, not write: a short write (ENOSPC, NFS)
+                            // would be counted as success for however many
+                            // bytes landed, silently shifting later chunks.
+                            match f.write_all(&content).await {
+                                Ok(()) => bytes_written += content.len() as u64,
                                 Err(e) => {
                                     // Match Go: write failures are response-level errors, not gRPC errors
                                     resp_error = Some(format!("failed to write file: {}", e));
@@ -1860,16 +2509,32 @@ impl VolumeServer for VolumeGrpcService {
 
         match result {
             Ok(()) => {
-                // Check for protocol-level errors (returned in response body, not gRPC status)
+                // Flush the BufWriter and fsync, reporting failure through the
+                // response `error` field: the caller renames the staged file
+                // into place on success, so a swallowed fsync error would
+                // publish data that never reached disk.
+                if resp_error.is_none()
+                    && let Some(ref mut f) = target_file
+                {
+                    if let Err(e) = f.flush().await {
+                        resp_error = Some(format!("failed to flush file: {}", e));
+                    } else if let Err(e) = f.get_ref().sync_all().await {
+                        resp_error = Some(format!("failed to sync file: {}", e));
+                    }
+                }
+                // Protocol-level errors are returned in the response body, not
+                // gRPC status. Any of them leaves a partial staged file behind;
+                // remove it as Go does on a failed write.
                 if let Some(err_msg) = resp_error {
+                    drop(target_file.take());
+                    if let Some(ref p) = file_path {
+                        let _ = tokio::fs::remove_file(p).await;
+                    }
                     return Ok(Response::new(volume_server_pb::ReceiveFileResponse {
                         error: err_msg,
                         bytes_written: 0,
                     }));
                 }
-                if let Some(ref f) = target_file {
-                    let _ = f.sync_all();
-                }
                 Ok(Response::new(volume_server_pb::ReceiveFileResponse {
                     error: String::new(),
                     bytes_written,
@@ -1881,7 +2546,7 @@ impl VolumeServer for VolumeGrpcService {
                     drop(f);
                 }
                 if let Some(ref p) = file_path {
-                    let _ = std::fs::remove_file(p);
+                    let _ = tokio::fs::remove_file(p).await;
                 }
                 Err(e)
             }
@@ -1896,12 +2561,32 @@ impl VolumeServer for VolumeGrpcService {
         let vid = VolumeId(req.volume_id);
         let offset = req.offset;
         let size = Size(req.size);
+        if let Err(msg) = crate::storage::needle::needle::validate_wire_size(size) {
+            return Err(Status::invalid_argument(msg));
+        }
 
-        let store = self.state.store.read().unwrap();
+        let store = self.store_read();
         let (_, vol) = store
             .find_volume(vid)
             .ok_or_else(|| Status::not_found(format!("not found volume id {}", vid)))?;
 
+        // Framing: request `size` is body size, but read_needle_blob returns
+        // GetActualSize bytes + protobuf tag/len, so body==1<<30 always exceeds
+        // GRPC_MAX_MESSAGE_SIZE on the wire after allocation+disk read.
+        // Check actual encoded size post-lock (have vol.version() here).
+        // The 6-byte headroom is the exact protobuf overhead for this
+        // response at the boundary: 1 tag byte (`bytes needle_blob = 1`)
+        // plus a 5-byte varint length for sizes near 1 GiB. Sizes whose
+        // encoded form still fits are therefore accepted; anything larger
+        // is rejected before paying for the disk read.
+        let actual = crate::storage::needle::needle::get_actual_size(size, vol.version()) as u64;
+        if actual + 6 > crate::server::grpc_client::GRPC_MAX_MESSAGE_SIZE as u64 {
+            return Err(Status::invalid_argument(format!(
+                "needle blob size {} exceeds transport limit",
+                actual
+            )));
+        }
+
         let blob = vol.read_needle_blob(offset, size).map_err(|e| {
             Status::internal(format!(
                 "read needle blob offset {} size {}: {}",
@@ -1960,11 +2645,17 @@ impl VolumeServer for VolumeGrpcService {
         let vid = VolumeId(req.volume_id);
         let needle_id = NeedleId(req.needle_id);
         let size = Size(req.size);
+        if let Err(msg) = crate::storage::needle::needle::validate_wire_size(size) {
+            return Err(Status::invalid_argument(msg));
+        }
 
-        let mut store = self.state.store.write().unwrap();
-        let (_, vol) = store
-            .find_volume_mut(vid)
-            .ok_or_else(|| Status::not_found(format!("not found volume id {}", vid)))?;
+        let vol = {
+            let store = self.store_read();
+            let (_, vol) = store
+                .find_volume(vid)
+                .ok_or_else(|| Status::not_found(format!("not found volume id {}", vid)))?;
+            vol
+        };
 
         vol.write_needle_blob_and_index(needle_id, &req.needle_blob, size)
             .map_err(|e| {
@@ -1982,53 +2673,21 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::ReadAllNeedlesRequest>,
     ) -> Result<Response<Self::ReadAllNeedlesStream>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         let req = request.into_inner();
         let state = self.state.clone();
 
         let (tx, rx) = tokio::sync::mpsc::channel(32);
 
-        // Stream needles lazily via a blocking task (matches Go's scanner pattern)
         tokio::task::spawn_blocking(move || {
-            let store = state.store.read().unwrap();
             for &raw_vid in &req.volume_ids {
-                let vid = VolumeId(raw_vid);
-                let v = match store.find_volume(vid) {
-                    Some((_, v)) => v,
-                    None => {
-                        let _ = tx.blocking_send(Err(Status::not_found(format!(
-                            "not found volume id {}",
-                            vid
-                        ))));
+                match read_all_needles_of_volume(&state, VolumeId(raw_vid), &tx) {
+                    Ok(()) => {}
+                    Err(Some(status)) => {
+                        let _ = tx.blocking_send(Err(status));
                         return;
                     }
-                };
-
-                let needles = match v.read_all_needles() {
-                    Ok(n) => n,
-                    Err(e) => {
-                        let _ = tx.blocking_send(Err(Status::internal(e.to_string())));
-                        return;
-                    }
-                };
-
-                for n in needles {
-                    let compressed = n.is_compressed();
-                    if tx
-                        .blocking_send(Ok(volume_server_pb::ReadAllNeedlesResponse {
-                            volume_id: raw_vid,
-                            needle_id: n.id.into(),
-                            cookie: n.cookie.0,
-                            needle_blob: n.data,
-                            needle_blob_compressed: compressed,
-                            last_modified: n.last_modified,
-                            crc: n.checksum.0,
-                            name: n.name,
-                            mime: n.mime,
-                        }))
-                        .is_err()
-                    {
-                        return; // receiver dropped
-                    }
+                    Err(None) => return, // receiver dropped
                 }
             }
         });
@@ -2050,12 +2709,14 @@ impl VolumeServer for VolumeGrpcService {
             let (_, vol) = store
                 .find_volume(vid)
                 .ok_or_else(|| Status::not_found(format!("not found volume id {}", vid)))?;
-            (vol.version().0 as u32, vol.super_block.block_size() as u64)
+            (
+                vol.version().0 as u32,
+                vol.super_block().block_size() as u64,
+            )
         };
 
         let state = self.state.clone();
         let (tx, rx) = tokio::sync::mpsc::channel(32);
-        const BUFFER_SIZE_LIMIT: usize = 2 * 1024 * 1024;
 
         tokio::spawn(async move {
             let since_ns = req.since_ns;
@@ -2064,86 +2725,51 @@ impl VolumeServer for VolumeGrpcService {
             let mut draining_seconds = idle_timeout as i64;
 
             loop {
-                // Use binary search to find starting offset, then scan from there
-                let scan_result = {
-                    let store = state.store.read().unwrap();
-                    if let Some((_, vol)) = store.find_volume(vid) {
-                        let start_offset = if last_timestamp_ns > 0 {
-                            match vol.binary_search_by_append_at_ns(last_timestamp_ns) {
-                                Ok((offset, _is_last)) => {
-                                    if offset.is_zero() {
-                                        Ok(sb_size)
-                                    } else {
-                                        Ok(offset.to_actual_offset() as u64)
-                                    }
-                                }
-                                Err(e) => {
-                                    tracing::warn!(
-                                        "fail to locate by appendAtNs {}: {}",
-                                        last_timestamp_ns,
-                                        e
-                                    );
-                                    Err(format!(
-                                        "fail to locate by appendAtNs {}: {}",
-                                        last_timestamp_ns, e
-                                    ))
-                                }
-                            }
-                        } else {
-                            Ok(sb_size)
-                        };
-                        match start_offset {
-                            Ok(off) => Ok(vol.scan_raw_needles_from(off)),
-                            Err(msg) => Err(msg),
-                        }
-                    } else {
-                        break;
-                    }
-                };
+                // The search and the scan are blocking file (or S3) I/O, so
+                // each pass runs on a blocking thread and takes and drops the
+                // store guard itself (see tail_pass). The heartbeat, the sleep
+                // and the draining countdown stay here, so no thread is parked
+                // while the stream is idle.
+                let pass_state = state.clone();
+                let pass_tx = tx.clone();
+                let pass = tokio::task::spawn_blocking(move || {
+                    tail_pass(
+                        &pass_state,
+                        vid,
+                        sb_size,
+                        version,
+                        last_timestamp_ns,
+                        &pass_tx,
+                    )
+                })
+                .await;
 
-                let scan_inner = match scan_result {
-                    Ok(r) => r,
-                    Err(msg) => {
+                let (last_processed_ns, sent_any) = match pass {
+                    Ok(TailPass::Scanned {
+                        last_processed_ns,
+                        sent_any,
+                    }) => (last_processed_ns, sent_any),
+                    // Caught up: heartbeat WITHOUT scanning, as Go does.
+                    Ok(TailPass::CaughtUp) => (last_timestamp_ns, false),
+                    Ok(TailPass::VolumeGone) => break,
+                    Ok(TailPass::ClientGone) => return,
+                    Ok(TailPass::Failed(msg)) => {
                         let _ = tx.send(Err(Status::internal(msg))).await;
                         return;
                     }
+                    // A panic on the blocking thread must not look like a
+                    // clean end of stream to the receiver.
+                    Err(e) => {
+                        let _ = tx
+                            .send(Err(Status::internal(format!(
+                                "streamFollow: tail pass for volume {} failed: {}",
+                                vid, e
+                            ))))
+                            .await;
+                        return;
+                    }
                 };
 
-                let entries = match scan_inner {
-                    Ok(e) => e,
-                    Err(_) => break,
-                };
-
-                // Filter entries since last_timestamp_ns
-                let mut last_processed_ns = last_timestamp_ns;
-                let mut sent_any = false;
-                for (header, body, append_at_ns) in &entries {
-                    if *append_at_ns <= last_timestamp_ns && last_timestamp_ns > 0 {
-                        continue;
-                    }
-                    sent_any = true;
-                    // Send body in chunks of BUFFER_SIZE_LIMIT
-                    // Go sends needle_header on every chunk
-                    let mut i = 0;
-                    while i < body.len() {
-                        let end = std::cmp::min(i + BUFFER_SIZE_LIMIT, body.len());
-                        let is_last_chunk = end >= body.len();
-                        let msg = volume_server_pb::VolumeTailSenderResponse {
-                            needle_header: header.clone(),
-                            needle_body: body[i..end].to_vec(),
-                            is_last_chunk,
-                            version,
-                        };
-                        if tx.send(Ok(msg)).await.is_err() {
-                            return;
-                        }
-                        i = end;
-                    }
-                    if *append_at_ns > last_processed_ns {
-                        last_processed_ns = *append_at_ns;
-                    }
-                }
-
                 if !sent_any {
                     // Send heartbeat
                     let msg = volume_server_pb::VolumeTailSenderResponse {
@@ -2182,9 +2808,21 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeTailReceiverRequest>,
     ) -> Result<Response<volume_server_pb::VolumeTailReceiverResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
+        if !self.state.allow_untrusted_remote_endpoints {
+            crate::remote_storage::validate_replica_target(&req.source_volume_server)
+                .await
+                .map_err(|e| {
+                    Status::invalid_argument(format!(
+                        "invalid source volume server {}: {}",
+                        req.source_volume_server, e
+                    ))
+                })?;
+        }
+
         // Check volume exists
         {
             let store = self.state.store.read().unwrap();
@@ -2198,19 +2836,17 @@ impl VolumeServer for VolumeGrpcService {
         let grpc_addr = parse_grpc_address(source)
             .map_err(|e| Status::internal(format!("invalid source address {}: {}", source, e)))?;
 
-        let channel = build_grpc_endpoint(&grpc_addr, self.state.outgoing_grpc_tls.as_ref())
-            .map_err(|e| Status::internal(format!("parse source: {}", e)))?
-            .connect()
-            .await
-            .map_err(|e| Status::internal(format!("connect to {}: {}", grpc_addr, e)))?;
+        let channel = connect_channel_guarded(
+            &grpc_addr,
+            source,
+            self.state.outgoing_grpc_tls.as_ref(),
+            GrpcDialOptions::stream(),
+            self.state.allow_untrusted_remote_endpoints,
+        )
+        .await
+        .map_err(|e| Status::internal(format!("connect to {}: {}", grpc_addr, e)))?;
 
-        let mut client =
-            volume_server_pb::volume_server_client::VolumeServerClient::with_interceptor(
-                channel,
-                super::request_id::outgoing_request_id_interceptor,
-            )
-            .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-            .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+        let mut client = volume_server_client(channel);
 
         // Call VolumeTailSender on source
         let mut stream = client
@@ -2284,15 +2920,20 @@ impl VolumeServer for VolumeGrpcService {
                 if needle_body.len() < min_footer {
                     return Err(Status::invalid_argument(format!(
                         "tombstone needle {} body too short: got {} bytes, need >= {} for version {}",
-                        n.id.0, needle_body.len(), min_footer, resp_version
+                        n.id.0,
+                        needle_body.len(),
+                        min_footer,
+                        resp_version
                     )));
                 }
             }
 
             // Write needle to local volume
-            let mut store = state.store.write().unwrap();
-            store
-                .write_volume_needle(vid, &mut n)
+            let vol = {
+                let store = state.store.read().unwrap();
+                store.writable_volume(vid)
+            };
+            vol.and_then(|vol| vol.write_needle(&mut n, true, false))
                 .map_err(|e| Status::internal(format!("write needle: {}", e)))?;
         }
 
@@ -2307,6 +2948,7 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeEcShardsGenerateRequest>,
     ) -> Result<Response<volume_server_pb::VolumeEcShardsGenerateResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
@@ -2326,18 +2968,7 @@ impl VolumeServer for VolumeGrpcService {
             }
             let version = vol.version().0 as u32;
             let dat_size = vol.dat_file_size().unwrap_or(0) as i64;
-            let expire_at_sec = {
-                let ttl_seconds = vol.super_block.ttl.to_seconds();
-                if ttl_seconds > 0 {
-                    std::time::SystemTime::now()
-                        .duration_since(std::time::UNIX_EPOCH)
-                        .unwrap_or_default()
-                        .as_secs()
-                        + ttl_seconds
-                } else {
-                    0
-                }
-            };
+            let expire_at_sec = vol.expire_at_sec();
             (
                 store.locations[loc_idx].directory.clone(),
                 store.locations[loc_idx].idx_directory.clone(),
@@ -2347,13 +2978,57 @@ impl VolumeServer for VolumeGrpcService {
             )
         };
 
-        // Check existing .vif for EC shard config (matching Go's MaybeLoadVolumeInfo)
-        let (data_shards, parity_shards) =
+        // Check existing .vif for EC shard config (matching Go's MaybeLoadVolumeInfo).
+        // The block size is recomputed by the encode for the current .dat, so
+        // only the ratio is carried over from a prior config.
+        let (data_shards, parity_shards, _) =
             crate::storage::erasure_coding::ec_volume::read_ec_shard_config(
                 &dir, &idx_dir, collection, vid,
-            );
+            )
+            .map_err(|e| {
+                tonic::Status::internal(format!("read ec shard config for volume {}: {}", vid.0, e))
+            })?;
 
-        if let Err(e) = crate::storage::erasure_coding::ec_encoder::write_ec_files(
+        // Wipe any EC artifacts from a prior encode so a retry never mixes two
+        // runs (Go's UnloadEcVolume + removeStaleEcArtifacts). Evict the
+        // in-memory EcVolume first so the unlink frees the inodes instead of
+        // leaving open fds serving the old bytes, and sweep every disk: a
+        // stale shard on a sibling disk would otherwise be mounted against the
+        // new .ecx at reconcile. The source .dat/.idx/.vif are kept.
+        let swept = {
+            let mut store = self.state.store.write().unwrap();
+            store.unload_ec_volume(vid);
+            store.locations.iter().try_for_each(|loc| {
+                loc.remove_ec_volume_files_full_teardown(collection, vid)
+                    .map_err(|e| {
+                        Status::internal(format!(
+                            "wipe stale EC artifacts for volume {} on {}: {}",
+                            vid.0, loc.directory, e
+                        ))
+                    })
+            })
+        };
+        // The unload dropped mounted shards, so wake the heartbeat now rather
+        // than leaving the master to route reads here until the next pulse. A
+        // failed sweep has unloaded them too, hence before the `?`.
+        self.state.volume_state_notify.notify_one();
+        swept?;
+
+        // On any failure before the .vif is committed, remove the freshly
+        // written .ecNN, .ecx and generation-0 .ecsum (matching Go's deferred
+        // cleanup) so a retry never starts from this run's leftovers.
+        let cleanup_encode = || {
+            let base = crate::storage::volume::volume_file_name(&dir, collection, vid);
+            for i in 0..(data_shards + parity_shards) {
+                let _ = std::fs::remove_file(format!("{}.ec{:02}", base, i));
+            }
+            let _ = std::fs::remove_file(format!("{}.ecx", base));
+            let _ = std::fs::remove_file(
+                crate::storage::erasure_coding::ec_bitrot::bitrot_sidecar_path(&base, 0),
+            );
+        };
+
+        let block_size = match crate::storage::erasure_coding::ec_encoder::write_ec_files(
             &dir,
             &idx_dir,
             collection,
@@ -2361,16 +3036,12 @@ impl VolumeServer for VolumeGrpcService {
             data_shards as usize,
             parity_shards as usize,
         ) {
-            // Cleanup partially-created .ecNN and .ecx files on failure (matching Go defer)
-            let base = crate::storage::volume::volume_file_name(&dir, collection, vid);
-            let total_shards = data_shards + parity_shards;
-            for i in 0..total_shards {
-                let shard_path = format!("{}.ec{:02}", base, i);
-                let _ = std::fs::remove_file(&shard_path);
+            Ok(block_size) => block_size,
+            Err(e) => {
+                cleanup_encode();
+                return Err(Status::internal(e.to_string()));
             }
-            let _ = std::fs::remove_file(format!("{}.ecx", base));
-            return Err(Status::internal(e.to_string()));
-        }
+        };
 
         // Write .vif file with EC shard metadata
         {
@@ -2381,21 +3052,22 @@ impl VolumeServer for VolumeGrpcService {
                 dat_file_size,
                 expire_at_sec,
                 ec_shard_config: Some(crate::storage::volume::VifEcShardConfig {
-                    data_shards: data_shards,
-                    parity_shards: parity_shards,
+                    data_shards,
+                    parity_shards,
                     // This run's identity; the read path rejects a shard from a
                     // different encode run.
                     encode_ts_ns: std::time::SystemTime::now()
                         .duration_since(std::time::UNIX_EPOCH)
                         .unwrap_or_default()
                         .as_nanos() as i64,
+                    block_size,
                 }),
                 ..Default::default()
             };
-            let content = serde_json::to_string_pretty(&vif)
-                .map_err(|e| Status::internal(format!("serialize vif: {}", e)))?;
-            std::fs::write(&vif_path, content)
-                .map_err(|e| Status::internal(format!("write vif: {}", e)))?;
+            if let Err(e) = crate::storage::store::save_vif_volume_info(&vif_path, &vif) {
+                cleanup_encode();
+                return Err(Status::internal(format!("write vif: {}", e)));
+            }
         }
 
         Ok(Response::new(
@@ -2407,6 +3079,7 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeEcShardsRebuildRequest>,
     ) -> Result<Response<volume_server_pb::VolumeEcShardsRebuildResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
@@ -2421,13 +3094,6 @@ impl VolumeServer for VolumeGrpcService {
             format!("{}_{}", collection, vid.0)
         };
 
-        struct LocInfo {
-            dir: String,
-            idx_dir: String,
-            shard_count: usize,
-            has_ecx: bool,
-        }
-
         let store = self.state.store.read().unwrap();
         let mut loc_infos: Vec<LocInfo> = Vec::new();
 
@@ -2475,26 +3141,8 @@ impl VolumeServer for VolumeGrpcService {
             ));
         }
 
-        // Pick rebuild location: has .ecx and most shards
-        let mut rebuild_loc_idx: Option<usize> = None;
-        let mut other_dirs: Vec<String> = Vec::new();
-
-        for (i, info) in loc_infos.iter().enumerate() {
-            if info.has_ecx
-                && (rebuild_loc_idx.is_none()
-                    || info.shard_count > loc_infos[rebuild_loc_idx.unwrap()].shard_count)
-            {
-                if let Some(prev) = rebuild_loc_idx {
-                    other_dirs.push(loc_infos[prev].dir.clone());
-                }
-                rebuild_loc_idx = Some(i);
-            } else {
-                other_dirs.push(info.dir.clone());
-            }
-        }
-
-        let rebuild_loc_idx = match rebuild_loc_idx {
-            Some(i) => i,
+        let (rebuild_loc_idx, other_dirs) = match select_rebuild_location(&loc_infos) {
+            Some(picked) => picked,
             None => {
                 return Ok(Response::new(
                     volume_server_pb::VolumeEcShardsRebuildResponse {
@@ -2508,13 +3156,34 @@ impl VolumeServer for VolumeGrpcService {
         let rebuild_idx_dir = loc_infos[rebuild_loc_idx].idx_dir.clone();
 
         // Determine data/parity shard config from rebuild dir
-        let (data_shards, parity_shards) =
-            crate::storage::erasure_coding::ec_volume::read_ec_shard_config(
+        // The encode-time .dat size resolves the row count the ecx rebuild
+        // de-stripes with; 0 leaves it to infer from the padded shard extent.
+        // Both lookups search the sibling disks too: the rebuild writes into one
+        // location, but a multi-disk server may keep this volume's .vif or its
+        // generation-0 .ecsum on another, and defaulting to 10+4 with the
+        // legacy layout would reconstruct through the wrong matrix.
+        let dat_file_size = crate::storage::erasure_coding::ec_volume::load_vif_info_across_dirs(
+            &rebuild_dir,
+            &rebuild_idx_dir,
+            &other_dirs,
+            collection,
+            vid,
+        )
+        .ok()
+        .flatten()
+        .map(|(v, _)| v.dat_file_size)
+        .unwrap_or(0);
+        let (data_shards, parity_shards, block_size) =
+            crate::storage::erasure_coding::ec_volume::read_ec_shard_config_across_dirs(
                 &rebuild_dir,
                 &rebuild_idx_dir,
+                &other_dirs,
                 collection,
                 vid,
-            );
+            )
+            .map_err(|e| {
+                tonic::Status::internal(format!("read ec shard config for volume {}: {}", vid.0, e))
+            })?;
         let total_shards = data_shards + parity_shards;
 
         // Check which shards are missing (check rebuild dir and all other dirs)
@@ -2553,8 +3222,17 @@ impl VolumeServer for VolumeGrpcService {
 
         // Rebuild missing shards, searching all locations for input shards.
         // Pass other_dirs so shards on sibling disks are found even when the
-        // primary rebuild dir doesn't hold them.
-        let other_dir_refs: Vec<&str> = other_dirs.iter().map(|s| s.as_str()).collect();
+        // primary rebuild dir doesn't hold them. This one takes a single flat
+        // list — the shape Go's RebuildEcFiles uses — so unlike the resolvers
+        // above it cannot be handed the rebuild's own index directory
+        // separately, and a split -dir/-dir.idx location keeps its .ecx and
+        // .vif there. Go's additionalDirs carries that directory for the same
+        // reason.
+        let mut rebuild_search_dirs: Vec<String> = other_dirs.clone();
+        if !rebuild_idx_dir.is_empty() && rebuild_idx_dir != rebuild_dir {
+            rebuild_search_dirs.push(rebuild_idx_dir.clone());
+        }
+        let other_dir_refs: Vec<&str> = rebuild_search_dirs.iter().map(|s| s.as_str()).collect();
         crate::storage::erasure_coding::ec_encoder::rebuild_ec_files(
             &rebuild_dir,
             collection,
@@ -2592,6 +3270,8 @@ impl VolumeServer for VolumeGrpcService {
             collection,
             vid,
             data_shards as usize,
+            block_size,
+            dat_file_size,
             &ecx_dir_refs,
         )
         .map_err(|e| Status::internal(format!("RebuildEcxFile: {}", e)))?;
@@ -2607,21 +3287,43 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeEcShardsCopyRequest>,
     ) -> Result<Response<volume_server_pb::VolumeEcShardsCopyResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
+        if !self.state.allow_untrusted_remote_endpoints {
+            crate::remote_storage::validate_replica_target(&req.source_data_node)
+                .await
+                .map_err(|e| {
+                    Status::invalid_argument(format!(
+                        "invalid source data node {}: {}",
+                        req.source_data_node, e
+                    ))
+                })?;
+        }
+
+        // Validate wire shard ids at the boundary: ShardId is u8 but only
+        // 0..MAX_SHARD_COUNT are valid. Rejects 256 (would truncate to 0)
+        // and 270 (would alias 14).
+        let mut shard_ids: Vec<ShardId> = Vec::with_capacity(req.shard_ids.len());
+        for &sid in &req.shard_ids {
+            shard_ids.push(shard_id_try_from(sid).map_err(Status::invalid_argument)?);
+        }
+
         // Select target location:
         //   When disk_id > 0: use that specific location.
         //   When disk_id == 0 (unset): auto-select via
         //   find_ec_shard_target_location, which prefers a disk that
-        //   already has the EC volume mounted, then a disk that owns the
-        //   .ecx on disk (volume not yet mounted — relevant for
-        //   ec.rebuild, where only the first shard carries .ecx and
-        //   subsequent shards must land on the same disk; see #9212),
-        //   then any HDD, then any disk. Pass the build's default
-        //   data-shard count; the helper takes it as a parameter so
-        //   custom-ratio builds can swap it.
+        //   already owns one of the shards being copied (a retried move
+        //   must overwrite in place, not leave two disks of this server
+        //   claiming the same shard), then a disk that already has the EC
+        //   volume mounted, then a disk that owns the .ecx on disk (volume
+        //   not yet mounted — relevant for ec.rebuild, where only the
+        //   first shard carries .ecx and subsequent shards must land on
+        //   the same disk; see #9212), then any HDD, then any disk. The
+        //   free-slot maths uses the volume's own data-shard count from its
+        //   .vif so a custom-ratio volume is not scored as 10+4.
         let (dest_dir, dest_idx_dir) = {
             let store = self.state.store.read().unwrap();
             let count = store.locations.len();
@@ -2637,10 +3339,28 @@ impl VolumeServer for VolumeGrpcService {
                 let loc = &store.locations[req.disk_id as usize];
                 (loc.directory.clone(), loc.idx_directory.clone())
             } else {
+                // A batch whose requested shards are already owned by
+                // different local disks has no single correct destination:
+                // writing them all to one disk would duplicate the other
+                // disks' claims. Refuse so the caller splits the batch per
+                // shard (or chooses explicitly via disk_id).
+                let owners = store.ec_shard_owner_disks(vid, &shard_ids);
+                if owners.len() > 1 {
+                    let dirs: Vec<&str> = owners
+                        .iter()
+                        .map(|&i| store.locations[i].directory.as_str())
+                        .collect();
+                    return Err(Status::failed_precondition(format!(
+                        "volume {} shards {:?} are already owned by multiple local disks {:?}: no single destination; copy per shard or pass disk_id",
+                        req.volume_id, shard_ids, dirs
+                    )));
+                }
+                let data_shards = store.lookup_ec_data_shards(&req.collection, vid);
                 match store.find_ec_shard_target_location(
                     &req.collection,
                     vid,
-                    DATA_SHARDS_COUNT as u32,
+                    data_shards,
+                    &shard_ids,
                 ) {
                     Some(i) => {
                         let loc = &store.locations[i];
@@ -2662,32 +3382,25 @@ impl VolumeServer for VolumeGrpcService {
             ))
         })?;
 
-        let channel = build_grpc_endpoint(&grpc_addr, self.state.outgoing_grpc_tls.as_ref())
-            .map_err(|e| {
-                Status::internal(format!(
-                    "VolumeEcShardsCopy volume {} parse source: {}",
-                    vid, e
-                ))
-            })?
-            .connect()
-            .await
-            .map_err(|e| {
-                Status::internal(format!(
-                    "VolumeEcShardsCopy volume {} connect to {}: {}",
-                    vid, grpc_addr, e
-                ))
-            })?;
+        let channel = connect_channel_guarded(
+            &grpc_addr,
+            source,
+            self.state.outgoing_grpc_tls.as_ref(),
+            GrpcDialOptions::stream(),
+            self.state.allow_untrusted_remote_endpoints,
+        )
+        .await
+        .map_err(|e| {
+            Status::internal(format!(
+                "VolumeEcShardsCopy volume {} connect to {}: {}",
+                vid, grpc_addr, e
+            ))
+        })?;
 
-        let mut client =
-            volume_server_pb::volume_server_client::VolumeServerClient::with_interceptor(
-                channel,
-                super::request_id::outgoing_request_id_interceptor,
-            )
-            .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-            .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+        let mut client = volume_server_client(channel);
 
         // Copy each shard
-        for &shard_id in &req.shard_ids {
+        for &shard_id in &shard_ids {
             let ext = format!(".ec{:02}", shard_id);
             let copy_req = volume_server_pb::CopyFileRequest {
                 volume_id: req.volume_id,
@@ -2750,10 +3463,24 @@ impl VolumeServer for VolumeGrpcService {
             let file = tokio::fs::File::create(&file_path)
                 .await
                 .map_err(|e| Status::internal(format!("create {}: {}", file_path, e)))?;
-            drain_copy_stream_to_file(&mut stream, file, &file_path, ".ecx").await?;
+            let written = drain_copy_stream_to_file(&mut stream, file, &file_path, ".ecx").await?;
+            // A source that genuinely holds a 0-byte .ecx would leave a stub
+            // here that no placement or mount decision accepts. Catch it at
+            // distribute time, as Go does, so the orchestrator can pick another
+            // source instead of learning about it at mount.
+            if written == 0 {
+                let _ = tokio::fs::remove_file(&file_path).await;
+                return Err(Status::internal(format!(
+                    "VolumeEcShardsCopy volume {}: source .ecx is 0 bytes",
+                    vid
+                )));
+            }
         }
 
-        // Copy .ecj file if requested
+        // Copy .ecj file if requested. The journal is a *set* of ids: merge
+        // the source's into the local one as a union, never append it whole,
+        // or every balance round trip doubles it. A source without one
+        // is not an error.
         if req.copy_ecj_file {
             let copy_req = volume_server_pb::CopyFileRequest {
                 volume_id: req.volume_id,
@@ -2775,19 +3502,26 @@ impl VolumeServer for VolumeGrpcService {
                     ))
                 })?
                 .into_inner();
-
-            let file_path = {
-                let base =
-                    crate::storage::volume::volume_file_name(&dest_idx_dir, &req.collection, vid);
-                format!("{}.ecj", base)
-            };
-            let file = tokio::fs::OpenOptions::new()
-                .create(true)
-                .append(true)
-                .open(&file_path)
-                .await
-                .map_err(|e| Status::internal(format!("create {}: {}", file_path, e)))?;
-            drain_copy_stream_to_file(&mut stream, file, &file_path, ".ecj").await?;
+            let (ids, found) = receive_ecj_ids(&mut stream).await.map_err(|e| {
+                Status::internal(format!(
+                    "VolumeEcShardsCopy volume {} copy .ecj: {}",
+                    vid, e
+                ))
+            })?;
+            if found {
+                let ecj_path = format!(
+                    "{}.ecj",
+                    crate::storage::volume::volume_file_name(&dest_idx_dir, &req.collection, vid)
+                );
+                merge_ecj_ids(&self.state, vid, dest_dir.clone(), ecj_path, ids)
+                    .await
+                    .map_err(|e| {
+                        Status::internal(format!(
+                            "VolumeEcShardsCopy volume {} merge .ecj: {}",
+                            vid, e
+                        ))
+                    })?;
+            }
         }
 
         // Copy .vif file if requested
@@ -2873,12 +3607,13 @@ impl VolumeServer for VolumeGrpcService {
         ))
     }
 
+    /// Allowed in maintenance mode: like `volume_delete` it only removes data, and
+    /// evacuating EC shards off a server in maintenance mode ends here (issue #11066).
     async fn volume_ec_shards_delete(
         &self,
         request: Request<volume_server_pb::VolumeEcShardsDeleteRequest>,
     ) -> Result<Response<volume_server_pb::VolumeEcShardsDeleteResponse>, Status> {
         self.check_grpc_admin_auth(&request)?;
-        self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
@@ -2889,15 +3624,18 @@ impl VolumeServer for VolumeGrpcService {
                 // listed shards, so a remote node retains no stale generation a fresh copy
                 // collides with. Echo the acknowledgement so the caller can tell a
                 // pre-upgrade server apart.
+                //
+                // Unload every disk holding the vid (Go's Store.UnloadEcVolume):
+                // each registration returns its descriptors and ec_shards gauge.
                 {
                     let mut store = self.state.store.write().unwrap();
-                    let _ = store.remove_ec_volume(vid);
+                    store.unload_ec_volume(vid);
                     for loc in &store.locations {
                         loc.remove_ec_volume_files_full_teardown(&req.collection, vid)
                             .map_err(|e| {
                                 Status::internal(format!(
-                                    "full teardown of ec volume {}: {}",
-                                    req.volume_id, e
+                                    "full teardown of ec volume {} on {}: {}",
+                                    req.volume_id, loc.directory, e
                                 ))
                             })?;
                     }
@@ -2910,7 +3648,8 @@ impl VolumeServer for VolumeGrpcService {
                 // shards. Unload and remove only the strictly-older disks, never node-wide.
                 let mut store = self.state.store.write().unwrap();
                 for disk_id in 0..store.locations.len() {
-                    let disk_gen = store.locations[disk_id].ec_generation_ts_ns(&req.collection, vid);
+                    let disk_gen =
+                        store.locations[disk_id].ec_generation_ts_ns(&req.collection, vid);
                     let older = matches!(disk_gen, Some(g) if g > 0 && g < req.encode_ts_ns);
                     if !older {
                         tracing::info!(
@@ -2922,13 +3661,13 @@ impl VolumeServer for VolumeGrpcService {
                         );
                         continue;
                     }
-                    store.locations[disk_id].remove_ec_volume(vid);
+                    store.locations[disk_id].unload_ec_volume(vid);
                     store.locations[disk_id]
                         .remove_ec_volume_files_full_teardown(&req.collection, vid)
                         .map_err(|e| {
                             Status::internal(format!(
-                                "fenced teardown of ec volume {}: {}",
-                                req.volume_id, e
+                                "fenced teardown of ec volume {} on {}: {}",
+                                req.volume_id, store.locations[disk_id].directory, e
                             ))
                         })?;
                 }
@@ -2941,10 +3680,68 @@ impl VolumeServer for VolumeGrpcService {
             ));
         }
 
+        if req.delete_generations_older_than > 0 {
+            // Post-commit cleanup of a 2PC generation switch: the committed
+            // generation has been promoted to the canonical names, so only the
+            // staged <base>.*.v<N> files strictly older than the threshold are
+            // superseded and safe to remove. Versioned files are never mounted,
+            // so nothing needs to be unloaded first.
+            // Snapshot the base names under the lock; the filesystem sweep runs
+            // after it is dropped so a slow disk cannot stall the store.
+            let mut bases = Vec::new();
+            {
+                let store = self.state.store.read().unwrap();
+                for loc in &store.locations {
+                    bases.push(crate::storage::volume::volume_file_name(
+                        &loc.directory,
+                        &req.collection,
+                        vid,
+                    ));
+                    if loc.idx_directory != loc.directory {
+                        bases.push(crate::storage::volume::volume_file_name(
+                            &loc.idx_directory,
+                            &req.collection,
+                            vid,
+                        ));
+                    }
+                }
+            }
+            for base in &bases {
+                crate::storage::erasure_coding::ec_shard::remove_ec_generation_files(
+                    base,
+                    req.delete_generations_older_than,
+                )
+                .map_err(|e| {
+                    Status::internal(format!(
+                        "ec generation cleanup of volume {} on {}: {}",
+                        req.volume_id, base, e
+                    ))
+                })?;
+            }
+            self.state.volume_state_notify.notify_one();
+            return Ok(Response::new(
+                volume_server_pb::VolumeEcShardsDeleteResponse {
+                    full_teardown_done: false,
+                },
+            ));
+        }
+
         let mut store = self.state.store.write().unwrap();
-        store.delete_ec_shards(vid, &req.collection, &req.shard_ids);
+        let mut shard_ids: Vec<ShardId> = Vec::with_capacity(req.shard_ids.len());
+        for &sid in &req.shard_ids {
+            shard_ids.push(shard_id_try_from(sid).map_err(Status::invalid_argument)?);
+        }
+        let delete_result = store.delete_ec_shards(vid, &req.collection, &shard_ids);
+        // The shards are already deleted and unmounted even when a staged-
+        // generation sweep failed, so the state notification must still go out.
         drop(store);
         self.state.volume_state_notify.notify_one();
+        delete_result.map_err(|e| {
+            Status::internal(format!(
+                "delete ec shards of volume {} in {}: {}",
+                req.volume_id, req.collection, e
+            ))
+        })?;
         Ok(Response::new(
             volume_server_pb::VolumeEcShardsDeleteResponse {
                 full_teardown_done: false,
@@ -2959,6 +3756,17 @@ impl VolumeServer for VolumeGrpcService {
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
+        // Pre-validate the ENTIRE batch before any mutation: validating inside
+        // the mount loop would mount a prefix (e.g. shard 0 of [0, 32]) and
+        // then fail, leaving a partial mutation while skipping the sidecar
+        // reload + notify below. Reject up front so invalid batches change no
+        // state.
+        // Validate wire shard ids at the boundary (rejects truncation aliases like 256→0).
+        let mut validated: Vec<ShardId> = Vec::with_capacity(req.shard_ids.len());
+        for &sid in &req.shard_ids {
+            validated.push(shard_id_try_from(sid).map_err(Status::invalid_argument)?);
+        }
+
         // Fetch a missing .ecx from a peer first so on-disk shards that never had
         // a local index can be mounted (issue #10104). Driven on demand by
         // ec.rebuild. volume_id 0 recovers every orphan on this server, including
@@ -2970,13 +3778,34 @@ impl VolumeServer for VolumeGrpcService {
         // Mount one shard at a time, returning error on first failure.
         // Matches Go: for _, shardId := range req.ShardIds { err = vs.store.MountEcShards(...) }
         let mut store = self.state.store.write().unwrap();
-        for &shard_id in &req.shard_ids {
+        for &shard_id in &validated {
             store
                 .mount_ec_shard(vid, &req.collection, shard_id, &req.source_disk_type)
                 .map_err(|e| {
                     Status::internal(format!("mount {}.{}: {}", req.volume_id, shard_id, e))
                 })?;
         }
+        // A delivery can bring the checksum manifest alongside the shards, but
+        // the receive path only writes the file. When this server already had
+        // the volume mounted, the EcVolume in memory keeps whatever protection
+        // state it resolved at mount — off, for a volume whose sidecar arrives
+        // now — until a remount. Re-resolve it here, where the shards it
+        // describes have just been added.
+        //
+        // Every per-disk runtime, not just the first: a vid mounts as one
+        // EcVolume per disk, the delivery lands the .ecsum on one of them, and
+        // the first-match lookup would leave the siblings reporting no
+        // protection. Each re-resolves against its own data and index
+        // directories, so a shared -dir.idx reaches all of them.
+        // Resolving across every EC metadata directory is what makes that
+        // reload mean something: startup mirroring gives each shard-bearing
+        // disk its own .ecx/.ecj/.vif but deliberately not the sidecar, so a
+        // runtime restricted to its own two directories would find nothing
+        // however often it reloaded. One delivered copy, reachable from all.
+        let ec_metadata_dirs = store.ec_metadata_dirs();
+        for ec_vol in store.find_all_ec_volumes_mut(vid) {
+            ec_vol.reload_bitrot_sidecar(&ec_metadata_dirs);
+        }
         drop(store);
         self.state.volume_state_notify.notify_one();
 
@@ -2989,13 +3818,24 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeEcShardsUnmountRequest>,
     ) -> Result<Response<volume_server_pb::VolumeEcShardsUnmountResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
+        // Pre-validate the ENTIRE batch before acquiring the write lock or
+        // mutating: validating inside the unmount loop would unmount a prefix
+        // (e.g. shard 0 of [0, 32]) and then fail, leaving a partial mutation.
+        // Reject up front so invalid batches change no state. Auth stays first.
+        // Validate wire shard ids at the boundary (rejects truncation aliases like 256→0).
+        let mut validated: Vec<ShardId> = Vec::with_capacity(req.shard_ids.len());
+        for &sid in &req.shard_ids {
+            validated.push(shard_id_try_from(sid).map_err(Status::invalid_argument)?);
+        }
+
         // Unmount one shard at a time, returning error on first failure.
         // Matches Go: for _, shardId := range req.ShardIds { err = vs.store.UnmountEcShards(...) }
         let mut store = self.state.store.write().unwrap();
-        for &shard_id in &req.shard_ids {
+        for &shard_id in &validated {
             store
                 .unmount_ec_shard(vid, shard_id, req.encode_ts_ns)
                 .map_err(|e| {
@@ -3016,6 +3856,7 @@ impl VolumeServer for VolumeGrpcService {
     ) -> Result<Response<Self::VolumeEcShardReadStream>, Status> {
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
+        let shard_id = shard_id_try_from(req.shard_id).map_err(Status::invalid_argument)?;
 
         let store = self.state.store.read().unwrap();
         // Reconciled EC volumes can have their shards split across
@@ -3024,7 +3865,7 @@ impl VolumeServer for VolumeGrpcService {
         // rather than first-match `find_ec_volume(vid)` which would
         // miss shards that live on a sibling. Mirrors Go's findEcShard.
         let ec_vol = store
-            .find_ec_volume_with_shard(vid, req.shard_id)
+            .find_ec_volume_with_shard(vid, shard_id)
             .ok_or_else(|| {
                 Status::not_found(format!(
                     "ec volume {} shard {} not found",
@@ -3053,15 +3894,14 @@ impl VolumeServer for VolumeGrpcService {
             if let Some((_offset, size)) = ec_vol
                 .find_needle_from_ecx(needle_id)
                 .map_err(|e| Status::internal(e.to_string()))?
+                && size.is_deleted()
             {
-                if size.is_deleted() {
-                    let results = vec![Ok(volume_server_pb::VolumeEcShardReadResponse {
-                        is_deleted: true,
-                        encode_ts_ns: served_encode_ts_ns,
-                        ..Default::default()
-                    })];
-                    return Ok(Response::new(Box::pin(tokio_stream::iter(results))));
-                }
+                let results = vec![Ok(volume_server_pb::VolumeEcShardReadResponse {
+                    is_deleted: true,
+                    encode_ts_ns: served_encode_ts_ns,
+                    ..Default::default()
+                })];
+                return Ok(Response::new(Box::pin(tokio_stream::iter(results))));
             }
         }
 
@@ -3069,7 +3909,7 @@ impl VolumeServer for VolumeGrpcService {
         // find_ec_volume_with_shard already verified it.
         let shard = ec_vol
             .shards
-            .get(req.shard_id as usize)
+            .get(shard_id as usize)
             .and_then(|s| s.as_ref())
             .ok_or_else(|| {
                 Status::not_found(format!(
@@ -3094,9 +3934,14 @@ impl VolumeServer for VolumeGrpcService {
         while bytes_read < total_size {
             let chunk_size = std::cmp::min(BUFFER_SIZE_LIMIT, total_size - bytes_read);
             let mut buf = vec![0u8; chunk_size];
-            let n = shard
-                .read_at(&mut buf, current_offset)
-                .map_err(|e| Status::internal(e.to_string()))?;
+            let n = match shard.read_at(&mut buf, current_offset) {
+                Ok(n) => n,
+                Err(e) => {
+                    ec_vol.check_read_write_error(Some(&e));
+                    return Err(Status::internal(e.to_string()));
+                }
+            };
+            ec_vol.check_read_write_error(None);
             if n == 0 {
                 break;
             }
@@ -3125,18 +3970,38 @@ impl VolumeServer for VolumeGrpcService {
         let vid = VolumeId(req.volume_id);
         let needle_id = NeedleId(req.file_key);
 
-        // Go checks if needle is already deleted (via ecx) before journaling.
-        // Search all locations for the EC volume.
-        let mut store = self.state.store.write().unwrap();
+        // A delete committed between the last journal catch_up and the
+        // compaction swap would be absent from the rebuilt .idx, so the
+        // tail membership must be checked under the store write lock: a
+        // decode can claim the tail while this delete waits for the
+        // decoder's read lock, and a check taken before acquiring it would
+        // be stale by the time the append commits.
+        let mut store = loop {
+            let store = self.state.store.write().unwrap();
+            if !ec_decode_tail_contains(&self.state, vid) {
+                break store;
+            }
+            drop(store);
+            wait_ec_decode_tail(&self.state, vid).await;
+        };
+
+        // Go's handler locates the needle first: absent fails the RPC so the
+        // caller moves to the next holder; an existing tombstone is a no-op.
         if let Some(ec_vol) = store.find_ec_volume_mut(vid) {
-            // Check if already deleted via ecx index
-            if let Ok(Some((_offset, size))) = ec_vol.find_needle_from_ecx(needle_id) {
-                if size.is_deleted() {
-                    // Already deleted, no-op
+            match ec_vol.find_needle_from_ecx(needle_id) {
+                Ok(Some((_, size))) if size.is_deleted() => {
                     return Ok(Response::new(
                         volume_server_pb::VolumeEcBlobDeleteResponse {},
                     ));
                 }
+                Ok(None) => {
+                    return Err(Status::not_found(format!(
+                        "needle {} not in ec volume {}",
+                        needle_id, req.volume_id
+                    )));
+                }
+                Ok(Some(_)) => {}
+                Err(e) => return Err(Status::internal(e.to_string())),
             }
             ec_vol
                 .journal_delete(needle_id)
@@ -3152,6 +4017,7 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeEcShardsToVolumeRequest>,
     ) -> Result<Response<volume_server_pb::VolumeEcShardsToVolumeResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
@@ -3162,6 +4028,24 @@ impl VolumeServer for VolumeGrpcService {
         // marker, then mount. This server holds no EC shards for the vid, so there
         // is no in-place decode to run.
         if req.from_staged {
+            // An in-place decode in flight for this vid is rebuilding the
+            // same .dat/.idx the staged files would overwrite. Claim the
+            // vid for the adoption rather than hold the set lock through
+            // it — the same exclusion for this vid, while unrelated mounts
+            // and decode claims stay unblocked.
+            if !self
+                .state
+                .ec_decodes_in_flight
+                .lock()
+                .unwrap_or_else(|e| e.into_inner())
+                .insert(vid)
+            {
+                return Err(Status::unavailable(format!(
+                    "ec volume {} is already being decoded",
+                    req.volume_id
+                )));
+            }
+            let _claim = EcDecodeClaim(&self.state, vid);
             let want = DiskType::from_string(&req.disk_type);
             let base = {
                 let store = self.state.store.read().unwrap();
@@ -3224,9 +4108,11 @@ impl VolumeServer for VolumeGrpcService {
 
             {
                 let mut store = self.state.store.write().unwrap();
-                store.mount_volume_by_id(vid).map_err(|e| {
-                    Status::internal(format!("mount staged volume {}: {}", req.volume_id, e))
-                })?;
+                store
+                    .mount_volume_by_id(vid, Some(req.collection.as_str()))
+                    .map_err(|e| {
+                        Status::internal(format!("mount staged volume {}: {}", req.volume_id, e))
+                    })?;
             }
             self.state.volume_state_notify.notify_one();
             tracing::info!(
@@ -3239,119 +4125,93 @@ impl VolumeServer for VolumeGrpcService {
             ));
         }
 
-        let store = self.state.store.read().unwrap();
-        // Aggregate per-shard data dirs across all locations so the
-        // shard-presence check + decoder both see the union for
-        // cross-disk reconciled volumes (#9252). Mirrors Go's
-        // CollectEcShards.
-        let max_shard_count = crate::storage::erasure_coding::ec_shard::MAX_SHARD_COUNT;
-        let (ec_vol, shard_dirs) = store
-            .collect_ec_shard_dirs(vid, max_shard_count)
-            .ok_or_else(|| Status::not_found(format!("ec volume {} not found", req.volume_id)))?;
+        let job = {
+            let store = self.state.store.read().unwrap();
+            // Aggregate per-shard data dirs across all locations so the
+            // shard-presence check + decoder both see the union for
+            // cross-disk reconciled volumes (#9252). Mirrors Go's
+            // CollectEcShards.
+            let max_shard_count = crate::storage::erasure_coding::ec_shard::MAX_SHARD_COUNT;
+            let (ec_vol, shard_dirs) = store
+                .collect_ec_shard_dirs(vid, max_shard_count)
+                .ok_or_else(|| {
+                    Status::not_found(format!("ec volume {} not found", req.volume_id))
+                })?;
 
-        if ec_vol.collection != req.collection {
-            return Err(Status::internal(format!(
-                "existing collection:{} unexpected input: {}",
-                ec_vol.collection, req.collection
-            )));
-        }
-
-        // Use EC context data shard count from the volume
-        let data_shards = ec_vol.data_shards as usize;
-
-        // Validate data shard count range (matches Go's VolumeEcShardsToVolume)
-        if data_shards == 0 || data_shards > max_shard_count {
-            return Err(Status::invalid_argument(format!(
-                "invalid data shard count {} for volume {} (must be 1..{})",
-                data_shards, req.volume_id, max_shard_count
-            )));
-        }
-
-        // Check that all data shards are present somewhere on this server.
-        for shard_id in 0..data_shards {
-            if shard_dirs[shard_id].is_none() {
+            if ec_vol.collection != req.collection {
                 return Err(Status::internal(format!(
-                    "ec volume {} missing shard {}",
-                    req.volume_id, shard_id
+                    "existing collection:{} unexpected input: {}",
+                    ec_vol.collection, req.collection
                 )));
             }
-        }
 
-        // Read the .ecx index to check for live entries
-        let ecx_path = ec_vol.ecx_file_name();
-        let ecx_data =
-            std::fs::read(&ecx_path).map_err(|e| Status::internal(format!("read ecx: {}", e)))?;
-        let entry_count = ecx_data.len() / NEEDLE_MAP_ENTRY_SIZE;
+            // Use EC context data shard count from the volume
+            let data_shards = ec_vol.data_shards as usize;
 
-        let mut has_live = false;
-        for i in 0..entry_count {
-            let start = i * NEEDLE_MAP_ENTRY_SIZE;
-            let (_, _, size) =
-                idx_entry_from_bytes(&ecx_data[start..start + NEEDLE_MAP_ENTRY_SIZE]);
-            if !size.is_deleted() {
-                has_live = true;
-                break;
+            // Validate data shard count range (matches Go's VolumeEcShardsToVolume)
+            if data_shards == 0 || data_shards > max_shard_count {
+                return Err(Status::invalid_argument(format!(
+                    "invalid data shard count {} for volume {} (must be 1..{})",
+                    data_shards, req.volume_id, max_shard_count
+                )));
             }
-        }
 
-        if !has_live {
-            return Err(Status::failed_precondition(format!(
-                "ec volume {} has no live entries",
+            // Check that all data shards are present somewhere on this server.
+            for (shard_id, dir) in shard_dirs[..data_shards].iter().enumerate() {
+                if dir.is_none() {
+                    return Err(Status::internal(format!(
+                        "ec volume {} missing shard {}",
+                        req.volume_id, shard_id
+                    )));
+                }
+            }
+
+            // Reconstruct the volume from EC shards. Use the EcVolume's
+            // own dir for the produced .dat (matches the volume's home
+            // disk) and its `ecx_actual_dir` for the .ecx lookup, while
+            // reading each shard from its real on-disk location.
+            // shard_dirs[i] is guaranteed Some for i in 0..data_shards by
+            // the check above; collect concrete dirs for the decoder.
+            EcDecodeJob {
+                vid,
+                dat_dir: ec_vol.dir.clone(),
+                ecx_dir: ec_vol.ecx_actual_dir().to_string(),
+                idx_dir: ec_vol.dir_idx.clone(),
+                collection: ec_vol.collection.clone(),
+                vif_dat_file_size: ec_vol.dat_file_size,
+                large_block_size: ec_vol.large_block_size() as usize,
+                small_block_size: ec_vol.small_block_size() as usize,
+                shard_dirs: shard_dirs[..data_shards]
+                    .iter()
+                    .map(|d| d.clone().unwrap())
+                    .collect(),
+                needle_map_kind: store.needle_map_kind,
+            }
+        };
+
+        // A dropped request leaves the blocking job running; keep the vid
+        // claimed until it finishes so a retry cannot race the in-flight
+        // decode on the same volume files.
+        if !self
+            .state
+            .ec_decodes_in_flight
+            .lock()
+            .unwrap()
+            .insert(vid)
+        {
+            return Err(Status::unavailable(format!(
+                "ec volume {} is already being decoded",
                 req.volume_id
             )));
         }
 
-        // Reconstruct the volume from EC shards. Use the EcVolume's
-        // own dir for the produced .dat (matches the volume's home
-        // disk) and its `ecx_actual_dir` for the .ecx lookup, while
-        // reading each shard from its real on-disk location.
-        let dat_dir = ec_vol.dir.clone();
-        let ecx_dir = ec_vol.ecx_actual_dir().to_string();
-        let collection = ec_vol.collection.clone();
-        let vif_dat_file_size = ec_vol.dat_file_size;
-        // shard_dirs[i] is guaranteed Some for i in 0..data_shards by
-        // the check above; collect concrete dirs for the decoder.
-        let per_shard_dirs: Vec<String> = shard_dirs[..data_shards]
-            .iter()
-            .map(|d| d.clone().unwrap())
-            .collect();
-        drop(store);
-
-        // Calculate .dat file size from .ecx entries (.ec00 lives on
-        // its own disk, .ecx on the index disk).
-        let dat_file_size =
-            crate::storage::erasure_coding::ec_decoder::find_dat_file_size_with_dirs(
-                &per_shard_dirs[0],
-                &ecx_dir,
-                &collection,
-                vid,
-            )
-            .map_err(|e| Status::internal(format!("FindDatFileSize: {}", e)))?;
-
-        // The shard block layout was fixed by the .dat size at encode time
-        // (recorded in .vif); deletions can shrink the live extent below a
-        // large-block row boundary, so the layout must not be derived from
-        // dat_file_size. The decoder infers the layout from the shard size
-        // when .vif does not record it.
-        // Write .dat file using block-interleaved reading from shards.
-        crate::storage::erasure_coding::ec_decoder::write_dat_file_from_shards_with_dirs(
-            &dat_dir,
-            &collection,
-            vid,
-            dat_file_size,
-            vif_dat_file_size,
-            data_shards,
-            &per_shard_dirs,
-        )
-        .map_err(|e| Status::internal(format!("WriteDatFile: {}", e)))?;
-
-        // Write .idx file from .ecx and .ecj files (lives on idx dir).
-        crate::storage::erasure_coding::ec_decoder::write_idx_file_from_ec_index(
-            &dat_dir,
-            &collection,
-            vid,
-        )
-        .map_err(|e| Status::internal(format!("WriteIdxFileFromEcIndex: {}", e)))?;
+        let state = self.state.clone();
+        tokio::task::spawn_blocking(move || {
+            let _claim = EcDecodeClaim(&state, vid);
+            job.run(&state)
+        })
+        .await
+        .map_err(|e| Status::internal(format!("decode ec volume {}: {}", vid, e)))??;
 
         // Go does NOT unmount EC shards or mount the volume here.
         // The caller (ec.balance / ec.decode) handles mount/unmount separately.
@@ -3400,12 +4260,24 @@ impl VolumeServer for VolumeGrpcService {
             .walk_ecx_stats()
             .map_err(|e| Status::internal(e.to_string()))?;
 
+        // The layout this holder serves reads through, as Go reports it: a
+        // coordinator cannot otherwise tell a holder that understands the
+        // uniform block layout from one that dropped the unknown .vif field
+        // and mounted the volume as legacy.
+        let ec_shard_config = Some(volume_server_pb::EcShardConfig {
+            data_shards: ec_vol.data_shards,
+            parity_shards: ec_vol.parity_shards,
+            encode_ts_ns: 0,
+            block_size: ec_vol.block_size,
+        });
+
         Ok(Response::new(
             volume_server_pb::VolumeEcShardsInfoResponse {
                 ec_shard_infos: shard_infos,
                 volume_size,
                 file_count,
                 file_deleted_count,
+                ec_shard_config,
             },
         ))
     }
@@ -3418,12 +4290,13 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeTierMoveDatToRemoteRequest>,
     ) -> Result<Response<Self::VolumeTierMoveDatToRemoteStream>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
 
         // Validate volume exists and collection matches
-        let dat_path = {
+        let (dat_path, instance, compaction_revision) = {
             let store = self.state.store.read().unwrap();
             let (_, vol) = store
                 .find_volume(vid)
@@ -3440,7 +4313,7 @@ impl VolumeServer for VolumeGrpcService {
 
             // Match Go's DiskFile check: if the .dat file is still local, we can
             // keep tiering it even when remote file entries already exist.
-            if volume_is_remote_only(&dat_path, vol.has_remote_file) {
+            if volume_is_remote_only(&dat_path, vol.has_remote_file()) {
                 // Already on remote -- return empty stream (matches Go: returns nil)
                 let stream = tokio_stream::empty();
                 return Ok(Response::new(
@@ -3448,12 +4321,19 @@ impl VolumeServer for VolumeGrpcService {
                 ));
             }
 
+            if vol.is_compacting() {
+                return Err(Status::failed_precondition(format!(
+                    "volume {} is compacting",
+                    vid
+                )));
+            }
+
             // Check if the destination backend already exists in volume info
             let (backend_type, backend_id) =
                 crate::remote_storage::s3_tier::backend_name_to_type_id(
                     &req.destination_backend_name,
                 );
-            for rf in &vol.volume_info.files {
+            for rf in &vol.volume_info().files {
                 if rf.backend_type == backend_type && rf.backend_id == backend_id {
                     return Err(Status::already_exists(format!(
                         "destination {} already exists",
@@ -3462,7 +4342,11 @@ impl VolumeServer for VolumeGrpcService {
                 }
             }
 
-            dat_path
+            (
+                dat_path,
+                vol.instance(),
+                vol.super_block().compaction_revision,
+            )
         };
 
         // Store the source .dat mtime, not the upload time, so a reload computes
@@ -3476,7 +4360,9 @@ impl VolumeServer for VolumeGrpcService {
 
         // Look up the S3 tier backend
         let backend = {
-            let registry = self.state.s3_tier_registry.read().unwrap();
+            let registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
+                .read()
+                .unwrap();
             registry.get(&req.destination_backend_name).ok_or_else(|| {
                 let keys = registry.names();
                 Status::not_found(format!(
@@ -3498,44 +4384,104 @@ impl VolumeServer for VolumeGrpcService {
 
         tokio::spawn(async move {
             let result: Result<(), Status> = async {
+                // Nothing below is worth doing for a caller that has already
+                // gone: the upload would spend bandwidth and S3 storage on a
+                // transition nobody is waiting to hear the result of.
+                if tx.is_closed() {
+                    return Err(Status::cancelled(format!(
+                        "volume {} tier move to remote cancelled by caller",
+                        vid
+                    )));
+                }
+
                 // Upload the .dat file to S3 with progress
                 let tx_progress = tx.clone();
                 let mut last_report = std::time::Instant::now();
                 let (key, size) = backend
                     .upload_file(&dat_path, move |processed, percentage| {
+                        // Checked on every part, not only where progress is
+                        // reported: the report is rate-limited to one a second,
+                        // so its result alone would miss a caller that left in
+                        // between. Go aborts here too -- the progress callback
+                        // returns stream.Send's error (s3_upload.go).
+                        if tx_progress.is_closed() {
+                            return Err(format!(
+                                "volume {} tier move to remote cancelled by caller",
+                                vid
+                            ));
+                        }
                         let now = std::time::Instant::now();
                         if now.duration_since(last_report) >= std::time::Duration::from_secs(1) {
                             last_report = now;
-                            let _ = tx_progress.try_send(Ok(
-                                volume_server_pb::VolumeTierMoveDatToRemoteResponse {
-                                    processed,
-                                    processed_percentage: percentage,
-                                },
-                            ));
+                            if let Err(tokio::sync::mpsc::error::TrySendError::Closed(_)) =
+                                tx_progress.try_send(Ok(
+                                    volume_server_pb::VolumeTierMoveDatToRemoteResponse {
+                                        processed,
+                                        processed_percentage: percentage,
+                                    },
+                                ))
+                            {
+                                return Err(format!(
+                                    "volume {} tier move to remote cancelled by caller",
+                                    vid
+                                ));
+                            }
+                            // A merely full channel is a slow reader, not a
+                            // departed one; drop the report and keep going.
                         }
+                        Ok(())
                     })
                     .await
                     .map_err(|e| {
-                        Status::internal(format!(
-                            "backend {} copy file {}: {}",
-                            dest_backend_name, dat_path, e
-                        ))
+                        crate::server::status_with_context(
+                            &format!("backend {} copy file {}", dest_backend_name, dat_path),
+                            e.into(),
+                        )
                     })?;
 
-                // Update volume info with remote file reference
-                {
-                    let mut store = state.store.write().unwrap();
-                    if let Some((_, vol)) = store.find_volume_mut(vid) {
-                        vol.volume_info.files.push(volume_server_pb::RemoteFile {
-                            backend_type: backend_type.clone(),
-                            backend_id: backend_id.clone(),
-                            key,
-                            offset: 0,
-                            file_size: size,
-                            modified_time: dat_modified_secs,
-                            extension: ".dat".to_string(),
-                        });
-                        vol.refresh_remote_write_mode();
+                // Deliberately no cancellation check here. Once the object is
+                // in S3 the cheap bookkeeping that follows is what makes the
+                // state consistent; stopping now would leave the object paid
+                // for and referenced by nothing. Go does not gate here either:
+                // its progress callback only runs during the transfer.
+                // Update volume info with remote file reference, unless the
+                // volume was compacted, replaced or removed mid-upload: the
+                // object would not match what now holds this id.
+                let abort = {
+                    let store = state.store.read().unwrap();
+                    let abort = match store.find_volume(vid) {
+                        None => Some(Status::not_found(format!("volume {} not found", vid))),
+                        Some((_, v))
+                            if !v.is_instance(&instance)
+                                || v.super_block().compaction_revision != compaction_revision =>
+                        {
+                            Some(Status::failed_precondition(format!(
+                                "volume {} was compacted or replaced during tier move to remote",
+                                vid
+                            )))
+                        }
+                        Some(_) => None,
+                    };
+                    if abort.is_none()
+                        && let Some((_, vol)) = store.find_volume(vid)
+                    {
+                        vol.update_remote_files(|files| {
+                            files.push(volume_server_pb::RemoteFile {
+                                backend_type: backend_type.clone(),
+                                backend_id: backend_id.clone(),
+                                key: key.clone(),
+                                offset: 0,
+                                file_size: size,
+                                modified_time: dat_modified_secs,
+                                extension: ".dat".to_string(),
+                            })
+                        })
+                        .map_err(|e| {
+                            Status::internal(format!(
+                                "volume {} failed to refresh write mode: {}",
+                                vid, e
+                            ))
+                        })?;
 
                         if let Err(e) = vol.save_volume_info() {
                             return Err(Status::internal(format!(
@@ -3560,6 +4506,18 @@ impl VolumeServer for VolumeGrpcService {
                             let _ = std::fs::remove_file(&dat);
                         }
                     }
+                    abort
+                };
+                if let Some(status) = abort {
+                    if let Err(e) = backend.delete_file(&key).await {
+                        tracing::warn!(
+                            "volume {} could not delete stale tier object {}: {}",
+                            vid,
+                            key,
+                            e
+                        );
+                    }
+                    return Err(status);
                 }
 
                 // Go does NOT send a final 100% progress message after upload completion
@@ -3568,6 +4526,13 @@ impl VolumeServer for VolumeGrpcService {
             .await;
 
             if let Err(e) = result {
+                // The error otherwise goes to a channel nobody is
+                // reading, leaving an abandoned tier move with no trace.
+                if e.code() == tonic::Code::Cancelled {
+                    tracing::info!("volume {} tier move to remote abandoned by its caller", vid);
+                } else {
+                    tracing::warn!("volume {} tier move to remote failed: {}", vid, e);
+                }
                 let _ = tx.send(Err(e)).await;
             }
         });
@@ -3584,6 +4549,7 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeTierMoveDatFromRemoteRequest>,
     ) -> Result<Response<Self::VolumeTierMoveDatFromRemoteStream>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         // Note: Go does NOT check maintenance mode for TierMoveDatFromRemote
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
@@ -3620,7 +4586,7 @@ impl VolumeServer for VolumeGrpcService {
             }
 
             let remote_modified_secs = vol
-                .volume_info
+                .volume_info()
                 .files
                 .first()
                 .map(|f| f.modified_time)
@@ -3631,7 +4597,9 @@ impl VolumeServer for VolumeGrpcService {
 
         // Look up the S3 tier backend
         let backend = {
-            let registry = self.state.s3_tier_registry.read().unwrap();
+            let registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
+                .read()
+                .unwrap();
             registry.get(&storage_name).ok_or_else(|| {
                 let keys = registry.names();
                 Status::not_found(format!(
@@ -3649,42 +4617,101 @@ impl VolumeServer for VolumeGrpcService {
 
         tokio::spawn(async move {
             let result: Result<(), Status> = async {
+                // Nothing below is worth doing for a caller that has already
+                // gone, and the download would overwrite a .dat path the volume
+                // still reports as absent.
+                if tx.is_closed() {
+                    return Err(Status::cancelled(format!(
+                        "volume {} tier move from remote cancelled by caller",
+                        vid
+                    )));
+                }
+
                 // Download the .dat file from S3 with progress
                 let tx_progress = tx.clone();
                 let mut last_report = std::time::Instant::now();
                 let storage_name_clone = storage_name.clone();
                 let _size = backend
                     .download_file(&dat_path, &storage_key, move |processed, percentage| {
+                        // Checked on every part, not only where progress is
+                        // reported: the report is rate-limited to one a second,
+                        // so its result alone would miss a caller that left in
+                        // between. Go aborts here too -- the progress callback
+                        // returns stream.Send's error (s3_download.go).
+                        if tx_progress.is_closed() {
+                            return Err(format!(
+                                "volume {} tier move from remote cancelled by caller",
+                                vid
+                            ));
+                        }
                         let now = std::time::Instant::now();
                         if now.duration_since(last_report) >= std::time::Duration::from_secs(1) {
                             last_report = now;
-                            let _ = tx_progress.try_send(Ok(
-                                volume_server_pb::VolumeTierMoveDatFromRemoteResponse {
-                                    processed,
-                                    processed_percentage: percentage,
-                                },
-                            ));
+                            if let Err(tokio::sync::mpsc::error::TrySendError::Closed(_)) =
+                                tx_progress.try_send(Ok(
+                                    volume_server_pb::VolumeTierMoveDatFromRemoteResponse {
+                                        processed,
+                                        processed_percentage: percentage,
+                                    },
+                                ))
+                            {
+                                return Err(format!(
+                                    "volume {} tier move from remote cancelled by caller",
+                                    vid
+                                ));
+                            }
+                            // A merely full channel is a slow reader, not a
+                            // departed one; drop the report and keep going.
                         }
+                        Ok(())
                     })
                     .await
                     .map_err(|e| {
-                        Status::internal(format!(
-                            "backend {} copy file {}: {}",
-                            storage_name_clone, dat_path, e
-                        ))
+                        // download_file pre-allocates the destination to the
+                        // object's full size, so an aborted download leaves a
+                        // .dat that is the right length and the wrong content.
+                        // It has to go: this handler refuses to run at all when
+                        // a local .dat exists, so leaving one wedges every
+                        // retry on "already on local disk", and a restart would
+                        // load the sparse file as the volume's data.
+                        if let Err(rm) = std::fs::remove_file(&dat_path)
+                            && rm.kind() != std::io::ErrorKind::NotFound
+                        {
+                            tracing::warn!(
+                                "volume {} could not remove the incomplete download {}: {}",
+                                vid,
+                                dat_path,
+                                rm
+                            );
+                        }
+                        crate::server::status_with_context(
+                            &format!("backend {} copy file {}", storage_name_clone, dat_path),
+                            e.into(),
+                        )
                     })?;
 
                 // Restore the .dat mtime so a reload computes TTL from real data age,
                 // not download time (matches Go VolumeTierMoveDatFromRemote).
                 if remote_modified_secs > 0 {
-                    let modified_ts_ns = (remote_modified_secs as i64).saturating_mul(1_000_000_000);
+                    let modified_ts_ns =
+                        (remote_modified_secs as i64).saturating_mul(1_000_000_000);
                     if let Err(e) = set_file_mtime(&dat_path, modified_ts_ns) {
-                        tracing::warn!("volume {} restore data file {} modified time: {}", vid, dat_path, e);
+                        tracing::warn!(
+                            "volume {} restore data file {} modified time: {}",
+                            vid,
+                            dat_path,
+                            e
+                        );
                     } else if let Ok(dat_file) = tokio::fs::File::open(&dat_path).await {
                         // Persist the restored mtime past the download's content fsync;
                         // best-effort, only TTL accuracy depends on it surviving a crash.
                         if let Err(e) = dat_file.sync_all().await {
-                            tracing::warn!("volume {} fsync data file {} after mtime restore: {}", vid, dat_path, e);
+                            tracing::warn!(
+                                "volume {} fsync data file {} after mtime restore: {}",
+                                vid,
+                                dat_path,
+                                e
+                            );
                         }
                     }
                 }
@@ -3700,14 +4727,20 @@ impl VolumeServer for VolumeGrpcService {
 
                 // Trim the remote reference, persist the .vif, and swap to the local
                 // .dat on BOTH paths BEFORE deleting the remote object. After this the
-                // volume serves from local disk (has_remote_file = false), so a crash
+                // volume serves from local disk (has_remote_file() is false), so a crash
                 // before the delete only leaks the remote object; the .vif must never
                 // reference an object that has already been deleted.
                 {
-                    let mut store = state.store.write().unwrap();
-                    let (_, vol) = store.find_volume_mut(vid).ok_or_else(|| {
-                        Status::not_found(format!("volume {} disappeared during tier-down", vid))
-                    })?;
+                    let vol = {
+                        let store = state.store.read().unwrap();
+                        let (_, vol) = store.find_volume(vid).ok_or_else(|| {
+                            Status::not_found(format!(
+                                "volume {} disappeared during tier-down",
+                                vid
+                            ))
+                        })?;
+                        vol
+                    };
 
                     // The volume could have been deleted/recreated or re-tiered while the
                     // download ran. Abort rather than trim the .vif or delete a remote
@@ -3720,10 +4753,62 @@ impl VolumeServer for VolumeGrpcService {
                         )));
                     }
 
-                    if !vol.volume_info.files.is_empty() {
-                        vol.volume_info.files.remove(0);
+                    // One write lease across the reference trim, .vif save and
+                    // backend swap: between clearing the remote-only write
+                    // restriction and attaching the local .dat a write would
+                    // pass check_writable and then fail on a missing dat_file.
+                    let _sync_guard = vol.data_file_sync_lock().lock().unwrap();
+                    let _lease = vol.instance().write_lock();
+
+                    // The store guard dropped before the lease was taken, so an
+                    // unmount could have detached this handle in the gap. A
+                    // closed handle still passes the remote-reference check,
+                    // and proceeding would delete an object its remounted
+                    // replacement still reads.
+                    if vol.is_closed() {
+                        return Err(Status::not_found(format!(
+                            "volume {} was unmounted during tier-down",
+                            vid
+                        )));
+                    }
+
+                    // Snapshot the remote reference before dropping it: the
+                    // refresh it triggers can fail, and a half-applied transition
+                    // leaves the volume claiming local while the remote backend
+                    // is still attached and the on-disk .vif still says remote
+                    // — a state a retry reads as "already on local disk" and
+                    // refuses to finish.
+                    //
+                    // update_remote_files also swaps the read-only sorted map
+                    // out before the volume is published as writable; without
+                    // it the first write would append to the local .dat and
+                    // then fail to index.
+                    let mut removed_remote = None;
+                    if let Err(e) = vol.update_remote_files_held(|files| {
+                        if !files.is_empty() {
+                            removed_remote = Some(files.remove(0));
+                        }
+                    }) {
+                        // Put the reference, the derived flags and the needle
+                        // map back where they belong. Best effort: if even this
+                        // fails the volume stays pinned read-only, which is the
+                        // safe end of the transition.
+                        if let Err(restore_err) = vol.update_remote_files_held(|files| {
+                            if let Some(remote) = removed_remote {
+                                files.insert(0, remote);
+                            }
+                        }) {
+                            tracing::warn!(
+                                volume_id = vid.0,
+                                error = %restore_err,
+                                "tier-down rollback could not restore the remote write mode",
+                            );
+                        }
+                        return Err(Status::internal(format!(
+                            "volume {} failed to refresh write mode: {}",
+                            vid, e
+                        )));
                     }
-                    vol.refresh_remote_write_mode();
 
                     if let Err(e) = vol.save_volume_info() {
                         return Err(Status::internal(format!(
@@ -3732,7 +4817,7 @@ impl VolumeServer for VolumeGrpcService {
                         )));
                     }
 
-                    if let Err(e) = vol.open_local_dat_backend() {
+                    if let Err(e) = vol.open_local_dat_backend_held() {
                         return Err(Status::internal(format!(
                             "volume {} failed to open local dat file {}: {}",
                             vid, dat_path, e
@@ -3756,10 +4841,13 @@ impl VolumeServer for VolumeGrpcService {
 
                 // Only the last replica to download deletes the shared remote object.
                 backend.delete_file(&storage_key).await.map_err(|e| {
-                    Status::internal(format!(
-                        "volume {} failed to delete remote file {}: {}",
-                        vid, storage_key, e
-                    ))
+                    crate::server::status_with_context(
+                        &format!(
+                            "volume {} failed to delete remote file {}",
+                            vid, storage_key
+                        ),
+                        e.into(),
+                    )
                 })?;
 
                 // Go does NOT send a final 100% progress message after download completion
@@ -3768,6 +4856,16 @@ impl VolumeServer for VolumeGrpcService {
             .await;
 
             if let Err(e) = result {
+                // The error otherwise goes to a channel nobody is
+                // reading, leaving an abandoned tier move with no trace.
+                if e.code() == tonic::Code::Cancelled {
+                    tracing::info!(
+                        "volume {} tier move from remote abandoned by its caller",
+                        vid
+                    );
+                } else {
+                    tracing::warn!("volume {} tier move from remote failed: {}", vid, e);
+                }
                 let _ = tx.send(Err(e)).await;
             }
         });
@@ -3844,6 +4942,7 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::FetchAndWriteNeedleRequest>,
     ) -> Result<Response<volume_server_pb::FetchAndWriteNeedleResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         self.state.check_maintenance()?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
@@ -3869,16 +4968,13 @@ impl VolumeServer for VolumeGrpcService {
         // provider default (e.g. real AWS S3) and cannot target an internal
         // host, so skip it. Extends the Go volume server's validateRemoteEndpoint
         // gate, which only covered type "s3".
-        if !self.state.allow_untrusted_remote_endpoints {
-            if let Some(endpoint) = crate::remote_storage::s3_compatible_endpoint(remote_conf) {
-                if !endpoint.trim().is_empty() {
-                    crate::remote_storage::validate_remote_endpoint(endpoint)
-                        .await
-                        .map_err(|e| {
-                            Status::invalid_argument(format!("reject remote endpoint: {}", e))
-                        })?;
-                }
-            }
+        if !self.state.allow_untrusted_remote_endpoints
+            && let Some(endpoint) = crate::remote_storage::s3_compatible_endpoint(remote_conf)
+            && !endpoint.trim().is_empty()
+        {
+            crate::remote_storage::validate_remote_endpoint(endpoint)
+                .await
+                .map_err(|e| Status::invalid_argument(format!("reject remote endpoint: {}", e)))?;
         }
 
         // Create remote storage client
@@ -3919,6 +5015,21 @@ impl VolumeServer for VolumeGrpcService {
             .as_secs();
         n.set_has_last_modified_date();
 
+        // Validate every replica target before writing anything, so a malformed
+        // or internal target fails the request instead of leaving a local write
+        // behind. Mirrors the Go volume server. NOTE: like the Rust S3 endpoint
+        // guard, this validates the up-front DNS answer but does not yet re-check
+        // at connect time, so a rebinding hostname remains a follow-up.
+        if !self.state.allow_untrusted_remote_endpoints {
+            for replica in &req.replicas {
+                crate::remote_storage::validate_replica_target(&replica.url)
+                    .await
+                    .map_err(|e| {
+                        Status::invalid_argument(format!("reject replica target: {}", e))
+                    })?;
+            }
+        }
+
         // Run local write and replica writes concurrently (matches Go's WaitGroup)
         let mut handles: Vec<tokio::task::JoinHandle<Result<(), String>>> = Vec::new();
 
@@ -3928,9 +5039,11 @@ impl VolumeServer for VolumeGrpcService {
         let needle_id = req.needle_id;
         let size = req.size;
         let local_handle = tokio::task::spawn_blocking(move || {
-            let mut store = state_clone.store.write().unwrap();
-            store
-                .write_volume_needle(vid, &mut n_clone)
+            let vol = {
+                let store = state_clone.store.read().unwrap();
+                store.writable_volume(vid)
+            };
+            vol.and_then(|vol| vol.write_needle(&mut n_clone, true, false))
                 .map(|_| ())
                 .map_err(|e| format!("local write needle {} size {}: {}", needle_id, size, e))
         });
@@ -4005,299 +5118,74 @@ impl VolumeServer for VolumeGrpcService {
         // Validate mode
         let mode = req.mode;
         match mode {
-            1 | 2 | 3 => {} // INDEX=1, FULL=2, LOCAL=3
+            1 | 2 | 3 | 5 => {} // INDEX=1, FULL=2, LOCAL=3, READS=5 (FULL for regular volumes)
             _ => {
                 return Err(Status::invalid_argument(format!(
                     "unsupported volume scrub mode {}",
                     mode
-                )))
+                )));
             }
         }
 
-        let mut total_volumes: u64 = 0;
-        let mut total_files: u64 = 0;
-        let mut broken_volume_ids: Vec<u32> = Vec::new();
-        let mut details: Vec<String> = Vec::new();
-        let mut broken_vids: Vec<VolumeId> = Vec::new();
+        let explicit = !req.volume_ids.is_empty();
+        let vids: Vec<VolumeId> = if explicit {
+            req.volume_ids.iter().map(|&id| VolumeId(id)).collect()
+        } else {
+            self.state.store.read().unwrap().all_volume_ids()
+        };
 
-        // Scrub phase: hold store read lock, then drop before async readonly calls.
-        {
-            let store = self.state.store.read().unwrap();
-            let vids: Vec<VolumeId> = if req.volume_ids.is_empty() {
-                store.all_volume_ids()
-            } else {
-                req.volume_ids.iter().map(|&id| VolumeId(id)).collect()
-            };
-
-            for vid in &vids {
-                let (_, v) = store
-                    .find_volume(*vid)
-                    .ok_or_else(|| Status::not_found(format!("volume id {} not found", vid.0)))?;
-                total_volumes += 1;
-
-                // INDEX mode (1) calls scrub_index; FULL (2) and LOCAL (3) call scrub
-                let scrub_result = if mode == 1 {
-                    v.scrub_index()
-                } else {
-                    v.scrub()
-                };
-                match scrub_result {
-                    Ok((files, broken)) => {
-                        total_files += files;
-                        if !broken.is_empty() {
-                            broken_vids.push(*vid);
-                            broken_volume_ids.push(vid.0);
-                            for msg in broken {
-                                details.push(format!("vol {}: {}", vid.0, msg));
-                            }
-                        }
-                    }
-                    Err(e) => {
-                        total_files += v.file_count().max(0) as u64;
-                        broken_vids.push(*vid);
-                        broken_volume_ids.push(vid.0);
-                        details.push(format!("vol {}: scrub error: {}", vid.0, e));
-                    }
-                }
-            }
-        } // store lock dropped here
-
-        // Match Go: if mark_broken_volumes_readonly, call makeVolumeReadonly on each broken volume.
-        // Collect errors via errors.Join semantics (return joined error if any fail).
-        let mut errs: Vec<String> = Vec::new();
-        if req.mark_broken_volumes_readonly {
-            for vid in &broken_vids {
-                match self.make_volume_readonly(*vid, true).await {
-                    Ok(()) => {
-                        details.push(format!("volume {} is now read-only", vid.0));
-                    }
-                    Err(e) => {
-                        errs.push(e.message().to_string());
-                        details.push(e.message().to_string());
-                    }
-                }
-            }
-        }
-
-        // Record metrics before the post-scrub error check so scrub failures are
-        // persisted even when a follow-up admin action (mark-readonly) fails.
-        emit_scrub_metrics(mode, broken_vids.len(), None);
-
-        if !errs.is_empty() {
-            return Err(Status::internal(errs.join("\n")));
-        }
-
-        Ok(Response::new(volume_server_pb::ScrubVolumeResponse {
-            total_volumes,
-            total_files,
-            broken_volume_ids,
-            details,
-        }))
+        self.scrub_volumes(&req, vids, explicit).await
     }
 
     async fn scrub_ec_volume(
         &self,
         request: Request<volume_server_pb::ScrubEcVolumeRequest>,
     ) -> Result<Response<volume_server_pb::ScrubEcVolumeResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         let req = request.into_inner();
 
         // Validate mode
         let mode = req.mode;
         match mode {
-            1 | 2 | 3 | 4 => {} // INDEX=1, FULL=2, LOCAL=3, CHECKSUM=4
+            1..=5 => {} // INDEX=1, FULL=2, LOCAL=3, CHECKSUM=4, READS=5
             _ => {
                 return Err(Status::invalid_argument(format!(
                     "unsupported EC volume scrub mode {}",
                     mode
-                )))
+                )));
             }
         }
 
+        // Only the modes that walk needles can be strict about deleted ones.
+        let force_deleted_needles_check = req.force_deleted_needles_check;
+        if force_deleted_needles_check && mode != 2 && mode != 5 {
+            return Err(Status::invalid_argument(
+                "deleted needle checks are only supported for FULL and READS scrubs",
+            ));
+        }
+
         // Collect the volume ids under a brief lock, then release it: FULL (mode 2)
         // reads remote shards and must not hold the !Send store guard across .await.
-        let vids: Vec<VolumeId> = {
+        // Collect the volume ids under a brief lock, then release it: FULL (mode 2)
+        // reads remote shards and must not hold the !Send store guard across .await.
+        let explicit = !req.volume_ids.is_empty();
+        let vids: Vec<VolumeId> = if explicit {
+            req.volume_ids.iter().map(|&id| VolumeId(id)).collect()
+        } else {
             let store = self.state.store.read().unwrap();
-            if req.volume_ids.is_empty() {
-                store
-                    .locations
-                    .iter()
-                    .flat_map(|loc| loc.ec_volumes().map(|(vid, _)| *vid))
-                    .collect()
-            } else {
-                req.volume_ids.iter().map(|&id| VolumeId(id)).collect()
-            }
+            // A vid mounted on N disks appears N times here. Left as-is, each
+            // duplicate rescans the same runtime and inflates total_volumes,
+            // while the sibling disks' shards are still never reached.
+            let mut seen = std::collections::HashSet::new();
+            store
+                .locations
+                .iter()
+                .flat_map(|loc| loc.ec_volumes().map(|(vid, _)| *vid))
+                .filter(|vid| seen.insert(*vid))
+                .collect()
         };
 
-        let mut total_volumes: u64 = 0;
-        let mut total_files: u64 = 0;
-        let mut broken_volume_ids: Vec<u32> = Vec::new();
-        let mut broken_shard_infos: Vec<volume_server_pb::EcShardInfo> = Vec::new();
-        let mut details: Vec<String> = Vec::new();
-
-        for vid in vids {
-            match mode {
-                1 => {
-                    // INDEX mode: check ecx index integrity only, no shard verification.
-                    let (count, errs) = {
-                        let store = self.state.store.read().unwrap();
-                        let ecv = store.find_ec_volume(vid).ok_or_else(|| {
-                            Status::not_found(format!("EC volume id {} not found", vid.0))
-                        })?;
-                        ecv.scrub_index()
-                    };
-                    total_volumes += 1;
-                    total_files += count;
-                    if !errs.is_empty() {
-                        broken_volume_ids.push(vid.0);
-                        for msg in errs {
-                            details.push(format!("ecvol {}: {}", vid.0, msg));
-                        }
-                    }
-                }
-                2 => {
-                    // FULL: Go-parity per-needle local+remote walk, PLUS a TEMPORARY
-                    // local Reed-Solomon parity check. The needle walk only reads
-                    // DATA-shard intervals of LIVE needles, so on its own it can't
-                    // catch silent bitrot in a PARITY shard or an unwalked cold
-                    // region. Go closes that gap with a separate CHECKSUM mode over
-                    // .ecsum, which Rust does not have yet; running both here is a
-                    // deliberate divergence from Go FULL to preserve coverage. Drop
-                    // verify_ec_shards from this arm once mode 4 (CHECKSUM) lands.
-                    //
-                    // The RS recompute needs every shard co-located, so only run it
-                    // when this node holds all data+parity shards (single-node EC);
-                    // on a distributed layout it would report every non-local shard
-                    // as missing. Snapshot under a brief lock; release before await.
-                    let (dir, collection, data_shards, parity_shards, all_local) = {
-                        let store = self.state.store.read().unwrap();
-                        let ecv = store.find_ec_volume(vid).ok_or_else(|| {
-                            Status::not_found(format!("EC volume id {} not found", vid.0))
-                        })?;
-                        let total = (ecv.data_shards + ecv.parity_shards) as usize;
-                        let local = ecv.shards.iter().filter(|s| s.is_some()).count();
-                        (
-                            ecv.dir.clone(),
-                            ecv.collection.clone(),
-                            ecv.data_shards as usize,
-                            ecv.parity_shards as usize,
-                            local == total,
-                        )
-                    };
-                    total_volumes += 1;
-
-                    // (1) Per-needle local+remote walk (Go ScrubEcVolume parity).
-                    let (files, mut shard_infos, mut errs) =
-                        crate::server::store_ec::scrub_ec_volume_distributed(&self.state, vid, false)
-                            .await;
-                    total_files += files as u64; // count comes from the needle walk only
-
-                    // (2) Local parity check, gated on all-shards-local. Blocking RS
-                    // verify -> spawn_blocking; inputs are owned, no lock held.
-                    if all_local && !dir.is_empty() {
-                        let collection_pc = collection.clone();
-                        let (parity_broken, parity_details) = tokio::task::spawn_blocking(move || {
-                            crate::storage::erasure_coding::ec_encoder::verify_ec_shards(
-                                &dir,
-                                &collection_pc,
-                                vid,
-                                data_shards,
-                                parity_shards,
-                            )
-                        })
-                        .await
-                        .map_err(|e| Status::internal(format!("verify_ec_shards join: {}", e)))?
-                        .unwrap_or_else(|e| (Vec::new(), vec![format!("verify_ec_shards: {}", e)]));
-
-                        let mut seen: std::collections::HashSet<u32> =
-                            shard_infos.iter().map(|s| s.shard_id).collect();
-                        for sid in parity_broken {
-                            if seen.insert(sid) {
-                                shard_infos.push(volume_server_pb::EcShardInfo {
-                                    shard_id: sid,
-                                    collection: collection.clone(),
-                                    volume_id: vid.0,
-                                    ..Default::default()
-                                });
-                            }
-                        }
-                        shard_infos.sort_by_key(|s| s.shard_id);
-                        errs.extend(parity_details);
-                    }
-
-                    if !errs.is_empty() || !shard_infos.is_empty() {
-                        broken_volume_ids.push(vid.0);
-                        broken_shard_infos.extend(shard_infos);
-                        for msg in errs {
-                            details.push(format!("ecvol {}: {}", vid.0, msg));
-                        }
-                    }
-                }
-                3 => {
-                    // LOCAL: verify each needle against the locally-held shards.
-                    let (files, shard_infos, errs) = {
-                        let store = self.state.store.read().unwrap();
-                        let ecv = store.find_ec_volume(vid).ok_or_else(|| {
-                            Status::not_found(format!("EC volume id {} not found", vid.0))
-                        })?;
-                        ecv.scrub_local()
-                    };
-                    total_volumes += 1;
-                    total_files += files;
-                    if !errs.is_empty() || !shard_infos.is_empty() {
-                        broken_volume_ids.push(vid.0);
-                        broken_shard_infos.extend(shard_infos);
-                        for msg in errs {
-                            details.push(format!("ecvol {}: {}", vid.0, msg));
-                        }
-                    }
-                }
-                4 => {
-                    // CHECKSUM: verify each local shard's raw bytes against the
-                    // bitrot checksum sidecar, exercising cold parity shards.
-                    // Read-only. Mirrors Go's v.ChecksumScrub().
-                    let (blocks_scanned, broken, errs, collection) = {
-                        let store = self.state.store.read().unwrap();
-                        let ecv = store.find_ec_volume(vid).ok_or_else(|| {
-                            Status::not_found(format!("EC volume id {} not found", vid.0))
-                        })?;
-                        let collection = ecv.collection.clone();
-                        let (blocks, broken, errs) = ecv.checksum_scrub();
-                        (blocks, broken, errs, collection)
-                    };
-                    total_volumes += 1;
-                    total_files += blocks_scanned;
-                    if !errs.is_empty() || !broken.is_empty() {
-                        broken_volume_ids.push(vid.0);
-                        for b in broken {
-                            broken_shard_infos.push(volume_server_pb::EcShardInfo {
-                                volume_id: vid.0,
-                                collection: collection.clone(),
-                                shard_id: b,
-                                ..Default::default()
-                            });
-                        }
-                        for msg in errs {
-                            details.push(format!("ecvol {}: {}", vid.0, msg));
-                        }
-                    }
-                }
-                _ => unreachable!(), // validated above
-            }
-        }
-
-        emit_scrub_metrics(
-            mode,
-            broken_volume_ids.len(),
-            Some(broken_shard_infos.len()),
-        );
-
-        Ok(Response::new(volume_server_pb::ScrubEcVolumeResponse {
-            total_volumes,
-            total_files,
-            broken_volume_ids,
-            broken_shard_infos,
-            details,
-        }))
+        self.scrub_ec_volumes(&req, vids, explicit).await
     }
 
     type QueryStream = BoxStream<volume_server_pb::QueriedStripe>;
@@ -4309,7 +5197,7 @@ impl VolumeServer for VolumeGrpcService {
         let mut stripes: Vec<Result<volume_server_pb::QueriedStripe, Status>> = Vec::new();
 
         for fid_str in &req.from_file_ids {
-            let file_id = needle::FileId::parse(fid_str).map_err(|e| Status::internal(e))?;
+            let file_id = needle::FileId::parse(fid_str).map_err(Status::internal)?;
 
             let mut n = Needle {
                 id: file_id.key,
@@ -4318,11 +5206,13 @@ impl VolumeServer for VolumeGrpcService {
             };
             let original_cookie = n.cookie;
 
-            let store = self.state.store.read().unwrap();
-            store
-                .read_volume_needle(file_id.volume_id, &mut n)
+            let vol = {
+                let store = self.state.store.read().unwrap();
+                store.find_volume(file_id.volume_id).map(|(_, v)| v)
+            };
+            vol.ok_or(crate::storage::volume::VolumeError::NotFound)
+                .and_then(|vol| vol.read_needle(&mut n))
                 .map_err(|e| Status::internal(e.to_string()))?;
-            drop(store);
 
             // Cookie mismatch: log and return empty stream (matching Go behavior where err is nil)
             if n.cookie != original_cookie {
@@ -4337,13 +5227,13 @@ impl VolumeServer for VolumeGrpcService {
             let input = req.input_serialization.as_ref();
 
             // CSV input: no output (Go does nothing for CSV)
-            if input.map_or(false, |i| i.csv_input.is_some()) {
+            if input.is_some_and(|i| i.csv_input.is_some()) {
                 // No stripes emitted for CSV
                 continue;
             }
 
             // JSON input: process lines
-            if input.map_or(false, |i| i.json_input.is_some()) {
+            if input.is_some_and(|i| i.json_input.is_some()) {
                 let filter = req.filter.as_ref();
                 let data_str = String::from_utf8_lossy(&n.data);
                 let mut records: Vec<u8> = Vec::new();
@@ -4358,69 +5248,70 @@ impl VolumeServer for VolumeGrpcService {
                     };
 
                     // Apply filter
-                    if let Some(f) = filter {
-                        if !f.field.is_empty() && !f.operand.is_empty() {
-                            let field_val = &parsed[&f.field];
-                            let pass = match f.operand.as_str() {
-                                ">" => {
-                                    if let (Some(fv), Ok(tv)) =
-                                        (field_val.as_f64(), f.value.parse::<f64>())
-                                    {
-                                        fv > tv
-                                    } else {
-                                        false
-                                    }
+                    if let Some(f) = filter
+                        && !f.field.is_empty()
+                        && !f.operand.is_empty()
+                    {
+                        let field_val = &parsed[&f.field];
+                        let pass = match f.operand.as_str() {
+                            ">" => {
+                                if let (Some(fv), Ok(tv)) =
+                                    (field_val.as_f64(), f.value.parse::<f64>())
+                                {
+                                    fv > tv
+                                } else {
+                                    false
                                 }
-                                ">=" => {
-                                    if let (Some(fv), Ok(tv)) =
-                                        (field_val.as_f64(), f.value.parse::<f64>())
-                                    {
-                                        fv >= tv
-                                    } else {
-                                        false
-                                    }
-                                }
-                                "<" => {
-                                    if let (Some(fv), Ok(tv)) =
-                                        (field_val.as_f64(), f.value.parse::<f64>())
-                                    {
-                                        fv < tv
-                                    } else {
-                                        false
-                                    }
-                                }
-                                "<=" => {
-                                    if let (Some(fv), Ok(tv)) =
-                                        (field_val.as_f64(), f.value.parse::<f64>())
-                                    {
-                                        fv <= tv
-                                    } else {
-                                        false
-                                    }
-                                }
-                                "=" => {
-                                    if let (Some(fv), Ok(tv)) =
-                                        (field_val.as_f64(), f.value.parse::<f64>())
-                                    {
-                                        fv == tv
-                                    } else {
-                                        field_val.as_str().map_or(false, |s| s == f.value)
-                                    }
-                                }
-                                "!=" => {
-                                    if let (Some(fv), Ok(tv)) =
-                                        (field_val.as_f64(), f.value.parse::<f64>())
-                                    {
-                                        fv != tv
-                                    } else {
-                                        field_val.as_str().map_or(true, |s| s != f.value)
-                                    }
-                                }
-                                _ => true,
-                            };
-                            if !pass {
-                                continue;
                             }
+                            ">=" => {
+                                if let (Some(fv), Ok(tv)) =
+                                    (field_val.as_f64(), f.value.parse::<f64>())
+                                {
+                                    fv >= tv
+                                } else {
+                                    false
+                                }
+                            }
+                            "<" => {
+                                if let (Some(fv), Ok(tv)) =
+                                    (field_val.as_f64(), f.value.parse::<f64>())
+                                {
+                                    fv < tv
+                                } else {
+                                    false
+                                }
+                            }
+                            "<=" => {
+                                if let (Some(fv), Ok(tv)) =
+                                    (field_val.as_f64(), f.value.parse::<f64>())
+                                {
+                                    fv <= tv
+                                } else {
+                                    false
+                                }
+                            }
+                            "=" => {
+                                if let (Some(fv), Ok(tv)) =
+                                    (field_val.as_f64(), f.value.parse::<f64>())
+                                {
+                                    fv == tv
+                                } else {
+                                    field_val.as_str().is_some_and(|s| s == f.value)
+                                }
+                            }
+                            "!=" => {
+                                if let (Some(fv), Ok(tv)) =
+                                    (field_val.as_f64(), f.value.parse::<f64>())
+                                {
+                                    fv != tv
+                                } else {
+                                    field_val.as_str().is_none_or(|s| s != f.value)
+                                }
+                            }
+                            _ => true,
+                        };
+                        if !pass {
+                            continue;
                         }
                     }
 
@@ -4456,68 +5347,79 @@ impl VolumeServer for VolumeGrpcService {
         &self,
         request: Request<volume_server_pb::VolumeNeedleStatusRequest>,
     ) -> Result<Response<volume_server_pb::VolumeNeedleStatusResponse>, Status> {
+        self.check_grpc_admin_auth(&request)?;
         let req = request.into_inner();
         let vid = VolumeId(req.volume_id);
         let needle_id = NeedleId(req.needle_id);
 
-        let store = self.state.store.read().unwrap();
-
-        // Try normal volume first
-        if let Some(_) = store.find_volume(vid) {
-            let mut n = Needle {
-                id: needle_id,
-                ..Needle::default()
+        {
+            // Try normal volume first
+            let vol = {
+                let store = self.state.store.read().unwrap();
+                store.find_volume(vid).map(|(_, v)| v)
             };
-            match store.read_volume_needle(vid, &mut n) {
-                Ok(_) => {
-                    let ttl_str = n.ttl.as_ref().map_or(String::new(), |t| t.to_string());
-                    return Ok(Response::new(
-                        volume_server_pb::VolumeNeedleStatusResponse {
-                            needle_id: n.id.0,
-                            cookie: n.cookie.0,
-                            size: n.size.0 as u32,
-                            last_modified: n.last_modified,
-                            crc: n.checksum.0,
-                            ttl: ttl_str,
-                        },
-                    ));
-                }
-                Err(_) => return Err(Status::not_found(format!("needle not found {}", needle_id))),
-            }
-        }
-
-        // Fall back to EC shards — read full needle from local shards
-        if let Some(ec_vol) = store.find_ec_volume(vid) {
-            match ec_vol.read_ec_shard_needle(needle_id) {
-                Ok(Some(n)) => {
-                    let ttl_str = match &n.ttl {
-                        Some(t) if n.has_ttl() => t.to_string(),
-                        _ => String::new(),
-                    };
-                    return Ok(Response::new(
-                        volume_server_pb::VolumeNeedleStatusResponse {
-                            needle_id: n.id.0,
-                            cookie: n.cookie.0,
-                            size: n.size.0 as u32,
-                            last_modified: n.last_modified,
-                            crc: n.checksum.0,
-                            ttl: ttl_str,
-                        },
-                    ));
-                }
-                Ok(None) => {
-                    return Err(Status::not_found(format!("needle not found {}", needle_id)));
-                }
-                Err(e) => {
-                    return Err(Status::internal(format!(
-                        "read ec shard needle {} from volume {}: {}",
-                        needle_id, vid, e
-                    )));
+            if let Some(vol) = vol {
+                let mut n = Needle {
+                    id: needle_id,
+                    ..Needle::default()
+                };
+                match vol.read_needle(&mut n) {
+                    Ok(_) => {
+                        let ttl_str = n.ttl.as_ref().map_or(String::new(), |t| t.to_string());
+                        return Ok(Response::new(
+                            volume_server_pb::VolumeNeedleStatusResponse {
+                                needle_id: n.id.0,
+                                cookie: n.cookie.0,
+                                size: n.size.0 as u32,
+                                last_modified: n.last_modified,
+                                crc: n.checksum.0,
+                                ttl: ttl_str,
+                            },
+                        ));
+                    }
+                    Err(crate::storage::volume::VolumeError::NotFound) => {
+                        return Err(needle_not_found(needle_id));
+                    }
+                    // fs.verify skips "already deleted" by message, like Go's plain ErrorDeleted.
+                    Err(e) => return Err(Status::unknown(e.to_string())),
                 }
             }
         }
 
-        Err(Status::not_found(format!("volume not found {}", vid)))
+        // Intervals on shards held by other nodes are fetched or reconstructed, as in Go.
+        use crate::server::store_ec::EcMiss;
+        match crate::server::store_ec::read_ec_shard_needle_or_miss(&self.state, vid, needle_id)
+            .await
+        {
+            Ok(Ok(n)) => {
+                let ttl_str = match &n.ttl {
+                    Some(t) if n.has_ttl() => t.to_string(),
+                    _ => String::new(),
+                };
+                Ok(Response::new(
+                    volume_server_pb::VolumeNeedleStatusResponse {
+                        needle_id: n.id.0,
+                        cookie: n.cookie.0,
+                        size: n.size.0 as u32,
+                        last_modified: n.last_modified,
+                        crc: n.checksum.0,
+                        ttl: ttl_str,
+                    },
+                ))
+            }
+            Ok(Err(EcMiss::NotFound)) => Err(needle_not_found(needle_id)),
+            // fs.verify skips "already deleted" by message, like Go's plain ErrorDeleted.
+            Ok(Err(EcMiss::Deleted)) => Err(Status::unknown(
+                crate::storage::volume::VolumeError::Deleted.to_string(),
+            )),
+            Ok(Err(EcMiss::VolumeNotFound)) => {
+                Err(Status::not_found(format!("volume not found {}", vid)))
+            }
+            Err(e) => Err(Status::unknown(format!(
+                "read ec shard needle {} from volume {}: {}",
+                needle_id, vid, e
+            ))),
+        }
     }
 
     async fn ping(
@@ -4562,7 +5464,7 @@ impl VolumeServer for VolumeGrpcService {
                     return Err(Status::internal(format!(
                         "ping {} {}: {}",
                         req.target_type, req.target, e
-                    )))
+                    )));
                 }
             }
         } else if req.target_type == "master" {
@@ -4573,7 +5475,7 @@ impl VolumeServer for VolumeGrpcService {
                     return Err(Status::internal(format!(
                         "ping {} {}: {}",
                         req.target_type, req.target, e
-                    )))
+                    )));
                 }
             }
         } else if req.target_type == "filer" {
@@ -4583,7 +5485,7 @@ impl VolumeServer for VolumeGrpcService {
                     return Err(Status::internal(format!(
                         "ping {} {}: {}",
                         req.target_type, req.target, e
-                    )))
+                    )));
                 }
             }
         } else {
@@ -4600,13 +5502,624 @@ impl VolumeServer for VolumeGrpcService {
     }
 }
 
-/// Build a gRPC endpoint from a SeaweedFS server address.
-fn to_grpc_endpoint(
+/// The copy source's ReadVolumeFileStatus answer. `fetch` is the only
+/// constructor, so holding one proves the source is reachable and holds the
+/// volume. Readability alone is the gate: size/count comparisons invert after
+/// divergent compaction and would block valid re-replication.
+mod copy_source {
+    use tonic::Status;
+
+    use crate::pb::volume_server_pb;
+    use crate::server::grpc_client::VolumeServerGrpcClient;
+
+    pub(super) struct SourceVolumeStatus(volume_server_pb::ReadVolumeFileStatusResponse);
+
+    impl SourceVolumeStatus {
+        pub(super) async fn fetch(
+            client: &mut VolumeServerGrpcClient,
+            volume_id: u32,
+        ) -> Result<Self, Status> {
+            // Get file status from source
+            let vol_info = client
+                .read_volume_file_status(volume_server_pb::ReadVolumeFileStatusRequest {
+                    volume_id,
+                })
+                .await
+                .map_err(|e| Status::internal(format!("read volume file status failed, {}", e)))?
+                .into_inner();
+            Ok(Self(vol_info))
+        }
+    }
+
+    impl std::ops::Deref for SourceVolumeStatus {
+        type Target = volume_server_pb::ReadVolumeFileStatusResponse;
+
+        fn deref(&self) -> &Self::Target {
+            &self.0
+        }
+    }
+}
+
+use copy_source::SourceVolumeStatus;
+
+/// Deletes a VolumeCopy destination replica but keeps its remote data: its
+/// .vif may point at the same cloud-tier object the source replica references,
+/// so dropping that object would destroy the source's data. The pre-copy delete
+/// and the failed-copy rollback both go through here.
+fn delete_replica_keep_remote(
+    store: &mut crate::storage::store::Store,
+    vid: VolumeId,
+) -> Result<(), crate::storage::volume::VolumeError> {
+    store.delete_volume(vid, false, false, true)
+}
+
+/// Drops a pre-existing local replica before the copy overwrites its files.
+/// Deleting before the source is confirmed reachable destroys a healthy copy
+/// on a transient source outage (and, on retry, can lose the volume
+/// entirely), so this takes the source's status as proof. The caller holds
+/// the store write lock so the delete is atomic with the destination pick.
+fn delete_existing_replica(
+    store: &mut crate::storage::store::Store,
+    vid: VolumeId,
+    _source: &SourceVolumeStatus,
+) -> Result<(), Status> {
+    delete_replica_keep_remote(store, vid)
+        .map_err(|e| Status::internal(format!("failed to delete existing volume {}: {}", vid, e)))
+}
+
+/// The source's record counts before and after the copy decide whether the
+/// copied replica's counts can be checked. Without the "before" snapshot the
+/// check is skipped, not the copy.
+async fn fetch_source_status_before(
+    client: &mut VolumeServerGrpcClient,
+    volume_id: u32,
+    vid: VolumeId,
+) -> Option<volume_server_pb::VolumeStatusResponse> {
+    match client
+        .volume_status(volume_server_pb::VolumeStatusRequest { volume_id })
+        .await
+    {
+        Ok(resp) => Some(resp.into_inner()),
+        Err(e) => {
+            tracing::warn!(
+                "failed to read source volume {} status before copy; skip record count validation: {}",
+                vid,
+                e
+            );
+            None
+        }
+    }
+}
+
+/// Go passes stream.Context() here, so a departing caller cancels the call.
+/// Race it against the response channel the same way: a stalled source would
+/// otherwise hold the copied, unmounted files past the caller.
+async fn fetch_source_status_after(
+    client: &mut VolumeServerGrpcClient,
+    volume_id: u32,
+    vid: VolumeId,
+    tx: &tokio::sync::mpsc::Sender<Result<volume_server_pb::VolumeCopyResponse, Status>>,
+) -> Result<volume_server_pb::VolumeStatusResponse, Status> {
+    tokio::select! {
+        res = client.volume_status(volume_server_pb::VolumeStatusRequest {
+            volume_id,
+        }) => res
+            .map(|r| r.into_inner())
+            .map_err(|e| {
+                Status::internal(format!(
+                    "read source volume {} status after copy failed: {}",
+                    vid, e
+                ))
+            }),
+        _ = tx.closed() => Err(Status::cancelled(format!(
+            "volume {} copy cancelled by caller",
+            vid
+        ))),
+    }
+}
+
+/// Where a VolumeCopy lands on this server.
+struct CopyDestination {
+    data_base_name: String,
+    idx_base_name: String,
+    disk_type: DiskType,
+    /// A remote-backed volume only lands its .idx/.vif locally; the .dat stays in the tier.
+    has_remote_dat: bool,
+}
+
+impl CopyDestination {
+    fn note_path(&self) -> String {
+        format!("{}.note", self.data_base_name)
+    }
+
+    /// Write a .note file to indicate copy in progress. A leftover note
+    /// fails the volume load on restart, so a write failure must abort.
+    fn write_note(&self, vid: VolumeId, source: &str) -> Result<(), Status> {
+        let note_path = self.note_path();
+        std::fs::write(&note_path, format!("copying from {}", source))
+            .map_err(|e| Status::internal(format!("write .note for volume {}: {}", vid, e)))?;
+        Ok(())
+    }
+}
+
+impl VolumeGrpcService {
+    async fn connect_to_copy_source(
+        &self,
+        vid: VolumeId,
+        source: &str,
+    ) -> Result<VolumeServerGrpcClient, Status> {
+        // Parse source_data_node address: "ip:port.grpcPort" or "ip:port" (grpc = port + 10000)
+        let grpc_addr = parse_grpc_address(source).map_err(|e| {
+            Status::internal(format!(
+                "VolumeCopy volume {} invalid source_data_node {}: {}",
+                vid, source, e
+            ))
+        })?;
+
+        let channel = connect_channel_guarded(
+            &grpc_addr,
+            source,
+            self.state.outgoing_grpc_tls.as_ref(),
+            GrpcDialOptions::stream(),
+            self.state.allow_untrusted_remote_endpoints,
+        )
+        .await
+        .map_err(|e| {
+            Status::internal(format!(
+                "VolumeCopy volume {} connect to {}: {}",
+                vid, grpc_addr, e
+            ))
+        })?;
+
+        Ok(volume_server_client(channel))
+    }
+
+    /// Picks the destination disk and, under the same write lock, drops a
+    /// pre-existing local replica so its slot counts as free for the pick.
+    fn plan_copy_destination(
+        &self,
+        req: &volume_server_pb::VolumeCopyRequest,
+        vid: VolumeId,
+        vol_info: &SourceVolumeStatus,
+        had_existing_volume: bool,
+    ) -> Result<CopyDestination, Status> {
+        let requested_disk_type = if !req.disk_type.is_empty() {
+            DiskType::from_string(&req.disk_type)
+        } else {
+            DiskType::from_string(&vol_info.disk_type)
+        };
+
+        let has_remote_dat = vol_info
+            .volume_info
+            .as_ref()
+            .map(|vi| !vi.files.is_empty())
+            .unwrap_or(false);
+        let needed_space = if has_remote_dat {
+            vol_info.idx_file_size
+        } else {
+            vol_info.dat_file_size
+        };
+
+        // Find a free disk location using Go's Store.FindFreeLocation
+        // semantics; the slot of the replica being replaced counts as free.
+        let (data_base, idx_base, selected_disk_type) = {
+            let mut store = self.state.store.write().unwrap();
+            let Some(loc_idx) = store.find_free_location_predicate(
+                |loc| {
+                    loc.disk_type == requested_disk_type
+                        && loc.available_space.load(Ordering::Relaxed) > needed_space
+                },
+                Some(vid),
+            ) else {
+                return Err(Status::internal(format!(
+                    "no space left {}",
+                    requested_disk_type.readable_string()
+                )));
+            };
+            let loc = &store.locations[loc_idx];
+            let selected = (
+                loc.directory.clone(),
+                loc.idx_directory.clone(),
+                loc.disk_type.clone(),
+            );
+            if had_existing_volume {
+                delete_existing_replica(&mut store, vid, vol_info)?;
+            }
+            selected
+        };
+        if had_existing_volume {
+            self.state.volume_state_notify.notify_one();
+        }
+
+        let data_base_name =
+            crate::storage::volume::volume_file_name(&data_base, &vol_info.collection, vid);
+        let idx_base_name =
+            crate::storage::volume::volume_file_name(&idx_base, &vol_info.collection, vid);
+
+        Ok(CopyDestination {
+            data_base_name,
+            idx_base_name,
+            disk_type: selected_disk_type,
+            has_remote_dat,
+        })
+    }
+}
+
+/// The part of a VolumeCopy that runs after the handler has returned its stream.
+struct VolumeCopyJob {
+    state: Arc<VolumeServerState>,
+    req: volume_server_pb::VolumeCopyRequest,
+    vid: VolumeId,
+    source: SourceVolumeStatus,
+    source_status_before: Option<volume_server_pb::VolumeStatusResponse>,
+    dest: CopyDestination,
+    tx: tokio::sync::mpsc::Sender<Result<volume_server_pb::VolumeCopyResponse, Status>>,
+}
+
+impl VolumeCopyJob {
+    async fn run(
+        &self,
+        client: &mut VolumeServerGrpcClient,
+        mounted: &mut bool,
+    ) -> Result<(), Status> {
+        let (state, req, vid, tx) = (&self.state, &self.req, self.vid, &self.tx);
+        // Nothing below is worth doing for a caller that has already
+        // gone: the transfer would spend the source's bandwidth and the
+        // destination's disk on a volume nobody will take delivery of.
+        if tx.is_closed() {
+            return Err(Status::cancelled(format!(
+                "volume {} copy cancelled by caller",
+                vid
+            )));
+        }
+
+        let report_interval: i64 = 128 * 1024 * 1024;
+        let mut next_report_target: i64 = report_interval;
+        let io_byte_per_second = if req.io_byte_per_second > 0 {
+            req.io_byte_per_second
+        } else {
+            state.maintenance_byte_per_second
+        };
+        let mut throttler = WriteThrottler::new(io_byte_per_second);
+
+        self.preallocate_dat().await?;
+
+        let mut progress = CopyProgress {
+            tx,
+            next_report_target: &mut next_report_target,
+            report_interval,
+            throttler: &mut throttler,
+        };
+        self.transfer_files(client, &mut progress).await?;
+
+        let source_status_after =
+            fetch_source_status_after(client, self.req.volume_id, vid, tx).await?;
+        let last_append_at_ns = self.finish_copied_files()?;
+        self.mount_and_reply(last_append_at_ns, &source_status_after, mounted)
+            .await
+    }
+
+    /// Query master for preallocation settings (matching Go VolumeCopy behavior).
+    async fn preallocate_dat(&self) -> Result<(), Status> {
+        let (state, vid, tx) = (&self.state, self.vid, &self.tx);
+        let (data_base_name, has_remote_dat) =
+            (&self.dest.data_base_name, self.dest.has_remote_dat);
+        let mut preallocate_size: i64 = 0;
+        if !has_remote_dat {
+            let master = state.current_master().await;
+            let grpc_addr = super::heartbeat::to_grpc_address(&master);
+            // Race the master-configuration RPC against the caller's
+            // response channel: a stalled master (or a slow leader
+            // election) would otherwise hold the task and its .note
+            // past a departing caller, since the per-chunk checks in
+            // copy_file_from_source are never reached.
+            let config = tokio::select! {
+                res = super::heartbeat::try_get_master_configuration(
+                    &grpc_addr,
+                    state.outgoing_grpc_tls.as_ref(),
+                ) => res,
+                _ = tx.closed() => {
+                    return Err(Status::cancelled(format!(
+                        "volume {} copy cancelled by caller",
+                        vid
+                    )));
+                }
+            };
+            match config {
+                Ok(resp) => {
+                    if resp.volume_preallocate {
+                        preallocate_size = resp.volume_size_limit_m_b as i64 * 1024 * 1024;
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!("get master {} configuration: {}", master, e);
+                }
+            }
+
+            if preallocate_size > 0 {
+                let dat_path = format!("{}.dat", data_base_name);
+                let file = std::fs::File::create(&dat_path).map_err(|e| {
+                    Status::internal(format!(
+                        "create preallocated volume file {}: {}",
+                        dat_path, e
+                    ))
+                })?;
+                file.set_len(preallocate_size as u64).map_err(|e| {
+                    Status::internal(format!("preallocate volume file {}: {}", dat_path, e))
+                })?;
+            }
+        }
+        Ok(())
+    }
+
+    /// Pull the .dat (unless it stays in the remote tier), .idx and .vif.
+    async fn transfer_files(
+        &self,
+        client: &mut VolumeServerGrpcClient,
+        progress: &mut CopyProgress<'_>,
+    ) -> Result<(), Status> {
+        let (req, vol_info) = (&self.req, &self.source);
+        let (data_base_name, idx_base_name, has_remote_dat) = (
+            &self.dest.data_base_name,
+            &self.dest.idx_base_name,
+            self.dest.has_remote_dat,
+        );
+        // Copy .dat file
+        if !has_remote_dat {
+            let dat_path = format!("{}.dat", data_base_name);
+            let dat_modified_ts_ns = copy_file_from_source(
+                client,
+                &CopyFileSpec {
+                    is_ec_volume: false,
+                    collection: &req.collection,
+                    volume_id: req.volume_id,
+                    compaction_revision: vol_info.compaction_revision,
+                    stop_offset: vol_info.dat_file_size,
+                    dest_path: &dat_path,
+                    ext: ".dat",
+                    is_append: false,
+                    ignore_source_not_found: true,
+                    report_progress: true,
+                },
+                progress,
+            )
+            .await?;
+            if dat_modified_ts_ns > 0 {
+                let _ = set_file_mtime(&dat_path, dat_modified_ts_ns);
+            }
+        }
+
+        // Copy .idx file
+        let idx_path = format!("{}.idx", idx_base_name);
+        let idx_modified_ts_ns = copy_file_from_source(
+            client,
+            &CopyFileSpec {
+                is_ec_volume: false,
+                collection: &req.collection,
+                volume_id: req.volume_id,
+                compaction_revision: vol_info.compaction_revision,
+                stop_offset: vol_info.idx_file_size,
+                dest_path: &idx_path,
+                ext: ".idx",
+                is_append: false,
+                ignore_source_not_found: false,
+                report_progress: false,
+            },
+            progress,
+        )
+        .await?;
+        if idx_modified_ts_ns > 0 {
+            let _ = set_file_mtime(&idx_path, idx_modified_ts_ns);
+        }
+
+        // Copy .vif file (ignore if not found on source)
+        let vif_path = format!("{}.vif", data_base_name);
+        let vif_modified_ts_ns = copy_file_from_source(
+            client,
+            &CopyFileSpec {
+                is_ec_volume: false,
+                collection: &req.collection,
+                volume_id: req.volume_id,
+                compaction_revision: vol_info.compaction_revision,
+                stop_offset: 1024 * 1024,
+                dest_path: &vif_path,
+                ext: ".vif",
+                is_append: false,
+                ignore_source_not_found: true,
+                report_progress: false,
+            },
+            progress,
+        )
+        .await?;
+        if vif_modified_ts_ns > 0 {
+            let _ = set_file_mtime(&vif_path, vif_modified_ts_ns);
+        }
+        Ok(())
+    }
+
+    /// Clear the .note, verify the copied sizes and return last_append_at_ns.
+    fn finish_copied_files(&self) -> Result<u64, Status> {
+        let (vid, vol_info, note_path) = (self.vid, &self.source, self.dest.note_path());
+        let (data_base_name, has_remote_dat) =
+            (&self.dest.data_base_name, self.dest.has_remote_dat);
+        let idx_path = format!("{}.idx", self.dest.idx_base_name);
+        // Remove the .note file. A leftover note fails the load on the
+        // next restart, so a removal failure must fail the copy.
+        if let Err(e) = std::fs::remove_file(&note_path)
+            && e.kind() != std::io::ErrorKind::NotFound
+        {
+            return Err(Status::internal(format!(
+                "remove .note for volume {}: {}",
+                vid, e
+            )));
+        }
+
+        // Verify file sizes
+        if !has_remote_dat {
+            let dat_path = format!("{}.dat", data_base_name);
+            check_copy_file_size(&dat_path, vol_info.dat_file_size)?;
+        }
+        if vol_info.idx_file_size > 0 {
+            check_copy_file_size(&idx_path, vol_info.idx_file_size)?;
+        }
+
+        // Find last_append_at_ns from copied files
+        let last_append_at_ns = if !has_remote_dat {
+            find_last_append_at_ns(
+                &idx_path,
+                &format!("{}.dat", data_base_name),
+                vol_info.version,
+            )
+            .unwrap_or(vol_info.dat_file_timestamp_seconds * 1_000_000_000)
+        } else {
+            vol_info.dat_file_timestamp_seconds * 1_000_000_000
+        };
+        Ok(last_append_at_ns)
+    }
+
+    async fn mount_and_reply(
+        &self,
+        last_append_at_ns: u64,
+        source_status_after: &volume_server_pb::VolumeStatusResponse,
+        mounted: &mut bool,
+    ) -> Result<(), Status> {
+        let (state, vid, vol_info, tx) = (&self.state, self.vid, &self.source, &self.tx);
+        let selected_disk_type = self.dest.disk_type.clone();
+        // An orphaned mount is how an abandoned copy does lasting
+        // damage: the destination carries that volume's index cache for
+        // the lifetime of the process, and under replication=000 the
+        // cluster is left holding one volume id on two servers, both
+        // writable, which concurrent writes can diverge.
+        if tx.is_closed() {
+            return Err(Status::cancelled(format!(
+                "volume {} copy cancelled by caller before mount",
+                vid
+            )));
+        }
+
+        let validate_counts =
+            copy_counts_stable(self.source_status_before.as_ref(), source_status_after);
+        if !validate_counts {
+            tracing::debug!(
+                "source volume {} changed during copy; skip record count validation",
+                vid
+            );
+        }
+
+        // Mount and validate the volume under one store lock, so a replica that
+        // fails validation is unloaded before the next heartbeat can announce it.
+        {
+            let mut store = state.store.write().unwrap();
+            store
+                .mount_volume(vid, &vol_info.collection, selected_disk_type)
+                .map_err(|e| {
+                    Status::internal(format!("failed to mount or validate volume {}: {}", vid, e))
+                })?;
+            if validate_counts
+                && let Some((_, v)) = store.find_volume(vid)
+                && let Err(e) = check_copy_counts(
+                    source_status_after,
+                    v.file_count() as u64,
+                    v.deleted_count() as u64,
+                )
+            {
+                // Cannot fail: mounted under this same guard, so it cannot be compacting.
+                let _ = store.unmount_volume(vid);
+                return Err(Status::internal(format!(
+                    "failed to mount or validate volume {}: {}",
+                    vid, e
+                )));
+            }
+            *mounted = true;
+        }
+        state.volume_state_notify.notify_one();
+
+        // Send final response with last_append_at_ns. A failed send
+        // means the caller is gone: the mount above raced a departing
+        // receiver (the pre-mount is_closed() check cannot close that
+        // window), and leaving the volume mounted is exactly the orphan
+        // this PR prevents. Surface it as Cancelled so the error branch
+        // unmounts and deletes the replica it just created.
+        if tx
+            .send(Ok(volume_server_pb::VolumeCopyResponse {
+                last_append_at_ns,
+                processed_bytes: 0,
+            }))
+            .await
+            .is_err()
+        {
+            return Err(Status::cancelled(format!(
+                "volume {} copy cancelled by caller after mount",
+                vid
+            )));
+        }
+
+        Ok(())
+    }
+
+    async fn cleanup_failed_copy(&self, e: Status, mounted: bool) {
+        let (state, req, vid, tx) = (&self.state, &self.req, self.vid, &self.tx);
+        let (data_base_name, idx_base_name, note_path) = (
+            &self.dest.data_base_name,
+            &self.dest.idx_base_name,
+            self.dest.note_path(),
+        );
+        // An abandoned copy is otherwise invisible here: the error goes
+        // to a channel nobody is reading. Logging it gives the operator
+        // the cause behind the balancer's "delete that copy, then re-run
+        // the move".
+        if e.code() == tonic::Code::Cancelled {
+            tracing::info!(
+                "volume {} copy from {} abandoned by its caller, discarding the partial copy",
+                vid,
+                req.source_data_node
+            );
+        } else {
+            tracing::warn!(
+                "volume {} copy from {} failed: {}",
+                vid,
+                req.source_data_node,
+                e
+            );
+        }
+        // Clean up on error. If the volume was mounted (the after-mount
+        // race), delete_volume unmounts it from the store AND removes
+        // the .dat/.idx/.vif in one step; the remove_file calls below
+        // cover the never-mounted partial-file case and are harmless
+        // no-ops when delete_volume already removed the files.
+        if mounted {
+            let mut store = state.store.write().unwrap();
+            let _ = delete_replica_keep_remote(&mut store, vid);
+            state.volume_state_notify.notify_one();
+        }
+        let _ = std::fs::remove_file(format!("{}.dat", data_base_name));
+        let _ = std::fs::remove_file(format!("{}.idx", idx_base_name));
+        let _ = std::fs::remove_file(format!("{}.vif", data_base_name));
+        let _ = std::fs::remove_file(&note_path);
+        let _ = tx.send(Err(e)).await;
+    }
+}
+
+/// Dial a ping target, bounding the whole connect at 5s.
+///
+/// The outer timeout is not redundant with `GrpcDialOptions`' connect timeout:
+/// tonic hands that one to the HTTP connector, so it bounds the TCP dial only.
+/// A ping to a TLS peer that accepts the connection and then stalls in the
+/// handshake needs this wrapper to come back at all.
+async fn connect_ping_target(
     target: &str,
     tls: Option<&super::grpc_client::OutgoingGrpcTlsConfig>,
-) -> Result<tonic::transport::Endpoint, String> {
+) -> Result<tonic::transport::Channel, String> {
     let grpc_host_port = parse_grpc_address(target)?;
-    build_grpc_endpoint(&grpc_host_port, tls).map_err(|e| e.to_string())
+    // Ping is unary, but `stream()` is still right: these three have no
+    // per-request deadline today, and `unary()` would add a 10 s one.
+    tokio::time::timeout(
+        std::time::Duration::from_secs(5),
+        connect_channel(&grpc_host_port, tls, GrpcDialOptions::stream()),
+    )
+    .await
+    .map_err(|_| "connection timeout".to_string())?
+    .map_err(|e| e.to_string())
 }
 
 /// Ping a remote volume server target by actually calling its Ping RPC (matches Go behavior).
@@ -4614,18 +6127,7 @@ async fn ping_volume_server_target(
     target: &str,
     tls: Option<&super::grpc_client::OutgoingGrpcTlsConfig>,
 ) -> Result<i64, String> {
-    let endpoint = to_grpc_endpoint(target, tls)?;
-    let channel = tokio::time::timeout(std::time::Duration::from_secs(5), endpoint.connect())
-        .await
-        .map_err(|_| "connection timeout".to_string())?
-        .map_err(|e| e.to_string())?;
-
-    let mut client = volume_server_pb::volume_server_client::VolumeServerClient::with_interceptor(
-        channel,
-        super::request_id::outgoing_request_id_interceptor,
-    )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    let mut client = volume_server_client(connect_ping_target(target, tls).await?);
     let resp = client
         .ping(volume_server_pb::PingRequest {
             target: String::new(),
@@ -4641,18 +6143,7 @@ async fn ping_master_target(
     target: &str,
     tls: Option<&super::grpc_client::OutgoingGrpcTlsConfig>,
 ) -> Result<i64, String> {
-    let endpoint = to_grpc_endpoint(target, tls)?;
-    let channel = tokio::time::timeout(std::time::Duration::from_secs(5), endpoint.connect())
-        .await
-        .map_err(|_| "connection timeout".to_string())?
-        .map_err(|e| e.to_string())?;
-
-    let mut client = master_pb::seaweed_client::SeaweedClient::with_interceptor(
-        channel,
-        super::request_id::outgoing_request_id_interceptor,
-    )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    let mut client = master_client(connect_ping_target(target, tls).await?);
     let resp = client
         .ping(master_pb::PingRequest {
             target: String::new(),
@@ -4668,18 +6159,7 @@ async fn ping_filer_target(
     target: &str,
     tls: Option<&super::grpc_client::OutgoingGrpcTlsConfig>,
 ) -> Result<i64, String> {
-    let endpoint = to_grpc_endpoint(target, tls)?;
-    let channel = tokio::time::timeout(std::time::Duration::from_secs(5), endpoint.connect())
-        .await
-        .map_err(|_| "connection timeout".to_string())?
-        .map_err(|e| e.to_string())?;
-
-    let mut client = filer_pb::seaweed_filer_client::SeaweedFilerClient::with_interceptor(
-        channel,
-        super::request_id::outgoing_request_id_interceptor,
-    )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    let mut client = filer_client(connect_ping_target(target, tls).await?);
     let resp = client
         .ping(filer_pb::PingRequest::default())
         .await
@@ -4756,32 +6236,125 @@ async fn drain_copy_stream_to_file(
     }
 }
 
+/// Decode a CopyFile stream of an `.ecj` into its distinct ids without staging
+/// it on disk. `found` is false only when the source has no journal, which it
+/// signals with neither a modified time nor any bytes; an empty journal still
+/// carries its modified time.
+pub(crate) async fn receive_ecj_ids(
+    stream: &mut tonic::Streaming<volume_server_pb::CopyFileResponse>,
+) -> std::io::Result<(std::collections::HashSet<NeedleId>, bool)> {
+    let mut decoder = EcjIdDecoder::default();
+    let mut found = false;
+    while let Some(chunk) = stream
+        .message()
+        .await
+        .map_err(|e| std::io::Error::other(format!("recv .ecj: {}", e)))?
+    {
+        found |= chunk.modified_ts_ns != 0 || !chunk.file_content.is_empty();
+        decoder.push(&chunk.file_content);
+    }
+    Ok((decoder.into_ids(), found))
+}
+
+/// Merge received `.ecj` ids into vid's local journal at `ecj_path` on the
+/// disk whose data directory is `data_dir`, off the async runtime (the merge
+/// reads, appends and fsyncs). Shared by shard copy and index recovery.
+pub(crate) async fn merge_ecj_ids(
+    state: &std::sync::Arc<super::volume_server::VolumeServerState>,
+    vid: VolumeId,
+    data_dir: String,
+    ecj_path: String,
+    ids: std::collections::HashSet<NeedleId>,
+) -> std::io::Result<usize> {
+    let state = std::sync::Arc::clone(state);
+    tokio::task::spawn_blocking(move || {
+        crate::storage::store_ec_journal::merge_ec_journal(
+            &state.store,
+            vid,
+            &data_dir,
+            &ecj_path,
+            &ids,
+        )
+    })
+    .await
+    .map_err(|e| std::io::Error::other(format!("join .ecj merge: {}", e)))?
+}
+
+/// One file of a volume copy: what to ask the source for and where it lands.
+#[derive(Clone, Copy)]
+struct CopyFileSpec<'a> {
+    is_ec_volume: bool,
+    collection: &'a str,
+    volume_id: u32,
+    compaction_revision: u32,
+    stop_offset: u64,
+    dest_path: &'a str,
+    ext: &'a str,
+    is_append: bool,
+    ignore_source_not_found: bool,
+    /// Whether this file's bytes are reported back to the caller as progress.
+    report_progress: bool,
+}
+
+/// Progress reporting and throttling shared by every file of one volume copy.
+struct CopyProgress<'a> {
+    tx: &'a tokio::sync::mpsc::Sender<Result<volume_server_pb::VolumeCopyResponse, Status>>,
+    next_report_target: &'a mut i64,
+    report_interval: i64,
+    throttler: &'a mut WriteThrottler,
+}
+
+/// Mirrors Go's checkVolumeFileExtension: the client-supplied Ext that
+/// CopyFile and ReceiveFile join onto the volume directory. A genuine
+/// extension is a leading dot plus alphanumerics (".dat", ".idx", ".ecx",
+/// ".ec00"..) and never a separator or "..".
+fn check_volume_file_extension(ext: &str) -> Result<(), String> {
+    let valid = ext.len() >= 2
+        && ext.starts_with('.')
+        && ext[1..].bytes().all(|b| b.is_ascii_alphanumeric());
+    if !valid {
+        return Err(format!("invalid file extension {ext:?}"));
+    }
+    Ok(())
+}
+
+/// Mirrors Go's checkVolumeCollection: the client-supplied Collection that
+/// CopyFile and ReceiveFile fold into a path component ("<collection>_<vid>").
+/// Collection names may hold '.' or '-', so this rejects only separators and
+/// bare parent references.
+fn check_volume_collection(collection: &str) -> Result<(), String> {
+    if collection == "." || collection == ".." || collection.contains(['/', '\\']) {
+        return Err(format!("invalid collection {collection:?}"));
+    }
+    Ok(())
+}
+
 /// Copy a file from a remote volume server via CopyFile streaming RPC.
 /// Returns the modified_ts_ns received from the source.
 async fn copy_file_from_source<T>(
     client: &mut volume_server_pb::volume_server_client::VolumeServerClient<T>,
-    is_ec_volume: bool,
-    collection: &str,
-    volume_id: u32,
-    compaction_revision: u32,
-    stop_offset: u64,
-    dest_path: &str,
-    ext: &str,
-    is_append: bool,
-    ignore_source_not_found: bool,
-    progress_tx: Option<
-        &tokio::sync::mpsc::Sender<Result<volume_server_pb::VolumeCopyResponse, Status>>,
-    >,
-    next_report_target: &mut i64,
-    report_interval: i64,
-    throttler: &mut WriteThrottler,
-) -> Result<i64, String>
+    spec: &CopyFileSpec<'_>,
+    progress: &mut CopyProgress<'_>,
+) -> Result<i64, Status>
 where
-    T: tonic::client::GrpcService<tonic::body::BoxBody>,
+    T: tonic::client::GrpcService<tonic::body::Body>,
     T::Error: Into<tonic::codegen::StdError>,
     T::ResponseBody: http_body::Body<Data = bytes::Bytes> + Send + 'static,
     <T::ResponseBody as http_body::Body>::Error: Into<tonic::codegen::StdError> + Send,
 {
+    let CopyFileSpec {
+        is_ec_volume,
+        collection,
+        volume_id,
+        compaction_revision,
+        stop_offset,
+        dest_path,
+        ext,
+        is_append,
+        ignore_source_not_found,
+        report_progress,
+    } = *spec;
+    let progress_tx = progress.tx;
     let copy_req = volume_server_pb::CopyFileRequest {
         volume_id,
         ext: ext.to_string(),
@@ -4792,62 +6365,107 @@ where
         ignore_source_file_not_found: ignore_source_not_found,
     };
 
-    let mut stream = client
-        .copy_file(copy_req)
-        .await
-        .map_err(|e| {
-            format!(
-                "failed to start copying volume {} {} file: {}",
-                volume_id, ext, e
-            )
-        })?
-        .into_inner();
+    // Cancellation surfaces as Status::cancelled so the spawn's error branch
+    // can distinguish it from ordinary failures (logging + future handling).
+    // The other errors here stay Status::internal, matching the prior
+    // `.map_err(|e| Status::internal(e))` at the call sites.
+    let cancelled = || {
+        Status::cancelled(format!(
+            "volume {} {} copy cancelled by caller",
+            volume_id, ext
+        ))
+    };
+
+    // Race the initial RPC establishment against the caller's response channel:
+    // if the source stalls before sending response headers, the per-message
+    // select! below is never reached, and without this race the task, the
+    // source connection, and any preallocated files would outlive a caller
+    // that has already gone.
+    let mut stream = tokio::select! {
+        res = client.copy_file(copy_req) => {
+            res.map_err(|e| {
+                Status::internal(format!(
+                    "failed to start copying volume {} {} file: {}",
+                    volume_id, ext, e
+                ))
+            })?
+            .into_inner()
+        }
+        _ = progress_tx.closed() => return Err(cancelled()),
+    };
 
     let mut file = if is_append {
         std::fs::OpenOptions::new()
             .create(true)
             .append(true)
             .open(dest_path)
-            .map_err(|e| format!("open file {}: {}", dest_path, e))?
+            .map_err(|e| Status::internal(format!("open file {}: {}", dest_path, e)))?
     } else {
         std::fs::OpenOptions::new()
             .write(true)
             .create(true)
             .truncate(true)
             .open(dest_path)
-            .map_err(|e| format!("open file {}: {}", dest_path, e))?
+            .map_err(|e| Status::internal(format!("open file {}: {}", dest_path, e)))?
     };
 
     let mut progressed_bytes: i64 = 0;
     let mut modified_ts_ns: i64 = 0;
 
-    while let Some(resp) = stream
-        .message()
-        .await
-        .map_err(|e| format!("receiving {}: {}", dest_path, e))?
-    {
+    // The source stream's message() future is the one await in this loop that
+    // can hang indefinitely: a stalled source (slow disk, network partition,
+    // GC pause on the source host) never returns a chunk, and without racing
+    // it against the caller's response channel the detached task, the source
+    // connection, and the partial files (including the .note) all outlive the
+    // caller. select! lets a departing caller preempt the source read.
+    loop {
+        let resp = tokio::select! {
+            msg = stream.message() => {
+                msg.map_err(|e| Status::internal(format!("receiving {}: {}", dest_path, e)))?
+            }
+            _ = progress_tx.closed() => return Err(cancelled()),
+        };
+        let resp = match resp {
+            Some(r) => r,
+            None => break,
+        };
         if resp.modified_ts_ns != 0 {
             modified_ts_ns = resp.modified_ts_ns;
         }
         if !resp.file_content.is_empty() {
+            // The caller's response stream is the only thing that makes this
+            // copy worth finishing. Checked every chunk rather than only where
+            // progress is reported: the first report lands 128MB in, so a
+            // smaller volume would otherwise run to completion — and mount —
+            // long after its caller stopped listening.
+            if progress_tx.is_closed() {
+                return Err(cancelled());
+            }
             use std::io::Write;
             file.write_all(&resp.file_content)
-                .map_err(|e| format!("write file {}: {}", dest_path, e))?;
+                .map_err(|e| Status::internal(format!("write file {}: {}", dest_path, e)))?;
             progressed_bytes += resp.file_content.len() as i64;
-            throttler
-                .maybe_slowdown(resp.file_content.len() as i64)
-                .await;
+            // A throttled copy sleeps seconds at a time; wake for a departing
+            // caller instead of finishing the nap first.
+            tokio::select! {
+                _ = progress.throttler.maybe_slowdown(resp.file_content.len() as i64) => {}
+                _ = progress_tx.closed() => return Err(cancelled()),
+            }
 
-            if let Some(tx) = progress_tx {
-                if progressed_bytes > *next_report_target {
-                    let _ = tx
-                        .send(Ok(volume_server_pb::VolumeCopyResponse {
-                            last_append_at_ns: 0,
-                            processed_bytes: progressed_bytes,
-                        }))
-                        .await;
-                    *next_report_target = progressed_bytes + report_interval;
+            if report_progress && progressed_bytes > *progress.next_report_target {
+                // Go aborts the transfer when this send fails
+                // (volume_grpc_copy.go: `return false`); so do we.
+                if progress_tx
+                    .send(Ok(volume_server_pb::VolumeCopyResponse {
+                        last_append_at_ns: 0,
+                        processed_bytes: progressed_bytes,
+                    }))
+                    .await
+                    .is_err()
+                {
+                    return Err(cancelled());
                 }
+                *progress.next_report_target = progressed_bytes + progress.report_interval;
             }
         }
     }
@@ -4861,6 +6479,40 @@ where
     Ok(modified_ts_ns)
 }
 
+/// Compare a copied replica's record counts with the source's.
+fn check_copy_counts(
+    origin: &volume_server_pb::VolumeStatusResponse,
+    target_file_count: u64,
+    target_deleted_count: u64,
+) -> Result<(), String> {
+    if origin.file_count != target_file_count {
+        return Err(format!(
+            "target file count [{}] is not same as origin file count [{}]",
+            target_file_count, origin.file_count
+        ));
+    }
+    if origin.file_deleted_count != target_deleted_count {
+        return Err(format!(
+            "target deleted count [{}] is not same as origin deleted count [{}]",
+            target_deleted_count, origin.file_deleted_count
+        ));
+    }
+    Ok(())
+}
+
+/// A writable source may take writes or deletes while its files are copied;
+/// then the before/after counts do not describe one snapshot and a strict
+/// count check would report a false mismatch.
+fn copy_counts_stable(
+    before: Option<&volume_server_pb::VolumeStatusResponse>,
+    after: &volume_server_pb::VolumeStatusResponse,
+) -> bool {
+    before.is_some_and(|before| {
+        before.file_count == after.file_count
+            && before.file_deleted_count == after.file_deleted_count
+    })
+}
+
 /// Verify that a copied file has the expected size.
 fn check_copy_file_size(path: &str, expected: u64) -> Result<(), Status> {
     match std::fs::metadata(path) {
@@ -4938,10 +6590,258 @@ fn find_last_append_at_ns(idx_path: &str, dat_path: &str, version: u32) -> Optio
     let ts = u64::from_be_bytes([
         tail[4], tail[5], tail[6], tail[7], tail[8], tail[9], tail[10], tail[11],
     ]);
-    if ts > 0 {
-        Some(ts)
-    } else {
-        None
+    if ts > 0 { Some(ts) } else { None }
+}
+
+/// What one `volume_tail_sender` pass did.
+enum TailPass {
+    /// The volume is no longer mounted: the stream ends.
+    VolumeGone,
+    /// The receiver hung up: the stream ends without a status.
+    ClientGone,
+    /// The pass failed: the stream ends with this internal error.
+    Failed(String),
+    /// Nothing is newer than the caller's timestamp, and nothing was scanned.
+    CaughtUp,
+    /// A scan ran. `last_processed_ns` is the newest timestamp shipped, or the
+    /// caller's own when nothing was.
+    Scanned {
+        last_processed_ns: u64,
+        sent_any: bool,
+    },
+}
+
+/// One pass of `volume_tail_sender`, on a blocking thread: resolve where to
+/// start under one store guard, then stream every needle newer than
+/// `last_timestamp_ns` with the guard released.
+fn tail_pass(
+    state: &VolumeServerState,
+    vid: VolumeId,
+    sb_size: u64,
+    version: u32,
+    last_timestamp_ns: u64,
+    tx: &tokio::sync::mpsc::Sender<Result<volume_server_pb::VolumeTailSenderResponse, Status>>,
+) -> TailPass {
+    const BUFFER_SIZE_LIMIT: usize = 2 * 1024 * 1024;
+
+    // `is_last` means the client is already caught up: nothing in the
+    // volume is newer than last_timestamp_ns. Go answers that with a
+    // heartbeat and does NOT scan (volume_grpc_tail.go, `if isLastOne`).
+    // Dropping that flag here is expensive, not just untidy: the scan
+    // below reads every needle from its start offset to the end bound, and
+    // when the search yields offset 0 the start offset falls back to
+    // sb_size -- the whole volume. A volume being moved is marked
+    // read-only first, so it is ALWAYS caught up, and the tail loop
+    // would re-read and discard the entire volume every 2s until the
+    // idle timeout expired. Measured at ~2.17 GB re-read six times in
+    // 35s for a 2.15 GB volume, which OOM-kills the source under a
+    // per-process memory cap.
+    //
+    // The start offset, the .dat handle and the end bound are captured under
+    // ONE store read guard, and the guard is dropped before any needle is
+    // read. The handle pins the inode the offset was resolved against: a
+    // vacuum commit replaces .dat by rename, and unmount or destroy unlink it,
+    // so the offset stays meaningful after either (see DatScanPlan). Reading
+    // needles under the guard stalled the node: needle writes and the
+    // heartbeat take store.write(), and the lock prefers writers, so every
+    // reader queued behind them until the scan finished.
+    let (plan, from) = {
+        let store = state.store.read().unwrap();
+        let Some((_, vol)) = store.find_volume(vid) else {
+            return TailPass::VolumeGone;
+        };
+        let from = if last_timestamp_ns > 0 {
+            match vol.binary_search_by_append_at_ns(last_timestamp_ns) {
+                Ok((_, true)) => return TailPass::CaughtUp,
+                Ok((offset, false)) => {
+                    if offset.is_zero() {
+                        sb_size
+                    } else {
+                        offset.to_actual_offset() as u64
+                    }
+                }
+                Err(e) => {
+                    tracing::warn!("fail to locate by appendAtNs {}: {}", last_timestamp_ns, e);
+                    return TailPass::Failed(format!(
+                        "fail to locate by appendAtNs {}: {}",
+                        last_timestamp_ns, e
+                    ));
+                }
+            }
+        } else {
+            // No timestamp yet: the caller wants everything.
+            sb_size
+        };
+        match vol.dat_scan_plan(from) {
+            Ok(plan) => (plan, from),
+            Err(e) => {
+                return TailPass::Failed(format!(
+                    "streamFollow: scan volume {} from offset {}: {}",
+                    vid, from, e
+                ));
+            }
+        }
+    };
+
+    let mut last_processed_ns = last_timestamp_ns;
+    let mut sent_any = false;
+    let mut client_gone = false;
+    let mut unavailable: Option<String> = None;
+    let scanned = plan.scan(|needle| {
+        // The plan is detached from the volume, so a failed recovery marking
+        // it unavailable mid-scan would otherwise keep streaming.
+        {
+            let store = state.store.read().unwrap();
+            if let Some((_, vol)) = store.find_volume(vid)
+                && let Some(e) = vol.unavailable_error()
+            {
+                unavailable = Some(e.to_string());
+                return ControlFlow::Break(());
+            }
+        }
+        // Notice a receiver that hung up between sends too, so a pass over
+        // needles it already has does not read on for nobody.
+        if tx.is_closed() {
+            client_gone = true;
+            return ControlFlow::Break(());
+        }
+        if needle.append_at_ns <= last_timestamp_ns && last_timestamp_ns > 0 {
+            return ControlFlow::Continue(());
+        }
+        sent_any = true;
+        // Send body in chunks of BUFFER_SIZE_LIMIT
+        // Go sends needle_header on every chunk
+        let mut i = 0;
+        while i < needle.body.len() {
+            let end = std::cmp::min(i + BUFFER_SIZE_LIMIT, needle.body.len());
+            let msg = volume_server_pb::VolumeTailSenderResponse {
+                needle_header: needle.header.to_vec(),
+                needle_body: needle.body[i..end].to_vec(),
+                is_last_chunk: end >= needle.body.len(),
+                version,
+            };
+            if tx.blocking_send(Ok(msg)).is_err() {
+                client_gone = true;
+                return ControlFlow::Break(());
+            }
+            i = end;
+        }
+        if needle.append_at_ns > last_processed_ns {
+            last_processed_ns = needle.append_at_ns;
+        }
+        ControlFlow::Continue(())
+    });
+
+    if let Some(reason) = unavailable {
+        return TailPass::Failed(format!("volume {} is unavailable: {}", vid, reason));
+    }
+    if client_gone {
+        return TailPass::ClientGone;
+    }
+    match scanned {
+        Ok(()) => TailPass::Scanned {
+            last_processed_ns,
+            sent_any,
+        },
+        // Streaming makes a failed pass partial: some needles may already be
+        // on the wire. Ending the stream cleanly would let the receiver
+        // (volume.move) treat a truncated tail as complete, so report it, as
+        // Go does (`streamFollow: %w`).
+        Err(e) => TailPass::Failed(format!(
+            "streamFollow: scan volume {} from offset {}: {}",
+            vid, from, e
+        )),
+    }
+}
+
+/// Stream the live needles of one volume in .dat order, one at a time and
+/// without holding the store lock while reading or waiting for channel space.
+/// Liveness is checked against the needle map per record, and the scan follows
+/// appends made while it ran. `Err(None)` means the receiver hung up.
+fn read_all_needles_of_volume(
+    state: &VolumeServerState,
+    vid: VolumeId,
+    tx: &tokio::sync::mpsc::Sender<Result<volume_server_pb::ReadAllNeedlesResponse, Status>>,
+) -> Result<(), Option<Status>> {
+    let not_found = || Some(Status::not_found(format!("not found volume id {}", vid)));
+    let internal = |e: crate::storage::volume::VolumeError| Some(Status::internal(e.to_string()));
+    let mut plan = {
+        let store = state.store.read().unwrap();
+        let (_, v) = store.find_volume(vid).ok_or_else(not_found)?;
+        v.dat_scan_plan(v.super_block().block_size() as u64)
+            .map_err(internal)?
+    };
+    loop {
+        let mut next = None;
+        let mut failed = None;
+        let mut client_gone = false;
+        let scanned = plan.scan_records(|record| {
+            if tx.is_closed() {
+                client_gone = true;
+                return Ok(ControlFlow::Break(()));
+            }
+            next = Some(record.offset + record.bytes.len() as u64);
+            if record.size.0 <= 0 {
+                return Ok(ControlFlow::Continue(()));
+            }
+            // A stale copy's parse error must not fail the stream.
+            let parsed = record.parse();
+            // Wait for channel space before the liveness check, then enqueue
+            // under the guard, so no overwrite can land between the two.
+            let Ok(permit) = futures::executor::block_on(tx.reserve()) else {
+                client_gone = true;
+                return Ok(ControlFlow::Break(()));
+            };
+            let store = state.store.read().unwrap();
+            let live = match store.find_volume(vid) {
+                Some((_, v)) => v
+                    .is_live_in_plan(&plan, record.id, record.offset)
+                    .map_err(internal),
+                None => Err(not_found()),
+            };
+            match live {
+                Ok(true) => {}
+                Ok(false) => return Ok(ControlFlow::Continue(())),
+                Err(status) => {
+                    failed = status;
+                    return Ok(ControlFlow::Break(()));
+                }
+            }
+            let n = parsed?;
+            let compressed = n.is_compressed();
+            let msg = volume_server_pb::ReadAllNeedlesResponse {
+                volume_id: vid.0,
+                needle_id: n.id.into(),
+                cookie: n.cookie.0,
+                needle_blob: n.data,
+                needle_blob_compressed: compressed,
+                last_modified: n.last_modified,
+                crc: n.checksum.0,
+                name: n.name,
+                mime: n.mime,
+            };
+            permit.send(Ok(msg));
+            Ok(ControlFlow::Continue(()))
+        });
+        if client_gone {
+            return Err(None);
+        }
+        if failed.is_some() {
+            return Err(failed);
+        }
+        scanned.map_err(internal)?;
+
+        // Records appended while the pass ran lie past its end bound; an
+        // overwrite's new copy is among them, so continue until none are left.
+        let after = {
+            let store = state.store.read().unwrap();
+            let (_, v) = store.find_volume(vid).ok_or_else(not_found)?;
+            v.dat_scan_plan_after(&plan, next).map_err(internal)?
+        };
+        match after {
+            Some(p) => plan = p,
+            None => return Ok(()),
+        }
     }
 }
 
@@ -4966,18 +6866,380 @@ fn get_disk_usage(path: &str) -> (u64, u64) {
     }
 }
 
+/// What `VolumeEcShardsToVolume` needs to decode an EC volume, snapshotted
+/// under the store lock so the decode itself runs without it.
+struct EcDecodeJob {
+    vid: VolumeId,
+    dat_dir: String,
+    ecx_dir: String,
+    idx_dir: String,
+    collection: String,
+    vif_dat_file_size: i64,
+    large_block_size: usize,
+    small_block_size: usize,
+    /// Directory of each data shard.
+    shard_dirs: Vec<String>,
+    needle_map_kind: crate::storage::needle_map::NeedleMapKind,
+}
+
+impl EcDecodeJob {
+    fn run(self, state: &VolumeServerState) -> Result<(), Status> {
+        use crate::storage::erasure_coding::{ec_bitrot, ec_decoder};
+        let EcDecodeJob {
+            vid,
+            dat_dir,
+            ecx_dir,
+            idx_dir,
+            collection,
+            vif_dat_file_size,
+            large_block_size,
+            small_block_size,
+            shard_dirs,
+            needle_map_kind,
+        } = self;
+
+        // Deletions journaled beside the .ecx, or collected by
+        // VolumeEcShardsCopy into the idx dir, count as deleted throughout.
+        // The first pass runs unlocked — a slow journal must not stall every
+        // store writer — then a second pass runs with appends quiesced by the
+        // read lock. The rollback epoch proves whether it needs to be a full
+        // rescan: an unchanged epoch means no append was rolled back inside
+        // the window, so every id folded in was committed and catch_up only
+        // needs to pick up records appended meanwhile.
+        let epoch_before = crate::storage::erasure_coding::ec_volume::ECJ_ROLLBACK_EPOCH
+            .load(std::sync::atomic::Ordering::Acquire);
+        let mut deleted = ec_decoder::EcjDeletions::read(&[&ecx_dir, &idx_dir], &collection, vid)
+            .map_err(|e| Status::internal(format!("read ecj: {}", e)))?;
+        {
+            let _guard = state.store.read().unwrap();
+            if epoch_before
+                == crate::storage::erasure_coding::ec_volume::ECJ_ROLLBACK_EPOCH
+                    .load(std::sync::atomic::Ordering::Acquire)
+            {
+                deleted
+                    .catch_up()
+                    .map_err(|e| Status::internal(format!("read ecj: {}", e)))?;
+            } else {
+                // A rollback ran inside the window: the unlocked pass may
+                // have folded in bytes that were truncated away, or missed a
+                // record re-appended to the freed offset — re-read it all.
+                deleted
+                    .rescan()
+                    .map_err(|e| Status::internal(format!("read ecj: {}", e)))?;
+            }
+        }
+        let has_live = ec_decoder::has_live_needles(&ecx_dir, &collection, vid, &deleted.ids)
+            .map_err(|e| Status::internal(format!("HasLiveNeedles: {}", e)))?;
+        if !has_live {
+            return Err(Status::failed_precondition(format!(
+                "ec volume {} has no live entries",
+                vid
+            )));
+        }
+
+        // Calculate .dat file size from .ecx entries (.ec00 lives on
+        // its own disk, .ecx on the index disk).
+        let dat_file_size = ec_decoder::find_dat_file_size_with_dirs(
+            &shard_dirs[0],
+            &ecx_dir,
+            &collection,
+            vid,
+            &deleted.ids,
+        )
+        .map_err(|e| Status::internal(format!("FindDatFileSize: {}", e)))?;
+
+        // The shard block layout was fixed by the .dat size at encode time
+        // (recorded in .vif); deletions can shrink the live extent below a
+        // large-block row boundary, so the layout must not be derived from
+        // dat_file_size. The decoder infers the layout from the shard size
+        // when .vif does not record it.
+        // Write .dat file using block-interleaved reading from shards.
+        ec_decoder::write_dat_file_from_shards(&ec_decoder::DatRebuild {
+            dat_dir: &dat_dir,
+            collection: &collection,
+            volume_id: vid,
+            dat_file_size,
+            encoded_dat_file_size: vif_dat_file_size,
+            data_shards: shard_dirs.len(),
+            shard_dirs: Some(&shard_dirs),
+            large_block_size,
+            small_block_size,
+        })
+        .map_err(|e| Status::internal(format!("WriteDatFile: {}", e)))?;
+        ec_decoder::verify_decoded_dat_file(&dat_dir, &collection, vid, dat_file_size)
+            .map_err(|e| Status::internal(format!("VerifyDecodedDatFile: {}", e)))?;
+
+        // Publishing phase: local .ecj appends for this vid wait on
+        // ec_decode_tail_notify until the .idx is written and compaction
+        // done, so a delete committed mid-tail can never slip between
+        // catch_up and the .cpd/.cpx swap. Unlike a store lock held across
+        // all of it, this stalls writers for this volume only — an append
+        // that would commit now instead commits right after the tail, on a
+        // .ecj that survives like any post-decode journal record (Go holds
+        // EcVolume.ecjFileAccessLock over the same span).
+        state
+            .ec_decode_tail
+            .lock()
+            .unwrap_or_else(|e| e.into_inner())
+            .insert(vid);
+        let _tail = EcDecodeTailGuard(state, vid);
+
+        // Deletes journaled while the .dat was written. Journal appends hold
+        // the store write lock through their sync-or-truncate, so a read lock
+        // held from catch_up through the .idx publish guarantees every record
+        // read is committed — a rolled-back delete cannot leave a tombstone
+        // in the index — and no new journal record can be missed by the
+        // rebuilt .idx.
+        {
+            let _guard = state.store.read().unwrap();
+            deleted
+                .catch_up()
+                .map_err(|e| Status::internal(format!("read ecj: {}", e)))?;
+
+            // Write .idx from the .ecx wherever it lives, beside the .dat
+            // where the mount looks first (Go moves it there after the
+            // rebuild).
+            ec_decoder::write_idx_file_from_ec_index_with_dirs(
+                &ecx_dir,
+                &dat_dir,
+                &collection,
+                vid,
+                &deleted.ids,
+                dat_file_size,
+            )
+            .map_err(|e| Status::internal(format!("WriteIdxFileFromEcIndex: {}", e)))?;
+        }
+
+        // The EC generation is gone; a stale .ecsum must not pass for the
+        // protection of a later re-encode.
+        let mut sidecar_dirs = vec![&dat_dir];
+        if ecx_dir != dat_dir {
+            sidecar_dirs.push(&ecx_dir);
+        }
+        for dir in sidecar_dirs {
+            let base = crate::storage::volume::volume_file_name(dir, &collection, vid);
+            if let Err(e) = ec_bitrot::remove_bitrot_sidecars(&base) {
+                tracing::warn!(volume_id = vid.0, error = %e, "remove bitrot sidecars of {base}");
+            }
+        }
+
+        // Drop the deleted needles — without the store lock, which must not
+        // be held through this rewrite: on a slow or large volume it would
+        // stall every store writer (journal appends, mounts) for unrelated
+        // volumes. This volume's own appends still wait on the tail set, and
+        // VolumeMount is held off by the decode claim, so the .cpd/.cpx swap
+        // cannot be raced. A failure is only logged, as in Go: the
+        // uncompacted .dat/.idx already make a complete volume.
+        if let Err(e) = crate::storage::store::Store::compact_volume_files(
+            &dat_dir,
+            &idx_dir,
+            &collection,
+            vid,
+            needle_map_kind,
+        ) {
+            // Benign only when the swap never started or was settled: a
+            // surviving .cpc marker means the commit was decided but the
+            // renames could not be reconciled, so .dat/.idx may be a
+            // mismatched pair — fail the decode and let the caller keep
+            // the shards rather than mount a corrupt volume.
+            let marker = format!(
+                "{}.cpc",
+                crate::storage::volume::volume_file_name(&dat_dir, &collection, vid)
+            );
+            if std::path::Path::new(&marker).exists() {
+                return Err(Status::internal(format!(
+                    "compact decoded volume {vid}: {e}"
+                )));
+            }
+            tracing::error!(volume_id = vid.0, error = %e, "compact decoded volume");
+        }
+        Ok(())
+    }
+}
+
+/// Bytes compacted between two `VacuumVolumeCompact` progress reports.
+const COMPACT_REPORT_INTERVAL: i64 = 128 * 1024 * 1024;
+
+/// The blocking body of `vacuum_volume_compact`. The store lock is held only
+/// to start the job; the copy and its progress sends run without it.
+fn run_vacuum_compact(
+    state: &VolumeServerState,
+    vid: VolumeId,
+    preallocate: u64,
+    report_interval: i64,
+    tx: &tokio::sync::mpsc::Sender<Result<volume_server_pb::VacuumVolumeCompactResponse, Status>>,
+) {
+    let compact_start = std::time::Instant::now();
+    let next_report = std::sync::atomic::AtomicI64::new(report_interval);
+    let progress = |processed: i64| {
+        // A copy nobody waits for would keep refusing unmount/delete/cleanup.
+        if tx.is_closed() {
+            return false;
+        }
+        let target = next_report.load(std::sync::atomic::Ordering::Relaxed);
+        if processed > target {
+            let resp = volume_server_pb::VacuumVolumeCompactResponse {
+                processed_bytes: processed,
+                load_avg_1m: 0.0,
+            };
+            // If send fails (client disconnected), stop compaction
+            if tx.blocking_send(Ok(resp)).is_err() {
+                return false;
+            }
+            next_report.store(
+                processed + report_interval,
+                std::sync::atomic::Ordering::Relaxed,
+            );
+        }
+        true
+    };
+
+    let job = state
+        .store
+        .write()
+        .unwrap()
+        .begin_compact_volume(vid, preallocate);
+    let result = match job {
+        Ok(Some(job)) => job.run(progress),
+        Ok(None) => Ok(()), // already compacting
+        Err(e) => Err(e),
+    };
+
+    let success = result.is_ok();
+    crate::metrics::VACUUMING_HISTOGRAM
+        .with_label_values(&["compact"])
+        .observe(compact_start.elapsed().as_secs_f64());
+    crate::metrics::VACUUMING_COMPACT_COUNTER
+        .with_label_values(&[if success { "true" } else { "false" }])
+        .inc();
+
+    if let Err(e) = result {
+        let _ = tx.blocking_send(Err(crate::server::status_with_context(
+            &format!("compact volume {vid}"),
+            e,
+        )));
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::config::MinFreeSpace;
-    use crate::remote_storage::s3_tier::{global_s3_tier_registry, S3TierBackend, S3TierConfig};
+    use crate::remote_storage::s3_tier::{
+        S3TierBackend, S3TierConfig, TierError, global_s3_tier_registry,
+    };
     use crate::security::{Guard, SigningKey};
+    use crate::server::grpc_client::GRPC_MAX_MESSAGE_SIZE;
     use crate::storage::needle_map::NeedleMapKind;
     use crate::storage::store::Store;
     use std::sync::RwLock;
     use tempfile::TempDir;
     use tokio_stream::StreamExt;
 
+    fn loc(dir: &str, idx_dir: &str, shard_count: usize, has_ecx: bool) -> LocInfo {
+        LocInfo {
+            dir: dir.to_string(),
+            idx_dir: idx_dir.to_string(),
+            shard_count,
+            has_ecx,
+        }
+    }
+
+    // The rebuild reads its shards from one directory but resolves the volume's
+    // layout -- ratio and uniform block size -- from the .vif or the
+    // generation-0 .ecsum, which on a multi-disk server may sit anywhere. Every
+    // directory that could hold one has to be in the search list, or the
+    // resolution silently falls back to 10+4 with the legacy striping and
+    // reconstructs through the wrong matrix.
+    // The rebuild's own data and index directories are handed to the resolvers
+    // as their own arguments, so they are deliberately absent from this list --
+    // unlike Go, whose resolver takes a single directory list and therefore
+    // carries the rebuild's index directory inside it.
+    #[test]
+    fn select_rebuild_location_excludes_the_rebuilds_own_dirs() {
+        for infos in [
+            vec![loc("/data1", "/idx1", 3, true)],
+            vec![loc("/data1", "/data1", 3, true)],
+        ] {
+            let (idx, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+            assert_eq!(idx, 0);
+            assert!(others.is_empty(), "got {:?}", others);
+        }
+    }
+
+    // The case two reviewers flagged: a sibling holding only shards while its
+    // index directory holds this volume's .vif.
+    #[test]
+    fn select_rebuild_location_searches_a_siblings_index_dir_not_just_its_data_dir() {
+        let infos = vec![
+            loc("/data1", "/data1", 5, true),
+            loc("/data2", "/idx2", 2, false),
+        ];
+        let (idx, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(idx, 0);
+        assert_eq!(others, vec!["/data2".to_string(), "/idx2".to_string()]);
+    }
+
+    // Several disks pointed at one index directory is a normal -dir.idx
+    // deployment; the shared directory is worth searching but only once.
+    #[test]
+    fn select_rebuild_location_lists_a_shared_index_dir_once() {
+        let infos = vec![
+            loc("/data1", "/data1", 5, true),
+            loc("/data2", "/shared-idx", 2, false),
+            loc("/data3", "/shared-idx", 1, false),
+        ];
+        let (_, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(
+            others,
+            vec![
+                "/data2".to_string(),
+                "/data3".to_string(),
+                "/shared-idx".to_string()
+            ]
+        );
+    }
+
+    // When the shared index directory is the rebuild's own it drops out, since
+    // the caller passes it separately.
+    #[test]
+    fn select_rebuild_location_omits_a_shared_index_dir_it_rebuilds_into() {
+        let infos = vec![
+            loc("/data1", "/shared-idx", 5, true),
+            loc("/data2", "/shared-idx", 2, false),
+        ];
+        let (_, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(others, vec!["/data2".to_string()]);
+    }
+
+    // The winner moves as a fuller location turns up; the one it displaces
+    // still has to be searched, index directory included.
+    #[test]
+    fn select_rebuild_location_keeps_the_displaced_winners_dirs() {
+        let infos = vec![
+            loc("/data1", "/idx1", 2, true),
+            loc("/data2", "/idx2", 9, true),
+        ];
+        let (idx, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(idx, 1, "the fuller location wins");
+        assert_eq!(others, vec!["/data1".to_string(), "/idx1".to_string()]);
+    }
+
+    #[test]
+    fn select_rebuild_location_drops_empty_dirs() {
+        let infos = vec![loc("/data1", "", 3, true), loc("/data2", "", 1, false)];
+        let (_, others) = select_rebuild_location(&infos).expect("a location with .ecx");
+        assert_eq!(others, vec!["/data2".to_string()]);
+    }
+
+    // Nothing carries an .ecx: there is no index to rebuild the shards against,
+    // so the caller answers with an empty rebuild rather than guessing.
+    #[test]
+    fn select_rebuild_location_is_none_without_an_ecx() {
+        let infos = vec![loc("/data1", "/idx1", 3, false)];
+        assert!(select_rebuild_location(&infos).is_none());
+    }
+
     #[test]
     fn test_parse_grpc_address_with_explicit_grpc_port() {
         // Format: "ip:port.grpcPort" — used by SeaweedFS for source_data_node
@@ -5035,9 +7297,9 @@ mod tests {
         tokio::sync::oneshot::Sender<()>,
         std::sync::Arc<std::sync::atomic::AtomicUsize>,
     ) {
-        use axum::http::{header, HeaderMap, HeaderValue, Method, StatusCode};
-        use axum::routing::any;
         use axum::Router;
+        use axum::http::{HeaderMap, HeaderValue, Method, StatusCode, header};
+        use axum::routing::any;
         use std::sync::atomic::{AtomicUsize, Ordering};
 
         let body = Arc::new(body);
@@ -5066,41 +7328,40 @@ mod tests {
                         if let Some(range) = headers
                             .get(header::RANGE)
                             .and_then(|value| value.to_str().ok())
+                            && let Some(range_value) = range.strip_prefix("bytes=")
                         {
-                            if let Some(range_value) = range.strip_prefix("bytes=") {
-                                let mut parts = range_value.splitn(2, '-');
-                                let start = parts
-                                    .next()
-                                    .and_then(|value| value.parse::<usize>().ok())
-                                    .unwrap_or(0);
-                                let end = parts
-                                    .next()
-                                    .and_then(|value| value.parse::<usize>().ok())
-                                    .unwrap_or_else(|| bytes.len().saturating_sub(1));
-                                let start = start.min(bytes.len());
-                                let end = end.min(bytes.len().saturating_sub(1));
-                                let payload = if start > end || start >= bytes.len() {
-                                    Vec::new()
-                                } else {
-                                    bytes[start..=end].to_vec()
-                                };
-                                let mut response_headers = HeaderMap::new();
-                                response_headers.insert(
-                                    header::CONTENT_RANGE,
-                                    HeaderValue::from_str(&format!(
-                                        "bytes {}-{}/{}",
-                                        start,
-                                        end,
-                                        bytes.len()
-                                    ))
-                                    .unwrap(),
-                                );
-                                response_headers.insert(
-                                    header::CONTENT_LENGTH,
-                                    HeaderValue::from_str(&payload.len().to_string()).unwrap(),
-                                );
-                                return (StatusCode::PARTIAL_CONTENT, response_headers, payload);
-                            }
+                            let mut parts = range_value.splitn(2, '-');
+                            let start = parts
+                                .next()
+                                .and_then(|value| value.parse::<usize>().ok())
+                                .unwrap_or(0);
+                            let end = parts
+                                .next()
+                                .and_then(|value| value.parse::<usize>().ok())
+                                .unwrap_or_else(|| bytes.len().saturating_sub(1));
+                            let start = start.min(bytes.len());
+                            let end = end.min(bytes.len().saturating_sub(1));
+                            let payload = if start > end || start >= bytes.len() {
+                                Vec::new()
+                            } else {
+                                bytes[start..=end].to_vec()
+                            };
+                            let mut response_headers = HeaderMap::new();
+                            response_headers.insert(
+                                header::CONTENT_RANGE,
+                                HeaderValue::from_str(&format!(
+                                    "bytes {}-{}/{}",
+                                    start,
+                                    end,
+                                    bytes.len()
+                                ))
+                                .unwrap(),
+                            );
+                            response_headers.insert(
+                                header::CONTENT_LENGTH,
+                                HeaderValue::from_str(&payload.len().to_string()).unwrap(),
+                            );
+                            return (StatusCode::PARTIAL_CONTENT, response_headers, payload);
                         }
 
                         let mut response_headers = HeaderMap::new();
@@ -5128,7 +7389,9 @@ mod tests {
         (format!("http://{}", addr), shutdown_tx, delete_count)
     }
 
-    fn make_remote_only_service(backend_id: &str) -> (
+    fn make_remote_only_service(
+        backend_id: &str,
+    ) -> (
         VolumeGrpcService,
         TempDir,
         tokio::sync::oneshot::Sender<()>,
@@ -5140,16 +7403,12 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         let (dat_bytes, super_block_size) = {
-            let mut volume = crate::storage::volume::Volume::new(
+            let volume = crate::storage::volume::Volume::new(
                 dir,
                 dir,
-                "",
                 VolumeId(1),
                 NeedleMapKind::InMemory,
-                None,
-                None,
-                0,
-                Version::current(),
+                &crate::storage::volume::VolumeSpec::default(),
             )
             .unwrap();
             let mut needle = Needle {
@@ -5159,11 +7418,11 @@ mod tests {
                 data_size: "remote-incremental-copy".len() as u32,
                 ..Needle::default()
             };
-            volume.write_needle(&mut needle, true).unwrap();
+            volume.write_needle(&mut needle, true, false).unwrap();
             volume.sync_to_disk().unwrap();
             (
                 std::fs::read(volume.file_name(".dat")).unwrap(),
-                volume.super_block.block_size() as u64,
+                volume.super_block().block_size() as u64,
             )
         };
 
@@ -5185,7 +7444,10 @@ mod tests {
         };
         {
             let mut registry = global_s3_tier_registry().write().unwrap();
-            registry.register(format!("s3.{}", backend_id), S3TierBackend::new(&tier_config));
+            registry.register(
+                format!("s3.{}", backend_id),
+                S3TierBackend::new(&tier_config),
+            );
         }
 
         let vif = crate::storage::volume::VifVolumeInfo {
@@ -5245,18 +7507,13 @@ mod tests {
             rack: String::new(),
             file_size_limit_bytes: 0,
             maintenance_byte_per_second: 0,
+            vacuum_commit_slots: None,
+            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
             is_heartbeating: std::sync::atomic::AtomicBool::new(true),
             has_master: false,
             pre_stop_seconds: 0,
             volume_state_notify: tokio::sync::Notify::new(),
             write_queue: std::sync::OnceLock::new(),
-            s3_tier_registry: std::sync::RwLock::new({
-                // The tier-down handler resolves the backend from the per-server
-                // registry, so register it here too (reads use the global one).
-                let mut reg = crate::remote_storage::s3_tier::S3TierRegistry::new();
-                reg.register(format!("s3.{}", backend_id), S3TierBackend::new(&tier_config));
-                reg
-            }),
             read_mode: crate::config::ReadMode::Local,
             allow_untrusted_remote_endpoints: false,
             master_url: String::new(),
@@ -5277,6 +7534,9 @@ mod tests {
             security_file: String::new(),
             cli_white_list: vec![],
             state_file_path: String::new(),
+            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail_notify: tokio::sync::Notify::new(),
         });
 
         (
@@ -5292,6 +7552,14 @@ mod tests {
     fn make_local_service_with_volume(
         collection: &str,
         ttl: Option<crate::storage::needle::ttl::TTL>,
+    ) -> (VolumeGrpcService, TempDir) {
+        make_local_service_with_volume_and_trust(collection, ttl, true)
+    }
+
+    fn make_local_service_with_volume_and_trust(
+        collection: &str,
+        ttl: Option<crate::storage::needle::ttl::TTL>,
+        allow_untrusted: bool,
     ) -> (VolumeGrpcService, TempDir) {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
@@ -5310,16 +7578,16 @@ mod tests {
         store
             .add_volume(
                 VolumeId(1),
-                collection,
-                None,
-                ttl,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection,
+                    ttl,
+                    ..Default::default()
+                },
             )
             .unwrap();
         {
-            let (_, volume) = store.find_volume_mut(VolumeId(1)).unwrap();
+            let (_, volume) = store.find_volume(VolumeId(1)).unwrap();
             let mut needle = Needle {
                 id: NeedleId(11),
                 cookie: Cookie(0x3344),
@@ -5327,7 +7595,7 @@ mod tests {
                 data_size: b"ec-generate".len() as u32,
                 ..Needle::default()
             };
-            volume.write_needle(&mut needle, true).unwrap();
+            volume.write_needle(&mut needle, true, false).unwrap();
             volume.sync_to_disk().unwrap();
         }
 
@@ -5355,16 +7623,15 @@ mod tests {
             rack: String::new(),
             file_size_limit_bytes: 0,
             maintenance_byte_per_second: 0,
+            vacuum_commit_slots: None,
+            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
             is_heartbeating: std::sync::atomic::AtomicBool::new(true),
             has_master: false,
             pre_stop_seconds: 0,
             volume_state_notify: tokio::sync::Notify::new(),
             write_queue: std::sync::OnceLock::new(),
-            s3_tier_registry: std::sync::RwLock::new(
-                crate::remote_storage::s3_tier::S3TierRegistry::new(),
-            ),
             read_mode: crate::config::ReadMode::Local,
-            allow_untrusted_remote_endpoints: false,
+            allow_untrusted_remote_endpoints: allow_untrusted,
             master_url: String::new(),
             master_urls: Vec::new(),
             seed_master_set: std::collections::HashSet::new(),
@@ -5383,11 +7650,357 @@ mod tests {
             security_file: String::new(),
             cli_white_list: vec![],
             state_file_path: String::new(),
+            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail_notify: tokio::sync::Notify::new(),
         });
 
         (VolumeGrpcService { state }, tmp)
     }
 
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_copy_and_tail_handlers_reject_blocked_sources() {
+        let (service, _tmp) = make_local_service_with_volume_and_trust("guard_rpc", None, false);
+
+        let copy_req = Request::new(volume_server_pb::VolumeCopyRequest {
+            volume_id: 1,
+            source_data_node: "169.254.169.254:80".to_string(),
+            ..Default::default()
+        });
+        let status = service.volume_copy(copy_req).await.err().unwrap();
+        assert_eq!(status.code(), tonic::Code::InvalidArgument, "{}", status);
+
+        let tail_req = Request::new(volume_server_pb::VolumeTailReceiverRequest {
+            volume_id: 1,
+            source_volume_server: "127.0.0.1:8080".to_string(),
+            ..Default::default()
+        });
+        let status = service.volume_tail_receiver(tail_req).await.err().unwrap();
+        assert_eq!(status.code(), tonic::Code::InvalidArgument, "{}", status);
+
+        let ec_req = Request::new(volume_server_pb::VolumeEcShardsCopyRequest {
+            volume_id: 1,
+            source_data_node: "127.0.0.1:8080".to_string(),
+            shard_ids: vec![0],
+            ..Default::default()
+        });
+        let status = service.volume_ec_shards_copy(ec_req).await.err().unwrap();
+        assert_eq!(status.code(), tonic::Code::InvalidArgument, "{}", status);
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_consolidate_index_rpc() {
+        let (service, _tmp) = make_local_service_with_volume("consolidate_rpc", None);
+
+        // Carry a peer address so the admin gate sees a caller; the test guard
+        // has an empty whitelist, so any peer is accepted.
+        let mut request =
+            Request::new(volume_server_pb::VolumeConsolidateIndexRequest { volume_id: 1 });
+        request
+            .extensions_mut()
+            .insert(tonic::transport::server::TcpConnectInfo {
+                local_addr: None,
+                remote_addr: Some("127.0.0.1:65000".parse().unwrap()),
+            });
+
+        service.volume_consolidate_index(request).await.unwrap();
+
+        // Data and index share a directory here, so there is nothing to move;
+        // the volume stays mounted and keeps its needle.
+        let store = service.state.store.read().unwrap();
+        let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+        assert_eq!(v.file_count(), 1);
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_vacuum_volume_commit_missing_volume_is_not_found() {
+        let (service, _tmp) = make_local_service_with_volume("vacuum_commit_missing", None);
+
+        let mut request =
+            Request::new(volume_server_pb::VacuumVolumeCommitRequest { volume_id: 4242 });
+        request
+            .extensions_mut()
+            .insert(tonic::transport::server::TcpConnectInfo {
+                local_addr: None,
+                remote_addr: Some("127.0.0.1:65000".parse().unwrap()),
+            });
+
+        let err = service
+            .vacuum_volume_commit(request)
+            .await
+            .expect_err("committing a compaction for a volume that is not mounted must fail");
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err:?}");
+        assert!(
+            err.message().contains("4242"),
+            "the message must still name the volume: {err:?}"
+        );
+    }
+
+    fn make_commit_limited_service(
+        collection: &str,
+        max_parallel_commits: usize,
+    ) -> (VolumeGrpcService, TempDir) {
+        let (mut service, tmp) = make_local_service_with_volume(collection, None);
+        if max_parallel_commits > 0 {
+            Arc::get_mut(&mut service.state)
+                .unwrap()
+                .vacuum_commit_slots = Some(tokio::sync::Semaphore::new(max_parallel_commits));
+        }
+        (service, tmp)
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 8)]
+    async fn test_vacuum_commit_slots_bound_concurrent_commits() {
+        async fn peak_holders(limit: usize) -> i32 {
+            let (service, _tmp) = make_commit_limited_service("bound_commits", limit);
+            let current = Arc::new(std::sync::atomic::AtomicI32::new(0));
+            let peak = Arc::new(std::sync::atomic::AtomicI32::new(0));
+            let mut workers = Vec::new();
+            for _ in 0..8 {
+                let state = service.state.clone();
+                let current = current.clone();
+                let peak = peak.clone();
+                workers.push(tokio::spawn(async move {
+                    let Ok(Some(_permit)) = state.acquire_vacuum_commit_slot(None).await else {
+                        return;
+                    };
+                    let n = current.fetch_add(1, Ordering::Relaxed) + 1;
+                    peak.fetch_max(n, Ordering::Relaxed);
+                    tokio::time::sleep(std::time::Duration::from_millis(5)).await;
+                    current.fetch_sub(1, Ordering::Relaxed);
+                }));
+            }
+            for w in workers {
+                w.await.unwrap();
+            }
+            peak.load(Ordering::Relaxed)
+        }
+        assert_eq!(peak_holders(1).await, 1);
+        assert!(peak_holders(3).await <= 3);
+    }
+
+    #[tokio::test]
+    async fn test_vacuum_commit_slots_unlimited_by_default() {
+        let (service, _tmp) = make_commit_limited_service("unlimited_commits", 0);
+        for i in 0..8 {
+            service
+                .state
+                .acquire_vacuum_commit_slot(Some(
+                    tokio::time::Instant::now() + std::time::Duration::from_secs(1),
+                ))
+                .await
+                .unwrap_or_else(|e| {
+                    panic!("acquisition {i} must not wait when no limit is configured: {e}")
+                });
+        }
+    }
+
+    #[tokio::test]
+    async fn test_vacuum_commit_slot_not_granted_to_expired_deadline() {
+        let (service, _tmp) = make_commit_limited_service("expired_commit", 1);
+        let slots = service.state.vacuum_commit_slots.as_ref().unwrap();
+        let past = tokio::time::Instant::now() - std::time::Duration::from_secs(1);
+        for _ in 0..100 {
+            let err = service
+                .state
+                .acquire_vacuum_commit_slot(Some(past))
+                .await
+                .expect_err("an expired deadline must not get a slot");
+            assert_eq!(err.code(), tonic::Code::DeadlineExceeded);
+            assert_eq!(
+                slots.available_permits(),
+                1,
+                "a refused acquisition must not keep the slot"
+            );
+        }
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_vacuum_commit_deadline_while_queued() {
+        let (service, _tmp) = make_commit_limited_service("queued_deadline", 1);
+        let state = service.state.clone();
+        let held = state
+            .vacuum_commit_slots
+            .as_ref()
+            .unwrap()
+            .acquire()
+            .await
+            .unwrap();
+
+        let mut request =
+            Request::new(volume_server_pb::VacuumVolumeCommitRequest { volume_id: 1 });
+        request
+            .metadata_mut()
+            .insert("grpc-timeout", "20m".parse().unwrap());
+        let err = service
+            .vacuum_volume_commit(request)
+            .await
+            .expect_err("the queued commit must expire at its deadline");
+        assert_eq!(err.code(), tonic::Code::DeadlineExceeded);
+        assert_eq!(
+            state
+                .vacuum_commit_slots
+                .as_ref()
+                .unwrap()
+                .available_permits(),
+            0,
+            "a refused commit must not consume the held slot"
+        );
+        drop(held);
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_queued_vacuum_commit_holds_no_store_lock() {
+        let (service, _tmp) = make_commit_limited_service("no_lock_commit", 1);
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .compact_volume(VolumeId(1), 0, 0, |_| true)
+            .unwrap();
+        let state = service.state.clone();
+        let held = state
+            .vacuum_commit_slots
+            .as_ref()
+            .unwrap()
+            .acquire()
+            .await
+            .unwrap();
+
+        let committed = tokio::spawn(async move {
+            service
+                .vacuum_volume_commit(Request::new(volume_server_pb::VacuumVolumeCommitRequest {
+                    volume_id: 1,
+                }))
+                .await
+        });
+        tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            while state.vacuum_commits_waiting.load(Ordering::Relaxed) == 0 {
+                tokio::time::sleep(std::time::Duration::from_millis(1)).await;
+            }
+        })
+        .await
+        .expect("the commit must pass the entry checks and wait for a slot");
+
+        tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            loop {
+                if let Ok(_guard) = state.store.try_read() {
+                    return;
+                }
+                tokio::time::sleep(std::time::Duration::from_millis(1)).await;
+            }
+        })
+        .await
+        .expect("store read blocked behind a queued commit");
+
+        drop(held);
+        tokio::time::timeout(std::time::Duration::from_secs(5), committed)
+            .await
+            .expect("queued commit did not run after the slot freed")
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            state
+                .vacuum_commit_slots
+                .as_ref()
+                .unwrap()
+                .available_permits(),
+            1,
+            "the commit must return its slot"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_vacuum_commit_releases_slot_on_error() {
+        let (service, _tmp) = make_commit_limited_service("commit_err", 1);
+        service
+            .vacuum_volume_commit(Request::new(volume_server_pb::VacuumVolumeCommitRequest {
+                volume_id: 42,
+            }))
+            .await
+            .expect_err("committing an unknown volume must fail");
+        assert_eq!(
+            service
+                .state
+                .vacuum_commit_slots
+                .as_ref()
+                .unwrap()
+                .available_permits(),
+            1,
+            "a failed commit must return its slot"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_queued_vacuum_commit_does_not_start_in_maintenance() {
+        let (service, _tmp) = make_commit_limited_service("maint_commit", 1);
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .compact_volume(VolumeId(1), 0, 0, |_| true)
+            .unwrap();
+        let revision_before = {
+            let store = service.state.store.read().unwrap();
+            let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+            v.super_block().compaction_revision
+        };
+        let state = service.state.clone();
+        let held = state
+            .vacuum_commit_slots
+            .as_ref()
+            .unwrap()
+            .acquire()
+            .await
+            .unwrap();
+
+        let committed = tokio::spawn(async move {
+            service
+                .vacuum_volume_commit(Request::new(volume_server_pb::VacuumVolumeCommitRequest {
+                    volume_id: 1,
+                }))
+                .await
+        });
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        while state.vacuum_commits_waiting.load(Ordering::Relaxed) == 0 {
+            assert!(
+                std::time::Instant::now() < deadline,
+                "the commit must pass the entry maintenance check and wait for a slot"
+            );
+            tokio::time::sleep(std::time::Duration::from_millis(1)).await;
+        }
+
+        state.maintenance.store(true, Ordering::Relaxed);
+        drop(held);
+
+        let err = tokio::time::timeout(std::time::Duration::from_secs(5), committed)
+            .await
+            .expect("queued commit did not return after the slot freed")
+            .unwrap()
+            .expect_err("a queued commit must not run in maintenance mode");
+        assert!(err.message().contains("maintenance mode"));
+        let revision_after = {
+            let store = state.store.read().unwrap();
+            let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+            v.super_block().compaction_revision
+        };
+        assert_eq!(
+            revision_before, revision_after,
+            "the volume must not be committed"
+        );
+        assert_eq!(
+            state
+                .vacuum_commit_slots
+                .as_ref()
+                .unwrap()
+                .available_permits(),
+            1,
+            "the refused commit must return its slot"
+        );
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn test_volume_incremental_copy_streams_remote_only_volume_data() {
         let (service, _tmp, shutdown_tx, dat_bytes, super_block_size, _delete_count) =
@@ -5448,8 +8061,8 @@ mod tests {
         {
             let store = service.state.store.read().unwrap();
             let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
-            assert!(!vol.has_remote_file);
-            assert!(vol.volume_info.files.is_empty());
+            assert!(!vol.has_remote_file());
+            assert!(vol.volume_info().files.is_empty());
             assert!(vol.has_data_backend());
         }
 
@@ -5463,6 +8076,178 @@ mod tests {
             .remove("s3.tier_down_delete");
     }
 
+    /// An S3 endpoint that answers every request 404 with no body.
+    fn spawn_s3_not_found_server() -> (String, tokio::sync::oneshot::Sender<()>) {
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
+        let (ready_tx, ready_rx) = std::sync::mpsc::channel::<()>();
+        std::thread::spawn(move || {
+            let runtime = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            runtime.block_on(async move {
+                let app = axum::Router::new().fallback(axum::routing::any(|| async {
+                    axum::http::StatusCode::NOT_FOUND
+                }));
+                let listener = tokio::net::TcpListener::from_std(listener).unwrap();
+                let _ = ready_tx.send(());
+                axum::serve(listener, app)
+                    .with_graceful_shutdown(async move {
+                        let _ = shutdown_rx.await;
+                    })
+                    .await
+                    .unwrap();
+            });
+        });
+        ready_rx.recv().unwrap();
+        (format!("http://{}", addr), shutdown_tx)
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_tier_move_from_remote_missing_object_is_not_found() {
+        let (service, tmp, shutdown_tx, _dat_bytes, _super_block_size, _delete_count) =
+            make_remote_only_service("tier_down_missing");
+        let (endpoint, missing_shutdown_tx) = spawn_s3_not_found_server();
+        global_s3_tier_registry().write().unwrap().register(
+            "s3.tier_down_missing".to_string(),
+            S3TierBackend::new(&S3TierConfig {
+                access_key: "access".to_string(),
+                secret_key: "secret".to_string(),
+                region: "us-east-1".to_string(),
+                bucket: "bucket-a".to_string(),
+                endpoint,
+                storage_class: "STANDARD".to_string(),
+                force_path_style: true,
+            }),
+        );
+        let dat_path = format!("{}/1.dat", tmp.path().to_str().unwrap());
+
+        let mut stream = service
+            .volume_tier_move_dat_from_remote(Request::new(
+                volume_server_pb::VolumeTierMoveDatFromRemoteRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                    keep_remote_dat_file: false,
+                },
+            ))
+            .await
+            .unwrap()
+            .into_inner();
+        let err = stream
+            .next()
+            .await
+            .expect("the stream must carry the failure")
+            .expect_err("a missing remote object must fail the tier-down");
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err:?}");
+        assert!(
+            err.message().starts_with(&format!(
+                "backend s3.tier_down_missing copy file {dat_path}: "
+            )),
+            "the message must keep its context: {err:?}"
+        );
+        assert!(!std::path::Path::new(&dat_path).exists());
+
+        let _ = shutdown_tx.send(());
+        let _ = missing_shutdown_tx.send(());
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_down_missing");
+    }
+
+    // The progress callback is the only thing a tier transfer polls, so it is
+    // the only place a departing caller can be noticed. Go gives it an error
+    // return for exactly this (s3_upload.go:99, s3_download.go:84); this checks
+    // the Rust port now honours one.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_download_file_aborts_when_the_progress_callback_fails() {
+        let (service, tmp, shutdown_tx, _dat_bytes, _super_block_size, _delete_count) =
+            make_remote_only_service("tier_progress_abort");
+        let backend = global_s3_tier_registry()
+            .read()
+            .unwrap()
+            .get("s3.tier_progress_abort")
+            .expect("backend registered");
+        let dest = format!("{}/aborted.dat", tmp.path().to_str().unwrap());
+
+        let err = backend
+            .download_file(&dest, "remote-key", |_, _| Err("caller gone".to_string()))
+            .await
+            .expect_err("a failing progress callback must abort the download");
+        assert!(
+            matches!(&err, TierError::Aborted(m) if m == "caller gone"),
+            "unexpected error: {err:?}"
+        );
+
+        drop(service);
+        let _ = shutdown_tx.send(());
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_progress_abort");
+    }
+
+    // An abandoned tier-down must leave the volume exactly as it found it. The
+    // partial .dat matters most: download_file pre-allocates the destination to
+    // the object's full size, this handler refuses to run while a local .dat
+    // exists, and a restart would load that file as the volume's data -- so a
+    // leftover wedges every retry on "already on local disk" and corrupts the
+    // volume on the way.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_tier_move_from_remote_cancelled_leaves_the_volume_untouched() {
+        let (service, tmp, shutdown_tx, _dat_bytes, _super_block_size, delete_count) =
+            make_remote_only_service("tier_down_cancel");
+        let dat_path = format!("{}/1.dat", tmp.path().to_str().unwrap());
+        assert!(!std::path::Path::new(&dat_path).exists());
+
+        let response = service
+            .volume_tier_move_dat_from_remote(Request::new(
+                volume_server_pb::VolumeTierMoveDatFromRemoteRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                    keep_remote_dat_file: false,
+                },
+            ))
+            .await
+            .unwrap();
+
+        // The caller hangs up: dropping the response drops the receiving half
+        // of the channel, which is all a cancelled RPC amounts to here.
+        drop(response);
+
+        for _ in 0..60 {
+            tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            assert!(
+                !std::path::Path::new(&dat_path).exists(),
+                "abandoned tier-down left a local .dat behind"
+            );
+        }
+
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            assert!(
+                vol.has_remote_file(),
+                "abandoned tier-down published the transition to local"
+            );
+            assert!(!vol.volume_info().files.is_empty());
+        }
+        assert_eq!(
+            delete_count.load(std::sync::atomic::Ordering::SeqCst),
+            0,
+            "abandoned tier-down deleted the shared remote object"
+        );
+
+        let _ = shutdown_tx.send(());
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_down_cancel");
+    }
+
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn test_tier_move_from_remote_keep_remote_still_swaps_to_local() {
         let (service, tmp, shutdown_tx, dat_bytes, _super_block_size, delete_count) =
@@ -5492,8 +8277,8 @@ mod tests {
         {
             let store = service.state.store.read().unwrap();
             let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
-            assert!(!vol.has_remote_file);
-            assert!(vol.volume_info.files.is_empty());
+            assert!(!vol.has_remote_file());
+            assert!(vol.volume_info().files.is_empty());
             assert!(vol.has_data_backend());
         }
 
@@ -5507,14 +8292,552 @@ mod tests {
             .remove("s3.tier_down_keep");
     }
 
+    // The destination is resolved from the process-wide registry, now the
+    // only one. A backend registered nowhere else has to get past that
+    // lookup. The stream stays open until the spawned transfer reports its
+    // terminal error, so the task cannot race a dropped receiver or outlive
+    // the test.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_tier_move_to_remote_resolves_the_destination_from_the_global_registry() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        {
+            let mut registry = global_s3_tier_registry().write().unwrap();
+            registry.register(
+                "s3.tier_up_probe".to_string(),
+                S3TierBackend::new(&S3TierConfig {
+                    access_key: "access".to_string(),
+                    secret_key: "secret".to_string(),
+                    region: "us-east-1".to_string(),
+                    bucket: "bucket-a".to_string(),
+                    // Nothing listens here; the upload fails instead of hanging.
+                    endpoint: "http://127.0.0.1:1".to_string(),
+                    storage_class: "STANDARD".to_string(),
+                    force_path_style: true,
+                }),
+            );
+        }
+
+        let mut stream = service
+            .volume_tier_move_dat_to_remote(Request::new(
+                volume_server_pb::VolumeTierMoveDatToRemoteRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                    destination_backend_name: "s3.tier_up_probe".to_string(),
+                    keep_local_dat_file: true,
+                },
+            ))
+            .await
+            .expect("tier-up must resolve its destination from the global registry")
+            .into_inner();
+
+        // The dead endpoint fails the multipart upload; the terminal error is
+        // also what proves the spawned task ran to completion rather than
+        // leaving background network work behind.
+        let terminal = stream.next().await;
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_up_probe");
+
+        match terminal {
+            Some(Err(status)) => {
+                assert_eq!(status.code(), tonic::Code::Internal, "{status:?}");
+                assert!(status.message().contains("s3.tier_up_probe"), "{status:?}");
+            }
+            other => panic!("the dead endpoint must fail the upload, got {other:?}"),
+        }
+    }
+
+    fn register_tier_backend(name: &str, endpoint: String) {
+        global_s3_tier_registry().write().unwrap().register(
+            name.to_string(),
+            S3TierBackend::new(&S3TierConfig {
+                access_key: "access".to_string(),
+                secret_key: "secret".to_string(),
+                region: "us-east-1".to_string(),
+                bucket: "bucket-a".to_string(),
+                endpoint,
+                storage_class: "STANDARD".to_string(),
+                force_path_style: true,
+            }),
+        );
+    }
+
+    fn tier_up_request(
+        backend: &str,
+        keep_local_dat_file: bool,
+    ) -> Request<volume_server_pb::VolumeTierMoveDatToRemoteRequest> {
+        Request::new(volume_server_pb::VolumeTierMoveDatToRemoteRequest {
+            volume_id: 1,
+            collection: String::new(),
+            destination_backend_name: backend.to_string(),
+            keep_local_dat_file,
+        })
+    }
+
+    /// Starts a tier move of volume 1 and waits until `s3` holds its part.
+    async fn start_parked_tier_move(
+        service: &VolumeGrpcService,
+        s3: &mut FakeMultipartS3,
+        backend: &str,
+        keep_local_dat_file: bool,
+    ) -> BoxStream<volume_server_pb::VolumeTierMoveDatToRemoteResponse> {
+        let stream = service
+            .volume_tier_move_dat_to_remote(tier_up_request(backend, keep_local_dat_file))
+            .await
+            .unwrap()
+            .into_inner();
+        s3.parked
+            .recv()
+            .await
+            .expect("the upload must reach its part");
+        stream
+    }
+
+    async fn tier_move_error(
+        mut stream: BoxStream<volume_server_pb::VolumeTierMoveDatToRemoteResponse>,
+    ) -> Option<Status> {
+        while let Some(message) = stream.next().await {
+            if let Err(e) = message {
+                return Some(e);
+            }
+        }
+        None
+    }
+
+    /// Writes needles 1 and 2 and deletes 1, so a compaction moves needle 2.
+    fn seed_compactable_volume(service: &VolumeGrpcService) {
+        let store = service.state.store.read().unwrap();
+        for id in [1u64, 2] {
+            let data = format!("needle-{id}").into_bytes();
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(id as u32),
+                data_size: data.len() as u32,
+                data,
+                ..Needle::default()
+            };
+            store
+                .write_volume_needle(VolumeId(1), &mut n, true)
+                .unwrap();
+        }
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(1),
+            ..Needle::default()
+        };
+        store.delete_volume_needle(VolumeId(1), &mut n).unwrap();
+    }
+
+    fn read_surviving_needle(
+        service: &VolumeGrpcService,
+    ) -> Result<Vec<u8>, crate::storage::volume::VolumeError> {
+        let mut n = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(2),
+            ..Needle::default()
+        };
+        let store = service.state.store.read().unwrap();
+        store.read_volume_needle(VolumeId(1), &mut n)?;
+        Ok(n.data)
+    }
+
+    fn compact_volume(service: &VolumeGrpcService) {
+        let job = service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .begin_compact_volume(VolumeId(1), 0)
+            .unwrap()
+            .expect("no compaction should be running");
+        job.run(|_| true).unwrap();
+    }
+
+    struct FakeMultipartS3 {
+        endpoint: String,
+        shutdown: tokio::sync::oneshot::Sender<()>,
+        /// Receives one message per part as it arrives, before it is answered.
+        parked: tokio::sync::mpsc::UnboundedReceiver<()>,
+        /// Each permit answers one parked part.
+        release: Arc<tokio::sync::Semaphore>,
+        delete_count: Arc<std::sync::atomic::AtomicUsize>,
+    }
+
+    /// An S3 endpoint that accepts multipart uploads, holding every part
+    /// until the test releases it.
+    fn spawn_multipart_s3_server() -> FakeMultipartS3 {
+        use axum::http::{Method, StatusCode, Uri, header};
+        use std::sync::atomic::{AtomicUsize, Ordering};
+
+        let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = listener.local_addr().unwrap();
+        listener.set_nonblocking(true).unwrap();
+        let (shutdown, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
+        let (parked_tx, parked) = tokio::sync::mpsc::unbounded_channel();
+        let release = Arc::new(tokio::sync::Semaphore::new(0));
+        let delete_count = Arc::new(AtomicUsize::new(0));
+        let (ready_tx, ready_rx) = std::sync::mpsc::channel::<()>();
+        let handler_release = release.clone();
+        let handler_deletes = delete_count.clone();
+        std::thread::spawn(move || {
+            let runtime = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap();
+            runtime.block_on(async move {
+                let app = axum::Router::new().fallback(axum::routing::any(
+                    move |method: Method, uri: Uri| {
+                        let parked_tx = parked_tx.clone();
+                        let release = handler_release.clone();
+                        let deletes = handler_deletes.clone();
+                        async move {
+                            let query = uri.query().unwrap_or_default();
+                            let xml =
+                                |body: String| (StatusCode::OK, [(header::ETAG, "\"etag\"")], body);
+                            match method {
+                                Method::DELETE => {
+                                    deletes.fetch_add(1, Ordering::SeqCst);
+                                    (
+                                        StatusCode::NO_CONTENT,
+                                        [(header::ETAG, "\"etag\"")],
+                                        String::new(),
+                                    )
+                                }
+                                Method::POST if query.contains("uploads") => {
+                                    xml("<InitiateMultipartUploadResult><Bucket>bucket-a</Bucket>\
+                                     <Key>k</Key><UploadId>upload-1</UploadId>\
+                                     </InitiateMultipartUploadResult>"
+                                        .to_string())
+                                }
+                                Method::PUT if query.contains("partNumber") => {
+                                    let _ = parked_tx.send(());
+                                    release.acquire().await.unwrap().forget();
+                                    xml(String::new())
+                                }
+                                Method::POST => {
+                                    xml("<CompleteMultipartUploadResult><Bucket>bucket-a</Bucket>\
+                                     <Key>k</Key><ETag>\"etag\"</ETag>\
+                                     </CompleteMultipartUploadResult>"
+                                        .to_string())
+                                }
+                                _ => (
+                                    StatusCode::NOT_FOUND,
+                                    [(header::ETAG, "\"etag\"")],
+                                    String::new(),
+                                ),
+                            }
+                        }
+                    },
+                ));
+                let listener = tokio::net::TcpListener::from_std(listener).unwrap();
+                let _ = ready_tx.send(());
+                axum::serve(listener, app)
+                    .with_graceful_shutdown(async move {
+                        let _ = shutdown_rx.await;
+                    })
+                    .await
+                    .unwrap();
+            });
+        });
+        ready_rx.recv().unwrap();
+        FakeMultipartS3 {
+            endpoint: format!("http://{}", addr),
+            shutdown,
+            parked,
+            release,
+            delete_count,
+        }
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_tier_move_to_remote_refused_while_compacting() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        // Nothing listens here, so a move that does start fails fast.
+        register_tier_backend("s3.tier_up_compacting", "http://127.0.0.1:1".to_string());
+        let job = service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .begin_compact_volume(VolumeId(1), 0)
+            .unwrap()
+            .unwrap();
+
+        let result = service
+            .volume_tier_move_dat_to_remote(tier_up_request("s3.tier_up_compacting", true))
+            .await;
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_up_compacting");
+        let Err(err) = result else {
+            panic!("a tier move must not start while the volume is compacting");
+        };
+        assert_eq!(err.code(), tonic::Code::FailedPrecondition, "{err:?}");
+        assert_eq!(err.message(), "volume 1 is compacting");
+        drop(job);
+    }
+
+    // A commit that lands while the upload runs changes the .dat under it;
+    // the object must not be published against the compacted .idx.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_tier_move_to_remote_aborts_when_compaction_commits_mid_upload() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        seed_compactable_volume(&service);
+        let mut s3 = spawn_multipart_s3_server();
+        register_tier_backend("s3.tier_up_mid_commit", s3.endpoint.clone());
+
+        let stream = start_parked_tier_move(&service, &mut s3, "s3.tier_up_mid_commit", true).await;
+
+        compact_volume(&service);
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .commit_compact_volume(VolumeId(1))
+            .unwrap();
+        s3.release.add_permits(1);
+
+        let terminal = tier_move_error(stream).await;
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_up_mid_commit");
+        let err = terminal.expect("the tier move must fail once the volume was compacted");
+        assert_eq!(err.code(), tonic::Code::FailedPrecondition, "{err:?}");
+        assert_eq!(
+            s3.delete_count.load(std::sync::atomic::Ordering::SeqCst),
+            1,
+            "the stale object must be deleted"
+        );
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            assert!(!vol.has_remote_file());
+            assert!(vol.volume_info().files.is_empty());
+        }
+        assert!(tmp.path().join("1.dat").exists());
+        assert_eq!(read_surviving_needle(&service).unwrap(), b"needle-2");
+        let _ = s3.shutdown.send(());
+    }
+
+    // A volume deleted and re-created under the same id mid-upload is back at
+    // the same compaction revision; the object holds the old volume's bytes.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_tier_move_to_remote_aborts_when_volume_is_recreated_mid_upload() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let mut s3 = spawn_multipart_s3_server();
+        register_tier_backend("s3.tier_up_recreated", s3.endpoint.clone());
+
+        let stream = start_parked_tier_move(&service, &mut s3, "s3.tier_up_recreated", false).await;
+        {
+            let mut store = service.state.store.write().unwrap();
+            store
+                .delete_volume(VolumeId(1), false, false, false)
+                .unwrap();
+            store
+                .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+                .unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            assert_eq!(vol.super_block().compaction_revision, 0);
+        }
+        s3.release.add_permits(1);
+
+        let terminal = tier_move_error(stream).await;
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_up_recreated");
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            assert!(!vol.has_remote_file(), "the new volume must not be tiered");
+            assert!(vol.volume_info().files.is_empty());
+        }
+        assert!(tmp.path().join("1.dat").exists());
+        if let Ok(vif) = std::fs::read_to_string(tmp.path().join("1.vif")) {
+            assert!(!vif.contains("tier_up_recreated"), "{vif}");
+        }
+        let err = terminal.expect("the tier move must fail once the volume was replaced");
+        assert_eq!(err.code(), tonic::Code::FailedPrecondition, "{err:?}");
+        assert_eq!(
+            s3.delete_count.load(std::sync::atomic::Ordering::SeqCst),
+            1,
+            "the stale object must be deleted"
+        );
+        let _ = s3.shutdown.send(());
+    }
+
+    // Go fails here too: unmounting closes the descriptor its copy reads.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_tier_move_to_remote_fails_when_volume_is_unmounted_mid_upload() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let mut s3 = spawn_multipart_s3_server();
+        register_tier_backend("s3.tier_up_unmounted", s3.endpoint.clone());
+
+        let stream = start_parked_tier_move(&service, &mut s3, "s3.tier_up_unmounted", false).await;
+        assert!(
+            service
+                .state
+                .store
+                .write()
+                .unwrap()
+                .unmount_volume(VolumeId(1))
+                .unwrap()
+        );
+        s3.release.add_permits(1);
+
+        let terminal = tier_move_error(stream).await;
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_up_unmounted");
+        let err = terminal.expect("the tier move must fail once the volume was unmounted");
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err:?}");
+        assert_eq!(
+            s3.delete_count.load(std::sync::atomic::Ordering::SeqCst),
+            1,
+            "the unreferenced object must be deleted"
+        );
+        assert!(tmp.path().join("1.dat").exists());
+        if let Ok(vif) = std::fs::read_to_string(tmp.path().join("1.vif")) {
+            assert!(!vif.contains("tier_up_unmounted"), "{vif}");
+        }
+        let _ = s3.shutdown.send(());
+    }
+
+    // A tier move that lands while the copy runs leaves a compaction that
+    // must not be committed: the reload would read the remote object, which
+    // keeps the pre-compaction layout, through the compacted .idx.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_compaction_commit_refused_once_the_volume_is_tiered() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        seed_compactable_volume(&service);
+        let job = service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .begin_compact_volume(VolumeId(1), 0)
+            .unwrap()
+            .unwrap();
+
+        // Tier it the way the tier-up bookkeeping does, keeping the local .dat.
+        let dat_bytes = std::fs::read(tmp.path().join("1.dat")).unwrap();
+        let (endpoint, shutdown_tx, _deletes) = spawn_fake_s3_server(dat_bytes.clone());
+        register_tier_backend("s3.tier_up_then_commit", endpoint);
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            vol.update_remote_files(|files| {
+                files.push(volume_server_pb::RemoteFile {
+                    backend_type: "s3".to_string(),
+                    backend_id: "tier_up_then_commit".to_string(),
+                    key: "remote-key".to_string(),
+                    offset: 0,
+                    file_size: dat_bytes.len() as u64,
+                    modified_time: 0,
+                    extension: ".dat".to_string(),
+                })
+            })
+            .unwrap();
+            vol.save_volume_info().unwrap();
+            vol.load_remote_dat_file().unwrap();
+        }
+        job.run(|_| true).unwrap();
+
+        let result = service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .commit_compact_volume(VolumeId(1));
+        let read = read_surviving_needle(&service);
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tier_up_then_commit");
+        let _ = shutdown_tx.send(());
+
+        let err = result.expect_err("a tiered volume must refuse the commit");
+        assert!(err.to_string().contains("tiered"), "{err}");
+        assert!(!tmp.path().join("1.cpd").exists());
+        assert!(!tmp.path().join("1.cpx").exists());
+        assert_eq!(read.unwrap(), b"needle-2");
+    }
+
+    // An explicit vacuum of a tiered volume must not copy it out of remote
+    // storage only for the commit to refuse the result.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_compaction_refused_before_copying_a_tiered_volume() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        seed_compactable_volume(&service);
+        let dat_bytes = std::fs::read(tmp.path().join("1.dat")).unwrap();
+        let (endpoint, shutdown_tx, _deletes) = spawn_fake_s3_server(dat_bytes.clone());
+        register_tier_backend("s3.tiered_then_compact", endpoint);
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            vol.update_remote_files(|files| {
+                files.push(volume_server_pb::RemoteFile {
+                    backend_type: "s3".to_string(),
+                    backend_id: "tiered_then_compact".to_string(),
+                    key: "remote-key".to_string(),
+                    offset: 0,
+                    file_size: dat_bytes.len() as u64,
+                    modified_time: 0,
+                    extension: ".dat".to_string(),
+                })
+            })
+            .unwrap();
+            vol.save_volume_info().unwrap();
+            vol.load_remote_dat_file().unwrap();
+        }
+        std::fs::remove_file(tmp.path().join("1.dat")).unwrap();
+
+        let mut stream = service
+            .vacuum_volume_compact(Request::new(volume_server_pb::VacuumVolumeCompactRequest {
+                volume_id: 1,
+                preallocate: 0,
+            }))
+            .await
+            .unwrap()
+            .into_inner();
+        let mut error = None;
+        while let Some(message) = stream.next().await {
+            if let Err(e) = message {
+                error = Some(e);
+            }
+        }
+        let compacting = {
+            let store = service.state.store.read().unwrap();
+            store.find_volume(VolumeId(1)).unwrap().1.is_compacting()
+        };
+        let read = read_surviving_needle(&service);
+        global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.tiered_then_compact");
+        let _ = shutdown_tx.send(());
+
+        let err = error.expect("a tiered volume must refuse the compaction");
+        assert!(err.message().contains("tiered"), "{err:?}");
+        assert!(!tmp.path().join("1.cpd").exists());
+        assert!(!tmp.path().join("1.cpx").exists());
+        assert!(!compacting);
+        assert_eq!(read.unwrap(), b"needle-2");
+    }
+
     /// Build a local service whose volume has a `.dat` large enough to span
     /// several 2MB copy chunks, so the streaming copy paths are exercised
     /// across multiple messages rather than a single buffer.
     fn make_local_service_with_large_volume() -> (VolumeGrpcService, TempDir, Vec<u8>) {
         let (service, tmp) = make_local_service_with_volume("", None);
         {
-            let mut store = service.state.store.write().unwrap();
-            let (_, v) = store.find_volume_mut(VolumeId(1)).unwrap();
+            let store = service.state.store.read().unwrap();
+            let (_, v) = store.find_volume(VolumeId(1)).unwrap();
             // Non-uniform payload so reassembly catches duplicated or reordered
             // chunks that a repeated byte would hide.
             let payload: Vec<u8> = (0..5 * 1024 * 1024usize)
@@ -5527,7 +8850,7 @@ mod tests {
                 data: payload,
                 ..Needle::default()
             };
-            v.write_needle(&mut needle, true).unwrap();
+            v.write_needle(&mut needle, true, false).unwrap();
             v.sync_to_disk().unwrap();
         }
         let dat_path = {
@@ -5539,6 +8862,702 @@ mod tests {
         (service, tmp, dat_bytes)
     }
 
+    // Serve a VolumeGrpcService over a real gRPC endpoint. VolumeCopy dials its
+    // source_data_node rather than calling in process, so a cancellation test
+    // needs a source that is reachable over the wire.
+    async fn serve_source(service: VolumeGrpcService) -> (u16, tokio::sync::oneshot::Sender<()>) {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let (shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
+        tokio::spawn(async move {
+            let _ = tonic::transport::Server::builder()
+                .add_service(
+                    crate::pb::volume_server_pb::volume_server_server::VolumeServerServer::new(
+                        service,
+                    ),
+                )
+                .serve_with_incoming_shutdown(
+                    tokio_stream::wrappers::TcpListenerStream::new(listener),
+                    async {
+                        let _ = shutdown_rx.await;
+                    },
+                )
+                .await;
+        });
+        (port, shutdown_tx)
+    }
+
+    // The transfer itself must notice a caller that has gone, with no progress
+    // report to carry the news. The first report is 128MB in, so for anything
+    // smaller -- the ordinary case for a balance move -- the send result says
+    // nothing and only the closed channel does.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_copy_file_from_source_stops_when_the_caller_is_gone() {
+        let (source_service, _source_tmp, dat_bytes) = make_local_service_with_large_volume();
+        assert!(
+            dat_bytes.len() > 2 * 1024 * 1024,
+            "fixture must span several 2MB chunks"
+        );
+        let (port, _shutdown) = serve_source(source_service).await;
+
+        let channel = tonic::transport::Endpoint::from_shared(format!("http://127.0.0.1:{}", port))
+            .unwrap()
+            .connect()
+            .await
+            .unwrap();
+        let mut client = volume_server_pb::volume_server_client::VolumeServerClient::new(channel)
+            .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
+            .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+
+        let dest_tmp = TempDir::new().unwrap();
+        let dest_path = format!("{}/copied.dat", dest_tmp.path().to_str().unwrap());
+
+        let (tx, rx) =
+            tokio::sync::mpsc::channel::<Result<volume_server_pb::VolumeCopyResponse, Status>>(16);
+        drop(rx); // exactly what a client hanging up does to the sender
+
+        let mut next_report_target: i64 = 128 * 1024 * 1024;
+        let mut throttler = WriteThrottler::new(0);
+        let err = copy_file_from_source(
+            &mut client,
+            &CopyFileSpec {
+                is_ec_volume: false,
+                collection: "",
+                volume_id: 1,
+                compaction_revision: u32::MAX,
+                stop_offset: dat_bytes.len() as u64,
+                dest_path: &dest_path,
+                ext: ".dat",
+                is_append: false,
+                ignore_source_not_found: true,
+                report_progress: true,
+            },
+            &mut CopyProgress {
+                tx: &tx,
+                next_report_target: &mut next_report_target,
+                report_interval: 128 * 1024 * 1024,
+                throttler: &mut throttler,
+            },
+        )
+        .await
+        .expect_err("a copy whose caller is gone must not run to completion");
+        // Cancellation must surface as Status::cancelled, not Status::internal:
+        // the spawn's error branch classifies on the code, so an Internal here
+        // would be logged as a generic failure instead of "abandoned by caller".
+        assert_eq!(
+            err.code(),
+            tonic::Code::Cancelled,
+            "expected Cancelled, got {:?}: {}",
+            err.code(),
+            err
+        );
+        assert!(
+            err.message().contains("cancelled by caller"),
+            "unexpected error: {}",
+            err
+        );
+
+        let copied = std::fs::metadata(&dest_path).map(|m| m.len()).unwrap_or(0);
+        assert!(
+            copied < dat_bytes.len() as u64,
+            "copy should have stopped short, wrote {} of {} bytes",
+            copied,
+            dat_bytes.len()
+        );
+    }
+
+    // An abandoned VolumeCopy must leave nothing behind: no mounted volume (its
+    // index cache would be held for the life of the process, and under
+    // replication=000 the cluster would carry one volume id on two writable
+    // servers), and none of the partial files or the .note, which fails the
+    // volume load on the next restart.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_volume_copy_cancelled_by_caller_mounts_nothing_and_cleans_up() {
+        let (source_service, _source_tmp, _dat_bytes) = make_local_service_with_large_volume();
+        let (port, _shutdown) = serve_source(source_service).await;
+
+        let (dest_service, dest_tmp) = make_local_service_with_volume("", None);
+        {
+            let mut store = dest_service.state.store.write().unwrap();
+            store
+                .delete_volume(VolumeId(1), false, false, false)
+                .unwrap();
+            // available_space is filled in by the periodic disk check, which
+            // does not run in a unit test; without it VolumeCopy finds no
+            // location with room and never gets as far as copying.
+            for loc in &store.locations {
+                loc.check_disk_space();
+            }
+        }
+        let dest_dir = dest_tmp.path().to_str().unwrap().to_string();
+        let dest_file = |ext: &str| format!("{}/1{}", dest_dir, ext);
+        assert!(
+            !std::path::Path::new(&dest_file(".dat")).exists(),
+            "destination must start without the volume for this test to mean anything"
+        );
+
+        let response = dest_service
+            .volume_copy(Request::new(volume_server_pb::VolumeCopyRequest {
+                volume_id: 1,
+                collection: String::new(),
+                source_data_node: format!("127.0.0.1:1.{}", port),
+                disk_type: String::new(),
+                io_byte_per_second: 0,
+                replication: String::new(),
+                ttl: String::new(),
+            }))
+            .await
+            .unwrap();
+
+        // The caller hangs up. Dropping the response drops the receiving half of
+        // the channel, which is all a cancelled RPC amounts to on this side.
+        drop(response);
+
+        // Give the copy longer than it would need to finish, and hold it to the
+        // assertion throughout rather than only at the end.
+        for _ in 0..100 {
+            tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            let store = dest_service.state.store.read().unwrap();
+            assert!(
+                store.find_volume(VolumeId(1)).is_none(),
+                "destination mounted a volume whose copy was abandoned"
+            );
+        }
+
+        for ext in [".dat", ".idx", ".vif", ".note"] {
+            assert!(
+                !std::path::Path::new(&dest_file(ext)).exists(),
+                "abandoned copy left {} behind",
+                dest_file(ext)
+            );
+        }
+    }
+
+    // If the caller departs in the narrow window between the pre-mount
+    // is_closed() check and the final tx.send, the volume is already mounted
+    // when the send fails. The task must roll back that mount — not just unlink
+    // the files — or the destination carries the volume's index cache for the
+    // life of the process.
+    //
+    // Reaching that window black-box needs a seam. The one the code already
+    // offers is the store write lock: the test takes it immediately after
+    // volume_copy returns, so the spawned task runs the copy to completion with
+    // the caller still attached, passes the pre-mount is_closed() check, then
+    // parks entering the mount block (state.store.write() blocks on the test's
+    // guard). The test then drops the response — the caller is gone — and
+    // releases the guard. The task acquires the lock, mounts, fails the final
+    // tx.send (receiver dropped), and must roll back via the error branch's
+    // delete_volume. Without the lock seam the task sees is_closed() at its
+    // very first check and returns before mount_volume, exercising the wrong
+    // path — the test would be green for the wrong reason.
+    /// ReceiveFile had no test at all, which is how a `write()` whose short
+    /// return was counted as success survived. This drives the real streaming
+    /// handler over a real connection with chunks that do not divide evenly,
+    /// and checks the bytes on disk rather than just the reported count -- a
+    /// dropped or reordered chunk changes the file even when `bytes_written`
+    /// still adds up.
+    #[tokio::test]
+    async fn receive_file_writes_every_chunk_and_reports_the_full_length() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let (port, _shutdown) = serve_source(service).await;
+
+        let mut client = volume_server_pb::volume_server_client::VolumeServerClient::connect(
+            format!("http://127.0.0.1:{}", port),
+        )
+        .await
+        .unwrap();
+
+        // Deliberately ragged chunk sizes, and a payload whose bytes are
+        // position-dependent so any shift is visible.
+        let payload: Vec<u8> = (0..70_001u32).map(|i| (i % 251) as u8).collect();
+        let mut messages = vec![volume_server_pb::ReceiveFileRequest {
+            data: Some(volume_server_pb::receive_file_request::Data::Info(
+                volume_server_pb::ReceiveFileInfo {
+                    volume_id: 1,
+                    ext: ".recvtest".to_string(),
+                    collection: String::new(),
+                    is_ec_volume: false,
+                    shard_id: 0,
+                    file_size: payload.len() as u64,
+                    disk_type: String::new(),
+                    disk_id: 0,
+                },
+            )),
+        }];
+        for chunk in payload.chunks(7_777) {
+            messages.push(volume_server_pb::ReceiveFileRequest {
+                data: Some(volume_server_pb::receive_file_request::Data::FileContent(
+                    chunk.to_vec(),
+                )),
+            });
+        }
+
+        let response = client
+            .receive_file(tokio_stream::iter(messages))
+            .await
+            .unwrap()
+            .into_inner();
+
+        assert_eq!(response.error, "", "ReceiveFile reported an error");
+        assert_eq!(
+            response.bytes_written,
+            payload.len() as u64,
+            "bytes_written must cover the whole payload"
+        );
+
+        let written = std::fs::read(format!("{}/1.recvtest", dir)).unwrap();
+        assert_eq!(
+            written.len(),
+            payload.len(),
+            "file on disk is a different length than the payload"
+        );
+        assert_eq!(written, payload, "file on disk does not match the payload");
+    }
+
+    /// A volume that mounts on a journal ReceiveFile is still writing must not
+    /// compact it: the rest of the stream would land in the replaced inode and
+    /// be gone at the next mount.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn receive_file_ecj_stream_blocks_mount_compaction() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let (port, _shutdown) = serve_source(service).await;
+        // An empty index is enough to mount; the store never sees this volume,
+        // so ReceiveFile's mounted check lets the .ecj through.
+        std::fs::write(format!("{}/4.ecx", dir), b"").unwrap();
+        let ecj_path = format!("{}/4.ecj", dir);
+
+        // A bloated prefix (100 ids, 4096 times over) the mount would compact,
+        // then an id only the second chunk carries.
+        let mut one = vec![0u8; 100 * NEEDLE_ID_SIZE];
+        for (i, entry) in one.chunks_exact_mut(NEEDLE_ID_SIZE).enumerate() {
+            NeedleId(1000 + i as u64).to_bytes(entry);
+        }
+        let bloated = one.repeat(4096);
+        let mut tail = vec![0u8; NEEDLE_ID_SIZE];
+        NeedleId(5000).to_bytes(&mut tail);
+
+        let mut client = volume_server_pb::volume_server_client::VolumeServerClient::connect(
+            format!("http://127.0.0.1:{}", port),
+        )
+        .await
+        .unwrap();
+        let (tx, rx) = tokio::sync::mpsc::channel(4);
+        let call = tokio::spawn(async move {
+            client
+                .receive_file(tokio_stream::wrappers::ReceiverStream::new(rx))
+                .await
+        });
+        let send = |data| volume_server_pb::ReceiveFileRequest { data: Some(data) };
+        tx.send(send(volume_server_pb::receive_file_request::Data::Info(
+            volume_server_pb::ReceiveFileInfo {
+                volume_id: 4,
+                ext: ".ecj".to_string(),
+                is_ec_volume: true,
+                file_size: (bloated.len() + tail.len()) as u64,
+                ..Default::default()
+            },
+        )))
+        .await
+        .unwrap();
+        tx.send(send(
+            volume_server_pb::receive_file_request::Data::FileContent(bloated.clone()),
+        ))
+        .await
+        .unwrap();
+
+        // Mount once the first chunk is on disk and before the second is sent.
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        while std::fs::metadata(&ecj_path).map_or(0, |m| m.len()) < bloated.len() as u64 {
+            assert!(
+                std::time::Instant::now() < deadline,
+                "first chunk never reached disk"
+            );
+            tokio::time::sleep(std::time::Duration::from_millis(5)).await;
+        }
+        let mount_dir = dir.clone();
+        let mounted = tokio::task::spawn_blocking(move || {
+            crate::storage::erasure_coding::ec_volume::EcVolume::new(
+                &mount_dir,
+                &mount_dir,
+                "",
+                VolumeId(4),
+            )
+        })
+        .await
+        .unwrap()
+        .expect("mount during the stream");
+
+        tx.send(send(
+            volume_server_pb::receive_file_request::Data::FileContent(tail.clone()),
+        ))
+        .await
+        .unwrap();
+        drop(tx);
+        let response = call.await.unwrap().unwrap().into_inner();
+        assert_eq!(response.error, "", "ReceiveFile reported an error");
+        drop(mounted);
+
+        let mut want = bloated;
+        want.extend_from_slice(&tail);
+        let got = std::fs::read(&ecj_path).unwrap();
+        assert_eq!(
+            got.len(),
+            want.len(),
+            "journal on disk is not what the stream sent"
+        );
+        assert!(got == want, "journal on disk is not what the stream sent");
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    #[expect(
+        clippy::await_holding_lock,
+        clippy::readonly_write_lock,
+        reason = "the store write guard is a barrier that parks the copy task at the mount block"
+    )]
+    async fn test_volume_copy_after_mount_cancellation_rolls_back_mount() {
+        let (source_service, _source_tmp, _dat_bytes) = make_local_service_with_large_volume();
+        let (port, _shutdown) = serve_source(source_service).await;
+
+        let (dest_service, dest_tmp) = make_local_service_with_volume("", None);
+        {
+            let mut store = dest_service.state.store.write().unwrap();
+            store
+                .delete_volume(VolumeId(1), false, false, false)
+                .unwrap();
+            for loc in &store.locations {
+                loc.check_disk_space();
+            }
+        }
+        let dest_dir = dest_tmp.path().to_str().unwrap().to_string();
+        let dest_file = |ext: &str| format!("{}/1{}", dest_dir, ext);
+
+        let response = dest_service
+            .volume_copy(Request::new(volume_server_pb::VolumeCopyRequest {
+                volume_id: 1,
+                collection: String::new(),
+                source_data_node: format!("127.0.0.1:1.{}", port),
+                disk_type: String::new(),
+                io_byte_per_second: 0,
+                replication: String::new(),
+                ttl: String::new(),
+            }))
+            .await
+            .unwrap();
+
+        // Hold the store write lock so the task parks at the mount block after
+        // completing the copy and passing the pre-mount is_closed() check.
+        let store_guard = dest_service.state.store.write().unwrap();
+
+        // Give the copy time to complete and the task to reach the mount block.
+        // The 5 MB fixture copies in well under a second on a local loopback
+        // gRPC connection; 2 s is generous and keeps the test fast.
+        tokio::time::sleep(std::time::Duration::from_secs(2)).await;
+
+        // The caller hangs up while the task is parked at the mount block.
+        drop(response);
+
+        // Release the store lock so the task can enter the mount block, mount,
+        // fail the final send, and roll back.
+        drop(store_guard);
+
+        // Wait for the rollback to finish.
+        tokio::time::sleep(std::time::Duration::from_secs(1)).await;
+
+        let store = dest_service.state.store.read().unwrap();
+        assert!(
+            store.find_volume(VolumeId(1)).is_none(),
+            "destination still holds a mounted volume after after-mount cancellation"
+        );
+        drop(store);
+
+        for ext in [".dat", ".idx", ".vif", ".note"] {
+            assert!(
+                !std::path::Path::new(&dest_file(ext)).exists(),
+                "abandoned copy left {} behind",
+                dest_file(ext)
+            );
+        }
+    }
+
+    /// Run a VolumeCopy of volume 1 from `port` to completion and return its
+    /// terminal result: the final response, or the error that ended the copy.
+    async fn run_volume_copy(
+        dest: &VolumeGrpcService,
+        port: u16,
+    ) -> Result<volume_server_pb::VolumeCopyResponse, Status> {
+        let mut stream = dest
+            .volume_copy(Request::new(volume_server_pb::VolumeCopyRequest {
+                volume_id: 1,
+                collection: String::new(),
+                source_data_node: format!("127.0.0.1:1.{}", port),
+                disk_type: String::new(),
+                io_byte_per_second: 0,
+                replication: String::new(),
+                ttl: String::new(),
+            }))
+            .await?
+            .into_inner();
+        tokio::time::timeout(std::time::Duration::from_secs(30), async {
+            let mut last = None;
+            while let Some(msg) = stream.next().await {
+                last = Some(msg?);
+            }
+            last.ok_or_else(|| Status::internal("copy stream ended without a response"))
+        })
+        .await
+        .expect("volume copy must finish")
+    }
+
+    // A replica that is about to be replaced must survive a copy that has
+    // nowhere to land: deleting it before a destination disk is reserved
+    // loses the only local copy when no disk qualifies.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_volume_copy_without_free_disk_keeps_existing_replica() {
+        let (source_service, _source_tmp, _dat_bytes) = make_local_service_with_large_volume();
+        let (port, _shutdown) = serve_source(source_service).await;
+
+        // available_space stays 0 without check_disk_space, so no disk has room.
+        let (dest_service, dest_tmp) = make_local_service_with_volume("", None);
+        let dest_dat = format!("{}/1.dat", dest_tmp.path().to_str().unwrap());
+
+        let err = run_volume_copy(&dest_service, port)
+            .await
+            .expect_err("a copy with no free disk must fail");
+        assert!(err.message().contains("no space left"), "{err:?}");
+
+        let store = dest_service.state.store.read().unwrap();
+        let (_, vol) = store
+            .find_volume(VolumeId(1))
+            .expect("the existing replica must still be mounted");
+        assert_eq!(vol.file_count(), 1, "the existing replica must be intact");
+        assert!(std::path::Path::new(&dest_dat).exists());
+    }
+
+    // Replacing a replica on a disk whose only slot it occupies must succeed:
+    // the slot the replica frees counts as free when choosing a destination.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_volume_copy_replaces_existing_replica_in_its_own_slot() {
+        let (source_service, _source_tmp, _dat_bytes) = make_local_service_with_large_volume();
+        let (port, _shutdown) = serve_source(source_service).await;
+
+        let (dest_service, _dest_tmp) = make_local_service_with_volume("", None);
+        {
+            let store = dest_service.state.store.read().unwrap();
+            for loc in &store.locations {
+                loc.max_volume_count.store(1, Ordering::Relaxed);
+                loc.check_disk_space();
+            }
+        }
+
+        let resp = run_volume_copy(&dest_service, port)
+            .await
+            .expect("replacing a replica in its own slot must succeed");
+        assert!(resp.last_append_at_ns > 0);
+
+        let store = dest_service.state.store.read().unwrap();
+        let (_, vol) = store
+            .find_volume(VolumeId(1))
+            .expect("the copied replica must be mounted");
+        assert_eq!(
+            vol.file_count(),
+            2,
+            "the replica must hold the source's needles"
+        );
+    }
+
+    // A copy whose record counts disagree with a stable source must be
+    // rejected, left unmounted, and cleaned off disk, even though the .dat and
+    // .idx sizes match.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_volume_copy_rejects_record_count_mismatch() {
+        let (source_service, _source_tmp, _dat_bytes) = make_local_service_with_large_volume();
+        {
+            let store = source_service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            vol.add_file_count_for_test(1);
+        }
+        let (port, _shutdown) = serve_source(source_service).await;
+
+        let (dest_service, dest_tmp) = make_local_service_with_volume("", None);
+        {
+            let mut store = dest_service.state.store.write().unwrap();
+            store
+                .delete_volume(VolumeId(1), false, false, false)
+                .unwrap();
+            for loc in &store.locations {
+                loc.check_disk_space();
+            }
+        }
+        let dest_dir = dest_tmp.path().to_str().unwrap().to_string();
+
+        let err = run_volume_copy(&dest_service, port)
+            .await
+            .expect_err("a copy with mismatched record counts must fail");
+        assert!(err.message().contains("file count"), "{err:?}");
+
+        assert!(
+            dest_service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .find_volume(VolumeId(1))
+                .is_none(),
+            "a replica that failed count validation must not stay mounted"
+        );
+        for ext in [".dat", ".idx", ".vif", ".note"] {
+            let path = format!("{}/1{}", dest_dir, ext);
+            assert!(
+                !std::path::Path::new(&path).exists(),
+                "rejected copy left {} behind",
+                path
+            );
+        }
+    }
+
+    /// Lets the first VolumeStatus call through and never answers the ones
+    /// after it, so the source stalls exactly at VolumeCopy's post-copy status
+    /// read.
+    #[derive(Clone)]
+    struct StallLaterVolumeStatus<S> {
+        inner: S,
+        status_calls: Arc<std::sync::atomic::AtomicUsize>,
+        stalled: Arc<tokio::sync::Notify>,
+    }
+
+    impl<S, B> tower::Service<tonic::codegen::http::Request<B>> for StallLaterVolumeStatus<S>
+    where
+        S: tower::Service<tonic::codegen::http::Request<B>>,
+        S::Future: Send + 'static,
+        S::Response: 'static,
+        S::Error: 'static,
+    {
+        type Response = S::Response;
+        type Error = S::Error;
+        type Future = std::pin::Pin<
+            Box<dyn std::future::Future<Output = Result<S::Response, S::Error>> + Send>,
+        >;
+
+        fn poll_ready(
+            &mut self,
+            cx: &mut std::task::Context<'_>,
+        ) -> std::task::Poll<Result<(), Self::Error>> {
+            self.inner.poll_ready(cx)
+        }
+
+        fn call(&mut self, req: tonic::codegen::http::Request<B>) -> Self::Future {
+            if req.uri().path() == "/volume_server_pb.VolumeServer/VolumeStatus"
+                && self.status_calls.fetch_add(1, Ordering::SeqCst) >= 1
+            {
+                self.stalled.notify_one();
+                return Box::pin(std::future::pending());
+            }
+            Box::pin(self.inner.call(req))
+        }
+    }
+
+    // A source that stalls on the post-copy status read must not hold the
+    // copied files once the caller is gone: the old replica is already
+    // deleted and the new one is unmounted, so the task has to notice the
+    // departed caller and clean up like any other failed copy.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_volume_copy_stalled_final_status_cleans_up_when_caller_leaves() {
+        let (source_service, _source_tmp, _dat_bytes) = make_local_service_with_large_volume();
+        let stalled = Arc::new(tokio::sync::Notify::new());
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let (_shutdown_tx, shutdown_rx) = tokio::sync::oneshot::channel::<()>();
+        {
+            let stalled = stalled.clone();
+            let status_calls = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+            tokio::spawn(async move {
+                let _ = tonic::transport::Server::builder()
+                    .layer(tower::layer::layer_fn(move |inner| {
+                        StallLaterVolumeStatus {
+                            inner,
+                            status_calls: status_calls.clone(),
+                            stalled: stalled.clone(),
+                        }
+                    }))
+                    .add_service(
+                        crate::pb::volume_server_pb::volume_server_server::VolumeServerServer::new(
+                            source_service,
+                        ),
+                    )
+                    .serve_with_incoming_shutdown(
+                        tokio_stream::wrappers::TcpListenerStream::new(listener),
+                        async {
+                            let _ = shutdown_rx.await;
+                        },
+                    )
+                    .await;
+            });
+        }
+
+        let (dest_service, dest_tmp) = make_local_service_with_volume("", None);
+        {
+            let mut store = dest_service.state.store.write().unwrap();
+            store
+                .delete_volume(VolumeId(1), false, false, false)
+                .unwrap();
+            for loc in &store.locations {
+                loc.check_disk_space();
+            }
+        }
+        let dest_file = |ext: &str| format!("{}/1{}", dest_tmp.path().to_str().unwrap(), ext);
+
+        let response = dest_service
+            .volume_copy(Request::new(volume_server_pb::VolumeCopyRequest {
+                volume_id: 1,
+                collection: String::new(),
+                source_data_node: format!("127.0.0.1:1.{}", port),
+                disk_type: String::new(),
+                io_byte_per_second: 0,
+                replication: String::new(),
+                ttl: String::new(),
+            }))
+            .await
+            .unwrap();
+
+        tokio::time::timeout(std::time::Duration::from_secs(30), stalled.notified())
+            .await
+            .expect("the copy must reach the post-copy status read");
+        assert!(
+            std::path::Path::new(&dest_file(".dat")).exists(),
+            "the files must be copied before the post-copy status read"
+        );
+
+        drop(response);
+
+        let mut cleaned = false;
+        for _ in 0..100 {
+            tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+            if [".dat", ".idx", ".vif", ".note"]
+                .iter()
+                .all(|ext| !std::path::Path::new(&dest_file(ext)).exists())
+            {
+                cleaned = true;
+                break;
+            }
+        }
+        assert!(
+            cleaned,
+            "a copy stalled on the source's final status left its files behind"
+        );
+        assert!(
+            dest_service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .find_volume(VolumeId(1))
+                .is_none(),
+            "an abandoned copy must not be mounted"
+        );
+    }
+
     // copy_file must stream the whole .dat in 2MB chunks (not buffer it) and
     // reassemble byte-for-byte, with the mtime carried only on the first message.
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -5577,10 +9596,352 @@ mod tests {
         assert_ne!(messages[0].modified_ts_ns, 0);
         assert!(messages[1..].iter().all(|m| m.modified_ts_ns == 0));
 
-        let copied: Vec<u8> = messages.iter().flat_map(|m| m.file_content.clone()).collect();
+        let copied: Vec<u8> = messages
+            .iter()
+            .flat_map(|m| m.file_content.clone())
+            .collect();
         assert_eq!(copied, dat_bytes);
     }
 
+    // volume_tail_sender streams each needle in 2MB chunks with the header on
+    // every chunk, heartbeats once the caller is caught up, and ends when the
+    // idle timeout runs out. Reassembling the stream must reproduce the .dat
+    // after the superblock byte for byte, so a scan that skipped, reordered or
+    // re-sent a record fails here. The fixture holds a small needle and a 5MB
+    // one, covering the single- and multi-chunk paths.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_tail_sender_streams_chunks_then_heartbeats() {
+        let (service, _tmp, dat_bytes) = make_local_service_with_large_volume();
+        let sb_size = {
+            let store = service.state.store.read().unwrap();
+            let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+            v.super_block().block_size()
+        };
+
+        let response = service
+            .volume_tail_sender(Request::new(volume_server_pb::VolumeTailSenderRequest {
+                volume_id: 1,
+                since_ns: 0,
+                idle_timeout_seconds: 1,
+            }))
+            .await
+            .unwrap();
+        let mut stream = response.into_inner();
+        let messages = tokio::time::timeout(std::time::Duration::from_secs(30), async {
+            let mut messages = Vec::new();
+            while let Some(m) = stream.next().await {
+                messages.push(m.unwrap());
+            }
+            messages
+        })
+        .await
+        .expect("the tail must end once its idle timeout runs out");
+
+        let (heartbeats, chunks): (Vec<_>, Vec<_>) =
+            messages.iter().partition(|m| m.needle_header.is_empty());
+        assert_eq!(heartbeats.len(), 1, "one caught-up pass before the timeout");
+        assert!(heartbeats[0].is_last_chunk && heartbeats[0].needle_body.is_empty());
+        assert!(
+            messages.last().unwrap().needle_header.is_empty(),
+            "the heartbeat follows the data"
+        );
+
+        let mut shipped = Vec::new();
+        let mut ids = Vec::new();
+        let mut chunks_per_needle = Vec::new();
+        let mut current_header: Vec<u8> = Vec::new();
+        let mut starting = true;
+        for m in &chunks {
+            if starting {
+                current_header = m.needle_header.clone();
+                shipped.extend_from_slice(&current_header);
+                ids.push(Needle::parse_header(&current_header).1);
+                chunks_per_needle.push(0);
+            } else {
+                assert_eq!(m.needle_header, current_header, "header on every chunk");
+            }
+            shipped.extend_from_slice(&m.needle_body);
+            *chunks_per_needle.last_mut().unwrap() += 1;
+            starting = m.is_last_chunk;
+        }
+        assert!(starting, "the last needle must end on is_last_chunk");
+        assert_eq!(ids, vec![NeedleId(11), NeedleId(99)]);
+        assert_eq!(chunks_per_needle, vec![1, 3], "a 5MB body in 2MB chunks");
+        assert!(
+            shipped == dat_bytes[sb_size..],
+            "the stream must reproduce the .dat after the superblock"
+        );
+    }
+
+    fn write_volume_needle(service: &VolumeGrpcService, id: u64, data: &[u8]) {
+        let store = service.state.store.read().unwrap();
+        let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+        let mut n = Needle {
+            id: NeedleId(id),
+            cookie: Cookie(0x1234),
+            data: data.to_vec(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+    }
+
+    async fn read_all_needles_stream(
+        service: &VolumeGrpcService,
+        volume_ids: Vec<u32>,
+    ) -> BoxStream<volume_server_pb::ReadAllNeedlesResponse> {
+        service
+            .read_all_needles(Request::new(volume_server_pb::ReadAllNeedlesRequest {
+                volume_ids,
+            }))
+            .await
+            .unwrap()
+            .into_inner()
+    }
+
+    async fn collect_read_all(
+        mut stream: BoxStream<volume_server_pb::ReadAllNeedlesResponse>,
+    ) -> Vec<Result<volume_server_pb::ReadAllNeedlesResponse, Status>> {
+        tokio::time::timeout(std::time::Duration::from_secs(30), async {
+            let mut items = Vec::new();
+            while let Some(item) = stream.next().await {
+                items.push(item);
+            }
+            items
+        })
+        .await
+        .expect("the stream must end")
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_read_all_needles_uses_dat_order_for_live_offsets() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        write_volume_needle(&service, 10, b"first");
+        write_volume_needle(&service, 20, b"second");
+        write_volume_needle(&service, 10, b"first-overwrite");
+
+        let items = collect_read_all(read_all_needles_stream(&service, vec![1]).await).await;
+        let needles: Vec<_> = items.into_iter().map(|r| r.unwrap()).collect();
+        let ids: Vec<u64> = needles.iter().map(|n| n.needle_id).collect();
+        let bodies: Vec<&[u8]> = needles.iter().map(|n| n.needle_blob.as_slice()).collect();
+        assert_eq!(ids, vec![11, 20, 10]);
+        assert_eq!(
+            bodies,
+            vec![
+                b"ec-generate".as_slice(),
+                b"second".as_slice(),
+                b"first-overwrite".as_slice()
+            ]
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn read_all_needles_fails_at_a_header_it_cannot_advance_past() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let dat_path = {
+            let store = service.state.store.read().unwrap();
+            let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+            v.file_name(".dat")
+        };
+        let mut corrupt = [0u8; NEEDLE_HEADER_SIZE];
+        NeedleId(99).to_bytes(&mut corrupt[4..12]);
+        Size(-100).to_bytes(&mut corrupt[12..16]);
+        let mut dat = std::fs::OpenOptions::new()
+            .append(true)
+            .open(dat_path)
+            .unwrap();
+        std::io::Write::write_all(&mut dat, &corrupt).unwrap();
+
+        let items = collect_read_all(read_all_needles_stream(&service, vec![1]).await).await;
+        assert_eq!(
+            items.len(),
+            2,
+            "the needle before the corrupt header, then the error"
+        );
+        assert_eq!(items[0].as_ref().unwrap().needle_id, 11);
+        let err = items[1].as_ref().unwrap_err();
+        assert_eq!(err.code(), tonic::Code::Internal);
+        assert!(err.message().contains("corrupt needle header"), "{err:?}");
+    }
+
+    // A damaged body in a copy that was since overwritten must not fail the
+    // stream: only the live copy is parsed.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_read_all_needles_skips_a_corrupt_stale_copy() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let (stale_offset, dat_path) = {
+            let store = service.state.store.read().unwrap();
+            let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+            (v.dat_file_size().unwrap(), v.file_name(".dat"))
+        };
+        write_volume_needle(&service, 50, b"old-data");
+        write_volume_needle(&service, 50, b"new-data");
+        // The first body field is DataSize; u32::MAX cannot fit the record.
+        let mut dat = std::fs::OpenOptions::new()
+            .write(true)
+            .open(dat_path)
+            .unwrap();
+        std::io::Seek::seek(
+            &mut dat,
+            std::io::SeekFrom::Start(stale_offset + NEEDLE_HEADER_SIZE as u64),
+        )
+        .unwrap();
+        std::io::Write::write_all(&mut dat, &u32::MAX.to_be_bytes()).unwrap();
+        drop(dat);
+
+        let items = collect_read_all(read_all_needles_stream(&service, vec![1]).await).await;
+        let needles: Vec<_> = items.into_iter().map(|r| r.unwrap()).collect();
+        let got: Vec<(u64, &[u8])> = needles
+            .iter()
+            .map(|n| (n.needle_id, n.needle_blob.as_slice()))
+            .collect();
+        assert_eq!(
+            got,
+            vec![
+                (11, b"ec-generate".as_slice()),
+                (50, b"new-data".as_slice())
+            ]
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_read_all_needles_reports_a_missing_volume_after_the_found_ones() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let items = collect_read_all(read_all_needles_stream(&service, vec![1, 77]).await).await;
+        assert_eq!(items.len(), 2);
+        assert_eq!(items[0].as_ref().unwrap().needle_id, 11);
+        assert_eq!(items[1].as_ref().unwrap_err().code(), tonic::Code::NotFound);
+    }
+
+    // Open a ReadAllNeedles stream over more needles than its channel holds,
+    // read one message so the scan is known to be running (it then fills the
+    // channel and parks in a send), and apply `f` under store.write(). Returns
+    // the first message and the rest of the stream.
+    async fn park_read_all_then_write(
+        service: &VolumeGrpcService,
+        ids: &[u64],
+        f: impl FnOnce(&crate::storage::volume::Volume),
+    ) -> (
+        volume_server_pb::ReadAllNeedlesResponse,
+        BoxStream<volume_server_pb::ReadAllNeedlesResponse>,
+    ) {
+        for &id in ids {
+            write_volume_needle(service, id, format!("body-{id}").as_bytes());
+        }
+        let mut stream = read_all_needles_stream(service, vec![1]).await;
+        let first = stream.next().await.unwrap().unwrap();
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        loop {
+            // The scan takes a read guard briefly per record, so retry.
+            if let Ok(store) = service.state.store.try_write() {
+                let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+                f(&v);
+                return (first, stream);
+            }
+            if std::time::Instant::now() > deadline {
+                drop(stream);
+                panic!("store.write() stayed blocked while the scan was parked in a send");
+            }
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+    }
+
+    // A client that stops reading parks the scan waiting for channel space. The
+    // store lock must not be held there, or needle writes and the heartbeat,
+    // which take store.write(), stall behind it. A needle overwritten before the
+    // scan reaches it is streamed once, as its new copy, the way Go's scan reads
+    // on to EOF.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_read_all_needles_releases_the_store_lock_while_parked() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let ids: Vec<u64> = (100..140).collect();
+        let (first, stream) = park_read_all_then_write(&service, &ids, |v| {
+            let mut n = Needle {
+                id: NeedleId(138),
+                cookie: Cookie(0x1234),
+                data: b"overwritten".to_vec(),
+                data_size: b"overwritten".len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        })
+        .await;
+
+        let items = collect_read_all(stream).await;
+        let needles: Vec<_> = std::iter::once(first)
+            .chain(items.into_iter().map(|r| r.unwrap()))
+            .collect();
+        let got: Vec<u64> = needles.iter().map(|n| n.needle_id).collect();
+        let mut want = vec![11];
+        want.extend(ids.iter().copied().filter(|&id| id != 138));
+        want.push(138);
+        assert_eq!(got, want);
+        assert_eq!(needles.last().unwrap().needle_blob, b"overwritten");
+    }
+
+    // The record the scan is parked on is checked for liveness only once it has
+    // channel space, so overwriting it meanwhile streams it once, as its new
+    // copy, not the old copy followed by the new one.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_read_all_needles_skips_a_record_overwritten_while_parked() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        for id in 100..104 {
+            write_volume_needle(&service, id, b"old");
+        }
+        let (tx, mut rx) = tokio::sync::mpsc::channel(1);
+        let state = service.state.clone();
+        let producer = tokio::task::spawn_blocking(move || {
+            read_all_needles_of_volume(&state, VolumeId(1), &tx).map_err(|e| e.map(|s| s.code()))
+        });
+        // Needle 11 fills the channel and the scan parks on needle 100.
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+        while rx.len() < rx.max_capacity() {
+            assert!(
+                std::time::Instant::now() < deadline,
+                "the scan never filled the channel"
+            );
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+        // Lets a scan that checks before waiting reach its wait; the fixed
+        // order is correct under any timing.
+        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+        write_volume_needle(&service, 100, b"new");
+
+        let mut got = Vec::new();
+        while let Some(item) = rx.recv().await {
+            let n = item.unwrap();
+            got.push((n.needle_id, n.needle_blob));
+        }
+        assert_eq!(producer.await.unwrap(), Ok(()));
+        let want: Vec<(u64, Vec<u8>)> = vec![
+            (11, b"ec-generate".to_vec()),
+            (101, b"old".to_vec()),
+            (102, b"old".to_vec()),
+            (103, b"old".to_vec()),
+            (100, b"new".to_vec()),
+        ];
+        assert_eq!(got, want);
+    }
+
+    // After a vacuum commit the needle map describes the new .dat, not the
+    // one the scan pinned, so the stream fails instead of guessing.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_read_all_needles_fails_when_the_volume_is_compacted_mid_scan() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let ids: Vec<u64> = (100..140).collect();
+        let (_first, stream) = park_read_all_then_write(&service, &ids, |v| {
+            v.compact_by_index(0, 0, |_| true).unwrap();
+            v.commit_compact().unwrap();
+        })
+        .await;
+
+        let items = collect_read_all(stream).await;
+        let err = items.last().unwrap().as_ref().unwrap_err();
+        assert_eq!(err.code(), tonic::Code::Internal);
+        assert!(err.message().contains("compacted or replaced"), "{err:?}");
+        assert!(items[..items.len() - 1].iter().all(|r| r.is_ok()));
+    }
+
     // copy_file must stop exactly at stop_offset, never streaming past it.
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn test_copy_file_respects_stop_offset() {
@@ -5618,7 +9979,7 @@ mod tests {
         let super_block_size = {
             let store = service.state.store.read().unwrap();
             let (_, v) = store.find_volume(VolumeId(1)).unwrap();
-            v.super_block.block_size() as u64
+            v.super_block().block_size() as u64
         };
 
         let response = service
@@ -5642,7 +10003,10 @@ mod tests {
             "expected multiple streamed chunks, got {}",
             messages.len()
         );
-        let copied: Vec<u8> = messages.iter().flat_map(|m| m.file_content.clone()).collect();
+        let copied: Vec<u8> = messages
+            .iter()
+            .flat_map(|m| m.file_content.clone())
+            .collect();
         assert_eq!(copied, dat_bytes[super_block_size as usize..]);
     }
 
@@ -5693,14 +10057,13 @@ mod tests {
             rack: String::new(),
             file_size_limit_bytes: 0,
             maintenance_byte_per_second: 0,
+            vacuum_commit_slots: None,
+            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
             is_heartbeating: std::sync::atomic::AtomicBool::new(true),
             has_master: false,
             pre_stop_seconds: 0,
             volume_state_notify: tokio::sync::Notify::new(),
             write_queue: std::sync::OnceLock::new(),
-            s3_tier_registry: std::sync::RwLock::new(
-                crate::remote_storage::s3_tier::S3TierRegistry::new(),
-            ),
             read_mode: crate::config::ReadMode::Local,
             allow_untrusted_remote_endpoints: false,
             master_url: master_urls.first().cloned().unwrap_or_default(),
@@ -5721,6 +10084,9 @@ mod tests {
             security_file: String::new(),
             cli_white_list: vec![],
             state_file_path: String::new(),
+            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail_notify: tokio::sync::Notify::new(),
         });
 
         (VolumeGrpcService { state }, tmp)
@@ -5847,6 +10213,204 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn test_read_needle_blob_negative_returns_invalid_argument() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let err = service
+            .read_needle_blob(Request::new(volume_server_pb::ReadNeedleBlobRequest {
+                volume_id: 1,
+                offset: 0,
+                size: -100,
+            }))
+            .await
+            .expect_err("negative size must be rejected");
+        assert_eq!(err.code(), tonic::Code::InvalidArgument);
+    }
+
+    #[tokio::test]
+    async fn test_write_needle_blob_negative_returns_invalid_argument() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let err = service
+            .write_needle_blob(Request::new(volume_server_pb::WriteNeedleBlobRequest {
+                volume_id: 1,
+                needle_id: 11,
+                size: -100,
+                needle_blob: vec![],
+            }))
+            .await
+            .expect_err("negative size must be rejected");
+        assert_eq!(err.code(), tonic::Code::InvalidArgument);
+    }
+
+    #[tokio::test]
+    async fn test_read_needle_blob_zero_size_passes_gate() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        // Size(0) must pass the wire-size gate (may 404/Internal downstream,
+        // but must NOT be rejected as InvalidArgument).
+        match service
+            .read_needle_blob(Request::new(volume_server_pb::ReadNeedleBlobRequest {
+                volume_id: 1,
+                offset: 0,
+                size: 0,
+            }))
+            .await
+        {
+            Ok(_) => {}
+            Err(e) => assert_ne!(e.code(), tonic::Code::InvalidArgument, "got {e:?}"),
+        }
+    }
+
+    // The compaction copy must not hold the store lock: a progress send parked
+    // on a client that stops reading would otherwise stall every read, write
+    // and heartbeat on the node for the rest of the copy.
+    #[test]
+    fn test_vacuum_compact_releases_store_lock_while_progress_send_parks() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let vid = VolumeId(1);
+        let write = |store: &mut crate::storage::store::Store, id: u64, data: &[u8]| {
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(id as u32),
+                data_size: data.len() as u32,
+                data: data.to_vec(),
+                ..Needle::default()
+            };
+            store.write_volume_needle(vid, &mut n, true).unwrap();
+        };
+        {
+            let mut store = service.state.store.write().unwrap();
+            for i in 100..140u64 {
+                write(&mut store, i, format!("data-{i}").as_bytes());
+            }
+        }
+
+        // Report every needle into a one-slot channel nobody reads, so the
+        // copy parks in `blocking_send` after the first report.
+        let (tx, mut rx) = tokio::sync::mpsc::channel(1);
+        let state = service.state.clone();
+        let copy = std::thread::spawn(move || run_vacuum_compact(&state, vid, 0, 0, &tx));
+
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        loop {
+            if let Ok(store) = service.state.store.try_read()
+                && store.find_volume(vid).unwrap().1.is_compacting()
+            {
+                break;
+            }
+            if std::time::Instant::now() > deadline {
+                drop(rx);
+                panic!("the store lock stayed held while the compaction copy was parked");
+            }
+            std::thread::sleep(std::time::Duration::from_millis(10));
+        }
+        {
+            let mut store = service
+                .state
+                .store
+                .try_write()
+                .expect("the store write lock must be free while the copy is parked");
+            assert!(store.find_volume(vid).unwrap().1.is_compacting());
+            write(&mut store, 999, b"late-write");
+        }
+
+        let mut reports = 0;
+        while let Some(msg) = rx.blocking_recv() {
+            msg.expect("the compaction must succeed");
+            reports += 1;
+        }
+        copy.join().unwrap();
+        assert!(reports > 1, "every needle should have been reported");
+
+        let mut store = service.state.store.write().unwrap();
+        store.commit_compact_volume(vid).unwrap();
+        let mut n = Needle {
+            id: NeedleId(999),
+            cookie: Cookie(999),
+            ..Needle::default()
+        };
+        store.read_volume_needle(vid, &mut n).unwrap();
+        assert_eq!(n.data, b"late-write");
+    }
+
+    #[test]
+    fn test_vacuum_compact_stops_when_the_client_is_gone_before_a_report() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let vid = VolumeId(1);
+        let cpd = {
+            let store = service.state.store.read().unwrap();
+            for i in 100..110u64 {
+                let data = format!("data-{i}");
+                let mut n = Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(i as u32),
+                    data_size: data.len() as u32,
+                    data: data.into_bytes(),
+                    ..Needle::default()
+                };
+                store.write_volume_needle(vid, &mut n, true).unwrap();
+            }
+            store.find_volume(vid).unwrap().1.file_name(".cpd")
+        };
+
+        // The client is gone and no report is due for 128 MiB.
+        let (tx, rx) = tokio::sync::mpsc::channel(1);
+        drop(rx);
+        run_vacuum_compact(&service.state, vid, 0, COMPACT_REPORT_INTERVAL, &tx);
+
+        assert!(
+            !std::path::Path::new(&cpd).exists(),
+            "the copy ran to the end after its client disconnected"
+        );
+        let store = service.state.store.read().unwrap();
+        assert!(!store.find_volume(vid).unwrap().1.is_compacting());
+    }
+
+    // VolumeConfigure unmounts, rewrites the super block and remounts. While
+    // a copy is in flight the unmount is refused, and configure must stop
+    // there rather than rewrite the .dat the copy is reading.
+    #[tokio::test]
+    async fn test_volume_configure_refused_while_compacting() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let vid = VolumeId(1);
+        let job = service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .begin_compact_volume(vid, 0)
+            .unwrap()
+            .unwrap();
+
+        let resp = service
+            .volume_configure(Request::new(volume_server_pb::VolumeConfigureRequest {
+                volume_id: vid.0,
+                replication: "001".to_string(),
+            }))
+            .await
+            .unwrap()
+            .into_inner();
+        assert!(resp.error.contains("is compacting"), "{}", resp.error);
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, v) = store.find_volume(vid).expect("still mounted");
+            assert_eq!(v.super_block().replica_placement.to_string(), "000");
+        }
+
+        job.run(|_| true).unwrap();
+        let resp = service
+            .volume_configure(Request::new(volume_server_pb::VolumeConfigureRequest {
+                volume_id: vid.0,
+                replication: "001".to_string(),
+            }))
+            .await
+            .unwrap()
+            .into_inner();
+        assert_eq!(resp.error, "");
+        let store = service.state.store.read().unwrap();
+        let (_, v) = store.find_volume(vid).unwrap();
+        assert_eq!(v.super_block().replica_placement.to_string(), "001");
+    }
+
     // Regression test for comparing the wrong compaction-revision field.
     // last_compact_revision() is bookkeeping recorded just before a compaction
     // starts (for makeup-diff catch-up) and is intentionally left behind
@@ -5863,14 +10427,18 @@ mod tests {
         // actually diverge the way they do in production, rather than poking
         // the struct fields directly.
         let (revision_before, revision_after, last_compact_revision_after) = {
-            let mut store = service.state.store.write().unwrap();
-            let (_, v) = store.find_volume_mut(VolumeId(1)).unwrap();
-            let before = v.super_block.compaction_revision;
+            let store = service.state.store.read().unwrap();
+            let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+            let before = v.super_block().compaction_revision;
 
             v.compact_by_index(0, 0, |_| true).unwrap();
             v.commit_compact().unwrap();
 
-            (before, v.super_block.compaction_revision, v.last_compact_revision())
+            (
+                before,
+                v.super_block().compaction_revision,
+                v.last_compact_revision(),
+            )
         };
 
         assert_eq!(revision_before, 0, "fresh volume starts at revision 0");
@@ -5971,4 +10539,2888 @@ mod tests {
         assert!(vif.expire_at_sec >= before + ttl.to_seconds());
         assert!(vif.expire_at_sec <= before + ttl.to_seconds() + 5);
     }
+
+    /// The worker EC encode reads ExpireAtSec out of ReadVolumeFileStatus, so
+    /// persisting a readonly mark must stamp it into the live volume_info too,
+    /// not only into the written .vif. A creation-time stamp would sit a full
+    /// last-write interval early.
+    #[tokio::test]
+    async fn test_mark_readonly_persist_reports_expire_at_sec() {
+        let ttl = crate::storage::needle::ttl::TTL::read("3m").unwrap();
+        let (service, _tmp) = make_local_service_with_volume("ttl", Some(ttl));
+
+        // A later write must move the expiry: pin it ahead of the setup write
+        // so the stale creation-time stamp cannot collide on the same second.
+        let last_write = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_secs()
+            + 60;
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .find_volume(VolumeId(1))
+            .unwrap()
+            .1
+            .set_last_modified_ts_for_test(last_write);
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .find_volume(VolumeId(1))
+            .unwrap()
+            .1
+            .set_read_only_persist(false, true)
+            .unwrap();
+
+        let status = service
+            .read_volume_file_status(Request::new(
+                volume_server_pb::ReadVolumeFileStatusRequest { volume_id: 1 },
+            ))
+            .await
+            .unwrap()
+            .into_inner();
+        assert_eq!(
+            status.volume_info.unwrap().expire_at_sec,
+            last_write + ttl.to_seconds()
+        );
+    }
+
+    /// A re-encode must not mix artifacts from a previous run. Generate used to
+    /// go straight into the encode, truncating only the `.ecNN` files on the
+    /// encoding disk; a stale shard on a sibling disk survived and was later
+    /// mounted against the new `.ecx`. Go evicts the EcVolume and sweeps every
+    /// disk first (UnloadEcVolume + removeStaleEcArtifacts).
+    #[tokio::test]
+    async fn test_volume_ec_shards_generate_sweeps_stale_artifacts_on_every_disk() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let sibling = TempDir::new().unwrap();
+        let sibling_dir = sibling.path().to_str().unwrap();
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .add_location(
+                sibling_dir,
+                sibling_dir,
+                10,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+
+        let generate = || {
+            service.volume_ec_shards_generate(Request::new(
+                volume_server_pb::VolumeEcShardsGenerateRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                },
+            ))
+        };
+        generate().await.unwrap();
+        service
+            .volume_ec_shards_mount(Request::new(volume_server_pb::VolumeEcShardsMountRequest {
+                volume_id: 1,
+                collection: String::new(),
+                shard_ids: (0..14).collect(),
+                source_disk_type: String::new(),
+                recover_missing_index: false,
+            }))
+            .await
+            .unwrap();
+        assert!(
+            service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .has_ec_volume(VolumeId(1))
+        );
+
+        // A prior run's leftovers on the sibling disk. `.ec20` is outside the
+        // 10+4 ratio: the sweep scans the shard-id cap, not the current total.
+        let stale = [
+            ".ec03",
+            ".ec20",
+            ".ecx",
+            ".ecj",
+            ".ecsum",
+            ".ecsum.v2",
+            ".vif",
+        ];
+        for ext in stale {
+            std::fs::write(sibling.path().join(format!("1{}", ext)), b"stale-run").unwrap();
+        }
+
+        // Drain the permit the mount above left, so the wake-up asserted below
+        // can only come from the re-generate's unload.
+        let notify = &service.state.volume_state_notify;
+        let _ = tokio::time::timeout(std::time::Duration::ZERO, notify.notified()).await;
+
+        generate().await.unwrap();
+
+        assert!(
+            tokio::time::timeout(std::time::Duration::ZERO, notify.notified())
+                .await
+                .is_ok(),
+            "unloading the mounted shards must wake the heartbeat"
+        );
+
+        for ext in stale {
+            assert!(
+                !sibling.path().join(format!("1{}", ext)).exists(),
+                "stale 1{} on the sibling disk must not survive a re-generate",
+                ext
+            );
+        }
+        assert!(
+            !service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .has_ec_volume(VolumeId(1)),
+            "the mounted EC volume must be unloaded before its files are swept"
+        );
+        // The source volume and the fresh run stay on the encoding disk.
+        for ext in [".dat", ".idx", ".vif", ".ecx", ".ecsum", ".ec00", ".ec13"] {
+            assert!(
+                tmp.path().join(format!("1{}", ext)).exists(),
+                "1{} must exist on the encoding disk after a re-generate",
+                ext
+            );
+        }
+        assert!(
+            service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .find_volume(VolumeId(1))
+                .is_some(),
+            "the source volume stays loaded"
+        );
+    }
+
+    /// Blanket full teardown (`encode_ts_ns == 0`) on a split-disk volume:
+    /// like Go's Store.UnloadEcVolume, every disk unregisters its EcVolume
+    /// and returns its ec_shards gauge before the files are unlinked.
+    #[tokio::test]
+    async fn test_volume_ec_shards_delete_full_teardown_unloads_every_disk() {
+        let collection = "ecdel-blanket";
+        let vid = VolumeId(7060);
+        let gauge = crate::metrics::VOLUME_GAUGE.with_label_values(&[collection, "ec_shards"]);
+        let gauge_before_mount = gauge.get();
+
+        let (service, tmp) = SplitDiskEcFixture {
+            collection,
+            ..SplitDiskEcFixture::new(vid.0)
+        }
+        .build();
+        {
+            let store = service.state.store.read().unwrap();
+            assert_eq!(store.locations.len(), 2);
+            for (disk_id, loc) in store.locations.iter().enumerate() {
+                assert!(
+                    loc.has_ec_volume(vid),
+                    "fixture must mount the vid on disk {disk_id} for this to be meaningful"
+                );
+            }
+        }
+        assert_eq!(
+            gauge.get(),
+            gauge_before_mount + 2.0,
+            "fixture must account one shard per disk"
+        );
+
+        let resp = service
+            .volume_ec_shards_delete(Request::new(
+                volume_server_pb::VolumeEcShardsDeleteRequest {
+                    volume_id: vid.0,
+                    collection: collection.to_string(),
+                    shard_ids: Vec::new(),
+                    full_teardown: true,
+                    encode_ts_ns: 0,
+                    delete_generations_older_than: 0,
+                },
+            ))
+            .await
+            .unwrap()
+            .into_inner();
+        assert!(resp.full_teardown_done);
+
+        {
+            let store = service.state.store.read().unwrap();
+            for (disk_id, loc) in store.locations.iter().enumerate() {
+                assert!(
+                    !loc.has_ec_volume(vid),
+                    "blanket full teardown must unload the EcVolume on disk {disk_id}, \
+                     not just the first disk holding the vid"
+                );
+            }
+        }
+        assert_eq!(
+            gauge.get(),
+            gauge_before_mount,
+            "the ec_shards gauge must return to its pre-mount value"
+        );
+        for (dir, ext) in [("data0", ".ec00"), ("data1", ".ec01"), ("data1", ".ecx")] {
+            let path = tmp
+                .path()
+                .join(dir)
+                .join(format!("{}_{}{}", collection, vid.0, ext));
+            assert!(!path.exists(), "{} must be gone", path.display());
+        }
+    }
+
+    /// Fenced teardown (`encode_ts_ns != 0`) unloads only a disk whose
+    /// generation is strictly older than the request, as Go's
+    /// location.UnloadEcVolume does, returning the ec_shards gauge it held.
+    #[tokio::test]
+    async fn test_volume_ec_shards_delete_fenced_teardown_gives_back_gauge_for_older_disk() {
+        let collection = "ecdel-fenced";
+        let vid = VolumeId(7061);
+        let gauge = crate::metrics::VOLUME_GAUGE.with_label_values(&[collection, "ec_shards"]);
+        let gauge_before_mount = gauge.get();
+
+        // dir0 carries generation 100, dir1 generation 200: a fence at 150
+        // wipes dir0 alone.
+        let (service, tmp) = SplitDiskEcFixture {
+            collection,
+            dir0_encode_ts_ns: Some(100),
+            dir1_encode_ts_ns: 200,
+            ..SplitDiskEcFixture::new(vid.0)
+        }
+        .build();
+        {
+            let store = service.state.store.read().unwrap();
+            assert_eq!(
+                store.locations[0].ec_generation_ts_ns(collection, vid),
+                Some(100)
+            );
+            assert_eq!(
+                store.locations[1].ec_generation_ts_ns(collection, vid),
+                Some(200)
+            );
+            assert!(store.locations[0].has_ec_volume(vid));
+            assert!(store.locations[1].has_ec_volume(vid));
+        }
+        assert_eq!(
+            gauge.get(),
+            gauge_before_mount + 2.0,
+            "fixture must account one shard per disk"
+        );
+
+        let resp = service
+            .volume_ec_shards_delete(Request::new(
+                volume_server_pb::VolumeEcShardsDeleteRequest {
+                    volume_id: vid.0,
+                    collection: collection.to_string(),
+                    shard_ids: Vec::new(),
+                    full_teardown: true,
+                    encode_ts_ns: 150,
+                    delete_generations_older_than: 0,
+                },
+            ))
+            .await
+            .unwrap()
+            .into_inner();
+        assert!(resp.full_teardown_done);
+
+        {
+            let store = service.state.store.read().unwrap();
+            assert!(
+                !store.locations[0].has_ec_volume(vid),
+                "the strictly-older disk must be unloaded"
+            );
+            assert!(
+                store.locations[1].has_ec_volume(vid),
+                "the newer disk must be preserved"
+            );
+        }
+        assert_eq!(
+            gauge.get(),
+            gauge_before_mount + 1.0,
+            "fenced teardown must give back the ec_shards gauge for the older \
+             disk's shard and leave the preserved disk's shard counted"
+        );
+        let older_shard = tmp
+            .path()
+            .join("data0")
+            .join(format!("{}_{}.ec00", collection, vid.0));
+        assert!(
+            !older_shard.exists(),
+            "{} must be gone",
+            older_shard.display()
+        );
+        let newer_shard = tmp
+            .path()
+            .join("data1")
+            .join(format!("{}_{}.ec01", collection, vid.0));
+        assert!(
+            newer_shard.exists(),
+            "{} must survive",
+            newer_shard.display()
+        );
+    }
+
+    /// A full teardown wipes the 2PC-staged <base>.*.v<N> files together with
+    /// the canonical ones: they are invisible to EC bookkeeping, so anything
+    /// left behind leaks forever (Go removeStaleEcArtifacts).
+    #[tokio::test]
+    async fn test_volume_ec_shards_delete_teardown_removes_staged_generations() {
+        let collection = "ecdel-gens";
+        let vid = VolumeId(7062);
+        let (service, tmp) = SplitDiskEcFixture {
+            collection,
+            ..SplitDiskEcFixture::new(vid.0)
+        }
+        .build();
+
+        for ext in [".ec00.v3", ".ecx.v3", ".vif.v3", ".ecsum.v3"] {
+            std::fs::write(
+                tmp.path()
+                    .join("data0")
+                    .join(format!("{}_{}{}", collection, vid.0, ext)),
+                b"staged",
+            )
+            .unwrap();
+        }
+
+        service
+            .volume_ec_shards_delete(Request::new(
+                volume_server_pb::VolumeEcShardsDeleteRequest {
+                    volume_id: vid.0,
+                    collection: collection.to_string(),
+                    shard_ids: Vec::new(),
+                    full_teardown: true,
+                    encode_ts_ns: 0,
+                    delete_generations_older_than: 0,
+                },
+            ))
+            .await
+            .unwrap();
+
+        for dir in ["data0", "data1"] {
+            let leftover = std::fs::read_dir(tmp.path().join(dir))
+                .unwrap()
+                .flatten()
+                .filter(|e| {
+                    e.file_name()
+                        .to_string_lossy()
+                        .starts_with(&format!("{}_{}.", collection, vid.0))
+                })
+                .count();
+            assert_eq!(leftover, 0, "teardown must leave no EC files in {dir}");
+        }
+    }
+
+    /// Post-commit cleanup removes only staged generations strictly below the
+    /// threshold; the committed generation and live canonical files stay
+    /// (Go VolumeEcShardsDelete delete_generations_older_than).
+    #[tokio::test]
+    async fn test_volume_ec_shards_delete_generations_older_than() {
+        let collection = "ecdel-gc";
+        let vid = VolumeId(7063);
+        let (service, tmp) = SplitDiskEcFixture {
+            collection,
+            ..SplitDiskEcFixture::new(vid.0)
+        }
+        .build();
+
+        let staged = |ext: &str| {
+            tmp.path()
+                .join("data0")
+                .join(format!("{}_{}{}", collection, vid.0, ext))
+        };
+        for ext in [".ec00.v3", ".ecx.v3", ".vif.v3", ".ec00.v7"] {
+            std::fs::write(staged(ext), b"staged").unwrap();
+        }
+
+        service
+            .volume_ec_shards_delete(Request::new(
+                volume_server_pb::VolumeEcShardsDeleteRequest {
+                    volume_id: vid.0,
+                    collection: collection.to_string(),
+                    shard_ids: Vec::new(),
+                    full_teardown: false,
+                    encode_ts_ns: 0,
+                    delete_generations_older_than: 5,
+                },
+            ))
+            .await
+            .unwrap();
+
+        for ext in [".ec00.v3", ".ecx.v3", ".vif.v3"] {
+            assert!(
+                !staged(ext).exists(),
+                "{} must be removed",
+                staged(ext).display()
+            );
+        }
+        assert!(
+            staged(".ec00.v7").exists(),
+            "the committed generation must be preserved"
+        );
+        assert!(
+            tmp.path()
+                .join("data0")
+                .join(format!("{}_{}.ec00", collection, vid.0))
+                .exists(),
+            "canonical shards must be preserved"
+        );
+        assert!(
+            service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .locations[0]
+                .has_ec_volume(vid),
+            "mounted shards must stay mounted"
+        );
+    }
+
+    /// REGRESSION: a node-wide scrub must survive a volume that legitimately
+    /// disappears while it runs.
+    ///
+    /// Nothing is held across the scan, so the volume set changes under the
+    /// loop: the heartbeat drops a volume that reported an I/O error, and a
+    /// delete or an unmount can land between any two volumes. Aborting there
+    /// discards every result gathered so far and leaves every later volume
+    /// unscrubbed — on a large node, one expiry costs a whole scrub pass.
+    ///
+    /// The absent id goes FIRST, so the assertion fails if the abort ever comes
+    /// back: the volume behind it would never be reached.
+    #[tokio::test]
+    async fn test_scrub_skips_a_vanished_volume_and_scrubs_the_rest() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+
+        let resp = service
+            .scrub_volumes(
+                &volume_server_pb::ScrubVolumeRequest {
+                    mode: 1,
+                    volume_ids: Vec::new(),
+                    mark_broken_volumes_readonly: false,
+                },
+                vec![VolumeId(17), VolumeId(1)],
+                false,
+            )
+            .await
+            .expect("a volume missing from the node's own listing must not fail the scrub")
+            .into_inner();
+
+        assert_eq!(
+            resp.total_volumes, 1,
+            "the volume behind the vanished one must still be scrubbed"
+        );
+    }
+
+    /// A caller who NAMES a volume that is not here is making a mistake, not
+    /// racing a teardown, and still gets told — callers match on the message.
+    #[tokio::test]
+    async fn test_scrub_fails_on_an_explicitly_requested_missing_volume() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+
+        let err = service
+            .scrub_volumes(
+                &volume_server_pb::ScrubVolumeRequest {
+                    mode: 1,
+                    volume_ids: vec![17],
+                    mark_broken_volumes_readonly: false,
+                },
+                vec![VolumeId(17)],
+                true,
+            )
+            .await
+            .expect_err("an explicitly requested missing volume must still fail");
+
+        assert_eq!(err.code(), tonic::Code::NotFound);
+        assert!(err.message().contains("volume id 17 not found"), "{}", err);
+    }
+
+    /// A volume can vanish between make_volume_readonly's lookup and its write
+    /// lock, a window spanning the step-1 master round trip; Go's
+    /// MarkVolumeReadonly answers "not found" there. Holding the
+    /// current_master_url write guard parks the call after its lookup, so
+    /// join!'s in-order polls land the unmount inside the window.
+    #[tokio::test]
+    async fn test_make_volume_readonly_answers_not_found_when_volume_vanished_under_lock() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let park = service.state.current_master_url.write().await;
+
+        let (result, ()) = tokio::join!(
+            service.make_volume_readonly(VolumeId(1), false, true),
+            async {
+                assert!(
+                    service
+                        .state
+                        .store
+                        .write()
+                        .unwrap()
+                        .unmount_volume(VolumeId(1))
+                        .unwrap(),
+                    "the volume must still be mounted when the lookup ran"
+                );
+                drop(park);
+            }
+        );
+
+        let err = result.expect_err("marking a volume that vanished under the lock must fail");
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err:?}");
+        assert!(err.message().contains("volume 1 not found"), "{err:?}");
+    }
+
+    /// Same rule for EC volumes, which the heartbeat also expires under a store
+    /// write: delete_expired_ec_volumes destroys a volume whose destroy time has
+    /// passed, and volume_ec_shards_delete unmounts one on demand.
+    #[tokio::test]
+    async fn test_ec_scrub_skips_a_vanished_volume_and_scrubs_the_rest() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        service
+            .volume_ec_shards_generate(Request::new(
+                volume_server_pb::VolumeEcShardsGenerateRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                },
+            ))
+            .await
+            .unwrap();
+        service
+            .volume_ec_shards_mount(Request::new(volume_server_pb::VolumeEcShardsMountRequest {
+                volume_id: 1,
+                collection: String::new(),
+                shard_ids: (0..14).collect(),
+                source_disk_type: String::new(),
+                recover_missing_index: false,
+            }))
+            .await
+            .unwrap();
+
+        let resp = service
+            .scrub_ec_volumes(
+                &volume_server_pb::ScrubEcVolumeRequest {
+                    mode: 1,
+                    volume_ids: Vec::new(),
+                    force_deleted_needles_check: false,
+                },
+                vec![VolumeId(17), VolumeId(1)],
+                false,
+            )
+            .await
+            .expect("an EC volume missing from the node's own listing must not fail the scrub")
+            .into_inner();
+
+        assert_eq!(
+            resp.total_volumes, 1,
+            "the EC volume behind the vanished one must still be scrubbed"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_ec_scrub_fails_on_an_explicitly_requested_missing_volume() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+
+        let err = service
+            .scrub_ec_volumes(
+                &volume_server_pb::ScrubEcVolumeRequest {
+                    mode: 1,
+                    volume_ids: vec![17],
+                    force_deleted_needles_check: false,
+                },
+                vec![VolumeId(17)],
+                true,
+            )
+            .await
+            .expect_err("an explicitly requested missing EC volume must still fail");
+
+        assert_eq!(err.code(), tonic::Code::NotFound);
+        assert!(
+            err.message().contains("EC volume id 17 not found"),
+            "{}",
+            err
+        );
+    }
+
+    async fn scrub_ec_volume_1(
+        service: &VolumeGrpcService,
+        mode: i32,
+    ) -> volume_server_pb::ScrubEcVolumeResponse {
+        service
+            .scrub_ec_volume(Request::new(volume_server_pb::ScrubEcVolumeRequest {
+                mode,
+                volume_ids: vec![1],
+                force_deleted_needles_check: false,
+            }))
+            .await
+            .unwrap()
+            .into_inner()
+    }
+
+    #[tokio::test]
+    async fn test_scrub_ec_volume_reads_mode_reconstructs_missing_shard() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        service
+            .volume_ec_shards_generate(Request::new(
+                volume_server_pb::VolumeEcShardsGenerateRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                },
+            ))
+            .await
+            .unwrap();
+        service
+            .volume_ec_shards_mount(Request::new(volume_server_pb::VolumeEcShardsMountRequest {
+                volume_id: 1,
+                collection: String::new(),
+                shard_ids: (0..14).collect(),
+                source_disk_type: String::new(),
+                recover_missing_index: false,
+            }))
+            .await
+            .unwrap();
+
+        // Seed the shard-location cache so the scrub skips the master lookup.
+        // The explicit-gRPC-port form targets port 1, so remote reads fail fast
+        // with connection-refused instead of resolving to a live local port.
+        {
+            let store = service.state.store.read().unwrap();
+            let ecv = store.find_ec_volume(VolumeId(1)).unwrap();
+            ecv.merge_shard_locations(
+                (0u8..14)
+                    .map(|sid| (sid, vec!["127.0.0.1:255.1".to_string()]))
+                    .collect(),
+            );
+        }
+
+        // All shards local: FULL is clean.
+        let resp = scrub_ec_volume_1(&service, 2).await;
+        assert!(resp.broken_volume_ids.is_empty(), "{:?}", resp.details);
+        assert_eq!(resp.total_files, 1);
+
+        service
+            .volume_ec_shards_unmount(Request::new(
+                volume_server_pb::VolumeEcShardsUnmountRequest {
+                    volume_id: 1,
+                    shard_ids: vec![0],
+                    encode_ts_ns: 0,
+                },
+            ))
+            .await
+            .unwrap();
+
+        // With a shard unreadable, FULL flags it AND fails the needle...
+        let resp = scrub_ec_volume_1(&service, 2).await;
+        assert_eq!(resp.broken_volume_ids, vec![1]);
+        assert!(resp.broken_shard_infos.iter().any(|s| s.shard_id == 0));
+        assert!(!resp.details.is_empty());
+
+        // ...while READS still reports the shard broken but reconstructs the
+        // interval from the local survivors, so no needle errors surface.
+        let resp = scrub_ec_volume_1(&service, 5).await;
+        assert_eq!(resp.broken_volume_ids, vec![1]);
+        assert!(resp.broken_shard_infos.iter().any(|s| s.shard_id == 0));
+        assert!(resp.details.is_empty(), "{:?}", resp.details);
+        assert_eq!(resp.total_files, 1);
+    }
+
+    async fn needle_status(
+        service: &VolumeGrpcService,
+        needle_id: u64,
+    ) -> Result<volume_server_pb::VolumeNeedleStatusResponse, Status> {
+        service
+            .volume_needle_status(Request::new(volume_server_pb::VolumeNeedleStatusRequest {
+                volume_id: 1,
+                needle_id,
+            }))
+            .await
+            .map(Response::into_inner)
+    }
+
+    async fn generate_and_mount_ec_1(service: &VolumeGrpcService, shard_ids: Vec<u32>) {
+        service
+            .volume_ec_shards_generate(Request::new(
+                volume_server_pb::VolumeEcShardsGenerateRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                },
+            ))
+            .await
+            .unwrap();
+        mount_ec_1(service, shard_ids).await;
+    }
+
+    async fn mount_ec_1(service: &VolumeGrpcService, shard_ids: Vec<u32>) {
+        service
+            .volume_ec_shards_mount(Request::new(volume_server_pb::VolumeEcShardsMountRequest {
+                volume_id: 1,
+                collection: String::new(),
+                shard_ids,
+                source_disk_type: String::new(),
+                recover_missing_index: false,
+            }))
+            .await
+            .unwrap();
+    }
+
+    /// Leaves `service` holding only EC shard 1 of volume 1, with shard 0 (the
+    /// one with needle 11's bytes) served by a peer; `peer_deletes` journals
+    /// the needle's delete on the peer alone.
+    async fn put_ec_1_needle_shard_on_a_peer(
+        service: &VolumeGrpcService,
+        tmp: &TempDir,
+        peer_deletes: bool,
+    ) -> (TempDir, tokio::sync::oneshot::Sender<()>) {
+        // One local shard, not the needle's: only a peer read can answer.
+        generate_and_mount_ec_1(service, vec![1]).await;
+
+        let (peer, peer_tmp) = make_local_service_with_volume("", None);
+        peer.state
+            .store
+            .write()
+            .unwrap()
+            .unmount_volume(VolumeId(1))
+            .unwrap();
+        for entry in std::fs::read_dir(tmp.path()).unwrap() {
+            let name = entry.unwrap().file_name().into_string().unwrap();
+            if name.starts_with("1.ec") || name == "1.vif" {
+                std::fs::copy(tmp.path().join(&name), peer_tmp.path().join(&name)).unwrap();
+            }
+        }
+        mount_ec_1(&peer, vec![0]).await;
+        if peer_deletes {
+            peer.state
+                .store
+                .write()
+                .unwrap()
+                .find_ec_volume_mut(VolumeId(1))
+                .unwrap()
+                .journal_delete(NeedleId(11))
+                .unwrap();
+        }
+        let (port, shutdown) = serve_source(peer).await;
+
+        {
+            let mut store = service.state.store.write().unwrap();
+            store.unmount_volume(VolumeId(1)).unwrap();
+            store
+                .find_ec_volume(VolumeId(1))
+                .unwrap()
+                .merge_shard_locations(
+                    (0u8..14)
+                        .map(|sid| {
+                            let addr = if sid == 0 {
+                                format!("127.0.0.1:{port}.{port}")
+                            } else {
+                                "127.0.0.1:255.1".to_string()
+                            };
+                            (sid, vec![addr])
+                        })
+                        .collect(),
+                );
+        }
+        (peer_tmp, shutdown)
+    }
+
+    /// fs.verify asks every EC shard holder, so a node that does not hold the
+    /// shard with the needle's bytes must fetch them from a peer, as Go does.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_volume_needle_status_reads_an_ec_needle_from_a_peer_shard() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let want = needle_status(&service, 11).await.unwrap();
+        let _peer = put_ec_1_needle_shard_on_a_peer(&service, &tmp, false).await;
+
+        let got = needle_status(&service, 11)
+            .await
+            .expect("the needle's shard is on a reachable peer");
+        assert_eq!(got, want);
+    }
+
+    /// The local .ecx still shows the needle live; the peer's answer that it is
+    /// deleted must reach fs.verify as Go's ErrorDeleted, not as a missing needle.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_volume_needle_status_reports_a_peer_reported_ec_deletion() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let _peer = put_ec_1_needle_shard_on_a_peer(&service, &tmp, true).await;
+
+        let err = needle_status(&service, 11).await.unwrap_err();
+        assert_eq!(err.code(), tonic::Code::Unknown, "{err}");
+        assert_eq!(err.message(), "already deleted");
+    }
+
+    /// A volume unmounted before the EC read resolves it is "volume not found",
+    /// which fs.verify does not count as a lost needle.
+    #[tokio::test]
+    async fn test_volume_needle_status_reports_a_vanished_volume_as_not_found() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .unmount_volume(VolumeId(1))
+            .unwrap();
+
+        let miss = crate::server::store_ec::read_ec_shard_needle_or_miss(
+            &service.state,
+            VolumeId(1),
+            NeedleId(11),
+        )
+        .await
+        .unwrap()
+        .unwrap_err();
+        assert_eq!(miss, crate::server::store_ec::EcMiss::VolumeNotFound);
+
+        let err = needle_status(&service, 11).await.unwrap_err();
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err}");
+        assert_eq!(err.message(), "volume not found 1");
+    }
+
+    /// Go returns ErrorDeleted as a plain error, which fs.verify skips by
+    /// message; a NotFound "needle not found" would class it as missing.
+    #[tokio::test]
+    async fn test_volume_needle_status_reports_deleted_needles_like_go() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+
+        let err = needle_status(&service, 12345).await.unwrap_err();
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err}");
+        assert_eq!(err.message(), "needle not found 12345");
+
+        generate_and_mount_ec_1(&service, (0..14).collect()).await;
+        {
+            let store = service.state.store.read().unwrap();
+            let mut n = Needle {
+                id: NeedleId(11),
+                cookie: Cookie(0x3344),
+                ..Needle::default()
+            };
+            store.delete_volume_needle(VolumeId(1), &mut n).unwrap();
+        }
+        let err = needle_status(&service, 11).await.unwrap_err();
+        assert_eq!(err.code(), tonic::Code::Unknown, "{err}");
+        assert_eq!(err.message(), "already deleted");
+
+        // The EC copy still has the needle live until its own delete lands.
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .unmount_volume(VolumeId(1))
+            .unwrap();
+        assert_eq!(needle_status(&service, 11).await.unwrap().cookie, 0x3344);
+
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .find_ec_volume_mut(VolumeId(1))
+            .unwrap()
+            .journal_delete(NeedleId(11))
+            .unwrap();
+        let err = needle_status(&service, 11).await.unwrap_err();
+        assert_eq!(err.code(), tonic::Code::Unknown, "{err}");
+        assert_eq!(err.message(), "already deleted");
+
+        let err = needle_status(&service, 12345).await.unwrap_err();
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err}");
+        assert_eq!(err.message(), "needle not found 12345");
+    }
+
+    /// Volume 1 as EC only, all 14 shards local: needle 11 (cookie 0x3344) and
+    /// chunk manifest needle 12 (cookie 0x5566).
+    async fn ec_1_with_a_manifest_needle() -> (VolumeGrpcService, TempDir) {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, volume) = store.find_volume(VolumeId(1)).unwrap();
+            let mut manifest = Needle {
+                id: NeedleId(12),
+                cookie: Cookie(0x5566),
+                data: b"[]".to_vec(),
+                data_size: 2,
+                ..Needle::default()
+            };
+            manifest.set_is_chunk_manifest();
+            volume.write_needle(&mut manifest, true, false).unwrap();
+            volume.sync_to_disk().unwrap();
+        }
+        generate_and_mount_ec_1(&service, (0..14).collect()).await;
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .unmount_volume(VolumeId(1))
+            .unwrap();
+        (service, tmp)
+    }
+
+    async fn batch_delete_1(
+        service: &VolumeGrpcService,
+        needle_id: u64,
+        cookie: u32,
+        skip_cookie_check: bool,
+    ) -> (i32, String) {
+        let fid = needle::FileId::new(VolumeId(1), NeedleId(needle_id), Cookie(cookie));
+        let resp = service
+            .batch_delete(Request::new(volume_server_pb::BatchDeleteRequest {
+                file_ids: vec![fid.to_string()],
+                skip_cookie_check,
+            }))
+            .await
+            .unwrap()
+            .into_inner();
+        assert_eq!(resp.results.len(), 1, "{:?}", resp.results);
+        let r = &resp.results[0];
+        (r.status, r.error.clone())
+    }
+
+    /// A batch delete only needs the needle's cookie, which is stored in the
+    /// header, so it must not read the payload.
+    #[tokio::test]
+    async fn batch_delete_reads_needle_meta_only() {
+        use crate::storage::volume::needle_read_hook;
+        use std::sync::Mutex;
+
+        const ID: u64 = 0x6e7a_0b01;
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let data = vec![7u8; 512 * 1024];
+        let mut n = Needle {
+            id: NeedleId(ID),
+            cookie: Cookie(0x3344),
+            data: data.clone(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        };
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .write_volume_needle(VolumeId(1), &mut n, false)
+            .unwrap();
+
+        let reads = Arc::new(Mutex::new(Vec::new()));
+        let _hook = needle_read_hook::register(NeedleId(ID), {
+            let reads = reads.clone();
+            move |len| reads.lock().unwrap().push(len)
+        });
+
+        let (status, _) = batch_delete_1(&service, ID, 0x3345, false).await;
+        assert_eq!(status, 400);
+        let (status, error) = batch_delete_1(&service, ID, 0x3344, false).await;
+        assert_eq!(status, 202, "{error}");
+
+        let reads = reads.lock().unwrap().clone();
+        assert!(
+            !reads.is_empty() && reads.iter().all(|&len| len < 4096),
+            "a batch delete must not read the needle's payload ({} bytes): {reads:?}",
+            data.len()
+        );
+    }
+
+    const GO_EC_NEEDLE_NOT_FOUND: &str =
+        "locate in local ec volume: FindNeedleFromEcx: needle not found";
+
+    /// Go's TestBatchDelete_AlreadyDeletedEcNeedleIsNotAnError: the filer skips
+    /// the cookie check, and a repeat delete must not read as a failure.
+    #[tokio::test]
+    async fn test_batch_delete_already_deleted_ec_needle_is_not_an_error() {
+        let (service, _tmp) = ec_1_with_a_manifest_needle().await;
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .find_ec_volume_mut(VolumeId(1))
+            .unwrap()
+            .journal_delete(NeedleId(11))
+            .unwrap();
+
+        assert_eq!(
+            batch_delete_1(&service, 11, 0x3344, true).await,
+            (304, String::new())
+        );
+        assert_eq!(
+            batch_delete_1(&service, 11, 0x3344, false).await,
+            (404, "already deleted".to_string())
+        );
+    }
+
+    /// A deletion only the peer holding the needle's shard knows of is still 304.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn test_batch_delete_peer_reported_ec_deletion_is_not_an_error() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let _peer = put_ec_1_needle_shard_on_a_peer(&service, &tmp, true).await;
+
+        assert_eq!(
+            batch_delete_1(&service, 11, 0x3344, true).await,
+            (304, String::new())
+        );
+    }
+
+    #[tokio::test]
+    async fn test_batch_delete_missing_ec_needle_reports_go_error() {
+        let (service, _tmp) = ec_1_with_a_manifest_needle().await;
+
+        assert_eq!(
+            batch_delete_1(&service, 12345, 0x3344, false).await,
+            (404, GO_EC_NEEDLE_NOT_FOUND.to_string())
+        );
+        assert_eq!(
+            batch_delete_1(&service, 12345, 0x3344, true).await,
+            (500, GO_EC_NEEDLE_NOT_FOUND.to_string())
+        );
+    }
+
+    /// Go discards the fid cookie when skipping, so a mismatch deletes.
+    #[tokio::test]
+    async fn test_batch_delete_ec_cookie_is_checked_only_when_asked() {
+        let (service, _tmp) = ec_1_with_a_manifest_needle().await;
+
+        assert_eq!(
+            batch_delete_1(&service, 11, 0x9999, false).await,
+            (400, "File Random Cookie does not match.".to_string())
+        );
+        let (status, error) = batch_delete_1(&service, 11, 0x9999, true).await;
+        assert_eq!((status, error.as_str()), (202, ""));
+        assert_eq!(
+            batch_delete_1(&service, 11, 0x3344, true).await,
+            (304, String::new())
+        );
+    }
+
+    /// The filer deletes a manifest chunk's own fid, with the cookie check skipped.
+    #[tokio::test]
+    async fn test_batch_delete_ec_manifest_is_refused_only_with_the_cookie_check() {
+        let (service, _tmp) = ec_1_with_a_manifest_needle().await;
+
+        assert_eq!(
+            batch_delete_1(&service, 12, 0x5566, false).await,
+            (
+                406,
+                "ChunkManifest: not allowed in batch delete mode.".to_string()
+            )
+        );
+        let (status, error) = batch_delete_1(&service, 12, 0x5566, true).await;
+        assert_eq!((status, error.as_str()), (202, ""));
+        assert_eq!(
+            batch_delete_1(&service, 12, 0x5566, false).await,
+            (404, "already deleted".to_string())
+        );
+    }
+
+    /// Batch atomicity: mount pre-validates the ENTIRE shard_ids before
+    /// acquiring the write lock or mounting anything. A batch like [0, 32]
+    /// must fail with InvalidArgument and mount NOTHING — not the valid
+    /// prefix (shard 0). Regression test for the in-loop validation that
+    /// mounted 0 then returned InvalidArgument, skipping the sidecar reload
+    /// + notify.
+    #[tokio::test]
+    async fn test_mount_rejects_invalid_batch_without_partial_mutation() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        service
+            .volume_ec_shards_generate(Request::new(
+                volume_server_pb::VolumeEcShardsGenerateRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                },
+            ))
+            .await
+            .unwrap();
+
+        let err = service
+            .volume_ec_shards_mount(Request::new(volume_server_pb::VolumeEcShardsMountRequest {
+                volume_id: 1,
+                collection: String::new(),
+                shard_ids: vec![0, 32],
+                source_disk_type: String::new(),
+                recover_missing_index: false,
+            }))
+            .await
+            .expect_err("batch with shard 32 must be rejected");
+        assert_eq!(err.code(), tonic::Code::InvalidArgument, "{}", err);
+
+        // No partial mutation: shard 0 must NOT be mounted.
+        let store = service.state.store.read().unwrap();
+        assert!(
+            store.find_ec_volume_with_shard(VolumeId(1), 0).is_none(),
+            "invalid batch must mount nothing, but shard 0 is mounted"
+        );
+    }
+
+    /// Batch atomicity (unmount side): unmount pre-validates the ENTIRE
+    /// shard_ids after admin auth but before the write lock / mutation. A
+    /// batch like [0, 32] must fail with InvalidArgument and unmount NOTHING.
+    #[tokio::test]
+    async fn test_unmount_rejects_invalid_batch_without_partial_mutation() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        service
+            .volume_ec_shards_generate(Request::new(
+                volume_server_pb::VolumeEcShardsGenerateRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                },
+            ))
+            .await
+            .unwrap();
+        service
+            .volume_ec_shards_mount(Request::new(volume_server_pb::VolumeEcShardsMountRequest {
+                volume_id: 1,
+                collection: String::new(),
+                shard_ids: (0..14).collect(),
+                source_disk_type: String::new(),
+                recover_missing_index: false,
+            }))
+            .await
+            .unwrap();
+
+        let err = service
+            .volume_ec_shards_unmount(Request::new(
+                volume_server_pb::VolumeEcShardsUnmountRequest {
+                    volume_id: 1,
+                    shard_ids: vec![0, 32],
+                    encode_ts_ns: 0,
+                },
+            ))
+            .await
+            .expect_err("batch with shard 32 must be rejected");
+        assert_eq!(err.code(), tonic::Code::InvalidArgument, "{}", err);
+
+        // No partial mutation: shard 0 must STILL be mounted.
+        let store = service.state.store.read().unwrap();
+        assert!(
+            store.find_ec_volume_with_shard(VolumeId(1), 0).is_some(),
+            "invalid unmount batch must unmount nothing, but shard 0 is gone"
+        );
+    }
+
+    /// Two locations, one vid: the split-disk / cross-disk-reconcile layout
+    /// `build_split_disk_store` exercises in store_ec_reconcile.rs. Neither
+    /// disk holds a `.dat`, so each disk's orphan shard survives
+    /// `check_orphaned_shards` and `Store::add_location`'s automatic
+    /// `reconcile_ec_shards_across_disks()` mounts it against its own disk,
+    /// pointing at the sibling's `.ecx` -- the same layout a real
+    /// seaweedfs/seaweedfs#9212 report produces.
+    fn make_local_service_with_split_disk_ec_volume(vid_raw: u32) -> (VolumeGrpcService, TempDir) {
+        SplitDiskEcFixture::new(vid_raw).build()
+    }
+
+    /// Knobs on the two-location layout above, so one fixture can produce the
+    /// shapes the scrub tests need. `new()` reproduces the layout exactly as
+    /// `make_local_service_with_split_disk_ec_volume` has always built it; every
+    /// field is a deliberate departure from it.
+    struct SplitDiskEcFixture {
+        vid_raw: u32,
+        /// Collection the files and mounted volume carry; the delete tests use
+        /// unique names so parallel tests under `""` share no gauge labels.
+        collection: &'static str,
+        /// Which shard id each disk gets. Which disk holds the shard a needle
+        /// actually spans is the whole difference between reaching one disk and
+        /// reaching both, so the LOCAL/CHECKSUM tests move shard 0 to disk 1.
+        dir0_shard_id: u8,
+        dir1_shard_id: u8,
+        /// dir0's own `.vif` encode identity. `None` writes NO `.vif` in dir0 at
+        /// all -- the original layout, where `locate_vif_path` falls through to
+        /// dir1's copy and both runtimes therefore agree. `Some(ts)` writes one,
+        /// which is what lets the two disks disagree and drives the identity
+        /// fence in `merge_ec_runtimes`.
+        dir0_encode_ts_ns: Option<i64>,
+        dir1_encode_ts_ns: i64,
+        /// `false` writes the original 20 zero bytes: a structurally invalid
+        /// index, so every scrub that walks it reports something. `true` writes
+        /// one well-formed TOMBSTONE entry instead -- a deleted needle, which the
+        /// walk skips -- so a FULL/READS scrub of this volume is CLEAN and a
+        /// test can pin a clean-to-broken transition rather than a message.
+        clean_index: bool,
+        /// Where the generation-0 `.ecsum` is written. Its per-shard checksums
+        /// do not describe the placeholder bytes, so a CHECKSUM scrub reports
+        /// every shard it actually reads. With `Nowhere`, `bitrot_status` is
+        /// `Off` on both disks and `EcChecksumScrubPlan::run` returns clean
+        /// before touching a handle.
+        bitrot_sidecar: SidecarPlacement,
+    }
+
+    /// Which disks get the `.ecsum`. The sidecar is deliberately NOT mirrored
+    /// in production (`Store::ec_metadata_dirs` exists so one copy stays
+    /// reachable rather than being duplicated), and at mount `EcVolume::new`
+    /// resolves it with no sibling directories -- so `Dir1Only` is not an
+    /// artificial shape, it is what a volume server looks like after any
+    /// restart when the one copy happens to live on the non-anchor disk.
+    #[derive(Clone, Copy, PartialEq, Eq)]
+    enum SidecarPlacement {
+        Nowhere,
+        BothDisks,
+        Dir1Only,
+    }
+
+    impl SplitDiskEcFixture {
+        fn new(vid_raw: u32) -> Self {
+            SplitDiskEcFixture {
+                vid_raw,
+                collection: "",
+                dir0_shard_id: 0,
+                dir1_shard_id: 1,
+                dir0_encode_ts_ns: None,
+                dir1_encode_ts_ns: 0,
+                clean_index: false,
+                bitrot_sidecar: SidecarPlacement::Nowhere,
+            }
+        }
+
+        fn build(self) -> (VolumeGrpcService, TempDir) {
+            make_local_service_with_split_disk_ec_volume_from(self)
+        }
+    }
+
+    fn make_local_service_with_split_disk_ec_volume_from(
+        cfg: SplitDiskEcFixture,
+    ) -> (VolumeGrpcService, TempDir) {
+        let SplitDiskEcFixture {
+            vid_raw,
+            collection,
+            dir0_shard_id,
+            dir1_shard_id,
+            dir0_encode_ts_ns,
+            dir1_encode_ts_ns,
+            clean_index,
+            bitrot_sidecar,
+        } = cfg;
+
+        let tmp = TempDir::new().unwrap();
+        let dir0 = tmp.path().join("data0");
+        let dir1 = tmp.path().join("data1");
+        std::fs::create_dir_all(&dir0).unwrap();
+        std::fs::create_dir_all(&dir1).unwrap();
+        let file = |dir: &std::path::Path, ext: &str| {
+            format!(
+                "{}{}",
+                crate::storage::volume::volume_file_name(
+                    dir.to_str().unwrap(),
+                    collection,
+                    VolumeId(vid_raw),
+                ),
+                ext
+            )
+        };
+
+        let ec_vif = |encode_ts_ns: i64| crate::storage::volume::VifVolumeInfo {
+            version: 3,
+            ec_shard_config: Some(crate::storage::volume::VifEcShardConfig {
+                data_shards: 10,
+                parity_shards: 4,
+                encode_ts_ns,
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+
+        // dir0: one shard, no .ecx.
+        std::fs::write(
+            file(&dir0, &format!(".ec{:02}", dir0_shard_id)),
+            b"shard data nonempty",
+        )
+        .unwrap();
+        if let Some(ts) = dir0_encode_ts_ns {
+            std::fs::write(
+                file(&dir0, ".vif"),
+                serde_json::to_string(&ec_vif(ts)).unwrap(),
+            )
+            .unwrap();
+        }
+        // dir1: one shard plus the index files.
+        std::fs::write(
+            file(&dir1, &format!(".ec{:02}", dir1_shard_id)),
+            b"shard data nonempty",
+        )
+        .unwrap();
+        let ecx = if clean_index {
+            let mut buf: Vec<u8> = Vec::new();
+            crate::storage::idx::write_index_entry(
+                &mut buf,
+                crate::storage::types::NeedleId(1),
+                crate::storage::types::Offset::from_actual_offset(0),
+                crate::storage::types::TOMBSTONE_FILE_SIZE,
+            )
+            .unwrap();
+            buf
+        } else {
+            vec![0u8; 20]
+        };
+        std::fs::write(file(&dir1, ".ecx"), ecx).unwrap();
+        std::fs::write(file(&dir1, ".ecj"), b"").unwrap();
+        std::fs::write(
+            file(&dir1, ".vif"),
+            serde_json::to_string(&ec_vif(dir1_encode_ts_ns)).unwrap(),
+        )
+        .unwrap();
+
+        if bitrot_sidecar != SidecarPlacement::Nowhere {
+            use crate::pb::volume_server_pb::{
+                ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums,
+            };
+            use crate::storage::erasure_coding::ec_bitrot;
+            let prot = EcBitrotProtection {
+                algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+                block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+                generation: 0,
+                ec_shard_config: Some(ec_bitrot::ec_shard_config(10, 4, 0)),
+                shards: (0..14u32)
+                    .map(|shard_id| EcShardChecksums {
+                        shard_id,
+                        covered_size: 4,
+                        block_crc32c: vec![0u8; 4],
+                    })
+                    .collect(),
+                encode_uuid: vec![0u8; 16],
+            };
+            // Each runtime resolves its sidecar from its own directory at mount
+            // (`load_bitrot_for_generation` gets no sibling dirs there), so a
+            // disk that gets no copy here mounts `BitrotStatus::Off`.
+            let sidecar_dirs: Vec<&std::path::Path> = match bitrot_sidecar {
+                SidecarPlacement::Nowhere => Vec::new(),
+                SidecarPlacement::BothDisks => vec![dir0.as_path(), dir1.as_path()],
+                SidecarPlacement::Dir1Only => vec![dir1.as_path()],
+            };
+            for d in sidecar_dirs {
+                let base = file(d, "");
+                ec_bitrot::save_bitrot_sidecar(&ec_bitrot::bitrot_sidecar_path(&base, 0), &prot)
+                    .unwrap();
+            }
+        }
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        for d in [&dir0, &dir1] {
+            store
+                .add_location(
+                    d.to_str().unwrap(),
+                    d.to_str().unwrap(),
+                    100,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(0.0),
+                    Vec::new(),
+                )
+                .unwrap();
+        }
+
+        (split_disk_grpc_service(store), tmp)
+    }
+
+    /// Wrap a hand-built two-location `Store` in the full
+    /// `VolumeServerState` the gRPC handlers need. Shared by the split-disk
+    /// fixtures so a second one costs a store, not another copy of this
+    /// 50-line literal.
+    fn split_disk_grpc_service(store: Store) -> VolumeGrpcService {
+        let state = Arc::new(VolumeServerState {
+            store: RwLock::new(store),
+            guard: RwLock::new(Guard::new(
+                &[],
+                SigningKey(vec![]),
+                0,
+                SigningKey(vec![]),
+                0,
+            )),
+            is_stopping: RwLock::new(false),
+            maintenance: std::sync::atomic::AtomicBool::new(false),
+            state_version: std::sync::atomic::AtomicU32::new(0),
+            concurrent_upload_limit: 0,
+            concurrent_download_limit: 0,
+            inflight_upload_data_timeout: std::time::Duration::from_secs(60),
+            inflight_download_data_timeout: std::time::Duration::from_secs(60),
+            inflight_upload_bytes: std::sync::atomic::AtomicI64::new(0),
+            inflight_download_bytes: std::sync::atomic::AtomicI64::new(0),
+            upload_notify: tokio::sync::Notify::new(),
+            download_notify: tokio::sync::Notify::new(),
+            data_center: String::new(),
+            rack: String::new(),
+            file_size_limit_bytes: 0,
+            maintenance_byte_per_second: 0,
+            vacuum_commit_slots: None,
+            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
+            is_heartbeating: std::sync::atomic::AtomicBool::new(true),
+            has_master: false,
+            pre_stop_seconds: 0,
+            volume_state_notify: tokio::sync::Notify::new(),
+            write_queue: std::sync::OnceLock::new(),
+            read_mode: crate::config::ReadMode::Local,
+            allow_untrusted_remote_endpoints: false,
+            master_url: String::new(),
+            master_urls: Vec::new(),
+            seed_master_set: std::collections::HashSet::new(),
+            current_master_url: tokio::sync::RwLock::new(String::new()),
+            self_url: String::new(),
+            http_client: reqwest::Client::new(),
+            outgoing_http_scheme: "http".to_string(),
+            outgoing_grpc_tls: None,
+            metrics_runtime: std::sync::RwLock::new(
+                crate::server::volume_server::RuntimeMetricsConfig::default(),
+            ),
+            metrics_notify: tokio::sync::Notify::new(),
+            fix_jpg_orientation: false,
+            has_slow_read: false,
+            read_buffer_size_bytes: 1024 * 1024,
+            security_file: String::new(),
+            cli_white_list: vec![],
+            state_file_path: String::new(),
+            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail_notify: tokio::sync::Notify::new(),
+        });
+
+        VolumeGrpcService { state }
+    }
+
+    /// The dedupe lives on the implicit (empty `volume_ids`) path of
+    /// `scrub_ec_volume` itself -- `scrub_ec_volumes` is handed an
+    /// already-deduped list by every other caller in this test module, so it
+    /// cannot exercise this regression. Before the fix, flat-mapping every
+    /// location's `ec_volumes()` visited this split-disk vid twice and
+    /// `total_volumes` counted it twice.
+    #[tokio::test]
+    async fn test_scrub_ec_volume_node_wide_dedupes_a_split_disk_volume() {
+        let (service, _tmp) = make_local_service_with_split_disk_ec_volume(7040);
+
+        let resp = service
+            .scrub_ec_volume(Request::new(volume_server_pb::ScrubEcVolumeRequest {
+                mode: 1,
+                volume_ids: vec![],
+                force_deleted_needles_check: false,
+            }))
+            .await
+            .unwrap()
+            .into_inner();
+
+        assert_eq!(
+            resp.total_volumes, 1,
+            "a vid split across two disks must be scrubbed once, not once per disk"
+        );
+    }
+
+    /// Issue one scrub mode against a single vid on a split-disk service.
+    async fn scrub_split_disk(
+        service: &VolumeGrpcService,
+        vid_raw: u32,
+        mode: i32,
+    ) -> volume_server_pb::ScrubEcVolumeResponse {
+        service
+            .scrub_ec_volume(Request::new(volume_server_pb::ScrubEcVolumeRequest {
+                mode,
+                volume_ids: vec![vid_raw],
+                force_deleted_needles_check: false,
+            }))
+            .await
+            .unwrap()
+            .into_inner()
+    }
+
+    /// FULL/READS resolves shard locations up front, and with no master
+    /// configured that lookup fails and short-circuits the whole scrub with an
+    /// error of its own. Seed the cache so the needle walk actually runs and the
+    /// response reflects the volume rather than the missing master.
+    fn seed_all_shard_locations(service: &VolumeGrpcService, vid_raw: u32) {
+        let store = service.state.store.read().unwrap();
+        for ecv in store.find_all_ec_volumes(VolumeId(vid_raw)) {
+            ecv.merge_shard_locations(
+                (0u8..14)
+                    .map(|sid| (sid, vec!["127.0.0.1:255.1".to_string()]))
+                    .collect(),
+            );
+        }
+    }
+
+    /// A disk the identity fence excluded is a disk the scrub did not read,
+    /// and the mode 2|5 arm must say so. `merge_ec_runtimes` hands the
+    /// exclusions back as `skipped`; the arm folds them into `errs`, which
+    /// flags the volume broken and prints the line. Before that, a volume
+    /// whose disks disagreed on encode identity scrubbed the anchor and
+    /// reported CLEAN -- the sibling disk went unmentioned.
+    ///
+    /// Both halves of the TRANSITION are asserted here: the same layout with
+    /// the disks AGREEING is clean, so the clean-to-broken change is pinned,
+    /// not just the message text.
+    ///
+    /// Across modes, `BitrotStatus::Off` is now the ONLY place an exclusion
+    /// goes unreported: modes 2|5 and 3 always report it, and mode 4 reports it
+    /// on `On` and (since `ec: report fenced-out disks on a malformed sidecar
+    /// too`) on `Invalid`. `Off` returns `(0, [], [])` before reporting
+    /// `skipped` because that is a hard Go-parity contract
+    /// (`case BitrotOff: return 0, nil, nil`), so on an unprotected generation
+    /// a CHECKSUM scrub of a fenced volume is clean and the excluded disk goes
+    /// unmentioned. That single exception is deliberate, not an oversight.
+    #[tokio::test]
+    async fn test_scrub_ec_volume_full_reports_a_fenced_out_disk() {
+        // Control: identical layout, both disks on encode run 200.
+        let (agreeing, _tmp_a) = SplitDiskEcFixture {
+            dir0_encode_ts_ns: None, // no dir0 .vif => falls through to dir1's
+            dir1_encode_ts_ns: 200,
+            clean_index: true,
+            ..SplitDiskEcFixture::new(7050)
+        }
+        .build();
+        seed_all_shard_locations(&agreeing, 7050);
+        {
+            let store = agreeing.state.store.read().unwrap();
+            let gens: Vec<i64> = store
+                .find_all_ec_volumes(VolumeId(7050))
+                .iter()
+                .map(|v| v.encode_ts_ns)
+                .collect();
+            assert_eq!(gens, vec![200, 200], "control fixture must NOT be fenced");
+        }
+
+        // The fenced volume: dir0 carries its own, older encode identity.
+        let (fenced, _tmp_f) = SplitDiskEcFixture {
+            dir0_encode_ts_ns: Some(100),
+            dir1_encode_ts_ns: 200,
+            clean_index: true,
+            ..SplitDiskEcFixture::new(7051)
+        }
+        .build();
+        seed_all_shard_locations(&fenced, 7051);
+        {
+            let store = fenced.state.store.read().unwrap();
+            let gens: Vec<i64> = store
+                .find_all_ec_volumes(VolumeId(7051))
+                .iter()
+                .map(|v| v.encode_ts_ns)
+                .collect();
+            assert_eq!(
+                gens,
+                vec![100, 200],
+                "fixture must mount both disks with DISAGREEING encode identities \
+                 for this to be meaningful"
+            );
+        }
+
+        // Both FULL (2) and READS (5) share the arm, so both must report it.
+        for mode in [2, 5] {
+            let clean = scrub_split_disk(&agreeing, 7050, mode).await;
+            assert!(
+                clean.broken_volume_ids.is_empty() && clean.details.is_empty(),
+                "mode {mode}: agreeing disks must scrub clean, else the fenced \
+                 case below proves nothing: {:?} {:?}",
+                clean.broken_volume_ids,
+                clean.details
+            );
+
+            let resp = scrub_split_disk(&fenced, 7051, mode).await;
+            assert_eq!(
+                resp.broken_volume_ids,
+                vec![7051],
+                "mode {mode}: a fenced-out disk must flag the volume broken, not \
+                 pass silently: {:?}",
+                resp.details
+            );
+            assert_eq!(
+                resp.details.len(),
+                1,
+                "mode {mode}: the exclusion is the only finding: {:?}",
+                resp.details
+            );
+            assert!(
+                resp.details[0].starts_with("ecvol 7051: ")
+                    && resp.details[0].contains("belong to encode run 100")
+                    && resp.details[0].contains("they were not verified"),
+                "mode {mode}: {:?}",
+                resp.details
+            );
+        }
+    }
+
+    /// LOCAL and CHECKSUM must verify the shards on EVERY disk holding the vid,
+    /// not the ones on whichever disk `find_ec_volume` happened to return. The
+    /// layout makes that observable: disk 0 -- the disk the singular lookup
+    /// returns -- holds only shard 5, while shard 0 (the one the volume's single
+    /// needle spans, and the one the checksum sidecar is checked against) lives
+    /// on disk 1. Built from disk 0 alone, both scrubs simply never look at
+    /// shard 0.
+    #[tokio::test]
+    async fn test_scrub_ec_volume_local_and_checksum_reach_the_sibling_disk() {
+        // LOCAL reads only the shards the volume's one needle spans, so shard 5
+        // is never touched; CHECKSUM reads every shard it holds, so both appear.
+        for (vid_raw, mode, bitrot_sidecar, want_broken) in [
+            (7052u32, 3i32, SidecarPlacement::Nowhere, &[0u32][..]),
+            (7053, 4, SidecarPlacement::BothDisks, &[0, 5][..]),
+        ] {
+            let (service, _tmp) = SplitDiskEcFixture {
+                dir0_shard_id: 5,
+                dir1_shard_id: 0,
+                bitrot_sidecar,
+                ..SplitDiskEcFixture::new(vid_raw)
+            }
+            .build();
+
+            {
+                let store = service.state.store.read().unwrap();
+                let first = store
+                    .find_ec_volume(VolumeId(vid_raw))
+                    .expect("the singular lookup must still resolve the vid");
+                assert!(
+                    !first.has_shard(0) && first.has_shard(5),
+                    "mode {mode}: the first-disk runtime must NOT hold shard 0, or a \
+                     first-disk-only scrub would reach it anyway and this proves nothing"
+                );
+                assert!(
+                    store
+                        .find_all_ec_volumes(VolumeId(vid_raw))
+                        .iter()
+                        .any(|v| v.has_shard(0)),
+                    "mode {mode}: fixture must mount shard 0 on the sibling disk"
+                );
+            }
+
+            let resp = scrub_split_disk(&service, vid_raw, mode).await;
+            let mut broken: Vec<u32> = resp.broken_shard_infos.iter().map(|s| s.shard_id).collect();
+            broken.sort_unstable();
+            assert!(
+                broken.contains(&0),
+                "mode {mode}: shard 0 lives on the sibling disk and was never \
+                 verified: shards={broken:?} details={:?}",
+                resp.details
+            );
+            assert_eq!(
+                broken, want_broken,
+                "mode {mode}: details={:?}",
+                resp.details
+            );
+            assert_eq!(resp.broken_volume_ids, vec![vid_raw]);
+        }
+    }
+
+    /// CHECKSUM must not source bitrot protection from the ANCHOR alone.
+    ///
+    /// The `.ecsum` sidecar is deliberately not mirrored across disks, and at
+    /// mount `EcVolume::new` resolves it with no sibling directories -- only
+    /// `VolumeEcShardsMount` ever passes `ec_metadata_dirs()`. So after any
+    /// volume-server restart the split-disk runtime that does not hold the
+    /// sidecar mounts `BitrotStatus::Off`. The anchor is the first
+    /// shard-bearing runtime at the maximum `encode_ts_ns`, picked with no
+    /// regard for which disk holds the sidecar -- so whenever the one copy
+    /// lands on the non-anchor disk (about half of all mirrored split-disk
+    /// layouts), taking `(prot, status)` from the anchor made `run()` return
+    /// `(0, [], [])` and the WHOLE volume scrubbed clean, silently. That is the
+    /// exact failure this branch exists to remove.
+    ///
+    /// The fixture is the same one the sibling-disk test uses, with the sidecar
+    /// written to dir1 ONLY. Both disks agree on encode identity, so nothing is
+    /// fenced and the plan's `unverifiable_sidecar` early return cannot fire --
+    /// the volume must actually be SCANNED, and the placeholder shard bytes do
+    /// not match the sidecar, so every shard the merge reaches is reported.
+    #[tokio::test]
+    async fn test_checksum_scrub_takes_protection_from_the_disk_that_has_the_sidecar() {
+        let (service, _tmp) = SplitDiskEcFixture {
+            dir0_shard_id: 5,
+            dir1_shard_id: 0,
+            bitrot_sidecar: SidecarPlacement::Dir1Only,
+            ..SplitDiskEcFixture::new(7054)
+        }
+        .build();
+
+        // Without this the test could pass for the wrong reason: if the anchor
+        // ever resolved the sibling's sidecar itself, sourcing from the anchor
+        // would be fine and this would prove nothing.
+        {
+            use crate::storage::erasure_coding::ec_bitrot::BitrotStatus;
+            let store = service.state.store.read().unwrap();
+            let runtimes = store.find_all_ec_volumes(VolumeId(7054));
+            assert_eq!(
+                runtimes.len(),
+                2,
+                "fixture must mount the vid on both disks"
+            );
+            assert_eq!(
+                runtimes[0].bitrot_status,
+                BitrotStatus::Off,
+                "the ANCHOR disk must have NO sidecar, or this proves nothing"
+            );
+            assert_eq!(
+                runtimes[1].bitrot_status,
+                BitrotStatus::On,
+                "the sibling disk must be the one carrying protection"
+            );
+            assert_eq!(
+                runtimes[0].encode_ts_ns, runtimes[1].encode_ts_ns,
+                "the disks must AGREE on encode identity, so nothing is fenced \
+                 and the unverifiable-sidecar early return cannot mask the scan"
+            );
+        }
+
+        let resp = scrub_split_disk(&service, 7054, 4).await;
+        let mut broken: Vec<u32> = resp.broken_shard_infos.iter().map(|s| s.shard_id).collect();
+        broken.sort_unstable();
+        assert_eq!(
+            broken,
+            vec![0, 5],
+            "the volume must be SCANNED against the sibling's sidecar, not \
+             returned clean-empty because the anchor mounted BitrotStatus::Off: \
+             details={:?}",
+            resp.details
+        );
+        assert_eq!(
+            resp.broken_volume_ids,
+            vec![7054],
+            "details={:?}",
+            resp.details
+        );
+    }
+
+    /// A two-location store holding a REAL 10+4 encoded volume with EVERY data
+    /// and parity shard present, scattered across both disks: shards 0..=6 on
+    /// disk 0, shards 7..=13 plus the `.ecx`/`.ecj`/`.vif` on disk 1. Disk 0
+    /// gets no index files, so its shards mount only through the cross-disk
+    /// reconcile -- the real split-disk shape.
+    ///
+    /// This is the only layout that reaches mode 2's local Reed-Solomon parity
+    /// check over a genuinely MULTI-DIRECTORY `dirs`. The check is gated on
+    /// `all_local`, so every shard has to be present; the existing all-local
+    /// fixture keeps them in one directory, where every entry of `dirs` is the
+    /// same string and a permutation or off-by-one in the `slots` -> `dirs`
+    /// mapping is invisible.
+    ///
+    /// The `.dat`/`.idx` are left in a third directory that is NOT a store
+    /// location, so `prune_incomplete_ec_with_sibling_dat` finds no sibling
+    /// `.dat` and cannot delete the EC artefacts out from under the fixture.
+    fn make_service_with_two_disk_complete_ec_volume(vid_raw: u32) -> (VolumeGrpcService, TempDir) {
+        let tmp = TempDir::new().unwrap();
+        let src = tmp.path().join("src");
+        let dir0 = tmp.path().join("data0");
+        let dir1 = tmp.path().join("data1");
+        for d in [&src, &dir0, &dir1] {
+            std::fs::create_dir_all(d).unwrap();
+        }
+        let src_s = src.to_str().unwrap();
+        let vid = VolumeId(vid_raw);
+
+        // A real volume, really encoded: a parity check needs genuine
+        // Reed-Solomon parity to agree with, or "no corruption" means nothing.
+        {
+            let v = crate::storage::volume::Volume::new(
+                src_s,
+                src_s,
+                vid,
+                NeedleMapKind::InMemory,
+                &crate::storage::volume::VolumeSpec::default(),
+            )
+            .unwrap();
+            for i in 1..=8u64 {
+                let data = format!("test data for needle {} with a bit more length", i);
+                let mut n = crate::storage::needle::Needle {
+                    id: crate::storage::types::NeedleId(i),
+                    cookie: crate::storage::types::Cookie(i as u32),
+                    data: data.as_bytes().to_vec(),
+                    data_size: data.len() as u32,
+                    ..Default::default()
+                };
+                v.write_needle(&mut n, true, false).unwrap();
+            }
+            v.sync_to_disk().unwrap();
+            v.close();
+        }
+        crate::storage::erasure_coding::ec_encoder::write_ec_files(src_s, src_s, "", vid, 10, 4)
+            .unwrap();
+
+        for id in 0..14u8 {
+            let target = if id < 7 { &dir0 } else { &dir1 };
+            std::fs::rename(
+                format!("{}/{}.ec{:02}", src_s, vid_raw, id),
+                format!("{}/{}.ec{:02}", target.to_str().unwrap(), vid_raw, id),
+            )
+            .unwrap();
+        }
+        let idx_dir = dir1.to_str().unwrap();
+        std::fs::rename(
+            format!("{}/{}.ecx", src_s, vid_raw),
+            format!("{}/{}.ecx", idx_dir, vid_raw),
+        )
+        .unwrap();
+        std::fs::write(format!("{}/{}.ecj", idx_dir, vid_raw), b"").unwrap();
+        std::fs::write(
+            format!("{}/{}.vif", idx_dir, vid_raw),
+            serde_json::to_string(&crate::storage::volume::VifVolumeInfo {
+                version: 3,
+                ec_shard_config: Some(crate::storage::volume::VifEcShardConfig {
+                    data_shards: 10,
+                    parity_shards: 4,
+                    ..Default::default()
+                }),
+                ..Default::default()
+            })
+            .unwrap(),
+        )
+        .unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        for d in [&dir0, &dir1] {
+            store
+                .add_location(
+                    d.to_str().unwrap(),
+                    d.to_str().unwrap(),
+                    100,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(0.0),
+                    Vec::new(),
+                )
+                .unwrap();
+        }
+
+        (split_disk_grpc_service(store), tmp)
+    }
+
+    /// The branch's newest production behavior, end to end: a mode 2 scrub of a
+    /// SPLIT-DISK volume whose shards are all local but spread over two
+    /// directories.
+    ///
+    /// `all_local` is now computed from the merged view, so this layout reaches
+    /// the local Reed-Solomon parity check for the first time -- and
+    /// `verify_ec_shards` is handed a `dirs` vector whose entries differ.
+    /// `test_scrub_ec_volume_reads_mode_reconstructs_missing_shard` also reaches
+    /// `all_local == true`, but every entry of its `dirs` is the same string, so
+    /// a permutation or off-by-one in the `slots` -> `dirs` mapping (the mode
+    /// 2|5 arm) cannot be observed there; and
+    /// `test_verify_ec_shards_reads_shards_from_multiple_dirs` builds its `dirs`
+    /// by hand and never goes through `merge_ec_runtimes` at all.
+    #[tokio::test]
+    async fn test_scrub_ec_volume_full_parity_checks_a_two_disk_all_local_volume() {
+        let (service, tmp) = make_service_with_two_disk_complete_ec_volume(7060);
+        seed_all_shard_locations(&service, 7060);
+        let dir0 = tmp.path().join("data0").to_str().unwrap().to_string();
+        let dir1 = tmp.path().join("data1").to_str().unwrap().to_string();
+
+        // The fixture must actually produce the shape under test: every shard
+        // mounted, and the mapping the mode 2|5 arm builds `dirs` from spanning
+        // BOTH directories. Without this the test could pass over a one-disk
+        // layout and prove nothing about the mapping.
+        {
+            let store = service.state.store.read().unwrap();
+            let runtimes = store.find_all_ec_volumes(VolumeId(7060));
+            assert_eq!(runtimes.len(), 2, "the vid must mount on both disks");
+            let merged = crate::storage::erasure_coding::ec_volume::merge_ec_runtimes(&runtimes)
+                .expect("two runtimes merge");
+            assert!(merged.skipped.is_empty(), "{:?}", merged.skipped);
+            let dirs: Vec<String> = (0..14)
+                .map(|id| {
+                    merged.slots[id]
+                        .unwrap_or_else(|| {
+                            panic!(
+                                "shard {id} is not mounted; all_local would be false \
+                                 and the parity check would never run"
+                            )
+                        })
+                        .0
+                        .dir
+                        .clone()
+                })
+                .collect();
+            assert_eq!(dirs[0], dir0);
+            assert_eq!(dirs[6], dir0);
+            assert_eq!(dirs[7], dir1);
+            assert_eq!(dirs[13], dir1);
+        }
+
+        // Real parity over a real encode, read through two directories: nothing
+        // may be fabricated as corrupt.
+        let resp = scrub_split_disk(&service, 7060, 2).await;
+        assert!(
+            resp.broken_volume_ids.is_empty() && resp.broken_shard_infos.is_empty(),
+            "an intact two-disk volume must not be reported broken: {:?}",
+            resp.details
+        );
+        assert!(resp.details.is_empty(), "{:?}", resp.details);
+        assert_eq!(resp.total_files, 8, "the needle walk must have run");
+
+        // ...and the parity check really RAN, over the SECOND disk's shards.
+        // Shard 13 is a PARITY shard: the per-needle walk reads only live
+        // data-shard intervals, so nothing but `verify_ec_shards` can see this,
+        // and nothing but a correct `slots` -> `dirs` mapping can find the file.
+        //
+        // `assert_eq!` rather than `contains`, and the reason is specific:
+        // `dirs` is indexed BY SHARD ID and carries only directories, so an
+        // off-by-one or a permutation that lands the wrong DIRECTORY at some
+        // index makes `verify_ec_shards` look for a shard file that is not
+        // there -- the reported set is then not exactly `[13]`, which
+        // `contains(&13)` would still accept. A permutation that stays WITHIN
+        // one disk is not caught here: both entries name the same directory, so
+        // it is unobservable through `dirs` at all. That is a limit of this
+        // fixture, stated rather than papered over.
+        let shard13 = format!("{}/7060.ec13", dir1);
+        let mut bytes = std::fs::read(&shard13).unwrap();
+        bytes[0] ^= 0xFF;
+        std::fs::write(&shard13, &bytes).unwrap();
+
+        let resp = scrub_split_disk(&service, 7060, 2).await;
+        let broken: Vec<u32> = resp.broken_shard_infos.iter().map(|s| s.shard_id).collect();
+        assert_eq!(
+            broken,
+            vec![13],
+            "the parity check must reach disk 1 and blame exactly shard 13: {:?}",
+            resp.details
+        );
+        assert_eq!(resp.broken_volume_ids, vec![7060]);
+        assert!(
+            resp.details
+                .iter()
+                .any(|d| d.contains("parity mismatch on shard 13")),
+            "the finding must come from the parity check, not the needle walk: {:?}",
+            resp.details
+        );
+    }
+
+    #[tokio::test]
+    async fn volume_delete_reports_absent_volume_as_not_found() {
+        let (service, _tmp) = make_service_with_seed_masters(&[]);
+        let err = service
+            .volume_delete(Request::new(volume_server_pb::VolumeDeleteRequest {
+                volume_id: 4242,
+                only_empty: false,
+                only_garbage: false,
+                keep_remote_data: false,
+            }))
+            .await
+            .expect_err("deleting an absent volume must fail");
+        assert_eq!(err.code(), tonic::Code::NotFound, "{err:?}");
+        assert!(err.message().contains("not found"), "{err:?}");
+    }
+
+    #[tokio::test]
+    async fn volume_delete_only_empty_refuses_a_volume_with_data() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let err = service
+            .volume_delete(Request::new(volume_server_pb::VolumeDeleteRequest {
+                volume_id: 1,
+                only_empty: true,
+                only_garbage: false,
+                keep_remote_data: false,
+            }))
+            .await
+            .expect_err("only_empty must refuse a volume holding a needle");
+        assert_eq!(err.code(), tonic::Code::FailedPrecondition, "{err:?}");
+        assert!(err.message().contains("volume not empty"), "{err:?}");
+        assert!(
+            service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .find_volume(VolumeId(1))
+                .is_some(),
+            "refused delete must leave the volume mounted"
+        );
+    }
+
+    #[tokio::test]
+    async fn volume_delete_only_garbage_deletes_a_fully_deleted_volume() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            vol.delete_needle(&mut Needle {
+                id: NeedleId(11),
+                cookie: Cookie(0x3344),
+                ..Needle::default()
+            })
+            .unwrap();
+            vol.sync_to_disk().unwrap();
+        }
+
+        service
+            .volume_delete(Request::new(volume_server_pb::VolumeDeleteRequest {
+                volume_id: 1,
+                only_empty: false,
+                only_garbage: true,
+                keep_remote_data: false,
+            }))
+            .await
+            .expect("a fully deleted volume is garbage and must delete");
+        assert!(
+            service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .find_volume(VolumeId(1))
+                .is_none(),
+            "the garbage volume must be gone"
+        );
+    }
+
+    #[tokio::test]
+    async fn volume_delete_only_garbage_refuses_a_volume_with_live_needles() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let err = service
+            .volume_delete(Request::new(volume_server_pb::VolumeDeleteRequest {
+                volume_id: 1,
+                only_empty: false,
+                only_garbage: true,
+                keep_remote_data: false,
+            }))
+            .await
+            .expect_err("only_garbage must refuse a volume holding a live needle");
+        assert_eq!(err.code(), tonic::Code::FailedPrecondition, "{err:?}");
+        assert!(
+            service
+                .state
+                .store
+                .read()
+                .unwrap()
+                .find_volume(VolumeId(1))
+                .is_some(),
+            "refused delete must leave the volume mounted"
+        );
+    }
+
+    #[tokio::test]
+    async fn volume_delete_empty_or_garbage_uses_either_check() {
+        // Both flags set, volume fully deleted: the garbage check passes even
+        // though the empty check would not.
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        {
+            let store = service.state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            vol.delete_needle(&mut Needle {
+                id: NeedleId(11),
+                cookie: Cookie(0x3344),
+                ..Needle::default()
+            })
+            .unwrap();
+            vol.sync_to_disk().unwrap();
+        }
+        service
+            .volume_delete(Request::new(volume_server_pb::VolumeDeleteRequest {
+                volume_id: 1,
+                only_empty: true,
+                only_garbage: true,
+                keep_remote_data: false,
+            }))
+            .await
+            .expect("a fully deleted volume deletes under either check");
+    }
+
+    // A collection or ext carrying a separator or ".." is folded into a path
+    // CopyFile then opens; it must be rejected rather than climbed out of the
+    // volume directory. Mirrors Go's checkVolumeFileExtension /
+    // checkVolumeCollection.
+    #[tokio::test]
+    async fn copy_file_rejects_traversal_in_collection_and_ext() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let unique = tmp
+            .path()
+            .file_name()
+            .unwrap()
+            .to_str()
+            .unwrap()
+            .to_string();
+        let outside = tmp
+            .path()
+            .parent()
+            .unwrap()
+            .join(format!("copy_escape_{unique}_888.txt"));
+        std::fs::write(&outside, b"secret").unwrap();
+
+        let traversal = |collection: &str, ext: &str| volume_server_pb::CopyFileRequest {
+            volume_id: 888,
+            ext: ext.to_string(),
+            collection: collection.to_string(),
+            is_ec_volume: true,
+            stop_offset: u64::MAX,
+            compaction_revision: u32::MAX,
+            ignore_source_file_not_found: false,
+        };
+        let name = outside
+            .file_name()
+            .unwrap()
+            .to_str()
+            .unwrap()
+            .trim_end_matches("_888.txt")
+            .to_string();
+        let status = service
+            .copy_file(Request::new(traversal(&format!("../{name}"), ".txt")))
+            .await
+            .err()
+            .expect("a collection that climbs out of the store must be rejected");
+        assert_eq!(status.code(), tonic::Code::InvalidArgument, "{status}");
+
+        let status = service
+            .copy_file(Request::new(traversal("", "/../escape")))
+            .await
+            .err()
+            .expect("an ext that climbs out of the store must be rejected");
+        assert_eq!(status.code(), tonic::Code::InvalidArgument, "{status}");
+
+        std::fs::remove_file(&outside).unwrap();
+    }
+    // Same reach, write side: the path ReceiveFile creates is built from the
+    // client-supplied collection and ext.
+    #[tokio::test]
+    async fn receive_file_rejects_traversal_in_collection_and_ext() {
+        let (service, tmp) = make_local_service_with_volume("", None);
+        let unique = tmp
+            .path()
+            .file_name()
+            .unwrap()
+            .to_str()
+            .unwrap()
+            .to_string();
+        let outside = tmp
+            .path()
+            .parent()
+            .unwrap()
+            .join(format!("recv_escape_{unique}_777.dat"));
+        let (port, _shutdown) = serve_source(service).await;
+        let mut client = volume_server_pb::volume_server_client::VolumeServerClient::connect(
+            format!("http://127.0.0.1:{}", port),
+        )
+        .await
+        .unwrap();
+
+        let send = |collection: String, ext: String| {
+            let messages = vec![
+                volume_server_pb::ReceiveFileRequest {
+                    data: Some(volume_server_pb::receive_file_request::Data::Info(
+                        volume_server_pb::ReceiveFileInfo {
+                            volume_id: 777,
+                            ext,
+                            collection,
+                            is_ec_volume: true,
+                            shard_id: 0,
+                            file_size: 4,
+                            disk_id: 0,
+                            disk_type: String::new(),
+                        },
+                    )),
+                },
+                volume_server_pb::ReceiveFileRequest {
+                    data: Some(volume_server_pb::receive_file_request::Data::FileContent(
+                        b"data".to_vec(),
+                    )),
+                },
+            ];
+            tokio_stream::iter(messages)
+        };
+        let name = outside
+            .file_name()
+            .unwrap()
+            .to_str()
+            .unwrap()
+            .trim_end_matches("_777.dat")
+            .to_string();
+        let resp = client
+            .receive_file(send(format!("../{name}"), ".dat".to_string()))
+            .await
+            .unwrap()
+            .into_inner();
+        assert!(
+            resp.error.contains("invalid collection"),
+            "a collection that climbs out of the store must be rejected: {:?}",
+            resp.error
+        );
+        assert!(
+            !outside.exists(),
+            "rejected ReceiveFile must not create {}",
+            outside.display()
+        );
+
+        let resp = client
+            .receive_file(send(String::new(), "/../escape".to_string()))
+            .await
+            .unwrap()
+            .into_inner();
+        assert!(
+            resp.error.contains("invalid file extension"),
+            "an ext that climbs out of the store must be rejected: {:?}",
+            resp.error
+        );
+    }
+
+    /// A split -dir/-dir.idx decode target with the shards in the data dir.
+    /// The .ecx is moved to the idx dir, as VolumeEcShardsCopy leaves it, unless
+    /// `ecx_in_data_dir` (where VolumeEcShardsGenerate writes it). `journal` goes
+    /// into the idx-dir .ecj, where VolumeEcShardsCopy appends collected ones.
+    async fn make_split_idx_ec_decode_service(
+        journal: &[u64],
+        ecx_in_data_dir: bool,
+    ) -> (VolumeGrpcService, TempDir, String, String, u64) {
+        let tmp = TempDir::new().unwrap();
+        let data = tmp.path().join("data").to_str().unwrap().to_string();
+        let idx = tmp.path().join("idx").to_str().unwrap().to_string();
+        std::fs::create_dir_all(&data).unwrap();
+        std::fs::create_dir_all(&idx).unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                &data,
+                &idx,
+                10,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(0.0),
+                Vec::new(),
+            )
+            .unwrap();
+        store
+            .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+            .unwrap();
+        let mut size_before_needle_3 = 0;
+        {
+            let (_, volume) = store.find_volume(VolumeId(1)).unwrap();
+            for id in 1..=3u64 {
+                if id == 3 {
+                    size_before_needle_3 = volume.dat_file_size().unwrap();
+                }
+                let body = format!("split idx decode needle {id}").into_bytes();
+                let mut needle = Needle {
+                    id: NeedleId(id),
+                    cookie: Cookie(id as u32),
+                    data_size: body.len() as u32,
+                    data: body,
+                    ..Needle::default()
+                };
+                volume.write_needle(&mut needle, true, false).unwrap();
+            }
+            volume.sync_to_disk().unwrap();
+        }
+        let service = split_disk_grpc_service(store);
+        service
+            .volume_ec_shards_generate(Request::new(
+                volume_server_pb::VolumeEcShardsGenerateRequest {
+                    volume_id: 1,
+                    collection: String::new(),
+                },
+            ))
+            .await
+            .unwrap();
+
+        let mut store = service.state.store.write().unwrap();
+        store.unmount_volume(VolumeId(1)).unwrap();
+        std::fs::remove_file(format!("{data}/1.dat")).unwrap();
+        std::fs::remove_file(format!("{idx}/1.idx")).unwrap();
+        let ecx_dir = if ecx_in_data_dir {
+            data.clone()
+        } else {
+            std::fs::rename(format!("{data}/1.ecx"), format!("{idx}/1.ecx")).unwrap();
+            idx.clone()
+        };
+        let mut ecj = Vec::new();
+        for id in journal {
+            let mut buf = [0u8; NEEDLE_ID_SIZE];
+            NeedleId(*id).to_bytes(&mut buf);
+            ecj.extend_from_slice(&buf);
+        }
+        std::fs::write(format!("{idx}/1.ecj"), ecj).unwrap();
+        for shard_id in 0..14 {
+            store.mount_ec_shard(VolumeId(1), "", shard_id, "").unwrap();
+        }
+        assert_eq!(
+            store.find_ec_volume(VolumeId(1)).unwrap().ecx_actual_dir(),
+            ecx_dir,
+            "precondition: the mounted EC volume reads its .ecx from {ecx_dir}"
+        );
+        drop(store);
+        (service, tmp, data, idx, size_before_needle_3)
+    }
+
+    fn ec_shards_to_volume_request() -> Request<volume_server_pb::VolumeEcShardsToVolumeRequest> {
+        let mut request = Request::new(volume_server_pb::VolumeEcShardsToVolumeRequest {
+            volume_id: 1,
+            collection: String::new(),
+            ..Default::default()
+        });
+        request
+            .extensions_mut()
+            .insert(tonic::transport::server::TcpConnectInfo {
+                local_addr: None,
+                remote_addr: Some("127.0.0.1:65000".parse().unwrap()),
+            });
+        request
+    }
+
+    /// Mounts the decoded volume and checks its (file, deleted) counts, that it
+    /// is writable, that `live` needles read back and `deleted` ones stay deleted.
+    fn assert_decoded_volume(
+        service: &VolumeGrpcService,
+        counts: (i64, i64),
+        live: &[u64],
+        deleted: &[u64],
+    ) {
+        let mut store = service.state.store.write().unwrap();
+        let all_shards: Vec<ShardId> = (0..14).collect();
+        store.unmount_ec_shards(VolumeId(1), &all_shards);
+        store
+            .mount_volume(VolumeId(1), "", DiskType::HardDrive)
+            .unwrap();
+        let (_, v) = store.find_volume(VolumeId(1)).unwrap();
+        assert_eq!((v.file_count(), v.deleted_count()), counts);
+        assert!(
+            !v.is_no_write_or_delete(),
+            "no .idx row may point past the end of the decoded .dat"
+        );
+        for &id in live {
+            let mut n = Needle {
+                id: NeedleId(id),
+                ..Needle::default()
+            };
+            store.read_volume_needle(VolumeId(1), &mut n).unwrap();
+            assert_eq!(n.data, format!("split idx decode needle {id}").into_bytes());
+        }
+        for &id in deleted {
+            let mut n = Needle {
+                id: NeedleId(id),
+                ..Needle::default()
+            };
+            assert!(
+                store.read_volume_needle(VolumeId(1), &mut n).is_err(),
+                "needle {id} was deleted through the .ecj and must stay deleted"
+            );
+        }
+        let body = b"written after decode".to_vec();
+        let mut n = Needle {
+            id: NeedleId(4),
+            cookie: Cookie(4),
+            data_size: body.len() as u32,
+            data: body.clone(),
+            ..Needle::default()
+        };
+        store
+            .write_volume_needle(VolumeId(1), &mut n, true)
+            .unwrap();
+        let mut n = Needle {
+            id: NeedleId(4),
+            ..Needle::default()
+        };
+        store.read_volume_needle(VolumeId(1), &mut n).unwrap();
+        assert_eq!(n.data, body);
+    }
+
+    /// The decode's closing compaction fails when its .cpd cannot be created;
+    /// undo with [`unblock_decode_compaction`] before mounting.
+    fn block_decode_compaction(data: &str) {
+        std::fs::create_dir(format!("{data}/1.cpd")).unwrap();
+    }
+
+    fn unblock_decode_compaction(data: &str) {
+        std::fs::remove_dir(format!("{data}/1.cpd")).unwrap();
+        assert!(!std::path::Path::new(&format!("{data}/1.cpx")).exists());
+    }
+
+    /// ec.decode used to read the .ecx/.ecj from the data dir when writing the
+    /// .idx, failing with NotFound after the .dat was already published, and
+    /// ignored .ecj deletions when sizing the .dat (Go folds them in first).
+    /// Compaction is made to fail: the decode still succeeds, as in Go, so the
+    /// uncompacted .idx must stand on its own.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_reads_ecx_from_split_idx_dir() {
+        // The lowest key (the first .idx row) and the .dat tail, each journaled
+        // many times over.
+        let journal: Vec<u64> = std::iter::repeat_n([1, 3], 500).flatten().collect();
+        let (service, _tmp, data, idx, size_before_needle_3) =
+            make_split_idx_ec_decode_service(&journal, false).await;
+        let ecx = std::fs::read(format!("{idx}/1.ecx")).unwrap();
+        block_decode_compaction(&data);
+
+        service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap();
+        unblock_decode_compaction(&data);
+
+        // The journaled tail needle is not decoded.
+        assert_eq!(
+            std::fs::metadata(format!("{data}/1.dat")).unwrap().len(),
+            size_before_needle_3
+        );
+        // The .idx sits beside the .dat. It keeps the .ecx rows the .dat holds
+        // and tombstones each journaled one once, however often it was journaled.
+        let mut expected_idx = ecx[..2 * NEEDLE_MAP_ENTRY_SIZE].to_vec();
+        crate::storage::idx::write_index_entry(
+            &mut expected_idx,
+            NeedleId(1),
+            Offset::default(),
+            TOMBSTONE_FILE_SIZE,
+        )
+        .unwrap();
+        assert_eq!(
+            std::fs::read(format!("{data}/1.idx")).unwrap(),
+            expected_idx
+        );
+        assert!(!std::path::Path::new(&format!("{idx}/1.idx")).exists());
+
+        // Needle 1 is still in the .dat, so it counts as garbage; needle 3 is not.
+        assert_decoded_volume(&service, (2, 1), &[2], &[1, 3]);
+    }
+
+    /// Collected journals land in the idx dir even when the .ecx is beside the
+    /// shards, so the decode reads deletions from both.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_reads_idx_dir_ecj_with_data_dir_ecx() {
+        let (service, _tmp, data, _idx, size_before_needle_3) =
+            make_split_idx_ec_decode_service(&[3], true).await;
+
+        service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap();
+
+        assert_eq!(
+            std::fs::metadata(format!("{data}/1.dat")).unwrap().len(),
+            size_before_needle_3
+        );
+        assert_decoded_volume(&service, (2, 0), &[1, 2], &[3]);
+    }
+
+    /// A tail needle tombstoned in the .ecx itself (Go's RebuildEcxFile) is cut
+    /// from the .dat the same way, so its row must not survive either, even
+    /// when compaction fails.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_drops_sealed_tail_tombstone() {
+        let (service, _tmp, data, idx, size_before_needle_3) =
+            make_split_idx_ec_decode_service(&[], false).await;
+        let ecx_path = format!("{idx}/1.ecx");
+        let mut ecx = std::fs::read(&ecx_path).unwrap();
+        let size_at = 2 * NEEDLE_MAP_ENTRY_SIZE + NEEDLE_ID_SIZE + OFFSET_SIZE;
+        TOMBSTONE_FILE_SIZE.to_bytes(&mut ecx[size_at..size_at + SIZE_SIZE]);
+        std::fs::write(&ecx_path, &ecx).unwrap();
+        block_decode_compaction(&data);
+
+        service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap();
+        unblock_decode_compaction(&data);
+
+        assert_eq!(
+            std::fs::metadata(format!("{data}/1.dat")).unwrap().len(),
+            size_before_needle_3
+        );
+        assert_eq!(
+            std::fs::read(format!("{data}/1.idx")).unwrap(),
+            ecx[..2 * NEEDLE_MAP_ENTRY_SIZE]
+        );
+        assert_decoded_volume(&service, (2, 0), &[1, 2], &[3]);
+    }
+
+    /// Go compacts the decoded volume (CompactVolumeFiles), so needles deleted
+    /// through the .ecj leave the .dat and .idx instead of waiting for a vacuum.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_compacts_the_decoded_volume() {
+        let (service, _tmp, data, idx, _) = make_split_idx_ec_decode_service(&[1], false).await;
+        let vifs = || [&data, &idx].map(|dir| std::fs::read(format!("{dir}/1.vif")).ok());
+        let vifs_before = vifs();
+        assert!(vifs_before.iter().any(Option::is_some));
+
+        service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap();
+
+        let dat = std::fs::read(format!("{data}/1.dat")).unwrap();
+        let deleted_body = b"split idx decode needle 1";
+        assert!(
+            !dat.windows(deleted_body.len()).any(|w| w == deleted_body),
+            "the deleted needle must be compacted out of the .dat"
+        );
+        assert_eq!(dat[4..6], 1u16.to_be_bytes(), "compaction revision");
+        let idx = std::fs::read(format!("{data}/1.idx")).unwrap();
+        let idx_rows: Vec<(NeedleId, Size)> = idx
+            .as_chunks::<NEEDLE_MAP_ENTRY_SIZE>()
+            .0
+            .iter()
+            .map(|row| {
+                let (key, _, size) = idx_entry_from_bytes(row);
+                (key, size)
+            })
+            .collect();
+        assert_eq!(
+            idx_rows.iter().map(|(key, _)| key.0).collect::<Vec<_>>(),
+            [2, 3]
+        );
+        assert!(idx_rows.iter().all(|(_, size)| !size.is_deleted()));
+        assert_eq!(vifs(), vifs_before, "the EC .vif is left alone");
+
+        assert_decoded_volume(&service, (2, 0), &[2, 3], &[1]);
+    }
+
+    /// Deletions only in the .ecj count toward "no live entries", as after Go's
+    /// RebuildEcxFile, so the caller purges the shards instead of decoding.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_all_journaled_has_no_live_entries() {
+        let (service, _tmp, data, _idx, _) =
+            make_split_idx_ec_decode_service(&[1, 2, 3], false).await;
+
+        let err = service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap_err();
+        assert_eq!(err.code(), tonic::Code::FailedPrecondition, "{err:?}");
+        assert!(err.message().contains("has no live entries"), "{err:?}");
+        assert!(!std::path::Path::new(&format!("{data}/1.dat")).exists());
+        assert!(
+            std::path::Path::new(&format!("{data}/1.ecsum")).exists(),
+            "a failed decode keeps the shards' bitrot sidecar"
+        );
+    }
+
+    /// A decode drops the bitrot sidecars beside the .dat and the .ecx, as Go
+    /// does, so a stale .ecsum cannot vouch for a later re-encode.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_removes_bitrot_sidecars() {
+        let (service, _tmp, data, idx, _) = make_split_idx_ec_decode_service(&[], false).await;
+        assert!(
+            std::path::Path::new(&format!("{data}/1.ecsum")).exists(),
+            "precondition: the encode wrote a generation-0 sidecar"
+        );
+        let idx_sidecar = format!("{idx}/1.ecsum.v3");
+        let other_volume = format!("{data}/2.ecsum");
+        std::fs::write(&idx_sidecar, b"x").unwrap();
+        std::fs::write(&other_volume, b"x").unwrap();
+
+        service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap();
+
+        assert!(!std::path::Path::new(&format!("{data}/1.ecsum")).exists());
+        assert!(!std::path::Path::new(&idx_sidecar).exists());
+        assert!(std::path::Path::new(&other_volume).exists());
+    }
+
+    /// Only the .dat and .ecx dirs are swept: with the .ecx beside the shards,
+    /// the idx dir is not one of them.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_sweeps_sidecars_beside_dat_and_ecx_only() {
+        let (service, _tmp, data, idx, _) = make_split_idx_ec_decode_service(&[], true).await;
+        let idx_sidecar = format!("{idx}/1.ecsum");
+        std::fs::write(&idx_sidecar, b"x").unwrap();
+
+        service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap();
+
+        assert!(!std::path::Path::new(&format!("{data}/1.ecsum")).exists());
+        assert!(std::path::Path::new(&idx_sidecar).exists());
+    }
+
+    /// Replaces the idx-dir .ecj with a FIFO: the decode's open of it blocks
+    /// until [`release_ecj_fifo`] opens the write end.
+    #[cfg(unix)]
+    fn make_ecj_fifo(idx: &str) -> String {
+        let fifo = format!("{idx}/1.ecj");
+        std::fs::remove_file(&fifo).unwrap();
+        let path = std::ffi::CString::new(fifo.clone()).unwrap();
+        // SAFETY: `path` is a valid NUL-terminated string for the call.
+        assert_eq!(unsafe { libc::mkfifo(path.as_ptr(), 0o644) }, 0);
+        fifo
+    }
+
+    /// Opens the write end once the decode has the read end open, releasing
+    /// it. Keep the returned handle so a later open does not block again.
+    #[cfg(unix)]
+    fn release_ecj_fifo(fifo: &str) -> std::fs::File {
+        use std::os::unix::fs::OpenOptionsExt;
+        let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
+        loop {
+            match std::fs::OpenOptions::new()
+                .write(true)
+                .custom_flags(libc::O_NONBLOCK)
+                .open(fifo)
+            {
+                Ok(writer) => return writer,
+                // No reader yet.
+                Err(e)
+                    if e.raw_os_error() == Some(libc::ENXIO)
+                        && std::time::Instant::now() < deadline =>
+                {
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                }
+                Err(e) => panic!("the decode never opened the .ecj: {e}"),
+            }
+        }
+    }
+
+    /// The decode's file I/O used to run on the async runtime: parked on a
+    /// slow disk, it stalled every other task on that worker.
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn test_volume_ec_shards_to_volume_decodes_off_the_runtime() {
+        let (service, _tmp, data, idx, _) = make_split_idx_ec_decode_service(&[], true).await;
+        let fifo = make_ecj_fifo(&idx);
+
+        let probed = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let releaser = {
+            let probed = probed.clone();
+            let state = service.state.clone();
+            std::thread::spawn(move || {
+                let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+                while !probed.load(Ordering::SeqCst) && std::time::Instant::now() < deadline {
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                }
+                let probed_while_parked = probed.load(Ordering::SeqCst);
+                assert!(
+                    state.store.try_write().is_ok(),
+                    "the decode must not hold the store lock"
+                );
+                (probed_while_parked, release_ecj_fifo(&fifo))
+            })
+        };
+
+        let (result, ()) = tokio::join!(
+            service.volume_ec_shards_to_volume(ec_shards_to_volume_request()),
+            async { probed.store(true, Ordering::SeqCst) }
+        );
+        let (probed_while_parked, _writer) = releaser.join().unwrap();
+        result.unwrap();
+        assert!(
+            probed_while_parked,
+            "another task on the runtime must run while the decode is parked"
+        );
+        assert!(std::path::Path::new(&format!("{data}/1.dat")).exists());
+    }
+
+    /// A delete journaled while the .dat is written still reaches the .idx:
+    /// the journals are read again just before it.
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn test_volume_ec_shards_to_volume_keeps_a_delete_journaled_mid_decode() {
+        let (service, _tmp, _data, idx, _) = make_split_idx_ec_decode_service(&[], true).await;
+        let fifo = make_ecj_fifo(&idx);
+
+        let probed = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let deleter = {
+            let probed = probed.clone();
+            let state = service.state.clone();
+            std::thread::spawn(move || {
+                // The handler has taken its snapshot and handed off the decode.
+                let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+                while !probed.load(Ordering::SeqCst) && std::time::Instant::now() < deadline {
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                }
+                // Held until the delete is journaled, so the decode cannot
+                // catch up before it; the release proves the decode is parked
+                // on the idx-dir .ecj, past its first read of the data-dir one.
+                let mut store = state.store.write().unwrap();
+                let writer = release_ecj_fifo(&fifo);
+                store
+                    .find_ec_volume_mut(VolumeId(1))
+                    .unwrap()
+                    .journal_delete(NeedleId(2))
+                    .unwrap();
+                writer
+            })
+        };
+
+        let (result, ()) = tokio::join!(
+            service.volume_ec_shards_to_volume(ec_shards_to_volume_request()),
+            async { probed.store(true, Ordering::SeqCst) }
+        );
+        let _writer = deleter.join().unwrap();
+        result.unwrap();
+        assert_decoded_volume(&service, (2, 0), &[1, 3], &[2]);
+    }
+
+    /// A second decode while one is in flight is refused: the blocking job
+    /// outlives a dropped request and would race a retry on the same files.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_shards_to_volume_rejects_overlapping_decode() {
+        let (service, _tmp, _data, _idx, _) = make_split_idx_ec_decode_service(&[], false).await;
+        service
+            .state
+            .ec_decodes_in_flight
+            .lock()
+            .unwrap()
+            .insert(VolumeId(1));
+
+        let err = service
+            .volume_ec_shards_to_volume(ec_shards_to_volume_request())
+            .await
+            .unwrap_err();
+        assert_eq!(err.code(), tonic::Code::Unavailable);
+    }
+
+    /// The blob-delete tail check must run under the store write lock: a
+    /// delete that passed an unlocked check could still be parked behind
+    /// the decoder's read lock when the decode claims the tail, then commit
+    /// its journal append after the rebuilt .idx — an acknowledged delete
+    /// the mount would never see.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_ec_blob_delete_rechecks_tail_under_write_lock() {
+        let (service, _tmp, _data, idx, _) = make_split_idx_ec_decode_service(&[], false).await;
+        let state = service.state.clone();
+
+        // Park the delete on the store write lock, claimed in a thread so a
+        // std guard is never held across .await; the tail is claimed while
+        // it waits — the interleaving an unlocked check missed.
+        let claimed = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let held = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let releaser = {
+            let claimed = claimed.clone();
+            let held = held.clone();
+            let state = state.clone();
+            std::thread::spawn(move || {
+                let guard = state.store.write().unwrap();
+                held.store(true, Ordering::SeqCst);
+                while !claimed.load(Ordering::SeqCst) {
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                }
+                drop(guard);
+            })
+        };
+        // Spawn only once the write lock is held: on a slow runner the delete
+        // could otherwise acquire it first and commit before the tail exists.
+        while !held.load(Ordering::SeqCst) {
+            tokio::time::sleep(std::time::Duration::from_millis(5)).await;
+        }
+        let delete = tokio::spawn(async move {
+            service
+                .volume_ec_blob_delete(Request::new(volume_server_pb::VolumeEcBlobDeleteRequest {
+                    volume_id: 1,
+                    file_key: 1,
+                    collection: String::new(),
+                    version: 0,
+                }))
+                .await
+        });
+        tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+        state
+            .ec_decode_tail
+            .lock()
+            .unwrap()
+            .insert(VolumeId(1));
+        claimed.store(true, Ordering::SeqCst);
+        releaser.join().unwrap();
+
+        // Under the lock the delete sees the tail and parks on the notify.
+        tokio::time::sleep(std::time::Duration::from_millis(200)).await;
+        assert!(
+            !delete.is_finished(),
+            "a delete must not commit while its volume is in the decode tail"
+        );
+
+        state
+            .ec_decode_tail
+            .lock()
+            .unwrap()
+            .remove(&VolumeId(1));
+        state.ec_decode_tail_notify.notify_waiters();
+        delete.await.unwrap().unwrap();
+
+        let ecj = std::fs::read(format!("{idx}/1.ecj")).unwrap();
+        assert_eq!(
+            ecj.len(),
+            NEEDLE_ID_SIZE,
+            "the delayed delete must land on the surviving journal"
+        );
+    }
+
+    /// A normal mount must exclude an in-flight decode for the same volume —
+    /// it could observe a half-swapped .dat/.idx — without holding the set
+    /// lock across the disk work, and the claim must not outlive the call.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_volume_mount_claims_the_vid_against_decodes() {
+        let (service, _tmp) = make_local_service_with_volume("mount_claim", None);
+        let mount_req = |volume_id| {
+            Request::new(volume_server_pb::VolumeMountRequest {
+                volume_id,
+                collection: Some(String::new()),
+            })
+        };
+
+        service
+            .state
+            .ec_decodes_in_flight
+            .lock()
+            .unwrap()
+            .insert(VolumeId(1));
+        let err = service.volume_mount(mount_req(1)).await.unwrap_err();
+        assert_eq!(err.code(), tonic::Code::Unavailable);
+        service
+            .state
+            .ec_decodes_in_flight
+            .lock()
+            .unwrap()
+            .remove(&VolumeId(1));
+
+        // A mount that fails on disk still releases the claim it took.
+        let _ = service.volume_mount(mount_req(2)).await;
+        assert!(
+            service
+                .state
+                .ec_decodes_in_flight
+                .lock()
+                .unwrap()
+                .is_empty(),
+            "the mount claim must not outlive the call"
+        );
+    }
+
+    // Among storage errors, the filer requeues a delete only on "is read only"
+    // (Go's DeleteVolumeNeedle text).
+    #[tokio::test]
+    async fn test_batch_delete_on_read_only_volume_says_is_read_only() {
+        let request = || {
+            Request::new(volume_server_pb::BatchDeleteRequest {
+                file_ids: vec!["1,b00003344".to_string()],
+                skip_cookie_check: false,
+            })
+        };
+
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .find_volume(VolumeId(1))
+            .unwrap()
+            .1
+            .set_no_write_or_delete(true);
+        let resp = service.batch_delete(request()).await.unwrap().into_inner();
+        assert_eq!(resp.results.len(), 1);
+        assert_eq!(resp.results[0].status, 500);
+        assert_eq!(resp.results[0].error, "volume 1 is read only");
+
+        // Controls: a writable volume, and one read-only but deletable.
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        let resp = service.batch_delete(request()).await.unwrap().into_inner();
+        assert_eq!(resp.results[0].status, 202, "{:?}", resp.results[0].error);
+
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        service
+            .state
+            .store
+            .write()
+            .unwrap()
+            .find_volume(VolumeId(1))
+            .unwrap()
+            .1
+            .set_read_only_persist(true, false)
+            .unwrap();
+        let resp = service.batch_delete(request()).await.unwrap().into_inner();
+        assert_eq!(resp.results[0].status, 202, "{:?}", resp.results[0].error);
+    }
+
+    // Go says "volume N not found[ on host:port]" with the same statuses; the
+    // bare "not found" is kept on purpose: the filer skips it, whereas Go's
+    // text is booked permanent and outranks a retryable sibling replica.
+    #[tokio::test]
+    async fn test_batch_delete_on_missing_volume_says_not_found() {
+        let (service, _tmp) = make_local_service_with_volume("", None);
+        for (skip_cookie_check, status) in [(false, 404), (true, 500)] {
+            let resp = service
+                .batch_delete(Request::new(volume_server_pb::BatchDeleteRequest {
+                    file_ids: vec!["2,b00003344".to_string()],
+                    skip_cookie_check,
+                }))
+                .await
+                .unwrap()
+                .into_inner();
+            assert_eq!(resp.results[0].status, status, "skip={skip_cookie_check}");
+            assert_eq!(resp.results[0].error, "not found");
+        }
+    }
 }
diff --git a/seaweed-volume/src/server/handlers.rs b/seaweed-volume/src/server/handlers.rs
index 429a13cdde..1310793564 100644
--- a/seaweed-volume/src/server/handlers.rs
+++ b/seaweed-volume/src/server/handlers.rs
@@ -6,20 +6,23 @@
 
 use std::collections::HashMap;
 use std::future::Future;
-use std::sync::atomic::Ordering;
+use std::ops::ControlFlow;
 use std::sync::Arc;
+use std::sync::atomic::Ordering;
 
 use axum::body::Body;
 use axum::extract::{Path, Query, State};
-use axum::http::{header, HeaderMap, Method, Request, StatusCode};
+use axum::http::{HeaderMap, Method, Request, StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use serde::{Deserialize, Serialize};
 
-use super::grpc_client::{build_grpc_endpoint, GRPC_MAX_MESSAGE_SIZE};
-use super::volume_server::{normalize_outgoing_http_url, to_http_address, VolumeServerState};
+use super::absolute_display_path;
+use super::grpc_client::{GrpcDialOptions, connect_channel, volume_server_client};
+use super::volume_server::{VolumeServerState, normalize_outgoing_http_url, to_http_address};
 use crate::config::ReadMode;
 use crate::metrics;
 use crate::pb::volume_server_pb;
+use crate::storage::needle::CRC;
 use crate::storage::needle::needle::Needle;
 use crate::storage::types::*;
 
@@ -141,10 +144,97 @@ const STREAMING_THRESHOLD: u32 = 1024 * 1024; // 1 MB
 /// Default chunk size for streaming reads from the dat file.
 const DEFAULT_STREAMING_CHUNK_SIZE: usize = 64 * 1024; // 64 KB
 
+/// Whether a GET/HEAD can be answered from the needle meta and the data file.
+#[derive(Clone, Copy)]
+struct SourceReadRequest {
+    is_head: bool,
+    has_range: bool,
+    has_image_ops: bool,
+    bypass_cm: bool,
+}
+
+impl SourceReadRequest {
+    /// The payload can be served as stored.
+    fn direct(&self, n: &Needle) -> bool {
+        !n.is_compressed() && !(n.is_chunk_manifest() && !self.bypass_cm) && !self.has_image_ops
+    }
+
+    /// HEAD, a range, or a stream.
+    fn served_from_source(&self, n: &Needle) -> bool {
+        if self.is_head {
+            // HEAD is meta-only unless the payload is needed to expand a
+            // manifest or to answer an image transform's length.
+            return !self.has_image_ops && !(n.is_chunk_manifest() && !self.bypass_cm);
+        }
+        self.direct(n) && (self.has_range || n.data_size > STREAMING_THRESHOLD)
+    }
+
+    /// Meta first only if the needle could be served from source; its data
+    /// size is below its index size.
+    fn try_meta_first(&self, size: Size) -> bool {
+        if self.has_image_ops {
+            return false;
+        }
+        self.is_head || self.has_range || size.0 > STREAMING_THRESHOLD as i32
+    }
+}
+
+/// Blocking part of a GET/HEAD: the store guard is dropped before any needle
+/// I/O, so a slow or tiered read cannot park store writers. `Ok(None)` is a
+/// cookie mismatch.
+fn read_needle_for_get(
+    state: &VolumeServerState,
+    vid: VolumeId,
+    needle_id: NeedleId,
+    cookie: Cookie,
+    read_deleted: bool,
+    request: SourceReadRequest,
+) -> Result<
+    Option<(Needle, Option<crate::storage::volume::NeedleStreamInfo>)>,
+    crate::storage::volume::VolumeError,
+> {
+    let mut plan = state
+        .store
+        .read()
+        .unwrap()
+        .needle_read_plan(vid, needle_id, read_deleted)?;
+    let blank = || Needle {
+        id: needle_id,
+        cookie,
+        ..Needle::default()
+    };
+    let mut n = blank();
+    if request.try_meta_first(plan.size()) {
+        plan.read_meta(&mut n)?;
+        if n.cookie != cookie {
+            // The meta read answered the request.
+            plan.note_meta_only_success();
+            return Ok(None);
+        }
+        if request.served_from_source(&n) {
+            if request.is_head {
+                // HEAD ends here; no payload read will record the success.
+                plan.note_meta_only_success();
+            }
+            let info = plan.into_stream_info(&n);
+            return Ok(Some((n, Some(info))));
+        }
+        // Compressed or a chunk manifest: the payload is needed after all.
+        n = blank();
+    }
+    plan.read_full(&mut n)?;
+    if n.cookie != cookie {
+        return Ok(None);
+    }
+    Ok(Some((n, None)))
+}
+
 /// A body that streams needle data from the dat file in chunks using pread,
 /// avoiding loading the entire payload into memory at once.
 struct StreamingBody {
-    source: crate::storage::volume::NeedleStreamSource,
+    /// Opened at plan time: it pins the inode the offset was resolved against,
+    /// so a vacuum commit mid-stream moves nothing under it.
+    source: Arc<crate::storage::volume::NeedleStreamSource>,
     data_offset: u64,
     data_size: u32,
     pos: usize,
@@ -152,20 +242,22 @@ struct StreamingBody {
     data_file_access_control: Arc<crate::storage::volume::DataFileAccessControl>,
     hold_read_lock_for_stream: bool,
     _held_read_lease: Option<crate::storage::volume::DataFileReadLease>,
-    /// Pending result from spawn_blocking, polled to completion.
-    pending: Option<tokio::task::JoinHandle<Result<bytes::Bytes, std::io::Error>>>,
+    io_unavailable: Arc<crate::storage::volume::IoUnavailable>,
+    /// Chunk read failures feed the volume's io-error streak, and finishing
+    /// the stream clears it — Go readNeedleDataInto parity.
+    io_errors: Arc<crate::storage::io_error::IoErrorTracker>,
+    /// Pending chunk read; it hands `buf` back with the result.
+    pending: Option<tokio::task::JoinHandle<(bytes::BytesMut, std::io::Result<bytes::Bytes>)>>,
+    /// Chunk buffer, reclaimed once the previous frame has been written out.
+    buf: bytes::BytesMut,
     /// For download throttling — released on drop.
     state: Option<Arc<VolumeServerState>>,
     tracked_bytes: i64,
-    /// Server state used to re-lookup needle offset if compaction occurs during streaming.
-    server_state: Arc<VolumeServerState>,
-    /// Volume ID for compaction-revision re-lookup.
-    volume_id: crate::storage::types::VolumeId,
-    /// Needle ID for compaction-revision re-lookup.
     needle_id: crate::storage::types::NeedleId,
-    /// Compaction revision at the time of the initial read; if the volume's revision
-    /// changes between chunks, the needle may have moved and we must re-lookup its offset.
-    compaction_revision: u16,
+    /// Checksum stored in the needle tail.
+    expected_checksum: u32,
+    /// Running checksum over the emitted data.
+    crc: CRC,
 }
 
 impl http_body::Body for StreamingBody {
@@ -183,20 +275,52 @@ impl http_body::Body for StreamingBody {
                     std::task::Poll::Pending => return std::task::Poll::Pending,
                     std::task::Poll::Ready(result) => {
                         self.pending = None;
+                        let result = result.map(|(buf, read)| {
+                            self.buf = buf;
+                            read
+                        });
                         match result {
                             Ok(Ok(chunk)) => {
                                 let len = chunk.len();
+                                self.crc = self.crc.update(&chunk);
                                 self.pos += len;
+                                // The last frame is held back until the checksum verifies
+                                // (Go parity: readNeedleDataInto). On a mismatch it is
+                                // never emitted, so the response ends short of the declared
+                                // Content-Length and the reader sees a failed transfer.
+                                if self.pos >= self.data_size as usize {
+                                    let ok = self.expected_checksum == self.crc.0
+                                        || self.expected_checksum == self.crc.legacy_value();
+                                    if !ok {
+                                        metrics::HANDLER_COUNTER
+                                            .with_label_values(&[metrics::ERROR_CRC])
+                                            .inc();
+                                        return std::task::Poll::Ready(Some(Err(
+                                            std::io::Error::new(
+                                                std::io::ErrorKind::InvalidData,
+                                                format!(
+                                                    "needle data checksum {} expected {} for needle {}",
+                                                    self.crc.0,
+                                                    self.expected_checksum,
+                                                    self.needle_id
+                                                ),
+                                            ),
+                                        )));
+                                    }
+                                    // Hyper may not poll again once Content-Length is
+                                    // satisfied, so the read's success is recorded here.
+                                    self.io_errors.check_read_write_error(None);
+                                }
                                 return std::task::Poll::Ready(Some(Ok(http_body::Frame::data(
                                     chunk,
                                 ))));
                             }
-                            Ok(Err(e)) => return std::task::Poll::Ready(Some(Err(e))),
+                            Ok(Err(e)) => {
+                                self.io_errors.check_read_write_error(Some(&e));
+                                return std::task::Poll::Ready(Some(Err(e)));
+                            }
                             Err(e) => {
-                                return std::task::Poll::Ready(Some(Err(std::io::Error::new(
-                                    std::io::ErrorKind::Other,
-                                    e,
-                                ))))
+                                return std::task::Poll::Ready(Some(Err(std::io::Error::other(e))));
                             }
                         }
                     }
@@ -205,48 +329,17 @@ impl http_body::Body for StreamingBody {
 
             let total = self.data_size as usize;
             if self.pos >= total {
+                self.io_errors.check_read_write_error(None);
                 return std::task::Poll::Ready(None);
             }
 
-            // Check if compaction has changed the needle's disk location (Go parity:
-            // readNeedleDataInto re-reads the needle offset when CompactionRevision changes).
-            let relookup_result = {
-                let store = self.server_state.store.read().unwrap();
-                if let Some((_, vol)) = store.find_volume(self.volume_id) {
-                    if vol.super_block.compaction_revision != self.compaction_revision {
-                        // Compaction occurred — re-lookup the needle's data offset
-                        Some(vol.re_lookup_needle_data_offset(self.needle_id))
-                    } else {
-                        None
-                    }
-                } else {
-                    None
-                }
-            };
-            if let Some(result) = relookup_result {
-                match result {
-                    Ok((new_offset, new_rev)) => {
-                        self.data_offset = new_offset;
-                        self.compaction_revision = new_rev;
-                    }
-                    Err(_) => {
-                        return std::task::Poll::Ready(Some(Err(std::io::Error::new(
-                            std::io::ErrorKind::NotFound,
-                            "needle not found after compaction",
-                        ))));
-                    }
-                }
-            }
-
             let chunk_len = std::cmp::min(self.chunk_size, total - self.pos);
             let file_offset = self.data_offset + self.pos as u64;
-
-            let source_clone = match self.source.clone_for_read() {
-                Ok(source) => source,
-                Err(e) => return std::task::Poll::Ready(Some(Err(e))),
-            };
+            let source = self.source.clone();
             let data_file_access_control = self.data_file_access_control.clone();
             let hold_read_lock_for_stream = self.hold_read_lock_for_stream;
+            let io_unavailable = self.io_unavailable.clone();
+            let mut buf = std::mem::take(&mut self.buf);
 
             let handle = tokio::task::spawn_blocking(move || {
                 let _lease = if hold_read_lock_for_stream {
@@ -254,9 +347,15 @@ impl http_body::Body for StreamingBody {
                 } else {
                     Some(data_file_access_control.read_lock())
                 };
-                let mut buf = vec![0u8; chunk_len];
-                source_clone.read_exact_at(&mut buf, file_offset)?;
-                Ok::<bytes::Bytes, std::io::Error>(bytes::Bytes::from(buf))
+                // Under the lease: a writer marks the volume holding the write lock.
+                if let Some(e) = io_unavailable.error() {
+                    return (buf, Err(std::io::Error::other(e)));
+                }
+                buf.resize(chunk_len, 0);
+                let read = source
+                    .read_exact_at(&mut buf, file_offset)
+                    .map(|()| buf.split().freeze());
+                (buf, read)
             });
 
             self.pending = Some(handle);
@@ -282,33 +381,106 @@ impl Drop for StreamingBody {
 // URL Parsing
 // ============================================================================
 
-/// Parse volume ID and file ID from URL path.
-/// Supports: "vid,fid", "vid/fid", "vid,fid.ext", "vid/fid/filename.ext"
-/// Extract the file_id string (e.g., "3,01637037d6") from a URL path for JWT validation.
-fn extract_file_id(path: &str) -> String {
-    let path = path.trim_start_matches('/');
-    // Strip extension and filename after second slash
-    if let Some(comma) = path.find(',') {
-        let after_comma = &path[comma + 1..];
-        let fid_part = if let Some(slash) = after_comma.find('/') {
-            &after_comma[..slash]
-        } else if let Some(dot) = after_comma.rfind('.') {
-            &after_comma[..dot]
-        } else {
-            after_comma
-        };
-        // Strip "_suffix" from fid (Go does this for filenames appended with underscore)
-        let fid_part = if let Some(underscore) = fid_part.rfind('_') {
-            &fid_part[..underscore]
-        } else {
-            fid_part
-        };
-        format!("{},{}", &path[..comma], fid_part)
-    } else {
-        path.to_string()
+/// The pieces a needle URL carries, as Go's `parseURLPath` splits them
+/// (`weed/server/common.go:218-249`). Borrowed from the path so the callers
+/// that only need one field do not allocate.
+///
+/// `fid` keeps any `_delta` suffix, exactly like Go: applying the delta is
+/// `parse_needle_id_cookie`'s job (Go's `needle.ParsePath`), and the JWT check
+/// strips it separately.
+#[derive(Debug, PartialEq, Eq)]
+pub(crate) struct NeedlePath<'a> {
+    pub vid: &'a str,
+    pub fid: &'a str,
+    /// Extension including the dot (`.jpg`), or "" when the URL has none.
+    pub ext: &'a str,
+    /// The trailing display name of the `vid/fid/filename.ext` form only.
+    pub filename: Option<&'a str>,
+}
+
+/// Split a needle URL path into volume id, file id, extension and filename.
+///
+/// Dispatches on the slash count like Go's `parseURLPath`, which is what
+/// decides where the extension is taken from:
+/// - `/vid/fid/filename.ext` (Go case 3): the filename carries the extension
+///   and the fid is left intact.
+/// - `/vid/fid.ext` (Go case 2): the extension is split off the fid.
+/// - `/vid,fid.ext` (Go's default): the last path segment is split on its last
+///   comma, then on its last dot.
+///
+/// The leading slash is optional, so chunk manifest entries ("3,01637037d6")
+/// parse through the same function. Returns `None` for a path with no file id
+/// at all — Go's `isVolumeIdOnly` case — since every caller here needs one.
+pub(crate) fn parse_needle_path(path: &str) -> Option<NeedlePath<'_>> {
+    // Go counts one more slash than this because it keeps the leading one.
+    let trimmed = path.trim_start_matches('/');
+    match trimmed.matches('/').count() {
+        2 => {
+            let mut parts = trimmed.splitn(3, '/');
+            let vid = parts.next()?;
+            let fid = parts.next()?;
+            let filename = parts.next()?;
+            // Go uses filepath.Ext here, which has no "dot at index 0" guard.
+            let ext = filename.rfind('.').map_or("", |dot| &filename[dot..]);
+            Some(NeedlePath {
+                vid,
+                fid,
+                ext,
+                filename: Some(filename),
+            })
+        }
+        1 => {
+            let (vid, fid) = trimmed.split_once('/')?;
+            let (fid, ext) = split_extension(fid);
+            Some(NeedlePath {
+                vid,
+                fid,
+                ext,
+                filename: None,
+            })
+        }
+        _ => {
+            // Go looks only after the last slash, so a deeper path has no
+            // comma to find and falls out as invalid.
+            let segment = trimmed.rsplit_once('/').map_or(trimmed, |(_, last)| last);
+            let comma = segment.rfind(',')?;
+            let (fid, ext) = split_extension(&segment[comma + 1..]);
+            Some(NeedlePath {
+                vid: &segment[..comma],
+                fid,
+                ext,
+                filename: None,
+            })
+        }
     }
 }
 
+/// Split a trailing `.ext` off a file id. Go guards this with `dotIndex > 0`,
+/// so a file id that is nothing but an extension keeps it and fails to parse
+/// later instead of becoming empty here.
+fn split_extension(fid: &str) -> (&str, &str) {
+    match fid.rfind('.') {
+        Some(dot) if dot > 0 => (&fid[..dot], &fid[dot..]),
+        _ => (fid, ""),
+    }
+}
+
+/// Extract the file_id string (e.g., "3,01637037d6") from a URL path for JWT validation.
+///
+/// Go compares the token's `fid` claim against `vid + "," + fid` for every URL
+/// form, after dropping an `_suffix` (`volume_server_handlers.go:361-364`), so
+/// the comma form is emitted here even when the request used slashes.
+fn extract_file_id(path: &str) -> String {
+    let Some(parsed) = parse_needle_path(path) else {
+        return path.trim_start_matches('/').to_string();
+    };
+    let fid = match parsed.fid.rfind('_') {
+        Some(sep) if sep > 0 => &parsed.fid[..sep],
+        _ => parsed.fid,
+    };
+    format!("{},{}", parsed.vid, fid)
+}
+
 fn streaming_chunk_size(read_buffer_size_bytes: usize, data_size: usize) -> usize {
     std::cmp::min(
         read_buffer_size_bytes.max(DEFAULT_STREAMING_CHUNK_SIZE),
@@ -317,33 +489,11 @@ fn streaming_chunk_size(read_buffer_size_bytes: usize, data_size: usize) -> usiz
 }
 
 fn parse_url_path(path: &str) -> Option<(VolumeId, NeedleId, Cookie)> {
-    let path = path.trim_start_matches('/');
-
-    // Try "vid,fid" or "vid/fid" or "vid/fid/filename" formats
-    let (vid_str, fid_part) = if let Some(pos) = path.find(',') {
-        (&path[..pos], &path[pos + 1..])
-    } else if let Some(pos) = path.find('/') {
-        (&path[..pos], &path[pos + 1..])
-    } else {
-        return None;
-    };
-
-    // For fid part, strip extension from the fid (not from filename)
-    // "vid,fid.ext" -> fid is before dot
-    // "vid/fid/filename.ext" -> fid is the part before the second slash
-    let fid_str = if let Some(slash_pos) = fid_part.find('/') {
-        // "fid/filename.ext" - fid is before the slash
-        &fid_part[..slash_pos]
-    } else if let Some(dot) = fid_part.rfind('.') {
-        // "fid.ext" - strip extension
-        &fid_part[..dot]
-    } else {
-        fid_part
-    };
-
-    let vid = VolumeId::parse(vid_str).ok()?;
+    let parsed = parse_needle_path(path)?;
+    let vid = VolumeId::parse(parsed.vid).ok()?;
+    // parse_needle_id_cookie applies an `_delta` suffix itself (Go ParsePath).
     let (needle_id, cookie) =
-        crate::storage::needle::needle::parse_needle_id_cookie(fid_str).ok()?;
+        crate::storage::needle::needle::parse_needle_id_cookie(parsed.fid).ok()?;
 
     Some((vid, needle_id, cookie))
 }
@@ -356,6 +506,10 @@ fn parse_url_path(path: &str) -> Option<(VolumeId, NeedleId, Cookie)> {
 #[derive(Clone, Debug, Deserialize)]
 struct VolumeLocation {
     url: String,
+    #[serde(rename = "readOnly", default)]
+    read_only: bool,
+    #[serde(rename = "readOnlyCanDelete", default)]
+    read_only_can_delete: bool,
     // Master often omits publicUrl when it matches url (Go json omitempty).
     #[serde(rename = "publicUrl", default)]
     public_url: String,
@@ -405,10 +559,10 @@ async fn lookup_volume(
         .json()
         .await
         .map_err(|e| format!("lookup parse failed: {}", e))?;
-    if let Some(err) = result.error {
-        if !err.is_empty() {
-            return Err(err);
-        }
+    if let Some(err) = result.error
+        && !err.is_empty()
+    {
+        return Err(err);
     }
     Ok(result.locations.unwrap_or_default())
 }
@@ -465,7 +619,7 @@ async fn batch_delete_file_ids(
             let locations = lookup_volume(
                 &state.http_client,
                 &state.outgoing_http_scheme,
-                &state.master_url,
+                &state.current_master().await,
                 volume_id,
             )
             .await
@@ -488,19 +642,16 @@ async fn batch_delete_file_ids(
     }
 
     for (grpc_addr, batch) in server_to_file_ids {
-        let endpoint = build_grpc_endpoint(&grpc_addr, state.outgoing_grpc_tls.as_ref())
-            .map_err(|e| format!("batch delete {}: {}", grpc_addr, e))?;
-        let channel = endpoint
-            .connect()
-            .await
-            .map_err(|e| format!("batch delete {}: {}", grpc_addr, e))?;
-        let mut client =
-            volume_server_pb::volume_server_client::VolumeServerClient::with_interceptor(
-                channel,
-                super::request_id::outgoing_request_id_interceptor,
-            )
-            .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-            .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+        // BatchDelete is unary, but `stream()` is still right: this fan-out has
+        // no per-request deadline today, and `unary()` would add a 10 s one.
+        let channel = connect_channel(
+            &grpc_addr,
+            state.outgoing_grpc_tls.as_ref(),
+            GrpcDialOptions::stream(),
+        )
+        .await
+        .map_err(|e| format!("batch delete {}: {}", grpc_addr, e))?;
+        let mut client = volume_server_client(channel);
 
         let response = client
             .batch_delete(volume_server_pb::BatchDeleteRequest {
@@ -540,33 +691,45 @@ async fn do_replicated_request(
     let locations = lookup_volume(
         &state.http_client,
         &state.outgoing_http_scheme,
-        &state.master_url,
+        &state.current_master().await,
         vid,
     )
     .await
     .map_err(|e| format!("lookup volume failed: {}", e))?;
 
-    // Mirror Go's GetWritableRemoteReplications: reject when the master reports fewer replicas than
-    // the copy count. lookup_volume is uncached, so recovery is immediate once the replica re-registers.
     let copy_count = {
         let store = state.store.read().unwrap();
         store.find_volume(VolumeId(vid)).map_or(1, |(_, v)| {
-            v.super_block.replica_placement.get_copy_count()
+            v.super_block().replica_placement.get_copy_count()
         })
     };
-    if locations.len() < copy_count as usize {
+    let allow_delete = method == axum::http::Method::DELETE;
+    let eligible_locations: Vec<_> = locations
+        .into_iter()
+        .filter(|loc| {
+            (!loc.read_only && allow_delete)
+                || (!loc.read_only && !allow_delete)
+                || (allow_delete && loc.read_only_can_delete)
+        })
+        .collect();
+    if eligible_locations.len() < copy_count as usize {
         return Err(format!(
             "replicating operations [{}] is less than volume {} replication copy count [{}]",
-            locations.len(),
+            eligible_locations.len(),
             vid,
             copy_count
         ));
     }
 
     let self_http = to_http_address(&state.self_url);
-    let remote_locations: Vec<_> = locations
+    let remote_locations: Vec<_> = eligible_locations
         .into_iter()
         .filter(|loc| {
+            if (!allow_delete && loc.read_only)
+                || (allow_delete && loc.read_only && !loc.read_only_can_delete)
+            {
+                return false;
+            }
             to_http_address(&loc.url) != self_http
                 && to_http_address(loc.public_or_url()) != self_http
         })
@@ -661,35 +824,16 @@ fn build_proxy_request_info(
     headers: &HeaderMap,
     query_string: &str,
 ) -> Option<ProxyRequestInfo> {
-    let trimmed = path.trim_start_matches('/');
-    let (vid_str, fid_str) = if let Some(pos) = trimmed.find(',') {
-        let raw_fid = &trimmed[pos + 1..];
-        let fid = if let Some(slash) = raw_fid.find('/') {
-            &raw_fid[..slash]
-        } else if let Some(dot) = raw_fid.rfind('.') {
-            &raw_fid[..dot]
-        } else {
-            raw_fid
-        };
-        (trimmed[..pos].to_string(), fid.to_string())
-    } else if let Some(pos) = trimmed.find('/') {
-        let after = &trimmed[pos + 1..];
-        let fid_part = if let Some(slash) = after.find('/') {
-            &after[..slash]
-        } else {
-            after
-        };
-        (trimmed[..pos].to_string(), fid_part.to_string())
-    } else {
-        return None;
-    };
+    // Go redirects to "vid,fid" built from parseURLPath, so the extension must
+    // already be off the fid here (volume_server_handlers_read.go:128-137).
+    let parsed = parse_needle_path(path)?;
 
     Some(ProxyRequestInfo {
         original_headers: headers.clone(),
         original_query: query_string.to_string(),
         path: path.to_string(),
-        vid_str,
-        fid_str,
+        vid_str: parsed.vid.to_string(),
+        fid_str: parsed.fid.to_string(),
     })
 }
 
@@ -704,7 +848,7 @@ async fn proxy_or_redirect_to_target(
     let locations = match lookup_volume(
         &state.http_client,
         &state.outgoing_http_scheme,
-        &state.master_url,
+        &state.current_master().await,
         vid.0,
     )
     .await
@@ -779,11 +923,9 @@ async fn proxy_request(
     // Build the proxy request
     let mut req_builder = state.http_client.get(&target_url);
 
-    // Forward all original headers
+    // Forward all original headers as raw bytes, as Go does.
     for (name, value) in &info.original_headers {
-        if let Ok(v) = value.to_str() {
-            req_builder = req_builder.header(name.as_str(), v);
-        }
+        req_builder = req_builder.header(name.clone(), value.clone());
     }
 
     let resp = match req_builder.send().await {
@@ -802,7 +944,7 @@ async fn proxy_request(
         if name.as_str().eq_ignore_ascii_case("server") {
             continue;
         }
-        response_headers.insert(name.clone(), value.clone());
+        response_headers.append(name.clone(), value.clone());
     }
 
     // Stream the proxy response body instead of buffering it entirely
@@ -821,12 +963,12 @@ fn redirect_request(info: &ProxyRequestInfo, target: &VolumeLocation, scheme: &s
     let mut query_params = Vec::new();
     if !info.original_query.is_empty() {
         for param in info.original_query.split('&') {
-            if let Some((key, value)) = param.split_once('=') {
-                if key == "collection" {
-                    query_params.push(format!("collection={}", value));
-                }
-                // Intentionally drop readDeleted and other params (Go parity)
+            if let Some((key, value)) = param.split_once('=')
+                && key == "collection"
+            {
+                query_params.push(format!("collection={}", value));
             }
+            // Intentionally drop readDeleted and other params (Go parity)
         }
     }
     query_params.push("proxied=true".to_string());
@@ -836,7 +978,7 @@ fn redirect_request(info: &ProxyRequestInfo, target: &VolumeLocation, scheme: &s
     let target_http = to_http_address(&target.url);
     let raw_target = format!(
         "{}/{},{}?{}",
-        target_http, &info.vid_str, &info.fid_str, query
+        target_http, info.vid_str, info.fid_str, query
     );
     let location = match normalize_outgoing_http_url(scheme, &raw_target) {
         Ok(url) => url,
@@ -930,27 +1072,10 @@ async fn get_or_head_handler_inner(
     request: Request<Body>,
 ) -> Response {
     let path = request.uri().path().to_string();
-    let raw_query = request.uri().query().map(|q| q.to_string());
     let method = request.method().clone();
 
-    // JWT check for reads — must happen BEFORE path parsing to match Go behavior.
-    // Go's GetOrHeadHandler calls maybeCheckJwtAuthorization before NewVolumeId,
-    // so invalid paths with JWT enabled return 401, not 400.
-    let file_id = extract_file_id(&path);
-    let token = extract_jwt(&headers, request.uri());
-    if let Err(_) =
-        state
-            .guard
-            .read()
-            .unwrap()
-            .check_jwt_for_file(token.as_deref(), &file_id, false)
-    {
-        let body = serde_json::json!({"error": "wrong jwt"});
-        return Response::builder()
-            .status(StatusCode::UNAUTHORIZED)
-            .header(header::CONTENT_TYPE, "application/json")
-            .body(Body::from(serde_json::to_string(&body).unwrap()))
-            .unwrap();
+    if let Some(resp) = reject_read_jwt(&state, &headers, request.uri(), &path) {
+        return resp;
     }
 
     let (vid, needle_id, cookie) = match parse_url_path(&path) {
@@ -958,371 +1083,557 @@ async fn get_or_head_handler_inner(
         None => return StatusCode::BAD_REQUEST.into_response(),
     };
 
-    // Check if volume exists locally; if not, proxy/redirect based on read_mode.
-    // This mirrors Go's hasVolume + hasEcVolume check in GetOrHeadHandler.
-    // NOTE: The RwLockReadGuard must be dropped before any .await to keep the future Send.
+    // The RwLockReadGuard must drop before any .await to keep the future Send.
     let has_volume = state.store.read().unwrap().has_volume(vid);
     let has_ec_volume = state.store.read().unwrap().has_ec_volume(vid);
 
     if !has_volume && !has_ec_volume {
-        // Check if already proxied (loop prevention)
-        let query_string = request.uri().query().unwrap_or("").to_string();
-        let is_proxied = query_string.contains("proxied=true");
-
-        if is_proxied || state.read_mode == ReadMode::Local || state.master_url.is_empty() {
-            return StatusCode::NOT_FOUND.into_response();
-        }
-
-        // For redirect, fid must be stripped of extension (Go parity: parseURLPath returns raw fid).
-        let info = match build_proxy_request_info(&path, request.headers(), &query_string) {
-            Some(info) => info,
-            None => return StatusCode::NOT_FOUND.into_response(),
-        };
-
-        return proxy_or_redirect_to_target(&state, info, vid, false).await;
+        return proxy_missing_volume(&state, request.uri(), request.headers(), &path, vid).await;
     }
 
-    // Download throttling — matches Go's checkDownloadLimit + waitForDownloadSlot
-    let download_guard = if state.concurrent_download_limit > 0 {
-        let timeout = state.inflight_download_data_timeout;
-        let deadline = tokio::time::Instant::now() + timeout;
-        let query_string = request.uri().query().unwrap_or("").to_string();
-
-        let current = state.inflight_download_bytes.load(Ordering::Relaxed);
-        if current > state.concurrent_download_limit {
-            metrics::HANDLER_COUNTER
-                .with_label_values(&[metrics::DOWNLOAD_LIMIT_COND])
-                .inc();
-
-            // Go tries proxy to replica ONCE before entering the blocking wait
-            // loop (checkDownloadLimit L65). It does NOT retry on each wakeup.
-            let should_try_replica =
-                !query_string.contains("proxied=true") && !state.master_url.is_empty() && {
-                    let store = state.store.read().unwrap();
-                    store.find_volume(vid).map_or(false, |(_, vol)| {
-                        vol.super_block.replica_placement.get_copy_count() > 1
-                    })
-                };
-            if should_try_replica {
-                if let Some(info) =
-                    build_proxy_request_info(&path, request.headers(), &query_string)
-                {
-                    return proxy_or_redirect_to_target(&state, info, vid, true).await;
-                }
-            }
-
-            // Blocking wait loop (Go's waitForDownloadSlot)
-            loop {
-                if tokio::time::timeout_at(deadline, state.download_notify.notified())
-                    .await
-                    .is_err()
-                {
-                    return json_error_with_query(
-                        StatusCode::TOO_MANY_REQUESTS,
-                        "download limit exceeded",
-                        raw_query.as_deref(),
-                    );
-                }
-                let current = state.inflight_download_bytes.load(Ordering::Relaxed);
-                if current <= state.concurrent_download_limit {
-                    break;
-                }
-            }
-        }
-        // We'll set the actual bytes after reading the needle (once we know the size)
-        Some(state.clone())
-    } else {
-        None
-    };
-
-    // Read needle — branching between regular volume and EC volume paths.
-    // EC volumes always do a full read (no streaming/meta-only).
-    let mut n = Needle {
-        id: needle_id,
-        cookie,
-        ..Needle::default()
-    };
+    let track_download =
+        match check_download_limit(&state, request.uri(), request.headers(), &path, vid).await {
+            ControlFlow::Continue(track_download) => track_download,
+            ControlFlow::Break(resp) => return resp,
+        };
 
     let read_deleted = query.read_deleted.as_deref() == Some("true");
-    let has_range = headers.contains_key(header::RANGE);
-    let ext = extract_extension_from_path(&path);
-    // Go checks resize and crop extensions separately: resize supports .webp, crop does not.
-    let has_resize_ops =
-        is_image_resize_ext(&ext) && (query.width.unwrap_or(0) > 0 || query.height.unwrap_or(0) > 0);
-    // Go's shouldCropImages (L410) requires x2 > x1 && y2 > y1 (x1/y1 default 0).
-    // Only disable streaming when a real crop will actually happen.
-    let has_crop_ops = is_image_crop_ext(&ext) && {
-        let x1 = query.crop_x1.unwrap_or(0);
-        let y1 = query.crop_y1.unwrap_or(0);
-        let x2 = query.crop_x2.unwrap_or(0);
-        let y2 = query.crop_y2.unwrap_or(0);
-        x2 > x1 && y2 > y1
+    // Go reads Range once and ignores an empty value; a non-UTF-8 byte fails its parse.
+    let range = headers
+        .get(header::RANGE)
+        .map(|v| String::from_utf8_lossy(v.as_bytes()))
+        .filter(|r| !r.is_empty());
+    let (ext, request_kind) = parse_read_request(&path, range.is_some(), &query, &method);
+
+    // EC volumes always do a full read (no streaming/meta-only).
+    let plan = if has_ec_volume && !has_volume {
+        read_ec_shard_needle(&state, vid, needle_id, cookie).await
+    } else {
+        read_volume_needle(&state, vid, needle_id, cookie, read_deleted, request_kind).await
+    };
+    let ReadPlan {
+        needle: n,
+        strategy,
+    } = match plan {
+        ControlFlow::Continue(plan) => plan,
+        ControlFlow::Break(resp) => return resp,
     };
-    let has_image_ops = has_resize_ops || has_crop_ops;
 
-    // Stream info is only available for regular volumes, not EC volumes.
-    let stream_info;
-    let bypass_cm;
-    let track_download;
-    let can_stream;
-    let can_handle_head_from_meta;
-    let can_handle_range_from_source;
+    let (etag, last_modified_str) = etag_and_last_modified(&n);
+    if let Some(resp) = not_modified_response(&n, &headers, &etag, &last_modified_str) {
+        // A request that ends here was answered by the meta read alone.
+        if let Some(io_errors) = strategy.io_errors() {
+            io_errors.check_read_write_error(None);
+        }
+        return resp;
+    }
 
-    if has_ec_volume && !has_volume {
-        // ---- EC volume read path (always full read, no streaming) ----
-        //
-        // The distributed read path already does a local-first pass
-        // in its Snapshot phase under the same store read lock the
-        // legacy code would have taken — so calling it directly
-        // serves both the "all shards local" fast case and the
-        // "some intervals need peer fetch + reconstruct" general
-        // case without paying for the local interval reads twice.
-        match crate::server::store_ec::read_ec_shard_needle_distributed(
-            &state, vid, needle_id,
+    // Chunk manifest expansion needs the full data.
+    if n.is_chunk_manifest()
+        && !request_kind.bypass_cm
+        && let Some(expanded) = try_expand_chunk_manifest(
+            &state,
+            &n,
+            &path,
+            &query,
+            range.as_deref().filter(|_| method == Method::GET),
+            &method,
         )
         .await
+    {
+        // HEAD, and a Range the manifest path did not answer, apply to the assembled object.
+        return match expanded {
+            ControlFlow::Continue((data, response_headers)) => buffered_response(
+                &state,
+                range.as_deref(),
+                &method,
+                data,
+                response_headers,
+                track_download,
+            ),
+            ControlFlow::Break(resp) => resp,
+        };
+    }
+    // If manifest expansion fails (invalid JSON etc.), fall through to raw data
+
+    let (mut response_headers, ext) =
+        read_response_headers(&n, &path, &query, &etag, &last_modified_str, ext);
+
+    match strategy {
+        ReadStrategy::Stream(info) => {
+            return stream_response(&state, info, response_headers, track_download);
+        }
+        ReadStrategy::HeadFromMeta(info) => {
+            return head_from_meta_response(&info, response_headers);
+        }
+        ReadStrategy::RangeFromSource(info) => {
+            return range_from_source_response(
+                &state,
+                range.as_deref().unwrap_or_default(),
+                info,
+                response_headers,
+                track_download,
+            )
+            .await;
+        }
+        ReadStrategy::Buffered => {}
+    }
+
+    let data = match buffered_payload(
+        n,
+        &headers,
+        &query,
+        &ext,
+        request_kind.has_image_ops,
+        &mut response_headers,
+    ) {
+        ControlFlow::Continue(data) => data,
+        ControlFlow::Break(resp) => return resp,
+    };
+    buffered_response(
+        &state,
+        range.as_deref(),
+        &method,
+        data,
+        response_headers,
+        track_download,
+    )
+}
+
+/// How a GET/HEAD reply is produced once the needle is read.
+enum ReadStrategy {
+    /// Large, served as stored, no range: streamed from the data file.
+    Stream(crate::storage::volume::NeedleStreamInfo),
+    /// HEAD: answered from the needle meta.
+    HeadFromMeta(crate::storage::volume::NeedleStreamInfo),
+    /// A range over a payload served as stored: read from the data file.
+    RangeFromSource(crate::storage::volume::NeedleStreamInfo),
+    /// Everything else, from the needle data in memory.
+    Buffered,
+}
+
+/// The needle a GET/HEAD resolved to, and how its reply is produced.
+struct ReadPlan {
+    needle: Needle,
+    strategy: ReadStrategy,
+}
+
+impl ReadStrategy {
+    /// The tracker a terminal meta read reports success to, when the reply
+    /// is served from the data file.
+    fn io_errors(&self) -> Option<&Arc<crate::storage::io_error::IoErrorTracker>> {
+        match self {
+            ReadStrategy::Stream(info)
+            | ReadStrategy::HeadFromMeta(info)
+            | ReadStrategy::RangeFromSource(info) => Some(&info.io_errors),
+            ReadStrategy::Buffered => None,
+        }
+    }
+}
+
+/// The 401 reply for a bad read JWT; Go checks it before NewVolumeId, so a
+/// bad path with JWT enabled is a 401, not a 400.
+fn reject_read_jwt(
+    state: &VolumeServerState,
+    headers: &HeaderMap,
+    uri: &axum::http::Uri,
+    path: &str,
+) -> Option<Response> {
+    let file_id = extract_file_id(path);
+    let token = extract_jwt(headers, uri);
+    if state
+        .guard
+        .read()
+        .unwrap()
+        .check_jwt_for_file(token.as_deref(), &file_id, false)
+        .is_err()
+    {
+        let body = serde_json::json!({"error": "wrong jwt"});
+        return Some(
+            Response::builder()
+                .status(StatusCode::UNAUTHORIZED)
+                .header(header::CONTENT_TYPE, "application/json")
+                .body(Body::from(serde_json::to_string(&body).unwrap()))
+                .unwrap(),
+        );
+    }
+    None
+}
+
+/// The volume is not here: 404, or proxy/redirect to a holder per read_mode.
+async fn proxy_missing_volume(
+    state: &Arc<VolumeServerState>,
+    uri: &axum::http::Uri,
+    request_headers: &HeaderMap,
+    path: &str,
+    vid: VolumeId,
+) -> Response {
+    let query_string = uri.query().unwrap_or("").to_string();
+    if is_proxied_query(&query_string)
+        || state.read_mode == ReadMode::Local
+        || state.current_master().await.is_empty()
+    {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+
+    // For redirect, fid must be stripped of extension (Go parity: parseURLPath returns raw fid).
+    let info = match build_proxy_request_info(path, request_headers, &query_string) {
+        Some(info) => info,
+        None => return StatusCode::NOT_FOUND.into_response(),
+    };
+
+    proxy_or_redirect_to_target(state, info, vid, false).await
+}
+
+/// Go's `proxied` query param check (loop prevention).
+fn is_proxied_query(query_string: &str) -> bool {
+    query_string.split('&').any(|kv| kv == "proxied=true")
+}
+
+/// Download throttling — Go's checkDownloadLimit + waitForDownloadSlot.
+/// `Continue(true)` when the reply must count toward the inflight download bytes.
+async fn check_download_limit(
+    state: &Arc<VolumeServerState>,
+    uri: &axum::http::Uri,
+    request_headers: &HeaderMap,
+    path: &str,
+    vid: VolumeId,
+) -> ControlFlow<Response, bool> {
+    if state.concurrent_download_limit <= 0 {
+        return ControlFlow::Continue(false);
+    }
+    let timeout = state.inflight_download_data_timeout;
+    let deadline = tokio::time::Instant::now() + timeout;
+    let query_string = uri.query().unwrap_or("").to_string();
+
+    let current = state.inflight_download_bytes.load(Ordering::Relaxed);
+    if current > state.concurrent_download_limit {
+        metrics::HANDLER_COUNTER
+            .with_label_values(&[metrics::DOWNLOAD_LIMIT_COND])
+            .inc();
+
+        // Go tries proxy to replica once before the wait loop
+        // (checkDownloadLimit); it does not retry on each wakeup.
+        let should_try_replica =
+            !is_proxied_query(&query_string) && !state.current_master().await.is_empty() && {
+                let store = state.store.read().unwrap();
+                store
+                    .find_volume(vid)
+                    .is_some_and(|(_, vol)| vol.super_block().replica_placement.has_replication())
+            };
+        if should_try_replica
+            && let Some(info) = build_proxy_request_info(path, request_headers, &query_string)
         {
-            Ok(Some(ec_needle)) => {
-                n = ec_needle;
-            }
-            Ok(None) => {
-                metrics::HANDLER_COUNTER
-                    .with_label_values(&[metrics::ERROR_GET_NOT_FOUND])
-                    .inc();
-                return StatusCode::NOT_FOUND.into_response();
-            }
-            Err(e) => {
-                let kind = if e.kind() == std::io::ErrorKind::NotFound {
-                    metrics::ERROR_GET_NOT_FOUND
-                } else {
-                    metrics::ERROR_GET_INTERNAL
-                };
-                metrics::HANDLER_COUNTER.with_label_values(&[kind]).inc();
-                if e.kind() == std::io::ErrorKind::NotFound {
-                    return StatusCode::NOT_FOUND.into_response();
-                }
-                return (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("ec read: {}", e),
-                )
-                    .into_response();
-            }
+            return ControlFlow::Break(proxy_or_redirect_to_target(state, info, vid, true).await);
         }
 
-        // Validate cookie (matches Go behavior after ReadEcShardNeedle)
-        if n.cookie != cookie {
-            return StatusCode::NOT_FOUND.into_response();
+        // Blocking wait loop (Go's waitForDownloadSlot)
+        loop {
+            if tokio::time::timeout_at(deadline, state.download_notify.notified())
+                .await
+                .is_err()
+            {
+                return ControlFlow::Break(json_error_with_query(
+                    StatusCode::TOO_MANY_REQUESTS,
+                    "download limit exceeded",
+                    uri.query(),
+                ));
+            }
+            let current = state.inflight_download_bytes.load(Ordering::Relaxed);
+            if current <= state.concurrent_download_limit {
+                break;
+            }
         }
+    }
+    ControlFlow::Continue(true)
+}
 
-        // EC volumes: no streaming support
-        stream_info = None;
-        bypass_cm = query.cm.as_deref() == Some("false");
-        track_download = download_guard.is_some();
-        can_stream = false;
-        can_handle_head_from_meta = false;
-        can_handle_range_from_source = false;
-    } else {
-        // ---- Regular volume read path (with streaming support) ----
+/// The URL extension, and how the reply may be served.
+fn parse_read_request(
+    path: &str,
+    has_range: bool,
+    query: &ReadQueryParams,
+    method: &Method,
+) -> (String, SourceReadRequest) {
+    let ext = extract_extension_from_path(path);
+    // Go checks resize and crop extensions separately: resize supports .webp, crop does not.
+    let request_kind = SourceReadRequest {
+        is_head: method == Method::HEAD,
+        has_range,
+        has_image_ops: has_image_ops(&ext, query),
+        bypass_cm: query.cm.as_deref() == Some("false"),
+    };
+    (ext, request_kind)
+}
 
-        // Try meta-only read first for potential streaming
-        let store = state.store.read().unwrap();
-        let si_result = store.read_volume_needle_stream_info(vid, &mut n, read_deleted);
-        stream_info = match si_result {
-            Ok(info) => Some(info),
-            Err(crate::storage::volume::VolumeError::StreamingUnsupported) => None,
-            Err(crate::storage::volume::VolumeError::NotFound) => {
-                metrics::HANDLER_COUNTER
-                    .with_label_values(&[metrics::ERROR_GET_NOT_FOUND])
-                    .inc();
-                return StatusCode::NOT_FOUND.into_response();
+/// Full read from an EC volume; there is no streaming for EC.
+async fn read_ec_shard_needle(
+    state: &Arc<VolumeServerState>,
+    vid: VolumeId,
+    needle_id: NeedleId,
+    cookie: Cookie,
+) -> ControlFlow<Response, ReadPlan> {
+    // The distributed read does a local-first pass in its Snapshot phase, so
+    // calling it directly covers both the all-local fast case and the
+    // peer-fetch + reconstruct case without reading local intervals twice.
+    let n = match crate::server::store_ec::read_ec_shard_needle_distributed(state, vid, needle_id)
+        .await
+    {
+        Ok(Some(ec_needle)) => ec_needle,
+        Ok(None) => {
+            metrics::HANDLER_COUNTER
+                .with_label_values(&[metrics::ERROR_GET_NOT_FOUND])
+                .inc();
+            return ControlFlow::Break(StatusCode::NOT_FOUND.into_response());
+        }
+        Err(e) => {
+            let kind = if e.kind() == std::io::ErrorKind::NotFound {
+                metrics::ERROR_GET_NOT_FOUND
+            } else {
+                metrics::ERROR_GET_INTERNAL
+            };
+            metrics::HANDLER_COUNTER.with_label_values(&[kind]).inc();
+            if e.kind() == std::io::ErrorKind::NotFound {
+                return ControlFlow::Break(StatusCode::NOT_FOUND.into_response());
             }
-            Err(crate::storage::volume::VolumeError::Deleted) => {
-                metrics::HANDLER_COUNTER
-                    .with_label_values(&[metrics::ERROR_GET_NOT_FOUND])
-                    .inc();
-                return StatusCode::NOT_FOUND.into_response();
-            }
-            Err(e) => {
-                metrics::HANDLER_COUNTER
-                    .with_label_values(&[metrics::ERROR_GET_INTERNAL])
-                    .inc();
-                return (
+            return ControlFlow::Break(
+                (StatusCode::INTERNAL_SERVER_ERROR, format!("ec read: {}", e)).into_response(),
+            );
+        }
+    };
+
+    // Validate cookie (matches Go behavior after ReadEcShardNeedle)
+    if n.cookie != cookie {
+        return ControlFlow::Break(StatusCode::NOT_FOUND.into_response());
+    }
+    ControlFlow::Continue(ReadPlan {
+        needle: n,
+        strategy: ReadStrategy::Buffered,
+    })
+}
+
+/// Reads a regular volume's needle off the store lock, meta-only when the
+/// reply can be served from the data file.
+async fn read_volume_needle(
+    state: &Arc<VolumeServerState>,
+    vid: VolumeId,
+    needle_id: NeedleId,
+    cookie: Cookie,
+    read_deleted: bool,
+    request_kind: SourceReadRequest,
+) -> ControlFlow<Response, ReadPlan> {
+    let has_range = request_kind.has_range;
+    let is_head = request_kind.is_head;
+
+    let read_state = state.clone();
+    let read = tokio::task::spawn_blocking(move || {
+        read_needle_for_get(
+            &read_state,
+            vid,
+            needle_id,
+            cookie,
+            read_deleted,
+            request_kind,
+        )
+    })
+    .await;
+    let (n, stream_info) = match read {
+        Ok(Ok(Some(found))) => found,
+        // Cookie mismatch
+        Ok(Ok(None)) => return ControlFlow::Break(StatusCode::NOT_FOUND.into_response()),
+        Ok(Err(
+            crate::storage::volume::VolumeError::NotFound
+            | crate::storage::volume::VolumeError::Deleted,
+        )) => {
+            metrics::HANDLER_COUNTER
+                .with_label_values(&[metrics::ERROR_GET_NOT_FOUND])
+                .inc();
+            return ControlFlow::Break(StatusCode::NOT_FOUND.into_response());
+        }
+        Ok(Err(e)) => {
+            metrics::HANDLER_COUNTER
+                .with_label_values(&[metrics::ERROR_GET_INTERNAL])
+                .inc();
+            return ControlFlow::Break(
+                (
                     StatusCode::INTERNAL_SERVER_ERROR,
                     format!("read error: {}", e),
                 )
-                    .into_response();
-            }
-        };
-        drop(store);
-
-        // Validate cookie
-        if n.cookie != cookie {
-            return StatusCode::NOT_FOUND.into_response();
+                    .into_response(),
+            );
         }
-
-        bypass_cm = query.cm.as_deref() == Some("false");
-        track_download = download_guard.is_some();
-        let can_direct_source_read = stream_info.is_some()
-            && !n.is_compressed()
-            && !(n.is_chunk_manifest() && !bypass_cm)
-            && !has_image_ops;
-
-        // Determine if we can stream (large, direct-source eligible, no range)
-        can_stream = can_direct_source_read
-            && n.data_size > STREAMING_THRESHOLD
-            && !has_range
-            && method != Method::HEAD;
-
-        // Go uses meta-only reads for all HEAD requests, regardless of compression/chunked files.
-        can_handle_head_from_meta = stream_info.is_some() && method == Method::HEAD;
-        can_handle_range_from_source = can_direct_source_read && has_range;
-
-        // For chunk manifest or any non-streaming path, we need the full data.
-        // If we can't stream, do a full read now.
-        if !can_stream && !can_handle_head_from_meta && !can_handle_range_from_source {
-            // Re-read with full data
-            let mut n_full = Needle {
-                id: needle_id,
-                cookie,
-                ..Needle::default()
-            };
-            let store = state.store.read().unwrap();
-            match store.read_volume_needle_opt(vid, &mut n_full, read_deleted) {
-                Ok(count) => {
-                    if count < 0 {
-                        return StatusCode::NOT_FOUND.into_response();
-                    }
-                }
-                Err(crate::storage::volume::VolumeError::NotFound) => {
-                    return StatusCode::NOT_FOUND.into_response();
-                }
-                Err(crate::storage::volume::VolumeError::Deleted) => {
-                    return StatusCode::NOT_FOUND.into_response();
-                }
-                Err(e) => {
-                    return (
-                        StatusCode::INTERNAL_SERVER_ERROR,
-                        format!("read error: {}", e),
-                    )
-                        .into_response();
-                }
-            }
-            drop(store);
-            // Use the full needle from here (it has the same metadata + data)
-            n = n_full;
+        Err(e) => {
+            metrics::HANDLER_COUNTER
+                .with_label_values(&[metrics::ERROR_GET_INTERNAL])
+                .inc();
+            return ControlFlow::Break(
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("read error: {}", e),
+                )
+                    .into_response(),
+            );
         }
-    }
+    };
 
-    // Build ETag and Last-Modified BEFORE conditional checks and chunk manifest expansion
-    // (matches Go order: conditional checks first, then chunk manifest)
+    // Stream info is only returned for a reply served from the data file.
+    let can_direct_source_read = stream_info.is_some() && request_kind.direct(&n);
+
+    let can_stream =
+        can_direct_source_read && n.data_size > STREAMING_THRESHOLD && !has_range && !is_head;
+    // HEAD is meta-only when served_from_source loaded no payload. A chunk
+    // manifest without cm=false is read in full so expansion can run.
+    let can_handle_head_from_meta = stream_info.is_some() && is_head;
+    let can_handle_range_from_source = can_direct_source_read && has_range;
+
+    let strategy = match stream_info {
+        Some(info) if can_stream => ReadStrategy::Stream(info),
+        Some(info) if can_handle_head_from_meta => ReadStrategy::HeadFromMeta(info),
+        Some(info) if can_handle_range_from_source => ReadStrategy::RangeFromSource(info),
+        _ => ReadStrategy::Buffered,
+    };
+    ControlFlow::Continue(ReadPlan {
+        needle: n,
+        strategy,
+    })
+}
+
+/// The ETag, and Last-Modified in RFC 1123 format.
+fn etag_and_last_modified(n: &Needle) -> (String, Option<String>) {
     let etag = format!("\"{}\"", n.etag());
-
-    // Build Last-Modified header (RFC 1123 format) — must be done before conditional checks
     let last_modified_str = if n.last_modified > 0 {
         use chrono::{TimeZone, Utc};
-        if let Some(dt) = Utc.timestamp_opt(n.last_modified as i64, 0).single() {
-            Some(dt.format("%a, %d %b %Y %H:%M:%S GMT").to_string())
-        } else {
-            None
-        }
+        Utc.timestamp_opt(n.last_modified as i64, 0)
+            .single()
+            .map(|dt| dt.format("%a, %d %b %Y %H:%M:%S GMT").to_string())
     } else {
         None
     };
+    (etag, last_modified_str)
+}
 
-    // Check If-Modified-Since FIRST (Go checks this before If-None-Match)
-    if n.last_modified > 0 {
-        if let Some(ims_header) = headers.get(header::IF_MODIFIED_SINCE) {
-            if let Ok(ims_str) = ims_header.to_str() {
-                // Parse HTTP date format: "Mon, 02 Jan 2006 15:04:05 GMT"
-                if let Ok(ims_time) =
-                    chrono::NaiveDateTime::parse_from_str(ims_str, "%a, %d %b %Y %H:%M:%S GMT")
-                {
-                    if (n.last_modified as i64) <= ims_time.and_utc().timestamp() {
-                        let mut resp = StatusCode::NOT_MODIFIED.into_response();
-                        if let Some(ref lm) = last_modified_str {
-                            resp.headers_mut()
-                                .insert(header::LAST_MODIFIED, lm.parse().unwrap());
-                        }
-                        // Go sets ETag AFTER the 304 return paths (L235), so 304 does NOT include ETag
-                        return resp;
-                    }
-                }
-            }
+/// The 304 reply, if a conditional header matches.
+fn not_modified_response(
+    n: &Needle,
+    headers: &HeaderMap,
+    etag: &str,
+    last_modified_str: &Option<String>,
+) -> Option<Response> {
+    let not_modified = || {
+        let mut resp = StatusCode::NOT_MODIFIED.into_response();
+        resp.headers_mut()
+            .insert(header::ETAG, etag.parse().unwrap());
+        if let Some(lm) = last_modified_str {
+            resp.headers_mut()
+                .insert(header::LAST_MODIFIED, lm.parse().unwrap());
         }
+        resp
+    };
+
+    // If-Modified-Since applies only when there is no If-None-Match (RFC 9110 13.2.2).
+    if headers.contains_key(header::IF_NONE_MATCH) {
+        let inm = headers
+            .get_all(header::IF_NONE_MATCH)
+            .iter()
+            .map(|v| v.to_str().unwrap_or(""))
+            .collect::<Vec<_>>()
+            .join(",");
+        return etag_list_matches(&inm, etag).then(not_modified);
     }
 
-    // Check If-None-Match SECOND
-    if let Some(if_none_match) = headers.get(header::IF_NONE_MATCH) {
-        if let Ok(inm) = if_none_match.to_str() {
-            if inm == etag {
-                let mut resp = StatusCode::NOT_MODIFIED.into_response();
-                if let Some(ref lm) = last_modified_str {
-                    resp.headers_mut()
-                        .insert(header::LAST_MODIFIED, lm.parse().unwrap());
-                }
-                // Go sets ETag AFTER the 304 return paths (L235), so 304 does NOT include ETag
-                return resp;
-            }
-        }
-    }
-
-    // Chunk manifest expansion (needs full data) — after conditional checks, before response
-    // Pass ETag so chunk manifest responses include it (matches Go: ETag is set on the
-    // response writer before tryHandleChunkedFile runs).
-    if n.is_chunk_manifest() && !bypass_cm {
-        if let Some(resp) = try_expand_chunk_manifest(
-            &state,
-            &n,
-            &headers,
-            &method,
-            &path,
-            &query,
-            &etag,
-            &last_modified_str,
-        )
-        .await
+    if n.last_modified > 0
+        && let Some(ims_str) = headers
+            .get(header::IF_MODIFIED_SINCE)
+            .and_then(|v| v.to_str().ok())
+    {
+        // Parse HTTP date format: "Mon, 02 Jan 2006 15:04:05 GMT"
+        if let Ok(ims_time) =
+            chrono::NaiveDateTime::parse_from_str(ims_str, "%a, %d %b %Y %H:%M:%S GMT")
+            && (n.last_modified as i64) <= ims_time.and_utc().timestamp()
         {
-            return resp;
+            return Some(not_modified());
         }
-        // If manifest expansion fails (invalid JSON etc.), fall through to raw data
     }
+    None
+}
 
+/// Weak comparison against "*" or a comma-separated entity-tag list (RFC 9110 13.1.2).
+fn etag_list_matches(header: &str, etag: &str) -> bool {
+    if header.trim() == "*" {
+        return true;
+    }
+    let etag = etag.trim_matches('"');
+    split_etag_list(header).into_iter().any(|tag| {
+        let tag = tag.trim();
+        let tag = tag.strip_prefix("W/").unwrap_or(tag);
+        // Empty list elements are ignored, so padding like a trailing
+        // comma cannot match an empty opaque tag.
+        !tag.is_empty() && tag.trim_matches('"') == etag
+    })
+}
+
+/// Splits an entity-tag list on the commas between tags; a comma inside a
+/// quoted opaque tag does not split.
+fn split_etag_list(header: &str) -> Vec<&str> {
+    let mut tags = Vec::new();
+    let (mut start, mut quoted) = (0, false);
+    for (i, b) in header.bytes().enumerate() {
+        match b {
+            b'"' => quoted = !quoted,
+            b',' if !quoted => {
+                tags.push(&header[start..i]);
+                start = i + 1;
+            }
+            _ => {}
+        }
+    }
+    tags.push(&header[start..]);
+    tags
+}
+
+/// The 200 reply headers, and the extension, which falls back to the stored name's.
+fn read_response_headers(
+    n: &Needle,
+    path: &str,
+    query: &ReadQueryParams,
+    etag: &str,
+    last_modified_str: &Option<String>,
+    ext: String,
+) -> (HeaderMap, String) {
     let mut response_headers = HeaderMap::new();
     response_headers.insert(header::ETAG, etag.parse().unwrap());
 
     // H1: Emit pairs as response headers
-    if n.has_pairs() && !n.pairs.is_empty() {
-        if let Ok(pair_map) =
+    if n.has_pairs()
+        && !n.pairs.is_empty()
+        && let Ok(pair_map) =
             serde_json::from_slice::<std::collections::HashMap<String, String>>(&n.pairs)
-        {
-            for (k, v) in &pair_map {
-                if let (Ok(hname), Ok(hval)) = (
-                    axum::http::HeaderName::from_bytes(k.as_bytes()),
-                    axum::http::HeaderValue::from_str(v),
-                ) {
-                    response_headers.insert(hname, hval);
-                }
+    {
+        for (k, v) in &pair_map {
+            if let (Ok(hname), Ok(hval)) = (
+                axum::http::HeaderName::from_bytes(k.as_bytes()),
+                axum::http::HeaderValue::from_str(v),
+            ) {
+                response_headers.insert(hname, hval);
             }
         }
     }
 
     // H8: Use needle stored name when URL path has no filename (only vid,fid)
-    let mut filename = extract_filename_from_path(&path);
+    let mut filename = extract_filename_from_path(path);
     let mut ext = ext;
     if n.name_size > 0 && filename.is_empty() {
         filename = String::from_utf8_lossy(&n.name).to_string();
-        if ext.is_empty() {
-            if let Some(dot_pos) = filename.rfind('.') {
-                ext = filename[dot_pos..].to_lowercase();
-            }
+        if ext.is_empty()
+            && let Some(dot_pos) = filename.rfind('.')
+        {
+            ext = filename[dot_pos..].to_lowercase();
         }
     }
 
     // H6: Determine Content-Type: filter application/octet-stream, use mime_guess
     // For chunk manifests, skip extension-based MIME override — use stored MIME as-is (Go parity)
-    let content_type = if let Some(ref ct) = query.response_content_type {
-        Some(ct.clone())
-    } else if n.is_chunk_manifest() {
+    let content_type = if n.is_chunk_manifest() {
         // Chunk manifests: use stored MIME but filter application/octet-stream (Go L334)
         if !n.mime.is_empty() {
             let mt = String::from_utf8_lossy(&n.mime).to_string();
@@ -1371,31 +1682,54 @@ async fn get_or_head_handler_inner(
             }
         }
     };
-    if let Some(ref ct) = content_type {
-        response_headers.insert(header::CONTENT_TYPE, ct.parse().unwrap());
+    // Every value below can come straight from the query string, so none of
+    // them may be unwrapped: `?response-cache-control=%0Aevil` decodes to a
+    // value with a newline, `HeaderValue::from_str` rejects it, and the unwrap
+    // would panic the connection task. An invalid `response-content-type`
+    // falls back to the needle MIME rather than dropping Content-Type.
+    if let Some(hval) = query
+        .response_content_type
+        .as_ref()
+        .and_then(|ct| ct.parse::<header::HeaderValue>().ok())
+    {
+        response_headers.insert(header::CONTENT_TYPE, hval);
+    } else if let Some(ref ct) = content_type
+        && let Ok(hval) = ct.parse()
+    {
+        response_headers.insert(header::CONTENT_TYPE, hval);
     }
 
     // Cache-Control override from query param
-    if let Some(ref cc) = query.response_cache_control {
-        response_headers.insert(header::CACHE_CONTROL, cc.parse().unwrap());
+    if let Some(ref cc) = query.response_cache_control
+        && let Ok(hval) = cc.parse()
+    {
+        response_headers.insert(header::CACHE_CONTROL, hval);
     }
 
     // S3 response passthrough headers
-    if let Some(ref ce) = query.response_content_encoding {
-        response_headers.insert(header::CONTENT_ENCODING, ce.parse().unwrap());
+    if let Some(ref ce) = query.response_content_encoding
+        && let Ok(hval) = ce.parse()
+    {
+        response_headers.insert(header::CONTENT_ENCODING, hval);
     }
-    if let Some(ref exp) = query.response_expires {
-        response_headers.insert(header::EXPIRES, exp.parse().unwrap());
+    if let Some(ref exp) = query.response_expires
+        && let Ok(hval) = exp.parse()
+    {
+        response_headers.insert(header::EXPIRES, hval);
     }
-    if let Some(ref cl) = query.response_content_language {
-        response_headers.insert("Content-Language", cl.parse().unwrap());
+    if let Some(ref cl) = query.response_content_language
+        && let Ok(hval) = cl.parse()
+    {
+        response_headers.insert("Content-Language", hval);
     }
-    if let Some(ref cd) = query.response_content_disposition {
-        response_headers.insert(header::CONTENT_DISPOSITION, cd.parse().unwrap());
+    if let Some(ref cd) = query.response_content_disposition
+        && let Ok(hval) = cd.parse()
+    {
+        response_headers.insert(header::CONTENT_DISPOSITION, hval);
     }
 
     // Last-Modified
-    if let Some(ref lm) = last_modified_str {
+    if let Some(lm) = last_modified_str {
         response_headers.insert(header::LAST_MODIFIED, lm.parse().unwrap());
     }
 
@@ -1416,105 +1750,127 @@ async fn get_or_head_handler_inner(
             response_headers.insert(header::CONTENT_DISPOSITION, hval);
         }
     }
+    (response_headers, ext)
+}
 
-    // ---- Streaming path: large uncompressed files ----
-    if can_stream {
-        if let Some(info) = stream_info {
-            response_headers.insert(header::ACCEPT_RANGES, "bytes".parse().unwrap());
-            response_headers.insert(
-                header::CONTENT_LENGTH,
-                info.data_size.to_string().parse().unwrap(),
-            );
+/// Streaming path: large uncompressed files.
+fn stream_response(
+    state: &Arc<VolumeServerState>,
+    info: crate::storage::volume::NeedleStreamInfo,
+    mut response_headers: HeaderMap,
+    track_download: bool,
+) -> Response {
+    response_headers.insert(header::ACCEPT_RANGES, "bytes".parse().unwrap());
+    response_headers.insert(
+        header::CONTENT_LENGTH,
+        info.data_size.to_string().parse().unwrap(),
+    );
 
-            let tracked_bytes = info.data_size as i64;
-            let tracking_state = if download_guard.is_some() {
-                let new_val = state
-                    .inflight_download_bytes
-                    .fetch_add(tracked_bytes, Ordering::Relaxed)
-                    + tracked_bytes;
-                metrics::INFLIGHT_DOWNLOAD_SIZE.set(new_val);
-                Some(state.clone())
-            } else {
-                None
-            };
+    let tracked_bytes = info.data_size as i64;
+    let tracking_state = if track_download {
+        let new_val = state
+            .inflight_download_bytes
+            .fetch_add(tracked_bytes, Ordering::Relaxed)
+            + tracked_bytes;
+        metrics::INFLIGHT_DOWNLOAD_SIZE.set(new_val);
+        Some(state.clone())
+    } else {
+        None
+    };
 
-            let streaming = StreamingBody {
-                source: info.source,
-                data_offset: info.data_file_offset,
-                data_size: info.data_size,
-                pos: 0,
-                chunk_size: streaming_chunk_size(
-                    state.read_buffer_size_bytes,
-                    info.data_size as usize,
-                ),
-                _held_read_lease: if state.has_slow_read {
-                    None
-                } else {
-                    Some(info.data_file_access_control.read_lock())
-                },
-                data_file_access_control: info.data_file_access_control,
-                hold_read_lock_for_stream: !state.has_slow_read,
-                pending: None,
-                state: tracking_state,
-                tracked_bytes,
-                server_state: state.clone(),
-                volume_id: info.volume_id,
-                needle_id: info.needle_id,
-                compaction_revision: info.compaction_revision,
-            };
+    let streaming = StreamingBody {
+        source: Arc::new(info.source),
+        data_offset: info.data_file_offset,
+        data_size: info.data_size,
+        pos: 0,
+        chunk_size: streaming_chunk_size(state.read_buffer_size_bytes, info.data_size as usize),
+        _held_read_lease: if state.has_slow_read {
+            None
+        } else {
+            Some(info.data_file_access_control.read_lock())
+        },
+        data_file_access_control: info.data_file_access_control,
+        hold_read_lock_for_stream: !state.has_slow_read,
+        io_unavailable: info.io_unavailable,
+        io_errors: info.io_errors,
+        pending: None,
+        buf: bytes::BytesMut::new(),
+        state: tracking_state,
+        tracked_bytes,
+        needle_id: info.needle_id,
+        expected_checksum: info.checksum,
+        crc: CRC(0),
+    };
 
-            let body = Body::new(streaming);
-            let mut resp = Response::new(body);
-            *resp.status_mut() = StatusCode::OK;
-            *resp.headers_mut() = response_headers;
-            return resp;
-        }
-    }
+    let body = Body::new(streaming);
+    let mut resp = Response::new(body);
+    *resp.status_mut() = StatusCode::OK;
+    *resp.headers_mut() = response_headers;
+    resp
+}
 
-    if can_handle_head_from_meta {
-        if let Some(info) = stream_info {
-            response_headers.insert(
-                header::CONTENT_LENGTH,
-                info.data_size.to_string().parse().unwrap(),
-            );
-            return (StatusCode::OK, response_headers).into_response();
-        }
-    }
+/// HEAD from the needle meta: Content-Length is the stored data size.
+fn head_from_meta_response(
+    info: &crate::storage::volume::NeedleStreamInfo,
+    mut response_headers: HeaderMap,
+) -> Response {
+    response_headers.insert(
+        header::CONTENT_LENGTH,
+        info.data_size.to_string().parse().unwrap(),
+    );
+    (StatusCode::OK, response_headers).into_response()
+}
 
-    if can_handle_range_from_source {
-        if let (Some(range_header), Some(info)) = (headers.get(header::RANGE), stream_info) {
-            if let Ok(range_str) = range_header.to_str() {
-                return handle_range_request_from_source(
-                    range_str,
-                    info,
-                    response_headers,
-                    track_download.then(|| state.clone()),
-                );
-            }
-        }
-    }
-
-    // ---- Buffered path: small files, compressed, images, range requests ----
+/// A range over a payload served as stored, read from the data file.
+async fn range_from_source_response(
+    state: &Arc<VolumeServerState>,
+    range_str: &str,
+    info: crate::storage::volume::NeedleStreamInfo,
+    response_headers: HeaderMap,
+    track_download: bool,
+) -> Response {
+    let range_str = range_str.to_string();
+    let tracking = track_download.then(|| state.clone());
+    tokio::task::spawn_blocking(move || {
+        handle_range_request_from_source(&range_str, info, response_headers, tracking)
+    })
+    .await
+    .unwrap_or_else(|e| {
+        (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            format!("range read error: {}", e),
+        )
+            .into_response()
+    })
+}
 
+/// The needle data, decompressed and image-processed as the request needs.
+fn buffered_payload(
+    n: Needle,
+    headers: &HeaderMap,
+    query: &ReadQueryParams,
+    ext: &str,
+    needs_image_ops: bool,
+    response_headers: &mut HeaderMap,
+) -> ControlFlow<Response, Vec<u8>> {
     // Handle compressed data: if needle is compressed, either pass through or decompress
     let is_compressed = n.is_compressed();
     let mut data = n.data;
 
-    // Check if image operations are needed — must decompress first regardless of Accept-Encoding
-    // Go checks resize (.webp OK) and crop (.webp NOT OK) separately.
-    let needs_image_ops = has_resize_ops || has_crop_ops;
-
+    // Image operations must decompress first regardless of Accept-Encoding.
     if is_compressed {
         if needs_image_ops {
             // Always decompress for image operations (Go decompresses before resize/crop)
             match maybe_decompress_gzip(&data) {
                 Ok(decompressed) => data = decompressed,
                 Err(GunzipError::TooLarge) => {
-                    return (
-                        StatusCode::PAYLOAD_TOO_LARGE,
-                        "compressed object exceeds decompression limit",
-                    )
-                        .into_response()
+                    return ControlFlow::Break(
+                        (
+                            StatusCode::PAYLOAD_TOO_LARGE,
+                            "compressed object exceeds decompression limit",
+                        )
+                            .into_response(),
+                    );
                 }
                 Err(GunzipError::Decode) => {} // not valid gzip; keep raw bytes
             }
@@ -1536,11 +1892,13 @@ async fn get_or_head_handler_inner(
                 match maybe_decompress_gzip(&data) {
                     Ok(decompressed) => data = decompressed,
                     Err(GunzipError::TooLarge) => {
-                        return (
-                            StatusCode::PAYLOAD_TOO_LARGE,
-                            "compressed object exceeds decompression limit",
-                        )
-                            .into_response()
+                        return ControlFlow::Break(
+                            (
+                                StatusCode::PAYLOAD_TOO_LARGE,
+                                "compressed object exceeds decompression limit",
+                            )
+                                .into_response(),
+                        );
                     }
                     Err(GunzipError::Decode) => {} // not valid gzip; keep raw bytes
                 }
@@ -1550,28 +1908,27 @@ async fn get_or_head_handler_inner(
 
     // Image crop and resize — Go checks extensions separately per operation.
     // Crop: .png .jpg .jpeg .gif (no .webp). Resize: .png .jpg .jpeg .gif .webp.
-    if is_image_crop_ext(&ext) {
-        data = maybe_crop_image(&data, &ext, &query);
+    if is_image_crop_ext(ext) {
+        data = maybe_crop_image(&data, ext, query);
     }
-    if is_image_resize_ext(&ext) {
-        data = maybe_resize_image(&data, &ext, &query);
+    if is_image_resize_ext(ext) {
+        data = maybe_resize_image(&data, ext, query);
     }
+    ControlFlow::Continue(data)
+}
 
-    // Accept-Ranges
+/// The buffered reply over the payload, whole or a range.
+fn buffered_response(
+    state: &Arc<VolumeServerState>,
+    range: Option<&str>,
+    method: &Method,
+    data: Vec<u8>,
+    mut response_headers: HeaderMap,
+    track_download: bool,
+) -> Response {
     response_headers.insert(header::ACCEPT_RANGES, "bytes".parse().unwrap());
 
-    // Check Range header
-    if let Some(range_header) = headers.get(header::RANGE) {
-        if let Ok(range_str) = range_header.to_str() {
-            return handle_range_request(
-                range_str,
-                &data,
-                response_headers,
-                track_download.then(|| state.clone()),
-            );
-        }
-    }
-
+    // HEAD before Range (Go's writeResponseContent order).
     if method == Method::HEAD {
         response_headers.insert(
             header::CONTENT_LENGTH,
@@ -1580,6 +1937,15 @@ async fn get_or_head_handler_inner(
         return (StatusCode::OK, response_headers).into_response();
     }
 
+    if let Some(range) = range {
+        return handle_range_request(
+            range,
+            &data,
+            response_headers,
+            track_download.then(|| state.clone()),
+        );
+    }
+
     finalize_bytes_response(
         StatusCode::OK,
         response_headers,
@@ -1589,12 +1955,15 @@ async fn get_or_head_handler_inner(
 }
 
 /// Handle HTTP Range requests. Returns 206 Partial Content or 416 Range Not Satisfiable.
-#[derive(Clone, Copy)]
+#[derive(Clone, Copy, Debug)]
 struct HttpRange {
     start: i64,
     length: i64,
 }
 
+// Returned when the first-byte-pos of every byte-range-spec is at or past the content size.
+const RANGE_NO_OVERLAP: &str = "invalid range: failed to overlap";
+
 fn parse_range_header(s: &str, size: i64) -> Result<Vec<HttpRange>, &'static str> {
     if s.is_empty() {
         return Ok(Vec::new());
@@ -1604,6 +1973,7 @@ fn parse_range_header(s: &str, size: i64) -> Result<Vec<HttpRange>, &'static str
         return Err("invalid range");
     }
     let mut ranges = Vec::new();
+    let mut no_overlap = false;
     for part in s[PREFIX.len()..].split(',') {
         let part = part.trim();
         if part.is_empty() {
@@ -1627,9 +1997,13 @@ fn parse_range_header(s: &str, size: i64) -> Result<Vec<HttpRange>, &'static str
             r.length = size - r.start;
         } else {
             let i = start_str.parse::<i64>().map_err(|_| "invalid range")?;
-            if i > size || i < 0 {
+            if i < 0 {
                 return Err("invalid range");
             }
+            if i >= size {
+                no_overlap = true;
+                continue;
+            }
             r.start = i;
             if end_str.is_empty() {
                 r.length = size - r.start;
@@ -1646,11 +2020,20 @@ fn parse_range_header(s: &str, size: i64) -> Result<Vec<HttpRange>, &'static str
         }
         ranges.push(r);
     }
+    if no_overlap && ranges.is_empty() {
+        return Err(RANGE_NO_OVERLAP);
+    }
     Ok(ranges)
 }
 
 fn sum_ranges_size(ranges: &[HttpRange]) -> i64 {
-    ranges.iter().map(|r| r.length).sum()
+    ranges.iter().fold(0i64, |acc, r| {
+        if r.length > 0 {
+            acc.saturating_add(r.length)
+        } else {
+            acc
+        }
+    })
 }
 
 fn range_content_range(r: HttpRange, total: i64) -> String {
@@ -1658,12 +2041,13 @@ fn range_content_range(r: HttpRange, total: i64) -> String {
 }
 
 fn range_error_response(mut headers: HeaderMap, msg: &str) -> Response {
-    if !headers.contains_key(header::CONTENT_TYPE) {
-        headers.insert(
-            header::CONTENT_TYPE,
-            "text/plain; charset=utf-8".parse().unwrap(),
-        );
-    }
+    // net/http.Error resets Content-Type and sets nosniff even when a
+    // caller already set the object's MIME type.
+    headers.insert(
+        header::CONTENT_TYPE,
+        "text/plain; charset=utf-8".parse().unwrap(),
+    );
+    headers.insert(header::X_CONTENT_TYPE_OPTIONS, "nosniff".parse().unwrap());
     let mut response = Response::new(Body::from(msg.to_string()));
     *response.status_mut() = StatusCode::RANGE_NOT_SATISFIABLE;
     *response.headers_mut() = headers;
@@ -1673,13 +2057,38 @@ fn range_error_response(mut headers: HeaderMap, msg: &str) -> Response {
 fn handle_range_request(
     range_str: &str,
     data: &[u8],
+    headers: HeaderMap,
+    state: Option<Arc<VolumeServerState>>,
+) -> Response {
+    handle_range_request_with(
+        range_str,
+        data.len() as i64,
+        |buf, start, end| buf.extend_from_slice(&data[start..end]),
+        headers,
+        state,
+    )
+}
+
+/// Range reply over an object of `total` bytes; `read` appends `[start, end)`
+/// of it and is called only for the ranges actually served.
+fn handle_range_request_with(
+    range_str: &str,
+    total: i64,
+    read: impl Fn(&mut Vec<u8>, usize, usize),
     mut headers: HeaderMap,
     state: Option<Arc<VolumeServerState>>,
 ) -> Response {
-    let total = data.len() as i64;
     let ranges = match parse_range_header(range_str, total) {
         Ok(r) => r,
-        Err(msg) => return range_error_response(headers, msg),
+        Err(msg) => {
+            if msg == RANGE_NO_OVERLAP {
+                headers.insert(
+                    "Content-Range",
+                    format!("bytes */{}", total).parse().unwrap(),
+                );
+            }
+            return range_error_response(headers, msg);
+        }
     };
 
     // Go's ProcessRangeRequest returns nil (empty body) for empty or oversized ranges
@@ -1704,10 +2113,9 @@ fn handle_range_request(
         if r.length <= 0 {
             return (StatusCode::PARTIAL_CONTENT, headers).into_response();
         }
-        let start = r.start as usize;
-        let end = (r.start + r.length) as usize;
-        let slice = &data[start..end];
-        finalize_bytes_response(StatusCode::PARTIAL_CONTENT, headers, slice.to_vec(), state)
+        let mut slice = Vec::with_capacity(r.length as usize);
+        read(&mut slice, r.start as usize, (r.start + r.length) as usize);
+        finalize_bytes_response(StatusCode::PARTIAL_CONTENT, headers, slice, state)
     } else {
         // Multi-range: build multipart/byteranges response
         let boundary = "SeaweedFSBoundary";
@@ -1730,9 +2138,7 @@ fn handle_range_request(
                 format!("Content-Range: {}\r\n\r\n", range_content_range(*r, total)).as_bytes(),
             );
             if r.length > 0 {
-                let start = r.start as usize;
-                let end = (r.start + r.length) as usize;
-                body.extend_from_slice(&data[start..end]);
+                read(&mut body, r.start as usize, (r.start + r.length) as usize);
             }
         }
         body.extend_from_slice(format!("\r\n--{}--\r\n", boundary).as_bytes());
@@ -1762,7 +2168,15 @@ fn handle_range_request_from_source(
     let total = info.data_size as i64;
     let ranges = match parse_range_header(range_str, total) {
         Ok(r) => r,
-        Err(msg) => return range_error_response(headers, msg),
+        Err(msg) => {
+            if msg == RANGE_NO_OVERLAP {
+                headers.insert(
+                    "Content-Range",
+                    format!("bytes */{}", total).parse().unwrap(),
+                );
+            }
+            return range_error_response(headers, msg);
+        }
     };
 
     if ranges.is_empty() {
@@ -1778,9 +2192,21 @@ fn handle_range_request_from_source(
             return Ok(Vec::new());
         }
         let mut buf = vec![0u8; length as usize];
-        info.source
-            .read_exact_at(&mut buf, info.data_file_offset + start as u64)?;
-        Ok(buf)
+        match info
+            .source
+            .read_exact_at(&mut buf, info.data_file_offset + start as u64)
+        {
+            // A finished range read clears the streak a failed meta read
+            // counted, like readNeedleDataInto's terminal report.
+            Ok(()) => {
+                info.io_errors.check_read_write_error(None);
+                Ok(buf)
+            }
+            Err(e) => {
+                info.io_errors.check_read_write_error(Some(&e));
+                Err(e)
+            }
+        }
     };
 
     if ranges.len() == 1 {
@@ -1792,7 +2218,7 @@ fn handle_range_request_from_source(
                     StatusCode::INTERNAL_SERVER_ERROR,
                     format!("range read error: {}", err),
                 )
-                    .into_response()
+                    .into_response();
             }
         };
         headers.insert(
@@ -1822,7 +2248,7 @@ fn handle_range_request_from_source(
                     StatusCode::INTERNAL_SERVER_ERROR,
                     format!("range read error: {}", err),
                 )
-                    .into_response()
+                    .into_response();
             }
         };
         if i == 0 {
@@ -1863,6 +2289,19 @@ fn extract_filename_from_path(path: &str) -> String {
     }
 }
 
+fn has_image_ops(ext: &str, query: &ReadQueryParams) -> bool {
+    let resize =
+        is_image_resize_ext(ext) && (query.width.unwrap_or(0) > 0 || query.height.unwrap_or(0) > 0);
+    let crop = is_image_crop_ext(ext) && {
+        let x1 = query.crop_x1.unwrap_or(0);
+        let y1 = query.crop_y1.unwrap_or(0);
+        let x2 = query.crop_x2.unwrap_or(0);
+        let y2 = query.crop_y2.unwrap_or(0);
+        x2 > x1 && y2 > y1
+    };
+    resize || crop
+}
+
 fn path_base(path: &str) -> String {
     let trimmed = path.trim_end_matches('/');
     trimmed
@@ -1968,7 +2407,7 @@ fn extract_extension_from_path(path: &str) -> String {
         if let Some(dot_pos) = filename.rfind('.') {
             return filename[dot_pos..].to_lowercase();
         }
-    } else if parts.len() >= 1 {
+    } else if !parts.is_empty() {
         // 2-segment path: /vid,fid.ext or /vid/fid.ext
         // Go's parseURLPath extracts ext from the full path for all formats
         let last = parts[parts.len() - 1];
@@ -2077,6 +2516,9 @@ fn is_zero_u32(v: &u32) -> bool {
     *v == 0
 }
 
+/// Store an uploaded needle on the local volume — durable (fsync) uploads
+/// through the per-volume write queue, the rest synchronously — and then
+/// replicate it if the volume's placement calls for more copies.
 pub async fn post_handler(
     State(state): State<Arc<VolumeServerState>>,
     request: Request<Body>,
@@ -2091,7 +2533,7 @@ pub async fn post_handler(
             // Go's r.ParseForm() returns 400 on malformed query strings
             return json_error_with_query(
                 StatusCode::BAD_REQUEST,
-                &format!("form parse error: {}", e),
+                format!("form parse error: {}", e),
                 Some(&query),
             );
         }
@@ -2100,18 +2542,23 @@ pub async fn post_handler(
     let (vid, needle_id, cookie) = match parse_url_path(&path) {
         Some(parsed) => parsed,
         None => {
-            return json_error_with_query(StatusCode::BAD_REQUEST, "invalid URL path", Some(&query))
+            return json_error_with_query(
+                StatusCode::BAD_REQUEST,
+                "invalid URL path",
+                Some(&query),
+            );
         }
     };
 
     // JWT check for writes
     let file_id = extract_file_id(&path);
     let token = extract_jwt(&headers, request.uri());
-    if let Err(_) = state
+    if state
         .guard
         .read()
         .unwrap()
         .check_jwt_for_file(token.as_deref(), &file_id, true)
+        .is_err()
     {
         return json_error_with_query(StatusCode::UNAUTHORIZED, "wrong jwt", Some(&query));
     }
@@ -2216,7 +2663,10 @@ pub async fn post_handler(
             // With a limit configured, an error here means the body exceeded it
             // before we buffered the whole thing; report it like the size check.
             let msg = if state.file_size_limit_bytes > 0 {
-                format!("file over the limited {} bytes", state.file_size_limit_bytes)
+                format!(
+                    "file over the limited {} bytes",
+                    state.file_size_limit_bytes
+                )
             } else {
                 format!("read body: {}", e)
             };
@@ -2238,11 +2688,8 @@ pub async fn post_handler(
             .split(';')
             .find_map(|part| {
                 let part = part.trim();
-                if let Some(val) = part.strip_prefix("boundary=") {
-                    Some(val.trim_matches('"').to_string())
-                } else {
-                    None
-                }
+                part.strip_prefix("boundary=")
+                    .map(|val| val.trim_matches('"').to_string())
             })
             .unwrap_or_default();
 
@@ -2384,17 +2831,17 @@ pub async fn post_handler(
     } else {
         None
     };
-    if let (Some(ref expected_md5), Some(ref actual_md5)) = (&content_md5, &original_content_md5) {
-        if expected_md5 != actual_md5 {
-            return json_error_with_query(
-                StatusCode::BAD_REQUEST,
-                format!(
-                    "Content-MD5 did not match md5 of file data expected [{}] received [{}] size {}",
-                    expected_md5, actual_md5, original_data_size
-                ),
-                Some(&query),
-            );
-        }
+    if let (Some(expected_md5), Some(actual_md5)) = (&content_md5, &original_content_md5)
+        && expected_md5 != actual_md5
+    {
+        return json_error_with_query(
+            StatusCode::BAD_REQUEST,
+            format!(
+                "Content-MD5 did not match md5 of file data expected [{}] received [{}] size {}",
+                expected_md5, actual_md5, original_data_size
+            ),
+            Some(&query),
+        );
     }
 
     let now = std::time::SystemTime::now()
@@ -2536,7 +2983,7 @@ pub async fn post_handler(
         cookie,
         data_size: final_data.len() as u32,
         data: final_data,
-        last_modified: last_modified,
+        last_modified,
         ..Needle::default()
     };
     n.set_has_last_modified_date();
@@ -2554,22 +3001,21 @@ pub async fn post_handler(
     }
 
     // Set TTL on needle
-    if let Some(ref t) = ttl {
-        if !t.is_empty() {
-            n.ttl = Some(*t);
-            n.set_has_ttl();
-        }
+    if let Some(ref t) = ttl
+        && !t.is_empty()
+    {
+        n.ttl = Some(*t);
+        n.set_has_ttl();
     }
 
     // Set pairs on needle
-    if !pair_map.is_empty() {
-        if let Ok(pairs_json) = serde_json::to_vec(&pair_map) {
-            if pairs_json.len() < 65536 {
-                n.pairs_size = pairs_json.len() as u16;
-                n.pairs = pairs_json;
-                n.set_has_pairs();
-            }
-        }
+    if !pair_map.is_empty()
+        && let Ok(pairs_json) = serde_json::to_vec(&pair_map)
+        && pairs_json.len() < 65536
+    {
+        n.pairs_size = pairs_json.len() as u16;
+        n.pairs = pairs_json;
+        n.set_has_pairs();
     }
 
     // Set filename on needle (matches Go: if len(pu.FileName) < 256)
@@ -2580,21 +3026,31 @@ pub async fn post_handler(
         n.set_has_name();
     }
 
-    let write_result = if let Some(wq) = state.write_queue.get() {
-        wq.submit(vid, n.clone()).await
-    } else {
-        let mut store = state.store.write().unwrap();
-        store.write_volume_needle(vid, &mut n)
-    };
+    // A durable write flushes before it is acked. Read it the way Go's
+    // r.FormValue does, off the decoded fields, so a percent-encoded value is
+    // honored here too. ReplicatedWrite forwards the parameter, so a replica
+    // sees it the same way the primary did.
+    let fsync = form_value("fsync").as_deref() == Some("true");
+
+    // Go computes the checksum while building the needle (CreateNeedleFromRequest).
+    // The write queue takes the needle away, so the response fields that come
+    // from it are read here, before the write, rather than from a copy.
+    n.checksum = crate::storage::needle::crc::CRC::new(&n.data);
+    let needle_etag = n.etag();
+    let needle_has_name = n.has_name();
+
+    let write_result = write_upload_needle(&state, vid, n, fsync).await;
 
     // Replicate to remote volume servers if this volume has replicas.
     // Matches Go's GetWritableRemoteReplications: skip if copy_count == 1.
-    if !is_replicate && write_result.is_ok() && !state.master_url.is_empty() {
+    // No leader-known gate: when the lookup cannot run, the write must fail
+    // rather than be acknowledged on fewer copies than required.
+    if !is_replicate && write_result.is_ok() {
         let needs_replication = {
             let store = state.store.read().unwrap();
-            store.find_volume(vid).map_or(false, |(_, v)| {
-                v.super_block.replica_placement.get_copy_count() > 1
-            })
+            store
+                .find_volume(vid)
+                .is_some_and(|(_, v)| v.super_block().replica_placement.get_copy_count() > 1)
         };
         if needs_replication {
             let state_clone = state.clone();
@@ -2617,7 +3073,7 @@ pub async fn post_handler(
             let replication_result = replication
                 .await
                 .map_err(|e| format!("replication task failed: {}", e))
-                .and_then(|result| result);
+                .flatten();
             if let Err(e) = replication_result {
                 tracing::error!("replicated write failed: {}", e);
                 return json_error_with_query(
@@ -2632,22 +3088,22 @@ pub async fn post_handler(
     let resp = match write_result {
         Ok((_offset, _size, is_unchanged)) => {
             if is_unchanged {
-                let etag = format!("\"{}\"", n.etag());
+                let etag = format!("\"{}\"", needle_etag);
                 (StatusCode::NO_CONTENT, [(header::ETAG, etag)]).into_response()
             } else {
                 // Go only includes contentMd5 when the client provided Content-MD5
                 let result = UploadResult {
-                    name: if n.has_name() {
+                    name: if needle_has_name {
                         filename.clone()
                     } else {
                         String::new()
                     },
                     size: original_data_size, // H3: use original size, not compressed
-                    etag: n.etag(),
+                    etag: needle_etag.clone(),
                     mime: mime_type.clone(),
                     content_md5: original_content_md5.clone(),
                 };
-                let etag = n.etag();
+                let etag = needle_etag;
                 let etag_header = if etag.starts_with('"') {
                     etag.clone()
                 } else {
@@ -2679,6 +3135,28 @@ pub async fn post_handler(
     resp
 }
 
+/// Append an uploaded needle the way Go's `writeNeedle2` does: a durable
+/// write goes to the volume's batching worker, which group-commits the
+/// batch's .dat/.idx syncs, while anything else — a non-durable write, or a
+/// durable one landing while the server is stopping and the workers are
+/// winding down — takes the synchronous path and fsyncs inline.
+async fn write_upload_needle(
+    state: &Arc<VolumeServerState>,
+    vid: VolumeId,
+    mut n: Needle,
+    fsync: bool,
+) -> Result<(u64, Size, bool), crate::storage::volume::VolumeError> {
+    let queued = fsync && !*state.is_stopping.read().unwrap();
+    if queued && let Some(wq) = state.write_queue.get() {
+        return wq.submit(vid, n, fsync).await;
+    }
+    let vol = {
+        let store = state.store.read().unwrap();
+        store.writable_volume(vid)
+    };
+    vol.and_then(|vol| vol.write_needle(&mut n, true, fsync))
+}
+
 // ============================================================================
 // Delete Handler
 // ============================================================================
@@ -2688,6 +3166,20 @@ struct DeleteResult {
     size: i64,
 }
 
+/// Read option for deletes: read only the needle's header and trailer.
+///
+/// A delete needs to know that the needle exists, what its cookie is, and
+/// whether it is a chunk manifest. None of that requires the payload. If the
+/// needle turns out to be a chunk manifest, the read loads its data as well,
+/// because the delete needs the manifest to delete the chunks.
+pub(crate) fn delete_read_option() -> ReadOption {
+    ReadOption {
+        attempt_meta_only: true,
+        must_meta_only: true,
+        ..ReadOption::default()
+    }
+}
+
 pub async fn delete_handler(
     State(state): State<Arc<VolumeServerState>>,
     request: Request<Body>,
@@ -2704,18 +3196,19 @@ pub async fn delete_handler(
                 StatusCode::BAD_REQUEST,
                 "invalid URL path",
                 Some(&del_query),
-            )
+            );
         }
     };
 
     // JWT check for writes (deletes use write key)
     let file_id = extract_file_id(&path);
     let token = extract_jwt(&headers, request.uri());
-    if let Err(_) = state
+    if state
         .guard
         .read()
         .unwrap()
         .check_jwt_for_file(token.as_deref(), &file_id, true)
+        .is_err()
     {
         return json_error_with_query(StatusCode::UNAUTHORIZED, "wrong jwt", Some(&del_query));
     }
@@ -2726,15 +3219,23 @@ pub async fn delete_handler(
     {
         let has_ec = state.store.read().unwrap().has_ec_volume(vid);
         if has_ec {
-            // Step 1: Read the EC needle to get its size and validate cookie
-            let ec_read_result = {
-                let store = state.store.read().unwrap();
-                store
-                    .find_ec_volume(vid)
-                    .map(|ecv| ecv.read_ec_shard_needle(needle_id))
-            };
+            // Step 1: Read the EC needle to get its size and validate cookie.
+            //
+            // This must go through the *distributed* reader, as the GET path
+            // does. The local-only `EcVolume::read_ec_shard_needle` errors
+            // "ec shard N not available locally" for any interval that lives on
+            // a peer, so on a standard 10+4 spread every HTTP DELETE of an EC
+            // needle failed 500 and never appended to `.ecj`. The distributed
+            // reader does a local-first pass in its snapshot phase, so the
+            // all-shards-local case costs the same as before.
+            //
+            // No store guard is held across this call: the reader takes and
+            // releases its own, and `RwLockReadGuard` is `!Send`.
+            let ec_read_result =
+                crate::server::store_ec::read_ec_shard_needle_distributed(&state, vid, needle_id)
+                    .await;
             match ec_read_result {
-                Some(Ok(Some(ec_needle))) => {
+                Ok(Some(ec_needle)) => {
                     // Step 2: Validate cookie (Go: cookie != 0 && cookie != n.Cookie)
                     if cookie.0 != 0 && ec_needle.cookie != cookie {
                         return json_error_with_query(
@@ -2744,10 +3245,37 @@ pub async fn delete_handler(
                         );
                     }
                     let count = ec_needle.data_size as i64;
-                    // Step 3: Journal the delete
-                    let mut store = state.store.write().unwrap();
-                    if let Some(ecv) = store.find_ec_volume_mut(vid) {
-                        if let Err(e) = ecv.journal_delete(needle_id) {
+                    // Step 3: Journal the delete on a holder of the needle's
+                    // primary data shard — Go's DeleteEcShardNeedle forwards a
+                    // VolumeEcBlobDelete there rather than journaling locally,
+                    // so exactly one node carries the tombstone and
+                    // delete_count stays consistent across replicas.
+                    match crate::server::store_ec::delete_ec_shard_needle_distributed(
+                        &state, vid, needle_id,
+                    )
+                    .await
+                    {
+                        Ok(()) => {
+                            let result = DeleteResult { size: count };
+                            return json_response_with_params(
+                                StatusCode::ACCEPTED,
+                                &result,
+                                Some(&del_params),
+                            );
+                        }
+                        // Unmounted between the read and the append, or the
+                        // needle went away in the same window: nothing was
+                        // journalled, so answering 202 would lose the delete
+                        // while reporting success.
+                        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                            let result = DeleteResult { size: 0 };
+                            return json_response_with_params(
+                                StatusCode::NOT_FOUND,
+                                &result,
+                                Some(&del_params),
+                            );
+                        }
+                        Err(e) => {
                             return json_error_with_query(
                                 StatusCode::INTERNAL_SERVER_ERROR,
                                 format!("Deletion Failed: {}", e),
@@ -2755,15 +3283,12 @@ pub async fn delete_handler(
                             );
                         }
                     }
-                    let result = DeleteResult { size: count };
-                    return json_response_with_params(
-                        StatusCode::ACCEPTED,
-                        &result,
-                        Some(&del_params),
-                    );
                 }
-                Some(Ok(None)) => {
-                    // Needle not found in EC volume
+                Ok(None) => {
+                    // Needle not in the EC index, or the volume disappeared
+                    // between the `has_ec` check and the snapshot — the
+                    // distributed reader reports both as `Ok(None)`, and both
+                    // mean the same thing to a deleter.
                     let result = DeleteResult { size: 0 };
                     return json_response_with_params(
                         StatusCode::NOT_FOUND,
@@ -2771,22 +3296,25 @@ pub async fn delete_handler(
                         Some(&del_params),
                     );
                 }
-                Some(Err(e)) => {
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                    // A shard or interval the read needed is gone rather than
+                    // merely remote. The GET path answers 404 here; answering
+                    // 500 (as this handler did for every error) told callers to
+                    // retry a delete that can never succeed.
+                    let result = DeleteResult { size: 0 };
+                    return json_response_with_params(
+                        StatusCode::NOT_FOUND,
+                        &result,
+                        Some(&del_params),
+                    );
+                }
+                Err(e) => {
                     return json_error_with_query(
                         StatusCode::INTERNAL_SERVER_ERROR,
                         format!("Deletion Failed: {}", e),
                         Some(&del_query),
                     );
                 }
-                None => {
-                    // EC volume disappeared between has_ec check and find
-                    let result = DeleteResult { size: 0 };
-                    return json_response_with_params(
-                        StatusCode::NOT_FOUND,
-                        &result,
-                        Some(&del_params),
-                    );
-                }
             }
         }
     }
@@ -2819,8 +3347,14 @@ pub async fn delete_handler(
     // Read needle first to validate cookie (matching Go behavior)
     let original_cookie = cookie;
     {
-        let store = state.store.read().unwrap();
-        match store.read_volume_needle(vid, &mut n) {
+        let vol = {
+            let store = state.store.read().unwrap();
+            store.find_volume(vid).map(|(_, vol)| vol)
+        };
+        match vol
+            .ok_or(crate::storage::volume::VolumeError::NotFound)
+            .and_then(|vol| vol.read_needle_with_option(&mut n, &mut delete_read_option()))
+        {
             Ok(_) => {}
             Err(_) => {
                 let result = DeleteResult { size: 0 };
@@ -2891,20 +3425,33 @@ pub async fn delete_handler(
     }
 
     let delete_result = {
-        let mut store = state.store.write().unwrap();
-        store.delete_volume_needle(vid, &mut n)
+        let vol = {
+            let store = state.store.read().unwrap();
+            store
+                .find_volume(vid)
+                .map(|(_, vol)| vol)
+                .ok_or(crate::storage::volume::VolumeError::NotFound)
+        };
+        match vol {
+            Err(e) => Err(e),
+            // Matches Store::delete_volume_needle: noWriteOrDelete rejects first.
+            Ok(vol) if vol.is_no_write_or_delete() => {
+                Err(crate::storage::volume::VolumeError::ReadOnly(vid))
+            }
+            Ok(vol) => vol.delete_needle(&mut n),
+        }
     };
 
     let is_replicate = del_query.split('&').any(|p| p == "type=replicate");
-    if !is_replicate && delete_result.is_ok() && !state.master_url.is_empty() {
+    if !is_replicate && delete_result.is_ok() {
         let needs_replication = {
             let store = state.store.read().unwrap();
-            store.find_volume(vid).map_or(false, |(_, v)| {
-                v.super_block.replica_placement.get_copy_count() > 1
-            })
+            store
+                .find_volume(vid)
+                .is_some_and(|(_, v)| v.super_block().replica_placement.get_copy_count() > 1)
         };
-        if needs_replication {
-            if let Err(e) = do_replicated_request(
+        if needs_replication
+            && let Err(e) = do_replicated_request(
                 &state,
                 vid.0,
                 Method::DELETE,
@@ -2914,14 +3461,13 @@ pub async fn delete_handler(
                 None,
             )
             .await
-            {
-                tracing::error!("replicated delete failed: {}", e);
-                return json_error_with_query(
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("replication failed: {}", e),
-                    Some(&del_query),
-                );
-            }
+        {
+            tracing::error!("replicated delete failed: {}", e);
+            return json_error_with_query(
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("replication failed: {}", e),
+                Some(&del_query),
+            );
         }
     }
 
@@ -2989,7 +3535,7 @@ pub async fn status_handler(
             );
             vol_info.insert(
                 "CompactRevision".to_string(),
-                serde_json::Value::from(vol.super_block.compaction_revision),
+                serde_json::Value::from(vol.super_block().compaction_revision),
             );
             vol_info.insert(
                 "ModifiedAtSecond".to_string(),
@@ -3000,7 +3546,7 @@ pub async fn status_handler(
                 serde_json::Value::from(loc.disk_type.to_string()),
             );
 
-            let replica = &vol.super_block.replica_placement;
+            let replica = &vol.super_block().replica_placement;
             let mut replica_value = serde_json::Map::new();
             if replica.diff_data_center_count > 0 {
                 replica_value.insert(
@@ -3025,7 +3571,7 @@ pub async fn status_handler(
                 serde_json::Value::Object(replica_value),
             );
 
-            let ttl = vol.super_block.ttl;
+            let ttl = vol.super_block().ttl;
             let mut ttl_value = serde_json::Map::new();
             if ttl.count > 0 {
                 ttl_value.insert("Count".to_string(), serde_json::Value::from(ttl.count));
@@ -3080,6 +3626,11 @@ pub async fn healthz_handler(State(state): State<Arc<VolumeServerState>>) -> Res
     if !state.is_heartbeating.load(Ordering::Relaxed) {
         return StatusCode::SERVICE_UNAVAILABLE.into_response();
     }
+    // A server with quarantined local replicas has faulty storage media;
+    // report degraded so a load balancer can drain it.
+    if state.store.read().unwrap().has_io_quarantine() {
+        return StatusCode::SERVICE_UNAVAILABLE.into_response();
+    }
     StatusCode::OK.into_response()
 }
 
@@ -3182,7 +3733,6 @@ pub async fn ui_handler(State(state): State<Arc<VolumeServerState>>) -> Response
 // ============================================================================
 
 #[derive(Deserialize)]
-#[allow(dead_code)]
 struct ChunkManifest {
     #[serde(default)]
     name: String,
@@ -3201,28 +3751,189 @@ struct ChunkInfo {
     size: i64,
 }
 
-/// Try to expand a chunk manifest needle. Returns None if manifest can't be parsed.
-async fn try_expand_chunk_manifest(
-    state: &Arc<VolumeServerState>,
+fn manifest_filename(path: &str, manifest_name: &str) -> String {
+    let mut filename = extract_filename_from_path(path);
+    if filename.is_empty() && !manifest_name.is_empty() {
+        filename = manifest_name.to_string();
+    }
+    filename
+}
+
+fn extension_of(filename: &str) -> String {
+    filename
+        .rfind('.')
+        .map(|dot| filename[dot..].to_lowercase())
+        .unwrap_or_default()
+}
+
+fn reject_bad_chunks(chunks: &[ChunkInfo]) -> Option<ControlFlow<Response, (Vec<u8>, HeaderMap)>> {
+    for chunk in chunks {
+        if chunk.offset < 0 || chunk.size < 0 {
+            return Some(ControlFlow::Break(
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("invalid negative chunk offset/size in {}", chunk.fid),
+                )
+                    .into_response(),
+            ));
+        }
+    }
+    None
+}
+
+/// `None` is a u64 overflow or a sum that does not fit in i64.
+fn sum_chunk_sizes(chunks: &[ChunkInfo]) -> Option<i64> {
+    let mut sum: u64 = 0;
+    for chunk in chunks {
+        if chunk.size < 0 {
+            return None;
+        }
+        sum = sum.checked_add(chunk.size as u64)?;
+    }
+    if sum > i64::MAX as u64 {
+        return None;
+    }
+    Some(sum as i64)
+}
+
+fn exceeds_expansion_limit(buffered: u64) -> bool {
+    buffered > MAX_EXPANSION_BYTES
+}
+
+fn manifest_too_large() -> ControlFlow<Response, (Vec<u8>, HeaderMap)> {
+    ControlFlow::Break(
+        (
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "chunk manifest exceeds expansion limit",
+        )
+            .into_response(),
+    )
+}
+
+fn chunk_manifest_response_headers(
     n: &Needle,
-    _headers: &HeaderMap,
-    method: &Method,
-    path: &str,
     query: &ReadQueryParams,
     etag: &str,
     last_modified_str: &Option<String>,
-) -> Option<Response> {
+    filename: &str,
+    manifest_mime: &str,
+) -> HeaderMap {
+    let content_type = {
+        if !manifest_mime.is_empty() && !manifest_mime.starts_with("application/octet-stream") {
+            manifest_mime.to_string()
+        } else {
+            let ext = extension_of(filename);
+            if !ext.is_empty() {
+                mime_guess::from_ext(ext.trim_start_matches('.'))
+                    .first()
+                    .map(|m| m.to_string())
+                    .unwrap_or_else(|| "application/octet-stream".to_string())
+            } else if !manifest_mime.is_empty() {
+                manifest_mime.to_string()
+            } else {
+                "application/octet-stream".to_string()
+            }
+        }
+    };
+
+    let mut response_headers = HeaderMap::new();
+    if let Ok(etag_val) = etag.parse() {
+        response_headers.insert(header::ETAG, etag_val);
+    }
+    // `mime` is stored JSON; fall back when it is not a legal header value.
+    let content_type_value = content_type
+        .parse()
+        .unwrap_or_else(|_| header::HeaderValue::from_static("application/octet-stream"));
+    response_headers.insert(header::CONTENT_TYPE, content_type_value);
+    response_headers.insert("X-File-Store", "chunked".parse().unwrap());
+
+    if let Some(lm) = last_modified_str
+        && let Ok(hval) = lm.parse()
+    {
+        response_headers.insert(header::LAST_MODIFIED, hval);
+    }
+
+    if n.has_pairs()
+        && !n.pairs.is_empty()
+        && let Ok(pair_map) =
+            serde_json::from_slice::<std::collections::HashMap<String, String>>(&n.pairs)
+    {
+        for (k, v) in &pair_map {
+            if let (Ok(hname), Ok(hval)) = (
+                axum::http::HeaderName::from_bytes(k.as_bytes()),
+                axum::http::HeaderValue::from_str(v),
+            ) {
+                response_headers.insert(hname, hval);
+            }
+        }
+    }
+
+    if let Some(ref cc) = query.response_cache_control
+        && let Ok(hval) = cc.parse()
+    {
+        response_headers.insert(header::CACHE_CONTROL, hval);
+    }
+    if let Some(ref ce) = query.response_content_encoding
+        && let Ok(hval) = ce.parse()
+    {
+        response_headers.insert(header::CONTENT_ENCODING, hval);
+    }
+    if let Some(ref exp) = query.response_expires
+        && let Ok(hval) = exp.parse()
+    {
+        response_headers.insert(header::EXPIRES, hval);
+    }
+    if let Some(ref cl) = query.response_content_language
+        && let Ok(hval) = cl.parse()
+    {
+        response_headers.insert("Content-Language", hval);
+    }
+    if let Some(ref cd) = query.response_content_disposition
+        && let Ok(hval) = cd.parse()
+    {
+        response_headers.insert(header::CONTENT_DISPOSITION, hval);
+    }
+
+    if !filename.is_empty() {
+        let disposition_type = if let Some(ref dl_val) = query.dl {
+            if parse_go_bool(dl_val).unwrap_or(false) {
+                "attachment"
+            } else {
+                "inline"
+            }
+        } else {
+            "inline"
+        };
+        let disposition = format_content_disposition(disposition_type, filename);
+        if let Ok(hval) = disposition.parse() {
+            response_headers.insert(header::CONTENT_DISPOSITION, hval);
+        }
+    }
+    response_headers
+}
+
+/// Try to expand a chunk manifest needle into its assembled body and reply
+/// headers. The Range of a GET (`get_range`) is answered here from only the
+/// chunks it overlaps. Returns None if manifest can't be parsed.
+async fn try_expand_chunk_manifest(
+    state: &Arc<VolumeServerState>,
+    n: &Needle,
+    path: &str,
+    query: &ReadQueryParams,
+    get_range: Option<&str>,
+    method: &Method,
+) -> Option<ControlFlow<Response, (Vec<u8>, HeaderMap)>> {
     let data = if n.is_compressed() {
         match maybe_decompress_gzip(&n.data) {
             Ok(d) => d,
             Err(GunzipError::TooLarge) => {
-                return Some(
+                return Some(ControlFlow::Break(
                     (
                         StatusCode::PAYLOAD_TOO_LARGE,
                         "compressed manifest exceeds decompression limit",
                     )
                         .into_response(),
-                )
+                ));
             }
             Err(GunzipError::Decode) => return None,
         }
@@ -3235,195 +3946,278 @@ async fn try_expand_chunk_manifest(
         Err(_) => return None,
     };
 
-    // Guard the attacker-controlled manifest size before allocating: a negative
-    // value would wrap to a huge usize (capacity-overflow panic) and an oversized
-    // one would OOM-kill the server.
-    if manifest.size < 0 || manifest.size as u64 > MAX_EXPANSION_BYTES {
-        return None;
+    if let Some(flow) = reject_bad_chunks(&manifest.chunks) {
+        return Some(flow);
     }
 
-    // Read and concatenate all chunks. Each chunk is resolved to wherever it
-    // lives — a local regular volume, a local EC volume (reconstruct-on-read),
-    // or a peer via master lookup — mirroring Go's ChunkedFileReader, which
-    // never assumes chunks are local regular needles.
-    let mut result = vec![0u8; manifest.size as usize];
-    for chunk in &manifest.chunks {
-        // Validate the attacker-controlled chunk offset before indexing: a
-        // negative value would wrap to a huge usize, and an out-of-range one has
-        // nowhere to land.
-        if chunk.offset < 0 || chunk.size < 0 {
-            return Some(
-                (
-                    StatusCode::INTERNAL_SERVER_ERROR,
-                    format!("invalid negative chunk offset/size in {}", chunk.fid),
-                )
-                    .into_response(),
-            );
+    let Some(sum) = sum_chunk_sizes(&manifest.chunks) else {
+        return Some(manifest_too_large());
+    };
+
+    // Go's tryHandleChunkedFile: ext comes from the URL (including a fid
+    // suffix like /vid,fid.png) and falls back to the resolved filename's.
+    let filename = manifest_filename(path, &manifest.name);
+    let url_ext = extract_extension_from_path(path);
+    let cm_ext = if url_ext.is_empty() {
+        extension_of(&filename)
+    } else {
+        url_ext
+    };
+    let transforms_image = has_image_ops(&cm_ext, query);
+    let (etag, last_modified_str) = etag_and_last_modified(n);
+    let mut response_headers = chunk_manifest_response_headers(
+        n,
+        query,
+        &etag,
+        &last_modified_str,
+        &filename,
+        &manifest.mime,
+    );
+    if *method == Method::HEAD && !transforms_image {
+        response_headers.insert(header::ACCEPT_RANGES, "bytes".parse().unwrap());
+        response_headers.insert(header::CONTENT_LENGTH, sum.to_string().parse().unwrap());
+        return Some(ControlFlow::Break(
+            (StatusCode::OK, response_headers).into_response(),
+        ));
+    }
+
+    let mut wanted: Option<(&str, Vec<HttpRange>)> = None;
+    if transforms_image {
+        if exceeds_expansion_limit(sum as u64) {
+            return Some(manifest_too_large());
         }
-        let data = match read_chunk_needle(state, &chunk.fid).await {
+    } else if let Some(range) = get_range {
+        let parsed = parse_range_header(range, sum);
+        let fetch = match &parsed {
+            Err(_) => false,
+            Ok(ranges) if ranges.is_empty() || sum_ranges_size(ranges) > sum => false,
+            Ok(ranges) => {
+                let covered = sum_ranges_size(ranges);
+                if covered > 0 && exceeds_expansion_limit(covered as u64) {
+                    return Some(manifest_too_large());
+                }
+                if buffered_span_exceeds_limit(&manifest.chunks, sum, ranges) {
+                    return Some(manifest_too_large());
+                }
+                true
+            }
+        };
+        if !fetch {
+            response_headers.insert(header::ACCEPT_RANGES, "bytes".parse().unwrap());
+            return Some(ControlFlow::Break(handle_range_request_with(
+                range,
+                sum,
+                |_buf: &mut Vec<u8>, _, _| {},
+                response_headers,
+                None,
+            )));
+        }
+        wanted = Some((range, parsed.unwrap()));
+    } else if exceeds_expansion_limit(sum as u64) {
+        return Some(manifest_too_large());
+    }
+
+    let size = sum as usize;
+    type Parts = HashMap<(usize, usize), Vec<(usize, Vec<u8>)>>;
+    let mut parts: Parts = HashMap::new();
+    let mut result = if wanted.is_some() {
+        Vec::new()
+    } else {
+        vec![0u8; size]
+    };
+    for chunk in &manifest.chunks {
+        let Some(window) = chunk_window(chunk.offset, chunk.size, sum) else {
+            continue;
+        };
+        let ranges = wanted.as_ref().map(|(_, ranges)| ranges.as_slice());
+        let Some(how) = remote_read_for(chunk.offset, window, ranges) else {
+            continue;
+        };
+        let fetched = match read_chunk_needle(state, &chunk.fid, how).await {
             Ok(d) => d,
             Err(e) => {
-                return Some(
+                return Some(ControlFlow::Break(
                     (
                         StatusCode::INTERNAL_SERVER_ERROR,
                         format!("read chunk {}: {}", chunk.fid, e),
                     )
                         .into_response(),
-                )
+                ));
             }
         };
         let offset = chunk.offset as usize;
-        if offset >= result.len() {
+        let file_lo = offset + fetched.origin;
+        if file_lo >= size {
             continue;
         }
-        // Clamp to the chunk's declared size so an over-long chunk can't bleed
-        // into the next chunk's window; also drop bytes past the buffer end.
-        let bound = (chunk.size as usize).min(result.len() - offset);
-        let copy_len = data.len().min(bound);
-        result[offset..offset + copy_len].copy_from_slice(&data[..copy_len]);
-    }
-
-    // Determine filename: URL path filename, then manifest name
-    // (Go's tryHandleChunkedFile does NOT fall back to needle name)
-    let mut filename = extract_filename_from_path(path);
-    if filename.is_empty() && !manifest.name.is_empty() {
-        filename = manifest.name.clone();
-    }
-
-    // Determine MIME type: manifest mime, but fall back to extension detection
-    // if empty or application/octet-stream (matching Go behavior)
-    let content_type = {
-        let mime_str = &manifest.mime;
-        if !mime_str.is_empty() && !mime_str.starts_with("application/octet-stream") {
-            mime_str.clone()
-        } else {
-            // Try to detect from filename extension
-            let ext = if !filename.is_empty() {
-                if let Some(dot_pos) = filename.rfind('.') {
-                    filename[dot_pos..].to_lowercase()
-                } else {
-                    String::new()
+        let window_end = offset + window as usize;
+        let copy_len = fetched
+            .data
+            .len()
+            .min(window_end.saturating_sub(file_lo))
+            .min(size - file_lo);
+        if let Some((_, ranges)) = &wanted {
+            let file_hi = file_lo + copy_len;
+            let key = |r: &HttpRange| (r.start as usize, (r.start + r.length) as usize);
+            for r in ranges {
+                if r.length <= 0 {
+                    continue;
                 }
-            } else {
-                String::new()
-            };
-            if !ext.is_empty() {
-                mime_guess::from_ext(ext.trim_start_matches('.'))
-                    .first()
-                    .map(|m| m.to_string())
-                    .unwrap_or_else(|| "application/octet-stream".to_string())
-            } else if !mime_str.is_empty() {
-                mime_str.clone()
-            } else {
-                "application/octet-stream".to_string()
-            }
-        }
-    };
-
-    let mut response_headers = HeaderMap::new();
-    // Preserve ETag from the needle (matches Go: ETag is set before tryHandleChunkedFile)
-    if let Ok(etag_val) = etag.parse() {
-        response_headers.insert(header::ETAG, etag_val);
-    }
-    response_headers.insert(header::CONTENT_TYPE, content_type.parse().unwrap());
-    response_headers.insert("X-File-Store", "chunked".parse().unwrap());
-    response_headers.insert(header::ACCEPT_RANGES, "bytes".parse().unwrap());
-
-    // Last-Modified — Go sets this on the response writer before tryHandleChunkedFile
-    if let Some(ref lm) = last_modified_str {
-        if let Ok(hval) = lm.parse() {
-            response_headers.insert(header::LAST_MODIFIED, hval);
-        }
-    }
-
-    // Pairs — Go sets needle pairs on the response writer before tryHandleChunkedFile
-    if n.has_pairs() && !n.pairs.is_empty() {
-        if let Ok(pair_map) =
-            serde_json::from_slice::<std::collections::HashMap<String, String>>(&n.pairs)
-        {
-            for (k, v) in &pair_map {
-                if let (Ok(hname), Ok(hval)) = (
-                    axum::http::HeaderName::from_bytes(k.as_bytes()),
-                    axum::http::HeaderValue::from_str(v),
-                ) {
-                    response_headers.insert(hname, hval);
+                let rs = r.start as usize;
+                let re = rs + r.length as usize;
+                let lo = rs.max(file_lo);
+                let hi = re.min(file_hi);
+                if lo < hi {
+                    parts
+                        .entry(key(r))
+                        .or_default()
+                        .push((lo, fetched.data[lo - file_lo..hi - file_lo].to_vec()));
                 }
             }
-        }
-    }
-
-    // S3 response passthrough headers — Go sets these via AdjustPassthroughHeaders
-    if let Some(ref cc) = query.response_cache_control {
-        if let Ok(hval) = cc.parse() {
-            response_headers.insert(header::CACHE_CONTROL, hval);
-        }
-    }
-    if let Some(ref ce) = query.response_content_encoding {
-        if let Ok(hval) = ce.parse() {
-            response_headers.insert(header::CONTENT_ENCODING, hval);
-        }
-    }
-    if let Some(ref exp) = query.response_expires {
-        if let Ok(hval) = exp.parse() {
-            response_headers.insert(header::EXPIRES, hval);
-        }
-    }
-    if let Some(ref cl) = query.response_content_language {
-        if let Ok(hval) = cl.parse() {
-            response_headers.insert("Content-Language", hval);
-        }
-    }
-    if let Some(ref cd) = query.response_content_disposition {
-        if let Ok(hval) = cd.parse() {
-            response_headers.insert(header::CONTENT_DISPOSITION, hval);
-        }
-    }
-
-    // Content-Disposition
-    if !filename.is_empty() {
-        let disposition_type = if let Some(ref dl_val) = query.dl {
-            if parse_go_bool(dl_val).unwrap_or(false) {
-                "attachment"
-            } else {
-                "inline"
-            }
         } else {
-            "inline"
+            result[file_lo..file_lo + copy_len].copy_from_slice(&fetched.data[..copy_len]);
+        }
+    }
+
+    if let Some((range, _)) = wanted {
+        response_headers.insert(header::ACCEPT_RANGES, "bytes".parse().unwrap());
+        let read = |buf: &mut Vec<u8>, start: usize, end: usize| {
+            let base = buf.len();
+            buf.resize(base + end - start, 0);
+            if let Some(range_parts) = parts.get(&(start, end)) {
+                for (offset, data) in range_parts {
+                    let (lo, hi) = (start.max(*offset), end.min(offset + data.len()));
+                    if lo < hi {
+                        buf[base + lo - start..base + hi - start]
+                            .copy_from_slice(&data[lo - offset..hi - offset]);
+                    }
+                }
+            }
         };
-        let disposition = format_content_disposition(disposition_type, &filename);
-        if let Ok(hval) = disposition.parse() {
-            response_headers.insert(header::CONTENT_DISPOSITION, hval);
-        }
+        return Some(ControlFlow::Break(handle_range_request_with(
+            range,
+            sum,
+            read,
+            response_headers,
+            None,
+        )));
     }
 
-    // Go's tryHandleChunkedFile applies crop then resize to expanded chunk data
-    // (L344-345: conditionallyCropImages, conditionallyResizeImages).
-    let cm_ext = if !filename.is_empty() {
-        if let Some(dot_pos) = filename.rfind('.') {
-            filename[dot_pos..].to_lowercase()
-        } else {
-            String::new()
-        }
-    } else {
-        String::new()
-    };
-    let mut result = result;
     if is_image_crop_ext(&cm_ext) {
         result = maybe_crop_image(&result, &cm_ext, query);
     }
     if is_image_resize_ext(&cm_ext) {
         result = maybe_resize_image(&result, &cm_ext, query);
     }
+    Some(ControlFlow::Continue((result, response_headers)))
+}
 
-    if *method == Method::HEAD {
-        response_headers.insert(
-            header::CONTENT_LENGTH,
-            result.len().to_string().parse().unwrap(),
-        );
-        return Some((StatusCode::OK, response_headers).into_response());
+#[derive(Clone, Copy)]
+enum RemoteRead {
+    /// GET with no Range. Keep at most `cap` bytes. Origin 0.
+    Whole { cap: u64 },
+    /// `Range: bytes={lo}-{hi-1}`. The returned bytes start at chunk offset `lo`.
+    Range { lo: u64, hi: u64 },
+}
+
+struct ChunkBytes {
+    /// Chunk offset of `data[0]`.
+    origin: usize,
+    data: Vec<u8>,
+}
+
+fn chunk_window(offset: i64, size: i64, sum: i64) -> Option<i64> {
+    if size <= 0 || offset >= sum {
+        return None;
     }
+    Some(size.min(sum - offset))
+}
 
-    Some((StatusCode::OK, response_headers, result).into_response())
+/// Overlap of `[offset, offset+window)` with `ranges`, as chunk-relative `[lo, hi)`.
+fn overlap_span(offset: i64, window: i64, ranges: &[HttpRange]) -> Option<(i64, i64)> {
+    let file_hi = offset + window;
+    let mut lo = i64::MAX;
+    let mut hi = i64::MIN;
+    for r in ranges {
+        if r.length <= 0 {
+            continue;
+        }
+        let start = r.start.max(offset);
+        let end = (r.start + r.length).min(file_hi);
+        if start < end {
+            lo = lo.min(start);
+            hi = hi.max(end);
+        }
+    }
+    if lo < hi {
+        Some((lo - offset, hi - offset))
+    } else {
+        None
+    }
+}
+
+/// One fetched span over `MAX_EXPANSION_BYTES`. The covered-length check does
+/// not see the gap between two ranges on the same chunk.
+fn buffered_span_exceeds_limit(chunks: &[ChunkInfo], sum: i64, ranges: &[HttpRange]) -> bool {
+    chunks.iter().any(|chunk| {
+        let Some(window) = chunk_window(chunk.offset, chunk.size, sum) else {
+            return false;
+        };
+        let Some((lo, hi)) = overlap_span(chunk.offset, window, ranges) else {
+            return false;
+        };
+        exceeds_expansion_limit((hi - lo) as u64)
+    })
+}
+
+fn remote_read_for(offset: i64, window: i64, ranges: Option<&[HttpRange]>) -> Option<RemoteRead> {
+    let (lo, hi) = match ranges {
+        None => (0, window),
+        Some(ranges) => overlap_span(offset, window, ranges)?,
+    };
+    if lo == 0 && hi == window {
+        Some(RemoteRead::Whole { cap: window as u64 })
+    } else {
+        Some(RemoteRead::Range {
+            lo: lo as u64,
+            hi: hi as u64,
+        })
+    }
+}
+
+fn content_range_first_byte(headers: &HeaderMap) -> Option<u64> {
+    let values: Vec<_> = headers.get_all(header::CONTENT_RANGE).iter().collect();
+    if values.len() != 1 {
+        return None;
+    }
+    let value = values[0].to_str().ok()?;
+    let rest = value.trim().strip_prefix("bytes ")?;
+    let (start_end, _) = rest.split_once('/')?;
+    let (start, end) = start_end.split_once('-')?;
+    if start.trim().is_empty() || start.trim() == "*" || end.trim().is_empty() {
+        return None;
+    }
+    start.trim().parse().ok()
+}
+
+async fn read_limited_body(resp: &mut reqwest::Response, cap: usize) -> Result<Vec<u8>, String> {
+    let mut out = Vec::new();
+    while out.len() < cap {
+        match resp.chunk().await {
+            Ok(Some(chunk)) => {
+                let room = cap - out.len();
+                if chunk.len() <= room {
+                    out.extend_from_slice(&chunk);
+                } else {
+                    out.extend_from_slice(&chunk[..room]);
+                    break;
+                }
+            }
+            Ok(None) => break,
+            Err(e) => return Err(format!("read body: {e}")),
+        }
+    }
+    Ok(out)
 }
 
 /// Read one chunk-manifest chunk's final (decompressed) content bytes from
@@ -3434,7 +4228,8 @@ async fn try_expand_chunk_manifest(
 async fn read_chunk_needle(
     state: &Arc<VolumeServerState>,
     fid: &str,
-) -> Result<Vec<u8>, String> {
+    how: RemoteRead,
+) -> Result<ChunkBytes, String> {
     let (vid, nid, cookie) =
         parse_url_path(fid).ok_or_else(|| format!("invalid chunk fid: {}", fid))?;
 
@@ -3443,19 +4238,12 @@ async fn read_chunk_needle(
     enum Placement {
         Ec,
         Remote,
+        Local(std::sync::Arc<crate::storage::volume::Volume>),
     }
     let placement = {
         let store = state.store.read().unwrap();
-        if store.find_volume(vid).is_some() {
-            let mut n = Needle {
-                id: nid,
-                cookie,
-                ..Needle::default()
-            };
-            return store
-                .read_volume_needle(vid, &mut n)
-                .map_err(|e| format!("{}", e))
-                .and_then(|_| cookie_checked_chunk(n, cookie));
+        if let Some((_, vol)) = store.find_volume(vid) {
+            Placement::Local(vol)
         } else if store.find_ec_volume(vid).is_some() {
             Placement::Ec
         } else {
@@ -3464,15 +4252,28 @@ async fn read_chunk_needle(
     };
 
     match placement {
+        Placement::Local(vol) => {
+            let mut n = Needle {
+                id: nid,
+                cookie,
+                ..Needle::default()
+            };
+            vol.read_needle(&mut n)
+                .map_err(|e| format!("{}", e))
+                .and_then(|_| cookie_checked_chunk(n, cookie))
+                .map(|data| ChunkBytes { origin: 0, data })
+        }
         Placement::Ec => {
             match crate::server::store_ec::read_ec_shard_needle_distributed(state, vid, nid).await {
-                Ok(Some(n)) => cookie_checked_chunk(n, cookie),
+                Ok(Some(n)) => {
+                    cookie_checked_chunk(n, cookie).map(|data| ChunkBytes { origin: 0, data })
+                }
                 Ok(None) => Err("not found".to_string()),
                 Err(e) => Err(format!("{}", e)),
             }
         }
         // The peer serves through its own GET handler, which validates the cookie.
-        Placement::Remote => read_remote_chunk_needle(state, vid, fid).await,
+        Placement::Remote => read_remote_chunk_needle(state, vid, fid, how).await,
     }
 }
 
@@ -3511,11 +4312,12 @@ async fn read_remote_chunk_needle(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
     fid: &str,
-) -> Result<Vec<u8>, String> {
+    how: RemoteRead,
+) -> Result<ChunkBytes, String> {
     let locations = lookup_volume(
         &state.http_client,
         &state.outgoing_http_scheme,
-        &state.master_url,
+        &state.current_master().await,
         vid.0,
     )
     .await?;
@@ -3540,13 +4342,39 @@ async fn read_remote_chunk_needle(
                 continue;
             }
         };
-        match state.http_client.get(&url).send().await {
-            Ok(resp) if resp.status().is_success() => match resp.bytes().await {
-                Ok(b) => return Ok(b.to_vec()),
-                Err(e) => last_err = format!("read body from {}: {}", url, e),
-            },
-            Ok(resp) => last_err = format!("{} returned {}", url, resp.status()),
-            Err(e) => last_err = format!("request to {} failed: {}", url, e),
+        let mut req = state.http_client.get(&url);
+        let (origin, cap) = match how {
+            RemoteRead::Whole { cap } => (0usize, cap as usize),
+            RemoteRead::Range { lo, hi } => {
+                req = req.header(header::RANGE, format!("bytes={lo}-{}", hi - 1));
+                (lo as usize, (hi - lo) as usize)
+            }
+        };
+        match req.send().await {
+            Ok(mut resp) => {
+                let status = resp.status();
+                let err = match how {
+                    RemoteRead::Whole { .. } if status.is_success() => None,
+                    RemoteRead::Range { lo, .. }
+                        if status.as_u16() == StatusCode::PARTIAL_CONTENT.as_u16() =>
+                    {
+                        match content_range_first_byte(resp.headers()) {
+                            Some(start) if start == lo => None,
+                            _ => Some(format!("{url} Content-Range does not start at {lo}")),
+                        }
+                    }
+                    _ => Some(format!("{url} returned {status}")),
+                };
+                if let Some(err) = err {
+                    last_err = err;
+                    continue;
+                }
+                match read_limited_body(&mut resp, cap).await {
+                    Ok(data) => return Ok(ChunkBytes { origin, data }),
+                    Err(e) => last_err = format!("read body from {url}: {e}"),
+                }
+            }
+            Err(e) => last_err = format!("request to {url} failed: {e}"),
         }
     }
     Err(if last_err.is_empty() {
@@ -3560,16 +4388,6 @@ async fn read_remote_chunk_needle(
 // Helpers
 // ============================================================================
 
-fn absolute_display_path(path: &str) -> String {
-    let p = std::path::Path::new(path);
-    if p.is_absolute() {
-        return path.to_string();
-    }
-    std::env::current_dir()
-        .map(|cwd| cwd.join(p).to_string_lossy().to_string())
-        .unwrap_or_else(|_| path.to_string())
-}
-
 fn build_disk_statuses(store: &crate::storage::store::Store) -> Vec<serde_json::Value> {
     let mut disk_statuses = Vec::new();
     for loc in &store.locations {
@@ -3686,33 +4504,33 @@ fn extract_jwt(headers: &HeaderMap, uri: &axum::http::Uri) -> Option<String> {
     // 1. Check ?jwt= query parameter
     if let Some(query) = uri.query() {
         for pair in query.split('&') {
-            if let Some(value) = pair.strip_prefix("jwt=") {
-                if !value.is_empty() {
-                    return Some(value.to_string());
-                }
+            if let Some(value) = pair.strip_prefix("jwt=")
+                && !value.is_empty()
+            {
+                return Some(value.to_string());
             }
         }
     }
 
     // 2. Check Authorization: Bearer <token> (case-insensitive prefix)
-    if let Some(auth) = headers.get(header::AUTHORIZATION) {
-        if let Ok(auth_str) = auth.to_str() {
-            if auth_str.len() > 7 && auth_str[..7].eq_ignore_ascii_case("bearer ") {
-                return Some(auth_str[7..].to_string());
-            }
-        }
+    if let Some(auth) = headers.get(header::AUTHORIZATION)
+        && let Ok(auth_str) = auth.to_str()
+        && auth_str.len() > 7
+        && auth_str[..7].eq_ignore_ascii_case("bearer ")
+    {
+        return Some(auth_str[7..].to_string());
     }
 
     // 3. Check Cookie
-    if let Some(cookie_header) = headers.get(header::COOKIE) {
-        if let Ok(cookie_str) = cookie_header.to_str() {
-            for cookie in cookie_str.split(';') {
-                let cookie = cookie.trim();
-                if let Some(value) = cookie.strip_prefix("AT=") {
-                    if !value.is_empty() {
-                        return Some(value.to_string());
-                    }
-                }
+    if let Some(cookie_header) = headers.get(header::COOKIE)
+        && let Ok(cookie_str) = cookie_header.to_str()
+    {
+        for cookie in cookie_str.split(';') {
+            let cookie = cookie.trim();
+            if let Some(value) = cookie.strip_prefix("AT=")
+                && !value.is_empty()
+            {
+                return Some(value.to_string());
             }
         }
     }
@@ -3774,8 +4592,8 @@ fn is_compressible_file_type(ext: &str, mtype: &str) -> bool {
 
 /// Try to gzip data. Returns None on error.
 fn try_gzip_data(data: &[u8]) -> Option<Vec<u8>> {
-    use flate2::write::GzEncoder;
     use flate2::Compression;
+    use flate2::write::GzEncoder;
     use std::io::Write;
     let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
     encoder.write_all(data).ok()?;
@@ -3852,6 +4670,181 @@ fn parse_content_disposition_filename(value: &str) -> Option<String> {
 mod tests {
     use super::*;
 
+    /// The upload handler reads fsync off the decoded query fields rather than
+    /// matching the raw string, because Go's r.FormValue decodes and a raw
+    /// match would silently drop a percent-encoded value.
+    #[test]
+    fn test_encoded_query_field_decodes() {
+        let raw = "fsync=%74rue";
+        assert!(
+            !raw.split('&').any(|p| p == "fsync=true"),
+            "a raw match is exactly what misses this"
+        );
+        let fields: Vec<(String, String)> = serde_urlencoded::from_str(raw).unwrap();
+        assert_eq!(
+            fields
+                .iter()
+                .find(|(k, _)| k == "fsync")
+                .map(|(_, v)| v.as_str()),
+            Some("true")
+        );
+    }
+
+    /// Every URL form the volume server accepts, against what Go's
+    /// `parseURLPath` returns for it (`weed/server/common.go:218-249`):
+    /// the `vid/fid/filename` form leaves the fid alone and takes the
+    /// extension off the filename, the other two take it off the fid, and
+    /// none of them touch an `_delta` suffix.
+    #[test]
+    fn test_parse_needle_path_every_form() {
+        let cases: &[(&str, &str, &str, &str, Option<&str>)] = &[
+            // "vid,fid" — Go's default branch.
+            ("/3,01637037d6", "3", "01637037d6", "", None),
+            ("/3,01637037d6.jpg", "3", "01637037d6", ".jpg", None),
+            ("/3,01637037d6_1", "3", "01637037d6_1", "", None),
+            ("/3,01637037d6_1.jpg", "3", "01637037d6_1", ".jpg", None),
+            // "vid/fid" — Go's case 2.
+            ("/3/01637037d6", "3", "01637037d6", "", None),
+            ("/3/01637037d6.jpg", "3", "01637037d6", ".jpg", None),
+            ("/3/01637037d6_1", "3", "01637037d6_1", "", None),
+            ("/3/01637037d6_1.jpg", "3", "01637037d6_1", ".jpg", None),
+            // "vid/fid/filename" — Go's case 3: the fid stays whole.
+            (
+                "/3/01637037d6/report",
+                "3",
+                "01637037d6",
+                "",
+                Some("report"),
+            ),
+            (
+                "/3/01637037d6/report.txt",
+                "3",
+                "01637037d6",
+                ".txt",
+                Some("report.txt"),
+            ),
+            (
+                "/3/01637037d6_1/report",
+                "3",
+                "01637037d6_1",
+                "",
+                Some("report"),
+            ),
+            (
+                "/3/01637037d6_1/report.txt",
+                "3",
+                "01637037d6_1",
+                ".txt",
+                Some("report.txt"),
+            ),
+            // Mixed forms: the slash count decides, so a comma with a trailing
+            // segment is read as "vid/fid" (Go case 2, and the volume id then
+            // fails to parse) and a comma inside a filename is just part of
+            // the filename (Go case 3).
+            (
+                "/3,01637037d6/name.txt",
+                "3,01637037d6",
+                "name",
+                ".txt",
+                None,
+            ),
+            (
+                "/3/01637037d6/my,file.jpg",
+                "3",
+                "01637037d6",
+                ".jpg",
+                Some("my,file.jpg"),
+            ),
+            // Go's case 2 guards the extension split with `dotIndex > 0`, so a
+            // file id that is nothing but an extension keeps it and fails to
+            // parse later; filepath.Ext in case 3 has no such guard.
+            ("/3/.jpg", "3", ".jpg", "", None),
+            (
+                "/3/01637037d6/.jpg",
+                "3",
+                "01637037d6",
+                ".jpg",
+                Some(".jpg"),
+            ),
+        ];
+
+        for &(path, vid, fid, ext, filename) in cases {
+            assert_eq!(
+                parse_needle_path(path),
+                Some(NeedlePath {
+                    vid,
+                    fid,
+                    ext,
+                    filename
+                }),
+                "path {}",
+                path
+            );
+            // Chunk manifest entries arrive without the leading slash.
+            let unrooted = path.trim_start_matches('/');
+            assert_eq!(
+                parse_needle_path(unrooted),
+                parse_needle_path(path),
+                "path {}",
+                unrooted
+            );
+        }
+    }
+
+    /// A path with no file id at all is Go's `isVolumeIdOnly` case; every
+    /// caller here needs a file id, so it has to come back as `None`.
+    #[test]
+    fn test_parse_needle_path_rejects_paths_without_a_file_id() {
+        for path in ["", "/", "/3", "/invalid", "/not/a/valid/volume/path"] {
+            assert_eq!(parse_needle_path(path), None, "path {}", path);
+        }
+    }
+
+    /// Go's `maybeCheckJwtAuthorization` compares the token's `fid` claim
+    /// against `vid + "," + fid` whatever form the URL used
+    /// (volume_server_handlers.go:361-364), so the slash form has to produce
+    /// the comma form too or a JWT-protected read of `/3/01637037d6` can never
+    /// match its own token.
+    #[test]
+    fn test_extract_file_id_normalizes_every_url_form() {
+        for path in [
+            "/3,01637037d6",
+            "/3,01637037d6.jpg",
+            "/3,01637037d6_1",
+            "/3/01637037d6",
+            "/3/01637037d6.jpg",
+            "/3/01637037d6_1.jpg",
+            "/3/01637037d6/report.txt",
+            "/3/01637037d6_1/report.txt",
+        ] {
+            assert_eq!(extract_file_id(path), "3,01637037d6", "path {}", path);
+        }
+    }
+
+    /// Go only drops the `_suffix` when `strings.LastIndex(fid, "_") > 0`
+    /// (volume_server_handlers.go:361-364), so a file id that starts with the
+    /// separator is compared whole rather than becoming empty.
+    #[test]
+    fn test_extract_file_id_keeps_a_leading_underscore() {
+        assert_eq!(extract_file_id("/3,_5"), "3,_5");
+        assert_eq!(extract_file_id("/3/_5"), "3,_5");
+    }
+
+    /// Go checks the JWT before it parses the volume id
+    /// (volume_server_handlers_read.go:142-156), and so does
+    /// get_or_head_handler_inner, which is why an unparsable path still has to
+    /// produce a comparison string: it decides 401 before parse_url_path gets
+    /// to decide 400.
+    #[test]
+    fn test_extract_file_id_falls_back_for_unparsable_paths() {
+        assert_eq!(extract_file_id("/invalid"), "invalid");
+        assert_eq!(extract_file_id("/3"), "3");
+        assert_eq!(
+            extract_file_id("/not/a/valid/volume/path"),
+            "not/a/valid/volume/path"
+        );
+    }
+
     #[test]
     fn test_parse_url_path_comma() {
         let (vid, nid, cookie) = parse_url_path("/3,01637037d6").unwrap();
@@ -3874,16 +4867,61 @@ mod tests {
 
     #[test]
     fn test_parse_url_path_slash_with_filename() {
-        let result = parse_url_path("3/01637037d6/report.txt");
-        assert!(result.is_some());
-        let (vid, _, _) = result.unwrap();
-        assert_eq!(vid, VolumeId(3));
+        // A comma in the filename is part of the filename: the slash count
+        // already decided the form, as in Go's case 3.
+        for path in ["3/01637037d6/report.txt", "3/01637037d6/my,file.jpg"] {
+            let (vid, nid, cookie) = parse_url_path(path).unwrap();
+            assert_eq!(vid, VolumeId(3), "path {}", path);
+            assert_eq!(nid, NeedleId(0x01), "path {}", path);
+            assert_eq!(cookie, Cookie(0x637037d6), "path {}", path);
+        }
+    }
+
+    /// The `_delta` suffix stays on the fid through the path split and is
+    /// applied by parse_needle_id_cookie, as Go's ParsePath does.
+    #[test]
+    fn test_parse_url_path_applies_delta_suffix() {
+        for path in [
+            "/3,01637037d6_1",
+            "/3/01637037d6_1",
+            "/3/01637037d6_1/a.txt",
+        ] {
+            let (vid, nid, cookie) = parse_url_path(path).unwrap();
+            assert_eq!(vid, VolumeId(3), "path {}", path);
+            assert_eq!(nid, NeedleId(0x02), "path {}", path);
+            assert_eq!(cookie, Cookie(0x637037d6), "path {}", path);
+        }
     }
 
     #[test]
     fn test_parse_url_path_invalid() {
         assert!(parse_url_path("/invalid").is_none());
         assert!(parse_url_path("").is_none());
+        // Go reads this as case 2 with vid = "3,01637037d6", which NewVolumeId
+        // rejects, so the comma-with-a-trailing-segment form is a 400 here too.
+        assert!(parse_url_path("/3,01637037d6/name.txt").is_none());
+        // Go's `dotIndex > 0` guard leaves ".jpg" as the file id, which then
+        // fails to parse as a needle id.
+        assert!(parse_url_path("/3/.jpg").is_none());
+    }
+
+    #[test]
+    fn test_parse_range_header_no_overlap() {
+        assert_eq!(
+            parse_range_header("bytes=10-", 10).unwrap_err(),
+            RANGE_NO_OVERLAP
+        );
+        assert_eq!(
+            parse_range_header("bytes=100-", 10).unwrap_err(),
+            RANGE_NO_OVERLAP
+        );
+        // 416 only when every range fails to overlap
+        let ranges = parse_range_header("bytes=10-,0-1", 10).unwrap();
+        assert_eq!(ranges.len(), 1);
+        assert_eq!((ranges[0].start, ranges[0].length), (0, 2));
+        // an end past the size is clamped, still satisfiable
+        let ranges = parse_range_header("bytes=5-100", 10).unwrap();
+        assert_eq!((ranges[0].start, ranges[0].length), (5, 5));
     }
 
     #[test]
@@ -4106,6 +5144,8 @@ mod tests {
             url: "volume.internal:8080".to_string(),
             public_url: "volume.public:8080".to_string(),
             grpc_port: 18080,
+            read_only: false,
+            read_only_can_delete: false,
         };
 
         let response = redirect_request(&info, &target, "https");
@@ -4132,6 +5172,8 @@ mod tests {
             url: "volume.internal:8080.18080".to_string(),
             public_url: "volume.public:8080.18080".to_string(),
             grpc_port: 18080,
+            read_only: false,
+            read_only_can_delete: false,
         };
 
         let response = redirect_request(&info, &target, "http");
@@ -4142,6 +5184,34 @@ mod tests {
         );
     }
 
+    /// Go redirects to `vid,fid` with the extension already stripped: its
+    /// `parseURLPath` case 2 splits `.jpg` off the fid and
+    /// `proxyReqToTargetServer` formats `"%s/%s,%s"` from what is left
+    /// (common.go:224-233, volume_server_handlers_read.go:128-137). Built from
+    /// the real `build_proxy_request_info` so the parse and the Location header
+    /// are covered together.
+    #[test]
+    fn test_redirect_location_drops_extension_for_slash_form() {
+        let info =
+            build_proxy_request_info("/3/01637037d6.jpg", &HeaderMap::new(), "").expect("parses");
+        assert_eq!(info.vid_str, "3");
+        assert_eq!(info.fid_str, "01637037d6");
+
+        let target = VolumeLocation {
+            url: "volume.internal:8080".to_string(),
+            public_url: "volume.public:8080".to_string(),
+            grpc_port: 18080,
+            read_only: false,
+            read_only_can_delete: false,
+        };
+        let response = redirect_request(&info, &target, "http");
+        assert_eq!(response.status(), StatusCode::MOVED_PERMANENTLY);
+        assert_eq!(
+            response.headers().get(header::LOCATION).unwrap(),
+            "http://volume.internal:8080/3,01637037d6?proxied=true"
+        );
+    }
+
     /// Master /dir/lookup often omits publicUrl when empty (Go `json:"publicUrl,omitempty"`).
     /// Replication must still parse locations or every cross-DC write fails.
     #[test]
@@ -4174,19 +5244,23 @@ mod tests {
     /// replicated write to fail.
     #[tokio::test]
     async fn test_lookup_volume_strips_grpc_port_from_master_url() {
-        use axum::{routing::get, Router};
+        use axum::{Router, routing::get};
 
         let app = Router::new().route(
             "/dir/lookup",
-            get(|axum::extract::Query(params): axum::extract::Query<std::collections::HashMap<String, String>>| async move {
-                assert_eq!(params.get("volumeId").map(String::as_str), Some("31"));
-                axum::Json(serde_json::json!({
-                    "volumeOrFileId": "31",
-                    "locations": [
-                        {"url": "10.0.0.2:5301", "publicUrl": "10.0.0.2:5301", "grpcPort": 5311}
-                    ]
-                }))
-            }),
+            get(
+                |axum::extract::Query(params): axum::extract::Query<
+                    std::collections::HashMap<String, String>,
+                >| async move {
+                    assert_eq!(params.get("volumeId").map(String::as_str), Some("31"));
+                    axum::Json(serde_json::json!({
+                        "volumeOrFileId": "31",
+                        "locations": [
+                            {"url": "10.0.0.2:5301", "publicUrl": "10.0.0.2:5301", "grpcPort": 5311}
+                        ]
+                    }))
+                },
+            ),
         );
 
         let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
@@ -4212,4 +5286,2171 @@ mod tests {
 
         server.abort();
     }
+
+    /// A body streaming `data_size` bytes of `file` from offset 0.
+    fn file_streaming_body(
+        file: &std::fs::File,
+        data_size: usize,
+        chunk_size: usize,
+        expected_checksum: u32,
+    ) -> StreamingBody {
+        StreamingBody {
+            source: Arc::new(crate::storage::volume::NeedleStreamSource::Local(
+                file.try_clone().unwrap(),
+            )),
+            data_offset: 0,
+            data_size: data_size as u32,
+            pos: 0,
+            chunk_size,
+            data_file_access_control: Arc::new(
+                crate::storage::volume::DataFileAccessControl::default(),
+            ),
+            hold_read_lock_for_stream: true,
+            _held_read_lease: None,
+            io_unavailable: Arc::default(),
+            io_errors: Arc::default(),
+            pending: None,
+            buf: bytes::BytesMut::new(),
+            state: None,
+            tracked_bytes: 0,
+            needle_id: NeedleId(7),
+            expected_checksum,
+            crc: CRC(0),
+        }
+    }
+
+    /// Repeated target response headers (e.g. Set-Cookie) must all reach the
+    /// client, as Go's `w.Header().Add` does; only `Server` is dropped.
+    #[tokio::test]
+    async fn test_proxy_request_keeps_repeated_response_headers() {
+        use axum::{Router, routing::get};
+
+        let app = Router::new().route(
+            "/3,01637037d6",
+            get(|| async {
+                (
+                    axum::response::AppendHeaders([
+                        (header::SET_COOKIE, "a=1"),
+                        (header::SET_COOKIE, "b=2"),
+                        (header::SERVER, "target"),
+                    ]),
+                    "payload",
+                )
+            }),
+        );
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            axum::serve(listener, app).await.unwrap();
+        });
+
+        let info = ProxyRequestInfo {
+            original_headers: HeaderMap::new(),
+            original_query: String::new(),
+            path: "/3,01637037d6".to_string(),
+            vid_str: "3".to_string(),
+            fid_str: "01637037d6".to_string(),
+        };
+        let target = VolumeLocation {
+            url: addr.to_string(),
+            public_url: String::new(),
+            grpc_port: 0,
+            read_only: false,
+            read_only_can_delete: false,
+        };
+
+        let response = proxy_request(&streaming_test_state(), &info, &target).await;
+        assert_eq!(response.status(), StatusCode::OK);
+        let cookies: Vec<_> = response
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .map(|v| v.to_str().unwrap().to_string())
+            .collect();
+        assert_eq!(cookies, vec!["a=1", "b=2"]);
+        assert!(response.headers().get(header::SERVER).is_none());
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        assert_eq!(&body[..], b"payload");
+
+        server.abort();
+    }
+
+    fn streaming_test_state() -> Arc<VolumeServerState> {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::store::Store;
+        test_state_with_store(Store::new(NeedleMapKind::InMemory))
+    }
+
+    fn test_state_with_store(store: crate::storage::store::Store) -> Arc<VolumeServerState> {
+        use crate::security::{Guard, SigningKey};
+        use crate::server::volume_server::RuntimeMetricsConfig;
+        use std::sync::RwLock;
+        use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU32};
+
+        Arc::new(VolumeServerState {
+            store: RwLock::new(store),
+            guard: RwLock::new(Guard::new(
+                &[],
+                SigningKey(vec![]),
+                0,
+                SigningKey(vec![]),
+                0,
+            )),
+            is_stopping: RwLock::new(false),
+            maintenance: AtomicBool::new(false),
+            state_version: AtomicU32::new(0),
+            concurrent_upload_limit: 0,
+            concurrent_download_limit: 0,
+            inflight_upload_data_timeout: std::time::Duration::ZERO,
+            inflight_download_data_timeout: std::time::Duration::ZERO,
+            inflight_upload_bytes: AtomicI64::new(0),
+            inflight_download_bytes: AtomicI64::new(0),
+            upload_notify: tokio::sync::Notify::new(),
+            download_notify: tokio::sync::Notify::new(),
+            data_center: String::new(),
+            rack: String::new(),
+            file_size_limit_bytes: 0,
+            maintenance_byte_per_second: 0,
+            vacuum_commit_slots: None,
+            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
+            is_heartbeating: AtomicBool::new(false),
+            has_master: false,
+            pre_stop_seconds: 0,
+            volume_state_notify: tokio::sync::Notify::new(),
+            write_queue: std::sync::OnceLock::new(),
+            read_mode: crate::config::ReadMode::Local,
+            allow_untrusted_remote_endpoints: false,
+            master_url: String::new(),
+            master_urls: Vec::new(),
+            seed_master_set: std::collections::HashSet::new(),
+            current_master_url: tokio::sync::RwLock::new(String::new()),
+            self_url: String::new(),
+            http_client: reqwest::Client::new(),
+            outgoing_http_scheme: "http".to_string(),
+            outgoing_grpc_tls: None,
+            metrics_runtime: RwLock::new(RuntimeMetricsConfig::default()),
+            metrics_notify: tokio::sync::Notify::new(),
+            fix_jpg_orientation: false,
+            has_slow_read: false,
+            read_buffer_size_bytes: 4 * 1024 * 1024,
+            security_file: String::new(),
+            cli_white_list: vec![],
+            state_file_path: String::new(),
+            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail_notify: tokio::sync::Notify::new(),
+        })
+    }
+
+    /// Go's readNeedleDataInto holds back the last chunk of a whole-needle read
+    /// until the checksum verifies; a streamed needle that fails its CRC must
+    /// likewise end short of the declared length instead of looking complete.
+    #[tokio::test]
+    async fn test_streaming_body_checksum_failure_drops_last_chunk() {
+        use futures::StreamExt;
+        use std::io::Write;
+
+        let data: Vec<u8> = (0..10_000u32).map(|i| (i % 251) as u8).collect();
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        tmp.write_all(&data).unwrap();
+        let file = tmp.reopen().unwrap();
+
+        let mk_body = |expected_checksum: u32, file: &std::fs::File| {
+            file_streaming_body(file, data.len(), 4096, expected_checksum)
+        };
+
+        // Healthy needle: every byte is delivered.
+        let body = Body::new(mk_body(CRC::new(&data).0, &file));
+        let mut stream = body.into_data_stream();
+        let mut got = 0usize;
+        while let Some(item) = stream.next().await {
+            got += item.expect("healthy stream errored").len();
+        }
+        assert_eq!(got, data.len());
+
+        // Corrupted needle: the last chunk fails the checksum and is never
+        // emitted — the body ends short of the data size.
+        let body = Body::new(mk_body(CRC::new(&data).0 ^ 0xff, &file));
+        let mut stream = body.into_data_stream();
+        let mut got = 0usize;
+        let mut saw_err = false;
+        while let Some(item) = stream.next().await {
+            match item {
+                Ok(bytes) => got += bytes.len(),
+                Err(e) => {
+                    assert!(
+                        e.to_string().contains("checksum"),
+                        "unexpected stream error: {e}"
+                    );
+                    saw_err = true;
+                }
+            }
+        }
+        assert!(saw_err, "corrupted stream must fail");
+        assert!(got < data.len(), "delivered {got} of {} bytes", data.len());
+    }
+
+    const TEST_COOKIE: u32 = 0x1234_5678;
+
+    /// State whose store holds volume 1 in `tmp`.
+    fn volume_test_state(tmp: &tempfile::TempDir) -> Arc<VolumeServerState> {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::store::Store;
+        use crate::storage::volume::VolumeSpec;
+
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                dir,
+                dir,
+                10,
+                DiskType::HardDrive,
+                crate::config::MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+        store
+            .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+            .unwrap();
+        test_state_with_store(store)
+    }
+
+    /// Write a needle to volume 1 and return its URL path.
+    fn put_test_needle(state: &VolumeServerState, id: u64, data: &[u8]) -> String {
+        put_test_needle_with(state, id, data, |_| {})
+    }
+
+    fn put_test_needle_with(
+        state: &VolumeServerState,
+        id: u64,
+        data: &[u8],
+        prepare: impl FnOnce(&mut Needle),
+    ) -> String {
+        let mut n = Needle {
+            id: NeedleId(id),
+            cookie: Cookie(TEST_COOKIE),
+            data: data.to_vec(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        };
+        prepare(&mut n);
+        state
+            .store
+            .write()
+            .unwrap()
+            .write_volume_needle(VolumeId(1), &mut n, false)
+            .unwrap();
+        format!("/1,{:x}{:08x}", id, TEST_COOKIE)
+    }
+
+    fn watch_reads(
+        ids: &[u64],
+    ) -> (
+        Vec<crate::storage::volume::needle_read_hook::Registration>,
+        std::sync::Arc<[std::sync::atomic::AtomicUsize]>,
+    ) {
+        use crate::storage::volume::needle_read_hook;
+        use std::sync::atomic::AtomicUsize;
+        let reads: std::sync::Arc<[AtomicUsize]> = std::sync::Arc::from(
+            std::iter::repeat_with(|| AtomicUsize::new(0))
+                .take(ids.len())
+                .collect::<Vec<_>>()
+                .into_boxed_slice(),
+        );
+        let regs = ids
+            .iter()
+            .enumerate()
+            .map(|(i, &id)| {
+                let reads = reads.clone();
+                needle_read_hook::register(NeedleId(id), move |_| {
+                    reads[i].fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                })
+            })
+            .collect();
+        (regs, reads)
+    }
+
+    fn taken(reads: &std::sync::Arc<[std::sync::atomic::AtomicUsize]>) -> Vec<usize> {
+        use std::sync::atomic::Ordering;
+        reads.iter().map(|c| c.swap(0, Ordering::SeqCst)).collect()
+    }
+
+    fn put_manifest(state: &VolumeServerState, id: u64, json: &str) -> String {
+        put_test_needle_with(state, id, json.as_bytes(), |n| n.set_is_chunk_manifest())
+    }
+
+    fn put_gzip_manifest(state: &VolumeServerState, id: u64, json: &str) -> String {
+        let gz = try_gzip_data(json.as_bytes()).unwrap();
+        put_test_needle_with(state, id, &gz, |n| {
+            n.set_is_chunk_manifest();
+            n.set_is_compressed();
+        })
+    }
+
+    /// Write `data` as a chunk manifest on a fresh EC volume 2. Chunks stay on volume 1.
+    fn put_ec_manifest(
+        state: &VolumeServerState,
+        tmp: &tempfile::TempDir,
+        id: u64,
+        data: &[u8],
+        compressed: bool,
+    ) -> String {
+        use crate::storage::erasure_coding::ec_encoder::write_ec_files;
+        use crate::storage::erasure_coding::ec_shard::ShardId;
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+
+        let dir = tmp.path().to_str().unwrap();
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(2),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        let mut n = Needle {
+            id: NeedleId(id),
+            cookie: Cookie(TEST_COOKIE),
+            data: data.to_vec(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        };
+        n.set_is_chunk_manifest();
+        if compressed {
+            n.set_is_compressed();
+        }
+        v.write_needle(&mut n, true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        v.close();
+        write_ec_files(dir, dir, "", VolumeId(2), 10, 4).unwrap();
+        let shard_ids: Vec<ShardId> = (0..14).collect();
+        state
+            .store
+            .write()
+            .unwrap()
+            .mount_ec_shards(VolumeId(2), "", &shard_ids)
+            .unwrap();
+        format!("/2,{:x}{:08x}", id, TEST_COOKIE)
+    }
+
+    fn slash_name(stored: &str, name: &str) -> String {
+        let fid = stored.trim_start_matches('/');
+        let (vid, needle) = fid.split_once(',').unwrap();
+        format!("/{vid}/{needle}/{name}")
+    }
+
+    async fn send_read(
+        state: &Arc<VolumeServerState>,
+        method: Method,
+        path: &str,
+        range: Option<&[u8]>,
+    ) -> (StatusCode, HeaderMap, Vec<u8>) {
+        use tower::ServiceExt;
+        let mut req = Request::builder().method(method).uri(path);
+        if let Some(range) = range {
+            req = req.header(
+                header::RANGE,
+                header::HeaderValue::from_bytes(range).unwrap(),
+            );
+        }
+        let resp = super::super::volume_server::build_public_router(state.clone())
+            .oneshot(req.body(Body::empty()).unwrap())
+            .await
+            .unwrap();
+        let status = resp.status();
+        let headers = resp.headers().clone();
+        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
+            .await
+            .unwrap()
+            .to_vec();
+        (status, headers, body)
+    }
+
+    /// The public router does not accept DELETE requests, so this calls the
+    /// handler directly, the same way the admin router does.
+    async fn send_delete(state: &Arc<VolumeServerState>, path: &str) -> StatusCode {
+        let request = Request::builder()
+            .method(Method::DELETE)
+            .uri(path)
+            .body(Body::empty())
+            .unwrap();
+        delete_handler(State(state.clone()), request).await.status()
+    }
+
+    #[test]
+    fn test_not_modified_checks_if_none_match_first() {
+        let n = Needle {
+            last_modified: 1700000000,
+            ..Needle::default()
+        };
+        let (etag, last_modified_str) = etag_and_last_modified(&n);
+        let bare = n.etag();
+        let before = "Tue, 14 Nov 2023 22:12:20 GMT".to_string();
+        let after = "Tue, 14 Nov 2023 22:14:20 GMT".to_string();
+
+        let cases: Vec<(Vec<(axum::http::HeaderName, String)>, bool)> = vec![
+            (vec![(header::IF_NONE_MATCH, format!("\"{bare}\""))], true),
+            (vec![(header::IF_NONE_MATCH, format!("W/\"{bare}\""))], true),
+            (
+                vec![(header::IF_NONE_MATCH, format!("\"x\", \"{bare}\""))],
+                true,
+            ),
+            (vec![(header::IF_NONE_MATCH, "*".into())], true),
+            (vec![(header::IF_NONE_MATCH, "\"x\"".into())], false),
+            (
+                vec![
+                    (header::IF_NONE_MATCH, "\"x\"".into()),
+                    (header::IF_NONE_MATCH, format!("\"{bare}\"")),
+                ],
+                true,
+            ),
+            (
+                vec![(header::IF_NONE_MATCH, format!("\"{bare},old\""))],
+                false,
+            ),
+            (
+                vec![(header::IF_NONE_MATCH, format!("\"x\",,\"{bare}\""))],
+                true,
+            ),
+            (
+                vec![
+                    (header::IF_NONE_MATCH, "\"x\"".into()),
+                    (header::IF_MODIFIED_SINCE, after.clone()),
+                ],
+                false,
+            ),
+            (
+                vec![
+                    (header::IF_NONE_MATCH, "".into()),
+                    (header::IF_MODIFIED_SINCE, after.clone()),
+                ],
+                false,
+            ),
+            (vec![(header::IF_MODIFIED_SINCE, after)], true),
+            (vec![(header::IF_MODIFIED_SINCE, before)], false),
+        ];
+        for (pairs, want) in cases {
+            let mut headers = HeaderMap::new();
+            for (name, value) in &pairs {
+                headers.append(name, value.parse().unwrap());
+            }
+            assert_eq!(
+                not_modified_response(&n, &headers, &etag, &last_modified_str).is_some(),
+                want,
+                "{pairs:?}"
+            );
+        }
+
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::IF_NONE_MATCH,
+            format!("\"{bare}\"").parse().unwrap(),
+        );
+        let resp = not_modified_response(&n, &headers, &etag, &last_modified_str).unwrap();
+        assert!(resp.headers().contains_key(header::ETAG));
+        assert!(resp.headers().contains_key(header::LAST_MODIFIED));
+    }
+
+    /// A GET whose needle read is parked must not hold the store lock: a
+    /// writer, here a real append to the same volume, must get through.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_get_needle_read_runs_off_the_store_lock() {
+        use crate::storage::volume::needle_read_hook;
+        use std::sync::Mutex;
+        use std::sync::mpsc;
+        use std::time::Duration;
+
+        const ID: u64 = 0x6e7a_0001;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let data = b"parked needle".to_vec();
+        let path = put_test_needle(&state, ID, &data);
+
+        let (entered_tx, entered_rx) = mpsc::channel::<()>();
+        let (release_tx, release_rx) = mpsc::channel::<()>();
+        let release_rx = Mutex::new(release_rx);
+        let _hook = needle_read_hook::register(NeedleId(ID), move |_| {
+            let _ = entered_tx.send(());
+            // Returns once released, or at once when the sender is gone.
+            let _ = release_rx.lock().unwrap().recv();
+        });
+
+        let get = tokio::spawn({
+            let state = state.clone();
+            async move { send_read(&state, Method::GET, &path, None).await }
+        });
+        tokio::task::spawn_blocking(move || entered_rx.recv_timeout(Duration::from_secs(10)))
+            .await
+            .unwrap()
+            .expect("the GET never reached its needle read");
+
+        let try_write_ok = state.store.try_write().is_ok();
+        let (wrote_tx, wrote_rx) = mpsc::channel();
+        std::thread::spawn({
+            let state = state.clone();
+            move || {
+                put_test_needle(&state, ID + 1, b"written meanwhile");
+                let _ = wrote_tx.send(());
+            }
+        });
+        let write_done = tokio::task::spawn_blocking(move || {
+            wrote_rx.recv_timeout(Duration::from_secs(5)).is_ok()
+        })
+        .await
+        .unwrap();
+        drop(release_tx);
+
+        assert!(
+            try_write_ok,
+            "a parked GET read must not hold the store lock"
+        );
+        assert!(write_done, "an append must not wait for a parked GET read");
+        let (status, _, body) = get.await.unwrap();
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, data);
+    }
+
+    /// A small needle is read from disk once, not once for its meta and
+    /// again in full; a large one never reads its payload before streaming.
+    #[tokio::test]
+    async fn test_get_reads_small_needle_once_and_large_needle_meta_only() {
+        use crate::storage::volume::needle_read_hook;
+        use std::sync::Mutex;
+
+        const SMALL: u64 = 0x6e7a_0101;
+        const LARGE: u64 = 0x6e7a_0102;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let small = b"small needle".to_vec();
+        let large: Vec<u8> = (0..(STREAMING_THRESHOLD as usize + 4096))
+            .map(|i| (i % 251) as u8)
+            .collect();
+        let small_path = put_test_needle(&state, SMALL, &small);
+        let large_path = put_test_needle(&state, LARGE, &large);
+
+        let small_reads = Arc::new(Mutex::new(Vec::new()));
+        let large_reads = Arc::new(Mutex::new(Vec::new()));
+        let _small_hook = needle_read_hook::register(NeedleId(SMALL), {
+            let reads = small_reads.clone();
+            move |len| reads.lock().unwrap().push(len)
+        });
+        let _large_hook = needle_read_hook::register(NeedleId(LARGE), {
+            let reads = large_reads.clone();
+            move |len| reads.lock().unwrap().push(len)
+        });
+
+        let (status, _, body) = send_read(&state, Method::GET, &small_path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, small);
+        let reads = small_reads.lock().unwrap().clone();
+        assert_eq!(reads.len(), 1, "reads of the small needle: {reads:?}");
+
+        let (status, _, body) = send_read(&state, Method::GET, &large_path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, large);
+        let reads = large_reads.lock().unwrap().clone();
+        assert!(
+            !reads.is_empty() && reads.iter().all(|&len| len < 64 * 1024),
+            "the large needle's payload must not be read before streaming: {reads:?}"
+        );
+    }
+
+    /// A delete needs the needle's cookie and its chunk-manifest flag. Both
+    /// are stored in the header and trailer, so the delete must not read the
+    /// payload.
+    #[tokio::test]
+    async fn test_delete_reads_needle_meta_only() {
+        use crate::storage::volume::needle_read_hook;
+        use std::sync::Mutex;
+
+        const ID: u64 = 0x6e7a_0a01;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let data: Vec<u8> = (0..512 * 1024).map(|i| (i % 251) as u8).collect();
+        let path = put_test_needle(&state, ID, &data);
+
+        let reads = Arc::new(Mutex::new(Vec::new()));
+        let _hook = needle_read_hook::register(NeedleId(ID), {
+            let reads = reads.clone();
+            move |len| reads.lock().unwrap().push(len)
+        });
+
+        let wrong_cookie = format!("/1,{:x}{:08x}", ID, TEST_COOKIE + 1);
+        assert_eq!(
+            send_delete(&state, &wrong_cookie).await,
+            StatusCode::BAD_REQUEST
+        );
+        assert_eq!(send_delete(&state, &path).await, StatusCode::ACCEPTED);
+
+        let reads = reads.lock().unwrap().clone();
+        assert!(
+            !reads.is_empty() && reads.iter().all(|&len| len < 4096),
+            "a delete must not read the needle's payload ({} bytes): {reads:?}",
+            data.len()
+        );
+        let (status, _, _) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::NOT_FOUND);
+    }
+
+    /// HEAD and ranged reads keep answering from the needle meta and the
+    /// data file, and a missing or wrong-cookie needle is still a 404.
+    #[tokio::test]
+    async fn test_get_head_range_and_not_found_after_single_read() {
+        const ID: u64 = 0x6e7a_0201;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let data: Vec<u8> = (0..4096u32).map(|i| (i % 251) as u8).collect();
+        let path = put_test_needle(&state, ID, &data);
+
+        let (status, headers, body) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], data.len().to_string());
+        assert!(headers.contains_key(header::ETAG));
+
+        let (status, headers, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=10-19")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, &data[10..20]);
+        assert_eq!(
+            headers["Content-Range"],
+            format!("bytes 10-19/{}", data.len())
+        );
+
+        let wrong_cookie = format!("/1,{:x}{:08x}", ID, TEST_COOKIE ^ 1);
+        let (status, _, _) = send_read(&state, Method::GET, &wrong_cookie, None).await;
+        assert_eq!(status, StatusCode::NOT_FOUND);
+        let missing = format!("/1,{:x}{:08x}", ID + 1, TEST_COOKIE);
+        let (status, _, _) = send_read(&state, Method::GET, &missing, None).await;
+        assert_eq!(status, StatusCode::NOT_FOUND);
+    }
+
+    /// A ranged read served from the data file reports its outcome to the
+    /// io-error streak, like readNeedleDataInto: a finished range clears the
+    /// count a failed meta read left.
+    #[test]
+    fn test_range_from_source_reports_to_io_error_streak() {
+        use std::io::Write;
+
+        let tmp = tempfile::TempDir::new().unwrap();
+        let file = std::fs::OpenOptions::new()
+            .read(true)
+            .write(true)
+            .create(true)
+            .open(tmp.path().join("1.dat"))
+            .unwrap();
+        let data: Vec<u8> = (0..256u32).map(|i| i as u8).collect();
+        (&file).write_all(&data).unwrap();
+
+        let io_errors = Arc::new(crate::storage::io_error::IoErrorTracker::default());
+        let eio = crate::storage::volume::media_error_for_test();
+        io_errors.check_read_write_error(Some(&eio));
+        io_errors.check_read_write_error(Some(&eio));
+        assert_eq!(io_errors.get_io_error_state().1, 2);
+
+        let info = crate::storage::volume::NeedleStreamInfo {
+            source: crate::storage::volume::NeedleStreamSource::Local(file),
+            data_file_offset: 0,
+            data_size: data.len() as u32,
+            data_file_access_control: Arc::default(),
+            io_unavailable: Arc::default(),
+            io_errors: io_errors.clone(),
+            needle_id: NeedleId(1),
+            checksum: 0,
+        };
+        let resp = handle_range_request_from_source("bytes=10-19", info, HeaderMap::new(), None);
+        assert_eq!(resp.status(), StatusCode::PARTIAL_CONTENT);
+        assert_eq!(io_errors.get_io_error_state().1, 0);
+    }
+
+    /// Range is read as Go reads it: a byte its parseRange cannot parse is a
+    /// 416, Unicode whitespace around a range is trimmed, an empty value is no
+    /// range, and HEAD ignores it.
+    #[tokio::test]
+    async fn test_get_range_header_is_read_as_go_reads_it() {
+        const PLAIN: u64 = 0x6e7a_0501;
+        const GZIPPED: u64 = 0x6e7a_0502;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let data = b"range over a needle".to_vec();
+        let plain_path = put_test_needle(&state, PLAIN, &data);
+        let gz = try_gzip_data(&data).unwrap();
+        let gz_path = put_test_needle_with(&state, GZIPPED, &gz, |n| n.set_is_compressed());
+
+        for path in [&plain_path, &gz_path] {
+            let (status, _, body) =
+                send_read(&state, Method::GET, path, Some(b"bytes=0-1\xff")).await;
+            assert_eq!(status, StatusCode::RANGE_NOT_SATISFIABLE, "{path}");
+            assert_eq!(body, b"invalid range", "{path}");
+
+            let (status, _, _) =
+                send_read(&state, Method::HEAD, path, Some(b"bytes=0-1\xff")).await;
+            assert_eq!(status, StatusCode::OK, "{path}");
+
+            for range in ["bytes=0-1\u{a0}", "bytes=\u{85}0-1"] {
+                let (status, headers, body) =
+                    send_read(&state, Method::GET, path, Some(range.as_bytes())).await;
+                assert_eq!(status, StatusCode::PARTIAL_CONTENT, "{path} {range:?}");
+                assert_eq!(body, &data[..2], "{path} {range:?}");
+                assert_eq!(
+                    headers["Content-Range"],
+                    format!("bytes 0-1/{}", data.len())
+                );
+            }
+
+            let (status, _, body) = send_read(&state, Method::GET, path, Some(b"")).await;
+            assert_eq!(status, StatusCode::OK, "{path}");
+            assert_eq!(body, data, "{path}");
+        }
+    }
+
+    /// An EC needle is served from memory: its GET parses Range like any
+    /// other, and its HEAD ignores it as Go's writeResponseContent does.
+    #[tokio::test]
+    async fn test_ec_needle_range_and_head() {
+        use crate::storage::erasure_coding::ec_encoder::write_ec_files;
+        use crate::storage::erasure_coding::ec_shard::ShardId;
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+
+        const ID: u64 = 0x6e7a_0601;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let dir = tmp.path().to_str().unwrap();
+        let data: Vec<u8> = (0..4096u32).map(|i| (i % 251) as u8).collect();
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(2),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        let mut n = Needle {
+            id: NeedleId(ID),
+            cookie: Cookie(TEST_COOKIE),
+            data: data.clone(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        v.close();
+        write_ec_files(dir, dir, "", VolumeId(2), 10, 4).unwrap();
+        let shard_ids: Vec<ShardId> = (0..14).collect();
+        state
+            .store
+            .write()
+            .unwrap()
+            .mount_ec_shards(VolumeId(2), "", &shard_ids)
+            .unwrap();
+        let path = format!("/2,{:x}{:08x}", ID, TEST_COOKIE);
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=0-1\xff")).await;
+        assert_eq!(status, StatusCode::RANGE_NOT_SATISFIABLE);
+        assert_eq!(body, b"invalid range");
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=10-19")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, &data[10..20]);
+
+        for range in [&b"bytes=10-19"[..], b"bytes=0-1\xff"] {
+            let (status, headers, _) = send_read(&state, Method::HEAD, &path, Some(range)).await;
+            assert_eq!(status, StatusCode::OK);
+            assert_eq!(headers[header::CONTENT_LENGTH], data.len().to_string());
+        }
+    }
+
+    /// A chunk manifest applies Range to the assembled object. HEAD reports the
+    /// sum of chunk sizes, including when a Range header is present.
+    #[tokio::test]
+    async fn test_chunk_manifest_range() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let data = b"0123456789abcdef";
+        let a = put_test_needle(&state, 0x6e7a_0701, &data[..8]);
+        let b = put_test_needle(&state, 0x6e7a_0702, &data[8..]);
+        let manifest = format!(
+            r#"{{"name":"obj.txt","size":16,"chunks":[{{"fid":"{}","offset":0,"size":8}},{{"fid":"{}","offset":8,"size":8}}]}}"#,
+            &a[1..],
+            &b[1..]
+        );
+        let path = put_test_needle_with(&state, 0x6e7a_0703, manifest.as_bytes(), |n| {
+            n.set_is_chunk_manifest()
+        });
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, data);
+
+        let (status, headers, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=5-12")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, &data[5..13]);
+        assert_eq!(headers["Content-Range"], "bytes 5-12/16");
+        assert_eq!(headers["X-File-Store"], "chunked");
+        assert!(headers.contains_key(header::ETAG));
+
+        let (status, headers, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=0-1,14-15")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert!(
+            headers[header::CONTENT_TYPE]
+                .to_str()
+                .unwrap()
+                .starts_with("multipart/byteranges")
+        );
+        let body = String::from_utf8(body).unwrap();
+        assert!(body.contains("Content-Range: bytes 0-1/16\r\n\r\n01"));
+        assert!(body.contains("Content-Range: bytes 14-15/16\r\n\r\nef"));
+
+        let (status, headers, _) = send_read(&state, Method::GET, &path, Some(b"bytes=16-")).await;
+        assert_eq!(status, StatusCode::RANGE_NOT_SATISFIABLE);
+        assert_eq!(headers["Content-Range"], "bytes */16");
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=0-1\xff")).await;
+        assert_eq!(status, StatusCode::RANGE_NOT_SATISFIABLE);
+        assert_eq!(body, b"invalid range");
+
+        let (status, headers, body) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], "16");
+        assert_eq!(headers["X-File-Store"], "chunked");
+        assert_eq!(headers[header::ACCEPT_RANGES], "bytes");
+        let (range_status, range_headers, range_body) =
+            send_read(&state, Method::HEAD, &path, Some(b"bytes=0-9")).await;
+        assert_eq!(range_status, StatusCode::OK);
+        assert!(range_body.is_empty());
+        assert_eq!(range_headers[header::CONTENT_LENGTH], "16");
+        assert_eq!(range_headers["X-File-Store"], "chunked");
+    }
+
+    /// A ranged GET of a chunk manifest fetches only the chunks its ranges
+    /// overlap, as Go's ChunkedFileReader does.
+    #[tokio::test]
+    async fn test_chunk_manifest_range_fetches_only_overlapping_chunks() {
+        use crate::storage::volume::needle_read_hook;
+        use std::sync::atomic::{AtomicUsize, Ordering};
+
+        const IDS: [u64; 3] = [0x6e7a_0901, 0x6e7a_0902, 0x6e7a_0903];
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let data = b"chunk-1:chunk-2:chunk-3:";
+        let fids: Vec<String> = IDS
+            .iter()
+            .zip(data.chunks(8))
+            .map(|(&id, part)| put_test_needle(&state, id, part)[1..].to_string())
+            .collect();
+        let manifest = format!(
+            r#"{{"name":"obj.txt","size":24,"chunks":[{{"fid":"{}","offset":0,"size":8}},{{"fid":"{}","offset":8,"size":8}},{{"fid":"{}","offset":16,"size":8}}]}}"#,
+            fids[0], fids[1], fids[2]
+        );
+        let path = put_test_needle_with(&state, 0x6e7a_0904, manifest.as_bytes(), |n| {
+            n.set_is_chunk_manifest()
+        });
+
+        let reads: Arc<[AtomicUsize; 3]> = Arc::new(Default::default());
+        let _hooks: Vec<_> = IDS
+            .iter()
+            .enumerate()
+            .map(|(i, &id)| {
+                let reads = reads.clone();
+                needle_read_hook::register(NeedleId(id), move |_| {
+                    reads[i].fetch_add(1, Ordering::SeqCst);
+                })
+            })
+            .collect();
+        let fetched =
+            || -> [usize; 3] { std::array::from_fn(|i| reads[i].swap(0, Ordering::SeqCst)) };
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, data);
+        assert_eq!(fetched(), [1, 1, 1]);
+
+        let (status, headers, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=10-13")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, &data[10..14]);
+        assert_eq!(headers["Content-Range"], "bytes 10-13/24");
+        assert_eq!(headers[header::CONTENT_LENGTH], "4");
+        assert_eq!(headers[header::ACCEPT_RANGES], "bytes");
+        assert_eq!(headers["X-File-Store"], "chunked");
+        assert!(headers.contains_key(header::ETAG));
+        assert_eq!(fetched(), [0, 1, 0]);
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=4-11")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, &data[4..12]);
+        assert_eq!(fetched(), [1, 1, 0]);
+
+        let (status, headers, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=0-1,20-23")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert!(
+            headers[header::CONTENT_TYPE]
+                .to_str()
+                .unwrap()
+                .starts_with("multipart/byteranges")
+        );
+        let body = String::from_utf8(body).unwrap();
+        assert!(body.contains("Content-Range: bytes 0-1/24\r\n\r\nch"));
+        assert!(body.contains("Content-Range: bytes 20-23/24\r\n\r\nk-3:\r\n"));
+        assert_eq!(fetched(), [1, 0, 1]);
+
+        let (status, headers, _) = send_read(&state, Method::GET, &path, Some(b"bytes=24-")).await;
+        assert_eq!(status, StatusCode::RANGE_NOT_SATISFIABLE);
+        assert_eq!(headers["Content-Range"], "bytes */24");
+        assert_eq!(fetched(), [0, 0, 0]);
+    }
+
+    /// Ranges served from fetched chunks read what assembly would: clamped
+    /// chunks, later ones overwriting earlier ones, and zero-filled gaps.
+    #[tokio::test]
+    async fn test_chunk_manifest_range_matches_assembly() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let a = put_test_needle(&state, 0x6e7a_0905, b"AAAAAAAA");
+        let b = put_test_needle(&state, 0x6e7a_0906, b"BBBB");
+        let c = put_test_needle(&state, 0x6e7a_0907, b"CCCC");
+        let manifest = format!(
+            r#"{{"size":12,"chunks":[{{"fid":"{}","offset":0,"size":6}},{{"fid":"{}","offset":4,"size":4}},{{"fid":"{}","offset":10,"size":4}}]}}"#,
+            &a[1..],
+            &b[1..],
+            &c[1..]
+        );
+        let path = put_test_needle_with(&state, 0x6e7a_0908, manifest.as_bytes(), |n| {
+            n.set_is_chunk_manifest()
+        });
+
+        let (status, _, full) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(full, b"AAAABBBB\0\0CCCC");
+        for start in 0..14 {
+            for end in start..14 {
+                let range = format!("bytes={start}-{end}");
+                let (status, _, body) =
+                    send_read(&state, Method::GET, &path, Some(range.as_bytes())).await;
+                assert_eq!(status, StatusCode::PARTIAL_CONTENT, "{range}");
+                assert_eq!(body, &full[start..=end], "{range}");
+            }
+        }
+    }
+
+    /// Regular and EC HEAD of a chunk manifest, plain or gzipped, report the
+    /// sum and do not read chunks. The sum is not the stored needle length.
+    #[tokio::test]
+    async fn test_chunk_manifest_head_sum() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let a = put_test_needle(&state, 0x6e7a_0a01, b"AAAAAAAA");
+        let b = put_test_needle(&state, 0x6e7a_0a02, b"BBBBBBBB");
+        let json = format!(
+            r#"{{"name":"obj.txt","size":100,"chunks":[{{"fid":"{}","offset":0,"size":8}},{{"fid":"{}","offset":8,"size":8}}]}}"#,
+            &a[1..],
+            &b[1..]
+        );
+        assert_ne!(json.len(), 16);
+        let path = put_manifest(&state, 0x6e7a_0a03, &json);
+        let (_regs, reads) = watch_reads(&[0x6e7a_0a01, 0x6e7a_0a02]);
+
+        let (status, headers, body) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], "16");
+        assert_eq!(headers["X-File-Store"], "chunked");
+        assert_eq!(headers[header::ACCEPT_RANGES], "bytes");
+        assert_eq!(taken(&reads), vec![0, 0]);
+
+        let gz_path = put_gzip_manifest(&state, 0x6e7a_0a04, &json);
+        let (status, headers, _) = send_read(&state, Method::HEAD, &gz_path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(headers[header::CONTENT_LENGTH], "16");
+        assert_eq!(headers["X-File-Store"], "chunked");
+        assert_eq!(taken(&reads), vec![0, 0]);
+
+        let cached = format!("{path}?response-cache-control=max-age%3D9");
+        let (status, headers, _) = send_read(&state, Method::HEAD, &cached, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(headers[header::CACHE_CONTROL], "max-age=9");
+        assert_eq!(headers[header::CONTENT_LENGTH], "16");
+        assert_eq!(taken(&reads), vec![0, 0]);
+
+        // Regression pins: expansion does not claim these.
+        let raw = put_manifest(&state, 0x6e7a_0a05, "not-json");
+        let (status, headers, body) = send_read(&state, Method::HEAD, &raw, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], "8");
+        assert!(!headers.contains_key("X-File-Store"));
+
+        let bypass = format!("{path}?cm=false");
+        let (status, headers, _) = send_read(&state, Method::HEAD, &bypass, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(headers[header::CONTENT_LENGTH], json.len().to_string());
+        assert!(!headers.contains_key("X-File-Store"));
+    }
+
+    /// An EC manifest used to fetch every chunk on HEAD. It now reports the sum.
+    #[tokio::test]
+    async fn test_chunk_manifest_head_ec() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let a = put_test_needle(&state, 0x6e7a_0a11, b"AAAAAAAA");
+        let b = put_test_needle(&state, 0x6e7a_0a12, b"BBBBBBBB");
+        let json = format!(
+            r#"{{"name":"obj.txt","size":100,"chunks":[{{"fid":"{}","offset":0,"size":8}},{{"fid":"{}","offset":8,"size":8}}]}}"#,
+            &a[1..],
+            &b[1..]
+        );
+        let path = put_ec_manifest(&state, &tmp, 0x6e7a_0a13, json.as_bytes(), false);
+        let (_regs, reads) = watch_reads(&[0x6e7a_0a11, 0x6e7a_0a12]);
+        let (status, headers, body) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], "16");
+        assert_eq!(headers["X-File-Store"], "chunked");
+        assert_eq!(taken(&reads), vec![0, 0]);
+        drop(_regs);
+
+        // A second mount of volume 2 on the same store fails. Gzip gets its own.
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let a = put_test_needle(&state, 0x6e7a_0a15, b"AAAAAAAA");
+        let b = put_test_needle(&state, 0x6e7a_0a16, b"BBBBBBBB");
+        let json = format!(
+            r#"{{"name":"obj.txt","size":100,"chunks":[{{"fid":"{}","offset":0,"size":8}},{{"fid":"{}","offset":8,"size":8}}]}}"#,
+            &a[1..],
+            &b[1..]
+        );
+        let gz = try_gzip_data(json.as_bytes()).unwrap();
+        assert_ne!(gz.len(), 16);
+        let path = put_ec_manifest(&state, &tmp, 0x6e7a_0a17, &gz, true);
+        let (_regs, reads) = watch_reads(&[0x6e7a_0a15, 0x6e7a_0a16]);
+        let (status, headers, body) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], "16");
+        assert_eq!(headers["X-File-Store"], "chunked");
+        assert_eq!(taken(&reads), vec![0, 0]);
+    }
+
+    fn solid_png(width: u32, height: u32) -> Vec<u8> {
+        let mut img = image::RgbImage::new(width, height);
+        for px in img.pixels_mut() {
+            *px = image::Rgb([10, 20, 30]);
+        }
+        let mut buf = Vec::new();
+        img.write_to(&mut std::io::Cursor::new(&mut buf), image::ImageFormat::Png)
+            .unwrap();
+        buf
+    }
+
+    /// A zero crop is not a transform. A real crop of one PNG still fetches,
+    /// and Range applies to the transformed bytes.
+    #[tokio::test]
+    async fn test_chunk_manifest_head_image() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let first = put_test_needle(&state, 0x6e7a_0a21, b"AAAA");
+        let second = put_test_needle(&state, 0x6e7a_0a22, b"BBBB");
+        let raw = format!(
+            r#"{{"name":"obj.txt","size":8,"chunks":[{{"fid":"{}","offset":0,"size":4}},{{"fid":"{}","offset":4,"size":4}}]}}"#,
+            &first[1..],
+            &second[1..]
+        );
+        let stored = put_manifest(&state, 0x6e7a_0a23, &raw);
+        let (_regs, reads) = watch_reads(&[0x6e7a_0a21, 0x6e7a_0a22]);
+        for query in ["crop_x2=0&crop_y2=0", "width=0&height=0"] {
+            let url = format!("{}?{query}", slash_name(&stored, "obj.jpg"));
+            let (status, headers, _) = send_read(&state, Method::HEAD, &url, None).await;
+            assert_eq!(status, StatusCode::OK, "{query}");
+            assert_eq!(headers[header::CONTENT_LENGTH], "8", "{query}");
+            assert_eq!(headers["X-File-Store"], "chunked", "{query}");
+            assert_eq!(taken(&reads), vec![0, 0], "{query}");
+        }
+        let partial = format!("{}?crop_x2=0&crop_y2=0", slash_name(&stored, "obj.jpg"));
+        let (status, _, body) = send_read(&state, Method::GET, &partial, Some(b"bytes=0-3")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"AAAA");
+        assert_eq!(taken(&reads), vec![1, 0]);
+
+        let png = solid_png(8, 8);
+        let chunk = put_test_needle(&state, 0x6e7a_0a24, &png);
+        let image = format!(
+            r#"{{"name":"obj.txt","size":{},"chunks":[{{"fid":"{}","offset":0,"size":{}}}]}}"#,
+            png.len(),
+            &chunk[1..],
+            png.len()
+        );
+        let stored = put_manifest(&state, 0x6e7a_0a25, &image);
+        let (_regs, reads) = watch_reads(&[0x6e7a_0a24]);
+        let crop = format!(
+            "{}?crop_x1=0&crop_y1=0&crop_x2=2&crop_y2=2",
+            slash_name(&stored, "obj.jpg")
+        );
+        let (get_status, _, cropped) = send_read(&state, Method::GET, &crop, None).await;
+        assert_eq!(get_status, StatusCode::OK);
+        assert_ne!(cropped.len(), png.len(), "the crop must change the length");
+        assert_eq!(taken(&reads), vec![1]);
+
+        let (status, headers, body) =
+            send_read(&state, Method::HEAD, &crop, Some(b"bytes=0-1")).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], cropped.len().to_string());
+        assert_eq!(taken(&reads), vec![1]);
+
+        let past = format!("bytes={}-", cropped.len());
+        let (status, _, _) = send_read(&state, Method::GET, &crop, Some(past.as_bytes())).await;
+        assert_eq!(status, StatusCode::RANGE_NOT_SATISFIABLE);
+        assert_eq!(taken(&reads), vec![1]);
+    }
+
+    /// A HEAD asking for an image transform needs the payload too: a
+    /// meta-only read could not produce the transformed length.
+    #[tokio::test]
+    async fn test_head_with_image_op_reads_full() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let png = solid_png(8, 8);
+        let stored = put_test_needle(&state, 0x6e7a_0a30, &png);
+        let crop = format!(
+            "{}.png?crop_x1=0&crop_y1=0&crop_x2=2&crop_y2=2",
+            stored
+        );
+
+        let (get_status, _, cropped) = send_read(&state, Method::GET, &crop, None).await;
+        assert_eq!(get_status, StatusCode::OK);
+        assert_ne!(cropped.len(), png.len(), "the crop must change the length");
+
+        let (status, headers, body) = send_read(&state, Method::HEAD, &crop, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], cropped.len().to_string());
+    }
+
+    /// Go takes the transform extension from the URL first — including a fid
+    /// suffix like /vid,fid.png — before the resolved filename's.
+    #[tokio::test]
+    async fn test_chunk_manifest_fid_extension_drives_transform() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let png = solid_png(8, 8);
+        let chunk = put_test_needle(&state, 0x6e7a_0f01, &png);
+        let (_regs, reads) = watch_reads(&[0x6e7a_0f01]);
+        let json = format!(
+            r#"{{"name":"obj","size":{},"chunks":[{{"fid":"{}","offset":0,"size":{}}}]}}"#,
+            png.len(),
+            &chunk[1..],
+            png.len()
+        );
+        let stored = put_manifest(&state, 0x6e7a_0f02, &json);
+        let url = format!("{stored}.png?width=2&height=2");
+        let (status, _, body) = send_read(&state, Method::GET, &url, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_ne!(body.len(), png.len(), "resize must run on the fid suffix");
+        assert_eq!(taken(&reads), vec![1]);
+
+        let (status, headers, head_body) = send_read(&state, Method::HEAD, &url, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(head_body.is_empty());
+        assert_eq!(headers[header::CONTENT_LENGTH], body.len().to_string());
+        assert_eq!(taken(&reads), vec![1]);
+    }
+
+    #[test]
+    fn test_expansion_limit_allows_exactly_two_gib() {
+        assert!(!exceeds_expansion_limit(MAX_EXPANSION_BYTES));
+        assert!(exceeds_expansion_limit(MAX_EXPANSION_BYTES + 1));
+        assert!(!exceeds_expansion_limit(0));
+    }
+
+    #[test]
+    fn test_remote_whole_window_caps_at_visible_window() {
+        let ranges = [HttpRange {
+            start: 100,
+            length: 4,
+        }];
+        let how = remote_read_for(100, 4, Some(&ranges)).unwrap();
+        assert!(matches!(how, RemoteRead::Whole { cap: 4 }));
+        let full = remote_read_for(0, 8, None).unwrap();
+        assert!(matches!(full, RemoteRead::Whole { cap: 8 }));
+        let prefix = remote_read_for(
+            0,
+            8,
+            Some(&[HttpRange {
+                start: 0,
+                length: 4,
+            }]),
+        )
+        .unwrap();
+        assert!(matches!(prefix, RemoteRead::Range { lo: 0, hi: 4 }));
+    }
+
+    #[test]
+    fn test_sum_ranges_size_ignores_non_positive() {
+        let ranges = [
+            HttpRange {
+                start: 0,
+                length: 8,
+            },
+            HttpRange {
+                start: 0,
+                length: 8,
+            },
+            HttpRange {
+                start: 0,
+                length: -1_073_741_824,
+            },
+        ];
+        assert_eq!(sum_ranges_size(&ranges), 16);
+        let over = [
+            HttpRange {
+                start: 0,
+                length: MAX_EXPANSION_BYTES as i64 + 1,
+            },
+            HttpRange {
+                start: 0,
+                length: -1,
+            },
+        ];
+        assert_eq!(sum_ranges_size(&over), MAX_EXPANSION_BYTES as i64 + 1);
+        assert!(exceeds_expansion_limit(sum_ranges_size(&over) as u64));
+    }
+
+    /// `"size"` is not the object length. Holes stay zero. Chunks at or past
+    /// the sum are not read.
+    #[tokio::test]
+    async fn test_chunk_manifest_length_is_sum() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+
+        let a = put_test_needle(&state, 0x6e7a_0c01, b"AAAA");
+        let b = put_test_needle(&state, 0x6e7a_0c02, b"BBBB");
+        let omitted = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":4}},{{"fid":"{}","offset":4,"size":4}}]}}"#,
+            &a[1..],
+            &b[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c03, &omitted);
+        let (status, headers, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, b"AAAABBBB");
+        assert_eq!(headers[header::CONTENT_LENGTH], "8");
+
+        let padded = format!(
+            r#"{{"size":100,"chunks":[{{"fid":"{}","offset":0,"size":4}}]}}"#,
+            &a[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c04, &padded);
+        let (status, headers, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, b"AAAA");
+        assert_eq!(headers[header::CONTENT_LENGTH], "4");
+
+        let gap_b = put_test_needle(&state, 0x6e7a_0c05, b"BBBB");
+        let (_regs, reads) = watch_reads(&[0x6e7a_0c01, 0x6e7a_0c05]);
+        let gap = format!(
+            r#"{{"size":100,"chunks":[{{"fid":"{}","offset":0,"size":4}},{{"fid":"{}","offset":8,"size":4}}]}}"#,
+            &a[1..],
+            &gap_b[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c06, &gap);
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, b"AAAA\0\0\0\0");
+        assert_eq!(taken(&reads), vec![1, 0]);
+
+        let zero = format!(
+            r#"{{"chunks":[{{"fid":"9,0000000a12345678","offset":0,"size":0}},{{"fid":"{}","offset":0,"size":4}}]}}"#,
+            &a[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c07, &zero);
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, b"AAAA");
+
+        let empty = put_manifest(&state, 0x6e7a_0c08, r#"{"size":5,"chunks":[]}"#);
+        let (status, headers, body) = send_read(&state, Method::HEAD, &empty, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(headers[header::CONTENT_LENGTH], "0");
+        assert!(body.is_empty());
+        let (status, headers, body) = send_read(&state, Method::GET, &empty, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(headers[header::CONTENT_LENGTH], "0");
+        assert!(body.is_empty());
+        let (status, headers, _) = send_read(&state, Method::GET, &empty, Some(b"bytes=0-0")).await;
+        assert_eq!(status, StatusCode::RANGE_NOT_SATISFIABLE);
+        assert_eq!(headers["Content-Range"], "bytes */0");
+
+        let ten = put_test_needle(&state, 0x6e7a_0c09, b"0123456789");
+        let (_regs, reads) = watch_reads(&[0x6e7a_0c09]);
+        let dup = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":10}}]}}"#,
+            &ten[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c0a, &dup);
+        let (status, headers, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=0-7,0-7")).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::ACCEPT_RANGES], "bytes");
+        assert_eq!(taken(&reads), vec![0]);
+    }
+
+    /// A negative suffix must not shrink the covered length under the sum.
+    /// Duplicate ranges stay an empty 200 and read nothing.
+    #[tokio::test]
+    async fn test_chunk_manifest_negative_suffix_stays_empty() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let ten = put_test_needle(&state, 0x6e7a_0c41, b"0123456789");
+        let (_regs, reads) = watch_reads(&[0x6e7a_0c41]);
+        let json = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":10}}]}}"#,
+            &ten[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c42, &json);
+        let (status, headers, body) = send_read(
+            &state,
+            Method::GET,
+            &path,
+            Some(b"bytes=0-7,0-7,--1073741824"),
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::ACCEPT_RANGES], "bytes");
+        assert_eq!(taken(&reads), vec![0]);
+    }
+
+    /// A negative field is rejected before any read, including a chunk the
+    /// range does not overlap.
+    #[tokio::test]
+    async fn test_chunk_manifest_negative_reads_nothing() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let inside = put_test_needle(&state, 0x6e7a_0c11, b"AAAA");
+        let outside = put_test_needle(&state, 0x6e7a_0c12, b"BBBB");
+        let (_regs, reads) = watch_reads(&[0x6e7a_0c11, 0x6e7a_0c12]);
+        let json = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":4}},{{"fid":"{}","offset":100,"size":4}},{{"fid":"9,0000000b12345678","offset":0,"size":-1}}]}}"#,
+            &inside[1..],
+            &outside[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c13, &json);
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=0-1")).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+        let body = String::from_utf8(body).unwrap();
+        assert!(
+            body.contains("invalid negative chunk offset/size"),
+            "{body}"
+        );
+        assert_eq!(taken(&reads), vec![0, 0]);
+
+        let (status, _, _) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+        assert_eq!(taken(&reads), vec![0, 0]);
+    }
+
+    /// The cap is the bytes that would be buffered. Exactly 2 GiB is allowed
+    /// by the predicate. This test does not allocate that buffer.
+    #[tokio::test]
+    async fn test_chunk_manifest_cap_is_buffered_bytes() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let one = put_test_needle(&state, 0x6e7a_0c21, b"Z");
+        let (_regs, reads) = watch_reads(&[0x6e7a_0c21]);
+        let big = MAX_EXPANSION_BYTES + 1;
+        let json = format!(
+            r#"{{"size":1,"chunks":[{{"fid":"{}","offset":0,"size":{big}}}]}}"#,
+            &one[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c22, &json);
+
+        let (status, headers, body) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(headers[header::CONTENT_LENGTH], big.to_string());
+        assert!(body.is_empty());
+        assert_eq!(taken(&reads), vec![0]);
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::PAYLOAD_TOO_LARGE);
+        assert_eq!(body, b"chunk manifest exceeds expansion limit");
+        assert_eq!(taken(&reads), vec![0]);
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=0-3")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"Z\0\0\0");
+        assert_eq!(taken(&reads), vec![1]);
+
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=0-")).await;
+        assert_eq!(status, StatusCode::PAYLOAD_TOO_LARGE);
+        assert_eq!(body, b"chunk manifest exceeds expansion limit");
+        assert_eq!(taken(&reads), vec![0]);
+
+        let overflow = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":1}},{{"fid":"9,0000000c12345678","offset":0,"size":9223372036854775807}},{{"fid":"9,0000000d12345678","offset":0,"size":9223372036854775807}},{{"fid":"9,0000000e12345678","offset":0,"size":9223372036854775807}}]}}"#,
+            &one[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0c23, &overflow);
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::PAYLOAD_TOO_LARGE);
+        assert_eq!(body, b"chunk manifest exceeds expansion limit");
+        assert_eq!(taken(&reads), vec![0]);
+    }
+
+    /// Two open ranges on an `i64::MAX` object must not wrap the covered
+    /// length. The saturated sum equals the total, which is over the buffer
+    /// cap, so this is 413 and reads nothing.
+    #[tokio::test]
+    async fn test_chunk_manifest_open_ranges_do_not_wrap() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let one = put_test_needle(&state, 0x6e7a_0c31, b"Z");
+        let (_regs, reads) = watch_reads(&[0x6e7a_0c31]);
+        let json = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":{}}}]}}"#,
+            &one[1..],
+            i64::MAX
+        );
+        let path = put_manifest(&state, 0x6e7a_0c32, &json);
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=0-,0-")).await;
+        assert_eq!(status, StatusCode::PAYLOAD_TOO_LARGE);
+        assert_eq!(body, b"chunk manifest exceeds expansion limit");
+        assert_eq!(taken(&reads), vec![0]);
+    }
+
+    #[derive(Clone)]
+    enum PeerMode {
+        /// Honor a single `bytes=lo-hi` range. No Range header returns `chunk`.
+        Honor {
+            chunk: Vec<u8>,
+        },
+        Always200 {
+            body: Vec<u8>,
+        },
+        Status(u16),
+        /// 206 whose Content-Range starts at 0, whatever Range was asked.
+        WrongStart {
+            body: Vec<u8>,
+        },
+        /// 206, correct start, body shorter than the asked span.
+        Short {
+            body: Vec<u8>,
+        },
+        /// 206, correct start, body longer than the asked span.
+        Long {
+            body: Vec<u8>,
+        },
+        /// 206 with no Content-Range header.
+        NoContentRange {
+            body: Vec<u8>,
+        },
+    }
+
+    struct PeerHit {
+        range: Option<String>,
+    }
+
+    async fn spawn_chunk_peer(
+        mode: std::sync::Arc<std::sync::Mutex<PeerMode>>,
+        hits: std::sync::Arc<std::sync::Mutex<Vec<PeerHit>>>,
+    ) -> (std::net::SocketAddr, tokio::task::JoinHandle<()>) {
+        use axum::routing::get;
+        let app = axum::Router::new().route(
+            "/{*rest}",
+            get(move |headers: HeaderMap| {
+                let mode = mode.clone();
+                let hits = hits.clone();
+                async move {
+                    let range = headers
+                        .get(header::RANGE)
+                        .and_then(|v| v.to_str().ok())
+                        .map(|s| s.to_string());
+                    hits.lock().unwrap().push(PeerHit {
+                        range: range.clone(),
+                    });
+                    let mode = mode.lock().unwrap().clone();
+                    match mode {
+                        PeerMode::Honor { chunk } => match range {
+                            None => (StatusCode::OK, chunk).into_response(),
+                            Some(spec) => {
+                                let nums = spec.trim_start_matches("bytes=");
+                                let (lo, hi) = nums.split_once('-').unwrap();
+                                let lo: usize = lo.parse().unwrap();
+                                let hi: usize = hi.parse().unwrap();
+                                let body = chunk[lo..=hi].to_vec();
+                                let cr = format!("bytes {lo}-{hi}/{}", chunk.len());
+                                (
+                                    StatusCode::PARTIAL_CONTENT,
+                                    [(header::CONTENT_RANGE, cr)],
+                                    body,
+                                )
+                                    .into_response()
+                            }
+                        },
+                        PeerMode::Always200 { body } => (StatusCode::OK, body).into_response(),
+                        PeerMode::Status(code) => {
+                            StatusCode::from_u16(code).unwrap().into_response()
+                        }
+                        PeerMode::WrongStart { body } => (
+                            StatusCode::PARTIAL_CONTENT,
+                            [(
+                                header::CONTENT_RANGE,
+                                format!("bytes 0-{}/8", body.len().saturating_sub(1)),
+                            )],
+                            body,
+                        )
+                            .into_response(),
+                        PeerMode::Short { body } => {
+                            let spec = range.unwrap();
+                            let nums = spec.trim_start_matches("bytes=");
+                            let (lo, hi) = nums.split_once('-').unwrap();
+                            (
+                                StatusCode::PARTIAL_CONTENT,
+                                [(header::CONTENT_RANGE, format!("bytes {lo}-{hi}/8"))],
+                                body,
+                            )
+                                .into_response()
+                        }
+                        PeerMode::Long { body } => {
+                            let spec = range.unwrap();
+                            let nums = spec.trim_start_matches("bytes=");
+                            let (lo, hi) = nums.split_once('-').unwrap();
+                            (
+                                StatusCode::PARTIAL_CONTENT,
+                                [(header::CONTENT_RANGE, format!("bytes {lo}-{hi}/8"))],
+                                body,
+                            )
+                                .into_response()
+                        }
+                        PeerMode::NoContentRange { body } => {
+                            (StatusCode::PARTIAL_CONTENT, body).into_response()
+                        }
+                    }
+                }
+            }),
+        );
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let handle = tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+        (addr, handle)
+    }
+
+    async fn spawn_lookup(peer: std::net::SocketAddr) -> String {
+        use axum::routing::get;
+        let app = axum::Router::new().route(
+            "/dir/lookup",
+            get(move || async move {
+                axum::Json(serde_json::json!({
+                    "volumeOrFileId": "9",
+                    "locations": [{ "url": peer.to_string() }]
+                }))
+            }),
+        );
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+        format!("127.0.0.1:{}", addr.port())
+    }
+
+    fn remote_manifest_state(
+        tmp: &tempfile::TempDir,
+        master_url: String,
+    ) -> Arc<VolumeServerState> {
+        let mut state = volume_test_state(tmp);
+        let s = Arc::get_mut(&mut state).unwrap();
+        // Empty self_url makes `url.contains(self_url)` true for every peer.
+        s.self_url = "198.51.100.8:8080".to_string();
+        s.master_url = master_url.clone();
+        s.current_master_url = tokio::sync::RwLock::new(master_url);
+        state
+    }
+
+    /// Remote overlap is one bounded Range, indexed from `lo`. Local short
+    /// needles still zero-fill.
+    #[tokio::test]
+    async fn test_chunk_manifest_remote_range() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let mode = std::sync::Arc::new(std::sync::Mutex::new(PeerMode::Honor {
+            chunk: b"ABCDEFGH".to_vec(),
+        }));
+        let hits = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+        let (peer, peer_handle) = spawn_chunk_peer(mode.clone(), hits.clone()).await;
+        let master = spawn_lookup(peer).await;
+        let state = remote_manifest_state(&tmp, master);
+        let local = put_test_needle(&state, 0x6e7a_0d01, b"0123456789");
+        let remote_fid = "9,0000000a12345678";
+        let json = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":10}},{{"fid":"{remote_fid}","offset":10,"size":8}}]}}"#,
+            &local[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0d02, &json);
+
+        hits.lock().unwrap().clear();
+        let (status, headers, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=12-15")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"CDEF");
+        assert_eq!(headers["Content-Range"], "bytes 12-15/18");
+        let seen = hits.lock().unwrap().drain(..).collect::<Vec<_>>();
+        assert_eq!(seen.len(), 1);
+        assert_eq!(seen[0].range.as_deref(), Some("bytes=2-5"));
+
+        hits.lock().unwrap().clear();
+        let (status, _, body) =
+            send_read(&state, Method::GET, &path, Some(b"bytes=11-12,15-16")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        let text = String::from_utf8(body).unwrap();
+        assert!(
+            text.contains("Content-Range: bytes 11-12/18\r\n\r\nBC"),
+            "{text}"
+        );
+        assert!(
+            text.contains("Content-Range: bytes 15-16/18\r\n\r\nFG"),
+            "{text}"
+        );
+        let seen = hits.lock().unwrap().drain(..).collect::<Vec<_>>();
+        assert_eq!(seen.len(), 1, "disjoint ranges share one span");
+        assert_eq!(seen[0].range.as_deref(), Some("bytes=1-6"));
+
+        hits.lock().unwrap().clear();
+        let whole = put_manifest(
+            &state,
+            0x6e7a_0d03,
+            &format!(r#"{{"chunks":[{{"fid":"{remote_fid}","offset":0,"size":8}}]}}"#),
+        );
+        let (status, _, body) = send_read(&state, Method::GET, &whole, Some(b"bytes=0-7")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"ABCDEFGH");
+        let seen = hits.lock().unwrap().drain(..).collect::<Vec<_>>();
+        assert_eq!(seen.len(), 1);
+        assert_eq!(seen[0].range, None);
+
+        *mode.lock().unwrap() = PeerMode::Short {
+            body: b"AB".to_vec(),
+        };
+        hits.lock().unwrap().clear();
+        let (status, _, body) = send_read(&state, Method::GET, &whole, Some(b"bytes=0-3")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"AB\0\0");
+
+        *mode.lock().unwrap() = PeerMode::Long {
+            body: b"ABCDEFGH".to_vec(),
+        };
+        let (status, _, body) = send_read(&state, Method::GET, &whole, Some(b"bytes=0-3")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"ABCD");
+
+        *mode.lock().unwrap() = PeerMode::WrongStart {
+            body: b"ABCD".to_vec(),
+        };
+        let (status, _, body) = send_read(&state, Method::GET, &whole, Some(b"bytes=2-5")).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+        assert!(String::from_utf8_lossy(&body).contains("read chunk"));
+
+        *mode.lock().unwrap() = PeerMode::NoContentRange {
+            body: b"CDEF".to_vec(),
+        };
+        let (status, _, body) = send_read(&state, Method::GET, &whole, Some(b"bytes=2-5")).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+        assert!(String::from_utf8_lossy(&body).contains("read chunk"));
+
+        *mode.lock().unwrap() = PeerMode::Always200 {
+            body: b"ABCDEFGH".to_vec(),
+        };
+        let (status, _, body) = send_read(&state, Method::GET, &whole, Some(b"bytes=2-5")).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+        assert!(String::from_utf8_lossy(&body).contains("read chunk"));
+
+        *mode.lock().unwrap() = PeerMode::Status(416);
+        let (status, _, body) = send_read(&state, Method::GET, &whole, Some(b"bytes=1-2")).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+        assert!(String::from_utf8_lossy(&body).contains("read chunk"));
+
+        peer_handle.abort();
+    }
+
+    /// A local needle shorter than declared zero-fills. The remote 416 above
+    /// is the intentional divergence.
+    #[tokio::test]
+    async fn test_chunk_manifest_local_short_needle_zero_fills() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let short = put_test_needle(&state, 0x6e7a_0d11, b"AB");
+        let json = format!(
+            r#"{{"chunks":[{{"fid":"{}","offset":0,"size":4}}]}}"#,
+            &short[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0d12, &json);
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=1-2")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"B\0");
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, b"AB\0\0");
+    }
+
+    /// A short range of a huge remote chunk is fetched. The span between two
+    /// distant ranges is not, once it would buffer more than 2 GiB.
+    #[tokio::test]
+    async fn test_chunk_manifest_remote_span_over_cap_is_rejected() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let mode = std::sync::Arc::new(std::sync::Mutex::new(PeerMode::Honor {
+            chunk: b"ABCDEFGH".to_vec(),
+        }));
+        let hits = std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+        let (peer, peer_handle) = spawn_chunk_peer(mode, hits.clone()).await;
+        let master = spawn_lookup(peer).await;
+        let state = remote_manifest_state(&tmp, master);
+        let big = MAX_EXPANSION_BYTES + 1;
+        let path = put_manifest(
+            &state,
+            0x6e7a_0e01,
+            &format!(r#"{{"chunks":[{{"fid":"9,0000000a12345678","offset":0,"size":{big}}}]}}"#),
+        );
+
+        hits.lock().unwrap().clear();
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(b"bytes=0-3")).await;
+        assert_eq!(status, StatusCode::PARTIAL_CONTENT);
+        assert_eq!(body, b"ABCD");
+        assert_eq!(hits.lock().unwrap().len(), 1);
+
+        hits.lock().unwrap().clear();
+        let last = big - 1;
+        let wide = format!("bytes=0-0,{last}-{last}");
+        let (status, _, body) = send_read(&state, Method::GET, &path, Some(wide.as_bytes())).await;
+        assert_eq!(status, StatusCode::PAYLOAD_TOO_LARGE);
+        assert_eq!(body, b"chunk manifest exceeds expansion limit");
+        assert!(hits.lock().unwrap().is_empty());
+        peer_handle.abort();
+    }
+
+    /// An illegal manifest MIME is not a legal header value. HEAD reaches the
+    /// header builder, so both HEAD and GET fall back instead of panicking.
+    #[tokio::test]
+    async fn test_chunk_manifest_illegal_mime_falls_back() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let chunk = put_test_needle(&state, 0x6e7a_0e11, b"AAAA");
+        let (_regs, reads) = watch_reads(&[0x6e7a_0e11]);
+        let json = format!(
+            r#"{{"name":"obj.txt","mime":"text/plain\n","size":4,"chunks":[{{"fid":"{}","offset":0,"size":4}}]}}"#,
+            &chunk[1..]
+        );
+        let path = put_manifest(&state, 0x6e7a_0e12, &json);
+
+        let (status, headers, body) = send_read(&state, Method::HEAD, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert!(body.is_empty());
+        assert_eq!(headers[header::CONTENT_TYPE], "application/octet-stream");
+        assert_eq!(headers[header::CONTENT_LENGTH], "4");
+        assert_eq!(taken(&reads), vec![0]);
+
+        let (status, headers, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, b"AAAA");
+        assert_eq!(headers[header::CONTENT_TYPE], "application/octet-stream");
+        assert_eq!(taken(&reads), vec![1]);
+    }
+
+    /// A proxied read forwards request headers as raw bytes, as Go does: a
+    /// Range the target cannot parse must reach it and come back as its 416.
+    #[tokio::test]
+    async fn test_proxy_forwards_non_ascii_range() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let target_state = volume_test_state(&tmp);
+        let path = put_test_needle(&target_state, 0x6e7a_0801, b"proxied payload");
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let app = super::super::volume_server::build_public_router(target_state);
+        let server = tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+
+        let proxy_state = test_state_with_store(crate::storage::store::Store::new(
+            crate::storage::needle_map::NeedleMapKind::InMemory,
+        ));
+        let target = VolumeLocation {
+            url: addr.to_string(),
+            public_url: addr.to_string(),
+            grpc_port: 0,
+            read_only: false,
+            read_only_can_delete: false,
+        };
+        let mut headers = HeaderMap::new();
+        headers.insert(
+            header::RANGE,
+            header::HeaderValue::from_bytes(b"bytes=0-1\xff").unwrap(),
+        );
+        let info = build_proxy_request_info(&path, &headers, "").unwrap();
+
+        let resp = proxy_request(&proxy_state, &info, &target).await;
+        assert_eq!(resp.status(), StatusCode::RANGE_NOT_SATISFIABLE);
+        let body = axum::body::to_bytes(resp.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        assert_eq!(&body[..], b"invalid range");
+
+        server.abort();
+    }
+
+    /// A large compressed needle cannot be streamed as stored: its meta is
+    /// read first, then the payload exactly once.
+    #[tokio::test]
+    async fn test_get_large_compressed_needle_reads_payload_once() {
+        use crate::storage::volume::needle_read_hook;
+        use std::sync::Mutex;
+
+        const ID: u64 = 0x6e7a_0301;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        // Incompressible, so the stored gzip stays above the stream threshold.
+        let mut x = 0x2545_f491_u32;
+        let plain: Vec<u8> = (0..(STREAMING_THRESHOLD as usize + 64 * 1024))
+            .map(|_| {
+                x ^= x << 13;
+                x ^= x >> 17;
+                x ^= x << 5;
+                x as u8
+            })
+            .collect();
+        let gz = try_gzip_data(&plain).unwrap();
+        assert!(gz.len() > STREAMING_THRESHOLD as usize);
+        let path = put_test_needle_with(&state, ID, &gz, |n| n.set_is_compressed());
+
+        let reads = Arc::new(Mutex::new(Vec::new()));
+        let _hook = needle_read_hook::register(NeedleId(ID), {
+            let reads = reads.clone();
+            move |len| reads.lock().unwrap().push(len)
+        });
+        let (status, _, body) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::OK);
+        assert_eq!(body, plain);
+        let reads = reads.lock().unwrap().clone();
+        let full = reads.iter().filter(|&&len| len >= gz.len()).count();
+        assert_eq!(full, 1, "reads: {reads:?}");
+    }
+
+    /// The single full read still verifies the needle checksum.
+    #[tokio::test]
+    async fn test_get_small_needle_with_bad_checksum_fails() {
+        const ID: u64 = 0x6e7a_0401;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        let data = b"checksummed payload, to be corrupted".to_vec();
+        let path = put_test_needle(&state, ID, &data);
+
+        let dat = tmp.path().join("1.dat");
+        let mut bytes = std::fs::read(&dat).unwrap();
+        let at = bytes
+            .windows(data.len())
+            .position(|w| w == data.as_slice())
+            .unwrap();
+        bytes[at] ^= 0xff;
+        std::fs::write(&dat, bytes).unwrap();
+
+        let (status, _, _) = send_read(&state, Method::GET, &path, None).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR);
+    }
+
+    /// Each chunk reuses the buffer of the previous frame once that frame has
+    /// been dropped, instead of allocating a new one.
+    #[tokio::test]
+    async fn test_streaming_body_reuses_its_chunk_buffer() {
+        use std::io::Write;
+
+        const CHUNK: usize = 4096;
+        let data: Vec<u8> = (0..3 * CHUNK + 100).map(|i| (i % 251) as u8).collect();
+        let mut tmp = tempfile::NamedTempFile::new().unwrap();
+        tmp.write_all(&data).unwrap();
+        let file = tmp.reopen().unwrap();
+        let mut body = file_streaming_body(&file, data.len(), CHUNK, CRC::new(&data).0);
+
+        let mut got = Vec::new();
+        while let Some(frame) = std::future::poll_fn(|cx| {
+            http_body::Body::poll_frame(std::pin::Pin::new(&mut body), cx)
+        })
+        .await
+        {
+            let chunk = frame.unwrap().into_data().unwrap();
+            got.extend_from_slice(&chunk);
+            assert!(
+                !body.buf.try_reclaim(CHUNK),
+                "the buffer must be the one the live frame points into"
+            );
+            drop(chunk);
+            assert!(
+                body.buf.try_reclaim(CHUNK),
+                "the chunk buffer did not come back from the read"
+            );
+        }
+        assert_eq!(got, data);
+    }
+
+    /// Start a GET and return its body unread.
+    async fn open_read(state: &Arc<VolumeServerState>, path: &str) -> Body {
+        use tower::ServiceExt;
+        let resp = super::super::volume_server::build_public_router(state.clone())
+            .oneshot(Request::builder().uri(path).body(Body::empty()).unwrap())
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::OK);
+        resp.into_body()
+    }
+
+    /// A needle that streams in several chunks.
+    fn multi_chunk_data() -> Vec<u8> {
+        (0..9 * 1024 * 1024 + 123)
+            .map(|i| (i % 251) as u8)
+            .collect()
+    }
+
+    /// With -hasSlowRead=false a stream holds a data-file lease for its whole
+    /// life, and a writer waits for that lease under store.write(). Producing
+    /// a frame must not need the store lock, or the two wait on each other.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_streaming_body_progresses_while_a_writer_holds_the_store() {
+        use futures::StreamExt;
+        use std::sync::mpsc;
+        use std::time::{Duration, Instant};
+
+        const ID: u64 = 0x6e7a_0501;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        assert!(!state.has_slow_read);
+        let data = multi_chunk_data();
+        let path = put_test_needle(&state, ID, &data);
+
+        let mut stream = open_read(&state, &path).await.into_data_stream();
+        let mut got = stream.next().await.unwrap().unwrap().to_vec();
+        assert!(
+            got.len() < data.len(),
+            "the needle must span several frames"
+        );
+
+        // The writer takes store.write(), then parks on the stream's lease.
+        let (wrote_tx, wrote_rx) = mpsc::channel();
+        std::thread::spawn({
+            let state = state.clone();
+            move || {
+                put_test_needle(&state, ID + 1, b"written meanwhile");
+                let _ = wrote_tx.send(());
+            }
+        });
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while state.store.try_read().is_ok() {
+            assert!(Instant::now() < deadline, "the writer never took the store");
+            std::thread::sleep(Duration::from_millis(1));
+        }
+
+        // Drained off the runtime: a frame stuck on the store lock would block
+        // its thread, which a tokio timeout cannot interrupt.
+        let (done_tx, done_rx) = mpsc::channel();
+        let rt = tokio::runtime::Handle::current();
+        std::thread::spawn(move || {
+            let rest = rt.block_on(async move {
+                let mut rest = Vec::new();
+                while let Some(chunk) = stream.next().await {
+                    rest.extend_from_slice(&chunk?);
+                }
+                Ok::<_, axum::Error>(rest)
+            });
+            let _ = done_tx.send(rest);
+        });
+        let rest =
+            tokio::task::spawn_blocking(move || done_rx.recv_timeout(Duration::from_secs(10)))
+                .await
+                .unwrap()
+                .expect("the stream stalled behind a writer holding the store");
+        got.extend(rest.unwrap());
+        assert_eq!(got, data);
+
+        let wrote = tokio::task::spawn_blocking(move || {
+            wrote_rx.recv_timeout(Duration::from_secs(10)).is_ok()
+        })
+        .await
+        .unwrap();
+        assert!(wrote, "the writer must get the lease once the stream ends");
+    }
+
+    /// With -hasSlowRead a writer gets the data-file lease between chunks; if
+    /// its failed append leaves the volume unavailable, the stream must stop.
+    #[tokio::test]
+    async fn test_streaming_body_stops_once_the_volume_becomes_unavailable() {
+        use futures::StreamExt;
+
+        const ID: u64 = 0x6e7a_0701;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let mut state = volume_test_state(&tmp);
+        Arc::get_mut(&mut state).unwrap().has_slow_read = true;
+        let data = multi_chunk_data();
+        let path = put_test_needle(&state, ID, &data);
+
+        let mut stream = open_read(&state, &path).await.into_data_stream();
+        let first = stream.next().await.unwrap().unwrap();
+        assert!(
+            first.len() < data.len(),
+            "the needle must span several frames"
+        );
+
+        {
+            let store = state.store.read().unwrap();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            vol.fail_next_fsync_for_test(true);
+            vol.fail_next_truncate_for_test(true);
+            let mut n = Needle {
+                id: NeedleId(ID + 1),
+                cookie: Cookie(TEST_COOKIE),
+                data: b"never-landed".to_vec(),
+                data_size: 12,
+                ..Needle::default()
+            };
+            store
+                .write_volume_needle(VolumeId(1), &mut n, true)
+                .unwrap_err();
+            let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+            vol.fail_next_fsync_for_test(false);
+            vol.fail_next_truncate_for_test(false);
+            assert!(vol.unavailable_error().is_some());
+        }
+
+        match stream.next().await {
+            Some(Err(err)) => assert!(
+                err.to_string().contains("volume is unavailable"),
+                "unexpected stream error: {err}"
+            ),
+            other => panic!(
+                "the stream kept reading an unavailable volume: {:?}",
+                other.map(|chunk| chunk.map(|c| c.len()))
+            ),
+        }
+    }
+
+    /// A leased stream blocks the compaction commit instead of racing the
+    /// file swap, and still delivers the needle's bytes; the commit goes
+    /// through once the stream releases its read lease.
+    #[cfg(unix)]
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn test_streaming_body_survives_a_vacuum_that_moves_the_needle() {
+        use futures::StreamExt;
+
+        const FILLER: u64 = 0x6e7a_0601;
+        const ID: u64 = 0x6e7a_0602;
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        put_test_needle(&state, FILLER, &[7u8; 4096]);
+        let data = multi_chunk_data();
+        let path = put_test_needle(&state, ID, &data);
+        let mut filler = Needle {
+            id: NeedleId(FILLER),
+            cookie: Cookie(TEST_COOKIE),
+            ..Needle::default()
+        };
+        state
+            .store
+            .write()
+            .unwrap()
+            .delete_volume_needle(VolumeId(1), &mut filler)
+            .unwrap();
+        let data_offset = || {
+            let mut plan = state
+                .store
+                .read()
+                .unwrap()
+                .needle_read_plan(VolumeId(1), NeedleId(ID), false)
+                .unwrap();
+            let mut n = Needle::default();
+            plan.read_meta(&mut n).unwrap();
+            plan.into_stream_info(&n).data_file_offset
+        };
+        let before = data_offset();
+
+        let mut stream = open_read(&state, &path).await.into_data_stream();
+        let mut got = stream.next().await.unwrap().unwrap().to_vec();
+        assert!(
+            got.len() < data.len(),
+            "the needle must span several frames"
+        );
+        {
+            let mut store = state.store.write().unwrap();
+            store.compact_volume(VolumeId(1), 0, 0, |_| true).unwrap();
+            let err = store.commit_compact_volume(VolumeId(1)).unwrap_err();
+            assert!(
+                err.to_string()
+                    .contains(crate::storage::volume::COMMIT_WAITS_FOR_READS),
+                "the leased stream must hold the commit back: {err}"
+            );
+        }
+
+        while let Some(chunk) = stream.next().await {
+            got.extend_from_slice(&chunk.expect("the stream failed across a vacuum"));
+        }
+        assert_eq!(got, data);
+        drop(stream);
+
+        {
+            let mut store = state.store.write().unwrap();
+            store.commit_compact_volume(VolumeId(1)).unwrap();
+        }
+        assert_ne!(
+            data_offset(),
+            before,
+            "the vacuum moves the needle once the stream drains"
+        );
+    }
+
+    /// Issue #801: an fsync upload takes the per-volume worker so its sync is
+    /// shared across the batch (Go's `writeNeedle2` split); a non-fsync write,
+    /// or an fsync write landing while the server is stopping, takes the
+    /// synchronous path instead.
+    #[tokio::test]
+    async fn test_write_upload_needle_routes_fsync_to_queue() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let state = volume_test_state(&tmp);
+        assert!(
+            state
+                .write_queue
+                .set(crate::server::write_queue::WriteQueue::new(
+                    state.clone(),
+                    128,
+                    crate::server::write_queue::SyncBatchOption::default(),
+                ))
+                .is_ok()
+        );
+        let queue = state.write_queue.get().unwrap();
+
+        let needle = |id: u64| {
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(TEST_COOKIE),
+                data: vec![id as u8; 8],
+                data_size: 8,
+                ..Needle::default()
+            };
+            n.checksum = CRC::new(&n.data);
+            n
+        };
+
+        write_upload_needle(&state, VolumeId(1), needle(0x6e7a_0b01), true)
+            .await
+            .unwrap();
+        assert_eq!(queue.submits_for_test(), 1);
+
+        write_upload_needle(&state, VolumeId(1), needle(0x6e7a_0b02), false)
+            .await
+            .unwrap();
+        assert_eq!(queue.submits_for_test(), 1);
+
+        *state.is_stopping.write().unwrap() = true;
+        write_upload_needle(&state, VolumeId(1), needle(0x6e7a_0b03), true)
+            .await
+            .unwrap();
+        assert_eq!(queue.submits_for_test(), 1);
+    }
 }
diff --git a/seaweed-volume/src/server/heartbeat.rs b/seaweed-volume/src/server/heartbeat.rs
index 3af2adb428..9d56440a75 100644
--- a/seaweed-volume/src/server/heartbeat.rs
+++ b/seaweed-volume/src/server/heartbeat.rs
@@ -5,28 +5,29 @@
 
 use std::collections::HashMap;
 use std::path::Path;
-use std::sync::atomic::Ordering;
 use std::sync::Arc;
+use std::sync::atomic::Ordering;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use tokio::sync::broadcast;
 use tracing::{error, info, warn};
 
-use super::grpc_client::{build_grpc_endpoint, GRPC_MAX_MESSAGE_SIZE};
+use super::grpc_client::{GrpcDialOptions, connect_channel, master_client};
 use super::volume_server::VolumeServerState;
 use crate::pb::master_pb;
-use crate::pb::master_pb::seaweed_client::SeaweedClient;
 use crate::pb::volume_server_pb;
 use crate::remote_storage::s3_tier::{S3TierBackend, S3TierConfig};
 use crate::storage::store::Store;
+use crate::storage::types::{NeedleId, VolumeId};
 use crate::storage::volume_report::VolumeReportKey;
 use crate::storage::volume_report_hash::report_hash;
-use crate::storage::types::NeedleId;
 
 const DUPLICATE_UUID_RETRY_MESSAGE: &str = "duplicate UUIDs detected, retrying connection";
 const MAX_DUPLICATE_UUID_RETRIES: u32 = 3;
+const MAX_TTL_VOLUME_REMOVAL_DELAY: u32 = 10;
 
 /// Configuration for the heartbeat client.
+#[derive(Clone)]
 pub struct HeartbeatConfig {
     pub ip: String,
     pub port: u16,
@@ -92,8 +93,15 @@ pub async fn run_heartbeat_with_state(
                 SleepDuplicate(Duration),
                 SleepPulse,
             }
-            let action = match do_heartbeat(&config, &state, &grpc_addr, &target_addr, pulse, &mut shutdown_rx)
-                .await
+            let action = match do_heartbeat(
+                &config,
+                &state,
+                &grpc_addr,
+                &target_addr,
+                pulse,
+                &mut shutdown_rx,
+            )
+            .await
             {
                 Ok(Some(leader)) => {
                     info!("Master leader changed to {}", leader);
@@ -111,7 +119,9 @@ pub async fn run_heartbeat_with_state(
 
                     if err_msg.contains(DUPLICATE_UUID_RETRY_MESSAGE) {
                         if duplicate_retry_count >= MAX_DUPLICATE_UUID_RETRIES {
-                            error!("Shut down Volume Server due to persistent duplicate volume directories after 3 retries");
+                            error!(
+                                "Shut down Volume Server due to persistent duplicate volume directories after 3 retries"
+                            );
                             error!(
                                 "Please check if another volume server is using the same directory"
                             );
@@ -145,7 +155,11 @@ pub async fn run_heartbeat_with_state(
                 }
                 PostAction::SleepPulse => {
                     new_leader = None;
-                    tokio::time::sleep(pulse).await;
+                    // The lookup spends part of the retry delay rather than
+                    // adding to it.
+                    let retry_at = tokio::time::Instant::now() + pulse;
+                    refresh_leader_from_peers(&config, &state, pulse).await;
+                    tokio::time::sleep_until(retry_at).await;
                 }
             }
 
@@ -181,10 +195,10 @@ pub async fn run_heartbeat_with_state(
 pub fn to_grpc_address(master_addr: &str) -> String {
     if let Some((host, port_str)) = master_addr.rsplit_once(':') {
         // "host:port.grpcPort" — the part after the last '.' is the gRPC port.
-        if let Some((_, grpc_port)) = port_str.rsplit_once('.') {
-            if grpc_port.parse::<u16>().is_ok() {
-                return format!("{}:{}", host, grpc_port);
-            }
+        if let Some((_, grpc_port)) = port_str.rsplit_once('.')
+            && grpc_port.parse::<u16>().is_ok()
+        {
+            return format!("{}:{}", host, grpc_port);
         }
         if let Ok(port) = port_str.parse::<u16>() {
             let grpc_port = port + 10000;
@@ -212,7 +226,7 @@ async fn check_with_master(config: &HeartbeatConfig, state: &Arc<VolumeServerSta
                     if changed {
                         state.metrics_notify.notify_waiters();
                     }
-                    apply_storage_backends(state, &resp.storage_backends);
+                    apply_storage_backends(&resp.storage_backends);
                     info!(
                         "Got master configuration from {}: metrics_address={}, metrics_interval={}s",
                         master_addr, resp.metrics_address, resp.metrics_interval_seconds
@@ -236,27 +250,64 @@ pub async fn try_get_master_configuration(
     grpc_addr: &str,
     tls: Option<&super::grpc_client::OutgoingGrpcTlsConfig>,
 ) -> Result<master_pb::GetMasterConfigurationResponse, Box<dyn std::error::Error>> {
-    let channel = build_grpc_endpoint(grpc_addr, tls)?
-        .connect_timeout(Duration::from_secs(5))
-        .timeout(Duration::from_secs(10))
-        .connect()
-        .await?;
-    let mut client = SeaweedClient::with_interceptor(
-        channel,
-        super::request_id::outgoing_request_id_interceptor,
-    )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    let channel = connect_channel(grpc_addr, tls, GrpcDialOptions::unary()).await?;
+    let mut client = master_client(channel);
     let resp = client
         .get_master_configuration(master_pb::GetMasterConfigurationRequest {})
         .await?;
     Ok(resp.into_inner())
 }
 
+/// Publish the leader the configured masters report, so lookups stop going
+/// to the master the heartbeat just lost while the loop retries. Without an
+/// answer inside `timeout` the published master is cleared: the lost master
+/// is dead or no longer leader, and a follower answers lookups from its own
+/// cache rather than refusing them. Mirrors Go's refreshLeaderFromPeers.
+async fn refresh_leader_from_peers(
+    config: &HeartbeatConfig,
+    state: &Arc<VolumeServerState>,
+    timeout: Duration,
+) {
+    let lookup = lookup_leader_from_peers(
+        &config.master_addresses,
+        state.outgoing_grpc_tls.as_ref(),
+    );
+    match tokio::time::timeout(timeout, lookup).await {
+        Ok(Some(leader)) => publish_current_master(state, &leader).await,
+        _ => state.current_master_url.write().await.clear(),
+    }
+}
+
+/// Ask each seed master for the raft leader and return the first answer, or
+/// None when none replies with one. Mirrors Go's
+/// `operation.LookupRaftLeaderMaster`.
+pub async fn lookup_leader_from_peers(
+    master_addrs: &[String],
+    tls: Option<&super::grpc_client::OutgoingGrpcTlsConfig>,
+) -> Option<String> {
+    for master_addr in master_addrs {
+        let grpc_addr = to_grpc_address(master_addr);
+        if let Ok(resp) = try_get_master_configuration(&grpc_addr, tls).await
+            && !resp.leader.is_empty()
+        {
+            return Some(resp.leader);
+        }
+    }
+    None
+}
+
 fn is_stopping(state: &VolumeServerState) -> bool {
     *state.is_stopping.read().unwrap()
 }
 
+/// Store the master lookups should go to, in the address form it was
+/// announced in — `host:port` or `host:port.grpcPort` — so an explicit gRPC
+/// port survives to the gRPC callers, mirroring Go's setCurrentMaster.
+/// The heartbeat calls this only for a master known to lead.
+async fn publish_current_master(state: &Arc<VolumeServerState>, master: &str) {
+    *state.current_master_url.write().await = master.to_string();
+}
+
 fn duplicate_uuid_retry_delay(retry_count: u32) -> Duration {
     Duration::from_secs((1u64 << retry_count) * 2)
 }
@@ -296,7 +347,7 @@ fn apply_master_volume_options(store: &Store, hb_resp: &master_pb::HeartbeatResp
         volume_opts_changed = true;
     }
 
-    volume_opts_changed && store.maybe_adjust_volume_max()
+    volume_opts_changed
 }
 
 type EcShardDeltaKey = (u32, String, u32, u32);
@@ -308,6 +359,10 @@ fn collect_ec_shard_delta_messages(
 
     for (disk_id, loc) in store.locations.iter().enumerate() {
         for (_, ec_vol) in loc.ec_volumes() {
+            let (_, _, quarantined) = ec_vol.get_io_error_state();
+            if quarantined {
+                continue;
+            }
             for shard in ec_vol.shards.iter().flatten() {
                 messages.insert(
                     (
@@ -368,6 +423,22 @@ fn diff_ec_shard_delta_messages(
     (new_ec_shards, deleted_ec_shards)
 }
 
+/// A volume heartbeat carries no shard list, only the expired shards it
+/// deleted, so that is all it may take out of the delta baseline.
+fn forget_reported_ec_deletions(
+    last_ec_shards: &mut HashMap<EcShardDeltaKey, master_pb::VolumeEcShardInformationMessage>,
+    heartbeat: &master_pb::Heartbeat,
+) {
+    last_ec_shards.retain(|(id, collection, disk_id, shard_id), _| {
+        !heartbeat.deleted_ec_shards.iter().any(|deleted| {
+            deleted.id == *id
+                && deleted.collection == *collection
+                && deleted.disk_id == *disk_id
+                && deleted.ec_index_bits & (1u32 << shard_id) != 0
+        })
+    });
+}
+
 /// Perform one heartbeat session with a master server.
 async fn do_heartbeat(
     config: &HeartbeatConfig,
@@ -377,53 +448,38 @@ async fn do_heartbeat(
     pulse: Duration,
     shutdown_rx: &mut broadcast::Receiver<()>,
 ) -> Result<Option<String>, Box<dyn std::error::Error>> {
-    let channel = build_grpc_endpoint(grpc_addr, state.outgoing_grpc_tls.as_ref())?
-        .connect_timeout(Duration::from_secs(5))
-        .timeout(Duration::from_secs(30))
-        .connect()
-        .await?;
-
-    let mut client = SeaweedClient::with_interceptor(
-        channel,
-        super::request_id::outgoing_request_id_interceptor,
+    let channel = connect_channel(
+        grpc_addr,
+        state.outgoing_grpc_tls.as_ref(),
+        GrpcDialOptions::long(),
     )
-    .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-    .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    .await?;
+
+    let mut client = master_client(channel);
 
     let (tx, rx) = tokio::sync::mpsc::channel::<master_pb::Heartbeat>(32);
 
-    // This master may know nothing about this server, and has not yet said
-    // whether it understands digests, so start from the whole list.
-    state.store.read().unwrap().volume_report.reset();
-
     // Keep track of what we sent, to generate delta updates
-    let (initial_hb, initial_volumes) = collect_heartbeat_with_snapshot(config, state);
-    let mut last_volumes: HashMap<u32, master_pb::VolumeInformationMessage> =
-        initial_volumes.iter().map(|v| (v.id, v.clone())).collect();
-    let mut last_ec_shards = {
-        let store = state.store.read().unwrap();
-        collect_ec_shard_delta_messages(&store)
-    };
+    let (initial_hb, initial_volumes) = off_runtime(config, state, |config, state| {
+        // This master may know nothing about this server, and has not yet said
+        // whether it understands digests, so start from the whole list.
+        state.store.read().unwrap().volume_report.reset();
+        collect_heartbeat_with_snapshot(config, state)
+    })
+    .await?;
+    let mut last_volumes: HashMap<u32, VolumeIdentity> = volume_identities(&initial_volumes);
 
     // Send initial heartbeats BEFORE calling send_heartbeat to avoid deadlock:
     // the server won't send response headers until it receives the first message,
     // but send_heartbeat().await waits for response headers.
     tx.send(initial_hb).await?;
-    tx.send(collect_ec_heartbeat(config, state)).await?;
+    let (initial_ec_hb, mut last_ec_shards) = ec_tick_pass(config, state).await?;
+    tx.send(initial_ec_hb).await?;
 
     let stream = tokio_stream::wrappers::ReceiverStream::new(rx);
     let mut response_stream = client.send_heartbeat(stream).await?.into_inner();
 
     info!("Heartbeat stream established with {}", grpc_addr);
-    // Publish the master we're now talking to in canonical http host:port
-    // form so Ping admission can recognise it once a leader change moves us
-    // off the seed list. Mirrors Go's vs.setCurrentMaster(masterAddress).
-    {
-        let normalised =
-            super::volume_server::to_http_address(current_master).into_owned();
-        let mut guard = state.current_master_url.write().await;
-        *guard = normalised;
-    }
     if is_stopping(state) {
         state.is_heartbeating.store(false, Ordering::Relaxed);
         send_deregister_heartbeat(config, state, &tx).await;
@@ -437,18 +493,37 @@ async fn do_heartbeat(
     volume_tick.tick().await;
     ec_tick.tick().await;
 
+    let mut confirmed_leader = false;
     loop {
         tokio::select! {
             resp = response_stream.message() => {
                 match resp {
                     Ok(Some(hb_resp)) => {
-                        // Match Go ordering: DuplicatedUuids first, then volume
-                        // options, then leader redirect.
+                        // A reply names the leader or comes from it, so it
+                        // settles where lookups go before anything else on the
+                        // reply is handled: a follower reply carries no other
+                        // fields, and a leader stays the lookup target even
+                        // when it rejects this registration. Mirrors Go.
+                        if !hb_resp.leader.is_empty() {
+                            if super::volume_server::to_http_address(current_master)
+                                != super::volume_server::to_http_address(&hb_resp.leader)
+                            {
+                                publish_current_master(state, &hb_resp.leader).await;
+                                return Ok(Some(hb_resp.leader));
+                            }
+                        } else if !confirmed_leader {
+                            // The leader answers every new stream without
+                            // naming a leader, so this peer is the one lookups
+                            // go to.
+                            confirmed_leader = true;
+                            publish_current_master(state, current_master).await;
+                        }
                         if !hb_resp.duplicated_uuids.is_empty() {
-                            let duplicate_dirs = {
-                                let store = state.store.read().unwrap();
-                                duplicate_directories(&store, &hb_resp.duplicated_uuids)
-                            };
+                            let uuids = hb_resp.duplicated_uuids.clone();
+                            let duplicate_dirs = off_runtime(config, state, move |_, state| {
+                                duplicate_directories(&state.store.read().unwrap(), &uuids)
+                            })
+                            .await?;
                             error!(
                                 "Master reported duplicate volume directories: {:?}",
                                 duplicate_dirs
@@ -459,19 +534,22 @@ async fn do_heartbeat(
                             )
                             .into());
                         }
-                        let changed = {
-                            let s = state.store.read().unwrap();
-                            apply_master_volume_options(&s, &hb_resp)
-                        };
-                        if changed {
+                        let echo_max_volume_id = hb_resp.max_volume_id;
+                        let echo_topology_id = hb_resp.topology_id.clone();
+                        off_runtime(config, state, move |_, state| {
+                            let store = state.store.read().unwrap();
+                            store.update_max_volume_id_seen(echo_max_volume_id);
+                            store.update_last_seen_topology_id(&echo_topology_id);
+                        })
+                        .await?;
+                        let options_changed =
+                            volume_options_pass(config, state, &hb_resp).await?;
+                        if options_changed && maybe_adjust_volume_max(config, state).await? {
                             let (adjusted_hb, adjusted_volumes) =
-                                collect_heartbeat_with_snapshot(config, state);
-                            last_volumes =
-                                adjusted_volumes.iter().map(|v| (v.id, v.clone())).collect();
-                            last_ec_shards = {
-                                let store = state.store.read().unwrap();
-                                collect_ec_shard_delta_messages(&store)
-                            };
+                                off_runtime(config, state, collect_heartbeat_with_snapshot)
+                                    .await?;
+                            last_volumes = volume_identities(&adjusted_volumes);
+                            forget_reported_ec_deletions(&mut last_ec_shards, &adjusted_hb);
                             if tx.send(adjusted_hb).await.is_err() {
                                 return Ok(None);
                             }
@@ -484,11 +562,6 @@ async fn do_heartbeat(
                         if metrics_changed {
                             state.metrics_notify.notify_waiters();
                         }
-                        // Match Go: only redirect if leader is non-empty AND
-                        // different from the current master we're connected to.
-                        if !hb_resp.leader.is_empty() && current_master != hb_resp.leader {
-                            return Ok(Some(hb_resp.leader));
-                        }
                     }
                     Ok(None) => return Ok(None),
                     Err(e) => return Err(Box::new(e)),
@@ -496,27 +569,19 @@ async fn do_heartbeat(
             }
 
             _ = volume_tick.tick() => {
-                {
-                    let s = state.store.read().unwrap();
-                    s.maybe_adjust_volume_max();
-                }
-                let (current_hb, current_volumes) = collect_heartbeat_with_snapshot(config, state);
-                last_volumes = current_volumes.iter().map(|v| (v.id, v.clone())).collect();
-                last_ec_shards = {
-                    let store = state.store.read().unwrap();
-                    collect_ec_shard_delta_messages(&store)
-                };
+                maybe_adjust_volume_max(config, state).await?;
+                let (current_hb, current_volumes) =
+                    off_runtime(config, state, collect_heartbeat_with_snapshot).await?;
+                last_volumes = volume_identities(&current_volumes);
+                forget_reported_ec_deletions(&mut last_ec_shards, &current_hb);
                 if tx.send(current_hb).await.is_err() {
                     return Ok(None);
                 }
             }
 
             _ = ec_tick.tick() => {
-                let current_ec_hb = collect_ec_heartbeat(config, state);
-                last_ec_shards = {
-                    let store = state.store.read().unwrap();
-                    collect_ec_shard_delta_messages(&store)
-                };
+                let (current_ec_hb, current_ec_shards) = ec_tick_pass(config, state).await?;
+                last_ec_shards = current_ec_shards;
                 if tx.send(current_ec_hb).await.is_err() {
                     return Ok(None);
                 }
@@ -529,41 +594,26 @@ async fn do_heartbeat(
                     info!("Heartbeat stopping");
                     return Ok(None);
                 }
-                let held_volumes = collect_volume_snapshot(config, state);
-                let current_volumes: HashMap<u32, _> = held_volumes.iter().map(|v| (v.id, v.clone())).collect();
-                let current_ec_shards = {
-                    let store = state.store.read().unwrap();
-                    collect_ec_shard_delta_messages(&store)
-                };
+                let (held_volumes, current_ec_shards) = notify_pass(config, state).await?;
+                let current_volumes = volume_identities(&held_volumes);
 
                 let mut new_vols = Vec::new();
                 let mut del_vols = Vec::new();
 
                 for (id, vol) in &current_volumes {
-                    if !last_volumes.contains_key(id) {
-                        new_vols.push(master_pb::VolumeShortInformationMessage {
-                            id: *id,
-                            collection: vol.collection.clone(),
-                            version: vol.version,
-                            replica_placement: vol.replica_placement,
-                            ttl: vol.ttl,
-                            disk_type: vol.disk_type.clone(),
-                            disk_id: vol.disk_id,
-                        });
+                    if let Some(previous) = last_volumes.get(id) {
+                        if previous != vol {
+                            del_vols.push(previous.to_short_message(*id));
+                            new_vols.push(vol.to_short_message(*id));
+                        }
+                    } else {
+                        new_vols.push(vol.to_short_message(*id));
                     }
                 }
 
                 for (id, vol) in &last_volumes {
                     if !current_volumes.contains_key(id) {
-                        del_vols.push(master_pb::VolumeShortInformationMessage {
-                            id: *id,
-                            collection: vol.collection.clone(),
-                            version: vol.version,
-                            replica_placement: vol.replica_placement,
-                            ttl: vol.ttl,
-                            disk_type: vol.disk_type.clone(),
-                            disk_id: vol.disk_id,
-                        });
+                        del_vols.push(vol.to_short_message(*id));
                     }
                 }
 
@@ -634,30 +684,41 @@ async fn send_deregister_heartbeat(
     state: &Arc<VolumeServerState>,
     tx: &tokio::sync::mpsc::Sender<master_pb::Heartbeat>,
 ) {
-    let empty = {
-        let store = state.store.read().unwrap();
-        // Deregister: no effective max computed, fall back to configured max.
-        let (location_uuids, disk_tags) = collect_location_metadata(&store, &[]);
-        master_pb::Heartbeat {
-            id: store.id.clone(),
-            ip: config.ip.clone(),
-            port: config.port as u32,
-            public_url: config.public_url.clone(),
-            max_file_key: 0,
-            data_center: config.data_center.clone(),
-            rack: config.rack.clone(),
-            has_no_volumes: true,
-            has_no_ec_shards: true,
-            grpc_port: config.grpc_port as u32,
-            location_uuids,
-            disk_tags,
-            ..Default::default()
+    let empty = match off_runtime(config, state, deregister_heartbeat).await {
+        Ok(empty) => empty,
+        Err(e) => {
+            warn!("Deregistration heartbeat not built: {}", e);
+            return;
         }
     };
     let _ = tx.send(empty).await;
     tokio::time::sleep(Duration::from_millis(200)).await;
 }
 
+fn deregister_heartbeat(
+    config: &HeartbeatConfig,
+    state: &Arc<VolumeServerState>,
+) -> master_pb::Heartbeat {
+    let store = state.store.read().unwrap();
+    // Deregister: no effective max computed, fall back to configured max.
+    let (location_uuids, disk_tags) = collect_location_metadata(&store, &[]);
+    master_pb::Heartbeat {
+        id: store.id.clone(),
+        ip: config.ip.clone(),
+        port: config.port as u32,
+        public_url: config.public_url.clone(),
+        max_file_key: 0,
+        data_center: config.data_center.clone(),
+        rack: config.rack.clone(),
+        has_no_volumes: true,
+        has_no_ec_shards: true,
+        grpc_port: config.grpc_port as u32,
+        location_uuids,
+        disk_tags,
+        ..Default::default()
+    }
+}
+
 fn apply_metrics_push_settings(
     state: &VolumeServerState,
     address: &str,
@@ -674,16 +735,15 @@ fn apply_metrics_push_settings(
     true
 }
 
-fn apply_storage_backends(
-    state: &VolumeServerState,
-    storage_backends: &[master_pb::StorageBackend],
-) {
+/// Registers the master's S3 storage backends in the process-wide tier
+/// registry, the single place both the tier-move handlers and `Volume` itself
+/// resolve a backend from.
+fn apply_storage_backends(storage_backends: &[master_pb::StorageBackend]) {
     if storage_backends.is_empty() {
         return;
     }
 
-    let mut registry = state.s3_tier_registry.write().unwrap();
-    let mut global_registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
+    let mut registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
         .write()
         .unwrap();
     for backend in storage_backends {
@@ -714,7 +774,6 @@ fn apply_storage_backends(
             backend.id.as_str()
         };
         register_s3_backend(&mut registry, backend, backend_id, &config);
-        register_s3_backend(&mut global_registry, backend, backend_id, &config);
     }
 }
 
@@ -744,20 +803,176 @@ fn parse_bool_property(value: Option<&String>) -> bool {
         .unwrap_or(true)
 }
 
+/// What a mount or unmount delta has to name, which is far less than the
+/// information message the heartbeat carries. A server holding millions of
+/// volumes cannot keep a whole message for each just to notice one leave; the
+/// Go report state keeps the same fields for the same reason.
+#[derive(Clone, PartialEq)]
+struct VolumeIdentity {
+    collection: String,
+    disk_type: String,
+    version: u32,
+    replica_placement: u32,
+    ttl: u32,
+    disk_id: u32,
+    read_only: bool,
+    read_only_can_delete: bool,
+}
+
+impl VolumeIdentity {
+    fn of(v: &master_pb::VolumeInformationMessage) -> Self {
+        Self {
+            collection: v.collection.clone(),
+            disk_type: v.disk_type.clone(),
+            version: v.version,
+            replica_placement: v.replica_placement,
+            ttl: v.ttl,
+            disk_id: v.disk_id,
+            read_only: v.read_only,
+            read_only_can_delete: v.read_only_can_delete,
+        }
+    }
+
+    fn to_short_message(&self, id: u32) -> master_pb::VolumeShortInformationMessage {
+        master_pb::VolumeShortInformationMessage {
+            id,
+            collection: self.collection.clone(),
+            version: self.version,
+            replica_placement: self.replica_placement,
+            ttl: self.ttl,
+            disk_type: self.disk_type.clone(),
+            disk_id: self.disk_id,
+            read_only: self.read_only,
+            read_only_can_delete: self.read_only_can_delete,
+        }
+    }
+}
+
+fn volume_identities(
+    volumes: &[master_pb::VolumeInformationMessage],
+) -> HashMap<u32, VolumeIdentity> {
+    volumes
+        .iter()
+        .map(|v| (v.id, VolumeIdentity::of(v)))
+        .collect()
+}
+
+/// Runs a store pass on the blocking pool, so waiting for the store lock
+/// parks no runtime worker.
+async fn off_runtime<T: Send + 'static>(
+    config: &HeartbeatConfig,
+    state: &Arc<VolumeServerState>,
+    pass: impl FnOnce(&HeartbeatConfig, &Arc<VolumeServerState>) -> T + Send + 'static,
+) -> Result<T, tokio::task::JoinError> {
+    let (config, state) = (config.clone(), state.clone());
+    tokio::task::spawn_blocking(move || pass(&config, &state)).await
+}
+
+/// Applies the master's volume options; whether they changed.
+async fn volume_options_pass(
+    config: &HeartbeatConfig,
+    state: &Arc<VolumeServerState>,
+    hb_resp: &master_pb::HeartbeatResponse,
+) -> Result<bool, tokio::task::JoinError> {
+    let hb_resp = hb_resp.clone();
+    off_runtime(config, state, move |_, state| {
+        apply_master_volume_options(&state.store.read().unwrap(), &hb_resp)
+    })
+    .await
+}
+
+/// The held volumes and EC shards a state notification is diffed from.
+async fn notify_pass(
+    config: &HeartbeatConfig,
+    state: &Arc<VolumeServerState>,
+) -> Result<
+    (
+        Vec<master_pb::VolumeInformationMessage>,
+        HashMap<EcShardDeltaKey, master_pb::VolumeEcShardInformationMessage>,
+    ),
+    tokio::task::JoinError,
+> {
+    off_runtime(config, state, |config, state| {
+        let volumes = collect_volume_snapshot(config, state);
+        #[cfg(test)]
+        {
+            let store_id = state.store.read().unwrap().id.clone();
+            read_phase_hook::park(read_phase_hook::Point::BeforeNotifyEcRead, &store_id);
+        }
+        let shards = collect_ec_shard_delta_messages(&state.store.read().unwrap());
+        (volumes, shards)
+    })
+    .await
+}
+
+/// Go's MaybeAdjustVolumeMax: statvfs on every auto-sized disk, a stat per
+/// writable volume.
+async fn maybe_adjust_volume_max(
+    config: &HeartbeatConfig,
+    state: &Arc<VolumeServerState>,
+) -> Result<bool, tokio::task::JoinError> {
+    off_runtime(config, state, |_, state| {
+        state.store.read().unwrap().maybe_adjust_volume_max()
+    })
+    .await
+}
+
+/// The EC heartbeat and the shard list later deltas are diffed against,
+/// under one guard so no mount lands between them unreported.
+async fn ec_tick_pass(
+    config: &HeartbeatConfig,
+    state: &Arc<VolumeServerState>,
+) -> Result<
+    (
+        master_pb::Heartbeat,
+        HashMap<EcShardDeltaKey, master_pb::VolumeEcShardInformationMessage>,
+    ),
+    tokio::task::JoinError,
+> {
+    off_runtime(config, state, |config, state| {
+        let store = state.store.read().unwrap();
+        (
+            collect_ec_heartbeat(config, &store),
+            collect_ec_shard_delta_messages(&store),
+        )
+    })
+    .await
+}
+
 /// Collect volume information into a Heartbeat message.
 fn collect_heartbeat_with_snapshot(
     config: &HeartbeatConfig,
     state: &Arc<VolumeServerState>,
-) -> (master_pb::Heartbeat, Vec<master_pb::VolumeInformationMessage>) {
-    let mut store = state.store.write().unwrap();
-    let (ec_shards, deleted_ec_shards) = store.delete_expired_ec_volumes();
-    build_heartbeat_with_ec_status(
-        config,
-        &mut store,
-        deleted_ec_shards,
-        ec_shards.is_empty(),
-        true,
-    )
+) -> (
+    master_pb::Heartbeat,
+    Vec<master_pb::VolumeInformationMessage>,
+) {
+    let (_, expired_ec) = state.store.read().unwrap().find_expired_ec_volumes();
+    let mut deleted_ec_shards = Vec::new();
+    if !expired_ec.is_empty() {
+        deleted_ec_shards = state
+            .store
+            .write()
+            .unwrap()
+            .remove_expired_ec_volumes(expired_ec)
+            .0;
+    }
+    #[cfg(test)]
+    {
+        let store_id = state.store.read().unwrap().id.clone();
+        read_phase_hook::park(read_phase_hook::Point::BeforeVolumePass, &store_id);
+    }
+    let (heartbeat, volumes, actions) = {
+        let store = state.store.read().unwrap();
+        #[cfg(test)]
+        read_phase_hook::park(read_phase_hook::Point::VolumePass, &store.id);
+        // Taken with the volume list: a shard mounted since the EC phase must
+        // not go out as "no EC shards", which clears it on the master.
+        let has_no_ec_shards = !has_reportable_ec_shards(&store);
+        build_heartbeat_with_ec_status(config, &store, deleted_ec_shards, has_no_ec_shards, true)
+    };
+    apply_volume_actions(state, actions);
+    (heartbeat, volumes)
 }
 
 /// Lists the volumes the server holds without touching reporting state or
@@ -767,10 +982,108 @@ fn collect_volume_snapshot(
     config: &HeartbeatConfig,
     state: &Arc<VolumeServerState>,
 ) -> Vec<master_pb::VolumeInformationMessage> {
-    let mut store = state.store.write().unwrap();
-    build_heartbeat_with_ec_status(config, &mut store, Vec::new(), true, false).1
+    let (_, volumes, actions) = build_heartbeat_with_ec_status(
+        config,
+        &state.store.read().unwrap(),
+        Vec::new(),
+        true,
+        false,
+    );
+    apply_volume_actions(state, actions);
+    volumes
 }
 
+/// Store changes a heartbeat pass decides on under the read lock, applied
+/// under a short write lock afterwards. Entries are (disk index, volume id).
+#[derive(Default)]
+struct VolumeActions {
+    delete_expired: Vec<(usize, VolumeId)>,
+    quarantine: Vec<(usize, VolumeId)>,
+}
+
+fn apply_volume_actions(state: &VolumeServerState, actions: VolumeActions) {
+    if actions.delete_expired.is_empty() && actions.quarantine.is_empty() {
+        return;
+    }
+    apply_volume_actions_to(&mut state.store.write().unwrap(), actions);
+}
+
+/// Each target is re-checked: it may have been written to, replaced or removed
+/// since the read pass chose it.
+fn apply_volume_actions_to(store: &mut Store, actions: VolumeActions) {
+    let volume_size_limit = store.volume_size_limit.load(Ordering::Relaxed);
+    for (disk_id, vid) in actions.delete_expired {
+        let Some(loc) = store.locations.get_mut(disk_id) else {
+            continue;
+        };
+        let still_expired = loc.find_volume(vid).is_some_and(|vol| {
+            !vol.should_quarantine()
+                && vol.is_expired(vol.dat_file_size().unwrap_or(0), volume_size_limit)
+                && vol.is_expired_long_enough(MAX_TTL_VOLUME_REMOVAL_DELAY)
+        });
+        if still_expired {
+            let _ = loc.delete_volume(vid, false, false, false);
+        }
+    }
+    for (disk_id, vid) in actions.quarantine {
+        if let Some(vol) = store
+            .locations
+            .get_mut(disk_id)
+            .and_then(|loc| loc.find_volume(vid))
+            && vol.should_quarantine()
+        {
+            vol.set_no_write_or_delete(true);
+        }
+    }
+}
+
+#[cfg(test)]
+mod read_phase_hook {
+    use std::sync::Mutex;
+    use std::sync::mpsc::Receiver;
+    use tokio::sync::oneshot::Sender;
+
+    #[derive(Clone, Copy, PartialEq)]
+    pub(super) enum Point {
+        /// Between the EC phase and the volume pass, holding no lock.
+        BeforeVolumePass,
+        /// Inside the volume pass, holding the store read lock.
+        VolumePass,
+        /// Between the notify branch's volume snapshot and its EC read.
+        BeforeNotifyEcRead,
+    }
+
+    type Park = (Point, String, Sender<()>, Receiver<()>);
+    static ARMED: Mutex<Vec<Park>> = Mutex::new(Vec::new());
+
+    /// Parks the next pass over the store with this id at `point`, announcing
+    /// itself on `entered` and waiting until `release` is dropped.
+    pub(super) fn arm(point: Point, store_id: &str, entered: Sender<()>, release: Receiver<()>) {
+        ARMED
+            .lock()
+            .unwrap()
+            .push((point, store_id.to_string(), entered, release));
+    }
+
+    pub(super) fn park(point: Point, store_id: &str) {
+        let armed = {
+            let mut armed = ARMED.lock().unwrap();
+            armed
+                .iter()
+                .position(|(p, id, _, _)| *p == point && !id.is_empty() && id == store_id)
+                .map(|i| armed.swap_remove(i))
+        };
+        if let Some((_, _, entered, release)) = armed {
+            let _ = entered.send(());
+            let _ = release.recv();
+        }
+    }
+}
+
+/// The heartbeat alone, without the volume snapshot the send loop pairs it
+/// with. Only the tests want it that way; the loop calls
+/// collect_heartbeat_with_snapshot directly.
+#[cfg(test)]
 fn collect_heartbeat(
     config: &HeartbeatConfig,
     state: &Arc<VolumeServerState>,
@@ -807,24 +1120,42 @@ fn collect_location_metadata(
     (location_uuids, disk_tags)
 }
 
+/// Whether a heartbeat would report any EC shard: Go's non-empty
+/// `ecVolumeMessages` from `deleteExpiredEcVolumes`.
+fn has_reportable_ec_shards(store: &Store) -> bool {
+    store.locations.iter().any(|loc| {
+        loc.ec_volumes().any(|(_, ec_vol)| {
+            !ec_vol.is_time_to_destroy()
+                && !ec_vol.should_quarantine()
+                && ec_vol.shards.iter().any(Option::is_some)
+        })
+    })
+}
+
 #[cfg(test)]
 fn build_heartbeat(config: &HeartbeatConfig, store: &mut Store) -> master_pb::Heartbeat {
     let has_no_ec_shards = collect_live_ec_shards(store, false).is_empty();
-    build_heartbeat_with_ec_status(config, store, Vec::new(), has_no_ec_shards, true).0
+    let (heartbeat, _, actions) =
+        build_heartbeat_with_ec_status(config, store, Vec::new(), has_no_ec_shards, true);
+    apply_volume_actions_to(store, actions);
+    heartbeat
 }
 
-/// Returns the heartbeat to send and, separately, every volume held. The
-/// caller derives mount and unmount deltas by diffing successive snapshots, so
-/// it must not be handed the partial list a heartbeat may carry.
+/// Returns the heartbeat to send, every volume held, and the store changes
+/// the pass decided on. The caller derives mount and unmount deltas by diffing
+/// successive snapshots, so it must not be handed the partial list a heartbeat
+/// may carry.
 fn build_heartbeat_with_ec_status(
     config: &HeartbeatConfig,
-    store: &mut Store,
+    store: &Store,
     deleted_ec_shards: Vec<master_pb::VolumeEcShardInformationMessage>,
     has_no_ec_shards: bool,
     commit_report: bool,
-) -> (master_pb::Heartbeat, Vec<master_pb::VolumeInformationMessage>) {
-    const MAX_TTL_VOLUME_REMOVAL_DELAY: u32 = 10;
-
+) -> (
+    master_pb::Heartbeat,
+    Vec<master_pb::VolumeInformationMessage>,
+    VolumeActions,
+) {
     #[derive(Default)]
     struct ReadOnlyCounts {
         is_read_only: u32,
@@ -838,8 +1169,8 @@ fn build_heartbeat_with_ec_status(
     // master can tell whether applying what it was sent leaves it current.
     // Volumes skipped below -- quarantined, phantom, expired -- are in neither.
     let mut volume_digest: u64 = 0;
-    let (send_full_list, report_generation) = store.volume_report.begin();
-    let mut reported_hashes: HashMap<VolumeReportKey, u64> = HashMap::new();
+    let mut quarantined_volumes: u32 = 0;
+    let (send_full_list, report_generation, report_pass) = store.volume_report.begin();
     let mut changed_volumes = Vec::new();
     let mut max_file_key = NeedleId(0);
     let mut max_volume_counts: HashMap<String, u32> = HashMap::new();
@@ -854,16 +1185,16 @@ fn build_heartbeat_with_ec_status(
 
     // Per-disk effective max for DiskTag, captured alongside the per-type sum.
     let mut disk_max_by_id = vec![0i32; store.locations.len()];
+    let mut actions = VolumeActions::default();
 
-    for (disk_id, loc) in store.locations.iter_mut().enumerate() {
+    for (disk_id, loc) in store.locations.iter().enumerate() {
         let disk_type_str = loc.disk_type.to_string();
         let mut effective_max_count = loc.max_volume_count.load(Ordering::Relaxed);
         if loc.is_disk_space_low.load(Ordering::Relaxed) {
             let used_slots = loc.volumes_len() as i32
-                + ((loc.ec_shard_count()
-                    + crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT
-                    - 1)
-                    / crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT)
+                + loc
+                    .ec_shard_count()
+                    .div_ceil(crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT)
                     as i32;
             effective_max_count = used_slots;
         }
@@ -880,7 +1211,6 @@ fn build_heartbeat_with_ec_status(
         *disk_free_bytes.entry(disk_type_str).or_insert(0) +=
             loc.disk_free_bytes.load(Ordering::Relaxed);
 
-        let mut delete_vids = Vec::new();
         for (_, vol) in loc.iter_volumes() {
             let cur_max = vol.max_file_key();
             if cur_max > max_file_key {
@@ -890,9 +1220,18 @@ fn build_heartbeat_with_ec_status(
             let volume_size = vol.dat_file_size().unwrap_or(0);
             let mut should_delete_volume = false;
 
-            if vol.last_io_error().is_some() {
-                delete_vids.push(vol.id);
-                should_delete_volume = true;
+            if vol.should_quarantine() {
+                let (_, io_count, io_quarantined) = vol.get_io_error_state();
+                if !io_quarantined {
+                    vol.mark_io_quarantined();
+                    warn!(
+                        "Volume {} quarantined after {} consecutive IO errors",
+                        vol.id.0, io_count
+                    );
+                }
+                quarantined_volumes += 1;
+                actions.quarantine.push((disk_id, vol.id));
+                continue;
             } else if !vol.is_expired(volume_size, volume_size_limit) {
                 // Detect phantom volumes: the .dat was unlinked from disk but is still
                 // held open as a deleted FD, so the volume keeps serving and heartbeating
@@ -900,15 +1239,21 @@ fn build_heartbeat_with_ec_status(
                 // whose .dat legitimately lives in cloud storage. Only a present .dat is
                 // cached for 30s; a missing one is re-checked every heartbeat so the volume
                 // stays suppressed until the file returns. See issues/10004
-                if vol.file_count() > 0 && !vol.has_remote_file {
+                if vol.file_count() > 0 && !vol.has_remote_file() {
                     const DISK_CHECK_INTERVAL_NS: i64 = 30 * 1_000_000_000;
                     let now_ns = SystemTime::now()
                         .duration_since(UNIX_EPOCH)
                         .unwrap_or(Duration::ZERO)
                         .as_nanos() as i64;
-                    if now_ns - vol.last_disk_check_ns.load(Ordering::Relaxed) > DISK_CHECK_INTERVAL_NS {
+                    if now_ns - vol.last_disk_check_ns.load(Ordering::Relaxed)
+                        > DISK_CHECK_INTERVAL_NS
+                    {
                         if !Path::new(&vol.file_name(".dat")).exists() {
-                            warn!("Volume {}: data file {} missing (held open as deleted FD) - not reporting to master", vol.id.0, vol.file_name(".dat"));
+                            warn!(
+                                "Volume {}: data file {} missing (held open as deleted FD) - not reporting to master",
+                                vol.id.0,
+                                vol.file_name(".dat")
+                            );
                             continue;
                         }
                         vol.last_disk_check_ns.store(now_ns, Ordering::Relaxed);
@@ -924,11 +1269,15 @@ fn build_heartbeat_with_ec_status(
                     delete_count: vol.deleted_count() as u64,
                     deleted_byte_count: vol.deleted_size(),
                     read_only: vol.is_read_only(),
-                    replica_placement: vol.super_block.replica_placement.to_byte() as u32,
-                    version: vol.super_block.version.0 as u32,
-                    ttl: vol.super_block.ttl.to_u32(),
-                    compact_revision: vol.super_block.compaction_revision as u32,
-                    modified_at_second: vol.last_modified_ts() as i64,
+                    read_only_can_delete: vol.is_no_write_can_delete(),
+                    replica_placement: vol.super_block().replica_placement.to_byte() as u32,
+                    version: vol.super_block().version.0 as u32,
+                    ttl: vol.super_block().ttl.to_u32(),
+                    compact_revision: vol.super_block().compaction_revision as u32,
+                    // The .dat mtime, as Go reports: the shell's quiet-period
+                    // gates read this as "last touched", which a delete has to
+                    // count towards even though the TTL clock ignores it.
+                    modified_at_second: vol.dat_file_mod_time() as i64,
                     disk_type: loc.disk_type.to_string(),
                     disk_id: disk_id as u32,
                     remote_storage_name,
@@ -937,41 +1286,48 @@ fn build_heartbeat_with_ec_status(
                 let hash = report_hash(&volume_message);
                 volume_digest ^= hash;
                 let key: VolumeReportKey = (volume_message.disk_id, volume_message.id);
-                reported_hashes.insert(key, hash);
-                if send_full_list || store.volume_report.changed(key, hash) {
+                // A snapshot must leave the reporting state as it found it, so
+                // it asks rather than marks.
+                let is_news = if commit_report {
+                    store.volume_report.record(key, hash, report_pass)
+                } else {
+                    store.volume_report.changed(key, hash)
+                };
+                if send_full_list || is_news {
                     changed_volumes.push(volume_message.clone());
                 }
                 volumes.push(volume_message);
             } else if vol.is_expired_long_enough(MAX_TTL_VOLUME_REMOVAL_DELAY) {
-                delete_vids.push(vol.id);
+                actions.delete_expired.push((disk_id, vol.id));
                 should_delete_volume = true;
             }
 
-            // Track disk size by collection
-            let entry = disk_sizes.entry(vol.collection.clone()).or_insert((0, 0));
+            // Track disk size by collection. A volume on its way out is left
+            // out: an entry here is also what says the collection is still on
+            // this server.
             if !should_delete_volume {
+                let entry = disk_sizes.entry(vol.collection.clone()).or_insert((0, 0));
                 entry.0 += volume_size;
                 entry.1 += vol.deleted_size();
             }
 
-            let read_only = ro_counts.entry(vol.collection.clone()).or_default();
-            if !should_delete_volume && vol.is_read_only() {
-                read_only.is_read_only += 1;
-                if vol.is_no_write_or_delete() {
-                    read_only.no_write_or_delete += 1;
-                }
-                if vol.is_no_write_can_delete() {
-                    read_only.no_write_can_delete += 1;
-                }
-                if loc.is_disk_space_low.load(Ordering::Relaxed) {
-                    read_only.is_disk_space_low += 1;
+            // An entry here is what says the collection is still on this
+            // server, so a volume on its way out must not make one.
+            if !should_delete_volume {
+                let read_only = ro_counts.entry(vol.collection.clone()).or_default();
+                if vol.is_read_only() {
+                    read_only.is_read_only += 1;
+                    if vol.is_no_write_or_delete() {
+                        read_only.no_write_or_delete += 1;
+                    }
+                    if vol.is_no_write_can_delete() {
+                        read_only.no_write_can_delete += 1;
+                    }
+                    if loc.is_disk_space_low.load(Ordering::Relaxed) {
+                        read_only.is_disk_space_low += 1;
+                    }
                 }
             }
-
-        }
-
-        for vid in delete_vids {
-            let _ = loc.delete_volume(vid, false, false);
         }
     }
 
@@ -998,6 +1354,17 @@ fn build_heartbeat_with_ec_status(
             .with_label_values(&[col, crate::metrics::READ_ONLY_LABEL_IS_DISK_SPACE_LOW])
             .set(counts.is_disk_space_low as f64);
     }
+    // ro_counts has an entry for every collection that kept a volume through
+    // this pass, including the ones counting zero read-only volumes.
+    {
+        let mut reported = store.reported_collections.lock().unwrap();
+        for col in reported.iter() {
+            if !ro_counts.contains_key(col) {
+                crate::metrics::delete_volume_server_collection_metrics(col);
+            }
+        }
+        *reported = ro_counts.keys().cloned().collect();
+    }
     // Update max volumes gauge
     let total_max: i64 = max_volume_counts.values().map(|v| *v as i64).sum();
     crate::metrics::MAX_VOLUMES.set(total_max);
@@ -1005,7 +1372,7 @@ fn build_heartbeat_with_ec_status(
     // Only when this heartbeat is going to be sent: marking volumes reported
     // and then discarding the message would leave the master never told.
     if commit_report {
-        store.volume_report.commit(reported_hashes, report_generation);
+        store.volume_report.commit(report_pass, report_generation);
     }
 
     // has_no_volumes says the server holds nothing, so it may only be derived
@@ -1018,6 +1385,23 @@ fn build_heartbeat_with_ec_status(
     };
     let (location_uuids, disk_tags) = collect_location_metadata(store, &disk_max_by_id);
 
+    let mut quarantined_ec_shards: u32 = 0;
+    for loc in &store.locations {
+        for (_, ec_vol) in loc.ec_volumes() {
+            let (_, _, quarantined) = ec_vol.get_io_error_state();
+            if quarantined {
+                quarantined_ec_shards += ec_vol.shard_count() as u32;
+            }
+        }
+    }
+
+    crate::metrics::IO_QUARANTINE_GAUGE
+        .with_label_values(&["volume"])
+        .set(quarantined_volumes as i64);
+    crate::metrics::IO_QUARANTINE_GAUGE
+        .with_label_values(&["ec_shard"])
+        .set(quarantined_ec_shards as i64);
+
     let heartbeat = master_pb::Heartbeat {
         id: store.id.clone(),
         ip: config.ip.clone(),
@@ -1039,9 +1423,11 @@ fn build_heartbeat_with_ec_status(
         grpc_port: config.grpc_port as u32,
         location_uuids,
         disk_tags,
+        max_volume_id_seen: store.max_volume_id_seen(),
+        last_seen_topology_id: store.last_seen_topology_id(),
         ..Default::default()
     };
-    (heartbeat, volumes)
+    (heartbeat, volumes, actions)
 }
 
 fn collect_live_ec_shards(
@@ -1053,6 +1439,10 @@ fn collect_live_ec_shards(
 
     for (disk_id, loc) in store.locations.iter().enumerate() {
         for (_, ec_vol) in loc.ec_volumes() {
+            let (_, _, quarantined) = ec_vol.get_io_error_state();
+            if quarantined {
+                continue;
+            }
             for message in ec_vol.to_volume_ec_shard_information_messages(disk_id as u32) {
                 if update_metrics {
                     let total_size: u64 = message
@@ -1073,15 +1463,22 @@ fn collect_live_ec_shards(
                 .with_label_values(&[col, crate::metrics::DISK_SIZE_LABEL_EC])
                 .set(*size as f64);
         }
+        let mut reported = store.reported_ec_collections.lock().unwrap();
+        for col in reported.iter() {
+            if !ec_sizes.contains_key(col) {
+                let _ = crate::metrics::DISK_SIZE_GAUGE
+                    .remove_label_values(&[col, crate::metrics::DISK_SIZE_LABEL_EC]);
+            }
+        }
+        *reported = ec_sizes.keys().cloned().collect();
     }
 
     ec_shards
 }
 
 /// Collect EC shard information into a Heartbeat message.
-fn collect_ec_heartbeat(config: &HeartbeatConfig, state: &Arc<VolumeServerState>) -> master_pb::Heartbeat {
-    let store = state.store.read().unwrap();
-    let ec_shards = collect_live_ec_shards(&store, true);
+fn collect_ec_heartbeat(config: &HeartbeatConfig, store: &Store) -> master_pb::Heartbeat {
+    let ec_shards = collect_live_ec_shards(store, true);
 
     let has_no = ec_shards.is_empty();
     master_pb::Heartbeat {
@@ -1102,17 +1499,17 @@ mod tests {
     use crate::config::MinFreeSpace;
     use crate::config::ReadMode;
     use crate::metrics::{
-        DISK_SIZE_GAUGE, DISK_SIZE_LABEL_DELETED_BYTES, DISK_SIZE_LABEL_EC,
-        DISK_SIZE_LABEL_NORMAL, READ_ONLY_LABEL_IS_DISK_SPACE_LOW,
-        READ_ONLY_LABEL_IS_READ_ONLY, READ_ONLY_LABEL_NO_WRITE_CAN_DELETE,
-        READ_ONLY_LABEL_NO_WRITE_OR_DELETE, READ_ONLY_VOLUME_GAUGE,
+        DISK_SIZE_GAUGE, DISK_SIZE_LABEL_DELETED_BYTES, DISK_SIZE_LABEL_EC, DISK_SIZE_LABEL_NORMAL,
+        READ_ONLY_LABEL_IS_DISK_SPACE_LOW, READ_ONLY_LABEL_IS_READ_ONLY,
+        READ_ONLY_LABEL_NO_WRITE_CAN_DELETE, READ_ONLY_LABEL_NO_WRITE_OR_DELETE,
+        READ_ONLY_VOLUME_GAUGE,
     };
-    use crate::remote_storage::s3_tier::S3TierRegistry;
     use crate::security::{Guard, SigningKey};
     use crate::storage::needle_map::NeedleMapKind;
-    use crate::storage::types::{DiskType, Version, VolumeId};
-    use std::sync::atomic::Ordering;
+    use crate::storage::types::{DiskType, VolumeId};
+    use crate::storage::volume::VolumeSpec;
     use std::sync::RwLock;
+    use std::sync::atomic::Ordering;
     use std::time::{SystemTime, UNIX_EPOCH};
 
     fn test_config() -> HeartbeatConfig {
@@ -1153,12 +1550,13 @@ mod tests {
             rack: String::new(),
             file_size_limit_bytes: 0,
             maintenance_byte_per_second: 0,
+            vacuum_commit_slots: None,
+            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
             is_heartbeating: std::sync::atomic::AtomicBool::new(false),
             has_master: true,
             pre_stop_seconds: 0,
             volume_state_notify: tokio::sync::Notify::new(),
             write_queue: std::sync::OnceLock::new(),
-            s3_tier_registry: std::sync::RwLock::new(S3TierRegistry::new()),
             read_mode: ReadMode::Local,
             allow_untrusted_remote_endpoints: false,
             master_url: String::new(),
@@ -1177,6 +1575,9 @@ mod tests {
             security_file: String::new(),
             cli_white_list: vec![],
             state_file_path: String::new(),
+            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail_notify: tokio::sync::Notify::new(),
         })
     }
 
@@ -1190,7 +1591,10 @@ mod tests {
     fn test_to_grpc_address_explicit_grpc_port() {
         // host:port.grpcPort form — gRPC port is what's after the dot.
         assert_eq!(to_grpc_address("10.85.183.6:5300.6300"), "10.85.183.6:6300");
-        assert_eq!(to_grpc_address("master.local:9333.19333"), "master.local:19333");
+        assert_eq!(
+            to_grpc_address("master.local:9333.19333"),
+            "master.local:19333"
+        );
     }
 
     #[test]
@@ -1220,12 +1624,11 @@ mod tests {
         store
             .add_volume(
                 VolumeId(7),
-                "pics",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "pics",
+                    ..Default::default()
+                },
             )
             .unwrap();
 
@@ -1244,7 +1647,10 @@ mod tests {
             heartbeat.disk_tags[0].tags,
             vec!["fast".to_string(), "ssd".to_string()]
         );
-        assert_eq!(heartbeat.disk_tags[0].r#type, DiskType::HardDrive.to_string());
+        assert_eq!(
+            heartbeat.disk_tags[0].r#type,
+            DiskType::HardDrive.to_string()
+        );
         assert_eq!(heartbeat.disk_tags[0].max_volume_count, 3);
     }
 
@@ -1267,12 +1673,11 @@ mod tests {
         store
             .add_volume(
                 VolumeId(7),
-                "pics",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "pics",
+                    ..Default::default()
+                },
             )
             .unwrap();
 
@@ -1283,7 +1688,10 @@ mod tests {
 
         let heartbeat = build_heartbeat(&test_config(), &mut store);
         assert_eq!(heartbeat.disk_tags[0].max_volume_count, 1);
-        assert_eq!(heartbeat.max_volume_counts[&DiskType::HardDrive.to_string()], 1);
+        assert_eq!(
+            heartbeat.max_volume_counts[&DiskType::HardDrive.to_string()],
+            1
+        );
     }
 
     #[test]
@@ -1330,12 +1738,11 @@ mod tests {
             store
                 .add_volume(
                     VolumeId(id),
-                    "pics",
-                    None,
-                    None,
-                    0,
                     DiskType::HardDrive,
-                    Version::current(),
+                    &VolumeSpec {
+                        collection: "pics",
+                        ..Default::default()
+                    },
                 )
                 .unwrap();
         }
@@ -1384,12 +1791,11 @@ mod tests {
         store
             .add_volume(
                 VolumeId(3),
-                "pics",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "pics",
+                    ..Default::default()
+                },
             )
             .unwrap();
 
@@ -1424,10 +1830,10 @@ mod tests {
         store.volume_report.accept_deltas();
         build_heartbeat(&test_config(), &mut store);
 
-        let (full, generation) = store.volume_report.begin();
+        let (full, generation, pass) = store.volume_report.begin();
         assert!(!full);
         store.volume_report.request_full_list();
-        store.volume_report.commit(HashMap::new(), generation);
+        store.volume_report.commit(pass, generation);
 
         let heartbeat = build_heartbeat(&test_config(), &mut store);
         assert_eq!(heartbeat.volumes.len(), 2);
@@ -1445,18 +1851,17 @@ mod tests {
         store
             .add_volume(
                 VolumeId(3),
-                "pics",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "pics",
+                    ..Default::default()
+                },
             )
             .unwrap();
 
         // What the notify path does: collect a snapshot, send a message of its own.
         let snapshot =
-            build_heartbeat_with_ec_status(&test_config(), &mut store, Vec::new(), true, false).1;
+            build_heartbeat_with_ec_status(&test_config(), &store, Vec::new(), true, false).1;
         assert_eq!(snapshot.len(), 3);
 
         let heartbeat = build_heartbeat(&test_config(), &mut store);
@@ -1488,12 +1893,11 @@ mod tests {
             store
                 .add_volume(
                     vid,
-                    "pics",
-                    None,
-                    None,
-                    0,
                     DiskType::HardDrive,
-                    Version::current(),
+                    &VolumeSpec {
+                        collection: "pics",
+                        ..Default::default()
+                    },
                 )
                 .unwrap();
         }
@@ -1501,10 +1905,9 @@ mod tests {
         let heartbeat = build_heartbeat(&test_config(), &mut store);
         assert_eq!(heartbeat.volumes.len(), 2);
 
-        let expected = heartbeat
-            .volumes
-            .iter()
-            .fold(0u64, |acc, m| acc ^ crate::storage::volume_report_hash::report_hash(m));
+        let expected = heartbeat.volumes.iter().fold(0u64, |acc, m| {
+            acc ^ crate::storage::volume_report_hash::report_hash(m)
+        });
         assert_eq!(heartbeat.volume_digest, Some(expected));
         assert_ne!(heartbeat.volume_digest, Some(0));
     }
@@ -1528,12 +1931,11 @@ mod tests {
         store
             .add_volume(
                 VolumeId(17),
-                "heartbeat_metrics_case",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "heartbeat_metrics_case",
+                    ..Default::default()
+                },
             )
             .unwrap();
         store.locations[0]
@@ -1541,10 +1943,11 @@ mod tests {
             .store(true, Ordering::Relaxed);
 
         {
-            let (_, volume) = store.find_volume_mut(VolumeId(17)).unwrap();
+            let (_, volume) = store.find_volume(VolumeId(17)).unwrap();
             volume.set_read_only().unwrap();
-            volume.volume_info.files.push(Default::default());
-            volume.refresh_remote_write_mode();
+            volume
+                .update_remote_files(|files| files.push(Default::default()))
+                .unwrap();
         }
 
         let heartbeat = build_heartbeat(&test_config(), &mut store);
@@ -1592,6 +1995,80 @@ mod tests {
         );
     }
 
+    fn collection_series(gauge: &prometheus::GaugeVec, collection: &str) -> usize {
+        use prometheus::core::Collector;
+        gauge
+            .collect()
+            .iter()
+            .flat_map(|family| family.get_metric().to_vec())
+            .filter(|metric| {
+                metric.get_label().iter().any(|label| {
+                    label.get_name() == "collection" && label.get_value() == collection
+                })
+            })
+            .count()
+    }
+
+    // The per-collection gauges are only ever set for collections the heartbeat
+    // still finds on this server. A volume.balance that moves a collection's
+    // last volume off a server used to leave its read-only count - marked
+    // read-only for the move, moments before it went - standing on that server
+    // until a restart, with nothing in volume.list to match it.
+    #[test]
+    fn test_build_heartbeat_clears_metrics_of_departed_collection() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+        let collection = "heartbeat_departed_case";
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                dir,
+                dir,
+                8,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+        store
+            .add_volume(
+                VolumeId(21),
+                DiskType::HardDrive,
+                &VolumeSpec {
+                    collection,
+                    ..Default::default()
+                },
+            )
+            .unwrap();
+        {
+            let (_, volume) = store.find_volume(VolumeId(21)).unwrap();
+            volume.set_read_only().unwrap();
+        }
+
+        build_heartbeat(&test_config(), &mut store);
+        assert_eq!(
+            READ_ONLY_VOLUME_GAUGE
+                .with_label_values(&[collection, READ_ONLY_LABEL_IS_READ_ONLY])
+                .get(),
+            1.0
+        );
+
+        assert!(store.unmount_volume(VolumeId(21)).unwrap());
+        build_heartbeat(&test_config(), &mut store);
+
+        assert_eq!(
+            collection_series(&READ_ONLY_VOLUME_GAUGE, collection),
+            0,
+            "read-only series left after the collection left the server"
+        );
+        assert_eq!(
+            collection_series(&DISK_SIZE_GAUGE, collection),
+            0,
+            "disk size series left after the collection left the server"
+        );
+    }
+
     #[test]
     fn test_build_heartbeat_reports_disk_bytes() {
         let temp_dir = tempfile::tempdir().unwrap();
@@ -1648,19 +2125,23 @@ mod tests {
 
         let shard_path = format!("{}/ec_metrics_case_27.ec00", dir);
         std::fs::write(&shard_path, b"ec-shard").unwrap();
+        // An EC volume needs its .ecx to mount.
+        std::fs::write(format!("{}/ec_metrics_case_27.ecx", dir), [0u8; 16]).unwrap();
         store.locations[0]
             .mount_ec_shards(VolumeId(27), "ec_metrics_case", &[0], "")
             .unwrap();
 
         let state = test_state_with_store(store);
-        let heartbeat = collect_ec_heartbeat(&test_config(), &state);
+        let heartbeat = collect_ec_heartbeat(&test_config(), &state.store.read().unwrap());
 
         assert_eq!(heartbeat.ec_shards.len(), 1);
         assert!(!heartbeat.has_no_ec_shards);
         assert_eq!(heartbeat.ec_shards[0].disk_id, 0);
         assert_eq!(
             heartbeat.ec_shards[0].disk_type,
-            state.store.read().unwrap().locations[0].disk_type.to_string()
+            state.store.read().unwrap().locations[0]
+                .disk_type
+                .to_string()
         );
         assert_eq!(heartbeat.ec_shards[0].ec_index_bits, 1);
         assert_eq!(heartbeat.ec_shards[0].shard_sizes, vec![8]);
@@ -1690,6 +2171,8 @@ mod tests {
             .unwrap();
 
         std::fs::write(format!("{}/expired_heartbeat_ec_31.ec00", dir), b"expired").unwrap();
+        // An EC volume needs its .ecx to mount.
+        std::fs::write(format!("{}/expired_heartbeat_ec_31.ecx", dir), [0u8; 16]).unwrap();
         store.locations[0]
             .mount_ec_shards(VolumeId(31), "expired_heartbeat_ec", &[0], "")
             .unwrap();
@@ -1727,16 +2210,17 @@ mod tests {
         store
             .add_volume(
                 VolumeId(41),
-                "expired_volume_case",
-                None,
-                Some(crate::storage::needle::ttl::TTL::read("20m").unwrap()),
-                1024,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "expired_volume_case",
+                    ttl: Some(crate::storage::needle::ttl::TTL::read("20m").unwrap()),
+                    preallocate: 1024,
+                    ..Default::default()
+                },
             )
             .unwrap();
         let dat_path = {
-            let (_, volume) = store.find_volume_mut(VolumeId(41)).unwrap();
+            let (_, volume) = store.find_volume(VolumeId(41)).unwrap();
             volume.set_last_io_error_for_test(None);
             volume.set_last_modified_ts_for_test(
                 SystemTime::now()
@@ -1783,21 +2267,563 @@ mod tests {
         store
             .add_volume(
                 VolumeId(51),
-                "io_error_case",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "io_error_case",
+                    ..Default::default()
+                },
             )
             .unwrap();
-        let (_, volume) = store.find_volume_mut(VolumeId(51)).unwrap();
+        let (_, volume) = store.find_volume(VolumeId(51)).unwrap();
         volume.set_last_io_error_for_test(Some("input/output error"));
 
         let heartbeat = build_heartbeat(&test_config(), &mut store);
 
+        // A sustained IO error quarantines the volume: it stays mounted
+        // (so healthz can observe the quarantine state) but is not
+        // advertised to the master.
         assert!(heartbeat.volumes.is_empty());
-        assert!(!store.has_volume(VolumeId(51)));
+        assert!(store.has_volume(VolumeId(51)));
+        let (_, volume) = store.find_volume(VolumeId(51)).unwrap();
+        assert!(volume.is_no_write_or_delete());
+    }
+
+    // The pass only reads the store, so it must not shut out the readers that
+    // serve traffic while it stats every volume.
+    #[tokio::test]
+    async fn test_heartbeat_collection_leaves_the_store_readable() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let mut store = reporting_store(temp_dir.path().to_str().unwrap(), 2);
+        store.id = "heartbeat-read-phase-park".to_string();
+        let state = test_state_with_store(store);
+
+        let (entered_tx, entered_rx) = tokio::sync::oneshot::channel();
+        let (release_tx, release_rx) = std::sync::mpsc::channel::<()>();
+        read_phase_hook::arm(
+            read_phase_hook::Point::VolumePass,
+            "heartbeat-read-phase-park",
+            entered_tx,
+            release_rx,
+        );
+        let collection = {
+            let state = state.clone();
+            tokio::spawn(async move {
+                off_runtime(&test_config(), &state, collect_heartbeat_with_snapshot).await
+            })
+        };
+        tokio::time::timeout(Duration::from_secs(10), entered_rx)
+            .await
+            .expect("the pass never reached its read phase")
+            .unwrap();
+
+        let readable = state.store.try_read().is_ok();
+        drop(release_tx);
+        let (heartbeat, volumes) = collection.await.unwrap().unwrap();
+
+        assert!(readable, "a parked heartbeat pass shut out store readers");
+        assert_eq!(heartbeat.volumes.len(), 2);
+        assert_eq!(volumes.len(), 2);
+    }
+
+    /// Holds the store write lock on another thread until `release` is
+    /// dropped, or for 3s so a parked runtime fails the test instead of
+    /// hanging it. The flag turns true just before the lock is let go.
+    fn hold_store_write_lock(
+        state: &Arc<VolumeServerState>,
+    ) -> (
+        std::sync::mpsc::Sender<()>,
+        Arc<std::sync::atomic::AtomicBool>,
+        std::thread::JoinHandle<()>,
+    ) {
+        let (held_tx, held_rx) = std::sync::mpsc::channel();
+        let (release_tx, release_rx) = std::sync::mpsc::channel::<()>();
+        let released = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let writer = {
+            let (state, released) = (state.clone(), released.clone());
+            std::thread::spawn(move || {
+                let guard = state.store.write().unwrap();
+                held_tx.send(()).unwrap();
+                let _ = release_rx.recv_timeout(Duration::from_secs(3));
+                released.store(true, Ordering::SeqCst);
+                drop(guard);
+            })
+        };
+        held_rx.recv().unwrap();
+        (release_tx, released, writer)
+    }
+
+    // The heartbeat task shares a worker with other tasks; on this
+    // single-threaded runtime, a pass that waits for the store on the worker
+    // stops everything else until the writer lets go.
+    #[tokio::test]
+    async fn test_ec_tick_pass_waits_for_the_store_off_the_runtime() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+        let mut store = reporting_store(dir, 0);
+        std::fs::write(format!("{}/ec_tick_off_runtime_41.ec00", dir), b"shard").unwrap();
+        std::fs::write(format!("{}/ec_tick_off_runtime_41.ecx", dir), [0u8; 16]).unwrap();
+        store.locations[0]
+            .mount_ec_shards(VolumeId(41), "ec_tick_off_runtime", &[0], "")
+            .unwrap();
+        let state = test_state_with_store(store);
+
+        let (release, released, writer) = hold_store_write_lock(&state);
+        let pass = {
+            let state = state.clone();
+            tokio::spawn(async move { ec_tick_pass(&test_config(), &state).await })
+        };
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let ran_while_held = !released.load(Ordering::SeqCst);
+        drop(release);
+        writer.join().unwrap();
+        let (heartbeat, shards) = pass.await.unwrap().unwrap();
+
+        assert!(
+            ran_while_held,
+            "the EC pass parked the runtime on the store lock"
+        );
+        assert_eq!(heartbeat.ec_shards.len(), 1);
+        assert_eq!(shards.len(), 1);
+    }
+
+    #[tokio::test]
+    async fn test_volume_max_adjustment_waits_for_the_store_off_the_runtime() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let mut store = reporting_store(temp_dir.path().to_str().unwrap(), 1);
+        // Auto-sized, so the adjustment stats the disk and the volume.
+        store.locations[0].original_max_volume_count = 0;
+        store.locations[0]
+            .max_volume_count
+            .store(0, Ordering::Relaxed);
+        store
+            .volume_size_limit
+            .store(1024 * 1024, Ordering::Relaxed);
+        let state = test_state_with_store(store);
+
+        let (release, released, writer) = hold_store_write_lock(&state);
+        let adjust = {
+            let state = state.clone();
+            tokio::spawn(async move { maybe_adjust_volume_max(&test_config(), &state).await })
+        };
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let ran_while_held = !released.load(Ordering::SeqCst);
+        drop(release);
+        writer.join().unwrap();
+        let changed = adjust.await.unwrap().unwrap();
+
+        assert!(
+            ran_while_held,
+            "the adjustment parked the runtime on the store lock"
+        );
+        assert!(changed);
+        assert!(
+            state.store.read().unwrap().locations[0]
+                .max_volume_count
+                .load(Ordering::Relaxed)
+                >= 1
+        );
+    }
+
+    #[tokio::test]
+    async fn test_volume_options_wait_for_the_store_off_the_runtime() {
+        let state = test_state_with_store(Store::new(NeedleMapKind::InMemory));
+        state
+            .store
+            .read()
+            .unwrap()
+            .volume_size_limit
+            .store(1024, Ordering::Relaxed);
+        let hb_resp = master_pb::HeartbeatResponse {
+            volume_size_limit: 2048,
+            preallocate: true,
+            ..Default::default()
+        };
+
+        let (release, released, writer) = hold_store_write_lock(&state);
+        let apply = {
+            let state = state.clone();
+            tokio::spawn(async move { volume_options_pass(&test_config(), &state, &hb_resp).await })
+        };
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let ran_while_held = !released.load(Ordering::SeqCst);
+        drop(release);
+        writer.join().unwrap();
+        let changed = apply.await.unwrap().unwrap();
+
+        assert!(
+            ran_while_held,
+            "applying volume options parked the runtime on the store lock"
+        );
+        assert!(changed);
+        let store = state.store.read().unwrap();
+        assert!(store.get_preallocate());
+        assert_eq!(store.volume_size_limit.load(Ordering::Relaxed), 2048);
+    }
+
+    // The writer arrives between the volume snapshot and the EC read.
+    #[tokio::test]
+    async fn test_state_notification_waits_for_the_store_off_the_runtime() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+        let mut store = reporting_store(dir, 1);
+        store.id = "notify-off-runtime".to_string();
+        let state = test_state_with_store(store);
+        mount_test_ec_shard(&state, dir, "notify_off_runtime", 42);
+
+        let (entered_tx, entered_rx) = tokio::sync::oneshot::channel();
+        let (resume_tx, resume_rx) = std::sync::mpsc::channel::<()>();
+        read_phase_hook::arm(
+            read_phase_hook::Point::BeforeNotifyEcRead,
+            "notify-off-runtime",
+            entered_tx,
+            resume_rx,
+        );
+        let (held_tx, held_rx) = tokio::sync::oneshot::channel();
+        let (release_tx, release_rx) = std::sync::mpsc::channel::<()>();
+        let released = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let writer = {
+            let (state, released) = (state.clone(), released.clone());
+            std::thread::spawn(move || {
+                entered_rx.blocking_recv().unwrap();
+                let guard = state.store.write().unwrap();
+                drop(resume_tx);
+                held_tx.send(()).unwrap();
+                let _ = release_rx.recv_timeout(Duration::from_secs(3));
+                released.store(true, Ordering::SeqCst);
+                drop(guard);
+            })
+        };
+        let pass = {
+            let state = state.clone();
+            tokio::spawn(async move { notify_pass(&test_config(), &state).await })
+        };
+        tokio::time::timeout(Duration::from_secs(10), held_rx)
+            .await
+            .expect("the notify pass never reached its EC read")
+            .unwrap();
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let ran_while_held = !released.load(Ordering::SeqCst);
+        drop(release_tx);
+        writer.join().unwrap();
+        let (volumes, shards) = pass.await.unwrap().unwrap();
+
+        assert!(
+            ran_while_held,
+            "the notify pass parked the runtime on the store lock"
+        );
+        assert_eq!(volumes.len(), 1);
+        assert_eq!(shards.len(), 1);
+    }
+
+    #[tokio::test]
+    async fn test_deregister_heartbeat_waits_for_the_store_off_the_runtime() {
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store.id = "deregister-off-runtime".to_string();
+        let state = test_state_with_store(store);
+        let (tx, mut rx) = tokio::sync::mpsc::channel(1);
+
+        let (release, released, writer) = hold_store_write_lock(&state);
+        let deregister = {
+            let state = state.clone();
+            tokio::spawn(
+                async move { send_deregister_heartbeat(&test_config(), &state, &tx).await },
+            )
+        };
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        let ran_while_held = !released.load(Ordering::SeqCst);
+        drop(release);
+        writer.join().unwrap();
+        deregister.await.unwrap();
+        let heartbeat = rx.recv().await.unwrap();
+
+        assert!(
+            ran_while_held,
+            "the deregistration heartbeat parked the runtime on the store lock"
+        );
+        assert_eq!(heartbeat.id, "deregister-off-runtime");
+        assert!(heartbeat.has_no_volumes && heartbeat.has_no_ec_shards);
+    }
+
+    // What the read pass decided on can go stale before the write lock is
+    // taken: each action must re-check its target, not act on whatever now
+    // holds the id.
+    #[test]
+    fn test_volume_actions_skip_volumes_changed_since_the_read_pass() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                dir,
+                dir,
+                8,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+        store.volume_size_limit.store(1, Ordering::Relaxed);
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs();
+        for id in [61, 62, 63] {
+            store
+                .add_volume(
+                    VolumeId(id),
+                    DiskType::HardDrive,
+                    &VolumeSpec {
+                        collection: "stale_action_case",
+                        ttl: Some(crate::storage::needle::ttl::TTL::read("20m").unwrap()),
+                        ..Default::default()
+                    },
+                )
+                .unwrap();
+            let (_, volume) = store.find_volume(VolumeId(id)).unwrap();
+            volume.set_last_io_error_for_test(None);
+            volume.set_last_modified_ts_for_test(now.saturating_sub(60 * 60));
+            std::fs::OpenOptions::new()
+                .write(true)
+                .open(volume.dat_path())
+                .unwrap()
+                .set_len((crate::storage::super_block::SUPER_BLOCK_SIZE + 1) as u64)
+                .unwrap();
+        }
+        store
+            .add_volume(
+                VolumeId(64),
+                DiskType::HardDrive,
+                &VolumeSpec {
+                    collection: "stale_action_case",
+                    ..Default::default()
+                },
+            )
+            .unwrap();
+        let (_, volume) = store.find_volume(VolumeId(64)).unwrap();
+        volume.set_last_io_error_for_test(Some("input/output error"));
+
+        let (heartbeat, _, actions) =
+            build_heartbeat_with_ec_status(&test_config(), &store, Vec::new(), true, true);
+        assert!(heartbeat.volumes.is_empty());
+        assert_eq!(actions.delete_expired.len(), 3);
+        assert_eq!(actions.quarantine, vec![(0, VolumeId(64))]);
+
+        // Between the phases: 61 is deleted by someone else, 62 and 64 are
+        // replaced by fresh copies under the same ids; 63 is left alone.
+        store
+            .delete_volume(VolumeId(61), false, false, false)
+            .unwrap();
+        for id in [62, 64] {
+            store
+                .delete_volume(VolumeId(id), false, false, false)
+                .unwrap();
+            store
+                .add_volume(
+                    VolumeId(id),
+                    DiskType::HardDrive,
+                    &VolumeSpec {
+                        collection: "stale_action_case",
+                        ..Default::default()
+                    },
+                )
+                .unwrap();
+        }
+
+        apply_volume_actions_to(&mut store, actions);
+
+        assert!(!store.has_volume(VolumeId(61)));
+        assert!(store.has_volume(VolumeId(62)), "a fresh copy was deleted");
+        assert!(
+            !store.has_volume(VolumeId(63)),
+            "the expired volume survived"
+        );
+        let (_, fresh) = store.find_volume(VolumeId(64)).unwrap();
+        assert!(
+            !fresh.is_no_write_or_delete(),
+            "a fresh copy was quarantined"
+        );
+    }
+
+    // A shard mounted after the EC phase is held when the volume list is
+    // taken; reporting "no EC shards" alongside it would clear it on the master.
+    #[tokio::test]
+    async fn test_ec_shard_mounted_after_the_ec_phase_is_not_reported_absent() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+        let mut store = reporting_store(dir, 1);
+        store.id = "heartbeat-ec-mount-between-passes".to_string();
+        let state = test_state_with_store(store);
+        std::fs::write(format!("{}/ec_mount_race_73.ec00", dir), b"shard").unwrap();
+        std::fs::write(format!("{}/ec_mount_race_73.ecx", dir), [0u8; 16]).unwrap();
+
+        let (entered_tx, entered_rx) = tokio::sync::oneshot::channel();
+        let (release_tx, release_rx) = std::sync::mpsc::channel::<()>();
+        read_phase_hook::arm(
+            read_phase_hook::Point::BeforeVolumePass,
+            "heartbeat-ec-mount-between-passes",
+            entered_tx,
+            release_rx,
+        );
+        let collection = {
+            let state = state.clone();
+            tokio::spawn(async move {
+                off_runtime(&test_config(), &state, collect_heartbeat_with_snapshot).await
+            })
+        };
+        tokio::time::timeout(Duration::from_secs(10), entered_rx)
+            .await
+            .expect("the pass never finished its EC phase")
+            .unwrap();
+
+        state.store.write().unwrap().locations[0]
+            .mount_ec_shards(VolumeId(73), "ec_mount_race", &[0], "")
+            .unwrap();
+        drop(release_tx);
+        let (heartbeat, _) = collection.await.unwrap().unwrap();
+
+        assert!(
+            !heartbeat.has_no_ec_shards,
+            "a mounted EC shard was reported absent"
+        );
+    }
+
+    fn mount_test_ec_shard(state: &VolumeServerState, dir: &str, collection: &str, id: u32) {
+        std::fs::write(format!("{}/{}_{}.ec00", dir, collection, id), b"shard").unwrap();
+        std::fs::write(format!("{}/{}_{}.ecx", dir, collection, id), [0u8; 16]).unwrap();
+        state.store.write().unwrap().locations[0]
+            .mount_ec_shards(VolumeId(id), collection, &[0], "")
+            .unwrap();
+    }
+
+    /// One pass of the loop's volume tick, then of its notify branch: the
+    /// EC delta the notify branch would send.
+    fn ec_delta_after_volume_tick(
+        state: &Arc<VolumeServerState>,
+        last_ec_shards: &mut HashMap<EcShardDeltaKey, master_pb::VolumeEcShardInformationMessage>,
+    ) -> (
+        master_pb::Heartbeat,
+        Vec<master_pb::VolumeEcShardInformationMessage>,
+        Vec<master_pb::VolumeEcShardInformationMessage>,
+    ) {
+        let (heartbeat, _) = collect_heartbeat_with_snapshot(&test_config(), state);
+        forget_reported_ec_deletions(last_ec_shards, &heartbeat);
+        let current = collect_ec_shard_delta_messages(&state.store.read().unwrap());
+        let (new_ec_shards, deleted_ec_shards) =
+            diff_ec_shard_delta_messages(last_ec_shards, &current);
+        (heartbeat, new_ec_shards, deleted_ec_shards)
+    }
+
+    // A volume heartbeat carries no shard list, so a mount or unmount it
+    // collects past must still go out as the notify branch's delta.
+    #[test]
+    fn test_ec_shard_change_before_a_volume_heartbeat_still_goes_out_as_a_delta() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+        let state = test_state_with_store(reporting_store(dir, 1));
+        mount_test_ec_shard(&state, dir, "ec_delta_kept", 91);
+        mount_test_ec_shard(&state, dir, "ec_delta_unmounted", 92);
+        let mut last_ec_shards = collect_ec_shard_delta_messages(&state.store.read().unwrap());
+
+        mount_test_ec_shard(&state, dir, "ec_delta_mounted", 93);
+        state
+            .store
+            .write()
+            .unwrap()
+            .unmount_ec_shards(VolumeId(92), &[0]);
+        let (heartbeat, new_ec_shards, deleted_ec_shards) =
+            ec_delta_after_volume_tick(&state, &mut last_ec_shards);
+
+        assert!(heartbeat.ec_shards.is_empty() && !heartbeat.has_no_ec_shards);
+        assert_eq!(
+            new_ec_shards.iter().map(|s| s.id).collect::<Vec<_>>(),
+            vec![93],
+            "a mount collected past by the volume heartbeat was never sent"
+        );
+        assert_eq!(
+            deleted_ec_shards.iter().map(|s| s.id).collect::<Vec<_>>(),
+            vec![92],
+            "an unmount collected past by the volume heartbeat was never sent"
+        );
+    }
+
+    // The volume heartbeat already told the master about the expired EC
+    // volume it destroyed; the next delta must not repeat it.
+    #[test]
+    fn test_ec_volume_expired_by_a_volume_heartbeat_is_not_deleted_again() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+        let state = test_state_with_store(reporting_store(dir, 0));
+        mount_test_ec_shard(&state, dir, "ec_delta_kept", 94);
+        mount_test_ec_shard(&state, dir, "ec_delta_expired", 95);
+        let mut last_ec_shards = collect_ec_shard_delta_messages(&state.store.read().unwrap());
+        state
+            .store
+            .write()
+            .unwrap()
+            .find_ec_volume_mut(VolumeId(95))
+            .unwrap()
+            .expire_at_sec = 1;
+
+        let (heartbeat, new_ec_shards, deleted_ec_shards) =
+            ec_delta_after_volume_tick(&state, &mut last_ec_shards);
+
+        assert_eq!(heartbeat.deleted_ec_shards.len(), 1);
+        assert_eq!(heartbeat.deleted_ec_shards[0].id, 95);
+        assert!(new_ec_shards.is_empty());
+        assert!(
+            deleted_ec_shards.is_empty(),
+            "an expired EC volume was reported deleted twice"
+        );
+        assert_eq!(last_ec_shards.len(), 1);
+    }
+
+    #[test]
+    fn test_expired_ec_volume_gone_before_removal_is_not_reported_deleted() {
+        let temp_dir = tempfile::tempdir().unwrap();
+        let dir = temp_dir.path().to_str().unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                dir,
+                dir,
+                8,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+        for id in [71, 72] {
+            std::fs::write(format!("{}/stale_ec_case_{}.ec00", dir, id), b"expired").unwrap();
+            std::fs::write(format!("{}/stale_ec_case_{}.ecx", dir, id), [0u8; 16]).unwrap();
+            store.locations[0]
+                .mount_ec_shards(VolumeId(id), "stale_ec_case", &[0], "")
+                .unwrap();
+            store
+                .find_ec_volume_mut(VolumeId(id))
+                .unwrap()
+                .expire_at_sec = 1;
+        }
+
+        let (ec_shards, mut expired) = store.find_expired_ec_volumes();
+        expired.sort();
+        assert!(ec_shards.is_empty());
+        assert_eq!(expired, vec![(0, VolumeId(71)), (0, VolumeId(72))]);
+
+        // Between the phases: 71 is destroyed by someone else, 72 is remounted
+        // without an expiry.
+        store.remove_ec_volume(VolumeId(71)).unwrap().destroy();
+        store.remove_ec_volume(VolumeId(72)).unwrap();
+        store.locations[0]
+            .mount_ec_shards(VolumeId(72), "stale_ec_case", &[0], "")
+            .unwrap();
+        let (deleted, still_held) = store.remove_expired_ec_volumes(expired);
+
+        assert!(deleted.is_empty());
+        assert_eq!(still_held.len(), 1);
+        assert_eq!(still_held[0].id, 72);
+        assert!(store.has_ec_volume(VolumeId(72)));
     }
 
     #[test]
@@ -1819,22 +2845,24 @@ mod tests {
         store
             .add_volume(
                 VolumeId(71),
-                "remote_volume_case",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "remote_volume_case",
+                    ..Default::default()
+                },
             )
             .unwrap();
-        let (_, volume) = store.find_volume_mut(VolumeId(71)).unwrap();
-        volume.volume_info.files.push(crate::storage::volume::PbRemoteFile {
-            backend_type: "s3".to_string(),
-            backend_id: "archive".to_string(),
-            key: "volumes/71.dat".to_string(),
-            ..Default::default()
-        });
-        volume.refresh_remote_write_mode();
+        let (_, volume) = store.find_volume(VolumeId(71)).unwrap();
+        volume
+            .update_remote_files(|files| {
+                files.push(crate::storage::volume::PbRemoteFile {
+                    backend_type: "s3".to_string(),
+                    backend_id: "archive".to_string(),
+                    key: "volumes/71.dat".to_string(),
+                    ..Default::default()
+                })
+            })
+            .unwrap();
 
         let heartbeat = build_heartbeat(&test_config(), &mut store);
 
@@ -1843,65 +2871,56 @@ mod tests {
         assert_eq!(heartbeat.volumes[0].remote_storage_key, "volumes/71.dat");
     }
 
+    // Not hermetic, and cannot be made so cheaply: `register_s3_backend` skips
+    // a name that is already registered, so had another test put `s3` or
+    // `s3.default` in the process-wide registry first, this would pass without
+    // proving that this call registered anything. Removing them afterwards is
+    // no better — unlike the tier tests' unique ids, the bare `s3` alias is the
+    // production one. Nothing else in the tree registers those two names.
     #[test]
     fn test_apply_storage_backends_registers_s3_default_aliases() {
-        let state = test_state_with_store(Store::new(NeedleMapKind::InMemory));
         // Do not call clear() on the global registry — other tests may be
         // running concurrently.  Just register our entries and verify them.
 
-        apply_storage_backends(
-            &state,
-            &[master_pb::StorageBackend {
-                r#type: "s3".to_string(),
-                id: "default".to_string(),
-                properties: std::collections::HashMap::from([
-                    ("aws_access_key_id".to_string(), "access".to_string()),
-                    ("aws_secret_access_key".to_string(), "secret".to_string()),
-                    ("bucket".to_string(), "bucket-a".to_string()),
-                    ("region".to_string(), "us-west-2".to_string()),
-                    ("endpoint".to_string(), "http://127.0.0.1:8333".to_string()),
-                    ("storage_class".to_string(), "STANDARD".to_string()),
-                    ("force_path_style".to_string(), "false".to_string()),
-                ]),
-            }],
-        );
+        apply_storage_backends(&[master_pb::StorageBackend {
+            r#type: "s3".to_string(),
+            id: "default".to_string(),
+            properties: std::collections::HashMap::from([
+                ("aws_access_key_id".to_string(), "access".to_string()),
+                ("aws_secret_access_key".to_string(), "secret".to_string()),
+                ("bucket".to_string(), "bucket-a".to_string()),
+                ("region".to_string(), "us-west-2".to_string()),
+                ("endpoint".to_string(), "http://127.0.0.1:8333".to_string()),
+                ("storage_class".to_string(), "STANDARD".to_string()),
+                ("force_path_style".to_string(), "false".to_string()),
+            ]),
+        }]);
 
-        let registry = state.s3_tier_registry.read().unwrap();
-        assert!(registry.get("s3.default").is_some());
-        assert!(registry.get("s3").is_some());
-        let global_registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
+        let registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
             .read()
             .unwrap();
-        assert!(global_registry.get("s3.default").is_some());
-        assert!(global_registry.get("s3").is_some());
+        assert!(registry.get("s3.default").is_some());
+        assert!(registry.get("s3").is_some());
     }
 
     #[test]
     fn test_apply_storage_backends_ignores_unsupported_types() {
-        let state = test_state_with_store(Store::new(NeedleMapKind::InMemory));
         // Do not call clear() on the global registry — other tests may be
         // running concurrently.
 
-        apply_storage_backends(
-            &state,
-            &[master_pb::StorageBackend {
-                r#type: "rclone".to_string(),
-                id: "default".to_string(),
-                properties: std::collections::HashMap::new(),
-            }],
-        );
+        apply_storage_backends(&[master_pb::StorageBackend {
+            r#type: "rclone".to_string(),
+            id: "default".to_string(),
+            properties: std::collections::HashMap::new(),
+        }]);
 
-        // The per-state registry is freshly created and should have no entries
-        // since "rclone" is unsupported.
-        let registry = state.s3_tier_registry.read().unwrap();
-        assert!(registry.names().is_empty());
         // Only check that the unsupported type was not added to the global
         // registry.  Other tests may have their own entries present.
-        let global_registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
+        let registry = crate::remote_storage::s3_tier::global_s3_tier_registry()
             .read()
             .unwrap();
-        assert!(global_registry.get("rclone.default").is_none());
-        assert!(global_registry.get("rclone").is_none());
+        assert!(registry.get("rclone.default").is_none());
+        assert!(registry.get("rclone").is_none());
     }
 
     #[test]
@@ -1970,7 +2989,7 @@ mod tests {
 
         assert!(store.get_preallocate());
         assert_eq!(store.volume_size_limit.load(Ordering::Relaxed), 2048);
-        assert!(!changed);
+        assert!(changed);
     }
 
     #[test]
@@ -1993,12 +3012,13 @@ mod tests {
         let previous = collect_ec_shard_delta_messages(&store);
 
         std::fs::write(format!("{}/ec_delta_case_81.ec00", dir), b"delta").unwrap();
+        // An EC volume needs its .ecx to mount.
+        std::fs::write(format!("{}/ec_delta_case_81.ecx", dir), [0u8; 16]).unwrap();
         store.locations[0]
             .mount_ec_shards(VolumeId(81), "ec_delta_case", &[0], "")
             .unwrap();
         let current = collect_ec_shard_delta_messages(&store);
-        let (new_ec_shards, deleted_ec_shards) =
-            diff_ec_shard_delta_messages(&previous, &current);
+        let (new_ec_shards, deleted_ec_shards) = diff_ec_shard_delta_messages(&previous, &current);
 
         assert_eq!(new_ec_shards.len(), 1);
         assert!(deleted_ec_shards.is_empty());
diff --git a/seaweed-volume/src/server/memory_status.rs b/seaweed-volume/src/server/memory_status.rs
index 92886465f0..42958374de 100644
--- a/seaweed-volume/src/server/memory_status.rs
+++ b/seaweed-volume/src/server/memory_status.rs
@@ -36,16 +36,20 @@ pub fn collect_mem_status() -> volume_server_pb::MemStatus {
 
 #[cfg(target_os = "linux")]
 fn get_system_memory_linux() -> Option<(u64, u64)> {
-    unsafe {
-        let mut info: libc::sysinfo = std::mem::zeroed();
-        if libc::sysinfo(&mut info) == 0 {
-            let unit = info.mem_unit as u64;
-            let total = info.totalram as u64 * unit;
-            let free = info.freeram as u64 * unit;
-            return Some((total, free));
-        }
+    // SAFETY: `libc::sysinfo` is plain data — integers and trailing padding,
+    // no pointers and no restricted niches — so the all-zero value is a valid
+    // one for the kernel to overwrite.
+    let mut info: libc::sysinfo = unsafe { std::mem::zeroed() };
+    // SAFETY: `&mut info` is a live, aligned, exclusive pointer to a
+    // `sysinfo` that the kernel only writes through, and its fields are read
+    // below only after the call reports success.
+    if unsafe { libc::sysinfo(&mut info) } != 0 {
+        return None;
     }
-    None
+    let unit = info.mem_unit as u64;
+    let total = info.totalram as u64 * unit;
+    let free = info.freeram as u64 * unit;
+    Some((total, free))
 }
 
 #[cfg(target_os = "linux")]
diff --git a/seaweed-volume/src/server/mod.rs b/seaweed-volume/src/server/mod.rs
index 092e43c354..3ba09a18ba 100644
--- a/seaweed-volume/src/server/mod.rs
+++ b/seaweed-volume/src/server/mod.rs
@@ -1,3 +1,8 @@
+use tonic::Status;
+
+use crate::remote_storage::s3_tier::TierError;
+use crate::storage::volume::VolumeError;
+
 #[cfg(unix)]
 pub mod debug;
 pub mod grpc_client;
@@ -13,3 +18,111 @@ pub mod store_ec;
 pub mod ui;
 pub mod volume_server;
 pub mod write_queue;
+
+/// Map a storage error onto the gRPC code that describes it.
+impl From<VolumeError> for Status {
+    fn from(err: VolumeError) -> Self {
+        let message = err.to_string();
+        match err {
+            VolumeError::NotFound
+            | VolumeError::VolumeNotFound(_)
+            | VolumeError::Tier(TierError::NotFound(_)) => Status::not_found(message),
+            VolumeError::ReadOnly(_) | VolumeError::NotEmpty => {
+                Status::failed_precondition(message)
+            }
+            VolumeError::InsufficientSpace { .. } => Status::resource_exhausted(message),
+            VolumeError::AlreadyExists => Status::already_exists(message),
+            _ => Status::internal(message),
+        }
+    }
+}
+
+/// Same mapping, with the RPC's own context prefixed (`compact volume 7: ...`).
+pub fn status_with_context(context: &str, err: VolumeError) -> Status {
+    let status = Status::from(err);
+    Status::new(status.code(), format!("{context}: {}", status.message()))
+}
+
+/// Render a configured disk directory as an absolute path for display, so the
+/// status JSON and the UI show the same thing for a relative `-dir`. Falls
+/// back to the configured spelling when the current directory cannot be read.
+pub(crate) fn absolute_display_path(path: &str) -> String {
+    let p = std::path::Path::new(path);
+    if p.is_absolute() {
+        return path.to_string();
+    }
+    std::env::current_dir()
+        .map(|cwd| cwd.join(p).to_string_lossy().to_string())
+        .unwrap_or_else(|_| path.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::storage::types::VolumeId;
+
+    #[test]
+    fn test_volume_error_maps_to_grpc_code() {
+        use tonic::Code;
+
+        let code = |e: VolumeError| Status::from(e).code();
+        assert_eq!(
+            code(VolumeError::VolumeNotFound(VolumeId(7))),
+            Code::NotFound
+        );
+        assert_eq!(code(VolumeError::NotFound), Code::NotFound);
+        assert_eq!(
+            code(VolumeError::ReadOnly(VolumeId(7))),
+            Code::FailedPrecondition
+        );
+        assert_eq!(
+            VolumeError::ReadOnly(VolumeId(7)).to_string(),
+            "volume 7 is read only"
+        );
+        assert_eq!(
+            code(VolumeError::InsufficientSpace {
+                vid: VolumeId(7),
+                required: 2,
+                free: 1,
+            }),
+            Code::ResourceExhausted
+        );
+        assert_eq!(code(VolumeError::AlreadyExists), Code::AlreadyExists);
+        assert_eq!(code(VolumeError::NotInitialized), Code::Internal);
+        assert_eq!(
+            code(TierError::NotFound("gone".into()).into()),
+            Code::NotFound
+        );
+        for tier in [
+            TierError::Io("io".into()),
+            TierError::RuntimeUnavailable("rt".into()),
+            TierError::Aborted("bye".into()),
+        ] {
+            assert_eq!(code(tier.into()), Code::Internal);
+        }
+
+        let status = status_with_context(
+            "backend s3.default copy file /data/1.dat",
+            TierError::NotFound("failed to head object k: NotFound".into()).into(),
+        );
+        assert_eq!(status.code(), Code::NotFound);
+        assert_eq!(
+            status.message(),
+            "backend s3.default copy file /data/1.dat: failed to head object k: NotFound"
+        );
+
+        let status = status_with_context(
+            "compact volume 7",
+            VolumeError::InsufficientSpace {
+                vid: VolumeId(7),
+                required: 2,
+                free: 1,
+            },
+        );
+        assert_eq!(status.code(), Code::ResourceExhausted);
+        assert_eq!(
+            status.message(),
+            "compact volume 7: not enough free space: required 2, free 1"
+        );
+    }
+}
diff --git a/seaweed-volume/src/server/profiling.rs b/seaweed-volume/src/server/profiling.rs
index 51e4f174cc..5622e9d428 100644
--- a/seaweed-volume/src/server/profiling.rs
+++ b/seaweed-volume/src/server/profiling.rs
@@ -132,10 +132,14 @@ mod tests {
             fix_jpg_orientation: false,
             read_mode: ReadMode::Local,
             allow_untrusted_remote_endpoints: false,
+            fsync_min_batch_bytes: 1024 * 1024,
+            fsync_min_batch_requests: 128,
+            fsync_batch_wait: std::time::Duration::from_micros(500),
             cpu_profile: String::new(),
             mem_profile: String::new(),
             compaction_byte_per_second: 0,
             maintenance_byte_per_second: 0,
+            max_parallel_vacuum_commits: 0,
             file_size_limit_bytes: 0,
             concurrent_upload_limit: 0,
             concurrent_download_limit: 0,
@@ -163,11 +167,12 @@ mod tests {
             https_client_ca_file: String::new(),
             grpc_cert_file: String::new(),
             grpc_key_file: String::new(),
+            grpc_client_cert_file: String::new(),
+            grpc_client_key_file: String::new(),
             grpc_ca_file: String::new(),
             grpc_allowed_wildcard_domain: String::new(),
             grpc_volume_allowed_common_names: vec![],
             tls_policy: TlsPolicy::default(),
-            enable_write_queue: false,
             security_file: String::new(),
         }
     }
diff --git a/seaweed-volume/src/server/request_id.rs b/seaweed-volume/src/server/request_id.rs
index 1a2b61f40f..1e2a8315f0 100644
--- a/seaweed-volume/src/server/request_id.rs
+++ b/seaweed-volume/src/server/request_id.rs
@@ -29,11 +29,11 @@ impl<S> Layer<S> for GrpcRequestIdLayer {
 
 impl<S, B> Service<http::Request<B>> for GrpcRequestIdService<S>
 where
-    S: Service<http::Request<B>, Response = http::Response<tonic::body::BoxBody>> + Send + 'static,
+    S: Service<http::Request<B>, Response = http::Response<tonic::body::Body>> + Send + 'static,
     S::Future: Send + 'static,
     B: Send + 'static,
 {
-    type Response = http::Response<tonic::body::BoxBody>;
+    type Response = http::Response<tonic::body::Body>;
     type Error = S::Error;
     type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>> + Send>>;
 
@@ -57,7 +57,7 @@ where
         let future = self.inner.call(request);
 
         Box::pin(async move {
-            let mut response: http::Response<tonic::body::BoxBody> =
+            let mut response: http::Response<tonic::body::Body> =
                 scope_request_id(request_id.clone(), future).await?;
             if let Ok(value) = HeaderValue::from_str(&request_id) {
                 response.headers_mut().insert("x-amz-request-id", value);
diff --git a/seaweed-volume/src/server/store_ec.rs b/seaweed-volume/src/server/store_ec.rs
index 4c6d6438f5..bf973d7fa5 100644
--- a/seaweed-volume/src/server/store_ec.rs
+++ b/seaweed-volume/src/server/store_ec.rs
@@ -26,29 +26,45 @@
 //! cache write-back briefly reacquires the EcVolume's internal
 //! `RwLock` so we do not contend with the Store-level lock at all.
 
-use std::collections::HashMap;
+use std::collections::{HashMap, HashSet};
 use std::fs;
 use std::io;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
 use futures::future::join_all;
+use futures::stream::{self, StreamExt};
 use reed_solomon_erasure::galois_8::ReedSolomon;
+use tokio::sync::Semaphore;
 use tonic::Request;
 
-use crate::pb::master_pb::{self, seaweed_client::SeaweedClient, LookupEcVolumeRequest};
+use crate::pb::master_pb::{self, LookupEcVolumeRequest};
 use crate::pb::volume_server_pb::{
-    volume_server_client::VolumeServerClient, CopyFileRequest, VolumeEcShardReadRequest,
+    CopyFileRequest, VolumeEcBlobDeleteRequest, VolumeEcShardReadRequest,
 };
-use crate::server::grpc_client::{build_grpc_endpoint, parse_grpc_address, GRPC_MAX_MESSAGE_SIZE};
-use crate::server::request_id::outgoing_request_id_interceptor;
-use crate::server::volume_server::{to_http_address, VolumeServerState};
-use crate::storage::erasure_coding::ec_shard::ShardId;
-use crate::storage::needle::needle::{get_actual_size, Needle, NeedleError};
+use crate::server::grpc_client::{
+    GrpcDialOptions, connect_channel, master_client, parse_grpc_address, volume_server_client,
+};
+use crate::server::volume_server::{VolumeServerState, to_http_address};
+use crate::storage::erasure_coding::ec_shard::{ShardId, shard_id_try_from};
+use crate::storage::needle::needle::{Needle, NeedleError, get_actual_size};
 use crate::storage::store_ec_reconcile::EcVolumeMissingIndex;
 use crate::storage::types::*;
 use crate::storage::volume::volume_file_name;
 
+/// Bounds the fan-out of a single needle read. Mirrors Go's
+/// `ecIntervalReadConcurrency`.
+const INTERVAL_READ_CONCURRENCY: usize = 8;
+
+/// Bounds the bytes EC recovery holds in flight across every concurrent read.
+/// Recovery is the one read path that multiplies the served bytes — it keeps an
+/// interval-sized buffer per shard alive until Reed-Solomon runs — and a peer
+/// that is slow to fail holds each of them for the whole gRPC timeout, so a
+/// burst of reads during a network blip walked the server into an OOM. Mirrors
+/// Go's `ecRecoverBudget`.
+const EC_RECOVER_BUDGET: usize = 256 << 20;
+static EC_RECOVER_SEM: Semaphore = Semaphore::const_new(EC_RECOVER_BUDGET);
+
 /// One interval's data after Phase A.
 enum IntervalResult {
     /// Already read from a locally-mounted shard.
@@ -79,20 +95,41 @@ struct Snapshot {
     encode_ts_ns: i64,
 }
 
-/// Top-level entry point. Returns `Ok(None)` for "not found" (matches
-/// Go's `ReadEcShardNeedle`); errors propagate as `io::Error`.
+/// Why a distributed EC read has no needle to return.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EcMiss {
+    NotFound,
+    /// Tombstoned in the local `.ecx`/`.ecj`, or reported deleted by a peer.
+    Deleted,
+    VolumeNotFound,
+}
+
+/// Top-level entry point. Returns `Ok(None)` for any miss — absent,
+/// deleted, or volume gone; errors propagate as `io::Error`.
 pub async fn read_ec_shard_needle_distributed(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
     needle_id: NeedleId,
 ) -> io::Result<Option<Needle>> {
+    Ok(read_ec_shard_needle_or_miss(state, vid, needle_id)
+        .await?
+        .ok())
+}
+
+/// Like `read_ec_shard_needle_distributed`, but says why there is no needle,
+/// as Go's `ReadEcShardNeedle` tells `ErrorDeleted` from not-found.
+pub async fn read_ec_shard_needle_or_miss(
+    state: &Arc<VolumeServerState>,
+    vid: VolumeId,
+    needle_id: NeedleId,
+) -> io::Result<Result<Needle, EcMiss>> {
     // Phase A — under the Store read lock, locate the needle, compute
     // intervals, and read any locally-mounted shard intervals. We must
     // not `.await` while holding this guard (std::sync::RwLockReadGuard
     // is !Send).
-    let snapshot = match snapshot_under_lock(state, vid, needle_id)? {
-        Some(s) => s,
-        None => return Ok(None),
+    let mut snapshot = match snapshot_under_lock(state, vid, needle_id)? {
+        Ok(s) => s,
+        Err(miss) => return Ok(Err(miss)),
     };
 
     // Phase B — refresh the shard_locations cache from the master if
@@ -106,7 +143,9 @@ pub async fn read_ec_shard_needle_distributed(
 
     let mut shard_locations = snapshot.cached_locations.clone();
     if any_remote
-        && needs_refresh(
+        && claim_shard_locations_refresh(
+            state,
+            vid,
             &shard_locations,
             snapshot.cache_refreshed_at,
             snapshot.data_shards as usize,
@@ -117,17 +156,26 @@ pub async fn read_ec_shard_needle_distributed(
             Ok(fresh) => {
                 // A complete reply merges into the cache; an incomplete one
                 // (< data_shards) is left unwritten — keep the prior cache.
-                if let Some(merged) =
-                    write_back_shard_locations(state, vid, fresh, snapshot.data_shards as usize)
-                {
-                    shard_locations = merged;
+                match write_back_shard_locations(
+                    state,
+                    vid,
+                    fresh,
+                    snapshot.data_shards as usize,
+                    snapshot.encode_ts_ns,
+                ) {
+                    Some(merged) => shard_locations = merged,
+                    // An incomplete reply leaves the cache unwritten and its refresh
+                    // time unadvanced, so the mark this refresh consumed goes back.
+                    None => mark_shard_locations_stale(state, vid),
                 }
             }
             Err(e) => {
                 // Lookup failed — proceed with cached values. If cache
                 // is empty, the remote fetch below will fail and we
                 // surface a NotFound (matching Go's behavior when no
-                // locations are known).
+                // locations are known). The mark goes back: nothing
+                // answered for it, and the map stays disproved.
+                mark_shard_locations_stale(state, vid);
                 tracing::warn!(
                     "ec lookup failed for volume {}: {} — using cached locations ({} entries)",
                     vid.0,
@@ -138,40 +186,56 @@ pub async fn read_ec_shard_needle_distributed(
         }
     }
 
-    // Phase C — fetch missing intervals, reconstructing when the
-    // direct peer read fails.
-    let mut assembled: Vec<Vec<u8>> = Vec::with_capacity(snapshot.intervals.len());
-    for res in snapshot.intervals {
-        match res {
-            IntervalResult::Local(buf) => assembled.push(buf),
-            IntervalResult::NeedRemote {
-                shard_id,
-                shard_offset,
-                size,
-            } => {
-                let (buf, is_deleted) = fetch_one_interval(
-                    state,
-                    vid,
-                    needle_id,
-                    shard_id,
-                    shard_offset,
-                    size,
-                    &shard_locations,
-                    snapshot.data_shards as usize,
-                    snapshot.parity_shards as usize,
-                    snapshot.encode_ts_ns,
-                )
-                .await?;
-                // A peer reports the needle deleted (a cross-server window where the
-                // local index still shows it live): treat as not-found rather than
-                // serving zeros, mirroring Go's ErrorDeleted.
-                if is_deleted {
-                    return Ok(None);
+    // Phase C — fetch missing intervals, reconstructing when the direct peer
+    // read fails. Blocks that follow each other in the .dat live on different
+    // shards, so a needle spanning several of them costs one round trip per
+    // block when fetched in sequence; `buffered` keeps the order while letting
+    // INTERVAL_READ_CONCURRENCY of them fly at once.
+    let data_shards = snapshot.data_shards as usize;
+    let parity_shards = snapshot.parity_shards as usize;
+    let encode_ts_ns = snapshot.encode_ts_ns;
+    let intervals = std::mem::take(&mut snapshot.intervals);
+    let fetched: Vec<io::Result<(Vec<u8>, bool)>> =
+        stream::iter(intervals.into_iter().map(|res| {
+            let shard_locations = &shard_locations;
+            async move {
+                match res {
+                    IntervalResult::Local(buf) => Ok((buf, false)),
+                    IntervalResult::NeedRemote {
+                        shard_id,
+                        shard_offset,
+                        size,
+                    } => {
+                        fetch_one_interval(
+                            state,
+                            EcInterval {
+                                vid,
+                                needle_id,
+                                shard_id,
+                                shard_offset,
+                                size,
+                                expected_encode_ts_ns: encode_ts_ns,
+                            },
+                            EcShardMap {
+                                locations: shard_locations,
+                                data_shards,
+                                parity_shards,
+                            },
+                        )
+                        .await
+                    }
                 }
-                assembled.push(buf);
             }
-        }
-    }
+        }))
+        .buffered(INTERVAL_READ_CONCURRENCY)
+        .collect()
+        .await;
+
+    // A peer reports the needle deleted (a cross-server window where the
+    // local index still shows it live): answer deleted rather than serving zeros.
+    let Some(assembled) = gather_intervals(fetched)? else {
+        return Ok(Err(EcMiss::Deleted));
+    };
 
     // Phase D — assemble and parse the Needle. Mirrors the tail of
     // `EcVolume::read_ec_shard_needle`.
@@ -192,8 +256,10 @@ pub async fn read_ec_shard_needle_distributed(
         ));
     }
 
-    let mut n = Needle::default();
-    n.id = needle_id;
+    let mut n = Needle {
+        id: needle_id,
+        ..Needle::default()
+    };
     n.read_bytes(
         &bytes,
         snapshot.offset.to_actual_offset(),
@@ -201,14 +267,280 @@ pub async fn read_ec_shard_needle_distributed(
         snapshot.version,
     )
     .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, format!("{}", e)))?;
-    Ok(Some(n))
+    Ok(Ok(n))
+}
+
+/// `None` when any holder reported the needle deleted. That outranks another
+/// interval's error: deletes are never invented, so the needle is gone either way.
+fn gather_intervals(fetched: Vec<io::Result<(Vec<u8>, bool)>>) -> io::Result<Option<Vec<Vec<u8>>>> {
+    if fetched.iter().any(|r| matches!(r, Ok((_, true)))) {
+        return Ok(None);
+    }
+    fetched
+        .into_iter()
+        .map(|r| r.map(|(buf, _)| buf))
+        .collect::<io::Result<_>>()
+        .map(Some)
+}
+
+/// What one EC delete RPC carries — `VolumeEcBlobDeleteRequest` minus tonic.
+struct EcDeleteTarget<'a> {
+    vid: VolumeId,
+    collection: &'a str,
+    version: Version,
+    needle_id: NeedleId,
+}
+
+/// `Store.doDeleteNeedleFromAtLeastOneRemoteEcShards` in Go: journal the
+/// tombstone on one holder of the needle's primary data shard, falling back
+/// to any other shard holder when the primary has none. Exactly one node
+/// journals — replicas of a shard hold identical .ecx copies, so journaling
+/// on more than one would double the reported delete count.
+///
+/// `NotFound` means the volume or needle is gone; other errors mean every
+/// reachable holder failed or no shard has a holder at all.
+pub async fn delete_ec_shard_needle_distributed(
+    state: &Arc<VolumeServerState>,
+    vid: VolumeId,
+    needle_id: NeedleId,
+) -> io::Result<()> {
+    let (
+        primary_shard_id,
+        collection,
+        version,
+        total_shards,
+        local_shards,
+        data_shards,
+        encode_ts_ns,
+        refreshed_at,
+        cached_locations,
+    ) = {
+        let store = state.store.read().unwrap();
+        let ecv = store.find_ec_volume(vid).ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::NotFound,
+                format!("ec volume {} not mounted", vid.0),
+            )
+        })?;
+        let (_, _, intervals) = ecv.locate_needle(needle_id)?.ok_or_else(|| {
+            io::Error::new(
+                io::ErrorKind::NotFound,
+                format!("needle {} not in ec volume {}", needle_id, vid.0),
+            )
+        })?;
+        let (shard_id, _) = intervals
+            .first()
+            .map(|i| ecv.interval_to_shard_id_and_offset(i))
+            .ok_or_else(|| io::Error::new(io::ErrorKind::NotFound, "no intervals for needle"))?;
+        let (cached_locations, refreshed_at) = ecv.shard_locations_snapshot();
+        (
+            shard_id,
+            ecv.collection.clone(),
+            ecv.version,
+            ecv.data_shards + ecv.parity_shards,
+            local_shard_ids(ecv),
+            ecv.data_shards as usize,
+            ecv.encode_ts_ns,
+            refreshed_at,
+            cached_locations,
+        )
+    };
+    let target = EcDeleteTarget {
+        vid,
+        collection: &collection,
+        version,
+        needle_id,
+    };
+
+    // Holder addresses come from the same staleness-gated cache as the read
+    // path: a master LookupEcVolume only when due, merged on a complete reply.
+    let mut locations = cached_locations;
+    if claim_shard_locations_refresh(
+        state,
+        vid,
+        &locations,
+        refreshed_at,
+        data_shards,
+        total_shards as usize,
+    ) {
+        match cached_lookup_ec_shard_locations(state, vid).await {
+            Ok(fresh) => {
+                match write_back_shard_locations(state, vid, fresh, data_shards, encode_ts_ns) {
+                    Some(merged) => locations = merged,
+                    None => mark_shard_locations_stale(state, vid),
+                }
+            }
+            Err(_) => mark_shard_locations_stale(state, vid),
+        }
+    }
+
+    match delete_on_ec_shard_holders(state, &locations, &local_shards, primary_shard_id, &target)
+        .await
+    {
+        Ok(true) => return Ok(()),
+        Err(e) => return Err(e),
+        Ok(false) => {}
+    }
+
+    for shard_id in 0..total_shards {
+        let Ok(shard_id) = shard_id_try_from(shard_id) else {
+            continue;
+        };
+        if shard_id == primary_shard_id {
+            continue;
+        }
+        if let Ok(true) =
+            delete_on_ec_shard_holders(state, &locations, &local_shards, shard_id, &target).await
+        {
+            return Ok(());
+        }
+    }
+
+    Err(io::Error::other(format!(
+        "ec volume {}: no shard holder could journal the delete",
+        vid.0
+    )))
+}
+
+/// `doDeleteNeedleFromRemoteEcShardServers` in Go. `Ok(false)` is the
+/// shard-missing signal — no live holder anywhere — that triggers the
+/// caller's fallback walk over the remaining shards.
+async fn delete_on_ec_shard_holders(
+    state: &Arc<VolumeServerState>,
+    locations: &HashMap<ShardId, Vec<String>>,
+    local_shards: &HashSet<ShardId>,
+    shard_id: ShardId,
+    target: &EcDeleteTarget<'_>,
+) -> io::Result<bool> {
+    let addrs = locations.get(&shard_id);
+    if !local_shards.contains(&shard_id) && addrs.is_none_or(|a| a.is_empty()) {
+        return Ok(false);
+    }
+
+    let mut last_err = None;
+    if local_shards.contains(&shard_id) {
+        // A decode in its publishing tail must not miss this delete. The
+        // tail membership is verified again under the store write lock
+        // inside journal_delete_local — WouldBlock means the decode claimed
+        // it in the gap after this wait — so wait and retry.
+        loop {
+            crate::server::grpc_server::wait_ec_decode_tail(state, target.vid).await;
+            match journal_delete_local(state, target.vid, target.needle_id) {
+                Ok(()) => return Ok(true),
+                Err(e) if e.kind() == io::ErrorKind::WouldBlock => continue,
+                // Nothing was committed — the volume unmounted or remounted
+                // without the needle — so it is safe to fall back to other
+                // shard holders, unlike an RPC failure which may have landed.
+                Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(false),
+                Err(e) => {
+                    last_err = Some(e);
+                    break;
+                }
+            }
+        }
+    }
+    if let Some(addrs) = addrs {
+        let self_http = to_http_address(&state.self_url);
+        for addr in addrs {
+            // A stale self entry: the loopback RPC would journal on this same
+            // volume, which the local attempt above already covered.
+            if to_http_address(addr).as_ref() == self_http.as_ref() {
+                continue;
+            }
+            match delete_on_remote_ec_shard(state, addr, target).await {
+                Ok(()) => return Ok(true),
+                Err(e) => last_err = Some(e),
+            }
+        }
+    }
+    match last_err {
+        Some(e) => Err(e),
+        None => Ok(false),
+    }
+}
+
+/// `doDeleteNeedleFromRemoteEcShard` in Go — one `VolumeEcBlobDelete` RPC.
+async fn delete_on_remote_ec_shard(
+    state: &Arc<VolumeServerState>,
+    addr: &str,
+    target: &EcDeleteTarget<'_>,
+) -> io::Result<()> {
+    let grpc_addr =
+        parse_grpc_address(addr).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
+    let channel = connect_channel(
+        &grpc_addr,
+        state.outgoing_grpc_tls.as_ref(),
+        GrpcDialOptions::unary(),
+    )
+    .await
+    .map_err(|e| io::Error::other(format!("connect to {}: {}", addr, e)))?;
+    let mut client = volume_server_client(channel);
+    client
+        .volume_ec_blob_delete(Request::new(VolumeEcBlobDeleteRequest {
+            volume_id: target.vid.0,
+            collection: target.collection.to_string(),
+            file_key: target.needle_id.0,
+            version: target.version.0 as u32,
+        }))
+        .await
+        .map_err(|e| io::Error::other(format!("volume_ec_blob_delete on {}: {}", addr, e)))?;
+    Ok(())
+}
+
+/// Journals on the local volume — what the `VolumeEcBlobDelete` handler runs
+/// when this server is the shard holder. An absent needle is an error, not a
+/// no-op: `journal_delete` would accept it silently, but here it means the
+/// volume remounted as a different generation mid-delete and the tombstone
+/// should go to a replica that still has the needle.
+fn journal_delete_local(
+    state: &Arc<VolumeServerState>,
+    vid: VolumeId,
+    needle_id: NeedleId,
+) -> io::Result<()> {
+    let mut store = state.store.write().unwrap();
+    // Membership is read under the write lock: a decode can claim the
+    // publishing tail while this call waited for the decoder's read lock,
+    // so a check taken earlier would be stale by commit time.
+    if crate::server::grpc_server::ec_decode_tail_contains(state, vid) {
+        return Err(io::Error::new(
+            io::ErrorKind::WouldBlock,
+            format!("ec volume {} is in decode publishing tail", vid.0),
+        ));
+    }
+    let ecv = store.find_ec_volume_mut(vid).ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::NotFound,
+            format!("ec volume {} unmounted", vid.0),
+        )
+    })?;
+    match ecv.find_needle_from_ecx(needle_id)? {
+        None => {
+            return Err(io::Error::new(
+                io::ErrorKind::NotFound,
+                format!("needle {} not in local ecx", needle_id),
+            ));
+        }
+        Some((_, size)) if size.is_deleted() => return Ok(()),
+        Some(_) => {}
+    }
+    ecv.journal_delete(needle_id)
+}
+
+fn local_shard_ids(ecv: &crate::storage::erasure_coding::EcVolume) -> HashSet<ShardId> {
+    ecv.shards
+        .iter()
+        .enumerate()
+        .filter_map(|(i, s)| s.as_ref().map(|_| i as ShardId))
+        .collect()
 }
 
 /// FULL EC scrub: verify every needle's bytes across local AND remote shards,
 /// without decoding (so genuine shard faults are reported rather than healed).
 /// Mirrors Go's `Store.ScrubEcVolume`. Returns (rows walked, broken shards,
 /// errors). `force_deleted_needles_check` disables the benign delete-state
-/// size-mismatch suppression.
+/// size-mismatch suppression. `recover_unreadable` (READS mode) rebuilds an
+/// unreadable interval from the surviving shards: the same shards are reported
+/// broken, but only needles parity can no longer recover become errors.
 ///
 /// Shard locations are refreshed once up front. Each needle is then processed via
 /// `scrub_snapshot_under_lock` + lock-drop + no-reconstruct `read_remote_ec_shard_interval`,
@@ -216,49 +548,131 @@ pub async fn read_ec_shard_needle_distributed(
 pub async fn scrub_ec_volume_distributed(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
+    expected_encode_ts_ns: i64,
     force_deleted_needles_check: bool,
-) -> (i64, Vec<crate::pb::volume_server_pb::EcShardInfo>, Vec<String>) {
-    // Phase A — under the Store read lock, run the index scrub and grab the
+    recover_unreadable: bool,
+) -> (
+    i64,
+    Vec<crate::pb::volume_server_pb::EcShardInfo>,
+    Vec<String>,
+) {
+    // Phase A — under the Store read lock, snapshot the index scrub and grab the
     // paths/scalars + shard-location staleness; release the lock before any await.
-    let (ecx_path, collection, seed_errs, cached_locations, cache_refreshed_at, data_shards, total_shards) = {
+    let (
+        ecx_path,
+        collection,
+        index_plan,
+        ecx_walk,
+        encode_ts_ns,
+        cached_locations,
+        cache_refreshed_at,
+        data_shards,
+        total_shards,
+    ) = {
         let store = state.store.read().unwrap();
-        let ecv = match store.find_ec_volume(vid) {
+        // Resolve the runtime matching the anchor's encode generation, not the
+        // first-match find_ec_volume — otherwise the needle walk can scan an
+        // older run while the parity half scans the newest.
+        let ecv = match find_ec_volume_for_scrub(&store, vid, expected_encode_ts_ns) {
             Some(v) => v,
             None => {
                 return (
                     0,
                     Vec::new(),
                     vec![format!("EC volume id {} not found", vid.0)],
-                )
+                );
             }
         };
         // full scan means verifying the index as well
-        let (_, errs) = ecv.scrub_index();
-        // Bind to locals so the inner RwLock/Mutex guards drop before the block ends.
-        let cached_locations = ecv.shard_locations.read().unwrap().clone();
-        let cache_refreshed_at = *ecv.shard_locations_refresh_time.lock().unwrap();
+        let index_plan = ecv.scrub_index_plan();
+        // A SECOND .ecx descriptor, opened under the guard for the needle walk
+        // below. The index plan's handle is consumed by its own structural walk,
+        // and both seek, so a `dup` would race the cursor. Reopening by PATH
+        // after the guard is dropped would let a teardown that legitimately
+        // unlinks or replaces the .ecx (the heartbeat's
+        // delete_expired_ec_volumes, volume_ec_shards_delete) surface an
+        // intentional removal as a scrub error or mix index generations within
+        // one scrub — the same race the vanished-volume policy exists to hide.
+        // The descriptor outlives the name, the same way the checksum plan's
+        // shard handles do.
+        let ecx_walk = fs::File::open(ecv.ecx_file_name());
+        // Encode-run identity of the volume this scrub started against. The
+        // per-needle `scrub_snapshot_under_lock` re-resolves the volume by id
+        // under a fresh guard, so a teardown-and-remount of the same vid between
+        // two rows would otherwise apply the captured .ecx's offsets to a
+        // replacement volume's shards. Bind the walk to this generation: if the
+        // mounted volume's encode_ts_ns no longer matches, abort like a
+        // mid-scan unmount rather than mixing generations.
+        let encode_ts_ns = ecv.encode_ts_ns;
+        // One read section, so the map and the refresh time it is aged against
+        // describe the same lookup.
+        let (cached_locations, cache_refreshed_at) = ecv.shard_locations_snapshot();
         let data_shards = ecv.data_shards as usize;
         let total_shards = (ecv.data_shards + ecv.parity_shards) as usize;
         (
             ecv.ecx_file_name(),
             ecv.collection.clone(),
-            errs,
+            index_plan,
+            ecx_walk,
+            encode_ts_ns,
             cached_locations,
             cache_refreshed_at,
             data_shards,
             total_shards,
         )
     };
+    // Lock released: walk the index now, before anything else appends to errs,
+    // so the seeded errors keep their position in the reported details.
+    //
+    // `index_plan.run()` reads the whole .ecx synchronously, so run it in the
+    // blocking pool rather than on this async worker — a large index scan would
+    // otherwise block unrelated RPC work handled on the same executor. Same
+    // treatment as the CHECKSUM/LOCAL plans in the gRPC handler.
+    let (_, seed_errs) = match tokio::task::spawn_blocking(move || index_plan.run()).await {
+        Ok(v) => v,
+        Err(e) => {
+            // A panic is evidence about the volume and counts as broken; a
+            // cancellation is not — spawn_blocking only reports it when the
+            // runtime is going down, the volume was never scanned, and the
+            // caller (FULL/READS) would put a false corruption into
+            // broken_volume_ids if it reached the errs path. Match the
+            // record_scrub_join_failure distinction used by the handler arms.
+            if e.is_panic() {
+                return (
+                    0,
+                    Vec::new(),
+                    vec![format!(
+                        "EC volume {} index scrub task panicked: {}",
+                        vid.0, e
+                    )],
+                );
+            }
+            // Cancellation: the runtime is shutting down, so this response is
+            // unlikely to reach anyone. Return clean rather than inventing a
+            // corruption for a volume that was never scanned.
+            return (0, Vec::new(), Vec::new());
+        }
+    };
     let mut errs = seed_errs;
 
     // Refresh the shard-location cache once up front (mirrors Go's
     // cachedLookupEcShardLocations). A partial reply (< data_shards locations, a
     // master mid-recovery) or a failed lookup is a hard, retryable error — never
     // overwrite a good cache with a partial map or storm a down master per needle.
-    if needs_refresh(&cached_locations, cache_refreshed_at, data_shards, total_shards) {
+    if claim_shard_locations_refresh(
+        state,
+        vid,
+        &cached_locations,
+        cache_refreshed_at,
+        data_shards,
+        total_shards,
+    ) {
         match cached_lookup_ec_shard_locations(state, vid).await {
             Ok(fresh) => {
-                if write_back_shard_locations(state, vid, fresh, data_shards).is_none() {
+                if write_back_shard_locations(state, vid, fresh, data_shards, expected_encode_ts_ns)
+                    .is_none()
+                {
+                    mark_shard_locations_stale(state, vid);
                     return (
                         0,
                         Vec::new(),
@@ -270,11 +684,12 @@ pub async fn scrub_ec_volume_distributed(
                 }
             }
             Err(e) => {
+                mark_shard_locations_stale(state, vid);
                 return (
                     0,
                     Vec::new(),
                     vec![format!("failed to locate shard via master grpc: {}", e)],
-                )
+                );
             }
         }
     }
@@ -283,53 +698,88 @@ pub async fn scrub_ec_volume_distributed(
     // walk, so per-needle snapshots no longer clone it.
     let locations: HashMap<ShardId, Vec<String>> = {
         let store = state.store.read().unwrap();
-        let ecv = match store.find_ec_volume(vid) {
+        let ecv = match find_ec_volume_for_scrub(&store, vid, expected_encode_ts_ns) {
             Some(v) => v,
             None => {
                 return (
                     0,
                     Vec::new(),
                     vec![format!("EC volume id {} not found", vid.0)],
-                )
+                );
             }
         };
-        let map = ecv.shard_locations.read().unwrap().clone();
-        map
+        ecv.shard_locations_snapshot().0
     };
 
-    // Walk the .ecx (private fd, no lock) for the row count + live (id, offset, size).
-    let mut count: i64 = 0;
-    let mut needles: Vec<(NeedleId, Offset, Size)> = Vec::new();
-    match fs::File::open(&ecx_path) {
-        Ok(mut f) => {
-            if let Err(e) = crate::storage::idx::walk_index_file(&mut f, 0, |id, offset, size| {
-                count += 1;
-                // Skip ALL deleted entries: -1 tombstones (runtime delete folded
-                // into .ecx) and -originalSize entries (a needle deleted on the
-                // regular volume before EC encode). get_actual_size uses the raw
-                // signed size, so a negative would yield empty intervals
-                // (false-positive) or an under-16-byte buffer (parse panic).
-                if !size.is_deleted() {
-                    needles.push((id, offset, size));
+    // Walk the .ecx (private fd captured under the lock, no lock held) for the
+    // row count + live (id, offset, size). Reading through the captured
+    // descriptor — not a pathname reopen — keeps a concurrent teardown from
+    // surfacing an intentional removal as a scrub error or mixing index
+    // generations, the same invariant the vanished-volume policy enforces.
+    //
+    // `walk_index_file` reads the full .ecx synchronously, so run it in the
+    // blocking pool rather than on this async worker — same reason as
+    // `index_plan.run()` above.
+    let (count, needles, walk_errs) = match tokio::task::spawn_blocking(
+        move || -> (i64, Vec<(NeedleId, Offset, Size)>, Vec<String>) {
+            let mut count: i64 = 0;
+            let mut needles: Vec<(NeedleId, Offset, Size)> = Vec::new();
+            let mut walk_errs: Vec<String> = Vec::new();
+            match ecx_walk {
+                Ok(mut f) => {
+                    if let Err(e) =
+                        crate::storage::idx::walk_index_file(&mut f, 0, |id, offset, size| {
+                            count += 1;
+                            // Skip ALL deleted entries: -1 tombstones (runtime delete folded
+                            // into .ecx) and -originalSize entries (a needle deleted on the
+                            // regular volume before EC encode). get_actual_size uses the raw
+                            // signed size, so a negative would yield empty intervals
+                            // (false-positive) or an under-16-byte buffer (parse panic).
+                            if !size.is_deleted() {
+                                needles.push((id, offset, size));
+                            }
+                            Ok(())
+                        })
+                    {
+                        walk_errs.push(format!("walk ECX file {}: {}", ecx_path, e));
+                    }
                 }
-                Ok(())
-            }) {
-                errs.push(format!("walk ECX file {}: {}", ecx_path, e));
+                Err(e) => walk_errs.push(format!("open ECX file {}: {}", ecx_path, e)),
             }
+            (count, needles, walk_errs)
+        },
+    )
+    .await
+    {
+        Ok(v) => v,
+        Err(e) => {
+            // A panic is evidence about the volume and counts as broken; a
+            // cancellation is not — see the index_plan join above for the
+            // same reasoning.
+            if e.is_panic() {
+                return (
+                    0,
+                    Vec::new(),
+                    vec![format!("EC volume {} ecx walk task panicked: {}", vid.0, e)],
+                );
+            }
+            return (0, Vec::new(), Vec::new());
         }
-        Err(e) => errs.push(format!("open ECX file {}: {}", ecx_path, e)),
-    }
+    };
+    errs.extend(walk_errs);
 
     // reads for EC chunks can hit the same shard repeatedly, so dedupe broken shards
-    let mut broken_shards: HashMap<ShardId, crate::pb::volume_server_pb::EcShardInfo> = HashMap::new();
+    let mut broken_shards: HashMap<ShardId, crate::pb::volume_server_pb::EcShardInfo> =
+        HashMap::new();
 
     for (id, offset, size) in needles {
         // Per-needle snapshot under the lock from the RAW .ecx (offset, size) so
         // logically-deleted needles are still verified; lock dropped before await.
-        let snapshot = match scrub_snapshot_under_lock(state, vid, offset, size) {
+        let snapshot = match scrub_snapshot_under_lock(state, vid, offset, size, encode_ts_ns) {
             Ok(s) => s,
-            // Volume unmounted mid-scan: abort with an error rather than skipping
-            // every remaining needle, which would report a false-CLEAN result.
+            // Volume unmounted (or remounted as a different encode run) mid-scan:
+            // abort with an error rather than skipping every remaining needle,
+            // which would report a false-CLEAN result.
             Err(e) if e.kind() == io::ErrorKind::NotFound => {
                 errs.push(format!("EC volume {} unmounted during scrub: {}", vid.0, e));
                 break;
@@ -340,8 +790,9 @@ pub async fn scrub_ec_volume_distributed(
             }
         };
 
-        // Read each interval local-then-remote WITHOUT reconstructing: we verify
-        // the shards are valid, we do not heal them. Locations refreshed above.
+        // Read each interval local-then-remote. Neither read decodes: the point is to
+        // find shards that are themselves broken, not to heal around them. READS then
+        // rebuilds what it could not read. Locations refreshed above.
         let n_intervals = snapshot.intervals.len();
         let mut data: Vec<u8> = Vec::with_capacity(snapshot.actual_size);
         for (i, res) in snapshot.intervals.iter().enumerate() {
@@ -354,28 +805,23 @@ pub async fn scrub_ec_volume_distributed(
                 } => {
                     let sources: &[String] =
                         locations.get(shard_id).map(Vec::as_slice).unwrap_or(&[]);
-                    match read_remote_ec_shard_interval(
-                        state,
-                        sources,
+                    let iv = EcInterval {
                         vid,
-                        id,
-                        *shard_id,
-                        *shard_offset,
-                        *ssize,
-                        snapshot.encode_ts_ns,
-                    )
-                    .await
-                    {
+                        needle_id: id,
+                        shard_id: *shard_id,
+                        shard_offset: *shard_offset,
+                        size: *ssize,
+                        expected_encode_ts_ns: snapshot.encode_ts_ns,
+                    };
+                    match read_remote_ec_shard_interval(state, sources, iv).await {
                         // A deleted shard yields no bytes; zero-fill the interval so
                         // the assembled needle reaches read_bytes -> SizeMismatch{0}
                         // -> the delete-state suppression (mirrors Go's pre-zeroed buffer).
                         Ok((_, true)) => data.resize(data.len() + *ssize, 0),
                         Ok((buf, false)) => data.extend_from_slice(&buf),
-                        Err(_) => {
-                            errs.push(format!(
-                                "failed to read EC shard {} for needle {} on volume {} (interval {}/{})",
-                                shard_id, id.0, vid.0, i + 1, n_intervals
-                            ));
+                        Err(read_err) => {
+                            // The shard is broken whether or not the needle survives it,
+                            // so report it either way.
                             broken_shards.insert(
                                 *shard_id,
                                 crate::pb::volume_server_pb::EcShardInfo {
@@ -386,7 +832,38 @@ pub async fn scrub_ec_volume_distributed(
                                     ..Default::default()
                                 },
                             );
-                            break;
+                            if !recover_unreadable {
+                                errs.push(format!(
+                                    "failed to read EC shard {} for needle {} on volume {} (interval {}/{}): {}",
+                                    shard_id, id.0, vid.0, i + 1, n_intervals, read_err
+                                ));
+                                break;
+                            }
+                            match recover_one_remote_ec_shard_interval(
+                                state,
+                                iv,
+                                EcShardMap {
+                                    locations: &locations,
+                                    data_shards,
+                                    parity_shards: total_shards - data_shards,
+                                },
+                            )
+                            .await
+                            {
+                                // Same as the direct read above: a holder reporting the
+                                // needle deleted is authoritative and answers with no
+                                // bytes, so zero-fill and let the delete-state
+                                // suppression have it.
+                                Ok((_, true)) => data.resize(data.len() + *ssize, 0),
+                                Ok((buf, false)) => data.extend_from_slice(&buf),
+                                Err(e) => {
+                                    errs.push(format!(
+                                        "failed to recover EC shard {} for needle {} on volume {} (interval {}/{}): {}",
+                                        shard_id, id.0, vid.0, i + 1, n_intervals, e
+                                    ));
+                                    break;
+                                }
+                            }
                         }
                     }
                 }
@@ -422,7 +899,11 @@ pub async fn scrub_ec_volume_distributed(
     // Mirror Go CmpEcShardInfo: sort by (volume_id, shard_id).
     let mut broken: Vec<crate::pb::volume_server_pb::EcShardInfo> =
         broken_shards.into_values().collect();
-    broken.sort_by(|a, b| a.volume_id.cmp(&b.volume_id).then(a.shard_id.cmp(&b.shard_id)));
+    broken.sort_by(|a, b| {
+        a.volume_id
+            .cmp(&b.volume_id)
+            .then(a.shard_id.cmp(&b.shard_id))
+    });
 
     (count, broken, errs)
 }
@@ -431,11 +912,10 @@ fn snapshot_under_lock(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
     needle_id: NeedleId,
-) -> io::Result<Option<Snapshot>> {
+) -> io::Result<Result<Snapshot, EcMiss>> {
     let store = state.store.read().unwrap();
-    let ecv = match store.find_ec_volume(vid) {
-        Some(v) => v,
-        None => return Ok(None),
+    let Some(ecv) = store.find_ec_volume(vid) else {
+        return Ok(Err(EcMiss::VolumeNotFound));
     };
 
     // Reuse EcVolume::locate_needle for offset/size resolution AND
@@ -443,11 +923,17 @@ fn snapshot_under_lock(
     // local-only read path uses, so we stay byte-identical on the
     // shard-size + interval boundaries. locate_needle applies the runtime
     // delete mask, which is correct for serving reads.
-    let (offset, size, intervals) = match ecv.locate_needle(needle_id)? {
-        Some(v) => v,
-        None => return Ok(None),
+    let Some((offset, size, intervals)) = ecv.locate_needle(needle_id)? else {
+        // locate_needle folds a tombstone into not-found.
+        let deleted =
+            matches!(ecv.find_needle_from_ecx(needle_id)?, Some((_, s)) if s.is_deleted());
+        return Ok(Err(if deleted {
+            EcMiss::Deleted
+        } else {
+            EcMiss::NotFound
+        }));
     };
-    build_snapshot(ecv, offset, size, &intervals).map(Some)
+    build_snapshot(ecv, offset, size, &intervals).map(Ok)
 }
 
 /// Like `snapshot_under_lock`, but locates intervals from the RAW .ecx
@@ -460,9 +946,10 @@ fn scrub_snapshot_under_lock(
     vid: VolumeId,
     offset: Offset,
     size: Size,
+    expected_encode_ts: i64,
 ) -> io::Result<ScrubSnapshot> {
     let store = state.store.read().unwrap();
-    let ecv = match store.find_ec_volume(vid) {
+    let ecv = match find_ec_volume_for_scrub(&store, vid, expected_encode_ts) {
         Some(v) => v,
         // Volume unmounted mid-scan: a distinct NotFound so the caller aborts
         // with an error rather than silently skipping (which would false-CLEAN).
@@ -470,9 +957,31 @@ fn scrub_snapshot_under_lock(
             return Err(io::Error::new(
                 io::ErrorKind::NotFound,
                 format!("EC volume {} not found (unmounted mid-scan)", vid.0),
-            ))
+            ));
         }
     };
+    // The volume was torn down and remounted as a DIFFERENT encode run between
+    // two rows. The .ecx offsets captured at the start of the walk belong to
+    // the old generation; applying them to the replacement's shards would
+    // falsely report corruption. Abort like a mid-scan unmount instead of
+    // mixing generations within one scrub.
+    //
+    // `encode_ts_ns == 0` means the .vif carried no encode-run identity (a
+    // legacy or pre-feature volume). Two such volumes are NOT the same mount
+    // by this check alone — 0 == 0 would accept a teardown-and-remount and
+    // apply the old .ecx's offsets to the replacement's shards. Only treat a
+    // match as verified when the identity is non-zero; when it is zero, fall
+    // back to the pre-check behavior (no generation binding) rather than
+    // aborting a scrub that was already running without the guard.
+    if expected_encode_ts != 0 && ecv.encode_ts_ns != expected_encode_ts {
+        return Err(io::Error::new(
+            io::ErrorKind::NotFound,
+            format!(
+                "EC volume {} remounted as a different encode run during scrub (was {}, now {})",
+                vid.0, expected_encode_ts, ecv.encode_ts_ns
+            ),
+        ));
+    }
     let intervals = ecv.locate_ec_shard_needle_interval(offset.to_actual_offset(), size);
     if intervals.is_empty() {
         return Err(io::Error::new(
@@ -508,7 +1017,7 @@ fn read_local_intervals(
 ) -> Vec<IntervalResult> {
     let mut interval_results = Vec::with_capacity(intervals.len());
     for interval in intervals {
-        let (shard_id, shard_offset) = interval.to_shard_id_and_offset(ecv.data_shards);
+        let (shard_id, shard_offset) = ecv.interval_to_shard_id_and_offset(interval);
         let buf_size = interval.size as usize;
         let local = ecv.shards.get(shard_id as usize).and_then(|s| s.as_ref());
         match local {
@@ -549,8 +1058,7 @@ fn build_snapshot(
     }
     let actual = get_actual_size(size, ecv.version);
     let interval_results = read_local_intervals(ecv, intervals);
-    let cached_locations = ecv.shard_locations.read().unwrap().clone();
-    let cache_refreshed_at = *ecv.shard_locations_refresh_time.lock().unwrap();
+    let (cached_locations, cache_refreshed_at) = ecv.shard_locations_snapshot();
 
     Ok(Snapshot {
         data_shards: ecv.data_shards,
@@ -571,6 +1079,7 @@ fn build_snapshot(
 fn needs_refresh(
     locations: &HashMap<ShardId, Vec<String>>,
     refreshed_at: Option<Instant>,
+    stale: bool,
     data_shards: usize,
     total_shards: usize,
 ) -> bool {
@@ -580,56 +1089,77 @@ fn needs_refresh(
         None => return true,
     };
     let shard_count = locations.len();
-    if shard_count < data_shards && age < Duration::from_secs(11) {
-        return false;
+    // A complete map is trusted longest. One short of data_shards, or one a
+    // failed read has just disproved, is re-checked promptly: until it is, reads
+    // keep aiming at a location the shard has left.
+    let ttl = if stale || shard_count < data_shards {
+        Duration::from_secs(11)
+    } else if shard_count == total_shards {
+        Duration::from_mins(37)
+    } else {
+        Duration::from_mins(7)
+    };
+    age >= ttl
+}
+
+/// Mark the cached shard map for a prompt re-check after a read failed against
+/// one of its locations. Go drops the entry outright in `forgetShardId`, which
+/// costs it the direct read until the map is re-learned; here the entry stays
+/// (a dead peer just fails fast on the next attempt) and only the freshness
+/// window is cut, so a shard that has moved is picked up in seconds either way.
+fn mark_shard_locations_stale(state: &Arc<VolumeServerState>, vid: VolumeId) {
+    let store = state.store.read().unwrap();
+    if let Some(ecv) = store.find_ec_volume(vid) {
+        ecv.mark_shard_locations_stale();
     }
-    if shard_count == total_shards && age < Duration::from_secs(37 * 60) {
-        return false;
-    }
-    if shard_count >= data_shards && age < Duration::from_secs(7 * 60) {
-        return false;
-    }
-    true
+}
+
+/// Decide whether the caller's snapshot is due a master lookup and, when it is,
+/// consume the cache's stale mark in the same critical section. A mark raised
+/// from here on belongs to the next refresh: the read that raised it has
+/// disproved the map this lookup is about to install.
+fn claim_shard_locations_refresh(
+    state: &Arc<VolumeServerState>,
+    vid: VolumeId,
+    locations: &HashMap<ShardId, Vec<String>>,
+    refreshed_at: Option<Instant>,
+    data_shards: usize,
+    total_shards: usize,
+) -> bool {
+    let store = state.store.read().unwrap();
+    let Some(ecv) = store.find_ec_volume(vid) else {
+        return needs_refresh(locations, refreshed_at, false, data_shards, total_shards);
+    };
+    ecv.claim_shard_locations_refresh(|stale| {
+        needs_refresh(locations, refreshed_at, stale, data_shards, total_shards)
+    })
 }
 
 async fn cached_lookup_ec_shard_locations(
     state: &Arc<VolumeServerState>,
     vid: VolumeId,
 ) -> io::Result<HashMap<ShardId, Vec<String>>> {
-    let master = {
-        let live = state.current_master_url.read().await.clone();
-        if !live.is_empty() {
-            live
-        } else {
-            state.master_url.clone()
-        }
-    };
+    let master = state.current_master().await;
     if master.is_empty() {
-        return Err(io::Error::new(
-            io::ErrorKind::Other,
-            "no master configured for ec shard lookup",
-        ));
+        return Err(io::Error::other("no master leader known for ec shard lookup"));
     }
 
-    let grpc_addr = parse_grpc_address(&master)
-        .map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
-    let endpoint = build_grpc_endpoint(&grpc_addr, state.outgoing_grpc_tls.as_ref())
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))?;
-    let channel = endpoint
-        .connect_timeout(Duration::from_secs(5))
-        .timeout(Duration::from_secs(10))
-        .connect()
-        .await
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("master connect: {}", e)))?;
+    let grpc_addr =
+        parse_grpc_address(&master).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
+    let channel = connect_channel(
+        &grpc_addr,
+        state.outgoing_grpc_tls.as_ref(),
+        GrpcDialOptions::unary(),
+    )
+    .await
+    .map_err(|e| io::Error::other(format!("master connect: {}", e)))?;
 
-    let mut client = SeaweedClient::with_interceptor(channel, outgoing_request_id_interceptor)
-        .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-        .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    let mut client = master_client(channel);
 
     let resp = client
         .lookup_ec_volume(Request::new(LookupEcVolumeRequest { volume_id: vid.0 }))
         .await
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("lookup_ec_volume: {}", e)))?;
+        .map_err(|e| io::Error::other(format!("lookup_ec_volume: {}", e)))?;
     let resp = resp.into_inner();
 
     let mut out = HashMap::new();
@@ -639,7 +1169,12 @@ async fn cached_lookup_ec_shard_locations(
             .iter()
             .map(format_location_as_server_address)
             .collect();
-        out.insert(entry.shard_id as ShardId, addrs);
+        // Defensive: skip out-of-range shard ids from the master instead of
+        // truncating (256 would alias 0). Valid replies are unaffected.
+        let Ok(sid) = shard_id_try_from(entry.shard_id) else {
+            continue;
+        };
+        out.insert(sid, addrs);
     }
     Ok(out)
 }
@@ -660,15 +1195,34 @@ fn write_back_shard_locations(
     vid: VolumeId,
     locations: HashMap<ShardId, Vec<String>>,
     data_shards: usize,
+    expected_encode_ts_ns: i64,
 ) -> Option<HashMap<ShardId, Vec<String>>> {
     if locations.len() < data_shards {
         return None;
     }
     let store = state.store.read().unwrap();
-    let ecv = store.find_ec_volume(vid)?;
+    let ecv = find_ec_volume_for_scrub(&store, vid, expected_encode_ts_ns)?;
     Some(ecv.merge_shard_locations(locations))
 }
 
+/// Resolve the runtime matching the scrub's anchor encode generation, not the
+/// first-match `find_ec_volume`. When `expected_encode_ts_ns` is 0 (legacy or
+/// pre-feature), falls back to first-match so existing behavior is preserved.
+fn find_ec_volume_for_scrub(
+    store: &crate::storage::store::Store,
+    vid: VolumeId,
+    expected_encode_ts_ns: i64,
+) -> Option<&crate::storage::erasure_coding::EcVolume> {
+    if expected_encode_ts_ns != 0 {
+        store
+            .find_all_ec_volumes(vid)
+            .into_iter()
+            .find(|v| v.encode_ts_ns == expected_encode_ts_ns)
+    } else {
+        store.find_ec_volume(vid)
+    }
+}
+
 /// Build a SeaweedFS-style `host:httpPort.grpcPort` address from a
 /// master `Location` so the result is what `parse_grpc_address` (and
 /// the heartbeat path) already understand.
@@ -677,101 +1231,83 @@ fn format_location_as_server_address(loc: &master_pb::Location) -> String {
         .url
         .trim_start_matches("http://")
         .trim_start_matches("https://");
-    if loc.grpc_port > 0 {
-        if let Some((host, http_port)) = raw.rsplit_once(':') {
-            return format!("{}:{}.{}", host, http_port, loc.grpc_port);
-        }
+    if loc.grpc_port > 0
+        && let Some((host, http_port)) = raw.rsplit_once(':')
+    {
+        return format!("{}:{}.{}", host, http_port, loc.grpc_port);
     }
     raw.to_string()
 }
 
+/// One shard-relative byte range of a needle on an EC volume, the unit the
+/// peer-read and recovery paths work in. Mirrors the argument list of Go's
+/// `readOneEcShardInterval`.
+#[derive(Clone, Copy, Debug)]
+struct EcInterval {
+    vid: VolumeId,
+    needle_id: NeedleId,
+    /// The shard the bytes live on, or the one to rebuild when recovering.
+    shard_id: ShardId,
+    shard_offset: i64,
+    size: usize,
+    /// Encode run the caller expects the shard to belong to; 0 accepts any,
+    /// for peers that predate the identity check.
+    expected_encode_ts_ns: i64,
+}
+
+/// Where the shards of one EC volume can be fetched from, and the volume's
+/// Reed-Solomon shape, as recovery needs both together.
+#[derive(Clone, Copy)]
+struct EcShardMap<'a> {
+    locations: &'a HashMap<ShardId, Vec<String>>,
+    data_shards: usize,
+    parity_shards: usize,
+}
+
 /// Try direct peer read; on failure, reconstruct via Reed-Solomon
 /// from the other shards. Mirrors `readOneEcShardInterval`'s tail.
 async fn fetch_one_interval(
     state: &Arc<VolumeServerState>,
-    vid: VolumeId,
-    needle_id: NeedleId,
-    shard_id: ShardId,
-    shard_offset: i64,
-    size: usize,
-    shard_locations: &HashMap<ShardId, Vec<String>>,
-    data_shards: usize,
-    parity_shards: usize,
-    expected_encode_ts_ns: i64,
+    iv: EcInterval,
+    map: EcShardMap<'_>,
 ) -> io::Result<(Vec<u8>, bool)> {
+    let EcInterval { vid, shard_id, .. } = iv;
     // Direct peer read against the cached locations for this shard.
-    if let Some(sources) = shard_locations.get(&shard_id) {
-        if !sources.is_empty() {
-            match read_remote_ec_shard_interval(
-                state,
-                sources,
-                vid,
-                needle_id,
-                shard_id,
-                shard_offset,
-                size,
-                expected_encode_ts_ns,
-            )
-            .await
-            {
-                // A deleted needle short-circuits: don't reconstruct (every shard
-                // would report deleted), let the caller return "deleted".
-                Ok((buf, is_deleted)) => return Ok((buf, is_deleted)),
-                Err(e) => {
-                    tracing::debug!(
-                        "direct read ec shard {}.{} from {:?} failed: {} — will reconstruct",
-                        vid.0,
-                        shard_id,
-                        sources,
-                        e
-                    );
-                }
+    if let Some(sources) = map.locations.get(&shard_id)
+        && !sources.is_empty()
+    {
+        match read_remote_ec_shard_interval(state, sources, iv).await {
+            // A deleted needle short-circuits: don't reconstruct (every shard
+            // would report deleted), let the caller return "deleted".
+            Ok((buf, is_deleted)) => return Ok((buf, is_deleted)),
+            Err(e) => {
+                tracing::debug!(
+                    "direct read ec shard {}.{} from {:?} failed: {} — will reconstruct",
+                    vid.0,
+                    shard_id,
+                    sources,
+                    e
+                );
+                // Reconstruction below skips this very shard, so nothing else
+                // invalidates the location that just failed.
+                mark_shard_locations_stale(state, vid);
             }
         }
     }
 
     // Reconstruct: fan-out reads to every other shard at the same
     // (shard_offset, size). Mirrors `recoverOneRemoteEcShardInterval`.
-    let buf = recover_one_remote_ec_shard_interval(
-        state,
-        vid,
-        needle_id,
-        shard_id,
-        shard_offset,
-        size,
-        shard_locations,
-        data_shards,
-        parity_shards,
-        expected_encode_ts_ns,
-    )
-    .await?;
-    Ok((buf, false))
+    recover_one_remote_ec_shard_interval(state, iv, map).await
 }
 
 async fn read_remote_ec_shard_interval(
     state: &Arc<VolumeServerState>,
     sources: &[String],
-    vid: VolumeId,
-    needle_id: NeedleId,
-    shard_id: ShardId,
-    shard_offset: i64,
-    size: usize,
-    expected_encode_ts_ns: i64,
+    iv: EcInterval,
 ) -> io::Result<(Vec<u8>, bool)> {
     let mut last_err: Option<io::Error> = None;
     for src in sources {
-        match do_read_remote_ec_shard_interval(
-            state,
-            src,
-            vid,
-            needle_id,
-            shard_id,
-            shard_offset,
-            size,
-            expected_encode_ts_ns,
-        )
-        .await
-        {
+        match do_read_remote_ec_shard_interval(state, src, iv).await {
             Ok(res) => return Ok(res),
             Err(e) => last_err = Some(e),
         }
@@ -779,7 +1315,7 @@ async fn read_remote_ec_shard_interval(
     Err(last_err.unwrap_or_else(|| {
         io::Error::new(
             io::ErrorKind::NotFound,
-            format!("no source for ec shard {}.{}", vid.0, shard_id),
+            format!("no source for ec shard {}.{}", iv.vid.0, iv.shard_id),
         )
     }))
 }
@@ -787,28 +1323,25 @@ async fn read_remote_ec_shard_interval(
 async fn do_read_remote_ec_shard_interval(
     state: &Arc<VolumeServerState>,
     source: &str,
-    vid: VolumeId,
-    needle_id: NeedleId,
-    shard_id: ShardId,
-    shard_offset: i64,
-    size: usize,
-    expected_encode_ts_ns: i64,
+    iv: EcInterval,
 ) -> io::Result<(Vec<u8>, bool)> {
+    let EcInterval {
+        vid,
+        needle_id,
+        shard_id,
+        shard_offset,
+        size,
+        expected_encode_ts_ns,
+    } = iv;
     let grpc_addr =
         parse_grpc_address(source).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
-    let endpoint = build_grpc_endpoint(&grpc_addr, state.outgoing_grpc_tls.as_ref())
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))?;
-    let channel = endpoint
-        .connect_timeout(Duration::from_secs(5))
-        .timeout(Duration::from_secs(30))
-        .connect()
-        .await
-        .map_err(|e| {
-            io::Error::new(
-                io::ErrorKind::Other,
-                format!("connect to {}: {}", source, e),
-            )
-        })?;
+    let channel = connect_channel(
+        &grpc_addr,
+        state.outgoing_grpc_tls.as_ref(),
+        GrpcDialOptions::long(),
+    )
+    .await
+    .map_err(|e| io::Error::other(format!("connect to {}: {}", source, e)))?;
 
     // TODO(grpc-jwt): clusters with `jwt.signing.key` configured will
     // reject peer-to-peer VolumeEcShardRead calls until the Rust
@@ -818,9 +1351,7 @@ async fn do_read_remote_ec_shard_interval(
     // here in isolation would split the credential plumbing across
     // call sites. Re-visit when outgoing JWT signing lands as a
     // server-wide helper.
-    let mut client = VolumeServerClient::with_interceptor(channel, outgoing_request_id_interceptor)
-        .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-        .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    let mut client = volume_server_client(channel);
 
     let req = VolumeEcShardReadRequest {
         volume_id: vid.0,
@@ -834,10 +1365,10 @@ async fn do_read_remote_ec_shard_interval(
         .volume_ec_shard_read(Request::new(req))
         .await
         .map_err(|e| {
-            io::Error::new(
-                io::ErrorKind::Other,
-                format!("volume_ec_shard_read {}.{} from {}: {}", vid.0, shard_id, source, e),
-            )
+            io::Error::other(format!(
+                "volume_ec_shard_read {}.{} from {}: {}",
+                vid.0, shard_id, source, e
+            ))
         })?;
     let mut stream = resp.into_inner();
 
@@ -846,19 +1377,16 @@ async fn do_read_remote_ec_shard_interval(
     while let Some(msg) = stream
         .message()
         .await
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("recv: {}", e)))?
+        .map_err(|e| io::Error::other(format!("recv: {}", e)))?
     {
         // Validate the served shard's identity client-side, so the guard holds even
         // against a pre-upgrade server that ignored the request field (returns 0).
         // A mismatch fails the read; the caller recovers from parity.
         if expected_encode_ts_ns != 0 && msg.encode_ts_ns != expected_encode_ts_ns {
-            return Err(io::Error::new(
-                io::ErrorKind::Other,
-                format!(
-                    "ec shard {}.{} from {} belongs to a different encode run (want {} got {})",
-                    vid.0, shard_id, source, expected_encode_ts_ns, msg.encode_ts_ns
-                ),
-            ));
+            return Err(io::Error::other(format!(
+                "ec shard {}.{} from {} belongs to a different encode run (want {} got {})",
+                vid.0, shard_id, source, expected_encode_ts_ns, msg.encode_ts_ns
+            )));
         }
         if msg.is_deleted {
             is_deleted = true;
@@ -896,23 +1424,39 @@ async fn do_read_remote_ec_shard_interval(
 
 async fn recover_one_remote_ec_shard_interval(
     state: &Arc<VolumeServerState>,
-    vid: VolumeId,
-    needle_id: NeedleId,
-    shard_id_to_recover: ShardId,
-    shard_offset: i64,
-    size: usize,
-    shard_locations: &HashMap<ShardId, Vec<String>>,
-    data_shards: usize,
-    parity_shards: usize,
-    expected_encode_ts_ns: i64,
-) -> io::Result<Vec<u8>> {
+    iv: EcInterval,
+    map: EcShardMap<'_>,
+) -> io::Result<(Vec<u8>, bool)> {
+    let EcInterval {
+        vid,
+        needle_id,
+        shard_id: shard_id_to_recover,
+        shard_offset,
+        size,
+        expected_encode_ts_ns,
+    } = iv;
+    let EcShardMap {
+        locations: shard_locations,
+        data_shards,
+        parity_shards,
+    } = map;
     let total_shards = data_shards + parity_shards;
-    let rs = ReedSolomon::new(data_shards, parity_shards).map_err(|e| {
-        io::Error::new(
-            io::ErrorKind::Other,
-            format!("reed-solomon init: {:?}", e),
-        )
-    })?;
+    let rs = ReedSolomon::new(data_shards, parity_shards)
+        .map_err(|e| io::Error::other(format!("reed-solomon init: {:?}", e)))?;
+
+    // Charge the buffers this recovery is about to hold against the budget, so a
+    // burst of them queues here rather than on the heap. An interval whose
+    // fan-out outgrows the whole budget takes all of it and so runs alone,
+    // rather than waiting on permits that can never be granted.
+    let _permit = EC_RECOVER_SEM
+        .acquire_many((size * data_shards).min(EC_RECOVER_BUDGET) as u32)
+        .await
+        .map_err(|e| {
+            io::Error::other(format!(
+                "ec recover budget for shard {}.{}: {}",
+                vid.0, shard_id_to_recover, e
+            ))
+        })?;
 
     let mut bufs: Vec<Option<Vec<u8>>> = vec![None; total_shards];
 
@@ -920,111 +1464,141 @@ async fn recover_one_remote_ec_shard_interval(
     // already holds enough sibling shards, reconstruction completes
     // without any peer fan-out — and even with a cold/incomplete
     // shard_locations cache or a failed master lookup, local
-    // survivors still contribute. Mirrors Go's
-    // recoverOneRemoteEcShardInterval behaviour, which is implicitly
-    // local-aware because the Store fan-out targets ALL known
-    // locations (including the caller's own server address); the
-    // Rust port had been remote-only, so reconstructing with a cold
-    // cache failed even when enough siblings were on disk.
+    // survivors still contribute.
+    let mut available = 0usize;
     {
         let store = state.store.read().unwrap();
-        if let Some(ecv) = store.find_ec_volume(vid) {
-            for sid in 0..total_shards {
-                if sid as ShardId == shard_id_to_recover {
-                    continue;
+        for (sid, slot) in bufs.iter_mut().enumerate() {
+            if available >= data_shards {
+                break;
+            }
+            if sid as ShardId == shard_id_to_recover {
+                continue;
+            }
+            // Resolve the shard together with the EcVolume on the disk that owns
+            // it: a reconciled volume has its shards split across data dirs. A
+            // shard from a different encode run must not be fed to Reed-Solomon;
+            // lenient only when the caller carries no identity (pre-upgrade).
+            // Mirrors Go's `readLocalEcShardInterval`.
+            let Ok(sid_shard) = ShardId::try_from(sid) else {
+                continue;
+            };
+            let owner = match store.find_ec_volume_with_shard(vid, sid_shard) {
+                Some(ecv)
+                    if expected_encode_ts_ns == 0 || ecv.encode_ts_ns == expected_encode_ts_ns =>
+                {
+                    ecv
                 }
-                if let Some(Some(shard)) = ecv.shards.get(sid) {
-                    let mut buf = vec![0u8; size];
-                    if shard.read_at(&mut buf, shard_offset as u64).map(|n| n == size).unwrap_or(false) {
-                        bufs[sid] = Some(buf);
+                _ => continue,
+            };
+            if let Some(Some(shard)) = owner.shards.get(sid) {
+                let mut buf = vec![0u8; size];
+                if shard
+                    .read_at(&mut buf, shard_offset as u64)
+                    .map(|n| n == size)
+                    .unwrap_or(false)
+                {
+                    *slot = Some(buf);
+                    available += 1;
+                }
+            }
+        }
+    }
+
+    // Phase 1: remote fan-out over the shard locations we DON'T already have
+    // locally and DON'T need to recover. Reconstruction consumes data_shards
+    // shards, so reading every remaining one holds a third more buffers than
+    // that and asks a third more of peers that may already be struggling: fetch
+    // what is still missing, and widen only if some of those reads fail.
+    let mut candidates: Vec<(ShardId, Vec<String>)> = shard_locations
+        .iter()
+        .filter(|(sid, locs)| {
+            **sid != shard_id_to_recover
+                && (**sid as usize) < total_shards
+                && !locs.is_empty()
+                && bufs[**sid as usize].is_none()
+        })
+        .map(|(sid, locs)| (*sid, locs.clone()))
+        .collect();
+
+    let mut any_deleted = false;
+    while available < data_shards && !candidates.is_empty() {
+        let rest = candidates.split_off((data_shards - available).min(candidates.len()));
+        let wave = std::mem::replace(&mut candidates, rest);
+        let results = join_all(wave.into_iter().map(|(sid, locs)| {
+            let state = state.clone();
+            async move {
+                let res = read_remote_ec_shard_interval(
+                    &state,
+                    &locs,
+                    EcInterval {
+                        shard_id: sid,
+                        ..iv
+                    },
+                )
+                .await;
+                (sid, res)
+            }
+        }))
+        .await;
+
+        for (sid, res) in results {
+            match res {
+                // Exclude a deleted shard from reconstruction (Go gates on a full
+                // read): feeding the empty/zero buffer into Reed-Solomon would
+                // corrupt the recovered shard.
+                Ok((buf, is_deleted)) => {
+                    if is_deleted {
+                        any_deleted = true;
+                        continue;
                     }
-                }
-            }
-        }
-    }
-
-    // Phase 1: remote fan-out — one task per known shard location
-    // we DON'T already have locally and DON'T need to recover.
-    let mut tasks = Vec::new();
-    for (sid, locs) in shard_locations {
-        if *sid == shard_id_to_recover || locs.is_empty() {
-            continue;
-        }
-        if bufs[*sid as usize].is_some() {
-            continue;
-        }
-        let sid = *sid;
-        let locs = locs.clone();
-        let state = state.clone();
-        tasks.push(async move {
-            let res = read_remote_ec_shard_interval(
-                &state,
-                &locs,
-                vid,
-                needle_id,
-                sid,
-                shard_offset,
-                size,
-                expected_encode_ts_ns,
-            )
-            .await;
-            (sid, res)
-        });
-    }
-    let results = join_all(tasks).await;
-
-    for (sid, res) in results {
-        match res {
-            // Exclude a deleted shard from reconstruction (Go gates on a full
-            // read): feeding the empty/zero buffer into Reed-Solomon would
-            // corrupt the recovered shard.
-            Ok((buf, is_deleted)) => {
-                if !is_deleted && (sid as usize) < total_shards {
                     bufs[sid as usize] = Some(buf);
+                    available += 1;
+                }
+                Err(e) => {
+                    tracing::debug!(
+                        "recover: read {}.{} for needle {} failed: {}",
+                        vid.0,
+                        sid,
+                        needle_id,
+                        e
+                    );
+                    mark_shard_locations_stale(state, vid);
                 }
             }
-            Err(e) => {
-                tracing::debug!(
-                    "recover: read {}.{} for needle {} failed: {}",
-                    vid.0,
-                    sid,
-                    needle_id,
-                    e
-                );
-            }
+        }
+        if any_deleted {
+            // every shard of a deleted needle answers deleted, so another wave cannot help
+            break;
         }
     }
 
-    let available = bufs.iter().filter(|b| b.is_some()).count();
     if available < data_shards {
-        return Err(io::Error::new(
-            io::ErrorKind::Other,
-            format!(
-                "cannot recover ec shard {}.{}: only {} shards available, need at least {}",
-                vid.0, shard_id_to_recover, available, data_shards
-            ),
-        ));
+        // A holder reporting the needle deleted is authoritative -- deletes are
+        // never invented and never undone -- so answer that rather than the
+        // failure to gather shards of a needle that is gone.
+        if any_deleted {
+            return Ok((Vec::new(), true));
+        }
+        return Err(io::Error::other(format!(
+            "cannot recover ec shard {}.{}: only {} shards available, need at least {}",
+            vid.0, shard_id_to_recover, available, data_shards
+        )));
     }
 
     rs.reconstruct(&mut bufs).map_err(|e| {
-        io::Error::new(
-            io::ErrorKind::Other,
-            format!(
-                "reed-solomon reconstruct ec shard {}.{}: {:?}",
-                vid.0, shard_id_to_recover, e
-            ),
-        )
+        io::Error::other(format!(
+            "reed-solomon reconstruct ec shard {}.{}: {:?}",
+            vid.0, shard_id_to_recover, e
+        ))
     })?;
 
     match bufs.into_iter().nth(shard_id_to_recover as usize).flatten() {
-        Some(buf) => Ok(buf),
-        None => Err(io::Error::new(
-            io::ErrorKind::Other,
-            format!(
-                "reconstructed buffer for shard {}.{} missing after RS reconstruct",
-                vid.0, shard_id_to_recover
-            ),
-        )),
+        Some(buf) => Ok((buf, any_deleted)),
+        None => Err(io::Error::other(format!(
+            "reconstructed buffer for shard {}.{} missing after RS reconstruct",
+            vid.0, shard_id_to_recover
+        ))),
     }
 }
 
@@ -1165,16 +1739,14 @@ async fn fetch_ec_index_from_one_peer(
 ) -> io::Result<()> {
     let grpc_addr =
         parse_grpc_address(peer).map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
-    let channel = build_grpc_endpoint(&grpc_addr, state.outgoing_grpc_tls.as_ref())
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, e.to_string()))?
-        .connect_timeout(Duration::from_secs(5))
-        .timeout(Duration::from_secs(30))
-        .connect()
-        .await
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("connect {}: {}", peer, e)))?;
-    let mut client = VolumeServerClient::with_interceptor(channel, outgoing_request_id_interceptor)
-        .max_decoding_message_size(GRPC_MAX_MESSAGE_SIZE)
-        .max_encoding_message_size(GRPC_MAX_MESSAGE_SIZE);
+    let channel = connect_channel(
+        &grpc_addr,
+        state.outgoing_grpc_tls.as_ref(),
+        GrpcDialOptions::long(),
+    )
+    .await
+    .map_err(|e| io::Error::other(format!("connect {}: {}", peer, e)))?;
+    let mut client = volume_server_client(channel);
 
     let copy_req = |ext: &str, ignore_not_found: bool| CopyFileRequest {
         volume_id: m.vid.0,
@@ -1192,29 +1764,45 @@ async fn fetch_ec_index_from_one_peer(
     let stream = client
         .copy_file(copy_req(".ecx", false))
         .await
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("copy .ecx: {}", e)))?
+        .map_err(|e| io::Error::other(format!("copy .ecx: {}", e)))?
         .into_inner();
-    drain_copy_stream(stream, ecx_path, false).await?;
+    drain_copy_stream(stream, ecx_path).await?;
 
-    let meta = fs::metadata(ecx_path)
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("stat copied .ecx: {}", e)))?;
+    let meta =
+        fs::metadata(ecx_path).map_err(|e| io::Error::other(format!("stat copied .ecx: {}", e)))?;
     if meta.is_dir() || meta.len() == 0 {
         let _ = fs::remove_file(ecx_path);
-        return Err(io::Error::new(
-            io::ErrorKind::Other,
-            format!("peer {} served an unusable .ecx (size {})", peer, meta.len()),
-        ));
+        return Err(io::Error::other(format!(
+            "peer {} served an unusable .ecx (size {})",
+            peer,
+            meta.len()
+        )));
     }
 
-    // .ecj is the source peer's deletion journal (appended); .vif carries EC
-    // params. Both are best-effort: a missing .ecj is recreated at mount and a
-    // missing .vif falls back to default EC parameters. A failed .ecj append
-    // leaves a partial file, so drop it.
+    // .ecj is the source peer's deletion journal; .vif carries EC params. Both
+    // are best-effort: a missing .ecj is recreated at mount and a missing .vif
+    // falls back to default EC parameters. The journal is a *set*: merge the
+    // peer's ids into any local ones as a union instead of appending, so
+    // a volume bounced between servers cannot double its journal. The merge
+    // only appends whole records, so a failure leaves nothing to clean up.
     match client.copy_file(copy_req(".ecj", true)).await {
         Ok(resp) => {
-            if let Err(e) = drain_copy_stream(resp.into_inner(), ecj_path, true).await {
+            let mut stream = resp.into_inner();
+            let merged = match crate::server::grpc_server::receive_ecj_ids(&mut stream).await {
+                Ok((ids, true)) => crate::server::grpc_server::merge_ecj_ids(
+                    state,
+                    m.vid,
+                    m.data_dir.clone(),
+                    ecj_path.to_string(),
+                    ids,
+                )
+                .await
+                .map(|_| ()),
+                Ok((_, false)) => Ok(()),
+                Err(e) => Err(e),
+            };
+            if let Err(e) = merged {
                 tracing::warn!(volume_id = m.vid.0, peer = %peer, "copy .ecj: {}", e);
-                let _ = fs::remove_file(ecj_path);
             }
         }
         Err(e) => tracing::warn!(volume_id = m.vid.0, peer = %peer, "copy .ecj: {}", e),
@@ -1222,7 +1810,7 @@ async fn fetch_ec_index_from_one_peer(
 
     match client.copy_file(copy_req(".vif", true)).await {
         Ok(resp) => {
-            if let Err(e) = drain_copy_stream(resp.into_inner(), vif_path, false).await {
+            if let Err(e) = drain_copy_stream(resp.into_inner(), vif_path).await {
                 tracing::warn!(volume_id = m.vid.0, peer = %peer, "copy .vif: {}", e);
             }
         }
@@ -1232,26 +1820,67 @@ async fn fetch_ec_index_from_one_peer(
     Ok(())
 }
 
-/// Drain a CopyFile stream into a local file, appending or truncating.
+/// Drain a CopyFile stream into a local file, truncating it first.
 async fn drain_copy_stream(
     mut stream: tonic::Streaming<crate::pb::volume_server_pb::CopyFileResponse>,
     dest_path: &str,
-    append: bool,
 ) -> io::Result<()> {
     use std::io::Write;
-    let mut file = if append {
-        fs::OpenOptions::new().create(true).append(true).open(dest_path)
-    } else {
-        fs::File::create(dest_path)
-    }
-    .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("create {}: {}", dest_path, e)))?;
+    let mut file = fs::File::create(dest_path)
+        .map_err(|e| io::Error::other(format!("create {}: {}", dest_path, e)))?;
     while let Some(chunk) = stream
         .message()
         .await
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("recv {}: {}", dest_path, e)))?
+        .map_err(|e| io::Error::other(format!("recv {}: {}", dest_path, e)))?
     {
         file.write_all(&chunk.file_content)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("write {}: {}", dest_path, e)))?;
+            .map_err(|e| io::Error::other(format!("write {}: {}", dest_path, e)))?;
     }
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn gather_intervals_puts_a_reported_deletion_ahead_of_errors() {
+        let failed = || Err(io::Error::other("shard unreachable"));
+        assert!(
+            gather_intervals(vec![failed(), Ok((Vec::new(), true))])
+                .unwrap()
+                .is_none()
+        );
+        assert!(gather_intervals(vec![failed(), Ok((vec![1], false))]).is_err());
+        assert_eq!(
+            gather_intervals(vec![Ok((vec![1], false)), Ok((vec![2], false))]).unwrap(),
+            Some(vec![vec![1], vec![2]])
+        );
+    }
+
+    fn locations(count: usize) -> HashMap<ShardId, Vec<String>> {
+        (0..count)
+            .map(|sid| (sid as ShardId, vec!["127.0.0.1:8080".to_string()]))
+            .collect()
+    }
+
+    #[test]
+    fn needs_refresh_re_checks_a_map_a_failed_read_disproved() {
+        let just_now = Some(Instant::now());
+        let aged = Some(Instant::now() - Duration::from_secs(12));
+
+        // A complete map is trusted for a long time, and one shard short still
+        // outlasts a 12-second gap.
+        assert!(!needs_refresh(&locations(14), aged, false, 10, 14));
+        assert!(!needs_refresh(&locations(13), aged, false, 10, 14));
+        // Disproved by a read, the same maps are re-checked within seconds.
+        assert!(needs_refresh(&locations(14), aged, true, 10, 14));
+        assert!(needs_refresh(&locations(13), aged, true, 10, 14));
+        // But the mark buys one prompt re-check, not a lookup per read.
+        assert!(!needs_refresh(&locations(14), just_now, true, 10, 14));
+        // A map short of the data shards is re-checked promptly regardless.
+        assert!(needs_refresh(&locations(9), aged, false, 10, 14));
+        // An unrefreshed cache always looks up.
+        assert!(needs_refresh(&locations(0), None, false, 10, 14));
+    }
+}
diff --git a/seaweed-volume/src/server/ui.rs b/seaweed-volume/src/server/ui.rs
index f1f830a563..403ce15365 100644
--- a/seaweed-volume/src/server/ui.rs
+++ b/seaweed-volume/src/server/ui.rs
@@ -1,5 +1,6 @@
 use std::fmt::Write as _;
 
+use crate::server::absolute_display_path;
 use crate::server::server_stats;
 use crate::server::volume_server::VolumeServerState;
 use crate::storage::store::Store;
@@ -399,7 +400,7 @@ fn collect_ui_data(
                 file_count: volume.file_count(),
                 delete_count: volume.deleted_count(),
                 deleted_byte_count: volume.deleted_size(),
-                ttl: volume.super_block.ttl.to_string(),
+                ttl: volume.super_block().ttl.to_string(),
                 read_only: volume.is_read_only(),
                 version: volume.version().0 as u32,
                 remote_storage_name,
@@ -423,13 +424,12 @@ fn collect_ui_data(
                     shard_id: shard.shard_id,
                     size: shard_size,
                 });
-                if created_at == "-" {
-                    if let Ok(metadata) = std::fs::metadata(shard.file_name()) {
-                        if let Ok(modified) = metadata.modified() {
-                            let ts: chrono::DateTime<chrono::Local> = modified.into();
-                            created_at = ts.format("%Y-%m-%d %H:%M").to_string();
-                        }
-                    }
+                if created_at == "-"
+                    && let Ok(metadata) = std::fs::metadata(shard.file_name())
+                    && let Ok(modified) = metadata.modified()
+                {
+                    let ts: chrono::DateTime<chrono::Local> = modified.into();
+                    created_at = ts.format("%Y-%m-%d %H:%M").to_string();
                 }
             }
             let preferred_size = ec_volume.dat_file_size.max(0) as u64;
@@ -451,16 +451,6 @@ fn collect_ui_data(
     (disk_rows, volumes, remote_volumes, ec_volumes)
 }
 
-fn absolute_display_path(path: &str) -> String {
-    let p = std::path::Path::new(path);
-    if p.is_absolute() {
-        return path.to_string();
-    }
-    std::env::current_dir()
-        .map(|cwd| cwd.join(p).to_string_lossy().to_string())
-        .unwrap_or_else(|_| path.to_string())
-}
-
 fn join_i64(values: &[i64]) -> String {
     values
         .iter()
diff --git a/seaweed-volume/src/server/volume_server.rs b/seaweed-volume/src/server/volume_server.rs
index 54928f61dd..eab2e3617a 100644
--- a/seaweed-volume/src/server/volume_server.rs
+++ b/seaweed-volume/src/server/volume_server.rs
@@ -14,12 +14,12 @@ use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU32, Ordering};
 use std::sync::{Arc, RwLock};
 
 use axum::{
-    extract::{connect_info::ConnectInfo, Request, State},
-    http::{header, HeaderValue, Method, StatusCode},
+    Router,
+    extract::{Request, State, connect_info::ConnectInfo},
+    http::{HeaderValue, Method, StatusCode, header},
     middleware::{self, Next},
     response::{IntoResponse, Response},
     routing::{any, get},
-    Router,
 };
 
 use crate::config::ReadMode;
@@ -63,6 +63,12 @@ pub struct VolumeServerState {
     pub file_size_limit_bytes: i64,
     /// Default IO rate limit for maintenance copy/replication work.
     pub maintenance_byte_per_second: i64,
+    /// Bounds concurrent vacuum commits; None means unlimited. Queued commits
+    /// wait on the semaphore, not on the store lock, so reads keep flowing.
+    /// Mirrors Go's `vacuumCommitSlots`.
+    pub vacuum_commit_slots: Option<tokio::sync::Semaphore>,
+    /// Vacuum commits currently waiting for a slot.
+    pub vacuum_commits_waiting: AtomicU32,
     /// Whether the server is connected to master (heartbeat active).
     pub is_heartbeating: AtomicBool,
     /// Whether master addresses are configured.
@@ -71,16 +77,17 @@ pub struct VolumeServerState {
     pub pre_stop_seconds: u32,
     /// Notify heartbeat to send an immediate update when volume state changes.
     pub volume_state_notify: tokio::sync::Notify,
-    /// Optional batched write queue for improved throughput under load.
+    /// Per-volume write workers that group-commit durable (fsync) uploads.
+    /// Set once at startup in production; a test state may leave it unset,
+    /// which sends every write down the synchronous path.
     pub write_queue: std::sync::OnceLock<WriteQueue>,
-    /// Registry of S3 tier backends for tiered storage operations.
-    pub s3_tier_registry: std::sync::RwLock<crate::remote_storage::s3_tier::S3TierRegistry>,
     /// Read mode: local, proxy, or redirect for non-local volumes.
     pub read_mode: ReadMode,
     /// If true, FetchAndWriteNeedle skips remote S3 endpoint validation,
     /// allowing arbitrary (incl. loopback / link-local / metadata) hosts.
     pub allow_untrusted_remote_endpoints: bool,
-    /// First master address for volume lookups (e.g., "localhost:9333").
+    /// First configured master address (e.g., "localhost:9333"). A seed, not a
+    /// lookup target: lookups go to `current_master_url`.
     pub master_url: String,
     /// Seed master addresses for UI rendering.
     pub master_urls: Vec<String>,
@@ -88,10 +95,12 @@ pub struct VolumeServerState {
     /// Built once at construction so Ping admission stays O(1). Mirrors
     /// Go's `seedMasterSet` on `VolumeServer`.
     pub seed_master_set: std::collections::HashSet<String>,
-    /// Current master this server is heartbeating with, in canonical http
-    /// `host:port` form. Empty when no heartbeat connection is active. The
-    /// heartbeat goroutine writes; admission reads — the lock keeps them
-    /// from racing on a leader change. Mirrors Go's `currentMaster` plus
+    /// Master this server takes as leader, in its announced
+    /// `host:port[.grpcPort]` form — callers pick http or gRPC form per use.
+    /// Empty until the heartbeat confirms one — a peer that answered a
+    /// stream without naming a leader, or the leader a follower named — and
+    /// cleared again when no master reports one. The heartbeat writes;
+    /// admission and lookups read. Mirrors Go's `currentMaster` plus
     /// `currentMasterLock`.
     pub current_master_url: tokio::sync::RwLock<String>,
     /// This server's own address (ip:port) for filtering self from lookup results.
@@ -116,9 +125,31 @@ pub struct VolumeServerState {
     pub cli_white_list: Vec<String>,
     /// Path to state.pb file for persisting VolumeServerState across restarts.
     pub state_file_path: String,
+    /// Volumes with an EC decode in flight. A dropped request leaves the
+    /// blocking job running; this keeps a retry from racing it on the
+    /// same volume files.
+    pub ec_decodes_in_flight:
+        std::sync::Mutex<std::collections::HashSet<crate::storage::types::VolumeId>>,
+    /// Volumes whose EC decode is in its publishing tail (journal catch-up,
+    /// .idx write, compaction). Local .ecj appenders wait on
+    /// `ec_decode_tail_notify` while their vid is listed, so no committed
+    /// delete falls between the last catch_up and the .cpd/.cpx swap —
+    /// the per-volume slice of Go's EcVolume.ecjFileAccessLock.
+    pub ec_decode_tail:
+        std::sync::Mutex<std::collections::HashSet<crate::storage::types::VolumeId>>,
+    /// Wakes .ecj appenders waiting on `ec_decode_tail` when a decode's
+    /// publishing tail ends.
+    pub ec_decode_tail_notify: tokio::sync::Notify,
 }
 
 impl VolumeServerState {
+    /// The master lookups should go to: the leader the heartbeat confirmed,
+    /// or empty while none is known, in its announced `host:port[.grpcPort]`
+    /// form. Mirrors Go's `vs.getCurrentMaster()`.
+    pub async fn current_master(&self) -> String {
+        self.current_master_url.read().await.clone()
+    }
+
     /// Check if the server is in maintenance mode; return gRPC error if so.
     pub fn check_maintenance(&self) -> Result<(), tonic::Status> {
         if self.maintenance.load(Ordering::Relaxed) {
@@ -131,6 +162,40 @@ impl VolumeServerState {
         Ok(())
     }
 
+    /// Wait for a vacuum commit slot without touching the store lock; the wait
+    /// counts against the caller's `grpc-timeout`. An already-expired deadline
+    /// is refused even when a slot is free, matching Go's post-acquire
+    /// `ctx.Err()` check in `acquireVacuumCommitSlot`.
+    pub async fn acquire_vacuum_commit_slot(
+        &self,
+        deadline: Option<tokio::time::Instant>,
+    ) -> Result<Option<tokio::sync::SemaphorePermit<'_>>, tonic::Status> {
+        let Some(slots) = &self.vacuum_commit_slots else {
+            return Ok(None);
+        };
+        self.vacuum_commits_waiting.fetch_add(1, Ordering::Relaxed);
+        let acquired = match deadline {
+            Some(d) => match tokio::time::timeout_at(d, slots.acquire()).await {
+                Ok(permit) => permit.map_err(|e| tonic::Status::internal(e.to_string())),
+                Err(_) => Err(tonic::Status::deadline_exceeded(
+                    "timed out waiting for a vacuum commit slot",
+                )),
+            },
+            None => slots
+                .acquire()
+                .await
+                .map_err(|e| tonic::Status::internal(e.to_string())),
+        };
+        self.vacuum_commits_waiting.fetch_sub(1, Ordering::Relaxed);
+        let permit = acquired?;
+        if deadline.is_some_and(|d| tokio::time::Instant::now() >= d) {
+            return Err(tonic::Status::deadline_exceeded(
+                "timed out waiting for a vacuum commit slot",
+            ));
+        }
+        Ok(Some(permit))
+    }
+
     /// Build the seed master set from a list of raw `host:port[.grpcPort]`
     /// addresses, normalised the same way Go's `pb.ServerAddress.ToHttpAddress`
     /// does (drop the `.grpcPort` suffix, preserve everything else).
@@ -154,7 +219,7 @@ impl VolumeServerState {
             return false;
         }
         let current = self.current_master_url.read().await.clone();
-        if !current.is_empty() && current == key {
+        if !current.is_empty() && to_http_address(&current) == key {
             return true;
         }
         self.seed_master_set.contains(&key)
@@ -200,9 +265,7 @@ pub fn to_http_address(addr: &str) -> std::borrow::Cow<'_, str> {
         // rather than being silently rewritten. Mirrors the validation already
         // done in `to_grpc_address` for the inverse direction.
         if let (Ok(_), Ok(_)) = (http_port.parse::<u16>(), grpc_port.parse::<u16>()) {
-            return std::borrow::Cow::Owned(
-                addr[..ports_sep_index + 1 + dot_idx].to_string(),
-            );
+            return std::borrow::Cow::Owned(addr[..ports_sep_index + 1 + dot_idx].to_string());
         }
     }
     std::borrow::Cow::Borrowed(addr)
@@ -312,16 +375,15 @@ async fn admin_store_handler(state: State<Arc<VolumeServerState>>, request: Requ
             )
         }
     };
-    if method == Method::GET {
-        if let Some(response_bytes) = response
+    if method == Method::GET
+        && let Some(response_bytes) = response
             .headers()
             .get(header::CONTENT_LENGTH)
             .and_then(|value| value.to_str().ok())
             .and_then(|value| value.parse::<i64>().ok())
             .filter(|value| *value > 0)
-        {
-            super::server_stats::record_bytes_out(response_bytes);
-        }
+    {
+        super::server_stats::record_bytes_out(response_bytes);
     }
     super::server_stats::record_request_close();
     crate::metrics::INFLIGHT_REQUESTS_GAUGE
@@ -358,16 +420,15 @@ async fn public_store_handler(state: State<Arc<VolumeServerState>>, request: Req
         }
         _ => StatusCode::OK.into_response(),
     };
-    if method == Method::GET {
-        if let Some(response_bytes) = response
+    if method == Method::GET
+        && let Some(response_bytes) = response
             .headers()
             .get(header::CONTENT_LENGTH)
             .and_then(|value| value.to_str().ok())
             .and_then(|value| value.parse::<i64>().ok())
             .filter(|value| *value > 0)
-        {
-            super::server_stats::record_bytes_out(response_bytes);
-        }
+    {
+        super::server_stats::record_bytes_out(response_bytes);
     }
     super::server_stats::record_request_close();
     crate::metrics::INFLIGHT_REQUESTS_GAUGE
@@ -432,13 +493,13 @@ pub fn build_admin_router_with_ui(state: Arc<VolumeServerState>, ui_enabled: boo
         .route("/healthz", get(handlers::healthz_handler))
         .route("/favicon.ico", get(handlers::favicon_handler))
         .route(
-            "/seaweedfsstatic/*path",
+            "/seaweedfsstatic/{*path}",
             get(handlers::static_asset_handler),
         )
         .route("/", any(admin_store_handler))
-        .route("/:path", any(admin_store_handler))
-        .route("/:vid/:fid", any(admin_store_handler))
-        .route("/:vid/:fid/:filename", any(admin_store_handler))
+        .route("/{path}", any(admin_store_handler))
+        .route("/{vid}/{fid}", any(admin_store_handler))
+        .route("/{vid}/{fid}/{filename}", any(admin_store_handler))
         .fallback(admin_store_handler);
     if ui_enabled {
         // Note: /stats/* endpoints are commented out in Go's volume_server.go (L130-134).
@@ -455,13 +516,13 @@ pub fn build_public_router(state: Arc<VolumeServerState>) -> Router {
     Router::new()
         .route("/favicon.ico", get(handlers::favicon_handler))
         .route(
-            "/seaweedfsstatic/*path",
+            "/seaweedfsstatic/{*path}",
             get(handlers::static_asset_handler),
         )
         .route("/", any(public_store_handler))
-        .route("/:path", any(public_store_handler))
-        .route("/:vid/:fid", any(public_store_handler))
-        .route("/:vid/:fid/:filename", any(public_store_handler))
+        .route("/{path}", any(public_store_handler))
+        .route("/{vid}/{fid}", any(public_store_handler))
+        .route("/{vid}/{fid}/{filename}", any(public_store_handler))
         .fallback(public_store_handler)
         .layer(middleware::from_fn(common_headers_middleware))
         .with_state(state)
@@ -516,7 +577,10 @@ mod tests {
         // "host:abc.def"), and silently rewriting it would just hide the bug.
         assert_eq!(to_http_address("host:abc.def"), "host:abc.def");
         assert_eq!(to_http_address("host:9333.notaport"), "host:9333.notaport");
-        assert_eq!(to_http_address("host:notaport.19333"), "host:notaport.19333");
+        assert_eq!(
+            to_http_address("host:notaport.19333"),
+            "host:notaport.19333"
+        );
         // Out-of-range ports must not be silently truncated either.
         assert_eq!(to_http_address("host:99999.19333"), "host:99999.19333");
     }
diff --git a/seaweed-volume/src/server/write_queue.rs b/seaweed-volume/src/server/write_queue.rs
index df809db38c..dc649e0d72 100644
--- a/seaweed-volume/src/server/write_queue.rs
+++ b/seaweed-volume/src/server/write_queue.rs
@@ -1,13 +1,19 @@
 //! Async batched write processing for the volume server.
 //!
-//! Instead of each upload handler directly calling `write_needle` and syncing,
-//! writes are submitted to a queue. A background worker drains the queue in
-//! batches (up to 128 entries), groups them by volume ID, processes them
-//! together, and syncs once per volume for the entire batch.
+//! Durable (fsync) uploads are submitted here instead of each handler calling
+//! `write_needle` directly — Go's `writeNeedle2` makes the same split, so the
+//! queue is always constructed. Each volume gets its own FIFO worker (Go's
+//! volume_write.go keeps one batching worker per volume), which drains its
+//! channel in batches of up to 128 entries or 4 MiB and shares the .dat/.idx
+//! flushes across durable writes (see `Volume::write_needles_grouped`).
+//! Writes to different volumes proceed in parallel; a volume's ordering and
+//! exclusion still come from its data-file write lease.
 
-use std::sync::Arc;
+use std::collections::HashMap;
+use std::collections::hash_map::Entry;
+use std::sync::{Arc, Mutex};
 
-use tokio::sync::{mpsc, oneshot};
+use tokio::sync::{OwnedSemaphorePermit, Semaphore, mpsc, oneshot};
 use tracing::debug;
 
 use crate::storage::needle::needle::Needle;
@@ -19,11 +25,19 @@ use super::volume_server::VolumeServerState;
 /// Result of a single write operation: (offset, size, is_unchanged).
 pub type WriteResult = Result<(u64, Size, bool), VolumeError>;
 
+/// The needles queued for one volume, each with the durability it asked for.
+type VolumeBatch = Vec<(Needle, bool, oneshot::Sender<WriteResult>)>;
+
 /// A request to write a needle, submitted to the write queue.
 pub struct WriteRequest {
     pub volume_id: VolumeId,
     pub needle: Needle,
+    pub fsync: bool,
     pub response_tx: oneshot::Sender<WriteResult>,
+    /// The global queued-slot permit, owned by the request itself: a caller
+    /// that cancels `submit` after the send must not free the slot while the
+    /// worker still holds the needle.
+    pub queue_permit: Option<OwnedSemaphorePermit>,
 }
 
 /// Maximum number of write requests to batch together.
@@ -33,101 +47,290 @@ const MAX_BATCH_SIZE: usize = 128;
 /// This prevents large writes from accumulating unbounded latency.
 const MAX_BATCH_BYTES: usize = 4 * 1024 * 1024;
 
-/// Handle for submitting write requests to the background worker.
+/// Cap on volumes doing grouped I/O at once, so many writers cannot crowd
+/// readers off a slow disk the way unlimited parallel fsyncs would.
+const MAX_CONCURRENT_VOLUME_WRITES: usize = 8;
+
+/// How often an idle worker re-checks that its volume is still mounted.
+/// Workers live for their volume's queue lifetime (Go parity), so the only
+/// retirement is the volume leaving the store.
+const IDLE_WORKER_POLL: std::time::Duration = std::time::Duration::from_secs(60);
+
+/// Tunes the per-volume durable-write worker. Once the queue drains with the
+/// batch still below min_bytes and min_requests, the batch stays open up to
+/// wait for stragglers instead of paying an fsync per request. Mirrors Go's
+/// storage.SyncBatchOption.
+#[derive(Clone, Copy)]
+pub struct SyncBatchOption {
+    pub min_bytes: usize,
+    pub min_requests: usize,
+    pub wait: std::time::Duration,
+}
+
+impl Default for SyncBatchOption {
+    fn default() -> Self {
+        SyncBatchOption {
+            min_bytes: 1024 * 1024,
+            min_requests: MAX_BATCH_SIZE,
+            wait: std::time::Duration::from_micros(500),
+        }
+    }
+}
+
+/// Handle for submitting write requests to the per-volume workers.
 #[derive(Clone)]
 pub struct WriteQueue {
-    tx: mpsc::Sender<WriteRequest>,
+    state: Arc<VolumeServerState>,
+    /// Per-volume channel capacity; backpressure kicks in when full.
+    capacity: usize,
+    io_permits: Arc<Semaphore>,
+    /// Bounds queued+in-flight writes across all volumes — per-volume channels
+    /// alone would multiply the old single queue's capacity by volume count.
+    queue_permits: Arc<Semaphore>,
+    workers: Arc<Mutex<HashMap<VolumeId, mpsc::Sender<WriteRequest>>>>,
+    sync_batch: SyncBatchOption,
+    /// Submissions accepted, for tests asserting which writes route here.
+    #[cfg(test)]
+    submits: Arc<std::sync::atomic::AtomicU64>,
+    /// Times a worker armed the straggler window, for tests that must land a
+    /// write inside an already-open batch.
+    #[cfg(test)]
+    windows_armed: Arc<std::sync::atomic::AtomicU64>,
 }
 
 impl WriteQueue {
-    /// Create a new write queue and spawn the background worker.
-    ///
-    /// `capacity` controls the channel buffer size (backpressure kicks in when full).
-    /// The worker holds a reference to `state` for accessing the store.
-    pub fn new(state: Arc<VolumeServerState>, capacity: usize) -> Self {
-        let (tx, rx) = mpsc::channel(capacity);
-        let worker = WriteQueueWorker { rx, state };
-        tokio::spawn(worker.run());
-        WriteQueue { tx }
+    /// Create a new write queue. Per-volume workers are spawned lazily on the
+    /// first submission for that volume.
+    pub fn new(
+        state: Arc<VolumeServerState>,
+        capacity: usize,
+        sync_batch: SyncBatchOption,
+    ) -> Self {
+        WriteQueue {
+            state,
+            capacity,
+            io_permits: Arc::new(Semaphore::new(MAX_CONCURRENT_VOLUME_WRITES)),
+            queue_permits: Arc::new(Semaphore::new(capacity)),
+            workers: Arc::new(Mutex::new(HashMap::new())),
+            sync_batch,
+            #[cfg(test)]
+            submits: Arc::new(std::sync::atomic::AtomicU64::new(0)),
+            #[cfg(test)]
+            windows_armed: Arc::new(std::sync::atomic::AtomicU64::new(0)),
+        }
+    }
+
+    /// How many writes were submitted, for tests asserting upload routing.
+    #[cfg(test)]
+    pub fn submits_for_test(&self) -> u64 {
+        self.submits.load(std::sync::atomic::Ordering::Relaxed)
+    }
+
+    /// How many batch windows workers have armed so far.
+    #[cfg(test)]
+    fn windows_armed_for_test(&self) -> u64 {
+        self.windows_armed.load(std::sync::atomic::Ordering::Relaxed)
+    }
+
+    /// Sender for the volume's worker, spawning one on first use.
+    fn worker_for(&self, volume_id: VolumeId) -> mpsc::Sender<WriteRequest> {
+        let mut workers = self.workers.lock().unwrap();
+        match workers.entry(volume_id) {
+            Entry::Occupied(e) => e.get().clone(),
+            Entry::Vacant(e) => {
+                let (tx, rx) = mpsc::channel(self.capacity);
+                tokio::spawn(
+                    VolumeWriteWorker {
+                        rx,
+                        vid: volume_id,
+                        state: self.state.clone(),
+                        io_permits: self.io_permits.clone(),
+                        workers: self.workers.clone(),
+                        sync_batch: self.sync_batch,
+                        #[cfg(test)]
+                        windows_armed: self.windows_armed.clone(),
+                    }
+                    .run(),
+                );
+                e.insert(tx.clone());
+                tx
+            }
+        }
     }
 
     /// Submit a write request and wait for the result.
     ///
     /// Returns `Err` if the worker has shut down or the response channel was dropped.
-    pub async fn submit(&self, volume_id: VolumeId, needle: Needle) -> WriteResult {
+    pub async fn submit(&self, volume_id: VolumeId, needle: Needle, fsync: bool) -> WriteResult {
+        // Workers spawn only for mounted volumes — a bogus id never creates
+        // a channel, so volume-id sprays can't grow the worker map.
+        #[cfg(test)]
+        self.submits
+            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        {
+            let store = self.state.store.read().unwrap();
+            if store.find_volume(volume_id).is_none() {
+                return Err(VolumeError::NotFound);
+            }
+        }
+        // The permit travels inside the request, so the global queued bound
+        // covers the request until the worker drops it — including after a
+        // canceled submit.
+        let queue_permit = self
+            .queue_permits
+            .clone()
+            .acquire_owned()
+            .await
+            .map_err(|_| broken_pipe("write queue shut down"))?;
         let (response_tx, response_rx) = oneshot::channel();
-        let request = WriteRequest {
+        let mut request = WriteRequest {
             volume_id,
             needle,
+            fsync,
             response_tx,
+            queue_permit: Some(queue_permit),
         };
 
-        // Send to queue; this awaits if the channel is full (backpressure).
-        if self.tx.send(request).await.is_err() {
-            return Err(VolumeError::Io(std::io::Error::new(
-                std::io::ErrorKind::BrokenPipe,
-                "write queue worker has shut down",
-            )));
+        // A send fails only against a retiring worker's closed channel; the
+        // request was never accepted, so retrying it behind a fresh worker
+        // keeps same-volume order. The volume recheck bounds the spin.
+        loop {
+            let tx = self.worker_for(volume_id);
+            match tx.send(request).await {
+                Ok(()) => break,
+                Err(mpsc::error::SendError(returned)) => {
+                    request = returned;
+                    {
+                        let store = self.state.store.read().unwrap();
+                        if store.find_volume(volume_id).is_none() {
+                            return Err(VolumeError::NotFound);
+                        }
+                    }
+                    tokio::task::yield_now().await;
+                }
+            }
         }
 
         // Wait for the worker to process our request.
         match response_rx.await {
             Ok(result) => result,
-            Err(_) => Err(VolumeError::Io(std::io::Error::new(
-                std::io::ErrorKind::BrokenPipe,
-                "write queue worker dropped response channel",
-            ))),
+            Err(_) => Err(broken_pipe("write queue worker dropped response channel")),
         }
     }
 }
 
-/// Background worker that drains write requests and processes them in batches.
-struct WriteQueueWorker {
-    rx: mpsc::Receiver<WriteRequest>,
-    state: Arc<VolumeServerState>,
+fn broken_pipe(msg: &'static str) -> VolumeError {
+    VolumeError::Io(std::io::Error::new(std::io::ErrorKind::BrokenPipe, msg))
 }
 
-impl WriteQueueWorker {
-    async fn run(mut self) {
-        debug!("write queue worker started");
+/// FIFO worker draining one volume's write channel in batches. Like Go's
+/// per-volume async writer it runs for the volume's queue lifetime — exiting
+/// only when the channel closes or its volume leaves the store — so no
+/// handoff can ever split one volume's write order across two workers.
+struct VolumeWriteWorker {
+    rx: mpsc::Receiver<WriteRequest>,
+    vid: VolumeId,
+    state: Arc<VolumeServerState>,
+    io_permits: Arc<Semaphore>,
+    workers: Arc<Mutex<HashMap<VolumeId, mpsc::Sender<WriteRequest>>>>,
+    sync_batch: SyncBatchOption,
+    #[cfg(test)]
+    windows_armed: Arc<std::sync::atomic::AtomicU64>,
+}
 
+impl VolumeWriteWorker {
+    async fn run(mut self) {
         loop {
-            // Wait for the first request (blocks until one arrives or channel closes).
-            let first = match self.rx.recv().await {
-                Some(req) => req,
-                None => {
-                    debug!("write queue channel closed, worker exiting");
+            let first = match tokio::time::timeout(IDLE_WORKER_POLL, self.rx.recv()).await {
+                Ok(Some(req)) => req,
+                // recv() yields None only once every sender is gone — the map
+                // holds a sender per volume, so that is exactly queue shutdown.
+                Ok(None) => return,
+                Err(_) if self.volume_gone() => {
+                    self.retire().await;
                     return;
                 }
+                Err(_) => continue,
             };
-
-            // Drain as many additional requests as available, up to MAX_BATCH_SIZE
-            // or MAX_BATCH_BYTES (matches Go: 128 requests or 4MB, whichever comes first).
-            let mut batch = Vec::with_capacity(MAX_BATCH_SIZE);
-            let mut batch_bytes: usize = first.needle.data.len();
-            batch.push(first);
-
-            while batch.len() < MAX_BATCH_SIZE && batch_bytes < MAX_BATCH_BYTES {
-                match self.rx.try_recv() {
-                    Ok(req) => {
-                        batch_bytes += req.needle.data.len();
-                        batch.push(req);
-                    }
-                    Err(_) => break,
-                }
-            }
-
-            let batch_size = batch.len();
-            debug!("processing write batch of {} requests", batch_size);
-
-            // Process the batch in spawn_blocking since write_needle does file I/O.
-            let state = self.state.clone();
-            let _ = tokio::task::spawn_blocking(move || {
-                process_batch(state, batch);
-            })
-            .await;
+            self.process_from(first).await;
         }
     }
+
+    /// The volume's handle left the store, so the worker can go too; an idle
+    /// worker for a mounted volume stays (Go keeps the writer for the mount).
+    fn volume_gone(&self) -> bool {
+        let store = self.state.store.read().unwrap();
+        store.find_volume(self.vid).is_none()
+    }
+
+    /// Retire in a fixed order that keeps same-volume FIFO: close the channel
+    /// so racing senders fail fast (they retry and wait for a fresh worker),
+    /// drain what was already accepted, and only then give up the map slot —
+    /// a replacement worker can never start while this one still holds queued
+    /// writes.
+    async fn retire(&mut self) {
+        self.rx.close();
+        while let Some(first) = self.rx.recv().await {
+            self.process_from(first).await;
+        }
+        self.workers.lock().unwrap().remove(&self.vid);
+    }
+
+    /// Collect a batch around `first` and process it under the I/O bound.
+    async fn process_from(&mut self, first: WriteRequest) {
+        // Drain as many additional requests as available, up to MAX_BATCH_SIZE
+        // or MAX_BATCH_BYTES (matches Go: 128 requests or 4MB, whichever comes first).
+        let mut batch = Vec::with_capacity(MAX_BATCH_SIZE);
+        let mut batch_bytes: usize = first.needle.data.len();
+        batch.push(first);
+        // Armed once the queue first drains below the minimum batch; holds the
+        // batch open for stragglers so the wait bound is per batch, not per
+        // lull (Go's batchWait).
+        let mut window_deadline = None;
+        while batch.len() < MAX_BATCH_SIZE && batch_bytes < MAX_BATCH_BYTES {
+            if window_deadline.is_some_and(|d| tokio::time::Instant::now() >= d) {
+                break;
+            }
+            let req = match self.rx.try_recv() {
+                Ok(req) => req,
+                Err(mpsc::error::TryRecvError::Empty) => {
+                    let sync = self.sync_batch;
+                    if sync.wait.is_zero()
+                        || batch_bytes >= sync.min_bytes
+                        || batch.len() >= sync.min_requests
+                    {
+                        // a drained queue flushes right away once it holds enough
+                        break;
+                    }
+                    let deadline = *window_deadline.get_or_insert_with(|| {
+                        #[cfg(test)]
+                        self.windows_armed
+                            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                        tokio::time::Instant::now() + sync.wait
+                    });
+                    match tokio::time::timeout_at(deadline, self.rx.recv()).await {
+                        Ok(Some(req)) => req,
+                        Ok(None) | Err(_) => break,
+                    }
+                }
+                Err(mpsc::error::TryRecvError::Disconnected) => break,
+            };
+            batch_bytes += req.needle.data.len();
+            batch.push(req);
+        }
+        debug!("processing write batch of {} requests", batch.len());
+
+        // Bound the number of volumes doing grouped I/O at once, then run
+        // the batch in spawn_blocking since write_needle does file I/O.
+        let Ok(_permit) = self.io_permits.clone().acquire_owned().await else {
+            return;
+        };
+        let state = self.state.clone();
+        let _ = tokio::task::spawn_blocking(move || {
+            process_batch(state, batch);
+        })
+        .await;
+    }
 }
 
 /// Process a batch of write requests, grouped by volume ID.
@@ -138,23 +341,40 @@ fn process_batch(state: Arc<VolumeServerState>, batch: Vec<WriteRequest>) {
     // Group requests by volume ID for efficient processing.
     // We use a Vec of (VolumeId, Vec<(Needle, Sender)>) to preserve order
     // and avoid requiring Hash on VolumeId.
-    let mut groups: Vec<(VolumeId, Vec<(Needle, oneshot::Sender<WriteResult>)>)> = Vec::new();
+    let mut groups: Vec<(VolumeId, VolumeBatch)> = Vec::new();
 
     for req in batch {
         let vid = req.volume_id;
         if let Some(group) = groups.iter_mut().find(|(v, _)| *v == vid) {
-            group.1.push((req.needle, req.response_tx));
+            group.1.push((req.needle, req.fsync, req.response_tx));
         } else {
-            groups.push((vid, vec![(req.needle, req.response_tx)]));
+            groups.push((vid, vec![(req.needle, req.fsync, req.response_tx)]));
         }
     }
 
-    // Process each volume group under a single store lock.
-    let mut store = state.store.write().unwrap();
-
+    // Resolve each group's volume handle under a brief store read, then run
+    // the group's I/O with the guard released — one volume's write must not
+    // block admission on another volume's.
     for (vid, entries) in groups {
-        for (mut needle, response_tx) in entries {
-            let result = store.write_volume_needle(vid, &mut needle);
+        let (mut writes, senders): (Vec<_>, Vec<_>) = entries
+            .into_iter()
+            .map(|(needle, fsync, response_tx)| ((needle, fsync), response_tx))
+            .unzip();
+        let vol = {
+            let store = state.store.read().unwrap();
+            store.writable_volume(vid)
+        };
+        let results = match vol {
+            Ok(vol) => vol.write_needles_grouped(&mut writes),
+            Err(e) => writes
+                .iter()
+                .map(|_| match e {
+                    VolumeError::ReadOnly(vid) => Err(VolumeError::ReadOnly(vid)),
+                    _ => Err(VolumeError::NotFound),
+                })
+                .collect(),
+        };
+        for (response_tx, result) in senders.into_iter().zip(results) {
             // Send result back; ignore error if receiver dropped.
             let _ = response_tx.send(result);
         }
@@ -172,8 +392,8 @@ mod tests {
         use crate::server::volume_server::RuntimeMetricsConfig;
         use crate::storage::needle_map::NeedleMapKind;
         use crate::storage::store::Store;
-        use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU32};
         use std::sync::RwLock;
+        use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU32};
 
         let store = Store::new(NeedleMapKind::InMemory);
         let guard = Guard::new(&[], SigningKey(vec![]), 0, SigningKey(vec![]), 0);
@@ -196,14 +416,13 @@ mod tests {
             rack: String::new(),
             file_size_limit_bytes: 0,
             maintenance_byte_per_second: 0,
+            vacuum_commit_slots: None,
+            vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
             is_heartbeating: AtomicBool::new(false),
             has_master: false,
             pre_stop_seconds: 0,
             volume_state_notify: tokio::sync::Notify::new(),
             write_queue: std::sync::OnceLock::new(),
-            s3_tier_registry: std::sync::RwLock::new(
-                crate::remote_storage::s3_tier::S3TierRegistry::new(),
-            ),
             read_mode: crate::config::ReadMode::Local,
             allow_untrusted_remote_endpoints: false,
             master_url: String::new(),
@@ -222,6 +441,9 @@ mod tests {
             security_file: String::new(),
             cli_white_list: vec![],
             state_file_path: String::new(),
+            ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+            ec_decode_tail_notify: tokio::sync::Notify::new(),
         })
     }
 
@@ -229,7 +451,7 @@ mod tests {
     async fn test_write_queue_submit_no_volume() {
         // Submit a write to a non-existent volume -- should return VolumeError::NotFound.
         let state = make_test_state();
-        let queue = WriteQueue::new(state, MAX_BATCH_SIZE);
+        let queue = WriteQueue::new(state, MAX_BATCH_SIZE, SyncBatchOption::default());
 
         let needle = Needle {
             id: 1.into(),
@@ -239,7 +461,7 @@ mod tests {
             ..Needle::default()
         };
 
-        let result = queue.submit(VolumeId(999), needle).await;
+        let result = queue.submit(VolumeId(999), needle, false).await;
         assert!(result.is_err());
         match result {
             Err(VolumeError::NotFound) => {} // expected
@@ -251,7 +473,7 @@ mod tests {
     async fn test_write_queue_concurrent_submissions() {
         // Submit multiple concurrent writes -- all should complete (with errors since no volume).
         let state = make_test_state();
-        let queue = WriteQueue::new(state, MAX_BATCH_SIZE);
+        let queue = WriteQueue::new(state, MAX_BATCH_SIZE, SyncBatchOption::default());
 
         let mut handles = Vec::new();
         for i in 0..10u64 {
@@ -264,7 +486,7 @@ mod tests {
                     data_size: 10,
                     ..Needle::default()
                 };
-                q.submit(VolumeId(1), needle).await
+                q.submit(VolumeId(1), needle, false).await
             }));
         }
 
@@ -279,7 +501,7 @@ mod tests {
     async fn test_write_queue_batching() {
         // Verify that many concurrent writes get processed (testing the batching path).
         let state = make_test_state();
-        let queue = WriteQueue::new(state, MAX_BATCH_SIZE);
+        let queue = WriteQueue::new(state, MAX_BATCH_SIZE, SyncBatchOption::default());
 
         // Submit MAX_BATCH_SIZE requests concurrently
         let mut handles = Vec::new();
@@ -293,7 +515,7 @@ mod tests {
                     data_size: 4,
                     ..Needle::default()
                 };
-                q.submit(VolumeId(42), needle).await
+                q.submit(VolumeId(42), needle, false).await
             }));
         }
 
@@ -309,11 +531,69 @@ mod tests {
         }
     }
 
+    /// The queue hands a volume's batch to the grouped path, so ten durable
+    /// writes cost one .dat sync and one .idx sync, not ten of each.
+    #[test]
+    fn test_process_batch_group_commits_fsync_writes() {
+        use crate::config::MinFreeSpace;
+        use crate::storage::types::{DiskType, NeedleId};
+        use crate::storage::volume::VolumeSpec;
+
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let state = make_test_state();
+        {
+            let mut store = state.store.write().unwrap();
+            store
+                .add_location(
+                    dir,
+                    dir,
+                    10,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(1.0),
+                    Vec::new(),
+                )
+                .unwrap();
+            store
+                .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+                .unwrap();
+        }
+
+        let mut receivers = Vec::new();
+        let batch = (1..=10u64)
+            .map(|id| {
+                let (response_tx, response_rx) = oneshot::channel();
+                receivers.push(response_rx);
+                WriteRequest {
+                    volume_id: VolumeId(1),
+                    needle: Needle {
+                        id: NeedleId(id),
+                        cookie: 0x1111.into(),
+                        data: vec![id as u8; 8],
+                        data_size: 8,
+                        ..Needle::default()
+                    },
+                    fsync: true,
+                    response_tx,
+                    queue_permit: None,
+                }
+            })
+            .collect();
+        process_batch(state.clone(), batch);
+
+        for mut rx in receivers {
+            assert!(matches!(rx.try_recv().unwrap(), Ok((_, _, false))));
+        }
+        let store = state.store.read().unwrap();
+        let (_, vol) = store.find_volume(VolumeId(1)).unwrap();
+        assert_eq!(vol.sync_counts_for_test(), (1, 1));
+    }
+
     #[tokio::test]
     async fn test_write_queue_dropped_sender() {
         // When the queue is dropped, subsequent submits should fail gracefully.
         let state = make_test_state();
-        let queue = WriteQueue::new(state, 1);
+        let queue = WriteQueue::new(state, 1, SyncBatchOption::default());
 
         // Clone then drop the original -- the worker keeps running via its rx handle.
         let queue2 = queue.clone();
@@ -327,7 +607,283 @@ mod tests {
             data_size: 0,
             ..Needle::default()
         };
-        let result = queue2.submit(VolumeId(1), needle).await;
+        let result = queue2.submit(VolumeId(1), needle, false).await;
         assert!(result.is_err()); // NotFound is fine -- the point is it doesn't panic
     }
+
+    /// Issue #791: a write parked inside its .dat append must not hold the
+    /// store guard, so another volume still resolves and writes. The hook
+    /// runs under the volume's data-file lease, so the assertion is that the
+    /// store — not the per-volume serialization — stays open.
+    #[test]
+    fn test_process_batch_does_not_block_other_volumes() {
+        use crate::config::MinFreeSpace;
+        use crate::storage::types::{DiskType, NeedleId};
+        use crate::storage::volume::{VolumeSpec, needle_write_hook};
+        use std::sync::Barrier;
+
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let state = make_test_state();
+        {
+            let mut store = state.store.write().unwrap();
+            store
+                .add_location(
+                    dir,
+                    dir,
+                    10,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(1.0),
+                    Vec::new(),
+                )
+                .unwrap();
+            for vid in [VolumeId(1), VolumeId(2)] {
+                store
+                    .add_volume(vid, DiskType::HardDrive, &VolumeSpec::default())
+                    .unwrap();
+            }
+        }
+
+        let in_append = Arc::new(Barrier::new(2));
+        let release = Arc::new(Barrier::new(2));
+        let _reg = needle_write_hook::register(NeedleId(101), {
+            let in_append = in_append.clone();
+            let release = release.clone();
+            move |_| {
+                in_append.wait();
+                release.wait();
+            }
+        });
+
+        let (response_tx, mut response_rx) = oneshot::channel();
+        let batch = vec![WriteRequest {
+            volume_id: VolumeId(1),
+            needle: Needle {
+                id: NeedleId(101),
+                cookie: 0x1111.into(),
+                data: vec![7u8; 8],
+                data_size: 8,
+                ..Needle::default()
+            },
+            fsync: false,
+            response_tx,
+            queue_permit: None,
+        }];
+        let writer = {
+            let state = state.clone();
+            std::thread::spawn(move || process_batch(state, batch))
+        };
+
+        in_append.wait(); // volume 1's write is inside its .dat append.
+
+        // The store still admits a lifecycle writer and a volume-2 write.
+        drop(state.store.try_write().unwrap());
+        let vol2 = state
+            .store
+            .read()
+            .unwrap()
+            .writable_volume(VolumeId(2))
+            .unwrap();
+        let mut n2 = Needle {
+            id: NeedleId(9),
+            cookie: 0x2222.into(),
+            data: vec![9u8; 8],
+            data_size: 8,
+            ..Needle::default()
+        };
+        vol2.write_needle(&mut n2, true, false).unwrap();
+
+        // Same-volume exclusion is intact: volume 1's data-file lease is held.
+        let (_, vol1) = state.store.read().unwrap().find_volume(VolumeId(1)).unwrap();
+        assert!(vol1.instance().try_write_lock().is_none());
+
+        release.wait();
+        writer.join().unwrap();
+        assert!(response_rx.try_recv().unwrap().is_ok());
+        assert!(vol1.instance().try_write_lock().is_some());
+    }
+
+    /// A write parked inside volume 1's .dat append must not keep later
+    /// batches for other volumes queued behind it: each volume drains through
+    /// its own FIFO worker, while same-volume writes still serialize.
+    /// NeedleId(102) is reserved for this test — hooks are keyed by needle id
+    /// process-wide and parallel tests must not share one.
+    #[tokio::test]
+    async fn test_write_queue_does_not_block_other_volumes() {
+        use crate::config::MinFreeSpace;
+        use crate::storage::types::{DiskType, NeedleId};
+        use crate::storage::volume::{VolumeSpec, needle_write_hook};
+        use std::sync::Barrier;
+
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let state = make_test_state();
+        {
+            let mut store = state.store.write().unwrap();
+            store
+                .add_location(
+                    dir,
+                    dir,
+                    10,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(1.0),
+                    Vec::new(),
+                )
+                .unwrap();
+            for vid in [VolumeId(1), VolumeId(2)] {
+                store
+                    .add_volume(vid, DiskType::HardDrive, &VolumeSpec::default())
+                    .unwrap();
+            }
+        }
+        let queue = WriteQueue::new(state, MAX_BATCH_SIZE, SyncBatchOption::default());
+
+        let in_append = Arc::new(Barrier::new(2));
+        let release = Arc::new(Barrier::new(2));
+        let _reg = needle_write_hook::register(NeedleId(102), {
+            let in_append = in_append.clone();
+            let release = release.clone();
+            move |_| {
+                in_append.wait();
+                release.wait();
+            }
+        });
+
+        let needle_a = Needle {
+            id: NeedleId(102),
+            cookie: 0x1111.into(),
+            data: vec![7u8; 8],
+            data_size: 8,
+            ..Needle::default()
+        };
+        let a1 = tokio::spawn({
+            let queue = queue.clone();
+            async move { queue.submit(VolumeId(1), needle_a, false).await }
+        });
+        // The hook parks on a blocking thread, so wait on the barrier off the
+        // runtime worker.
+        let parked = {
+            let in_append = in_append.clone();
+            tokio::task::spawn_blocking(move || in_append.wait())
+        };
+        parked.await.unwrap(); // volume 1's write is inside its .dat append.
+
+        // Volume 2's worker is independent: its submit completes now.
+        let needle_b = Needle {
+            id: NeedleId(9),
+            cookie: 0x2222.into(),
+            data: vec![9u8; 8],
+            data_size: 8,
+            ..Needle::default()
+        };
+        queue.submit(VolumeId(2), needle_b, true).await.unwrap();
+
+        // Same-volume FIFO is preserved: a second volume-1 write stays queued.
+        let needle_a2 = Needle {
+            id: NeedleId(2),
+            cookie: 0x3333.into(),
+            data: vec![8u8; 8],
+            data_size: 8,
+            ..Needle::default()
+        };
+        let mut a2 = tokio::spawn({
+            let queue = queue.clone();
+            async move { queue.submit(VolumeId(1), needle_a2, false).await }
+        });
+        assert!(
+            tokio::time::timeout(std::time::Duration::from_millis(200), &mut a2)
+                .await
+                .is_err(),
+            "a same-volume write must queue behind the stalled one"
+        );
+
+        let released = {
+            let release = release.clone();
+            tokio::task::spawn_blocking(move || release.wait())
+        };
+        released.await.unwrap();
+        assert!(a1.await.unwrap().is_ok());
+        assert!(a2.await.unwrap().is_ok());
+    }
+
+    /// A durable write below the minimum batch rides out its window so a
+    /// straggler joins the same sync instead of each paying an fsync alone —
+    /// Go's batchWait. Paused time makes the hold observable: a lone write can
+    /// only complete once the runtime auto-advances to the window's deadline.
+    #[tokio::test(start_paused = true)]
+    async fn test_batch_window_defers_flush_for_stragglers() {
+        use crate::config::MinFreeSpace;
+        use crate::storage::types::{DiskType, NeedleId};
+        use crate::storage::volume::VolumeSpec;
+        use std::time::Duration;
+
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let state = make_test_state();
+        {
+            let mut store = state.store.write().unwrap();
+            store
+                .add_location(
+                    dir,
+                    dir,
+                    10,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(1.0),
+                    Vec::new(),
+                )
+                .unwrap();
+            store
+                .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+                .unwrap();
+        }
+
+        let queue = WriteQueue::new(
+            state,
+            MAX_BATCH_SIZE,
+            SyncBatchOption {
+                min_bytes: usize::MAX,
+                min_requests: MAX_BATCH_SIZE,
+                wait: Duration::from_secs(30),
+            },
+        );
+
+        let needle = |id: u64| Needle {
+            id: NeedleId(id),
+            cookie: 0x1111.into(),
+            data: vec![id as u8; 8],
+            data_size: 8,
+            ..Needle::default()
+        };
+
+        let start = tokio::time::Instant::now();
+        queue.submit(VolumeId(1), needle(1), true).await.unwrap();
+        assert!(start.elapsed() >= Duration::from_secs(30));
+
+        // Wait for the worker to take the second write and open its batch
+        // window, so the straggler provably lands inside an open batch
+        // instead of arriving during the initial drain.
+        let armed = queue.windows_armed_for_test();
+        let second = tokio::spawn({
+            let queue = queue.clone();
+            async move { queue.submit(VolumeId(1), needle(2), true).await }
+        });
+        for _ in 0..10_000 {
+            if queue.windows_armed_for_test() > armed {
+                break;
+            }
+            tokio::task::yield_now().await;
+        }
+        assert!(queue.windows_armed_for_test() > armed);
+        let third = tokio::spawn({
+            let queue = queue.clone();
+            async move { queue.submit(VolumeId(1), needle(3), true).await }
+        });
+        let (second, third) = tokio::join!(second, third);
+        second.unwrap().unwrap();
+        third.unwrap().unwrap();
+        // One shared window ends both writes ~30s after their batch armed;
+        // back-to-back windows would keep the third out to ~90s.
+        let elapsed = start.elapsed();
+        assert!(elapsed >= Duration::from_secs(60) && elapsed < Duration::from_secs(90));
+    }
 }
diff --git a/seaweed-volume/src/storage/disk_location.rs b/seaweed-volume/src/storage/disk_location.rs
index 1f10d7eb65..5483274f9c 100644
--- a/seaweed-volume/src/storage/disk_location.rs
+++ b/seaweed-volume/src/storage/disk_location.rs
@@ -15,15 +15,17 @@ use tracing::warn;
 use crate::config::MinFreeSpace;
 use crate::storage::erasure_coding::ec_bitrot::remove_bitrot_sidecars;
 use crate::storage::erasure_coding::ec_shard::{
-    EcVolumeShard, DATA_SHARDS_COUNT, ERASURE_CODING_LARGE_BLOCK_SIZE,
-    ERASURE_CODING_SMALL_BLOCK_SIZE,
+    DATA_SHARDS_COUNT, ERASURE_CODING_LARGE_BLOCK_SIZE, ERASURE_CODING_SMALL_BLOCK_SIZE,
+    EcVolumeShard, ShardId,
+};
+use crate::storage::erasure_coding::ec_volume::{
+    ECJ_COMPACT_TMP_EXT, EcVolume, is_usable_ecx_file,
 };
-use crate::storage::erasure_coding::ec_volume::EcVolume;
 use crate::storage::needle_map::NeedleMapKind;
-use crate::storage::super_block::{ReplicaPlacement, SUPER_BLOCK_SIZE};
+use crate::storage::super_block::SUPER_BLOCK_SIZE;
 use crate::storage::types::*;
 use crate::storage::volume::{
-    remove_volume_files, volume_file_name, VifVolumeInfo, Volume, VolumeError,
+    VifVolumeInfo, Volume, VolumeError, VolumeSpec, remove_volume_files, volume_file_name,
 };
 
 /// A single disk location managing volumes in one directory.
@@ -35,7 +37,7 @@ pub struct DiskLocation {
     pub tags: Vec<String>,
     pub max_volume_count: AtomicI32,
     pub original_max_volume_count: i32,
-    volumes: HashMap<VolumeId, Volume>,
+    volumes: HashMap<VolumeId, Arc<Volume>>,
     ec_volumes: HashMap<VolumeId, EcVolume>,
     pub is_disk_space_low: Arc<AtomicBool>,
     pub available_space: AtomicU64,
@@ -131,10 +133,10 @@ impl DiskLocation {
         for entry in entries {
             let entry = entry?;
             let name = entry.file_name().into_string().unwrap_or_default();
-            if let Some((collection, vid)) = parse_volume_filename(&name) {
-                if seen.insert((collection.clone(), vid)) {
-                    dat_files.push((collection, vid));
-                }
+            if let Some((collection, vid)) = parse_volume_filename(&name)
+                && seen.insert((collection.clone(), vid))
+            {
+                dat_files.push((collection, vid));
             }
         }
 
@@ -205,7 +207,6 @@ impl DiskLocation {
                 continue;
             }
 
-
             // Load existing data only; never create a phantom `.dat`. A lone
             // `.vif`/`.idx` (e.g. an EC sidecar whose `.ecx` is on a sibling
             // disk) would otherwise have Volume::new write an 8-byte stub that
@@ -236,6 +237,7 @@ impl DiskLocation {
         }
 
         for (collection, vid, v) in self.open_volumes(to_load, needle_map_kind) {
+            let v = Arc::new(v);
             crate::metrics::VOLUME_GAUGE
                 .with_label_values(&[&collection, "volume"])
                 .inc();
@@ -280,30 +282,33 @@ impl DiskLocation {
         let opened = Mutex::new(Vec::with_capacity(to_load.len()));
         std::thread::scope(|scope| {
             for _ in 0..workers {
-                scope.spawn(|| loop {
-                    let i = next.fetch_add(1, Ordering::Relaxed);
-                    let Some((vid, collections)) = to_load.get(i) else {
-                        return;
-                    };
-                    for collection in collections {
-                        match Volume::new(
-                            &self.directory,
-                            &self.idx_directory,
-                            collection,
-                            *vid,
-                            needle_map_kind,
-                            None, // replica placement read from superblock
-                            None, // TTL read from superblock
-                            0,    // no preallocate on load
-                            Version::current(),
-                        ) {
-                            Ok(mut v) => {
-                                v.location_disk_space_low = self.is_disk_space_low.clone();
-                                opened.lock().unwrap().push((collection.clone(), *vid, v));
-                                break;
-                            }
-                            Err(e) => {
-                                warn!(volume_id = vid.0, error = %e, "failed to load volume");
+                scope.spawn(|| {
+                    loop {
+                        let i = next.fetch_add(1, Ordering::Relaxed);
+                        let Some((vid, collections)) = to_load.get(i) else {
+                            return;
+                        };
+                        for collection in collections {
+                            // Replica placement and TTL are read back from the
+                            // superblock, and a load never preallocates.
+                            match Volume::new(
+                                &self.directory,
+                                &self.idx_directory,
+                                *vid,
+                                needle_map_kind,
+                                &VolumeSpec {
+                                    collection,
+                                    ..Default::default()
+                                },
+                            ) {
+                                Ok(mut v) => {
+                                    v.location_disk_space_low = self.is_disk_space_low.clone();
+                                    opened.lock().unwrap().push((collection.clone(), *vid, v));
+                                    break;
+                                }
+                                Err(e) => {
+                                    warn!(volume_id = vid.0, error = %e, "failed to load volume");
+                                }
                             }
                         }
                     }
@@ -327,10 +332,10 @@ impl DiskLocation {
                         .strip_suffix(".cpc")
                         .or_else(|| name.strip_suffix(".cpd"))
                         .or_else(|| name.strip_suffix(".cpx"));
-                    if let Some(stem) = stem {
-                        if let Some(key) = parse_collection_volume_id(stem) {
-                            pending.insert(key);
-                        }
+                    if let Some(stem) = stem
+                        && let Some(key) = parse_collection_volume_id(stem)
+                    {
+                        pending.insert(key);
                     }
                 }
             }
@@ -374,8 +379,10 @@ impl DiskLocation {
         let mut expected_shard_size: Option<i64> = None;
         let dat_exists = match fs::metadata(&dat_path) {
             Ok(meta) if meta.len() > SUPER_BLOCK_SIZE as u64 => {
-                expected_shard_size =
-                    Some(calculate_expected_shard_size(meta.len() as i64, data_shards));
+                expected_shard_size = Some(calculate_expected_shard_size(
+                    meta.len() as i64,
+                    data_shards,
+                ));
                 true
             }
             Ok(_) => false,
@@ -399,7 +406,13 @@ impl DiskLocation {
                         if size != prev {
                             // Inconsistent sizes signal corruption or mixed
                             // generations; not trusted for deletion -> keep.
-                            warn!(volume_id = vid.0, shard = i, size, expected = prev, "EC shard size mismatch; keeping shards");
+                            warn!(
+                                volume_id = vid.0,
+                                shard = i,
+                                size,
+                                expected = prev,
+                                "EC shard size mismatch; keeping shards"
+                            );
                             return true;
                         }
                     } else {
@@ -426,11 +439,16 @@ impl DiskLocation {
         if shard_count == 0 {
             return false;
         }
-        if let (Some(actual), Some(expected)) = (actual_shard_size, expected_shard_size) {
-            if actual < expected {
-                warn!(volume_id = vid.0, actual, expected, "shards smaller than the .dat's full encode; reclaiming the complete .dat");
-                return false;
-            }
+        if let (Some(actual), Some(expected)) = (actual_shard_size, expected_shard_size)
+            && actual < expected
+        {
+            warn!(
+                volume_id = vid.0,
+                actual,
+                expected,
+                "shards smaller than the .dat's full encode; reclaiming the complete .dat"
+            );
+            return false;
         }
         true
     }
@@ -445,13 +463,16 @@ impl DiskLocation {
         let idx_base = volume_file_name(&self.idx_directory, collection, vid);
         const MAX_SHARD_COUNT: usize = 32;
 
-        // Remove index files from idx directory (.ecx, .ecj)
+        // Remove index files from idx directory (.ecx, .ecj, and a compaction
+        // tmp a crash may have left beside the .ecj)
         rm_if_present(format!("{}.ecx", idx_base))?;
         rm_if_present(format!("{}.ecj", idx_base))?;
+        rm_if_present(format!("{}{}", idx_base, ECJ_COMPACT_TMP_EXT))?;
         // Also try data directory in case .ecx/.ecj were created before -dir.idx was configured
         if self.idx_directory != self.directory {
             rm_if_present(format!("{}.ecx", base))?;
             rm_if_present(format!("{}.ecj", base))?;
+            rm_if_present(format!("{}{}", base, ECJ_COMPACT_TMP_EXT))?;
         }
 
         // Remove all EC shard files (.ec00 ~ .ec31)
@@ -464,6 +485,13 @@ impl DiskLocation {
         if self.idx_directory != self.directory {
             remove_bitrot_sidecars(&idx_base)?;
         }
+
+        // Staged 2PC generations (<base>.ecNN.v<N>, versioned .ecx/.ecj/.vif)
+        // belong to this volume's EC state too; leaving them orphans the files.
+        crate::storage::erasure_coding::ec_shard::remove_ec_generation_files(&base, 0)?;
+        if self.idx_directory != self.directory {
+            crate::storage::erasure_coding::ec_shard::remove_ec_generation_files(&idx_base, 0)?;
+        }
         Ok(())
     }
 
@@ -510,10 +538,10 @@ impl DiskLocation {
     pub(crate) fn ec_generation_ts_ns(&self, collection: &str, vid: VolumeId) -> Option<i64> {
         for dir in [&self.directory, &self.idx_directory] {
             let vif = format!("{}.vif", volume_file_name(dir, collection, vid));
-            if let Ok(s) = fs::read_to_string(&vif) {
-                if let Ok(vi) = serde_json::from_str::<VifVolumeInfo>(&s) {
-                    return Some(vi.ec_shard_config.map(|c| c.encode_ts_ns).unwrap_or(0));
-                }
+            if let Ok(s) = fs::read_to_string(&vif)
+                && let Ok(vi) = serde_json::from_str::<VifVolumeInfo>(&s)
+            {
+                return Some(vi.ec_shard_config.map(|c| c.encode_ts_ns).unwrap_or(0));
             }
             if self.directory == self.idx_directory {
                 break;
@@ -522,20 +550,23 @@ impl DiskLocation {
         None
     }
 
-    /// Find a volume by ID.
-    pub fn find_volume(&self, vid: VolumeId) -> Option<&Volume> {
-        self.volumes.get(&vid)
-    }
-
-    /// Find a volume by ID (mutable).
-    pub fn find_volume_mut(&mut self, vid: VolumeId) -> Option<&mut Volume> {
-        self.volumes.get_mut(&vid)
+    /// Find a volume by ID. Returns a shared handle like Go's findVolume:
+    /// the lookup borrows the map briefly and I/O runs on the handle after.
+    pub fn find_volume(&self, vid: VolumeId) -> Option<Arc<Volume>> {
+        self.volumes.get(&vid).cloned()
     }
 
     /// Add a volume to this location.
     pub fn set_volume(&mut self, vid: VolumeId, volume: Volume) {
         let collection = volume.collection.clone();
-        self.volumes.insert(vid, volume);
+        if let Some(old) = self.volumes.insert(vid, Arc::new(volume)) {
+            // A held handle would keep writing the same files against a stale
+            // in-memory index; close it so the stale handle fails closed.
+            crate::metrics::VOLUME_GAUGE
+                .with_label_values(&[&old.collection, "volume"])
+                .dec();
+            old.close();
+        }
         crate::metrics::VOLUME_GAUGE
             .with_label_values(&[&collection, "volume"])
             .inc();
@@ -545,35 +576,34 @@ impl DiskLocation {
     pub fn create_volume(
         &mut self,
         vid: VolumeId,
-        collection: &str,
         needle_map_kind: NeedleMapKind,
-        replica_placement: Option<ReplicaPlacement>,
-        ttl: Option<crate::storage::needle::ttl::TTL>,
-        preallocate: u64,
-        version: Version,
+        spec: &VolumeSpec<'_>,
     ) -> Result<(), VolumeError> {
         let mut v = Volume::new(
             &self.directory,
             &self.idx_directory,
-            collection,
             vid,
             needle_map_kind,
-            replica_placement,
-            ttl,
-            preallocate,
-            version,
+            spec,
         )?;
         v.location_disk_space_low = self.is_disk_space_low.clone();
         crate::metrics::VOLUME_GAUGE
-            .with_label_values(&[collection, "volume"])
+            .with_label_values(&[spec.collection, "volume"])
             .inc();
-        self.volumes.insert(vid, v);
+        if let Some(old) = self.volumes.insert(vid, Arc::new(v)) {
+            // Same fail-closed rule as set_volume: a stale handle must not
+            // keep writing the files the replacement just reopened.
+            crate::metrics::VOLUME_GAUGE
+                .with_label_values(&[&old.collection, "volume"])
+                .dec();
+            old.close();
+        }
         Ok(())
     }
 
     /// Remove and close a volume.
-    pub fn unload_volume(&mut self, vid: VolumeId) -> Option<Volume> {
-        if let Some(mut v) = self.volumes.remove(&vid) {
+    pub fn unload_volume(&mut self, vid: VolumeId) -> Option<Arc<Volume>> {
+        if let Some(v) = self.volumes.remove(&vid) {
             crate::metrics::VOLUME_GAUGE
                 .with_label_values(&[&v.collection, "volume"])
                 .dec();
@@ -591,14 +621,30 @@ impl DiskLocation {
         &mut self,
         vid: VolumeId,
         only_empty: bool,
+        only_garbage: bool,
         keep_remote_data: bool,
     ) -> Result<(), VolumeError> {
-        if let Some(mut v) = self.volumes.remove(&vid) {
-            crate::metrics::VOLUME_GAUGE
-                .with_label_values(&[&v.collection, "volume"])
-                .dec();
-            v.destroy(only_empty, keep_remote_data)?;
-            Ok(())
+        // Refuse before removing: a refused destroy must leave it mounted.
+        if let Some(v) = self.volumes.get(&vid)
+            && v.is_compacting()
+        {
+            return Err(v.compacting_error());
+        }
+        if let Some(v) = self.volumes.remove(&vid) {
+            match v.destroy(only_empty, only_garbage, keep_remote_data) {
+                Ok(()) => {
+                    crate::metrics::VOLUME_GAUGE
+                        .with_label_values(&[&v.collection, "volume"])
+                        .dec();
+                    Ok(())
+                }
+                Err(e) => {
+                    // A failed destroy left the local files in place, so the
+                    // replica stays registered rather than becoming a phantom.
+                    self.volumes.insert(vid, v);
+                    Err(e)
+                }
+            }
         } else {
             Err(VolumeError::NotFound)
         }
@@ -614,12 +660,14 @@ impl DiskLocation {
             .collect();
 
         for vid in vids {
-            if let Some(mut v) = self.volumes.remove(&vid) {
-                crate::metrics::VOLUME_GAUGE
-                    .with_label_values(&[&v.collection, "volume"])
-                    .dec();
-                if let Err(e) = v.destroy(false, false) {
+            if let Some(v) = self.volumes.remove(&vid) {
+                if let Err(e) = v.destroy(false, false, false) {
                     warn!(volume_id = vid.0, error = %e, "delete collection: failed to destroy volume");
+                    self.volumes.insert(vid, v);
+                } else {
+                    crate::metrics::VOLUME_GAUGE
+                        .with_label_values(&[&v.collection, "volume"])
+                        .dec();
                 }
             }
         }
@@ -660,7 +708,7 @@ impl DiskLocation {
 
     /// Iterate over all volumes.
     pub fn iter_volumes(&self) -> impl Iterator<Item = (&VolumeId, &Volume)> {
-        self.volumes.iter()
+        self.volumes.iter().map(|(k, v)| (k, v.as_ref()))
     }
 
     /// Number of free volume slots.
@@ -669,8 +717,7 @@ impl DiskLocation {
     pub fn free_volume_count(&self) -> i32 {
         use crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT;
         let max = self.max_volume_count.load(Ordering::Relaxed);
-        let free_count = (max as i64 - self.volumes.len() as i64)
-            * DATA_SHARDS_COUNT as i64
+        let free_count = (max as i64 - self.volumes.len() as i64) * DATA_SHARDS_COUNT as i64
             - self.ec_shard_count() as i64;
         let effective_free = free_count / DATA_SHARDS_COUNT as i64;
         if effective_free > 0 {
@@ -682,12 +729,7 @@ impl DiskLocation {
 
     /// Iterate over all volumes.
     pub fn volumes(&self) -> impl Iterator<Item = (&VolumeId, &Volume)> {
-        self.volumes.iter()
-    }
-
-    /// Iterate over all volumes (mutable).
-    pub fn volumes_mut(&mut self) -> impl Iterator<Item = (&VolumeId, &mut Volume)> {
-        self.volumes.iter_mut()
+        self.volumes.iter().map(|(k, v)| (k, v.as_ref()))
     }
 
     /// Sum of unused space in writable volumes (volumeSizeLimit - actual size per volume).
@@ -698,7 +740,11 @@ impl DiskLocation {
             if vol.is_read_only() {
                 continue;
             }
-            let dat_size = vol.dat_file_size().unwrap_or(0);
+            // A preallocated volume already holds its space on disk.
+            let dat_size = vol
+                .dat_file_size()
+                .unwrap_or(0)
+                .max(vol.dat_allocated_size());
             let idx_size = vol.idx_file_size();
             let used = dat_size + idx_size;
             if volume_size_limit > used {
@@ -773,22 +819,18 @@ impl DiskLocation {
     /// Mirrors `DiskLocation.HasEcxFileOnDisk` in
     /// `weed/storage/disk_location_ec.go`. Skips entries that are
     /// directories so a stray dir named `<collection>_<vid>.ecx` doesn't
-    /// register as a present index file.
+    /// register as a present index file. A 0-byte `.ecx` is a corrupt stub
+    /// left by a failed EC distribute copy; it must not steer placement
+    /// toward this disk, so it counts as absent (Go requires `Size() > 0`).
     pub fn has_ecx_file_on_disk(&self, collection: &str, vid: VolumeId) -> bool {
         let idx_base = volume_file_name(&self.idx_directory, collection, vid);
-        let idx_path = format!("{}.ecx", idx_base);
-        if let Ok(meta) = fs::metadata(&idx_path) {
-            if !meta.is_dir() {
-                return true;
-            }
+        if is_usable_ecx_file(&format!("{}.ecx", idx_base)) {
+            return true;
         }
         if self.idx_directory != self.directory {
             let data_base = volume_file_name(&self.directory, collection, vid);
-            let data_path = format!("{}.ecx", data_base);
-            if let Ok(meta) = fs::metadata(&data_path) {
-                if !meta.is_dir() {
-                    return true;
-                }
+            if is_usable_ecx_file(&format!("{}.ecx", data_base)) {
+                return true;
             }
         }
         false
@@ -799,6 +841,20 @@ impl DiskLocation {
         self.ec_volumes.remove(&vid)
     }
 
+    /// Drop the in-memory EC volume for vid and close its descriptors without
+    /// deleting files, so a following unlink frees the inodes instead of
+    /// leaving open fds serving the old bytes. Mirrors Go's unloadEcVolume.
+    pub fn unload_ec_volume(&mut self, vid: VolumeId) {
+        if let Some(mut ec_vol) = self.ec_volumes.remove(&vid) {
+            for _ in 0..ec_vol.shard_count() {
+                crate::metrics::VOLUME_GAUGE
+                    .with_label_values(&[&ec_vol.collection, "ec_shards"])
+                    .dec();
+            }
+            ec_vol.close();
+        }
+    }
+
     /// Mount EC shards for a volume on this location.
     ///
     /// `source_disk_type` is the source volume's disk type carried on the
@@ -811,7 +867,7 @@ impl DiskLocation {
         &mut self,
         vid: VolumeId,
         collection: &str,
-        shard_ids: &[u32],
+        shard_ids: &[ShardId],
         source_disk_type: &str,
     ) -> Result<(), VolumeError> {
         let idx_dir = self.idx_directory.clone();
@@ -833,7 +889,7 @@ impl DiskLocation {
         &mut self,
         vid: VolumeId,
         collection: &str,
-        shard_ids: &[u32],
+        shard_ids: &[ShardId],
         idx_dir: &str,
         source_disk_type: &str,
     ) -> Result<(), VolumeError> {
@@ -843,15 +899,12 @@ impl DiskLocation {
         // .ecx open error, .ecj create error, malformed .vif) would
         // have to panic via unwrap(). Build the EcVolume up front and
         // propagate the error to the caller.
-        if !self.ec_volumes.contains_key(&vid) {
-            let ec_vol = EcVolume::new(&dir, idx_dir, collection, vid)
-                .map_err(VolumeError::Io)?;
+        let created = !self.ec_volumes.contains_key(&vid);
+        if created {
+            let ec_vol = EcVolume::new(&dir, idx_dir, collection, vid).map_err(VolumeError::Io)?;
             self.ec_volumes.insert(vid, ec_vol);
         }
-        let ec_vol = self
-            .ec_volumes
-            .get_mut(&vid)
-            .expect("just inserted above");
+        let ec_vol = self.ec_volumes.get_mut(&vid).expect("just inserted above");
         // When the orchestrator supplied a source disk type on the Mount
         // RPC, override the EC volume's disk type so heartbeats report
         // under the source volume's disk type (#9423). When the caller
@@ -866,9 +919,27 @@ impl DiskLocation {
         }
 
         for &shard_id in shard_ids {
-            let mut shard = EcVolumeShard::new(&dir, collection, vid, shard_id as u8);
+            // A mount retry re-listing a shard this volume already holds:
+            // keep the existing registration (mirrors Go's AddEcVolumeShard
+            // added=false) — re-adding would replace a serving fd and bump
+            // the ec_shards gauge without growing the mounted count.
+            if ec_vol.has_shard(shard_id) {
+                continue;
+            }
+            let mut shard = EcVolumeShard::new(&dir, collection, vid, shard_id);
             shard.disk_type = ec_vol.disk_type.clone();
-            ec_vol.add_shard(shard).map_err(VolumeError::Io)?;
+            if let Err(e) = ec_vol.add_shard(shard) {
+                // The shard was dropped (its descriptors closed) inside the
+                // failed add. If this call just created the EcVolume and it
+                // holds nothing, remove it too — a zero-shard registration
+                // would advertise a mount that serves no data while pinning
+                // its descriptors.
+                let now_empty = ec_vol.shard_count() == 0;
+                if created && now_empty {
+                    self.ec_volumes.remove(&vid);
+                }
+                return Err(VolumeError::Io(e));
+            }
             crate::metrics::VOLUME_GAUGE
                 .with_label_values(&[collection, "ec_shards"])
                 .inc();
@@ -883,14 +954,14 @@ impl DiskLocation {
     /// caller passes a shard that lives on a sibling disk
     /// (cross-disk reconcile makes that the common case for the same
     /// `vid` after reconciliation).
-    pub fn unmount_ec_shards(&mut self, vid: VolumeId, shard_ids: &[u32]) {
+    pub fn unmount_ec_shards(&mut self, vid: VolumeId, shard_ids: &[ShardId]) {
         if let Some(ec_vol) = self.ec_volumes.get_mut(&vid) {
             let collection = ec_vol.collection.clone();
             for &shard_id in shard_ids {
-                if !ec_vol.has_shard(shard_id as u8) {
+                if !ec_vol.has_shard(shard_id) {
                     continue;
                 }
-                ec_vol.remove_shard(shard_id as u8);
+                let _ = ec_vol.remove_shard(shard_id);
                 crate::metrics::VOLUME_GAUGE
                     .with_label_values(&[&collection, "ec_shards"])
                     .dec();
@@ -921,31 +992,36 @@ impl DiskLocation {
         // double-count for those filenames.
         let mut seen: HashSet<String> = HashSet::new();
         let mut entries: Vec<String> = Vec::new();
-        for ent in fs::read_dir(&self.directory)? {
-            let ent = ent?;
-            if ent.file_type().map(|ft| ft.is_dir()).unwrap_or(false) {
-                continue;
-            }
-            let name = ent.file_name().to_string_lossy().into_owned();
-            if seen.insert(name.clone()) {
-                entries.push(name);
-            }
-        }
-        if self.idx_directory != self.directory {
-            for ent in fs::read_dir(&self.idx_directory)? {
+        // Keep only the shard and index files this scan acts on: a disk of
+        // regular volumes has millions of .dat/.idx/.vif names that would
+        // otherwise each cost a String here and a slot in the sort below.
+        let mut collect = |dir: &str| -> io::Result<()> {
+            for ent in fs::read_dir(dir)? {
                 let ent = ent?;
                 if ent.file_type().map(|ft| ft.is_dir()).unwrap_or(false) {
                     continue;
                 }
                 let name = ent.file_name().to_string_lossy().into_owned();
+                let Some(dot) = name.rfind('.') else {
+                    continue;
+                };
+                let ext = &name[dot..];
+                if parse_ec_shard_extension(ext).is_none() && ext != ".ecx" {
+                    continue;
+                }
                 if seen.insert(name.clone()) {
                     entries.push(name);
                 }
             }
+            Ok(())
+        };
+        collect(&self.directory)?;
+        if self.idx_directory != self.directory {
+            collect(&self.idx_directory)?;
         }
         entries.sort();
 
-        let mut same_volume_shards: Vec<(String, u32)> = Vec::new(); // (filename, shard_id)
+        let mut same_volume_shards: Vec<(String, ShardId)> = Vec::new(); // (filename, shard_id)
         let mut prev_vid: Option<VolumeId> = None;
         let mut prev_collection: String = String::new();
 
@@ -1010,7 +1086,12 @@ impl DiskLocation {
     /// Validate + mount a (collection, vid) group when its `.ecx` is
     /// found. Mirrors `handleFoundEcxFile` in
     /// `weed/storage/disk_location_ec.go`.
-    fn handle_found_ecx_file(&mut self, shards: &[(String, u32)], collection: &str, vid: VolumeId) {
+    fn handle_found_ecx_file(
+        &mut self,
+        shards: &[(String, ShardId)],
+        collection: &str,
+        vid: VolumeId,
+    ) {
         let base = volume_file_name(&self.directory, collection, vid);
         let dat_path = format!("{}.dat", base);
         let dat_exists = check_dat_file_exists(&dat_path);
@@ -1024,7 +1105,7 @@ impl DiskLocation {
             return;
         }
 
-        let shard_ids: Vec<u32> = shards.iter().map(|(_, sid)| *sid).collect();
+        let shard_ids: Vec<ShardId> = shards.iter().map(|(_, sid)| *sid).collect();
         if let Err(e) = self.mount_ec_shards(vid, collection, &shard_ids, "") {
             // A mount failure (corrupt/locked .ecx, EMFILE, transient I/O) is
             // not proof the shards are disposable -- validate_ec_volume already
@@ -1033,8 +1114,7 @@ impl DiskLocation {
             // delete on a load error.
             warn!(
                 volume_id = vid.0,
-                "Failed to load EC shards: {}; keeping files for retry",
-                e,
+                "Failed to load EC shards: {}; keeping files for retry", e,
             );
             self.unmount_ec_shards(vid, &shard_ids);
         }
@@ -1047,7 +1127,7 @@ impl DiskLocation {
     /// distributed-EC shards waiting for cross-disk reconciliation.
     fn check_orphaned_shards(
         &self,
-        shards: &[(String, u32)],
+        shards: &[(String, ShardId)],
         collection: &str,
         vid: VolumeId,
     ) -> bool {
@@ -1083,7 +1163,7 @@ impl DiskLocation {
 
     /// Close all volumes.
     pub fn close(&mut self) {
-        for (_, v) in self.volumes.iter_mut() {
+        for v in self.volumes.values_mut() {
             v.close();
         }
         self.volumes.clear();
@@ -1103,20 +1183,60 @@ pub fn get_disk_stats(path: &str) -> (u64, u64) {
             Ok(p) => p,
             Err(_) => return (0, 0),
         };
-        unsafe {
-            let mut stat: libc::statvfs = std::mem::zeroed();
-            if libc::statvfs(c_path.as_ptr(), &mut stat) == 0 {
-                let all = stat.f_blocks as u64 * stat.f_frsize as u64;
-                let free = stat.f_bavail as u64 * stat.f_frsize as u64;
-                return (all, free);
-            }
+        // SAFETY: `libc::statvfs` is plain data — integers and reserved
+        // padding, no pointers and no restricted niches — so the all-zero
+        // value is a valid one for the call to overwrite.
+        let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+        // SAFETY: `c_path` is a live NUL-terminated `CString` that outlives
+        // the call, and `&mut stat` is a live, aligned, exclusive pointer the
+        // kernel only writes through; the fields are read below only after
+        // the call reports success.
+        if unsafe { libc::statvfs(c_path.as_ptr(), &mut stat) } != 0 {
+            return (0, 0);
         }
-        (0, 0)
+        let all = stat.f_blocks as u64 * stat.f_frsize as u64;
+        let free = stat.f_bavail as u64 * stat.f_frsize as u64;
+        (all, free)
     }
-    #[cfg(not(unix))]
+    #[cfg(windows)]
     {
-        let _ = path;
-        (0, 0)
+        use std::os::windows::ffi::OsStrExt;
+
+        // Canonicalize so symlinks, `.`/`..` segments, and relative paths
+        // resolve to the real location before querying. `\\?\`-prefixed
+        // extended-length paths and UNC (`\\?\UNC\...`) are passed through
+        // untouched: GetDiskFreeSpaceExW accepts them as-is.
+        let canonical = match std::fs::canonicalize(path) {
+            Ok(p) => p,
+            Err(_) => return (0, 0),
+        };
+        // UTF-16 with trailing NUL for the Win32 wide-string call.
+        let mut wide: Vec<u16> = canonical.as_os_str().encode_wide().collect();
+        // UNC directory names must end in a backslash for GetDiskFreeSpaceExW.
+        if !wide.ends_with(&[0x5C]) {
+            wide.push(0x5C);
+        }
+        wide.push(0);
+        // SAFETY: `wide` is NUL-terminated; the out-params are valid u64
+        // writes; the call has no other preconditions.
+        unsafe {
+            let mut free_available: u64 = 0;
+            let mut total: u64 = 0;
+            let ok = windows_sys::Win32::Storage::FileSystem::GetDiskFreeSpaceExW(
+                wide.as_ptr(),
+                &mut free_available,
+                &mut total,
+                std::ptr::null_mut(),
+            );
+            if ok == 0 {
+                return (0, 0);
+            }
+            return (total, free_available);
+        }
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        compile_error!("get_disk_stats is implemented for unix and windows only");
     }
 }
 
@@ -1152,7 +1272,12 @@ fn rm_if_present(path: String) -> io::Result<()> {
     }
 }
 
-fn ec_data_shards_from_vif(directory: &str, idx_directory: &str, collection: &str, vid: VolumeId) -> usize {
+fn ec_data_shards_from_vif(
+    directory: &str,
+    idx_directory: &str,
+    collection: &str,
+    vid: VolumeId,
+) -> usize {
     for dir in [directory, idx_directory] {
         let vif = format!("{}.vif", volume_file_name(dir, collection, vid));
         if let Some(ds) = fs::read_to_string(&vif)
@@ -1160,10 +1285,9 @@ fn ec_data_shards_from_vif(directory: &str, idx_directory: &str, collection: &st
             .and_then(|s| serde_json::from_str::<VifVolumeInfo>(&s).ok())
             .and_then(|vi| vi.ec_shard_config)
             .map(|c| c.data_shards as usize)
+            && ds > 0
         {
-            if ds > 0 {
-                return ds;
-            }
+            return ds;
         }
         if directory == idx_directory {
             break;
@@ -1199,7 +1323,7 @@ fn parse_collection_volume_id(base: &str) -> Option<(String, VolumeId)> {
 
 /// `pub(crate)` re-export of [`parse_ec_shard_extension`] for the
 /// cross-disk reconcile in `store_ec_reconcile.rs`.
-pub(crate) fn is_ec_shard_extension(ext: &str) -> Option<u32> {
+pub(crate) fn is_ec_shard_extension(ext: &str) -> Option<ShardId> {
     parse_ec_shard_extension(ext)
 }
 
@@ -1213,7 +1337,7 @@ pub(crate) fn is_ec_shard_extension(ext: &str) -> Option<u32> {
 /// shardId > 255` guard. The 3-digit form (`.ec100`–`.ec255`) is
 /// retained so the parser can still recognise shards from custom
 /// 32+ ratios that fit in a u8 even though OSS only ships 10+4.
-fn parse_ec_shard_extension(ext: &str) -> Option<u32> {
+fn parse_ec_shard_extension(ext: &str) -> Option<ShardId> {
     let rest = ext.strip_prefix(".ec")?;
     if rest.len() < 2 || rest.len() > 3 {
         return None;
@@ -1222,7 +1346,7 @@ fn parse_ec_shard_extension(ext: &str) -> Option<u32> {
     if id > 255 {
         return None;
     }
-    Some(id)
+    ShardId::try_from(id).ok()
 }
 
 /// Robust check that a `.dat` with actual data exists. An empty `.dat`
@@ -1241,7 +1365,7 @@ fn check_dat_file_exists(path: &str) -> bool {
 /// True when a `.vif` references remote-tier files: a remote-only volume
 /// that has no local `.dat` but must still load via the remote path,
 /// rather than be skipped as a lone EC sidecar.
-fn vif_references_remote_file(vif_path: &str) -> bool {
+pub(crate) fn vif_references_remote_file(vif_path: &str) -> bool {
     fs::read_to_string(vif_path)
         .ok()
         .and_then(|s| serde_json::from_str::<VifVolumeInfo>(&s).ok())
@@ -1284,7 +1408,10 @@ fn remove_empty_ec_dat_stub(volume_name: &str, idx_name: &str, vid: VolumeId) ->
         return false;
     }
 
-    warn!(volume_id = vid.0, "removing leftover empty .dat stub for EC volume");
+    warn!(
+        volume_id = vid.0,
+        "removing leftover empty .dat stub for EC volume"
+    );
     let _ = fs::remove_file(&dat_path);
     let _ = fs::remove_file(format!("{}.idx", idx_name));
     true
@@ -1307,6 +1434,17 @@ mod tests {
     use super::*;
     use tempfile::TempDir;
 
+    /// get_disk_stats must report real capacity for a real path on every
+    /// platform (Windows included) — consumers treat total==0 as "unknown"
+    /// and leave available_space at 0, which breaks volume assignment.
+    #[test]
+    fn test_get_disk_stats_reports_capacity_for_real_path() {
+        let tmp = TempDir::new().unwrap();
+        let (total, free) = get_disk_stats(tmp.path().to_str().unwrap());
+        assert!(total > 0, "expected total>0, got {total}");
+        assert!(free > 0, "expected free>0, got {free}");
+    }
+
     /// When `-dir.idx` is configured the EC `.vif` may live in the idx
     /// directory; the sweep must look there too, not only the data dir.
     #[test]
@@ -1329,7 +1467,11 @@ mod tests {
             }),
             ..Default::default()
         };
-        std::fs::write(format!("{}.vif", ibase), serde_json::to_string(&vif).unwrap()).unwrap();
+        std::fs::write(
+            format!("{}.vif", ibase),
+            serde_json::to_string(&vif).unwrap(),
+        )
+        .unwrap();
 
         assert!(
             remove_empty_ec_dat_stub(&vbase, &ibase, VolumeId(42)),
@@ -1345,16 +1487,30 @@ mod tests {
     fn test_validate_ec_volume_partial_dat_next_to_full_shards_keeps() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let loc = DiskLocation::new(dir, dir, 10, DiskType::HardDrive, MinFreeSpace::Percent(1.0), Vec::new()).unwrap();
+        let loc = DiskLocation::new(
+            dir,
+            dir,
+            10,
+            DiskType::HardDrive,
+            MinFreeSpace::Percent(1.0),
+            Vec::new(),
+        )
+        .unwrap();
         let base = volume_file_name(dir, "", VolumeId(70));
         let ds = crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT;
         let full = calculate_expected_shard_size(30 * 1024 * 1024, ds);
         for i in 0..ds {
-            std::fs::File::create(format!("{}.ec{:02}", base, i)).unwrap().set_len(full as u64).unwrap();
+            std::fs::File::create(format!("{}.ec{:02}", base, i))
+                .unwrap()
+                .set_len(full as u64)
+                .unwrap();
         }
         // Partial .dat: bigger than a superblock so it is not swept as a stub,
         // but smaller than what these shards encode.
-        std::fs::File::create(format!("{}.dat", base)).unwrap().set_len(5 * 1024 * 1024).unwrap();
+        std::fs::File::create(format!("{}.dat", base))
+            .unwrap()
+            .set_len(5 * 1024 * 1024)
+            .unwrap();
         assert!(
             loc.validate_ec_volume("", VolumeId(70)),
             "full-size shards beside a smaller (stale/partial) .dat must be kept",
@@ -1368,15 +1524,29 @@ mod tests {
     fn test_validate_ec_volume_interrupted_encode_reclaims() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let loc = DiskLocation::new(dir, dir, 10, DiskType::HardDrive, MinFreeSpace::Percent(1.0), Vec::new()).unwrap();
+        let loc = DiskLocation::new(
+            dir,
+            dir,
+            10,
+            DiskType::HardDrive,
+            MinFreeSpace::Percent(1.0),
+            Vec::new(),
+        )
+        .unwrap();
         let base = volume_file_name(dir, "", VolumeId(71));
         let ds = crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT;
         let dat_size = 30 * 1024 * 1024i64;
-        std::fs::File::create(format!("{}.dat", base)).unwrap().set_len(dat_size as u64).unwrap();
+        std::fs::File::create(format!("{}.dat", base))
+            .unwrap()
+            .set_len(dat_size as u64)
+            .unwrap();
         let partial = calculate_expected_shard_size(dat_size, ds) / 3;
         assert!(partial > 0);
         for i in 0..ds {
-            std::fs::File::create(format!("{}.ec{:02}", base, i)).unwrap().set_len(partial as u64).unwrap();
+            std::fs::File::create(format!("{}.ec{:02}", base, i))
+                .unwrap()
+                .set_len(partial as u64)
+                .unwrap();
         }
         assert!(
             !loc.validate_ec_volume("", VolumeId(71)),
@@ -1421,7 +1591,11 @@ mod tests {
             }),
             ..Default::default()
         };
-        std::fs::write(format!("{}.vif", dbase), serde_json::to_string(&with_gen).unwrap()).unwrap();
+        std::fs::write(
+            format!("{}.vif", dbase),
+            serde_json::to_string(&with_gen).unwrap(),
+        )
+        .unwrap();
         assert_eq!(loc.ec_generation_ts_ns("", vid), Some(4242));
 
         // A .vif with no EC config reads as generation 0 (recovered/pre-upgrade live volume).
@@ -1430,12 +1604,20 @@ mod tests {
             version: 3,
             ..Default::default()
         };
-        std::fs::write(format!("{}.vif", dbase), serde_json::to_string(&no_cfg).unwrap()).unwrap();
+        std::fs::write(
+            format!("{}.vif", dbase),
+            serde_json::to_string(&no_cfg).unwrap(),
+        )
+        .unwrap();
         assert_eq!(loc.ec_generation_ts_ns("", vid), Some(0));
 
         // idx-dir fallback: only the idx dir holds the .vif.
         std::fs::remove_file(format!("{}.vif", dbase)).unwrap();
-        std::fs::write(format!("{}.vif", ibase), serde_json::to_string(&with_gen).unwrap()).unwrap();
+        std::fs::write(
+            format!("{}.vif", ibase),
+            serde_json::to_string(&with_gen).unwrap(),
+        )
+        .unwrap();
         assert_eq!(loc.ec_generation_ts_ns("", vid), Some(4242));
     }
 
@@ -1475,16 +1657,8 @@ mod tests {
         )
         .unwrap();
 
-        loc.create_volume(
-            VolumeId(1),
-            "",
-            NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
-        )
-        .unwrap();
+        loc.create_volume(VolumeId(1), NeedleMapKind::InMemory, &VolumeSpec::default())
+            .unwrap();
 
         assert_eq!(loc.volumes_len(), 1);
         assert!(loc.find_volume(VolumeId(1)).is_some());
@@ -1508,24 +1682,15 @@ mod tests {
                 Vec::new(),
             )
             .unwrap();
-            loc.create_volume(
-                VolumeId(1),
-                "",
-                NeedleMapKind::InMemory,
-                None,
-                None,
-                0,
-                Version::current(),
-            )
-            .unwrap();
+            loc.create_volume(VolumeId(1), NeedleMapKind::InMemory, &VolumeSpec::default())
+                .unwrap();
             loc.create_volume(
                 VolumeId(2),
-                "test",
                 NeedleMapKind::InMemory,
-                None,
-                None,
-                0,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "test",
+                    ..Default::default()
+                },
             )
             .unwrap();
             loc.close();
@@ -1568,12 +1733,11 @@ mod tests {
             .unwrap();
             loc.create_volume(
                 VolumeId(9),
-                "good",
                 NeedleMapKind::InMemory,
-                None,
-                None,
-                0,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "good",
+                    ..Default::default()
+                },
             )
             .unwrap();
             loc.close();
@@ -1617,29 +1781,13 @@ mod tests {
         )
         .unwrap();
 
-        loc.create_volume(
-            VolumeId(1),
-            "",
-            NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
-        )
-        .unwrap();
-        loc.create_volume(
-            VolumeId(2),
-            "",
-            NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
-        )
-        .unwrap();
+        loc.create_volume(VolumeId(1), NeedleMapKind::InMemory, &VolumeSpec::default())
+            .unwrap();
+        loc.create_volume(VolumeId(2), NeedleMapKind::InMemory, &VolumeSpec::default())
+            .unwrap();
         assert_eq!(loc.volumes_len(), 2);
 
-        loc.delete_volume(VolumeId(1), false, false).unwrap();
+        loc.delete_volume(VolumeId(1), false, false, false).unwrap();
         assert_eq!(loc.volumes_len(), 1);
         assert!(loc.find_volume(VolumeId(1)).is_none());
     }
@@ -1660,32 +1808,29 @@ mod tests {
 
         loc.create_volume(
             VolumeId(1),
-            "pics",
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec {
+                collection: "pics",
+                ..Default::default()
+            },
         )
         .unwrap();
         loc.create_volume(
             VolumeId(2),
-            "pics",
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec {
+                collection: "pics",
+                ..Default::default()
+            },
         )
         .unwrap();
         loc.create_volume(
             VolumeId(3),
-            "docs",
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec {
+                collection: "docs",
+                ..Default::default()
+            },
         )
         .unwrap();
         assert_eq!(loc.volumes_len(), 3);
@@ -1695,6 +1840,34 @@ mod tests {
         assert!(loc.find_volume(VolumeId(3)).is_some());
     }
 
+    /// A 0-byte `.ecx` is the stub a failed EC distribute copy leaves behind.
+    /// Go's HasEcxFileOnDisk requires Size() > 0 so the stub cannot pin
+    /// placement to a disk that has no usable index.
+    #[test]
+    fn test_has_ecx_file_on_disk_ignores_zero_byte_stub() {
+        let tmp = TempDir::new().unwrap();
+        let data = tmp.path().join("data");
+        let idx = tmp.path().join("idx");
+        fs::create_dir_all(&data).unwrap();
+        fs::create_dir_all(&idx).unwrap();
+        let loc = DiskLocation::new(
+            data.to_str().unwrap(),
+            idx.to_str().unwrap(),
+            10,
+            DiskType::HardDrive,
+            MinFreeSpace::Percent(1.0),
+            Vec::new(),
+        )
+        .unwrap();
+
+        fs::write(idx.join("pics_7.ecx"), b"").unwrap();
+        assert!(!loc.has_ecx_file_on_disk("pics", VolumeId(7)));
+
+        // A real index in the data dir still counts, stub or no stub.
+        fs::write(data.join("pics_7.ecx"), [0u8; 16]).unwrap();
+        assert!(loc.has_ecx_file_on_disk("pics", VolumeId(7)));
+    }
+
     #[test]
     fn test_disk_location_delete_collection_removes_ec_volumes() {
         let tmp = TempDir::new().unwrap();
@@ -1711,6 +1884,8 @@ mod tests {
 
         let shard_path = format!("{}/pics_7.ec00", dir);
         std::fs::write(&shard_path, b"ec-shard").unwrap();
+        // An EC volume needs its .ecx to mount.
+        std::fs::write(format!("{}/pics_7.ecx", dir), [0u8; 16]).unwrap();
 
         loc.mount_ec_shards(VolumeId(7), "pics", &[0], "").unwrap();
         assert!(loc.has_ec_volume(VolumeId(7)));
@@ -1748,7 +1923,9 @@ mod tests {
         // mount_ec_shards with source_disk_type="ssd" — simulating the
         // VolumeEcShardsMount RPC path.
         std::fs::write(format!("{}/pics_7.ec00", dir), b"ec-shard").unwrap();
-        loc.mount_ec_shards(VolumeId(7), "pics", &[0], "ssd").unwrap();
+        std::fs::write(format!("{}/pics_7.ecx", dir), [0u8; 16]).unwrap();
+        loc.mount_ec_shards(VolumeId(7), "pics", &[0], "ssd")
+            .unwrap();
         {
             let ec_vol = loc.find_ec_volume(VolumeId(7)).expect("ec volume mounted");
             assert_eq!(
@@ -1765,7 +1942,9 @@ mod tests {
         std::fs::write(format!("{}/pics_7.ec01", dir), b"ec-shard").unwrap();
         loc.mount_ec_shards(VolumeId(7), "pics", &[1], "").unwrap();
         {
-            let ec_vol = loc.find_ec_volume(VolumeId(7)).expect("ec volume still mounted");
+            let ec_vol = loc
+                .find_ec_volume(VolumeId(7))
+                .expect("ec volume still mounted");
             assert_eq!(
                 ec_vol.disk_type,
                 DiskType::Ssd,
@@ -1774,6 +1953,96 @@ mod tests {
         }
     }
 
+    /// A refused shard (a 0-byte file beside an index with entries) on the
+    /// FIRST mount of a volume must not leave the just-created zero-shard
+    /// EcVolume registered — it would advertise a mount serving no data,
+    /// pin the .ecx/.ecj descriptors, and make placement's mounted tier
+    /// prefer this disk. A volume that already holds shards keeps them
+    /// (the mount RPC's pre-existing first-error-aborts contract).
+    #[test]
+    fn test_mount_ec_shards_refused_shard_removes_created_empty_volume() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut loc = DiskLocation::new(
+            dir,
+            dir,
+            10,
+            DiskType::HardDrive,
+            MinFreeSpace::Percent(1.0),
+            Vec::new(),
+        )
+        .unwrap();
+
+        // An index with one 16-byte entry and a 0-byte shard: the mount is
+        // refused, and the EcVolume created for it must be unregistered.
+        std::fs::write(format!("{}/pics_9.ecx", dir), [0u8; 16]).unwrap();
+        std::fs::write(format!("{}/pics_9.ec00", dir), b"").unwrap();
+        let err = loc
+            .mount_ec_shards(VolumeId(9), "pics", &[0], "")
+            .expect_err("a 0-byte shard beside an index with entries must refuse the mount");
+        assert!(
+            err.to_string().contains("empty (0 bytes)"),
+            "want the empty-shard refusal, got: {}",
+            err
+        );
+        assert!(
+            loc.find_ec_volume(VolumeId(9)).is_none(),
+            "a refused first mount must not leave a zero-shard EcVolume registered",
+        );
+
+        // With a valid shard mounted, a later refused shard keeps the
+        // existing registration intact.
+        std::fs::write(format!("{}/pics_9.ec01", dir), b"good bytes").unwrap();
+        loc.mount_ec_shards(VolumeId(9), "pics", &[1], "").unwrap();
+        loc.mount_ec_shards(VolumeId(9), "pics", &[0], "")
+            .expect_err("the 0-byte shard stays refused");
+        assert_eq!(
+            loc.find_ec_volume(VolumeId(9)).map(|v| v.shard_count()),
+            Some(1),
+            "an existing volume keeps its valid shards when a later shard is refused",
+        );
+    }
+
+    /// A mount retry re-listing an already mounted shard must keep the
+    /// existing registration and not bump the ec_shards gauge — the Rust
+    /// twin of Go's AddEcVolumeShard added=false handling.
+    #[test]
+    fn test_mount_ec_shards_duplicate_keeps_registration_and_gauge() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut loc = DiskLocation::new(
+            dir,
+            dir,
+            10,
+            DiskType::HardDrive,
+            MinFreeSpace::Percent(1.0),
+            Vec::new(),
+        )
+        .unwrap();
+
+        // A collection name unique to this test: the gauge is process-global
+        // and sibling tests running in parallel touch other labels.
+        std::fs::write(format!("{}/dupmount_11.ec00", dir), b"shard bytes").unwrap();
+        std::fs::write(format!("{}/dupmount_11.ecx", dir), [0u8; 16]).unwrap();
+        let gauge = crate::metrics::VOLUME_GAUGE.with_label_values(&["dupmount", "ec_shards"]);
+        let before = gauge.get();
+
+        loc.mount_ec_shards(VolumeId(11), "dupmount", &[0], "")
+            .unwrap();
+        loc.mount_ec_shards(VolumeId(11), "dupmount", &[0], "")
+            .expect("a duplicate mount must succeed as a no-op");
+
+        assert_eq!(
+            loc.find_ec_volume(VolumeId(11)).map(|v| v.shard_count()),
+            Some(1),
+        );
+        assert_eq!(
+            gauge.get(),
+            before + 1.0,
+            "the duplicate mount must not bump the ec_shards gauge",
+        );
+    }
+
     #[test]
     fn test_disk_location_persists_directory_uuid_and_tags() {
         let tmp = TempDir::new().unwrap();
@@ -1835,8 +2104,11 @@ mod tests {
             let path = format!("{}/{}_{}.ec{:02}", dir, collection, vid.0, sid);
             std::fs::write(&path, b"shard data nonempty").unwrap();
         }
-        std::fs::write(format!("{}/{}_{}.ecx", dir, collection, vid.0), vec![0u8; 20])
-            .unwrap();
+        std::fs::write(
+            format!("{}/{}_{}.ecx", dir, collection, vid.0),
+            vec![0u8; 20],
+        )
+        .unwrap();
         std::fs::write(format!("{}/{}_{}.ecj", dir, collection, vid.0), b"").unwrap();
         std::fs::write(
             format!("{}/{}_{}.vif", dir, collection, vid.0),
diff --git a/seaweed-volume/src/storage/erasure_coding/ec_bitrot.rs b/seaweed-volume/src/storage/erasure_coding/ec_bitrot.rs
index e1eab27b5a..d6afaa5e7e 100644
--- a/seaweed-volume/src/storage/erasure_coding/ec_bitrot.rs
+++ b/seaweed-volume/src/storage/erasure_coding/ec_bitrot.rs
@@ -30,6 +30,7 @@ use crate::pb::volume_server_pb::{
     ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums, EcShardConfig,
 };
 use crate::storage::erasure_coding::ec_shard::MAX_SHARD_COUNT;
+use crate::storage::io::read_exact_at;
 use crate::storage::needle::crc::CRC;
 
 /// Canonical extension for the checksum sidecar. Generation 0 (legacy/fresh
@@ -164,16 +165,16 @@ pub fn remove_bitrot_sidecars(base: &str) -> io::Result<()> {
     };
     let mut first_err: Option<io::Error> = None;
     let mut record = |res: io::Result<()>| {
-        if let Err(e) = res {
-            if first_err.is_none() {
-                first_err = Some(e);
-            }
+        if let Err(e) = res
+            && first_err.is_none()
+        {
+            first_err = Some(e);
         }
     };
     record(rm(format!("{}{}", base, BITROT_SIDECAR_EXT).into()));
     let path = Path::new(base);
     if let (Some(parent), Some(fname)) = (path.parent(), path.file_name()) {
-        let prefix = format!("{}{}.v", fname.to_string_lossy(), BITROT_SIDECAR_EXT);
+        let prefix = format!("{}{}.v", fname.display(), BITROT_SIDECAR_EXT);
         match fs::read_dir(parent) {
             Ok(entries) => {
                 for entry in entries.flatten() {
@@ -203,7 +204,7 @@ pub fn new_encode_uuid() -> Vec<u8> {
 
 /// Reports whether `block_size` is a power of two in [1 MiB, MAX_BITROT_BLOCK_SIZE].
 pub fn is_pow2_multiple_of_1mib(block_size: u32) -> bool {
-    block_size >= (1 << 20) && block_size <= MAX_BITROT_BLOCK_SIZE && block_size.count_ones() == 1
+    ((1 << 20)..=MAX_BITROT_BLOCK_SIZE).contains(&block_size) && block_size.count_ones() == 1
 }
 
 /// Returns ceil(covered_size / block_size).
@@ -402,7 +403,7 @@ pub fn validate_manifest(
             total
         ));
     }
-    let mut seen = vec![false; MAX_SHARD_COUNT];
+    let mut seen = [false; MAX_SHARD_COUNT];
     for s in &prot.shards {
         if s.shard_id >= total as u32 {
             return Err(format!(
@@ -465,6 +466,28 @@ pub fn resolve_status(
     }
 }
 
+/// Whether a generation-matching sidecar agrees with the geometry the volume is
+/// mounted with. Both files record the layout the generation was encoded with,
+/// so a disagreement means one of them is wrong and reads through the other
+/// would land at the wrong shard offsets — the caller fails the mount rather
+/// than merely dropping protection. A sidecar that records no EC config has
+/// nothing to contradict.
+pub fn geometry_matches(
+    prot: &EcBitrotProtection,
+    data_shards: usize,
+    parity_shards: usize,
+    block_size: i64,
+) -> bool {
+    match &prot.ec_shard_config {
+        None => true,
+        Some(cfg) => {
+            cfg.data_shards as usize == data_shards
+                && cfg.parity_shards as usize == parity_shards
+                && cfg.block_size == block_size
+        }
+    }
+}
+
 /// Returns the [`EcShardChecksums`] entry for a shard id, or `None`.
 pub fn shard_checksums(prot: &EcBitrotProtection, shard_id: u32) -> Option<&EcShardChecksums> {
     prot.shards.iter().find(|s| s.shard_id == shard_id)
@@ -483,7 +506,21 @@ pub fn verify_shard_file_blocks(
     entry: &EcShardChecksums,
     block_size: i64,
 ) -> io::Result<Vec<usize>> {
-    let f = File::open(path)?;
+    verify_shard_blocks(&File::open(path)?, entry, block_size)
+}
+
+/// Same verification against an ALREADY-OPEN shard handle.
+///
+/// Go's `ChecksumScrub` reads through `shard.ReadAt`, i.e. the handle the
+/// EcVolumeShard already holds, so a concurrent teardown that unlinks the shard
+/// cannot turn an intentional removal into a scrub read error. A scrub that
+/// runs with the store lock released has to read the same way — see
+/// `EcChecksumScrubPlan`.
+pub fn verify_shard_blocks(
+    f: &File,
+    entry: &EcShardChecksums,
+    block_size: i64,
+) -> io::Result<Vec<usize>> {
     let file_size = f.metadata()?.len() as i64;
     let want = unpack_u32_le(&entry.block_crc32c);
 
@@ -501,7 +538,7 @@ pub fn verify_shard_file_blocks(
             break;
         }
         let to_read = to_read as usize;
-        read_full_at(&f, &mut buf[..to_read], offset as u64)?;
+        read_exact_at(f, &mut buf[..to_read], offset as u64)?;
         if CRC::new(&buf[..to_read]).0 != *want_crc {
             mismatched.push(i);
         }
@@ -510,40 +547,14 @@ pub fn verify_shard_file_blocks(
     Ok(mismatched)
 }
 
-/// Reads exactly `buf.len()` bytes from `f` at `offset`, erroring on early EOF.
-fn read_full_at(f: &File, buf: &mut [u8], offset: u64) -> io::Result<()> {
-    let mut total = 0usize;
-    while total < buf.len() {
-        #[cfg(unix)]
-        let n = {
-            use std::os::unix::fs::FileExt;
-            f.read_at(&mut buf[total..], offset + total as u64)?
-        };
-        #[cfg(not(unix))]
-        let n = {
-            use std::io::{Read, Seek, SeekFrom};
-            let mut fc = f.try_clone()?;
-            fc.seek(SeekFrom::Start(offset + total as u64))?;
-            fc.read(&mut buf[total..])?
-        };
-        if n == 0 {
-            return Err(io::Error::new(
-                io::ErrorKind::UnexpectedEof,
-                "short read on shard block",
-            ));
-        }
-        total += n;
-    }
-    Ok(())
-}
-
 /// Builds the `EcShardConfig` proto for the given layout. The bitrot sidecar
 /// carries its own top-level encode_uuid, so the nested config leaves it empty.
-pub fn ec_shard_config(data_shards: u32, parity_shards: u32) -> EcShardConfig {
+pub fn ec_shard_config(data_shards: u32, parity_shards: u32, block_size: i64) -> EcShardConfig {
     EcShardConfig {
         data_shards,
         parity_shards,
         encode_ts_ns: 0,
+        block_size,
     }
 }
 
@@ -567,6 +578,7 @@ mod tests {
                 data_shards: 10,
                 parity_shards: 4,
                 encode_ts_ns: 0,
+                block_size: 0,
             }),
             shards: vec![
                 EcShardChecksums {
@@ -589,7 +601,10 @@ mod tests {
         save_bitrot_sidecar(path, &prot).unwrap();
         let bytes = std::fs::read(path).unwrap();
         let hex: String = bytes.iter().map(|b| format!("{:02x}", b)).collect();
-        assert_eq!(hex, CANONICAL_HEX, "Rust .ecsum bytes drifted from the Go canonical form");
+        assert_eq!(
+            hex, CANONICAL_HEX,
+            "Rust .ecsum bytes drifted from the Go canonical form"
+        );
         let _ = std::fs::remove_file(path);
     }
 
@@ -624,7 +639,11 @@ mod tests {
             format!("{}.ecsum.v1", base),
             format!("{}.ecsum.v7", base),
         ] {
-            assert!(!std::path::Path::new(&p).exists(), "{} should be removed", p);
+            assert!(
+                !std::path::Path::new(&p).exists(),
+                "{} should be removed",
+                p
+            );
         }
         assert!(std::path::Path::new(&keep_shard).exists());
         assert!(std::path::Path::new(&keep_other_vid).exists());
@@ -643,7 +662,9 @@ mod tests {
         assert!(!is_pow2_multiple_of_1mib(1 << 19)); // 512 KiB, too small
         assert!(!is_pow2_multiple_of_1mib(3 << 20)); // 3 MiB, not pow2
         assert!(!is_pow2_multiple_of_1mib(128 * 1024 * 1024)); // pow2 but > MAX_BITROT_BLOCK_SIZE
-        assert!(!is_pow2_multiple_of_1mib(DEFAULT_BITROT_BLOCK_SIZE as u32 + 1));
+        assert!(!is_pow2_multiple_of_1mib(
+            DEFAULT_BITROT_BLOCK_SIZE as u32 + 1
+        ));
     }
 
     #[test]
@@ -697,12 +718,7 @@ mod tests {
     #[test]
     fn test_save_load_roundtrip() {
         let tmp = tempfile::TempDir::new().unwrap();
-        let path = tmp
-            .path()
-            .join("vol.ecsum")
-            .to_str()
-            .unwrap()
-            .to_string();
+        let path = tmp.path().join("vol.ecsum").to_str().unwrap().to_string();
 
         let mut builder = ShardChecksumBuilder::new(DEFAULT_BITROT_BLOCK_SIZE as i64);
         builder.write(b"hello world");
@@ -712,7 +728,7 @@ mod tests {
             algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
             block_size: DEFAULT_BITROT_BLOCK_SIZE as u32,
             generation: 0,
-            ec_shard_config: Some(ec_shard_config(10, 4)),
+            ec_shard_config: Some(ec_shard_config(10, 4, 0)),
             shards: vec![EcShardChecksums {
                 shard_id: 0,
                 covered_size: covered,
@@ -750,7 +766,7 @@ mod tests {
             algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
             block_size: DEFAULT_BITROT_BLOCK_SIZE as u32,
             generation: 0,
-            ec_shard_config: Some(ec_shard_config(10, 4)),
+            ec_shard_config: Some(ec_shard_config(10, 4, 0)),
             shards: vec![EcShardChecksums {
                 shard_id: 0,
                 covered_size: 5,
@@ -794,7 +810,7 @@ mod tests {
             algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
             block_size: DEFAULT_BITROT_BLOCK_SIZE as u32,
             generation: 0,
-            ec_shard_config: Some(ec_shard_config(10, 4)),
+            ec_shard_config: Some(ec_shard_config(10, 4, 0)),
             shards,
             encode_uuid: vec![0u8; 16],
         }
@@ -863,8 +879,7 @@ mod tests {
         assert_eq!(resolve_status(&notfound, 0, 10, 4), BitrotStatus::Off);
 
         // Integrity failure => Invalid.
-        let bad: Result<EcBitrotProtection, BitrotLoadError> =
-            Err(BitrotLoadError::BadMagic(0));
+        let bad: Result<EcBitrotProtection, BitrotLoadError> = Err(BitrotLoadError::BadMagic(0));
         assert_eq!(resolve_status(&bad, 0, 10, 4), BitrotStatus::Invalid);
 
         // Generation mismatch => Off.
diff --git a/seaweed-volume/src/storage/erasure_coding/ec_decoder.rs b/seaweed-volume/src/storage/erasure_coding/ec_decoder.rs
index 428184538c..e0a3586ff2 100644
--- a/seaweed-volume/src/storage/erasure_coding/ec_decoder.rs
+++ b/seaweed-volume/src/storage/erasure_coding/ec_decoder.rs
@@ -3,10 +3,12 @@
 //! Rebuilds the original .dat + .idx files from data shards (.ec00-.ec09)
 //! and the sorted index (.ecx) + deletion journal (.ecj).
 
+use std::collections::HashSet;
 use std::fs::File;
 use std::io::{self, Read, Write};
 
 use crate::storage::erasure_coding::ec_shard::*;
+use crate::storage::erasure_coding::ec_volume::read_ecj_ids;
 use crate::storage::idx;
 use crate::storage::needle::needle::get_actual_size;
 use crate::storage::super_block::SUPER_BLOCK_SIZE;
@@ -20,18 +22,21 @@ use crate::storage::volume::{fsync_dir, volume_file_name};
 /// `dir` is used both for reading `.ec00` and `.ecx`. For split-disk
 /// reconciled volumes call [`find_dat_file_size_with_dirs`] instead.
 pub fn find_dat_file_size(dir: &str, collection: &str, volume_id: VolumeId) -> io::Result<i64> {
-    find_dat_file_size_with_dirs(dir, dir, collection, volume_id)
+    let deleted = read_ecj_deletions(&[dir], collection, volume_id)?;
+    find_dat_file_size_with_dirs(dir, dir, collection, volume_id, &deleted)
 }
 
 /// Like [`find_dat_file_size`] but lets the caller pass separate dirs
 /// for `.ec00` (the data shard) and `.ecx` (the sealed index). This
 /// is the form needed when shards are split across data dirs and the
-/// `.ecx` lives on a sibling disk's idx dir (#9252).
+/// `.ecx` lives on a sibling disk's idx dir (#9252). Needles in `deleted`
+/// count as deleted.
 pub fn find_dat_file_size_with_dirs(
     ec00_dir: &str,
     ecx_dir: &str,
     collection: &str,
     volume_id: VolumeId,
+    deleted: &HashSet<NeedleId>,
 ) -> io::Result<i64> {
     let ec00_base = volume_file_name(ec00_dir, collection, volume_id);
     let ecx_base = volume_file_name(ecx_dir, collection, volume_id);
@@ -53,9 +58,9 @@ pub fn find_dat_file_size_with_dirs(
 
     for i in 0..entry_count {
         let start = i * NEEDLE_MAP_ENTRY_SIZE;
-        let (_, offset, size) =
+        let (key, offset, size) =
             idx_entry_from_bytes(&ecx_data[start..start + NEEDLE_MAP_ENTRY_SIZE]);
-        if size.is_deleted() {
+        if size.is_deleted() || deleted.contains(&key) {
             continue;
         }
         let entry_stop = offset.to_actual_offset() + get_actual_size(size, version);
@@ -67,63 +72,163 @@ pub fn find_dat_file_size_with_dirs(
     Ok(dat_size)
 }
 
-/// Reconstruct a .dat file from EC data shards.
-///
-/// Reads from .ec00-.ec09 and writes a new .dat file. All data shards
-/// must live in `dir`. For the cross-disk reconciled layout where
-/// shards are split across multiple data dirs of the same node, use
-/// [`write_dat_file_from_shards_with_dirs`] instead.
-pub fn write_dat_file_from_shards(
-    dir: &str,
+/// Whether the `.ecx` in `ecx_dir` indexes a needle deleted neither there nor
+/// in `deleted`.
+pub fn has_live_needles(
+    ecx_dir: &str,
     collection: &str,
     volume_id: VolumeId,
-    dat_file_size: i64,
-    encoded_dat_file_size: i64,
-    data_shards: usize,
-) -> io::Result<()> {
-    let dirs: Vec<String> = (0..data_shards).map(|_| dir.to_string()).collect();
-    write_dat_file_from_shards_with_dirs(
-        dir,
-        collection,
-        volume_id,
-        dat_file_size,
-        encoded_dat_file_size,
-        data_shards,
-        &dirs,
-    )
+    deleted: &HashSet<NeedleId>,
+) -> io::Result<bool> {
+    let ecx_base = volume_file_name(ecx_dir, collection, volume_id);
+    let ecx_data = std::fs::read(format!("{}.ecx", ecx_base))?;
+    let (entries, _) = ecx_data.as_chunks::<NEEDLE_MAP_ENTRY_SIZE>();
+    Ok(entries.iter().any(|entry| {
+        let (key, _, size) = idx_entry_from_bytes(entry);
+        !size.is_deleted() && !deleted.contains(&key)
+    }))
 }
 
-/// Reconstruct a .dat file from EC data shards, taking the source
-/// directory for each shard separately.
-///
-/// `dat_dir` is where the produced `.dat` is written. `shard_dirs[i]`
-/// is the directory holding shard `i`. For the simple "all shards in
-/// one dir" case both can be the same value.
+/// Distinct needle ids journaled in the `.ecj` of any of `dirs`. Go folds the
+/// journal into the `.ecx` (RebuildEcxFile) before a decode; reading it leaves
+/// the sealed index untouched. Only NotFound means "no journal".
+pub fn read_ecj_deletions(
+    dirs: &[&str],
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<HashSet<NeedleId>> {
+    Ok(EcjDeletions::read(dirs, collection, volume_id)?.ids)
+}
+
+/// The ids [`read_ecj_deletions`] returns, plus how far each journal was read
+/// so that ids journaled later can be added.
+pub struct EcjDeletions {
+    pub ids: HashSet<NeedleId>,
+    /// Each distinct journal path and the whole-record length read so far.
+    journals: Vec<(String, u64)>,
+}
+
+impl EcjDeletions {
+    pub fn read(dirs: &[&str], collection: &str, volume_id: VolumeId) -> io::Result<Self> {
+        let mut journals: Vec<(String, u64)> = Vec::new();
+        for dir in dirs {
+            let path = format!("{}.ecj", volume_file_name(dir, collection, volume_id));
+            if !journals.iter().any(|(p, _)| *p == path) {
+                journals.push((path, 0));
+            }
+        }
+        let mut deletions = EcjDeletions {
+            ids: HashSet::new(),
+            journals,
+        };
+        deletions.catch_up()?;
+        Ok(deletions)
+    }
+
+    /// Adds the ids appended to each journal since the last read. A journal
+    /// that shrank is read again from the start — and the whole set rebuilt,
+    /// since ids already folded in from the truncated tail may have been a
+    /// rolled-back append. Non-regular journals (the FIFOs the tests stand
+    /// in for a blocking disk) stat empty and cannot be rolled back, so they
+    /// never count as shrunk.
+    pub fn catch_up(&mut self) -> io::Result<()> {
+        let mut shrank = false;
+        for (path, read_to) in &self.journals {
+            if *read_to == 0 {
+                continue;
+            }
+            match std::fs::metadata(path) {
+                Ok(m) => {
+                    if m.is_file() && m.len() < *read_to {
+                        shrank = true;
+                        break;
+                    }
+                }
+                // A journal that was read before and is now gone shrank to
+                // nothing (e.g. the volume was destroyed mid-scan) — the ids
+                // read from it no longer reflect committed content.
+                Err(e) if e.kind() == io::ErrorKind::NotFound => {
+                    shrank = true;
+                    break;
+                }
+                Err(e) => return Err(e),
+            }
+        }
+        if shrank {
+            self.ids.clear();
+            for (_, read_to) in &mut self.journals {
+                *read_to = 0;
+            }
+        }
+        for (path, read_to) in &mut self.journals {
+            let file = match File::open(&*path) {
+                Ok(file) => file,
+                Err(e) if e.kind() == io::ErrorKind::NotFound => continue,
+                Err(e) => return Err(e),
+            };
+            let len = file.metadata()?.len();
+            if len < *read_to {
+                *read_to = 0;
+            }
+            read_ecj_ids(&file, *read_to, len, &mut self.ids)?;
+            *read_to = len - len % NEEDLE_ID_SIZE as u64;
+        }
+        Ok(())
+    }
+
+    /// Clears the set and re-reads every journal from the start. Run under
+    /// the caller's store read lock (no append in flight): the result is
+    /// then exactly the committed content — an earlier unlocked read may
+    /// have folded in bytes a rolled-back append later truncated, or missed
+    /// a record re-appended to the very offset a rollback freed.
+    pub fn rescan(&mut self) -> io::Result<()> {
+        self.ids.clear();
+        for (_, read_to) in &mut self.journals {
+            *read_to = 0;
+        }
+        self.catch_up()
+    }
+}
+
+/// What it takes to rebuild a volume's .dat from its EC data shards.
 ///
 /// Mirrors Go's `WriteDatFile(baseFileName, datFileSize,
 /// encodedDatFileSize, shardFileNames)` shape — Go passes per-shard
 /// paths so a reconciled volume with shards split across disks of the
 /// same volume server can still be decoded back to a regular .dat
 /// (seaweedfs/seaweedfs#9252).
+#[derive(Clone, Copy, Debug)]
+pub struct DatRebuild<'a> {
+    /// Where the produced `.dat` is written.
+    pub dat_dir: &'a str,
+    pub collection: &'a str,
+    pub volume_id: VolumeId,
+    /// The number of bytes to write, i.e. the live data extent from
+    /// [`find_dat_file_size`].
+    pub dat_file_size: i64,
+    /// The .dat size at encode time, which fixed the shard block layout:
+    /// deletions can move the live extent below the large-block row
+    /// boundary, and deriving the layout from the shrunk extent would read
+    /// the shards in the wrong block order. Zero when the .vif does not
+    /// record the encode-time size; the layout is then inferred from the
+    /// shard size.
+    pub encoded_dat_file_size: i64,
+    pub data_shards: usize,
+    /// `shard_dirs[i]` is the directory holding shard `i`. `None` means every
+    /// data shard sits in `dat_dir`.
+    pub shard_dirs: Option<&'a [String]>,
+    /// The volume's shard block layout, e.g. `EcVolume::large_block_size()`
+    /// / `small_block_size()` from its .vif EC config.
+    pub large_block_size: usize,
+    pub small_block_size: usize,
+}
+
+/// Reconstruct a .dat file from EC data shards.
 ///
-/// `dat_file_size` is the number of bytes to write, i.e. the live data
-/// extent from [`find_dat_file_size`]. `encoded_dat_file_size` is the
-/// .dat size at encode time, which fixed the shard block layout:
-/// deletions can move the live extent below the large-block row
-/// boundary, and deriving the layout from the shrunk extent would read
-/// the shards in the wrong block order. Pass zero when the .vif does
-/// not record the encode-time size to infer the layout from the shard
-/// size.
-pub fn write_dat_file_from_shards_with_dirs(
-    dat_dir: &str,
-    collection: &str,
-    volume_id: VolumeId,
-    dat_file_size: i64,
-    encoded_dat_file_size: i64,
-    data_shards: usize,
-    shard_dirs: &[String],
-) -> io::Result<()> {
-    write_dat_file(
+/// Reads from .ec00-.ec09 and writes a new .dat file, from one directory or
+/// from the per-shard directories of a cross-disk reconciled volume.
+pub fn write_dat_file_from_shards(spec: &DatRebuild<'_>) -> io::Result<()> {
+    let DatRebuild {
         dat_dir,
         collection,
         volume_id,
@@ -131,23 +236,17 @@ pub fn write_dat_file_from_shards_with_dirs(
         encoded_dat_file_size,
         data_shards,
         shard_dirs,
-        ERASURE_CODING_LARGE_BLOCK_SIZE,
-        ERASURE_CODING_SMALL_BLOCK_SIZE,
-    )
-}
-
-#[allow(clippy::too_many_arguments)]
-fn write_dat_file(
-    dat_dir: &str,
-    collection: &str,
-    volume_id: VolumeId,
-    dat_file_size: i64,
-    encoded_dat_file_size: i64,
-    data_shards: usize,
-    shard_dirs: &[String],
-    large_block_size: usize,
-    small_block_size: usize,
-) -> io::Result<()> {
+        large_block_size,
+        small_block_size,
+    } = *spec;
+    let same_dir: Vec<String>;
+    let shard_dirs: &[String] = match shard_dirs {
+        Some(dirs) => dirs,
+        None => {
+            same_dir = vec![dat_dir.to_string(); data_shards];
+            &same_dir
+        }
+    };
     if data_shards == 0 {
         return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
@@ -224,10 +323,10 @@ fn write_dat_file(
 
         // Read large blocks
         while encoded_remaining >= large_row_size && remaining > 0 {
-            for i in 0..data_shards {
+            for (i, shard) in shards[..data_shards].iter().enumerate() {
                 let to_write = large_block_size.min(remaining as usize);
                 let mut buf = vec![0u8; to_write];
-                let n = shards[i].read_at(&mut buf, shard_offset)?;
+                let n = shard.read_at(&mut buf, shard_offset)?;
                 if n != to_write {
                     return Err(io::Error::new(
                         io::ErrorKind::UnexpectedEof,
@@ -246,10 +345,10 @@ fn write_dat_file(
 
         // Read small blocks
         while remaining > 0 {
-            for i in 0..data_shards {
+            for (i, shard) in shards[..data_shards].iter().enumerate() {
                 let to_write = small_block_size.min(remaining as usize);
                 let mut buf = vec![0u8; to_write];
-                let n = shards[i].read_at(&mut buf, shard_offset)?;
+                let n = shard.read_at(&mut buf, shard_offset)?;
                 if n != to_write {
                     return Err(io::Error::new(
                         io::ErrorKind::UnexpectedEof,
@@ -289,56 +388,87 @@ fn write_dat_file(
     write_result
 }
 
+/// Fails when the decoded `.dat` in `dat_dir` is shorter than the
+/// `dat_file_size` bytes its EC index references: the caller deletes the
+/// shards next, and they are the only other copy of the needles past the cut.
+/// A longer file passes.
+pub fn verify_decoded_dat_file(
+    dat_dir: &str,
+    collection: &str,
+    volume_id: VolumeId,
+    dat_file_size: i64,
+) -> io::Result<()> {
+    let dat_path = format!("{}.dat", volume_file_name(dat_dir, collection, volume_id));
+    let size = std::fs::metadata(&dat_path)?.len();
+    if (size as i64) < dat_file_size {
+        return Err(io::Error::new(
+            io::ErrorKind::UnexpectedEof,
+            format!(
+                "decoded {} is {} bytes, short of the {} its ec index references",
+                dat_path, size, dat_file_size
+            ),
+        ));
+    }
+    Ok(())
+}
+
 /// Write .idx file from .ecx index + .ecj deletion journal.
 ///
-/// Copies sorted .ecx entries to .idx, then appends tombstones for
-/// deleted needles from .ecj.
+/// See [`write_idx_file_from_ec_index_with_dirs`]; everything lives in `dir`.
 pub fn write_idx_file_from_ec_index(
     dir: &str,
     collection: &str,
     volume_id: VolumeId,
 ) -> io::Result<()> {
-    let base = volume_file_name(dir, collection, volume_id);
-    let ecx_path = format!("{}.ecx", base);
-    let ecj_path = format!("{}.ecj", base);
-    let idx_path = format!("{}.idx", base);
+    let deleted = read_ecj_deletions(&[dir], collection, volume_id)?;
+    let dat_file_size = find_dat_file_size_with_dirs(dir, dir, collection, volume_id, &deleted)?;
+    write_idx_file_from_ec_index_with_dirs(dir, dir, collection, volume_id, &deleted, dat_file_size)
+}
+
+/// Write the `.idx` for a `.dat` decoded to `dat_file_size` bytes, from the
+/// `.ecx` in `ecx_dir`, into `idx_dir`.
+///
+/// Copies the `.ecx` rows, then appends one tombstone per row whose needle is
+/// in `deleted`. A deleted needle at or past `dat_file_size` was cut from the
+/// `.dat`, so its row is dropped: a row pointing past the end of the `.dat`
+/// makes the volume load read-only.
+pub fn write_idx_file_from_ec_index_with_dirs(
+    ecx_dir: &str,
+    idx_dir: &str,
+    collection: &str,
+    volume_id: VolumeId,
+    deleted: &HashSet<NeedleId>,
+    dat_file_size: i64,
+) -> io::Result<()> {
+    let ecx_path = format!("{}.ecx", volume_file_name(ecx_dir, collection, volume_id));
+    let idx_path = format!("{}.idx", volume_file_name(idx_dir, collection, volume_id));
     // Write to a temp file and atomically rename into place, so a crash
     // mid-write never leaves a partial .idx at the final name beside the
     // source shards.
     let tmp_path = format!("{}.tmp", idx_path);
 
     let write_result = (|| -> io::Result<()> {
-        // Copy .ecx to the temp .idx
-        std::fs::copy(&ecx_path, &tmp_path)?;
-
-        // Append deletions from .ecj as tombstones. Read the journal directly
-        // and treat only NotFound as "no journal": Path::exists would also
-        // swallow a permission/IO error and silently skip deletions, which
-        // would resurrect deleted needles as live.
-        let mut idx_file = std::fs::OpenOptions::new()
-            .write(true)
-            .append(true)
-            .open(&tmp_path)?;
-        match std::fs::read(&ecj_path) {
-            Ok(ecj_data) => {
-                let count = ecj_data.len() / NEEDLE_ID_SIZE;
-                for i in 0..count {
-                    let start = i * NEEDLE_ID_SIZE;
-                    let needle_id = NeedleId::from_bytes(&ecj_data[start..start + NEEDLE_ID_SIZE]);
-                    idx::write_index_entry(
-                        &mut idx_file,
-                        needle_id,
-                        Offset::default(),
-                        TOMBSTONE_FILE_SIZE,
-                    )?;
-                }
+        let mut ecx_file = File::open(&ecx_path)?;
+        let mut idx_file = io::BufWriter::new(File::create(&tmp_path)?);
+        let mut tombstoned = Vec::new();
+        idx::walk_index_file(&mut ecx_file, 0, |key, offset, size| {
+            let is_deleted = size.is_deleted() || deleted.contains(&key);
+            if is_deleted && offset.to_actual_offset() >= dat_file_size {
+                return Ok(());
             }
-            Err(e) if e.kind() == io::ErrorKind::NotFound => {}
-            Err(e) => return Err(e),
+            idx::write_index_entry(&mut idx_file, key, offset, size)?;
+            if !size.is_deleted() && deleted.contains(&key) {
+                tombstoned.push(key);
+            }
+            Ok(())
+        })?;
+        for key in tombstoned {
+            idx::write_index_entry(&mut idx_file, key, Offset::default(), TOMBSTONE_FILE_SIZE)?;
         }
 
         // fsync, rename, then fsync the dir so the decoded .idx is durable and
         // atomically published before the caller deletes the source shards.
+        let idx_file = idx_file.into_inner().map_err(|e| e.into_error())?;
         idx_file.sync_all()?;
         drop(idx_file);
         // Windows rename does not replace an existing file on every version;
@@ -363,7 +493,7 @@ mod tests {
     use crate::storage::erasure_coding::ec_encoder;
     use crate::storage::needle::needle::Needle;
     use crate::storage::needle_map::NeedleMapKind;
-    use crate::storage::volume::Volume;
+    use crate::storage::volume::{Volume, VolumeSpec};
     use tempfile::TempDir;
 
     #[test]
@@ -372,16 +502,12 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         // Create volume with data
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
@@ -400,7 +526,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         let original_dat_size = v.dat_file_size().unwrap();
@@ -412,21 +538,26 @@ mod tests {
         // Encode to EC
         let data_shards = 10;
         let parity_shards = 4;
-        ec_encoder::write_ec_files(dir, dir, "", VolumeId(1), data_shards, parity_shards).unwrap();
+        let block_size =
+            ec_encoder::write_ec_files(dir, dir, "", VolumeId(1), data_shards, parity_shards)
+                .unwrap();
 
         // Delete original .dat and .idx
         std::fs::remove_file(format!("{}/1.dat", dir)).unwrap();
         std::fs::remove_file(format!("{}/1.idx", dir)).unwrap();
 
         // Reconstruct from EC shards
-        write_dat_file_from_shards(
-            dir,
-            "",
-            VolumeId(1),
-            original_dat_size as i64,
-            original_dat_size as i64,
+        write_dat_file_from_shards(&DatRebuild {
+            dat_dir: dir,
+            collection: "",
+            volume_id: VolumeId(1),
+            dat_file_size: original_dat_size as i64,
+            encoded_dat_file_size: original_dat_size as i64,
             data_shards,
-        )
+            shard_dirs: None,
+            large_block_size: block_size as usize,
+            small_block_size: block_size as usize,
+        })
         .unwrap();
         write_idx_file_from_ec_index(dir, "", VolumeId(1)).unwrap();
 
@@ -446,13 +577,9 @@ mod tests {
         let v2 = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
@@ -472,20 +599,29 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
         // No shard files exist, so de-striping must fail and publish nothing:
         // neither the final .dat nor a partial .dat.tmp may remain.
-        let res = write_dat_file_from_shards(dir, "", VolumeId(7), 100, 100, 10);
+        let res = write_dat_file_from_shards(&DatRebuild {
+            dat_dir: dir,
+            collection: "",
+            volume_id: VolumeId(7),
+            dat_file_size: 100,
+            encoded_dat_file_size: 100,
+            data_shards: 10,
+            shard_dirs: None,
+            large_block_size: ERASURE_CODING_LARGE_BLOCK_SIZE,
+            small_block_size: ERASURE_CODING_SMALL_BLOCK_SIZE,
+        });
         assert!(res.is_err());
         assert!(!std::path::Path::new(&format!("{}/7.dat", dir)).exists());
         assert!(!std::path::Path::new(&format!("{}/7.dat.tmp", dir)).exists());
     }
 
-
     // Decoding when .vif does not record the encode-time size: the layout is
     // inferred from the shard size, except when that is an exact large-block
     // multiple and the live extent reaches the ambiguous region.
     #[test]
     fn test_write_dat_file_fallback_layout() {
         use crate::storage::erasure_coding::ec_bitrot::{
-            ShardChecksumBuilder, DEFAULT_BITROT_BLOCK_SIZE,
+            DEFAULT_BITROT_BLOCK_SIZE, ShardChecksumBuilder,
         };
         use reed_solomon_erasure::galois_8::ReedSolomon;
 
@@ -523,10 +659,13 @@ mod tests {
                 &rs,
                 &mut shards,
                 &mut builders,
-                data_shards,
-                parity_shards,
-                LARGE,
-                SMALL,
+                ec_encoder::EcEncodeLayout {
+                    data_shards,
+                    parity_shards,
+                    buffer_size: SMALL,
+                    large_block_size: LARGE,
+                    small_block_size: SMALL,
+                },
             )
             .unwrap();
             for shard in &mut shards {
@@ -544,7 +683,17 @@ mod tests {
          -> io::Result<Vec<u8>> {
             let out = format!("{}/{}", dir, sub);
             std::fs::create_dir_all(&out).unwrap();
-            write_dat_file(&out, "", VolumeId(1), live, encoded, 10, shard_dirs, LARGE, SMALL)?;
+            write_dat_file_from_shards(&DatRebuild {
+                dat_dir: &out,
+                collection: "",
+                volume_id: VolumeId(1),
+                dat_file_size: live,
+                encoded_dat_file_size: encoded,
+                data_shards: 10,
+                shard_dirs: Some(shard_dirs),
+                large_block_size: LARGE,
+                small_block_size: SMALL,
+            })?;
             Ok(std::fs::read(format!("{}/1.dat", out)).unwrap())
         };
 
@@ -558,14 +707,20 @@ mod tests {
         // each shard exactly one large block, indistinguishable from one large row
         let (dir, shard_dirs, _) = encode("ambig1", large_row_size - 1);
         let err = decode_to(&dir, "out", large_row_size / 2, 0, &shard_dirs).unwrap_err();
-        assert!(err.to_string().contains("does not identify the block layout"));
+        assert!(
+            err.to_string()
+                .contains("does not identify the block layout")
+        );
 
         // two-row equivalent: decoding within the agreed prefix still works
         let (dir, shard_dirs, original) = encode("ambig2", 2 * large_row_size - 1);
         let decoded = decode_to(&dir, "outa", large_row_size, 0, &shard_dirs).unwrap();
         assert_eq!(&original[..large_row_size as usize], &decoded[..]);
         let err = decode_to(&dir, "outb", large_row_size + 1, 0, &shard_dirs).unwrap_err();
-        assert!(err.to_string().contains("does not identify the block layout"));
+        assert!(
+            err.to_string()
+                .contains("does not identify the block layout")
+        );
     }
 
     // Decoding after deletions moved the live extent below the large-block row
@@ -574,7 +729,7 @@ mod tests {
     #[test]
     fn test_write_dat_file_after_tail_deletion() {
         use crate::storage::erasure_coding::ec_bitrot::{
-            ShardChecksumBuilder, DEFAULT_BITROT_BLOCK_SIZE,
+            DEFAULT_BITROT_BLOCK_SIZE, ShardChecksumBuilder,
         };
         use reed_solomon_erasure::galois_8::ReedSolomon;
 
@@ -614,10 +769,13 @@ mod tests {
             &rs,
             &mut shards,
             &mut builders,
-            data_shards,
-            parity_shards,
-            LARGE,
-            SMALL,
+            ec_encoder::EcEncodeLayout {
+                data_shards,
+                parity_shards,
+                buffer_size: SMALL,
+                large_block_size: LARGE,
+                small_block_size: SMALL,
+            },
         )
         .unwrap();
         for shard in &mut shards {
@@ -633,17 +791,17 @@ mod tests {
         std::fs::create_dir(&out_dir).unwrap();
         let out = out_dir.to_str().unwrap();
         let decode = |live_size: i64, encoded_size: i64| -> Vec<u8> {
-            write_dat_file(
-                out,
-                "",
-                VolumeId(1),
-                live_size,
-                encoded_size,
+            write_dat_file_from_shards(&DatRebuild {
+                dat_dir: out,
+                collection: "",
+                volume_id: VolumeId(1),
+                dat_file_size: live_size,
+                encoded_dat_file_size: encoded_size,
                 data_shards,
-                &shard_dirs,
-                LARGE,
-                SMALL,
-            )
+                shard_dirs: Some(&shard_dirs),
+                large_block_size: LARGE,
+                small_block_size: SMALL,
+            })
             .unwrap();
             let path = format!("{}/1.dat", out);
             let decoded = std::fs::read(&path).unwrap();
@@ -678,17 +836,131 @@ mod tests {
         assert_ne!(&original[..(large_row_size / 2) as usize], &control[..]);
 
         // the live extent can never exceed the encode-time size
-        assert!(write_dat_file(
-            out,
-            "",
-            VolumeId(1),
-            dat_size + 1,
-            dat_size,
-            data_shards,
-            &shard_dirs,
-            LARGE,
-            SMALL,
-        )
-        .is_err());
+        assert!(
+            write_dat_file_from_shards(&DatRebuild {
+                dat_dir: out,
+                collection: "",
+                volume_id: VolumeId(1),
+                dat_file_size: dat_size + 1,
+                encoded_dat_file_size: dat_size,
+                data_shards,
+                shard_dirs: Some(&shard_dirs),
+                large_block_size: LARGE,
+                small_block_size: SMALL,
+            })
+            .is_err()
+        );
+    }
+
+    /// A journal many chunks long that repeats a few ids reads back as those
+    /// ids, from each dir once, whatever its length.
+    #[test]
+    fn test_read_ecj_deletions_collects_distinct_ids_across_dirs() {
+        let tmp = TempDir::new().unwrap();
+        let data = tmp.path().join("data");
+        let idx = tmp.path().join("idx");
+        let missing = tmp.path().join("missing");
+        std::fs::create_dir_all(&data).unwrap();
+        std::fs::create_dir_all(&idx).unwrap();
+        let (data, idx, missing) = (
+            data.to_str().unwrap(),
+            idx.to_str().unwrap(),
+            missing.to_str().unwrap(),
+        );
+
+        let entry = |id: u64| {
+            let mut buf = [0u8; NEEDLE_ID_SIZE];
+            NeedleId(id).to_bytes(&mut buf);
+            buf
+        };
+        // Past two load chunks of three repeating ids, then an id only in the
+        // last chunk and a torn trailing record.
+        let mut ecj = Vec::new();
+        while ecj.len() <= 2 * (1 << 20) {
+            for id in [1, 2, 3] {
+                ecj.extend_from_slice(&entry(id));
+            }
+        }
+        ecj.extend_from_slice(&entry(7));
+        ecj.extend_from_slice(&entry(8)[..3]);
+        std::fs::write(format!("{idx}/1.ecj"), &ecj).unwrap();
+        std::fs::write(format!("{data}/1.ecj"), entry(9)).unwrap();
+
+        let ids = read_ecj_deletions(&[data, idx, idx, missing], "", VolumeId(1)).unwrap();
+        let expected: HashSet<NeedleId> = [1, 2, 3, 7, 9].into_iter().map(NeedleId).collect();
+        assert_eq!(ids, expected);
+    }
+
+    #[test]
+    fn test_verify_decoded_dat_file_rejects_a_short_dat() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let dat_path = format!("{dir}/1.dat");
+
+        let err = verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap_err();
+        assert_eq!(err.kind(), io::ErrorKind::NotFound);
+
+        std::fs::write(&dat_path, vec![0u8; 99]).unwrap();
+        let err = verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap_err();
+        assert!(err.to_string().contains("short of the 100"), "{err}");
+
+        std::fs::write(&dat_path, vec![0u8; 100]).unwrap();
+        verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap();
+        std::fs::write(&dat_path, vec![0u8; 101]).unwrap();
+        verify_decoded_dat_file(dir, "", VolumeId(1), 100).unwrap();
+    }
+
+    /// Ids appended after the first read, including the rest of a record torn
+    /// at that point, are picked up; a journal that shrank is read again.
+    #[test]
+    fn test_ecj_deletions_catch_up_reads_appended_ids() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ecj_path = format!("{dir}/1.ecj");
+        let entry = |id: u64| {
+            let mut buf = [0u8; NEEDLE_ID_SIZE];
+            NeedleId(id).to_bytes(&mut buf);
+            buf
+        };
+        let append = |bytes: &[u8]| {
+            let mut f = std::fs::OpenOptions::new()
+                .create(true)
+                .append(true)
+                .open(&ecj_path)
+                .unwrap();
+            f.write_all(bytes).unwrap();
+        };
+        let ids = |d: &EcjDeletions| {
+            let mut ids: Vec<u64> = d.ids.iter().map(|id| id.0).collect();
+            ids.sort();
+            ids
+        };
+
+        // No journal yet.
+        let mut deletions = EcjDeletions::read(&[dir, dir], "", VolumeId(1)).unwrap();
+        assert!(deletions.ids.is_empty());
+
+        append(&entry(1));
+        append(&entry(2)[..3]);
+        deletions.catch_up().unwrap();
+        assert_eq!(ids(&deletions), [1]);
+
+        append(&entry(2)[3..]);
+        append(&entry(3));
+        deletions.catch_up().unwrap();
+        assert_eq!(ids(&deletions), [1, 2, 3]);
+
+        // A shrunk journal is rebuilt from its surviving content: ids folded
+        // in from the truncated tail may have been rolled back and must not
+        // linger as phantom tombstones.
+        std::fs::write(&ecj_path, entry(9)).unwrap();
+        deletions.catch_up().unwrap();
+        assert_eq!(ids(&deletions), [9]);
+
+        // A journal removed since it was read is the extreme shrink: its
+        // earlier ids must go with it, not linger.
+        std::fs::remove_file(&ecj_path).unwrap();
+        deletions.catch_up().unwrap();
+        assert!(deletions.ids.is_empty());
     }
 }
diff --git a/seaweed-volume/src/storage/erasure_coding/ec_encoder.rs b/seaweed-volume/src/storage/erasure_coding/ec_encoder.rs
index 15b944483b..f99f0855d7 100644
--- a/seaweed-volume/src/storage/erasure_coding/ec_encoder.rs
+++ b/seaweed-volume/src/storage/erasure_coding/ec_encoder.rs
@@ -5,16 +5,12 @@
 
 use std::fs::File;
 use std::io;
-#[cfg(not(unix))]
-use std::io::{Read, Seek, SeekFrom};
 
 use reed_solomon_erasure::galois_8::ReedSolomon;
 
-use crate::pb::volume_server_pb::{
-    ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums,
-};
+use crate::pb::volume_server_pb::{ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums};
 use crate::storage::erasure_coding::ec_bitrot::{
-    self, ShardChecksumBuilder, DEFAULT_BITROT_BLOCK_SIZE,
+    self, DEFAULT_BITROT_BLOCK_SIZE, ShardChecksumBuilder,
 };
 use crate::storage::erasure_coding::ec_shard::*;
 use crate::storage::idx;
@@ -25,6 +21,10 @@ use crate::storage::volume::volume_file_name;
 ///
 /// Creates .ec00-.ec13 files in the same directory.
 /// Also creates a sorted .ecx index from the .idx file.
+///
+/// Always encodes with the uniform block layout, sized for this .dat, and
+/// returns the block size so the caller can persist it to .vif. Mirrors Go's
+/// WriteEcFiles.
 pub fn write_ec_files(
     dir: &str,
     idx_dir: &str,
@@ -32,7 +32,7 @@ pub fn write_ec_files(
     volume_id: VolumeId,
     data_shards: usize,
     parity_shards: usize,
-) -> io::Result<()> {
+) -> io::Result<i64> {
     let base = volume_file_name(dir, collection, volume_id);
     let dat_path = format!("{}.dat", base);
     let idx_base = volume_file_name(idx_dir, collection, volume_id);
@@ -46,7 +46,7 @@ pub fn write_ec_files(
     let dat_size = dat_file.metadata()?.len() as i64;
 
     let rs = ReedSolomon::new(data_shards, parity_shards)
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("reed-solomon init: {:?}", e)))?;
+        .map_err(|e| io::Error::other(format!("reed-solomon init: {:?}", e)))?;
 
     // Create shard files
     let total_shards = data_shards + parity_shards;
@@ -66,17 +66,20 @@ pub fn write_ec_files(
         .map(|_| ShardChecksumBuilder::new(DEFAULT_BITROT_BLOCK_SIZE as i64))
         .collect();
 
-    // Encode in large blocks, then small blocks
+    let block_size = uniform_block_size(dat_size, data_shards);
     encode_dat_file(
         &dat_file,
         dat_size,
         &rs,
         &mut shards,
         &mut builders,
-        data_shards,
-        parity_shards,
-        ERASURE_CODING_LARGE_BLOCK_SIZE,
-        ERASURE_CODING_SMALL_BLOCK_SIZE,
+        EcEncodeLayout {
+            data_shards,
+            parity_shards,
+            buffer_size: ENCODE_BUFFER_SIZE,
+            large_block_size: block_size as usize,
+            small_block_size: block_size as usize,
+        },
     )?;
 
     // Close all shards
@@ -103,6 +106,7 @@ pub fn write_ec_files(
         ec_shard_config: Some(ec_bitrot::ec_shard_config(
             data_shards as u32,
             parity_shards as u32,
+            block_size,
         )),
         shards: shard_checksums,
         encode_uuid: ec_bitrot::new_encode_uuid(),
@@ -120,7 +124,19 @@ pub fn write_ec_files(
         );
     }
 
-    Ok(())
+    Ok(block_size)
+}
+
+/// uniform_block_size returns the per-shard block size of the uniform layout
+/// for a .dat of the given size: ceil(dat_file_size/data_shards) rounded up to
+/// a whole small block. For every input this equals the legacy layout's padded
+/// shard size, so only the byte placement differs between the two layouts,
+/// never the shard length. Mirrors Go's UniformBlockSize.
+pub fn uniform_block_size(dat_file_size: i64, data_shards: usize) -> i64 {
+    let small = ERASURE_CODING_SMALL_BLOCK_SIZE as i64;
+    let per_shard = (dat_file_size + data_shards as i64 - 1) / data_shards as i64;
+    let blocks = ((per_shard + small - 1) / small).max(1);
+    blocks * small
 }
 
 /// Rebuild missing EC shard files from existing shards using Reed-Solomon reconstruct.
@@ -144,7 +160,7 @@ pub fn rebuild_ec_files(
     }
 
     let rs = ReedSolomon::new(data_shards, parity_shards)
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("reed-solomon init: {:?}", e)))?;
+        .map_err(|e| io::Error::other(format!("reed-solomon init: {:?}", e)))?;
 
     let total_shards = data_shards + parity_shards;
     let mut shards: Vec<EcVolumeShard> = (0..total_shards as u8)
@@ -157,7 +173,7 @@ pub fn rebuild_ec_files(
     let mut shard_size = 0;
     for (i, shard) in shards.iter_mut().enumerate() {
         if !missing_shard_ids.contains(&(i as u32)) {
-            if let Ok(_) = shard.open() {
+            if shard.open().is_ok() {
                 let size = shard.file_size();
                 if size > shard_size {
                     shard_size = size;
@@ -167,7 +183,7 @@ pub fn rebuild_ec_files(
                 let mut found = false;
                 for &other_dir in additional_dirs {
                     let mut alt = EcVolumeShard::new(other_dir, collection, volume_id, i as u8);
-                    if let Ok(_) = alt.open() {
+                    if alt.open().is_ok() {
                         let size = alt.file_size();
                         if size > shard_size {
                             shard_size = size;
@@ -233,12 +249,8 @@ pub fn rebuild_ec_files(
         }
 
         // Reconstruct missing shards
-        rs.reconstruct(&mut buffers).map_err(|e| {
-            io::Error::new(
-                io::ErrorKind::Other,
-                format!("reed-solomon reconstruct: {:?}", e),
-            )
-        })?;
+        rs.reconstruct(&mut buffers)
+            .map_err(|e| io::Error::other(format!("reed-solomon reconstruct: {:?}", e)))?;
 
         // Write recovered data into the missing shards
         for i in missing_shard_ids {
@@ -266,40 +278,63 @@ pub fn rebuild_ec_files(
 /// FULL walk only reads live data-shard intervals, so on its own it can't catch
 /// bitrot in a parity shard or an unwalked region. Move to mode 4 (CHECKSUM) and
 /// drop it from mode 2 once the `.ecsum` subsystem lands.
+///
+/// `dirs` is indexed BY SHARD ID: each entry is the directory holding that
+/// shard, or `None` when no disk mounts it. A reconciled volume's shards can be
+/// split across disks, so a single directory cannot address them all.
 pub fn verify_ec_shards(
-    dir: &str,
+    dirs: &[Option<String>],
     collection: &str,
     volume_id: VolumeId,
     data_shards: usize,
     parity_shards: usize,
 ) -> io::Result<(Vec<u32>, Vec<String>)> {
     let rs = ReedSolomon::new(data_shards, parity_shards)
-        .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("reed-solomon init: {:?}", e)))?;
+        .map_err(|e| io::Error::other(format!("reed-solomon init: {:?}", e)))?;
 
     let total_shards = data_shards + parity_shards;
-    let mut shards: Vec<EcVolumeShard> = (0..total_shards as u8)
-        .map(|i| EcVolumeShard::new(dir, collection, volume_id, i))
+    let mut shards: Vec<Option<EcVolumeShard>> = (0..total_shards)
+        .map(|i| {
+            dirs.get(i)
+                .and_then(|d| d.as_ref())
+                .map(|d| EcVolumeShard::new(d, collection, volume_id, i as u8))
+        })
         .collect();
 
     let mut shard_size = 0;
     let mut broken_shards = std::collections::HashSet::new();
     let mut details = Vec::new();
 
-    for (i, shard) in shards.iter_mut().enumerate() {
-        if let Ok(_) = shard.open() {
-            let size = shard.file_size();
-            if size > shard_size {
-                shard_size = size;
+    for (i, slot) in shards.iter_mut().enumerate() {
+        match slot.as_mut() {
+            // Not a match guard: a binding is immutable until the guard ends,
+            // and `open()` needs `&mut self`.
+            Some(shard) => {
+                if shard.open().is_ok() {
+                    let size = shard.file_size();
+                    if size > shard_size {
+                        shard_size = size;
+                    }
+                } else {
+                    broken_shards.insert(i as u32);
+                    details.push(format!("failed to open or missing shard {}", i));
+                }
+            }
+            None => {
+                broken_shards.insert(i as u32);
+                details.push(format!("shard {} is not mounted on any disk", i));
             }
-        } else {
-            broken_shards.insert(i as u32);
-            details.push(format!("failed to open or missing shard {}", i));
         }
     }
 
     if shard_size == 0 || broken_shards.len() >= parity_shards {
-        // Can't do much if we don't know the size or have too many missing
-        return Ok((broken_shards.into_iter().collect(), details));
+        // Can't do much if we don't know the size or have too many missing.
+        // Sort like the normal path below: a `HashSet` iteration order would
+        // make this return shard ids in an arbitrary order, and enough `None`
+        // entries in `dirs` now reach this branch for a caller to notice.
+        let mut broken_vec: Vec<u32> = broken_shards.into_iter().collect();
+        broken_vec.sort_unstable();
+        return Ok((broken_vec, details));
     }
 
     let block_size = ERASURE_CODING_SMALL_BLOCK_SIZE;
@@ -313,7 +348,17 @@ pub fn verify_ec_shards(
         let mut read_failed = false;
         for i in 0..total_shards {
             if !broken_shards.contains(&(i as u32)) {
-                if let Err(e) = shards[i].read_at(&mut buffers[i], offset) {
+                // The `None` arm is defensive and unreachable: the open loop
+                // put every unmounted slot in `broken_shards`, which this
+                // branch already skipped. Kept because the `Option` forces
+                // some handling here, and an error is the only shape that
+                // cannot quietly feed an unread buffer into the parity
+                // comparison below. Nothing needs to cover it.
+                let read = match shards[i].as_mut() {
+                    Some(shard) => shard.read_at(&mut buffers[i], offset),
+                    None => Err(io::Error::new(io::ErrorKind::NotFound, "shard not mounted")),
+                };
+                if let Err(e) = read {
                     broken_shards.insert(i as u32);
                     details.push(format!("read error shard {}: {}", i, e));
                     read_failed = true;
@@ -327,27 +372,27 @@ pub fn verify_ec_shards(
         if !read_failed {
             // Need to convert Vec<Vec<u8>> to &[&[u8]] for rs.verify
             let slice_ptrs: Vec<&[u8]> = buffers.iter().map(|v| v.as_slice()).collect();
-            if let Ok(is_valid) = rs.verify(&slice_ptrs) {
-                if !is_valid {
-                    // Reed-Solomon verification failed. We cannot easily pinpoint which shard
-                    // is corrupted without recalculating parities or syndromes, so we just
-                    // log that this batch has corruption. Wait, we can test each parity shard!
-                    // Let's re-encode from the first `data_shards` and compare to the actual `parity_shards`.
+            if let Ok(is_valid) = rs.verify(&slice_ptrs)
+                && !is_valid
+            {
+                // Reed-Solomon verification failed. We cannot easily pinpoint which shard
+                // is corrupted without recalculating parities or syndromes, so we just
+                // log that this batch has corruption. Wait, we can test each parity shard!
+                // Let's re-encode from the first `data_shards` and compare to the actual `parity_shards`.
 
-                    let mut verify_buffers = buffers.clone();
-                    // Clear the parity parts
-                    for i in data_shards..total_shards {
-                        verify_buffers[i].fill(0);
-                    }
-                    if rs.encode(&mut verify_buffers).is_ok() {
-                        for i in 0..total_shards {
-                            if buffers[i] != verify_buffers[i] {
-                                broken_shards.insert(i as u32);
-                                details.push(format!(
-                                    "parity mismatch on shard {} at offset {}",
-                                    i, offset
-                                ));
-                            }
+                let mut verify_buffers = buffers.clone();
+                // Clear the parity parts
+                for buf in &mut verify_buffers[data_shards..total_shards] {
+                    buf.fill(0);
+                }
+                if rs.encode(&mut verify_buffers).is_ok() {
+                    for i in 0..total_shards {
+                        if buffers[i] != verify_buffers[i] {
+                            broken_shards.insert(i as u32);
+                            details.push(format!(
+                                "parity mismatch on shard {} at offset {}",
+                                i, offset
+                            ));
                         }
                     }
                 }
@@ -359,7 +404,7 @@ pub fn verify_ec_shards(
     }
 
     // Close all shards
-    for shard in &mut shards {
+    for shard in shards.iter_mut().flatten() {
         shard.close();
     }
 
@@ -370,7 +415,7 @@ pub fn verify_ec_shards(
 }
 
 /// Write sorted .ecx index from .idx file.
-fn write_sorted_ecx_from_idx(idx_path: &str, ecx_path: &str) -> io::Result<()> {
+pub(crate) fn write_sorted_ecx_from_idx(idx_path: &str, ecx_path: &str) -> io::Result<()> {
     if !std::path::Path::new(idx_path).exists() {
         return Err(io::Error::new(
             io::ErrorKind::NotFound,
@@ -380,22 +425,23 @@ fn write_sorted_ecx_from_idx(idx_path: &str, ecx_path: &str) -> io::Result<()> {
 
     // Read all idx entries
     let mut idx_file = File::open(idx_path)?;
-    let mut entries: Vec<(NeedleId, Offset, Size)> = Vec::new();
-
+    let mut last: std::collections::HashMap<NeedleId, (Offset, Size)> =
+        std::collections::HashMap::new();
     idx::walk_index_file(&mut idx_file, 0, |key, offset, size| {
-        entries.push((key, offset, size));
+        last.insert(key, (offset, size));
         Ok(())
     })?;
-
-    // Sort by NeedleId, then by actual offset so later entries come last
-    entries.sort_by_key(|&(key, offset, _)| (key, offset.to_actual_offset()));
-
-    // Remove duplicates (keep last/latest entry for each key).
-    // dedup_by_key keeps the first in each run, so we reverse first,
-    // dedup, then reverse back.
-    entries.reverse();
-    entries.dedup_by_key(|entry| entry.0);
-    entries.reverse();
+    let mut entries: Vec<(NeedleId, Offset, Size)> = last
+        .into_iter()
+        .filter_map(|(key, (offset, size))| {
+            if size.is_deleted() || offset.is_zero() {
+                None
+            } else {
+                Some((key, offset, size))
+            }
+        })
+        .collect();
+    entries.sort_by_key(|&(key, _o, _s)| key);
 
     // Write sorted entries to .ecx
     let mut ecx_file = File::create(ecx_path)?;
@@ -421,6 +467,8 @@ pub fn rebuild_ecx_file(
     collection: &str,
     volume_id: VolumeId,
     data_shards: usize,
+    block_size: i64,
+    dat_file_size: i64,
     additional_dirs: &[&str],
 ) -> io::Result<()> {
     use crate::storage::needle::needle::get_actual_size;
@@ -437,7 +485,7 @@ pub fn rebuild_ecx_file(
         .collect();
 
     for (i, shard) in shards.iter_mut().enumerate() {
-        if let Err(_) = shard.open() {
+        if shard.open().is_err() {
             let mut found = false;
             for &other_dir in additional_dirs {
                 let mut alt = EcVolumeShard::new(other_dir, collection, volume_id, i as u8);
@@ -454,7 +502,7 @@ pub fn rebuild_ecx_file(
                 }
                 return Err(io::Error::new(
                     io::ErrorKind::NotFound,
-                    format!("cannot open data shard for ecx rebuild"),
+                    "cannot open data shard for ecx rebuild".to_string(),
                 ));
             }
         }
@@ -462,11 +510,43 @@ pub fn rebuild_ecx_file(
 
     // Determine total logical data size from shard sizes
     let shard_size = shards.iter().map(|s| s.file_size()).max().unwrap_or(0);
-    let total_data_size = shard_size as i64 * data_shards as i64;
+    let total_data_size = shard_size * data_shards as i64;
+    // The volume's shard block layout: the .vif-recorded uniform block size,
+    // or the legacy two-tier sizes when 0. The row count comes from the shard
+    // length; -1 disambiguates a legacy shard that is an exact large-block
+    // multiple (mirrors the ecdFileSize-1 fallback in the read path).
+    let (large_block, small_block) = if block_size > 0 {
+        (block_size, block_size)
+    } else {
+        (
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        )
+    };
+    // The row count the de-stripe walks with. The encode-time .dat size is the
+    // authority — the same value the read path divides by data_shards — and the
+    // padded extent is only a fallback: under the legacy layout a shard that is
+    // an exact large-block multiple reads as one row too many, which
+    // re-interprets its last large row as small blocks and scrambles the
+    // recovered offsets. Subtracting one keeps that fallback on the safe side of
+    // the boundary, exactly as the read path's own fallback does.
+    let locate_shard_size = if dat_file_size > 0 {
+        dat_file_size / data_shards as i64
+    } else {
+        (shard_size - 1).max(0)
+    };
 
     // Read version from superblock (first byte of logical data)
     let mut sb_buf = [0u8; SUPER_BLOCK_SIZE];
-    read_from_data_shards(&shards, &mut sb_buf, 0, data_shards)?;
+    read_from_data_shards(
+        &shards,
+        &mut sb_buf,
+        0,
+        data_shards,
+        locate_shard_size,
+        large_block,
+        small_block,
+    )?;
     let version = Version(sb_buf[0]);
 
     // Walk needles starting after superblock
@@ -475,14 +555,35 @@ pub fn rebuild_ecx_file(
     let mut entries: Vec<(NeedleId, Offset, Size)> = Vec::new();
 
     while offset + header_size as i64 <= total_data_size {
-        // Read needle header (cookie + needle_id + size = 16 bytes)
+        // Read needle header (cookie + needle_id + size = 16 bytes).
+        // A read failure is NOT the end of the data — every offset in
+        // range maps into the shards, so an error means a truncated or
+        // unreadable shard. Publishing the entries collected so far as
+        // a successful .ecx would hand out a silently incomplete
+        // recovery index; propagate instead. (The scan still ends
+        // normally on the zero-cookie tail below.)
         let mut header_buf = [0u8; NEEDLE_HEADER_SIZE];
-        if read_from_data_shards(&shards, &mut header_buf, offset as u64, data_shards).is_err() {
-            break;
+        if let Err(e) = read_from_data_shards(
+            &shards,
+            &mut header_buf,
+            offset as u64,
+            data_shards,
+            locate_shard_size,
+            large_block,
+            small_block,
+        ) {
+            for s in &mut shards {
+                s.close();
+            }
+            return Err(io::Error::new(
+                e.kind(),
+                format!("scan needle header at offset {}: {}", offset, e),
+            ));
         }
 
         let cookie = Cookie::from_bytes(&header_buf[..COOKIE_SIZE]);
-        let needle_id = NeedleId::from_bytes(&header_buf[COOKIE_SIZE..COOKIE_SIZE + NEEDLE_ID_SIZE]);
+        let needle_id =
+            NeedleId::from_bytes(&header_buf[COOKIE_SIZE..COOKIE_SIZE + NEEDLE_ID_SIZE]);
         let size = Size::from_bytes(&header_buf[COOKIE_SIZE + NEEDLE_ID_SIZE..header_size]);
 
         // Validate: stop if we hit zero cookie+id (end of data)
@@ -532,106 +633,138 @@ pub fn rebuild_ecx_file(
     Ok(())
 }
 
-/// Read bytes from EC data shards at a logical offset in the .dat file.
+/// Read bytes from EC data shards at a logical offset in the .dat file,
+/// resolving the shard/offset through the volume's block layout via
+/// locate_data — the same mapping the read path uses.
 fn read_from_data_shards(
     shards: &[EcVolumeShard],
     buf: &mut [u8],
     logical_offset: u64,
     data_shards: usize,
+    locate_shard_size: i64,
+    large_block_size: i64,
+    small_block_size: i64,
 ) -> io::Result<()> {
-    let small_block = ERASURE_CODING_SMALL_BLOCK_SIZE as u64;
-    let data_shards_u64 = data_shards as u64;
-
-    let mut bytes_read = 0u64;
-    let mut remaining = buf.len() as u64;
-    let mut current_offset = logical_offset;
-
-    while remaining > 0 {
-        // Determine which shard and at what shard-offset this logical offset maps to.
-        // The data is interleaved: large blocks first, then small blocks.
-        // For simplicity, use the small block size for all calculations since
-        // large blocks are multiples of small blocks.
-        let row_size = small_block * data_shards_u64;
-        let row_index = current_offset / row_size;
-        let row_offset = current_offset % row_size;
-        let shard_index = (row_offset / small_block) as usize;
-        let shard_offset = row_index * small_block + (row_offset % small_block);
-
-        if shard_index >= data_shards {
+    let intervals = crate::storage::erasure_coding::ec_locate::locate_data(
+        logical_offset as i64,
+        Size(buf.len() as i32),
+        locate_shard_size,
+        data_shards as u32,
+        large_block_size,
+        small_block_size,
+    );
+    let mut bytes_read = 0usize;
+    for interval in &intervals {
+        let (shard_id, shard_offset) =
+            interval.to_shard_id_and_offset(data_shards as u32, large_block_size, small_block_size);
+        if shard_id as usize >= data_shards {
             return Err(io::Error::new(
                 io::ErrorKind::InvalidInput,
                 "shard index out of range",
             ));
         }
-
-        // How many bytes can we read from this position in this shard block
-        let bytes_left_in_block = small_block - (row_offset % small_block);
-        let to_read = remaining.min(bytes_left_in_block) as usize;
-
-        let dest = &mut buf[bytes_read as usize..bytes_read as usize + to_read];
-        shards[shard_index].read_at(dest, shard_offset)?;
-
-        bytes_read += to_read as u64;
-        remaining -= to_read as u64;
-        current_offset += to_read as u64;
+        let to_read = interval.size as usize;
+        let dest = &mut buf[bytes_read..bytes_read + to_read];
+        // Exact-read semantics: read_at may legally return fewer bytes
+        // than requested, and treating a short read as complete leaves
+        // the tail of `dest` as whatever the buffer held before. Loop
+        // until filled; zero bytes inside the mapped range means the
+        // shard is truncated — an error, not an end.
+        let mut filled = 0usize;
+        while filled < to_read {
+            let n = shards[shard_id as usize]
+                .read_at(&mut dest[filled..], shard_offset as u64 + filled as u64)?;
+            if n == 0 {
+                return Err(io::Error::new(
+                    io::ErrorKind::UnexpectedEof,
+                    format!(
+                        "short read from data shard {}: {} of {} bytes at offset {}",
+                        shard_id, filled, to_read, shard_offset
+                    ),
+                ));
+            }
+            filled += n;
+        }
+        bytes_read += to_read;
+    }
+    if bytes_read != buf.len() {
+        return Err(io::Error::new(
+            io::ErrorKind::UnexpectedEof,
+            "short read from data shards",
+        ));
     }
-
     Ok(())
 }
 
+/// Buffer size for one encode sub-batch per shard, mirroring Go's 256KB
+/// bufferSize in WriteEcFiles. A block is processed in block_size/buffer_size
+/// sub-batches, so memory stays at total_shards * 256KB no matter how large
+/// the uniform block is.
+const ENCODE_BUFFER_SIZE: usize = 256 * 1024;
+
+/// Shape of one encode run: the Reed-Solomon split and the block sizes that
+/// fix where every byte of the .dat lands in the shards. Mirrors Go's
+/// `ECContext`. `buffer_size` must divide both block sizes.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct EcEncodeLayout {
+    pub(crate) data_shards: usize,
+    pub(crate) parity_shards: usize,
+    /// Bytes of each shard's block handled per sub-batch; bounds memory at
+    /// `total_shards * buffer_size` however large the blocks are.
+    pub(crate) buffer_size: usize,
+    pub(crate) large_block_size: usize,
+    pub(crate) small_block_size: usize,
+}
+
 /// Encode the .dat file data into shard files.
 ///
 /// Uses a two-phase approach matching Go's ec_encoder.go:
-/// 1. Process as many large blocks (1GB) as possible
-/// 2. Process remaining data with small blocks (1MB)
-#[allow(clippy::too_many_arguments)]
+/// 1. Process as many large blocks as possible
+/// 2. Process remaining data with small blocks
 pub(crate) fn encode_dat_file(
     dat_file: &File,
     dat_size: i64,
     rs: &ReedSolomon,
     shards: &mut [EcVolumeShard],
     builders: &mut [ShardChecksumBuilder],
-    data_shards: usize,
-    parity_shards: usize,
-    large_block_size: usize,
-    small_block_size: usize,
+    layout: EcEncodeLayout,
 ) -> io::Result<()> {
+    let EcEncodeLayout {
+        data_shards,
+        parity_shards,
+        buffer_size,
+        large_block_size,
+        small_block_size,
+    } = layout;
+    let total_shards = data_shards + parity_shards;
+    let mut buffers: Vec<Vec<u8>> = (0..total_shards).map(|_| vec![0u8; buffer_size]).collect();
+    let mut run = EncodeRun {
+        dat_file,
+        rs,
+        buffers: &mut buffers,
+        shards,
+        builders,
+        data_shards,
+    };
+
     let mut remaining = dat_size;
     let mut offset: u64 = 0;
 
-    // Phase 1: Process large blocks (1GB each) while enough data remains
+    // Phase 1: process whole large-block rows while enough data remains
     let large_row_size = large_block_size * data_shards;
 
     while remaining >= large_row_size as i64 {
-        encode_one_batch(
-            dat_file,
-            offset,
-            large_block_size,
-            rs,
-            shards,
-            builders,
-            data_shards,
-            parity_shards,
-        )?;
+        run.encode_row(offset, large_block_size)?;
         offset += large_row_size as u64;
         remaining -= large_row_size as i64;
     }
 
-    // Phase 2: Process remaining data with small blocks (1MB each)
+    // Phase 2: process remaining data with small blocks
     let small_row_size = small_block_size * data_shards;
 
     while remaining > 0 {
         let to_process = remaining.min(small_row_size as i64);
-        encode_one_batch(
-            dat_file,
-            offset,
-            small_block_size,
-            rs,
-            shards,
-            builders,
-            data_shards,
-            parity_shards,
-        )?;
+        run.encode_row(offset, small_block_size)?;
         offset += to_process as u64;
         remaining -= to_process;
     }
@@ -639,75 +772,66 @@ pub(crate) fn encode_dat_file(
     Ok(())
 }
 
-/// Encode one batch (row) of data.
-fn encode_one_batch(
-    dat_file: &File,
-    offset: u64,
-    block_size: usize,
-    rs: &ReedSolomon,
-    shards: &mut [EcVolumeShard],
-    builders: &mut [ShardChecksumBuilder],
+/// Everything one encode run streams through: the source .dat, the codec, a
+/// buffer per shard, and the per-shard file and checksum sinks.
+struct EncodeRun<'a> {
+    dat_file: &'a File,
+    rs: &'a ReedSolomon,
+    buffers: &'a mut [Vec<u8>],
+    shards: &'a mut [EcVolumeShard],
+    builders: &'a mut [ShardChecksumBuilder],
     data_shards: usize,
-    parity_shards: usize,
-) -> io::Result<()> {
-    let total_shards = data_shards + parity_shards;
-    // Each batch allocates block_size * total_shards bytes.
-    // With large blocks (1 GiB) this is 14 GiB -- guard against OOM.
-    let total_alloc = block_size.checked_mul(total_shards).ok_or_else(|| {
-        io::Error::new(
-            io::ErrorKind::InvalidInput,
-            "block_size * shard count overflows usize",
-        )
-    })?;
-    // Large-block encoding uses 1 GiB * 14 shards = 14 GiB; allow up to 16 GiB.
-    const MAX_BATCH_ALLOC: usize = 16 * 1024 * 1024 * 1024; // 16 GiB safety limit
-    if total_alloc > MAX_BATCH_ALLOC {
-        return Err(io::Error::new(
-            io::ErrorKind::InvalidInput,
-            format!(
-                "batch allocation too large ({} bytes, limit {} bytes); block_size={} shards={}",
-                total_alloc, MAX_BATCH_ALLOC, block_size, total_shards,
-            ),
-        ));
+}
+
+impl EncodeRun<'_> {
+    /// Encode one row of blocks, streaming it in ENCODE_BUFFER_SIZE sub-batches
+    /// so arbitrarily large blocks never require block-sized allocations.
+    /// Mirrors Go's encodeData.
+    fn encode_row(&mut self, row_offset: u64, block_size: usize) -> io::Result<()> {
+        let buffer_size = self.buffers[0].len();
+        if !block_size.is_multiple_of(buffer_size) {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                format!(
+                    "unexpected block size {} buffer size {}",
+                    block_size, buffer_size
+                ),
+            ));
+        }
+        let batch_count = block_size / buffer_size;
+        for b in 0..batch_count {
+            self.encode_one_batch(row_offset + (b * buffer_size) as u64, block_size)?;
+        }
+        Ok(())
     }
 
-    // Allocate buffers for all shards
-    let mut buffers: Vec<Vec<u8>> = (0..total_shards).map(|_| vec![0u8; block_size]).collect();
-
-    // Read data shards from .dat file
-    for i in 0..data_shards {
-        let read_offset = offset + (i * block_size) as u64;
-
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::FileExt;
-            dat_file.read_at(&mut buffers[i], read_offset)?;
+    /// Encode one sub-batch: the same buffer-sized slice of every shard's block
+    /// in this row. Mirrors Go's encodeDataOneBatch.
+    fn encode_one_batch(&mut self, offset: u64, block_size: usize) -> io::Result<()> {
+        // Read data shards from the .dat file, zero-filling past EOF — the
+        // buffers are reused across batches, so the tail must be cleared
+        // explicitly.
+        for (i, buf) in self.buffers[..self.data_shards].iter_mut().enumerate() {
+            let read_offset = offset + (i * block_size) as u64;
+            let n = crate::storage::io::read_full_at(self.dat_file, buf, read_offset)?;
+            buf[n..].fill(0);
         }
 
-        #[cfg(not(unix))]
-        {
-            let mut f = dat_file.try_clone()?;
-            f.seek(SeekFrom::Start(read_offset))?;
-            f.read(&mut buffers[i])?;
+        // Encode parity shards
+        self.rs
+            .encode(&mut *self.buffers)
+            .map_err(|e| io::Error::other(format!("reed-solomon encode: {:?}", e)))?;
+
+        // Write all shard buffers to files and feed the same bytes to each
+        // shard's bitrot checksum builder, keeping covered_size == on-disk
+        // length.
+        for (i, buf) in self.buffers.iter().enumerate() {
+            self.shards[i].write_all(buf)?;
+            self.builders[i].write(buf);
         }
+
+        Ok(())
     }
-
-    // Encode parity shards
-    rs.encode(&mut buffers).map_err(|e| {
-        io::Error::new(
-            io::ErrorKind::Other,
-            format!("reed-solomon encode: {:?}", e),
-        )
-    })?;
-
-    // Write all shard buffers to files and feed the same bytes to each
-    // shard's bitrot checksum builder, keeping covered_size == on-disk length.
-    for (i, buf) in buffers.iter().enumerate() {
-        shards[i].write_all(buf)?;
-        builders[i].write(buf);
-    }
-
-    Ok(())
 }
 
 #[cfg(test)]
@@ -715,7 +839,7 @@ mod tests {
     use super::*;
     use crate::storage::needle::needle::Needle;
     use crate::storage::needle_map::NeedleMapKind;
-    use crate::storage::volume::Volume;
+    use crate::storage::volume::{Volume, VolumeSpec};
     use tempfile::TempDir;
 
     #[test]
@@ -724,16 +848,12 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         // Create a volume with some data
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
@@ -746,7 +866,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         v.close();
@@ -775,16 +895,12 @@ mod tests {
     fn make_volume_with_needles(n: u64) -> TempDir {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         for i in 1..=n {
@@ -798,7 +914,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut needle, true).unwrap();
+            v.write_needle(&mut needle, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         v.close();
@@ -854,16 +970,12 @@ mod tests {
     // the dir path so a test can drop/truncate shards and rebuild.
     fn encode_sample_volume(tmp: &TempDir) -> String {
         let dir = tmp.path().to_str().unwrap().to_string();
-        let mut v = Volume::new(
+        let v = Volume::new(
             &dir,
             &dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         for i in 1..=20 {
@@ -875,7 +987,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         v.close();
@@ -895,7 +1007,10 @@ mod tests {
         let victim = format!("{}/1.ec03", dir);
         let full = std::fs::metadata(&victim).unwrap().len();
         assert!(full > 0, "encoded shard should be non-empty");
-        let f = std::fs::OpenOptions::new().write(true).open(&victim).unwrap();
+        let f = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&victim)
+            .unwrap();
         f.set_len(full / 2).unwrap();
         drop(f);
 
@@ -1020,7 +1135,7 @@ mod tests {
 
         // Without additional_dirs, rebuild must fail: shards 1, 3, 6 are not
         // in primary and the full logical .dat content can't be reconstructed.
-        let res = rebuild_ecx_file(&primary, "", VolumeId(1), 10, &[]);
+        let res = rebuild_ecx_file(&primary, "", VolumeId(1), 10, 0, 0, &[]);
         assert!(
             res.is_err(),
             "ecx rebuild without additional_dirs must fail when data shards are on another disk"
@@ -1031,7 +1146,7 @@ mod tests {
         );
 
         // With additional_dirs pointing at the secondary, the rebuild must succeed.
-        rebuild_ecx_file(&primary, "", VolumeId(1), 10, &[secondary.as_str()]).unwrap();
+        rebuild_ecx_file(&primary, "", VolumeId(1), 10, 0, 0, &[secondary.as_str()]).unwrap();
 
         assert!(
             std::path::Path::new(&ecx_path).exists(),
@@ -1043,6 +1158,113 @@ mod tests {
         );
     }
 
+    // A uniform-layout volume (block size > 1MiB) must have its .ecx rebuilt
+    // through the recorded geometry; the legacy 1MiB mapping would scan
+    // garbage past the first block boundary.
+    #[test]
+    fn test_rebuild_ecx_file_uniform_layout() {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let v = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(2),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for i in 1u64..=12 {
+            let data: Vec<u8> = (0..2 << 20)
+                .map(|b| ((b as u64).wrapping_mul(2654435761).wrapping_add(i) >> 8) as u8)
+                .collect();
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.clone(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        let block_size = write_ec_files(&dir, &dir, "", VolumeId(2), 10, 4).unwrap();
+        assert!(
+            block_size > ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+            "fixture must diverge from the legacy layout"
+        );
+
+        let ecx_path = format!("{}/2.ecx", dir);
+        let canonical = std::fs::read(&ecx_path).unwrap();
+        std::fs::remove_file(&ecx_path).unwrap();
+
+        rebuild_ecx_file(&dir, "", VolumeId(2), 10, block_size, 0, &[]).unwrap();
+        let rebuilt = std::fs::read(&ecx_path).unwrap();
+        assert_eq!(
+            canonical, rebuilt,
+            "rebuilt .ecx must match the encode-time .ecx"
+        );
+    }
+
+    // A truncated data shard must FAIL the .ecx rebuild, not publish the
+    // entries scanned so far as a successful (silently incomplete) index.
+    #[test]
+    fn test_rebuild_ecx_file_fails_on_truncated_shard() {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let v = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(3),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for i in 1u64..=12 {
+            let data: Vec<u8> = (0..2 << 20)
+                .map(|b| ((b as u64).wrapping_mul(2654435761).wrapping_add(i) >> 8) as u8)
+                .collect();
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.clone(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        let block_size = write_ec_files(&dir, &dir, "", VolumeId(3), 10, 4).unwrap();
+
+        let ecx_path = format!("{}/3.ecx", dir);
+        std::fs::remove_file(&ecx_path).unwrap();
+
+        // Truncate shard 0 to just the superblock: the scan's very first
+        // needle-header read (offset SUPER_BLOCK_SIZE, shard 0 under the
+        // uniform layout) lands in the missing region. The pre-fix code
+        // broke the scan there and published an EMPTY .ecx as success.
+        let shard_path = format!("{}/3.ec00", dir);
+        let f = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&shard_path)
+            .unwrap();
+        f.set_len(crate::storage::super_block::SUPER_BLOCK_SIZE as u64)
+            .unwrap();
+        drop(f);
+
+        let res = rebuild_ecx_file(&dir, "", VolumeId(3), 10, block_size, 0, &[]);
+        assert!(res.is_err(), "rebuild over a truncated shard must fail");
+        assert!(
+            !std::path::Path::new(&ecx_path).exists(),
+            "a failed rebuild must not leave a partial .ecx behind"
+        );
+    }
+
     #[test]
     fn test_reed_solomon_basic() {
         let data_shards = 10;
@@ -1094,16 +1316,12 @@ mod tests {
         let idx_dir = idx_tmp.path().to_str().unwrap();
 
         // Create a volume with separate data and index directories
-        let mut v = Volume::new(
+        let v = Volume::new(
             dat_dir,
             idx_dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
@@ -1116,7 +1334,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         v.close();
@@ -1178,16 +1396,12 @@ mod tests {
         let idx_dir = idx_tmp.path().to_str().unwrap();
         let wrong_dir = wrong_tmp.path().to_str().unwrap();
 
-        let mut v = Volume::new(
+        let v = Volume::new(
             dat_dir,
             idx_dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
@@ -1198,7 +1412,7 @@ mod tests {
             data_size: 5,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
         v.sync_to_disk().unwrap();
         v.close();
 
@@ -1209,4 +1423,189 @@ mod tests {
             "should fail when idx_dir doesn't contain .idx"
         );
     }
+
+    /// Write a real 10+4 encoded volume into `dir`.
+    ///
+    /// Unlike `make_volume_with_needles` and `encode_sample_volume` this seeds
+    /// a caller-chosen directory, which is what a split-disk test needs: the
+    /// shards have to be scattered out of the directory they were encoded into.
+    fn seed_encoded_volume(dir: &str, vid: VolumeId) {
+        let v = Volume::new(
+            dir,
+            dir,
+            vid,
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for i in 1..=8 {
+            let data = format!("test data for needle {} with a bit more length", i);
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.as_bytes().to_vec(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        write_ec_files(dir, dir, "", vid, 10, 4).unwrap();
+    }
+
+    /// Shards split across two directories must all be found. Passing one dir
+    /// per shard is what lets a reconciled volume's parity be checked at all.
+    #[test]
+    fn test_verify_ec_shards_reads_shards_from_multiple_dirs() {
+        let tmp = TempDir::new().unwrap();
+        let src = tmp.path().join("src");
+        let d0 = tmp.path().join("d0");
+        let d1 = tmp.path().join("d1");
+        for d in [&src, &d0, &d1] {
+            std::fs::create_dir_all(d).unwrap();
+        }
+        let src_s = src.to_str().unwrap();
+        seed_encoded_volume(src_s, VolumeId(1));
+
+        // Move shards 0..=6 to d0 and 7..=13 to d1.
+        let mut dirs: Vec<Option<String>> = Vec::new();
+        for id in 0..14u8 {
+            let target = if id < 7 { &d0 } else { &d1 };
+            std::fs::rename(
+                format!("{}/1.ec{:02}", src_s, id),
+                format!("{}/1.ec{:02}", target.to_str().unwrap(), id),
+            )
+            .unwrap();
+            dirs.push(Some(target.to_str().unwrap().to_string()));
+        }
+
+        let (broken, details) = verify_ec_shards(&dirs, "", VolumeId(1), 10, 4).unwrap();
+        assert!(
+            broken.is_empty(),
+            "split-dir shards reported broken: {:?}",
+            details
+        );
+    }
+
+    /// A shard no disk holds is a missing shard, not a panic and not a silent
+    /// pass: it is REPORTED, by id, with a message that distinguishes "no disk
+    /// holds this shard" from "the disk holds it but it won't open".
+    ///
+    /// Read the scope literally. This does NOT show that the mounted shards
+    /// verify clean. `dirs[5] = None` puts shard 5 in `broken_shards` before
+    /// the block loop starts, so every iteration takes the
+    /// `else { read_failed = true; }` arm and the Reed-Solomon comparison never
+    /// runs at all. `broken == vec![5]` therefore holds because the other 13
+    /// were never verified, not because they verified clean -- a parity check
+    /// over intact shards is what
+    /// `test_verify_ec_shards_reads_shards_from_multiple_dirs` and the
+    /// end-to-end split-disk FULL scrub establish.
+    #[test]
+    fn test_verify_ec_shards_treats_a_none_dir_as_missing() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        seed_encoded_volume(dir, VolumeId(1));
+
+        let mut dirs: Vec<Option<String>> = (0..14).map(|_| Some(dir.to_string())).collect();
+        dirs[5] = None;
+
+        let (broken, details) = verify_ec_shards(&dirs, "", VolumeId(1), 10, 4).unwrap();
+        assert_eq!(
+            broken,
+            vec![5],
+            "an unmounted shard must be reported, and only it: {:?}",
+            details
+        );
+        // "no disk holds this shard" and "the disk holds it but it won't open"
+        // are different operator problems, which is why they carry different
+        // messages. Asserting only the id would let one masquerade as the other.
+        assert!(
+            details.iter().any(|d| d.contains("not mounted")),
+            "an unmounted shard must be distinguished from an unopenable one, got {:?}",
+            details
+        );
+    }
+
+    #[test]
+    fn test_encode_drops_tombstone_last_wins() {
+        use crate::storage::idx;
+        use crate::storage::types::{NeedleId, Offset, Size, TOMBSTONE_FILE_SIZE};
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let idx_path = format!("{}/t.idx", dir);
+        let ecx_path = format!("{}/t.ecx", dir);
+        let key = NeedleId(12345);
+        {
+            let mut f = std::fs::File::create(&idx_path).unwrap();
+            idx::write_index_entry(&mut f, key, Offset::from_actual_offset(1024), Size(100))
+                .unwrap();
+            idx::write_index_entry(&mut f, key, Offset::default(), TOMBSTONE_FILE_SIZE).unwrap();
+        }
+        super::write_sorted_ecx_from_idx(&idx_path, &ecx_path).unwrap();
+        let mut found = false;
+        {
+            let mut f = std::fs::File::open(&ecx_path).unwrap();
+            idx::walk_index_file(&mut f, 0, |k, _o, _s| {
+                if k == key {
+                    found = true;
+                }
+                Ok(())
+            })
+            .unwrap();
+        }
+        assert!(!found, "tombstoned key must not appear in .ecx");
+        let idx2 = format!("{}/t2.idx", dir);
+        let ecx2 = format!("{}/t2.ecx", dir);
+        {
+            let mut f = std::fs::File::create(&idx2).unwrap();
+            idx::write_index_entry(&mut f, key, Offset::default(), TOMBSTONE_FILE_SIZE).unwrap();
+            idx::write_index_entry(&mut f, key, Offset::from_actual_offset(2048), Size(200))
+                .unwrap();
+        }
+        super::write_sorted_ecx_from_idx(&idx2, &ecx2).unwrap();
+        let mut found2 = false;
+        {
+            let mut f = std::fs::File::open(&ecx2).unwrap();
+            idx::walk_index_file(&mut f, 0, |k, o, s| {
+                if k == key {
+                    found2 = true;
+                    assert_eq!(o.to_actual_offset(), 2048);
+                    assert_eq!(s, Size(200));
+                }
+                Ok(())
+            })
+            .unwrap();
+        }
+        assert!(found2, "re-created key must appear live");
+        // Zero offset with non-negative size is also a deletion: Go
+        // readNeedleMap (`if !offset.IsZero() && !size.IsDeleted() { Set }
+        // else { Delete }`) and CompactNeedleMap::load_from_idx both treat
+        // it as deleted. Encode must drop it too, or the .ecx live-map
+        // mismatches replay.
+        let idx3 = format!("{}/t3.idx", dir);
+        let ecx3 = format!("{}/t3.ecx", dir);
+        {
+            let mut f = std::fs::File::create(&idx3).unwrap();
+            idx::write_index_entry(&mut f, key, Offset::from_actual_offset(1024), Size(100))
+                .unwrap();
+            idx::write_index_entry(&mut f, key, Offset::default(), Size(0)).unwrap();
+        }
+        super::write_sorted_ecx_from_idx(&idx3, &ecx3).unwrap();
+        let mut found3 = false;
+        {
+            let mut f = std::fs::File::open(&ecx3).unwrap();
+            idx::walk_index_file(&mut f, 0, |k, _o, _s| {
+                if k == key {
+                    found3 = true;
+                }
+                Ok(())
+            })
+            .unwrap();
+        }
+        assert!(
+            !found3,
+            "zero-offset row must not appear in .ecx even with non-negative size"
+        );
+    }
 }
diff --git a/seaweed-volume/src/storage/erasure_coding/ec_locate.rs b/seaweed-volume/src/storage/erasure_coding/ec_locate.rs
index 4c1f06aa2d..baaed9f3b7 100644
--- a/seaweed-volume/src/storage/erasure_coding/ec_locate.rs
+++ b/seaweed-volume/src/storage/erasure_coding/ec_locate.rs
@@ -18,21 +18,26 @@ pub struct Interval {
 }
 
 impl Interval {
-    pub fn to_shard_id_and_offset(&self, data_shards: u32) -> (ShardId, i64) {
+    pub fn to_shard_id_and_offset(
+        &self,
+        data_shards: u32,
+        large_block_size: i64,
+        small_block_size: i64,
+    ) -> (ShardId, i64) {
         let data_shards_usize = data_shards as usize;
         let shard_id = (self.block_index % data_shards_usize) as ShardId;
         let row_index = self.block_index / data_shards_usize;
 
         let block_size = if self.is_large_block {
-            ERASURE_CODING_LARGE_BLOCK_SIZE as i64
+            large_block_size
         } else {
-            ERASURE_CODING_SMALL_BLOCK_SIZE as i64
+            small_block_size
         };
 
         let mut offset = row_index as i64 * block_size + self.inner_block_offset;
         if !self.is_large_block {
             // Small blocks come after large blocks in the shard file
-            offset += self.large_block_rows_count as i64 * ERASURE_CODING_LARGE_BLOCK_SIZE as i64;
+            offset += self.large_block_rows_count as i64 * large_block_size;
         }
 
         (shard_id, offset)
@@ -42,7 +47,14 @@ impl Interval {
 /// Locate the EC shard intervals needed to read data at the given offset and size.
 ///
 /// `shard_size` is the size of a single shard file.
-pub fn locate_data(offset: i64, size: Size, shard_size: i64, data_shards: u32) -> Vec<Interval> {
+pub fn locate_data(
+    offset: i64,
+    size: Size,
+    shard_size: i64,
+    data_shards: u32,
+    large_block_size: i64,
+    small_block_size: i64,
+) -> Vec<Interval> {
     let mut intervals = Vec::new();
     let data_size = size.0 as i64;
 
@@ -50,17 +62,14 @@ pub fn locate_data(offset: i64, size: Size, shard_size: i64, data_shards: u32) -
         return intervals;
     }
 
-    let large_block_size = ERASURE_CODING_LARGE_BLOCK_SIZE as i64;
-    let small_block_size = ERASURE_CODING_SMALL_BLOCK_SIZE as i64;
     let large_row_size = large_block_size * data_shards as i64;
     let small_row_size = small_block_size * data_shards as i64;
 
-    // Number of large block rows
-    let n_large_block_rows = if shard_size > 0 {
-        ((shard_size - 1) / large_block_size) as usize
-    } else {
-        0
-    };
+    // Number of large block rows. Mirrors Go's shardDatSize/largeBlockLength:
+    // the caller's ecd-size fallback already subtracts 1 to disambiguate the
+    // exact-multiple case, so no further -1 here — a shard size that IS an
+    // exact multiple (dat_file_size path) means real full large rows.
+    let n_large_block_rows = (shard_size / large_block_size) as usize;
     let large_section_size = n_large_block_rows as i64 * large_row_size;
 
     let mut remaining_offset = offset;
@@ -150,7 +159,11 @@ mod tests {
             is_large_block: true,
             large_block_rows_count: 1,
         };
-        let (shard_id, offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
         assert_eq!(shard_id, 0);
         assert_eq!(offset, 100);
 
@@ -162,7 +175,11 @@ mod tests {
             is_large_block: true,
             large_block_rows_count: 1,
         };
-        let (shard_id, _offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, _offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
         assert_eq!(shard_id, 5);
 
         // Block index 12 (data_shards=10) → row_index 1, shard_id 2
@@ -173,7 +190,11 @@ mod tests {
             is_large_block: true,
             large_block_rows_count: 5,
         };
-        let (shard_id, offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
         assert_eq!(shard_id, 2); // 12 % 10 = 2
         assert_eq!(offset, large_block_size + 200); // row 1 offset + inner_block_offset
 
@@ -185,7 +206,11 @@ mod tests {
             is_large_block: true,
             large_block_rows_count: 2,
         };
-        let (shard_id, offset) = interval.to_shard_id_and_offset(data_shards);
+        let (shard_id, offset) = interval.to_shard_id_and_offset(
+            data_shards,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
         assert_eq!(shard_id, 0);
         assert_eq!(offset, ERASURE_CODING_LARGE_BLOCK_SIZE as i64); // row 1 offset
     }
@@ -193,7 +218,14 @@ mod tests {
     #[test]
     fn test_locate_data_small_file() {
         // Small file: 100 bytes at offset 50, shard size = 1MB
-        let intervals = locate_data(50, Size(100), 1024 * 1024, 10);
+        let intervals = locate_data(
+            50,
+            Size(100),
+            1024 * 1024,
+            10,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
         assert!(!intervals.is_empty());
 
         // Should be a single small block interval (no large block rows for 1MB shard)
@@ -203,7 +235,14 @@ mod tests {
 
     #[test]
     fn test_locate_data_empty() {
-        let intervals = locate_data(0, Size(0), 1024 * 1024, 10);
+        let intervals = locate_data(
+            0,
+            Size(0),
+            1024 * 1024,
+            10,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
         assert!(intervals.is_empty());
     }
 
@@ -216,7 +255,11 @@ mod tests {
             is_large_block: false,
             large_block_rows_count: 2,
         };
-        let (_shard_id, offset) = interval.to_shard_id_and_offset(10);
+        let (_shard_id, offset) = interval.to_shard_id_and_offset(
+            10,
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64,
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+        );
         // Should be after 2 large block rows
         assert_eq!(offset, 2 * ERASURE_CODING_LARGE_BLOCK_SIZE as i64);
     }
diff --git a/seaweed-volume/src/storage/erasure_coding/ec_shard.rs b/seaweed-volume/src/storage/erasure_coding/ec_shard.rs
index 5f246adcf0..bda6e2b8ab 100644
--- a/seaweed-volume/src/storage/erasure_coding/ec_shard.rs
+++ b/seaweed-volume/src/storage/erasure_coding/ec_shard.rs
@@ -4,6 +4,7 @@ use std::fs::{self, File, OpenOptions};
 use std::io::{self, Write};
 
 use crate::storage::types::*;
+use crate::storage::volume_open::open_volume_file;
 
 pub const DATA_SHARDS_COUNT: usize = 10;
 pub const PARITY_SHARDS_COUNT: usize = 4;
@@ -15,6 +16,20 @@ pub const ERASURE_CODING_SMALL_BLOCK_SIZE: usize = 1024 * 1024; // 1MB
 
 pub type ShardId = u8;
 
+/// Validate a wire shard id. `ShardId` is `u8` but only 0..MAX_SHARD_COUNT are valid.
+/// Rejects 256 (would truncate to 0 and delete .ec00) and 270 (would alias 14).
+pub fn shard_id_try_from(v: u32) -> Result<ShardId, String> {
+    if v < MAX_SHARD_COUNT as u32 {
+        Ok(v as ShardId)
+    } else {
+        Err(format!(
+            "invalid shard id {} (max {})",
+            v,
+            MAX_SHARD_COUNT - 1
+        ))
+    }
+}
+
 /// A single erasure-coded shard file.
 pub struct EcVolumeShard {
     pub volume_id: VolumeId,
@@ -50,7 +65,7 @@ impl EcVolumeShard {
     /// Open the shard file for reading.
     pub fn open(&mut self) -> io::Result<()> {
         let path = self.file_name();
-        let file = File::open(&path)?;
+        let file = open_volume_file(OpenOptions::new().read(true), &path)?;
         self.ecd_file_size = file.metadata()?.len() as i64;
         self.ecd_file = Some(file);
         Ok(())
@@ -59,39 +74,27 @@ impl EcVolumeShard {
     /// Create the shard file for writing.
     pub fn create(&mut self) -> io::Result<()> {
         let path = self.file_name();
-        let file = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .create(true)
-            .truncate(true)
-            .open(&path)?;
+        let file = open_volume_file(
+            OpenOptions::new()
+                .read(true)
+                .write(true)
+                .create(true)
+                .truncate(true),
+            &path,
+        )?;
         self.ecd_file = Some(file);
         self.ecd_file_size = 0;
         Ok(())
     }
 
-    /// Read data at a specific offset.
+    /// Read data at a specific offset, filling `buf` unless the shard ends first.
     pub fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
         let file = self
             .ecd_file
             .as_ref()
-            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "shard file not open"))?;
+            .ok_or_else(|| io::Error::other("shard file not open"))?;
 
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::FileExt;
-            file.read_at(buf, offset)
-        }
-
-        #[cfg(not(unix))]
-        {
-            use std::io::{Read, Seek, SeekFrom};
-            // File::read_at is unix-only; fall back to seek + read.
-            // We need a mutable reference for seek/read, so clone the handle.
-            let mut f = file.try_clone()?;
-            f.seek(SeekFrom::Start(offset))?;
-            f.read(buf)
-        }
+        crate::storage::io::read_full_at(file, buf, offset)
     }
 
     /// Write data to the shard file (appends).
@@ -99,7 +102,7 @@ impl EcVolumeShard {
         let file = self
             .ecd_file
             .as_mut()
-            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "shard file not open"))?;
+            .ok_or_else(|| io::Error::other("shard file not open"))?;
         file.write_all(data)?;
         self.ecd_file_size += data.len() as i64;
         Ok(())
@@ -109,6 +112,21 @@ impl EcVolumeShard {
         self.ecd_file_size
     }
 
+    /// A duplicate of the mounted shard handle, for a reader that has to
+    /// outlive the store guard.
+    ///
+    /// This is the same descriptor `read_at` serves from, so it carries the
+    /// `O_NOATIME` from `open_volume_file` and keeps pointing at the shard
+    /// that was mounted, whatever later happens to the path. `dup` shares the
+    /// kernel file offset, which is why every read through it must be
+    /// positional (`read_at`), never seek-based.
+    pub fn try_clone_file(&self) -> io::Result<File> {
+        self.ecd_file
+            .as_ref()
+            .ok_or_else(|| io::Error::other("shard file not open"))?
+            .try_clone()
+    }
+
     /// Protobuf descriptor for this shard. Mirrors Go's ToEcShardInfo.
     pub fn to_ec_shard_info(&self) -> crate::pb::volume_server_pb::EcShardInfo {
         crate::pb::volume_server_pb::EcShardInfo {
@@ -177,6 +195,104 @@ impl ShardBits {
     }
 }
 
+/// Parses the generation of a 2PC-staged `<base>.v<N>` file: `None` means the
+/// name is not a generation file of `base`.
+pub fn ec_file_generation(name: &str, base: &str) -> Option<u32> {
+    let suffix = name.strip_prefix(&format!("{}.v", base))?;
+    match suffix.parse::<u32>() {
+        Ok(g) if g > 0 => Some(g),
+        _ => None,
+    }
+}
+
+/// Removes 2PC generation files staged under `base`:
+/// `<base>.ecNN.v<N>`, `<base>.ecx.v<N>`, `<base>.ecj.v<N>`, `<base>.ecsum.v<N>`
+/// and `<base>.vif.v<N>`. `generations_older_than == 0` removes every
+/// generation; otherwise only generations strictly below it. Returns the
+/// first real removal failure. Mirrors Go's `RemoveEcGenerationFiles`.
+pub fn remove_ec_generation_files(base: &str, generations_older_than: u32) -> io::Result<()> {
+    let path = std::path::Path::new(base);
+    let (Some(parent), Some(fname)) = (path.parent(), path.file_name()) else {
+        return Ok(());
+    };
+    let ec_prefix = format!("{}.ec", fname.to_string_lossy());
+    let vif_name = format!("{}.vif", fname.to_string_lossy());
+    let mut first_err: Option<io::Error> = None;
+    let mut record = |res: io::Result<()>| {
+        if let Err(e) = res
+            && first_err.is_none()
+        {
+            first_err = Some(e);
+        }
+    };
+    match fs::read_dir(parent) {
+        Ok(entries) => {
+            for entry in entries {
+                let entry = match entry {
+                    Ok(entry) => entry,
+                    Err(e) => {
+                        // A skipped entry means an incomplete sweep; report it
+                        // instead of pretending the cleanup finished.
+                        record(Err(e));
+                        continue;
+                    }
+                };
+                let name = entry.file_name().to_string_lossy().into_owned();
+                let Some((artifact, _)) = name.rsplit_once(".v") else {
+                    continue;
+                };
+                if artifact != vif_name && !artifact.starts_with(&ec_prefix) {
+                    continue;
+                }
+                let Some(generation) = ec_file_generation(&name, artifact) else {
+                    continue;
+                };
+                if generations_older_than > 0 && generation >= generations_older_than {
+                    continue;
+                }
+                record(match fs::remove_file(entry.path()) {
+                    Err(e) if e.kind() != io::ErrorKind::NotFound => Err(e),
+                    _ => Ok(()),
+                });
+            }
+        }
+        Err(e) if e.kind() != io::ErrorKind::NotFound => record(Err(e)),
+        Err(_) => {}
+    }
+    match first_err {
+        Some(e) => Err(e),
+        None => Ok(()),
+    }
+}
+
+/// Removes every staged generation `<shard_file>.v<N>` of one shard file.
+/// Returns true when at least one generation file was removed.
+pub fn remove_ec_shard_generations(shard_file: &str) -> io::Result<bool> {
+    let path = std::path::Path::new(shard_file);
+    let (Some(parent), Some(fname)) = (path.parent(), path.file_name()) else {
+        return Ok(false);
+    };
+    let fname = fname.to_string_lossy().into_owned();
+    let mut removed = false;
+    match fs::read_dir(parent) {
+        Ok(entries) => {
+            for entry in entries {
+                let entry = entry?;
+                let name = entry.file_name().to_string_lossy().into_owned();
+                if ec_file_generation(&name, &fname).is_some() {
+                    match fs::remove_file(entry.path()) {
+                        Err(e) if e.kind() != io::ErrorKind::NotFound => return Err(e),
+                        _ => removed = true,
+                    }
+                }
+            }
+        }
+        Err(e) if e.kind() != io::ErrorKind::NotFound => return Err(e),
+        Err(_) => {}
+    }
+    Ok(removed)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -233,4 +349,42 @@ mod tests {
         let shard = EcVolumeShard::new("/data", "", VolumeId(7), 13);
         assert_eq!(shard.file_name(), "/data/7.ec13");
     }
+
+    #[test]
+    fn test_shard_id_try_from_u32_rejects_overflow() {
+        use super::{MAX_SHARD_COUNT, shard_id_try_from};
+        assert_eq!(shard_id_try_from(0).unwrap(), 0u8);
+        assert_eq!(shard_id_try_from(14).unwrap(), 14u8);
+        assert_eq!(shard_id_try_from(31).unwrap(), 31u8);
+        assert!(shard_id_try_from(32).is_err());
+        assert!(shard_id_try_from(256).is_err());
+        assert!(shard_id_try_from(270).is_err());
+        assert!(shard_id_try_from(u32::MAX).is_err());
+        assert_eq!(MAX_SHARD_COUNT, 32);
+    }
+
+    #[test]
+    fn test_shard_batch_validation_is_atomic_rejects_without_partial_prefix() {
+        use super::shard_id_try_from;
+        // The mount/unmount handlers pre-validate the ENTIRE req.shard_ids into
+        // a Vec<ShardId> BEFORE acquiring the write lock or mutating any EC
+        // state. This test pins the validation half of that contract at the
+        // unit level: a batch like [0, 32] must fail as a whole, so by
+        // construction no validated prefix (e.g. shard 0) is ever applied.
+        // The handler-level tests below assert the no-state-change half.
+        let batch = vec![0u32, 32u32];
+        let validated: Result<Vec<_>, _> =
+            batch.iter().map(|&sid| shard_id_try_from(sid)).collect();
+        assert!(
+            validated.is_err(),
+            "batch {:?} must be rejected as a whole",
+            batch
+        );
+        // A fully-valid batch still validates cleanly.
+        let ok: Result<Vec<_>, _> = [0u32, 1u32, 13u32]
+            .iter()
+            .map(|&sid| shard_id_try_from(sid))
+            .collect();
+        assert_eq!(ok.unwrap(), vec![0u8, 1u8, 13u8]);
+    }
 }
diff --git a/seaweed-volume/src/storage/erasure_coding/ec_volume.rs b/seaweed-volume/src/storage/erasure_coding/ec_volume.rs
index 261574073e..ac0496a3be 100644
--- a/seaweed-volume/src/storage/erasure_coding/ec_volume.rs
+++ b/seaweed-volume/src/storage/erasure_coding/ec_volume.rs
@@ -5,15 +5,180 @@
 
 use std::collections::{HashMap, HashSet};
 use std::fs::{self, File, OpenOptions};
-use std::io::{self, Write};
+use std::io::{self, BufWriter, Write};
 use std::sync::RwLock;
-use std::time::{SystemTime, UNIX_EPOCH};
+use std::time::{Instant, SystemTime, UNIX_EPOCH};
 
 use crate::pb::master_pb;
 use crate::storage::erasure_coding::ec_locate;
 use crate::storage::erasure_coding::ec_shard::*;
-use crate::storage::needle::needle::{get_actual_size, Needle, NeedleError};
+use crate::storage::erasure_coding::ecj_registry::EcjHold;
+use crate::storage::io::read_exact_at;
+use crate::storage::io_error::IoErrorTracker;
+use crate::storage::needle::needle::{Needle, NeedleError, get_actual_size};
 use crate::storage::types::*;
+use crate::storage::volume_open::open_volume_file;
+
+/// The shard-location cache: where each shard lives, when that was last learned
+/// from the master, and whether a read has since disproved it. One struct behind
+/// one lock, because the freshness heuristic judges all three together (the map
+/// and its time from the reader's own snapshot, see
+/// `EcVolume::claim_shard_locations_refresh`) — a map published ahead of its
+/// refresh time reads as a fresh map stamped with the previous lookup, and a
+/// half-populated map must never look fresh at all.
+#[derive(Default)]
+pub(crate) struct ShardLocationCache {
+    /// Maps shard ID -> list of server addresses where that shard exists.
+    /// Used for distributed EC reads across the cluster.
+    locations: HashMap<ShardId, Vec<String>>,
+    /// Wall-clock timestamp of the most recent successful `LookupEcVolume`
+    /// refresh of `locations`. `None` until the first refresh. Drives the
+    /// staleness heuristic in `cached_lookup_ec_shard_locations` (mirrors Go's
+    /// `ShardLocationsRefreshTime`).
+    refreshed_at: Option<Instant>,
+    /// Marks the map for a prompt re-check: a read that failed against a cached
+    /// location has disproved what the map claims, and the normal freshness
+    /// window is far too long to serve from a map known to be wrong. Mirrors the
+    /// invalidation Go's `forgetShardId` performs. A field under the map's lock
+    /// rather than an atomic so the refresh can consume the mark in one critical
+    /// section, and a mark raised meanwhile survives for the next refresh.
+    stale: bool,
+}
+
+/// Bytes read per positional read when seeding `deleted_needles` from `.ecj`.
+/// A multiple of `NEEDLE_ID_SIZE`; 1 MiB is 131072 entries per syscall.
+const ECJ_LOAD_CHUNK_BYTES: usize = 1 << 20;
+
+/// Process-wide epoch bumped whenever a failed .ecj append truncates its
+/// uncommitted tail. A decode that read the journal without the store lock
+/// compares a sample taken before the read with one taken under the
+/// quiescing lock: equal means no rollback ran in between, so every id it
+/// folded in was committed and only incremental catch-up remains — the
+/// full rescan is needed only when the epoch moved.
+pub(crate) static ECJ_ROLLBACK_EPOCH: std::sync::atomic::AtomicU64 =
+    std::sync::atomic::AtomicU64::new(0);
+
+/// A `.ecj` smaller than this is never rewritten, however redundant. Below a
+/// megabyte the duplication costs nothing and the rewrite is pure churn.
+const ECJ_COMPACT_MIN_BYTES: i64 = 1 << 20;
+
+/// Rewrite only when the journal is at least this many times larger than the
+/// set it encodes. A journal holds one entry per delete, so a healthy one is
+/// close to 1x; four times the set means most of the file is repeats.
+const ECJ_COMPACT_RATIO: i64 = 4;
+
+/// Staging file for a compacted journal, next to the `.ecj` it replaces.
+/// Listed with the other EC index files wherever those are removed, so a tmp
+/// left by a crash between write and rename does not outlive its volume.
+pub(crate) const ECJ_COMPACT_TMP_EXT: &str = ".ecj.compact.tmp";
+
+/// Open `path` as a deletion journal append handle, creating it if absent.
+/// Every handle `journal_delete` appends through comes from here, so a handle
+/// reopened after compaction behaves exactly like the one opened at mount.
+fn open_ecj_append(path: &str) -> io::Result<File> {
+    open_volume_file(
+        OpenOptions::new()
+            .read(true)
+            .write(true)
+            .create(true)
+            .append(true),
+        path,
+    )
+}
+
+/// The filesystem steps of a mount's journal compaction: the reads that load
+/// the set it compacts from, and the steps that publish the compacted file.
+/// Production uses [`EcjFsOps::REAL`]; tests substitute their own steps to
+/// cover the failure paths and races through the real mount.
+#[derive(Clone, Copy)]
+struct EcjFsOps {
+    read_at: fn(&File, &mut [u8], u64) -> io::Result<()>,
+    rename: fn(&str, &str) -> io::Result<()>,
+    fsync_dir: fn(&str) -> io::Result<()>,
+    reopen: fn(&str) -> io::Result<File>,
+}
+
+impl EcjFsOps {
+    const REAL: EcjFsOps = EcjFsOps {
+        read_at: read_exact_at,
+        rename: |from, to| fs::rename(from, to),
+        fsync_dir: fsync_ecj_dir,
+        reopen: open_ecj_append,
+    };
+}
+
+/// Fsync the directory holding `path`, failing when it cannot be opened.
+/// The crate's `fsync_dir` treats an unopenable directory as success, which is
+/// best-effort syncing; here the mount carries on after the rename and takes
+/// deletes against the replacement, so an unsynced entry could lose them to a
+/// power loss. A rename needs only write and search permission on the
+/// directory, so it can succeed where opening the directory fails. Matches
+/// Go's `util.FsyncDir`, which also skips the sync on Windows.
+fn fsync_ecj_dir(path: &str) -> io::Result<()> {
+    #[cfg(windows)]
+    {
+        let _ = path;
+        Ok(())
+    }
+    #[cfg(not(windows))]
+    {
+        let dir = match std::path::Path::new(path).parent() {
+            Some(p) if !p.as_os_str().is_empty() => p,
+            _ => std::path::Path::new("."),
+        };
+        File::open(dir)?.sync_all()
+    }
+}
+
+/// Why publishing a compacted journal failed, split by whether the volume
+/// still has a working journal handle. Decided where the failure happens, not
+/// inferred afterwards from `ecj_file`.
+#[derive(Debug)]
+enum EcjPublishError {
+    /// Nothing was published: the original journal is in place and the handle
+    /// to it is restored. The mount carries on with the uncompacted file.
+    Abandoned(io::Error),
+    /// The volume has no usable journal handle, so it must not mount: deletes
+    /// would fail, or land in an inode no longer at the journal's path.
+    HandleLost(io::Error),
+}
+
+/// Adds every whole needle id in bytes `from..len` of `ecj_file` to `ids`,
+/// reading `ECJ_LOAD_CHUNK_BYTES` at a time; a trailing partial record is
+/// ignored. `from` is a record boundary.
+pub(crate) fn read_ecj_ids(
+    ecj_file: &File,
+    from: u64,
+    len: u64,
+    ids: &mut HashSet<NeedleId>,
+) -> io::Result<()> {
+    read_ecj_ids_with(read_exact_at, ecj_file, from, len, ids)
+}
+
+/// [`read_ecj_ids`] with the positional read supplied by the caller, so the
+/// mount can load through its injectable [`EcjFsOps`] steps.
+fn read_ecj_ids_with(
+    read_at: fn(&File, &mut [u8], u64) -> io::Result<()>,
+    ecj_file: &File,
+    from: u64,
+    len: u64,
+    ids: &mut HashSet<NeedleId>,
+) -> io::Result<()> {
+    let mut buf =
+        vec![0u8; std::cmp::min(ECJ_LOAD_CHUNK_BYTES as u64, len.saturating_sub(from)) as usize];
+    let mut off: u64 = from;
+    while off + NEEDLE_ID_SIZE as u64 <= len {
+        let mut want = std::cmp::min(ECJ_LOAD_CHUNK_BYTES as u64, len - off) as usize;
+        want -= want % NEEDLE_ID_SIZE;
+        // Positional read: the loader's handle is shared with journal appends.
+        read_at(ecj_file, &mut buf[..want], off)?;
+        for entry in buf[..want].as_chunks::<NEEDLE_ID_SIZE>().0 {
+            ids.insert(NeedleId::from_bytes(entry));
+        }
+        off += want as u64;
+    }
+    Ok(())
+}
 
 /// An erasure-coded volume managing its local shards and index.
 pub struct EcVolume {
@@ -26,12 +191,19 @@ pub struct EcVolume {
     pub dat_file_size: i64,
     pub data_shards: u32,
     pub parity_shards: u32,
+    /// Uniform block layout: each shard is one contiguous block of this many
+    /// bytes. 0 = legacy 1GiB/1MiB two-tier layout. Loaded from .vif.
+    pub block_size: i64,
     ecx_file: Option<File>,
     ecx_file_size: i64,
     ecj_file: Option<File>,
-    /// On-disk size of the .ecj deletion journal. Used only by IO helpers
-    /// (seek / set_len on partial writes) — the authoritative runtime
-    /// delete count comes from `deleted_needles.len()`.
+    /// This volume's registration as a holder of its `.ecj` path. Held for as
+    /// long as `ecj_file` may be open; see `ecj_registry`.
+    ecj_hold: Option<EcjHold>,
+    /// On-disk size of the .ecj deletion journal: the rollback point for a
+    /// failed append, and the size mount-time compaction compares against the
+    /// id set and re-checks on disk before replacing the file. The runtime
+    /// delete count comes from `deleted_needles.len()`, not from this.
     ecj_file_size: i64,
     /// In-memory set of needle ids that have been deleted since the volume
     /// was encoded. .ecx is immutable at runtime — it only stores the
@@ -43,18 +215,11 @@ pub struct EcVolume {
     pub disk_type: DiskType,
     /// Directory where .ecx/.ecj were actually found (may differ from dir_idx after fallback).
     ecx_actual_dir: String,
-    /// Maps shard ID -> list of server addresses where that shard exists.
-    /// Used for distributed EC reads across the cluster. Wrapped in
-    /// `RwLock` so the read path can refresh the map (under master
-    /// lookup) without holding the Store write lock — mirrors Go's
-    /// `ShardLocationsLock sync.RWMutex` in `weed/storage/erasure_coding/ec_volume.go`.
-    pub shard_locations: std::sync::RwLock<HashMap<ShardId, Vec<String>>>,
-    /// Wall-clock timestamp of the most recent successful
-    /// `LookupEcVolume` refresh of `shard_locations`. `None` until the
-    /// first refresh. Drives the staleness heuristic in
-    /// `cached_lookup_ec_shard_locations` (mirrors Go's
-    /// `ShardLocationsRefreshTime`).
-    pub shard_locations_refresh_time: std::sync::Mutex<Option<std::time::Instant>>,
+    /// Where each shard lives and how far that is to be trusted, all under one
+    /// `RwLock` so the read path can refresh it (under master lookup) without
+    /// holding the Store write lock — mirrors Go's `ShardLocationsLock
+    /// sync.RWMutex` in `weed/storage/erasure_coding/ec_volume.go`.
+    shard_locations: RwLock<ShardLocationCache>,
     /// EC volume expiration time (unix epoch seconds), set during EC encode from TTL.
     pub expire_at_sec: u64,
     /// Encode-run identity (unix nanos) loaded from the .vif EcShardConfig. A read
@@ -68,6 +233,19 @@ pub struct EcVolume {
     /// so `bitrot_protection()` can return the `Off`/`Invalid` distinction without
     /// re-reading, mirroring Go's `EcVolume.bitrotStatus`.
     pub(crate) bitrot_status: crate::storage::erasure_coding::ec_bitrot::BitrotStatus,
+    /// Directory the active sidecar was actually resolved from. The search in
+    /// `load_bitrot_for_generation` spans sibling disks, and a `.ecsum` records
+    /// no encode identity, so provenance is the only signal that a loaded
+    /// manifest may describe a different encode run. Same purpose as
+    /// `ecx_actual_dir`. Empty when no sidecar was found. Always committed in
+    /// the same step as `bitrot`/`bitrot_status`, so a reload whose `Err` gets
+    /// swallowed by `reload_bitrot_sidecar` cannot leave this describing a
+    /// sidecar other than the one those two fields actually hold.
+    pub(crate) bitrot_source_dir: String,
+
+    /// Consecutive storage-media errors and the quarantine they lead to,
+    /// for EC volume health monitoring.
+    io_errors: IoErrorTracker,
 }
 
 /// Locate the `.vif` for a (collection, vid) by preferring the data dir
@@ -94,45 +272,323 @@ fn locate_vif_path(dir: &str, dir_idx: &str, collection: &str, volume_id: Volume
     data_vif
 }
 
-/// Read EC data/parity shard counts from `.vif`, defaulting to the
-/// build's standard ratio when no `.vif` is present or is malformed.
+/// Load the volume's `.vif` (data dir first, then idx dir, then the active
+/// generation's versioned sidecar — see [`locate_vif_path`]). Absent
+/// everywhere is legal — legacy volumes predate the sidecar — and returns
+/// `None`; so does a zero-byte stub (an ec.decode copy from a source
+/// without one), mirroring Go's MaybeLoadVolumeInfo. A
+/// present-but-unreadable or malformed `.vif` is an ERROR: silently
+/// defaulting would mount a uniform-layout volume with legacy offset math
+/// and serve wrong bytes with a straight face.
+pub fn load_vif_info(
+    dir: &str,
+    dir_idx: &str,
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<Option<crate::storage::volume::VifVolumeInfo>> {
+    let vif_path = locate_vif_path(dir, dir_idx, collection, volume_id);
+    match std::fs::read_to_string(&vif_path) {
+        Ok(content) if content.trim().is_empty() => Ok(None),
+        Ok(content) => serde_json::from_str(&content).map(Some).map_err(|e| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!("parse {}: {}", vif_path, e),
+            )
+        }),
+        Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(None),
+        Err(e) => Err(io::Error::new(
+            e.kind(),
+            format!("read {}: {}", vif_path, e),
+        )),
+    }
+}
+
+/// Read the EC data/parity shard counts and shard block size from `.vif`,
+/// defaulting to the build's standard ratio and the legacy block layout when
+/// no `.vif` is present. A present-but-unreadable or malformed `.vif`
+/// fails instead of defaulting (see [`load_vif_info`]).
 /// Looks at the data dir first, then the idx dir — see [`locate_vif_path`].
 pub fn read_ec_shard_config(
     dir: &str,
     dir_idx: &str,
     collection: &str,
     volume_id: VolumeId,
-) -> (u32, u32) {
-    let mut data_shards = crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT as u32;
-    let mut parity_shards = crate::storage::erasure_coding::ec_shard::PARITY_SHARDS_COUNT as u32;
-    let vif_path = locate_vif_path(dir, dir_idx, collection, volume_id);
-    if let Ok(vif_content) = std::fs::read_to_string(&vif_path) {
-        if let Ok(vif_info) =
-            serde_json::from_str::<crate::storage::volume::VifVolumeInfo>(&vif_content)
-        {
-            if let Some(ec) = vif_info.ec_shard_config {
-                if ec.data_shards > 0
-                    && ec.parity_shards > 0
-                    && (ec.data_shards + ec.parity_shards) <= MAX_SHARD_COUNT as u32
-                {
-                    data_shards = ec.data_shards;
-                    parity_shards = ec.parity_shards;
-                }
+) -> io::Result<(u32, u32, i64)> {
+    let vif = load_vif_info(dir, dir_idx, collection, volume_id)?;
+    ec_shard_config_from(vif.as_ref(), &[dir, dir_idx], collection, volume_id)
+}
+
+/// Load the volume's `.vif` from the selected location or, failing that, from
+/// any sibling disk — returning the directory it came from so the caller can
+/// resolve the rest of the volume's metadata against the same place. A rebuild
+/// picks one disk to write into, but a multi-disk server may hold that
+/// volume's metadata on another.
+pub fn load_vif_info_across_dirs(
+    dir: &str,
+    dir_idx: &str,
+    other_dirs: &[String],
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<Option<(crate::storage::volume::VifVolumeInfo, String)>> {
+    if let Some(vif) = load_vif_info(dir, dir_idx, collection, volume_id)? {
+        // Report where it actually came from. load_vif_info probes the data
+        // directory then the index directory, so naming `dir` unconditionally
+        // pointed callers at the wrong disk whenever the vif lived with the
+        // index — and a caller resolving the rest of the volume's metadata
+        // against that answer would look in a directory holding none of it.
+        let data_vif = format!(
+            "{}.vif",
+            crate::storage::volume::volume_file_name(dir, collection, volume_id)
+        );
+        let found_in = if std::path::Path::new(&data_vif).exists() {
+            dir.to_string()
+        } else {
+            dir_idx.to_string()
+        };
+        return Ok(Some((vif, found_in)));
+    }
+    for other in other_dirs {
+        if let Some(vif) = load_vif_info(other, other, collection, volume_id)? {
+            return Ok(Some((vif, other.clone())));
+        }
+    }
+    Ok(None)
+}
+
+/// [`read_ec_shard_config`] for a caller that may find the volume's metadata on
+/// any of the server's disks. Without this a rebuild that lands on a disk
+/// holding only shards reads the default 10+4 and the legacy block layout,
+/// then reconstructs a custom-ratio or uniform volume through the wrong matrix
+/// and de-striping geometry.
+pub fn read_ec_shard_config_across_dirs(
+    dir: &str,
+    dir_idx: &str,
+    other_dirs: &[String],
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<(u32, u32, i64)> {
+    // Every directory this volume's metadata could be in. A split -dir/-dir.idx
+    // location keeps .vif and .ecsum with the INDEX, and callers exclude their
+    // own index directory from other_dirs on the understanding that it is
+    // passed here separately — so it is chained explicitly, exactly as the .vif
+    // lookup and Go's findBitrotSidecar both do.
+    let mut candidates: Vec<&str> = Vec::with_capacity(2 + other_dirs.len());
+    candidates.push(dir);
+    if !dir_idx.is_empty() && dir_idx != dir {
+        candidates.push(dir_idx);
+    }
+    candidates.extend(other_dirs.iter().map(|s| s.as_str()));
+
+    // A vif that carries no ecShardConfig answers nothing about the layout, so
+    // it must NOT short-circuit the sidecar search: a legacy config-free vif
+    // and the generation-0 sidecar can sit in different directories, and
+    // stopping at the vif resolved a 12+4 uniform volume as 10+4 legacy. Pass
+    // the whole candidate list so the fallback covers the same ground the vif
+    // lookup did.
+    let vif = load_vif_info_across_dirs(dir, dir_idx, other_dirs, collection, volume_id)?;
+    ec_shard_config_from(
+        vif.as_ref().map(|(v, _)| v),
+        &candidates,
+        collection,
+        volume_id,
+    )
+}
+
+/// Resolve (data_shards, parity_shards, block_size) from an already-loaded
+/// `.vif`. With no vif — or one carrying no EC config — the bitrot sidecar
+/// records the same config at encode time and answers the layout question the
+/// vif cannot: defaulting a uniform-layout volume to the legacy block sizes
+/// maps every read to the wrong shard offset. `weed fix -ecx` reads the
+/// sidecar for the same reason. Absent both, the build's standard ratio and
+/// the legacy layout.
+pub fn ec_shard_config_from(
+    vif: Option<&crate::storage::volume::VifVolumeInfo>,
+    dirs: &[&str],
+    collection: &str,
+    volume_id: VolumeId,
+) -> io::Result<(u32, u32, i64)> {
+    let default_ds = crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT as u32;
+    let default_ps = crate::storage::erasure_coding::ec_shard::PARITY_SHARDS_COUNT as u32;
+    // Sum as u64: counts near the u32 ceiling would wrap and pass the bound.
+    let usable =
+        |ds: u32, ps: u32| ds > 0 && ps > 0 && (ds as u64 + ps as u64) <= MAX_SHARD_COUNT as u64;
+
+    if let Some(ec) = vif.and_then(|v| v.ec_shard_config.as_ref()) {
+        // A config that is PRESENT but records an impossible ratio is not a
+        // volume to fall back on: dropping through to the sidecar or the
+        // defaults would read uniform shards with the legacy offset math and
+        // answer with the wrong bytes. Only an ENTIRELY absent config means
+        // "this predates the record".
+        if !usable(ec.data_shards, ec.parity_shards) {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "vif for volume {} records invalid shard counts {}+{}",
+                    volume_id.0, ec.data_shards, ec.parity_shards
+                ),
+            ));
+        }
+        // A recorded block size that no encoder could have produced maps
+        // every read to the wrong shard offset. Refuse the mount rather
+        // than serve those bytes or silently pick a layout.
+        validate_block_size(ec.block_size)?;
+        return Ok((ec.data_shards, ec.parity_shards, ec.block_size));
+    }
+    // With no usable vif config the sidecar is the ONLY record of this volume's
+    // layout, so the three answers stay distinct: absent EVERYWHERE means the
+    // volume may genuinely predate the sidecar and legacy is the right guess;
+    // present-but-unusable means the record is corrupt, and answering reads
+    // from a guessed layout returns wrong bytes rather than none.
+    //
+    // Every candidate directory is searched, not just the first: a split
+    // -dir/-dir.idx location keeps the sidecar with the INDEX, and a multi-disk
+    // server may keep it on a sibling. Stopping at the data directory resolved
+    // a 12+4 uniform volume as 10+4 legacy.
+    let mut path = String::new();
+    for candidate in dirs.iter().filter(|d| !d.is_empty()) {
+        let base = crate::storage::volume::volume_file_name(candidate, collection, volume_id);
+        let probe = crate::storage::erasure_coding::ec_bitrot::bitrot_sidecar_path(&base, 0);
+        match std::fs::metadata(&probe) {
+            Err(e) if e.kind() == io::ErrorKind::NotFound => continue,
+            Err(e) => {
+                return Err(io::Error::new(e.kind(), format!("stat {}: {}", probe, e)));
+            }
+            Ok(_) => {
+                path = probe;
+                break;
             }
         }
     }
-    (data_shards, parity_shards)
+    if path.is_empty() {
+        return Ok((default_ds, default_ps, 0));
+    }
+    let prot = crate::storage::erasure_coding::ec_bitrot::load_bitrot_sidecar(&path)
+        .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, format!("read {}: {}", path, e)))?;
+    // The un-suffixed sidecar describes generation 0 and nothing else.
+    if prot.generation != 0 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!(
+                "{} records generation {}, not generation 0",
+                path, prot.generation
+            ),
+        ));
+    }
+    let ec = prot.ec_shard_config.as_ref().ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("{} records no EC config", path),
+        )
+    })?;
+    if !usable(ec.data_shards, ec.parity_shards) {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!(
+                "{} records invalid shard counts {}+{}",
+                path, ec.data_shards, ec.parity_shards
+            ),
+        ));
+    }
+    validate_block_size(ec.block_size)
+        .map_err(|e| io::Error::new(e.kind(), format!("{}: {}", path, e)))?;
+    Ok((ec.data_shards, ec.parity_shards, ec.block_size))
+}
+
+/// Reports whether a `.vif`-recorded shard block size is one an encoder could
+/// have produced. 0 means the legacy two-tier layout, which is always valid;
+/// anything positive must be a whole number of small blocks, because that is
+/// what `uniform_block_size` rounds to. Mirrors Go's `ValidateBlockSize`.
+pub fn validate_block_size(block_size: i64) -> io::Result<()> {
+    if block_size == 0 {
+        return Ok(());
+    }
+    if block_size < 0
+        || block_size
+            % crate::storage::erasure_coding::ec_shard::ERASURE_CODING_SMALL_BLOCK_SIZE as i64
+            != 0
+    {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!(
+                "invalid shard block size {}: expected 0 (legacy) or a multiple of {}",
+                block_size,
+                crate::storage::erasure_coding::ec_shard::ERASURE_CODING_SMALL_BLOCK_SIZE
+            ),
+        ));
+    }
+    Ok(())
+}
+
+/// Size of the `.ecx` at `path`, or `None` when it is absent or a directory.
+/// Mirrors Go's `statEcxSize`.
+pub(crate) fn ecx_file_size(path: &str) -> Option<u64> {
+    match std::fs::metadata(path) {
+        Ok(meta) if !meta.is_dir() => Some(meta.len()),
+        _ => None,
+    }
+}
+
+/// Whether `path` is an `.ecx` that can steer placement, ownership or a copy:
+/// a regular file with content. A 0-byte `.ecx` is what a failed EC distribute
+/// copy leaves behind, and Go treats it as absent at every such decision
+/// (`HasEcxFileOnDisk`, `findEcxIdxDirForVolume`, `indexEcxOwners`) so the scan
+/// moves on to a sibling disk that may hold a valid index.
+pub(crate) fn is_usable_ecx_file(path: &str) -> bool {
+    ecx_file_size(path).is_some_and(|size| size > 0)
+}
+
+/// Stream sorted deleted ids to `tmp_path` and fsync it. Extracted so failure
+/// paths (ENOSPC, read-only dir) are unit-testable without mounting a volume.
+fn write_compacted_ecj_tmp(tmp_path: &str, ids: &[NeedleId]) -> io::Result<()> {
+    // Stream the ids out rather than materialising the whole encoded
+    // journal: the set and the sorted vector are already resident, and a
+    // third full-size buffer is a needless contiguous allocation at mount.
+    // Opened like every other volume file, so the journal this becomes has
+    // the same mode and open flags as one that was never compacted.
+    let file = open_volume_file(
+        OpenOptions::new().write(true).create(true).truncate(true),
+        tmp_path,
+    )?;
+    let mut w = BufWriter::new(file);
+    let mut buf = [0u8; NEEDLE_ID_SIZE];
+    for id in ids {
+        id.to_bytes(&mut buf);
+        w.write_all(&buf)?;
+    }
+    // into_inner flushes; into_error keeps the flush's own ErrorKind.
+    w.into_inner()
+        .map_err(io::IntoInnerError::into_error)?
+        .sync_all()
 }
 
 impl EcVolume {
-    /// Create a new EcVolume. Loads .ecx index and .ecj journal if present.
+    /// Create a new EcVolume. Opens the .ecx index (required) and the .ecj journal.
     pub fn new(
         dir: &str,
         dir_idx: &str,
         collection: &str,
         volume_id: VolumeId,
     ) -> io::Result<Self> {
-        let (data_shards, parity_shards) = read_ec_shard_config(dir, dir_idx, collection, volume_id);
+        Self::open_with(dir, dir_idx, collection, volume_id, EcjFsOps::REAL)
+    }
+
+    /// [`Self::new`] with the journal-compaction filesystem steps supplied, so
+    /// tests can drive a failing publish through the real mount.
+    fn open_with(
+        dir: &str,
+        dir_idx: &str,
+        collection: &str,
+        volume_id: VolumeId,
+        ecj_ops: EcjFsOps,
+    ) -> io::Result<Self> {
+        // One load of the volume's `.vif`, used for both the shard config and
+        // the version / dat-size fields below.
+        let vif = load_vif_info(dir, dir_idx, collection, volume_id)?;
+        // Both directories: a split -dir/-dir.idx layout keeps the .ecsum with
+        // the INDEX, and it is the only layout record a volume whose vif is
+        // absent or config-free still has.
+        let (data_shards, parity_shards, block_size) =
+            ec_shard_config_from(vif.as_ref(), &[dir, dir_idx], collection, volume_id)?;
 
         let total_shards = (data_shards + parity_shards) as usize;
         let mut shards = Vec::with_capacity(total_shards);
@@ -148,12 +604,11 @@ impl EcVolume {
         // for shard-size math and by the Store-level prune in
         // `store_ec_reconcile.rs` to verify a sibling-disk .dat is
         // plausibly the encoding source (#9478).
-        let (expire_at_sec, vif_version, vif_dat_file_size, encode_ts_ns) = {
-            let vif_path = locate_vif_path(dir, dir_idx, collection, volume_id);
-            if let Ok(vif_content) = std::fs::read_to_string(&vif_path) {
-                if let Ok(vif_info) =
-                    serde_json::from_str::<crate::storage::volume::VifVolumeInfo>(&vif_content)
-                {
+        let (expire_at_sec, vif_version, vif_dat_file_size, encode_ts_ns) =
+            // Absent everywhere = legacy defaults; a present-but-unreadable or
+            // malformed vif already failed the mount in load_vif_info above.
+            match vif.as_ref() {
+                Some(vif_info) => {
                     let ver = if vif_info.version > 0 {
                         Version(vif_info.version as u8)
                     } else {
@@ -169,13 +624,9 @@ impl EcVolume {
                         vif_info.dat_file_size,
                         cfg_encode_ts_ns,
                     )
-                } else {
-                    (0, Version::current(), 0, 0)
                 }
-            } else {
-                (0, Version::current(), 0, 0)
-            }
-        };
+                None => (0, Version::current(), 0, 0),
+            };
 
         let mut vol = EcVolume {
             volume_id,
@@ -187,76 +638,185 @@ impl EcVolume {
             dat_file_size: vif_dat_file_size,
             data_shards,
             parity_shards,
+            block_size,
             ecx_file: None,
             ecx_file_size: 0,
             ecj_file: None,
+            ecj_hold: None,
             ecj_file_size: 0,
             deleted_needles: RwLock::new(HashSet::new()),
             disk_type: DiskType::default(),
             ecx_actual_dir: dir_idx.to_string(),
-            shard_locations: std::sync::RwLock::new(HashMap::new()),
-            shard_locations_refresh_time: std::sync::Mutex::new(None),
+            shard_locations: RwLock::new(ShardLocationCache::default()),
             expire_at_sec,
             encode_ts_ns,
             bitrot: None,
             bitrot_status: crate::storage::erasure_coding::ec_bitrot::BitrotStatus::Off,
+            bitrot_source_dir: String::new(),
+            io_errors: IoErrorTracker::default(),
         };
 
         // Open .ecx file (sorted index) in read/write mode for in-place deletion marking.
         // Matches Go which opens ecx for writing via MarkNeedleDeleted.
-        let ecx_path = vol.ecx_file_name();
-        if std::path::Path::new(&ecx_path).exists() {
-            let file = OpenOptions::new().read(true).write(true).open(&ecx_path)?;
-            vol.ecx_file_size = file.metadata()?.len() as i64;
-            vol.ecx_file = Some(file);
-        } else if dir_idx != dir {
-            // Fall back to data directory if .ecx was created before -dir.idx was configured
-            let data_base = crate::storage::volume::volume_file_name(dir, collection, volume_id);
-            let fallback_ecx = format!("{}.ecx", data_base);
-            if std::path::Path::new(&fallback_ecx).exists() {
-                tracing::info!(
+        //
+        // Resolve it the way Go's NewEcVolume does: prefer a non-empty copy,
+        // the one co-located with the shard data first, then the caller's
+        // index directory — either the shared -dir.idx dir or a sibling disk
+        // that owns the .ecx when this disk holds only a 0-byte stub left by an
+        // interrupted copy. A 0-byte .ecx is also a legitimate empty index, so
+        // it yields only to a non-empty copy elsewhere, never to a mere
+        // absence. No .ecx at all fails the mount with NotFound (Go wraps
+        // os.ErrNotExist): an EcVolume without an index would advertise shards
+        // that no read can ever serve.
+        let local_ecx = format!(
+            "{}.ecx",
+            crate::storage::volume::volume_file_name(dir, collection, volume_id)
+        );
+        let shared_ecx = vol.ecx_file_name();
+        let local_size = ecx_file_size(&local_ecx);
+        let shared_size = if dir_idx != dir {
+            ecx_file_size(&shared_ecx)
+        } else {
+            None
+        };
+        let use_local = match (local_size, shared_size) {
+            (Some(n), _) if n > 0 => true,
+            (_, Some(n)) if n > 0 => {
+                tracing::debug!(
                     volume_id = volume_id.0,
-                    "ecx file not found in idx dir, falling back to data dir"
+                    "ecx not local at {}, using {}",
+                    local_ecx,
+                    shared_ecx
                 );
-                let file = OpenOptions::new().read(true).write(true).open(&fallback_ecx)?;
-                vol.ecx_file_size = file.metadata()?.len() as i64;
-                vol.ecx_file = Some(file);
-                vol.ecx_actual_dir = dir.to_string();
+                false
             }
-        }
+            // Only 0-byte copies exist: an empty index, local first.
+            (Some(_), _) => true,
+            (None, Some(_)) => false,
+            (None, None) => {
+                let tried = if dir_idx != dir {
+                    format!("{} (or {})", local_ecx, shared_ecx)
+                } else {
+                    local_ecx
+                };
+                return Err(io::Error::new(
+                    io::ErrorKind::NotFound,
+                    format!("cannot open ec volume index {}: not found", tried),
+                ));
+            }
+        };
+        let ecx_path = if use_local {
+            vol.ecx_actual_dir = dir.to_string();
+            local_ecx
+        } else {
+            shared_ecx
+        };
+        let file = open_volume_file(OpenOptions::new().read(true).write(true), &ecx_path)?;
+        vol.ecx_file_size = file.metadata()?.len() as i64;
+        vol.ecx_file = Some(file);
 
         // Open .ecj file (deletion journal) — use ecx_actual_dir for consistency.
         // Note: Go does NOT replay .ecj into .ecx at volume load (RebuildEcxFile
         // is only invoked from specific decode/rebuild gRPC handlers), so we
         // don't either. Tombstones from prior sessions were already written
-        // in-place in .ecx, and the journal grows monotonically until a
-        // decode/rebuild operation folds it in.
+        // in-place in .ecx. The journal only grows at runtime; the one rewrite
+        // at mount is `maybe_compact_ecj` below, which folds a bloated journal
+        // down to the set it encodes when no other holder or writer can reach
+        // the file.
         let ecj_base =
             crate::storage::volume::volume_file_name(&vol.ecx_actual_dir, collection, volume_id);
         let ecj_path = format!("{}.ecj", ecj_base);
-        let ecj_file = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .create(true)
-            .append(true)
-            .open(&ecj_path)?;
+
+        // Register as a holder before touching the file: this waits out a
+        // compaction another disk's volume may be running on the same path, so
+        // the tail repair and the handle below see the final inode, and it
+        // stops any compaction from replacing the file under this handle.
+        vol.ecj_hold = Some(EcjHold::acquire(&ecj_path));
+
+        // Repair a torn tail BEFORE the append handle exists.
+        //
+        // The file is a flat array of fixed-size records and the journal handle
+        // is in append mode, so every write lands at the physical end. A
+        // trailing partial record therefore knocks every later append out of
+        // alignment: the loader below skips the partial bytes, but the next
+        // mount decodes those bytes together with the leading bytes of a real
+        // entry, yielding one garbage id and silently dropping the delete that
+        // followed the tear. Truncating to a whole number of records costs at
+        // most one incomplete id that was never readable anyway.
+        //
+        // This deliberately uses its own read+write handle rather than the
+        // append handle opened below: on Windows, `append(true)` requests
+        // FILE_APPEND_DATA *without* FILE_WRITE_DATA (and `.write(true)` is
+        // subsumed by `.append(true)`), so SetEndOfFile through that handle
+        // fails with ERROR_ACCESS_DENIED. The handle is scoped so it is closed
+        // again before the append handle opens.
+        {
+            let repair = open_volume_file(
+                OpenOptions::new().read(true).write(true).create(true),
+                &ecj_path,
+            )?;
+            let on_disk = repair.metadata()?.len() as i64;
+            let ragged = on_disk % NEEDLE_ID_SIZE as i64;
+            if ragged != 0 {
+                let whole = on_disk - ragged;
+                tracing::warn!(
+                    volume_id = volume_id.0,
+                    collection = %collection,
+                    on_disk_bytes = on_disk,
+                    truncated_to = whole,
+                    "truncating torn .ecj tail so later appends stay aligned",
+                );
+                repair.set_len(whole as u64)?;
+                repair.sync_all()?;
+            }
+        }
+
+        let ecj_file = open_ecj_append(&ecj_path)?;
         vol.ecj_file_size = ecj_file.metadata()?.len() as i64;
         vol.ecj_file = Some(ecj_file);
 
         // Seed the in-memory deleted set from the journal.
-        vol.load_deleted_needles_from_ecj()?;
+        vol.load_deleted_needles_from_ecj(ecj_ops.read_at)?;
 
-        // Load the generation-0 EC bitrot checksum sidecar (optional; best-effort).
-        vol.load_active_bitrot_sidecar();
+        // Load the generation-0 EC bitrot checksum sidecar. Optional, except
+        // when it contradicts the volume's own geometry — see
+        // load_bitrot_for_generation.
+        vol.load_active_bitrot_sidecar(&[])?;
+
+        // Last, once every check that can refuse the mount has passed: a
+        // volume the server declines to serve keeps its files as they were.
+        vol.maybe_compact_ecj(ecj_ops).map_err(|e| {
+            io::Error::new(
+                e.kind(),
+                format!(
+                    "ec volume {}: .ecj compaction left no usable journal handle: {}",
+                    volume_id.0, e
+                ),
+            )
+        })?;
 
         Ok(vol)
     }
 
+    /// Re-resolve the checksum sidecar for a volume that is already mounted. A
+    /// shard delivery can bring the manifest with it, and the receive path only
+    /// writes the file, so without this the in-memory volume keeps the
+    /// protection state it resolved at mount (off) until a remount.
+    pub fn reload_bitrot_sidecar(&mut self, additional_dirs: &[String]) {
+        if let Err(e) = self.load_active_bitrot_sidecar(additional_dirs) {
+            tracing::warn!(
+                volume_id = self.volume_id.0,
+                error = %e,
+                "reload bitrot sidecar",
+            );
+        }
+    }
+
     /// Load the generation-0 checksum sidecar into `self.bitrot`/`self.bitrot_status`.
     /// OSS only produces generation-0 (fresh-encode) sidecars, mirroring Go's
     /// `loadActiveBitrotSidecar`.
-    fn load_active_bitrot_sidecar(&mut self) {
-        self.load_bitrot_for_generation(0);
+    fn load_active_bitrot_sidecar(&mut self, additional_dirs: &[String]) -> io::Result<()> {
+        self.load_bitrot_for_generation(0, additional_dirs)
     }
 
     /// Load and validate the sidecar describing `generation`, setting
@@ -264,17 +824,85 @@ impl EcVolume {
     /// => `Off` (protection off, not corruption); self-integrity or manifest
     /// failure => `Invalid` with a warning (protection off pending repair); usable
     /// => `On`. Mirrors Go's `loadBitrotForGeneration`.
-    fn load_bitrot_for_generation(&mut self, generation: u32) {
+    fn load_bitrot_for_generation(
+        &mut self,
+        generation: u32,
+        additional_dirs: &[String],
+    ) -> io::Result<()> {
         use crate::storage::erasure_coding::ec_bitrot;
-        let base = self.base_name();
-        let path = ec_bitrot::bitrot_sidecar_path(&base, generation);
+        // Data base then index base, matching Go's findBitrotSidecar. A split
+        // -dir/-dir.idx location keeps the sidecar with the INDEX, and on a
+        // multi-disk server sharing one index directory that is the only copy
+        // the per-disk runtimes other than the first can see — searching the
+        // data base alone left them reporting no protection at all.
+        let data_path = ec_bitrot::bitrot_sidecar_path(&self.base_name(), generation);
+        let idx_path = ec_bitrot::bitrot_sidecar_path(&self.idx_base_name(), generation);
+        // Sibling disks last: startup mirroring gives each shard-bearing disk
+        // its own .ecx/.ecj/.vif but not the sidecar, and a delivery lands
+        // exactly one copy, so a runtime restricted to its own two directories
+        // would report no protection however often it reloaded.
+        let path = std::iter::once(data_path.clone())
+            .chain(std::iter::once(idx_path))
+            .chain(additional_dirs.iter().filter(|d| !d.is_empty()).map(|d| {
+                ec_bitrot::bitrot_sidecar_path(
+                    &crate::storage::volume::volume_file_name(d, &self.collection, self.volume_id),
+                    generation,
+                )
+            }))
+            .find(|p| std::path::Path::new(p).exists())
+            .unwrap_or(data_path);
         let loaded = ec_bitrot::load_bitrot_sidecar(&path);
+        // A sidecar written for THIS generation that contradicts the volume's
+        // geometry is not "no protection" — it says the layout the volume is
+        // about to serve reads with is wrong. Fail the mount.
+        if let Ok(prot) = &loaded
+            && prot.generation == generation
+            && !ec_bitrot::geometry_matches(
+                prot,
+                self.data_shards as usize,
+                self.parity_shards as usize,
+                self.block_size,
+            )
+        {
+            let cfg = prot.ec_shard_config.as_ref();
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "ec volume {} generation {}: {} records layout {}+{} block {} but the volume is mounted as {}+{} block {}; refusing to serve one of the two layouts",
+                    self.volume_id.0,
+                    generation,
+                    path,
+                    cfg.map(|c| c.data_shards).unwrap_or(0),
+                    cfg.map(|c| c.parity_shards).unwrap_or(0),
+                    cfg.map(|c| c.block_size).unwrap_or(0),
+                    self.data_shards,
+                    self.parity_shards,
+                    self.block_size,
+                ),
+            ));
+        }
         let status = ec_bitrot::resolve_status(
             &loaded,
             generation,
             self.data_shards as usize,
             self.parity_shards as usize,
         );
+        // Provenance is committed together with the sidecar it describes, so a
+        // swallowed reload (`reload_bitrot_sidecar` logs and discards the `Err`
+        // above) cannot leave them disagreeing: the geometry-mismatch return
+        // happens before this point, so `bitrot`/`bitrot_status` below and
+        // `bitrot_source_dir` here always describe the same load attempt.
+        // Only a path that actually exists is a real source: `path` falls back
+        // to the data path when nothing was found, and recording that would
+        // claim a provenance the volume does not have.
+        self.bitrot_source_dir = if std::path::Path::new(&path).exists() {
+            std::path::Path::new(&path)
+                .parent()
+                .map(|p| p.to_string_lossy().into_owned())
+                .unwrap_or_default()
+        } else {
+            String::new()
+        };
         self.bitrot = None;
         self.bitrot_status = status;
         match status {
@@ -289,6 +917,7 @@ impl EcVolume {
                 );
             }
         }
+        Ok(())
     }
 
     /// The active-generation bitrot protection AND its status (cached at mount),
@@ -321,119 +950,43 @@ impl EcVolume {
     /// already unrecoverable, so treating it as a sidecar-integrity issue avoids
     /// raising false shard-corruption alarms.
     ///
+    /// A third outcome sits ahead of both of the above: if the identity fence
+    /// excluded a runtime AND the sidecar that supplied the protection was
+    /// resolved from that excluded runtime's directory, the checksums cannot be
+    /// trusted against
+    /// the merged shards at all. That case returns `(0, [], [errors])` with an
+    /// "unverifiable" note and never touches a shard handle — no scan, no
+    /// wholesale-mismatch classification, no blamed shard.
+    ///
     /// This method NEVER deletes or mutates anything — it is purely diagnostic.
+    /// Duplicates the mounted shard handles so `run()` can scan with the store
+    /// guard released; see `EcChecksumScrubPlan` for why that matters.
+    pub fn checksum_scrub_plan(&self) -> EcChecksumScrubPlan {
+        EcChecksumScrubPlan::for_volumes(&[self]).expect("a single runtime is never an empty slice")
+    }
+
+    /// Convenience wrapper preserving the original call shape. Callers that
+    /// hold the store lock MUST use `checksum_scrub_plan()` + `run()` instead.
     pub fn checksum_scrub(&self) -> (u64, Vec<u32>, Vec<String>) {
-        use crate::storage::erasure_coding::ec_bitrot;
-        use crate::storage::erasure_coding::ec_bitrot::BitrotStatus;
-
-        let mut errors: Vec<String> = Vec::new();
-
-        // Resolve the active-generation protection AND its status, mirroring
-        // Go's `ChecksumScrub` (`prot, status := ecv.BitrotProtection()`):
-        //   - BitrotOff   => sidecars are OPTIONAL; an absent (or generation/
-        //     config-mismatched) sidecar simply means protection is not enabled
-        //     for this generation. Return a CLEAN, EMPTY result — NOT an error —
-        //     so legacy/intentionally-unprotected volumes are never reported
-        //     broken. (Go: `case BitrotOff: return 0, nil, nil`.)
-        //   - BitrotInvalid => the sidecar is PRESENT but malformed/unverifiable
-        //     (self-integrity or manifest failure). That is the only status that
-        //     yields an integrity error here.
-        //   - BitrotOn    => scan local shards against it.
-        let prot = match self.bitrot_protection() {
-            (_, BitrotStatus::Off) => {
-                // Unprotected generation: nothing to verify. Not an error.
-                return (0, Vec::new(), Vec::new());
-            }
-            (_, BitrotStatus::Invalid) => {
-                return (
-                    0,
-                    Vec::new(),
-                    vec![format!(
-                        "EC volume {} bitrot sidecar is malformed/unverifiable (sidecar integrity)",
-                        self.volume_id.0
-                    )],
-                );
-            }
-            (Some(p), BitrotStatus::On) => p,
-            (None, BitrotStatus::On) => {
-                // Unreachable: BitrotOn always carries a loaded sidecar. Treat a
-                // missing payload defensively as protection off (clean no-op).
-                return (0, Vec::new(), Vec::new());
-            }
-        };
-
-        let block_size = prot.block_size as i64;
-        let generation = prot.generation;
-        let base = self.base_name();
-
-        let mut blocks_scanned: u64 = 0;
-        let mut mismatched_shards: Vec<u32> = Vec::new();
-        // Track shards whose blocks ALL mismatch (wholesale) to detect a
-        // stale/wrong sidecar.
-        let mut wholesale_mismatch = 0usize;
-
-        for (i, slot) in self.shards.iter().enumerate() {
-            if slot.is_none() {
-                continue; // not local
-            }
-            let shard_id = i as u32;
-            let Some(entry) = ec_bitrot::shard_checksums(&prot, shard_id) else {
-                errors.push(format!(
-                    "EC volume {} shard {} present but missing from sidecar manifest",
-                    self.volume_id.0, shard_id
-                ));
-                continue;
-            };
-
-            // Resolve the on-disk shard file path for the active generation,
-            // mirroring EcVolumeShard::reopen_against_generation's convention.
-            let path = if generation == 0 {
-                format!("{}.ec{:02}", base, shard_id)
-            } else {
-                format!("{}.ec{:02}.v{}", base, shard_id, generation)
-            };
-
-            let expected_blocks = entry.block_crc32c.len() / 4;
-            match ec_bitrot::verify_shard_file_blocks(&path, entry, block_size) {
-                Ok(mismatched) => {
-                    blocks_scanned += expected_blocks as u64;
-                    if !mismatched.is_empty() {
-                        mismatched_shards.push(shard_id);
-                        if expected_blocks > 0 && mismatched.len() == expected_blocks {
-                            wholesale_mismatch += 1;
-                        }
-                    }
-                }
-                Err(e) => {
-                    errors.push(format!(
-                        "EC volume {} shard {} scrub read error: {}",
-                        self.volume_id.0, shard_id, e
-                    ));
-                }
-            }
-        }
-
-        // If more shards mismatch wholesale than parity can mask, the sidecar
-        // itself is the likely culprit (stale generation / wrong volume), so
-        // suppress the shard-corruption verdict and flag a sidecar-integrity
-        // issue instead.
-        if wholesale_mismatch > self.parity_shards as usize {
-            errors.push(format!(
-                "EC volume {}: {} shards mismatch wholesale (> {} parity); suspect stale/wrong sidecar, not shard corruption",
-                self.volume_id.0, wholesale_mismatch, self.parity_shards
-            ));
-            mismatched_shards.clear();
-        }
-
-        mismatched_shards.sort_unstable();
-        (blocks_scanned, mismatched_shards, errors)
+        self.checksum_scrub_plan().run()
     }
 
     /// Walk the .ecj journal and populate `deleted_needles`. Called once
     /// from `new()` under exclusive ownership of the just-constructed
     /// EcVolume, so locking is not strictly required — but we take the
     /// write lock anyway for symmetry with later mutations.
-    fn load_deleted_needles_from_ecj(&mut self) -> io::Result<()> {
+    ///
+    /// Read in large chunks. This previously issued one `NEEDLE_ID_SIZE`-byte
+    /// positional read per entry, which is fine for a healthy journal (a few
+    /// KB) and catastrophic for a bloated one: at the 1.51 TB seen in
+    /// production that is ~188e9 syscalls, so the server spun at 100% of one
+    /// core with a 31 MB RSS — the set stays small because the ids repeat —
+    /// and never opened its HTTP port, which made the master unregister every
+    /// volume it held. Chunked reads cut that by ~`ECJ_LOAD_CHUNK_BYTES / 8`.
+    fn load_deleted_needles_from_ecj(
+        &mut self,
+        read_at: fn(&File, &mut [u8], u64) -> io::Result<()>,
+    ) -> io::Result<()> {
         let ecj_file = match self.ecj_file.as_ref() {
             Some(f) => f,
             None => return Ok(()),
@@ -441,21 +994,227 @@ impl EcVolume {
         if self.ecj_file_size < NEEDLE_ID_SIZE as i64 {
             return Ok(());
         }
-        let mut buf = [0u8; NEEDLE_ID_SIZE];
+
+        // Build into a local set and merge at the end. The previous version
+        // held the `deleted_needles` write lock for the whole scan, which on a
+        // bloated journal is the entire (unbounded) startup.
+        let mut loaded: HashSet<NeedleId> = HashSet::new();
+        read_ecj_ids_with(read_at, ecj_file, 0, self.ecj_file_size as u64, &mut loaded)?;
+
         let mut set = self
             .deleted_needles
             .write()
-            .map_err(|_| io::Error::new(io::ErrorKind::Other, "deleted_needles lock poisoned"))?;
-        let mut off: i64 = 0;
-        while off + NEEDLE_ID_SIZE as i64 <= self.ecj_file_size {
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::FileExt;
-                ecj_file.read_exact_at(&mut buf, off as u64)?;
-            }
-            set.insert(NeedleId::from_bytes(&buf));
-            off += NEEDLE_ID_SIZE as i64;
+            .map_err(|_| io::Error::other("deleted_needles lock poisoned"))?;
+        set.extend(loaded);
+        Ok(())
+    }
+
+    /// Rewrite a bloated `.ecj` from the set just loaded out of it.
+    ///
+    /// The journal is semantically a SET of deleted needle ids, but it is
+    /// written as an append-only log that nothing dedupes or truncates. Several
+    /// paths append a peer's *entire* journal onto this one —
+    /// `VolumeEcShardsCopy` (`copy_ecj_file`), EC index recovery, and
+    /// `ec_decode`'s deliberate merge across holders — so a volume whose shards
+    /// are repeatedly balanced between two servers grows the file geometrically.
+    /// Observed in production: 1.51 TB and 1.30 TB for one volume holding ~100
+    /// distinct ids, which wedged both owning volume servers at startup.
+    ///
+    /// Compaction is safe because the set IS the journal's meaning, provided
+    /// nothing else can write the file between the load and the rename. That is
+    /// what the `ecj_registry` reservation and the on-disk re-check establish:
+    /// this volume is the only holder of the path, no copy is writing to it, and
+    /// the file is still the inode and size that was loaded. Crash-safe via temp
+    /// file + fsync + rename + directory fsync.
+    ///
+    /// Returns `Err` only when the volume is left without a usable journal
+    /// handle, which must fail the mount. Every other failure leaves the
+    /// original journal in place and is logged here.
+    fn maybe_compact_ecj(&mut self, ops: EcjFsOps) -> io::Result<()> {
+        let ecj_path = self.ecj_file_name();
+        let tmp_path = format!("{}{}", self.idx_base_name(), ECJ_COMPACT_TMP_EXT);
+        let wanted = self.ecj_needs_compaction()?;
+        let stale_tmp = std::path::Path::new(&tmp_path).exists();
+        if !wanted && !stale_tmp {
+            return Ok(());
         }
+        let Some(_reservation) = self
+            .ecj_hold
+            .as_ref()
+            .and_then(EcjHold::try_begin_compaction)
+        else {
+            tracing::debug!(
+                volume_id = self.volume_id.0,
+                path = %ecj_path,
+                "skipping .ecj compaction: another holder or a copy can reach the journal",
+            );
+            return Ok(());
+        };
+        // A tmp left by a crash between its write and the rename. Removed under
+        // the reservation, so it cannot be another holder's compaction in flight.
+        if stale_tmp {
+            let _ = fs::remove_file(&tmp_path);
+        }
+        if !wanted {
+            return Ok(());
+        }
+        self.compact_ecj_reserved(&ecj_path, &tmp_path, ops)
+    }
+
+    /// The part of [`Self::maybe_compact_ecj`] that runs under the path
+    /// reservation: re-check the file, write the compacted tmp, publish it.
+    /// Same error contract: `Err` only when no usable journal handle is left.
+    fn compact_ecj_reserved(
+        &mut self,
+        ecj_path: &str,
+        tmp_path: &str,
+        ops: EcjFsOps,
+    ) -> io::Result<()> {
+        match self.ecj_unchanged_since_load(ecj_path) {
+            Ok(true) => {}
+            Ok(false) => {
+                tracing::warn!(
+                    volume_id = self.volume_id.0,
+                    path = %ecj_path,
+                    "skipping .ecj compaction: the journal changed on disk after it was loaded",
+                );
+                return Ok(());
+            }
+            Err(e) => {
+                tracing::warn!(volume_id = self.volume_id.0, error = %e, "compact .ecj: stat journal");
+                return Ok(());
+            }
+        }
+        let ids = self.sorted_deleted_ids()?;
+        tracing::warn!(
+            volume_id = self.volume_id.0,
+            collection = %self.collection,
+            on_disk_bytes = self.ecj_file_size,
+            unique_ids = ids.len(),
+            compacted_bytes = ids.len() * NEEDLE_ID_SIZE,
+            "compacting bloated .ecj deletion journal",
+        );
+        if let Err(e) = write_compacted_ecj_tmp(tmp_path, &ids) {
+            // Leaving the partial temp file behind would pin its bytes for the
+            // life of the process — and the likeliest reason to land here is
+            // ENOSPC, where those bytes are exactly what is scarce.
+            let _ = fs::remove_file(tmp_path);
+            tracing::warn!(volume_id = self.volume_id.0, error = %e, "compact .ecj: write compacted journal");
+            return Ok(());
+        }
+        match self.publish_compacted_ecj(ecj_path, tmp_path, ops) {
+            Ok(()) => Ok(()),
+            Err(EcjPublishError::Abandoned(e)) => {
+                tracing::warn!(volume_id = self.volume_id.0, error = %e, "compact .ecj: journal left as it was");
+                Ok(())
+            }
+            Err(EcjPublishError::HandleLost(e)) => Err(e),
+        }
+    }
+
+    /// Whether the loaded journal is bloated enough to rewrite:
+    /// `file_bytes >= max(ECJ_COMPACT_MIN_BYTES, ECJ_COMPACT_RATIO * set_bytes)`.
+    /// The 1 MiB floor keeps a small healthy journal from ever being rewritten.
+    /// Reads only the set's length, so the common no-op mount copies nothing.
+    fn ecj_needs_compaction(&self) -> io::Result<bool> {
+        let distinct = self
+            .deleted_needles
+            .read()
+            .map_err(|_| io::Error::other("deleted_needles lock poisoned"))?
+            .len();
+        let compacted_len = (distinct as i64).saturating_mul(NEEDLE_ID_SIZE as i64);
+        Ok(self.ecj_file_size >= ECJ_COMPACT_MIN_BYTES
+            && self.ecj_file_size >= compacted_len.saturating_mul(ECJ_COMPACT_RATIO))
+    }
+
+    /// The deleted set, sorted so the rewritten file is deterministic: two
+    /// holders that compact the same set produce byte-identical journals, which
+    /// makes a difference between them meaningful rather than ordering noise.
+    fn sorted_deleted_ids(&self) -> io::Result<Vec<NeedleId>> {
+        let mut ids: Vec<NeedleId> = self
+            .deleted_needles
+            .read()
+            .map_err(|_| io::Error::other("deleted_needles lock poisoned"))?
+            .iter()
+            .copied()
+            .collect();
+        ids.sort_unstable();
+        Ok(ids)
+    }
+
+    /// Whether the file at `ecj_path` is still the one this volume loaded: the
+    /// same inode as the open handle (Unix) and the size the set was read from.
+    /// A copy that appended, or replaced the file, after the load fails this,
+    /// and compacting then would drop what it wrote.
+    fn ecj_unchanged_since_load(&self, ecj_path: &str) -> io::Result<bool> {
+        let Some(held) = self.ecj_file.as_ref() else {
+            return Ok(false);
+        };
+        let held = held.metadata()?;
+        let on_path = fs::metadata(ecj_path)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::MetadataExt;
+            if held.dev() != on_path.dev() || held.ino() != on_path.ino() {
+                return Ok(false);
+            }
+        }
+        Ok(held.len() == on_path.len() && on_path.len() as i64 == self.ecj_file_size)
+    }
+
+    /// Publish a compacted tmp file over the live journal: drop the handle
+    /// (Windows cannot rename over an open file), rename, fsync the directory,
+    /// reopen the append handle.
+    ///
+    /// A failed rename publishes nothing: the tmp is removed and the handle to
+    /// the original journal restored, giving [`EcjPublishError::Abandoned`]. If
+    /// that restore fails too, or anything fails after the rename, the volume
+    /// has no usable handle: [`EcjPublishError::HandleLost`], carrying every
+    /// error involved.
+    fn publish_compacted_ecj(
+        &mut self,
+        ecj_path: &str,
+        tmp_path: &str,
+        ops: EcjFsOps,
+    ) -> Result<(), EcjPublishError> {
+        // Drop our handle on the destination BEFORE replacing it. On Windows a
+        // rename over a file that is still open fails outright, which would
+        // make compaction a permanent no-op there; on Unix the handle would
+        // survive as an unlinked inode, which is worse than useless.
+        self.ecj_file = None;
+        if let Err(rename_err) = (ops.rename)(tmp_path, ecj_path) {
+            let _ = fs::remove_file(tmp_path);
+            return match (ops.reopen)(ecj_path) {
+                Ok(f) => {
+                    self.ecj_file = Some(f);
+                    Err(EcjPublishError::Abandoned(rename_err))
+                }
+                Err(reopen_err) => Err(EcjPublishError::HandleLost(io::Error::new(
+                    reopen_err.kind(),
+                    format!(
+                        "rename {} over {}: {}; reopening the original journal then failed: {}",
+                        tmp_path, ecj_path, rename_err, reopen_err
+                    ),
+                ))),
+            };
+        }
+        // Syncing the temp file persisted its contents, not the directory entry
+        // that now points at it. Without this a power loss can restore the old
+        // bloated journal — and, worse, discard deletes that were acknowledged
+        // against the replacement in between. Matches the other replace-by-rename
+        // paths in this crate (ec_decoder, volume_idx_rebuild, volume_idx_repair).
+        let lost = |what: &str, e: io::Error| {
+            EcjPublishError::HandleLost(io::Error::new(
+                e.kind(),
+                format!("replaced {} but could not {}: {}", ecj_path, what, e),
+            ))
+        };
+        (ops.fsync_dir)(ecj_path).map_err(|e| lost("fsync its directory", e))?;
+        // Reopen so later journal_delete appends land in the file just written.
+        let reopened = (ops.reopen)(ecj_path).map_err(|e| lost("reopen it", e))?;
+        let size = reopened.metadata().map_err(|e| lost("stat it", e))?.len();
+        self.ecj_file_size = size as i64;
+        self.ecj_file = Some(reopened);
         Ok(())
     }
 
@@ -491,7 +1250,6 @@ impl EcVolume {
 
     // ---- File names ----
 
-    #[allow(dead_code)]
     fn base_name(&self) -> String {
         crate::storage::volume::volume_file_name(&self.dir, &self.collection, self.volume_id)
     }
@@ -541,6 +1299,27 @@ impl EcVolume {
             ));
         }
         shard.open()?;
+        // A 0-byte shard file beside an index with entries is residue of a
+        // failed copy or a truncation, not a mountable shard: registering
+        // it would advertise a size-0 claim that serves nothing and, since
+        // placement pins re-copies to the owning disk, would keep
+        // attracting repairs to a file that was never valid. A 0-byte shard
+        // beside a 0-byte index is different — that is the legitimate
+        // layout of a volume encoded with no live needles, and it must keep
+        // mounting. The startup scan already skips 0-byte shard files; this
+        // covers the mount path. Mirrors AddEcVolumeShard in
+        // weed/storage/erasure_coding/ec_volume.go.
+        if shard.file_size() == 0 && self.ecx_file_size > 0 {
+            let path = shard.file_name();
+            shard.close();
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "ec volume shard {} is empty (0 bytes) but the index has entries: residue of a failed copy, not a mountable shard",
+                    path
+                ),
+            ));
+        }
         self.shards[id] = Some(shard);
         Ok(())
     }
@@ -552,19 +1331,29 @@ impl EcVolume {
     /// default to the physical location's disk type.
     pub fn set_disk_type(&mut self, d: DiskType) {
         self.disk_type = d.clone();
-        for slot in self.shards.iter_mut() {
-            if let Some(shard) = slot {
-                shard.disk_type = d.clone();
-            }
+        for shard in self.shards.iter_mut().flatten() {
+            shard.disk_type = d.clone();
         }
     }
 
     /// Remove and close a shard.
-    pub fn remove_shard(&mut self, shard_id: ShardId) {
-        if let Some(ref mut shard) = self.shards[shard_id as usize] {
+    pub fn remove_shard(&mut self, shard_id: ShardId) -> io::Result<()> {
+        let idx = shard_id as usize;
+        if idx >= self.shards.len() {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                format!(
+                    "invalid shard id {} (max {})",
+                    shard_id,
+                    self.shards.len().saturating_sub(1)
+                ),
+            ));
+        }
+        if let Some(ref mut shard) = self.shards[idx] {
             shard.close();
         }
-        self.shards[shard_id as usize] = None;
+        self.shards[idx] = None;
+        Ok(())
     }
 
     /// Get a ShardBits bitmap of locally available shards.
@@ -586,7 +1375,7 @@ impl EcVolume {
     /// Reports whether `shard_id` is currently registered to this
     /// EcVolume (used by the cross-disk reconcile to skip already-
     /// loaded shards).
-    pub fn has_shard(&self, shard_id: u8) -> bool {
+    pub fn has_shard(&self, shard_id: ShardId) -> bool {
         self.shards
             .get(shard_id as usize)
             .map(|s| s.is_some())
@@ -644,37 +1433,6 @@ impl EcVolume {
 
     // ---- Shard locations (distributed tracking) ----
 
-    /// Set the list of server addresses for a single shard ID. Does
-    /// NOT touch `shard_locations_refresh_time` — a per-shard write
-    /// from inside a multi-shard population (e.g. iterating the
-    /// `LookupEcVolume` response shard-by-shard) would otherwise
-    /// flip the staleness flag while the map is still incomplete,
-    /// letting a concurrent reader observe `needs_refresh == false`
-    /// against a half-populated cache and return NotFound for the
-    /// not-yet-inserted shards.
-    ///
-    /// Callers writing back a whole `LookupEcVolume` reply should use
-    /// [`Self::merge_shard_locations`] instead — it upserts the reply's
-    /// shards under the write lock and advances the refresh timestamp in
-    /// one step, retaining cached shards the reply omits.
-    pub fn set_shard_locations(&self, shard_id: ShardId, locations: Vec<String>) {
-        self.shard_locations
-            .write()
-            .unwrap()
-            .insert(shard_id, locations);
-    }
-
-    /// Atomically replace the entire shard-locations map and stamp
-    /// the refresh time. Used by the distributed-read path's
-    /// post-`LookupEcVolume` write-back so the cache transitions
-    /// from old → fresh in a single observable step — concurrent
-    /// readers either see the full prior map or the full new map,
-    /// never an intermediate state with the freshness flag flipped.
-    pub fn replace_shard_locations(&self, locations: HashMap<ShardId, Vec<String>>) {
-        *self.shard_locations.write().unwrap() = locations;
-        *self.shard_locations_refresh_time.lock().unwrap() = Some(std::time::Instant::now());
-    }
-
     /// Merge a fresh `LookupEcVolume` reply into the shard-locations cache and
     /// stamp the refresh time, returning a clone of the resulting map.
     ///
@@ -683,29 +1441,76 @@ impl EcVolume {
     /// from the reply keep their previously-cached locations — so a reply that
     /// passes the data-shard completeness guard but omits a shard already in cache
     /// does not drop that shard's known location (unlike a full replace).
-    pub fn merge_shard_locations(
+    ///
+    /// Map and refresh time advance in one write section, so no reader can pair
+    /// the merged map with the previous lookup's timestamp.
+    pub(crate) fn merge_shard_locations(
         &self,
         locations: HashMap<ShardId, Vec<String>>,
     ) -> HashMap<ShardId, Vec<String>> {
-        let merged = {
-            let mut guard = self.shard_locations.write().unwrap();
-            for (shard_id, addrs) in locations {
-                guard.insert(shard_id, addrs);
-            }
-            guard.clone()
-        };
-        *self.shard_locations_refresh_time.lock().unwrap() = Some(std::time::Instant::now());
-        merged
+        let mut cache = self.shard_locations.write().unwrap();
+        for (shard_id, addrs) in locations {
+            cache.locations.insert(shard_id, addrs);
+        }
+        cache.refreshed_at = Some(Instant::now());
+        cache.locations.clone()
     }
 
-    /// Get a cloned list of server addresses for a given shard ID.
-    pub fn get_shard_locations(&self, shard_id: ShardId) -> Vec<String> {
-        self.shard_locations
-            .read()
-            .unwrap()
-            .get(&shard_id)
-            .cloned()
-            .unwrap_or_default()
+    /// The cached map and the time it was learned, read in one section. Both
+    /// halves describe the same refresh, which is what the freshness heuristic
+    /// assumes when it ages the map against the timestamp.
+    pub(crate) fn shard_locations_snapshot(
+        &self,
+    ) -> (HashMap<ShardId, Vec<String>>, Option<Instant>) {
+        let cache = self.shard_locations.read().unwrap();
+        (cache.locations.clone(), cache.refreshed_at)
+    }
+
+    /// Mark the cached map for a prompt re-check after a read failed against one
+    /// of its locations.
+    pub(crate) fn mark_shard_locations_stale(&self) {
+        self.shard_locations.write().unwrap().stale = true;
+    }
+
+    /// Put the stale mark to `decide`, and clear it only if `decide` says the
+    /// master lookup is going ahead — both in one critical section, so the mark
+    /// is consumed exactly once by the refresh that answers for it and a mark
+    /// raised meanwhile survives for the next one. `decide` owns the rest of the
+    /// freshness rule; it judges the map its caller will actually read from,
+    /// which is not necessarily the one cached here by the time it runs.
+    ///
+    /// `decide` runs under the cache write lock and must not acquire other locks:
+    /// every caller reaches this while already holding the store read lock, so a
+    /// cache-write → store-read inside `decide` would invert that order.
+    pub(crate) fn claim_shard_locations_refresh(&self, decide: impl FnOnce(bool) -> bool) -> bool {
+        let mut cache = self.shard_locations.write().unwrap();
+        let refresh = decide(cache.stale);
+        if refresh {
+            cache.stale = false;
+        }
+        refresh
+    }
+
+    // ---- I/O error tracking ----
+
+    pub fn check_read_write_error(&self, err: Option<&io::Error>) {
+        self.io_errors.check_read_write_error(err);
+    }
+
+    pub fn get_io_error_state(&self) -> (Option<String>, i32, bool) {
+        self.io_errors.get_io_error_state()
+    }
+
+    pub fn should_quarantine(&self) -> bool {
+        self.io_errors.should_quarantine()
+    }
+
+    pub fn mark_io_quarantined(&self) {
+        self.io_errors.mark_io_quarantined();
+    }
+
+    pub fn reset_io_error_state(&self) {
+        self.io_errors.reset_io_error_state();
     }
 
     // ---- Index operations ----
@@ -715,7 +1520,7 @@ impl EcVolume {
         let ecx_file = self
             .ecx_file
             .as_ref()
-            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "ecx file not open"))?;
+            .ok_or_else(|| io::Error::other("ecx file not open"))?;
 
         let entry_count = self.ecx_file_size as usize / NEEDLE_MAP_ENTRY_SIZE;
         if entry_count == 0 {
@@ -731,10 +1536,12 @@ impl EcVolume {
             let mid = lo + (hi - lo) / 2;
             let file_offset = (mid * NEEDLE_MAP_ENTRY_SIZE) as u64;
 
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::FileExt;
-                ecx_file.read_exact_at(&mut entry_buf, file_offset)?;
+            // Positional read so concurrent find_needle_from_ecx calls on the
+            // shared .ecx handle don't interleave a seek and a read and corrupt
+            // each other's binary search.
+            if let Err(e) = read_exact_at(ecx_file, &mut entry_buf, file_offset) {
+                self.check_read_write_error(Some(&e));
+                return Err(e);
             }
 
             let (key, offset, size) = idx_entry_from_bytes(&entry_buf);
@@ -744,8 +1551,10 @@ impl EcVolume {
                 // reported with TOMBSTONE_FILE_SIZE even though the .ecx
                 // record itself is untouched.
                 if self.is_needle_deleted(needle_id) {
+                    self.check_read_write_error(None);
                     return Ok(Some((offset, TOMBSTONE_FILE_SIZE)));
                 }
+                self.check_read_write_error(None);
                 return Ok(Some((offset, size)));
             } else if key < needle_id {
                 lo = mid + 1;
@@ -754,9 +1563,30 @@ impl EcVolume {
             }
         }
 
+        self.check_read_write_error(None);
         Ok(None)
     }
 
+    /// Large-block length of this volume's shard layout (the uniform block
+    /// size when set, the legacy 1GiB otherwise). Mirrors Go's
+    /// ECContext.LargeBlockSize.
+    pub fn large_block_size(&self) -> i64 {
+        if self.block_size > 0 {
+            self.block_size
+        } else {
+            ERASURE_CODING_LARGE_BLOCK_SIZE as i64
+        }
+    }
+
+    /// Small-block length of this volume's shard layout.
+    pub fn small_block_size(&self) -> i64 {
+        if self.block_size > 0 {
+            self.block_size
+        } else {
+            ERASURE_CODING_SMALL_BLOCK_SIZE as i64
+        }
+    }
+
     /// Locate the EC shard intervals needed to read a needle.
     /// Locate the EC shard intervals covering a needle at `actual_offset` whose
     /// index size is `size`. Mirrors Go's EcVolume.LocateEcShardNeedleInterval.
@@ -775,7 +1605,27 @@ impl EcVolume {
         };
         // locate_data wants the on-disk size (header+body+checksum+timestamp+padding).
         let actual = get_actual_size(size, self.version);
-        ec_locate::locate_data(actual_offset, Size(actual as i32), shard_size, self.data_shards)
+        ec_locate::locate_data(
+            actual_offset,
+            Size(actual as i32),
+            shard_size,
+            self.data_shards,
+            self.large_block_size(),
+            self.small_block_size(),
+        )
+    }
+
+    /// Resolve an interval against this volume's shard block layout. Mirrors
+    /// Go's EcVolume.IntervalToShardIdAndOffset.
+    pub fn interval_to_shard_id_and_offset(
+        &self,
+        interval: &ec_locate::Interval,
+    ) -> (ShardId, i64) {
+        interval.to_shard_id_and_offset(
+            self.data_shards,
+            self.large_block_size(),
+            self.small_block_size(),
+        )
     }
 
     pub fn locate_needle(
@@ -821,7 +1671,7 @@ impl EcVolume {
         let mut bytes = Vec::with_capacity(actual_size);
 
         for interval in &intervals {
-            let (shard_id, shard_offset) = interval.to_shard_id_and_offset(self.data_shards);
+            let (shard_id, shard_offset) = self.interval_to_shard_id_and_offset(interval);
             let shard = self
                 .shards
                 .get(shard_id as usize)
@@ -874,10 +1724,8 @@ impl EcVolume {
 
     /// Get the size of a single shard (all shards are the same size).
     fn shard_file_size(&self) -> i64 {
-        for shard in &self.shards {
-            if let Some(s) = shard {
-                return s.file_size();
-            }
+        if let Some(s) = self.shards.iter().flatten().next() {
+            return s.file_size();
         }
         0
     }
@@ -903,6 +1751,17 @@ impl EcVolume {
                 use std::os::unix::fs::FileExt;
                 ecx_file.read_exact_at(&mut entry_buf, file_offset)?;
             }
+            #[cfg(windows)]
+            {
+                // Positional read so concurrent readers of the shared .ecx
+                // handle can't interleave seek/read. Mirrors the
+                // read_exact_at helper at the bottom of this file.
+                read_exact_at(ecx_file, &mut entry_buf, file_offset)?;
+            }
+            #[cfg(not(any(unix, windows)))]
+            {
+                compile_error!("Platform not supported: only unix and windows are supported");
+            }
             let (_key, _offset, size) = idx_entry_from_bytes(&entry_buf);
             // Match Go's Size.Raw(): tombstone (-1) returns 0, other negatives return abs
             if !size.is_tombstone() {
@@ -921,187 +1780,57 @@ impl EcVolume {
     /// ScrubIndex verifies index integrity of an EC volume.
     /// Matches Go's `(ev *EcVolume) ScrubIndex()` → `idx.CheckIndexFile()`.
     /// Returns (entry_count, errors).
-    pub fn scrub_index(&self) -> (u64, Vec<String>) {
-        if self.ecx_file.is_none() {
-            return (
-                0,
-                vec![format!(
-                    "no ECX file associated with EC volume {}",
-                    self.volume_id.0
-                )],
-            );
-        }
-        if self.ecx_file_size == 0 {
-            return (
-                0,
-                vec![format!("zero-size ECX file for EC volume {}", self.volume_id.0)],
-            );
-        }
-
-        // Walk a private fd so the structural scan never moves the shared
-        // ecx_file cursor (the cached handle is read positionally elsewhere).
+    /// Snapshot for `scrub_index`, so the index walk can run with the store
+    /// lock released. Same rationale as `checksum_scrub_plan`.
+    pub fn scrub_index_plan(&self) -> EcIndexScrubPlan {
         let ecx_path = self.ecx_file_name();
-        let mut ecx_file = match File::open(&ecx_path) {
-            Ok(f) => f,
-            Err(e) => return (0, vec![format!("open ECX file {}: {}", ecx_path, e)]),
-        };
-        crate::storage::idx::check_index_file(&mut ecx_file, self.ecx_file_size, self.version)
+        // Opened under the guard, for the same reason the checksum plan
+        // duplicates its shard handles. A fresh open rather than a clone of the
+        // cached handle: `check_index_file` seeks, and `dup` would share the
+        // cursor the shared handle is read from elsewhere.
+        let ecx_handle = File::open(&ecx_path);
+        EcIndexScrubPlan {
+            volume_id: self.volume_id,
+            has_ecx_file: self.ecx_file.is_some(),
+            ecx_path,
+            ecx_file_size: self.ecx_file_size,
+            version: self.version,
+            ecx_handle,
+        }
+    }
+
+    /// Convenience wrapper preserving the original call shape. Callers holding
+    /// the store lock MUST use `scrub_index_plan()` + `run()` instead.
+    pub fn scrub_index(&self) -> (u64, Vec<String>) {
+        self.scrub_index_plan().run()
+    }
+
+    /// Snapshot for `scrub_local`, so the needle walk can run with the store
+    /// lock released. Same rationale as `checksum_scrub_plan`: this reads every
+    /// local needle's bytes, which is GB-scale on a real volume.
+    ///
+    /// The shard vector keeps its SLOT structure — index is the shard id, gaps
+    /// are the shards this node does not hold. `scrub_local` reads that
+    /// distinction to decide whether a needle can be reassembled locally at
+    /// all, so compacting it would silently change which needles get verified.
+    pub fn scrub_local_plan(&self) -> EcLocalScrubPlan {
+        EcLocalScrubPlan::for_volumes(&[self]).expect("a single runtime is never an empty slice")
     }
 
     /// ScrubLocal verifies each needle against the LOCAL shards only; it cannot
     /// CRC-check a needle whose intervals span shards held on other servers.
     /// Mirrors Go's EcVolume.ScrubLocal. Returns (rows walked, broken shards, errors).
+    ///
+    /// Convenience wrapper preserving the original call shape. Callers that
+    /// hold the store lock MUST use `scrub_local_plan()` + `run()` instead.
     pub fn scrub_local(
         &self,
-    ) -> (u64, Vec<crate::pb::volume_server_pb::EcShardInfo>, Vec<String>) {
-        // Local scan also verifies the index.
-        let (_, mut errs) = self.scrub_index();
-
-        let mut broken_shards: HashSet<ShardId> = HashSet::new();
-        let mut count: u64 = 0;
-
-        let ecx_path = self.ecx_file_name();
-        let mut ecx_file = match File::open(&ecx_path) {
-            Ok(f) => f,
-            Err(e) => {
-                errs.push(format!("open ECX file {}: {}", ecx_path, e));
-                return (count, Vec::new(), errs);
-            }
-        };
-
-        // Reused across every needle/chunk to avoid a per-chunk allocation.
-        let mut chunk_buf: Vec<u8> = Vec::new();
-        let walk = crate::storage::idx::walk_index_file(&mut ecx_file, 0, |id, offset, size| {
-            count += 1;
-            if size.is_tombstone() {
-                return Ok(());
-            }
-
-            let locations = self.locate_ec_shard_needle_interval(offset.to_actual_offset(), size);
-            // A needle is verifiable locally only if every shard it spans is local;
-            // when any is remote, skip the reassembly buffer entirely.
-            let has_remote_chunks = locations.iter().any(|iv| {
-                let (sid, _) = iv.to_shard_id_and_offset(self.data_shards);
-                self.shards.get(sid as usize).and_then(|s| s.as_ref()).is_none()
-            });
-            let mut read: i64 = 0;
-            let mut data: Vec<u8> = if has_remote_chunks {
-                Vec::new()
-            } else {
-                Vec::with_capacity(get_actual_size(size, self.version) as usize)
-            };
-            let mut local_shard_ids: Vec<ShardId> = Vec::new();
-
-            for (i, iv) in locations.iter().enumerate() {
-                let (sid, soffset) = iv.to_shard_id_and_offset(self.data_shards);
-                let ssize = iv.size;
-                let shard = match self.shards.get(sid as usize).and_then(|s| s.as_ref()) {
-                    Some(s) => s,
-                    None => {
-                        // Shard is not local; we can't verify it without decoding.
-                        read += ssize;
-                        continue;
-                    }
-                };
-                local_shard_ids.push(sid);
-
-                if soffset + ssize > shard.file_size() {
-                    broken_shards.insert(sid);
-                    errs.push(format!(
-                        "local shard {} for needle {} is too short ({}), cannot read chunk {}/{}",
-                        sid,
-                        id.0,
-                        shard.file_size(),
-                        i + 1,
-                        locations.len()
-                    ));
-                    continue;
-                }
-
-                chunk_buf.resize(ssize as usize, 0);
-                match shard.read_at(&mut chunk_buf, soffset as u64) {
-                    Err(e) => {
-                        broken_shards.insert(sid);
-                        errs.push(format!(
-                            "failed to read chunk {}/{} for needle {} from local shard {} at offset {}: {}",
-                            i + 1,
-                            locations.len(),
-                            id.0,
-                            sid,
-                            soffset,
-                            e
-                        ));
-                        continue;
-                    }
-                    Ok(got) if got as i64 != ssize => {
-                        broken_shards.insert(sid);
-                        errs.push(format!(
-                            "expected {} bytes for chunk {}/{} for needle {} from local shard {}, got {}",
-                            ssize,
-                            i + 1,
-                            locations.len(),
-                            id.0,
-                            sid,
-                            got
-                        ));
-                        continue;
-                    }
-                    Ok(_) => {}
-                }
-
-                if !has_remote_chunks {
-                    data.extend_from_slice(&chunk_buf);
-                }
-                read += ssize;
-            }
-
-            local_shard_ids.sort_unstable();
-
-            let want = get_actual_size(size, self.version);
-            if read != want {
-                // Like Go, returning from the walk callback aborts the scan.
-                return Err(io::Error::new(
-                    io::ErrorKind::Other,
-                    format!(
-                        "expected {} bytes for needle {} on volume {}, got {}",
-                        want, id.0, self.volume_id.0, read
-                    ),
-                ));
-            }
-
-            // Only a fully-local needle can be reassembled and CRC-checked.
-            if !has_remote_chunks {
-                let mut n = Needle::default();
-                if let Err(e) = n.read_bytes(&data, 0, size, self.version) {
-                    // A delete-state disagreement between the .ecx index and the reassembled
-                    // on-disk header (live index vs zero header size) is not corruption.
-                    let delete_state_disagrees = matches!(
-                        &e,
-                        NeedleError::SizeMismatch { found, .. } if size.is_deleted() != (found.0 == 0)
-                    );
-                    if !delete_state_disagrees {
-                        errs.push(format!(
-                            "needle {} on volume {}, shards {:?}: {}",
-                            id.0, self.volume_id.0, local_shard_ids, e
-                        ));
-                    }
-                }
-            }
-            Ok(())
-        });
-        if let Err(e) = walk {
-            // Go appends the walk/callback error verbatim.
-            errs.push(e.to_string());
-        }
-
-        let mut broken: Vec<crate::pb::volume_server_pb::EcShardInfo> = broken_shards
-            .iter()
-            .filter_map(|sid| self.shards.get(*sid as usize).and_then(|s| s.as_ref()))
-            .map(|s| s.to_ec_shard_info())
-            .collect();
-        broken.sort_by(|a, b| a.shard_id.cmp(&b.shard_id));
-
-        (count, broken, errs)
+    ) -> (
+        u64,
+        Vec<crate::pb::volume_server_pb::EcShardInfo>,
+        Vec<String>,
+    ) {
+        self.scrub_local_plan().run()
     }
 
     // ---- Deletion ----
@@ -1114,13 +1843,10 @@ impl EcVolume {
     /// the index (ignored by callers) and an error on IO failure.
     fn tombstone_ecx_entry(&self, needle_id: NeedleId) -> io::Result<bool> {
         let ecx_file = self.ecx_file.as_ref().ok_or_else(|| {
-            io::Error::new(
-                io::ErrorKind::Other,
-                format!(
-                    "ec volume {} has no open .ecx file (closed or corrupt)",
-                    self.volume_id.0
-                ),
-            )
+            io::Error::other(format!(
+                "ec volume {} has no open .ecx file (closed or corrupt)",
+                self.volume_id.0
+            ))
         })?;
 
         let entry_count = self.ecx_file_size as usize / NEEDLE_MAP_ENTRY_SIZE;
@@ -1139,6 +1865,17 @@ impl EcVolume {
                 use std::os::unix::fs::FileExt;
                 ecx_file.read_exact_at(&mut entry_buf, file_offset)?;
             }
+            #[cfg(windows)]
+            {
+                // Positional read so concurrent readers of the shared .ecx
+                // handle can't interleave seek/read. Mirrors the
+                // read_exact_at helper at the bottom of this file.
+                read_exact_at(ecx_file, &mut entry_buf, file_offset)?;
+            }
+            #[cfg(not(any(unix, windows)))]
+            {
+                compile_error!("Platform not supported: only unix and windows are supported");
+            }
             let (key, _offset, _old_size) = idx_entry_from_bytes(&entry_buf);
             if key == needle_id {
                 let size_offset = file_offset + NEEDLE_ID_SIZE as u64 + OFFSET_SIZE as u64;
@@ -1149,6 +1886,31 @@ impl EcVolume {
                     use std::os::unix::fs::FileExt;
                     ecx_file.write_all_at(&size_buf, size_offset)?;
                 }
+                #[cfg(windows)]
+                {
+                    // Positional write so concurrent readers of the shared
+                    // .ecx handle can't observe a moved cursor. Mirrors the
+                    // read_exact_at helper at the bottom of this file, with
+                    // seek_write in place of seek_read.
+                    use std::os::windows::fs::FileExt;
+                    let mut written = 0;
+                    let mut at = size_offset;
+                    while written < size_buf.len() {
+                        let n = ecx_file.seek_write(&size_buf[written..], at)?;
+                        if n == 0 {
+                            return Err(io::Error::new(
+                                io::ErrorKind::WriteZero,
+                                "seek_write wrote nothing",
+                            ));
+                        }
+                        written += n;
+                        at += n as u64;
+                    }
+                }
+                #[cfg(not(any(unix, windows)))]
+                {
+                    compile_error!("Platform not supported: only unix and windows are supported");
+                }
                 return Ok(true);
             } else if key < needle_id {
                 lo = mid + 1;
@@ -1167,7 +1929,7 @@ impl EcVolume {
     /// `deleted_needles` instead). The rebuild is atomic with respect to
     /// the journal: if any individual write fails the .ecj file is left
     /// in place and the error is propagated so tombstones are not lost.
-    #[allow(dead_code)]
+    #[expect(dead_code, reason = "no caller yet; see the doc comment")]
     fn rebuild_ecx_from_journal(&mut self) -> io::Result<()> {
         let ecj_path = self.ecj_file_name();
         if !std::path::Path::new(&ecj_path).exists() {
@@ -1203,13 +1965,7 @@ impl EcVolume {
         // in-memory deleted set (all of its contents are now materialized
         // in .ecx), and reset the cached size.
         fs::remove_file(&ecj_path)?;
-        let ecj_file = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .create(true)
-            .append(true)
-            .open(&ecj_path)?;
-        self.ecj_file = Some(ecj_file);
+        self.ecj_file = Some(open_ecj_append(&ecj_path)?);
         self.ecj_file_size = 0;
         if let Ok(mut set) = self.deleted_needles.write() {
             set.clear();
@@ -1254,40 +2010,57 @@ impl EcVolume {
             return Ok(());
         }
 
+        let mut buf = [0u8; NEEDLE_ID_SIZE];
+        needle_id.to_bytes(&mut buf);
+        self.append_journal(&buf)?;
+        if let Ok(mut set) = self.deleted_needles.write() {
+            set.insert(needle_id);
+        }
+        Ok(())
+    }
+
+    /// Append whole records to `.ecj` and sync them. On any failure the file is
+    /// truncated back to the pre-append length so the on-disk journal and
+    /// `deleted_needles` cannot drift.
+    fn append_journal(&mut self, records: &[u8]) -> io::Result<()> {
         let prev_ecj_size = self.ecj_file_size;
         let append_result: io::Result<()> = {
             let ecj_file = self
                 .ecj_file
                 .as_mut()
-                .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "ecj file not open"))?;
-            let mut buf = [0u8; NEEDLE_ID_SIZE];
-            needle_id.to_bytes(&mut buf);
+                .ok_or_else(|| io::Error::other("ecj file not open"))?;
             ecj_file
-                .write_all(&buf)
+                .write_all(records)
                 .and_then(|_| ecj_file.sync_all())
         };
 
         match append_result {
             Ok(()) => {
-                self.ecj_file_size += NEEDLE_ID_SIZE as i64;
-                if let Ok(mut set) = self.deleted_needles.write() {
-                    set.insert(needle_id);
-                }
+                self.ecj_file_size += records.len() as i64;
                 Ok(())
             }
             Err(e) => {
                 // write_all may have extended the file on disk before
                 // sync_all failed; truncate back to the known-good size so
                 // the on-disk journal never drifts past `deleted_needles`.
-                if let Some(ecj) = self.ecj_file.as_mut() {
-                    if let Err(trunc_err) = ecj.set_len(prev_ecj_size as u64) {
-                        tracing::error!(
-                            volume_id = self.volume_id.0,
-                            needle_id = needle_id.0,
-                            truncate_error = %trunc_err,
-                            "failed to truncate ecj after append failure"
-                        );
-                    }
+                // Uses its own write handle: on Windows the append handle
+                // lacks FILE_WRITE_DATA, so set_len through it fails with
+                // ERROR_ACCESS_DENIED and the rollback would silently not
+                // happen.
+                let ecj_path = self.ecj_file_name();
+                let rollback = open_volume_file(OpenOptions::new().write(true), &ecj_path)
+                    .and_then(|f| f.set_len(prev_ecj_size as u64).and_then(|_| f.sync_all()));
+                // Bumped on attempt, not success: a failed rollback leaves the
+                // bytes in place and a decode re-reading for the epoch change
+                // simply sees them — harmless — while a successful one must
+                // never go unnoticed by an unlocked journal read.
+                ECJ_ROLLBACK_EPOCH.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                if let Err(trunc_err) = rollback {
+                    tracing::error!(
+                        volume_id = self.volume_id.0,
+                        truncate_error = %trunc_err,
+                        "failed to truncate ecj after append failure"
+                    );
                 }
                 Err(e)
             }
@@ -1297,14 +2070,11 @@ impl EcVolume {
     /// Internal: binary search .ecx without masking by `deleted_needles`.
     /// Used by `journal_delete` so a repeat delete can still see the raw
     /// pre-existing .ecx tombstone from a prior rebuild.
-    fn find_needle_from_ecx_raw(
-        &self,
-        needle_id: NeedleId,
-    ) -> io::Result<Option<(Offset, Size)>> {
+    fn find_needle_from_ecx_raw(&self, needle_id: NeedleId) -> io::Result<Option<(Offset, Size)>> {
         let ecx_file = self
             .ecx_file
             .as_ref()
-            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "ecx file not open"))?;
+            .ok_or_else(|| io::Error::other("ecx file not open"))?;
         let entry_count = self.ecx_file_size as usize / NEEDLE_MAP_ENTRY_SIZE;
         if entry_count == 0 {
             return Ok(None);
@@ -1320,6 +2090,18 @@ impl EcVolume {
                 use std::os::unix::fs::FileExt;
                 ecx_file.read_exact_at(&mut entry_buf, file_offset)?;
             }
+            #[cfg(windows)]
+            {
+                // Positional read so concurrent find_needle_from_ecx_raw calls
+                // on the shared .ecx handle don't interleave seek/read and
+                // corrupt each other's binary search. Mirrors the
+                // read_exact_at helper at the bottom of this file.
+                read_exact_at(ecx_file, &mut entry_buf, file_offset)?;
+            }
+            #[cfg(not(any(unix, windows)))]
+            {
+                compile_error!("Platform not supported: only unix and windows are supported");
+            }
             let (key, offset, size) = idx_entry_from_bytes(&entry_buf);
             if key == needle_id {
                 return Ok(Some((offset, size)));
@@ -1342,38 +2124,63 @@ impl EcVolume {
     ) -> io::Result<()> {
         // cookie == 0 indicates SkipCookieCheck was requested
         if cookie.0 != 0 {
-            // Try to read the needle's cookie from the EC shards to validate
-            // Look up the needle in ecx index to find its offset, then read header from shard
-            if let Ok(Some((offset, size))) = self.find_needle_from_ecx(needle_id) {
-                if !size.is_deleted() && !offset.is_zero() {
-                    let actual_offset = offset.to_actual_offset() as u64;
-                    // Determine which shard contains this offset and read the cookie
-                    let shard_size = self
-                        .shards
-                        .iter()
-                        .filter_map(|s| s.as_ref())
-                        .map(|s| s.file_size())
-                        .next()
-                        .unwrap_or(0) as u64;
-                    if shard_size > 0 {
-                        let shard_id = (actual_offset / shard_size) as usize;
-                        let shard_offset = actual_offset % shard_size;
-                        if let Some(Some(shard)) = self.shards.get(shard_id) {
-                            let mut header_buf = [0u8; 4]; // cookie is first 4 bytes of needle
-                            if shard.read_at(&mut header_buf, shard_offset).is_ok() {
-                                let needle_cookie =
-                                    crate::storage::types::Cookie(u32::from_be_bytes(header_buf));
-                                if needle_cookie != cookie {
-                                    return Err(io::Error::new(
-                                        io::ErrorKind::InvalidData,
-                                        format!("unexpected cookie {:x}", cookie.0),
-                                    ));
-                                }
-                            }
-                        }
+            let (offset, size) = match self.find_needle_from_ecx(needle_id)? {
+                Some((o, s)) => (o, s),
+                None => return self.journal_delete(needle_id),
+            };
+            if size.is_deleted() || offset.is_zero() {
+                return self.journal_delete(needle_id);
+            }
+            let actual_offset = offset.to_actual_offset();
+            let intervals = self.locate_ec_shard_needle_interval(actual_offset, size);
+            if intervals.is_empty() {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("cannot verify cookie for needle {}", needle_id.0),
+                ));
+            }
+            let (shard_id, shard_offset) = self.interval_to_shard_id_and_offset(&intervals[0]);
+            let shard = self
+                .shards
+                .get(shard_id as usize)
+                .and_then(|s| s.as_ref())
+                .ok_or_else(|| {
+                    io::Error::new(
+                        io::ErrorKind::InvalidData,
+                        format!("cannot verify cookie: shard {} not local", shard_id),
+                    )
+                })?;
+            // Retry short reads, but fail closed on EOF.
+            let mut header_buf = [0u8; 4];
+            let mut filled = 0usize;
+            while filled < header_buf.len() {
+                match shard.read_at(
+                    &mut header_buf[filled..],
+                    shard_offset as u64 + filled as u64,
+                ) {
+                    Ok(0) => break,
+                    Ok(n) => filled += n,
+                    Err(e) => {
+                        return Err(io::Error::new(
+                            io::ErrorKind::InvalidData,
+                            format!("cannot verify cookie: {}", e),
+                        ));
                     }
                 }
             }
+            if filled != header_buf.len() {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    "cannot verify cookie: incomplete header",
+                ));
+            }
+            let needle_cookie = crate::storage::types::Cookie(u32::from_be_bytes(header_buf));
+            if needle_cookie != cookie {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("unexpected cookie {:x}", cookie.0),
+                ));
+            }
         }
         self.journal_delete(needle_id)
     }
@@ -1396,6 +2203,32 @@ impl EcVolume {
         Ok(needles)
     }
 
+    /// Fold a peer's deletion journal into this mounted volume: append only
+    /// the ids not already deleted here, in one write and one fsync, then
+    /// publish them into the in-memory set — the same commit order as
+    /// `journal_delete`. `&mut self` serializes it with deletes under the store
+    /// lock, and the live handle is appended to in place, so no delete can land
+    /// in an orphaned file. Returns how many ids were added.
+    pub fn merge_journal(&mut self, ids: &HashSet<NeedleId>) -> io::Result<usize> {
+        let delta = super::ecj_merge::ecj_delta(ids, |id| self.is_needle_deleted(*id));
+        if delta.is_empty() {
+            return Ok(0);
+        }
+        self.append_journal(&super::ecj_merge::encode_ecj_ids(&delta))?;
+        if let Ok(mut set) = self.deleted_needles.write() {
+            set.extend(delta.iter().copied());
+        }
+        Ok(delta.len())
+    }
+
+    /// Marks ids deleted in memory only, for runtimes sharing a journal
+    /// another runtime already appended them to.
+    pub fn publish_merged_ids(&self, ids: &HashSet<NeedleId>) {
+        if let Ok(mut set) = self.deleted_needles.write() {
+            set.extend(ids.iter().copied());
+        }
+    }
+
     // ---- Lifecycle ----
 
     pub fn close(&mut self) {
@@ -1411,6 +2244,7 @@ impl EcVolume {
         }
         self.ecx_file = None;
         self.ecj_file = None;
+        self.ecj_hold = None;
     }
 
     pub fn destroy(&mut self) {
@@ -1429,6 +2263,7 @@ impl EcVolume {
         );
         let _ = fs::remove_file(format!("{}.ecx", actual_base));
         let _ = fs::remove_file(format!("{}.ecj", actual_base));
+        let _ = fs::remove_file(format!("{}{}", actual_base, ECJ_COMPACT_TMP_EXT));
         let _ = fs::remove_file(format!("{}.vif", actual_base));
         // Also sweep the originally-configured idx dir in case stale files
         // exist there (ecx_file_name() / ecj_file_name() now resolve from
@@ -1441,6 +2276,7 @@ impl EcVolume {
             );
             let _ = fs::remove_file(format!("{}.ecx", idx_base));
             let _ = fs::remove_file(format!("{}.ecj", idx_base));
+            let _ = fs::remove_file(format!("{}{}", idx_base, ECJ_COMPACT_TMP_EXT));
             let _ = fs::remove_file(format!("{}.vif", idx_base));
         }
         if self.ecx_actual_dir != self.dir && self.dir_idx != self.dir {
@@ -1451,15 +2287,15 @@ impl EcVolume {
             );
             let _ = fs::remove_file(format!("{}.ecx", data_base));
             let _ = fs::remove_file(format!("{}.ecj", data_base));
+            let _ = fs::remove_file(format!("{}{}", data_base, ECJ_COMPACT_TMP_EXT));
             let _ = fs::remove_file(format!("{}.vif", data_base));
         }
         // Go's Destroy() also removes bitrot checksum sidecars so a later
         // volume-id reuse cannot load stale protection, and so
         // collection.delete does not leave orphaned <base>.ecsum files.
         // ecx_actual_dir is always one of these two dirs.
-        let _ = crate::storage::erasure_coding::ec_bitrot::remove_bitrot_sidecars(
-            &self.base_name(),
-        );
+        let _ =
+            crate::storage::erasure_coding::ec_bitrot::remove_bitrot_sidecars(&self.base_name());
         if self.dir_idx != self.dir {
             let idx_base = crate::storage::volume::volume_file_name(
                 &self.dir_idx,
@@ -1470,6 +2306,7 @@ impl EcVolume {
         }
         self.ecx_file = None;
         self.ecj_file = None;
+        self.ecj_hold = None;
     }
 }
 
@@ -1478,26 +2315,82 @@ mod tests {
     use super::*;
     use tempfile::TempDir;
 
+    /// Go's NewEcVolume fails with os.ErrNotExist when neither directory has an
+    /// `.ecx`. Mounting anyway advertises shards every read then fails on with
+    /// "ecx file not open", and zeroes the size `add_shard`'s 0-byte guard needs.
+    #[test]
+    fn test_new_without_ecx_is_not_found() {
+        let data = TempDir::new().unwrap();
+        let idx = TempDir::new().unwrap();
+        let (dir, dir_idx) = (data.path().to_str().unwrap(), idx.path().to_str().unwrap());
+        std::fs::write(format!("{}/7.ec00", dir), b"shard").unwrap();
+
+        for idx_dir in [dir, dir_idx] {
+            let err = EcVolume::new(dir, idx_dir, "", VolumeId(7))
+                .err()
+                .expect("an EC volume without an .ecx must not mount");
+            assert_eq!(err.kind(), io::ErrorKind::NotFound, "{}", err);
+        }
+    }
+
+    /// A 0-byte `.ecx` stub left by an interrupted copy yields to a non-empty
+    /// copy in the other directory, whichever side the stub is on.
+    #[test]
+    fn test_new_prefers_non_empty_ecx_over_zero_byte_stub() {
+        for stub_in_idx_dir in [true, false] {
+            let data = TempDir::new().unwrap();
+            let idx = TempDir::new().unwrap();
+            let (dir, dir_idx) = (data.path().to_str().unwrap(), idx.path().to_str().unwrap());
+            let (stub_dir, valid_dir) = if stub_in_idx_dir {
+                (dir_idx, dir)
+            } else {
+                (dir, dir_idx)
+            };
+            std::fs::write(format!("{}/7.ecx", stub_dir), b"").unwrap();
+            std::fs::write(
+                format!("{}/7.ecx", valid_dir),
+                vec![0u8; NEEDLE_MAP_ENTRY_SIZE],
+            )
+            .unwrap();
+
+            let vol = EcVolume::new(dir, dir_idx, "", VolumeId(7)).unwrap();
+            assert_eq!(vol.ecx_actual_dir(), valid_dir);
+            assert_eq!(vol.ecx_file_size, NEEDLE_MAP_ENTRY_SIZE as i64);
+        }
+    }
+
+    /// With no other copy a 0-byte `.ecx` is a legitimate empty index (a volume
+    /// whose needles were all deleted before encoding) and still mounts, as in Go.
+    #[test]
+    fn test_new_accepts_lone_zero_byte_ecx_as_empty_index() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        std::fs::write(format!("{}/7.ecx", dir), b"").unwrap();
+
+        let vol = EcVolume::new(dir, dir, "", VolumeId(7)).unwrap();
+        assert_eq!(vol.ecx_file_size, 0);
+        assert!(!is_usable_ecx_file(&vol.ecx_file_name()));
+    }
+
     /// `destroy()` must remove co-located `.ecsum` sidecars (Go Destroy parity).
     /// Without this, `collection.delete` leaves orphaned bitrot files that
     /// inflate EC-health scanners after the shards are gone.
     #[test]
     fn test_destroy_removes_bitrot_sidecar() {
         use crate::storage::needle_map::NeedleMapKind;
-        use crate::storage::volume::Volume;
+        use crate::storage::volume::{Volume, VolumeSpec};
 
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "ec1c",
             VolumeId(2074),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec {
+                collection: "ec1c",
+                ..Default::default()
+            },
         )
         .unwrap();
         for i in 1..=3 {
@@ -1509,7 +2402,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         v.close();
@@ -1560,20 +2453,16 @@ mod tests {
     fn test_mount_loads_bitrot_sidecar() {
         use crate::storage::erasure_coding::ec_bitrot::BitrotStatus;
         use crate::storage::needle_map::NeedleMapKind;
-        use crate::storage::volume::Volume;
+        use crate::storage::volume::{Volume, VolumeSpec};
 
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         for i in 1..=5 {
@@ -1585,12 +2474,19 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         v.close();
-        crate::storage::erasure_coding::ec_encoder::write_ec_files(dir, dir, "", VolumeId(1), 10, 4)
-            .unwrap();
+        crate::storage::erasure_coding::ec_encoder::write_ec_files(
+            dir,
+            dir,
+            "",
+            VolumeId(1),
+            10,
+            4,
+        )
+        .unwrap();
 
         let vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
         assert!(
@@ -1602,25 +2498,25 @@ mod tests {
         assert_eq!(prot.unwrap().shards.len(), 14);
     }
 
-    /// CHECKSUM scrub verifies clean shards against the sidecar and flags a shard
-    /// whose bytes are corrupted after encode.
+    /// REGRESSION: the scrub plans must be SELF-CONTAINED, so the handler can
+    /// drop the store lock before the scan runs — see `EcChecksumScrubPlan`.
+    ///
+    /// The volume is DROPPED before the plans run, and the plans are moved to
+    /// another thread. A plan that borrowed from `EcVolume` could do neither, so
+    /// this stops COMPILING if the snapshot ever regresses to a borrow.
     #[test]
-    fn test_checksum_scrub_clean_and_detects_corruption() {
+    fn test_scrub_plans_are_self_contained_and_match_direct_call() {
         use crate::storage::needle_map::NeedleMapKind;
-        use crate::storage::volume::Volume;
+        use crate::storage::volume::{Volume, VolumeSpec};
 
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         for i in 1..=8 {
@@ -1632,12 +2528,291 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
         v.close();
-        crate::storage::erasure_coding::ec_encoder::write_ec_files(dir, dir, "", VolumeId(1), 10, 4)
-            .unwrap();
+        crate::storage::erasure_coding::ec_encoder::write_ec_files(
+            dir,
+            dir,
+            "",
+            VolumeId(1),
+            10,
+            4,
+        )
+        .unwrap();
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        for id in 0..14u8 {
+            vol.add_shard(EcVolumeShard::new(dir, "", VolumeId(1), id))
+                .unwrap();
+        }
+
+        // Baseline via the original call shape, with the volume still alive.
+        let direct_checksum = vol.checksum_scrub();
+        let direct_index = vol.scrub_index();
+        let direct_local = vol.scrub_local();
+        assert!(
+            direct_checksum.0 > 0 && direct_local.0 > 0,
+            "fixture scanned nothing, so the equalities below would be vacuous"
+        );
+
+        let checksum_plan = vol.checksum_scrub_plan();
+        let index_plan = vol.scrub_index_plan();
+        let local_plan = vol.scrub_local_plan();
+
+        // The lock (and here the whole volume) is gone before the scan runs.
+        drop(vol);
+
+        let (from_plan_checksum, from_plan_index, from_plan_local) =
+            std::thread::spawn(move || (checksum_plan.run(), index_plan.run(), local_plan.run()))
+                .join()
+                .expect("scrub plans must be runnable off the owning thread");
+
+        assert_eq!(
+            from_plan_checksum, direct_checksum,
+            "checksum scrub result changed when run from a released-lock plan"
+        );
+        assert_eq!(
+            from_plan_index, direct_index,
+            "index scrub result changed when run from a released-lock plan"
+        );
+        assert_eq!(
+            from_plan_local, direct_local,
+            "local scrub result changed when run from a released-lock plan"
+        );
+    }
+
+    /// REGRESSION: a malformed `.ecx` row must not abort the scrub TASK.
+    ///
+    /// `EcLocalScrubPlan::run()` skips only the -1 tombstone, matching Go's
+    /// `ScrubLocal`, so any OTHER negative size reaches the reassembly buffer
+    /// with a negative `get_actual_size()`. Go pays nothing for that (it
+    /// appends to a nil slice); Rust sizes a per-needle `Vec` from it, and
+    /// `Vec::with_capacity(negative as usize)` aborts the process. Now that the
+    /// plan runs under `spawn_blocking`, that abort comes back as a JoinError
+    /// and would take the whole node-wide scrub RPC down with every result
+    /// already collected. The row must be REPORTED, as Go reports it.
+    #[test]
+    fn test_local_scrub_plan_reports_negative_size_ecx_row() {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for i in 1..=8 {
+            let data = format!("test data for needle {} with a bit more length", i);
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.as_bytes().to_vec(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        crate::storage::erasure_coding::ec_encoder::write_ec_files(
+            dir,
+            dir,
+            "",
+            VolumeId(1),
+            10,
+            4,
+        )
+        .unwrap();
+
+        // Rewrite the first .ecx row's size as -1000: a negative that is NOT
+        // the -1 tombstone the walk skips. A scrub is what you point at an
+        // index you already suspect, so an arbitrary i32 in the size field is
+        // in-scope input, whatever wrote it.
+        let ecx = format!(
+            "{}.ecx",
+            crate::storage::volume::volume_file_name(dir, "", VolumeId(1))
+        );
+        let mut raw = std::fs::read(&ecx).unwrap();
+        assert!(
+            raw.len() >= NEEDLE_MAP_ENTRY_SIZE,
+            "fixture must write at least one .ecx row"
+        );
+        let (key, offset, _) = idx_entry_from_bytes(&raw[..NEEDLE_MAP_ENTRY_SIZE]);
+        idx_entry_to_bytes(&mut raw[..NEEDLE_MAP_ENTRY_SIZE], key, offset, Size(-1000));
+        std::fs::write(&ecx, &raw).unwrap();
+        assert!(
+            get_actual_size(Size(-1000), Version::current()) < 0,
+            "precondition: the row must drive get_actual_size negative"
+        );
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        for id in 0..14u8 {
+            vol.add_shard(EcVolumeShard::new(dir, "", VolumeId(1), id))
+                .unwrap();
+        }
+        let plan = vol.scrub_local_plan();
+        drop(vol);
+
+        // The join IS the assertion: a panic here is the JoinError that used to
+        // fail the whole ScrubEcVolume RPC.
+        let (_count, _broken, errs) = std::thread::spawn(move || plan.run())
+            .join()
+            .expect("a malformed .ecx row must not abort the scrub task");
+
+        assert!(
+            errs.iter()
+                .any(|e| e.contains(&format!("bytes for needle {}", key.0))),
+            "the malformed row must be reported, got {:?}",
+            errs
+        );
+    }
+
+    /// REGRESSION: a scrub running with the store lock RELEASED must not turn a
+    /// concurrent, intentional removal into a corruption report — see
+    /// `EcChecksumScrubPlan`.
+    ///
+    /// Deleting every file after the plans are built is the whole test: reads
+    /// that resolve a path diverge from the direct call, reads through the
+    /// captured descriptors are identical.
+    #[test]
+    fn test_scrub_plans_survive_files_removed_after_snapshot() {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for i in 1..=8 {
+            let data = format!("test data for needle {} with a bit more length", i);
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.as_bytes().to_vec(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        crate::storage::erasure_coding::ec_encoder::write_ec_files(
+            dir,
+            dir,
+            "",
+            VolumeId(1),
+            10,
+            4,
+        )
+        .unwrap();
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        for id in 0..14u8 {
+            vol.add_shard(EcVolumeShard::new(dir, "", VolumeId(1), id))
+                .unwrap();
+        }
+
+        // Baseline with every file present and the volume still mounted.
+        let direct_checksum = vol.checksum_scrub();
+        let direct_index = vol.scrub_index();
+        let direct_local = vol.scrub_local();
+        assert!(
+            direct_checksum.0 > 0 && direct_local.0 > 0,
+            "fixture scanned nothing, so the equalities below would be vacuous"
+        );
+        assert!(
+            direct_checksum.2.is_empty() && direct_index.1.is_empty() && direct_local.2.is_empty(),
+            "fixture is not clean, so a false error could not be told apart: {:?} {:?} {:?}",
+            direct_checksum.2,
+            direct_index.1,
+            direct_local.2
+        );
+
+        let checksum_plan = vol.checksum_scrub_plan();
+        let index_plan = vol.scrub_index_plan();
+        let local_plan = vol.scrub_local_plan();
+
+        // The teardown a store writer would perform, after the plans exist.
+        drop(vol);
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        for id in 0..14u8 {
+            std::fs::remove_file(format!("{}.ec{:02}", base, id)).unwrap();
+        }
+        std::fs::remove_file(format!("{}.ecx", base)).unwrap();
+        assert!(
+            !std::path::Path::new(&format!("{}.ec00", base)).exists(),
+            "the removal under test did not happen"
+        );
+
+        assert_eq!(
+            checksum_plan.run(),
+            direct_checksum,
+            "shard files unlinked after the snapshot were reported as corruption"
+        );
+        assert_eq!(
+            index_plan.run(),
+            direct_index,
+            "the .ecx unlinked after the snapshot was reported as an index error"
+        );
+        assert_eq!(
+            local_plan.run(),
+            direct_local,
+            "files unlinked after the snapshot were reported as local-scrub errors"
+        );
+    }
+
+    /// CHECKSUM scrub verifies clean shards against the sidecar and flags a shard
+    /// whose bytes are corrupted after encode.
+    #[test]
+    fn test_checksum_scrub_clean_and_detects_corruption() {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for i in 1..=8 {
+            let data = format!("test data for needle {} with a bit more length", i);
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.as_bytes().to_vec(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        crate::storage::erasure_coding::ec_encoder::write_ec_files(
+            dir,
+            dir,
+            "",
+            VolumeId(1),
+            10,
+            4,
+        )
+        .unwrap();
 
         let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
         for id in 0..14u8 {
@@ -1745,6 +2920,980 @@ mod tests {
         assert_eq!((fc, dc), (2, 2));
     }
 
+    /// A mounted volume merges a peer's journal through its own handle: only
+    /// the missing ids are appended, the file keeps its inode, the in-memory
+    /// set follows, and a later delete lands in the same live file.
+    #[test]
+    fn test_merge_journal_appends_missing_ids_in_place() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let entries: Vec<_> = (1..=5)
+            .map(|id| {
+                (
+                    NeedleId(id),
+                    Offset::from_actual_offset(8 * id as i64),
+                    Size(100),
+                )
+            })
+            .collect();
+        write_ecx_file(dir, "", VolumeId(1), &entries);
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        vol.journal_delete(NeedleId(1)).unwrap();
+        let ecj_path = vol.ecj_file_name();
+        #[cfg(unix)]
+        let inode = {
+            use std::os::unix::fs::MetadataExt;
+            std::fs::metadata(&ecj_path).unwrap().ino()
+        };
+
+        let peer: HashSet<NeedleId> = [1, 2, 3].into_iter().map(NeedleId).collect();
+        assert_eq!(vol.merge_journal(&peer).unwrap(), 2);
+        assert_eq!(
+            vol.merge_journal(&peer).unwrap(),
+            0,
+            "a repeated merge appends nothing"
+        );
+        for id in 1..=3 {
+            assert!(vol.is_needle_deleted(NeedleId(id)), "id {}", id);
+        }
+        assert_eq!(vol.file_and_delete_count().1, 3);
+
+        vol.journal_delete(NeedleId(4)).unwrap();
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::MetadataExt;
+            assert_eq!(
+                std::fs::metadata(&ecj_path).unwrap().ino(),
+                inode,
+                "the journal must never be replaced under the open handle"
+            );
+        }
+        assert_eq!(
+            vol.read_deleted_needles().unwrap(),
+            (1..=4).map(NeedleId).collect::<Vec<_>>()
+        );
+        vol.close();
+
+        let vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        for id in 1..=4 {
+            assert!(
+                vol.is_needle_deleted(NeedleId(id)),
+                "id {} survives remount",
+                id
+            );
+        }
+    }
+
+    /// Write a raw `.ecj` containing `ids` repeated `repeats` times, i.e. the
+    /// shape the append paths produce when a peer's whole journal is
+    /// concatenated onto this one over and over.
+    fn write_bloated_ecj(
+        dir: &str,
+        collection: &str,
+        vid: VolumeId,
+        ids: &[NeedleId],
+        repeats: usize,
+    ) {
+        let base = crate::storage::volume::volume_file_name(dir, collection, vid);
+        let mut one = vec![0u8; ids.len() * NEEDLE_ID_SIZE];
+        for (i, id) in ids.iter().enumerate() {
+            id.to_bytes(&mut one[i * NEEDLE_ID_SIZE..(i + 1) * NEEDLE_ID_SIZE]);
+        }
+        let mut f = File::create(format!("{}.ecj", base)).unwrap();
+        for _ in 0..repeats {
+            f.write_all(&one).unwrap();
+        }
+        f.sync_all().unwrap();
+    }
+    /// A journal whose length is not a whole number of entries must not lose
+    /// the entries that ARE complete, and must not panic.
+    #[test]
+    fn test_ecj_with_trailing_partial_entry() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "", VolumeId(40), &[]);
+
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(40));
+        let ids: Vec<NeedleId> = (1..=3).map(NeedleId).collect();
+        let mut bytes = vec![0u8; ids.len() * NEEDLE_ID_SIZE];
+        for (i, id) in ids.iter().enumerate() {
+            id.to_bytes(&mut bytes[i * NEEDLE_ID_SIZE..(i + 1) * NEEDLE_ID_SIZE]);
+        }
+        bytes.extend_from_slice(&[0xAB, 0xCD, 0xEF]); // torn tail
+        std::fs::write(format!("{}.ecj", base), &bytes).unwrap();
+
+        let vol = EcVolume::new(dir, dir, "", VolumeId(40)).unwrap();
+        assert_eq!(vol.read_deleted_needles().unwrap(), ids);
+    }
+
+    /// A torn tail must be truncated at mount, not merely skipped. The handle
+    /// is in append mode, so leaving the partial bytes in place would push
+    /// every later append out of alignment: the delete taken after the tear
+    /// would decode as garbage on the next mount and be silently lost.
+    #[test]
+    fn test_torn_ecj_tail_is_repaired_so_later_deletes_survive() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        // journal_delete only appends on a live->tombstone transition.
+        write_ecx_file(
+            dir,
+            "",
+            VolumeId(42),
+            &[(NeedleId(7), Offset::from_actual_offset(8), Size(10))],
+        );
+
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(42));
+        let ecj_path = format!("{}.ecj", base);
+        let ids: Vec<NeedleId> = (1..=3).map(NeedleId).collect();
+        let mut bytes = vec![0u8; ids.len() * NEEDLE_ID_SIZE];
+        for (i, id) in ids.iter().enumerate() {
+            id.to_bytes(&mut bytes[i * NEEDLE_ID_SIZE..(i + 1) * NEEDLE_ID_SIZE]);
+        }
+        bytes.extend_from_slice(&[0xAB, 0xCD, 0xEF]); // torn tail
+        std::fs::write(&ecj_path, &bytes).unwrap();
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(42)).unwrap();
+
+        // The tear is gone from disk, not just ignored in memory.
+        assert_eq!(
+            std::fs::metadata(&ecj_path).unwrap().len(),
+            (ids.len() * NEEDLE_ID_SIZE) as u64,
+            "torn tail should have been truncated at mount",
+        );
+
+        vol.journal_delete(NeedleId(7)).unwrap();
+        drop(vol);
+
+        // The delete taken after the repair must survive a remount.
+        let vol2 = EcVolume::new(dir, dir, "", VolumeId(42)).unwrap();
+        let deleted = vol2.read_deleted_needles().unwrap();
+        assert!(
+            deleted.contains(&NeedleId(7)),
+            "delete after a torn tail was lost: {:?}",
+            deleted,
+        );
+        assert_eq!(
+            deleted.len(),
+            ids.len() + 1,
+            "misaligned decode: {:?}",
+            deleted
+        );
+    }
+
+    /// A journal spanning several read chunks must load every entry — guards
+    /// the chunk-boundary arithmetic in the buffered loader.
+    #[test]
+    fn test_ecj_spanning_multiple_read_chunks() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "", VolumeId(41), &[]);
+
+        // 2.5 chunks' worth of DISTINCT ids, so nothing is masked by dedup and
+        // the total is not a chunk multiple.
+        let n = (ECJ_LOAD_CHUNK_BYTES / NEEDLE_ID_SIZE) * 5 / 2;
+        let ids: Vec<NeedleId> = (1..=n as u64).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", VolumeId(41), &ids, 1);
+
+        let vol = EcVolume::new(dir, dir, "", VolumeId(41)).unwrap();
+        let deleted = vol.read_deleted_needles().unwrap();
+        assert_eq!(deleted.len(), n, "entries lost across a chunk boundary");
+        assert_eq!(deleted, ids);
+    }
+
+    /// A journal of 1M records over 100 distinct ids must mount to those 100
+    /// ids and be folded down to 100x8 bytes. The production failure: 1.51 TB
+    /// of ~100 distinct ids wedging startup.
+    #[test]
+    fn test_bloated_ecj_is_compacted_on_load() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "", VolumeId(37), &[]);
+
+        // 100 unique ids x 10000 repeats x 8 B = 8 MiB on disk for 800 B of
+        // actual information — over both compaction thresholds.
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", VolumeId(37), &ids, 10_000);
+
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(dir, "", VolumeId(37))
+        );
+        let before = std::fs::metadata(&ecj_path).unwrap().len();
+        assert_eq!(before, 100 * 10_000 * NEEDLE_ID_SIZE as u64);
+
+        let vol = EcVolume::new(dir, dir, "", VolumeId(37)).unwrap();
+
+        let deleted = vol.read_deleted_needles().unwrap();
+        assert_eq!(deleted, ids, "compaction must preserve the deleted set");
+
+        let after = std::fs::metadata(&ecj_path).unwrap().len();
+        assert_eq!(
+            after,
+            ids.len() as u64 * NEEDLE_ID_SIZE as u64,
+            "journal should have been folded down to one entry per id",
+        );
+        assert!(after < before);
+        assert!(!std::path::Path::new(&format!("{}.compact.tmp", ecj_path)).exists());
+
+        drop(vol);
+        let vol2 = EcVolume::new(dir, dir, "", VolumeId(37)).unwrap();
+        assert_eq!(vol2.read_deleted_needles().unwrap(), ids);
+        assert_eq!(std::fs::metadata(&ecj_path).unwrap().len(), after);
+    }
+
+    /// Appends must still land in the file after a compaction reopened the
+    /// handle — otherwise deletes taken after mount would be lost on restart.
+    #[test]
+    fn test_journal_delete_after_compaction_persists() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(
+            dir,
+            "",
+            VolumeId(38),
+            &[(NeedleId(7), Offset::from_actual_offset(8), Size(10))],
+        );
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", VolumeId(38), &ids, 4096);
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(38)).unwrap();
+        vol.journal_delete(NeedleId(7)).unwrap();
+        drop(vol);
+
+        let vol2 = EcVolume::new(dir, dir, "", VolumeId(38)).unwrap();
+        let deleted = vol2.read_deleted_needles().unwrap();
+        assert!(
+            deleted.contains(&NeedleId(7)),
+            "post-compaction append was lost across remount: {:?}",
+            &deleted[..deleted.len().min(5)],
+        );
+        assert_eq!(deleted.len(), ids.len() + 1);
+    }
+
+    /// A healthy journal must be left byte-for-byte alone — compaction is for
+    /// pathology, not routine churn on every mount.
+    #[test]
+    fn test_healthy_ecj_is_not_rewritten() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "", VolumeId(39), &[]);
+
+        // Duplicated 3x, but only 2.4 KB — under ECJ_COMPACT_MIN_BYTES.
+        let ids: Vec<NeedleId> = (1..=100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", VolumeId(39), &ids, 3);
+
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(dir, "", VolumeId(39))
+        );
+        let before_meta = std::fs::metadata(&ecj_path).unwrap();
+        let before_bytes = std::fs::read(&ecj_path).unwrap();
+        // Use mtime+inode proxy: metadata len + content equality. A rewrite
+        // would change mtime; content equality proves no-op.
+        let before_mtime = before_meta.modified().unwrap();
+
+        let vol = EcVolume::new(dir, dir, "", VolumeId(39)).unwrap();
+
+        let (_, delete_count) = vol.file_and_delete_count();
+        assert_eq!(delete_count, ids.len() as u64);
+        assert_eq!(vol.read_deleted_needles().unwrap().len(), ids.len() * 3);
+
+        let after_bytes = std::fs::read(&ecj_path).unwrap();
+        assert_eq!(
+            before_bytes, after_bytes,
+            "small journal must not be rewritten"
+        );
+        let after_mtime = std::fs::metadata(&ecj_path).unwrap().modified().unwrap();
+        assert_eq!(
+            before_mtime, after_mtime,
+            "small journal mtime must be unchanged"
+        );
+    }
+
+    /// A torn tail plus an oversized journal must be repaired and compacted,
+    /// with no id lost or invented.
+    #[test]
+    fn test_torn_tail_plus_bloated_journal_is_repaired_and_compacted() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "", VolumeId(45), &[]);
+
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", VolumeId(45), &ids, 4096);
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(dir, "", VolumeId(45))
+        );
+        // Append a torn tail.
+        {
+            use std::io::Write as _;
+            let mut f = std::fs::OpenOptions::new()
+                .append(true)
+                .open(&ecj_path)
+                .unwrap();
+            f.write_all(&[0xAB, 0xCD, 0xEF]).unwrap();
+            f.sync_all().unwrap();
+        }
+
+        let vol = EcVolume::new(dir, dir, "", VolumeId(45)).unwrap();
+        assert_eq!(vol.read_deleted_needles().unwrap(), ids);
+        assert_eq!(
+            std::fs::metadata(&ecj_path).unwrap().len(),
+            ids.len() as u64 * NEEDLE_ID_SIZE as u64,
+            "torn tail should be truncated and journal compacted",
+        );
+    }
+
+    /// A journal reached through a shared index directory is compacted when
+    /// this volume is its only holder: the guard is who holds the path, not
+    /// which directory it lives in.
+    #[test]
+    fn test_shared_index_dir_journal_with_one_holder_is_compacted() {
+        let tmp = TempDir::new().unwrap();
+        let data_dir = tmp.path().join("data");
+        let idx_dir = tmp.path().join("idx");
+        std::fs::create_dir_all(&data_dir).unwrap();
+        std::fs::create_dir_all(&idx_dir).unwrap();
+        let (data, idx) = (data_dir.to_str().unwrap(), idx_dir.to_str().unwrap());
+
+        write_ecx_file(idx, "", VolumeId(44), &[]);
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(idx, "", VolumeId(44), &ids, 4096);
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(idx, "", VolumeId(44))
+        );
+
+        let vol = EcVolume::new(data, idx, "", VolumeId(44)).unwrap();
+        assert_eq!(vol.file_and_delete_count().1, ids.len() as u64);
+        assert_eq!(
+            std::fs::metadata(&ecj_path).unwrap().len(),
+            (ids.len() * NEEDLE_ID_SIZE) as u64,
+        );
+        drop(vol);
+
+        let vol2 = EcVolume::new(data, idx, "", VolumeId(44)).unwrap();
+        assert_eq!(vol2.read_deleted_needles().unwrap(), ids);
+    }
+
+    /// A shard mount can give disk B a volume whose `.ecj` is disk A's. When
+    /// A's own volume mounts later, it must not replace the file under B:
+    /// B's deletes would go to an unlinked inode and vanish at the next mount.
+    #[test]
+    fn test_sibling_holder_blocks_compaction() {
+        let tmp = TempDir::new().unwrap();
+        let a_dir = tmp.path().join("a");
+        let b_dir = tmp.path().join("b");
+        std::fs::create_dir_all(&a_dir).unwrap();
+        std::fs::create_dir_all(&b_dir).unwrap();
+        let (a, b) = (a_dir.to_str().unwrap(), b_dir.to_str().unwrap());
+        let vid = VolumeId(48);
+
+        write_ecx_file(
+            a,
+            "",
+            vid,
+            &[(NeedleId(7), Offset::from_actual_offset(8), Size(10))],
+        );
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(a, "", vid, &ids, 1);
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(a, "", vid)
+        );
+
+        // B has no index of its own, so it resolves A's and holds A's journal.
+        let mut on_b = EcVolume::new(b, a, "", vid).unwrap();
+        assert_eq!(on_b.ecj_file_name(), ecj_path);
+
+        // The journal bloats (say, a copy appended to it) and A mounts.
+        write_bloated_ecj(a, "", vid, &ids, 4096);
+        let bloated = std::fs::metadata(&ecj_path).unwrap().len();
+        let on_a = EcVolume::new(a, a, "", vid).unwrap();
+        assert_eq!(
+            std::fs::metadata(&ecj_path).unwrap().len(),
+            bloated,
+            "compaction must not replace a journal another volume holds open",
+        );
+
+        // B's delete must land in the file at the journal's path.
+        on_b.journal_delete(NeedleId(7)).unwrap();
+        assert_eq!(std::fs::metadata(&ecj_path).unwrap().len(), bloated + 8);
+        drop(on_b);
+        drop(on_a);
+
+        // Sole holder now: the next mount compacts and keeps B's delete.
+        let vol = EcVolume::new(a, a, "", vid).unwrap();
+        let deleted = vol.read_deleted_needles().unwrap();
+        assert_eq!(deleted.len(), ids.len() + 1);
+        assert!(deleted.contains(&NeedleId(7)));
+    }
+
+    /// A copy appending to the journal by path must not have its bytes
+    /// dropped by a compaction renaming over the file.
+    #[test]
+    fn test_active_copy_blocks_compaction() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let vid = VolumeId(49);
+        write_ecx_file(dir, "", vid, &[]);
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", vid, &ids, 4096);
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(dir, "", vid)
+        );
+        let bloated = std::fs::metadata(&ecj_path).unwrap().len();
+
+        let copy = crate::storage::erasure_coding::ecj_registry::begin_ecj_write(&ecj_path);
+        let vol = EcVolume::new(dir, dir, "", vid).unwrap();
+        assert_eq!(std::fs::metadata(&ecj_path).unwrap().len(), bloated);
+        drop(vol);
+        drop(copy);
+
+        let vol = EcVolume::new(dir, dir, "", vid).unwrap();
+        assert_eq!(
+            std::fs::metadata(&ecj_path).unwrap().len(),
+            (ids.len() * NEEDLE_ID_SIZE) as u64,
+        );
+        assert_eq!(vol.read_deleted_needles().unwrap(), ids);
+    }
+
+    /// A journal that grew, or was replaced, after it was loaded must not be
+    /// compacted from the stale set.
+    #[test]
+    fn test_journal_changed_after_load_is_detected() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let vid = VolumeId(50);
+        write_ecx_file(dir, "", vid, &[]);
+        write_bloated_ecj(dir, "", vid, &[NeedleId(1)], 1);
+
+        let vol = EcVolume::new(dir, dir, "", vid).unwrap();
+        let ecj_path = vol.ecj_file_name();
+        assert!(vol.ecj_unchanged_since_load(&ecj_path).unwrap());
+
+        {
+            let mut f = OpenOptions::new().append(true).open(&ecj_path).unwrap();
+            f.write_all(&[0u8; NEEDLE_ID_SIZE]).unwrap();
+        }
+        assert!(!vol.ecj_unchanged_since_load(&ecj_path).unwrap());
+
+        // Same size, different inode: a copy that replaced the file.
+        let replacement = format!("{}.replacement", ecj_path);
+        std::fs::write(&replacement, [0u8; NEEDLE_ID_SIZE]).unwrap();
+        std::fs::rename(&replacement, &ecj_path).unwrap();
+        #[cfg(unix)]
+        assert!(!vol.ecj_unchanged_since_load(&ecj_path).unwrap());
+    }
+
+    /// A compaction tmp left by a crash between its write and the rename is
+    /// removed at the next mount, even when the journal needs no compaction.
+    #[test]
+    fn test_stale_compaction_tmp_is_removed_at_mount() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let vid = VolumeId(51);
+        write_ecx_file(dir, "", vid, &[]);
+        write_bloated_ecj(dir, "", vid, &[NeedleId(1)], 1);
+        let tmp_path = format!(
+            "{}{}",
+            crate::storage::volume::volume_file_name(dir, "", vid),
+            ECJ_COMPACT_TMP_EXT
+        );
+        std::fs::write(&tmp_path, [0u8; 64]).unwrap();
+
+        let mut vol = EcVolume::new(dir, dir, "", vid).unwrap();
+        assert!(!std::path::Path::new(&tmp_path).exists());
+
+        // destroy() sweeps it too.
+        std::fs::write(&tmp_path, [0u8; 64]).unwrap();
+        vol.destroy();
+        assert!(!std::path::Path::new(&tmp_path).exists());
+    }
+
+    /// A mount the bitrot sidecar refuses must leave the journal as it was:
+    /// compaction runs only after every check that can fail the mount.
+    #[test]
+    fn test_refused_mount_does_not_compact() {
+        use crate::pb::volume_server_pb::{ChecksumAlgorithm, EcBitrotProtection};
+        use crate::storage::erasure_coding::ec_bitrot;
+        use crate::storage::volume::{VifEcShardConfig, VifVolumeInfo};
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let vid = VolumeId(52);
+        let base = crate::storage::volume::volume_file_name(dir, "", vid);
+        write_ecx_file(dir, "", vid, &[]);
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", vid, &ids, 4096);
+        std::fs::write(
+            format!("{}.vif", base),
+            serde_json::to_string(&VifVolumeInfo {
+                version: 3,
+                ec_shard_config: Some(VifEcShardConfig {
+                    data_shards: 10,
+                    parity_shards: 4,
+                    ..Default::default()
+                }),
+                ..Default::default()
+            })
+            .unwrap(),
+        )
+        .unwrap();
+        // A generation-0 sidecar recording a different layout: mount refused.
+        ec_bitrot::save_bitrot_sidecar(
+            &ec_bitrot::bitrot_sidecar_path(&base, 0),
+            &EcBitrotProtection {
+                algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+                block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+                generation: 0,
+                ec_shard_config: Some(ec_bitrot::ec_shard_config(12, 4, 0)),
+                shards: Vec::new(),
+                encode_uuid: vec![0u8; 16],
+            },
+        )
+        .unwrap();
+        let ecj_path = format!("{}.ecj", base);
+        let before = std::fs::read(&ecj_path).unwrap();
+
+        let err = EcVolume::new(dir, dir, "", vid)
+            .err()
+            .expect("a geometry-mismatched sidecar must refuse the mount");
+        assert!(err.to_string().contains("refusing to serve"), "{}", err);
+        assert_eq!(std::fs::read(&ecj_path).unwrap(), before);
+    }
+
+    /// Compaction must never leave a handle that does not refer to the
+    /// journal's pathname, and must not leave its temp file behind.
+    #[test]
+    fn test_compaction_leaves_a_usable_handle_and_no_temp_file() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(
+            dir,
+            "",
+            VolumeId(43),
+            &[(NeedleId(7), Offset::from_actual_offset(8), Size(10))],
+        );
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", VolumeId(43), &ids, 4096);
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(43)).unwrap();
+        assert!(vol.ecj_file.is_some(), "mount must leave a journal handle");
+
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(dir, "", VolumeId(43))
+        );
+        assert!(!std::path::Path::new(&format!("{}.compact.tmp", ecj_path)).exists());
+
+        vol.journal_delete(NeedleId(7)).unwrap();
+        let on_disk = std::fs::metadata(&ecj_path).unwrap().len();
+        assert_eq!(
+            on_disk,
+            ((ids.len() + 1) * NEEDLE_ID_SIZE) as u64,
+            "post-compaction append did not reach the journal's pathname",
+        );
+    }
+
+    /// Mount a volume `vid` over a bloated journal with the given compaction
+    /// filesystem steps. Returns the mount result, the journal path, and the
+    /// journal's bytes before the mount.
+    fn mount_bloated_with(
+        dir: &str,
+        vid: VolumeId,
+        ops: EcjFsOps,
+    ) -> (io::Result<EcVolume>, String, Vec<u8>) {
+        write_ecx_file(
+            dir,
+            "",
+            vid,
+            &[(NeedleId(7), Offset::from_actual_offset(8), Size(10))],
+        );
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", vid, &ids, 4096);
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(dir, "", vid)
+        );
+        let before = std::fs::read(&ecj_path).unwrap();
+        (
+            EcVolume::open_with(dir, dir, "", vid, ops),
+            ecj_path,
+            before,
+        )
+    }
+
+    fn failing_rename(_: &str, _: &str) -> io::Result<()> {
+        Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            "injected rename failure",
+        ))
+    }
+
+    fn failing_reopen(_: &str) -> io::Result<File> {
+        Err(io::Error::new(
+            io::ErrorKind::NotFound,
+            "injected reopen failure",
+        ))
+    }
+
+    /// A failed rename publishes nothing: the mount succeeds on the original
+    /// journal, byte for byte, with no tmp left, and deletes still reach the
+    /// file at the journal's path.
+    #[test]
+    fn test_compaction_rename_failure_keeps_original_journal() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ops = EcjFsOps {
+            rename: failing_rename,
+            ..EcjFsOps::REAL
+        };
+        let (vol, ecj_path, before) = mount_bloated_with(dir, VolumeId(46), ops);
+        let mut vol = vol.expect("a failed rename must not fail the mount");
+
+        assert_eq!(std::fs::read(&ecj_path).unwrap(), before);
+        assert!(!std::path::Path::new(&format!("{}.compact.tmp", ecj_path)).exists());
+        assert_eq!(vol.file_and_delete_count().1, 100);
+
+        vol.journal_delete(NeedleId(7)).unwrap();
+        assert_eq!(
+            std::fs::metadata(&ecj_path).unwrap().len(),
+            before.len() as u64 + NEEDLE_ID_SIZE as u64,
+            "the restored handle must append to the original journal",
+        );
+    }
+
+    /// A failed rename whose handle restore also fails leaves no usable
+    /// handle: the mount fails, reports both errors, and says nothing was
+    /// compacted. The original journal is untouched.
+    #[test]
+    fn test_compaction_rename_and_restore_failure_is_mount_error() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ops = EcjFsOps {
+            rename: failing_rename,
+            reopen: failing_reopen,
+            ..EcjFsOps::REAL
+        };
+        let (vol, ecj_path, before) = mount_bloated_with(dir, VolumeId(53), ops);
+        let msg = vol
+            .err()
+            .expect("mount must fail without a handle")
+            .to_string();
+
+        assert!(msg.contains("no usable journal handle"), "{}", msg);
+        assert!(msg.contains("injected rename failure"), "{}", msg);
+        assert!(msg.contains("injected reopen failure"), "{}", msg);
+        assert!(msg.contains("reopening the original journal"), "{}", msg);
+        assert_eq!(std::fs::read(&ecj_path).unwrap(), before);
+        assert!(!std::path::Path::new(&format!("{}.compact.tmp", ecj_path)).exists());
+    }
+
+    /// A reopen failure after the rename fails the mount: the journal was
+    /// replaced and the volume has no handle to it.
+    #[test]
+    fn test_compaction_post_rename_reopen_failure_is_mount_error() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ops = EcjFsOps {
+            reopen: failing_reopen,
+            ..EcjFsOps::REAL
+        };
+        let (vol, ecj_path, _) = mount_bloated_with(dir, VolumeId(47), ops);
+        let msg = vol
+            .err()
+            .expect("mount must fail without a handle")
+            .to_string();
+
+        assert!(msg.contains("no usable journal handle"), "{}", msg);
+        assert!(msg.contains("could not reopen it"), "{}", msg);
+        assert!(msg.contains("injected reopen failure"), "{}", msg);
+        assert_eq!(
+            std::fs::metadata(&ecj_path).unwrap().len(),
+            100 * NEEDLE_ID_SIZE as u64,
+            "the rename had published the compacted journal",
+        );
+    }
+
+    /// A directory fsync failure after the rename fails the mount too: the
+    /// replacement may not survive a power loss.
+    #[test]
+    fn test_compaction_post_rename_fsync_failure_is_mount_error() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ops = EcjFsOps {
+            fsync_dir: |_| Err(io::Error::other("injected fsync failure")),
+            ..EcjFsOps::REAL
+        };
+        let (vol, _, _) = mount_bloated_with(dir, VolumeId(54), ops);
+        let msg = vol.err().expect("mount must fail").to_string();
+        assert!(msg.contains("could not fsync its directory"), "{}", msg);
+        assert!(msg.contains("injected fsync failure"), "{}", msg);
+    }
+
+    /// The directory sync after the rename must report a directory it cannot
+    /// open. The crate's best-effort `fsync_dir` returns Ok there, which would
+    /// let the mount take deletes against an entry that was never synced.
+    #[test]
+    fn test_fsync_ecj_dir_fails_when_directory_cannot_be_opened() {
+        let tmp = TempDir::new().unwrap();
+        let missing = tmp.path().join("gone").join("1.ecj");
+        let missing = missing.to_str().unwrap();
+        #[cfg(not(windows))]
+        assert!(fsync_ecj_dir(missing).is_err());
+        assert!(crate::storage::volume::fsync_dir(missing).is_ok());
+    }
+
+    /// The real mount over a directory it may write and search but not read:
+    /// the rename succeeds and the directory sync cannot open the directory,
+    /// so the mount fails rather than serving an unsynced replacement.
+    #[cfg(unix)]
+    #[test]
+    fn test_compaction_unreadable_directory_is_mount_error() {
+        use std::os::unix::fs::PermissionsExt;
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let set_mode =
+            |mode| std::fs::set_permissions(dir, std::fs::Permissions::from_mode(mode)).unwrap();
+        write_ecx_file(
+            dir,
+            "",
+            VolumeId(55),
+            &[(NeedleId(7), Offset::from_actual_offset(8), Size(10))],
+        );
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", VolumeId(55), &ids, 4096);
+
+        set_mode(0o300);
+        if File::open(dir).is_ok() {
+            // Root opens it regardless; nothing to test.
+            set_mode(0o755);
+            return;
+        }
+        let result = EcVolume::new(dir, dir, "", VolumeId(55));
+        set_mode(0o755);
+        let msg = result
+            .err()
+            .expect("an unsynced replacement must fail the mount")
+            .to_string();
+        assert!(msg.contains("could not fsync its directory"), "{}", msg);
+    }
+
+    thread_local! {
+        /// The journal path and replacement bytes `rewrite_after_last_read`
+        /// writes; taken when it does.
+        static IN_PLACE_REWRITE: std::cell::RefCell<Option<(String, Vec<u8>)>> =
+            const { std::cell::RefCell::new(None) };
+    }
+
+    /// A load step that, once the last chunk is read, truncates and refills
+    /// the journal in place as a registered writer, start to finish, the way a
+    /// `ReceiveFile` would.
+    fn rewrite_after_last_read(f: &File, buf: &mut [u8], off: u64) -> io::Result<()> {
+        read_exact_at(f, buf, off)?;
+        let pending = IN_PLACE_REWRITE.with(|r| {
+            let mut r = r.borrow_mut();
+            match r.as_ref() {
+                Some((_, bytes)) if off + buf.len() as u64 >= bytes.len() as u64 => r.take(),
+                _ => None,
+            }
+        });
+        if let Some((path, bytes)) = pending {
+            let _write = crate::storage::erasure_coding::ecj_registry::begin_ecj_write(&path);
+            let mut out = OpenOptions::new().write(true).truncate(true).open(&path)?;
+            out.write_all(&bytes)?;
+        }
+        Ok(())
+    }
+
+    /// A `ReceiveFile` that runs during the mount's load and finishes before
+    /// compaction can leave the same inode at the same length with different
+    /// ids, which the inode-and-size re-check accepts. Compacting would then
+    /// overwrite the received ids with the stale set.
+    #[test]
+    fn test_in_place_rewrite_during_load_blocks_compaction() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let vid = VolumeId(56);
+        write_ecx_file(
+            dir,
+            "",
+            vid,
+            &[(NeedleId(7), Offset::from_actual_offset(8), Size(10))],
+        );
+        let ids: Vec<NeedleId> = (1000..1100).map(NeedleId).collect();
+        write_bloated_ecj(dir, "", vid, &ids, 4096);
+        let ecj_path = format!(
+            "{}.ecj",
+            crate::storage::volume::volume_file_name(dir, "", vid)
+        );
+        let mut one = vec![0u8; 100 * NEEDLE_ID_SIZE];
+        for (i, entry) in one.chunks_exact_mut(NEEDLE_ID_SIZE).enumerate() {
+            NeedleId(2000 + i as u64).to_bytes(entry);
+        }
+        let rewrite = one.repeat(4096);
+        IN_PLACE_REWRITE.with(|r| *r.borrow_mut() = Some((ecj_path.clone(), rewrite.clone())));
+
+        let ops = EcjFsOps {
+            read_at: rewrite_after_last_read,
+            ..EcjFsOps::REAL
+        };
+        let vol = EcVolume::open_with(dir, dir, "", vid, ops).unwrap();
+        assert!(
+            IN_PLACE_REWRITE.with(|r| r.borrow().is_none()),
+            "the rewrite never ran"
+        );
+        assert!(
+            std::fs::read(&ecj_path).unwrap() == rewrite,
+            "the received journal must not be compacted from the set loaded before it",
+        );
+        drop(vol);
+    }
+
+    #[test]
+    fn test_journal_delete_wrong_cookie() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let needle = NeedleId(7);
+        let entries = vec![(needle, Offset::from_actual_offset(8), Size(100))];
+        write_ecx_file(dir, "", VolumeId(1), &entries);
+
+        let vif = crate::storage::volume::VifVolumeInfo {
+            dat_file_size: 14000,
+            ..Default::default()
+        };
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        std::fs::write(
+            format!("{}.vif", base),
+            serde_json::to_string_pretty(&vif).unwrap(),
+        )
+        .unwrap();
+
+        let mut shard9 = EcVolumeShard::new(dir, "", VolumeId(1), 9);
+        shard9.create().unwrap();
+        shard9.write_all(&[0xAAu8; 2048]).unwrap();
+        shard9.close();
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        vol.add_shard(EcVolumeShard::new(dir, "", VolumeId(1), 9))
+            .unwrap();
+
+        let (off, size) = vol
+            .find_needle_from_ecx(needle)
+            .unwrap()
+            .expect("fixture needle must be indexed");
+        let intervals = vol.locate_ec_shard_needle_interval(off.to_actual_offset(), size);
+        assert!(
+            !intervals.is_empty(),
+            "fixture must locate to a shard for the test to be meaningful"
+        );
+        let (located, _) = vol.interval_to_shard_id_and_offset(&intervals[0]);
+        assert_ne!(
+            located, 9,
+            "fixture must locate away from mounted shard 9, got {}",
+            located
+        );
+
+        let res = vol.journal_delete_with_cookie(needle, Cookie(0xDEAD_BEEF));
+        let err = res.expect_err("wrong cookie must Err, not bypass to journal");
+        assert!(
+            err.to_string().contains("cannot verify cookie"),
+            "fail-closed error must say why, got: {}",
+            err
+        );
+        let deleted = vol.read_deleted_needles().unwrap();
+        assert!(
+            !deleted.contains(&needle),
+            "failed delete must not append to .ecj, got {:?}",
+            deleted
+        );
+
+        vol.journal_delete_with_cookie(needle, Cookie(0)).unwrap();
+        let deleted = vol.read_deleted_needles().unwrap();
+        assert!(
+            deleted.contains(&needle),
+            "cookie-0 delete must still journal, got {:?}",
+            deleted
+        );
+    }
+
+    #[test]
+    fn test_journal_delete_incomplete_header() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let needle = NeedleId(7);
+        let entries = vec![(needle, Offset::from_actual_offset(8), Size(100))];
+        write_ecx_file(dir, "", VolumeId(1), &entries);
+
+        let vif = crate::storage::volume::VifVolumeInfo {
+            dat_file_size: 14000,
+            ..Default::default()
+        };
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        std::fs::write(
+            format!("{}.vif", base),
+            serde_json::to_string_pretty(&vif).unwrap(),
+        )
+        .unwrap();
+
+        let probe = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        let (off, size) = probe
+            .find_needle_from_ecx(needle)
+            .unwrap()
+            .expect("fixture needle must be indexed");
+        let intervals = probe.locate_ec_shard_needle_interval(off.to_actual_offset(), size);
+        assert!(
+            !intervals.is_empty(),
+            "fixture must locate to a shard for the test to be meaningful"
+        );
+        let (located, located_offset) = probe.interval_to_shard_id_and_offset(&intervals[0]);
+        drop(probe);
+
+        let mut shard = EcVolumeShard::new(dir, "", VolumeId(1), located);
+        shard.create().unwrap();
+        shard.write_all(&[0x00u8; 2]).unwrap();
+        shard.close();
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        vol.add_shard(EcVolumeShard::new(dir, "", VolumeId(1), located))
+            .unwrap();
+
+        let shard_ref = vol.shards[located as usize]
+            .as_ref()
+            .expect("located shard must be mounted");
+        assert!(
+            (shard_ref.file_size()) < located_offset + 4,
+            "fixture must truncate the header read (file {} bytes, offset {})",
+            shard_ref.file_size(),
+            located_offset
+        );
+
+        let res = vol.journal_delete_with_cookie(needle, Cookie(0x1234));
+        let err = res.expect_err("short header read must Err, not forge-match");
+        assert!(
+            err.to_string().contains("incomplete header"),
+            "short read must report incomplete header, got: {}",
+            err
+        );
+        let deleted = vol.read_deleted_needles().unwrap();
+        assert!(
+            !deleted.contains(&needle),
+            "failed delete must not append to .ecj, got {:?}",
+            deleted
+        );
+
+        vol.journal_delete_with_cookie(needle, Cookie(0)).unwrap();
+        let deleted = vol.read_deleted_needles().unwrap();
+        assert!(
+            deleted.contains(&needle),
+            "cookie-0 delete must still journal, got {:?}",
+            deleted
+        );
+    }
+
     #[test]
     fn test_ec_volume_shard_bits() {
         let tmp = TempDir::new().unwrap();
@@ -1766,6 +3915,62 @@ mod tests {
         assert!(vol.shard_bits().has_shard_id(3));
     }
 
+    /// A 0-byte shard file beside an index WITH entries is residue of a
+    /// failed copy: `add_shard` must refuse it and leave the slot
+    /// unregistered, so no size-0 claim is advertised (and no re-copy is
+    /// attracted to a file that was never valid). Beside a 0-byte index it
+    /// is the legitimate empty-volume layout and must keep mounting. The
+    /// startup scan already skips such files; this covers the mount path.
+    /// Mirrors TestLoadEcShardRefusesEmptyShardFile in Go.
+    #[test]
+    fn test_add_shard_refuses_empty_shard_file() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(
+            dir,
+            "",
+            VolumeId(1),
+            &[(NeedleId(1), Offset::from_actual_offset(8), Size(100))],
+        );
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+
+        let mut shard = EcVolumeShard::new(dir, "", VolumeId(1), 4);
+        shard.create().unwrap();
+        shard.close();
+
+        let err = vol
+            .add_shard(EcVolumeShard::new(dir, "", VolumeId(1), 4))
+            .expect_err("adding a 0-byte shard file must fail when the index has entries");
+        assert!(
+            err.to_string().contains("empty (0 bytes)"),
+            "a 0-byte shard should be refused as empty, got: {}",
+            err
+        );
+        assert_eq!(vol.shard_count(), 0, "a refused shard must not register");
+        assert!(!vol.shard_bits().has_shard_id(4));
+    }
+
+    /// The legitimate empty-volume layout: a volume encoded with no live
+    /// needles has a 0-byte .ecx AND 0-byte shards, and mounting it must
+    /// keep working.
+    #[test]
+    fn test_add_shard_accepts_empty_shard_of_empty_volume() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "", VolumeId(1), &[]);
+
+        let mut vol = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+
+        let mut shard = EcVolumeShard::new(dir, "", VolumeId(1), 4);
+        shard.create().unwrap();
+        shard.close();
+
+        vol.add_shard(EcVolumeShard::new(dir, "", VolumeId(1), 4))
+            .expect("a 0-byte shard of an empty volume (0-byte index) must mount");
+        assert!(vol.shard_bits().has_shard_id(4));
+    }
+
     #[test]
     fn test_ec_volume_uses_collection_prefixed_vif_config() {
         let tmp = TempDir::new().unwrap();
@@ -1792,8 +3997,14 @@ mod tests {
         assert_eq!(vol.parity_shards, 3);
     }
 
+    /// A vif that RECORDS a ratio no volume could have must fail the mount.
+    /// Substituting the default 10+4 (and with it the legacy block layout)
+    /// would read a uniform volume's shards at the wrong offsets and answer
+    /// with the wrong bytes; only an entirely absent config means "this
+    /// predates the record", which
+    /// `test_ec_volume_absent_vif_config_uses_defaults` covers.
     #[test]
-    fn test_ec_volume_invalid_vif_config_falls_back_to_defaults() {
+    fn test_ec_volume_invalid_vif_config_fails_the_mount() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
         write_ecx_file(dir, "pics", VolumeId(1), &[]);
@@ -1814,9 +4025,27 @@ mod tests {
         )
         .unwrap();
 
+        // EcVolume has no Debug impl, so match rather than expect_err.
+        match EcVolume::new(dir, dir, "pics", VolumeId(1)) {
+            Ok(_) => panic!("an impossible ratio must fail the mount"),
+            Err(e) => assert_eq!(e.kind(), io::ErrorKind::InvalidData, "got {e}"),
+        }
+    }
+
+    /// The compatibility case the check above must not swallow: a vif with no
+    /// EC config at all predates the record, and mounts on the defaults.
+    #[test]
+    fn test_ec_volume_absent_vif_config_uses_defaults() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_ecx_file(dir, "pics", VolumeId(1), &[]);
+        let base = crate::storage::volume::volume_file_name(dir, "pics", VolumeId(1));
+        std::fs::write(format!("{}.vif", base), r#"{"version":3}"#).unwrap();
+
         let vol = EcVolume::new(dir, dir, "pics", VolumeId(1)).unwrap();
         assert_eq!(vol.data_shards, DATA_SHARDS_COUNT as u32);
         assert_eq!(vol.parity_shards, PARITY_SHARDS_COUNT as u32);
+        assert_eq!(vol.block_size, 0, "legacy layout for a pre-record volume");
     }
 
     #[test]
@@ -1964,4 +4193,1889 @@ mod tests {
             "a non-zero size mismatch is genuine corruption and must be reported"
         );
     }
+
+    /// Build one real encoded EC volume in `dir`, then hand back N runtimes over
+    /// it, each holding the shard ids it was given. Models the reconciled
+    /// split-disk mount without needing N directories.
+    fn split_runtimes(dir: &str, vid: VolumeId, subsets: &[&[u8]]) -> Vec<EcVolume> {
+        use crate::storage::needle_map::NeedleMapKind;
+        use crate::storage::volume::{Volume, VolumeSpec};
+
+        let v = Volume::new(
+            dir,
+            dir,
+            vid,
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for i in 1..=8 {
+            let data = format!("test data for needle {} with a bit more length", i);
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.as_bytes().to_vec(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        v.close();
+        crate::storage::erasure_coding::ec_encoder::write_ec_files(dir, dir, "", vid, 10, 4)
+            .unwrap();
+
+        subsets
+            .iter()
+            .map(|ids| {
+                let mut ev = EcVolume::new(dir, dir, "", vid).unwrap();
+                for &id in ids.iter() {
+                    ev.add_shard(EcVolumeShard::new(dir, "", vid, id)).unwrap();
+                }
+                ev
+            })
+            .collect()
+    }
+
+    /// The union must reach every disk's shards, and first-disk-wins must
+    /// resolve a shard mounted on two disks — the same rule
+    /// `collect_ec_shard_dirs` and Go's `CollectEcShards` already use.
+    #[test]
+    fn test_merge_ec_runtimes_unions_slots_first_disk_wins() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        // Disk 0: 0..=6 plus 9 (9 is also on disk 1 — a duplicate mount).
+        // Disk 1: 7..=13.
+        let runtimes = split_runtimes(
+            dir,
+            VolumeId(1),
+            &[&[0, 1, 2, 3, 4, 5, 6, 9], &[7, 8, 9, 10, 11, 12, 13]],
+        );
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let merged = merge_ec_runtimes(&refs).expect("non-empty input merges");
+        assert_eq!(merged.merged.len(), 2, "both runtimes share generation 0");
+        assert!(
+            merged.skipped.is_empty(),
+            "nothing to skip: {:?}",
+            merged.skipped
+        );
+
+        // Every shard 0..=13 is reachable from the merged slots.
+        for id in 0..14usize {
+            assert!(
+                merged.slots[id].is_some(),
+                "shard {} missing from the union",
+                id
+            );
+        }
+        // Shard 9 is held by both; the first disk wins.
+        let (owner, _) = merged.slots[9].unwrap();
+        assert!(
+            std::ptr::eq(owner, refs[0]),
+            "duplicate shard must resolve to the first disk"
+        );
+        // Slots are shard-id indexed across the volume's whole shard space,
+        // never compacted: index N is shard N or nothing.
+        assert_eq!(
+            merged.slots.len(),
+            14,
+            "slots must span the full 10+4 shard space"
+        );
+    }
+
+    /// Leniency is keyed on the ANCHOR, never the holder: a known identity must
+    /// not accept an unstamped holder (store_ec.rs:667-673,
+    /// grpc_server.rs:3743-3748). Merging leftover legacy shards beside a
+    /// current encode is what produces false corruption reports.
+    #[test]
+    fn test_merge_ec_runtimes_excludes_incompatible_identities() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut runtimes = split_runtimes(
+            dir,
+            VolumeId(1),
+            &[&[0, 1, 2, 3, 4, 5, 6], &[7, 8, 9], &[10, 11, 12, 13]],
+        );
+        runtimes[0].encode_ts_ns = 500; // stale, but stamped
+        runtimes[1].encode_ts_ns = 0; // legacy, unstamped
+        runtimes[2].encode_ts_ns = 900; // the live encode run
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let merged = merge_ec_runtimes(&refs).unwrap();
+
+        // Anchor is the newest known identity; only exact matches merge.
+        assert_eq!(merged.anchor.encode_ts_ns, 900);
+        assert_eq!(merged.merged.len(), 1);
+        assert!(
+            merged.slots[10].is_some(),
+            "the anchor's own shards must merge"
+        );
+        assert!(
+            merged.slots[0].is_none(),
+            "an older known generation must not merge"
+        );
+        assert!(
+            merged.slots[7].is_none(),
+            "an unstamped holder must not merge"
+        );
+
+        // Exclusions are REPORTED, never silent — that is what keeps this from
+        // regressing to the silent-clean bug this whole change fixes.
+        assert_eq!(merged.skipped.len(), 2, "got {:?}", merged.skipped);
+        assert!(merged.skipped.iter().all(|s| s.contains("not verified")));
+    }
+
+    /// When no runtime carries an identity there is nothing to fence on, so
+    /// behavior stays exactly as it is today: everything merges.
+    #[test]
+    fn test_merge_ec_runtimes_is_lenient_when_no_identity_is_known() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let runtimes = split_runtimes(dir, VolumeId(1), &[&[0, 1, 2], &[3, 4, 5]]);
+        assert!(runtimes.iter().all(|r| r.encode_ts_ns == 0));
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let merged = merge_ec_runtimes(&refs).unwrap();
+        assert_eq!(merged.merged.len(), 2);
+        assert!(merged.skipped.is_empty());
+        assert!(merged.slots[3].is_some());
+    }
+
+    /// The anchor supplies the volume-level metadata, so prefer a shard-bearing
+    /// runtime at the anchor generation over an empty one.
+    #[test]
+    fn test_merge_ec_runtimes_anchor_prefers_a_shard_bearing_runtime() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let runtimes = split_runtimes(dir, VolumeId(1), &[&[], &[0, 1, 2]]);
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let merged = merge_ec_runtimes(&refs).unwrap();
+        assert!(
+            std::ptr::eq(merged.anchor, refs[1]),
+            "anchor must hold shards"
+        );
+        assert!(
+            merged.skipped.is_empty(),
+            "same generation: nothing is excluded"
+        );
+    }
+
+    /// Empty input is the vanished-volume case and the ONLY None.
+    #[test]
+    fn test_merge_ec_runtimes_none_only_when_empty() {
+        assert!(merge_ec_runtimes(&[]).is_none());
+    }
+
+    /// The vanished-volume case: callers' `let ... else` guards depend on this
+    /// being the ONLY None.
+    #[test]
+    fn test_for_volumes_is_none_only_for_an_empty_slice() {
+        assert!(EcChecksumScrubPlan::for_volumes(&[]).is_none());
+        assert!(EcLocalScrubPlan::for_volumes(&[]).is_none());
+    }
+
+    /// The whole point: corruption on a shard that only a sibling runtime holds
+    /// must be reported. Before this change the scrub saw disk 0 alone and
+    /// returned clean.
+    #[test]
+    fn test_checksum_scrub_for_volumes_catches_sibling_disk_corruption() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        // Shard 11 is held ONLY by the second runtime.
+        let runtimes = split_runtimes(
+            dir,
+            VolumeId(1),
+            &[&[0, 1, 2, 3, 4, 5, 6], &[7, 8, 9, 10, 11, 12, 13]],
+        );
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        // Clean to start.
+        let (scanned, broken, errs) = EcChecksumScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(errs.is_empty(), "unexpected errors: {:?}", errs);
+        assert!(broken.is_empty(), "unexpected mismatches: {:?}", broken);
+        assert!(scanned > 0, "merged plan scanned nothing");
+
+        // Corrupt shard 11 — reachable only through the second runtime.
+        let shard11 = format!("{}/1.ec11", dir);
+        let mut bytes = std::fs::read(&shard11).unwrap();
+        bytes[0] ^= 0xFF;
+        std::fs::write(&shard11, &bytes).unwrap();
+
+        let (_, broken2, _) = EcChecksumScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(
+            broken2.contains(&11),
+            "sibling-disk corruption must be flagged, got {:?}",
+            broken2
+        );
+
+        // The single-runtime path is exactly the old blind spot: disk 0 alone
+        // still reports clean, which is why aggregation was needed.
+        let (_, broken_disk0, _) = refs[0].checksum_scrub();
+        assert!(!broken_disk0.contains(&11));
+    }
+
+    /// An excluded runtime is reported through the plan's errors, but ONLY on
+    /// the On path — the Off arm's clean-empty contract is Go parity
+    /// (`case BitrotOff: return 0, nil, nil`) and must not grow errors.
+    #[test]
+    fn test_checksum_scrub_skips_are_reported_but_never_break_the_off_arm() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut runtimes = split_runtimes(dir, VolumeId(1), &[&[0, 1, 2], &[3, 4, 5]]);
+        runtimes[0].encode_ts_ns = 100; // excluded: older known identity
+        runtimes[1].encode_ts_ns = 200; // anchor
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        // With protection ON, the skip surfaces as an error line, and the
+        // surviving (anchor) runtime is still actually scanned.
+        let (scanned, _, errs) = EcChecksumScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(
+            scanned > 0,
+            "excluding one runtime must not stop the rest from being scanned"
+        );
+        assert!(
+            errs.iter().any(|e| e.contains("not verified")),
+            "excluded runtime must be reported, got {:?}",
+            errs
+        );
+
+        // With protection OFF, the arm stays byte-for-byte clean.
+        let mut off = runtimes;
+        for r in off.iter_mut() {
+            r.bitrot_status = crate::storage::erasure_coding::ec_bitrot::BitrotStatus::Off;
+            r.bitrot = None;
+        }
+        let off_refs: Vec<&EcVolume> = off.iter().collect();
+        assert_eq!(
+            EcChecksumScrubPlan::for_volumes(&off_refs).unwrap().run(),
+            (0, Vec::new(), Vec::new()),
+            "BitrotOff must stay clean-empty for Go parity"
+        );
+    }
+
+    /// The Invalid arm returns a non-empty error vector of its own, so the
+    /// Go-parity contract that silences the Off arm does not reach it. A volume
+    /// with BOTH a malformed sidecar and a fenced-out disk must report BOTH:
+    /// reporting only the sidecar hides an unscanned disk behind an unrelated
+    /// integrity error, which is the failure mode this whole change exists to
+    /// close.
+    #[test]
+    fn test_checksum_scrub_reports_skips_on_a_malformed_sidecar() {
+        use crate::storage::erasure_coding::ec_bitrot::BitrotStatus;
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut runtimes = split_runtimes(dir, VolumeId(1), &[&[0, 1, 2], &[3, 4, 5]]);
+        runtimes[0].encode_ts_ns = 100; // excluded: older known identity
+        runtimes[1].encode_ts_ns = 200; // anchor
+        for r in runtimes.iter_mut() {
+            r.bitrot_status = BitrotStatus::Invalid;
+        }
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let (scanned, broken, errs) = EcChecksumScrubPlan::for_volumes(&refs).unwrap().run();
+        assert_eq!(
+            scanned, 0,
+            "a malformed sidecar must not be scanned against"
+        );
+        assert!(broken.is_empty(), "must never blame shards: {:?}", broken);
+        assert_eq!(
+            errs.len(),
+            2,
+            "expected the sidecar error AND the skip: {:?}",
+            errs
+        );
+        assert!(
+            errs[0].contains("malformed/unverifiable"),
+            "the sidecar error stays first: {:?}",
+            errs
+        );
+        assert!(
+            errs[1].contains("belong to encode run 100") && errs[1].contains("not verified"),
+            "the excluded disk must still be named: {:?}",
+            errs
+        );
+    }
+
+    /// When the anchor's sidecar came from a directory belonging to a runtime
+    /// the fence excluded, the checksums cannot be trusted against the anchor's
+    /// shards. Report that, never "shard N is corrupt".
+    #[test]
+    fn test_checksum_scrub_reports_unverifiable_sidecar_from_excluded_runtime() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut runtimes = split_runtimes(dir, VolumeId(1), &[&[0, 1, 2], &[3, 4, 5]]);
+
+        // Mount actually resolved the real sidecar from `dir` (both subsets
+        // share one physical directory in this fixture), confirming
+        // `load_bitrot_for_generation` populates the field before the test
+        // overwrites it below to simulate a cross-disk borrow.
+        assert_eq!(
+            runtimes[1].bitrot_source_dir, dir,
+            "mount must record the dir the sidecar was actually resolved from"
+        );
+
+        // Runtime 0 is an older encode run, and the anchor resolved its sidecar
+        // from runtime 0's directory.
+        runtimes[0].encode_ts_ns = 100;
+        runtimes[0].dir = "/disk-old".to_string();
+        runtimes[0].dir_idx = "/disk-old".to_string();
+        runtimes[1].encode_ts_ns = 200;
+        runtimes[1].dir = "/disk-new".to_string();
+        runtimes[1].dir_idx = "/disk-new".to_string();
+        runtimes[1].bitrot_source_dir = "/disk-old".to_string();
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let (scanned, broken, errs) = EcChecksumScrubPlan::for_volumes(&refs).unwrap().run();
+        assert_eq!(
+            scanned, 0,
+            "an unverifiable sidecar must not be scanned against"
+        );
+        assert!(broken.is_empty(), "must never blame shards: {:?}", broken);
+        assert!(
+            errs.iter().any(|e| e.contains("unverifiable")),
+            "expected an unverifiable-protection note, got {:?}",
+            errs
+        );
+        assert!(
+            errs.iter().any(|e| e.contains("were not verified")),
+            "the fenced-out runtime must still be reported alongside the unverifiable note: {:?}",
+            errs
+        );
+    }
+
+    /// The provenance rule fires only when a runtime was actually excluded. A
+    /// healthy single-encode volume whose sidecar lives on a sibling disk is the
+    /// normal mirrored case and must scrub normally.
+    #[test]
+    fn test_checksum_scrub_provenance_rule_does_not_fire_without_exclusions() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut runtimes = split_runtimes(
+            dir,
+            VolumeId(1),
+            &[&[0, 1, 2, 3, 4, 5, 6], &[7, 8, 9, 10, 11, 12, 13]],
+        );
+        // Same generation: nothing is excluded, so provenance is irrelevant even
+        // though the anchor's sidecar appears to have come from somewhere
+        // neither runtime owns. (The anchor is runtimes[0]: `merge_ec_runtimes`
+        // picks the first shard-bearing runtime at the anchor generation.)
+        runtimes[0].bitrot_source_dir = "/somewhere-else".to_string();
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let (scanned, broken, errs) = EcChecksumScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(scanned > 0, "a normal volume must still be scanned");
+        assert!(broken.is_empty(), "{:?}", broken);
+        assert!(
+            !errs.iter().any(|e| e.contains("unverifiable")),
+            "{:?}",
+            errs
+        );
+    }
+
+    /// The identity fence keys on `encode_ts_ns` ALONE, never on geometry, so
+    /// two same-generation runtimes whose `.vif`s disagree about the layout do
+    /// merge -- and `slots` is then sized to the WIDER of them while the
+    /// volume's actual shard-id range is the ANCHOR's `data + parity`.
+    ///
+    /// The two consumers disagreed about exactly that range: the mode 2|5 arm
+    /// builds `dirs` over `0..anchor.data_shards + anchor.parity_shards` and
+    /// silently drops the surplus slots, while `EcChecksumScrubPlan` iterated
+    /// the full width and reported each one "present but missing from sidecar
+    /// manifest". Nothing in this volume describes those ids -- the sidecar
+    /// manifest and the Reed-Solomon matrix are both the anchor's -- so that
+    /// message is the width disagreement talking, not a finding.
+    #[test]
+    fn test_checksum_scrub_truncates_slots_to_the_anchors_geometry() {
+        use crate::pb::volume_server_pb::{
+            ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums,
+        };
+        use crate::storage::erasure_coding::ec_bitrot;
+        use crate::storage::volume::{VifEcShardConfig, VifVolumeInfo};
+
+        let tmp = TempDir::new().unwrap();
+        let vid = VolumeId(1);
+
+        // One dir per geometry: `EcVolume::new` reads `data_shards`/
+        // `parity_shards` from the `.vif` beside the volume, so two runtimes can
+        // only disagree if they mount from different directories.
+        let seed = |name: &str, ds: u32, ps: u32, shard_id: u8| -> String {
+            let dir = tmp.path().join(name);
+            std::fs::create_dir_all(&dir).unwrap();
+            let d = dir.to_str().unwrap().to_string();
+            let base = crate::storage::volume::volume_file_name(&d, "", vid);
+            std::fs::write(format!("{}.ecx", base), b"").unwrap();
+            std::fs::write(format!("{}.ecj", base), b"").unwrap();
+            std::fs::write(
+                format!("{}.vif", base),
+                serde_json::to_string(&VifVolumeInfo {
+                    version: 3,
+                    ec_shard_config: Some(VifEcShardConfig {
+                        data_shards: ds,
+                        parity_shards: ps,
+                        encode_ts_ns: 500,
+                        ..Default::default()
+                    }),
+                    ..Default::default()
+                })
+                .unwrap(),
+            )
+            .unwrap();
+            std::fs::write(
+                format!("{}.ec{:02}", base, shard_id),
+                b"shard data nonempty",
+            )
+            .unwrap();
+            d
+        };
+
+        // 10+4, and the only disk with a sidecar -- so it supplies `prot`, and
+        // its manifest covers shard ids 0..=13 and nothing else.
+        let narrow = seed("narrow", 10, 4, 0);
+        let prot = EcBitrotProtection {
+            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+            block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+            generation: 0,
+            ec_shard_config: Some(ec_bitrot::ec_shard_config(10, 4, 0)),
+            shards: (0..14u32)
+                .map(|shard_id| EcShardChecksums {
+                    shard_id,
+                    covered_size: 4,
+                    block_crc32c: vec![0u8; 4],
+                })
+                .collect(),
+            encode_uuid: vec![0u8; 16],
+        };
+        ec_bitrot::save_bitrot_sidecar(
+            &ec_bitrot::bitrot_sidecar_path(
+                &crate::storage::volume::volume_file_name(&narrow, "", vid),
+                0,
+            ),
+            &prot,
+        )
+        .unwrap();
+
+        // 12+4: 16 slots, and it holds shard 14 -- an id the anchor's layout
+        // does not contain at all. Same encode_ts_ns, but the geometry fence
+        // now excludes it rather than merging incompatible shards.
+        let wide = seed("wide", 12, 4, 14);
+
+        let mut narrow_v = EcVolume::new(&narrow, &narrow, "", vid).unwrap();
+        narrow_v
+            .add_shard(EcVolumeShard::new(&narrow, "", vid, 0))
+            .unwrap();
+        let mut wide_v = EcVolume::new(&wide, &wide, "", vid).unwrap();
+        wide_v
+            .add_shard(EcVolumeShard::new(&wide, "", vid, 14))
+            .unwrap();
+
+        assert_eq!(narrow_v.shards.len(), 14);
+        assert_eq!(wide_v.shards.len(), 16);
+        assert_eq!(
+            narrow_v.encode_ts_ns, wide_v.encode_ts_ns,
+            "the two runtimes must share a generation"
+        );
+        assert_eq!(
+            narrow_v.bitrot_status,
+            crate::storage::erasure_coding::ec_bitrot::BitrotStatus::On,
+            "the narrow disk must carry usable protection"
+        );
+
+        let refs: Vec<&EcVolume> = vec![&narrow_v, &wide_v];
+        let merged = merge_ec_runtimes(&refs).unwrap();
+        assert!(
+            std::ptr::eq(merged.anchor, refs[0]),
+            "the NARROW runtime must anchor"
+        );
+        assert!(
+            !merged.skipped.is_empty(),
+            "the wide runtime must be excluded by the geometry fence: {:?}",
+            merged.skipped
+        );
+        assert_eq!(
+            merged.slots.len(),
+            14,
+            "slots are sized to the anchor's geometry, not the excluded wide runtime"
+        );
+        assert!(
+            merged.slots.get(14).is_none() || merged.slots.get(14).unwrap().is_none(),
+            "shard 14 from the excluded runtime must not appear in slots"
+        );
+
+        let (scanned, broken, errs) = EcChecksumScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(
+            !errs.iter().any(|e| e.contains("shard 14")),
+            "shard 14 belongs to an excluded runtime and must not be scanned: {:?}",
+            errs
+        );
+        assert!(
+            scanned > 0,
+            "the anchor's shard 0 must still be scanned: {:?}",
+            errs
+        );
+        assert_eq!(
+            broken,
+            vec![0],
+            "shard 0 is inside the anchor's geometry and its bytes do not match \
+             the manifest, so it must still be reported: errs={:?}",
+            errs
+        );
+    }
+
+    /// `for_volumes` must reach every runtime's shards, not just the first's.
+    /// A needle walk alone can't prove that with this fixture: ~500 bytes of
+    /// data under a legacy 1GiB large block puts every needle interval on
+    /// shard 0, so the slot vector is asserted directly. The walk-level checks
+    /// below additionally show the merged plan verifies cleanly and then
+    /// detects corruption reachable through the first runtime, while a
+    /// single-runtime plan stays blind to it.
+    #[test]
+    fn test_scrub_local_for_volumes_merges_slots_across_runtimes() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let runtimes = split_runtimes(dir, VolumeId(1), &[&[0, 1, 2], &[7, 8, 9]]);
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let (count, broken, errs) = EcLocalScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(count > 0, "the merged plan walked no needles");
+        assert!(
+            broken.is_empty(),
+            "clean volume reported broken shards: {:?}",
+            broken
+        );
+        assert!(errs.is_empty(), "clean volume reported errors: {:?}", errs);
+
+        // The property this task exists to deliver, asserted directly on the
+        // plan rather than through a needle walk. With ~500 bytes of fixture
+        // data and a legacy 1GiB large block every needle interval lands in
+        // shard 0, so no needle walk can ever reach a sibling runtime's
+        // shards -- but the slot vector can. Neither runtime holds every
+        // shard here, so the gap at shard 3 makes compaction load-bearing:
+        // a compacting implementation could still satisfy a "populated slots
+        // are reachable" check while silently reindexing the vector.
+        let merged_plan = EcLocalScrubPlan::for_volumes(&refs).unwrap();
+        assert_eq!(
+            merged_plan.shards.len(),
+            14,
+            "slots must span the full 10+4 shard space"
+        );
+        assert!(
+            merged_plan.shards[0].is_some(),
+            "disk 0's shard 0 must be reachable"
+        );
+        assert!(
+            merged_plan.shards[3].is_none(),
+            "a shard no runtime holds must stay an empty slot -- compaction would fill it"
+        );
+        assert!(
+            merged_plan.shards[7].is_some(),
+            "disk 1's shard 7 must be reachable -- the bug being fixed"
+        );
+
+        // A single-runtime plan still sees only its own disk, which is exactly
+        // what made aggregation necessary.
+        let solo = EcLocalScrubPlan::for_volumes(&[refs[0]]).unwrap();
+        assert!(solo.shards[0].is_some());
+        assert!(
+            solo.shards[7].is_none(),
+            "refs[0] alone must not see the sibling's shard 7"
+        );
+
+        // This fixture's few hundred bytes of needle data all land inside
+        // shard 0's legacy 1GiB large block (the tiny volume never fills even
+        // one), so shard 0 alone — held only by the first runtime — carries
+        // every needle. Corrupting a needle body byte there is the LOCAL
+        // analogue of Task 3's sibling-disk corruption: the whole point is
+        // that a partial-shard `scrub_local` cannot see it at all (it just
+        // silently skips a needle it can't reassemble locally — that is not
+        // an error), while the merged plan reaches it through refs[0].
+        let shard0 = format!("{}/1.ec00", dir);
+        let mut bytes = std::fs::read(&shard0).unwrap();
+        assert!(
+            bytes.len() > 268,
+            "fixture shrank below the corruption offset; split_runtimes's \
+             needle payloads changed, so this offset needs picking again"
+        );
+        bytes[268] ^= 0xFF; // inside needle 4's data payload
+        std::fs::write(&shard0, &bytes).unwrap();
+
+        let (_, _, merged_errs) = EcLocalScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(
+            !merged_errs.is_empty(),
+            "merged plan must detect corruption on shard 0, reachable through refs[0]"
+        );
+
+        // refs[1] never mounted shard 0, so it cannot see this corruption at
+        // all — that silent blind spot is exactly the bug aggregation fixes.
+        let (_, _, refs1_errs) = refs[1].scrub_local();
+        assert!(
+            refs1_errs.is_empty(),
+            "runtime without shard 0 has no way to detect this corruption: {:?}",
+            refs1_errs
+        );
+    }
+
+    /// LOCAL's legacy `shard_size` fallback (`dat_file_size == 0`) is now a
+    /// NODE-WIDE input: it feeds `locate_data`'s offset math for every merged
+    /// sibling's shards, not just the anchor's. `anchor.shard_file_size()`
+    /// returns the anchor's FIRST held shard rather than a maximum, so one
+    /// truncated shard on the anchor disk would mis-offset every needle read
+    /// across every disk and manufacture corruption reports wholesale. Take the
+    /// max over the merged slots, the way `verify_ec_shards` already answers the
+    /// same question (`if size > shard_size { shard_size = size }`).
+    #[test]
+    fn test_scrub_local_shard_size_fallback_takes_the_max_across_disks() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+
+        // Mount two shardless runtimes first so the shard files can be doctored
+        // before `add_shard` caches their sizes.
+        let mut runtimes = split_runtimes(dir, VolumeId(1), &[&[], &[]]);
+
+        // Disk 0's shard 0 is truncated -- a partially-copied shard, which is
+        // exactly the containment this fallback used to have and now must not
+        // lose.
+        let shard0_path = format!("{}/1.ec00", dir);
+        let full = std::fs::metadata(&shard0_path).unwrap().len();
+        assert!(full > 1, "fixture shard is too small to truncate");
+        std::fs::OpenOptions::new()
+            .write(true)
+            .open(&shard0_path)
+            .unwrap()
+            .set_len(full / 2)
+            .unwrap();
+
+        runtimes[0]
+            .add_shard(EcVolumeShard::new(dir, "", VolumeId(1), 0))
+            .unwrap();
+        runtimes[1]
+            .add_shard(EcVolumeShard::new(dir, "", VolumeId(1), 1))
+            .unwrap();
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let intact = std::fs::metadata(format!("{}/1.ec01", dir)).unwrap().len() as i64;
+        let truncated = (full / 2) as i64;
+        assert!(
+            truncated < intact,
+            "fixture must leave disk 0's shard SHORTER than disk 1's"
+        );
+
+        let merged = merge_ec_runtimes(&refs).unwrap();
+        assert!(
+            std::ptr::eq(merged.anchor, refs[0]),
+            "the truncated disk must anchor, or the old sizing was already right"
+        );
+        assert_eq!(
+            refs[0].dat_file_size, 0,
+            "this fixture writes no .vif, so the legacy fallback is the path \
+             under test; with a dat_file_size the branch is never reached"
+        );
+        assert_eq!(
+            refs[0].shard_file_size(),
+            truncated,
+            "the old source -- the anchor's first held shard -- is the \
+             truncated one, which is what makes this observable"
+        );
+
+        let plan = EcLocalScrubPlan::for_volumes(&refs).unwrap();
+        assert_eq!(
+            plan.shard_size,
+            intact - 1,
+            "one disk's truncated shard must not size every merged sibling's \
+             shards; locate_data would then mis-offset every needle on every \
+             disk and report corruption that is not there"
+        );
+    }
+
+    /// LOCAL has no bitrot status gate, so an excluded runtime is always
+    /// reported.
+    #[test]
+    fn test_scrub_local_reports_skipped_runtimes() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut runtimes = split_runtimes(dir, VolumeId(1), &[&[0, 1, 2], &[3, 4, 5]]);
+        runtimes[0].encode_ts_ns = 100;
+        runtimes[1].encode_ts_ns = 200;
+        let refs: Vec<&EcVolume> = runtimes.iter().collect();
+
+        let (_, _, errs) = EcLocalScrubPlan::for_volumes(&refs).unwrap().run();
+        assert!(
+            errs.iter().any(|e| e.contains("not verified")),
+            "excluded runtime must be reported, got {:?}",
+            errs
+        );
+    }
+
+    /// Mount a bare EC volume: an empty .ecx is enough to exercise the
+    /// shard-location cache, which is pure in-memory state.
+    fn mount_bare_ec_volume(dir: &str) -> EcVolume {
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        std::fs::write(format!("{}.ecx", base), b"").unwrap();
+        EcVolume::new(dir, dir, "", VolumeId(1)).unwrap()
+    }
+
+    /// The map and the refresh time it was learned at must become visible in the
+    /// same step. A merge that published the map first and stamped the time
+    /// afterwards let a reader in between pair a fresh map with the previous
+    /// refresh time -- and the freshness heuristic judges exactly that pair, so
+    /// the reader re-looked-up a map that had just been refreshed.
+    #[test]
+    fn merge_shard_locations_publishes_map_and_time_together() {
+        let tmp = TempDir::new().unwrap();
+        let vol = mount_bare_ec_volume(tmp.path().to_str().unwrap());
+
+        let (locations, refreshed_at) = vol.shard_locations_snapshot();
+        assert!(locations.is_empty(), "a fresh mount knows no locations");
+        assert!(
+            refreshed_at.is_none(),
+            "a volume that never refreshed has no refresh time"
+        );
+
+        let reply: HashMap<ShardId, Vec<String>> =
+            HashMap::from([(0, vec!["a:1".to_string()]), (1, vec!["b:2".to_string()])]);
+        let merged = vol.merge_shard_locations(reply.clone());
+        assert_eq!(merged, reply, "merge returns the resulting map");
+
+        let (locations, refreshed_at) = vol.shard_locations_snapshot();
+        assert_eq!(locations, reply, "the snapshot reports the merged map");
+        assert!(
+            refreshed_at.is_some(),
+            "the merge that produced that map also stamped its refresh time"
+        );
+
+        // Upsert, not replace: a reply that omits a cached shard keeps it.
+        // `before` is taken outside the merge so the assertion fails if the
+        // second merge did not re-stamp: `later >= refreshed_at` would hold on
+        // the first merge's stamp alone.
+        let before = Instant::now();
+        let merged = vol.merge_shard_locations(HashMap::from([(1, vec!["c:3".to_string()])]));
+        assert_eq!(merged.get(&0), Some(&vec!["a:1".to_string()]));
+        assert_eq!(merged.get(&1), Some(&vec!["c:3".to_string()]));
+        let (locations, later) = vol.shard_locations_snapshot();
+        assert_eq!(locations, merged, "the snapshot reports the merged map");
+        assert!(
+            later.unwrap() >= before,
+            "the second merge re-stamped the refresh time"
+        );
+    }
+
+    /// The stale mark is consumed by the refresh that acts on it, exactly once:
+    /// otherwise every later read keeps re-looking-up a map no one has disproved
+    /// since. A claim that declines the refresh must leave the mark standing.
+    #[test]
+    fn claim_shard_locations_refresh_consumes_the_stale_mark_once() {
+        let tmp = TempDir::new().unwrap();
+        let vol = mount_bare_ec_volume(tmp.path().to_str().unwrap());
+
+        assert!(
+            !vol.claim_shard_locations_refresh(|stale| stale),
+            "an untouched cache carries no mark"
+        );
+
+        vol.mark_shard_locations_stale();
+        assert!(
+            vol.claim_shard_locations_refresh(|stale| stale),
+            "the mark is visible to the next claim"
+        );
+        assert!(
+            !vol.claim_shard_locations_refresh(|stale| stale),
+            "the claim that acted on the mark consumed it"
+        );
+
+        vol.mark_shard_locations_stale();
+        assert!(
+            !vol.claim_shard_locations_refresh(|_| false),
+            "the refresh decision stays the caller's"
+        );
+        assert!(
+            vol.claim_shard_locations_refresh(|stale| stale),
+            "a claim that did not refresh leaves the mark for the next one"
+        );
+    }
+}
+
+#[cfg(test)]
+mod uniform_layout_tests {
+    use super::*;
+    use crate::storage::needle_map::NeedleMapKind;
+    use crate::storage::volume::{VifEcShardConfig, VifVolumeInfo, Volume, VolumeSpec};
+    use tempfile::TempDir;
+
+    // Write ~26MB of needles so the uniform block size (3MB) diverges from the
+    // legacy layout, encode, and verify EcVolume reads every needle back
+    // through the .vif-recorded geometry. A legacy-encoded fixture (no .vif
+    // block size) must keep reading through the legacy interpretation.
+    #[test]
+    fn test_read_needles_uniform_and_legacy_layouts() {
+        for legacy in [false, true] {
+            let tmp = TempDir::new().unwrap();
+            let dir = tmp.path().to_str().unwrap();
+            let vid = VolumeId(8);
+
+            let v = Volume::new(
+                dir,
+                dir,
+                vid,
+                NeedleMapKind::InMemory,
+                &VolumeSpec::default(),
+            )
+            .unwrap();
+            let mut expected: Vec<(NeedleId, Vec<u8>)> = Vec::new();
+            for i in 1u64..=11 {
+                let size = if i <= 5 { 4 << 20 } else { 1 << 20 };
+                let data: Vec<u8> = (0..size)
+                    .map(|b| ((b as u64).wrapping_mul(2654435761).wrapping_add(i) >> 8) as u8)
+                    .collect();
+                let mut n = Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(i as u32),
+                    data: data.clone(),
+                    data_size: data.len() as u32,
+                    ..Needle::default()
+                };
+                v.write_needle(&mut n, true, false).unwrap();
+                expected.push((NeedleId(i), data));
+            }
+            v.sync_to_disk().unwrap();
+            let dat_size = v.dat_file_size().unwrap() as i64;
+            v.close();
+
+            let block_size = if legacy {
+                // Legacy fixture: two-tier encode plus a .vif without a block
+                // size, the state every pre-upgrade EC volume is in.
+                use crate::storage::erasure_coding::ec_bitrot::{
+                    DEFAULT_BITROT_BLOCK_SIZE, ShardChecksumBuilder,
+                };
+                use reed_solomon_erasure::galois_8::ReedSolomon;
+                let base = crate::storage::volume::volume_file_name(dir, "", vid);
+                crate::storage::erasure_coding::ec_encoder::write_sorted_ecx_from_idx(
+                    &format!("{}.idx", base),
+                    &format!("{}.ecx", base),
+                )
+                .unwrap();
+                let dat_file = std::fs::File::open(format!("{}.dat", base)).unwrap();
+                let rs = ReedSolomon::new(10, 4).unwrap();
+                let mut shards: Vec<EcVolumeShard> = (0..14u8)
+                    .map(|i| EcVolumeShard::new(dir, "", vid, i))
+                    .collect();
+                for shard in &mut shards {
+                    shard.create().unwrap();
+                }
+                let mut builders: Vec<ShardChecksumBuilder> = (0..14)
+                    .map(|_| ShardChecksumBuilder::new(DEFAULT_BITROT_BLOCK_SIZE as i64))
+                    .collect();
+                crate::storage::erasure_coding::ec_encoder::encode_dat_file(
+                    &dat_file,
+                    dat_size,
+                    &rs,
+                    &mut shards,
+                    &mut builders,
+                    crate::storage::erasure_coding::ec_encoder::EcEncodeLayout {
+                        data_shards: 10,
+                        parity_shards: 4,
+                        buffer_size: 256 * 1024,
+                        large_block_size: ERASURE_CODING_LARGE_BLOCK_SIZE,
+                        small_block_size: ERASURE_CODING_SMALL_BLOCK_SIZE,
+                    },
+                )
+                .unwrap();
+                for shard in &mut shards {
+                    shard.close();
+                }
+                0
+            } else {
+                let bs = crate::storage::erasure_coding::ec_encoder::write_ec_files(
+                    dir, dir, "", vid, 10, 4,
+                )
+                .unwrap();
+                assert!(
+                    bs > ERASURE_CODING_SMALL_BLOCK_SIZE as i64,
+                    "block size {} does not diverge from the legacy layout",
+                    bs
+                );
+                bs
+            };
+
+            let base = crate::storage::volume::volume_file_name(dir, "", vid);
+            let vif = VifVolumeInfo {
+                version: Version::current().0 as u32,
+                dat_file_size: dat_size,
+                ec_shard_config: Some(VifEcShardConfig {
+                    data_shards: 10,
+                    parity_shards: 4,
+                    block_size,
+                    ..Default::default()
+                }),
+                ..Default::default()
+            };
+            std::fs::write(
+                format!("{}.vif", base),
+                serde_json::to_string_pretty(&vif).unwrap(),
+            )
+            .unwrap();
+            std::fs::remove_file(format!("{}.dat", base)).unwrap();
+            std::fs::remove_file(format!("{}.idx", base)).unwrap();
+
+            let mut vol = EcVolume::new(dir, dir, "", vid).unwrap();
+            assert_eq!(
+                vol.block_size, block_size,
+                "block size not loaded from .vif"
+            );
+            for i in 0..10u8 {
+                vol.add_shard(EcVolumeShard::new(dir, "", vid, i)).unwrap();
+            }
+
+            for (id, data) in &expected {
+                let n = vol
+                    .read_ec_shard_needle(*id)
+                    .unwrap()
+                    .unwrap_or_else(|| panic!("needle {} not found (legacy={})", id.0, legacy));
+                assert_eq!(
+                    n.data, *data,
+                    "needle {} data mismatch (legacy={})",
+                    id.0, legacy
+                );
+            }
+        }
+    }
+
+    // A present-but-malformed .vif must FAIL the mount: every new encode
+    // records a positive uniform block size there, and silently defaulting
+    // to the legacy layout would serve those shards with the wrong offset
+    // math. Absence stays legal — legacy volumes predate the sidecar.
+    #[test]
+    fn new_fails_on_malformed_vif() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        std::fs::write(format!("{}.ecx", base), b"").unwrap();
+        std::fs::write(format!("{}.vif", base), b"not json").unwrap();
+        let res = EcVolume::new(dir, dir, "", VolumeId(1));
+        assert!(res.is_err(), "mount over a malformed .vif must fail");
+    }
+
+    #[test]
+    fn new_absent_vif_mounts_with_defaults() {
+        let tmp = tempfile::TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(1));
+        std::fs::write(format!("{}.ecx", base), b"").unwrap();
+        let ev = EcVolume::new(dir, dir, "", VolumeId(1)).unwrap();
+        assert_eq!(ev.block_size, 0, "legacy mount must use the legacy layout");
+    }
+
+    /// A rebuild lands on one disk, but the volume's metadata may live on
+    /// another. Reading only the selected directory returns the default 10+4
+    /// and the legacy block layout, which reconstructs a custom-ratio or
+    /// uniform volume through the wrong matrix.
+    fn seed_uniform_sidecar(base: &str, ds: u32, ps: u32, block: i64) {
+        use crate::pb::volume_server_pb::{
+            ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums,
+        };
+        use crate::storage::erasure_coding::ec_bitrot;
+        let prot = EcBitrotProtection {
+            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+            block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+            generation: 0,
+            ec_shard_config: Some(ec_bitrot::ec_shard_config(ds, ps, block)),
+            shards: (0..(ds + ps))
+                .map(|shard_id| EcShardChecksums {
+                    shard_id,
+                    covered_size: 4,
+                    block_crc32c: vec![0u8; 4],
+                })
+                .collect(),
+            encode_uuid: vec![0u8; 16],
+        };
+        ec_bitrot::save_bitrot_sidecar(&ec_bitrot::bitrot_sidecar_path(base, 0), &prot).unwrap();
+    }
+
+    fn seed_config_free_vif(base: &str) {
+        std::fs::write(format!("{}.vif", base), r#"{"version":3,"datFileSize":0}"#).unwrap();
+    }
+
+    // A .vif that omits ecShardConfig answers nothing about the layout, so it
+    // must not short-circuit the sidecar search. Returning as soon as any
+    // parseable vif turned up resolved a 12+4 uniform volume as 10+4 legacy.
+    #[test]
+    fn read_ec_shard_config_falls_back_when_the_vif_has_no_config() {
+        let d = tempfile::TempDir::new().unwrap();
+        let dir = d.path().to_str().unwrap();
+        let base = crate::storage::volume::volume_file_name(dir, "", VolumeId(11));
+        seed_config_free_vif(&base);
+        seed_uniform_sidecar(&base, 12, 4, 3 * 1024 * 1024);
+
+        let got = read_ec_shard_config(dir, dir, "", VolumeId(11)).unwrap();
+        assert_eq!(got, (12, 4, 3 * 1024 * 1024));
+    }
+
+    // Split -dir/-dir.idx: the vif and the sidecar both live with the INDEX,
+    // and the resolver was told to report the DATA directory, so the fallback
+    // looked in a directory holding neither.
+    #[test]
+    fn read_ec_shard_config_finds_a_config_free_vifs_sidecar_in_the_index_dir() {
+        let data = tempfile::TempDir::new().unwrap();
+        let idx = tempfile::TempDir::new().unwrap();
+        let (dir, dir_idx) = (data.path().to_str().unwrap(), idx.path().to_str().unwrap());
+        let idx_base = crate::storage::volume::volume_file_name(dir_idx, "", VolumeId(12));
+        seed_config_free_vif(&idx_base);
+        seed_uniform_sidecar(&idx_base, 12, 4, 3 * 1024 * 1024);
+
+        let got = read_ec_shard_config(dir, dir_idx, "", VolumeId(12)).unwrap();
+        assert_eq!(got, (12, 4, 3 * 1024 * 1024));
+    }
+
+    // Same gap in the cross-disk resolver the rebuild uses.
+    #[test]
+    fn read_ec_shard_config_across_dirs_falls_back_when_the_vif_has_no_config() {
+        let data = tempfile::TempDir::new().unwrap();
+        let sib = tempfile::TempDir::new().unwrap();
+        let (dir, sibling) = (data.path().to_str().unwrap(), sib.path().to_str().unwrap());
+        seed_config_free_vif(&crate::storage::volume::volume_file_name(
+            dir,
+            "",
+            VolumeId(13),
+        ));
+        seed_uniform_sidecar(
+            &crate::storage::volume::volume_file_name(sibling, "", VolumeId(13)),
+            12,
+            4,
+            3 * 1024 * 1024,
+        );
+
+        let got =
+            read_ec_shard_config_across_dirs(dir, dir, &[sibling.to_string()], "", VolumeId(13))
+                .unwrap();
+        assert_eq!(got, (12, 4, 3 * 1024 * 1024));
+    }
+
+    // Absence stays legal: a volume predating both records is genuinely legacy.
+    #[test]
+    fn read_ec_shard_config_config_free_vif_without_a_sidecar_is_legacy() {
+        let d = tempfile::TempDir::new().unwrap();
+        let dir = d.path().to_str().unwrap();
+        seed_config_free_vif(&crate::storage::volume::volume_file_name(
+            dir,
+            "",
+            VolumeId(14),
+        ));
+        let got = read_ec_shard_config(dir, dir, "", VolumeId(14)).unwrap();
+        assert_eq!(got, (10, 4, 0));
+    }
+
+    #[test]
+    fn read_ec_shard_config_finds_a_sibling_disks_vif() {
+        let a = tempfile::TempDir::new().unwrap();
+        let b = tempfile::TempDir::new().unwrap();
+        let (rebuild, sibling) = (a.path().to_str().unwrap(), b.path().to_str().unwrap());
+        let base = crate::storage::volume::volume_file_name(sibling, "", VolumeId(3));
+        std::fs::write(
+            format!("{}.vif", base),
+            r#"{"version":3,"ecShardConfig":{"dataShards":12,"parityShards":4,"blockSize":3145728}}"#,
+        )
+        .unwrap();
+
+        let (ds, ps, bs) = read_ec_shard_config_across_dirs(
+            rebuild,
+            rebuild,
+            &[sibling.to_string()],
+            "",
+            VolumeId(3),
+        )
+        .unwrap();
+        assert_eq!((ds, ps, bs), (12, 4, 3 * 1024 * 1024));
+    }
+
+    /// Same, for the sidecar: with no .vif anywhere it is the surviving record
+    /// of the geometry, wherever it sits.
+    // A split -dir/-dir.idx location keeps its metadata with the INDEX, and
+    // callers leave their own index directory out of other_dirs because it is
+    // passed separately. With no .vif anywhere the generation-0 .ecsum is the
+    // only record of the layout, so missing that directory resolves a 12+4
+    // uniform volume to 10+4 legacy and reconstructs through the wrong matrix.
+    #[test]
+    fn read_ec_shard_config_finds_the_sidecar_in_its_own_index_dir() {
+        use crate::pb::volume_server_pb::{
+            ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums,
+        };
+        use crate::storage::erasure_coding::ec_bitrot;
+
+        let data = tempfile::TempDir::new().unwrap();
+        let idx = tempfile::TempDir::new().unwrap();
+        let (dir, dir_idx) = (data.path().to_str().unwrap(), idx.path().to_str().unwrap());
+        let base = crate::storage::volume::volume_file_name(dir_idx, "", VolumeId(7));
+        let prot = EcBitrotProtection {
+            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+            block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+            generation: 0,
+            ec_shard_config: Some(ec_bitrot::ec_shard_config(12, 4, 3 * 1024 * 1024)),
+            shards: (0..16u32)
+                .map(|shard_id| EcShardChecksums {
+                    shard_id,
+                    covered_size: 4,
+                    block_crc32c: vec![0u8; 4],
+                })
+                .collect(),
+            encode_uuid: vec![0u8; 16],
+        };
+        ec_bitrot::save_bitrot_sidecar(&ec_bitrot::bitrot_sidecar_path(&base, 0), &prot).unwrap();
+
+        let (ds, ps, bs) =
+            read_ec_shard_config_across_dirs(dir, dir_idx, &[], "", VolumeId(7)).unwrap();
+        assert_eq!((ds, ps, bs), (12, 4, 3 * 1024 * 1024));
+    }
+
+    #[test]
+    fn read_ec_shard_config_finds_a_sibling_disks_sidecar() {
+        use crate::pb::volume_server_pb::{
+            ChecksumAlgorithm, EcBitrotProtection, EcShardChecksums,
+        };
+        use crate::storage::erasure_coding::ec_bitrot;
+
+        let a = tempfile::TempDir::new().unwrap();
+        let b = tempfile::TempDir::new().unwrap();
+        let (rebuild, sibling) = (a.path().to_str().unwrap(), b.path().to_str().unwrap());
+        let base = crate::storage::volume::volume_file_name(sibling, "", VolumeId(4));
+        let prot = EcBitrotProtection {
+            algorithm: ChecksumAlgorithm::ChecksumCrc32c as i32,
+            block_size: ec_bitrot::DEFAULT_BITROT_BLOCK_SIZE as u32,
+            generation: 0,
+            ec_shard_config: Some(ec_bitrot::ec_shard_config(12, 4, 3 * 1024 * 1024)),
+            shards: (0..16u32)
+                .map(|shard_id| EcShardChecksums {
+                    shard_id,
+                    covered_size: 4,
+                    block_crc32c: vec![0u8; 4],
+                })
+                .collect(),
+            encode_uuid: vec![0u8; 16],
+        };
+        ec_bitrot::save_bitrot_sidecar(&ec_bitrot::bitrot_sidecar_path(&base, 0), &prot).unwrap();
+
+        let (ds, ps, bs) = read_ec_shard_config_across_dirs(
+            rebuild,
+            rebuild,
+            &[sibling.to_string()],
+            "",
+            VolumeId(4),
+        )
+        .unwrap();
+        assert_eq!((ds, ps, bs), (12, 4, 3 * 1024 * 1024));
+    }
+}
+
+/// One volume id's per-disk runtimes resolved into a single scrubbable view.
+/// Every scrub mode builds from this, so there is exactly one answer to
+/// "which disks count" per volume.
+pub(crate) struct MergedEcRuntimes<'a> {
+    /// Volume-level metadata source: geometry, `.ecx` handles, version. NOT
+    /// bitrot protection — the `.ecsum` sidecar is per-DISK state, so
+    /// `EcChecksumScrubPlan::for_volumes` sources it from the first `merged`
+    /// runtime that has any.
+    pub anchor: &'a EcVolume,
+    /// Runtimes whose shards are safe to verify together.
+    pub merged: Vec<&'a EcVolume>,
+    /// Indexed BY SHARD ID. `None` is a shard no merged runtime holds. The
+    /// volume's shard-id range is the anchor's geometry
+    /// (`0..data_shards + parity_shards`); consumers truncate to it.
+    pub slots: Vec<Option<(&'a EcVolume, &'a EcVolumeShard)>>,
+    /// One line per runtime excluded by the identity or geometry fence.
+    /// Reported, never dropped.
+    pub skipped: Vec<String>,
+}
+
+/// Resolve `runtimes` (one vid's mounts, in location order) into a merged view.
+/// `None` for an empty slice (the vanished-volume case).
+///
+/// Two fences admit a runtime into `merged`: the anchor's `encode_ts_ns` (the
+/// maximum, so `0` implies every runtime is `0` and nothing is excluded —
+/// legacy leniency), and the anchor's geometry (`data_shards`, `parity_shards`,
+/// `block_size`). Equal timestamps do not guarantee equal layouts, so a
+/// same-generation runtime whose `.vif` disagrees is excluded and reported
+/// rather than merged into a plan that would apply the anchor's offsets and
+/// checksums to incompatible shards.
+pub(crate) fn merge_ec_runtimes<'a>(runtimes: &[&'a EcVolume]) -> Option<MergedEcRuntimes<'a>> {
+    let anchor_gen = runtimes.iter().map(|v| v.encode_ts_ns).max()?;
+
+    let gen_matches: Vec<&'a EcVolume> = runtimes
+        .iter()
+        .copied()
+        .filter(|v| v.encode_ts_ns == anchor_gen)
+        .collect();
+
+    let anchor = gen_matches
+        .iter()
+        .copied()
+        .find(|v| v.shards.iter().any(|s| s.is_some()))
+        .unwrap_or(gen_matches[0]);
+
+    let merged: Vec<&'a EcVolume> = gen_matches
+        .iter()
+        .copied()
+        .filter(|v| {
+            v.data_shards == anchor.data_shards
+                && v.parity_shards == anchor.parity_shards
+                && v.block_size == anchor.block_size
+        })
+        .collect();
+
+    let width = merged.iter().map(|v| v.shards.len()).max().unwrap_or(0);
+    let mut slots: Vec<Option<(&'a EcVolume, &'a EcVolumeShard)>> = vec![None; width];
+    for v in &merged {
+        for (id, slot) in v.shards.iter().enumerate() {
+            if let Some(shard) = slot.as_ref()
+                && slots[id].is_none()
+            {
+                slots[id] = Some((*v, shard));
+            }
+        }
+    }
+
+    let skipped: Vec<String> = runtimes
+        .iter()
+        .enumerate()
+        .filter(|(_, v)| {
+            v.encode_ts_ns != anchor_gen
+                || v.data_shards != anchor.data_shards
+                || v.parity_shards != anchor.parity_shards
+                || v.block_size != anchor.block_size
+        })
+        .map(|(pos, v)| {
+            if v.encode_ts_ns != anchor_gen {
+                format!(
+                    "EC volume {} shards at {} (position {}) belong to encode run {} but the scrub anchors on {}; they were not verified",
+                    v.volume_id.0, v.dir, pos, v.encode_ts_ns, anchor_gen
+                )
+            } else {
+                format!(
+                    "EC volume {} shards at {} (position {}) share encode run {} but disagree on geometry ({}+{} bs {} vs {}+{} bs {}); they were not verified",
+                    v.volume_id.0, v.dir, pos, v.encode_ts_ns,
+                    v.data_shards, v.parity_shards, v.block_size,
+                    anchor.data_shards, anchor.parity_shards, anchor.block_size
+                )
+            }
+        })
+        .collect();
+
+    Some(MergedEcRuntimes {
+        anchor,
+        merged,
+        slots,
+        skipped,
+    })
+}
+
+/// Self-contained input for an EC checksum scrub: the sidecar plus a duplicate
+/// of every mounted local shard handle, taken under the store read guard.
+///
+/// Two things follow from holding descriptors rather than paths. `run()` needs
+/// no store access, so the guard is released before a scan that reads every
+/// byte of every local shard — under the guard that scan parks the periodic
+/// heartbeat's `store.write()`, and `std::sync::RwLock` is write-preferring, so
+/// every later reader queues behind it and the node stops serving. And a
+/// teardown that legitimately unlinks the shards mid-scan (the heartbeat's
+/// `delete_expired_ec_volumes`, `volume_ec_shards_delete`) cannot masquerade as
+/// bitrot, because the descriptor outlives the name. Go reads the same way:
+/// `ChecksumScrub` goes through `shard.ReadAt`.
+///
+/// Not `Clone`: it owns those descriptors.
+#[derive(Debug)]
+pub struct EcChecksumScrubPlan {
+    pub volume_id: VolumeId,
+    pub prot: Option<crate::pb::volume_server_pb::EcBitrotProtection>,
+    pub status: crate::storage::erasure_coding::ec_bitrot::BitrotStatus,
+    pub parity_shards: u32,
+    /// One entry per LOCAL shard: its id and a duplicate of the mounted
+    /// handle (or the error to report). Private so a plan can only be built
+    /// (via `checksum_scrub_plan()` or `for_volumes()`) from `&EcVolume`
+    /// references, which cannot be obtained without the store guard — which
+    /// is what makes "captured under the guard" an invariant rather than a
+    /// convention.
+    ///
+    /// `dup` shares the kernel file offset, so every read here is positional.
+    shards: Vec<(u32, std::io::Result<File>)>,
+    /// Runtimes the identity/geometry fence excluded, one line each. Surfaced
+    /// through `run()`'s errors on the `On`/`Invalid` paths.
+    skipped: Vec<String>,
+    /// `Some(source_dir)` when the sidecar that supplied `prot`/`status` was
+    /// resolved from a directory belonging to a runtime the fence excluded.
+    /// `run()` reports unverifiable protection instead of blaming shards.
+    unverifiable_sidecar: Option<String>,
+    /// One line per merged runtime whose sidecar resolved `Invalid`. Reported
+    /// even when protection is taken from a sibling that is `On`, so a
+    /// malformed sidecar is never silently discarded.
+    invalid_sidecar_errors: Vec<String>,
+}
+
+impl EcChecksumScrubPlan {
+    /// Build one plan over every per-disk runtime of a volume id. `None` only
+    /// when `runtimes` is empty (the vanished-volume case).
+    pub fn for_volumes(runtimes: &[&EcVolume]) -> Option<Self> {
+        use crate::storage::erasure_coding::ec_bitrot::BitrotStatus;
+
+        let merged = merge_ec_runtimes(runtimes)?;
+        let anchor = merged.anchor;
+
+        // Protection is per-DISK state: the `.ecsum` sidecar is not mirrored,
+        // and at mount each runtime resolves it from its own directories only,
+        // so after a restart the runtime without the sidecar mounts `Off`.
+        // Take the first merged runtime that has protection: `On` if any, else
+        // `Invalid`, else the anchor's `Off`. This only moves toward more
+        // verification (`Off->On`, `Off->Invalid`, `Invalid->On`), never toward
+        // silence — the anchor is itself in `merged`, so the fallback is `Off`
+        // only when every merged runtime is `Off`.
+        let protection_source = merged
+            .merged
+            .iter()
+            .copied()
+            .find(|v| matches!(v.bitrot_protection().1, BitrotStatus::On))
+            .or_else(|| {
+                merged
+                    .merged
+                    .iter()
+                    .copied()
+                    .find(|v| matches!(v.bitrot_protection().1, BitrotStatus::Invalid))
+            })
+            .unwrap_or(anchor);
+        let (prot, status) = protection_source.bitrot_protection();
+
+        // Collect every merged runtime whose sidecar resolved Invalid, excluding
+        // the protection_source (whose error the Invalid arm of run() already
+        // reports). These surface when protection is taken from a sibling that
+        // is On, so a malformed sidecar is never silently discarded.
+        let invalid_sidecar_errors: Vec<String> = merged
+            .merged
+            .iter()
+            .filter(|v| {
+                let v_ptr: *const EcVolume = **v;
+                let src_ptr: *const EcVolume = protection_source;
+                !std::ptr::eq(v_ptr, src_ptr)
+                    && matches!(v.bitrot_protection().1, BitrotStatus::Invalid)
+            })
+            .map(|v| {
+                format!(
+                    "EC volume {} bitrot sidecar at {} is malformed/unverifiable (sidecar integrity)",
+                    v.volume_id.0, v.dir
+                )
+            })
+            .collect();
+
+        let total = (anchor.data_shards + anchor.parity_shards) as usize;
+
+        let shards = match status {
+            crate::storage::erasure_coding::ec_bitrot::BitrotStatus::On => merged
+                .slots
+                .iter()
+                .take(total)
+                .enumerate()
+                .filter_map(|(id, slot)| slot.map(|(_, shard)| (id as u32, shard.try_clone_file())))
+                .collect(),
+            _ => Vec::new(),
+        };
+
+        // If the fence excluded a runtime AND the sidecar that supplied
+        // protection was resolved from that excluded runtime's directory, the
+        // checksums cannot be trusted against the merged shards.
+        let unverifiable_sidecar = if merged.skipped.is_empty() {
+            None
+        } else {
+            let own_dirs: Vec<String> = merged
+                .merged
+                .iter()
+                .flat_map(|v| [v.dir.as_str(), v.dir_idx.as_str()])
+                .map(|d| d.trim_end_matches('/').to_string())
+                .collect();
+            let src = protection_source.bitrot_source_dir.trim_end_matches('/');
+            if src.is_empty() || own_dirs.iter().any(|d| d == src) {
+                None
+            } else {
+                Some(protection_source.bitrot_source_dir.clone())
+            }
+        };
+
+        Some(EcChecksumScrubPlan {
+            volume_id: anchor.volume_id,
+            prot,
+            status,
+            parity_shards: anchor.parity_shards,
+            shards,
+            skipped: merged.skipped,
+            unverifiable_sidecar,
+            invalid_sidecar_errors,
+        })
+    }
+
+    /// The byte-verification pass. Touches only the filesystem — no store, no
+    /// lock — so it is safe to hand to `spawn_blocking`.
+    pub fn run(self) -> (u64, Vec<u32>, Vec<String>) {
+        use crate::storage::erasure_coding::ec_bitrot;
+        use crate::storage::erasure_coding::ec_bitrot::BitrotStatus;
+
+        let mut errors: Vec<String> = Vec::new();
+
+        // Mirrors Go's `ChecksumScrub` (`prot, status := ecv.BitrotProtection()`):
+        //   - Off: sidecars are optional; return clean (Go: `case BitrotOff: return 0, nil, nil`).
+        //   - Invalid: sidecar is present but malformed; report an integrity error.
+        //   - On: scan local shards against it.
+        let prot = match (self.prot, self.status) {
+            (_, BitrotStatus::Off) => {
+                return (0, Vec::new(), Vec::new());
+            }
+            (_, BitrotStatus::Invalid) => {
+                let mut errs = vec![format!(
+                    "EC volume {} bitrot sidecar is malformed/unverifiable (sidecar integrity)",
+                    self.volume_id.0
+                )];
+                errs.extend(self.skipped);
+                errs.extend(self.invalid_sidecar_errors);
+                return (0, Vec::new(), errs);
+            }
+            (Some(p), BitrotStatus::On) => p,
+            (None, BitrotStatus::On) => {
+                return (0, Vec::new(), Vec::new());
+            }
+        };
+
+        errors.extend(self.skipped);
+        errors.extend(self.invalid_sidecar_errors);
+
+        if let Some(src) = self.unverifiable_sidecar {
+            errors.push(format!(
+                "EC volume {} bitrot sidecar was resolved from {}, which belongs to an excluded encode run; protection unverifiable",
+                self.volume_id.0, src
+            ));
+            return (0, Vec::new(), errors);
+        }
+
+        let block_size = prot.block_size as i64;
+
+        let mut blocks_scanned: u64 = 0;
+        let mut mismatched_shards: Vec<u32> = Vec::new();
+        // Track shards whose blocks ALL mismatch (wholesale) to detect a
+        // stale/wrong sidecar.
+        let mut wholesale_mismatch = 0usize;
+
+        for (shard_id, handle) in self.shards {
+            let Some(entry) = ec_bitrot::shard_checksums(&prot, shard_id) else {
+                errors.push(format!(
+                    "EC volume {} shard {} present but missing from sidecar manifest",
+                    self.volume_id.0, shard_id
+                ));
+                continue;
+            };
+
+            // The handle was opened under the store lock; reading through it
+            // means a concurrent unmount/unlink cannot masquerade as bitrot.
+            let file = match &handle {
+                Ok(f) => f,
+                Err(e) => {
+                    errors.push(format!(
+                        "EC volume {} shard {} scrub read error: {}",
+                        self.volume_id.0, shard_id, e
+                    ));
+                    continue;
+                }
+            };
+
+            let expected_blocks = entry.block_crc32c.len() / 4;
+            match ec_bitrot::verify_shard_blocks(file, entry, block_size) {
+                Ok(mismatched) => {
+                    blocks_scanned += expected_blocks as u64;
+                    if !mismatched.is_empty() {
+                        mismatched_shards.push(shard_id);
+                        if expected_blocks > 0 && mismatched.len() == expected_blocks {
+                            wholesale_mismatch += 1;
+                        }
+                    }
+                }
+                Err(e) => {
+                    errors.push(format!(
+                        "EC volume {} shard {} scrub read error: {}",
+                        self.volume_id.0, shard_id, e
+                    ));
+                }
+            }
+        }
+
+        // If more shards mismatch wholesale than parity can mask, the sidecar
+        // itself is the likely culprit (stale generation / wrong volume), so
+        // suppress the shard-corruption verdict and flag a sidecar-integrity
+        // issue instead.
+        if wholesale_mismatch > self.parity_shards as usize {
+            errors.push(format!(
+                "EC volume {}: {} shards mismatch wholesale (> {} parity); suspect stale/wrong sidecar, not shard corruption",
+                self.volume_id.0, wholesale_mismatch, self.parity_shards
+            ));
+            mismatched_shards.clear();
+        }
+
+        mismatched_shards.sort_unstable();
+        (blocks_scanned, mismatched_shards, errors)
+    }
+}
+
+/// Self-contained input for an EC index scrub.
+///
+/// Not `Clone`: it owns the .ecx handle opened under the store lock.
+#[derive(Debug)]
+pub struct EcIndexScrubPlan {
+    pub volume_id: VolumeId,
+    pub has_ecx_file: bool,
+    pub ecx_path: String,
+    pub ecx_file_size: i64,
+    pub version: Version,
+    /// The .ecx handle opened while the store lock was held. Private, so the
+    /// plan can only come from `EcVolume::scrub_index_plan`.
+    ecx_handle: std::io::Result<File>,
+}
+
+impl EcIndexScrubPlan {
+    /// Structural walk of the .ecx index. Filesystem only — no store, no lock.
+    pub fn run(self) -> (u64, Vec<String>) {
+        if !self.has_ecx_file {
+            return (
+                0,
+                vec![format!(
+                    "no ECX file associated with EC volume {}",
+                    self.volume_id.0
+                )],
+            );
+        }
+        if self.ecx_file_size == 0 {
+            return (
+                0,
+                vec![format!(
+                    "zero-size ECX file for EC volume {}",
+                    self.volume_id.0
+                )],
+            );
+        }
+
+        // A private fd, so the structural scan never moves the shared ecx_file
+        // cursor (the cached handle is read positionally elsewhere). Checked
+        // after the two guards above so the error ordering is unchanged.
+        let mut ecx_file = match self.ecx_handle {
+            Ok(f) => f,
+            Err(e) => return (0, vec![format!("open ECX file {}: {}", self.ecx_path, e)]),
+        };
+        crate::storage::idx::check_index_file(&mut ecx_file, self.ecx_file_size, self.version)
+    }
+}
+
+/// One local shard as `EcLocalScrubPlan` sees it: the mounted descriptor, the
+/// size the scan compares against, and the identity a broken-shard report needs.
+#[derive(Debug)]
+pub struct EcLocalShard {
+    file: std::io::Result<File>,
+    /// The shard's cached size, as `scrub_local` has always compared against —
+    /// deliberately not a live `metadata()` call in `run()`.
+    file_size: i64,
+    info: crate::pb::volume_server_pb::EcShardInfo,
+}
+
+impl EcLocalShard {
+    /// Positional read through the duplicated handle. `dup` shares the kernel
+    /// offset with the mounted shard, so this must never seek.
+    fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+        let file = self
+            .file
+            .as_ref()
+            .map_err(|e| io::Error::new(e.kind(), e.to_string()))?;
+        crate::storage::io::read_full_at(file, buf, offset)
+    }
+}
+
+/// Self-contained input for an EC LOCAL scrub: the index snapshot, a private
+/// .ecx descriptor for the needle walk, and the mounted local shard handles.
+///
+/// Same reasoning as `EcChecksumScrubPlan` — `scrub_local` reads every local
+/// needle's bytes, so it must not run under the store read guard.
+///
+/// Not `Clone`: it owns descriptors.
+#[derive(Debug)]
+pub struct EcLocalScrubPlan {
+    volume_id: VolumeId,
+    version: Version,
+    data_shards: u32,
+    shard_size: i64,
+    large_block_size: i64,
+    small_block_size: i64,
+    index: EcIndexScrubPlan,
+    ecx_path: String,
+    ecx_walk: std::io::Result<File>,
+    /// Indexed BY SHARD ID; `None` is a shard no merged runtime holds.
+    shards: Vec<Option<EcLocalShard>>,
+    /// Runtimes the identity fence excluded, one line each. LOCAL has no status
+    /// gate, so `run()` always reports these.
+    skipped: Vec<String>,
+}
+
+impl EcLocalScrubPlan {
+    /// Build one plan over every per-disk runtime of a volume id. `None` only
+    /// when `runtimes` is empty.
+    ///
+    /// The shard vector keeps its SLOT structure — index is the shard id, gaps
+    /// are shards no merged runtime holds. `run()` reads that distinction to
+    /// decide whether a needle can be reassembled locally at all, so compacting
+    /// it would silently change which needles get verified.
+    pub fn for_volumes(runtimes: &[&EcVolume]) -> Option<Self> {
+        let merged = merge_ec_runtimes(runtimes)?;
+        let anchor = merged.anchor;
+
+        Some(EcLocalScrubPlan {
+            volume_id: anchor.volume_id,
+            version: anchor.version,
+            data_shards: anchor.data_shards,
+            // locate_data wants shardSize = datFileSize / DataShards when known,
+            // else ecdFileSize - 1 (shards are padded to the small block size;
+            // the -1 avoids an off-by-one in the large-block row count).
+            //
+            // The fallback takes the MAX over every merged slot, not
+            // `anchor.shard_file_size()` -- which returns the anchor's FIRST
+            // held shard, not a maximum. Before aggregation the plan only read
+            // the anchor's own shards, so a truncated shard there mis-sized only
+            // its own runtime; now one disk's truncated shard would set
+            // `shard_size` for every merged sibling's shards, mis-offset
+            // `locate_data` and manufacture needle corruption across the whole
+            // node. `verify_ec_shards` already answers this same question the
+            // same way (`if size > shard_size { shard_size = size }`), so this
+            // is the in-tree convention rather than a preference. Reached only
+            // on the legacy `dat_file_size == 0` path.
+            //
+            // `.take(..)` honors the `slots` contract: the volume's shard-id
+            // range is the ANCHOR's geometry, and a same-generation runtime with
+            // a disagreeing `.vif` can populate slots beyond it. Scanning those
+            // would let an OUT-OF-GEOMETRY shard -- one nothing in this volume's
+            // layout describes -- set the offset math for every shard that IS in
+            // it, which is a narrower path to exactly the node-wide mis-sizing
+            // this max exists to close.
+            shard_size: if anchor.dat_file_size > 0 {
+                anchor.dat_file_size / anchor.data_shards as i64
+            } else {
+                merged
+                    .slots
+                    .iter()
+                    .take((anchor.data_shards + anchor.parity_shards) as usize)
+                    .flatten()
+                    .map(|(_, s)| s.file_size())
+                    .max()
+                    .unwrap_or(0)
+                    - 1
+            },
+            large_block_size: anchor.large_block_size(),
+            small_block_size: anchor.small_block_size(),
+            index: anchor.scrub_index_plan(),
+            ecx_path: anchor.ecx_file_name(),
+            // A second descriptor: the index plan's is consumed by its own walk,
+            // and both seek.
+            ecx_walk: File::open(anchor.ecx_file_name()),
+            shards: merged
+                .slots
+                .iter()
+                .map(|slot| {
+                    slot.map(|(_, s)| EcLocalShard {
+                        file: s.try_clone_file(),
+                        file_size: s.file_size(),
+                        info: s.to_ec_shard_info(),
+                    })
+                })
+                .collect(),
+            skipped: merged.skipped,
+        })
+    }
+
+    /// The needle walk. Filesystem only — no store, no lock.
+    pub fn run(
+        self,
+    ) -> (
+        u64,
+        Vec<crate::pb::volume_server_pb::EcShardInfo>,
+        Vec<String>,
+    ) {
+        let EcLocalScrubPlan {
+            volume_id,
+            version,
+            data_shards,
+            shard_size,
+            large_block_size,
+            small_block_size,
+            index,
+            ecx_path,
+            ecx_walk,
+            shards,
+            skipped,
+        } = self;
+
+        // Local scan also verifies the index.
+        let (_, mut errs) = index.run();
+
+        // LOCAL has no protection status to gate on, so an excluded runtime is
+        // always reported rather than silently unscanned.
+        errs.extend(skipped);
+
+        let mut broken_shards: HashSet<ShardId> = HashSet::new();
+        let mut count: u64 = 0;
+
+        let mut ecx_file = match ecx_walk {
+            Ok(f) => f,
+            Err(e) => {
+                errs.push(format!("open ECX file {}: {}", ecx_path, e));
+                return (count, Vec::new(), errs);
+            }
+        };
+
+        // Reused across every needle/chunk to avoid a per-chunk allocation.
+        let mut chunk_buf: Vec<u8> = Vec::new();
+        let walk = crate::storage::idx::walk_index_file(&mut ecx_file, 0, |id, offset, size| {
+            count += 1;
+            if size.is_tombstone() {
+                return Ok(());
+            }
+
+            // Go recomputes this at the size check below; hoisted because Rust
+            // also sizes the reassembly buffer from it. Any negative size other
+            // than the -1 tombstone skipped above drives it negative.
+            let want = get_actual_size(size, version);
+
+            let locations = ec_locate::locate_data(
+                offset.to_actual_offset(),
+                Size(want as i32),
+                shard_size,
+                data_shards,
+                large_block_size,
+                small_block_size,
+            );
+            // A needle is verifiable locally only if every shard it spans is local;
+            // when any is remote, skip the reassembly buffer entirely.
+            let has_remote_chunks = locations.iter().any(|iv| {
+                let (sid, _) =
+                    iv.to_shard_id_and_offset(data_shards, large_block_size, small_block_size);
+                shards.get(sid as usize).and_then(|s| s.as_ref()).is_none()
+            });
+            let mut read: i64 = 0;
+            // `want <= 0` means the row is malformed. Go pays nothing for it:
+            // it appends to a nil slice and has no capacity hint here. Rust's
+            // per-needle buffer does, and `Vec::with_capacity(negative as usize)`
+            // aborts the process -- inside spawn_blocking that surfaces as a
+            // JoinError and takes the whole node-wide scrub RPC with it. Fall
+            // through with an empty buffer instead: locate_data already returns
+            // no intervals for a non-positive size, so read stays 0 and the
+            // `read != want` check below reports the row, exactly as Go does.
+            let mut data: Vec<u8> = if has_remote_chunks || want <= 0 {
+                Vec::new()
+            } else {
+                Vec::with_capacity(want as usize)
+            };
+            let mut local_shard_ids: Vec<ShardId> = Vec::new();
+
+            for (i, iv) in locations.iter().enumerate() {
+                let (sid, soffset) =
+                    iv.to_shard_id_and_offset(data_shards, large_block_size, small_block_size);
+                let ssize = iv.size;
+                let shard = match shards.get(sid as usize).and_then(|s| s.as_ref()) {
+                    Some(s) => s,
+                    None => {
+                        // Shard is not local; we can't verify it without decoding.
+                        read += ssize;
+                        continue;
+                    }
+                };
+                local_shard_ids.push(sid);
+
+                if soffset + ssize > shard.file_size {
+                    broken_shards.insert(sid);
+                    errs.push(format!(
+                        "local shard {} for needle {} is too short ({}), cannot read chunk {}/{}",
+                        sid,
+                        id.0,
+                        shard.file_size,
+                        i + 1,
+                        locations.len()
+                    ));
+                    continue;
+                }
+
+                chunk_buf.resize(ssize as usize, 0);
+                match shard.read_at(&mut chunk_buf, soffset as u64) {
+                    Err(e) => {
+                        broken_shards.insert(sid);
+                        errs.push(format!(
+                            "failed to read chunk {}/{} for needle {} from local shard {} at offset {}: {}",
+                            i + 1,
+                            locations.len(),
+                            id.0,
+                            sid,
+                            soffset,
+                            e
+                        ));
+                        continue;
+                    }
+                    Ok(got) if got as i64 != ssize => {
+                        broken_shards.insert(sid);
+                        errs.push(format!(
+                            "expected {} bytes for chunk {}/{} for needle {} from local shard {}, got {}",
+                            ssize,
+                            i + 1,
+                            locations.len(),
+                            id.0,
+                            sid,
+                            got
+                        ));
+                        continue;
+                    }
+                    Ok(_) => {}
+                }
+
+                if !has_remote_chunks {
+                    data.extend_from_slice(&chunk_buf);
+                }
+                read += ssize;
+            }
+
+            local_shard_ids.sort_unstable();
+
+            if read != want {
+                // Like Go, returning from the walk callback aborts the scan.
+                return Err(io::Error::other(format!(
+                    "expected {} bytes for needle {} on volume {}, got {}",
+                    want, id.0, volume_id.0, read
+                )));
+            }
+
+            // Only a fully-local needle can be reassembled and CRC-checked.
+            if !has_remote_chunks {
+                let mut n = Needle::default();
+                if let Err(e) = n.read_bytes(&data, 0, size, version) {
+                    // A delete-state disagreement between the .ecx index and the reassembled
+                    // on-disk header (live index vs zero header size) is not corruption.
+                    let delete_state_disagrees = matches!(
+                        &e,
+                        NeedleError::SizeMismatch { found, .. } if size.is_deleted() != (found.0 == 0)
+                    );
+                    if !delete_state_disagrees {
+                        errs.push(format!(
+                            "needle {} on volume {}, shards {:?}: {}",
+                            id.0, volume_id.0, local_shard_ids, e
+                        ));
+                    }
+                }
+            }
+            Ok(())
+        });
+        if let Err(e) = walk {
+            // Go appends the walk/callback error verbatim.
+            errs.push(e.to_string());
+        }
+
+        let mut broken: Vec<crate::pb::volume_server_pb::EcShardInfo> = broken_shards
+            .iter()
+            .filter_map(|sid| shards.get(*sid as usize).and_then(|s| s.as_ref()))
+            .map(|s| s.info.clone())
+            .collect();
+        broken.sort_by_key(|a| a.shard_id);
+
+        (count, broken, errs)
+    }
 }
diff --git a/seaweed-volume/src/storage/erasure_coding/ecj_merge.rs b/seaweed-volume/src/storage/erasure_coding/ecj_merge.rs
new file mode 100644
index 0000000000..d9a3168477
--- /dev/null
+++ b/seaweed-volume/src/storage/erasure_coding/ecj_merge.rs
@@ -0,0 +1,290 @@
+//! Set-union merge of `.ecj` deletion journals for EC shard copy / index
+//! recovery. Mirrors Go's `weed/storage/erasure_coding/ecj_merge.go`.
+//!
+//! An EC volume's deletion journal (`<vid>.ecj`) is a *set* of deleted needle
+//! ids stored as 8-byte big-endian records. Shard copy and index recovery fold
+//! a peer's journal into the local one; they must append only the ids the
+//! local journal lacks, or every `ec_balance` round trip doubles the file.
+//!
+//! The journal is only ever appended to, never replaced: a mounted `EcVolume`
+//! holds it open, and a rename would leave that handle writing to an unlinked
+//! inode, losing every later delete at the next mount. A mounted volume merges
+//! through [`EcVolume::merge_journal`](super::ec_volume::EcVolume::merge_journal);
+//! [`append_ecj_ids`] is for a journal no volume has open.
+
+use std::collections::HashSet;
+use std::fs::{self, OpenOptions};
+use std::io::{self, Read, Seek, SeekFrom, Write};
+use std::path::Path;
+
+use crate::storage::types::{NEEDLE_ID_SIZE, NeedleId};
+use crate::storage::volume::fsync_dir;
+use crate::storage::volume_open::open_volume_file;
+
+/// Bytes per read when scanning a journal; a multiple of `NEEDLE_ID_SIZE`.
+const ECJ_READ_CHUNK_BYTES: usize = 1 << 20;
+
+/// Decodes `.ecj` records from a byte stream split at arbitrary boundaries (a
+/// CopyFile stream, chunked reads), collecting the distinct ids. Memory
+/// follows the number of distinct ids, not the journal's length. A trailing
+/// partial record is never decoded.
+#[derive(Default)]
+pub(crate) struct EcjIdDecoder {
+    ids: HashSet<NeedleId>,
+    partial: [u8; NEEDLE_ID_SIZE],
+    pending: usize,
+}
+
+impl EcjIdDecoder {
+    pub(crate) fn push(&mut self, mut bytes: &[u8]) {
+        if self.pending > 0 {
+            let n = (NEEDLE_ID_SIZE - self.pending).min(bytes.len());
+            self.partial[self.pending..self.pending + n].copy_from_slice(&bytes[..n]);
+            self.pending += n;
+            bytes = &bytes[n..];
+            if self.pending < NEEDLE_ID_SIZE {
+                return;
+            }
+            self.ids.insert(NeedleId::from_bytes(&self.partial));
+            self.pending = 0;
+        }
+        let mut records = bytes.chunks_exact(NEEDLE_ID_SIZE);
+        for record in &mut records {
+            self.ids.insert(NeedleId::from_bytes(record));
+        }
+        let rest = records.remainder();
+        self.partial[..rest.len()].copy_from_slice(rest);
+        self.pending = rest.len();
+    }
+
+    pub(crate) fn into_ids(self) -> HashSet<NeedleId> {
+        self.ids
+    }
+}
+
+/// Read the distinct ids of the journal at `path` in bounded chunks. A missing
+/// file reads as empty. Also returns the whole-record length read; a torn
+/// trailing partial record is excluded from it.
+pub(crate) fn read_ecj_ids(path: &str) -> io::Result<(HashSet<NeedleId>, u64)> {
+    let mut file = match fs::File::open(path) {
+        Ok(f) => f,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok((HashSet::new(), 0)),
+        Err(e) => return Err(e),
+    };
+    let len = file.metadata()?.len();
+    let size = len - len % NEEDLE_ID_SIZE as u64;
+    let mut decoder = EcjIdDecoder::default();
+    let mut buf = vec![0u8; (ECJ_READ_CHUNK_BYTES as u64).min(size) as usize];
+    let mut off = 0u64;
+    while off < size {
+        let want = (buf.len() as u64).min(size - off) as usize;
+        file.read_exact(&mut buf[..want])?;
+        decoder.push(&buf[..want]);
+        off += want as u64;
+    }
+    Ok((decoder.into_ids(), size))
+}
+
+/// The ids of `incoming` that `has` does not report, ascending, so a merge
+/// appends deterministic output.
+pub(crate) fn ecj_delta(
+    incoming: &HashSet<NeedleId>,
+    has: impl Fn(&NeedleId) -> bool,
+) -> Vec<NeedleId> {
+    let mut delta: Vec<NeedleId> = incoming.iter().copied().filter(|id| !has(id)).collect();
+    delta.sort_unstable();
+    delta
+}
+
+pub(crate) fn encode_ecj_ids(ids: &[NeedleId]) -> Vec<u8> {
+    let mut buf = vec![0u8; ids.len() * NEEDLE_ID_SIZE];
+    for (record, id) in buf.chunks_exact_mut(NEEDLE_ID_SIZE).zip(ids) {
+        id.to_bytes(record);
+    }
+    buf
+}
+
+/// Append to the journal at `path` the ids of `incoming` that `local` lacks,
+/// in one write and one fsync, returning how many were added. `local` and
+/// `size` come from [`read_ecj_ids`] on the same path: if the journal's
+/// whole-record length is no longer `size`, returns `Ok(None)` so the caller
+/// re-reads. A torn tail past `size` is truncated first so the new records
+/// stay aligned.
+pub(crate) fn append_ecj_ids(
+    path: &str,
+    local: &HashSet<NeedleId>,
+    incoming: &HashSet<NeedleId>,
+    size: u64,
+) -> io::Result<Option<usize>> {
+    let delta = ecj_delta(incoming, |id| local.contains(id));
+    if delta.is_empty() {
+        return Ok(Some(0));
+    }
+    let created = !Path::new(path).exists();
+    let mut file = open_volume_file(OpenOptions::new().read(true).write(true).create(true), path)?;
+    let len = file.metadata()?.len();
+    if len - len % NEEDLE_ID_SIZE as u64 != size {
+        return Ok(None);
+    }
+    if len != size {
+        file.set_len(size)?;
+    }
+    let appended = file
+        .seek(SeekFrom::Start(size))
+        .and_then(|_| file.write_all(&encode_ecj_ids(&delta)))
+        .and_then(|_| file.sync_all());
+    if let Err(e) = appended {
+        let _ = file.set_len(size);
+        return Err(e);
+    }
+    if created {
+        fsync_dir(path)?;
+    }
+    Ok(Some(delta.len()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn ids(v: &[u64]) -> HashSet<NeedleId> {
+        v.iter().map(|&id| NeedleId(id)).collect()
+    }
+
+    fn bytes(v: &[u64]) -> Vec<u8> {
+        encode_ecj_ids(&v.iter().map(|&id| NeedleId(id)).collect::<Vec<_>>())
+    }
+
+    fn records(path: &str) -> Vec<u64> {
+        let data = fs::read(path).expect("read ecj");
+        assert_eq!(data.len() % NEEDLE_ID_SIZE, 0, "journal must stay aligned");
+        data.chunks_exact(NEEDLE_ID_SIZE)
+            .map(|c| NeedleId::from_bytes(c).0)
+            .collect()
+    }
+
+    /// Run the unmounted merge the way the server does: read, then append.
+    fn merge_file(path: &str, incoming: &HashSet<NeedleId>) -> usize {
+        let (local, size) = read_ecj_ids(path).expect("read");
+        append_ecj_ids(path, &local, incoming, size)
+            .expect("append")
+            .expect("journal unchanged")
+    }
+
+    #[test]
+    fn decoder_handles_records_split_across_chunks() {
+        let mut stream = bytes(&[1, 2, 3, 2, 0x0102030405060708]);
+        stream.extend_from_slice(&[9, 9, 9]);
+        for chunk in 1..=stream.len() {
+            let mut d = EcjIdDecoder::default();
+            for piece in stream.chunks(chunk) {
+                d.push(piece);
+            }
+            assert_eq!(
+                d.into_ids(),
+                ids(&[1, 2, 3, 0x0102030405060708]),
+                "chunk {}",
+                chunk
+            );
+        }
+    }
+
+    #[test]
+    fn read_ecj_ids_dedups_and_ignores_torn_tail() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let missing = dir.path().join("missing.ecj");
+        let (got, size) = read_ecj_ids(missing.to_str().unwrap()).expect("read");
+        assert!(got.is_empty());
+        assert_eq!(size, 0);
+
+        let torn = dir.path().join("torn.ecj");
+        let mut data = bytes(&[1, 2, 1]);
+        data.extend_from_slice(&[7, 7, 7]);
+        fs::write(&torn, data).unwrap();
+        let (got, size) = read_ecj_ids(torn.to_str().unwrap()).expect("read");
+        assert_eq!(got, ids(&[1, 2]));
+        assert_eq!(size, 3 * NEEDLE_ID_SIZE as u64);
+
+        // A bloated journal repeating a few ids across several read chunks
+        // keeps only the distinct ids.
+        let bloated = dir.path().join("bloated.ecj");
+        let data: Vec<u8> = (0..300_000u64).flat_map(|i| bytes(&[i % 3])).collect();
+        fs::write(&bloated, &data).unwrap();
+        let (got, size) = read_ecj_ids(bloated.to_str().unwrap()).expect("read");
+        assert_eq!(got, ids(&[0, 1, 2]));
+        assert_eq!(size, data.len() as u64);
+    }
+
+    #[test]
+    fn appends_only_missing_ids() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("vol.ecj");
+        let path = path.to_str().unwrap();
+        fs::write(path, bytes(&[1, 2, 3])).unwrap();
+        assert_eq!(merge_file(path, &ids(&[3, 4])), 1);
+        assert_eq!(records(path), vec![1, 2, 3, 4]);
+    }
+
+    #[test]
+    fn round_trip_stays_constant() {
+        // A->B->A->B 20 times: the old append path doubled the journal each trip.
+        let dir = tempfile::tempdir().expect("tempdir");
+        let a = dir.path().join("a.ecj");
+        let b = dir.path().join("b.ecj");
+        let (a, b) = (a.to_str().unwrap(), b.to_str().unwrap());
+        fs::write(a, bytes(&[1, 2])).unwrap();
+        fs::write(b, bytes(&[2, 3])).unwrap();
+        for i in 0..20 {
+            let (src, dst) = if i % 2 == 0 { (a, b) } else { (b, a) };
+            let (incoming, _) = read_ecj_ids(src).expect("read");
+            merge_file(dst, &incoming);
+        }
+        for path in [a, b] {
+            let mut got = records(path);
+            got.sort_unstable();
+            assert_eq!(got, vec![1, 2, 3]);
+        }
+    }
+
+    #[test]
+    fn nothing_new_leaves_journal_alone() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let missing = dir.path().join("missing.ecj");
+        assert_eq!(merge_file(missing.to_str().unwrap(), &ids(&[])), 0);
+        assert!(
+            !missing.exists(),
+            "an empty merge must not create a journal"
+        );
+
+        let path = dir.path().join("vol.ecj");
+        let path = path.to_str().unwrap();
+        fs::write(path, bytes(&[1, 2])).unwrap();
+        assert_eq!(merge_file(path, &ids(&[2, 1])), 0);
+        assert_eq!(records(path), vec![1, 2]);
+    }
+
+    #[test]
+    fn repairs_torn_tail() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("vol.ecj");
+        let path = path.to_str().unwrap();
+        let mut data = bytes(&[1, 2]);
+        data.extend_from_slice(&[9, 9, 9]);
+        fs::write(path, data).unwrap();
+        assert_eq!(merge_file(path, &ids(&[3])), 1);
+        assert_eq!(records(path), vec![1, 2, 3]);
+    }
+
+    #[test]
+    fn rejects_changed_journal() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("vol.ecj");
+        let path = path.to_str().unwrap();
+        fs::write(path, bytes(&[1])).unwrap();
+        let (local, size) = read_ecj_ids(path).expect("read");
+        fs::write(path, bytes(&[1, 5])).unwrap();
+        let outcome = append_ecj_ids(path, &local, &ids(&[2]), size).expect("append");
+        assert_eq!(outcome, None);
+        assert_eq!(records(path), vec![1, 5]);
+    }
+}
diff --git a/seaweed-volume/src/storage/erasure_coding/ecj_registry.rs b/seaweed-volume/src/storage/erasure_coding/ecj_registry.rs
new file mode 100644
index 0000000000..426623875b
--- /dev/null
+++ b/seaweed-volume/src/storage/erasure_coding/ecj_registry.rs
@@ -0,0 +1,326 @@
+//! Process-wide coordination of everything that touches one `.ecj` path.
+//!
+//! Mount-time compaction replaces a deletion journal with a new inode. That is
+//! only safe while nothing else in this process can write the old one:
+//!
+//! - **Holders** are mounted `EcVolume`s with an append handle on the path. A
+//!   store holds one `EcVolume` per disk location, and a shard mount or a
+//!   cross-disk reconcile can point one disk's volume at another disk's
+//!   `.ecj`, so several holders of one path are normal. A holder that keeps
+//!   appending to a replaced inode acknowledges deletes that are gone at the
+//!   next mount.
+//! - **Writers** append to or replace the path by name without holding it
+//!   open across calls: `ReceiveFile` of an EC `.ecj`, and the unmounted
+//!   append in `merge_ec_journal`, which `VolumeEcShardsCopy` and EC index
+//!   recovery funnel a peer's journal through. Bytes they write after the
+//!   compactor sized the journal would be dropped by the rename.
+//!
+//! Compaction therefore runs only while its caller is the sole holder and no
+//! writer is active, and while it runs no holder may open the path and no
+//! writer may start. Both wait instead; a compaction rewrites only the distinct
+//! id set, so the wait is short.
+//!
+//! No writer active at the reservation is not enough: one that ran while the
+//! holder loaded the journal, or after, and has finished may have rewritten it
+//! in place to the same length (`ReceiveFile` truncates and refills), which
+//! the inode-and-size re-check cannot see. So each writer bumps the path's
+//! write generation as it starts, and a holder may compact only if no writer
+//! was active when it registered and the generation has not moved since.
+//!
+//! Paths are keyed by their canonical parent directory, so two disk locations
+//! that spell one directory differently still meet here.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Condvar, LazyLock, Mutex, MutexGuard};
+
+#[derive(Default)]
+struct PathState {
+    holders: usize,
+    writers: usize,
+    compacting: bool,
+    /// Writers that have started on the path. Lives as long as the entry,
+    /// which a registered holder keeps.
+    write_gen: u64,
+}
+
+impl PathState {
+    fn idle(&self) -> bool {
+        self.holders == 0 && self.writers == 0 && !self.compacting
+    }
+}
+
+struct Registry {
+    paths: Mutex<HashMap<PathBuf, PathState>>,
+    changed: Condvar,
+}
+
+static REGISTRY: LazyLock<Registry> = LazyLock::new(|| Registry {
+    paths: Mutex::new(HashMap::new()),
+    changed: Condvar::new(),
+});
+
+fn lock() -> MutexGuard<'static, HashMap<PathBuf, PathState>> {
+    // The critical sections only adjust counters and cannot panic midway, so
+    // a poisoned lock still guards consistent state.
+    REGISTRY.paths.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+/// Canonical key for `path`: its resolved parent directory joined with the
+/// file name. The file itself may not exist yet (a copy creates it), so only
+/// the directory is resolved.
+fn key_for(path: &str) -> PathBuf {
+    let p = Path::new(path);
+    let (Some(parent), Some(name)) = (p.parent(), p.file_name()) else {
+        return std::path::absolute(p).unwrap_or_else(|_| p.to_path_buf());
+    };
+    let parent = if parent.as_os_str().is_empty() {
+        Path::new(".")
+    } else {
+        parent
+    };
+    let dir = std::fs::canonicalize(parent)
+        .or_else(|_| std::path::absolute(parent))
+        .unwrap_or_else(|_| parent.to_path_buf());
+    dir.join(name)
+}
+
+/// Block until no compaction is running on `key`, then apply `f` to its state.
+fn update_when_not_compacting<R>(key: &Path, f: impl FnOnce(&mut PathState) -> R) -> R {
+    let mut paths = lock();
+    while paths.get(key).is_some_and(|s| s.compacting) {
+        paths = REGISTRY
+            .changed
+            .wait(paths)
+            .unwrap_or_else(|e| e.into_inner());
+    }
+    f(paths.entry(key.to_path_buf()).or_default())
+}
+
+fn release(key: &Path, f: impl FnOnce(&mut PathState)) {
+    let mut paths = lock();
+    if let Some(state) = paths.get_mut(key) {
+        f(state);
+        if state.idle() {
+            paths.remove(key);
+        }
+    }
+    drop(paths);
+    REGISTRY.changed.notify_all();
+}
+
+/// A mounted `EcVolume`'s registration as a holder of its `.ecj`. Taken before
+/// the journal is opened and released when dropped.
+pub(crate) struct EcjHold {
+    key: PathBuf,
+    /// The path's write generation when the hold was taken, and whether a
+    /// writer was active then. Taken before the journal is opened and loaded,
+    /// so they cover every write the load might have missed.
+    write_gen: u64,
+    writer_at_start: bool,
+}
+
+impl EcjHold {
+    /// Register as a holder of `ecj_path`, first waiting out any compaction in
+    /// progress so the handle opened afterwards is on the final inode.
+    pub(crate) fn acquire(ecj_path: &str) -> Self {
+        let key = key_for(ecj_path);
+        let (write_gen, writer_at_start) = update_when_not_compacting(&key, |s| {
+            s.holders += 1;
+            (s.write_gen, s.writers > 0)
+        });
+        EcjHold {
+            key,
+            write_gen,
+            writer_at_start,
+        }
+    }
+
+    /// Reserve the path for a compaction, or `None` when another holder or an
+    /// active writer could still reach the current inode, or when a writer
+    /// has run on the path since the hold was taken, so the journal may no
+    /// longer be what the holder loaded.
+    pub(crate) fn try_begin_compaction(&self) -> Option<EcjCompaction> {
+        let mut paths = lock();
+        let state = paths.get_mut(&self.key)?;
+        if state.holders != 1 || state.writers != 0 || state.compacting {
+            return None;
+        }
+        if self.writer_at_start || state.write_gen != self.write_gen {
+            return None;
+        }
+        state.compacting = true;
+        Some(EcjCompaction {
+            key: self.key.clone(),
+        })
+    }
+}
+
+impl Drop for EcjHold {
+    fn drop(&mut self) {
+        release(&self.key, |s| s.holders = s.holders.saturating_sub(1));
+    }
+}
+
+/// An exclusive reservation of a `.ecj` path for compaction. Holders and
+/// writers wait until it is dropped.
+pub(crate) struct EcjCompaction {
+    key: PathBuf,
+}
+
+impl Drop for EcjCompaction {
+    fn drop(&mut self) {
+        release(&self.key, |s| s.compacting = false);
+    }
+}
+
+/// An out-of-band writer (shard copy, index recovery, `ReceiveFile`) on a
+/// `.ecj` path.
+/// Compaction does not start while one is alive.
+pub(crate) struct EcjWrite {
+    key: PathBuf,
+}
+
+impl Drop for EcjWrite {
+    fn drop(&mut self) {
+        release(&self.key, |s| s.writers = s.writers.saturating_sub(1));
+    }
+}
+
+/// Register as a writer of `ecj_path`, waiting out any compaction in progress.
+/// Blocks; async callers use [`begin_ecj_write_async`].
+pub(crate) fn begin_ecj_write(ecj_path: &str) -> EcjWrite {
+    let key = key_for(ecj_path);
+    update_when_not_compacting(&key, |s| {
+        s.writers += 1;
+        s.write_gen += 1;
+    });
+    EcjWrite { key }
+}
+
+/// [`begin_ecj_write`] for async handlers: the wait runs on the blocking pool
+/// so a compaction in progress never stalls a runtime worker.
+pub(crate) async fn begin_ecj_write_async(ecj_path: &str) -> EcjWrite {
+    let path = ecj_path.to_string();
+    match tokio::task::spawn_blocking(move || begin_ecj_write(&path)).await {
+        Ok(write) => write,
+        // Only a panic inside the registry lands here, and it leaves no count
+        // behind; registering inline is still correct, merely blocking.
+        Err(_) => begin_ecj_write(ecj_path),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::mpsc;
+    use std::time::Duration;
+    use tempfile::TempDir;
+
+    fn ecj(dir: &TempDir) -> String {
+        dir.path().join("1.ecj").to_str().unwrap().to_string()
+    }
+
+    #[test]
+    fn sole_holder_may_compact() {
+        let dir = TempDir::new().unwrap();
+        let hold = EcjHold::acquire(&ecj(&dir));
+        assert!(hold.try_begin_compaction().is_some());
+    }
+
+    #[test]
+    fn second_holder_blocks_compaction() {
+        let dir = TempDir::new().unwrap();
+        let a = EcjHold::acquire(&ecj(&dir));
+        let b = EcjHold::acquire(&ecj(&dir));
+        assert!(a.try_begin_compaction().is_none());
+        drop(b);
+        assert!(a.try_begin_compaction().is_some());
+    }
+
+    #[test]
+    fn active_writer_blocks_compaction() {
+        let dir = TempDir::new().unwrap();
+        let hold = EcjHold::acquire(&ecj(&dir));
+        let w = begin_ecj_write(&ecj(&dir));
+        assert!(hold.try_begin_compaction().is_none());
+        drop(w);
+        // This hold loaded before the write; a later one may compact.
+        drop(hold);
+        let hold = EcjHold::acquire(&ecj(&dir));
+        assert!(hold.try_begin_compaction().is_some());
+    }
+
+    /// A writer that ran after the hold was taken, or was already running
+    /// then, may have changed the journal the holder loaded, even though it
+    /// has finished by the time compaction asks.
+    #[test]
+    fn finished_writer_since_hold_blocks_compaction() {
+        let dir = TempDir::new().unwrap();
+        let path = ecj(&dir);
+
+        let hold = EcjHold::acquire(&path);
+        drop(begin_ecj_write(&path));
+        assert!(
+            hold.try_begin_compaction().is_none(),
+            "a writer that started after the hold",
+        );
+        drop(hold);
+
+        let w = begin_ecj_write(&path);
+        let hold = EcjHold::acquire(&path);
+        drop(w);
+        assert!(
+            hold.try_begin_compaction().is_none(),
+            "a writer active when the hold was taken",
+        );
+        drop(hold);
+
+        let hold = EcjHold::acquire(&path);
+        assert!(
+            hold.try_begin_compaction().is_some(),
+            "no writer since the hold",
+        );
+    }
+
+    #[test]
+    fn differently_spelled_paths_share_one_key() {
+        let dir = TempDir::new().unwrap();
+        std::fs::create_dir(dir.path().join("sub")).unwrap();
+        let plain = ecj(&dir);
+        let dotted = dir
+            .path()
+            .join("sub")
+            .join("..")
+            .join("1.ecj")
+            .to_str()
+            .unwrap()
+            .to_string();
+        let a = EcjHold::acquire(&plain);
+        let _b = EcjHold::acquire(&dotted);
+        assert!(a.try_begin_compaction().is_none());
+    }
+
+    #[test]
+    fn writer_waits_for_compaction_to_finish() {
+        let dir = TempDir::new().unwrap();
+        let path = ecj(&dir);
+        let hold = EcjHold::acquire(&path);
+        let compaction = hold.try_begin_compaction().unwrap();
+
+        let (tx, rx) = mpsc::channel();
+        let p = path.clone();
+        let t = std::thread::spawn(move || {
+            let _w = begin_ecj_write(&p);
+            tx.send(()).unwrap();
+        });
+        assert!(
+            rx.recv_timeout(Duration::from_millis(100)).is_err(),
+            "a writer must not start while a compaction holds the path",
+        );
+        drop(compaction);
+        rx.recv_timeout(Duration::from_secs(5))
+            .expect("writer must proceed once the compaction ends");
+        t.join().unwrap();
+    }
+}
diff --git a/seaweed-volume/src/storage/erasure_coding/mod.rs b/seaweed-volume/src/storage/erasure_coding/mod.rs
index fd1dab9284..4ed7ab0049 100644
--- a/seaweed-volume/src/storage/erasure_coding/mod.rs
+++ b/seaweed-volume/src/storage/erasure_coding/mod.rs
@@ -9,9 +9,11 @@ pub mod ec_encoder;
 pub mod ec_locate;
 pub mod ec_shard;
 pub mod ec_volume;
+pub mod ecj_merge;
+pub(crate) mod ecj_registry;
 
 pub use ec_shard::{
-    EcVolumeShard, ShardId, DATA_SHARDS_COUNT, MAX_SHARD_COUNT, MIN_TOTAL_DISKS,
-    PARITY_SHARDS_COUNT, TOTAL_SHARDS_COUNT,
+    DATA_SHARDS_COUNT, EcVolumeShard, MAX_SHARD_COUNT, MIN_TOTAL_DISKS, PARITY_SHARDS_COUNT,
+    ShardId, TOTAL_SHARDS_COUNT,
 };
 pub use ec_volume::EcVolume;
diff --git a/seaweed-volume/src/storage/idx/mod.rs b/seaweed-volume/src/storage/idx/mod.rs
index 15392cb39e..a56a91d81b 100644
--- a/seaweed-volume/src/storage/idx/mod.rs
+++ b/seaweed-volume/src/storage/idx/mod.rs
@@ -6,7 +6,7 @@ use crate::storage::needle::needle::get_actual_size;
 use crate::storage::types::*;
 use std::io::{self, Read, Seek, SeekFrom};
 
-const ROWS_TO_READ: usize = 1024;
+pub(crate) const ROWS_TO_READ: usize = 1024;
 
 /// Walk all entries in an .idx file, calling `f` for each.
 /// Mirrors Go's `WalkIndexFile()`.
@@ -21,12 +21,26 @@ where
     let mut buf = vec![0u8; NEEDLE_MAP_ENTRY_SIZE * ROWS_TO_READ];
 
     loop {
-        let count = match reader.read(&mut buf) {
-            Ok(0) => return Ok(()),
-            Ok(n) => n,
-            Err(ref e) if e.kind() == io::ErrorKind::UnexpectedEof => return Ok(()),
-            Err(e) => return Err(e),
-        };
+        // Fill the batch before decoding: `read` may return a count that is
+        // not a multiple of the entry size, and a split entry would misalign
+        // every later row. Go is immune: `ReadAt` fills or errors.
+        let mut count = 0;
+        let mut eof = false;
+        while count < buf.len() {
+            match reader.read(&mut buf[count..]) {
+                Ok(0) => {
+                    eof = true;
+                    break;
+                }
+                Ok(n) => count += n,
+                Err(ref e) if e.kind() == io::ErrorKind::Interrupted => continue,
+                Err(ref e) if e.kind() == io::ErrorKind::UnexpectedEof => {
+                    eof = true;
+                    break;
+                }
+                Err(e) => return Err(e),
+            }
+        }
 
         let mut i = 0;
         while i + NEEDLE_MAP_ENTRY_SIZE <= count {
@@ -34,6 +48,11 @@ where
             f(key, offset, size)?;
             i += NEEDLE_MAP_ENTRY_SIZE;
         }
+
+        // A trailing partial entry at EOF is ignored, as Go does on `io.EOF`.
+        if eof {
+            return Ok(());
+        }
     }
 }
 
@@ -57,7 +76,7 @@ pub fn check_index_file<R: Read + Seek>(
         errs.push(format!("walk index file: {}", e));
     }
 
-    entries.sort_by(|a, b| a.2.cmp(&b.2).then(a.3 .0.cmp(&b.3 .0)));
+    entries.sort_by(|a, b| a.2.cmp(&b.2).then(a.3.0.cmp(&b.3.0)));
 
     // Offset-0 logical tombstones (remote-tier deletes) occupy no physical extent,
     // so they cannot overlap anything — exclude them from the overlap check. They
@@ -177,6 +196,111 @@ mod tests {
         data
     }
 
+    /// Reader that hands back at most `chunk` bytes per `read`. 7 is coprime
+    /// with the 17-byte entry size, so nearly every read ends mid-entry. With
+    /// `interrupts`, every other call fails with `ErrorKind::Interrupted`.
+    struct ShortReader {
+        inner: Cursor<Vec<u8>>,
+        chunk: usize,
+        interrupts: bool,
+        interrupt_next: bool,
+    }
+
+    impl ShortReader {
+        fn new(data: Vec<u8>, interrupts: bool) -> Self {
+            ShortReader {
+                inner: Cursor::new(data),
+                chunk: 7,
+                interrupts,
+                interrupt_next: false,
+            }
+        }
+    }
+
+    impl Read for ShortReader {
+        fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+            if self.interrupt_next {
+                self.interrupt_next = false;
+                return Err(io::Error::from(io::ErrorKind::Interrupted));
+            }
+            self.interrupt_next = self.interrupts;
+            let n = buf.len().min(self.chunk);
+            self.inner.read(&mut buf[..n])
+        }
+    }
+
+    impl Seek for ShortReader {
+        fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
+            self.inner.seek(pos)
+        }
+    }
+
+    fn walk_all<R: Read + Seek>(reader: &mut R, start_from: u64) -> Vec<(NeedleId, i64, Size)> {
+        let mut collected = Vec::new();
+        walk_index_file(reader, start_from, |key, offset, size| {
+            collected.push((key, offset.to_actual_offset(), size));
+            Ok(())
+        })
+        .unwrap();
+        collected
+    }
+
+    /// More than one ROWS_TO_READ batch, so the walk crosses a buffer refill.
+    fn many_entries() -> Vec<(NeedleId, Offset, Size)> {
+        (0..(ROWS_TO_READ as u64 * 2 + 37))
+            .map(|i| {
+                (
+                    NeedleId(i * 7 + 1),
+                    Offset::from_actual_offset(i as i64 * 128),
+                    Size(i as i32 + 1),
+                )
+            })
+            .collect()
+    }
+
+    #[test]
+    fn test_walk_index_file_short_reads_keep_alignment() {
+        let data = idx_bytes(&many_entries());
+        let expected = walk_all(&mut Cursor::new(data.clone()), 0);
+        assert_eq!(expected.len(), ROWS_TO_READ * 2 + 37);
+
+        let mut short = ShortReader::new(data, false);
+        assert_eq!(walk_all(&mut short, 0), expected);
+    }
+
+    #[test]
+    fn test_walk_index_file_retries_interrupted_reads() {
+        let data = idx_bytes(&many_entries());
+        let expected = walk_all(&mut Cursor::new(data.clone()), 0);
+
+        let mut short = ShortReader::new(data, true);
+        assert_eq!(walk_all(&mut short, 0), expected);
+    }
+
+    #[test]
+    fn test_walk_index_file_short_reads_start_from() {
+        let data = idx_bytes(&many_entries());
+        let expected = walk_all(&mut Cursor::new(data.clone()), 0);
+
+        let start = ROWS_TO_READ as u64 + 5;
+        let mut short = ShortReader::new(data, false);
+        assert_eq!(walk_all(&mut short, start), expected[start as usize..]);
+    }
+
+    #[test]
+    fn test_walk_index_file_ignores_trailing_partial_entry() {
+        // A torn final entry is dropped without an error, as Go does on io.EOF.
+        let entries = many_entries();
+        let mut data = idx_bytes(&entries);
+        data.extend_from_slice(&[0xAB; NEEDLE_MAP_ENTRY_SIZE - 1]);
+
+        let expected = walk_all(&mut Cursor::new(idx_bytes(&entries)), 0);
+        assert_eq!(walk_all(&mut Cursor::new(data.clone()), 0), expected);
+
+        let mut short = ShortReader::new(data, false);
+        assert_eq!(walk_all(&mut short, 0), expected);
+    }
+
     #[test]
     fn test_check_index_file_clean() {
         let data = idx_bytes(&[
@@ -213,7 +337,11 @@ mod tests {
         let size = data.len() as i64;
         let (count, errs) = check_index_file(&mut Cursor::new(data), size, Version(3));
         assert_eq!(count, 2, "tombstone row is still counted: {:?}", errs);
-        assert!(errs.is_empty(), "offset-0 tombstone must not overlap: {:?}", errs);
+        assert!(
+            errs.is_empty(),
+            "offset-0 tombstone must not overlap: {:?}",
+            errs
+        );
     }
 
     #[test]
diff --git a/seaweed-volume/src/storage/io.rs b/seaweed-volume/src/storage/io.rs
new file mode 100644
index 0000000000..57d32c44a4
--- /dev/null
+++ b/seaweed-volume/src/storage/io.rs
@@ -0,0 +1,208 @@
+//! Positional file reads.
+//!
+//! Every read here is "these bytes at this offset", never "the next bytes".
+//! The handles are shared — `.dat` and `.idx` descriptors are borrowed from
+//! [`file_pool`](super::needle_map::file_pool), a mounted EC shard's handle is
+//! duplicated into a scrub plan — so no caller may rely on a file position.
+//!
+//! On unix that is `pread(2)` through `std::os::unix::fs::FileExt`. On Windows
+//! it is `seek_read`, which passes the offset through `OVERLAPPED`, so the read
+//! itself is independent of the current cursor.
+//!
+//! What these helpers replace is `try_clone()` + `seek()` + `read()`. A
+//! duplicated handle shares one kernel file offset with the original, so that
+//! sequence is two syscalls against state another thread can move in between:
+//! the seek positions the offset, a concurrent reader or an append moves it,
+//! and the read returns bytes from somewhere else entirely. `seek_read` carries
+//! its own offset in a single call, so there is no window.
+//!
+//! `seek_read` does still advance the cursor as a side effect — Windows updates
+//! the file pointer even for an `OVERLAPPED` read — which nothing here relies
+//! on. A caller that genuinely needs a private position must open the file
+//! again rather than duplicate a handle; see `Volume::dat_scan_plan` in
+//! [`storage::volume`](super::volume).
+
+use std::fs::File;
+use std::io;
+
+/// Reads exactly `buf.len()` bytes from `file` starting at `offset`.
+///
+/// Fails with [`io::ErrorKind::UnexpectedEof`] if the file ends first.
+pub(crate) fn read_exact_at(file: &File, buf: &mut [u8], offset: u64) -> io::Result<()> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::FileExt;
+        file.read_exact_at(buf, offset)?;
+    }
+    #[cfg(windows)]
+    {
+        if read_full_at(file, buf, offset)? < buf.len() {
+            return Err(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                "unexpected EOF in seek_read",
+            ));
+        }
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        compile_error!("Platform not supported: only unix and windows are supported");
+    }
+    Ok(())
+}
+
+/// Reads up to `buf.len()` bytes from `file` starting at `offset`, returning
+/// how many were read.
+///
+/// A short read — including `0` at or past end of file — is not an error; use
+/// [`read_exact_at`] when the whole buffer must be filled.
+pub(crate) fn read_at(file: &File, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::FileExt;
+        file.read_at(buf, offset)
+    }
+    #[cfg(windows)]
+    {
+        use std::os::windows::fs::FileExt;
+        file.seek_read(buf, offset)
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        compile_error!("Platform not supported: only unix and windows are supported");
+    }
+}
+
+/// Reads into `buf` at `offset` until it is full or the file ends, retrying
+/// interrupted reads; returns how many bytes were read.
+///
+/// Unlike [`read_at`], a count below `buf.len()` always means end of file.
+pub(crate) fn read_full_at(file: &File, buf: &mut [u8], offset: u64) -> io::Result<usize> {
+    fill_at(|b, at| read_at(file, b, at), buf, offset)
+}
+
+fn fill_at(
+    mut read: impl FnMut(&mut [u8], u64) -> io::Result<usize>,
+    buf: &mut [u8],
+    offset: u64,
+) -> io::Result<usize> {
+    let mut filled = 0;
+    while filled < buf.len() {
+        match read(&mut buf[filled..], offset + filled as u64) {
+            Ok(0) => break,
+            Ok(n) => filled += n,
+            Err(err) if err.kind() == io::ErrorKind::Interrupted => {}
+            Err(err) => return Err(err),
+        }
+    }
+    Ok(filled)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{fill_at, read_at, read_exact_at, read_full_at};
+    use std::io::{ErrorKind, Write};
+
+    fn temp_file(bytes: &[u8]) -> tempfile::NamedTempFile {
+        let mut f = tempfile::NamedTempFile::new().expect("temp file");
+        f.write_all(bytes).expect("write");
+        f.flush().expect("flush");
+        f
+    }
+
+    #[test]
+    fn read_exact_at_fills_the_whole_buffer() {
+        let f = temp_file(b"0123456789");
+        let mut buf = [0u8; 10];
+        read_exact_at(f.as_file(), &mut buf, 0).expect("read");
+        assert_eq!(&buf, b"0123456789");
+    }
+
+    #[test]
+    fn read_exact_at_reads_from_the_offset() {
+        let f = temp_file(b"0123456789");
+        let mut buf = [0u8; 4];
+        read_exact_at(f.as_file(), &mut buf, 3).expect("read");
+        assert_eq!(&buf, b"3456");
+
+        // The helper is positional: a second read at a lower offset sees the
+        // bytes at that offset, not wherever the first read left a cursor.
+        let mut again = [0u8; 4];
+        read_exact_at(f.as_file(), &mut again, 1).expect("read");
+        assert_eq!(&again, b"1234");
+    }
+
+    #[test]
+    fn read_exact_at_short_file_is_unexpected_eof() {
+        let f = temp_file(b"0123");
+        let mut buf = [0u8; 8];
+        let err = read_exact_at(f.as_file(), &mut buf, 0).expect_err("short file");
+        assert_eq!(err.kind(), ErrorKind::UnexpectedEof);
+    }
+
+    #[test]
+    fn read_at_allows_a_short_read_at_eof() {
+        let f = temp_file(b"0123456789");
+        let mut buf = [0u8; 8];
+
+        let n = read_at(f.as_file(), &mut buf, 6).expect("read");
+        assert_eq!(n, 4);
+        assert_eq!(&buf[..n], b"6789");
+
+        // Entirely past the end is zero bytes, not an error.
+        let n = read_at(f.as_file(), &mut buf, 10).expect("read");
+        assert_eq!(n, 0);
+    }
+
+    /// A source that returns at most `chunk` bytes per call and fails with
+    /// `Interrupted` on its first call, like a network mount under a signal.
+    fn chunked(src: &[u8], chunk: usize) -> impl FnMut(&mut [u8], u64) -> std::io::Result<usize> {
+        let mut interrupted = false;
+        move |buf, at| {
+            if !interrupted {
+                interrupted = true;
+                return Err(ErrorKind::Interrupted.into());
+            }
+            let at = (at as usize).min(src.len());
+            let n = buf.len().min(chunk).min(src.len() - at);
+            buf[..n].copy_from_slice(&src[at..at + n]);
+            Ok(n)
+        }
+    }
+
+    #[test]
+    fn fill_at_fills_across_short_and_interrupted_reads() {
+        let src: Vec<u8> = (0..=255).collect();
+        let mut buf = [0u8; 100];
+        let n = fill_at(chunked(&src, 7), &mut buf, 50).expect("read");
+        assert_eq!(n, buf.len());
+        assert_eq!(&buf[..], &src[50..150]);
+    }
+
+    #[test]
+    fn fill_at_stops_at_end_of_source() {
+        let src: Vec<u8> = (0..=255).collect();
+        let mut buf = [0u8; 100];
+        let n = fill_at(chunked(&src, 7), &mut buf, 200).expect("read");
+        assert_eq!(n, 56);
+        assert_eq!(&buf[..n], &src[200..]);
+    }
+
+    #[test]
+    fn fill_at_propagates_other_errors() {
+        let mut buf = [0u8; 8];
+        let err = fill_at(|_, _| Err(ErrorKind::PermissionDenied.into()), &mut buf, 0)
+            .expect_err("error");
+        assert_eq!(err.kind(), ErrorKind::PermissionDenied);
+    }
+
+    #[test]
+    fn read_full_at_returns_the_short_count_only_at_eof() {
+        let f = temp_file(b"0123456789");
+        let mut buf = [0u8; 8];
+        assert_eq!(read_full_at(f.as_file(), &mut buf, 0).expect("read"), 8);
+        assert_eq!(&buf, b"01234567");
+        assert_eq!(read_full_at(f.as_file(), &mut buf, 6).expect("read"), 4);
+        assert_eq!(&buf[..4], b"6789");
+        assert_eq!(read_full_at(f.as_file(), &mut buf, 10).expect("read"), 0);
+    }
+}
diff --git a/seaweed-volume/src/storage/io_error.rs b/seaweed-volume/src/storage/io_error.rs
new file mode 100644
index 0000000000..a073419302
--- /dev/null
+++ b/seaweed-volume/src/storage/io_error.rs
@@ -0,0 +1,354 @@
+//! Consecutive storage-media error tracking shared by `Volume` and
+//! `EcVolume`. Mirrors Go's `weed/storage/io_error.go`.
+
+use std::io;
+use std::sync::Mutex;
+use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+
+/// Consecutive storage-media errors allowed before the volume is quarantined.
+pub(crate) const IO_ERROR_TOLERANCE: i32 = 3;
+
+/// Returns true for I/O errors that indicate faulty storage media, not
+/// transient/network failures. On Unix this is EIO; on Windows it covers
+/// ERROR_CRC and ERROR_IO_DEVICE, which the kernel returns for failing disks.
+pub(crate) fn is_storage_io_error(e: &io::Error) -> bool {
+    #[cfg(unix)]
+    {
+        e.raw_os_error() == Some(libc::EIO)
+    }
+    #[cfg(windows)]
+    {
+        const ERROR_CRC: i32 = 23;
+        const ERROR_IO_DEVICE: i32 = 1117;
+        return e.raw_os_error() == Some(ERROR_CRC) || e.raw_os_error() == Some(ERROR_IO_DEVICE);
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        false
+    }
+}
+
+/// Consecutive storage-media error state for one volume. `quarantined` is
+/// sticky: once set it survives later successful I/O and is lifted only by
+/// `reset_io_error_state`.
+#[derive(Default)]
+pub(crate) struct IoErrorTracker {
+    last: Mutex<Option<String>>,
+    /// The consecutive error count in the low 32 bits and, in the high 32,
+    /// how many times it has been cleared. They share one word so that
+    /// `record_success_at` updates both in one step: reads record their
+    /// outcomes here without the volume's write lock.
+    streak: AtomicU64,
+    quarantined: AtomicBool,
+}
+
+const STREAK_COUNT_BITS: u64 = 0xffff_ffff;
+
+fn streak_count(streak: u64) -> i32 {
+    (streak & STREAK_COUNT_BITS) as i32
+}
+
+/// `streak` with its count cleared and one more clear on record.
+fn streak_cleared(streak: u64) -> u64 {
+    (streak >> 32).wrapping_add(1) << 32
+}
+
+/// A point in the error streak, taken where a write landed whose success
+/// is only recorded later. See `IoErrorTracker::record_success_at`.
+#[derive(Clone, Copy)]
+pub(crate) struct StreakMark(u64);
+
+impl IoErrorTracker {
+    /// `Some(e)` records a failure, `None` a success. Only storage-media
+    /// failures count; every other outcome clears the count and last error.
+    pub(crate) fn check_read_write_error(&self, err: Option<&io::Error>) {
+        if let Some(e) = err
+            && is_storage_io_error(e)
+        {
+            self.streak.fetch_add(1, Ordering::Relaxed);
+            if let Ok(mut guard) = self.last.lock() {
+                *guard = Some(e.to_string());
+            }
+            crate::metrics::STORAGE_IO_ERROR_COUNTER.inc();
+            return;
+        }
+        self.clear_count();
+        self.clear_last();
+    }
+
+    fn clear_count(&self) {
+        self.update_streak(|streak| Some(streak_cleared(streak)));
+    }
+
+    fn clear_last(&self) {
+        if let Ok(mut guard) = self.last.lock()
+            && guard.is_some()
+        {
+            *guard = None;
+        }
+    }
+
+    /// Apply `f` to the streak atomically; `None` leaves it as it is.
+    /// Returns the streak `f` produced, if any.
+    fn update_streak(&self, mut f: impl FnMut(u64) -> Option<u64>) -> Option<u64> {
+        let mut updated = None;
+        let _ = self
+            .streak
+            .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |streak| {
+                updated = f(streak);
+                updated
+            });
+        updated
+    }
+
+    pub(crate) fn mark(&self) -> StreakMark {
+        StreakMark(self.streak.load(Ordering::Relaxed))
+    }
+
+    /// Record a success as if it had come at `mark`: the errors counted
+    /// before the mark are cleared and the ones counted since still stand,
+    /// as they would had each outcome been recorded in order. A streak
+    /// cleared since the mark is left as it is.
+    pub(crate) fn record_success_at(&self, mark: StreakMark) {
+        let before = streak_count(mark.0);
+        let updated = self.update_streak(|streak| {
+            if streak >> 32 != mark.0 >> 32 {
+                return None;
+            }
+            if streak_count(streak) <= before {
+                return Some(streak_cleared(streak));
+            }
+            Some(streak - before as u64)
+        });
+        // The last error stays when one counted since the mark is left.
+        if updated.is_some_and(|streak| streak_count(streak) == 0) {
+            self.clear_last();
+        }
+    }
+
+    /// The last recorded error, the consecutive count, and the quarantine flag.
+    pub(crate) fn get_io_error_state(&self) -> (Option<String>, i32, bool) {
+        let err = self.last.lock().ok().and_then(|g| g.clone());
+        let count = self.count();
+        let quarantined = self.quarantined.load(Ordering::Relaxed);
+        (err, count, quarantined)
+    }
+
+    fn count(&self) -> i32 {
+        streak_count(self.streak.load(Ordering::Relaxed))
+    }
+
+    pub(crate) fn should_quarantine(&self) -> bool {
+        self.quarantined.load(Ordering::Relaxed) || self.count() >= IO_ERROR_TOLERANCE
+    }
+
+    pub(crate) fn mark_io_quarantined(&self) {
+        self.quarantined.store(true, Ordering::Relaxed);
+    }
+
+    pub(crate) fn reset_io_error_state(&self) {
+        self.clear_count();
+        self.quarantined.store(false, Ordering::Relaxed);
+        if let Ok(mut guard) = self.last.lock() {
+            *guard = None;
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_last_io_error_for_test(&self, err: Option<&str>) {
+        if let Ok(mut guard) = self.last.lock() {
+            *guard = err.map(|value| value.to_string());
+        }
+        if err.is_some() {
+            self.update_streak(|streak| {
+                Some((streak & !STREAK_COUNT_BITS) | IO_ERROR_TOLERANCE as u64)
+            });
+        } else {
+            self.clear_count();
+        }
+    }
+}
+
+// The tracker only reacts to errors `is_storage_io_error` recognises, which is
+// nothing at all on a platform that is neither Unix nor Windows.
+#[cfg(all(test, any(unix, windows)))]
+mod tests {
+    use super::*;
+
+    /// An OS error the platform reports for failing storage media.
+    #[cfg(unix)]
+    fn media_error() -> io::Error {
+        io::Error::from_raw_os_error(libc::EIO)
+    }
+
+    /// An OS error the platform reports for failing storage media.
+    #[cfg(windows)]
+    fn media_error() -> io::Error {
+        const ERROR_IO_DEVICE: i32 = 1117;
+        io::Error::from_raw_os_error(ERROR_IO_DEVICE)
+    }
+
+    #[test]
+    fn check_read_write_error_counts_consecutive_media_errors() {
+        let tracker = IoErrorTracker::default();
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.check_read_write_error(Some(&media_error()));
+
+        let (last, count, quarantined) = tracker.get_io_error_state();
+        assert_eq!(last, Some(media_error().to_string()));
+        assert_eq!(count, 2);
+        assert!(!quarantined);
+    }
+
+    #[test]
+    fn success_clears_the_count_and_the_last_error() {
+        let tracker = IoErrorTracker::default();
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.check_read_write_error(None);
+
+        assert_eq!(tracker.get_io_error_state(), (None, 0, false));
+    }
+
+    #[test]
+    fn non_media_error_clears_the_count() {
+        let tracker = IoErrorTracker::default();
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.check_read_write_error(Some(&io::Error::new(
+            io::ErrorKind::NotFound,
+            "no such file",
+        )));
+
+        assert_eq!(tracker.get_io_error_state(), (None, 0, false));
+    }
+
+    #[test]
+    fn should_quarantine_only_once_the_tolerance_is_reached() {
+        let tracker = IoErrorTracker::default();
+        for _ in 1..IO_ERROR_TOLERANCE {
+            tracker.check_read_write_error(Some(&media_error()));
+            assert!(!tracker.should_quarantine());
+        }
+        tracker.check_read_write_error(Some(&media_error()));
+        assert!(tracker.should_quarantine());
+    }
+
+    #[test]
+    fn quarantine_survives_later_successful_io() {
+        let tracker = IoErrorTracker::default();
+        tracker.mark_io_quarantined();
+        tracker.check_read_write_error(None);
+
+        assert_eq!(tracker.get_io_error_state(), (None, 0, true));
+        assert!(tracker.should_quarantine());
+    }
+
+    #[test]
+    fn success_at_a_mark_keeps_only_the_errors_after_it() {
+        let tracker = IoErrorTracker::default();
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.check_read_write_error(Some(&media_error()));
+        let mark = tracker.mark();
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.record_success_at(mark);
+
+        assert_eq!(
+            tracker.get_io_error_state(),
+            (Some(media_error().to_string()), 1, false)
+        );
+    }
+
+    #[test]
+    fn success_at_a_mark_with_nothing_after_it_clears_the_streak() {
+        let tracker = IoErrorTracker::default();
+        tracker.check_read_write_error(Some(&media_error()));
+        let mark = tracker.mark();
+        tracker.record_success_at(mark);
+
+        assert_eq!(tracker.get_io_error_state(), (None, 0, false));
+    }
+
+    #[test]
+    fn success_at_a_mark_leaves_a_streak_cleared_since() {
+        let tracker = IoErrorTracker::default();
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.check_read_write_error(Some(&media_error()));
+        let mark = tracker.mark();
+        tracker.check_read_write_error(None);
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.record_success_at(mark);
+
+        assert_eq!(
+            tracker.get_io_error_state(),
+            (Some(media_error().to_string()), 1, false)
+        );
+    }
+
+    /// Reads update the tracker without the volume's write lock, so a
+    /// success replayed at a mark must not lose the errors they record
+    /// while it runs.
+    #[test]
+    fn success_at_a_mark_keeps_concurrent_errors() {
+        use std::sync::{Arc, Barrier};
+        const READERS: i32 = 4;
+        const ERRORS: i32 = 200;
+
+        for _ in 0..500 {
+            let tracker = Arc::new(IoErrorTracker::default());
+            tracker.check_read_write_error(Some(&media_error()));
+            tracker.check_read_write_error(Some(&media_error()));
+            let mark = tracker.mark();
+            let start = Arc::new(Barrier::new(READERS as usize + 1));
+            let readers: Vec<_> = (0..READERS)
+                .map(|_| {
+                    let (tracker, start) = (tracker.clone(), start.clone());
+                    std::thread::spawn(move || {
+                        start.wait();
+                        for _ in 0..ERRORS {
+                            tracker.check_read_write_error(Some(&media_error()));
+                        }
+                    })
+                })
+                .collect();
+            start.wait();
+            while tracker.get_io_error_state().1 < 2 + READERS * ERRORS / 2 {
+                std::hint::spin_loop();
+            }
+            tracker.record_success_at(mark);
+            for reader in readers {
+                reader.join().unwrap();
+            }
+            // The two errors before the mark are cleared; every error the
+            // readers recorded after it stands.
+            assert_eq!(tracker.get_io_error_state().1, READERS * ERRORS);
+        }
+    }
+
+    #[test]
+    fn reset_io_error_state_lifts_the_quarantine() {
+        let tracker = IoErrorTracker::default();
+        tracker.check_read_write_error(Some(&media_error()));
+        tracker.mark_io_quarantined();
+        tracker.reset_io_error_state();
+
+        assert_eq!(tracker.get_io_error_state(), (None, 0, false));
+        assert!(!tracker.should_quarantine());
+    }
+
+    #[test]
+    fn test_helper_arms_a_sustained_error() {
+        let tracker = IoErrorTracker::default();
+        tracker.set_last_io_error_for_test(Some("input/output error"));
+        assert!(tracker.should_quarantine());
+        assert_eq!(
+            tracker.get_io_error_state(),
+            (
+                Some("input/output error".to_string()),
+                IO_ERROR_TOLERANCE,
+                false
+            )
+        );
+
+        tracker.set_last_io_error_for_test(None);
+        assert_eq!(tracker.get_io_error_state(), (None, 0, false));
+    }
+}
diff --git a/seaweed-volume/src/storage/mod.rs b/seaweed-volume/src/storage/mod.rs
index 9ded27ac05..dab21dd2d9 100644
--- a/seaweed-volume/src/storage/mod.rs
+++ b/seaweed-volume/src/storage/mod.rs
@@ -1,14 +1,21 @@
 pub mod disk_location;
 pub mod erasure_coding;
 pub mod idx;
+pub(crate) mod io;
+pub(crate) mod io_error;
 pub mod needle;
 pub mod needle_map;
 pub mod store;
+pub mod store_ec_journal;
 pub mod store_ec_mirror;
 pub mod store_ec_reconcile;
 pub mod super_block;
 pub mod types;
+pub mod vid_stamp;
 pub mod volume;
+pub mod volume_idx_rebuild;
 pub mod volume_idx_repair;
+pub mod volume_open;
 pub mod volume_report;
 pub mod volume_report_hash;
+pub mod volume_tail_repair;
diff --git a/seaweed-volume/src/storage/needle/crc.rs b/seaweed-volume/src/storage/needle/crc.rs
index 6225c8495f..02b107ede6 100644
--- a/seaweed-volume/src/storage/needle/crc.rs
+++ b/seaweed-volume/src/storage/needle/crc.rs
@@ -21,7 +21,7 @@ impl CRC {
     /// Legacy `.Value()` function — deprecated in Go but needed for backward compat check.
     /// Formula: (crc >> 15 | crc << 17) + 0xa282ead8
     pub fn legacy_value(&self) -> u32 {
-        (self.0 >> 15 | self.0 << 17).wrapping_add(0xa282ead8)
+        self.0.rotate_right(15).wrapping_add(0xa282ead8)
     }
 }
 
@@ -67,7 +67,9 @@ mod tests {
     fn test_crc_legacy_value() {
         let crc = CRC(0x12345678);
         let v = crc.legacy_value();
-        let expected = (0x12345678u32 >> 15 | 0x12345678u32 << 17).wrapping_add(0xa282ead8);
+        // (0x12345678 >> 15 | 0x12345678 << 17) + 0xa282ead8, worked out by hand so
+        // the test checks the rotate rather than restating it.
+        let expected = 0x4f730f40_u32;
         assert_eq!(v, expected);
     }
 }
diff --git a/seaweed-volume/src/storage/needle/mod.rs b/seaweed-volume/src/storage/needle/mod.rs
index 364c6122a6..c009dddf89 100644
--- a/seaweed-volume/src/storage/needle/mod.rs
+++ b/seaweed-volume/src/storage/needle/mod.rs
@@ -1,4 +1,8 @@
 pub mod crc;
+#[expect(
+    clippy::module_inception,
+    reason = "needle/needle.rs mirrors the Go package layout"
+)]
 pub mod needle;
 pub mod ttl;
 
diff --git a/seaweed-volume/src/storage/needle/needle.rs b/seaweed-volume/src/storage/needle/needle.rs
index 81384d47b5..d61cb22002 100644
--- a/seaweed-volume/src/storage/needle/needle.rs
+++ b/seaweed-volume/src/storage/needle/needle.rs
@@ -198,8 +198,8 @@ impl Needle {
     /// the data payload from disk at all, matching Go's `ReadNeedleMeta`.
     pub fn read_paged_meta(
         &mut self,
-        header_bytes: &[u8],   // first 20 bytes: NEEDLE_HEADER_SIZE + DATA_SIZE_SIZE
-        meta_bytes: &[u8],     // tail: non-data body metadata + checksum + timestamp + padding
+        header_bytes: &[u8], // first 20 bytes: NEEDLE_HEADER_SIZE + DATA_SIZE_SIZE
+        meta_bytes: &[u8],   // tail: non-data body metadata + checksum + timestamp + padding
         offset: i64,
         expected_size: Size,
         version: Version,
@@ -560,7 +560,7 @@ impl Needle {
 
         // Padding to 8-byte alignment
         let padding = padding_length(self.size, version).0 as usize;
-        buf.extend(std::iter::repeat(0u8).take(padding));
+        buf.extend(std::iter::repeat_n(0u8, padding));
 
         buf
     }
@@ -581,23 +581,19 @@ impl Needle {
 // ============================================================================
 
 /// Compute padding to align needle to NEEDLE_PADDING_SIZE (8 bytes).
+///
+/// The sum is formed in i64: a size read from a corrupt header can sit near
+/// `i32::MAX`, and adding the header, checksum and timestamp widths to it in
+/// i32 would overflow (a panic with overflow checks, a wrapped padding
+/// without). The result is at most NEEDLE_PADDING_SIZE, so it fits `Size`.
 pub fn padding_length(needle_size: Size, version: Version) -> Size {
-    if version == VERSION_3 {
-        Size(
-            NEEDLE_PADDING_SIZE as i32
-                - ((NEEDLE_HEADER_SIZE as i32
-                    + needle_size.0
-                    + NEEDLE_CHECKSUM_SIZE as i32
-                    + TIMESTAMP_SIZE as i32)
-                    % NEEDLE_PADDING_SIZE as i32),
-        )
+    let fixed = if version == VERSION_3 {
+        NEEDLE_HEADER_SIZE + NEEDLE_CHECKSUM_SIZE + TIMESTAMP_SIZE
     } else {
-        Size(
-            NEEDLE_PADDING_SIZE as i32
-                - ((NEEDLE_HEADER_SIZE as i32 + needle_size.0 + NEEDLE_CHECKSUM_SIZE as i32)
-                    % NEEDLE_PADDING_SIZE as i32),
-        )
-    }
+        NEEDLE_HEADER_SIZE + NEEDLE_CHECKSUM_SIZE
+    };
+    let unpadded = fixed as i64 + needle_size.0 as i64;
+    Size((NEEDLE_PADDING_SIZE as i64 - unpadded % NEEDLE_PADDING_SIZE as i64) as i32)
 }
 
 /// Body length = Size + Checksum + [Timestamp] + Padding.
@@ -619,6 +615,30 @@ pub fn get_actual_size(size: Size, version: Version) -> i64 {
     NEEDLE_HEADER_SIZE as i64 + needle_body_length(size, version)
 }
 
+/// Validate a wire-supplied needle body size before any `as usize` cast.
+/// Rejects negative/deleted sizes and bodies larger than the gRPC max message.
+/// Size(0) is allowed: empty/anomalous entries and tombstones read as size 0
+/// (actual_size = header+checksum+pad > 0, safe alloc, no wrap).
+/// Transport cap only: storage paths must NOT use this cap — see volume.rs
+/// guards (a >1GiB stored needle from a high-limit cluster must remain
+/// readable/compaction-safe). Keep `get_actual_size` unchanged (it
+/// intentionally returns negative for deleted index entries).
+pub fn validate_wire_size(size: Size) -> Result<(), String> {
+    if size.0 < 0 {
+        return Err(format!("invalid needle size {}", size.0));
+    }
+    // Keep in sync with canonical `GRPC_MAX_MESSAGE_SIZE` in server/grpc_client.rs:10
+    // (duplicated here to avoid a storage->server import and prevent drift).
+    const WIRE_MAX_NEEDLE_SIZE: i32 = 1 << 30;
+    if size.0 > WIRE_MAX_NEEDLE_SIZE {
+        return Err(format!(
+            "needle size {} exceeds max {}",
+            size.0, WIRE_MAX_NEEDLE_SIZE
+        ));
+    }
+    Ok(())
+}
+
 /// Read 5 bytes as a u64 (big-endian, zero-padded high bytes).
 fn bytes_to_u64_5(bytes: &[u8]) -> u64 {
     assert!(bytes.len() >= 5);
@@ -729,6 +749,14 @@ pub fn parse_needle_id_cookie(s: &str) -> Result<(NeedleId, Cookie), String> {
         (s, None)
     };
 
+    // Every length check and the split below are in BYTES, so a multi-byte
+    // character would let `split` land inside one and panic the slice. Hex is
+    // ASCII by definition; reject anything else up front, as Go's ParseUint
+    // does a step later.
+    if !hex_part.is_ascii() {
+        return Err("KeyHash must be ASCII hex.".to_string());
+    }
+
     // Go: len(key_hash_string) <= CookieSize*2 => error (must be > 8 hex chars)
     if hex_part.len() <= COOKIE_SIZE * 2 {
         return Err("KeyHash is too short.".to_string());
@@ -770,7 +798,9 @@ pub fn parse_needle_id_cookie(s: &str) -> Result<(NeedleId, Cookie), String> {
 
 #[derive(Debug, thiserror::Error)]
 pub enum NeedleError {
-    #[error("size mismatch at offset {offset}: found id={id} size={found:?}, expected size={expected:?}")]
+    #[error(
+        "size mismatch at offset {offset}: found id={id} size={found:?}, expected size={expected:?}"
+    )]
     SizeMismatch {
         offset: i64,
         id: NeedleId,
@@ -806,6 +836,30 @@ pub enum NeedleError {
 mod tests {
     use super::*;
 
+    /// A fid whose hex part carries multi-byte UTF-8 must be rejected, not
+    /// panic. `split` is a byte offset into `hex_part`; before the ASCII guard
+    /// `&hex_part[..split]` could land inside a character. `GET /3,ééééa` is
+    /// nine bytes, so it passes the length checks and splits at byte 1 —
+    /// halfway through the first `é`. Go's `ParseUint` just errors.
+    #[test]
+    fn parse_needle_id_cookie_rejects_non_ascii_instead_of_panicking() {
+        for s in ["ééééa", "ééééaaaaa", "0123456é9abc", "ééééa_1"] {
+            assert!(
+                parse_needle_id_cookie(s).is_err(),
+                "non-ASCII fid {:?} must be an error",
+                s
+            );
+        }
+    }
+
+    /// The ASCII guard must not change any accepted input.
+    #[test]
+    fn parse_needle_id_cookie_still_accepts_ascii_hex() {
+        let (id, cookie) = parse_needle_id_cookie("01637037d6").unwrap();
+        assert_eq!(id, NeedleId(0x01));
+        assert_eq!(cookie, Cookie(0x637037d6));
+    }
+
     #[test]
     fn test_parse_header() {
         let mut buf = [0u8; NEEDLE_HEADER_SIZE];
@@ -824,11 +878,13 @@ mod tests {
 
     #[test]
     fn test_needle_write_read_round_trip_v3() {
-        let mut n = Needle::default();
-        n.cookie = Cookie(42);
-        n.id = NeedleId(100);
-        n.data = b"hello world".to_vec();
-        n.flags = 0;
+        let mut n = Needle {
+            cookie: Cookie(42),
+            id: NeedleId(100),
+            data: b"hello world".to_vec(),
+            flags: 0,
+            ..Needle::default()
+        };
         n.set_has_name();
         n.name = b"test.txt".to_vec();
         n.name_size = 8;
@@ -867,11 +923,13 @@ mod tests {
 
     #[test]
     fn test_needle_write_read_round_trip_v2() {
-        let mut n = Needle::default();
-        n.cookie = Cookie(77);
-        n.id = NeedleId(200);
-        n.data = b"data v2".to_vec();
-        n.flags = 0;
+        let mut n = Needle {
+            cookie: Cookie(77),
+            id: NeedleId(200),
+            data: b"data v2".to_vec(),
+            flags: 0,
+            ..Needle::default()
+        };
 
         let bytes = n.write_bytes(VERSION_2);
         let expected_size = get_actual_size(n.size, VERSION_2);
@@ -886,10 +944,12 @@ mod tests {
 
     #[test]
     fn test_read_bytes_meta_only_handles_tombstone_v3() {
-        let mut tombstone = Needle::default();
-        tombstone.cookie = Cookie(0x1234abcd);
-        tombstone.id = NeedleId(300);
-        tombstone.append_at_ns = 999_999;
+        let mut tombstone = Needle {
+            cookie: Cookie(0x1234abcd),
+            id: NeedleId(300),
+            append_at_ns: 999_999,
+            ..Needle::default()
+        };
 
         let bytes = tombstone.write_bytes(VERSION_3);
 
@@ -917,6 +977,21 @@ mod tests {
         }
     }
 
+    #[test]
+    fn padding_length_does_not_overflow_on_a_corrupt_size() {
+        // A header read from a corrupt or truncated file can carry any i32
+        // size. The scanners bound it against the bytes left before sizing a
+        // buffer, but on a volume with more than 2 GiB left a size near
+        // i32::MAX passes that bound, so the padding arithmetic itself must
+        // not overflow. Overflow checks are on in test builds, so an i32 sum
+        // here would panic rather than wrap.
+        for version in [VERSION_2, VERSION_3] {
+            let padding = padding_length(Size(i32::MAX), version).0 as i64;
+            assert!((1..=NEEDLE_PADDING_SIZE as i64).contains(&padding));
+            assert_eq!(get_actual_size(Size(i32::MAX), version) % 8, 0);
+        }
+    }
+
     #[test]
     fn test_file_id_parse() {
         let fid = FileId::parse("3,01637037d6").unwrap();
@@ -961,4 +1036,16 @@ mod tests {
         assert_eq!(fid.key, NeedleId(0x123));
         assert_eq!(fid.cookie, Cookie(0));
     }
+
+    #[test]
+    fn test_validate_wire_size_boundaries() {
+        assert!(validate_wire_size(Size(-100)).is_err());
+        assert!(validate_wire_size(Size(-1)).is_err());
+        assert!(validate_wire_size(Size(0)).is_ok());
+        assert!(validate_wire_size(Size(1024)).is_ok());
+        assert!(validate_wire_size(Size(1)).is_ok());
+        assert!(validate_wire_size(Size(1 << 30)).is_ok());
+        assert!(validate_wire_size(Size((1 << 30) + 1)).is_err());
+        assert!(validate_wire_size(Size(i32::MAX)).is_err());
+    }
 }
diff --git a/seaweed-volume/src/storage/needle/ttl.rs b/seaweed-volume/src/storage/needle/ttl.rs
index f55cb082ff..f4a059560f 100644
--- a/seaweed-volume/src/storage/needle/ttl.rs
+++ b/seaweed-volume/src/storage/needle/ttl.rs
@@ -80,8 +80,14 @@ impl TTL {
         if s.is_empty() {
             return Ok(TTL::EMPTY);
         }
+        // The unit is read as the last BYTE and the count as everything before
+        // it, so a trailing multi-byte character would split inside itself and
+        // panic. A TTL is digits plus a one-letter unit; reject the rest.
+        if !s.is_ascii() {
+            return Err(format!("invalid TTL {:?}: must be ASCII", s));
+        }
         let last_byte = s.as_bytes()[s.len() - 1];
-        let (num_str, unit_byte) = if last_byte >= b'0' && last_byte <= b'9' {
+        let (num_str, unit_byte) = if last_byte.is_ascii_digit() {
             // All digits — default to minutes (matching Go)
             (s, b'm')
         } else {
@@ -144,40 +150,73 @@ fn fit_ttl_count(count: u32, unit: u8) -> TTL {
     const MINUTE_SECS: u64 = 60;
 
     // First pass: try exact fits from largest to smallest
-    if seconds % YEAR_SECS == 0 && seconds / YEAR_SECS < 256 {
-        return TTL { count: (seconds / YEAR_SECS) as u8, unit: TTL_UNIT_YEAR };
+    if seconds.is_multiple_of(YEAR_SECS) && seconds / YEAR_SECS < 256 {
+        return TTL {
+            count: (seconds / YEAR_SECS) as u8,
+            unit: TTL_UNIT_YEAR,
+        };
     }
-    if seconds % MONTH_SECS == 0 && seconds / MONTH_SECS < 256 {
-        return TTL { count: (seconds / MONTH_SECS) as u8, unit: TTL_UNIT_MONTH };
+    if seconds.is_multiple_of(MONTH_SECS) && seconds / MONTH_SECS < 256 {
+        return TTL {
+            count: (seconds / MONTH_SECS) as u8,
+            unit: TTL_UNIT_MONTH,
+        };
     }
-    if seconds % WEEK_SECS == 0 && seconds / WEEK_SECS < 256 {
-        return TTL { count: (seconds / WEEK_SECS) as u8, unit: TTL_UNIT_WEEK };
+    if seconds.is_multiple_of(WEEK_SECS) && seconds / WEEK_SECS < 256 {
+        return TTL {
+            count: (seconds / WEEK_SECS) as u8,
+            unit: TTL_UNIT_WEEK,
+        };
     }
-    if seconds % DAY_SECS == 0 && seconds / DAY_SECS < 256 {
-        return TTL { count: (seconds / DAY_SECS) as u8, unit: TTL_UNIT_DAY };
+    if seconds.is_multiple_of(DAY_SECS) && seconds / DAY_SECS < 256 {
+        return TTL {
+            count: (seconds / DAY_SECS) as u8,
+            unit: TTL_UNIT_DAY,
+        };
     }
-    if seconds % HOUR_SECS == 0 && seconds / HOUR_SECS < 256 {
-        return TTL { count: (seconds / HOUR_SECS) as u8, unit: TTL_UNIT_HOUR };
+    if seconds.is_multiple_of(HOUR_SECS) && seconds / HOUR_SECS < 256 {
+        return TTL {
+            count: (seconds / HOUR_SECS) as u8,
+            unit: TTL_UNIT_HOUR,
+        };
     }
     // Minutes: truncating division
     if seconds / MINUTE_SECS < 256 {
-        return TTL { count: (seconds / MINUTE_SECS) as u8, unit: TTL_UNIT_MINUTE };
+        return TTL {
+            count: (seconds / MINUTE_SECS) as u8,
+            unit: TTL_UNIT_MINUTE,
+        };
     }
     // Second pass: truncating division from smallest to largest
     if seconds / HOUR_SECS < 256 {
-        return TTL { count: (seconds / HOUR_SECS) as u8, unit: TTL_UNIT_HOUR };
+        return TTL {
+            count: (seconds / HOUR_SECS) as u8,
+            unit: TTL_UNIT_HOUR,
+        };
     }
     if seconds / DAY_SECS < 256 {
-        return TTL { count: (seconds / DAY_SECS) as u8, unit: TTL_UNIT_DAY };
+        return TTL {
+            count: (seconds / DAY_SECS) as u8,
+            unit: TTL_UNIT_DAY,
+        };
     }
     if seconds / WEEK_SECS < 256 {
-        return TTL { count: (seconds / WEEK_SECS) as u8, unit: TTL_UNIT_WEEK };
+        return TTL {
+            count: (seconds / WEEK_SECS) as u8,
+            unit: TTL_UNIT_WEEK,
+        };
     }
     if seconds / MONTH_SECS < 256 {
-        return TTL { count: (seconds / MONTH_SECS) as u8, unit: TTL_UNIT_MONTH };
+        return TTL {
+            count: (seconds / MONTH_SECS) as u8,
+            unit: TTL_UNIT_MONTH,
+        };
     }
     if seconds / YEAR_SECS < 256 {
-        return TTL { count: (seconds / YEAR_SECS) as u8, unit: TTL_UNIT_YEAR };
+        return TTL {
+            count: (seconds / YEAR_SECS) as u8,
+            unit: TTL_UNIT_YEAR,
+        };
     }
     TTL::EMPTY
 }
@@ -207,6 +246,16 @@ impl fmt::Display for TTL {
 mod tests {
     use super::*;
 
+    /// `?ttl=5%C3%A9` must be an error, not a panic. The unit is taken as the
+    /// last *byte*, so a trailing multi-byte character made `&s[..s.len()-1]`
+    /// split inside it.
+    #[test]
+    fn ttl_read_rejects_non_ascii_instead_of_panicking() {
+        for s in ["5é", "é", "3🦀", "12é"] {
+            assert!(TTL::read(s).is_err(), "non-ASCII TTL {:?} must error", s);
+        }
+    }
+
     #[test]
     fn test_ttl_parse() {
         let ttl = TTL::read("3m").unwrap();
@@ -225,7 +274,13 @@ mod tests {
         // 24h normalizes to 1d via fitTtlCount
         let ttl = TTL::read("24h").unwrap();
         assert_eq!(ttl.to_seconds(), 86400);
-        assert_eq!(ttl, TTL { count: 1, unit: TTL_UNIT_DAY });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 1,
+                unit: TTL_UNIT_DAY
+            }
+        );
     }
 
     #[test]
@@ -271,12 +326,24 @@ mod tests {
     fn test_ttl_overflow_normalizes() {
         // Go's ReadTTL calls fitTtlCount: 300m = 18000s = 5h (exact fit)
         let ttl = TTL::read("300m").unwrap();
-        assert_eq!(ttl, TTL { count: 5, unit: TTL_UNIT_HOUR });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 5,
+                unit: TTL_UNIT_HOUR
+            }
+        );
 
         // 256h = 921600s. Doesn't fit in hours (256 >= 256), doesn't fit exact in days.
         // Second pass: 921600/86400 = 10 (truncated) < 256 -> 10d
         let ttl = TTL::read("256h").unwrap();
-        assert_eq!(ttl, TTL { count: 10, unit: TTL_UNIT_DAY });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 10,
+                unit: TTL_UNIT_DAY
+            }
+        );
     }
 
     #[test]
@@ -284,19 +351,49 @@ mod tests {
         // Go's ReadTTL calls fitTtlCount which normalizes to coarsest unit.
         // 120m -> 2h, 7d -> 1w, 24h -> 1d.
         let ttl = TTL::read("120m").unwrap();
-        assert_eq!(ttl, TTL { count: 2, unit: TTL_UNIT_HOUR });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 2,
+                unit: TTL_UNIT_HOUR
+            }
+        );
 
         let ttl = TTL::read("7d").unwrap();
-        assert_eq!(ttl, TTL { count: 1, unit: TTL_UNIT_WEEK });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 1,
+                unit: TTL_UNIT_WEEK
+            }
+        );
 
         let ttl = TTL::read("24h").unwrap();
-        assert_eq!(ttl, TTL { count: 1, unit: TTL_UNIT_DAY });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 1,
+                unit: TTL_UNIT_DAY
+            }
+        );
 
         // Values that don't simplify stay as-is
         let ttl = TTL::read("5d").unwrap();
-        assert_eq!(ttl, TTL { count: 5, unit: TTL_UNIT_DAY });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 5,
+                unit: TTL_UNIT_DAY
+            }
+        );
 
         let ttl = TTL::read("3m").unwrap();
-        assert_eq!(ttl, TTL { count: 3, unit: TTL_UNIT_MINUTE });
+        assert_eq!(
+            ttl,
+            TTL {
+                count: 3,
+                unit: TTL_UNIT_MINUTE
+            }
+        );
     }
 }
diff --git a/seaweed-volume/src/storage/needle_map.rs b/seaweed-volume/src/storage/needle_map.rs
index 2d0dfb4568..9e683f0c9d 100644
--- a/seaweed-volume/src/storage/needle_map.rs
+++ b/seaweed-volume/src/storage/needle_map.rs
@@ -8,13 +8,21 @@
 //! Loaded from .idx file on volume mount. Supports Get, Put, Delete with
 //! metrics tracking (file count, byte count, deleted count, deleted bytes).
 
-use std::collections::HashMap;
+use std::collections::BTreeMap;
 use std::io::{self, Read, Seek, Write};
 use std::path::Path;
 use std::sync::atomic::{AtomicI64, AtomicU64, Ordering};
 
+#[cfg(feature = "redb-experimental-cursor")]
+use std::ops::Bound;
+
 mod compact_map;
+pub mod file_pool;
+mod idx_metric;
+pub mod sorted_file;
 use compact_map::CompactMap;
+use idx_metric::metrics_from_idx;
+use sorted_file::SortedFileNeedleMap;
 
 use redb::{Database, Durability, ReadableDatabase, ReadableTable, TableDefinition};
 
@@ -52,6 +60,15 @@ fn unpack_needle_value(bytes: &[u8; PACKED_NEEDLE_VALUE_SIZE]) -> NeedleValue {
     }
 }
 
+fn packed_to_needle_value(bytes: &[u8]) -> Option<NeedleValue> {
+    if bytes.len() != PACKED_NEEDLE_VALUE_SIZE {
+        return None;
+    }
+    let mut arr = [0u8; PACKED_NEEDLE_VALUE_SIZE];
+    arr.copy_from_slice(bytes);
+    Some(unpack_needle_value(&arr))
+}
+
 // ============================================================================
 // NeedleMapMetric
 // ============================================================================
@@ -80,12 +97,13 @@ impl NeedleMapMetric {
         self.file_byte_count
             .fetch_add(new_size.0 as u64, Ordering::Relaxed);
         // Go: if oldSize > 0 && oldSize.IsValid() { LogDeletionCounter(oldSize) }
-        if let Some(old_val) = old {
-            if old_val.size.0 > 0 && old_val.size.is_valid() {
-                self.deletion_count.fetch_add(1, Ordering::Relaxed);
-                self.deletion_byte_count
-                    .fetch_add(old_val.size.0 as u64, Ordering::Relaxed);
-            }
+        if let Some(old_val) = old
+            && old_val.size.0 > 0
+            && old_val.size.is_valid()
+        {
+            self.deletion_count.fetch_add(1, Ordering::Relaxed);
+            self.deletion_byte_count
+                .fetch_add(old_val.size.0 as u64, Ordering::Relaxed);
         }
     }
 
@@ -151,19 +169,52 @@ pub enum NeedleMapKind {
     RedbLarge,
 }
 
+impl NeedleMapKind {
+    /// Bytes of redb page cache to give ONE volume's index database.
+    ///
+    /// A volume server opens a separate redb database per volume, so the
+    /// process-wide ceiling is roughly (open volumes x this budget). redb's
+    /// own default is 1 GiB per database, which with hundreds of volumes
+    /// grows without practical bound as traffic touches them (#11179).
+    /// These tiers mirror the Go server's LevelDB sizing (block cache +
+    /// write buffer of 3/6/12 MiB), rounded to powers of two.
+    pub fn redb_cache_bytes(self) -> usize {
+        const MIB: usize = 1024 * 1024;
+        match self {
+            // InMemory never opens redb; return the smallest tier so a
+            // caller that does not branch on kind still gets a sane bound.
+            NeedleMapKind::InMemory | NeedleMapKind::Redb => 4 * MIB,
+            NeedleMapKind::RedbMedium => 8 * MIB,
+            NeedleMapKind::RedbLarge => 16 * MIB,
+        }
+    }
+}
+
 // ============================================================================
 // IdxFileWriter trait
 // ============================================================================
 
 /// Trait for appending to an index file.
-pub trait IdxFileWriter: Write + Send + Sync {
+///
+/// The file is opened without append mode and each row is written at the
+/// current `idx_file_offset` — the same positioned-write model the Go
+/// server uses — because an append-mode handle cannot truncate on Windows,
+/// where the std library keeps it strictly append-only.
+pub trait IdxFileWriter: Write + Seek + Send + Sync {
     fn sync_all(&self) -> io::Result<()>;
+    /// Truncate the file to `len` bytes. Used to remove an orphan .idx row
+    /// left by a failed redb commit so `idx_file_offset` stays a contiguous
+    /// replay watermark.
+    fn truncate_to(&mut self, len: u64) -> io::Result<()>;
 }
 
 impl IdxFileWriter for std::fs::File {
     fn sync_all(&self) -> io::Result<()> {
         std::fs::File::sync_all(self)
     }
+    fn truncate_to(&mut self, len: u64) -> io::Result<()> {
+        self.set_len(len)
+    }
 }
 
 // ============================================================================
@@ -178,6 +229,15 @@ pub struct CompactNeedleMap {
     metric: NeedleMapMetric,
     idx_file: Option<Box<dyn IdxFileWriter>>,
     idx_file_offset: u64,
+    /// The file holds bytes past `idx_file_offset` that must be trimmed
+    /// before another row can land aligned.
+    idx_torn: bool,
+}
+
+impl Default for CompactNeedleMap {
+    fn default() -> Self {
+        Self::new()
+    }
 }
 
 impl CompactNeedleMap {
@@ -188,6 +248,7 @@ impl CompactNeedleMap {
             metric: NeedleMapMetric::default(),
             idx_file: None,
             idx_file_offset: 0,
+            idx_torn: false,
         }
     }
 
@@ -195,6 +256,8 @@ impl CompactNeedleMap {
     pub fn load_from_idx<R: Read + Seek>(reader: &mut R, version: Version) -> io::Result<Self> {
         let mut nm = CompactNeedleMap::new();
         idx::walk_index_file(reader, 0, |key, offset, size| {
+            // A read-only load attaches no writer, so this is its only size.
+            nm.idx_file_offset += NEEDLE_MAP_ENTRY_SIZE as u64;
             nm.metric.maybe_set_max_needle_end(offset, size, version);
             if offset.is_zero() || size.is_deleted() {
                 nm.delete_from_map(key);
@@ -210,6 +273,7 @@ impl CompactNeedleMap {
     pub fn set_idx_file(&mut self, file: Box<dyn IdxFileWriter>, offset: u64) {
         self.idx_file = Some(file);
         self.idx_file_offset = offset;
+        self.idx_torn = false;
     }
 
     /// True when an .idx file writer is attached. A read-only load leaves
@@ -224,8 +288,8 @@ impl CompactNeedleMap {
     /// Insert or update an entry. Appends to .idx file if present.
     pub fn put(&mut self, key: NeedleId, offset: Offset, size: Size) -> io::Result<()> {
         // Persist to idx file BEFORE mutating in-memory state for crash consistency
-        if let Some(ref mut idx_file) = self.idx_file {
-            idx::write_index_entry(idx_file, key, offset, size)?;
+        self.append_to_index_file(key, offset, size)?;
+        if self.idx_file.is_some() {
             self.idx_file_offset += NEEDLE_MAP_ENTRY_SIZE as u64;
         }
 
@@ -235,6 +299,41 @@ impl CompactNeedleMap {
         Ok(())
     }
 
+    /// Write one row to the .idx file at `idx_file_offset`. A row left
+    /// half-written by a failed write is trimmed back to the offset so the
+    /// next row still lands aligned; while the trim keeps failing no row is
+    /// written at all, or it would sit off alignment and parse as garbage on
+    /// load. The offset itself is advanced by the caller once the row counts.
+    fn append_to_index_file(
+        &mut self,
+        key: NeedleId,
+        offset: Offset,
+        size: Size,
+    ) -> io::Result<()> {
+        let Some(idx_file) = self.idx_file.as_mut() else {
+            return Ok(());
+        };
+        if self.idx_torn {
+            match idx_file.truncate_to(self.idx_file_offset) {
+                Ok(()) => self.idx_torn = false,
+                Err(e) => {
+                    return Err(io::Error::other(format!(
+                        "index file still holds a torn row: {e}"
+                    )));
+                }
+            }
+        }
+        idx_file.seek(io::SeekFrom::Start(self.idx_file_offset))?;
+        if let Err(e) = idx::write_index_entry(idx_file, key, offset, size) {
+            if let Err(te) = idx_file.truncate_to(self.idx_file_offset) {
+                self.idx_torn = true;
+                tracing::warn!("failed to trim torn .idx row: {}", te);
+            }
+            return Err(e);
+        }
+        Ok(())
+    }
+
     /// Look up a needle.
     pub fn get(&self, key: NeedleId) -> Option<NeedleValue> {
         self.map.get(key)
@@ -259,8 +358,8 @@ impl CompactNeedleMap {
         }
 
         // Always write tombstone to idx file (matching Go)
-        if let Some(ref mut idx_file) = self.idx_file {
-            idx::write_index_entry(idx_file, key, offset, TOMBSTONE_FILE_SIZE)?;
+        self.append_to_index_file(key, offset, TOMBSTONE_FILE_SIZE)?;
+        if self.idx_file.is_some() {
             self.idx_file_offset += NEEDLE_MAP_ENTRY_SIZE as u64;
         }
 
@@ -365,9 +464,9 @@ impl CompactNeedleMap {
     }
 
     /// Visit all entries in ascending order by needle ID.
-    pub fn ascending_visit<F>(&self, f: F) -> Result<(), String>
+    pub fn ascending_visit<F, E>(&self, f: F) -> Result<(), E>
     where
-        F: FnMut(NeedleId, &NeedleValue) -> Result<(), String>,
+        F: FnMut(NeedleId, &NeedleValue) -> Result<(), E>,
     {
         self.map.ascending_visit(f)
     }
@@ -386,133 +485,185 @@ const NEEDLE_TABLE: TableDefinition<u64, &[u8]> = TableDefinition::new("needles"
 const META_TABLE: TableDefinition<&str, u64> = TableDefinition::new("meta");
 const META_IDX_SIZE: &str = "idx_size";
 
+/// Writes between two durable redb checkpoints. Every non-durable commit
+/// leaves an entry in redb's transaction tracker and pins the pages that
+/// were on disk at the last durable commit; only a durable commit clears
+/// both. Without a cadence they grow for the life of the process (#11179).
+/// The map only counts; the volume takes the checkpoint (see
+/// `RedbNeedleMap::checkpoint_due`) because the .dat must be flushed first.
+const REDB_CHECKPOINT_INTERVAL: u32 = 1000;
+
 /// Disk-backed needle map using redb.
-/// Low memory usage — data lives on disk with redb's page cache.
+/// Low memory usage — data lives on disk behind a small, bounded redb page
+/// cache sized by `NeedleMapKind::redb_cache_bytes`.
 pub struct RedbNeedleMap {
-    db: Database,
+    /// `Option` so a non-`TransactionPoisoned` commit error can drop the
+    /// `Database` (releasing the file lock) before reopening from `.idx`.
+    db: Option<Database>,
+    /// Path of the `.rdb` file — needed to reopen after a commit error.
+    rdb_path: String,
+    /// Volume version, for replaying `.idx` rows on reopen.
+    version: Version,
+    /// redb page-cache size, for reopening with the same configuration.
+    cache_bytes: usize,
     metric: NeedleMapMetric,
     idx_file: Option<Box<dyn IdxFileWriter>>,
     idx_file_offset: u64,
+    /// The file holds bytes past `idx_file_offset` that must be trimmed
+    /// before another row can land aligned.
+    idx_torn: bool,
+    /// Puts/deletes since the last durable checkpoint.
+    writes_since_checkpoint: u32,
 }
 
 impl RedbNeedleMap {
     /// Begin a write transaction with `Durability::None` (no fsync).
-    /// The .idx file is the source of truth for crash recovery, so redb
-    /// is always rebuilt from .idx on startup — fsync is unnecessary.
+    /// The .idx file is the source of truth for crash recovery: a crash
+    /// loses at most the writes since the last checkpoint from redb, and
+    /// the next load replays them from .idx.
     fn begin_write_no_fsync(db: &Database) -> io::Result<redb::WriteTransaction> {
-        let mut txn = db.begin_write().map_err(|e| {
-            io::Error::new(io::ErrorKind::Other, format!("redb begin_write: {}", e))
-        })?;
+        let mut txn = db
+            .begin_write()
+            .map_err(|e| io::Error::other(format!("redb begin_write: {}", e)))?;
         let _ = txn.set_durability(Durability::None);
         Ok(txn)
     }
 
+    /// Return a reference to the open `Database`, or an error if a previous
+    /// non-poisoned commit error followed by a failed reopen left it closed.
+    fn db_or_err(&self) -> io::Result<&Database> {
+        self.db.as_ref().ok_or_else(|| {
+            io::Error::other(
+                "redb database is closed after a commit error and failed reopen from .idx",
+            )
+        })
+    }
+
+    /// True once `REDB_CHECKPOINT_INTERVAL` puts/deletes have been committed
+    /// non-durably. The caller (the volume) must then flush the .dat and
+    /// call [`checkpoint`](Self::checkpoint): a checkpoint makes the index
+    /// durable, so the bytes it points at have to be on disk before it.
+    pub fn checkpoint_due(&self) -> bool {
+        self.writes_since_checkpoint >= REDB_CHECKPOINT_INTERVAL
+    }
+
+    /// Make the table durable and record how much of the .idx it reflects.
+    /// Precondition: the .dat the index points into has been flushed.
+    ///
+    /// When `sync_idx` is true the .idx file is fsynced first — the recorded
+    /// size must never exceed what is on disk, or the reload would have to
+    /// rebuild from scratch. A caller that has already fsynced the .idx (e.g.
+    /// the volume's `flush_idx` on the fsync=true write path) may pass false
+    /// to avoid a redundant fsync.
+    pub fn checkpoint(&mut self, sync_idx: bool) -> io::Result<()> {
+        let txn = self.begin_checkpoint(sync_idx)?;
+        txn.commit()
+            .map_err(|e| io::Error::other(format!("redb commit: {}", e)))?;
+        self.writes_since_checkpoint = 0;
+        Ok(())
+    }
+
+    /// Begin a durable transaction (fsync on commit) that also records how
+    /// much of the .idx the table reflects, so a reload replays only the
+    /// tail appended after it. When `sync_idx` is true the .idx is fsynced
+    /// first (see [`checkpoint`](Self::checkpoint)).
+    /// Durable commit uses `set_quick_repair(true)` so the next open after a
+    /// crash does not scan the whole file.
+    fn begin_checkpoint(&self, sync_idx: bool) -> io::Result<redb::WriteTransaction> {
+        if sync_idx {
+            self.sync()?;
+        }
+        let mut txn = self
+            .db_or_err()?
+            .begin_write()
+            .map_err(|e| io::Error::other(format!("redb begin_write: {}", e)))?;
+        txn.set_quick_repair(true);
+        if self.idx_file.is_some() {
+            let mut meta = txn
+                .open_table(META_TABLE)
+                .map_err(|e| io::Error::other(format!("redb open meta: {}", e)))?;
+            meta.insert(META_IDX_SIZE, self.idx_file_offset)
+                .map_err(|e| io::Error::other(format!("redb insert meta: {}", e)))?;
+        }
+        Ok(txn)
+    }
+
     /// Create a new redb-backed needle map at the given path.
     /// The database file will be created if it does not exist.
-    pub fn new(db_path: &str) -> io::Result<Self> {
-        let db = Database::create(db_path).map_err(|e| {
-            io::Error::new(io::ErrorKind::Other, format!("redb create error: {}", e))
-        })?;
+    /// `cache_bytes` bounds redb's page cache for this one database.
+    pub fn new(db_path: &str, cache_bytes: usize) -> io::Result<Self> {
+        let db = Database::builder()
+            .set_cache_size(cache_bytes)
+            .create(db_path)
+            .map_err(|e| io::Error::other(format!("redb create error: {}", e)))?;
 
         // Ensure tables exist
         let txn = Self::begin_write_no_fsync(&db)?;
         {
-            let _table = txn.open_table(NEEDLE_TABLE).map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e))
-            })?;
-            let _meta = txn.open_table(META_TABLE).map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb open_table meta: {}", e))
-            })?;
+            let _table = txn
+                .open_table(NEEDLE_TABLE)
+                .map_err(|e| io::Error::other(format!("redb open_table: {}", e)))?;
+            let _meta = txn
+                .open_table(META_TABLE)
+                .map_err(|e| io::Error::other(format!("redb open_table meta: {}", e)))?;
         }
         txn.commit()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb commit: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb commit: {}", e)))?;
 
         Ok(RedbNeedleMap {
-            db,
+            db: Some(db),
+            rdb_path: db_path.to_string(),
+            version: Version::current(),
+            cache_bytes,
             metric: NeedleMapMetric::default(),
             idx_file: None,
             idx_file_offset: 0,
+            idx_torn: false,
+            writes_since_checkpoint: 0,
         })
     }
 
     /// Save the .idx file size into redb metadata so we can detect whether
     /// the .rdb is up-to-date on the next startup.
     fn save_idx_size_meta(&self, idx_size: u64) -> io::Result<()> {
-        let txn = Self::begin_write_no_fsync(&self.db)?;
+        let txn = Self::begin_write_no_fsync(self.db_or_err()?)?;
         {
-            let mut meta = txn.open_table(META_TABLE).map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb open meta: {}", e))
-            })?;
-            meta.insert(META_IDX_SIZE, idx_size).map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb insert meta: {}", e))
-            })?;
+            let mut meta = txn
+                .open_table(META_TABLE)
+                .map_err(|e| io::Error::other(format!("redb open meta: {}", e)))?;
+            meta.insert(META_IDX_SIZE, idx_size)
+                .map_err(|e| io::Error::other(format!("redb insert meta: {}", e)))?;
         }
-        txn.commit().map_err(|e| {
-            io::Error::new(io::ErrorKind::Other, format!("redb commit meta: {}", e))
-        })?;
+        txn.commit()
+            .map_err(|e| io::Error::other(format!("redb commit meta: {}", e)))?;
         Ok(())
     }
 
     /// Read the stored .idx file size from redb metadata.
     fn read_idx_size_meta(&self) -> io::Result<Option<u64>> {
         let txn = self
-            .db
+            .db_or_err()?
             .begin_read()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb begin_read: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb begin_read: {}", e)))?;
         let meta = txn
             .open_table(META_TABLE)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb open meta: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb open meta: {}", e)))?;
+        // experimental-api-5 drops inherent ReadOnlyTable::get ('static guard).
+        // ReadableTable::get guard borrows `meta`; edition 2024 drops the tail
+        // expression's temporaries before `meta`, so no extra binding is needed.
         match meta.get(META_IDX_SIZE) {
             Ok(Some(guard)) => Ok(Some(guard.value())),
             Ok(None) => Ok(None),
-            Err(e) => Err(io::Error::new(
-                io::ErrorKind::Other,
-                format!("redb get meta: {}", e),
-            )),
+            Err(e) => Err(io::Error::other(format!("redb get meta: {}", e))),
         }
     }
 
-    /// Rebuild metrics by scanning all entries in the redb table.
-    /// Called when reusing an existing .rdb without a full rebuild.
-    fn rebuild_metrics_from_db(&self, version: Version) -> io::Result<()> {
-        let txn = self
-            .db
-            .begin_read()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb begin_read: {}", e)))?;
-        let table = txn
-            .open_table(NEEDLE_TABLE)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e)))?;
-        let iter = table
-            .iter()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb iter: {}", e)))?;
-        for entry in iter {
-            let (key_guard, val_guard) = entry.map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb iter next: {}", e))
-            })?;
-            let key = NeedleId(key_guard.value());
-            let bytes: &[u8] = val_guard.value();
-            if bytes.len() == PACKED_NEEDLE_VALUE_SIZE {
-                let mut arr = [0u8; PACKED_NEEDLE_VALUE_SIZE];
-                arr.copy_from_slice(bytes);
-                let nv = unpack_needle_value(&arr);
-                self.metric.maybe_set_max_file_key(key);
-                self.metric
-                    .maybe_set_max_needle_end(nv.offset, nv.size, version);
-                if nv.size.is_valid() {
-                    self.metric.file_count.fetch_add(1, Ordering::Relaxed);
-                    self.metric
-                        .file_byte_count
-                        .fetch_add(nv.size.0 as u64, Ordering::Relaxed);
-                } else {
-                    // Deleted entry (negative size)
-                    self.metric.deletion_count.fetch_add(1, Ordering::Relaxed);
-                    self.metric
-                        .deletion_byte_count
-                        .fetch_add((-nv.size.0) as u64, Ordering::Relaxed);
-                }
-            }
-        }
-        Ok(())
+    /// Test-only read of META `idx_size` through the live handle. See
+    /// [`test_support::live_meta_idx_size`] for why durability tests use
+    /// this instead of copying the open `.rdb`.
+    #[cfg(test)]
+    pub(crate) fn live_meta_idx_size(&self) -> Option<u64> {
+        self.read_idx_size_meta().unwrap()
     }
 
     /// Load from an .idx file, reusing an existing .rdb if it is consistent.
@@ -526,20 +677,21 @@ impl RedbNeedleMap {
         db_path: &str,
         reader: &mut R,
         version: Version,
+        cache_bytes: usize,
     ) -> io::Result<Self> {
         let idx_size = reader.seek(io::SeekFrom::End(0))?;
         reader.seek(io::SeekFrom::Start(0))?;
 
         // Try to reuse existing .rdb
         if Path::new(db_path).exists() {
-            if let Ok(nm) = Self::try_reuse_rdb(db_path, reader, idx_size, version) {
+            if let Ok(nm) = Self::try_reuse_rdb(db_path, reader, idx_size, version, cache_bytes) {
                 return Ok(nm);
             }
             // Reuse failed — fall through to full rebuild
             reader.seek(io::SeekFrom::Start(0))?;
         }
 
-        Self::full_rebuild(db_path, reader, idx_size, version)
+        Self::full_rebuild(db_path, reader, idx_size, version, cache_bytes)
     }
 
     /// Try to reuse an existing .rdb file. Returns Ok if successful,
@@ -549,77 +701,75 @@ impl RedbNeedleMap {
         reader: &mut R,
         idx_size: u64,
         version: Version,
+        cache_bytes: usize,
     ) -> io::Result<Self> {
-        let db = Database::open(db_path)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb open: {}", e)))?;
+        let db = Database::builder()
+            .set_cache_size(cache_bytes)
+            .open(db_path)
+            .map_err(|e| io::Error::other(format!("redb open: {}", e)))?;
 
-        let nm = RedbNeedleMap {
-            db,
+        let mut nm = RedbNeedleMap {
+            db: Some(db),
+            rdb_path: db_path.to_string(),
+            version,
+            cache_bytes,
             metric: NeedleMapMetric::default(),
             idx_file: None,
             idx_file_offset: 0,
+            idx_torn: false,
+            writes_since_checkpoint: 0,
         };
 
         let stored_idx_size = nm
             .read_idx_size_meta()?
-            .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "no idx_size in redb meta"))?;
+            .ok_or_else(|| io::Error::other("no idx_size in redb meta"))?;
 
         if stored_idx_size > idx_size {
             // .idx shrank — corrupted or truncated, need full rebuild
-            return Err(io::Error::new(
-                io::ErrorKind::Other,
-                "idx file smaller than stored size",
-            ));
+            return Err(io::Error::other("idx file smaller than stored size"));
         }
 
-        // Rebuild metrics from existing data
-        nm.rebuild_metrics_from_db(version)?;
+        // Counters come from the whole .idx history, never from the table,
+        // so the replay below is free to re-apply rows the table already
+        // holds (redb flushes on drop even without a checkpoint).
+        nm.metric = metrics_from_idx(reader, version)?;
 
         if stored_idx_size < idx_size {
             // .idx grew — replay new entries incrementally
             let start_entry = stored_idx_size / NEEDLE_MAP_ENTRY_SIZE as u64;
-            let txn = Self::begin_write_no_fsync(&nm.db)?;
+            let txn = Self::begin_write_no_fsync(nm.db.as_ref().unwrap())?;
             {
-                let mut table = txn.open_table(NEEDLE_TABLE).map_err(|e| {
-                    io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e))
-                })?;
+                let mut table = txn
+                    .open_table(NEEDLE_TABLE)
+                    .map_err(|e| io::Error::other(format!("redb open_table: {}", e)))?;
                 idx::walk_index_file(reader, start_entry, |key, offset, size| {
-                    nm.metric.maybe_set_max_needle_end(offset, size, version);
                     let key_u64: u64 = key.into();
                     if offset.is_zero() || size.is_deleted() {
-                        // Delete: look up old value for metric update, then
-                        // store tombstone (negative size with original offset)
-                        if let Ok(Some(old)) = nm.get_via_table(&table, key_u64) {
-                            if old.size.is_valid() {
-                                nm.metric.on_delete(&old);
-                                let deleted_nv = NeedleValue {
-                                    offset: old.offset,
-                                    size: Size(-(old.size.0)),
-                                };
-                                let packed = pack_needle_value(&deleted_nv);
-                                table.insert(key_u64, packed.as_slice()).map_err(|e| {
-                                    io::Error::new(
-                                        io::ErrorKind::Other,
-                                        format!("redb insert: {}", e),
-                                    )
-                                })?;
-                            }
+                        // Delete: store a tombstone (negative size, original
+                        // offset) over a live value; already deleted is a no-op.
+                        if let Ok(Some(old)) = nm.get_via_table(&table, key_u64)
+                            && old.size.is_valid()
+                        {
+                            let deleted_nv = NeedleValue {
+                                offset: old.offset,
+                                size: Size(-(old.size.0)),
+                            };
+                            let packed = pack_needle_value(&deleted_nv);
+                            table
+                                .insert(key_u64, packed.as_slice())
+                                .map_err(|e| io::Error::other(format!("redb insert: {}", e)))?;
                         }
                     } else {
-                        // Put: look up old value for metric update
-                        let old = nm.get_via_table(&table, key_u64).ok().flatten();
-                        let nv = NeedleValue { offset, size };
-                        let packed = pack_needle_value(&nv);
-                        table.insert(key_u64, packed.as_slice()).map_err(|e| {
-                            io::Error::new(io::ErrorKind::Other, format!("redb insert: {}", e))
-                        })?;
-                        nm.metric.on_put(key, old.as_ref(), size);
+                        let packed = pack_needle_value(&NeedleValue { offset, size });
+                        table
+                            .insert(key_u64, packed.as_slice())
+                            .map_err(|e| io::Error::other(format!("redb insert: {}", e)))?;
                     }
                     Ok(())
                 })?;
             }
             txn.commit()
-                .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb commit: {}", e)))?;
+                .map_err(|e| io::Error::other(format!("redb commit: {}", e)))?;
 
             nm.save_idx_size_meta(idx_size)?;
         }
@@ -635,81 +785,130 @@ impl RedbNeedleMap {
         key_u64: u64,
     ) -> io::Result<Option<NeedleValue>> {
         match table.get(key_u64) {
-            Ok(Some(guard)) => {
-                let bytes: &[u8] = guard.value();
-                if bytes.len() == PACKED_NEEDLE_VALUE_SIZE {
-                    let mut arr = [0u8; PACKED_NEEDLE_VALUE_SIZE];
-                    arr.copy_from_slice(bytes);
-                    Ok(Some(unpack_needle_value(&arr)))
-                } else {
-                    Ok(None)
-                }
-            }
+            Ok(Some(guard)) => Ok(packed_to_needle_value(guard.value())),
             Ok(None) => Ok(None),
-            Err(e) => Err(io::Error::new(
-                io::ErrorKind::Other,
-                format!("redb get: {}", e),
-            )),
+            Err(e) => Err(io::Error::other(format!("redb get: {}", e))),
         }
     }
 
-    /// Full rebuild: delete existing .rdb and rebuild from entire .idx file.
+    /// Full rebuild: prefer a fresh `.rdb`, then rebuild from the entire `.idx`.
+    ///
+    /// `Database::create` opens an existing file (`truncate(false)`). Unlink
+    /// is best-effort: if it fails (sticky bit, foreign owner) but the path is
+    /// still writable, clear the leftover needles table before inserting.
+    /// Live keys come from a `BTreeMap` so inserts are in needle-id order and
+    /// redb 4.2.0 packs leaves, without a second Vec + sort scratch.
     fn full_rebuild<R: Read + Seek>(
         db_path: &str,
         reader: &mut R,
         idx_size: u64,
         version: Version,
+        cache_bytes: usize,
     ) -> io::Result<Self> {
-        let _ = std::fs::remove_file(db_path);
-        let nm = RedbNeedleMap::new(db_path)?;
-
-        // Collect entries from idx file, resolving duplicates/deletions
-        let mut entries: HashMap<NeedleId, Option<NeedleValue>> = HashMap::new();
-        idx::walk_index_file(reader, 0, |key, offset, size| {
-            nm.metric.maybe_set_max_needle_end(offset, size, version);
-            if offset.is_zero() || size.is_deleted() {
-                entries.insert(key, None);
-            } else {
-                entries.insert(key, Some(NeedleValue { offset, size }));
+        let unlinked = match std::fs::remove_file(db_path) {
+            Ok(()) => true,
+            Err(e) if e.kind() == io::ErrorKind::NotFound => true,
+            Err(e) => {
+                tracing::warn!("redb unlink before rebuild failed: {}", e);
+                false
             }
-            Ok(())
-        })?;
+        };
 
-        // Write all live entries to redb in a single transaction
-        let txn = Self::begin_write_no_fsync(&nm.db)?;
-        {
-            let mut table = txn.open_table(NEEDLE_TABLE).map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e))
+        let mut nm = match RedbNeedleMap::new(db_path, cache_bytes) {
+            Ok(nm) => nm,
+            Err(e) => {
+                let _ = std::fs::remove_file(db_path);
+                return Err(e);
+            }
+        };
+        nm.version = version;
+
+        let result = (|| -> io::Result<()> {
+            // Seek independently of walk_index_file. Run before the write txn
+            // so a metric-read error does not unlink a committed rebuild.
+            nm.metric = metrics_from_idx(reader, version)?;
+
+            let mut entries: BTreeMap<NeedleId, NeedleValue> = BTreeMap::new();
+            idx::walk_index_file(reader, 0, |key, offset, size| {
+                if offset.is_zero() || size.is_deleted() {
+                    entries.remove(&key);
+                } else {
+                    entries.insert(key, NeedleValue { offset, size });
+                }
+                Ok(())
             })?;
 
-            for (key, maybe_nv) in &entries {
-                let key_u64: u64 = (*key).into();
-                if let Some(nv) = maybe_nv {
-                    let packed = pack_needle_value(nv);
-                    table.insert(key_u64, packed.as_slice()).map_err(|e| {
-                        io::Error::new(io::ErrorKind::Other, format!("redb insert: {}", e))
-                    })?;
-                    nm.metric.on_put(*key, None, nv.size);
-                } else {
-                    // Entry was deleted — remove from redb if present
-                    table.remove(key_u64).map_err(|e| {
-                        io::Error::new(io::ErrorKind::Other, format!("redb remove: {}", e))
+            let txn = Self::begin_write_no_fsync(nm.db.as_ref().unwrap())?;
+            {
+                let mut table = txn
+                    .open_table(NEEDLE_TABLE)
+                    .map_err(|e| io::Error::other(format!("redb open_table: {}", e)))?;
+                if !unlinked {
+                    table
+                        .retain(|_, _| false)
+                        .map_err(|e| io::Error::other(format!("redb retain: {}", e)))?;
+                }
+
+                #[cfg(not(feature = "redb-experimental-cursor"))]
+                {
+                    for (key, nv) in &entries {
+                        let key_u64: u64 = (*key).into();
+                        let packed = pack_needle_value(nv);
+                        table
+                            .insert(key_u64, packed.as_slice())
+                            .map_err(|e| io::Error::other(format!("redb insert: {}", e)))?;
+                    }
+                }
+                #[cfg(feature = "redb-experimental-cursor")]
+                {
+                    let mut cursor =
+                        table
+                            .upper_bound_mut(Bound::<u64>::Unbounded)
+                            .map_err(|e| {
+                                io::Error::new(
+                                    io::ErrorKind::Other,
+                                    format!("redb upper_bound_mut: {}", e),
+                                )
+                            })?;
+                    for (key, nv) in &entries {
+                        let key_u64: u64 = (*key).into();
+                        let packed = pack_needle_value(nv);
+                        cursor
+                            .insert_before(key_u64, packed.as_slice())
+                            .map_err(|e| {
+                                io::Error::new(
+                                    io::ErrorKind::Other,
+                                    format!("redb insert_before: {}", e),
+                                )
+                            })?;
+                    }
+                    cursor.close().map_err(|e| {
+                        io::Error::new(io::ErrorKind::Other, format!("redb cursor close: {}", e))
                     })?;
                 }
             }
+            txn.commit()
+                .map_err(|e| io::Error::other(format!("redb commit: {}", e)))?;
+
+            nm.save_idx_size_meta(idx_size)?;
+            Ok(())
+        })();
+
+        match result {
+            Ok(()) => Ok(nm),
+            Err(e) => {
+                drop(nm);
+                let _ = std::fs::remove_file(db_path);
+                Err(e)
+            }
         }
-        txn.commit()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb commit: {}", e)))?;
-
-        nm.save_idx_size_meta(idx_size)?;
-
-        Ok(nm)
     }
 
     /// Set the index file for append-only writes.
     pub fn set_idx_file(&mut self, file: Box<dyn IdxFileWriter>, offset: u64) {
         self.idx_file = Some(file);
         self.idx_file_offset = offset;
+        self.idx_torn = false;
     }
 
     /// True when an .idx file writer is attached. See CompactNeedleMap.
@@ -721,107 +920,207 @@ impl RedbNeedleMap {
 
     /// Insert or update an entry. Writes to idx file first, then redb.
     pub fn put(&mut self, key: NeedleId, offset: Offset, size: Size) -> io::Result<()> {
-        // Persist to idx file BEFORE mutating redb state for crash consistency
-        if let Some(ref mut idx_file) = self.idx_file {
-            idx::write_index_entry(idx_file, key, offset, size)?;
-            self.idx_file_offset += NEEDLE_MAP_ENTRY_SIZE as u64;
-        }
+        // Persist to idx file BEFORE mutating redb state for crash consistency.
+        // The offset is advanced only after the redb commit succeeds: a failed
+        // commit leaves an orphan row in .idx that redb doesn't reflect, and
+        // advancing the offset here would let a later checkpoint record it as
+        // reflected, making the reload skip it permanently.
+        self.append_to_index_file(key, offset, size)?;
 
         let key_u64: u64 = key.into();
-        let nv = NeedleValue { offset, size };
-        let packed = pack_needle_value(&nv);
+        let packed = pack_needle_value(&NeedleValue { offset, size });
 
-        // Read old value for metric update
-        let old = self.get_internal(key_u64)?;
+        let old = {
+            let db = match self.db_or_err() {
+                Ok(db) => db,
+                Err(e) => {
+                    self.truncate_idx_to_offset();
+                    return Err(e);
+                }
+            };
+            let txn = Self::begin_write_no_fsync(db);
+            let txn = match txn {
+                Ok(txn) => txn,
+                Err(e) => {
+                    self.truncate_idx_to_offset();
+                    return Err(e);
+                }
+            };
+            // Insert and extract the old value inside a block so the table
+            // and AccessGuard are dropped before commit (which moves txn).
+            let old = {
+                let mut table = match txn.open_table(NEEDLE_TABLE) {
+                    Ok(t) => t,
+                    Err(e) => {
+                        self.truncate_idx_to_offset();
+                        return Err(io::Error::other(format!("redb open_table: {}", e)));
+                    }
+                };
+                match table.insert(key_u64, packed.as_slice()) {
+                    Ok(prev) => prev.and_then(|g| packed_to_needle_value(g.value())),
+                    Err(e) => {
+                        self.truncate_idx_to_offset();
+                        return Err(io::Error::other(format!("redb insert: {}", e)));
+                    }
+                }
+            };
+            match txn.commit() {
+                Ok(()) => old,
+                Err(redb::CommitError::TransactionPoisoned) => {
+                    // Transaction rolled back, database still usable:
+                    // truncate the orphan .idx row.
+                    self.truncate_idx_to_offset();
+                    return Err(io::Error::other(
+                        "redb commit: Transaction was poisoned by a panic",
+                    ));
+                }
+                Err(e) => {
+                    // Non-poisoned commit error: the change may be
+                    // visible and redb refuses further writes. Keep
+                    // the .idx row (do NOT truncate) and reopen from
+                    // .idx to repair redb's internal state.
+                    let err = io::Error::other(format!("redb commit: {}", e));
+                    if let Err(reopen_err) = self.reopen_from_idx() {
+                        tracing::warn!("redb reopen after put commit error failed: {}", reopen_err);
+                    }
+                    return Err(err);
+                }
+            }
+        };
 
-        let txn = Self::begin_write_no_fsync(&self.db)?;
-        {
-            let mut table = txn.open_table(NEEDLE_TABLE).map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e))
-            })?;
-            table
-                .insert(key_u64, packed.as_slice())
-                .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb insert: {}", e)))?;
+        if self.idx_file.is_some() {
+            self.idx_file_offset += NEEDLE_MAP_ENTRY_SIZE as u64;
         }
-        txn.commit()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb commit: {}", e)))?;
-
+        self.writes_since_checkpoint = self.writes_since_checkpoint.saturating_add(1);
         self.metric.on_put(key, old.as_ref(), size);
         Ok(())
     }
 
-    /// Look up a needle.
-    pub fn get(&self, key: NeedleId) -> Option<NeedleValue> {
+    /// Write one row to the .idx file at `idx_file_offset`. A row left
+    /// half-written by a failed write is trimmed back to the offset so the
+    /// next row still lands aligned; while the trim keeps failing no row is
+    /// written at all, or it would sit off alignment and parse as garbage on
+    /// load. The offset itself is advanced by the caller once the row counts.
+    fn append_to_index_file(
+        &mut self,
+        key: NeedleId,
+        offset: Offset,
+        size: Size,
+    ) -> io::Result<()> {
+        let Some(idx_file) = self.idx_file.as_mut() else {
+            return Ok(());
+        };
+        if self.idx_torn {
+            match idx_file.truncate_to(self.idx_file_offset) {
+                Ok(()) => self.idx_torn = false,
+                Err(e) => {
+                    return Err(io::Error::other(format!(
+                        "index file still holds a torn row: {e}"
+                    )));
+                }
+            }
+        }
+        idx_file.seek(io::SeekFrom::Start(self.idx_file_offset))?;
+        if let Err(e) = idx::write_index_entry(idx_file, key, offset, size) {
+            if let Err(te) = idx_file.truncate_to(self.idx_file_offset) {
+                self.idx_torn = true;
+                tracing::warn!("failed to trim torn .idx row: {}", te);
+            }
+            return Err(e);
+        }
+        Ok(())
+    }
+
+    /// Look up a needle. A redb failure is an ERROR, not an absent needle:
+    /// answering "not found" would turn a database problem into a read miss
+    /// and let a delete report success without recording a tombstone.
+    pub fn get(&self, key: NeedleId) -> io::Result<Option<NeedleValue>> {
         let key_u64: u64 = key.into();
-        self.get_internal(key_u64).ok().flatten()
+        self.get_internal(key_u64)
     }
 
     /// Internal get that returns io::Result for error propagation.
     fn get_internal(&self, key_u64: u64) -> io::Result<Option<NeedleValue>> {
         let txn = self
-            .db
+            .db_or_err()?
             .begin_read()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb begin_read: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb begin_read: {}", e)))?;
         let table = txn
             .open_table(NEEDLE_TABLE)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb open_table: {}", e)))?;
+        // experimental-api-5 drops inherent ReadOnlyTable::get ('static guard).
+        // ReadableTable::get guard borrows `table`; edition 2024 drops the tail
+        // expression's temporaries before `table`, so no extra binding is needed.
         match table.get(key_u64) {
-            Ok(Some(guard)) => {
-                let bytes: &[u8] = guard.value();
-                if bytes.len() == PACKED_NEEDLE_VALUE_SIZE {
-                    let mut arr = [0u8; PACKED_NEEDLE_VALUE_SIZE];
-                    arr.copy_from_slice(bytes);
-                    Ok(Some(unpack_needle_value(&arr)))
-                } else {
-                    Ok(None)
-                }
-            }
+            Ok(Some(guard)) => Ok(packed_to_needle_value(guard.value())),
             Ok(None) => Ok(None),
-            Err(e) => Err(io::Error::new(
-                io::ErrorKind::Other,
-                format!("redb get: {}", e),
-            )),
+            Err(e) => Err(io::Error::other(format!("redb get: {}", e))),
         }
     }
 
     /// Mark a needle as deleted. Appends tombstone to .idx file, negates size in redb.
     pub fn delete(&mut self, key: NeedleId, offset: Offset) -> io::Result<Option<Size>> {
         let key_u64: u64 = key.into();
+        let txn = Self::begin_write_no_fsync(self.db_or_err()?)?;
+        let mut table = txn
+            .open_table(NEEDLE_TABLE)
+            .map_err(|e| io::Error::other(format!("redb open_table: {}", e)))?;
+        let old = match table.get(key_u64) {
+            Ok(Some(guard)) => packed_to_needle_value(guard.value()),
+            Ok(None) => None,
+            Err(e) => {
+                return Err(io::Error::other(format!("redb get: {}", e)));
+            }
+        };
+        let Some(old) = old.filter(|nv| nv.size.is_valid()) else {
+            drop(table);
+            return Ok(None);
+        };
 
-        if let Some(old) = self.get_internal(key_u64)? {
-            if old.size.is_valid() {
-                // Persist tombstone to idx file BEFORE mutating redb
-                if let Some(ref mut idx_file) = self.idx_file {
-                    idx::write_index_entry(idx_file, key, offset, TOMBSTONE_FILE_SIZE)?;
-                    self.idx_file_offset += NEEDLE_MAP_ENTRY_SIZE as u64;
+        self.append_to_index_file(key, offset, TOMBSTONE_FILE_SIZE)?;
+
+        let deleted_nv = NeedleValue {
+            offset: old.offset,
+            size: Size(-(old.size.0)),
+        };
+        let packed = pack_needle_value(&deleted_nv);
+        let insert_res = table.insert(key_u64, packed.as_slice()).map(|_| ());
+        drop(table);
+        if let Err(e) = insert_res {
+            self.truncate_idx_to_offset();
+            return Err(io::Error::other(format!("redb insert: {}", e)));
+        }
+        match txn.commit() {
+            Ok(()) => {}
+            Err(redb::CommitError::TransactionPoisoned) => {
+                // Transaction rolled back, database still usable:
+                // truncate the orphan .idx row.
+                self.truncate_idx_to_offset();
+                return Err(io::Error::other(
+                    "redb commit: Transaction was poisoned by a panic",
+                ));
+            }
+            Err(e) => {
+                // Non-poisoned commit error: the change may be visible
+                // and redb refuses further writes. Keep the .idx row
+                // (do NOT truncate) and reopen from .idx to repair
+                // redb's internal state.
+                let err = io::Error::other(format!("redb commit: {}", e));
+                if let Err(reopen_err) = self.reopen_from_idx() {
+                    tracing::warn!(
+                        "redb reopen after delete commit error failed: {}",
+                        reopen_err
+                    );
                 }
-
-                self.metric.on_delete(&old);
-                let deleted_size = Size(-(old.size.0));
-                // Keep original offset so readDeleted can find original data (matching Go behavior)
-                let deleted_nv = NeedleValue {
-                    offset: old.offset,
-                    size: deleted_size,
-                };
-                let packed = pack_needle_value(&deleted_nv);
-
-                let txn = Self::begin_write_no_fsync(&self.db)?;
-                {
-                    let mut table = txn.open_table(NEEDLE_TABLE).map_err(|e| {
-                        io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e))
-                    })?;
-                    table.insert(key_u64, packed.as_slice()).map_err(|e| {
-                        io::Error::new(io::ErrorKind::Other, format!("redb insert: {}", e))
-                    })?;
-                }
-                txn.commit().map_err(|e| {
-                    io::Error::new(io::ErrorKind::Other, format!("redb commit: {}", e))
-                })?;
-
-                return Ok(Some(old.size));
+                return Err(err);
             }
         }
-        Ok(None)
+        if self.idx_file.is_some() {
+            self.idx_file_offset += NEEDLE_MAP_ENTRY_SIZE as u64;
+        }
+        self.writes_since_checkpoint = self.writes_since_checkpoint.saturating_add(1);
+        self.metric.on_delete(&old);
+        Ok(Some(old.size))
     }
 
     // ---- Metrics accessors ----
@@ -864,21 +1163,106 @@ impl RedbNeedleMap {
         Ok(())
     }
 
-    /// Close index file.
+    /// Remove any .idx bytes past `idx_file_offset` — the orphan row left by
+    /// a failed redb commit. Without this the next successful write appends
+    /// after the orphan, `idx_file_offset` advances past it, and a later
+    /// checkpoint records an offset that makes the reload skip the orphan.
+    /// When the trim fails the file is latched torn so no later row lands
+    /// after bytes the map does not reflect.
+    fn truncate_idx_to_offset(&mut self) {
+        if let Some(ref mut idx_file) = self.idx_file
+            && let Err(e) = idx_file.truncate_to(self.idx_file_offset)
+        {
+            self.idx_torn = true;
+            tracing::warn!("failed to truncate orphan .idx row: {}", e);
+        }
+    }
+
+    /// Reopen the database from `.idx` after a non-`TransactionPoisoned`
+    /// commit error.
+    ///
+    /// redb 4.2.0 can make a `Durability::None` commit visible *before*
+    /// returning `Err(CommitError::Storage(..))`. In that state the database
+    /// refuses further write transactions, so the map cannot be used as-is.
+    /// The `.idx` row that triggered the commit is **not** truncated — the
+    /// change may already be in the table — and the database is closed and
+    /// reopened from `.idx`, which repairs redb's internal state and replays
+    /// any tail the failed commit did not apply.
+    ///
+    /// The `.idx` writer is preserved and `idx_file_offset` is advanced to
+    /// the on-disk `.idx` size so the preserved row is part of the replay
+    /// watermark.
+    fn reopen_from_idx(&mut self) -> io::Result<()> {
+        let idx_path = self
+            .rdb_path
+            .strip_suffix(".rdb")
+            .map(|base| format!("{base}.idx"))
+            .ok_or_else(|| {
+                io::Error::other(format!(
+                    "rdb path lacks .rdb suffix, cannot derive .idx path: {}",
+                    self.rdb_path
+                ))
+            })?;
+
+        // Close the current database first — redb holds an exclusive file
+        // lock, so load_from_idx cannot open the same path until we drop it.
+        let old_db = self.db.take();
+        drop(old_db);
+
+        let read_file = std::fs::OpenOptions::new()
+            .read(true)
+            .open(&idx_path)
+            .map_err(|e| io::Error::other(format!("reopen: open .idx {}: {}", idx_path, e)))?;
+        let actual_idx_size = read_file.metadata()?.len();
+        let mut reader = io::BufReader::new(read_file);
+
+        let reopened =
+            Self::load_from_idx(&self.rdb_path, &mut reader, self.version, self.cache_bytes)?;
+
+        // Preserve the append writer and the paths/version/cache; adopt the
+        // repaired database, metrics, and idx_file_offset from the reload.
+        self.db = reopened.db;
+        self.metric = reopened.metric;
+        self.idx_file_offset = actual_idx_size;
+        self.idx_torn = reopened.idx_torn;
+        // The reopen replayed all rows since the last durable checkpoint
+        // non-durably; start the counter fresh.
+        self.writes_since_checkpoint = 0;
+        Ok(())
+    }
+
+    /// Close the index file, checkpointing first so a reload starts from
+    /// the recorded .idx size instead of replaying entries the table
+    /// already holds.
     pub fn close(&mut self) {
-        let _ = self.sync();
+        if let Err(e) = self.checkpoint(true) {
+            tracing::warn!("redb checkpoint on close failed: {}", e);
+        }
+        self.idx_file = None;
+    }
+
+    /// Sync the .idx and drop the writer without taking a durable checkpoint.
+    /// Used when the .dat flush failed: a checkpoint would make the index
+    /// durable with entries that may point past the unflushed .dat tail, so
+    /// the reload's max_needle_end check would mark the volume read-only.
+    /// Without the checkpoint, META_IDX_SIZE stays at the last successful one
+    /// and the reload replays the uncheckpointed tail (redb flushes on drop).
+    pub fn close_without_checkpoint(&mut self) {
+        if let Err(e) = self.sync() {
+            tracing::warn!("redb idx sync on close failed: {}", e);
+        }
         self.idx_file = None;
     }
 
     /// Save the redb contents to an index file, sorted by needle ID ascending.
     pub fn save_to_idx(&self, path: &str) -> io::Result<()> {
         let txn = self
-            .db
+            .db_or_err()?
             .begin_read()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb begin_read: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb begin_read: {}", e)))?;
         let table = txn
             .open_table(NEEDLE_TABLE)
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb open_table: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb open_table: {}", e)))?;
 
         let mut file = std::fs::OpenOptions::new()
             .write(true)
@@ -889,21 +1273,17 @@ impl RedbNeedleMap {
         // redb iterates in key order (u64 ascending)
         let iter = table
             .iter()
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, format!("redb iter: {}", e)))?;
+            .map_err(|e| io::Error::other(format!("redb iter: {}", e)))?;
 
         for entry in iter {
-            let (key_guard, val_guard) = entry.map_err(|e| {
-                io::Error::new(io::ErrorKind::Other, format!("redb iter next: {}", e))
-            })?;
+            let (key_guard, val_guard) =
+                entry.map_err(|e| io::Error::other(format!("redb iter next: {}", e)))?;
             let key_u64: u64 = key_guard.value();
             let bytes: &[u8] = val_guard.value();
-            if bytes.len() == PACKED_NEEDLE_VALUE_SIZE {
-                let mut arr = [0u8; PACKED_NEEDLE_VALUE_SIZE];
-                arr.copy_from_slice(bytes);
-                let nv = unpack_needle_value(&arr);
-                if nv.size.is_valid() {
-                    idx::write_index_entry(&mut file, NeedleId(key_u64), nv.offset, nv.size)?;
-                }
+            if let Some(nv) = packed_to_needle_value(bytes)
+                && nv.size.is_valid()
+            {
+                idx::write_index_entry(&mut file, NeedleId(key_u64), nv.offset, nv.size)?;
             }
         }
         file.sync_all()?;
@@ -911,12 +1291,14 @@ impl RedbNeedleMap {
     }
 
     /// Visit all entries in ascending order by needle ID.
-    pub fn ascending_visit<F>(&self, mut f: F) -> Result<(), String>
+    pub fn ascending_visit<F, E>(&self, mut f: F) -> Result<(), E>
     where
-        F: FnMut(NeedleId, &NeedleValue) -> Result<(), String>,
+        F: FnMut(NeedleId, &NeedleValue) -> Result<(), E>,
+        E: From<String>,
     {
         let txn = self
-            .db
+            .db_or_err()
+            .map_err(|e| format!("redb begin_read: {}", e))?
             .begin_read()
             .map_err(|e| format!("redb begin_read: {}", e))?;
         let table = txn
@@ -928,10 +1310,7 @@ impl RedbNeedleMap {
             let (key_guard, val_guard) = entry.map_err(|e| format!("redb iter next: {}", e))?;
             let key_u64: u64 = key_guard.value();
             let bytes: &[u8] = val_guard.value();
-            if bytes.len() == PACKED_NEEDLE_VALUE_SIZE {
-                let mut arr = [0u8; PACKED_NEEDLE_VALUE_SIZE];
-                arr.copy_from_slice(bytes);
-                let nv = unpack_needle_value(&arr);
+            if let Some(nv) = packed_to_needle_value(bytes) {
                 f(NeedleId(key_u64), &nv)?;
             }
         }
@@ -939,33 +1318,28 @@ impl RedbNeedleMap {
     }
 
     /// Collect all entries as a Vec for iteration (used by volume.rs iter patterns).
-    pub fn collect_entries(&self) -> Vec<(NeedleId, NeedleValue)> {
+    pub fn collect_entries(&self) -> io::Result<Vec<(NeedleId, NeedleValue)>> {
         let mut result = Vec::new();
-        let txn: redb::ReadTransaction = match self.db.begin_read() {
-            Ok(t) => t,
-            Err(_) => return result,
-        };
-        let table = match txn.open_table(NEEDLE_TABLE) {
-            Ok(t) => t,
-            Err(_) => return result,
-        };
-        let iter = match table.iter() {
-            Ok(i) => i,
-            Err(_) => return result,
-        };
+        let txn: redb::ReadTransaction = self
+            .db_or_err()?
+            .begin_read()
+            .map_err(|e| io::Error::other(format!("redb begin_read: {e}")))?;
+        let table = txn
+            .open_table(NEEDLE_TABLE)
+            .map_err(|e| io::Error::other(format!("redb open_table: {e}")))?;
+        let iter = table
+            .iter()
+            .map_err(|e| io::Error::other(format!("redb iter: {e}")))?;
         for entry in iter {
-            if let Ok((key_guard, val_guard)) = entry {
-                let key_u64: u64 = key_guard.value();
-                let bytes: &[u8] = val_guard.value();
-                if bytes.len() == PACKED_NEEDLE_VALUE_SIZE {
-                    let mut arr = [0u8; PACKED_NEEDLE_VALUE_SIZE];
-                    arr.copy_from_slice(bytes);
-                    let nv = unpack_needle_value(&arr);
-                    result.push((NeedleId(key_u64), nv));
-                }
+            let (key_guard, val_guard) =
+                entry.map_err(|e| io::Error::other(format!("redb entry: {e}")))?;
+            let key_u64: u64 = key_guard.value();
+            let bytes: &[u8] = val_guard.value();
+            if let Some(nv) = packed_to_needle_value(bytes) {
+                result.push((NeedleId(key_u64), nv));
             }
         }
-        result
+        Ok(result)
     }
 }
 
@@ -977,6 +1351,10 @@ impl RedbNeedleMap {
 pub enum NeedleMap {
     InMemory(CompactNeedleMap),
     Redb(RedbNeedleMap),
+    /// Read-only volumes — including every cloud-tiered one — search the sorted
+    /// `.sdx` on disk instead of holding an index in RAM. Mirrors Go's
+    /// `SortedFileNeedleMap`.
+    SortedFile(SortedFileNeedleMap),
 }
 
 impl NeedleMap {
@@ -985,14 +1363,18 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.put(key, offset, size),
             NeedleMap::Redb(nm) => nm.put(key, offset, size),
+            NeedleMap::SortedFile(nm) => nm.put(key, offset, size),
         }
     }
 
-    /// Look up a needle.
-    pub fn get(&self, key: NeedleId) -> Option<NeedleValue> {
+    /// Look up a needle. Disk- and database-backed maps report their own
+    /// failures rather than folding them into "not found" — see the notes on
+    /// `RedbNeedleMap::get` and `SortedFileNeedleMap::get`.
+    pub fn get(&self, key: NeedleId) -> io::Result<Option<NeedleValue>> {
         match self {
-            NeedleMap::InMemory(nm) => nm.get(key),
+            NeedleMap::InMemory(nm) => Ok(nm.get(key)),
             NeedleMap::Redb(nm) => nm.get(key),
+            NeedleMap::SortedFile(nm) => nm.get(key),
         }
     }
 
@@ -1001,6 +1383,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.delete(key, offset),
             NeedleMap::Redb(nm) => nm.delete(key, offset),
+            NeedleMap::SortedFile(nm) => nm.delete(key, offset),
         }
     }
 
@@ -1009,6 +1392,9 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.set_idx_file(file, offset),
             NeedleMap::Redb(nm) => nm.set_idx_file(file, offset),
+            // The sorted map borrows its .idx per append, so there is no
+            // long-lived writer to install.
+            NeedleMap::SortedFile(_) => {}
         }
     }
 
@@ -1017,6 +1403,29 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.has_idx_writer(),
             NeedleMap::Redb(nm) => nm.has_idx_writer(),
+            // Appends open the .idx on demand, so one is always available.
+            NeedleMap::SortedFile(_) => true,
+        }
+    }
+
+    /// Whether the backend wants a durable checkpoint. Only the redb map
+    /// commits non-durably between checkpoints; see
+    /// `RedbNeedleMap::checkpoint_due`.
+    pub fn checkpoint_due(&self) -> bool {
+        match self {
+            NeedleMap::Redb(nm) => nm.checkpoint_due(),
+            NeedleMap::InMemory(_) | NeedleMap::SortedFile(_) => false,
+        }
+    }
+
+    /// Take the checkpoint `checkpoint_due` asked for. The caller must have
+    /// flushed the .dat first. Pass `sync_idx = false` when the .idx has
+    /// already been fsynced (e.g. by `flush_idx` on the fsync=true path) to
+    /// avoid a redundant fsync.
+    pub fn checkpoint(&mut self, sync_idx: bool) -> io::Result<()> {
+        match self {
+            NeedleMap::Redb(nm) => nm.checkpoint(sync_idx),
+            NeedleMap::InMemory(_) | NeedleMap::SortedFile(_) => Ok(()),
         }
     }
 
@@ -1025,6 +1434,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.content_size(),
             NeedleMap::Redb(nm) => nm.content_size(),
+            NeedleMap::SortedFile(nm) => nm.content_size(),
         }
     }
 
@@ -1033,6 +1443,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.deleted_size(),
             NeedleMap::Redb(nm) => nm.deleted_size(),
+            NeedleMap::SortedFile(nm) => nm.deleted_size(),
         }
     }
 
@@ -1041,6 +1452,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.file_count(),
             NeedleMap::Redb(nm) => nm.file_count(),
+            NeedleMap::SortedFile(nm) => nm.file_count(),
         }
     }
 
@@ -1049,6 +1461,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.deleted_count(),
             NeedleMap::Redb(nm) => nm.deleted_count(),
+            NeedleMap::SortedFile(nm) => nm.deleted_count(),
         }
     }
 
@@ -1057,9 +1470,22 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.max_file_key(),
             NeedleMap::Redb(nm) => nm.max_file_key(),
+            NeedleMap::SortedFile(nm) => nm.max_file_key(),
         }
     }
 
+    /// Skew the live file count away from what the `.idx` holds, so tests
+    /// can build a volume whose reported count disagrees with a reload.
+    #[cfg(test)]
+    pub(crate) fn add_file_count_for_test(&self, delta: i64) {
+        let metric = match self {
+            NeedleMap::InMemory(nm) => &nm.metric,
+            NeedleMap::Redb(nm) => &nm.metric,
+            NeedleMap::SortedFile(_) => panic!("sorted-file needle maps are read-only"),
+        };
+        metric.file_count.fetch_add(delta, Ordering::Relaxed);
+    }
+
     /// Largest (offset + actual size) seen during the load walk; 0 if the
     /// map is empty. Used at volume load to detect .idx entries that
     /// reference past the end of .dat (issue #8928) without a second scan.
@@ -1067,6 +1493,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.max_needle_end(),
             NeedleMap::Redb(nm) => nm.max_needle_end(),
+            NeedleMap::SortedFile(nm) => nm.max_needle_end(),
         }
     }
 
@@ -1075,6 +1502,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.index_file_size(),
             NeedleMap::Redb(nm) => nm.index_file_size(),
+            NeedleMap::SortedFile(nm) => nm.index_file_size(),
         }
     }
 
@@ -1083,6 +1511,7 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.sync(),
             NeedleMap::Redb(nm) => nm.sync(),
+            NeedleMap::SortedFile(nm) => nm.sync(),
         }
     }
 
@@ -1091,6 +1520,17 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.close(),
             NeedleMap::Redb(nm) => nm.close(),
+            NeedleMap::SortedFile(nm) => nm.close(),
+        }
+    }
+
+    /// Close without checkpointing — sync the .idx and drop the writer only.
+    /// See [`RedbNeedleMap::close_without_checkpoint`].
+    pub fn close_without_checkpoint(&mut self) {
+        match self {
+            NeedleMap::InMemory(nm) => nm.close(),
+            NeedleMap::Redb(nm) => nm.close_without_checkpoint(),
+            NeedleMap::SortedFile(nm) => nm.close(),
         }
     }
 
@@ -1099,33 +1539,41 @@ impl NeedleMap {
         match self {
             NeedleMap::InMemory(nm) => nm.save_to_idx(path),
             NeedleMap::Redb(nm) => nm.save_to_idx(path),
+            NeedleMap::SortedFile(nm) => nm.save_to_idx(path),
         }
     }
 
     /// Visit all entries in ascending order by needle ID.
-    pub fn ascending_visit<F>(&self, f: F) -> Result<(), String>
+    pub fn ascending_visit<F, E>(&self, f: F) -> Result<(), E>
     where
-        F: FnMut(NeedleId, &NeedleValue) -> Result<(), String>,
+        F: FnMut(NeedleId, &NeedleValue) -> Result<(), E>,
+        E: From<String>,
     {
         match self {
             NeedleMap::InMemory(nm) => nm.ascending_visit(f),
             NeedleMap::Redb(nm) => nm.ascending_visit(f),
+            NeedleMap::SortedFile(nm) => nm.ascending_visit(f),
         }
     }
 
     /// Iterate all entries. Returns a Vec of (NeedleId, NeedleValue) pairs.
-    /// For InMemory this collects via ascending visit; for Redb it reads from disk.
-    pub fn iter_entries(&self) -> Vec<(NeedleId, NeedleValue)> {
+    /// For InMemory this collects via ascending visit; the disk-backed maps read
+    /// it back off disk, so a truncated .sdx or a redb read fault surfaces here
+    /// as an error. Compaction treats the result as the complete live set, so a
+    /// partial scan must never be mistaken for an empty tail.
+    pub fn iter_entries(&self) -> io::Result<Vec<(NeedleId, NeedleValue)>> {
         match self {
             NeedleMap::InMemory(nm) => {
                 let mut entries = Vec::new();
+                // The visitor never fails, so neither can this.
                 let _ = nm.ascending_visit(|id, nv| {
                     entries.push((id, *nv));
-                    Ok(())
+                    Ok::<(), std::convert::Infallible>(())
                 });
-                entries
+                Ok(entries)
             }
             NeedleMap::Redb(nm) => nm.collect_entries(),
+            NeedleMap::SortedFile(nm) => nm.iter_entries(),
         }
     }
 }
@@ -1134,6 +1582,37 @@ impl NeedleMap {
 // Tests
 // ============================================================================
 
+#[cfg(test)]
+pub(crate) mod test_support {
+    use super::*;
+
+    /// The `.idx` size in the map's META table, read through the live
+    /// handle.
+    ///
+    /// The load path records the `.idx` size with `Durability::None`, and
+    /// every `put`/`delete` also commits non-durably, so before the first
+    /// checkpoint this is the load-time value (`Some(0)` for a fresh map) —
+    /// NOT the crash-durable `None` a copy of the open `.rdb` would show.
+    /// A live read is the only portable observation: redb 4.2.0 takes an
+    /// exclusive whole-file lock, which is advisory on Unix but mandatory
+    /// on Windows, so copying the open `.rdb` fails there with OS error 33.
+    ///
+    /// It still pins the property under test: the only *durable* META
+    /// writer is `checkpoint`, so any value other than the load-time one
+    /// proves a checkpoint recorded progress — and the post-checkpoint
+    /// value equals the durable one, because checkpoints commit with
+    /// `Durability::Immediate`. What is lost vs the old copy: strict crash
+    /// fidelity — a hard crash pre-checkpoint would leave META absent
+    /// rather than `Some(0)` (loader-equivalent outcomes: full rebuild vs
+    /// replay-from-0, both correct). A clean close+reopen cannot recover
+    /// that distinction either: dropping the `Database` flushes pending
+    /// non-durable commits, so a reopened handle reads `Some(0)` just like
+    /// the live one.
+    pub(crate) fn live_meta_idx_size(nm: &RedbNeedleMap) -> Option<u64> {
+        nm.live_meta_idx_size()
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1269,31 +1748,247 @@ mod tests {
 
     // ---- RedbNeedleMap tests ----
 
+    /// The cache budget production gives the smallest redb tier.
+    fn redb_test_cache() -> usize {
+        NeedleMapKind::Redb.redb_cache_bytes()
+    }
+
+    /// Open a redb map on an empty .idx with an append writer attached, the
+    /// way `Volume::load_index_redb` opens a writable volume.
+    fn open_writable_redb(
+        dir: &std::path::Path,
+    ) -> (RedbNeedleMap, std::path::PathBuf, std::path::PathBuf) {
+        let db_path = dir.join("v.rdb");
+        let idx_path = dir.join("v.idx");
+        let idx_file = std::fs::OpenOptions::new()
+            .read(true)
+            .write(true)
+            .create(true)
+            .truncate(false)
+            .open(&idx_path)
+            .unwrap();
+        let idx_size = idx_file.metadata().unwrap().len();
+        let mut reader = std::io::BufReader::new(&idx_file);
+        let mut nm = RedbNeedleMap::load_from_idx(
+            db_path.to_str().unwrap(),
+            &mut reader,
+            Version::current(),
+            redb_test_cache(),
+        )
+        .unwrap();
+        let writer = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&idx_path)
+            .unwrap();
+        nm.set_idx_file(Box::new(writer), idx_size);
+        (nm, db_path, idx_path)
+    }
+
+    /// .idx records in non-id order: 10, 1, 5, overwrite 1, delete 5.
+    fn shuffled_idx_with_overwrite_and_delete() -> Vec<u8> {
+        let mut idx_data = Vec::new();
+        idx::write_index_entry(
+            &mut idx_data,
+            NeedleId(10),
+            Offset::from_actual_offset(8),
+            Size(100),
+        )
+        .unwrap();
+        idx::write_index_entry(
+            &mut idx_data,
+            NeedleId(1),
+            Offset::from_actual_offset(128),
+            Size(50),
+        )
+        .unwrap();
+        idx::write_index_entry(
+            &mut idx_data,
+            NeedleId(5),
+            Offset::from_actual_offset(384),
+            Size(75),
+        )
+        .unwrap();
+        idx::write_index_entry(
+            &mut idx_data,
+            NeedleId(1),
+            Offset::from_actual_offset(200),
+            Size(200),
+        )
+        .unwrap();
+        idx::write_index_entry(
+            &mut idx_data,
+            NeedleId(5),
+            Offset::default(),
+            TOMBSTONE_FILE_SIZE,
+        )
+        .unwrap();
+        idx_data
+    }
+
+    #[test]
+    fn test_redb_full_rebuild_last_write_wins_from_shuffled_idx() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("test.rdb");
+        let idx_data = shuffled_idx_with_overwrite_and_delete();
+        let mut cursor = Cursor::new(idx_data);
+        let nm = RedbNeedleMap::load_from_idx(
+            db_path.to_str().unwrap(),
+            &mut cursor,
+            Version::current(),
+            redb_test_cache(),
+        )
+        .unwrap();
+
+        let v10 = nm.get(NeedleId(10)).unwrap().unwrap();
+        assert_eq!(v10.size, Size(100));
+        let v1 = nm.get(NeedleId(1)).unwrap().unwrap();
+        assert_eq!(v1.size, Size(200));
+        assert_eq!(v1.offset, Offset::from_actual_offset(200));
+        assert!(nm.get(NeedleId(5)).unwrap().is_none());
+    }
+
+    #[test]
+    fn test_redb_full_rebuild_drops_keys_absent_from_idx() {
+        let dir = tempfile::tempdir().unwrap();
+        let (mut nm, db_path, idx_path) = open_writable_redb(dir.path());
+        nm.put(NeedleId(1), Offset::from_actual_offset(8), Size(100))
+            .unwrap();
+        nm.put(NeedleId(99), Offset::from_actual_offset(128), Size(50))
+            .unwrap();
+        nm.checkpoint(true).unwrap();
+        nm.close();
+        drop(nm);
+
+        // idx on disk is two entries; stored idx_size is two entries.
+        // Shrink the .idx so try_reuse_rdb rejects (stored > idx) and
+        // full_rebuild runs. Key 99 must not survive.
+        {
+            let f = std::fs::OpenOptions::new()
+                .write(true)
+                .open(&idx_path)
+                .unwrap();
+            f.set_len(NEEDLE_MAP_ENTRY_SIZE as u64).unwrap();
+        }
+
+        let mut idx = std::fs::File::open(&idx_path).unwrap();
+        let reloaded = RedbNeedleMap::load_from_idx(
+            db_path.to_str().unwrap(),
+            &mut idx,
+            Version::current(),
+            redb_test_cache(),
+        )
+        .unwrap();
+        assert!(reloaded.get(NeedleId(1)).unwrap().is_some());
+        assert!(
+            reloaded.get(NeedleId(99)).unwrap().is_none(),
+            "full_rebuild must not keep keys that are not in the .idx"
+        );
+    }
+
+    #[cfg(feature = "redb-experimental-cursor")]
+    #[test]
+    fn test_redb_full_rebuild_insert_before_reads_back_thousands_of_shuffled_keys() {
+        // Enough keys to split leaves. insert_before vs table.insert only
+        // diverges across page boundaries (pending-insert buffer / close).
+        const N: u64 = 4000;
+        let mut idx_data = Vec::new();
+        for i in (1..=N).rev() {
+            idx::write_index_entry(
+                &mut idx_data,
+                NeedleId(i),
+                Offset::from_actual_offset((8 * i) as i64),
+                Size(i as i32),
+            )
+            .unwrap();
+        }
+        idx::write_index_entry(
+            &mut idx_data,
+            NeedleId(1),
+            Offset::from_actual_offset(200),
+            Size(200),
+        )
+        .unwrap();
+        idx::write_index_entry(
+            &mut idx_data,
+            NeedleId(2),
+            Offset::default(),
+            TOMBSTONE_FILE_SIZE,
+        )
+        .unwrap();
+
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("test.rdb");
+        let mut cursor = Cursor::new(idx_data);
+        let nm = RedbNeedleMap::load_from_idx(
+            db_path.to_str().unwrap(),
+            &mut cursor,
+            Version::current(),
+            redb_test_cache(),
+        )
+        .unwrap();
+
+        let v1 = nm.get(NeedleId(1)).unwrap().unwrap();
+        assert_eq!(v1.size, Size(200));
+        assert_eq!(v1.offset, Offset::from_actual_offset(200));
+        assert!(nm.get(NeedleId(2)).unwrap().is_none());
+        let v_n = nm.get(NeedleId(N)).unwrap().unwrap();
+        assert_eq!(v_n.size, Size(N as i32));
+        let v3 = nm.get(NeedleId(3)).unwrap().unwrap();
+        assert_eq!(v3.size, Size(3));
+        assert_eq!(v3.offset, Offset::from_actual_offset(24));
+
+        let mut live = 0u64;
+        nm.ascending_visit(|_, _| {
+            live += 1;
+            Ok::<(), String>(())
+        })
+        .unwrap();
+        assert_eq!(live, N - 1);
+    }
+
     #[test]
     fn test_redb_needle_map_put_get() {
         let dir = tempfile::tempdir().unwrap();
         let db_path = dir.path().join("test.rdb");
-        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap()).unwrap();
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
 
         nm.put(NeedleId(1), Offset::from_actual_offset(0), Size(100))
             .unwrap();
         nm.put(NeedleId(2), Offset::from_actual_offset(128), Size(200))
             .unwrap();
 
-        let v1 = nm.get(NeedleId(1)).unwrap();
+        let v1 = nm.get(NeedleId(1)).unwrap().unwrap();
         assert_eq!(v1.size, Size(100));
 
-        let v2 = nm.get(NeedleId(2)).unwrap();
+        let v2 = nm.get(NeedleId(2)).unwrap().unwrap();
         assert_eq!(v2.size, Size(200));
 
-        assert!(nm.get(NeedleId(99)).is_none());
+        assert!(nm.get(NeedleId(99)).unwrap().is_none());
+    }
+
+    #[test]
+    fn test_redb_put_overwrite_metrics_without_prior_get() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("test.rdb");
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
+        nm.put(NeedleId(1), Offset::from_actual_offset(8), Size(100))
+            .unwrap();
+        nm.put(NeedleId(1), Offset::from_actual_offset(200), Size(200))
+            .unwrap();
+        assert_eq!(nm.file_count(), 2);
+        assert_eq!(nm.content_size(), 300);
+        assert_eq!(nm.deleted_count(), 1);
+        assert_eq!(nm.deleted_size(), 100);
+        let v = nm.get(NeedleId(1)).unwrap().unwrap();
+        assert_eq!(v.size, Size(200));
+        assert_eq!(v.offset, Offset::from_actual_offset(200));
     }
 
     #[test]
     fn test_redb_needle_map_delete() {
         let dir = tempfile::tempdir().unwrap();
         let db_path = dir.path().join("test.rdb");
-        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap()).unwrap();
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
 
         nm.put(NeedleId(1), Offset::from_actual_offset(0), Size(100))
             .unwrap();
@@ -1311,7 +2006,7 @@ mod tests {
         assert_eq!(nm.deleted_size(), 100);
 
         // Deleted entry should have negated size
-        let nv = nm.get(NeedleId(1)).unwrap();
+        let nv = nm.get(NeedleId(1)).unwrap().unwrap();
         assert_eq!(nv.size, Size(-100));
     }
 
@@ -1319,7 +2014,7 @@ mod tests {
     fn test_redb_needle_map_metrics() {
         let dir = tempfile::tempdir().unwrap();
         let db_path = dir.path().join("test.rdb");
-        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap()).unwrap();
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
 
         nm.put(NeedleId(1), Offset::from_actual_offset(0), Size(100))
             .unwrap();
@@ -1382,19 +2077,29 @@ mod tests {
         .unwrap();
 
         let mut cursor = Cursor::new(idx_data);
-        let nm = RedbNeedleMap::load_from_idx(db_path.to_str().unwrap(), &mut cursor, Version::current()).unwrap();
+        let nm = RedbNeedleMap::load_from_idx(
+            db_path.to_str().unwrap(),
+            &mut cursor,
+            Version::current(),
+            redb_test_cache(),
+        )
+        .unwrap();
 
-        assert!(nm.get(NeedleId(1)).is_some());
-        assert!(nm.get(NeedleId(2)).is_none()); // deleted and removed
-        assert!(nm.get(NeedleId(3)).is_some());
-        assert_eq!(nm.file_count(), 2);
+        assert!(nm.get(NeedleId(1)).unwrap().is_some());
+        assert!(nm.get(NeedleId(2)).unwrap().is_none()); // deleted and removed
+        assert!(nm.get(NeedleId(3)).unwrap().is_some());
+        // Same history as test_needle_map_load_from_idx: the counters must
+        // match what the in-memory map (and a live volume) accumulates.
+        assert_eq!(nm.file_count(), 3);
+        assert_eq!(nm.deleted_count(), 1);
+        assert_eq!(nm.deleted_size(), 200);
     }
 
     #[test]
     fn test_redb_needle_map_double_delete() {
         let dir = tempfile::tempdir().unwrap();
         let db_path = dir.path().join("test.rdb");
-        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap()).unwrap();
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
 
         nm.put(NeedleId(1), Offset::from_actual_offset(0), Size(100))
             .unwrap();
@@ -1412,11 +2117,31 @@ mod tests {
         assert_eq!(nm.deleted_count(), 1); // not double counted
     }
 
+    #[test]
+    fn test_redb_delete_wrong_length_value_is_absent_not_panic() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("test.rdb");
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
+        {
+            let txn = RedbNeedleMap::begin_write_no_fsync(nm.db.as_ref().unwrap()).unwrap();
+            {
+                let mut table = txn.open_table(NEEDLE_TABLE).unwrap();
+                table.insert(1u64, &b"xx"[..]).unwrap();
+            }
+            txn.commit().unwrap();
+        }
+        let deleted = nm
+            .delete(NeedleId(1), Offset::from_actual_offset(0))
+            .unwrap();
+        assert_eq!(deleted, None);
+        assert_eq!(nm.deleted_count(), 0);
+    }
+
     #[test]
     fn test_redb_needle_map_ascending_visit() {
         let dir = tempfile::tempdir().unwrap();
         let db_path = dir.path().join("test.rdb");
-        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap()).unwrap();
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
 
         nm.put(NeedleId(3), Offset::from_actual_offset(384), Size(300))
             .unwrap();
@@ -1428,7 +2153,7 @@ mod tests {
         let mut visited = Vec::new();
         nm.ascending_visit(|id, nv| {
             visited.push((id, nv.size));
-            Ok(())
+            Ok::<(), String>(())
         })
         .unwrap();
 
@@ -1444,7 +2169,7 @@ mod tests {
         let db_path = dir.path().join("test.rdb");
         let idx_path = dir.path().join("test.idx");
 
-        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap()).unwrap();
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap();
         nm.put(NeedleId(1), Offset::from_actual_offset(8), Size(100))
             .unwrap();
         nm.put(NeedleId(2), Offset::from_actual_offset(128), Size(200))
@@ -1503,7 +2228,7 @@ mod tests {
         let mut nm = NeedleMap::InMemory(CompactNeedleMap::new());
         nm.put(NeedleId(1), Offset::from_actual_offset(0), Size(100))
             .unwrap();
-        assert_eq!(nm.get(NeedleId(1)).unwrap().size, Size(100));
+        assert_eq!(nm.get(NeedleId(1)).unwrap().unwrap().size, Size(100));
         assert_eq!(nm.file_count(), 1);
     }
 
@@ -1511,10 +2236,232 @@ mod tests {
     fn test_needle_map_enum_redb() {
         let dir = tempfile::tempdir().unwrap();
         let db_path = dir.path().join("test.rdb");
-        let mut nm = NeedleMap::Redb(RedbNeedleMap::new(db_path.to_str().unwrap()).unwrap());
+        let mut nm = NeedleMap::Redb(
+            RedbNeedleMap::new(db_path.to_str().unwrap(), redb_test_cache()).unwrap(),
+        );
         nm.put(NeedleId(1), Offset::from_actual_offset(0), Size(100))
             .unwrap();
-        assert_eq!(nm.get(NeedleId(1)).unwrap().size, Size(100));
+        assert_eq!(nm.get(NeedleId(1)).unwrap().unwrap().size, Size(100));
         assert_eq!(nm.file_count(), 1);
     }
+
+    #[test]
+    fn test_needle_map_kind_redb_cache_bytes_grows_by_tier() {
+        // Per-volume redb cache budgets. These must stay small: a volume
+        // server opens one redb database per volume, so the process-wide
+        // ceiling is roughly (volumes x budget).
+        assert_eq!(NeedleMapKind::Redb.redb_cache_bytes(), 4 * 1024 * 1024);
+        assert_eq!(
+            NeedleMapKind::RedbMedium.redb_cache_bytes(),
+            8 * 1024 * 1024
+        );
+        assert_eq!(
+            NeedleMapKind::RedbLarge.redb_cache_bytes(),
+            16 * 1024 * 1024
+        );
+    }
+
+    #[test]
+    fn test_redb_needle_map_tiny_cache_still_serves_all_entries() {
+        let dir = tempfile::tempdir().unwrap();
+        let db_path = dir.path().join("test.rdb");
+        // A cache far smaller than the data forces redb to evict pages on
+        // every write and read; every entry must still round-trip.
+        let mut nm = RedbNeedleMap::new(db_path.to_str().unwrap(), 64 * 1024).unwrap();
+        let n = 3000u64;
+        for i in 1..=n {
+            nm.put(
+                NeedleId(i),
+                Offset::from_actual_offset((i * 8) as i64),
+                Size(i as i32),
+            )
+            .unwrap();
+        }
+        for i in 1..=n {
+            let v = nm.get(NeedleId(i)).unwrap().unwrap();
+            assert_eq!(v.size, Size(i as i32));
+            assert_eq!(v.offset, Offset::from_actual_offset((i * 8) as i64));
+        }
+        assert_eq!(nm.file_count(), n as i64);
+    }
+
+    #[test]
+    fn test_redb_checkpoint_is_explicit_and_due_every_interval() {
+        use test_support::live_meta_idx_size;
+
+        // Every non-durable redb commit leaves bookkeeping behind until a
+        // durable one clears it, so a writable map asks for a checkpoint on
+        // a fixed cadence. The map never takes it by itself: the volume has
+        // to flush the .dat first, then call checkpoint().
+        const EXPECTED_INTERVAL: u64 = 1000;
+        let dir = tempfile::tempdir().unwrap();
+        let (mut nm, db_path, _idx_path) = open_writable_redb(dir.path());
+        for i in 1..EXPECTED_INTERVAL {
+            nm.put(
+                NeedleId(i),
+                Offset::from_actual_offset((i * 8) as i64),
+                Size(1),
+            )
+            .unwrap();
+            assert!(!nm.checkpoint_due(), "due after only {i} writes");
+        }
+        nm.put(
+            NeedleId(EXPECTED_INTERVAL),
+            Offset::from_actual_offset((EXPECTED_INTERVAL * 8) as i64),
+            Size(1),
+        )
+        .unwrap();
+        assert!(nm.checkpoint_due());
+        // No checkpoint taken yet: META still holds the load-time .idx size.
+        // put() only commits non-durably, so the live value is unchanged.
+        assert_eq!(
+            live_meta_idx_size(&nm),
+            Some(0),
+            "put() must not record checkpoint progress"
+        );
+
+        nm.checkpoint(true).unwrap();
+        assert!(!nm.checkpoint_due());
+        assert_eq!(
+            live_meta_idx_size(&nm),
+            Some(EXPECTED_INTERVAL * NEEDLE_MAP_ENTRY_SIZE as u64),
+            "checkpoint records how much of the .idx the table reflects"
+        );
+
+        // Everything is durable after the checkpoint, so the map is closed
+        // first and the snapshot sees the same bytes on every platform.
+        // (Copying while open fails on Windows, where redb's file lock is
+        // mandatory: what a crash leaves.)
+        drop(nm);
+        let crash_copy = dir.path().join("crash.rdb");
+        std::fs::copy(&db_path, &crash_copy).unwrap();
+        let db = Database::open(&crash_copy).unwrap();
+        let txn = db.begin_read().unwrap();
+        let table = txn.open_table(NEEDLE_TABLE).unwrap();
+        assert!(
+            table.get(EXPECTED_INTERVAL).unwrap().is_some(),
+            "entries up to the checkpoint are durable"
+        );
+    }
+
+    #[test]
+    fn test_redb_close_records_idx_size_so_reload_does_not_double_count() {
+        let dir = tempfile::tempdir().unwrap();
+        let (mut nm, db_path, idx_path) = open_writable_redb(dir.path());
+        for i in 1..=5u64 {
+            nm.put(
+                NeedleId(i),
+                Offset::from_actual_offset((i * 8) as i64),
+                Size(1),
+            )
+            .unwrap();
+        }
+        nm.close();
+        drop(nm);
+
+        // A clean close leaves the table durable; the recorded .idx size
+        // must match it, or the reload replays the same 5 entries on top.
+        let mut idx = std::fs::File::open(&idx_path).unwrap();
+        let reloaded = RedbNeedleMap::load_from_idx(
+            db_path.to_str().unwrap(),
+            &mut idx,
+            Version::current(),
+            redb_test_cache(),
+        )
+        .unwrap();
+        assert_eq!(reloaded.file_count(), 5);
+        assert_eq!(reloaded.deleted_count(), 0);
+    }
+
+    #[test]
+    fn test_redb_reload_with_stale_idx_size_does_not_double_count() {
+        let dir = tempfile::tempdir().unwrap();
+        let (mut nm, db_path, idx_path) = open_writable_redb(dir.path());
+        for i in 1..=5u64 {
+            nm.put(
+                NeedleId(i),
+                Offset::from_actual_offset((i * 8) as i64),
+                Size(1),
+            )
+            .unwrap();
+        }
+        // Drop without close(): redb makes the table durable on drop, but the
+        // recorded .idx size stays at its load-time value (0), so the reload
+        // replays all 5 entries over rows the table already holds.
+        drop(nm);
+
+        let mut idx = std::fs::File::open(&idx_path).unwrap();
+        let reloaded = RedbNeedleMap::load_from_idx(
+            db_path.to_str().unwrap(),
+            &mut idx,
+            Version::current(),
+            redb_test_cache(),
+        )
+        .unwrap();
+        assert_eq!(reloaded.file_count(), 5);
+        assert_eq!(reloaded.deleted_count(), 0);
+        assert_eq!(
+            reloaded.get(NeedleId(5)).unwrap().unwrap().offset,
+            Offset::from_actual_offset(40)
+        );
+    }
+
+    #[test]
+    fn test_redb_reload_metrics_keep_overwrite_and_delete_history() {
+        // garbage_level() is deleted_size / content_size. Every load path
+        // must rebuild both from the whole .idx history, the way the live
+        // counters accumulate, not from the table's final state, or the
+        // bytes of overwritten and deleted needles stop counting as garbage
+        // after a restart.
+        for (close_first, rebuild) in [(true, false), (false, false), (true, true)] {
+            let dir = tempfile::tempdir().unwrap();
+            let (mut nm, db_path, idx_path) = open_writable_redb(dir.path());
+            nm.put(NeedleId(1), Offset::from_actual_offset(8), Size(100))
+                .unwrap();
+            // Overwrite: the first 100 bytes become garbage.
+            nm.put(NeedleId(1), Offset::from_actual_offset(200), Size(200))
+                .unwrap();
+            nm.put(NeedleId(2), Offset::from_actual_offset(500), Size(50))
+                .unwrap();
+            nm.delete(NeedleId(2), Offset::from_actual_offset(600))
+                .unwrap();
+            let live = (
+                nm.file_count(),
+                nm.content_size(),
+                nm.deleted_count(),
+                nm.deleted_size(),
+            );
+            assert_eq!(live, (3, 350, 2, 150));
+            if close_first {
+                nm.close();
+            }
+            drop(nm);
+            if rebuild {
+                std::fs::remove_file(&db_path).unwrap();
+            }
+
+            let mut idx = std::fs::File::open(&idx_path).unwrap();
+            let reloaded = RedbNeedleMap::load_from_idx(
+                db_path.to_str().unwrap(),
+                &mut idx,
+                Version::current(),
+                redb_test_cache(),
+            )
+            .unwrap();
+            let after = (
+                reloaded.file_count(),
+                reloaded.content_size(),
+                reloaded.deleted_count(),
+                reloaded.deleted_size(),
+            );
+            assert_eq!(after, live, "close_first={close_first} rebuild={rebuild}");
+            assert_eq!(reloaded.get(NeedleId(1)).unwrap().unwrap().size, Size(200));
+            assert!(
+                reloaded
+                    .get(NeedleId(2))
+                    .unwrap()
+                    .is_none_or(|v| v.size.is_deleted())
+            );
+        }
+    }
 }
diff --git a/seaweed-volume/src/storage/needle_map/compact_map.rs b/seaweed-volume/src/storage/needle_map/compact_map.rs
index 9dea94ce7e..d0ba4a1c68 100644
--- a/seaweed-volume/src/storage/needle_map/compact_map.rs
+++ b/seaweed-volume/src/storage/needle_map/compact_map.rs
@@ -31,7 +31,7 @@ struct CompactEntry {
 }
 
 impl CompactEntry {
-    fn to_needle_value(&self) -> NeedleValue {
+    fn to_needle_value(self) -> NeedleValue {
         NeedleValue {
             offset: Offset::from_bytes(&self.offset),
             size: self.size,
diff --git a/seaweed-volume/src/storage/needle_map/file_pool.rs b/seaweed-volume/src/storage/needle_map/file_pool.rs
new file mode 100644
index 0000000000..e2884de0c4
--- /dev/null
+++ b/seaweed-volume/src/storage/needle_map/file_pool.rs
@@ -0,0 +1,264 @@
+//! Bounded pool of open index-file descriptors.
+//!
+//! Read-only volumes — cloud-tiered ones above all — outnumber writable ones by
+//! orders of magnitude on a large server, and a volume that pins its `.idx` and
+//! `.sdx` for the life of the process costs two descriptors whether or not
+//! anybody reads it. At ~600K volumes per server that alone exhausts any fd
+//! limit. Neither file is needed except while a lookup is in flight, so
+//! [`SortedFileNeedleMap`](super::sorted_file::SortedFileNeedleMap) borrows them
+//! from this pool: an idle volume holds nothing, a busy one keeps its handles
+//! hot rather than paying an `open()` per needle.
+//!
+//! Mirrors Go's `weed/storage/needle_map_file_pool.go`. Handles are handed out
+//! as `Arc<File>`, so an eviction cannot close a descriptor a reader still
+//! holds — the file closes when the last borrower drops its `Arc`.
+
+use std::collections::{BTreeMap, HashMap};
+use std::fs::{File, OpenOptions};
+use std::io;
+use std::sync::{Arc, Mutex, OnceLock};
+
+use crate::storage::volume_open::open_volume_file;
+
+/// Descriptors the pool keeps open. Matches Go's `maxPooledIndexFiles`.
+pub const MAX_POOLED_INDEX_FILES: usize = 1024;
+
+struct Entry {
+    file: Arc<File>,
+    tick: u64,
+}
+
+#[derive(Default)]
+struct Inner {
+    entries: HashMap<String, Entry>,
+    /// Recency order, oldest tick first, so eviction is a `pop_first`.
+    order: BTreeMap<u64, String>,
+    next_tick: u64,
+}
+
+pub struct IndexFilePool {
+    capacity: usize,
+    inner: Mutex<Inner>,
+}
+
+/// Writable and read-only handles for the same path are pooled separately so a
+/// read never depends on the file being openable for write — a volume served
+/// off a read-only mount still answers lookups.
+fn pool_key(path: &str, writable: bool) -> String {
+    if writable {
+        format!("{path}\0rw")
+    } else {
+        path.to_string()
+    }
+}
+
+impl IndexFilePool {
+    pub fn new(capacity: usize) -> Self {
+        IndexFilePool {
+            capacity: capacity.max(1),
+            inner: Mutex::new(Inner::default()),
+        }
+    }
+
+    /// Hand out an open handle for `path`, reusing the pooled one when there is
+    /// one. The descriptor lives as long as the returned `Arc`.
+    pub fn borrow(&self, path: &str, writable: bool) -> io::Result<Arc<File>> {
+        let key = pool_key(path, writable);
+        if let Some(file) = self.touch(&key) {
+            return Ok(file);
+        }
+
+        // Opened outside the lock: a cold open blocks on disk, and holding a
+        // process-wide mutex across it would serialize every volume's lookups.
+        let file = Arc::new(open_volume_file(
+            OpenOptions::new().read(true).write(writable),
+            path,
+        )?);
+        Ok(self.insert(key, file))
+    }
+
+    /// Forget the pooled handles for `path`, so a later rename or delete of that
+    /// path cannot be served from a descriptor on the old inode.
+    pub fn discard(&self, path: &str) {
+        let mut inner = self.inner.lock().unwrap();
+        for key in [pool_key(path, false), pool_key(path, true)] {
+            if let Some(entry) = inner.entries.remove(&key) {
+                inner.order.remove(&entry.tick);
+            }
+        }
+    }
+
+    /// Descriptors currently pooled. Test-only visibility into the bound.
+    #[cfg(test)]
+    pub fn pooled_count(&self) -> usize {
+        self.inner.lock().unwrap().entries.len()
+    }
+
+    fn touch(&self, key: &str) -> Option<Arc<File>> {
+        let mut inner = self.inner.lock().unwrap();
+        let tick = inner.next_tick;
+        let entry = inner.entries.get_mut(key)?;
+        let file = entry.file.clone();
+        let old_tick = std::mem::replace(&mut entry.tick, tick);
+        inner.order.remove(&old_tick);
+        inner.order.insert(tick, key.to_string());
+        inner.next_tick += 1;
+        Some(file)
+    }
+
+    fn insert(&self, key: String, file: Arc<File>) -> Arc<File> {
+        let mut inner = self.inner.lock().unwrap();
+        if let Some(entry) = inner.entries.get(&key) {
+            // Another borrower opened the same path first; keep one descriptor.
+            return entry.file.clone();
+        }
+        let tick = inner.next_tick;
+        inner.next_tick += 1;
+        inner.order.insert(tick, key.clone());
+        inner.entries.insert(
+            key,
+            Entry {
+                file: file.clone(),
+                tick,
+            },
+        );
+        while inner.entries.len() > self.capacity {
+            let Some((_, oldest)) = inner.order.pop_first() else {
+                break;
+            };
+            inner.entries.remove(&oldest);
+        }
+        file
+    }
+}
+
+/// Process-wide pool shared by every read-only volume on this server.
+pub fn pooled_index_files() -> &'static IndexFilePool {
+    static POOL: OnceLock<IndexFilePool> = OnceLock::new();
+    POOL.get_or_init(|| IndexFilePool::new(MAX_POOLED_INDEX_FILES))
+}
+
+/// Descriptors this process holds on `.idx`/`.sdx` files under `dir`, read from
+/// `/proc/self/fd` where it exists and from `lsof` otherwise. `None` when
+/// neither is available, so a caller can skip rather than assert vacuously.
+#[cfg(test)]
+pub(crate) fn open_index_fds(dir: &std::path::Path) -> Option<usize> {
+    let prefix = std::fs::canonicalize(dir).unwrap_or_else(|_| dir.to_path_buf());
+    let is_index = |target: &std::path::Path| {
+        target.starts_with(&prefix)
+            && matches!(
+                target.extension().and_then(|e| e.to_str()),
+                Some("idx") | Some("sdx")
+            )
+    };
+
+    if let Ok(entries) = std::fs::read_dir("/proc/self/fd") {
+        return Some(
+            entries
+                .filter_map(|e| std::fs::read_link(e.ok()?.path()).ok())
+                .filter(|target| is_index(target))
+                .count(),
+        );
+    }
+
+    let out = std::process::Command::new("lsof")
+        .args(["-p", &std::process::id().to_string(), "-F", "n"])
+        .output()
+        .ok()?;
+    Some(
+        String::from_utf8_lossy(&out.stdout)
+            .lines()
+            .filter_map(|line| line.strip_prefix('n'))
+            .filter(|line| is_index(std::path::Path::new(line)))
+            .count(),
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    fn write_file(dir: &std::path::Path, name: &str, contents: &[u8]) -> String {
+        let path = dir.join(name);
+        let mut f = File::create(&path).unwrap();
+        f.write_all(contents).unwrap();
+        path.to_str().unwrap().to_string()
+    }
+
+    #[test]
+    fn evicted_handle_stays_usable_for_its_borrower() {
+        let dir = tempfile::tempdir().unwrap();
+        let first = write_file(dir.path(), "first", b"first");
+        let second = write_file(dir.path(), "second", b"second");
+
+        let pool = IndexFilePool::new(1);
+        let borrowed = pool.borrow(&first, false).unwrap();
+
+        // Pushes the single slot over, evicting the entry still in use.
+        let _other = pool.borrow(&second, false).unwrap();
+        assert_eq!(pool.pooled_count(), 1);
+
+        let mut buf = [0u8; 5];
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::FileExt;
+            borrowed.read_exact_at(&mut buf, 0).unwrap();
+        }
+        #[cfg(windows)]
+        {
+            use std::os::windows::fs::FileExt;
+            let mut filled = 0;
+            let mut at = 0;
+            while filled < buf.len() {
+                let n = borrowed.seek_read(&mut buf[filled..], at).unwrap();
+                assert!(n != 0, "unexpected EOF in seek_read");
+                filled += n;
+                at += n as u64;
+            }
+        }
+        assert_eq!(&buf, b"first");
+    }
+
+    #[test]
+    fn borrow_reuses_the_pooled_handle() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_file(dir.path(), "idx", b"x");
+
+        let pool = IndexFilePool::new(4);
+        let a = pool.borrow(&path, false).unwrap();
+        let b = pool.borrow(&path, false).unwrap();
+        assert!(Arc::ptr_eq(&a, &b));
+        assert_eq!(pool.pooled_count(), 1);
+
+        // A writable handle is pooled separately from the read-only one.
+        let w = pool.borrow(&path, true).unwrap();
+        assert!(!Arc::ptr_eq(&a, &w));
+        assert_eq!(pool.pooled_count(), 2);
+    }
+
+    #[test]
+    fn discard_drops_both_handles() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = write_file(dir.path(), "idx", b"x");
+
+        let pool = IndexFilePool::new(4);
+        let _r = pool.borrow(&path, false).unwrap();
+        let _w = pool.borrow(&path, true).unwrap();
+        assert_eq!(pool.pooled_count(), 2);
+
+        pool.discard(&path);
+        assert_eq!(pool.pooled_count(), 0);
+    }
+
+    #[test]
+    fn pool_stays_within_capacity() {
+        let dir = tempfile::tempdir().unwrap();
+        let pool = IndexFilePool::new(3);
+        for i in 0..10 {
+            let path = write_file(dir.path(), &format!("f{i}"), b"x");
+            let _ = pool.borrow(&path, false).unwrap();
+        }
+        assert_eq!(pool.pooled_count(), 3);
+    }
+}
diff --git a/seaweed-volume/src/storage/needle_map/idx_metric.rs b/seaweed-volume/src/storage/needle_map/idx_metric.rs
new file mode 100644
index 0000000000..39ba03dc67
--- /dev/null
+++ b/seaweed-volume/src/storage/needle_map/idx_metric.rs
@@ -0,0 +1,159 @@
+//! Rebuild a needle map's counters from the whole `.idx` history.
+//!
+//! The volume's garbage ratio is `deleted_size / content_size`, and both are
+//! additive over the life of the volume: an overwritten needle keeps its
+//! bytes in `content_size` and adds them to `deleted_size`. A backend whose
+//! table only holds the final value per key (redb) cannot recover that from
+//! the table, so on load the counters come from the `.idx` file instead.
+//!
+//! This mirrors Go's `needleMapMetricFromIndexFile`: walk the index newest
+//! entry first with a bloom filter of the keys already seen, so the memory
+//! cost is a few bits per entry instead of a map of every key. The counting
+//! rule reproduces what the live `on_put`/`on_delete` path accumulates:
+//!
+//! - every live entry is one put: `file_count`, `file_byte_count`;
+//! - a live entry with a newer entry for the same key was overwritten or
+//!   deleted later, so it is also one deletion: `deletion_count`,
+//!   `deletion_byte_count`;
+//! - a tombstone only marks its key as seen.
+//!
+//! A bloom false positive (0.1%) can only add a spurious deletion, which
+//! over-reports garbage slightly; it never hides any.
+
+use std::io::{self, Read, Seek, SeekFrom};
+use std::sync::atomic::Ordering;
+
+use xxhash_rust::xxh64::xxh64;
+
+use super::NeedleMapMetric;
+use crate::storage::types::*;
+
+/// Entries read per batch while walking backwards (64 KiB of index).
+const BATCH_ENTRIES: usize = 4096;
+/// Same target false-positive rate as the Go server's filter.
+const FALSE_POSITIVE_RATE: f64 = 0.001;
+
+/// Minimal bloom filter over needle ids, double hashing with xxh64.
+struct SeenKeys {
+    bits: Vec<u64>,
+    bit_count: u64,
+    hashes: u64,
+}
+
+impl SeenKeys {
+    fn new(expected: u64, false_positive_rate: f64) -> Self {
+        let n = expected.max(1) as f64;
+        let ln2 = std::f64::consts::LN_2;
+        let bit_count = (-(n * false_positive_rate.ln()) / (ln2 * ln2))
+            .ceil()
+            .max(64.0) as u64;
+        let hashes = ((bit_count as f64 / n) * ln2).round().clamp(1.0, 16.0) as u64;
+        SeenKeys {
+            bits: vec![0u64; bit_count.div_ceil(64) as usize],
+            bit_count,
+            hashes,
+        }
+    }
+
+    /// Whether `key` was (probably) seen before; marks it seen either way.
+    fn test_and_add(&mut self, key: u64) -> bool {
+        let bytes = key.to_le_bytes();
+        let h1 = xxh64(&bytes, 0);
+        let h2 = xxh64(&bytes, 0x9E37_79B9_7F4A_7C15) | 1;
+        let mut seen = true;
+        for i in 0..self.hashes {
+            let bit = h1.wrapping_add(i.wrapping_mul(h2)) % self.bit_count;
+            let word = (bit / 64) as usize;
+            let mask = 1u64 << (bit % 64);
+            if self.bits[word] & mask == 0 {
+                seen = false;
+                self.bits[word] |= mask;
+            }
+        }
+        seen
+    }
+}
+
+/// Walk `reader` (an `.idx` file) newest entry first and return the counters
+/// a live volume would hold after applying the same history. A torn partial
+/// entry at the tail is ignored, as `walk_index_file` does. The reader is
+/// left positioned at the start of the file.
+pub(super) fn metrics_from_idx<R: Read + Seek>(
+    reader: &mut R,
+    version: Version,
+) -> io::Result<NeedleMapMetric> {
+    let metric = NeedleMapMetric::default();
+    let file_size = reader.seek(SeekFrom::End(0))?;
+    let entry_count = file_size / NEEDLE_MAP_ENTRY_SIZE as u64;
+    let mut seen = SeenKeys::new(entry_count, FALSE_POSITIVE_RATE);
+    let mut buf = vec![0u8; NEEDLE_MAP_ENTRY_SIZE * BATCH_ENTRIES];
+
+    let mut remaining = entry_count;
+    while remaining > 0 {
+        let batch = remaining.min(BATCH_ENTRIES as u64) as usize;
+        let first_entry = remaining - batch as u64;
+        let len = batch * NEEDLE_MAP_ENTRY_SIZE;
+        reader.seek(SeekFrom::Start(first_entry * NEEDLE_MAP_ENTRY_SIZE as u64))?;
+        reader.read_exact(&mut buf[..len])?;
+        for i in (0..batch).rev() {
+            let entry = &buf[i * NEEDLE_MAP_ENTRY_SIZE..(i + 1) * NEEDLE_MAP_ENTRY_SIZE];
+            let (key, offset, size) = idx_entry_from_bytes(entry);
+            metric.maybe_set_max_needle_end(offset, size, version);
+            let superseded = seen.test_and_add(key.into());
+            if offset.is_zero() || size.is_deleted() {
+                // Tombstone: reserves no bytes, only marks the key as seen.
+                continue;
+            }
+            metric.maybe_set_max_file_key(key);
+            metric.file_count.fetch_add(1, Ordering::Relaxed);
+            metric
+                .file_byte_count
+                .fetch_add(size.0 as u64, Ordering::Relaxed);
+            if superseded && size.0 > 0 {
+                metric.deletion_count.fetch_add(1, Ordering::Relaxed);
+                metric
+                    .deletion_byte_count
+                    .fetch_add(size.0 as u64, Ordering::Relaxed);
+            }
+        }
+        remaining = first_entry;
+    }
+
+    reader.seek(SeekFrom::Start(0))?;
+    Ok(metric)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_seen_keys_reports_repeats_and_not_fresh_keys() {
+        let mut seen = SeenKeys::new(10_000, FALSE_POSITIVE_RATE);
+        // Fresh keys may occasionally collide (that is the false-positive
+        // rate), but only rarely.
+        let fresh_reported_seen = (0..10_000u64).filter(|&key| seen.test_and_add(key)).count();
+        assert!(
+            fresh_reported_seen < 50,
+            "fresh keys reported seen: {fresh_reported_seen}"
+        );
+        // A repeated key is never reported fresh: no false negatives.
+        for key in 0..10_000u64 {
+            assert!(seen.test_and_add(key), "repeated key {key} reported fresh");
+        }
+        // Over 100k never-inserted keys the false-positive rate stays near
+        // the 0.1% target; allow a generous margin.
+        let false_positives = (1_000_000..1_100_000u64)
+            .filter(|k| {
+                let bytes = k.to_le_bytes();
+                let h1 = xxh64(&bytes, 0);
+                let h2 = xxh64(&bytes, 0x9E37_79B9_7F4A_7C15) | 1;
+                (0..seen.hashes).all(|i| {
+                    let bit = h1.wrapping_add(i.wrapping_mul(h2)) % seen.bit_count;
+                    seen.bits[(bit / 64) as usize] & (1u64 << (bit % 64)) != 0
+                })
+            })
+            .count();
+        assert!(false_positives < 500, "false positives: {false_positives}");
+    }
+}
diff --git a/seaweed-volume/src/storage/needle_map/sorted_file.rs b/seaweed-volume/src/storage/needle_map/sorted_file.rs
new file mode 100644
index 0000000000..ec3f9af0a4
--- /dev/null
+++ b/seaweed-volume/src/storage/needle_map/sorted_file.rs
@@ -0,0 +1,1114 @@
+//! Disk-backed needle map for read-only volumes, mirroring Go's
+//! `weed/storage/needle_map_sorted_file.go`.
+//!
+//! A read-only or cloud-tiered volume does not need its index in RAM: `.sdx` is
+//! the `.idx` rewritten as a sorted array of live entries, so a lookup is a
+//! binary search on disk. Deletes append a tombstone to the tail of `.idx` and
+//! mark the `.sdx` record in place.
+//!
+//! The map holds no descriptor of its own — both files are borrowed per
+//! operation from [`file_pool`](super::file_pool) — so a volume nobody is
+//! reading costs zero fds and zero index bytes of RAM.
+
+use std::collections::HashMap;
+use std::fs::{File, OpenOptions};
+use std::io;
+use std::sync::atomic::Ordering;
+use std::sync::{Mutex, RwLock};
+
+use super::file_pool::pooled_index_files;
+use crate::storage::idx;
+use crate::storage::io::read_exact_at;
+use crate::storage::needle_map::{CompactNeedleMap, NeedleMapMetric, NeedleValue};
+use crate::storage::types::*;
+
+/// Entries per positional read when scanning `.sdx` end to end.
+const ROWS_TO_READ: u64 = 1024;
+
+/// Byte offset of the `Size` field inside a 17-byte index entry.
+const ENTRY_SIZE_OFFSET: u64 = (NEEDLE_ID_SIZE + OFFSET_SIZE) as u64;
+
+/// Appends made since the last sync, plus the tail offset the next tombstone
+/// goes to. Seeded from the `.idx` size at open so a delete appends instead of
+/// overwriting the front of the file.
+struct IndexTail {
+    offset: u64,
+    needs_sync: bool,
+}
+
+pub struct SortedFileNeedleMap {
+    metric: NeedleMapMetric,
+    index_file_name: String,
+    db_file_name: String,
+    db_file_size: i64,
+    tail: Mutex<IndexTail>,
+    /// Needles whose tombstone is durable in `.idx` but whose `.sdx` record
+    /// this process could not mark. `.sdx` is only a search accelerator over
+    /// `.idx`, so a stale record there would keep serving bytes the volume has
+    /// already accepted a delete for, until a reload rebuilds it. Lookups
+    /// consult this first and report the needle deleted, which is what the
+    /// next reload will conclude too.
+    pending_tombstones: RwLock<HashMap<NeedleId, Offset>>,
+    /// Test seam: forces the in-place `.sdx` mark to fail so the tests can
+    /// exercise the "tombstone durable in `.idx`, mark did not land" path,
+    /// which no portable filesystem trick reproduces (a read-only `.sdx`
+    /// fails the borrow long before the mark).
+    #[cfg(test)]
+    fail_sdx_mark: std::sync::atomic::AtomicBool,
+}
+
+impl SortedFileNeedleMap {
+    /// Open the sorted map for the volume whose index files share
+    /// `index_base_file_name` (the path with no extension), regenerating `.sdx`
+    /// when it is older than `.idx` or torn.
+    pub fn open(index_base_file_name: &str, version: Version) -> io::Result<Self> {
+        let index_file_name = format!("{index_base_file_name}.idx");
+        let db_file_name = format!("{index_base_file_name}.sdx");
+
+        if !is_sorted_file_fresh(&db_file_name, &index_file_name)
+            || !holds_whole_entries(&db_file_name)
+        {
+            tracing::info!(sdx = %db_file_name, idx = %index_file_name, "generating sorted index");
+            write_sorted_file_from_idx(&index_file_name, &db_file_name, version)?;
+        }
+
+        let db_file_size = std::fs::metadata(&db_file_name)?.len();
+        if db_file_size % NEEDLE_MAP_ENTRY_SIZE as u64 != 0 {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "{db_file_name} is {db_file_size} bytes, not whole {NEEDLE_MAP_ENTRY_SIZE}-byte entries"
+                ),
+            ));
+        }
+        let db_file_size = db_file_size as i64;
+        let index_file_size = std::fs::metadata(&index_file_name)?.len();
+        // Start appends at the last whole entry. A torn tail is overwritten by
+        // the next tombstone rather than leaving every later row misaligned; the
+        // metric walk below ignores it for the same reason.
+        let index_file_size = index_file_size - index_file_size % NEEDLE_MAP_ENTRY_SIZE as u64;
+
+        let metric = index_metric(&index_file_name, &db_file_name, version)?;
+
+        Ok(SortedFileNeedleMap {
+            metric,
+            index_file_name,
+            db_file_name,
+            db_file_size,
+            tail: Mutex::new(IndexTail {
+                offset: index_file_size,
+                needs_sync: false,
+            }),
+            pending_tombstones: RwLock::new(HashMap::new()),
+            #[cfg(test)]
+            fail_sdx_mark: std::sync::atomic::AtomicBool::new(false),
+        })
+    }
+
+    /// Path of the `.sdx` this map searches.
+    pub fn db_file_name(&self) -> &str {
+        &self.db_file_name
+    }
+
+    /// Path of the `.idx` this map appends tombstones to.
+    pub fn index_file_name(&self) -> &str {
+        &self.index_file_name
+    }
+
+    /// Look up a needle. An unreadable or torn `.sdx` — or a pooled reopen that
+    /// fails — is an ERROR, not an absent needle: swallowing it would answer a
+    /// read with "not found" and let a delete report success without recording
+    /// a tombstone, both of which look like data loss to the caller.
+    pub fn get(&self, key: NeedleId) -> io::Result<Option<NeedleValue>> {
+        if let Some(offset) = self
+            .pending_tombstones
+            .read()
+            .expect("pending tombstones lock")
+            .get(&key)
+            .copied()
+        {
+            return Ok(Some(NeedleValue {
+                offset,
+                size: TOMBSTONE_FILE_SIZE,
+            }));
+        }
+        let file = pooled_index_files()
+            .borrow(&self.db_file_name, false)
+            .map_err(|e| io::Error::new(e.kind(), format!("open {}: {}", self.db_file_name, e)))?;
+        match search_sorted_index(&file, self.db_file_size, key)? {
+            Some((_, offset, size)) => Ok(Some(NeedleValue { offset, size })),
+            None => Ok(None),
+        }
+    }
+
+    /// Always an error: a volume backed by `.sdx` is read-only. Mirrors Go's
+    /// `SortedFileNeedleMap.Put`.
+    pub fn put(&mut self, _key: NeedleId, _offset: Offset, _size: Size) -> io::Result<()> {
+        Err(io::Error::new(
+            io::ErrorKind::InvalidInput,
+            format!("needle map {} is read only", self.db_file_name),
+        ))
+    }
+
+    /// Append a tombstone for `key` to `.idx` and mark its `.sdx` record
+    /// deleted. A key that is absent or already deleted is a no-op, matching
+    /// Go.
+    pub fn delete(&self, key: NeedleId, offset: Offset) -> io::Result<Option<Size>> {
+        if self
+            .pending_tombstones
+            .read()
+            .expect("pending tombstones lock")
+            .contains_key(&key)
+        {
+            // Already tombstoned in `.idx`; a second tombstone would double
+            // count, and the mark this process owes `.sdx` is still pending.
+            return Ok(None);
+        }
+        let file = pooled_index_files().borrow(&self.db_file_name, true)?;
+        let Some((entry_index, _, size)) = search_sorted_index(&file, self.db_file_size, key)?
+        else {
+            return Ok(None);
+        };
+        if size.is_deleted() {
+            return Ok(None);
+        }
+
+        // Write to the index file first: .idx is the source of truth a reload
+        // rebuilds .sdx from. If the in-place mark below then fails, the delete
+        // is still durable and neither shape of failure corrupts the index: a
+        // write that lands nothing leaves .sdx older than the .idx we just
+        // appended to, so the next load rebuilds it, and a partial write leaves
+        // the size field's leading 0xff behind, which reads back negative and so
+        // already counts as deleted.
+        self.append_to_index_file(key, offset, TOMBSTONE_FILE_SIZE)?;
+
+        // Move the counters to where a reload would put them, so the heartbeat
+        // does not report this volume as garbage-free until it restarts. The
+        // tombstone is one more .idx row, and under the rule index_metric
+        // applies both it and the row it supersedes count as deletions; the
+        // bytes leave the live set without leaving the .idx.
+        //
+        // This belongs to the `.idx` append, not to the `.sdx` mark below: the
+        // append is what makes the delete durable and what a reload would
+        // count, and the retry path returns early once the overlay records it.
+        // Leaving the counters until after the mark would strand them at their
+        // pre-delete values whenever the mark fails.
+        self.metric.file_count.fetch_add(1, Ordering::Relaxed);
+        self.metric.deletion_count.fetch_add(2, Ordering::Relaxed);
+        self.metric
+            .deletion_byte_count
+            .fetch_add(size.0.max(0) as u64, Ordering::Relaxed);
+
+        // From here the delete is durable in `.idx`, so no lookup may report
+        // this needle live again. Record it before touching `.sdx` and clear
+        // the record only once that mark lands: if the mark fails, the entry
+        // stays and lookups fail closed until a reload rebuilds `.sdx` from
+        // the `.idx` that already carries the tombstone.
+        self.pending_tombstones
+            .write()
+            .expect("pending tombstones lock")
+            .insert(key, offset);
+
+        self.mark_deleted_in_sdx(&file, entry_index)?;
+        self.pending_tombstones
+            .write()
+            .expect("pending tombstones lock")
+            .remove(&key);
+
+        Ok(Some(size))
+    }
+
+    /// Mark the `.sdx` record for `entry_index` deleted in place.
+    fn mark_deleted_in_sdx(&self, file: &File, entry_index: u64) -> io::Result<()> {
+        #[cfg(test)]
+        if self
+            .fail_sdx_mark
+            .load(std::sync::atomic::Ordering::Relaxed)
+        {
+            return Err(io::Error::other("injected .sdx mark failure"));
+        }
+        let mut buf = [0u8; SIZE_SIZE];
+        TOMBSTONE_FILE_SIZE.to_bytes(&mut buf);
+        write_at(
+            file,
+            &buf,
+            entry_index * NEEDLE_MAP_ENTRY_SIZE as u64 + ENTRY_SIZE_OFFSET,
+        )
+    }
+
+    fn append_to_index_file(&self, key: NeedleId, offset: Offset, size: Size) -> io::Result<()> {
+        let file = pooled_index_files().borrow(&self.index_file_name, true)?;
+        let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+        idx_entry_to_bytes(&mut buf, key, offset, size);
+
+        let mut tail = self.tail.lock().unwrap();
+        write_at(&file, &buf, tail.offset)?;
+        tail.offset += NEEDLE_MAP_ENTRY_SIZE as u64;
+        tail.needs_sync = true;
+        Ok(())
+    }
+
+    /// Answers from the offset the appends maintain rather than a stat: the
+    /// heartbeat asks every volume for this on every beat, and a read-only
+    /// volume's `.idx` only ever grows through `append_to_index_file`.
+    pub fn index_file_size(&self) -> u64 {
+        self.tail.lock().unwrap().offset
+    }
+
+    /// Flushes tombstones appended by [`delete`](Self::delete). A read-only
+    /// volume that has never been deleted from — the overwhelming majority —
+    /// opens nothing here, so shutting down a server holding hundreds of
+    /// thousands of them costs no fsyncs.
+    pub fn sync(&self) -> io::Result<()> {
+        let mut tail = self.tail.lock().unwrap();
+        if !tail.needs_sync {
+            return Ok(());
+        }
+        let file = pooled_index_files().borrow(&self.index_file_name, true)?;
+        file.sync_all()?;
+        tail.needs_sync = false;
+        Ok(())
+    }
+
+    /// Drops the pooled handles: the caller may be about to rename or remove
+    /// these paths, and a descriptor left behind would keep answering reads
+    /// from the old inode.
+    pub fn close(&mut self) {
+        let _ = self.sync();
+        pooled_index_files().discard(&self.index_file_name);
+        pooled_index_files().discard(&self.db_file_name);
+    }
+
+    /// Visit the live entries in ascending needle-id order, straight off `.sdx`.
+    fn visit_live_entries<F>(&self, mut f: F) -> io::Result<()>
+    where
+        F: FnMut(NeedleId, &NeedleValue) -> io::Result<()>,
+    {
+        // A needle whose `.sdx` mark failed still reads live off the record.
+        // `get` answers it from the overlay and so must every scan, or a
+        // compaction would copy a deleted needle forward as live. Snapshot it
+        // rather than hold the lock across the whole file.
+        let pending = self
+            .pending_tombstones
+            .read()
+            .expect("pending tombstones lock")
+            .clone();
+        let file = pooled_index_files().borrow(&self.db_file_name, false)?;
+        let entry_count = self.db_file_size.max(0) as u64 / NEEDLE_MAP_ENTRY_SIZE as u64;
+        // A batch per 1024 entries rather than a syscall per entry, matching
+        // idx::walk_index_file. Positional reads, not a cursor: the handle is
+        // shared with any other borrower, so a file position would race.
+        let rows_per_read = ROWS_TO_READ.min(entry_count.max(1));
+        let mut block = vec![0u8; rows_per_read as usize * NEEDLE_MAP_ENTRY_SIZE];
+        let mut done: u64 = 0;
+        while done < entry_count {
+            let rows = rows_per_read.min(entry_count - done) as usize;
+            let bytes = &mut block[..rows * NEEDLE_MAP_ENTRY_SIZE];
+            read_exact_at(&file, bytes, done * NEEDLE_MAP_ENTRY_SIZE as u64)?;
+            for entry in bytes.as_chunks::<NEEDLE_MAP_ENTRY_SIZE>().0 {
+                let (key, offset, size) = idx_entry_from_bytes(entry);
+                if !size.is_valid() || pending.contains_key(&key) {
+                    continue; // deleted in place, or still awaiting that mark
+                }
+                f(key, &NeedleValue { offset, size })?;
+            }
+            done += rows as u64;
+        }
+        Ok(())
+    }
+
+    /// Visit all live entries in ascending order by needle ID.
+    pub fn ascending_visit<F, E>(&self, mut f: F) -> Result<(), E>
+    where
+        F: FnMut(NeedleId, &NeedleValue) -> Result<(), E>,
+        E: From<String>,
+    {
+        let mut visit_error = None;
+        self.visit_live_entries(|id, nv| {
+            if let Err(e) = f(id, nv) {
+                visit_error = Some(e);
+                return Err(io::Error::other("visit aborted"));
+            }
+            Ok(())
+        })
+        .map_err(|e| visit_error.take().unwrap_or_else(|| E::from(e.to_string())))
+    }
+
+    pub fn iter_entries(&self) -> io::Result<Vec<(NeedleId, NeedleValue)>> {
+        let mut entries = Vec::new();
+        self.visit_live_entries(|id, nv| {
+            entries.push((id, *nv));
+            Ok(())
+        })?;
+        Ok(entries)
+    }
+
+    pub fn save_to_idx(&self, path: &str) -> io::Result<()> {
+        let mut out = OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .open(path)?;
+        self.visit_live_entries(|id, nv| idx::write_index_entry(&mut out, id, nv.offset, nv.size))?;
+        out.sync_all()
+    }
+
+    // ---- Metrics accessors ----
+
+    pub fn content_size(&self) -> u64 {
+        self.metric.file_byte_count.load(Ordering::Relaxed)
+    }
+
+    pub fn deleted_size(&self) -> u64 {
+        self.metric.deletion_byte_count.load(Ordering::Relaxed)
+    }
+
+    pub fn file_count(&self) -> i64 {
+        self.metric.file_count.load(Ordering::Relaxed)
+    }
+
+    pub fn deleted_count(&self) -> i64 {
+        self.metric.deletion_count.load(Ordering::Relaxed)
+    }
+
+    pub fn max_file_key(&self) -> NeedleId {
+        NeedleId(self.metric.max_file_key.load(Ordering::Relaxed))
+    }
+
+    pub fn max_needle_end(&self) -> i64 {
+        self.metric.max_needle_end.load(Ordering::Relaxed)
+    }
+}
+
+impl Drop for SortedFileNeedleMap {
+    fn drop(&mut self) {
+        self.close();
+    }
+}
+
+/// Whether a sorted index is a whole number of entries. A torn one is treated
+/// like a stale one and rebuilt: truncation bumps the mtime, so the staleness
+/// check alone would trust it, and flooring the entry count would silently hide
+/// the last needle — which a later compaction would then drop for good. Go
+/// writes `.sdx` in place, so a crash mid-generation can leave one behind.
+fn holds_whole_entries(db_file_name: &str) -> bool {
+    std::fs::metadata(db_file_name)
+        .map(|m| m.len() % NEEDLE_MAP_ENTRY_SIZE as u64 == 0)
+        .unwrap_or(false)
+}
+
+/// `.sdx` is stale when it is not newer than `.idx`; writes always land in
+/// `.idx` first. Mirrors Go's `isSortedFileFresh`.
+fn is_sorted_file_fresh(db_file_name: &str, index_file_name: &str) -> bool {
+    let (Ok(db), Ok(index)) = (
+        std::fs::metadata(db_file_name),
+        std::fs::metadata(index_file_name),
+    ) else {
+        return false;
+    };
+    match (db.modified(), index.modified()) {
+        (Ok(db_time), Ok(index_time)) => db_time > index_time,
+        _ => false,
+    }
+}
+
+/// Rewrite `.idx` as a sorted array of the entries that are still live, the
+/// same file Go's `WriteSortedFileFromIdx` produces: last write wins per key,
+/// and a tombstoned key is dropped entirely.
+fn write_sorted_file_from_idx(
+    index_file_name: &str,
+    db_file_name: &str,
+    version: Version,
+) -> io::Result<()> {
+    let mut index_file = File::open(index_file_name)?;
+    let nm = CompactNeedleMap::load_from_idx(&mut index_file, version)?;
+
+    let tmp_name = format!("{db_file_name}.tmp");
+    let mut out = OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .open(&tmp_name)?;
+    let write_result = nm
+        .ascending_visit(|id, nv| {
+            idx::write_index_entry(&mut out, id, nv.offset, nv.size).map_err(|e| e.to_string())
+        })
+        .map_err(io::Error::other)
+        .and_then(|()| out.sync_all());
+    if let Err(e) = write_result {
+        let _ = std::fs::remove_file(&tmp_name);
+        return Err(e);
+    }
+    drop(out);
+    // Rename in: a crash mid-generation must not leave a short .sdx that looks
+    // fresh and silently hides needles.
+    std::fs::rename(&tmp_name, db_file_name)
+}
+
+/// Counters equivalent to Go's `needleMapMetricFromIndexFile`, derived without
+/// its bloom filter — and so without its false positives or its per-volume
+/// allocation.
+///
+/// Go counts every `.idx` row in `FileCounter`, and counts a row in
+/// `DeletionCounter` when it is not the last, still-valid row for its key. The
+/// rows that *are* the last valid row for their key are exactly the entries
+/// `.sdx` holds, so `DeletionCounter = rows - live` and
+/// `DeletionByteCounter = valid bytes in .idx - live bytes in .sdx`, each
+/// computable in one sequential pass with no per-key state.
+fn index_metric(
+    index_file_name: &str,
+    db_file_name: &str,
+    version: Version,
+) -> io::Result<NeedleMapMetric> {
+    let metric = NeedleMapMetric::default();
+
+    let mut rows: i64 = 0;
+    let mut valid_bytes: u64 = 0;
+    let mut index_file = File::open(index_file_name)?;
+    idx::walk_index_file(&mut index_file, 0, |key, offset, size| {
+        rows += 1;
+        metric.maybe_set_max_file_key(key);
+        metric.maybe_set_max_needle_end(offset, size, version);
+        if size.is_valid() {
+            valid_bytes += size.0 as u64;
+        }
+        Ok(())
+    })?;
+
+    let mut live: i64 = 0;
+    let mut live_bytes: u64 = 0;
+    let mut db_file = File::open(db_file_name)?;
+    idx::walk_index_file(&mut db_file, 0, |_, _, size| {
+        if size.is_valid() {
+            live += 1;
+            live_bytes += size.0 as u64;
+        }
+        Ok(())
+    })?;
+
+    metric.file_count.store(rows, Ordering::Relaxed);
+    metric.file_byte_count.store(valid_bytes, Ordering::Relaxed);
+    metric
+        .deletion_count
+        .store((rows - live).max(0), Ordering::Relaxed);
+    metric
+        .deletion_byte_count
+        .store(valid_bytes.saturating_sub(live_bytes), Ordering::Relaxed);
+    Ok(metric)
+}
+
+/// Binary search the sorted index for `key`, returning its entry index along
+/// with the record. Mirrors Go's `SearchNeedleFromSortedIndex`.
+fn search_sorted_index(
+    file: &File,
+    file_size: i64,
+    key: NeedleId,
+) -> io::Result<Option<(u64, Offset, Size)>> {
+    let mut lo: u64 = 0;
+    let mut hi: u64 = file_size.max(0) as u64 / NEEDLE_MAP_ENTRY_SIZE as u64;
+    let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+    while lo < hi {
+        let mid = lo + (hi - lo) / 2;
+        read_exact_at(file, &mut buf, mid * NEEDLE_MAP_ENTRY_SIZE as u64)?;
+        let (entry_key, offset, size) = idx_entry_from_bytes(&buf);
+        if entry_key == key {
+            return Ok(Some((mid, offset, size)));
+        }
+        if entry_key < key {
+            lo = mid + 1;
+        } else {
+            hi = mid;
+        }
+    }
+    Ok(None)
+}
+
+fn write_at(file: &File, buf: &[u8], offset: u64) -> io::Result<()> {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::FileExt;
+        file.write_all_at(buf, offset)
+    }
+    #[cfg(windows)]
+    {
+        use std::os::windows::fs::FileExt;
+        let mut written = 0;
+        let mut at = offset;
+        while written < buf.len() {
+            let n = file.seek_write(&buf[written..], at)?;
+            if n == 0 {
+                return Err(io::Error::new(
+                    io::ErrorKind::WriteZero,
+                    "seek_write wrote nothing",
+                ));
+            }
+            written += n;
+            at += n as u64;
+        }
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write as _;
+
+    fn version() -> Version {
+        VERSION_3
+    }
+
+    /// Write an .idx with the given rows, in order.
+    fn write_idx(path: &str, rows: &[(u64, u32, i32)]) {
+        let mut f = File::create(path).unwrap();
+        for &(key, offset, size) in rows {
+            let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+            idx_entry_to_bytes(
+                &mut buf,
+                NeedleId(key),
+                Offset::from_actual_offset(offset as i64),
+                Size(size),
+            );
+            f.write_all(&buf).unwrap();
+        }
+        f.sync_all().unwrap();
+    }
+
+    fn base(dir: &tempfile::TempDir) -> String {
+        dir.path().join("7").to_str().unwrap().to_string()
+    }
+
+    #[test]
+    fn get_finds_live_needles_and_skips_deleted_ones() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        write_idx(
+            &format!("{base}.idx"),
+            &[
+                (1, 8, 100),
+                (2, 16, 200),
+                (3, 24, 300),
+                (2, 0, -1), // tombstone
+            ],
+        );
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(m.get(NeedleId(1)).unwrap().unwrap().size, Size(100));
+        assert_eq!(m.get(NeedleId(3)).unwrap().unwrap().size, Size(300));
+        // A key tombstoned before the .sdx was written is not in it at all.
+        assert!(m.get(NeedleId(2)).unwrap().is_none());
+        assert!(m.get(NeedleId(99)).unwrap().is_none());
+    }
+
+    #[test]
+    fn metrics_match_the_go_counters() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        // key 1 rewritten once, key 2 deleted, key 3 live.
+        write_idx(
+            &format!("{base}.idx"),
+            &[
+                (1, 8, 100),
+                (2, 16, 200),
+                (1, 32, 150),
+                (3, 24, 300),
+                (2, 0, -1),
+            ],
+        );
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        // Every row counts, matching Go's FileCounter.
+        assert_eq!(m.file_count(), 5);
+        assert_eq!(m.content_size(), 100 + 200 + 150 + 300);
+        // Superseded row for key 1, plus both rows for the deleted key 2.
+        assert_eq!(m.deleted_count(), 3);
+        assert_eq!(m.deleted_size(), 100 + 200);
+        assert_eq!(m.max_file_key(), NeedleId(3));
+    }
+
+    #[test]
+    fn put_is_rejected() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        write_idx(&format!("{base}.idx"), &[(1, 8, 100)]);
+
+        let mut m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        let err = m
+            .put(NeedleId(2), Offset::from_actual_offset(16), Size(10))
+            .unwrap_err();
+        assert_eq!(err.kind(), io::ErrorKind::InvalidInput);
+    }
+
+    #[test]
+    fn delete_appends_a_tombstone_to_the_idx_tail() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        let idx_path = format!("{base}.idx");
+        write_idx(&idx_path, &[(1, 8, 100), (2, 16, 200), (3, 24, 300)]);
+        let before = std::fs::metadata(&idx_path).unwrap().len();
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(
+            m.delete(NeedleId(2), Offset::from_actual_offset(16))
+                .unwrap(),
+            Some(Size(200))
+        );
+
+        // Appended, not overwritten from the front.
+        let after = std::fs::metadata(&idx_path).unwrap().len();
+        assert_eq!(after, before + NEEDLE_MAP_ENTRY_SIZE as u64);
+        assert_eq!(m.index_file_size(), after);
+
+        let mut rows = Vec::new();
+        let mut f = File::open(&idx_path).unwrap();
+        idx::walk_index_file(&mut f, 0, |key, _, size| {
+            rows.push((key, size));
+            Ok(())
+        })
+        .unwrap();
+        assert_eq!(rows[0], (NeedleId(1), Size(100)));
+        assert_eq!(rows[1], (NeedleId(2), Size(200)));
+        assert_eq!(rows[2], (NeedleId(3), Size(300)));
+        assert_eq!(rows[3], (NeedleId(2), TOMBSTONE_FILE_SIZE));
+
+        // .sdx is marked in place, so the needle reads back as a tombstone
+        // without a reload — the same contract Go's Get has, where callers
+        // check size.is_deleted().
+        assert!(m.get(NeedleId(2)).unwrap().unwrap().size.is_deleted());
+        assert!(
+            m.delete(NeedleId(2), Offset::from_actual_offset(16))
+                .unwrap()
+                .is_none()
+        );
+        assert!(!m.get(NeedleId(1)).unwrap().unwrap().size.is_deleted());
+    }
+
+    #[test]
+    fn delete_moves_the_counters_where_a_reload_would() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        write_idx(
+            &format!("{base}.idx"),
+            &[(1, 8, 100), (2, 16, 200), (3, 24, 300)],
+        );
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(
+            (m.file_count(), m.deleted_count(), m.deleted_size()),
+            (3, 0, 0)
+        );
+
+        m.delete(NeedleId(2), Offset::from_actual_offset(16))
+            .unwrap();
+        let live = m.file_count() - m.deleted_count();
+        assert_eq!(live, 2, "one of the three needles is gone");
+        assert_eq!(m.deleted_size(), 200);
+        assert_eq!(m.content_size(), 600, "a delete does not shrink .idx bytes");
+
+        // A reload recomputes from .idx and .sdx; the runtime numbers must
+        // already agree with it or the heartbeat jumps at every restart.
+        drop(m);
+        let reloaded = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(reloaded.file_count(), 4);
+        assert_eq!(reloaded.deleted_count(), 2);
+        assert_eq!(reloaded.deleted_size(), 200);
+        assert_eq!(reloaded.content_size(), 600);
+
+        // Deleting again is a no-op and must not move them further.
+        reloaded
+            .delete(NeedleId(2), Offset::from_actual_offset(16))
+            .unwrap();
+        assert_eq!((reloaded.file_count(), reloaded.deleted_count()), (4, 2));
+    }
+
+    #[test]
+    fn a_torn_idx_tail_does_not_misalign_appends() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        let idx_path = format!("{base}.idx");
+        write_idx(&idx_path, &[(1, 8, 100), (2, 16, 200)]);
+        // A short write left half a record behind. Seeding the append offset
+        // from the raw file length would put every later row off by five bytes.
+        {
+            use std::io::Write as _;
+            let mut f = OpenOptions::new().append(true).open(&idx_path).unwrap();
+            f.write_all(&[0xab; 5]).unwrap();
+        }
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(m.index_file_size(), 2 * NEEDLE_MAP_ENTRY_SIZE as u64);
+        m.delete(NeedleId(1), Offset::from_actual_offset(8))
+            .unwrap();
+
+        let mut rows = Vec::new();
+        let mut f = File::open(&idx_path).unwrap();
+        idx::walk_index_file(&mut f, 0, |key, _, size| {
+            rows.push((key, size));
+            Ok(())
+        })
+        .unwrap();
+        assert_eq!(
+            std::fs::metadata(&idx_path).unwrap().len(),
+            3 * NEEDLE_MAP_ENTRY_SIZE as u64,
+            "the tombstone should have overwritten the torn tail"
+        );
+        assert_eq!(rows[0], (NeedleId(1), Size(100)));
+        assert_eq!(rows[1], (NeedleId(2), Size(200)));
+        assert_eq!(rows[2], (NeedleId(1), TOMBSTONE_FILE_SIZE));
+    }
+
+    #[test]
+    fn torn_sdx_is_regenerated() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        write_idx(
+            &format!("{base}.idx"),
+            &[(1, 8, 100), (2, 16, 200), (3, 24, 300)],
+        );
+
+        // Build a good .sdx, then lop off part of its last record. Truncation
+        // bumps the mtime, so the staleness check sees a *fresher* file than the
+        // .idx — without the whole-entry check the map would trust it and needle
+        // 3 would disappear.
+        drop(SortedFileNeedleMap::open(&base, version()).unwrap());
+        let good = std::fs::metadata(format!("{base}.sdx")).unwrap().len();
+        assert_eq!(good, 3 * NEEDLE_MAP_ENTRY_SIZE as u64);
+        let sdx = OpenOptions::new()
+            .write(true)
+            .open(format!("{base}.sdx"))
+            .unwrap();
+        sdx.set_len(good - 5).unwrap();
+        drop(sdx);
+        pooled_index_files().discard(&format!("{base}.sdx"));
+        // Truncation bumps the .sdx mtime, but "bumps" is only true at the
+        // filesystem's timestamp granularity: where both writes land in the
+        // same tick the torn file does not look fresher, and the precondition
+        // below then fails for a reason the test is not about. Age the .idx the
+        // way stale_sdx_is_regenerated does, so freshness is established rather
+        // than raced for.
+        filetime_backdate(&format!("{base}.idx"));
+        assert!(
+            std::fs::metadata(format!("{base}.sdx"))
+                .unwrap()
+                .modified()
+                .unwrap()
+                > std::fs::metadata(format!("{base}.idx"))
+                    .unwrap()
+                    .modified()
+                    .unwrap(),
+            "the torn file must look fresh, or the test proves nothing"
+        );
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(
+            std::fs::metadata(format!("{base}.sdx")).unwrap().len(),
+            good
+        );
+        assert_eq!(m.get(NeedleId(3)).unwrap().unwrap().size, Size(300));
+        assert_eq!(m.iter_entries().unwrap().len(), 3);
+    }
+
+    #[test]
+    fn stale_sdx_is_regenerated() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        write_idx(&format!("{base}.idx"), &[(1, 8, 100)]);
+        // A short, stale .sdx from an older .idx must not be trusted.
+        std::fs::write(format!("{base}.sdx"), b"").unwrap();
+        filetime_backdate(&format!("{base}.sdx"));
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(m.get(NeedleId(1)).unwrap().unwrap().size, Size(100));
+    }
+
+    #[test]
+    fn scan_spans_read_batches() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        // Straddles ROWS_TO_READ so the batched scan has to stitch a full
+        // batch, a second full batch and a short tail together.
+        let total = ROWS_TO_READ as u32 * 2 + 7;
+        let rows: Vec<(u64, u32, i32)> = (1..=total)
+            .map(|i| (i as u64, i * 8, (i * 10) as i32))
+            .collect();
+        write_idx(&format!("{base}.idx"), &rows);
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        let entries = m.iter_entries().unwrap();
+        assert_eq!(entries.len(), total as usize);
+        assert_eq!(entries[0].0, NeedleId(1));
+        assert_eq!(entries[entries.len() - 1].0, NeedleId(total as u64));
+        assert_eq!(entries[entries.len() - 1].1.size, Size((total * 10) as i32));
+        // Every id is still reachable through the binary search.
+        assert_eq!(
+            m.get(NeedleId(total as u64)).unwrap().unwrap().size,
+            Size((total * 10) as i32)
+        );
+    }
+
+    #[test]
+    fn iter_entries_reports_a_truncated_sdx() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        write_idx(
+            &format!("{base}.idx"),
+            &[(1, 8, 100), (2, 16, 200), (3, 24, 300), (4, 32, 400)],
+        );
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        assert_eq!(m.iter_entries().unwrap().len(), 4);
+
+        // Losing the tail of .sdx must surface as an error, not as a shorter
+        // list: compaction takes this vector for the complete live set and would
+        // otherwise commit a volume missing the needles it could not read.
+        let sdx = OpenOptions::new()
+            .write(true)
+            .open(format!("{base}.sdx"))
+            .unwrap();
+        sdx.set_len(2 * NEEDLE_MAP_ENTRY_SIZE as u64).unwrap();
+        drop(sdx);
+        pooled_index_files().discard(m.db_file_name());
+
+        let err = m.iter_entries().unwrap_err();
+        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof);
+        assert!(m.save_to_idx(&format!("{base}.check")).is_err());
+    }
+
+    #[test]
+    fn holds_no_descriptors_when_idle() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = base(&dir);
+        write_idx(&format!("{base}.idx"), &[(1, 8, 100), (2, 16, 200)]);
+
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        let Some(_) = super::super::file_pool::open_index_fds(dir.path()) else {
+            return; // cannot enumerate descriptors here
+        };
+        drop_pooled(&m);
+        assert_eq!(
+            super::super::file_pool::open_index_fds(dir.path()),
+            Some(0),
+            "an idle sorted map must hold no .idx/.sdx descriptor"
+        );
+
+        assert!(m.get(NeedleId(1)).unwrap().is_some());
+        drop_pooled(&m);
+        assert_eq!(
+            super::super::file_pool::open_index_fds(dir.path()),
+            Some(0),
+            "a lookup must give its borrowed handle back"
+        );
+    }
+
+    fn drop_pooled(m: &SortedFileNeedleMap) {
+        pooled_index_files().discard(m.index_file_name());
+        pooled_index_files().discard(m.db_file_name());
+    }
+
+    fn filetime_backdate(path: &str) {
+        // Push the mtime into the past so the freshness check sees it as stale
+        // even when both files were written within the same clock tick.
+        let past = std::time::SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(1);
+        let f = OpenOptions::new().write(true).open(path).unwrap();
+        let _ = f.set_times(std::fs::FileTimes::new().set_modified(past));
+    }
+
+    /// A `.sdx` that cannot be read is an I/O error, never a lookup miss:
+    /// reporting "not found" would answer reads with NotFound and let a delete
+    /// acknowledge success without recording a tombstone.
+    #[test]
+    fn get_reports_io_errors_instead_of_missing() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let base = base(&dir);
+        write_idx(&format!("{base}.idx"), &[(1, 8, 100), (2, 16, 200)]);
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+
+        // Tear the .sdx before anything borrows it: the map still believes the
+        // file holds the entries it recorded at open, so the binary search
+        // reads past the end.
+        let f = OpenOptions::new()
+            .write(true)
+            .open(format!("{base}.sdx"))
+            .unwrap();
+        f.set_len(3).unwrap();
+        drop(f);
+
+        let err = m
+            .get(NeedleId(1))
+            .expect_err("a torn .sdx must surface as an error, not a miss");
+        assert_eq!(err.kind(), io::ErrorKind::UnexpectedEof, "got {err}");
+    }
+
+    /// The deletion counters describe what a reload of `.idx` would count, so
+    /// they belong to the durable append — not to the `.sdx` mark that may
+    /// fail after it. Leaving them behind would report the volume as
+    /// garbage-free while the tombstone already sits in `.idx`, and the
+    /// idempotent retry never applies them either.
+    #[test]
+    fn delete_counts_against_the_durable_idx_append() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let base = base(&dir);
+        write_idx(&format!("{base}.idx"), &[(1, 8, 100), (2, 16, 200)]);
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+        let deleted_before = m.deleted_count();
+        let bytes_before = m.deleted_size();
+
+        m.fail_sdx_mark
+            .store(true, std::sync::atomic::Ordering::Relaxed);
+        m.delete(NeedleId(1), Offset::from_actual_offset(8))
+            .expect_err("the injected mark failure must surface");
+
+        assert_eq!(
+            m.deleted_count(),
+            deleted_before + 2,
+            "a durable tombstone must move the deletion count"
+        );
+        assert_eq!(
+            m.deleted_size(),
+            bytes_before + 100,
+            "a durable tombstone must move the deleted bytes"
+        );
+        assert!(
+            m.get(NeedleId(1)).unwrap().unwrap().size.is_deleted(),
+            "the needle must read as deleted while the mark is outstanding"
+        );
+
+        // The retry is a no-op: no second tombstone, no double counting.
+        assert_eq!(
+            m.delete(NeedleId(1), Offset::from_actual_offset(8))
+                .unwrap(),
+            None
+        );
+        assert_eq!(m.deleted_count(), deleted_before + 2);
+        assert_eq!(m.deleted_size(), bytes_before + 100);
+    }
+
+    /// Once the tombstone is durable in `.idx`, no lookup may report the needle
+    /// live again — even when marking the `.sdx` record fails.
+    #[test]
+    fn failed_sdx_mark_still_reads_deleted() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let base = base(&dir);
+        write_idx(&format!("{base}.idx"), &[(1, 8, 100), (2, 16, 200)]);
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+
+        // Simulate the mark failing after the .idx append landed.
+        m.pending_tombstones
+            .write()
+            .unwrap()
+            .insert(NeedleId(1), Offset::from_actual_offset(8));
+
+        let nv = m.get(NeedleId(1)).unwrap().expect("entry still resolves");
+        assert!(
+            nv.size.is_deleted(),
+            "a needle whose tombstone is durable must read as deleted, got {:?}",
+            nv.size
+        );
+        // And a retry must not append a second tombstone for it.
+        assert_eq!(
+            m.delete(NeedleId(1), Offset::from_actual_offset(8))
+                .unwrap(),
+            None
+        );
+    }
+
+    /// The scans feed compaction and the rebuilt `.idx`, so a needle the
+    /// overlay reports deleted must not come back through them as live.
+    #[test]
+    fn failed_sdx_mark_is_hidden_from_scans() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let base = base(&dir);
+        write_idx(&format!("{base}.idx"), &[(1, 8, 100), (2, 16, 200)]);
+        let m = SortedFileNeedleMap::open(&base, version()).unwrap();
+
+        m.fail_sdx_mark
+            .store(true, std::sync::atomic::Ordering::Relaxed);
+        m.delete(NeedleId(1), Offset::from_actual_offset(8))
+            .expect_err("the injected mark failure must surface");
+
+        let ids: Vec<NeedleId> = m
+            .iter_entries()
+            .unwrap()
+            .into_iter()
+            .map(|(id, _)| id)
+            .collect();
+        assert_eq!(ids, vec![NeedleId(2)], "iter_entries must drop the needle");
+
+        let mut visited = Vec::new();
+        m.ascending_visit(|id, _| {
+            visited.push(id);
+            Ok::<(), String>(())
+        })
+        .unwrap();
+        assert_eq!(visited, vec![NeedleId(2)]);
+
+        let saved = format!("{base}.check");
+        m.save_to_idx(&saved).unwrap();
+        let mut rows = Vec::new();
+        idx::walk_index_file(&mut File::open(&saved).unwrap(), 0, |key, _, size| {
+            rows.push((key, size));
+            Ok(())
+        })
+        .unwrap();
+        assert_eq!(
+            rows,
+            vec![(NeedleId(2), Size(200))],
+            "save_to_idx must not write the needle back as live"
+        );
+    }
+}
+
+// Only meaningful with 5-byte offsets, which is what production Go builds use.
+#[cfg(all(test, feature = "5bytes"))]
+mod go_parity_tests {
+    use super::*;
+
+    /// The `.sdx` bytes Go's `WriteSortedFileFromIdx` produces for the fixture
+    /// below, captured from `weed/storage/erasure_coding` built with
+    /// `-tags 5BytesOffset`. A volume moved between a Go and a Rust server reads
+    /// whichever `.sdx` is already on disk, so the two generators must agree
+    /// byte for byte: sorted by needle id, last write wins, tombstoned keys
+    /// dropped entirely.
+    const GO_SDX_HEX: &str = "0000000000000001000000200000000096000000000000000300000018000000012c00000000000000040000003000000001900000000000000005000000080000\
+0001f4";
+
+    #[test]
+    fn sdx_matches_the_bytes_go_writes() {
+        let dir = tempfile::tempdir().unwrap();
+        let base = dir.path().join("1").to_str().unwrap().to_string();
+
+        // Rewrites, tombstones and out-of-order keys, matching the Go fixture.
+        let rows: &[(u64, u32, i32)] = &[
+            (5, 8, 500),
+            (1, 16, 100),
+            (3, 24, 300),
+            (1, 32, 150),
+            (2, 40, 200),
+            (2, 0, -1),
+            (4, 48, 400),
+            (9, 56, 900),
+            (9, 0, -1),
+        ];
+        let mut f = std::fs::File::create(format!("{base}.idx")).unwrap();
+        for &(key, offset, size) in rows {
+            let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+            // The Go fixture stores raw offsets; scale by the padding so both
+            // sides put the same bytes in the entry.
+            idx_entry_to_bytes(
+                &mut buf,
+                NeedleId(key),
+                Offset::from_actual_offset(offset as i64 * NEEDLE_PADDING_SIZE as i64),
+                Size(size),
+            );
+            use std::io::Write as _;
+            f.write_all(&buf).unwrap();
+        }
+        drop(f);
+
+        write_sorted_file_from_idx(&format!("{base}.idx"), &format!("{base}.sdx"), VERSION_3)
+            .unwrap();
+        let sdx = std::fs::read(format!("{base}.sdx")).unwrap();
+        let hex: String = sdx.iter().map(|b| format!("{b:02x}")).collect();
+        assert_eq!(hex, GO_SDX_HEX.replace('\n', ""));
+    }
+}
diff --git a/seaweed-volume/src/storage/store.rs b/seaweed-volume/src/storage/store.rs
index beeca7e83a..4cef145590 100644
--- a/seaweed-volume/src/storage/store.rs
+++ b/seaweed-volume/src/storage/store.rs
@@ -4,19 +4,53 @@
 //! It coordinates volume placement, lookup, and lifecycle operations.
 //! Matches Go's storage/store.go.
 
+use std::collections::HashSet;
 use std::io;
-use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, Ordering};
+use std::sync::{Arc, Mutex};
 
 use crate::config::MinFreeSpace;
 use crate::pb::master_pb;
 use crate::storage::disk_location::DiskLocation;
-use crate::storage::erasure_coding::ec_shard::{EcVolumeShard, MAX_SHARD_COUNT};
-use crate::storage::erasure_coding::ec_volume::EcVolume;
-use crate::storage::needle::needle::Needle;
+use crate::storage::erasure_coding::ec_shard::{EcVolumeShard, MAX_SHARD_COUNT, ShardId};
+use crate::storage::erasure_coding::ec_volume::{
+    ECJ_COMPACT_TMP_EXT, EcVolume, is_usable_ecx_file, read_ec_shard_config_across_dirs,
+};
+use crate::storage::needle::needle::{Needle, get_actual_size};
 use crate::storage::needle_map::NeedleMapKind;
-use crate::storage::super_block::ReplicaPlacement;
+use crate::storage::super_block::{ReplicaPlacement, SUPER_BLOCK_SIZE, SuperBlock};
 use crate::storage::types::*;
-use crate::storage::volume::{VifVolumeInfo, VolumeError};
+use crate::storage::volume::{CompactionJob, VifVolumeInfo, Volume, VolumeError, VolumeSpec};
+
+/// Mirrors Go's ensureCompactVolumeSpace, per filesystem: the new .dat lands
+/// next to the old one and the new .idx next to the old index, so when the
+/// index directory is on another filesystem each disk answers for its own
+/// share, while two directories on one filesystem must cover the sum.
+fn ensure_compact_volume_space(v: &Volume, preallocate: u64) -> Result<(), VolumeError> {
+    let (data_bytes, index_bytes) = compaction_space_needed(v, preallocate);
+    let (dir, dir_idx) = (v.dir(), v.dir_idx());
+    let check = |dir: &str, needed: u64| -> Result<(), VolumeError> {
+        let (_, free) = crate::storage::disk_location::get_disk_stats(dir);
+        if free < needed {
+            return Err(VolumeError::InsufficientSpace {
+                vid: v.id,
+                required: needed,
+                free,
+            });
+        }
+        Ok(())
+    };
+
+    if dir_idx.is_empty() || dir_idx == dir {
+        check(dir, data_bytes + index_bytes)
+    } else if !same_filesystem(dir, &dir_idx) {
+        check(dir, data_bytes)?;
+        check(&dir_idx, index_bytes)
+    } else {
+        check(dir, data_bytes + index_bytes)?;
+        check(&dir_idx, index_bytes)
+    }
+}
 
 /// Top-level storage manager containing all disk locations and their volumes.
 pub struct Store {
@@ -32,6 +66,16 @@ pub struct Store {
     pub data_center: String,
     pub rack: String,
     pub volume_report: crate::storage::volume_report::VolumeReportState,
+    /// Collections the last heartbeat set per-collection gauges for. Those
+    /// gauges are only ever set for collections still held here, so one whose
+    /// last volume leaves - moved away by volume.balance, say - would keep
+    /// reporting the heartbeat that saw it.
+    pub reported_collections: Mutex<HashSet<String>>,
+    pub reported_ec_collections: Mutex<HashSet<String>>,
+    pub max_volume_id_seen: AtomicU32,
+    pub last_seen_topology_id: Mutex<String>,
+    pub vid_stamp_lock: Mutex<()>,
+    pub vid_stamp_dirty: std::sync::atomic::AtomicBool,
 }
 
 impl Store {
@@ -49,6 +93,12 @@ impl Store {
             volume_report: Default::default(),
             data_center: String::new(),
             rack: String::new(),
+            reported_collections: Mutex::new(HashSet::new()),
+            reported_ec_collections: Mutex::new(HashSet::new()),
+            max_volume_id_seen: AtomicU32::new(0),
+            last_seen_topology_id: Mutex::new(String::new()),
+            vid_stamp_lock: Mutex::new(()),
+            vid_stamp_dirty: std::sync::atomic::AtomicBool::new(false),
         }
     }
 
@@ -110,6 +160,12 @@ impl Store {
         // (read-only target, partial copy).
         self.reconcile_ec_shards_across_disks();
 
+        self.fold_location_into_vid_stamp(self.locations.last().unwrap());
+        // Write the combined bound back to every dir, including ones whose
+        // own stamp or volumes sit below it — a lost disk must not restart
+        // the server below the bound its remaining dirs once reached.
+        self.save_vid_stamps();
+
         Ok(())
     }
 
@@ -128,8 +184,13 @@ impl Store {
 
     // ---- Volume lookup ----
 
-    /// Find which location contains a volume.
-    pub fn find_volume(&self, vid: VolumeId) -> Option<(usize, &crate::storage::volume::Volume)> {
+    /// Find which location contains a volume, returning a shared handle.
+    /// Mirroring Go's findVolume: the lookup only borrows the volume map,
+    /// so callers can run volume I/O after releasing the store guard.
+    pub fn find_volume(
+        &self,
+        vid: VolumeId,
+    ) -> Option<(usize, Arc<crate::storage::volume::Volume>)> {
         for (i, loc) in self.locations.iter().enumerate() {
             if let Some(v) = loc.find_volume(vid) {
                 return Some((i, v));
@@ -138,24 +199,31 @@ impl Store {
         None
     }
 
-    /// Find which location contains a volume (mutable).
-    pub fn find_volume_mut(
-        &mut self,
-        vid: VolumeId,
-    ) -> Option<(usize, &mut crate::storage::volume::Volume)> {
-        for (i, loc) in self.locations.iter_mut().enumerate() {
-            if let Some(v) = loc.find_volume_mut(vid) {
-                return Some((i, v));
-            }
-        }
-        None
-    }
-
     /// Check if a volume exists.
     pub fn has_volume(&self, vid: VolumeId) -> bool {
         self.find_volume(vid).is_some()
     }
 
+    /// Move a volume's index into the configured `-dir.idx` directory, reloading
+    /// the volume in place. A no-op when the location has no separate index
+    /// directory. Mirrors Go's `Store::ConsolidateVolumeIndex`.
+    pub fn consolidate_volume_index(&mut self, vid: VolumeId) -> Result<(), VolumeError> {
+        for loc in self.locations.iter() {
+            let idx_dir = loc.idx_directory.clone();
+            let data_dir = loc.directory.clone();
+            if let Some(v) = loc.find_volume(vid) {
+                if idx_dir == data_dir {
+                    return Ok(());
+                }
+                return v.relocate_index_to(&idx_dir);
+            }
+        }
+        Err(VolumeError::Io(io::Error::new(
+            io::ErrorKind::NotFound,
+            format!("volume {} not found on disk", vid),
+        )))
+    }
+
     // ---- Volume lifecycle ----
 
     /// Find the location with fewest volumes (load-balance) of the given disk type.
@@ -195,7 +263,13 @@ impl Store {
     /// Find a free location matching a predicate.
     /// Matches Go's Store.FindFreeLocation: picks the matching location with the
     /// most remaining volume capacity, while skipping low-disk locations.
-    pub fn find_free_location_predicate<F>(&self, pred: F) -> Option<usize>
+    /// `replace_vid` names a volume about to be replaced: the slot it holds on
+    /// a location counts as free there.
+    pub fn find_free_location_predicate<F>(
+        &self,
+        pred: F,
+        replace_vid: Option<VolumeId>,
+    ) -> Option<usize>
     where
         F: Fn(&DiskLocation) -> bool,
     {
@@ -211,8 +285,12 @@ impl Store {
             let effective_free = if max == 0 {
                 i64::MAX
             } else {
-                let free_count = (max - loc.volumes_len() as i64) * DATA_SHARDS_COUNT as i64
-                    - loc.ec_shard_count() as i64;
+                let mut free_slots = max - loc.volumes_len() as i64;
+                if replace_vid.is_some_and(|vid| loc.find_volume(vid).is_some()) {
+                    free_slots += 1;
+                }
+                let free_count =
+                    free_slots * DATA_SHARDS_COUNT as i64 - loc.ec_shard_count() as i64;
                 free_count / DATA_SHARDS_COUNT as i64
             };
             if effective_free <= 0 {
@@ -229,11 +307,25 @@ impl Store {
     /// Returns the index of the disk that should receive a new EC
     /// shard / index file for `(collection, vid)`. Selection order:
     ///
+    /// 0. a disk that already owns one of `shard_ids` (in-memory claim),
     /// 1. a disk that already has the EC volume mounted (in-memory state),
     /// 2. a disk that owns the `.ecx` file on disk (volume not yet mounted),
     /// 3. any HDD with free space,
     /// 4. any disk with free space.
     ///
+    /// Step 0 keeps the per-server invariant that a shard id is owned by
+    /// at most one disk. Steps 1-4 only know the volume, and a multi-disk
+    /// server legitimately mounts the same vid on several disks, so the
+    /// free-count tie-break alone can send a re-copy of a shard the server
+    /// already holds (a retried `ec.balance` / `ec.rebuild` move) to a
+    /// sibling disk. Both disks then claim the same (vid, shard) and
+    /// report it to the master from two disk ids, and which claimant
+    /// serves reads or survives a later unmount/delete of the shard id
+    /// becomes an accident of location order. Overwriting in place is what
+    /// the caller meant, so an owning disk wins ahead of the space filters
+    /// too — a re-copy needs no new shard slot, and a genuinely full disk
+    /// fails the write rather than silently splitting the claim.
+    ///
     /// Step 2 is the missing primitive that pinned subsequent shards to
     /// the first-shard disk during `ec.rebuild`: rebuild only sets
     /// `CopyEcxFile=true` on the first shard, then relies on auto-select
@@ -256,20 +348,26 @@ impl Store {
         collection: &str,
         vid: VolumeId,
         data_shard_count: u32,
+        shard_ids: &[ShardId],
     ) -> Option<usize> {
         const TIER_ANY_DISK: u8 = 1;
         const TIER_HDD: u8 = 2;
         const TIER_ECX_ON_DISK: u8 = 3;
         const TIER_MOUNTED: u8 = 4;
+        const TIER_OWNS_SHARD: u8 = 5;
 
-        let mut best: Option<(usize, u8, i64)> = None;
+        // (index, tier, owned shard count, free shard slots)
+        let mut best: Option<(usize, u8, usize, i64)> = None;
         for (i, loc) in self.locations.iter().enumerate() {
-            if loc.is_disk_space_low.load(Ordering::Relaxed) {
-                continue;
-            }
+            let owned = owned_ec_shard_count(loc, vid, shard_ids);
             let free = ec_free_shard_count(loc, data_shard_count);
-            if free <= 0 {
-                continue;
+            if owned == 0 {
+                if loc.is_disk_space_low.load(Ordering::Relaxed) {
+                    continue;
+                }
+                if free <= 0 {
+                    continue;
+                }
             }
             let mut tier = TIER_ANY_DISK;
             if loc.disk_type == DiskType::HardDrive {
@@ -281,47 +379,95 @@ impl Store {
             if loc.has_ec_volume(vid) {
                 tier = TIER_MOUNTED;
             }
+            if owned > 0 {
+                tier = TIER_OWNS_SHARD;
+            }
             let better = match best {
                 None => true,
-                Some((_, b_tier, b_free)) => tier > b_tier || (tier == b_tier && free > b_free),
+                // owned only separates disks inside TIER_OWNS_SHARD; it is 0
+                // everywhere else, so this falls through to the free-count
+                // tie-break for the other tiers.
+                Some((_, b_tier, b_owned, b_free)) => {
+                    tier > b_tier
+                        || (tier == b_tier
+                            && (owned > b_owned || (owned == b_owned && free > b_free)))
+                }
             };
             if better {
-                best = Some((i, tier, free));
+                best = Some((i, tier, owned, free));
             }
         }
-        best.map(|(i, _, _)| i)
+        best.map(|(i, _, _, _)| i)
+    }
+
+    /// Returns the distinct disk indexes that already own one of `shard_ids`
+    /// for `vid`, in location order. More than one owner means the batch has
+    /// no single correct destination — whichever disk receives it would
+    /// duplicate a sibling disk's claim — so batch callers must split by
+    /// owner (`volume_ec_shards_copy` refuses such a batch instead of
+    /// guessing). Mirrors `Store.EcShardOwnerDisks` in
+    /// `weed/storage/store_ec.go`.
+    pub fn ec_shard_owner_disks(&self, vid: VolumeId, shard_ids: &[ShardId]) -> Vec<usize> {
+        self.locations
+            .iter()
+            .enumerate()
+            .filter(|(_, loc)| owned_ec_shard_count(loc, vid, shard_ids) > 0)
+            .map(|(i, _)| i)
+            .collect()
+    }
+
+    /// Look up the per-volume EC data-shard count, preferring a mounted EC
+    /// volume's own config and then the `.vif` on whichever disk holds it.
+    /// Falls back to the default when neither exists yet (e.g. before the
+    /// first shard streams in during ec.rebuild), so
+    /// `find_ec_shard_target_location`'s free-slot maths scores custom-ratio
+    /// volumes against their real width instead of the build default.
+    pub fn lookup_ec_data_shards(&self, collection: &str, vid: VolumeId) -> u32 {
+        use crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT;
+
+        for loc in &self.locations {
+            if let Some(ec_vol) = loc.find_ec_volume(vid) {
+                return ec_vol.data_shards;
+            }
+        }
+        let Some(first) = self.locations.first() else {
+            return DATA_SHARDS_COUNT as u32;
+        };
+        let other_dirs: Vec<String> = self.locations[1..]
+            .iter()
+            .flat_map(|loc| [loc.directory.clone(), loc.idx_directory.clone()])
+            .filter(|d| !d.is_empty())
+            .collect();
+        read_ec_shard_config_across_dirs(
+            &first.directory,
+            &first.idx_directory,
+            &other_dirs,
+            collection,
+            vid,
+        )
+        .map(|(data_shards, _, _)| data_shards)
+        .unwrap_or(DATA_SHARDS_COUNT as u32)
     }
 
     /// Create a new volume, placing it on the location with the most free space.
     pub fn add_volume(
         &mut self,
         vid: VolumeId,
-        collection: &str,
-        replica_placement: Option<ReplicaPlacement>,
-        ttl: Option<crate::storage::needle::ttl::TTL>,
-        preallocate: u64,
         disk_type: DiskType,
-        version: Version,
+        spec: &VolumeSpec<'_>,
     ) -> Result<(), VolumeError> {
+        self.stamp_allocated_vid(vid);
         if self.find_volume(vid).is_some() {
             return Err(VolumeError::AlreadyExists);
         }
         let loc_idx = self.find_free_location(&disk_type).ok_or_else(|| {
-            VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                format!("no free location for disk type {:?}", disk_type),
-            ))
+            VolumeError::Io(io::Error::other(format!(
+                "no free location for disk type {:?}",
+                disk_type
+            )))
         })?;
 
-        self.locations[loc_idx].create_volume(
-            vid,
-            collection,
-            self.needle_map_kind,
-            replica_placement,
-            ttl,
-            preallocate,
-            version,
-        )
+        self.locations[loc_idx].create_volume(vid, self.needle_map_kind, spec)
     }
 
     /// Delete a volume from any location. When keep_remote_data is true the
@@ -331,21 +477,48 @@ impl Store {
         &mut self,
         vid: VolumeId,
         only_empty: bool,
+        only_garbage: bool,
         keep_remote_data: bool,
     ) -> Result<(), VolumeError> {
         for loc in &mut self.locations {
             if loc.find_volume(vid).is_some() {
-                return loc.delete_volume(vid, only_empty, keep_remote_data);
+                return loc.delete_volume(vid, only_empty, only_garbage, keep_remote_data);
             }
         }
         Err(VolumeError::NotFound)
     }
 
-    /// Unload (unmount) a volume without deleting its files.
-    pub fn unmount_volume(&mut self, vid: VolumeId) -> bool {
+    /// Unload (unmount) a volume without deleting its files. Refused while
+    /// compacting, since a remount could start a second copy into .cpd.
+    pub fn unmount_volume(&mut self, vid: VolumeId) -> Result<bool, VolumeError> {
+        if let Some((_, v)) = self.find_volume(vid)
+            && v.is_compacting()
+        {
+            return Err(v.compacting_error());
+        }
         for loc in &mut self.locations {
             if loc.unload_volume(vid).is_some() {
-                return true;
+                return Ok(true);
+            }
+        }
+        Ok(false)
+    }
+
+    /// Reports whether any local volume or EC shard is currently quarantined
+    /// due to sustained storage-media EIO. Mirrors Go's Store.HasIoQuarantine.
+    pub fn has_io_quarantine(&self) -> bool {
+        for loc in &self.locations {
+            for (_, vol) in loc.iter_volumes() {
+                let (_, _, quarantined) = vol.get_io_error_state();
+                if quarantined {
+                    return true;
+                }
+            }
+            for (_, ec_vol) in loc.ec_volumes() {
+                let (_, _, quarantined) = ec_vol.get_io_error_state();
+                if quarantined {
+                    return true;
+                }
             }
         }
         false
@@ -363,7 +536,7 @@ impl Store {
         }
         // Find the location where the .dat file exists
         for loc in &mut self.locations {
-            if &loc.disk_type != &disk_type {
+            if loc.disk_type != disk_type {
                 continue;
             }
             let base = crate::storage::volume::volume_file_name(&loc.directory, collection, vid);
@@ -376,20 +549,23 @@ impl Store {
                 // Fail the mount so the caller (VolumeCopy) treats it as an error.
                 let note_path = format!("{}.note", base);
                 if std::path::Path::new(&note_path).exists() {
-                    return Err(VolumeError::Io(io::Error::new(
-                        io::ErrorKind::Other,
-                        format!("volume {} copy incomplete: .note still present", vid),
-                    )));
+                    return Err(VolumeError::Io(io::Error::other(format!(
+                        "volume {} copy incomplete: .note still present",
+                        vid
+                    ))));
                 }
-                return loc.create_volume(
+                let result = loc.create_volume(
                     vid,
-                    collection,
                     self.needle_map_kind,
-                    None,
-                    None,
-                    0,
-                    Version::current(),
+                    &VolumeSpec {
+                        collection,
+                        ..Default::default()
+                    },
                 );
+                if result.is_ok() {
+                    self.stamp_allocated_vid(vid);
+                }
+                return result;
             }
         }
         Err(VolumeError::Io(io::Error::new(
@@ -400,50 +576,194 @@ impl Store {
 
     /// Mount a volume by id only (Go's MountVolume behavior).
     /// Scans all locations for a matching .dat file and loads with its collection prefix.
-    pub fn mount_volume_by_id(&mut self, vid: VolumeId) -> Result<(), VolumeError> {
+    /// When a collection hint is given, the expected <collection>_<vid>.vif/.idx
+    /// path is probed directly before falling back to the directory scan.
+    pub fn mount_volume_by_id(
+        &mut self,
+        vid: VolumeId,
+        collection: Option<&str>,
+    ) -> Result<(), VolumeError> {
         if self.find_volume(vid).is_some() {
             return Err(VolumeError::AlreadyExists);
         }
-        if let Some((loc_idx, _base_path, collection)) = self.find_volume_file_base(vid) {
-            let loc = &mut self.locations[loc_idx];
-            return loc.create_volume(
-                vid,
-                &collection,
-                self.needle_map_kind,
-                None,
-                None,
-                0,
-                Version::current(),
-            );
+        // Remember the last non-NotFound error so a caller gets a useful
+        // message when every candidate fails to open, instead of a generic
+        // NotFound. A successful mount returns immediately.
+        let mut last_err: Option<VolumeError> = None;
+        if let Some(collection) = collection {
+            // The hint is only an optimization: a collection carrying a path
+            // separator could route file creation outside the storage
+            // directory, so skip the shortcut and let the safe directory scan
+            // resolve the volume instead. Rejecting the exact ".." name is
+            // sufficient — a collection like "foo..bar" is a valid name and
+            // stays inside the directory (the ".." is part of the filename, not
+            // a parent reference, because volume_file_name joins with "_").
+            let hint_safe = !collection.is_empty()
+                && !collection.contains('/')
+                && !collection.contains('\\')
+                && collection != "..";
+            if hint_safe {
+                for loc in &mut self.locations {
+                    let base =
+                        crate::storage::volume::volume_file_name(&loc.directory, collection, vid);
+                    // Confirm a collection-named sidecar exists before using the
+                    // hint. A lone .vif/.idx (e.g. an EC sidecar whose .ecx is on
+                    // a sibling disk) must NOT mount here: create_volume would
+                    // write an empty .dat and register a phantom normal volume
+                    // that shadows the real EC volume. Match the guard in
+                    // load_existing_volumes: only mount when a real .dat is
+                    // present, or the .vif points at a remote-tiered file.
+                    let sidecar_present = [".vif", ".idx"].iter().any(|ext| {
+                        std::fs::metadata(format!("{}{}", base, ext))
+                            .map(|m| !m.is_dir())
+                            .unwrap_or(false)
+                    });
+                    if !sidecar_present {
+                        continue;
+                    }
+                    let dat_path = format!("{}.dat", base);
+                    let dat_exists = std::fs::metadata(&dat_path)
+                        .map(|m| !m.is_dir())
+                        .unwrap_or(false);
+                    let idx_base = crate::storage::volume::volume_file_name(
+                        &loc.idx_directory,
+                        collection,
+                        vid,
+                    );
+                    let has_remote = crate::storage::disk_location::vif_references_remote_file(
+                        &format!("{}.vif", base),
+                    ) || crate::storage::disk_location::vif_references_remote_file(
+                        &format!("{}.vif", idx_base),
+                    );
+                    if dat_exists || has_remote {
+                        // A persisting .note means the copy that produced these
+                        // files never completed; mounting it would expose a
+                        // truncated volume. Skip this candidate and keep
+                        // searching (matches load_existing_volumes).
+                        let note_path = format!("{}.note", base);
+                        if std::path::Path::new(&note_path).exists() {
+                            continue;
+                        }
+                        // An open failure on one candidate must not block a
+                        // valid volume on a later disk — remember the error and
+                        // keep scanning (matches open_volumes / Go mountVolume).
+                        match loc.create_volume(
+                            vid,
+                            self.needle_map_kind,
+                            &VolumeSpec {
+                                collection,
+                                ..Default::default()
+                            },
+                        ) {
+                            Ok(()) => {
+                                self.stamp_allocated_vid(vid);
+                                return Ok(());
+                            }
+                            Err(e) => {
+                                last_err = Some(e);
+                                continue;
+                            }
+                        }
+                    }
+                    // Lone sidecar: leave it for the directory scan below.
+                }
+            }
         }
-        Err(VolumeError::Io(io::Error::new(
-            io::ErrorKind::NotFound,
-            format!("volume {} not found on disk", vid),
-        )))
+        // Iterate every matching candidate, not just the first. A lone
+        // sidecar on an earlier disk must not hide a real .dat on a later
+        // disk (the split-disk EC layout the guard above protects against).
+        for (loc_idx, base_path, collection) in self.find_volume_file_bases(vid) {
+            // The scan matches any volume file (.dat/.vif/.idx). A lone .vif/.idx
+            // sidecar (e.g. an EC sidecar whose .ecx is on a sibling disk) must
+            // NOT mount here: create_volume would write an empty .dat and
+            // register a phantom normal volume that shadows the real EC volume.
+            // Match the guard in load_existing_volumes: only mount when a real
+            // .dat is present, or the .vif points at a remote-tiered file.
+            let dat_exists = std::fs::metadata(format!("{}.dat", base_path))
+                .map(|m| !m.is_dir())
+                .unwrap_or(false);
+            let idx_base = crate::storage::volume::volume_file_name(
+                &self.locations[loc_idx].idx_directory,
+                &collection,
+                vid,
+            );
+            let has_remote = crate::storage::disk_location::vif_references_remote_file(&format!(
+                "{}.vif",
+                base_path
+            )) || crate::storage::disk_location::vif_references_remote_file(
+                &format!("{}.vif", idx_base),
+            );
+            if dat_exists || has_remote {
+                // A persisting .note means the copy that produced these files
+                // never completed; mounting it would expose a truncated volume.
+                // Skip this candidate and keep searching (matches
+                // load_existing_volumes).
+                let note_path = format!("{}.note", base_path);
+                if std::path::Path::new(&note_path).exists() {
+                    continue;
+                }
+                // An open failure on one candidate must not block a valid
+                // volume on a later disk — remember the error and keep
+                // scanning (matches open_volumes / Go mountVolume).
+                let loc = &mut self.locations[loc_idx];
+                match loc.create_volume(
+                    vid,
+                    self.needle_map_kind,
+                    &VolumeSpec {
+                        collection: &collection,
+                        ..Default::default()
+                    },
+                ) {
+                    Ok(()) => {
+                        self.stamp_allocated_vid(vid);
+                        return Ok(());
+                    }
+                    Err(e) => {
+                        last_err = Some(e);
+                        continue;
+                    }
+                }
+            }
+        }
+        Err(last_err.unwrap_or_else(|| {
+            VolumeError::Io(io::Error::new(
+                io::ErrorKind::NotFound,
+                format!("volume {} not found on disk", vid),
+            ))
+        }))
     }
 
     fn find_volume_file_base(&self, vid: VolumeId) -> Option<(usize, String, String)> {
+        self.find_volume_file_bases(vid).into_iter().next()
+    }
+
+    /// Collect every location/collection whose directory holds a volume file
+    /// (.dat/.vif/.idx) for `vid`, in scan order. Callers that need to skip
+    /// lone sidecars (mount_volume_by_id) must see all candidates so a sidecar
+    /// on an earlier disk does not hide a real .dat on a later one.
+    fn find_volume_file_bases(&self, vid: VolumeId) -> Vec<(usize, String, String)> {
+        let mut results = Vec::new();
         for (loc_idx, loc) in self.locations.iter().enumerate() {
             if let Ok(entries) = std::fs::read_dir(&loc.directory) {
                 for entry in entries.flatten() {
                     let name = entry.file_name();
                     let name = name.to_string_lossy();
-                    if let Some((collection, file_vid)) = parse_volume_filename(&name) {
-                        if file_vid == vid {
-                            let base = strip_volume_suffix(&name)?;
-                            let base_path = format!("{}/{}", loc.directory, base);
-                            return Some((loc_idx, base_path, collection));
-                        }
+                    if let Some((collection, file_vid)) = parse_volume_filename(&name)
+                        && file_vid == vid
+                        && let Some(base) = strip_volume_suffix(&name)
+                    {
+                        let base_path = format!("{}/{}", loc.directory, base);
+                        results.push((loc_idx, base_path, collection));
                     }
                 }
             }
         }
-        None
+        results
     }
 
     /// Configure a volume's replica placement on disk.
-    /// The volume must already be unmounted. This opens the .dat file directly,
-    /// modifies the replica_placement byte (offset 1), and writes it back.
+    /// The volume must already be unmounted. Rewrites the .vif and the .dat
+    /// superblock so both carry the new placement.
     pub fn configure_volume(&self, vid: VolumeId, rp: ReplicaPlacement) -> Result<(), VolumeError> {
         let (_, base_path, _) = self.find_volume_file_base(vid).ok_or_else(|| {
             VolumeError::Io(io::Error::new(
@@ -455,7 +775,7 @@ impl Store {
         let mut vif = load_vif_volume_info(&vif_path)?;
         vif.replication = rp.to_string();
         save_vif_volume_info(&vif_path, &vif)?;
-        Ok(())
+        update_dat_replica_placement(&format!("{}.dat", base_path), vid, rp)
     }
 
     // ---- Read / Write / Delete ----
@@ -466,6 +786,20 @@ impl Store {
         vol.read_needle(n)
     }
 
+    /// Read a needle from a volume using the given read option.
+    ///
+    /// On return, `read_option.is_meta_only` tells the caller whether the
+    /// payload was skipped.
+    pub fn read_volume_needle_with_option(
+        &self,
+        vid: VolumeId,
+        n: &mut Needle,
+        read_option: &mut ReadOption,
+    ) -> Result<i32, VolumeError> {
+        let (_, vol) = self.find_volume(vid).ok_or(VolumeError::NotFound)?;
+        vol.read_needle_with_option(n, read_option)
+    }
+
     /// Read a needle from a volume, optionally reading deleted needles.
     pub fn read_volume_needle_opt(
         &self,
@@ -477,36 +811,54 @@ impl Store {
         vol.read_needle_opt(n, read_deleted)
     }
 
-    /// Read needle metadata and return streaming info for large file reads.
-    pub fn read_volume_needle_stream_info(
+    /// Resolve a needle read under this guard, to run after it is released.
+    pub(crate) fn needle_read_plan(
         &self,
         vid: VolumeId,
-        n: &mut Needle,
+        id: NeedleId,
         read_deleted: bool,
-    ) -> Result<crate::storage::volume::NeedleStreamInfo, VolumeError> {
+    ) -> Result<crate::storage::volume::NeedleReadPlan, VolumeError> {
         let (_, vol) = self.find_volume(vid).ok_or(VolumeError::NotFound)?;
-        vol.read_needle_stream_info(n, read_deleted)
+        vol.needle_read_plan(id, read_deleted)
     }
 
-    /// Re-lookup a needle's data-file offset after compaction may have moved it.
-    /// Returns `(new_data_file_offset, current_compaction_revision)`.
-    pub fn re_lookup_needle_data_offset(
+    /// Write a needle to a volume. With `fsync` the volume flushes its .dat
+    /// before returning, so the caller can ack a durable write.
+    pub fn write_volume_needle(
         &self,
         vid: VolumeId,
-        needle_id: NeedleId,
-    ) -> Result<(u64, u16), VolumeError> {
-        let (_, vol) = self.find_volume(vid).ok_or(VolumeError::NotFound)?;
-        vol.re_lookup_needle_data_offset(needle_id)
+        n: &mut Needle,
+        fsync: bool,
+    ) -> Result<(u64, Size, bool), VolumeError> {
+        self.writable_volume(vid)?.write_needle(n, true, fsync)
     }
 
-    /// Write a needle to a volume.
-    pub fn write_volume_needle(
-        &mut self,
+    /// Write a batch of needles to one volume, sharing the syncs of its
+    /// durable writes. See `Volume::write_needles_grouped`.
+    pub fn write_volume_needles(
+        &self,
         vid: VolumeId,
-        n: &mut Needle,
-    ) -> Result<(u64, Size, bool), VolumeError> {
+        writes: &mut [(Needle, bool)],
+    ) -> Vec<Result<(u64, Size, bool), VolumeError>> {
+        match self.writable_volume(vid) {
+            Ok(vol) => vol.write_needles_grouped(writes),
+            // The lookup fails only with NotFound or the disk-space ReadOnly.
+            Err(e) => writes
+                .iter()
+                .map(|_| match e {
+                    VolumeError::ReadOnly(vid) => Err(VolumeError::ReadOnly(vid)),
+                    _ => Err(VolumeError::NotFound),
+                })
+                .collect(),
+        }
+    }
+
+    /// Resolve a mounted volume handle for writing, checking disk space like
+    /// Go's writableVolume. The returned Arc stays valid for I/O after the
+    /// store guard is released; if the volume is unmounted meanwhile the I/O
+    /// fails on the volume's closed state, not on a stale pointer.
+    pub(crate) fn writable_volume(&self, vid: VolumeId) -> Result<Arc<Volume>, VolumeError> {
         // Check disk space on the location containing this volume.
-        // We do this before the mutable borrow to avoid borrow conflicts.
         let loc_idx = self
             .find_volume(vid)
             .map(|(i, _)| i)
@@ -515,36 +867,33 @@ impl Store {
             .is_disk_space_low
             .load(Ordering::Relaxed)
         {
-            return Err(VolumeError::ReadOnly);
+            return Err(VolumeError::ReadOnly(vid));
         }
 
-        let (_, vol) = self.find_volume_mut(vid).ok_or(VolumeError::NotFound)?;
-        vol.write_needle(n, true)
+        let (_, vol) = self.find_volume(vid).ok_or(VolumeError::NotFound)?;
+        Ok(vol)
     }
 
     /// Delete a needle from a volume.
     pub fn delete_volume_needle(
-        &mut self,
+        &self,
         vid: VolumeId,
         n: &mut Needle,
     ) -> Result<Size, VolumeError> {
         // Match Go's DeleteVolumeNeedle: check noWriteOrDelete before proceeding.
         let (_, vol) = self.find_volume(vid).ok_or(VolumeError::NotFound)?;
         if vol.is_no_write_or_delete() {
-            return Err(VolumeError::ReadOnly);
+            return Err(VolumeError::ReadOnly(vid));
         }
-
-        let (_, vol) = self.find_volume_mut(vid).ok_or(VolumeError::NotFound)?;
         vol.delete_needle(n)
     }
 
     // ---- Collection operations ----
 
     /// Delete all volumes in a collection.
-    pub fn delete_collection(&mut self, collection: &str) -> Result<(), String> {
+    pub fn delete_collection(&mut self, collection: &str) -> Result<(), VolumeError> {
         for loc in &mut self.locations {
-            loc.delete_collection(collection)
-                .map_err(|e| format!("delete collection {}: {}", collection, e))?;
+            loc.delete_collection(collection)?;
         }
         crate::metrics::delete_collection_metrics(collection);
         Ok(())
@@ -594,19 +943,13 @@ impl Store {
                 let current = loc.max_volume_count.load(Ordering::Relaxed);
                 let (_, free) = super::disk_location::get_disk_stats(&loc.directory);
 
-                let unused_space = if self.get_preallocate() {
-                    0
-                } else {
-                    loc.unused_space(volume_size_limit)
-                };
+                let unused_space = loc.unused_space(volume_size_limit);
                 let unclaimed = (free as i64) - (unused_space as i64);
 
                 let vol_count = loc.volumes_len() as i32;
                 let loc_ec_shards = loc.ec_shard_count();
-                let ec_equivalent = ((loc_ec_shards
-                    + crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT
-                    - 1)
-                    / crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT)
+                let ec_equivalent = loc_ec_shards
+                    .div_ceil(crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT)
                     as i32;
                 let mut max_count = vol_count + ec_equivalent;
 
@@ -661,8 +1004,9 @@ impl Store {
         &mut self,
         vid: VolumeId,
         collection: &str,
-        shard_ids: &[u32],
+        shard_ids: &[ShardId],
     ) -> Result<(), VolumeError> {
+        self.stamp_allocated_vid(vid);
         // Find the location where the EC files live
         let loc_idx = self.find_ec_location(vid, collection).ok_or_else(|| {
             VolumeError::Io(io::Error::new(
@@ -682,21 +1026,92 @@ impl Store {
         &mut self,
         vid: VolumeId,
         collection: &str,
-        shard_id: u32,
+        shard_id: ShardId,
         source_disk_type: &str,
     ) -> Result<(), VolumeError> {
+        self.stamp_allocated_vid(vid);
+        // The .ecx may live on a different disk than the shard being mounted
+        // (ec.balance / ec.rebuild can spread shards across sibling disks), so
+        // look up its owner once and point EcVolume::new at the directory that
+        // really has it — Go's MountEcShards does the same. Without an index
+        // anywhere the mount fails instead of advertising an unreadable shard.
+        let ecx_idx_dir = self.find_ecx_idx_dir_for_volume(collection, vid);
+        // Keep going past a disk that cannot mount the shard: an interrupted
+        // move can leave an unusable copy on one disk and a good one on the
+        // next. Like Go, a NotFound just means "not this disk"; anything else
+        // is collected so an all-disks-fail error names every disk tried.
+        let mut failures: Vec<(String, VolumeError)> = Vec::new();
         for loc in &mut self.locations {
             // Check if the shard file exists on this location
-            let shard = EcVolumeShard::new(&loc.directory, collection, vid, shard_id as u8);
-            if std::path::Path::new(&shard.file_name()).exists() {
-                loc.mount_ec_shards(vid, collection, &[shard_id], source_disk_type)?;
-                return Ok(());
+            let shard = EcVolumeShard::new(&loc.directory, collection, vid, shard_id);
+            if !std::path::Path::new(&shard.file_name()).exists() {
+                continue;
+            }
+            // If this disk owns the .ecx its own idx dir is the right answer;
+            // only a disk without a usable .ecx is pointed at the owner's.
+            let idx_dir = match &ecx_idx_dir {
+                Some(owner_dir)
+                    if loc.idx_directory != *owner_dir
+                        && loc.directory != *owner_dir
+                        && !loc.has_ecx_file_on_disk(collection, vid) =>
+                {
+                    owner_dir.clone()
+                }
+                _ => loc.idx_directory.clone(),
+            };
+            match loc.mount_ec_shards_with_idx_dir(
+                vid,
+                collection,
+                &[shard_id],
+                &idx_dir,
+                source_disk_type,
+            ) {
+                Ok(()) => return Ok(()),
+                Err(VolumeError::Io(e)) if e.kind() == io::ErrorKind::NotFound => {}
+                Err(e) => failures.push((loc.directory.clone(), e)),
             }
         }
-        Err(VolumeError::Io(io::Error::new(
-            io::ErrorKind::NotFound,
-            format!("MountEcShards {}.{} not found on disk", vid, shard_id),
-        )))
+        if failures.is_empty() {
+            let what = if ecx_idx_dir.is_none() {
+                ": no .ecx index found on any local disk"
+            } else {
+                " not found on disk"
+            };
+            return Err(VolumeError::Io(io::Error::new(
+                io::ErrorKind::NotFound,
+                format!("MountEcShards {}.{}{}", vid, shard_id, what),
+            )));
+        }
+        let tried = failures
+            .iter()
+            .map(|(dir, e)| format!("{}: {}", dir, e))
+            .collect::<Vec<_>>()
+            .join("; ");
+        Err(VolumeError::Io(io::Error::other(format!(
+            "MountEcShards {}.{} load failures: {}",
+            vid, shard_id, tried
+        ))))
+    }
+
+    /// The directory holding a usable `.ecx` for (collection, vid) on any local
+    /// disk, index directory before data directory. A 0-byte `.ecx` is a stub
+    /// from a failed copy and counts as absent, so the scan continues to a
+    /// sibling disk. Mirrors Go's `Store.findEcxIdxDirForVolume`.
+    fn find_ecx_idx_dir_for_volume(&self, collection: &str, vid: VolumeId) -> Option<String> {
+        let mut seen = std::collections::HashSet::new();
+        for loc in &self.locations {
+            for scan in [&loc.idx_directory, &loc.directory] {
+                // A shared -dir.idx is only stat'd once per call.
+                if scan.is_empty() || !seen.insert(scan.clone()) {
+                    continue;
+                }
+                let base = crate::storage::volume::volume_file_name(scan, collection, vid);
+                if is_usable_ecx_file(&format!("{}.ecx", base)) {
+                    return Some(scan.clone());
+                }
+            }
+        }
+        None
     }
 
     /// Unmount EC shards for a volume (batch).
@@ -708,7 +1123,7 @@ impl Store {
     /// the same store (#9252). DiskLocation::unmount_ec_shards
     /// already skips shards that aren't mounted, so this is safe to
     /// fan out blindly.
-    pub fn unmount_ec_shards(&mut self, vid: VolumeId, shard_ids: &[u32]) {
+    pub fn unmount_ec_shards(&mut self, vid: VolumeId, shard_ids: &[ShardId]) {
         for loc in &mut self.locations {
             if loc.has_ec_volume(vid) {
                 loc.unmount_ec_shards(vid, shard_ids);
@@ -721,7 +1136,7 @@ impl Store {
     pub fn unmount_ec_shard(
         &mut self,
         vid: VolumeId,
-        shard_id: u32,
+        shard_id: ShardId,
         req_encode_ts_ns: i64,
     ) -> Result<(), VolumeError> {
         // Walk all locations rather than stopping at the first with the
@@ -729,7 +1144,7 @@ impl Store {
         // multiple disks, with the target shard on any of them.
         for disk_id in 0..self.locations.len() {
             let ec_vol = self.locations[disk_id].find_ec_volume(vid);
-            let has_shard = ec_vol.is_some_and(|ec_vol| ec_vol.has_shard(shard_id as u8));
+            let has_shard = ec_vol.is_some_and(|ec_vol| ec_vol.has_shard(shard_id));
             if !has_shard {
                 continue;
             }
@@ -749,12 +1164,7 @@ impl Store {
                 );
                 continue;
             }
-            tracing::info!(
-                volume_id = vid.0,
-                shard_id,
-                disk_id,
-                "UnmountEcShards"
-            );
+            tracing::info!(volume_id = vid.0, shard_id, disk_id, "UnmountEcShards");
             self.locations[disk_id].unmount_ec_shards(vid, &[shard_id]);
         }
         // Go returns nil if shard not found (no error)
@@ -772,6 +1182,51 @@ impl Store {
     }
 
     /// Find an EC volume across all locations (mutable).
+    /// Every per-disk `EcVolume` this store maps for `vid`. A vid can mount on
+    /// N disks as N distinct runtimes, and the first-match `find_ec_volume_mut`
+    /// hides the siblings — so anything that has to reach the whole volume,
+    /// rather than any one runtime of it, iterates this instead.
+    /// Every directory on this server that could hold an EC volume's metadata —
+    /// each disk's data and index directory. Startup mirroring gives each
+    /// shard-bearing disk its own .ecx/.ecj/.vif, but the checksum sidecar is
+    /// not mirrored and a repair delivers exactly one copy, so a runtime looking
+    /// only at its own two directories cannot see it. Handing this list to the
+    /// sidecar resolution keeps one authoritative copy reachable from every
+    /// runtime rather than duplicating a file that is rewritten as shards are
+    /// repaired and generations published.
+    pub fn ec_metadata_dirs(&self) -> Vec<String> {
+        let mut dirs: Vec<String> = Vec::with_capacity(self.locations.len() * 2);
+        for loc in &self.locations {
+            for dir in [&loc.directory, &loc.idx_directory] {
+                if !dir.is_empty() && !dirs.iter().any(|d| d == dir) {
+                    dirs.push(dir.clone());
+                }
+            }
+        }
+        dirs
+    }
+
+    /// Every per-disk `EcVolume` this store maps for `vid`, in location order.
+    /// Immutable twin of [`Self::find_all_ec_volumes_mut`].
+    ///
+    /// Reconciliation can mount one vid as N runtimes holding disjoint shard
+    /// subsets, and the first-match `find_ec_volume` hides the siblings. Anything
+    /// that has to reach the whole volume, rather than any one runtime of it,
+    /// uses this.
+    pub fn find_all_ec_volumes(&self, vid: VolumeId) -> Vec<&EcVolume> {
+        self.locations
+            .iter()
+            .filter_map(|loc| loc.find_ec_volume(vid))
+            .collect()
+    }
+
+    pub fn find_all_ec_volumes_mut(&mut self, vid: VolumeId) -> Vec<&mut EcVolume> {
+        self.locations
+            .iter_mut()
+            .filter_map(|loc| loc.find_ec_volume_mut(vid))
+            .collect()
+    }
+
     pub fn find_ec_volume_mut(&mut self, vid: VolumeId) -> Option<&mut EcVolume> {
         for loc in &mut self.locations {
             if let Some(ecv) = loc.find_ec_volume_mut(vid) {
@@ -808,12 +1263,12 @@ impl Store {
     /// disks (each holding a disjoint subset of the shards). Without
     /// this, callers using `find_ec_volume(vid)` would only see the
     /// first disk and miss shards that live on a sibling.
-    pub fn find_ec_shard_location(&self, vid: VolumeId, shard_id: u32) -> Option<usize> {
+    pub fn find_ec_shard_location(&self, vid: VolumeId, shard_id: ShardId) -> Option<usize> {
         for (i, loc) in self.locations.iter().enumerate() {
-            if let Some(ecv) = loc.find_ec_volume(vid) {
-                if ecv.has_shard(shard_id as u8) {
-                    return Some(i);
-                }
+            if let Some(ecv) = loc.find_ec_volume(vid)
+                && ecv.has_shard(shard_id)
+            {
+                return Some(i);
             }
         }
         None
@@ -822,16 +1277,12 @@ impl Store {
     /// Like [`Self::find_ec_shard_location`] but returns the EcVolume
     /// reference directly. Borrows the store immutably for the
     /// EcVolume's lifetime.
-    pub fn find_ec_volume_with_shard(
-        &self,
-        vid: VolumeId,
-        shard_id: u32,
-    ) -> Option<&EcVolume> {
+    pub fn find_ec_volume_with_shard(&self, vid: VolumeId, shard_id: ShardId) -> Option<&EcVolume> {
         for loc in &self.locations {
-            if let Some(ecv) = loc.find_ec_volume(vid) {
-                if ecv.has_shard(shard_id as u8) {
-                    return Some(ecv);
-                }
+            if let Some(ecv) = loc.find_ec_volume(vid)
+                && ecv.has_shard(shard_id)
+            {
+                return Some(ecv);
             }
         }
         None
@@ -860,9 +1311,12 @@ impl Store {
                 if found_vol.is_none() {
                     found_vol = Some(ecv);
                 }
-                for shard_id in 0..max_shard_count {
-                    if dirs[shard_id].is_none() && ecv.has_shard(shard_id as u8) {
-                        dirs[shard_id] = Some(loc.directory.clone());
+                for (shard_id, dir) in dirs.iter_mut().enumerate() {
+                    let Ok(sid) = ShardId::try_from(shard_id) else {
+                        continue;
+                    };
+                    if dir.is_none() && ecv.has_shard(sid) {
+                        *dir = Some(loc.directory.clone());
                     }
                 }
             }
@@ -870,49 +1324,93 @@ impl Store {
         found_vol.map(|v| (v, dirs))
     }
 
+    #[cfg(test)]
     pub fn delete_expired_ec_volumes(
         &mut self,
     ) -> (
         Vec<master_pb::VolumeEcShardInformationMessage>,
         Vec<master_pb::VolumeEcShardInformationMessage>,
     ) {
-        let mut ec_shards = Vec::new();
-        let mut deleted = Vec::new();
+        let (mut ec_shards, expired) = self.find_expired_ec_volumes();
+        let (deleted, still_held) = self.remove_expired_ec_volumes(expired);
+        ec_shards.extend(still_held);
+        (ec_shards, deleted)
+    }
 
-        for (disk_id, loc) in self.locations.iter_mut().enumerate() {
-            let mut expired_vids = Vec::new();
+    /// The read half of `delete_expired_ec_volumes`: the shards to report, and
+    /// the expired EC volumes, by disk index, for `remove_expired_ec_volumes`.
+    pub fn find_expired_ec_volumes(
+        &self,
+    ) -> (
+        Vec<master_pb::VolumeEcShardInformationMessage>,
+        Vec<(usize, VolumeId)>,
+    ) {
+        let mut ec_shards = Vec::new();
+        let mut expired = Vec::new();
+
+        for (disk_id, loc) in self.locations.iter().enumerate() {
             for (vid, ec_vol) in loc.ec_volumes() {
                 if ec_vol.is_time_to_destroy() {
-                    expired_vids.push(*vid);
+                    expired.push((disk_id, *vid));
+                } else if ec_vol.should_quarantine() {
+                    let (_, io_count, quarantined) = ec_vol.get_io_error_state();
+                    if !quarantined {
+                        ec_vol.mark_io_quarantined();
+                        tracing::warn!(
+                            volume_id = vid.0,
+                            io_count,
+                            "ec volume quarantined after consecutive IO errors"
+                        );
+                    }
                 } else {
                     ec_shards
                         .extend(ec_vol.to_volume_ec_shard_information_messages(disk_id as u32));
                 }
             }
-
-            for vid in expired_vids {
-                let messages = loc
-                    .find_ec_volume(vid)
-                    .map(|ec_vol| ec_vol.to_volume_ec_shard_information_messages(disk_id as u32))
-                    .unwrap_or_default();
-                if let Some(mut ec_vol) = loc.remove_ec_volume(vid) {
-                    for _ in 0..ec_vol.shard_count() {
-                        crate::metrics::VOLUME_GAUGE
-                            .with_label_values(&[&ec_vol.collection, "ec_shards"])
-                            .dec();
-                    }
-                    ec_vol.destroy();
-                    deleted.extend(messages);
-                } else {
-                    ec_shards.extend(messages);
-                }
-            }
         }
 
-        (ec_shards, deleted)
+        (ec_shards, expired)
+    }
+
+    /// The write half of `delete_expired_ec_volumes`: destroys each volume that
+    /// is still there and still expired, returning the shards deleted and the
+    /// shards of any that no longer qualify.
+    pub fn remove_expired_ec_volumes(
+        &mut self,
+        expired: Vec<(usize, VolumeId)>,
+    ) -> (
+        Vec<master_pb::VolumeEcShardInformationMessage>,
+        Vec<master_pb::VolumeEcShardInformationMessage>,
+    ) {
+        let mut deleted = Vec::new();
+        let mut still_held = Vec::new();
+        for (disk_id, vid) in expired {
+            let Some(loc) = self.locations.get_mut(disk_id) else {
+                continue;
+            };
+            let Some(ec_vol) = loc.find_ec_volume(vid) else {
+                continue;
+            };
+            let messages = ec_vol.to_volume_ec_shard_information_messages(disk_id as u32);
+            if !ec_vol.is_time_to_destroy() {
+                still_held.extend(messages);
+                continue;
+            }
+            if let Some(mut ec_vol) = loc.remove_ec_volume(vid) {
+                for _ in 0..ec_vol.shard_count() {
+                    crate::metrics::VOLUME_GAUGE
+                        .with_label_values(&[&ec_vol.collection, "ec_shards"])
+                        .dec();
+                }
+                ec_vol.destroy();
+                deleted.extend(messages);
+            }
+        }
+        (deleted, still_held)
     }
 
     /// Remove an EC volume from whichever location has it.
+    #[cfg(test)]
     pub fn remove_ec_volume(&mut self, vid: VolumeId) -> Option<EcVolume> {
         for loc in &mut self.locations {
             if let Some(ecv) = loc.remove_ec_volume(vid) {
@@ -922,28 +1420,66 @@ impl Store {
         None
     }
 
+    /// Drop any in-memory EC volume for vid from EVERY disk and close its
+    /// descriptors without deleting files. Unlike remove_ec_volume this does not
+    /// stop at the first disk: a split-disk volume is registered on each disk
+    /// holding a shard. Mirrors Go's Store.UnloadEcVolume.
+    pub fn unload_ec_volume(&mut self, vid: VolumeId) {
+        for loc in &mut self.locations {
+            loc.unload_ec_volume(vid);
+        }
+    }
+
     /// Find the location index containing EC files for a volume.
     pub fn find_ec_location(&self, vid: VolumeId, collection: &str) -> Option<usize> {
         for (i, loc) in self.locations.iter().enumerate() {
             let base = crate::storage::volume::volume_file_name(&loc.directory, collection, vid);
             let ecx_path = format!("{}.ecx", base);
-            if std::path::Path::new(&ecx_path).exists() {
+            // A 0-byte .ecx is a failed-copy stub, not an index (Go requires
+            // Size() > 0); keep looking for a disk with a real one.
+            if is_usable_ecx_file(&ecx_path) {
                 return Some(i);
             }
         }
         None
     }
 
-    /// Delete EC shard files from disk.
-    pub fn delete_ec_shards(&mut self, vid: VolumeId, collection: &str, shard_ids: &[u32]) {
+    /// Delete EC shard files from disk. Staged-generation removal failures are
+    /// retained and returned after every location has been processed, so a
+    /// failed sweep never masquerades as a successful delete.
+    pub fn delete_ec_shards(
+        &mut self,
+        vid: VolumeId,
+        collection: &str,
+        shard_ids: &[ShardId],
+    ) -> std::io::Result<()> {
         // Delete shard files from disk, tracking which locations actually held one.
         let mut deleted_at = vec![false; self.locations.len()];
+        let mut first_err: Option<std::io::Error> = None;
         for (i, loc) in self.locations.iter().enumerate() {
             for &shard_id in shard_ids {
-                let shard = EcVolumeShard::new(&loc.directory, collection, vid, shard_id as u8);
+                let shard = EcVolumeShard::new(&loc.directory, collection, vid, shard_id);
                 if std::fs::remove_file(shard.file_name()).is_ok() {
                     deleted_at[i] = true;
                 }
+                // The shard and every 2PC generation of it (<name>.v<N>) are
+                // removed: the shard must not live on this disk at all.
+                match crate::storage::erasure_coding::ec_shard::remove_ec_shard_generations(
+                    &shard.file_name(),
+                ) {
+                    Ok(true) => deleted_at[i] = true,
+                    Ok(false) => {}
+                    Err(e) => {
+                        tracing::warn!(
+                            "failed to remove staged generations of {}: {}",
+                            shard.file_name(),
+                            e
+                        );
+                        if first_err.is_none() {
+                            first_err = Some(e);
+                        }
+                    }
+                }
             }
         }
 
@@ -976,8 +1512,9 @@ impl Store {
                         collection,
                         vid,
                     );
-                    let _ =
-                        crate::storage::erasure_coding::ec_bitrot::remove_bitrot_sidecars(&idx_base);
+                    let _ = crate::storage::erasure_coding::ec_bitrot::remove_bitrot_sidecars(
+                        &idx_base,
+                    );
                 }
             }
         }
@@ -992,10 +1529,12 @@ impl Store {
                     crate::storage::volume::volume_file_name(&loc.directory, collection, vid);
                 let _ = std::fs::remove_file(format!("{}.ecx", idx_base));
                 let _ = std::fs::remove_file(format!("{}.ecj", idx_base));
+                let _ = std::fs::remove_file(format!("{}{}", idx_base, ECJ_COMPACT_TMP_EXT));
                 // Also try data directory in case .ecx/.ecj were created before -dir.idx
                 if loc.idx_directory != loc.directory {
                     let _ = std::fs::remove_file(format!("{}.ecx", data_base));
                     let _ = std::fs::remove_file(format!("{}.ecj", data_base));
+                    let _ = std::fs::remove_file(format!("{}{}", data_base, ECJ_COMPACT_TMP_EXT));
                 }
                 // A shard-only disk also drops its stale .vif (Go
                 // removeEcSharedIndexFiles): a live .idx means this disk still
@@ -1014,6 +1553,11 @@ impl Store {
                 }
             }
         }
+
+        match first_err {
+            Some(e) => Err(e),
+            None => Ok(()),
+        }
     }
 
     /// True if `loc` still has any on-disk EC shard for this volume. An
@@ -1082,87 +1626,89 @@ impl Store {
 
     // ---- Vacuum / Compaction ----
 
-    /// Check the garbage level of a volume.
-    pub fn check_compact_volume(&self, vid: VolumeId) -> Result<f64, String> {
-        if let Some((_, v)) = self.find_volume(vid) {
-            Ok(v.garbage_level())
-        } else {
-            Err(format!(
-                "volume id {} is not found during check compact",
-                vid.0
-            ))
-        }
-    }
-
     /// Compact a volume by rewriting only live needles.
     pub fn compact_volume<F>(
         &mut self,
         vid: VolumeId,
         preallocate: u64,
-        max_bytes_per_second: i64,
+        _max_bytes_per_second: i64,
         progress_fn: F,
-    ) -> Result<(), String>
+    ) -> Result<(), VolumeError>
     where
         F: Fn(i64) -> bool,
     {
-        let loc_idx = self
+        match self.begin_compact_volume(vid, preallocate)? {
+            Some(job) => job.run(progress_fn),
+            None => Ok(()),
+        }
+    }
+
+    /// The part of `compact_volume` that needs the store: check free space and
+    /// start the compaction. The returned job runs without the store lock.
+    pub(crate) fn begin_compact_volume(
+        &mut self,
+        vid: VolumeId,
+        preallocate: u64,
+    ) -> Result<Option<CompactionJob>, VolumeError> {
+        let (_, v) = self
             .find_volume(vid)
-            .map(|(i, _)| i)
-            .ok_or_else(|| format!("volume id {} is not found during compact", vid.0))?;
+            .ok_or(VolumeError::VolumeNotFound(vid))?;
+        ensure_compact_volume_space(&v, preallocate)?;
 
-        let dir = self.locations[loc_idx].directory.clone();
-        let (_, free) = crate::storage::disk_location::get_disk_stats(&dir);
+        let (_, v) = self
+            .find_volume(vid)
+            .ok_or(VolumeError::VolumeNotFound(vid))?;
+        v.begin_compact_by_index()
+    }
 
-        // Compute required space: use the larger of preallocate or estimated volume size
-        // matching Go's CompactVolume space check
-        let space_needed = {
-            let (_, v) = self.find_volume(vid).unwrap();
-            let estimated = v.dat_file_size().unwrap_or(0) + v.idx_file_size();
-            std::cmp::max(preallocate, estimated)
+    /// Rewrite the volume in `dir`/`dir_idx`, which is not mounted, with its
+    /// live needles only. Go's `Store.CompactVolumeFiles`.
+    pub fn compact_volume_files(
+        dir: &str,
+        dir_idx: &str,
+        collection: &str,
+        vid: VolumeId,
+        needle_map_kind: NeedleMapKind,
+    ) -> Result<(), VolumeError> {
+        let spec = VolumeSpec {
+            collection,
+            ..VolumeSpec::default()
         };
-
-        if free < space_needed {
-            return Err(format!(
-                "not enough free space to compact volume {}. Required: {}, Free: {}",
-                vid.0, space_needed, free
-            ));
-        }
-
-        if let Some((_, v)) = self.find_volume_mut(vid) {
-            v.compact_by_index(preallocate, max_bytes_per_second, progress_fn)
-                .map_err(|e| format!("compact volume {}: {}", vid.0, e))
-        } else {
-            Err(format!("volume id {} is not found during compact", vid.0))
+        let v = Volume::new(dir, dir_idx, vid, needle_map_kind, &spec)?;
+        let compact = || -> Result<(), VolumeError> {
+            ensure_compact_volume_space(&v, 0)?;
+            v.compact_by_index(0, 0, |_| true)?;
+            v.commit_compact()
+        };
+        let result = compact();
+        if result.is_err() {
+            // A failed commit may have swapped only one of .dat/.idx;
+            // reconcile rolls a decided swap forward or removes orphan
+            // temp files before this volume can mount a mismatched pair.
+            let _ = v.reconcile_compact_state();
+            let _ = v.cleanup_compact();
         }
+        v.close();
+        result
     }
 
     /// Commit a completed compaction: swap files and reload.
-    pub fn commit_compact_volume(&mut self, vid: VolumeId) -> Result<(bool, u64), String> {
-        if let Some((_, v)) = self.find_volume_mut(vid) {
-            let is_read_only = v.is_read_only();
-            v.commit_compact()
-                .map_err(|e| format!("commit compact volume {}: {}", vid.0, e))?;
-            let volume_size = v.dat_file_size().unwrap_or(0);
-            Ok((is_read_only, volume_size))
-        } else {
-            Err(format!(
-                "volume id {} is not found during commit compact",
-                vid.0
-            ))
-        }
+    pub fn commit_compact_volume(&mut self, vid: VolumeId) -> Result<(bool, u64), VolumeError> {
+        let (_, v) = self
+            .find_volume(vid)
+            .ok_or(VolumeError::VolumeNotFound(vid))?;
+        let is_read_only = v.is_read_only();
+        v.commit_compact()?;
+        let volume_size = v.dat_file_size().unwrap_or(0);
+        Ok((is_read_only, volume_size))
     }
 
     /// Clean up leftover compaction files.
-    pub fn cleanup_compact_volume(&mut self, vid: VolumeId) -> Result<(), String> {
-        if let Some((_, v)) = self.find_volume_mut(vid) {
-            v.cleanup_compact()
-                .map_err(|e| format!("cleanup volume {}: {}", vid.0, e))
-        } else {
-            Err(format!(
-                "volume id {} is not found during cleaning up",
-                vid.0
-            ))
-        }
+    pub fn cleanup_compact_volume(&mut self, vid: VolumeId) -> Result<(), VolumeError> {
+        let (_, v) = self
+            .find_volume(vid)
+            .ok_or(VolumeError::VolumeNotFound(vid))?;
+        v.cleanup_compact()
     }
 
     /// Close all locations and their volumes.
@@ -1194,6 +1740,61 @@ fn strip_volume_suffix(filename: &str) -> Option<&str> {
         .or_else(|| filename.strip_suffix(".idx"))
 }
 
+/// Rewrites the replica placement in a .dat header for a volume that is not
+/// mounted; a missing .dat means a remote-only volume, where the .vif carries
+/// the placement.
+fn update_dat_replica_placement(
+    dat_path: &str,
+    vid: VolumeId,
+    rp: ReplicaPlacement,
+) -> Result<(), VolumeError> {
+    use std::io::{Read, Seek, SeekFrom, Write};
+
+    let mut file = match std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .open(dat_path)
+    {
+        Ok(f) => f,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(()),
+        Err(e) => {
+            return Err(VolumeError::Io(io::Error::new(
+                e.kind(),
+                format!("volume {} failed to open {}: {}", vid, dat_path, e),
+            )))
+        }
+    };
+    let mut header = [0u8; SUPER_BLOCK_SIZE];
+    file.read_exact(&mut header).map_err(|e| {
+        VolumeError::Io(io::Error::new(
+            e.kind(),
+            format!("volume {} failed to parse superblock: {}", vid, e),
+        ))
+    })?;
+    let extra_size = u16::from_be_bytes([header[6], header[7]]) as usize;
+    let mut block = header.to_vec();
+    block.resize(SUPER_BLOCK_SIZE + extra_size, 0);
+    if extra_size > 0 {
+        file.read_exact(&mut block[SUPER_BLOCK_SIZE..]).map_err(|e| {
+            VolumeError::Io(io::Error::new(
+                e.kind(),
+                format!("volume {} failed to parse superblock: {}", vid, e),
+            ))
+        })?;
+    }
+    let mut super_block = SuperBlock::from_bytes(&block).map_err(|e| {
+        VolumeError::Io(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("volume {} failed to parse superblock: {}", vid, e),
+        ))
+    })?;
+    super_block.replica_placement = rp;
+    file.seek(SeekFrom::Start(0))?;
+    file.write_all(&super_block.to_bytes())?;
+    file.sync_all()?;
+    Ok(())
+}
+
 fn load_vif_volume_info(path: &str) -> Result<VifVolumeInfo, VolumeError> {
     let content = match std::fs::read_to_string(path) {
         Ok(c) => c,
@@ -1211,9 +1812,10 @@ fn load_vif_volume_info(path: &str) -> Result<VifVolumeInfo, VolumeError> {
         read_only: bool,
     }
     if let Ok(legacy) = serde_json::from_str::<LegacyVolumeInfo>(&content) {
-        let mut vif = VifVolumeInfo::default();
-        vif.read_only = legacy.read_only;
-        return Ok(vif);
+        return Ok(VifVolumeInfo {
+            read_only: legacy.read_only,
+            ..VifVolumeInfo::default()
+        });
     }
     Err(VolumeError::Io(io::Error::new(
         io::ErrorKind::InvalidData,
@@ -1221,10 +1823,35 @@ fn load_vif_volume_info(path: &str) -> Result<VifVolumeInfo, VolumeError> {
     )))
 }
 
-fn save_vif_volume_info(path: &str, info: &VifVolumeInfo) -> Result<(), VolumeError> {
+/// Mirrors Go's SaveVolumeInfo: a read-only .vif fails the save, and the
+/// file is replaced atomically so a failed write keeps the previous
+/// metadata intact.
+pub(crate) fn save_vif_volume_info(path: &str, info: &VifVolumeInfo) -> Result<(), VolumeError> {
+    if std::fs::metadata(path).is_ok_and(|m| m.permissions().readonly()) {
+        return Err(VolumeError::Io(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!("failed to check {} not writable", path),
+        )));
+    }
     let content = serde_json::to_string_pretty(info)
-        .map_err(|e| VolumeError::Io(io::Error::new(io::ErrorKind::Other, e.to_string())))?;
-    std::fs::write(path, content)?;
+        .map_err(|e| VolumeError::Io(io::Error::other(e.to_string())))?;
+    static TMP_SEQ: AtomicU64 = AtomicU64::new(0);
+    let tmp = format!(
+        "{}.tmp.{}.{}",
+        path,
+        std::process::id(),
+        TMP_SEQ.fetch_add(1, Ordering::Relaxed)
+    );
+    let write = (|| -> io::Result<()> {
+        use std::io::Write;
+        let mut f = std::fs::File::create(&tmp)?;
+        f.write_all(content.as_bytes())?;
+        f.sync_all()
+    })();
+    if let Err(e) = write.and_then(|()| std::fs::rename(&tmp, path)) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e.into());
+    }
     Ok(())
 }
 
@@ -1270,6 +1897,79 @@ fn ec_free_shard_count(loc: &DiskLocation, data_shard_count: u32) -> i64 {
     free
 }
 
+/// Reports how many of `shard_ids` this disk already claims for `vid`, per
+/// the in-memory registration the read path and heartbeats use.
+///
+/// Mirrors `ownedEcShardCount` in `weed/storage/store_ec.go`.
+fn owned_ec_shard_count(loc: &DiskLocation, vid: VolumeId, shard_ids: &[ShardId]) -> usize {
+    let Some(ecv) = loc.find_ec_volume(vid) else {
+        return 0;
+    };
+    shard_ids
+        .iter()
+        .filter(|&&shard_id| ecv.has_shard(shard_id))
+        .count()
+}
+
+/// Mirrors Go's compactionSpaceNeeded: what compaction will write, split into
+/// the new .dat and rebuilt .idx shares, each capped at its current file.
+fn compaction_space_needed(v: &Volume, preallocate: u64) -> (u64, u64) {
+    let mut data_bytes = v.current_dat_file_size().unwrap_or(0);
+    let mut index_bytes = v.idx_file_size();
+
+    let live_count = v.file_count() - v.deleted_count();
+    let live_content = v.content_size() as i64 - v.deleted_size() as i64;
+    // Unknown or inconsistent deleted sizes: the whole volume stays the
+    // estimate.
+    let deleted_size_known = v.deleted_count() == 0 || v.deleted_size() > 0;
+    if deleted_size_known && live_count >= 0 && live_content >= 0 {
+        // Empty-needle framing plus a padding unit covers the worst case.
+        let per_needle =
+            (get_actual_size(Size(0), v.version()) + NEEDLE_PADDING_SIZE as i64) as u64;
+        let estimate = with_headroom(
+            SUPER_BLOCK_SIZE as u64 + live_content as u64 + live_count as u64 * per_needle,
+        );
+        if estimate < data_bytes {
+            data_bytes = estimate;
+        }
+        let estimate = with_headroom(live_count as u64 * NEEDLE_MAP_ENTRY_SIZE as u64);
+        if estimate < index_bytes {
+            index_bytes = estimate;
+        }
+    }
+    if preallocate > data_bytes {
+        data_bytes = preallocate;
+    }
+    (data_bytes, index_bytes)
+}
+
+/// Headroom for Bloom-filter false positives in the live/deleted counters.
+fn with_headroom(estimate: u64) -> u64 {
+    estimate + estimate / 16
+}
+
+/// Whether two directories draw on the same free-space pool; in doubt, yes.
+fn same_filesystem(a: &str, b: &str) -> bool {
+    if a == b {
+        return true;
+    }
+    same_filesystem_impl(a, b)
+}
+
+#[cfg(unix)]
+fn same_filesystem_impl(a: &str, b: &str) -> bool {
+    use std::os::unix::fs::MetadataExt;
+    match (std::fs::metadata(a), std::fs::metadata(b)) {
+        (Ok(ma), Ok(mb)) => ma.dev() == mb.dev(),
+        _ => true,
+    }
+}
+
+#[cfg(not(unix))]
+fn same_filesystem_impl(_a: &str, _b: &str) -> bool {
+    true
+}
+
 // ============================================================================
 // Tests
 // ============================================================================
@@ -1325,36 +2025,354 @@ mod tests {
         let mut store = make_test_store(&[dir]);
 
         store
-            .add_volume(
-                VolumeId(1),
-                "",
-                None,
-                None,
-                0,
-                DiskType::HardDrive,
-                Version::current(),
-            )
+            .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
             .unwrap();
         assert!(store.has_volume(VolumeId(1)));
         assert!(!store.has_volume(VolumeId(2)));
         assert_eq!(store.total_volume_count(), 1);
     }
 
+    // Mirrors Go's TestConfigureVolumeUpdatesSuperblock: configure must leave
+    // the .dat header and the .vif both on the new placement.
+    #[test]
+    fn test_configure_volume_updates_superblock() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+
+        store
+            .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+            .unwrap();
+        assert!(store.unmount_volume(VolumeId(1)).unwrap());
+
+        let rp = ReplicaPlacement::from_string("010").unwrap();
+        store.configure_volume(VolumeId(1), rp).unwrap();
+
+        let base = volume_file_name(dir, "", VolumeId(1));
+        let vif = load_vif_volume_info(&format!("{}.vif", base)).unwrap();
+        assert_eq!(vif.replication, "010");
+
+        let dat = std::fs::read(format!("{}.dat", base)).unwrap();
+        let super_block = SuperBlock::from_bytes(&dat).unwrap();
+        assert_eq!(super_block.replica_placement, rp);
+
+        assert!(store.configure_volume(VolumeId(2), rp).is_err());
+    }
+
+    #[test]
+    fn test_mount_volume_by_id_hint_skips_lone_sidecar() {
+        // A lone .vif/.idx sidecar (e.g. an EC sidecar whose .ecx is on a
+        // sibling disk) must NOT make the collection hint create a phantom
+        // empty .dat. The hint is skipped and the directory scan finds nothing.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+
+        let base = volume_file_name(dir, "coll", VolumeId(5));
+        std::fs::write(format!("{}.vif", base), "{}").unwrap();
+        std::fs::write(format!("{}.idx", base), b"").unwrap();
+        // No .dat, and the .vif does not reference a remote file.
+
+        let err = store
+            .mount_volume_by_id(VolumeId(5), Some("coll"))
+            .unwrap_err();
+        assert!(matches!(err, VolumeError::Io(ref e)
+            if e.kind() == std::io::ErrorKind::NotFound));
+        // No phantom .dat was created.
+        assert!(!std::path::Path::new(&format!("{}.dat", base)).exists());
+        assert!(store.find_volume(VolumeId(5)).is_none());
+    }
+
+    #[test]
+    fn test_mount_volume_by_id_hint_rejects_traversal_collection() {
+        // A collection carrying a parent reference must not route file
+        // creation outside the storage directory; the hint is dropped.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+
+        let escaped = format!("{}/../evil_5.dat", dir);
+        let err = store
+            .mount_volume_by_id(VolumeId(5), Some("../evil"))
+            .unwrap_err();
+        assert!(matches!(err, VolumeError::Io(ref e)
+            if e.kind() == std::io::ErrorKind::NotFound));
+        assert!(!std::path::Path::new(&escaped).exists());
+        assert!(store.find_volume(VolumeId(5)).is_none());
+    }
+
+    #[test]
+    fn test_mount_volume_by_id_hint_loads_real_volume() {
+        // With a real .dat on disk, the collection hint mounts the volume
+        // directly without scanning the directory.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+        store
+            .add_volume(
+                VolumeId(7),
+                DiskType::HardDrive,
+                &VolumeSpec {
+                    collection: "coll",
+                    ..Default::default()
+                },
+            )
+            .unwrap();
+        // Write a needle so the volume has real data, then unmount it so the
+        // .dat stays on disk but is no longer registered.
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"hint me".to_vec(),
+            data_size: 7,
+            ..Needle::default()
+        };
+        store
+            .write_volume_needle(VolumeId(7), &mut n, false)
+            .unwrap();
+        assert!(store.unmount_volume(VolumeId(7)).unwrap());
+
+        store.mount_volume_by_id(VolumeId(7), Some("coll")).unwrap();
+        assert!(store.find_volume(VolumeId(7)).is_some());
+
+        let mut got = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        let count = store.read_volume_needle(VolumeId(7), &mut got).unwrap();
+        assert_eq!(count, 7);
+        assert_eq!(got.data, b"hint me");
+    }
+
+    #[test]
+    fn test_mount_volume_by_id_hint_accepts_double_dot_collection() {
+        // A valid collection like "foo..bar" contains ".." but is not a parent
+        // reference — volume_file_name joins with "_" so it stays in the dir.
+        // The hint must NOT be rejected for it.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+        store
+            .add_volume(
+                VolumeId(9),
+                DiskType::HardDrive,
+                &VolumeSpec {
+                    collection: "foo..bar",
+                    ..Default::default()
+                },
+            )
+            .unwrap();
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"dots".to_vec(),
+            data_size: 4,
+            ..Needle::default()
+        };
+        store
+            .write_volume_needle(VolumeId(9), &mut n, false)
+            .unwrap();
+        assert!(store.unmount_volume(VolumeId(9)).unwrap());
+
+        // The hint is accepted and mounts the volume.
+        store
+            .mount_volume_by_id(VolumeId(9), Some("foo..bar"))
+            .unwrap();
+        assert!(store.find_volume(VolumeId(9)).is_some());
+
+        let mut got = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        let count = store.read_volume_needle(VolumeId(9), &mut got).unwrap();
+        assert_eq!(count, 4);
+        assert_eq!(got.data, b"dots");
+    }
+
+    #[test]
+    fn test_mount_volume_by_id_skips_incomplete_note() {
+        // A persisting .note means a VolumeCopy was interrupted; the volume
+        // must not mount as live (would expose truncated data). The candidate
+        // is skipped and mount returns NotFound.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+        store
+            .add_volume(
+                VolumeId(11),
+                DiskType::HardDrive,
+                &VolumeSpec {
+                    collection: "coll",
+                    ..Default::default()
+                },
+            )
+            .unwrap();
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"partial".to_vec(),
+            data_size: 7,
+            ..Needle::default()
+        };
+        store
+            .write_volume_needle(VolumeId(11), &mut n, false)
+            .unwrap();
+        assert!(store.unmount_volume(VolumeId(11)).unwrap());
+
+        // Simulate an interrupted copy: drop a .note marker.
+        let base = volume_file_name(dir, "coll", VolumeId(11));
+        std::fs::write(format!("{}.note", base), "interrupted").unwrap();
+
+        // Hint path: skipped because of .note.
+        let err = store
+            .mount_volume_by_id(VolumeId(11), Some("coll"))
+            .unwrap_err();
+        assert!(matches!(err, VolumeError::Io(ref e)
+            if e.kind() == std::io::ErrorKind::NotFound));
+        assert!(store.find_volume(VolumeId(11)).is_none());
+
+        // Fallback path (no hint): also skipped because of .note.
+        let err = store.mount_volume_by_id(VolumeId(11), None).unwrap_err();
+        assert!(matches!(err, VolumeError::Io(ref e)
+            if e.kind() == std::io::ErrorKind::NotFound));
+        assert!(store.find_volume(VolumeId(11)).is_none());
+    }
+
+    #[test]
+    fn test_mount_volume_by_id_fallback_skips_sidecar_finds_real_dat() {
+        // A lone sidecar on disk 0 must not hide a real .dat on disk 1.
+        // The fallback now iterates all candidates instead of stopping at
+        // the first (sidecar-only) match.
+        let tmp1 = TempDir::new().unwrap();
+        let tmp2 = TempDir::new().unwrap();
+        let dir0 = tmp1.path().to_str().unwrap();
+        let dir1 = tmp2.path().to_str().unwrap();
+
+        // disk 0: lone .vif sidecar, no .dat, no remote.
+        let base0 = volume_file_name(dir0, "coll", VolumeId(13));
+        std::fs::write(format!("{}.vif", base0), "{}").unwrap();
+
+        // disk 1: real volume with data.
+        let mut store = make_test_store(&[dir0, dir1]);
+        store
+            .add_volume(
+                VolumeId(13),
+                DiskType::HardDrive,
+                &VolumeSpec {
+                    collection: "coll",
+                    ..Default::default()
+                },
+            )
+            .unwrap();
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"real".to_vec(),
+            data_size: 4,
+            ..Needle::default()
+        };
+        store
+            .write_volume_needle(VolumeId(13), &mut n, false)
+            .unwrap();
+        assert!(store.unmount_volume(VolumeId(13)).unwrap());
+
+        // No hint: the fallback scan finds the sidecar on disk 0 first (skip,
+        // no .dat), then the real .dat on disk 1 (mount).
+        store.mount_volume_by_id(VolumeId(13), None).unwrap();
+        assert!(store.find_volume(VolumeId(13)).is_some());
+
+        let mut got = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        let count = store.read_volume_needle(VolumeId(13), &mut got).unwrap();
+        assert_eq!(count, 4);
+        assert_eq!(got.data, b"real");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_mount_volume_by_id_continues_past_open_failure() {
+        // A create_volume failure on an earlier candidate must not block a
+        // valid volume on a later disk. The scan remembers the error and
+        // keeps going (matches open_volumes / Go mountVolume).
+        use std::os::unix::fs::PermissionsExt;
+        use std::sync::atomic::Ordering;
+        let tmp1 = TempDir::new().unwrap();
+        let tmp2 = TempDir::new().unwrap();
+        let dir0 = tmp1.path().to_str().unwrap();
+        let dir1 = tmp2.path().to_str().unwrap();
+
+        let mut store = make_test_store(&[dir0, dir1]);
+
+        // Force add_volume onto disk 1 by marking disk 0 as low on space.
+        store.locations[0]
+            .is_disk_space_low
+            .store(true, Ordering::Relaxed);
+        store
+            .add_volume(
+                VolumeId(15),
+                DiskType::HardDrive,
+                &VolumeSpec {
+                    collection: "coll",
+                    ..Default::default()
+                },
+            )
+            .unwrap();
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"later".to_vec(),
+            data_size: 5,
+            ..Needle::default()
+        };
+        store
+            .write_volume_needle(VolumeId(15), &mut n, false)
+            .unwrap();
+        assert!(store.unmount_volume(VolumeId(15)).unwrap());
+        // Clear the low-space flag so mount_volume_by_id considers disk 0.
+        store.locations[0]
+            .is_disk_space_low
+            .store(false, Ordering::Relaxed);
+
+        // disk 0: a .dat that exists but is unreadable (chmod 000). The guard
+        // sees dat_exists=true (metadata succeeds, not a dir), but
+        // create_volume -> Volume::new -> load fails opening it.
+        let base0 = volume_file_name(dir0, "coll", VolumeId(15));
+        std::fs::write(format!("{}.dat", base0), b"").unwrap();
+        std::fs::set_permissions(
+            format!("{}.dat", base0),
+            std::fs::Permissions::from_mode(0o000),
+        )
+        .unwrap();
+
+        // The fallback scan hits disk 0 first (create_volume fails on the
+        // unreadable .dat), then disk 1 (succeeds). Mount succeeds from disk 1.
+        store.mount_volume_by_id(VolumeId(15), None).unwrap();
+        assert!(store.find_volume(VolumeId(15)).is_some());
+
+        let mut got = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        let count = store.read_volume_needle(VolumeId(15), &mut got).unwrap();
+        assert_eq!(count, 5);
+        assert_eq!(got.data, b"later");
+
+        // Restore permissions so TempDir cleanup can remove the file.
+        let _ = std::fs::set_permissions(
+            format!("{}.dat", base0),
+            std::fs::Permissions::from_mode(0o644),
+        );
+    }
+
     #[test]
     fn test_store_read_write_delete() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
         let mut store = make_test_store(&[dir]);
         store
-            .add_volume(
-                VolumeId(1),
-                "",
-                None,
-                None,
-                0,
-                DiskType::HardDrive,
-                Version::current(),
-            )
+            .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
             .unwrap();
 
         // Write
@@ -1365,7 +2383,9 @@ mod tests {
             data_size: 11,
             ..Needle::default()
         };
-        let (offset, _size, unchanged) = store.write_volume_needle(VolumeId(1), &mut n).unwrap();
+        let (offset, _size, unchanged) = store
+            .write_volume_needle(VolumeId(1), &mut n, false)
+            .unwrap();
         assert!(!unchanged);
         assert!(offset > 0);
 
@@ -1388,6 +2408,67 @@ mod tests {
         assert!(deleted.0 > 0);
     }
 
+    #[test]
+    fn test_consolidate_volume_index_not_found() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+        let err = store.consolidate_volume_index(VolumeId(9)).unwrap_err();
+        assert!(matches!(err, VolumeError::Io(ref e)
+            if e.kind() == std::io::ErrorKind::NotFound));
+    }
+
+    #[test]
+    fn test_consolidate_volume_index_noop_with_separate_idx_dir() {
+        let root = TempDir::new().unwrap();
+        let data_dir = root.path().join("data");
+        let idx_dir = root.path().join("idx");
+        std::fs::create_dir_all(&data_dir).unwrap();
+        std::fs::create_dir_all(&idx_dir).unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                data_dir.to_str().unwrap(),
+                idx_dir.to_str().unwrap(),
+                10,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+        store
+            .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+            .unwrap();
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"co-located".to_vec(),
+            data_size: 10,
+            ..Needle::default()
+        };
+        store
+            .write_volume_needle(VolumeId(1), &mut n, false)
+            .unwrap();
+
+        // add_volume already placed the index in the -dir.idx directory, so
+        // consolidation has nothing to move and leaves the volume readable.
+        store.consolidate_volume_index(VolumeId(1)).unwrap();
+        let idx_file = format!(
+            "{}.idx",
+            volume_file_name(idx_dir.to_str().unwrap(), "", VolumeId(1))
+        );
+        assert!(std::path::Path::new(&idx_file).exists());
+
+        let mut got = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        let count = store.read_volume_needle(VolumeId(1), &mut got).unwrap();
+        assert_eq!(count, 10);
+        assert_eq!(got.data, b"co-located");
+    }
+
     #[test]
     fn test_store_multi_location() {
         let tmp1 = TempDir::new().unwrap();
@@ -1420,26 +2501,10 @@ mod tests {
 
         // Add volumes — should go to location with fewest volumes
         store
-            .add_volume(
-                VolumeId(1),
-                "",
-                None,
-                None,
-                0,
-                DiskType::HardDrive,
-                Version::current(),
-            )
+            .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
             .unwrap();
         store
-            .add_volume(
-                VolumeId(2),
-                "",
-                None,
-                None,
-                0,
-                DiskType::HardDrive,
-                Version::current(),
-            )
+            .add_volume(VolumeId(2), DiskType::HardDrive, &VolumeSpec::default())
             .unwrap();
 
         assert_eq!(store.total_volume_count(), 2);
@@ -1457,34 +2522,31 @@ mod tests {
         store
             .add_volume(
                 VolumeId(1),
-                "pics",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "pics",
+                    ..Default::default()
+                },
             )
             .unwrap();
         store
             .add_volume(
                 VolumeId(2),
-                "pics",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "pics",
+                    ..Default::default()
+                },
             )
             .unwrap();
         store
             .add_volume(
                 VolumeId(3),
-                "docs",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "docs",
+                    ..Default::default()
+                },
             )
             .unwrap();
         assert_eq!(store.total_volume_count(), 3);
@@ -1495,7 +2557,7 @@ mod tests {
     }
 
     #[test]
-    fn test_maybe_adjust_volume_max_honors_preallocate_flag() {
+    fn test_maybe_adjust_volume_max_reserves_plain_volumes_while_preallocating() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
 
@@ -1510,58 +2572,77 @@ mod tests {
                 Vec::new(),
             )
             .unwrap();
-        // Use a large volume_size_limit so the unused-space difference between
-        // preallocate=true (0) and preallocate=false (~2 × limit) is big enough
-        // that integer-division rounding and disk-free fluctuations between the
-        // two get_disk_stats calls cannot make the quotients equal.
-        store
-            .volume_size_limit
-            .store(100 * 1024 * 1024, Ordering::Relaxed);
         store
             .add_volume(
                 VolumeId(61),
-                "preallocate_case",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "preallocate_case",
+                    ..Default::default()
+                },
             )
             .unwrap();
+
+        // Room for 2.5 volumes: the plain volume claims one, leaving one more slot.
+        let (_, free) = crate::storage::disk_location::get_disk_stats(dir);
+        let volume_size_limit = (free as f64 / 2.5) as u64;
+        if volume_size_limit == 0 {
+            return; // cannot determine free disk space
+        }
         store
-            .add_volume(
-                VolumeId(62),
-                "preallocate_case",
-                None,
-                None,
-                0,
+            .volume_size_limit
+            .store(volume_size_limit, Ordering::Relaxed);
+        store.locations[0].original_max_volume_count = 0;
+        store.set_preallocate(true);
+
+        store.maybe_adjust_volume_max();
+        assert_eq!(
+            store.locations[0].max_volume_count.load(Ordering::Relaxed),
+            2
+        );
+    }
+
+    #[cfg(target_os = "linux")]
+    #[test]
+    fn test_unused_space_counts_preallocated_volumes_as_full() {
+        const LIMIT: u64 = 1 << 20;
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                dir,
+                dir,
+                2,
                 DiskType::HardDrive,
-                Version::current(),
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
             )
             .unwrap();
-        for vid in [VolumeId(61), VolumeId(62)] {
-            let dat_path = store.find_volume(vid).unwrap().1.dat_path();
-            std::fs::OpenOptions::new()
-                .write(true)
-                .open(dat_path)
-                .unwrap()
-                .set_len((crate::storage::super_block::SUPER_BLOCK_SIZE + 1) as u64)
+        for (vid, preallocate) in [(VolumeId(71), LIMIT), (VolumeId(72), 0)] {
+            store
+                .add_volume(
+                    vid,
+                    DiskType::HardDrive,
+                    &VolumeSpec {
+                        collection: "preallocate_case",
+                        preallocate,
+                        ..Default::default()
+                    },
+                )
                 .unwrap();
         }
-        store.locations[0].original_max_volume_count = 0;
-        store.locations[0]
-            .max_volume_count
-            .store(0, Ordering::Relaxed);
+        let preallocated = store.find_volume(VolumeId(71)).unwrap().1;
+        if preallocated.dat_allocated_size() < LIMIT {
+            return; // the filesystem does not support fallocate
+        }
 
-        store.set_preallocate(false);
-        assert!(store.maybe_adjust_volume_max());
-        let without_preallocate = store.locations[0].max_volume_count.load(Ordering::Relaxed);
-
-        store.set_preallocate(true);
-        assert!(store.maybe_adjust_volume_max());
-        let with_preallocate = store.locations[0].max_volume_count.load(Ordering::Relaxed);
-
-        assert!(with_preallocate > without_preallocate);
+        let plain = store.find_volume(VolumeId(72)).unwrap().1;
+        let plain_dat = plain.dat_file_size().unwrap();
+        // The filesystem may round a small file up to a larger allocation unit.
+        let plain_used = plain_dat.max(plain.dat_allocated_size()) + plain.idx_file_size();
+        assert_eq!(store.locations[0].unused_space(LIMIT), LIMIT - plain_used);
     }
 
     #[test]
@@ -1637,17 +2718,16 @@ mod tests {
         store
             .add_volume(
                 VolumeId(71),
-                "find_free_location_case",
-                None,
-                None,
-                0,
                 DiskType::HardDrive,
-                Version::current(),
+                &VolumeSpec {
+                    collection: "find_free_location_case",
+                    ..Default::default()
+                },
             )
             .unwrap();
 
         let selected =
-            store.find_free_location_predicate(|loc| loc.disk_type == DiskType::HardDrive);
+            store.find_free_location_predicate(|loc| loc.disk_type == DiskType::HardDrive, None);
         assert_eq!(selected, Some(1));
 
         store.locations[1]
@@ -1655,10 +2735,56 @@ mod tests {
             .store(true, Ordering::Relaxed);
 
         let selected =
-            store.find_free_location_predicate(|loc| loc.disk_type == DiskType::HardDrive);
+            store.find_free_location_predicate(|loc| loc.disk_type == DiskType::HardDrive, None);
         assert_eq!(selected, Some(0));
     }
 
+    // VolumeCopy picks a disk before deleting the replica it replaces, so only
+    // the location actually holding that replica may count its slot as free.
+    #[test]
+    fn test_find_free_location_predicate_credits_only_the_holding_location() {
+        let tmp1 = TempDir::new().unwrap();
+        let dir1 = tmp1.path().to_str().unwrap();
+        let tmp2 = TempDir::new().unwrap();
+        let dir2 = tmp2.path().to_str().unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        for dir in [dir1, dir2] {
+            store
+                .add_location(
+                    dir,
+                    dir,
+                    1,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(0.0),
+                    Vec::new(),
+                )
+                .unwrap();
+        }
+        for vid in [81, 82] {
+            store
+                .add_volume(VolumeId(vid), DiskType::HardDrive, &VolumeSpec::default())
+                .unwrap();
+        }
+        let loc_of = |vid| store.find_volume(VolumeId(vid)).unwrap().0;
+        assert_ne!(loc_of(81), loc_of(82), "fixture must fill both locations");
+
+        let hdd = |loc: &DiskLocation| loc.disk_type == DiskType::HardDrive;
+        assert_eq!(store.find_free_location_predicate(hdd, None), None);
+        assert_eq!(
+            store.find_free_location_predicate(hdd, Some(VolumeId(99))),
+            None
+        );
+        assert_eq!(
+            store.find_free_location_predicate(hdd, Some(VolumeId(81))),
+            Some(loc_of(81))
+        );
+        assert_eq!(
+            store.find_free_location_predicate(hdd, Some(VolumeId(82))),
+            Some(loc_of(82))
+        );
+    }
+
     #[test]
     fn test_delete_expired_ec_volumes_removes_expired_entries() {
         let tmp = TempDir::new().unwrap();
@@ -1666,6 +2792,8 @@ mod tests {
         let mut store = make_test_store(&[dir]);
 
         std::fs::write(format!("{}/expired_ec_case_9.ec00", dir), b"expired").unwrap();
+        // An EC volume needs its .ecx to mount.
+        std::fs::write(format!("{}/expired_ec_case_9.ecx", dir), [0u8; 16]).unwrap();
         store.locations[0]
             .mount_ec_shards(VolumeId(9), "expired_ec_case", &[0], "")
             .unwrap();
@@ -1694,6 +2822,244 @@ mod tests {
         assert!(matches!(err, Err(VolumeError::NotFound)));
     }
 
+    #[test]
+    fn test_compaction_of_missing_volume_is_volume_not_found() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+
+        let missing = VolumeId(4242);
+
+        let compact = store.compact_volume(missing, 0, 0, |_| true);
+        assert!(
+            matches!(compact, Err(VolumeError::VolumeNotFound(v)) if v == missing),
+            "{compact:?}"
+        );
+
+        let commit = store.commit_compact_volume(missing);
+        assert!(
+            matches!(commit, Err(VolumeError::VolumeNotFound(v)) if v == missing),
+            "{commit:?}"
+        );
+
+        let cleanup = store.cleanup_compact_volume(missing);
+        assert!(
+            matches!(cleanup, Err(VolumeError::VolumeNotFound(v)) if v == missing),
+            "{cleanup:?}"
+        );
+
+        assert_eq!(
+            VolumeError::VolumeNotFound(missing).to_string(),
+            "volume id 4242 is not found"
+        );
+    }
+
+    #[test]
+    fn test_compact_then_commit_reclaims_a_deleted_needle() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = make_test_store(&[dir]);
+
+        let vid = VolumeId(1);
+        store
+            .add_volume(vid, DiskType::HardDrive, &VolumeSpec::default())
+            .unwrap();
+
+        for i in 1..=3u64 {
+            let payload = format!("data-{i}").into_bytes();
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data_size: payload.len() as u32,
+                data: payload,
+                ..Needle::default()
+            };
+            store.write_volume_needle(vid, &mut n, true).unwrap();
+        }
+
+        let mut del = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(2),
+            ..Needle::default()
+        };
+        store.delete_volume_needle(vid, &mut del).unwrap();
+
+        let size_before = store.find_volume(vid).unwrap().1.dat_file_size().unwrap();
+
+        // preallocate 0, unthrottled, progress fn that never cancels.
+        store.compact_volume(vid, 0, 0, |_| true).unwrap();
+
+        let (is_read_only, volume_size) = store.commit_compact_volume(vid).unwrap();
+        assert!(!is_read_only);
+        assert!(
+            volume_size < size_before,
+            "compaction must drop the deleted needle: {volume_size} vs {size_before}"
+        );
+
+        let (_, v) = store
+            .find_volume(vid)
+            .expect("the volume stays mounted across a commit");
+        assert_eq!(v.file_count(), 2);
+        assert_eq!(v.deleted_count(), 0);
+        assert_eq!(v.dat_file_size().unwrap(), volume_size);
+    }
+
+    fn write_test_needle(store: &mut Store, vid: VolumeId, id: u64, data: &[u8]) {
+        let mut n = Needle {
+            id: NeedleId(id),
+            cookie: Cookie(id as u32),
+            data_size: data.len() as u32,
+            data: data.to_vec(),
+            ..Needle::default()
+        };
+        store.write_volume_needle(vid, &mut n, true).unwrap();
+    }
+
+    fn read_test_needle(store: &Store, vid: VolumeId, id: u64) -> Result<Vec<u8>, VolumeError> {
+        let mut n = Needle {
+            id: NeedleId(id),
+            cookie: Cookie(id as u32),
+            ..Needle::default()
+        };
+        store.read_volume_needle(vid, &mut n)?;
+        Ok(n.data)
+    }
+
+    /// While a compaction copy runs off the store lock, nothing may pull the
+    /// volume's files out from under it or start a second copy into .cpd.
+    #[test]
+    fn test_compaction_in_flight_guards_the_volume() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let other = TempDir::new().unwrap();
+        let mut store = make_test_store(&[dir]);
+        let vid = VolumeId(1);
+        store
+            .add_volume(vid, DiskType::HardDrive, &VolumeSpec::default())
+            .unwrap();
+        for i in 1..=3u64 {
+            write_test_needle(&mut store, vid, i, format!("data-{i}").as_bytes());
+        }
+        let revision = {
+            let (_, v) = store.find_volume(vid).unwrap();
+            v.super_block().compaction_revision
+        };
+
+        let job = store
+            .begin_compact_volume(vid, 0)
+            .unwrap()
+            .expect("the first compaction claims the volume");
+
+        assert!(store.begin_compact_volume(vid, 0).unwrap().is_none());
+        assert!(store.unmount_volume(vid).is_err());
+        assert!(store.delete_volume(vid, false, false, false).is_err());
+        store.delete_collection("").unwrap();
+        assert!(store.cleanup_compact_volume(vid).is_err());
+        let (_, v) = store.find_volume(vid).unwrap();
+        assert!(v.relocate_index_to(other.path().to_str().unwrap()).is_err());
+        // Go parity: a commit that finds the volume compacting is a no-op.
+        store.commit_compact_volume(vid).unwrap();
+
+        let (_, v) = store.find_volume(vid).expect("still mounted");
+        assert!(v.is_compacting());
+        assert_eq!(v.super_block().compaction_revision, revision);
+
+        job.run(|_| true).unwrap();
+        assert!(!store.find_volume(vid).unwrap().1.is_compacting());
+        store.commit_compact_volume(vid).unwrap();
+        let (_, v) = store.find_volume(vid).unwrap();
+        assert_eq!(v.super_block().compaction_revision, revision + 1);
+        assert!(store.unmount_volume(vid).unwrap());
+    }
+
+    /// Writes, overwrites and deletes that land while the copy is parked
+    /// off the store lock must all survive the commit via makeup_diff.
+    fn check_writes_during_compaction_survive_commit(kind: NeedleMapKind) {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut store = Store::new(kind);
+        store
+            .add_location(
+                dir,
+                dir,
+                10,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+        let vid = VolumeId(1);
+        store
+            .add_volume(vid, DiskType::HardDrive, &VolumeSpec::default())
+            .unwrap();
+        let (_, v) = store.find_volume(vid).unwrap();
+        assert_eq!(
+            v.live_meta_idx_size_for_test().is_some(),
+            kind == NeedleMapKind::Redb
+        );
+        for i in 1..=6u64 {
+            write_test_needle(&mut store, vid, i, format!("data-{i}").as_bytes());
+        }
+        let mut del = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(2),
+            ..Needle::default()
+        };
+        store.delete_volume_needle(vid, &mut del).unwrap();
+        let revision = {
+            let (_, v) = store.find_volume(vid).unwrap();
+            v.super_block().compaction_revision
+        };
+
+        let job = store.begin_compact_volume(vid, 0).unwrap().unwrap();
+        let (entered_tx, entered_rx) = std::sync::mpsc::channel();
+        let (release_tx, release_rx) = std::sync::mpsc::channel::<()>();
+        let copy = std::thread::spawn(move || {
+            job.run(move |_| {
+                let _ = entered_tx.send(());
+                let _ = release_rx.recv();
+                true
+            })
+        });
+        entered_rx.recv().unwrap();
+
+        write_test_needle(&mut store, vid, 99, b"late-write");
+        write_test_needle(&mut store, vid, 3, b"overwritten");
+        let mut del = Needle {
+            id: NeedleId(4),
+            cookie: Cookie(4),
+            ..Needle::default()
+        };
+        store.delete_volume_needle(vid, &mut del).unwrap();
+
+        drop(release_tx);
+        copy.join().unwrap().unwrap();
+        store.commit_compact_volume(vid).unwrap();
+
+        let (_, v) = store.find_volume(vid).unwrap();
+        assert_eq!(v.super_block().compaction_revision, revision + 1);
+        assert_eq!(read_test_needle(&store, vid, 99).unwrap(), b"late-write");
+        assert_eq!(read_test_needle(&store, vid, 3).unwrap(), b"overwritten");
+        assert!(read_test_needle(&store, vid, 4).is_err());
+        assert!(read_test_needle(&store, vid, 2).is_err());
+        for i in [1u64, 5, 6] {
+            assert_eq!(
+                read_test_needle(&store, vid, i).unwrap(),
+                format!("data-{i}").as_bytes()
+            );
+        }
+    }
+
+    #[test]
+    fn test_writes_during_compaction_survive_commit_in_memory() {
+        check_writes_during_compaction_survive_commit(NeedleMapKind::InMemory);
+    }
+
+    #[test]
+    fn test_writes_during_compaction_survive_commit_redb() {
+        check_writes_during_compaction_survive_commit(NeedleMapKind::Redb);
+    }
+
     /// Build a Store with N HDD disk locations under a single TempDir.
     /// Returns the store and the TempDir guard so callers keep the dirs
     /// alive for the test's lifetime.
@@ -1737,7 +3103,7 @@ mod tests {
         let base = volume_file_name(&store.locations[2].idx_directory, collection, vid);
         std::fs::write(format!("{}.ecx", base), vec![0u8; 20]).unwrap();
 
-        let got = store.find_ec_shard_target_location(collection, vid, 10);
+        let got = store.find_ec_shard_target_location(collection, vid, 10, &[]);
         assert_eq!(
             got,
             Some(2),
@@ -1746,6 +3112,35 @@ mod tests {
         );
     }
 
+    /// A volume whose `.vif` declares a custom EC ratio must feed its own
+    /// data-shard count into the free-slot maths — not the build default —
+    /// wherever the `.vif` happens to sit. With no `.vif` anywhere (a
+    /// brand-new volume mid-ec.rebuild) the answer is the default.
+    #[test]
+    fn test_lookup_ec_data_shards_reads_vif_on_any_disk() {
+        use crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT;
+
+        let (store, _tmp) = make_ec_target_test_store(3);
+        let collection = "custom-ratio";
+        let vid = VolumeId(4242);
+
+        assert_eq!(
+            store.lookup_ec_data_shards(collection, vid),
+            DATA_SHARDS_COUNT as u32,
+            "no .vif anywhere must answer the default"
+        );
+
+        // A 6+2 .vif lands on disk 2 only — the rebuild staging disk.
+        let base = volume_file_name(&store.locations[2].directory, collection, vid);
+        std::fs::write(
+            format!("{}.vif", base),
+            br#"{"ecShardConfig":{"dataShards":6,"parityShards":2}}"#,
+        )
+        .unwrap();
+
+        assert_eq!(store.lookup_ec_data_shards(collection, vid), 6);
+    }
+
     /// Deleting a disk's last shard removes that disk's now-orphaned `.ecsum`;
     /// a disk this delete never changed keeps its sidecar. Disk 0 models
     /// ec.rebuild's index-prep state (`.ecsum` landed, no shards yet) — an
@@ -1764,13 +3159,13 @@ mod tests {
         std::fs::write(format!("{}.ecsum", base1), b"x").unwrap();
 
         // Disk 1 still has .ec01 afterwards: both sidecars survive.
-        store.delete_ec_shards(vid, collection, &[0]);
+        store.delete_ec_shards(vid, collection, &[0]).unwrap();
         assert!(std::path::Path::new(&format!("{}.ecsum", base0)).exists());
         assert!(std::path::Path::new(&format!("{}.ecsum", base1)).exists());
 
         // Disk 1's last shard goes: its sidecar is orphaned and removed, but
         // disk 0 was never touched by either delete and keeps its sidecar.
-        store.delete_ec_shards(vid, collection, &[1]);
+        store.delete_ec_shards(vid, collection, &[1]).unwrap();
         assert!(!std::path::Path::new(&format!("{}.ec01", base1)).exists());
         assert!(
             !std::path::Path::new(&format!("{}.ecsum", base1)).exists(),
@@ -1815,13 +3210,13 @@ mod tests {
         std::fs::write(format!("{}.ec01", base1), b"x").unwrap();
         std::fs::write(format!("{}.ecsum", idx_base), b"x").unwrap();
 
-        store.delete_ec_shards(vid, collection, &[0]);
+        store.delete_ec_shards(vid, collection, &[0]).unwrap();
         assert!(
             std::path::Path::new(&format!("{}.ecsum", idx_base)).exists(),
             "shared idx sidecar must survive while a sibling disk still has shards"
         );
 
-        store.delete_ec_shards(vid, collection, &[1]);
+        store.delete_ec_shards(vid, collection, &[1]).unwrap();
         assert!(
             !std::path::Path::new(&format!("{}.ecsum", idx_base)).exists(),
             "shared idx sidecar should go with the last location's last shard"
@@ -1844,7 +3239,7 @@ mod tests {
         std::fs::write(format!("{}.vif", base1), b"x").unwrap();
         std::fs::write(format!("{}.idx", base1), b"x").unwrap();
 
-        store.delete_ec_shards(vid, collection, &[0, 1]);
+        store.delete_ec_shards(vid, collection, &[0, 1]).unwrap();
 
         assert!(
             !std::path::Path::new(&format!("{}.vif", base0)).exists(),
@@ -1856,6 +3251,34 @@ mod tests {
         );
     }
 
+    /// Deleting a shard removes its staged 2PC generations (<name>.v<N>) too:
+    /// a shard evicted off a disk leaves nothing (Go
+    /// deleteEcShardIdsForEachLocation).
+    #[test]
+    fn test_delete_ec_shards_removes_staged_generations() {
+        let (mut store, _tmp) = make_ec_target_test_store(1);
+        let collection = "c";
+        let vid = VolumeId(7);
+        let base = volume_file_name(&store.locations[0].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", base), b"x").unwrap();
+        std::fs::write(format!("{}.ec05", base), b"x").unwrap();
+        std::fs::write(format!("{}.ec05.v2", base), b"x").unwrap();
+        std::fs::write(format!("{}.ecx", base), b"x").unwrap();
+
+        store.delete_ec_shards(vid, collection, &[5]).unwrap();
+
+        assert!(!std::path::Path::new(&format!("{}.ec05", base)).exists());
+        assert!(
+            !std::path::Path::new(&format!("{}.ec05.v2", base)).exists(),
+            "staged generations of a deleted shard must go with it"
+        );
+        assert!(std::path::Path::new(&format!("{}.ec00", base)).exists());
+        assert!(
+            std::path::Path::new(&format!("{}.ecx", base)).exists(),
+            "index must survive while shards remain"
+        );
+    }
+
     /// An already-mounted EC volume on disk 1 must win over a stray
     /// `.ecx` on disk 2. Protects the post-startup steady state from
     /// being perturbed by leftover index files from a prior failed move.
@@ -1867,10 +3290,21 @@ mod tests {
 
         // Mount an EC shard on disk 1 so has_ec_volume returns true.
         std::fs::write(
-            format!("{}/{}_{}.ec00", store.locations[1].directory, collection, vid.0),
+            format!(
+                "{}/{}_{}.ec00",
+                store.locations[1].directory, collection, vid.0
+            ),
             b"shard data",
         )
         .unwrap();
+        std::fs::write(
+            format!(
+                "{}/{}_{}.ecx",
+                store.locations[1].directory, collection, vid.0
+            ),
+            vec![0u8; 20],
+        )
+        .unwrap();
         store.locations[1]
             .mount_ec_shards(vid, collection, &[0], "")
             .unwrap();
@@ -1879,8 +3313,13 @@ mod tests {
         let base = volume_file_name(&store.locations[2].idx_directory, collection, vid);
         std::fs::write(format!("{}.ecx", base), vec![0u8; 20]).unwrap();
 
-        let got = store.find_ec_shard_target_location(collection, vid, 10);
-        assert_eq!(got, Some(1), "expected the mounted disk to win; got {:?}", got);
+        let got = store.find_ec_shard_target_location(collection, vid, 10, &[]);
+        assert_eq!(
+            got,
+            Some(1),
+            "expected the mounted disk to win; got {:?}",
+            got
+        );
     }
 
     /// Cold-volume case: no mount, no `.ecx` anywhere on this server.
@@ -1888,7 +3327,7 @@ mod tests {
     #[test]
     fn test_find_ec_shard_target_location_falls_through_to_hdd_when_nothing_matches() {
         let (store, _tmp) = make_ec_target_test_store(2);
-        let got = store.find_ec_shard_target_location("grafana-loki", VolumeId(3333), 10);
+        let got = store.find_ec_shard_target_location("grafana-loki", VolumeId(3333), 10, &[]);
         assert!(got.is_some(), "expected an HDD fallback");
         assert_eq!(store.locations[got.unwrap()].disk_type, DiskType::HardDrive);
     }
@@ -1904,7 +3343,7 @@ mod tests {
             .max_volume_count
             .store(0, Ordering::Relaxed);
 
-        let got = store.find_ec_shard_target_location("grafana-loki", VolumeId(4444), 10);
+        let got = store.find_ec_shard_target_location("grafana-loki", VolumeId(4444), 10, &[]);
         assert_eq!(
             got,
             Some(0),
@@ -1934,15 +3373,26 @@ mod tests {
         // free shard slots remaining; the old formula would have
         // rounded that to 0.
         std::fs::write(
-            format!("{}/{}_{}.ec00", store.locations[1].directory, collection, vid.0),
+            format!(
+                "{}/{}_{}.ec00",
+                store.locations[1].directory, collection, vid.0
+            ),
             b"shard data",
         )
         .unwrap();
+        std::fs::write(
+            format!(
+                "{}/{}_{}.ecx",
+                store.locations[1].directory, collection, vid.0
+            ),
+            vec![0u8; 20],
+        )
+        .unwrap();
         store.locations[1]
             .mount_ec_shards(vid, collection, &[0], "")
             .unwrap();
 
-        let got = store.find_ec_shard_target_location(collection, vid, 10);
+        let got = store.find_ec_shard_target_location(collection, vid, 10, &[]);
         assert_eq!(
             got,
             Some(1),
@@ -1950,4 +3400,236 @@ mod tests {
             got,
         );
     }
+
+    /// Per-server invariant: a shard id is owned by at most one disk.
+    ///
+    /// A multi-disk server legitimately mounts one vid on several disks, each
+    /// holding a disjoint subset of the shards, so the mounted tier ties and
+    /// the free-count tie-break decides — and it points at whichever disk
+    /// happens to be emptier, not at the disk that already has this shard. A
+    /// re-copy of a shard the server already holds (a retried `ec.balance` /
+    /// `ec.rebuild` move) then lands a second copy on the sibling disk, and
+    /// both disks register the same shard id.
+    #[test]
+    fn test_find_ec_shard_target_location_pins_to_the_disk_owning_the_shard() {
+        let (mut store, _tmp) = make_ec_target_test_store(2);
+        let collection = "grafana-loki";
+        let vid = VolumeId(8888);
+
+        // Disk 0 owns shards 0 and 1, disk 1 owns shard 2 — so disk 1 is the
+        // emptier of the two and wins the free-count tie-break.
+        let base0 = volume_file_name(&store.locations[0].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", base0), b"x").unwrap();
+        std::fs::write(format!("{}.ec01", base0), b"x").unwrap();
+        std::fs::write(format!("{}.ecx", base0), vec![0u8; 20]).unwrap();
+        store.locations[0]
+            .mount_ec_shards(vid, collection, &[0, 1], "")
+            .unwrap();
+
+        let base1 = volume_file_name(&store.locations[1].directory, collection, vid);
+        std::fs::write(format!("{}.ec02", base1), b"x").unwrap();
+        std::fs::write(format!("{}.ecx", base1), vec![0u8; 20]).unwrap();
+        store.locations[1]
+            .mount_ec_shards(vid, collection, &[2], "")
+            .unwrap();
+
+        assert_eq!(
+            store.find_ec_shard_target_location(collection, vid, 10, &[0]),
+            Some(0),
+            "a copy of shard 0 left its owning disk",
+        );
+        assert_eq!(
+            store.find_ec_shard_target_location(collection, vid, 10, &[2]),
+            Some(1),
+            "a copy of shard 2 left its owning disk",
+        );
+        // A shard no disk owns yet is placed by the unchanged waterfall: both
+        // disks have it mounted, so the emptier one wins.
+        assert_eq!(
+            store.find_ec_shard_target_location(collection, vid, 10, &[7]),
+            Some(1),
+            "placement of an unclaimed shard changed",
+        );
+    }
+
+    /// The second half of the invariant: a disk with no free shard slots
+    /// still wins for a shard it already owns. Re-copying that shard
+    /// overwrites bytes the disk is already accounted for, while routing to a
+    /// sibling splits the claim across two disks.
+    #[test]
+    fn test_find_ec_shard_target_location_owning_disk_wins_when_full() {
+        let (mut store, _tmp) = make_ec_target_test_store(2);
+        store.locations[0]
+            .max_volume_count
+            .store(1, Ordering::Relaxed);
+
+        let collection = "grafana-loki";
+        let vid = VolumeId(9999);
+
+        let base = volume_file_name(&store.locations[0].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", base), b"x").unwrap();
+        std::fs::write(format!("{}.ecx", base), vec![0u8; 20]).unwrap();
+        store.locations[0]
+            .mount_ec_shards(vid, collection, &[0], "")
+            .unwrap();
+
+        // Fill disk 0 past its shard-slot budget so ec_free_shard_count is 0.
+        let filler = VolumeId(10000);
+        let filler_base = volume_file_name(&store.locations[0].directory, collection, filler);
+        let filler_shards: Vec<ShardId> = (0..10).collect();
+        for shard_id in &filler_shards {
+            std::fs::write(format!("{}.ec{:02}", filler_base, shard_id), b"x").unwrap();
+        }
+        std::fs::write(format!("{}.ecx", filler_base), vec![0u8; 20]).unwrap();
+        store.locations[0]
+            .mount_ec_shards(filler, collection, &filler_shards, "")
+            .unwrap();
+
+        assert_eq!(
+            store.find_ec_shard_target_location(collection, vid, 10, &[0]),
+            Some(0),
+            "a copy of shard 0 left its owning disk when the disk was full",
+        );
+        // A shard it does not own still respects the space filter.
+        assert_eq!(
+            store.find_ec_shard_target_location(collection, vid, 10, &[7]),
+            Some(1),
+            "an unclaimed shard should go to the disk with free slots",
+        );
+    }
+
+    /// Per-shard `VolumeEcShardsMount` with no `.ecx` on any local disk must
+    /// fail (Go: "no .ecx index found on any local disk") rather than register
+    /// a volume whose every read dies with "ecx file not open".
+    #[test]
+    fn test_mount_ec_shard_without_ecx_fails_and_advertises_nothing() {
+        let (mut store, _tmp) = make_ec_target_test_store(2);
+        let collection = "grafana-loki";
+        let vid = VolumeId(12121);
+        let base = volume_file_name(&store.locations[1].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", base), b"x").unwrap();
+
+        let err = store
+            .mount_ec_shard(vid, collection, 0, "")
+            .expect_err("a shard without an index must not mount");
+        assert!(
+            matches!(&err, VolumeError::Io(e) if e.kind() == io::ErrorKind::NotFound),
+            "got {:?}",
+            err
+        );
+        assert!(store.find_ec_volume(vid).is_none());
+    }
+
+    /// An interrupted move can leave a 0-byte shard on one disk and the good
+    /// copy on the next. The first disk's failure must not end the scan (Go's
+    /// MountEcShards keeps going), and nothing of the failed attempt may stay
+    /// registered.
+    #[test]
+    fn test_mount_ec_shard_continues_past_a_disk_that_cannot_mount() {
+        let (mut store, _tmp) = make_ec_target_test_store(2);
+        let collection = "grafana-loki";
+        let vid = VolumeId(13132);
+        for loc in &store.locations {
+            let base = volume_file_name(&loc.directory, collection, vid);
+            std::fs::write(format!("{}.ecx", base), vec![0u8; 20]).unwrap();
+        }
+        let bad = volume_file_name(&store.locations[0].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", bad), b"").unwrap();
+        let good = volume_file_name(&store.locations[1].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", good), b"x").unwrap();
+
+        store.mount_ec_shard(vid, collection, 0, "").unwrap();
+
+        assert!(store.locations[0].find_ec_volume(vid).is_none());
+        assert!(store.locations[1].find_ec_volume(vid).unwrap().has_shard(0));
+    }
+
+    /// When every disk holding the shard fails, the error names each of them.
+    #[test]
+    fn test_mount_ec_shard_reports_every_failing_disk() {
+        let (mut store, _tmp) = make_ec_target_test_store(2);
+        let collection = "grafana-loki";
+        let vid = VolumeId(13133);
+        for loc in &store.locations {
+            let base = volume_file_name(&loc.directory, collection, vid);
+            std::fs::write(format!("{}.ecx", base), vec![0u8; 20]).unwrap();
+            std::fs::write(format!("{}.ec00", base), b"").unwrap();
+        }
+
+        let err = store
+            .mount_ec_shard(vid, collection, 0, "")
+            .unwrap_err()
+            .to_string();
+
+        for loc in &store.locations {
+            assert!(
+                err.contains(&loc.directory),
+                "{} missing from: {}",
+                loc.directory,
+                err
+            );
+            assert!(loc.find_ec_volume(vid).is_none());
+        }
+    }
+
+    /// The `.ecx` may sit on a sibling disk of the one holding the shard; the
+    /// per-shard mount routes EcVolume::new at the owner's directory, skipping
+    /// a 0-byte stub on the way (Go's findEcxIdxDirForVolume).
+    #[test]
+    fn test_mount_ec_shard_uses_valid_ecx_on_sibling_disk() {
+        let (mut store, _tmp) = make_ec_target_test_store(3);
+        let collection = "grafana-loki";
+        let vid = VolumeId(13131);
+        let stub = volume_file_name(&store.locations[0].directory, collection, vid);
+        std::fs::write(format!("{}.ecx", stub), b"").unwrap();
+        let owner_dir = store.locations[1].directory.clone();
+        let owner = volume_file_name(&owner_dir, collection, vid);
+        std::fs::write(format!("{}.ecx", owner), vec![0u8; 20]).unwrap();
+        let shard = volume_file_name(&store.locations[2].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", shard), b"x").unwrap();
+
+        // The stub is not a location for the batch path either.
+        assert_eq!(store.find_ec_location(vid, collection), Some(1));
+
+        store.mount_ec_shard(vid, collection, 0, "").unwrap();
+        let ec_vol = store.locations[2]
+            .find_ec_volume(vid)
+            .expect("mounted on the shard's disk");
+        assert_eq!(ec_vol.ecx_actual_dir(), owner_dir);
+    }
+
+    /// Mixed-owner batch contract: a batch whose requested shards are
+    /// already owned by different disks reports every owner, so
+    /// `volume_ec_shards_copy` can refuse it rather than rank the owners
+    /// into one destination and duplicate the loser's claim.
+    #[test]
+    fn test_ec_shard_owner_disks() {
+        let (mut store, _tmp) = make_ec_target_test_store(3);
+        let collection = "grafana-loki";
+        let vid = VolumeId(11111);
+
+        let base0 = volume_file_name(&store.locations[0].directory, collection, vid);
+        std::fs::write(format!("{}.ec00", base0), b"x").unwrap();
+        std::fs::write(format!("{}.ec01", base0), b"x").unwrap();
+        std::fs::write(format!("{}.ecx", base0), vec![0u8; 20]).unwrap();
+        store.locations[0]
+            .mount_ec_shards(vid, collection, &[0, 1], "")
+            .unwrap();
+        let base1 = volume_file_name(&store.locations[1].directory, collection, vid);
+        std::fs::write(format!("{}.ec02", base1), b"x").unwrap();
+        std::fs::write(format!("{}.ecx", base1), vec![0u8; 20]).unwrap();
+        store.locations[1]
+            .mount_ec_shards(vid, collection, &[2], "")
+            .unwrap();
+
+        assert_eq!(
+            store.ec_shard_owner_disks(vid, &[0, 2]),
+            vec![0, 1],
+            "a batch owned by two disks must report both owners",
+        );
+        // A batch on one disk, with or without unowned extras, has one owner.
+        assert_eq!(store.ec_shard_owner_disks(vid, &[0, 1, 7]), vec![0]);
+        // A wholly unowned batch reports none — fresh placement stays allowed.
+        assert!(store.ec_shard_owner_disks(vid, &[7, 8]).is_empty());
+    }
 }
diff --git a/seaweed-volume/src/storage/store_ec_journal.rs b/seaweed-volume/src/storage/store_ec_journal.rs
new file mode 100644
index 0000000000..6912a5dfa3
--- /dev/null
+++ b/seaweed-volume/src/storage/store_ec_journal.rs
@@ -0,0 +1,374 @@
+//! Merging a peer's `.ecj` deletion ids into a local EC journal. Mirrors Go's
+//! `Store.MergeEcJournal` (`weed/storage/store_ec_journal.go`).
+
+use std::collections::HashSet;
+use std::io;
+use std::path::Path;
+use std::sync::RwLock;
+
+use crate::storage::erasure_coding::ecj_merge::{append_ecj_ids, read_ecj_ids};
+use crate::storage::store::Store;
+use crate::storage::types::{NeedleId, VolumeId};
+
+/// How often an unmounted merge re-reads a journal that changed under it. Only
+/// a mount-delete-unmount or a concurrent merge between the read and the
+/// append changes it, so one retry is nearly always enough.
+const ECJ_MERGE_ATTEMPTS: usize = 5;
+
+/// Fold a peer's deletion `ids` into the local journal of EC volume `vid` on
+/// the receiving disk, the one whose data directory is `data_dir`; `ecj_path`
+/// is that journal's path in the disk's index directory. Appends only the ids
+/// the journal lacks and returns how many it added. Blocking: call it from
+/// `spawn_blocking`.
+///
+/// A mounted volume owns its journal: the merge goes through its open handle
+/// and in-memory set. That is the receiving disk's own runtime for `vid`,
+/// wherever its journal lives (it may sit in the data dir rather than
+/// `ecj_path`'s index dir), else a sibling runtime journaling into `ecj_path`
+/// itself: disks sharing one index directory, or reconciliation mounting `vid`
+/// on a disk that journals into another's (#9212). Otherwise `ecj_path` is
+/// appended to under the store write lock, which mounts take, so no mount can
+/// open it mid-append. The read that computes the delta runs outside the lock,
+/// and a journal that changed in between — including by a concurrent merge —
+/// is re-read.
+pub fn merge_ec_journal(
+    store: &RwLock<Store>,
+    vid: VolumeId,
+    data_dir: &str,
+    ecj_path: &str,
+    ids: &HashSet<NeedleId>,
+) -> io::Result<usize> {
+    merge_ec_journal_with(store, vid, data_dir, ecj_path, ids, read_ecj_ids)
+}
+
+/// `merge_ec_journal` with the unlocked journal read injected, so a test can
+/// mount the volume between that read and the append.
+fn merge_ec_journal_with(
+    store: &RwLock<Store>,
+    vid: VolumeId,
+    data_dir: &str,
+    ecj_path: &str,
+    ids: &HashSet<NeedleId>,
+    mut read: impl FnMut(&str) -> io::Result<(HashSet<NeedleId>, u64)>,
+) -> io::Result<usize> {
+    for _ in 0..ECJ_MERGE_ATTEMPTS {
+        {
+            let mut store = store
+                .write()
+                .map_err(|_| io::Error::other("store lock poisoned"))?;
+            if let Some(primary) = mounted_ec_journal(&store, vid, data_dir, ecj_path)? {
+                let ecv = store.locations[primary]
+                    .find_ec_volume_mut(vid)
+                    .expect("mounted journal runtime");
+                let journal_path = ecv.ecj_file_name();
+                let added = ecv.merge_journal(ids)?;
+                // Publish to the holders of the file the merge wrote to — the
+                // picked runtime's journal may live outside ecj_path, and a
+                // holder of a different file must not claim ids it lacks.
+                publish_to_journal_siblings(&store, primary, vid, &journal_path, ids);
+                return Ok(added);
+            }
+        }
+        let (local, size) = read(ecj_path)?;
+        let mut store = store
+            .write()
+            .map_err(|_| io::Error::other("store lock poisoned"))?;
+        if let Some(primary) = mounted_ec_journal(&store, vid, data_dir, ecj_path)? {
+            // Mounted since the read: its handle owns the journal now.
+            let ecv = store.locations[primary]
+                .find_ec_volume_mut(vid)
+                .expect("mounted journal runtime");
+            let journal_path = ecv.ecj_file_name();
+            let added = ecv.merge_journal(ids)?;
+            publish_to_journal_siblings(&store, primary, vid, &journal_path, ids);
+            return Ok(added);
+        }
+        // The path append registers as a writer so a mount compacting this
+        // journal cannot swap its inode underneath it (the write itself is
+        // already serialized with mounts by the store lock).
+        let _ecj_write =
+            crate::storage::erasure_coding::ecj_registry::begin_ecj_write(ecj_path);
+        if let Some(added) = append_ecj_ids(ecj_path, &local, ids, size)? {
+            return Ok(added);
+        }
+    }
+    Err(io::Error::other(format!(
+        "ec volume {}: journal {} kept changing during merge",
+        vid.0, ecj_path
+    )))
+}
+
+/// The disk index of the runtime holding `ecj_path` open, if any: the disk at
+/// `data_dir`'s own, else the first sibling journaling into it.
+fn mounted_ec_journal(
+    store: &Store,
+    vid: VolumeId,
+    data_dir: &str,
+    ecj_path: &str,
+) -> io::Result<Option<usize>> {
+    let owner = store
+        .locations
+        .iter()
+        .position(|loc| Path::new(&loc.directory) == Path::new(data_dir))
+        .ok_or_else(|| {
+            io::Error::other(format!(
+                "ec volume {}: no disk at {} owns journal {}",
+                vid.0, data_dir, ecj_path
+            ))
+        })?;
+    let runtime = if store.locations[owner].has_ec_volume(vid) {
+        Some(owner)
+    } else {
+        store.locations.iter().position(|loc| {
+            loc.find_ec_volume(vid)
+                .is_some_and(|ecv| Path::new(&ecv.ecj_file_name()) == Path::new(ecj_path))
+        })
+    };
+    Ok(runtime)
+}
+
+/// Publishes merged ids into every other runtime journaling into `ecj_path`.
+fn publish_to_journal_siblings(
+    store: &Store,
+    primary: usize,
+    vid: VolumeId,
+    ecj_path: &str,
+    ids: &HashSet<NeedleId>,
+) {
+    for (i, loc) in store.locations.iter().enumerate() {
+        if i == primary {
+            continue;
+        }
+        if let Some(ecv) = loc.find_ec_volume(vid) {
+            if Path::new(&ecv.ecj_file_name()) == Path::new(ecj_path) {
+                ecv.publish_merged_ids(ids);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::MinFreeSpace;
+    use crate::storage::needle_map::NeedleMapKind;
+    use crate::storage::types::DiskType;
+    use crate::storage::volume::{VifEcShardConfig, VifVolumeInfo};
+    use tempfile::TempDir;
+
+    const COLLECTION: &str = "c";
+    const VID: VolumeId = VolumeId(9);
+
+    /// A store with one disk per entry of `data`, all sharing `idx` when given,
+    /// else each indexing into its own data dir.
+    fn make_store(tmp: &TempDir, data: &[&str], idx: Option<&str>) -> RwLock<Store> {
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        for d in data {
+            let dir = tmp.path().join(d).to_string_lossy().into_owned();
+            let idx_dir = idx
+                .map(|i| tmp.path().join(i).to_string_lossy().into_owned())
+                .unwrap_or_else(|| dir.clone());
+            std::fs::create_dir_all(&dir).unwrap();
+            std::fs::create_dir_all(&idx_dir).unwrap();
+            store
+                .add_location(
+                    &dir,
+                    &idx_dir,
+                    100,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(0.0),
+                    Vec::new(),
+                )
+                .unwrap();
+        }
+        RwLock::new(store)
+    }
+
+    fn dir(tmp: &TempDir, d: &str) -> String {
+        tmp.path().join(d).to_string_lossy().into_owned()
+    }
+
+    fn records(ids: &[u64]) -> Vec<u8> {
+        let ids: Vec<NeedleId> = ids.iter().copied().map(NeedleId).collect();
+        crate::storage::erasure_coding::ecj_merge::encode_ecj_ids(&ids)
+    }
+
+    fn id_set(ids: &[u64]) -> HashSet<NeedleId> {
+        ids.iter().copied().map(NeedleId).collect()
+    }
+
+    /// Shard 0 of `VID` and its `.vif` in `data_dir`.
+    fn write_shard0(data_dir: &str) {
+        let base = format!("{}/{}_{}", data_dir, COLLECTION, VID.0);
+        std::fs::write(format!("{}.ec00", base), b"shard data nonempty").unwrap();
+        let vif = VifVolumeInfo {
+            version: 3,
+            ec_shard_config: Some(VifEcShardConfig {
+                data_shards: 10,
+                parity_shards: 4,
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+        std::fs::write(
+            format!("{}.vif", base),
+            serde_json::to_string(&vif).unwrap(),
+        )
+        .unwrap();
+    }
+
+    /// `VID`'s `.ecx` and a `.ecj` holding `deleted` in `dir`; returns the
+    /// journal path.
+    fn write_index(dir: &str, deleted: &[u64]) -> String {
+        let base = format!("{}/{}_{}", dir, COLLECTION, VID.0);
+        std::fs::write(format!("{}.ecx", base), vec![0u8; 16]).unwrap();
+        let ecj = format!("{}.ecj", base);
+        std::fs::write(&ecj, records(deleted)).unwrap();
+        ecj
+    }
+
+    fn deleted_on(store: &RwLock<Store>, disk: usize, id: u64) -> bool {
+        store.read().unwrap().locations[disk]
+            .find_ec_volume(VID)
+            .expect("mounted")
+            .is_needle_deleted(NeedleId(id))
+    }
+
+    /// Disks sharing one index directory all hold the same journal path.
+    /// Copying shards onto a disk that has not mounted `vid` must still reach
+    /// the sibling runtime holding that journal open.
+    #[test]
+    fn shared_index_dir_reaches_sibling_mount() {
+        let tmp = TempDir::new().unwrap();
+        let store = make_store(&tmp, &["d0", "d1"], Some("idx"));
+        write_shard0(&dir(&tmp, "d0"));
+        let ecj = write_index(&dir(&tmp, "idx"), &[1]);
+        store.write().unwrap().locations[0]
+            .mount_ec_shards(VID, COLLECTION, &[0], "")
+            .unwrap();
+        assert_eq!(
+            store.read().unwrap().locations[0]
+                .find_ec_volume(VID)
+                .unwrap()
+                .ecj_file_name(),
+            ecj
+        );
+
+        let added =
+            merge_ec_journal(&store, VID, &dir(&tmp, "d1"), &ecj, &id_set(&[1, 2])).unwrap();
+        assert_eq!(added, 1);
+        assert!(
+            deleted_on(&store, 0, 2),
+            "the mounted sibling must see id 2"
+        );
+        assert_eq!(std::fs::read(&ecj).unwrap(), records(&[1, 2]));
+    }
+
+    /// Every runtime holding the journal open must see merged ids in memory.
+    #[test]
+    fn shared_journal_reaches_every_holder() {
+        let tmp = TempDir::new().unwrap();
+        let store = make_store(&tmp, &["d0", "d1"], Some("idx"));
+        write_shard0(&dir(&tmp, "d0"));
+        write_shard0(&dir(&tmp, "d1"));
+        let ecj = write_index(&dir(&tmp, "idx"), &[1]);
+        for i in 0..2 {
+            store.write().unwrap().locations[i]
+                .mount_ec_shards(VID, COLLECTION, &[0], "")
+                .unwrap();
+        }
+
+        let added =
+            merge_ec_journal(&store, VID, &dir(&tmp, "d1"), &ecj, &id_set(&[1, 2])).unwrap();
+        assert_eq!(added, 1);
+        assert!(
+            deleted_on(&store, 0, 2) && deleted_on(&store, 1, 2),
+            "every journal holder must see the merged id"
+        );
+        assert_eq!(std::fs::read(&ecj).unwrap(), records(&[1, 2]));
+    }
+
+    /// The picked runtime may journal to a different file than the copied
+    /// one — its index lives in its data directory while a sibling's lives
+    /// in the index directory. The ids must be published only to holders of
+    /// the file they were written to.
+    #[test]
+    fn publishes_to_actual_journal_holders() {
+        let tmp = TempDir::new().unwrap();
+        let store = make_store(&tmp, &["d0", "d1"], Some("idx"));
+        write_shard0(&dir(&tmp, "d0"));
+        write_shard0(&dir(&tmp, "d1"));
+        let data_ecj = write_index(&dir(&tmp, "d0"), &[1]);
+        let idx_ecj = write_index(&dir(&tmp, "idx"), &[1]);
+        for i in 0..2 {
+            store.write().unwrap().locations[i]
+                .mount_ec_shards(VID, COLLECTION, &[0], "")
+                .unwrap();
+        }
+        assert_eq!(
+            store.read().unwrap().locations[0]
+                .find_ec_volume(VID)
+                .unwrap()
+                .ecj_file_name(),
+            data_ecj
+        );
+
+        let added =
+            merge_ec_journal(&store, VID, &dir(&tmp, "d0"), &idx_ecj, &id_set(&[1, 2])).unwrap();
+        assert_eq!(added, 1);
+        assert_eq!(std::fs::read(&data_ecj).unwrap(), records(&[1, 2]));
+        assert_eq!(std::fs::read(&idx_ecj).unwrap(), records(&[1]));
+        assert!(deleted_on(&store, 0, 2));
+        assert!(
+            !deleted_on(&store, 1, 2),
+            "a different journal's holder must not claim the merged id"
+        );
+    }
+
+    /// A sibling disk can mount `vid` from the receiving disk's index (#9212)
+    /// while the merge reads the journal unlocked. The merge must go through
+    /// that mount and report what it added.
+    #[test]
+    fn mount_during_read_is_merged_through_and_counted() {
+        let tmp = TempDir::new().unwrap();
+        let store = make_store(&tmp, &["d0", "d1"], None);
+        let owner = dir(&tmp, "d0");
+        let ecj = write_index(&owner, &[1]);
+        write_shard0(&dir(&tmp, "d1"));
+
+        let mut mounted = false;
+        let read = |path: &str| {
+            let read = read_ecj_ids(path);
+            if !mounted {
+                store.write().unwrap().locations[1]
+                    .mount_ec_shards_with_idx_dir(VID, COLLECTION, &[0], &owner, "")
+                    .unwrap();
+                mounted = true;
+            }
+            read
+        };
+        let added =
+            merge_ec_journal_with(&store, VID, &owner, &ecj, &id_set(&[1, 2, 3]), read).unwrap();
+        assert_eq!(added, 2, "the ids merged through the new mount are counted");
+        assert!(deleted_on(&store, 1, 2) && deleted_on(&store, 1, 3));
+        assert_eq!(std::fs::read(&ecj).unwrap(), records(&[1, 2, 3]));
+    }
+
+    /// An unmounted journal is merged on disk and a repeat adds nothing; a
+    /// data dir that is no disk is refused.
+    #[test]
+    fn unmounted_journal_is_idempotent() {
+        let tmp = TempDir::new().unwrap();
+        let store = make_store(&tmp, &["d0"], Some("idx"));
+        let ecj = write_index(&dir(&tmp, "idx"), &[1, 2]);
+        let d0 = dir(&tmp, "d0");
+        for want in [2, 0, 0] {
+            let added = merge_ec_journal(&store, VID, &d0, &ecj, &id_set(&[2, 3, 4])).unwrap();
+            assert_eq!(added, want);
+        }
+        assert_eq!(std::fs::read(&ecj).unwrap(), records(&[1, 2, 3, 4]));
+        assert!(
+            merge_ec_journal(&store, VID, &dir(&tmp, "elsewhere"), &ecj, &id_set(&[1])).is_err()
+        );
+    }
+}
diff --git a/seaweed-volume/src/storage/store_ec_mirror.rs b/seaweed-volume/src/storage/store_ec_mirror.rs
index 77b3af56c0..95ae9df89f 100644
--- a/seaweed-volume/src/storage/store_ec_mirror.rs
+++ b/seaweed-volume/src/storage/store_ec_mirror.rs
@@ -8,7 +8,7 @@ use std::path::Path;
 
 use tracing::{info, warn};
 
-use crate::storage::disk_location::{parse_collection_volume_id_pub, DiskLocation};
+use crate::storage::disk_location::{DiskLocation, parse_collection_volume_id_pub};
 use crate::storage::store::Store;
 use crate::storage::types::VolumeId;
 
@@ -131,6 +131,12 @@ impl Store {
                     let Some(base) = name.strip_suffix(".ecx") else {
                         continue;
                     };
+                    // A 0-byte .ecx is a corrupt stub from a failed copy, not a
+                    // credible owner — skip it so the scan keeps looking for a
+                    // real index on a sibling disk (Go's indexEcxOwners).
+                    if !ent.metadata().is_ok_and(|m| m.len() > 0) {
+                        continue;
+                    }
                     let Some((collection, vid)) = parse_collection_volume_id_pub(base) else {
                         continue;
                     };
@@ -286,9 +292,7 @@ fn collect_shard_disk_volumes(loc: &DiskLocation) -> HashMap<EcKey, Vec<String>>
         let Some((collection, vid)) = parse_collection_volume_id_pub(base) else {
             continue;
         };
-        out.entry(EcKey { collection, vid })
-            .or_default()
-            .push(name);
+        out.entry(EcKey { collection, vid }).or_default().push(name);
     }
     out
 }
@@ -419,4 +423,33 @@ mod tests {
         let post = fs::read(dir0.join(format!("{}_{}.ecx", collection, vid))).unwrap();
         assert_eq!(post, ecx_local, "mirror overwrote dir0's existing .ecx");
     }
+
+    /// The mirror shares Go's indexEcxOwners, which skips a 0-byte `.ecx`:
+    /// a stub must not be chosen as the source to mirror from.
+    #[test]
+    fn mirror_owner_index_skips_zero_byte_ecx() {
+        let tmp = TempDir::new().unwrap();
+        let dir0 = tmp.path().join("data0");
+        let dir1 = tmp.path().join("data1");
+        fs::create_dir_all(&dir0).unwrap();
+        fs::create_dir_all(&dir1).unwrap();
+
+        let collection = "video-recordings";
+        let vid = 4123u32;
+        plant_ecx(&dir0, collection, vid, b"");
+        plant_ecx(&dir1, collection, vid, &[0xA1u8; 20]);
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        add_loc(&mut store, &dir0);
+        add_loc(&mut store, &dir1);
+
+        let owners = store.index_ecx_owners_for_mirror();
+        let owner = owners
+            .get(&EcKey {
+                collection: collection.to_string(),
+                vid: VolumeId(vid),
+            })
+            .expect("the valid .ecx on disk 1 must be indexed");
+        assert_eq!(owner.location, 1);
+    }
 }
diff --git a/seaweed-volume/src/storage/store_ec_reconcile.rs b/seaweed-volume/src/storage/store_ec_reconcile.rs
index cfc27c7cd1..0c81e42443 100644
--- a/seaweed-volume/src/storage/store_ec_reconcile.rs
+++ b/seaweed-volume/src/storage/store_ec_reconcile.rs
@@ -21,7 +21,7 @@ use std::fs;
 use tracing::{error, info, warn};
 
 use crate::storage::disk_location::{is_ec_shard_extension, parse_collection_volume_id_pub};
-use crate::storage::erasure_coding::ec_shard::DATA_SHARDS_COUNT;
+use crate::storage::erasure_coding::ec_shard::{DATA_SHARDS_COUNT, ShardId};
 use crate::storage::store::Store;
 use crate::storage::types::VolumeId;
 
@@ -37,6 +37,7 @@ pub(crate) struct EcVolumeMissingIndex {
     pub data_dir: String,
 }
 
+#[cfg(test)]
 pub(crate) fn ec_local_ecx_path(dir: &str, collection: &str, vid: VolumeId) -> String {
     if collection.is_empty() {
         format!("{}/{}.ecx", dir, vid.0)
@@ -80,6 +81,11 @@ struct EcxOwnerInfo {
     idx_dir: String,
 }
 
+/// One unit of reconcile work: the disk holding orphan shards, the volume
+/// they belong to, the shard files, the `.ecx` owner, and whether the
+/// mirror already installed sidecars locally (`use_local_idx`).
+type OrphanShardLoad = (usize, EcKey, Vec<(String, ShardId)>, EcxOwnerInfo, bool);
+
 impl Store {
     /// Run cross-disk orphan-shard reconciliation. Should be called
     /// after every DiskLocation has finished its per-disk EC scan.
@@ -98,7 +104,7 @@ impl Store {
         // `use_local_idx` is the post-mirror fast path: when the
         // mirror already installed sidecars locally, mount against
         // loc.idx_directory instead of the owner disk.
-        let mut to_load: Vec<(usize, EcKey, Vec<(String, u32)>, EcxOwnerInfo, bool)> = Vec::new();
+        let mut to_load: Vec<OrphanShardLoad> = Vec::new();
         for (loc_idx, loc) in self.locations.iter().enumerate() {
             let orphans = collect_orphan_ec_shards(loc, loc_idx);
             for (key, shards) in orphans {
@@ -112,14 +118,11 @@ impl Store {
                     );
                     continue;
                 };
-                let local_ecx = ec_local_ecx_path(&loc.idx_directory, &key.collection, key.vid);
-                let local_ecx_in_data = ec_local_ecx_path(&loc.directory, &key.collection, key.vid);
-                let use_local_idx = std::path::Path::new(&local_ecx).exists()
-                    || std::path::Path::new(&local_ecx_in_data).exists();
+                // A 0-byte local stub is not a mirrored index (Go gates this fast
+                // path on HasEcxFileOnDisk); mount against the owner instead.
+                let use_local_idx = loc.has_ecx_file_on_disk(&key.collection, key.vid);
 
-                if !use_local_idx
-                    && owner.location == loc_idx
-                    && owner.idx_dir == loc.idx_directory
+                if !use_local_idx && owner.location == loc_idx && owner.idx_dir == loc.idx_directory
                 {
                     // Same-disk no-op: load_all_ec_shards already
                     // tried and logged the failure.
@@ -132,7 +135,7 @@ impl Store {
         for (loc_idx, key, shards, owner, use_local_idx) in to_load {
             let shard_names: Vec<&str> = shards.iter().map(|(n, _)| n.as_str()).collect();
             let loc_dir = self.locations[loc_idx].directory.clone();
-            let shard_ids: Vec<u32> = shards.iter().map(|(_, sid)| *sid).collect();
+            let shard_ids: Vec<ShardId> = shards.iter().map(|(_, sid)| *sid).collect();
 
             if use_local_idx {
                 info!(
@@ -293,10 +296,10 @@ impl Store {
                 // may be sole copies of a distributed volume.
                 let mut node_wide_bits = ev.shard_bits().0;
                 for other in &self.locations {
-                    if let Some(other_ev) = other.find_ec_volume(*vid) {
-                        if other_ev.collection == ev.collection {
-                            node_wide_bits |= other_ev.shard_bits().0;
-                        }
+                    if let Some(other_ev) = other.find_ec_volume(*vid)
+                        && other_ev.collection == ev.collection
+                    {
+                        node_wide_bits |= other_ev.shard_bits().0;
                     }
                 }
                 let node_wide = node_wide_bits.count_ones() as usize;
@@ -419,6 +422,12 @@ impl Store {
                     let Some(base) = name.strip_suffix(".ecx") else {
                         continue;
                     };
+                    // A 0-byte .ecx is a corrupt stub from a failed copy, not a
+                    // credible owner — skip it so the scan keeps looking for a
+                    // real index on a sibling disk (Go's indexEcxOwners).
+                    if !ent.metadata().is_ok_and(|m| m.len() > 0) {
+                        continue;
+                    }
                     let Some((collection, vid)) = parse_collection_volume_id_pub(base) else {
                         continue;
                     };
@@ -474,13 +483,13 @@ impl Store {
     /// Unlike `reconcile_ec_shards_across_disks` it needs no sibling disk, so a
     /// single-disk store recovers once its index has been fetched from a peer.
     fn load_orphan_ec_shards_with_local_index(&mut self) {
-        let mut work: Vec<(usize, EcKey, Vec<u32>)> = Vec::new();
+        let mut work: Vec<(usize, EcKey, Vec<ShardId>)> = Vec::new();
         for (loc_idx, loc) in self.locations.iter().enumerate() {
             for (key, shards) in collect_orphan_ec_shards(loc, loc_idx) {
                 if !loc.has_ecx_file_on_disk(&key.collection, key.vid) {
                     continue;
                 }
-                let ids: Vec<u32> = shards.iter().map(|(_, sid)| *sid).collect();
+                let ids: Vec<ShardId> = shards.iter().map(|(_, sid)| *sid).collect();
                 work.push((loc_idx, key, ids));
             }
         }
@@ -499,6 +508,53 @@ impl Store {
     }
 }
 
+/// Walk a disk's data directory and return the `.ec??` shard files
+/// that are present on disk but not yet registered in the location's
+/// `ec_volumes` map. Keyed by (collection, vid) so callers can match
+/// each group against its `.ecx`-owning disk in one lookup. Zero-byte
+/// shard files are ignored — same shape as `load_all_ec_shards`.
+fn collect_orphan_ec_shards(
+    loc: &crate::storage::disk_location::DiskLocation,
+    _loc_idx: usize,
+) -> HashMap<EcKey, Vec<(String, ShardId)>> {
+    let mut orphans: HashMap<EcKey, Vec<(String, ShardId)>> = HashMap::new();
+    let Ok(read) = fs::read_dir(&loc.directory) else {
+        return orphans;
+    };
+    for ent in read.flatten() {
+        if ent.file_type().map(|ft| ft.is_dir()).unwrap_or(false) {
+            continue;
+        }
+        let name = ent.file_name().to_string_lossy().into_owned();
+        let Some(dot) = name.rfind('.') else {
+            continue;
+        };
+        let (base, ext) = name.split_at(dot);
+        let Some(shard_id) = is_ec_shard_extension(ext) else {
+            continue;
+        };
+        // Ignore zero-byte shards. Use the DirEntry's metadata so we
+        // don't pay a second stat syscall per file beyond what
+        // read_dir already returned.
+        match ent.metadata() {
+            Ok(meta) if meta.len() > 0 => {}
+            _ => continue,
+        }
+        let Some((collection, vid)) = parse_collection_volume_id_pub(base) else {
+            continue;
+        };
+        // Skip shards that are already registered to an EcVolume.
+        if let Some(ecv) = loc.find_ec_volume(vid)
+            && ecv.has_shard(shard_id)
+        {
+            continue;
+        }
+        let key = EcKey { collection, vid };
+        orphans.entry(key).or_default().push((name, shard_id));
+    }
+    orphans
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -541,7 +597,13 @@ mod tests {
         std::fs::write(&p, b"shard data nonempty").unwrap();
     }
 
-    fn write_index_files(idx_dir: &str, collection: &str, vid: u32, data_shards: u32, parity_shards: u32) {
+    fn write_index_files(
+        idx_dir: &str,
+        collection: &str,
+        vid: u32,
+        data_shards: u32,
+        parity_shards: u32,
+    ) {
         // Minimal sealed .ecx (the loader only opens the file; it
         // doesn't parse it during placement).
         std::fs::write(
@@ -583,6 +645,34 @@ mod tests {
         .unwrap();
     }
 
+    /// A 0-byte `.ecx` is not a credible owner (Go's indexEcxOwners skips
+    /// it): picking the stub would hide the valid index on the sibling disk.
+    #[test]
+    fn test_index_ecx_owners_skips_zero_byte_stub() {
+        let (store, _tmp) = make_test_store(2, None);
+        let d0 = store.locations[0].directory.clone();
+        let d1 = store.locations[1].directory.clone();
+        std::fs::write(ec_local_ecx_path(&d0, "pics", VolumeId(7)), b"").unwrap();
+        write_index_files(&d1, "pics", 7, 10, 4);
+
+        let owners = store.index_ecx_owners();
+        let owner = owners
+            .get(&EcKey {
+                collection: "pics".to_string(),
+                vid: VolumeId(7),
+            })
+            .expect("the valid .ecx on disk 1 must be indexed");
+        assert_eq!(owner.location, 1);
+        assert_eq!(owner.idx_dir, d1);
+
+        // A stub with no real index anywhere owns nothing.
+        std::fs::write(ec_local_ecx_path(&d0, "pics", VolumeId(8)), b"").unwrap();
+        assert!(!store.index_ecx_owners().contains_key(&EcKey {
+            collection: "pics".to_string(),
+            vid: VolumeId(8),
+        }));
+    }
+
     /// An empty `.dat` (<= a superblock, i.e. zero needles) for an EC volume
     /// is a leftover stub from the pre-fix loader. It must be swept on startup,
     /// not loaded as a phantom empty volume. With the same vid's stub on two
@@ -895,15 +985,74 @@ mod tests {
         // dir1 owns the .ecx and so already has shard 1 mounted via
         // its own load_all_ec_shards.
         let ev1 = store.locations[1].find_ec_volume(VolumeId(vid));
-        assert!(ev1.is_some(), "baseline broken: dir1 should have mounted shard 1");
+        assert!(
+            ev1.is_some(),
+            "baseline broken: dir1 should have mounted shard 1"
+        );
 
         // dir0's shards must be reconciled across to its own
         // ec_volumes map, pointing at dir1's idx dir.
         let ev0 = store.locations[0]
             .find_ec_volume(VolumeId(vid))
             .expect("dir0 should now have an EcVolume after reconcile");
-        assert!(ev0.has_shard(0), "shard 0 missing from dir0 after reconcile");
-        assert!(ev0.has_shard(12), "shard 12 missing from dir0 after reconcile");
+        assert!(
+            ev0.has_shard(0),
+            "shard 0 missing from dir0 after reconcile"
+        );
+        assert!(
+            ev0.has_shard(12),
+            "shard 12 missing from dir0 after reconcile"
+        );
+    }
+
+    /// dir0 holds orphan shards next to a 0-byte `.ecx` stub from a failed
+    /// copy; the real index is on dir1. The stub must not count as a
+    /// locally-mirrored index (Go gates that fast path on HasEcxFileOnDisk),
+    /// or the shards get registered against an empty index.
+    #[test]
+    fn test_reconcile_ignores_zero_byte_local_ecx_stub() {
+        let tmp = TempDir::new().unwrap();
+        let dir0 = tmp.path().join("data0");
+        let dir1 = tmp.path().join("data1");
+        std::fs::create_dir_all(&dir0).unwrap();
+        std::fs::create_dir_all(&dir1).unwrap();
+
+        let collection = "grafana-loki";
+        let vid = 1094u32;
+
+        write_shard(dir0.to_str().unwrap(), collection, vid, 0);
+        write_shard(dir1.to_str().unwrap(), collection, vid, 1);
+        write_index_files(dir1.to_str().unwrap(), collection, vid, 10, 4);
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        for dir in [&dir0, &dir1] {
+            store
+                .add_location(
+                    dir.to_str().unwrap(),
+                    dir.to_str().unwrap(),
+                    100,
+                    DiskType::HardDrive,
+                    MinFreeSpace::Percent(0.0),
+                    Vec::new(),
+                )
+                .unwrap();
+        }
+        // Plant the stub after the startup scan so only the reconcile decision
+        // is under test, then drop dir0's mount and reconcile again.
+        store.locations[0].remove_ec_volume(VolumeId(vid));
+        std::fs::write(
+            ec_local_ecx_path(dir0.to_str().unwrap(), collection, VolumeId(vid)),
+            b"",
+        )
+        .unwrap();
+
+        store.reconcile_ec_shards_across_disks();
+
+        let ev0 = store.locations[0]
+            .find_ec_volume(VolumeId(vid))
+            .expect("dir0's shard must be mounted against the owner's index");
+        assert!(ev0.has_shard(0));
+        assert_eq!(ev0.ecx_actual_dir(), dir1.to_str().unwrap());
     }
 
     /// PR 9244 review case: idx_directory is configured but the
@@ -1012,7 +1161,13 @@ mod tests {
         assert!(store.locations[0].find_ec_volume(VolumeId(vid)).is_none());
         // Shard files must still exist on disk for operator recovery.
         for sid in [0u8, 12u8] {
-            let p = format!("{}/{}_{}.ec{:02}", dir0.to_str().unwrap(), collection, vid, sid);
+            let p = format!(
+                "{}/{}_{}.ec{:02}",
+                dir0.to_str().unwrap(),
+                collection,
+                vid,
+                sid
+            );
             assert!(
                 std::path::Path::new(&p).exists(),
                 "orphan shard {} was destroyed",
@@ -1077,10 +1232,12 @@ mod tests {
         assert!(ev1.has_shard(6), "dir1 shard missing");
 
         // Nothing left to recover.
-        assert!(store
-            .collect_ec_volumes_missing_index()
-            .iter()
-            .all(|m| m.vid != VolumeId(vid)));
+        assert!(
+            store
+                .collect_ec_volumes_missing_index()
+                .iter()
+                .all(|m| m.vid != VolumeId(vid))
+        );
     }
 
     #[test]
@@ -1112,10 +1269,12 @@ mod tests {
                 .unwrap();
         }
 
-        assert!(store
-            .collect_ec_volumes_missing_index()
-            .iter()
-            .all(|m| m.vid != VolumeId(vid)));
+        assert!(
+            store
+                .collect_ec_volumes_missing_index()
+                .iter()
+                .all(|m| m.vid != VolumeId(vid))
+        );
     }
 
     /// Helper: build a 2-disk store where reconcile produces the
@@ -1184,6 +1343,87 @@ mod tests {
         assert!(!std::ptr::eq(ev0, ev1));
     }
 
+    /// `find_ec_volume` returns only disk 0's runtime, which is what hides
+    /// sibling-disk shards from every scrub mode. The plural lookup must
+    /// return one runtime per disk holding the vid, in location order.
+    #[test]
+    fn test_find_all_ec_volumes_returns_every_disk() {
+        let (store, _tmp) = build_split_disk_store(7010);
+        let vid = VolumeId(7010);
+
+        let all = store.find_all_ec_volumes(vid);
+        assert_eq!(
+            all.len(),
+            2,
+            "expected one EcVolume per disk holding the vid"
+        );
+
+        // Disk 0 carries shards 0 and 12; disk 1 carries shard 1.
+        assert!(all[0].has_shard(0));
+        assert!(all[0].has_shard(12));
+        assert!(all[1].has_shard(1));
+
+        // The singular lookup sees only the first — the bug being fixed.
+        let first = store.find_ec_volume(vid).unwrap();
+        assert!(std::ptr::eq(first, all[0]));
+
+        // A vid nobody mounts yields an empty vec, not a panic.
+        assert!(store.find_all_ec_volumes(VolumeId(9999)).is_empty());
+    }
+
+    /// End-to-end: with the vid mounted on two disks, a scrub driven through
+    /// the Store must reach BOTH disks' shards. Before the aggregation fix
+    /// `find_ec_volume` returned disk 0 and disk 1's shard 1 was never read.
+    #[test]
+    fn test_scrub_plans_reach_every_disk_through_the_store() {
+        use crate::storage::erasure_coding::ec_volume::{
+            EcChecksumScrubPlan, EcLocalScrubPlan, merge_ec_runtimes,
+        };
+
+        let (store, _tmp) = build_split_disk_store(7030);
+        let vid = VolumeId(7030);
+
+        let runtimes = store.find_all_ec_volumes(vid);
+        assert_eq!(runtimes.len(), 2);
+
+        // Reachability is the invariant, so assert on the resolved slots rather
+        // than on scrub message text: shards 0 and 12 live on disk 0, shard 1 on
+        // disk 1. The old first-match lookup could never see shard 1.
+        let merged = merge_ec_runtimes(&runtimes).expect("two runtimes merge");
+        assert!(merged.slots[0].is_some(), "disk 0's shard 0 unreachable");
+        assert!(merged.slots[12].is_some(), "disk 0's shard 12 unreachable");
+        assert!(
+            merged.slots[1].is_some(),
+            "disk 1's shard 1 unreachable — the bug"
+        );
+        assert!(
+            merged.skipped.is_empty(),
+            "same generation: {:?}",
+            merged.skipped
+        );
+
+        // Shard 1 is owned by the sibling runtime, not the anchor.
+        let (owner, _) = merged.slots[1].unwrap();
+        assert!(std::ptr::eq(owner, runtimes[1]));
+
+        // Both plans build over the union rather than over disk 0 alone.
+        assert!(EcChecksumScrubPlan::for_volumes(&runtimes).is_some());
+        assert!(EcLocalScrubPlan::for_volumes(&runtimes).is_some());
+        // ...and `is_some()` is a real question: `for_volumes` has exactly one
+        // `None` (the vanished-volume case), so without this the two lines above
+        // would hold for any input at all.
+        assert!(EcChecksumScrubPlan::for_volumes(&[]).is_none());
+        assert!(EcLocalScrubPlan::for_volumes(&[]).is_none());
+
+        // Regression guard: a single-runtime view still sees only its own disk,
+        // which is exactly what made aggregation necessary.
+        let disk0 = merge_ec_runtimes(&[runtimes[0]]).unwrap();
+        assert!(
+            disk0.slots.get(1).copied().flatten().is_none(),
+            "disk 0's runtime must not see the sibling's shard"
+        );
+    }
+
     /// `Store::unmount_ec_shards` used to return after the first
     /// location with the vid, so a request to unmount a shard that
     /// lives on a sibling disk became a silent no-op. After the fix,
@@ -1236,7 +1476,7 @@ mod tests {
         let vid = VolumeId(7004);
         let collection = "grafana-loki";
 
-        store.delete_ec_shards(vid, collection, &[1]);
+        store.delete_ec_shards(vid, collection, &[1]).unwrap();
 
         // Shard 1 file is gone on disk 1.
         let p1 = format!(
@@ -1267,17 +1507,22 @@ mod tests {
         let (_ev, dirs) = store.collect_ec_shard_dirs(vid, max_shards).unwrap();
 
         // Shards 0 and 12 → disk 0's directory.
-        assert_eq!(dirs[0].as_deref(), Some(store.locations[0].directory.as_str()));
-        assert_eq!(dirs[12].as_deref(), Some(store.locations[0].directory.as_str()));
+        assert_eq!(
+            dirs[0].as_deref(),
+            Some(store.locations[0].directory.as_str())
+        );
+        assert_eq!(
+            dirs[12].as_deref(),
+            Some(store.locations[0].directory.as_str())
+        );
         // Shard 1 → disk 1's directory.
-        assert_eq!(dirs[1].as_deref(), Some(store.locations[1].directory.as_str()));
+        assert_eq!(
+            dirs[1].as_deref(),
+            Some(store.locations[1].directory.as_str())
+        );
         // Unmounted shards → None.
         for sid in [2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13] {
-            assert_eq!(
-                dirs[sid], None,
-                "shard {} unexpectedly reported a dir",
-                sid,
-            );
+            assert_eq!(dirs[sid], None, "shard {} unexpectedly reported a dir", sid,);
         }
     }
 
@@ -1586,11 +1831,7 @@ mod tests {
             vec![0u8; 20],
         )
         .unwrap();
-        std::fs::write(
-            ec_dir.join(format!("{}_{}.ecj", collection, vid)),
-            b"",
-        )
-        .unwrap();
+        std::fs::write(ec_dir.join(format!("{}_{}.ecj", collection, vid)), b"").unwrap();
 
         let mut store = Store::new(NeedleMapKind::InMemory);
         store
@@ -1689,50 +1930,3 @@ mod tests {
         assert!(std::path::Path::new(&format!("{}.ecx", ec_base)).exists());
     }
 }
-
-/// Walk a disk's data directory and return the `.ec??` shard files
-/// that are present on disk but not yet registered in the location's
-/// `ec_volumes` map. Keyed by (collection, vid) so callers can match
-/// each group against its `.ecx`-owning disk in one lookup. Zero-byte
-/// shard files are ignored — same shape as `load_all_ec_shards`.
-fn collect_orphan_ec_shards(
-    loc: &crate::storage::disk_location::DiskLocation,
-    _loc_idx: usize,
-) -> HashMap<EcKey, Vec<(String, u32)>> {
-    let mut orphans: HashMap<EcKey, Vec<(String, u32)>> = HashMap::new();
-    let Ok(read) = fs::read_dir(&loc.directory) else {
-        return orphans;
-    };
-    for ent in read.flatten() {
-        if ent.file_type().map(|ft| ft.is_dir()).unwrap_or(false) {
-            continue;
-        }
-        let name = ent.file_name().to_string_lossy().into_owned();
-        let Some(dot) = name.rfind('.') else {
-            continue;
-        };
-        let (base, ext) = name.split_at(dot);
-        let Some(shard_id) = is_ec_shard_extension(ext) else {
-            continue;
-        };
-        // Ignore zero-byte shards. Use the DirEntry's metadata so we
-        // don't pay a second stat syscall per file beyond what
-        // read_dir already returned.
-        match ent.metadata() {
-            Ok(meta) if meta.len() > 0 => {}
-            _ => continue,
-        }
-        let Some((collection, vid)) = parse_collection_volume_id_pub(base) else {
-            continue;
-        };
-        // Skip shards that are already registered to an EcVolume.
-        if let Some(ecv) = loc.find_ec_volume(vid) {
-            if ecv.has_shard(shard_id as u8) {
-                continue;
-            }
-        }
-        let key = EcKey { collection, vid };
-        orphans.entry(key).or_default().push((name, shard_id));
-    }
-    orphans
-}
diff --git a/seaweed-volume/src/storage/super_block.rs b/seaweed-volume/src/storage/super_block.rs
index 033d1a9295..7203d13848 100644
--- a/seaweed-volume/src/storage/super_block.rs
+++ b/seaweed-volume/src/storage/super_block.rs
@@ -221,6 +221,35 @@ mod tests {
     use super::*;
     use crate::storage::types::*;
 
+    /// Multi-byte input must be an error, not a panic: `to_digit` on the
+    /// leading characters rejects it before `chars[2]` is ever indexed.
+    #[test]
+    fn replica_placement_rejects_non_ascii_instead_of_panicking() {
+        for s in ["é", "0é", "é0", "🦀", "ééé"] {
+            assert!(
+                ReplicaPlacement::from_string(s).is_err(),
+                "non-ASCII replication {:?} must error",
+                s
+            );
+        }
+    }
+
+    /// The ASCII guard must not change any accepted input, including the
+    /// zero-padding shorthands.
+    #[test]
+    fn replica_placement_still_accepts_ascii_shorthands() {
+        assert_eq!(
+            ReplicaPlacement::from_string("1").unwrap(),
+            ReplicaPlacement::from_string("001").unwrap()
+        );
+        assert_eq!(
+            ReplicaPlacement::from_string("01").unwrap(),
+            ReplicaPlacement::from_string("001").unwrap()
+        );
+        let rp = ReplicaPlacement::from_string("010").unwrap();
+        assert_eq!(rp.diff_rack_count, 1);
+    }
+
     #[test]
     fn test_super_block_round_trip() {
         let sb = SuperBlock {
diff --git a/seaweed-volume/src/storage/types.rs b/seaweed-volume/src/storage/types.rs
index c75d35ec18..cf877bae59 100644
--- a/seaweed-volume/src/storage/types.rs
+++ b/seaweed-volume/src/storage/types.rs
@@ -155,7 +155,7 @@ impl Size {
             return 0;
         }
         if self.0 < 0 {
-            return (self.0 * -1) as u32;
+            return -self.0 as u32;
         }
         self.0 as u32
     }
@@ -284,8 +284,9 @@ impl fmt::Display for Offset {
 // DiskType
 // ============================================================================
 
-#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Default)]
 pub enum DiskType {
+    #[default]
     HardDrive,
     Ssd,
     Custom(String),
@@ -319,12 +320,6 @@ impl fmt::Display for DiskType {
     }
 }
 
-impl Default for DiskType {
-    fn default() -> Self {
-        DiskType::HardDrive
-    }
-}
-
 // ============================================================================
 // VolumeId
 // ============================================================================
@@ -397,7 +392,7 @@ impl From<u8> for Version {
 ///
 /// Fields are split into request-side options (set by the caller) and response-side
 /// flags (set during the read to communicate status back).
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Default)]
 pub struct ReadOption {
     // -- request --
     /// If true, allow reading needles that have been soft-deleted.
@@ -423,21 +418,6 @@ pub struct ReadOption {
     pub read_buffer_size: i32,
 }
 
-impl Default for ReadOption {
-    fn default() -> Self {
-        ReadOption {
-            read_deleted: false,
-            attempt_meta_only: false,
-            must_meta_only: false,
-            is_meta_only: false,
-            volume_revision: 0,
-            is_out_of_range: false,
-            has_slow_read: false,
-            read_buffer_size: 0,
-        }
-    }
-}
-
 // ============================================================================
 // NeedleMapEntry helpers (for .idx file)
 // ============================================================================
diff --git a/seaweed-volume/src/storage/vid_stamp.rs b/seaweed-volume/src/storage/vid_stamp.rs
new file mode 100644
index 0000000000..a98d4eaaf2
--- /dev/null
+++ b/seaweed-volume/src/storage/vid_stamp.rs
@@ -0,0 +1,232 @@
+//! Persisted volume-id high-water mark ("vid stamp"), mirroring Go's
+//! `weed/storage/vid_stamp.go`.
+//!
+//! Each volume dir carries a `.vid_stamp` JSON file with the highest volume
+//! id the server has ever observed plus the topology id it last heartbeated
+//! to. The bound is fed by heartbeat echoes, AllocateVolume, and local
+//! volume/EC creation, is reported back in `Heartbeat.max_volume_id_seen`,
+//! and survives master state loss so rebuilt masters cannot reissue ids an
+//! offline server still holds.
+
+use std::fs;
+use std::io;
+use std::path::Path;
+
+use serde::{Deserialize, Serialize};
+
+use crate::storage::types::VolumeId;
+
+use super::store::Store;
+
+const VID_STAMP_FILE_NAME: &str = ".vid_stamp";
+
+#[derive(Serialize, Deserialize, Default)]
+struct VidStamp {
+    #[serde(rename = "maxVolumeId")]
+    max_volume_id: u32,
+    #[serde(rename = "topologyId", default, skip_serializing_if = "String::is_empty")]
+    topology_id: String,
+}
+
+impl Store {
+    pub fn max_volume_id_seen(&self) -> u32 {
+        self.max_volume_id_seen.load(std::sync::atomic::Ordering::Relaxed)
+    }
+
+    pub fn last_seen_topology_id(&self) -> String {
+        self.last_seen_topology_id
+            .lock()
+            .unwrap()
+            .clone()
+    }
+
+    pub fn update_max_volume_id_seen(&self, vid: u32) {
+        use std::sync::atomic::Ordering::Relaxed;
+        let prev = self.max_volume_id_seen.fetch_max(vid, Relaxed);
+        if vid > prev || self.vid_stamp_dirty.load(Relaxed) {
+            self.save_vid_stamps();
+        }
+    }
+
+    pub fn update_last_seen_topology_id(&self, id: &str) {
+        if id.is_empty() {
+            return;
+        }
+        {
+            let mut guard = self.last_seen_topology_id.lock().unwrap();
+            if *guard == id && !self.vid_stamp_dirty.load(std::sync::atomic::Ordering::Relaxed) {
+                return;
+            }
+            *guard = id.to_string();
+        }
+        self.save_vid_stamps();
+    }
+
+    /// Seed the bound from a freshly added location: its persisted stamp,
+    /// its volumes, and its EC shards. Called per location from
+    /// `add_location` after the EC reconcile passes have run.
+    pub(crate) fn fold_location_into_vid_stamp(&self, loc: &super::disk_location::DiskLocation) {
+        if let Ok(stamp) = read_vid_stamp(Path::new(&loc.directory)) {
+            self.update_max_volume_id_seen(stamp.max_volume_id);
+            if !stamp.topology_id.is_empty() {
+                self.update_last_seen_topology_id(&stamp.topology_id);
+            }
+        }
+        let mut max_vid: u32 = 0;
+        for vid in loc.volume_ids() {
+            max_vid = max_vid.max(vid.0);
+        }
+        for (vid, _) in loc.ec_volumes() {
+            max_vid = max_vid.max(vid.0);
+        }
+        if max_vid > 0 {
+            self.update_max_volume_id_seen(max_vid);
+        }
+    }
+
+    pub(crate) fn save_vid_stamps(&self) {
+        let _guard = self.vid_stamp_lock.lock().unwrap();
+        let stamp = match serde_json::to_vec(&VidStamp {
+            max_volume_id: self.max_volume_id_seen(),
+            topology_id: self.last_seen_topology_id(),
+        }) {
+            Ok(s) => s,
+            Err(_) => return,
+        };
+        let mut failed = false;
+        for loc in &self.locations {
+            if let Err(e) = write_vid_stamp(Path::new(&loc.directory), &stamp) {
+                tracing::warn!("write vid stamp in {}: {}", loc.directory, e);
+                failed = true;
+            }
+        }
+        self.vid_stamp_dirty
+            .store(failed, std::sync::atomic::Ordering::Relaxed);
+    }
+}
+
+fn read_vid_stamp(dir: &Path) -> io::Result<VidStamp> {
+    let data = fs::read(dir.join(VID_STAMP_FILE_NAME))?;
+    serde_json::from_slice(&data).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))
+}
+
+fn write_vid_stamp(dir: &Path, stamp: &[u8]) -> io::Result<()> {
+    let tmp = dir.join(format!("{}.tmp", VID_STAMP_FILE_NAME));
+    {
+        use std::io::Write;
+        let mut f = fs::File::create(&tmp)?;
+        f.write_all(stamp)?;
+        f.sync_all()?;
+    }
+    fs::rename(&tmp, dir.join(VID_STAMP_FILE_NAME))?;
+    if cfg!(unix) {
+        fs::File::open(dir)?.sync_all()?;
+    }
+    Ok(())
+}
+
+/// Stamps the volume id of a newly created volume or EC shard set. Called
+/// from `Store::add_volume` / `Store::mount_ec_shards*` so the bound covers
+/// ids before their files exist.
+impl Store {
+    pub(crate) fn stamp_allocated_vid(&self, vid: VolumeId) {
+        self.update_max_volume_id_seen(vid.0);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::MinFreeSpace;
+    use crate::storage::needle_map::NeedleMapKind;
+    use crate::storage::types::DiskType;
+    use tempfile::TempDir;
+
+    fn make_store(dir: &str) -> Store {
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(dir, dir, 10, DiskType::HardDrive, MinFreeSpace::Percent(1.0), Vec::new())
+            .unwrap();
+        store
+    }
+
+    #[test]
+    fn stamp_written_on_bound_increase() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let store = make_store(dir);
+
+        store.update_max_volume_id_seen(42);
+
+        let stamp = read_vid_stamp(tmp.path()).unwrap();
+        assert_eq!(stamp.max_volume_id, 42);
+    }
+
+    #[test]
+    fn stamp_survives_restart() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+
+        let store = make_store(dir);
+        store.update_max_volume_id_seen(42);
+        store.update_last_seen_topology_id("cluster-a");
+        drop(store);
+
+        let restarted = make_store(dir);
+        assert_eq!(restarted.max_volume_id_seen(), 42);
+        assert_eq!(restarted.last_seen_topology_id(), "cluster-a");
+    }
+
+    #[test]
+    fn later_disk_gets_combined_stamp() {
+        let tmp1 = TempDir::new().unwrap();
+        let tmp2 = TempDir::new().unwrap();
+        // dir2 carries a stale stamp from an older run
+        write_vid_stamp(
+            tmp2.path(),
+            &serde_json::to_vec(&VidStamp {
+                max_volume_id: 10,
+                topology_id: String::new(),
+            })
+            .unwrap(),
+        )
+        .unwrap();
+
+        let mut store = Store::new(NeedleMapKind::InMemory);
+        store
+            .add_location(
+                tmp1.path().to_str().unwrap(),
+                tmp1.path().to_str().unwrap(),
+                10,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+        store.update_max_volume_id_seen(100);
+        store
+            .add_location(
+                tmp2.path().to_str().unwrap(),
+                tmp2.path().to_str().unwrap(),
+                10,
+                DiskType::HardDrive,
+                MinFreeSpace::Percent(1.0),
+                Vec::new(),
+            )
+            .unwrap();
+
+        let stamp2 = read_vid_stamp(tmp2.path()).unwrap();
+        assert_eq!(stamp2.max_volume_id, 100);
+    }
+
+    #[test]
+    fn bound_is_monotonic() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let store = make_store(dir);
+
+        store.update_max_volume_id_seen(10);
+        store.update_max_volume_id_seen(5);
+        assert_eq!(store.max_volume_id_seen(), 10);
+    }
+}
diff --git a/seaweed-volume/src/storage/volume.rs b/seaweed-volume/src/storage/volume.rs
index 67a03eef71..7fc7be57de 100644
--- a/seaweed-volume/src/storage/volume.rs
+++ b/seaweed-volume/src/storage/volume.rs
@@ -9,22 +9,27 @@
 //! Matches Go's storage/volume.go, volume_loading.go, volume_read.go,
 //! volume_write.go, volume_super_block.go.
 
+use std::collections::HashSet;
 use std::fs::{self, File, OpenOptions};
 use std::io::{self, Read, Seek, SeekFrom, Write};
+use std::ops::ControlFlow;
 use std::path::Path;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::sync::Arc;
-use std::sync::{Condvar, Mutex};
+use std::sync::atomic::{AtomicBool, AtomicI64, AtomicU8, AtomicU64, Ordering};
+use std::sync::{Arc, Condvar, Mutex, RwLock};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-use tracing::{info, warn};
+use tracing::{debug, error, info, warn};
 
-#[cfg(test)]
 use crate::storage::idx;
-use crate::storage::needle::needle::{self, get_actual_size, Needle, NeedleError};
+use crate::storage::io::read_exact_at;
+use crate::storage::io_error::{IoErrorTracker, StreakMark};
+use crate::storage::needle::needle::{self, Needle, NeedleError, get_actual_size};
+use crate::storage::needle_map::sorted_file::SortedFileNeedleMap;
 use crate::storage::needle_map::{CompactNeedleMap, NeedleMap, NeedleMapKind, RedbNeedleMap};
-use crate::storage::super_block::{ReplicaPlacement, SuperBlock, SUPER_BLOCK_SIZE};
+use crate::storage::super_block::{ReplicaPlacement, SUPER_BLOCK_SIZE, SuperBlock};
 use crate::storage::types::*;
+use crate::storage::volume_open::open_volume_file;
+use crate::storage::volume_tail_repair::TailRepairError;
 
 // ============================================================================
 // Errors
@@ -35,6 +40,9 @@ pub enum VolumeError {
     #[error("not found")]
     NotFound,
 
+    #[error("volume id {0} is not found")]
+    VolumeNotFound(VolumeId),
+
     #[error("already deleted")]
     Deleted,
 
@@ -53,12 +61,22 @@ pub enum VolumeError {
     #[error("volume already exists")]
     AlreadyExists,
 
-    #[error("volume is read-only")]
-    ReadOnly,
+    #[error("volume {0} is read only")]
+    ReadOnly(VolumeId),
+
+    #[error("volume is unavailable: {0}")]
+    Unavailable(String),
 
     #[error("volume size limit exceeded: current {current}, limit {limit}")]
     SizeLimitExceeded { current: u64, limit: u64 },
 
+    #[error("not enough free space: required {required}, free {free}")]
+    InsufficientSpace {
+        vid: VolumeId,
+        required: u64,
+        free: u64,
+    },
+
     #[error("volume not initialized")]
     NotInitialized,
 
@@ -71,8 +89,8 @@ pub enum VolumeError {
     #[error("IO error: {0}")]
     Io(#[from] io::Error),
 
-    #[error("streaming from remote-backed volume requires buffered fallback")]
-    StreamingUnsupported,
+    #[error(transparent)]
+    Tier(#[from] crate::remote_storage::s3_tier::TierError),
 }
 
 /// Returns true when a needle read failed because the on-disk bytes are
@@ -93,6 +111,67 @@ fn is_skippable_needle_read_error(e: &VolumeError) -> bool {
     }
 }
 
+/// Reports whether the compacted .dat is short of the live bytes the
+/// pre-compaction index snapshot expected.
+fn exceeds_expected_compacted_size(expected_live_bytes: u64, dst_dat_size: u64) -> bool {
+    expected_live_bytes > dst_dat_size
+}
+
+/// Read and parse the needle at `offset` through `read_at`.
+fn read_needle_with(
+    read_at: impl Fn(&mut [u8], u64) -> Result<(), VolumeError>,
+    n: &mut Needle,
+    offset: i64,
+    size: Size,
+    version: Version,
+) -> Result<(), VolumeError> {
+    match parse_needle_at(&read_at, n, offset, size, version) {
+        Ok(()) => Ok(()),
+        #[cfg(not(feature = "5bytes"))]
+        Err(VolumeError::Needle(NeedleError::SizeMismatch { offset: o, .. }))
+            if o < MAX_POSSIBLE_VOLUME_SIZE as i64 =>
+        {
+            // Double-read: in 4-byte offset mode, the actual data may be
+            // beyond 32GB due to offset wrapping. Retry at offset + 32GB.
+            parse_needle_at(
+                &read_at,
+                n,
+                offset + MAX_POSSIBLE_VOLUME_SIZE as i64,
+                size,
+                version,
+            )
+        }
+        Err(e) => Err(e),
+    }
+}
+
+fn parse_needle_at(
+    read_at: &impl Fn(&mut [u8], u64) -> Result<(), VolumeError>,
+    n: &mut Needle,
+    offset: i64,
+    size: Size,
+    version: Version,
+) -> Result<(), VolumeError> {
+    // Storage guard: negativity-only (Go parity — storage allocates what the
+    // index says). Size(0) and >1GiB map sizes must still read; only
+    // negative wraps/panics. Transport cap lives in RPC handlers only.
+    if size.0 < 0 {
+        return Err(VolumeError::Io(std::io::Error::new(
+            std::io::ErrorKind::InvalidData,
+            format!("invalid needle size {}", size.0),
+        )));
+    }
+    let actual_size = get_actual_size(size, version);
+
+    let mut buf = vec![0u8; actual_size as usize];
+    #[cfg(test)]
+    needle_read_hook::fire(n.id, buf.len());
+    read_at(&mut buf, offset as u64)?;
+
+    n.read_bytes(&buf, offset, size, version)?;
+    Ok(())
+}
+
 // ============================================================================
 // VolumeInfo (.vif persistence)
 // ============================================================================
@@ -193,6 +272,10 @@ pub struct VifEcShardConfig {
     /// so a read served from a different run's shard is rejected.
     #[serde(default, rename = "encodeTsNs", with = "string_or_i64")]
     pub encode_ts_ns: i64,
+    /// Uniform block layout: each shard is a single contiguous block of this
+    /// many bytes. 0 = legacy 1GiB/1MiB two-tier layout.
+    #[serde(default, rename = "blockSize", with = "string_or_i64")]
+    pub block_size: i64,
 }
 
 /// Serde-compatible representation of OldVersionVolumeInfo for legacy .vif JSON deserialization.
@@ -207,9 +290,19 @@ struct OldVersionVifVolumeInfo {
     pub replication: String,
     #[serde(default, alias = "bytesOffset", alias = "BytesOffset")]
     pub bytes_offset: u32,
-    #[serde(default, alias = "datFileSize", alias = "dat_file_size", with = "string_or_i64")]
+    #[serde(
+        default,
+        alias = "datFileSize",
+        alias = "dat_file_size",
+        with = "string_or_i64"
+    )]
     pub dat_file_size: i64,
-    #[serde(default, alias = "destroyTime", alias = "DestroyTime", with = "string_or_u64")]
+    #[serde(
+        default,
+        alias = "destroyTime",
+        alias = "DestroyTime",
+        with = "string_or_u64"
+    )]
     pub destroy_time: u64,
     #[serde(default, alias = "readOnly", alias = "read_only")]
     pub read_only: bool,
@@ -217,7 +310,7 @@ struct OldVersionVifVolumeInfo {
 
 impl OldVersionVifVolumeInfo {
     /// Convert to the standard VifVolumeInfo, mapping destroy_time -> expire_at_sec.
-    fn to_vif(self) -> VifVolumeInfo {
+    fn into_vif(self) -> VifVolumeInfo {
         VifVolumeInfo {
             files: self.files,
             version: self.version,
@@ -227,6 +320,7 @@ impl OldVersionVifVolumeInfo {
             expire_at_sec: self.destroy_time,
             read_only: self.read_only,
             ec_shard_config: None,
+            read_only_can_delete: false,
         }
     }
 }
@@ -255,6 +349,8 @@ pub struct VifVolumeInfo {
         skip_serializing_if = "Option::is_none"
     )]
     pub ec_shard_config: Option<VifEcShardConfig>,
+    #[serde(default, rename = "readOnlyCanDelete")]
+    pub read_only_can_delete: bool,
 }
 
 impl VifVolumeInfo {
@@ -284,7 +380,9 @@ impl VifVolumeInfo {
                 data_shards: c.data_shards,
                 parity_shards: c.parity_shards,
                 encode_ts_ns: c.encode_ts_ns,
+                block_size: c.block_size,
             }),
+            read_only_can_delete: pb.read_only_can_delete,
         }
     }
 
@@ -315,8 +413,10 @@ impl VifVolumeInfo {
                     data_shards: c.data_shards,
                     parity_shards: c.parity_shards,
                     encode_ts_ns: c.encode_ts_ns,
+                    block_size: c.block_size,
                 }
             }),
+            read_only_can_delete: self.read_only_can_delete,
         }
     }
 }
@@ -369,8 +469,28 @@ impl DataFileAccessControl {
             control: self.clone(),
         }
     }
+
+    /// Non-blocking write lease. The compaction commit uses this: its caller
+    /// holds the store write lock, so blocking behind a slow streaming read
+    /// would stall every volume. Refusal is reported as `WouldBlock` with
+    /// `COMMIT_WAITS_FOR_READS` so the caller can retry later.
+    pub fn try_write_lock(self: &Arc<Self>) -> Option<DataFileWriteLease> {
+        let mut state = self.state.lock().unwrap();
+        if state.writer_active || state.readers > 0 {
+            return None;
+        }
+        state.writer_active = true;
+        drop(state);
+        Some(DataFileWriteLease {
+            control: self.clone(),
+        })
+    }
 }
 
+/// Error text for a compaction commit refused while streaming reads hold the
+/// data file; callers match it to retry instead of blocking the store lock.
+pub const COMMIT_WAITS_FOR_READS: &str = "streaming reads hold the data file";
+
 impl Drop for DataFileReadLease {
     fn drop(&mut self) {
         let mut state = self.control.state.lock().unwrap();
@@ -389,6 +509,83 @@ impl Drop for DataFileWriteLease {
     }
 }
 
+/// Test seam: a hook sees (and may park) every data read of its needle.
+#[cfg(test)]
+pub(crate) mod needle_read_hook {
+    use super::NeedleId;
+    use std::sync::{Arc, Mutex};
+
+    type Hook = Arc<dyn Fn(usize) + Send + Sync>;
+    static HOOKS: Mutex<Vec<(NeedleId, Hook)>> = Mutex::new(Vec::new());
+
+    pub(crate) struct Registration(NeedleId);
+
+    impl Drop for Registration {
+        fn drop(&mut self) {
+            HOOKS.lock().unwrap().retain(|(id, _)| *id != self.0);
+        }
+    }
+
+    /// Needle ids are the key, so tests running in parallel must use distinct ones.
+    pub(crate) fn register(
+        id: NeedleId,
+        hook: impl Fn(usize) + Send + Sync + 'static,
+    ) -> Registration {
+        HOOKS.lock().unwrap().push((id, Arc::new(hook)));
+        Registration(id)
+    }
+
+    pub(crate) fn fire(id: NeedleId, len: usize) {
+        let hook = HOOKS
+            .lock()
+            .unwrap()
+            .iter()
+            .find(|(hook_id, _)| *hook_id == id)
+            .map(|(_, hook)| hook.clone());
+        if let Some(hook) = hook {
+            hook(len);
+        }
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod needle_write_hook {
+    use super::NeedleId;
+    use std::sync::{Arc, Mutex};
+
+    type Hook = Arc<dyn Fn(usize) + Send + Sync>;
+    static HOOKS: Mutex<Vec<(NeedleId, Hook)>> = Mutex::new(Vec::new());
+
+    pub(crate) struct Registration(NeedleId);
+
+    impl Drop for Registration {
+        fn drop(&mut self) {
+            HOOKS.lock().unwrap().retain(|(id, _)| *id != self.0);
+        }
+    }
+
+    /// Needle ids are the key, so tests running in parallel must use distinct ones.
+    pub(crate) fn register(
+        id: NeedleId,
+        hook: impl Fn(usize) + Send + Sync + 'static,
+    ) -> Registration {
+        HOOKS.lock().unwrap().push((id, Arc::new(hook)));
+        Registration(id)
+    }
+
+    pub(crate) fn fire(id: NeedleId, len: usize) {
+        let hook = HOOKS
+            .lock()
+            .unwrap()
+            .iter()
+            .find(|(hook_id, _)| *hook_id == id)
+            .map(|(_, hook)| hook.clone());
+        if let Some(hook) = hook {
+            hook(len);
+        }
+    }
+}
+
 /// Information needed to stream needle data directly from the dat file
 /// without loading the entire payload into memory.
 pub(crate) enum NeedleStreamSource {
@@ -397,36 +594,559 @@ pub(crate) enum NeedleStreamSource {
 }
 
 impl NeedleStreamSource {
-    pub(crate) fn clone_for_read(&self) -> io::Result<Self> {
-        match self {
-            NeedleStreamSource::Local(file) => Ok(NeedleStreamSource::Local(file.try_clone()?)),
-            NeedleStreamSource::Remote(remote) => Ok(NeedleStreamSource::Remote(remote.clone())),
-        }
-    }
-
     pub(crate) fn read_exact_at(&self, buf: &mut [u8], offset: u64) -> io::Result<()> {
         match self {
-            NeedleStreamSource::Local(file) => {
-                #[cfg(unix)]
-                {
-                    use std::os::unix::fs::FileExt;
-                    file.read_exact_at(buf, offset)?;
-                }
-                #[cfg(windows)]
-                {
-                    read_exact_at(file, buf, offset)?;
-                }
-                #[cfg(not(any(unix, windows)))]
-                {
-                    compile_error!("Platform not supported: only unix and windows are supported");
-                }
-                Ok(())
-            }
+            NeedleStreamSource::Local(file) => read_exact_at(file, buf, offset),
             NeedleStreamSource::Remote(remote) => remote.read_exact_at(buf, offset),
         }
     }
 }
 
+/// A `.dat` scan that runs with the store lock released, built by
+/// `Volume::dat_scan_plan` while the caller holds a store guard.
+///
+/// The start offset, the handle and the end bound are captured together
+/// while the guard excludes every writer. The handle pins the inode the
+/// offset was resolved against: a vacuum commit replaces `.dat` by rename,
+/// and unmount or destroy close and unlink it, none of which rewrites the
+/// pinned bytes. `.dat` is otherwise append-only and a failed append
+/// truncates only its own bytes, so `[from, end)` holds complete records
+/// that nothing rewrites while the scan runs. A short read below `end` can
+/// therefore only mean the inode was truncated under the plan (an unmount
+/// followed by a `VolumeCopy` of the same id reopens `.dat` with
+/// `truncate(true)`), and the scan fails rather than ending as if the
+/// snapshot had been read. The fields are private so a plan can only come
+/// from `dat_scan_plan`.
+pub(crate) struct DatScanPlan {
+    source: NeedleStreamSource,
+    version: Version,
+    from: u64,
+    end: u64,
+    /// The volume instance and revision the plan was taken from: after a
+    /// vacuum or a re-create, the needle map's offsets name another file.
+    owner: Arc<DataFileAccessControl>,
+    compaction_revision: u16,
+}
+
+/// One record visited by `DatScanPlan::scan`: the raw on-disk bytes and the
+/// parsed append timestamp.
+pub(crate) struct RawNeedle<'a> {
+    pub header: &'a [u8],
+    pub body: &'a [u8],
+    pub append_at_ns: u64,
+}
+
+/// One record visited by `DatScanPlan::scan_records`, not yet parsed.
+pub(crate) struct DatRecord<'a> {
+    pub offset: u64,
+    pub id: NeedleId,
+    pub size: Size,
+    /// Header and body.
+    pub bytes: &'a [u8],
+    version: Version,
+}
+
+impl DatRecord<'_> {
+    pub(crate) fn parse(&self) -> Result<Needle, VolumeError> {
+        let mut n = Needle::default();
+        n.read_bytes(self.bytes, self.offset as i64, self.size, self.version)?;
+        Ok(n)
+    }
+}
+
+impl DatScanPlan {
+    /// Visit the records in `[from, end)` in file order, the way Go's
+    /// `ScanVolumeFileFrom` feeds a `VolumeFileScanner`: only the record being
+    /// visited is in memory. Reads are positional and never touch the
+    /// `Volume`. The pass ends `Ok` at the end of the data, at a record that
+    /// does not fit before `end`, or when `visit` breaks. A corrupt header
+    /// fails the pass: ending early would let a truncated tail look complete.
+    /// It also fails on any read error, including a short read below `end`:
+    /// every byte below `end` existed when the plan was taken, so a short read
+    /// means the file was truncated under the plan and the pass is incomplete.
+    pub(crate) fn scan(
+        &self,
+        mut visit: impl FnMut(RawNeedle<'_>) -> ControlFlow<()>,
+    ) -> Result<(), VolumeError> {
+        self.scan_records(|record| {
+            let append_at_ns = record.parse()?.append_at_ns;
+            Ok(visit(RawNeedle {
+                header: &record.bytes[..NEEDLE_HEADER_SIZE],
+                body: &record.bytes[NEEDLE_HEADER_SIZE..],
+                append_at_ns,
+            }))
+        })
+    }
+
+    /// `scan` without the parse: a visitor that skips a record never fails on
+    /// a body it did not need.
+    pub(crate) fn scan_records(
+        &self,
+        mut visit: impl FnMut(DatRecord<'_>) -> Result<ControlFlow<()>, VolumeError>,
+    ) -> Result<(), VolumeError> {
+        let mut offset = self.from;
+        while offset + NEEDLE_HEADER_SIZE as u64 <= self.end {
+            let mut header = [0u8; NEEDLE_HEADER_SIZE];
+            self.source
+                .read_exact_at(&mut header, offset)
+                .map_err(|e| self.read_error(e, offset))?;
+
+            let (_cookie, id, size) = Needle::parse_header(&header);
+            if size.0 == 0 && id.is_empty() {
+                break;
+            }
+            // A negative size is a corrupt header: the record length it
+            // implies cannot advance the scan past it, and stopping quietly
+            // would let a truncated tail look complete. Go's scan fails here.
+            if size.0 < 0 {
+                return Err(VolumeError::Io(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!(
+                        "corrupt needle header at offset {offset}: size {}, record length {}",
+                        size.0,
+                        get_actual_size(size, self.version)
+                    ),
+                )));
+            }
+
+            // Nothing past `end` was a complete record when the plan was
+            // taken. The size is checked against the bytes left, and the
+            // whole record after it. Both run before allocating, so a corrupt
+            // size cannot size the buffer. (The size check alone does not
+            // keep a corrupt size out of the padding arithmetic on a volume
+            // with more than 2 GiB left, which is why `padding_length` sums
+            // in i64.)
+            if size.0 as u64 > self.end - offset - NEEDLE_HEADER_SIZE as u64 {
+                break;
+            }
+            let body_length = needle::needle_body_length(size, self.version) as u64;
+            let total_size = NEEDLE_HEADER_SIZE as u64 + body_length;
+            if offset + total_size > self.end {
+                break;
+            }
+
+            // Match Go's ScanVolumeFileFrom: visit ALL needles including deleted ones.
+            // This is critical for incremental copy where tombstones must be propagated.
+            let mut record = vec![0u8; total_size as usize];
+            record[..NEEDLE_HEADER_SIZE].copy_from_slice(&header);
+            self.source
+                .read_exact_at(
+                    &mut record[NEEDLE_HEADER_SIZE..],
+                    offset + NEEDLE_HEADER_SIZE as u64,
+                )
+                .map_err(|e| self.read_error(e, offset + NEEDLE_HEADER_SIZE as u64))?;
+
+            let record = DatRecord {
+                offset,
+                id,
+                size,
+                bytes: &record,
+                version: self.version,
+            };
+            if visit(record)?.is_break() {
+                break;
+            }
+            offset += total_size;
+        }
+        Ok(())
+    }
+
+    /// Name the snapshot in a read failure. A short read is the truncation
+    /// case described on the type; every other error is passed through with
+    /// the offset.
+    fn read_error(&self, e: io::Error, offset: u64) -> VolumeError {
+        let what = if e.kind() == io::ErrorKind::UnexpectedEof {
+            "short read below the snapshot end, the dat file was truncated under the scan"
+        } else {
+            "read failed"
+        };
+        VolumeError::Io(io::Error::new(
+            e.kind(),
+            format!(
+                "{} (offset {}, snapshot end {}): {}",
+                what, offset, self.end, e
+            ),
+        ))
+    }
+}
+
+/// Why a volume refuses all I/O, shared with its in-flight needle streams so
+/// they see a mark made after they left the store lock. A leaf lock.
+#[derive(Debug, Default)]
+pub(crate) struct IoUnavailable(Mutex<Option<String>>);
+
+impl IoUnavailable {
+    fn set(&self, reason: String) {
+        *self.0.lock().unwrap() = Some(reason);
+    }
+
+    fn is_set(&self) -> bool {
+        self.0.lock().unwrap().is_some()
+    }
+
+    pub(crate) fn error(&self) -> Option<VolumeError> {
+        self.0
+            .lock()
+            .unwrap()
+            .as_ref()
+            .map(|reason| VolumeError::Unavailable(reason.clone()))
+    }
+}
+
+/// A needle read resolved under a store guard and run after it is released;
+/// the handle pins the inode, as for `DatScanPlan`. It takes no data-file
+/// lease: writers wait for one while holding the store write lock.
+pub(crate) struct NeedleReadPlan {
+    source: NeedleStreamSource,
+    offset: i64,
+    size: Size,
+    version: Version,
+    needle_id: NeedleId,
+    data_file_access_control: Arc<DataFileAccessControl>,
+    io_errors: Arc<IoErrorTracker>,
+    io_unavailable: Arc<IoUnavailable>,
+}
+
+impl NeedleReadPlan {
+    /// The needle's size in the index.
+    pub(crate) fn size(&self) -> Size {
+        self.size
+    }
+
+    /// Read the whole needle and verify its checksum.
+    pub(crate) fn read_full(&mut self, n: &mut Needle) -> Result<(), VolumeError> {
+        let (source, size, version) = (&self.source, self.size, self.version);
+        let read_at = |buf: &mut [u8], at: u64| Ok(source.read_exact_at(buf, at)?);
+        let result = with_offset_retry(&mut self.offset, |off| {
+            parse_needle_at(&read_at, n, off, size, version)
+        });
+        match &result {
+            Ok(()) => self.io_errors.check_read_write_error(None),
+            Err(VolumeError::Io(e)) => self.io_errors.check_read_write_error(Some(e)),
+            Err(_) => {}
+        }
+        result?;
+        if needle_expired(n) {
+            return Err(VolumeError::NotFound);
+        }
+        Ok(())
+    }
+
+    /// Read only the needle's metadata, skipping the payload.
+    pub(crate) fn read_meta(&mut self, n: &mut Needle) -> Result<(), VolumeError> {
+        let (source, size, version) = (&self.source, self.size, self.version);
+        let read_at = |buf: &mut [u8], at: u64| Ok(source.read_exact_at(buf, at)?);
+        let result = with_offset_retry(&mut self.offset, |off| {
+            if version == VERSION_1 {
+                // A V1 body is all data, so its "meta" is the whole record.
+                let mut buf = vec![0u8; get_actual_size(size, version) as usize];
+                #[cfg(test)]
+                needle_read_hook::fire(n.id, buf.len());
+                read_at(&mut buf, off as u64)?;
+                Ok(n.read_bytes_meta_only(&buf, off, size, version)?)
+            } else {
+                Volume::read_needle_meta_blob_and_parse(read_at, n, off, size, version)
+            }
+        });
+        // Report failures only: a successful meta read precedes the payload
+        // read, so clearing the streak here would reset the count before
+        // every failing download and the volume could never reach quarantine.
+        if let Err(VolumeError::Io(e)) = &result {
+            self.io_errors.check_read_write_error(Some(e));
+        }
+        result?;
+        if needle_expired(n) {
+            return Err(VolumeError::NotFound);
+        }
+        Ok(())
+    }
+
+    /// A successful meta read ended the request (e.g. HEAD), so it may reset
+    /// the streak — unlike a meta read that precedes a payload read.
+    pub(crate) fn note_meta_only_success(&self) {
+        self.io_errors.check_read_write_error(None);
+    }
+
+    /// For a reply served from the data file, after `read_meta` filled `n`.
+    pub(crate) fn into_stream_info(self, n: &Needle) -> NeedleStreamInfo {
+        // V1 data starts right after the header, V2/V3 after the DataSize field.
+        let data_file_offset = if self.version == VERSION_1 {
+            self.offset as u64 + NEEDLE_HEADER_SIZE as u64
+        } else {
+            self.offset as u64 + NEEDLE_HEADER_SIZE as u64 + DATA_SIZE_SIZE as u64
+        };
+        NeedleStreamInfo {
+            source: self.source,
+            data_file_offset,
+            data_size: n.data_size,
+            data_file_access_control: self.data_file_access_control,
+            io_unavailable: self.io_unavailable,
+            io_errors: self.io_errors,
+            needle_id: self.needle_id,
+            checksum: n.checksum.0,
+        }
+    }
+}
+
+/// Run `read` at `offset`, retrying past the 32 GiB wrap of 4-byte offsets
+/// on a size mismatch, and leave `offset` where the needle parsed.
+fn with_offset_retry(
+    offset: &mut i64,
+    mut read: impl FnMut(i64) -> Result<(), VolumeError>,
+) -> Result<(), VolumeError> {
+    match read(*offset) {
+        #[cfg(not(feature = "5bytes"))]
+        Err(VolumeError::Needle(NeedleError::SizeMismatch { offset: o, .. }))
+            if o < MAX_POSSIBLE_VOLUME_SIZE as i64 =>
+        {
+            *offset += MAX_POSSIBLE_VOLUME_SIZE as i64;
+            read(*offset)
+        }
+        result => result,
+    }
+}
+
+fn needle_expired(n: &Needle) -> bool {
+    let Some(ttl) = n.ttl.as_ref().filter(|_| n.has_ttl()) else {
+        return false;
+    };
+    let ttl_minutes = ttl.minutes();
+    if ttl_minutes == 0 || !n.has_last_modified_date() {
+        return false;
+    }
+    let expire_at_ns = n.append_at_ns + (ttl_minutes as u64) * 60 * 1_000_000_000;
+    let now_ns = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_nanos() as u64;
+    now_ns >= expire_at_ns
+}
+
+/// Holds `Volume::is_compacting` set; dropping it clears the flag.
+struct CompactionClaim(Arc<AtomicBool>);
+
+impl CompactionClaim {
+    fn try_claim(flag: &Arc<AtomicBool>) -> Option<Self> {
+        flag.compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
+            .ok()
+            .map(|_| CompactionClaim(flag.clone()))
+    }
+}
+
+impl Drop for CompactionClaim {
+    fn drop(&mut self) {
+        self.0.store(false, Ordering::Release);
+    }
+}
+
+/// A compaction copy that runs off the store lock: `.dat`/`.idx` are
+/// append-only below `idx_size`, and `makeup_diff` replays what lands after.
+pub(crate) struct CompactionJob {
+    id: VolumeId,
+    src_dat: NeedleStreamSource,
+    src_idx: File,
+    idx_size: u64,
+    cpd_path: String,
+    cpx_path: String,
+    version: Version,
+    super_block: SuperBlock,
+    io_errors: Arc<IoErrorTracker>,
+    _claim: CompactionClaim,
+}
+
+impl CompactionJob {
+    pub(crate) fn run<F>(self, progress_fn: F) -> Result<(), VolumeError>
+    where
+        F: Fn(i64) -> bool,
+    {
+        let cpd_path = &self.cpd_path;
+        let cpx_path = &self.cpx_path;
+        let version = self.version;
+
+        // Write new super block with incremented compaction revision
+        let mut new_sb = self.super_block.clone();
+        new_sb.compaction_revision += 1;
+        let sb_bytes = new_sb.to_bytes();
+
+        let mut dst = OpenOptions::new()
+            .read(true)
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .open(cpd_path)?;
+        dst.write_all(&sb_bytes)?;
+        let mut new_offset = sb_bytes.len() as i64;
+
+        // Build new index in memory
+        let mut new_nm = CompactNeedleMap::new();
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs();
+
+        let entries = self.live_entries()?;
+
+        let mut skipped_needles: u64 = 0;
+        let mut skipped_data_bytes: u64 = 0;
+        let mut expected_live_bytes: u64 = 0;
+        for (id, offset, size) in entries {
+            // Progress callback
+            if !progress_fn(offset.to_actual_offset()) {
+                // Interrupted
+                let _ = fs::remove_file(cpd_path);
+                return Err(VolumeError::Io(io::Error::new(
+                    io::ErrorKind::Interrupted,
+                    "compaction interrupted",
+                )));
+            }
+
+            // Read needle from source
+            let mut n = Needle {
+                id,
+                ..Needle::default()
+            };
+            let read = read_needle_with(
+                |buf, at| self.src_dat.read_exact_at(buf, at).map_err(VolumeError::Io),
+                &mut n,
+                offset.to_actual_offset(),
+                size,
+                version,
+            );
+            if let Err(e) = read {
+                // Record EIO for health monitoring (parity with Go's checkReadWriteError).
+                if let VolumeError::Io(ref io_err) = e {
+                    self.io_errors.check_read_write_error(Some(io_err));
+                }
+                // Only drop the entry when the failure is one of the well-
+                // known permanent-corruption shapes. A transient disk fault,
+                // a tiered-read timeout, or a Windows hardware error (which
+                // surfaces as a generic Io rather than UnexpectedEof) must
+                // abort so an operator notices, rather than silently
+                // compacting away data that might come back on retry.
+                if !is_skippable_needle_read_error(&e) {
+                    return Err(VolumeError::Io(io::Error::other(format!(
+                        "cannot hydrate needle from file: {}",
+                        e
+                    ))));
+                }
+                skipped_needles += 1;
+                if size.is_valid() {
+                    skipped_data_bytes += size.0 as u64;
+                }
+                warn!(
+                    volume_id = self.id.0,
+                    key = id.0,
+                    offset = offset.to_actual_offset(),
+                    size = size.0,
+                    error = %e,
+                    "vacuum: dropping unreadable needle"
+                );
+                continue;
+            }
+
+            // Skip TTL-expired needles using the volume's TTL (matches Go's volume_vacuum.go)
+            if n.has_ttl() {
+                let ttl_minutes = self.super_block.ttl.minutes();
+                if ttl_minutes > 0 && n.last_modified > 0 {
+                    let expire_at = n.last_modified + (ttl_minutes as u64) * 60;
+                    if now >= expire_at {
+                        continue;
+                    }
+                }
+            }
+
+            // Tally the live bytes from the frozen snapshot this loop copied
+            // from, not the live needle map. Unreadable needles return before
+            // this point, so no further skipped-byte adjustment is needed.
+            expected_live_bytes += size.0 as u64;
+
+            // Write needle to destination
+            let bytes = n.write_bytes(version);
+            dst.write_all(&bytes)?;
+
+            // Update new index
+            new_nm.put(id, Offset::from_actual_offset(new_offset), n.size)?;
+            new_offset += bytes.len() as i64;
+        }
+
+        if skipped_needles > 0 {
+            warn!(
+                volume_id = self.id.0,
+                skipped_needles,
+                skipped_data_bytes,
+                "vacuum: dropped unreadable index entries during compaction"
+            );
+        }
+
+        dst.sync_all()?;
+
+        if self.super_block.ttl.is_empty() {
+            let dst_dat_size = dst.metadata()?.len();
+            if exceeds_expected_compacted_size(expected_live_bytes, dst_dat_size) {
+                let _ = fs::remove_file(cpd_path);
+                let _ = fs::remove_file(cpx_path);
+                return Err(VolumeError::Io(io::Error::new(
+                    io::ErrorKind::UnexpectedEof,
+                    format!(
+                        "volume {} unexpected new data size: {} does not match expected live content size {} from the pre-compaction snapshot",
+                        self.id.0, dst_dat_size, expected_live_bytes
+                    ),
+                )));
+            }
+        }
+
+        // Save new index
+        new_nm.save_to_idx(cpx_path)?;
+
+        Ok(())
+    }
+
+    /// Replay `.idx` up to the recorded size, as Go's `LoadFromIdx` does, and
+    /// return the live entries in `.dat` order. A short read fails: treating
+    /// it as the whole index would compact away every needle past it.
+    fn live_entries(&self) -> Result<Vec<(NeedleId, Offset, Size)>, VolumeError> {
+        let rows = self.idx_size / NEEDLE_MAP_ENTRY_SIZE as u64;
+        let mut snapshot = CompactNeedleMap::new();
+        let mut seen = 0u64;
+        // Rows past the recorded size are makeup_diff's; do not read them.
+        let mut reader = io::BufReader::new((&self.src_idx).take(self.idx_size));
+        let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+        while seen < rows {
+            match reader.read_exact(&mut buf) {
+                Ok(()) => {}
+                Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => break,
+                Err(e) => return Err(e.into()),
+            }
+            let (key, offset, size) = idx_entry_from_bytes(&buf);
+            if offset.is_zero() || size.is_deleted() {
+                snapshot.delete(key, offset)?;
+            } else {
+                snapshot.put(key, offset, size)?;
+            }
+            seen += 1;
+        }
+        if seen < rows {
+            return Err(VolumeError::Io(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                format!(
+                    "volume {} index has {} entries, expected {}",
+                    self.id.0, seen, rows
+                ),
+            )));
+        }
+
+        let mut entries: Vec<(NeedleId, Offset, Size)> = Vec::new();
+        let _ = snapshot.ascending_visit(|id, nv| {
+            if !nv.offset.is_zero() && !nv.size.is_deleted() {
+                entries.push((id, nv.offset, nv.size));
+            }
+            Ok::<(), std::convert::Infallible>(())
+        });
+        entries.sort_by_key(|(_, offset, _)| *offset);
+        Ok(entries)
+    }
+}
+
 pub struct NeedleStreamInfo {
     /// Stream source for the dat file, local or remote.
     pub(crate) source: NeedleStreamSource,
@@ -436,14 +1156,15 @@ pub struct NeedleStreamInfo {
     pub data_size: u32,
     /// Per-volume file access lock used to match Go's slow-read behavior.
     pub data_file_access_control: Arc<DataFileAccessControl>,
-    /// Volume ID — used to re-lookup needle offset if compaction occurs during streaming.
-    pub volume_id: VolumeId,
-    /// Needle ID — used to re-lookup needle offset if compaction occurs during streaming.
+    /// Checked before each chunk: the volume can become unavailable mid-stream.
+    pub(crate) io_unavailable: Arc<IoUnavailable>,
+    /// Streamed chunks report read failures here and clear the streak when
+    /// the whole body has been emitted, mirroring readNeedleDataInto.
+    pub(crate) io_errors: Arc<IoErrorTracker>,
     pub needle_id: NeedleId,
-    /// Compaction revision at the time of the initial read. If this changes during
-    /// streaming, the needle's disk offset must be re-read from the needle map because
-    /// compaction may have moved the needle to a different location.
-    pub compaction_revision: u16,
+    /// Checksum stored in the needle tail, verified once the last chunk has
+    /// been read — before that frame is emitted.
+    pub checksum: u32,
 }
 
 #[derive(Clone)]
@@ -472,7 +1193,7 @@ impl RemoteDatFile {
         let data = self
             .backend
             .read_range_blocking(&self.key, offset, buf.len())
-            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+            .map_err(io::Error::other)?;
         if data.len() != buf.len() {
             return Err(io::Error::new(
                 io::ErrorKind::UnexpectedEof,
@@ -493,67 +1214,137 @@ impl RemoteDatFile {
 // Volume
 // ============================================================================
 
-pub struct Volume {
-    pub id: VolumeId,
-    dir: String,
-    dir_idx: String,
-    pub collection: String,
-
+/// The fields Go guards with `dataFileAccessLock`: the data and index file
+/// handles, the needle map, and the append/compaction cursors that must move
+/// with them. Taken briefly by read-plan resolution and held across an op by
+/// writes, deletes and lifecycle transitions — the same granularity Go's
+/// `*Volume` callers get from `dataFileAccessLock`, so a mounted `Arc<Volume>`
+/// is safe to use with no store guard held.
+///
+/// Lock order when more than one lock is needed: `data_file_access_control`
+/// lease first, then `io`, then `volume_info` / `super_block` / `dir_idx`;
+/// the atomics have no order. Helpers that receive an `io` guard are named
+/// `*_io` or `*_locked` and must never re-lock `self.io`.
+pub(crate) struct VolumeIo {
     dat_file: Option<File>,
     remote_dat_file: Option<RemoteDatFile>,
     nm: Option<NeedleMap>,
+    /// Make the next .dat or .idx flush fail, so tests can exercise the durable
+    /// write's failure paths without a real disk fault.
+    #[cfg(test)]
+    fail_fsync_for_test: bool,
+    #[cfg(test)]
+    fail_idx_sync_for_test: bool,
+    #[cfg(test)]
+    fail_truncate_for_test: bool,
+    /// Needle ids whose .dat append fails with a media error.
+    #[cfg(test)]
+    fail_append_for_test: HashSet<NeedleId>,
+    last_append_at_ns: u64,
+    last_write_append_at_ns: u64, // AppendAtNs of the newest write; tombstones don't move it
+    last_write_needle_key: NeedleId, // the write behind the watermark
+    last_write_deleted: bool,     // that write was deleted, so recovery has to rescan
+    keep_last_modified_ts_on_load: bool,
+    last_compact_index_offset: u64,
+    last_compact_revision: u16,
+}
+
+pub struct Volume {
+    pub id: VolumeId,
+    dir: String,
+    /// Moves only in load's --dir.idx adopt-back and `relocate_index_to`;
+    /// kept off the `io` lock so path building never contends with I/O.
+    dir_idx: RwLock<String>,
+    pub collection: String,
+
+    io: RwLock<VolumeIo>,
+
+    #[cfg(test)]
+    dat_syncs_for_test: std::sync::atomic::AtomicUsize,
+    #[cfg(test)]
+    idx_syncs_for_test: std::sync::atomic::AtomicUsize,
     needle_map_kind: NeedleMapKind,
     data_file_access_control: Arc<DataFileAccessControl>,
+    /// Serializes a data-file mutation with the sync that makes it durable:
+    /// write, delete and lifecycle paths hold it for their whole critical
+    /// section, while the fsync itself runs with only the `io` read guard so
+    /// readers of this volume do not wait on it. Lock order is
+    /// `data_file_sync_lock` -> `data_file_access_control` -> `io`.
+    data_file_sync_lock: std::sync::Mutex<()>,
 
-    pub super_block: SuperBlock,
+    /// Go's superBlockAccessLock.
+    super_block: RwLock<SuperBlock>,
 
-    no_write_or_delete: bool,
-    no_write_can_delete: bool,
+    /// Go's noWriteLock pair packed atomically: bit0 = no_write_or_delete
+    /// (no writes, no deletes), bit1 = no_write_can_delete (no writes, deletes
+    /// allowed). Read via `no_write_flags`.
+    no_write: AtomicU8,
+
+    /// Set when a failed recovery leaves the .dat/index pair unverified: all
+    /// I/O is refused and a `.unavailable` marker keeps the volume quarantined
+    /// across restarts. Mirrors Go's ioUnavailable.
+    io_unavailable: Arc<IoUnavailable>,
 
     /// Shared flag from the parent DiskLocation indicating low disk space.
     /// Matches Go's `v.location.isDiskSpaceLow` checked in `IsReadOnly()`.
     pub location_disk_space_low: Arc<AtomicBool>,
 
-    last_modified_ts_seconds: u64,
-    last_append_at_ns: u64,
+    last_modified_ts_seconds: AtomicU64,
     pub last_disk_check_ns: Arc<std::sync::atomic::AtomicI64>, // for phantom volume detection cache
 
-    last_compact_index_offset: u64,
-    last_compact_revision: u16,
+    /// Shared with an in-flight `CompactionJob`, which runs off the store lock.
+    is_compacting: Arc<AtomicBool>,
 
-    is_compacting: bool,
+    /// Set by `close` under the write lease: the handle is detached from the
+    /// store. An `Arc<Volume>` outliving its mount (unmount, delete, or a
+    /// remount that published a replacement) must fail closed instead of
+    /// touching files the new instance owns.
+    closed: AtomicBool,
 
     /// Compaction speed limit in bytes per second (0 = unlimited).
-    pub compaction_byte_per_second: i64,
+    pub compaction_byte_per_second: AtomicI64,
 
-    /// Tracks the last I/O error (EIO) for volume health monitoring.
-    /// Uses Mutex for interior mutability so reads (&self) can clear/set it.
-    last_io_error: Mutex<Option<String>>,
+    /// Consecutive storage-media errors and the quarantine they lead to,
+    /// for volume health monitoring.
+    io_errors: Arc<IoErrorTracker>,
 
-    /// Protobuf VolumeInfo for tiered storage (.vif file).
-    pub volume_info: PbVolumeInfo,
-
-    /// Whether this volume has a remote file reference.
-    pub has_remote_file: bool,
+    /// Protobuf VolumeInfo for tiered storage (.vif file), Go's
+    /// volumeInfoRWLock domain.
+    ///
+    /// Private: `volume_info.files` and the write mode derived from it are the
+    /// same fact, so outside callers edit the list through
+    /// [`Volume::update_remote_files`] and read it through
+    /// [`Volume::volume_info`].
+    volume_info: RwLock<PbVolumeInfo>,
 }
 
-/// Windows helper: loop seek_read until buffer is fully filled.
-#[cfg(windows)]
-fn read_exact_at(file: &File, buf: &mut [u8], mut offset: u64) -> io::Result<()> {
-    use std::os::windows::fs::FileExt;
-    let mut filled = 0;
-    while filled < buf.len() {
-        let n = file.seek_read(&mut buf[filled..], offset)?;
-        if n == 0 {
-            return Err(io::Error::new(
-                io::ErrorKind::UnexpectedEof,
-                "unexpected EOF in seek_read",
-            ));
+const NO_WRITE_OR_DELETE: u8 = 1;
+const NO_WRITE_CAN_DELETE: u8 = 2;
+
+/// What a volume is created with beyond its id, directories and index kind:
+/// the tail of Go's `NewVolume` argument list. The default is an empty
+/// collection with no replication, no TTL and no preallocation at the
+/// current needle version, which is what most tests want.
+#[derive(Clone, Copy, Debug)]
+pub struct VolumeSpec<'a> {
+    pub collection: &'a str,
+    pub replica_placement: Option<ReplicaPlacement>,
+    pub ttl: Option<crate::storage::needle::ttl::TTL>,
+    /// Bytes to reserve for the .dat up front; 0 grows on demand.
+    pub preallocate: u64,
+    pub version: Version,
+}
+
+impl Default for VolumeSpec<'_> {
+    fn default() -> Self {
+        VolumeSpec {
+            collection: "",
+            replica_placement: None,
+            ttl: None,
+            preallocate: 0,
+            version: Version::current(),
         }
-        filled += n;
-        offset += n as u64;
     }
-    Ok(())
 }
 
 impl Volume {
@@ -561,42 +1352,64 @@ impl Volume {
     pub fn new(
         dirname: &str,
         dir_idx: &str,
-        collection: &str,
         id: VolumeId,
         needle_map_kind: NeedleMapKind,
-        replica_placement: Option<ReplicaPlacement>,
-        ttl: Option<crate::storage::needle::ttl::TTL>,
-        preallocate: u64,
-        version: Version,
+        spec: &VolumeSpec<'_>,
     ) -> Result<Self, VolumeError> {
-        let mut v = Volume {
+        let VolumeSpec {
+            collection,
+            replica_placement,
+            ttl,
+            preallocate,
+            version,
+        } = *spec;
+        let v = Volume {
             id,
             dir: dirname.to_string(),
-            dir_idx: dir_idx.to_string(),
+            dir_idx: RwLock::new(dir_idx.to_string()),
             collection: collection.to_string(),
-            dat_file: None,
-            remote_dat_file: None,
-            nm: None,
+            io: RwLock::new(VolumeIo {
+                dat_file: None,
+                remote_dat_file: None,
+                nm: None,
+                #[cfg(test)]
+                fail_fsync_for_test: false,
+                #[cfg(test)]
+                fail_idx_sync_for_test: false,
+                #[cfg(test)]
+                fail_truncate_for_test: false,
+                #[cfg(test)]
+                fail_append_for_test: HashSet::new(),
+                last_append_at_ns: 0,
+                last_write_append_at_ns: 0,
+                last_write_needle_key: NeedleId(0),
+                last_write_deleted: false,
+                keep_last_modified_ts_on_load: false,
+                last_compact_index_offset: 0,
+                last_compact_revision: 0,
+            }),
+            #[cfg(test)]
+            dat_syncs_for_test: Default::default(),
+            #[cfg(test)]
+            idx_syncs_for_test: Default::default(),
             needle_map_kind,
             data_file_access_control: Arc::new(DataFileAccessControl::default()),
-            super_block: SuperBlock {
+            data_file_sync_lock: std::sync::Mutex::new(()),
+            super_block: RwLock::new(SuperBlock {
                 replica_placement: replica_placement.unwrap_or_default(),
                 ttl: ttl.unwrap_or(crate::storage::needle::ttl::TTL::EMPTY),
                 ..SuperBlock::default()
-            },
-            no_write_or_delete: false,
-            no_write_can_delete: false,
+            }),
+            no_write: AtomicU8::new(0),
+            io_unavailable: Arc::default(),
             location_disk_space_low: Arc::new(AtomicBool::new(false)),
-            last_modified_ts_seconds: 0,
-            last_append_at_ns: 0,
+            last_modified_ts_seconds: AtomicU64::new(0),
             last_disk_check_ns: Arc::new(std::sync::atomic::AtomicI64::new(0)),
-            last_compact_index_offset: 0,
-            last_compact_revision: 0,
-            is_compacting: false,
-            compaction_byte_per_second: 0,
-            last_io_error: Mutex::new(None),
-            volume_info: PbVolumeInfo::default(),
-            has_remote_file: false,
+            is_compacting: Arc::new(AtomicBool::new(false)),
+            closed: AtomicBool::new(false),
+            compaction_byte_per_second: AtomicI64::new(0),
+            io_errors: Arc::default(),
+            volume_info: RwLock::new(PbVolumeInfo::default()),
         };
 
         v.load(true, true, preallocate, version)?;
@@ -610,33 +1423,107 @@ impl Volume {
         Volume {
             id,
             dir: dirname.to_string(),
-            dir_idx: dir_idx.to_string(),
+            dir_idx: RwLock::new(dir_idx.to_string()),
             collection: collection.to_string(),
-            dat_file: None,
-            remote_dat_file: None,
-            nm: None,
+            io: RwLock::new(VolumeIo {
+                dat_file: None,
+                remote_dat_file: None,
+                nm: None,
+                #[cfg(test)]
+                fail_fsync_for_test: false,
+                #[cfg(test)]
+                fail_idx_sync_for_test: false,
+                #[cfg(test)]
+                fail_truncate_for_test: false,
+                #[cfg(test)]
+                fail_append_for_test: HashSet::new(),
+                last_append_at_ns: 0,
+                last_write_append_at_ns: 0,
+                last_write_needle_key: NeedleId(0),
+                last_write_deleted: false,
+                keep_last_modified_ts_on_load: false,
+                last_compact_index_offset: 0,
+                last_compact_revision: 0,
+            }),
+            #[cfg(test)]
+            dat_syncs_for_test: Default::default(),
+            #[cfg(test)]
+            idx_syncs_for_test: Default::default(),
             needle_map_kind: NeedleMapKind::InMemory,
             data_file_access_control: Arc::new(DataFileAccessControl::default()),
-            super_block: SuperBlock::default(),
-            no_write_or_delete: false,
-            no_write_can_delete: false,
+            data_file_sync_lock: std::sync::Mutex::new(()),
+            super_block: RwLock::new(SuperBlock::default()),
+            no_write: AtomicU8::new(0),
+            io_unavailable: Arc::default(),
             location_disk_space_low: Arc::new(AtomicBool::new(false)),
-            last_modified_ts_seconds: 0,
-            last_append_at_ns: 0,
+            last_modified_ts_seconds: AtomicU64::new(0),
             last_disk_check_ns: Arc::new(std::sync::atomic::AtomicI64::new(0)),
-            last_compact_index_offset: 0,
-            last_compact_revision: 0,
-            is_compacting: false,
-            compaction_byte_per_second: 0,
-            last_io_error: Mutex::new(None),
-            volume_info: PbVolumeInfo::default(),
-            has_remote_file: false,
+            is_compacting: Arc::new(AtomicBool::new(false)),
+            closed: AtomicBool::new(false),
+            compaction_byte_per_second: AtomicI64::new(0),
+            io_errors: Arc::default(),
+            volume_info: RwLock::new(PbVolumeInfo::default()),
         }
     }
 
+    /// Identifies this volume instance: a re-created or remounted volume gets
+    /// a new one, even at the same compaction revision.
+    pub(crate) fn instance(&self) -> Arc<DataFileAccessControl> {
+        self.data_file_access_control.clone()
+    }
+
+    /// The mutation/sync serializer, for callers that manage the access
+    /// lease themselves (the `_held` lifecycle paths). Same lock order as
+    /// everywhere else: sync lock first, then the write lease, then `io`.
+    pub(crate) fn data_file_sync_lock(&self) -> &std::sync::Mutex<()> {
+        &self.data_file_sync_lock
+    }
+
+    pub(crate) fn is_instance(&self, instance: &Arc<DataFileAccessControl>) -> bool {
+        Arc::ptr_eq(instance, &self.data_file_access_control)
+    }
+
     /// Returns true if the volume is currently being compacted.
     pub fn is_compacting(&self) -> bool {
-        self.is_compacting
+        self.is_compacting.load(Ordering::Acquire)
+    }
+
+    /// True once `close` ran: this handle is detached and any operation that
+    /// would change files must refuse it. A remounted volume is a different
+    /// `Volume`, so a stale `Arc` sees this set.
+    pub fn is_closed(&self) -> bool {
+        self.closed.load(Ordering::Acquire)
+    }
+
+    /// Go's noWriteLock pair as one atomic snapshot, so a reader never sees
+    /// one flag updated without the other: `(no_write_or_delete,
+    /// no_write_can_delete)`.
+    fn no_write_flags(&self) -> (bool, bool) {
+        let flags = self.no_write.load(Ordering::Acquire);
+        (
+            flags & NO_WRITE_OR_DELETE != 0,
+            flags & NO_WRITE_CAN_DELETE != 0,
+        )
+    }
+
+    fn set_no_write_flag(&self, flag: u8, on: bool) {
+        if on {
+            self.no_write.fetch_or(flag, Ordering::AcqRel);
+        } else {
+            self.no_write.fetch_and(!flag, Ordering::AcqRel);
+        }
+    }
+
+    /// A snapshot of the superblock (Go's superBlockAccessLock domain).
+    pub fn super_block(&self) -> SuperBlock {
+        self.super_block.read().unwrap().clone()
+    }
+
+    pub(crate) fn compacting_error(&self) -> VolumeError {
+        VolumeError::Io(io::Error::other(format!(
+            "volume {} is compacting",
+            self.id
+        )))
     }
 
     // ---- File naming (matching Go) ----
@@ -647,7 +1534,7 @@ impl Volume {
     }
 
     pub fn index_file_name(&self) -> String {
-        volume_file_name(&self.dir_idx, &self.collection, self.id)
+        volume_file_name(&self.dir_idx.read().unwrap(), &self.collection, self.id)
     }
 
     pub fn file_name(&self, ext: &str) -> String {
@@ -662,17 +1549,38 @@ impl Volume {
     }
 
     pub fn version(&self) -> Version {
-        if self.volume_info.version != 0 {
-            Version(self.volume_info.version as u8)
+        let version = self.volume_info.read().unwrap().version;
+        if version != 0 {
+            Version(version as u8)
         } else {
-            self.super_block.version
+            self.super_block.read().unwrap().version
         }
     }
 
     // ---- Loading ----
 
     fn load(
-        &mut self,
+        &self,
+        also_load_index: bool,
+        create_dat_if_missing: bool,
+        preallocate: u64,
+        version: Version,
+    ) -> Result<(), VolumeError> {
+        let mut io = self.io.write().unwrap();
+        self.load_io(
+            &mut io,
+            also_load_index,
+            create_dat_if_missing,
+            preallocate,
+            version,
+        )
+    }
+
+    /// `load` with the `self.io` write guard already held, for callers like
+    /// `commit_compact` that swap the data file under the guard.
+    fn load_io(
+        &self,
+        io: &mut VolumeIo,
         also_load_index: bool,
         create_dat_if_missing: bool,
         preallocate: u64,
@@ -681,48 +1589,70 @@ impl Volume {
         let dat_path = self.file_name(".dat");
         let mut already_has_super_block = false;
 
-        let has_volume_info_file = self.load_vif()?;
+        let has_volume_info_file = self.load_vif(io)?;
 
-        if self.volume_info.read_only && !self.has_remote_file {
-            self.no_write_or_delete = true;
+        {
+            let vi = self.volume_info.read().unwrap();
+            if vi.read_only && vi.files.is_empty() {
+                if vi.read_only_can_delete {
+                    self.set_no_write_flag(NO_WRITE_CAN_DELETE, true);
+                } else {
+                    self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+                }
+            }
         }
 
-        if self.has_remote_file {
-            self.load_remote_dat_file()?;
-            if let Some(remote_file) = self.volume_info.files.first() {
-                if remote_file.modified_time > 0 {
-                    self.last_modified_ts_seconds = remote_file.modified_time;
-                } else if let Ok(metadata) = fs::metadata(self.vif_path()) {
-                    self.last_modified_ts_seconds = metadata
+        if self.has_remote_file() {
+            self.load_remote_dat_file_io(io)?;
+            let modified_time = self
+                .volume_info
+                .read()
+                .unwrap()
+                .files
+                .first()
+                .map(|f| f.modified_time)
+                .unwrap_or(0);
+            if modified_time > 0 {
+                self.last_modified_ts_seconds
+                    .store(modified_time, Ordering::Relaxed);
+            } else if let Ok(metadata) = fs::metadata(self.vif_path()) {
+                self.last_modified_ts_seconds.store(
+                    metadata
                         .modified()
                         .unwrap_or(SystemTime::UNIX_EPOCH)
                         .duration_since(UNIX_EPOCH)
                         .unwrap_or_default()
-                        .as_secs();
-                }
+                        .as_secs(),
+                    Ordering::Relaxed,
+                );
             }
             already_has_super_block = true;
         } else if Path::new(&dat_path).exists() {
             let metadata = fs::metadata(&dat_path)?;
 
             // Try to open read-write; fall back to read-only
-            match OpenOptions::new().read(true).write(true).open(&dat_path) {
+            match open_volume_file(OpenOptions::new().read(true).write(true), &dat_path) {
                 Ok(file) => {
-                    self.dat_file = Some(file);
+                    io.dat_file = Some(file);
                 }
                 Err(e) if e.kind() == io::ErrorKind::PermissionDenied => {
-                    self.dat_file = Some(File::open(&dat_path)?);
-                    self.no_write_or_delete = true;
+                    io.dat_file = Some(open_volume_file(OpenOptions::new().read(true), &dat_path)?);
+                    self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
                 }
                 Err(e) => return Err(e.into()),
             }
 
-            self.last_modified_ts_seconds = metadata
-                .modified()
-                .unwrap_or(SystemTime::UNIX_EPOCH)
-                .duration_since(UNIX_EPOCH)
-                .unwrap_or_default()
-                .as_secs();
+            if !io.keep_last_modified_ts_on_load {
+                self.last_modified_ts_seconds.store(
+                    metadata
+                        .modified()
+                        .unwrap_or(SystemTime::UNIX_EPOCH)
+                        .duration_since(UNIX_EPOCH)
+                        .unwrap_or_default()
+                        .as_secs(),
+                    Ordering::Relaxed,
+                );
+            }
 
             if metadata.len() >= SUPER_BLOCK_SIZE as u64 {
                 already_has_super_block = true;
@@ -732,15 +1662,14 @@ impl Volume {
             if let Some(parent) = Path::new(&dat_path).parent() {
                 fs::create_dir_all(parent)?;
             }
-            let file = OpenOptions::new()
-                .read(true)
-                .write(true)
-                .create(true)
-                .open(&dat_path)?;
+            let file = open_volume_file(
+                OpenOptions::new().read(true).write(true).create(true),
+                &dat_path,
+            )?;
             if preallocate > 0 {
                 preallocate_file(&file, preallocate);
             }
-            self.dat_file = Some(file);
+            io.dat_file = Some(file);
         } else {
             return Err(VolumeError::Io(io::Error::new(
                 io::ErrorKind::NotFound,
@@ -749,15 +1678,16 @@ impl Volume {
         }
 
         if already_has_super_block {
-            match self.read_super_block() {
+            match self.read_super_block(io) {
                 Ok(()) => {
-                    if !self.super_block.version.is_supported() {
-                        return Err(VolumeError::UnsupportedVersion(self.super_block.version.0));
+                    let sb_version = self.super_block.read().unwrap().version;
+                    if !sb_version.is_supported() {
+                        return Err(VolumeError::UnsupportedVersion(sb_version.0));
                     }
                     // Match Go: v.volumeInfo.Version = uint32(v.SuperBlock.Version)
-                    self.volume_info.version = self.super_block.version.0 as u32;
+                    self.volume_info.write().unwrap().version = sb_version.0 as u32;
                 }
-                Err(e) if self.has_remote_file => {
+                Err(e) if self.has_remote_file() => {
                     warn!(
                         volume_id = self.id.0,
                         error = %e,
@@ -767,15 +1697,39 @@ impl Volume {
                 Err(e) => return Err(e),
             }
         } else {
-            self.maybe_write_super_block(version)?;
+            self.maybe_write_super_block(io, version)?;
         }
 
         if also_load_index {
+            // Adjust for existing volumes with .idx together with .dat files:
+            // an index already beside the data keeps serving after --dir.idx
+            // named a different directory.
+            if *self.dir_idx.read().unwrap() != self.dir
+                && Path::new(&format!("{}.idx", self.data_file_name())).exists()
+            {
+                *self.dir_idx.write().unwrap() = self.dir.clone();
+            }
+
+            // A changed --dir.idx leaves the new directory without an index.
+            // The .dat still holds every row, so rebuild rather than mount the
+            // volume with every needle invisible.
+            if !self.has_remote_file()
+                && !Path::new(&self.file_name(".idx")).exists()
+                && self.current_dat_file_size_io(io)? > SUPER_BLOCK_SIZE as u64
+            {
+                self.rebuild_idx_file()?;
+                info!(
+                    volume_id = self.id.0,
+                    idx = %self.file_name(".idx"),
+                    "rebuilt the index from the data file"
+                );
+            }
+
             // Recover rows that deletes on a tiered read-only volume overwrote
             // at the front of .idx. Best effort: a volume that cannot be
             // repaired is still servable for everything the surviving rows
             // index.
-            match self.repair_idx_head_tombstones() {
+            match self.repair_idx_head_tombstones(io) {
                 Ok(0) => {}
                 Ok(restored) => info!(
                     volume_id = self.id.0,
@@ -788,19 +1742,64 @@ impl Volume {
                 ),
             }
 
-            self.load_index()?;
+            // A crash between the .dat append and the .idx append leaves a
+            // .dat tail no index entry covers. Re-index complete needles and
+            // cut an incomplete remainder before the index loads, so the
+            // recovered rows land in the needle map and inside its append
+            // offset. Mirrors Go running repairUnindexedDatTail inside
+            // CheckVolumeDataIntegrity ahead of the needle map load. Only a
+            // volume about to load writable is repaired.
+            // A no_write_can_delete volume still appends tombstone records on
+            // delete, so it tears tails the same way and gets the same repair.
+            if !self.has_remote_file() && !self.no_write_flags().0 {
+                // An empty .idx gets the same repair: every check below
+                // skips an empty index on its own, so a tail the repair
+                // cannot explain there fails the load like in Go rather
+                // than warn and load writable.
+                let idx_empty = fs::metadata(self.file_name(".idx"))
+                    .map(|m| m.len() == 0)
+                    .unwrap_or(false);
+                match self.repair_unindexed_dat_tail(io) {
+                    Ok(()) => {}
+                    Err(e) if e.is_not_torn() && !idx_empty => warn!(
+                        volume_id = self.id.0,
+                        error = %e,
+                        "unindexed .dat tail not repaired"
+                    ),
+                    // The index refusing a read-write open is the same failure
+                    // Go reports opening it ahead of the check: it fails the
+                    // load rather than only the repair.
+                    Err(TailRepairError::OpenIndex(e)) => return Err(e),
+                    Err(e) => {
+                        // A repair that could not complete must not load the
+                        // volume writable on files it half-fixed: the check
+                        // fails as in Go, so the volume loads read-only.
+                        self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+                        warn!(
+                            volume_id = self.id.0,
+                            error = %e,
+                            "repair unindexed .dat tail"
+                        );
+                    }
+                }
+            }
+
+            self.load_index(io)?;
 
             // Match Go: CheckVolumeDataIntegrity after loading index (volume_loading.go L154-159)
             // Only for non-remote volumes (remote storage may not have local .dat)
-            if !self.has_remote_file {
-                if let Err(e) = self.check_volume_data_integrity() {
-                    self.no_write_or_delete = true;
+            if !self.has_remote_file() {
+                if let Err(e) = self.check_volume_data_integrity(io) {
+                    self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
                     warn!(
                         volume_id = self.id.0,
                         error = %e,
                         "volumeDataIntegrityChecking failed"
                     );
                 }
+                if !io.keep_last_modified_ts_on_load {
+                    self.recover_last_modified_ts(io);
+                }
 
                 // Structural check: no .idx entry may reference bytes past the
                 // end of .dat. The needle map's load walk above already
@@ -808,28 +1807,32 @@ impl Volume {
                 // — no extra disk I/O. A violation marks the volume read-only
                 // so vacuum doesn't silently drop reachable data based on a
                 // corrupt .idx left over from a crashed batched write.
-                // See issue #8928.
-                if let Some(ref nm) = self.nm {
-                    if let Ok(dat_size) = self.current_dat_file_size() {
-                        let max_end = nm.max_needle_end();
-                        if dat_size > 0 && max_end > dat_size as i64 {
-                            self.no_write_or_delete = true;
-                            warn!(
-                                volume_id = self.id.0,
-                                max_needle_end = max_end,
-                                dat_size,
-                                "idx references bytes past end of .dat; marking volume read-only"
-                            );
-                        }
+                if let Some(ref nm) = io.nm
+                    && let Ok(dat_size) = self.current_dat_file_size_io(io)
+                {
+                    let max_end = nm.max_needle_end();
+                    if dat_size > 0 && max_end > dat_size as i64 {
+                        self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+                        warn!(
+                            volume_id = self.id.0,
+                            max_needle_end = max_end,
+                            dat_size,
+                            "idx references bytes past end of .dat; marking volume read-only"
+                        );
                     }
                 }
             }
         }
 
+        self.restore_unavailable();
+
         // Match Go: if no .vif file existed, create one with version and bytes_offset
         if !has_volume_info_file {
-            self.volume_info.version = self.super_block.version.0 as u32;
-            self.volume_info.bytes_offset = OFFSET_SIZE as u32;
+            {
+                let mut vi = self.volume_info.write().unwrap();
+                vi.version = self.super_block.read().unwrap().version.0 as u32;
+                vi.bytes_offset = OFFSET_SIZE as u32;
+            }
             if let Err(e) = self.save_volume_info() {
                 warn!(
                     volume_id = self.id.0,
@@ -842,14 +1845,14 @@ impl Volume {
         Ok(())
     }
 
-    fn nm_or_not_found(&self) -> Result<&NeedleMap, VolumeError> {
-        self.nm.as_ref().ok_or_else(|| {
+    fn nm_or_not_found<'a>(&self, io: &'a VolumeIo) -> Result<&'a NeedleMap, VolumeError> {
+        io.nm.as_ref().ok_or_else(|| {
             tracing::warn!(volume_id = self.id.0, "needle map not loaded");
             VolumeError::NotFound
         })
     }
 
-    fn load_index(&mut self) -> Result<(), VolumeError> {
+    fn load_index(&self, io: &mut VolumeIo) -> Result<(), VolumeError> {
         let use_redb = matches!(
             self.needle_map_kind,
             NeedleMapKind::Redb | NeedleMapKind::RedbMedium | NeedleMapKind::RedbLarge
@@ -862,23 +1865,99 @@ impl Volume {
             fs::create_dir_all(parent)?;
         }
 
-        if use_redb {
-            self.load_index_redb(&idx_path)?;
+        // Go picks the sorted-file map for both read-only modes, which is every
+        // cloud-tiered volume: the index stays on disk in .sdx instead of in
+        // RAM, and nothing is held open between lookups.
+        if self.use_sorted_index() {
+            self.load_index_sorted_file(io, &idx_path)?;
+        } else if use_redb {
+            self.load_index_redb(io, &idx_path)?;
         } else {
-            self.load_index_inmemory(&idx_path)?;
+            self.load_index_inmemory(io, &idx_path)?;
         }
 
         Ok(())
     }
 
+    /// Whether this volume's index belongs in a `.sdx`. Mirrors Go's
+    /// `v.noWriteOrDelete || v.noWriteCanDelete` branch in volume_loading.go —
+    /// a tiered volume is always the second of the two.
+    fn use_sorted_index(&self) -> bool {
+        let (no_write_or_delete, no_write_can_delete) = self.no_write_flags();
+        no_write_or_delete || no_write_can_delete
+    }
+
+    /// Load the on-disk sorted index for a read-only or cloud-tiered volume.
+    fn load_index_sorted_file(&self, io: &mut VolumeIo, idx_path: &str) -> Result<(), VolumeError> {
+        if !Path::new(idx_path).exists() {
+            // Missing .idx with existing .dat could orphan needles
+            let dat_path = self.file_name(".dat");
+            if Path::new(&dat_path).exists() {
+                let dat_size = fs::metadata(&dat_path).map(|m| m.len()).unwrap_or(0);
+                if dat_size > SUPER_BLOCK_SIZE as u64 {
+                    warn!(
+                        volume_id = self.id.0,
+                        ".idx file missing but .dat exists with data; needles may be orphaned"
+                    );
+                }
+            }
+            // Go opens .idx with O_CREATE only where deletes are allowed; an
+            // empty index yields an empty .sdx and a volume that still mounts.
+            // A volume that takes neither writes nor deletes must not write
+            // here, since its index directory can sit on a read-only mount.
+            if !self.no_write_flags().0 {
+                File::create(idx_path)?;
+            }
+        }
+        // Building .sdx writes to the index directory. Where that cannot be
+        // done — a read-only mount, a full disk — keep this volume's index in
+        // memory rather than failing the load and taking its data offline.
+        match SortedFileNeedleMap::open(&self.index_file_name(), self.version()) {
+            Ok(nm) => {
+                io.nm = Some(NeedleMap::SortedFile(nm));
+                Ok(())
+            }
+            Err(e) => {
+                warn!(
+                    volume_id = self.id.0,
+                    error = %e,
+                    "cannot build the sorted index; keeping this volume's index in memory"
+                );
+                match self.load_index_inmemory(io, idx_path) {
+                    Ok(()) => Ok(()),
+                    // Where deletes are allowed the in-memory loader opens .idx
+                    // read-write, which fails on the same directory that just
+                    // refused the .sdx. Give up the deletes rather than the
+                    // volume: without a writer no tombstone could be recorded
+                    // anyway, so refusing them is the honest answer, and a
+                    // remount on a writable directory restores them.
+                    Err(retry_err) if !self.no_write_flags().0 => {
+                        warn!(
+                            volume_id = self.id.0,
+                            error = %retry_err,
+                            "cannot open the index for write; serving this volume without deletes"
+                        );
+                        // Deletes are gone with the writer, so stop advertising
+                        // them: leaving no_write_can_delete set would report
+                        // this volume as delete-capable in metrics and mode
+                        // checks while every delete is refused.
+                        self.no_write.store(NO_WRITE_OR_DELETE, Ordering::Release);
+                        self.load_index_inmemory(io, idx_path)
+                    }
+                    Err(retry_err) => Err(retry_err),
+                }
+            }
+        }
+    }
+
     /// Load index using in-memory CompactNeedleMap.
-    fn load_index_inmemory(&mut self, idx_path: &str) -> Result<(), VolumeError> {
-        if self.no_write_or_delete {
+    fn load_index_inmemory(&self, io: &mut VolumeIo, idx_path: &str) -> Result<(), VolumeError> {
+        if self.no_write_flags().0 {
             // Open read-only
             if Path::new(&idx_path).exists() {
-                let mut idx_file = File::open(&idx_path)?;
+                let mut idx_file = open_volume_file(OpenOptions::new().read(true), idx_path)?;
                 let nm = CompactNeedleMap::load_from_idx(&mut idx_file, self.version())?;
-                self.nm = Some(NeedleMap::InMemory(nm));
+                io.nm = Some(NeedleMap::InMemory(nm));
             } else {
                 // Missing .idx with existing .dat could orphan needles
                 let dat_path = self.file_name(".dat");
@@ -891,43 +1970,49 @@ impl Volume {
                         );
                     }
                 }
-                self.nm = Some(NeedleMap::InMemory(CompactNeedleMap::new()));
+                io.nm = Some(NeedleMap::InMemory(CompactNeedleMap::new()));
             }
         } else {
             // Open read-write (create if missing)
-            let idx_file = OpenOptions::new()
-                .read(true)
-                .write(true)
-                .create(true)
-                .open(&idx_path)?;
+            let idx_file = open_volume_file(
+                OpenOptions::new().read(true).write(true).create(true),
+                idx_path,
+            )?;
 
-            let idx_size = idx_file.metadata()?.len();
+            let idx_size = trim_torn_idx_tail(&idx_file, idx_path)?;
             let mut idx_reader = io::BufReader::new(&idx_file);
             let mut nm = CompactNeedleMap::load_from_idx(&mut idx_reader, self.version())?;
 
-            // Re-open for append-only writes
-            let write_file = OpenOptions::new()
-                .write(true)
-                .append(true)
-                .open(&idx_path)?;
+            // Re-open for positioned writes: rows are written at
+            // idx_file_offset so a torn tail can be trimmed (an append-mode
+            // handle cannot set_len on Windows).
+            let write_file = OpenOptions::new().write(true).open(idx_path)?;
             nm.set_idx_file(Box::new(write_file), idx_size);
-            self.nm = Some(NeedleMap::InMemory(nm));
+            io.nm = Some(NeedleMap::InMemory(nm));
         }
 
         Ok(())
     }
 
     /// Load index using disk-backed RedbNeedleMap.
-    fn load_index_redb(&mut self, idx_path: &str) -> Result<(), VolumeError> {
+    fn load_index_redb(&self, io: &mut VolumeIo, idx_path: &str) -> Result<(), VolumeError> {
         // The redb database file is stored alongside the volume files
         let rdb_path = self.file_name(".rdb");
+        // One redb database per volume: keep its page cache small, or the
+        // process grows by up to redb's 1 GiB default per volume (#11179).
+        let cache_bytes = self.needle_map_kind.redb_cache_bytes();
 
-        if self.no_write_or_delete {
+        if self.no_write_flags().0 {
             // Open read-only
             if Path::new(&idx_path).exists() {
-                let mut idx_file = File::open(&idx_path)?;
-                let nm = RedbNeedleMap::load_from_idx(&rdb_path, &mut idx_file, self.version())?;
-                self.nm = Some(NeedleMap::Redb(nm));
+                let mut idx_file = open_volume_file(OpenOptions::new().read(true), idx_path)?;
+                let nm = RedbNeedleMap::load_from_idx(
+                    &rdb_path,
+                    &mut idx_file,
+                    self.version(),
+                    cache_bytes,
+                )?;
+                io.nm = Some(NeedleMap::Redb(nm));
             } else {
                 // Missing .idx with existing .dat could orphan needles
                 let dat_path = self.file_name(".dat");
@@ -940,33 +2025,43 @@ impl Volume {
                         );
                     }
                 }
-                self.nm = Some(NeedleMap::Redb(RedbNeedleMap::new(&rdb_path)?));
+                io.nm = Some(NeedleMap::Redb(RedbNeedleMap::new(&rdb_path, cache_bytes)?));
             }
         } else {
             // Open read-write (create if missing)
-            let idx_file = OpenOptions::new()
-                .read(true)
-                .write(true)
-                .create(true)
-                .open(&idx_path)?;
+            let idx_file = open_volume_file(
+                OpenOptions::new().read(true).write(true).create(true),
+                idx_path,
+            )?;
 
-            let idx_size = idx_file.metadata()?.len();
+            let idx_size = trim_torn_idx_tail(&idx_file, idx_path)?;
             let mut idx_reader = io::BufReader::new(&idx_file);
-            let mut nm = RedbNeedleMap::load_from_idx(&rdb_path, &mut idx_reader, self.version())?;
+            let mut nm = RedbNeedleMap::load_from_idx(
+                &rdb_path,
+                &mut idx_reader,
+                self.version(),
+                cache_bytes,
+            )?;
 
-            // Re-open for append-only writes
-            let write_file = OpenOptions::new()
-                .write(true)
-                .append(true)
-                .open(&idx_path)?;
+            // Re-open for positioned writes: rows are written at
+            // idx_file_offset so a torn tail can be trimmed (an append-mode
+            // handle cannot set_len on Windows).
+            let write_file = OpenOptions::new().write(true).open(idx_path)?;
             nm.set_idx_file(Box::new(write_file), idx_size);
-            self.nm = Some(NeedleMap::Redb(nm));
+            io.nm = Some(NeedleMap::Redb(nm));
         }
 
         Ok(())
     }
 
-    pub(crate) fn load_remote_dat_file(&mut self) -> Result<(), VolumeError> {
+    pub(crate) fn load_remote_dat_file(&self) -> Result<(), VolumeError> {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        let mut io = self.io.write().unwrap();
+        self.load_remote_dat_file_io(&mut io)
+    }
+
+    fn load_remote_dat_file_io(&self, io: &mut VolumeIo) -> Result<(), VolumeError> {
         let (storage_name, storage_key) = self.remote_storage_name_key();
         let backend = crate::remote_storage::s3_tier::global_s3_tier_registry()
             .read()
@@ -979,75 +2074,78 @@ impl Volume {
                 ))
             })?;
 
-        let remote_file = self.volume_info.files.first().ok_or_else(|| {
-            VolumeError::Io(io::Error::new(
-                io::ErrorKind::NotFound,
-                "remote volume has no remote file entries",
-            ))
-        })?;
+        let (file_size, modified_time) = {
+            let vi = self.volume_info.read().unwrap();
+            let remote_file = vi.files.first().ok_or_else(|| {
+                VolumeError::Io(io::Error::new(
+                    io::ErrorKind::NotFound,
+                    "remote volume has no remote file entries",
+                ))
+            })?;
 
-        let file_size = if remote_file.file_size > 0 {
-            remote_file.file_size
-        } else if self.volume_info.dat_file_size > 0 {
-            self.volume_info.dat_file_size as u64
-        } else {
-            return Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::InvalidData,
-                format!("remote volume {} is missing file size metadata", self.id.0),
-            )));
+            let file_size = if remote_file.file_size > 0 {
+                remote_file.file_size
+            } else if vi.dat_file_size > 0 {
+                vi.dat_file_size as u64
+            } else {
+                return Err(VolumeError::Io(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!("remote volume {} is missing file size metadata", self.id.0),
+                )));
+            };
+            (file_size, remote_file.modified_time)
         };
 
-        self.dat_file = None;
-        self.remote_dat_file = Some(RemoteDatFile {
+        io.dat_file = None;
+        io.remote_dat_file = Some(RemoteDatFile {
             backend,
             key: storage_key,
             file_size,
-            modified_time: remote_file.modified_time,
+            modified_time,
         });
         Ok(())
     }
 
+    /// Read `buf` from the data backend. The caller must hold the `self.io`
+    /// guard (Go's dataFileAccessLock) and pass it through — std RwLock is
+    /// not reentrant, so re-acquiring here would deadlock.
     pub(crate) fn read_exact_at_backend(
         &self,
+        io: &VolumeIo,
         buf: &mut [u8],
         offset: u64,
     ) -> Result<(), VolumeError> {
-        if let Some(dat_file) = self.dat_file.as_ref() {
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::FileExt;
-                dat_file.read_exact_at(buf, offset)?;
-            }
-            #[cfg(windows)]
-            {
-                read_exact_at(dat_file, buf, offset)?;
-            }
-            #[cfg(not(any(unix, windows)))]
-            {
-                compile_error!("Platform not supported: only unix and windows are supported");
-            }
+        if let Some(dat_file) = io.dat_file.as_ref() {
+            read_exact_at(dat_file, buf, offset)?;
             Ok(())
-        } else if let Some(remote_dat_file) = self.remote_dat_file.as_ref() {
+        } else if let Some(remote_dat_file) = io.remote_dat_file.as_ref() {
             remote_dat_file.read_exact_at(buf, offset)?;
             Ok(())
         } else {
-            Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                "dat file not open",
-            )))
+            Err(VolumeError::Io(io::Error::other("dat file not open")))
         }
     }
 
     /// Returns true when the volume has a data backend (local .dat file or
     /// remote tiered storage).  Mirrors Go's `v.DataBackend != nil` check.
     pub fn has_data_backend(&self) -> bool {
-        self.dat_file.is_some() || self.remote_dat_file.is_some()
+        let io = self.io.read().unwrap();
+        self.has_data_backend_io(&io)
     }
 
-    fn current_dat_file_size(&self) -> io::Result<u64> {
-        if let Some(ref f) = self.dat_file {
+    pub(crate) fn has_data_backend_io(&self, io: &VolumeIo) -> bool {
+        io.dat_file.is_some() || io.remote_dat_file.is_some()
+    }
+
+    pub(crate) fn current_dat_file_size(&self) -> io::Result<u64> {
+        let io = self.io.read().unwrap();
+        self.current_dat_file_size_io(&io)
+    }
+
+    pub(crate) fn current_dat_file_size_io(&self, io: &VolumeIo) -> io::Result<u64> {
+        if let Some(ref f) = io.dat_file {
             Ok(f.metadata()?.len())
-        } else if let Some(ref remote_dat_file) = self.remote_dat_file {
+        } else if let Some(ref remote_dat_file) = io.remote_dat_file {
             Ok(remote_dat_file.file_size)
         } else {
             Ok(0)
@@ -1060,30 +2158,34 @@ impl Volume {
     /// remote-only tiered volumes whose `.dat` is no longer present locally.
     pub fn read_dat_slice(&self, offset: u64, size: usize) -> Result<Vec<u8>, VolumeError> {
         let _guard = self.data_file_access_control.read_lock();
-        let dat_size = self.current_dat_file_size()?;
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        let io = self.io.read().unwrap();
+        let dat_size = self.current_dat_file_size_io(&io)?;
         if size == 0 || offset >= dat_size {
             return Ok(Vec::new());
         }
 
         let read_len = std::cmp::min(size as u64, dat_size - offset) as usize;
         let mut buf = vec![0u8; read_len];
-        self.read_exact_at_backend(&mut buf, offset)?;
+        self.read_exact_at_backend(&io, &mut buf, offset)?;
         Ok(buf)
     }
 
     /// Clone the remote backend handle (cheap: an `Arc` plus key/size) so a
     /// caller can stream a tiered `.dat` from S3 after dropping the store lock.
-    /// Returns `None` for local volumes. `has_remote_file` implies `dat_file`
+    /// Returns `None` for local volumes. `has_remote_file()` implies `dat_file`
     /// is `None`, so this selects the same backend `read_dat_slice` would.
     pub(crate) fn remote_dat_file(&self) -> Option<RemoteDatFile> {
-        self.remote_dat_file.clone()
+        self.io.read().unwrap().remote_dat_file.clone()
     }
 
     // ---- SuperBlock I/O ----
 
-    fn read_super_block(&mut self) -> Result<(), VolumeError> {
+    fn read_super_block(&self, io: &VolumeIo) -> Result<(), VolumeError> {
         let mut header = [0u8; SUPER_BLOCK_SIZE];
-        self.read_exact_at_backend(&mut header, 0)?;
+        self.read_exact_at_backend(io, &mut header, 0)?;
 
         let extra_size = u16::from_be_bytes([header[6], header[7]]);
         let total_size = SUPER_BLOCK_SIZE + extra_size as usize;
@@ -1091,32 +2193,45 @@ impl Volume {
         let mut full_buf = vec![0u8; total_size];
         full_buf[..SUPER_BLOCK_SIZE].copy_from_slice(&header);
         if extra_size > 0 {
-            self.read_exact_at_backend(&mut full_buf[SUPER_BLOCK_SIZE..], SUPER_BLOCK_SIZE as u64)?;
+            self.read_exact_at_backend(
+                io,
+                &mut full_buf[SUPER_BLOCK_SIZE..],
+                SUPER_BLOCK_SIZE as u64,
+            )?;
         }
 
-        self.super_block = SuperBlock::from_bytes(&full_buf)?;
+        *self.super_block.write().unwrap() = SuperBlock::from_bytes(&full_buf)?;
 
         // Match Go: if volumeInfo.Replication is set, override super block's ReplicaPlacement
-        if !self.volume_info.replication.is_empty() {
-            let rp = ReplicaPlacement::from_string(&self.volume_info.replication)?;
-            self.super_block.replica_placement = rp;
+        let replication = self.volume_info.read().unwrap().replication.clone();
+        if !replication.is_empty() {
+            let rp = ReplicaPlacement::from_string(&replication)?;
+            self.super_block.write().unwrap().replica_placement = rp;
         }
 
         Ok(())
     }
 
-    fn maybe_write_super_block(&mut self, version: Version) -> Result<(), VolumeError> {
-        let dat_file = self.dat_file.as_mut().ok_or_else(|| {
-            VolumeError::Io(io::Error::new(io::ErrorKind::Other, "dat file not open"))
-        })?;
+    fn maybe_write_super_block(
+        &self,
+        io: &mut VolumeIo,
+        version: Version,
+    ) -> Result<(), VolumeError> {
+        let dat_file = io
+            .dat_file
+            .as_mut()
+            .ok_or_else(|| VolumeError::Io(io::Error::other("dat file not open")))?;
 
         let dat_size = dat_file.metadata()?.len();
         if dat_size == 0 {
             if !version.is_supported() {
                 return Err(VolumeError::UnsupportedVersion(version.0));
             }
-            self.super_block.version = version;
-            let bytes = self.super_block.to_bytes();
+            let bytes = {
+                let mut sb = self.super_block.write().unwrap();
+                sb.version = version;
+                sb.to_bytes()
+            };
             dat_file.seek(SeekFrom::Start(0))?;
             dat_file.write_all(&bytes)?;
             dat_file.sync_all()?;
@@ -1146,8 +2261,12 @@ impl Volume {
         read_option: &mut ReadOption,
     ) -> Result<i32, VolumeError> {
         let _guard = self.data_file_access_control.read_lock();
-        let nm = self.nm_or_not_found()?;
-        let nv = nm.get(n.id).ok_or(VolumeError::NotFound)?;
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        let io = self.io.read().unwrap();
+        let nm = self.nm_or_not_found(&io)?;
+        let nv = nm.get(n.id)?.ok_or(VolumeError::NotFound)?;
 
         if nv.offset.is_zero() {
             return Err(VolumeError::NotFound);
@@ -1166,7 +2285,29 @@ impl Volume {
             return Ok(0);
         }
 
-        match self.read_needle_data_at_unlocked(n, nv.offset.to_actual_offset(), read_size, read_option) {
+        // With `must_meta_only`, read the header and trailer first. If the
+        // needle is compressed or is a chunk manifest, the caller needs its
+        // data, so read the payload as well.
+        //
+        // A version 1 needle has no data size field and no metadata after its
+        // data, so the metadata reader would treat the whole payload as
+        // metadata. It is always read in full.
+        let offset = nv.offset.to_actual_offset();
+        // `is_meta_only` is a result: clear it in case the option is reused.
+        read_option.is_meta_only = false;
+        let meta_first = read_option.must_meta_only && self.version() != VERSION_1;
+        let mut read = if meta_first {
+            self.read_needle_meta_at_unlocked(&io, n, offset, read_size)
+        } else {
+            Ok(())
+        };
+        if read.is_ok() && meta_first && !n.is_compressed() && !n.is_chunk_manifest() {
+            read_option.is_meta_only = true;
+        }
+        if read.is_ok() && !read_option.is_meta_only {
+            read = self.read_needle_data_at_unlocked(&io, n, offset, read_size, read_option);
+        }
+        match read {
             Ok(()) => self.check_read_write_error(None),
             Err(VolumeError::Io(ref e)) => {
                 self.check_read_write_error(Some(e));
@@ -1175,21 +2316,8 @@ impl Volume {
             Err(e) => return Err(e),
         }
 
-        // TTL expiry check
-        if n.has_ttl() {
-            if let Some(ref ttl) = n.ttl {
-                let ttl_minutes = ttl.minutes();
-                if ttl_minutes > 0 && n.has_last_modified_date() {
-                    let expire_at_ns = n.append_at_ns + (ttl_minutes as u64) * 60 * 1_000_000_000;
-                    let now_ns = SystemTime::now()
-                        .duration_since(UNIX_EPOCH)
-                        .unwrap_or_default()
-                        .as_nanos() as u64;
-                    if now_ns >= expire_at_ns {
-                        return Err(VolumeError::NotFound);
-                    }
-                }
-            }
+        if needle_expired(n) {
+            return Err(VolumeError::NotFound);
         }
 
         Ok(n.data_size as i32)
@@ -1203,58 +2331,58 @@ impl Volume {
         size: Size,
     ) -> Result<(), VolumeError> {
         let _guard = self.data_file_access_control.read_lock();
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        let io = self.io.read().unwrap();
         let mut read_option = ReadOption::default();
-        self.read_needle_data_at_unlocked(n, offset, size, &mut read_option)
+        self.read_needle_data_at_unlocked(&io, n, offset, size, &mut read_option)
     }
 
     fn read_needle_data_at_unlocked(
         &self,
+        io: &VolumeIo,
         n: &mut Needle,
         offset: i64,
         size: Size,
         _read_option: &mut ReadOption,
     ) -> Result<(), VolumeError> {
-        match self.read_needle_blob_and_parse(n, offset, size) {
-            Ok(()) => Ok(()),
-            #[cfg(not(feature = "5bytes"))]
-            Err(VolumeError::Needle(NeedleError::SizeMismatch { offset: o, .. }))
-                if o < MAX_POSSIBLE_VOLUME_SIZE as i64 =>
-            {
-                // Double-read: in 4-byte offset mode, the actual data may be
-                // beyond 32GB due to offset wrapping. Retry at offset + 32GB.
-                self.read_needle_blob_and_parse(n, offset + MAX_POSSIBLE_VOLUME_SIZE as i64, size)
-            }
-            Err(e) => Err(e),
-        }
-    }
-
-    fn read_needle_blob_and_parse(
-        &self,
-        n: &mut Needle,
-        offset: i64,
-        size: Size,
-    ) -> Result<(), VolumeError> {
-        let version = self.version();
-        let actual_size = get_actual_size(size, version);
-
-        let mut buf = vec![0u8; actual_size as usize];
-        self.read_exact_at_backend(&mut buf, offset as u64)?;
-
-        n.read_bytes(&mut buf, offset, size, version)?;
-        Ok(())
+        read_needle_with(
+            |buf, at| self.read_exact_at_backend(io, buf, at),
+            n,
+            offset,
+            size,
+            self.version(),
+        )
     }
 
     /// Read raw needle blob at a specific offset.
     pub fn read_needle_blob(&self, offset: i64, size: Size) -> Result<Vec<u8>, VolumeError> {
         let _guard = self.data_file_access_control.read_lock();
-        self.read_needle_blob_unlocked(offset, size)
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        let io = self.io.read().unwrap();
+        self.read_needle_blob_unlocked(&io, offset, size)
     }
 
-    fn read_needle_blob_unlocked(&self, offset: i64, size: Size) -> Result<Vec<u8>, VolumeError> {
+    pub(crate) fn read_needle_blob_unlocked(
+        &self,
+        io: &VolumeIo,
+        offset: i64,
+        size: Size,
+    ) -> Result<Vec<u8>, VolumeError> {
         let version = self.version();
+        // Storage guard: negativity-only (Go parity). See parse_needle_at.
+        if size.0 < 0 {
+            return Err(VolumeError::Io(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("invalid needle size {}", size.0),
+            )));
+        }
         let actual_size = get_actual_size(size, version);
         let mut buf = vec![0u8; actual_size as usize];
-        self.read_exact_at_backend(&mut buf, offset as u64)?;
+        self.read_exact_at_backend(io, &mut buf, offset as u64)?;
 
         Ok(buf)
     }
@@ -1271,45 +2399,43 @@ impl Volume {
         size: Size,
     ) -> Result<(), VolumeError> {
         let _guard = self.data_file_access_control.read_lock();
-        self.read_needle_meta_at_unlocked(n, offset, size)
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        let io = self.io.read().unwrap();
+        self.read_needle_meta_at_unlocked(&io, n, offset, size)
     }
 
     fn read_needle_meta_at_unlocked(
         &self,
+        io: &VolumeIo,
         n: &mut Needle,
         offset: i64,
         size: Size,
     ) -> Result<(), VolumeError> {
         let normalized_size = if size.is_deleted() { Size(0) } else { size };
-        match self.read_needle_meta_blob_and_parse(n, offset, normalized_size) {
-            Ok(()) => Ok(()),
-            #[cfg(not(feature = "5bytes"))]
-            Err(VolumeError::Needle(NeedleError::SizeMismatch { offset: o, .. }))
-                if o < MAX_POSSIBLE_VOLUME_SIZE as i64 =>
-            {
-                self.read_needle_meta_blob_and_parse(
-                    n,
-                    offset + MAX_POSSIBLE_VOLUME_SIZE as i64,
-                    normalized_size,
-                )
-            }
-            Err(e) => Err(e),
-        }
+        let read_at = |buf: &mut [u8], at: u64| self.read_exact_at_backend(io, buf, at);
+        let version = self.version();
+        let mut offset = offset;
+        with_offset_retry(&mut offset, |off| {
+            Self::read_needle_meta_blob_and_parse(read_at, n, off, normalized_size, version)
+        })
     }
 
     fn read_needle_meta_blob_and_parse(
-        &self,
+        read_at: impl Fn(&mut [u8], u64) -> Result<(), VolumeError>,
         n: &mut Needle,
         offset: i64,
         size: Size,
+        version: Version,
     ) -> Result<(), VolumeError> {
-        let version = self.version();
-
         // Step 1: Read only the first 20 bytes (header + DataSize).
         // Matches Go's ReadNeedleMeta which reads NeedleHeaderSize+DataSizeSize first.
         const HEADER_PREFIX: usize = NEEDLE_HEADER_SIZE + DATA_SIZE_SIZE; // 20
         let mut header_buf = [0u8; HEADER_PREFIX];
-        self.read_exact_at_backend(&mut header_buf, offset as u64)?;
+        #[cfg(test)]
+        needle_read_hook::fire(n.id, header_buf.len());
+        read_at(&mut header_buf, offset as u64)?;
 
         // Parse header to get the needle's Size field for validation
         let (_, _, found_size) = Needle::parse_header(&header_buf);
@@ -1328,7 +2454,7 @@ impl Volume {
         if size.0 == 0 || version == VERSION_1 {
             // Tombstone or V1: no body data section, tail starts right after header
             let meta_size = actual_size - NEEDLE_HEADER_SIZE as i64;
-            if meta_size < 0 || meta_size > 128 * 1024 {
+            if !(0..=128 * 1024).contains(&meta_size) {
                 return Err(VolumeError::Io(io::Error::new(
                     io::ErrorKind::InvalidData,
                     format!(
@@ -1338,10 +2464,9 @@ impl Volume {
                 )));
             }
             let mut meta_buf = vec![0u8; meta_size as usize];
-            self.read_exact_at_backend(
-                &mut meta_buf,
-                (offset + NEEDLE_HEADER_SIZE as i64) as u64,
-            )?;
+            #[cfg(test)]
+            needle_read_hook::fire(n.id, meta_buf.len());
+            read_at(&mut meta_buf, (offset + NEEDLE_HEADER_SIZE as i64) as u64)?;
             n.read_paged_meta(&header_buf, &meta_buf, offset, size, version)?;
         } else {
             // V2/V3: extract DataSize from bytes 16..20
@@ -1359,7 +2484,7 @@ impl Volume {
             let meta_size = stop_offset - start_offset;
 
             // Sanity check: reject metadata sizes > 128KB (matching Go's ReadNeedleMeta guard)
-            if meta_size < 0 || meta_size > 128 * 1024 {
+            if !(0..=128 * 1024).contains(&meta_size) {
                 return Err(VolumeError::Io(io::Error::new(
                     io::ErrorKind::InvalidData,
                     format!(
@@ -1371,174 +2496,430 @@ impl Volume {
 
             // Step 3: Read only the meta tail (skip the data payload entirely)
             let mut meta_buf = vec![0u8; meta_size as usize];
-            self.read_exact_at_backend(&mut meta_buf, start_offset as u64)?;
+            #[cfg(test)]
+            needle_read_hook::fire(n.id, meta_buf.len());
+            read_at(&mut meta_buf, start_offset as u64)?;
             n.read_paged_meta(&header_buf, &meta_buf, offset, size, version)?;
         }
 
         Ok(())
     }
 
-    /// Read needle metadata (header + flags/name/mime/etc) without loading the data payload,
-    /// and return a `NeedleStreamInfo` that can be used to stream data directly from the dat file.
-    ///
-    /// This is used for large needles to avoid loading the entire payload into memory.
-    pub fn read_needle_stream_info(
+    /// Resolve a needle read under the caller's store guard, without data I/O.
+    pub(crate) fn needle_read_plan(
         &self,
-        n: &mut Needle,
+        id: NeedleId,
         read_deleted: bool,
-    ) -> Result<NeedleStreamInfo, VolumeError> {
-        let _guard = self.data_file_access_control.read_lock();
-        let nm = self.nm_or_not_found()?;
-        let nv = nm.get(n.id).ok_or(VolumeError::NotFound)?;
+    ) -> Result<NeedleReadPlan, VolumeError> {
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        let io = self.io.read().unwrap();
+        let nm = self.nm_or_not_found(&io)?;
+        let nv = nm.get(id)?.ok_or(VolumeError::NotFound)?;
 
         if nv.offset.is_zero() {
             return Err(VolumeError::NotFound);
         }
 
-        let mut read_size = nv.size;
-        if read_size.is_deleted() {
-            if read_deleted && !read_size.is_tombstone() {
-                read_size = Size(-read_size.0);
+        let mut size = nv.size;
+        if size.is_deleted() {
+            if read_deleted && !size.is_tombstone() {
+                debug!("reading deleted {}", id);
+                crate::metrics::HANDLER_COUNTER
+                    .with_label_values(&[crate::metrics::READ_DELETED_NEEDLE])
+                    .inc();
+                size = Size(-size.0);
             } else {
                 return Err(VolumeError::Deleted);
             }
         }
-        if read_size.0 == 0 {
+        if size.0 == 0 {
             return Err(VolumeError::NotFound);
         }
 
-        #[cfg_attr(feature = "5bytes", allow(unused_mut))]
-        let mut offset = nv.offset.to_actual_offset();
-        let version = self.version();
-        let actual_size = get_actual_size(read_size, version);
-
-        // Read the full needle bytes (including data) for metadata parsing.
-        // We use read_bytes_meta_only which skips copying the data payload.
-        #[cfg_attr(feature = "5bytes", allow(unused_mut))]
-        let mut read_and_parse = |off: i64| -> Result<(), VolumeError> {
-            let mut buf = vec![0u8; actual_size as usize];
-            self.read_exact_at_backend(&mut buf, off as u64)?;
-            n.read_bytes_meta_only(&mut buf, off, read_size, version)?;
-            Ok(())
-        };
-
-        match read_and_parse(offset) {
-            Ok(()) => {}
-            #[cfg(not(feature = "5bytes"))]
-            Err(VolumeError::Needle(NeedleError::SizeMismatch { offset: o, .. }))
-                if o < MAX_POSSIBLE_VOLUME_SIZE as i64 =>
-            {
-                offset += MAX_POSSIBLE_VOLUME_SIZE as i64;
-                read_and_parse(offset)?;
-            }
-            Err(e) => return Err(e),
-        }
-
-        // TTL expiry check
-        if n.has_ttl() {
-            if let Some(ref ttl) = n.ttl {
-                let ttl_minutes = ttl.minutes();
-                if ttl_minutes > 0 && n.has_last_modified_date() {
-                    let expire_at_ns = n.append_at_ns + (ttl_minutes as u64) * 60 * 1_000_000_000;
-                    let now_ns = SystemTime::now()
-                        .duration_since(UNIX_EPOCH)
-                        .unwrap_or_default()
-                        .as_nanos() as u64;
-                    if now_ns >= expire_at_ns {
-                        return Err(VolumeError::NotFound);
-                    }
-                }
-            }
-        }
-
-        // For V1, data starts right after the header
-        // For V2/V3, data starts at header + 4 (DataSize field)
-        let data_file_offset = if version == VERSION_1 {
-            offset as u64 + NEEDLE_HEADER_SIZE as u64
-        } else {
-            offset as u64 + NEEDLE_HEADER_SIZE as u64 + 4 // skip DataSize (4 bytes)
-        };
-
-        let source = match (self.dat_file.as_ref(), self.remote_dat_file.as_ref()) {
-            (Some(dat_file), _) => NeedleStreamSource::Local(
-                dat_file.try_clone().map_err(VolumeError::Io)?,
-            ),
-            (None, Some(remote_dat_file)) => NeedleStreamSource::Remote(remote_dat_file.clone()),
-            (None, None) => return Err(VolumeError::StreamingUnsupported),
-        };
-
-        Ok(NeedleStreamInfo {
-            source,
-            data_file_offset,
-            data_size: n.data_size,
+        Ok(NeedleReadPlan {
+            source: self.read_source(&io)?,
+            offset: nv.offset.to_actual_offset(),
+            size,
+            version: self.version(),
+            needle_id: id,
             data_file_access_control: self.data_file_access_control.clone(),
-            volume_id: self.id,
-            needle_id: n.id,
-            compaction_revision: self.super_block.compaction_revision,
+            io_errors: self.io_errors.clone(),
+            io_unavailable: self.io_unavailable.clone(),
         })
     }
 
-    /// Re-lookup a needle's data-file offset after compaction may have moved it.
-    ///
-    /// Returns `(new_data_file_offset, current_compaction_revision)` or an error
-    /// if the needle is no longer present / has been deleted.
-    ///
-    /// This matches Go's `readNeedleDataInto` behaviour: when the volume's
-    /// `CompactionRevision` changes between streaming chunks, the needle offset
-    /// is re-read from the needle map because compaction may have relocated it.
-    pub fn re_lookup_needle_data_offset(
-        &self,
-        needle_id: NeedleId,
-    ) -> Result<(u64, u16), VolumeError> {
-        let nm = self.nm_or_not_found()?;
-        let nv = nm.get(needle_id).ok_or(VolumeError::NotFound)?;
-        if nv.offset.is_zero() {
-            return Err(VolumeError::NotFound);
-        }
-        if nv.size.is_deleted() {
-            return Err(VolumeError::Deleted);
-        }
-
-        let offset = nv.offset.to_actual_offset();
-        let version = self.version();
-
-        let data_file_offset = if version == VERSION_1 {
-            offset as u64 + NEEDLE_HEADER_SIZE as u64
+    /// A read handle on the data backend that stays valid without the guard.
+    fn read_source(&self, io: &VolumeIo) -> Result<NeedleStreamSource, VolumeError> {
+        if io.dat_file.is_some() {
+            // A fresh open, not `try_clone`: a duplicated handle shares the
+            // file position, and on Windows `read_exact_at` goes through
+            // `seek_read`, which moves it under a concurrent append. Opened
+            // while the caller's io guard excludes a vacuum swap, the path
+            // names the inode `dat_file` holds.
+            Ok(NeedleStreamSource::Local(open_volume_file(
+                OpenOptions::new().read(true),
+                self.file_name(".dat"),
+            )?))
+        } else if let Some(remote) = io.remote_dat_file.clone() {
+            Ok(NeedleStreamSource::Remote(remote))
         } else {
-            offset as u64 + NEEDLE_HEADER_SIZE as u64 + 4 // skip DataSize (4 bytes)
-        };
-
-        Ok((data_file_offset, self.super_block.compaction_revision))
+            Err(VolumeError::Io(io::Error::other("dat file not open")))
+        }
     }
 
     // ---- Write ----
 
     /// Write a needle to the volume (synchronous path).
+    ///
+    /// With `fsync` the write is only reported successful once both the .dat
+    /// record and the .idx row that indexes it are on disk, so an ack survives a
+    /// crash rather than sitting in the page cache. The two flushes fail
+    /// differently: a failed .dat flush happens before anything is published, so
+    /// it takes its own append back off the end and nobody else's, while a
+    /// failed .idx flush cannot be undone and stops the volume taking writes.
     pub fn write_needle(
-        &mut self,
+        &self,
         n: &mut Needle,
         check_cookie: bool,
+        fsync: bool,
     ) -> Result<(u64, Size, bool), VolumeError> {
-        let _guard = self.data_file_access_control.write_lock();
-        if self.is_read_only() {
-            return Err(VolumeError::ReadOnly);
+        // A single write is a one-entry run of the grouped path: identical
+        // outcome, and the fsync handling lives in one place.
+        debug_assert!(check_cookie, "every write_needle caller checks the cookie");
+        let _ = check_cookie;
+        let mut writes = [(std::mem::take(n), fsync)];
+        let mut results = self.write_needles_grouped(&mut writes);
+        *n = std::mem::replace(&mut writes[0].0, Needle::default());
+        results.pop().unwrap_or(Err(VolumeError::NotFound))
+    }
+
+    /// Write a batch of needles the way Go's processBatch does: one .dat
+    /// sync and one .idx sync per run of distinct needle ids that holds a
+    /// durable write, instead of two per durable needle. Nothing in such a
+    /// run is published before its sync, so a failed sync takes the whole
+    /// run back off the .dat and fails every entry. A durable entry that
+    /// fails to index stops the volume taking writes, and the entries after
+    /// it in the run are refused read only. A repeated id starts a new run,
+    /// so its dedup and cookie checks see the earlier write.
+    pub fn write_needles_grouped(
+        &self,
+        writes: &mut [(Needle, bool)],
+    ) -> Vec<Result<(u64, Size, bool), VolumeError>> {
+        // The sync lock serializes a .dat mutation with the flush that makes
+        // it durable: a failed sync's rollback can never clobber an append
+        // that slipped in behind it, and a compaction swap or unlink cannot
+        // land between the append and its sync. Readers never take it, and
+        // the write-side guards are dropped for the sync itself, so reads of
+        // this volume do not wait on fsync.
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let mut results = Vec::with_capacity(writes.len());
+        let mut rest = writes;
+        while !rest.is_empty() {
+            let mut ids = HashSet::new();
+            let len = rest.iter().take_while(|(n, _)| ids.insert(n.id)).count();
+            let (run, tail) = std::mem::take(&mut rest).split_at_mut(len);
+            if run.iter().any(|(_, fsync)| *fsync) {
+                results.extend(self.write_synced_run(run));
+            } else {
+                let _guard = self.data_file_access_control.write_lock();
+                let mut io = self.io.write().unwrap();
+                for (n, _) in run.iter_mut() {
+                    results.push(
+                        self.check_writable()
+                            .and_then(|()| self.do_write_request(&mut io, n, true, false)),
+                    );
+                }
+            }
+            rest = tail;
+        }
+        results
+    }
+
+    fn write_synced_run(
+        &self,
+        run: &mut [(Needle, bool)],
+    ) -> Vec<Result<(u64, Size, bool), VolumeError>> {
+        // Per entry: Some(offset) once appended, None when it dedups.
+        let mut staged = Vec::with_capacity(run.len());
+        // Per entry: the I/O error streak once it is staged, where a write
+        // sent on its own would have recorded its success.
+        let mut marks = Vec::with_capacity(run.len());
+        let mut last_append_at_ns;
+        let mut run_start = None;
+        let mut sync = false;
+        {
+            // Append under the write guards, then drop them for the flush:
+            // readers need only `io`'s read side, while mutators and a
+            // compaction swap stay excluded by the caller's sync lock.
+            let _guard = self.data_file_access_control.write_lock();
+            let mut io = self.io.write().unwrap();
+            last_append_at_ns = io.last_append_at_ns;
+            for (n, fsync) in run.iter_mut() {
+                let r = self.append_unpublished(&mut io, n, &mut last_append_at_ns);
+                marks.push(self.io_errors.mark());
+                if let Ok(Some(offset)) = r {
+                    run_start.get_or_insert(offset);
+                }
+                // Only a durable entry that got this far needs the sync.
+                sync |= *fsync && r.is_ok();
+                staged.push(r);
+            }
         }
 
-        self.do_write_request(n, check_cookie)
+        if sync {
+            let io = self.io.read().unwrap();
+            if let Err(e) = self.flush_dat(&io) {
+                self.check_read_write_error(Some(&e));
+                if let Some(start) = run_start {
+                    self.undo_unsynced_append(&io, start);
+                }
+                let e = VolumeError::Io(e);
+                return staged
+                    .into_iter()
+                    .map(|r| r.and_then(|_| Err(run_error(&e))))
+                    .collect();
+            }
+        }
+
+        {
+            let _guard = self.data_file_access_control.write_lock();
+            let mut io = self.io.write().unwrap();
+            io.last_append_at_ns = last_append_at_ns;
+            for ((n, _), r) in run.iter().zip(&staged) {
+                if matches!(r, Ok(Some(_))) && n.append_at_ns > io.last_write_append_at_ns {
+                    io.last_write_append_at_ns = n.append_at_ns;
+                    io.last_write_needle_key = n.id;
+                    io.last_write_deleted = false;
+                }
+            }
+
+            // A durable entry that fails to publish stops the volume taking
+            // writes, so the entries after it are refused the way a lone
+            // write would be.
+            let mut refused = false;
+            for ((n, fsync), r) in run.iter().zip(staged.iter_mut()) {
+                if refused {
+                    *r = Err(self
+                        .check_writable()
+                        .err()
+                        .unwrap_or(VolumeError::ReadOnly(self.id)));
+                } else if let Ok(Some(offset)) = *r
+                    && let Err(e) = self.publish_write(&mut io, n, offset, *fsync)
+                {
+                    *r = Err(e);
+                    refused = *fsync;
+                }
+            }
+        }
+
+        if sync {
+            let io = self.io.read().unwrap();
+            if let Err(e) = self.flush_idx(&io) {
+                return staged
+                    .into_iter()
+                    .map(|r| r.and_then(|_| Err(run_error(&e))))
+                    .collect();
+            }
+        }
+
+        let written = run
+            .iter()
+            .zip(&staged)
+            .filter(|(_, r)| matches!(r, Ok(Some(_))))
+            .map(|((n, _), _)| n.last_modified)
+            .max();
+        let last = staged.iter().rposition(|r| matches!(r, Ok(Some(_))));
+        if let (Some(last_modified), Some(last)) = (written, last) {
+            // Sent one at a time, the last write to land would have cleared
+            // the streak of the appends before it, and the ones after it
+            // would have failed on top of that.
+            let _guard = self.data_file_access_control.write_lock();
+            let mut io = self.io.write().unwrap();
+            self.finish_write(&mut io, last_modified, sync, marks[last]);
+        }
+
+        run.iter()
+            .zip(staged)
+            .map(|((n, _), r)| {
+                let size = Size(n.data_size as i32);
+                r.map(|staged| match staged {
+                    Some(offset) => (offset, size, false),
+                    None => (0, size, true),
+                })
+            })
+            .collect()
+    }
+
+    /// The checks and the append for one entry of a synced run, leaving the
+    /// publish to the caller. Returns the offset, or None when it dedups.
+    fn append_unpublished(
+        &self,
+        io: &mut VolumeIo,
+        n: &mut Needle,
+        last_append_at_ns: &mut u64,
+    ) -> Result<Option<u64>, VolumeError> {
+        self.check_writable()?;
+        if self.prepare_write(io, n, true)? {
+            return Ok(None);
+        }
+        n.append_at_ns = get_append_at_ns(*last_append_at_ns);
+        let (offset, _, _) = self.append_needle(io, n)?;
+        *last_append_at_ns = n.append_at_ns;
+        Ok(Some(offset))
+    }
+
+    fn check_writable(&self) -> Result<(), VolumeError> {
+        if self.is_closed() {
+            return Err(VolumeError::NotFound);
+        }
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        if self.is_read_only() {
+            return Err(VolumeError::ReadOnly(self.id));
+        }
+        Ok(())
+    }
+
+    /// Flush the .dat, the first half of a durable write. The .idx is flushed
+    /// separately by flush_idx once the row is published; the two are split so
+    /// nothing is indexed before the bytes it points at are down.
+    pub(crate) fn flush_dat(&self, io: &VolumeIo) -> io::Result<()> {
+        #[cfg(test)]
+        self.dat_syncs_for_test.fetch_add(1, Ordering::Relaxed);
+        #[cfg(test)]
+        if io.fail_fsync_for_test {
+            return Err(io::Error::other("injected fsync failure"));
+        }
+        match io.dat_file.as_ref() {
+            Some(dat_file) => dat_file.sync_all(),
+            None => Err(io::Error::other("dat file not open")),
+        }
+    }
+
+    /// Flush the .idx, the second half of a durable write. load() rebuilds the
+    /// map from .idx, not from .dat, so the row has to be down before the write
+    /// is acked: lose it and the volume comes back with a .dat tail the
+    /// integrity check cannot account for, and loads read only.
+    ///
+    /// By the time this runs the row is published and cannot be taken back -
+    /// undoing it would mean writing to a disk that is already failing, and
+    /// would leave an .idx row pointing past a truncated .dat. So a failure
+    /// stops the volume taking writes instead: nothing more gets appended past a
+    /// record whose index may not survive, and the master routes writes
+    /// elsewhere once the volume heartbeats read only.
+    fn flush_idx(&self, io: &VolumeIo) -> Result<(), VolumeError> {
+        #[cfg(test)]
+        self.idx_syncs_for_test.fetch_add(1, Ordering::Relaxed);
+        #[cfg(test)]
+        if io.fail_idx_sync_for_test {
+            let e = io::Error::other("injected idx sync failure");
+            self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+            return Err(VolumeError::Io(e));
+        }
+        let synced = match io.nm.as_ref() {
+            Some(nm) => nm.sync(),
+            None => Ok(()),
+        };
+        if let Err(e) = synced {
+            self.check_read_write_error(Some(&e));
+            self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+            tracing::error!(
+                "volume {}: failed to flush the index after a durable write, \
+                 marking read only: {}",
+                self.id.0,
+                e
+            );
+            return Err(VolumeError::Io(e));
+        }
+        Ok(())
+    }
+
+    /// Take an unflushed append back off the .dat after its sync failed.
+    pub(crate) fn truncate_dat(&self, io: &VolumeIo, len: u64) -> io::Result<()> {
+        #[cfg(test)]
+        if io.fail_truncate_for_test {
+            return Err(io::Error::other("injected truncate failure"));
+        }
+        match io.dat_file.as_ref() {
+            Some(dat_file) => dat_file.set_len(len),
+            None => Ok(()),
+        }
     }
 
     fn do_write_request(
-        &mut self,
+        &self,
+        io: &mut VolumeIo,
         n: &mut Needle,
         check_cookie: bool,
+        fsync: bool,
     ) -> Result<(u64, Size, bool), VolumeError> {
+        if self.prepare_write(io, n, check_cookie)? {
+            // Nothing to append, but the write this matched may have been
+            // non-durable, and the caller is asking for the content to be on
+            // disk. Its .idx row can be sitting in the page cache too, so both
+            // files get flushed exactly as they would for a fresh append.
+            if fsync {
+                self.flush_dat(io).map_err(|e| {
+                    self.check_read_write_error(Some(&e));
+                    VolumeError::Io(e)
+                })?;
+                self.flush_idx(io)?;
+            }
+            return Ok((0, Size(n.data_size as i32), true));
+        }
+
+        // Update append timestamp
+        n.append_at_ns = get_append_at_ns(io.last_append_at_ns);
+
+        // Append to .dat file
+        let (offset, _body_size, _actual_size) = self.append_needle(io, n)?;
+
+        // Nothing is published until the bytes are down: an index entry for an
+        // unflushed append would resolve past the end of the file after a crash,
+        // and undoing it afterwards would double-count the volume's metrics.
+        if fsync && let Err(e) = self.flush_dat(io) {
+            self.check_read_write_error(Some(&e));
+            self.undo_unsynced_append(io, offset);
+            return Err(VolumeError::Io(e));
+        }
+
+        io.last_append_at_ns = n.append_at_ns;
+        io.last_write_append_at_ns = n.append_at_ns;
+        io.last_write_needle_key = n.id;
+        io.last_write_deleted = false;
+
+        self.publish_write(io, n, offset, fsync)?;
+
+        if fsync {
+            self.flush_idx(io)?;
+        }
+
+        self.finish_write(io, n.last_modified, fsync, self.io_errors.mark());
+
+        // Return Size(n.DataSize) as the logical size, matching Go's doWriteRequest
+        Ok((offset, Size(n.data_size as i32), false))
+    }
+
+    /// The checks a write passes before anything is appended: TTL
+    /// inheritance, checksum, dedup and cookie. Returns true when the needle
+    /// matches the stored copy and there is nothing to append.
+    fn prepare_write(
+        &self,
+        io: &VolumeIo,
+        n: &mut Needle,
+        check_cookie: bool,
+    ) -> Result<bool, VolumeError> {
         // TTL inheritance from volume (matching Go's writeNeedle2)
         {
             use crate::storage::needle::ttl::TTL;
+            let volume_ttl = self.super_block.read().unwrap().ttl;
             let needle_ttl = n.ttl.unwrap_or(TTL::EMPTY);
-            if needle_ttl == TTL::EMPTY && self.super_block.ttl != TTL::EMPTY {
+            if needle_ttl == TTL::EMPTY && volume_ttl != TTL::EMPTY {
                 n.set_has_ttl();
-                n.ttl = Some(self.super_block.ttl);
+                n.ttl = Some(volume_ttl);
             }
         }
 
@@ -1548,18 +2929,52 @@ impl Volume {
         }
 
         // Dedup check (matches Go: n.DataSize = oldNeedle.DataSize on dedup)
-        if let Some(old_data_size) = self.is_file_unchanged(n) {
+        if let Some(old_data_size) = self.is_file_unchanged(io, n) {
             n.data_size = old_data_size;
-            return Ok((0, Size(n.data_size as i32), true));
+            return Ok(true);
         }
 
         // Cookie validation for existing needle (matches Go: check whenever nm.Get returns ok)
-        if let Some(nm) = &self.nm {
-            if let Some(nv) = nm.get(n.id) {
-                let mut existing = Needle::default();
-                // Read only the header to check cookie
-                self.read_needle_header_unlocked(&mut existing, nv.offset.to_actual_offset())?;
+        let indexed = match io.nm.as_ref() {
+            Some(nm) => nm.get(n.id)?,
+            None => None,
+        };
+        if let Some(nv) = indexed
+            && !nv.offset.is_zero()
+        {
+            let mut existing = Needle::default();
+            // Read only the header to check cookie
+            self.read_needle_header_unlocked(io, &mut existing, nv.offset.to_actual_offset())?;
 
+            if existing.id != n.id && existing.size != nv.size {
+                // a 4-byte index entry can index past the 32 GiB wrap: the
+                // low offset may hold another needle while the real record
+                // sits at the wrapped offset, where reads already retry
+                #[cfg(not(feature = "5bytes"))]
+                if nv.offset.to_actual_offset() < MAX_POSSIBLE_VOLUME_SIZE as i64 {
+                    let mut wrapped = Needle::default();
+                    match self.read_needle_header_unlocked(
+                        io,
+                        &mut wrapped,
+                        nv.offset.to_actual_offset() + MAX_POSSIBLE_VOLUME_SIZE as i64,
+                    ) {
+                        Ok(()) => existing = wrapped,
+                        Err(VolumeError::Io(e)) if e.kind() == io::ErrorKind::UnexpectedEof => {}
+                        Err(e) => return Err(e),
+                    }
+                }
+            }
+
+            if existing.id != n.id && existing.size != nv.size {
+                // the entry resolves to a record that is neither the indexed
+                // key nor the indexed size, so it is stale rather than a
+                // duplicate — skip the cookie check and let publish_write
+                // overwrite it once the append commits
+                warn!(
+                    "volume {} index entry for needle {} resolves to needle {}; overwriting stale index entry",
+                    self.id.0, n.id.0, existing.id.0
+                );
+            } else {
                 if n.cookie.0 == 0 && !check_cookie {
                     n.cookie = existing.cookie;
                 }
@@ -1568,41 +2983,148 @@ impl Volume {
                 }
             }
         }
+        Ok(false)
+    }
 
-        // Update append timestamp
-        n.append_at_ns = get_append_at_ns(self.last_append_at_ns);
-
-        // Append to .dat file
-        let (offset, _body_size, _actual_size) = self.append_needle(n)?;
-        self.last_append_at_ns = n.append_at_ns;
+    /// Take an append whose sync failed back off the .dat.
+    fn undo_unsynced_append(&self, io: &VolumeIo, offset: u64) {
+        if let Err(te) = self.truncate_dat(io, offset) {
+            // The rejected record is still on the end. A later append
+            // would bury it mid-file, where the .dat tail check cannot
+            // see it, so the volume fails closed instead.
+            self.mark_io_unavailable(format!(
+                "failed to truncate back to {} after a failed fsync: {}",
+                offset, te
+            ));
+        }
+    }
 
+    /// Index an appended needle. `fsync` means its record is already down.
+    fn publish_write(
+        &self,
+        io: &mut VolumeIo,
+        n: &Needle,
+        offset: u64,
+        fsync: bool,
+    ) -> Result<(), VolumeError> {
         // Update needle map (uses n.size = full body size, matching Go's nm.Put)
-        let should_update = if let Some(nm) = &self.nm {
-            match nm.get(n.id) {
-                Some(nv) => (nv.offset.to_actual_offset() as u64) < offset,
-                None => true,
+        let prior = match io.nm.as_ref() {
+            Some(nm) => nm.get(n.id),
+            None => Ok(None),
+        };
+        let should_update = match prior {
+            Ok(Some(nv)) => (nv.offset.to_actual_offset() as u64) < offset,
+            Ok(None) => true,
+            Err(e) => {
+                if fsync {
+                    // Leaves the same durable-but-unindexed record a failed put
+                    // below does, so it gets the same treatment.
+                    self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+                    tracing::error!(
+                        "volume {}: failed to read the prior mapping for a durable write at {}, \
+                         marking read only: {}",
+                        self.id.0,
+                        offset,
+                        e
+                    );
+                }
+                return Err(VolumeError::Io(e));
             }
-        } else {
-            true
         };
 
         if should_update {
-            if let Some(nm) = &mut self.nm {
-                nm.put(n.id, Offset::from_actual_offset(offset as i64), n.size)?;
+            let indexed = match io.nm.as_mut() {
+                Some(nm) => nm.put(n.id, Offset::from_actual_offset(offset as i64), n.size),
+                None => Ok(()),
+            };
+            if let Err(e) = indexed {
+                if fsync {
+                    // The record is already down but nothing indexes it, the
+                    // same state a failed .idx flush leaves behind, so it gets
+                    // the same treatment rather than another write on top.
+                    self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+                    tracing::error!(
+                        "volume {}: failed to index a durable write at {}, \
+                         marking read only: {}",
+                        self.id.0,
+                        offset,
+                        e
+                    );
+                }
+                return Err(VolumeError::Io(e));
             }
         }
-
-        if self.last_modified_ts_seconds < n.last_modified {
-            self.last_modified_ts_seconds = n.last_modified;
-        }
-
-        // Return Size(n.DataSize) as the logical size, matching Go's doWriteRequest
-        Ok((offset, Size(n.data_size as i32), false))
+        Ok(())
     }
 
-    fn read_needle_header_unlocked(&self, n: &mut Needle, offset: i64) -> Result<(), VolumeError> {
+    /// The bookkeeping after a write is fully down. `landed_at` is the point
+    /// in the I/O error streak where the write landed; errors counted after
+    /// it, by later appends of the same run, are not cleared.
+    fn finish_write(
+        &self,
+        io: &mut VolumeIo,
+        last_modified: u64,
+        idx_synced: bool,
+        landed_at: StreakMark,
+    ) {
+        if self.last_modified_ts_seconds.load(Ordering::Relaxed) < last_modified {
+            self.last_modified_ts_seconds
+                .store(last_modified, Ordering::Relaxed);
+        }
+
+        let checkpoint_ok = self.maybe_checkpoint_index(io, idx_synced);
+
+        // Clear the EIO streak only after the full write (data + flush +
+        // index + checkpoint) succeeds, so a failed fsync or checkpoint
+        // does not get its EIO erased by the success reset.
+        if checkpoint_ok {
+            self.io_errors.record_success_at(landed_at);
+        }
+    }
+
+    /// Take the index checkpoint the needle map asked for, data first: the
+    /// checkpoint makes the index durable, and an index row that outlives
+    /// the bytes it points at loads read-only (see load()). A failed .dat
+    /// flush therefore skips the checkpoint; the map keeps asking, so it is
+    /// retried on the next write.
+    ///
+    /// When `idx_already_synced` is true the .idx has already been fsynced by
+    /// `flush_idx` on the fsync=true write path, so the checkpoint skips its
+    /// own .idx fsync to avoid a redundant one.
+    fn maybe_checkpoint_index(&self, io: &mut VolumeIo, idx_already_synced: bool) -> bool {
+        let due = io.nm.as_ref().is_some_and(|nm| nm.checkpoint_due());
+        if !due {
+            return true;
+        }
+        if let Err(e) = self.flush_dat(io) {
+            self.check_read_write_error(Some(&e));
+            tracing::warn!(
+                "volume {}: skipping index checkpoint, .dat flush failed: {}",
+                self.id.0,
+                e
+            );
+            return false;
+        }
+        let checkpointed = match io.nm.as_mut() {
+            Some(nm) => nm.checkpoint(!idx_already_synced),
+            None => Ok(()),
+        };
+        if let Err(e) = checkpointed {
+            self.check_read_write_error(Some(&e));
+            tracing::warn!("volume {}: index checkpoint failed: {}", self.id.0, e);
+            return false;
+        }
+        true
+    }
+
+    fn read_needle_header_unlocked(
+        &self,
+        io: &VolumeIo,
+        n: &mut Needle,
+        offset: i64,
+    ) -> Result<(), VolumeError> {
         let mut header = [0u8; NEEDLE_HEADER_SIZE];
-        self.read_exact_at_backend(&mut header, offset as u64)?;
+        self.read_exact_at_backend(io, &mut header, offset as u64)?;
 
         n.read_header(&header);
         Ok(())
@@ -1611,33 +3133,43 @@ impl Volume {
     /// Check if the needle is unchanged from the existing one on disk.
     /// Returns `Some(old_data_size)` if unchanged, `None` otherwise.
     /// Matches Go's isFileUnchanged which also sets n.DataSize = oldNeedle.DataSize.
-    fn is_file_unchanged(&self, n: &Needle) -> Option<u32> {
+    fn is_file_unchanged(&self, io: &VolumeIo, n: &Needle) -> Option<u32> {
         // Don't dedup for volumes with TTL
-        if self.super_block.ttl != crate::storage::needle::ttl::TTL::EMPTY {
+        if self.super_block.read().unwrap().ttl != crate::storage::needle::ttl::TTL::EMPTY {
             return None;
         }
 
-        if let Some(nm) = &self.nm {
-            if let Some(nv) = nm.get(n.id) {
-                if !nv.offset.is_zero() && nv.size.is_valid() {
-                    let mut old = Needle::default();
-                    let mut ro = ReadOption::default();
-                    if self
-                        .read_needle_data_at_unlocked(
-                            &mut old,
-                            nv.offset.to_actual_offset(),
-                            nv.size,
-                            &mut ro,
-                        )
-                        .is_ok()
-                    {
-                        if old.cookie == n.cookie
-                            && old.checksum == n.checksum
-                            && old.data == n.data
-                        {
-                            return Some(old.data_size);
-                        }
-                    }
+        if let Some(nm) = &io.nm {
+            let existing = match nm.get(n.id) {
+                Ok(existing) => existing,
+                Err(e) => {
+                    // Not a lookup miss: the index could not be read. Report
+                    // "unknown" so the caller writes the needle again rather
+                    // than treating an unreadable index as proof of a change.
+                    warn!(volume_id = self.id.0, error = %e, "needle map lookup failed");
+                    return None;
+                }
+            };
+            if let Some(nv) = existing
+                && !nv.offset.is_zero()
+                && nv.size.is_valid()
+            {
+                let mut old = Needle::default();
+                let mut ro = ReadOption::default();
+                if self
+                    .read_needle_data_at_unlocked(
+                        io,
+                        &mut old,
+                        nv.offset.to_actual_offset(),
+                        nv.size,
+                        &mut ro,
+                    )
+                    .is_ok()
+                    && old.cookie == n.cookie
+                    && old.checksum == n.checksum
+                    && old.data == n.data
+                {
+                    return Some(old.data_size);
                 }
             }
         }
@@ -1645,14 +3177,19 @@ impl Volume {
     }
 
     /// Append a needle to the .dat file. Returns (offset, size, actual_size).
-    fn append_needle(&mut self, n: &mut Needle) -> Result<(u64, Size, i64), VolumeError> {
+    fn append_needle(
+        &self,
+        io: &mut VolumeIo,
+        n: &mut Needle,
+    ) -> Result<(u64, Size, i64), VolumeError> {
         let version = self.version();
         let bytes = n.write_bytes(version);
         let actual_size = bytes.len() as i64;
 
-        let dat_file = self.dat_file.as_mut().ok_or_else(|| {
-            VolumeError::Io(io::Error::new(io::ErrorKind::Other, "dat file not open"))
-        })?;
+        let dat_file = io
+            .dat_file
+            .as_mut()
+            .ok_or_else(|| VolumeError::Io(io::Error::other("dat file not open")))?;
 
         let offset = dat_file.seek(SeekFrom::End(0))?;
 
@@ -1664,13 +3201,20 @@ impl Volume {
             });
         }
 
-        if let Err(e) = dat_file.write_all(&bytes) {
-            // Truncate back to pre-write position on error (matching Go)
-            let _ = dat_file.set_len(offset);
+        let written = dat_file.write_all(&bytes);
+        #[cfg(test)]
+        let written = if io.fail_append_for_test.contains(&n.id) {
+            Err(media_error_for_test())
+        } else {
+            written
+        };
+        #[cfg(test)]
+        needle_write_hook::fire(n.id, actual_size as usize);
+        if let Err(e) = written {
+            self.undo_unsynced_append(io, offset);
             self.check_read_write_error(Some(&e));
             return Err(VolumeError::Io(e));
         }
-        self.check_read_write_error(None);
 
         Ok((offset, n.size, actual_size))
     }
@@ -1678,17 +3222,31 @@ impl Volume {
     // ---- Delete ----
 
     /// Delete a needle from the volume.
-    pub fn delete_needle(&mut self, n: &mut Needle) -> Result<Size, VolumeError> {
+    pub fn delete_needle(&self, n: &mut Needle) -> Result<Size, VolumeError> {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
         let _guard = self.data_file_access_control.write_lock();
-        if self.no_write_or_delete {
-            return Err(VolumeError::ReadOnly);
+        let mut io = self.io.write().unwrap();
+        if self.is_closed() {
+            // A detached handle has no index; without this check the tombstone
+            // would silently no-op as Ok(0) while the needle lives on the
+            // remounted volume.
+            return Err(VolumeError::NotFound);
         }
-        self.do_delete_request(n)
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        if self.no_write_flags().0 {
+            return Err(VolumeError::ReadOnly(self.id));
+        }
+        self.do_delete_request(&mut io, n)
     }
 
-    fn do_delete_request(&mut self, n: &mut Needle) -> Result<Size, VolumeError> {
-        let (found, size, _stored_offset) = if let Some(nm) = &self.nm {
-            if let Some(nv) = nm.get(n.id) {
+    fn do_delete_request(&self, io: &mut VolumeIo, n: &mut Needle) -> Result<Size, VolumeError> {
+        let (found, size, _stored_offset) = if let Some(nm) = &io.nm {
+            // Propagate: acknowledging the delete as a no-op because the index
+            // could not be read would drop the tombstone on the floor while the
+            // caller believes the needle is gone.
+            if let Some(nv) = nm.get(n.id)? {
                 if !nv.size.is_deleted() {
                     (true, nv.size, nv.offset)
                 } else {
@@ -1707,22 +3265,34 @@ impl Volume {
 
         // Write tombstone: append needle with empty data
         n.data = vec![];
-        n.append_at_ns = get_append_at_ns(self.last_append_at_ns);
+        n.append_at_ns = get_append_at_ns(io.last_append_at_ns);
 
-        let offset = if !self.has_remote_file {
+        let offset = if !self.has_remote_file() {
             // Normal volume: append tombstone to .dat file
-            let (offset, _, _) = self.append_needle(n)?;
+            let (offset, _, _) = self.append_needle(io, n)?;
             offset
         } else {
             // Remote-tiered volume: skip .dat append, use offset 0
             0
         };
-        self.last_append_at_ns = n.append_at_ns;
+        io.last_append_at_ns = n.append_at_ns;
 
         // Update index
-        if let Some(nm) = &mut self.nm {
+        if let Some(nm) = &mut io.nm {
             nm.delete(n.id, Offset::from_actual_offset(offset as i64))?;
         }
+        if n.id == io.last_write_needle_key {
+            io.last_write_append_at_ns = 0;
+            io.last_write_needle_key = NeedleId(0);
+            io.last_write_deleted = true;
+        }
+        let checkpoint_ok = self.maybe_checkpoint_index(io, false);
+
+        // Clear the EIO streak after a successful delete (tombstone append +
+        // index update + checkpoint), mirroring do_write_request.
+        if checkpoint_ok {
+            self.check_read_write_error(None);
+        }
 
         Ok(size)
     }
@@ -1730,45 +3300,152 @@ impl Volume {
     // ---- Metrics ----
 
     pub fn content_size(&self) -> u64 {
-        self.nm.as_ref().map_or(0, |nm| nm.content_size())
+        self.io
+            .read()
+            .unwrap()
+            .nm
+            .as_ref()
+            .map_or(0, |nm| nm.content_size())
     }
 
     pub fn deleted_size(&self) -> u64 {
-        self.nm.as_ref().map_or(0, |nm| nm.deleted_size())
+        self.io
+            .read()
+            .unwrap()
+            .nm
+            .as_ref()
+            .map_or(0, |nm| nm.deleted_size())
     }
 
     pub fn file_count(&self) -> i64 {
-        self.nm.as_ref().map_or(0, |nm| nm.file_count())
+        self.io
+            .read()
+            .unwrap()
+            .nm
+            .as_ref()
+            .map_or(0, |nm| nm.file_count())
     }
 
     pub fn deleted_count(&self) -> i64 {
-        self.nm.as_ref().map_or(0, |nm| nm.deleted_count())
+        self.io
+            .read()
+            .unwrap()
+            .nm
+            .as_ref()
+            .map_or(0, |nm| nm.deleted_count())
     }
 
     pub fn max_file_key(&self) -> NeedleId {
-        self.nm.as_ref().map_or(NeedleId(0), |nm| nm.max_file_key())
+        self.io
+            .read()
+            .unwrap()
+            .nm
+            .as_ref()
+            .map_or(NeedleId(0), |nm| nm.max_file_key())
     }
 
     pub fn is_read_only(&self) -> bool {
-        self.no_write_or_delete
-            || self.no_write_can_delete
+        let (no_write_or_delete, no_write_can_delete) = self.no_write_flags();
+        no_write_or_delete
+            || no_write_can_delete
+            || self.io_unavailable.is_set()
             || self.location_disk_space_low.load(Ordering::Relaxed)
     }
 
+    /// Mirrors Go's ReadOnlyReasons: `no_write_or_delete` already covers the
+    /// io_unavailable quarantine.
+    pub fn read_only_reasons(&self) -> (bool, bool, bool, bool) {
+        let (flag_or_delete, no_write_can_delete) = self.no_write_flags();
+        let no_write_or_delete = flag_or_delete || self.io_unavailable.is_set();
+        let disk_space_low = self.location_disk_space_low.load(Ordering::Relaxed);
+        (
+            no_write_or_delete || no_write_can_delete || disk_space_low,
+            no_write_or_delete,
+            no_write_can_delete,
+            disk_space_low,
+        )
+    }
+
+    /// The reason the volume refuses all I/O, when a failed recovery left the
+    /// .dat/index pair unverified. Mirrors Go's unavailableError.
+    pub fn unavailable_error(&self) -> Option<VolumeError> {
+        self.io_unavailable.error()
+    }
+
+    /// Fail closed after a recovery could not return the volume to a verified
+    /// state: refuse all I/O, leave heartbeats out, and record the state so a
+    /// reload stays unavailable until an operator verifies the volume.
+    fn mark_io_unavailable(&self, reason: String) {
+        self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+        self.io_unavailable.set(reason.clone());
+        self.mark_io_quarantined();
+        if let Err(e) = self.persist_unavailable(&reason) {
+            warn!(
+                volume_id = self.id.0,
+                error = %e,
+                "failed to persist unavailable marker"
+            );
+        }
+        if let Err(e) = self.set_read_only_persist_held(false, true) {
+            warn!(
+                volume_id = self.id.0,
+                error = %e,
+                "failed to persist unavailable state"
+            );
+        }
+        error!(
+            volume_id = self.id.0,
+            "volume entered unavailable state after failed recovery: {}", reason
+        );
+    }
+
+    fn persist_unavailable(&self, reason: &str) -> io::Result<()> {
+        let marker = self.file_name(".unavailable");
+        let mut f = OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .open(&marker)?;
+        f.write_all(reason.as_bytes())?;
+        f.sync_all()?;
+        drop(f);
+        fsync_dir(&marker)
+    }
+
+    /// Re-arm the state a `.unavailable` marker recorded. The marker is
+    /// deleted manually once the .dat/index pair is verified.
+    fn restore_unavailable(&self) {
+        let Ok(reason) = fs::read_to_string(self.file_name(".unavailable")) else {
+            return;
+        };
+        self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+        self.io_unavailable.set(reason.trim().to_string());
+        self.mark_io_quarantined();
+        warn!(
+            volume_id = self.id.0,
+            "volume is unavailable: {}",
+            reason.trim()
+        );
+    }
+
     pub fn is_no_write_or_delete(&self) -> bool {
-        self.no_write_or_delete
+        self.no_write_flags().0
+    }
+
+    pub fn set_no_write_or_delete(&self, value: bool) {
+        self.set_no_write_flag(NO_WRITE_OR_DELETE, value);
     }
 
     pub fn is_no_write_can_delete(&self) -> bool {
-        self.no_write_can_delete
+        self.no_write_flags().1
     }
 
     pub fn last_compact_revision(&self) -> u16 {
-        self.last_compact_revision
+        self.io.read().unwrap().last_compact_revision
     }
 
     pub fn last_modified_ts(&self) -> u64 {
-        self.last_modified_ts_seconds
+        self.last_modified_ts_seconds.load(Ordering::Relaxed)
     }
 
     pub fn is_expired(&self, volume_size: u64, volume_size_limit: u64) -> bool {
@@ -1778,7 +3455,7 @@ impl Volume {
         if volume_size <= SUPER_BLOCK_SIZE as u64 {
             return false;
         }
-        let ttl_minutes = self.super_block.ttl.minutes();
+        let ttl_minutes = self.super_block.read().unwrap().ttl.minutes();
         if ttl_minutes == 0 {
             return false;
         }
@@ -1786,81 +3463,50 @@ impl Volume {
             .duration_since(UNIX_EPOCH)
             .unwrap_or_default()
             .as_secs()
-            .saturating_sub(self.last_modified_ts_seconds)
+            .saturating_sub(self.last_modified_ts_seconds.load(Ordering::Relaxed))
             / 60;
         (ttl_minutes as u64) < lived_minutes
     }
 
+    /// When this volume's data becomes garbage, counted from its last write.
+    /// Counting from the current time instead let every .vif rewrite — a
+    /// read-only mark, a tier upload, an EC encode — hand an already expiring
+    /// volume another full TTL. Zero when the volume has no TTL. Mirrors Go's
+    /// ExpireAtSec.
+    pub fn expire_at_sec(&self) -> u64 {
+        let ttl_seconds = self.super_block.read().unwrap().ttl.to_seconds();
+        if ttl_seconds == 0 {
+            return 0;
+        }
+        let mut last_write_sec = self.last_modified_ts_seconds.load(Ordering::Relaxed);
+        if last_write_sec == 0 {
+            last_write_sec = SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_secs();
+        }
+        last_write_sec + ttl_seconds
+    }
+
     pub fn is_expired_long_enough(&self, max_delay_minutes: u32) -> bool {
-        let ttl_minutes = self.super_block.ttl.minutes();
+        let ttl_minutes = self.super_block.read().unwrap().ttl.minutes();
         if ttl_minutes == 0 {
             return false;
         }
         let removal_delay = std::cmp::min(ttl_minutes / 10, max_delay_minutes);
-        ((ttl_minutes + removal_delay) as u64) * 60 + self.last_modified_ts_seconds
+        ((ttl_minutes + removal_delay) as u64) * 60
+            + self.last_modified_ts_seconds.load(Ordering::Relaxed)
             < SystemTime::now()
                 .duration_since(UNIX_EPOCH)
                 .unwrap_or_default()
                 .as_secs()
     }
 
-    /// Read all live needles from the volume (for ReadAllNeedles streaming RPC).
-    pub fn read_all_needles(&self) -> Result<Vec<Needle>, VolumeError> {
-        let _guard = self.data_file_access_control.read_lock();
-        let nm = self.nm_or_not_found()?;
-        let version = self.version();
-        let dat_size = self.current_dat_file_size()? as i64;
-        let mut needles = Vec::new();
-        let mut offset = self.super_block.block_size() as i64;
-
-        while offset < dat_size {
-            let mut header = [0u8; NEEDLE_HEADER_SIZE];
-            match self.read_exact_at_backend(&mut header, offset as u64) {
-                Ok(()) => {}
-                Err(VolumeError::Io(e)) if e.kind() == io::ErrorKind::UnexpectedEof => break,
-                Err(e) => return Err(e),
-            }
-
-            let (_cookie, key, size) = Needle::parse_header(&header);
-            if size.0 == 0 && key.is_empty() {
-                break;
-            }
-
-            let body_length = needle::needle_body_length(size, version);
-            let total_size = NEEDLE_HEADER_SIZE as i64 + body_length as i64;
-
-            if size.is_deleted() || size.0 <= 0 {
-                offset += total_size;
-                continue;
-            }
-
-            let Some(nv) = nm.get(key) else {
-                offset += total_size;
-                continue;
-            };
-            if nv.offset.to_actual_offset() != offset {
-                offset += total_size;
-                continue;
-            }
-
-            let mut n = Needle {
-                id: key,
-                ..Needle::default()
-            };
-            let mut read_option = ReadOption::default();
-            self.read_needle_data_at_unlocked(&mut n, offset, size, &mut read_option)?;
-            needles.push(n);
-
-            offset += total_size;
-        }
-        Ok(needles)
-    }
-
     /// Check volume data integrity by verifying the last index entries against the .dat file.
     /// Matches Go's CheckVolumeDataIntegrity (volume_checking.go L117-141).
     /// Reads the last few index entries, verifies each needle header is readable and
     /// consistent. On failure, marks the volume read-only.
-    fn check_volume_data_integrity(&mut self) -> Result<(), VolumeError> {
+    fn check_volume_data_integrity(&self, io: &mut VolumeIo) -> Result<(), VolumeError> {
         let idx_path = self.file_name(".idx");
         if !Path::new(&idx_path).exists() {
             return Ok(());
@@ -1873,17 +3519,14 @@ impl Volume {
         if idx_size % NEEDLE_MAP_ENTRY_SIZE as i64 != 0 {
             return Err(VolumeError::Io(io::Error::new(
                 io::ErrorKind::InvalidData,
-                format!(
-                    "index file's size is {} bytes, maybe corrupted",
-                    idx_size
-                ),
+                format!("index file's size is {} bytes, maybe corrupted", idx_size),
             )));
         }
 
         let version = self.version();
 
         // The deeper-than-tail structural check (every (offset + actual size)
-        // fits inside .dat — issue #8928) is now handled in load() via the
+        // fits inside .dat) is now handled in load() via the
         // needle map's max_needle_end accumulator, so we don't pay for a
         // second linear scan of the .idx here.
 
@@ -1896,7 +3539,8 @@ impl Volume {
         // the volume read-only on every load. Mirrors Go's
         // findDatTailEntryOffset + doCheckAndFixVolumeData.
         let mut idx_file = File::open(&idx_path)?;
-        let tail_entry_pos = self.find_dat_tail_entry_offset(&mut idx_file, idx_size, version)?;
+        let tail_entry_pos =
+            self.find_dat_tail_entry_offset(io, &mut idx_file, idx_size, version)?;
         if tail_entry_pos < 0 {
             // pre-allocated / all-zero index, nothing to verify against the .dat
             return Ok(());
@@ -1914,9 +3558,45 @@ impl Volume {
             // the appended needle in .dat carries Size=0, so verify with
             // Size=0 — comparing against -1 would mismatch the on-disk header
             // and send every volume with a trailing deletion read-only.
-            self.verify_deleted_needle_integrity(offset.to_actual_offset(), key, version)
+            self.verify_deleted_needle_integrity(io, offset.to_actual_offset(), key, version)
         } else {
-            self.verify_needle_integrity(offset.to_actual_offset(), key, size, version)
+            self.verify_needle_integrity(io, offset.to_actual_offset(), key, size, version)
+        }
+    }
+
+    /// Bounds the work a vacuumed volume's recovery does, where key order makes
+    /// every write a candidate for the newest one. A volume with more live
+    /// needles than this keeps the .dat mtime: reading a subset could recover a
+    /// timestamp older than the newest write and expire data still inside its
+    /// TTL, so a scan that will not fit declines instead of guessing.
+    const VACUUMED_LAST_WRITE_SCAN_ENTRIES: usize = 1 << 16;
+
+    /// Point the TTL clock at the newest write recorded in the volume, replacing
+    /// the .dat mtime the loader starts from. A delete appends a tombstone and
+    /// vacuum rewrites the .dat wholesale, so the mtime moves without any write
+    /// ever landing: every restart of a volume taking delete traffic re-armed
+    /// is_expired() for another full TTL and the volume was never reclaimed.
+    /// Mirrors Go's recoverLastModifiedTs.
+    fn recover_last_modified_ts(&self, io: &mut VolumeIo) {
+        if self.super_block.read().unwrap().ttl.minutes() == 0 {
+            return;
+        }
+        match self.find_last_write_append_at_ns(io) {
+            Ok((0, _)) => {}
+            Ok((append_at_ns, key)) => {
+                self.last_modified_ts_seconds
+                    .store(append_at_ns / 1_000_000_000, Ordering::Relaxed);
+                if append_at_ns > io.last_write_append_at_ns {
+                    io.last_write_append_at_ns = append_at_ns;
+                    io.last_write_needle_key = key;
+                    io.last_write_deleted = false;
+                }
+            }
+            Err(e) => warn!(
+                volume_id = self.id.0,
+                error = %e,
+                "recover the last write from the index"
+            ),
         }
     }
 
@@ -1926,22 +3606,23 @@ impl Volume {
     /// key-sorted .idx (e.g. legacy weed fix output) falls back to a single
     /// linear scan for the maximum offset. Returns -1 when no entry has a
     /// non-zero offset (a pre-allocated / all-zero index).
-    fn find_dat_tail_entry_offset(
+    pub(crate) fn find_dat_tail_entry_offset(
         &self,
+        io: &VolumeIo,
         idx_file: &mut File,
         idx_size: i64,
         version: Version,
     ) -> Result<i64, VolumeError> {
-        if let Ok(dat_size) = self.dat_file_size() {
-            if dat_size > 0 {
-                let last_pos = idx_size - NEEDLE_MAP_ENTRY_SIZE as i64;
-                let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
-                idx_file.seek(SeekFrom::Start(last_pos as u64))?;
-                idx_file.read_exact(&mut buf)?;
-                let (_, offset, size) = idx_entry_from_bytes(&buf);
-                if !offset.is_zero() && needle_disk_end(offset, size, version) == dat_size as i64 {
-                    return Ok(last_pos);
-                }
+        if let Ok(dat_size) = self.current_dat_file_size_io(io)
+            && dat_size > 0
+        {
+            let last_pos = idx_size - NEEDLE_MAP_ENTRY_SIZE as i64;
+            let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+            idx_file.seek(SeekFrom::Start(last_pos as u64))?;
+            idx_file.read_exact(&mut buf)?;
+            let (_, offset, size) = idx_entry_from_bytes(&buf);
+            if !offset.is_zero() && needle_disk_end(offset, size, version) == dat_size as i64 {
+                return Ok(last_pos);
             }
         }
 
@@ -1969,6 +3650,126 @@ impl Volume {
         Ok(max_entry_pos)
     }
 
+    /// Scan the .idx backwards for the newest write — an entry that is not a
+    /// deletion tombstone — and return that needle's append timestamp and key.
+    /// The .idx
+    /// and the .dat share an order, so an append-ordered volume answers with the
+    /// first write the scan reaches. Vacuum rewrites both in key order, which
+    /// tracks write order only because the master issues keys increasing: an
+    /// overwrite keeps its original, lower key, so a vacuumed volume has to take
+    /// the maximum over every write it indexes. Returns 0 when the .idx holds
+    /// nothing but tombstones, when a vacuumed volume holds more needles than
+    /// the scan budget, or for a volume older than version 3, whose needles
+    /// carry no append timestamp. Mirrors Go's findLastWriteAppendAtNs.
+    fn find_last_write_append_at_ns(&self, io: &VolumeIo) -> Result<(u64, NeedleId), VolumeError> {
+        let version = self.version();
+        if version != VERSION_3 {
+            return Ok((0, NeedleId(0)));
+        }
+        let idx_path = self.file_name(".idx");
+        let idx_size = fs::metadata(&idx_path).map(|m| m.len()).unwrap_or(0) as i64;
+        if idx_size == 0 || idx_size % NEEDLE_MAP_ENTRY_SIZE as i64 != 0 {
+            return Ok((0, NeedleId(0)));
+        }
+        let scan_every_write = self.super_block.read().unwrap().compaction_revision > 0;
+        let mut entry_budget = Self::VACUUMED_LAST_WRITE_SCAN_ENTRIES;
+        let mut last_write_append_at_ns = 0u64;
+        let mut last_write_key = NeedleId(0);
+        let mut dead = HashSet::new();
+        let mut idx_file = File::open(&idx_path)?;
+        let mut block = vec![0u8; NEEDLE_MAP_ENTRY_SIZE * idx::ROWS_TO_READ];
+        let mut end = idx_size;
+        while end > 0 {
+            let start = (end - block.len() as i64).max(0);
+            let entries = &mut block[..(end - start) as usize];
+            idx_file.seek(SeekFrom::Start(start as u64))?;
+            idx_file.read_exact(entries)?;
+            for entry in entries.as_chunks::<NEEDLE_MAP_ENTRY_SIZE>().0.iter().rev() {
+                let (key, offset, size) = idx_entry_from_bytes(entry);
+                // The first row a key presents is its latest state: a tombstone
+                // there retires the write rows beneath it.
+                if dead.contains(&key) {
+                    continue;
+                }
+                if offset.is_zero() || size.is_deleted() {
+                    dead.insert(key);
+                    continue;
+                }
+                let Some(needle_offset) =
+                    self.find_needle_offset(io, offset.to_actual_offset(), key, size)
+                else {
+                    continue;
+                };
+                let append_at_ns = self.read_needle_append_at_ns(io, needle_offset, size)?;
+                if append_at_ns > last_write_append_at_ns {
+                    last_write_append_at_ns = append_at_ns;
+                    last_write_key = key;
+                }
+                if !scan_every_write {
+                    return Ok((last_write_append_at_ns, last_write_key));
+                }
+                entry_budget -= 1;
+                if entry_budget == 0 {
+                    warn!(
+                        volume_id = self.id.0,
+                        budget = Self::VACUUMED_LAST_WRITE_SCAN_ENTRIES,
+                        "too many needles to scan for the last write, keeping the .dat mtime"
+                    );
+                    return Ok((0, NeedleId(0)));
+                }
+            }
+            end = start;
+        }
+        Ok((last_write_append_at_ns, last_write_key))
+    }
+
+    /// The .dat offset holding the needle an .idx entry describes, or None when
+    /// no needle there matches it. A .dat past MAX_POSSIBLE_VOLUME_SIZE wraps the
+    /// offsets in its .idx, so the needle can sit one volume size further in;
+    /// verify_needle_integrity retries the same way. Mirrors Go's
+    /// findNeedleOffset.
+    fn find_needle_offset(
+        &self,
+        io: &VolumeIo,
+        actual_offset: i64,
+        key: NeedleId,
+        size: Size,
+    ) -> Option<i64> {
+        for at in [
+            actual_offset,
+            actual_offset + MAX_POSSIBLE_VOLUME_SIZE as i64,
+        ] {
+            let mut header = [0u8; NEEDLE_HEADER_SIZE];
+            if self
+                .read_exact_at_backend(io, &mut header, at as u64)
+                .is_err()
+            {
+                continue;
+            }
+            let (_, needle_id, needle_size) = Needle::parse_header(&header);
+            if needle_id == key && needle_size == size {
+                return Some(at);
+            }
+        }
+        None
+    }
+
+    /// Read the append timestamp a version 3 needle carries past its checksum.
+    fn read_needle_append_at_ns(
+        &self,
+        io: &VolumeIo,
+        actual_offset: i64,
+        size: Size,
+    ) -> Result<u64, VolumeError> {
+        let ts_offset = actual_offset as u64
+            + NEEDLE_HEADER_SIZE as u64
+            + size.0 as u64
+            + NEEDLE_CHECKSUM_SIZE as u64;
+        let mut ts = [0u8; TIMESTAMP_SIZE];
+        self.read_exact_at_backend(io, &mut ts, ts_offset)?;
+        Ok(u64::from_be_bytes(ts))
+    }
+
     /// Verify the live needle at the .dat tail: its header must match the
     /// .idx entry and, on v3, the .dat must end exactly at its on-disk end.
     /// Extra bytes mean an unindexed trailing record (a torn append);
@@ -1978,14 +3779,15 @@ impl Volume {
     /// check is v3-only -- a v1/v2 volume Go serves read-write must not go
     /// read-only here.
     fn verify_needle_integrity(
-        &mut self,
+        &self,
+        io: &mut VolumeIo,
         actual_offset: i64,
         key: NeedleId,
         size: Size,
         version: Version,
     ) -> Result<(), VolumeError> {
         let mut header = [0u8; NEEDLE_HEADER_SIZE];
-        self.read_exact_at_backend(&mut header, actual_offset as u64)?;
+        self.read_exact_at_backend(io, &mut header, actual_offset as u64)?;
         let (_cookie, needle_id, needle_size) = Needle::parse_header(&header);
 
         let mut checked_offset = actual_offset;
@@ -1995,11 +3797,16 @@ impl Volume {
             // wrap-around before giving up.
             let alt_offset = actual_offset + MAX_POSSIBLE_VOLUME_SIZE as i64;
             let mut alt_header = [0u8; NEEDLE_HEADER_SIZE];
-            self.read_exact_at_backend(&mut alt_header, alt_offset as u64)
+            self.read_exact_at_backend(io, &mut alt_header, alt_offset as u64)
                 .map_err(|_| size_mismatch_error(actual_offset, needle_id, needle_size, size))?;
             let (_, alt_id, alt_size) = Needle::parse_header(&alt_header);
             if alt_size != size {
-                return Err(size_mismatch_error(actual_offset, needle_id, needle_size, size));
+                return Err(size_mismatch_error(
+                    actual_offset,
+                    needle_id,
+                    needle_size,
+                    size,
+                ));
             }
             checked_offset = alt_offset;
             checked_id = alt_id;
@@ -2019,15 +3826,12 @@ impl Volume {
             return Ok(());
         }
 
-        let ts_offset = checked_offset as u64 + NEEDLE_HEADER_SIZE as u64 + size.0 as u64 + 4; // skip checksum
-        let mut ts_buf = [0u8; 8];
-        self.read_exact_at_backend(&mut ts_buf, ts_offset)?;
-        let ts = u64::from_be_bytes(ts_buf);
+        let ts = self.read_needle_append_at_ns(io, checked_offset, size)?;
         if ts > 0 {
-            self.last_append_at_ns = ts;
+            io.last_append_at_ns = ts;
         }
 
-        self.verify_dat_ends_at(checked_offset + get_actual_size(size, version))
+        self.verify_dat_ends_at(io, checked_offset + get_actual_size(size, version))
     }
 
     /// Verify the deletion tombstone at the .dat tail. Tombstones are appended
@@ -2035,14 +3839,15 @@ impl Volume {
     /// and then require the .dat to end exactly at the tombstone. Mirrors Go's
     /// verifyDeletedNeedleIntegrity.
     fn verify_deleted_needle_integrity(
-        &mut self,
+        &self,
+        io: &mut VolumeIo,
         actual_offset: i64,
         key: NeedleId,
         version: Version,
     ) -> Result<(), VolumeError> {
         let record_size = get_actual_size(Size(0), version) as usize;
         let mut record = vec![0u8; record_size];
-        self.read_exact_at_backend(&mut record, actual_offset as u64)?;
+        self.read_exact_at_backend(io, &mut record, actual_offset as u64)?;
 
         let mut n = Needle::default();
         n.read_bytes(&record, actual_offset, Size(0), version)
@@ -2062,16 +3867,16 @@ impl Volume {
             )));
         }
         if n.append_at_ns > 0 {
-            self.last_append_at_ns = n.append_at_ns;
+            io.last_append_at_ns = n.append_at_ns;
         }
 
-        self.verify_dat_ends_at(actual_offset + get_actual_size(Size(0), version))
+        self.verify_dat_ends_at(io, actual_offset + get_actual_size(Size(0), version))
     }
 
     /// The checked needle is the one physically last in the .dat, so the file
     /// must end exactly at it; extra bytes mean an unindexed trailing record.
-    fn verify_dat_ends_at(&self, file_tail_offset: i64) -> Result<(), VolumeError> {
-        let file_size = self.dat_file_size().map_err(VolumeError::Io)? as i64;
+    fn verify_dat_ends_at(&self, io: &VolumeIo, file_tail_offset: i64) -> Result<(), VolumeError> {
+        let file_size = self.current_dat_file_size_io(io).map_err(VolumeError::Io)? as i64;
         if file_size == file_tail_offset {
             return Ok(());
         }
@@ -2108,8 +3913,8 @@ impl Volume {
     /// corruption. Returns the open file + size, or the messages to report.
     fn open_index_for_scrub(&self) -> Result<(File, i64), Vec<String>> {
         let idx_path = self.file_name(".idx");
-        let idx_file =
-            File::open(&idx_path).map_err(|e| vec![format!("open index file {}: {}", idx_path, e)])?;
+        let idx_file = File::open(&idx_path)
+            .map_err(|e| vec![format!("open index file {}: {}", idx_path, e)])?;
         let idx_file_size = idx_file
             .metadata()
             .map_err(|e| vec![format!("stat index file {}: {}", idx_path, e)])?
@@ -2127,7 +3932,7 @@ impl Volume {
                     return Err(vec![format!(
                         "stat data file for volume {}: {}",
                         self.id.0, e
-                    )])
+                    )]);
                 }
             }
         }
@@ -2167,7 +3972,10 @@ impl Volume {
         };
 
         let version = self.version();
-        let dat_size = self.dat_file_size().map_err(VolumeError::Io)?;
+        let io = self.io.read().unwrap();
+        let dat_size = self
+            .current_dat_file_size_io(&io)
+            .map_err(VolumeError::Io)?;
 
         // Full scrub also runs the index structural check.
         let (_, mut broken) =
@@ -2175,42 +3983,54 @@ impl Volume {
 
         let mut count: u64 = 0;
         let mut total_read: i64 = 0;
-        let walk = crate::storage::idx::walk_index_file(&mut idx_file, 0, |needle_id, offset, size| {
-            count += 1;
-            // A remote-tier delete records an offset-0 tombstone with no physical
-            // .dat bytes, so it must not contribute to total_read.
-            if offset.is_zero() && size.is_deleted() {
-                return Ok(());
-            }
-            // Deleted needles still occupy .dat space: count their size, don't read.
-            total_read += get_actual_size(size, version);
-            if size.is_deleted() {
-                return Ok(());
-            }
-            let actual_offset = offset.to_actual_offset();
-            if actual_offset < 0 || actual_offset as u64 >= dat_size {
-                broken.push(format!(
-                    "needle {} offset {} out of range (dat_size={})",
-                    needle_id.0, actual_offset, dat_size
-                ));
-                return Ok(());
-            }
-            // Lock held above; read directly via the unlocked path (matches Go).
-            let mut n = Needle {
-                id: needle_id,
-                ..Needle::default()
-            };
-            let mut read_option = ReadOption::default();
-            if let Err(e) =
-                self.read_needle_data_at_unlocked(&mut n, actual_offset, size, &mut read_option)
-            {
-                broken.push(format!(
-                    "failed to read needle {} on volume {}: {}",
-                    needle_id.0, self.id.0, e
-                ));
-            }
-            Ok(())
-        });
+        let walk =
+            crate::storage::idx::walk_index_file(&mut idx_file, 0, |needle_id, offset, size| {
+                count += 1;
+                // A remote-tier delete records an offset-0 tombstone with no physical
+                // .dat bytes, so it must not contribute to total_read.
+                if offset.is_zero() && size.is_deleted() {
+                    return Ok(());
+                }
+                let on_disk_size = Size(size.raw() as i32);
+                // compute the actual size of the needle in disk, including needle header, body and alignment padding.
+                total_read += get_actual_size(on_disk_size, version);
+                let actual_offset = offset.to_actual_offset();
+                if actual_offset < 0 || actual_offset as u64 >= dat_size {
+                    broken.push(format!(
+                        "needle {} offset {} out of range (dat_size={})",
+                        needle_id.0, actual_offset, dat_size
+                    ));
+                    return Ok(());
+                }
+                // Lock held above; read directly via the unlocked path (matches Go).
+                let mut n = Needle {
+                    id: needle_id,
+                    ..Needle::default()
+                };
+                let mut read_option = ReadOption::default();
+                if let Err(e) = self.read_needle_data_at_unlocked(
+                    &io,
+                    &mut n,
+                    actual_offset,
+                    on_disk_size,
+                    &mut read_option,
+                ) {
+                    broken.push(format!(
+                        "failed to read needle {} on volume {}: {}",
+                        needle_id.0, self.id.0, e
+                    ));
+                } else if n.id != needle_id {
+                    // The data CRC does not cover the header: a damaged needle id
+                    // still reads clean while every live-needle lookup on this
+                    // replica keeps finding the index key here. (Go parity:
+                    // the check covers live needles too, not just tombstones.)
+                    broken.push(format!(
+                        "index key {} does not match needle's Id {} on volume {}",
+                        needle_id.0, n.id.0, self.id.0
+                    ));
+                }
+                Ok(())
+            });
         if let Err(e) = walk {
             broken.push(format!("walk index file: {}", e));
         }
@@ -2232,89 +4052,176 @@ impl Volume {
         Ok((count, broken))
     }
 
-    /// Scan raw needle entries from the .dat file starting at `from_offset`.
-    /// Returns (needle_header_bytes, needle_body_bytes, append_at_ns) for each needle.
-    /// Used by VolumeTailSender to stream raw bytes.
-    pub fn scan_raw_needles_from(
-        &self,
-        from_offset: u64,
-    ) -> Result<Vec<(Vec<u8>, Vec<u8>, u64)>, VolumeError> {
-        let version = self.version();
-        let dat_size = self.current_dat_file_size()?;
-        let mut entries = Vec::new();
-        let mut offset = from_offset;
-
-        while offset < dat_size {
-            // Read needle header (16 bytes)
-            let mut header = [0u8; NEEDLE_HEADER_SIZE];
-            match self.read_exact_at_backend(&mut header, offset) {
-                Ok(()) => {}
-                Err(VolumeError::Io(e)) if e.kind() == io::ErrorKind::UnexpectedEof => break,
-                Err(e) => return Err(e.into()),
-            }
-
-            let (_cookie, _id, size) = Needle::parse_header(&header);
-            if size.0 == 0 && _id.is_empty() {
-                break;
-            }
-
-            let body_length = needle::needle_body_length(size, version);
-            let total_size = NEEDLE_HEADER_SIZE as u64 + body_length as u64;
-
-            // Match Go's ScanVolumeFileFrom: visit ALL needles including deleted ones.
-            // This is critical for incremental copy where tombstones must be propagated.
-
-            // Read body bytes
-            let mut body = vec![0u8; body_length as usize];
-            match self.read_exact_at_backend(&mut body, offset + NEEDLE_HEADER_SIZE as u64) {
-                Ok(()) => {}
-                Err(VolumeError::Io(e)) if e.kind() == io::ErrorKind::UnexpectedEof => break,
-                Err(e) => return Err(e.into()),
-            }
-
-            // Parse the needle to get append_at_ns
-            let mut full = vec![0u8; total_size as usize];
-            full[..NEEDLE_HEADER_SIZE].copy_from_slice(&header);
-            full[NEEDLE_HEADER_SIZE..].copy_from_slice(&body);
-            let mut n = Needle::default();
-            let _ = n.read_bytes(&full, offset as i64, size, version);
-
-            entries.push((header.to_vec(), body, n.append_at_ns));
-            offset += total_size;
+    /// Capture a `.dat` scan from `from_offset` that the caller can run after
+    /// dropping its store guard. See `DatScanPlan` for why the offset, the
+    /// handle and the end bound must come from the same guard.
+    pub(crate) fn dat_scan_plan(&self, from_offset: u64) -> Result<DatScanPlan, VolumeError> {
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
         }
-
-        Ok(entries)
+        let io = self.io.read().unwrap();
+        Ok(DatScanPlan {
+            source: self.read_source(&io)?,
+            version: self.version(),
+            from: from_offset,
+            end: self.current_dat_file_size_io(&io)?,
+            owner: self.data_file_access_control.clone(),
+            compaction_revision: self.super_block.read().unwrap().compaction_revision,
+        })
     }
 
-    /// Insert or update a needle index entry (for low-level blob writes).
-    pub fn put_needle_index(
-        &mut self,
-        key: NeedleId,
-        offset: Offset,
-        size: Size,
-    ) -> Result<(), VolumeError> {
-        if let Some(ref mut nm) = self.nm {
-            nm.put(key, offset, size).map_err(VolumeError::Io)?;
+    /// Fail unless `plan` was taken from this volume at its current
+    /// compaction revision.
+    fn check_plan_source(&self, plan: &DatScanPlan) -> Result<(), VolumeError> {
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
+        }
+        if !Arc::ptr_eq(&plan.owner, &self.data_file_access_control)
+            || plan.compaction_revision != self.super_block.read().unwrap().compaction_revision
+        {
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "volume {} was compacted or replaced during the scan",
+                self.id
+            ))));
         }
         Ok(())
     }
 
-    /// Mark this volume as read-only (no writes or deletes).
-    /// If `persist` is true, the readonly state is saved to the .vif file.
-    pub fn set_read_only(&mut self) -> Result<(), VolumeError> {
-        self.no_write_or_delete = true;
-        self.save_vif()
+    /// Whether the record of `key` at `offset` in `plan` is the one the
+    /// needle map points at now.
+    pub(crate) fn is_live_in_plan(
+        &self,
+        plan: &DatScanPlan,
+        key: NeedleId,
+        offset: u64,
+    ) -> Result<bool, VolumeError> {
+        self.check_plan_source(plan)?;
+        let io = self.io.read().unwrap();
+        let nv = self.nm_or_not_found(&io)?.get(key)?;
+        Ok(nv.is_some_and(|nv| nv.offset.to_actual_offset() == offset as i64))
+    }
+
+    /// A plan for the records appended since `plan` was taken, or `None` when
+    /// there are none. `next` is the offset after the last record the pass
+    /// visited; a pass that stopped short of its end bound is not continued.
+    pub(crate) fn dat_scan_plan_after(
+        &self,
+        plan: &DatScanPlan,
+        next: Option<u64>,
+    ) -> Result<Option<DatScanPlan>, VolumeError> {
+        self.check_plan_source(plan)?;
+        if next.unwrap_or(plan.from) != plan.end || self.current_dat_file_size()? <= plan.end {
+            return Ok(None);
+        }
+        self.dat_scan_plan(plan.end).map(Some)
+    }
+
+    /// Insert or update a needle index entry (for low-level blob writes).
+    pub fn put_needle_index(
+        &self,
+        key: NeedleId,
+        offset: Offset,
+        size: Size,
+    ) -> Result<(), VolumeError> {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        let mut io = self.io.write().unwrap();
+        if let Some(ref mut nm) = io.nm {
+            nm.put(key, offset, size).map_err(VolumeError::Io)?;
+        }
+        self.maybe_checkpoint_index(&mut io, false);
+        Ok(())
+    }
+
+    /// Mark this volume as read-only (no writes or deletes) and persist.
+    pub fn set_read_only(&self) -> Result<(), VolumeError> {
+        self.set_read_only_persist(false, true)
     }
 
     /// Mark this volume as read-only, optionally persisting to .vif.
-    pub fn set_read_only_persist(&mut self, persist: bool) -> Result<(), VolumeError> {
-        self.no_write_or_delete = true;
+    /// With `can_delete`, deletes still land so expiring data drains the volume.
+    pub fn set_read_only_persist(
+        &self,
+        can_delete: bool,
+        persist: bool,
+    ) -> Result<(), VolumeError> {
+        // The flag flip and the .vif save are one critical section with the idx
+        // attach: Go's markVolumeReadonly runs under dataFileAccessLock, so a
+        // racing mark-writable cannot interleave a save of half-applied state.
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        self.set_read_only_persist_held(can_delete, persist)
+    }
+
+    /// `set_read_only_persist` for callers already holding the write lease —
+    /// mark_io_unavailable reaches this from append paths that hold it.
+    fn set_read_only_persist_held(
+        &self,
+        can_delete: bool,
+        persist: bool,
+    ) -> Result<(), VolumeError> {
+        if self.is_closed() {
+            // A detached handle must not write .vif for its replacement.
+            return Err(VolumeError::NotFound);
+        }
+        if can_delete && !self.has_remote_file() {
+            // deletes append tombstones to .idx; a read-only boot attached no writer
+            // Go's reopenIdxForWrite holds dataFileAccessLock: the idx swap must
+            // exclude compaction.
+            let mut io = self.io.write().unwrap();
+            self.attach_idx_writer_if_missing(&mut io)?;
+        }
+        let no_write_or_delete = !can_delete;
+        let no_write_can_delete = if can_delete {
+            true
+        } else if !self.has_remote_file() {
+            // downgrading a canDelete mark; remote volumes keep their derived flag
+            false
+        } else {
+            self.no_write_flags().1
+        };
+        let bits = (if no_write_or_delete {
+            NO_WRITE_OR_DELETE
+        } else {
+            0
+        }) | (if no_write_can_delete {
+            NO_WRITE_CAN_DELETE
+        } else {
+            0
+        });
+        self.no_write.store(bits, Ordering::Release);
         if persist {
             self.save_vif()?;
         }
         Ok(())
     }
 
+    /// Attach an append-only .idx writer when missing (read-only boot). Runs
+    /// before any flag flips so a failure cannot leave puts silently skipping
+    /// the on-disk append.
+    fn attach_idx_writer_if_missing(&self, io: &mut VolumeIo) -> Result<(), VolumeError> {
+        let needs_idx_writer = io
+            .nm
+            .as_ref()
+            .map(|nm| !nm.has_idx_writer())
+            .unwrap_or(false);
+        if needs_idx_writer {
+            let idx_path = self.file_name(".idx");
+            // Positioned writes: an append-mode handle cannot set_len on
+            // Windows.
+            let write_file = OpenOptions::new()
+                .write(true)
+                .create(true)
+                .truncate(false)
+                .open(&idx_path)?;
+            let idx_size = trim_torn_idx_tail(&write_file, &idx_path)?;
+            if let Some(ref mut nm) = io.nm {
+                nm.set_idx_file(Box::new(write_file), idx_size);
+            }
+        }
+        Ok(())
+    }
+
     /// Mark this volume as writable (allow writes and deletes).
     ///
     /// If the volume booted with .vif ReadOnly=true, `load_index` built the
@@ -2322,52 +4229,214 @@ impl Volume {
     /// silently skip the on-disk append and only mutate in-memory state —
     /// surviving until the next restart, then vanishing. Re-attach a writer
     /// here so writes persist again.
-    pub fn set_writable(&mut self) -> Result<(), VolumeError> {
-        // Attach the writer (if missing) before flipping the flag — otherwise
-        // a transient open/metadata failure would leave the volume marked
-        // writable with no .idx writer, and subsequent puts would silently
-        // skip the on-disk append and vanish on the next restart.
-        let needs_idx_writer = self
-            .nm
-            .as_ref()
-            .map(|nm| !nm.has_idx_writer())
-            .unwrap_or(false);
-        if needs_idx_writer {
-            let idx_path = self.file_name(".idx");
-            let write_file = OpenOptions::new()
-                .write(true)
-                .append(true)
-                .create(true)
-                .open(&idx_path)?;
-            let idx_size = write_file.metadata()?.len();
-            if let Some(ref mut nm) = self.nm {
-                nm.set_idx_file(Box::new(write_file), idx_size);
-            }
+    pub fn set_writable(&self) -> Result<(), VolumeError> {
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
         }
-        self.no_write_or_delete = false;
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        let (was_no_write_or_delete, was_no_write_can_delete) = self.no_write_flags();
+        // A remote-tiered volume keeps the delete-only mode a load derives: its
+        // .dat cannot take appends, so "writable" resolves to can-delete rather
+        // than advertising writable with no local data file.
+        let no_write_can_delete = self.has_remote_file();
+        self.no_write.store(
+            if no_write_can_delete {
+                NO_WRITE_CAN_DELETE
+            } else {
+                0
+            },
+            Ordering::Release,
+        );
+
+        let mut io = self.io.write().unwrap();
+
+        // Everything below keys off the flags above, so it runs with the volume
+        // already marked writable. Any failure has to put them back: a volume
+        // advertising writable whose needle map cannot reach .idx acknowledges
+        // writes that are gone after a restart.
+        if let Err(e) = self.publish_writable(&mut io) {
+            let bits = (if was_no_write_or_delete {
+                NO_WRITE_OR_DELETE
+            } else {
+                0
+            }) | (if was_no_write_can_delete {
+                NO_WRITE_CAN_DELETE
+            } else {
+                0
+            });
+            self.no_write.store(bits, Ordering::Release);
+            return Err(e);
+        }
+        self.reset_io_error_state();
+        Ok(())
+    }
+
+    /// The steps that must all succeed before a volume can be left marked
+    /// writable: swap out the read-only map, attach the .idx writer, persist the
+    /// mark. Split out so set_writable has one rollback point rather than three.
+    fn publish_writable(&self, io: &mut VolumeIo) -> Result<(), VolumeError> {
+        self.reconcile_index_mode(io)?;
+        self.attach_idx_writer_if_missing(io)?;
         self.save_vif()
     }
 
-    /// Recompute the Go-style write/delete mode from the current remote tier state.
-    pub fn refresh_remote_write_mode(&mut self) {
-        self.has_remote_file = !self.volume_info.files.is_empty();
-        if self.has_remote_file {
-            self.no_write_can_delete = true;
-            self.no_write_or_delete = false;
-        } else {
-            self.no_write_can_delete = false;
+    /// Swap the read-only sorted map for the configured writable one once the
+    /// current mode says the volume is no longer read-only. Mirrors Go's
+    /// reopenIdxForWrite, and is the reason a volume that stops being read-only
+    /// can accept writes at all: SortedFileNeedleMap::put always fails, so
+    /// publishing a writable volume without this leaves every write appending to
+    /// .dat and then failing to index it. A no-op unless the map is the sorted
+    /// one and the flags have already moved.
+    fn reconcile_index_mode(&self, io: &mut VolumeIo) -> Result<(), VolumeError> {
+        let wants_sorted = self.use_sorted_index();
+        let has_sorted = matches!(io.nm, Some(NeedleMap::SortedFile(_)));
+        if wants_sorted == has_sorted {
+            return Ok(());
+        }
+        // Both directions matter. Tiering DOWN has to trade the read-only
+        // sorted map for a writable one before the volume is published as
+        // writable. Tiering UP has to install the sorted map, or a volume
+        // tiered while the server runs keeps its whole index in RAM and its
+        // .idx descriptor pinned until the next restart — the cost this map
+        // exists to avoid.
+        //
+        // load_index only publishes io.nm once the new map is built, so a
+        // failure leaves the previous map in place and the caller can recover.
+        self.load_index(io)
+    }
+
+    /// The tiered-storage VolumeInfo backing the .vif file. A snapshot clone:
+    /// the field lives behind `volume_info`'s RwLock (Go's volumeInfoRWLock).
+    pub fn volume_info(&self) -> PbVolumeInfo {
+        self.volume_info.read().unwrap().clone()
+    }
+
+    /// Whether this volume is backed by a remote file, i.e. whether the .vif
+    /// holds a remote reference. Derived rather than mirrored, so it can never
+    /// disagree with the reference list it describes.
+    pub fn has_remote_file(&self) -> bool {
+        !self.volume_info.read().unwrap().files.is_empty()
+    }
+
+    /// Edit the remote reference list and recompute everything derived from it.
+    ///
+    /// This is the only way to change `volume_info.files` from outside the
+    /// module: the write/delete mode and the needle map follow from whether the
+    /// volume is remote, so an edit that skipped the refresh would leave the
+    /// volume claiming a mode its .vif contradicts.
+    ///
+    /// Not transactional: on error `f` has already been applied and the volume
+    /// is left pinned read-only, which is the safe end of a half-finished tier
+    /// transition. A caller that needs the old list back restores it with a
+    /// second call.
+    pub fn update_remote_files(
+        &self,
+        f: impl FnOnce(&mut Vec<PbRemoteFile>),
+    ) -> Result<(), VolumeError> {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        self.update_remote_files_held(f)
+    }
+
+    /// `update_remote_files` for callers already holding the write lease —
+    /// tier-down spans the reference trim, .vif save and backend swap under
+    /// one lease so no write can enter the transition gap.
+    pub(crate) fn update_remote_files_held(
+        &self,
+        f: impl FnOnce(&mut Vec<PbRemoteFile>),
+    ) -> Result<(), VolumeError> {
+        if self.is_closed() {
+            // A detached handle must not rewrite .vif state its remounted
+            // replacement owns.
+            return Err(VolumeError::NotFound);
+        }
+        f(&mut self.volume_info.write().unwrap().files);
+        let mut io = self.io.write().unwrap();
+        self.refresh_remote_write_mode(&mut io, true)
+    }
+
+    /// Go's MarkTieredDeletable: a live tier-up lifts the upload-time
+    /// read-only mark, except on a replicated volume — the shell copies the
+    /// uploaded replica's .idx and .vif to the other replicas after the
+    /// upload, and a tombstone written before that copy would reach one
+    /// replica only — or under an I/O quarantine, which is not the tier
+    /// upload's to lift. A refused volume keeps its flags until the next
+    /// load, as the Go volume does.
+    fn mark_tiered_deletable(&self) -> bool {
+        if self
+            .super_block
+            .read()
+            .unwrap()
+            .replica_placement
+            .has_replication()
+        {
+            return false;
+        }
+        if !self.has_remote_file() {
+            return false;
+        }
+        // Go takes noWriteLock around the quarantine check and the flag
+        // change; here a compare-exchange gives the same ordering — a
+        // heartbeat refusal landing between the check and the swap fails the
+        // swap, and the retry sees the quarantine mark the heartbeat set
+        // first.
+        loop {
+            if self.should_quarantine() {
+                return false;
+            }
+            let flags = self.no_write.load(Ordering::Acquire);
+            let promoted = (flags & !NO_WRITE_OR_DELETE) | NO_WRITE_CAN_DELETE;
+            if self
+                .no_write
+                .compare_exchange(flags, promoted, Ordering::AcqRel, Ordering::Acquire)
+                .is_ok()
+            {
+                return true;
+            }
         }
     }
 
+    /// Recompute the Go-style write/delete mode from the current remote tier
+    /// state, and bring the needle map in line with it — a volume that stops
+    /// being remote also stops using the read-only sorted index.
+    ///
+    /// `live` is a tier transition on a running volume: the promotion then
+    /// goes through mark_tiered_deletable, Go's MarkTieredDeletable, while a
+    /// load promotes every tiered volume unconditionally as Go's load() does.
+    ///
+    /// If the map cannot be rebuilt the volume is pinned read-only rather than
+    /// published as writable with an index that rejects every put; a restart
+    /// recovers it.
+    fn refresh_remote_write_mode(&self, io: &mut VolumeIo, live: bool) -> Result<(), VolumeError> {
+        let has_remote = self.has_remote_file();
+        if has_remote {
+            // remote-tiered: no writes, deletes allowed
+            if !live {
+                self.no_write.store(NO_WRITE_CAN_DELETE, Ordering::Release);
+            } else {
+                self.mark_tiered_deletable();
+            }
+        } else if !self.volume_info.read().unwrap().read_only_can_delete {
+            // only clear the remoteness-derived flag, not an operator mark
+            self.set_no_write_flag(NO_WRITE_CAN_DELETE, false);
+        }
+        if let Err(e) = self.reconcile_index_mode(io) {
+            self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+            return Err(e);
+        }
+        Ok(())
+    }
+
     /// Open the local .dat as the data backend, dropping any remote backend, so reads
-    /// are served from local disk. Mirrors Go's swapToLocalDatBackend after a tier-down.
-    pub(crate) fn open_local_dat_backend(&mut self) -> Result<(), VolumeError> {
-        let file = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .open(self.dat_path())?;
-        self.remote_dat_file = None;
-        self.dat_file = Some(file);
+    /// are served from local disk. Mirrors Go's swapToLocalDatBackend after a
+    /// tier-down. Callers hold the write lease: the swap is the last step of a
+    /// transition that must not admit a write mid-way.
+    pub(crate) fn open_local_dat_backend_held(&self) -> Result<(), VolumeError> {
+        let file = open_volume_file(OpenOptions::new().read(true).write(true), self.dat_path())?;
+        let mut io = self.io.write().unwrap();
+        io.remote_dat_file = None;
+        io.dat_file = Some(file);
         Ok(())
     }
 
@@ -2379,7 +4448,7 @@ impl Volume {
     /// Load volume info from .vif file.
     /// Supports both the protobuf-JSON format (Go-compatible) and legacy JSON.
     /// Returns true if a .vif file was found and successfully loaded.
-    fn load_vif(&mut self) -> Result<bool, VolumeError> {
+    fn load_vif(&self, io: &mut VolumeIo) -> Result<bool, VolumeError> {
         let path = self.vif_path();
         if let Ok(content) = fs::read_to_string(&path) {
             if content.trim().is_empty() {
@@ -2389,62 +4458,70 @@ impl Volume {
             if let Ok(vif_info) = serde_json::from_str::<VifVolumeInfo>(&content) {
                 let pb_info = vif_info.to_pb();
                 if pb_info.read_only {
-                    self.no_write_or_delete = true;
+                    if pb_info.read_only_can_delete {
+                        self.set_no_write_flag(NO_WRITE_CAN_DELETE, true);
+                    } else {
+                        self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
+                    }
                 }
-                self.volume_info = pb_info;
-                self.refresh_remote_write_mode();
-                if self.volume_info.version == 0 {
-                    self.volume_info.version = Version::current().0 as u32;
-                }
-                if !self.has_remote_file && self.volume_info.bytes_offset == 0 {
-                    self.volume_info.bytes_offset = OFFSET_SIZE as u32;
-                }
-                if self.volume_info.bytes_offset != 0
-                    && self.volume_info.bytes_offset != OFFSET_SIZE as u32
+                *self.volume_info.write().unwrap() = pb_info;
+                self.refresh_remote_write_mode(io, false)?;
                 {
-                    return Err(VolumeError::Io(io::Error::new(
-                        io::ErrorKind::InvalidData,
-                        format!(
-                            "bytes_offset mismatch in {}: found {}, expected {}",
-                            path, self.volume_info.bytes_offset, OFFSET_SIZE
-                        ),
-                    )));
+                    let mut vi = self.volume_info.write().unwrap();
+                    if vi.version == 0 {
+                        vi.version = Version::current().0 as u32;
+                    }
+                    if vi.files.is_empty() && vi.bytes_offset == 0 {
+                        vi.bytes_offset = OFFSET_SIZE as u32;
+                    }
+                    if vi.bytes_offset != 0 && vi.bytes_offset != OFFSET_SIZE as u32 {
+                        let found = vi.bytes_offset;
+                        return Err(VolumeError::Io(io::Error::new(
+                            io::ErrorKind::InvalidData,
+                            format!(
+                                "bytes_offset mismatch in {}: found {}, expected {}",
+                                path, found, OFFSET_SIZE
+                            ),
+                        )));
+                    }
                 }
                 return Ok(true);
             }
             // Fall back to OldVersionVolumeInfo (Go's tryOldVersionVolumeInfo):
             // maps DestroyTime -> expire_at_sec
             if let Ok(old_info) = serde_json::from_str::<OldVersionVifVolumeInfo>(&content) {
-                let vif_info = old_info.to_vif();
+                let vif_info = old_info.into_vif();
                 let pb_info = vif_info.to_pb();
                 if pb_info.read_only {
-                    self.no_write_or_delete = true;
+                    self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
                 }
-                self.volume_info = pb_info;
-                self.refresh_remote_write_mode();
-                if self.volume_info.version == 0 {
-                    self.volume_info.version = Version::current().0 as u32;
-                }
-                if !self.has_remote_file && self.volume_info.bytes_offset == 0 {
-                    self.volume_info.bytes_offset = OFFSET_SIZE as u32;
-                }
-                if self.volume_info.bytes_offset != 0
-                    && self.volume_info.bytes_offset != OFFSET_SIZE as u32
+                *self.volume_info.write().unwrap() = pb_info;
+                self.refresh_remote_write_mode(io, false)?;
                 {
-                    return Err(VolumeError::Io(io::Error::new(
-                        io::ErrorKind::InvalidData,
-                        format!(
-                            "bytes_offset mismatch in {}: found {}, expected {}",
-                            path, self.volume_info.bytes_offset, OFFSET_SIZE
-                        ),
-                    )));
+                    let mut vi = self.volume_info.write().unwrap();
+                    if vi.version == 0 {
+                        vi.version = Version::current().0 as u32;
+                    }
+                    if vi.files.is_empty() && vi.bytes_offset == 0 {
+                        vi.bytes_offset = OFFSET_SIZE as u32;
+                    }
+                    if vi.bytes_offset != 0 && vi.bytes_offset != OFFSET_SIZE as u32 {
+                        let found = vi.bytes_offset;
+                        return Err(VolumeError::Io(io::Error::new(
+                            io::ErrorKind::InvalidData,
+                            format!(
+                                "bytes_offset mismatch in {}: found {}, expected {}",
+                                path, found, OFFSET_SIZE
+                            ),
+                        )));
+                    }
                 }
                 return Ok(true);
             }
             // Fall back to legacy format
             if let Ok(info) = serde_json::from_str::<VolumeInfo>(&content) {
                 if info.read_only {
-                    self.no_write_or_delete = true;
+                    self.set_no_write_flag(NO_WRITE_OR_DELETE, true);
                 }
                 return Ok(true);
             }
@@ -2469,43 +4546,51 @@ impl Volume {
             }
         }
 
-        let mut vif = VifVolumeInfo::from_pb(&self.volume_info);
-        vif.read_only = self.no_write_or_delete;
+        // remoteness-derived no_write_can_delete is not an operator mark; sync
+        // volume_info so refresh_remote_write_mode sees a real mark
+        let (no_write_or_delete, no_write_can_delete) = self.no_write_flags();
+        let marked_can_delete =
+            no_write_can_delete && !self.has_remote_file() && !no_write_or_delete;
 
-        // Match Go's SaveVolumeInfo: compute ExpireAtSec from TTL
-        let ttl_seconds = self.super_block.ttl.to_seconds();
-        if ttl_seconds > 0 {
-            let now = SystemTime::now()
-                .duration_since(UNIX_EPOCH)
-                .unwrap_or_default()
-                .as_secs();
-            vif.expire_at_sec = now + ttl_seconds;
-        }
+        // Match Go's SaveVolumeInfo: stamp ExpireAtSec into the live volume_info
+        // so read_volume_file_status returns it, not only into the written file.
+        let expire_at_sec = self.expire_at_sec();
+        let vif = {
+            let mut vi = self.volume_info.write().unwrap();
+            vi.read_only = no_write_or_delete || marked_can_delete;
+            vi.read_only_can_delete = marked_can_delete;
+            if expire_at_sec > 0 {
+                vi.expire_at_sec = expire_at_sec;
+            }
+            VifVolumeInfo::from_pb(&vi)
+        };
 
         let content = serde_json::to_string_pretty(&vif)
-            .map_err(|e| VolumeError::Io(io::Error::new(io::ErrorKind::Other, e.to_string())))?;
+            .map_err(|e| VolumeError::Io(io::Error::other(e.to_string())))?;
         fs::write(&vif_path, content)?;
         Ok(())
     }
 
     /// Save full VolumeInfo to .vif file (for tiered storage).
     /// Matches Go's SaveVolumeInfo which computes ExpireAtSec from TTL.
-    pub fn save_volume_info(&mut self) -> Result<(), VolumeError> {
-        self.volume_info.read_only = self.no_write_or_delete;
+    pub fn save_volume_info(&self) -> Result<(), VolumeError> {
+        let (no_write_or_delete, no_write_can_delete) = self.no_write_flags();
+        let marked_can_delete =
+            no_write_can_delete && !self.has_remote_file() && !no_write_or_delete;
 
         // Compute ExpireAtSec from TTL (matches Go's SaveVolumeInfo)
-        let ttl_seconds = self.super_block.ttl.to_seconds();
-        if ttl_seconds > 0 {
-            let now = SystemTime::now()
-                .duration_since(UNIX_EPOCH)
-                .unwrap_or_default()
-                .as_secs();
-            self.volume_info.expire_at_sec = now + ttl_seconds;
-        }
-
-        let vif = VifVolumeInfo::from_pb(&self.volume_info);
+        let expire_at_sec = self.expire_at_sec();
+        let vif = {
+            let mut vi = self.volume_info.write().unwrap();
+            vi.read_only = no_write_or_delete || marked_can_delete;
+            vi.read_only_can_delete = marked_can_delete;
+            if expire_at_sec > 0 {
+                vi.expire_at_sec = expire_at_sec;
+            }
+            VifVolumeInfo::from_pb(&vi)
+        };
         let content = serde_json::to_string_pretty(&vif)
-            .map_err(|e| VolumeError::Io(io::Error::new(io::ErrorKind::Other, e.to_string())))?;
+            .map_err(|e| VolumeError::Io(io::Error::other(e.to_string())))?;
         // fsync the .vif so a tiered volume's remote reference is durable before the
         // caller acts on it, e.g. deletes the remote object (matches Go util.WriteFile).
         let mut f = OpenOptions::new()
@@ -2520,10 +4605,11 @@ impl Volume {
 
     /// Get the remote storage backend name and key from this volume .vif.
     pub fn remote_storage_name_key(&self) -> (String, String) {
-        if self.volume_info.files.is_empty() {
+        let vi = self.volume_info.read().unwrap();
+        if vi.files.is_empty() {
             return (String::new(), String::new());
         }
-        let rf = &self.volume_info.files[0];
+        let rf = &vi.files[0];
         let backend_name = if rf.backend_id.is_empty() {
             rf.backend_type.clone()
         } else {
@@ -2542,26 +4628,38 @@ impl Volume {
         &self.dir
     }
 
+    /// Get the directory this volume's index is stored in.
+    pub fn dir_idx(&self) -> String {
+        self.dir_idx.read().unwrap().clone()
+    }
+
     /// Throttle IO during compaction to avoid saturating disk.
     pub fn maybe_throttle_compaction(&self, bytes_written: u64) {
-        if self.compaction_byte_per_second <= 0 || !self.is_compacting {
+        let limit = self.compaction_byte_per_second.load(Ordering::Relaxed);
+        if limit <= 0 || !self.is_compacting() {
             return;
         }
         // Simple throttle: sleep based on bytes written vs allowed rate
-        let sleep_us =
-            (bytes_written as f64 / self.compaction_byte_per_second as f64 * 1_000_000.0) as u64;
+        let sleep_us = (bytes_written as f64 / limit as f64 * 1_000_000.0) as u64;
         if sleep_us > 0 {
             std::thread::sleep(std::time::Duration::from_micros(sleep_us));
         }
     }
 
     /// Change the replication placement and rewrite the super block.
-    pub fn set_replica_placement(&mut self, rp: ReplicaPlacement) -> Result<(), VolumeError> {
-        self.super_block.replica_placement = rp;
-        let bytes = self.super_block.to_bytes();
-        let dat_file = self.dat_file.as_mut().ok_or_else(|| {
-            VolumeError::Io(io::Error::new(io::ErrorKind::Other, "dat file not open"))
-        })?;
+    pub fn set_replica_placement(&self, rp: ReplicaPlacement) -> Result<(), VolumeError> {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        let bytes = {
+            let mut sb = self.super_block.write().unwrap();
+            sb.replica_placement = rp;
+            sb.to_bytes()
+        };
+        let mut io = self.io.write().unwrap();
+        let dat_file = io
+            .dat_file
+            .as_mut()
+            .ok_or_else(|| VolumeError::Io(io::Error::other("dat file not open")))?;
         dat_file.seek(SeekFrom::Start(0))?;
         dat_file.write_all(&bytes)?;
         dat_file.sync_all()?;
@@ -2595,12 +4693,12 @@ impl Volume {
     /// Go reads the full needle body for ALL entries including tombstones to get the
     /// actual AppendAtNs timestamp, which is needed for correct binary search during
     /// incremental copy.
-    fn read_append_at_ns(&self, offset: Offset) -> Result<u64, VolumeError> {
+    fn read_append_at_ns(&self, io: &VolumeIo, offset: Offset) -> Result<u64, VolumeError> {
         let actual_offset = offset.to_actual_offset() as u64;
         let version = self.version();
 
         let mut header_buf = [0u8; NEEDLE_HEADER_SIZE];
-        self.read_exact_at_backend(&mut header_buf, actual_offset)?;
+        self.read_exact_at_backend(io, &mut header_buf, actual_offset)?;
 
         let (_cookie, _id, size) = Needle::parse_header(&header_buf);
 
@@ -2609,15 +4707,20 @@ impl Volume {
             return Ok(0);
         }
         let mut buf = vec![0u8; actual_size as usize];
-        self.read_exact_at_backend(&mut buf, actual_offset)?;
+        self.read_exact_at_backend(io, &mut buf, actual_offset)?;
 
         let mut n = Needle::default();
-        n.read_bytes_meta_only(&mut buf, offset.to_actual_offset(), size, version)?;
+        n.read_bytes_meta_only(&buf, offset.to_actual_offset(), size, version)?;
         Ok(n.append_at_ns)
     }
 
     /// Search right from position m to find the first non-deleted entry.
-    fn read_right_ns(&self, m: i64, max: i64) -> Result<(i64, Offset, u64), VolumeError> {
+    fn read_right_ns(
+        &self,
+        io: &VolumeIo,
+        m: i64,
+        max: i64,
+    ) -> Result<(i64, Offset, u64), VolumeError> {
         let mut index = m;
         loop {
             index += 1;
@@ -2626,14 +4729,14 @@ impl Volume {
             }
             let offset = self.read_offset_from_index(index)?;
             if !offset.is_zero() {
-                let ts = self.read_append_at_ns(offset)?;
+                let ts = self.read_append_at_ns(io, offset)?;
                 return Ok((index, offset, ts));
             }
         }
     }
 
     /// Search left from position m to find the first non-deleted entry.
-    fn read_left_ns(&self, m: i64) -> Result<(i64, Offset, u64), VolumeError> {
+    fn read_left_ns(&self, io: &VolumeIo, m: i64) -> Result<(i64, Offset, u64), VolumeError> {
         let mut index = m;
         loop {
             index -= 1;
@@ -2642,7 +4745,7 @@ impl Volume {
             }
             let offset = self.read_offset_from_index(index)?;
             if !offset.is_zero() {
-                let ts = self.read_append_at_ns(offset)?;
+                let ts = self.read_append_at_ns(io, offset)?;
                 return Ok((index, offset, ts));
             }
         }
@@ -2655,7 +4758,8 @@ impl Volume {
         &self,
         since_ns: u64,
     ) -> Result<(Offset, bool), VolumeError> {
-        let file_size = self.idx_file_size() as i64;
+        let io = self.io.read().unwrap();
+        let file_size = io.nm.as_ref().map_or(0, |nm| nm.index_file_size()) as i64;
         if file_size % NEEDLE_MAP_ENTRY_SIZE as i64 != 0 {
             return Err(VolumeError::Io(io::Error::new(
                 io::ErrorKind::InvalidData,
@@ -2677,8 +4781,9 @@ impl Volume {
             let offset = self.read_offset_from_index(m)?;
 
             if offset.is_zero() {
-                let (left_index, _left_offset, left_ns) = self.read_left_ns(m)?;
-                let (right_index, right_offset, right_ns) = self.read_right_ns(m, entry_count)?;
+                let (left_index, _left_offset, left_ns) = self.read_left_ns(&io, m)?;
+                let (right_index, right_offset, right_ns) =
+                    self.read_right_ns(&io, m, entry_count)?;
 
                 if right_ns <= since_ns {
                     l = right_index;
@@ -2695,7 +4800,7 @@ impl Volume {
                 return Ok((right_offset, false));
             }
 
-            let m_ns = self.read_append_at_ns(offset)?;
+            let m_ns = self.read_append_at_ns(&io, offset)?;
 
             if m_ns <= since_ns {
                 l = m + 1;
@@ -2713,17 +4818,26 @@ impl Volume {
     }
 
     /// Write a raw needle blob at a specific offset in the .dat file.
-    pub fn write_needle_blob(
-        &mut self,
+    pub fn write_needle_blob(&self, offset: i64, needle_blob: &[u8]) -> Result<(), VolumeError> {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        if self.is_read_only() {
+            return Err(VolumeError::ReadOnly(self.id));
+        }
+        let mut io = self.io.write().unwrap();
+        self.write_needle_blob_io(&mut io, offset, needle_blob)
+    }
+
+    fn write_needle_blob_io(
+        &self,
+        io: &mut VolumeIo,
         offset: i64,
         needle_blob: &[u8],
     ) -> Result<(), VolumeError> {
-        if self.is_read_only() {
-            return Err(VolumeError::ReadOnly);
-        }
-        let dat_file = self.dat_file.as_mut().ok_or_else(|| {
-            VolumeError::Io(io::Error::new(io::ErrorKind::Other, "dat file not open"))
-        })?;
+        let dat_file = io
+            .dat_file
+            .as_mut()
+            .ok_or_else(|| VolumeError::Io(io::Error::other("dat file not open")))?;
         dat_file.seek(SeekFrom::Start(offset as u64))?;
         dat_file.write_all(needle_blob)?;
         Ok(())
@@ -2732,14 +4846,24 @@ impl Volume {
     /// Write a needle blob and update the needle map index.
     /// Matches Go's Volume.WriteNeedleBlob which appends to dat and calls nm.Put.
     pub fn write_needle_blob_and_index(
-        &mut self,
+        &self,
         needle_id: NeedleId,
         needle_blob: &[u8],
         size: Size,
     ) -> Result<(), VolumeError> {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
         // nm.put on a read-only volume fails only after the blob is appended to .dat.
         if self.is_read_only() {
-            return Err(VolumeError::ReadOnly);
+            return Err(VolumeError::ReadOnly(self.id));
+        }
+        let mut io = self.io.write().unwrap();
+        // Storage guard: negativity-only (Go parity). See parse_needle_at.
+        if size.0 < 0 {
+            return Err(VolumeError::Io(std::io::Error::new(
+                std::io::ErrorKind::InvalidData,
+                format!("invalid needle size {}", size.0),
+            )));
         }
 
         // size indexes the needle and places the v3 append timestamp, so a caller using
@@ -2764,63 +4888,72 @@ impl Volume {
                 ),
             )));
         }
+        // The blob is appended as is: its length must be the record this size takes in this volume's version.
+        let actual_size = get_actual_size(size, self.version());
+        if needle_blob.len() as i64 != actual_size {
+            return Err(VolumeError::Io(io::Error::new(
+                io::ErrorKind::InvalidData,
+                format!(
+                    "needle {} blob of {} bytes does not match the {} bytes size {} takes in a version {} volume",
+                    needle_id.0,
+                    needle_blob.len(),
+                    actual_size,
+                    size.0,
+                    self.version().0
+                ),
+            )));
+        }
 
         // Dedup check: if the same needle already exists with matching content, skip the write.
         // Matches Go's WriteNeedleBlob which reads existing needle and compares cookie+checksum+data.
-        if let Some(nm) = &self.nm {
-            if let Some(nv) = nm.get(needle_id) {
-                if nv.size == size {
-                    let version = self.version();
-                    // Read existing needle from disk
-                    let mut old_needle = Needle::default();
-                    let mut ro = ReadOption::default();
-                    if self
-                        .read_needle_data_at_unlocked(
-                            &mut old_needle,
-                            nv.offset.to_actual_offset(),
-                            nv.size,
-                            &mut ro,
-                        )
-                        .is_ok()
-                    {
-                        // Parse the incoming blob into a needle
-                        let mut new_needle = Needle::default();
-                        if new_needle
-                            .read_bytes(needle_blob, nv.offset.to_actual_offset(), size, version)
-                            .is_ok()
-                        {
-                            if old_needle.cookie == new_needle.cookie
-                                && old_needle.checksum == new_needle.checksum
-                                && old_needle.data == new_needle.data
-                            {
-                                return Ok(());
-                            }
-                        }
-                    }
+        if let Some(nm) = &io.nm
+            && let Some(nv) = nm.get(needle_id)?
+            && nv.size == size
+        {
+            let version = self.version();
+            // Read existing needle from disk
+            let mut old_needle = Needle::default();
+            let mut ro = ReadOption::default();
+            if self
+                .read_needle_data_at_unlocked(
+                    &io,
+                    &mut old_needle,
+                    nv.offset.to_actual_offset(),
+                    nv.size,
+                    &mut ro,
+                )
+                .is_ok()
+            {
+                // Parse the incoming blob into a needle
+                let mut new_needle = Needle::default();
+                if new_needle
+                    .read_bytes(needle_blob, nv.offset.to_actual_offset(), size, version)
+                    .is_ok()
+                    && old_needle.cookie == new_needle.cookie
+                    && old_needle.checksum == new_needle.checksum
+                    && old_needle.data == new_needle.data
+                {
+                    return Ok(());
                 }
             }
         }
 
         // Check volume size limit
-        let content_size = self.content_size();
+        let content_size = io.nm.as_ref().map_or(0, |nm| nm.content_size());
         if MAX_POSSIBLE_VOLUME_SIZE < content_size + needle_blob.len() as u64 {
-            return Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                format!(
-                    "volume size limit {} exceeded! current size is {}",
-                    MAX_POSSIBLE_VOLUME_SIZE, content_size
-                ),
-            )));
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "volume size limit {} exceeded! current size is {}",
+                MAX_POSSIBLE_VOLUME_SIZE, content_size
+            ))));
         }
 
         // Compute monotonic appendAtNs (matches Go: needle.GetAppendAtNs(v.lastAppendAtNs))
-        let append_at_ns = get_append_at_ns(self.last_append_at_ns);
+        let append_at_ns = get_append_at_ns(io.last_append_at_ns);
 
         // Patch appendAtNs timestamp into V3 blobs (matches Go WriteNeedleBlob L64-77)
         let mut blob_buf;
         let blob_to_write = if self.version() == VERSION_3 {
-            let ts_offset =
-                NEEDLE_HEADER_SIZE + size.0 as usize + NEEDLE_CHECKSUM_SIZE;
+            let ts_offset = NEEDLE_HEADER_SIZE + size.0 as usize + NEEDLE_CHECKSUM_SIZE;
             if ts_offset + TIMESTAMP_SIZE > needle_blob.len() {
                 return Err(VolumeError::Io(io::Error::new(
                     io::ErrorKind::InvalidData,
@@ -2840,23 +4973,32 @@ impl Volume {
         };
 
         // Append blob at end of dat file
-        let dat_size = self.dat_file_size()? as i64;
-        self.write_needle_blob(dat_size, blob_to_write)?;
+        let dat_size = self.current_dat_file_size_io(&io)? as i64;
+        self.write_needle_blob_io(&mut io, dat_size, blob_to_write)?;
 
         // Update lastAppendAtNs (matches Go L352: v.lastAppendAtNs = appendAtNs)
-        self.last_append_at_ns = append_at_ns;
+        io.last_append_at_ns = append_at_ns;
+        io.last_write_append_at_ns = append_at_ns;
+        io.last_write_needle_key = needle_id;
+        io.last_write_deleted = false;
 
         // Update needle map index
         let offset = Offset::from_actual_offset(dat_size);
-        if let Some(ref mut nm) = self.nm {
+        if let Some(ref mut nm) = io.nm {
             nm.put(needle_id, offset, size)?;
         }
+        self.maybe_checkpoint_index(&mut io, false);
 
         Ok(())
     }
 
     pub fn needs_replication(&self) -> bool {
-        self.super_block.replica_placement.get_copy_count() > 1
+        self.super_block
+            .read()
+            .unwrap()
+            .replica_placement
+            .get_copy_count()
+            > 1
     }
 
     /// Garbage ratio: deleted_size / content_size (matching Go's garbageLevel).
@@ -2878,7 +5020,9 @@ impl Volume {
             // This happens for .sdx converted back to normal .idx
             // where deleted entry size is missing
             let dat_file_size = self.dat_file_size().unwrap_or(0);
-            deleted = dat_file_size.saturating_sub(content).saturating_sub(SUPER_BLOCK_SIZE as u64);
+            deleted = dat_file_size
+                .saturating_sub(content)
+                .saturating_sub(SUPER_BLOCK_SIZE as u64);
             file_size = dat_file_size;
         }
 
@@ -2892,9 +5036,29 @@ impl Volume {
         self.current_dat_file_size()
     }
 
+    /// Disk space held by the local .dat file, or 0 when it is unknown. It
+    /// exceeds the file size when the file was preallocated with
+    /// `FALLOC_FL_KEEP_SIZE`.
+    pub fn dat_allocated_size(&self) -> u64 {
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::MetadataExt;
+            let io = self.io.read().unwrap();
+            io.dat_file
+                .as_ref()
+                .and_then(|f| f.metadata().ok())
+                .map_or(0, |m| m.blocks() * 512)
+        }
+        #[cfg(not(unix))]
+        {
+            0
+        }
+    }
+
     /// Get the modification time of the .dat file as Unix seconds.
     pub fn dat_file_mod_time(&self) -> u64 {
-        if let Some(dat_file) = self.dat_file.as_ref() {
+        let io = self.io.read().unwrap();
+        if let Some(dat_file) = io.dat_file.as_ref() {
             dat_file
                 .metadata()
                 .ok()
@@ -2903,7 +5067,7 @@ impl Volume {
                 .map(|d| d.as_secs())
                 .unwrap_or(0)
         } else {
-            self.remote_dat_file
+            io.remote_dat_file
                 .as_ref()
                 .map(|remote_dat_file| remote_dat_file.modified_time)
                 .unwrap_or(0)
@@ -2911,7 +5075,12 @@ impl Volume {
     }
 
     pub fn idx_file_size(&self) -> u64 {
-        self.nm.as_ref().map_or(0, |nm| nm.index_file_size())
+        self.io
+            .read()
+            .unwrap()
+            .nm
+            .as_ref()
+            .map_or(0, |nm| nm.index_file_size())
     }
 
     // ---- Compaction / Vacuum ----
@@ -2920,7 +5089,7 @@ impl Volume {
     /// This reads from the current .dat/.idx and writes to .cpd/.cpx.
     /// Call `commit_compact()` after to swap the files.
     pub fn compact_by_index<F>(
-        &mut self,
+        &self,
         _preallocate: u64,
         _max_bytes_per_second: i64,
         progress_fn: F,
@@ -2928,178 +5097,128 @@ impl Volume {
     where
         F: Fn(i64) -> bool,
     {
-        if self.is_compacting {
-            return Ok(()); // already compacting
+        match self.begin_compact_by_index()? {
+            Some(job) => job.run(progress_fn),
+            None => Ok(()), // already compacting
         }
-        self.is_compacting = true;
-
-        let result = self.do_compact_by_index(progress_fn);
-
-        self.is_compacting = false;
-        result
     }
 
-    fn do_compact_by_index<F>(&mut self, progress_fn: F) -> Result<(), VolumeError>
-    where
-        F: Fn(i64) -> bool,
-    {
-        // Guard against nil needle map (matches Go's nil check before compaction sync)
-        if self.nm.is_none() {
-            return Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                format!("volume {} needle map is nil", self.id),
-            )));
+    /// Claim the compaction, record the `makeup_diff` watermark, and open the
+    /// sources the copy reads, so the caller can run the copy after dropping
+    /// its store guard. `None` means a compaction is already running.
+    pub(crate) fn begin_compact_by_index(&self) -> Result<Option<CompactionJob>, VolumeError> {
+        let Some(claim) = CompactionClaim::try_claim(&self.is_compacting) else {
+            return Ok(None);
+        };
+
+        let mut io = self.io.write().unwrap();
+
+        // Guard against nil needle map (matches Go's nil check)
+        let idx_size = match io.nm.as_ref() {
+            Some(nm) => nm.index_file_size(),
+            None => {
+                return Err(VolumeError::Io(io::Error::other(format!(
+                    "volume {} needle map is nil",
+                    self.id
+                ))));
+            }
+        };
+        if let Some(e) = self.unavailable_error() {
+            return Err(e);
         }
+        // The copy would stream the .dat from remote storage for a commit that refuses it.
+        if self.has_remote_file() {
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "volume {} is tiered to remote storage, cannot compact",
+                self.id
+            ))));
+        }
+
+        // Fresh opens, not `try_clone`: see `dat_scan_plan`.
+        let src_dat = if io.dat_file.is_some() {
+            NeedleStreamSource::Local(open_volume_file(
+                OpenOptions::new().read(true),
+                self.file_name(".dat"),
+            )?)
+        } else if let Some(remote) = io.remote_dat_file.clone() {
+            NeedleStreamSource::Remote(remote)
+        } else {
+            return Err(VolumeError::Io(io::Error::other("dat file not open")));
+        };
+        let src_idx = open_volume_file(OpenOptions::new().read(true), self.file_name(".idx"))?;
 
         // Record state before compaction for makeupDiff
-        self.last_compact_index_offset = self.nm.as_ref().map_or(0, |nm| nm.index_file_size());
-        self.last_compact_revision = self.super_block.compaction_revision;
+        let old_super_block = self.super_block.read().unwrap().clone();
+        io.last_compact_index_offset = idx_size;
+        io.last_compact_revision = old_super_block.compaction_revision;
 
-        // Sync current data
-        self.sync_to_disk()?;
-
-        let cpd_path = self.file_name(".cpd");
-        let cpx_path = self.file_name(".cpx");
-        let version = self.version();
-
-        // Write new super block with incremented compaction revision
-        let mut new_sb = self.super_block.clone();
-        new_sb.compaction_revision += 1;
-        let sb_bytes = new_sb.to_bytes();
-
-        let mut dst = OpenOptions::new()
-            .read(true)
-            .write(true)
-            .create(true)
-            .truncate(true)
-            .open(&cpd_path)?;
-        dst.write_all(&sb_bytes)?;
-        let mut new_offset = sb_bytes.len() as i64;
-
-        // Build new index in memory
-        let mut new_nm = CompactNeedleMap::new();
-        let now = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_secs();
-
-        // Collect live entries from needle map (sorted ascending)
-        let nm = self.nm.as_ref().ok_or(VolumeError::NotInitialized)?;
-        let mut entries: Vec<(NeedleId, Offset, Size)> = Vec::new();
-        for (id, nv) in nm.iter_entries() {
-            if nv.offset.is_zero() || nv.size.is_deleted() {
-                continue;
-            }
-            entries.push((id, nv.offset, nv.size));
-        }
-        entries.sort_by_key(|(_, offset, _)| *offset);
-
-        let mut skipped_needles: u64 = 0;
-        let mut skipped_data_bytes: u64 = 0;
-        for (id, offset, size) in entries {
-            // Progress callback
-            if !progress_fn(offset.to_actual_offset()) {
-                // Interrupted
-                let _ = fs::remove_file(&cpd_path);
-                return Err(VolumeError::Io(io::Error::new(
-                    io::ErrorKind::Interrupted,
-                    "compaction interrupted",
-                )));
-            }
-
-            // Read needle from source
-            let mut n = Needle {
-                id,
-                ..Needle::default()
-            };
-            match self.read_needle_data_at(&mut n, offset.to_actual_offset(), size) {
-                Ok(()) => {}
-                Err(e) => {
-                    // Record EIO for health monitoring (parity with Go's checkReadWriteError).
-                    if let VolumeError::Io(ref io_err) = e {
-                        self.check_read_write_error(Some(io_err));
-                    }
-                    // Only drop the entry when the failure is one of the well-
-                    // known permanent-corruption shapes. A transient disk fault,
-                    // a tiered-read timeout, or a Windows hardware error (which
-                    // surfaces as a generic Io rather than UnexpectedEof) must
-                    // abort so an operator notices, rather than silently
-                    // compacting away data that might come back on retry.
-                    // See issue #8928.
-                    if !is_skippable_needle_read_error(&e) {
-                        return Err(VolumeError::Io(io::Error::new(
-                            io::ErrorKind::Other,
-                            format!("cannot hydrate needle from file: {}", e),
-                        )));
-                    }
-                    skipped_needles += 1;
-                    if size.is_valid() {
-                        skipped_data_bytes += size.0 as u64;
-                    }
-                    warn!(
-                        volume_id = self.id.0,
-                        key = id.0,
-                        offset = offset.to_actual_offset(),
-                        size = size.0,
-                        error = %e,
-                        "vacuum: dropping unreadable needle"
-                    );
-                    continue;
-                }
-            }
-
-            // Skip TTL-expired needles using the volume's TTL (matches Go's volume_vacuum.go)
-            if n.has_ttl() {
-                let ttl_minutes = self.super_block.ttl.minutes();
-                if ttl_minutes > 0 && n.last_modified > 0 {
-                    let expire_at = n.last_modified + (ttl_minutes as u64) * 60;
-                    if now >= expire_at {
-                        continue;
-                    }
-                }
-            }
-
-            // Write needle to destination
-            let bytes = n.write_bytes(version);
-            dst.write_all(&bytes)?;
-
-            // Update new index
-            new_nm.put(id, Offset::from_actual_offset(new_offset), n.size)?;
-            new_offset += bytes.len() as i64;
-        }
-
-        if skipped_needles > 0 {
-            warn!(
-                volume_id = self.id.0,
-                skipped_needles,
-                skipped_data_bytes,
-                "vacuum: dropped unreadable index entries during compaction"
-            );
-        }
-
-        dst.sync_all()?;
-
-        // Save new index
-        new_nm.save_to_idx(&cpx_path)?;
-
-        Ok(())
+        Ok(Some(CompactionJob {
+            id: self.id,
+            src_dat,
+            src_idx,
+            idx_size,
+            cpd_path: self.file_name(".cpd"),
+            cpx_path: self.file_name(".cpx"),
+            version: self.version(),
+            super_block: old_super_block,
+            io_errors: self.io_errors.clone(),
+            _claim: claim,
+        }))
     }
 
     /// Commit a previously completed compaction: swap .cpd/.cpx to .dat/.idx and reload.
     /// Matches Go's isCompactionInProgress CompareAndSwap guard.
-    pub fn commit_compact(&mut self) -> Result<(), VolumeError> {
-        if self.is_compacting {
-            return Ok(()); // already compacting, silently skip (matches Go)
-        }
-        self.is_compacting = true;
-
-        let result = self.do_commit_compact();
-
-        self.is_compacting = false;
-        result
+    pub fn commit_compact(&self) -> Result<(), VolumeError> {
+        // Go parity: CommitCompact holds dataFileAccessLock, so the swap waits
+        // out leased readers (a fast-read stream leases for its whole body).
+        // Try-lock for callers that hold the store write lock; blocking there
+        // would stall every volume behind one slow client. The vacuum-commit
+        // RPC uses the lease-holding path instead — it waits with no store
+        // guard held, matching Go's blocking commit.
+        // The sync lock must come before the lease and be non-blocking like
+        // it: a durable write holds it across its fsync, and the commit must
+        // not swap files over an unpublished write — nor stall the store
+        // behind one.
+        let Ok(_sync_guard) = self.data_file_sync_lock.try_lock() else {
+            return Err(VolumeError::Io(io::Error::new(
+                io::ErrorKind::WouldBlock,
+                COMMIT_WAITS_FOR_READS,
+            )));
+        };
+        let Some(_lease) = self.data_file_access_control.try_write_lock() else {
+            return Err(VolumeError::Io(io::Error::new(
+                io::ErrorKind::WouldBlock,
+                COMMIT_WAITS_FOR_READS,
+            )));
+        };
+        self.commit_compact_held()
     }
 
-    fn do_commit_compact(&mut self) -> Result<(), VolumeError> {
+    /// `commit_compact` for callers already holding `data_file_sync_lock`
+    /// and the write lease — the swap must not land between a durable
+    /// write's append and its publish.
+    pub(crate) fn commit_compact_held(&self) -> Result<(), VolumeError> {
+        // A handle detached between lookup and lease must not swap compacted
+        // files over the ones its remounted replacement now owns.
+        if self.is_closed() {
+            return Err(VolumeError::NotFound);
+        }
+        let Some(_claim) = CompactionClaim::try_claim(&self.is_compacting) else {
+            return Ok(()); // already compacting, silently skip (matches Go)
+        };
+        // The reload would read the remote object through the compacted .idx.
+        if self.has_remote_file() {
+            let _ = fs::remove_file(self.file_name(".cpd"));
+            let _ = fs::remove_file(self.file_name(".cpx"));
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "volume {} is tiered to remote storage, cannot commit compaction",
+                self.id
+            ))));
+        }
+        self.do_commit_compact()
+    }
+
+    fn do_commit_compact(&self) -> Result<(), VolumeError> {
         if let Err(e) = self.makeup_diff() {
             warn!("makeup_diff failed: {}", e);
             // Match Go: clean up .cpd/.cpx on makeup_diff failure
@@ -3111,15 +5230,18 @@ impl Volume {
         }
 
         // Close current files
-        if let Some(ref mut nm) = self.nm {
-            nm.close();
+        {
+            let mut io = self.io.write().unwrap();
+            if let Some(ref mut nm) = io.nm {
+                nm.close();
+            }
+            io.nm = None;
+            if let Some(ref dat_file) = io.dat_file {
+                let _ = dat_file.sync_all();
+            }
+            io.dat_file = None;
+            io.remote_dat_file = None;
         }
-        self.nm = None;
-        if let Some(ref dat_file) = self.dat_file {
-            let _ = dat_file.sync_all();
-        }
-        self.dat_file = None;
-        self.remote_dat_file = None;
 
         // makeup_diff has fsynced the .cpd/.cpx contents. Persist a durable .cpc
         // commit marker BEFORE the renames so the two-rename swap is atomic
@@ -3130,8 +5252,22 @@ impl Volume {
         self.write_compact_commit_marker()?;
         self.apply_compact_swap()?;
 
-        // Reload
-        self.load(true, false, 0, self.version())?;
+        // The write watermark already equals what recover_last_modified_ts
+        // would rescan, so keep the clock instead of paying for the scan
+        // under the lock. If its write was itself deleted, the reload
+        // recovers the newest surviving write instead.
+        let mut io = self.io.write().unwrap();
+        if io.last_write_append_at_ns != 0 {
+            self.last_modified_ts_seconds.store(
+                io.last_write_append_at_ns / 1_000_000_000,
+                Ordering::Relaxed,
+            );
+        }
+        io.keep_last_modified_ts_on_load =
+            self.last_modified_ts_seconds.load(Ordering::Relaxed) != 0 && !io.last_write_deleted;
+        let load_result = self.load_io(&mut io, true, false, 0, self.version());
+        io.keep_last_modified_ts_on_load = false;
+        load_result?;
 
         Ok(())
     }
@@ -3202,7 +5338,7 @@ impl Volume {
         }
         if cpd_exists || cpx_exists {
             fsync_dir(&dat_path)?;
-            if self.dir != self.dir_idx {
+            if self.dir != *self.dir_idx.read().unwrap() {
                 fsync_dir(&idx_path)?;
             }
             let _ = fs::remove_dir_all(self.file_name(".ldb"));
@@ -3266,17 +5402,18 @@ impl Volume {
 
     /// Clean up leftover compaction files (.cpd, .cpx).
     pub fn cleanup_compact(&self) -> Result<(), VolumeError> {
+        // An in-flight copy is still writing .cpd/.cpx.
+        if self.is_compacting() {
+            return Err(self.compacting_error());
+        }
         // Refuse to unlink .cpd/.cpx while a .cpc marker exists: those temp files
         // are the only inputs reconcile can roll forward to, so removing them
         // mid-commit would strand a decided swap.
         if Path::new(&self.file_name(".cpc")).exists() {
-            return Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                format!(
-                    "volume {}: refusing cleanup while commit marker present",
-                    self.id
-                ),
-            )));
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "volume {}: refusing cleanup while commit marker present",
+                self.id
+            ))));
         }
 
         let cpd_path = self.file_name(".cpd");
@@ -3291,10 +5428,10 @@ impl Volume {
 
         // Ignore NotFound errors
         for e in [e1, e2, e3, e4] {
-            if let Err(e) = e {
-                if e.kind() != io::ErrorKind::NotFound {
-                    return Err(e.into());
-                }
+            if let Err(e) = e
+                && e.kind() != io::ErrorKind::NotFound
+            {
+                return Err(e.into());
             }
         }
 
@@ -3302,21 +5439,25 @@ impl Volume {
     }
 
     /// Read any new needles appended during compaction and append them to .cpd/.cpx
-    fn makeup_diff(&mut self) -> Result<(), VolumeError> {
-        let old_idx_size = self.nm.as_ref().map_or(0, |nm| nm.index_file_size());
-        if old_idx_size == 0 || old_idx_size <= self.last_compact_index_offset {
+    fn makeup_diff(&self) -> Result<(), VolumeError> {
+        let (old_idx_size, last_compact_index_offset, last_compact_revision) = {
+            let io = self.io.read().unwrap();
+            (
+                io.nm.as_ref().map_or(0, |nm| nm.index_file_size()),
+                io.last_compact_index_offset,
+                io.last_compact_revision,
+            )
+        };
+        if old_idx_size == 0 || old_idx_size <= last_compact_index_offset {
             return Ok(());
         }
 
-        let old_super_block = &self.super_block;
-        if old_super_block.compaction_revision != self.last_compact_revision {
-            return Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                format!(
-                    "current old dat file's compact revision {} is not the expected one {}",
-                    old_super_block.compaction_revision, self.last_compact_revision
-                ),
-            )));
+        let old_super_block = self.super_block.read().unwrap().clone();
+        if old_super_block.compaction_revision != last_compact_revision {
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "current old dat file's compact revision {} is not the expected one {}",
+                old_super_block.compaction_revision, last_compact_revision
+            ))));
         }
 
         // Read the new .cpd file's super block and verify its compaction revision is old + 1
@@ -3328,13 +5469,10 @@ impl Volume {
         let old_compact_revision = old_super_block.compaction_revision;
         let new_compact_revision = new_super_block.compaction_revision;
         if old_compact_revision + 1 != new_compact_revision {
-            return Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                format!(
-                    "old dat file's compact revision {} + 1 does not equal new dat file's compact revision {}",
-                    old_compact_revision, new_compact_revision
-                ),
-            )));
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "old dat file's compact revision {} + 1 does not equal new dat file's compact revision {}",
+                old_compact_revision, new_compact_revision
+            ))));
         }
 
         let old_idx_path = self.file_name(".idx");
@@ -3342,7 +5480,7 @@ impl Volume {
 
         // Read new entries from .idx
         let mut incremented_entries = std::collections::HashMap::new();
-        let offset = self.last_compact_index_offset;
+        let offset = last_compact_index_offset;
 
         old_idx_file.seek(SeekFrom::Start(offset))?;
         let entry_count = (old_idx_size - offset) / NEEDLE_MAP_ENTRY_SIZE as u64;
@@ -3361,10 +5499,7 @@ impl Volume {
         let cpx_path = self.file_name(".cpx");
 
         let mut dst_dat = OpenOptions::new().read(true).write(true).open(&cpd_path)?;
-        let mut dst_idx = OpenOptions::new()
-            .write(true)
-            .append(true)
-            .open(&cpx_path)?;
+        let mut dst_idx = OpenOptions::new().append(true).open(&cpx_path)?;
 
         let mut dat_offset = dst_dat.seek(SeekFrom::End(0))?;
         let padding_rem = dat_offset % NEEDLE_PADDING_SIZE as u64;
@@ -3382,20 +5517,11 @@ impl Volume {
                 let actual_size = crate::storage::needle::needle::get_actual_size(size, version);
                 let mut blob = vec![0u8; actual_size as usize];
 
-                #[cfg(unix)]
-                {
-                    use std::os::unix::fs::FileExt;
-                    old_dat_file
-                        .read_exact_at(&mut blob, needle_offset.to_actual_offset() as u64)?;
-                }
-                #[cfg(windows)]
-                {
-                    crate::storage::volume::read_exact_at(
-                        &old_dat_file,
-                        &mut blob,
-                        needle_offset.to_actual_offset() as u64,
-                    )?;
-                }
+                read_exact_at(
+                    &old_dat_file,
+                    &mut blob,
+                    needle_offset.to_actual_offset() as u64,
+                )?;
 
                 dst_dat.write_all(&blob)?;
 
@@ -3447,46 +5573,147 @@ impl Volume {
 
     // ---- Sync / Close ----
 
-    pub fn sync_to_disk(&mut self) -> io::Result<()> {
-        if let Some(ref dat_file) = self.dat_file {
+    pub fn sync_to_disk(&self) -> io::Result<()> {
+        let io = self.io.read().unwrap();
+        if let Some(ref dat_file) = io.dat_file {
             dat_file.sync_all()?;
         }
-        if let Some(ref nm) = self.nm {
+        if let Some(ref nm) = io.nm {
             nm.sync()?;
         }
         Ok(())
     }
 
-    pub fn close(&mut self) {
-        if let Some(ref dat_file) = self.dat_file {
-            let _ = dat_file.sync_all();
+    /// Go's `Volume.Close`: the write lease excludes in-flight I/O — with a
+    /// shared handle, `&mut self` no longer provides that exclusion.
+    pub fn close(&self) {
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        self.closed.store(true, Ordering::Release);
+        self.close_locked();
+    }
+
+    /// `close` for callers already holding the write lease (Go's `doClose`).
+    fn close_locked(&self) {
+        let mut io = self.io.write().unwrap();
+        let dat_synced = if let Some(ref dat_file) = io.dat_file {
+            dat_file.sync_all().is_ok()
+        } else {
+            true
+        };
+        io.dat_file = None;
+        io.remote_dat_file = None;
+        // When the .dat flushed, checkpoint the index so the next load starts
+        // from the recorded .idx size. When it did not, skip the checkpoint:
+        // a durable index pointing past an unflushed .dat tail would make the
+        // reload's max_needle_end check mark the volume read-only. Without the
+        // checkpoint, META_IDX_SIZE stays at the last successful one and the
+        // reload replays the uncheckpointed tail (redb flushes on drop).
+        if let Some(ref mut nm) = io.nm {
+            if dat_synced {
+                nm.close();
+            } else {
+                tracing::warn!(
+                    "volume {}: .dat sync failed on close, skipping index checkpoint",
+                    self.id.0
+                );
+                nm.close_without_checkpoint();
+            }
         }
-        self.dat_file = None;
-        self.remote_dat_file = None;
-        if let Some(ref nm) = self.nm {
-            let _ = nm.sync();
+        io.nm = None;
+    }
+
+    /// Move this volume's `.idx` (and `.sdx` when present) from its current
+    /// index directory into `new_idx_dir`, then reload in place. Mirrors Go's
+    /// `Volume::RelocateIndexTo`: it is a no-op when the index is already there
+    /// or nothing is co-located to move, and is used to pull an index a decode
+    /// or reconstruct left beside the data back into the configured `-dir.idx`.
+    pub fn relocate_index_to(&self, new_idx_dir: &str) -> Result<(), VolumeError> {
+        // Moving .idx would strand the .cpx an in-flight copy writes beside it.
+        if self.is_compacting() {
+            return Err(self.compacting_error());
         }
-        self.nm = None;
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+
+        if self.dir_idx() == new_idx_dir {
+            return Ok(());
+        }
+        let old_base = volume_file_name(&self.dir_idx(), &self.collection, self.id);
+        let old_idx = format!("{old_base}.idx");
+        if !Path::new(&old_idx).exists() {
+            return Ok(()); // nothing co-located to move
+        }
+        let new_base = volume_file_name(new_idx_dir, &self.collection, self.id);
+        let new_idx = format!("{new_base}.idx");
+
+        // Close the index and data handles before moving the index file.
+        let version = self.version();
+        self.close_locked();
+
+        if let Err(e) = rename_or_copy(&old_idx, &new_idx) {
+            // Reopen against the old dir so the volume is not left down; surface
+            // a failed reopen since it leaves the volume unusable until reload.
+            if let Err(reopen) = self.load(true, false, 0, version) {
+                error!(
+                    "relocate volume {}: reopen after failed .idx move: {}",
+                    self.id, reopen
+                );
+            }
+            return Err(VolumeError::Io(io::Error::other(format!(
+                "relocate index for volume {}: move .idx: {e}",
+                self.id
+            ))));
+        }
+
+        // The .sdx is a derived sorted index; move it when present, but a
+        // failure is not fatal — drop the stale copy so a reload rebuilds it.
+        let old_sdx = format!("{old_base}.sdx");
+        if Path::new(&old_sdx).exists() {
+            let new_sdx = format!("{new_base}.sdx");
+            if let Err(e) = rename_or_copy(&old_sdx, &new_sdx) {
+                warn!(
+                    "relocate volume {}: move .sdx: {} (will rebuild)",
+                    self.id, e
+                );
+                let _ = fs::remove_file(&old_sdx);
+            }
+        }
+
+        *self.dir_idx.write().unwrap() = new_idx_dir.to_string();
+        self.load(true, false, 0, version)
     }
 
     /// Remove all volume files from disk.
     /// Destroy removes everything related to this volume. When keep_remote_data
     /// is true the cloud-tier object backing the volume is left intact — used
     /// by moves where another server is taking over the same .vif.
-    pub fn destroy(&mut self, only_empty: bool, keep_remote_data: bool) -> Result<(), VolumeError> {
-        if only_empty && self.file_count() > 0 {
+    pub fn destroy(
+        &self,
+        only_empty: bool,
+        only_garbage: bool,
+        keep_remote_data: bool,
+    ) -> Result<(), VolumeError> {
+        // Go's Destroy holds dataFileAccessLock: file unlinking must exclude
+        // in-flight I/O from a shared handle, not just borrow exclusivity.
+        let _sync_guard = self.data_file_sync_lock.lock().unwrap();
+        let _guard = self.data_file_access_control.write_lock();
+        // Either enabled check may pass: a volume with no live data qualifies
+        // whether it reads empty or as all garbage. Byte counters, not counts:
+        // index rows and live tallies drift apart on reload.
+        let empty_ok = only_empty && self.file_count() == 0;
+        let garbage_ok =
+            only_garbage && self.content_size() > 0 && self.deleted_size() >= self.content_size();
+        if (only_empty || only_garbage) && !empty_ok && !garbage_ok {
             return Err(VolumeError::NotEmpty);
         }
-        if self.is_compacting {
-            return Err(VolumeError::Io(io::Error::new(
-                io::ErrorKind::Other,
-                format!("volume {} is compacting", self.id),
-            )));
+        if self.is_compacting() {
+            return Err(self.compacting_error());
         }
 
         let (storage_name, storage_key) = self.remote_storage_name_key();
         if !keep_remote_data
-            && self.has_remote_file
+            && self.has_remote_file()
             && !storage_name.is_empty()
             && !storage_key.is_empty()
         {
@@ -3496,13 +5723,12 @@ impl Volume {
                 .get(&storage_name);
             if let Some(backend) = backend {
                 if let Err(e) = backend.delete_file_blocking(&storage_key) {
-                    warn!(
-                        volume_id = self.id.0,
-                        storage_name,
-                        storage_key,
-                        error = %e,
-                        "failed to delete remote tier file during destroy"
-                    );
+                    // Stop short of local cleanup: a failed remote delete must
+                    // not strand a registered replica with no local files.
+                    return Err(VolumeError::Io(io::Error::other(format!(
+                        "volume {} remote object {}/{} delete failed: {}",
+                        self.id, storage_name, storage_key, e
+                    ))));
                 }
             } else {
                 warn!(
@@ -3517,7 +5743,7 @@ impl Volume {
         // a source replica before it is deleted), keep the .vif so removing the
         // regular volume does not strip the EC volume's info file.
         let keep_vif = self.shares_vif_with_ec_volume();
-        self.close();
+        self.close_locked();
         remove_volume_files(&self.data_file_name(), keep_vif);
         remove_volume_files(&self.index_file_name(), keep_vif);
         Ok(())
@@ -3533,50 +5759,98 @@ impl Volume {
                 .map(|m| !m.is_dir() && m.len() > 0)
                 .unwrap_or(false)
         };
-        if has_ecx(&volume_file_name(&self.dir_idx, &self.collection, self.id)) {
+        let dir_idx = self.dir_idx();
+        if has_ecx(&volume_file_name(&dir_idx, &self.collection, self.id)) {
             return true;
         }
-        self.dir != self.dir_idx
-            && has_ecx(&volume_file_name(&self.dir, &self.collection, self.id))
+        self.dir != dir_idx && has_ecx(&volume_file_name(&self.dir, &self.collection, self.id))
     }
 
-    /// Check if an I/O error is EIO (errno 5) and record it for health monitoring.
-    /// On success (None), clears any previously recorded EIO error.
-    /// Matches Go's `checkReadWriteError` in volume_write.go.
+    /// Matches Go's `checkReadWriteError` in `weed/storage/io_error.go`.
     fn check_read_write_error(&self, err: Option<&io::Error>) {
-        if let Some(e) = err {
-            if e.raw_os_error() == Some(5) {
-                // EIO — record it
-                if let Ok(mut guard) = self.last_io_error.lock() {
-                    *guard = Some(e.to_string());
-                }
-            }
-        } else {
-            // Success — clear any previous EIO
-            if let Ok(mut guard) = self.last_io_error.lock() {
-                if guard.is_some() {
-                    *guard = None;
-                }
-            }
-        }
+        self.io_errors.check_read_write_error(err);
     }
 
-    /// Returns the last recorded I/O error string, if any.
-    #[allow(dead_code)]
-    pub fn last_io_error(&self) -> Option<String> {
-        self.last_io_error.lock().ok()?.clone()
+    pub fn get_io_error_state(&self) -> (Option<String>, i32, bool) {
+        self.io_errors.get_io_error_state()
+    }
+
+    pub fn should_quarantine(&self) -> bool {
+        self.io_errors.should_quarantine()
+    }
+
+    pub fn mark_io_quarantined(&self) {
+        self.io_errors.mark_io_quarantined();
+    }
+
+    pub fn reset_io_error_state(&self) {
+        self.io_errors.reset_io_error_state();
     }
 
     #[cfg(test)]
     pub(crate) fn set_last_io_error_for_test(&self, err: Option<&str>) {
-        if let Ok(mut guard) = self.last_io_error.lock() {
-            *guard = err.map(|value| value.to_string());
+        self.io_errors.set_last_io_error_for_test(err);
+    }
+
+    /// Test-only `io` read guard for sibling-module tests that need to call
+    /// `VolumeIo`-parameterized helpers.
+    #[cfg(test)]
+    pub(crate) fn io_read_for_test(&self) -> std::sync::RwLockReadGuard<'_, VolumeIo> {
+        self.io.read().unwrap()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn fail_next_fsync_for_test(&self, fail: bool) {
+        self.io.write().unwrap().fail_fsync_for_test = fail;
+    }
+
+    /// Test-only read of the redb META `.idx` size through the live handle.
+    /// See `needle_map::test_support::live_meta_idx_size` for why durability
+    /// tests read this live instead of copying the open `.rdb` (Windows
+    /// mandatory file locking rejects reads of the locked file).
+    #[cfg(test)]
+    pub(crate) fn live_meta_idx_size_for_test(&self) -> Option<u64> {
+        match self.io.read().unwrap().nm.as_ref() {
+            Some(NeedleMap::Redb(nm)) => nm.live_meta_idx_size(),
+            _ => None,
         }
     }
 
     #[cfg(test)]
-    pub(crate) fn set_last_modified_ts_for_test(&mut self, ts_seconds: u64) {
-        self.last_modified_ts_seconds = ts_seconds;
+    pub(crate) fn fail_next_idx_sync_for_test(&self, fail: bool) {
+        self.io.write().unwrap().fail_idx_sync_for_test = fail;
+    }
+
+    #[cfg(test)]
+    pub(crate) fn fail_next_truncate_for_test(&self, fail: bool) {
+        self.io.write().unwrap().fail_truncate_for_test = fail;
+    }
+
+    #[cfg(test)]
+    pub(crate) fn fail_append_for_test(&self, ids: &[NeedleId]) {
+        self.io.write().unwrap().fail_append_for_test = ids.iter().copied().collect();
+    }
+
+    /// (.dat syncs, .idx syncs) attempted since the volume was opened.
+    #[cfg(test)]
+    pub(crate) fn sync_counts_for_test(&self) -> (usize, usize) {
+        (
+            self.dat_syncs_for_test.load(Ordering::Relaxed),
+            self.idx_syncs_for_test.load(Ordering::Relaxed),
+        )
+    }
+
+    #[cfg(test)]
+    pub(crate) fn set_last_modified_ts_for_test(&self, ts_seconds: u64) {
+        self.last_modified_ts_seconds
+            .store(ts_seconds, Ordering::Relaxed);
+    }
+
+    #[cfg(test)]
+    pub(crate) fn add_file_count_for_test(&self, delta: i64) {
+        if let Some(nm) = self.io.read().unwrap().nm.as_ref() {
+            nm.add_file_count_for_test(delta);
+        }
     }
 }
 
@@ -3584,13 +5858,19 @@ impl Volume {
 // Helpers
 // ============================================================================
 
+/// A copy of a run-wide failure for each entry it fails.
+fn run_error(e: &VolumeError) -> VolumeError {
+    match e {
+        VolumeError::Io(e) => VolumeError::Io(io::Error::new(e.kind(), e.to_string())),
+        e => VolumeError::Io(io::Error::other(e.to_string())),
+    }
+}
+
 /// Generate volume file base name: dir/collection_id or dir/id
-/// Byte offset just past the needle's on-disk record. Deletion tombstones
-/// carry TombstoneFileSize (-1) in the .idx but are written with DataSize=0,
-/// so their on-disk record is sized as 0. Mirrors Go's needleDiskEnd.
-fn needle_disk_end(offset: Offset, size: Size, version: Version) -> i64 {
-    let on_disk_size = if size.is_deleted() { Size(0) } else { size };
-    offset.to_actual_offset() + get_actual_size(on_disk_size, version)
+/// Byte offset just past the needle's on-disk record. Mirrors Go's
+/// needleDiskEnd.
+pub(crate) fn needle_disk_end(offset: Offset, size: Size, version: Version) -> i64 {
+    offset.to_actual_offset() + get_actual_size(Size(size.raw() as i32), version)
 }
 
 fn size_mismatch_error(offset: i64, id: NeedleId, found: Size, expected: Size) -> VolumeError {
@@ -3603,6 +5883,29 @@ fn size_mismatch_error(offset: i64, id: NeedleId, found: Size, expected: Size) -
     ))
 }
 
+/// Drop a partial row from the end of `.idx` and return the remaining length.
+///
+/// `.idx` is a run of fixed-size rows, and writers append at EOF: a short write
+/// leaves a partial row behind, and every row appended after it lands off
+/// alignment, so the next load parses the rest of the file as garbage. The
+/// partial row is unrecoverable either way — every loader already skips it — so
+/// removing it before anything can append is what keeps the file parseable.
+/// Go instead refuses to load a volume whose `.idx` is not a whole number of
+/// rows; trimming keeps it mountable, and the rows before the tear are intact.
+fn trim_torn_idx_tail(idx_file: &File, idx_path: &str) -> Result<u64, VolumeError> {
+    let size = idx_file.metadata()?.len();
+    let aligned = size - size % NEEDLE_MAP_ENTRY_SIZE as u64;
+    if aligned != size {
+        warn!(
+            idx = %idx_path,
+            size, aligned, "dropping a partial row from the end of the index"
+        );
+        idx_file.set_len(aligned)?;
+        idx_file.sync_all()?;
+    }
+    Ok(aligned)
+}
+
 pub fn volume_file_name(dir: &str, collection: &str, id: VolumeId) -> String {
     if collection.is_empty() {
         format!("{}/{}", dir, id.0)
@@ -3611,17 +5914,41 @@ pub fn volume_file_name(dir: &str, collection: &str, id: VolumeId) -> String {
     }
 }
 
+/// Move `src` to `dst`, falling back to copy+remove when the two live on
+/// different filesystems (a real `-dir.idx` split). Mirrors Go's
+/// `RenameOrCopyFile`: any rename error other than cross-device is fatal, and a
+/// failed copy or a source that cannot be removed rolls the copy back so a
+/// failure never leaves two divergent files.
+fn rename_or_copy(src: &str, dst: &str) -> io::Result<()> {
+    match fs::rename(src, dst) {
+        Ok(()) => return Ok(()),
+        Err(e) if e.raw_os_error() != Some(libc::EXDEV) => return Err(e),
+        Err(_) => {}
+    }
+    fs::copy(src, dst)?;
+    // fsync the destination before dropping the source, matching Go's out.Sync().
+    if let Err(e) = OpenOptions::new()
+        .write(true)
+        .open(dst)
+        .and_then(|f| f.sync_all())
+    {
+        let _ = fs::remove_file(dst);
+        return Err(e);
+    }
+    if let Err(e) = fs::remove_file(src) {
+        let _ = fs::remove_file(dst);
+        return Err(e);
+    }
+    Ok(())
+}
+
 /// Generate a monotonically increasing append timestamp.
 fn get_append_at_ns(last: u64) -> u64 {
     let now = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .unwrap_or_default()
         .as_nanos() as u64;
-    if now <= last {
-        last + 1
-    } else {
-        now
-    }
+    if now <= last { last + 1 } else { now }
 }
 
 /// Remove all files associated with a volume.
@@ -3639,10 +5966,10 @@ pub(crate) fn fsync_dir(path: &str) -> io::Result<()> {
     }
     #[cfg(not(windows))]
     {
-        if let Some(parent) = Path::new(path).parent() {
-            if let Ok(d) = File::open(parent) {
-                return d.sync_all();
-            }
+        if let Some(parent) = Path::new(path).parent()
+            && let Ok(d) = File::open(parent)
+        {
+            return d.sync_all();
         }
         Ok(())
     }
@@ -3650,7 +5977,16 @@ pub(crate) fn fsync_dir(path: &str) -> io::Result<()> {
 
 pub(crate) fn remove_volume_files(base: &str, keep_vif: bool) {
     for ext in &[
-        ".dat", ".idx", ".vif", ".sdx", ".cpd", ".cpx", ".cpc", ".note", ".rdb",
+        ".dat",
+        ".idx",
+        ".vif",
+        ".sdx",
+        ".cpd",
+        ".cpx",
+        ".cpc",
+        ".note",
+        ".rdb",
+        ".unavailable",
     ] {
         if *ext == ".vif" && keep_vif {
             continue;
@@ -3708,6 +6044,12 @@ pub fn scan_volume_file(
         if size.0 == 0 && _id.is_empty() {
             break; // end of valid data
         }
+        // A negative size is a corrupt header, and body_length would advance the
+        // walk backwards from it. The index rebuild this feeds salvages the
+        // records before it, like Go's rebuild scanner stopping on io.EOF.
+        if size.0 < 0 {
+            break;
+        }
 
         let body_length = needle::needle_body_length(size, version);
         let total_size = NEEDLE_HEADER_SIZE as i64 + body_length;
@@ -3745,7 +6087,12 @@ fn preallocate_file(file: &File, size: u64) {
     {
         use std::os::unix::io::AsRawFd;
         let fd = file.as_raw_fd();
-        // FALLOC_FL_KEEP_SIZE = 1: allocate blocks without changing file size
+        // FALLOC_FL_KEEP_SIZE = 1: allocate blocks without changing file size.
+        //
+        // SAFETY: `fd` is borrowed from the live `&File` the caller owns, so
+        // it stays open for the call; the remaining arguments are plain
+        // scalars; and failure is reported in the return value, which is
+        // checked below before `last_os_error()` reads errno.
         let ret = unsafe { libc::fallocate(fd, 1, 0, size as libc::off_t) };
         if ret == 0 {
             tracing::info!(bytes = size, "preallocated disk space");
@@ -3768,6 +6115,25 @@ fn preallocate_file(file: &File, size: u64) {
 // Tests
 // ============================================================================
 
+/// An OS error the platform reports for failing storage media, which is
+/// what counts toward the I/O error streak.
+#[cfg(test)]
+pub(crate) fn media_error_for_test() -> io::Error {
+    #[cfg(unix)]
+    {
+        io::Error::from_raw_os_error(libc::EIO)
+    }
+    #[cfg(windows)]
+    {
+        const ERROR_IO_DEVICE: i32 = 1117;
+        io::Error::from_raw_os_error(ERROR_IO_DEVICE)
+    }
+    #[cfg(not(any(unix, windows)))]
+    {
+        io::Error::other("injected media error")
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -3775,9 +6141,9 @@ mod tests {
     use tempfile::TempDir;
 
     fn spawn_fake_s3_server(body: Vec<u8>) -> (String, tokio::sync::oneshot::Sender<()>) {
-        use axum::http::{header, HeaderMap, HeaderValue, StatusCode};
-        use axum::routing::any;
         use axum::Router;
+        use axum::http::{HeaderMap, HeaderValue, StatusCode, header};
+        use axum::routing::any;
 
         let body = Arc::new(body);
         let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
@@ -3799,34 +6165,33 @@ mod tests {
                         if let Some(range) = headers
                             .get(header::RANGE)
                             .and_then(|value| value.to_str().ok())
+                            && let Some(spec) = range.strip_prefix("bytes=")
                         {
-                            if let Some(spec) = range.strip_prefix("bytes=") {
-                                let (start, end) = spec.split_once('-').unwrap();
-                                let start = start.parse::<usize>().unwrap();
-                                let end = if end.is_empty() {
-                                    bytes.len().saturating_sub(1)
-                                } else {
-                                    end.parse::<usize>().unwrap()
-                                }
-                                .min(bytes.len().saturating_sub(1));
-                                let chunk = bytes[start..=end].to_vec();
-                                let mut response_headers = HeaderMap::new();
-                                response_headers.insert(
-                                    header::CONTENT_LENGTH,
-                                    HeaderValue::from_str(&chunk.len().to_string()).unwrap(),
-                                );
-                                response_headers.insert(
-                                    header::CONTENT_RANGE,
-                                    HeaderValue::from_str(&format!(
-                                        "bytes {}-{}/{}",
-                                        start,
-                                        end,
-                                        bytes.len()
-                                    ))
-                                    .unwrap(),
-                                );
-                                return (StatusCode::PARTIAL_CONTENT, response_headers, chunk);
+                            let (start, end) = spec.split_once('-').unwrap();
+                            let start = start.parse::<usize>().unwrap();
+                            let end = if end.is_empty() {
+                                bytes.len().saturating_sub(1)
+                            } else {
+                                end.parse::<usize>().unwrap()
                             }
+                            .min(bytes.len().saturating_sub(1));
+                            let chunk = bytes[start..=end].to_vec();
+                            let mut response_headers = HeaderMap::new();
+                            response_headers.insert(
+                                header::CONTENT_LENGTH,
+                                HeaderValue::from_str(&chunk.len().to_string()).unwrap(),
+                            );
+                            response_headers.insert(
+                                header::CONTENT_RANGE,
+                                HeaderValue::from_str(&format!(
+                                    "bytes {}-{}/{}",
+                                    start,
+                                    end,
+                                    bytes.len()
+                                ))
+                                .unwrap(),
+                            );
+                            return (StatusCode::PARTIAL_CONTENT, response_headers, chunk);
                         }
 
                         let mut response_headers = HeaderMap::new();
@@ -3858,17 +6223,41 @@ mod tests {
         Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap()
     }
 
+    fn write_test_needle(v: &mut Volume, id: u64, data: &[u8]) -> u64 {
+        let mut n = Needle {
+            id: NeedleId(id),
+            cookie: Cookie(0x12345678),
+            data: data.to_vec(),
+            data_size: data.len() as u32,
+            flags: 0,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+        n.append_at_ns
+    }
+
+    /// Run a plan to completion, keeping owned copies of every record.
+    fn scan_all(plan: &DatScanPlan) -> Vec<(Vec<u8>, Vec<u8>, u64)> {
+        let mut records = Vec::new();
+        plan.scan(|needle| {
+            records.push((
+                needle.header.to_vec(),
+                needle.body.to_vec(),
+                needle.append_at_ns,
+            ));
+            ControlFlow::Continue(())
+        })
+        .unwrap();
+        records
+    }
+
     #[test]
     fn test_data_file_access_control_blocks_writer_until_reader_releases() {
         let control = Arc::new(DataFileAccessControl::default());
@@ -3916,11 +6305,501 @@ mod tests {
     }
 
     #[test]
-    fn test_volume_write_read() {
+    fn binary_search_reports_is_last_when_caller_is_caught_up() {
+        // is_last drives the caught-up heartbeat; if it stops reporting true
+        // for an up-to-date caller, the tail sender re-reads the whole volume.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut newest_ns = 0u64;
+        for id in 1..=3u64 {
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(0x12345678),
+                data: vec![b'x'; 64],
+                data_size: 64,
+                flags: 0,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            newest_ns = n.append_at_ns;
+        }
+        assert!(newest_ns > 0, "needles must carry an append timestamp");
+
+        // Caught up: asking from the newest timestamp has nothing newer.
+        let (_offset, is_last) = v.binary_search_by_append_at_ns(newest_ns).unwrap();
+        assert!(
+            is_last,
+            "a caller at the newest append_at_ns must be reported as caught up"
+        );
+
+        // And from beyond the newest, likewise.
+        let (_offset, is_last_future) = v
+            .binary_search_by_append_at_ns(newest_ns + 1_000_000_000)
+            .unwrap();
+        assert!(
+            is_last_future,
+            "a caller ahead of the newest needle must be reported as caught up"
+        );
+    }
+
+    #[test]
+    fn binary_search_does_not_report_is_last_when_data_is_newer() {
+        // Complement: a behind caller must NOT be caught up, or tailing loses data.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut first_ns = 0u64;
+        for id in 1..=3u64 {
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(0x12345678),
+                data: vec![b'y'; 64],
+                data_size: 64,
+                flags: 0,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            if id == 1 {
+                first_ns = n.append_at_ns;
+            }
+        }
+
+        let (_offset, is_last) = v.binary_search_by_append_at_ns(first_ns).unwrap();
+        assert!(
+            !is_last,
+            "a caller behind the newest needle must NOT be reported as caught up"
+        );
+    }
+
+    #[test]
+    fn binary_search_does_not_report_is_last_when_only_a_delete_is_newer() {
+        // A delete is data the tail must ship. A caught-up caller before the
+        // delete must be sent to scan from the tombstone, not handed a heartbeat.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut newest_ns = 0u64;
+        for id in 1..=3u64 {
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(0x12345678),
+                data: vec![b'z'; 64],
+                data_size: 64,
+                flags: 0,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            newest_ns = n.append_at_ns;
+        }
+        let (_offset, is_last) = v.binary_search_by_append_at_ns(newest_ns).unwrap();
+        assert!(is_last, "precondition: the caller starts caught up");
+
+        v.delete_needle(&mut Needle {
+            id: NeedleId(2),
+            cookie: Cookie(0x12345678),
+            ..Needle::default()
+        })
+        .unwrap();
+
+        let (offset, is_last) = v.binary_search_by_append_at_ns(newest_ns).unwrap();
+        assert!(
+            !is_last,
+            "a caller older than a trailing delete must NOT be reported as caught up"
+        );
+
+        // Scan and filter exactly as volume_tail_sender does: the tombstone,
+        // and only the tombstone, is newer than the caller.
+        let shipped: Vec<u64> =
+            scan_all(&v.dat_scan_plan(offset.to_actual_offset() as u64).unwrap())
+                .into_iter()
+                .map(|(_, _, append_at_ns)| append_at_ns)
+                .filter(|&append_at_ns| append_at_ns > newest_ns)
+                .collect();
+        assert_eq!(shipped.len(), 1, "the tail must ship the tombstone");
+    }
+
+    #[test]
+    fn binary_search_on_compacted_volume_still_reports_a_later_write() {
+        // Compaction rewrites .idx in needle-id order, so append_at_ns is no
+        // longer monotonic by row: an overwritten key can sit before an older
+        // one. The caller's since_ns is the last row's timestamp, so such rows
+        // were already in the files it copied. A write made afterwards is
+        // appended as the final row, which the search cannot step past.
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
         let mut v = make_test_volume(dir);
 
+        let write = |v: &mut Volume, id: u64, byte: u8| {
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(0x12345678),
+                data: vec![byte; 64],
+                data_size: 64,
+                flags: 0,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            n.append_at_ns
+        };
+        write(&mut v, 1, b'c');
+        let key2_ns = write(&mut v, 2, b'c');
+        let key1_ns = write(&mut v, 1, b'd'); // genuine overwrite: different data
+        assert!(
+            key1_ns > key2_ns,
+            "precondition: the overwrite must append a newer record, not dedup"
+        );
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        v.commit_compact().unwrap();
+
+        let (_offset, is_last) = v.binary_search_by_append_at_ns(key2_ns).unwrap();
+        assert!(
+            is_last,
+            "precondition: compaction ordered .idx by key, so key 2 is the final row"
+        );
+
+        let key3_ns = write(&mut v, 3, b'c');
+        let (offset, is_last) = v.binary_search_by_append_at_ns(key2_ns).unwrap();
+        assert!(
+            !is_last,
+            "a write after compaction is the final row and must not be hidden"
+        );
+        let shipped: Vec<u64> =
+            scan_all(&v.dat_scan_plan(offset.to_actual_offset() as u64).unwrap())
+                .into_iter()
+                .map(|(_, _, append_at_ns)| append_at_ns)
+                .filter(|&append_at_ns| append_at_ns > key2_ns)
+                .collect();
+        assert!(
+            shipped.contains(&key3_ns),
+            "the tail must ship the write made after compaction"
+        );
+    }
+
+    #[test]
+    fn dat_scan_plan_visits_needles_and_tombstones_in_file_order() {
+        // The tail ships exactly what the scan visits, so the scan must cover
+        // the file record by record: the on-disk bytes, in file order,
+        // tombstones included.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        let written: Vec<u64> = (1..=3u64)
+            .map(|id| write_test_needle(&mut v, id, b"scan"))
+            .collect();
+        v.delete_needle(&mut Needle {
+            id: NeedleId(2),
+            cookie: Cookie(0x12345678),
+            ..Needle::default()
+        })
+        .unwrap();
+
+        let sb_size = v.super_block().block_size() as u64;
+        let records = scan_all(&v.dat_scan_plan(sb_size).unwrap());
+        let dat = std::fs::read(v.file_name(".dat")).unwrap();
+
+        assert_eq!(records.len(), 4, "three writes and one tombstone");
+        let mut offset = sb_size as usize;
+        for (header, body, _) in &records {
+            assert_eq!(&dat[offset..offset + header.len()], header.as_slice());
+            offset += header.len();
+            assert_eq!(&dat[offset..offset + body.len()], body.as_slice());
+            offset += body.len();
+        }
+        assert_eq!(offset, dat.len(), "the scan must reach the end of the file");
+
+        let ids: Vec<NeedleId> = records
+            .iter()
+            .map(|(header, _, _)| Needle::parse_header(header).1)
+            .collect();
+        assert_eq!(
+            ids,
+            vec![NeedleId(1), NeedleId(2), NeedleId(3), NeedleId(2)]
+        );
+        let stamps: Vec<u64> = records.iter().map(|r| r.2).collect();
+        assert_eq!(&stamps[..3], written.as_slice());
+        assert!(stamps[3] > stamps[2], "the tombstone is the newest record");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn dat_scan_plan_outlives_a_vacuum_commit() {
+        // The tail sender drops the store guard before scanning, so a vacuum
+        // commit can land mid-scan. The commit renames .cpd over .dat; a plan
+        // taken before it must keep reading the file its offset was resolved
+        // against, not the compacted one.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        write_test_needle(&mut v, 1, b"first");
+        write_test_needle(&mut v, 2, b"second");
+        write_test_needle(&mut v, 1, b"first, overwritten");
+
+        let sb_size = v.super_block().block_size() as u64;
+        let before = scan_all(&v.dat_scan_plan(sb_size).unwrap());
+        let plan = v.dat_scan_plan(sb_size).unwrap();
+        let old_len = std::fs::metadata(v.file_name(".dat")).unwrap().len();
+
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        v.commit_compact().unwrap();
+        let new_len = std::fs::metadata(v.file_name(".dat")).unwrap().len();
+        assert!(
+            new_len < old_len,
+            "precondition: the commit swapped in a smaller .dat"
+        );
+
+        assert_eq!(scan_all(&plan), before);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn dat_scan_plan_outlives_volume_destroy() {
+        // Unmount or delete can land mid-scan too. The plan holds a handle,
+        // not a path, so it finishes reading what was there.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        write_test_needle(&mut v, 1, b"going");
+        write_test_needle(&mut v, 2, b"gone");
+
+        let sb_size = v.super_block().block_size() as u64;
+        let before = scan_all(&v.dat_scan_plan(sb_size).unwrap());
+        let plan = v.dat_scan_plan(sb_size).unwrap();
+        let dat_path = v.file_name(".dat");
+
+        v.destroy(false, false, false).unwrap();
+        assert!(
+            !Path::new(&dat_path).exists(),
+            "precondition: destroy removed .dat"
+        );
+
+        assert_eq!(scan_all(&plan), before);
+    }
+
+    #[test]
+    fn dat_scan_plan_fails_when_the_snapshot_is_truncated() {
+        // Unmount followed by a VolumeCopy of the same id reopens .dat with
+        // truncate(true) on the inode a running plan holds. Every byte below
+        // the captured end existed when the plan was taken, so a short read
+        // there is an incomplete pass, not the end of the data: the stream
+        // must fail rather than let volume.move take a partial tail as
+        // complete.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        write_test_needle(&mut v, 1, b"kept");
+        write_test_needle(&mut v, 2, b"cut off");
+
+        let sb_size = v.super_block().block_size() as u64;
+        let first_record_len = {
+            let records = scan_all(&v.dat_scan_plan(sb_size).unwrap());
+            assert_eq!(records.len(), 2, "precondition: two records on disk");
+            (records[0].0.len() + records[0].1.len()) as u64
+        };
+        let plan = v.dat_scan_plan(sb_size).unwrap();
+        let end = plan.end;
+
+        // Truncate through the header of the second record.
+        let second = sb_size + first_record_len;
+        OpenOptions::new()
+            .write(true)
+            .open(v.file_name(".dat"))
+            .unwrap()
+            .set_len(second + NEEDLE_HEADER_SIZE as u64 / 2)
+            .unwrap();
+
+        let mut visited = Vec::new();
+        let err = plan
+            .scan(|n| {
+                visited.push(n.append_at_ns);
+                ControlFlow::Continue(())
+            })
+            .unwrap_err();
+        assert_eq!(visited.len(), 1, "the intact first record is still visited");
+        match err {
+            VolumeError::Io(e) => {
+                assert_eq!(e.kind(), io::ErrorKind::UnexpectedEof);
+                let msg = e.to_string();
+                assert!(msg.contains("truncated"), "{msg}");
+                assert!(msg.contains(&format!("snapshot end {end}")), "{msg}");
+            }
+            other => panic!("expected an I/O error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn dat_scan_plan_stops_at_the_snapshot_end() {
+        // The end bound is read under the guard, while no append can be in
+        // flight. A record appended after the plan belongs to the next pass.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        let first_ns = write_test_needle(&mut v, 1, b"before");
+
+        let plan = v
+            .dat_scan_plan(v.super_block().block_size() as u64)
+            .unwrap();
+        write_test_needle(&mut v, 2, b"after");
+
+        let stamps: Vec<u64> = scan_all(&plan).into_iter().map(|r| r.2).collect();
+        assert_eq!(stamps, vec![first_ns]);
+    }
+
+    #[test]
+    fn dat_scan_plan_stops_when_the_visitor_breaks() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        for id in 1..=3u64 {
+            write_test_needle(&mut v, id, b"brk");
+        }
+
+        let mut visited = 0;
+        v.dat_scan_plan(v.super_block().block_size() as u64)
+            .unwrap()
+            .scan(|_| {
+                visited += 1;
+                ControlFlow::Break(())
+            })
+            .unwrap();
+        assert_eq!(visited, 1);
+    }
+
+    #[test]
+    fn dat_scan_plan_ends_the_pass_at_a_corrupt_header() {
+        // A negative size is a corrupt header: the record length it implies
+        // cannot advance the scan past it, so the pass fails. A size running
+        // past the end bound, like one near i32::MAX, cannot be a complete
+        // record and ends the pass after the records before it, without
+        // reading or allocating the bogus body.
+        for bad_size in [-1000, i32::MAX] {
+            let tmp = TempDir::new().unwrap();
+            let dir = tmp.path().to_str().unwrap();
+            let mut v = make_test_volume(dir);
+            write_test_needle(&mut v, 1, b"good");
+
+            let sb_size = v.super_block().block_size() as u64;
+            let dat_path = v.file_name(".dat");
+            let start = sb_size as usize;
+            let mut bad =
+                std::fs::read(&dat_path).unwrap()[start..start + NEEDLE_HEADER_SIZE].to_vec();
+            Size(bad_size).to_bytes(&mut bad[COOKIE_SIZE + NEEDLE_ID_SIZE..NEEDLE_HEADER_SIZE]);
+            // Bytes after the header, so the size check stops the walk, not EOF.
+            bad.extend_from_slice(&[0u8; 64]);
+            OpenOptions::new()
+                .append(true)
+                .open(&dat_path)
+                .unwrap()
+                .write_all(&bad)
+                .unwrap();
+
+            let mut visited = 0;
+            let result = v.dat_scan_plan(sb_size).unwrap().scan(|_| {
+                visited += 1;
+                ControlFlow::Continue(())
+            });
+            if bad_size < 0 {
+                let err = result.unwrap_err();
+                assert!(
+                    matches!(&err, VolumeError::Io(e) if e.kind() == io::ErrorKind::InvalidData),
+                    "size {bad_size}: expected a corrupt-data error, got {err:?}"
+                );
+            } else {
+                result.unwrap();
+            }
+            assert_eq!(visited, 1, "size {bad_size}: only the good record");
+        }
+    }
+
+    #[test]
+    fn dat_scan_plan_fails_when_the_record_body_is_corrupt() {
+        // A record can fit inside the captured snapshot and still fail needle
+        // parsing. The tail must surface that failure instead of emitting a
+        // raw record with a zero append timestamp and reporting a clean pass.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        write_test_needle(&mut v, 1, b"good");
+
+        let sb_size = v.super_block().block_size() as u64;
+        let plan = v.dat_scan_plan(sb_size).unwrap();
+
+        let mut dat = OpenOptions::new()
+            .write(true)
+            .open(v.file_name(".dat"))
+            .unwrap();
+        dat.seek(SeekFrom::Start(sb_size + NEEDLE_HEADER_SIZE as u64))
+            .unwrap();
+        dat.write_all(&u32::MAX.to_be_bytes()).unwrap();
+        drop(dat);
+
+        let mut visited = 0;
+        let err = plan
+            .scan(|_| {
+                visited += 1;
+                ControlFlow::Continue(())
+            })
+            .unwrap_err();
+
+        assert_eq!(visited, 0, "the corrupt record must not be emitted");
+        assert!(
+            matches!(err, VolumeError::Needle(_)),
+            "expected a needle parse error, got {err:?}"
+        );
+    }
+
+    fn append_corrupt_header(v: &Volume, size: i32) {
+        let mut dat = OpenOptions::new()
+            .append(true)
+            .open(v.file_name(".dat"))
+            .unwrap();
+        let mut corrupt = [0u8; NEEDLE_HEADER_SIZE];
+        NeedleId(99).to_bytes(&mut corrupt[4..12]);
+        Size(size).to_bytes(&mut corrupt[12..16]);
+        dat.write_all(&corrupt).unwrap();
+    }
+
+    #[test]
+    fn dat_scan_plan_fails_at_a_header_it_cannot_advance_past() {
+        // A size so negative the record length is zero or less cannot be
+        // advanced past; the pass must fail rather than end early and let a
+        // truncated tail look complete.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+        write_test_needle(&mut v, 1, b"good");
+        append_corrupt_header(&v, -100);
+
+        let plan = v
+            .dat_scan_plan(v.super_block().block_size() as u64)
+            .unwrap();
+        let mut visited = 0;
+        let err = plan
+            .scan(|_| {
+                visited += 1;
+                ControlFlow::Continue(())
+            })
+            .unwrap_err();
+
+        assert_eq!(
+            visited, 1,
+            "the record before the corrupt header is visited"
+        );
+        assert!(
+            matches!(&err, VolumeError::Io(e) if e.kind() == io::ErrorKind::InvalidData),
+            "expected a corrupt-data error, got {err:?}"
+        );
+    }
+
+    #[test]
+    fn test_volume_write_read() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
         // Write a needle
         let mut n = Needle {
             id: NeedleId(1),
@@ -3930,7 +6809,7 @@ mod tests {
             flags: 0,
             ..Needle::default()
         };
-        let (offset, size, unchanged) = v.write_needle(&mut n, true).unwrap();
+        let (offset, size, unchanged) = v.write_needle(&mut n, true, false).unwrap();
         assert!(!unchanged);
         assert!(offset > 0); // after superblock
         assert!(size.0 > 0);
@@ -3947,11 +6826,1017 @@ mod tests {
         assert_eq!(read_n.cookie, Cookie(0x12345678));
     }
 
+    /// With `must_meta_only` set, the payload is skipped whatever the needle's
+    /// size. This is the option a delete uses. A chunk manifest is the
+    /// exception: its data is still read, because a delete needs it to find
+    /// the chunks.
+    #[test]
+    fn test_read_needle_must_meta_only() {
+        let tmp = TempDir::new().unwrap();
+        let v = make_test_volume(tmp.path().to_str().unwrap());
+        let data = vec![7u8; 8192];
+        let mut plain = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0x1234),
+            data: data.clone(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        };
+        v.write_needle(&mut plain, true, false).unwrap();
+        let mut manifest = Needle {
+            id: NeedleId(2),
+            data: b"{}".to_vec(),
+            data_size: 2,
+            ..Needle::default()
+        };
+        manifest.set_is_chunk_manifest();
+        v.write_needle(&mut manifest, true, false).unwrap();
+
+        let read = |id: u64, read_option: &mut ReadOption| {
+            let mut n = Needle {
+                id: NeedleId(id),
+                ..Needle::default()
+            };
+            v.read_needle_with_option(&mut n, read_option).unwrap();
+            n
+        };
+        let meta_only = || ReadOption {
+            attempt_meta_only: true,
+            must_meta_only: true,
+            ..ReadOption::default()
+        };
+
+        let mut read_option = meta_only();
+        let n = read(1, &mut read_option);
+        assert!(read_option.is_meta_only);
+        assert!(n.data.is_empty(), "{} bytes of data read", n.data.len());
+        assert_eq!(n.cookie, Cookie(0x1234));
+        assert_eq!(n.data_size as usize, data.len());
+
+        // Without `must_meta_only`, the needle is read in full.
+        let mut read_option = ReadOption::default();
+        let n = read(1, &mut read_option);
+        assert!(!read_option.is_meta_only);
+        assert_eq!(n.data, data);
+
+        let mut read_option = meta_only();
+        let n = read(2, &mut read_option);
+        assert!(!read_option.is_meta_only);
+        assert_eq!(n.data, b"{}");
+
+        // The option is reused: a metadata-only result from the first read
+        // must not carry over and skip the chunk manifest's data.
+        let mut read_option = meta_only();
+        read(1, &mut read_option);
+        assert!(read_option.is_meta_only);
+        let n = read(2, &mut read_option);
+        assert!(!read_option.is_meta_only);
+        assert_eq!(n.data, b"{}");
+    }
+
+    /// A version 1 needle is a header, the data and a checksum: it has no data
+    /// size field and no metadata after the data, so the metadata reader would
+    /// take the whole payload for metadata and reject anything over 128 KiB.
+    /// A read with `must_meta_only` must fall back to a full read.
+    #[test]
+    fn test_read_needle_must_meta_only_version_1() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let spec = VolumeSpec {
+            version: VERSION_1,
+            ..VolumeSpec::default()
+        };
+        let v = Volume::new(dir, dir, VolumeId(1), NeedleMapKind::InMemory, &spec).unwrap();
+        assert_eq!(v.version(), VERSION_1);
+
+        for (id, len) in [(1u64, 11usize), (2, 256 * 1024)] {
+            let data: Vec<u8> = b"hello world".iter().copied().cycle().take(len).collect();
+            // The server only writes version 2 and 3 records, so build the
+            // version 1 record by hand.
+            let size = Size(len as i32);
+            let mut blob = vec![0u8; NEEDLE_HEADER_SIZE];
+            Cookie(0x1234).to_bytes(&mut blob[0..COOKIE_SIZE]);
+            NeedleId(id).to_bytes(&mut blob[COOKIE_SIZE..COOKIE_SIZE + NEEDLE_ID_SIZE]);
+            size.to_bytes(&mut blob[COOKIE_SIZE + NEEDLE_ID_SIZE..NEEDLE_HEADER_SIZE]);
+            blob.extend_from_slice(&data);
+            blob.extend_from_slice(&CRC::new(&data).0.to_be_bytes());
+            blob.resize(get_actual_size(size, VERSION_1) as usize, 0);
+            v.write_needle_blob_and_index(NeedleId(id), &blob, size)
+                .unwrap();
+
+            let mut n = Needle {
+                id: NeedleId(id),
+                ..Needle::default()
+            };
+            let mut read_option = ReadOption {
+                attempt_meta_only: true,
+                must_meta_only: true,
+                ..ReadOption::default()
+            };
+            v.read_needle_with_option(&mut n, &mut read_option).unwrap();
+            assert!(!read_option.is_meta_only);
+            assert_eq!(n.cookie, Cookie(0x1234));
+            assert_eq!(n.data, data, "{len} byte needle");
+        }
+    }
+
+    /// A durable write goes down the same path and lands the same data; the
+    /// flush is extra work, not different work.
+    #[test]
+    fn test_volume_write_needle_fsync() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0x12345678),
+            data: b"durable payload".to_vec(),
+            data_size: 15,
+            flags: 0,
+            ..Needle::default()
+        };
+        let (offset, _, unchanged) = v.write_needle(&mut n, true, true).unwrap();
+        assert!(!unchanged);
+        assert!(offset > 0);
+
+        let mut read_n = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        assert_eq!(v.read_needle(&mut read_n).unwrap(), 15);
+        assert_eq!(read_n.data, b"durable payload");
+
+        // rewriting the same content still dedups, so there is nothing to flush
+        let mut same = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0x12345678),
+            data: b"durable payload".to_vec(),
+            data_size: 15,
+            flags: 0,
+            ..Needle::default()
+        };
+        let (_, _, unchanged) = v.write_needle(&mut same, true, true).unwrap();
+        assert!(unchanged);
+    }
+
+    /// A durable write whose flush fails must leave nothing behind: the append
+    /// comes off the .dat and the mapping it would have replaced still stands,
+    /// with the volume's own accounting untouched.
+    #[test]
+    fn test_write_needle_failed_fsync_keeps_prior_mapping() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut kept = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"first-copy".to_vec(),
+            data_size: 10,
+            ..Needle::default()
+        };
+        v.write_needle(&mut kept, true, true).unwrap();
+        let prior =
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(1))
+                .unwrap()
+                .unwrap();
+        let dat_len_before = std::fs::metadata(v.file_name(".dat")).unwrap().len();
+        let file_count_before = v.file_count();
+        let content_size_before = v.content_size();
+
+        v.fail_next_fsync_for_test(true);
+        let mut replacement = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"second-copy".to_vec(),
+            data_size: 11,
+            ..Needle::default()
+        };
+        v.write_needle(&mut replacement, true, true).unwrap_err();
+        v.fail_next_fsync_for_test(false);
+
+        assert_eq!(
+            std::fs::metadata(v.file_name(".dat")).unwrap().len(),
+            dat_len_before,
+            "the unflushed append should be off the .dat"
+        );
+        let now =
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(1))
+                .unwrap()
+                .unwrap();
+        assert_eq!(
+            now.offset, prior.offset,
+            "the mapping should never have moved"
+        );
+        assert_eq!(now.size, prior.size);
+        assert_eq!(
+            v.file_count(),
+            file_count_before,
+            "a rejected write must not count towards the volume"
+        );
+        assert_eq!(v.content_size(), content_size_before);
+
+        let mut read_n = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        assert_eq!(v.read_needle(&mut read_n).unwrap(), 10);
+        assert_eq!(read_n.data, b"first-copy");
+    }
+
+    /// A durable write that dedups against an earlier non-durable one still has
+    /// to flush the index. The row that earlier write left behind can be sitting
+    /// in the page cache, so acking without flushing is the same false promise
+    /// as skipping the flush on a fresh append.
+    #[test]
+    fn test_dedup_durable_write_flushes_the_index() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut first = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"same-content".to_vec(),
+            data_size: 12,
+            ..Needle::default()
+        };
+        v.write_needle(&mut first, true, false).unwrap();
+
+        v.fail_next_idx_sync_for_test(true);
+        let mut same = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"same-content".to_vec(),
+            data_size: 12,
+            ..Needle::default()
+        };
+        let result = v.write_needle(&mut same, true, true);
+        v.fail_next_idx_sync_for_test(false);
+
+        assert!(
+            result.is_err(),
+            "a dedup hit must not be acked without flushing the index"
+        );
+        assert!(
+            v.is_read_only(),
+            "and the failed index flush quarantines the volume, dedup or not"
+        );
+    }
+
+    /// A durable write whose index flush fails leaves the .dat record down and
+    /// its row published but not guaranteed to come back. The volume stops
+    /// taking writes rather than appending more past a record whose index may
+    /// not survive a restart.
+    #[test]
+    fn test_write_needle_failed_idx_sync_quarantines_volume() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        v.fail_next_idx_sync_for_test(true);
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"index-never-flushed".to_vec(),
+            data_size: 19,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, true).unwrap_err();
+        v.fail_next_idx_sync_for_test(false);
+
+        assert!(
+            v.is_read_only(),
+            "a volume whose index flush failed must stop taking writes"
+        );
+        let mut later = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(0xbb),
+            data: b"should-be-refused".to_vec(),
+            data_size: 17,
+            ..Needle::default()
+        };
+        assert!(
+            matches!(
+                v.write_needle(&mut later, true, false),
+                Err(VolumeError::ReadOnly(_))
+            ),
+            "later writes must not append past the record whose index is in doubt"
+        );
+    }
+
+    /// A failed fsync whose .dat rollback cannot complete leaves the tail
+    /// unverified, so the volume fails closed: reads and writes are refused,
+    /// the state is persisted, and a reload stays quarantined.
+    #[test]
+    fn test_failed_rollback_marks_volume_unavailable() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        v.fail_next_fsync_for_test(true);
+        v.fail_next_truncate_for_test(true);
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0xaa),
+            data: b"never-landed".to_vec(),
+            data_size: 12,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, true).unwrap_err();
+        v.fail_next_fsync_for_test(false);
+        v.fail_next_truncate_for_test(false);
+
+        assert!(v.is_read_only());
+        assert!(v.unavailable_error().is_some());
+        assert!(
+            v.should_quarantine(),
+            "an unavailable volume must stay out of heartbeats"
+        );
+        assert!(Path::new(&v.file_name(".unavailable")).exists());
+
+        let mut read_n = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        assert!(matches!(
+            v.read_needle(&mut read_n),
+            Err(VolumeError::Unavailable(_))
+        ));
+        let mut later = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(0xbb),
+            data: b"should-be-refused".to_vec(),
+            data_size: 17,
+            ..Needle::default()
+        };
+        assert!(matches!(
+            v.write_needle(&mut later, true, true),
+            Err(VolumeError::Unavailable(_))
+        ));
+        assert!(
+            v.set_writable().is_err(),
+            "a manual writable transition must not bypass quarantine"
+        );
+        assert!(v.unavailable_error().is_some());
+
+        let reloaded = reload_volume(dir);
+        assert!(reloaded.unavailable_error().is_some());
+        assert!(reloaded.is_read_only());
+        assert!(reloaded.should_quarantine());
+        let mut read_n = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        assert!(reloaded.read_needle(&mut read_n).is_err());
+    }
+
+    /// Same for a needle the failed write introduced: it never becomes visible,
+    /// rather than being published and then tombstoned back out.
+    #[test]
+    fn test_write_needle_failed_fsync_publishes_nothing() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let dat_len_before = std::fs::metadata(v.file_name(".dat")).unwrap().len();
+        let file_count_before = v.file_count();
+
+        v.fail_next_fsync_for_test(true);
+        let mut fresh = Needle {
+            id: NeedleId(7),
+            cookie: Cookie(0x77),
+            data: b"never-landed".to_vec(),
+            data_size: 12,
+            ..Needle::default()
+        };
+        v.write_needle(&mut fresh, true, true).unwrap_err();
+        v.fail_next_fsync_for_test(false);
+
+        assert_eq!(
+            std::fs::metadata(v.file_name(".dat")).unwrap().len(),
+            dat_len_before
+        );
+        assert!(
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(7))
+                .unwrap()
+                .is_none(),
+            "a needle that never reached the disk must not be indexed at all"
+        );
+        assert_eq!(v.file_count(), file_count_before);
+        assert_eq!(
+            v.deleted_count(),
+            0,
+            "nothing was written, so nothing was deleted"
+        );
+
+        let mut read_n = Needle {
+            id: NeedleId(7),
+            ..Needle::default()
+        };
+        assert!(v.read_needle(&mut read_n).is_err());
+    }
+
+    fn batch_needle(id: u64, cookie: u32, data: &[u8]) -> Needle {
+        Needle {
+            id: NeedleId(id),
+            cookie: Cookie(cookie),
+            data: data.to_vec(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        }
+    }
+
+    fn dat_len(v: &Volume) -> u64 {
+        std::fs::metadata(v.file_name(".dat")).unwrap().len()
+    }
+
+    /// A batch of durable writes shares one .dat sync and one .idx sync,
+    /// where writing them one at a time syncs both files per needle.
+    #[test]
+    fn test_grouped_fsync_writes_share_one_sync() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut writes: Vec<_> = (1..=10u64)
+            .map(|id| {
+                (
+                    batch_needle(id, 0xaa, format!("body-{id}").as_bytes()),
+                    true,
+                )
+            })
+            .collect();
+        let results = v.write_needles_grouped(&mut writes);
+        assert!(results.iter().all(|r| matches!(r, Ok((_, _, false)))));
+        assert_eq!(v.sync_counts_for_test(), (1, 1));
+        for id in 1..=10u64 {
+            let mut n = Needle {
+                id: NeedleId(id),
+                ..Needle::default()
+            };
+            v.read_needle(&mut n).unwrap();
+            assert_eq!(n.data, format!("body-{id}").as_bytes());
+        }
+
+        // A batch with no durable write syncs nothing, as before.
+        let mut writes: Vec<_> = (11..=20u64)
+            .map(|id| (batch_needle(id, 0xaa, b"lazy"), false))
+            .collect();
+        let results = v.write_needles_grouped(&mut writes);
+        assert!(results.iter().all(|r| r.is_ok()));
+        assert_eq!(v.sync_counts_for_test(), (1, 1));
+
+        // The per-needle path pays both syncs for every durable write.
+        let tmp2 = TempDir::new().unwrap();
+        let one_by_one = make_test_volume(tmp2.path().to_str().unwrap());
+        for id in 1..=10u64 {
+            let mut n = batch_needle(id, 0xaa, format!("body-{id}").as_bytes());
+            one_by_one.write_needle(&mut n, true, true).unwrap();
+        }
+        assert_eq!(one_by_one.sync_counts_for_test(), (10, 10));
+    }
+
+    /// A failed shared sync fails every entry of the run, durable or not,
+    /// and leaves the volume as it was before the run: the .dat back at the
+    /// run start, the clocks where they were, nothing published.
+    #[test]
+    fn test_grouped_failed_sync_rolls_back_the_run() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut kept = batch_needle(1, 0xaa, b"first-copy");
+        v.write_needle(&mut kept, true, true).unwrap();
+        let prior =
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(1))
+                .unwrap()
+                .unwrap();
+        let dat_len_before = dat_len(&v);
+        let last_append_before = v.io.read().unwrap().last_append_at_ns;
+        let last_write_append_before = v.io.read().unwrap().last_write_append_at_ns;
+        let last_modified_before = v.last_modified_ts();
+        let file_count_before = v.file_count();
+
+        let mut writes = vec![
+            (batch_needle(1, 0xaa, b"second-copy"), false),
+            (batch_needle(2, 0xbb, b"durable"), true),
+            (batch_needle(3, 0xcc, b"lazy"), false),
+        ];
+        for (n, _) in writes.iter_mut() {
+            n.last_modified = last_modified_before + 1000;
+        }
+        v.fail_next_fsync_for_test(true);
+        let results = v.write_needles_grouped(&mut writes);
+        v.fail_next_fsync_for_test(false);
+
+        assert!(
+            results.iter().all(|r| matches!(r, Err(VolumeError::Io(_)))),
+            "every entry of the run shares its failed sync: {results:?}"
+        );
+        assert_eq!(dat_len(&v), dat_len_before, "the run is off the .dat");
+        assert_eq!(v.io.read().unwrap().last_append_at_ns, last_append_before);
+        assert_eq!(
+            v.io.read().unwrap().last_write_append_at_ns,
+            last_write_append_before
+        );
+        assert_eq!(v.last_modified_ts(), last_modified_before);
+        let now =
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(1))
+                .unwrap()
+                .unwrap();
+        assert_eq!((now.offset, now.size), (prior.offset, prior.size));
+        assert!(
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(2))
+                .unwrap()
+                .is_none()
+        );
+        assert!(
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(3))
+                .unwrap()
+                .is_none()
+        );
+        assert_eq!(v.file_count(), file_count_before);
+        assert!(
+            !v.is_read_only(),
+            "a rolled-back run keeps the volume writable"
+        );
+
+        let mut read_n = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        v.read_needle(&mut read_n).unwrap();
+        assert_eq!(read_n.data, b"first-copy");
+
+        // The same run goes through once the disk recovers.
+        let results = v.write_needles_grouped(&mut writes);
+        assert!(results.iter().all(|r| r.is_ok()));
+        assert!(v.io.read().unwrap().last_append_at_ns > last_append_before);
+    }
+
+    /// A repeated id starts a new run, so the second write sees the first
+    /// one published: a different cookie is refused and the same content
+    /// dedups, exactly as two sequential writes would.
+    #[test]
+    fn test_grouped_repeated_id_behaves_as_sequential_writes() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut writes = vec![
+            (batch_needle(1, 0xaa, b"one"), true),
+            (batch_needle(1, 0xbb, b"imposter"), true),
+            (batch_needle(2, 0xcc, b"two"), true),
+            (batch_needle(2, 0xcc, b"two"), true),
+        ];
+        let results = v.write_needles_grouped(&mut writes);
+
+        assert!(matches!(results[0], Ok((_, _, false))));
+        assert!(matches!(results[1], Err(VolumeError::CookieMismatch(0xbb))));
+        assert!(matches!(results[2], Ok((_, _, false))));
+        assert!(
+            matches!(results[3], Ok((0, _, true))),
+            "the same content dedups against the write just before it"
+        );
+        // Runs [1], [1, 2], [2]: one pair of syncs each.
+        assert_eq!(v.sync_counts_for_test(), (3, 3));
+
+        let mut read_n = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        v.read_needle(&mut read_n).unwrap();
+        assert_eq!(read_n.data, b"one");
+    }
+
+    /// A failed shared .idx sync fails every published entry and stops the
+    /// volume taking writes, as it does for a single durable write.
+    #[test]
+    fn test_grouped_failed_idx_sync_quarantines_volume() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut writes = vec![
+            (batch_needle(1, 0xaa, b"durable"), true),
+            (batch_needle(2, 0xbb, b"lazy"), false),
+        ];
+        v.fail_next_idx_sync_for_test(true);
+        let results = v.write_needles_grouped(&mut writes);
+        v.fail_next_idx_sync_for_test(false);
+
+        assert!(results.iter().all(|r| matches!(r, Err(VolumeError::Io(_)))));
+        assert_eq!(v.sync_counts_for_test(), (1, 1));
+        assert!(v.is_read_only());
+    }
+
+    /// A failed shared sync whose truncate also fails leaves an unverified
+    /// tail, so the volume fails closed exactly as a single write does.
+    #[test]
+    fn test_grouped_failed_rollback_marks_volume_unavailable() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut writes = vec![
+            (batch_needle(1, 0xaa, b"never"), true),
+            (batch_needle(2, 0xbb, b"landed"), false),
+        ];
+        v.fail_next_fsync_for_test(true);
+        v.fail_next_truncate_for_test(true);
+        let results = v.write_needles_grouped(&mut writes);
+        v.fail_next_fsync_for_test(false);
+        v.fail_next_truncate_for_test(false);
+
+        assert!(results.iter().all(|r| r.is_err()));
+        assert!(v.unavailable_error().is_some());
+        assert!(v.is_read_only());
+        assert!(v.should_quarantine());
+        assert!(
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(1))
+                .unwrap()
+                .is_none()
+        );
+
+        let mut later = vec![(batch_needle(3, 0xcc, b"refused"), true)];
+        let results = v.write_needles_grouped(&mut later);
+        assert!(matches!(results[0], Err(VolumeError::Unavailable(_))));
+    }
+
+    /// An .idx writer that tears its `tear_at`-th row: half of the row
+    /// reaches the file, then the write fails.
+    struct TornIdxWriter {
+        file: File,
+        writes: usize,
+        tear_at: usize,
+        fail_truncates: bool,
+    }
+
+    impl Write for TornIdxWriter {
+        fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+            self.writes += 1;
+            if self.writes == self.tear_at {
+                self.file.write_all(&buf[..buf.len() / 2])?;
+                return Err(io::Error::other("injected torn .idx write"));
+            }
+            self.file.write(buf)
+        }
+
+        fn flush(&mut self) -> io::Result<()> {
+            self.file.flush()
+        }
+    }
+
+    impl Seek for TornIdxWriter {
+        fn seek(&mut self, pos: SeekFrom) -> io::Result<u64> {
+            self.file.seek(pos)
+        }
+    }
+
+    impl crate::storage::needle_map::IdxFileWriter for TornIdxWriter {
+        fn sync_all(&self) -> io::Result<()> {
+            self.file.sync_all()
+        }
+
+        fn truncate_to(&mut self, len: u64) -> io::Result<()> {
+            if self.fail_truncates {
+                return Err(io::Error::other("injected trim failure"));
+            }
+            self.file.set_len(len)
+        }
+    }
+
+    /// A durable entry whose index update fails stops the volume taking
+    /// writes, as it does when sent on its own, so the entries after it in
+    /// the run are refused instead of indexed behind a row that may be
+    /// torn. Entries before it stay acked.
+    #[test]
+    fn test_grouped_failed_durable_index_refuses_rest_of_run() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        let mut kept = batch_needle(4, 0xdd, b"kept");
+        v.write_needle(&mut kept, true, true).unwrap();
+        let mut other = batch_needle(5, 0xee, b"other");
+        v.write_needle(&mut other, true, true).unwrap();
+
+        {
+            let mut io = v.io.write().unwrap();
+            let nm = io.nm.as_mut().unwrap();
+            let idx_len = nm.index_file_size();
+            let file = OpenOptions::new()
+                .write(true)
+                .open(format!("{dir}/1.idx"))
+                .unwrap();
+            nm.set_idx_file(
+                Box::new(TornIdxWriter {
+                    file,
+                    writes: 0,
+                    tear_at: 2,
+                    fail_truncates: false,
+                }),
+                idx_len,
+            );
+        }
+
+        let mut writes = vec![
+            (batch_needle(1, 0xaa, b"before"), true),
+            (batch_needle(2, 0xbb, b"torn"), true),
+            (batch_needle(3, 0xcc, b"after"), true),
+            (batch_needle(4, 0xdd, b"kept"), true),
+            (batch_needle(5, 0xef, b"wrong cookie"), true),
+        ];
+        let results = v.write_needles_grouped(&mut writes);
+        // Two setup writes, then the run's one sync of each file.
+        assert_eq!(v.sync_counts_for_test(), (3, 3));
+        assert!(v.is_read_only());
+        drop(v);
+
+        let reopened = match Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        ) {
+            Ok(v) => v,
+            Err(e) => panic!("the volume does not reload: {e}"),
+        };
+        for ((n, _), r) in writes.iter().zip(&results) {
+            if r.is_ok() {
+                let mut got = Needle {
+                    id: n.id,
+                    ..Needle::default()
+                };
+                let read = reopened.read_needle(&mut got);
+                assert!(
+                    read.is_ok() && got.data == n.data,
+                    "acked write {} lost on reload: {read:?}",
+                    n.id.0
+                );
+            }
+        }
+
+        assert!(matches!(results[0], Ok((_, _, false))), "{results:?}");
+        assert!(matches!(results[1], Err(VolumeError::Io(_))), "{results:?}");
+        for r in &results[2..] {
+            assert!(
+                matches!(r, Err(VolumeError::ReadOnly(VolumeId(1)))),
+                "refused as it would be sent on its own: {results:?}"
+            );
+        }
+    }
+
+    /// A torn .idx row is trimmed back, so the row a later write appends
+    /// still lands aligned and survives a reload.
+    #[test]
+    fn test_failed_index_write_is_trimmed() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        {
+            let mut io = v.io.write().unwrap();
+            let nm = io.nm.as_mut().unwrap();
+            let idx_len = nm.index_file_size();
+            let file = OpenOptions::new()
+                .write(true)
+                .open(format!("{dir}/1.idx"))
+                .unwrap();
+            nm.set_idx_file(
+                Box::new(TornIdxWriter {
+                    file,
+                    writes: 0,
+                    tear_at: 1,
+                    fail_truncates: false,
+                }),
+                idx_len,
+            );
+        }
+
+        let mut writes = vec![
+            (batch_needle(1, 0xaa, b"torn"), false),
+            (batch_needle(2, 0xbb, b"after"), true),
+        ];
+        let results = v.write_needles_grouped(&mut writes);
+        assert!(matches!(results[0], Err(VolumeError::Io(_))), "{results:?}");
+        assert!(matches!(results[1], Ok((_, _, false))), "{results:?}");
+        drop(v);
+
+        let reopened = match Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        ) {
+            Ok(v) => v,
+            Err(e) => panic!("the volume does not reload: {e}"),
+        };
+        let mut got = Needle {
+            id: NeedleId(2),
+            ..Needle::default()
+        };
+        reopened.read_needle(&mut got).unwrap();
+        assert_eq!(got.data, b"after");
+    }
+
+    /// When the trim of a torn .idx row itself fails, no later row is
+    /// appended after the torn bytes.
+    #[test]
+    fn test_untrimmed_torn_row_refuses_later_appends() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let idx_len = {
+            let mut io = v.io.write().unwrap();
+            let nm = io.nm.as_mut().unwrap();
+            let idx_len = nm.index_file_size();
+            let file = OpenOptions::new()
+                .write(true)
+                .open(format!("{dir}/1.idx"))
+                .unwrap();
+            nm.set_idx_file(
+                Box::new(TornIdxWriter {
+                    file,
+                    writes: 0,
+                    tear_at: 1,
+                    fail_truncates: true,
+                }),
+                idx_len,
+            );
+            idx_len
+        };
+
+        let mut writes = vec![
+            (batch_needle(1, 0xaa, b"torn"), false),
+            (batch_needle(2, 0xbb, b"after"), false),
+        ];
+        let results = v.write_needles_grouped(&mut writes);
+        assert!(matches!(results[0], Err(VolumeError::Io(_))), "{results:?}");
+        assert!(results[1].is_err(), "{results:?}");
+
+        // The second row was never appended behind the torn bytes.
+        let size = std::fs::metadata(format!("{dir}/1.idx")).unwrap().len();
+        assert_eq!(size, idx_len + 8);
+    }
+
+    /// The I/O error streak after writing four durable needles, the ones in
+    /// `failing` with a media error on their append, first one at a time and
+    /// then as one grouped run. Also returns which grouped writes landed.
+    #[cfg(any(unix, windows))]
+    fn io_error_streaks(failing: &[u64]) -> (i32, i32, Vec<bool>) {
+        let writes = || -> Vec<_> {
+            (1..=4u64)
+                .map(|id| {
+                    (
+                        batch_needle(id, 0xaa, format!("body-{id}").as_bytes()),
+                        true,
+                    )
+                })
+                .collect()
+        };
+        let failing: Vec<_> = failing.iter().map(|&id| NeedleId(id)).collect();
+
+        let tmp = TempDir::new().unwrap();
+        let one_by_one = make_test_volume(tmp.path().to_str().unwrap());
+        one_by_one.fail_append_for_test(&failing);
+        for (mut n, fsync) in writes() {
+            let _ = one_by_one.write_needle(&mut n, true, fsync);
+        }
+
+        let tmp2 = TempDir::new().unwrap();
+        let v = make_test_volume(tmp2.path().to_str().unwrap());
+        v.fail_append_for_test(&failing);
+        let mut grouped = writes();
+        let results = v.write_needles_grouped(&mut grouped);
+        assert!(!v.is_read_only(), "the failed appends were truncated back");
+
+        let landed = results
+            .iter()
+            .map(|r| matches!(r, Ok((_, _, false))))
+            .collect();
+        (
+            one_by_one.get_io_error_state().1,
+            v.get_io_error_state().1,
+            landed,
+        )
+    }
+
+    /// A run counts I/O errors as the same writes sent one at a time would:
+    /// a success early in the run must not wipe out the streak that the
+    /// failed appends after it built up, or the volume escapes quarantine.
+    #[cfg(any(unix, windows))]
+    #[test]
+    fn test_grouped_run_keeps_the_io_error_streak_of_later_appends() {
+        use crate::storage::io_error::IO_ERROR_TOLERANCE;
+
+        let (one_by_one, grouped, landed) = io_error_streaks(&[2, 3, 4]);
+
+        assert_eq!(landed, [true, false, false, false]);
+        assert_eq!(one_by_one, IO_ERROR_TOLERANCE);
+        assert_eq!(grouped, IO_ERROR_TOLERANCE);
+    }
+
+    /// The other half: a write that lands clears the errors of the appends
+    /// queued before it, even when another append after it fails, or the
+    /// run reaches a quarantine that the same writes one at a time do not.
+    #[cfg(any(unix, windows))]
+    #[test]
+    fn test_grouped_run_clears_the_io_error_streak_of_earlier_appends() {
+        let (one_by_one, grouped, landed) = io_error_streaks(&[1, 2, 4]);
+
+        assert_eq!(landed, [false, false, true, false]);
+        assert_eq!(one_by_one, 1);
+        assert_eq!(grouped, 1);
+    }
+
+    /// An append whose partial bytes cannot be truncated back leaves the .dat
+    /// tail unverified, so the volume fails closed rather than let a later
+    /// append bury them mid-file.
+    #[test]
+    fn test_failed_append_rollback_marks_volume_unavailable() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut first = batch_needle(1, 0xaa, b"landed");
+        v.write_needle(&mut first, true, true).unwrap();
+
+        // A read-only .dat handle fails the append and the truncate-back alike.
+        v.io.write().unwrap().dat_file = Some(File::open(v.file_name(".dat")).unwrap());
+        let mut n = batch_needle(2, 0xbb, b"never-lands");
+        v.write_needle(&mut n, true, false).unwrap_err();
+
+        assert!(v.unavailable_error().is_some());
+        assert!(v.is_read_only());
+        assert!(v.should_quarantine());
+        assert!(
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(2))
+                .unwrap()
+                .is_none()
+        );
+
+        let mut later = batch_needle(3, 0xcc, b"refused");
+        assert!(matches!(
+            v.write_needle(&mut later, true, true),
+            Err(VolumeError::Unavailable(_))
+        ));
+    }
+
     #[test]
     fn test_volume_write_dedup() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         let mut n = Needle {
             id: NeedleId(1),
@@ -3960,7 +7845,7 @@ mod tests {
             data_size: 9,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
 
         // Write same needle again — should be unchanged
         let mut n2 = Needle {
@@ -3971,7 +7856,7 @@ mod tests {
             ..Needle::default()
         };
         n2.checksum = CRC::new(&n2.data);
-        let (_, _, unchanged) = v.write_needle(&mut n2, true).unwrap();
+        let (_, _, unchanged) = v.write_needle(&mut n2, true, false).unwrap();
         assert!(unchanged);
     }
 
@@ -3979,7 +7864,7 @@ mod tests {
     fn test_volume_delete() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         let mut n = Needle {
             id: NeedleId(1),
@@ -3988,7 +7873,7 @@ mod tests {
             data_size: 9,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
         assert_eq!(v.file_count(), 1);
 
         let deleted_size = v
@@ -4024,7 +7909,7 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         {
-            let mut v = make_test_volume(dir);
+            let v = make_test_volume(dir);
             for i in 1..=3 {
                 let data = format!("data {}", i);
                 let mut n = Needle {
@@ -4034,7 +7919,7 @@ mod tests {
                     data_size: data.len() as u32,
                     ..Needle::default()
                 };
-                v.write_needle(&mut n, true).unwrap();
+                v.write_needle(&mut n, true, false).unwrap();
             }
             v.delete_needle(&mut Needle {
                 id: NeedleId(2),
@@ -4048,13 +7933,9 @@ mod tests {
         let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         assert!(
@@ -4063,8 +7944,129 @@ mod tests {
         );
     }
 
-    fn write_three_needles(dir: &str) {
-        let mut v = make_test_volume(dir);
+    // Reproduce the delete-traffic TTL bug: deletes append a tombstone to the
+    // .dat, which moves the file's mtime, and the loader read the TTL clock
+    // back from that mtime. A volume taking delete traffic therefore had
+    // is_expired() re-armed for another full TTL on every restart and was
+    // never reclaimed.
+    #[test]
+    fn test_ttl_clock_survives_deletes() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ttl = crate::storage::needle::ttl::TTL::read("5m").unwrap();
+        let last_write_ns = (SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs()
+            - 2 * 60 * 60)
+            * 1_000_000_000;
+
+        let content_size = {
+            let v = make_ttl_volume(dir, ttl);
+            let mut written = Vec::new();
+            for i in 1..=3u64 {
+                let data = format!("data {}", i);
+                let mut n = Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(i as u32),
+                    data: data.as_bytes().to_vec(),
+                    data_size: data.len() as u32,
+                    ..Needle::default()
+                };
+                let (offset, _, _) = v.write_needle(&mut n, true, false).unwrap();
+                written.push((offset, n.size));
+            }
+            // More than one tombstone: the scan has to walk back over the whole
+            // run of them to reach a write.
+            for i in [2u64, 3] {
+                v.delete_needle(&mut Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(i as u32),
+                    ..Needle::default()
+                })
+                .unwrap();
+            }
+            v.sync_to_disk().unwrap();
+            // Backdate the writes on disk so the last one sits well outside the
+            // TTL, while the tombstones leave the .dat mtime at now.
+            for (offset, size) in written {
+                backdate_append_at_ns(&v.dat_path(), offset, size, last_write_ns);
+            }
+            v.content_size()
+        };
+
+        let v = make_ttl_volume(dir, ttl);
+        assert_eq!(v.last_modified_ts(), last_write_ns / 1_000_000_000);
+        assert!(
+            v.is_expired(content_size, 1024 * 1024),
+            "a TTL volume whose last write is 2h old must be expired after a reload"
+        );
+    }
+
+    // The one layout where a .dat's order does not track its write order:
+    // vacuum rewrites it by key, and an overwrite keeps its original, lower key.
+    // Reading the position rather than the timestamps would recover the
+    // highest-key needle's older write time and expire the volume before the
+    // overwrite has lived out its TTL.
+    #[test]
+    fn test_ttl_clock_after_vacuum_takes_newest_write() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ttl = crate::storage::needle::ttl::TTL::read("5m").unwrap();
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs();
+        let old_write_ns = (now - 2 * 60 * 60) * 1_000_000_000;
+        let new_write_ns = (now - 60) * 1_000_000_000;
+
+        let content_size = {
+            let v = make_ttl_volume(dir, ttl);
+            // Needle 1 is overwritten last but sorts first, so vacuum leaves it
+            // at the head of the .dat with the newest timestamp of the three.
+            for (id, append_at_ns) in [(2u64, old_write_ns), (3, old_write_ns), (1, new_write_ns)] {
+                let data = format!("data {}", id);
+                let mut n = Needle {
+                    id: NeedleId(id),
+                    cookie: Cookie(id as u32),
+                    data: data.as_bytes().to_vec(),
+                    data_size: data.len() as u32,
+                    ..Needle::default()
+                };
+                let (offset, _, _) = v.write_needle(&mut n, true, false).unwrap();
+                v.sync_to_disk().unwrap();
+                backdate_append_at_ns(&v.dat_path(), offset, n.size, append_at_ns);
+            }
+            v.compact_by_index(0, 0, |_| true).unwrap();
+            v.commit_compact().unwrap();
+            v.content_size()
+        };
+
+        let v = make_ttl_volume(dir, ttl);
+        assert_eq!(v.last_modified_ts(), new_write_ns / 1_000_000_000);
+        assert!(
+            !v.is_expired(content_size, 1024 * 1024),
+            "a volume overwritten a minute ago must not be expired after a vacuum and reload"
+        );
+    }
+
+    // Covers the reload that ends a vacuum commit: the clock must keep the
+    // last write's append time rather than be re-derived, and the intervening
+    // delete's tombstone must not freshen it.
+    #[test]
+    fn test_ttl_clock_carried_across_vacuum_commit() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ttl = crate::storage::needle::ttl::TTL::read("5m").unwrap();
+        let last_write_ns = (SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs()
+            - 2 * 60 * 60)
+            * 1_000_000_000;
+
+        let v = make_ttl_volume(dir, ttl);
+        let mut written = Vec::new();
         for i in 1..=3u64 {
             let data = format!("data {}", i);
             let mut n = Needle {
@@ -4074,7 +8076,185 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            let (offset, _, _) = v.write_needle(&mut n, true, false).unwrap();
+            written.push((offset, n.size));
+        }
+        v.delete_needle(&mut Needle {
+            id: NeedleId(2),
+            cookie: Cookie(2),
+            ..Needle::default()
+        })
+        .unwrap();
+        v.sync_to_disk().unwrap();
+        for (offset, size) in written {
+            backdate_append_at_ns(&v.dat_path(), offset, size, last_write_ns);
+        }
+        // Where a restart's recovery would have left the clock. The delete
+        // above pushed last_append_at_ns to ~now; the commit must not use it.
+        v.set_last_modified_ts_for_test(last_write_ns / 1_000_000_000);
+        v.io.write().unwrap().last_write_append_at_ns = last_write_ns;
+
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        v.commit_compact().unwrap();
+
+        assert_eq!(v.last_modified_ts(), last_write_ns / 1_000_000_000);
+        assert!(
+            v.is_expired(v.content_size(), 1024 * 1024),
+            "a TTL volume whose last write is 2h old must stay expired across a vacuum commit"
+        );
+    }
+
+    // A write's client supplied modified time can lie ahead of or behind when
+    // it was appended; the commit keeps the server-side write watermark the
+    // recovery scan would recompute.
+    #[test]
+    fn test_ttl_clock_at_commit_uses_append_time() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ttl = crate::storage::needle::ttl::TTL::read("5m").unwrap();
+        let future = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs()
+            + 24 * 60 * 60;
+
+        let v = make_ttl_volume(dir, ttl);
+        let data = b"data".to_vec();
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(1),
+            data,
+            data_size: 4,
+            last_modified: future,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+        assert!(v.last_modified_ts() >= future);
+        let append_watermark_sec = v.io.read().unwrap().last_write_append_at_ns / 1_000_000_000;
+
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        v.commit_compact().unwrap();
+
+        assert_eq!(v.last_modified_ts(), append_watermark_sec);
+    }
+
+    // A vacuum commit whose newest write was deleted first: the carried
+    // watermark belonged to that write, so the commit has to let the reload
+    // rescan and land on the newest surviving write rather than keep the
+    // volume alive on a deleted write's time.
+    #[test]
+    fn test_ttl_clock_at_commit_skips_deleted_write() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ttl = crate::storage::needle::ttl::TTL::read("5m").unwrap();
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs();
+        let old_write_ns = (now - 2 * 60 * 60) * 1_000_000_000;
+        let new_write_ns = (now - 60 * 60) * 1_000_000_000;
+
+        let v = make_ttl_volume(dir, ttl);
+        for (id, append_at_ns) in [(1u64, old_write_ns), (2, new_write_ns)] {
+            let data = format!("data {}", id);
+            let mut n = Needle {
+                id: NeedleId(id),
+                cookie: Cookie(id as u32),
+                data: data.as_bytes().to_vec(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            let (offset, _, _) = v.write_needle(&mut n, true, false).unwrap();
+            v.sync_to_disk().unwrap();
+            backdate_append_at_ns(&v.dat_path(), offset, n.size, append_at_ns);
+        }
+        // The delete lands inside the commit window: makeup_diff replays its
+        // tombstone into the new .idx behind the write row the copy carried.
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        v.delete_needle(&mut Needle {
+            id: NeedleId(2),
+            cookie: Cookie(2),
+            ..Needle::default()
+        })
+        .unwrap();
+        assert!(
+            v.io.read().unwrap().last_write_deleted,
+            "deleting the newest write must mark the watermark dead"
+        );
+        v.commit_compact().unwrap();
+
+        assert_eq!(v.last_modified_ts(), old_write_ns / 1_000_000_000);
+        assert!(
+            !v.io.read().unwrap().last_write_deleted,
+            "the reload's rescan must reseed the watermark off the surviving write"
+        );
+    }
+
+    // Guard the destroy time an EC volume is reclaimed on: it was recomputed as
+    // now+TTL every time the .vif was written, so a read-only mark, a tier
+    // upload or an EC encode handed an already expiring volume another full TTL.
+    #[test]
+    fn test_expire_at_sec_counts_from_last_write() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let ttl = crate::storage::needle::ttl::TTL::read("5m").unwrap();
+        let now = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap()
+            .as_secs();
+
+        let v = make_ttl_volume(dir, ttl);
+        // A volume with nothing written yet has no last write to count from, and
+        // must not land in 1970 with its data due for destruction on sight.
+        assert!(v.expire_at_sec() >= now);
+
+        v.set_last_modified_ts_for_test(now - 3600);
+        let want = now - 3600 + ttl.to_seconds();
+        for pass in 0..2 {
+            v.save_volume_info().unwrap();
+            assert_eq!(
+                v.volume_info().expire_at_sec,
+                want,
+                ".vif save {} moved the destroy time off the last write",
+                pass
+            );
+        }
+    }
+
+    fn make_ttl_volume(dir: &str, ttl: crate::storage::needle::ttl::TTL) -> Volume {
+        Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec {
+                ttl: Some(ttl),
+                ..Default::default()
+            },
+        )
+        .unwrap()
+    }
+
+    fn backdate_append_at_ns(dat_path: &str, offset: u64, size: Size, append_at_ns: u64) {
+        let ts_offset =
+            offset + NEEDLE_HEADER_SIZE as u64 + size.0 as u64 + NEEDLE_CHECKSUM_SIZE as u64;
+        let mut f = OpenOptions::new().write(true).open(dat_path).unwrap();
+        f.seek(SeekFrom::Start(ts_offset)).unwrap();
+        f.write_all(&append_at_ns.to_be_bytes()).unwrap();
+    }
+
+    fn write_three_needles(dir: &str) {
+        let v = make_test_volume(dir);
+        for i in 1..=3u64 {
+            let data = format!("data {}", i);
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: data.as_bytes().to_vec(),
+                data_size: data.len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
     }
@@ -4083,13 +8263,9 @@ mod tests {
         Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap()
     }
@@ -4126,16 +8302,15 @@ mod tests {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
         {
-            let mut v = Volume::new(
+            let v = Volume::new(
                 dir,
                 dir,
-                "",
                 VolumeId(1),
                 NeedleMapKind::InMemory,
-                None,
-                None,
-                0,
-                VERSION_2,
+                &VolumeSpec {
+                    version: VERSION_2,
+                    ..Default::default()
+                },
             )
             .unwrap();
             for i in 1..=3u64 {
@@ -4147,7 +8322,7 @@ mod tests {
                     data_size: data.len() as u32,
                     ..Needle::default()
                 };
-                v.write_needle(&mut n, true).unwrap();
+                v.write_needle(&mut n, true, false).unwrap();
             }
             v.sync_to_disk().unwrap();
         }
@@ -4173,7 +8348,7 @@ mod tests {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
         {
-            let mut v = make_test_volume(dir);
+            let v = make_test_volume(dir);
             let data = b"data 1".to_vec();
             let mut n = Needle {
                 id: NeedleId(1),
@@ -4182,7 +8357,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
             v.delete_needle(&mut Needle {
                 id: NeedleId(1),
                 cookie: Cookie(1),
@@ -4293,7 +8468,7 @@ mod tests {
         // physical .dat, so a healthy overwritten volume is NOT flagged broken.
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         for (id, body) in [(1u64, "first version"), (1, "second version"), (2, "other")] {
             let mut n = Needle {
@@ -4303,7 +8478,7 @@ mod tests {
                 data_size: body.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
 
@@ -4323,7 +8498,7 @@ mod tests {
         // reconcile nor the structural overlap check).
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         let data = b"needle data".to_vec();
         let mut n = Needle {
@@ -4333,7 +8508,7 @@ mod tests {
             data_size: data.len() as u32,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
         v.sync_to_disk().unwrap();
 
         // Append an offset-0 logical tombstone to the on-disk .idx.
@@ -4341,8 +8516,13 @@ mod tests {
             .append(true)
             .open(v.file_name(".idx"))
             .unwrap();
-        crate::storage::idx::write_index_entry(&mut f, NeedleId(2), Offset::from_actual_offset(0), Size(-1))
-            .unwrap();
+        crate::storage::idx::write_index_entry(
+            &mut f,
+            NeedleId(2),
+            Offset::from_actual_offset(0),
+            Size(-1),
+        )
+        .unwrap();
         f.sync_all().unwrap();
         drop(f);
 
@@ -4355,13 +8535,171 @@ mod tests {
         assert_eq!(count, 2, "both .idx rows are walked");
     }
 
+    /// The .dat offset a local delete's .idx row points at: the physical
+    /// tombstone record. Mirrors the Go test helper localTombstoneOffset.
+    fn local_tombstone_offset(v: &Volume, id: u64) -> Offset {
+        let mut idx_file = File::open(v.file_name(".idx")).unwrap();
+        let mut found = Offset::default();
+        idx::walk_index_file(&mut idx_file, 0, |key, offset, size| {
+            if key == NeedleId(id) && !offset.is_zero() && size.is_deleted() {
+                found = offset;
+            }
+            Ok(())
+        })
+        .unwrap();
+        assert!(
+            !found.is_zero(),
+            "expected a local deletion tombstone for needle {} in .idx",
+            id
+        );
+        found
+    }
+
+    #[test]
+    fn test_scrub_checks_local_deletion_tombstone() {
+        // Mirror of Go's TestScrubVolumeDataChecksLocalDeletionTombstone: a
+        // local delete's tombstone record is read and its needle id checked
+        // against the .idx key.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+
+        write_test_needle(&mut v, 1, b"needle data");
+        v.delete_needle(&mut Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0x12345678),
+            ..Needle::default()
+        })
+        .unwrap();
+        // A later record keeps the tombstone mid-file rather than at the tail.
+        write_test_needle(&mut v, 2, b"needle data");
+        v.sync_to_disk().unwrap();
+
+        let tombstone_offset = local_tombstone_offset(&v, 1);
+        let (_count, broken) = v.scrub().unwrap();
+        assert!(
+            broken.is_empty(),
+            "healthy local deletion tombstone must pass scrub, got {:?}",
+            broken
+        );
+
+        let mut id_bytes = [0u8; NEEDLE_ID_SIZE];
+        NeedleId(99).to_bytes(&mut id_bytes);
+        let mut dat = OpenOptions::new()
+            .write(true)
+            .open(v.file_name(".dat"))
+            .unwrap();
+        dat.seek(SeekFrom::Start(
+            tombstone_offset.to_actual_offset() as u64 + COOKIE_SIZE as u64,
+        ))
+        .unwrap();
+        dat.write_all(&id_bytes).unwrap();
+        dat.sync_all().unwrap();
+
+        let (_count, broken) = v.scrub().unwrap();
+        assert!(
+            broken
+                .iter()
+                .any(|e| e.contains("does not match needle's Id")),
+            "scrub should report the corrupted tombstone's Id, got {:?}",
+            broken
+        );
+    }
+
+    #[test]
+    fn test_scrub_checks_live_needle_id() {
+        // Mirror of Go's TestScrubVolumeDataChecksLiveNeedleId: a live needle
+        // whose stored id is damaged still reads clean — the data CRC does not
+        // cover the header — so the scrub must catch it via the index key.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+
+        write_test_needle(&mut v, 1, b"needle data");
+        v.sync_to_disk().unwrap();
+
+        let mut idx_file = File::open(v.file_name(".idx")).unwrap();
+        let mut live_offset = Offset::default();
+        idx::walk_index_file(&mut idx_file, 0, |key, offset, size| {
+            if key == NeedleId(1) && !offset.is_zero() && !size.is_deleted() {
+                live_offset = offset;
+            }
+            Ok(())
+        })
+        .unwrap();
+
+        let (_count, broken) = v.scrub().unwrap();
+        assert!(
+            broken.is_empty(),
+            "healthy needle must pass, got {:?}",
+            broken
+        );
+
+        let mut id_bytes = [0u8; NEEDLE_ID_SIZE];
+        NeedleId(99).to_bytes(&mut id_bytes);
+        let mut dat = OpenOptions::new()
+            .write(true)
+            .open(v.file_name(".dat"))
+            .unwrap();
+        dat.seek(SeekFrom::Start(
+            live_offset.to_actual_offset() as u64 + COOKIE_SIZE as u64,
+        ))
+        .unwrap();
+        dat.write_all(&id_bytes).unwrap();
+        dat.sync_all().unwrap();
+
+        let (_count, broken) = v.scrub().unwrap();
+        assert!(
+            broken
+                .iter()
+                .any(|e| e.contains("does not match needle's Id")),
+            "scrub should report the corrupted live needle's Id, got {:?}",
+            broken
+        );
+    }
+
+    #[test]
+    fn test_scrub_reports_truncated_local_deletion_tombstone() {
+        // Mirror of Go's TestScrubVolumeDataReportsTruncatedLocalDeletionTombstone.
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+
+        write_test_needle(&mut v, 1, b"needle data");
+        v.delete_needle(&mut Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0x12345678),
+            ..Needle::default()
+        })
+        .unwrap();
+        v.sync_to_disk().unwrap();
+
+        let tombstone_offset = local_tombstone_offset(&v, 1);
+        let dat = OpenOptions::new()
+            .write(true)
+            .open(v.file_name(".dat"))
+            .unwrap();
+        dat.set_len(tombstone_offset.to_actual_offset() as u64 + NEEDLE_HEADER_SIZE as u64)
+            .unwrap();
+        dat.sync_all().unwrap();
+
+        let (_count, broken) = v.scrub().unwrap();
+        assert!(
+            broken
+                .iter()
+                .any(|e| e.contains("failed to read needle 1 on volume 1")),
+            "scrub should report the truncated tombstone read, got {:?}",
+            broken
+        );
+    }
+
     #[test]
     fn test_scrub_index_flags_zero_size_idx_with_data() {
         // A populated .dat with an empty .idx is corruption — the pre-allocated
         // exception only covers a superblock-only .dat.
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         let data = b"needle data".to_vec();
         let mut n = Needle {
@@ -4371,7 +8709,7 @@ mod tests {
             data_size: data.len() as u32,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
         v.sync_to_disk().unwrap();
         assert!(v.dat_file_size().unwrap() > SUPER_BLOCK_SIZE as u64);
 
@@ -4393,7 +8731,7 @@ mod tests {
         // with live needles scrubs clean and the .dat size accounting matches.
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         for i in 1..=5 {
             let data = format!("needle data {}", i);
@@ -4404,7 +8742,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
 
@@ -4421,7 +8759,7 @@ mod tests {
     fn test_volume_multiple_needles() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         for i in 1..=10 {
             let data = format!("needle data {}", i);
@@ -4432,7 +8770,7 @@ mod tests {
                 data_size: data.len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
 
         assert_eq!(v.file_count(), 10);
@@ -4454,7 +8792,7 @@ mod tests {
 
         // Write some needles
         {
-            let mut v = make_test_volume(dir);
+            let v = make_test_volume(dir);
             for i in 1..=3 {
                 let data = format!("data {}", i);
                 let mut n = Needle {
@@ -4464,7 +8802,7 @@ mod tests {
                     data_size: data.len() as u32,
                     ..Needle::default()
                 };
-                v.write_needle(&mut n, true).unwrap();
+                v.write_needle(&mut n, true, false).unwrap();
             }
             v.sync_to_disk().unwrap();
         }
@@ -4473,13 +8811,9 @@ mod tests {
         let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         assert_eq!(v.file_count(), 3);
@@ -4492,11 +8826,253 @@ mod tests {
         assert_eq!(std::str::from_utf8(&n.data).unwrap(), "data 2");
     }
 
+    #[test]
+    fn test_redb_volume_close_then_reload_keeps_counters_exact() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let open = || {
+            Volume::new(
+                dir,
+                dir,
+                VolumeId(1),
+                NeedleMapKind::Redb,
+                &VolumeSpec::default(),
+            )
+            .unwrap()
+        };
+
+        {
+            let v = open();
+            for i in 1..=3 {
+                let data = format!("data {}", i);
+                let mut n = Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(i as u32),
+                    data: data.as_bytes().to_vec(),
+                    data_size: data.len() as u32,
+                    ..Needle::default()
+                };
+                v.write_needle(&mut n, true, false).unwrap();
+            }
+            // Volume::close is the shutdown path (store -> disk location ->
+            // volume). It must checkpoint the redb index, or the reload
+            // replays rows the table already holds and inflates the counters.
+            v.close();
+        }
+
+        let v = open();
+        assert_eq!(v.file_count(), 3);
+        assert_eq!(v.deleted_count(), 0);
+        let mut n = Needle {
+            id: NeedleId(2),
+            ..Needle::default()
+        };
+        v.read_needle(&mut n).unwrap();
+        assert_eq!(std::str::from_utf8(&n.data).unwrap(), "data 2");
+    }
+
+    #[test]
+    fn test_redb_volume_checkpoint_flushes_dat_before_index() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::Redb,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        let write = |v: &mut Volume, i: u64| {
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(1),
+                data: b"x".to_vec(),
+                data_size: 1,
+                ..Needle::default()
+            };
+            // fsync=false: the .dat append is not flushed by the write itself.
+            v.write_needle(&mut n, true, false).unwrap();
+        };
+        for i in 1..1000 {
+            write(&mut v, i);
+        }
+        // No checkpoint due yet, so META still holds the load-time .idx
+        // size. Read live: copying the open .rdb fails on Windows, where
+        // redb's file lock is mandatory (see live_meta_idx_size).
+        assert_eq!(v.live_meta_idx_size_for_test(), Some(0));
+
+        // The 1000th write makes an index checkpoint due. A checkpoint makes
+        // the index durable, so the volume has to flush the .dat first, and
+        // when that flush fails nothing may be checkpointed: a durable index
+        // row pointing past the end of an unflushed .dat loads read-only.
+        v.fail_next_fsync_for_test(true);
+        write(&mut v, 1000);
+        assert_eq!(
+            v.live_meta_idx_size_for_test(),
+            Some(0),
+            "skipped checkpoint must not record progress"
+        );
+
+        v.fail_next_fsync_for_test(false);
+        write(&mut v, 1001);
+        assert_eq!(
+            v.live_meta_idx_size_for_test(),
+            Some(1001 * NEEDLE_MAP_ENTRY_SIZE as u64)
+        );
+    }
+
+    #[test]
+    fn test_relocate_index_to_moves_index_and_serves_reads() {
+        let root = TempDir::new().unwrap();
+        let data_dir = root.path().join("data");
+        let idx_dir = root.path().join("idx");
+        fs::create_dir_all(&data_dir).unwrap();
+        fs::create_dir_all(&idx_dir).unwrap();
+        let data = data_dir.to_str().unwrap();
+        let idx = idx_dir.to_str().unwrap();
+
+        // Create the volume with its index co-located in the data dir (the state
+        // an EC reconstruct leaves), write a needle, and flush.
+        let v = Volume::new(
+            data,
+            data,
+            VolumeId(7),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        let payload = b"payload-across-relocate".to_vec();
+        let mut n = Needle {
+            id: NeedleId(42),
+            cookie: Cookie(0x55),
+            data: payload.clone(),
+            data_size: payload.len() as u32,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+        v.sync_to_disk().unwrap();
+
+        let data_idx = format!("{data}/7.idx");
+        let idx_dir_idx = format!("{idx}/7.idx");
+        assert!(
+            Path::new(&data_idx).exists(),
+            "precondition: index co-located with the data"
+        );
+
+        v.relocate_index_to(idx).unwrap();
+
+        assert!(
+            Path::new(&idx_dir_idx).exists(),
+            "index moved to the idx dir"
+        );
+        assert!(
+            !Path::new(&data_idx).exists(),
+            "index gone from the data dir"
+        );
+        assert_eq!(v.file_count(), 1);
+
+        // The volume reloaded in place, so the needle still reads back.
+        let mut got = Needle {
+            id: NeedleId(42),
+            ..Needle::default()
+        };
+        v.read_needle(&mut got).unwrap();
+        assert_eq!(got.data, payload, "needle content survives the relocate");
+
+        // Relocating again is a no-op: the index is already where asked.
+        v.relocate_index_to(idx).unwrap();
+        assert!(Path::new(&idx_dir_idx).exists());
+    }
+
+    #[test]
+    fn test_load_keeps_index_co_located_with_the_data() {
+        let root = TempDir::new().unwrap();
+        let data_dir = root.path().join("data");
+        let idx_dir = root.path().join("idx");
+        fs::create_dir_all(&data_dir).unwrap();
+        fs::create_dir_all(&idx_dir).unwrap();
+        let data = data_dir.to_str().unwrap();
+        let idx = idx_dir.to_str().unwrap();
+
+        let v = Volume::new(
+            data,
+            data,
+            VolumeId(7),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        let payload = b"payload-beside-the-data".to_vec();
+        let mut n = Needle {
+            id: NeedleId(42),
+            cookie: Cookie(0x55),
+            data: payload.clone(),
+            data_size: payload.len() as u32,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        drop(v);
+
+        // --dir.idx now names an empty directory: the index already beside the
+        // data keeps serving, and nothing lands in the new directory.
+        let reopened = Volume::new(
+            data,
+            idx,
+            VolumeId(7),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        assert!(
+            Path::new(&format!("{data}/7.idx")).exists(),
+            "index stays with the data"
+        );
+        assert!(
+            !Path::new(&format!("{idx}/7.idx")).exists(),
+            "nothing written to the new idx dir"
+        );
+
+        let mut got = Needle {
+            id: NeedleId(42),
+            ..Needle::default()
+        };
+        reopened.read_needle(&mut got).unwrap();
+        assert_eq!(got.data, payload);
+    }
+
+    #[test]
+    fn test_relocate_index_to_noop_when_already_in_place() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(1),
+            data: b"x".to_vec(),
+            data_size: 1,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+        v.sync_to_disk().unwrap();
+
+        // Data and index share a directory, so there is nothing to move.
+        v.relocate_index_to(dir).unwrap();
+        assert!(Path::new(&format!("{dir}/1.idx")).exists());
+        let mut got = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        v.read_needle(&mut got).unwrap();
+        assert_eq!(got.data, b"x");
+    }
+
     #[test]
     fn test_volume_cookie_mismatch() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         let mut n = Needle {
             id: NeedleId(1),
@@ -4505,7 +9081,7 @@ mod tests {
             data_size: 8,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
 
         // Write with wrong cookie
         let mut n2 = Needle {
@@ -4515,17 +9091,118 @@ mod tests {
             data_size: 9,
             ..Needle::default()
         };
-        let err = v.write_needle(&mut n2, true).unwrap_err();
+        let err = v.write_needle(&mut n2, true, false).unwrap_err();
         assert!(matches!(err, VolumeError::CookieMismatch(_)));
     }
 
+    /// A damaged index entry resolving to a different needle must miss on
+    /// reads and be dropped by the next write for the key, not rejected as a
+    /// cookie conflict.
+    #[test]
+    fn test_stale_index_entry_heals_on_write() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut first = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(0x2222),
+            data: b"second".to_vec(),
+            data_size: 6,
+            ..Needle::default()
+        };
+        v.write_needle(&mut first, true, false).unwrap();
+
+        // point key 9 at needle 2's record with a size that does not match
+        // the record, as a corrupt index entry would look
+        {
+            let mut io = v.io.write().unwrap();
+            let nm = io.nm.as_mut().unwrap();
+            let nv = nm.get(NeedleId(2)).unwrap().unwrap();
+            nm.put(NeedleId(9), nv.offset, Size(nv.size.0 + 1)).unwrap();
+        }
+
+        let mut probe = Needle {
+            id: NeedleId(9),
+            ..Needle::default()
+        };
+        assert!(v.read_needle(&mut probe).is_err());
+
+        let mut n = Needle {
+            id: NeedleId(9),
+            cookie: Cookie(0xabcd),
+            data: b"ninth".to_vec(),
+            data_size: 5,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+
+        let mut back = Needle {
+            id: NeedleId(9),
+            ..Needle::default()
+        };
+        v.read_needle(&mut back).unwrap();
+        assert_eq!(back.data, b"ninth");
+        assert_eq!(back.cookie, Cookie(0xabcd));
+    }
+
+    /// A stale index entry is only replaced once the new record commits: a
+    /// durable write rolled back by a failed fsync leaves the index exactly
+    /// as it found it.
+    #[test]
+    fn test_stale_index_entry_survives_failed_write() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut existing = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(0x2222),
+            data: b"second".to_vec(),
+            data_size: 6,
+            ..Needle::default()
+        };
+        v.write_needle(&mut existing, true, false).unwrap();
+
+        let stale_nv = {
+            let mut io = v.io.write().unwrap();
+            let nm = io.nm.as_mut().unwrap();
+            let nv = nm.get(NeedleId(2)).unwrap().unwrap();
+            nm.put(NeedleId(9), nv.offset, Size(nv.size.0 + 1)).unwrap();
+            nm.get(NeedleId(9)).unwrap().unwrap()
+        };
+
+        v.fail_next_fsync_for_test(true);
+        let mut replacement = Needle {
+            id: NeedleId(9),
+            cookie: Cookie(0xabcd),
+            data: b"ninth".to_vec(),
+            data_size: 5,
+            ..Needle::default()
+        };
+        assert!(v.write_needle(&mut replacement, true, true).is_err());
+        v.fail_next_fsync_for_test(false);
+
+        let now = {
+            let io = v.io.read().unwrap();
+            io.nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(9))
+                .unwrap()
+                .expect("a failed write must not drop the index entry it meant to replace")
+        };
+        assert_eq!(now.offset, stale_nv.offset);
+        assert_eq!(now.size, stale_nv.size);
+    }
+
     // A size disagreeing with the blob's own header indexes the needle at the wrong
     // length and, on v3, stamps the append timestamp into the middle of the needle.
     #[test]
     fn test_write_needle_blob_rejects_size_mismatch() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         let mut n = Needle {
             id: NeedleId(1),
@@ -4535,7 +9212,7 @@ mod tests {
             ..Needle::default()
         };
         n.checksum = CRC::new(&n.data);
-        let (offset, _, _) = v.write_needle(&mut n, true).unwrap();
+        let (offset, _, _) = v.write_needle(&mut n, true, false).unwrap();
         let blob = v.read_needle_blob(offset as i64, n.size).unwrap();
 
         let dat_size_before = v.dat_file_size().unwrap();
@@ -4552,6 +9229,91 @@ mod tests {
             .unwrap();
     }
 
+    // A blob shorter or longer than its record size leaves .dat off the record
+    // grid: later writes index at truncated offsets, or a scan reads the leftover
+    // bytes as the next record.
+    #[test]
+    fn test_write_needle_blob_rejects_length_mismatch() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        let mut n = Needle {
+            id: NeedleId(1),
+            cookie: Cookie(0x12345678),
+            data: b"the merged payload".to_vec(),
+            data_size: 18,
+            ..Needle::default()
+        };
+        n.checksum = CRC::new(&n.data);
+        let (offset, _, _) = v.write_needle(&mut n, true, false).unwrap();
+        let blob = v.read_needle_blob(offset as i64, n.size).unwrap();
+
+        let dat_size_before = v.dat_file_size().unwrap();
+
+        let mut too_long = blob.clone();
+        too_long.push(0);
+        let too_short = blob[..blob.len() - 1].to_vec();
+        let mut eight_long = blob.clone();
+        eight_long.extend_from_slice(&[0u8; 8]);
+        for mutated in [&too_long, &too_short, &eight_long] {
+            let err = v
+                .write_needle_blob_and_index(NeedleId(2), mutated, n.size)
+                .unwrap_err();
+            assert!(matches!(err, VolumeError::Io(_)), "got {err:?}");
+            assert_eq!(v.dat_file_size().unwrap(), dat_size_before);
+        }
+
+        // Later ordinary writes still read back correctly.
+        let mut next = Needle {
+            id: NeedleId(3),
+            cookie: Cookie(2),
+            data: b"next".to_vec(),
+            data_size: 4,
+            ..Needle::default()
+        };
+        next.checksum = CRC::new(&next.data);
+        v.write_needle(&mut next, true, false).unwrap();
+        let mut got = Needle {
+            id: NeedleId(3),
+            ..Needle::default()
+        };
+        v.read_needle(&mut got).unwrap();
+        assert_eq!(got.data, b"next");
+    }
+
+    #[test]
+    fn test_read_blob_negative_does_not_panic() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        let res = v.read_needle_blob(0, Size(-100));
+        assert!(res.is_err(), "negative size must return Err, not panic");
+        match res.unwrap_err() {
+            VolumeError::Io(e) => assert_eq!(e.kind(), std::io::ErrorKind::InvalidData),
+            e => panic!("expected Io InvalidData, got {e:?}"),
+        }
+    }
+
+    #[test]
+    fn test_read_blob_zero_size_not_rejected_by_validation() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        // Size(0) must not be rejected by the negativity guard: the read may
+        // Ok or fail on empty-volume IO, but never with our validation message.
+        match v.read_needle_blob(0, Size(0)) {
+            Ok(_) => {}
+            Err(VolumeError::Io(e)) => {
+                assert!(
+                    !e.to_string().contains("invalid needle size"),
+                    "Size(0) must pass validation, got {e}"
+                );
+            }
+            Err(e) => panic!("unexpected error kind for Size(0): {e:?}"),
+        }
+    }
+
     #[test]
     fn test_volume_destroy() {
         let tmp = TempDir::new().unwrap();
@@ -4560,58 +9322,17 @@ mod tests {
         let idx_path;
 
         {
-            let mut v = make_test_volume(dir);
+            let v = make_test_volume(dir);
             dat_path = v.file_name(".dat");
             idx_path = v.file_name(".idx");
             assert!(Path::new(&dat_path).exists());
-            v.destroy(false, false).unwrap();
+            v.destroy(false, false, false).unwrap();
         }
 
         assert!(!Path::new(&dat_path).exists());
         assert!(!Path::new(&idx_path).exists());
     }
 
-    #[test]
-    fn test_read_all_needles_uses_dat_order_for_live_offsets() {
-        let tmp = TempDir::new().unwrap();
-        let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
-
-        let mut first = Needle {
-            id: NeedleId(10),
-            cookie: Cookie(0x11223344),
-            data: b"first".to_vec(),
-            data_size: 5,
-            ..Needle::default()
-        };
-        v.write_needle(&mut first, true).unwrap();
-
-        let mut second = Needle {
-            id: NeedleId(20),
-            cookie: Cookie(0x55667788),
-            data: b"second".to_vec(),
-            data_size: 6,
-            ..Needle::default()
-        };
-        v.write_needle(&mut second, true).unwrap();
-
-        let mut first_overwrite = Needle {
-            id: NeedleId(10),
-            cookie: Cookie(0x11223344),
-            data: b"first-overwrite".to_vec(),
-            data_size: 15,
-            ..Needle::default()
-        };
-        v.write_needle(&mut first_overwrite, true).unwrap();
-
-        let needles = v.read_all_needles().unwrap();
-        let ids: Vec<u64> = needles.iter().map(|n| u64::from(n.id)).collect();
-        let bodies: Vec<&[u8]> = needles.iter().map(|n| n.data.as_slice()).collect();
-
-        assert_eq!(ids, vec![20, 10]);
-        assert_eq!(bodies, vec![b"second".as_slice(), b"first-overwrite".as_slice()]);
-    }
-
     #[test]
     fn test_get_append_at_ns() {
         let t1 = get_append_at_ns(0);
@@ -4628,7 +9349,7 @@ mod tests {
     fn test_volume_compact() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         // Write 3 needles
         for i in 1..=3u64 {
@@ -4639,7 +9360,7 @@ mod tests {
                 data_size: format!("data-{}", i).len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         assert_eq!(v.file_count(), 3);
 
@@ -4707,15 +9428,135 @@ mod tests {
         v.cleanup_compact().unwrap();
     }
 
+    /// Guards the copy-phase integrity check against regressing into
+    /// double-subtracting skipped bytes: expected_live_bytes already excludes
+    /// needles dropped as unreadable (they continue before the tally), so the
+    /// check must compare it directly against the compacted .dat size.
+    #[test]
+    fn test_exceeds_expected_compacted_size() {
+        assert!(!exceeds_expected_compacted_size(100, 100));
+        assert!(!exceeds_expected_compacted_size(100, 150));
+        assert!(exceeds_expected_compacted_size(100, 90));
+    }
+
+    /// A write that lands on the live volume mid-copy must not trip the
+    /// post-copy integrity check. The Rust port snapshots the index entries
+    /// before the copy loop (equivalent to Go's frozen oldNm), so a concurrent
+    /// write is invisible to the tally and the check stays quiet. The write
+    /// is then replayed by makeup_diff during commit_compact.
+    #[test]
+    fn test_compact_by_index_tolerates_concurrent_write() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+
+        for i in 1..=8u64 {
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(i as u32),
+                data: format!("data-{}", i).into_bytes(),
+                data_size: format!("data-{}", i).len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        assert!(Path::new(&v.file_name(".cpd")).exists());
+
+        // A write arriving after the snapshot but before commit must survive
+        // via makeup_diff, exactly like a concurrent write in the Go server.
+        let mut late = Needle {
+            id: NeedleId(99),
+            cookie: Cookie(99),
+            data: b"late-write".to_vec(),
+            data_size: 10,
+            ..Needle::default()
+        };
+        v.write_needle(&mut late, true, false).unwrap();
+
+        v.commit_compact().unwrap();
+
+        let mut got = Needle {
+            id: NeedleId(99),
+            cookie: Cookie(99),
+            ..Needle::default()
+        };
+        v.read_needle(&mut got).unwrap();
+        assert_eq!(got.data, b"late-write");
+    }
+
+    /// Mirrors Go's TestConcurrentWriteCrossesOffsetBoundary (issue #11410):
+    /// a replayed write's index entry must encode all offset bytes even when
+    /// old and new offsets sit in different 32 GiB ranges. Unix-only: Windows
+    /// set_len eagerly allocates the 64 GiB extension.
+    #[test]
+    #[cfg(all(unix, feature = "5bytes"))]
+    fn test_makeup_diff_replay_crosses_offset_boundary() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let mut v = make_test_volume(dir);
+
+        write_test_needle(&mut v, 1, &[b'x'; 32]);
+        v.io.read()
+            .unwrap()
+            .dat_file
+            .as_ref()
+            .unwrap()
+            .set_len(64u64 << 30)
+            .unwrap();
+        v.compact_by_index(0, 0, |_| true).unwrap();
+
+        let late_data = vec![b'x'; 113];
+        write_test_needle(&mut v, 342511246, &late_data);
+
+        let mut before = Needle {
+            id: NeedleId(342511246),
+            ..Needle::default()
+        };
+        v.read_needle(&mut before).unwrap();
+        assert_eq!(before.data, late_data);
+
+        let expected_offset = fs::metadata(v.file_name(".cpd")).unwrap().len() as i64;
+        v.commit_compact().unwrap();
+
+        let mut idx_file = File::open(v.file_name(".idx")).unwrap();
+        let mut actual_offset = 0i64;
+        crate::storage::idx::walk_index_file(&mut idx_file, 0, |key, offset, _size| {
+            if key == NeedleId(342511246) {
+                actual_offset = offset.to_actual_offset();
+            }
+            Ok(())
+        })
+        .unwrap();
+        assert_eq!(actual_offset, expected_offset);
+
+        let mut after = Needle {
+            id: NeedleId(342511246),
+            ..Needle::default()
+        };
+        v.read_needle(&mut after).unwrap();
+        assert_eq!(after.data, late_data);
+
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        v.commit_compact().unwrap();
+        let mut third = Needle {
+            id: NeedleId(342511246),
+            ..Needle::default()
+        };
+        v.read_needle(&mut third).unwrap();
+        assert_eq!(third.data, late_data);
+    }
+
     /// Vacuum compaction must tolerate an .idx entry whose offset points past
-    /// the end of the .dat file (the failure mode in issue #8928). The bad
+    /// the end of the .dat file. The bad
     /// entry is silently dropped from the resulting .cpx; healthy needles
     /// survive untouched.
     #[test]
     fn test_compact_by_index_drops_dangling_needle() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         // Write a handful of healthy needles to establish a baseline .dat/.idx.
         for i in 1..=5u64 {
@@ -4726,7 +9567,7 @@ mod tests {
                 data_size: format!("payload-{}", i).len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
 
@@ -4734,12 +9575,14 @@ mod tests {
         let bad_key = NeedleId(9999);
         let bad_offset = Offset::from_actual_offset((dat_size + 1024 * 1024) as i64);
         let bad_size = Size(2048);
-        v.nm
+        v.io.write()
+            .unwrap()
+            .nm
             .as_mut()
             .expect("needle map present")
             .put(bad_key, bad_offset, bad_size)
             .unwrap();
-        v.nm.as_ref().unwrap().sync().unwrap();
+        v.io.read().unwrap().nm.as_ref().unwrap().sync().unwrap();
 
         // Vacuum must succeed in spite of the dangling entry.
         v.compact_by_index(0, 0, |_| true)
@@ -4776,14 +9619,14 @@ mod tests {
 
     /// The needle map's max_needle_end accumulator must let volume.load
     /// detect an .idx whose entries point past the end of the .dat — the
-    /// deeper-than-tail corruption shape from issue #8928 that the existing
+    /// deeper-than-tail corruption shape that the existing
     /// last-10-entries scan cannot see. The check is populated by the load
     /// walk and read in volume.load() to flip the volume read-only.
     #[test]
     fn test_max_needle_end_detects_dangling_entry() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         for i in 1..=4u64 {
             let mut n = Needle {
@@ -4793,7 +9636,7 @@ mod tests {
                 data_size: format!("data-{}", i).len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
 
@@ -4804,8 +9647,7 @@ mod tests {
         // Sanity: a fresh load walk over the healthy .idx puts max_needle_end
         // somewhere inside the .dat.
         let mut idx_reader = File::open(&idx_path).unwrap();
-        let healthy_nm =
-            CompactNeedleMap::load_from_idx(&mut idx_reader, version).unwrap();
+        let healthy_nm = CompactNeedleMap::load_from_idx(&mut idx_reader, version).unwrap();
         let healthy_end = healthy_nm.max_needle_end();
         assert!(
             healthy_end > 0 && healthy_end <= dat_size,
@@ -4819,13 +9661,8 @@ mod tests {
         // max_needle_end past dat_size — which is exactly the signal
         // volume.load uses to mark the volume read-only.
         let bad_offset = Offset::from_actual_offset(dat_size + 4 * 1024 * 1024);
-        let mut idx_append = OpenOptions::new()
-            .write(true)
-            .append(true)
-            .open(&idx_path)
-            .unwrap();
-        idx::write_index_entry(&mut idx_append, NeedleId(9999), bad_offset, Size(1024))
-            .unwrap();
+        let mut idx_append = OpenOptions::new().append(true).open(&idx_path).unwrap();
+        idx::write_index_entry(&mut idx_append, NeedleId(9999), bad_offset, Size(1024)).unwrap();
         idx_append.sync_all().unwrap();
 
         let mut idx_reread = File::open(&idx_path).unwrap();
@@ -4840,86 +9677,10 @@ mod tests {
     }
 
     #[test]
-    fn test_compaction_revision_relookup() {
-        // Verifies that re_lookup_needle_data_offset returns the correct data offset
-        // and compaction revision, and that after compaction the offset changes.
+    fn test_stream_info_locates_needle_data() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
-
-        // Write two needles
-        let mut n1 = Needle {
-            id: NeedleId(1),
-            cookie: Cookie(0xAABBCCDD),
-            data: b"first-needle-data".to_vec(),
-            data_size: 17,
-            ..Needle::default()
-        };
-        v.write_needle(&mut n1, true).unwrap();
-
-        let mut n2 = Needle {
-            id: NeedleId(2),
-            cookie: Cookie(0x11223344),
-            data: b"second-needle-data".to_vec(),
-            data_size: 18,
-            ..Needle::default()
-        };
-        v.write_needle(&mut n2, true).unwrap();
-
-        // Get initial revision and offset for needle 1
-        let initial_rev = v.super_block.compaction_revision;
-        let (initial_offset, rev) = v.re_lookup_needle_data_offset(NeedleId(1)).unwrap();
-        assert_eq!(rev, initial_rev);
-        assert!(initial_offset > 0, "data offset should be positive");
-
-        // Delete needle 2 so compaction removes it
-        let mut del_n2 = Needle {
-            id: NeedleId(2),
-            cookie: Cookie(0x11223344),
-            ..Needle::default()
-        };
-        v.delete_needle(&mut del_n2).unwrap();
-
-        // Compact the volume — this increments compaction_revision and may move needles
-        v.compact_by_index(0, 0, |_| true).unwrap();
-        v.commit_compact().unwrap();
-
-        // After compaction, the revision should have changed
-        let new_rev = v.super_block.compaction_revision;
-        assert_eq!(
-            new_rev,
-            initial_rev + 1,
-            "compaction should increment revision"
-        );
-
-        // Re-lookup needle 1 — should still be found with the new revision
-        let (new_offset, relookup_rev) = v.re_lookup_needle_data_offset(NeedleId(1)).unwrap();
-        assert_eq!(relookup_rev, new_rev);
-        assert!(new_offset > 0, "data offset should still be positive");
-
-        // The data should still be readable correctly after compaction
-        let mut read_n1 = Needle {
-            id: NeedleId(1),
-            ..Needle::default()
-        };
-        v.read_needle(&mut read_n1).unwrap();
-        assert_eq!(read_n1.data, b"first-needle-data");
-
-        // Deleted needle should not be found
-        let result = v.re_lookup_needle_data_offset(NeedleId(2));
-        assert!(
-            result.is_err(),
-            "deleted needle should not be found after compaction"
-        );
-    }
-
-    #[test]
-    fn test_stream_info_includes_compaction_revision() {
-        // Verifies that NeedleStreamInfo carries the volume's compaction revision
-        // so that StreamingBody can detect when compaction has occurred.
-        let tmp = TempDir::new().unwrap();
-        let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         // Write a needle large enough to have meaningful data
         let data = vec![0xABu8; 2048];
@@ -4930,7 +9691,7 @@ mod tests {
             data_size: data.len() as u32,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
 
         // Read stream info
         let mut read_n = Needle {
@@ -4938,11 +9699,11 @@ mod tests {
             cookie: Cookie(0xDEADBEEF),
             ..Needle::default()
         };
-        let info = v.read_needle_stream_info(&mut read_n, false).unwrap();
+        let mut plan = v.needle_read_plan(NeedleId(42), false).unwrap();
+        plan.read_meta(&mut read_n).unwrap();
+        let info = plan.into_stream_info(&read_n);
 
-        assert_eq!(info.volume_id, VolumeId(1));
         assert_eq!(info.needle_id, NeedleId(42));
-        assert_eq!(info.compaction_revision, v.super_block.compaction_revision);
         assert_eq!(info.data_size, data.len() as u32);
         assert!(info.data_file_offset > 0);
     }
@@ -4953,7 +9714,7 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         let dat_size_before_reload = {
-            let mut v = make_test_volume(dir);
+            let v = make_test_volume(dir);
             let mut n = Needle {
                 id: NeedleId(1),
                 cookie: Cookie(0x1234),
@@ -4961,7 +9722,7 @@ mod tests {
                 data_size: 6,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
 
             let vif = VifVolumeInfo {
                 files: vec![VifRemoteFile {
@@ -5006,22 +9767,18 @@ mod tests {
             v.dat_file_size().unwrap()
         };
 
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
         assert!(v.is_read_only());
-        assert!(!v.no_write_or_delete);
-        assert!(v.no_write_can_delete);
+        assert!(!v.no_write_flags().0);
+        assert!(v.no_write_flags().1);
 
         let err = v
             .write_needle(
@@ -5033,9 +9790,10 @@ mod tests {
                     ..Needle::default()
                 },
                 true,
+                false,
             )
             .unwrap_err();
-        assert!(matches!(err, VolumeError::ReadOnly));
+        assert!(matches!(err, VolumeError::ReadOnly(_)));
 
         let deleted_size = v
             .delete_needle(&mut Needle {
@@ -5053,27 +9811,888 @@ mod tests {
             .remove("s3.vif_rw_test");
     }
 
+    /// Build a volume with `needles` needles, tier it to a fake remote backend,
+    /// and reload it the way a restart would — so it comes back read-only with
+    /// its index on disk. The local .dat is left in place, matching the state a
+    /// completed tier-down download leaves behind.
+    fn reload_as_tiered(dir: &str, backend_id: &str, needles: u64) -> Volume {
+        {
+            let v = make_test_volume(dir);
+            for i in 1..=needles {
+                let mut n = Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(0x1234),
+                    data: format!("needle-{i}").into_bytes(),
+                    data_size: format!("needle-{i}").len() as u32,
+                    ..Needle::default()
+                };
+                v.write_needle(&mut n, true, false).unwrap();
+            }
+
+            let vif = VifVolumeInfo {
+                files: vec![VifRemoteFile {
+                    backend_type: "s3".to_string(),
+                    backend_id: backend_id.to_string(),
+                    key: "remote-key".to_string(),
+                    offset: 0,
+                    file_size: v.dat_file_size().unwrap(),
+                    modified_time: 123,
+                    extension: ".dat".to_string(),
+                }],
+                version: v.version().0 as u32,
+                ..VifVolumeInfo::default()
+            };
+            std::fs::write(
+                format!("{}/1.vif", dir),
+                serde_json::to_string_pretty(&vif).unwrap(),
+            )
+            .unwrap();
+
+            let tier_config = crate::remote_storage::s3_tier::S3TierConfig {
+                access_key: "access".to_string(),
+                secret_key: "secret".to_string(),
+                region: "us-east-1".to_string(),
+                bucket: "bucket-a".to_string(),
+                endpoint: "http://127.0.0.1:1".to_string(),
+                storage_class: "STANDARD".to_string(),
+                force_path_style: true,
+            };
+            crate::remote_storage::s3_tier::global_s3_tier_registry()
+                .write()
+                .unwrap()
+                .register(
+                    format!("s3.{backend_id}"),
+                    crate::remote_storage::s3_tier::S3TierBackend::new(&tier_config),
+                );
+        }
+
+        Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap()
+    }
+
+    /// The remote reference and the derived write mode are the same fact, so a
+    /// caller must not be able to move one without the other. Every edit goes
+    /// through update_remote_files, which refreshes the mode on the way out.
+    #[test]
+    fn test_update_remote_files_refreshes_the_derived_write_mode() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        let file_size = v.dat_file_size().unwrap();
+
+        assert!(!v.has_remote_file());
+        assert!(!v.is_no_write_can_delete());
+        assert!(!v.is_no_write_or_delete());
+
+        v.update_remote_files(|files| {
+            files.push(PbRemoteFile {
+                backend_type: "s3".to_string(),
+                backend_id: "default".to_string(),
+                key: "remote-key".to_string(),
+                offset: 0,
+                file_size,
+                modified_time: 123,
+                extension: ".dat".to_string(),
+            })
+        })
+        .unwrap();
+
+        assert!(v.has_remote_file());
+        assert!(
+            v.is_no_write_can_delete(),
+            "a remote-backed volume only serves deletes"
+        );
+        assert!(!v.is_no_write_or_delete());
+
+        v.update_remote_files(|files| {
+            files.remove(0);
+        })
+        .unwrap();
+
+        assert!(!v.has_remote_file());
+        assert!(
+            !v.is_no_write_can_delete(),
+            "dropping the last remote reference publishes the volume as writable"
+        );
+        assert!(!v.is_no_write_or_delete());
+    }
+
+    /// Go's MarkTieredDeletable leaves a replicated volume's upload-time
+    /// read-only mark alone: the shell still has to copy the uploaded
+    /// replica's .idx to the others, and a tombstone written before that copy
+    /// would reach one replica only.
+    #[test]
+    fn test_update_remote_files_keeps_a_replicated_volume_refusing_deletes() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        v.super_block.write().unwrap().replica_placement =
+            crate::storage::super_block::ReplicaPlacement::from_string("001").unwrap();
+        v.set_no_write_or_delete(true); // the shell's pre-upload mark
+
+        v.update_remote_files(|files| files.push(Default::default()))
+            .unwrap();
+
+        assert!(v.has_remote_file());
+        assert!(
+            v.is_no_write_or_delete(),
+            "a replicated volume keeps refusing deletes until its next load"
+        );
+        assert!(!v.is_no_write_can_delete());
+    }
+
+    /// An I/O quarantine is not the tier upload's to lift: a live tier-up
+    /// leaves a quarantined volume's read-only mark alone, as Go's
+    /// MarkTieredDeletable does.
+    #[test]
+    fn test_update_remote_files_keeps_an_io_quarantine() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        v.set_no_write_or_delete(true);
+        v.mark_io_quarantined();
+
+        v.update_remote_files(|files| files.push(Default::default()))
+            .unwrap();
+
+        assert!(v.has_remote_file());
+        assert!(v.is_no_write_or_delete());
+        assert!(!v.is_no_write_can_delete());
+    }
+
+    /// A refused tiered volume keeps OR_DELETE without CAN_DELETE; marking it
+    /// writable must resolve to the delete-only mode a load derives — the
+    /// remote .dat cannot take appends — not drop every protection.
+    #[test]
+    fn test_set_writable_on_a_refused_tiered_volume_stays_delete_only() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        v.super_block.write().unwrap().replica_placement =
+            crate::storage::super_block::ReplicaPlacement::from_string("001").unwrap();
+        v.set_no_write_or_delete(true);
+
+        v.update_remote_files(|files| files.push(Default::default()))
+            .unwrap();
+        assert!(v.is_no_write_or_delete());
+
+        v.set_writable().unwrap();
+
+        assert!(v.is_read_only());
+        assert!(!v.no_write_flags().0);
+        assert!(v.no_write_flags().1);
+    }
+
+    // Tier-down clears the remote mode and publishes the volume as writable. The
+    // map it booted with is the read-only sorted one, whose put always fails, so
+    // without a rebuild the first write appends to .dat and then cannot be
+    // indexed — leaving bytes nothing references.
+    /// A volume tiered while the server runs must install the sorted map right
+    /// then. Reconciling only on the way down left it holding the whole index
+    /// in RAM and its .idx descriptor pinned until the next restart — the cost
+    /// the sorted map exists to avoid.
+    #[test]
+    fn test_tier_up_installs_the_sorted_needle_map() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = make_test_volume(dir);
+        for i in 1..=2u64 {
+            let mut n = Needle {
+                id: NeedleId(i),
+                cookie: Cookie(0x1234),
+                data: format!("needle-{i}").into_bytes(),
+                data_size: format!("needle-{i}").len() as u32,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+        }
+        v.sync_to_disk().unwrap();
+        assert!(
+            !matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))),
+            "a local volume starts with a writable in-memory map"
+        );
+
+        // What the tier-up handler does once the .dat is uploaded: record the
+        // remote reference and reconcile the mode.
+        let file_size = v.dat_file_size().unwrap();
+        v.update_remote_files(|files| {
+            files.push(PbRemoteFile {
+                backend_type: "s3".to_string(),
+                backend_id: "vif_tierup_test".to_string(),
+                key: "remote-key".to_string(),
+                offset: 0,
+                file_size,
+                modified_time: 123,
+                extension: ".dat".to_string(),
+            })
+        })
+        .unwrap();
+
+        assert!(v.has_remote_file());
+        assert!(
+            matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))),
+            "tier-up must install the sorted map without waiting for a restart"
+        );
+        // The index still answers, now off .sdx.
+        let nv =
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(1))
+                .unwrap()
+                .expect("needle 1 still resolves through the sorted index");
+        assert!(!nv.size.is_deleted());
+    }
+
+    #[test]
+    fn test_tier_down_swaps_in_a_writable_needle_map() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        let v = reload_as_tiered(dir, "vif_tierdown_test", 2);
+        assert!(matches!(
+            v.io.read().unwrap().nm,
+            Some(NeedleMap::SortedFile(_))
+        ));
+
+        // The tail of the tier-down handler, once the .dat is back on disk —
+        // one write lease spans the reference trim, .vif save and backend swap.
+        {
+            let _lease = v.instance().write_lock();
+            v.update_remote_files_held(|files| {
+                files.remove(0);
+            })
+            .unwrap();
+            v.save_volume_info().unwrap();
+            v.open_local_dat_backend_held().unwrap();
+        }
+
+        assert!(!v.has_remote_file());
+        assert!(
+            !v.is_read_only(),
+            "tier-down should publish a writable volume"
+        );
+        assert!(
+            !matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))),
+            "tier-down must swap the read-only map out before writes are allowed"
+        );
+
+        let mut n = Needle {
+            id: NeedleId(7),
+            cookie: Cookie(0x5678),
+            data: b"after-tier-down".to_vec(),
+            data_size: 15,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, true).unwrap();
+        v.sync_to_disk().unwrap();
+        drop(v);
+
+        // Reload: the needle must come back from .idx, not just have landed in
+        // .dat as unreferenced bytes.
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        let mut probe = Needle {
+            id: NeedleId(7),
+            ..Needle::default()
+        };
+        v.read_needle(&mut probe).unwrap();
+        assert_eq!(probe.data, b"after-tier-down");
+
+        crate::remote_storage::s3_tier::global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.vif_tierdown_test");
+    }
+
+    // An .idx that cannot be read up to the recorded size must abort
+    // compaction. Treating the short scan as the complete live set would
+    // commit a volume missing every needle past the truncation.
+    #[test]
+    fn test_compaction_aborts_on_truncated_index() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        {
+            let mut v = make_test_volume(dir);
+            for i in 1..=4u64 {
+                write_test_needle(&mut v, i, format!("needle-{i}").as_bytes());
+            }
+            v.set_read_only_persist(false, true).unwrap();
+            v.sync_to_disk().unwrap();
+        }
+        let v = make_test_volume(dir);
+        if !matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))) {
+            panic!("read-only volume should search the on-disk .sdx");
+        }
+
+        let idx = OpenOptions::new()
+            .write(true)
+            .open(v.file_name(".idx"))
+            .unwrap();
+        idx.set_len(NEEDLE_MAP_ENTRY_SIZE as u64).unwrap();
+        drop(idx);
+
+        let err = v
+            .compact_by_index(0, 0, |_| true)
+            .expect_err("compaction must not commit a partially scanned index");
+        assert!(
+            matches!(err, VolumeError::Io(ref e) if e.kind() == io::ErrorKind::UnexpectedEof),
+            "unexpected error: {err:?}"
+        );
+    }
+
+    // Building .sdx writes to the index directory, which a read-only volume's
+    // may not allow. Before the sorted map that volume mounted and served reads
+    // off an in-memory index; it must still do so rather than going offline.
+    #[test]
+    #[cfg(unix)]
+    fn test_read_only_volume_mounts_when_the_index_dir_is_not_writable() {
+        use std::os::unix::fs::PermissionsExt;
+
+        // root ignores the directory mode, so there is nothing to simulate.
+        // SAFETY: `geteuid` takes no arguments, reads no memory and cannot fail.
+        if unsafe { libc::geteuid() } == 0 {
+            return;
+        }
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        {
+            let v = make_test_volume(&dir);
+            let mut n = Needle {
+                id: NeedleId(1),
+                cookie: Cookie(0x1234),
+                data: b"still-readable".to_vec(),
+                data_size: 14,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            v.set_read_only_persist(false, true).unwrap();
+            v.sync_to_disk().unwrap();
+        }
+
+        let set_mode = |mode: u32| {
+            let mut perms = std::fs::metadata(tmp.path()).unwrap().permissions();
+            perms.set_mode(mode);
+            std::fs::set_permissions(tmp.path(), perms).unwrap();
+        };
+        set_mode(0o555);
+
+        let loaded = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        );
+        set_mode(0o755); // restore before any assertion, so cleanup works
+
+        let v = loaded.expect("a read-only volume must mount without writing its index dir");
+        assert!(
+            !matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))),
+            "the .sdx could not be built, so the index should have fallen back to memory"
+        );
+        let mut probe = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        v.read_needle(&mut probe).unwrap();
+        assert_eq!(probe.data, b"still-readable");
+    }
+
+    // Compaction copies the .idx prefix index_file_size() reports. A read-only
+    // volume's map has no writer, so that must still be the loaded size, or the
+    // copy is empty and the commit drops every needle.
+    #[cfg(unix)]
+    fn check_read_only_compaction_keeps_needles(index_dir_writable: bool) {
+        use std::os::unix::fs::PermissionsExt;
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        {
+            let mut v = make_test_volume(&dir);
+            for i in 1..=3u64 {
+                write_test_needle(&mut v, i, format!("data-{i}").as_bytes());
+            }
+            v.set_read_only_persist(false, true).unwrap();
+            v.sync_to_disk().unwrap();
+        }
+        let idx_len = fs::metadata(format!("{dir}/1.idx")).unwrap().len();
+
+        let set_mode = |mode: u32| {
+            let mut perms = std::fs::metadata(tmp.path()).unwrap().permissions();
+            perms.set_mode(mode);
+            std::fs::set_permissions(tmp.path(), perms).unwrap();
+        };
+        if !index_dir_writable {
+            set_mode(0o555);
+        }
+        let loaded = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        );
+        set_mode(0o755);
+
+        let v = loaded.unwrap();
+        assert_eq!(
+            matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))),
+            index_dir_writable
+        );
+        assert_eq!(v.idx_file_size(), idx_len);
+
+        v.compact_by_index(0, 0, |_| true).unwrap();
+        v.commit_compact().unwrap();
+        for i in 1..=3u64 {
+            let mut n = Needle {
+                id: NeedleId(i),
+                ..Needle::default()
+            };
+            v.read_needle(&mut n).unwrap();
+            assert_eq!(n.data, format!("data-{i}").as_bytes());
+        }
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn test_compacting_a_read_only_volume_keeps_its_needles_sorted_index() {
+        check_read_only_compaction_keeps_needles(true);
+    }
+
+    // The .sdx could not be built, so the index fell back to memory.
+    #[test]
+    #[cfg(unix)]
+    fn test_compacting_a_read_only_volume_keeps_its_needles_in_memory_fallback() {
+        // root ignores the directory mode, so there is nothing to simulate.
+        // SAFETY: `geteuid` takes no arguments, reads no memory and cannot fail.
+        if unsafe { libc::geteuid() } == 0 {
+            return;
+        }
+        check_read_only_compaction_keeps_needles(false);
+    }
+
+    // set_writable clears the read-only flags before it can know the .idx writer
+    // will attach. If attaching fails the flags have to go back: a volume that
+    // advertises writable while its map has no writer takes puts into memory and
+    // loses them at the next restart.
+    #[test]
+    #[cfg(unix)]
+    fn test_set_writable_rolls_back_when_the_idx_writer_cannot_attach() {
+        use std::os::unix::fs::PermissionsExt;
+
+        // root ignores the directory mode, so there is nothing to simulate.
+        // SAFETY: `geteuid` takes no arguments, reads no memory and cannot fail.
+        if unsafe { libc::geteuid() } == 0 {
+            return;
+        }
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        {
+            let v = make_test_volume(&dir);
+            let mut n = Needle {
+                id: NeedleId(1),
+                cookie: Cookie(0x1234),
+                data: b"before".to_vec(),
+                data_size: 6,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            v.set_read_only_persist(false, true).unwrap();
+            v.sync_to_disk().unwrap();
+        }
+
+        // A read-only mount, both halves of it: nothing new can be created in the
+        // directory, so .sdx generation fails and the index falls back to memory,
+        // and the .idx itself cannot be opened for write, so no writer attaches.
+        let set_mode = |path: &std::path::Path, mode: u32| {
+            let mut perms = std::fs::metadata(path).unwrap().permissions();
+            perms.set_mode(mode);
+            std::fs::set_permissions(path, perms).unwrap();
+        };
+        let idx_path = tmp.path().join("1.idx");
+        set_mode(&idx_path, 0o444);
+        set_mode(tmp.path(), 0o555);
+
+        let loaded = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        );
+        let marked = loaded.map(|v| {
+            let r = v.set_writable();
+            (
+                v.no_write_flags().0,
+                v.is_read_only(),
+                v.io.read().unwrap().nm.as_ref().unwrap().has_idx_writer(),
+                r,
+            )
+        });
+        // Restore before any assertion, so cleanup works.
+        set_mode(tmp.path(), 0o755);
+        set_mode(&idx_path, 0o644);
+
+        let (no_write_or_delete, read_only, has_writer, result) = marked.unwrap();
+        assert!(
+            result.is_err(),
+            "set_writable cannot succeed without an .idx writer"
+        );
+        assert!(!has_writer, "the writer is what failed to attach");
+        assert!(
+            no_write_or_delete && read_only,
+            "a failed mark must leave the volume read-only, not writable with an index it cannot append to"
+        );
+    }
+
+    // .idx is a run of fixed-size rows and writers append at EOF, so a partial
+    // row left by a short write puts every row appended after it off alignment
+    // and the next load parses the rest as garbage. The tail has to go before
+    // anything writable attaches.
+    #[test]
+    fn test_writable_load_trims_a_torn_idx_tail() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        {
+            let v = make_test_volume(&dir);
+            let mut n = Needle {
+                id: NeedleId(1),
+                cookie: Cookie(0x1234),
+                data: b"first".to_vec(),
+                data_size: 5,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, true).unwrap();
+            v.sync_to_disk().unwrap();
+        }
+
+        let idx_path = tmp.path().join("1.idx");
+        let whole = std::fs::metadata(&idx_path).unwrap().len();
+        {
+            use std::io::Write as _;
+            let mut f = OpenOptions::new().append(true).open(&idx_path).unwrap();
+            f.write_all(&[0xcd; 5]).unwrap();
+        }
+
+        let v = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        assert_eq!(
+            std::fs::metadata(&idx_path).unwrap().len(),
+            whole,
+            "the partial row should be gone before any writer attaches"
+        );
+
+        let mut n = Needle {
+            id: NeedleId(2),
+            cookie: Cookie(0x5678),
+            data: b"second".to_vec(),
+            data_size: 6,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, true).unwrap();
+        v.sync_to_disk().unwrap();
+        drop(v);
+
+        // Both rows have to survive the round trip; a misaligned append loses
+        // the second one and garbles whatever follows it.
+        let v = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for (id, want) in [(1u64, &b"first"[..]), (2u64, &b"second"[..])] {
+            let mut probe = Needle {
+                id: NeedleId(id),
+                ..Needle::default()
+            };
+            v.read_needle(&mut probe).unwrap();
+            assert_eq!(probe.data, want);
+        }
+    }
+
+    // A delete-capable read-only volume — every tiered one — takes the in-memory
+    // loader's read-write branch, which fails on the same unwritable directory
+    // that refused the .sdx. It has to end up read-only rather than offline.
+    #[test]
+    #[cfg(unix)]
+    fn test_delete_capable_volume_falls_all_the_way_back_to_read_only() {
+        use std::os::unix::fs::PermissionsExt;
+
+        // root ignores the directory mode, so there is nothing to simulate.
+        // SAFETY: `geteuid` takes no arguments, reads no memory and cannot fail.
+        if unsafe { libc::geteuid() } == 0 {
+            return;
+        }
+
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        {
+            let v = make_test_volume(&dir);
+            let mut n = Needle {
+                id: NeedleId(1),
+                cookie: Cookie(0x1234),
+                data: b"still-readable".to_vec(),
+                data_size: 14,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            v.set_read_only_persist(true, true).unwrap();
+            v.sync_to_disk().unwrap();
+        }
+
+        let set_mode = |path: &std::path::Path, mode: u32| {
+            let mut perms = std::fs::metadata(path).unwrap().permissions();
+            perms.set_mode(mode);
+            std::fs::set_permissions(path, perms).unwrap();
+        };
+        let idx_path = tmp.path().join("1.idx");
+        set_mode(&idx_path, 0o444);
+        set_mode(tmp.path(), 0o555);
+
+        let loaded = Volume::new(
+            &dir,
+            &dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        );
+        set_mode(tmp.path(), 0o755);
+        set_mode(&idx_path, 0o644);
+
+        let v = loaded.expect("a delete-capable volume must mount without a writable index dir");
+        assert!(
+            v.no_write_flags().0,
+            "with no writer for tombstones, deletes have to be refused outright"
+        );
+        let mut probe = Needle {
+            id: NeedleId(1),
+            ..Needle::default()
+        };
+        v.read_needle(&mut probe).unwrap();
+        assert_eq!(probe.data, b"still-readable");
+    }
+
+    // Issue #10937: a volume server holding hundreds of thousands of cloud-tiered
+    // volumes ran out of descriptors because every one of them pinned its index
+    // for the life of the process. A tiered volume must search the on-disk .sdx
+    // and hold nothing open while it sits idle.
+    #[test]
+    fn test_remote_volume_index_is_on_disk_and_holds_no_descriptors() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+
+        {
+            let v = make_test_volume(dir);
+            for i in 1..=4u64 {
+                let mut n = Needle {
+                    id: NeedleId(i),
+                    cookie: Cookie(0x1234),
+                    data: format!("needle-{i}").into_bytes(),
+                    data_size: format!("needle-{i}").len() as u32,
+                    ..Needle::default()
+                };
+                v.write_needle(&mut n, true, false).unwrap();
+            }
+
+            // A writable volume does pin its .idx, which is also what proves the
+            // descriptor probe below is looking at something real.
+            if let Some(count) = crate::storage::needle_map::file_pool::open_index_fds(tmp.path()) {
+                assert!(count > 0, "a writable volume should hold its .idx open");
+            }
+
+            let vif = VifVolumeInfo {
+                files: vec![VifRemoteFile {
+                    backend_type: "s3".to_string(),
+                    backend_id: "vif_fd_test".to_string(),
+                    key: "remote-key".to_string(),
+                    offset: 0,
+                    file_size: v.dat_file_size().unwrap(),
+                    modified_time: 123,
+                    extension: ".dat".to_string(),
+                }],
+                version: v.version().0 as u32,
+                ..VifVolumeInfo::default()
+            };
+            std::fs::write(
+                format!("{}/1.vif", dir),
+                serde_json::to_string_pretty(&vif).unwrap(),
+            )
+            .unwrap();
+
+            let tier_config = crate::remote_storage::s3_tier::S3TierConfig {
+                access_key: "access".to_string(),
+                secret_key: "secret".to_string(),
+                region: "us-east-1".to_string(),
+                bucket: "bucket-a".to_string(),
+                endpoint: "http://127.0.0.1:1".to_string(),
+                storage_class: "STANDARD".to_string(),
+                force_path_style: true,
+            };
+            crate::remote_storage::s3_tier::global_s3_tier_registry()
+                .write()
+                .unwrap()
+                .register(
+                    "s3.vif_fd_test".to_string(),
+                    crate::remote_storage::s3_tier::S3TierBackend::new(&tier_config),
+                );
+        }
+
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+
+        assert!(v.has_remote_file());
+        let (idx_path, sdx_path) = {
+            let io = v.io.read().unwrap();
+            let Some(NeedleMap::SortedFile(ref nm)) = io.nm else {
+                panic!(
+                    "tiered volume should search the on-disk .sdx, got {:?}",
+                    io.nm.is_some()
+                );
+            };
+            (
+                nm.index_file_name().to_string(),
+                nm.db_file_name().to_string(),
+            )
+        };
+        assert!(Path::new(&sdx_path).exists(), "load should build the .sdx");
+
+        let drop_pooled = || {
+            crate::storage::needle_map::file_pool::pooled_index_files().discard(&idx_path);
+            crate::storage::needle_map::file_pool::pooled_index_files().discard(&sdx_path);
+        };
+
+        if crate::storage::needle_map::file_pool::open_index_fds(tmp.path()).is_some() {
+            drop_pooled();
+            assert_eq!(
+                crate::storage::needle_map::file_pool::open_index_fds(tmp.path()),
+                Some(0),
+                "a loaded tiered volume must hold no .idx/.sdx descriptor"
+            );
+        }
+
+        // Lookups still resolve, straight off .sdx.
+        assert!(
+            !v.io
+                .read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(3))
+                .unwrap()
+                .unwrap()
+                .size
+                .is_deleted()
+        );
+        assert!(
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(9))
+                .unwrap()
+                .is_none()
+        );
+
+        // Deletes are still allowed on a tiered volume and land in .idx.
+        let idx_before = std::fs::metadata(&idx_path).unwrap().len();
+        let deleted = v
+            .delete_needle(&mut Needle {
+                id: NeedleId(3),
+                cookie: Cookie(0x1234),
+                ..Needle::default()
+            })
+            .unwrap();
+        assert!(deleted.0 > 0);
+        assert_eq!(
+            std::fs::metadata(&idx_path).unwrap().len(),
+            idx_before + NEEDLE_MAP_ENTRY_SIZE as u64,
+            "the tombstone must be appended to the .idx tail"
+        );
+        assert!(
+            v.io.read()
+                .unwrap()
+                .nm
+                .as_ref()
+                .unwrap()
+                .get(NeedleId(3))
+                .unwrap()
+                .unwrap()
+                .size
+                .is_deleted()
+        );
+
+        if crate::storage::needle_map::file_pool::open_index_fds(tmp.path()).is_some() {
+            drop_pooled();
+            assert_eq!(
+                crate::storage::needle_map::file_pool::open_index_fds(tmp.path()),
+                Some(0),
+                "reads and deletes must give their borrowed handles back"
+            );
+        }
+
+        crate::remote_storage::s3_tier::global_s3_tier_registry()
+            .write()
+            .unwrap()
+            .remove("s3.vif_fd_test");
+    }
+
     #[test]
     fn test_set_writable_keeps_remote_delete_only_mode() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
-        v.volume_info.files.push(PbRemoteFile {
-            backend_type: "s3".to_string(),
-            backend_id: "default".to_string(),
-            key: "remote-key".to_string(),
-            offset: 0,
-            file_size: v.dat_file_size().unwrap(),
-            modified_time: 123,
-            extension: ".dat".to_string(),
-        });
-        v.refresh_remote_write_mode();
+        let file_size = v.dat_file_size().unwrap();
+        v.update_remote_files(|files| {
+            files.push(PbRemoteFile {
+                backend_type: "s3".to_string(),
+                backend_id: "default".to_string(),
+                key: "remote-key".to_string(),
+                offset: 0,
+                file_size,
+                modified_time: 123,
+                extension: ".dat".to_string(),
+            })
+        })
+        .unwrap();
         v.set_writable().unwrap();
 
         assert!(v.is_read_only());
-        assert!(!v.no_write_or_delete);
-        assert!(v.no_write_can_delete);
+        assert!(!v.no_write_flags().0);
+        assert!(v.no_write_flags().1);
     }
 
     // A volume booted with .vif ReadOnly=true used to come back stuck —
@@ -5087,7 +10706,7 @@ mod tests {
         let dir = tmp.path().to_str().unwrap();
 
         {
-            let mut v = make_test_volume(dir);
+            let v = make_test_volume(dir);
             let mut n = Needle {
                 id: NeedleId(1),
                 cookie: Cookie(1),
@@ -5095,36 +10714,36 @@ mod tests {
                 data_size: 7,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
-            v.set_read_only_persist(true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
+            v.set_read_only_persist(false, true).unwrap();
             v.sync_to_disk().unwrap();
         }
 
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         assert!(
-            v.no_write_or_delete,
+            v.no_write_flags().0,
             "reloaded volume should be read-only from .vif"
         );
         assert!(
-            !v.nm.as_ref().unwrap().has_idx_writer(),
-            "read-only load should not attach an .idx writer"
+            matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))),
+            "read-only load should search the on-disk .sdx"
         );
 
         v.set_writable().unwrap();
         assert!(!v.is_read_only());
         assert!(
-            v.nm.as_ref().unwrap().has_idx_writer(),
+            !matches!(v.io.read().unwrap().nm, Some(NeedleMap::SortedFile(_))),
+            "set_writable must swap out the read-only map, whose put always fails"
+        );
+        assert!(
+            v.io.read().unwrap().nm.as_ref().unwrap().has_idx_writer(),
             "set_writable must reattach the .idx writer or post-restart writes vanish"
         );
 
@@ -5135,7 +10754,7 @@ mod tests {
             data_size: 19,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
         v.sync_to_disk().unwrap();
 
         // Reload one more time — the .idx must contain the post-mark-writable
@@ -5144,13 +10763,9 @@ mod tests {
         let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         let mut probe = Needle {
@@ -5158,7 +10773,176 @@ mod tests {
             ..Needle::default()
         };
         v.read_needle(&mut probe).unwrap();
-        assert_eq!(std::str::from_utf8(&probe.data).unwrap(), "after-mark-writable");
+        assert_eq!(
+            std::str::from_utf8(&probe.data).unwrap(),
+            "after-mark-writable"
+        );
+    }
+
+    // readOnlyCanDelete rejects writes, keeps accepting deletes, and survives
+    // a restart.
+    #[test]
+    fn test_read_only_can_delete_persists_and_keeps_deletes_working() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+
+        {
+            let v = make_test_volume(dir);
+            for id in 1..=2u64 {
+                let mut n = Needle {
+                    id: NeedleId(id),
+                    cookie: Cookie(id as u32),
+                    data: b"payload".to_vec(),
+                    data_size: 7,
+                    ..Needle::default()
+                };
+                v.write_needle(&mut n, true, false).unwrap();
+            }
+            v.set_read_only_persist(true, true).unwrap();
+            assert!(v.no_write_flags().1);
+            assert!(!v.no_write_flags().0);
+            assert!(v.is_read_only());
+
+            let err = v
+                .write_needle(
+                    &mut Needle {
+                        id: NeedleId(3),
+                        cookie: Cookie(3),
+                        data: b"blocked".to_vec(),
+                        data_size: 7,
+                        ..Needle::default()
+                    },
+                    true,
+                    false,
+                )
+                .unwrap_err();
+            assert!(matches!(err, VolumeError::ReadOnly(_)));
+
+            let deleted = v
+                .delete_needle(&mut Needle {
+                    id: NeedleId(1),
+                    cookie: Cookie(1),
+                    ..Needle::default()
+                })
+                .unwrap();
+            assert!(deleted.0 > 0, "deletes must still land");
+            v.sync_to_disk().unwrap();
+        }
+
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        assert!(v.no_write_flags().1, "state must survive a restart");
+        assert!(!v.no_write_flags().0);
+        assert!(
+            v.io.read().unwrap().nm.as_ref().unwrap().has_idx_writer(),
+            "canDelete boot must attach an .idx writer for delete tombstones"
+        );
+
+        let err = v
+            .write_needle(
+                &mut Needle {
+                    id: NeedleId(4),
+                    cookie: Cookie(4),
+                    data: b"blocked".to_vec(),
+                    data_size: 7,
+                    ..Needle::default()
+                },
+                true,
+                false,
+            )
+            .unwrap_err();
+        assert!(matches!(err, VolumeError::ReadOnly(_)));
+
+        let deleted = v
+            .delete_needle(&mut Needle {
+                id: NeedleId(2),
+                cookie: Cookie(2),
+                ..Needle::default()
+            })
+            .unwrap();
+        assert!(deleted.0 > 0, "deletes must still land after restart");
+
+        // downgrading to plain readonly clears the canDelete flag
+        v.set_read_only_persist(false, true).unwrap();
+        assert!(v.no_write_flags().0);
+        assert!(!v.no_write_flags().1);
+
+        // -writable clears the state again.
+        v.set_writable().unwrap();
+        assert!(!v.is_read_only());
+        let mut n = Needle {
+            id: NeedleId(5),
+            cookie: Cookie(5),
+            data: b"writable-again".to_vec(),
+            data_size: 14,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+    }
+
+    // Upgrading a volume that booted plain persisted-readonly to canDelete
+    // must attach the missing .idx writer, or delete tombstones cannot append.
+    #[test]
+    fn test_read_only_can_delete_upgrade_after_readonly_boot() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+
+        {
+            let v = make_test_volume(dir);
+            let mut n = Needle {
+                id: NeedleId(1),
+                cookie: Cookie(1),
+                data: b"payload".to_vec(),
+                data_size: 7,
+                ..Needle::default()
+            };
+            v.write_needle(&mut n, true, false).unwrap();
+            v.set_read_only_persist(false, true).unwrap();
+            v.sync_to_disk().unwrap();
+        }
+
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        assert!(v.no_write_flags().0);
+        let err = v
+            .delete_needle(&mut Needle {
+                id: NeedleId(1),
+                cookie: Cookie(1),
+                ..Needle::default()
+            })
+            .unwrap_err();
+        assert!(
+            matches!(err, VolumeError::ReadOnly(_)),
+            "plain readonly must reject deletes"
+        );
+
+        v.set_read_only_persist(true, true).unwrap();
+        assert!(!v.no_write_flags().0);
+        assert!(v.no_write_flags().1);
+        assert!(
+            v.io.read().unwrap().nm.as_ref().unwrap().has_idx_writer(),
+            "upgrade to canDelete must attach the .idx writer"
+        );
+        let deleted = v
+            .delete_needle(&mut Needle {
+                id: NeedleId(1),
+                cookie: Cookie(1),
+                ..Needle::default()
+            })
+            .unwrap();
+        assert!(deleted.0 > 0, "deletes must land once canDelete is set");
     }
 
     #[test]
@@ -5179,18 +10963,14 @@ mod tests {
         let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
-        assert_eq!(v.volume_info.version, Version::current().0 as u32);
-        assert_eq!(v.volume_info.bytes_offset, OFFSET_SIZE as u32);
+        assert_eq!(v.volume_info().version, Version::current().0 as u32);
+        assert_eq!(v.volume_info().bytes_offset, OFFSET_SIZE as u32);
         assert_eq!(v.version(), Version::current());
     }
 
@@ -5219,18 +10999,14 @@ mod tests {
         let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
         // Superblock version (3) overrides the .vif version (2)
-        assert_eq!(v.volume_info.version, VERSION_3.0 as u32);
+        assert_eq!(v.volume_info().version, VERSION_3.0 as u32);
         assert_eq!(v.version(), VERSION_3);
     }
 
@@ -5256,13 +11032,9 @@ mod tests {
         let result = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         );
 
         match result {
@@ -5275,13 +11047,38 @@ mod tests {
         }
     }
 
+    // A directory occupying the .dat path fails open even as root; load must
+    // return the error. Mirrors Go's TestLoad_DatOpenFail_NoNilPanic.
+    #[test]
+    fn test_load_dat_open_fail_returns_error() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+
+        {
+            let _v = make_test_volume(dir);
+        }
+
+        let dat_path = format!("{dir}/1.dat");
+        std::fs::remove_file(&dat_path).unwrap();
+        std::fs::create_dir(&dat_path).unwrap();
+
+        let result = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        );
+        assert!(result.is_err(), "unopenable .dat must fail load");
+    }
+
     #[test]
     fn test_remote_only_volume_load_reads_from_tier_backend() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
 
         let dat_bytes = {
-            let mut v = make_test_volume(dir);
+            let v = make_test_volume(dir);
             let mut n = Needle {
                 id: NeedleId(7),
                 cookie: Cookie(0x7788),
@@ -5289,7 +11086,7 @@ mod tests {
                 data_size: 11,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
             v.sync_to_disk().unwrap();
             std::fs::read(v.file_name(".dat")).unwrap()
         };
@@ -5344,19 +11141,15 @@ mod tests {
         let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
-        assert!(v.has_remote_file);
-        assert!(v.dat_file.is_none());
-        assert!(v.remote_dat_file.is_some());
+        assert!(v.has_remote_file());
+        assert!(v.io.read().unwrap().dat_file.is_none());
+        assert!(v.remote_dat_file().is_some());
 
         let mut n = Needle {
             id: NeedleId(7),
@@ -5370,7 +11163,9 @@ mod tests {
             id: NeedleId(7),
             ..Needle::default()
         };
-        let info = v.read_needle_stream_info(&mut meta, false).unwrap();
+        let mut plan = v.needle_read_plan(NeedleId(7), false).unwrap();
+        plan.read_meta(&mut meta).unwrap();
+        let info = plan.into_stream_info(&meta);
         assert!(matches!(info.source, NeedleStreamSource::Remote(_)));
         let mut streamed = vec![0u8; info.data_size as usize];
         info.source
@@ -5392,7 +11187,7 @@ mod tests {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
 
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
         let mut n = Needle {
             id: NeedleId(1),
             cookie: Cookie(1),
@@ -5400,7 +11195,7 @@ mod tests {
             data_size: 4,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
 
         // Write a .vif file (as EC encode would)
         let vif_path = format!("{}/1.vif", dir);
@@ -5414,7 +11209,7 @@ mod tests {
         assert!(std::path::Path::new(&idx_path).exists());
 
         // Destroy the volume
-        v.destroy(false, false).unwrap();
+        v.destroy(false, false, false).unwrap();
 
         // .dat and .idx should be gone
         assert!(
@@ -5440,16 +11235,12 @@ mod tests {
         let dat_dir = dat_tmp.path().to_str().unwrap();
         let idx_dir = idx_tmp.path().to_str().unwrap();
 
-        let mut v = Volume::new(
+        let v = Volume::new(
             dat_dir,
             idx_dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
 
@@ -5460,7 +11251,7 @@ mod tests {
             data_size: 5,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
 
         // Write .vif in data dir (as EC encode would)
         let vif_path = format!("{}/1.vif", dat_dir);
@@ -5471,7 +11262,7 @@ mod tests {
         assert!(std::path::Path::new(&dat_path).exists());
         assert!(std::path::Path::new(&idx_path).exists());
 
-        v.destroy(false, false).unwrap();
+        v.destroy(false, false, false).unwrap();
 
         assert!(
             !std::path::Path::new(&dat_path).exists(),
@@ -5494,7 +11285,7 @@ mod tests {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
 
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
         let mut n = Needle {
             id: NeedleId(1),
             cookie: Cookie(1),
@@ -5502,7 +11293,7 @@ mod tests {
             data_size: 4,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
 
         let vif_path = format!("{}/1.vif", dir);
         std::fs::write(&vif_path, r#"{"version":3}"#).unwrap();
@@ -5510,7 +11301,7 @@ mod tests {
         let ecx_path = format!("{}/1.ecx", dir);
         std::fs::write(&ecx_path, b"ec-index").unwrap();
 
-        v.destroy(false, false).unwrap();
+        v.destroy(false, false, false).unwrap();
 
         let dat_path = format!("{}/1.dat", dir);
         let idx_path = format!("{}/1.idx", dir);
@@ -5534,7 +11325,7 @@ mod tests {
     fn test_reconcile_roll_forward_marker_only() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         for i in 1..=6u64 {
             let mut n = Needle {
@@ -5544,7 +11335,7 @@ mod tests {
                 data_size: format!("data-{}", i).len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         for id in [2u64, 5u64] {
             let mut del = Needle {
@@ -5599,7 +11390,7 @@ mod tests {
     fn test_reconcile_roll_back_no_marker() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         for i in 1..=4u64 {
             let mut n = Needle {
@@ -5609,7 +11400,7 @@ mod tests {
                 data_size: format!("data-{}", i).len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.compact_by_index(0, 0, |_| true).unwrap();
 
@@ -5635,7 +11426,7 @@ mod tests {
     fn test_apply_compact_swap_missing_temp_files_preserves_live() {
         let tmp = TempDir::new().unwrap();
         let dir = tmp.path().to_str().unwrap();
-        let mut v = make_test_volume(dir);
+        let v = make_test_volume(dir);
 
         for i in 1..=3u64 {
             let mut n = Needle {
@@ -5645,7 +11436,7 @@ mod tests {
                 data_size: format!("data-{}", i).len() as u32,
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
         }
         v.sync_to_disk().unwrap();
 
diff --git a/seaweed-volume/src/storage/volume_idx_rebuild.rs b/seaweed-volume/src/storage/volume_idx_rebuild.rs
new file mode 100644
index 0000000000..fc36fd5e8a
--- /dev/null
+++ b/seaweed-volume/src/storage/volume_idx_rebuild.rs
@@ -0,0 +1,344 @@
+//! Rebuild a missing .idx from the .dat it indexes. Mirrors
+//! `weed/storage/volume_idx_rebuild.go`.
+
+use std::fs::{self, OpenOptions};
+use std::io::{BufWriter, Write};
+use std::path::Path;
+
+use crate::storage::idx;
+use crate::storage::needle::Needle;
+use crate::storage::super_block::SuperBlock;
+use crate::storage::types::*;
+use crate::storage::volume::{
+    Volume, VolumeError, VolumeFileVisitor, fsync_dir, needle_disk_end, scan_volume_file,
+};
+
+/// Writes one .idx row per .dat record, in .dat append order, which is the
+/// shape the volume server's own writes leave behind.
+struct VolumeFileScanner4RebuildIdx<W: Write> {
+    writer: W,
+    dat_size: i64,
+    version: Version,
+    stopped: bool,
+}
+
+impl<W: Write> VolumeFileVisitor for VolumeFileScanner4RebuildIdx<W> {
+    fn visit_super_block(&mut self, _sb: &SuperBlock) -> Result<(), VolumeError> {
+        Ok(())
+    }
+
+    fn read_needle_body(&self) -> bool {
+        false
+    }
+
+    fn visit_needle(&mut self, n: &Needle, offset: i64) -> Result<(), VolumeError> {
+        // A record reaching past the end of .dat is a torn append or a corrupt
+        // header: nothing beyond it is indexable, and a row pointing past EOF
+        // would fail every read of that needle. The all-zero header case ends
+        // the walk upstream.
+        if self.stopped {
+            return Ok(());
+        }
+        if needle_disk_end(Offset::from_actual_offset(offset), n.size, self.version) > self.dat_size
+        {
+            self.stopped = true;
+            return Ok(());
+        }
+        let size = if n.size.is_valid() {
+            n.size
+        } else {
+            TOMBSTONE_FILE_SIZE
+        };
+        idx::write_index_entry(
+            &mut self.writer,
+            n.id,
+            Offset::from_actual_offset(offset),
+            size,
+        )?;
+        Ok(())
+    }
+}
+
+impl Volume {
+    /// Regenerate the volume's .idx from its .dat. The whole index is derivable
+    /// from the data file, so a volume whose index directory has no .idx -- a
+    /// --dir.idx pointed at an empty directory, or a lost index -- comes back on
+    /// its own instead of mounting with every needle invisible. The rows go to a
+    /// temp file that is renamed in, so an interrupted rebuild leaves no partial
+    /// index behind.
+    pub(crate) fn rebuild_idx_file(&self) -> Result<(), VolumeError> {
+        let idx_path = self.file_name(".idx");
+        let dat_path = self.file_name(".dat");
+        let tmp_path = format!("{idx_path}.tmp");
+
+        let rebuild = || -> Result<(), VolumeError> {
+            if let Some(parent) = Path::new(&idx_path).parent() {
+                fs::create_dir_all(parent)?;
+            }
+            let tmp_file = OpenOptions::new()
+                .write(true)
+                .create(true)
+                .truncate(true)
+                .open(&tmp_path)?;
+            let mut scanner = VolumeFileScanner4RebuildIdx {
+                writer: BufWriter::new(&tmp_file),
+                dat_size: fs::metadata(&dat_path)?.len() as i64,
+                version: self.version(),
+                stopped: false,
+            };
+            scan_volume_file(&dat_path, &mut scanner)?;
+            scanner.writer.flush()?;
+            drop(scanner);
+            tmp_file.sync_all()?;
+            fs::rename(&tmp_path, &idx_path)?;
+            fsync_dir(&idx_path)?;
+            Ok(())
+        };
+
+        let result = rebuild();
+        if result.is_err() {
+            let _ = fs::remove_file(&tmp_path);
+        }
+        result
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::storage::needle::Needle;
+    use crate::storage::needle::crc::CRC;
+    use crate::storage::needle_map::NeedleMapKind;
+    use crate::storage::types::*;
+    use crate::storage::volume::{Volume, VolumeSpec};
+    use std::fs;
+    use std::path::Path;
+    use tempfile::TempDir;
+
+    fn needle(id: u64) -> Needle {
+        let data = format!("payload-{id}").into_bytes();
+        Needle {
+            id: NeedleId(id),
+            cookie: Cookie(0x55),
+            data_size: data.len() as u32,
+            checksum: CRC::new(&data),
+            data,
+            ..Needle::default()
+        }
+    }
+
+    // Pointing --dir.idx at a directory with no .idx used to mount the volume on
+    // an empty index; the index is derivable from the .dat, so it must be
+    // rebuilt in place instead.
+    #[test]
+    fn test_load_moved_idx_directory_rebuilds_idx() {
+        let root = TempDir::new().unwrap();
+        let data_dir = root.path().join("data");
+        let old_idx_dir = root.path().join("idxA");
+        let new_idx_dir = root.path().join("idxB");
+        for dir in [&data_dir, &old_idx_dir, &new_idx_dir] {
+            fs::create_dir_all(dir).unwrap();
+        }
+        let data = data_dir.to_str().unwrap();
+        let old_idx = old_idx_dir.to_str().unwrap();
+        let new_idx = new_idx_dir.to_str().unwrap();
+
+        let v = Volume::new(
+            data,
+            old_idx,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        for id in 1..=3 {
+            v.write_needle(&mut needle(id), true, false).unwrap();
+        }
+        v.delete_needle(&mut needle(2)).unwrap();
+        v.sync_to_disk().unwrap();
+        let (want_count, want_deleted) = (v.file_count(), v.deleted_count());
+        drop(v);
+
+        let seeded = fs::read(format!("{old_idx}/1.idx")).unwrap();
+
+        let reopened = Volume::new(
+            data,
+            new_idx,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+
+        assert!(
+            Path::new(&format!("{new_idx}/1.idx")).exists(),
+            "idx not rebuilt in the new idx dir"
+        );
+        assert_eq!(reopened.file_count(), want_count);
+        assert_eq!(reopened.deleted_count(), want_deleted);
+        assert_eq!(
+            fs::read(format!("{new_idx}/1.idx")).unwrap(),
+            seeded,
+            "rebuilt idx differs from the one the server wrote"
+        );
+
+        for id in [1, 3] {
+            let mut got = needle(id);
+            got.data.clear();
+            reopened.read_needle(&mut got).unwrap();
+            assert_eq!(got.data, format!("payload-{id}").into_bytes());
+        }
+    }
+
+    // A .dat padded with zeros must not be indexed as needle 0 rows: the walk
+    // stops where the records do.
+    #[test]
+    fn test_rebuild_idx_stops_at_zero_padded_dat_tail() {
+        let root = TempDir::new().unwrap();
+        let dir = root.path().to_str().unwrap();
+
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        v.write_needle(&mut needle(1), true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        drop(v);
+
+        let seeded = fs::read(format!("{dir}/1.idx")).unwrap();
+        let dat = fs::OpenOptions::new()
+            .write(true)
+            .open(format!("{dir}/1.dat"))
+            .unwrap();
+        let dat_size = dat.metadata().unwrap().len();
+        dat.set_len(dat_size + 4096).unwrap();
+        drop(dat);
+        fs::remove_file(format!("{dir}/1.idx")).unwrap();
+
+        let reopened = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        drop(reopened);
+
+        assert_eq!(
+            fs::read(format!("{dir}/1.idx")).unwrap(),
+            seeded,
+            "the zero-padded tail leaked into the rebuilt idx"
+        );
+    }
+
+    // A .dat whose last append was torn mid-body must not gain an index row
+    // that points past the end of the file.
+    #[test]
+    fn test_rebuild_idx_skips_truncated_dat_tail() {
+        let root = TempDir::new().unwrap();
+        let dir = root.path().to_str().unwrap();
+
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        v.write_needle(&mut needle(1), true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        let kept = fs::read(format!("{dir}/1.idx")).unwrap();
+        v.write_needle(&mut needle(2), true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        drop(v);
+
+        // Chop the second needle's body, leaving its header intact.
+        let dat = fs::OpenOptions::new()
+            .write(true)
+            .open(format!("{dir}/1.dat"))
+            .unwrap();
+        let torn_size = dat.metadata().unwrap().len() - 8;
+        dat.set_len(torn_size).unwrap();
+        drop(dat);
+        fs::remove_file(format!("{dir}/1.idx")).unwrap();
+
+        let reopened = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        drop(reopened);
+
+        assert_eq!(
+            fs::read(format!("{dir}/1.idx")).unwrap(),
+            kept,
+            "the torn record leaked into the rebuilt idx"
+        );
+    }
+
+    // A corrupt header carrying a negative size advances the .dat walk
+    // backwards, which cycles forever between it and the record before it.
+    #[test]
+    fn test_rebuild_idx_stops_at_negative_size_header() {
+        let root = TempDir::new().unwrap();
+        let dir = root.path().to_str().unwrap();
+
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        v.write_needle(&mut needle(1), true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        let kept = fs::read(format!("{dir}/1.idx")).unwrap();
+        v.write_needle(&mut needle(2), true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        drop(v);
+
+        let rows = fs::read(format!("{dir}/1.idx")).unwrap();
+        let (_, offset, _) = idx_entry_from_bytes(&rows[NEEDLE_MAP_ENTRY_SIZE..]);
+        let corrupt_at = offset.to_actual_offset();
+
+        // Overwrite the second needle's size field with a negative i32.
+        use std::io::{Seek, SeekFrom, Write};
+        let mut dat = fs::OpenOptions::new()
+            .write(true)
+            .open(format!("{dir}/1.dat"))
+            .unwrap();
+        dat.seek(SeekFrom::Start(
+            corrupt_at as u64 + COOKIE_SIZE as u64 + NEEDLE_ID_SIZE as u64,
+        ))
+        .unwrap();
+        dat.write_all(&[0xff, 0xff, 0xf0, 0x00]).unwrap();
+        drop(dat);
+        fs::remove_file(format!("{dir}/1.idx")).unwrap();
+
+        // Pre-fix the rebuild walked backwards from here and never terminated.
+        let reopened = Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        drop(reopened);
+
+        assert_eq!(
+            fs::read(format!("{dir}/1.idx")).unwrap(),
+            kept,
+            "the corrupt record leaked into the rebuilt idx"
+        );
+    }
+}
diff --git a/seaweed-volume/src/storage/volume_idx_repair.rs b/seaweed-volume/src/storage/volume_idx_repair.rs
index 612341b962..e79e222633 100644
--- a/seaweed-volume/src/storage/volume_idx_repair.rs
+++ b/seaweed-volume/src/storage/volume_idx_repair.rs
@@ -9,10 +9,10 @@ use std::path::Path;
 use tracing::info;
 
 use crate::storage::idx;
-use crate::storage::needle::needle::needle_body_length;
 use crate::storage::needle::Needle;
+use crate::storage::needle::needle::needle_body_length;
 use crate::storage::types::*;
-use crate::storage::volume::{fsync_dir, Volume, VolumeError};
+use crate::storage::volume::{Volume, VolumeError, VolumeIo, fsync_dir};
 
 /// Needles found in the head of .dat, keyed by id, plus the ids in .dat order.
 type DatHeadNeedles = (HashMap<NeedleId, (Offset, Size)>, Vec<NeedleId>);
@@ -45,15 +45,15 @@ impl Volume {
     /// restores .idx to .dat append order, which several readers lean on: the
     /// fingerprint is gone so a later load stops after one row, and the last row
     /// is the .dat-tail needle again.
-    pub(crate) fn repair_idx_head_tombstones(&self) -> Result<usize, VolumeError> {
-        if !self.has_data_backend() {
+    pub(crate) fn repair_idx_head_tombstones(&self, io: &VolumeIo) -> Result<usize, VolumeError> {
+        if !self.has_data_backend_io(io) {
             return Ok(0);
         }
         let version = self.version();
         if !version.is_supported() {
             return Ok(0);
         }
-        let first_needle_offset = self.super_block.block_size() as i64;
+        let first_needle_offset = self.super_block().block_size() as i64;
         let idx_path = self.file_name(".idx");
 
         let clobbered = idx_head_tombstone_count(&idx_path)?;
@@ -68,7 +68,7 @@ impl Volume {
             "idx starts with offset-0 tombstones, recovering the rows they overwrote from .dat"
         );
 
-        let (mut lost, order) = self.scan_dat_head(version, first_needle_offset, clobbered)?;
+        let (mut lost, order) = self.scan_dat_head(io, version, first_needle_offset, clobbered)?;
         drop_indexed_keys(&idx_path, &mut lost)?;
         if lost.is_empty() {
             return Ok(0);
@@ -93,6 +93,7 @@ impl Volume {
     /// being resurrected.
     fn scan_dat_head(
         &self,
+        io: &VolumeIo,
         version: Version,
         first_needle_offset: i64,
         limit: usize,
@@ -103,7 +104,7 @@ impl Volume {
 
         for _ in 0..limit {
             let mut header = [0u8; NEEDLE_HEADER_SIZE];
-            match self.read_exact_at_backend(&mut header, offset as u64) {
+            match self.read_exact_at_backend(io, &mut header, offset as u64) {
                 Ok(()) => {}
                 Err(VolumeError::Io(ref e)) if e.kind() == io::ErrorKind::UnexpectedEof => break,
                 Err(e) => return Err(e),
@@ -122,7 +123,19 @@ impl Volume {
             } else {
                 found.remove(&id);
             }
-            offset += NEEDLE_HEADER_SIZE as i64 + needle_body_length(size, version);
+            let record_size = NEEDLE_HEADER_SIZE as i64 + needle_body_length(size, version);
+            // A corrupt header can make the record length zero or negative;
+            // the scan cannot advance past it.
+            if record_size <= 0 {
+                return Err(VolumeError::Io(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    format!(
+                        "corrupt needle header at offset {offset}: size {}, record length {record_size}",
+                        size.0
+                    ),
+                )));
+            }
+            offset += record_size;
         }
 
         Ok((found, order))
@@ -215,26 +228,25 @@ mod tests {
     use super::*;
     use crate::storage::needle::crc::CRC;
     use crate::storage::needle_map::NeedleMapKind;
-    use std::os::unix::fs::{FileExt, PermissionsExt};
+    use crate::storage::volume::VolumeSpec;
+    use std::io::{Seek, SeekFrom};
+    #[cfg(unix)]
+    use std::os::unix::fs::PermissionsExt;
     use tempfile::TempDir;
 
     fn open_volume(dir: &str) -> Volume {
         Volume::new(
             dir,
             dir,
-            "",
             VolumeId(1),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap()
     }
 
     fn write_test_volume(dir: &str, needle_count: u64) -> Vec<Vec<u8>> {
-        let mut v = open_volume(dir);
+        let v = open_volume(dir);
         let mut written = Vec::new();
         for i in 1..=needle_count {
             let data = format!("needle-{}-payload", i).into_bytes();
@@ -246,7 +258,7 @@ mod tests {
                 data: data.clone(),
                 ..Needle::default()
             };
-            v.write_needle(&mut n, true).unwrap();
+            v.write_needle(&mut n, true, false).unwrap();
             written.push(data);
         }
         written
@@ -256,7 +268,7 @@ mod tests {
     /// writes (key, offset 0, tombstone) rows over the front of .idx instead of
     /// appending them.
     fn clobber_idx_head(idx_path: &str, keys: &[u64]) {
-        let file = OpenOptions::new().write(true).open(idx_path).unwrap();
+        let mut file = OpenOptions::new().write(true).open(idx_path).unwrap();
         for (i, key) in keys.iter().enumerate() {
             let mut row = Vec::new();
             idx::write_index_entry(
@@ -266,8 +278,13 @@ mod tests {
                 TOMBSTONE_FILE_SIZE,
             )
             .unwrap();
-            file.write_at(&row, (i * NEEDLE_MAP_ENTRY_SIZE) as u64)
+            // Positional write without Unix-only `FileExt::write_at`, so this
+            // helper (and the tests using it) also builds on Windows.
+            // Single-threaded test helper: no concurrent reader can move the
+            // offset between seek and write.
+            file.seek(SeekFrom::Start((i * NEEDLE_MAP_ENTRY_SIZE) as u64))
                 .unwrap();
+            file.write_all(&row).unwrap();
         }
     }
 
@@ -305,6 +322,7 @@ mod tests {
         let size_before = idx_size(&idx_path);
 
         // The rewrite replaces .idx wholesale, so it must not widen the mode.
+        #[cfg(unix)]
         fs::set_permissions(&idx_path, fs::Permissions::from_mode(0o600)).unwrap();
 
         // Deletes against needles 9..12 land on the front of .idx and take the
@@ -324,18 +342,21 @@ mod tests {
         let want = size_before + 4 * NEEDLE_MAP_ENTRY_SIZE as u64;
         assert_eq!(idx_size(&idx_path), want, "idx size after recovery");
 
-        assert_eq!(
-            fs::metadata(&idx_path).unwrap().permissions().mode() & 0o777,
-            0o600,
-            "idx mode after recovery"
-        );
+        #[cfg(unix)]
+        {
+            assert_eq!(
+                fs::metadata(&idx_path).unwrap().permissions().mode() & 0o777,
+                0o600,
+                "idx mode after recovery"
+            );
+        }
 
         // The recovered rows go back in front, so .idx is in .dat append order
         // again: the fingerprint is gone and the last row is still the .dat tail.
         let rows = idx_rows(&idx_path);
         assert_eq!(
             rows[0].1,
-            v.super_block.block_size() as i64,
+            v.super_block().block_size() as i64,
             "first row does not index the first needle in .dat"
         );
         for i in 1..4 {
@@ -360,7 +381,7 @@ mod tests {
         let idx_path = format!("{}/1.idx", dir);
 
         write_test_volume(dir, 6);
-        let mut v = open_volume(dir);
+        let v = open_volume(dir);
         v.delete_needle(&mut Needle {
             id: NeedleId(3),
             ..Needle::default()
@@ -395,7 +416,7 @@ mod tests {
         let idx_path = format!("{}/1.idx", dir);
 
         write_test_volume(dir, 8);
-        let mut v = open_volume(dir);
+        let v = open_volume(dir);
         v.delete_needle(&mut Needle {
             id: NeedleId(2),
             ..Needle::default()
@@ -418,4 +439,31 @@ mod tests {
             "needle 1 should have been recovered"
         );
     }
+
+    #[test]
+    fn test_scan_dat_head_fails_at_a_header_it_cannot_advance_past() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap();
+        write_test_volume(dir, 2);
+
+        let mut dat = OpenOptions::new()
+            .append(true)
+            .open(format!("{}/1.dat", dir))
+            .unwrap();
+        let mut corrupt = [0u8; NEEDLE_HEADER_SIZE];
+        NeedleId(99).to_bytes(&mut corrupt[4..12]);
+        Size(-100).to_bytes(&mut corrupt[12..16]);
+        dat.write_all(&corrupt).unwrap();
+        drop(dat);
+
+        let v = open_volume(dir);
+        let first = v.super_block().block_size() as i64;
+        let err = v
+            .scan_dat_head(&v.io_read_for_test(), v.version(), first, 10)
+            .unwrap_err();
+        assert!(
+            matches!(&err, VolumeError::Io(e) if e.kind() == io::ErrorKind::InvalidData),
+            "expected a corrupt-data error, got {err:?}"
+        );
+    }
 }
diff --git a/seaweed-volume/src/storage/volume_open.rs b/seaweed-volume/src/storage/volume_open.rs
new file mode 100644
index 0000000000..964620b943
--- /dev/null
+++ b/seaweed-volume/src/storage/volume_open.rs
@@ -0,0 +1,27 @@
+//! Opening volume data and index files without access-time updates.
+
+use std::fs::{File, OpenOptions};
+use std::io;
+use std::path::Path;
+
+/// Open a volume data or index file with `O_NOATIME`. Nothing reads these
+/// files' atime, but without the flag every needle read dirties the inode —
+/// even relatime writes atime on the first read after each write, so an
+/// actively written volume pays a metadata write per read/write cycle.
+/// Matches Go's `backend.OpenVolumeFile`.
+pub fn open_volume_file(opts: &OpenOptions, path: impl AsRef<Path>) -> io::Result<File> {
+    let path = path.as_ref();
+    #[cfg(target_os = "linux")]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+        let mut noatime = opts.clone();
+        noatime.custom_flags(libc::O_NOATIME);
+        match noatime.open(path) {
+            // O_NOATIME is refused unless we own the file or hold CAP_FOWNER.
+            Err(e) if e.raw_os_error() == Some(libc::EPERM) => opts.open(path),
+            result => result,
+        }
+    }
+    #[cfg(not(target_os = "linux"))]
+    opts.open(path)
+}
diff --git a/seaweed-volume/src/storage/volume_report.rs b/seaweed-volume/src/storage/volume_report.rs
index aedf24f237..ac5550d377 100644
--- a/seaweed-volume/src/storage/volume_report.rs
+++ b/seaweed-volume/src/storage/volume_report.rs
@@ -1,7 +1,6 @@
 //! Mirror of `weed/storage/store_volume_report.go`.
 
 use std::collections::HashMap;
-use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
 use std::sync::Mutex;
 
 /// Identifies one reported copy. Keyed by disk as well as id because a volume
@@ -9,6 +8,34 @@ use std::sync::Mutex;
 /// other's changes untold.
 pub type VolumeReportKey = (u32, u32);
 
+/// What the master was told about one volume copy: the hash that detects
+/// change, and the heartbeat pass that last found the copy held.
+#[derive(Clone, Copy)]
+struct ReportedVolume {
+    hash: u64,
+    pass: u64,
+}
+
+/// Everything a heartbeat reads and writes about what the master was told,
+/// under one lock. The full-list flag and the generation that answers it have
+/// to move together: split across atomics, a request landing between two of
+/// them is answered by a heartbeat that never carried a list. Go holds a single
+/// mutex over the same fields.
+#[derive(Default)]
+struct ReportState {
+    /// Set once the master says it compares digests. Until then the whole list
+    /// goes every time, which is what an older master needs.
+    deltas_accepted: bool,
+    full_list_needed: bool,
+    /// Counts requests for the whole list, so one arriving while a heartbeat is
+    /// being built is not marked satisfied by it.
+    full_list_generation: u64,
+    /// Numbers heartbeats, so one can mark the copies it finds held without
+    /// building a second map of them.
+    pass: u64,
+    last_reported: HashMap<VolumeReportKey, ReportedVolume>,
+}
+
 /// Remembers what the master was last told about each volume, so a heartbeat
 /// can carry only what moved since.
 ///
@@ -18,56 +45,86 @@ pub type VolumeReportKey = (u32, u32);
 /// until one accepts changes.
 #[derive(Default)]
 pub struct VolumeReportState {
-    /// Set once the master says it compares digests. Until then the whole list
-    /// goes every time, which is what an older master needs.
-    deltas_accepted: AtomicBool,
-    full_list_needed: AtomicBool,
-    /// Counts requests for the whole list, so one arriving while a heartbeat is
-    /// being built is not marked satisfied by it.
-    full_list_generation: AtomicU64,
-    last_reported: Mutex<HashMap<VolumeReportKey, u64>>,
+    state: Mutex<ReportState>,
 }
 
 impl VolumeReportState {
     /// Drops everything known about the master's view.
     pub fn reset(&self) {
-        self.deltas_accepted.store(false, Ordering::Relaxed);
-        self.full_list_needed.store(true, Ordering::Relaxed);
-        self.full_list_generation.fetch_add(1, Ordering::Relaxed);
-        self.last_reported.lock().unwrap().clear();
+        let mut state = self.state.lock().unwrap();
+        state.deltas_accepted = false;
+        state.full_list_needed = true;
+        state.full_list_generation += 1;
+        state.last_reported.clear();
     }
 
     pub fn accept_deltas(&self) {
-        self.deltas_accepted.store(true, Ordering::Relaxed);
+        self.state.lock().unwrap().deltas_accepted = true;
     }
 
     pub fn request_full_list(&self) {
-        self.full_list_needed.store(true, Ordering::Relaxed);
-        self.full_list_generation.fetch_add(1, Ordering::Relaxed);
+        let mut state = self.state.lock().unwrap();
+        state.full_list_needed = true;
+        state.full_list_generation += 1;
     }
 
-    /// Reports whether this heartbeat must carry the whole list, and the
-    /// request it answers.
-    pub fn begin(&self) -> (bool, u64) {
-        let full = self.full_list_needed.load(Ordering::Relaxed)
-            || !self.deltas_accepted.load(Ordering::Relaxed);
-        (full, self.full_list_generation.load(Ordering::Relaxed))
+    /// Opens a heartbeat: whether it must carry the whole list, the request it
+    /// answers, and the pass number that marks the copies it finds still held.
+    pub fn begin(&self) -> (bool, u64, u64) {
+        let mut state = self.state.lock().unwrap();
+        state.pass += 1;
+        (
+            state.full_list_needed || !state.deltas_accepted,
+            state.full_list_generation,
+            state.pass,
+        )
     }
 
     /// Reports whether the master needs telling about this volume, given what
-    /// it was last told.
+    /// it was last told. For a caller that is only taking a snapshot and so
+    /// must leave the reporting state alone; a heartbeat calls `record`.
     pub fn changed(&self, key: VolumeReportKey, hash: u64) -> bool {
-        self.last_reported.lock().unwrap().get(&key) != Some(&hash)
+        self.state
+            .lock()
+            .unwrap()
+            .last_reported
+            .get(&key)
+            .is_none_or(|previous| previous.hash != hash)
     }
 
-    /// Records what this heartbeat told the master. Volumes absent from
-    /// `reported` are forgotten, so one that comes back is reported again.
-    pub fn commit(&self, reported: HashMap<VolumeReportKey, u64>, generation: u64) {
-        *self.last_reported.lock().unwrap() = reported;
+    /// Marks one volume copy as held by the heartbeat being built, and reports
+    /// whether the master needs telling about it. It updates the entry already
+    /// held rather than build a second map beside it, so a server whose volumes
+    /// are quiet allocates nothing per volume per heartbeat.
+    pub fn record(&self, key: VolumeReportKey, hash: u64, pass: u64) -> bool {
+        let mut state = self.state.lock().unwrap();
+        match state.last_reported.get_mut(&key) {
+            Some(previous) => {
+                let changed = previous.hash != hash;
+                previous.hash = hash;
+                previous.pass = pass;
+                changed
+            }
+            None => {
+                state
+                    .last_reported
+                    .insert(key, ReportedVolume { hash, pass });
+                true
+            }
+        }
+    }
+
+    /// Closes the heartbeat. Copies this pass did not find are forgotten, so one
+    /// that comes back is reported again.
+    pub fn commit(&self, pass: u64, generation: u64) {
+        let mut state = self.state.lock().unwrap();
+        state
+            .last_reported
+            .retain(|_, reported| reported.pass == pass);
         // A request that arrived while this heartbeat was being built asked
         // about a later state than it carries, so it stands.
-        if self.full_list_generation.load(Ordering::Relaxed) == generation {
-            self.full_list_needed.store(false, Ordering::Relaxed);
+        if state.full_list_generation == generation {
+            state.full_list_needed = false;
         }
     }
 }
diff --git a/seaweed-volume/src/storage/volume_report_hash.rs b/seaweed-volume/src/storage/volume_report_hash.rs
index c661d4d7f2..cbb8e5f22d 100644
--- a/seaweed-volume/src/storage/volume_report_hash.rs
+++ b/seaweed-volume/src/storage/volume_report_hash.rs
@@ -30,13 +30,17 @@ pub fn report_hash(m: &master_pb::VolumeInformationMessage) -> u64 {
     if m.read_only {
         buf[56] = 1;
     }
+    if m.read_only_can_delete {
+        buf[56] |= 2;
+    }
     let mut h = xxh64(&buf, 0);
 
     h = fold(h, xxh64(&(m.modified_at_second as u64).to_le_bytes(), 0));
     h = fold(h, xxh64(m.collection.as_bytes(), 0));
     h = fold(h, xxh64(m.disk_type.as_bytes(), 0));
+    // Not the remote storage key: the master does not keep it, so a change to
+    // it alters nothing its copy holds.
     h = fold(h, xxh64(m.remote_storage_name.as_bytes(), 0));
-    h = fold(h, xxh64(m.remote_storage_key.as_bytes(), 0));
     h
 }
 
@@ -67,11 +71,13 @@ mod tests {
     #[test]
     fn report_hash_vectors() {
         let empty = master_pb::VolumeInformationMessage::default();
-        assert_eq!(report_hash(&empty), 17122085700329870549);
+        assert_eq!(report_hash(&empty), 10988706248825469653);
 
-        let mut one = master_pb::VolumeInformationMessage::default();
-        one.id = 1;
-        assert_eq!(report_hash(&one), 12867601919960834066);
+        let one = master_pb::VolumeInformationMessage {
+            id: 1,
+            ..Default::default()
+        };
+        assert_eq!(report_hash(&one), 2035849960016744285);
 
         let full = master_pb::VolumeInformationMessage {
             id: 42,
@@ -81,6 +87,7 @@ mod tests {
             delete_count: 2,
             deleted_byte_count: 99,
             read_only: true,
+            read_only_can_delete: false,
             replica_placement: 10,
             version: 3,
             ttl: 3 << 8,
@@ -91,7 +98,7 @@ mod tests {
             disk_type: "ssd".to_string(),
             disk_id: 2,
         };
-        assert_eq!(report_hash(&full), 12500327696413250175);
+        assert_eq!(report_hash(&full), 2748844479819636032);
     }
 
     #[test]
diff --git a/seaweed-volume/src/storage/volume_tail_repair.rs b/seaweed-volume/src/storage/volume_tail_repair.rs
new file mode 100644
index 0000000000..178cf1981f
--- /dev/null
+++ b/seaweed-volume/src/storage/volume_tail_repair.rs
@@ -0,0 +1,1215 @@
+//! Repair of the .dat tail a crash between the needle append and the .idx
+//! append leaves. Mirrors `repairUnindexedDatTail` and its helpers in
+//! weed/storage/volume_checking.go (#11864).
+//!
+//! A write appends the needle to .dat, then its entry to .idx, then answers
+//! the client. A process killed between the first two steps leaves a needle,
+//! or part of one, past the end of the needle at the highest indexed offset.
+//! After a power loss a complete needle can survive whose .idx entry did
+//! not, although the client was answered. So a complete needle is never
+//! dropped: every complete needle in the tail gets the .idx entry the volume
+//! server would have written, in .dat order, the .dat synced first so the
+//! rows never become durable ahead of the records they name, and only an
+//! incomplete last record is cut. A size 0 record is indexed at size 0, the
+//! same live entry
+//! the write path publishes for an empty write: a delete appends the
+//! identical record, so the two cannot be told apart, and resurrecting an
+//! empty placeholder beats a wrong tombstone, which drops an acknowledged
+//! write's object entirely.
+
+use std::fmt;
+use std::fs::{self, File, OpenOptions};
+use std::io::{self, Read, Seek, SeekFrom, Write};
+use std::path::Path;
+
+use tracing::warn;
+
+use crate::storage::needle::needle::{Needle, NeedleError, get_actual_size};
+use crate::storage::super_block::SUPER_BLOCK_SIZE;
+use crate::storage::types::*;
+use crate::storage::volume::{Volume, VolumeError, VolumeIo, needle_disk_end};
+
+/// What stopped the unindexed-.dat-tail repair. Mirrors the sentinels Go
+/// distinguishes: a `NotTorn` tail is left untouched for the integrity check
+/// to quarantine read-only, a `Corrupt` record is damaged bytes (Go errors
+/// wrapping needle.ErrorCorrupted) that `walk_unindexed_dat_tail` resolves
+/// into a cut or a `NotTorn`, an `OpenIndex` failure is the .idx refusing a
+/// read-write open — which in Go fails the whole load before the check ever
+/// runs — and `Failed` is any other repair failure, which fails the check so
+/// the volume loads read-only.
+#[derive(Debug)]
+pub(crate) enum TailRepairError {
+    NotTorn(String),
+    Corrupt(String),
+    OpenIndex(VolumeError),
+    Failed(VolumeError),
+}
+
+impl fmt::Display for TailRepairError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            TailRepairError::NotTorn(why) | TailRepairError::Corrupt(why) => {
+                write!(f, "{why}: not a torn tail")
+            }
+            TailRepairError::OpenIndex(e) | TailRepairError::Failed(e) => write!(f, "{e}"),
+        }
+    }
+}
+
+impl TailRepairError {
+    /// Mirrors Go's `errors.Is(err, errTailNotTorn)`: a tail that is not the
+    /// result of an interrupted append keeps the volume loading read-only
+    /// through the integrity check; a `Corrupt` record is resolved inside
+    /// the walk and everything else is a real repair failure.
+    pub(crate) fn is_not_torn(&self) -> bool {
+        matches!(self, TailRepairError::NotTorn(_))
+    }
+}
+
+impl From<io::Error> for TailRepairError {
+    fn from(e: io::Error) -> Self {
+        TailRepairError::Failed(VolumeError::Io(e))
+    }
+}
+
+impl From<VolumeError> for TailRepairError {
+    fn from(e: VolumeError) -> Self {
+        TailRepairError::Failed(e)
+    }
+}
+
+impl Volume {
+    /// Re-index the complete needles a crash left past the last indexed
+    /// needle of a local version 3 volume, and cut an incomplete remainder.
+    /// Mirrors Go's repairUnindexedDatTail.
+    ///
+    /// Runs ahead of the index load so the re-indexed rows land in the
+    /// needle map and inside its append offset. Only a volume about to load
+    /// writable is repaired; the caller checks the no-write flags. A crash
+    /// after the very first append leaves the needle past an index with no
+    /// entry at all: the walk then starts at the first record past the
+    /// superblock with no anchor needle and no append timestamp to compare
+    /// against, and a tail it cannot explain fails the load like any other
+    /// repair failure, since every later check skips an empty index. Nothing
+    /// is changed when the tail is anything but what an interrupted append
+    /// leaves, and the integrity check that follows then marks the volume
+    /// read-only exactly as before.
+    pub(crate) fn repair_unindexed_dat_tail(&self, io: &VolumeIo) -> Result<(), TailRepairError> {
+        let version = self.version();
+        if version != VERSION_3 || !self.has_data_backend_io(io) {
+            return Ok(());
+        }
+        let idx_path = self.file_name(".idx");
+        if !Path::new(&idx_path).exists() {
+            return Ok(());
+        }
+        let idx_size = fs::metadata(&idx_path).map(|m| m.len()).unwrap_or(0) as i64;
+        if idx_size % NEEDLE_MAP_ENTRY_SIZE as i64 != 0 {
+            // a partial .idx entry is left alone, as today
+            return Ok(());
+        }
+        let file_size = self.current_dat_file_size_io(io)? as i64;
+        if file_size <= SUPER_BLOCK_SIZE as i64 || file_size > MAX_POSSIBLE_VOLUME_SIZE as i64 {
+            // past MaxPossibleVolumeSize the .idx offsets wrap: an entry's
+            // offset does not name its needle's position on its own
+            return Ok(());
+        }
+
+        // Go opens the index O_RDWR ahead of the check when the volume is
+        // writable, and a failure there fails the load, not just the repair.
+        let mut idx_file = OpenOptions::new()
+            .read(true)
+            .write(true)
+            .open(&idx_path)
+            .map_err(|e| TailRepairError::OpenIndex(VolumeError::Io(e)))?;
+
+        let mut last_append_at_ns = 0u64;
+        let start = if idx_size == 0 {
+            // The index holds no row at all, so no entry can anchor the
+            // walk: it starts at the first record past the superblock.
+            // Mirrors Go's tailEntryPos < 0.
+            self.super_block().block_size() as i64
+        } else {
+            let tail_entry_pos =
+                self.find_dat_tail_entry_offset(io, &mut idx_file, idx_size, version)?;
+            if tail_entry_pos < 0 {
+                // pre-allocated / all-zero index, no anchor to repair past
+                return Ok(());
+            }
+            let mut buf = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+            idx_file.seek(SeekFrom::Start(tail_entry_pos as u64))?;
+            idx_file.read_exact(&mut buf)?;
+            let (key, offset, size) = idx_entry_from_bytes(&buf);
+            if offset.is_zero() {
+                return Ok(());
+            }
+            let start = needle_disk_end(offset, size, version);
+            if start >= file_size {
+                // the .dat ends at the last needle (clean), or the index
+                // references bytes the .dat does not have: not a torn tail
+                return Ok(());
+            }
+
+            // Anchor: the needle at the highest indexed offset must be the one
+            // its entry describes, whole and with a valid CRC.
+            let on_disk_size = if size.is_deleted() { Size(0) } else { size };
+            let anchor = self
+                .read_tail_needle(io, offset.to_actual_offset(), on_disk_size, version)
+                .map_err(|e| {
+                    TailRepairError::NotTorn(format!(
+                        "last indexed needle {key} at {}: {e}",
+                        offset.to_actual_offset()
+                    ))
+                })?;
+            if anchor.id != key {
+                return Err(TailRepairError::NotTorn(format!(
+                    "needle at {} is id {:?}, its index entry says id {:?}",
+                    offset.to_actual_offset(),
+                    anchor.id,
+                    key
+                )));
+            }
+            last_append_at_ns = anchor.append_at_ns;
+            start
+        };
+        if start >= file_size {
+            // no record past the superblock: nothing to index
+            return Ok(());
+        }
+
+        let (entries, cut_at) =
+            self.walk_unindexed_dat_tail(io, version, start, file_size, last_append_at_ns)?;
+        let reindexed = entries.len() / NEEDLE_MAP_ENTRY_SIZE;
+        if reindexed > 0 {
+            // The new .idx rows must not become durable before the .dat
+            // records they name: a power loss between the two would leave
+            // the .idx pointing past the end of the .dat.
+            self.flush_dat(io).map_err(|e| {
+                TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                    e.kind(),
+                    format!("sync {} before re-indexing: {e}", self.file_name(".dat")),
+                )))
+            })?;
+            Self::append_index_entries(&mut idx_file, &entries, idx_size)?;
+        }
+        let mut cut = 0i64;
+        if cut_at < file_size {
+            self.truncate_dat(io, cut_at as u64).map_err(|e| {
+                TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                    e.kind(),
+                    format!("truncate {} to {cut_at}: {e}", self.file_name(".dat")),
+                )))
+            })?;
+            self.flush_dat(io).map_err(|e| {
+                TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                    e.kind(),
+                    format!(
+                        "sync {} after truncating to {cut_at}: {e}",
+                        self.file_name(".dat")
+                    ),
+                )))
+            })?;
+            cut = file_size - cut_at;
+        }
+        warn!(
+            "volume {}: repaired the unindexed tail of {}: re-indexed {} needle(s), cut {} bytes ({} -> {} bytes)",
+            self.id.0,
+            self.file_name(".dat"),
+            reindexed,
+            cut,
+            file_size,
+            file_size - cut
+        );
+        Ok(())
+    }
+
+    /// Read and verify the whole record of a needle of the given on-disk
+    /// size at offset: header, body, CRC and timestamp. Mirrors Go's
+    /// readTailNeedle.
+    fn read_tail_needle(
+        &self,
+        io: &VolumeIo,
+        at: i64,
+        size: Size,
+        version: Version,
+    ) -> Result<Needle, TailRepairError> {
+        let blob = self
+            .read_needle_blob_unlocked(io, at, size)
+            .map_err(TailRepairError::Failed)?;
+        let mut n = Needle::default();
+        n.read_bytes(&blob, at, size, version)
+            .map_err(|e| match e {
+                NeedleError::CrcMismatch { .. }
+                | NeedleError::IndexOutOfRange(_)
+                | NeedleError::TailTooShort => TailRepairError::Corrupt(e.to_string()),
+                other => TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                    io::ErrorKind::InvalidData,
+                    other.to_string(),
+                ))),
+            })?;
+        if size.0 > 0 && n.data.is_empty() {
+            // A needle with no data is written with size 0, so a record with
+            // a body whose data size reads 0 is damaged. The CRC covers only
+            // the data, and read_bytes does not check it for empty data.
+            return Err(TailRepairError::Corrupt(format!(
+                "needle {:?} at {at} has size {} but no data",
+                n.id, size.0
+            )));
+        }
+        Ok(n)
+    }
+
+    /// Walk the needles from start to file_size and return the .idx entries
+    /// of the complete ones, and the offset from which the rest is an
+    /// incomplete last record (file_size when there is none). Fails with
+    /// NotTorn when the tail is damaged in a way an interrupted append does
+    /// not explain. Mirrors Go's walkUnindexedDatTail.
+    fn walk_unindexed_dat_tail(
+        &self,
+        io: &VolumeIo,
+        version: Version,
+        start: i64,
+        file_size: i64,
+        last_append_at_ns: u64,
+    ) -> Result<(Vec<u8>, i64), TailRepairError> {
+        let mut entries = Vec::new();
+        let mut last_append_at_ns = last_append_at_ns;
+        let mut at = start;
+        while at < file_size {
+            if file_size - at < NEEDLE_HEADER_SIZE as i64 {
+                return Ok((entries, at)); // a partial header
+            }
+            let mut header = [0u8; NEEDLE_HEADER_SIZE];
+            self.read_exact_at_backend(io, &mut header, at as u64)
+                .map_err(|e| {
+                    TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                        io::ErrorKind::InvalidData,
+                        format!("read needle header at {at}: {e}"),
+                    )))
+                })?;
+            let (_, id, size) = Needle::parse_header(&header);
+            if id.is_empty() || size.0 < 0 {
+                return Err(TailRepairError::NotTorn(format!(
+                    "record at {at} has id {id:?} size {}",
+                    size.0
+                )));
+            }
+            let end = at + get_actual_size(size, version);
+            if end > file_size {
+                return Ok((entries, at)); // the last record runs past the end of the file
+            }
+            let n = match self.read_tail_needle(io, at, size, version) {
+                Ok(n) => n,
+                Err(e @ TailRepairError::Corrupt(_)) => {
+                    if end == file_size {
+                        return Ok((entries, at)); // the last record is damaged: it never completed
+                    }
+                    return Err(TailRepairError::NotTorn(format!(
+                        "record {id:?} at {at} is damaged and {} bytes follow it: {e}",
+                        file_size - end
+                    )));
+                }
+                Err(e) => return Err(e), // a read error says nothing about the bytes: leave them
+            };
+            if n.append_at_ns <= last_append_at_ns {
+                return Err(TailRepairError::NotTorn(format!(
+                    "record {:?} at {at} was appended at {}, not after {last_append_at_ns}",
+                    n.id, n.append_at_ns
+                )));
+            }
+            last_append_at_ns = n.append_at_ns;
+            // A size 0 record is a delete or an empty write; the two append
+            // the identical record, so it is indexed at size 0 the way the
+            // write path indexes an empty write.
+            let mut entry = [0u8; NEEDLE_MAP_ENTRY_SIZE];
+            idx_entry_to_bytes(&mut entry, n.id, Offset::from_actual_offset(at), size);
+            entries.extend_from_slice(&entry);
+            at = end;
+        }
+        Ok((entries, file_size))
+    }
+
+    /// Write entries at the end (at) of the .idx and sync it. A failed write
+    /// can leave part of the entries behind, which would make the next load
+    /// reject the .idx as a partial entry; they are removed again. Mirrors
+    /// Go's appendIndexEntries.
+    fn append_index_entries(
+        idx_file: &mut File,
+        entries: &[u8],
+        at: i64,
+    ) -> Result<(), TailRepairError> {
+        let write = (|| -> io::Result<()> {
+            idx_file.seek(SeekFrom::Start(at as u64))?;
+            idx_file.write_all(entries)
+        })();
+        if let Err(e) = write {
+            return Err(match idx_file.set_len(at as u64) {
+                Ok(()) => TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                    e.kind(),
+                    format!("append {} bytes to index: {e}", entries.len()),
+                ))),
+                Err(te) => TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                    e.kind(),
+                    format!(
+                        "append {} bytes to index: {e}; truncate back to {at}: {te}",
+                        entries.len()
+                    ),
+                ))),
+            });
+        }
+        idx_file.sync_all().map_err(|e| {
+            TailRepairError::Failed(VolumeError::Io(io::Error::new(
+                e.kind(),
+                format!("sync index: {e}"),
+            )))
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::storage::needle_map::NeedleMapKind;
+    use std::collections::HashMap;
+    use crate::storage::volume::VolumeSpec;
+    use tempfile::TempDir;
+
+    // A torn tail is what a crash between the two appends of a write leaves:
+    // the needle is in the .dat, its entry never reached the .idx. These
+    // tests write needles (and deletes) normally, drop the last .idx
+    // entries, cut or damage the .dat as a crash would, and reload the
+    // volume through the real load path — the same fixture Go's
+    // volume_checking_tail_repair_test.go builds.
+
+    enum Op {
+        Write(u64),
+        Del(u64),
+        Empty(u64), // a write with no data appends a size 0 record like a delete
+    }
+
+    struct TornFixture {
+        _tmp: TempDir,
+        dir: String,
+        starts: Vec<i64>, // .dat offset of each op's record
+        end: i64,         // .dat size after every op
+        written: HashMap<u64, Vec<u8>>,
+    }
+
+    impl TornFixture {
+        fn dat_path(&self) -> String {
+            format!("{}/1.dat", self.dir)
+        }
+        fn idx_path(&self) -> String {
+            format!("{}/1.idx", self.dir)
+        }
+        fn dat_size(&self) -> i64 {
+            fs::metadata(self.dat_path()).unwrap().len() as i64
+        }
+        fn idx_size(&self) -> i64 {
+            fs::metadata(self.idx_path()).unwrap().len() as i64
+        }
+        /// An offset inside the body of op i's record: past its header,
+        /// short of its end.
+        fn mid_record(&self, i: usize) -> i64 {
+            let end = if i + 1 < self.starts.len() {
+                self.starts[i + 1]
+            } else {
+                self.end
+            };
+            self.starts[i]
+                + NEEDLE_HEADER_SIZE as i64
+                + (end - self.starts[i] - NEEDLE_HEADER_SIZE as i64) / 2
+        }
+        fn truncate_dat(&self, size: i64) {
+            OpenOptions::new()
+                .write(true)
+                .open(self.dat_path())
+                .unwrap()
+                .set_len(size as u64)
+                .unwrap();
+        }
+        /// Damage the data of the record at the given offset so its CRC no
+        /// longer matches.
+        fn flip_data_byte(&self, at: i64) {
+            // Positional writes without Unix-only FileExt so the helper also
+            // builds on Windows; single-threaded, no reader can move the
+            // offset between seek and write.
+            let mut file = OpenOptions::new()
+                .read(true)
+                .write(true)
+                .open(self.dat_path())
+                .unwrap();
+            let pos = (at + NEEDLE_HEADER_SIZE as i64 + 4) as u64; // past the 4-byte DataSize field
+            let mut b = [0u8; 1];
+            file.seek(SeekFrom::Start(pos)).unwrap();
+            file.read_exact(&mut b).unwrap();
+            b[0] ^= 0xff;
+            file.seek(SeekFrom::Start(pos)).unwrap();
+            file.write_all(&b).unwrap();
+        }
+        /// Zero the DataSize field and the first data byte (read as the
+        /// flags once DataSize is 0): the header still claims a body, the
+        /// body parses as an empty needle.
+        fn zero_data_size(&self, at: i64) {
+            let mut file = OpenOptions::new()
+                .write(true)
+                .open(self.dat_path())
+                .unwrap();
+            file.seek(SeekFrom::Start(at as u64 + NEEDLE_HEADER_SIZE as u64))
+                .unwrap();
+            file.write_all(&[0u8; 5]).unwrap();
+        }
+    }
+
+    fn open_volume(dir: &str) -> Volume {
+        Volume::new(
+            dir,
+            dir,
+            VolumeId(1),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap()
+    }
+
+    fn new_needle(id: u64) -> Needle {
+        let data = format!("needle-{id}-payload").into_bytes();
+        Needle {
+            id: NeedleId(id),
+            cookie: Cookie(0x1234_0000 + id as u32),
+            data,
+            ..Needle::default()
+        }
+    }
+
+    /// Run ops against a fresh volume (each op appends one .dat record and
+    /// one .idx entry), drop it, and remove the last `unindexed` entries.
+    fn build_fixture(ops: &[Op], unindexed: usize) -> TornFixture {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let mut f = TornFixture {
+            _tmp: tmp,
+            dir,
+            starts: Vec::new(),
+            end: 0,
+            written: HashMap::new(),
+        };
+        {
+            let v = open_volume(&f.dir);
+            for op in ops {
+                f.starts.push(v.current_dat_file_size().unwrap() as i64);
+                match op {
+                    Op::Write(id) => {
+                        let mut n = new_needle(*id);
+                        v.write_needle(&mut n, true, false).unwrap();
+                        f.written.insert(*id, n.data.clone());
+                    }
+                    Op::Del(id) => {
+                        v.delete_needle(&mut Needle {
+                            id: NeedleId(*id),
+                            ..Needle::default()
+                        })
+                        .unwrap();
+                    }
+                    Op::Empty(id) => {
+                        let mut n = Needle {
+                            id: NeedleId(*id),
+                            cookie: Cookie(0x1234_0000 + *id as u32),
+                            ..Needle::default()
+                        };
+                        v.write_needle(&mut n, true, false).unwrap();
+                        f.written.insert(*id, n.data.clone());
+                    }
+                }
+            }
+            f.end = v.current_dat_file_size().unwrap() as i64;
+        }
+        if unindexed > 0 {
+            let idx_file = OpenOptions::new().write(true).open(f.idx_path()).unwrap();
+            let idx_size = idx_file.metadata().unwrap().len();
+            idx_file
+                .set_len(idx_size - unindexed as u64 * NEEDLE_MAP_ENTRY_SIZE as u64)
+                .unwrap();
+        }
+        f
+    }
+
+    fn assert_readable(v: &Volume, id: u64, want: &[u8]) {
+        let mut n = Needle {
+            id: NeedleId(id),
+            ..Needle::default()
+        };
+        v.read_needle(&mut n).unwrap();
+        assert_eq!(n.data, want, "needle {id} reads back different data");
+    }
+
+    fn assert_not_readable(v: &Volume, id: u64) {
+        let mut n = Needle {
+            id: NeedleId(id),
+            ..Needle::default()
+        };
+        assert!(
+            v.read_needle(&mut n).is_err(),
+            "needle {id} reads back; it should be deleted or absent"
+        );
+    }
+
+    /// A recovered size 0 record indexes as a live empty needle: a delete
+    /// and a write with no data append the identical record, so the repair
+    /// cannot tell them apart and indexes the entry the write path would
+    /// have written.
+    fn assert_empty(v: &Volume, id: u64) {
+        let mut n = Needle {
+            id: NeedleId(id),
+            ..Needle::default()
+        };
+        v.read_needle(&mut n)
+            .unwrap_or_else(|e| panic!("read needle {id}: {e}"));
+        assert!(
+            n.data.is_empty(),
+            "needle {id} reads back {} bytes, want an empty needle",
+            n.data.len()
+        );
+    }
+
+    fn writes(ids: &[u64]) -> Vec<Op> {
+        ids.iter().map(|id| Op::Write(*id)).collect()
+    }
+
+    struct RepairCase {
+        name: &'static str,
+        ops: Vec<Op>,
+        unindexed: usize,
+        damage: Option<fn(&TornFixture)>,
+        want_dat_size: fn(&TornFixture) -> i64,
+        reindexed: usize,
+        readable: &'static [u64],
+        empty: &'static [u64], // readable as an empty live needle
+        absent: &'static [u64],
+    }
+
+    struct ReadOnlyCase {
+        name: &'static str,
+        ops: Vec<Op>,
+        unindexed: usize,
+        damage: fn(&TornFixture),
+    }
+
+    #[test]
+    fn volume_load_repairs_unindexed_dat_tail() {
+        let cases = vec![
+            RepairCase {
+                name: "one complete unindexed needle is re-indexed",
+                ops: writes(&[1, 2, 3, 4]),
+                unindexed: 1,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 1,
+                readable: &[1, 2, 3, 4],
+                empty: &[],
+                absent: &[],
+            },
+            RepairCase {
+                name: "two complete unindexed needles are re-indexed",
+                ops: writes(&[1, 2, 3, 4, 5]),
+                unindexed: 2,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 2,
+                readable: &[1, 2, 3, 4, 5],
+                empty: &[],
+                absent: &[],
+            },
+            RepairCase {
+                name: "an unindexed delete is re-indexed as an empty live needle",
+                ops: {
+                    let mut ops = writes(&[1, 2, 3]);
+                    ops.push(Op::Del(2));
+                    ops
+                },
+                unindexed: 1,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 1,
+                readable: &[1, 3],
+                empty: &[2],
+                absent: &[],
+            },
+            RepairCase {
+                name: "an unindexed empty write of a live id stays an empty needle",
+                ops: {
+                    let mut ops = writes(&[1, 2, 3]);
+                    ops.push(Op::Empty(2));
+                    ops
+                },
+                unindexed: 1,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 1,
+                readable: &[1, 3],
+                empty: &[2],
+                absent: &[],
+            },
+            RepairCase {
+                name: "a partial header is cut",
+                ops: writes(&[1, 2, 3, 4]),
+                unindexed: 1,
+                damage: Some(|f| f.truncate_dat(f.starts[3] + 7)),
+                want_dat_size: |f| f.starts[3],
+                reindexed: 0,
+                readable: &[1, 2, 3],
+                empty: &[],
+                absent: &[4],
+            },
+            RepairCase {
+                name: "a partial body is cut",
+                ops: writes(&[1, 2, 3, 4]),
+                unindexed: 1,
+                damage: Some(|f| f.truncate_dat(f.mid_record(3))),
+                want_dat_size: |f| f.starts[3],
+                reindexed: 0,
+                readable: &[1, 2, 3],
+                empty: &[],
+                absent: &[4],
+            },
+            RepairCase {
+                name: "a complete needle is re-indexed and the partial one after it cut",
+                ops: writes(&[1, 2, 3, 4, 5]),
+                unindexed: 2,
+                damage: Some(|f| f.truncate_dat(f.mid_record(4))),
+                want_dat_size: |f| f.starts[4],
+                reindexed: 1,
+                readable: &[1, 2, 3, 4],
+                empty: &[],
+                absent: &[5],
+            },
+            RepairCase {
+                name: "a last needle with a bad CRC is cut",
+                ops: writes(&[1, 2, 3, 4]),
+                unindexed: 1,
+                damage: Some(|f| f.flip_data_byte(f.starts[3])),
+                want_dat_size: |f| f.starts[3],
+                reindexed: 0,
+                readable: &[1, 2, 3],
+                empty: &[],
+                absent: &[4],
+            },
+            RepairCase {
+                name: "a last needle whose data size field reads 0 is cut",
+                ops: writes(&[1, 2, 3, 4]),
+                unindexed: 1,
+                damage: Some(|f| f.zero_data_size(f.starts[3])),
+                want_dat_size: |f| f.starts[3],
+                reindexed: 0,
+                readable: &[1, 2, 3],
+                empty: &[],
+                absent: &[4],
+            },
+            RepairCase {
+                name: "an unindexed empty write of a new id stays an empty needle",
+                ops: {
+                    let mut ops = writes(&[1, 2]);
+                    ops.push(Op::Empty(3));
+                    ops
+                },
+                unindexed: 1,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 1,
+                readable: &[1, 2, 3],
+                empty: &[],
+                absent: &[],
+            },
+            RepairCase {
+                name: "an unindexed empty write after a delete of the same id stays an empty needle",
+                ops: {
+                    let mut ops = writes(&[1, 2]);
+                    ops.push(Op::Del(2));
+                    ops.push(Op::Empty(2));
+                    ops
+                },
+                unindexed: 1,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 1,
+                readable: &[1, 2],
+                empty: &[],
+                absent: &[],
+            },
+            RepairCase {
+                name: "an unindexed write and delete of the same id are re-indexed in order",
+                ops: {
+                    let mut ops = writes(&[1, 2, 3]);
+                    ops.push(Op::Del(3));
+                    ops
+                },
+                unindexed: 2,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 2,
+                readable: &[1, 2],
+                empty: &[3],
+                absent: &[],
+            },
+            RepairCase {
+                name: "an unindexed empty write and its delete are re-indexed in order",
+                ops: {
+                    let mut ops = writes(&[1, 2]);
+                    ops.push(Op::Empty(3));
+                    ops.push(Op::Del(3));
+                    ops
+                },
+                unindexed: 2,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 2,
+                readable: &[1, 2],
+                empty: &[3],
+                absent: &[],
+            },
+            RepairCase {
+                name: "a partial needle after an indexed tombstone is cut",
+                ops: {
+                    let mut ops = writes(&[1, 2, 3]);
+                    ops.push(Op::Del(2));
+                    ops.push(Op::Write(4));
+                    ops
+                },
+                unindexed: 1,
+                damage: Some(|f| f.truncate_dat(f.mid_record(4))),
+                want_dat_size: |f| f.starts[4],
+                reindexed: 0,
+                readable: &[1, 3],
+                empty: &[],
+                absent: &[2, 4],
+            },
+        ];
+        for tc in cases {
+            let f = build_fixture(&tc.ops, tc.unindexed);
+            if let Some(damage) = tc.damage {
+                damage(&f);
+            }
+            let idx_before = f.idx_size();
+
+            {
+                let v = open_volume(&f.dir);
+                assert!(
+                    !v.is_read_only(),
+                    "{}: volume with an unindexed .dat tail loaded read-only",
+                    tc.name
+                );
+                assert_eq!(
+                    f.dat_size(),
+                    (tc.want_dat_size)(&f),
+                    "{}: .dat size after load",
+                    tc.name
+                );
+                assert_eq!(
+                    f.idx_size(),
+                    idx_before + tc.reindexed as i64 * NEEDLE_MAP_ENTRY_SIZE as i64,
+                    "{}: .idx size after load ({} entries re-indexed)",
+                    tc.name,
+                    tc.reindexed
+                );
+                for &id in tc.readable {
+                    assert_readable(&v, id, &f.written[&id]);
+                }
+                for &id in tc.empty {
+                    assert_empty(&v, id);
+                }
+                for &id in tc.absent {
+                    assert_not_readable(&v, id);
+                }
+                let mut extra = new_needle(100);
+                v.write_needle(&mut extra, true, false)
+                    .expect("write after repair");
+                assert_readable(&v, 100, &extra.data);
+            }
+
+            // the repaired volume reloads clean, and keeps what it indexed
+            let v = open_volume(&f.dir);
+            assert!(
+                !v.is_read_only(),
+                "{}: repaired volume loaded read-only on the next load",
+                tc.name
+            );
+            for &id in tc.readable {
+                assert_readable(&v, id, &f.written[&id]);
+            }
+            assert_readable(&v, 100, b"needle-100-payload");
+        }
+    }
+
+    /// An empty index can hide writes a crash stranded in the .dat: the
+    /// writable index loader creates the .idx before the first needle
+    /// append, so a crash after that append leaves a volume whose data
+    /// nothing indexes. The same repair runs from the first record past
+    /// the superblock.
+    #[test]
+    fn volume_load_repairs_tail_past_empty_index() {
+        let cases = vec![
+            RepairCase {
+                name: "the only write is re-indexed",
+                ops: writes(&[7]),
+                unindexed: 1,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 1,
+                readable: &[7],
+                empty: &[],
+                absent: &[],
+            },
+            RepairCase {
+                name: "every write is re-indexed",
+                ops: writes(&[1, 2, 3]),
+                unindexed: 3,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 3,
+                readable: &[1, 2, 3],
+                empty: &[],
+                absent: &[],
+            },
+            RepairCase {
+                name: "an unindexed delete is re-indexed as an empty live needle",
+                ops: {
+                    let mut ops = writes(&[1, 2, 3]);
+                    ops.push(Op::Del(2));
+                    ops
+                },
+                unindexed: 4,
+                damage: None,
+                want_dat_size: |f| f.end,
+                reindexed: 4,
+                readable: &[1, 3],
+                empty: &[2],
+                absent: &[],
+            },
+            RepairCase {
+                name: "a complete needle is re-indexed and the partial one after it cut",
+                ops: writes(&[1, 2]),
+                unindexed: 2,
+                damage: Some(|f| f.truncate_dat(f.mid_record(1))),
+                want_dat_size: |f| f.starts[1],
+                reindexed: 1,
+                readable: &[1],
+                empty: &[],
+                absent: &[2],
+            },
+            RepairCase {
+                name: "a last needle with a bad CRC is cut",
+                ops: writes(&[1, 2]),
+                unindexed: 2,
+                damage: Some(|f| f.flip_data_byte(f.starts[1])),
+                want_dat_size: |f| f.starts[1],
+                reindexed: 1,
+                readable: &[1],
+                empty: &[],
+                absent: &[2],
+            },
+        ];
+        for tc in cases {
+            let f = build_fixture(&tc.ops, tc.unindexed);
+            if let Some(damage) = tc.damage {
+                damage(&f);
+            }
+
+            {
+                let v = open_volume(&f.dir);
+                assert!(
+                    !v.is_read_only(),
+                    "{}: volume with an unindexed .dat tail loaded read-only",
+                    tc.name
+                );
+                assert_eq!(
+                    f.dat_size(),
+                    (tc.want_dat_size)(&f),
+                    "{}: .dat size after load",
+                    tc.name
+                );
+                assert_eq!(
+                    f.idx_size(),
+                    tc.reindexed as i64 * NEEDLE_MAP_ENTRY_SIZE as i64,
+                    "{}: .idx size after load ({} entries re-indexed)",
+                    tc.name,
+                    tc.reindexed
+                );
+                for &id in tc.readable {
+                    assert_readable(&v, id, &f.written[&id]);
+                }
+                for &id in tc.empty {
+                    assert_empty(&v, id);
+                }
+                for &id in tc.absent {
+                    assert_not_readable(&v, id);
+                }
+            }
+
+            // the repaired volume reloads clean, and keeps what it indexed
+            let v = open_volume(&f.dir);
+            assert!(
+                !v.is_read_only(),
+                "{}: repaired volume loaded read-only on the next load",
+                tc.name
+            );
+            for &id in tc.readable {
+                assert_readable(&v, id, &f.written[&id]);
+            }
+            for &id in tc.empty {
+                assert_empty(&v, id);
+            }
+        }
+    }
+
+    /// A .dat an interrupted append does not explain, over an index with no
+    /// rows at all, loads the volume read-only: the checks that would
+    /// quarantine it otherwise all skip an empty index.
+    #[test]
+    fn volume_load_keeps_unexplained_tail_past_empty_index_read_only() {
+        let cases = vec![
+            ReadOnlyCase {
+                name: "zero bytes where the next record would be (id 0)",
+                ops: writes(&[1, 2]),
+                unindexed: 2,
+                damage: |f| {
+                    let mut file = OpenOptions::new().append(true).open(f.dat_path()).unwrap();
+                    file.write_all(&[0u8; 64]).unwrap();
+                },
+            },
+            ReadOnlyCase {
+                name: "a damaged record more data follows",
+                ops: writes(&[1, 2]),
+                unindexed: 2,
+                damage: |f| f.flip_data_byte(f.starts[0]),
+            },
+        ];
+        for tc in cases {
+            let f = build_fixture(&tc.ops, tc.unindexed);
+            (tc.damage)(&f);
+            let (dat_before, idx_before) = (f.dat_size(), f.idx_size());
+            assert_eq!(idx_before, 0, "fixture did not leave an empty .idx");
+
+            let v = open_volume(&f.dir);
+            assert!(
+                v.is_read_only(),
+                "{}: volume with an unexplained tail past an empty index loaded writable",
+                tc.name
+            );
+            assert_eq!(
+                f.dat_size(),
+                dat_before,
+                "{}: .dat changed on load",
+                tc.name
+            );
+            assert_eq!(
+                f.idx_size(),
+                idx_before,
+                "{}: .idx changed on load",
+                tc.name
+            );
+        }
+    }
+
+    /// Every tail an interrupted append does not explain is left exactly as
+    /// it is, and the volume loads read-only as before.
+    #[test]
+    fn volume_load_keeps_unexplained_tail_read_only() {
+        let cases = vec![
+            ReadOnlyCase {
+                name: "the last indexed needle's id differs from its entry",
+                ops: writes(&[1, 2, 3, 4]),
+                unindexed: 1,
+                damage: |f| {
+                    let mut file = OpenOptions::new().write(true).open(f.dat_path()).unwrap();
+                    file.seek(SeekFrom::Start(
+                        (f.starts[2] + COOKIE_SIZE as i64 + NEEDLE_ID_SIZE as i64 - 1) as u64,
+                    ))
+                    .unwrap();
+                    file.write_all(&[0xff]).unwrap();
+                },
+            },
+            ReadOnlyCase {
+                name: "the last indexed needle fails its CRC",
+                ops: writes(&[1, 2, 3, 4]),
+                unindexed: 1,
+                damage: |f| f.flip_data_byte(f.starts[2]),
+            },
+            ReadOnlyCase {
+                name: "a zeroed data size field followed by more data",
+                ops: writes(&[1, 2, 3, 4, 5]),
+                unindexed: 2,
+                damage: |f| f.zero_data_size(f.starts[3]),
+            },
+            ReadOnlyCase {
+                name: "a bad CRC followed by more data",
+                ops: writes(&[1, 2, 3, 4, 5]),
+                unindexed: 2,
+                damage: |f| f.flip_data_byte(f.starts[3]),
+            },
+            ReadOnlyCase {
+                name: "zero bytes past the last needle (id 0)",
+                ops: writes(&[1, 2, 3]),
+                unindexed: 0,
+                damage: |f| {
+                    let mut file = OpenOptions::new().append(true).open(f.dat_path()).unwrap();
+                    file.write_all(&[0u8; 64]).unwrap();
+                },
+            },
+            ReadOnlyCase {
+                name: "the index ends past the data",
+                ops: writes(&[1, 2, 3]),
+                unindexed: 0,
+                damage: |f| f.truncate_dat(f.end - 10),
+            },
+        ];
+        for tc in cases {
+            let f = build_fixture(&tc.ops, tc.unindexed);
+            (tc.damage)(&f);
+            let (dat_before, idx_before) = (f.dat_size(), f.idx_size());
+
+            let v = open_volume(&f.dir);
+            assert!(
+                v.is_read_only(),
+                "{}: volume with an unexplained tail loaded writable",
+                tc.name
+            );
+            assert_eq!(
+                f.dat_size(),
+                dat_before,
+                "{}: .dat changed on load",
+                tc.name
+            );
+            assert_eq!(
+                f.idx_size(),
+                idx_before,
+                "{}: .idx changed on load",
+                tc.name
+            );
+        }
+    }
+
+    #[test]
+    fn volume_load_leaves_clean_volume_untouched() {
+        let f = build_fixture(
+            &{
+                let mut ops = writes(&[1, 2, 3]);
+                ops.push(Op::Del(2));
+                ops
+            },
+            0,
+        );
+        let (dat_before, idx_before) = (f.dat_size(), f.idx_size());
+
+        let v = open_volume(&f.dir);
+        assert!(!v.is_read_only(), "clean volume loaded read-only");
+        assert_eq!(f.dat_size(), dat_before, "clean .dat changed");
+        assert_eq!(f.idx_size(), idx_before, "clean .idx changed");
+        assert_readable(&v, 1, &f.written[&1]);
+        assert_readable(&v, 3, &f.written[&3]);
+        assert_not_readable(&v, 2);
+    }
+
+    /// A volume persisted read-only is not repaired: the tail stays for
+    /// whoever marked it.
+    #[test]
+    fn volume_load_leaves_read_only_volume_tail_alone() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        {
+            let v = open_volume(&dir);
+            for id in [1u64, 2, 99] {
+                let mut n = new_needle(id);
+                v.write_needle(&mut n, true, false).unwrap();
+            }
+            v.set_read_only_persist(false, true).unwrap();
+        }
+        let idx_path = format!("{dir}/1.idx");
+        let idx_len = fs::metadata(&idx_path).unwrap().len();
+        OpenOptions::new()
+            .write(true)
+            .open(&idx_path)
+            .unwrap()
+            .set_len(idx_len - NEEDLE_MAP_ENTRY_SIZE as u64)
+            .unwrap();
+        let dat_path = format!("{dir}/1.dat");
+        let (dat_before, idx_before) = (
+            fs::metadata(&dat_path).unwrap().len(),
+            fs::metadata(&idx_path).unwrap().len(),
+        );
+
+        let v = open_volume(&dir);
+        assert!(
+            v.is_read_only(),
+            "volume persisted read-only loaded writable"
+        );
+        assert_eq!(fs::metadata(&dat_path).unwrap().len(), dat_before);
+        assert_eq!(fs::metadata(&idx_path).unwrap().len(), idx_before);
+    }
+
+    /// A canDelete volume still appends a tombstone record on every delete,
+    /// so it can tear a tail the same way: it is repaired and keeps taking
+    /// deletes. Mirrors Go's TestVolumeLoadRepairsTailOnCanDeleteVolume.
+    #[test]
+    fn volume_load_repairs_tail_on_can_delete_volume() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().to_str().unwrap().to_string();
+        let mut last_data = Vec::new();
+        {
+            let v = open_volume(&dir);
+            for id in [1u64, 2, 99] {
+                let mut n = new_needle(id);
+                v.write_needle(&mut n, true, false).unwrap();
+                last_data = n.data.clone();
+            }
+            v.set_read_only_persist(true, true).unwrap();
+        }
+        let idx_path = format!("{dir}/1.idx");
+        let idx_len = fs::metadata(&idx_path).unwrap().len();
+        OpenOptions::new()
+            .write(true)
+            .open(&idx_path)
+            .unwrap()
+            .set_len(idx_len - NEEDLE_MAP_ENTRY_SIZE as u64)
+            .unwrap();
+
+        let v = open_volume(&dir);
+        assert!(
+            !v.is_no_write_or_delete() && v.is_no_write_can_delete(),
+            "canDelete volume with a torn tail did not load canDelete after the repair"
+        );
+        assert_readable(&v, 99, &last_data);
+    }
+
+    /// A torn record whose header advertises a positive size smaller than
+    /// the body's own 4-byte data-size field is damaged, not decodable: the
+    /// decoder's range check rejects it, and as the last record it is cut.
+    /// Mirrors Go's TestVolumeLoadCutsDamagedSmallSizeTailOnCanDeleteVolume.
+    #[test]
+    fn volume_load_cuts_damaged_small_size_tail() {
+        let f = build_fixture(&writes(&[1, 2, 3]), 1);
+        let mut record = vec![0u8; get_actual_size(Size(2), VERSION_3) as usize];
+        Cookie(0xabcd).to_bytes(&mut record[0..COOKIE_SIZE]);
+        NeedleId(7).to_bytes(&mut record[COOKIE_SIZE..COOKIE_SIZE + NEEDLE_ID_SIZE]);
+        Size(2).to_bytes(
+            &mut record[COOKIE_SIZE + NEEDLE_ID_SIZE..NEEDLE_HEADER_SIZE],
+        );
+        OpenOptions::new()
+            .append(true)
+            .open(f.dat_path())
+            .unwrap()
+            .write_all(&record)
+            .unwrap();
+
+        let v = open_volume(&f.dir);
+        assert!(
+            !v.is_read_only(),
+            "damaged tail record loaded the volume read-only"
+        );
+        assert_not_readable(&v, 7);
+        assert_eq!(
+            f.dat_size(),
+            f.end,
+            "damaged tail was not cut"
+        );
+    }
+}
diff --git a/seaweed-volume/src/version.rs b/seaweed-volume/src/version.rs
index 413a526b11..39d6ee4072 100644
--- a/seaweed-volume/src/version.rs
+++ b/seaweed-volume/src/version.rs
@@ -66,7 +66,7 @@ fn parse_go_version_number() -> Option<String> {
         }
     }
     match (major, minor) {
-        (Some(maj), Some(min)) => Some(format!("{}.{}", maj, format!("{:02}", min))),
+        (Some(maj), Some(min)) => Some(format!("{}.{:02}", maj, min)),
         _ => None,
     }
 }
diff --git a/seaweed-volume/tests/admin_auth_coverage.rs b/seaweed-volume/tests/admin_auth_coverage.rs
new file mode 100644
index 0000000000..612b8c72f3
--- /dev/null
+++ b/seaweed-volume/tests/admin_auth_coverage.rs
@@ -0,0 +1,182 @@
+//! Parity guard for the gRPC admin-auth gate.
+//!
+//! Every `VolumeServer` handler must either call `check_grpc_admin_auth` or be
+//! listed here as intentionally ungated, with the reason it stays open. Mirrors
+//! the Go side's `TestVolumeServerAdminAuthCoverage`
+//! (`weed/server/volume_grpc_admin_auth_coverage_test.go`). The gate had
+//! silently dropped off 15 handlers on the Rust side; this keeps the two
+//! implementations from drifting apart again.
+
+use std::collections::{HashMap, HashSet};
+
+/// Handlers that intentionally run without `check_grpc_admin_auth`, each with
+/// the reason. Kept in sync with `ungatedVolumeServerRPCs` on the Go side.
+///
+/// The split is by caller, not by how destructive the call is: the guard checks
+/// the peer IP against `-whiteList`, which holds masters, shell hosts and
+/// workers -- not every peer volume server. Gating a volume-server ->
+/// volume-server call therefore breaks replication, EC and tiering, so those
+/// calls stay open and need a cluster-peer identity before they can be closed.
+fn ungated_handlers() -> HashMap<&'static str, &'static str> {
+    [
+        // Cluster-internal: issued volume server -> volume server.
+        (
+            "copy_file",
+            "replica sync and EC task pull whole files from a peer",
+        ),
+        (
+            "read_needle_blob",
+            "replica sync, vacuum and EC rebuild read needles from a peer",
+        ),
+        (
+            "read_needle_meta",
+            "replica sync compares needle metadata across peers",
+        ),
+        ("write_needle_blob", "replica sync repairs a peer's needle"),
+        (
+            "receive_file",
+            "EC shard distribution pushes shards to a peer",
+        ),
+        (
+            "read_volume_file_status",
+            "the copy path queries the source volume server",
+        ),
+        (
+            "volume_ec_shard_read",
+            "a volume server reads EC shards held by a peer",
+        ),
+        (
+            "volume_ec_blob_delete",
+            "EC delete is fanned out to the shard holders",
+        ),
+        (
+            "volume_ec_shards_info",
+            "EC verification polls shard holders",
+        ),
+        (
+            "volume_ec_shards_mount",
+            "EC shard distribution mounts on the receiving peer",
+        ),
+        (
+            "volume_incremental_copy",
+            "volume backup pulls increments from a peer",
+        ),
+        (
+            "volume_sync_status",
+            "sync compares volume state across peers",
+        ),
+        (
+            "volume_tail_sender",
+            "the tail source streams to the receiving peer",
+        ),
+        (
+            "volume_status",
+            "replica sync and the master's vacuum loop poll volume status",
+        ),
+        // Read-only or liveness: no state change.
+        ("ping", "liveness probe"),
+        ("get_state", "read-only volume server state"),
+        ("query", "read-only data query"),
+        (
+            "vacuum_volume_check",
+            "read-only garbage ratio; the vacuum steps that act on it are gated",
+        ),
+        (
+            "volume_server_status",
+            "read-only status, the gRPC counterpart of the /status page",
+        ),
+    ]
+    .into_iter()
+    .collect()
+}
+
+/// Whether a handler body actually invokes the gate. We can't run a real AST
+/// pass like the Go side without pulling in a parser, so approximate it: drop
+/// `//` line comments (the realistic way a stray mention would sneak in) and
+/// look for the call form `check_grpc_admin_auth(`, not the bare identifier, so
+/// a comment or doc reference can't make an ungated handler pass.
+fn calls_gate(body: &str) -> bool {
+    body.lines()
+        .map(|line| line.split_once("//").map_or(line, |(code, _)| code))
+        .any(|code| code.contains("check_grpc_admin_auth("))
+}
+
+/// Enumerate the `VolumeServer` trait handlers and whether each gates on
+/// `check_grpc_admin_auth`, by scanning the source of the trait impl block.
+fn handler_gating(src: &str) -> Vec<(String, bool)> {
+    let impl_start = src
+        .find("impl VolumeServer for VolumeGrpcService {")
+        .expect("locate the VolumeServer trait impl");
+    let after = &src[impl_start..];
+    // rustfmt keeps every method body indented, so the impl's own closing brace
+    // is the first line that begins at column 0.
+    let impl_end = after
+        .match_indices("\n}")
+        .next()
+        .map(|(i, _)| i + 1)
+        .expect("locate the end of the trait impl");
+    let block = &after[..impl_end];
+
+    let marker = "\n    async fn ";
+    let starts: Vec<usize> = block.match_indices(marker).map(|(i, _)| i).collect();
+    let mut handlers = Vec::with_capacity(starts.len());
+    for (i, &start) in starts.iter().enumerate() {
+        let name_start = start + marker.len();
+        let name_end = name_start
+            + block[name_start..]
+                .find('(')
+                .expect("handler signature has an argument list");
+        let name = block[name_start..name_end].to_string();
+        let body_end = starts.get(i + 1).copied().unwrap_or(block.len());
+        let gated = calls_gate(&block[start..body_end]);
+        handlers.push((name, gated));
+    }
+    handlers
+}
+
+#[test]
+fn volume_server_admin_auth_coverage() {
+    let src = std::fs::read_to_string(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/src/server/grpc_server.rs"
+    ))
+    .expect("read grpc_server.rs");
+
+    let handlers = handler_gating(&src);
+    assert!(
+        handlers.len() >= 40,
+        "parsed only {} handlers from the trait impl, expected the full service",
+        handlers.len()
+    );
+
+    let ungated = ungated_handlers();
+    let mut problems = Vec::new();
+    for (name, gated) in &handlers {
+        match (gated, ungated.contains_key(name.as_str())) {
+            (true, true) => problems.push(format!(
+                "{name} calls check_grpc_admin_auth but is also listed as intentionally ungated; drop it from ungated_handlers"
+            )),
+            (false, false) => problems.push(format!(
+                "{name} does not call check_grpc_admin_auth and is not listed as intentionally ungated; gate it, or add it with the reason it must stay open"
+            )),
+            _ => {}
+        }
+    }
+
+    // Keep the exemption list honest: an entry for a handler that no longer
+    // exists hides the fact that nothing is being exempted.
+    let names: HashSet<&str> = handlers.iter().map(|(n, _)| n.as_str()).collect();
+    for name in ungated.keys() {
+        if !names.contains(name) {
+            problems.push(format!(
+                "ungated_handlers lists \"{name}\", which is not a VolumeServer handler"
+            ));
+        }
+    }
+
+    assert!(
+        problems.is_empty(),
+        "admin-auth coverage gaps:\n{}",
+        problems.join("\n")
+    );
+}
diff --git a/seaweed-volume/tests/http_integration.rs b/seaweed-volume/tests/http_integration.rs
index 521c25d2bd..b90234a5ad 100644
--- a/seaweed-volume/tests/http_integration.rs
+++ b/seaweed-volume/tests/http_integration.rs
@@ -12,12 +12,13 @@ use tower::ServiceExt; // for `oneshot`
 
 use seaweed_volume::security::{Guard, SigningKey};
 use seaweed_volume::server::volume_server::{
-    build_admin_router, build_admin_router_with_ui, build_metrics_router, build_public_router,
-    VolumeServerState,
+    VolumeServerState, build_admin_router, build_admin_router_with_ui, build_metrics_router,
+    build_public_router,
 };
 use seaweed_volume::storage::needle_map::NeedleMapKind;
 use seaweed_volume::storage::store::Store;
-use seaweed_volume::storage::types::{DiskType, Version, VolumeId};
+use seaweed_volume::storage::types::{DiskType, VolumeId};
+use seaweed_volume::storage::volume::VolumeSpec;
 
 use tempfile::TempDir;
 
@@ -73,12 +74,11 @@ fn build_test_state(
     store
         .add_volume(
             VolumeId(1),
-            "",
-            replica_placement,
-            None,
-            0,
             DiskType::HardDrive,
-            Version::current(),
+            &VolumeSpec {
+                replica_placement,
+                ..Default::default()
+            },
         )
         .expect("failed to create volume");
 
@@ -107,14 +107,16 @@ fn build_test_state(
         rack: String::new(),
         file_size_limit_bytes: 0,
         maintenance_byte_per_second: 0,
+        vacuum_commit_slots: None,
+        vacuum_commits_waiting: std::sync::atomic::AtomicU32::new(0),
         is_heartbeating: std::sync::atomic::AtomicBool::new(true),
+        ec_decodes_in_flight: std::sync::Mutex::new(std::collections::HashSet::new()),
+        ec_decode_tail: std::sync::Mutex::new(std::collections::HashSet::new()),
+        ec_decode_tail_notify: tokio::sync::Notify::new(),
         has_master: false,
         pre_stop_seconds: 0,
         volume_state_notify: tokio::sync::Notify::new(),
         write_queue: std::sync::OnceLock::new(),
-        s3_tier_registry: std::sync::RwLock::new(
-            seaweed_volume::remote_storage::s3_tier::S3TierRegistry::new(),
-        ),
         read_mode: seaweed_volume::config::ReadMode::Local,
         allow_untrusted_remote_endpoints: false,
         master_url,
@@ -385,6 +387,46 @@ async fn write_then_read_needle() {
     assert_eq!(body, payload, "GET body should match written data");
 }
 
+// A durable upload takes the same route through the handler; the flush is not
+// observable from here, but a broken wiring would show up as a failed write.
+#[tokio::test]
+async fn write_with_fsync_then_read_needle() {
+    let (state, _tmp) = test_state();
+
+    let uri = "/1,01637037d6?fsync=true";
+    let payload = b"durable through the handler";
+
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri(uri)
+                .body(Body::from(payload.to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        response.status(),
+        StatusCode::CREATED,
+        "a durable POST should return 201 Created"
+    );
+
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/1,01637037d6")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(body_bytes(response).await, payload);
+}
+
 // ============================================================================
 // 5. DELETE deletes a needle, subsequent GET returns 404
 // ============================================================================
@@ -440,6 +482,74 @@ async fn delete_then_get_returns_404() {
     );
 }
 
+// Go answers both with 500 and an error containing "volume N is read only"
+// (the write behind "failed to write to local disk: ").
+#[tokio::test]
+async fn write_and_delete_on_read_only_volume_say_is_read_only() {
+    let (state, _tmp) = test_state();
+    let uri = "/1,01637037d6";
+
+    let request = |method: &str, body: &[u8]| {
+        Request::builder()
+            .method(method)
+            .uri(uri)
+            .body(Body::from(body.to_vec()))
+            .unwrap()
+    };
+    let error_of = |body: Vec<u8>| -> String {
+        let json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+        json["error"].as_str().unwrap_or_default().to_string()
+    };
+
+    let response = build_admin_router(state.clone())
+        .oneshot(request("POST", b"written before read-only"))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    state
+        .store
+        .write()
+        .unwrap()
+        .find_volume(VolumeId(1))
+        .unwrap()
+        .1
+        .set_no_write_or_delete(true);
+
+    let response = build_admin_router(state.clone())
+        .oneshot(request("POST", b"refused"))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    let error = error_of(body_bytes(response).await);
+    assert!(error.contains("volume 1 is read only"), "{error}");
+
+    let response = build_admin_router(state.clone())
+        .oneshot(request("DELETE", b""))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::INTERNAL_SERVER_ERROR);
+    assert_eq!(
+        error_of(body_bytes(response).await),
+        "Deletion Failed: volume 1 is read only"
+    );
+
+    // The needle is still there to delete once the volume is writable again.
+    state
+        .store
+        .write()
+        .unwrap()
+        .find_volume(VolumeId(1))
+        .unwrap()
+        .1
+        .set_no_write_or_delete(false);
+    let response = build_admin_router(state.clone())
+        .oneshot(request("DELETE", b""))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::ACCEPTED);
+}
+
 // ============================================================================
 // 6. HEAD returns headers without body
 // ============================================================================
@@ -739,6 +849,76 @@ async fn replicate_write_raw_body_is_stored() {
     assert_eq!(body_bytes(response).await, payload);
 }
 
+/// Go reads fsync through r.FormValue, which decodes the query, so a
+/// percent-encoded value has to reach the write path here too.
+#[tokio::test]
+async fn write_with_percent_encoded_fsync_is_accepted() {
+    let (state, _tmp) = test_state();
+    let payload = b"encoded durable payload";
+
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/1,01637037d6?fsync=%74rue")
+                .body(Body::from(payload.to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/1,01637037d6")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(body_bytes(response).await, payload);
+}
+
+/// The fan-out query a Go primary sends for a durable write: `fsync=true` rides
+/// along with `type=replicate`, and the replica has to honor it rather than ack
+/// out of the page cache.
+#[tokio::test]
+async fn replicate_write_with_fsync_is_stored() {
+    let (state, _tmp) = test_state();
+    let uri = "/1,01637037d6?fsync=true&type=replicate";
+    let payload = b"durable replica bytes";
+
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri(uri)
+                .body(Body::from(payload.to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/1,01637037d6")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(body_bytes(response).await, payload);
+}
+
 /// Multipart `type=replicate` write (the shape the Go gateway uploader sends)
 /// is stored and reads back.
 #[tokio::test]
@@ -847,9 +1027,10 @@ async fn replicate_write_does_not_re_replicate() {
 #[tokio::test]
 async fn chunk_manifest_expands_chunk_stored_on_ec_volume() {
     use seaweed_volume::storage::erasure_coding::ec_encoder::write_ec_files;
+    use seaweed_volume::storage::erasure_coding::ec_shard::ShardId;
     use seaweed_volume::storage::needle::needle::{FileId, Needle};
     use seaweed_volume::storage::types::{Cookie, NeedleId};
-    use seaweed_volume::storage::volume::Volume;
+    use seaweed_volume::storage::volume::{Volume, VolumeSpec};
 
     let (state, tmp) = test_state();
     let dir = tmp.path().to_str().unwrap();
@@ -863,16 +1044,12 @@ async fn chunk_manifest_expands_chunk_stored_on_ec_volume() {
     // Build regular volume 2 holding the chunk, then EC-encode it and mount all
     // 14 shards locally so reconstruct-on-read is a pure local read.
     {
-        let mut v = Volume::new(
+        let v = Volume::new(
             dir,
             dir,
-            "",
             VolumeId(2),
             NeedleMapKind::InMemory,
-            None,
-            None,
-            0,
-            Version::current(),
+            &VolumeSpec::default(),
         )
         .unwrap();
         let mut n = Needle {
@@ -882,7 +1059,7 @@ async fn chunk_manifest_expands_chunk_stored_on_ec_volume() {
             data_size: chunk_data.len() as u32,
             ..Needle::default()
         };
-        v.write_needle(&mut n, true).unwrap();
+        v.write_needle(&mut n, true, false).unwrap();
         v.sync_to_disk().unwrap();
         v.close();
     }
@@ -892,7 +1069,7 @@ async fn chunk_manifest_expands_chunk_stored_on_ec_volume() {
     // after ec.encode retired the regular volume.
     {
         let mut store = state.store.write().unwrap();
-        let shard_ids: Vec<u32> = (0..14).collect();
+        let shard_ids: Vec<ShardId> = (0..14).collect();
         store.mount_ec_shards(VolumeId(2), "", &shard_ids).unwrap();
     }
 
@@ -907,7 +1084,7 @@ async fn chunk_manifest_expands_chunk_stored_on_ec_volume() {
     let manifest_nid = NeedleId(0x7);
     let manifest_cookie = Cookie(0x55667788);
     {
-        let mut store = state.store.write().unwrap();
+        let store = state.store.read().unwrap();
         let mut n = Needle {
             id: manifest_nid,
             cookie: manifest_cookie,
@@ -916,7 +1093,9 @@ async fn chunk_manifest_expands_chunk_stored_on_ec_volume() {
         };
         n.data_size = n.data.len() as u32;
         n.set_is_chunk_manifest();
-        store.write_volume_needle(VolumeId(1), &mut n).unwrap();
+        store
+            .write_volume_needle(VolumeId(1), &mut n, false)
+            .unwrap();
     }
 
     // GET the manifest object; expect the reconstructed chunk bytes.
@@ -934,3 +1113,317 @@ async fn chunk_manifest_expands_chunk_stored_on_ec_volume() {
     assert_eq!(response.status(), StatusCode::OK);
     assert_eq!(body_bytes(response).await, chunk_data);
 }
+
+// ============================================================================
+// HTTP DELETE on an EC volume whose shards are not all mounted locally
+//
+// The delete handler used to validate the cookie with the local-only
+// `EcVolume::read_ec_shard_needle`, which errors "ec shard N not available
+// locally" for any interval held by a peer. Every such error was mapped to 500
+// and no `.ecj` tombstone was written, so on a standard 10+4 spread across 14
+// servers no HTTP delete of an EC needle could ever succeed.
+//
+// A single node can exercise that path without peers: mount 13 of the 14
+// shards, leaving out the one holding the needle's interval. The distributed
+// reader seeds its Reed-Solomon buffers from locally mounted siblings (Phase 0
+// in `store_ec.rs`), so with >= 10 survivors it reconstructs without any peer
+// fan-out — while the local-only read still fails outright.
+// ============================================================================
+
+#[tokio::test]
+async fn delete_on_ec_volume_succeeds_when_the_needles_shard_is_not_mounted() {
+    use seaweed_volume::storage::erasure_coding::ec_encoder::write_ec_files;
+    use seaweed_volume::storage::erasure_coding::ec_shard::ShardId;
+    use seaweed_volume::storage::needle::needle::{FileId, Needle};
+    use seaweed_volume::storage::types::{Cookie, NeedleId};
+    use seaweed_volume::storage::volume::{Volume, VolumeSpec};
+
+    let (state, tmp) = test_state();
+    let dir = tmp.path().to_str().unwrap();
+
+    let data: Vec<u8> = (0..4096u32).map(|i| (i % 251) as u8).collect();
+    let nid = NeedleId(0x5c);
+    let cookie = Cookie(0x0badc0de);
+
+    // Build regular volume 4, then EC-encode it. The volume is standalone and
+    // never registered in the store, so afterwards it exists only as shards.
+    {
+        let v = Volume::new(
+            dir,
+            dir,
+            VolumeId(4),
+            NeedleMapKind::InMemory,
+            &VolumeSpec::default(),
+        )
+        .unwrap();
+        let mut n = Needle {
+            id: nid,
+            cookie,
+            data: data.clone(),
+            data_size: data.len() as u32,
+            ..Needle::default()
+        };
+        v.write_needle(&mut n, true, false).unwrap();
+        v.sync_to_disk().unwrap();
+        v.close();
+    }
+    write_ec_files(dir, dir, "", VolumeId(4), 10, 4).unwrap();
+
+    // Mount shards 1..=13 only. A needle at .dat offset 0 lives in shard 0's
+    // first small block, so the interval this delete needs is deliberately the
+    // one shard that is absent.
+    {
+        let mut store = state.store.write().unwrap();
+        let shard_ids: Vec<ShardId> = (1..14).collect();
+        store.mount_ec_shards(VolumeId(4), "", &shard_ids).unwrap();
+    }
+
+    let fid = FileId::new(VolumeId(4), nid, cookie).to_string();
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .method("DELETE")
+                .uri(format!("/{}", fid))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(
+        response.status(),
+        StatusCode::ACCEPTED,
+        "DELETE of an EC needle must reconstruct through the distributed \
+         reader instead of failing 500 on a non-local shard"
+    );
+
+    // The tombstone must actually have landed: a later GET is a 404.
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri(format!("/{}", fid))
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(
+        response.status(),
+        StatusCode::NOT_FOUND,
+        "the delete must have been journalled, not just answered 202"
+    );
+}
+
+// ============================================================================
+// Hostile response-header override params must not panic the handler
+//
+// The `response-*` query params are attacker-controlled and were inserted with
+// `parse().unwrap()`. `%0A` decodes to a newline, `HeaderValue::from_str`
+// rejects it, and the unwrap panicked the connection task — unauthenticated.
+// The override must simply be skipped.
+// ============================================================================
+
+#[tokio::test]
+async fn hostile_response_header_overrides_are_skipped_not_panicked() {
+    let (state, _tmp) = test_state();
+    let uri = "/1,01637037d6";
+
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri(uri)
+                .body(Body::from(b"payload".to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    // One request per override param, each carrying a raw newline.
+    for param in [
+        "response-cache-control",
+        "response-content-encoding",
+        "response-expires",
+        "response-content-language",
+        "response-content-disposition",
+        "response-content-type",
+    ] {
+        let app = build_admin_router(state.clone());
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .uri(format!("{}?{}=%0Aevil", uri, param))
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(
+            response.status(),
+            StatusCode::OK,
+            "{} with a newline must be ignored, not panic",
+            param
+        );
+        assert_eq!(body_bytes(response).await, b"payload".to_vec());
+    }
+}
+
+// ============================================================================
+// Non-ASCII in the fid and in ?ttl= must be rejected, not panic
+//
+// `parse_needle_id_cookie` split the hex by BYTE offset and `TTL::read` took
+// the unit as the last BYTE, so a multi-byte character split inside itself.
+// Both are reachable unauthenticated from the request line / query string.
+// ============================================================================
+
+#[tokio::test]
+async fn non_ascii_fid_and_ttl_are_rejected_not_panicked() {
+    let (state, _tmp) = test_state();
+
+    // A fid whose hex part is multi-byte UTF-8.
+    let app = build_admin_router(state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/1,%C3%A9%C3%A9%C3%A9%C3%A9a")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert!(
+        response.status().is_client_error() || response.status().is_server_error(),
+        "non-ASCII fid must produce an error status, got {}",
+        response.status()
+    );
+
+    // A TTL whose unit character is multi-byte. The upload path does
+    // `TTL::read(..).ok()`, so *any* unparseable TTL is simply dropped and the
+    // write succeeds — the point here is that a non-ASCII one now takes that
+    // same road instead of panicking. Assert it matches an ASCII-invalid TTL
+    // rather than inventing a stricter contract than the handler has.
+    let mut statuses = Vec::new();
+    // Distinct needle ids: reusing one id with a different cookie is a
+    // cookie-mismatch overwrite, which would mask what this test measures.
+    for (fid, ttl) in [("/1,03637037d7", "5%C3%A9"), ("/1,04637037d8", "5z")] {
+        let app = build_admin_router(state.clone());
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri(format!("{}?ttl={}", fid, ttl))
+                    .body(Body::from(b"x".to_vec()))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        statuses.push(response.status());
+    }
+    assert_eq!(
+        statuses[0], statuses[1],
+        "a non-ASCII ttl must behave like any other invalid ttl, not panic"
+    );
+}
+
+// ============================================================================
+// The write queue answers an upload with the needle's real ETag
+//
+// The queue worker computes the CRC on the needle it was handed, so the handler
+// has to know the checksum before it submits. Without that every queued upload
+// came back as "00000000". The direct path is the reference: same payload, same
+// ETag, for a plain body and for one the handler gzips before storing.
+// ============================================================================
+
+#[tokio::test]
+async fn write_queue_upload_returns_same_etag_as_direct_write() {
+    use seaweed_volume::server::write_queue::{SyncBatchOption, WriteQueue};
+
+    let (direct_state, _direct_tmp) = test_state();
+    let (queued_state, _queued_tmp) = test_state();
+    let wq = WriteQueue::new(queued_state.clone(), 128, SyncBatchOption::default());
+    let _ = queued_state.write_queue.set(wq);
+
+    let compressible = "seaweedfs ".repeat(200).into_bytes();
+    let uploads: [(&str, &[u8]); 2] = [
+        ("/1,01637037d6", b"hello, seaweedfs!"),
+        ("/1/02637037d6/notes.txt", &compressible),
+    ];
+
+    for (uri, payload) in uploads {
+        let mut etags = Vec::new();
+        for state in [&direct_state, &queued_state] {
+            let app = build_admin_router(state.clone());
+            let response = app
+                .oneshot(
+                    Request::builder()
+                        .method("POST")
+                        .uri(uri)
+                        .body(Body::from(payload.to_vec()))
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(response.status(), StatusCode::CREATED);
+
+            let header = response
+                .headers()
+                .get("ETag")
+                .expect("upload response has no ETag")
+                .to_str()
+                .unwrap()
+                .to_string();
+            let body = body_bytes(response).await;
+            let json: serde_json::Value =
+                serde_json::from_slice(&body).expect("POST response is not valid JSON");
+            let etag = json["eTag"].as_str().unwrap().to_string();
+            assert_eq!(header, format!("\"{}\"", etag));
+            etags.push(etag);
+        }
+        assert_ne!(etags[0], "00000000", "{}: direct ETag is the zero CRC", uri);
+        assert_eq!(
+            etags[1], etags[0],
+            "{}: queued upload must return the direct path's ETag",
+            uri
+        );
+    }
+
+    // The second upload really was stored gzipped, so its ETag is the CRC of
+    // the compressed bytes on both paths.
+    let app = build_admin_router(queued_state.clone());
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri(uploads[1].0)
+                .header("Accept-Encoding", "gzip")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.headers()["Content-Encoding"], "gzip");
+
+    // Re-uploading the same bytes is the unchanged path: 204 with the same ETag.
+    let (uri, payload) = uploads[0];
+    let mut etags = Vec::new();
+    for state in [&direct_state, &queued_state] {
+        let app = build_admin_router(state.clone());
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri(uri)
+                    .body(Body::from(payload.to_vec()))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(response.status(), StatusCode::NO_CONTENT);
+        etags.push(response.headers()["ETag"].to_str().unwrap().to_string());
+    }
+    assert_eq!(etags[1], etags[0], "unchanged upload ETag differs");
+}
diff --git a/seaweed-volume/tests/store_lock_repro.rs b/seaweed-volume/tests/store_lock_repro.rs
new file mode 100644
index 0000000000..801a696d49
--- /dev/null
+++ b/seaweed-volume/tests/store_lock_repro.rs
@@ -0,0 +1,89 @@
+//! Issue #791: the shared `RwLock<Store>` guards the volume map only.
+//! `find_volume` hands out an `Arc<Volume>` so needle I/O runs without the
+//! guard; a handle that outlives its mount must fail closed rather than I/O
+//! a torn-down volume — the same end Go reaches through nil needle-map/dat
+//! checks under the per-volume dataFileAccessLock.
+
+use std::sync::{Arc, RwLock};
+
+use seaweed_volume::config::MinFreeSpace;
+use seaweed_volume::storage::needle::needle::Needle;
+use seaweed_volume::storage::needle_map::NeedleMapKind;
+use seaweed_volume::storage::store::Store;
+use seaweed_volume::storage::types::{DiskType, NeedleId, VolumeId};
+use seaweed_volume::storage::volume::VolumeSpec;
+
+use tempfile::TempDir;
+
+fn store_with_two_volumes() -> (Arc<RwLock<Store>>, TempDir) {
+    let tmp = TempDir::new().unwrap();
+    let dir = tmp.path().to_str().unwrap();
+    let mut store = Store::new(NeedleMapKind::InMemory);
+    store
+        .add_location(dir, dir, 10, DiskType::HardDrive, MinFreeSpace::Percent(1.0), Vec::new())
+        .unwrap();
+    store
+        .add_volume(VolumeId(1), DiskType::HardDrive, &VolumeSpec::default())
+        .unwrap();
+    store
+        .add_volume(VolumeId(2), DiskType::HardDrive, &VolumeSpec::default())
+        .unwrap();
+    (Arc::new(RwLock::new(store)), tmp)
+}
+
+fn needle(id: u64) -> Needle {
+    Needle {
+        id: NeedleId(id),
+        cookie: 0x1234.into(),
+        data: vec![7u8; 16],
+        data_size: 16,
+        ..Needle::default()
+    }
+}
+
+#[test]
+fn store_read_guard_admits_cross_volume_io() {
+    let (store, _tmp) = store_with_two_volumes();
+
+    // Read-guarded callers can write on different volumes concurrently —
+    // what used to require store.write() now only resolves a handle.
+    let t = {
+        let store = store.clone();
+        std::thread::spawn(move || {
+            let store = store.read().unwrap();
+            store
+                .write_volume_needle(VolumeId(1), &mut needle(1), false)
+                .unwrap();
+        })
+    };
+    {
+        let store = store.read().unwrap();
+        store
+            .write_volume_needle(VolumeId(2), &mut needle(9), false)
+            .unwrap();
+    }
+    t.join().unwrap();
+
+    let store = store.read().unwrap();
+    let mut n = needle(9);
+    n.data.clear();
+    assert_eq!(store.read_volume_needle(VolumeId(2), &mut n).unwrap(), 16);
+    let mut n = needle(1);
+    n.data.clear();
+    assert_eq!(store.read_volume_needle(VolumeId(1), &mut n).unwrap(), 16);
+}
+
+#[test]
+fn stale_volume_handle_fails_after_unmount() {
+    let (store, _tmp) = store_with_two_volumes();
+
+    // A handle resolved before unmount keeps the Volume alive but must not
+    // be able to write into its closed files.
+    let (_, vol1) = store.read().unwrap().find_volume(VolumeId(1)).unwrap();
+    store.write().unwrap().unmount_volume(VolumeId(1)).unwrap();
+
+    assert!(vol1.write_needle(&mut needle(1), true, false).is_err());
+    let mut n = needle(1);
+    n.data.clear();
+    assert!(vol1.read_needle(&mut n).is_err());
+}
diff --git a/seaweed-worker/.gitignore b/seaweed-worker/.gitignore
new file mode 100644
index 0000000000..2f7896d1d1
--- /dev/null
+++ b/seaweed-worker/.gitignore
@@ -0,0 +1 @@
+target/
diff --git a/seaweed-worker/Cargo.lock b/seaweed-worker/Cargo.lock
new file mode 100644
index 0000000000..3dfd02f29b
--- /dev/null
+++ b/seaweed-worker/Cargo.lock
@@ -0,0 +1,6800 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "ahash"
+version = "0.8.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+dependencies = [
+ "cfg-if",
+ "const-random",
+ "getrandom 0.3.4",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "arc-swap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "arrayref"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
+
+[[package]]
+name = "arrow"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cfdd0833e32a9874d2b55089333ad310c0be208aafa277385ce2461dec90be3"
+dependencies = [
+ "arrow-arith",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-csv",
+ "arrow-data",
+ "arrow-ipc",
+ "arrow-json",
+ "arrow-ord",
+ "arrow-row",
+ "arrow-schema",
+ "arrow-select",
+ "arrow-string",
+]
+
+[[package]]
+name = "arrow-arith"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a41203398f0eaa6f7ec8e62c0da742a21abf282c148fc157f6c35c90e29981a"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "chrono",
+ "num-traits",
+]
+
+[[package]]
+name = "arrow-array"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae33dad492b7df00a217563a7b0ef2874df68a0deea1b1a3acf628152f7f7a69"
+dependencies = [
+ "ahash",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "chrono",
+ "chrono-tz",
+ "half",
+ "hashbrown 0.17.1",
+ "num-complex",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "arrow-buffer"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9552f96391c005e6ab449fa941420935e7e062489b12b8b1b08879b2163f5b5"
+dependencies = [
+ "bytes",
+ "half",
+ "num-bigint",
+ "num-traits",
+]
+
+[[package]]
+name = "arrow-cast"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a8a327c9649f30d8406995f27642b68df354713cca3baaaf100f076f18d5f34"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-ord",
+ "arrow-schema",
+ "arrow-select",
+ "atoi",
+ "base64 0.22.1",
+ "chrono",
+ "comfy-table",
+ "half",
+ "lexical-core",
+ "num-traits",
+ "ryu",
+]
+
+[[package]]
+name = "arrow-csv"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af0dd6d90d1955e9f9a014c1e563ee8aeffc21909085d25623e1da44d96eca26"
+dependencies = [
+ "arrow-array",
+ "arrow-cast",
+ "arrow-schema",
+ "chrono",
+ "csv",
+ "csv-core",
+ "regex",
+]
+
+[[package]]
+name = "arrow-data"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b24852db04738907e06c04ea61e42fe7fda962a34513022dc0d0e754fb7976b"
+dependencies = [
+ "arrow-buffer",
+ "arrow-schema",
+ "half",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "arrow-ipc"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29a908a11fcfb3fb2f6730f4ac15e367bc644e419155e96238f68cf3adde572b"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "arrow-select",
+ "flatbuffers",
+ "lz4_flex",
+ "zstd",
+]
+
+[[package]]
+name = "arrow-json"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8a96aed3931c076adee39ec2a40d8219fc7f09e79bcdaca1df16272993e1e14"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-ord",
+ "arrow-schema",
+ "arrow-select",
+ "chrono",
+ "half",
+ "indexmap 2.14.0",
+ "itoa",
+ "lexical-core",
+ "memchr",
+ "num-traits",
+ "ryu",
+ "serde_core",
+ "serde_json",
+ "simdutf8",
+]
+
+[[package]]
+name = "arrow-ord"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63a083ec750f5c043f02946b4baf05fcdbb55f4560a3277055caca5cc99f3eb0"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "arrow-select",
+]
+
+[[package]]
+name = "arrow-row"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "514ba0ef0d4c5896202dae736251ce415abb43a950bed570fb7981b8716c0e4c"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "half",
+]
+
+[[package]]
+name = "arrow-schema"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21ca356ad6425cecb6eb7b28e4f659f1ee7880fbb1a16127de7dd62901efee9e"
+dependencies = [
+ "bitflags 2.13.1",
+ "serde_core",
+ "serde_json",
+]
+
+[[package]]
+name = "arrow-select"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c58da39eb3d8350ad4a549e5c2bc49284dac554016c69829310350f1731b0aad"
+dependencies = [
+ "ahash",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "num-traits",
+]
+
+[[package]]
+name = "arrow-string"
+version = "58.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6789b388467525e3271326b6b4915666ecfdf5142aef09779445c954b67543c"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "arrow-select",
+ "memchr",
+ "num-traits",
+ "regex",
+ "regex-syntax",
+]
+
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-compression"
+version = "0.4.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3976abdc8fe7d1133d43d304afd42abdf5bc3e1319d263d223bde07b5efc4be8"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "async-lock"
+version = "3.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "290f7f2596bd5b78a9fec8088ccd89180d7f9f55b94b0576823bbbdc72ee8311"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "async_cell"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "447ab28afbb345f5408b120702a44e5529ebf90b1796ec76e9528df8e288e6c2"
+dependencies = [
+ "loom",
+]
+
+[[package]]
+name = "atoi"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28d99ec8bfea296261ca1af174f24225171fea9664ba9003cbebee704810528"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-config"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b180a3c8b55960db3426d8964b8745e652466a1a49fe1a2eda828046d30b5e4"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-sdk-sso",
+ "aws-sdk-ssooidc",
+ "aws-sdk-sts",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "hex",
+ "http 1.5.0",
+ "sha1 0.10.7",
+ "time",
+ "tokio",
+ "tracing",
+ "url",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-credential-types"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
+dependencies = [
+ "aws-lc-sys",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.44.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
+[[package]]
+name = "aws-runtime"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9007227e10b5fed2f3e0a2beff489211e2b5604c400b7a9d5d81ca9d64c24bb"
+dependencies = [
+ "aws-credential-types",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "bytes-utils",
+ "fastrand",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "percent-encoding",
+ "pin-project-lite",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "aws-sdk-sso"
+version = "1.106.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d0efcee834347b6705eca3eea2defd88242f43774f55d7326604222e3c86260"
+dependencies = [
+ "arc-swap",
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-observability",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "http 0.2.12",
+ "http 1.5.0",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-ssooidc"
+version = "1.108.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a59312a04cf19c962cfee32b64ecfee758f8786407ff6da5b30fff46ae96f201"
+dependencies = [
+ "arc-swap",
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-observability",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "http 0.2.12",
+ "http 1.5.0",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-sts"
+version = "1.111.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "120e7eb63457a9e547f9986fe3b273f77c43679da4d04f46359fa881c5e19b6e"
+dependencies = [
+ "arc-swap",
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-observability",
+ "aws-smithy-query",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "fastrand",
+ "http 0.2.12",
+ "http 1.5.0",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sigv4"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "723c2234ad7511ceef63eab016b7ba6ff7c55590fefb96fa8467af014a07309f"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "form_urlencoded",
+ "hex",
+ "hmac",
+ "http 0.2.12",
+ "http 1.5.0",
+ "percent-encoding",
+ "sha2",
+ "time",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-async"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316"
+dependencies = [
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "aws-smithy-http"
+version = "0.64.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37843d9add67c3aff5856f409c6dc315d3cdff60f9c0cb5b670dab1e9920306d"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "futures-util",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "percent-encoding",
+ "pin-project-lite",
+ "pin-utils",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-http-client"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c1c8a04cb31ba74d0115af5a890bb8c0d48fba64b52812fa13929a6ef0cc83c"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "h2",
+ "http 1.5.0",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "pin-project-lite",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-json"
+version = "0.63.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3dc65a121adb4b33729919fcfa14fa36fb33c1555a8f06bb0e2188dbfdc1d9ef"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+]
+
+[[package]]
+name = "aws-smithy-observability"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e86338c869539a581bf161247762a6e87f92c5c075060057b5ed6d06632ed0c"
+dependencies = [
+ "aws-smithy-runtime-api",
+]
+
+[[package]]
+name = "aws-smithy-query"
+version = "0.62.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512346c7212ab7436df2d77a16d976a468ae44a418835511d2a69269810aaf62"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "urlencoding",
+]
+
+[[package]]
+name = "aws-smithy-runtime"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "483b858ff67522011c4786310c5cd8fd88d0be7ea3d5f1a48328446300c4269e"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-http-client",
+ "aws-smithy-observability",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "bytes",
+ "fastrand",
+ "http 0.2.12",
+ "http 1.5.0",
+ "http-body 0.4.6",
+ "http-body 1.1.0",
+ "http-body-util",
+ "pin-project-lite",
+ "pin-utils",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-runtime-api"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b98f2e1fd67ec06618f9c291e5e495a468e60519e44c9c1979cd0521f3affdb"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api-macros",
+ "aws-smithy-types",
+ "bytes",
+ "http 0.2.12",
+ "http 1.5.0",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-smithy-runtime-api-macros"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "221eaa237ddf1ca79b60d1372aad77e47f9c0ea5b3ce5099da8c61d027dc77b3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "aws-smithy-schema"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56e0a4e53127a632224e43633b0fe045fa9e1e3cfc68b9830f1115e103f910"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "http 1.5.0",
+]
+
+[[package]]
+name = "aws-smithy-types"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fce83ce9abbb198d25bc7131e468d0f9fe1257125e58c39f3f9fc9f5098c9647"
+dependencies = [
+ "base64-simd",
+ "bytes",
+ "bytes-utils",
+ "http 0.2.12",
+ "http 1.5.0",
+ "http-body 0.4.6",
+ "http-body 1.1.0",
+ "http-body-util",
+ "itoa",
+ "num-integer",
+ "pin-project-lite",
+ "pin-utils",
+ "ryu",
+ "serde",
+ "time",
+]
+
+[[package]]
+name = "aws-smithy-xml"
+version = "0.62.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce84f71c72fee2cbbadde6e7d082f5fb466e3a84733855295fa7aafd1b31b7d8"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "xmlparser",
+]
+
+[[package]]
+name = "aws-types"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eec1cd5469f328c782dc3e33d4153cf118a54e33cbb3356d60d16f89883e1f94"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
+ "rustc_version",
+ "tracing",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "backon"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cffb0e931875b666fc4fcb20fee52e9bbd1ef836fd9e9e04ec21555f9f85f7ef"
+dependencies = [
+ "fastrand",
+ "gloo-timers",
+ "tokio",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "base64-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
+dependencies = [
+ "outref",
+ "vsimd",
+]
+
+[[package]]
+name = "bigdecimal"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d6867f1565b3aad85681f1015055b087fcfd840d6aeee6eee7f2da317603695"
+dependencies = [
+ "autocfg",
+ "libm",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "bitvec"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddcec3d12c579d40898fe0a9a358a803c23e9c52ca3c425707f81c9436211837"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "blake3"
+version = "1.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ae7bad254120e9e4c63bafc385310756f90c484eac0e36b8317cf09cb92a77"
+dependencies = [
+ "arrayref",
+ "arrayvec",
+ "cc",
+ "cfg-if",
+ "constant_time_eq",
+ "cpufeatures 0.3.0",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0e56a716f1e132ff6bf4bdac1c944a3fcdc1cae65f70a4a2a1ac3b401d2d1f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "bytes-utils"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dafe3a8757b027e2be6e4e5601ed563c55989fcf1546e933c66c8eb3a058d35"
+dependencies = [
+ "bytes",
+ "either",
+]
+
+[[package]]
+name = "cc"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "chrono-tz"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6139a8597ed92cf816dfb33f5dd6cf0bb93a6adc938f11039f371bc5bcd26c3"
+dependencies = [
+ "chrono",
+ "phf",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "comfy-table"
+version = "7.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "958c5d6ecf1f214b4c2bbbbf6ab9523a864bd136dcf71a7e8904799acfe1ad47"
+dependencies = [
+ "unicode-segmentation",
+ "unicode-width",
+]
+
+[[package]]
+name = "compression-codecs"
+version = "0.4.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2548391e9c1929c21bf6aa2680af86fe4c1b33e6cea9ac1cfeec0bd11218cf"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc14f565cf027a105f7a44ccf9e5b424348421a1d8952a8fc9d499d313107789"
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "const-random"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87e00182fe74b066627d63b85fd550ac2998d4b0bd86bfed477a0ae4c7c71359"
+dependencies = [
+ "const-random-macro",
+]
+
+[[package]]
+name = "const-random-macro"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9d839f2a20b0aee515dc581a6172f2321f96cab76c1a38a4c584a194955390e"
+dependencies = [
+ "getrandom 0.2.17",
+ "once_cell",
+ "tiny-keccak",
+]
+
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32c"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
+dependencies = [
+ "rustc_version",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-skiplist"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df29de440c58ca2cc6e587ec3d22347551a32435fbde9d2bff64e78a9ffa151b"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+
+[[package]]
+name = "crunchy"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "csv"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde_core",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704a3c26996a80471189265814dbc2c257598b96b8a7feae2d31ace646bb9782"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ctor"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "914a755b7c2d4af2bdcff7ce1739e2db9a1b81a9b07123d8015786ae03c0980d"
+dependencies = [
+ "link-section",
+ "linktime-proc-macro",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dashmap"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6361d5c062261c78a176addb82d4c821ae42bed6089de0e12603cd25de2059c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "datafusion"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "754ef4e8f073922a26f5b23133b9db4829342362b09be0bc94309cf261c2f098"
+dependencies = [
+ "arrow",
+ "arrow-schema",
+ "async-trait",
+ "chrono",
+ "datafusion-catalog",
+ "datafusion-catalog-listing",
+ "datafusion-common",
+ "datafusion-common-runtime",
+ "datafusion-datasource",
+ "datafusion-datasource-arrow",
+ "datafusion-datasource-csv",
+ "datafusion-datasource-json",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-expr-common",
+ "datafusion-functions",
+ "datafusion-functions-aggregate",
+ "datafusion-functions-nested",
+ "datafusion-functions-table",
+ "datafusion-functions-window",
+ "datafusion-optimizer",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-adapter",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-optimizer",
+ "datafusion-physical-plan",
+ "datafusion-session",
+ "datafusion-sql",
+ "futures",
+ "indexmap 2.14.0",
+ "itertools",
+ "log",
+ "object_store",
+ "parking_lot",
+ "sqlparser",
+ "tempfile",
+ "tokio",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "datafusion-catalog"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06afd1e38dd27bbb1258685a1fc6524df6aff4e07b25b393a47de59635178d99"
+dependencies = [
+ "arrow",
+ "async-trait",
+ "dashmap",
+ "datafusion-common",
+ "datafusion-common-runtime",
+ "datafusion-datasource",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-physical-expr",
+ "datafusion-physical-plan",
+ "datafusion-session",
+ "futures",
+ "itertools",
+ "log",
+ "object_store",
+ "parking_lot",
+ "tokio",
+]
+
+[[package]]
+name = "datafusion-catalog-listing"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0668fb32c12065ec242be0e5b4bc62bd7a06a0be3ecd83791ef877e4be67e02"
+dependencies = [
+ "arrow",
+ "async-trait",
+ "datafusion-catalog",
+ "datafusion-common",
+ "datafusion-datasource",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-adapter",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-plan",
+ "futures",
+ "itertools",
+ "log",
+ "object_store",
+]
+
+[[package]]
+name = "datafusion-common"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca43b263cdff57042cfa8fb817fb3469f4878933380dccff25f5e793580abbf9"
+dependencies = [
+ "arrow",
+ "arrow-ipc",
+ "arrow-schema",
+ "chrono",
+ "foldhash 0.2.0",
+ "half",
+ "hashbrown 0.17.1",
+ "indexmap 2.14.0",
+ "itertools",
+ "libc",
+ "log",
+ "object_store",
+ "sqlparser",
+ "tokio",
+ "uuid",
+ "web-time",
+]
+
+[[package]]
+name = "datafusion-common-runtime"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f0ba2b864792bdca4d76c59a1de0ab6e1b61946596b9936888dbd6360035f2"
+dependencies = [
+ "futures",
+ "log",
+ "tokio",
+]
+
+[[package]]
+name = "datafusion-datasource"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b840a8bce0bcbf5afad02946d438591e7c373f7afccaf3d874c04485772514dd"
+dependencies = [
+ "arrow",
+ "async-trait",
+ "bytes",
+ "chrono",
+ "datafusion-common",
+ "datafusion-common-runtime",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-adapter",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-plan",
+ "datafusion-session",
+ "futures",
+ "glob",
+ "itertools",
+ "log",
+ "object_store",
+ "parking_lot",
+ "rand 0.9.5",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "datafusion-datasource-arrow"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a24cc0b9cf6e367f27f27406eff13abf48a11b72446aaa40b3105c0ded5c17d9"
+dependencies = [
+ "arrow",
+ "arrow-ipc",
+ "async-trait",
+ "bytes",
+ "datafusion-common",
+ "datafusion-common-runtime",
+ "datafusion-datasource",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-plan",
+ "datafusion-session",
+ "futures",
+ "itertools",
+ "object_store",
+ "tokio",
+]
+
+[[package]]
+name = "datafusion-datasource-csv"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1abe56b2a7a2d1d6de5117dd1a203181e267f28529faa5da546947621b697d7"
+dependencies = [
+ "arrow",
+ "async-trait",
+ "bytes",
+ "datafusion-common",
+ "datafusion-common-runtime",
+ "datafusion-datasource",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-plan",
+ "datafusion-session",
+ "futures",
+ "object_store",
+ "regex",
+ "tokio",
+]
+
+[[package]]
+name = "datafusion-datasource-json"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3e467f0611ad7bdd5aad17c63c9bb6182d04e5282e5496d897ea2b49c024ba"
+dependencies = [
+ "arrow",
+ "async-trait",
+ "bytes",
+ "datafusion-common",
+ "datafusion-common-runtime",
+ "datafusion-datasource",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-plan",
+ "datafusion-session",
+ "futures",
+ "object_store",
+ "tokio",
+ "tokio-stream",
+]
+
+[[package]]
+name = "datafusion-doc"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d69bb69d8769e34f76839c960dbde24c1ac0c885a79b6c3c2287bdc56ec67891"
+
+[[package]]
+name = "datafusion-execution"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8eac0a09bc8d263f52025cad9e001da4d8138d633fa288edda4d06b1772eae6"
+dependencies = [
+ "arrow",
+ "arrow-buffer",
+ "async-trait",
+ "dashmap",
+ "datafusion-common",
+ "datafusion-expr",
+ "datafusion-physical-expr-common",
+ "futures",
+ "log",
+ "object_store",
+ "parking_lot",
+ "rand 0.9.5",
+ "tempfile",
+ "url",
+]
+
+[[package]]
+name = "datafusion-expr"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eeb14d374767ee0fc62dc79a5ba8bcf8a63c14e993c7d992d0e63adfa23d77d3"
+dependencies = [
+ "arrow",
+ "arrow-schema",
+ "async-trait",
+ "chrono",
+ "datafusion-common",
+ "datafusion-doc",
+ "datafusion-expr-common",
+ "datafusion-functions-aggregate-common",
+ "datafusion-functions-window-common",
+ "datafusion-physical-expr-common",
+ "indexmap 2.14.0",
+ "itertools",
+ "serde_json",
+ "sqlparser",
+]
+
+[[package]]
+name = "datafusion-expr-common"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7b19a8c95522bee8cbb313d74263b85e355d2b52f42e67ef5694bf5de9e9356"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "indexmap 2.14.0",
+ "itertools",
+]
+
+[[package]]
+name = "datafusion-functions"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f64c983bbbdcb729d921a2b2ac3375598719b5cc0c30345ad664936f3176fc7"
+dependencies = [
+ "arrow",
+ "arrow-buffer",
+ "base64 0.22.1",
+ "blake2",
+ "blake3",
+ "chrono",
+ "chrono-tz",
+ "datafusion-common",
+ "datafusion-doc",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-expr-common",
+ "datafusion-macros",
+ "datafusion-physical-expr-common",
+ "hex",
+ "itertools",
+ "log",
+ "md-5 0.11.0",
+ "memchr",
+ "num-traits",
+ "rand 0.9.5",
+ "regex",
+ "sha2",
+ "uuid",
+]
+
+[[package]]
+name = "datafusion-functions-aggregate"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89bc17041e424a47ed062f43df24d84aab8b57c4c3221e5c1a5eef46d6c5718b"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "datafusion-doc",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-functions-aggregate-common",
+ "datafusion-macros",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-common",
+ "foldhash 0.2.0",
+ "half",
+ "log",
+ "num-traits",
+]
+
+[[package]]
+name = "datafusion-functions-aggregate-common"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97dd2a9e865c6108059f5b37b77934f84b50bfb108f837bd0e5c9536e03f0545"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "datafusion-expr-common",
+ "datafusion-physical-expr-common",
+]
+
+[[package]]
+name = "datafusion-functions-nested"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75f0bdfeef16d96417b9632ef855645376b242e9006a126dfd0bedfc54a93f5f"
+dependencies = [
+ "arrow",
+ "arrow-ord",
+ "datafusion-common",
+ "datafusion-doc",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-expr-common",
+ "datafusion-functions",
+ "datafusion-functions-aggregate",
+ "datafusion-functions-aggregate-common",
+ "datafusion-macros",
+ "datafusion-physical-expr-common",
+ "hashbrown 0.17.1",
+ "itertools",
+ "itoa",
+ "log",
+ "memchr",
+]
+
+[[package]]
+name = "datafusion-functions-table"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4e4941673c917819616877e9993da4503e4f4739812be0bc32c5356184c6383"
+dependencies = [
+ "arrow",
+ "async-trait",
+ "datafusion-catalog",
+ "datafusion-common",
+ "datafusion-expr",
+ "datafusion-physical-expr",
+ "datafusion-physical-plan",
+ "parking_lot",
+]
+
+[[package]]
+name = "datafusion-functions-window"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12dd2e16c12b84b6f6b41b19f55b366dd1c46876bb35b86896c6349067379e8d"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "datafusion-doc",
+ "datafusion-expr",
+ "datafusion-functions-window-common",
+ "datafusion-macros",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-common",
+ "log",
+]
+
+[[package]]
+name = "datafusion-functions-window-common"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cdc5e4b6f8b6ef823cc1c761f85088ad4c884fe8df64df3cbcc6b2b84698441"
+dependencies = [
+ "datafusion-common",
+ "datafusion-physical-expr-common",
+]
+
+[[package]]
+name = "datafusion-macros"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a3614234dd93578c92428cb4f408e020874f0d2b7e6c90c928d9d28b5df2ceb"
+dependencies = [
+ "datafusion-doc",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "datafusion-optimizer"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0635620b050b81bb92764e99250868f654e2cd5ad1bece413283b3f73c83179"
+dependencies = [
+ "arrow",
+ "chrono",
+ "datafusion-common",
+ "datafusion-expr",
+ "datafusion-expr-common",
+ "datafusion-physical-expr",
+ "indexmap 2.14.0",
+ "itertools",
+ "log",
+ "regex",
+ "regex-syntax",
+]
+
+[[package]]
+name = "datafusion-physical-expr"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cabf7a86eb70b816729e33c81bf7767c936ee1226f607a114f5dac2decac8d0"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "datafusion-expr",
+ "datafusion-expr-common",
+ "datafusion-functions-aggregate-common",
+ "datafusion-physical-expr-common",
+ "half",
+ "hashbrown 0.17.1",
+ "indexmap 2.14.0",
+ "itertools",
+ "parking_lot",
+ "petgraph",
+ "tokio",
+]
+
+[[package]]
+name = "datafusion-physical-expr-adapter"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de222e04f7e6744501555a54ab0abe26bfdfebee380af79a9bdc175704246859"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "datafusion-expr",
+ "datafusion-functions",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-common",
+ "itertools",
+]
+
+[[package]]
+name = "datafusion-physical-expr-common"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72d0d0057fc5a502d45c870cb6d47c66eb7bdd5edb1bd71ad6f3f724975ac2a8"
+dependencies = [
+ "arrow",
+ "chrono",
+ "datafusion-common",
+ "datafusion-expr-common",
+ "hashbrown 0.17.1",
+ "indexmap 2.14.0",
+ "itertools",
+ "parking_lot",
+ "pin-project",
+]
+
+[[package]]
+name = "datafusion-physical-optimizer"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86046eed10950c5f9aaed9acfd148e9bd2e1dfdfe4f9aef607d1447b271e4183"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-expr-common",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-plan",
+ "datafusion-pruning",
+ "itertools",
+]
+
+[[package]]
+name = "datafusion-physical-plan"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bc84da934c903407ba297971ebcc020c4c1a38aafd765d6c144c76eff3fa6a1"
+dependencies = [
+ "arrow",
+ "arrow-data",
+ "arrow-ipc",
+ "arrow-ord",
+ "arrow-schema",
+ "async-trait",
+ "datafusion-common",
+ "datafusion-common-runtime",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-functions",
+ "datafusion-functions-aggregate-common",
+ "datafusion-functions-window-common",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-common",
+ "futures",
+ "half",
+ "hashbrown 0.17.1",
+ "indexmap 2.14.0",
+ "itertools",
+ "log",
+ "num-traits",
+ "parking_lot",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "datafusion-pruning"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb63eeac6de19be40f487b65dd84e546195f783c5a9928618e0c4f2a3569b0d7"
+dependencies = [
+ "arrow",
+ "datafusion-common",
+ "datafusion-datasource",
+ "datafusion-expr-common",
+ "datafusion-physical-expr",
+ "datafusion-physical-expr-common",
+ "datafusion-physical-plan",
+ "log",
+]
+
+[[package]]
+name = "datafusion-session"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f961d209177f91bd014db5cbb2c33b7d28a2597b9003e77f17aeb712964315a"
+dependencies = [
+ "async-trait",
+ "datafusion-common",
+ "datafusion-execution",
+ "datafusion-expr",
+ "datafusion-physical-plan",
+ "parking_lot",
+]
+
+[[package]]
+name = "datafusion-sql"
+version = "54.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1d71cb454da682b2af7488e1fc1ddd72ee1b28f19297b8ccad73f0a21ee9a69"
+dependencies = [
+ "arrow",
+ "bigdecimal",
+ "chrono",
+ "datafusion-common",
+ "datafusion-expr",
+ "datafusion-functions-nested",
+ "indexmap 2.14.0",
+ "log",
+ "regex",
+ "sqlparser",
+]
+
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "dlv-list"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "442039f5147480ba31067cb00ada1adae6892028e40e45fc5de7b7df6dcc1b5f"
+dependencies = [
+ "const-random",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
+[[package]]
+name = "either"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "ethnum"
+version = "1.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40404c3f5f511ec4da6fe866ddf6a717c309fdbb69fbbad7b0f3edab8f2e835f"
+
+[[package]]
+name = "event-listener"
+version = "5.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
+dependencies = [
+ "parking",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "event-listener-strategy"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8be9f3dfaaffdae2972880079a491a1a8bb7cbed0b8dd7a347f668b4150a3b93"
+dependencies = [
+ "event-listener",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "fast-float2"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6e8948ce679d00a02a94739ea185595dca7118ed04feb991127e443bd3d761f"
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+
+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
+[[package]]
+name = "flatbuffers"
+version = "25.12.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
+dependencies = [
+ "bitflags 2.13.1",
+ "rustc_version",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "fsst"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0981ce90521824089f3cd68a48b1c4c89e9ad96d0eb74f58d6e550a3d604545"
+dependencies = [
+ "arrow-array",
+ "rand 0.9.5",
+]
+
+[[package]]
+name = "fst"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ab85b9b05e3978cc9a9cf8fea7f01b494e1a09ed3037e16ba39edc7a29eb61a"
+dependencies = [
+ "utf8-ranges",
+]
+
+[[package]]
+name = "funty"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
+
+[[package]]
+name = "futures"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generator"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "log",
+ "rustversion",
+ "windows-link",
+ "windows-result",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "glob"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
+
+[[package]]
+name = "gloo-timers"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb143cf96099802033e0d4f4963b19fd2e0b728bcf076cd9cf7f6634f092994"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.5.0",
+ "indexmap 2.14.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b"
+dependencies = [
+ "bytemuck",
+ "cfg-if",
+ "crunchy",
+ "num-traits",
+ "zerocopy",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash 0.1.5",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "http"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http 1.5.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "humantime"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "hyper"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http 1.5.0",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "rustls-native-certs",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+ "webpki-roots",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
+dependencies = [
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "hyperloglogplus"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "621debdf94dcac33e50475fdd76d34d5ea9c0362a834b9db08c3024696c1fbe3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "serde",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "251af8e57c9400e3eb58242fe5b8b1152b2a64fdf4cf632f923c38ccee6f2fa9"
+dependencies = [
+ "icu_locale_core",
+ "icu_locale_fallback_data",
+ "icu_provider",
+ "potential_utf",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_fallback_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "decf2a22ec8fa68f1a0c1129a3f8583f8f8bc24e8b9ccbe98ead99f62a4dc3a8"
+
+[[package]]
+name = "icu_normalizer"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
+
+[[package]]
+name = "icu_properties"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
+
+[[package]]
+name = "icu_provider"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92a7ed671a6aad807a8651a2e1782a6598fda9ce5185dd8158549e95a91c6428"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "serde",
+ "stable_deref_trait",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82d07aafccd67af15d02512a6adf5896fbc5ed00f2e99b471d2efa14016db3db"
+dependencies = [
+ "icu_collections",
+ "icu_locale_fallback",
+ "icu_provider",
+ "icu_segmenter_data",
+ "potential_utf",
+ "smallvec",
+ "utf8_iter",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_segmenter_data"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae293c039020f9ec10710af98d29ce6aa2051486638b49c9a6409f3b4a9e98ad"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "io-uring"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d64d8ca234d152948ceaede1f419b6a83983a5ecccaac05fb337a809c96d3aa6"
+dependencies = [
+ "bitflags 2.13.1",
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jiff"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "js-sys",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "wasm-bindgen",
+ "windows-link",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+dependencies = [
+ "defmt",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.20",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonb"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb98fb29636087c40ad0d1274d9a30c0c1e83e03ae93f6e7e89247b37fcc6953"
+dependencies = [
+ "byteorder",
+ "ethnum",
+ "fast-float2",
+ "itoa",
+ "jiff",
+ "nom",
+ "num-traits",
+ "ordered-float",
+ "rand 0.9.5",
+ "serde",
+ "serde_json",
+ "zmij",
+]
+
+[[package]]
+name = "lance"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830548f9fc92ae74b848a504282d4da06f016f2ee94b663773c2738b9cb61c42"
+dependencies = [
+ "arc-swap",
+ "arrow",
+ "arrow-arith",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-ipc",
+ "arrow-ord",
+ "arrow-row",
+ "arrow-schema",
+ "arrow-select",
+ "async-recursion",
+ "async-trait",
+ "async_cell",
+ "aws-credential-types",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crossbeam-queue",
+ "crossbeam-skiplist",
+ "dashmap",
+ "datafusion",
+ "datafusion-expr",
+ "datafusion-functions",
+ "datafusion-physical-expr",
+ "datafusion-physical-plan",
+ "either",
+ "fst",
+ "futures",
+ "half",
+ "humantime",
+ "itertools",
+ "lance-arrow",
+ "lance-bitpacking",
+ "lance-core",
+ "lance-datafusion",
+ "lance-encoding",
+ "lance-file",
+ "lance-index",
+ "lance-io",
+ "lance-linalg",
+ "lance-namespace",
+ "lance-select",
+ "lance-table",
+ "lance-tokenizer",
+ "log",
+ "moka",
+ "object_store",
+ "permutation",
+ "pin-project",
+ "prost",
+ "prost-build",
+ "prost-types",
+ "rand 0.9.5",
+ "rayon",
+ "roaring",
+ "rustc-hash",
+ "semver",
+ "serde",
+ "serde_json",
+ "snafu",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tracing",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "lance-arrow"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24187f972374567bb3573cffd8728f2f4f7f06d644c3c5d4430b79d6b0b67300"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-ipc",
+ "arrow-ord",
+ "arrow-schema",
+ "arrow-select",
+ "bytemuck",
+ "bytes",
+ "futures",
+ "getrandom 0.2.17",
+ "half",
+ "jsonb",
+ "num-traits",
+ "rand 0.9.5",
+]
+
+[[package]]
+name = "lance-arrow-scalar"
+version = "58.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "771f68b04b47f3addf781116f65061808de94b05e1e9411c23c18f32d14ebe79"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-data",
+ "arrow-row",
+ "arrow-schema",
+ "half",
+]
+
+[[package]]
+name = "lance-arrow-stats"
+version = "58.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd47ec33c90bf29f688fd02118e37d3a5ad5c339caa3163f89e417dc0867001f"
+dependencies = [
+ "arrow-array",
+ "arrow-schema",
+ "half",
+ "lance-arrow-scalar",
+]
+
+[[package]]
+name = "lance-bitpacking"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55fa50ad941e25298afb54eec107c3584f80c16db4adf7a6e4e9c4b6066f4281"
+dependencies = [
+ "arrayref",
+ "crunchy",
+ "paste",
+ "seq-macro",
+]
+
+[[package]]
+name = "lance-core"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21f4fd872bfe948150a6878d983327c4f150dc1b629e94ae7677310fa6a3f35f"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-data",
+ "arrow-schema",
+ "async-trait",
+ "blake3",
+ "byteorder",
+ "bytes",
+ "datafusion-common",
+ "datafusion-sql",
+ "futures",
+ "itertools",
+ "lance-arrow",
+ "lance-derive",
+ "libc",
+ "libm",
+ "log",
+ "moka",
+ "num_cpus",
+ "object_store",
+ "pin-project",
+ "prost",
+ "quick_cache",
+ "rand 0.9.5",
+ "roaring",
+ "serde_json",
+ "snafu",
+ "tempfile",
+ "tokio",
+ "tokio-stream",
+ "tokio-util",
+ "tracing",
+ "twox-hash",
+ "url",
+]
+
+[[package]]
+name = "lance-datafusion"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "230770734cd5f6fe1f1cb4a66750acad5c5a862c23c7f587d7def57c9f2c5f6b"
+dependencies = [
+ "arrow",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-ord",
+ "arrow-schema",
+ "arrow-select",
+ "async-trait",
+ "chrono",
+ "datafusion",
+ "datafusion-common",
+ "datafusion-functions",
+ "datafusion-physical-expr",
+ "futures",
+ "jsonb",
+ "lance-arrow",
+ "lance-core",
+ "lance-datagen",
+ "log",
+ "pin-project",
+ "prost",
+ "prost-build",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "lance-datagen"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0c9edcea9dbf154a3baf470595bdcdb7ef6b44dcf2b5a0c28e8815c2d4837c5"
+dependencies = [
+ "arrow",
+ "arrow-array",
+ "arrow-cast",
+ "arrow-schema",
+ "chrono",
+ "futures",
+ "half",
+ "hex",
+ "rand 0.9.5",
+ "rand_distr",
+ "rand_xoshiro",
+]
+
+[[package]]
+name = "lance-derive"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03ac280ef94d66c2e7a4b0104e60d548f45156f114f02cd0ac57423721ec96ec"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "lance-encoding"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65b345fecf1792d4147982e9ded1cf211992a442bcf73dd17a598b1c8c9b53a5"
+dependencies = [
+ "arrow-arith",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-data",
+ "arrow-schema",
+ "arrow-select",
+ "bytemuck",
+ "byteorder",
+ "bytes",
+ "fsst",
+ "futures",
+ "hex",
+ "hyperloglogplus",
+ "itertools",
+ "lance-arrow",
+ "lance-bitpacking",
+ "lance-core",
+ "log",
+ "lz4",
+ "num-traits",
+ "prost",
+ "prost-build",
+ "rand 0.9.5",
+ "strum",
+ "tokio",
+ "tracing",
+ "xxhash-rust",
+ "zstd",
+]
+
+[[package]]
+name = "lance-file"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "203400160ecd4ac6f67f6bfdb3c186f94758ff70a6ca76d4f300c327f5c14a11"
+dependencies = [
+ "arrow-arith",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-cast",
+ "arrow-data",
+ "arrow-schema",
+ "arrow-select",
+ "async-recursion",
+ "async-trait",
+ "byteorder",
+ "bytes",
+ "datafusion-common",
+ "futures",
+ "lance-arrow",
+ "lance-core",
+ "lance-encoding",
+ "lance-io",
+ "log",
+ "num-traits",
+ "object_store",
+ "prost",
+ "prost-build",
+ "prost-types",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "lance-index"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db67792e22332a7be08d35e60ce9e4c6fb7f75f70ab1566b67b462d1aac21b13"
+dependencies = [
+ "arc-swap",
+ "arrow",
+ "arrow-arith",
+ "arrow-array",
+ "arrow-ipc",
+ "arrow-ord",
+ "arrow-schema",
+ "arrow-select",
+ "async-channel",
+ "async-recursion",
+ "async-trait",
+ "bitvec",
+ "bytes",
+ "chrono",
+ "crossbeam-queue",
+ "datafusion",
+ "datafusion-common",
+ "datafusion-expr",
+ "datafusion-physical-expr",
+ "dirs",
+ "fst",
+ "futures",
+ "half",
+ "itertools",
+ "jsonb",
+ "lance-arrow",
+ "lance-arrow-stats",
+ "lance-bitpacking",
+ "lance-core",
+ "lance-datafusion",
+ "lance-datagen",
+ "lance-encoding",
+ "lance-file",
+ "lance-index-core",
+ "lance-io",
+ "lance-linalg",
+ "lance-select",
+ "lance-table",
+ "lance-tokenizer",
+ "libsais-rs",
+ "log",
+ "ndarray",
+ "num-traits",
+ "object_store",
+ "prost",
+ "prost-build",
+ "prost-types",
+ "rand 0.9.5",
+ "rand_distr",
+ "rangemap",
+ "rayon",
+ "regex-syntax",
+ "roaring",
+ "serde",
+ "serde_json",
+ "smallvec",
+ "tempfile",
+ "tokio",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "lance-index-core"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49b5700d71f43e5da2057908f3243a6bc01247b5dd12247313f789c280155aae"
+dependencies = [
+ "arrow-array",
+ "arrow-schema",
+ "arrow-select",
+ "async-trait",
+ "bytes",
+ "datafusion",
+ "datafusion-common",
+ "datafusion-expr",
+ "futures",
+ "lance-core",
+ "lance-io",
+ "lance-select",
+ "prost-types",
+ "roaring",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "lance-io"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b8a6872b9bff95e75e223e04011feebd990d8784878eaf5df73c86d6acebb47"
+dependencies = [
+ "arrow",
+ "arrow-array",
+ "arrow-schema",
+ "async-trait",
+ "aws-config",
+ "aws-credential-types",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "futures",
+ "http 1.5.0",
+ "io-uring",
+ "lance-arrow",
+ "lance-core",
+ "lance-namespace",
+ "log",
+ "moka",
+ "object_store",
+ "object_store_opendal",
+ "opendal",
+ "path_abs",
+ "pin-project",
+ "prost",
+ "rand 0.9.5",
+ "serde",
+ "tempfile",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "lance-linalg"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a1dd49fdf61da86650dc335fbe1f239803f9d73bc2bc5ffbc0c905dd8809892"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-schema",
+ "cc",
+ "half",
+ "lance-arrow",
+ "lance-core",
+ "num-traits",
+ "rand 0.9.5",
+ "rayon",
+]
+
+[[package]]
+name = "lance-namespace"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1449221f599147e570bec6e09eaea6ce6b9286f632e00a27f945dd0c6b70ccd8"
+dependencies = [
+ "arrow",
+ "async-trait",
+ "bytes",
+ "lance-core",
+ "lance-namespace-reqwest-client",
+ "snafu",
+]
+
+[[package]]
+name = "lance-namespace-reqwest-client"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3f0a235e3ed5f8805205649ccc7d7d0f3df23ce1294242c9265ad488d7f19d"
+dependencies = [
+ "reqwest 0.12.28",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "serde_with",
+ "url",
+]
+
+[[package]]
+name = "lance-select"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c66c5cb12ed194c7c8e427a0e90e990cdbc7159edba2bfc7b7e8db2c90c747af"
+dependencies = [
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-schema",
+ "byteorder",
+ "bytes",
+ "itertools",
+ "lance-core",
+ "roaring",
+ "tracing",
+]
+
+[[package]]
+name = "lance-table"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6cd2a39f2e288d1acecf887cb9cc655711fb67bcf3b24a2034158dbac7a6f60e"
+dependencies = [
+ "arrow",
+ "arrow-array",
+ "arrow-buffer",
+ "arrow-ipc",
+ "arrow-schema",
+ "async-trait",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "futures",
+ "lance-arrow",
+ "lance-core",
+ "lance-file",
+ "lance-io",
+ "lance-select",
+ "log",
+ "object_store",
+ "prost",
+ "prost-build",
+ "prost-types",
+ "rand 0.9.5",
+ "rangemap",
+ "roaring",
+ "semver",
+ "serde",
+ "serde_json",
+ "snafu",
+ "tokio",
+ "tracing",
+ "url",
+ "uuid",
+]
+
+[[package]]
+name = "lance-tokenizer"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "254c1e9287789c8d744f93f2010a8389a5ea3fcedc0dddf7649c4117ec830c57"
+dependencies = [
+ "icu_segmenter",
+ "rust-stemmers",
+ "serde",
+ "stop-words",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "lexical-core"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d8d125a277f807e55a77304455eb7b1cb52f2b18c143b60e766c120bd64a594"
+dependencies = [
+ "lexical-parse-float",
+ "lexical-parse-integer",
+ "lexical-util",
+ "lexical-write-float",
+ "lexical-write-integer",
+]
+
+[[package]]
+name = "lexical-parse-float"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52a9f232fbd6f550bc0137dcb5f99ab674071ac2d690ac69704593cb4abbea56"
+dependencies = [
+ "lexical-parse-integer",
+ "lexical-util",
+]
+
+[[package]]
+name = "lexical-parse-integer"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a7a039f8fb9c19c996cd7b2fcce303c1b2874fe1aca544edc85c4a5f8489b34"
+dependencies = [
+ "lexical-util",
+]
+
+[[package]]
+name = "lexical-util"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2604dd126bb14f13fb5d1bd6a66155079cb9fa655b37f875b3a742c705dbed17"
+
+[[package]]
+name = "lexical-write-float"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50c438c87c013188d415fbabbb1dceb44249ab81664efbd31b14ae55dabb6361"
+dependencies = [
+ "lexical-util",
+ "lexical-write-integer",
+]
+
+[[package]]
+name = "lexical-write-integer"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "409851a618475d2d5796377cad353802345cba92c867d9fbcde9cf4eac4e14df"
+dependencies = [
+ "lexical-util",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "libm"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
+
+[[package]]
+name = "libredox"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d0a00925a9f930d679b6789b721e3a7f9ed110f41b86d2497caa780c3a070a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "libsais-rs"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00777f770949ecbe5524eb6630699a501c9c27e4d18493705a7dad49c9bdfbd1"
+dependencies = [
+ "rayon",
+]
+
+[[package]]
+name = "link-section"
+version = "0.19.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c29a617ce3df32c08497bdc1ab6e2376e0b17948ac166a2fbe5977c5954cd9"
+
+[[package]]
+name = "linktime-proc-macro"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e57c38c1e860fd37c604281cdfb1dd2216977fd76a50f85ba2f388ef3219616"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "lock_api"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+
+[[package]]
+name = "loom"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
+dependencies = [
+ "cfg-if",
+ "generator",
+ "scoped-tls",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "lz4"
+version = "1.28.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a20b523e860d03443e98350ceaac5e71c6ba89aea7d960769ec3ce37f4de5af4"
+dependencies = [
+ "lz4-sys",
+]
+
+[[package]]
+name = "lz4-sys"
+version = "1.11.1+lz4-1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bd8c0d6c6ed0cd30b3652886bb8711dc4bb01d637a68105a3d5158039b418e6"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "lz4_flex"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
+dependencies = [
+ "twox-hash",
+]
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "matrixmultiply"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f607c237553f086e7043417a51df26b2eb899d3caff94e6a67592ff992fedc7"
+dependencies = [
+ "autocfg",
+ "num_cpus",
+ "once_cell",
+ "rawpointer",
+ "thread-tree",
+]
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "md-5"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
+dependencies = [
+ "cfg-if",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "mea"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c709842c4ce65cb91e2666ad5319dfc1efc3af0d34f02075eddca9000d9f8afb"
+dependencies = [
+ "hashbrown 0.17.1",
+ "slab",
+]
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "moka"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4293f18e7567a1caf3c584855554377025c65e0aa445344d04171f5ad63d19b9"
+dependencies = [
+ "async-lock",
+ "crossbeam-channel",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "equivalent",
+ "event-listener",
+ "futures-util",
+ "parking_lot",
+ "portable-atomic",
+ "smallvec",
+ "tagptr",
+ "uuid",
+]
+
+[[package]]
+name = "multimap"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
+
+[[package]]
+name = "ndarray"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "882ed72dce9365842bf196bdeedf5055305f11fc8c03dee7bb0194a6cad34841"
+dependencies = [
+ "matrixmultiply",
+ "num-complex",
+ "num-integer",
+ "num-traits",
+ "portable-atomic",
+ "portable-atomic-util",
+ "rawpointer",
+]
+
+[[package]]
+name = "nom"
+version = "8.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df9761775871bdef83bee530e60050f7e54b1105350d6884eb0fb4f46c2f9405"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "object_store"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622acbc9100d3c10e2ee15804b0caa40e55c933d5aa53814cd520805b7958a49"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "chrono",
+ "form_urlencoded",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http 1.5.0",
+ "http-body-util",
+ "humantime",
+ "hyper",
+ "itertools",
+ "md-5 0.10.6",
+ "parking_lot",
+ "percent-encoding",
+ "quick-xml 0.39.4",
+ "rand 0.10.2",
+ "reqwest 0.12.28",
+ "ring",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "url",
+ "walkdir",
+ "wasm-bindgen-futures",
+ "web-time",
+]
+
+[[package]]
+name = "object_store_opendal"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eb12a624a41fce745838d0ef3701ff6c47797c13cd18ad3612fd2a3134fdbd8"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "chrono",
+ "futures",
+ "mea",
+ "object_store",
+ "opendal",
+ "pin-project",
+ "tokio",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "opendal"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c9c85ce253ff87225e7669979d877a20c98a06604ec9d6dd5f4473e08f1ae1"
+dependencies = [
+ "ctor",
+ "opendal-core",
+ "opendal-layer-concurrent-limit",
+ "opendal-layer-logging",
+ "opendal-layer-retry",
+ "opendal-layer-timeout",
+ "opendal-service-s3",
+]
+
+[[package]]
+name = "opendal-core"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4f8607c90e2c963a91467f50fb49fbc7fb3d573f88cea219ca59ccd3740b309"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "bytes",
+ "futures",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "jiff",
+ "log",
+ "md-5 0.11.0",
+ "mea",
+ "percent-encoding",
+ "quick-xml 0.39.4",
+ "reqsign-core",
+ "reqwest 0.13.4",
+ "serde",
+ "serde_json",
+ "tokio",
+ "url",
+ "uuid",
+ "web-time",
+]
+
+[[package]]
+name = "opendal-layer-concurrent-limit"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d6f81ba6960e3fae1882f253b114b21d7e444e1534f209c7737a79f6243eb6f"
+dependencies = [
+ "futures",
+ "http 1.5.0",
+ "mea",
+ "opendal-core",
+]
+
+[[package]]
+name = "opendal-layer-logging"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58ada45c6d81d1aa4c9305d0c7d4bc317c59c85866a0908a2d75a7a978aa5ee2"
+dependencies = [
+ "log",
+ "opendal-core",
+]
+
+[[package]]
+name = "opendal-layer-retry"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2a25a718afb81fad81cb9a0580a1cb989221fa2317f888c6a37f8dad408eb7"
+dependencies = [
+ "backon",
+ "log",
+ "opendal-core",
+]
+
+[[package]]
+name = "opendal-layer-timeout"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e91f731724c213af81e9d03517859c8fc47b4578e64ad61ae4f099f10fe36e3"
+dependencies = [
+ "opendal-core",
+ "tokio",
+]
+
+[[package]]
+name = "opendal-service-s3"
+version = "0.57.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "313d46c9f5ae70bca26b7c3e3fbb9b639292625f28af73aa016f47e788af9deb"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "crc32c",
+ "http 1.5.0",
+ "log",
+ "md-5 0.11.0",
+ "opendal-core",
+ "quick-xml 0.39.4",
+ "reqsign-aws-v4",
+ "reqsign-core",
+ "reqsign-file-read-tokio",
+ "serde",
+ "url",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "ordered-float"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7d950ca161dc355eaf28f82b11345ed76c6e1f6eb1f4f4479e0323b9e2fbd0e"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "ordered-multimap"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49203cdcae0030493bad186b28da2fa25645fa276a51b6fec8010d281e02ef79"
+dependencies = [
+ "dlv-list",
+ "hashbrown 0.14.5",
+]
+
+[[package]]
+name = "outref"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-link",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "path_abs"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05ef02f6342ac01d8a93b65f96db53fe68a92a15f41144f97fb00a9e669633c3"
+dependencies = [
+ "serde",
+ "serde_derive",
+ "std_prelude",
+ "stfu8",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "permutation"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df202b0b0f5b8e389955afd5f27b007b00fb948162953f1db9c70d2c7e3157d7"
+
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap 2.14.0",
+ "serde",
+]
+
+[[package]]
+name = "phf"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "913273894cec178f401a31ec4b656318d95473527be05c0752cc41cdc32be8b7"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06005508882fb681fd97892ecff4b7fd0fee13ef1aa569f8695dae7ab9099981"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2466b2336ed02bcdca6b294417127b90ec92038d1d5c4fbeac971a922e0e0924"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a106d1259c23fac8e543272398ae0e3c0b8d33c88ed73d0cc71b0f1d902618"
+dependencies = [
+ "portable-atomic",
+]
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "serde_core",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prometheus"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d33c28a30771f7f96db69893f78b857f7450d7e0237e9c8fc6427a81bae7ed1"
+dependencies = [
+ "cfg-if",
+ "fnv",
+ "lazy_static",
+ "memchr",
+ "parking_lot",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "prost"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "528ac67416ff8646872a3c02cad9cc4ee5dc9f9540c9b10771855c95cb2e5ae1"
+dependencies = [
+ "bytes",
+ "prost-derive",
+]
+
+[[package]]
+name = "prost-build"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03da047801ff44bb6a4d407d4860c05fd70bb81714e6b2f3812603d5b145b042"
+dependencies = [
+ "heck",
+ "itertools",
+ "log",
+ "multimap",
+ "petgraph",
+ "prettyplease",
+ "prost",
+ "prost-types",
+ "pulldown-cmark",
+ "pulldown-cmark-to-cmark",
+ "regex",
+ "syn 2.0.119",
+ "tempfile",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
+dependencies = [
+ "anyhow",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f94967dc7688f3054c7fac87473ffae4cc4c3904800e2d9f5b857246d8963b0a"
+dependencies = [
+ "prost",
+]
+
+[[package]]
+name = "protoc-bin-vendored"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1c381df33c98266b5f08186583660090a4ffa0889e76c7e9a5e175f645a67fa"
+dependencies = [
+ "protoc-bin-vendored-linux-aarch_64",
+ "protoc-bin-vendored-linux-ppcle_64",
+ "protoc-bin-vendored-linux-s390_64",
+ "protoc-bin-vendored-linux-x86_32",
+ "protoc-bin-vendored-linux-x86_64",
+ "protoc-bin-vendored-macos-aarch_64",
+ "protoc-bin-vendored-macos-x86_64",
+ "protoc-bin-vendored-win32",
+]
+
+[[package]]
+name = "protoc-bin-vendored-linux-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c350df4d49b5b9e3ca79f7e646fde2377b199e13cfa87320308397e1f37e1a4c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-ppcle_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55a63e6c7244f19b5c6393f025017eb5d793fd5467823a099740a7a4222440c"
+
+[[package]]
+name = "protoc-bin-vendored-linux-s390_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dba5565db4288e935d5330a07c264a4ee8e4a5b4a4e6f4e83fad824cc32f3b0"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8854774b24ee28b7868cd71dccaae8e02a2365e67a4a87a6cd11ee6cdbdf9cf5"
+
+[[package]]
+name = "protoc-bin-vendored-linux-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b38b07546580df720fa464ce124c4b03630a6fb83e05c336fea2a241df7e5d78"
+
+[[package]]
+name = "protoc-bin-vendored-macos-aarch_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89278a9926ce312e51f1d999fee8825d324d603213344a9a706daa009f1d8092"
+
+[[package]]
+name = "protoc-bin-vendored-macos-x86_64"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81745feda7ccfb9471d7a4de888f0652e806d5795b61480605d4943176299756"
+
+[[package]]
+name = "protoc-bin-vendored-win32"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95067976aca6421a523e491fce939a3e65249bac4b977adee0ee9771568e8aa3"
+
+[[package]]
+name = "pulldown-cmark"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
+dependencies = [
+ "bitflags 2.13.1",
+ "memchr",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-to-cmark"
+version = "22.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab1ad36992cead65f02aa399a373a42730922f1525d988172634fdefdecb8a60"
+dependencies = [
+ "pulldown-cmark",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.39.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e660451e55124f798a69a5af3f49ccfbefbd41910eefd25caf2393e1f3473ec1"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quick_cache"
+version = "0.6.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9c6658afe513a3b484e3abfdaa0d03ef3c0bbf017542c178dd55f94eb3051f9"
+dependencies = [
+ "ahash",
+ "equivalent",
+ "hashbrown 0.16.1",
+ "parking_lot",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.20",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.4.3",
+ "lru-slab",
+ "rand 0.10.2",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.20",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "radium"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
+
+[[package]]
+name = "rand"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rand_distr"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
+dependencies = [
+ "num-traits",
+ "rand 0.9.5",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
+[[package]]
+name = "rand_xoshiro"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f703f4665700daf5512dcca5f43afa6af89f09db47fb56be587f80636bda2d41"
+dependencies = [
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rangemap"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a611d15b50743feb4c76b7d03edcb0e64f399c26961e4efe6975bc398be6aa3d"
+
+[[package]]
+name = "rawpointer"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60a357793950651c4ed0f3f52338f53b2f809f32d83a07f72909fa13e4c6c1e3"
+
+[[package]]
+name = "rayon"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
+dependencies = [
+ "bitflags 2.13.1",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror 2.0.20",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "216e8f773d7923bcba9ceb86a86c93cabb3903a11872fc3f138c49630e50b96d"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9283685feec7d69af75fb0e858d5e7378f33fe4fc699383b2916ab9273e03c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "regex"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-lite"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "reqsign-aws-core"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d63b56638bb3cc7bd376a7cdce1ba3089777a08f47e4097888f2d784cc3f46c"
+dependencies = [
+ "bytes",
+ "form_urlencoded",
+ "hex",
+ "http 1.5.0",
+ "log",
+ "percent-encoding",
+ "quick-xml 0.41.0",
+ "reqsign-core",
+ "rust-ini",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sha1 0.11.0",
+]
+
+[[package]]
+name = "reqsign-aws-v4"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a0c499f4ed12d04c3d4c78fe4cb01aee22c9dae22848c14db2c6313d9df9f43"
+dependencies = [
+ "bytes",
+ "http 1.5.0",
+ "log",
+ "quick-xml 0.41.0",
+ "reqsign-aws-core",
+ "reqsign-core",
+ "serde",
+]
+
+[[package]]
+name = "reqsign-core"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4ac1510872d9481205975d264deb39c109797e5068cc882ed9064270eaae5fa"
+dependencies = [
+ "anyhow",
+ "base64 0.23.1",
+ "bytes",
+ "futures",
+ "hex",
+ "hmac",
+ "http 1.5.0",
+ "jiff",
+ "log",
+ "percent-encoding",
+ "sha1 0.11.0",
+ "sha2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "reqsign-file-read-tokio"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95c3371bfc7e5c7f9627a04133af3583fd6c28715e7c83f79db38f3b384f535f"
+dependencies = [
+ "anyhow",
+ "reqsign-core",
+ "tokio",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.4.2",
+ "web-sys",
+ "webpki-roots",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.5.0",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "roaring"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18bd8a37d17a58532776dcdf6041ce64929adca78e8489d5cacbafe99229d3e1"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+]
+
+[[package]]
+name = "rust-ini"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "796e8d2b6696392a43bea58116b667fb4c29727dc5abd27d6acf338bb4f688c7"
+dependencies = [
+ "cfg-if",
+ "ordered-multimap",
+]
+
+[[package]]
+name = "rust-stemmers"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e46a2036019fdb888131db7a4c847a1063a7493f971ed94ea82c67eada63ca54"
+dependencies = [
+ "serde",
+ "serde_derive",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags 2.13.1",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+dependencies = [
+ "aws-lc-rs",
+ "log",
+ "once_cell",
+ "ring",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "seaweed-common"
+version = "0.1.0"
+dependencies = [
+ "rustls",
+]
+
+[[package]]
+name = "seaweed-worker-core"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "aws-lc-rs",
+ "axum",
+ "base64 0.22.1",
+ "prometheus",
+ "prost",
+ "prost-types",
+ "protoc-bin-vendored",
+ "seaweed-common",
+ "tokio",
+ "tokio-stream",
+ "tonic",
+ "tonic-prost",
+ "tonic-prost-build",
+ "tracing",
+]
+
+[[package]]
+name = "seaweed-worker-sort"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "seaweed-worker-core",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags 2.13.1",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "seq-macro"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
+dependencies = [
+ "base64 0.22.1",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.14.0",
+ "jiff",
+ "schemars 0.9.0",
+ "schemars 1.2.2",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b"
+dependencies = [
+ "errno",
+ "libc",
+]
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "snafu"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e45cb604038abb7b926b679887b3226d8d0f23874b66623625a0454be425a4b7"
+dependencies = [
+ "snafu-derive",
+]
+
+[[package]]
+name = "snafu-derive"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "287f59010008f0d7cf5e3b03196d666c1acc46c8d3e9cf34c28a1a7157601e72"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "sqlparser"
+version = "0.62.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c6d1b651dc4edf07eead2a0c6c78016ce971bc2c10da5266861b13f25e7cec"
+dependencies = [
+ "log",
+ "sqlparser_derive",
+]
+
+[[package]]
+name = "sqlparser_derive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6dd45d8fc1c79299bfbb7190e42ccbbdf6a5f52e4a6ad98d92357ea965bd289"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "std_prelude"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8207e78455ffdf55661170876f88daf85356e4edd54e0a3dbc79586ca1e50cbe"
+
+[[package]]
+name = "stfu8"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51f1e89f093f99e7432c491c382b88a6860a5adbe6bf02574bf0a08efff1978"
+
+[[package]]
+name = "stop-words"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d68df56303396bcfb639455b3c166804aeb7994005010aab5e9e8a1277b8871d"
+dependencies = [
+ "serde_json",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tagptr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
+
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.3.4",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl 2.0.20",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "thread-tree"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffbd370cb847953a25954d9f63e14824a36113f8c72eecf6eccef5dc4b45d630"
+dependencies = [
+ "crossbeam-channel",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
+dependencies = [
+ "displaydoc",
+ "serde_core",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tonic"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
+dependencies = [
+ "async-trait",
+ "axum",
+ "base64 0.22.1",
+ "bytes",
+ "h2",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "hyper",
+ "hyper-timeout",
+ "hyper-util",
+ "percent-encoding",
+ "pin-project",
+ "socket2",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tokio-stream",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tonic-build"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c68f61875ac5293cf72e6c8cf0158086428c82c37229e98c840878f1706b0322"
+dependencies = [
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tonic-prost"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50849f68853be452acf590cde0b146665b8d507b3b8af17261df47e02c209ea0"
+dependencies = [
+ "bytes",
+ "prost",
+ "tonic",
+]
+
+[[package]]
+name = "tonic-prost-build"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "654e5643eff75d7f8c99197ce1440ed19a3474eada74c12bbac488b2cafdae27"
+dependencies = [
+ "prettyplease",
+ "proc-macro2",
+ "prost-build",
+ "prost-types",
+ "quote",
+ "syn 2.0.119",
+ "tempfile",
+ "tonic-build",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 2.14.0",
+ "pin-project-lite",
+ "slab",
+ "sync_wrapper",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "async-compression",
+ "bitflags 2.13.1",
+ "bytes",
+ "futures-core",
+ "futures-util",
+ "http 1.5.0",
+ "http-body 1.1.0",
+ "http-body-util",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "twox-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8464ec13c3691491391d9fce00f6416c9a48e46972f72d7865688be2080192c9"
+dependencies = [
+ "rand 0.10.2",
+]
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
+name = "utf8-ranges"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcfc827f90e53a02eaef5e535ee14266c1d569214c6aa70133a624d8a3164ba"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
+dependencies = [
+ "getrandom 0.4.3",
+ "js-sys",
+ "serde_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "vsimd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b7777d5cc23d0e91404e53ce2d5e8ec7acae3026b16233dba62cd3246457950"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c435338968042f4f59a557f690a253676d47ce13ceb55d70100e7facf6620a30"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "weed-lance-worker"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "arrow-array",
+ "arrow-cast",
+ "arrow-schema",
+ "async-trait",
+ "chrono",
+ "clap",
+ "futures",
+ "lance",
+ "lance-datafusion",
+ "lance-index",
+ "lance-linalg",
+ "lance-table",
+ "prometheus",
+ "reqwest 0.12.28",
+ "seaweed-common",
+ "seaweed-worker-core",
+ "seaweed-worker-sort",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tonic",
+ "tracing",
+ "tracing-subscriber",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "wyz"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f360fc0b24296329c78fda852a1e9ae82de9cf7b27dae4b7f62f118f77b9ed"
+dependencies = [
+ "tap",
+]
+
+[[package]]
+name = "xmlparser"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
+
+[[package]]
+name = "xxhash-rust"
+version = "0.8.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aee1b19627c7c60102ab80d3a9cbe18de90bfe03bfa6c3715447681f0e8c8af6"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556764e583adb45a9f8d413c2a147fa7e8d821e48e12b14fd560b607998b75eb"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ab42fc20575779bd240faa45f94a74256f755c0fa9e89f0ede20d91d0cdfc1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94b5c6b5976d66c1d703c4fd17d3f5e43c8cedaacf604961b171adc7130896d8"
+dependencies = [
+ "serde",
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f212a141d820099d57ffafb9569be9617a6f27d3dc881fbee8fb56642f917a9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.16+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/seaweed-worker/Cargo.toml b/seaweed-worker/Cargo.toml
new file mode 100644
index 0000000000..17f732e2a8
--- /dev/null
+++ b/seaweed-worker/Cargo.toml
@@ -0,0 +1,40 @@
+# Rust plugin workers for SeaweedFS.
+#
+# `core` is the plugin.proto contract and nothing else; a worker crate beside it
+# supplies job handlers and a binary. Adding a worker means adding a member here,
+# not touching the protocol. `sort` is neither: it is the sort specification the
+# sorting jobs share, so that two of them cannot drift on what an order means.
+[workspace]
+resolver = "2"
+members = ["crates/core", "crates/lance", "crates/sort"]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2024"
+# The edition needs 1.85; the dependency tree needs more. Verified with
+# `cargo +1.94.1 check --all-targets` (1.94.0 fails on the AWS SDK that
+# lance's `aws` feature pulls in).
+rust-version = "1.94.1"
+
+[workspace.lints.clippy]
+# Protobuf message literals keep `..Default::default()` on purpose: it is
+# what lets a proto gain a field without touching every constructor.
+needless_update = "allow"
+# Every `unsafe` block states its precondition, right above the block.
+undocumented_unsafe_blocks = "warn"
+
+[workspace.dependencies]
+anyhow = "1"
+async-trait = "0.1"
+prost = "0.14"
+prost-types = "0.14"
+tokio = { version = "1", features = ["full"] }
+tokio-stream = "0.1"
+tonic = { version = "0.14", features = ["tls-aws-lc"] }
+tonic-prost = "0.14"
+# Already in the tree via tonic; named here so the metrics server can use them.
+axum = "0.8"
+prometheus = { version = "0.13", default-features = false }
+tonic-prost-build = "0.14"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
diff --git a/seaweed-worker/README.md b/seaweed-worker/README.md
new file mode 100644
index 0000000000..9dde317711
--- /dev/null
+++ b/seaweed-worker/README.md
@@ -0,0 +1,114 @@
+# SeaweedFS Rust workers
+
+`weed/pb/plugin.proto` is a language-agnostic contract: a maintenance worker
+connects out to admin, announces the job types it can detect and execute, and
+answers requests on that one stream. `weed worker -admin=host:12535` is the Go
+implementation of it from outside the admin process. This workspace is the Rust
+one.
+
+    crates/core     the contract: stream, handshake, heartbeat, registry, config forms
+    crates/lance    maintenance jobs for Lance tables, and a binary
+
+It also depends on `../seaweed-common`, a small crate outside this workspace
+holding the few helpers the Rust volume server needs identically — the
+HTTP<->gRPC address rule and the rustls provider choice.
+
+`core` knows nothing about any job. A second worker is a new crate beside
+`lance` that depends on it, not a fork of the protocol.
+
+## Building
+
+Requires Rust 1.94.1+ (2024 edition), matching `rust-version` in `Cargo.toml`.
+The patch release matters: 1.94.0 does not build. The edition itself only needs
+1.85; the higher floor comes from the dependency tree — lance's `aws` feature
+pulls in the AWS SDK — so it moves with those crates. CI builds on the latest
+stable.
+
+`core` compiles `plugin.proto` with the protoc that protoc-bin-vendored ships,
+the way seaweed-volume does, so it needs no system install.
+
+The lance crates compile protos of their own, in their own build-script
+processes, which nothing our build script sets can reach. They need a protoc of
+their own: either one on PATH — `brew install protobuf`, `apt install
+protobuf-compiler` — or `PROTOC` naming one. CI points it at the vendored
+binary for the runner's platform, resolved from the version in `Cargo.lock`.
+
+## Running
+
+    cargo run -p weed-lance-worker -- --admin 127.0.0.1:12535
+
+The admin's *HTTP* address is what an operator has; the gRPC port is derived
+from it the way the Go side does. Dialling the HTTP port fails as "frame with
+invalid size", which reads like a protocol bug rather than a wrong port.
+
+The binary is `weed-worker`, not `weed-lance-worker`: it is the Rust side of
+`weed worker`, and lance is the first family of jobs it carries rather than the
+only one it ever will.
+
+Released builds do not need a toolchain. The worker ships inside the SeaweedFS
+image, beside the Rust volume server, under the verb that mirrors
+`volume-rust`:
+
+    docker run chrislusf/seaweedfs worker-rust --admin admin:12535
+
+and as `weed-worker_linux_{amd64,arm64}.tar.gz` on each GitHub release. Both are
+linux amd64/arm64 only — lance, arrow and datafusion make every extra target an
+expensive build, and the worker runs beside the cluster it maintains. On an
+architecture without a build the image carries an empty placeholder and the
+entrypoint says so rather than failing as "not found".
+
+## Metrics
+
+    cargo run -p weed-lance-worker -- --admin 127.0.0.1:12535 --metrics-port 9328
+
+Serves `/health`, `/ready` and `/metrics` on that port, the same three the Go
+worker serves under `weed worker -metricsPort`, so one scrape config covers
+workers in either language. Off by default, and bound to loopback unless
+`--metrics-ip` says otherwise, because the endpoint is unauthenticated. 9328
+continues the series the other components use (master 9324, volume 9325, filer
+9326, s3 9327); an IPv6 address works with or without brackets.
+
+Grafana: the "Plugin Workers" row of `other/metrics/grafana_seaweedfs.json`
+graphs these. Its panels filter on `$cluster`, which comes from the scrape job's
+labels, so scrape the worker the way the rest of the cluster is scraped or the
+row stays empty.
+
+Names are `SeaweedFS_worker_*`, matching the Go side's convention. The pair
+worth alerting on is `objects_seen_total` and `objects_skipped_total`: a sweep
+that proposes nothing and a sweep that could read nothing look identical from
+`proposals_total` alone.
+
+    SeaweedFS_worker_connected 1
+    SeaweedFS_worker_objects_seen_total{job_type="lance_compact"} 7
+    SeaweedFS_worker_proposals_total{job_type="lance_compact"} 2
+    SeaweedFS_worker_jobs_total{job_type="lance_compact",result="ok"} 2
+    SeaweedFS_worker_lance_fragments_removed_total 25
+
+`/ready` follows the control stream: a worker whose admin has gone away is
+running but is not going to do anything.
+
+## Credentials
+
+The worker holds none. It asks the namespace to describe a table with
+`vend_credentials` and hands the `storage_options` that come back to lance. A
+gateway without STS configured vends no credentials at all, so `--access-key`
+and `--secret-key` supply a fallback; anything the namespace does vend wins over
+them.
+
+## State
+
+All three jobs are implemented and tested end to end against a live gateway:
+
+    compaction result: 12 fragments became 1
+    reindex result:    512 uncovered rows became 0
+    cleanup result:    removed 14 versions and 24272 bytes
+
+`cargo test -p weed-lance-worker` runs them when `WEED_LANCE_NAMESPACE` names a
+live namespace and skips otherwise, the way the Go integration tests skip
+without Docker. Each test seeds the table it needs, including building a vector
+index and then appending rows outside it, so a run does not depend on what the
+previous one left behind — the first version of these did, and quietly stopped
+testing anything once it had done its job.
+
+The handshake, descriptor exchange and heartbeat work against a live admin,
+which logs the worker connecting and prefetches all three descriptors.
diff --git a/seaweed-worker/crates/core/Cargo.toml b/seaweed-worker/crates/core/Cargo.toml
new file mode 100644
index 0000000000..d75d5b9a4f
--- /dev/null
+++ b/seaweed-worker/crates/core/Cargo.toml
@@ -0,0 +1,39 @@
+[package]
+name = "seaweed-worker-core"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "SeaweedFS plugin.proto worker contract"
+
+[lib]
+name = "seaweed_worker_core"
+
+[dependencies]
+# Helpers the Rust volume server needs as well. A path dependency because
+# the two trees are separate cargo workspaces with no common root manifest.
+seaweed-common = { path = "../../../seaweed-common" }
+# Already in the graph through tonic's `tls-aws-lc` feature; named here so the
+# admin token can sign with the same HMAC the Go worker uses.
+aws-lc-rs = "1"
+base64 = "0.22"
+anyhow.workspace = true
+async-trait.workspace = true
+prost.workspace = true
+prost-types.workspace = true
+tokio.workspace = true
+tokio-stream.workspace = true
+tonic.workspace = true
+tonic-prost.workspace = true
+axum.workspace = true
+prometheus.workspace = true
+tracing.workspace = true
+
+[build-dependencies]
+tonic-prost-build.workspace = true
+# Ships protoc with the build so neither CI nor a developer needs a system
+# install, and so the version is pinned rather than whatever the platform's
+# package manager happens to carry. The same crate seaweed-volume uses.
+protoc-bin-vendored = "3"
+
+[lints]
+workspace = true
diff --git a/seaweed-worker/crates/core/build.rs b/seaweed-worker/crates/core/build.rs
new file mode 100644
index 0000000000..e775fcb816
--- /dev/null
+++ b/seaweed-worker/crates/core/build.rs
@@ -0,0 +1,25 @@
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // Use the protoc that ships with protoc-bin-vendored rather than a system
+    // one, so the build needs no package manager and always sees the same
+    // version. An explicit PROTOC still wins, for packagers supplying their own
+    // and for the lance crates, whose own build scripts read the same variable.
+    if std::env::var_os("PROTOC").is_none() {
+        // SAFETY: a build script's main runs single-threaded before anything
+        // else in this process, so no other thread can be reading the
+        // environment concurrently.
+        unsafe {
+            std::env::set_var("PROTOC", protoc_bin_vendored::protoc_bin_path()?);
+        }
+    }
+
+    // Compiled straight out of the Go tree, the way seaweed-volume already reads
+    // filer.proto, so the contract cannot drift from a vendored copy.
+    tonic_prost_build::configure()
+        // The server half is only for tests, which stand up a fake admin.
+        .build_server(true)
+        .build_client(true)
+        .protoc_arg("--experimental_allow_proto3_optional")
+        .compile_protos(&["../../../weed/pb/plugin.proto"], &["../../../weed/pb/"])?;
+    println!("cargo:rerun-if-changed=../../../weed/pb/plugin.proto");
+    Ok(())
+}
diff --git a/seaweed-worker/crates/core/src/address.rs b/seaweed-worker/crates/core/src/address.rs
new file mode 100644
index 0000000000..f819fb70d3
--- /dev/null
+++ b/seaweed-worker/crates/core/src/address.rs
@@ -0,0 +1,63 @@
+//! SeaweedFS addresses the way the Go tree does.
+//!
+//! An operator gives a worker the admin's HTTP address, and the gRPC port is
+//! derived from it rather than asked for separately. Dialling the HTTP port
+//! instead fails as "frame with invalid size", which reads like a protocol bug
+//! rather than a wrong port, so getting this right is worth its own module.
+//! Mirrors pb.ServerToGrpcAddress in weed/pb/grpc_client_server.go.
+//!
+//! The rule itself now lives in `seaweed_common::address`, shared with the Rust
+//! volume server, which had its own copy of it. What stays here is the `Option`
+//! shape this crate's callers expect, and the tests that pin it.
+
+/// Converts `host:port` to the gRPC address, and accepts the explicit
+/// `host:port.grpcPort` form the Go side also understands.
+pub fn server_to_grpc_address(server: &str) -> Option<String> {
+    seaweed_common::address::to_grpc_address(server).ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::server_to_grpc_address;
+
+    #[test]
+    fn derives_the_grpc_port() {
+        assert_eq!(
+            server_to_grpc_address("localhost:23646").as_deref(),
+            Some("localhost:33646")
+        );
+        assert_eq!(
+            server_to_grpc_address("127.0.0.1:9333").as_deref(),
+            Some("127.0.0.1:19333")
+        );
+    }
+
+    #[test]
+    fn honours_an_explicit_grpc_port() {
+        assert_eq!(
+            server_to_grpc_address("localhost:23646.33999").as_deref(),
+            Some("localhost:33999")
+        );
+    }
+
+    #[test]
+    fn brackets_ipv6_literals() {
+        assert_eq!(
+            server_to_grpc_address("::1:23646").as_deref(),
+            Some("[::1]:33646")
+        );
+    }
+
+    #[test]
+    fn rejects_what_it_cannot_parse() {
+        assert!(server_to_grpc_address("localhost").is_none());
+        assert!(server_to_grpc_address("localhost:notaport").is_none());
+    }
+
+    #[test]
+    fn rejects_a_dotted_form_whose_http_port_is_not_a_port() {
+        // Tightened by the move to seaweed-common: this copy used to ignore the
+        // HTTP port of the dotted form and answer Some("host:18080").
+        assert!(server_to_grpc_address("host:abc.18080").is_none());
+    }
+}
diff --git a/seaweed-worker/crates/core/src/config.rs b/seaweed-worker/crates/core/src/config.rs
new file mode 100644
index 0000000000..af3742c15e
--- /dev/null
+++ b/seaweed-worker/crates/core/src/config.rs
@@ -0,0 +1,60 @@
+use std::time::Duration;
+
+/// How one worker process connects and how much work it will take on.
+#[derive(Clone, Debug)]
+pub struct WorkerOptions {
+    /// Admin gRPC address, e.g. "localhost:12535".
+    pub admin_address: String,
+    pub worker_id: String,
+    pub worker_version: String,
+    /// Advertised address; empty when the worker takes no inbound connections.
+    pub worker_address: String,
+    pub heartbeat_interval: Duration,
+    pub reconnect_delay: Duration,
+    pub max_detection_concurrency: i32,
+    pub max_execution_concurrency: i32,
+    /// mTLS for the control stream, mirroring the Go worker's `[grpc.worker]`
+    /// section of security.toml. None means plaintext, which is the default the
+    /// Go worker also takes when no certificates are configured.
+    pub tls: Option<TlsOptions>,
+    /// The shared secret the admin stream requires when the cluster configures
+    /// `jwt.filer_signing.key`; mirrored from that config value. Empty means no
+    /// token is attached, which only works against admins that either bound
+    /// their worker listener to loopback or authenticate with mTLS instead.
+    pub signing_key: Option<String>,
+    /// Seconds the minted admin token lives, mirroring
+    /// `jwt.filer_signing.expires_after_seconds`. Zero mints a token without an
+    /// expiry, matching the Go default.
+    pub signing_key_expires_after_seconds: u64,
+}
+
+/// Certificates for the control stream. All three are required together: the
+/// cluster's gRPC TLS is mutual, so a CA without a client identity gets refused
+/// by admin rather than falling back to one-way TLS.
+#[derive(Clone, Debug)]
+pub struct TlsOptions {
+    pub ca_path: String,
+    pub client_cert_path: String,
+    pub client_key_path: String,
+    /// Name to verify the server certificate against, when the address a worker
+    /// dials is not the name the certificate carries.
+    pub server_name: Option<String>,
+}
+
+impl Default for WorkerOptions {
+    fn default() -> Self {
+        Self {
+            admin_address: "localhost:12535".to_string(),
+            worker_id: String::new(),
+            worker_version: env!("CARGO_PKG_VERSION").to_string(),
+            worker_address: String::new(),
+            heartbeat_interval: Duration::from_secs(10),
+            reconnect_delay: Duration::from_secs(5),
+            max_detection_concurrency: 1,
+            max_execution_concurrency: 1,
+            tls: None,
+            signing_key: None,
+            signing_key_expires_after_seconds: 0,
+        }
+    }
+}
diff --git a/seaweed-worker/crates/core/src/config_form.rs b/seaweed-worker/crates/core/src/config_form.rs
new file mode 100644
index 0000000000..ceb7db70b6
--- /dev/null
+++ b/seaweed-worker/crates/core/src/config_form.rs
@@ -0,0 +1,106 @@
+//! Builders for the config forms a worker returns in its JobTypeDescriptor.
+//!
+//! Admin renders these into the job's settings page, so a worker written in any
+//! language gets a UI without touching Go or templ. That only holds if the
+//! field types and defaults are right, which is why they are built here rather
+//! than spelled out at each call site.
+
+use std::collections::HashMap;
+
+use crate::pb::{
+    ConfigField, ConfigFieldType, ConfigForm, ConfigSection, ConfigValue, config_value::Kind,
+};
+
+pub fn int_value(value: i64) -> ConfigValue {
+    ConfigValue {
+        kind: Some(Kind::Int64Value(value)),
+    }
+}
+
+pub fn bool_value(value: bool) -> ConfigValue {
+    ConfigValue {
+        kind: Some(Kind::BoolValue(value)),
+    }
+}
+
+pub fn string_value(value: impl Into<String>) -> ConfigValue {
+    ConfigValue {
+        kind: Some(Kind::StringValue(value.into())),
+    }
+}
+
+/// Reads an integer a request carried, falling back when admin sent nothing.
+pub fn int_or(values: &HashMap<String, ConfigValue>, name: &str, fallback: i64) -> i64 {
+    match values.get(name).and_then(|v| v.kind.as_ref()) {
+        Some(Kind::Int64Value(value)) => *value,
+        Some(Kind::DoubleValue(value)) => *value as i64,
+        _ => fallback,
+    }
+}
+
+pub fn bool_or(values: &HashMap<String, ConfigValue>, name: &str, fallback: bool) -> bool {
+    match values.get(name).and_then(|v| v.kind.as_ref()) {
+        Some(Kind::BoolValue(value)) => *value,
+        _ => fallback,
+    }
+}
+
+pub fn string_or(values: &HashMap<String, ConfigValue>, name: &str, fallback: &str) -> String {
+    match values.get(name).and_then(|v| v.kind.as_ref()) {
+        Some(Kind::StringValue(value)) if !value.is_empty() => value.clone(),
+        _ => fallback.to_string(),
+    }
+}
+
+pub fn number_field(name: &str, label: &str, description: &str, min: i64, max: i64) -> ConfigField {
+    ConfigField {
+        name: name.to_string(),
+        label: label.to_string(),
+        description: description.to_string(),
+        field_type: ConfigFieldType::Int64 as i32,
+        min_value: Some(int_value(min)),
+        max_value: Some(int_value(max)),
+        ..Default::default()
+    }
+}
+
+pub fn text_field(name: &str, label: &str, description: &str, placeholder: &str) -> ConfigField {
+    ConfigField {
+        name: name.to_string(),
+        label: label.to_string(),
+        description: description.to_string(),
+        field_type: ConfigFieldType::String as i32,
+        placeholder: placeholder.to_string(),
+        ..Default::default()
+    }
+}
+
+pub fn bool_field(name: &str, label: &str, description: &str) -> ConfigField {
+    ConfigField {
+        name: name.to_string(),
+        label: label.to_string(),
+        description: description.to_string(),
+        field_type: ConfigFieldType::Bool as i32,
+        ..Default::default()
+    }
+}
+
+pub fn form(
+    form_id: &str,
+    title: &str,
+    fields: Vec<ConfigField>,
+    defaults: HashMap<String, ConfigValue>,
+) -> ConfigForm {
+    ConfigForm {
+        form_id: form_id.to_string(),
+        title: title.to_string(),
+        description: String::new(),
+        sections: vec![ConfigSection {
+            section_id: format!("{form_id}-main"),
+            title: title.to_string(),
+            description: String::new(),
+            fields,
+        }],
+        default_values: defaults,
+    }
+}
diff --git a/seaweed-worker/crates/core/src/lib.rs b/seaweed-worker/crates/core/src/lib.rs
new file mode 100644
index 0000000000..d297a7b2f1
--- /dev/null
+++ b/seaweed-worker/crates/core/src/lib.rs
@@ -0,0 +1,30 @@
+//! The SeaweedFS plugin worker contract, in Rust.
+//!
+//! `weed/pb/plugin.proto` is a language-agnostic gRPC stream: a worker connects
+//! out to admin, announces the job types it can detect and execute, and then
+//! answers requests on that one stream. `weed worker -admin=host:12535` is the
+//! Go implementation of the same contract from outside the admin process; this
+//! is the Rust one, and it knows nothing about any particular job.
+
+pub mod address;
+pub mod config;
+pub mod config_form;
+pub mod metrics;
+pub mod registry;
+pub mod senders;
+pub mod stream;
+pub mod token;
+
+/// Generated plugin.proto types.
+pub mod pb {
+    // prost gives every oneof its own enum; the variant sizes are the
+    // messages' own, not a choice made here.
+    #![allow(clippy::large_enum_variant)]
+    tonic::include_proto!("plugin");
+}
+
+pub use config::{TlsOptions, WorkerOptions};
+pub use metrics::Metrics;
+pub use registry::{JobHandler, Preview, PreviewProvider, Registry};
+pub use senders::{DetectionSender, ExecutionSender};
+pub use stream::run;
diff --git a/seaweed-worker/crates/core/src/metrics.rs b/seaweed-worker/crates/core/src/metrics.rs
new file mode 100644
index 0000000000..e6b57a10fe
--- /dev/null
+++ b/seaweed-worker/crates/core/src/metrics.rs
@@ -0,0 +1,404 @@
+//! What a worker will say about itself when nobody is watching the logs.
+//!
+//! The Go plugin worker serves `/health`, `/ready` and `/metrics` on an optional
+//! port (`weed worker -metricsPort`); this is the same contract, so one scrape
+//! config covers workers in either language. Names follow the Go side's
+//! convention, `SeaweedFS_<subsystem>_<name>`, under a `worker` subsystem that
+//! nothing else uses.
+//!
+//! Nothing here is Lance-specific. A worker for another format registers its own
+//! collectors on the same registry and gets the same endpoint.
+
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+use prometheus::{
+    Encoder, HistogramOpts, HistogramVec, IntCounter, IntCounterVec, IntGauge, IntGaugeVec, Opts,
+    Registry, TextEncoder,
+};
+use std::sync::atomic::{AtomicBool, Ordering};
+use tracing::{info, warn};
+
+const NAMESPACE: &str = "SeaweedFS";
+const SUBSYSTEM: &str = "worker";
+
+/// The metrics one worker process publishes, and the registry they live on.
+///
+/// Cloneable because the stream loop, the job handlers and the HTTP server all
+/// hold it; everything inside is already shared.
+#[derive(Clone)]
+pub struct Metrics {
+    registry: Registry,
+    connected: IntGauge,
+    connects: IntCounterVec,
+    slots_used: IntGaugeVec,
+    slots_total: IntGaugeVec,
+    detections: IntCounterVec,
+    detection_seconds: HistogramVec,
+    proposals: IntCounterVec,
+    objects_seen: IntCounterVec,
+    objects_skipped: IntCounterVec,
+    jobs: IntCounterVec,
+    job_seconds: HistogramVec,
+    previews: IntCounterVec,
+    ready: Arc<AtomicBool>,
+}
+
+impl Metrics {
+    pub fn new(worker_id: &str, worker_version: &str) -> Result<Self> {
+        let registry = Registry::new();
+
+        // Build info as a constant 1, the way the Go side does it, so a scrape
+        // can tell which worker and which build answered.
+        let build = IntGaugeVec::new(
+            Opts::new("build_info", "Worker build information.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM),
+            &["worker_id", "version"],
+        )?;
+        build.with_label_values(&[worker_id, worker_version]).set(1);
+        registry.register(Box::new(build))?;
+
+        let connected = IntGauge::with_opts(
+            Opts::new("connected", "1 while the admin control stream is up.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM),
+        )?;
+        let connects = IntCounterVec::new(
+            Opts::new(
+                "stream_events_total",
+                "Control stream lifecycle events by outcome (connected, closed, failed, shutdown).",
+            )
+            .namespace(NAMESPACE)
+            .subsystem(SUBSYSTEM),
+            &["event"],
+        )?;
+        let slots_used = IntGaugeVec::new(
+            Opts::new("slots_used", "Slots currently held, by lane.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM),
+            &["lane"],
+        )?;
+        let slots_total = IntGaugeVec::new(
+            Opts::new("slots_total", "Slots this worker advertises, by lane.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM),
+            &["lane"],
+        )?;
+        let detections = IntCounterVec::new(
+            Opts::new(
+                "detections_total",
+                "Detection sweeps by job type and outcome.",
+            )
+            .namespace(NAMESPACE)
+            .subsystem(SUBSYSTEM),
+            &["job_type", "result"],
+        )?;
+        let detection_seconds = HistogramVec::new(
+            HistogramOpts::new("detection_seconds", "How long a detection sweep took.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM)
+                .buckets(prometheus::exponential_buckets(0.01, 2.0, 14)?),
+            &["job_type"],
+        )?;
+        let proposals = IntCounterVec::new(
+            Opts::new("proposals_total", "Jobs proposed to admin, by job type.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM),
+            &["job_type"],
+        )?;
+        let objects_seen = IntCounterVec::new(
+            Opts::new(
+                "objects_seen_total",
+                "Objects a detection sweep read, by job type.",
+            )
+            .namespace(NAMESPACE)
+            .subsystem(SUBSYSTEM),
+            &["job_type"],
+        )?;
+        let objects_skipped = IntCounterVec::new(
+            Opts::new(
+                "objects_skipped_total",
+                "Objects a sweep could not read, by job type and reason. A sweep that \
+                 proposes nothing looks the same as one that could read nothing; this is \
+                 what tells them apart.",
+            )
+            .namespace(NAMESPACE)
+            .subsystem(SUBSYSTEM),
+            &["job_type", "reason"],
+        )?;
+        let jobs = IntCounterVec::new(
+            Opts::new("jobs_total", "Jobs executed by job type and outcome.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM),
+            &["job_type", "result"],
+        )?;
+        let job_seconds = HistogramVec::new(
+            HistogramOpts::new("job_seconds", "How long a job took to run.")
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM)
+                .buckets(prometheus::exponential_buckets(0.05, 2.0, 16)?),
+            &["job_type"],
+        )?;
+        let previews = IntCounterVec::new(
+            Opts::new(
+                "previews_total",
+                "Object previews served to admin, by outcome.",
+            )
+            .namespace(NAMESPACE)
+            .subsystem(SUBSYSTEM),
+            &["result"],
+        )?;
+
+        for collector in [
+            Box::new(connected.clone()) as Box<dyn prometheus::core::Collector>,
+            Box::new(connects.clone()),
+            Box::new(slots_used.clone()),
+            Box::new(slots_total.clone()),
+            Box::new(detections.clone()),
+            Box::new(detection_seconds.clone()),
+            Box::new(proposals.clone()),
+            Box::new(objects_seen.clone()),
+            Box::new(objects_skipped.clone()),
+            Box::new(jobs.clone()),
+            Box::new(job_seconds.clone()),
+            Box::new(previews.clone()),
+        ] {
+            registry.register(collector)?;
+        }
+
+        Ok(Self {
+            registry,
+            connected,
+            connects,
+            slots_used,
+            slots_total,
+            detections,
+            detection_seconds,
+            proposals,
+            objects_seen,
+            objects_skipped,
+            jobs,
+            job_seconds,
+            previews,
+            ready: Arc::new(AtomicBool::new(false)),
+        })
+    }
+
+    /// The registry, so a worker can add collectors of its own.
+    pub fn registry(&self) -> &Registry {
+        &self.registry
+    }
+
+    pub fn stream_connected(&self) {
+        self.connected.set(1);
+        self.ready.store(true, Ordering::Relaxed);
+        self.connects.with_label_values(&["connected"]).inc();
+    }
+
+    /// `event` is why the stream ended: closed, failed, or shutdown.
+    pub fn stream_ended(&self, event: &str) {
+        self.connected.set(0);
+        self.ready.store(false, Ordering::Relaxed);
+        self.connects.with_label_values(&[event]).inc();
+    }
+
+    pub fn set_slots(&self, lane: &str, used: i64, total: i64) {
+        self.slots_used.with_label_values(&[lane]).set(used);
+        self.slots_total.with_label_values(&[lane]).set(total);
+    }
+
+    pub fn detection_finished(&self, job_type: &str, result: &str, seconds: f64, proposals: usize) {
+        self.detections
+            .with_label_values(&[job_type, result])
+            .inc_by(1);
+        self.detection_seconds
+            .with_label_values(&[job_type])
+            .observe(seconds);
+        self.proposals
+            .with_label_values(&[job_type])
+            .inc_by(proposals as u64);
+    }
+
+    pub fn object_seen(&self, job_type: &str) {
+        self.objects_seen.with_label_values(&[job_type]).inc();
+    }
+
+    pub fn object_skipped(&self, job_type: &str, reason: &str) {
+        self.objects_skipped
+            .with_label_values(&[job_type, reason])
+            .inc();
+    }
+
+    pub fn job_finished(&self, job_type: &str, result: &str, seconds: f64) {
+        self.jobs.with_label_values(&[job_type, result]).inc();
+        self.job_seconds
+            .with_label_values(&[job_type])
+            .observe(seconds);
+    }
+
+    pub fn preview_finished(&self, result: &str) {
+        self.previews.with_label_values(&[result]).inc();
+    }
+
+    /// A counter this worker's own jobs can raise, e.g. fragments removed.
+    /// Registered lazily so a format's numbers live beside the generic ones
+    /// without core having to know what they are.
+    pub fn counter(&self, name: &str, help: &str) -> Result<IntCounter> {
+        let counter = IntCounter::with_opts(
+            Opts::new(name, help)
+                .namespace(NAMESPACE)
+                .subsystem(SUBSYSTEM),
+        )?;
+        self.registry.register(Box::new(counter.clone()))?;
+        Ok(counter)
+    }
+
+    fn gather(&self) -> Result<String> {
+        let mut buffer = Vec::new();
+        TextEncoder::new().encode(&self.registry.gather(), &mut buffer)?;
+        Ok(String::from_utf8(buffer)?)
+    }
+
+    fn is_ready(&self) -> bool {
+        self.ready.load(Ordering::Relaxed)
+    }
+}
+
+/// Serves the metrics endpoints until the process stops. Failing to bind is
+/// logged rather than fatal: a worker that cannot publish metrics should still
+/// do its work.
+pub async fn serve(metrics: Metrics, addr: SocketAddr) -> Result<()> {
+    use axum::Router;
+    use axum::extract::State;
+    use axum::http::StatusCode;
+    use axum::routing::get;
+
+    let app = Router::new()
+        .route("/health", get(|| async { StatusCode::OK }))
+        .route(
+            "/ready",
+            get(|State(metrics): State<Metrics>| async move {
+                if metrics.is_ready() {
+                    StatusCode::OK
+                } else {
+                    StatusCode::SERVICE_UNAVAILABLE
+                }
+            }),
+        )
+        .route(
+            "/metrics",
+            get(|State(metrics): State<Metrics>| async move {
+                match metrics.gather() {
+                    Ok(body) => (StatusCode::OK, body),
+                    Err(err) => (StatusCode::INTERNAL_SERVER_ERROR, format!("{err:#}")),
+                }
+            }),
+        )
+        .with_state(metrics);
+
+    let listener = tokio::net::TcpListener::bind(addr)
+        .await
+        .with_context(|| format!("bind the metrics server to {addr}"))?;
+    info!("serving worker metrics on http://{addr}/metrics");
+    axum::serve(listener, app)
+        .await
+        .context("metrics server stopped")
+}
+
+/// Starts the metrics server in the background, warning rather than failing when
+/// it cannot start.
+pub fn spawn(metrics: Metrics, addr: SocketAddr) {
+    tokio::spawn(async move {
+        if let Err(err) = serve(metrics, addr).await {
+            warn!("worker metrics server: {err:#}");
+        }
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn metrics() -> Metrics {
+        Metrics::new("worker-1", "0.1.0").expect("build metrics")
+    }
+
+    // A scrape has to be able to tell these apart: a worker that swept and found
+    // nothing to do, and one that could not read anything it swept.
+    #[test]
+    fn a_sweep_reports_what_it_read_and_what_it_could_not() {
+        let metrics = metrics();
+        metrics.object_seen("lance_compact");
+        metrics.object_seen("lance_compact");
+        metrics.object_skipped("lance_compact", "open");
+        metrics.detection_finished("lance_compact", "ok", 0.5, 0);
+
+        let text = metrics.gather().expect("gather");
+        assert!(text.contains("SeaweedFS_worker_objects_seen_total{job_type=\"lance_compact\"} 2"));
+        assert!(text.contains(
+            "SeaweedFS_worker_objects_skipped_total{job_type=\"lance_compact\",reason=\"open\"} 1"
+        ));
+        assert!(text.contains(
+            "SeaweedFS_worker_detections_total{job_type=\"lance_compact\",result=\"ok\"} 1"
+        ));
+        assert!(text.contains("SeaweedFS_worker_proposals_total{job_type=\"lance_compact\"} 0"));
+    }
+
+    // /ready follows the stream, because a worker with no admin behind it is
+    // running but not doing anything.
+    #[test]
+    fn readiness_follows_the_stream() {
+        let metrics = metrics();
+        assert!(!metrics.is_ready(), "not ready before the stream is up");
+
+        metrics.stream_connected();
+        assert!(metrics.is_ready());
+        assert!(
+            metrics
+                .gather()
+                .unwrap()
+                .contains("SeaweedFS_worker_connected 1")
+        );
+
+        metrics.stream_ended("closed");
+        assert!(!metrics.is_ready());
+        assert!(
+            metrics
+                .gather()
+                .unwrap()
+                .contains("SeaweedFS_worker_connected 0")
+        );
+        assert!(
+            metrics
+                .gather()
+                .unwrap()
+                .contains("SeaweedFS_worker_stream_events_total{event=\"closed\"} 1")
+        );
+    }
+
+    #[test]
+    fn build_info_names_the_worker() {
+        let text = metrics().gather().expect("gather");
+        assert!(
+            text.contains(
+                "SeaweedFS_worker_build_info{version=\"0.1.0\",worker_id=\"worker-1\"} 1"
+            )
+        );
+    }
+
+    // A format's own numbers land on the same registry, so one endpoint serves
+    // both and a second worker implementation needs no new plumbing.
+    #[test]
+    fn a_worker_can_add_counters_of_its_own() {
+        let metrics = metrics();
+        let counter = metrics
+            .counter("lance_fragments_removed_total", "Fragments merged away.")
+            .expect("register");
+        counter.inc_by(16);
+
+        let text = metrics.gather().expect("gather");
+        assert!(text.contains("SeaweedFS_worker_lance_fragments_removed_total 16"));
+    }
+}
diff --git a/seaweed-worker/crates/core/src/registry.rs b/seaweed-worker/crates/core/src/registry.rs
new file mode 100644
index 0000000000..897aa0a42c
--- /dev/null
+++ b/seaweed-worker/crates/core/src/registry.rs
@@ -0,0 +1,89 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use anyhow::Result;
+use async_trait::async_trait;
+
+use crate::pb::{ExecuteJobRequest, JobTypeCapability, JobTypeDescriptor, RunDetectionRequest};
+use crate::senders::{DetectionSender, ExecutionSender};
+
+/// One job type, worker side. Mirrors the Go JobHandler interface in
+/// weed/plugin/worker/worker.go so the two stay readable against each other.
+#[async_trait]
+pub trait JobHandler: Send + Sync {
+    fn capability(&self) -> JobTypeCapability;
+    /// The descriptor admin renders as this job's settings page.
+    fn descriptor(&self) -> JobTypeDescriptor;
+    async fn detect(
+        &self,
+        request: &RunDetectionRequest,
+        sender: &dyn DetectionSender,
+    ) -> Result<()>;
+    async fn execute(
+        &self,
+        request: &ExecuteJobRequest,
+        sender: &dyn ExecutionSender,
+    ) -> Result<()>;
+}
+
+/// Sample rows of one object, already rendered as text. The worker formats
+/// them because it is the only side that knows the object's types.
+pub struct Preview {
+    pub columns: Vec<String>,
+    pub rows: Vec<Vec<String>>,
+    /// Rows in the object, which is not the number sampled.
+    pub total_rows: i64,
+}
+
+/// Reads sample rows of a format admin cannot parse itself.
+///
+/// This is deliberately not a JobHandler: a preview is answered while someone
+/// waits on a page, so it neither schedules nor reports progress.
+#[async_trait]
+pub trait PreviewProvider: Send + Sync {
+    /// The format this provider reads, matched case-insensitively against what
+    /// the catalog recorded.
+    fn format(&self) -> &str;
+    async fn preview(&self, object_id: &[String], row_limit: usize) -> Result<Preview>;
+}
+
+/// The handlers one worker process serves. A process may serve several job
+/// types, which is why WorkerHello carries a list of capabilities.
+#[derive(Default, Clone)]
+pub struct Registry {
+    handlers: HashMap<String, Arc<dyn JobHandler>>,
+    previews: HashMap<String, Arc<dyn PreviewProvider>>,
+}
+
+impl Registry {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn register(mut self, handler: Arc<dyn JobHandler>) -> Self {
+        self.handlers.insert(handler.capability().job_type, handler);
+        self
+    }
+
+    pub fn with_preview(mut self, provider: Arc<dyn PreviewProvider>) -> Self {
+        self.previews
+            .insert(provider.format().to_ascii_uppercase(), provider);
+        self
+    }
+
+    pub fn get(&self, job_type: &str) -> Option<Arc<dyn JobHandler>> {
+        self.handlers.get(job_type).cloned()
+    }
+
+    pub fn preview_provider(&self, format: &str) -> Option<Arc<dyn PreviewProvider>> {
+        self.previews.get(&format.to_ascii_uppercase()).cloned()
+    }
+
+    pub fn capabilities(&self) -> Vec<JobTypeCapability> {
+        self.handlers.values().map(|h| h.capability()).collect()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.handlers.is_empty()
+    }
+}
diff --git a/seaweed-worker/crates/core/src/senders.rs b/seaweed-worker/crates/core/src/senders.rs
new file mode 100644
index 0000000000..bd1b8d1ed4
--- /dev/null
+++ b/seaweed-worker/crates/core/src/senders.rs
@@ -0,0 +1,203 @@
+use anyhow::Result;
+use tokio::sync::mpsc;
+
+use crate::pb::{
+    ActivityEvent, DetectionComplete, DetectionProposals, JobCompleted, JobProgressUpdate,
+    WorkerObservations, WorkerToAdminMessage, worker_to_admin_message::Body,
+};
+
+/// Replies to one detection request.
+pub trait DetectionSender: Send + Sync {
+    fn send_proposals(&self, proposals: DetectionProposals) -> Result<()>;
+    fn send_complete(&self, complete: DetectionComplete) -> Result<()>;
+    fn send_activity(&self, activity: ActivityEvent) -> Result<()>;
+    /// Reports what the worker saw while deciding. Admin caches the last one
+    /// per object and serves it back for display; nothing is scheduled from it.
+    fn send_observations(&self, observations: WorkerObservations) -> Result<()>;
+}
+
+/// Replies to one execution request.
+pub trait ExecutionSender: Send + Sync {
+    fn send_progress(&self, progress: JobProgressUpdate) -> Result<()>;
+    fn send_completed(&self, completed: JobCompleted) -> Result<()>;
+}
+
+/// Both senders write to the single outbound stream, so they share one channel.
+#[derive(Clone)]
+pub struct StreamSender {
+    worker_id: String,
+    tx: mpsc::UnboundedSender<WorkerToAdminMessage>,
+}
+
+impl StreamSender {
+    pub fn new(worker_id: String, tx: mpsc::UnboundedSender<WorkerToAdminMessage>) -> Self {
+        Self { worker_id, tx }
+    }
+
+    pub fn send(&self, body: Body) -> Result<()> {
+        self.tx.send(WorkerToAdminMessage {
+            worker_id: self.worker_id.clone(),
+            sent_at: Some(std::time::SystemTime::now().into()),
+            body: Some(body),
+        })?;
+        Ok(())
+    }
+}
+
+impl DetectionSender for StreamSender {
+    fn send_proposals(&self, proposals: DetectionProposals) -> Result<()> {
+        self.send(Body::DetectionProposals(proposals))
+    }
+
+    fn send_complete(&self, complete: DetectionComplete) -> Result<()> {
+        self.send(Body::DetectionComplete(complete))
+    }
+
+    fn send_activity(&self, _activity: ActivityEvent) -> Result<()> {
+        // Activity rides inside progress and completion messages rather than
+        // being a body of its own, so there is nothing to send on its own here.
+        Ok(())
+    }
+
+    fn send_observations(&self, observations: WorkerObservations) -> Result<()> {
+        self.send(Body::Observations(observations))
+    }
+}
+
+impl ExecutionSender for StreamSender {
+    fn send_progress(&self, progress: JobProgressUpdate) -> Result<()> {
+        self.send(Body::JobProgressUpdate(progress))
+    }
+
+    fn send_completed(&self, completed: JobCompleted) -> Result<()> {
+        self.send(Body::JobCompleted(completed))
+    }
+}
+
+/// Wraps a sender so what passes through it is counted. The handlers report
+/// their results to admin and nowhere else, so this is where a scrape can learn
+/// what happened without every handler having to know about metrics.
+pub struct MeteredSender<'a> {
+    inner: &'a StreamSender,
+    proposals: std::sync::atomic::AtomicUsize,
+    failed: std::sync::atomic::AtomicBool,
+}
+
+impl<'a> MeteredSender<'a> {
+    pub fn new(inner: &'a StreamSender) -> Self {
+        Self {
+            inner,
+            proposals: std::sync::atomic::AtomicUsize::new(0),
+            failed: std::sync::atomic::AtomicBool::new(false),
+        }
+    }
+
+    /// How many proposals went out, for the detection counter.
+    pub fn proposals(&self) -> usize {
+        self.proposals.load(std::sync::atomic::Ordering::Relaxed)
+    }
+
+    /// Whether the handler reported a failure of its own. A handler that fails
+    /// by returning an error is counted by the caller; this catches the one that
+    /// reports failure and returns Ok.
+    pub fn reported_failure(&self) -> bool {
+        self.failed.load(std::sync::atomic::Ordering::Relaxed)
+    }
+}
+
+impl DetectionSender for MeteredSender<'_> {
+    fn send_proposals(&self, proposals: DetectionProposals) -> Result<()> {
+        // Counted after the send, not before: a stream that closed mid-sweep
+        // would otherwise leave proposals_total claiming work admin never saw.
+        let count = proposals.proposals.len();
+        self.inner.send_proposals(proposals)?;
+        self.proposals
+            .fetch_add(count, std::sync::atomic::Ordering::Relaxed);
+        Ok(())
+    }
+
+    fn send_complete(&self, complete: DetectionComplete) -> Result<()> {
+        if !complete.success {
+            self.failed
+                .store(true, std::sync::atomic::Ordering::Relaxed);
+        }
+        self.inner.send_complete(complete)
+    }
+
+    fn send_activity(&self, activity: ActivityEvent) -> Result<()> {
+        self.inner.send_activity(activity)
+    }
+
+    fn send_observations(&self, observations: WorkerObservations) -> Result<()> {
+        self.inner.send_observations(observations)
+    }
+}
+
+impl ExecutionSender for MeteredSender<'_> {
+    fn send_progress(&self, progress: JobProgressUpdate) -> Result<()> {
+        self.inner.send_progress(progress)
+    }
+
+    fn send_completed(&self, completed: JobCompleted) -> Result<()> {
+        if !completed.success {
+            self.failed
+                .store(true, std::sync::atomic::Ordering::Relaxed);
+        }
+        self.inner.send_completed(completed)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::pb::JobProposal;
+
+    fn proposals(n: usize) -> DetectionProposals {
+        DetectionProposals {
+            proposals: (0..n).map(|_| JobProposal::default()).collect(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn proposals_are_counted_once_they_are_sent() {
+        let (tx, mut rx) = mpsc::unbounded_channel();
+        let stream = StreamSender::new("worker-1".to_string(), tx);
+        let metered = MeteredSender::new(&stream);
+
+        metered.send_proposals(proposals(3)).expect("send");
+        assert_eq!(metered.proposals(), 3);
+        assert!(rx.try_recv().is_ok(), "the proposals reached the stream");
+    }
+
+    // Admin never saw these, so counting them would report work that was not
+    // handed over.
+    #[test]
+    fn proposals_are_not_counted_when_the_stream_is_gone() {
+        let (tx, rx) = mpsc::unbounded_channel();
+        let stream = StreamSender::new("worker-1".to_string(), tx);
+        let metered = MeteredSender::new(&stream);
+        drop(rx);
+
+        assert!(metered.send_proposals(proposals(3)).is_err());
+        assert_eq!(metered.proposals(), 0);
+    }
+
+    // A handler can report failure and still return Ok; the outcome has to come
+    // from what it said, not only from what it returned.
+    #[test]
+    fn a_reported_failure_is_remembered() {
+        let (tx, _rx) = mpsc::unbounded_channel();
+        let stream = StreamSender::new("worker-1".to_string(), tx);
+        let metered = MeteredSender::new(&stream);
+        assert!(!metered.reported_failure());
+
+        metered
+            .send_complete(DetectionComplete {
+                success: false,
+                ..Default::default()
+            })
+            .expect("send");
+        assert!(metered.reported_failure());
+    }
+}
diff --git a/seaweed-worker/crates/core/src/stream.rs b/seaweed-worker/crates/core/src/stream.rs
new file mode 100644
index 0000000000..63eeeea696
--- /dev/null
+++ b/seaweed-worker/crates/core/src/stream.rs
@@ -0,0 +1,500 @@
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+use anyhow::{Context, Result, anyhow};
+use tokio::sync::{Semaphore, mpsc};
+use tokio_stream::wrappers::UnboundedReceiverStream;
+use tonic::transport::{Certificate, Channel, ClientTlsConfig, Identity};
+use tracing::{info, warn};
+
+use crate::config::WorkerOptions;
+use crate::metrics::Metrics;
+use crate::pb::{
+    ConfigSchemaResponse, ExecuteJobRequest, JobCompleted, ObjectPreviewResponse, PreviewRow,
+    RequestObjectPreview, RunDetectionRequest, RunningWork, WorkerHeartbeat, WorkerHello,
+    admin_to_worker_message::Body as AdminBody,
+    plugin_control_service_client::PluginControlServiceClient,
+    worker_to_admin_message::Body as WorkerBody,
+};
+use crate::registry::Registry;
+use crate::senders::{MeteredSender, StreamSender};
+
+/// The protocol version this worker speaks, sent in WorkerHello.
+const PROTOCOL_VERSION: &str = "1";
+
+/// Connect to admin and serve the registry until the context is cancelled,
+/// reconnecting on failure. The stream is the only channel: everything admin
+/// asks for and everything the worker reports flows through it.
+pub async fn run(options: WorkerOptions, registry: Registry) -> Result<()> {
+    let metrics = Metrics::new(&options.worker_id, &options.worker_version)?;
+    run_with_metrics(options, registry, metrics).await
+}
+
+/// Runs with metrics a caller has already made, so it can serve them and add
+/// collectors of its own before the stream starts.
+pub async fn run_with_metrics(
+    options: WorkerOptions,
+    registry: Registry,
+    metrics: Metrics,
+) -> Result<()> {
+    if registry.is_empty() {
+        return Err(anyhow!("no job handlers registered"));
+    }
+    if options.max_detection_concurrency < 1 || options.max_execution_concurrency < 1 {
+        return Err(anyhow!(
+            "concurrency limits must be at least 1, got detection={} execution={}",
+            options.max_detection_concurrency,
+            options.max_execution_concurrency
+        ));
+    }
+    let slots = Slots::new(&options);
+    metrics.set_slots("detection", 0, slots.detection_total as i64);
+    metrics.set_slots("execution", 0, slots.execution_total as i64);
+    loop {
+        match serve_once(&options, &registry, &slots, &metrics).await {
+            Err(err) => {
+                metrics.stream_ended("failed");
+                warn!("worker stream ended: {err:#}")
+            }
+            // Admin asked this worker to stop, so stop. Reconnecting here would
+            // make shutdown impossible: the worker would log back in.
+            Ok(Outcome::ShutdownRequested) => {
+                metrics.stream_ended("shutdown");
+                return Ok(());
+            }
+            // Admin closing a healthy stream is not an error, but reconnecting
+            // in silence hides the reason - two workers sharing an id evict
+            // each other and produce nothing but a login every few seconds.
+            Ok(Outcome::StreamClosed) => {
+                metrics.stream_ended("closed");
+                warn!(
+                    "admin closed the stream; reconnecting in {:?}. If this repeats, check for \
+                     another worker using the id {}",
+                    options.reconnect_delay, options.worker_id
+                )
+            }
+        }
+        tokio::time::sleep(options.reconnect_delay).await;
+    }
+}
+
+/// Why a stream ended. Only one of these means "do not come back".
+enum Outcome {
+    StreamClosed,
+    ShutdownRequested,
+}
+
+/// The capacity this worker advertises in WorkerHello. Admin schedules against
+/// those numbers, so the worker has to actually hold to them - and the heartbeat
+/// has to report what is in use, or admin is scheduling blind.
+#[derive(Clone)]
+struct Slots {
+    detection: Arc<Semaphore>,
+    execution: Arc<Semaphore>,
+    detection_total: i32,
+    execution_total: i32,
+}
+
+impl Slots {
+    fn new(options: &WorkerOptions) -> Self {
+        Self {
+            detection: Arc::new(Semaphore::new(options.max_detection_concurrency as usize)),
+            execution: Arc::new(Semaphore::new(options.max_execution_concurrency as usize)),
+            detection_total: options.max_detection_concurrency,
+            execution_total: options.max_execution_concurrency,
+        }
+    }
+
+    fn detection_used(&self) -> i32 {
+        self.detection_total - self.detection.available_permits() as i32
+    }
+
+    fn execution_used(&self) -> i32 {
+        self.execution_total - self.execution.available_permits() as i32
+    }
+}
+
+/// Dials admin, over mTLS when certificates are configured. Plaintext is the
+/// default and is fine over loopback; anything else carries preview rows and
+/// execution commands in the clear, and a cluster with grpc TLS on refuses the
+/// connection anyway.
+async fn connect(options: &WorkerOptions, grpc_address: &str) -> Result<Channel> {
+    let Some(tls) = options.tls.as_ref() else {
+        return Ok(Channel::from_shared(format!("http://{grpc_address}"))?
+            .connect_timeout(Duration::from_secs(10))
+            .connect()
+            .await?);
+    };
+
+    let ca = tokio::fs::read(&tls.ca_path)
+        .await
+        .with_context(|| format!("read CA certificate {}", tls.ca_path))?;
+    let cert = tokio::fs::read(&tls.client_cert_path)
+        .await
+        .with_context(|| format!("read client certificate {}", tls.client_cert_path))?;
+    let key = tokio::fs::read(&tls.client_key_path)
+        .await
+        .with_context(|| format!("read client key {}", tls.client_key_path))?;
+
+    let mut config = ClientTlsConfig::new()
+        .ca_certificate(Certificate::from_pem(ca))
+        .identity(Identity::from_pem(cert, key));
+    if let Some(server_name) = tls.server_name.as_ref() {
+        config = config.domain_name(server_name.clone());
+    }
+
+    Ok(Channel::from_shared(format!("https://{grpc_address}"))?
+        .tls_config(config)?
+        .connect_timeout(Duration::from_secs(10))
+        .connect()
+        .await?)
+}
+
+async fn serve_once(
+    options: &WorkerOptions,
+    registry: &Registry,
+    slots: &Slots,
+    metrics: &Metrics,
+) -> Result<Outcome> {
+    // Operators give the admin's HTTP address; the gRPC port is derived, the
+    // same way the Go worker does it.
+    let grpc_address = crate::address::server_to_grpc_address(&options.admin_address)
+        .ok_or_else(|| anyhow!("cannot parse admin address {}", options.admin_address))?;
+    let channel = connect(options, &grpc_address).await?;
+    let mut client = PluginControlServiceClient::new(channel);
+
+    let (tx, rx) = mpsc::unbounded_channel();
+    let sender = StreamSender::new(options.worker_id.clone(), tx);
+
+    sender.send(WorkerBody::Hello(WorkerHello {
+        worker_id: options.worker_id.clone(),
+        worker_instance_id: options.worker_id.clone(),
+        address: options.worker_address.clone(),
+        worker_version: options.worker_version.clone(),
+        protocol_version: PROTOCOL_VERSION.to_string(),
+        capabilities: registry.capabilities(),
+        metadata: Default::default(),
+    }))?;
+
+    let mut request = tonic::Request::new(UnboundedReceiverStream::new(rx));
+    if let Some(token) = crate::token::admin_token(
+        options.signing_key.as_deref().unwrap_or("").as_bytes(),
+        options.signing_key_expires_after_seconds,
+    ) {
+        request.metadata_mut().insert(
+            "authorization",
+            format!("Bearer {token}")
+                .parse()
+                .context("minted admin token is not valid metadata")?,
+        );
+    }
+    let mut inbound = client.worker_stream(request).await?.into_inner();
+
+    let heartbeat = spawn_heartbeat(
+        sender.clone(),
+        options.clone(),
+        slots.clone(),
+        metrics.clone(),
+    );
+
+    while let Some(message) = inbound.message().await? {
+        let request_id = message.request_id.clone();
+        match message.body {
+            Some(AdminBody::Hello(hello)) => {
+                if !hello.accepted {
+                    return Err(anyhow!("admin rejected this worker: {}", hello.message));
+                }
+                metrics.stream_connected();
+                info!(
+                    "connected to admin at {} ({})",
+                    options.admin_address, grpc_address
+                );
+            }
+            Some(AdminBody::RequestConfigSchema(request)) => {
+                let response = match registry.get(&request.job_type) {
+                    Some(handler) => ConfigSchemaResponse {
+                        request_id: request_id.clone(),
+                        job_type: request.job_type.clone(),
+                        success: true,
+                        error_message: String::new(),
+                        job_type_descriptor: Some(handler.descriptor()),
+                    },
+                    None => ConfigSchemaResponse {
+                        request_id: request_id.clone(),
+                        job_type: request.job_type.clone(),
+                        success: false,
+                        error_message: format!("unknown job type {}", request.job_type),
+                        job_type_descriptor: None,
+                    },
+                };
+                sender.send(WorkerBody::ConfigSchemaResponse(response))?;
+            }
+            Some(AdminBody::RequestObjectPreview(request)) => {
+                spawn_preview(
+                    registry.clone(),
+                    sender.clone(),
+                    metrics.clone(),
+                    request_id.clone(),
+                    request,
+                );
+            }
+            Some(AdminBody::RunDetectionRequest(request)) => {
+                spawn_detection(
+                    registry.clone(),
+                    sender.clone(),
+                    slots.clone(),
+                    metrics.clone(),
+                    request,
+                );
+            }
+            Some(AdminBody::ExecuteJobRequest(request)) => {
+                spawn_execution(
+                    registry.clone(),
+                    sender.clone(),
+                    slots.clone(),
+                    metrics.clone(),
+                    request,
+                );
+            }
+            Some(AdminBody::CancelRequest(request)) => {
+                // Cancellation needs a per-request handle to be honoured; until
+                // then say so rather than silently continuing to run the job.
+                warn!(
+                    "cancel requested for {} ({}) but is not implemented",
+                    request.target_id, request.reason
+                );
+            }
+            Some(AdminBody::Shutdown(shutdown)) => {
+                info!("admin asked this worker to stop: {}", shutdown.reason);
+                heartbeat.abort();
+                return Ok(Outcome::ShutdownRequested);
+            }
+            None => {}
+        }
+    }
+
+    heartbeat.abort();
+    Ok(Outcome::StreamClosed)
+}
+
+/// Answers one preview request off the stream loop. Reading rows takes as long
+/// as it takes, and the stream has heartbeats to keep up meanwhile.
+fn spawn_preview(
+    registry: Registry,
+    sender: StreamSender,
+    metrics: Metrics,
+    request_id: String,
+    request: RequestObjectPreview,
+) {
+    tokio::spawn(async move {
+        let limit = request.row_limit.max(1) as usize;
+        let response = match registry.preview_provider(&request.format) {
+            None => ObjectPreviewResponse {
+                request_id,
+                success: false,
+                error_message: format!("this worker does not read {} objects", request.format),
+                ..Default::default()
+            },
+            Some(provider) => match provider.preview(&request.object_id, limit).await {
+                Ok(preview) => ObjectPreviewResponse {
+                    request_id,
+                    success: true,
+                    error_message: String::new(),
+                    columns: preview.columns,
+                    rows: preview
+                        .rows
+                        .into_iter()
+                        .map(|values| PreviewRow { values })
+                        .collect(),
+                    total_rows: preview.total_rows,
+                },
+                Err(err) => ObjectPreviewResponse {
+                    request_id,
+                    success: false,
+                    error_message: format!("{err:#}"),
+                    ..Default::default()
+                },
+            },
+        };
+        metrics.preview_finished(if response.success { "ok" } else { "failed" });
+        let _ = sender.send(WorkerBody::ObjectPreviewResponse(response));
+    });
+}
+
+fn spawn_heartbeat(
+    sender: StreamSender,
+    options: WorkerOptions,
+    slots: Slots,
+    metrics: Metrics,
+) -> tokio::task::JoinHandle<()> {
+    // The handle has to be the heartbeat's own, or aborting it aborts nothing
+    // and every reconnect leaves another ticker running.
+    tokio::spawn(async move {
+        let mut ticker = tokio::time::interval(options.heartbeat_interval);
+        loop {
+            ticker.tick().await;
+            // The heartbeat already computes this for admin; publish the same
+            // numbers so a scrape and the admin UI cannot disagree.
+            metrics.set_slots(
+                "detection",
+                slots.detection_used() as i64,
+                slots.detection_total as i64,
+            );
+            metrics.set_slots(
+                "execution",
+                slots.execution_used() as i64,
+                slots.execution_total as i64,
+            );
+            let beat = WorkerHeartbeat {
+                worker_id: options.worker_id.clone(),
+                running_work: Vec::<RunningWork>::new(),
+                detection_slots_used: slots.detection_used(),
+                detection_slots_total: slots.detection_total,
+                execution_slots_used: slots.execution_used(),
+                execution_slots_total: slots.execution_total,
+                queued_jobs_by_type: Default::default(),
+                metadata: Default::default(),
+            };
+            if sender.send(WorkerBody::Heartbeat(beat)).is_err() {
+                return;
+            }
+        }
+    })
+}
+
+fn spawn_detection(
+    registry: Registry,
+    sender: StreamSender,
+    slots: Slots,
+    metrics: Metrics,
+    request: RunDetectionRequest,
+) {
+    tokio::spawn(async move {
+        let Some(handler) = registry.get(&request.job_type) else {
+            return;
+        };
+        // Held until the sweep finishes, so the worker keeps to the capacity it
+        // advertised and the heartbeat reports the truth while it works.
+        let _permit = slots.detection.acquire().await;
+        let metered = MeteredSender::new(&sender);
+        let started = Instant::now();
+        let outcome = handler.detect(&request, &metered).await;
+        let result = if let Err(err) = &outcome {
+            warn!("detection for {} failed: {err:#}", request.job_type);
+            let _ = sender.send(WorkerBody::DetectionComplete(
+                crate::pb::DetectionComplete {
+                    request_id: request.request_id.clone(),
+                    job_type: request.job_type.clone(),
+                    success: false,
+                    error_message: format!("{err:#}"),
+                    total_proposals: 0,
+                },
+            ));
+            "failed"
+        } else if metered.reported_failure() {
+            "failed"
+        } else {
+            "ok"
+        };
+        metrics.detection_finished(
+            &request.job_type,
+            result,
+            started.elapsed().as_secs_f64(),
+            metered.proposals(),
+        );
+    });
+}
+
+fn spawn_execution(
+    registry: Registry,
+    sender: StreamSender,
+    slots: Slots,
+    metrics: Metrics,
+    request: ExecuteJobRequest,
+) {
+    tokio::spawn(async move {
+        let _permit = slots.execution.acquire().await;
+        let job_type = request
+            .job
+            .as_ref()
+            .map(|job| job.job_type.clone())
+            .unwrap_or_default();
+        let job_id = request
+            .job
+            .as_ref()
+            .map(|job| job.job_id.clone())
+            .unwrap_or_default();
+        let Some(handler) = registry.get(&job_type) else {
+            return;
+        };
+        let metered = MeteredSender::new(&sender);
+        let started = Instant::now();
+        let outcome = handler.execute(&request, &metered).await;
+        let result = if let Err(err) = &outcome {
+            warn!("job {job_id} failed: {err:#}");
+            let _ = sender.send(WorkerBody::JobCompleted(JobCompleted {
+                request_id: request.request_id.clone(),
+                job_id,
+                job_type: job_type.clone(),
+                success: false,
+                error_message: format!("{err:#}"),
+                ..Default::default()
+            }));
+            "failed"
+        } else if metered.reported_failure() {
+            "failed"
+        } else {
+            "ok"
+        };
+        metrics.job_finished(&job_type, result, started.elapsed().as_secs_f64());
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn options(detection: i32, execution: i32) -> WorkerOptions {
+        WorkerOptions {
+            max_detection_concurrency: detection,
+            max_execution_concurrency: execution,
+            ..Default::default()
+        }
+    }
+
+    // The heartbeat is admin's only view of how busy this worker is; before the
+    // permits existed it reported zero however much was running.
+    #[tokio::test]
+    async fn slots_report_what_is_held() {
+        let slots = Slots::new(&options(2, 3));
+        assert_eq!(slots.detection_used(), 0);
+        assert_eq!(slots.execution_used(), 0);
+
+        let held = slots.detection.acquire().await.unwrap();
+        assert_eq!(slots.detection_used(), 1);
+        assert_eq!(slots.execution_used(), 0, "the two do not share capacity");
+
+        drop(held);
+        assert_eq!(slots.detection_used(), 0);
+    }
+
+    // A limit of one means the second request waits, rather than running anyway
+    // as it did when every request simply spawned a task.
+    #[tokio::test]
+    async fn a_full_lane_makes_the_next_request_wait() {
+        let slots = Slots::new(&options(1, 1));
+        let held = slots.execution.clone().acquire_owned().await.unwrap();
+        assert_eq!(slots.execution_used(), 1);
+
+        let waiter = tokio::spawn({
+            let execution = slots.execution.clone();
+            async move { execution.acquire_owned().await.unwrap() }
+        });
+        tokio::task::yield_now().await;
+        assert!(!waiter.is_finished(), "the second request must not start");
+
+        drop(held);
+        let _second = waiter.await.expect("the waiter should be handed the slot");
+        assert_eq!(slots.execution_used(), 1);
+    }
+}
diff --git a/seaweed-worker/crates/core/src/token.rs b/seaweed-worker/crates/core/src/token.rs
new file mode 100644
index 0000000000..3df69398ef
--- /dev/null
+++ b/seaweed-worker/crates/core/src/token.rs
@@ -0,0 +1,61 @@
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use aws_lc_rs::hmac;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+
+/// Mints the HS256 Bearer token the admin control stream requires when
+/// jwt.filer_signing.key is configured, matching the SeaweedFilerAdminClaims
+/// the Go worker sends: registered claims only, no session id.
+pub fn admin_token(signing_key: &[u8], expires_after_secs: u64) -> Option<String> {
+    if signing_key.is_empty() {
+        return None;
+    }
+    let claims = if expires_after_secs > 0 {
+        let exp = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.as_secs())
+            .unwrap_or_default()
+            + expires_after_secs;
+        format!("{{\"exp\":{exp}}}")
+    } else {
+        "{}".to_string()
+    };
+    let signing_input = format!(
+        "{}.{}",
+        URL_SAFE_NO_PAD.encode(b"{\"alg\":\"HS256\",\"typ\":\"JWT\"}"),
+        URL_SAFE_NO_PAD.encode(claims.as_bytes())
+    );
+    let key = hmac::Key::new(hmac::HMAC_SHA256, signing_key);
+    let signature = hmac::sign(&key, signing_input.as_bytes());
+    Some(format!(
+        "{signing_input}.{}",
+        URL_SAFE_NO_PAD.encode(signature.as_ref())
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::admin_token;
+
+    #[test]
+    fn no_key_no_token() {
+        assert!(admin_token(b"", 0).is_none());
+    }
+
+    #[test]
+    fn minted_token_verifies_shape() {
+        let token = admin_token(b"secret", 60).unwrap();
+        let parts: Vec<&str> = token.split('.').collect();
+        assert_eq!(parts.len(), 3);
+        assert!(!parts.iter().any(|p| p.is_empty()));
+    }
+
+    #[test]
+    fn no_expiry_has_empty_claims() {
+        let token = admin_token(b"secret", 0).unwrap();
+        let payload = token.split('.').nth(1).unwrap();
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+        let claims = URL_SAFE_NO_PAD.decode(payload).unwrap();
+        assert_eq!(claims, b"{}");
+    }
+}
diff --git a/seaweed-worker/crates/lance/Cargo.toml b/seaweed-worker/crates/lance/Cargo.toml
new file mode 100644
index 0000000000..1637ab804f
--- /dev/null
+++ b/seaweed-worker/crates/lance/Cargo.toml
@@ -0,0 +1,58 @@
+[package]
+name = "weed-lance-worker"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "SeaweedFS maintenance worker for Lance tables"
+
+[lib]
+name = "weed_lance_worker"
+
+# The binary is not named for lance: it is the Rust side of `weed worker`, and
+# the job families it registers will outgrow this crate. When a second one
+# arrives the bin target moves to a crate of its own under the same name.
+[[bin]]
+name = "weed-worker"
+path = "src/main.rs"
+
+[dependencies]
+# Helpers the Rust volume server needs as well. A path dependency because
+# the two trees are separate cargo workspaces with no common root manifest.
+# It also carries the rustls requirement this crate used to state itself.
+seaweed-common = { path = "../../../seaweed-common" }
+seaweed-worker-core = { path = "../core" }
+seaweed-worker-sort = { path = "../sort" }
+prometheus.workspace = true
+# Only the S3 backend: the other object stores lance enables by default are
+# build time this worker never spends.
+lance = { version = "10", default-features = false, features = ["aws"] }
+lance-index = "10"
+# For the manifest's own fragment type, which the sort marker summarises.
+lance-table = "10"
+# For the execution options the sort needs; the scanner's own stream helper
+# takes the default, which has spilling off.
+lance-datafusion = "10"
+arrow-schema = "58"
+arrow-cast = "58"
+chrono = "0.4"
+futures = "0.3"
+anyhow.workspace = true
+async-trait.workspace = true
+clap = { version = "4", features = ["derive", "env"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+tokio.workspace = true
+tracing.workspace = true
+tracing-subscriber.workspace = true
+
+[dev-dependencies]
+tokio = { workspace = true }
+tonic.workspace = true
+arrow-array = "58"
+arrow-schema = "58"
+arrow-cast = "58"
+lance-linalg = "10"
+
+[lints]
+workspace = true
diff --git a/seaweed-worker/crates/lance/src/catalog/mod.rs b/seaweed-worker/crates/lance/src/catalog/mod.rs
new file mode 100644
index 0000000000..142de4eb52
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/catalog/mod.rs
@@ -0,0 +1,10 @@
+//! How the worker finds Lance tables and gets at their bytes.
+//!
+//! It goes through the Lance namespace rather than the filer: the namespace is
+//! the catalog of record, it already knows which tables are Lance, and asking it
+//! to describe a table with vend_credentials is how the worker gets storage
+//! credentials without holding any of its own.
+
+pub mod namespace;
+
+pub use namespace::{NamespaceClient, TableDescription, parse_id};
diff --git a/seaweed-worker/crates/lance/src/catalog/namespace.rs b/seaweed-worker/crates/lance/src/catalog/namespace.rs
new file mode 100644
index 0000000000..c026ae2c69
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/catalog/namespace.rs
@@ -0,0 +1,129 @@
+use std::collections::HashMap;
+
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use serde::Deserialize;
+
+/// The delimiter the Lance namespace joins identifier parts with.
+const DELIMITER: &str = "$";
+
+#[derive(Debug, Deserialize)]
+pub struct TableDescription {
+    pub location: String,
+    #[serde(default)]
+    pub storage_options: HashMap<String, String>,
+    #[serde(default)]
+    pub managed_versioning: bool,
+}
+
+#[derive(Debug, Deserialize)]
+struct ListNamespacesResponse {
+    #[serde(default)]
+    namespaces: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct ListTablesResponse {
+    #[serde(default)]
+    tables: Vec<String>,
+}
+
+/// A thin client for the operations this worker needs. It deliberately does not
+/// wrap the whole spec: a maintenance worker lists, describes, and commits.
+pub struct NamespaceClient {
+    base_url: String,
+    http: reqwest::Client,
+}
+
+/// A namespace call that has not answered by now is not going to. Without this
+/// a gateway that accepts the connection and then goes quiet holds a detection
+/// slot open forever, and the sweep never finishes.
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(30);
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+
+impl NamespaceClient {
+    pub fn new(base_url: impl Into<String>) -> Self {
+        let http = reqwest::Client::builder()
+            .timeout(REQUEST_TIMEOUT)
+            .connect_timeout(CONNECT_TIMEOUT)
+            .build()
+            // The builder only fails on a bad TLS backend, which would break
+            // every call anyway; a client with no timeouts is worse than a panic
+            // at startup, so keep the default only as a last resort.
+            .unwrap_or_else(|err| {
+                tracing::warn!("falling back to an untimed HTTP client: {err}");
+                reqwest::Client::new()
+            });
+        Self {
+            base_url: base_url.into().trim_end_matches('/').to_string(),
+            http,
+        }
+    }
+
+    /// Every table the namespace holds, as delimiter-joined identifiers.
+    pub async fn list_all_tables(&self) -> Result<Vec<String>> {
+        let url = format!("{}/v1/table", self.base_url);
+        let response: ListTablesResponse = self
+            .http
+            .get(&url)
+            .send()
+            .await
+            .context("list tables")?
+            .error_for_status()?
+            .json()
+            .await?;
+        Ok(response.tables)
+    }
+
+    /// Child namespaces of `id`; the root lists table buckets.
+    pub async fn list_namespaces(&self, id: &[String]) -> Result<Vec<String>> {
+        let url = format!("{}/v1/namespace/{}/list", self.base_url, encode_id(id));
+        let response: ListNamespacesResponse = self
+            .http
+            .get(&url)
+            .send()
+            .await
+            .context("list namespaces")?
+            .error_for_status()?
+            .json()
+            .await?;
+        Ok(response.namespaces)
+    }
+
+    /// Resolve a table to a location and the credentials to reach it. The
+    /// credentials expire, so a long compaction re-describes rather than
+    /// carrying one set for the whole job.
+    pub async fn describe_table(&self, id: &[String]) -> Result<TableDescription> {
+        let url = format!("{}/v1/table/{}/describe", self.base_url, encode_id(id));
+        let body = serde_json::json!({ "id": id, "vend_credentials": true });
+        let description: TableDescription = self
+            .http
+            .post(&url)
+            .json(&body)
+            .send()
+            .await
+            .context("describe table")?
+            .error_for_status()?
+            .json()
+            .await?;
+        Ok(description)
+    }
+}
+
+fn encode_id(id: &[String]) -> String {
+    if id.is_empty() {
+        DELIMITER.to_string()
+    } else {
+        id.join(DELIMITER)
+    }
+}
+
+/// Splits a delimiter-joined identifier back into parts.
+pub fn parse_id(encoded: &str) -> Vec<String> {
+    encoded
+        .split(DELIMITER)
+        .filter(|part| !part.is_empty())
+        .map(|part| part.to_string())
+        .collect()
+}
diff --git a/seaweed-worker/crates/lance/src/dataset.rs b/seaweed-worker/crates/lance/src/dataset.rs
new file mode 100644
index 0000000000..4b65c3fb31
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/dataset.rs
@@ -0,0 +1,98 @@
+//! Opening a Lance dataset with credentials the namespace vended.
+//!
+//! The worker holds no storage credentials of its own: it asks the namespace to
+//! describe a table with `vend_credentials`, and the `storage_options` that come
+//! back are handed to lance as-is. They expire, so a job that runs longer than
+//! their lifetime re-describes rather than carrying one set throughout.
+
+use std::collections::HashMap;
+
+use anyhow::{Context, Result};
+use lance::dataset::Dataset;
+use lance::dataset::builder::DatasetBuilder;
+
+use crate::catalog::{NamespaceClient, TableDescription};
+
+/// A table the worker is about to work on.
+pub struct OpenTable {
+    pub id: Vec<String>,
+    pub location: String,
+    pub dataset: Dataset,
+}
+
+/// What detection needs to decide whether a table is worth a job. Reading it
+/// opens the dataset but touches no data files.
+pub struct TableStats {
+    pub fragments: usize,
+    pub version: u64,
+    pub total_versions: usize,
+    pub rows: usize,
+    /// The Arrow schema as JSON, which is the only description of this table
+    /// anything outside the format can produce.
+    pub schema: Option<String>,
+}
+
+/// Storage options an operator supplies for deployments that vend none.
+pub type FallbackOptions = HashMap<String, String>;
+
+/// Resolve a table through the namespace and open it.
+pub async fn open(
+    client: &NamespaceClient,
+    id: &[String],
+    fallback: &FallbackOptions,
+) -> Result<OpenTable> {
+    let description = client.describe_table(id).await?;
+    let dataset = open_at(&description, fallback).await?;
+    Ok(OpenTable {
+        id: id.to_vec(),
+        location: description.location,
+        dataset,
+    })
+}
+
+/// The namespace vends object_store's own option names, so they pass straight
+/// through. What it vends always wins: the fallback exists because a deployment
+/// without STS vends no credentials at all, and then the worker has no other way
+/// to reach the data.
+async fn open_at(description: &TableDescription, fallback: &FallbackOptions) -> Result<Dataset> {
+    let mut options: HashMap<String, String> = fallback.clone();
+    options.extend(description.storage_options.clone());
+    DatasetBuilder::from_uri(&description.location)
+        .with_storage_options(options)
+        .load()
+        .await
+        .with_context(|| format!("open lance dataset at {}", description.location))
+}
+
+impl OpenTable {
+    pub async fn stats(&self) -> Result<TableStats> {
+        let versions = self.dataset.versions().await?;
+        Ok(TableStats {
+            fragments: self.dataset.get_fragments().len(),
+            version: self.dataset.version().version,
+            total_versions: versions.len(),
+            rows: self.dataset.count_rows(None).await.unwrap_or(0),
+            schema: schema_json(&self.dataset),
+        })
+    }
+}
+
+/// Renders the dataset's schema as JSON. Best effort: a schema that will not
+/// serialise is not a reason to fail a maintenance sweep.
+fn schema_json(dataset: &Dataset) -> Option<String> {
+    let arrow: arrow_schema::Schema = dataset.schema().into();
+    serde_json::to_string(
+        &arrow
+            .fields()
+            .iter()
+            .map(|f| {
+                serde_json::json!({
+                    "name": f.name(),
+                    "type": f.data_type().to_string(),
+                    "nullable": f.is_nullable(),
+                })
+            })
+            .collect::<Vec<_>>(),
+    )
+    .ok()
+}
diff --git a/seaweed-worker/crates/lance/src/jobs/cleanup.rs b/seaweed-worker/crates/lance/src/jobs/cleanup.rs
new file mode 100644
index 0000000000..608187ad48
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/jobs/cleanup.rs
@@ -0,0 +1,336 @@
+use std::collections::HashMap;
+
+use anyhow::{Context, Result, anyhow};
+use async_trait::async_trait;
+use chrono::{Duration, Utc};
+use lance::dataset::cleanup::{CleanupPolicy, cleanup_old_versions};
+use seaweed_worker_core::config_form::{form, int_or, int_value, number_field};
+use seaweed_worker_core::pb::{
+    ConfigValue, DetectionComplete, DetectionProposals, ExecuteJobRequest, JobCompleted,
+    JobProgressUpdate, JobProposal, JobResult, JobTypeCapability, JobTypeDescriptor,
+    RunDetectionRequest,
+};
+use seaweed_worker_core::{DetectionSender, ExecutionSender, JobHandler};
+use tracing::warn;
+
+use crate::catalog::{NamespaceClient, parse_id};
+use crate::dataset;
+use crate::jobs::{clamp, string_list, table_id};
+
+pub const JOB_TYPE: &str = "lance_cleanup_versions";
+
+const DEFAULT_RETAIN_HOURS: i64 = 168;
+const DEFAULT_MIN_VERSIONS: i64 = 5;
+
+// The ranges the form offers. Duration::hours also panics far outside this one.
+const MAX_RETAIN_HOURS: i64 = 8760;
+const MAX_MIN_VERSIONS: i64 = 1000;
+
+/// Lance keeps every version until something removes it. Lance can also do this
+/// itself through auto-cleanup, so this job is for deployments that would rather
+/// the cluster owned the policy than each writer.
+pub struct CleanupVersionsHandler {
+    namespace_url: String,
+    fallback: dataset::FallbackOptions,
+    metrics: Option<crate::metrics::LanceMetrics>,
+}
+
+impl CleanupVersionsHandler {
+    pub fn new(namespace_url: String) -> Self {
+        Self {
+            namespace_url,
+            fallback: dataset::FallbackOptions::new(),
+            metrics: None,
+        }
+    }
+
+    pub fn with_metrics(mut self, metrics: Option<crate::metrics::LanceMetrics>) -> Self {
+        self.metrics = metrics;
+        self
+    }
+
+    pub fn with_fallback(mut self, fallback: dataset::FallbackOptions) -> Self {
+        self.fallback = fallback;
+        self
+    }
+
+    fn client(&self) -> NamespaceClient {
+        NamespaceClient::new(self.namespace_url.clone())
+    }
+}
+
+/// The oldest version that may be removed while still leaving `min_versions`
+/// behind, or None when the table has no more than the floor.
+async fn version_floor(table: &dataset::OpenTable, min_versions: usize) -> Result<Option<u64>> {
+    let mut versions: Vec<u64> = table
+        .dataset
+        .versions()
+        .await?
+        .iter()
+        .map(|version| version.version)
+        .collect();
+    if versions.len() <= min_versions {
+        return Ok(None);
+    }
+    versions.sort_unstable();
+    Ok(Some(versions[versions.len() - min_versions]))
+}
+
+#[async_trait]
+impl JobHandler for CleanupVersionsHandler {
+    fn capability(&self) -> JobTypeCapability {
+        JobTypeCapability {
+            job_type: JOB_TYPE.to_string(),
+            can_detect: true,
+            can_execute: true,
+            max_detection_concurrency: 1,
+            max_execution_concurrency: 1,
+            display_name: "Lance Version Cleanup".to_string(),
+            description: "Remove old Lance versions and the files only they referenced".to_string(),
+            weight: 10,
+        }
+    }
+
+    fn descriptor(&self) -> JobTypeDescriptor {
+        let mut defaults: HashMap<String, ConfigValue> = HashMap::new();
+        defaults.insert("retain_hours".to_string(), int_value(DEFAULT_RETAIN_HOURS));
+        defaults.insert(
+            "min_versions_to_keep".to_string(),
+            int_value(DEFAULT_MIN_VERSIONS),
+        );
+
+        JobTypeDescriptor {
+            job_type: JOB_TYPE.to_string(),
+            display_name: "Lance Version Cleanup".to_string(),
+            description: "Age out Lance versions the table no longer needs".to_string(),
+            icon: "fas fa-broom".to_string(),
+            descriptor_version: 1,
+            worker_config_form: Some(form(
+                "lance-cleanup-worker",
+                "Version cleanup",
+                vec![
+                    number_field(
+                        "retain_hours",
+                        "Retain versions for (hours)",
+                        "Versions younger than this are always kept",
+                        1,
+                        8760,
+                    ),
+                    number_field(
+                        "min_versions_to_keep",
+                        "Minimum versions",
+                        "Never leave a table with fewer versions than this, whatever their age",
+                        1,
+                        1000,
+                    ),
+                ],
+                defaults.clone(),
+            )),
+            worker_default_values: defaults,
+            ..Default::default()
+        }
+    }
+
+    async fn detect(
+        &self,
+        request: &RunDetectionRequest,
+        sender: &dyn DetectionSender,
+    ) -> Result<()> {
+        let min_versions = clamp(
+            int_or(
+                &request.worker_config_values,
+                "min_versions_to_keep",
+                DEFAULT_MIN_VERSIONS,
+            ),
+            1,
+            MAX_MIN_VERSIONS,
+        ) as usize;
+        let client = self.client();
+        let tables = client.list_all_tables().await?;
+
+        let mut proposals = Vec::new();
+        for encoded in &tables {
+            let id = parse_id(encoded);
+            let table = match dataset::open(&client, &id, &self.fallback).await {
+                Ok(table) => table,
+                Err(err) => {
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "open");
+                    }
+                    warn!("skipping {encoded}: {err:#}");
+                    continue;
+                }
+            };
+            if let Some(counters) = &self.metrics {
+                counters.worker.object_seen(JOB_TYPE);
+            }
+            let stats = match table.stats().await {
+                Ok(stats) => stats,
+                Err(err) => {
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "stats");
+                    }
+                    warn!("skipping {encoded}: reading its stats failed: {err:#}");
+                    continue;
+                }
+            };
+            // Age is decided at execution against the retention window; a table
+            // at or under the floor cannot lose a version whatever its age, so
+            // proposing one would only produce a job with nothing to do.
+            if stats.total_versions <= min_versions {
+                continue;
+            }
+            let mut parameters: HashMap<String, ConfigValue> = HashMap::new();
+            parameters.insert("table_id".to_string(), string_list(&id));
+            proposals.push(JobProposal {
+                proposal_id: format!("{JOB_TYPE}:{encoded}"),
+                dedupe_key: format!("{JOB_TYPE}:{encoded}"),
+                job_type: JOB_TYPE.to_string(),
+                summary: format!("Clean up {encoded} ({} versions)", stats.total_versions),
+                detail: format!(
+                    "{} versions retained, above the {min_versions} floor; \
+                     those outside the retention window can go",
+                    stats.total_versions
+                ),
+                parameters,
+                ..Default::default()
+            });
+        }
+
+        let total = proposals.len() as i32;
+        sender.send_proposals(DetectionProposals {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            proposals,
+            has_more: false,
+        })?;
+        sender.send_complete(DetectionComplete {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            error_message: String::new(),
+            total_proposals: total,
+        })?;
+        Ok(())
+    }
+
+    async fn execute(
+        &self,
+        request: &ExecuteJobRequest,
+        sender: &dyn ExecutionSender,
+    ) -> Result<()> {
+        let job = request
+            .job
+            .as_ref()
+            .ok_or_else(|| anyhow!("execute request carried no job"))?;
+        let id = table_id(&job.parameters)
+            .ok_or_else(|| anyhow!("job {} carried no table_id", job.job_id))?;
+        let retain_hours = clamp(
+            int_or(
+                &request.worker_config_values,
+                "retain_hours",
+                DEFAULT_RETAIN_HOURS,
+            ),
+            0,
+            MAX_RETAIN_HOURS,
+        );
+        let min_versions = clamp(
+            int_or(
+                &request.worker_config_values,
+                "min_versions_to_keep",
+                DEFAULT_MIN_VERSIONS,
+            ),
+            1,
+            MAX_MIN_VERSIONS,
+        ) as usize;
+
+        let client = self.client();
+        let table = dataset::open(&client, &id, &self.fallback).await?;
+        let before = table.stats().await?;
+
+        // The floor is a promise about how much history survives, so it has to
+        // be applied here and not only when the job was proposed: by the time it
+        // runs, versions may have aged past the retention window, and age alone
+        // would take the table below what the operator asked to keep.
+        let Some(floor) = version_floor(&table, min_versions).await? else {
+            sender.send_completed(JobCompleted {
+                request_id: request.request_id.clone(),
+                job_id: job.job_id.clone(),
+                job_type: JOB_TYPE.to_string(),
+                success: true,
+                result: Some(JobResult {
+                    summary: format!(
+                        "kept all {} versions; the {min_versions} version floor leaves none to remove",
+                        before.total_versions
+                    ),
+                    ..Default::default()
+                }),
+                ..Default::default()
+            })?;
+            return Ok(());
+        };
+
+        sender.send_progress(JobProgressUpdate {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            progress_percent: 10.0,
+            stage: format!("cleaning up {} versions", before.total_versions),
+            ..Default::default()
+        })?;
+
+        let policy = CleanupPolicy {
+            before_timestamp: Some(Utc::now() - Duration::hours(retain_hours)),
+            // should_clean() ANDs its clauses, so a version has to be both older
+            // than the window and below the floor to go.
+            before_version: Some(floor),
+            // Files this dataset cannot account for are left alone: they may
+            // belong to a writer that has not committed yet, and deleting them
+            // would corrupt a commit in flight.
+            delete_unverified: false,
+            // A tagged version is pinned on purpose, so refuse rather than
+            // silently dropping what someone named.
+            error_if_tagged_old_versions: true,
+            ..Default::default()
+        };
+        let stats = cleanup_old_versions(&table.dataset, policy)
+            .await
+            .with_context(|| format!("clean up versions of {}", table.location))?;
+
+        if let Some(counters) = &self.metrics {
+            counters.versions_removed.inc_by(stats.old_versions as u64);
+            counters.bytes_reclaimed.inc_by(stats.bytes_removed as u64);
+        }
+
+        let mut output: HashMap<String, ConfigValue> = HashMap::new();
+        output.insert(
+            "old_versions_removed".to_string(),
+            int_value(stats.old_versions as i64),
+        );
+        output.insert(
+            "bytes_removed".to_string(),
+            int_value(stats.bytes_removed as i64),
+        );
+        output.insert(
+            "data_files_removed".to_string(),
+            int_value(stats.data_files_removed as i64),
+        );
+
+        sender.send_completed(JobCompleted {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            result: Some(JobResult {
+                output_values: output,
+                summary: format!(
+                    "removed {} versions and {} bytes",
+                    stats.old_versions, stats.bytes_removed
+                ),
+                ..Default::default()
+            }),
+            ..Default::default()
+        })?;
+        Ok(())
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/jobs/compact.rs b/seaweed-worker/crates/lance/src/jobs/compact.rs
new file mode 100644
index 0000000000..2cad969630
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/jobs/compact.rs
@@ -0,0 +1,318 @@
+use std::collections::HashMap;
+
+use anyhow::{Context, Result, anyhow};
+use async_trait::async_trait;
+use lance::dataset::optimize::{CompactionOptions, compact_files};
+use seaweed_worker_core::config_form::{form, int_or, int_value, number_field, string_value};
+use seaweed_worker_core::pb::{
+    ConfigValue, DetectionComplete, DetectionProposals, ExecuteJobRequest, JobCompleted,
+    JobProgressUpdate, JobProposal, JobResult, JobTypeCapability, JobTypeDescriptor,
+    RunDetectionRequest, WorkerObservations,
+};
+use seaweed_worker_core::{DetectionSender, ExecutionSender, JobHandler};
+use tracing::warn;
+
+use crate::catalog::{NamespaceClient, parse_id};
+use crate::dataset;
+use crate::jobs::{FORMAT, clamp, observation, string_list, table_id};
+
+pub const JOB_TYPE: &str = "lance_compact";
+
+const DEFAULT_TARGET_ROWS: i64 = 1_048_576;
+const DEFAULT_MIN_FRAGMENTS: i64 = 8;
+
+// The ranges the descriptor's form offers. These are also the values that stay
+// meaningful: a table needs two fragments before merging them means anything,
+// and a fragment target below a thousand rows defeats the purpose of the job.
+// Both are cast to usize, where a negative would arrive as an enormous number.
+const TARGET_ROWS_FLOOR: i64 = 1024;
+const TARGET_ROWS_CEILING: i64 = 16_777_216;
+const MIN_FRAGMENTS_FLOOR: i64 = 2;
+const MIN_FRAGMENTS_CEILING: i64 = 4096;
+
+/// Lance writes one fragment per write batch, so a table fed by small appends
+/// accumulates small files the same way an Iceberg table does.
+pub struct CompactHandler {
+    namespace_url: String,
+    fallback: dataset::FallbackOptions,
+    metrics: Option<crate::metrics::LanceMetrics>,
+}
+
+impl CompactHandler {
+    pub fn new(namespace_url: String) -> Self {
+        Self {
+            namespace_url,
+            fallback: dataset::FallbackOptions::new(),
+            metrics: None,
+        }
+    }
+
+    pub fn with_metrics(mut self, metrics: Option<crate::metrics::LanceMetrics>) -> Self {
+        self.metrics = metrics;
+        self
+    }
+
+    /// Storage options to use where the namespace vends none.
+    pub fn with_fallback(mut self, fallback: dataset::FallbackOptions) -> Self {
+        self.fallback = fallback;
+        self
+    }
+
+    fn client(&self) -> NamespaceClient {
+        NamespaceClient::new(self.namespace_url.clone())
+    }
+}
+
+#[async_trait]
+impl JobHandler for CompactHandler {
+    fn capability(&self) -> JobTypeCapability {
+        JobTypeCapability {
+            job_type: JOB_TYPE.to_string(),
+            can_detect: true,
+            can_execute: true,
+            max_detection_concurrency: 1,
+            max_execution_concurrency: 1,
+            display_name: "Lance Compaction".to_string(),
+            description: "Merge small Lance fragments into fewer, larger ones".to_string(),
+            weight: 20,
+        }
+    }
+
+    fn descriptor(&self) -> JobTypeDescriptor {
+        let mut defaults: HashMap<String, ConfigValue> = HashMap::new();
+        defaults.insert(
+            "target_rows_per_fragment".to_string(),
+            int_value(DEFAULT_TARGET_ROWS),
+        );
+        defaults.insert(
+            "min_fragments".to_string(),
+            int_value(DEFAULT_MIN_FRAGMENTS),
+        );
+
+        JobTypeDescriptor {
+            job_type: JOB_TYPE.to_string(),
+            display_name: "Lance Compaction".to_string(),
+            description: "Compact fragments of Lance tables".to_string(),
+            icon: "fas fa-compress".to_string(),
+            descriptor_version: 1,
+            worker_config_form: Some(form(
+                "lance-compact-worker",
+                "Compaction",
+                vec![
+                    number_field(
+                        "target_rows_per_fragment",
+                        "Target rows per fragment",
+                        "Rows to aim for when rewriting fragments",
+                        1024,
+                        16_777_216,
+                    ),
+                    number_field(
+                        "min_fragments",
+                        "Minimum fragments",
+                        "Leave a table alone until it has at least this many fragments",
+                        2,
+                        4096,
+                    ),
+                ],
+                defaults.clone(),
+            )),
+            worker_default_values: defaults,
+            ..Default::default()
+        }
+    }
+
+    /// Propose a job for every table with more fragments than the operator is
+    /// willing to leave alone. Opening a dataset reads its manifest, not its
+    /// data, so this stays cheap across a catalog.
+    async fn detect(
+        &self,
+        request: &RunDetectionRequest,
+        sender: &dyn DetectionSender,
+    ) -> Result<()> {
+        let min_fragments = clamp(
+            int_or(
+                &request.worker_config_values,
+                "min_fragments",
+                DEFAULT_MIN_FRAGMENTS,
+            ),
+            MIN_FRAGMENTS_FLOOR,
+            MIN_FRAGMENTS_CEILING,
+        ) as usize;
+        let client = self.client();
+        let tables = client.list_all_tables().await?;
+
+        let mut proposals = Vec::new();
+        let mut observations = Vec::new();
+        for encoded in &tables {
+            let id = parse_id(encoded);
+            let table = match dataset::open(&client, &id, &self.fallback).await {
+                Ok(table) => table,
+                Err(err) => {
+                    // A table that cannot be opened is the next run's problem,
+                    // not a reason to abandon the whole sweep.
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "open");
+                    }
+                    warn!("skipping {encoded}: {err:#}");
+                    continue;
+                }
+            };
+            // One unreadable table must not end the sweep: the tables already
+            // read would lose their proposals, and admin would get no
+            // completion for this request at all.
+            if let Some(counters) = &self.metrics {
+                counters.worker.object_seen(JOB_TYPE);
+            }
+            let stats = match table.stats().await {
+                Ok(stats) => stats,
+                Err(err) => {
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "stats");
+                    }
+                    warn!("skipping {encoded}: reading its stats failed: {err:#}");
+                    continue;
+                }
+            };
+            // Logged because "detection proposed nothing" is otherwise
+            // indistinguishable from a table the worker could not read.
+            tracing::info!(
+                "compaction detection: {encoded} has {} fragments, threshold {min_fragments}",
+                stats.fragments
+            );
+
+            let mut attributes: HashMap<String, ConfigValue> = HashMap::new();
+            attributes.insert("fragments".to_string(), int_value(stats.fragments as i64));
+            attributes.insert("version".to_string(), int_value(stats.version as i64));
+            attributes.insert(
+                "versions".to_string(),
+                int_value(stats.total_versions as i64),
+            );
+            attributes.insert("rows".to_string(), int_value(stats.rows as i64));
+            if let Some(schema) = stats.schema.clone() {
+                attributes.insert("schema".to_string(), string_value(schema));
+            }
+            observations.push(observation(&id, FORMAT, attributes));
+
+            if stats.fragments < min_fragments {
+                continue;
+            }
+            let mut parameters: HashMap<String, ConfigValue> = HashMap::new();
+            parameters.insert("table_id".to_string(), string_list(&id));
+            proposals.push(JobProposal {
+                proposal_id: format!("{JOB_TYPE}:{encoded}"),
+                dedupe_key: format!("{JOB_TYPE}:{encoded}"),
+                job_type: JOB_TYPE.to_string(),
+                summary: format!("Compact {encoded} ({} fragments)", stats.fragments),
+                detail: format!(
+                    "{} fragments at version {}, above the {min_fragments} the policy allows",
+                    stats.fragments, stats.version
+                ),
+                parameters,
+                ..Default::default()
+            });
+        }
+
+        if !observations.is_empty() {
+            sender.send_observations(WorkerObservations {
+                job_type: JOB_TYPE.to_string(),
+                observations,
+            })?;
+        }
+
+        let total = proposals.len() as i32;
+        sender.send_proposals(DetectionProposals {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            proposals,
+            has_more: false,
+        })?;
+        sender.send_complete(DetectionComplete {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            error_message: String::new(),
+            total_proposals: total,
+        })?;
+        Ok(())
+    }
+
+    async fn execute(
+        &self,
+        request: &ExecuteJobRequest,
+        sender: &dyn ExecutionSender,
+    ) -> Result<()> {
+        let job = request
+            .job
+            .as_ref()
+            .ok_or_else(|| anyhow!("execute request carried no job"))?;
+        let id = table_id(&job.parameters)
+            .ok_or_else(|| anyhow!("job {} carried no table_id", job.job_id))?;
+        let target_rows = clamp(
+            int_or(
+                &request.worker_config_values,
+                "target_rows_per_fragment",
+                DEFAULT_TARGET_ROWS,
+            ),
+            TARGET_ROWS_FLOOR,
+            TARGET_ROWS_CEILING,
+        ) as usize;
+
+        let client = self.client();
+        // Re-resolve rather than trusting the location detection saw: the table
+        // may have been repointed, and the vended credentials have expired.
+        let mut table = dataset::open(&client, &id, &self.fallback).await?;
+        let before = table.stats().await?;
+
+        sender.send_progress(JobProgressUpdate {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            progress_percent: 10.0,
+            stage: format!("compacting {} fragments", before.fragments),
+            ..Default::default()
+        })?;
+
+        let options = CompactionOptions {
+            target_rows_per_fragment: target_rows,
+            ..Default::default()
+        };
+        let metrics = compact_files(&mut table.dataset, options, None)
+            .await
+            .with_context(|| format!("compact {}", table.location))?;
+
+        if let Some(counters) = &self.metrics {
+            counters
+                .fragments_removed
+                .inc_by(metrics.fragments_removed as u64);
+        }
+
+        let after = table.stats().await?;
+        let mut output: HashMap<String, ConfigValue> = HashMap::new();
+        output.insert(
+            "fragments_removed".to_string(),
+            int_value(metrics.fragments_removed as i64),
+        );
+        output.insert(
+            "fragments_added".to_string(),
+            int_value(metrics.fragments_added as i64),
+        );
+        output.insert(
+            "files_removed".to_string(),
+            int_value(metrics.files_removed as i64),
+        );
+
+        sender.send_completed(JobCompleted {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            result: Some(JobResult {
+                output_values: output,
+                summary: format!("{} fragments became {}", before.fragments, after.fragments),
+                ..Default::default()
+            }),
+            ..Default::default()
+        })?;
+        Ok(())
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/jobs/indices.rs b/seaweed-worker/crates/lance/src/jobs/indices.rs
new file mode 100644
index 0000000000..927748b9b3
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/jobs/indices.rs
@@ -0,0 +1,275 @@
+use std::collections::HashMap;
+
+use anyhow::{Context, Result, anyhow};
+use async_trait::async_trait;
+use lance::index::DatasetIndexExt;
+use lance_index::optimize::OptimizeOptions;
+use seaweed_worker_core::config_form::{form, int_or, int_value, number_field};
+use seaweed_worker_core::pb::{
+    ConfigValue, DetectionComplete, DetectionProposals, ExecuteJobRequest, JobCompleted,
+    JobProgressUpdate, JobProposal, JobResult, JobTypeCapability, JobTypeDescriptor,
+    RunDetectionRequest,
+};
+use seaweed_worker_core::{DetectionSender, ExecutionSender, JobHandler};
+use tracing::warn;
+
+use crate::catalog::{NamespaceClient, parse_id};
+use crate::dataset::{self, OpenTable};
+use crate::jobs::{clamp, string_list, table_id};
+
+pub const JOB_TYPE: &str = "lance_optimize_indices";
+
+const DEFAULT_MAX_UNINDEXED_ROWS: i64 = 100_000;
+
+// Zero is a real setting - reindex as soon as any row is uncovered - so the
+// floor is what stays meaningful rather than what the form offers. The ceiling
+// is the form's, and the point of both is that this is cast to u64: a negative
+// would arrive as an enormous budget and mean "never reindex".
+const MAX_UNINDEXED_FLOOR: i64 = 0;
+const MAX_UNINDEXED_CEILING: i64 = 100_000_000;
+
+/// Rows written after an index was built are not covered by it, so a vector
+/// search quietly misses them. This is the job with no Iceberg equivalent, and
+/// the reason a neglected Lance table is a correctness problem rather than a
+/// slow one.
+pub struct OptimizeIndicesHandler {
+    namespace_url: String,
+    fallback: dataset::FallbackOptions,
+    metrics: Option<crate::metrics::LanceMetrics>,
+}
+
+impl OptimizeIndicesHandler {
+    pub fn new(namespace_url: String) -> Self {
+        Self {
+            namespace_url,
+            fallback: dataset::FallbackOptions::new(),
+            metrics: None,
+        }
+    }
+
+    pub fn with_metrics(mut self, metrics: Option<crate::metrics::LanceMetrics>) -> Self {
+        self.metrics = metrics;
+        self
+    }
+
+    pub fn with_fallback(mut self, fallback: dataset::FallbackOptions) -> Self {
+        self.fallback = fallback;
+        self
+    }
+
+    fn client(&self) -> NamespaceClient {
+        NamespaceClient::new(self.namespace_url.clone())
+    }
+}
+
+/// Rows no index covers, summed across a table's indices. A table with no
+/// indices at all has nothing to optimize, which is different from a table whose
+/// indices have fallen behind.
+async fn unindexed_rows(table: &OpenTable) -> Result<Option<u64>> {
+    let indices = table.dataset.load_indices().await?;
+    if indices.is_empty() {
+        return Ok(None);
+    }
+
+    let mut worst = 0u64;
+    let mut names: Vec<String> = indices.iter().map(|index| index.name.clone()).collect();
+    names.sort();
+    names.dedup();
+    for name in names {
+        let raw = table.dataset.index_statistics(&name).await?;
+        let stats: serde_json::Value = serde_json::from_str(&raw)
+            .with_context(|| format!("parse index statistics for {name}"))?;
+        let unindexed = stats
+            .get("num_unindexed_rows")
+            .and_then(|value| value.as_u64())
+            .unwrap_or(0);
+        worst = worst.max(unindexed);
+    }
+    Ok(Some(worst))
+}
+
+#[async_trait]
+impl JobHandler for OptimizeIndicesHandler {
+    fn capability(&self) -> JobTypeCapability {
+        JobTypeCapability {
+            job_type: JOB_TYPE.to_string(),
+            can_detect: true,
+            can_execute: true,
+            max_detection_concurrency: 1,
+            max_execution_concurrency: 1,
+            display_name: "Lance Index Optimization".to_string(),
+            description: "Extend indices to cover rows written since they were built".to_string(),
+            weight: 30,
+        }
+    }
+
+    fn descriptor(&self) -> JobTypeDescriptor {
+        let mut defaults: HashMap<String, ConfigValue> = HashMap::new();
+        defaults.insert(
+            "max_unindexed_rows".to_string(),
+            int_value(DEFAULT_MAX_UNINDEXED_ROWS),
+        );
+
+        JobTypeDescriptor {
+            job_type: JOB_TYPE.to_string(),
+            display_name: "Lance Index Optimization".to_string(),
+            description: "Keep vector and scalar indices covering the whole table".to_string(),
+            icon: "fas fa-magnifying-glass-chart".to_string(),
+            descriptor_version: 1,
+            worker_config_form: Some(form(
+                "lance-indices-worker",
+                "Index optimization",
+                vec![number_field(
+                    "max_unindexed_rows",
+                    "Unindexed row budget",
+                    "Reindex once a table has more rows than this outside its indices",
+                    1_000,
+                    100_000_000,
+                )],
+                defaults.clone(),
+            )),
+            worker_default_values: defaults,
+            ..Default::default()
+        }
+    }
+
+    async fn detect(
+        &self,
+        request: &RunDetectionRequest,
+        sender: &dyn DetectionSender,
+    ) -> Result<()> {
+        let budget = clamp(
+            int_or(
+                &request.worker_config_values,
+                "max_unindexed_rows",
+                DEFAULT_MAX_UNINDEXED_ROWS,
+            ),
+            MAX_UNINDEXED_FLOOR,
+            MAX_UNINDEXED_CEILING,
+        ) as u64;
+        let client = self.client();
+        let tables = client.list_all_tables().await?;
+
+        let mut proposals = Vec::new();
+        for encoded in &tables {
+            let id = parse_id(encoded);
+            let table = match dataset::open(&client, &id, &self.fallback).await {
+                Ok(table) => table,
+                Err(err) => {
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "open");
+                    }
+                    warn!("skipping {encoded}: {err:#}");
+                    continue;
+                }
+            };
+            if let Some(counters) = &self.metrics {
+                counters.worker.object_seen(JOB_TYPE);
+            }
+            let unindexed = match unindexed_rows(&table).await {
+                Ok(Some(unindexed)) => unindexed,
+                Ok(None) => continue,
+                Err(err) => {
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "index_stats");
+                    }
+                    warn!("skipping {encoded}: reading its index stats failed: {err:#}");
+                    continue;
+                }
+            };
+            if unindexed <= budget {
+                continue;
+            }
+            let mut parameters: HashMap<String, ConfigValue> = HashMap::new();
+            parameters.insert("table_id".to_string(), string_list(&id));
+            proposals.push(JobProposal {
+                proposal_id: format!("{JOB_TYPE}:{encoded}"),
+                dedupe_key: format!("{JOB_TYPE}:{encoded}"),
+                job_type: JOB_TYPE.to_string(),
+                summary: format!("Reindex {encoded} ({unindexed} rows uncovered)"),
+                detail: format!(
+                    "{unindexed} rows sit outside the indices, above the {budget} the policy allows; \
+                     a search of this table misses them"
+                ),
+                parameters,
+                ..Default::default()
+            });
+        }
+
+        let total = proposals.len() as i32;
+        sender.send_proposals(DetectionProposals {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            proposals,
+            has_more: false,
+        })?;
+        sender.send_complete(DetectionComplete {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            error_message: String::new(),
+            total_proposals: total,
+        })?;
+        Ok(())
+    }
+
+    async fn execute(
+        &self,
+        request: &ExecuteJobRequest,
+        sender: &dyn ExecutionSender,
+    ) -> Result<()> {
+        let job = request
+            .job
+            .as_ref()
+            .ok_or_else(|| anyhow!("execute request carried no job"))?;
+        let id = table_id(&job.parameters)
+            .ok_or_else(|| anyhow!("job {} carried no table_id", job.job_id))?;
+
+        let client = self.client();
+        let mut table = dataset::open(&client, &id, &self.fallback).await?;
+        let before = unindexed_rows(&table).await?.unwrap_or(0);
+
+        sender.send_progress(JobProgressUpdate {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            progress_percent: 10.0,
+            stage: format!("indexing {before} uncovered rows"),
+            ..Default::default()
+        })?;
+
+        // Merging every delta keeps read latency from drifting as the table is
+        // reindexed again and again; leaving them unmerged is how an index ends
+        // up fast to write and slow to search.
+        table
+            .dataset
+            .optimize_indices(&OptimizeOptions::default())
+            .await
+            .with_context(|| format!("optimize indices of {}", table.location))?;
+
+        let after = unindexed_rows(&table).await?.unwrap_or(0);
+        if let Some(counters) = &self.metrics {
+            counters.rows_indexed.inc_by(before.saturating_sub(after));
+        }
+        let mut output: HashMap<String, ConfigValue> = HashMap::new();
+        output.insert(
+            "unindexed_rows_before".to_string(),
+            int_value(before as i64),
+        );
+        output.insert("unindexed_rows_after".to_string(), int_value(after as i64));
+
+        sender.send_completed(JobCompleted {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            result: Some(JobResult {
+                output_values: output,
+                summary: format!("{before} uncovered rows became {after}"),
+                ..Default::default()
+            }),
+            ..Default::default()
+        })?;
+        Ok(())
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/jobs/mod.rs b/seaweed-worker/crates/lance/src/jobs/mod.rs
new file mode 100644
index 0000000000..b5502a7747
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/jobs/mod.rs
@@ -0,0 +1,118 @@
+//! One module per job type. Each declares its capability and the settings form
+//! admin renders for it, then does the work.
+//!
+//! Detection opens each table and reads its manifest rather than its data, so a
+//! sweep across a catalog stays cheap. Execution re-resolves the table instead
+//! of trusting what detection saw: it may have been repointed, and the vended
+//! credentials expire.
+
+pub mod cleanup;
+pub mod compact;
+pub mod indices;
+pub mod sort;
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use seaweed_worker_core::JobHandler;
+use seaweed_worker_core::pb::{ConfigValue, ObjectObservation, StringList, config_value::Kind};
+
+use crate::catalog::parse_id;
+
+/// A table identifier travels in a proposal's parameters and comes back on the
+/// job, so both sides agree on one encoding.
+pub(crate) fn string_list(parts: &[String]) -> ConfigValue {
+    ConfigValue {
+        kind: Some(Kind::StringList(StringList {
+            values: parts.to_vec(),
+        })),
+    }
+}
+
+pub(crate) fn table_id(parameters: &HashMap<String, ConfigValue>) -> Option<Vec<String>> {
+    match parameters.get("table_id")?.kind.as_ref()? {
+        Kind::StringList(list) => Some(list.values.clone()),
+        Kind::StringValue(encoded) => Some(parse_id(encoded)),
+        _ => None,
+    }
+}
+
+/// Every handler this worker serves. A worker process may serve several job
+/// types, which is why WorkerHello carries a list.
+pub fn handlers(
+    namespace_url: String,
+    fallback: crate::dataset::FallbackOptions,
+    metrics: Option<crate::metrics::LanceMetrics>,
+) -> Vec<Arc<dyn JobHandler>> {
+    vec![
+        Arc::new(
+            compact::CompactHandler::new(namespace_url.clone())
+                .with_fallback(fallback.clone())
+                .with_metrics(metrics.clone()),
+        ),
+        Arc::new(
+            indices::OptimizeIndicesHandler::new(namespace_url.clone())
+                .with_fallback(fallback.clone())
+                .with_metrics(metrics.clone()),
+        ),
+        Arc::new(
+            sort::SortHandler::new(namespace_url.clone())
+                .with_fallback(fallback.clone())
+                .with_metrics(metrics.clone()),
+        ),
+        Arc::new(
+            cleanup::CleanupVersionsHandler::new(namespace_url)
+                .with_fallback(fallback)
+                .with_metrics(metrics),
+        ),
+    ]
+}
+
+/// Holds a configured value to the range its form offers. A value from outside
+/// it is one the UI could not have produced, and every one of these is cast to
+/// an unsigned type: a negative arrives as an enormous number, which silently
+/// turns a threshold into "never" rather than failing loudly.
+pub(crate) fn clamp(value: i64, low: i64, high: i64) -> i64 {
+    value.max(low).min(high)
+}
+
+/// The format the catalog records for the tables this worker maintains.
+pub const FORMAT: &str = "LANCE";
+
+/// Builds the observation a detection sweep reports for one table. Detection
+/// has already opened the dataset to decide whether it needs work, so saying
+/// what it saw costs nothing, and for a format the cluster cannot read this is
+/// the only description of the table anything can produce.
+pub(crate) fn observation(
+    id: &[String],
+    format: &str,
+    attributes: HashMap<String, ConfigValue>,
+) -> ObjectObservation {
+    ObjectObservation {
+        object_id: id.to_vec(),
+        object_kind: "table".to_string(),
+        format: format.to_string(),
+        attributes,
+        observed_at: Some(std::time::SystemTime::now().into()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Every configured threshold is cast to an unsigned type before use. A
+    // negative one would arrive as an enormous number and quietly mean "never",
+    // which looks exactly like a worker with nothing to do.
+    #[test]
+    fn clamp_keeps_a_negative_from_wrapping() {
+        assert_eq!(clamp(-1, 2, 4096) as usize, 2);
+        assert_eq!(clamp(i64::MIN, 0, 100_000_000) as u64, 0);
+    }
+
+    #[test]
+    fn clamp_holds_the_ceiling_and_passes_the_middle() {
+        assert_eq!(clamp(i64::MAX, 0, 8760), 8760);
+        assert_eq!(clamp(168, 0, 8760), 168);
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/jobs/sort.rs b/seaweed-worker/crates/lance/src/jobs/sort.rs
new file mode 100644
index 0000000000..0bbf9b0639
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/jobs/sort.rs
@@ -0,0 +1,488 @@
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use anyhow::{Context, Result, anyhow};
+use async_trait::async_trait;
+use lance::dataset::scanner::ColumnOrdering;
+use lance::dataset::transaction::Operation;
+use lance::dataset::write::{CommitBuilder, InsertBuilder};
+use lance::dataset::{WriteDestination, WriteMode, WriteParams};
+use lance::index::DatasetIndexExt;
+use lance_datafusion::exec::{LanceExecutionOptions, execute_plan};
+use seaweed_worker_core::config_form::{form, int_or, int_value, string_or, string_value};
+use seaweed_worker_core::pb::{
+    ConfigValue, DetectionComplete, DetectionProposals, ExecuteJobRequest, JobCompleted,
+    JobProgressUpdate, JobProposal, JobResult, JobTypeCapability, JobTypeDescriptor,
+    RunDetectionRequest, WorkerObservations,
+};
+use seaweed_worker_core::{DetectionSender, ExecutionSender, JobHandler};
+use seaweed_worker_sort::{
+    CONFIG_MAX_ROWS_PER_FILE, CONFIG_MEMORY_BUDGET_MB, CONFIG_MIN_UNSORTED_ROWS,
+    CONFIG_SORT_FIELDS, DECLARED_FIELDS_KEY, FragmentSummary, SortSpec, SortState, config_fields,
+    resolve, verdict,
+};
+use tracing::warn;
+
+use crate::catalog::{NamespaceClient, parse_id};
+use crate::dataset;
+use crate::jobs::{FORMAT, clamp, observation, string_list, table_id};
+
+pub const JOB_TYPE: &str = "lance_sort";
+
+const DEFAULT_MIN_UNSORTED_ROWS: i64 = 1_048_576;
+const DEFAULT_MEMORY_BUDGET_MB: i64 = 512;
+const DEFAULT_MAX_ROWS_PER_FILE: i64 = 1_048_576;
+
+// The ranges the shared form offers, repeated here because a value from outside
+// one is a value the UI could not have produced and every one of these is cast
+// to an unsigned type on the way in.
+const MIN_UNSORTED_ROWS_FLOOR: i64 = 1;
+const MIN_UNSORTED_ROWS_CEILING: i64 = 1_000_000_000;
+const MEMORY_BUDGET_FLOOR: i64 = 64;
+const MEMORY_BUDGET_CEILING: i64 = 1_048_576;
+const MAX_ROWS_PER_FILE_FLOOR: i64 = 1024;
+const MAX_ROWS_PER_FILE_CEILING: i64 = 16_777_216;
+
+const BYTES_PER_MB: u64 = 1024 * 1024;
+
+/// Rewrites a table so its rows are stored in the order its fields declare,
+/// which is what lets a range scan read a few files instead of all of them.
+///
+/// Lance appends fragments in write order and has no notion of a sorted table,
+/// so nothing but a rewrite establishes that order, and nothing but another
+/// rewrite restores it once rows have been appended.
+pub struct SortHandler {
+    namespace_url: String,
+    fallback: dataset::FallbackOptions,
+    metrics: Option<crate::metrics::LanceMetrics>,
+}
+
+impl SortHandler {
+    pub fn new(namespace_url: String) -> Self {
+        Self {
+            namespace_url,
+            fallback: dataset::FallbackOptions::new(),
+            metrics: None,
+        }
+    }
+
+    pub fn with_metrics(mut self, metrics: Option<crate::metrics::LanceMetrics>) -> Self {
+        self.metrics = metrics;
+        self
+    }
+
+    /// Storage options to use where the namespace vends none.
+    pub fn with_fallback(mut self, fallback: dataset::FallbackOptions) -> Self {
+        self.fallback = fallback;
+        self
+    }
+
+    fn client(&self) -> NamespaceClient {
+        NamespaceClient::new(self.namespace_url.clone())
+    }
+}
+
+/// The fragments a dataset holds, in fragment order, as the sort crate reads
+/// them: the data files each one names, and the live rows it holds.
+///
+/// Appends only add fragments after the existing ones and lance hands out
+/// fragment ids monotonically even across an overwrite, so ordering by id makes
+/// "the fragments the sort wrote are still the first ones" a prefix test.
+fn fragment_summaries(dataset: &lance::Dataset) -> Vec<FragmentSummary> {
+    let mut fragments = dataset.get_fragments();
+    fragments.sort_by_key(|fragment| fragment.id());
+    fragments
+        .iter()
+        .map(|fragment| summarize(fragment.metadata()))
+        .collect()
+}
+
+/// The manifest's own account of one fragment. `num_rows` is physical rows less
+/// deletions, and None where the manifest does not record them.
+fn summarize(fragment: &lance_table::format::Fragment) -> FragmentSummary {
+    FragmentSummary {
+        files: fragment
+            .files
+            .iter()
+            .map(|file| file.path.clone())
+            .collect(),
+        rows: fragment.num_rows().map(|rows| rows as u64),
+    }
+}
+
+/// The scan ordering for a spec. Lance validates the column names against the
+/// schema when the ordering is set, so a spec naming a column the table does
+/// not have fails before anything is written.
+fn orderings(spec: &SortSpec) -> Vec<ColumnOrdering> {
+    spec.fields
+        .iter()
+        .map(|field| ColumnOrdering {
+            ascending: !field.descending,
+            nulls_first: field.nulls_first,
+            column_name: field.path.clone(),
+        })
+        .collect()
+}
+
+#[async_trait]
+impl JobHandler for SortHandler {
+    fn capability(&self) -> JobTypeCapability {
+        JobTypeCapability {
+            job_type: JOB_TYPE.to_string(),
+            can_detect: true,
+            can_execute: true,
+            max_detection_concurrency: 1,
+            max_execution_concurrency: 1,
+            display_name: "Lance Sort".to_string(),
+            description: "Rewrite Lance tables in the order their fields declare. The rewrite replaces every fragment, so indices do not survive it and want rebuilding afterwards.".to_string(),
+            weight: 40,
+        }
+    }
+
+    fn descriptor(&self) -> JobTypeDescriptor {
+        let mut defaults: HashMap<String, ConfigValue> = HashMap::new();
+        defaults.insert(CONFIG_SORT_FIELDS.to_string(), string_value(""));
+        defaults.insert(
+            CONFIG_MIN_UNSORTED_ROWS.to_string(),
+            int_value(DEFAULT_MIN_UNSORTED_ROWS),
+        );
+        defaults.insert(
+            CONFIG_MEMORY_BUDGET_MB.to_string(),
+            int_value(DEFAULT_MEMORY_BUDGET_MB),
+        );
+        defaults.insert(
+            CONFIG_MAX_ROWS_PER_FILE.to_string(),
+            int_value(DEFAULT_MAX_ROWS_PER_FILE),
+        );
+
+        JobTypeDescriptor {
+            job_type: JOB_TYPE.to_string(),
+            display_name: "Lance Sort".to_string(),
+            description: "Sort Lance tables by their declared fields".to_string(),
+            icon: "fas fa-sort".to_string(),
+            descriptor_version: 1,
+            worker_config_form: Some(form(
+                "lance-sort-worker",
+                "Sort",
+                config_fields(),
+                defaults.clone(),
+            )),
+            worker_default_values: defaults,
+            ..Default::default()
+        }
+    }
+
+    /// Propose a job for every table whose declared order the data no longer
+    /// follows. Opening a dataset reads its manifest and its configuration, not
+    /// its data, so this stays cheap across a catalog.
+    async fn detect(
+        &self,
+        request: &RunDetectionRequest,
+        sender: &dyn DetectionSender,
+    ) -> Result<()> {
+        let configured = string_or(&request.worker_config_values, CONFIG_SORT_FIELDS, "");
+        let min_unsorted_rows = clamp(
+            int_or(
+                &request.worker_config_values,
+                CONFIG_MIN_UNSORTED_ROWS,
+                DEFAULT_MIN_UNSORTED_ROWS,
+            ),
+            MIN_UNSORTED_ROWS_FLOOR,
+            MIN_UNSORTED_ROWS_CEILING,
+        ) as u64;
+
+        let client = self.client();
+        let tables = client.list_all_tables().await?;
+
+        let mut proposals = Vec::new();
+        let mut observations = Vec::new();
+        for encoded in &tables {
+            let id = parse_id(encoded);
+            let table = match dataset::open(&client, &id, &self.fallback).await {
+                Ok(table) => table,
+                Err(err) => {
+                    // One unreadable table must not end the sweep: the tables
+                    // already read would lose their proposals.
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "open");
+                    }
+                    warn!("skipping {encoded}: {err:#}");
+                    continue;
+                }
+            };
+            if let Some(counters) = &self.metrics {
+                counters.worker.object_seen(JOB_TYPE);
+            }
+            let stats = match table.stats().await {
+                Ok(stats) => stats,
+                Err(err) => {
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "stats");
+                    }
+                    warn!("skipping {encoded}: reading its stats failed: {err:#}");
+                    continue;
+                }
+            };
+
+            let config = table.dataset.config().clone();
+            let spec = match resolve(
+                config.get(DECLARED_FIELDS_KEY).map(String::as_str),
+                &configured,
+            ) {
+                Ok(Some(spec)) => spec,
+                Ok(None) => {
+                    // Not every table is one an operator wants sorted, and a
+                    // table with no order named anywhere is not a failure.
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "no_sort_order");
+                    }
+                    continue;
+                }
+                Err(err) => {
+                    if let Some(counters) = &self.metrics {
+                        counters.worker.object_skipped(JOB_TYPE, "sort_order");
+                    }
+                    warn!("skipping {encoded}: {err:#}");
+                    continue;
+                }
+            };
+
+            let state = SortState::from_config(&config);
+            let decision = verdict(
+                &spec,
+                &state,
+                &fragment_summaries(&table.dataset),
+                min_unsorted_rows,
+            );
+
+            let mut attributes: HashMap<String, ConfigValue> = HashMap::new();
+            attributes.insert("rows".to_string(), int_value(stats.rows as i64));
+            attributes.insert("version".to_string(), int_value(stats.version as i64));
+            attributes.insert("fragments".to_string(), int_value(stats.fragments as i64));
+            attributes.insert("sort_fields".to_string(), string_value(spec.to_string()));
+            attributes.insert("sort_state".to_string(), string_value(decision.reason()));
+            if let Some(schema) = stats.schema.clone() {
+                attributes.insert("schema".to_string(), string_value(schema));
+            }
+            observations.push(observation(&id, FORMAT, attributes));
+
+            // Logged because "detection proposed nothing" is otherwise
+            // indistinguishable from a table the worker could not read.
+            tracing::info!(
+                "sort detection: {encoded} has {} rows in {spec} order: {}",
+                stats.rows,
+                decision.reason()
+            );
+
+            if !decision.needs_sort() {
+                continue;
+            }
+            let mut parameters: HashMap<String, ConfigValue> = HashMap::new();
+            parameters.insert("table_id".to_string(), string_list(&id));
+            proposals.push(JobProposal {
+                proposal_id: format!("{JOB_TYPE}:{encoded}"),
+                dedupe_key: format!("{JOB_TYPE}:{encoded}"),
+                job_type: JOB_TYPE.to_string(),
+                summary: format!("Sort {encoded} by {spec}"),
+                detail: format!("{} rows, {}", stats.rows, decision.reason()),
+                parameters,
+                ..Default::default()
+            });
+        }
+
+        if !observations.is_empty() {
+            sender.send_observations(WorkerObservations {
+                job_type: JOB_TYPE.to_string(),
+                observations,
+            })?;
+        }
+
+        let total = proposals.len() as i32;
+        sender.send_proposals(DetectionProposals {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            proposals,
+            has_more: false,
+        })?;
+        sender.send_complete(DetectionComplete {
+            request_id: request.request_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            error_message: String::new(),
+            total_proposals: total,
+        })?;
+        Ok(())
+    }
+
+    async fn execute(
+        &self,
+        request: &ExecuteJobRequest,
+        sender: &dyn ExecutionSender,
+    ) -> Result<()> {
+        let job = request
+            .job
+            .as_ref()
+            .ok_or_else(|| anyhow!("execute request carried no job"))?;
+        let id = table_id(&job.parameters)
+            .ok_or_else(|| anyhow!("job {} carried no table_id", job.job_id))?;
+
+        let configured = string_or(&request.worker_config_values, CONFIG_SORT_FIELDS, "");
+        let memory_budget_mb = clamp(
+            int_or(
+                &request.worker_config_values,
+                CONFIG_MEMORY_BUDGET_MB,
+                DEFAULT_MEMORY_BUDGET_MB,
+            ),
+            MEMORY_BUDGET_FLOOR,
+            MEMORY_BUDGET_CEILING,
+        ) as u64;
+        let max_rows_per_file = clamp(
+            int_or(
+                &request.worker_config_values,
+                CONFIG_MAX_ROWS_PER_FILE,
+                DEFAULT_MAX_ROWS_PER_FILE,
+            ),
+            MAX_ROWS_PER_FILE_FLOOR,
+            MAX_ROWS_PER_FILE_CEILING,
+        ) as usize;
+
+        let client = self.client();
+        // Re-resolve rather than trusting what detection saw: the table may have
+        // been repointed, its declared order changed, and the vended credentials
+        // have expired.
+        let table = dataset::open(&client, &id, &self.fallback).await?;
+        let before = table.stats().await?;
+        let config = table.dataset.config().clone();
+        let spec = resolve(
+            config.get(DECLARED_FIELDS_KEY).map(String::as_str),
+            &configured,
+        )?
+        .ok_or_else(|| anyhow!("neither the table nor this worker names an order to sort by"))?;
+
+        sender.send_progress(JobProgressUpdate {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            progress_percent: 10.0,
+            stage: format!("sorting {} rows by {spec}", before.rows),
+            ..Default::default()
+        })?;
+
+        let mut scanner = table.dataset.scan();
+        scanner
+            .order_by(Some(orderings(&spec)))
+            .with_context(|| format!("order the scan of {} by {spec}", table.location))?;
+        let plan = scanner
+            .create_plan()
+            .await
+            .context("plan the ordered scan")?;
+
+        // Spilling is off in LanceExecutionOptions::default(), and the scanner's
+        // own stream helper takes that default, so the options are built here
+        // instead: a sort that cannot spill is one bounded by memory, which is
+        // the whole thing this job exists to avoid.
+        let stream = execute_plan(
+            plan,
+            LanceExecutionOptions {
+                use_spilling: true,
+                mem_pool_size: Some(memory_budget_mb * BYTES_PER_MB),
+                ..Default::default()
+            },
+        )
+        .context("run the ordered scan")?;
+
+        let params = WriteParams {
+            mode: WriteMode::Overwrite,
+            max_rows_per_file,
+            ..Default::default()
+        };
+        let destination = Arc::new(table.dataset.clone());
+        let mut transaction = InsertBuilder::new(WriteDestination::Dataset(destination.clone()))
+            .with_params(&params)
+            .execute_uncommitted_stream(stream)
+            .await
+            .context("write the sorted fragments")?;
+
+        // The marker rides in the same commit as the data it describes:
+        // Operation::Overwrite is the one place lance takes configuration
+        // values alongside fragments, and a marker written as a second commit
+        // would be lost if the worker died in between, re-sorting the whole
+        // table on the next sweep.
+        match &mut transaction.operation {
+            Operation::Overwrite {
+                config_upsert_values,
+                fragments,
+                ..
+            } => {
+                // The files these fragments name were written a moment ago and
+                // keep their names whatever version this commit becomes, which
+                // is what lets the marker travel inside the commit it describes.
+                let written: Vec<FragmentSummary> = fragments.iter().map(summarize).collect();
+                *config_upsert_values =
+                    Some(SortState::record(&spec, &written, before.rows as u64));
+            }
+            other => {
+                return Err(anyhow!(
+                    "a sorted rewrite produced {other} instead of an overwrite"
+                ));
+            }
+        }
+
+        let sorted = CommitBuilder::new(WriteDestination::Dataset(destination))
+            .execute(transaction)
+            .await
+            .context("commit the sorted rewrite")?;
+
+        if let Some(counters) = &self.metrics {
+            counters.rows_sorted.inc_by(before.rows as u64);
+        }
+
+        // An overwrite carries fragments, schema and configuration — not index
+        // metadata — so a table that had indices no longer does. Saying so is
+        // the difference between a slow table and a mystery.
+        let dropped_indices = match table.dataset.load_indices().await {
+            Ok(indices) => indices.len(),
+            Err(err) => {
+                warn!("could not read the indices of {}: {err:#}", table.location);
+                0
+            }
+        };
+        if dropped_indices > 0 {
+            warn!(
+                "{} lost {dropped_indices} index/indices to the sorted rewrite; run the index job to rebuild them",
+                table.location
+            );
+        }
+
+        let fragments_after = sorted.get_fragments().len();
+        let mut output: HashMap<String, ConfigValue> = HashMap::new();
+        output.insert("rows_sorted".to_string(), int_value(before.rows as i64));
+        output.insert("sort_fields".to_string(), string_value(spec.to_string()));
+        output.insert(
+            "fragments_before".to_string(),
+            int_value(before.fragments as i64),
+        );
+        output.insert(
+            "fragments_after".to_string(),
+            int_value(fragments_after as i64),
+        );
+        output.insert(
+            "indices_dropped".to_string(),
+            int_value(dropped_indices as i64),
+        );
+
+        sender.send_completed(JobCompleted {
+            request_id: request.request_id.clone(),
+            job_id: job.job_id.clone(),
+            job_type: JOB_TYPE.to_string(),
+            success: true,
+            result: Some(JobResult {
+                output_values: output,
+                summary: format!("{} rows rewritten in {spec} order", before.rows),
+                ..Default::default()
+            }),
+            ..Default::default()
+        })?;
+        Ok(())
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/lib.rs b/seaweed-worker/crates/lance/src/lib.rs
new file mode 100644
index 0000000000..69455e2aa0
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/lib.rs
@@ -0,0 +1,15 @@
+//! Maintenance jobs for Lance tables.
+//!
+//! A Lance dataset needs three things done to it over time: its fragments
+//! compacted, its indices extended to cover rows written after they were built,
+//! and its old versions removed. None can run in the Go worker, because all
+//! three read and rewrite Lance files. This crate is the worker that can.
+
+pub mod catalog;
+pub mod dataset;
+pub mod jobs;
+pub mod metrics;
+pub mod preview;
+pub mod tls;
+
+pub use jobs::handlers;
diff --git a/seaweed-worker/crates/lance/src/main.rs b/seaweed-worker/crates/lance/src/main.rs
new file mode 100644
index 0000000000..8f688cf357
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/main.rs
@@ -0,0 +1,207 @@
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use clap::Parser;
+use std::net::{IpAddr, SocketAddr};
+use std::sync::Arc;
+
+use seaweed_worker_core::{Metrics, Registry, TlsOptions, WorkerOptions};
+use weed_lance_worker::handlers;
+use weed_lance_worker::metrics::LanceMetrics;
+
+/// Mirrors `weed worker`'s flags, because this is the same contract from another
+/// language and an operator should not have to learn a second set of names.
+#[derive(Parser, Debug)]
+#[command(name = "weed-worker", about = "SeaweedFS maintenance worker")]
+struct Args {
+    /// Admin server gRPC address.
+    #[arg(long, default_value = "localhost:12535", env = "WEED_ADMIN")]
+    admin: String,
+
+    /// Worker identity reported to admin.
+    #[arg(long, default_value = "lance-worker", env = "WEED_WORKER_ID")]
+    id: String,
+
+    /// Lance namespace the worker lists tables from.
+    #[arg(
+        long,
+        default_value = "http://localhost:9101",
+        env = "WEED_LANCE_NAMESPACE"
+    )]
+    namespace: String,
+
+    #[arg(long, default_value = "10", env = "WEED_HEARTBEAT_SECONDS")]
+    heartbeat_seconds: u64,
+
+    #[arg(long, default_value = "1")]
+    max_concurrency: i32,
+
+    /// Storage credentials to use where the namespace vends none. A gateway
+    /// with STS configured vends its own and these are ignored.
+    #[arg(long, env = "WEED_S3_ACCESS_KEY")]
+    access_key: Option<String>,
+
+    #[arg(long, env = "WEED_S3_SECRET_KEY")]
+    secret_key: Option<String>,
+
+    /// mTLS for the admin stream, the same certificates the Go worker reads
+    /// from the [grpc.worker] section of security.toml. All three together, or
+    /// none, in which case the stream is plaintext.
+    #[arg(long, env = "WEED_GRPC_CA")]
+    tls_ca: Option<String>,
+
+    #[arg(long, env = "WEED_GRPC_CLIENT_CERT")]
+    tls_cert: Option<String>,
+
+    #[arg(long, env = "WEED_GRPC_CLIENT_KEY")]
+    tls_key: Option<String>,
+
+    /// Name to verify admin's certificate against, when it is not the address
+    /// this worker dials.
+    #[arg(long)]
+    tls_server_name: Option<String>,
+
+    /// Shared secret for the admin control stream, the `jwt.filer_signing.key`
+    /// value the Go worker reads from its config file. Required by admins that
+    /// authenticate the worker stream with a signing key.
+    #[arg(long, env = "WEED_FILER_SIGNING_KEY")]
+    filer_signing_key: Option<String>,
+
+    /// Lifetime of the token minted from the signing key, mirroring
+    /// `jwt.filer_signing.expires_after_seconds`. Zero mints a token with no
+    /// expiry.
+    #[arg(long, default_value = "0")]
+    filer_signing_key_expires_after_seconds: u64,
+
+    /// Serve /health, /ready and /metrics on this port, the way
+    /// `weed worker -metricsPort` does. Zero, the default, serves nothing.
+    #[arg(long, default_value = "0", env = "WEED_METRICS_PORT")]
+    metrics_port: u16,
+
+    /// Address the metrics server binds. Loopback by default, since the
+    /// endpoint is unauthenticated.
+    #[arg(long, default_value = "127.0.0.1", env = "WEED_METRICS_IP")]
+    metrics_ip: String,
+}
+
+impl Args {
+    /// The TLS configuration, or an error when the three certificate paths do
+    /// not arrive together: a CA on its own would silently give one-way TLS,
+    /// which the cluster's mutual setup refuses anyway.
+    fn tls(&self) -> Result<Option<TlsOptions>> {
+        match (
+            self.tls_ca.clone(),
+            self.tls_cert.clone(),
+            self.tls_key.clone(),
+        ) {
+            (None, None, None) => Ok(None),
+            (Some(ca_path), Some(client_cert_path), Some(client_key_path)) => {
+                Ok(Some(TlsOptions {
+                    ca_path,
+                    client_cert_path,
+                    client_key_path,
+                    server_name: self.tls_server_name.clone(),
+                }))
+            }
+            _ => Err(anyhow::anyhow!(
+                "--tls-ca, --tls-cert and --tls-key must be given together"
+            )),
+        }
+    }
+}
+
+/// Builds the metrics bind address. Parsing the host separately is what makes an
+/// IPv6 literal work: "::1" and 9327 joined with a colon is not an address, and
+/// formatting them that way turns `--metrics-ip ::1` into a startup failure.
+/// Brackets are accepted too, since that is how the same address is written in a
+/// URL and an operator will reasonably try it.
+fn metrics_address(ip: &str, port: u16) -> Result<SocketAddr> {
+    let host = ip.trim().trim_start_matches('[').trim_end_matches(']');
+    let parsed: IpAddr = host
+        .parse()
+        .with_context(|| format!("parse the metrics address {ip}"))?;
+    Ok(SocketAddr::new(parsed, port))
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    weed_lance_worker::tls::install_default_crypto_provider();
+
+    tracing_subscriber::fmt()
+        .with_env_filter(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info")),
+        )
+        .init();
+
+    let args = Args::parse();
+    let tls = args.tls()?;
+    let options = WorkerOptions {
+        admin_address: args.admin,
+        worker_id: args.id,
+        heartbeat_interval: Duration::from_secs(args.heartbeat_seconds),
+        max_detection_concurrency: args.max_concurrency,
+        max_execution_concurrency: args.max_concurrency,
+        tls,
+        signing_key: args.filer_signing_key,
+        signing_key_expires_after_seconds: args.filer_signing_key_expires_after_seconds,
+        ..Default::default()
+    };
+
+    let mut fallback = weed_lance_worker::dataset::FallbackOptions::new();
+    if let (Some(access), Some(secret)) = (args.access_key, args.secret_key) {
+        fallback.insert("aws_access_key_id".to_string(), access);
+        fallback.insert("aws_secret_access_key".to_string(), secret);
+    }
+
+    let metrics = Metrics::new(&options.worker_id, &options.worker_version)?;
+    let lance_metrics = LanceMetrics::new(&metrics)?;
+    if args.metrics_port > 0 {
+        seaweed_worker_core::metrics::spawn(
+            metrics.clone(),
+            metrics_address(&args.metrics_ip, args.metrics_port)?,
+        );
+    }
+
+    let mut registry = Registry::new().with_preview(Arc::new(
+        weed_lance_worker::preview::LancePreview::new(args.namespace.clone(), fallback.clone()),
+    ));
+    for handler in handlers(args.namespace, fallback, Some(lance_metrics)) {
+        registry = registry.register(handler);
+    }
+
+    seaweed_worker_core::stream::run_with_metrics(options, registry, metrics).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::metrics_address;
+
+    #[test]
+    fn metrics_address_takes_ipv4_ipv6_and_brackets() {
+        assert_eq!(
+            metrics_address("127.0.0.1", 9327).unwrap().to_string(),
+            "127.0.0.1:9327"
+        );
+        // Joining these with a colon gives "::1:9327", which is not an address.
+        assert_eq!(
+            metrics_address("::1", 9327).unwrap().to_string(),
+            "[::1]:9327"
+        );
+        assert_eq!(
+            metrics_address("[::1]", 9327).unwrap().to_string(),
+            "[::1]:9327"
+        );
+        assert_eq!(
+            metrics_address("0.0.0.0", 9327).unwrap().to_string(),
+            "0.0.0.0:9327"
+        );
+    }
+
+    #[test]
+    fn metrics_address_rejects_a_hostname() {
+        // Binding takes an address, not a name; saying so beats a confusing
+        // failure inside the server.
+        assert!(metrics_address("localhost", 9327).is_err());
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/metrics.rs b/seaweed-worker/crates/lance/src/metrics.rs
new file mode 100644
index 0000000000..e414a45386
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/metrics.rs
@@ -0,0 +1,50 @@
+//! What the Lance jobs reclaimed, in numbers a scrape can add up.
+//!
+//! The generic worker metrics say a job ran and how long it took. These say what
+//! it did: a compaction sweep that runs every minute and removes nothing is a
+//! different thing from one that never runs, and only these tell them apart.
+
+use anyhow::Result;
+use prometheus::IntCounter;
+use seaweed_worker_core::Metrics;
+
+/// Counters the Lance jobs raise, registered on the worker's own registry so
+/// they are served from the same endpoint.
+#[derive(Clone)]
+pub struct LanceMetrics {
+    /// The worker's own metrics, so a job can also record what it read and what
+    /// it had to skip - the pair that tells "nothing needed doing" apart from
+    /// "nothing could be read".
+    pub worker: Metrics,
+    pub fragments_removed: IntCounter,
+    pub rows_indexed: IntCounter,
+    pub rows_sorted: IntCounter,
+    pub versions_removed: IntCounter,
+    pub bytes_reclaimed: IntCounter,
+}
+
+impl LanceMetrics {
+    pub fn new(metrics: &Metrics) -> Result<Self> {
+        Ok(Self {
+            worker: metrics.clone(),
+            fragments_removed: metrics.counter(
+                "lance_fragments_removed_total",
+                "Fragments merged away by compaction.",
+            )?,
+            rows_indexed: metrics.counter(
+                "lance_rows_indexed_total",
+                "Rows brought under an index that did not cover them.",
+            )?,
+            rows_sorted: metrics.counter(
+                "lance_rows_sorted_total",
+                "Rows rewritten into their table's declared order.",
+            )?,
+            versions_removed: metrics.counter(
+                "lance_versions_removed_total",
+                "Dataset versions removed by cleanup.",
+            )?,
+            bytes_reclaimed: metrics
+                .counter("lance_bytes_reclaimed_total", "Bytes freed by cleanup.")?,
+        })
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/preview.rs b/seaweed-worker/crates/lance/src/preview.rs
new file mode 100644
index 0000000000..092791b69f
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/preview.rs
@@ -0,0 +1,86 @@
+//! Sample rows of a Lance table, for a page that cannot read the format.
+//!
+//! Admin renders an Iceberg table by reading its Parquet files directly. There
+//! is no Go Lance reader, so for Lance the worker does the reading and hands
+//! back text.
+
+use anyhow::{Context, Result};
+use arrow_cast::display::{ArrayFormatter, FormatOptions};
+use async_trait::async_trait;
+use futures::TryStreamExt;
+use seaweed_worker_core::{Preview, PreviewProvider};
+
+use crate::catalog::NamespaceClient;
+use crate::dataset::{self, FallbackOptions};
+use crate::jobs::FORMAT;
+
+pub struct LancePreview {
+    namespace_url: String,
+    fallback: FallbackOptions,
+}
+
+impl LancePreview {
+    pub fn new(namespace_url: String, fallback: FallbackOptions) -> Self {
+        Self {
+            namespace_url,
+            fallback,
+        }
+    }
+}
+
+#[async_trait]
+impl PreviewProvider for LancePreview {
+    fn format(&self) -> &str {
+        FORMAT
+    }
+
+    async fn preview(&self, object_id: &[String], row_limit: usize) -> Result<Preview> {
+        let client = NamespaceClient::new(self.namespace_url.clone());
+        let table = dataset::open(&client, object_id, &self.fallback).await?;
+
+        let total_rows = table.dataset.count_rows(None).await.unwrap_or(0) as i64;
+        let mut scanner = table.dataset.scan();
+        scanner.limit(Some(row_limit as i64), None)?;
+
+        let batches: Vec<_> = scanner
+            .try_into_stream()
+            .await?
+            .try_collect()
+            .await
+            .with_context(|| format!("read rows from {}", table.location))?;
+
+        let columns = table
+            .dataset
+            .schema()
+            .fields
+            .iter()
+            .map(|field| field.name.clone())
+            .collect();
+
+        let mut rows = Vec::new();
+        for batch in &batches {
+            // ArrayFormatter renders each Arrow type the way its own tooling
+            // does, so a vector column reads as a vector rather than as bytes.
+            let formatters = batch
+                .columns()
+                .iter()
+                .map(|array| ArrayFormatter::try_new(array.as_ref(), &FormatOptions::default()))
+                .collect::<Result<Vec<_>, _>>()?;
+            for index in 0..batch.num_rows() {
+                rows.push(
+                    formatters
+                        .iter()
+                        .map(|formatter| formatter.value(index).to_string())
+                        .collect(),
+                );
+            }
+        }
+        rows.truncate(row_limit);
+
+        Ok(Preview {
+            columns,
+            rows,
+            total_rows,
+        })
+    }
+}
diff --git a/seaweed-worker/crates/lance/src/tls.rs b/seaweed-worker/crates/lance/src/tls.rs
new file mode 100644
index 0000000000..c689c7c499
--- /dev/null
+++ b/seaweed-worker/crates/lance/src/tls.rs
@@ -0,0 +1,33 @@
+// aws-lc-rs and ring both get linked transitively (lance's aws backend pulls
+// aws-lc-rs, reqwest's rustls-tls pulls ring), so rustls can't auto-select a
+// provider and tonic's client TLS panics on first use. Pin the default to
+// aws-lc-rs. The body lives in seaweed-common so this binary and the Rust
+// volume server cannot end up installing different providers; re-exported here
+// so callers keep their import path.
+pub use seaweed_common::tls::install_default_crypto_provider;
+
+#[cfg(test)]
+mod tests {
+    use tonic::transport::{Certificate, Channel, ClientTlsConfig, Identity};
+
+    use super::install_default_crypto_provider;
+
+    const TEST_CERT_PEM: &str = "-----BEGIN CERTIFICATE-----\nMIIBPDCB76ADAgECAhRuRPQgeAu43BT/M7EfAWSdapVdYDAFBgMrZXAwFDESMBAG\nA1UEAwwJbG9jYWxob3N0MB4XDTI2MDcwNTE2MTUyOVoXDTM2MDcwMjE2MTUyOVow\nFDESMBAGA1UEAwwJbG9jYWxob3N0MCowBQYDK2VwAyEAr/3bNIFI+8V32oCiY6y+\nXRFmZpdNQ2g//VtRkT+nQg+jUzBRMB0GA1UdDgQWBBTsy9tLf1zPiXCQfgci6zNi\ndEzRSjAfBgNVHSMEGDAWgBTsy9tLf1zPiXCQfgci6zNidEzRSjAPBgNVHRMBAf8E\nBTADAQH/MAUGAytlcANBAIvsdw0IbvOBBkb9cd7BfMJfIP9pQQrAL03pCRWJFnFh\nSysaLVgFXI4T078IiaM874oO+iB+5vNbWEpc7CkGow4=\n-----END CERTIFICATE-----\n";
+    const TEST_KEY_PEM: &str = "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIHbyn71Kk+Y7KT3sBctit7uZpErpoH6qDbFj6P8qGaZH\n-----END PRIVATE KEY-----\n";
+
+    // Without install_default_crypto_provider this panics in the lance crate,
+    // where both aws-lc-rs and ring are linked. Mirrors the volume server's
+    // test_build_grpc_endpoint_with_tls_resolves_crypto_provider.
+    #[tokio::test]
+    async fn tls_channel_builds_after_crypto_provider_installed() {
+        install_default_crypto_provider();
+        let config = ClientTlsConfig::new()
+            .ca_certificate(Certificate::from_pem(TEST_CERT_PEM))
+            .identity(Identity::from_pem(TEST_CERT_PEM, TEST_KEY_PEM));
+        let endpoint = Channel::from_shared("https://127.0.0.1:9")
+            .unwrap()
+            .tls_config(config)
+            .unwrap();
+        assert_eq!(endpoint.uri().scheme_str(), Some("https"));
+    }
+}
diff --git a/seaweed-worker/crates/lance/tests/common/mod.rs b/seaweed-worker/crates/lance/tests/common/mod.rs
new file mode 100644
index 0000000000..10ffb3db86
--- /dev/null
+++ b/seaweed-worker/crates/lance/tests/common/mod.rs
@@ -0,0 +1,97 @@
+//! What every integration test in this crate needs to drive a handler: a sender
+//! that keeps what the handler sent, and the two settings that make a handler
+//! usable against a test gateway.
+//!
+//! Each test binary compiles this module on its own and uses part of it.
+#![allow(dead_code)]
+
+use std::collections::HashMap;
+use std::sync::Mutex;
+
+use anyhow::Result;
+use seaweed_worker_core::pb::{
+    ActivityEvent, ConfigValue, DetectionComplete, DetectionProposals, JobCompleted,
+    JobProgressUpdate, JobProposal, ObjectObservation, WorkerObservations, config_value::Kind,
+};
+use seaweed_worker_core::{DetectionSender, ExecutionSender};
+
+/// Keeps everything a handler reports, so a test can assert on it afterwards.
+#[derive(Default)]
+pub struct Recorder {
+    pub proposals: Mutex<Vec<JobProposal>>,
+    pub observations: Mutex<Vec<ObjectObservation>>,
+    pub completed: Mutex<Vec<JobCompleted>>,
+}
+
+impl DetectionSender for Recorder {
+    fn send_proposals(&self, proposals: DetectionProposals) -> Result<()> {
+        self.proposals.lock().unwrap().extend(proposals.proposals);
+        Ok(())
+    }
+    fn send_complete(&self, _complete: DetectionComplete) -> Result<()> {
+        Ok(())
+    }
+    fn send_activity(&self, _activity: ActivityEvent) -> Result<()> {
+        Ok(())
+    }
+    fn send_observations(&self, observations: WorkerObservations) -> Result<()> {
+        self.observations
+            .lock()
+            .unwrap()
+            .extend(observations.observations);
+        Ok(())
+    }
+}
+
+impl ExecutionSender for Recorder {
+    fn send_progress(&self, _progress: JobProgressUpdate) -> Result<()> {
+        Ok(())
+    }
+    fn send_completed(&self, completed: JobCompleted) -> Result<()> {
+        self.completed.lock().unwrap().push(completed);
+        Ok(())
+    }
+}
+
+/// The gateway to run against, or nothing, in which case the caller skips:
+/// these handlers rewrite real files, and there is nothing to learn from them
+/// against a fake.
+pub fn namespace_url() -> Option<String> {
+    std::env::var("WEED_LANCE_NAMESPACE")
+        .ok()
+        .filter(|s| !s.is_empty())
+}
+
+pub fn int_config(name: &str, value: i64) -> HashMap<String, ConfigValue> {
+    let mut values = HashMap::new();
+    values.insert(
+        name.to_string(),
+        ConfigValue {
+            kind: Some(Kind::Int64Value(value)),
+        },
+    );
+    values
+}
+
+/// What to reach the data with where the namespace vends nothing of its own -
+/// a gateway without STS vends no credentials, and one bound to a wildcard
+/// address vends no endpoint either. Taken from the environment so a harness
+/// can point these tests at a gateway that does check what it is given.
+pub fn fallback() -> weed_lance_worker::dataset::FallbackOptions {
+    let mut options = weed_lance_worker::dataset::FallbackOptions::new();
+    let from_env =
+        |name: &str, default: &str| std::env::var(name).unwrap_or_else(|_| default.to_string());
+    options.insert(
+        "aws_access_key_id".to_string(),
+        from_env("AWS_ACCESS_KEY_ID", "any"),
+    );
+    options.insert(
+        "aws_secret_access_key".to_string(),
+        from_env("AWS_SECRET_ACCESS_KEY", "any"),
+    );
+    if let Ok(endpoint) = std::env::var("AWS_ENDPOINT_URL") {
+        options.insert("aws_endpoint".to_string(), endpoint);
+        options.insert("allow_http".to_string(), "true".to_string());
+    }
+    options
+}
diff --git a/seaweed-worker/crates/lance/tests/compaction.rs b/seaweed-worker/crates/lance/tests/compaction.rs
new file mode 100644
index 0000000000..307e3d437a
--- /dev/null
+++ b/seaweed-worker/crates/lance/tests/compaction.rs
@@ -0,0 +1,540 @@
+//! Drives the compaction handler against a live namespace.
+//!
+//! Skipped unless WEED_LANCE_NAMESPACE names one, the way the Go integration
+//! tests skip without Docker: compaction rewrites real files, and there is
+//! nothing to learn from it against a fake.
+
+use std::collections::HashMap;
+
+use anyhow::Result;
+use seaweed_worker_core::pb::{
+    ExecuteJobRequest, JobSpec, RunDetectionRequest, config_value::Kind,
+};
+use seaweed_worker_core::{JobHandler, PreviewProvider};
+use weed_lance_worker::catalog::NamespaceClient;
+use weed_lance_worker::jobs::cleanup::CleanupVersionsHandler;
+use weed_lance_worker::jobs::compact::{CompactHandler, JOB_TYPE};
+use weed_lance_worker::jobs::indices::OptimizeIndicesHandler;
+use weed_lance_worker::preview::LancePreview;
+
+mod common;
+use common::{Recorder, fallback, int_config, namespace_url};
+
+/// These tests drive one live gateway and one shared catalog: `list_all_tables`
+/// sweeps everything, so a table another test is writing shows up in this test's
+/// detection. Rust runs a binary's tests concurrently, so take a lock.
+static GATEWAY: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
+/// Declares a table through the namespace and writes `fragments` one-row
+/// appends into it, so a test brings its own state instead of depending on
+/// whatever a previous run left behind.
+async fn seed_fragmented_table(url: &str, name: &str, fragments: usize) -> Result<String> {
+    seed_table(url, name, fragments, 1, false).await
+}
+
+/// Writes `batches` appends of `rows_each` into a freshly declared table, and
+/// optionally builds a vector index after the first batch so the later ones are
+/// rows no index covers.
+async fn seed_table(
+    url: &str,
+    name: &str,
+    batches: usize,
+    rows_each: usize,
+    with_index: bool,
+) -> Result<String> {
+    use arrow_array::{
+        FixedSizeListArray, Float32Array, Int64Array, RecordBatch, RecordBatchIterator,
+    };
+    use arrow_schema::{DataType, Field, Schema};
+    use lance::dataset::{Dataset, WriteMode, WriteParams};
+    use lance::io::{ObjectStoreParams, StorageOptionsAccessor};
+    use std::sync::Arc;
+
+    // Declaring is the namespace's job, not the worker's, so the test asks for
+    // it directly rather than widening the client the worker uses. The bucket and
+    // namespace come first: a table cannot be declared under a parent that does
+    // not exist, and a test that assumes one is a test that only passes twice.
+    let http = reqwest::Client::new();
+    for parent in ["vec", "vec$ml"] {
+        http.post(format!("{url}/v1/namespace/{parent}/create"))
+            .json(&serde_json::json!({"mode": "EXIST_OK"}))
+            .send()
+            .await?
+            .error_for_status()?;
+    }
+    let encoded = format!("vec$ml${name}");
+    http.post(format!("{url}/v1/table/{encoded}/declare"))
+        .json(&serde_json::json!({}))
+        .send()
+        .await?
+        .error_for_status()?;
+
+    let client = NamespaceClient::new(url.to_string());
+    let id = vec!["vec".to_string(), "ml".to_string(), name.to_string()];
+    let description = client.describe_table(&id).await?;
+
+    let mut options = description.storage_options.clone();
+    options.extend(fallback());
+    const DIM: i32 = 16;
+    let schema = Arc::new(Schema::new(vec![
+        Field::new("id", DataType::Int64, false),
+        Field::new(
+            "vec",
+            DataType::FixedSizeList(Arc::new(Field::new("item", DataType::Float32, true)), DIM),
+            false,
+        ),
+    ]));
+
+    for i in 0..batches {
+        let ids: Vec<i64> = (0..rows_each).map(|r| (i * rows_each + r) as i64).collect();
+        let values: Vec<f32> = ids
+            .iter()
+            .flat_map(|id| (0..DIM).map(move |d| (*id as f32) + d as f32))
+            .collect();
+        let vectors = FixedSizeListArray::new(
+            Arc::new(Field::new("item", DataType::Float32, true)),
+            DIM,
+            Arc::new(Float32Array::from(values)),
+            None,
+        );
+        let batch = RecordBatch::try_new(
+            schema.clone(),
+            vec![Arc::new(Int64Array::from(ids)), Arc::new(vectors)],
+        )?;
+        let reader = RecordBatchIterator::new(vec![Ok(batch)], schema.clone());
+        let params = WriteParams {
+            mode: if i == 0 {
+                WriteMode::Overwrite
+            } else {
+                WriteMode::Append
+            },
+            store_params: Some(ObjectStoreParams {
+                storage_options_accessor: Some(std::sync::Arc::new(
+                    StorageOptionsAccessor::with_static_options(options.clone()),
+                )),
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+        let dataset = Dataset::write(reader, description.location.as_str(), Some(params)).await?;
+
+        // The index is built after the first batch, so everything appended
+        // afterwards is a row it does not cover.
+        if with_index && i == 0 {
+            use lance::index::DatasetIndexExt;
+            use lance::index::vector::VectorIndexParams;
+            use lance_index::IndexType;
+            use lance_index::vector::{ivf::IvfBuildParams, pq::PQBuildParams};
+
+            let mut dataset = dataset;
+            let params = VectorIndexParams::with_ivf_pq_params(
+                lance_linalg::distance::MetricType::L2,
+                IvfBuildParams::new(1),
+                PQBuildParams::new(4, 8),
+            );
+            dataset
+                .create_index(&["vec"], IndexType::Vector, None, &params, true)
+                .await?;
+        }
+    }
+    Ok(encoded)
+}
+
+/// A table with more fragments than the policy allows is proposed, and running
+/// the proposal leaves it with fewer than it started with.
+#[tokio::test]
+async fn compacts_a_fragmented_table() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    // Seeded here rather than by a script, so the test is repeatable: a previous
+    // run compacts the table it depended on.
+    let encoded = seed_fragmented_table(&url, "compactme", 12)
+        .await
+        .expect("seed a fragmented table");
+    let handler = CompactHandler::new(url).with_fallback(fallback());
+    let recorder = Recorder::default();
+
+    let request = RunDetectionRequest {
+        request_id: "detect-1".to_string(),
+        job_type: JOB_TYPE.to_string(),
+        worker_config_values: int_config("min_fragments", 4),
+        ..Default::default()
+    };
+    handler
+        .detect(&request, &recorder)
+        .await
+        .expect("detection failed");
+
+    let proposals = recorder.proposals.lock().unwrap().clone();
+    assert!(
+        !proposals.is_empty(),
+        "expected a proposal for the fragmented table"
+    );
+    let proposal = proposals
+        .iter()
+        .find(|p| p.summary.contains(encoded.as_str()))
+        .expect("no proposal for the seeded table");
+
+    // Detection opened the dataset to decide, so it reports what it saw. This is
+    // the only description of a Lance table anything outside the format can give.
+    let observations = recorder.observations.lock().unwrap().clone();
+    let observed = observations
+        .iter()
+        .find(|o| o.object_id.last().map(String::as_str) == Some("compactme"))
+        .expect("detection reported no observation for the seeded table");
+    assert_eq!(observed.format, "LANCE");
+    for attribute in ["fragments", "rows", "versions", "schema"] {
+        assert!(
+            observed.attributes.contains_key(attribute),
+            "observation is missing {attribute}: {:?}",
+            observed.attributes.keys().collect::<Vec<_>>()
+        );
+    }
+
+    let execute = ExecuteJobRequest {
+        request_id: "execute-1".to_string(),
+        job: Some(JobSpec {
+            job_id: "job-1".to_string(),
+            job_type: JOB_TYPE.to_string(),
+            parameters: proposal.parameters.clone(),
+            ..Default::default()
+        }),
+        worker_config_values: int_config("target_rows_per_fragment", 1_048_576),
+        ..Default::default()
+    };
+    handler
+        .execute(&execute, &recorder)
+        .await
+        .expect("execution failed");
+
+    let completed = recorder.completed.lock().unwrap().clone();
+    let result = completed.first().expect("no completion reported");
+    assert!(
+        result.success,
+        "compaction reported failure: {}",
+        result.error_message
+    );
+    let summary = result
+        .result
+        .as_ref()
+        .map(|r| r.summary.clone())
+        .unwrap_or_default();
+    assert!(
+        summary.contains("became"),
+        "completion carried no fragment counts: {summary}"
+    );
+    eprintln!("compaction result: {summary}");
+}
+
+/// A table with more versions than the floor is proposed, and running the job
+/// reports what it removed. The compaction test above leaves one behind.
+#[tokio::test]
+async fn cleans_up_old_versions() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    let encoded = seed_table(&url, "cleanme", 6, 4, false)
+        .await
+        .expect("seed a table with versions to clean");
+
+    let handler = CleanupVersionsHandler::new(url).with_fallback(fallback());
+    let recorder = Recorder::default();
+
+    let request = RunDetectionRequest {
+        request_id: "detect-cleanup".to_string(),
+        job_type: "lance_cleanup_versions".to_string(),
+        worker_config_values: int_config("min_versions_to_keep", 2),
+        ..Default::default()
+    };
+    handler
+        .detect(&request, &recorder)
+        .await
+        .expect("detection failed");
+    let proposals = recorder.proposals.lock().unwrap().clone();
+    let proposal = proposals
+        .iter()
+        .find(|p| p.summary.contains(encoded.as_str()))
+        .cloned()
+        .expect("no cleanup proposal for the seeded table");
+
+    // Retain nothing, so every version outside the current one is fair game and
+    // the job has something to report rather than a no-op.
+    let execute = ExecuteJobRequest {
+        request_id: "execute-cleanup".to_string(),
+        job: Some(JobSpec {
+            job_id: "job-cleanup".to_string(),
+            job_type: "lance_cleanup_versions".to_string(),
+            parameters: proposal.parameters.clone(),
+            ..Default::default()
+        }),
+        worker_config_values: int_config("retain_hours", 0),
+        ..Default::default()
+    };
+    handler
+        .execute(&execute, &recorder)
+        .await
+        .expect("cleanup failed");
+
+    let completed = recorder.completed.lock().unwrap().clone();
+    let result = completed.last().expect("no completion reported");
+    assert!(
+        result.success,
+        "cleanup reported failure: {}",
+        result.error_message
+    );
+    eprintln!(
+        "cleanup result: {}",
+        result.result.as_ref().unwrap().summary
+    );
+}
+
+/// A table with no indices has nothing to optimize, so detection proposes
+/// nothing rather than queueing work that would do nothing.
+#[tokio::test]
+async fn skips_tables_without_indices() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    let encoded = seed_table(&url, "noindex", 2, 8, false)
+        .await
+        .expect("seed a table without an index");
+
+    let handler = OptimizeIndicesHandler::new(url).with_fallback(fallback());
+    let recorder = Recorder::default();
+
+    let request = RunDetectionRequest {
+        request_id: "detect-indices".to_string(),
+        job_type: "lance_optimize_indices".to_string(),
+        worker_config_values: int_config("max_unindexed_rows", 1),
+        ..Default::default()
+    };
+    handler
+        .detect(&request, &recorder)
+        .await
+        .expect("detection failed");
+    // Judge this table only: the catalog holds every other test's tables too,
+    // and an indexed one with uncovered rows is supposed to be proposed.
+    assert!(
+        !recorder
+            .proposals
+            .lock()
+            .unwrap()
+            .iter()
+            .any(|p| p.summary.contains(encoded.as_str())),
+        "a table with no indices must not be proposed for reindexing"
+    );
+}
+
+/// The job with no Iceberg equivalent: rows appended after an index was built
+/// are invisible to a search of it until this runs. Needs a table with an index
+/// and rows outside it, which `indexed.py` in the scratchpad seeds.
+#[tokio::test]
+async fn reindexes_rows_an_index_does_not_cover() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    let encoded = seed_table(&url, "reindexme", 2, 512, true)
+        .await
+        .expect("seed an indexed table with uncovered rows");
+    let handler = OptimizeIndicesHandler::new(url).with_fallback(fallback());
+    let recorder = Recorder::default();
+
+    let request = RunDetectionRequest {
+        request_id: "detect-reindex".to_string(),
+        job_type: "lance_optimize_indices".to_string(),
+        worker_config_values: int_config("max_unindexed_rows", 100),
+        ..Default::default()
+    };
+    handler
+        .detect(&request, &recorder)
+        .await
+        .expect("detection failed");
+    let proposals = recorder.proposals.lock().unwrap().clone();
+    let proposal = proposals
+        .iter()
+        .find(|p| p.summary.contains(encoded.as_str()))
+        .cloned()
+        .expect("the seeded indexed table was not proposed");
+
+    let execute = ExecuteJobRequest {
+        request_id: "execute-reindex".to_string(),
+        job: Some(JobSpec {
+            job_id: "job-reindex".to_string(),
+            job_type: "lance_optimize_indices".to_string(),
+            parameters: proposal.parameters.clone(),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+    handler
+        .execute(&execute, &recorder)
+        .await
+        .expect("reindex failed");
+
+    let completed = recorder.completed.lock().unwrap().clone();
+    let result = completed.last().expect("no completion reported");
+    assert!(
+        result.success,
+        "reindex reported failure: {}",
+        result.error_message
+    );
+    let output = &result.result.as_ref().unwrap().output_values;
+    let after = match output
+        .get("unindexed_rows_after")
+        .and_then(|v| v.kind.as_ref())
+    {
+        Some(Kind::Int64Value(value)) => *value,
+        other => panic!("no unindexed_rows_after in {other:?}"),
+    };
+    assert_eq!(
+        after, 0,
+        "rows are still outside the index after optimizing"
+    );
+    eprintln!(
+        "reindex result: {}",
+        result.result.as_ref().unwrap().summary
+    );
+}
+
+/// The UI's whole reason for asking a worker: admin cannot read a Lance table,
+/// so the rows have to come back already rendered.
+#[tokio::test]
+async fn previews_rows_of_a_table() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("set WEED_LANCE_NAMESPACE to run this test");
+        return;
+    };
+    seed_table(&url, "previewme", 2, 3, false)
+        .await
+        .expect("seed a table to preview");
+
+    let provider = LancePreview::new(url, fallback());
+    let id = vec!["vec".to_string(), "ml".to_string(), "previewme".to_string()];
+    let preview = provider.preview(&id, 4).await.expect("preview the table");
+
+    assert_eq!(preview.columns, vec!["id".to_string(), "vec".to_string()]);
+    assert_eq!(preview.total_rows, 6, "total is the table, not the sample");
+    assert_eq!(preview.rows.len(), 4, "row_limit bounds the sample");
+    assert!(
+        preview.rows[0][1].starts_with('['),
+        "a vector column should render as a list, got {:?}",
+        preview.rows[0][1]
+    );
+}
+
+/// The claim that removed managed versioning is not "one writer wins the
+/// conditional PUT" - that is only the mechanism. It is that concurrent writers
+/// lose nothing: the loser sees the conflict, rebases, and commits again. Eight
+/// writers appending at once must leave all eight batches in the table.
+#[tokio::test]
+async fn concurrent_writers_keep_every_commit() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("set WEED_LANCE_NAMESPACE to run this test");
+        return;
+    };
+    const WRITERS: i64 = 8;
+    const ROWS_EACH: i64 = 4;
+
+    seed_table(&url, "racers", 1, ROWS_EACH as usize, false)
+        .await
+        .expect("seed the table the writers will append to");
+
+    let client = NamespaceClient::new(url.clone());
+    let id = vec!["vec".to_string(), "ml".to_string(), "racers".to_string()];
+    let description = client.describe_table(&id).await.expect("describe");
+    let mut options = description.storage_options.clone();
+    options.extend(fallback());
+
+    let writes = (0..WRITERS).map(|writer| {
+        let location = description.location.clone();
+        let options = options.clone();
+        tokio::spawn(
+            async move { append_rows(&location, &options, writer * 1000, ROWS_EACH).await },
+        )
+    });
+    for (writer, handle) in writes.enumerate() {
+        handle
+            .await
+            .expect("writer panicked")
+            .unwrap_or_else(|err| panic!("writer {writer} failed to commit: {err:#}"));
+    }
+
+    let table = weed_lance_worker::dataset::open(&client, &id, &fallback())
+        .await
+        .expect("reopen the table");
+    let rows = table.dataset.count_rows(None).await.expect("count rows");
+    let expected = (ROWS_EACH + WRITERS * ROWS_EACH) as usize;
+    assert_eq!(
+        rows, expected,
+        "concurrent commits lost data: {rows} rows, want {expected}"
+    );
+}
+
+/// Appends one batch to an existing dataset, the way an independent writer would.
+async fn append_rows(
+    location: &str,
+    options: &HashMap<String, String>,
+    first_id: i64,
+    rows: i64,
+) -> Result<()> {
+    use arrow_array::{
+        FixedSizeListArray, Float32Array, Int64Array, RecordBatch, RecordBatchIterator,
+    };
+    use arrow_schema::{DataType, Field, Schema};
+    use lance::dataset::{Dataset, WriteMode, WriteParams};
+    use lance::io::{ObjectStoreParams, StorageOptionsAccessor};
+    use std::sync::Arc;
+
+    const DIM: i32 = 16;
+    let schema = Arc::new(Schema::new(vec![
+        Field::new("id", DataType::Int64, false),
+        Field::new(
+            "vec",
+            DataType::FixedSizeList(Arc::new(Field::new("item", DataType::Float32, true)), DIM),
+            false,
+        ),
+    ]));
+    let ids: Vec<i64> = (0..rows).map(|r| first_id + r).collect();
+    let values: Vec<f32> = ids
+        .iter()
+        .flat_map(|id| (0..DIM).map(move |d| (*id as f32) + d as f32))
+        .collect();
+    let vectors = FixedSizeListArray::new(
+        Arc::new(Field::new("item", DataType::Float32, true)),
+        DIM,
+        Arc::new(Float32Array::from(values)),
+        None,
+    );
+    let batch = RecordBatch::try_new(
+        schema.clone(),
+        vec![Arc::new(Int64Array::from(ids)), Arc::new(vectors)],
+    )?;
+    let params = WriteParams {
+        mode: WriteMode::Append,
+        store_params: Some(ObjectStoreParams {
+            storage_options_accessor: Some(Arc::new(StorageOptionsAccessor::with_static_options(
+                options.clone(),
+            ))),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+    Dataset::write(
+        RecordBatchIterator::new(vec![Ok(batch)], schema.clone()),
+        location,
+        Some(params),
+    )
+    .await?;
+    Ok(())
+}
diff --git a/seaweed-worker/crates/lance/tests/lifecycle.rs b/seaweed-worker/crates/lance/tests/lifecycle.rs
new file mode 100644
index 0000000000..9b5253fff2
--- /dev/null
+++ b/seaweed-worker/crates/lance/tests/lifecycle.rs
@@ -0,0 +1,123 @@
+//! Maintains one table someone else wrote, and nothing else.
+//!
+//! The Go suite in test/s3tables/lifecycle drives a table through its whole
+//! life - declared through the namespace, written by a Lance client, maintained,
+//! read again, dropped - and this is the maintenance step of it, so that step
+//! goes through the handlers a deployed worker runs rather than through the two
+//! lance calls they wrap. The table to work on comes in as WEED_LANCE_TABLE
+//! because the table is the Go test's, seeded and checked there.
+//!
+//! Skipped, like the rest of this crate's integration tests, unless
+//! WEED_LANCE_NAMESPACE names a live gateway.
+
+use std::collections::HashMap;
+
+use seaweed_worker_core::JobHandler;
+use seaweed_worker_core::pb::{ConfigValue, ExecuteJobRequest, JobSpec, RunDetectionRequest};
+use weed_lance_worker::jobs::cleanup::{self, CleanupVersionsHandler};
+use weed_lance_worker::jobs::compact::{CompactHandler, JOB_TYPE as COMPACT_JOB_TYPE};
+
+mod common;
+use common::{Recorder, fallback, int_config, namespace_url};
+
+fn table() -> Option<String> {
+    std::env::var("WEED_LANCE_TABLE")
+        .ok()
+        .filter(|s| !s.is_empty())
+}
+
+/// Compacts the named table's fragments, then drops the versions compaction
+/// left behind. Both go through the handler's own detect-then-execute path: a
+/// proposal the worker would not have made is not one worth running.
+#[tokio::test]
+async fn maintains_the_named_table() {
+    let (Some(url), Some(name)) = (namespace_url(), table()) else {
+        eprintln!("WEED_LANCE_NAMESPACE or WEED_LANCE_TABLE is unset, skipping");
+        return;
+    };
+
+    // A table written as a fragment per append is the case this exists for, so
+    // anything above one fragment is worth merging here.
+    let mut config = int_config("min_fragments", 2);
+    config.extend(int_config("target_rows_per_fragment", 1_048_576));
+    let compact = CompactHandler::new(url.clone()).with_fallback(fallback());
+    run(&compact, COMPACT_JOB_TYPE, &name, config, true).await;
+
+    // Keep the current version and retain nothing else, so the versions
+    // compaction superseded are actually removed rather than counted.
+    let mut config = int_config("min_versions_to_keep", 1);
+    config.extend(int_config("retain_hours", 0));
+    let cleanup = CleanupVersionsHandler::new(url).with_fallback(fallback());
+    run(&cleanup, cleanup::JOB_TYPE, &name, config, true).await;
+}
+
+/// Detects, finds the proposal for `name`, and executes it. The config carries
+/// every key both halves read; each ignores what it does not know.
+async fn run<H: JobHandler>(
+    handler: &H,
+    job_type: &str,
+    name: &str,
+    config: HashMap<String, ConfigValue>,
+    required: bool,
+) {
+    let recorder = Recorder::default();
+    handler
+        .detect(
+            &RunDetectionRequest {
+                request_id: format!("detect-{job_type}"),
+                job_type: job_type.to_string(),
+                worker_config_values: config.clone(),
+                ..Default::default()
+            },
+            &recorder,
+        )
+        .await
+        .unwrap_or_else(|err| panic!("{job_type} detection failed: {err}"));
+
+    let proposals = recorder.proposals.lock().unwrap().clone();
+    let Some(proposal) = proposals.iter().find(|p| p.summary.contains(name)) else {
+        assert!(
+            !required,
+            "{job_type} proposed nothing for {name}, out of {} proposals",
+            proposals.len()
+        );
+        eprintln!("{job_type}: nothing to do for {name}");
+        return;
+    };
+
+    handler
+        .execute(
+            &ExecuteJobRequest {
+                request_id: format!("execute-{job_type}"),
+                job: Some(JobSpec {
+                    job_id: format!("job-{job_type}"),
+                    job_type: job_type.to_string(),
+                    parameters: proposal.parameters.clone(),
+                    ..Default::default()
+                }),
+                worker_config_values: config,
+                ..Default::default()
+            },
+            &recorder,
+        )
+        .await
+        .unwrap_or_else(|err| panic!("{job_type} execution failed: {err}"));
+
+    let completed = recorder.completed.lock().unwrap().clone();
+    let result = completed
+        .last()
+        .unwrap_or_else(|| panic!("{job_type} reported no completion"));
+    assert!(
+        result.success,
+        "{job_type} reported failure: {}",
+        result.error_message
+    );
+    eprintln!(
+        "{job_type}: {}",
+        result
+            .result
+            .as_ref()
+            .map(|r| r.summary.clone())
+            .unwrap_or_default()
+    );
+}
diff --git a/seaweed-worker/crates/lance/tests/sort.rs b/seaweed-worker/crates/lance/tests/sort.rs
new file mode 100644
index 0000000000..9b76d5febf
--- /dev/null
+++ b/seaweed-worker/crates/lance/tests/sort.rs
@@ -0,0 +1,504 @@
+//! Drives the sort handler against a live namespace.
+//!
+//! Skipped unless WEED_LANCE_NAMESPACE names one, like the other integration
+//! tests here: the job rewrites every fragment of a real table and commits, and
+//! the commit is the half worth testing.
+
+use anyhow::Result;
+use seaweed_worker_core::JobHandler;
+use seaweed_worker_core::pb::{
+    ConfigValue, ExecuteJobRequest, JobSpec, RunDetectionRequest, config_value::Kind,
+};
+use weed_lance_worker::catalog::NamespaceClient;
+use weed_lance_worker::jobs::sort::{JOB_TYPE, SortHandler};
+
+mod common;
+use common::{Recorder, fallback, namespace_url};
+
+/// One live gateway and one shared catalog, and `list_all_tables` sweeps
+/// everything, so these tests take a lock the way the compaction ones do.
+static GATEWAY: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
+fn config(values: &[(&str, ConfigValue)]) -> std::collections::HashMap<String, ConfigValue> {
+    values
+        .iter()
+        .map(|(name, value)| (name.to_string(), value.clone()))
+        .collect()
+}
+
+fn int(value: i64) -> ConfigValue {
+    ConfigValue {
+        kind: Some(Kind::Int64Value(value)),
+    }
+}
+
+fn text(value: &str) -> ConfigValue {
+    ConfigValue {
+        kind: Some(Kind::StringValue(value.to_string())),
+    }
+}
+
+/// Declares a table and writes `batches` appends whose ids descend, so the rows
+/// land in an order no sort would produce. `declared` is written into the
+/// dataset's own configuration, which is where a table says how it wants to be
+/// sorted.
+async fn seed_unsorted_table(
+    url: &str,
+    name: &str,
+    batches: i64,
+    rows_each: i64,
+    declared: Option<&str>,
+) -> Result<String> {
+    use arrow_array::{Int64Array, RecordBatch, RecordBatchIterator};
+    use arrow_schema::{DataType, Field, Schema};
+    use lance::dataset::{Dataset, WriteMode, WriteParams};
+    use lance::io::{ObjectStoreParams, StorageOptionsAccessor};
+    use std::sync::Arc;
+
+    let http = reqwest::Client::new();
+    for parent in ["vec", "vec$ml"] {
+        http.post(format!("{url}/v1/namespace/{parent}/create"))
+            .json(&serde_json::json!({"mode": "EXIST_OK"}))
+            .send()
+            .await?
+            .error_for_status()?;
+    }
+    let encoded = format!("vec$ml${name}");
+    http.post(format!("{url}/v1/table/{encoded}/declare"))
+        .json(&serde_json::json!({}))
+        .send()
+        .await?
+        .error_for_status()?;
+
+    let client = NamespaceClient::new(url.to_string());
+    let id = vec!["vec".to_string(), "ml".to_string(), name.to_string()];
+    let description = client.describe_table(&id).await?;
+    let mut options = description.storage_options.clone();
+    options.extend(fallback());
+
+    let schema = Arc::new(Schema::new(vec![Field::new("id", DataType::Int64, false)]));
+    let total = batches * rows_each;
+    let mut dataset = None;
+    for batch_index in 0..batches {
+        // Ids descend across and within the batches, so the physical order is
+        // the reverse of the order the table declares.
+        let ids: Vec<i64> = (0..rows_each)
+            .map(|row| total - 1 - (batch_index * rows_each + row))
+            .collect();
+        let batch = RecordBatch::try_new(schema.clone(), vec![Arc::new(Int64Array::from(ids))])?;
+        let params = WriteParams {
+            mode: if batch_index == 0 {
+                WriteMode::Overwrite
+            } else {
+                WriteMode::Append
+            },
+            store_params: Some(ObjectStoreParams {
+                storage_options_accessor: Some(Arc::new(
+                    StorageOptionsAccessor::with_static_options(options.clone()),
+                )),
+                ..Default::default()
+            }),
+            ..Default::default()
+        };
+        dataset = Some(
+            Dataset::write(
+                RecordBatchIterator::new(vec![Ok(batch)], schema.clone()),
+                description.location.as_str(),
+                Some(params),
+            )
+            .await?,
+        );
+    }
+
+    if let Some(declared) = declared {
+        let mut dataset = dataset.expect("at least one batch was written");
+        dataset
+            .update_config([("seaweedfs.sort.fields", declared)])
+            .await?;
+    }
+    Ok(encoded)
+}
+
+/// Reads the ids back in the order they are stored, which is what a sort is
+/// supposed to change.
+async fn stored_ids(url: &str, name: &str) -> Result<Vec<i64>> {
+    use arrow_array::Int64Array;
+    use futures::TryStreamExt;
+
+    let client = NamespaceClient::new(url.to_string());
+    let id = vec!["vec".to_string(), "ml".to_string(), name.to_string()];
+    let table = weed_lance_worker::dataset::open(&client, &id, &fallback()).await?;
+    let stream = table.dataset.scan().try_into_stream().await?;
+    let batches: Vec<_> = stream.try_collect().await?;
+    let mut ids = Vec::new();
+    for batch in batches {
+        let column = batch
+            .column_by_name("id")
+            .expect("the seeded table has an id column")
+            .as_any()
+            .downcast_ref::<Int64Array>()
+            .expect("id is an Int64 column")
+            .clone();
+        ids.extend(column.values().iter().copied());
+    }
+    Ok(ids)
+}
+
+/// The whole loop: a table declaring an order its rows do not follow is
+/// proposed, sorting it stores the rows in that order, and the marker the same
+/// commit carries is what stops the next sweep proposing it again.
+#[tokio::test]
+async fn sorts_a_table_and_stops_proposing_it() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    let encoded = seed_unsorted_table(&url, "sortme", 4, 250, Some("id asc"))
+        .await
+        .expect("seed an unsorted table");
+
+    let before = stored_ids(&url, "sortme").await.expect("read the ids back");
+    assert!(
+        before.windows(2).any(|pair| pair[0] > pair[1]),
+        "the seeded table was already sorted, so the test proves nothing"
+    );
+
+    let handler = SortHandler::new(url.clone()).with_fallback(fallback());
+    let recorder = Recorder::default();
+    let detection = RunDetectionRequest {
+        request_id: "detect-sort".to_string(),
+        job_type: JOB_TYPE.to_string(),
+        worker_config_values: config(&[("min_unsorted_rows", int(1))]),
+        ..Default::default()
+    };
+    handler
+        .detect(&detection, &recorder)
+        .await
+        .expect("detection failed");
+
+    let proposal = recorder
+        .proposals
+        .lock()
+        .unwrap()
+        .iter()
+        .find(|p| p.summary.contains(encoded.as_str()))
+        .cloned()
+        .expect("the unsorted table was not proposed");
+    assert!(
+        proposal.summary.contains("id asc"),
+        "the proposal does not say what order it would use: {}",
+        proposal.summary
+    );
+
+    let execute = ExecuteJobRequest {
+        request_id: "execute-sort".to_string(),
+        job: Some(JobSpec {
+            job_id: "job-sort".to_string(),
+            job_type: JOB_TYPE.to_string(),
+            parameters: proposal.parameters.clone(),
+            ..Default::default()
+        }),
+        worker_config_values: config(&[
+            ("memory_budget_mb", int(64)),
+            ("max_rows_per_file", int(1024)),
+        ]),
+        ..Default::default()
+    };
+    handler
+        .execute(&execute, &recorder)
+        .await
+        .expect("sorting failed");
+
+    let completed = recorder.completed.lock().unwrap().clone();
+    let result = completed.last().expect("no completion reported");
+    assert!(
+        result.success,
+        "the sort reported failure: {}",
+        result.error_message
+    );
+
+    let after = stored_ids(&url, "sortme")
+        .await
+        .expect("read the sorted ids back");
+    assert_eq!(after.len(), before.len(), "the sort lost or invented rows");
+    assert!(
+        after.windows(2).all(|pair| pair[0] <= pair[1]),
+        "the rows are not stored in ascending id order"
+    );
+
+    // The marker rode in the same commit as the data, so a second sweep finds
+    // the table up to date without anything else having written it.
+    let second = Recorder::default();
+    handler
+        .detect(&detection, &second)
+        .await
+        .expect("second detection failed");
+    assert!(
+        !second
+            .proposals
+            .lock()
+            .unwrap()
+            .iter()
+            .any(|p| p.summary.contains(encoded.as_str())),
+        "a table that was just sorted must not be proposed again"
+    );
+    eprintln!("sort result: {}", result.result.as_ref().unwrap().summary);
+}
+
+/// A table that declares no order, with a worker configuring none either, is
+/// not something to rewrite on a guess.
+#[tokio::test]
+async fn leaves_a_table_that_declares_no_order_alone() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    let encoded = seed_unsorted_table(&url, "unsorted", 2, 16, None)
+        .await
+        .expect("seed a table with no declared order");
+
+    let handler = SortHandler::new(url.clone()).with_fallback(fallback());
+    let recorder = Recorder::default();
+    handler
+        .detect(
+            &RunDetectionRequest {
+                request_id: "detect-none".to_string(),
+                job_type: JOB_TYPE.to_string(),
+                worker_config_values: config(&[
+                    ("min_unsorted_rows", int(1)),
+                    ("sort_fields", text("")),
+                ]),
+                ..Default::default()
+            },
+            &recorder,
+        )
+        .await
+        .expect("detection failed");
+
+    assert!(
+        !recorder
+            .proposals
+            .lock()
+            .unwrap()
+            .iter()
+            .any(|p| p.summary.contains(encoded.as_str())),
+        "a table with no order named anywhere must not be proposed"
+    );
+}
+
+/// The case a row-count threshold cannot see: the table replaced by a write of
+/// its own, growing by far less than `min_unsorted_rows`. Every row moved, so
+/// the table is unsorted, and detection has to say so however small the delta.
+#[tokio::test]
+async fn proposes_a_replacement_that_barely_changes_the_row_count() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    let encoded = seed_unsorted_table(&url, "replaceme", 4, 250, Some("id asc"))
+        .await
+        .expect("seed an unsorted table");
+
+    let handler = SortHandler::new(url.clone()).with_fallback(fallback());
+    // A threshold no realistic append would cross, so nothing but the identity
+    // of the data can be what proposes this table.
+    let detection = RunDetectionRequest {
+        request_id: "detect-replace".to_string(),
+        job_type: JOB_TYPE.to_string(),
+        worker_config_values: config(&[("min_unsorted_rows", int(1_000_000))]),
+        ..Default::default()
+    };
+
+    let first = Recorder::default();
+    handler.detect(&detection, &first).await.expect("detection");
+    let proposal = first
+        .proposals
+        .lock()
+        .unwrap()
+        .iter()
+        .find(|p| p.summary.contains(encoded.as_str()))
+        .cloned()
+        .expect("a never-sorted table was not proposed");
+
+    handler
+        .execute(
+            &ExecuteJobRequest {
+                request_id: "execute-replace".to_string(),
+                job: Some(JobSpec {
+                    job_id: "job-replace".to_string(),
+                    job_type: JOB_TYPE.to_string(),
+                    parameters: proposal.parameters.clone(),
+                    ..Default::default()
+                }),
+                worker_config_values: config(&[("max_rows_per_file", int(1024))]),
+                ..Default::default()
+            },
+            &first,
+        )
+        .await
+        .expect("sorting failed");
+
+    // Sorted, and left alone by the next sweep.
+    let after_sort = Recorder::default();
+    handler
+        .detect(&detection, &after_sort)
+        .await
+        .expect("detection");
+    assert!(
+        !after_sort
+            .proposals
+            .lock()
+            .unwrap()
+            .iter()
+            .any(|p| p.summary.contains(encoded.as_str())),
+        "a table that was just sorted must not be proposed again"
+    );
+
+    // Now replace the data: 1002 rows where there were 1000, shuffled again.
+    seed_unsorted_table(&url, "replaceme", 3, 334, Some("id asc"))
+        .await
+        .expect("replace the table's data");
+
+    let after_replace = Recorder::default();
+    handler
+        .detect(&detection, &after_replace)
+        .await
+        .expect("detection");
+    assert!(
+        after_replace
+            .proposals
+            .lock()
+            .unwrap()
+            .iter()
+            .any(|p| p.summary.contains(encoded.as_str())),
+        "a replaced table must be proposed even when the row count barely moved"
+    );
+}
+
+/// Deletions must not hide appended rows. This is the arithmetic against a real
+/// manifest rather than a hand-built one: the sorted fragments keep their files
+/// and lose most of their rows, a smaller batch is appended after them, and the
+/// table has to be proposed *because rows were appended* — not because it looks
+/// replaced, and not left alone because it now holds fewer rows than when it
+/// was sorted.
+#[tokio::test]
+async fn deletions_do_not_hide_appended_rows() {
+    let _gateway = GATEWAY.lock().await;
+    let Some(url) = namespace_url() else {
+        eprintln!("WEED_LANCE_NAMESPACE is unset, skipping");
+        return;
+    };
+    let encoded = seed_unsorted_table(&url, "deleteme", 4, 250, Some("id asc"))
+        .await
+        .expect("seed an unsorted table");
+
+    let handler = SortHandler::new(url.clone()).with_fallback(fallback());
+    let detection = RunDetectionRequest {
+        request_id: "detect-delete".to_string(),
+        job_type: JOB_TYPE.to_string(),
+        worker_config_values: config(&[("min_unsorted_rows", int(100))]),
+        ..Default::default()
+    };
+
+    let recorder = Recorder::default();
+    handler
+        .detect(&detection, &recorder)
+        .await
+        .expect("detection");
+    let proposal = recorder
+        .proposals
+        .lock()
+        .unwrap()
+        .iter()
+        .find(|p| p.summary.contains(encoded.as_str()))
+        .cloned()
+        .expect("a never-sorted table was not proposed");
+    handler
+        .execute(
+            &ExecuteJobRequest {
+                request_id: "execute-delete".to_string(),
+                job: Some(JobSpec {
+                    job_id: "job-delete".to_string(),
+                    job_type: JOB_TYPE.to_string(),
+                    parameters: proposal.parameters.clone(),
+                    ..Default::default()
+                }),
+                worker_config_values: config(&[("max_rows_per_file", int(1024))]),
+                ..Default::default()
+            },
+            &recorder,
+        )
+        .await
+        .expect("sorting failed");
+
+    // Delete 900 of the 1000 sorted rows, then append 200 unsorted ones. The
+    // table is smaller than when it was sorted, so net growth reads as zero.
+    let client = NamespaceClient::new(url.clone());
+    let id = vec!["vec".to_string(), "ml".to_string(), "deleteme".to_string()];
+    let mut table = weed_lance_worker::dataset::open(&client, &id, &fallback())
+        .await
+        .expect("reopen the sorted table");
+    table
+        .dataset
+        .delete("id < 900")
+        .await
+        .expect("delete most of the sorted rows");
+    append_ids(&url, "deleteme", 5_000, 200)
+        .await
+        .expect("append rows after the sorted ones");
+
+    let after = Recorder::default();
+    handler.detect(&detection, &after).await.expect("detection");
+    let proposal = after
+        .proposals
+        .lock()
+        .unwrap()
+        .iter()
+        .find(|p| p.summary.contains(encoded.as_str()))
+        .cloned()
+        .expect("a table with 200 unsorted rows appended was not proposed");
+    assert!(
+        proposal.detail.contains("200 rows appended"),
+        "expected the appended rows to be counted, got {:?}",
+        proposal.detail
+    );
+}
+
+/// Appends one batch of ascending ids to an existing table.
+async fn append_ids(url: &str, name: &str, first_id: i64, rows: i64) -> Result<()> {
+    use arrow_array::{Int64Array, RecordBatch, RecordBatchIterator};
+    use arrow_schema::{DataType, Field, Schema};
+    use lance::dataset::{Dataset, WriteMode, WriteParams};
+    use lance::io::{ObjectStoreParams, StorageOptionsAccessor};
+    use std::sync::Arc;
+
+    let client = NamespaceClient::new(url.to_string());
+    let id = vec!["vec".to_string(), "ml".to_string(), name.to_string()];
+    let description = client.describe_table(&id).await?;
+    let mut options = description.storage_options.clone();
+    options.extend(fallback());
+
+    let schema = Arc::new(Schema::new(vec![Field::new("id", DataType::Int64, false)]));
+    let ids: Vec<i64> = (0..rows).map(|row| first_id + row).collect();
+    let batch = RecordBatch::try_new(schema.clone(), vec![Arc::new(Int64Array::from(ids))])?;
+    let params = WriteParams {
+        mode: WriteMode::Append,
+        store_params: Some(ObjectStoreParams {
+            storage_options_accessor: Some(Arc::new(StorageOptionsAccessor::with_static_options(
+                options,
+            ))),
+            ..Default::default()
+        }),
+        ..Default::default()
+    };
+    Dataset::write(
+        RecordBatchIterator::new(vec![Ok(batch)], schema.clone()),
+        description.location.as_str(),
+        Some(params),
+    )
+    .await?;
+    Ok(())
+}
diff --git a/seaweed-worker/crates/sort/Cargo.toml b/seaweed-worker/crates/sort/Cargo.toml
new file mode 100644
index 0000000000..1488f2f7ac
--- /dev/null
+++ b/seaweed-worker/crates/sort/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "seaweed-worker-sort"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+description = "The sort specification shared by SeaweedFS sorting jobs"
+
+[lib]
+name = "seaweed_worker_sort"
+
+[dependencies]
+seaweed-worker-core = { path = "../core" }
+anyhow.workspace = true
+
+[lints]
+workspace = true
diff --git a/seaweed-worker/crates/sort/src/lib.rs b/seaweed-worker/crates/sort/src/lib.rs
new file mode 100644
index 0000000000..8f6fc6a88d
--- /dev/null
+++ b/seaweed-worker/crates/sort/src/lib.rs
@@ -0,0 +1,612 @@
+//! The sort specification the sorting jobs share.
+//!
+//! A worker sorts a table by the fields the table itself declares, and by the
+//! fields its own configuration names for a table that declares none. Both
+//! halves of that rule, and the spelling of a field list, live here rather than
+//! in each job: a Lance job and an Iceberg job that disagreed about what
+//! "id desc nulls-first" means would be two features wearing one name.
+//!
+//! The spelling is deliberately the one `weed/worker/tasks/iceberg` already
+//! writes into an Iceberg snapshot's `sort-fields` summary, so the same order
+//! reads the same way whichever format holds the table and whichever language
+//! sorted it.
+
+use std::collections::{HashMap, HashSet};
+use std::fmt;
+
+use anyhow::{Context, Result, bail};
+use seaweed_worker_core::config_form::{number_field, text_field};
+use seaweed_worker_core::pb::ConfigField;
+
+/// Worker configuration keys. Shared so the Iceberg and Lance forms offer an
+/// operator the same names for the same settings.
+pub const CONFIG_SORT_FIELDS: &str = "sort_fields";
+pub const CONFIG_MIN_UNSORTED_ROWS: &str = "min_unsorted_rows";
+pub const CONFIG_MEMORY_BUDGET_MB: &str = "memory_budget_mb";
+pub const CONFIG_MAX_ROWS_PER_FILE: &str = "max_rows_per_file";
+
+/// The order an operator declares on a table. The worker only ever reads this
+/// one.
+pub const DECLARED_FIELDS_KEY: &str = "seaweedfs.sort.fields";
+
+/// What the worker recorded about the sort it last performed. Kept apart from
+/// the declaration above so that "the operator asked for this order" and "the
+/// worker achieved this order" stay distinguishable — comparing them is how a
+/// changed order is noticed.
+pub const SORTED_FIELDS_KEY: &str = "seaweedfs.sort.sorted_fields";
+pub const SORTED_ROWS_KEY: &str = "seaweedfs.sort.sorted_rows";
+/// How many fragments the sort wrote, and a digest of their data file names.
+/// Together they identify the data the sort produced — see [`verdict`] for why
+/// a version number cannot.
+pub const SORTED_FRAGMENTS_KEY: &str = "seaweedfs.sort.sorted_fragments";
+pub const SORTED_DIGEST_KEY: &str = "seaweedfs.sort.sorted_digest";
+
+/// One field of a sort order.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SortField {
+    pub path: String,
+    pub descending: bool,
+    pub nulls_first: bool,
+}
+
+/// A whole sort order, in the order the fields are compared.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SortSpec {
+    pub fields: Vec<SortField>,
+}
+
+impl SortSpec {
+    /// Reads "user_id asc nulls-last, ts desc" into a spec. An empty string is
+    /// not an error: it is how an operator says nothing, and the caller decides
+    /// what that means.
+    ///
+    /// Direction defaults to ascending and null order to Iceberg's default for
+    /// the direction — nulls first ascending, nulls last descending — because
+    /// this spelling is shared with tables that already have that rule.
+    pub fn parse(text: &str) -> Result<Option<Self>> {
+        let mut fields = Vec::new();
+        let mut seen = HashSet::new();
+        for entry in text.split(',') {
+            let entry = entry.trim();
+            if entry.is_empty() {
+                continue;
+            }
+            let field =
+                parse_field(entry).with_context(|| format!("read the sort field {entry:?}"))?;
+            // Compared exactly, not case-folded: Arrow schemas are
+            // case-sensitive, so `id` and `ID` can be two real columns and
+            // folding them together would reject a valid order. The Iceberg
+            // job, whose format resolves names case-insensitively, does its own
+            // check against the table schema.
+            if !seen.insert(field.path.clone()) {
+                bail!("the sort field {:?} is named twice", field.path);
+            }
+            fields.push(field);
+        }
+        if fields.is_empty() {
+            return Ok(None);
+        }
+        Ok(Some(Self { fields }))
+    }
+}
+
+/// Renders a spec back, always spelling out direction and null order so that a
+/// recorded order round-trips to the same thing it was parsed from.
+impl fmt::Display for SortSpec {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        for (i, field) in self.fields.iter().enumerate() {
+            if i > 0 {
+                write!(f, ", ")?;
+            }
+            write!(
+                f,
+                "{} {} {}",
+                field.path,
+                if field.descending { "desc" } else { "asc" },
+                if field.nulls_first {
+                    "nulls-first"
+                } else {
+                    "nulls-last"
+                }
+            )?;
+        }
+        Ok(())
+    }
+}
+
+fn parse_field(entry: &str) -> Result<SortField> {
+    let mut tokens = entry.split_whitespace();
+    let path = tokens
+        .next()
+        .expect("split_whitespace yields one token for a non-empty entry")
+        .to_string();
+
+    let mut descending = None;
+    let mut nulls_first = None;
+    for token in tokens {
+        // Underscores are accepted because that is how the same words are
+        // spelled in configuration keys, and refusing them would only teach an
+        // operator that the two spellings are different things.
+        match token.to_ascii_lowercase().replace('_', "-").as_str() {
+            "asc" | "ascending" if descending.is_none() => descending = Some(false),
+            "desc" | "descending" if descending.is_none() => descending = Some(true),
+            "nulls-first" if nulls_first.is_none() => nulls_first = Some(true),
+            "nulls-last" if nulls_first.is_none() => nulls_first = Some(false),
+            other => bail!("{other:?} is not a direction or a null order"),
+        }
+    }
+
+    let descending = descending.unwrap_or(false);
+    Ok(SortField {
+        path,
+        descending,
+        nulls_first: nulls_first.unwrap_or(!descending),
+    })
+}
+
+/// The order to sort a table by: what the table declares wins, and the worker's
+/// configuration is the fallback for a table that declares nothing. Neither one
+/// is not an error — it means this is not a table the operator wants sorted.
+///
+/// A declaration that cannot be read is an error rather than a reason to fall
+/// back: sorting by the worker's default order instead of the one the table
+/// asked for would silently rewrite the table the wrong way.
+pub fn resolve(declared: Option<&str>, configured: &str) -> Result<Option<SortSpec>> {
+    if let Some(declared) = declared
+        && let Some(spec) = SortSpec::parse(declared).context("read the table's declared order")?
+    {
+        return Ok(Some(spec));
+    }
+    SortSpec::parse(configured).context("read the configured sort order")
+}
+
+/// One fragment as detection sees it.
+///
+/// `rows` is the live row count the manifest records — physical rows less the
+/// deletions — and is None when the manifest does not say, which older
+/// fragments do not.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FragmentSummary {
+    pub files: Vec<String>,
+    pub rows: Option<u64>,
+}
+
+/// Every data file of these fragments, in order.
+pub fn data_files(fragments: &[FragmentSummary]) -> Vec<&str> {
+    fragments
+        .iter()
+        .flat_map(|fragment| fragment.files.iter().map(String::as_str))
+        .collect()
+}
+
+/// A digest of data file names, in the order the fragments hold them.
+///
+/// FNV-1a rather than the standard library's hasher, whose output is explicitly
+/// not stable across releases: a marker that hashed differently after a
+/// toolchain upgrade would re-sort every table once, silently.
+pub fn digest<S: AsRef<str>>(files: &[S]) -> String {
+    let mut hash: u64 = 0xcbf2_9ce4_8422_2325;
+    for file in files {
+        for byte in file.as_ref().as_bytes().iter().chain(std::iter::once(&0u8)) {
+            hash ^= *byte as u64;
+            hash = hash.wrapping_mul(0x1000_0000_01b3);
+        }
+    }
+    format!("{hash:016x}")
+}
+
+/// What the worker recorded on a table the last time it sorted it.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct SortState {
+    pub fields: Option<String>,
+    pub rows: Option<u64>,
+    /// The fragments the sort wrote: how many, and a digest of their data file
+    /// names. Data file names are chosen before the commit, which is what makes
+    /// them usable in a marker the same commit carries.
+    pub fragments: Option<usize>,
+    pub digest: Option<String>,
+}
+
+impl SortState {
+    /// Reads the marker out of a table's key/value configuration. A key that
+    /// will not parse is treated as absent, which asks for a sort rather than
+    /// skipping the table: the cost of a needless sort is time, and the cost of
+    /// skipping is a table that silently never gets sorted again.
+    pub fn from_config(config: &HashMap<String, String>) -> Self {
+        Self {
+            fields: config.get(SORTED_FIELDS_KEY).cloned(),
+            rows: config.get(SORTED_ROWS_KEY).and_then(|v| v.parse().ok()),
+            fragments: config
+                .get(SORTED_FRAGMENTS_KEY)
+                .and_then(|v| v.parse().ok()),
+            digest: config.get(SORTED_DIGEST_KEY).cloned(),
+        }
+    }
+
+    /// The marker to write for a sort that just finished.
+    pub fn record(
+        spec: &SortSpec,
+        fragments: &[FragmentSummary],
+        rows: u64,
+    ) -> HashMap<String, String> {
+        HashMap::from([
+            (SORTED_FIELDS_KEY.to_string(), spec.to_string()),
+            (SORTED_ROWS_KEY.to_string(), rows.to_string()),
+            (
+                SORTED_FRAGMENTS_KEY.to_string(),
+                fragments.len().to_string(),
+            ),
+            (
+                SORTED_DIGEST_KEY.to_string(),
+                digest(&data_files(fragments)),
+            ),
+        ])
+    }
+}
+
+/// Why a table does or does not need sorting.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SortVerdict {
+    NeverSorted,
+    OrderChanged,
+    RowsAppended(u64),
+    /// The table was committed to since the sort, and the row count did not
+    /// grow — the data is not the data that was sorted.
+    Rewritten,
+    UpToDate,
+}
+
+impl SortVerdict {
+    pub fn needs_sort(&self) -> bool {
+        !matches!(self, Self::UpToDate)
+    }
+
+    pub fn reason(&self) -> String {
+        match self {
+            Self::NeverSorted => "never sorted".to_string(),
+            Self::OrderChanged => "the declared order changed since the last sort".to_string(),
+            Self::RowsAppended(rows) => format!("{rows} rows appended since the last sort"),
+            Self::Rewritten => "the data was replaced since the last sort".to_string(),
+            Self::UpToDate => "sorted".to_string(),
+        }
+    }
+}
+
+/// Decides whether a table is worth sorting.
+///
+/// The question detection actually has to answer is "is this still the data the
+/// sort wrote?", and neither the row count nor the dataset version can answer
+/// it. A rewrite that leaves the row count where it was is invisible to the
+/// first, and the second cannot be recorded at all: the commit carrying the
+/// marker is the commit that creates the version, and a commit that rebases
+/// past a conflict lands on a different number again.
+///
+/// Data file names can answer it. They are chosen before the commit, so the
+/// marker the same commit carries can name them, and they are stable no matter
+/// which version the commit ends up as. So:
+///
+/// - the same files → the table is exactly what the sort left;
+/// - the sorted files still there, with more after them → rows were appended,
+///   and only then is `min_unsorted_rows` consulted, which is the churn that
+///   threshold exists to damp;
+/// - anything else → the data was replaced, whatever the row count says.
+///
+/// Appends only ever add fragments after the existing ones, and lance hands out
+/// fragment ids monotonically even across an overwrite, so "the sorted files
+/// are still there" is a prefix test on the files in fragment order.
+///
+/// Deletes leave the data files alone and write a deletion file beside them, so
+/// they read as unchanged here — which is right: deleting rows does not unsort
+/// the ones that remain.
+pub fn verdict(
+    spec: &SortSpec,
+    state: &SortState,
+    fragments: &[FragmentSummary],
+    min_unsorted_rows: u64,
+) -> SortVerdict {
+    let (Some(recorded_digest), Some(recorded_fragments)) =
+        (state.digest.as_deref(), state.fragments)
+    else {
+        return SortVerdict::NeverSorted;
+    };
+    if state.fields.as_deref() != Some(spec.to_string().as_str()) {
+        return SortVerdict::OrderChanged;
+    }
+    if digest(&data_files(fragments)) == recorded_digest {
+        return SortVerdict::UpToDate;
+    }
+
+    // Not the same files. Only a prefix match means the sorted data survived
+    // and the rest was appended after it.
+    if recorded_fragments > fragments.len()
+        || digest(&data_files(&fragments[..recorded_fragments])) != recorded_digest
+    {
+        return SortVerdict::Rewritten;
+    }
+
+    // How many rows are in the fragments appended after the sorted ones.
+    //
+    // Not the table's net growth against the recorded row count: rows deleted
+    // from the sorted fragments hide appended rows one for one, and enough of
+    // them hide every appended row, leaving a table that reads as sorted with
+    // an unsorted tail. Counting the appended fragments themselves is the same
+    // arithmetic the threshold was always meant to do.
+    let mut appended = 0u64;
+    for fragment in &fragments[recorded_fragments..] {
+        // A fragment whose length the manifest does not record cannot be
+        // counted, and a table that cannot be judged is one to sort rather than
+        // one to leave alone forever.
+        let Some(rows) = fragment.rows else {
+            return SortVerdict::Rewritten;
+        };
+        appended += rows;
+    }
+    if appended >= min_unsorted_rows.max(1) {
+        return SortVerdict::RowsAppended(appended);
+    }
+    SortVerdict::UpToDate
+}
+
+/// The settings every sorting job offers, so admin renders one form for the
+/// same behaviour whichever format the job sorts.
+pub fn config_fields() -> Vec<ConfigField> {
+    vec![
+        text_field(
+            CONFIG_SORT_FIELDS,
+            "Sort fields",
+            "Order for tables that declare none of their own, as \"user_id asc, ts desc nulls-last\". Empty sorts only the tables that declare an order.",
+            "user_id asc, ts desc",
+        ),
+        number_field(
+            CONFIG_MIN_UNSORTED_ROWS,
+            "Minimum unsorted rows",
+            "Rows appended since the last sort before a table is worth sorting again",
+            1,
+            1_000_000_000,
+        ),
+        number_field(
+            CONFIG_MEMORY_BUDGET_MB,
+            "Memory budget (MB)",
+            "Memory the sort may hold before it spills runs to disk. A table larger than this sorts more slowly rather than failing.",
+            64,
+            1_048_576,
+        ),
+        number_field(
+            CONFIG_MAX_ROWS_PER_FILE,
+            "Maximum rows per file",
+            "Rows to write into each output file of a sorted rewrite",
+            1024,
+            16_777_216,
+        ),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parses_direction_and_null_order() {
+        let spec = SortSpec::parse("user_id, ts desc, name asc nulls-last")
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            spec.fields,
+            vec![
+                // Ascending defaults to nulls first, descending to nulls last,
+                // which is the rule the Iceberg tables sharing this spelling use.
+                SortField {
+                    path: "user_id".into(),
+                    descending: false,
+                    nulls_first: true
+                },
+                SortField {
+                    path: "ts".into(),
+                    descending: true,
+                    nulls_first: false
+                },
+                SortField {
+                    path: "name".into(),
+                    descending: false,
+                    nulls_first: false
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn renders_back_to_something_that_parses_the_same() {
+        let spec = SortSpec::parse("a, b desc nulls_first").unwrap().unwrap();
+        let rendered = spec.to_string();
+        assert_eq!(rendered, "a asc nulls-first, b desc nulls-first");
+        assert_eq!(SortSpec::parse(&rendered).unwrap().unwrap(), spec);
+    }
+
+    #[test]
+    fn empty_is_no_spec_rather_than_an_error() {
+        assert!(SortSpec::parse("").unwrap().is_none());
+        assert!(SortSpec::parse("  ,  ").unwrap().is_none());
+    }
+
+    #[test]
+    fn rejects_nonsense_and_repeats() {
+        assert!(SortSpec::parse("a sideways").is_err());
+        assert!(SortSpec::parse("a asc desc").is_err());
+        assert!(SortSpec::parse("a, a desc").is_err());
+    }
+
+    #[test]
+    fn the_table_wins_and_configuration_fills_in() {
+        let configured = "b desc";
+        let from_table = resolve(Some("a asc"), configured).unwrap().unwrap();
+        assert_eq!(from_table.fields[0].path, "a");
+
+        let from_config = resolve(None, configured).unwrap().unwrap();
+        assert_eq!(from_config.fields[0].path, "b");
+
+        let from_config_again = resolve(Some("  "), configured).unwrap().unwrap();
+        assert_eq!(from_config_again.fields[0].path, "b");
+
+        assert!(resolve(None, "").unwrap().is_none());
+    }
+
+    // Falling back would sort the table by an order nobody asked for.
+    #[test]
+    fn a_broken_declaration_is_an_error_not_a_fallback() {
+        assert!(resolve(Some("a sideways"), "b desc").is_err());
+    }
+
+    /// One fragment per name, one file each, with a known row count.
+    fn frags(names: &[(&str, u64)]) -> Vec<FragmentSummary> {
+        names
+            .iter()
+            .map(|(name, rows)| FragmentSummary {
+                files: vec![name.to_string()],
+                rows: Some(*rows),
+            })
+            .collect()
+    }
+
+    #[test]
+    fn verdicts_follow_the_marker() {
+        let spec = SortSpec::parse("a asc").unwrap().unwrap();
+        let sorted = frags(&[("a.lance", 500), ("b.lance", 500)]);
+
+        let fresh = SortState::default();
+        assert_eq!(
+            verdict(&spec, &fresh, &sorted, 100),
+            SortVerdict::NeverSorted
+        );
+
+        let state = SortState {
+            fields: Some(spec.to_string()),
+            rows: Some(1_000),
+            fragments: Some(sorted.len()),
+            digest: Some(digest(&data_files(&sorted))),
+        };
+
+        // The same files, whatever version the commit ended up as.
+        assert_eq!(verdict(&spec, &state, &sorted, 100), SortVerdict::UpToDate);
+
+        // Appended: the sorted fragments are still the first ones.
+        let appended_50 = frags(&[("a.lance", 500), ("b.lance", 500), ("c.lance", 50)]);
+        assert_eq!(
+            verdict(&spec, &state, &appended_50, 100),
+            SortVerdict::UpToDate
+        );
+        let appended_100 = frags(&[("a.lance", 500), ("b.lance", 500), ("c.lance", 100)]);
+        assert_eq!(
+            verdict(&spec, &state, &appended_100, 100),
+            SortVerdict::RowsAppended(100)
+        );
+
+        // Replaced: different files, and the row count is no defence — this is
+        // the case a row-count threshold lets through, whatever the delta.
+        let replaced = frags(&[("x.lance", 500), ("y.lance", 501)]);
+        assert_eq!(
+            verdict(&spec, &state, &replaced, 100),
+            SortVerdict::Rewritten
+        );
+        // Compacted into fewer files is a replacement too.
+        assert_eq!(
+            verdict(&spec, &state, &frags(&[("merged.lance", 1_000)]), 100),
+            SortVerdict::Rewritten
+        );
+
+        // Deleting rows rewrites no data file, so the table still reads as
+        // sorted — which it is.
+        let after_deletes = frags(&[("a.lance", 500), ("b.lance", 400)]);
+        assert_eq!(
+            verdict(&spec, &state, &after_deletes, 100),
+            SortVerdict::UpToDate
+        );
+
+        let other = SortSpec::parse("b desc").unwrap().unwrap();
+        assert_eq!(
+            verdict(&other, &state, &sorted, 100),
+            SortVerdict::OrderChanged
+        );
+    }
+
+    /// Deletions must not hide appended rows. Net growth against the recorded
+    /// row count would say this table shrank, and it would stay unsorted with
+    /// an unsorted tail for as long as the deletes kept pace with the appends.
+    #[test]
+    fn deletions_do_not_mask_appended_rows() {
+        let spec = SortSpec::parse("a asc").unwrap().unwrap();
+        let sorted = frags(&[("a.lance", 500), ("b.lance", 500)]);
+        let state = SortState {
+            fields: Some(spec.to_string()),
+            rows: Some(1_000),
+            fragments: Some(sorted.len()),
+            digest: Some(digest(&data_files(&sorted))),
+        };
+
+        // 800 rows deleted from the sorted fragments, 300 appended after them:
+        // the table is smaller than it was, and 300 rows of it are unsorted.
+        let mixed = frags(&[("a.lance", 100), ("b.lance", 100), ("c.lance", 300)]);
+        assert_eq!(
+            verdict(&spec, &state, &mixed, 100),
+            SortVerdict::RowsAppended(300)
+        );
+
+        // The threshold still damps a small append beside heavy deletion.
+        let small = frags(&[("a.lance", 100), ("b.lance", 100), ("c.lance", 20)]);
+        assert_eq!(verdict(&spec, &state, &small, 100), SortVerdict::UpToDate);
+
+        // And net growth is still detected where there are no deletions.
+        let grown = frags(&[("a.lance", 500), ("b.lance", 500), ("c.lance", 700)]);
+        assert_eq!(
+            verdict(&spec, &state, &grown, 100),
+            SortVerdict::RowsAppended(700)
+        );
+    }
+
+    // An appended fragment whose length the manifest does not record cannot be
+    // measured against the threshold, and a table that cannot be judged is one
+    // to sort rather than one to leave alone forever.
+    #[test]
+    fn an_uncountable_appended_fragment_is_stale() {
+        let spec = SortSpec::parse("a asc").unwrap().unwrap();
+        let sorted = frags(&[("a.lance", 500)]);
+        let state = SortState {
+            fields: Some(spec.to_string()),
+            rows: Some(500),
+            fragments: Some(1),
+            digest: Some(digest(&data_files(&sorted))),
+        };
+
+        let mut appended = sorted.clone();
+        appended.push(FragmentSummary {
+            files: vec!["b.lance".to_string()],
+            rows: None,
+        });
+        assert_eq!(
+            verdict(&spec, &state, &appended, 100),
+            SortVerdict::Rewritten
+        );
+        // The untouched table is still up to date: the files answer that
+        // without needing to count anything.
+        assert_eq!(verdict(&spec, &state, &sorted, 100), SortVerdict::UpToDate);
+    }
+
+    // Distinct columns whose names differ only in case are two columns in an
+    // Arrow schema, not one named twice.
+    #[test]
+    fn case_distinguishes_two_fields() {
+        let spec = SortSpec::parse("id asc, ID desc").unwrap().unwrap();
+        assert_eq!(spec.fields.len(), 2);
+        assert!(SortSpec::parse("id asc, id desc").is_err());
+    }
+
+    #[test]
+    fn the_marker_round_trips_through_a_config_map() {
+        let spec = SortSpec::parse("a asc").unwrap().unwrap();
+        let written = frags(&[("one.lance", 20), ("two.lance", 22)]);
+        let recorded = SortState::record(&spec, &written, 42);
+        let state = SortState::from_config(&recorded);
+        assert_eq!(state.rows, Some(42));
+        assert_eq!(state.fragments, Some(2));
+        assert_eq!(verdict(&spec, &state, &written, 1), SortVerdict::UpToDate);
+    }
+}
diff --git a/seaweedfs-rdma-sidecar/.dockerignore b/seaweedfs-rdma-sidecar/.dockerignore
deleted file mode 100644
index 3989eb5bd3..0000000000
--- a/seaweedfs-rdma-sidecar/.dockerignore
+++ /dev/null
@@ -1,65 +0,0 @@
-# Git
-.git
-.gitignore
-.gitmodules
-
-# Documentation
-*.md
-docs/
-
-# Development files
-.vscode/
-.idea/
-*.swp
-*.swo
-*~
-
-# OS generated files
-.DS_Store
-.DS_Store?
-._*
-.Spotlight-V100
-.Trashes
-ehthumbs.db
-Thumbs.db
-
-# Build artifacts
-# bin/ (commented out for Docker build - needed for mount container)
-# target/ (commented out for Docker build)
-*.exe
-*.dll
-*.so
-*.dylib
-
-# Go specific
-vendor/
-*.test
-*.prof
-go.work
-go.work.sum
-
-# Rust specific  
-Cargo.lock
-# rdma-engine/target/ (commented out for Docker build)
-*.pdb
-
-# Docker
-Dockerfile*
-docker-compose*.yml
-.dockerignore
-
-# Test files (tests/ needed for integration test container)
-# tests/
-# scripts/ (commented out for Docker build - needed for mount container)
-*.log
-
-# Temporary files
-tmp/
-temp/
-*.tmp
-*.temp
-
-# IDE and editor files
-*.sublime-*
-.vscode/
-.idea/
diff --git a/seaweedfs-rdma-sidecar/CORRECT-SIDECAR-APPROACH.md b/seaweedfs-rdma-sidecar/CORRECT-SIDECAR-APPROACH.md
deleted file mode 100644
index 743128ba8d..0000000000
--- a/seaweedfs-rdma-sidecar/CORRECT-SIDECAR-APPROACH.md
+++ /dev/null
@@ -1,196 +0,0 @@
-# ✅ Correct RDMA Sidecar Approach - Simple Parameter-Based
-
-## 🎯 **You're Right - Simplified Architecture**
-
-The RDMA sidecar should be **simple** and just take the volume server address as a parameter. The volume lookup complexity should stay in `weed mount`, not in the sidecar.
-
-## 🏗️ **Correct Architecture**
-
-### **1. weed mount (Client Side) - Does Volume Lookup**
-```go
-// File: weed/mount/filehandle_read.go (integration point)
-func (fh *FileHandle) tryRDMARead(ctx context.Context, buff []byte, offset int64) (int64, int64, error) {
-    entry := fh.GetEntry()
-    
-    for _, chunk := range entry.GetEntry().Chunks {
-        if offset >= chunk.Offset && offset < chunk.Offset+int64(chunk.Size) {
-            // Parse chunk info
-            volumeID, needleID, cookie, err := ParseFileId(chunk.FileId)
-            if err != nil {
-                return 0, 0, err
-            }
-            
-            // 🔍 VOLUME LOOKUP (in weed mount, not sidecar)
-            volumeServerAddr, err := fh.wfs.lookupVolumeServer(ctx, volumeID)
-            if err != nil {
-                return 0, 0, err
-            }
-            
-            // 🚀 SIMPLE RDMA REQUEST WITH VOLUME SERVER PARAMETER
-            data, isRDMA, err := fh.wfs.rdmaClient.ReadNeedleFromServer(
-                ctx, volumeServerAddr, volumeID, needleID, cookie, chunkOffset, readSize)
-            
-            return int64(copy(buff, data)), time.Now().UnixNano(), nil
-        }
-    }
-}
-```
-
-### **2. RDMA Mount Client - Passes Volume Server Address**
-```go
-// File: weed/mount/rdma_client.go (modify existing)
-func (c *RDMAMountClient) ReadNeedleFromServer(ctx context.Context, volumeServerAddr string, volumeID uint32, needleID uint64, cookie uint32, offset, size uint64) ([]byte, bool, error) {
-    // Simple HTTP request with volume server as parameter
-    reqURL := fmt.Sprintf("http://%s/rdma/read", c.sidecarAddr)
-    
-    requestBody := map[string]interface{}{
-        "volume_server": volumeServerAddr,  // ← KEY: Pass volume server address
-        "volume_id":     volumeID,
-        "needle_id":     needleID,
-        "cookie":        cookie,
-        "offset":        offset,
-        "size":          size,
-    }
-    
-    // POST request with volume server parameter
-    jsonBody, err := json.Marshal(requestBody)
-    if err != nil {
-        return nil, false, fmt.Errorf("failed to marshal request body: %w", err)
-    }
-    resp, err := c.httpClient.Post(reqURL, "application/json", bytes.NewBuffer(jsonBody))
-    if err != nil {
-        return nil, false, fmt.Errorf("http post to sidecar: %w", err)
-    }
-}
-```
-
-### **3. RDMA Sidecar - Simple, No Lookup Logic**
-```go
-// File: seaweedfs-rdma-sidecar/cmd/demo-server/main.go
-func (s *DemoServer) rdmaReadHandler(w http.ResponseWriter, r *http.Request) {
-    if r.Method != http.MethodPost {
-        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-        return
-    }
-    
-    // Parse request body
-    var req struct {
-        VolumeServer string `json:"volume_server"`  // ← Receive volume server address
-        VolumeID     uint32 `json:"volume_id"`
-        NeedleID     uint64 `json:"needle_id"`
-        Cookie       uint32 `json:"cookie"`
-        Offset       uint64 `json:"offset"`
-        Size         uint64 `json:"size"`
-    }
-    
-    if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-        http.Error(w, "Invalid request", http.StatusBadRequest)
-        return
-    }
-    
-    s.logger.WithFields(logrus.Fields{
-        "volume_server": req.VolumeServer,  // ← Use provided volume server
-        "volume_id":     req.VolumeID,
-        "needle_id":     req.NeedleID,
-    }).Info("📖 Processing RDMA read with volume server parameter")
-    
-    // 🚀 SIMPLE: Use the provided volume server address
-    // No complex lookup logic needed!
-    resp, err := s.rdmaClient.ReadFromVolumeServer(r.Context(), req.VolumeServer, req.VolumeID, req.NeedleID, req.Cookie, req.Offset, req.Size)
-    
-    if err != nil {
-        http.Error(w, fmt.Sprintf("RDMA read failed: %v", err), http.StatusInternalServerError)
-        return
-    }
-    
-    // Return binary data
-    w.Header().Set("Content-Type", "application/octet-stream")
-    w.Header().Set("X-RDMA-Used", "true")
-    w.Write(resp.Data)
-}
-```
-
-### **4. Volume Lookup in weed mount (Where it belongs)**
-```go
-// File: weed/mount/weedfs.go (add method)
-func (wfs *WFS) lookupVolumeServer(ctx context.Context, volumeID uint32) (string, error) {
-    // Use existing SeaweedFS volume lookup logic
-    vid := fmt.Sprintf("%d", volumeID)
-    
-    // Query master server for volume location
-    locations, err := operation.LookupVolumeId(wfs.getMasterFn(), wfs.option.GrpcDialOption, vid)
-    if err != nil {
-        return "", fmt.Errorf("volume lookup failed: %w", err)
-    }
-    
-    if len(locations.Locations) == 0 {
-        return "", fmt.Errorf("no locations found for volume %d", volumeID)
-    }
-    
-    // Return first available location (or implement smart selection)
-    return locations.Locations[0].Url, nil
-}
-```
-
-## 🎯 **Key Differences from Over-Complicated Approach**
-
-### **❌ Over-Complicated (What I Built Before):**
-- ❌ Sidecar does volume lookup
-- ❌ Sidecar has master client integration  
-- ❌ Sidecar has volume location caching
-- ❌ Sidecar forwards requests to remote sidecars
-- ❌ Complex distributed logic in sidecar
-
-### **✅ Correct Simple Approach:**
-- ✅ **weed mount** does volume lookup (where it belongs)
-- ✅ **weed mount** passes volume server address to sidecar
-- ✅ **Sidecar** is simple and stateless
-- ✅ **Sidecar** just does local RDMA read for given server
-- ✅ **No complex distributed logic in sidecar**
-
-## 🚀 **Request Flow (Corrected)**
-
-1. **User Application** → `read()` system call
-2. **FUSE** → `weed mount` WFS.Read()
-3. **weed mount** → Volume lookup: "Where is volume 7?"
-4. **SeaweedFS Master** → "Volume 7 is on server-B:8080"
-5. **weed mount** → HTTP POST to sidecar: `{volume_server: "server-B:8080", volume: 7, needle: 12345}`
-6. **RDMA Sidecar** → Connect to server-B:8080, do local RDMA read
-7. **RDMA Engine** → Direct memory access to volume file
-8. **Response** → Binary data back to weed mount → user
-
-## 📝 **Implementation Changes Needed**
-
-### **1. Simplify Sidecar (Remove Complex Logic)**
-- Remove `DistributedRDMAClient`
-- Remove volume lookup logic
-- Remove master client integration
-- Keep simple RDMA engine communication
-
-### **2. Add Volume Lookup to weed mount**
-- Add `lookupVolumeServer()` method to WFS
-- Modify `RDMAMountClient` to accept volume server parameter
-- Integrate with existing SeaweedFS volume lookup
-
-### **3. Simple Sidecar API**
-```
-POST /rdma/read
-{
-  "volume_server": "server-B:8080",
-  "volume_id": 7,
-  "needle_id": 12345,
-  "cookie": 0,
-  "offset": 0,
-  "size": 4096
-}
-```
-
-## ✅ **Benefits of Simple Approach**
-
-- **🎯 Single Responsibility**: Sidecar only does RDMA, weed mount does lookup
-- **🔧 Maintainable**: Less complex logic in sidecar
-- **⚡ Performance**: No extra network hops for volume lookup
-- **🏗️ Clean Architecture**: Separation of concerns
-- **🐛 Easier Debugging**: Clear responsibility boundaries
-
-You're absolutely right - this is much cleaner! The sidecar should be a simple RDMA accelerator, not a distributed system coordinator.
diff --git a/seaweedfs-rdma-sidecar/CURRENT-STATUS.md b/seaweedfs-rdma-sidecar/CURRENT-STATUS.md
deleted file mode 100644
index e8f53dc1df..0000000000
--- a/seaweedfs-rdma-sidecar/CURRENT-STATUS.md
+++ /dev/null
@@ -1,165 +0,0 @@
-# SeaweedFS RDMA Sidecar - Current Status Summary
-
-## 🎉 **IMPLEMENTATION COMPLETE** 
-**Status**: ✅ **READY FOR PRODUCTION** (Mock Mode) / 🔄 **READY FOR HARDWARE INTEGRATION**
-
----
-
-## 📊 **What's Working Right Now**
-
-### ✅ **Complete Integration Pipeline**
-- **SeaweedFS Mount** → **Go Sidecar** → **Rust Engine** → **Mock RDMA**
-- End-to-end data flow with proper error handling
-- Zero-copy page cache optimization
-- Connection pooling for performance
-
-### ✅ **Production-Ready Components**
-- HTTP API with RESTful endpoints
-- Robust health checks and monitoring
-- Docker multi-service orchestration
-- Comprehensive error handling and fallback
-- Volume lookup and server discovery
-
-### ✅ **Performance Features**
-- **Zero-Copy**: Direct kernel page cache population
-- **Connection Pooling**: Reused IPC connections
-- **Async Operations**: Non-blocking I/O throughout
-- **Metrics**: Detailed performance monitoring
-
-### ✅ **Code Quality**
-- All GitHub PR review comments addressed
-- Memory-safe operations (no dangerous channel closes)
-- Proper file ID parsing using SeaweedFS functions
-- RESTful API design with correct HTTP methods
-
----
-
-## 🔄 **What's Mock/Simulated**
-
-### 🟡 **Mock RDMA Engine** (Rust)
-- **Location**: `rdma-engine/src/rdma.rs`
-- **Function**: Simulates RDMA hardware operations
-- **Data**: Generates pattern data (0,1,2...255,0,1,2...)
-- **Performance**: Realistic latency simulation (150ns reads)
-
-### 🟡 **Simulated Hardware**
-- **Device Info**: Mock Mellanox ConnectX-5 capabilities
-- **Memory Regions**: Fake registration without HCA
-- **Transfers**: Pattern generation instead of network transfer
-- **Completions**: Synthetic work completions
-
----
-
-## 📈 **Current Performance**
-- **Throughput**: ~403 operations/second
-- **Latency**: ~2.48ms average (mock overhead)
-- **Success Rate**: 100% in integration tests
-- **Memory Usage**: Optimized with zero-copy
-
----
-
-## 🏗️ **Architecture Overview**
-
-```
-┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
-│   SeaweedFS     │────▶│   Go Sidecar    │────▶│  Rust Engine    │
-│   Mount Client  │     │   HTTP Server   │     │  Mock RDMA      │
-│   (REAL)        │     │   (REAL)        │     │  (MOCK)         │
-└─────────────────┘     └─────────────────┘     └─────────────────┘
-         │                       │                       │
-         ▼                       ▼                       ▼
-┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
-│ - File ID Parse │     │ - Zero-Copy     │     │ - UCX Ready     │
-│ - Volume Lookup │     │ - Conn Pooling  │     │ - Memory Mgmt   │
-│ - HTTP Fallback │     │ - Health Checks │     │ - IPC Protocol  │
-│ - Error Handling│     │ - REST API      │     │ - Async Ops     │
-└─────────────────┘     └─────────────────┘     └─────────────────┘
-```
-
----
-
-## 🔧 **Key Files & Locations**
-
-### **Core Integration**
-- `weed/mount/filehandle_read.go` - RDMA read integration in FUSE
-- `weed/mount/rdma_client.go` - Mount client RDMA communication
-- `cmd/demo-server/main.go` - Main RDMA sidecar HTTP server
-
-### **RDMA Engine**
-- `rdma-engine/src/rdma.rs` - Mock RDMA implementation
-- `rdma-engine/src/ipc.rs` - IPC protocol with Go sidecar
-- `pkg/rdma/client.go` - Go client for RDMA engine
-
-### **Configuration**
-- `docker-compose.mount-rdma.yml` - Complete integration test setup
-- `go.mod` - Dependencies with local SeaweedFS replacement
-
----
-
-## 🚀 **Ready For Next Steps**
-
-### **Immediate Capability**
-- ✅ **Development**: Full testing without RDMA hardware
-- ✅ **Integration Testing**: Complete pipeline validation
-- ✅ **Performance Benchmarking**: Baseline metrics
-- ✅ **CI/CD**: Mock mode for automated testing
-
-### **Production Transition**
-- 🔄 **Hardware Integration**: Replace mock with UCX library
-- 🔄 **Real Data Transfer**: Remove pattern generation
-- 🔄 **Device Detection**: Enumerate actual RDMA NICs
-- 🔄 **Performance Optimization**: Hardware-specific tuning
-
----
-
-## 📋 **Commands to Resume Work**
-
-### **Start Development Environment**
-```bash
-# Navigate to your seaweedfs-rdma-sidecar directory
-cd /path/to/your/seaweedfs/seaweedfs-rdma-sidecar
-
-# Build components
-go build -o bin/demo-server ./cmd/demo-server
-cargo build --manifest-path rdma-engine/Cargo.toml
-
-# Run integration tests
-docker-compose -f docker-compose.mount-rdma.yml up
-```
-
-### **Test Current Implementation**
-```bash
-# Test sidecar HTTP API
-curl http://localhost:8081/health
-curl http://localhost:8081/stats
-
-# Test RDMA read
-curl "http://localhost:8081/read?volume=1&needle=123&cookie=456&offset=0&size=1024&volume_server=http://localhost:8080"
-```
-
----
-
-## 🎯 **Success Metrics Achieved**
-
-- ✅ **Functional**: Complete RDMA integration pipeline
-- ✅ **Reliable**: Robust error handling and fallback
-- ✅ **Performant**: Zero-copy and connection pooling
-- ✅ **Testable**: Comprehensive mock implementation
-- ✅ **Maintainable**: Clean code with proper documentation
-- ✅ **Scalable**: Async operations and pooling
-- ✅ **Production-Ready**: All review comments addressed
-
----
-
-## 📚 **Documentation**
-
-- `FUTURE-WORK-TODO.md` - Next steps for hardware integration
-- `DOCKER-TESTING.md` - Integration testing guide
-- `docker-compose.mount-rdma.yml` - Complete test environment
-- GitHub PR reviews - All issues addressed and documented
-
----
-
-**🏆 ACHIEVEMENT**: Complete RDMA sidecar architecture with production-ready infrastructure and seamless mock-to-real transition path!
-
-**Next**: Follow `FUTURE-WORK-TODO.md` to replace mock with real UCX hardware integration.
diff --git a/seaweedfs-rdma-sidecar/DOCKER-TESTING.md b/seaweedfs-rdma-sidecar/DOCKER-TESTING.md
deleted file mode 100644
index 88ea1971db..0000000000
--- a/seaweedfs-rdma-sidecar/DOCKER-TESTING.md
+++ /dev/null
@@ -1,290 +0,0 @@
-# 🐳 Docker Integration Testing Guide
-
-This guide provides comprehensive Docker-based integration testing for the SeaweedFS RDMA sidecar system.
-
-## 🏗️ Architecture
-
-The Docker Compose setup includes:
-
-```
-┌─────────────────────┐    ┌─────────────────────┐    ┌─────────────────────┐
-│   SeaweedFS Master  │    │  SeaweedFS Volume   │    │    Rust RDMA       │
-│     :9333          │◄──►│     :8080          │    │    Engine           │
-└─────────────────────┘    └─────────────────────┘    └─────────────────────┘
-                                    │                           │
-                                    ▼                           ▼
-┌─────────────────────┐    ┌─────────────────────┐    ┌─────────────────────┐
-│   Go RDMA Sidecar  │◄──►│    Unix Socket      │◄──►│   Integration       │
-│     :8081          │    │   /tmp/rdma.sock    │    │   Test Suite        │
-└─────────────────────┘    └─────────────────────┘    └─────────────────────┘
-```
-
-## 🚀 Quick Start
-
-### 1. Start All Services
-
-```bash
-# Using the helper script (recommended)
-./tests/docker-test-helper.sh start
-
-# Or using docker-compose directly
-docker-compose up -d
-```
-
-### 2. Run Integration Tests
-
-```bash
-# Run the complete test suite
-./tests/docker-test-helper.sh test
-
-# Or run tests manually
-docker-compose run --rm integration-tests
-```
-
-### 3. Interactive Testing
-
-```bash
-# Open a shell in the test container
-./tests/docker-test-helper.sh shell
-
-# Inside the container, you can run:
-./test-rdma ping
-./test-rdma capabilities  
-./test-rdma read --volume 1 --needle 12345 --size 1024
-curl http://rdma-sidecar:8081/health
-curl http://rdma-sidecar:8081/stats
-```
-
-## 📋 Test Helper Commands
-
-The `docker-test-helper.sh` script provides convenient commands:
-
-```bash
-# Service Management
-./tests/docker-test-helper.sh start      # Start all services
-./tests/docker-test-helper.sh stop       # Stop all services  
-./tests/docker-test-helper.sh clean      # Stop and clean volumes
-
-# Testing
-./tests/docker-test-helper.sh test       # Run integration tests
-./tests/docker-test-helper.sh shell      # Interactive testing shell
-
-# Monitoring
-./tests/docker-test-helper.sh status     # Check service health
-./tests/docker-test-helper.sh logs       # Show all logs
-./tests/docker-test-helper.sh logs rdma-engine  # Show specific service logs
-```
-
-## 🧪 Test Coverage
-
-The integration test suite covers:
-
-### ✅ Core Components
-- **SeaweedFS Master**: Cluster leadership and status
-- **SeaweedFS Volume Server**: Volume operations and health
-- **Rust RDMA Engine**: Socket communication and operations
-- **Go RDMA Sidecar**: HTTP API and RDMA integration
-
-### ✅ Integration Points
-- **IPC Communication**: Unix socket + MessagePack protocol
-- **RDMA Operations**: Ping, capabilities, read operations
-- **HTTP API**: All sidecar endpoints and error handling
-- **Fallback Logic**: RDMA → HTTP fallback behavior
-
-### ✅ Performance Testing
-- **Direct RDMA Benchmarks**: Engine-level performance
-- **Sidecar Benchmarks**: End-to-end performance
-- **Latency Measurements**: Operation timing validation
-- **Throughput Testing**: Operations per second
-
-## 🔧 Service Details
-
-### SeaweedFS Master
-- **Port**: 9333
-- **Health Check**: `/cluster/status`
-- **Data**: Persistent volume `master-data`
-
-### SeaweedFS Volume Server
-- **Port**: 8080  
-- **Health Check**: `/status`
-- **Data**: Persistent volume `volume-data`
-- **Depends on**: SeaweedFS Master
-
-### Rust RDMA Engine
-- **Socket**: `/tmp/rdma-engine.sock`
-- **Mode**: Mock RDMA (development)
-- **Health Check**: Socket existence
-- **Privileged**: Yes (for RDMA access)
-
-### Go RDMA Sidecar
-- **Port**: 8081
-- **Health Check**: `/health`
-- **API Endpoints**: `/stats`, `/read`, `/benchmark`
-- **Depends on**: RDMA Engine, Volume Server
-
-### Test Client
-- **Purpose**: Integration testing and interactive debugging
-- **Tools**: curl, jq, test-rdma binary
-- **Environment**: All service URLs configured
-
-## 📊 Expected Test Results
-
-### ✅ Successful Output Example
-
-```
-===============================================
-🚀 SEAWEEDFS RDMA INTEGRATION TEST SUITE  
-===============================================
-
-🔵 Waiting for SeaweedFS Master to be ready...
-✅ SeaweedFS Master is ready
-✅ SeaweedFS Master is leader and ready
-
-🔵 Waiting for SeaweedFS Volume Server to be ready...
-✅ SeaweedFS Volume Server is ready
-Volume Server Version: 3.60
-
-🔵 Checking RDMA engine socket...
-✅ RDMA engine socket exists
-🔵 Testing RDMA engine ping...
-✅ RDMA engine ping successful
-
-🔵 Waiting for RDMA Sidecar to be ready...
-✅ RDMA Sidecar is ready
-✅ RDMA Sidecar is healthy
-RDMA Status: true
-
-🔵 Testing needle read via sidecar...
-✅ Sidecar needle read successful
-⚠️  HTTP fallback used. Duration: 2.48ms
-
-🔵 Running sidecar performance benchmark...
-✅ Sidecar benchmark completed
-Benchmark Results:
-  RDMA Operations: 5
-  HTTP Operations: 0  
-  Average Latency: 2.479ms
-  Operations/sec: 403.2
-
-===============================================
-🎉 ALL INTEGRATION TESTS COMPLETED!
-===============================================
-```
-
-## 🐛 Troubleshooting
-
-### Service Not Starting
-
-```bash
-# Check service logs
-./tests/docker-test-helper.sh logs [service-name]
-
-# Check container status
-docker-compose ps
-
-# Restart specific service
-docker-compose restart [service-name]
-```
-
-### RDMA Engine Issues
-
-```bash
-# Check socket permissions
-docker-compose exec rdma-engine ls -la /tmp/rdma/rdma-engine.sock
-
-# Check RDMA engine logs
-./tests/docker-test-helper.sh logs rdma-engine
-
-# Test socket directly
-docker-compose exec test-client ./test-rdma ping
-```
-
-### Sidecar Connection Issues  
-
-```bash
-# Test sidecar health directly
-curl http://localhost:8081/health
-
-# Check sidecar logs
-./tests/docker-test-helper.sh logs rdma-sidecar
-
-# Verify environment variables
-docker-compose exec rdma-sidecar env | grep RDMA
-```
-
-### Volume Server Issues
-
-```bash
-# Check SeaweedFS status
-curl http://localhost:9333/cluster/status
-curl http://localhost:8080/status
-
-# Check volume server logs  
-./tests/docker-test-helper.sh logs seaweedfs-volume
-```
-
-## 🔍 Manual Testing Examples
-
-### Test RDMA Engine Directly
-
-```bash
-# Enter test container
-./tests/docker-test-helper.sh shell
-
-# Test RDMA operations
-./test-rdma ping --socket /tmp/rdma-engine.sock
-./test-rdma capabilities --socket /tmp/rdma-engine.sock
-./test-rdma read --socket /tmp/rdma-engine.sock --volume 1 --needle 12345
-./test-rdma bench --socket /tmp/rdma-engine.sock --iterations 10
-```
-
-### Test Sidecar HTTP API
-
-```bash
-# Health and status
-curl http://rdma-sidecar:8081/health | jq '.'
-curl http://rdma-sidecar:8081/stats | jq '.'
-
-# Needle operations
-curl "http://rdma-sidecar:8081/read?volume=1&needle=12345&size=1024" | jq '.'
-
-# Benchmarking
-curl "http://rdma-sidecar:8081/benchmark?iterations=5&size=2048" | jq '.benchmark_results'
-```
-
-### Test SeaweedFS Integration
-
-```bash
-# Check cluster status
-curl http://seaweedfs-master:9333/cluster/status | jq '.'
-
-# Check volume status  
-curl http://seaweedfs-volume:8080/status | jq '.'
-
-# List volumes
-curl http://seaweedfs-master:9333/vol/status | jq '.'
-```
-
-## 🚀 Production Deployment
-
-This Docker setup can be adapted for production by:
-
-1. **Replacing Mock RDMA**: Switch to `real-ucx` feature in Rust
-2. **RDMA Hardware**: Add RDMA device mappings and capabilities
-3. **Security**: Remove privileged mode, add proper user/group mapping  
-4. **Scaling**: Use Docker Swarm or Kubernetes for orchestration
-5. **Monitoring**: Add Prometheus metrics and Grafana dashboards
-6. **Persistence**: Configure proper volume management
-
-## 📚 Additional Resources
-
-- [Main README](README.md) - Complete project overview
-- [Docker Compose Reference](https://docs.docker.com/compose/)
-- [SeaweedFS Documentation](https://github.com/seaweedfs/seaweedfs/wiki)
-- [UCX Documentation](https://github.com/openucx/ucx)
-
----
-
-**🐳 Happy Docker Testing!** 
-
-For issues or questions, please check the logs first and refer to the troubleshooting section above.
diff --git a/seaweedfs-rdma-sidecar/Dockerfile.integration-test b/seaweedfs-rdma-sidecar/Dockerfile.integration-test
deleted file mode 100644
index 8e9d6610e4..0000000000
--- a/seaweedfs-rdma-sidecar/Dockerfile.integration-test
+++ /dev/null
@@ -1,25 +0,0 @@
-# Dockerfile for RDMA Mount Integration Tests
-FROM ubuntu:22.04
-
-# Install dependencies
-RUN apt-get update && apt-get install -y \
-    curl \
-    wget \
-    ca-certificates \
-    jq \
-    bc \
-    time \
-    util-linux \
-    coreutils \
-    && rm -rf /var/lib/apt/lists/*
-
-# Create test directories
-RUN mkdir -p /usr/local/bin /test-results
-
-# Copy test scripts
-COPY scripts/run-integration-tests.sh /usr/local/bin/run-integration-tests.sh
-COPY scripts/test-rdma-mount.sh /usr/local/bin/test-rdma-mount.sh
-RUN chmod +x /usr/local/bin/*.sh
-
-# Default command
-CMD ["/usr/local/bin/run-integration-tests.sh"]
diff --git a/seaweedfs-rdma-sidecar/Dockerfile.mount-rdma b/seaweedfs-rdma-sidecar/Dockerfile.mount-rdma
deleted file mode 100644
index 425defcc7c..0000000000
--- a/seaweedfs-rdma-sidecar/Dockerfile.mount-rdma
+++ /dev/null
@@ -1,40 +0,0 @@
-# Dockerfile for SeaweedFS Mount with RDMA support
-FROM ubuntu:22.04
-
-# Install dependencies
-RUN apt-get update && apt-get install -y \
-    fuse3 \
-    curl \
-    wget \
-    ca-certificates \
-    procps \
-    util-linux \
-    jq \
-    && rm -rf /var/lib/apt/lists/*
-
-# Create necessary directories
-RUN mkdir -p /usr/local/bin /mnt/seaweedfs /var/log/seaweedfs
-
-# Copy SeaweedFS binary (will be built from context)
-COPY bin/weed /usr/local/bin/weed
-RUN chmod +x /usr/local/bin/weed
-
-# Copy mount helper scripts
-COPY scripts/mount-helper.sh /usr/local/bin/mount-helper.sh
-RUN chmod +x /usr/local/bin/mount-helper.sh
-
-# Create mount point
-RUN mkdir -p /mnt/seaweedfs
-
-# Set up FUSE permissions
-RUN echo 'user_allow_other' >> /etc/fuse.conf
-
-# Health check script
-COPY scripts/mount-health-check.sh /usr/local/bin/mount-health-check.sh
-RUN chmod +x /usr/local/bin/mount-health-check.sh
-
-# Expose mount point as volume
-VOLUME ["/mnt/seaweedfs"]
-
-# Default command
-CMD ["/usr/local/bin/mount-helper.sh"]
diff --git a/seaweedfs-rdma-sidecar/Dockerfile.performance-test b/seaweedfs-rdma-sidecar/Dockerfile.performance-test
deleted file mode 100644
index 7ffa81c4f5..0000000000
--- a/seaweedfs-rdma-sidecar/Dockerfile.performance-test
+++ /dev/null
@@ -1,26 +0,0 @@
-# Dockerfile for RDMA Mount Performance Tests
-FROM ubuntu:22.04
-
-# Install dependencies
-RUN apt-get update && apt-get install -y \
-    curl \
-    wget \
-    ca-certificates \
-    jq \
-    bc \
-    time \
-    util-linux \
-    coreutils \
-    fio \
-    iozone3 \
-    && rm -rf /var/lib/apt/lists/*
-
-# Create test directories
-RUN mkdir -p /usr/local/bin /performance-results
-
-# Copy test scripts
-COPY scripts/run-performance-tests.sh /usr/local/bin/run-performance-tests.sh
-RUN chmod +x /usr/local/bin/*.sh
-
-# Default command
-CMD ["/usr/local/bin/run-performance-tests.sh"]
diff --git a/seaweedfs-rdma-sidecar/Dockerfile.rdma-engine b/seaweedfs-rdma-sidecar/Dockerfile.rdma-engine
deleted file mode 100644
index 539a71bd1e..0000000000
--- a/seaweedfs-rdma-sidecar/Dockerfile.rdma-engine
+++ /dev/null
@@ -1,63 +0,0 @@
-# Multi-stage build for Rust RDMA Engine
-FROM rust:1.80-slim AS builder
-
-# Install build dependencies
-RUN apt-get update && apt-get install -y \
-    pkg-config \
-    libssl-dev \
-    libudev-dev \
-    build-essential \
-    libc6-dev \
-    linux-libc-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-# Set work directory
-WORKDIR /app
-
-# Copy Rust project files
-COPY rdma-engine/Cargo.toml ./
-COPY rdma-engine/Cargo.lock ./
-COPY rdma-engine/src ./src
-
-# Build the release binary
-RUN cargo build --release
-
-# Runtime stage
-FROM debian:bookworm-slim
-
-# Install runtime dependencies
-RUN apt-get update && apt-get install -y \
-    ca-certificates \
-    libssl3 \
-    curl \
-    && rm -rf /var/lib/apt/lists/*
-
-# Create app user
-RUN useradd -m -u 1001 appuser
-
-# Set work directory
-WORKDIR /app
-
-# Copy binary from builder stage
-COPY --from=builder /app/target/release/rdma-engine-server .
-
-# Change ownership
-RUN chown -R appuser:appuser /app
-
-# Set default socket path (can be overridden)
-ENV RDMA_SOCKET_PATH=/tmp/rdma/rdma-engine.sock
-
-# Create socket directory with proper permissions (before switching user)
-RUN mkdir -p /tmp/rdma && chown -R appuser:appuser /tmp/rdma
-
-USER appuser
-
-# Expose any needed ports (none for this service as it uses Unix sockets)
-# EXPOSE 18515
-
-# Health check - verify both process and socket using environment variable
-HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=3 \
-    CMD pgrep rdma-engine-server >/dev/null && test -S "$RDMA_SOCKET_PATH"
-
-# Default command using environment variable
-CMD sh -c "./rdma-engine-server --debug --ipc-socket \"$RDMA_SOCKET_PATH\""
diff --git a/seaweedfs-rdma-sidecar/Dockerfile.rdma-engine.simple b/seaweedfs-rdma-sidecar/Dockerfile.rdma-engine.simple
deleted file mode 100644
index cbe3edf167..0000000000
--- a/seaweedfs-rdma-sidecar/Dockerfile.rdma-engine.simple
+++ /dev/null
@@ -1,36 +0,0 @@
-# Simplified Dockerfile for Rust RDMA Engine (using pre-built binary)
-FROM debian:bookworm-slim
-
-# Install runtime dependencies
-RUN apt-get update && apt-get install -y \
-    ca-certificates \
-    libssl3 \
-    curl \
-    procps \
-    && rm -rf /var/lib/apt/lists/*
-
-# Create app user
-RUN useradd -m -u 1001 appuser
-
-# Set work directory
-WORKDIR /app
-
-# Copy pre-built binary from local build
-COPY ./rdma-engine/target/release/rdma-engine-server .
-
-# Change ownership
-RUN chown -R appuser:appuser /app
-USER appuser
-
-# Set default socket path (can be overridden)
-ENV RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-
-# Create socket directory
-RUN mkdir -p /tmp
-
-# Health check - verify both process and socket using environment variable
-HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=3 \
-    CMD pgrep rdma-engine-server >/dev/null && test -S "$RDMA_SOCKET_PATH"
-
-# Default command using environment variable
-CMD sh -c "./rdma-engine-server --debug --ipc-socket \"$RDMA_SOCKET_PATH\""
diff --git a/seaweedfs-rdma-sidecar/Dockerfile.sidecar b/seaweedfs-rdma-sidecar/Dockerfile.sidecar
deleted file mode 100644
index 87bf9b33e0..0000000000
--- a/seaweedfs-rdma-sidecar/Dockerfile.sidecar
+++ /dev/null
@@ -1,55 +0,0 @@
-# Multi-stage build for Go Sidecar
-FROM golang:1.25-alpine AS builder
-
-# Install build dependencies
-RUN apk add --no-cache git ca-certificates tzdata
-
-# Set work directory
-WORKDIR /app
-
-# Copy go mod files
-COPY go.mod go.sum ./
-
-# Download dependencies
-RUN go mod download
-
-# Copy source code
-COPY cmd/ ./cmd/
-COPY pkg/ ./pkg/
-
-# Build the binaries
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o demo-server ./cmd/demo-server
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o sidecar ./cmd/sidecar
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o test-rdma ./cmd/test-rdma
-
-# Runtime stage
-FROM alpine:3.18
-
-# Install runtime dependencies
-RUN apk --no-cache add ca-certificates curl jq
-
-# Create app user
-RUN addgroup -g 1001 appgroup && \
-    adduser -D -s /bin/sh -u 1001 -G appgroup appuser
-
-# Set work directory
-WORKDIR /app
-
-# Copy binaries from builder stage
-COPY --from=builder /app/demo-server .
-COPY --from=builder /app/sidecar .
-COPY --from=builder /app/test-rdma .
-
-# Change ownership
-RUN chown -R appuser:appgroup /app
-USER appuser
-
-# Expose the demo server port
-EXPOSE 8081
-
-# Health check
-HEALTHCHECK --interval=10s --timeout=5s --start-period=15s --retries=3 \
-    CMD curl -f http://localhost:8081/health || exit 1
-
-# Default command (demo server)
-CMD ["./demo-server", "--port", "8081", "--enable-rdma", "--debug"]
diff --git a/seaweedfs-rdma-sidecar/Dockerfile.test-client b/seaweedfs-rdma-sidecar/Dockerfile.test-client
deleted file mode 100644
index 8798635ea5..0000000000
--- a/seaweedfs-rdma-sidecar/Dockerfile.test-client
+++ /dev/null
@@ -1,59 +0,0 @@
-# Multi-stage build for Test Client
-FROM golang:1.25-alpine AS builder
-
-# Install build dependencies
-RUN apk add --no-cache git ca-certificates tzdata
-
-# Set work directory
-WORKDIR /app
-
-# Copy go mod files
-COPY go.mod go.sum ./
-
-# Download dependencies
-RUN go mod download
-
-# Copy source code
-COPY cmd/ ./cmd/
-COPY pkg/ ./pkg/
-
-# Build the test binaries
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o test-rdma ./cmd/test-rdma
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o demo-server ./cmd/demo-server
-
-# Runtime stage
-FROM alpine:3.18
-
-# Install runtime dependencies and testing tools
-RUN apk --no-cache add \
-    ca-certificates \
-    curl \
-    jq \
-    bash \
-    wget \
-    netcat-openbsd \
-    && rm -rf /var/cache/apk/*
-
-# Create app user
-RUN addgroup -g 1001 appgroup && \
-    adduser -D -s /bin/bash -u 1001 -G appgroup appuser
-
-# Set work directory
-WORKDIR /app
-
-# Copy binaries from builder stage
-COPY --from=builder /app/test-rdma .
-COPY --from=builder /app/demo-server .
-
-# Copy test scripts
-COPY tests/ ./tests/
-RUN chmod +x ./tests/*.sh
-
-# Change ownership
-RUN chown -R appuser:appgroup /app
-
-# Switch to app user
-USER appuser
-
-# Default command
-CMD ["/bin/bash"]
diff --git a/seaweedfs-rdma-sidecar/FUTURE-WORK-TODO.md b/seaweedfs-rdma-sidecar/FUTURE-WORK-TODO.md
deleted file mode 100644
index cc7457b907..0000000000
--- a/seaweedfs-rdma-sidecar/FUTURE-WORK-TODO.md
+++ /dev/null
@@ -1,276 +0,0 @@
-# SeaweedFS RDMA Sidecar - Future Work TODO
-
-## 🎯 **Current Status (✅ COMPLETED)**
-
-### **Phase 1: Architecture & Integration - DONE**
-- ✅ **Complete Go ↔ Rust IPC Pipeline**: Unix sockets + MessagePack
-- ✅ **SeaweedFS Integration**: Mount client with RDMA acceleration
-- ✅ **Docker Orchestration**: Multi-service setup with proper networking
-- ✅ **Error Handling**: Robust fallback and recovery mechanisms
-- ✅ **Performance Optimizations**: Zero-copy page cache + connection pooling
-- ✅ **Code Quality**: All GitHub PR review comments addressed
-- ✅ **Testing Framework**: Integration tests and benchmarking tools
-
-### **Phase 2: Mock Implementation - DONE**
-- ✅ **Mock RDMA Engine**: Complete Rust implementation for development
-- ✅ **Pattern Data Generation**: Predictable test data for validation
-- ✅ **Simulated Performance**: Realistic latency and throughput modeling
-- ✅ **Development Environment**: Full testing without hardware requirements
-
----
-
-## 🚀 **PHASE 3: REAL RDMA IMPLEMENTATION**
-
-### **3.1 Hardware Abstraction Layer** 🔴 **HIGH PRIORITY**
-
-#### **Replace Mock RDMA Context**
-**File**: `rdma-engine/src/rdma.rs`
-**Current**:
-```rust
-RdmaContextImpl::Mock(MockRdmaContext::new(config).await?)
-```
-**TODO**:
-```rust
-// Enable UCX feature and implement
-RdmaContextImpl::Ucx(UcxRdmaContext::new(config).await?)
-```
-
-**Tasks**:
-- [ ] Implement `UcxRdmaContext` struct
-- [ ] Add UCX FFI bindings for Rust
-- [ ] Handle UCX initialization and cleanup
-- [ ] Add feature flag: `real-ucx` vs `mock`
-
-#### **Real Memory Management**
-**File**: `rdma-engine/src/rdma.rs` lines 245-270
-**Current**: Fake memory regions in vector
-**TODO**:
-- [ ] Integrate with UCX memory registration APIs
-- [ ] Implement HugePage support for large transfers
-- [ ] Add memory region caching for performance
-- [ ] Handle registration/deregistration errors
-
-#### **Actual RDMA Operations**
-**File**: `rdma-engine/src/rdma.rs` lines 273-335
-**Current**: Pattern data + artificial latency
-**TODO**:
-- [ ] Replace `post_read()` with real UCX RDMA operations
-- [ ] Implement `post_write()` with actual memory transfers
-- [ ] Add completion polling from hardware queues
-- [ ] Handle partial transfers and retries
-
-### **3.2 Data Path Replacement** 🟡 **MEDIUM PRIORITY**
-
-#### **Real Data Transfer**
-**File**: `pkg/rdma/client.go` lines 420-442
-**Current**:
-```go
-// MOCK: Pattern generation
-mockData[i] = byte(i % 256)
-```
-**TODO**:
-```go
-// Get actual data from RDMA buffer
-realData := getRdmaBufferContents(startResp.LocalAddr, startResp.TransferSize)
-validateDataIntegrity(realData, completeResp.ServerCrc)
-```
-
-**Tasks**:
-- [ ] Remove mock data generation
-- [ ] Access actual RDMA transferred data
-- [ ] Implement CRC validation: `completeResp.ServerCrc`
-- [ ] Add data integrity error handling
-
-#### **Hardware Device Detection**
-**File**: `rdma-engine/src/rdma.rs` lines 222-233
-**Current**: Hardcoded Mellanox device info
-**TODO**:
-- [ ] Enumerate real RDMA devices using UCX
-- [ ] Query actual device capabilities
-- [ ] Handle multiple device scenarios
-- [ ] Add device selection logic
-
-### **3.3 Performance Optimization** 🟢 **LOW PRIORITY**
-
-#### **Memory Registration Caching**
-**TODO**:
-- [ ] Implement MR (Memory Region) cache
-- [ ] Add LRU eviction for memory pressure
-- [ ] Optimize for frequently accessed regions
-- [ ] Monitor cache hit rates
-
-#### **Advanced RDMA Features**
-**TODO**:
-- [ ] Implement RDMA Write operations
-- [ ] Add Immediate Data support
-- [ ] Implement RDMA Write with Immediate
-- [ ] Add Atomic operations (if needed)
-
-#### **Multi-Transport Support**
-**TODO**:
-- [ ] Leverage UCX's automatic transport selection
-- [ ] Add InfiniBand support
-- [ ] Add RoCE (RDMA over Converged Ethernet) support
-- [ ] Implement TCP fallback via UCX
-
----
-
-## 🔧 **PHASE 4: PRODUCTION HARDENING**
-
-### **4.1 Error Handling & Recovery**
-- [ ] Add RDMA-specific error codes
-- [ ] Implement connection recovery
-- [ ] Add retry logic for transient failures
-- [ ] Handle device hot-plug scenarios
-
-### **4.2 Monitoring & Observability**
-- [ ] Add RDMA-specific metrics (bandwidth, latency, errors)
-- [ ] Implement tracing for RDMA operations
-- [ ] Add health checks for RDMA devices
-- [ ] Create performance dashboards
-
-### **4.3 Configuration & Tuning**
-- [ ] Add RDMA-specific configuration options
-- [ ] Implement auto-tuning based on workload
-- [ ] Add support for multiple RDMA ports
-- [ ] Create deployment guides for different hardware
-
----
-
-## 📋 **IMMEDIATE NEXT STEPS**
-
-### **Step 1: UCX Integration Setup**
-1. **Add UCX dependencies to Rust**:
-   ```toml
-   [dependencies]
-   ucx-sys = "0.1"  # UCX FFI bindings
-   ```
-
-2. **Create UCX wrapper module**:
-   ```bash
-   touch rdma-engine/src/ucx.rs
-   ```
-
-3. **Implement basic UCX context**:
-   ```rust
-   pub struct UcxRdmaContext {
-       context: *mut ucx_sys::ucp_context_h,
-       worker: *mut ucx_sys::ucp_worker_h,
-   }
-   ```
-
-### **Step 2: Development Environment**
-1. **Install UCX library**:
-   ```bash
-   # Ubuntu/Debian
-   sudo apt-get install libucx-dev
-   
-   # CentOS/RHEL  
-   sudo yum install ucx-devel
-   ```
-
-2. **Update Cargo.toml features**:
-   ```toml
-   [features]
-   default = ["mock"]
-   mock = []
-   real-ucx = ["ucx-sys"]
-   ```
-
-### **Step 3: Testing Strategy**
-1. **Add hardware detection tests**
-2. **Create UCX initialization tests**
-3. **Implement gradual feature migration**
-4. **Maintain mock fallback for CI/CD**
-
----
-
-## 🏗️ **ARCHITECTURE NOTES**
-
-### **Current Working Components**
-- ✅ **Go Sidecar**: Production-ready HTTP API
-- ✅ **IPC Layer**: Robust Unix socket + MessagePack
-- ✅ **SeaweedFS Integration**: Complete mount client integration
-- ✅ **Docker Setup**: Multi-service orchestration
-- ✅ **Error Handling**: Comprehensive fallback mechanisms
-
-### **Mock vs Real Boundary**
-```
-┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
-│   SeaweedFS     │────▶│   Go Sidecar    │────▶│  Rust Engine    │
-│   (REAL)        │     │   (REAL)        │     │   (MOCK)        │
-└─────────────────┘     └─────────────────┘     └─────────────────┘
-                                                          │
-                                                          ▼
-                                                 ┌─────────────────┐
-                                                 │ RDMA Hardware   │
-                                                 │ (TO IMPLEMENT)  │
-                                                 └─────────────────┘
-```
-
-### **Performance Expectations**
-- **Current Mock**: ~403 ops/sec, 2.48ms latency
-- **Target Real**: ~4000 ops/sec, 250μs latency (UCX optimized)
-- **Bandwidth Goal**: 25-100 Gbps (depending on hardware)
-
----
-
-## 📚 **REFERENCE MATERIALS**
-
-### **UCX Documentation**
-- **GitHub**: https://github.com/openucx/ucx
-- **API Reference**: https://openucx.readthedocs.io/
-- **Rust Bindings**: https://crates.io/crates/ucx-sys
-
-### **RDMA Programming**
-- **InfiniBand Architecture**: Volume 1 Specification
-- **RoCE Standards**: IBTA Annex A17
-- **Performance Tuning**: UCX Performance Guide
-
-### **SeaweedFS Integration**
-- **File ID Format**: `weed/storage/needle/file_id.go`
-- **Volume Server**: `weed/server/volume_server_handlers_read.go`
-- **Mount Client**: `weed/mount/filehandle_read.go`
-
----
-
-## ⚠️ **IMPORTANT NOTES**
-
-### **Breaking Changes to Avoid**
-- **Keep IPC Protocol Stable**: Don't change MessagePack format
-- **Maintain HTTP API**: Existing endpoints must remain compatible
-- **Preserve Configuration**: Environment variables should work unchanged
-
-### **Testing Requirements**
-- **Hardware Tests**: Require actual RDMA NICs
-- **CI/CD Compatibility**: Must fallback to mock for automated testing
-- **Performance Benchmarks**: Compare mock vs real performance
-
-### **Security Considerations**
-- **Memory Protection**: Ensure RDMA regions are properly isolated
-- **Access Control**: Validate remote memory access permissions
-- **Data Validation**: Always verify CRC checksums
-
----
-
-## 🎯 **SUCCESS CRITERIA**
-
-### **Phase 3 Complete When**:
-- [ ] Real RDMA data transfers working
-- [ ] Hardware device detection functional
-- [ ] Performance exceeds mock implementation
-- [ ] All integration tests passing with real hardware
-
-### **Phase 4 Complete When**:
-- [ ] Production deployment successful
-- [ ] Monitoring and alerting operational
-- [ ] Performance targets achieved
-- [ ] Error handling validated under load
-
----
-
-**📅 Last Updated**: December 2024
-**👤 Contact**: Resume from `seaweedfs-rdma-sidecar/` directory
-**🏷️ Version**: v1.0 (Mock Implementation Complete)
-
-**🚀 Ready to resume**: All infrastructure is in place, just need to replace the mock RDMA layer with UCX integration!
diff --git a/seaweedfs-rdma-sidecar/Makefile b/seaweedfs-rdma-sidecar/Makefile
deleted file mode 100644
index 19aa904616..0000000000
--- a/seaweedfs-rdma-sidecar/Makefile
+++ /dev/null
@@ -1,205 +0,0 @@
-# SeaweedFS RDMA Sidecar Makefile
-
-.PHONY: help build test clean docker-build docker-test docker-clean integration-test
-
-# Default target
-help: ## Show this help message
-	@echo "SeaweedFS RDMA Sidecar - Available Commands:"
-	@echo ""
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2}'
-	@echo ""
-	@echo "Examples:"
-	@echo "  make build           # Build all components locally"
-	@echo "  make docker-test     # Run complete Docker integration tests"
-	@echo "  make test            # Run unit tests"
-
-# Local Build Targets
-build: build-go build-rust ## Build all components locally
-
-build-go: ## Build Go components (sidecar, demo-server, test-rdma)
-	@echo "🔨 Building Go components..."
-	go build -o bin/sidecar ./cmd/sidecar
-	go build -o bin/demo-server ./cmd/demo-server  
-	go build -o bin/test-rdma ./cmd/test-rdma
-	@echo "✅ Go build complete"
-
-build-rust: ## Build Rust RDMA engine
-	@echo "🦀 Building Rust RDMA engine..."
-	cd rdma-engine && cargo build --release
-	@echo "✅ Rust build complete"
-
-# Testing Targets
-test: test-go test-rust ## Run all unit tests
-
-test-go: ## Run Go tests
-	@echo "🧪 Running Go tests..."
-	go test ./...
-	@echo "✅ Go tests complete"
-
-test-rust: ## Run Rust tests
-	@echo "🧪 Running Rust tests..."
-	cd rdma-engine && cargo test
-	@echo "✅ Rust tests complete"
-
-integration-test: build ## Run local integration test
-	@echo "🔗 Running local integration test..."
-	./scripts/demo-e2e.sh
-	@echo "✅ Local integration test complete"
-
-# Docker Targets
-docker-build: ## Build all Docker images
-	@echo "🐳 Building Docker images..."
-	docker-compose build
-	@echo "✅ Docker images built"
-
-docker-start: ## Start Docker services
-	@echo "🚀 Starting Docker services..."
-	./tests/docker-test-helper.sh start
-	@echo "✅ Docker services started"
-
-docker-test: ## Run Docker integration tests
-	@echo "🧪 Running Docker integration tests..."
-	./tests/docker-test-helper.sh test
-	@echo "✅ Docker integration tests complete"
-
-docker-stop: ## Stop Docker services
-	@echo "🛑 Stopping Docker services..."
-	./tests/docker-test-helper.sh stop
-	@echo "✅ Docker services stopped"
-
-docker-clean: ## Clean Docker services and volumes
-	@echo "🧹 Cleaning Docker environment..."
-	./tests/docker-test-helper.sh clean
-	docker system prune -f
-	@echo "✅ Docker cleanup complete"
-
-docker-logs: ## Show Docker logs
-	./tests/docker-test-helper.sh logs
-
-docker-status: ## Show Docker service status
-	./tests/docker-test-helper.sh status
-
-docker-shell: ## Open interactive shell in test container
-	./tests/docker-test-helper.sh shell
-
-# RDMA Simulation Targets
-rdma-sim-build: ## Build RDMA simulation environment
-	@echo "🚀 Building RDMA simulation environment..."
-	docker-compose -f docker-compose.rdma-sim.yml build
-	@echo "✅ RDMA simulation images built"
-
-rdma-sim-start: ## Start RDMA simulation environment
-	@echo "🚀 Starting RDMA simulation environment..."
-	docker-compose -f docker-compose.rdma-sim.yml up -d
-	@echo "✅ RDMA simulation environment started"
-
-rdma-sim-test: ## Run RDMA simulation tests
-	@echo "🧪 Running RDMA simulation tests..."
-	docker-compose -f docker-compose.rdma-sim.yml run --rm integration-tests-rdma
-	@echo "✅ RDMA simulation tests complete"
-
-rdma-sim-stop: ## Stop RDMA simulation environment
-	@echo "🛑 Stopping RDMA simulation environment..."
-	docker-compose -f docker-compose.rdma-sim.yml down
-	@echo "✅ RDMA simulation environment stopped"
-
-rdma-sim-clean: ## Clean RDMA simulation environment
-	@echo "🧹 Cleaning RDMA simulation environment..."
-	docker-compose -f docker-compose.rdma-sim.yml down -v --remove-orphans
-	docker system prune -f
-	@echo "✅ RDMA simulation cleanup complete"
-
-rdma-sim-status: ## Check RDMA simulation status
-	@echo "📊 RDMA simulation status:"
-	docker-compose -f docker-compose.rdma-sim.yml ps
-	@echo ""
-	@echo "🔍 RDMA device status:"
-	docker-compose -f docker-compose.rdma-sim.yml exec rdma-simulation /opt/rdma-sim/test-rdma.sh || true
-
-rdma-sim-shell: ## Open shell in RDMA simulation container
-	@echo "🐚 Opening RDMA simulation shell..."
-	docker-compose -f docker-compose.rdma-sim.yml exec rdma-simulation /bin/bash
-
-rdma-sim-logs: ## Show RDMA simulation logs
-	docker-compose -f docker-compose.rdma-sim.yml logs
-
-rdma-sim-ucx: ## Show UCX information in simulation
-	@echo "📋 UCX information in simulation:"
-	docker-compose -f docker-compose.rdma-sim.yml exec rdma-simulation /opt/rdma-sim/ucx-info.sh
-
-# Development Targets
-dev-setup: ## Set up development environment
-	@echo "🛠️  Setting up development environment..."
-	go mod tidy
-	cd rdma-engine && cargo check
-	chmod +x scripts/*.sh tests/*.sh
-	@echo "✅ Development environment ready"
-
-format: ## Format code
-	@echo "✨ Formatting code..."
-	go fmt ./...
-	cd rdma-engine && cargo fmt
-	@echo "✅ Code formatted"
-
-lint: ## Run linters
-	@echo "🔍 Running linters..."
-	go vet ./...
-	cd rdma-engine && cargo clippy -- -D warnings
-	@echo "✅ Linting complete"
-
-# Cleanup Targets
-clean: clean-go clean-rust ## Clean all build artifacts
-
-clean-go: ## Clean Go build artifacts
-	@echo "🧹 Cleaning Go artifacts..."
-	rm -rf bin/
-	go clean -testcache
-	@echo "✅ Go artifacts cleaned"
-
-clean-rust: ## Clean Rust build artifacts  
-	@echo "🧹 Cleaning Rust artifacts..."
-	cd rdma-engine && cargo clean
-	@echo "✅ Rust artifacts cleaned"
-
-# Full Workflow Targets
-check: format lint test ## Format, lint, and test everything
-
-ci: check integration-test docker-test ## Complete CI workflow
-
-demo: build ## Run local demo
-	@echo "🎮 Starting local demo..."
-	./scripts/demo-e2e.sh
-
-# Docker Development Workflow
-docker-dev: docker-clean docker-build docker-test ## Complete Docker development cycle
-
-# Quick targets
-quick-test: build ## Quick local test
-	./bin/test-rdma --help
-
-quick-docker: ## Quick Docker test
-	docker-compose up -d rdma-engine rdma-sidecar
-	sleep 5
-	curl -s http://localhost:8081/health | jq '.'
-	docker-compose down
-
-# Help and Documentation
-docs: ## Generate/update documentation
-	@echo "📚 Documentation ready:"
-	@echo "  README.md - Main project documentation"
-	@echo "  DOCKER-TESTING.md - Docker integration testing guide"
-	@echo "  Use 'make help' for available commands"
-
-# Environment Info
-info: ## Show environment information
-	@echo "🔍 Environment Information:"
-	@echo "  Go Version: $$(go version)"
-	@echo "  Rust Version: $$(cd rdma-engine && cargo --version)"
-	@echo "  Docker Version: $$(docker --version)"
-	@echo "  Docker Compose Version: $$(docker-compose --version)"
-	@echo ""
-	@echo "🏗️  Project Structure:"
-	@echo "  Go Components: cmd/ pkg/"
-	@echo "  Rust Engine: rdma-engine/"  
-	@echo "  Tests: tests/"
-	@echo "  Scripts: scripts/"
diff --git a/seaweedfs-rdma-sidecar/README.md b/seaweedfs-rdma-sidecar/README.md
deleted file mode 100644
index 402a992a58..0000000000
--- a/seaweedfs-rdma-sidecar/README.md
+++ /dev/null
@@ -1,385 +0,0 @@
-# 🚀 SeaweedFS RDMA Sidecar
-
-**High-Performance RDMA Acceleration for SeaweedFS using UCX and Rust**
-
-[![Build Status](https://img.shields.io/badge/build-passing-brightgreen)](#) 
-[![Go Version](https://img.shields.io/badge/go-1.23+-blue)](#)
-[![Rust Version](https://img.shields.io/badge/rust-1.70+-orange)](#)
-[![License](https://img.shields.io/badge/license-MIT-green)](#)
-
-## 🎯 Overview
-
-This project implements a **high-performance RDMA (Remote Direct Memory Access) sidecar** for SeaweedFS that provides significant performance improvements for data-intensive read operations. The sidecar uses a **hybrid Go + Rust architecture** with the [UCX (Unified Communication X)](https://github.com/openucx/ucx) framework to deliver up to **44x performance improvement** over traditional HTTP-based reads.
-
-### 🏗️ Architecture
-
-```
-┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
-│   SeaweedFS     │    │   Go Sidecar    │    │  Rust Engine    │
-│  Volume Server  │◄──►│ (Control Plane) │◄──►│  (Data Plane)   │
-└─────────────────┘    └─────────────────┘    └─────────────────┘
-         │                       │                       │
-         │                       │                       │
-         ▼                       ▼                       ▼
-   HTTP/gRPC API         RDMA Client API         UCX/RDMA Hardware
-```
-
-**Components:**
-- **🟢 Go Sidecar**: Control plane handling SeaweedFS integration, client API, and fallback logic
-- **🦀 Rust Engine**: High-performance data plane with UCX framework for RDMA operations  
-- **🔗 IPC Bridge**: Unix domain socket communication with MessagePack serialization
-
-## 🌟 Key Features
-
-### ⚡ Performance
-- **44x faster** than HTTP reads (theoretical max based on RDMA vs TCP overhead)
-- **Sub-microsecond latency** for memory-mapped operations
-- **Zero-copy data transfers** directly to/from SeaweedFS volume files
-- **Concurrent session management** with up to 1000+ simultaneous operations
-
-### 🛡️ Reliability
-- **Automatic HTTP fallback** when RDMA unavailable
-- **Graceful degradation** under failure conditions
-- **Session timeout and cleanup** to prevent resource leaks
-- **Comprehensive error handling** with structured logging
-
-### 🔧 Production Ready
-- **Container-native deployment** with Kubernetes support
-- **RDMA device plugin integration** for hardware resource management
-- **HugePages optimization** for memory efficiency
-- **Prometheus metrics** and structured logging for observability
-
-### 🎚️ Flexibility
-- **Mock RDMA implementation** for development and testing
-- **Configurable transport selection** (RDMA, TCP, shared memory via UCX)
-- **Multi-device support** with automatic failover
-- **Authentication and authorization** support
-
-## 🚀 Quick Start
-
-### Prerequisites
-
-```bash
-# Required dependencies
-- Go 1.23+
-- Rust 1.70+
-- UCX libraries (for hardware RDMA)
-- Linux with RDMA-capable hardware (InfiniBand/RoCE)
-
-# Optional for development
-- Docker
-- Kubernetes
-- jq (for demo scripts)
-```
-
-### 🏗️ Build
-
-```bash
-# Clone the repository
-git clone <repository-url>
-cd seaweedfs-rdma-sidecar
-
-# Build Go components
-go build -o bin/sidecar ./cmd/sidecar
-go build -o bin/test-rdma ./cmd/test-rdma
-go build -o bin/demo-server ./cmd/demo-server
-
-# Build Rust engine
-cd rdma-engine
-cargo build --release
-cd ..
-```
-
-### 🎮 Demo
-
-Run the complete end-to-end demonstration:
-
-```bash
-# Interactive demo with all components
-./scripts/demo-e2e.sh
-
-# Or run individual components
-./rdma-engine/target/release/rdma-engine-server --debug &
-./bin/demo-server --port 8080 --enable-rdma
-```
-
-## 📊 Performance Results
-
-### Mock RDMA Performance (Development)
-```
-Average Latency:    2.48ms per operation  
-Throughput:         403.2 operations/sec
-Success Rate:       100%
-Session Management: ✅ Working
-IPC Communication:  ✅ Working
-```
-
-### Expected Hardware RDMA Performance
-```
-Average Latency:    < 10µs per operation (440x improvement)
-Throughput:         > 1M operations/sec (2500x improvement)  
-Bandwidth:          > 100 Gbps (theoretical InfiniBand limit)
-CPU Utilization:    < 5% (vs 60%+ for HTTP)
-```
-
-## 🧩 Components
-
-### 1️⃣ Rust RDMA Engine (`rdma-engine/`)
-
-High-performance data plane built with:
-
-- **🔧 UCX Integration**: Production-grade RDMA framework
-- **⚡ Async Operations**: Tokio-based async runtime  
-- **🧠 Memory Management**: Pooled buffers with HugePage support
-- **📡 IPC Server**: Unix domain socket with MessagePack
-- **📊 Session Management**: Thread-safe lifecycle handling
-
-```rust
-// Example: Starting the RDMA engine
-let config = RdmaEngineConfig {
-    device_name: "auto".to_string(),
-    port: 18515,
-    max_sessions: 1000,
-    // ... other config
-};
-
-let engine = RdmaEngine::new(config).await?;
-engine.start().await?;
-```
-
-### 2️⃣ Go Sidecar (`pkg/`, `cmd/`)
-
-Control plane providing:
-
-- **🔌 SeaweedFS Integration**: Native needle read/write support
-- **🔄 HTTP Fallback**: Automatic degradation when RDMA unavailable
-- **📈 Performance Monitoring**: Metrics and benchmarking
-- **🌐 HTTP API**: RESTful interface for management
-
-```go
-// Example: Using the RDMA client
-client := seaweedfs.NewSeaweedFSRDMAClient(&seaweedfs.Config{
-    RDMASocketPath: "/tmp/rdma-engine.sock",
-    Enabled:        true,
-})
-
-resp, err := client.ReadNeedle(ctx, &seaweedfs.NeedleReadRequest{
-    VolumeID: 1,
-    NeedleID: 12345,
-    Size:     4096,
-})
-```
-
-### 3️⃣ Integration Examples (`cmd/demo-server/`)
-
-Production-ready integration examples:
-
-- **🌐 HTTP Server**: Demonstrates SeaweedFS integration
-- **📊 Benchmarking**: Performance testing utilities
-- **🔍 Health Checks**: Monitoring and diagnostics
-- **📱 Web Interface**: Browser-based demo and testing
-
-## 🐳 Deployment
-
-### Kubernetes
-
-```yaml
-apiVersion: v1
-kind: Pod
-metadata:
-  name: seaweedfs-with-rdma
-spec:
-  containers:
-  - name: volume-server
-    image: chrislusf/seaweedfs:latest
-    # ... volume server config
-    
-  - name: rdma-sidecar
-    image: seaweedfs-rdma-sidecar:latest
-    resources:
-      limits:
-        rdma/hca: 1  # RDMA device
-        hugepages-2Mi: 1Gi
-    volumeMounts:
-    - name: rdma-socket
-      mountPath: /tmp/rdma-engine.sock
-```
-
-### Docker Compose
-
-```yaml
-version: '3.8'
-services:
-  rdma-engine:
-    build:
-      context: .
-      dockerfile: rdma-engine/Dockerfile
-    privileged: true
-    volumes:
-      - /tmp/rdma-engine.sock:/tmp/rdma-engine.sock
-      
-  seaweedfs-sidecar:
-    build: .
-    depends_on:
-      - rdma-engine
-    ports:
-      - "8080:8080"
-    volumes:
-      - /tmp/rdma-engine.sock:/tmp/rdma-engine.sock
-```
-
-## 🧪 Testing
-
-### Unit Tests
-```bash
-# Go tests
-go test ./...
-
-# Rust tests  
-cd rdma-engine && cargo test
-```
-
-### Integration Tests
-```bash
-# Full end-to-end testing
-./scripts/demo-e2e.sh
-
-# Direct RDMA engine testing
-./bin/test-rdma ping
-./bin/test-rdma capabilities
-./bin/test-rdma read --volume 1 --needle 12345
-./bin/test-rdma bench --iterations 100
-```
-
-### Performance Benchmarking
-```bash
-# HTTP vs RDMA comparison
-./bin/demo-server --enable-rdma &
-curl "http://localhost:8080/benchmark?iterations=1000&size=1048576"
-```
-
-## 🔧 Configuration
-
-### RDMA Engine Configuration
-
-```toml
-# rdma-engine/config.toml
-[rdma]
-device_name = "mlx5_0"  # or "auto"
-port = 18515
-max_sessions = 1000
-buffer_size = "1GB"
-
-[ipc]
-socket_path = "/tmp/rdma-engine.sock"
-max_connections = 100
-
-[logging]
-level = "info"
-```
-
-### Go Sidecar Configuration
-
-```yaml
-# config.yaml
-rdma:
-  socket_path: "/tmp/rdma-engine.sock"
-  enabled: true
-  timeout: "30s"
-
-seaweedfs:
-  volume_server_url: "http://localhost:8080"
-  
-http:
-  port: 8080
-  enable_cors: true
-```
-
-## 📈 Monitoring
-
-### Metrics
-
-The sidecar exposes Prometheus-compatible metrics:
-
-- `rdma_operations_total{type="read|write", result="success|error"}`
-- `rdma_operation_duration_seconds{type="read|write"}`
-- `rdma_sessions_active`
-- `rdma_bytes_transferred_total{direction="tx|rx"}`
-
-### Health Checks
-
-```bash
-# Sidecar health
-curl http://localhost:8080/health
-
-# RDMA engine health  
-curl http://localhost:8080/stats
-```
-
-### Logging
-
-Structured logging with configurable levels:
-
-```json
-{
-  "timestamp": "2025-08-16T20:55:17Z",
-  "level": "INFO", 
-  "message": "✅ RDMA read completed successfully",
-  "session_id": "db152578-bfad-4cb3-a50f-a2ac66eecc6a",
-  "bytes_read": 1024,
-  "duration": "2.48ms",
-  "transfer_rate": 800742.88
-}
-```
-
-## 🛠️ Development
-
-### Mock RDMA Mode
-
-For development without RDMA hardware:
-
-```bash
-# Enable mock mode (default)
-cargo run --features mock-ucx
-
-# All operations simulate RDMA with realistic latencies
-```
-
-### UCX Hardware Mode
-
-For production with real RDMA hardware:
-
-```bash  
-# Enable hardware UCX
-cargo run --features real-ucx
-
-# Requires UCX libraries and RDMA-capable hardware
-```
-
-### Adding New Operations
-
-1. **Define protobuf messages** in `rdma-engine/src/ipc.rs`
-2. **Implement Go client** in `pkg/ipc/client.go`
-3. **Add Rust handler** in `rdma-engine/src/ipc.rs`
-4. **Update tests** in both languages
-
-## 🙏 Acknowledgments
-
-- **[UCX Project](https://github.com/openucx/ucx)** - Unified Communication X framework
-- **[SeaweedFS](https://github.com/seaweedfs/seaweedfs)** - Distributed file system
-- **Rust Community** - Excellent async/await and FFI capabilities
-- **Go Community** - Robust networking and gRPC libraries
-
-## 📞 Support
-
-- 🐛 **Bug Reports**: [Create an issue](../../issues/new?template=bug_report.md)
-- 💡 **Feature Requests**: [Create an issue](../../issues/new?template=feature_request.md)  
-- 📚 **Documentation**: See [docs/](docs/) folder
-- 💬 **Discussions**: [GitHub Discussions](../../discussions)
-
----
-
-**🚀 Ready to accelerate your SeaweedFS deployment with RDMA?**
-
-Get started with the [Quick Start Guide](#-quick-start) or explore the [Demo Server](cmd/demo-server/) for hands-on experience!
-
diff --git a/seaweedfs-rdma-sidecar/REVIEW_FEEDBACK.md b/seaweedfs-rdma-sidecar/REVIEW_FEEDBACK.md
deleted file mode 100644
index 5034f1bf0c..0000000000
--- a/seaweedfs-rdma-sidecar/REVIEW_FEEDBACK.md
+++ /dev/null
@@ -1,55 +0,0 @@
-# PR #7140 Review Feedback Summary
-
-## Positive Feedback Received ✅
-
-### Source: [GitHub PR #7140 Review](https://github.com/seaweedfs/seaweedfs/pull/7140#pullrequestreview-3126580539)
-**Reviewer**: Gemini Code Assist (Automated Review Bot)  
-**Date**: August 18, 2025
-
-## Comments Analysis
-
-### 🏆 Binary Search Optimization - PRAISED
-**File**: `weed/mount/filehandle_read.go`  
-**Implementation**: Efficient chunk lookup using binary search with cached cumulative offsets
-
-**Reviewer Comment**: 
-> "The `tryRDMARead` function efficiently finds the target chunk for a given offset by using a binary search on cached cumulative chunk offsets. This is an effective optimization that will perform well even for files with a large number of chunks."
-
-**Technical Merit**:
-- ✅ O(log N) performance vs O(N) linear search
-- ✅ Cached cumulative offsets prevent repeated calculations  
-- ✅ Scales well for large fragmented files
-- ✅ Memory-efficient implementation
-
-### 🏆 Resource Management - PRAISED
-**File**: `weed/mount/weedfs.go`  
-**Implementation**: Proper RDMA client initialization and cleanup
-
-**Reviewer Comment**:
-> "The RDMA client is now correctly initialized and attached to the `WFS` struct when RDMA is enabled. The shutdown logic in the `grace.OnInterrupt` handler has also been updated to properly close the RDMA client, preventing resource leaks."
-
-**Technical Merit**:
-- ✅ Proper initialization with error handling
-- ✅ Clean shutdown in interrupt handler
-- ✅ No resource leaks
-- ✅ Graceful degradation on failure
-
-## Summary
-
-**All review comments are positive acknowledgments of excellent implementation practices.**
-
-### Key Strengths Recognized:
-1. **Performance Optimization**: Binary search algorithm implementation
-2. **Memory Safety**: Proper resource lifecycle management  
-3. **Code Quality**: Clean, efficient, and maintainable code
-4. **Production Readiness**: Robust error handling and cleanup
-
-### Build Status: ✅ PASSING
-- ✅ `go build ./...` - All packages compile successfully
-- ✅ `go vet ./...` - No linting issues
-- ✅ All tests passing
-- ✅ Docker builds working
-
-## Conclusion
-
-The RDMA sidecar implementation has received positive feedback from automated code review, confirming high code quality and adherence to best practices. **No action items required** - these are endorsements of excellent work.
diff --git a/seaweedfs-rdma-sidecar/WEED-MOUNT-CODE-PATH.md b/seaweedfs-rdma-sidecar/WEED-MOUNT-CODE-PATH.md
deleted file mode 100644
index 1fdace9340..0000000000
--- a/seaweedfs-rdma-sidecar/WEED-MOUNT-CODE-PATH.md
+++ /dev/null
@@ -1,260 +0,0 @@
-# 📋 Weed Mount RDMA Integration - Code Path Analysis
-
-## Current Status
-
-The RDMA client (`RDMAMountClient`) exists in `weed/mount/rdma_client.go` but is **not yet integrated** into the actual file read path. The integration points are identified but not implemented.
-
-## 🔍 Complete Code Path
-
-### **1. FUSE Read Request Entry Point**
-```go
-// File: weed/mount/weedfs_file_read.go:41
-func (wfs *WFS) Read(cancel <-chan struct{}, in *fuse.ReadIn, buff []byte) (fuse.ReadResult, fuse.Status) {
-    fh := wfs.GetHandle(FileHandleId(in.Fh))
-    // ...
-    offset := int64(in.Offset)
-    totalRead, err := readDataByFileHandleWithContext(ctx, buff, fh, offset)
-    // ...
-    return fuse.ReadResultData(buff[:totalRead]), fuse.OK
-}
-```
-
-### **2. File Handle Read Coordination**
-```go
-// File: weed/mount/weedfs_file_read.go:103
-func readDataByFileHandleWithContext(ctx context.Context, buff []byte, fhIn *FileHandle, offset int64) (int64, error) {
-    size := len(buff)
-    fhIn.lockForRead(offset, size)
-    defer fhIn.unlockForRead(offset, size)
-
-    // KEY INTEGRATION POINT: This is where RDMA should be attempted
-    n, tsNs, err := fhIn.readFromChunksWithContext(ctx, buff, offset)
-    // ...
-    return n, err
-}
-```
-
-### **3. Chunk Reading (Current Implementation)**
-```go
-// File: weed/mount/filehandle_read.go:29
-func (fh *FileHandle) readFromChunksWithContext(ctx context.Context, buff []byte, offset int64) (int64, int64, error) {
-    // ...
-    
-    // CURRENT: Direct chunk reading without RDMA
-    totalRead, ts, err := fh.entryChunkGroup.ReadDataAt(ctx, fileSize, buff, offset)
-    
-    // MISSING: RDMA integration should happen here
-    return int64(totalRead), ts, err
-}
-```
-
-### **4. RDMA Integration Point (What Needs to Be Added)**
-
-The integration should happen in `readFromChunksWithContext` like this:
-
-```go
-func (fh *FileHandle) readFromChunksWithContext(ctx context.Context, buff []byte, offset int64) (int64, int64, error) {
-    // ... existing code ...
-    
-    // NEW: Try RDMA acceleration first
-    if fh.wfs.rdmaClient != nil && fh.wfs.rdmaClient.IsHealthy() {
-        if totalRead, ts, err := fh.tryRDMARead(ctx, buff, offset); err == nil {
-            glog.V(4).Infof("RDMA read successful: %d bytes", totalRead)
-            return totalRead, ts, nil
-        }
-        glog.V(2).Infof("RDMA read failed, falling back to HTTP")
-    }
-    
-    // FALLBACK: Original HTTP-based chunk reading
-    totalRead, ts, err := fh.entryChunkGroup.ReadDataAt(ctx, fileSize, buff, offset)
-    return int64(totalRead), ts, err
-}
-```
-
-## 🚀 RDMA Client Integration
-
-### **5. RDMA Read Implementation (Already Exists)**
-```go
-// File: weed/mount/rdma_client.go:129
-func (c *RDMAMountClient) ReadNeedle(ctx context.Context, volumeID uint32, needleID uint64, cookie uint32, offset, size uint64) ([]byte, bool, error) {
-    // Prepare request URL
-    reqURL := fmt.Sprintf("http://%s/read?volume=%d&needle=%d&cookie=%d&offset=%d&size=%d",
-        c.sidecarAddr, volumeID, needleID, cookie, offset, size)
-    
-    // Execute HTTP request to RDMA sidecar
-    resp, err := c.httpClient.Do(req)
-    // ...
-    
-    // Return data with RDMA metadata
-    return data, isRDMA, nil
-}
-```
-
-### **6. RDMA Sidecar Processing**
-```go
-// File: seaweedfs-rdma-sidecar/cmd/demo-server/main.go:375
-func (s *DemoServer) readHandler(w http.ResponseWriter, r *http.Request) {
-    // Parse volume, needle, cookie from URL parameters
-    volumeID, _ := strconv.ParseUint(query.Get("volume"), 10, 32)
-    needleID, _ := strconv.ParseUint(query.Get("needle"), 10, 64)
-    
-    // Use distributed client for volume lookup + RDMA
-    if s.useDistributed && s.distributedClient != nil {
-        resp, err = s.distributedClient.ReadNeedle(ctx, req)
-    } else {
-        resp, err = s.rdmaClient.ReadNeedle(ctx, req)  // Local RDMA
-    }
-    
-    // Return binary data or JSON metadata
-    w.Write(resp.Data)
-}
-```
-
-### **7. Volume Lookup & RDMA Engine**
-```go
-// File: seaweedfs-rdma-sidecar/pkg/seaweedfs/distributed_client.go:45
-func (c *DistributedRDMAClient) ReadNeedle(ctx context.Context, req *NeedleReadRequest) (*NeedleReadResponse, error) {
-    // Step 1: Lookup volume location from master
-    locations, err := c.locationService.LookupVolume(ctx, req.VolumeID)
-    
-    // Step 2: Find best server (local preferred)
-    bestLocation := c.locationService.FindBestLocation(locations)
-    
-    // Step 3: Make HTTP request to target server's RDMA sidecar
-    return c.makeRDMARequest(ctx, req, bestLocation, start)
-}
-```
-
-### **8. Rust RDMA Engine (Final Data Access)**
-```rust
-// File: rdma-engine/src/ipc.rs:403
-async fn handle_start_read(req: StartReadRequest, ...) -> RdmaResult<StartReadResponse> {
-    // Create RDMA session
-    let session_id = Uuid::new_v4().to_string();
-    let buffer = vec![0u8; transfer_size as usize];
-    
-    // Register memory for RDMA
-    let memory_region = rdma_context.register_memory(local_addr, transfer_size).await?;
-    
-    // Perform RDMA read (mock implementation)
-    rdma_context.post_read(local_addr, remote_addr, remote_key, size, wr_id).await?;
-    let completions = rdma_context.poll_completion(1).await?;
-    
-    // Return session info
-    Ok(StartReadResponse { session_id, local_addr, ... })
-}
-```
-
-## 🔧 Missing Integration Components
-
-### **1. WFS Struct Extension**
-```go
-// File: weed/mount/weedfs.go (needs modification)
-type WFS struct {
-    // ... existing fields ...
-    rdmaClient *RDMAMountClient  // ADD THIS
-}
-```
-
-### **2. RDMA Client Initialization**
-```go
-// File: weed/command/mount.go (needs modification)
-func runMount(cmd *cobra.Command, args []string) bool {
-    // ... existing code ...
-    
-    // NEW: Initialize RDMA client if enabled
-    var rdmaClient *mount.RDMAMountClient
-    if *mountOptions.rdmaEnabled && *mountOptions.rdmaSidecarAddr != "" {
-        rdmaClient, err = mount.NewRDMAMountClient(
-            *mountOptions.rdmaSidecarAddr,
-            *mountOptions.rdmaMaxConcurrent,
-            *mountOptions.rdmaTimeoutMs,
-        )
-        if err != nil {
-            glog.Warningf("Failed to initialize RDMA client: %v", err)
-        }
-    }
-    
-    // Pass RDMA client to WFS
-    wfs := mount.NewSeaweedFileSystem(&mount.Option{
-        // ... existing options ...
-        RDMAClient: rdmaClient,  // ADD THIS
-    })
-}
-```
-
-### **3. Chunk-to-Needle Mapping**
-```go
-// File: weed/mount/filehandle_read.go (needs new method)
-func (fh *FileHandle) tryRDMARead(ctx context.Context, buff []byte, offset int64) (int64, int64, error) {
-    entry := fh.GetEntry()
-    
-    // Find which chunk contains the requested offset
-    for _, chunk := range entry.GetEntry().Chunks {
-        if offset >= chunk.Offset && offset < chunk.Offset+int64(chunk.Size) {
-            // Parse chunk.FileId to get volume, needle, cookie
-            volumeID, needleID, cookie, err := ParseFileId(chunk.FileId)
-            if err != nil {
-                return 0, 0, err
-            }
-            
-            // Calculate offset within the chunk
-            chunkOffset := uint64(offset - chunk.Offset)
-            readSize := uint64(min(len(buff), int(chunk.Size-chunkOffset)))
-            
-            // Make RDMA request
-            data, isRDMA, err := fh.wfs.rdmaClient.ReadNeedle(
-                ctx, volumeID, needleID, cookie, chunkOffset, readSize)
-            if err != nil {
-                return 0, 0, err
-            }
-            
-            // Copy data to buffer
-            copied := copy(buff, data)
-            return int64(copied), time.Now().UnixNano(), nil
-        }
-    }
-    
-    return 0, 0, fmt.Errorf("chunk not found for offset %d", offset)
-}
-```
-
-## 📊 Request Flow Summary
-
-1. **User Application** → `read()` system call
-2. **FUSE Kernel** → Routes to `WFS.Read()`
-3. **WFS.Read()** → Calls `readDataByFileHandleWithContext()`
-4. **readDataByFileHandleWithContext()** → Calls `fh.readFromChunksWithContext()`
-5. **readFromChunksWithContext()** → **[INTEGRATION POINT]** Try RDMA first
-6. **tryRDMARead()** → Parse chunk info, call `RDMAMountClient.ReadNeedle()`
-7. **RDMAMountClient** → HTTP request to RDMA sidecar
-8. **RDMA Sidecar** → Volume lookup + RDMA engine call
-9. **RDMA Engine** → Direct memory access via RDMA hardware
-10. **Response Path** → Data flows back through all layers to user
-
-## ✅ What's Working vs Missing
-
-### **✅ Already Implemented:**
-- ✅ `RDMAMountClient` with HTTP communication
-- ✅ RDMA sidecar with volume lookup
-- ✅ Rust RDMA engine with mock hardware
-- ✅ File ID parsing utilities
-- ✅ Health checks and statistics
-- ✅ Command-line flags for RDMA options
-
-### **❌ Missing Integration:**
-- ❌ RDMA client not added to WFS struct
-- ❌ RDMA client not initialized in mount command
-- ❌ `tryRDMARead()` method not implemented
-- ❌ Chunk-to-needle mapping logic missing
-- ❌ RDMA integration not wired into read path
-
-## 🎯 Next Steps
-
-1. **Add RDMA client to WFS struct and Option**
-2. **Initialize RDMA client in mount command**
-3. **Implement `tryRDMARead()` method**
-4. **Wire RDMA integration into `readFromChunksWithContext()`**
-5. **Test end-to-end RDMA acceleration**
-
-The architecture is sound and most components exist - only the final integration wiring is needed!
diff --git a/seaweedfs-rdma-sidecar/cmd/demo-server/main.go b/seaweedfs-rdma-sidecar/cmd/demo-server/main.go
deleted file mode 100644
index 42b5020e55..0000000000
--- a/seaweedfs-rdma-sidecar/cmd/demo-server/main.go
+++ /dev/null
@@ -1,663 +0,0 @@
-// Package main provides a demonstration server showing SeaweedFS RDMA integration
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"os"
-	"os/signal"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-
-	"seaweedfs-rdma-sidecar/pkg/seaweedfs"
-
-	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-)
-
-var (
-	port            int
-	rdmaSocket      string
-	volumeServerURL string
-	enableRDMA      bool
-	enableZeroCopy  bool
-	tempDir         string
-	enablePooling   bool
-	maxConnections  int
-	maxIdleTime     time.Duration
-	debug           bool
-)
-
-func main() {
-	var rootCmd = &cobra.Command{
-		Use:   "demo-server",
-		Short: "SeaweedFS RDMA integration demonstration server",
-		Long: `Demonstration server that shows how SeaweedFS can integrate with the RDMA sidecar
-for accelerated read operations. This server provides HTTP endpoints that demonstrate
-the RDMA fast path with HTTP fallback capabilities.`,
-		RunE: runServer,
-	}
-
-	rootCmd.Flags().IntVarP(&port, "port", "p", 8080, "Demo server HTTP port")
-	rootCmd.Flags().StringVarP(&rdmaSocket, "rdma-socket", "r", "/tmp/rdma-engine.sock", "Path to RDMA engine Unix socket")
-	rootCmd.Flags().StringVarP(&volumeServerURL, "volume-server", "v", "http://localhost:8080", "SeaweedFS volume server URL for HTTP fallback")
-	rootCmd.Flags().BoolVarP(&enableRDMA, "enable-rdma", "e", true, "Enable RDMA acceleration")
-	rootCmd.Flags().BoolVarP(&enableZeroCopy, "enable-zerocopy", "z", true, "Enable zero-copy optimization via temp files")
-	rootCmd.Flags().StringVarP(&tempDir, "temp-dir", "t", "/tmp/rdma-cache", "Temp directory for zero-copy files")
-	rootCmd.Flags().BoolVar(&enablePooling, "enable-pooling", true, "Enable RDMA connection pooling")
-	rootCmd.Flags().IntVar(&maxConnections, "max-connections", 10, "Maximum connections in RDMA pool")
-	rootCmd.Flags().DurationVar(&maxIdleTime, "max-idle-time", 5*time.Minute, "Maximum idle time for pooled connections")
-	rootCmd.Flags().BoolVarP(&debug, "debug", "d", false, "Enable debug logging")
-
-	if err := rootCmd.Execute(); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func runServer(cmd *cobra.Command, args []string) error {
-	// Setup logging
-	logger := logrus.New()
-	if debug {
-		logger.SetLevel(logrus.DebugLevel)
-		logger.SetFormatter(&logrus.TextFormatter{
-			FullTimestamp: true,
-			ForceColors:   true,
-		})
-	} else {
-		logger.SetLevel(logrus.InfoLevel)
-	}
-
-	logger.WithFields(logrus.Fields{
-		"port":              port,
-		"rdma_socket":       rdmaSocket,
-		"volume_server_url": volumeServerURL,
-		"enable_rdma":       enableRDMA,
-		"enable_zerocopy":   enableZeroCopy,
-		"temp_dir":          tempDir,
-		"enable_pooling":    enablePooling,
-		"max_connections":   maxConnections,
-		"max_idle_time":     maxIdleTime,
-		"debug":             debug,
-	}).Info("🚀 Starting SeaweedFS RDMA Demo Server")
-
-	// Create SeaweedFS RDMA client
-	config := &seaweedfs.Config{
-		RDMASocketPath:  rdmaSocket,
-		VolumeServerURL: volumeServerURL,
-		Enabled:         enableRDMA,
-		DefaultTimeout:  30 * time.Second,
-		Logger:          logger,
-		TempDir:         tempDir,
-		UseZeroCopy:     enableZeroCopy,
-		EnablePooling:   enablePooling,
-		MaxConnections:  maxConnections,
-		MaxIdleTime:     maxIdleTime,
-	}
-
-	rdmaClient, err := seaweedfs.NewSeaweedFSRDMAClient(config)
-	if err != nil {
-		return fmt.Errorf("failed to create RDMA client: %w", err)
-	}
-
-	// Start RDMA client
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	if err := rdmaClient.Start(ctx); err != nil {
-		logger.WithError(err).Error("Failed to start RDMA client")
-	}
-	cancel()
-
-	// Create demo server
-	server := &DemoServer{
-		rdmaClient: rdmaClient,
-		logger:     logger,
-	}
-
-	// Setup HTTP routes
-	mux := http.NewServeMux()
-	mux.HandleFunc("/", server.homeHandler)
-	mux.HandleFunc("/health", server.healthHandler)
-	mux.HandleFunc("/stats", server.statsHandler)
-	mux.HandleFunc("/read", server.readHandler)
-	mux.HandleFunc("/benchmark", server.benchmarkHandler)
-	mux.HandleFunc("/cleanup", server.cleanupHandler)
-
-	httpServer := &http.Server{
-		Addr:    fmt.Sprintf(":%d", port),
-		Handler: mux,
-	}
-
-	// Handle graceful shutdown
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
-
-	go func() {
-		logger.WithField("port", port).Info("🌐 Demo server starting")
-		if err := httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-			logger.WithError(err).Fatal("HTTP server failed")
-		}
-	}()
-
-	// Wait for shutdown signal
-	<-sigChan
-	logger.Info("📡 Received shutdown signal, gracefully shutting down...")
-
-	// Shutdown HTTP server
-	shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer shutdownCancel()
-
-	if err := httpServer.Shutdown(shutdownCtx); err != nil {
-		logger.WithError(err).Error("HTTP server shutdown failed")
-	} else {
-		logger.Info("🌐 HTTP server shutdown complete")
-	}
-
-	// Stop RDMA client
-	rdmaClient.Stop()
-	logger.Info("🛑 Demo server shutdown complete")
-
-	return nil
-}
-
-// DemoServer demonstrates SeaweedFS RDMA integration
-type DemoServer struct {
-	rdmaClient *seaweedfs.SeaweedFSRDMAClient
-	logger     *logrus.Logger
-}
-
-// homeHandler provides information about the demo server
-func (s *DemoServer) homeHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	w.Header().Set("Content-Type", "text/html")
-	fmt.Fprintf(w, `<!DOCTYPE html>
-<html>
-<head>
-    <title>SeaweedFS RDMA Demo Server</title>
-    <style>
-        body { font-family: Arial, sans-serif; margin: 40px; background-color: #f5f5f5; }
-        .container { max-width: 800px; margin: 0 auto; background: white; padding: 20px; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }
-        h1 { color: #2c3e50; }
-        .endpoint { margin: 20px 0; padding: 15px; background: #ecf0f1; border-radius: 4px; }
-        .endpoint h3 { margin: 0 0 10px 0; color: #34495e; }
-        .endpoint a { color: #3498db; text-decoration: none; }
-        .endpoint a:hover { text-decoration: underline; }
-        .status { padding: 10px; border-radius: 4px; margin: 10px 0; }
-        .status.enabled { background: #d5f4e6; color: #27ae60; }
-        .status.disabled { background: #fadbd8; color: #e74c3c; }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <h1>🚀 SeaweedFS RDMA Demo Server</h1>
-        <p>This server demonstrates SeaweedFS integration with RDMA acceleration for high-performance reads.</p>
-        
-        <div class="status %s">
-            <strong>RDMA Status:</strong> %s
-        </div>
-
-        <h2>📋 Available Endpoints</h2>
-        
-        <div class="endpoint">
-            <h3>🏥 Health Check</h3>
-            <p><a href="/health">/health</a> - Check server and RDMA engine health</p>
-        </div>
-
-        <div class="endpoint">
-            <h3>📊 Statistics</h3>
-            <p><a href="/stats">/stats</a> - Get RDMA client statistics and capabilities</p>
-        </div>
-
-        <div class="endpoint">
-            <h3>📖 Read Needle</h3>
-            <p><a href="/read?file_id=3,01637037d6&size=1024&volume_server=http://localhost:8080">/read</a> - Read a needle with RDMA fast path</p>
-            <p><strong>Parameters:</strong> file_id OR (volume, needle, cookie), volume_server, offset (optional), size (optional)</p>
-        </div>
-
-        <div class="endpoint">
-            <h3>🏁 Benchmark</h3>
-            <p><a href="/benchmark?iterations=10&size=4096">/benchmark</a> - Run performance benchmark</p>
-            <p><strong>Parameters:</strong> iterations (default: 10), size (default: 4096)</p>
-        </div>
-
-        <h2>📝 Example Usage</h2>
-        <pre>
-# Read a needle using file ID (recommended)
-curl "http://localhost:%d/read?file_id=3,01637037d6&size=1024&volume_server=http://localhost:8080"
-
-# Read a needle using individual parameters (legacy)
-curl "http://localhost:%d/read?volume=1&needle=12345&cookie=305419896&size=1024&volume_server=http://localhost:8080"
-
-# Read a needle (hex cookie)
-curl "http://localhost:%d/read?volume=1&needle=12345&cookie=0x12345678&size=1024&volume_server=http://localhost:8080"
-
-# Run benchmark
-curl "http://localhost:%d/benchmark?iterations=5&size=2048"
-
-# Check health
-curl "http://localhost:%d/health"
-        </pre>
-    </div>
-</body>
-</html>`,
-		map[bool]string{true: "enabled", false: "disabled"}[s.rdmaClient.IsEnabled()],
-		map[bool]string{true: "RDMA Enabled ✅", false: "RDMA Disabled (HTTP Fallback Only) ⚠️"}[s.rdmaClient.IsEnabled()],
-		port, port, port, port)
-}
-
-// healthHandler checks server and RDMA health
-func (s *DemoServer) healthHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
-	defer cancel()
-
-	health := map[string]interface{}{
-		"status":    "healthy",
-		"timestamp": time.Now().Format(time.RFC3339),
-		"rdma": map[string]interface{}{
-			"enabled":   false,
-			"connected": false,
-		},
-	}
-
-	if s.rdmaClient != nil {
-		health["rdma"].(map[string]interface{})["enabled"] = s.rdmaClient.IsEnabled()
-		health["rdma"].(map[string]interface{})["type"] = "local"
-
-		if s.rdmaClient.IsEnabled() {
-			if err := s.rdmaClient.HealthCheck(ctx); err != nil {
-				s.logger.WithError(err).Warn("RDMA health check failed")
-				health["rdma"].(map[string]interface{})["error"] = err.Error()
-			} else {
-				health["rdma"].(map[string]interface{})["connected"] = true
-			}
-		}
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(health)
-}
-
-// statsHandler returns RDMA statistics
-func (s *DemoServer) statsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	var stats map[string]interface{}
-
-	if s.rdmaClient != nil {
-		stats = s.rdmaClient.GetStats()
-		stats["client_type"] = "local"
-	} else {
-		stats = map[string]interface{}{
-			"client_type": "none",
-			"error":       "no RDMA client available",
-		}
-	}
-
-	stats["timestamp"] = time.Now().Format(time.RFC3339)
-
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(stats)
-}
-
-// readHandler demonstrates needle reading with RDMA
-func (s *DemoServer) readHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	// Parse parameters - support both file_id and individual parameters for backward compatibility
-	query := r.URL.Query()
-	volumeServer := query.Get("volume_server")
-	fileID := query.Get("file_id")
-
-	var volumeID, cookie uint64
-	var needleID uint64
-	var err error
-
-	if fileID != "" {
-		// Use file ID format (e.g., "3,01637037d6")
-		// Extract individual components using existing SeaweedFS parsing
-		fid, parseErr := needle.ParseFileIdFromString(fileID)
-		if parseErr != nil {
-			http.Error(w, fmt.Sprintf("invalid 'file_id' parameter: %v", parseErr), http.StatusBadRequest)
-			return
-		}
-		volumeID = uint64(fid.VolumeId)
-		needleID = uint64(fid.Key)
-		cookie = uint64(fid.Cookie)
-	} else {
-		// Use individual parameters (backward compatibility)
-		volumeID, err = strconv.ParseUint(query.Get("volume"), 10, 32)
-		if err != nil {
-			http.Error(w, "invalid 'volume' parameter", http.StatusBadRequest)
-			return
-		}
-
-		needleID, err = strconv.ParseUint(query.Get("needle"), 10, 64)
-		if err != nil {
-			http.Error(w, "invalid 'needle' parameter", http.StatusBadRequest)
-			return
-		}
-
-		// Parse cookie parameter - support both decimal and hexadecimal formats
-		cookieStr := query.Get("cookie")
-		if strings.HasPrefix(strings.ToLower(cookieStr), "0x") {
-			// Parse as hexadecimal (remove "0x" prefix)
-			cookie, err = strconv.ParseUint(cookieStr[2:], 16, 32)
-		} else {
-			// Parse as decimal (default)
-			cookie, err = strconv.ParseUint(cookieStr, 10, 32)
-		}
-		if err != nil {
-			http.Error(w, "invalid 'cookie' parameter (expected decimal or hex with 0x prefix)", http.StatusBadRequest)
-			return
-		}
-	}
-
-	var offset uint64
-	if offsetStr := query.Get("offset"); offsetStr != "" {
-		var parseErr error
-		offset, parseErr = strconv.ParseUint(offsetStr, 10, 64)
-		if parseErr != nil {
-			http.Error(w, "invalid 'offset' parameter", http.StatusBadRequest)
-			return
-		}
-	}
-
-	var size uint64
-	if sizeStr := query.Get("size"); sizeStr != "" {
-		var parseErr error
-		size, parseErr = strconv.ParseUint(sizeStr, 10, 64)
-		if parseErr != nil {
-			http.Error(w, "invalid 'size' parameter", http.StatusBadRequest)
-			return
-		}
-	}
-
-	if volumeServer == "" {
-		http.Error(w, "volume_server parameter is required", http.StatusBadRequest)
-		return
-	}
-
-	if volumeID == 0 || needleID == 0 {
-		http.Error(w, "volume and needle parameters are required", http.StatusBadRequest)
-		return
-	}
-
-	// Note: cookie and size can have defaults for demo purposes when user provides empty values,
-	// but invalid parsing is caught above with proper error responses
-	if cookie == 0 {
-		cookie = 0x12345678 // Default cookie for demo
-	}
-
-	if size == 0 {
-		size = 4096 // Default size
-	}
-
-	logFields := logrus.Fields{
-		"volume_server": volumeServer,
-		"volume_id":     volumeID,
-		"needle_id":     needleID,
-		"cookie":        fmt.Sprintf("0x%x", cookie),
-		"offset":        offset,
-		"size":          size,
-	}
-	if fileID != "" {
-		logFields["file_id"] = fileID
-	}
-	s.logger.WithFields(logFields).Info("📖 Processing needle read request")
-
-	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	req := &seaweedfs.NeedleReadRequest{
-		VolumeID:     uint32(volumeID),
-		NeedleID:     needleID,
-		Cookie:       uint32(cookie),
-		Offset:       offset,
-		Size:         size,
-		VolumeServer: volumeServer,
-	}
-
-	resp, err := s.rdmaClient.ReadNeedle(ctx, req)
-
-	if err != nil {
-		s.logger.WithError(err).Error("❌ Needle read failed")
-		http.Error(w, fmt.Sprintf("Read failed: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	duration := time.Since(start)
-
-	s.logger.WithFields(logrus.Fields{
-		"volume_id": volumeID,
-		"needle_id": needleID,
-		"is_rdma":   resp.IsRDMA,
-		"source":    resp.Source,
-		"duration":  duration,
-		"data_size": len(resp.Data),
-	}).Info("✅ Needle read completed")
-
-	// Return metadata and first few bytes
-	result := map[string]interface{}{
-		"success":       true,
-		"volume_id":     volumeID,
-		"needle_id":     needleID,
-		"cookie":        fmt.Sprintf("0x%x", cookie),
-		"is_rdma":       resp.IsRDMA,
-		"source":        resp.Source,
-		"session_id":    resp.SessionID,
-		"duration":      duration.String(),
-		"data_size":     len(resp.Data),
-		"timestamp":     time.Now().Format(time.RFC3339),
-		"use_temp_file": resp.UseTempFile,
-		"temp_file":     resp.TempFilePath,
-	}
-
-	// Set headers for zero-copy optimization
-	if resp.UseTempFile && resp.TempFilePath != "" {
-		w.Header().Set("X-Use-Temp-File", "true")
-		w.Header().Set("X-Temp-File", resp.TempFilePath)
-		w.Header().Set("X-Source", resp.Source)
-		w.Header().Set("X-RDMA-Used", fmt.Sprintf("%t", resp.IsRDMA))
-
-		// For zero-copy, return minimal JSON response and let client read from temp file
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(result)
-		return
-	}
-
-	// Regular response with data
-	w.Header().Set("X-Source", resp.Source)
-	w.Header().Set("X-RDMA-Used", fmt.Sprintf("%t", resp.IsRDMA))
-
-	// Include first 32 bytes as hex for verification
-	if len(resp.Data) > 0 {
-		displayLen := 32
-		if len(resp.Data) < displayLen {
-			displayLen = len(resp.Data)
-		}
-		result["data_preview"] = fmt.Sprintf("%x", resp.Data[:displayLen])
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(result)
-}
-
-// benchmarkHandler runs performance benchmarks
-func (s *DemoServer) benchmarkHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	// Parse parameters
-	query := r.URL.Query()
-
-	iterations := 10 // default value
-	if iterationsStr := query.Get("iterations"); iterationsStr != "" {
-		var parseErr error
-		iterations, parseErr = strconv.Atoi(iterationsStr)
-		if parseErr != nil {
-			http.Error(w, "invalid 'iterations' parameter", http.StatusBadRequest)
-			return
-		}
-	}
-
-	size := uint64(4096) // default value
-	if sizeStr := query.Get("size"); sizeStr != "" {
-		var parseErr error
-		size, parseErr = strconv.ParseUint(sizeStr, 10, 64)
-		if parseErr != nil {
-			http.Error(w, "invalid 'size' parameter", http.StatusBadRequest)
-			return
-		}
-	}
-
-	if iterations <= 0 {
-		iterations = 10
-	}
-	if size == 0 {
-		size = 4096
-	}
-
-	s.logger.WithFields(logrus.Fields{
-		"iterations": iterations,
-		"size":       size,
-	}).Info("🏁 Starting benchmark")
-
-	ctx, cancel := context.WithTimeout(r.Context(), 60*time.Second)
-	defer cancel()
-
-	var rdmaSuccessful, rdmaFailed, httpSuccessful, httpFailed int
-	var totalDuration time.Duration
-	var totalBytes uint64
-
-	startTime := time.Now()
-
-	for i := 0; i < iterations; i++ {
-		req := &seaweedfs.NeedleReadRequest{
-			VolumeID: 1,
-			NeedleID: uint64(i + 1),
-			Cookie:   0x12345678,
-			Offset:   0,
-			Size:     size,
-		}
-
-		opStart := time.Now()
-		resp, err := s.rdmaClient.ReadNeedle(ctx, req)
-		opDuration := time.Since(opStart)
-
-		if err != nil {
-			httpFailed++
-			continue
-		}
-
-		totalDuration += opDuration
-		totalBytes += uint64(len(resp.Data))
-
-		if resp.IsRDMA {
-			rdmaSuccessful++
-		} else {
-			httpSuccessful++
-		}
-	}
-
-	benchDuration := time.Since(startTime)
-
-	// Calculate statistics
-	totalOperations := rdmaSuccessful + httpSuccessful
-	avgLatency := time.Duration(0)
-	if totalOperations > 0 {
-		avgLatency = totalDuration / time.Duration(totalOperations)
-	}
-
-	throughputMBps := float64(totalBytes) / benchDuration.Seconds() / (1024 * 1024)
-	opsPerSec := float64(totalOperations) / benchDuration.Seconds()
-
-	result := map[string]interface{}{
-		"benchmark_results": map[string]interface{}{
-			"iterations":      iterations,
-			"size_per_op":     size,
-			"total_duration":  benchDuration.String(),
-			"successful_ops":  totalOperations,
-			"failed_ops":      rdmaFailed + httpFailed,
-			"rdma_ops":        rdmaSuccessful,
-			"http_ops":        httpSuccessful,
-			"avg_latency":     avgLatency.String(),
-			"throughput_mbps": fmt.Sprintf("%.2f", throughputMBps),
-			"ops_per_sec":     fmt.Sprintf("%.1f", opsPerSec),
-			"total_bytes":     totalBytes,
-		},
-		"rdma_enabled": s.rdmaClient.IsEnabled(),
-		"timestamp":    time.Now().Format(time.RFC3339),
-	}
-
-	s.logger.WithFields(logrus.Fields{
-		"iterations":      iterations,
-		"successful_ops":  totalOperations,
-		"rdma_ops":        rdmaSuccessful,
-		"http_ops":        httpSuccessful,
-		"avg_latency":     avgLatency,
-		"throughput_mbps": throughputMBps,
-		"ops_per_sec":     opsPerSec,
-	}).Info("📊 Benchmark completed")
-
-	w.Header().Set("Content-Type", "application/json")
-	json.NewEncoder(w).Encode(result)
-}
-
-// cleanupHandler handles temp file cleanup requests from mount clients
-func (s *DemoServer) cleanupHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodDelete {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	// Get temp file path from query parameters
-	tempFilePath := r.URL.Query().Get("temp_file")
-	if tempFilePath == "" {
-		http.Error(w, "missing 'temp_file' parameter", http.StatusBadRequest)
-		return
-	}
-
-	s.logger.WithField("temp_file", tempFilePath).Debug("🗑️ Processing cleanup request")
-
-	// Use the RDMA client's cleanup method (which delegates to seaweedfs client)
-	err := s.rdmaClient.CleanupTempFile(tempFilePath)
-	if err != nil {
-		s.logger.WithError(err).WithField("temp_file", tempFilePath).Warn("Failed to cleanup temp file")
-		http.Error(w, fmt.Sprintf("cleanup failed: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	s.logger.WithField("temp_file", tempFilePath).Debug("🧹 Temp file cleanup successful")
-
-	// Return success response
-	w.Header().Set("Content-Type", "application/json")
-	response := map[string]interface{}{
-		"success":   true,
-		"message":   "temp file cleaned up successfully",
-		"temp_file": tempFilePath,
-		"timestamp": time.Now().Format(time.RFC3339),
-	}
-	json.NewEncoder(w).Encode(response)
-}
diff --git a/seaweedfs-rdma-sidecar/cmd/sidecar/main.go b/seaweedfs-rdma-sidecar/cmd/sidecar/main.go
deleted file mode 100644
index 55d98c4c68..0000000000
--- a/seaweedfs-rdma-sidecar/cmd/sidecar/main.go
+++ /dev/null
@@ -1,345 +0,0 @@
-// Package main provides the main RDMA sidecar service that integrates with SeaweedFS
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"os"
-	"os/signal"
-	"strconv"
-	"syscall"
-	"time"
-
-	"seaweedfs-rdma-sidecar/pkg/rdma"
-
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-)
-
-var (
-	port         int
-	engineSocket string
-	debug        bool
-	timeout      time.Duration
-)
-
-// Response structs for JSON encoding
-type HealthResponse struct {
-	Status              string `json:"status"`
-	RdmaEngineConnected bool   `json:"rdma_engine_connected"`
-	RdmaEngineLatency   string `json:"rdma_engine_latency"`
-	Timestamp           string `json:"timestamp"`
-}
-
-type CapabilitiesResponse struct {
-	Version         string   `json:"version"`
-	DeviceName      string   `json:"device_name"`
-	VendorId        uint32   `json:"vendor_id"`
-	MaxSessions     uint32   `json:"max_sessions"`
-	MaxTransferSize uint64   `json:"max_transfer_size"`
-	ActiveSessions  uint32   `json:"active_sessions"`
-	RealRdma        bool     `json:"real_rdma"`
-	PortGid         string   `json:"port_gid"`
-	PortLid         uint16   `json:"port_lid"`
-	SupportedAuth   []string `json:"supported_auth"`
-}
-
-type PingResponse struct {
-	Success       bool   `json:"success"`
-	EngineLatency string `json:"engine_latency"`
-	TotalLatency  string `json:"total_latency"`
-	Timestamp     string `json:"timestamp"`
-}
-
-func main() {
-	var rootCmd = &cobra.Command{
-		Use:   "rdma-sidecar",
-		Short: "SeaweedFS RDMA acceleration sidecar",
-		Long: `RDMA sidecar that accelerates SeaweedFS read/write operations using UCX and Rust RDMA engine.
-
-This sidecar acts as a bridge between SeaweedFS volume servers and the high-performance
-Rust RDMA engine, providing significant performance improvements for data-intensive workloads.`,
-		RunE: runSidecar,
-	}
-
-	// Flags
-	rootCmd.Flags().IntVarP(&port, "port", "p", 8081, "HTTP server port")
-	rootCmd.Flags().StringVarP(&engineSocket, "engine-socket", "e", "/tmp/rdma-engine.sock", "Path to RDMA engine Unix socket")
-	rootCmd.Flags().BoolVarP(&debug, "debug", "d", false, "Enable debug logging")
-	rootCmd.Flags().DurationVarP(&timeout, "timeout", "t", 30*time.Second, "RDMA operation timeout")
-
-	if err := rootCmd.Execute(); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func runSidecar(cmd *cobra.Command, args []string) error {
-	// Setup logging
-	logger := logrus.New()
-	if debug {
-		logger.SetLevel(logrus.DebugLevel)
-		logger.SetFormatter(&logrus.TextFormatter{
-			FullTimestamp: true,
-			ForceColors:   true,
-		})
-	} else {
-		logger.SetLevel(logrus.InfoLevel)
-	}
-
-	logger.WithFields(logrus.Fields{
-		"port":          port,
-		"engine_socket": engineSocket,
-		"debug":         debug,
-		"timeout":       timeout,
-	}).Info("🚀 Starting SeaweedFS RDMA Sidecar")
-
-	// Create RDMA client
-	rdmaConfig := &rdma.Config{
-		EngineSocketPath: engineSocket,
-		DefaultTimeout:   timeout,
-		Logger:           logger,
-	}
-
-	rdmaClient := rdma.NewClient(rdmaConfig)
-
-	// Connect to RDMA engine
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	logger.Info("🔗 Connecting to RDMA engine...")
-	if err := rdmaClient.Connect(ctx); err != nil {
-		return fmt.Errorf("failed to connect to RDMA engine: %w", err)
-	}
-	logger.Info("✅ Connected to RDMA engine successfully")
-
-	// Create HTTP server
-	sidecar := &Sidecar{
-		rdmaClient: rdmaClient,
-		logger:     logger,
-	}
-
-	mux := http.NewServeMux()
-
-	// Health check endpoint
-	mux.HandleFunc("/health", sidecar.healthHandler)
-
-	// RDMA operations endpoints
-	mux.HandleFunc("/rdma/read", sidecar.rdmaReadHandler)
-	mux.HandleFunc("/rdma/capabilities", sidecar.capabilitiesHandler)
-	mux.HandleFunc("/rdma/ping", sidecar.pingHandler)
-
-	server := &http.Server{
-		Addr:    fmt.Sprintf(":%d", port),
-		Handler: mux,
-	}
-
-	// Handle graceful shutdown
-	sigChan := make(chan os.Signal, 1)
-	signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
-
-	go func() {
-		logger.WithField("port", port).Info("🌐 HTTP server starting")
-		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-			logger.WithError(err).Fatal("HTTP server failed")
-		}
-	}()
-
-	// Wait for shutdown signal
-	<-sigChan
-	logger.Info("📡 Received shutdown signal, gracefully shutting down...")
-
-	// Shutdown HTTP server
-	shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer shutdownCancel()
-
-	if err := server.Shutdown(shutdownCtx); err != nil {
-		logger.WithError(err).Error("HTTP server shutdown failed")
-	} else {
-		logger.Info("🌐 HTTP server shutdown complete")
-	}
-
-	// Disconnect from RDMA engine
-	rdmaClient.Disconnect()
-	logger.Info("🛑 RDMA sidecar shutdown complete")
-
-	return nil
-}
-
-// Sidecar represents the main sidecar service
-type Sidecar struct {
-	rdmaClient *rdma.Client
-	logger     *logrus.Logger
-}
-
-// Health check handler
-func (s *Sidecar) healthHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
-	defer cancel()
-
-	// Test RDMA engine connectivity
-	if !s.rdmaClient.IsConnected() {
-		s.logger.Warn("⚠️  RDMA engine not connected")
-		http.Error(w, "RDMA engine not connected", http.StatusServiceUnavailable)
-		return
-	}
-
-	// Ping RDMA engine
-	latency, err := s.rdmaClient.Ping(ctx)
-	if err != nil {
-		s.logger.WithError(err).Error("❌ RDMA engine ping failed")
-		http.Error(w, "RDMA engine ping failed", http.StatusServiceUnavailable)
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	response := HealthResponse{
-		Status:              "healthy",
-		RdmaEngineConnected: true,
-		RdmaEngineLatency:   latency.String(),
-		Timestamp:           time.Now().Format(time.RFC3339),
-	}
-	json.NewEncoder(w).Encode(response)
-}
-
-// RDMA capabilities handler
-func (s *Sidecar) capabilitiesHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	caps := s.rdmaClient.GetCapabilities()
-	if caps == nil {
-		http.Error(w, "No capabilities available", http.StatusServiceUnavailable)
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	response := CapabilitiesResponse{
-		Version:         caps.Version,
-		DeviceName:      caps.DeviceName,
-		VendorId:        caps.VendorId,
-		MaxSessions:     uint32(caps.MaxSessions),
-		MaxTransferSize: caps.MaxTransferSize,
-		ActiveSessions:  uint32(caps.ActiveSessions),
-		RealRdma:        caps.RealRdma,
-		PortGid:         caps.PortGid,
-		PortLid:         caps.PortLid,
-		SupportedAuth:   caps.SupportedAuth,
-	}
-	json.NewEncoder(w).Encode(response)
-}
-
-// RDMA ping handler
-func (s *Sidecar) pingHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	latency, err := s.rdmaClient.Ping(ctx)
-	totalLatency := time.Since(start)
-
-	if err != nil {
-		s.logger.WithError(err).Error("❌ RDMA ping failed")
-		http.Error(w, fmt.Sprintf("Ping failed: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	w.Header().Set("Content-Type", "application/json")
-	response := PingResponse{
-		Success:       true,
-		EngineLatency: latency.String(),
-		TotalLatency:  totalLatency.String(),
-		Timestamp:     time.Now().Format(time.RFC3339),
-	}
-	json.NewEncoder(w).Encode(response)
-}
-
-// RDMA read handler - uses GET method with query parameters for RESTful read operations
-func (s *Sidecar) rdmaReadHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	// Parse query parameters
-	query := r.URL.Query()
-
-	// Get file ID (e.g., "3,01637037d6") - this is the natural SeaweedFS identifier
-	fileID := query.Get("file_id")
-	if fileID == "" {
-		http.Error(w, "missing 'file_id' parameter", http.StatusBadRequest)
-		return
-	}
-
-	// Parse optional offset and size parameters
-	offset := uint64(0) // default value
-	if offsetStr := query.Get("offset"); offsetStr != "" {
-		val, err := strconv.ParseUint(offsetStr, 10, 64)
-		if err != nil {
-			http.Error(w, "invalid 'offset' parameter", http.StatusBadRequest)
-			return
-		}
-		offset = val
-	}
-
-	size := uint64(4096) // default value
-	if sizeStr := query.Get("size"); sizeStr != "" {
-		val, err := strconv.ParseUint(sizeStr, 10, 64)
-		if err != nil {
-			http.Error(w, "invalid 'size' parameter", http.StatusBadRequest)
-			return
-		}
-		size = val
-	}
-
-	s.logger.WithFields(logrus.Fields{
-		"file_id": fileID,
-		"offset":  offset,
-		"size":    size,
-	}).Info("📖 Processing RDMA read request")
-
-	ctx, cancel := context.WithTimeout(r.Context(), timeout)
-	defer cancel()
-
-	start := time.Now()
-	resp, err := s.rdmaClient.ReadFileRange(ctx, fileID, offset, size)
-	duration := time.Since(start)
-
-	if err != nil {
-		s.logger.WithError(err).Error("❌ RDMA read failed")
-		http.Error(w, fmt.Sprintf("RDMA read failed: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	s.logger.WithFields(logrus.Fields{
-		"file_id":       fileID,
-		"bytes_read":    resp.BytesRead,
-		"duration":      duration,
-		"transfer_rate": resp.TransferRate,
-		"session_id":    resp.SessionID,
-	}).Info("✅ RDMA read completed successfully")
-
-	// Set response headers
-	w.Header().Set("Content-Type", "application/octet-stream")
-	w.Header().Set("X-RDMA-Session-ID", resp.SessionID)
-	w.Header().Set("X-RDMA-Duration", duration.String())
-	w.Header().Set("X-RDMA-Transfer-Rate", fmt.Sprintf("%.2f", resp.TransferRate))
-	w.Header().Set("X-RDMA-Bytes-Read", fmt.Sprintf("%d", resp.BytesRead))
-
-	// Write the data
-	w.Write(resp.Data)
-}
diff --git a/seaweedfs-rdma-sidecar/cmd/test-rdma/main.go b/seaweedfs-rdma-sidecar/cmd/test-rdma/main.go
deleted file mode 100644
index 4f2b2da43b..0000000000
--- a/seaweedfs-rdma-sidecar/cmd/test-rdma/main.go
+++ /dev/null
@@ -1,295 +0,0 @@
-// Package main provides a test client for the RDMA engine integration
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"time"
-
-	"seaweedfs-rdma-sidecar/pkg/rdma"
-
-	"github.com/sirupsen/logrus"
-	"github.com/spf13/cobra"
-)
-
-var (
-	socketPath string
-	debug      bool
-	timeout    time.Duration
-	volumeID   uint32
-	needleID   uint64
-	cookie     uint32
-	offset     uint64
-	size       uint64
-)
-
-func main() {
-	var rootCmd = &cobra.Command{
-		Use:   "test-rdma",
-		Short: "Test client for SeaweedFS RDMA engine integration",
-		Long: `Test client that demonstrates communication between Go sidecar and Rust RDMA engine.
-		
-This tool allows you to test various RDMA operations including:
-- Engine connectivity and capabilities
-- RDMA read operations with mock data
-- Performance measurements
-- IPC protocol validation`,
-	}
-
-	// Global flags
-	defaultSocketPath := os.Getenv("RDMA_SOCKET_PATH")
-	if defaultSocketPath == "" {
-		defaultSocketPath = "/tmp/rdma-engine.sock"
-	}
-	rootCmd.PersistentFlags().StringVarP(&socketPath, "socket", "s", defaultSocketPath, "Path to RDMA engine Unix socket (env: RDMA_SOCKET_PATH)")
-	rootCmd.PersistentFlags().BoolVarP(&debug, "debug", "d", false, "Enable debug logging")
-	rootCmd.PersistentFlags().DurationVarP(&timeout, "timeout", "t", 30*time.Second, "Operation timeout")
-
-	// Subcommands
-	rootCmd.AddCommand(pingCmd())
-	rootCmd.AddCommand(capsCmd())
-	rootCmd.AddCommand(readCmd())
-	rootCmd.AddCommand(benchCmd())
-
-	if err := rootCmd.Execute(); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
-}
-
-func pingCmd() *cobra.Command {
-	return &cobra.Command{
-		Use:   "ping",
-		Short: "Test connectivity to RDMA engine",
-		Long:  "Send a ping message to the RDMA engine and measure latency",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			client := createClient()
-			defer client.Disconnect()
-
-			ctx, cancel := context.WithTimeout(context.Background(), timeout)
-			defer cancel()
-
-			fmt.Printf("🏓 Pinging RDMA engine at %s...\n", socketPath)
-
-			if err := client.Connect(ctx); err != nil {
-				return fmt.Errorf("failed to connect: %w", err)
-			}
-
-			latency, err := client.Ping(ctx)
-			if err != nil {
-				return fmt.Errorf("ping failed: %w", err)
-			}
-
-			fmt.Printf("✅ Ping successful! Latency: %v\n", latency)
-			return nil
-		},
-	}
-}
-
-func capsCmd() *cobra.Command {
-	return &cobra.Command{
-		Use:   "capabilities",
-		Short: "Get RDMA engine capabilities",
-		Long:  "Query the RDMA engine for its current capabilities and status",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			client := createClient()
-			defer client.Disconnect()
-
-			ctx, cancel := context.WithTimeout(context.Background(), timeout)
-			defer cancel()
-
-			fmt.Printf("🔍 Querying RDMA engine capabilities...\n")
-
-			if err := client.Connect(ctx); err != nil {
-				return fmt.Errorf("failed to connect: %w", err)
-			}
-
-			caps := client.GetCapabilities()
-			if caps == nil {
-				return fmt.Errorf("no capabilities received")
-			}
-
-			fmt.Printf("\n📊 RDMA Engine Capabilities:\n")
-			fmt.Printf("  Version: %s\n", caps.Version)
-			fmt.Printf("  Max Sessions: %d\n", caps.MaxSessions)
-			fmt.Printf("  Max Transfer Size: %d bytes (%.1f MB)\n", caps.MaxTransferSize, float64(caps.MaxTransferSize)/(1024*1024))
-			fmt.Printf("  Active Sessions: %d\n", caps.ActiveSessions)
-			fmt.Printf("  Real RDMA: %t\n", caps.RealRdma)
-			fmt.Printf("  Port GID: %s\n", caps.PortGid)
-			fmt.Printf("  Port LID: %d\n", caps.PortLid)
-			fmt.Printf("  Supported Auth: %v\n", caps.SupportedAuth)
-
-			if caps.RealRdma {
-				fmt.Printf("🚀 Hardware RDMA enabled!\n")
-			} else {
-				fmt.Printf("🟡 Using mock RDMA (development mode)\n")
-			}
-
-			return nil
-		},
-	}
-}
-
-func readCmd() *cobra.Command {
-	cmd := &cobra.Command{
-		Use:   "read",
-		Short: "Test RDMA read operation",
-		Long:  "Perform a test RDMA read operation with specified parameters",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			client := createClient()
-			defer client.Disconnect()
-
-			ctx, cancel := context.WithTimeout(context.Background(), timeout)
-			defer cancel()
-
-			fmt.Printf("📖 Testing RDMA read operation...\n")
-			fmt.Printf("  Volume ID: %d\n", volumeID)
-			fmt.Printf("  Needle ID: %d\n", needleID)
-			fmt.Printf("  Cookie: 0x%x\n", cookie)
-			fmt.Printf("  Offset: %d\n", offset)
-			fmt.Printf("  Size: %d bytes\n", size)
-
-			if err := client.Connect(ctx); err != nil {
-				return fmt.Errorf("failed to connect: %w", err)
-			}
-
-			start := time.Now()
-			resp, err := client.ReadRange(ctx, volumeID, needleID, cookie, offset, size)
-			if err != nil {
-				return fmt.Errorf("read failed: %w", err)
-			}
-
-			duration := time.Since(start)
-
-			fmt.Printf("\n✅ RDMA read completed successfully!\n")
-			fmt.Printf("  Session ID: %s\n", resp.SessionID)
-			fmt.Printf("  Bytes Read: %d\n", resp.BytesRead)
-			fmt.Printf("  Duration: %v\n", duration)
-			fmt.Printf("  Transfer Rate: %.2f MB/s\n", resp.TransferRate)
-			fmt.Printf("  Success: %t\n", resp.Success)
-			fmt.Printf("  Message: %s\n", resp.Message)
-
-			// Show first few bytes of data for verification
-			if len(resp.Data) > 0 {
-				displayLen := 32
-				if len(resp.Data) < displayLen {
-					displayLen = len(resp.Data)
-				}
-				fmt.Printf("  Data (first %d bytes): %x\n", displayLen, resp.Data[:displayLen])
-			}
-
-			return nil
-		},
-	}
-
-	cmd.Flags().Uint32VarP(&volumeID, "volume", "v", 1, "Volume ID")
-	cmd.Flags().Uint64VarP(&needleID, "needle", "n", 100, "Needle ID")
-	cmd.Flags().Uint32VarP(&cookie, "cookie", "c", 0x12345678, "Needle cookie")
-	cmd.Flags().Uint64VarP(&offset, "offset", "o", 0, "Read offset")
-	cmd.Flags().Uint64VarP(&size, "size", "z", 4096, "Read size in bytes")
-
-	return cmd
-}
-
-func benchCmd() *cobra.Command {
-	var (
-		iterations int
-		readSize   uint64
-	)
-
-	cmd := &cobra.Command{
-		Use:   "bench",
-		Short: "Benchmark RDMA read performance",
-		Long:  "Run multiple RDMA read operations and measure performance statistics",
-		RunE: func(cmd *cobra.Command, args []string) error {
-			client := createClient()
-			defer client.Disconnect()
-
-			ctx, cancel := context.WithTimeout(context.Background(), timeout)
-			defer cancel()
-
-			fmt.Printf("🏁 Starting RDMA read benchmark...\n")
-			fmt.Printf("  Iterations: %d\n", iterations)
-			fmt.Printf("  Read Size: %d bytes\n", readSize)
-			fmt.Printf("  Socket: %s\n", socketPath)
-
-			if err := client.Connect(ctx); err != nil {
-				return fmt.Errorf("failed to connect: %w", err)
-			}
-
-			// Warmup
-			fmt.Printf("🔥 Warming up...\n")
-			for i := 0; i < 5; i++ {
-				_, err := client.ReadRange(ctx, 1, uint64(i+1), 0x12345678, 0, readSize)
-				if err != nil {
-					return fmt.Errorf("warmup read %d failed: %w", i+1, err)
-				}
-			}
-
-			// Benchmark
-			fmt.Printf("📊 Running benchmark...\n")
-			var totalDuration time.Duration
-			var totalBytes uint64
-			successful := 0
-
-			startTime := time.Now()
-			for i := 0; i < iterations; i++ {
-				opStart := time.Now()
-				resp, err := client.ReadRange(ctx, 1, uint64(i+1), 0x12345678, 0, readSize)
-				opDuration := time.Since(opStart)
-
-				if err != nil {
-					fmt.Printf("❌ Read %d failed: %v\n", i+1, err)
-					continue
-				}
-
-				totalDuration += opDuration
-				totalBytes += resp.BytesRead
-				successful++
-
-				if (i+1)%10 == 0 || i == iterations-1 {
-					fmt.Printf("  Completed %d/%d reads\n", i+1, iterations)
-				}
-			}
-			benchDuration := time.Since(startTime)
-
-			// Calculate statistics
-			avgLatency := totalDuration / time.Duration(successful)
-			throughputMBps := float64(totalBytes) / benchDuration.Seconds() / (1024 * 1024)
-			opsPerSec := float64(successful) / benchDuration.Seconds()
-
-			fmt.Printf("\n📈 Benchmark Results:\n")
-			fmt.Printf("  Total Duration: %v\n", benchDuration)
-			fmt.Printf("  Successful Operations: %d/%d (%.1f%%)\n", successful, iterations, float64(successful)/float64(iterations)*100)
-			fmt.Printf("  Total Bytes Transferred: %d (%.1f MB)\n", totalBytes, float64(totalBytes)/(1024*1024))
-			fmt.Printf("  Average Latency: %v\n", avgLatency)
-			fmt.Printf("  Throughput: %.2f MB/s\n", throughputMBps)
-			fmt.Printf("  Operations/sec: %.1f\n", opsPerSec)
-
-			return nil
-		},
-	}
-
-	cmd.Flags().IntVarP(&iterations, "iterations", "i", 100, "Number of read operations")
-	cmd.Flags().Uint64VarP(&readSize, "read-size", "r", 4096, "Size of each read in bytes")
-
-	return cmd
-}
-
-func createClient() *rdma.Client {
-	logger := logrus.New()
-	if debug {
-		logger.SetLevel(logrus.DebugLevel)
-	} else {
-		logger.SetLevel(logrus.InfoLevel)
-	}
-
-	config := &rdma.Config{
-		EngineSocketPath: socketPath,
-		DefaultTimeout:   timeout,
-		Logger:           logger,
-	}
-
-	return rdma.NewClient(config)
-}
diff --git a/seaweedfs-rdma-sidecar/demo-server b/seaweedfs-rdma-sidecar/demo-server
deleted file mode 100755
index 737f1721c0..0000000000
Binary files a/seaweedfs-rdma-sidecar/demo-server and /dev/null differ
diff --git a/seaweedfs-rdma-sidecar/docker-compose.mount-rdma.yml b/seaweedfs-rdma-sidecar/docker-compose.mount-rdma.yml
deleted file mode 100644
index 14ea1ca782..0000000000
--- a/seaweedfs-rdma-sidecar/docker-compose.mount-rdma.yml
+++ /dev/null
@@ -1,267 +0,0 @@
-services:
-  # SeaweedFS Master
-  seaweedfs-master:
-    image: chrislusf/seaweedfs:latest
-    container_name: seaweedfs-master
-    ports:
-      - "9333:9333"
-      - "19333:19333"
-    command: >
-      master
-      -port=9333
-      -mdir=/data
-      -volumeSizeLimitMB=1024
-      -defaultReplication=000
-    volumes:
-      - seaweedfs_master_data:/data
-    networks:
-      - seaweedfs-rdma
-    healthcheck:
-      test: ["CMD", "wget", "--timeout=10", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:9333/cluster/status"]
-      interval: 10s
-      timeout: 10s
-      retries: 6
-      start_period: 60s
-
-  # SeaweedFS Volume Server
-  seaweedfs-volume:
-    image: chrislusf/seaweedfs:latest
-    container_name: seaweedfs-volume
-    ports:
-      - "8080:8080"
-      - "18080:18080"
-    command: >
-      volume
-      -master=seaweedfs-master:9333
-      -port=8080
-      -dir=/data
-      -max=100
-    volumes:
-      - seaweedfs_volume_data:/data
-    networks:
-      - seaweedfs-rdma
-    depends_on:
-      seaweedfs-master:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "sh", "-c", "pgrep weed && netstat -tln | grep :8080"]
-      interval: 10s
-      timeout: 10s
-      retries: 6
-      start_period: 30s
-
-  # SeaweedFS Filer
-  seaweedfs-filer:
-    image: chrislusf/seaweedfs:latest
-    container_name: seaweedfs-filer
-    ports:
-      - "8888:8888"
-      - "18888:18888"
-    command: >
-      filer
-      -master=seaweedfs-master:9333
-      -port=8888
-      -defaultReplicaPlacement=000
-    networks:
-      - seaweedfs-rdma
-    depends_on:
-      seaweedfs-master:
-        condition: service_healthy
-      seaweedfs-volume:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "sh", "-c", "pgrep weed && netstat -tln | grep :8888"]
-      interval: 10s
-      timeout: 10s
-      retries: 6
-      start_period: 45s
-
-  # RDMA Engine (Rust)
-  rdma-engine:
-    build:
-      context: .
-      dockerfile: Dockerfile.rdma-engine
-    container_name: rdma-engine
-    volumes:
-      - rdma_socket:/tmp/rdma
-    networks:
-      - seaweedfs-rdma
-    environment:
-      - RUST_LOG=debug
-      - RDMA_SOCKET_PATH=/tmp/rdma/rdma-engine.sock
-      - RDMA_DEVICE=auto
-      - RDMA_PORT=18515
-      - RDMA_GID_INDEX=0
-      - DEBUG=true
-    command: >
-      ./rdma-engine-server
-      --ipc-socket ${RDMA_SOCKET_PATH}
-      --device ${RDMA_DEVICE}
-      --port ${RDMA_PORT}
-      --debug
-    healthcheck:
-      test: ["CMD", "sh", "-c", "pgrep rdma-engine-server >/dev/null && test -S /tmp/rdma/rdma-engine.sock"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-
-  # RDMA Sidecar (Go)
-  rdma-sidecar:
-    build:
-      context: .
-      dockerfile: Dockerfile.sidecar
-    container_name: rdma-sidecar
-    ports:
-      - "8081:8081"
-    volumes:
-      - rdma_socket:/tmp/rdma
-    networks:
-      - seaweedfs-rdma
-    environment:
-      - RDMA_SOCKET_PATH=/tmp/rdma/rdma-engine.sock
-      - VOLUME_SERVER_URL=http://seaweedfs-volume:8080
-      - SIDECAR_PORT=8081
-      - ENABLE_RDMA=true
-      - ENABLE_ZEROCOPY=true
-      - ENABLE_POOLING=true
-      - MAX_CONNECTIONS=10
-      - MAX_IDLE_TIME=5m
-      - DEBUG=true
-    command: >
-      ./demo-server
-      --port ${SIDECAR_PORT}
-      --rdma-socket ${RDMA_SOCKET_PATH}
-      --volume-server ${VOLUME_SERVER_URL}
-      --enable-rdma
-      --enable-zerocopy
-      --enable-pooling
-      --max-connections ${MAX_CONNECTIONS}
-      --max-idle-time ${MAX_IDLE_TIME}
-      --debug
-    depends_on:
-      rdma-engine:
-        condition: service_healthy
-      seaweedfs-volume:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8081/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 15s
-
-  # SeaweedFS Mount with RDMA
-  seaweedfs-mount:
-    build:
-      context: .
-      dockerfile: Dockerfile.mount-rdma
-    platform: linux/amd64
-    container_name: seaweedfs-mount
-    privileged: true  # Required for FUSE
-    devices:
-      - /dev/fuse:/dev/fuse
-    cap_add:
-      - SYS_ADMIN
-    volumes:
-      - seaweedfs_mount:/mnt/seaweedfs
-      - /tmp/seaweedfs-mount-logs:/var/log/seaweedfs
-    networks:
-      - seaweedfs-rdma
-    environment:
-      - FILER_ADDR=seaweedfs-filer:8888
-      - RDMA_SIDECAR_ADDR=rdma-sidecar:8081
-      - MOUNT_POINT=/mnt/seaweedfs
-      - RDMA_ENABLED=true
-      - RDMA_FALLBACK=true
-      - RDMA_MAX_CONCURRENT=64
-      - RDMA_TIMEOUT_MS=5000
-      - DEBUG=true
-    command: /usr/local/bin/mount-helper.sh
-    depends_on:
-      seaweedfs-filer:
-        condition: service_healthy
-      rdma-sidecar:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "mountpoint", "-q", "/mnt/seaweedfs"]
-      interval: 15s
-      timeout: 10s
-      retries: 3
-      start_period: 45s
-
-  # Integration Test Runner
-  integration-test:
-    build:
-      context: .
-      dockerfile: Dockerfile.integration-test
-    container_name: integration-test
-    volumes:
-      - seaweedfs_mount:/mnt/seaweedfs
-      - ./test-results:/test-results
-    networks:
-      - seaweedfs-rdma
-    environment:
-      - MOUNT_POINT=/mnt/seaweedfs
-      - FILER_ADDR=seaweedfs-filer:8888
-      - RDMA_SIDECAR_ADDR=rdma-sidecar:8081
-      - TEST_RESULTS_DIR=/test-results
-    depends_on:
-      seaweedfs-mount:
-        condition: service_healthy
-    command: >
-      sh -c "
-        echo 'Starting RDMA Mount Integration Tests...' &&
-        sleep 10 &&
-        /usr/local/bin/run-integration-tests.sh
-      "
-    profiles:
-      - test
-
-  # Performance Test Runner
-  performance-test:
-    build:
-      context: .
-      dockerfile: Dockerfile.performance-test
-    container_name: performance-test
-    volumes:
-      - seaweedfs_mount:/mnt/seaweedfs
-      - ./performance-results:/performance-results
-    networks:
-      - seaweedfs-rdma
-    environment:
-      - MOUNT_POINT=/mnt/seaweedfs
-      - RDMA_SIDECAR_ADDR=rdma-sidecar:8081
-      - PERFORMANCE_RESULTS_DIR=/performance-results
-    depends_on:
-      seaweedfs-mount:
-        condition: service_healthy
-    command: >
-      sh -c "
-        echo 'Starting RDMA Mount Performance Tests...' &&
-        sleep 10 &&
-        /usr/local/bin/run-performance-tests.sh
-      "
-    profiles:
-      - performance
-
-volumes:
-  seaweedfs_master_data:
-    driver: local
-  seaweedfs_volume_data:
-    driver: local
-  seaweedfs_mount:
-    driver: local
-    driver_opts:
-      type: tmpfs
-      device: tmpfs
-      o: size=1g
-  rdma_socket:
-    driver: local
-
-networks:
-  seaweedfs-rdma:
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.20.0.0/16
diff --git a/seaweedfs-rdma-sidecar/docker-compose.rdma-sim.yml b/seaweedfs-rdma-sidecar/docker-compose.rdma-sim.yml
deleted file mode 100644
index fc8de08dca..0000000000
--- a/seaweedfs-rdma-sidecar/docker-compose.rdma-sim.yml
+++ /dev/null
@@ -1,209 +0,0 @@
-services:
-  # SeaweedFS Master Server
-  seaweedfs-master:
-    image: chrislusf/seaweedfs:latest
-    container_name: seaweedfs-master
-    command: master -ip=seaweedfs-master -port=9333 -mdir=/data
-    ports:
-      - "9333:9333"
-    volumes:
-      - master-data:/data
-    networks:
-      - seaweedfs-rdma
-    healthcheck:
-      test: ["CMD", "pgrep", "-f", "weed"]
-      interval: 15s
-      timeout: 10s
-      retries: 5
-      start_period: 30s
-
-  # SeaweedFS Volume Server
-  seaweedfs-volume:
-    image: chrislusf/seaweedfs:latest
-    container_name: seaweedfs-volume
-    command: volume -master=seaweedfs-master:9333 -ip=seaweedfs-volume -port=8080 -dir=/data
-    ports:
-      - "8080:8080"
-    volumes:
-      - volume-data:/data
-    depends_on:
-      seaweedfs-master:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    healthcheck:
-      test: ["CMD", "pgrep", "-f", "weed"]
-      interval: 15s
-      timeout: 10s
-      retries: 5
-      start_period: 30s
-
-  # RDMA Simulation Environment
-  rdma-simulation:
-    build:
-      context: .
-      dockerfile: docker/Dockerfile.rdma-simulation
-    container_name: rdma-simulation
-    privileged: true  # Required for RDMA kernel module loading
-    environment:
-      - RDMA_DEVICE=rxe0
-      - UCX_TLS=rc_verbs,ud_verbs,tcp
-      - UCX_LOG_LEVEL=info
-    volumes:
-      - /lib/modules:/lib/modules:ro  # Host kernel modules
-      - /sys:/sys  # Required for sysfs access
-      - rdma-simulation-data:/opt/rdma-sim/data
-    networks:
-      - seaweedfs-rdma
-    ports:
-      - "18515:18515"  # RDMA application port
-      - "4791:4791"    # RDMA CM port
-      - "4792:4792"    # Additional RDMA port
-    command: |
-      bash -c "
-        echo '🚀 Setting up RDMA simulation environment...'
-        sudo /opt/rdma-sim/setup-soft-roce.sh || echo 'RDMA setup failed, continuing...'
-        echo '📋 RDMA environment status:'
-        /opt/rdma-sim/test-rdma.sh || true
-        echo '🔧 UCX information:'
-        /opt/rdma-sim/ucx-info.sh || true
-        echo '✅ RDMA simulation ready - keeping container alive...'
-        tail -f /dev/null
-      "
-    healthcheck:
-      test: ["CMD", "test", "-f", "/opt/rdma-sim/setup-soft-roce.sh"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 30s
-
-  # Rust RDMA Engine (with RDMA simulation support)
-  rdma-engine:
-    build:
-      context: .
-      dockerfile: Dockerfile.rdma-engine
-    container_name: rdma-engine
-    environment:
-      - RUST_LOG=debug
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-      # UCX configuration for real RDMA
-      - UCX_TLS=rc_verbs,ud_verbs,tcp,shm
-      - UCX_NET_DEVICES=all
-      - UCX_LOG_LEVEL=info
-      - UCX_RNDV_SCHEME=put_zcopy
-      - UCX_RNDV_THRESH=8192
-    volumes:
-      - rdma-socket:/tmp
-      # Share network namespace with RDMA simulation for device access
-    network_mode: "container:rdma-simulation"
-    depends_on:
-      rdma-simulation:
-        condition: service_healthy
-    command: ["./rdma-engine-server", "--debug", "--ipc-socket", "/tmp/rdma-engine.sock"]
-    healthcheck:
-      test: ["CMD", "test", "-S", "/tmp/rdma-engine.sock"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 15s
-
-  # Go RDMA Sidecar / Demo Server
-  rdma-sidecar:
-    build:
-      context: .
-      dockerfile: Dockerfile.sidecar
-    container_name: rdma-sidecar
-    ports:
-      - "8081:8081"
-    environment:
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-      - VOLUME_SERVER_URL=http://seaweedfs-volume:8080
-      - DEBUG=true
-    volumes:
-      - rdma-socket:/tmp
-    depends_on:
-      rdma-engine:
-        condition: service_healthy
-      seaweedfs-volume:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    command: [
-      "./demo-server",
-      "--port", "8081",
-      "--rdma-socket", "/tmp/rdma-engine.sock",
-      "--volume-server", "http://seaweedfs-volume:8080",
-      "--enable-rdma",
-      "--debug"
-    ]
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8081/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 20s
-
-  # Test Client for Integration Testing
-  test-client:
-    build:
-      context: .
-      dockerfile: Dockerfile.test-client
-    container_name: test-client
-    environment:
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-      - SIDECAR_URL=http://rdma-sidecar:8081
-      - SEAWEEDFS_MASTER=http://seaweedfs-master:9333
-      - SEAWEEDFS_VOLUME=http://seaweedfs-volume:8080
-    volumes:
-      - rdma-socket:/tmp
-    depends_on:
-      rdma-sidecar:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    profiles:
-      - testing
-    command: ["tail", "-f", "/dev/null"]  # Keep container running for manual testing
-
-  # Integration Test Runner with RDMA
-  integration-tests-rdma:
-    build:
-      context: .
-      dockerfile: Dockerfile.test-client
-    container_name: integration-tests-rdma
-    environment:
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-      - SIDECAR_URL=http://rdma-sidecar:8081
-      - SEAWEEDFS_MASTER=http://seaweedfs-master:9333
-      - SEAWEEDFS_VOLUME=http://seaweedfs-volume:8080
-      - RDMA_SIMULATION=true
-    volumes:
-      - rdma-socket:/tmp
-      - ./tests:/tests
-    depends_on:
-      rdma-sidecar:
-        condition: service_healthy
-      rdma-simulation:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    profiles:
-      - testing
-    command: ["/tests/run-integration-tests.sh"]
-
-volumes:
-  master-data:
-    driver: local
-  volume-data:
-    driver: local
-  rdma-socket:
-    driver: local
-  rdma-simulation-data:
-    driver: local
-
-networks:
-  seaweedfs-rdma:
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.20.0.0/16
diff --git a/seaweedfs-rdma-sidecar/docker-compose.yml b/seaweedfs-rdma-sidecar/docker-compose.yml
deleted file mode 100644
index b046ef8a0c..0000000000
--- a/seaweedfs-rdma-sidecar/docker-compose.yml
+++ /dev/null
@@ -1,157 +0,0 @@
-services:
-  # SeaweedFS Master Server
-  seaweedfs-master:
-    image: chrislusf/seaweedfs:latest
-    container_name: seaweedfs-master
-    command: master -ip=seaweedfs-master -port=9333 -mdir=/data
-    ports:
-      - "9333:9333"
-    volumes:
-      - master-data:/data
-    networks:
-      - seaweedfs-rdma
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:9333/cluster/status"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
-
-  # SeaweedFS Volume Server
-  seaweedfs-volume:
-    image: chrislusf/seaweedfs:latest
-    container_name: seaweedfs-volume
-    command: volume -master=seaweedfs-master:9333 -ip=seaweedfs-volume -port=8080 -dir=/data
-    ports:
-      - "8080:8080"
-    volumes:
-      - volume-data:/data
-    depends_on:
-      seaweedfs-master:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8080/status"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 15s
-
-  # Rust RDMA Engine
-  rdma-engine:
-    build:
-      context: .
-      dockerfile: Dockerfile.rdma-engine.simple
-    container_name: rdma-engine
-    environment:
-      - RUST_LOG=debug
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-    volumes:
-      - rdma-socket:/tmp
-      # Note: hugepages mount commented out to avoid host system requirements
-      # - /dev/hugepages:/dev/hugepages
-    # Privileged mode for RDMA access (in production, use specific capabilities)
-    privileged: true
-    networks:
-      - seaweedfs-rdma
-    command: ["./rdma-engine-server", "--debug", "--ipc-socket", "/tmp/rdma-engine.sock"]
-    healthcheck:
-      test: ["CMD", "test", "-S", "/tmp/rdma-engine.sock"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-
-  # Go RDMA Sidecar / Demo Server
-  rdma-sidecar:
-    build:
-      context: .
-      dockerfile: Dockerfile.sidecar
-    container_name: rdma-sidecar
-    ports:
-      - "8081:8081"
-    environment:
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-      - VOLUME_SERVER_URL=http://seaweedfs-volume:8080
-      - DEBUG=true
-    volumes:
-      - rdma-socket:/tmp
-    depends_on:
-      rdma-engine:
-        condition: service_healthy
-      seaweedfs-volume:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    command: [
-      "./demo-server",
-      "--port", "8081",
-      "--rdma-socket", "/tmp/rdma-engine.sock",
-      "--volume-server", "http://seaweedfs-volume:8080",
-      "--enable-rdma",
-      "--debug"
-    ]
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8081/health"]
-      interval: 10s
-      timeout: 5s
-      retries: 3
-      start_period: 15s
-
-  # Test Client for Integration Testing
-  test-client:
-    build:
-      context: .
-      dockerfile: Dockerfile.test-client
-    container_name: test-client
-    environment:
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-      - SIDECAR_URL=http://rdma-sidecar:8081
-      - SEAWEEDFS_MASTER=http://seaweedfs-master:9333
-      - SEAWEEDFS_VOLUME=http://seaweedfs-volume:8080
-    volumes:
-      - rdma-socket:/tmp
-    depends_on:
-      rdma-sidecar:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    profiles:
-      - testing
-    command: ["tail", "-f", "/dev/null"]  # Keep container running for manual testing
-
-  # Integration Test Runner
-  integration-tests:
-    build:
-      context: .
-      dockerfile: Dockerfile.test-client
-    container_name: integration-tests
-    environment:
-      - RDMA_SOCKET_PATH=/tmp/rdma-engine.sock
-      - SIDECAR_URL=http://rdma-sidecar:8081
-      - SEAWEEDFS_MASTER=http://seaweedfs-master:9333
-      - SEAWEEDFS_VOLUME=http://seaweedfs-volume:8080
-    volumes:
-      - rdma-socket:/tmp
-      - ./tests:/tests
-    depends_on:
-      rdma-sidecar:
-        condition: service_healthy
-    networks:
-      - seaweedfs-rdma
-    profiles:
-      - testing
-    command: ["/tests/run-integration-tests.sh"]
-
-volumes:
-  master-data:
-    driver: local
-  volume-data:
-    driver: local
-  rdma-socket:
-    driver: local
-
-networks:
-  seaweedfs-rdma:
-    driver: bridge
diff --git a/seaweedfs-rdma-sidecar/docker/Dockerfile.rdma-simulation b/seaweedfs-rdma-sidecar/docker/Dockerfile.rdma-simulation
deleted file mode 100644
index 9f25666234..0000000000
--- a/seaweedfs-rdma-sidecar/docker/Dockerfile.rdma-simulation
+++ /dev/null
@@ -1,77 +0,0 @@
-# RDMA Simulation Container with Soft-RoCE (RXE)
-# This container enables software RDMA over regular Ethernet
-
-FROM ubuntu:22.04
-
-# Install RDMA and networking tools
-RUN apt-get update && apt-get install -y \
-    # System utilities
-    sudo \
-    # RDMA core libraries
-    libibverbs1 \
-    libibverbs-dev \
-    librdmacm1 \
-    librdmacm-dev \
-    rdma-core \
-    ibverbs-utils \
-    infiniband-diags \
-    # Network tools  
-    iproute2 \
-    iputils-ping \
-    net-tools \
-    # Build tools
-    build-essential \
-    pkg-config \
-    cmake \
-    # UCX dependencies
-    libnuma1 \
-    libnuma-dev \
-    # UCX library (pre-built) - try to install but don't fail if not available
-    # libucx0 \
-    # libucx-dev \
-    # Debugging tools
-    strace \
-    gdb \
-    valgrind \
-    # Utilities
-    curl \
-    wget \
-    vim \
-    htop \
-    && rm -rf /var/lib/apt/lists/*
-
-# Try to install UCX tools (optional, may not be available in all repositories)
-RUN apt-get update && \
-    (apt-get install -y ucx-tools || echo "UCX tools not available in repository") && \
-    rm -rf /var/lib/apt/lists/*
-
-# Create rdmauser for security (avoid conflict with system rdma group)
-RUN useradd -m -s /bin/bash -G sudo,rdma rdmauser && \
-    echo "rdmauser ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
-
-# Create directories for RDMA setup
-RUN mkdir -p /opt/rdma-sim /var/log/rdma
-
-# Copy RDMA simulation scripts
-COPY docker/scripts/setup-soft-roce.sh /opt/rdma-sim/
-COPY docker/scripts/test-rdma.sh /opt/rdma-sim/
-COPY docker/scripts/ucx-info.sh /opt/rdma-sim/
-
-# Make scripts executable
-RUN chmod +x /opt/rdma-sim/*.sh
-
-# Set working directory
-WORKDIR /opt/rdma-sim
-
-# Switch to rdmauser
-USER rdmauser
-
-# Default command
-CMD ["/bin/bash"]
-
-# Health check for RDMA devices
-HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD /opt/rdma-sim/test-rdma.sh || exit 1
-
-# Expose common RDMA ports
-EXPOSE 18515 4791 4792
diff --git a/seaweedfs-rdma-sidecar/docker/scripts/setup-soft-roce.sh b/seaweedfs-rdma-sidecar/docker/scripts/setup-soft-roce.sh
deleted file mode 100755
index 55c8f3b805..0000000000
--- a/seaweedfs-rdma-sidecar/docker/scripts/setup-soft-roce.sh
+++ /dev/null
@@ -1,183 +0,0 @@
-#!/bin/bash
-
-# Setup Soft-RoCE (RXE) for RDMA simulation
-# This script enables RDMA over Ethernet using the RXE kernel module
-
-set -e
-
-echo "🔧 Setting up Soft-RoCE (RXE) RDMA simulation..."
-
-# Function to check if running with required privileges
-check_privileges() {
-    if [ "$EUID" -ne 0 ]; then
-        echo "❌ This script requires root privileges"
-        echo "Run with: sudo $0 or inside a privileged container"
-        exit 1
-    fi
-}
-
-# Function to load RXE kernel module
-load_rxe_module() {
-    echo "📦 Loading RXE kernel module..."
-    
-    # Try to load the rdma_rxe module
-    if modprobe rdma_rxe 2>/dev/null; then
-        echo "✅ rdma_rxe module loaded successfully"
-    else
-        echo "⚠️  Failed to load rdma_rxe module, trying alternative approach..."
-        
-        # Alternative: Try loading rxe_net (older kernels)
-        if modprobe rxe_net 2>/dev/null; then
-            echo "✅ rxe_net module loaded successfully"
-        else
-            echo "❌ Failed to load RXE modules. Possible causes:"
-            echo "  - Kernel doesn't support RXE (needs CONFIG_RDMA_RXE=m)"
-            echo "  - Running in unprivileged container"
-            echo "  - Missing kernel modules"
-            echo ""
-            echo "🔧 Workaround: Run container with --privileged flag"
-            exit 1
-        fi
-    fi
-    
-    # Verify module is loaded
-    if lsmod | grep -q "rdma_rxe\|rxe_net"; then
-        echo "✅ RXE module verification successful"
-    else
-        echo "❌ RXE module verification failed"
-        exit 1
-    fi
-}
-
-# Function to setup virtual RDMA device
-setup_rxe_device() {
-    echo "🌐 Setting up RXE device over Ethernet interface..."
-    
-    # Find available network interface (prefer eth0, fallback to others)
-    local interface=""
-    for iface in eth0 enp0s3 enp0s8 lo; do
-        if ip link show "$iface" >/dev/null 2>&1; then
-            interface="$iface"
-            break
-        fi
-    done
-    
-    if [ -z "$interface" ]; then
-        echo "❌ No suitable network interface found"
-        echo "Available interfaces:"
-        ip link show | grep "^[0-9]" | cut -d':' -f2 | tr -d ' '
-        exit 1
-    fi
-    
-    echo "📡 Using network interface: $interface"
-    
-    # Create RXE device
-    echo "🔨 Creating RXE device on $interface..."
-    
-    # Try modern rxe_cfg approach first
-    if command -v rxe_cfg >/dev/null 2>&1; then
-        rxe_cfg add "$interface" || {
-            echo "⚠️  rxe_cfg failed, trying manual approach..."
-            setup_rxe_manual "$interface"
-        }
-    else
-        echo "⚠️  rxe_cfg not available, using manual setup..."
-        setup_rxe_manual "$interface"
-    fi
-}
-
-# Function to manually setup RXE device
-setup_rxe_manual() {
-    local interface="$1"
-    
-    # Use sysfs interface to create RXE device
-    if [ -d /sys/module/rdma_rxe ]; then
-        echo "$interface" > /sys/module/rdma_rxe/parameters/add 2>/dev/null || {
-            echo "❌ Failed to add RXE device via sysfs"
-            exit 1
-        }
-    else
-        echo "❌ RXE sysfs interface not found"
-        exit 1
-    fi
-}
-
-# Function to verify RDMA devices
-verify_rdma_devices() {
-    echo "🔍 Verifying RDMA devices..."
-    
-    # Check for RDMA devices
-    if [ -d /sys/class/infiniband ]; then
-        local devices=$(ls /sys/class/infiniband/ 2>/dev/null | wc -l)
-        if [ "$devices" -gt 0 ]; then
-            echo "✅ Found $devices RDMA device(s):"
-            ls /sys/class/infiniband/
-            
-            # Show device details
-            for device in /sys/class/infiniband/*; do
-                if [ -d "$device" ]; then
-                    local dev_name=$(basename "$device")
-                    echo "  📋 Device: $dev_name"
-                    
-                    # Try to get device info
-                    if command -v ibv_devinfo >/dev/null 2>&1; then
-                        ibv_devinfo -d "$dev_name" | head -10
-                    fi
-                fi
-            done
-        else
-            echo "❌ No RDMA devices found in /sys/class/infiniband/"
-            exit 1
-        fi
-    else
-        echo "❌ /sys/class/infiniband directory not found"
-        exit 1
-    fi
-}
-
-# Function to test basic RDMA functionality
-test_basic_rdma() {
-    echo "🧪 Testing basic RDMA functionality..."
-    
-    # Test libibverbs
-    if command -v ibv_devinfo >/dev/null 2>&1; then
-        echo "📋 RDMA device information:"
-        ibv_devinfo | head -20
-    else
-        echo "⚠️  ibv_devinfo not available"
-    fi
-    
-    # Test UCX if available
-    if command -v ucx_info >/dev/null 2>&1; then
-        echo "📋 UCX information:"
-        ucx_info -d | head -10
-    else
-        echo "⚠️  UCX tools not available"
-    fi
-}
-
-# Main execution
-main() {
-    echo "🚀 Starting Soft-RoCE RDMA simulation setup..."
-    echo "======================================"
-    
-    check_privileges
-    load_rxe_module
-    setup_rxe_device  
-    verify_rdma_devices
-    test_basic_rdma
-    
-    echo ""
-    echo "🎉 Soft-RoCE setup completed successfully!"
-    echo "======================================"
-    echo "✅ RDMA simulation is ready for testing"
-    echo "📡 You can now run RDMA applications"
-    echo ""
-    echo "Next steps:"
-    echo "  - Test with: /opt/rdma-sim/test-rdma.sh"
-    echo "  - Check UCX: /opt/rdma-sim/ucx-info.sh"
-    echo "  - Run your RDMA applications"
-}
-
-# Execute main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/docker/scripts/test-rdma.sh b/seaweedfs-rdma-sidecar/docker/scripts/test-rdma.sh
deleted file mode 100755
index 91e60ca7f6..0000000000
--- a/seaweedfs-rdma-sidecar/docker/scripts/test-rdma.sh
+++ /dev/null
@@ -1,253 +0,0 @@
-#!/bin/bash
-
-# Test RDMA functionality in simulation environment
-# This script validates that RDMA devices and libraries are working
-
-set -e
-
-echo "🧪 Testing RDMA simulation environment..."
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-# Function to print colored output
-print_status() {
-    local status="$1"
-    local message="$2"
-    
-    case "$status" in
-        "success")
-            echo -e "${GREEN}✅ $message${NC}"
-            ;;
-        "warning") 
-            echo -e "${YELLOW}⚠️  $message${NC}"
-            ;;
-        "error")
-            echo -e "${RED}❌ $message${NC}"
-            ;;
-        "info")
-            echo -e "${BLUE}📋 $message${NC}"
-            ;;
-    esac
-}
-
-# Function to test RDMA devices
-test_rdma_devices() {
-    print_status "info" "Testing RDMA devices..."
-    
-    # Check for InfiniBand/RDMA devices
-    if [ -d /sys/class/infiniband ]; then
-        local device_count=$(ls /sys/class/infiniband/ 2>/dev/null | wc -l)
-        if [ "$device_count" -gt 0 ]; then
-            print_status "success" "Found $device_count RDMA device(s)"
-            
-            # List devices
-            for device in /sys/class/infiniband/*; do
-                if [ -d "$device" ]; then
-                    local dev_name=$(basename "$device")
-                    print_status "info" "Device: $dev_name"
-                fi
-            done
-            return 0
-        else
-            print_status "error" "No RDMA devices found"
-            return 1
-        fi
-    else
-        print_status "error" "/sys/class/infiniband directory not found"
-        return 1
-    fi
-}
-
-# Function to test libibverbs
-test_libibverbs() {
-    print_status "info" "Testing libibverbs..."
-    
-    if command -v ibv_devinfo >/dev/null 2>&1; then
-        # Get device info
-        local device_info=$(ibv_devinfo 2>/dev/null)
-        if [ -n "$device_info" ]; then
-            print_status "success" "libibverbs working - devices detected"
-            
-            # Show basic info
-            echo "$device_info" | head -5
-            
-            # Test device capabilities
-            if echo "$device_info" | grep -q "transport.*InfiniBand\|transport.*Ethernet"; then
-                print_status "success" "RDMA transport layer detected"
-            else
-                print_status "warning" "Transport layer information unclear"
-            fi
-            
-            return 0
-        else
-            print_status "error" "ibv_devinfo found no devices"
-            return 1
-        fi
-    else
-        print_status "error" "ibv_devinfo command not found"
-        return 1
-    fi
-}
-
-# Function to test UCX
-test_ucx() {
-    print_status "info" "Testing UCX..."
-    
-    if command -v ucx_info >/dev/null 2>&1; then
-        # Test UCX device detection
-        local ucx_output=$(ucx_info -d 2>/dev/null)
-        if [ -n "$ucx_output" ]; then
-            print_status "success" "UCX detecting devices"
-            
-            # Show UCX device info
-            echo "$ucx_output" | head -10
-            
-            # Check for RDMA transports
-            if echo "$ucx_output" | grep -q "rc\|ud\|dc"; then
-                print_status "success" "UCX RDMA transports available" 
-            else
-                print_status "warning" "UCX RDMA transports not detected"
-            fi
-            
-            return 0
-        else
-            print_status "warning" "UCX not detecting devices"
-            return 1
-        fi
-    else
-        print_status "warning" "UCX tools not available"
-        return 1
-    fi
-}
-
-# Function to test RDMA CM (Connection Manager)
-test_rdma_cm() {
-    print_status "info" "Testing RDMA Connection Manager..."
-    
-    # Check for RDMA CM device
-    if [ -e /dev/infiniband/rdma_cm ]; then
-        print_status "success" "RDMA CM device found"
-        return 0
-    else
-        print_status "warning" "RDMA CM device not found"
-        return 1
-    fi
-}
-
-# Function to test basic RDMA operations
-test_rdma_operations() {
-    print_status "info" "Testing basic RDMA operations..."
-    
-    # Try to run a simple RDMA test if tools are available
-    if command -v ibv_rc_pingpong >/dev/null 2>&1; then
-        # This would need a client/server setup, so just check if binary exists
-        print_status "success" "RDMA test tools available (ibv_rc_pingpong)"
-    else
-        print_status "warning" "RDMA test tools not available"
-    fi
-    
-    # Check for other useful RDMA utilities
-    local tools_found=0
-    for tool in ibv_asyncwatch ibv_read_lat ibv_write_lat; do
-        if command -v "$tool" >/dev/null 2>&1; then
-            tools_found=$((tools_found + 1))
-        fi
-    done
-    
-    if [ "$tools_found" -gt 0 ]; then
-        print_status "success" "Found $tools_found additional RDMA test tools"
-    else
-        print_status "warning" "No additional RDMA test tools found"
-    fi
-}
-
-# Function to generate test summary
-generate_summary() {
-    echo ""
-    print_status "info" "RDMA Simulation Test Summary"
-    echo "======================================"
-    
-    # Re-run key tests for summary
-    local devices_ok=0
-    local libibverbs_ok=0
-    local ucx_ok=0
-    
-    if [ -d /sys/class/infiniband ] && [ "$(ls /sys/class/infiniband/ 2>/dev/null | wc -l)" -gt 0 ]; then
-        devices_ok=1
-    fi
-    
-    if command -v ibv_devinfo >/dev/null 2>&1 && ibv_devinfo >/dev/null 2>&1; then
-        libibverbs_ok=1
-    fi
-    
-    if command -v ucx_info >/dev/null 2>&1 && ucx_info -d >/dev/null 2>&1; then
-        ucx_ok=1
-    fi
-    
-    echo "📊 Test Results:"
-    [ "$devices_ok" -eq 1 ] && print_status "success" "RDMA Devices: PASS" || print_status "error" "RDMA Devices: FAIL"
-    [ "$libibverbs_ok" -eq 1 ] && print_status "success" "libibverbs: PASS" || print_status "error" "libibverbs: FAIL"
-    [ "$ucx_ok" -eq 1 ] && print_status "success" "UCX: PASS" || print_status "warning" "UCX: FAIL/WARNING"
-    
-    echo ""
-    if [ "$devices_ok" -eq 1 ] && [ "$libibverbs_ok" -eq 1 ]; then
-        print_status "success" "RDMA simulation environment is ready! 🎉"
-        echo ""
-        print_status "info" "You can now:"
-        echo "  - Run RDMA applications"
-        echo "  - Test SeaweedFS RDMA engine with real RDMA"
-        echo "  - Use UCX for high-performance transfers"
-        return 0
-    else
-        print_status "error" "RDMA simulation setup needs attention"
-        echo ""
-        print_status "info" "Troubleshooting:"
-        echo "  - Run setup script: sudo /opt/rdma-sim/setup-soft-roce.sh"
-        echo "  - Check container privileges (--privileged flag)"
-        echo "  - Verify kernel RDMA support"
-        return 1
-    fi
-}
-
-# Main test execution
-main() {
-    echo "🚀 RDMA Simulation Test Suite"
-    echo "======================================"
-    
-    # Run tests
-    test_rdma_devices || true
-    echo ""
-    
-    test_libibverbs || true
-    echo ""
-    
-    test_ucx || true
-    echo ""
-    
-    test_rdma_cm || true
-    echo ""
-    
-    test_rdma_operations || true
-    echo ""
-    
-    # Generate summary
-    generate_summary
-}
-
-# Health check mode (for Docker healthcheck)
-if [ "$1" = "healthcheck" ]; then
-    # Quick health check - just verify devices exist
-    if [ -d /sys/class/infiniband ] && [ "$(ls /sys/class/infiniband/ 2>/dev/null | wc -l)" -gt 0 ]; then
-        exit 0
-    else
-        exit 1
-    fi
-fi
-
-# Execute main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/docker/scripts/ucx-info.sh b/seaweedfs-rdma-sidecar/docker/scripts/ucx-info.sh
deleted file mode 100755
index 9bf287c6ef..0000000000
--- a/seaweedfs-rdma-sidecar/docker/scripts/ucx-info.sh
+++ /dev/null
@@ -1,269 +0,0 @@
-#!/bin/bash
-
-# UCX Information and Testing Script
-# Provides detailed information about UCX configuration and capabilities
-
-set -e
-
-echo "📋 UCX (Unified Communication X) Information"
-echo "============================================="
-
-# Colors for output
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m' # No Color
-
-print_section() {
-    echo -e "\n${BLUE}📌 $1${NC}"
-    echo "----------------------------------------"
-}
-
-print_info() {
-    echo -e "${GREEN}ℹ️  $1${NC}"
-}
-
-print_warning() {
-    echo -e "${YELLOW}⚠️  $1${NC}"
-}
-
-# Function to check UCX installation
-check_ucx_installation() {
-    print_section "UCX Installation Status"
-    
-    if command -v ucx_info >/dev/null 2>&1; then
-        print_info "UCX tools are installed"
-        
-        # Get UCX version
-        if ucx_info -v >/dev/null 2>&1; then
-            local version=$(ucx_info -v 2>/dev/null | head -1)
-            print_info "Version: $version"
-        fi
-    else
-        print_warning "UCX tools not found"
-        echo "Install with: apt-get install ucx-tools libucx-dev"
-        return 1
-    fi
-    
-    # Check UCX libraries
-    local libs_found=0
-    for lib in libucp.so libucs.so libuct.so; do
-        if ldconfig -p | grep -q "$lib"; then
-            libs_found=$((libs_found + 1))
-        fi
-    done
-    
-    if [ "$libs_found" -eq 3 ]; then
-        print_info "All UCX libraries found (ucp, ucs, uct)"
-    else
-        print_warning "Some UCX libraries may be missing ($libs_found/3 found)"
-    fi
-}
-
-# Function to show UCX device information
-show_ucx_devices() {
-    print_section "UCX Transport Devices"
-    
-    if command -v ucx_info >/dev/null 2>&1; then
-        echo "Available UCX transports and devices:"
-        ucx_info -d 2>/dev/null || {
-            print_warning "Failed to get UCX device information"
-            return 1
-        }
-    else
-        print_warning "ucx_info command not available"
-        return 1
-    fi
-}
-
-# Function to show UCX configuration
-show_ucx_config() {
-    print_section "UCX Configuration"
-    
-    if command -v ucx_info >/dev/null 2>&1; then
-        echo "UCX configuration parameters:"
-        ucx_info -c 2>/dev/null | head -20 || {
-            print_warning "Failed to get UCX configuration"
-            return 1
-        }
-        
-        echo ""
-        print_info "Key UCX environment variables:"
-        echo "  UCX_TLS - Transport layers to use"
-        echo "  UCX_NET_DEVICES - Network devices to use"
-        echo "  UCX_LOG_LEVEL - Logging level (error, warn, info, debug, trace)"
-        echo "  UCX_MEMTYPE_CACHE - Memory type caching (y/n)"
-    else
-        print_warning "ucx_info command not available"
-        return 1
-    fi
-}
-
-# Function to test UCX capabilities
-test_ucx_capabilities() {
-    print_section "UCX Capability Testing"
-    
-    if command -v ucx_info >/dev/null 2>&1; then
-        print_info "Testing UCX transport capabilities..."
-        
-        # Check for RDMA transports
-        local ucx_transports=$(ucx_info -d 2>/dev/null | grep -i "transport\|tl:" || true)
-        
-        if echo "$ucx_transports" | grep -q "rc\|dc\|ud"; then
-            print_info "✅ RDMA transports detected (RC/DC/UD)"
-        else
-            print_warning "No RDMA transports detected"
-        fi
-        
-        if echo "$ucx_transports" | grep -q "tcp"; then
-            print_info "✅ TCP transport available"
-        else
-            print_warning "TCP transport not detected"
-        fi
-        
-        if echo "$ucx_transports" | grep -q "shm\|posix"; then
-            print_info "✅ Shared memory transport available"
-        else
-            print_warning "Shared memory transport not detected"
-        fi
-        
-        # Memory types
-        print_info "Testing memory type support..."
-        local memory_info=$(ucx_info -d 2>/dev/null | grep -i "memory\|md:" || true)
-        if [ -n "$memory_info" ]; then
-            echo "$memory_info" | head -5
-        fi
-        
-    else
-        print_warning "Cannot test UCX capabilities - ucx_info not available"
-        return 1
-    fi
-}
-
-# Function to show recommended UCX settings for RDMA
-show_rdma_settings() {
-    print_section "Recommended UCX Settings for RDMA"
-    
-    print_info "For optimal RDMA performance with SeaweedFS:"
-    echo ""
-    echo "Environment Variables:"
-    echo "  export UCX_TLS=rc_verbs,ud_verbs,rc_mlx5_dv,dc_mlx5_dv"
-    echo "  export UCX_NET_DEVICES=all"
-    echo "  export UCX_LOG_LEVEL=info"
-    echo "  export UCX_RNDV_SCHEME=put_zcopy"
-    echo "  export UCX_RNDV_THRESH=8192"
-    echo ""
-    
-    print_info "For development/debugging:"
-    echo "  export UCX_LOG_LEVEL=debug"
-    echo "  export UCX_LOG_FILE=/tmp/ucx.log"
-    echo ""
-    
-    print_info "For Soft-RoCE (RXE) specifically:"
-    echo "  export UCX_TLS=rc_verbs,ud_verbs"
-    echo "  export UCX_IB_DEVICE_SPECS=rxe0:1"  
-    echo ""
-}
-
-# Function to test basic UCX functionality
-test_ucx_basic() {
-    print_section "Basic UCX Functionality Test"
-    
-    if command -v ucx_hello_world >/dev/null 2>&1; then
-        print_info "UCX hello_world test available"
-        echo "You can test UCX with:"
-        echo "  Server: UCX_TLS=tcp ucx_hello_world -l"
-        echo "  Client: UCX_TLS=tcp ucx_hello_world <server_ip>"
-    else
-        print_warning "UCX hello_world test not available"
-    fi
-    
-    # Check for other UCX test utilities
-    local test_tools=0
-    for tool in ucx_perftest ucp_hello_world; do
-        if command -v "$tool" >/dev/null 2>&1; then
-            test_tools=$((test_tools + 1))
-            print_info "UCX test tool available: $tool"
-        fi
-    done
-    
-    if [ "$test_tools" -eq 0 ]; then
-        print_warning "No UCX test tools found"
-        echo "Consider installing: ucx-tools package"
-    fi
-}
-
-# Function to generate UCX summary
-generate_summary() {
-    print_section "UCX Status Summary"
-    
-    local ucx_ok=0
-    local devices_ok=0
-    local rdma_ok=0
-    
-    # Check UCX availability
-    if command -v ucx_info >/dev/null 2>&1; then
-        ucx_ok=1
-    fi
-    
-    # Check devices
-    if command -v ucx_info >/dev/null 2>&1 && ucx_info -d >/dev/null 2>&1; then
-        devices_ok=1
-        
-        # Check for RDMA
-        if ucx_info -d 2>/dev/null | grep -q "rc\|dc\|ud"; then
-            rdma_ok=1
-        fi
-    fi
-    
-    echo "📊 UCX Status:"
-    [ "$ucx_ok" -eq 1 ] && print_info "✅ UCX Installation: OK" || print_warning "❌ UCX Installation: Missing"
-    [ "$devices_ok" -eq 1 ] && print_info "✅ UCX Devices: Detected" || print_warning "❌ UCX Devices: Not detected"
-    [ "$rdma_ok" -eq 1 ] && print_info "✅ RDMA Support: Available" || print_warning "⚠️  RDMA Support: Limited/Missing"
-    
-    echo ""
-    if [ "$ucx_ok" -eq 1 ] && [ "$devices_ok" -eq 1 ]; then
-        print_info "🎉 UCX is ready for SeaweedFS RDMA integration!"
-        
-        if [ "$rdma_ok" -eq 1 ]; then
-            print_info "🚀 Real RDMA acceleration is available"
-        else
-            print_warning "💡 Only TCP/shared memory transports available"
-        fi
-    else
-        print_warning "🔧 UCX setup needs attention for optimal performance"
-    fi
-}
-
-# Main execution
-main() {
-    check_ucx_installation
-    echo ""
-    
-    show_ucx_devices
-    echo ""
-    
-    show_ucx_config
-    echo ""
-    
-    test_ucx_capabilities  
-    echo ""
-    
-    show_rdma_settings
-    echo ""
-    
-    test_ucx_basic
-    echo ""
-    
-    generate_summary
-    
-    echo ""
-    print_info "For SeaweedFS RDMA engine integration:"
-    echo "  1. Use UCX with your Rust engine"
-    echo "  2. Configure appropriate transport layers"
-    echo "  3. Test with SeaweedFS RDMA sidecar"
-    echo "  4. Monitor performance and adjust settings"
-}
-
-# Execute main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/go.mod b/seaweedfs-rdma-sidecar/go.mod
deleted file mode 100644
index d913cd9706..0000000000
--- a/seaweedfs-rdma-sidecar/go.mod
+++ /dev/null
@@ -1,49 +0,0 @@
-module seaweedfs-rdma-sidecar
-
-go 1.25.8
-
-require (
-	github.com/seaweedfs/seaweedfs v0.0.0-00010101000000-000000000000
-	github.com/sirupsen/logrus v1.9.4
-	github.com/spf13/cobra v1.8.0
-	github.com/vmihailenco/msgpack/v5 v5.4.1
-)
-
-require (
-	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cognusion/imaging v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
-	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
-	github.com/prometheus/client_golang v1.24.0 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.0 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
-	github.com/sagikazarmark/locafero v0.11.0 // indirect
-	github.com/seaweedfs/goexif v1.0.3 // indirect
-	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
-	github.com/spf13/afero v1.15.0 // indirect
-	github.com/spf13/cast v1.10.0 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/spf13/viper v1.21.0 // indirect
-	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/image v0.43.0 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
-	google.golang.org/grpc v1.82.1 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
-)
-
-// For local development, this replace directive is required to build the sidecar
-// against the parent SeaweedFS module in this monorepo.
-//
-// To build this module, ensure the main SeaweedFS repository is checked out
-// as a sibling directory to this `seaweedfs-rdma-sidecar` directory.
-replace github.com/seaweedfs/seaweedfs => ../
diff --git a/seaweedfs-rdma-sidecar/go.sum b/seaweedfs-rdma-sidecar/go.sum
deleted file mode 100644
index ffa38346dc..0000000000
--- a/seaweedfs-rdma-sidecar/go.sum
+++ /dev/null
@@ -1,118 +0,0 @@
-github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cognusion/imaging v1.0.4 h1:hrmWVa4S9fiLJJFKEHYYRNBUnHEKZD8/oxnC77xTUa0=
-github.com/cognusion/imaging v1.0.4/go.mod h1:X1mPSSZpMyiva54chCO/1NROp+b6xG4uMcud8VLii+U=
-github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
-github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
-github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
-github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
-github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ=
-github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
-github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
-github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
-github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
-github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
-github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
-github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
-github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
-github.com/seaweedfs/goexif v1.0.3 h1:ve/OjI7dxPW8X9YQsv3JuVMaxEyF9Rvfd04ouL+Bz30=
-github.com/seaweedfs/goexif v1.0.3/go.mod h1:Oni780Z236sXpIQzk1XoJlTwqrJ02smEin9zQeff7Fk=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
-github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
-github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
-github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
-github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
-github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
-github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
-github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
-github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
-github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
-github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IUPn0Bjt8=
-github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
-github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
-github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
-go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
-go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
-go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
-go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
-go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
-go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
-go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
-go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
-golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 h1:qEHAMpSaUhtD0p3NbEEI83HwNGFxEwaSJ1G9PLnCBZE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/seaweedfs-rdma-sidecar/pkg/ipc/client.go b/seaweedfs-rdma-sidecar/pkg/ipc/client.go
deleted file mode 100644
index b2c1d2db1a..0000000000
--- a/seaweedfs-rdma-sidecar/pkg/ipc/client.go
+++ /dev/null
@@ -1,331 +0,0 @@
-package ipc
-
-import (
-	"context"
-	"encoding/binary"
-	"fmt"
-	"net"
-	"sync"
-	"time"
-
-	"github.com/sirupsen/logrus"
-	"github.com/vmihailenco/msgpack/v5"
-)
-
-// Client provides IPC communication with the Rust RDMA engine
-type Client struct {
-	socketPath string
-	conn       net.Conn
-	mu         sync.RWMutex
-	logger     *logrus.Logger
-	connected  bool
-}
-
-// NewClient creates a new IPC client
-func NewClient(socketPath string, logger *logrus.Logger) *Client {
-	if logger == nil {
-		logger = logrus.New()
-		logger.SetLevel(logrus.InfoLevel)
-	}
-
-	return &Client{
-		socketPath: socketPath,
-		logger:     logger,
-	}
-}
-
-// Connect establishes connection to the Rust RDMA engine
-func (c *Client) Connect(ctx context.Context) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if c.connected {
-		return nil
-	}
-
-	c.logger.WithField("socket", c.socketPath).Info("🔗 Connecting to Rust RDMA engine")
-
-	dialer := &net.Dialer{}
-	conn, err := dialer.DialContext(ctx, "unix", c.socketPath)
-	if err != nil {
-		c.logger.WithError(err).Error("❌ Failed to connect to RDMA engine")
-		return fmt.Errorf("failed to connect to RDMA engine at %s: %w", c.socketPath, err)
-	}
-
-	c.conn = conn
-	c.connected = true
-	c.logger.Info("✅ Connected to Rust RDMA engine")
-
-	return nil
-}
-
-// Disconnect closes the connection
-func (c *Client) Disconnect() {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if c.conn != nil {
-		c.conn.Close()
-		c.conn = nil
-		c.connected = false
-		c.logger.Info("🔌 Disconnected from Rust RDMA engine")
-	}
-}
-
-// IsConnected returns connection status
-func (c *Client) IsConnected() bool {
-	c.mu.RLock()
-	defer c.mu.RUnlock()
-	return c.connected
-}
-
-// SendMessage sends an IPC message and waits for response
-func (c *Client) SendMessage(ctx context.Context, msg *IpcMessage) (*IpcMessage, error) {
-	c.mu.RLock()
-	conn := c.conn
-	connected := c.connected
-	c.mu.RUnlock()
-
-	if !connected || conn == nil {
-		return nil, fmt.Errorf("not connected to RDMA engine")
-	}
-
-	// Set write timeout
-	if deadline, ok := ctx.Deadline(); ok {
-		conn.SetWriteDeadline(deadline)
-	} else {
-		conn.SetWriteDeadline(time.Now().Add(30 * time.Second))
-	}
-
-	c.logger.WithField("type", msg.Type).Debug("📤 Sending message to Rust engine")
-
-	// Serialize message with MessagePack
-	data, err := msgpack.Marshal(msg)
-	if err != nil {
-		c.logger.WithError(err).Error("❌ Failed to marshal message")
-		return nil, fmt.Errorf("failed to marshal message: %w", err)
-	}
-
-	// Send message length (4 bytes) + message data
-	lengthBytes := make([]byte, 4)
-	binary.LittleEndian.PutUint32(lengthBytes, uint32(len(data)))
-
-	if _, err := conn.Write(lengthBytes); err != nil {
-		c.logger.WithError(err).Error("❌ Failed to send message length")
-		return nil, fmt.Errorf("failed to send message length: %w", err)
-	}
-
-	if _, err := conn.Write(data); err != nil {
-		c.logger.WithError(err).Error("❌ Failed to send message data")
-		return nil, fmt.Errorf("failed to send message data: %w", err)
-	}
-
-	c.logger.WithFields(logrus.Fields{
-		"type": msg.Type,
-		"size": len(data),
-	}).Debug("📤 Message sent successfully")
-
-	// Read response
-	return c.readResponse(ctx, conn)
-}
-
-// readResponse reads and deserializes the response message
-func (c *Client) readResponse(ctx context.Context, conn net.Conn) (*IpcMessage, error) {
-	// Set read timeout
-	if deadline, ok := ctx.Deadline(); ok {
-		conn.SetReadDeadline(deadline)
-	} else {
-		conn.SetReadDeadline(time.Now().Add(30 * time.Second))
-	}
-
-	// Read message length (4 bytes)
-	lengthBytes := make([]byte, 4)
-	if _, err := conn.Read(lengthBytes); err != nil {
-		c.logger.WithError(err).Error("❌ Failed to read response length")
-		return nil, fmt.Errorf("failed to read response length: %w", err)
-	}
-
-	length := binary.LittleEndian.Uint32(lengthBytes)
-	if length > 64*1024*1024 { // 64MB sanity check
-		c.logger.WithField("length", length).Error("❌ Response message too large")
-		return nil, fmt.Errorf("response message too large: %d bytes", length)
-	}
-
-	// Read message data
-	data := make([]byte, length)
-	if _, err := conn.Read(data); err != nil {
-		c.logger.WithError(err).Error("❌ Failed to read response data")
-		return nil, fmt.Errorf("failed to read response data: %w", err)
-	}
-
-	c.logger.WithField("size", length).Debug("📥 Response received")
-
-	// Deserialize with MessagePack
-	var response IpcMessage
-	if err := msgpack.Unmarshal(data, &response); err != nil {
-		c.logger.WithError(err).Error("❌ Failed to unmarshal response")
-		return nil, fmt.Errorf("failed to unmarshal response: %w", err)
-	}
-
-	c.logger.WithField("type", response.Type).Debug("📥 Response deserialized successfully")
-
-	return &response, nil
-}
-
-// High-level convenience methods
-
-// Ping sends a ping message to test connectivity
-func (c *Client) Ping(ctx context.Context, clientID *string) (*PongResponse, error) {
-	msg := NewPingMessage(clientID)
-
-	response, err := c.SendMessage(ctx, msg)
-	if err != nil {
-		return nil, err
-	}
-
-	if response.Type == MsgError {
-		errorData, err := msgpack.Marshal(response.Data)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal engine error data: %w", err)
-		}
-		var errorResp ErrorResponse
-		if err := msgpack.Unmarshal(errorData, &errorResp); err != nil {
-			return nil, fmt.Errorf("failed to unmarshal engine error response: %w", err)
-		}
-		return nil, fmt.Errorf("engine error: %s - %s", errorResp.Code, errorResp.Message)
-	}
-
-	if response.Type != MsgPong {
-		return nil, fmt.Errorf("unexpected response type: %s", response.Type)
-	}
-
-	// Convert response data to PongResponse
-	pongData, err := msgpack.Marshal(response.Data)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal pong data: %w", err)
-	}
-
-	var pong PongResponse
-	if err := msgpack.Unmarshal(pongData, &pong); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal pong response: %w", err)
-	}
-
-	return &pong, nil
-}
-
-// GetCapabilities requests engine capabilities
-func (c *Client) GetCapabilities(ctx context.Context, clientID *string) (*GetCapabilitiesResponse, error) {
-	msg := NewGetCapabilitiesMessage(clientID)
-
-	response, err := c.SendMessage(ctx, msg)
-	if err != nil {
-		return nil, err
-	}
-
-	if response.Type == MsgError {
-		errorData, err := msgpack.Marshal(response.Data)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal engine error data: %w", err)
-		}
-		var errorResp ErrorResponse
-		if err := msgpack.Unmarshal(errorData, &errorResp); err != nil {
-			return nil, fmt.Errorf("failed to unmarshal engine error response: %w", err)
-		}
-		return nil, fmt.Errorf("engine error: %s - %s", errorResp.Code, errorResp.Message)
-	}
-
-	if response.Type != MsgGetCapabilitiesResponse {
-		return nil, fmt.Errorf("unexpected response type: %s", response.Type)
-	}
-
-	// Convert response data to GetCapabilitiesResponse
-	capsData, err := msgpack.Marshal(response.Data)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal capabilities data: %w", err)
-	}
-
-	var caps GetCapabilitiesResponse
-	if err := msgpack.Unmarshal(capsData, &caps); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal capabilities response: %w", err)
-	}
-
-	return &caps, nil
-}
-
-// StartRead initiates an RDMA read operation
-func (c *Client) StartRead(ctx context.Context, req *StartReadRequest) (*StartReadResponse, error) {
-	msg := NewStartReadMessage(req)
-
-	response, err := c.SendMessage(ctx, msg)
-	if err != nil {
-		return nil, err
-	}
-
-	if response.Type == MsgError {
-		errorData, err := msgpack.Marshal(response.Data)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal engine error data: %w", err)
-		}
-		var errorResp ErrorResponse
-		if err := msgpack.Unmarshal(errorData, &errorResp); err != nil {
-			return nil, fmt.Errorf("failed to unmarshal engine error response: %w", err)
-		}
-		return nil, fmt.Errorf("engine error: %s - %s", errorResp.Code, errorResp.Message)
-	}
-
-	if response.Type != MsgStartReadResponse {
-		return nil, fmt.Errorf("unexpected response type: %s", response.Type)
-	}
-
-	// Convert response data to StartReadResponse
-	startData, err := msgpack.Marshal(response.Data)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal start read data: %w", err)
-	}
-
-	var startResp StartReadResponse
-	if err := msgpack.Unmarshal(startData, &startResp); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal start read response: %w", err)
-	}
-
-	return &startResp, nil
-}
-
-// CompleteRead completes an RDMA read operation
-func (c *Client) CompleteRead(ctx context.Context, sessionID string, success bool, bytesTransferred uint64, clientCrc *uint32) (*CompleteReadResponse, error) {
-	msg := NewCompleteReadMessage(sessionID, success, bytesTransferred, clientCrc, nil)
-
-	response, err := c.SendMessage(ctx, msg)
-	if err != nil {
-		return nil, err
-	}
-
-	if response.Type == MsgError {
-		errorData, err := msgpack.Marshal(response.Data)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal engine error data: %w", err)
-		}
-		var errorResp ErrorResponse
-		if err := msgpack.Unmarshal(errorData, &errorResp); err != nil {
-			return nil, fmt.Errorf("failed to unmarshal engine error response: %w", err)
-		}
-		return nil, fmt.Errorf("engine error: %s - %s", errorResp.Code, errorResp.Message)
-	}
-
-	if response.Type != MsgCompleteReadResponse {
-		return nil, fmt.Errorf("unexpected response type: %s", response.Type)
-	}
-
-	// Convert response data to CompleteReadResponse
-	completeData, err := msgpack.Marshal(response.Data)
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal complete read data: %w", err)
-	}
-
-	var completeResp CompleteReadResponse
-	if err := msgpack.Unmarshal(completeData, &completeResp); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal complete read response: %w", err)
-	}
-
-	return &completeResp, nil
-}
diff --git a/seaweedfs-rdma-sidecar/pkg/ipc/messages.go b/seaweedfs-rdma-sidecar/pkg/ipc/messages.go
deleted file mode 100644
index 4293ac3967..0000000000
--- a/seaweedfs-rdma-sidecar/pkg/ipc/messages.go
+++ /dev/null
@@ -1,160 +0,0 @@
-// Package ipc provides communication between Go sidecar and Rust RDMA engine
-package ipc
-
-import "time"
-
-// IpcMessage represents the tagged union of all IPC messages
-// This matches the Rust enum: #[serde(tag = "type", content = "data")]
-type IpcMessage struct {
-	Type string      `msgpack:"type"`
-	Data interface{} `msgpack:"data"`
-}
-
-// Request message types
-const (
-	MsgStartRead       = "StartRead"
-	MsgCompleteRead    = "CompleteRead"
-	MsgGetCapabilities = "GetCapabilities"
-	MsgPing            = "Ping"
-)
-
-// Response message types
-const (
-	MsgStartReadResponse       = "StartReadResponse"
-	MsgCompleteReadResponse    = "CompleteReadResponse"
-	MsgGetCapabilitiesResponse = "GetCapabilitiesResponse"
-	MsgPong                    = "Pong"
-	MsgError                   = "Error"
-)
-
-// StartReadRequest corresponds to Rust StartReadRequest
-type StartReadRequest struct {
-	VolumeID    uint32  `msgpack:"volume_id"`
-	NeedleID    uint64  `msgpack:"needle_id"`
-	Cookie      uint32  `msgpack:"cookie"`
-	Offset      uint64  `msgpack:"offset"`
-	Size        uint64  `msgpack:"size"`
-	RemoteAddr  uint64  `msgpack:"remote_addr"`
-	RemoteKey   uint32  `msgpack:"remote_key"`
-	TimeoutSecs uint64  `msgpack:"timeout_secs"`
-	AuthToken   *string `msgpack:"auth_token,omitempty"`
-}
-
-// StartReadResponse corresponds to Rust StartReadResponse
-type StartReadResponse struct {
-	SessionID    string `msgpack:"session_id"`
-	LocalAddr    uint64 `msgpack:"local_addr"`
-	LocalKey     uint32 `msgpack:"local_key"`
-	TransferSize uint64 `msgpack:"transfer_size"`
-	ExpectedCrc  uint32 `msgpack:"expected_crc"`
-	ExpiresAtNs  uint64 `msgpack:"expires_at_ns"`
-}
-
-// CompleteReadRequest corresponds to Rust CompleteReadRequest
-type CompleteReadRequest struct {
-	SessionID        string  `msgpack:"session_id"`
-	Success          bool    `msgpack:"success"`
-	BytesTransferred uint64  `msgpack:"bytes_transferred"`
-	ClientCrc        *uint32 `msgpack:"client_crc,omitempty"`
-	ErrorMessage     *string `msgpack:"error_message,omitempty"`
-}
-
-// CompleteReadResponse corresponds to Rust CompleteReadResponse
-type CompleteReadResponse struct {
-	Success   bool    `msgpack:"success"`
-	ServerCrc *uint32 `msgpack:"server_crc,omitempty"`
-	Message   *string `msgpack:"message,omitempty"`
-}
-
-// GetCapabilitiesRequest corresponds to Rust GetCapabilitiesRequest
-type GetCapabilitiesRequest struct {
-	ClientID *string `msgpack:"client_id,omitempty"`
-}
-
-// GetCapabilitiesResponse corresponds to Rust GetCapabilitiesResponse
-type GetCapabilitiesResponse struct {
-	DeviceName      string   `msgpack:"device_name"`
-	VendorId        uint32   `msgpack:"vendor_id"`
-	MaxTransferSize uint64   `msgpack:"max_transfer_size"`
-	MaxSessions     usize    `msgpack:"max_sessions"`
-	ActiveSessions  usize    `msgpack:"active_sessions"`
-	PortGid         string   `msgpack:"port_gid"`
-	PortLid         uint16   `msgpack:"port_lid"`
-	SupportedAuth   []string `msgpack:"supported_auth"`
-	Version         string   `msgpack:"version"`
-	RealRdma        bool     `msgpack:"real_rdma"`
-}
-
-// usize corresponds to Rust's usize type (platform dependent, but typically uint64 on 64-bit systems)
-type usize uint64
-
-// PingRequest corresponds to Rust PingRequest
-type PingRequest struct {
-	TimestampNs uint64  `msgpack:"timestamp_ns"`
-	ClientID    *string `msgpack:"client_id,omitempty"`
-}
-
-// PongResponse corresponds to Rust PongResponse
-type PongResponse struct {
-	ClientTimestampNs uint64 `msgpack:"client_timestamp_ns"`
-	ServerTimestampNs uint64 `msgpack:"server_timestamp_ns"`
-	ServerRttNs       uint64 `msgpack:"server_rtt_ns"`
-}
-
-// ErrorResponse corresponds to Rust ErrorResponse
-type ErrorResponse struct {
-	Code    string  `msgpack:"code"`
-	Message string  `msgpack:"message"`
-	Details *string `msgpack:"details,omitempty"`
-}
-
-// Helper functions for creating messages
-func NewStartReadMessage(req *StartReadRequest) *IpcMessage {
-	return &IpcMessage{
-		Type: MsgStartRead,
-		Data: req,
-	}
-}
-
-func NewCompleteReadMessage(sessionID string, success bool, bytesTransferred uint64, clientCrc *uint32, errorMessage *string) *IpcMessage {
-	return &IpcMessage{
-		Type: MsgCompleteRead,
-		Data: &CompleteReadRequest{
-			SessionID:        sessionID,
-			Success:          success,
-			BytesTransferred: bytesTransferred,
-			ClientCrc:        clientCrc,
-			ErrorMessage:     errorMessage,
-		},
-	}
-}
-
-func NewGetCapabilitiesMessage(clientID *string) *IpcMessage {
-	return &IpcMessage{
-		Type: MsgGetCapabilities,
-		Data: &GetCapabilitiesRequest{
-			ClientID: clientID,
-		},
-	}
-}
-
-func NewPingMessage(clientID *string) *IpcMessage {
-	return &IpcMessage{
-		Type: MsgPing,
-		Data: &PingRequest{
-			TimestampNs: uint64(time.Now().UnixNano()),
-			ClientID:    clientID,
-		},
-	}
-}
-
-func NewErrorMessage(code, message string, details *string) *IpcMessage {
-	return &IpcMessage{
-		Type: MsgError,
-		Data: &ErrorResponse{
-			Code:    code,
-			Message: message,
-			Details: details,
-		},
-	}
-}
diff --git a/seaweedfs-rdma-sidecar/pkg/rdma/client.go b/seaweedfs-rdma-sidecar/pkg/rdma/client.go
deleted file mode 100644
index 08ad760421..0000000000
--- a/seaweedfs-rdma-sidecar/pkg/rdma/client.go
+++ /dev/null
@@ -1,630 +0,0 @@
-// Package rdma provides high-level RDMA operations for SeaweedFS integration
-package rdma
-
-import (
-	"context"
-	"fmt"
-	"sync"
-	"time"
-
-	"seaweedfs-rdma-sidecar/pkg/ipc"
-
-	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
-	"github.com/sirupsen/logrus"
-)
-
-// PooledConnection represents a pooled RDMA connection
-type PooledConnection struct {
-	ipcClient *ipc.Client
-	lastUsed  time.Time
-	inUse     bool
-	sessionID string
-	created   time.Time
-}
-
-// ConnectionPool manages a pool of RDMA connections
-type ConnectionPool struct {
-	connections    []*PooledConnection
-	mutex          sync.RWMutex
-	maxConnections int
-	maxIdleTime    time.Duration
-	enginePath     string
-	logger         *logrus.Logger
-}
-
-// Client provides high-level RDMA operations with connection pooling
-type Client struct {
-	pool           *ConnectionPool
-	logger         *logrus.Logger
-	enginePath     string
-	capabilities   *ipc.GetCapabilitiesResponse
-	connected      bool
-	defaultTimeout time.Duration
-
-	// Legacy single connection (for backward compatibility)
-	ipcClient *ipc.Client
-}
-
-// Config holds configuration for the RDMA client
-type Config struct {
-	EngineSocketPath string
-	DefaultTimeout   time.Duration
-	Logger           *logrus.Logger
-
-	// Connection pooling options
-	EnablePooling  bool          // Enable connection pooling (default: true)
-	MaxConnections int           // Max connections in pool (default: 10)
-	MaxIdleTime    time.Duration // Max idle time before connection cleanup (default: 5min)
-}
-
-// ReadRequest represents a SeaweedFS needle read request
-type ReadRequest struct {
-	VolumeID  uint32
-	NeedleID  uint64
-	Cookie    uint32
-	Offset    uint64
-	Size      uint64
-	AuthToken *string
-}
-
-// ReadResponse represents the result of an RDMA read operation
-type ReadResponse struct {
-	Data         []byte
-	BytesRead    uint64
-	Duration     time.Duration
-	TransferRate float64
-	SessionID    string
-	Success      bool
-	Message      string
-}
-
-// NewConnectionPool creates a new connection pool
-func NewConnectionPool(enginePath string, maxConnections int, maxIdleTime time.Duration, logger *logrus.Logger) *ConnectionPool {
-	if maxConnections <= 0 {
-		maxConnections = 10 // Default
-	}
-	if maxIdleTime <= 0 {
-		maxIdleTime = 5 * time.Minute // Default
-	}
-
-	return &ConnectionPool{
-		connections:    make([]*PooledConnection, 0, maxConnections),
-		maxConnections: maxConnections,
-		maxIdleTime:    maxIdleTime,
-		enginePath:     enginePath,
-		logger:         logger,
-	}
-}
-
-// getConnection gets an available connection from the pool or creates a new one
-func (p *ConnectionPool) getConnection(ctx context.Context) (*PooledConnection, error) {
-	p.mutex.Lock()
-	defer p.mutex.Unlock()
-
-	// Look for an available connection
-	for _, conn := range p.connections {
-		if !conn.inUse && time.Since(conn.lastUsed) < p.maxIdleTime {
-			conn.inUse = true
-			conn.lastUsed = time.Now()
-			p.logger.WithField("session_id", conn.sessionID).Debug("🔌 Reusing pooled RDMA connection")
-			return conn, nil
-		}
-	}
-
-	// Create new connection if under limit
-	if len(p.connections) < p.maxConnections {
-		ipcClient := ipc.NewClient(p.enginePath, p.logger)
-		if err := ipcClient.Connect(ctx); err != nil {
-			return nil, fmt.Errorf("failed to create new pooled connection: %w", err)
-		}
-
-		conn := &PooledConnection{
-			ipcClient: ipcClient,
-			lastUsed:  time.Now(),
-			inUse:     true,
-			sessionID: fmt.Sprintf("pool-%d-%d", len(p.connections), time.Now().Unix()),
-			created:   time.Now(),
-		}
-
-		p.connections = append(p.connections, conn)
-		p.logger.WithFields(logrus.Fields{
-			"session_id": conn.sessionID,
-			"pool_size":  len(p.connections),
-		}).Info("🚀 Created new pooled RDMA connection")
-
-		return conn, nil
-	}
-
-	// Pool is full, wait for an available connection
-	return nil, fmt.Errorf("connection pool exhausted (max: %d)", p.maxConnections)
-}
-
-// releaseConnection returns a connection to the pool
-func (p *ConnectionPool) releaseConnection(conn *PooledConnection) {
-	p.mutex.Lock()
-	defer p.mutex.Unlock()
-
-	conn.inUse = false
-	conn.lastUsed = time.Now()
-
-	p.logger.WithField("session_id", conn.sessionID).Debug("🔄 Released RDMA connection back to pool")
-}
-
-// cleanup removes idle connections from the pool
-func (p *ConnectionPool) cleanup() {
-	p.mutex.Lock()
-	defer p.mutex.Unlock()
-
-	now := time.Now()
-	activeConnections := make([]*PooledConnection, 0, len(p.connections))
-
-	for _, conn := range p.connections {
-		if conn.inUse || now.Sub(conn.lastUsed) < p.maxIdleTime {
-			activeConnections = append(activeConnections, conn)
-		} else {
-			// Close idle connection
-			conn.ipcClient.Disconnect()
-			p.logger.WithFields(logrus.Fields{
-				"session_id": conn.sessionID,
-				"idle_time":  now.Sub(conn.lastUsed),
-			}).Debug("🧹 Cleaned up idle RDMA connection")
-		}
-	}
-
-	p.connections = activeConnections
-}
-
-// Close closes all connections in the pool
-func (p *ConnectionPool) Close() {
-	p.mutex.Lock()
-	defer p.mutex.Unlock()
-
-	for _, conn := range p.connections {
-		conn.ipcClient.Disconnect()
-	}
-	p.connections = nil
-	p.logger.Info("🔌 Connection pool closed")
-}
-
-// NewClient creates a new RDMA client
-func NewClient(config *Config) *Client {
-	if config.Logger == nil {
-		config.Logger = logrus.New()
-		config.Logger.SetLevel(logrus.InfoLevel)
-	}
-
-	if config.DefaultTimeout == 0 {
-		config.DefaultTimeout = 30 * time.Second
-	}
-
-	client := &Client{
-		logger:         config.Logger,
-		enginePath:     config.EngineSocketPath,
-		defaultTimeout: config.DefaultTimeout,
-	}
-
-	// Initialize connection pooling if enabled (default: true)
-	enablePooling := config.EnablePooling
-	if config.MaxConnections == 0 && config.MaxIdleTime == 0 {
-		// Default to enabled if not explicitly configured
-		enablePooling = true
-	}
-
-	if enablePooling {
-		client.pool = NewConnectionPool(
-			config.EngineSocketPath,
-			config.MaxConnections,
-			config.MaxIdleTime,
-			config.Logger,
-		)
-
-		// Start cleanup goroutine
-		go client.startCleanupRoutine()
-
-		config.Logger.WithFields(logrus.Fields{
-			"max_connections": client.pool.maxConnections,
-			"max_idle_time":   client.pool.maxIdleTime,
-		}).Info("🔌 RDMA connection pooling enabled")
-	} else {
-		// Legacy single connection mode
-		client.ipcClient = ipc.NewClient(config.EngineSocketPath, config.Logger)
-		config.Logger.Info("🔌 RDMA single connection mode (pooling disabled)")
-	}
-
-	return client
-}
-
-// startCleanupRoutine starts a background goroutine to clean up idle connections
-func (c *Client) startCleanupRoutine() {
-	ticker := time.NewTicker(1 * time.Minute) // Cleanup every minute
-	go func() {
-		defer ticker.Stop()
-		for range ticker.C {
-			if c.pool != nil {
-				c.pool.cleanup()
-			}
-		}
-	}()
-}
-
-// Connect establishes connection to the Rust RDMA engine and queries capabilities
-func (c *Client) Connect(ctx context.Context) error {
-	c.logger.Info("🚀 Connecting to RDMA engine")
-
-	if c.pool != nil {
-		// Connection pooling mode - connections are created on-demand
-		c.connected = true
-		c.logger.Info("✅ RDMA client ready (connection pooling enabled)")
-		return nil
-	}
-
-	// Single connection mode
-	if err := c.ipcClient.Connect(ctx); err != nil {
-		return fmt.Errorf("failed to connect to IPC: %w", err)
-	}
-
-	// Test connectivity with ping
-	clientID := "rdma-client"
-	pong, err := c.ipcClient.Ping(ctx, &clientID)
-	if err != nil {
-		c.ipcClient.Disconnect()
-		return fmt.Errorf("failed to ping RDMA engine: %w", err)
-	}
-
-	latency := time.Duration(pong.ServerRttNs)
-	c.logger.WithFields(logrus.Fields{
-		"latency":    latency,
-		"server_rtt": time.Duration(pong.ServerRttNs),
-	}).Info("📡 RDMA engine ping successful")
-
-	// Get capabilities
-	caps, err := c.ipcClient.GetCapabilities(ctx, &clientID)
-	if err != nil {
-		c.ipcClient.Disconnect()
-		return fmt.Errorf("failed to get engine capabilities: %w", err)
-	}
-
-	c.capabilities = caps
-	c.connected = true
-
-	c.logger.WithFields(logrus.Fields{
-		"version":           caps.Version,
-		"device_name":       caps.DeviceName,
-		"vendor_id":         caps.VendorId,
-		"max_sessions":      caps.MaxSessions,
-		"max_transfer_size": caps.MaxTransferSize,
-		"active_sessions":   caps.ActiveSessions,
-		"real_rdma":         caps.RealRdma,
-		"port_gid":          caps.PortGid,
-		"port_lid":          caps.PortLid,
-	}).Info("✅ RDMA engine connected and ready")
-
-	return nil
-}
-
-// Disconnect closes the connection to the RDMA engine
-func (c *Client) Disconnect() {
-	if c.connected {
-		if c.pool != nil {
-			// Connection pooling mode
-			c.pool.Close()
-			c.logger.Info("🔌 Disconnected from RDMA engine (pool closed)")
-		} else {
-			// Single connection mode
-			c.ipcClient.Disconnect()
-			c.logger.Info("🔌 Disconnected from RDMA engine")
-		}
-		c.connected = false
-	}
-}
-
-// IsConnected returns true if connected to the RDMA engine
-func (c *Client) IsConnected() bool {
-	if c.pool != nil {
-		// Connection pooling mode - always connected if pool exists
-		return c.connected
-	} else {
-		// Single connection mode
-		return c.connected && c.ipcClient.IsConnected()
-	}
-}
-
-// GetCapabilities returns the RDMA engine capabilities
-func (c *Client) GetCapabilities() *ipc.GetCapabilitiesResponse {
-	return c.capabilities
-}
-
-// Read performs an RDMA read operation for a SeaweedFS needle
-func (c *Client) Read(ctx context.Context, req *ReadRequest) (*ReadResponse, error) {
-	if !c.IsConnected() {
-		return nil, fmt.Errorf("not connected to RDMA engine")
-	}
-
-	startTime := time.Now()
-
-	c.logger.WithFields(logrus.Fields{
-		"volume_id": req.VolumeID,
-		"needle_id": req.NeedleID,
-		"offset":    req.Offset,
-		"size":      req.Size,
-	}).Debug("📖 Starting RDMA read operation")
-
-	if c.pool != nil {
-		// Connection pooling mode
-		return c.readWithPool(ctx, req, startTime)
-	}
-
-	// Single connection mode
-	// Create IPC request
-	ipcReq := &ipc.StartReadRequest{
-		VolumeID:    req.VolumeID,
-		NeedleID:    req.NeedleID,
-		Cookie:      req.Cookie,
-		Offset:      req.Offset,
-		Size:        req.Size,
-		RemoteAddr:  0, // Will be set by engine (mock for now)
-		RemoteKey:   0, // Will be set by engine (mock for now)
-		TimeoutSecs: uint64(c.defaultTimeout.Seconds()),
-		AuthToken:   req.AuthToken,
-	}
-
-	// Start RDMA read
-	startResp, err := c.ipcClient.StartRead(ctx, ipcReq)
-	if err != nil {
-		c.logger.WithError(err).Error("❌ Failed to start RDMA read")
-		return nil, fmt.Errorf("failed to start RDMA read: %w", err)
-	}
-
-	// In the new protocol, if we got a StartReadResponse, the operation was successful
-
-	c.logger.WithFields(logrus.Fields{
-		"session_id":    startResp.SessionID,
-		"local_addr":    fmt.Sprintf("0x%x", startResp.LocalAddr),
-		"local_key":     startResp.LocalKey,
-		"transfer_size": startResp.TransferSize,
-		"expected_crc":  fmt.Sprintf("0x%x", startResp.ExpectedCrc),
-		"expires_at":    time.Unix(0, int64(startResp.ExpiresAtNs)).Format(time.RFC3339),
-	}).Debug("📖 RDMA read session started")
-
-	// Complete the RDMA read
-	completeResp, err := c.ipcClient.CompleteRead(ctx, startResp.SessionID, true, startResp.TransferSize, &startResp.ExpectedCrc)
-	if err != nil {
-		c.logger.WithError(err).Error("❌ Failed to complete RDMA read")
-		return nil, fmt.Errorf("failed to complete RDMA read: %w", err)
-	}
-
-	duration := time.Since(startTime)
-
-	if !completeResp.Success {
-		errorMsg := "unknown error"
-		if completeResp.Message != nil {
-			errorMsg = *completeResp.Message
-		}
-		c.logger.WithFields(logrus.Fields{
-			"session_id":    startResp.SessionID,
-			"error_message": errorMsg,
-		}).Error("❌ RDMA read completion failed")
-		return nil, fmt.Errorf("RDMA read completion failed: %s", errorMsg)
-	}
-
-	// Calculate transfer rate (bytes/second)
-	transferRate := float64(startResp.TransferSize) / duration.Seconds()
-
-	c.logger.WithFields(logrus.Fields{
-		"session_id":    startResp.SessionID,
-		"bytes_read":    startResp.TransferSize,
-		"duration":      duration,
-		"transfer_rate": transferRate,
-		"server_crc":    completeResp.ServerCrc,
-	}).Info("✅ RDMA read completed successfully")
-
-	// MOCK DATA IMPLEMENTATION - FOR DEVELOPMENT/TESTING ONLY
-	//
-	// This section generates placeholder data for the mock RDMA implementation.
-	// In a production RDMA implementation, this should be replaced with:
-	//
-	// 1. The actual data transferred via RDMA from the remote memory region
-	// 2. Data validation using checksums/CRC from the RDMA completion
-	// 3. Proper error handling for RDMA transfer failures
-	// 4. Memory region cleanup and deregistration
-	//
-	// TODO for real RDMA implementation:
-	// - Replace mockData with actual RDMA buffer contents
-	// - Validate data integrity using server CRC: completeResp.ServerCrc
-	// - Handle partial transfers and retry logic
-	// - Implement proper memory management for RDMA regions
-	//
-	// Current mock behavior: Generates a simple pattern (0,1,2...255,0,1,2...)
-	// This allows testing of the integration pipeline without real hardware
-	mockData := make([]byte, startResp.TransferSize)
-	for i := range mockData {
-		mockData[i] = byte(i % 256) // Simple repeating pattern for verification
-	}
-	// END MOCK DATA IMPLEMENTATION
-
-	return &ReadResponse{
-		Data:         mockData,
-		BytesRead:    startResp.TransferSize,
-		Duration:     duration,
-		TransferRate: transferRate,
-		SessionID:    startResp.SessionID,
-		Success:      true,
-		Message:      "RDMA read completed successfully",
-	}, nil
-}
-
-// ReadRange performs an RDMA read for a specific range within a needle
-func (c *Client) ReadRange(ctx context.Context, volumeID uint32, needleID uint64, cookie uint32, offset, size uint64) (*ReadResponse, error) {
-	req := &ReadRequest{
-		VolumeID: volumeID,
-		NeedleID: needleID,
-		Cookie:   cookie,
-		Offset:   offset,
-		Size:     size,
-	}
-	return c.Read(ctx, req)
-}
-
-// ReadFileRange performs an RDMA read using SeaweedFS file ID format
-func (c *Client) ReadFileRange(ctx context.Context, fileID string, offset, size uint64) (*ReadResponse, error) {
-	// Parse file ID (e.g., "3,01637037d6" -> volume=3, needle=0x01637037d6, cookie extracted)
-	volumeID, needleID, cookie, err := parseFileID(fileID)
-	if err != nil {
-		return nil, fmt.Errorf("invalid file ID %s: %w", fileID, err)
-	}
-
-	req := &ReadRequest{
-		VolumeID: volumeID,
-		NeedleID: needleID,
-		Cookie:   cookie,
-		Offset:   offset,
-		Size:     size,
-	}
-	return c.Read(ctx, req)
-}
-
-// parseFileID extracts volume ID, needle ID, and cookie from a SeaweedFS file ID
-// Uses existing SeaweedFS parsing logic to ensure compatibility
-func parseFileID(fileId string) (volumeID uint32, needleID uint64, cookie uint32, err error) {
-	// Use existing SeaweedFS file ID parsing
-	fid, err := needle.ParseFileIdFromString(fileId)
-	if err != nil {
-		return 0, 0, 0, fmt.Errorf("failed to parse file ID %s: %w", fileId, err)
-	}
-
-	volumeID = uint32(fid.VolumeId)
-	needleID = uint64(fid.Key)
-	cookie = uint32(fid.Cookie)
-
-	return volumeID, needleID, cookie, nil
-}
-
-// ReadFull performs an RDMA read for an entire needle
-func (c *Client) ReadFull(ctx context.Context, volumeID uint32, needleID uint64, cookie uint32) (*ReadResponse, error) {
-	req := &ReadRequest{
-		VolumeID: volumeID,
-		NeedleID: needleID,
-		Cookie:   cookie,
-		Offset:   0,
-		Size:     0, // 0 means read entire needle
-	}
-	return c.Read(ctx, req)
-}
-
-// Ping tests connectivity to the RDMA engine
-func (c *Client) Ping(ctx context.Context) (time.Duration, error) {
-	if !c.IsConnected() {
-		return 0, fmt.Errorf("not connected to RDMA engine")
-	}
-
-	clientID := "health-check"
-	start := time.Now()
-	pong, err := c.ipcClient.Ping(ctx, &clientID)
-	if err != nil {
-		return 0, err
-	}
-
-	totalLatency := time.Since(start)
-	serverRtt := time.Duration(pong.ServerRttNs)
-
-	c.logger.WithFields(logrus.Fields{
-		"total_latency": totalLatency,
-		"server_rtt":    serverRtt,
-		"client_id":     clientID,
-	}).Debug("🏓 RDMA engine ping successful")
-
-	return totalLatency, nil
-}
-
-// readWithPool performs RDMA read using connection pooling
-func (c *Client) readWithPool(ctx context.Context, req *ReadRequest, startTime time.Time) (*ReadResponse, error) {
-	// Get connection from pool
-	conn, err := c.pool.getConnection(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get pooled connection: %w", err)
-	}
-	defer c.pool.releaseConnection(conn)
-
-	c.logger.WithField("session_id", conn.sessionID).Debug("🔌 Using pooled RDMA connection")
-
-	// Create IPC request
-	ipcReq := &ipc.StartReadRequest{
-		VolumeID:    req.VolumeID,
-		NeedleID:    req.NeedleID,
-		Cookie:      req.Cookie,
-		Offset:      req.Offset,
-		Size:        req.Size,
-		RemoteAddr:  0, // Will be set by engine (mock for now)
-		RemoteKey:   0, // Will be set by engine (mock for now)
-		TimeoutSecs: uint64(c.defaultTimeout.Seconds()),
-		AuthToken:   req.AuthToken,
-	}
-
-	// Start RDMA read
-	startResp, err := conn.ipcClient.StartRead(ctx, ipcReq)
-	if err != nil {
-		c.logger.WithError(err).Error("❌ Failed to start RDMA read (pooled)")
-		return nil, fmt.Errorf("failed to start RDMA read: %w", err)
-	}
-
-	c.logger.WithFields(logrus.Fields{
-		"session_id":    startResp.SessionID,
-		"local_addr":    fmt.Sprintf("0x%x", startResp.LocalAddr),
-		"local_key":     startResp.LocalKey,
-		"transfer_size": startResp.TransferSize,
-		"expected_crc":  fmt.Sprintf("0x%x", startResp.ExpectedCrc),
-		"expires_at":    time.Unix(0, int64(startResp.ExpiresAtNs)).Format(time.RFC3339),
-		"pooled":        true,
-	}).Debug("📖 RDMA read session started (pooled)")
-
-	// Complete the RDMA read
-	completeResp, err := conn.ipcClient.CompleteRead(ctx, startResp.SessionID, true, startResp.TransferSize, &startResp.ExpectedCrc)
-	if err != nil {
-		c.logger.WithError(err).Error("❌ Failed to complete RDMA read (pooled)")
-		return nil, fmt.Errorf("failed to complete RDMA read: %w", err)
-	}
-
-	duration := time.Since(startTime)
-
-	if !completeResp.Success {
-		errorMsg := "unknown error"
-		if completeResp.Message != nil {
-			errorMsg = *completeResp.Message
-		}
-		c.logger.WithFields(logrus.Fields{
-			"session_id":    conn.sessionID,
-			"error_message": errorMsg,
-			"pooled":        true,
-		}).Error("❌ RDMA read completion failed (pooled)")
-		return nil, fmt.Errorf("RDMA read completion failed: %s", errorMsg)
-	}
-
-	// Calculate transfer rate (bytes/second)
-	transferRate := float64(startResp.TransferSize) / duration.Seconds()
-
-	c.logger.WithFields(logrus.Fields{
-		"session_id":    conn.sessionID,
-		"bytes_read":    startResp.TransferSize,
-		"duration":      duration,
-		"transfer_rate": transferRate,
-		"server_crc":    completeResp.ServerCrc,
-		"pooled":        true,
-	}).Info("✅ RDMA read completed successfully (pooled)")
-
-	// For the mock implementation, we'll return placeholder data
-	// In the real implementation, this would be the actual RDMA transferred data
-	mockData := make([]byte, startResp.TransferSize)
-	for i := range mockData {
-		mockData[i] = byte(i % 256) // Simple pattern for testing
-	}
-
-	return &ReadResponse{
-		Data:         mockData,
-		BytesRead:    startResp.TransferSize,
-		Duration:     duration,
-		TransferRate: transferRate,
-		SessionID:    conn.sessionID,
-		Success:      true,
-		Message:      "RDMA read successful (pooled)",
-	}, nil
-}
diff --git a/seaweedfs-rdma-sidecar/pkg/seaweedfs/client.go b/seaweedfs-rdma-sidecar/pkg/seaweedfs/client.go
deleted file mode 100644
index 22047e5044..0000000000
--- a/seaweedfs-rdma-sidecar/pkg/seaweedfs/client.go
+++ /dev/null
@@ -1,402 +0,0 @@
-// Package seaweedfs provides SeaweedFS-specific RDMA integration
-package seaweedfs
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"seaweedfs-rdma-sidecar/pkg/rdma"
-
-	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
-	"github.com/seaweedfs/seaweedfs/weed/storage/types"
-	"github.com/sirupsen/logrus"
-)
-
-// SeaweedFSRDMAClient provides SeaweedFS-specific RDMA operations
-type SeaweedFSRDMAClient struct {
-	rdmaClient      *rdma.Client
-	logger          *logrus.Logger
-	volumeServerURL string
-	enabled         bool
-
-	// Zero-copy optimization
-	tempDir     string
-	useZeroCopy bool
-}
-
-// Config holds configuration for the SeaweedFS RDMA client
-type Config struct {
-	RDMASocketPath  string
-	VolumeServerURL string
-	Enabled         bool
-	DefaultTimeout  time.Duration
-	Logger          *logrus.Logger
-
-	// Zero-copy optimization
-	TempDir     string // Directory for temp files (default: /tmp/rdma-cache)
-	UseZeroCopy bool   // Enable zero-copy via temp files
-
-	// Connection pooling options
-	EnablePooling  bool          // Enable RDMA connection pooling (default: true)
-	MaxConnections int           // Max connections in pool (default: 10)
-	MaxIdleTime    time.Duration // Max idle time before connection cleanup (default: 5min)
-}
-
-// NeedleReadRequest represents a SeaweedFS needle read request
-type NeedleReadRequest struct {
-	VolumeID     uint32
-	NeedleID     uint64
-	Cookie       uint32
-	Offset       uint64
-	Size         uint64
-	VolumeServer string // Override volume server URL for this request
-}
-
-// NeedleReadResponse represents the result of a needle read
-type NeedleReadResponse struct {
-	Data      []byte
-	IsRDMA    bool
-	Latency   time.Duration
-	Source    string // "rdma" or "http"
-	SessionID string
-
-	// Zero-copy optimization fields
-	TempFilePath string // Path to temp file with data (for zero-copy)
-	UseTempFile  bool   // Whether to use temp file instead of Data
-}
-
-// NewSeaweedFSRDMAClient creates a new SeaweedFS RDMA client
-func NewSeaweedFSRDMAClient(config *Config) (*SeaweedFSRDMAClient, error) {
-	if config.Logger == nil {
-		config.Logger = logrus.New()
-		config.Logger.SetLevel(logrus.InfoLevel)
-	}
-
-	var rdmaClient *rdma.Client
-	if config.Enabled && config.RDMASocketPath != "" {
-		rdmaConfig := &rdma.Config{
-			EngineSocketPath: config.RDMASocketPath,
-			DefaultTimeout:   config.DefaultTimeout,
-			Logger:           config.Logger,
-			EnablePooling:    config.EnablePooling,
-			MaxConnections:   config.MaxConnections,
-			MaxIdleTime:      config.MaxIdleTime,
-		}
-		rdmaClient = rdma.NewClient(rdmaConfig)
-	}
-
-	// Setup temp directory for zero-copy optimization
-	tempDir := config.TempDir
-	if tempDir == "" {
-		tempDir = "/tmp/rdma-cache"
-	}
-
-	if config.UseZeroCopy {
-		if err := os.MkdirAll(tempDir, 0755); err != nil {
-			config.Logger.WithError(err).Warn("Failed to create temp directory, disabling zero-copy")
-			config.UseZeroCopy = false
-		}
-	}
-
-	return &SeaweedFSRDMAClient{
-		rdmaClient:      rdmaClient,
-		logger:          config.Logger,
-		volumeServerURL: config.VolumeServerURL,
-		enabled:         config.Enabled,
-		tempDir:         tempDir,
-		useZeroCopy:     config.UseZeroCopy,
-	}, nil
-}
-
-// Start initializes the RDMA client connection
-func (c *SeaweedFSRDMAClient) Start(ctx context.Context) error {
-	if !c.enabled || c.rdmaClient == nil {
-		c.logger.Info("🔄 RDMA disabled, using HTTP fallback only")
-		return nil
-	}
-
-	c.logger.Info("🚀 Starting SeaweedFS RDMA client...")
-
-	if err := c.rdmaClient.Connect(ctx); err != nil {
-		c.logger.WithError(err).Error("❌ Failed to connect to RDMA engine")
-		return fmt.Errorf("failed to connect to RDMA engine: %w", err)
-	}
-
-	c.logger.Info("✅ SeaweedFS RDMA client started successfully")
-	return nil
-}
-
-// Stop shuts down the RDMA client
-func (c *SeaweedFSRDMAClient) Stop() {
-	if c.rdmaClient != nil {
-		c.rdmaClient.Disconnect()
-		c.logger.Info("🔌 SeaweedFS RDMA client stopped")
-	}
-}
-
-// IsEnabled returns true if RDMA is enabled and available
-func (c *SeaweedFSRDMAClient) IsEnabled() bool {
-	return c.enabled && c.rdmaClient != nil && c.rdmaClient.IsConnected()
-}
-
-// ReadNeedle reads a needle using RDMA fast path or HTTP fallback
-func (c *SeaweedFSRDMAClient) ReadNeedle(ctx context.Context, req *NeedleReadRequest) (*NeedleReadResponse, error) {
-	start := time.Now()
-	var rdmaErr error
-
-	// Try RDMA fast path first
-	if c.IsEnabled() {
-		c.logger.WithFields(logrus.Fields{
-			"volume_id": req.VolumeID,
-			"needle_id": req.NeedleID,
-			"offset":    req.Offset,
-			"size":      req.Size,
-		}).Debug("🚀 Attempting RDMA fast path")
-
-		rdmaReq := &rdma.ReadRequest{
-			VolumeID: req.VolumeID,
-			NeedleID: req.NeedleID,
-			Cookie:   req.Cookie,
-			Offset:   req.Offset,
-			Size:     req.Size,
-		}
-
-		resp, err := c.rdmaClient.Read(ctx, rdmaReq)
-		if err != nil {
-			c.logger.WithError(err).Warn("⚠️  RDMA read failed, falling back to HTTP")
-			rdmaErr = err
-		} else {
-			c.logger.WithFields(logrus.Fields{
-				"volume_id":     req.VolumeID,
-				"needle_id":     req.NeedleID,
-				"bytes_read":    resp.BytesRead,
-				"transfer_rate": resp.TransferRate,
-				"latency":       time.Since(start),
-			}).Info("🚀 RDMA fast path successful")
-
-			// Try zero-copy optimization if enabled and data is large enough
-			if c.useZeroCopy && len(resp.Data) > 64*1024 { // 64KB threshold
-				tempFilePath, err := c.writeToTempFile(req, resp.Data)
-				if err != nil {
-					c.logger.WithError(err).Warn("Failed to write temp file, using regular response")
-					// Fall back to regular response
-				} else {
-					c.logger.WithFields(logrus.Fields{
-						"temp_file": tempFilePath,
-						"size":      len(resp.Data),
-					}).Info("🔥 Zero-copy temp file created")
-
-					return &NeedleReadResponse{
-						Data:         nil, // Don't duplicate data in memory
-						IsRDMA:       true,
-						Latency:      time.Since(start),
-						Source:       "rdma-zerocopy",
-						SessionID:    resp.SessionID,
-						TempFilePath: tempFilePath,
-						UseTempFile:  true,
-					}, nil
-				}
-			}
-
-			return &NeedleReadResponse{
-				Data:      resp.Data,
-				IsRDMA:    true,
-				Latency:   time.Since(start),
-				Source:    "rdma",
-				SessionID: resp.SessionID,
-			}, nil
-		}
-	}
-
-	// Fallback to HTTP
-	c.logger.WithFields(logrus.Fields{
-		"volume_id": req.VolumeID,
-		"needle_id": req.NeedleID,
-		"reason":    "rdma_unavailable",
-	}).Debug("🌐 Using HTTP fallback")
-
-	data, err := c.httpFallback(ctx, req)
-	if err != nil {
-		if rdmaErr != nil {
-			return nil, fmt.Errorf("both RDMA and HTTP fallback failed: RDMA=%v, HTTP=%v", rdmaErr, err)
-		}
-		return nil, fmt.Errorf("HTTP fallback failed: %w", err)
-	}
-
-	return &NeedleReadResponse{
-		Data:    data,
-		IsRDMA:  false,
-		Latency: time.Since(start),
-		Source:  "http",
-	}, nil
-}
-
-// ReadNeedleRange reads a specific range from a needle
-func (c *SeaweedFSRDMAClient) ReadNeedleRange(ctx context.Context, volumeID uint32, needleID uint64, cookie uint32, offset, size uint64) (*NeedleReadResponse, error) {
-	req := &NeedleReadRequest{
-		VolumeID: volumeID,
-		NeedleID: needleID,
-		Cookie:   cookie,
-		Offset:   offset,
-		Size:     size,
-	}
-	return c.ReadNeedle(ctx, req)
-}
-
-// httpFallback performs HTTP fallback read from SeaweedFS volume server
-func (c *SeaweedFSRDMAClient) httpFallback(ctx context.Context, req *NeedleReadRequest) ([]byte, error) {
-	// Use volume server from request, fallback to configured URL
-	volumeServerURL := req.VolumeServer
-	if volumeServerURL == "" {
-		volumeServerURL = c.volumeServerURL
-	}
-
-	if volumeServerURL == "" {
-		return nil, fmt.Errorf("no volume server URL provided in request or configured")
-	}
-
-	// Build URL using existing SeaweedFS file ID construction
-	volumeId := needle.VolumeId(req.VolumeID)
-	needleId := types.NeedleId(req.NeedleID)
-	cookie := types.Cookie(req.Cookie)
-
-	fileId := &needle.FileId{
-		VolumeId: volumeId,
-		Key:      needleId,
-		Cookie:   cookie,
-	}
-
-	url := fmt.Sprintf("%s/%s", volumeServerURL, fileId.String())
-
-	if req.Offset > 0 || req.Size > 0 {
-		url += fmt.Sprintf("?offset=%d&size=%d", req.Offset, req.Size)
-	}
-
-	c.logger.WithField("url", url).Debug("📥 HTTP fallback request")
-
-	httpReq, err := http.NewRequestWithContext(ctx, "GET", url, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create HTTP request: %w", err)
-	}
-
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(httpReq)
-	if err != nil {
-		return nil, fmt.Errorf("HTTP request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return nil, fmt.Errorf("HTTP request failed with status: %d", resp.StatusCode)
-	}
-
-	// Read response data - io.ReadAll handles context cancellation and timeouts correctly
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read HTTP response body: %w", err)
-	}
-
-	c.logger.WithFields(logrus.Fields{
-		"volume_id": req.VolumeID,
-		"needle_id": req.NeedleID,
-		"data_size": len(data),
-	}).Debug("📥 HTTP fallback successful")
-
-	return data, nil
-}
-
-// HealthCheck verifies that the RDMA client is healthy
-func (c *SeaweedFSRDMAClient) HealthCheck(ctx context.Context) error {
-	if !c.enabled {
-		return fmt.Errorf("RDMA is disabled")
-	}
-
-	if c.rdmaClient == nil {
-		return fmt.Errorf("RDMA client not initialized")
-	}
-
-	if !c.rdmaClient.IsConnected() {
-		return fmt.Errorf("RDMA client not connected")
-	}
-
-	// Try a ping to the RDMA engine
-	_, err := c.rdmaClient.Ping(ctx)
-	return err
-}
-
-// GetStats returns statistics about the RDMA client
-func (c *SeaweedFSRDMAClient) GetStats() map[string]interface{} {
-	stats := map[string]interface{}{
-		"enabled":           c.enabled,
-		"volume_server_url": c.volumeServerURL,
-		"rdma_socket_path":  "",
-	}
-
-	if c.rdmaClient != nil {
-		stats["connected"] = c.rdmaClient.IsConnected()
-		// Note: Capabilities method may not be available, skip for now
-	} else {
-		stats["connected"] = false
-		stats["error"] = "RDMA client not initialized"
-	}
-
-	return stats
-}
-
-// writeToTempFile writes RDMA data to a temp file for zero-copy optimization
-func (c *SeaweedFSRDMAClient) writeToTempFile(req *NeedleReadRequest, data []byte) (string, error) {
-	// Create temp file with unique name based on needle info
-	fileName := fmt.Sprintf("vol%d_needle%x_cookie%d_offset%d_size%d.tmp",
-		req.VolumeID, req.NeedleID, req.Cookie, req.Offset, req.Size)
-	tempFilePath := filepath.Join(c.tempDir, fileName)
-
-	// Write data to temp file (this populates the page cache)
-	err := os.WriteFile(tempFilePath, data, 0644)
-	if err != nil {
-		return "", fmt.Errorf("failed to write temp file: %w", err)
-	}
-
-	c.logger.WithFields(logrus.Fields{
-		"temp_file": tempFilePath,
-		"size":      len(data),
-	}).Debug("📁 Temp file written to page cache")
-
-	return tempFilePath, nil
-}
-
-// CleanupTempFile removes a temp file (called by mount client after use)
-func (c *SeaweedFSRDMAClient) CleanupTempFile(tempFilePath string) error {
-	if tempFilePath == "" {
-		return nil
-	}
-
-	// Validate that tempFilePath is within c.tempDir
-	absTempDir, err := filepath.Abs(c.tempDir)
-	if err != nil {
-		return fmt.Errorf("failed to resolve temp dir: %w", err)
-	}
-	absFilePath, err := filepath.Abs(tempFilePath)
-	if err != nil {
-		return fmt.Errorf("failed to resolve temp file path: %w", err)
-	}
-	// Ensure absFilePath is within absTempDir
-	if !strings.HasPrefix(absFilePath, absTempDir+string(os.PathSeparator)) && absFilePath != absTempDir {
-		c.logger.WithField("temp_file", tempFilePath).Warn("Attempted cleanup of file outside temp dir")
-		return fmt.Errorf("invalid temp file path")
-	}
-
-	err = os.Remove(absFilePath)
-	if err != nil && !os.IsNotExist(err) {
-		c.logger.WithError(err).WithField("temp_file", absFilePath).Warn("Failed to cleanup temp file")
-		return err
-	}
-
-	c.logger.WithField("temp_file", absFilePath).Debug("🧹 Temp file cleaned up")
-	return nil
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/Cargo.lock b/seaweedfs-rdma-sidecar/rdma-engine/Cargo.lock
deleted file mode 100644
index 6c2b851974..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/Cargo.lock
+++ /dev/null
@@ -1,1934 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "addr2line"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
-
-[[package]]
-name = "ahash"
-version = "0.7.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891477e0c6a8957309ee5c45a6368af3ae14bb510732d2684ffa19af310920f9"
-dependencies = [
- "getrandom 0.2.16",
- "once_cell",
- "version_check",
-]
-
-[[package]]
-name = "aho-corasick"
-version = "1.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "anes"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
-
-[[package]]
-name = "anstream"
-version = "0.6.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae563653d1938f79b1ab1b5e668c87c76a9930414574a6583a7b7e11a8e6192"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd"
-
-[[package]]
-name = "anstyle-parse"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
-dependencies = [
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.99"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
-
-[[package]]
-name = "async-trait"
-version = "0.1.89"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
-
-[[package]]
-name = "backtrace"
-version = "0.3.75"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "base64"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
-
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "bit-set"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
-dependencies = [
- "bit-vec",
-]
-
-[[package]]
-name = "bit-vec"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "bitflags"
-version = "2.9.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a65b545ab31d687cff52899d4890855fec459eb6afe0da6417b8a18da87aa29"
-
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
-[[package]]
-name = "bumpalo"
-version = "3.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c5e41b57b8bba42a04676d81cb89e9ee8e859a1a66f80a5a72e1cb76b34d43"
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
-[[package]]
-name = "bytes"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
-
-[[package]]
-name = "cast"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
-
-[[package]]
-name = "cc"
-version = "1.2.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ee0f8803222ba5a7e2777dd72ca451868909b1ac410621b676adf07280e9b5f"
-dependencies = [
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268"
-
-[[package]]
-name = "chrono"
-version = "0.4.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c469d952047f47f91b68d1cba3f10d63c11d73e4636f24f08daf0278abf01c4d"
-dependencies = [
- "android-tzdata",
- "iana-time-zone",
- "js-sys",
- "num-traits",
- "serde",
- "wasm-bindgen",
- "windows-link",
-]
-
-[[package]]
-name = "ciborium"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"
-dependencies = [
- "ciborium-io",
- "ciborium-ll",
- "serde",
-]
-
-[[package]]
-name = "ciborium-io"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"
-
-[[package]]
-name = "ciborium-ll"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"
-dependencies = [
- "ciborium-io",
- "half",
-]
-
-[[package]]
-name = "clap"
-version = "4.5.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fc0e74a703892159f5ae7d3aac52c8e6c392f5ae5f359c70b5881d60aaac318"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.5.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3e7f4214277f3c7aa526a59dd3fbe306a370daee1f8b7b8c987069cd8e888a8"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.5.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14cb31bb0a7d536caef2639baa7fad459e15c3144efefa6dbd1c84562c4739f6"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "clap_lex"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675"
-
-[[package]]
-name = "colorchoice"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
-
-[[package]]
-name = "config"
-version = "0.13.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23738e11972c7643e4ec947840fc463b6a571afcd3e735bdfce7d03c7a784aca"
-dependencies = [
- "async-trait",
- "json5",
- "lazy_static",
- "nom",
- "pathdiff",
- "ron",
- "rust-ini",
- "serde",
- "serde_json",
- "toml",
- "yaml-rust",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "criterion"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"
-dependencies = [
- "anes",
- "cast",
- "ciborium",
- "clap",
- "criterion-plot",
- "is-terminal",
- "itertools",
- "num-traits",
- "once_cell",
- "oorandom",
- "plotters",
- "rayon",
- "regex",
- "serde",
- "serde_derive",
- "serde_json",
- "tinytemplate",
- "walkdir",
-]
-
-[[package]]
-name = "criterion-plot"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
-dependencies = [
- "cast",
- "itertools",
-]
-
-[[package]]
-name = "crossbeam-deque"
-version = "0.8.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
-dependencies = [
- "crossbeam-epoch",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-epoch"
-version = "0.9.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
-dependencies = [
- "crossbeam-utils",
-]
-
-[[package]]
-name = "crossbeam-utils"
-version = "0.8.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
-
-[[package]]
-name = "crunchy"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
-
-[[package]]
-name = "crypto-common"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer",
- "crypto-common",
-]
-
-[[package]]
-name = "dlv-list"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0688c2a7f92e427f44895cd63841bff7b29f8d7a1648b9e7e07a4a365b2e1257"
-
-[[package]]
-name = "either"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-
-[[package]]
-name = "errno"
-version = "0.3.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "778e2ac28f6c47af28e4907f13ffd1e1ddbd400980a9abd7c8df189bf578a5ad"
-dependencies = [
- "libc",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "fastrand"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
-
-[[package]]
-name = "fnv"
-version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
-
-[[package]]
-name = "futures-core"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
-
-[[package]]
-name = "futures-sink"
-version = "0.3.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
-
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
-]
-
-[[package]]
-name = "getrandom"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
-dependencies = [
- "cfg-if",
- "libc",
- "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
-]
-
-[[package]]
-name = "gimli"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-
-[[package]]
-name = "half"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "459196ed295495a68f7d7fe1d84f6c4b7ff0e21fe3017b2f283c6fac3ad803c9"
-dependencies = [
- "cfg-if",
- "crunchy",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-dependencies = [
- "ahash",
-]
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "hermit-abi"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.63"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0c919e5debc312ad217002b8048a17b7d83f80703865bbfcfebb0458b0b27d8"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "log",
- "wasm-bindgen",
- "windows-core",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "io-uring"
-version = "0.7.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d93587f37623a1a17d94ef2bc9ada592f5465fe7732084ab7beefabe5c77c0c4"
-dependencies = [
- "bitflags 2.9.2",
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "is-terminal"
-version = "0.4.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e04d7f318608d35d4b61ddd75cbdaee86b023ebe2bd5a66ee0915f0bf93095a9"
-dependencies = [
- "hermit-abi",
- "libc",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
-
-[[package]]
-name = "itertools"
-version = "0.10.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
-dependencies = [
- "either",
-]
-
-[[package]]
-name = "itoa"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
-
-[[package]]
-name = "js-sys"
-version = "0.3.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
-dependencies = [
- "once_cell",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "json5"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
-dependencies = [
- "pest",
- "pest_derive",
- "serde",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-
-[[package]]
-name = "libc"
-version = "0.2.175"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
-
-[[package]]
-name = "libloading"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
-dependencies = [
- "cfg-if",
- "windows-targets 0.53.3",
-]
-
-[[package]]
-name = "linked-hash-map"
-version = "0.5.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
-
-[[package]]
-name = "linux-raw-sys"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
-
-[[package]]
-name = "lock_api"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96936507f153605bddfcda068dd804796c84324ed2510809e5b2a624c81da765"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "log"
-version = "0.4.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
-
-[[package]]
-name = "matchers"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
-dependencies = [
- "regex-automata",
-]
-
-[[package]]
-name = "memchr"
-version = "2.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
-
-[[package]]
-name = "memmap2"
-version = "0.9.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "483758ad303d734cec05e5c12b41d7e93e6a6390c5e9dae6bdeb7c1259012d28"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "minimal-lexical"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
-
-[[package]]
-name = "miniz_oxide"
-version = "0.8.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
-dependencies = [
- "adler2",
-]
-
-[[package]]
-name = "mio"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
-dependencies = [
- "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "nix"
-version = "0.27.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
-dependencies = [
- "bitflags 2.9.2",
- "cfg-if",
- "libc",
-]
-
-[[package]]
-name = "nom"
-version = "7.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
-dependencies = [
- "memchr",
- "minimal-lexical",
-]
-
-[[package]]
-name = "nu-ansi-term"
-version = "0.50.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4a28e057d01f97e61255210fcff094d74ed0466038633e95017f5beb68e4399"
-dependencies = [
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "object"
-version = "0.36.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
-
-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad"
-
-[[package]]
-name = "oorandom"
-version = "11.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e"
-
-[[package]]
-name = "ordered-multimap"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccd746e37177e1711c20dd619a1620f34f5c8b569c53590a72dedd5344d8924a"
-dependencies = [
- "dlv-list",
- "hashbrown",
-]
-
-[[package]]
-name = "parking_lot"
-version = "0.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70d58bf43669b5795d1576d0641cfb6fbb2057bf629506267a92807158584a13"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc838d2a56b5b1a6c25f55575dfc605fabb63bb2365f6c2353ef9159aa69e4a5"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
-
-[[package]]
-name = "pathdiff"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
-
-[[package]]
-name = "pest"
-version = "2.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1db05f56d34358a8b1066f67cbb203ee3e7ed2ba674a6263a1d5ec6db2204323"
-dependencies = [
- "memchr",
- "thiserror 2.0.15",
- "ucd-trie",
-]
-
-[[package]]
-name = "pest_derive"
-version = "2.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb056d9e8ea77922845ec74a1c4e8fb17e7c218cc4fc11a15c5d25e189aa40bc"
-dependencies = [
- "pest",
- "pest_generator",
-]
-
-[[package]]
-name = "pest_generator"
-version = "2.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87e404e638f781eb3202dc82db6760c8ae8a1eeef7fb3fa8264b2ef280504966"
-dependencies = [
- "pest",
- "pest_meta",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "pest_meta"
-version = "2.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edd1101f170f5903fde0914f899bb503d9ff5271d7ba76bbb70bea63690cc0d5"
-dependencies = [
- "pest",
- "sha2",
-]
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "plotters"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747"
-dependencies = [
- "num-traits",
- "plotters-backend",
- "plotters-svg",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "plotters-backend"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a"
-
-[[package]]
-name = "plotters-svg"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670"
-dependencies = [
- "plotters-backend",
-]
-
-[[package]]
-name = "ppv-lite86"
-version = "0.2.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
-dependencies = [
- "zerocopy",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "802989b9fe1b674bc996ac7bed7b3012090a9b4cbfa0fe157ee3ea97e93e4ccd"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "proptest"
-version = "1.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fcdab19deb5195a31cf7726a210015ff1496ba1464fd42cb4f537b8b01b471f"
-dependencies = [
- "bit-set",
- "bit-vec",
- "bitflags 2.9.2",
- "lazy_static",
- "num-traits",
- "rand",
- "rand_chacha",
- "rand_xorshift",
- "regex-syntax",
- "rusty-fork",
- "tempfile",
- "unarray",
-]
-
-[[package]]
-name = "quick-error"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
-
-[[package]]
-name = "quote"
-version = "1.0.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "r-efi"
-version = "5.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
-
-[[package]]
-name = "rand"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
-dependencies = [
- "rand_chacha",
- "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
-dependencies = [
- "ppv-lite86",
- "rand_core",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
-dependencies = [
- "getrandom 0.3.3",
-]
-
-[[package]]
-name = "rand_xorshift"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
-dependencies = [
- "rand_core",
-]
-
-[[package]]
-name = "rayon"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f"
-dependencies = [
- "either",
- "rayon-core",
-]
-
-[[package]]
-name = "rayon-core"
-version = "1.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
-dependencies = [
- "crossbeam-deque",
- "crossbeam-utils",
-]
-
-[[package]]
-name = "rdma-engine"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "async-trait",
- "bincode",
- "bytes",
- "chrono",
- "clap",
- "config",
- "criterion",
- "libc",
- "libloading",
- "memmap2",
- "nix",
- "parking_lot",
- "proptest",
- "rmp-serde",
- "serde",
- "tempfile",
- "thiserror 1.0.69",
- "tokio",
- "tokio-util",
- "tracing",
- "tracing-subscriber",
- "uuid",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5407465600fb0548f1442edf71dd20683c6ed326200ace4b1ef0763521bb3b77"
-dependencies = [
- "bitflags 2.9.2",
-]
-
-[[package]]
-name = "regex"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
-
-[[package]]
-name = "rmp"
-version = "0.8.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "228ed7c16fa39782c3b3468e974aec2795e9089153cd08ee2e9aefb3613334c4"
-dependencies = [
- "byteorder",
- "num-traits",
- "paste",
-]
-
-[[package]]
-name = "rmp-serde"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52e599a477cf9840e92f2cde9a7189e67b42c57532749bf90aea6ec10facd4db"
-dependencies = [
- "byteorder",
- "rmp",
- "serde",
-]
-
-[[package]]
-name = "ron"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88073939a61e5b7680558e6be56b419e208420c2adb92be54921fa6b72283f1a"
-dependencies = [
- "base64",
- "bitflags 1.3.2",
- "serde",
-]
-
-[[package]]
-name = "rust-ini"
-version = "0.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6d5f2436026b4f6e79dc829837d467cc7e9a55ee40e750d716713540715a2df"
-dependencies = [
- "cfg-if",
- "ordered-multimap",
-]
-
-[[package]]
-name = "rustc-demangle"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
-
-[[package]]
-name = "rustix"
-version = "1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11181fbabf243db407ef8df94a6ce0b2f9a733bd8be4ad02b4eda9602296cac8"
-dependencies = [
- "bitflags 2.9.2",
- "errno",
- "libc",
- "linux-raw-sys",
- "windows-sys 0.60.2",
-]
-
-[[package]]
-name = "rustversion"
-version = "1.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
-
-[[package]]
-name = "rusty-fork"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
-dependencies = [
- "fnv",
- "quick-error",
- "tempfile",
- "wait-timeout",
-]
-
-[[package]]
-name = "ryu"
-version = "1.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
-
-[[package]]
-name = "same-file"
-version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "serde"
-version = "1.0.219"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.219"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.142"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "030fedb782600dcbd6f02d479bf0d817ac3bb40d644745b769d6a96bc3afc5a7"
-dependencies = [
- "itoa",
- "memchr",
- "ryu",
- "serde",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
-[[package]]
-name = "sharded-slab"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
-dependencies = [
- "lazy_static",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "signal-hook-registry"
-version = "1.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "slab"
-version = "0.4.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
-
-[[package]]
-name = "smallvec"
-version = "1.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
-
-[[package]]
-name = "socket2"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
-dependencies = [
- "libc",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "syn"
-version = "2.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ede7c438028d4436d71104916910f5bb611972c5cfd7f89b8300a8186e6fada6"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "tempfile"
-version = "3.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
-dependencies = [
- "fastrand",
- "getrandom 0.3.3",
- "once_cell",
- "rustix",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "80d76d3f064b981389ecb4b6b7f45a0bf9fdac1d5b9204c7bd6714fecc302850"
-dependencies = [
- "thiserror-impl 2.0.15",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "2.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44d29feb33e986b6ea906bd9c3559a856983f92371b3eaa5e83782a351623de0"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "thread_local"
-version = "1.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "tinytemplate"
-version = "1.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
-dependencies = [
- "serde",
- "serde_json",
-]
-
-[[package]]
-name = "tokio"
-version = "1.47.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
-dependencies = [
- "backtrace",
- "bytes",
- "io-uring",
- "libc",
- "mio",
- "parking_lot",
- "pin-project-lite",
- "signal-hook-registry",
- "slab",
- "socket2",
- "tokio-macros",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "tokio-macros"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tokio-util"
-version = "0.7.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14307c986784f72ef81c89db7d9e28d6ac26d16213b109ea501696195e6e3ce5"
-dependencies = [
- "bytes",
- "futures-core",
- "futures-sink",
- "pin-project-lite",
- "tokio",
-]
-
-[[package]]
-name = "toml"
-version = "0.5.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
-dependencies = [
- "serde",
-]
-
-[[package]]
-name = "tracing"
-version = "0.1.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
-dependencies = [
- "pin-project-lite",
- "tracing-attributes",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-attributes"
-version = "0.1.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.34"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
-dependencies = [
- "once_cell",
- "valuable",
-]
-
-[[package]]
-name = "tracing-log"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
-dependencies = [
- "log",
- "once_cell",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-subscriber"
-version = "0.3.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
-dependencies = [
- "matchers",
- "nu-ansi-term",
- "once_cell",
- "regex-automata",
- "sharded-slab",
- "smallvec",
- "thread_local",
- "tracing",
- "tracing-core",
- "tracing-log",
-]
-
-[[package]]
-name = "typenum"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
-
-[[package]]
-name = "ucd-trie"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
-
-[[package]]
-name = "unarray"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
-
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
-[[package]]
-name = "uuid"
-version = "1.18.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f33196643e165781c20a5ead5582283a7dacbb87855d867fbc2df3f81eddc1be"
-dependencies = [
- "getrandom 0.3.3",
- "js-sys",
- "serde",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "valuable"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
-
-[[package]]
-name = "version_check"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
-
-[[package]]
-name = "wait-timeout"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "walkdir"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
-dependencies = [
- "same-file",
- "winapi-util",
-]
-
-[[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
-
-[[package]]
-name = "wasi"
-version = "0.14.2+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
-dependencies = [
- "wit-bindgen-rt",
-]
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
-dependencies = [
- "cfg-if",
- "once_cell",
- "rustversion",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "web-sys"
-version = "0.3.77"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "winapi-util"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
-dependencies = [
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0fdd3ddb90610c7638aa2b3a3ab2904fb9e5cdbecc643ddb3647212781c4ae3"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a47fddd13af08290e67f4acabf4b459f647552718f683a7b415d290ac744a836"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd9211b69f8dcdfa817bfd14bf1c97c9188afa36f4750130fcdf3f400eca9fa8"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e6ad25900d524eaabdbbb96d20b4311e1e7ae1699af4fb28c17ae66c80d798a"
-
-[[package]]
-name = "windows-result"
-version = "0.3.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56f42bd332cc6c8eac5af113fc0c1fd6a8fd2aa08a0119358686e5160d0586c6"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56e6c93f3a0c3b36176cb1327a4958a0353d5d166c2a35cb268ace15e91d3b57"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets 0.52.6",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.3",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc 0.52.6",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.53.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe6031c4041849d7c496a8ded650796e7b6ecc19df1a431c1a363342e5dc91"
-dependencies = [
- "windows-link",
- "windows_aarch64_gnullvm 0.53.0",
- "windows_aarch64_msvc 0.53.0",
- "windows_i686_gnu 0.53.0",
- "windows_i686_gnullvm 0.53.0",
- "windows_i686_msvc 0.53.0",
- "windows_x86_64_gnu 0.53.0",
- "windows_x86_64_gnullvm 0.53.0",
- "windows_x86_64_msvc 0.53.0",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b8d5f90ddd19cb4a147a5fa63ca848db3df085e25fee3cc10b39b6eebae764"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7651a1f62a11b8cbd5e0d42526e55f2c99886c77e007179efff86c2b137e66c"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1dc67659d35f387f5f6c479dc4e28f1d4bb90ddd1a5d3da2e5d97b42d6272c3"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ce6ccbdedbf6d6354471319e781c0dfef054c81fbc7cf83f338a4296c0cae11"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "581fee95406bb13382d2f65cd4a908ca7b1e4c2f1917f143ba16efe98a589b5d"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e55b5ac9ea33f2fc1716d1742db15574fd6fc8dadc51caab1c16a3d3b4190ba"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e035dd0599267ce1ee132e51c27dd29437f63325753051e71dd9e42406c57"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.53.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "271414315aff87387382ec3d271b52d7ae78726f5d44ac98b4f4030c91880486"
-
-[[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags 2.9.2",
-]
-
-[[package]]
-name = "yaml-rust"
-version = "0.4.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
-dependencies = [
- "linked-hash-map",
-]
-
-[[package]]
-name = "zerocopy"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1039dd0d3c310cf05de012d8a39ff557cb0d23087fd44cad61df08fc31907a2f"
-dependencies = [
- "zerocopy-derive",
-]
-
-[[package]]
-name = "zerocopy-derive"
-version = "0.8.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ecf5b4cc5364572d7f4c329661bcc82724222973f2cab6f050a4e5c22f75181"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/Cargo.toml b/seaweedfs-rdma-sidecar/rdma-engine/Cargo.toml
deleted file mode 100644
index 5b355fffcf..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/Cargo.toml
+++ /dev/null
@@ -1,74 +0,0 @@
-[package]
-name = "rdma-engine"
-version = "0.1.0"
-edition = "2021"
-authors = ["SeaweedFS Team <dev@seaweedfs.com>"]
-description = "High-performance RDMA engine for SeaweedFS sidecar"
-license = "Apache-2.0"
-
-[[bin]]
-name = "rdma-engine-server"
-path = "src/main.rs"
-
-[lib]
-name = "rdma_engine"
-path = "src/lib.rs"
-
-[dependencies]
-# UCX (Unified Communication X) for high-performance networking
-# Much better than direct libibverbs - provides unified API across transports
-libc = "0.2"
-libloading = "0.8"  # Dynamic loading of UCX libraries
-
-# Async runtime and networking
-tokio = { version = "1.0", features = ["full"] }
-tokio-util = "0.7"
-
-# Serialization for IPC
-serde = { version = "1.0", features = ["derive"] }
-bincode = "1.3"
-rmp-serde = "1.1"  # MessagePack for efficient IPC
-
-# Error handling and logging
-anyhow = "1.0"
-thiserror = "1.0"
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter"] }
-
-# UUID and time handling
-uuid = { version = "1.0", features = ["v4", "serde"] }
-chrono = { version = "0.4", features = ["serde"] }
-
-# Memory management and utilities
-memmap2 = "0.9"
-bytes = "1.11"
-parking_lot = "0.12"  # Fast mutexes
-
-# IPC and networking
-nix = { version = "0.27", features = ["mman"] }  # Unix domain sockets and system calls
-async-trait = "0.1"  # Async traits
-
-# Configuration
-clap = { version = "4.0", features = ["derive"] }
-config = "0.13"
-
-[dev-dependencies]
-proptest = "1.0"
-criterion = "0.5"
-tempfile = "3.0"
-
-[features]
-default = ["mock-ucx"]
-mock-ucx = []
-real-ucx = []  # UCX integration for production RDMA
-
-[profile.release]
-opt-level = 3
-lto = true
-codegen-units = 1
-panic = "abort"
-
-
-
-[package.metadata.docs.rs]
-features = ["real-rdma"]
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/README.md b/seaweedfs-rdma-sidecar/rdma-engine/README.md
deleted file mode 100644
index 1c7d575ae6..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/README.md
+++ /dev/null
@@ -1,88 +0,0 @@
-# UCX-based RDMA Engine for SeaweedFS
-
-High-performance Rust-based communication engine for SeaweedFS using [UCX (Unified Communication X)](https://github.com/openucx/ucx) framework that provides optimized data transfers across multiple transports including RDMA (InfiniBand/RoCE), TCP, and shared memory.
-
-## 🚀 **Complete Rust RDMA Sidecar Scaffolded!**
-
-I've successfully created a comprehensive Rust RDMA engine with the following components:
-
-### ✅ **What's Implemented**
-
-1. **Complete Project Structure**:
-   - `src/lib.rs` - Main library with engine management
-   - `src/main.rs` - Binary entry point with CLI 
-   - `src/error.rs` - Comprehensive error types
-   - `src/rdma.rs` - RDMA operations (mock & real)
-   - `src/ipc.rs` - IPC communication with Go sidecar
-   - `src/session.rs` - Session management
-   - `src/memory.rs` - Memory management and pooling
-
-2. **Advanced Features**:
-   - Mock RDMA implementation for development
-   - Real RDMA stubs ready for `libibverbs` integration
-   - High-performance memory management with pooling
-   - HugePage support for large allocations
-   - Thread-safe session management with expiration
-   - MessagePack-based IPC protocol
-   - Comprehensive error handling and recovery
-   - Performance monitoring and statistics
-
-3. **Production-Ready Architecture**:
-   - Async/await throughout for high concurrency
-   - Zero-copy memory operations where possible
-   - Proper resource cleanup and garbage collection
-   - Signal handling for graceful shutdown
-   - Configurable via CLI flags and config files
-   - Extensive logging and metrics
-
-### 🛠️ **Current Status**
-
-The scaffolding is **functionally complete** but has some compilation errors that need to be resolved:
-
-1. **Async Trait Object Issues** - Rust doesn't support async methods in trait objects
-2. **Stream Ownership** - BufReader/BufWriter ownership needs fixing
-3. **Memory Management** - Some lifetime and cloning issues
-
-### 🔧 **Next Steps to Complete**
-
-1. **Fix Compilation Errors** (1-2 hours):
-   - Replace trait objects with enums for RDMA context
-   - Fix async trait issues with concrete types
-   - Resolve memory ownership issues
-
-2. **Integration with Go Sidecar** (2-4 hours):
-   - Update Go sidecar to communicate with Rust engine
-   - Implement Unix domain socket protocol
-   - Add fallback when Rust engine is unavailable
-
-3. **RDMA Hardware Integration** (1-2 weeks):
-   - Add `libibverbs` FFI bindings
-   - Implement real RDMA operations
-   - Test on actual InfiniBand hardware
-
-### 📊 **Architecture Overview**
-
-```
-┌─────────────────────┐    IPC     ┌─────────────────────┐
-│   Go Control Plane  │◄─────────►│  Rust Data Plane    │
-│                     │  ~300ns    │                     │
-│ • gRPC Server       │            │ • RDMA Operations   │
-│ • Session Mgmt      │            │ • Memory Mgmt       │
-│ • HTTP Fallback     │            │ • Hardware Access   │
-│ • Error Handling    │            │ • Zero-Copy I/O     │
-└─────────────────────┘            └─────────────────────┘
-```
-
-### 🎯 **Performance Expectations**
-
-- **Mock RDMA**: ~150ns per operation (current)
-- **Real RDMA**: ~50ns per operation (projected)
-- **Memory Operations**: Zero-copy with hugepage support
-- **Session Throughput**: 1M+ sessions/second
-- **IPC Overhead**: ~300ns (Unix domain sockets)
-
-## 🚀 **Ready for Hardware Integration**
-
-This Rust RDMA engine provides a **solid foundation** for high-performance RDMA acceleration. The architecture is sound, the error handling is comprehensive, and the memory management is optimized for RDMA workloads.
-
-**Next milestone**: Fix compilation errors and integrate with the existing Go sidecar for end-to-end testing! 🎯
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/error.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/error.rs
deleted file mode 100644
index be60ef4aae..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/error.rs
+++ /dev/null
@@ -1,269 +0,0 @@
-//! Error types and handling for the RDMA engine
-
-// use std::fmt;  // Unused for now
-use thiserror::Error;
-
-/// Result type alias for RDMA operations
-pub type RdmaResult<T> = Result<T, RdmaError>;
-
-/// Comprehensive error types for RDMA operations
-#[derive(Error, Debug)]
-pub enum RdmaError {
-    /// RDMA device not found or unavailable
-    #[error("RDMA device '{device}' not found or unavailable")]
-    DeviceNotFound { device: String },
-    
-    /// Failed to initialize RDMA context
-    #[error("Failed to initialize RDMA context: {reason}")]
-    ContextInitFailed { reason: String },
-    
-    /// Failed to allocate protection domain
-    #[error("Failed to allocate protection domain: {reason}")]
-    PdAllocFailed { reason: String },
-    
-    /// Failed to create completion queue
-    #[error("Failed to create completion queue: {reason}")]
-    CqCreationFailed { reason: String },
-    
-    /// Failed to create queue pair
-    #[error("Failed to create queue pair: {reason}")]
-    QpCreationFailed { reason: String },
-    
-    /// Memory registration failed
-    #[error("Memory registration failed: {reason}")]
-    MemoryRegFailed { reason: String },
-    
-    /// RDMA operation failed
-    #[error("RDMA operation failed: {operation}, status: {status}")]
-    OperationFailed { operation: String, status: i32 },
-    
-    /// Session not found
-    #[error("Session '{session_id}' not found")]
-    SessionNotFound { session_id: String },
-    
-    /// Session expired
-    #[error("Session '{session_id}' has expired")]
-    SessionExpired { session_id: String },
-    
-    /// Too many active sessions
-    #[error("Maximum number of sessions ({max_sessions}) exceeded")]
-    TooManySessions { max_sessions: usize },
-    
-    /// IPC communication error
-    #[error("IPC communication error: {reason}")]
-    IpcError { reason: String },
-    
-    /// Serialization/deserialization error
-    #[error("Serialization error: {reason}")]
-    SerializationError { reason: String },
-    
-    /// Invalid request parameters
-    #[error("Invalid request: {reason}")]
-    InvalidRequest { reason: String },
-    
-    /// Insufficient buffer space
-    #[error("Insufficient buffer space: requested {requested}, available {available}")]
-    InsufficientBuffer { requested: usize, available: usize },
-    
-    /// Hardware not supported
-    #[error("Hardware not supported: {reason}")]
-    UnsupportedHardware { reason: String },
-    
-    /// System resource exhausted
-    #[error("System resource exhausted: {resource}")]
-    ResourceExhausted { resource: String },
-    
-    /// Permission denied
-    #[error("Permission denied: {operation}")]
-    PermissionDenied { operation: String },
-    
-    /// Network timeout
-    #[error("Network timeout after {timeout_ms}ms")]
-    NetworkTimeout { timeout_ms: u64 },
-    
-    /// I/O error
-    #[error("I/O error: {0}")]
-    Io(#[from] std::io::Error),
-    
-    /// Generic error for unexpected conditions
-    #[error("Internal error: {reason}")]
-    Internal { reason: String },
-}
-
-impl RdmaError {
-    /// Create a new DeviceNotFound error
-    pub fn device_not_found(device: impl Into<String>) -> Self {
-        Self::DeviceNotFound { device: device.into() }
-    }
-    
-    /// Create a new ContextInitFailed error
-    pub fn context_init_failed(reason: impl Into<String>) -> Self {
-        Self::ContextInitFailed { reason: reason.into() }
-    }
-    
-    /// Create a new MemoryRegFailed error
-    pub fn memory_reg_failed(reason: impl Into<String>) -> Self {
-        Self::MemoryRegFailed { reason: reason.into() }
-    }
-    
-    /// Create a new OperationFailed error
-    pub fn operation_failed(operation: impl Into<String>, status: i32) -> Self {
-        Self::OperationFailed { 
-            operation: operation.into(), 
-            status 
-        }
-    }
-    
-    /// Create a new SessionNotFound error
-    pub fn session_not_found(session_id: impl Into<String>) -> Self {
-        Self::SessionNotFound { session_id: session_id.into() }
-    }
-    
-    /// Create a new IpcError
-    pub fn ipc_error(reason: impl Into<String>) -> Self {
-        Self::IpcError { reason: reason.into() }
-    }
-    
-    /// Create a new InvalidRequest error
-    pub fn invalid_request(reason: impl Into<String>) -> Self {
-        Self::InvalidRequest { reason: reason.into() }
-    }
-    
-    /// Create a new Internal error
-    pub fn internal(reason: impl Into<String>) -> Self {
-        Self::Internal { reason: reason.into() }
-    }
-    
-    /// Check if this error is recoverable
-    pub fn is_recoverable(&self) -> bool {
-        match self {
-            // Network and temporary errors are recoverable
-            Self::NetworkTimeout { .. } |
-            Self::ResourceExhausted { .. } |
-            Self::TooManySessions { .. } |
-            Self::InsufficientBuffer { .. } => true,
-            
-            // Session errors are recoverable (can retry with new session)
-            Self::SessionNotFound { .. } |
-            Self::SessionExpired { .. } => true,
-            
-            // Hardware and system errors are generally not recoverable
-            Self::DeviceNotFound { .. } |
-            Self::ContextInitFailed { .. } |
-            Self::UnsupportedHardware { .. } |
-            Self::PermissionDenied { .. } => false,
-            
-            // IPC errors might be recoverable
-            Self::IpcError { .. } |
-            Self::SerializationError { .. } => true,
-            
-            // Invalid requests are not recoverable without fixing the request
-            Self::InvalidRequest { .. } => false,
-            
-            // RDMA operation failures might be recoverable
-            Self::OperationFailed { .. } => true,
-            
-            // Memory and resource allocation failures depend on the cause
-            Self::PdAllocFailed { .. } |
-            Self::CqCreationFailed { .. } |
-            Self::QpCreationFailed { .. } |
-            Self::MemoryRegFailed { .. } => false,
-            
-            // I/O errors might be recoverable
-            Self::Io(_) => true,
-            
-            // Internal errors are generally not recoverable
-            Self::Internal { .. } => false,
-        }
-    }
-    
-    /// Get error category for metrics and logging
-    pub fn category(&self) -> &'static str {
-        match self {
-            Self::DeviceNotFound { .. } |
-            Self::ContextInitFailed { .. } |
-            Self::UnsupportedHardware { .. } => "hardware",
-            
-            Self::PdAllocFailed { .. } |
-            Self::CqCreationFailed { .. } |
-            Self::QpCreationFailed { .. } |
-            Self::MemoryRegFailed { .. } => "resource",
-            
-            Self::OperationFailed { .. } => "rdma",
-            
-            Self::SessionNotFound { .. } |
-            Self::SessionExpired { .. } |
-            Self::TooManySessions { .. } => "session",
-            
-            Self::IpcError { .. } |
-            Self::SerializationError { .. } => "ipc",
-            
-            Self::InvalidRequest { .. } => "request",
-            
-            Self::InsufficientBuffer { .. } |
-            Self::ResourceExhausted { .. } => "capacity",
-            
-            Self::PermissionDenied { .. } => "security",
-            
-            Self::NetworkTimeout { .. } => "network",
-            
-            Self::Io(_) => "io",
-            
-            Self::Internal { .. } => "internal",
-        }
-    }
-}
-
-/// Convert from various RDMA library error codes
-impl From<i32> for RdmaError {
-    fn from(errno: i32) -> Self {
-        match errno {
-            libc::ENODEV => Self::DeviceNotFound { 
-                device: "unknown".to_string() 
-            },
-            libc::ENOMEM => Self::ResourceExhausted { 
-                resource: "memory".to_string() 
-            },
-            libc::EPERM | libc::EACCES => Self::PermissionDenied { 
-                operation: "RDMA operation".to_string() 
-            },
-            libc::ETIMEDOUT => Self::NetworkTimeout { 
-                timeout_ms: 5000 
-            },
-            libc::ENOSPC => Self::InsufficientBuffer { 
-                requested: 0, 
-                available: 0 
-            },
-            _ => Self::Internal { 
-                reason: format!("System error: {}", errno) 
-            },
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[test]
-    fn test_error_creation() {
-        let err = RdmaError::device_not_found("mlx5_0");
-        assert!(matches!(err, RdmaError::DeviceNotFound { .. }));
-        assert_eq!(err.category(), "hardware");
-        assert!(!err.is_recoverable());
-    }
-    
-    #[test]
-    fn test_error_recoverability() {
-        assert!(RdmaError::NetworkTimeout { timeout_ms: 1000 }.is_recoverable());
-        assert!(!RdmaError::DeviceNotFound { device: "test".to_string() }.is_recoverable());
-        assert!(RdmaError::SessionExpired { session_id: "test".to_string() }.is_recoverable());
-    }
-    
-    #[test]
-    fn test_error_display() {
-        let err = RdmaError::InvalidRequest { reason: "missing field".to_string() };
-        assert!(err.to_string().contains("Invalid request"));
-        assert!(err.to_string().contains("missing field"));
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/ipc.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/ipc.rs
deleted file mode 100644
index a578c2d7d1..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/ipc.rs
+++ /dev/null
@@ -1,542 +0,0 @@
-//! IPC (Inter-Process Communication) module for communicating with Go sidecar
-//!
-//! This module handles high-performance IPC between the Rust RDMA engine and 
-//! the Go control plane sidecar using Unix domain sockets and MessagePack serialization.
-
-use crate::{RdmaError, RdmaResult, rdma::RdmaContext, session::SessionManager};
-use serde::{Deserialize, Serialize};
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
-use tokio::net::{UnixListener, UnixStream};
-use tokio::io::{AsyncReadExt, AsyncWriteExt, BufReader, BufWriter};
-use tracing::{info, debug, error};
-use uuid::Uuid;
-use std::path::Path;
-
-/// Atomic counter for generating unique work request IDs
-/// This ensures no hash collisions that could cause incorrect completion handling
-static NEXT_WR_ID: AtomicU64 = AtomicU64::new(1);
-
-/// IPC message types between Go sidecar and Rust RDMA engine
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(tag = "type", content = "data")]
-pub enum IpcMessage {
-    /// Request to start an RDMA read operation
-    StartRead(StartReadRequest),
-    /// Response with RDMA session information
-    StartReadResponse(StartReadResponse),
-    
-    /// Request to complete an RDMA operation
-    CompleteRead(CompleteReadRequest),
-    /// Response confirming completion
-    CompleteReadResponse(CompleteReadResponse),
-    
-    /// Request for engine capabilities
-    GetCapabilities(GetCapabilitiesRequest),
-    /// Response with engine capabilities
-    GetCapabilitiesResponse(GetCapabilitiesResponse),
-    
-    /// Health check ping
-    Ping(PingRequest),
-    /// Ping response
-    Pong(PongResponse),
-    
-    /// Error response
-    Error(ErrorResponse),
-}
-
-/// Request to start RDMA read operation
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct StartReadRequest {
-    /// Volume ID in SeaweedFS
-    pub volume_id: u32,
-    /// Needle ID in SeaweedFS
-    pub needle_id: u64,
-    /// Needle cookie for validation
-    pub cookie: u32,
-    /// File offset within the needle data
-    pub offset: u64,
-    /// Size to read (0 = entire needle)
-    pub size: u64,
-    /// Remote memory address from Go sidecar
-    pub remote_addr: u64,
-    /// Remote key for RDMA access
-    pub remote_key: u32,
-    /// Session timeout in seconds
-    pub timeout_secs: u64,
-    /// Authentication token (optional)
-    pub auth_token: Option<String>,
-}
-
-/// Response with RDMA session details
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct StartReadResponse {
-    /// Unique session identifier
-    pub session_id: String,
-    /// Local buffer address for RDMA
-    pub local_addr: u64,
-    /// Local key for RDMA operations
-    pub local_key: u32,
-    /// Actual size that will be transferred
-    pub transfer_size: u64,
-    /// Expected CRC checksum
-    pub expected_crc: u32,
-    /// Session expiration timestamp (Unix nanoseconds)
-    pub expires_at_ns: u64,
-}
-
-/// Request to complete RDMA operation
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct CompleteReadRequest {
-    /// Session ID to complete
-    pub session_id: String,
-    /// Whether the operation was successful
-    pub success: bool,
-    /// Actual bytes transferred
-    pub bytes_transferred: u64,
-    /// Client-computed CRC (for verification)
-    pub client_crc: Option<u32>,
-    /// Error message if failed
-    pub error_message: Option<String>,
-}
-
-/// Response confirming completion
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct CompleteReadResponse {
-    /// Whether completion was successful
-    pub success: bool,
-    /// Server-computed CRC for verification
-    pub server_crc: Option<u32>,
-    /// Any cleanup messages
-    pub message: Option<String>,
-}
-
-/// Request for engine capabilities
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct GetCapabilitiesRequest {
-    /// Client identifier
-    pub client_id: Option<String>,
-}
-
-/// Response with engine capabilities
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct GetCapabilitiesResponse {
-    /// RDMA device name
-    pub device_name: String,
-    /// RDMA device vendor ID
-    pub vendor_id: u32,
-    /// Maximum transfer size in bytes
-    pub max_transfer_size: u64,
-    /// Maximum concurrent sessions
-    pub max_sessions: usize,
-    /// Current active sessions
-    pub active_sessions: usize,
-    /// Device port GID
-    pub port_gid: String,
-    /// Device port LID
-    pub port_lid: u16,
-    /// Supported authentication methods
-    pub supported_auth: Vec<String>,
-    /// Engine version
-    pub version: String,
-    /// Whether real RDMA hardware is available
-    pub real_rdma: bool,
-}
-
-/// Health check ping request
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct PingRequest {
-    /// Client timestamp (Unix nanoseconds)
-    pub timestamp_ns: u64,
-    /// Client identifier
-    pub client_id: Option<String>,
-}
-
-/// Ping response
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct PongResponse {
-    /// Original client timestamp
-    pub client_timestamp_ns: u64,
-    /// Server timestamp (Unix nanoseconds)
-    pub server_timestamp_ns: u64,
-    /// Round-trip time in nanoseconds (server perspective)
-    pub server_rtt_ns: u64,
-}
-
-/// Error response
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ErrorResponse {
-    /// Error code
-    pub code: String,
-    /// Human-readable error message
-    pub message: String,
-    /// Error category
-    pub category: String,
-    /// Whether the error is recoverable
-    pub recoverable: bool,
-}
-
-impl From<&RdmaError> for ErrorResponse {
-    fn from(error: &RdmaError) -> Self {
-        Self {
-            code: format!("{:?}", error),
-            message: error.to_string(),
-            category: error.category().to_string(),
-            recoverable: error.is_recoverable(),
-        }
-    }
-}
-
-/// IPC server handling communication with Go sidecar
-pub struct IpcServer {
-    socket_path: String,
-    listener: Option<UnixListener>,
-    rdma_context: Arc<RdmaContext>,
-    session_manager: Arc<SessionManager>,
-    shutdown_flag: Arc<parking_lot::RwLock<bool>>,
-}
-
-impl IpcServer {
-    /// Create new IPC server
-    pub async fn new(
-        socket_path: &str,
-        rdma_context: Arc<RdmaContext>,
-        session_manager: Arc<SessionManager>,
-    ) -> RdmaResult<Self> {
-        // Remove existing socket if it exists
-        if Path::new(socket_path).exists() {
-            std::fs::remove_file(socket_path)
-                .map_err(|e| RdmaError::ipc_error(format!("Failed to remove existing socket: {}", e)))?;
-        }
-        
-        Ok(Self {
-            socket_path: socket_path.to_string(),
-            listener: None,
-            rdma_context,
-            session_manager,
-            shutdown_flag: Arc::new(parking_lot::RwLock::new(false)),
-        })
-    }
-    
-    /// Start the IPC server
-    pub async fn run(&mut self) -> RdmaResult<()> {
-        let listener = UnixListener::bind(&self.socket_path)
-            .map_err(|e| RdmaError::ipc_error(format!("Failed to bind Unix socket: {}", e)))?;
-        
-        info!("🎯 IPC server listening on: {}", self.socket_path);
-        self.listener = Some(listener);
-        
-        if let Some(ref listener) = self.listener {
-            loop {
-                // Check shutdown flag
-                if *self.shutdown_flag.read() {
-                    info!("IPC server shutting down");
-                    break;
-                }
-                
-                // Accept connection with timeout
-                let accept_result = tokio::time::timeout(
-                    tokio::time::Duration::from_millis(100),
-                    listener.accept()
-                ).await;
-                
-                match accept_result {
-                    Ok(Ok((stream, addr))) => {
-                        debug!("New IPC connection from: {:?}", addr);
-                        
-                        // Spawn handler for this connection
-                        let rdma_context = self.rdma_context.clone();
-                        let session_manager = self.session_manager.clone();
-                        let shutdown_flag = self.shutdown_flag.clone();
-                        
-                        tokio::spawn(async move {
-                            if let Err(e) = Self::handle_connection(stream, rdma_context, session_manager, shutdown_flag).await {
-                                error!("IPC connection error: {}", e);
-                            }
-                        });
-                    }
-                    Ok(Err(e)) => {
-                        error!("Failed to accept IPC connection: {}", e);
-                        tokio::time::sleep(tokio::time::Duration::from_millis(100)).await;
-                    }
-                    Err(_) => {
-                        // Timeout - continue loop to check shutdown flag
-                        continue;
-                    }
-                }
-            }
-        }
-        
-        Ok(())
-    }
-    
-    /// Handle a single IPC connection
-    async fn handle_connection(
-        stream: UnixStream,
-        rdma_context: Arc<RdmaContext>,
-        session_manager: Arc<SessionManager>,
-        shutdown_flag: Arc<parking_lot::RwLock<bool>>,
-    ) -> RdmaResult<()> {
-        let (reader_half, writer_half) = stream.into_split();
-        let mut reader = BufReader::new(reader_half);
-        let mut writer = BufWriter::new(writer_half);
-        
-        let mut buffer = Vec::with_capacity(4096);
-        
-        loop {
-            // Check shutdown
-            if *shutdown_flag.read() {
-                break;
-            }
-            
-            // Read message length (4 bytes)
-            let mut len_bytes = [0u8; 4];
-            match tokio::time::timeout(
-                tokio::time::Duration::from_millis(100),
-                reader.read_exact(&mut len_bytes)
-            ).await {
-                Ok(Ok(_)) => {},
-                Ok(Err(e)) if e.kind() == std::io::ErrorKind::UnexpectedEof => {
-                    debug!("IPC connection closed by peer");
-                    break;
-                }
-                Ok(Err(e)) => return Err(RdmaError::ipc_error(format!("Read error: {}", e))),
-                Err(_) => continue, // Timeout, check shutdown flag
-            }
-            
-            let msg_len = u32::from_le_bytes(len_bytes) as usize;
-            if msg_len > 1024 * 1024 { // 1MB max message size
-                return Err(RdmaError::ipc_error("Message too large"));
-            }
-            
-            // Read message data
-            buffer.clear();
-            buffer.resize(msg_len, 0);
-            reader.read_exact(&mut buffer).await
-                .map_err(|e| RdmaError::ipc_error(format!("Failed to read message: {}", e)))?;
-            
-            // Deserialize message
-            let request: IpcMessage = rmp_serde::from_slice(&buffer)
-                .map_err(|e| RdmaError::SerializationError { reason: e.to_string() })?;
-            
-            debug!("Received IPC message: {:?}", request);
-            
-            // Process message
-            let response = Self::process_message(
-                request,
-                &rdma_context,
-                &session_manager,
-            ).await;
-            
-            // Serialize response
-            let response_data = rmp_serde::to_vec(&response)
-                .map_err(|e| RdmaError::SerializationError { reason: e.to_string() })?;
-            
-            // Send response
-            let response_len = (response_data.len() as u32).to_le_bytes();
-            writer.write_all(&response_len).await
-                .map_err(|e| RdmaError::ipc_error(format!("Failed to write response length: {}", e)))?;
-            writer.write_all(&response_data).await
-                .map_err(|e| RdmaError::ipc_error(format!("Failed to write response: {}", e)))?;
-            writer.flush().await
-                .map_err(|e| RdmaError::ipc_error(format!("Failed to flush response: {}", e)))?;
-            
-            debug!("Sent IPC response");
-        }
-        
-        Ok(())
-    }
-    
-    /// Process IPC message and generate response
-    async fn process_message(
-        message: IpcMessage,
-        rdma_context: &Arc<RdmaContext>,
-        session_manager: &Arc<SessionManager>,
-    ) -> IpcMessage {
-        match message {
-            IpcMessage::Ping(req) => {
-                let server_timestamp = chrono::Utc::now().timestamp_nanos_opt().unwrap_or(0) as u64;
-                IpcMessage::Pong(PongResponse {
-                    client_timestamp_ns: req.timestamp_ns,
-                    server_timestamp_ns: server_timestamp,
-                    server_rtt_ns: server_timestamp.saturating_sub(req.timestamp_ns),
-                })
-            }
-            
-            IpcMessage::GetCapabilities(_req) => {
-                let device_info = rdma_context.device_info();
-                let active_sessions = session_manager.active_session_count().await;
-                
-                IpcMessage::GetCapabilitiesResponse(GetCapabilitiesResponse {
-                    device_name: device_info.name.clone(),
-                    vendor_id: device_info.vendor_id,
-                    max_transfer_size: device_info.max_mr_size,
-                    max_sessions: session_manager.max_sessions(),
-                    active_sessions,
-                    port_gid: device_info.port_gid.clone(),
-                    port_lid: device_info.port_lid,
-                    supported_auth: vec!["none".to_string()],
-                    version: env!("CARGO_PKG_VERSION").to_string(),
-                    real_rdma: cfg!(feature = "real-ucx"),
-                })
-            }
-            
-            IpcMessage::StartRead(req) => {
-                match Self::handle_start_read(req, rdma_context, session_manager).await {
-                    Ok(response) => IpcMessage::StartReadResponse(response),
-                    Err(error) => IpcMessage::Error(ErrorResponse::from(&error)),
-                }
-            }
-            
-            IpcMessage::CompleteRead(req) => {
-                match Self::handle_complete_read(req, session_manager).await {
-                    Ok(response) => IpcMessage::CompleteReadResponse(response),
-                    Err(error) => IpcMessage::Error(ErrorResponse::from(&error)),
-                }
-            }
-            
-            _ => IpcMessage::Error(ErrorResponse {
-                code: "UNSUPPORTED_MESSAGE".to_string(),
-                message: "Unsupported message type".to_string(),
-                category: "request".to_string(),
-                recoverable: true,
-            }),
-        }
-    }
-    
-    /// Handle StartRead request
-    async fn handle_start_read(
-        req: StartReadRequest,
-        rdma_context: &Arc<RdmaContext>,
-        session_manager: &Arc<SessionManager>,
-    ) -> RdmaResult<StartReadResponse> {
-        info!("🚀 Starting RDMA read: volume={}, needle={}, size={}", 
-              req.volume_id, req.needle_id, req.size);
-        
-        // Create session
-        let session_id = Uuid::new_v4().to_string();
-        let transfer_size = if req.size == 0 { 65536 } else { req.size }; // Default 64KB
-        
-        // Allocate local buffer
-        let buffer = vec![0u8; transfer_size as usize];
-        let local_addr = buffer.as_ptr() as u64;
-        
-        // Register memory for RDMA
-        let memory_region = rdma_context.register_memory(local_addr, transfer_size as usize).await?;
-        
-        // Create and store session
-        session_manager.create_session(
-            session_id.clone(),
-            req.volume_id,
-            req.needle_id,
-            req.remote_addr,
-            req.remote_key,
-            transfer_size,
-            buffer,
-            memory_region.clone(),
-            chrono::Duration::seconds(req.timeout_secs as i64),
-        ).await?;
-        
-        // Perform RDMA read with unique work request ID
-        // Use atomic counter to avoid hash collisions that could cause incorrect completion handling
-        let wr_id = NEXT_WR_ID.fetch_add(1, Ordering::Relaxed);
-        rdma_context.post_read(
-            local_addr,
-            req.remote_addr,
-            req.remote_key,
-            transfer_size as usize,
-            wr_id,
-        ).await?;
-        
-        // Poll for completion
-        let completions = rdma_context.poll_completion(1).await?;
-        if completions.is_empty() {
-            return Err(RdmaError::operation_failed("RDMA read", -1));
-        }
-        
-        let completion = &completions[0];
-        if completion.status != crate::rdma::CompletionStatus::Success {
-            return Err(RdmaError::operation_failed("RDMA read", completion.status as i32));
-        }
-        
-        info!("✅ RDMA read completed: {} bytes", completion.byte_len);
-        
-        let expires_at = chrono::Utc::now() + chrono::Duration::seconds(req.timeout_secs as i64);
-        
-        Ok(StartReadResponse {
-            session_id,
-            local_addr,
-            local_key: memory_region.lkey,
-            transfer_size,
-            expected_crc: 0x12345678, // Mock CRC
-            expires_at_ns: expires_at.timestamp_nanos_opt().unwrap_or(0) as u64,
-        })
-    }
-    
-    /// Handle CompleteRead request
-    async fn handle_complete_read(
-        req: CompleteReadRequest,
-        session_manager: &Arc<SessionManager>,
-    ) -> RdmaResult<CompleteReadResponse> {
-        info!("🏁 Completing RDMA read session: {}", req.session_id);
-        
-        // Clean up session
-        session_manager.remove_session(&req.session_id).await?;
-        
-        Ok(CompleteReadResponse {
-            success: req.success,
-            server_crc: Some(0x12345678), // Mock CRC
-            message: Some("Session completed successfully".to_string()),
-        })
-    }
-    
-    /// Shutdown the IPC server
-    pub async fn shutdown(&mut self) -> RdmaResult<()> {
-        info!("Shutting down IPC server");
-        *self.shutdown_flag.write() = true;
-        
-        // Remove socket file
-        if Path::new(&self.socket_path).exists() {
-            std::fs::remove_file(&self.socket_path)
-                .map_err(|e| RdmaError::ipc_error(format!("Failed to remove socket file: {}", e)))?;
-        }
-        
-        Ok(())
-    }
-}
-
-
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[test]
-    fn test_error_response_conversion() {
-        let error = RdmaError::device_not_found("mlx5_0");
-        let response = ErrorResponse::from(&error);
-        
-        assert!(response.message.contains("mlx5_0"));
-        assert_eq!(response.category, "hardware");
-        assert!(!response.recoverable);
-    }
-    
-    #[test]
-    fn test_message_serialization() {
-        let request = IpcMessage::Ping(PingRequest {
-            timestamp_ns: 12345,
-            client_id: Some("test".to_string()),
-        });
-        
-        let serialized = rmp_serde::to_vec(&request).unwrap();
-        let deserialized: IpcMessage = rmp_serde::from_slice(&serialized).unwrap();
-        
-        match deserialized {
-            IpcMessage::Ping(ping) => {
-                assert_eq!(ping.timestamp_ns, 12345);
-                assert_eq!(ping.client_id, Some("test".to_string()));
-            }
-            _ => panic!("Wrong message type"),
-        }
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/lib.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/lib.rs
deleted file mode 100644
index c92dcf91ae..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/lib.rs
+++ /dev/null
@@ -1,153 +0,0 @@
-//! High-Performance RDMA Engine for SeaweedFS
-//! 
-//! This crate provides a high-performance RDMA (Remote Direct Memory Access) engine
-//! designed to accelerate data transfer operations in SeaweedFS. It communicates with
-//! the Go-based sidecar via IPC and handles the performance-critical RDMA operations.
-//!
-//! # Architecture
-//!
-//! ```text
-//! ┌─────────────────────┐    IPC     ┌─────────────────────┐
-//! │   Go Control Plane  │◄─────────►│  Rust Data Plane    │
-//! │                     │  ~300ns    │                     │
-//! │ • gRPC Server       │            │ • RDMA Operations   │
-//! │ • Session Mgmt      │            │ • Memory Mgmt       │
-//! │ • HTTP Fallback     │            │ • Hardware Access   │
-//! │ • Error Handling    │            │ • Zero-Copy I/O     │
-//! └─────────────────────┘            └─────────────────────┘
-//! ```
-//!
-//! # Features
-//!
-//! - `mock-rdma` (default): Mock RDMA operations for testing and development
-//! - `real-rdma`: Real RDMA hardware integration using rdma-core bindings
-
-use std::sync::Arc;
-use anyhow::Result;
-
-pub mod ucx;
-pub mod rdma;
-pub mod ipc;
-pub mod session;
-pub mod memory;
-pub mod error;
-
-pub use error::{RdmaError, RdmaResult};
-
-/// Configuration for the RDMA engine
-#[derive(Debug, Clone)]
-pub struct RdmaEngineConfig {
-    /// RDMA device name (e.g., "mlx5_0")
-    pub device_name: String,
-    /// RDMA port number  
-    pub port: u16,
-    /// Maximum number of concurrent sessions
-    pub max_sessions: usize,
-    /// Session timeout in seconds
-    pub session_timeout_secs: u64,
-    /// Memory buffer size in bytes
-    pub buffer_size: usize,
-    /// IPC socket path
-    pub ipc_socket_path: String,
-    /// Enable debug logging
-    pub debug: bool,
-}
-
-impl Default for RdmaEngineConfig {
-    fn default() -> Self {
-        Self {
-            device_name: "mlx5_0".to_string(),
-            port: 18515,
-            max_sessions: 1000,
-            session_timeout_secs: 300, // 5 minutes
-            buffer_size: 1024 * 1024 * 1024, // 1GB
-            ipc_socket_path: "/tmp/rdma-engine.sock".to_string(),
-            debug: false,
-        }
-    }
-}
-
-/// Main RDMA engine instance
-pub struct RdmaEngine {
-    config: RdmaEngineConfig,
-    rdma_context: Arc<rdma::RdmaContext>,
-    session_manager: Arc<session::SessionManager>,
-    ipc_server: Option<ipc::IpcServer>,
-}
-
-impl RdmaEngine {
-    /// Create a new RDMA engine with the given configuration
-    pub async fn new(config: RdmaEngineConfig) -> Result<Self> {
-        tracing::info!("Initializing RDMA engine with config: {:?}", config);
-        
-        // Initialize RDMA context
-        let rdma_context = Arc::new(rdma::RdmaContext::new(&config).await?);
-        
-        // Initialize session manager
-        let session_manager = Arc::new(session::SessionManager::new(
-            config.max_sessions,
-            std::time::Duration::from_secs(config.session_timeout_secs),
-        ));
-        
-        Ok(Self {
-            config,
-            rdma_context,
-            session_manager,
-            ipc_server: None,
-        })
-    }
-    
-    /// Start the RDMA engine server
-    pub async fn run(&mut self) -> Result<()> {
-        tracing::info!("Starting RDMA engine server on {}", self.config.ipc_socket_path);
-        
-        // Start IPC server
-        let ipc_server = ipc::IpcServer::new(
-            &self.config.ipc_socket_path,
-            self.rdma_context.clone(),
-            self.session_manager.clone(),
-        ).await?;
-        
-        self.ipc_server = Some(ipc_server);
-        
-        // Start session cleanup task
-        let session_manager = self.session_manager.clone();
-        tokio::spawn(async move {
-            session_manager.start_cleanup_task().await;
-        });
-        
-        // Run IPC server
-        if let Some(ref mut server) = self.ipc_server {
-            server.run().await?;
-        }
-        
-        Ok(())
-    }
-    
-    /// Shutdown the RDMA engine
-    pub async fn shutdown(&mut self) -> Result<()> {
-        tracing::info!("Shutting down RDMA engine");
-        
-        if let Some(ref mut server) = self.ipc_server {
-            server.shutdown().await?;
-        }
-        
-        self.session_manager.shutdown().await;
-        
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[tokio::test]
-    async fn test_rdma_engine_creation() {
-        let config = RdmaEngineConfig::default();
-        let result = RdmaEngine::new(config).await;
-        
-        // Should succeed with mock RDMA
-        assert!(result.is_ok());
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/main.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/main.rs
deleted file mode 100644
index 996d3a9d56..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/main.rs
+++ /dev/null
@@ -1,175 +0,0 @@
-//! RDMA Engine Server
-//!
-//! High-performance RDMA engine server that communicates with the Go sidecar
-//! via IPC and handles RDMA operations with zero-copy semantics.
-//!
-//! Usage:
-//! ```bash
-//! rdma-engine-server --device mlx5_0 --port 18515 --ipc-socket /tmp/rdma-engine.sock
-//! ```
-
-use clap::Parser;
-use rdma_engine::{RdmaEngine, RdmaEngineConfig};
-use std::path::PathBuf;
-use tracing::{info, error};
-use tracing_subscriber::{EnvFilter, fmt::layer, prelude::*};
-
-#[derive(Parser)]
-#[command(
-    name = "rdma-engine-server",
-    about = "High-performance RDMA engine for SeaweedFS",
-    version = env!("CARGO_PKG_VERSION")
-)]
-struct Args {
-    /// UCX device name preference (e.g., mlx5_0, or 'auto' for UCX auto-selection)
-    #[arg(short, long, default_value = "auto")]
-    device: String,
-    
-    /// RDMA port number
-    #[arg(short, long, default_value_t = 18515)]
-    port: u16,
-    
-    /// Maximum number of concurrent sessions
-    #[arg(long, default_value_t = 1000)]
-    max_sessions: usize,
-    
-    /// Session timeout in seconds
-    #[arg(long, default_value_t = 300)]
-    session_timeout: u64,
-    
-    /// Memory buffer size in bytes
-    #[arg(long, default_value_t = 1024 * 1024 * 1024)]
-    buffer_size: usize,
-    
-    /// IPC socket path
-    #[arg(long, default_value = "/tmp/rdma-engine.sock")]
-    ipc_socket: PathBuf,
-    
-    /// Enable debug logging
-    #[arg(long)]
-    debug: bool,
-    
-    /// Configuration file path
-    #[arg(short, long)]
-    config: Option<PathBuf>,
-}
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let args = Args::parse();
-    
-    // Initialize tracing
-    let filter = if args.debug {
-        EnvFilter::try_from_default_env()
-            .or_else(|_| EnvFilter::try_new("debug"))
-            .unwrap()
-    } else {
-        EnvFilter::try_from_default_env()
-            .or_else(|_| EnvFilter::try_new("info"))
-            .unwrap()
-    };
-    
-    tracing_subscriber::registry()
-        .with(layer().with_target(false))
-        .with(filter)
-        .init();
-    
-    info!("🚀 Starting SeaweedFS UCX RDMA Engine Server");
-    info!("   Version: {}", env!("CARGO_PKG_VERSION"));
-    info!("   UCX Device Preference: {}", args.device);
-    info!("   Port: {}", args.port);
-    info!("   Max Sessions: {}", args.max_sessions);
-    info!("   Buffer Size: {} bytes", args.buffer_size);
-    info!("   IPC Socket: {}", args.ipc_socket.display());
-    info!("   Debug Mode: {}", args.debug);
-    
-    // Load configuration
-    let config = RdmaEngineConfig {
-        device_name: args.device,
-        port: args.port,
-        max_sessions: args.max_sessions,
-        session_timeout_secs: args.session_timeout,
-        buffer_size: args.buffer_size,
-        ipc_socket_path: args.ipc_socket.to_string_lossy().to_string(),
-        debug: args.debug,
-    };
-    
-    // Override with config file if provided
-    if let Some(config_path) = args.config {
-        info!("Loading configuration from: {}", config_path.display());
-        // TODO: Implement configuration file loading
-    }
-    
-    // Create and run RDMA engine
-    let mut engine = match RdmaEngine::new(config).await {
-        Ok(engine) => {
-            info!("✅ RDMA engine initialized successfully");
-            engine
-        }
-        Err(e) => {
-            error!("❌ Failed to initialize RDMA engine: {}", e);
-            return Err(e);
-        }
-    };
-    
-    // Set up signal handlers for graceful shutdown
-    let mut sigterm = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())?;
-    let mut sigint = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::interrupt())?;
-    
-    // Run engine in background
-    let engine_handle = tokio::spawn(async move {
-        if let Err(e) = engine.run().await {
-            error!("RDMA engine error: {}", e);
-            return Err(e);
-        }
-        Ok(())
-    });
-    
-    info!("🎯 RDMA engine is running and ready to accept connections");
-    info!("   Send SIGTERM or SIGINT to shutdown gracefully");
-    
-    // Wait for shutdown signal
-    tokio::select! {
-        _ = sigterm.recv() => {
-            info!("📡 Received SIGTERM, shutting down gracefully");
-        }
-        _ = sigint.recv() => {
-            info!("📡 Received SIGINT (Ctrl+C), shutting down gracefully");
-        }
-        result = engine_handle => {
-            match result {
-                Ok(Ok(())) => info!("🏁 RDMA engine completed successfully"),
-                Ok(Err(e)) => {
-                    error!("❌ RDMA engine failed: {}", e);
-                    return Err(e);
-                }
-                Err(e) => {
-                    error!("❌ RDMA engine task panicked: {}", e);
-                    return Err(anyhow::anyhow!("Engine task panicked: {}", e));
-                }
-            }
-        }
-    }
-    
-    info!("🛑 RDMA engine server shut down complete");
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[test]
-    fn test_args_parsing() {
-        let args = Args::try_parse_from(&[
-            "rdma-engine-server",
-            "--device", "mlx5_0",
-            "--port", "18515",
-            "--debug"
-        ]).unwrap();
-        
-        assert_eq!(args.device, "mlx5_0");
-        assert_eq!(args.port, 18515);
-        assert!(args.debug);
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/memory.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/memory.rs
deleted file mode 100644
index 17a9a5b1de..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/memory.rs
+++ /dev/null
@@ -1,630 +0,0 @@
-//! Memory management for RDMA operations
-//!
-//! This module provides efficient memory allocation, registration, and management
-//! for RDMA operations with zero-copy semantics and proper cleanup.
-
-use crate::{RdmaError, RdmaResult};
-use memmap2::MmapMut;
-use parking_lot::RwLock;
-use std::collections::HashMap;
-use std::sync::Arc;
-use tracing::{debug, info, warn};
-
-/// Memory pool for efficient buffer allocation
-pub struct MemoryPool {
-    /// Pre-allocated memory regions by size
-    pools: RwLock<HashMap<usize, Vec<PooledBuffer>>>,
-    /// Total allocated memory in bytes
-    total_allocated: RwLock<usize>,
-    /// Maximum pool size per buffer size
-    max_pool_size: usize,
-    /// Maximum total memory usage
-    max_total_memory: usize,
-    /// Statistics
-    stats: RwLock<MemoryPoolStats>,
-}
-
-/// Statistics for memory pool
-#[derive(Debug, Clone, Default)]
-pub struct MemoryPoolStats {
-    /// Total allocations requested
-    pub total_allocations: u64,
-    /// Total deallocations
-    pub total_deallocations: u64,
-    /// Cache hits (reused buffers)
-    pub cache_hits: u64,
-    /// Cache misses (new allocations)
-    pub cache_misses: u64,
-    /// Current active allocations
-    pub active_allocations: usize,
-    /// Peak memory usage in bytes
-    pub peak_memory_usage: usize,
-}
-
-/// A pooled memory buffer
-pub struct PooledBuffer {
-    /// Raw buffer data
-    data: Vec<u8>,
-    /// Size of the buffer
-    size: usize,
-    /// Whether the buffer is currently in use
-    in_use: bool,
-    /// Creation timestamp
-    created_at: std::time::Instant,
-}
-
-impl PooledBuffer {
-    /// Create new pooled buffer
-    fn new(size: usize) -> Self {
-        Self {
-            data: vec![0u8; size],
-            size,
-            in_use: false,
-            created_at: std::time::Instant::now(),
-        }
-    }
-    
-    /// Get buffer data as slice
-    pub fn as_slice(&self) -> &[u8] {
-        &self.data
-    }
-    
-    /// Get buffer data as mutable slice
-    pub fn as_mut_slice(&mut self) -> &mut [u8] {
-        &mut self.data
-    }
-    
-    /// Get buffer size
-    pub fn size(&self) -> usize {
-        self.size
-    }
-    
-    /// Get buffer age
-    pub fn age(&self) -> std::time::Duration {
-        self.created_at.elapsed()
-    }
-    
-    /// Get raw pointer to buffer data
-    pub fn as_ptr(&self) -> *const u8 {
-        self.data.as_ptr()
-    }
-    
-    /// Get mutable raw pointer to buffer data
-    pub fn as_mut_ptr(&mut self) -> *mut u8 {
-        self.data.as_mut_ptr()
-    }
-}
-
-impl MemoryPool {
-    /// Create new memory pool
-    pub fn new(max_pool_size: usize, max_total_memory: usize) -> Self {
-        info!("🧠 Memory pool initialized: max_pool_size={}, max_total_memory={} bytes", 
-              max_pool_size, max_total_memory);
-        
-        Self {
-            pools: RwLock::new(HashMap::new()),
-            total_allocated: RwLock::new(0),
-            max_pool_size,
-            max_total_memory,
-            stats: RwLock::new(MemoryPoolStats::default()),
-        }
-    }
-    
-    /// Allocate buffer from pool
-    pub fn allocate(&self, size: usize) -> RdmaResult<Arc<RwLock<PooledBuffer>>> {
-        // Round up to next power of 2 for better pooling
-        let pool_size = size.next_power_of_two();
-        
-        {
-            let mut stats = self.stats.write();
-            stats.total_allocations += 1;
-        }
-        
-        // Try to get buffer from pool first
-        {
-            let mut pools = self.pools.write();
-            if let Some(pool) = pools.get_mut(&pool_size) {
-                // Find available buffer in pool
-                for buffer in pool.iter_mut() {
-                    if !buffer.in_use {
-                        buffer.in_use = true;
-                        
-                        let mut stats = self.stats.write();
-                        stats.cache_hits += 1;
-                        stats.active_allocations += 1;
-                        
-                        debug!("📦 Reused buffer from pool: size={}", pool_size);
-                        return Ok(Arc::new(RwLock::new(std::mem::replace(
-                            buffer, 
-                            PooledBuffer::new(0) // Placeholder
-                        ))));
-                    }
-                }
-            }
-        }
-        
-        // No available buffer in pool, create new one
-        let total_allocated = *self.total_allocated.read();
-        if total_allocated + pool_size > self.max_total_memory {
-            return Err(RdmaError::ResourceExhausted { 
-                resource: "memory".to_string() 
-            });
-        }
-        
-        let mut buffer = PooledBuffer::new(pool_size);
-        buffer.in_use = true;
-        
-        // Update allocation tracking
-        let new_total = {
-            let mut total = self.total_allocated.write();
-            *total += pool_size;
-            *total
-        };
-        
-        {
-            let mut stats = self.stats.write();
-            stats.cache_misses += 1;
-            stats.active_allocations += 1;
-            if new_total > stats.peak_memory_usage {
-                stats.peak_memory_usage = new_total;
-            }
-        }
-        
-        debug!("🆕 Allocated new buffer: size={}, total_allocated={}", 
-               pool_size, new_total);
-        
-        Ok(Arc::new(RwLock::new(buffer)))
-    }
-    
-    /// Return buffer to pool
-    pub fn deallocate(&self, buffer: Arc<RwLock<PooledBuffer>>) -> RdmaResult<()> {
-        let buffer_size = {
-            let buf = buffer.read();
-            buf.size()
-        };
-        
-        {
-            let mut stats = self.stats.write();
-            stats.total_deallocations += 1;
-            stats.active_allocations = stats.active_allocations.saturating_sub(1);
-        }
-        
-        // Try to return buffer to pool
-        {
-            let mut pools = self.pools.write();
-            let pool = pools.entry(buffer_size).or_insert_with(Vec::new);
-            
-            if pool.len() < self.max_pool_size {
-                // Reset buffer state and return to pool
-                if let Ok(buf) = Arc::try_unwrap(buffer) {
-                    let mut buf = buf.into_inner();
-                    buf.in_use = false;
-                    buf.data.fill(0); // Clear data for security
-                    pool.push(buf);
-                    
-                    debug!("♻️ Returned buffer to pool: size={}", buffer_size);
-                    return Ok(());
-                }
-            }
-        }
-        
-        // Pool is full or buffer is still referenced, just track deallocation
-        {
-            let mut total = self.total_allocated.write();
-            *total = total.saturating_sub(buffer_size);
-        }
-        
-        debug!("🗑️ Buffer deallocated (not pooled): size={}", buffer_size);
-        Ok(())
-    }
-    
-    /// Get memory pool statistics
-    pub fn stats(&self) -> MemoryPoolStats {
-        self.stats.read().clone()
-    }
-    
-    /// Get current memory usage
-    pub fn current_usage(&self) -> usize {
-        *self.total_allocated.read()
-    }
-    
-    /// Clean up old unused buffers from pools
-    pub fn cleanup_old_buffers(&self, max_age: std::time::Duration) {
-        let mut cleaned_count = 0;
-        let mut cleaned_bytes = 0;
-        
-        {
-            let mut pools = self.pools.write();
-            for (size, pool) in pools.iter_mut() {
-                pool.retain(|buffer| {
-                    if buffer.age() > max_age && !buffer.in_use {
-                        cleaned_count += 1;
-                        cleaned_bytes += size;
-                        false
-                    } else {
-                        true
-                    }
-                });
-            }
-        }
-        
-        if cleaned_count > 0 {
-            {
-                let mut total = self.total_allocated.write();
-                *total = total.saturating_sub(cleaned_bytes);
-            }
-            
-            info!("🧹 Cleaned up {} old buffers, freed {} bytes", 
-                  cleaned_count, cleaned_bytes);
-        }
-    }
-}
-
-/// RDMA-specific memory manager
-pub struct RdmaMemoryManager {
-    /// General purpose memory pool
-    pool: MemoryPool,
-    /// Memory-mapped regions for large allocations
-    mmapped_regions: RwLock<HashMap<u64, MmapRegion>>,
-    /// HugePage allocations (if available)
-    hugepage_regions: RwLock<HashMap<u64, HugePageRegion>>,
-    /// Configuration
-    config: MemoryConfig,
-}
-
-/// Memory configuration
-#[derive(Debug, Clone)]
-pub struct MemoryConfig {
-    /// Use hugepages for large allocations
-    pub use_hugepages: bool,
-    /// Hugepage size in bytes
-    pub hugepage_size: usize,
-    /// Memory pool settings
-    pub pool_max_size: usize,
-    /// Maximum total memory usage
-    pub max_total_memory: usize,
-    /// Buffer cleanup interval
-    pub cleanup_interval_secs: u64,
-}
-
-impl Default for MemoryConfig {
-    fn default() -> Self {
-        Self {
-            use_hugepages: true,
-            hugepage_size: 2 * 1024 * 1024, // 2MB
-            pool_max_size: 1000,
-            max_total_memory: 8 * 1024 * 1024 * 1024, // 8GB
-            cleanup_interval_secs: 300, // 5 minutes
-        }
-    }
-}
-
-/// Memory-mapped region
-#[allow(dead_code)]
-struct MmapRegion {
-    mmap: MmapMut,
-    size: usize,
-    created_at: std::time::Instant,
-}
-
-/// HugePage memory region
-#[allow(dead_code)]
-struct HugePageRegion {
-    addr: *mut u8,
-    size: usize,
-    created_at: std::time::Instant,
-}
-
-unsafe impl Send for HugePageRegion {}
-unsafe impl Sync for HugePageRegion {}
-
-impl RdmaMemoryManager {
-    /// Create new RDMA memory manager
-    pub fn new(config: MemoryConfig) -> Self {
-        let pool = MemoryPool::new(config.pool_max_size, config.max_total_memory);
-        
-        Self {
-            pool,
-            mmapped_regions: RwLock::new(HashMap::new()),
-            hugepage_regions: RwLock::new(HashMap::new()),
-            config,
-        }
-    }
-    
-    /// Allocate memory optimized for RDMA operations
-    pub fn allocate_rdma_buffer(&self, size: usize) -> RdmaResult<RdmaBuffer> {
-        if size >= self.config.hugepage_size && self.config.use_hugepages {
-            self.allocate_hugepage_buffer(size)
-        } else if size >= 64 * 1024 {  // Use mmap for large buffers
-            self.allocate_mmap_buffer(size)
-        } else {
-            self.allocate_pool_buffer(size)
-        }
-    }
-    
-    /// Allocate buffer from memory pool
-    fn allocate_pool_buffer(&self, size: usize) -> RdmaResult<RdmaBuffer> {
-        let buffer = self.pool.allocate(size)?;
-        Ok(RdmaBuffer::Pool { buffer, size })
-    }
-    
-    /// Allocate memory-mapped buffer
-    fn allocate_mmap_buffer(&self, size: usize) -> RdmaResult<RdmaBuffer> {
-        let mmap = MmapMut::map_anon(size)
-            .map_err(|e| RdmaError::memory_reg_failed(format!("mmap failed: {}", e)))?;
-        
-        let addr = mmap.as_ptr() as u64;
-        let region = MmapRegion {
-            mmap,
-            size,
-            created_at: std::time::Instant::now(),
-        };
-        
-        {
-            let mut regions = self.mmapped_regions.write();
-            regions.insert(addr, region);
-        }
-        
-        debug!("🗺️ Allocated mmap buffer: addr=0x{:x}, size={}", addr, size);
-        Ok(RdmaBuffer::Mmap { addr, size })
-    }
-    
-    /// Allocate hugepage buffer (Linux-specific)
-    fn allocate_hugepage_buffer(&self, size: usize) -> RdmaResult<RdmaBuffer> {
-        #[cfg(target_os = "linux")]
-        {
-            use nix::sys::mman::{mmap, MapFlags, ProtFlags};
-            
-            // Round up to hugepage boundary
-            let aligned_size = (size + self.config.hugepage_size - 1) & !(self.config.hugepage_size - 1);
-            
-            let addr = unsafe {
-                // For anonymous mapping, we can use -1 as the file descriptor
-                use std::os::fd::BorrowedFd;
-                let fake_fd = BorrowedFd::borrow_raw(-1); // Anonymous mapping uses -1
-                
-                mmap(
-                    None, // ptr::null_mut() -> None
-                    std::num::NonZero::new(aligned_size).unwrap(), // aligned_size -> NonZero<usize>
-                    ProtFlags::PROT_READ | ProtFlags::PROT_WRITE,
-                    MapFlags::MAP_PRIVATE | MapFlags::MAP_ANONYMOUS | MapFlags::MAP_HUGETLB,
-                    Some(&fake_fd), // Use borrowed FD for -1 wrapped in Some
-                    0,
-                )
-            };
-            
-            match addr {
-                Ok(addr) => {
-                    let addr_u64 = addr as u64;
-                    let region = HugePageRegion {
-                        addr: addr as *mut u8,
-                        size: aligned_size,
-                        created_at: std::time::Instant::now(),
-                    };
-                    
-                    {
-                        let mut regions = self.hugepage_regions.write();
-                        regions.insert(addr_u64, region);
-                    }
-                    
-                    info!("🔥 Allocated hugepage buffer: addr=0x{:x}, size={}", addr_u64, aligned_size);
-                    Ok(RdmaBuffer::HugePage { addr: addr_u64, size: aligned_size })
-                }
-                Err(_) => {
-                    warn!("Failed to allocate hugepage buffer, falling back to mmap");
-                    self.allocate_mmap_buffer(size)
-                }
-            }
-        }
-        
-        #[cfg(not(target_os = "linux"))]
-        {
-            warn!("HugePages not supported on this platform, using mmap");
-            self.allocate_mmap_buffer(size)
-        }
-    }
-    
-    /// Deallocate RDMA buffer
-    pub fn deallocate_buffer(&self, buffer: RdmaBuffer) -> RdmaResult<()> {
-        match buffer {
-            RdmaBuffer::Pool { buffer, .. } => {
-                self.pool.deallocate(buffer)
-            }
-            RdmaBuffer::Mmap { addr, .. } => {
-                let mut regions = self.mmapped_regions.write();
-                regions.remove(&addr);
-                debug!("🗑️ Deallocated mmap buffer: addr=0x{:x}", addr);
-                Ok(())
-            }
-            RdmaBuffer::HugePage { addr, size } => {
-                {
-                    let mut regions = self.hugepage_regions.write();
-                    regions.remove(&addr);
-                }
-                
-                #[cfg(target_os = "linux")]
-                {
-                    use nix::sys::mman::munmap;
-                    unsafe {
-                        let _ = munmap(addr as *mut std::ffi::c_void, size);
-                    }
-                }
-                
-                debug!("🗑️ Deallocated hugepage buffer: addr=0x{:x}, size={}", addr, size);
-                Ok(())
-            }
-        }
-    }
-    
-    /// Get memory manager statistics
-    pub fn stats(&self) -> MemoryManagerStats {
-        let pool_stats = self.pool.stats();
-        let mmap_count = self.mmapped_regions.read().len();
-        let hugepage_count = self.hugepage_regions.read().len();
-        
-        MemoryManagerStats {
-            pool_stats,
-            mmap_regions: mmap_count,
-            hugepage_regions: hugepage_count,
-            total_memory_usage: self.pool.current_usage(),
-        }
-    }
-    
-    /// Start background cleanup task
-    pub async fn start_cleanup_task(&self) -> tokio::task::JoinHandle<()> {
-        let pool = MemoryPool::new(self.config.pool_max_size, self.config.max_total_memory);
-        let cleanup_interval = std::time::Duration::from_secs(self.config.cleanup_interval_secs);
-        
-        tokio::spawn(async move {
-            let mut interval = tokio::time::interval(
-                tokio::time::Duration::from_secs(300) // 5 minutes
-            );
-            
-            loop {
-                interval.tick().await;
-                pool.cleanup_old_buffers(cleanup_interval);
-            }
-        })
-    }
-}
-
-/// RDMA buffer types
-pub enum RdmaBuffer {
-    /// Buffer from memory pool
-    Pool {
-        buffer: Arc<RwLock<PooledBuffer>>,
-        size: usize,
-    },
-    /// Memory-mapped buffer
-    Mmap {
-        addr: u64,
-        size: usize,
-    },
-    /// HugePage buffer
-    HugePage {
-        addr: u64,
-        size: usize,
-    },
-}
-
-impl RdmaBuffer {
-    /// Get buffer address
-    pub fn addr(&self) -> u64 {
-        match self {
-            Self::Pool { buffer, .. } => {
-                buffer.read().as_ptr() as u64
-            }
-            Self::Mmap { addr, .. } => *addr,
-            Self::HugePage { addr, .. } => *addr,
-        }
-    }
-    
-    /// Get buffer size
-    pub fn size(&self) -> usize {
-        match self {
-            Self::Pool { size, .. } => *size,
-            Self::Mmap { size, .. } => *size,
-            Self::HugePage { size, .. } => *size,
-        }
-    }
-    
-    /// Get buffer as Vec (copy to avoid lifetime issues)
-    pub fn to_vec(&self) -> Vec<u8> {
-        match self {
-            Self::Pool { buffer, .. } => {
-                buffer.read().as_slice().to_vec()
-            }
-            Self::Mmap { addr, size } => {
-                unsafe { 
-                    let slice = std::slice::from_raw_parts(*addr as *const u8, *size);
-                    slice.to_vec()
-                }
-            }
-            Self::HugePage { addr, size } => {
-                unsafe { 
-                    let slice = std::slice::from_raw_parts(*addr as *const u8, *size);
-                    slice.to_vec()
-                }
-            }
-        }
-    }
-    
-    /// Get buffer type name
-    pub fn buffer_type(&self) -> &'static str {
-        match self {
-            Self::Pool { .. } => "pool",
-            Self::Mmap { .. } => "mmap",
-            Self::HugePage { .. } => "hugepage",
-        }
-    }
-}
-
-/// Memory manager statistics
-#[derive(Debug, Clone)]
-pub struct MemoryManagerStats {
-    /// Pool statistics
-    pub pool_stats: MemoryPoolStats,
-    /// Number of mmap regions
-    pub mmap_regions: usize,
-    /// Number of hugepage regions
-    pub hugepage_regions: usize,
-    /// Total memory usage in bytes
-    pub total_memory_usage: usize,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[test]
-    fn test_memory_pool_allocation() {
-        let pool = MemoryPool::new(10, 1024 * 1024);
-        
-        let buffer1 = pool.allocate(4096).unwrap();
-        let buffer2 = pool.allocate(4096).unwrap();
-        
-        assert_eq!(buffer1.read().size(), 4096);
-        assert_eq!(buffer2.read().size(), 4096);
-        
-        let stats = pool.stats();
-        assert_eq!(stats.total_allocations, 2);
-        assert_eq!(stats.cache_misses, 2);
-    }
-    
-    #[test]
-    fn test_memory_pool_reuse() {
-        let pool = MemoryPool::new(10, 1024 * 1024);
-        
-        // Allocate and deallocate
-        let buffer = pool.allocate(4096).unwrap();
-        let size = buffer.read().size();
-        pool.deallocate(buffer).unwrap();
-        
-        // Allocate again - should reuse
-        let buffer2 = pool.allocate(4096).unwrap();
-        assert_eq!(buffer2.read().size(), size);
-        
-        let stats = pool.stats();
-        assert_eq!(stats.cache_hits, 1);
-    }
-    
-    #[tokio::test]
-    async fn test_rdma_memory_manager() {
-        let config = MemoryConfig::default();
-        let manager = RdmaMemoryManager::new(config);
-        
-        // Test small buffer (pool)
-        let small_buffer = manager.allocate_rdma_buffer(1024).unwrap();
-        assert_eq!(small_buffer.size(), 1024);
-        assert_eq!(small_buffer.buffer_type(), "pool");
-        
-        // Test large buffer (mmap)
-        let large_buffer = manager.allocate_rdma_buffer(128 * 1024).unwrap();
-        assert_eq!(large_buffer.size(), 128 * 1024);
-        assert_eq!(large_buffer.buffer_type(), "mmap");
-        
-        // Clean up
-        manager.deallocate_buffer(small_buffer).unwrap();
-        manager.deallocate_buffer(large_buffer).unwrap();
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/rdma.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/rdma.rs
deleted file mode 100644
index 7549a217e0..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/rdma.rs
+++ /dev/null
@@ -1,467 +0,0 @@
-//! RDMA operations and context management
-//! 
-//! This module provides both mock and real RDMA implementations:
-//! - Mock implementation for development and testing
-//! - Real implementation using libibverbs for production
-
-use crate::{RdmaResult, RdmaEngineConfig};
-use tracing::{debug, warn, info};
-use parking_lot::RwLock;
-
-/// RDMA completion status
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub enum CompletionStatus {
-    Success,
-    LocalLengthError,
-    LocalQpOperationError,
-    LocalEecOperationError,
-    LocalProtectionError,
-    WrFlushError,
-    MemoryWindowBindError,
-    BadResponseError,
-    LocalAccessError,
-    RemoteInvalidRequestError,
-    RemoteAccessError,
-    RemoteOperationError,
-    TransportRetryCounterExceeded,
-    RnrRetryCounterExceeded,
-    LocalRddViolationError,
-    RemoteInvalidRdRequest,
-    RemoteAbortedError,
-    InvalidEecnError,
-    InvalidEecStateError,
-    FatalError,
-    ResponseTimeoutError,
-    GeneralError,
-}
-
-impl From<u32> for CompletionStatus {
-    fn from(status: u32) -> Self {
-        match status {
-            0 => Self::Success,
-            1 => Self::LocalLengthError,
-            2 => Self::LocalQpOperationError,
-            3 => Self::LocalEecOperationError,
-            4 => Self::LocalProtectionError,
-            5 => Self::WrFlushError,
-            6 => Self::MemoryWindowBindError,
-            7 => Self::BadResponseError,
-            8 => Self::LocalAccessError,
-            9 => Self::RemoteInvalidRequestError,
-            10 => Self::RemoteAccessError,
-            11 => Self::RemoteOperationError,
-            12 => Self::TransportRetryCounterExceeded,
-            13 => Self::RnrRetryCounterExceeded,
-            14 => Self::LocalRddViolationError,
-            15 => Self::RemoteInvalidRdRequest,
-            16 => Self::RemoteAbortedError,
-            17 => Self::InvalidEecnError,
-            18 => Self::InvalidEecStateError,
-            19 => Self::FatalError,
-            20 => Self::ResponseTimeoutError,
-            _ => Self::GeneralError,
-        }
-    }
-}
-
-/// RDMA operation types
-#[derive(Debug, Clone, Copy)]
-pub enum RdmaOp {
-    Read,
-    Write,
-    Send,
-    Receive,
-    Atomic,
-}
-
-/// RDMA memory region information
-#[derive(Debug, Clone)]
-pub struct MemoryRegion {
-    /// Local virtual address
-    pub addr: u64,
-    /// Remote key for RDMA operations
-    pub rkey: u32,
-    /// Local key for local operations
-    pub lkey: u32,
-    /// Size of the memory region
-    pub size: usize,
-    /// Whether the region is registered with RDMA hardware
-    pub registered: bool,
-}
-
-/// RDMA work completion
-#[derive(Debug)]
-pub struct WorkCompletion {
-    /// Work request ID
-    pub wr_id: u64,
-    /// Completion status
-    pub status: CompletionStatus,
-    /// Operation type
-    pub opcode: RdmaOp,
-    /// Number of bytes transferred
-    pub byte_len: u32,
-    /// Immediate data (if any)
-    pub imm_data: Option<u32>,
-}
-
-/// RDMA context implementation (simplified enum approach)
-#[derive(Debug)]
-pub enum RdmaContextImpl {
-    Mock(MockRdmaContext),
-    // Ucx(UcxRdmaContext), // TODO: Add UCX implementation
-}
-
-/// RDMA device information
-#[derive(Debug, Clone)]
-pub struct RdmaDeviceInfo {
-    pub name: String,
-    pub vendor_id: u32,
-    pub vendor_part_id: u32,
-    pub hw_ver: u32,
-    pub max_mr: u32,
-    pub max_qp: u32,
-    pub max_cq: u32,
-    pub max_mr_size: u64,
-    pub port_gid: String,
-    pub port_lid: u16,
-}
-
-/// Main RDMA context
-pub struct RdmaContext {
-    inner: RdmaContextImpl,
-    #[allow(dead_code)]
-    config: RdmaEngineConfig,
-}
-
-impl RdmaContext {
-    /// Create new RDMA context
-    pub async fn new(config: &RdmaEngineConfig) -> RdmaResult<Self> {
-        let inner = if cfg!(feature = "real-ucx") {
-            RdmaContextImpl::Mock(MockRdmaContext::new(config).await?) // TODO: Use UCX when ready
-        } else {
-            RdmaContextImpl::Mock(MockRdmaContext::new(config).await?)
-        };
-        
-        Ok(Self {
-            inner,
-            config: config.clone(),
-        })
-    }
-    
-    /// Register memory for RDMA operations
-    pub async fn register_memory(&self, addr: u64, size: usize) -> RdmaResult<MemoryRegion> {
-        match &self.inner {
-            RdmaContextImpl::Mock(ctx) => ctx.register_memory(addr, size).await,
-        }
-    }
-    
-    /// Deregister memory region
-    pub async fn deregister_memory(&self, region: &MemoryRegion) -> RdmaResult<()> {
-        match &self.inner {
-            RdmaContextImpl::Mock(ctx) => ctx.deregister_memory(region).await,
-        }
-    }
-    
-    /// Post RDMA read operation
-    pub async fn post_read(&self, 
-        local_addr: u64, 
-        remote_addr: u64, 
-        rkey: u32, 
-        size: usize,
-        wr_id: u64,
-    ) -> RdmaResult<()> {
-        match &self.inner {
-            RdmaContextImpl::Mock(ctx) => ctx.post_read(local_addr, remote_addr, rkey, size, wr_id).await,
-        }
-    }
-    
-    /// Post RDMA write operation  
-    pub async fn post_write(&self, 
-        local_addr: u64, 
-        remote_addr: u64, 
-        rkey: u32, 
-        size: usize,
-        wr_id: u64,
-    ) -> RdmaResult<()> {
-        match &self.inner {
-            RdmaContextImpl::Mock(ctx) => ctx.post_write(local_addr, remote_addr, rkey, size, wr_id).await,
-        }
-    }
-    
-    /// Poll for work completions
-    pub async fn poll_completion(&self, max_completions: usize) -> RdmaResult<Vec<WorkCompletion>> {
-        match &self.inner {
-            RdmaContextImpl::Mock(ctx) => ctx.poll_completion(max_completions).await,
-        }
-    }
-    
-    /// Get device information
-    pub fn device_info(&self) -> &RdmaDeviceInfo {
-        match &self.inner {
-            RdmaContextImpl::Mock(ctx) => ctx.device_info(),
-        }
-    }
-}
-
-/// Mock RDMA context for testing and development
-#[derive(Debug)]
-pub struct MockRdmaContext {
-    device_info: RdmaDeviceInfo,
-    registered_regions: RwLock<Vec<MemoryRegion>>,
-    pending_operations: RwLock<Vec<WorkCompletion>>,
-    #[allow(dead_code)]
-    config: RdmaEngineConfig,
-}
-
-impl MockRdmaContext {
-    pub async fn new(config: &RdmaEngineConfig) -> RdmaResult<Self> {
-        warn!("🟡 Using MOCK RDMA implementation - for development only!");
-        info!("   Device: {} (mock)", config.device_name);
-        info!("   Port: {} (mock)", config.port);
-        
-        let device_info = RdmaDeviceInfo {
-            name: config.device_name.clone(),
-            vendor_id: 0x02c9, // Mellanox mock vendor ID
-            vendor_part_id: 0x1017, // ConnectX-5 mock part ID
-            hw_ver: 0,
-            max_mr: 131072,
-            max_qp: 262144,
-            max_cq: 65536,
-            max_mr_size: 1024 * 1024 * 1024 * 1024, // 1TB mock
-            port_gid: "fe80:0000:0000:0000:0200:5eff:fe12:3456".to_string(),
-            port_lid: 1,
-        };
-        
-        Ok(Self {
-            device_info,
-            registered_regions: RwLock::new(Vec::new()),
-            pending_operations: RwLock::new(Vec::new()),
-            config: config.clone(),
-        })
-    }
-}
-
-impl MockRdmaContext {
-    pub async fn register_memory(&self, addr: u64, size: usize) -> RdmaResult<MemoryRegion> {
-        debug!("🟡 Mock: Registering memory region addr=0x{:x}, size={}", addr, size);
-        
-        // Simulate registration delay
-        tokio::time::sleep(tokio::time::Duration::from_micros(10)).await;
-        
-        let region = MemoryRegion {
-            addr,
-            rkey: 0x12345678, // Mock remote key
-            lkey: 0x87654321, // Mock local key
-            size,
-            registered: true,
-        };
-        
-        self.registered_regions.write().push(region.clone());
-        
-        Ok(region)
-    }
-    
-    pub async fn deregister_memory(&self, region: &MemoryRegion) -> RdmaResult<()> {
-        debug!("🟡 Mock: Deregistering memory region rkey=0x{:x}", region.rkey);
-        
-        let mut regions = self.registered_regions.write();
-        regions.retain(|r| r.rkey != region.rkey);
-        
-        Ok(())
-    }
-    
-    pub async fn post_read(&self, 
-        local_addr: u64, 
-        remote_addr: u64, 
-        rkey: u32, 
-        size: usize,
-        wr_id: u64,
-    ) -> RdmaResult<()> {
-        debug!("🟡 Mock: RDMA READ local=0x{:x}, remote=0x{:x}, rkey=0x{:x}, size={}", 
-               local_addr, remote_addr, rkey, size);
-        
-        // Simulate RDMA read latency (much faster than real network, but realistic for mock)
-        tokio::time::sleep(tokio::time::Duration::from_nanos(150)).await;
-        
-        // Mock data transfer - copy pattern data to local address
-        let data_ptr = local_addr as *mut u8;
-        unsafe {
-            for i in 0..size {
-                *data_ptr.add(i) = (i % 256) as u8; // Pattern: 0,1,2,...,255,0,1,2...
-            }
-        }
-        
-        // Create completion
-        let completion = WorkCompletion {
-            wr_id,
-            status: CompletionStatus::Success,
-            opcode: RdmaOp::Read,
-            byte_len: size as u32,
-            imm_data: None,
-        };
-        
-        self.pending_operations.write().push(completion);
-        
-        Ok(())
-    }
-    
-    pub async fn post_write(&self, 
-        local_addr: u64, 
-        remote_addr: u64, 
-        rkey: u32, 
-        size: usize,
-        wr_id: u64,
-    ) -> RdmaResult<()> {
-        debug!("🟡 Mock: RDMA WRITE local=0x{:x}, remote=0x{:x}, rkey=0x{:x}, size={}", 
-               local_addr, remote_addr, rkey, size);
-        
-        // Simulate RDMA write latency
-        tokio::time::sleep(tokio::time::Duration::from_nanos(100)).await;
-        
-        // Create completion
-        let completion = WorkCompletion {
-            wr_id,
-            status: CompletionStatus::Success,
-            opcode: RdmaOp::Write,
-            byte_len: size as u32,
-            imm_data: None,
-        };
-        
-        self.pending_operations.write().push(completion);
-        
-        Ok(())
-    }
-    
-    pub async fn poll_completion(&self, max_completions: usize) -> RdmaResult<Vec<WorkCompletion>> {
-        let mut operations = self.pending_operations.write();
-        let available = operations.len().min(max_completions);
-        let completions = operations.drain(..available).collect();
-        
-        Ok(completions)
-    }
-    
-    pub fn device_info(&self) -> &RdmaDeviceInfo {
-        &self.device_info
-    }
-}
-
-/// Real RDMA context using libibverbs
-#[cfg(feature = "real-ucx")]
-pub struct RealRdmaContext {
-    // Real implementation would contain:
-    // ibv_context: *mut ibv_context,
-    // ibv_pd: *mut ibv_pd,
-    // ibv_cq: *mut ibv_cq,
-    // ibv_qp: *mut ibv_qp,
-    device_info: RdmaDeviceInfo,
-    config: RdmaEngineConfig,
-}
-
-#[cfg(feature = "real-ucx")]
-impl RealRdmaContext {
-    pub async fn new(config: &RdmaEngineConfig) -> RdmaResult<Self> {
-        info!("✅ Initializing REAL RDMA context for device: {}", config.device_name);
-        
-        // Real implementation would:
-        // 1. Get device list with ibv_get_device_list()
-        // 2. Find device by name
-        // 3. Open device with ibv_open_device()
-        // 4. Create protection domain with ibv_alloc_pd()
-        // 5. Create completion queue with ibv_create_cq()
-        // 6. Create queue pair with ibv_create_qp()
-        // 7. Transition QP to RTS state
-        
-        todo!("Real RDMA implementation using libibverbs");
-    }
-}
-
-#[cfg(feature = "real-ucx")]
-#[async_trait::async_trait]
-impl RdmaContextTrait for RealRdmaContext {
-    async fn register_memory(&self, _addr: u64, _size: usize) -> RdmaResult<MemoryRegion> {
-        // Real implementation would use ibv_reg_mr()
-        todo!("Real memory registration")
-    }
-    
-    async fn deregister_memory(&self, _region: &MemoryRegion) -> RdmaResult<()> {
-        // Real implementation would use ibv_dereg_mr()
-        todo!("Real memory deregistration")
-    }
-    
-    async fn post_read(&self, 
-        _local_addr: u64, 
-        _remote_addr: u64, 
-        _rkey: u32, 
-        _size: usize,
-        _wr_id: u64,
-    ) -> RdmaResult<()> {
-        // Real implementation would use ibv_post_send() with IBV_WR_RDMA_READ
-        todo!("Real RDMA read")
-    }
-    
-    async fn post_write(&self, 
-        _local_addr: u64, 
-        _remote_addr: u64, 
-        _rkey: u32, 
-        _size: usize,
-        _wr_id: u64,
-    ) -> RdmaResult<()> {
-        // Real implementation would use ibv_post_send() with IBV_WR_RDMA_WRITE
-        todo!("Real RDMA write")
-    }
-    
-    async fn poll_completion(&self, _max_completions: usize) -> RdmaResult<Vec<WorkCompletion>> {
-        // Real implementation would use ibv_poll_cq()
-        todo!("Real completion polling")
-    }
-    
-    fn device_info(&self) -> &RdmaDeviceInfo {
-        &self.device_info
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[tokio::test]
-    async fn test_mock_rdma_context() {
-        let config = RdmaEngineConfig::default();
-        let ctx = RdmaContext::new(&config).await.unwrap();
-        
-        // Test device info
-        let info = ctx.device_info();
-        assert_eq!(info.name, "mlx5_0");
-        assert!(info.max_mr > 0);
-        
-        // Test memory registration
-        let addr = 0x7f000000u64;
-        let size = 4096;
-        let region = ctx.register_memory(addr, size).await.unwrap();
-        assert_eq!(region.addr, addr);
-        assert_eq!(region.size, size);
-        assert!(region.registered);
-        
-        // Test RDMA read
-        let local_buf = vec![0u8; 1024];
-        let local_addr = local_buf.as_ptr() as u64;
-        let result = ctx.post_read(local_addr, 0x8000000, region.rkey, 1024, 1).await;
-        assert!(result.is_ok());
-        
-        // Test completion polling
-        let completions = ctx.poll_completion(10).await.unwrap();
-        assert_eq!(completions.len(), 1);
-        assert_eq!(completions[0].status, CompletionStatus::Success);
-        
-        // Test memory deregistration
-        let result = ctx.deregister_memory(&region).await;
-        assert!(result.is_ok());
-    }
-    
-    #[test]
-    fn test_completion_status_conversion() {
-        assert_eq!(CompletionStatus::from(0), CompletionStatus::Success);
-        assert_eq!(CompletionStatus::from(1), CompletionStatus::LocalLengthError);
-        assert_eq!(CompletionStatus::from(999), CompletionStatus::GeneralError);
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/session.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/session.rs
deleted file mode 100644
index fa089c72a2..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/session.rs
+++ /dev/null
@@ -1,587 +0,0 @@
-//! Session management for RDMA operations
-//!
-//! This module manages the lifecycle of RDMA sessions, including creation,
-//! storage, expiration, and cleanup of resources.
-
-use crate::{RdmaError, RdmaResult, rdma::MemoryRegion};
-use parking_lot::RwLock;
-use std::collections::HashMap;
-use std::sync::Arc;
-use tokio::time::{Duration, Instant};
-use tracing::{debug, info};
-// use uuid::Uuid;  // Unused for now
-
-/// RDMA session state
-#[derive(Debug, Clone)]
-pub struct RdmaSession {
-    /// Unique session identifier
-    pub id: String,
-    /// SeaweedFS volume ID
-    pub volume_id: u32,
-    /// SeaweedFS needle ID  
-    pub needle_id: u64,
-    /// Remote memory address
-    pub remote_addr: u64,
-    /// Remote key for RDMA access
-    pub remote_key: u32,
-    /// Transfer size in bytes
-    pub transfer_size: u64,
-    /// Local data buffer
-    pub buffer: Vec<u8>,
-    /// RDMA memory region
-    pub memory_region: MemoryRegion,
-    /// Session creation time
-    pub created_at: Instant,
-    /// Session expiration time
-    pub expires_at: Instant,
-    /// Current session state
-    pub state: SessionState,
-    /// Operation statistics
-    pub stats: SessionStats,
-}
-
-/// Session state enum
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub enum SessionState {
-    /// Session created but not yet active
-    Created,
-    /// RDMA operation in progress
-    Active,
-    /// Operation completed successfully
-    Completed,
-    /// Operation failed
-    Failed,
-    /// Session expired
-    Expired,
-    /// Session being cleaned up
-    CleaningUp,
-}
-
-/// Session operation statistics
-#[derive(Debug, Clone, Default)]
-pub struct SessionStats {
-    /// Number of RDMA operations performed
-    pub operations_count: u64,
-    /// Total bytes transferred
-    pub bytes_transferred: u64,
-    /// Time spent in RDMA operations (nanoseconds)
-    pub rdma_time_ns: u64,
-    /// Number of completion polling attempts
-    pub poll_attempts: u64,
-    /// Time of last operation
-    pub last_operation_at: Option<Instant>,
-}
-
-impl RdmaSession {
-    /// Create a new RDMA session
-    pub fn new(
-        id: String,
-        volume_id: u32,
-        needle_id: u64,
-        remote_addr: u64,
-        remote_key: u32,
-        transfer_size: u64,
-        buffer: Vec<u8>,
-        memory_region: MemoryRegion,
-        timeout: Duration,
-    ) -> Self {
-        let now = Instant::now();
-        
-        Self {
-            id,
-            volume_id,
-            needle_id,
-            remote_addr,
-            remote_key,
-            transfer_size,
-            buffer,
-            memory_region,
-            created_at: now,
-            expires_at: now + timeout,
-            state: SessionState::Created,
-            stats: SessionStats::default(),
-        }
-    }
-    
-    /// Check if session has expired
-    pub fn is_expired(&self) -> bool {
-        Instant::now() > self.expires_at
-    }
-    
-    /// Get session age in seconds
-    pub fn age_secs(&self) -> f64 {
-        self.created_at.elapsed().as_secs_f64()
-    }
-    
-    /// Get time until expiration in seconds
-    pub fn time_to_expiration_secs(&self) -> f64 {
-        if self.is_expired() {
-            0.0
-        } else {
-            (self.expires_at - Instant::now()).as_secs_f64()
-        }
-    }
-    
-    /// Update session state
-    pub fn set_state(&mut self, state: SessionState) {
-        debug!("Session {} state: {:?} -> {:?}", self.id, self.state, state);
-        self.state = state;
-    }
-    
-    /// Record RDMA operation statistics
-    pub fn record_operation(&mut self, bytes_transferred: u64, duration_ns: u64) {
-        self.stats.operations_count += 1;
-        self.stats.bytes_transferred += bytes_transferred;
-        self.stats.rdma_time_ns += duration_ns;
-        self.stats.last_operation_at = Some(Instant::now());
-    }
-    
-    /// Get average operation latency in nanoseconds
-    pub fn avg_operation_latency_ns(&self) -> u64 {
-        if self.stats.operations_count > 0 {
-            self.stats.rdma_time_ns / self.stats.operations_count
-        } else {
-            0
-        }
-    }
-    
-    /// Get throughput in bytes per second
-    pub fn throughput_bps(&self) -> f64 {
-        let age_secs = self.age_secs();
-        if age_secs > 0.0 {
-            self.stats.bytes_transferred as f64 / age_secs
-        } else {
-            0.0
-        }
-    }
-}
-
-/// Session manager for handling multiple concurrent RDMA sessions
-pub struct SessionManager {
-    /// Active sessions
-    sessions: Arc<RwLock<HashMap<String, Arc<RwLock<RdmaSession>>>>>,
-    /// Maximum number of concurrent sessions
-    max_sessions: usize,
-    /// Default session timeout
-    #[allow(dead_code)]
-    default_timeout: Duration,
-    /// Cleanup task handle
-    cleanup_task: RwLock<Option<tokio::task::JoinHandle<()>>>,
-    /// Shutdown flag
-    shutdown_flag: Arc<RwLock<bool>>,
-    /// Statistics
-    stats: Arc<RwLock<SessionManagerStats>>,
-}
-
-/// Session manager statistics
-#[derive(Debug, Clone, Default)]
-pub struct SessionManagerStats {
-    /// Total sessions created
-    pub total_sessions_created: u64,
-    /// Total sessions completed
-    pub total_sessions_completed: u64,
-    /// Total sessions failed
-    pub total_sessions_failed: u64,
-    /// Total sessions expired
-    pub total_sessions_expired: u64,
-    /// Total bytes transferred across all sessions
-    pub total_bytes_transferred: u64,
-    /// Manager start time
-    pub started_at: Option<Instant>,
-}
-
-impl SessionManager {
-    /// Create new session manager
-    pub fn new(max_sessions: usize, default_timeout: Duration) -> Self {
-        info!("🎯 Session manager initialized: max_sessions={}, timeout={:?}", 
-              max_sessions, default_timeout);
-              
-        let mut stats = SessionManagerStats::default();
-        stats.started_at = Some(Instant::now());
-        
-        Self {
-            sessions: Arc::new(RwLock::new(HashMap::new())),
-            max_sessions,
-            default_timeout,
-            cleanup_task: RwLock::new(None),
-            shutdown_flag: Arc::new(RwLock::new(false)),
-            stats: Arc::new(RwLock::new(stats)),
-        }
-    }
-    
-    /// Create a new RDMA session
-    pub async fn create_session(
-        &self,
-        session_id: String,
-        volume_id: u32,
-        needle_id: u64,
-        remote_addr: u64,
-        remote_key: u32,
-        transfer_size: u64,
-        buffer: Vec<u8>,
-        memory_region: MemoryRegion,
-        timeout: chrono::Duration,
-    ) -> RdmaResult<Arc<RwLock<RdmaSession>>> {
-        // Check session limit
-        {
-            let sessions = self.sessions.read();
-            if sessions.len() >= self.max_sessions {
-                return Err(RdmaError::TooManySessions { 
-                    max_sessions: self.max_sessions 
-                });
-            }
-            
-            // Check if session already exists
-            if sessions.contains_key(&session_id) {
-                return Err(RdmaError::invalid_request(
-                    format!("Session {} already exists", session_id)
-                ));
-            }
-        }
-        
-        let timeout_duration = Duration::from_millis(timeout.num_milliseconds().max(1) as u64);
-        
-        let session = Arc::new(RwLock::new(RdmaSession::new(
-            session_id.clone(),
-            volume_id,
-            needle_id,
-            remote_addr,
-            remote_key,
-            transfer_size,
-            buffer,
-            memory_region,
-            timeout_duration,
-        )));
-        
-        // Store session
-        {
-            let mut sessions = self.sessions.write();
-            sessions.insert(session_id.clone(), session.clone());
-        }
-        
-        // Update stats
-        {
-            let mut stats = self.stats.write();
-            stats.total_sessions_created += 1;
-        }
-        
-        info!("📦 Created session {}: volume={}, needle={}, size={}", 
-              session_id, volume_id, needle_id, transfer_size);
-        
-        Ok(session)
-    }
-    
-    /// Get session by ID
-    pub async fn get_session(&self, session_id: &str) -> RdmaResult<Arc<RwLock<RdmaSession>>> {
-        let sessions = self.sessions.read();
-        match sessions.get(session_id) {
-            Some(session) => {
-                if session.read().is_expired() {
-                    Err(RdmaError::SessionExpired { 
-                        session_id: session_id.to_string() 
-                    })
-                } else {
-                    Ok(session.clone())
-                }
-            }
-            None => Err(RdmaError::SessionNotFound { 
-                session_id: session_id.to_string() 
-            }),
-        }
-    }
-    
-    /// Remove and cleanup session
-    pub async fn remove_session(&self, session_id: &str) -> RdmaResult<()> {
-        let session = {
-            let mut sessions = self.sessions.write();
-            sessions.remove(session_id)
-        };
-        
-        if let Some(session) = session {
-            let session_data = session.read();
-            info!("🗑️ Removed session {}: stats={:?}", session_id, session_data.stats);
-            
-            // Update manager stats
-            {
-                let mut stats = self.stats.write();
-                match session_data.state {
-                    SessionState::Completed => stats.total_sessions_completed += 1,
-                    SessionState::Failed => stats.total_sessions_failed += 1,
-                    SessionState::Expired => stats.total_sessions_expired += 1,
-                    _ => {}
-                }
-                stats.total_bytes_transferred += session_data.stats.bytes_transferred;
-            }
-            
-            Ok(())
-        } else {
-            Err(RdmaError::SessionNotFound { 
-                session_id: session_id.to_string() 
-            })
-        }
-    }
-    
-    /// Get active session count
-    pub async fn active_session_count(&self) -> usize {
-        self.sessions.read().len()
-    }
-    
-    /// Get maximum sessions allowed
-    pub fn max_sessions(&self) -> usize {
-        self.max_sessions
-    }
-    
-    /// List active sessions
-    pub async fn list_sessions(&self) -> Vec<String> {
-        self.sessions.read().keys().cloned().collect()
-    }
-    
-    /// Get session statistics
-    pub async fn get_session_stats(&self, session_id: &str) -> RdmaResult<SessionStats> {
-        let session = self.get_session(session_id).await?;
-        let stats = {
-            let session_data = session.read();
-            session_data.stats.clone()
-        };
-        Ok(stats)
-    }
-    
-    /// Get manager statistics
-    pub fn get_manager_stats(&self) -> SessionManagerStats {
-        self.stats.read().clone()
-    }
-    
-    /// Start background cleanup task
-    pub async fn start_cleanup_task(&self) {
-        info!("📋 Session cleanup task initialized");
-        
-        let sessions = Arc::clone(&self.sessions);
-        let shutdown_flag = Arc::clone(&self.shutdown_flag);
-        let stats = Arc::clone(&self.stats);
-        
-        let task = tokio::spawn(async move {
-            let mut interval = tokio::time::interval(Duration::from_secs(30)); // Check every 30 seconds
-            
-            loop {
-                interval.tick().await;
-                
-                // Check shutdown flag
-                if *shutdown_flag.read() {
-                    debug!("🛑 Session cleanup task shutting down");
-                    break;
-                }
-                
-                let now = Instant::now();
-                let mut expired_sessions = Vec::new();
-                
-                // Find expired sessions
-                {
-                    let sessions_guard = sessions.read();
-                    for (session_id, session) in sessions_guard.iter() {
-                        if now > session.read().expires_at {
-                            expired_sessions.push(session_id.clone());
-                        }
-                    }
-                }
-                
-                // Remove expired sessions
-                if !expired_sessions.is_empty() {
-                    let mut sessions_guard = sessions.write();
-                    let mut stats_guard = stats.write();
-                    
-                    for session_id in expired_sessions {
-                        if let Some(session) = sessions_guard.remove(&session_id) {
-                            let session_data = session.read();
-                            info!("🗑️  Cleaned up expired session: {} (volume={}, needle={})", 
-                                 session_id, session_data.volume_id, session_data.needle_id);
-                            stats_guard.total_sessions_expired += 1;
-                        }
-                    }
-                    
-                    debug!("📊 Active sessions: {}", sessions_guard.len());
-                }
-            }
-        });
-        
-        *self.cleanup_task.write() = Some(task);
-    }
-    
-    /// Shutdown session manager
-    pub async fn shutdown(&self) {
-        info!("🛑 Shutting down session manager");
-        *self.shutdown_flag.write() = true;
-        
-        // Wait for cleanup task to finish
-        if let Some(task) = self.cleanup_task.write().take() {
-            let _ = task.await;
-        }
-        
-        // Clean up all remaining sessions
-        let session_ids: Vec<String> = {
-            self.sessions.read().keys().cloned().collect()
-        };
-        
-        for session_id in session_ids {
-            let _ = self.remove_session(&session_id).await;
-        }
-        
-        let final_stats = self.get_manager_stats();
-        info!("📈 Final session manager stats: {:?}", final_stats);
-    }
-    
-    /// Force cleanup of all sessions (for testing)
-    #[cfg(test)]
-    pub async fn cleanup_all_sessions(&self) {
-        let session_ids: Vec<String> = {
-            self.sessions.read().keys().cloned().collect()
-        };
-        
-        for session_id in session_ids {
-            let _ = self.remove_session(&session_id).await;
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::rdma::MemoryRegion;
-    
-    #[tokio::test]
-    async fn test_session_creation() {
-        let manager = SessionManager::new(10, Duration::from_secs(60));
-        
-        let memory_region = MemoryRegion {
-            addr: 0x1000,
-            rkey: 0x12345678,
-            lkey: 0x87654321,
-            size: 4096,
-            registered: true,
-        };
-        
-        let session = manager.create_session(
-            "test-session".to_string(),
-            1,
-            100,
-            0x2000,
-            0xabcd,
-            4096,
-            vec![0; 4096],
-            memory_region,
-            chrono::Duration::seconds(60),
-        ).await.unwrap();
-        
-        let session_data = session.read();
-        assert_eq!(session_data.id, "test-session");
-        assert_eq!(session_data.volume_id, 1);
-        assert_eq!(session_data.needle_id, 100);
-        assert_eq!(session_data.state, SessionState::Created);
-        assert!(!session_data.is_expired());
-    }
-    
-    #[tokio::test]
-    async fn test_session_expiration() {
-        let manager = SessionManager::new(10, Duration::from_millis(10));
-        
-        let memory_region = MemoryRegion {
-            addr: 0x1000,
-            rkey: 0x12345678,
-            lkey: 0x87654321,
-            size: 4096,
-            registered: true,
-        };
-        
-        let _session = manager.create_session(
-            "expire-test".to_string(),
-            1,
-            100,
-            0x2000,
-            0xabcd,
-            4096,
-            vec![0; 4096],
-            memory_region,
-            chrono::Duration::milliseconds(10),
-        ).await.unwrap();
-        
-        // Wait for expiration
-        tokio::time::sleep(Duration::from_millis(20)).await;
-        
-        let result = manager.get_session("expire-test").await;
-        assert!(matches!(result, Err(RdmaError::SessionExpired { .. })));
-    }
-    
-    #[tokio::test]
-    async fn test_session_limit() {
-        let manager = SessionManager::new(2, Duration::from_secs(60));
-        
-        let memory_region = MemoryRegion {
-            addr: 0x1000,
-            rkey: 0x12345678,
-            lkey: 0x87654321,
-            size: 4096,
-            registered: true,
-        };
-        
-        // Create first session
-        let _session1 = manager.create_session(
-            "session1".to_string(),
-            1, 100, 0x2000, 0xabcd, 4096,
-            vec![0; 4096],
-            memory_region.clone(),
-            chrono::Duration::seconds(60),
-        ).await.unwrap();
-        
-        // Create second session
-        let _session2 = manager.create_session(
-            "session2".to_string(),
-            1, 101, 0x3000, 0xabcd, 4096,
-            vec![0; 4096],
-            memory_region.clone(),
-            chrono::Duration::seconds(60),
-        ).await.unwrap();
-        
-        // Third session should fail
-        let result = manager.create_session(
-            "session3".to_string(),
-            1, 102, 0x4000, 0xabcd, 4096,
-            vec![0; 4096],
-            memory_region,
-            chrono::Duration::seconds(60),
-        ).await;
-        
-        assert!(matches!(result, Err(RdmaError::TooManySessions { .. })));
-    }
-    
-    #[tokio::test]
-    async fn test_session_stats() {
-        let manager = SessionManager::new(10, Duration::from_secs(60));
-        
-        let memory_region = MemoryRegion {
-            addr: 0x1000,
-            rkey: 0x12345678,
-            lkey: 0x87654321,
-            size: 4096,
-            registered: true,
-        };
-        
-        let session = manager.create_session(
-            "stats-test".to_string(),
-            1, 100, 0x2000, 0xabcd, 4096,
-            vec![0; 4096],
-            memory_region,
-            chrono::Duration::seconds(60),
-        ).await.unwrap();
-        
-        // Simulate some operations - now using proper interior mutability
-        {
-            let mut session_data = session.write();
-            session_data.record_operation(1024, 1000000); // 1KB in 1ms
-            session_data.record_operation(2048, 2000000); // 2KB in 2ms
-        }
-        
-        let stats = manager.get_session_stats("stats-test").await.unwrap();
-        assert_eq!(stats.operations_count, 2);
-        assert_eq!(stats.bytes_transferred, 3072);
-        assert_eq!(stats.rdma_time_ns, 3000000);
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/rdma-engine/src/ucx.rs b/seaweedfs-rdma-sidecar/rdma-engine/src/ucx.rs
deleted file mode 100644
index 9011498585..0000000000
--- a/seaweedfs-rdma-sidecar/rdma-engine/src/ucx.rs
+++ /dev/null
@@ -1,606 +0,0 @@
-//! UCX (Unified Communication X) FFI bindings and high-level wrapper
-//!
-//! UCX is a superior alternative to direct libibverbs for RDMA programming.
-//! It provides production-proven abstractions and automatic transport selection.
-//!
-//! References:
-//! - UCX Documentation: https://openucx.readthedocs.io/
-//! - UCX GitHub: https://github.com/openucx/ucx
-//! - UCX Paper: "UCX: an open source framework for HPC network APIs and beyond"
-
-use crate::{RdmaError, RdmaResult};
-use libc::{c_char, c_int, c_void, size_t};
-use libloading::{Library, Symbol};
-use parking_lot::Mutex;
-use std::collections::HashMap;
-use std::ffi::CStr;
-use std::ptr;
-use std::sync::Arc;
-use tracing::{debug, info, warn, error};
-
-/// UCX context handle
-pub type UcpContext = *mut c_void;
-/// UCX worker handle  
-pub type UcpWorker = *mut c_void;
-/// UCX endpoint handle
-pub type UcpEp = *mut c_void;
-/// UCX memory handle
-pub type UcpMem = *mut c_void;
-/// UCX request handle
-pub type UcpRequest = *mut c_void;
-
-/// UCX configuration parameters
-#[repr(C)]
-pub struct UcpParams {
-    pub field_mask: u64,
-    pub features: u64,
-    pub request_size: size_t,
-    pub request_init: extern "C" fn(*mut c_void),
-    pub request_cleanup: extern "C" fn(*mut c_void),
-    pub tag_sender_mask: u64,
-}
-
-/// UCX worker parameters
-#[repr(C)]
-pub struct UcpWorkerParams {
-    pub field_mask: u64,
-    pub thread_mode: c_int,
-    pub cpu_mask: u64,
-    pub events: c_int,
-    pub user_data: *mut c_void,
-}
-
-/// UCX endpoint parameters
-#[repr(C)]
-pub struct UcpEpParams {
-    pub field_mask: u64,
-    pub address: *const c_void,
-    pub flags: u64,
-    pub sock_addr: *const c_void,
-    pub err_handler: UcpErrHandler,
-    pub user_data: *mut c_void,
-}
-
-/// UCX memory mapping parameters
-#[repr(C)]
-pub struct UcpMemMapParams {
-    pub field_mask: u64,
-    pub address: *mut c_void,
-    pub length: size_t,
-    pub flags: u64,
-    pub prot: c_int,
-}
-
-/// UCX error handler callback
-pub type UcpErrHandler = extern "C" fn(
-    arg: *mut c_void,
-    ep: UcpEp,
-    status: c_int,
-);
-
-/// UCX request callback
-pub type UcpSendCallback = extern "C" fn(
-    request: *mut c_void,
-    status: c_int,
-    user_data: *mut c_void,
-);
-
-/// UCX feature flags
-pub const UCP_FEATURE_TAG: u64 = 1 << 0;
-pub const UCP_FEATURE_RMA: u64 = 1 << 1;
-pub const UCP_FEATURE_ATOMIC32: u64 = 1 << 2;
-pub const UCP_FEATURE_ATOMIC64: u64 = 1 << 3;
-pub const UCP_FEATURE_WAKEUP: u64 = 1 << 4;
-pub const UCP_FEATURE_STREAM: u64 = 1 << 5;
-
-/// UCX parameter field masks
-pub const UCP_PARAM_FIELD_FEATURES: u64 = 1 << 0;
-pub const UCP_PARAM_FIELD_REQUEST_SIZE: u64 = 1 << 1;
-pub const UCP_PARAM_FIELD_REQUEST_INIT: u64 = 1 << 2;
-pub const UCP_PARAM_FIELD_REQUEST_CLEANUP: u64 = 1 << 3;
-pub const UCP_PARAM_FIELD_TAG_SENDER_MASK: u64 = 1 << 4;
-
-pub const UCP_WORKER_PARAM_FIELD_THREAD_MODE: u64 = 1 << 0;
-pub const UCP_WORKER_PARAM_FIELD_CPU_MASK: u64 = 1 << 1;
-pub const UCP_WORKER_PARAM_FIELD_EVENTS: u64 = 1 << 2;
-pub const UCP_WORKER_PARAM_FIELD_USER_DATA: u64 = 1 << 3;
-
-pub const UCP_EP_PARAM_FIELD_REMOTE_ADDRESS: u64 = 1 << 0;
-pub const UCP_EP_PARAM_FIELD_FLAGS: u64 = 1 << 1;
-pub const UCP_EP_PARAM_FIELD_SOCK_ADDR: u64 = 1 << 2;
-pub const UCP_EP_PARAM_FIELD_ERR_HANDLER: u64 = 1 << 3;
-pub const UCP_EP_PARAM_FIELD_USER_DATA: u64 = 1 << 4;
-
-pub const UCP_MEM_MAP_PARAM_FIELD_ADDRESS: u64 = 1 << 0;
-pub const UCP_MEM_MAP_PARAM_FIELD_LENGTH: u64 = 1 << 1;
-pub const UCP_MEM_MAP_PARAM_FIELD_FLAGS: u64 = 1 << 2;
-pub const UCP_MEM_MAP_PARAM_FIELD_PROT: u64 = 1 << 3;
-
-/// UCX status codes
-pub const UCS_OK: c_int = 0;
-pub const UCS_INPROGRESS: c_int = 1;
-pub const UCS_ERR_NO_MESSAGE: c_int = -1;
-pub const UCS_ERR_NO_RESOURCE: c_int = -2;
-pub const UCS_ERR_IO_ERROR: c_int = -3;
-pub const UCS_ERR_NO_MEMORY: c_int = -4;
-pub const UCS_ERR_INVALID_PARAM: c_int = -5;
-pub const UCS_ERR_UNREACHABLE: c_int = -6;
-pub const UCS_ERR_INVALID_ADDR: c_int = -7;
-pub const UCS_ERR_NOT_IMPLEMENTED: c_int = -8;
-pub const UCS_ERR_MESSAGE_TRUNCATED: c_int = -9;
-pub const UCS_ERR_NO_PROGRESS: c_int = -10;
-pub const UCS_ERR_BUFFER_TOO_SMALL: c_int = -11;
-pub const UCS_ERR_NO_ELEM: c_int = -12;
-pub const UCS_ERR_SOME_CONNECTS_FAILED: c_int = -13;
-pub const UCS_ERR_NO_DEVICE: c_int = -14;
-pub const UCS_ERR_BUSY: c_int = -15;
-pub const UCS_ERR_CANCELED: c_int = -16;
-pub const UCS_ERR_SHMEM_SEGMENT: c_int = -17;
-pub const UCS_ERR_ALREADY_EXISTS: c_int = -18;
-pub const UCS_ERR_OUT_OF_RANGE: c_int = -19;
-pub const UCS_ERR_TIMED_OUT: c_int = -20;
-
-/// UCX memory protection flags  
-pub const UCP_MEM_MAP_NONBLOCK: u64 = 1 << 0;
-pub const UCP_MEM_MAP_ALLOCATE: u64 = 1 << 1;
-pub const UCP_MEM_MAP_FIXED: u64 = 1 << 2;
-
-/// UCX FFI function signatures
-pub struct UcxApi {
-    pub ucp_init: Symbol<'static, unsafe extern "C" fn(*const UcpParams, *const c_void, *mut UcpContext) -> c_int>,
-    pub ucp_cleanup: Symbol<'static, unsafe extern "C" fn(UcpContext)>,
-    pub ucp_worker_create: Symbol<'static, unsafe extern "C" fn(UcpContext, *const UcpWorkerParams, *mut UcpWorker) -> c_int>,
-    pub ucp_worker_destroy: Symbol<'static, unsafe extern "C" fn(UcpWorker)>,
-    pub ucp_ep_create: Symbol<'static, unsafe extern "C" fn(UcpWorker, *const UcpEpParams, *mut UcpEp) -> c_int>,
-    pub ucp_ep_destroy: Symbol<'static, unsafe extern "C" fn(UcpEp)>,
-    pub ucp_mem_map: Symbol<'static, unsafe extern "C" fn(UcpContext, *const UcpMemMapParams, *mut UcpMem) -> c_int>,
-    pub ucp_mem_unmap: Symbol<'static, unsafe extern "C" fn(UcpContext, UcpMem) -> c_int>,
-    pub ucp_put_nb: Symbol<'static, unsafe extern "C" fn(UcpEp, *const c_void, size_t, u64, u64, UcpSendCallback) -> UcpRequest>,
-    pub ucp_get_nb: Symbol<'static, unsafe extern "C" fn(UcpEp, *mut c_void, size_t, u64, u64, UcpSendCallback) -> UcpRequest>,
-    pub ucp_worker_progress: Symbol<'static, unsafe extern "C" fn(UcpWorker) -> c_int>,
-    pub ucp_request_check_status: Symbol<'static, unsafe extern "C" fn(UcpRequest) -> c_int>,
-    pub ucp_request_free: Symbol<'static, unsafe extern "C" fn(UcpRequest)>,
-    pub ucp_worker_get_address: Symbol<'static, unsafe extern "C" fn(UcpWorker, *mut *mut c_void, *mut size_t) -> c_int>,
-    pub ucp_worker_release_address: Symbol<'static, unsafe extern "C" fn(UcpWorker, *mut c_void)>,
-    pub ucs_status_string: Symbol<'static, unsafe extern "C" fn(c_int) -> *const c_char>,
-}
-
-impl UcxApi {
-    /// Load UCX library and resolve symbols
-    pub fn load() -> RdmaResult<Self> {
-        info!("🔗 Loading UCX library");
-        
-        // Try to load UCX library
-        let lib_names = [
-            "libucp.so.0",      // Most common
-            "libucp.so",        // Generic
-            "libucp.dylib",     // macOS
-            "/usr/lib/x86_64-linux-gnu/libucp.so.0",  // Ubuntu/Debian
-            "/usr/lib64/libucp.so.0",                 // RHEL/CentOS
-        ];
-        
-        let library = lib_names.iter()
-            .find_map(|name| {
-                debug!("Trying to load UCX library: {}", name);
-                match unsafe { Library::new(name) } {
-                    Ok(lib) => {
-                        info!("✅ Successfully loaded UCX library: {}", name);
-                        Some(lib)
-                    }
-                    Err(e) => {
-                        debug!("Failed to load {}: {}", name, e);
-                        None
-                    }
-                }
-            })
-            .ok_or_else(|| RdmaError::context_init_failed("UCX library not found"))?;
-
-        // Leak the library to get 'static lifetime for symbols
-        let library: &'static Library = Box::leak(Box::new(library));
-        
-        unsafe {
-            Ok(UcxApi {
-                ucp_init: library.get(b"ucp_init")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_init symbol: {}", e)))?,
-                ucp_cleanup: library.get(b"ucp_cleanup")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_cleanup symbol: {}", e)))?,
-                ucp_worker_create: library.get(b"ucp_worker_create")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_worker_create symbol: {}", e)))?,
-                ucp_worker_destroy: library.get(b"ucp_worker_destroy")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_worker_destroy symbol: {}", e)))?,
-                ucp_ep_create: library.get(b"ucp_ep_create")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_ep_create symbol: {}", e)))?,
-                ucp_ep_destroy: library.get(b"ucp_ep_destroy")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_ep_destroy symbol: {}", e)))?,
-                ucp_mem_map: library.get(b"ucp_mem_map")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_mem_map symbol: {}", e)))?,
-                ucp_mem_unmap: library.get(b"ucp_mem_unmap")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_mem_unmap symbol: {}", e)))?,
-                ucp_put_nb: library.get(b"ucp_put_nb")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_put_nb symbol: {}", e)))?,
-                ucp_get_nb: library.get(b"ucp_get_nb")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_get_nb symbol: {}", e)))?,
-                ucp_worker_progress: library.get(b"ucp_worker_progress")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_worker_progress symbol: {}", e)))?,
-                ucp_request_check_status: library.get(b"ucp_request_check_status")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_request_check_status symbol: {}", e)))?,
-                ucp_request_free: library.get(b"ucp_request_free")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_request_free symbol: {}", e)))?,
-                ucp_worker_get_address: library.get(b"ucp_worker_get_address")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_worker_get_address symbol: {}", e)))?,
-                ucp_worker_release_address: library.get(b"ucp_worker_release_address")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucp_worker_release_address symbol: {}", e)))?,
-                ucs_status_string: library.get(b"ucs_status_string")
-                    .map_err(|e| RdmaError::context_init_failed(format!("ucs_status_string symbol: {}", e)))?,
-            })
-        }
-    }
-    
-    /// Convert UCX status code to human-readable string
-    pub fn status_string(&self, status: c_int) -> String {
-        unsafe {
-            let c_str = (self.ucs_status_string)(status);
-            if c_str.is_null() {
-                format!("Unknown status: {}", status)
-            } else {
-                CStr::from_ptr(c_str).to_string_lossy().to_string()
-            }
-        }
-    }
-}
-
-/// High-level UCX context wrapper
-pub struct UcxContext {
-    api: Arc<UcxApi>,
-    context: UcpContext,
-    worker: UcpWorker,
-    worker_address: Vec<u8>,
-    endpoints: Mutex<HashMap<String, UcpEp>>,
-    memory_regions: Mutex<HashMap<u64, UcpMem>>,
-}
-
-impl UcxContext {
-    /// Initialize UCX context with RMA support
-    pub async fn new() -> RdmaResult<Self> {
-        info!("🚀 Initializing UCX context for RDMA operations");
-        
-        let api = Arc::new(UcxApi::load()?);
-        
-        // Initialize UCP context
-        let params = UcpParams {
-            field_mask: UCP_PARAM_FIELD_FEATURES,
-            features: UCP_FEATURE_RMA | UCP_FEATURE_WAKEUP,
-            request_size: 0,
-            request_init: request_init_cb,
-            request_cleanup: request_cleanup_cb,
-            tag_sender_mask: 0,
-        };
-        
-        let mut context = ptr::null_mut();
-        let status = unsafe { (api.ucp_init)(&params, ptr::null(), &mut context) };
-        if status != UCS_OK {
-            return Err(RdmaError::context_init_failed(format!(
-                "ucp_init failed: {} ({})", 
-                api.status_string(status), status
-            )));
-        }
-        
-        info!("✅ UCX context initialized successfully");
-        
-        // Create worker
-        let worker_params = UcpWorkerParams {
-            field_mask: UCP_WORKER_PARAM_FIELD_THREAD_MODE,
-            thread_mode: 0, // Single-threaded
-            cpu_mask: 0,
-            events: 0,
-            user_data: ptr::null_mut(),
-        };
-        
-        let mut worker = ptr::null_mut();
-        let status = unsafe { (api.ucp_worker_create)(context, &worker_params, &mut worker) };
-        if status != UCS_OK {
-            unsafe { (api.ucp_cleanup)(context) };
-            return Err(RdmaError::context_init_failed(format!(
-                "ucp_worker_create failed: {} ({})",
-                api.status_string(status), status
-            )));
-        }
-        
-        info!("✅ UCX worker created successfully");
-        
-        // Get worker address for connection establishment
-        let mut address_ptr = ptr::null_mut();
-        let mut address_len = 0;
-        let status = unsafe { (api.ucp_worker_get_address)(worker, &mut address_ptr, &mut address_len) };
-        if status != UCS_OK {
-            unsafe { 
-                (api.ucp_worker_destroy)(worker);
-                (api.ucp_cleanup)(context);
-            }
-            return Err(RdmaError::context_init_failed(format!(
-                "ucp_worker_get_address failed: {} ({})",
-                api.status_string(status), status
-            )));
-        }
-        
-        let worker_address = unsafe {
-            std::slice::from_raw_parts(address_ptr as *const u8, address_len).to_vec()
-        };
-        
-        unsafe { (api.ucp_worker_release_address)(worker, address_ptr) };
-        
-        info!("✅ UCX worker address obtained ({} bytes)", worker_address.len());
-        
-        Ok(UcxContext {
-            api,
-            context,
-            worker,
-            worker_address,
-            endpoints: Mutex::new(HashMap::new()),
-            memory_regions: Mutex::new(HashMap::new()),
-        })
-    }
-    
-    /// Map memory for RDMA operations
-    pub async fn map_memory(&self, addr: u64, size: usize) -> RdmaResult<u64> {
-        debug!("📍 Mapping memory for RDMA: addr=0x{:x}, size={}", addr, size);
-        
-        let params = UcpMemMapParams {
-            field_mask: UCP_MEM_MAP_PARAM_FIELD_ADDRESS | UCP_MEM_MAP_PARAM_FIELD_LENGTH,
-            address: addr as *mut c_void,
-            length: size,
-            flags: 0,
-            prot: libc::PROT_READ | libc::PROT_WRITE,
-        };
-        
-        let mut mem_handle = ptr::null_mut();
-        let status = unsafe { (self.api.ucp_mem_map)(self.context, &params, &mut mem_handle) };
-        
-        if status != UCS_OK {
-            return Err(RdmaError::memory_reg_failed(format!(
-                "ucp_mem_map failed: {} ({})",
-                self.api.status_string(status), status
-            )));
-        }
-        
-        // Store memory handle for cleanup
-        {
-            let mut regions = self.memory_regions.lock();
-            regions.insert(addr, mem_handle);
-        }
-        
-        info!("✅ Memory mapped successfully: addr=0x{:x}, size={}", addr, size);
-        Ok(addr) // Return the same address as remote key equivalent
-    }
-    
-    /// Unmap memory
-    pub async fn unmap_memory(&self, addr: u64) -> RdmaResult<()> {
-        debug!("🗑️ Unmapping memory: addr=0x{:x}", addr);
-        
-        let mem_handle = {
-            let mut regions = self.memory_regions.lock();
-            regions.remove(&addr)
-        };
-        
-        if let Some(handle) = mem_handle {
-            let status = unsafe { (self.api.ucp_mem_unmap)(self.context, handle) };
-            if status != UCS_OK {
-                warn!("ucp_mem_unmap failed: {} ({})", 
-                      self.api.status_string(status), status);
-            }
-        }
-        
-        Ok(())
-    }
-    
-    /// Perform RDMA GET (read from remote memory)
-    pub async fn get(&self, local_addr: u64, remote_addr: u64, size: usize) -> RdmaResult<()> {
-        debug!("📥 RDMA GET: local=0x{:x}, remote=0x{:x}, size={}", 
-               local_addr, remote_addr, size);
-        
-        // For now, use a simple synchronous approach
-        // In production, this would be properly async with completion callbacks
-        
-        // Find or create endpoint (simplified - would need proper address resolution)
-        let ep = self.get_or_create_endpoint("default").await?;
-        
-        let request = unsafe {
-            (self.api.ucp_get_nb)(
-                ep,
-                local_addr as *mut c_void,
-                size,
-                remote_addr,
-                0, // No remote key needed with UCX
-                get_completion_cb,
-            )
-        };
-        
-        // Wait for completion
-        if !request.is_null() {
-            loop {
-                let status = unsafe { (self.api.ucp_request_check_status)(request) };
-                if status != UCS_INPROGRESS {
-                    unsafe { (self.api.ucp_request_free)(request) };
-                    if status == UCS_OK {
-                        break;
-                    } else {
-                        return Err(RdmaError::operation_failed(
-                            "RDMA GET", status
-                        ));
-                    }
-                }
-                
-                // Progress the worker
-                unsafe { (self.api.ucp_worker_progress)(self.worker) };
-                tokio::task::yield_now().await;
-            }
-        }
-        
-        info!("✅ RDMA GET completed successfully");
-        Ok(())
-    }
-    
-    /// Perform RDMA PUT (write to remote memory)
-    pub async fn put(&self, local_addr: u64, remote_addr: u64, size: usize) -> RdmaResult<()> {
-        debug!("📤 RDMA PUT: local=0x{:x}, remote=0x{:x}, size={}", 
-               local_addr, remote_addr, size);
-        
-        let ep = self.get_or_create_endpoint("default").await?;
-        
-        let request = unsafe {
-            (self.api.ucp_put_nb)(
-                ep,
-                local_addr as *const c_void,
-                size,
-                remote_addr,
-                0, // No remote key needed with UCX
-                put_completion_cb,
-            )
-        };
-        
-        // Wait for completion (same pattern as GET)
-        if !request.is_null() {
-            loop {
-                let status = unsafe { (self.api.ucp_request_check_status)(request) };
-                if status != UCS_INPROGRESS {
-                    unsafe { (self.api.ucp_request_free)(request) };
-                    if status == UCS_OK {
-                        break;
-                    } else {
-                        return Err(RdmaError::operation_failed(
-                            "RDMA PUT", status
-                        ));
-                    }
-                }
-                
-                unsafe { (self.api.ucp_worker_progress)(self.worker) };
-                tokio::task::yield_now().await;
-            }
-        }
-        
-        info!("✅ RDMA PUT completed successfully");
-        Ok(())
-    }
-    
-    /// Get worker address for connection establishment
-    pub fn worker_address(&self) -> &[u8] {
-        &self.worker_address
-    }
-    
-    /// Create endpoint for communication (simplified version)
-    async fn get_or_create_endpoint(&self, key: &str) -> RdmaResult<UcpEp> {
-        let mut endpoints = self.endpoints.lock();
-        
-        if let Some(&ep) = endpoints.get(key) {
-            return Ok(ep);
-        }
-        
-        // For simplicity, create a dummy endpoint
-        // In production, this would use actual peer address
-        let ep_params = UcpEpParams {
-            field_mask: 0, // Simplified for mock
-            address: ptr::null(),
-            flags: 0,
-            sock_addr: ptr::null(),
-            err_handler: error_handler_cb,
-            user_data: ptr::null_mut(),
-        };
-        
-        let mut endpoint = ptr::null_mut();
-        let status = unsafe { (self.api.ucp_ep_create)(self.worker, &ep_params, &mut endpoint) };
-        
-        if status != UCS_OK {
-            return Err(RdmaError::context_init_failed(format!(
-                "ucp_ep_create failed: {} ({})",
-                self.api.status_string(status), status
-            )));
-        }
-        
-        endpoints.insert(key.to_string(), endpoint);
-        Ok(endpoint)
-    }
-}
-
-impl Drop for UcxContext {
-    fn drop(&mut self) {
-        info!("🧹 Cleaning up UCX context");
-        
-        // Clean up endpoints
-        {
-            let mut endpoints = self.endpoints.lock();
-            for (_, ep) in endpoints.drain() {
-                unsafe { (self.api.ucp_ep_destroy)(ep) };
-            }
-        }
-        
-        // Clean up memory regions
-        {
-            let mut regions = self.memory_regions.lock();
-            for (_, handle) in regions.drain() {
-                unsafe { (self.api.ucp_mem_unmap)(self.context, handle) };
-            }
-        }
-        
-        // Clean up worker and context
-        unsafe {
-            (self.api.ucp_worker_destroy)(self.worker);
-            (self.api.ucp_cleanup)(self.context);
-        }
-        
-        info!("✅ UCX context cleanup completed");
-    }
-}
-
-// UCX callback functions
-extern "C" fn request_init_cb(_request: *mut c_void) {
-    // Request initialization callback
-}
-
-extern "C" fn request_cleanup_cb(_request: *mut c_void) {
-    // Request cleanup callback
-}
-
-extern "C" fn get_completion_cb(_request: *mut c_void, status: c_int, _user_data: *mut c_void) {
-    if status != UCS_OK {
-        error!("RDMA GET completion error: {}", status);
-    }
-}
-
-extern "C" fn put_completion_cb(_request: *mut c_void, status: c_int, _user_data: *mut c_void) {
-    if status != UCS_OK {
-        error!("RDMA PUT completion error: {}", status);
-    }
-}
-
-extern "C" fn error_handler_cb(
-    _arg: *mut c_void,
-    _ep: UcpEp,
-    status: c_int,
-) {
-    error!("UCX endpoint error: {}", status);
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    
-    #[tokio::test]
-    async fn test_ucx_api_loading() {
-        // This test will fail without UCX installed, which is expected
-        match UcxApi::load() {
-            Ok(api) => {
-                info!("UCX API loaded successfully");
-                assert_eq!(api.status_string(UCS_OK), "Success");
-            }
-            Err(_) => {
-                warn!("UCX library not found - expected in development environment");
-            }
-        }
-    }
-    
-    #[tokio::test]
-    async fn test_ucx_context_mock() {
-        // This would test the mock implementation
-        // Real test requires UCX installation
-    }
-}
diff --git a/seaweedfs-rdma-sidecar/scripts/demo-e2e.sh b/seaweedfs-rdma-sidecar/scripts/demo-e2e.sh
deleted file mode 100755
index 54a751e579..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/demo-e2e.sh
+++ /dev/null
@@ -1,314 +0,0 @@
-#!/bin/bash
-
-# SeaweedFS RDMA End-to-End Demo Script
-# This script demonstrates the complete integration between SeaweedFS and the RDMA sidecar
-
-set -e
-
-# Configuration
-RDMA_ENGINE_SOCKET="/tmp/rdma-engine.sock"
-DEMO_SERVER_PORT=8080
-RUST_ENGINE_PID=""
-DEMO_SERVER_PID=""
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-PURPLE='\033[0;35m'
-CYAN='\033[0;36m'
-NC='\033[0m' # No Color
-
-print_header() {
-    echo -e "\n${PURPLE}===============================================${NC}"
-    echo -e "${PURPLE}$1${NC}"
-    echo -e "${PURPLE}===============================================${NC}\n"
-}
-
-print_step() {
-    echo -e "${CYAN}🔵 $1${NC}"
-}
-
-print_success() {
-    echo -e "${GREEN}✅ $1${NC}"
-}
-
-print_warning() {
-    echo -e "${YELLOW}⚠️  $1${NC}"
-}
-
-print_error() {
-    echo -e "${RED}❌ $1${NC}"
-}
-
-cleanup() {
-    print_header "CLEANUP"
-    
-    if [[ -n "$DEMO_SERVER_PID" ]]; then
-        print_step "Stopping demo server (PID: $DEMO_SERVER_PID)"
-        kill $DEMO_SERVER_PID 2>/dev/null || true
-        wait $DEMO_SERVER_PID 2>/dev/null || true
-    fi
-    
-    if [[ -n "$RUST_ENGINE_PID" ]]; then
-        print_step "Stopping Rust RDMA engine (PID: $RUST_ENGINE_PID)"
-        kill $RUST_ENGINE_PID 2>/dev/null || true
-        wait $RUST_ENGINE_PID 2>/dev/null || true
-    fi
-    
-    # Clean up socket
-    rm -f "$RDMA_ENGINE_SOCKET"
-    
-    print_success "Cleanup complete"
-}
-
-# Set up cleanup on exit
-trap cleanup EXIT
-
-build_components() {
-    print_header "BUILDING COMPONENTS"
-    
-    print_step "Building Go components..."
-    go build -o bin/demo-server ./cmd/demo-server
-    go build -o bin/test-rdma ./cmd/test-rdma
-    go build -o bin/sidecar ./cmd/sidecar
-    print_success "Go components built"
-    
-    print_step "Building Rust RDMA engine..."
-    cd rdma-engine
-    cargo build --release
-    cd ..
-    print_success "Rust RDMA engine built"
-}
-
-start_rdma_engine() {
-    print_header "STARTING RDMA ENGINE"
-    
-    print_step "Starting Rust RDMA engine..."
-    ./rdma-engine/target/release/rdma-engine-server --debug &
-    RUST_ENGINE_PID=$!
-    
-    # Wait for engine to be ready
-    print_step "Waiting for RDMA engine to be ready..."
-    for i in {1..10}; do
-        if [[ -S "$RDMA_ENGINE_SOCKET" ]]; then
-            print_success "RDMA engine ready (PID: $RUST_ENGINE_PID)"
-            return 0
-        fi
-        sleep 1
-    done
-    
-    print_error "RDMA engine failed to start"
-    exit 1
-}
-
-start_demo_server() {
-    print_header "STARTING DEMO SERVER"
-    
-    print_step "Starting SeaweedFS RDMA demo server..."
-    ./bin/demo-server --port $DEMO_SERVER_PORT --rdma-socket "$RDMA_ENGINE_SOCKET" --enable-rdma --debug &
-    DEMO_SERVER_PID=$!
-    
-    # Wait for server to be ready
-    print_step "Waiting for demo server to be ready..."
-    for i in {1..10}; do
-        if curl -s "http://localhost:$DEMO_SERVER_PORT/health" > /dev/null 2>&1; then
-            print_success "Demo server ready (PID: $DEMO_SERVER_PID)"
-            return 0
-        fi
-        sleep 1
-    done
-    
-    print_error "Demo server failed to start"
-    exit 1
-}
-
-test_health_check() {
-    print_header "HEALTH CHECK TEST"
-    
-    print_step "Testing health endpoint..."
-    response=$(curl -s "http://localhost:$DEMO_SERVER_PORT/health")
-    
-    if echo "$response" | jq -e '.status == "healthy"' > /dev/null; then
-        print_success "Health check passed"
-        echo "$response" | jq '.'
-    else
-        print_error "Health check failed"
-        echo "$response"
-        exit 1
-    fi
-}
-
-test_capabilities() {
-    print_header "CAPABILITIES TEST"
-    
-    print_step "Testing capabilities endpoint..."
-    response=$(curl -s "http://localhost:$DEMO_SERVER_PORT/stats")
-    
-    if echo "$response" | jq -e '.enabled == true' > /dev/null; then
-        print_success "RDMA capabilities retrieved"
-        echo "$response" | jq '.'
-    else
-        print_warning "RDMA not enabled, but HTTP fallback available"
-        echo "$response" | jq '.'
-    fi
-}
-
-test_needle_read() {
-    print_header "NEEDLE READ TEST"
-    
-    print_step "Testing RDMA needle read..."
-    response=$(curl -s "http://localhost:$DEMO_SERVER_PORT/read?volume=1&needle=12345&cookie=305419896&size=1024")
-    
-    if echo "$response" | jq -e '.success == true' > /dev/null; then
-        is_rdma=$(echo "$response" | jq -r '.is_rdma')
-        source=$(echo "$response" | jq -r '.source')
-        duration=$(echo "$response" | jq -r '.duration')
-        data_size=$(echo "$response" | jq -r '.data_size')
-        
-        if [[ "$is_rdma" == "true" ]]; then
-            print_success "RDMA fast path used! Duration: $duration, Size: $data_size bytes"
-        else
-            print_warning "HTTP fallback used. Duration: $duration, Size: $data_size bytes"
-        fi
-        
-        echo "$response" | jq '.'
-    else
-        print_error "Needle read failed"
-        echo "$response"
-        exit 1
-    fi
-}
-
-test_benchmark() {
-    print_header "PERFORMANCE BENCHMARK"
-    
-    print_step "Running performance benchmark..."
-    response=$(curl -s "http://localhost:$DEMO_SERVER_PORT/benchmark?iterations=5&size=2048")
-    
-    if echo "$response" | jq -e '.benchmark_results' > /dev/null; then
-        rdma_ops=$(echo "$response" | jq -r '.benchmark_results.rdma_ops')
-        http_ops=$(echo "$response" | jq -r '.benchmark_results.http_ops')
-        avg_latency=$(echo "$response" | jq -r '.benchmark_results.avg_latency')
-        throughput=$(echo "$response" | jq -r '.benchmark_results.throughput_mbps')
-        ops_per_sec=$(echo "$response" | jq -r '.benchmark_results.ops_per_sec')
-        
-        print_success "Benchmark completed:"
-        echo -e "  ${BLUE}RDMA Operations:${NC} $rdma_ops"
-        echo -e "  ${BLUE}HTTP Operations:${NC} $http_ops"
-        echo -e "  ${BLUE}Average Latency:${NC} $avg_latency"
-        echo -e "  ${BLUE}Throughput:${NC} $throughput MB/s"
-        echo -e "  ${BLUE}Operations/sec:${NC} $ops_per_sec"
-        
-        echo -e "\n${BLUE}Full benchmark results:${NC}"
-        echo "$response" | jq '.benchmark_results'
-    else
-        print_error "Benchmark failed"
-        echo "$response"
-        exit 1
-    fi
-}
-
-test_direct_rdma() {
-    print_header "DIRECT RDMA ENGINE TEST"
-    
-    print_step "Testing direct RDMA engine communication..."
-    
-    echo "Testing ping..."
-    ./bin/test-rdma ping 2>/dev/null && print_success "Direct RDMA ping successful" || print_warning "Direct RDMA ping failed"
-    
-    echo -e "\nTesting capabilities..."
-    ./bin/test-rdma capabilities 2>/dev/null | head -15 && print_success "Direct RDMA capabilities successful" || print_warning "Direct RDMA capabilities failed"
-    
-    echo -e "\nTesting direct read..."
-    ./bin/test-rdma read --volume 1 --needle 12345 --size 1024 2>/dev/null > /dev/null && print_success "Direct RDMA read successful" || print_warning "Direct RDMA read failed"
-}
-
-show_demo_urls() {
-    print_header "DEMO SERVER INFORMATION"
-    
-    echo -e "${GREEN}🌐 Demo server is running at: http://localhost:$DEMO_SERVER_PORT${NC}"
-    echo -e "${GREEN}📱 Try these URLs:${NC}"
-    echo -e "  ${BLUE}Home page:${NC}          http://localhost:$DEMO_SERVER_PORT/"
-    echo -e "  ${BLUE}Health check:${NC}       http://localhost:$DEMO_SERVER_PORT/health"
-    echo -e "  ${BLUE}Statistics:${NC}         http://localhost:$DEMO_SERVER_PORT/stats"
-    echo -e "  ${BLUE}Read needle:${NC}        http://localhost:$DEMO_SERVER_PORT/read?volume=1&needle=12345&cookie=305419896&size=1024"
-    echo -e "  ${BLUE}Benchmark:${NC}          http://localhost:$DEMO_SERVER_PORT/benchmark?iterations=5&size=2048"
-    
-    echo -e "\n${GREEN}📋 Example curl commands:${NC}"
-    echo -e "  ${CYAN}curl \"http://localhost:$DEMO_SERVER_PORT/health\" | jq '.'${NC}"
-    echo -e "  ${CYAN}curl \"http://localhost:$DEMO_SERVER_PORT/read?volume=1&needle=12345&size=1024\" | jq '.'${NC}"
-    echo -e "  ${CYAN}curl \"http://localhost:$DEMO_SERVER_PORT/benchmark?iterations=10\" | jq '.benchmark_results'${NC}"
-}
-
-interactive_mode() {
-    print_header "INTERACTIVE MODE"
-    
-    show_demo_urls
-    
-    echo -e "\n${YELLOW}Press Enter to run automated tests, or Ctrl+C to exit and explore manually...${NC}"
-    read -r
-}
-
-main() {
-    print_header "🚀 SEAWEEDFS RDMA END-TO-END DEMO"
-    
-    echo -e "${GREEN}This demonstration shows:${NC}"
-    echo -e "  ✅ Complete Go ↔ Rust IPC integration"
-    echo -e "  ✅ SeaweedFS RDMA client with HTTP fallback" 
-    echo -e "  ✅ High-performance needle reads via RDMA"
-    echo -e "  ✅ Performance benchmarking capabilities"
-    echo -e "  ✅ Production-ready error handling and logging"
-    
-    # Check dependencies
-    if ! command -v jq &> /dev/null; then
-        print_error "jq is required for this demo. Please install it: brew install jq"
-        exit 1
-    fi
-    
-    if ! command -v curl &> /dev/null; then
-        print_error "curl is required for this demo."
-        exit 1
-    fi
-    
-    # Build and start components
-    build_components
-    start_rdma_engine
-    sleep 2  # Give engine time to fully initialize
-    start_demo_server
-    sleep 2  # Give server time to connect to engine
-    
-    # Show interactive information
-    interactive_mode
-    
-    # Run automated tests
-    test_health_check
-    test_capabilities
-    test_needle_read
-    test_benchmark
-    test_direct_rdma
-    
-    print_header "🎉 END-TO-END DEMO COMPLETE!"
-    
-    echo -e "${GREEN}All tests passed successfully!${NC}"
-    echo -e "${BLUE}Key achievements demonstrated:${NC}"
-    echo -e "  🚀 RDMA fast path working with mock operations"
-    echo -e "  🔄 Automatic HTTP fallback when RDMA unavailable"
-    echo -e "  📊 Performance monitoring and benchmarking"
-    echo -e "  🛡️  Robust error handling and graceful degradation"
-    echo -e "  🔌 Complete IPC protocol between Go and Rust"
-    echo -e "  ⚡ Session management with proper cleanup"
-    
-    print_success "SeaweedFS RDMA integration is ready for hardware deployment!"
-    
-    # Keep server running for manual testing
-    echo -e "\n${YELLOW}Demo server will continue running for manual testing...${NC}"
-    echo -e "${YELLOW}Press Ctrl+C to shutdown.${NC}"
-    
-    # Wait for user interrupt
-    wait
-}
-
-# Run the main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/scripts/demo-mount-rdma.sh b/seaweedfs-rdma-sidecar/scripts/demo-mount-rdma.sh
deleted file mode 100755
index 890d6ccc0d..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/demo-mount-rdma.sh
+++ /dev/null
@@ -1,249 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Configuration - assumes script is run from seaweedfs-rdma-sidecar directory
-SEAWEEDFS_DIR="$(realpath ..)"
-SIDECAR_DIR="$(pwd)"
-MOUNT_POINT="/tmp/seaweedfs-rdma-mount"
-FILER_ADDR="localhost:8888"
-SIDECAR_ADDR="localhost:8081"
-
-# PIDs for cleanup
-MASTER_PID=""
-VOLUME_PID=""
-FILER_PID=""
-SIDECAR_PID=""
-MOUNT_PID=""
-
-cleanup() {
-    echo -e "\n${YELLOW}🧹 Cleaning up processes...${NC}"
-    
-    # Unmount filesystem
-    if mountpoint -q "$MOUNT_POINT" 2>/dev/null; then
-        echo "📤 Unmounting $MOUNT_POINT..."
-        fusermount -u "$MOUNT_POINT" 2>/dev/null || umount "$MOUNT_POINT" 2>/dev/null || true
-        sleep 1
-    fi
-    
-    # Kill processes
-    for pid in $MOUNT_PID $SIDECAR_PID $FILER_PID $VOLUME_PID $MASTER_PID; do
-        if [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; then
-            echo "🔪 Killing process $pid..."
-            kill "$pid" 2>/dev/null || true
-        fi
-    done
-    
-    # Wait for processes to exit
-    sleep 2
-    
-    # Force kill if necessary
-    for pid in $MOUNT_PID $SIDECAR_PID $FILER_PID $VOLUME_PID $MASTER_PID; do
-        if [[ -n "$pid" ]] && kill -0 "$pid" 2>/dev/null; then
-            echo "💀 Force killing process $pid..."
-            kill -9 "$pid" 2>/dev/null || true
-        fi
-    done
-    
-    # Clean up mount point
-    if [[ -d "$MOUNT_POINT" ]]; then
-        rmdir "$MOUNT_POINT" 2>/dev/null || true
-    fi
-    
-    echo -e "${GREEN}✅ Cleanup complete${NC}"
-}
-
-trap cleanup EXIT
-
-wait_for_service() {
-    local name=$1
-    local url=$2
-    local max_attempts=30
-    local attempt=1
-    
-    echo -e "${BLUE}⏳ Waiting for $name to be ready...${NC}"
-    
-    while [[ $attempt -le $max_attempts ]]; do
-        if curl -s "$url" >/dev/null 2>&1; then
-            echo -e "${GREEN}✅ $name is ready${NC}"
-            return 0
-        fi
-        echo "   Attempt $attempt/$max_attempts..."
-        sleep 1
-        ((attempt++))
-    done
-    
-    echo -e "${RED}❌ $name failed to start within $max_attempts seconds${NC}"
-    return 1
-}
-
-echo -e "${BLUE}🚀 SEAWEEDFS RDMA MOUNT DEMONSTRATION${NC}"
-echo "======================================"
-echo ""
-echo "This demo shows SeaweedFS mount with RDMA acceleration:"
-echo "  • Standard SeaweedFS cluster (master, volume, filer)"
-echo "  • RDMA sidecar for acceleration"
-echo "  • FUSE mount with RDMA fast path"
-echo "  • Performance comparison tests"
-echo ""
-
-# Create mount point
-echo -e "${BLUE}📁 Creating mount point: $MOUNT_POINT${NC}"
-mkdir -p "$MOUNT_POINT"
-
-# Start SeaweedFS Master
-echo -e "${BLUE}🎯 Starting SeaweedFS Master...${NC}"
-cd "$SEAWEEDFS_DIR"
-./weed master -port=9333 -mdir=/tmp/seaweedfs-master &
-MASTER_PID=$!
-wait_for_service "Master" "http://localhost:9333/cluster/status"
-
-# Start SeaweedFS Volume Server
-echo -e "${BLUE}💾 Starting SeaweedFS Volume Server...${NC}"
-./weed volume -master=localhost:9333 -port=8080 -dir=/tmp/seaweedfs-volume &
-VOLUME_PID=$!
-wait_for_service "Volume Server" "http://localhost:8080/status"
-
-# Start SeaweedFS Filer
-echo -e "${BLUE}📂 Starting SeaweedFS Filer...${NC}"
-./weed filer -master=localhost:9333 -port=8888 &
-FILER_PID=$!
-wait_for_service "Filer" "http://localhost:8888/"
-
-# Start RDMA Sidecar
-echo -e "${BLUE}⚡ Starting RDMA Sidecar...${NC}"
-cd "$SIDECAR_DIR"
-./bin/demo-server --port 8081 --rdma-socket /tmp/rdma-engine.sock --volume-server-url http://localhost:8080 --enable-rdma --debug &
-SIDECAR_PID=$!
-wait_for_service "RDMA Sidecar" "http://localhost:8081/health"
-
-# Check RDMA capabilities
-echo -e "${BLUE}🔍 Checking RDMA capabilities...${NC}"
-curl -s "http://localhost:8081/stats" | jq . || curl -s "http://localhost:8081/stats"
-
-echo ""
-echo -e "${BLUE}🗂️  Mounting SeaweedFS with RDMA acceleration...${NC}"
-
-# Mount with RDMA acceleration
-cd "$SEAWEEDFS_DIR"
-./weed mount \
-    -filer="$FILER_ADDR" \
-    -dir="$MOUNT_POINT" \
-    -rdma.enabled=true \
-    -rdma.sidecar="$SIDECAR_ADDR" \
-    -rdma.fallback=true \
-    -rdma.maxConcurrent=64 \
-    -rdma.timeoutMs=5000 \
-    -debug=true &
-MOUNT_PID=$!
-
-# Wait for mount to be ready
-echo -e "${BLUE}⏳ Waiting for mount to be ready...${NC}"
-sleep 5
-
-# Check if mount is successful
-if ! mountpoint -q "$MOUNT_POINT"; then
-    echo -e "${RED}❌ Mount failed${NC}"
-    exit 1
-fi
-
-echo -e "${GREEN}✅ SeaweedFS mounted successfully with RDMA acceleration!${NC}"
-echo ""
-
-# Demonstrate RDMA-accelerated operations
-echo -e "${BLUE}🧪 TESTING RDMA-ACCELERATED FILE OPERATIONS${NC}"
-echo "=============================================="
-
-# Create test files
-echo -e "${BLUE}📝 Creating test files...${NC}"
-echo "Hello, RDMA World!" > "$MOUNT_POINT/test1.txt"
-echo "This file will be read via RDMA acceleration!" > "$MOUNT_POINT/test2.txt"
-
-# Create a larger test file
-echo -e "${BLUE}📝 Creating larger test file (1MB)...${NC}"
-dd if=/dev/zero of="$MOUNT_POINT/large_test.dat" bs=1024 count=1024 2>/dev/null
-
-echo -e "${GREEN}✅ Test files created${NC}"
-echo ""
-
-# Test file reads
-echo -e "${BLUE}📖 Testing file reads (should use RDMA fast path)...${NC}"
-echo ""
-
-echo "📄 Reading test1.txt:"
-cat "$MOUNT_POINT/test1.txt"
-echo ""
-
-echo "📄 Reading test2.txt:"
-cat "$MOUNT_POINT/test2.txt"
-echo ""
-
-echo "📄 Reading first 100 bytes of large file:"
-head -c 100 "$MOUNT_POINT/large_test.dat" | hexdump -C | head -5
-echo ""
-
-# Performance test
-echo -e "${BLUE}🏁 PERFORMANCE COMPARISON${NC}"
-echo "========================="
-
-echo "🔥 Testing read performance with RDMA acceleration..."
-time_start=$(date +%s%N)
-for i in {1..10}; do
-    cat "$MOUNT_POINT/large_test.dat" > /dev/null
-done
-time_end=$(date +%s%N)
-rdma_time=$((($time_end - $time_start) / 1000000)) # Convert to milliseconds
-
-echo "✅ RDMA-accelerated reads: 10 x 1MB file = ${rdma_time}ms total"
-echo ""
-
-# Check RDMA statistics
-echo -e "${BLUE}📊 RDMA Statistics:${NC}"
-curl -s "http://localhost:8081/stats" | jq . 2>/dev/null || curl -s "http://localhost:8081/stats"
-echo ""
-
-# List files
-echo -e "${BLUE}📋 Files in mounted filesystem:${NC}"
-ls -la "$MOUNT_POINT/"
-echo ""
-
-# Interactive mode
-echo -e "${BLUE}🎮 INTERACTIVE MODE${NC}"
-echo "=================="
-echo ""
-echo "The SeaweedFS filesystem is now mounted at: $MOUNT_POINT"
-echo "RDMA acceleration is active for all read operations!"
-echo ""
-echo "Try these commands:"
-echo "  ls $MOUNT_POINT/"
-echo "  cat $MOUNT_POINT/test1.txt"
-echo "  echo 'New content' > $MOUNT_POINT/new_file.txt"
-echo "  cat $MOUNT_POINT/new_file.txt"
-echo ""
-echo "Monitor RDMA stats: curl http://localhost:8081/stats | jq"
-echo "Check mount status:  mount | grep seaweedfs"
-echo ""
-echo -e "${YELLOW}Press Ctrl+C to stop the demo and cleanup${NC}"
-
-# Keep running until interrupted
-while true; do
-    sleep 5
-    
-    # Check if mount is still active
-    if ! mountpoint -q "$MOUNT_POINT"; then
-        echo -e "${RED}❌ Mount point lost, exiting...${NC}"
-        break
-    fi
-    
-    # Show periodic stats
-    echo -e "${BLUE}📊 Current RDMA stats ($(date)):${NC}"
-    curl -s "http://localhost:8081/stats" | jq '.rdma_enabled, .total_reads, .rdma_reads, .http_fallbacks' 2>/dev/null || echo "Stats unavailable"
-    echo ""
-done
diff --git a/seaweedfs-rdma-sidecar/scripts/mount-health-check.sh b/seaweedfs-rdma-sidecar/scripts/mount-health-check.sh
deleted file mode 100755
index 4565cc6176..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/mount-health-check.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-MOUNT_POINT=${MOUNT_POINT:-"/mnt/seaweedfs"}
-
-# Check if mount point exists and is mounted
-if [[ ! -d "$MOUNT_POINT" ]]; then
-    echo "Mount point $MOUNT_POINT does not exist"
-    exit 1
-fi
-
-if ! mountpoint -q "$MOUNT_POINT"; then
-    echo "Mount point $MOUNT_POINT is not mounted"
-    exit 1
-fi
-
-# Try to list the mount point
-if ! ls "$MOUNT_POINT" >/dev/null 2>&1; then
-    echo "Cannot list mount point $MOUNT_POINT"
-    exit 1
-fi
-
-echo "Mount point $MOUNT_POINT is healthy"
-exit 0
diff --git a/seaweedfs-rdma-sidecar/scripts/mount-helper.sh b/seaweedfs-rdma-sidecar/scripts/mount-helper.sh
deleted file mode 100755
index 4159dd180d..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/mount-helper.sh
+++ /dev/null
@@ -1,150 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Configuration from environment variables
-FILER_ADDR=${FILER_ADDR:-"seaweedfs-filer:8888"}
-RDMA_SIDECAR_ADDR=${RDMA_SIDECAR_ADDR:-"rdma-sidecar:8081"}
-MOUNT_POINT=${MOUNT_POINT:-"/mnt/seaweedfs"}
-RDMA_ENABLED=${RDMA_ENABLED:-"true"}
-RDMA_FALLBACK=${RDMA_FALLBACK:-"true"}
-RDMA_MAX_CONCURRENT=${RDMA_MAX_CONCURRENT:-"64"}
-RDMA_TIMEOUT_MS=${RDMA_TIMEOUT_MS:-"5000"}
-DEBUG=${DEBUG:-"false"}
-
-echo -e "${BLUE}🚀 SeaweedFS RDMA Mount Helper${NC}"
-echo "================================"
-echo "Filer Address: $FILER_ADDR"
-echo "RDMA Sidecar: $RDMA_SIDECAR_ADDR"
-echo "Mount Point: $MOUNT_POINT"
-echo "RDMA Enabled: $RDMA_ENABLED"
-echo "RDMA Fallback: $RDMA_FALLBACK"
-echo "Debug Mode: $DEBUG"
-echo ""
-
-# Function to wait for service
-wait_for_service() {
-    local name=$1
-    local url=$2
-    local max_attempts=30
-    local attempt=1
-    
-    echo -e "${BLUE}⏳ Waiting for $name to be ready...${NC}"
-    
-    while [[ $attempt -le $max_attempts ]]; do
-        if curl -s "$url" >/dev/null 2>&1; then
-            echo -e "${GREEN}✅ $name is ready${NC}"
-            return 0
-        fi
-        echo "   Attempt $attempt/$max_attempts..."
-        sleep 2
-        ((attempt++))
-    done
-    
-    echo -e "${RED}❌ $name failed to be ready within $max_attempts attempts${NC}"
-    return 1
-}
-
-# Function to check RDMA sidecar capabilities
-check_rdma_capabilities() {
-    echo -e "${BLUE}🔍 Checking RDMA capabilities...${NC}"
-    
-    local response
-    if response=$(curl -s "http://$RDMA_SIDECAR_ADDR/stats" 2>/dev/null); then
-        echo "RDMA Sidecar Stats:"
-        echo "$response" | jq . 2>/dev/null || echo "$response"
-        echo ""
-        
-        # Check if RDMA is actually enabled
-        if echo "$response" | grep -q '"rdma_enabled":true'; then
-            echo -e "${GREEN}✅ RDMA is enabled and ready${NC}"
-            return 0
-        else
-            echo -e "${YELLOW}⚠️  RDMA sidecar is running but RDMA is not enabled${NC}"
-            if [[ "$RDMA_FALLBACK" == "true" ]]; then
-                echo -e "${YELLOW}   Will use HTTP fallback${NC}"
-                return 0
-            else
-                return 1
-            fi
-        fi
-    else
-        echo -e "${RED}❌ Failed to get RDMA sidecar stats${NC}"
-        if [[ "$RDMA_FALLBACK" == "true" ]]; then
-            echo -e "${YELLOW}   Will use HTTP fallback${NC}"
-            return 0
-        else
-            return 1
-        fi
-    fi
-}
-
-# Function to cleanup on exit
-cleanup() {
-    echo -e "\n${YELLOW}🧹 Cleaning up...${NC}"
-    
-    # Unmount if mounted
-    if mountpoint -q "$MOUNT_POINT" 2>/dev/null; then
-        echo "📤 Unmounting $MOUNT_POINT..."
-        fusermount3 -u "$MOUNT_POINT" 2>/dev/null || umount "$MOUNT_POINT" 2>/dev/null || true
-        sleep 2
-    fi
-    
-    echo -e "${GREEN}✅ Cleanup complete${NC}"
-}
-
-trap cleanup EXIT INT TERM
-
-# Wait for required services
-echo -e "${BLUE}🔄 Waiting for required services...${NC}"
-wait_for_service "Filer" "http://$FILER_ADDR/"
-
-if [[ "$RDMA_ENABLED" == "true" ]]; then
-    wait_for_service "RDMA Sidecar" "http://$RDMA_SIDECAR_ADDR/health"
-    check_rdma_capabilities
-fi
-
-# Create mount point if it doesn't exist
-echo -e "${BLUE}📁 Preparing mount point...${NC}"
-mkdir -p "$MOUNT_POINT"
-
-# Check if already mounted
-if mountpoint -q "$MOUNT_POINT"; then
-    echo -e "${YELLOW}⚠️  $MOUNT_POINT is already mounted, unmounting first...${NC}"
-    fusermount3 -u "$MOUNT_POINT" 2>/dev/null || umount "$MOUNT_POINT" 2>/dev/null || true
-    sleep 2
-fi
-
-# Build mount command
-MOUNT_CMD="/usr/local/bin/weed mount"
-MOUNT_CMD="$MOUNT_CMD -filer=$FILER_ADDR"
-MOUNT_CMD="$MOUNT_CMD -dir=$MOUNT_POINT"
-MOUNT_CMD="$MOUNT_CMD -allowOthers=true"
-
-# Add RDMA options if enabled
-if [[ "$RDMA_ENABLED" == "true" ]]; then
-    MOUNT_CMD="$MOUNT_CMD -rdma.enabled=true"
-    MOUNT_CMD="$MOUNT_CMD -rdma.sidecar=$RDMA_SIDECAR_ADDR"
-    MOUNT_CMD="$MOUNT_CMD -rdma.fallback=$RDMA_FALLBACK"
-    MOUNT_CMD="$MOUNT_CMD -rdma.maxConcurrent=$RDMA_MAX_CONCURRENT"
-    MOUNT_CMD="$MOUNT_CMD -rdma.timeoutMs=$RDMA_TIMEOUT_MS"
-fi
-
-# Add debug options if enabled
-if [[ "$DEBUG" == "true" ]]; then
-    MOUNT_CMD="$MOUNT_CMD -debug=true -v=2"
-fi
-
-echo -e "${BLUE}🗂️  Starting SeaweedFS mount...${NC}"
-echo "Command: $MOUNT_CMD"
-echo ""
-
-# Execute mount command
-exec $MOUNT_CMD
diff --git a/seaweedfs-rdma-sidecar/scripts/performance-benchmark.sh b/seaweedfs-rdma-sidecar/scripts/performance-benchmark.sh
deleted file mode 100755
index 907cf5a7ab..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/performance-benchmark.sh
+++ /dev/null
@@ -1,208 +0,0 @@
-#!/bin/bash
-
-# Performance Benchmark Script
-# Tests the revolutionary zero-copy + connection pooling optimizations
-
-set -e
-
-echo "🚀 SeaweedFS RDMA Performance Benchmark"
-echo "Testing Zero-Copy Page Cache + Connection Pooling Optimizations"
-echo "=============================================================="
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-PURPLE='\033[0;35m'
-CYAN='\033[0;36m'
-NC='\033[0m' # No Color
-
-# Test configuration
-SIDECAR_URL="http://localhost:8081"
-TEST_VOLUME=1
-TEST_NEEDLE=1
-TEST_COOKIE=1
-ITERATIONS=10
-
-# File sizes to test (representing different optimization thresholds)
-declare -a SIZES=(
-    "4096"     # 4KB - Small file (below zero-copy threshold)
-    "32768"    # 32KB - Medium file (below zero-copy threshold)
-    "65536"    # 64KB - Zero-copy threshold
-    "262144"   # 256KB - Medium zero-copy file
-    "1048576"  # 1MB - Large zero-copy file
-    "10485760" # 10MB - Very large zero-copy file
-)
-
-declare -a SIZE_NAMES=(
-    "4KB"
-    "32KB" 
-    "64KB"
-    "256KB"
-    "1MB"
-    "10MB"
-)
-
-# Function to check if sidecar is ready
-check_sidecar() {
-    echo -n "Waiting for RDMA sidecar to be ready..."
-    for i in {1..30}; do
-        if curl -s "$SIDECAR_URL/health" > /dev/null 2>&1; then
-            echo -e " ${GREEN}✓ Ready${NC}"
-            return 0
-        fi
-        echo -n "."
-        sleep 2
-    done
-    echo -e " ${RED}✗ Failed${NC}"
-    return 1
-}
-
-# Function to perform benchmark for a specific size
-benchmark_size() {
-    local size=$1
-    local size_name=$2
-    
-    echo -e "\n${CYAN}📊 Testing ${size_name} files (${size} bytes)${NC}"
-    echo "----------------------------------------"
-    
-    local total_time=0
-    local rdma_count=0
-    local zerocopy_count=0
-    local pooled_count=0
-    
-    for i in $(seq 1 $ITERATIONS); do
-        echo -n "  Iteration $i/$ITERATIONS: "
-        
-        # Make request with volume_server parameter
-        local start_time=$(date +%s%N)
-        local response=$(curl -s "$SIDECAR_URL/read?volume=$TEST_VOLUME&needle=$TEST_NEEDLE&cookie=$TEST_COOKIE&size=$size&volume_server=http://seaweedfs-volume:8080")
-        local end_time=$(date +%s%N)
-        
-        # Calculate duration in milliseconds
-        local duration_ns=$((end_time - start_time))
-        local duration_ms=$((duration_ns / 1000000))
-        
-        total_time=$((total_time + duration_ms))
-        
-        # Parse response to check optimization flags
-        local is_rdma=$(echo "$response" | jq -r '.is_rdma // false' 2>/dev/null || echo "false")
-        local source=$(echo "$response" | jq -r '.source // "unknown"' 2>/dev/null || echo "unknown")
-        local use_temp_file=$(echo "$response" | jq -r '.use_temp_file // false' 2>/dev/null || echo "false")
-        
-        # Count optimization usage
-        if [[ "$is_rdma" == "true" ]]; then
-            rdma_count=$((rdma_count + 1))
-        fi
-        
-        if [[ "$source" == *"zerocopy"* ]] || [[ "$use_temp_file" == "true" ]]; then
-            zerocopy_count=$((zerocopy_count + 1))
-        fi
-        
-        if [[ "$source" == *"pooled"* ]]; then
-            pooled_count=$((pooled_count + 1))
-        fi
-        
-        # Display result with color coding
-        if [[ "$source" == "rdma-zerocopy" ]]; then
-            echo -e "${GREEN}${duration_ms}ms (RDMA+ZeroCopy)${NC}"
-        elif [[ "$is_rdma" == "true" ]]; then
-            echo -e "${YELLOW}${duration_ms}ms (RDMA)${NC}"
-        else
-            echo -e "${RED}${duration_ms}ms (HTTP)${NC}"
-        fi
-    done
-    
-    # Calculate statistics
-    local avg_time=$((total_time / ITERATIONS))
-    local rdma_percentage=$((rdma_count * 100 / ITERATIONS))
-    local zerocopy_percentage=$((zerocopy_count * 100 / ITERATIONS))
-    local pooled_percentage=$((pooled_count * 100 / ITERATIONS))
-    
-    echo -e "\n${PURPLE}📈 Results for ${size_name}:${NC}"
-    echo "  Average latency: ${avg_time}ms"
-    echo "  RDMA usage: ${rdma_percentage}%"
-    echo "  Zero-copy usage: ${zerocopy_percentage}%"
-    echo "  Connection pooling: ${pooled_percentage}%"
-    
-    # Performance assessment
-    if [[ $zerocopy_percentage -gt 80 ]]; then
-        echo -e "  ${GREEN}🔥 REVOLUTIONARY: Zero-copy optimization active!${NC}"
-    elif [[ $rdma_percentage -gt 80 ]]; then
-        echo -e "  ${YELLOW}⚡ EXCELLENT: RDMA acceleration active${NC}"
-    else
-        echo -e "  ${RED}⚠️  WARNING: Falling back to HTTP${NC}"
-    fi
-    
-    # Store results for comparison
-    echo "$size_name,$avg_time,$rdma_percentage,$zerocopy_percentage,$pooled_percentage" >> /tmp/benchmark_results.csv
-}
-
-# Function to display final performance analysis
-performance_analysis() {
-    echo -e "\n${BLUE}🎯 PERFORMANCE ANALYSIS${NC}"
-    echo "========================================"
-    
-    if [[ -f /tmp/benchmark_results.csv ]]; then
-        echo -e "\n${CYAN}Summary Results:${NC}"
-        echo "Size     | Avg Latency | RDMA % | Zero-Copy % | Pooled %"
-        echo "---------|-------------|--------|-------------|----------"
-        
-        while IFS=',' read -r size_name avg_time rdma_pct zerocopy_pct pooled_pct; do
-            printf "%-8s | %-11s | %-6s | %-11s | %-8s\n" "$size_name" "${avg_time}ms" "${rdma_pct}%" "${zerocopy_pct}%" "${pooled_pct}%"
-        done < /tmp/benchmark_results.csv
-    fi
-    
-    echo -e "\n${GREEN}🚀 OPTIMIZATION IMPACT:${NC}"
-    echo "• Zero-Copy Page Cache: Eliminates 4/5 memory copies"
-    echo "• Connection Pooling: Eliminates 100ms RDMA setup cost"
-    echo "• Combined Effect: Up to 118x performance improvement!"
-    
-    echo -e "\n${PURPLE}📊 Expected vs Actual Performance:${NC}"
-    echo "• Small files (4-32KB): Expected 50x faster copies"
-    echo "• Medium files (64-256KB): Expected 25x faster copies + instant connection"
-    echo "• Large files (1MB+): Expected 100x faster copies + instant connection"
-    
-    # Check if connection pooling is working
-    echo -e "\n${CYAN}🔌 Connection Pooling Analysis:${NC}"
-    local stats_response=$(curl -s "$SIDECAR_URL/stats" 2>/dev/null || echo "{}")
-    local total_requests=$(echo "$stats_response" | jq -r '.total_requests // 0' 2>/dev/null || echo "0")
-    
-    if [[ "$total_requests" -gt 0 ]]; then
-        echo "✅ Connection pooling is functional"
-        echo "   Total requests processed: $total_requests"
-    else
-        echo "⚠️  Unable to retrieve connection pool statistics"
-    fi
-    
-    rm -f /tmp/benchmark_results.csv
-}
-
-# Main execution
-main() {
-    echo -e "\n${YELLOW}🔧 Initializing benchmark...${NC}"
-    
-    # Check if sidecar is ready
-    if ! check_sidecar; then
-        echo -e "${RED}❌ RDMA sidecar is not ready. Please start the Docker environment first.${NC}"
-        echo "Run: cd /path/to/seaweedfs-rdma-sidecar && docker compose -f docker-compose.mount-rdma.yml up -d"
-        exit 1
-    fi
-    
-    # Initialize results file
-    rm -f /tmp/benchmark_results.csv
-    
-    # Run benchmarks for each file size
-    for i in "${!SIZES[@]}"; do
-        benchmark_size "${SIZES[$i]}" "${SIZE_NAMES[$i]}"
-    done
-    
-    # Display final analysis
-    performance_analysis
-    
-    echo -e "\n${GREEN}🎉 Benchmark completed!${NC}"
-}
-
-# Run the benchmark
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/scripts/run-integration-tests.sh b/seaweedfs-rdma-sidecar/scripts/run-integration-tests.sh
deleted file mode 100755
index a9e5bd6441..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/run-integration-tests.sh
+++ /dev/null
@@ -1,288 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Configuration
-MOUNT_POINT=${MOUNT_POINT:-"/mnt/seaweedfs"}
-FILER_ADDR=${FILER_ADDR:-"seaweedfs-filer:8888"}
-RDMA_SIDECAR_ADDR=${RDMA_SIDECAR_ADDR:-"rdma-sidecar:8081"}
-TEST_RESULTS_DIR=${TEST_RESULTS_DIR:-"/test-results"}
-
-# Test counters
-TOTAL_TESTS=0
-PASSED_TESTS=0
-FAILED_TESTS=0
-
-# Create results directory
-mkdir -p "$TEST_RESULTS_DIR"
-
-# Log file
-LOG_FILE="$TEST_RESULTS_DIR/integration-test.log"
-exec > >(tee -a "$LOG_FILE")
-exec 2>&1
-
-echo -e "${BLUE}🧪 SEAWEEDFS RDMA MOUNT INTEGRATION TESTS${NC}"
-echo "=========================================="
-echo "Mount Point: $MOUNT_POINT"
-echo "Filer Address: $FILER_ADDR"
-echo "RDMA Sidecar: $RDMA_SIDECAR_ADDR"
-echo "Results Directory: $TEST_RESULTS_DIR"
-echo "Log File: $LOG_FILE"
-echo ""
-
-# Function to run a test
-run_test() {
-    local test_name=$1
-    local test_command=$2
-    
-    echo -e "${BLUE}🔬 Running test: $test_name${NC}"
-    ((TOTAL_TESTS++))
-    
-    if eval "$test_command"; then
-        echo -e "${GREEN}✅ PASSED: $test_name${NC}"
-        ((PASSED_TESTS++))
-        echo "PASS" > "$TEST_RESULTS_DIR/${test_name}.result"
-    else
-        echo -e "${RED}❌ FAILED: $test_name${NC}"
-        ((FAILED_TESTS++))
-        echo "FAIL" > "$TEST_RESULTS_DIR/${test_name}.result"
-    fi
-    echo ""
-}
-
-# Function to wait for mount to be ready
-wait_for_mount() {
-    local max_attempts=30
-    local attempt=1
-    
-    echo -e "${BLUE}⏳ Waiting for mount to be ready...${NC}"
-    
-    while [[ $attempt -le $max_attempts ]]; do
-        if mountpoint -q "$MOUNT_POINT" 2>/dev/null && ls "$MOUNT_POINT" >/dev/null 2>&1; then
-            echo -e "${GREEN}✅ Mount is ready${NC}"
-            return 0
-        fi
-        echo "   Attempt $attempt/$max_attempts..."
-        sleep 2
-        ((attempt++))
-    done
-    
-    echo -e "${RED}❌ Mount failed to be ready${NC}"
-    return 1
-}
-
-# Function to check RDMA sidecar
-check_rdma_sidecar() {
-    echo -e "${BLUE}🔍 Checking RDMA sidecar status...${NC}"
-    
-    local response
-    if response=$(curl -s "http://$RDMA_SIDECAR_ADDR/health" 2>/dev/null); then
-        echo "RDMA Sidecar Health: $response"
-        return 0
-    else
-        echo -e "${RED}❌ RDMA sidecar is not responding${NC}"
-        return 1
-    fi
-}
-
-# Test 1: Mount Point Accessibility
-test_mount_accessibility() {
-    mountpoint -q "$MOUNT_POINT" && ls "$MOUNT_POINT" >/dev/null
-}
-
-# Test 2: Basic File Operations
-test_basic_file_operations() {
-    local test_file="$MOUNT_POINT/test_basic_ops.txt"
-    local test_content="Hello, RDMA World! $(date)"
-    
-    # Write test
-    echo "$test_content" > "$test_file" || return 1
-    
-    # Read test
-    local read_content
-    read_content=$(cat "$test_file") || return 1
-    
-    # Verify content
-    [[ "$read_content" == "$test_content" ]] || return 1
-    
-    # Cleanup
-    rm -f "$test_file"
-    
-    return 0
-}
-
-# Test 3: Large File Operations
-test_large_file_operations() {
-    local test_file="$MOUNT_POINT/test_large_file.dat"
-    local size_mb=10
-    
-    # Create large file
-    dd if=/dev/zero of="$test_file" bs=1M count=$size_mb 2>/dev/null || return 1
-    
-    # Verify size
-    local actual_size
-    actual_size=$(stat -c%s "$test_file" 2>/dev/null) || return 1
-    local expected_size=$((size_mb * 1024 * 1024))
-    
-    [[ "$actual_size" -eq "$expected_size" ]] || return 1
-    
-    # Read test
-    dd if="$test_file" of=/dev/null bs=1M 2>/dev/null || return 1
-    
-    # Cleanup
-    rm -f "$test_file"
-    
-    return 0
-}
-
-# Test 4: Directory Operations
-test_directory_operations() {
-    local test_dir="$MOUNT_POINT/test_directory"
-    local test_file="$test_dir/test_file.txt"
-    
-    # Create directory
-    mkdir -p "$test_dir" || return 1
-    
-    # Create file in directory
-    echo "Directory test" > "$test_file" || return 1
-    
-    # List directory
-    ls "$test_dir" | grep -q "test_file.txt" || return 1
-    
-    # Read file
-    grep -q "Directory test" "$test_file" || return 1
-    
-    # Cleanup
-    rm -rf "$test_dir"
-    
-    return 0
-}
-
-# Test 5: Multiple File Operations
-test_multiple_files() {
-    local test_dir="$MOUNT_POINT/test_multiple"
-    local num_files=20
-    
-    mkdir -p "$test_dir" || return 1
-    
-    # Create multiple files
-    for i in $(seq 1 $num_files); do
-        echo "File $i content" > "$test_dir/file_$i.txt" || return 1
-    done
-    
-    # Verify all files exist and have correct content
-    for i in $(seq 1 $num_files); do
-        [[ -f "$test_dir/file_$i.txt" ]] || return 1
-        grep -q "File $i content" "$test_dir/file_$i.txt" || return 1
-    done
-    
-    # List files
-    local file_count
-    file_count=$(ls "$test_dir" | wc -l) || return 1
-    [[ "$file_count" -eq "$num_files" ]] || return 1
-    
-    # Cleanup
-    rm -rf "$test_dir"
-    
-    return 0
-}
-
-# Test 6: RDMA Statistics
-test_rdma_statistics() {
-    local stats_response
-    stats_response=$(curl -s "http://$RDMA_SIDECAR_ADDR/stats" 2>/dev/null) || return 1
-    
-    # Check if response contains expected fields
-    echo "$stats_response" | jq -e '.rdma_enabled' >/dev/null || return 1
-    echo "$stats_response" | jq -e '.total_reads' >/dev/null || return 1
-    
-    return 0
-}
-
-# Test 7: Performance Baseline
-test_performance_baseline() {
-    local test_file="$MOUNT_POINT/performance_test.dat"
-    local size_mb=50
-    
-    # Write performance test
-    local write_start write_end write_time
-    write_start=$(date +%s%N)
-    dd if=/dev/zero of="$test_file" bs=1M count=$size_mb 2>/dev/null || return 1
-    write_end=$(date +%s%N)
-    write_time=$(((write_end - write_start) / 1000000)) # Convert to milliseconds
-    
-    # Read performance test
-    local read_start read_end read_time
-    read_start=$(date +%s%N)
-    dd if="$test_file" of=/dev/null bs=1M 2>/dev/null || return 1
-    read_end=$(date +%s%N)
-    read_time=$(((read_end - read_start) / 1000000)) # Convert to milliseconds
-    
-    # Log performance metrics
-    echo "Performance Metrics:" > "$TEST_RESULTS_DIR/performance.txt"
-    echo "Write Time: ${write_time}ms for ${size_mb}MB" >> "$TEST_RESULTS_DIR/performance.txt"
-    echo "Read Time: ${read_time}ms for ${size_mb}MB" >> "$TEST_RESULTS_DIR/performance.txt"
-    echo "Write Throughput: $(bc <<< "scale=2; $size_mb * 1000 / $write_time") MB/s" >> "$TEST_RESULTS_DIR/performance.txt"
-    echo "Read Throughput: $(bc <<< "scale=2; $size_mb * 1000 / $read_time") MB/s" >> "$TEST_RESULTS_DIR/performance.txt"
-    
-    # Cleanup
-    rm -f "$test_file"
-    
-    # Performance test always passes (it's just for metrics)
-    return 0
-}
-
-# Main test execution
-main() {
-    echo -e "${BLUE}🚀 Starting integration tests...${NC}"
-    echo ""
-    
-    # Wait for mount to be ready
-    if ! wait_for_mount; then
-        echo -e "${RED}❌ Mount is not ready, aborting tests${NC}"
-        exit 1
-    fi
-    
-    # Check RDMA sidecar
-    check_rdma_sidecar || echo -e "${YELLOW}⚠️  RDMA sidecar check failed, continuing with tests${NC}"
-    
-    echo ""
-    echo -e "${BLUE}📋 Running test suite...${NC}"
-    echo ""
-    
-    # Run all tests
-    run_test "mount_accessibility" "test_mount_accessibility"
-    run_test "basic_file_operations" "test_basic_file_operations"
-    run_test "large_file_operations" "test_large_file_operations"
-    run_test "directory_operations" "test_directory_operations"
-    run_test "multiple_files" "test_multiple_files"
-    run_test "rdma_statistics" "test_rdma_statistics"
-    run_test "performance_baseline" "test_performance_baseline"
-    
-    # Generate test summary
-    echo -e "${BLUE}📊 TEST SUMMARY${NC}"
-    echo "==============="
-    echo "Total Tests: $TOTAL_TESTS"
-    echo -e "Passed: ${GREEN}$PASSED_TESTS${NC}"
-    echo -e "Failed: ${RED}$FAILED_TESTS${NC}"
-    
-    if [[ $FAILED_TESTS -eq 0 ]]; then
-        echo -e "${GREEN}🎉 ALL TESTS PASSED!${NC}"
-        echo "SUCCESS" > "$TEST_RESULTS_DIR/overall.result"
-        exit 0
-    else
-        echo -e "${RED}💥 SOME TESTS FAILED!${NC}"
-        echo "FAILURE" > "$TEST_RESULTS_DIR/overall.result"
-        exit 1
-    fi
-}
-
-# Run main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/scripts/run-mount-rdma-tests.sh b/seaweedfs-rdma-sidecar/scripts/run-mount-rdma-tests.sh
deleted file mode 100755
index e4237a5a2c..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/run-mount-rdma-tests.sh
+++ /dev/null
@@ -1,335 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Configuration
-COMPOSE_FILE="docker-compose.mount-rdma.yml"
-PROJECT_NAME="seaweedfs-rdma-mount"
-
-# Function to show usage
-show_usage() {
-    echo -e "${BLUE}🚀 SeaweedFS RDMA Mount Test Runner${NC}"
-    echo "===================================="
-    echo ""
-    echo "Usage: $0 [COMMAND] [OPTIONS]"
-    echo ""
-    echo "Commands:"
-    echo "  start           Start the RDMA mount environment"
-    echo "  stop            Stop and cleanup the environment"
-    echo "  restart         Restart the environment"
-    echo "  status          Show status of all services"
-    echo "  logs [service]  Show logs for all services or specific service"
-    echo "  test            Run integration tests"
-    echo "  perf            Run performance tests"
-    echo "  shell           Open shell in mount container"
-    echo "  cleanup         Full cleanup including volumes"
-    echo ""
-    echo "Services:"
-    echo "  seaweedfs-master    SeaweedFS master server"
-    echo "  seaweedfs-volume    SeaweedFS volume server"
-    echo "  seaweedfs-filer     SeaweedFS filer server"
-    echo "  rdma-engine         RDMA engine (Rust)"
-    echo "  rdma-sidecar        RDMA sidecar (Go)"
-    echo "  seaweedfs-mount     SeaweedFS mount with RDMA"
-    echo ""
-    echo "Examples:"
-    echo "  $0 start                    # Start all services"
-    echo "  $0 logs seaweedfs-mount     # Show mount logs"
-    echo "  $0 test                     # Run integration tests"
-    echo "  $0 perf                     # Run performance tests"
-    echo "  $0 shell                    # Open shell in mount container"
-}
-
-# Function to check if Docker Compose is available
-check_docker_compose() {
-    if ! command -v docker-compose >/dev/null 2>&1 && ! docker compose version >/dev/null 2>&1; then
-        echo -e "${RED}❌ Docker Compose is not available${NC}"
-        echo "Please install Docker Compose to continue"
-        exit 1
-    fi
-    
-    # Use docker compose if available, otherwise docker-compose
-    if docker compose version >/dev/null 2>&1; then
-        DOCKER_COMPOSE="docker compose"
-    else
-        DOCKER_COMPOSE="docker-compose"
-    fi
-}
-
-# Function to build required images
-build_images() {
-    echo -e "${BLUE}🔨 Building required Docker images...${NC}"
-    
-    # Build SeaweedFS binary first
-    echo "Building SeaweedFS binary..."
-    cd ..
-    make
-    cd seaweedfs-rdma-sidecar
-    
-    # Copy binary for Docker builds
-    mkdir -p bin
-    if [[ -f "../weed" ]]; then
-        cp ../weed bin/
-    elif [[ -f "../bin/weed" ]]; then
-        cp ../bin/weed bin/
-    elif [[ -f "../build/weed" ]]; then
-        cp ../build/weed bin/
-    else
-        echo "Error: Cannot find weed binary"
-        find .. -name "weed" -type f
-        exit 1
-    fi
-    
-    # Build RDMA sidecar
-    echo "Building RDMA sidecar..."
-    go build -o bin/demo-server cmd/sidecar/main.go
-    
-    # Build Docker images
-    $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" build
-    
-    echo -e "${GREEN}✅ Images built successfully${NC}"
-}
-
-# Function to start services
-start_services() {
-    echo -e "${BLUE}🚀 Starting SeaweedFS RDMA Mount environment...${NC}"
-    
-    # Build images if needed
-    if [[ ! -f "bin/weed" ]] || [[ ! -f "bin/demo-server" ]]; then
-        build_images
-    fi
-    
-    # Start services
-    $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" up -d
-    
-    echo -e "${GREEN}✅ Services started${NC}"
-    echo ""
-    echo "Services are starting up. Use '$0 status' to check their status."
-    echo "Use '$0 logs' to see the logs."
-}
-
-# Function to stop services
-stop_services() {
-    echo -e "${BLUE}🛑 Stopping SeaweedFS RDMA Mount environment...${NC}"
-    
-    $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" down
-    
-    echo -e "${GREEN}✅ Services stopped${NC}"
-}
-
-# Function to restart services
-restart_services() {
-    echo -e "${BLUE}🔄 Restarting SeaweedFS RDMA Mount environment...${NC}"
-    
-    stop_services
-    sleep 2
-    start_services
-}
-
-# Function to show status
-show_status() {
-    echo -e "${BLUE}📊 Service Status${NC}"
-    echo "================"
-    
-    $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" ps
-    
-    echo ""
-    echo -e "${BLUE}🔍 Health Checks${NC}"
-    echo "==============="
-    
-    # Check individual services
-    check_service_health "SeaweedFS Master" "http://localhost:9333/cluster/status"
-    check_service_health "SeaweedFS Volume" "http://localhost:8080/status"
-    check_service_health "SeaweedFS Filer" "http://localhost:8888/"
-    check_service_health "RDMA Sidecar" "http://localhost:8081/health"
-    
-    # Check mount status
-    echo -n "SeaweedFS Mount: "
-    if docker exec "${PROJECT_NAME}-seaweedfs-mount-1" mountpoint -q /mnt/seaweedfs 2>/dev/null; then
-        echo -e "${GREEN}✅ Mounted${NC}"
-    else
-        echo -e "${RED}❌ Not mounted${NC}"
-    fi
-}
-
-# Function to check service health
-check_service_health() {
-    local service_name=$1
-    local health_url=$2
-    
-    echo -n "$service_name: "
-    if curl -s "$health_url" >/dev/null 2>&1; then
-        echo -e "${GREEN}✅ Healthy${NC}"
-    else
-        echo -e "${RED}❌ Unhealthy${NC}"
-    fi
-}
-
-# Function to show logs
-show_logs() {
-    local service=$1
-    
-    if [[ -n "$service" ]]; then
-        echo -e "${BLUE}📋 Logs for $service${NC}"
-        echo "===================="
-        $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" logs -f "$service"
-    else
-        echo -e "${BLUE}📋 Logs for all services${NC}"
-        echo "======================="
-        $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" logs -f
-    fi
-}
-
-# Function to run integration tests
-run_integration_tests() {
-    echo -e "${BLUE}🧪 Running integration tests...${NC}"
-    
-    # Make sure services are running
-    if ! $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" ps | grep -q "Up"; then
-        echo -e "${RED}❌ Services are not running. Start them first with '$0 start'${NC}"
-        exit 1
-    fi
-    
-    # Run integration tests
-    $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" --profile test run --rm integration-test
-    
-    # Show results
-    if [[ -d "./test-results" ]]; then
-        echo -e "${BLUE}📊 Test Results${NC}"
-        echo "==============="
-        
-        if [[ -f "./test-results/overall.result" ]]; then
-            local result
-            result=$(cat "./test-results/overall.result")
-            if [[ "$result" == "SUCCESS" ]]; then
-                echo -e "${GREEN}🎉 ALL TESTS PASSED!${NC}"
-            else
-                echo -e "${RED}💥 SOME TESTS FAILED!${NC}"
-            fi
-        fi
-        
-        echo ""
-        echo "Detailed results available in: ./test-results/"
-        ls -la ./test-results/
-    fi
-}
-
-# Function to run performance tests
-run_performance_tests() {
-    echo -e "${BLUE}🏁 Running performance tests...${NC}"
-    
-    # Make sure services are running
-    if ! $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" ps | grep -q "Up"; then
-        echo -e "${RED}❌ Services are not running. Start them first with '$0 start'${NC}"
-        exit 1
-    fi
-    
-    # Run performance tests
-    $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" --profile performance run --rm performance-test
-    
-    # Show results
-    if [[ -d "./performance-results" ]]; then
-        echo -e "${BLUE}📊 Performance Results${NC}"
-        echo "======================"
-        echo ""
-        echo "Results available in: ./performance-results/"
-        ls -la ./performance-results/
-        
-        if [[ -f "./performance-results/performance_report.html" ]]; then
-            echo ""
-            echo -e "${GREEN}📄 HTML Report: ./performance-results/performance_report.html${NC}"
-        fi
-    fi
-}
-
-# Function to open shell in mount container
-open_shell() {
-    echo -e "${BLUE}🐚 Opening shell in mount container...${NC}"
-    
-    if ! $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" ps seaweedfs-mount | grep -q "Up"; then
-        echo -e "${RED}❌ Mount container is not running${NC}"
-        exit 1
-    fi
-    
-    docker exec -it "${PROJECT_NAME}-seaweedfs-mount-1" /bin/bash
-}
-
-# Function to cleanup everything
-cleanup_all() {
-    echo -e "${BLUE}🧹 Full cleanup...${NC}"
-    
-    # Stop services
-    $DOCKER_COMPOSE -f "$COMPOSE_FILE" -p "$PROJECT_NAME" down -v --remove-orphans
-    
-    # Remove images
-    echo "Removing Docker images..."
-    docker images | grep "$PROJECT_NAME" | awk '{print $3}' | xargs -r docker rmi -f
-    
-    # Clean up local files
-    rm -rf bin/ test-results/ performance-results/
-    
-    echo -e "${GREEN}✅ Full cleanup completed${NC}"
-}
-
-# Main function
-main() {
-    local command=${1:-""}
-    
-    # Check Docker Compose availability
-    check_docker_compose
-    
-    case "$command" in
-        "start")
-            start_services
-            ;;
-        "stop")
-            stop_services
-            ;;
-        "restart")
-            restart_services
-            ;;
-        "status")
-            show_status
-            ;;
-        "logs")
-            show_logs "${2:-}"
-            ;;
-        "test")
-            run_integration_tests
-            ;;
-        "perf")
-            run_performance_tests
-            ;;
-        "shell")
-            open_shell
-            ;;
-        "cleanup")
-            cleanup_all
-            ;;
-        "build")
-            build_images
-            ;;
-        "help"|"-h"|"--help")
-            show_usage
-            ;;
-        "")
-            show_usage
-            ;;
-        *)
-            echo -e "${RED}❌ Unknown command: $command${NC}"
-            echo ""
-            show_usage
-            exit 1
-            ;;
-    esac
-}
-
-# Run main function with all arguments
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/scripts/run-performance-tests.sh b/seaweedfs-rdma-sidecar/scripts/run-performance-tests.sh
deleted file mode 100755
index 4475365aa2..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/run-performance-tests.sh
+++ /dev/null
@@ -1,338 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-BLUE='\033[0;34m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-# Configuration
-MOUNT_POINT=${MOUNT_POINT:-"/mnt/seaweedfs"}
-RDMA_SIDECAR_ADDR=${RDMA_SIDECAR_ADDR:-"rdma-sidecar:8081"}
-PERFORMANCE_RESULTS_DIR=${PERFORMANCE_RESULTS_DIR:-"/performance-results"}
-
-# Create results directory
-mkdir -p "$PERFORMANCE_RESULTS_DIR"
-
-# Log file
-LOG_FILE="$PERFORMANCE_RESULTS_DIR/performance-test.log"
-exec > >(tee -a "$LOG_FILE")
-exec 2>&1
-
-echo -e "${BLUE}🏁 SEAWEEDFS RDMA MOUNT PERFORMANCE TESTS${NC}"
-echo "==========================================="
-echo "Mount Point: $MOUNT_POINT"
-echo "RDMA Sidecar: $RDMA_SIDECAR_ADDR"
-echo "Results Directory: $PERFORMANCE_RESULTS_DIR"
-echo "Log File: $LOG_FILE"
-echo ""
-
-# Function to wait for mount to be ready
-wait_for_mount() {
-    local max_attempts=30
-    local attempt=1
-    
-    echo -e "${BLUE}⏳ Waiting for mount to be ready...${NC}"
-    
-    while [[ $attempt -le $max_attempts ]]; do
-        if mountpoint -q "$MOUNT_POINT" 2>/dev/null && ls "$MOUNT_POINT" >/dev/null 2>&1; then
-            echo -e "${GREEN}✅ Mount is ready${NC}"
-            return 0
-        fi
-        echo "   Attempt $attempt/$max_attempts..."
-        sleep 2
-        ((attempt++))
-    done
-    
-    echo -e "${RED}❌ Mount failed to be ready${NC}"
-    return 1
-}
-
-# Function to get RDMA statistics
-get_rdma_stats() {
-    curl -s "http://$RDMA_SIDECAR_ADDR/stats" 2>/dev/null || echo "{}"
-}
-
-# Function to run dd performance test
-run_dd_test() {
-    local test_name=$1
-    local file_size_mb=$2
-    local block_size=$3
-    local operation=$4  # "write" or "read"
-    
-    local test_file="$MOUNT_POINT/perf_test_${test_name}.dat"
-    local result_file="$PERFORMANCE_RESULTS_DIR/dd_${test_name}.json"
-    
-    echo -e "${BLUE}🔬 Running DD test: $test_name${NC}"
-    echo "   Size: ${file_size_mb}MB, Block Size: $block_size, Operation: $operation"
-    
-    local start_time end_time duration_ms throughput_mbps
-    
-    if [[ "$operation" == "write" ]]; then
-        start_time=$(date +%s%N)
-        dd if=/dev/zero of="$test_file" bs="$block_size" count=$((file_size_mb * 1024 * 1024 / $(numfmt --from=iec "$block_size"))) 2>/dev/null
-        end_time=$(date +%s%N)
-    else
-        # Create file first if it doesn't exist
-        if [[ ! -f "$test_file" ]]; then
-            dd if=/dev/zero of="$test_file" bs=1M count="$file_size_mb" 2>/dev/null
-        fi
-        start_time=$(date +%s%N)
-        dd if="$test_file" of=/dev/null bs="$block_size" 2>/dev/null
-        end_time=$(date +%s%N)
-    fi
-    
-    duration_ms=$(((end_time - start_time) / 1000000))
-    throughput_mbps=$(bc <<< "scale=2; $file_size_mb * 1000 / $duration_ms")
-    
-    # Save results
-    cat > "$result_file" << EOF
-{
-  "test_name": "$test_name",
-  "operation": "$operation",
-  "file_size_mb": $file_size_mb,
-  "block_size": "$block_size",
-  "duration_ms": $duration_ms,
-  "throughput_mbps": $throughput_mbps,
-  "timestamp": "$(date -Iseconds)"
-}
-EOF
-    
-    echo "   Duration: ${duration_ms}ms"
-    echo "   Throughput: ${throughput_mbps} MB/s"
-    echo ""
-    
-    # Cleanup write test files
-    if [[ "$operation" == "write" ]]; then
-        rm -f "$test_file"
-    fi
-}
-
-# Function to run FIO performance test
-run_fio_test() {
-    local test_name=$1
-    local rw_type=$2      # "read", "write", "randread", "randwrite"
-    local block_size=$3
-    local file_size=$4
-    local iodepth=$5
-    
-    local test_file="$MOUNT_POINT/fio_test_${test_name}.dat"
-    local result_file="$PERFORMANCE_RESULTS_DIR/fio_${test_name}.json"
-    
-    echo -e "${BLUE}🔬 Running FIO test: $test_name${NC}"
-    echo "   Type: $rw_type, Block Size: $block_size, File Size: $file_size, IO Depth: $iodepth"
-    
-    # Run FIO test
-    fio --name="$test_name" \
-        --filename="$test_file" \
-        --rw="$rw_type" \
-        --bs="$block_size" \
-        --size="$file_size" \
-        --iodepth="$iodepth" \
-        --direct=1 \
-        --runtime=30 \
-        --time_based \
-        --group_reporting \
-        --output-format=json \
-        --output="$result_file" \
-        2>/dev/null
-    
-    # Extract key metrics
-    if [[ -f "$result_file" ]]; then
-        local iops throughput_kbps latency_us
-        iops=$(jq -r '.jobs[0].'"$rw_type"'.iops // 0' "$result_file" 2>/dev/null || echo "0")
-        throughput_kbps=$(jq -r '.jobs[0].'"$rw_type"'.bw // 0' "$result_file" 2>/dev/null || echo "0")
-        latency_us=$(jq -r '.jobs[0].'"$rw_type"'.lat_ns.mean // 0' "$result_file" 2>/dev/null || echo "0")
-        latency_us=$(bc <<< "scale=2; $latency_us / 1000" 2>/dev/null || echo "0")
-        
-        echo "   IOPS: $iops"
-        echo "   Throughput: $(bc <<< "scale=2; $throughput_kbps / 1024") MB/s"
-        echo "   Average Latency: ${latency_us} μs"
-    else
-        echo "   FIO test failed or no results"
-    fi
-    echo ""
-    
-    # Cleanup
-    rm -f "$test_file"
-}
-
-# Function to run concurrent access test
-run_concurrent_test() {
-    local num_processes=$1
-    local file_size_mb=$2
-    
-    echo -e "${BLUE}🔬 Running concurrent access test${NC}"
-    echo "   Processes: $num_processes, File Size per Process: ${file_size_mb}MB"
-    
-    local start_time end_time duration_ms total_throughput
-    local pids=()
-    
-    start_time=$(date +%s%N)
-    
-    # Start concurrent processes
-    for i in $(seq 1 "$num_processes"); do
-        (
-            local test_file="$MOUNT_POINT/concurrent_test_$i.dat"
-            dd if=/dev/zero of="$test_file" bs=1M count="$file_size_mb" 2>/dev/null
-            dd if="$test_file" of=/dev/null bs=1M 2>/dev/null
-            rm -f "$test_file"
-        ) &
-        pids+=($!)
-    done
-    
-    # Wait for all processes to complete
-    for pid in "${pids[@]}"; do
-        wait "$pid"
-    done
-    
-    end_time=$(date +%s%N)
-    duration_ms=$(((end_time - start_time) / 1000000))
-    total_throughput=$(bc <<< "scale=2; $num_processes * $file_size_mb * 2 * 1000 / $duration_ms")
-    
-    # Save results
-    cat > "$PERFORMANCE_RESULTS_DIR/concurrent_test.json" << EOF
-{
-  "test_name": "concurrent_access",
-  "num_processes": $num_processes,
-  "file_size_mb_per_process": $file_size_mb,
-  "total_data_mb": $((num_processes * file_size_mb * 2)),
-  "duration_ms": $duration_ms,
-  "total_throughput_mbps": $total_throughput,
-  "timestamp": "$(date -Iseconds)"
-}
-EOF
-    
-    echo "   Duration: ${duration_ms}ms"
-    echo "   Total Throughput: ${total_throughput} MB/s"
-    echo ""
-}
-
-# Function to generate performance report
-generate_report() {
-    local report_file="$PERFORMANCE_RESULTS_DIR/performance_report.html"
-    
-    echo -e "${BLUE}📊 Generating performance report...${NC}"
-    
-    cat > "$report_file" << 'EOF'
-<!DOCTYPE html>
-<html>
-<head>
-    <title>SeaweedFS RDMA Mount Performance Report</title>
-    <style>
-        body { font-family: Arial, sans-serif; margin: 20px; }
-        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
-        .test-section { margin: 20px 0; padding: 15px; border: 1px solid #ddd; border-radius: 5px; }
-        .metric { margin: 5px 0; }
-        .good { color: green; font-weight: bold; }
-        .warning { color: orange; font-weight: bold; }
-        .error { color: red; font-weight: bold; }
-        table { border-collapse: collapse; width: 100%; }
-        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
-        th { background-color: #f2f2f2; }
-    </style>
-</head>
-<body>
-    <div class="header">
-        <h1>🏁 SeaweedFS RDMA Mount Performance Report</h1>
-        <p>Generated: $(date)</p>
-        <p>Mount Point: $MOUNT_POINT</p>
-        <p>RDMA Sidecar: $RDMA_SIDECAR_ADDR</p>
-    </div>
-EOF
-    
-    # Add DD test results
-    echo '<div class="test-section"><h2>DD Performance Tests</h2><table><tr><th>Test</th><th>Operation</th><th>Size</th><th>Block Size</th><th>Throughput (MB/s)</th><th>Duration (ms)</th></tr>' >> "$report_file"
-    
-    for result_file in "$PERFORMANCE_RESULTS_DIR"/dd_*.json; do
-        if [[ -f "$result_file" ]]; then
-            local test_name operation file_size_mb block_size throughput_mbps duration_ms
-            test_name=$(jq -r '.test_name' "$result_file" 2>/dev/null || echo "unknown")
-            operation=$(jq -r '.operation' "$result_file" 2>/dev/null || echo "unknown")
-            file_size_mb=$(jq -r '.file_size_mb' "$result_file" 2>/dev/null || echo "0")
-            block_size=$(jq -r '.block_size' "$result_file" 2>/dev/null || echo "unknown")
-            throughput_mbps=$(jq -r '.throughput_mbps' "$result_file" 2>/dev/null || echo "0")
-            duration_ms=$(jq -r '.duration_ms' "$result_file" 2>/dev/null || echo "0")
-            
-            echo "<tr><td>$test_name</td><td>$operation</td><td>${file_size_mb}MB</td><td>$block_size</td><td>$throughput_mbps</td><td>$duration_ms</td></tr>" >> "$report_file"
-        fi
-    done
-    
-    echo '</table></div>' >> "$report_file"
-    
-    # Add FIO test results
-    echo '<div class="test-section"><h2>FIO Performance Tests</h2>' >> "$report_file"
-    echo '<p>Detailed FIO results are available in individual JSON files.</p></div>' >> "$report_file"
-    
-    # Add concurrent test results
-    if [[ -f "$PERFORMANCE_RESULTS_DIR/concurrent_test.json" ]]; then
-        echo '<div class="test-section"><h2>Concurrent Access Test</h2>' >> "$report_file"
-        local num_processes total_throughput duration_ms
-        num_processes=$(jq -r '.num_processes' "$PERFORMANCE_RESULTS_DIR/concurrent_test.json" 2>/dev/null || echo "0")
-        total_throughput=$(jq -r '.total_throughput_mbps' "$PERFORMANCE_RESULTS_DIR/concurrent_test.json" 2>/dev/null || echo "0")
-        duration_ms=$(jq -r '.duration_ms' "$PERFORMANCE_RESULTS_DIR/concurrent_test.json" 2>/dev/null || echo "0")
-        
-        echo "<p>Processes: $num_processes</p>" >> "$report_file"
-        echo "<p>Total Throughput: $total_throughput MB/s</p>" >> "$report_file"
-        echo "<p>Duration: $duration_ms ms</p>" >> "$report_file"
-        echo '</div>' >> "$report_file"
-    fi
-    
-    echo '</body></html>' >> "$report_file"
-    
-    echo "   Report saved to: $report_file"
-}
-
-# Main test execution
-main() {
-    echo -e "${BLUE}🚀 Starting performance tests...${NC}"
-    echo ""
-    
-    # Wait for mount to be ready
-    if ! wait_for_mount; then
-        echo -e "${RED}❌ Mount is not ready, aborting tests${NC}"
-        exit 1
-    fi
-    
-    # Get initial RDMA stats
-    echo -e "${BLUE}📊 Initial RDMA Statistics:${NC}"
-    get_rdma_stats | jq . 2>/dev/null || get_rdma_stats
-    echo ""
-    
-    # Run DD performance tests
-    echo -e "${BLUE}🏃 Running DD Performance Tests...${NC}"
-    run_dd_test "small_write" 10 "4k" "write"
-    run_dd_test "small_read" 10 "4k" "read"
-    run_dd_test "medium_write" 100 "64k" "write"
-    run_dd_test "medium_read" 100 "64k" "read"
-    run_dd_test "large_write" 500 "1M" "write"
-    run_dd_test "large_read" 500 "1M" "read"
-    
-    # Run FIO performance tests
-    echo -e "${BLUE}🏃 Running FIO Performance Tests...${NC}"
-    run_fio_test "seq_read" "read" "64k" "100M" 1
-    run_fio_test "seq_write" "write" "64k" "100M" 1
-    run_fio_test "rand_read" "randread" "4k" "100M" 16
-    run_fio_test "rand_write" "randwrite" "4k" "100M" 16
-    
-    # Run concurrent access test
-    echo -e "${BLUE}🏃 Running Concurrent Access Test...${NC}"
-    run_concurrent_test 4 50
-    
-    # Get final RDMA stats
-    echo -e "${BLUE}📊 Final RDMA Statistics:${NC}"
-    get_rdma_stats | jq . 2>/dev/null || get_rdma_stats
-    echo ""
-    
-    # Generate performance report
-    generate_report
-    
-    echo -e "${GREEN}🎉 Performance tests completed!${NC}"
-    echo "Results saved to: $PERFORMANCE_RESULTS_DIR"
-}
-
-# Run main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/scripts/test-complete-optimization.sh b/seaweedfs-rdma-sidecar/scripts/test-complete-optimization.sh
deleted file mode 100755
index f9d2984610..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/test-complete-optimization.sh
+++ /dev/null
@@ -1,250 +0,0 @@
-#!/bin/bash
-
-# Complete RDMA Optimization Test
-# Demonstrates the full optimization pipeline: Zero-Copy + Connection Pooling + RDMA
-
-set -e
-
-echo "🔥 SeaweedFS RDMA Complete Optimization Test"
-echo "Zero-Copy Page Cache + Connection Pooling + RDMA Bandwidth"
-echo "============================================================="
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-PURPLE='\033[0;35m'
-CYAN='\033[0;36m'
-NC='\033[0m'
-
-# Test configuration
-SIDECAR_URL="http://localhost:8081"
-VOLUME_SERVER="http://seaweedfs-volume:8080"
-
-# Function to test RDMA sidecar functionality
-test_sidecar_health() {
-    echo -e "\n${CYAN}🏥 Testing RDMA Sidecar Health${NC}"
-    echo "--------------------------------"
-    
-    local response=$(curl -s "$SIDECAR_URL/health" 2>/dev/null || echo "{}")
-    local status=$(echo "$response" | jq -r '.status // "unknown"' 2>/dev/null || echo "unknown")
-    
-    if [[ "$status" == "healthy" ]]; then
-        echo -e "✅ ${GREEN}Sidecar is healthy${NC}"
-        
-        # Check RDMA capabilities
-        local rdma_enabled=$(echo "$response" | jq -r '.rdma.enabled // false' 2>/dev/null || echo "false")
-        local zerocopy_enabled=$(echo "$response" | jq -r '.rdma.zerocopy_enabled // false' 2>/dev/null || echo "false")
-        local pooling_enabled=$(echo "$response" | jq -r '.rdma.pooling_enabled // false' 2>/dev/null || echo "false")
-        
-        echo "   RDMA enabled: $rdma_enabled"
-        echo "   Zero-copy enabled: $zerocopy_enabled" 
-        echo "   Connection pooling enabled: $pooling_enabled"
-        
-        return 0
-    else
-        echo -e "❌ ${RED}Sidecar health check failed${NC}"
-        return 1
-    fi
-}
-
-# Function to test zero-copy optimization
-test_zerocopy_optimization() {
-    echo -e "\n${PURPLE}🔥 Testing Zero-Copy Page Cache Optimization${NC}"
-    echo "----------------------------------------------"
-    
-    # Test with a file size above the 64KB threshold
-    local test_size=1048576  # 1MB
-    echo "Testing with 1MB file (above 64KB zero-copy threshold)..."
-    
-    local response=$(curl -s "$SIDECAR_URL/read?volume=1&needle=1&cookie=1&size=$test_size&volume_server=$VOLUME_SERVER")
-    
-    local use_temp_file=$(echo "$response" | jq -r '.use_temp_file // false' 2>/dev/null || echo "false")
-    local temp_file=$(echo "$response" | jq -r '.temp_file // ""' 2>/dev/null || echo "")
-    local source=$(echo "$response" | jq -r '.source // "unknown"' 2>/dev/null || echo "unknown")
-    
-    if [[ "$use_temp_file" == "true" ]] && [[ -n "$temp_file" ]]; then
-        echo -e "✅ ${GREEN}Zero-copy optimization ACTIVE${NC}"
-        echo "   Temp file created: $temp_file"
-        echo "   Source: $source"
-        return 0
-    elif [[ "$source" == *"rdma"* ]]; then
-        echo -e "⚡ ${YELLOW}RDMA active (zero-copy not triggered)${NC}"
-        echo "   Source: $source"
-        echo "   Note: File may be below 64KB threshold or zero-copy disabled"
-        return 0
-    else
-        echo -e "❌ ${RED}Zero-copy optimization not detected${NC}"
-        echo "   Response: $response"
-        return 1
-    fi
-}
-
-# Function to test connection pooling
-test_connection_pooling() {
-    echo -e "\n${BLUE}🔌 Testing RDMA Connection Pooling${NC}"
-    echo "-----------------------------------"
-    
-    echo "Making multiple rapid requests to test connection reuse..."
-    
-    local pooled_count=0
-    local total_requests=5
-    
-    for i in $(seq 1 $total_requests); do
-        echo -n "  Request $i: "
-        
-        local start_time=$(date +%s%N)
-        local response=$(curl -s "$SIDECAR_URL/read?volume=1&needle=$i&cookie=1&size=65536&volume_server=$VOLUME_SERVER")
-        local end_time=$(date +%s%N)
-        
-        local duration_ns=$((end_time - start_time))
-        local duration_ms=$((duration_ns / 1000000))
-        
-        local source=$(echo "$response" | jq -r '.source // "unknown"' 2>/dev/null || echo "unknown")
-        local session_id=$(echo "$response" | jq -r '.session_id // ""' 2>/dev/null || echo "")
-        
-        if [[ "$source" == *"pooled"* ]] || [[ -n "$session_id" ]]; then
-            pooled_count=$((pooled_count + 1))
-            echo -e "${GREEN}${duration_ms}ms (pooled: $session_id)${NC}"
-        else
-            echo -e "${YELLOW}${duration_ms}ms (source: $source)${NC}"
-        fi
-        
-        # Small delay to test connection reuse
-        sleep 0.1
-    done
-    
-    echo ""
-    echo "Connection pooling analysis:"
-    echo "  Requests using pooled connections: $pooled_count/$total_requests"
-    
-    if [[ $pooled_count -gt 0 ]]; then
-        echo -e "✅ ${GREEN}Connection pooling is working${NC}"
-        return 0
-    else
-        echo -e "⚠️  ${YELLOW}Connection pooling not detected (may be using single connection mode)${NC}"
-        return 0
-    fi
-}
-
-# Function to test performance comparison
-test_performance_comparison() {
-    echo -e "\n${CYAN}⚡ Performance Comparison Test${NC}"
-    echo "-------------------------------"
-    
-    local sizes=(65536 262144 1048576)  # 64KB, 256KB, 1MB
-    local size_names=("64KB" "256KB" "1MB")
-    
-    for i in "${!sizes[@]}"; do
-        local size=${sizes[$i]}
-        local size_name=${size_names[$i]}
-        
-        echo "Testing $size_name files:"
-        
-        # Test multiple requests to see optimization progression
-        for j in $(seq 1 3); do
-            echo -n "  Request $j: "
-            
-            local start_time=$(date +%s%N)
-            local response=$(curl -s "$SIDECAR_URL/read?volume=1&needle=$j&cookie=1&size=$size&volume_server=$VOLUME_SERVER")
-            local end_time=$(date +%s%N)
-            
-            local duration_ns=$((end_time - start_time))
-            local duration_ms=$((duration_ns / 1000000))
-            
-            local is_rdma=$(echo "$response" | jq -r '.is_rdma // false' 2>/dev/null || echo "false")
-            local source=$(echo "$response" | jq -r '.source // "unknown"' 2>/dev/null || echo "unknown")
-            local use_temp_file=$(echo "$response" | jq -r '.use_temp_file // false' 2>/dev/null || echo "false")
-            
-            # Color code based on optimization level
-            if [[ "$source" == "rdma-zerocopy" ]] || [[ "$use_temp_file" == "true" ]]; then
-                echo -e "${GREEN}${duration_ms}ms (RDMA+ZeroCopy) 🔥${NC}"
-            elif [[ "$is_rdma" == "true" ]]; then
-                echo -e "${YELLOW}${duration_ms}ms (RDMA) ⚡${NC}"
-            else
-                echo -e "⚠️  ${duration_ms}ms (HTTP fallback)"
-            fi
-        done
-        echo ""
-    done
-}
-
-# Function to test RDMA engine connectivity
-test_rdma_engine() {
-    echo -e "\n${PURPLE}🚀 Testing RDMA Engine Connectivity${NC}"
-    echo "------------------------------------"
-    
-    # Get sidecar stats to check RDMA engine connection
-    local stats_response=$(curl -s "$SIDECAR_URL/stats" 2>/dev/null || echo "{}")
-    local rdma_connected=$(echo "$stats_response" | jq -r '.rdma.connected // false' 2>/dev/null || echo "false")
-    
-    if [[ "$rdma_connected" == "true" ]]; then
-        echo -e "✅ ${GREEN}RDMA engine is connected${NC}"
-        
-        local total_requests=$(echo "$stats_response" | jq -r '.total_requests // 0' 2>/dev/null || echo "0")
-        local successful_reads=$(echo "$stats_response" | jq -r '.successful_reads // 0' 2>/dev/null || echo "0")
-        local total_bytes=$(echo "$stats_response" | jq -r '.total_bytes_read // 0' 2>/dev/null || echo "0")
-        
-        echo "   Total requests: $total_requests"
-        echo "   Successful reads: $successful_reads"
-        echo "   Total bytes read: $total_bytes"
-        
-        return 0
-    else
-        echo -e "⚠️  ${YELLOW}RDMA engine connection status unclear${NC}"
-        echo "   This may be normal if using mock implementation"
-        return 0
-    fi
-}
-
-# Function to display optimization summary
-display_optimization_summary() {
-    echo -e "\n${GREEN}🎯 OPTIMIZATION SUMMARY${NC}"
-    echo "========================================"
-    echo ""
-    echo -e "${PURPLE}Implemented Optimizations:${NC}"
-    echo "1. 🔥 Zero-Copy Page Cache"
-    echo "   - Eliminates 4 out of 5 memory copies"
-    echo "   - Direct page cache population via temp files"
-    echo "   - Threshold: 64KB+ files"
-    echo ""
-    echo "2. 🔌 RDMA Connection Pooling"
-    echo "   - Eliminates 100ms connection setup cost"
-    echo "   - Reuses connections across requests"
-    echo "   - Automatic cleanup of idle connections"
-    echo ""
-    echo "3. ⚡ RDMA Bandwidth Advantage"
-    echo "   - High-throughput data transfer"
-    echo "   - Bypasses kernel network stack"
-    echo "   - Direct memory access"
-    echo ""
-    echo -e "${CYAN}Expected Performance Gains:${NC}"
-    echo "• Small files (< 64KB): ~50x improvement from RDMA + pooling"
-    echo "• Medium files (64KB-1MB): ~47x improvement from zero-copy + pooling"
-    echo "• Large files (> 1MB): ~118x improvement from all optimizations"
-    echo ""
-    echo -e "${GREEN}🚀 This represents a fundamental breakthrough in distributed storage performance!${NC}"
-}
-
-# Main execution
-main() {
-    echo -e "\n${YELLOW}🔧 Starting comprehensive optimization test...${NC}"
-    
-    # Run all tests
-    test_sidecar_health || exit 1
-    test_rdma_engine
-    test_zerocopy_optimization
-    test_connection_pooling
-    test_performance_comparison
-    display_optimization_summary
-    
-    echo -e "\n${GREEN}🎉 Complete optimization test finished!${NC}"
-    echo ""
-    echo "Next steps:"
-    echo "1. Run performance benchmark: ./scripts/performance-benchmark.sh"
-    echo "2. Test with weed mount: docker compose -f docker-compose.mount-rdma.yml logs seaweedfs-mount"
-    echo "3. Monitor connection pool: curl -s http://localhost:8081/stats | jq"
-}
-
-# Execute main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/scripts/test-complete-optimizations.sh b/seaweedfs-rdma-sidecar/scripts/test-complete-optimizations.sh
deleted file mode 100755
index b84d429fab..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/test-complete-optimizations.sh
+++ /dev/null
@@ -1,295 +0,0 @@
-#!/bin/bash
-
-# Complete RDMA Optimization Test Suite
-# Tests all three optimizations: Zero-Copy + Connection Pooling + RDMA
-
-set -e
-
-echo "🚀 Complete RDMA Optimization Test Suite"
-echo "========================================"
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-PURPLE='\033[0;35m'
-CYAN='\033[0;36m'
-RED='\033[0;31m'
-NC='\033[0m'
-
-# Test results tracking
-TESTS_PASSED=0
-TESTS_TOTAL=0
-
-# Helper function to run a test
-run_test() {
-    local test_name="$1"
-    local test_command="$2"
-    
-    ((TESTS_TOTAL++))
-    echo -e "\n${CYAN}🧪 Test $TESTS_TOTAL: $test_name${NC}"
-    echo "$(printf '%.0s-' {1..50})"
-    
-    if eval "$test_command"; then
-        echo -e "${GREEN}✅ PASSED: $test_name${NC}"
-        ((TESTS_PASSED++))
-        return 0
-    else
-        echo -e "${RED}❌ FAILED: $test_name${NC}"
-        return 1
-    fi
-}
-
-# Test 1: Build verification
-test_build_verification() {
-    echo "📦 Verifying all components build successfully..."
-    
-    # Check demo server binary
-    if [[ -f "bin/demo-server" ]]; then
-        echo "✅ Demo server binary exists"
-    else
-        echo "❌ Demo server binary missing"
-        return 1
-    fi
-    
-    # Check RDMA engine binary
-    if [[ -f "rdma-engine/target/release/rdma-engine-server" ]]; then
-        echo "✅ RDMA engine binary exists"
-    else
-        echo "❌ RDMA engine binary missing"
-        return 1
-    fi
-    
-    # Check SeaweedFS binary
-    if [[ -f "../weed/weed" ]]; then
-        echo "✅ SeaweedFS with RDMA support exists"
-    else
-        echo "❌ SeaweedFS binary missing (expected at ../weed/weed)"
-        return 1
-    fi
-    
-    echo "🎯 All core components built successfully"
-    return 0
-}
-
-# Test 2: Zero-copy mechanism
-test_zero_copy_mechanism() {
-    echo "🔥 Testing zero-copy page cache mechanism..."
-    
-    local temp_dir="/tmp/rdma-test-$$"
-    mkdir -p "$temp_dir"
-    
-    # Create test data
-    local test_file="$temp_dir/test_data.bin"
-    dd if=/dev/urandom of="$test_file" bs=1024 count=64 2>/dev/null
-    
-    # Simulate temp file creation (sidecar behavior)
-    local temp_needle="$temp_dir/vol1_needle123.tmp"
-    cp "$test_file" "$temp_needle"
-    
-    if [[ -f "$temp_needle" ]]; then
-        echo "✅ Temp file created successfully"
-        
-        # Simulate reading (mount behavior)
-        local read_result="$temp_dir/read_result.bin"
-        cp "$temp_needle" "$read_result"
-        
-        if cmp -s "$test_file" "$read_result"; then
-            echo "✅ Zero-copy read successful with data integrity"
-            rm -rf "$temp_dir"
-            return 0
-        else
-            echo "❌ Data integrity check failed"
-            rm -rf "$temp_dir"
-            return 1
-        fi
-    else
-        echo "❌ Temp file creation failed"
-        rm -rf "$temp_dir"
-        return 1
-    fi
-}
-
-# Test 3: Connection pooling logic
-test_connection_pooling() {
-    echo "🔌 Testing connection pooling logic..."
-    
-    # Test the core pooling mechanism by running our pool test
-    local pool_test_output
-    pool_test_output=$(./scripts/test-connection-pooling.sh 2>&1 | tail -20)
-    
-    if echo "$pool_test_output" | grep -q "Connection pool test completed successfully"; then
-        echo "✅ Connection pooling logic verified"
-        return 0
-    else
-        echo "❌ Connection pooling test failed"
-        return 1
-    fi
-}
-
-# Test 4: Configuration validation
-test_configuration_validation() {
-    echo "⚙️ Testing configuration validation..."
-    
-    # Test demo server help
-    if ./bin/demo-server --help | grep -q "enable-zerocopy"; then
-        echo "✅ Zero-copy configuration available"
-    else
-        echo "❌ Zero-copy configuration missing"
-        return 1
-    fi
-    
-    if ./bin/demo-server --help | grep -q "enable-pooling"; then
-        echo "✅ Connection pooling configuration available"
-    else
-        echo "❌ Connection pooling configuration missing"  
-        return 1
-    fi
-    
-    if ./bin/demo-server --help | grep -q "max-connections"; then
-        echo "✅ Pool sizing configuration available"
-    else
-        echo "❌ Pool sizing configuration missing"
-        return 1
-    fi
-    
-    echo "🎯 All configuration options validated"
-    return 0
-}
-
-# Test 5: RDMA engine mock functionality
-test_rdma_engine_mock() {
-    echo "🚀 Testing RDMA engine mock functionality..."
-    
-    # Start RDMA engine in background for quick test
-    local engine_log="/tmp/rdma-engine-test.log"
-    local socket_path="/tmp/rdma-test-engine.sock"
-    
-    # Clean up any existing socket
-    rm -f "$socket_path"
-    
-    # Start engine in background
-    timeout 10s ./rdma-engine/target/release/rdma-engine-server \
-        --ipc-socket "$socket_path" \
-        --debug > "$engine_log" 2>&1 &
-    
-    local engine_pid=$!
-    
-    # Wait a moment for startup
-    sleep 2
-    
-    # Check if socket was created
-    if [[ -S "$socket_path" ]]; then
-        echo "✅ RDMA engine socket created successfully"
-        kill $engine_pid 2>/dev/null || true
-        wait $engine_pid 2>/dev/null || true
-        rm -f "$socket_path" "$engine_log"
-        return 0
-    else
-        echo "❌ RDMA engine socket not created"
-        kill $engine_pid 2>/dev/null || true
-        wait $engine_pid 2>/dev/null || true
-        echo "Engine log:"
-        cat "$engine_log" 2>/dev/null || echo "No log available"
-        rm -f "$socket_path" "$engine_log"
-        return 1
-    fi
-}
-
-# Test 6: Integration test preparation
-test_integration_readiness() {
-    echo "🧩 Testing integration readiness..."
-    
-    # Check Docker Compose file
-    if [[ -f "docker-compose.mount-rdma.yml" ]]; then
-        echo "✅ Docker Compose configuration available"
-    else
-        echo "❌ Docker Compose configuration missing"
-        return 1
-    fi
-    
-    # Validate Docker Compose syntax
-    if docker compose -f docker-compose.mount-rdma.yml config > /dev/null 2>&1; then
-        echo "✅ Docker Compose configuration valid"
-    else
-        echo "❌ Docker Compose configuration invalid"
-        return 1
-    fi
-    
-    # Check test scripts
-    local scripts=("test-zero-copy-mechanism.sh" "test-connection-pooling.sh" "performance-benchmark.sh")
-    for script in "${scripts[@]}"; do
-        if [[ -x "scripts/$script" ]]; then
-            echo "✅ Test script available: $script"
-        else
-            echo "❌ Test script missing or not executable: $script"
-            return 1
-        fi
-    done
-    
-    echo "🎯 Integration environment ready"
-    return 0
-}
-
-# Performance benchmarking
-test_performance_characteristics() {
-    echo "📊 Testing performance characteristics..."
-    
-    # Run zero-copy performance test
-    if ./scripts/test-zero-copy-mechanism.sh | grep -q "Performance improvement"; then
-        echo "✅ Zero-copy performance improvement detected"
-    else
-        echo "❌ Zero-copy performance test failed"
-        return 1
-    fi
-    
-    echo "🎯 Performance characteristics validated"
-    return 0
-}
-
-# Main test execution
-main() {
-    echo -e "${BLUE}🚀 Starting complete optimization test suite...${NC}"
-    echo ""
-    
-    # Run all tests
-    run_test "Build Verification" "test_build_verification"
-    run_test "Zero-Copy Mechanism" "test_zero_copy_mechanism"
-    run_test "Connection Pooling" "test_connection_pooling"
-    run_test "Configuration Validation" "test_configuration_validation"
-    run_test "RDMA Engine Mock" "test_rdma_engine_mock"
-    run_test "Integration Readiness" "test_integration_readiness"
-    run_test "Performance Characteristics" "test_performance_characteristics"
-    
-    # Results summary
-    echo -e "\n${PURPLE}📊 Test Results Summary${NC}"
-    echo "======================="
-    echo "Tests passed: $TESTS_PASSED/$TESTS_TOTAL"
-    
-    if [[ $TESTS_PASSED -eq $TESTS_TOTAL ]]; then
-        echo -e "${GREEN}🎉 ALL TESTS PASSED!${NC}"
-        echo ""
-        echo -e "${CYAN}🚀 Revolutionary Optimization Suite Status:${NC}"
-        echo "✅ Zero-Copy Page Cache: WORKING"
-        echo "✅ RDMA Connection Pooling: WORKING"  
-        echo "✅ RDMA Engine Integration: WORKING"
-        echo "✅ Mount Client Integration: READY"
-        echo "✅ Docker Environment: READY"
-        echo "✅ Performance Testing: READY"
-        echo ""
-        echo -e "${YELLOW}🔥 Expected Performance Improvements:${NC}"
-        echo "• Small files (< 64KB): 50x faster"
-        echo "• Medium files (64KB-1MB): 47x faster"
-        echo "• Large files (> 1MB): 118x faster"
-        echo ""
-        echo -e "${GREEN}Ready for production testing! 🚀${NC}"
-        return 0
-    else
-        echo -e "${RED}❌ SOME TESTS FAILED${NC}"
-        echo "Please review the failed tests above"
-        return 1
-    fi
-}
-
-# Execute main function
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/scripts/test-connection-pooling.sh b/seaweedfs-rdma-sidecar/scripts/test-connection-pooling.sh
deleted file mode 100755
index 576b905c08..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/test-connection-pooling.sh
+++ /dev/null
@@ -1,209 +0,0 @@
-#!/bin/bash
-
-# Test RDMA Connection Pooling Mechanism
-# Demonstrates connection reuse and pool management
-
-set -e
-
-echo "🔌 Testing RDMA Connection Pooling Mechanism"
-echo "============================================"
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-PURPLE='\033[0;35m'
-NC='\033[0m'
-
-echo -e "\n${BLUE}🧪 Testing Connection Pool Logic${NC}"
-echo "--------------------------------"
-
-# Test the pool implementation by building a simple test
-cat > /tmp/pool_test.go << 'EOF'
-package main
-
-import (
-	"context"
-	"fmt"
-	"time"
-)
-
-// Simulate the connection pool behavior
-type PooledConnection struct {
-	ID       string
-	lastUsed time.Time
-	inUse    bool
-	created  time.Time
-}
-
-type ConnectionPool struct {
-	connections    []*PooledConnection
-	maxConnections int
-	maxIdleTime    time.Duration
-}
-
-func NewConnectionPool(maxConnections int, maxIdleTime time.Duration) *ConnectionPool {
-	return &ConnectionPool{
-		connections:    make([]*PooledConnection, 0, maxConnections),
-		maxConnections: maxConnections,
-		maxIdleTime:    maxIdleTime,
-	}
-}
-
-func (p *ConnectionPool) getConnection() (*PooledConnection, error) {
-	// Look for available connection
-	for _, conn := range p.connections {
-		if !conn.inUse && time.Since(conn.lastUsed) < p.maxIdleTime {
-			conn.inUse = true
-			conn.lastUsed = time.Now()
-			fmt.Printf("🔄 Reusing connection: %s (age: %v)\n", conn.ID, time.Since(conn.created))
-			return conn, nil
-		}
-	}
-	
-	// Create new connection if under limit
-	if len(p.connections) < p.maxConnections {
-		conn := &PooledConnection{
-			ID:       fmt.Sprintf("conn-%d-%d", len(p.connections), time.Now().Unix()),
-			lastUsed: time.Now(),
-			inUse:    true,
-			created:  time.Now(),
-		}
-		p.connections = append(p.connections, conn)
-		fmt.Printf("🚀 Created new connection: %s (pool size: %d)\n", conn.ID, len(p.connections))
-		return conn, nil
-	}
-	
-	return nil, fmt.Errorf("pool exhausted (max: %d)", p.maxConnections)
-}
-
-func (p *ConnectionPool) releaseConnection(conn *PooledConnection) {
-	conn.inUse = false
-	conn.lastUsed = time.Now()
-	fmt.Printf("🔓 Released connection: %s\n", conn.ID)
-}
-
-func (p *ConnectionPool) cleanup() {
-	now := time.Now()
-	activeConnections := make([]*PooledConnection, 0, len(p.connections))
-	
-	for _, conn := range p.connections {
-		if conn.inUse || now.Sub(conn.lastUsed) < p.maxIdleTime {
-			activeConnections = append(activeConnections, conn)
-		} else {
-			fmt.Printf("🧹 Cleaned up idle connection: %s (idle: %v)\n", conn.ID, now.Sub(conn.lastUsed))
-		}
-	}
-	
-	p.connections = activeConnections
-}
-
-func (p *ConnectionPool) getStats() (int, int) {
-	total := len(p.connections)
-	inUse := 0
-	for _, conn := range p.connections {
-		if conn.inUse {
-			inUse++
-		}
-	}
-	return total, inUse
-}
-
-func main() {
-	fmt.Println("🔌 Connection Pool Test Starting...")
-	
-	// Create pool with small limits for testing
-	pool := NewConnectionPool(3, 2*time.Second)
-	
-	fmt.Println("\n1. Testing connection creation and reuse:")
-	
-	// Get multiple connections
-	conns := make([]*PooledConnection, 0)
-	for i := 0; i < 5; i++ {
-		conn, err := pool.getConnection()
-		if err != nil {
-			fmt.Printf("❌ Error getting connection %d: %v\n", i+1, err)
-			continue
-		}
-		conns = append(conns, conn)
-		
-		// Simulate work
-		time.Sleep(100 * time.Millisecond)
-	}
-	
-	total, inUse := pool.getStats()
-	fmt.Printf("\n📊 Pool stats: %d total connections, %d in use\n", total, inUse)
-	
-	fmt.Println("\n2. Testing connection release and reuse:")
-	
-	// Release some connections
-	for i := 0; i < 2; i++ {
-		if i < len(conns) {
-			pool.releaseConnection(conns[i])
-		}
-	}
-	
-	// Try to get new connections (should reuse)
-	for i := 0; i < 2; i++ {
-		conn, err := pool.getConnection()
-		if err != nil {
-			fmt.Printf("❌ Error getting reused connection: %v\n", err)
-		} else {
-			pool.releaseConnection(conn)
-		}
-	}
-	
-	fmt.Println("\n3. Testing cleanup of idle connections:")
-	
-	// Wait for connections to become idle
-	fmt.Println("⏱️  Waiting for connections to become idle...")
-	time.Sleep(3 * time.Second)
-	
-	// Cleanup
-	pool.cleanup()
-	
-	total, inUse = pool.getStats()
-	fmt.Printf("📊 Pool stats after cleanup: %d total connections, %d in use\n", total, inUse)
-	
-	fmt.Println("\n✅ Connection pool test completed successfully!")
-	fmt.Println("\n🎯 Key benefits demonstrated:")
-	fmt.Println("   • Connection reuse eliminates setup cost")
-	fmt.Println("   • Pool size limits prevent resource exhaustion")
-	fmt.Println("   • Automatic cleanup prevents memory leaks")
-	fmt.Println("   • Idle timeout ensures fresh connections")
-}
-EOF
-
-echo "📝 Created connection pool test program"
-
-echo -e "\n${GREEN}🚀 Running connection pool simulation${NC}"
-echo "------------------------------------"
-
-# Run the test
-cd /tmp && go run pool_test.go
-
-echo -e "\n${YELLOW}📊 Performance Impact Analysis${NC}"
-echo "------------------------------"
-
-echo "Without connection pooling:"
-echo "  • Each request: 100ms setup + 1ms transfer = 101ms"
-echo "  • 10 requests: 10 × 101ms = 1010ms"
-
-echo ""
-echo "With connection pooling:"
-echo "  • First request: 100ms setup + 1ms transfer = 101ms"
-echo "  • Next 9 requests: 0.1ms reuse + 1ms transfer = 1.1ms each"
-echo "  • 10 requests: 101ms + (9 × 1.1ms) = 111ms"
-
-echo ""
-echo -e "${GREEN}🔥 Performance improvement: 1010ms → 111ms = 9x faster!${NC}"
-
-echo -e "\n${PURPLE}💡 Real-world scaling benefits:${NC}"
-echo "• 100 requests: 100x faster with pooling"
-echo "• 1000 requests: 1000x faster with pooling"
-echo "• Connection pool amortizes setup cost across many operations"
-
-# Cleanup
-rm -f /tmp/pool_test.go
-
-echo -e "\n${GREEN}✅ Connection pooling test completed!${NC}"
diff --git a/seaweedfs-rdma-sidecar/scripts/test-zero-copy-mechanism.sh b/seaweedfs-rdma-sidecar/scripts/test-zero-copy-mechanism.sh
deleted file mode 100755
index 63c5d3584a..0000000000
--- a/seaweedfs-rdma-sidecar/scripts/test-zero-copy-mechanism.sh
+++ /dev/null
@@ -1,222 +0,0 @@
-#!/bin/bash
-
-# Test Zero-Copy Page Cache Mechanism
-# Demonstrates the core innovation without needing full server
-
-set -e
-
-echo "🔥 Testing Zero-Copy Page Cache Mechanism"
-echo "========================================="
-
-# Colors
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-PURPLE='\033[0;35m'
-NC='\033[0m'
-
-# Test configuration
-TEMP_DIR="/tmp/rdma-cache-test"
-TEST_DATA_SIZE=1048576  # 1MB
-ITERATIONS=5
-
-# Cleanup function
-cleanup() {
-    rm -rf "$TEMP_DIR" 2>/dev/null || true
-}
-
-# Setup
-setup() {
-    echo -e "\n${BLUE}🔧 Setting up test environment${NC}"
-    cleanup
-    mkdir -p "$TEMP_DIR"
-    echo "✅ Created temp directory: $TEMP_DIR"
-}
-
-# Generate test data
-generate_test_data() {
-    echo -e "\n${PURPLE}📝 Generating test data${NC}"
-    dd if=/dev/urandom of="$TEMP_DIR/source_data.bin" bs=$TEST_DATA_SIZE count=1 2>/dev/null
-    echo "✅ Generated $TEST_DATA_SIZE bytes of test data"
-}
-
-# Test 1: Simulate the zero-copy write mechanism
-test_zero_copy_write() {
-    echo -e "\n${GREEN}🔥 Test 1: Zero-Copy Page Cache Population${NC}"
-    echo "--------------------------------------------"
-    
-    local source_file="$TEMP_DIR/source_data.bin"
-    local temp_file="$TEMP_DIR/vol1_needle123_cookie456.tmp"
-    
-    echo "📤 Simulating RDMA sidecar writing to temp file..."
-    
-    # This simulates what our sidecar does:
-    # ioutil.WriteFile(tempFilePath, data, 0644)
-    local start_time=$(date +%s%N)
-    cp "$source_file" "$temp_file"
-    local end_time=$(date +%s%N)
-    
-    local write_duration_ns=$((end_time - start_time))
-    local write_duration_ms=$((write_duration_ns / 1000000))
-    
-    echo "✅ Temp file written in ${write_duration_ms}ms"
-    echo "   File: $temp_file"
-    echo "   Size: $(stat -f%z "$temp_file" 2>/dev/null || stat -c%s "$temp_file") bytes"
-    
-    # Check if file is in page cache (approximation)
-    if command -v vmtouch >/dev/null 2>&1; then
-        echo "   Page cache status:"
-        vmtouch "$temp_file" 2>/dev/null || echo "   (vmtouch not available for precise measurement)"
-    else
-        echo "   📄 File written to filesystem (page cache populated automatically)"
-    fi
-}
-
-# Test 2: Simulate the zero-copy read mechanism  
-test_zero_copy_read() {
-    echo -e "\n${GREEN}⚡ Test 2: Zero-Copy Page Cache Read${NC}"
-    echo "-----------------------------------"
-    
-    local temp_file="$TEMP_DIR/vol1_needle123_cookie456.tmp"
-    local read_buffer="$TEMP_DIR/read_buffer.bin"
-    
-    echo "📥 Simulating mount client reading from temp file..."
-    
-    # This simulates what our mount client does:
-    # file.Read(buffer) from temp file
-    local start_time=$(date +%s%N)
-    
-    # Multiple reads to test page cache efficiency
-    for i in $(seq 1 $ITERATIONS); do
-        cp "$temp_file" "$read_buffer.tmp$i"
-    done
-    
-    local end_time=$(date +%s%N)
-    local read_duration_ns=$((end_time - start_time))
-    local read_duration_ms=$((read_duration_ns / 1000000))
-    local avg_read_ms=$((read_duration_ms / ITERATIONS))
-    
-    echo "✅ $ITERATIONS reads completed in ${read_duration_ms}ms"
-    echo "   Average per read: ${avg_read_ms}ms"
-    echo "   🔥 Subsequent reads served from page cache!"
-    
-    # Verify data integrity
-    if cmp -s "$TEMP_DIR/source_data.bin" "$read_buffer.tmp1"; then
-        echo "✅ Data integrity verified - zero corruption"
-    else
-        echo "❌ Data integrity check failed"
-        return 1
-    fi
-}
-
-# Test 3: Performance comparison
-test_performance_comparison() {
-    echo -e "\n${YELLOW}📊 Test 3: Performance Comparison${NC}"
-    echo "-----------------------------------"
-    
-    local source_file="$TEMP_DIR/source_data.bin"
-    
-    echo "🐌 Traditional copy (simulating multiple memory copies):"
-    local start_time=$(date +%s%N)
-    
-    # Simulate 5 memory copies (traditional path)
-    cp "$source_file" "$TEMP_DIR/copy1.bin"
-    cp "$TEMP_DIR/copy1.bin" "$TEMP_DIR/copy2.bin"
-    cp "$TEMP_DIR/copy2.bin" "$TEMP_DIR/copy3.bin"
-    cp "$TEMP_DIR/copy3.bin" "$TEMP_DIR/copy4.bin"
-    cp "$TEMP_DIR/copy4.bin" "$TEMP_DIR/copy5.bin"
-    
-    local end_time=$(date +%s%N)
-    local traditional_duration_ns=$((end_time - start_time))
-    local traditional_duration_ms=$((traditional_duration_ns / 1000000))
-    
-    echo "   5 memory copies: ${traditional_duration_ms}ms"
-    
-    echo "🚀 Zero-copy method (page cache):"
-    local start_time=$(date +%s%N)
-    
-    # Simulate zero-copy path (write once, read multiple times from cache)
-    cp "$source_file" "$TEMP_DIR/zerocopy.tmp"
-    # Subsequent reads are from page cache
-    cp "$TEMP_DIR/zerocopy.tmp" "$TEMP_DIR/result.bin"
-    
-    local end_time=$(date +%s%N)
-    local zerocopy_duration_ns=$((end_time - start_time))
-    local zerocopy_duration_ms=$((zerocopy_duration_ns / 1000000))
-    
-    echo "   Write + cached read: ${zerocopy_duration_ms}ms"
-    
-    # Calculate improvement
-    if [[ $zerocopy_duration_ms -gt 0 ]]; then
-        local improvement=$((traditional_duration_ms / zerocopy_duration_ms))
-        echo ""
-        echo -e "${GREEN}🎯 Performance improvement: ${improvement}x faster${NC}"
-        
-        if [[ $improvement -gt 5 ]]; then
-            echo -e "${GREEN}🔥 EXCELLENT: Significant optimization detected!${NC}"
-        elif [[ $improvement -gt 2 ]]; then
-            echo -e "${YELLOW}⚡ GOOD: Measurable improvement${NC}"
-        else
-            echo -e "${YELLOW}📈 MODERATE: Some improvement (limited by I/O overhead)${NC}"
-        fi
-    fi
-}
-
-# Test 4: Demonstrate temp file cleanup with persistent page cache
-test_cleanup_behavior() {
-    echo -e "\n${PURPLE}🧹 Test 4: Cleanup with Page Cache Persistence${NC}"
-    echo "----------------------------------------------"
-    
-    local temp_file="$TEMP_DIR/cleanup_test.tmp"
-    
-    # Write data
-    echo "📝 Writing data to temp file..."
-    cp "$TEMP_DIR/source_data.bin" "$temp_file"
-    
-    # Read to ensure it's in page cache
-    echo "📖 Reading data (loads into page cache)..."
-    cp "$temp_file" "$TEMP_DIR/cache_load.bin"
-    
-    # Delete temp file (simulating our cleanup)
-    echo "🗑️  Deleting temp file (simulating cleanup)..."
-    rm "$temp_file"
-    
-    # Try to access page cache data (this would work in real scenario)
-    echo "🔍 File deleted but page cache may still contain data"
-    echo "   (In real implementation, this provides brief performance window)"
-    
-    if [[ -f "$TEMP_DIR/cache_load.bin" ]]; then
-        echo "✅ Data successfully accessed from loaded cache"
-    fi
-    
-    echo ""
-    echo -e "${BLUE}💡 Key insight: Page cache persists briefly even after file deletion${NC}"
-    echo "   This allows zero-copy reads during the critical performance window"
-}
-
-# Main execution
-main() {
-    echo -e "${BLUE}🚀 Starting zero-copy mechanism test...${NC}"
-    
-    setup
-    generate_test_data
-    test_zero_copy_write
-    test_zero_copy_read
-    test_performance_comparison
-    test_cleanup_behavior
-    
-    echo -e "\n${GREEN}🎉 Zero-copy mechanism test completed!${NC}"
-    echo ""
-    echo -e "${PURPLE}📋 Summary of what we demonstrated:${NC}"
-    echo "1. ✅ Temp file write populates page cache automatically"
-    echo "2. ✅ Subsequent reads served from fast page cache"
-    echo "3. ✅ Significant performance improvement over multiple copies"
-    echo "4. ✅ Cleanup behavior maintains performance window"
-    echo ""
-    echo -e "${YELLOW}🔥 This is the core mechanism behind our 100x performance improvement!${NC}"
-    
-    cleanup
-}
-
-# Run the test
-main "$@"
diff --git a/seaweedfs-rdma-sidecar/sidecar b/seaweedfs-rdma-sidecar/sidecar
deleted file mode 100755
index daddfdbf1a..0000000000
Binary files a/seaweedfs-rdma-sidecar/sidecar and /dev/null differ
diff --git a/seaweedfs-rdma-sidecar/test-fixes-standalone.go b/seaweedfs-rdma-sidecar/test-fixes-standalone.go
deleted file mode 100644
index 5b709bc7b5..0000000000
--- a/seaweedfs-rdma-sidecar/test-fixes-standalone.go
+++ /dev/null
@@ -1,127 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-)
-
-// Test the improved parse functions (from cmd/sidecar/main.go fix)
-func parseUint32(s string, defaultValue uint32) uint32 {
-	if s == "" {
-		return defaultValue
-	}
-	val, err := strconv.ParseUint(s, 10, 32)
-	if err != nil {
-		return defaultValue
-	}
-	return uint32(val)
-}
-
-func parseUint64(s string, defaultValue uint64) uint64 {
-	if s == "" {
-		return defaultValue
-	}
-	val, err := strconv.ParseUint(s, 10, 64)
-	if err != nil {
-		return defaultValue
-	}
-	return val
-}
-
-// Test the improved error reporting pattern (from weed/mount/rdma_client.go fix)
-func testErrorReporting() {
-	fmt.Println("Testing Error Reporting Fix:")
-
-	// Simulate RDMA failure followed by HTTP failure
-	rdmaErr := fmt.Errorf("RDMA connection timeout")
-	httpErr := fmt.Errorf("HTTP 404 Not Found")
-
-	// OLD (incorrect) way:
-	oldError := fmt.Errorf("both RDMA and HTTP fallback failed: RDMA=%v, HTTP=%v", rdmaErr, rdmaErr) // BUG: same error twice
-	fmt.Printf("  Old (buggy): %v\n", oldError)
-
-	// NEW (fixed) way:
-	newError := fmt.Errorf("both RDMA and HTTP fallback failed: RDMA=%v, HTTP=%v", rdmaErr, httpErr) // FIXED: different errors
-	fmt.Printf("  New (fixed): %v\n", newError)
-}
-
-// Test weed mount command with RDMA flags (from docker-compose fix)
-func testWeedMountCommand() {
-	fmt.Println("Testing Weed Mount Command Fix:")
-
-	// OLD (missing RDMA flags):
-	oldCommand := "/usr/local/bin/weed mount -filer=seaweedfs-filer:8888 -dir=/mnt/seaweedfs -allowOthers=true -debug"
-	fmt.Printf("  Old (missing RDMA): %s\n", oldCommand)
-
-	// NEW (with RDMA flags):
-	newCommand := "/usr/local/bin/weed mount -filer=${FILER_ADDR} -dir=${MOUNT_POINT} -allowOthers=true -rdma.enabled=${RDMA_ENABLED} -rdma.sidecar=${RDMA_SIDECAR_ADDR} -rdma.fallback=${RDMA_FALLBACK} -rdma.maxConcurrent=${RDMA_MAX_CONCURRENT} -rdma.timeoutMs=${RDMA_TIMEOUT_MS} -debug=${DEBUG}"
-	fmt.Printf("  New (with RDMA): %s\n", newCommand)
-
-	// Check if RDMA flags are present
-	rdmaFlags := []string{"-rdma.enabled", "-rdma.sidecar", "-rdma.fallback", "-rdma.maxConcurrent", "-rdma.timeoutMs"}
-	allPresent := true
-	for _, flag := range rdmaFlags {
-		if !strings.Contains(newCommand, flag) {
-			allPresent = false
-			break
-		}
-	}
-
-	if allPresent {
-		fmt.Println("  All RDMA flags present in command")
-	} else {
-		fmt.Println("  Missing RDMA flags")
-	}
-}
-
-// Test health check robustness (from Dockerfile.rdma-engine fix)
-func testHealthCheck() {
-	fmt.Println("Testing Health Check Fix:")
-
-	// OLD (hardcoded):
-	oldHealthCheck := "test -S /tmp/rdma-engine.sock"
-	fmt.Printf("  Old (hardcoded): %s\n", oldHealthCheck)
-
-	// NEW (robust):
-	newHealthCheck := `pgrep rdma-engine-server >/dev/null && test -d /tmp/rdma && test "$(find /tmp/rdma -name '*.sock' | wc -l)" -gt 0`
-	fmt.Printf("  New (robust): %s\n", newHealthCheck)
-}
-
-func main() {
-	fmt.Println("Testing All GitHub PR Review Fixes")
-	fmt.Println("====================================")
-	fmt.Println()
-
-	// Test parse functions
-	fmt.Println("Testing Parse Functions Fix:")
-	fmt.Printf("  parseUint32('123', 0) = %d (expected: 123)\n", parseUint32("123", 0))
-	fmt.Printf("  parseUint32('', 999) = %d (expected: 999)\n", parseUint32("", 999))
-	fmt.Printf("  parseUint32('invalid', 999) = %d (expected: 999)\n", parseUint32("invalid", 999))
-	fmt.Printf("  parseUint64('12345678901234', 0) = %d (expected: 12345678901234)\n", parseUint64("12345678901234", 0))
-	fmt.Printf("  parseUint64('invalid', 999) = %d (expected: 999)\n", parseUint64("invalid", 999))
-	fmt.Println("  Parse functions handle errors correctly!")
-	fmt.Println()
-
-	testErrorReporting()
-	fmt.Println()
-
-	testWeedMountCommand()
-	fmt.Println()
-
-	testHealthCheck()
-	fmt.Println()
-
-	fmt.Println("All Review Fixes Validated!")
-	fmt.Println("=============================")
-	fmt.Println()
-	fmt.Println("Parse functions: Safe error handling with strconv.ParseUint")
-	fmt.Println("Error reporting: Proper distinction between RDMA and HTTP errors")
-	fmt.Println("Weed mount: RDMA flags properly included in Docker command")
-	fmt.Println("Health check: Robust socket detection without hardcoding")
-	fmt.Println("File ID parsing: Reuses existing SeaweedFS functions")
-	fmt.Println("Semaphore handling: No more channel close panics")
-	fmt.Println("Go.mod documentation: Clear instructions for contributors")
-	fmt.Println()
-	fmt.Println("Ready for production deployment!")
-}
diff --git a/seaweedfs-rdma-sidecar/test-rdma-integration.sh b/seaweedfs-rdma-sidecar/test-rdma-integration.sh
deleted file mode 100644
index 4b599d3a14..0000000000
--- a/seaweedfs-rdma-sidecar/test-rdma-integration.sh
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/bin/bash
-set -e
-
-echo "🚀 Testing RDMA Integration with All Fixes Applied"
-echo "=================================================="
-
-# Build the sidecar with all fixes
-echo "📦 Building RDMA sidecar..."
-go build -o bin/demo-server ./cmd/demo-server
-go build -o bin/sidecar ./cmd/sidecar
-
-# Test that the parse functions work correctly
-echo "🧪 Testing parse helper functions..."
-cat > test_parse_functions.go << 'EOF'
-package main
-
-import (
-	"fmt"
-	"strconv"
-)
-
-func parseUint32(s string, defaultValue uint32) uint32 {
-	if s == "" {
-		return defaultValue
-	}
-	val, err := strconv.ParseUint(s, 10, 32)
-	if err != nil {
-		return defaultValue
-	}
-	return uint32(val)
-}
-
-func parseUint64(s string, defaultValue uint64) uint64 {
-	if s == "" {
-		return defaultValue
-	}
-	val, err := strconv.ParseUint(s, 10, 64)
-	if err != nil {
-		return defaultValue
-	}
-	return val
-}
-
-func main() {
-	fmt.Println("Testing parseUint32:")
-	fmt.Printf("  '123' -> %d (expected: 123)\n", parseUint32("123", 0))
-	fmt.Printf("  '' -> %d (expected: 999)\n", parseUint32("", 999))
-	fmt.Printf("  'invalid' -> %d (expected: 999)\n", parseUint32("invalid", 999))
-	
-	fmt.Println("Testing parseUint64:")
-	fmt.Printf("  '12345678901234' -> %d (expected: 12345678901234)\n", parseUint64("12345678901234", 0))
-	fmt.Printf("  '' -> %d (expected: 999)\n", parseUint64("", 999))
-	fmt.Printf("  'invalid' -> %d (expected: 999)\n", parseUint64("invalid", 999))
-}
-EOF
-
-go run test_parse_functions.go
-rm test_parse_functions.go
-
-echo "✅ Parse functions working correctly!"
-
-# Test the sidecar startup
-echo "🏁 Testing sidecar startup..."
-timeout 5 ./bin/demo-server --port 8081 --enable-rdma=false --debug --volume-server=http://httpbin.org/get &
-SIDECAR_PID=$!
-
-sleep 2
-
-# Test health endpoint
-echo "🏥 Testing health endpoint..."
-if curl -s http://localhost:8081/health | grep -q "healthy"; then
-    echo "✅ Health endpoint working!"
-else
-    echo "❌ Health endpoint failed!"
-fi
-
-# Test stats endpoint  
-echo "📊 Testing stats endpoint..."
-if curl -s http://localhost:8081/stats | jq . > /dev/null; then
-    echo "✅ Stats endpoint working!"
-else
-    echo "❌ Stats endpoint failed!"
-fi
-
-# Test read endpoint (will fallback to HTTP)
-echo "📖 Testing read endpoint..."
-RESPONSE=$(curl -s "http://localhost:8081/read?volume=1&needle=123&cookie=456&offset=0&size=1024&volume_server=http://localhost:8080")
-if echo "$RESPONSE" | jq . > /dev/null; then
-    echo "✅ Read endpoint working!"
-    echo "   Response structure valid JSON"
-    
-    # Check if it has the expected fields
-    if echo "$RESPONSE" | jq -e '.source' > /dev/null; then
-        SOURCE=$(echo "$RESPONSE" | jq -r '.source')
-        echo "   Source: $SOURCE"
-    fi
-    
-    if echo "$RESPONSE" | jq -e '.is_rdma' > /dev/null; then
-        IS_RDMA=$(echo "$RESPONSE" | jq -r '.is_rdma')
-        echo "   RDMA Used: $IS_RDMA"
-    fi
-else
-    echo "❌ Read endpoint failed!"
-    echo "Response: $RESPONSE"
-fi
-
-# Stop the sidecar
-kill $SIDECAR_PID 2>/dev/null || true
-wait $SIDECAR_PID 2>/dev/null || true
-
-echo ""
-echo "🎯 Integration Test Summary:"
-echo "=========================="
-echo "✅ Sidecar builds successfully"
-echo "✅ Parse functions handle errors correctly"  
-echo "✅ HTTP endpoints are functional"
-echo "✅ JSON responses are properly formatted"
-echo "✅ Error handling works as expected"
-echo ""
-echo "🎉 All RDMA integration fixes are working correctly!"
-echo ""
-echo "💡 Next Steps:"
-echo "- Deploy in Docker environment with real SeaweedFS cluster"
-echo "- Test with actual file uploads and downloads"
-echo "- Verify RDMA flags are passed correctly to weed mount"
-echo "- Monitor health checks with configurable socket paths"
diff --git a/seaweedfs-rdma-sidecar/tests/docker-smoke-test.sh b/seaweedfs-rdma-sidecar/tests/docker-smoke-test.sh
deleted file mode 100755
index b7ad813c1a..0000000000
--- a/seaweedfs-rdma-sidecar/tests/docker-smoke-test.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-
-# Simple smoke test for Docker setup
-set -e
-
-echo "🧪 Docker Smoke Test"
-echo "===================="
-echo ""
-
-echo "📋 1. Testing Docker Compose configuration..."
-docker-compose config --quiet
-echo "✅ Docker Compose configuration is valid"
-echo ""
-
-echo "📋 2. Testing container builds..."
-echo "Building RDMA engine container..."
-docker build -f Dockerfile.rdma-engine -t test-rdma-engine . > /dev/null
-echo "✅ RDMA engine container builds successfully"
-echo ""
-
-echo "📋 3. Testing basic container startup..."
-echo "Starting RDMA engine container..."
-container_id=$(docker run --rm -d --name test-rdma-engine test-rdma-engine)
-sleep 5
-
-if docker ps | grep test-rdma-engine > /dev/null; then
-    echo "✅ RDMA engine container starts successfully"
-    docker stop test-rdma-engine > /dev/null
-else
-    echo "❌ RDMA engine container failed to start"
-    echo "Checking container logs:"
-    docker logs test-rdma-engine 2>&1 || true
-    docker stop test-rdma-engine > /dev/null 2>&1 || true
-    exit 1
-fi
-echo ""
-
-echo "🎉 All smoke tests passed!"
-echo "Docker setup is working correctly."
diff --git a/seaweedfs-rdma-sidecar/tests/docker-test-helper.sh b/seaweedfs-rdma-sidecar/tests/docker-test-helper.sh
deleted file mode 100755
index edb95541e6..0000000000
--- a/seaweedfs-rdma-sidecar/tests/docker-test-helper.sh
+++ /dev/null
@@ -1,154 +0,0 @@
-#!/bin/bash
-
-# Docker Test Helper - Simplified commands for running integration tests
-
-set -e
-
-# Colors
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-NC='\033[0m'
-
-print_usage() {
-    echo -e "${BLUE}SeaweedFS RDMA Docker Integration Test Helper${NC}"
-    echo ""
-    echo "Usage: $0 [command]"
-    echo ""
-    echo "Commands:"
-    echo "  start     - Start all services"
-    echo "  test      - Run integration tests"
-    echo "  stop      - Stop all services"
-    echo "  clean     - Stop services and clean up volumes"
-    echo "  logs      - Show logs from all services"
-    echo "  status    - Show status of all services"
-    echo "  shell     - Open shell in test client container"
-    echo ""
-    echo "Examples:"
-    echo "  $0 start          # Start all services"
-    echo "  $0 test           # Run full integration test suite"
-    echo "  $0 logs rdma-engine  # Show logs from RDMA engine"
-    echo "  $0 shell          # Interactive testing shell"
-}
-
-start_services() {
-    echo -e "${GREEN}🚀 Starting SeaweedFS RDMA integration services...${NC}"
-    docker-compose up -d seaweedfs-master seaweedfs-volume rdma-engine rdma-sidecar
-    
-    echo -e "${YELLOW}⏳ Waiting for services to be ready...${NC}"
-    sleep 10
-    
-    echo -e "${GREEN}✅ Services started. Checking health...${NC}"
-    docker-compose ps
-}
-
-run_tests() {
-    echo -e "${GREEN}🧪 Running integration tests...${NC}"
-    
-    # Make sure services are running
-    docker-compose up -d seaweedfs-master seaweedfs-volume rdma-engine rdma-sidecar
-    
-    # Wait for services to be ready
-    echo -e "${YELLOW}⏳ Waiting for services to be ready...${NC}"
-    sleep 15
-    
-    # Run the integration tests
-    docker-compose run --rm integration-tests
-}
-
-stop_services() {
-    echo -e "${YELLOW}🛑 Stopping services...${NC}"
-    docker-compose down
-    echo -e "${GREEN}✅ Services stopped${NC}"
-}
-
-clean_all() {
-    echo -e "${YELLOW}🧹 Cleaning up services and volumes...${NC}"
-    docker-compose down -v --remove-orphans
-    echo -e "${GREEN}✅ Cleanup complete${NC}"
-}
-
-show_logs() {
-    local service=${1:-}
-    if [ -n "$service" ]; then
-        echo -e "${BLUE}📋 Showing logs for $service...${NC}"
-        docker-compose logs -f "$service"
-    else
-        echo -e "${BLUE}📋 Showing logs for all services...${NC}"
-        docker-compose logs -f
-    fi
-}
-
-show_status() {
-    echo -e "${BLUE}📊 Service Status:${NC}"
-    docker-compose ps
-    
-    echo -e "\n${BLUE}📡 Health Checks:${NC}"
-    
-    # Check SeaweedFS Master
-    if curl -s http://localhost:9333/cluster/status >/dev/null 2>&1; then
-        echo -e "  ${GREEN}✅ SeaweedFS Master: Healthy${NC}"
-    else
-        echo -e "  ${RED}❌ SeaweedFS Master: Unhealthy${NC}"
-    fi
-    
-    # Check SeaweedFS Volume
-    if curl -s http://localhost:8080/status >/dev/null 2>&1; then
-        echo -e "  ${GREEN}✅ SeaweedFS Volume: Healthy${NC}"
-    else
-        echo -e "  ${RED}❌ SeaweedFS Volume: Unhealthy${NC}"
-    fi
-    
-    # Check RDMA Sidecar
-    if curl -s http://localhost:8081/health >/dev/null 2>&1; then
-        echo -e "  ${GREEN}✅ RDMA Sidecar: Healthy${NC}"
-    else
-        echo -e "  ${RED}❌ RDMA Sidecar: Unhealthy${NC}"
-    fi
-}
-
-open_shell() {
-    echo -e "${GREEN}🐚 Opening interactive shell in test client...${NC}"
-    echo -e "${YELLOW}Use './test-rdma --help' for RDMA testing commands${NC}"
-    echo -e "${YELLOW}Use 'curl http://rdma-sidecar:8081/health' to test sidecar${NC}"
-    
-    docker-compose run --rm test-client /bin/bash
-}
-
-# Main command handling
-case "${1:-}" in
-    start)
-        start_services
-        ;;
-    test)
-        run_tests
-        ;;
-    stop)
-        stop_services
-        ;;
-    clean)
-        clean_all
-        ;;
-    logs)
-        show_logs "${2:-}"
-        ;;
-    status)
-        show_status
-        ;;
-    shell)
-        open_shell
-        ;;
-    -h|--help|help)
-        print_usage
-        ;;
-    "")
-        print_usage
-        exit 1
-        ;;
-    *)
-        echo -e "${RED}❌ Unknown command: $1${NC}"
-        print_usage
-        exit 1
-        ;;
-esac
diff --git a/seaweedfs-rdma-sidecar/tests/run-integration-tests.sh b/seaweedfs-rdma-sidecar/tests/run-integration-tests.sh
deleted file mode 100755
index 8f23c7e5f9..0000000000
--- a/seaweedfs-rdma-sidecar/tests/run-integration-tests.sh
+++ /dev/null
@@ -1,302 +0,0 @@
-#!/bin/bash
-
-# SeaweedFS RDMA Integration Test Suite
-# Comprehensive testing of the complete integration in Docker environment
-
-set -e
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-BLUE='\033[0;34m'
-PURPLE='\033[0;35m'
-CYAN='\033[0;36m'
-NC='\033[0m' # No Color
-
-print_header() {
-    echo -e "\n${PURPLE}===============================================${NC}"
-    echo -e "${PURPLE}$1${NC}"
-    echo -e "${PURPLE}===============================================${NC}\n"
-}
-
-print_step() {
-    echo -e "${CYAN}🔵 $1${NC}"
-}
-
-print_success() {
-    echo -e "${GREEN}✅ $1${NC}"
-}
-
-print_warning() {
-    echo -e "${YELLOW}⚠️  $1${NC}"
-}
-
-print_error() {
-    echo -e "${RED}❌ $1${NC}"
-}
-
-wait_for_service() {
-    local url=$1
-    local service_name=$2
-    local max_attempts=30
-    local attempt=1
-
-    print_step "Waiting for $service_name to be ready..."
-    
-    while [ $attempt -le $max_attempts ]; do
-        if curl -s "$url" > /dev/null 2>&1; then
-            print_success "$service_name is ready"
-            return 0
-        fi
-        
-        echo -n "."
-        sleep 2
-        attempt=$((attempt + 1))
-    done
-    
-    print_error "$service_name failed to become ready after $max_attempts attempts"
-    return 1
-}
-
-test_seaweedfs_master() {
-    print_header "TESTING SEAWEEDFS MASTER"
-    
-    wait_for_service "$SEAWEEDFS_MASTER/cluster/status" "SeaweedFS Master"
-    
-    print_step "Checking master status..."
-    response=$(curl -s "$SEAWEEDFS_MASTER/cluster/status")
-    
-    if echo "$response" | jq -e '.IsLeader == true' > /dev/null; then
-        print_success "SeaweedFS Master is leader and ready"
-    else
-        print_error "SeaweedFS Master is not ready"
-        echo "$response"
-        return 1
-    fi
-}
-
-test_seaweedfs_volume() {
-    print_header "TESTING SEAWEEDFS VOLUME SERVER"
-    
-    wait_for_service "$SEAWEEDFS_VOLUME/status" "SeaweedFS Volume Server"
-    
-    print_step "Checking volume server status..."
-    response=$(curl -s "$SEAWEEDFS_VOLUME/status")
-    
-    if echo "$response" | jq -e '.Version' > /dev/null; then
-        print_success "SeaweedFS Volume Server is ready"
-        echo "Volume Server Version: $(echo "$response" | jq -r '.Version')"
-    else
-        print_error "SeaweedFS Volume Server is not ready"
-        echo "$response"
-        return 1
-    fi
-}
-
-test_rdma_engine() {
-    print_header "TESTING RDMA ENGINE"
-    
-    print_step "Checking RDMA engine socket..."
-    if [ -S "$RDMA_SOCKET_PATH" ]; then
-        print_success "RDMA engine socket exists"
-    else
-        print_error "RDMA engine socket not found at $RDMA_SOCKET_PATH"
-        return 1
-    fi
-    
-    print_step "Testing RDMA engine ping..."
-    if ./test-rdma ping --socket "$RDMA_SOCKET_PATH" 2>/dev/null; then
-        print_success "RDMA engine ping successful"
-    else
-        print_error "RDMA engine ping failed"
-        return 1
-    fi
-    
-    print_step "Testing RDMA engine capabilities..."
-    if ./test-rdma capabilities --socket "$RDMA_SOCKET_PATH" 2>/dev/null | grep -q "Version:"; then
-        print_success "RDMA engine capabilities retrieved"
-        ./test-rdma capabilities --socket "$RDMA_SOCKET_PATH" 2>/dev/null | head -5
-    else
-        print_error "RDMA engine capabilities failed"
-        return 1
-    fi
-}
-
-test_rdma_sidecar() {
-    print_header "TESTING RDMA SIDECAR"
-    
-    wait_for_service "$SIDECAR_URL/health" "RDMA Sidecar"
-    
-    print_step "Testing sidecar health..."
-    response=$(curl -s "$SIDECAR_URL/health")
-    
-    if echo "$response" | jq -e '.status == "healthy"' > /dev/null; then
-        print_success "RDMA Sidecar is healthy"
-        echo "RDMA Status: $(echo "$response" | jq -r '.rdma.enabled')"
-    else
-        print_error "RDMA Sidecar health check failed"
-        echo "$response"
-        return 1
-    fi
-    
-    print_step "Testing sidecar stats..."
-    stats=$(curl -s "$SIDECAR_URL/stats")
-    
-    if echo "$stats" | jq -e '.enabled' > /dev/null; then
-        print_success "RDMA Sidecar stats retrieved"
-        echo "RDMA Enabled: $(echo "$stats" | jq -r '.enabled')"
-        echo "RDMA Connected: $(echo "$stats" | jq -r '.connected')"
-        
-        if echo "$stats" | jq -e '.capabilities' > /dev/null; then
-            version=$(echo "$stats" | jq -r '.capabilities.version')
-            sessions=$(echo "$stats" | jq -r '.capabilities.max_sessions')
-            print_success "RDMA Engine Info: Version=$version, Max Sessions=$sessions"
-        fi
-    else
-        print_error "RDMA Sidecar stats failed"
-        echo "$stats"
-        return 1
-    fi
-}
-
-test_direct_rdma_operations() {
-    print_header "TESTING DIRECT RDMA OPERATIONS"
-    
-    print_step "Testing direct RDMA read operation..."
-    if ./test-rdma read --socket "$RDMA_SOCKET_PATH" --volume 1 --needle 12345 --size 1024 2>/dev/null | grep -q "RDMA read completed"; then
-        print_success "Direct RDMA read operation successful"
-    else
-        print_warning "Direct RDMA read operation failed (expected in mock mode)"
-    fi
-    
-    print_step "Running RDMA performance benchmark..."
-    benchmark_result=$(./test-rdma bench --socket "$RDMA_SOCKET_PATH" --iterations 5 --read-size 2048 2>/dev/null | tail -10)
-    
-    if echo "$benchmark_result" | grep -q "Operations/sec:"; then
-        print_success "RDMA benchmark completed"
-        echo "$benchmark_result" | grep -E "Operations|Latency|Throughput"
-    else
-        print_warning "RDMA benchmark had issues (expected in mock mode)"
-    fi
-}
-
-test_sidecar_needle_operations() {
-    print_header "TESTING SIDECAR NEEDLE OPERATIONS"
-    
-    print_step "Testing needle read via sidecar..."
-    response=$(curl -s "$SIDECAR_URL/read?volume=1&needle=12345&cookie=305419896&size=1024")
-    
-    if echo "$response" | jq -e '.success == true' > /dev/null; then
-        print_success "Sidecar needle read successful"
-        
-        is_rdma=$(echo "$response" | jq -r '.is_rdma')
-        source=$(echo "$response" | jq -r '.source')
-        duration=$(echo "$response" | jq -r '.duration')
-        
-        if [ "$is_rdma" = "true" ]; then
-            print_success "RDMA fast path used! Duration: $duration"
-        else
-            print_warning "HTTP fallback used. Duration: $duration"
-        fi
-        
-        echo "Response details:"
-        echo "$response" | jq '{success, is_rdma, source, duration, data_size}'
-    else
-        print_error "Sidecar needle read failed"
-        echo "$response"
-        return 1
-    fi
-}
-
-test_sidecar_benchmark() {
-    print_header "TESTING SIDECAR BENCHMARK"
-    
-    print_step "Running sidecar performance benchmark..."
-    response=$(curl -s "$SIDECAR_URL/benchmark?iterations=5&size=2048")
-    
-    if echo "$response" | jq -e '.benchmark_results' > /dev/null; then
-        print_success "Sidecar benchmark completed"
-        
-        rdma_ops=$(echo "$response" | jq -r '.benchmark_results.rdma_ops')
-        http_ops=$(echo "$response" | jq -r '.benchmark_results.http_ops')
-        avg_latency=$(echo "$response" | jq -r '.benchmark_results.avg_latency')
-        ops_per_sec=$(echo "$response" | jq -r '.benchmark_results.ops_per_sec')
-        
-        echo "Benchmark Results:"
-        echo "  RDMA Operations: $rdma_ops"
-        echo "  HTTP Operations: $http_ops"
-        echo "  Average Latency: $avg_latency"
-        echo "  Operations/sec: $ops_per_sec"
-    else
-        print_error "Sidecar benchmark failed"
-        echo "$response"
-        return 1
-    fi
-}
-
-test_error_handling() {
-    print_header "TESTING ERROR HANDLING AND FALLBACK"
-    
-    print_step "Testing invalid needle read..."
-    response=$(curl -s "$SIDECAR_URL/read?volume=999&needle=999999&size=1024")
-    
-    # Should succeed with mock data or fail gracefully
-    if echo "$response" | jq -e '.success' > /dev/null; then
-        result=$(echo "$response" | jq -r '.success')
-        if [ "$result" = "true" ]; then
-            print_success "Error handling working - mock data returned"
-        else
-            print_success "Error handling working - graceful failure"
-        fi
-    else
-        print_success "Error handling working - proper error response"
-    fi
-}
-
-main() {
-    print_header "🚀 SEAWEEDFS RDMA INTEGRATION TEST SUITE"
-    
-    echo -e "${GREEN}Starting comprehensive integration tests...${NC}"
-    echo -e "${BLUE}Environment:${NC}"
-    echo -e "  RDMA Socket: $RDMA_SOCKET_PATH"
-    echo -e "  Sidecar URL: $SIDECAR_URL"
-    echo -e "  SeaweedFS Master: $SEAWEEDFS_MASTER"
-    echo -e "  SeaweedFS Volume: $SEAWEEDFS_VOLUME"
-    
-    # Run tests in sequence
-    test_seaweedfs_master
-    test_seaweedfs_volume
-    test_rdma_engine
-    test_rdma_sidecar
-    test_direct_rdma_operations
-    test_sidecar_needle_operations
-    test_sidecar_benchmark
-    test_error_handling
-    
-    print_header "🎉 ALL INTEGRATION TESTS COMPLETED!"
-    
-    echo -e "${GREEN}✅ Test Summary:${NC}"
-    echo -e "  ✅ SeaweedFS Master: Working"
-    echo -e "  ✅ SeaweedFS Volume Server: Working"
-    echo -e "  ✅ Rust RDMA Engine: Working (Mock Mode)"
-    echo -e "  ✅ Go RDMA Sidecar: Working"
-    echo -e "  ✅ IPC Communication: Working"
-    echo -e "  ✅ Needle Operations: Working"
-    echo -e "  ✅ Performance Benchmarking: Working"
-    echo -e "  ✅ Error Handling: Working"
-    
-    print_success "SeaweedFS RDMA integration is fully functional!"
-    
-    return 0
-}
-
-# Check required environment variables
-if [ -z "$RDMA_SOCKET_PATH" ] || [ -z "$SIDECAR_URL" ] || [ -z "$SEAWEEDFS_MASTER" ] || [ -z "$SEAWEEDFS_VOLUME" ]; then
-    print_error "Required environment variables not set"
-    echo "Required: RDMA_SOCKET_PATH, SIDECAR_URL, SEAWEEDFS_MASTER, SEAWEEDFS_VOLUME"
-    exit 1
-fi
-
-# Run main test suite
-main "$@"
diff --git a/telemetry/README.md b/telemetry/README.md
index b734d1f122..85fc48598e 100644
--- a/telemetry/README.md
+++ b/telemetry/README.md
@@ -68,6 +68,8 @@ message TelemetryData {
 | `broker_count` | Number of broker servers | `1` |
 | `timestamp` | When data was collected | `1640995200` |
 
+A master starts reporting once its cluster stores at least 10 GiB, and the server drops reports under that floor. Every fresh `weed server`, CI job and throwaway container mints its own cluster id, and at tens of thousands a day they were nearly all of the counted clusters and almost none of the bytes.
+
 ## Quick Start
 
 ### 1. Deploy Telemetry Server
@@ -139,7 +141,7 @@ The telemetry server exposes these Prometheus metrics:
 ### Cluster Metrics
 - `seaweedfs_telemetry_total_clusters`: Total unique clusters (30 days)
 - `seaweedfs_telemetry_active_clusters`: Active clusters (7 days)
-- `seaweedfs_telemetry_confirmed_clusters`: Active clusters seen on 2+ distinct days — one-shot reports don't count, and the version/OS distributions in `/api/stats` are computed over these
+- `seaweedfs_telemetry_confirmed_clusters`: Active clusters seen on 7+ distinct days — one-shot reports don't count, and the version/OS distributions in `/api/stats` are computed over these
 
 ### Per-Cluster Metrics
 - `seaweedfs_telemetry_volume_servers{cluster_id}`: Volume servers per cluster
@@ -156,6 +158,7 @@ series across upgrades. To slice values by version or OS, join with
 
 ### Server Metrics
 - `seaweedfs_telemetry_reports_received_total`: Total telemetry reports received
+- `seaweedfs_telemetry_reports_skipped_total`: Reports dropped because the cluster stores less than 10 GiB
 
 ## API Endpoints
 
diff --git a/telemetry/proto/floor.go b/telemetry/proto/floor.go
new file mode 100644
index 0000000000..8c8c9efd7b
--- /dev/null
+++ b/telemetry/proto/floor.go
@@ -0,0 +1,7 @@
+package proto
+
+// MinDiskBytes is what a cluster must store before its master reports it and
+// the server keeps the report: fresh `weed server` runs, CI jobs and throwaway
+// containers each mint their own cluster id, and they were most of the counted
+// clusters while holding almost none of the bytes.
+const MinDiskBytes uint64 = 10 << 30
diff --git a/telemetry/server/Dockerfile b/telemetry/server/Dockerfile
index 76fcb54cce..759df98183 100644
--- a/telemetry/server/Dockerfile
+++ b/telemetry/server/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 WORKDIR /app
 
@@ -12,7 +12,8 @@ WORKDIR /app/telemetry/server
 RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags '-extldflags "-static"' -o telemetry-server .
 
 FROM alpine:latest
-RUN apk --no-cache add ca-certificates \
+RUN apk upgrade --no-cache \
+    && apk --no-cache add ca-certificates libcrypto3 libssl3 \
     && addgroup -S appgroup \
     && adduser -S appuser -G appgroup
 
diff --git a/telemetry/server/api/handlers_test.go b/telemetry/server/api/handlers_test.go
index d6c10bf1b2..ec7eef971d 100644
--- a/telemetry/server/api/handlers_test.go
+++ b/telemetry/server/api/handlers_test.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"bytes"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -11,13 +12,16 @@ import (
 	protobuf "google.golang.org/protobuf/proto"
 )
 
+// promauto registers on the global registry: one storage per test binary.
+var testHandler = NewHandler(storage.NewPrometheusStorage())
+
 func validReport() *proto.TelemetryData {
 	return &proto.TelemetryData{
 		TopologyId:        "38422678-6a0d-4482-aa33-65b90010ac47",
 		Version:           "4.40",
 		Os:                "linux/amd64",
 		VolumeServerCount: 5,
-		TotalDiskBytes:    123456789,
+		TotalDiskBytes:    123 << 30,
 		TotalVolumeCount:  42,
 		FilerCount:        2,
 		BrokerCount:       1,
@@ -43,8 +47,7 @@ func marshalReport(t *testing.T, data *proto.TelemetryData) []byte {
 }
 
 func TestCollectTelemetryValidation(t *testing.T) {
-	// promauto registers on the global registry: one storage per test binary.
-	h := NewHandler(storage.NewPrometheusStorage())
+	h := testHandler
 
 	t.Run("valid report accepted", func(t *testing.T) {
 		if w := postCollect(t, h, marshalReport(t, validReport()), "application/x-protobuf"); w.Code != http.StatusOK {
@@ -96,3 +99,42 @@ func TestCollectTelemetryValidation(t *testing.T) {
 		}
 	})
 }
+
+// The dashboard looks confirmation windows up by the select's string value,
+// so the stats JSON must key confirmed_by_days by decimal strings and carry
+// unmet thresholds as zeros.
+func TestStatsSerializedThresholds(t *testing.T) {
+	data := validReport()
+	data.TopologyId = "49533789-7b1e-4593-bb44-76ca1121bd58"
+	if w := postCollect(t, testHandler, marshalReport(t, data), "application/x-protobuf"); w.Code != http.StatusOK {
+		t.Fatalf("collect: got %d: %s", w.Code, w.Body.String())
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/stats", nil)
+	w := httptest.NewRecorder()
+	testHandler.GetStats(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("stats: got %d", w.Code)
+	}
+
+	var stats struct {
+		ConfirmedByDays map[string]int `json:"confirmed_by_days"`
+	}
+	if err := json.Unmarshal(w.Body.Bytes(), &stats); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(stats.ConfirmedByDays) != 5 {
+		t.Fatalf("confirmed_by_days = %v, want the 5 thresholds", stats.ConfirmedByDays)
+	}
+	for _, key := range []string{"1", "3", "7", "14", "30"} {
+		if _, ok := stats.ConfirmedByDays[key]; !ok {
+			t.Errorf("confirmed_by_days missing %q: %v", key, stats.ConfirmedByDays)
+		}
+	}
+	if stats.ConfirmedByDays["1"] < 1 {
+		t.Errorf("fresh cluster missing from the 1-day count: %v", stats.ConfirmedByDays)
+	}
+	if stats.ConfirmedByDays["30"] != 0 {
+		t.Errorf("unmet threshold not zero: %v", stats.ConfirmedByDays)
+	}
+}
diff --git a/telemetry/server/dashboard/dashboard.go b/telemetry/server/dashboard/dashboard.go
index 5a8b6e077a..e049c702ea 100644
--- a/telemetry/server/dashboard/dashboard.go
+++ b/telemetry/server/dashboard/dashboard.go
@@ -57,6 +57,15 @@ func (h *Handler) ServeIndex(w http.ResponseWriter, r *http.Request) {
             color: #666;
             margin-top: 5px;
         }
+        .stat-label select {
+            border: none;
+            background: none;
+            color: inherit;
+            font: inherit;
+            padding: 0;
+            cursor: pointer;
+            text-decoration: underline dotted;
+        }
         .chart-container {
             background: white;
             padding: 20px;
@@ -129,7 +138,14 @@ func (h *Handler) ServeIndex(w http.ResponseWriter, r *http.Request) {
                 </div>
                 <div class="stat-card">
                     <div class="stat-value" id="confirmedInstances">-</div>
-                    <div class="stat-label">Confirmed Clusters (2+ days)</div>
+                    <div class="stat-label">Confirmed Clusters
+                        (<select id="confirmDays" onchange="updateConfirmed()">
+                            <option value="1">1+</option>
+                            <option value="3">3+</option>
+                            <option value="7" selected>7+</option>
+                            <option value="14">14+</option>
+                            <option value="30">30+</option>
+                        </select> days)</div>
                 </div>
                 <div class="stat-card">
                     <div class="stat-value" id="totalVersions">-</div>
@@ -229,14 +245,26 @@ func (h *Handler) ServeIndex(w http.ResponseWriter, r *http.Request) {
             }
         }
 
+        let latestStats = {};
+
         function updateStats(stats) {
+            latestStats = stats;
             document.getElementById('totalInstances').textContent = stats.total_instances || 0;
             document.getElementById('activeInstances').textContent = stats.active_instances || 0;
-            document.getElementById('confirmedInstances').textContent = stats.confirmed_instances || 0;
+            updateConfirmed();
             document.getElementById('totalVersions').textContent = Object.keys(stats.versions || {}).length;
             document.getElementById('totalOS').textContent = Object.keys(stats.os_distribution || {}).length;
         }
 
+        // Servers from before confirmed_by_days fall back to the fixed
+        // 7-day count.
+        function updateConfirmed() {
+            const days = document.getElementById('confirmDays').value;
+            const byDays = latestStats.confirmed_by_days || {};
+            const count = byDays[days] !== undefined ? byDays[days] : latestStats.confirmed_instances;
+            document.getElementById('confirmedInstances').textContent = count || 0;
+        }
+
         function updateCharts(stats) {
             createPieChart('versionChart', 'Version Distribution', stats.versions || {});
             createPieChart('osChart', 'Operating System Distribution', stats.os_distribution || {});
diff --git a/telemetry/server/go.mod b/telemetry/server/go.mod
index 8c5f7ecbf9..1d0bfda607 100644
--- a/telemetry/server/go.mod
+++ b/telemetry/server/go.mod
@@ -1,21 +1,21 @@
 module github.com/seaweedfs/seaweedfs/telemetry/server
 
-go 1.25.8
+go 1.26.6
 
 require (
 	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_model v0.6.3
 	github.com/seaweedfs/seaweedfs v0.0.0-00010101000000-000000000000
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/protobuf v1.36.12
 )
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 )
 
 replace github.com/seaweedfs/seaweedfs => ../..
diff --git a/telemetry/server/go.sum b/telemetry/server/go.sum
index 9e8f705c00..5bf02da2f1 100644
--- a/telemetry/server/go.sum
+++ b/telemetry/server/go.sum
@@ -6,8 +6,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
-github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
@@ -16,21 +16,21 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
 github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
 github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/telemetry/server/storage/confirmed_test.go b/telemetry/server/storage/confirmed_test.go
index 4670d14337..2e70309d9a 100644
--- a/telemetry/server/storage/confirmed_test.go
+++ b/telemetry/server/storage/confirmed_test.go
@@ -14,7 +14,7 @@ func report(id, version string) *proto.TelemetryData {
 		Version:           version,
 		Os:                "linux/amd64",
 		VolumeServerCount: 1,
-		TotalDiskBytes:    100,
+		TotalDiskBytes:    proto.MinDiskBytes,
 		TotalVolumeCount:  1,
 	}
 }
@@ -44,13 +44,18 @@ func TestConfirmedClusters(t *testing.T) {
 		t.Fatalf("fallback distribution missing active cluster: %v", v)
 	}
 
-	// Give cluster A a sample from yesterday: now seen on 2 distinct days.
+	// Give cluster A samples from the six previous days: now seen on 7
+	// distinct days.
 	s.mu.Lock()
 	id := "aaaaaaaa-0000-0000-0000-000000000001"
-	s.histories[id] = append([]HistorySample{{
-		Ts:             time.Now().AddDate(0, 0, -1).Unix(),
-		TotalDiskBytes: 50,
-	}}, s.histories[id]...)
+	var older []HistorySample
+	for offset := -6; offset < 0; offset++ {
+		older = append(older, HistorySample{
+			Ts:             time.Now().AddDate(0, 0, offset).Unix(),
+			TotalDiskBytes: 50,
+		})
+	}
+	s.histories[id] = append(older, s.histories[id]...)
 	s.mu.Unlock()
 
 	// A one-shot cluster B arrives (like an injected report): it counts as
@@ -60,7 +65,7 @@ func TestConfirmedClusters(t *testing.T) {
 	}
 	stats = statsOf(t, s)
 	if stats["active_instances"] != 2 || stats["confirmed_instances"] != 1 {
-		t.Fatalf("day two: active=%v confirmed=%v, want 2/1", stats["active_instances"], stats["confirmed_instances"])
+		t.Fatalf("day seven: active=%v confirmed=%v, want 2/1", stats["active_instances"], stats["confirmed_instances"])
 	}
 	v := stats["versions"].(map[string]int)
 	if v["4.40"] != 1 {
@@ -69,4 +74,14 @@ func TestConfirmedClusters(t *testing.T) {
 	if _, ok := v["9.99"]; ok {
 		t.Errorf("one-shot cluster polluted the distribution: %v", v)
 	}
+
+	// Cluster A meets the 1/3/7-day thresholds, B only the 1-day one, and
+	// unmet thresholds are present as zero so the dashboard can show them.
+	byDays := stats["confirmed_by_days"].(map[int]int)
+	want := map[int]int{1: 2, 3: 1, 7: 1, 14: 0, 30: 0}
+	for threshold, expected := range want {
+		if got, ok := byDays[threshold]; !ok || got != expected {
+			t.Errorf("confirmed_by_days[%d] = %v (present=%v), want %d", threshold, got, ok, expected)
+		}
+	}
 }
diff --git a/telemetry/server/storage/floor_test.go b/telemetry/server/storage/floor_test.go
new file mode 100644
index 0000000000..f32034f699
--- /dev/null
+++ b/telemetry/server/storage/floor_test.go
@@ -0,0 +1,90 @@
+package storage
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+	"github.com/seaweedfs/seaweedfs/telemetry/proto"
+)
+
+func counterValue(t *testing.T, c prometheus.Counter) float64 {
+	t.Helper()
+	var m dto.Metric
+	if err := c.Write(&m); err != nil {
+		t.Fatal(err)
+	}
+	return m.GetCounter().GetValue()
+}
+
+func TestClustersUnderTheFloorAreNotKept(t *testing.T) {
+	s := newPrometheusStorage(prometheus.NewRegistry())
+
+	// report() sits exactly on the floor, which is enough.
+	if err := s.StoreTelemetry(report("aaaaaaaa-0000-0000-0000-000000000001", "4.40")); err != nil {
+		t.Fatal(err)
+	}
+	small := report("bbbbbbbb-0000-0000-0000-000000000002", "4.40")
+	small.TotalDiskBytes = proto.MinDiskBytes - 1
+	if err := s.StoreTelemetry(small); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, ok := s.instances[small.TopologyId]; ok {
+		t.Fatal("cluster under the floor was kept")
+	}
+	if _, ok := s.GetHistory(small.TopologyId, 90); ok {
+		t.Fatal("history kept for a cluster under the floor")
+	}
+	if stats := statsOf(t, s); stats["active_instances"] != 1 {
+		t.Errorf("active = %v, want the one cluster on the floor", stats["active_instances"])
+	}
+	if got := counterValue(t, s.telemetryReceived); got != 2 {
+		t.Errorf("received = %v, want 2", got)
+	}
+	if got := counterValue(t, s.reportsSkipped); got != 1 {
+		t.Errorf("skipped = %v, want 1", got)
+	}
+}
+
+// State written before the floor existed carries clusters under it; loading
+// drops them and marks the state dirty so the next save sheds them from disk.
+func TestLoadStateDropsClustersUnderTheFloor(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "telemetry-state.json")
+
+	s := newPrometheusStorage(prometheus.NewRegistry())
+	kept := report("aaaaaaaa-0000-0000-0000-000000000001", "4.40")
+	if err := s.StoreTelemetry(kept); err != nil {
+		t.Fatal(err)
+	}
+	small := report("bbbbbbbb-0000-0000-0000-000000000002", "4.40")
+	small.TotalDiskBytes = proto.MinDiskBytes - 1
+	s.instances[small.TopologyId] = &telemetryData{TelemetryData: small, ReceivedAt: time.Now()}
+	s.histories[small.TopologyId] = []HistorySample{{Ts: time.Now().Unix(), TotalDiskBytes: small.TotalDiskBytes}}
+	if err := s.SaveStateIfDirty(path); err != nil {
+		t.Fatal(err)
+	}
+
+	s = newPrometheusStorage(prometheus.NewRegistry())
+	n, err := s.LoadState(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != 1 {
+		t.Errorf("loaded %d instances, want 1", n)
+	}
+	if _, ok := s.instances[small.TopologyId]; ok {
+		t.Error("cluster under the floor survived the load")
+	}
+	if _, ok := s.histories[small.TopologyId]; ok {
+		t.Error("history of a cluster under the floor survived the load")
+	}
+	if _, ok := s.instances[kept.TopologyId]; !ok {
+		t.Error("cluster on the floor was dropped")
+	}
+	if !s.dirty {
+		t.Error("dropping a cluster left the state clean, so it would stay on disk")
+	}
+}
diff --git a/telemetry/server/storage/history.go b/telemetry/server/storage/history.go
index e51d9a7860..a1ed779303 100644
--- a/telemetry/server/storage/history.go
+++ b/telemetry/server/storage/history.go
@@ -8,7 +8,11 @@ import (
 
 // confirmDays is how many distinct UTC days a cluster must have reported
 // on before it counts as confirmed in the aggregated stats.
-const confirmDays = 2
+const confirmDays = 7
+
+// confirmThresholds are the confirmation windows the dashboard lets the
+// viewer pick between; confirmDays is the one everything else is built on.
+var confirmThresholds = []int{1, 3, 7, 14, 30}
 
 // activeDays is how recently a cluster must have reported to count as active.
 const activeDays = 7
@@ -43,9 +47,9 @@ func (s *PrometheusStorage) appendHistory(data *proto.TelemetryData, receivedAt
 }
 
 // seriesHistories picks the clusters the fleet-wide series are built from: the
-// confirmed ones. A cluster that only ever reported on one day is usually a CI
-// or test cluster that lived for a minute, and those arrive faster than they
-// age out, so counting them makes every fleet total climb forever. Falls back to
+// confirmed ones. A cluster that reported for less than a week is usually a CI
+// or test cluster, and those arrive faster than they age out, so counting them
+// makes every fleet total climb forever. Falls back to
 // all clusters while none is confirmed yet, so a fresh server still draws its
 // charts. Callers must hold s.mu.
 func (s *PrometheusStorage) seriesHistories() map[string][]HistorySample {
diff --git a/telemetry/server/storage/history_test.go b/telemetry/server/storage/history_test.go
index 0f3775eed3..e1f8bf3c7f 100644
--- a/telemetry/server/storage/history_test.go
+++ b/telemetry/server/storage/history_test.go
@@ -17,7 +17,7 @@ func TestClusterHistory(t *testing.T) {
 		Version:           "4.40",
 		Os:                "linux/amd64",
 		VolumeServerCount: 3,
-		TotalDiskBytes:    1000,
+		TotalDiskBytes:    proto.MinDiskBytes + 1000,
 		TotalVolumeCount:  10,
 	}
 	if err := s.StoreTelemetry(report); err != nil {
@@ -25,7 +25,7 @@ func TestClusterHistory(t *testing.T) {
 	}
 
 	// A second report on the same UTC day replaces the day's sample.
-	report.TotalDiskBytes = 2000
+	report.TotalDiskBytes = proto.MinDiskBytes + 2000
 	if err := s.StoreTelemetry(report); err != nil {
 		t.Fatalf("store: %v", err)
 	}
@@ -36,7 +36,7 @@ func TestClusterHistory(t *testing.T) {
 	if len(samples) != 1 {
 		t.Fatalf("got %d samples, want 1 (same-day replace)", len(samples))
 	}
-	if samples[0].TotalDiskBytes != 2000 {
+	if samples[0].TotalDiskBytes != proto.MinDiskBytes+2000 {
 		t.Errorf("same-day sample not replaced: got %d", samples[0].TotalDiskBytes)
 	}
 
@@ -62,7 +62,7 @@ func TestClusterHistory(t *testing.T) {
 	if !ok || len(samples) != 2 {
 		t.Fatalf("after round trip: ok=%v samples=%d, want 2", ok, len(samples))
 	}
-	if samples[0].TotalDiskBytes != 500 || samples[1].TotalDiskBytes != 2000 {
+	if samples[0].TotalDiskBytes != 500 || samples[1].TotalDiskBytes != proto.MinDiskBytes+2000 {
 		t.Errorf("samples corrupted after round trip: %+v", samples)
 	}
 
diff --git a/telemetry/server/storage/metrics_test.go b/telemetry/server/storage/metrics_test.go
index 185b631af0..566c669247 100644
--- a/telemetry/server/storage/metrics_test.go
+++ b/telemetry/server/storage/metrics_test.go
@@ -15,7 +15,8 @@ func TestGetMetricsSumsEachDay(t *testing.T) {
 	seedSamples(s, "daily", HistorySample{TotalDiskBytes: 300, VolumeServerCount: 3},
 		-9, -8, -7, -6, -5, -4, -3, -2, -1, 0)
 	// Stopped reporting past the active window: counts on its own days only.
-	seedSamples(s, "gone", HistorySample{TotalDiskBytes: 900, VolumeServerCount: 9}, -9, -8)
+	seedSamples(s, "gone", HistorySample{TotalDiskBytes: 900, VolumeServerCount: 9},
+		-14, -13, -12, -11, -10, -9, -8)
 
 	metrics, err := s.GetMetrics(10)
 	if err != nil {
@@ -40,7 +41,8 @@ func TestGetMetricsSumsEachDay(t *testing.T) {
 func TestGetMetricsCarriesSkippedDaysForward(t *testing.T) {
 	s := newPrometheusStorage(prometheus.NewRegistry())
 
-	seedSamples(s, "gappy", HistorySample{TotalDiskBytes: 500, VolumeServerCount: 5}, -3, -1)
+	seedSamples(s, "gappy", HistorySample{TotalDiskBytes: 500, VolumeServerCount: 5},
+		-8, -7, -6, -5, -4, -3, -1)
 
 	metrics, err := s.GetMetrics(4)
 	if err != nil {
@@ -56,21 +58,23 @@ func TestGetMetricsCarriesSkippedDaysForward(t *testing.T) {
 // out of nothing on its first day of data.
 func TestGetMetricsWindowStartsAtOldestSample(t *testing.T) {
 	s := newPrometheusStorage(prometheus.NewRegistry())
-	seedSamples(s, "recent", HistorySample{TotalDiskBytes: 100, VolumeServerCount: 1}, -2, -1, 0)
+	seedSamples(s, "recent", HistorySample{TotalDiskBytes: 100, VolumeServerCount: 1},
+		-6, -5, -4, -3, -2, -1, 0)
 
 	metrics, err := s.GetMetrics(30)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if got := metrics["dates"].([]string); len(got) != 3 {
-		t.Errorf("dates = %v, want the 3 days with history, not 30", got)
+	if got := metrics["dates"].([]string); len(got) != 7 {
+		t.Errorf("dates = %v, want the 7 days with history, not 30", got)
 	}
-	if got := metrics["disk_usage"].([]uint64); !equal(got, []uint64{100, 100, 100}) {
+	if got := metrics["disk_usage"].([]uint64); !equal(got, []uint64{100, 100, 100, 100, 100, 100, 100}) {
 		t.Errorf("disk_usage = %v, want no leading zero days", got)
 	}
 
 	// History reaching past the requested window still clips to the window.
-	seedSamples(s, "old", HistorySample{TotalDiskBytes: 50, VolumeServerCount: 1}, -40, -39)
+	seedSamples(s, "old", HistorySample{TotalDiskBytes: 50, VolumeServerCount: 1},
+		-45, -44, -43, -42, -41, -40, -39)
 	metrics, err = s.GetMetrics(10)
 	if err != nil {
 		t.Fatal(err)
@@ -86,8 +90,10 @@ func TestGetMetricsAgreesWithClusterSizes(t *testing.T) {
 	s := newPrometheusStorage(prometheus.NewRegistry())
 	seedSamples(s, "daily", HistorySample{TotalDiskBytes: 300, VolumeServerCount: 3},
 		-9, -8, -7, -6, -5, -4, -3, -2, -1, 0)
-	seedSamples(s, "lagging", HistorySample{TotalDiskBytes: 200, VolumeServerCount: 2}, -3, -2)
-	seedSamples(s, "gone", HistorySample{TotalDiskBytes: 900, VolumeServerCount: 9}, -9, -8)
+	seedSamples(s, "lagging", HistorySample{TotalDiskBytes: 200, VolumeServerCount: 2},
+		-8, -7, -6, -5, -4, -3, -2)
+	seedSamples(s, "gone", HistorySample{TotalDiskBytes: 900, VolumeServerCount: 9},
+		-14, -13, -12, -11, -10, -9, -8)
 
 	metrics, err := s.GetMetrics(10)
 	if err != nil {
@@ -111,7 +117,8 @@ func TestGetMetricsAgreesWithClusterSizes(t *testing.T) {
 func TestGetMetricsExcludesUnconfirmedClusters(t *testing.T) {
 	s := newPrometheusStorage(prometheus.NewRegistry())
 
-	seedSamples(s, "real", HistorySample{TotalDiskBytes: 300, VolumeServerCount: 3}, -3, -2, -1, 0)
+	seedSamples(s, "real", HistorySample{TotalDiskBytes: 300, VolumeServerCount: 3},
+		-6, -5, -4, -3, -2, -1, 0)
 	for _, id := range []string{"ci-1", "ci-2", "ci-3"} {
 		seedSamples(s, id, HistorySample{TotalDiskBytes: 5, VolumeServerCount: 14}, -1)
 	}
@@ -128,7 +135,7 @@ func TestGetMetricsExcludesUnconfirmedClusters(t *testing.T) {
 	}
 }
 
-// Until any cluster has two days of history the charts fall back to every
+// Until any cluster has a week of history the charts fall back to every
 // cluster, so a fresh server doesn't serve empty series.
 func TestGetMetricsFallsBackWhenNoneConfirmed(t *testing.T) {
 	s := newPrometheusStorage(prometheus.NewRegistry())
diff --git a/telemetry/server/storage/persistence.go b/telemetry/server/storage/persistence.go
index a61740ec77..194c848ac4 100644
--- a/telemetry/server/storage/persistence.go
+++ b/telemetry/server/storage/persistence.go
@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+
+	"github.com/seaweedfs/seaweedfs/telemetry/proto"
 )
 
 // persistedState is the on-disk snapshot of the in-memory instance map.
@@ -16,7 +18,8 @@ type persistedState struct {
 // LoadState restores the instance map and Prometheus gauges from a state file
 // written by SaveStateIfDirty. A missing file is not an error. Original
 // ReceivedAt timestamps are preserved so cleanup and the active-cluster
-// windows stay correct across restarts.
+// windows stay correct across restarts. Clusters under proto.MinDiskBytes are
+// dropped, so state written before the floor sheds them on the first restart.
 func (s *PrometheusStorage) LoadState(path string) (int, error) {
 	b, err := os.ReadFile(path)
 	if err != nil {
@@ -39,6 +42,10 @@ func (s *PrometheusStorage) LoadState(path string) (int, error) {
 		if instance == nil || instance.TelemetryData == nil || instance.TelemetryData.TopologyId == "" {
 			continue
 		}
+		if instance.TelemetryData.TotalDiskBytes < proto.MinDiskBytes {
+			s.dirty = true // so the next save sheds it
+			continue
+		}
 		s.instances[id] = instance
 		s.setClusterMetrics(instance.TelemetryData)
 		loaded++
diff --git a/telemetry/server/storage/persistence_test.go b/telemetry/server/storage/persistence_test.go
index df11545f62..6417f7016e 100644
--- a/telemetry/server/storage/persistence_test.go
+++ b/telemetry/server/storage/persistence_test.go
@@ -26,7 +26,7 @@ func TestStateRoundTrip(t *testing.T) {
 		Version:           "4.40",
 		Os:                "linux/amd64",
 		VolumeServerCount: 5,
-		TotalDiskBytes:    123456789,
+		TotalDiskBytes:    123 << 30,
 		TotalVolumeCount:  42,
 		FilerCount:        2,
 		BrokerCount:       1,
@@ -79,7 +79,7 @@ func TestLoadStateFillsNewestSampleVersion(t *testing.T) {
 	path := filepath.Join(t.TempDir(), "telemetry-state.json")
 
 	s := newPrometheusStorage(prometheus.NewRegistry())
-	report := &proto.TelemetryData{TopologyId: "test-cluster-1", Version: "4.40", Os: "linux/amd64"}
+	report := &proto.TelemetryData{TopologyId: "test-cluster-1", Version: "4.40", Os: "linux/amd64", TotalDiskBytes: proto.MinDiskBytes}
 	if err := s.StoreTelemetry(report); err != nil {
 		t.Fatalf("store: %v", err)
 	}
diff --git a/telemetry/server/storage/prometheus.go b/telemetry/server/storage/prometheus.go
index 8c664e090b..b9756a8b35 100644
--- a/telemetry/server/storage/prometheus.go
+++ b/telemetry/server/storage/prometheus.go
@@ -1,6 +1,7 @@
 package storage
 
 import (
+	"fmt"
 	"sync"
 	"time"
 
@@ -21,6 +22,7 @@ type PrometheusStorage struct {
 	brokerCount       *prometheus.GaugeVec
 	clusterInfo       *prometheus.GaugeVec
 	telemetryReceived prometheus.Counter
+	reportsSkipped    prometheus.Counter
 
 	// In-memory storage for API endpoints (if needed)
 	mu        sync.RWMutex
@@ -53,7 +55,7 @@ func newPrometheusStorage(reg prometheus.Registerer) *PrometheusStorage {
 		}),
 		confirmedClusters: promauto.NewGauge(prometheus.GaugeOpts{
 			Name: "seaweedfs_telemetry_confirmed_clusters",
-			Help: "Active clusters seen on at least 2 distinct days (last 7 days)",
+			Help: "Active clusters seen on at least 7 distinct days (last 7 days)",
 		}),
 		volumeServerCount: promauto.NewGaugeVec(prometheus.GaugeOpts{
 			Name: "seaweedfs_telemetry_volume_servers",
@@ -83,6 +85,10 @@ func newPrometheusStorage(reg prometheus.Registerer) *PrometheusStorage {
 			Name: "seaweedfs_telemetry_reports_received_total",
 			Help: "Total number of telemetry reports received",
 		}),
+		reportsSkipped: promauto.NewCounter(prometheus.CounterOpts{
+			Name: "seaweedfs_telemetry_reports_skipped_total",
+			Help: fmt.Sprintf("Reports not kept because the cluster stores less than %d GiB", proto.MinDiskBytes>>30),
+		}),
 		instances: make(map[string]*telemetryData),
 		histories: make(map[string][]HistorySample),
 		stats:     make(map[string]interface{}),
@@ -93,6 +99,12 @@ func (s *PrometheusStorage) StoreTelemetry(data *proto.TelemetryData) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
+	s.telemetryReceived.Inc()
+	if data.TotalDiskBytes < proto.MinDiskBytes {
+		s.reportsSkipped.Inc()
+		return nil
+	}
+
 	// Drop the cluster_info series recorded under the previous label set when
 	// a cluster reports back with a different version or OS, so it is not
 	// counted under two versions at once.
@@ -102,8 +114,6 @@ func (s *PrometheusStorage) StoreTelemetry(data *proto.TelemetryData) error {
 	}
 	s.setClusterMetrics(data)
 
-	s.telemetryReceived.Inc()
-
 	// Store in memory for API endpoints
 	receivedAt := time.Now().UTC()
 	s.instances[data.TopologyId] = &telemetryData{
@@ -207,6 +217,10 @@ func (s *PrometheusStorage) updateStats() {
 	totalInstances := 0
 	activeInstances := 0
 	confirmedInstances := 0
+	confirmedByDays := make(map[int]int, len(confirmThresholds))
+	for _, threshold := range confirmThresholds {
+		confirmedByDays[threshold] = 0
+	}
 	versionsAll := make(map[string]int)
 	osAll := make(map[string]int)
 	versionsConfirmed := make(map[string]int)
@@ -220,10 +234,16 @@ func (s *PrometheusStorage) updateStats() {
 			activeInstances++
 			versionsAll[instance.TelemetryData.Version]++
 			osAll[instance.TelemetryData.Os]++
-			// A cluster is confirmed once seen on >=2 distinct UTC days
-			// (histories hold one sample per day), so one-shot reports
-			// can't skew the distributions below.
-			if len(s.histories[instance.TelemetryData.TopologyId]) >= confirmDays {
+			// A cluster is confirmed once seen on confirmDays distinct UTC
+			// days (histories hold one sample per day), so short-lived
+			// clusters can't skew the distributions below.
+			daysSeen := len(s.histories[instance.TelemetryData.TopologyId])
+			for _, threshold := range confirmThresholds {
+				if daysSeen >= threshold {
+					confirmedByDays[threshold]++
+				}
+			}
+			if daysSeen >= confirmDays {
 				confirmedInstances++
 				versionsConfirmed[instance.TelemetryData.Version]++
 				osConfirmed[instance.TelemetryData.Os]++
@@ -231,7 +251,7 @@ func (s *PrometheusStorage) updateStats() {
 		}
 	}
 
-	// Before any cluster has two days of history (fresh server with no
+	// Before any cluster has a week of history (fresh server with no
 	// prior state), fall back to all active clusters so the dashboard
 	// distributions aren't empty.
 	versions, osDistribution := versionsConfirmed, osConfirmed
@@ -249,6 +269,7 @@ func (s *PrometheusStorage) updateStats() {
 		"total_instances":     totalInstances,
 		"active_instances":    activeInstances,
 		"confirmed_instances": confirmedInstances,
+		"confirmed_by_days":   confirmedByDays,
 		"versions":            versions,
 		"os_distribution":     osDistribution,
 	}
diff --git a/telemetry/server/storage/sizes_test.go b/telemetry/server/storage/sizes_test.go
index b2ea82c062..6217a53785 100644
--- a/telemetry/server/storage/sizes_test.go
+++ b/telemetry/server/storage/sizes_test.go
@@ -25,11 +25,13 @@ func TestClusterSizeSeries(t *testing.T) {
 	// Reported every day of the window.
 	seedSamples(s, "daily", HistorySample{TotalDiskBytes: 300, VolumeServerCount: 3},
 		-9, -8, -7, -6, -5, -4, -3, -2, -1, 0)
-	// Reported two days ago and not since: still active, so its size is held
-	// to the right edge instead of dropping out of the stack.
-	seedSamples(s, "lagging", HistorySample{TotalDiskBytes: 200, VolumeServerCount: 2}, -3, -2)
+	// Stopped reporting two days ago: still active, so its size is held to
+	// the right edge instead of dropping out of the stack.
+	seedSamples(s, "lagging", HistorySample{TotalDiskBytes: 200, VolumeServerCount: 2},
+		-8, -7, -6, -5, -4, -3, -2)
 	// Stopped reporting past the active window: its own days only.
-	seedSamples(s, "gone", HistorySample{TotalDiskBytes: 900, VolumeServerCount: 9}, -9, -8)
+	seedSamples(s, "gone", HistorySample{TotalDiskBytes: 900, VolumeServerCount: 9},
+		-14, -13, -12, -11, -10, -9, -8)
 	// One day of history only: unconfirmed, so it stays out of the stack.
 	seedSamples(s, "oneshot", HistorySample{TotalDiskBytes: 400, VolumeServerCount: 4}, -1)
 
@@ -48,7 +50,7 @@ func TestClusterSizeSeries(t *testing.T) {
 	if got := byId["daily"].Disk; !equal(got, []uint64{300, 300, 300, 300, 300, 300, 300, 300, 300, 300}) {
 		t.Errorf("daily = %v, want 300 every day", got)
 	}
-	if got := byId["lagging"].Disk; !equal(got, []uint64{0, 0, 0, 0, 0, 0, 200, 200, 200, 200}) {
+	if got := byId["lagging"].Disk; !equal(got, []uint64{0, 200, 200, 200, 200, 200, 200, 200, 200, 200}) {
 		t.Errorf("lagging = %v, want its size carried to the right edge", got)
 	}
 	if got := byId["gone"].Disk; !equal(got, []uint64{900, 900, 0, 0, 0, 0, 0, 0, 0, 0}) {
@@ -62,7 +64,7 @@ func TestClusterSizeSeries(t *testing.T) {
 	if got := byId["daily"].Servers; !equal(got, []uint64{3, 3, 3, 3, 3, 3, 3, 3, 3, 3}) {
 		t.Errorf("daily servers = %v, want 3 every day", got)
 	}
-	if got := byId["lagging"].Servers; !equal(got, []uint64{0, 0, 0, 0, 0, 0, 2, 2, 2, 2}) {
+	if got := byId["lagging"].Servers; !equal(got, []uint64{0, 2, 2, 2, 2, 2, 2, 2, 2, 2}) {
 		t.Errorf("lagging servers = %v, want carried to the right edge", got)
 	}
 	if got := byId["gone"].Servers; !equal(got, []uint64{9, 9, 0, 0, 0, 0, 0, 0, 0, 0}) {
@@ -89,10 +91,10 @@ func TestClusterSizeSeries(t *testing.T) {
 	if series.Other == nil || series.Other.Count != 2 {
 		t.Fatalf("other = %+v, want 2 clusters", series.Other)
 	}
-	if !equal(series.Other.Disk, []uint64{900, 900, 0, 0, 0, 0, 200, 200, 200, 200}) {
+	if !equal(series.Other.Disk, []uint64{900, 1100, 200, 200, 200, 200, 200, 200, 200, 200}) {
 		t.Errorf("other = %v, want lagging+gone summed per day", series.Other.Disk)
 	}
-	if !equal(series.Other.Servers, []uint64{9, 9, 0, 0, 0, 0, 2, 2, 2, 2}) {
+	if !equal(series.Other.Servers, []uint64{9, 11, 2, 2, 2, 2, 2, 2, 2, 2}) {
 		t.Errorf("other servers = %v, want lagging+gone summed per day", series.Other.Servers)
 	}
 	if series.ClusterCount != 3 || series.TotalDisk != 500 || series.TotalServers != 5 {
@@ -110,13 +112,13 @@ func TestClusterSizeSeriesUsesLatestDailySample(t *testing.T) {
 		TopologyId:        "aaaaaaaa-0000-0000-0000-000000000001",
 		Version:           "4.40",
 		Os:                "linux/amd64",
-		TotalDiskBytes:    100,
+		TotalDiskBytes:    proto.MinDiskBytes + 100,
 		VolumeServerCount: 4,
 	}
 	if err := s.StoreTelemetry(data); err != nil {
 		t.Fatal(err)
 	}
-	data.TotalDiskBytes = 700
+	data.TotalDiskBytes = proto.MinDiskBytes + 700
 	data.VolumeServerCount = 6
 	if err := s.StoreTelemetry(data); err != nil {
 		t.Fatal(err)
@@ -131,14 +133,14 @@ func TestClusterSizeSeriesUsesLatestDailySample(t *testing.T) {
 	if today := time.Now().UTC().Format("2006-01-02"); len(series.Dates) != 1 || series.Dates[0] != today {
 		t.Errorf("dates = %v, want %s only", series.Dates, today)
 	}
-	if got := series.Clusters[0].Disk; !equal(got, []uint64{700}) {
+	if got := series.Clusters[0].Disk; !equal(got, []uint64{proto.MinDiskBytes + 700}) {
 		t.Errorf("disk = %v, want today's latest sample only", got)
 	}
 	if got := series.Clusters[0].Servers; !equal(got, []uint64{6}) {
 		t.Errorf("servers = %v, want today's latest sample only", got)
 	}
-	if series.TotalDisk != 700 || series.TotalServers != 6 {
-		t.Errorf("totals = %d disk / %d servers, want 700/6", series.TotalDisk, series.TotalServers)
+	if series.TotalDisk != proto.MinDiskBytes+700 || series.TotalServers != 6 {
+		t.Errorf("totals = %d disk / %d servers, want %d/6", series.TotalDisk, series.TotalServers, proto.MinDiskBytes+700)
 	}
 }
 
diff --git a/telemetry/server/storage/versions_test.go b/telemetry/server/storage/versions_test.go
index 8287700193..9fc012cc57 100644
--- a/telemetry/server/storage/versions_test.go
+++ b/telemetry/server/storage/versions_test.go
@@ -10,31 +10,31 @@ func TestVersionSeries(t *testing.T) {
 	s := newPrometheusStorage(prometheus.NewRegistry())
 
 	// Upgraded mid-window: its band leaves the old version for the new one.
-	seedSamples(s, "upgraded", HistorySample{Version: "4.39"}, -4, -3)
+	seedSamples(s, "upgraded", HistorySample{Version: "4.39"}, -6, -5, -4, -3)
 	seedSamples(s, "upgraded", HistorySample{Version: "4.40"}, -2, -1, 0)
 	// Reported every day on the same version.
-	seedSamples(s, "steady", HistorySample{Version: "4.40"}, -4, -3, -2, -1, 0)
+	seedSamples(s, "steady", HistorySample{Version: "4.40"}, -6, -5, -4, -3, -2, -1, 0)
 	// One day of history only: unconfirmed, so it stays out of the stack.
 	seedSamples(s, "oneshot", HistorySample{Version: "4.40"}, -1)
 	// Confirmed, but its samples predate versions being recorded.
-	seedSamples(s, "versionless", HistorySample{}, -9, -8)
+	seedSamples(s, "versionless", HistorySample{}, -13, -12, -11, -10, -9, -8, -7)
 
 	series := s.GetVersionSeries(10, 0)
 
 	// The versionless days are dropped before the axis is built, so the chart
 	// spans the days a version is known for instead of climbing out of blanks.
-	if len(series.Dates) != 5 {
-		t.Fatalf("dates = %v, want the 5 days with versions", series.Dates)
+	if len(series.Dates) != 7 {
+		t.Fatalf("dates = %v, want the 7 days with versions", series.Dates)
 	}
 	if len(series.Versions) != 2 ||
 		series.Versions[0].Version != "4.39" || series.Versions[1].Version != "4.40" {
 		t.Fatalf("versions = %+v, want 4.39 then 4.40", series.Versions)
 	}
-	if got := series.Versions[0].Clusters; !equal(got, []uint64{1, 1, 0, 0, 0}) {
-		t.Errorf("4.39 = %v, want the upgraded cluster's first two days", got)
+	if got := series.Versions[0].Clusters; !equal(got, []uint64{1, 1, 1, 1, 0, 0, 0}) {
+		t.Errorf("4.39 = %v, want the upgraded cluster's first four days", got)
 	}
-	if got := series.Versions[1].Clusters; !equal(got, []uint64{1, 1, 2, 2, 2}) {
-		t.Errorf("4.40 = %v, want steady plus upgraded from day 3", got)
+	if got := series.Versions[1].Clusters; !equal(got, []uint64{1, 1, 1, 1, 2, 2, 2}) {
+		t.Errorf("4.40 = %v, want steady plus upgraded from day 5", got)
 	}
 	if series.TotalClusters != 2 {
 		t.Errorf("total_clusters = %d, want 2", series.TotalClusters)
@@ -48,12 +48,12 @@ func TestVersionSeriesHoldsForwardAndLimits(t *testing.T) {
 	s := newPrometheusStorage(prometheus.NewRegistry())
 
 	// Stopped reporting past the active window: its own days only.
-	seedSamples(s, "gone", HistorySample{Version: "3.97"}, -9, -8)
+	seedSamples(s, "gone", HistorySample{Version: "3.97"}, -14, -13, -12, -11, -10, -9, -8)
 	// Reported every day of the window.
 	seedSamples(s, "daily", HistorySample{Version: "4.40"}, -9, -8, -7, -6, -5, -4, -3, -2, -1, 0)
-	// Reported three days ago and not since: still active, so it holds its
-	// version to the right edge instead of dropping out of the stack.
-	seedSamples(s, "lagging", HistorySample{Version: "4.30"}, -3, -2)
+	// Stopped reporting two days ago: still active, so it holds its version
+	// to the right edge instead of dropping out of the stack.
+	seedSamples(s, "lagging", HistorySample{Version: "4.30"}, -8, -7, -6, -5, -4, -3, -2)
 
 	series := s.GetVersionSeries(10, 0)
 	if len(series.Dates) != 10 {
@@ -66,7 +66,7 @@ func TestVersionSeriesHoldsForwardAndLimits(t *testing.T) {
 	if got := byVersion["3.97"]; !equal(got, []uint64{1, 1, 0, 0, 0, 0, 0, 0, 0, 0}) {
 		t.Errorf("3.97 = %v, want nothing after its last report", got)
 	}
-	if got := byVersion["4.30"]; !equal(got, []uint64{0, 0, 0, 0, 0, 0, 1, 1, 1, 1}) {
+	if got := byVersion["4.30"]; !equal(got, []uint64{0, 1, 1, 1, 1, 1, 1, 1, 1, 1}) {
 		t.Errorf("4.30 = %v, want carried to the right edge", got)
 	}
 	if got := byVersion["4.40"]; !equal(got, []uint64{1, 1, 1, 1, 1, 1, 1, 1, 1, 1}) {
@@ -85,7 +85,7 @@ func TestVersionSeriesHoldsForwardAndLimits(t *testing.T) {
 	if series.Other == nil || series.Other.Count != 2 {
 		t.Fatalf("other = %+v, want 2 versions", series.Other)
 	}
-	if !equal(series.Other.Clusters, []uint64{1, 1, 0, 0, 0, 0, 1, 1, 1, 1}) {
+	if !equal(series.Other.Clusters, []uint64{1, 2, 1, 1, 1, 1, 1, 1, 1, 1}) {
 		t.Errorf("other = %v, want 3.97+4.30 summed per day", series.Other.Clusters)
 	}
 	if series.TotalClusters != 2 {
diff --git a/telemetry/test/integration.go b/telemetry/test/integration.go
index cddb13a757..0ada29e0af 100644
--- a/telemetry/test/integration.go
+++ b/telemetry/test/integration.go
@@ -206,7 +206,7 @@ func testTelemetryClient() error {
 		Version:           "3.45",
 		Os:                "linux/amd64",
 		VolumeServerCount: 3,
-		TotalDiskBytes:    1073741824, // 1GB
+		TotalDiskBytes:    proto.MinDiskBytes + (1 << 30), // just above the reporting floor
 		TotalVolumeCount:  50,
 		FilerCount:        2,
 		BrokerCount:       1,
diff --git a/terraform/modules/aws/security_group.tf b/terraform/modules/aws/security_group.tf
index 93fa32af7d..cc9a5d5c87 100644
--- a/terraform/modules/aws/security_group.tf
+++ b/terraform/modules/aws/security_group.tf
@@ -1,6 +1,6 @@
 # Cluster security group + the SeaweedFS port matrix.
 # Intra-cluster: all TCP allowed within the SG (master 9333/19333, volume
-# 8080/18080, filer 8888/18888, admin 33646, ...). Client-facing: only S3 (8333)
+# 8080/18080, filer 8888/18888, admin 22535, ...). Client-facing: only S3 (8333)
 # and filer (8888). Metrics ports (9327) are never opened to clients.
 
 resource "aws_security_group" "cluster" {
diff --git a/terraform/test/local-secure/run_local_secure.sh b/terraform/test/local-secure/run_local_secure.sh
index 5e5588d83f..ffe606c5ca 100755
--- a/terraform/test/local-secure/run_local_secure.sh
+++ b/terraform/test/local-secure/run_local_secure.sh
@@ -113,7 +113,7 @@ done
 wait_http "http://127.0.0.1:$VPORT/healthz" 60 && ok "volume /healthz up (mTLS)" || bad "volume /healthz"
 
 launch filer-f0
-wait_http "http://127.0.0.1:$FPORT/" 30 && ok "filer / up (mTLS)" || bad "filer /"
+wait_http "http://127.0.0.1:$FPORT/healthz" 30 && ok "filer /healthz up (mTLS)" || bad "filer /healthz"
 # [jwt.filer_signing] is active, so the filer requires a signed JWT for writes.
 # An unsigned write MUST be rejected with 401 -- this proves the JWT signing key
 # rendered into security.toml is enforced (positive security assertion).
diff --git a/test/erasure_coding/admin_dockertest/ec_integration_test.go b/test/erasure_coding/admin_dockertest/ec_integration_test.go
index 8d62f32790..d8266cef1a 100644
--- a/test/erasure_coding/admin_dockertest/ec_integration_test.go
+++ b/test/erasure_coding/admin_dockertest/ec_integration_test.go
@@ -18,7 +18,7 @@ import (
 )
 
 const (
-	AdminUrl  = "http://localhost:23646"
+	AdminUrl  = "http://localhost:12535"
 	MasterUrl = "http://localhost:9333"
 	FilerUrl  = "http://localhost:8888"
 )
@@ -129,7 +129,7 @@ func ensureEnvironment(t *testing.T) {
 			port := 8080 + i - 1
 			dir := filepath.Join("tmp", volName)
 			os.MkdirAll(dir, 0755)
-			startWeed(t, volName, "volume", "-dir="+dir, "-mserver=localhost:9333", fmt.Sprintf("-port=%d", port), "-ip=localhost")
+			startWeed(t, volName, "volume", "-dir="+dir, "-mserver=localhost:9333", fmt.Sprintf("-port=%d", port), "-ip=localhost", "-volume.allowUntrustedRemoteEndpoints")
 		}(i)
 	}
 	volWg.Wait()
@@ -147,13 +147,13 @@ func ensureEnvironment(t *testing.T) {
 		debugPort := 6060 + i
 		dir, _ := filepath.Abs(filepath.Join("tmp", workerName))
 		os.MkdirAll(dir, 0755)
-		startWeed(t, workerName, "worker", "-admin=localhost:23646", "-workingDir="+dir, fmt.Sprintf("-metricsPort=%d", metricsPort), fmt.Sprintf("-debug.port=%d", debugPort))
+		startWeed(t, workerName, "worker", "-admin=localhost:12535", "-workingDir="+dir, fmt.Sprintf("-metricsPort=%d", metricsPort), fmt.Sprintf("-debug.port=%d", debugPort))
 	}
 
 	// 6. Start Admin
 	os.RemoveAll(filepath.Join("tmp", "admin"))
 	os.MkdirAll(filepath.Join("tmp", "admin"), 0755)
-	startWeed(t, "admin", "admin", "-master=localhost:9333", "-port=23646", "-dataDir=./tmp/admin")
+	startWeed(t, "admin", "admin", "-master=localhost:9333", "-port=12535", "-dataDir=./tmp/admin")
 	// Admin is started after master, 14 volume servers, filer and 2 workers,
 	// so under cold CI conditions the wait here has to absorb the tail of
 	// every earlier subprocess coming up. 60s is too tight and has flaked;
diff --git a/test/erasure_coding/chaos_lifecycle_test.go b/test/erasure_coding/chaos_lifecycle_test.go
new file mode 100644
index 0000000000..7d5c9758b8
--- /dev/null
+++ b/test/erasure_coding/chaos_lifecycle_test.go
@@ -0,0 +1,1294 @@
+package erasure_coding
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"io"
+	mrand "math/rand"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/shell"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// TestECChaosLifecycle drives randomized sequences of the EC lifecycle —
+// encode (hdd and ssd targets), balance, shard damage + rebuild, decode,
+// re-encode (a new generation), deletes, scrub, tier moves, crash-restarts,
+// and sidecar fault injections — against a live cluster running the
+// production-shaped layout: multiple data disks per server with a separate
+// -dir.idx directory, so the .ecx/.ecj sidecars are shared across disks.
+//
+// One invariant is checked after every step: every byte a client stored comes
+// back identical, and every deleted needle stays deleted. Shard counting alone
+// cannot tell a healthy volume from one serving a stale generation or a
+// mis-rebuilt shard; reading the payloads back can.
+//
+// The sequence is seeded (EC_CHAOS_SEED) and reproducible; EC_CHAOS_STEPS
+// scales the random portion. The fault scenarios that motivated the test —
+// losing a data-dir .vif (forcing the shared idx-dir fallback), and planting a
+// stale-generation shard file next to a newer encode — are always exercised
+// once, regardless of what the random schedule picks.
+const (
+	chaosMasterAddr   = "127.0.0.1:9338"
+	chaosMasterPort   = "9338"
+	chaosCollection   = "chaos"
+	chaosServerCount  = 3
+	chaosDisksPerNode = 3 // disk0, disk1 default type; disk2 tagged ssd
+)
+
+func chaosVolumePort(i int) string { return fmt.Sprintf("811%d", i) }
+
+func TestECChaosLifecycle(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping EC chaos lifecycle test in short mode")
+	}
+
+	seedStr := os.Getenv("EC_CHAOS_SEED")
+	if seedStr == "" {
+		t.Skip("randomized exploration is opt-in: set EC_CHAOS_SEED to run it; " +
+			"systematic coverage lives in TestECInterruptionMatrix and weed/ec's TestECLifecycleModelExhaustive")
+	}
+	seed, err := strconv.ParseInt(seedStr, 10, 64)
+	require.NoError(t, err, "EC_CHAOS_SEED must be an integer")
+	steps := 8
+	if s := os.Getenv("EC_CHAOS_STEPS"); s != "" {
+		v, err := strconv.Atoi(s)
+		require.NoError(t, err, "EC_CHAOS_STEPS must be an integer")
+		steps = v
+	}
+	t.Logf("chaos seed=%d steps=%d (override with EC_CHAOS_SEED / EC_CHAOS_STEPS)", seed, steps)
+
+	testDir := t.TempDir()
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	cluster, clusterErr := startChaosCluster(ctx, testDir)
+	require.NoError(t, clusterErr)
+	defer cluster.Stop()
+
+	require.NoError(t, waitForServer(chaosMasterAddr, 30*time.Second))
+	for i := 0; i < chaosServerCount; i++ {
+		require.NoError(t, waitForServer("127.0.0.1:"+chaosVolumePort(i), 30*time.Second))
+	}
+	time.Sleep(8 * time.Second)
+
+	commandEnv := shell.NewCommandEnv(&shell.ShellOptions{
+		Masters:        stringPtr(chaosMasterAddr),
+		GrpcDialOption: grpc.WithInsecure(),
+		FilerGroup:     stringPtr("default"),
+	})
+	connectToMasterAndSync(ctx, t, commandEnv)
+
+	r := newChaosRun(t, ctx, cluster, commandEnv, testDir, seed)
+	r.relock()
+	defer r.unlockIfHeld()
+	r.seedAndSpread()
+	r.verify("seeding")
+
+	// Random schedule. Every op re-verifies the full payload set.
+	ops := []struct {
+		name   string
+		weight int
+		run    func() bool
+	}{
+		{"encode", 4, r.opEncode},
+		{"decode", 2, r.opDecode},
+		{"balance", 2, r.opBalance},
+		{"damage+rebuild", 2, r.opDamageAndRebuild},
+		{"delete", 2, r.opDelete},
+		{"upload", 2, r.opUpload},
+		{"scrub", 2, r.opScrub},
+		{"crash-restart", 1, r.opCrashRestart},
+		{"tier-move", 1, r.opTierMove},
+		{"vif-fallback", 1, r.opVifFallback},
+		{"stale-generation", 1, r.opPlantStaleGeneration},
+		{"interrupted-encode", 2, r.opInterruptedEncode},
+		{"interrupted-decode", 1, r.opInterruptedDecode},
+		{"interrupted-balance", 1, r.opInterruptedBalance},
+	}
+	total := 0
+	for _, op := range ops {
+		total += op.weight
+	}
+	ran := map[string]bool{}
+	for step := 1; step <= steps; step++ {
+		n := r.rng.Intn(total)
+		for _, op := range ops {
+			if n -= op.weight; n < 0 {
+				t.Logf("── chaos step %d/%d: %s ──", step, steps, op.name)
+				if op.run() {
+					ran[op.name] = true
+					r.verify(op.name)
+				} else {
+					t.Logf("step %d: %s not applicable, skipped", step, op.name)
+				}
+				break
+			}
+		}
+	}
+
+	// Deterministic tail: the scenarios this test exists for always run once.
+	for _, must := range []struct {
+		name string
+		run  func() bool
+	}{
+		{"encode", r.opEncode},
+		{"damage+rebuild", r.opDamageAndRebuild},
+		{"vif-fallback", r.opVifFallback},
+		{"stale-generation", r.opPlantStaleGeneration},
+		{"interrupted-encode", r.opInterruptedEncode},
+		{"interrupted-decode", r.opInterruptedDecode},
+		{"interrupted-balance", r.opInterruptedBalance},
+		{"decode", r.opDecode},
+	} {
+		if ran[must.name] {
+			continue
+		}
+		t.Logf("── chaos tail: %s ──", must.name)
+		if must.run() {
+			r.verify(must.name)
+		} else {
+			t.Logf("tail: %s not applicable, skipped", must.name)
+		}
+	}
+
+	r.verify("final")
+	t.Logf("chaos done: %d payloads live, %d deleted, %d volumes tracked", len(r.payloads), len(r.deleted), len(r.volumes))
+}
+
+type chaosVolumeState struct {
+	encoded bool
+}
+
+type chaosRun struct {
+	t       *testing.T
+	ctx     context.Context
+	cluster *chaosCluster
+	env     *shell.CommandEnv
+	rng     *mrand.Rand
+	testDir string
+
+	payloads map[string][]byte // live fid -> expected bytes
+	deleted  map[string]bool   // fids that must stay deleted
+	fidVol   map[string]uint32
+	volumes  map[uint32]*chaosVolumeState
+
+	unlock func()
+}
+
+// ── invariants ──────────────────────────────────────────────────────────────
+
+// verify is the single invariant of the whole test: after any operation, every
+// live payload reads back byte-identical from the current cluster state, and
+// every deleted needle stays unreadable. Retries absorb heartbeat and mount
+// propagation delays; content mismatches fail immediately — waiting cannot fix
+// wrong bytes, and the first wrong read is the most useful state to stop in.
+func (r *chaosRun) verify(afterStep string) {
+	r.t.Helper()
+	for fid, want := range r.payloads {
+		fid, want := fid, want
+		// The condition runs on Eventually's own goroutine, where t.Fatalf
+		// would only kill that goroutine; record a corruption and fail on the
+		// test goroutine instead. A wrong read still ends the polling at once —
+		// waiting cannot fix wrong bytes, and the first wrong read is the most
+		// useful state to stop in.
+		var corrupted string
+		require.Eventuallyf(r.t, func() bool {
+			got, err := chaosReadFid(fid, r.fidVol[fid])
+			if err != nil {
+				return false
+			}
+			if !bytes.Equal(got, want) {
+				corrupted = fmt.Sprintf("payload %s corrupted after %s: got %d bytes, want %d bytes", fid, afterStep, len(got), len(want))
+			}
+			return true
+		}, 90*time.Second, time.Second, "payload %s unreadable after %s", fid, afterStep)
+		require.Empty(r.t, corrupted, "%s", corrupted)
+	}
+	for fid := range r.deleted {
+		fid := fid
+		require.Eventuallyf(r.t, func() bool {
+			got, err := chaosReadFid(fid, r.fidVol[fid])
+			return err != nil || len(got) == 0
+		}, 30*time.Second, time.Second, "deleted payload %s came back after %s", fid, afterStep)
+	}
+	r.t.Logf("verified %d live + %d deleted payloads after %s", len(r.payloads), len(r.deleted), afterStep)
+}
+
+// ── operations ──────────────────────────────────────────────────────────────
+
+func (r *chaosRun) opEncode() bool {
+	vid, ok := r.pickVolume(false)
+	if !ok {
+		return false
+	}
+	args := []string{"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-force"}
+	if r.rng.Intn(2) == 0 {
+		args = append(args, "-diskType", "ssd")
+	}
+	r.t.Logf("ec.encode args: %v", args)
+	out, err := r.shellCommand("ec.encode", args...)
+	r.t.Logf("ec.encode v%d output:\n%s", vid, out)
+	if err != nil {
+		vl, _ := r.shellCommand("volume.list")
+		r.t.Logf("volume.list at encode failure:\n%s", vl)
+	}
+	require.NoError(r.t, err, "ec.encode volume %d", vid)
+	r.volumes[vid].encoded = true
+	r.requireSingleGeneration(vid, "ec.encode")
+	return true
+}
+
+func (r *chaosRun) opDecode() bool {
+	vid, ok := r.pickVolume(true)
+	if !ok {
+		return false
+	}
+	// -checkMinFreeSpace=false: this intentionally tiny cluster would otherwise
+	// refuse the decode for lack of headroom, which is not what is under test.
+	out, err := r.shellCommand("ec.decode",
+		"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-checkMinFreeSpace=false")
+	r.t.Logf("ec.decode v%d output:\n%s", vid, out)
+	require.NoError(r.t, err, "ec.decode volume %d", vid)
+	r.volumes[vid].encoded = false
+	return true
+}
+
+func (r *chaosRun) opBalance() bool {
+	out, err := r.shellCommand("ec.balance", "-collection", chaosCollection, "-apply")
+	r.t.Logf("ec.balance output:\n%s", out)
+	require.NoError(r.t, err, "ec.balance")
+	return true
+}
+
+// opDamageAndRebuild removes up to two shard files of an encoded volume
+// straight off the disks, restarts the servers so the master relearns disk
+// truth, and repairs with ec.rebuild — the flow of a real shard-loss incident.
+func (r *chaosRun) opDamageAndRebuild() bool {
+	vid, ok := r.pickVolume(true)
+	if !ok {
+		return false
+	}
+	before := len(collectDistinctShardIDs(r.testDir, vid))
+	if before < erasureShardCount {
+		r.t.Logf("damage+rebuild: volume %d has %d/%d distinct shards on disk, skipping", vid, before, erasureShardCount)
+		return false // a prior fault is still outstanding; skip rather than stack damage
+	}
+	removed := removeTwoShardFiles(r.t, r.testDir, vid)
+	r.t.Logf("removed shard files for shards %v of volume %d", removed, vid)
+
+	// After the restart the master must agree with disk truth before any repair
+	// runs. The exact count is not fixed: a stale shard file planted by an
+	// earlier fault can legitimately re-register from disk and cover one of the
+	// removed ids, so the invariant is agreement, not a specific number.
+	r.restartAllVolumeServers()
+	require.Eventually(r.t, func() bool {
+		registered := masterEcShardIds(r.env, vid)
+		onDisk := collectDistinctShardIDs(r.testDir, vid)
+		if len(registered) != len(onDisk) {
+			return false
+		}
+		for id := range onDisk {
+			if !registered[id] {
+				return false
+			}
+		}
+		return true
+	}, 90*time.Second, 2*time.Second, "master never agreed with disk truth for volume %d (master=%v disk=%v)",
+		vid, sortedKeysOf(masterEcShardIds(r.env, vid)), sortedKeysOf(collectDistinctShardIDs(r.testDir, vid)))
+
+	out, err := r.shellCommand("ec.rebuild", "-collection", chaosCollection, "-apply")
+	r.t.Logf("ec.rebuild output:\n%s", out)
+	require.NoError(r.t, err, "ec.rebuild")
+	require.Eventually(r.t, func() bool {
+		return len(collectDistinctShardIDs(r.testDir, vid)) == erasureShardCount
+	}, 90*time.Second, time.Second, "ec.rebuild did not restore all shards of volume %d", vid)
+	return true
+}
+
+func (r *chaosRun) opDelete() bool {
+	// Keep at least one live payload per volume so no volume ever empties out
+	// completely (an all-deleted volume decodes into nothing, which is its own
+	// test, not this one).
+	liveByVol := map[uint32]int{}
+	for fid := range r.payloads {
+		liveByVol[r.fidVol[fid]]++
+	}
+	var candidates []string
+	for fid := range r.payloads {
+		if liveByVol[r.fidVol[fid]] > 1 {
+			candidates = append(candidates, fid)
+			liveByVol[r.fidVol[fid]]--
+		}
+		if len(candidates) == 2 {
+			break
+		}
+	}
+	if len(candidates) == 0 {
+		return false
+	}
+	for _, fid := range candidates {
+		require.NoError(r.t, chaosDeleteFid(fid, r.fidVol[fid]), "delete %s", fid)
+		delete(r.payloads, fid)
+		r.deleted[fid] = true
+		r.t.Logf("deleted %s (volume %d)", fid, r.fidVol[fid])
+	}
+	return true
+}
+
+func (r *chaosRun) opUpload() bool {
+	for i := 0; i < 3; i++ {
+		r.uploadOne()
+	}
+	return true
+}
+
+func (r *chaosRun) opScrub() bool {
+	out, err := r.shellCommand("ec.scrub", "-mode", "local")
+	r.t.Logf("ec.scrub output:\n%s", out)
+	require.NoError(r.t, err, "ec.scrub")
+	require.NotContains(r.t, out, "scrub failures", "ec.scrub reported broken EC volumes")
+	return true
+}
+
+func (r *chaosRun) opCrashRestart() bool {
+	r.restartAllVolumeServers()
+	return true
+}
+
+func (r *chaosRun) opTierMove() bool {
+	// Best effort: with -fullPercent=0 every quiet regular volume qualifies.
+	// Zero moved volumes is fine — the invariant read-back is the point.
+	out, err := r.shellCommand("volume.tier.move",
+		"-fromDiskType", "hdd", "-toDiskType", "ssd",
+		"-collectionPattern", "^"+chaosCollection+"$",
+		"-fullPercent", "0", "-quietFor", "1s", "-apply")
+	r.t.Logf("volume.tier.move output:\n%s", out)
+	require.NoError(r.t, err, "volume.tier.move")
+	return true
+}
+
+// opVifFallback simulates the split-sidecar layout: the data-dir .vif of one
+// disk's shards moves into the server's shared -dir.idx directory, and the
+// server restarts. Loading must fall back to the idx-dir copy (issue #9212
+// layout) and reads must stay correct.
+func (r *chaosRun) opVifFallback() bool {
+	vid, ok := r.pickVolume(true)
+	if !ok {
+		return false
+	}
+	moved := false
+	for server := 0; server < chaosServerCount && !moved; server++ {
+		for disk := 0; disk < chaosDisksPerNode; disk++ {
+			dataVif := filepath.Join(r.testDir, fmt.Sprintf("server%d_disk%d", server, disk),
+				fmt.Sprintf("%s_%d.vif", chaosCollection, vid))
+			if _, err := os.Stat(dataVif); err != nil {
+				continue
+			}
+			idxVif := filepath.Join(r.testDir, fmt.Sprintf("server%d_idx", server),
+				fmt.Sprintf("%s_%d.vif", chaosCollection, vid))
+			require.NoError(r.t, os.Rename(dataVif, idxVif), "move .vif to idx dir")
+			r.t.Logf("moved %s -> %s", dataVif, idxVif)
+			r.restartOneVolumeServer(server)
+			moved = true
+			break
+		}
+	}
+	return moved
+}
+
+// opPlantStaleGeneration reproduces the orphaned-generation hazard: it stashes
+// an encoded volume's shard files, decodes and re-encodes the volume (a new
+// generation with a new .vif stamp), then plants one stale shard file from the
+// old generation onto a disk of a server that holds new-generation shards, and
+// restarts that server. Whatever the server decides to do with the orphan —
+// delete it, quarantine it, or register it — reads must never serve its bytes.
+func (r *chaosRun) opPlantStaleGeneration() bool {
+	vid, ok := r.pickVolume(true)
+	if !ok {
+		return false
+	}
+	if n := len(collectDistinctShardIDs(r.testDir, vid)); n < erasureShardCount {
+		r.t.Logf("stale-generation: volume %d has %d/%d distinct shards on disk, skipping", vid, n, erasureShardCount)
+		return false
+	}
+
+	// Stash one old-generation shard file.
+	stale := r.stashOneShardFile(vid)
+	if stale == "" {
+		return false
+	}
+
+	out, err := r.shellCommand("ec.decode",
+		"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-checkMinFreeSpace=false")
+	r.t.Logf("ec.decode v%d output:\n%s", vid, out)
+	require.NoError(r.t, err, "ec.decode volume %d (stale-generation scenario)", vid)
+	r.verify("decode before re-encode")
+
+	out, err = r.shellCommand("ec.encode",
+		"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-force")
+	r.t.Logf("ec.encode v%d output:\n%s", vid, out)
+	require.NoError(r.t, err, "re-encode volume %d (stale-generation scenario)", vid)
+	r.volumes[vid].encoded = true
+
+	// Plant the old-generation shard on a server that holds new shards, on a
+	// disk of that server that does not currently hold this volume — the
+	// cross-disk mixing case, where the shared idx-dir sidecars are the only
+	// local generation authority for the planted file.
+	planted := false
+	for server := 0; server < chaosServerCount && !planted; server++ {
+		serverHasNew, diskWithout := false, -1
+		for disk := 0; disk < chaosDisksPerNode; disk++ {
+			pattern := filepath.Join(r.testDir, fmt.Sprintf("server%d_disk%d", server, disk),
+				fmt.Sprintf("%s_%d.ec*", chaosCollection, vid))
+			if m, _ := filepath.Glob(pattern); len(m) > 0 {
+				serverHasNew = true
+			} else if diskWithout == -1 {
+				diskWithout = disk
+			}
+		}
+		if serverHasNew && diskWithout >= 0 {
+			dst := filepath.Join(r.testDir, fmt.Sprintf("server%d_disk%d", server, diskWithout), filepath.Base(stale))
+			require.NoError(r.t, copyFileContents(stale, dst), "plant stale shard")
+			r.t.Logf("planted stale generation shard %s on server %d disk %d", filepath.Base(stale), server, diskWithout)
+			r.restartOneVolumeServer(server)
+			planted = true
+		}
+	}
+	if !planted {
+		r.t.Logf("no server had both new shards and a free disk; stale plant skipped")
+	}
+	return true
+}
+
+// ── interruption ops ────────────────────────────────────────────────────────
+//
+// These kill a real `weed shell` subprocess mid-operation — the operator's
+// shell dying — and then prove the cluster recovers: whatever half-finished
+// state the kill left (readonly sources, partial or unmounted shards, an
+// undeleted original, a half-collected decode), the next run of the same
+// command must converge to a clean state, and reads must stay correct
+// throughout. This is the restart-not-resume recovery model: an interrupted
+// run is never resumed, the retry starts clean via the pre-encode sweep.
+
+// runInterruptedShell feeds "lock" plus the command to a weed shell
+// subprocess and kills the process after killAfter. Stdin stays open so the
+// shell never exits gracefully — the lock releases only through the master
+// noticing the dead connection, which the follow-up relock must survive.
+func (r *chaosRun) runInterruptedShell(command string, killAfter time.Duration) string {
+	weedBinary := findWeedBinary()
+	require.NotEmpty(r.t, weedBinary, "weed binary not found")
+	cmd := exec.CommandContext(r.ctx, weedBinary, "shell", "-master="+chaosMasterAddr)
+	var out bytes.Buffer
+	cmd.Stdout, cmd.Stderr = &out, &out
+	stdin, err := cmd.StdinPipe()
+	require.NoError(r.t, err)
+	require.NoError(r.t, cmd.Start())
+	fmt.Fprintf(stdin, "lock\n%s\n", command)
+	time.Sleep(killAfter)
+	cmd.Process.Kill()
+	cmd.Wait()
+	return out.String()
+}
+
+func (r *chaosRun) volumeHasRegularReplica(vid uint32) bool {
+	found := false
+	for _, dn := range chaosDataNodes(r.env) {
+		for _, di := range dn.GetDiskInfos() {
+			for _, vi := range di.GetVolumeInfos() {
+				if vi.GetId() == vid {
+					found = true
+				}
+			}
+		}
+	}
+	return found
+}
+
+func (r *chaosRun) opInterruptedEncode() bool {
+	vid, ok := r.pickVolume(false)
+	if !ok {
+		return false
+	}
+	killAfter := time.Duration(1+r.rng.Intn(8)) * time.Second
+	r.unlockIfHeld()
+	out := r.runInterruptedShell(
+		fmt.Sprintf("ec.encode -volumeId %d -collection %s -force", vid, chaosCollection), killAfter)
+	r.t.Logf("killed ec.encode v%d after %v; output so far:\n%s", vid, killAfter, out)
+	r.relock()
+
+	r.recoverInterruptedEncode(vid)
+	return true
+}
+
+// recoverInterruptedEncode is the prescribed recovery after an encode was
+// killed mid-flight: if the kill came after the originals were deleted, the
+// encode had effectively completed and the volume is EC now; any earlier kill
+// leaves the regular volume in place (possibly readonly, possibly beside
+// partial shards), and a re-run must sweep the leftovers and finish.
+func (r *chaosRun) recoverInterruptedEncode(vid uint32) {
+	r.t.Helper()
+	if !r.volumeHasRegularReplica(vid) {
+		r.t.Logf("interrupted encode of volume %d had already completed", vid)
+		r.volumes[vid].encoded = true
+		r.requireSingleGeneration(vid, "interrupted ec.encode (completed)")
+		return
+	}
+	out2, err := r.shellCommand("ec.encode",
+		"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-force")
+	r.t.Logf("recovery ec.encode v%d output:\n%s", vid, out2)
+	if err != nil && !r.volumeHasRegularReplica(vid) {
+		// The killed run's original-deletion outran the topology snapshot the
+		// re-run planned from; the encode had in fact completed.
+		r.t.Logf("interrupted encode of volume %d had already completed (original deletion outran the topology)", vid)
+		err = nil
+	}
+	if err != nil {
+		vl, _ := r.shellCommand("volume.list")
+		r.t.Logf("volume.list at recovery-encode failure:\n%s", vl)
+	}
+	require.NoError(r.t, err, "recovery ec.encode volume %d after interruption", vid)
+	r.volumes[vid].encoded = true
+	r.requireSingleGeneration(vid, "recovery ec.encode")
+}
+
+func (r *chaosRun) opInterruptedDecode() bool {
+	vid, ok := r.pickVolume(true)
+	if !ok {
+		return false
+	}
+	killAfter := time.Duration(1+r.rng.Intn(6)) * time.Second
+	r.unlockIfHeld()
+	out := r.runInterruptedShell(
+		fmt.Sprintf("ec.decode -volumeId %d -collection %s -checkMinFreeSpace=false", vid, chaosCollection), killAfter)
+	r.t.Logf("killed ec.decode v%d after %v; output so far:\n%s", vid, killAfter, out)
+	r.relock()
+
+	r.recoverInterruptedDecode(vid)
+	return true
+}
+
+// recoverInterruptedDecode is the prescribed recovery after a decode was
+// killed mid-flight: while any shards remain the decode is unfinished (the
+// kill may have left a hybrid: regenerated volume plus undeleted shards) and
+// a re-run must complete it. No shards left means the decode had finished —
+// and the master's view can lag the killed run's final deletions, so a re-run
+// that finds no shards is also completion, not a failure.
+func (r *chaosRun) recoverInterruptedDecode(vid uint32) {
+	r.t.Helper()
+	if len(masterEcShardIds(r.env, vid)) > 0 {
+		out2, err := r.shellCommand("ec.decode",
+			"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-checkMinFreeSpace=false")
+		r.t.Logf("recovery ec.decode v%d output:\n%s", vid, out2)
+		if err != nil && strings.Contains(err.Error(), "no EC shards found") {
+			r.t.Logf("interrupted decode of volume %d had already completed (shard deletions outran the topology)", vid)
+		} else {
+			require.NoError(r.t, err, "recovery ec.decode volume %d after interruption", vid)
+		}
+	} else {
+		r.t.Logf("interrupted decode of volume %d had already completed", vid)
+	}
+	r.volumes[vid].encoded = false
+}
+
+func (r *chaosRun) opInterruptedBalance() bool {
+	anyEncoded := false
+	for _, st := range r.volumes {
+		if st.encoded {
+			anyEncoded = true
+		}
+	}
+	if !anyEncoded {
+		return false
+	}
+	killAfter := time.Duration(1+r.rng.Intn(5)) * time.Second
+	r.unlockIfHeld()
+	out := r.runInterruptedShell(
+		fmt.Sprintf("ec.balance -collection %s -apply", chaosCollection), killAfter)
+	r.t.Logf("killed ec.balance after %v; output so far:\n%s", killAfter, out)
+	r.relock()
+
+	r.recoverInterruptedBalance()
+	return true
+}
+
+// recoverInterruptedBalance is the prescribed recovery after a balance was
+// killed mid-flight: an interrupted move leaves a shard copied but not yet
+// deleted at the source. Re-running the balance must converge — its dedup
+// phase removes the extra copies — until the replication check is clean. A
+// lock lost to the killed shell's reap is re-taken by shellCommand, so the
+// loop only has to judge convergence.
+func (r *chaosRun) recoverInterruptedBalance() {
+	r.t.Helper()
+	require.Eventually(r.t, func() bool {
+		if _, err := r.shellCommand("ec.balance", "-collection", chaosCollection, "-apply"); err != nil {
+			r.t.Logf("recovery ec.balance: %v", err)
+			return false
+		}
+		report, err := r.shellCommand("ec.check.replication", "-details")
+		if err != nil {
+			r.t.Logf("ec.check.replication: %v", err)
+			return false
+		}
+		if strings.Contains(report, "under-replicated") {
+			r.t.Logf("replication not clean yet:\n%s", report)
+			return false
+		}
+		if crossNode, sameNode := classifyOverReplication(report); crossNode {
+			r.t.Logf("replication not clean yet:\n%s", report)
+			return false
+		} else if sameNode {
+			// KNOWN GAP: a shard mounted on two disks of ONE node (e.g. an
+			// orphan adopted after an interrupted copy) is invisible to
+			// ec.balance's dedup, and ec.shard.unmount's shard@address form
+			// cannot disambiguate two copies behind one address. Nothing can
+			// clean this state today; reads stay correct, so tolerate it here
+			// and keep it visible in the log.
+			r.t.Logf("tolerating same-node duplicate shards (no cleanup path exists):\n%s", report)
+		}
+		return true
+	}, 120*time.Second, 3*time.Second, "cluster never converged to clean replication after interrupted balance")
+}
+
+// classifyOverReplication parses an ec.check.replication -details report and
+// says whether any shard is duplicated across distinct nodes (crossNode) or
+// only within one node (sameNode, the two-disks-one-node adoption case).
+func classifyOverReplication(report string) (crossNode, sameNode bool) {
+	for _, line := range strings.Split(report, "\n") {
+		open := strings.Index(line, "=> [")
+		if open < 0 {
+			continue
+		}
+		addrs := strings.Fields(strings.Trim(line[open+len("=> ["):], "[] \r"))
+		if len(addrs) < 2 {
+			continue
+		}
+		distinct := map[string]bool{}
+		for _, a := range addrs {
+			distinct[a] = true
+		}
+		if len(distinct) > 1 {
+			crossNode = true
+		} else {
+			sameNode = true
+		}
+	}
+	return crossNode, sameNode
+}
+
+// ── helpers ─────────────────────────────────────────────────────────────────
+
+// newChaosRun wires a run driver over a started cluster. The rng only shapes
+// randomized schedules and payload sizes; deterministic drivers (the
+// interruption matrix) never draw from it beyond seeding uploads.
+func newChaosRun(t *testing.T, ctx context.Context, cluster *chaosCluster, env *shell.CommandEnv, testDir string, seed int64) *chaosRun {
+	return &chaosRun{
+		t:        t,
+		ctx:      ctx,
+		cluster:  cluster,
+		env:      env,
+		rng:      mrand.New(mrand.NewSource(seed)),
+		testDir:  testDir,
+		payloads: map[string][]byte{},
+		deleted:  map[string]bool{},
+		fidVol:   map[string]uint32{},
+		volumes:  map[uint32]*chaosVolumeState{},
+	}
+}
+
+// seedAndSpread uploads the payload set and then spreads volumes onto every
+// disk of every node: the master only enumerates disks that already hold
+// data, and shards only spread across enumerated disks (see
+// TestMultiDiskECBalanceNoShardLoss). Without this a balance can find no
+// eligible targets and the encode's clump guard aborts.
+func (r *chaosRun) seedAndSpread() {
+	r.t.Helper()
+	for i := 0; i < 24; i++ {
+		r.uploadOne()
+	}
+	require.GreaterOrEqual(r.t, len(r.volumes), 2, "seeding should produce at least two volumes")
+	time.Sleep(3 * time.Second)
+
+	// Cap the grows per server so heartbeat lag cannot run away: the spread
+	// check reads the master topology, which lags the volume.grow writes, so
+	// an uncapped loop re-fires every tick and fills every disk to capacity
+	// before the master registers the prior grow. A full disk has no free EC
+	// shard slots and the source disk drops below the encode's FreeVolumeCount
+	// >= 2 health check, failing ec.encode with "no healthy replicas" or "no
+	// free ec shard slots".
+	//
+	// Use -count 1 so each grow lands exactly one volume on the volume
+	// server's least-loaded disk (deterministic spreading), and cap the
+	// total grows per server well below the per-disk max so the source disk
+	// always retains FreeVolumeCount >= 2 for ec.encode's shard generation.
+	growsPerServer := make(map[string]int)
+	const maxGrowsPerServer = 4
+	require.Eventually(r.t, func() bool {
+		spread := nodeVolumeDiskCounts(r.t, r.env)
+		if len(spread) == chaosServerCount && allAtLeast(spread, 2) {
+			return true
+		}
+		for i := 0; i < chaosServerCount; i++ {
+			server := "127.0.0.1:" + chaosVolumePort(i)
+			if spread[server] < 2 && growsPerServer[server] < maxGrowsPerServer {
+				// Pin the data center and rack as well as the data node. The
+				// master's grow picks the rack by weighted random when -rack is
+				// unset, and only one of the three racks holds the requested
+				// data node, so an unpinned grow lands on the wrong rack two
+				// times out of three and the VolumeGrow RPC swallows the
+				// "No matching data node" error (non-cache grows ignore the
+				// internal failure). Those silent no-ops exhaust the per-server
+				// cap before the volumes ever spread, so seedAndSpread times
+				// out. Pinning the rack makes every grow reach the target node.
+				out, gerr := captureCommandOutput(r.t, shell.Commands[findCommandIndex("volume.grow")],
+					[]string{"-collection", chaosCollection, "-dataCenter", "dc1",
+						"-rack", fmt.Sprintf("rack%d", i), "-dataNode", server, "-count", "1"}, r.env)
+				// Only count successful grows toward the cap: a transient
+				// collectTopologyInfo or VolumeGrow RPC error would otherwise
+				// exhaust the retry budget without creating any volume, and
+				// the loop would then only poll until the Eventually timeout.
+				if gerr == nil {
+					growsPerServer[server]++
+				}
+				r.t.Logf("volume.grow on %s: err=%v output:\n%s", server, gerr, out)
+			}
+		}
+		return false
+	}, 90*time.Second, 2*time.Second, "volumes never spread across >=2 disks on all %d nodes", chaosServerCount)
+}
+
+// ensureRegularVolume returns a tracked volume in the regular (not encoded)
+// state, decoding one if every tracked volume is EC.
+func (r *chaosRun) ensureRegularVolume() uint32 {
+	r.t.Helper()
+	if vid, ok := r.pickVolume(false); ok {
+		return vid
+	}
+	vid, ok := r.pickVolume(true)
+	require.True(r.t, ok, "no volumes tracked at all")
+	out, err := r.shellCommand("ec.decode",
+		"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-checkMinFreeSpace=false")
+	r.t.Logf("ensureRegular ec.decode v%d output:\n%s", vid, out)
+	require.NoError(r.t, err, "decode volume %d to restore a regular volume", vid)
+	r.volumes[vid].encoded = false
+	return vid
+}
+
+// ensureEncodedVolume returns a tracked volume in the encoded state, encoding
+// one (hdd target, deterministic) if none is.
+func (r *chaosRun) ensureEncodedVolume() uint32 {
+	r.t.Helper()
+	if vid, ok := r.pickVolume(true); ok {
+		return vid
+	}
+	vid, ok := r.pickVolume(false)
+	require.True(r.t, ok, "no volumes tracked at all")
+	out, err := r.shellCommand("ec.encode",
+		"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-force")
+	r.t.Logf("ensureEncoded ec.encode v%d output:\n%s", vid, out)
+	require.NoError(r.t, err, "encode volume %d", vid)
+	r.volumes[vid].encoded = true
+	r.requireSingleGeneration(vid, "ensureEncodedVolume")
+	return vid
+}
+
+func (r *chaosRun) pickVolume(encoded bool) (uint32, bool) {
+	var candidates []uint32
+	for vid, st := range r.volumes {
+		if st.encoded == encoded {
+			candidates = append(candidates, vid)
+		}
+	}
+	if len(candidates) == 0 {
+		return 0, false
+	}
+	// Deterministic pick under one seed: order by volume id.
+	min := candidates[0]
+	for _, v := range candidates {
+		if v < min {
+			min = v
+		}
+	}
+	return min, true
+}
+
+func (r *chaosRun) uploadOne() {
+	data := make([]byte, 2048+r.rng.Intn(14*1024))
+	_, err := rand.Read(data)
+	require.NoError(r.t, err)
+	var vid needle.VolumeId
+	var fid string
+	for retry := 0; retry < 5; retry++ {
+		vid, fid, err = chaosUploadPayload(data)
+		if err == nil {
+			break
+		}
+		time.Sleep(2 * time.Second)
+	}
+	require.NoError(r.t, err, "upload payload")
+	r.payloads[fid] = data
+	r.fidVol[fid] = uint32(vid)
+	if _, ok := r.volumes[uint32(vid)]; !ok {
+		r.volumes[uint32(vid)] = &chaosVolumeState{}
+	}
+}
+
+// lostShellLock reports whether a command failed because the shell lock this
+// harness holds is no longer recognised. A killed shell's lock is released
+// only when the master notices the dead connection, and that cleanup lands
+// asynchronously -- after the harness has already re-acquired the lock -- so
+// it can clear the lock this run holds and the next command then refuses with
+// `need to run "lock" first to continue`.
+func lostShellLock(err error) bool {
+	return err != nil && strings.Contains(err.Error(), `need to run "lock" first`)
+}
+
+// shellCommand runs a shell command, answering a lost lock the way an operator
+// would: run lock again and retry. Every recovery path needs this, not just the
+// balance one -- the reap can land during any command that follows a kill.
+func (r *chaosRun) shellCommand(name string, args ...string) (string, error) {
+	const attempts = 3
+	var out string
+	var err error
+	for attempt := 0; attempt < attempts; attempt++ {
+		out, err = captureCommandOutput(r.t, shell.Commands[findCommandIndex(name)], args, r.env)
+		if !lostShellLock(err) {
+			return out, err
+		}
+		r.t.Logf("%s lost the shell lock (%v); re-locking and retrying", name, err)
+		r.relock()
+	}
+	return out, err
+}
+
+func (r *chaosRun) relock() {
+	locked, unlock := tryLockWithTimeout(r.t, r.env, 45*time.Second)
+	require.True(r.t, locked, "could not acquire shell lock")
+	r.unlock = unlock
+}
+
+func (r *chaosRun) unlockIfHeld() {
+	if r.unlock != nil {
+		r.unlock()
+		r.unlock = nil
+	}
+}
+
+func (r *chaosRun) restartAllVolumeServers() {
+	require.NoError(r.t, r.cluster.RestartVolumeServers(r.ctx))
+	for i := 0; i < chaosServerCount; i++ {
+		require.NoError(r.t, waitForServer("127.0.0.1:"+chaosVolumePort(i), 30*time.Second))
+	}
+	time.Sleep(3 * time.Second)
+	r.relock() // the restart's master disconnect drops the shell lock
+}
+
+func (r *chaosRun) restartOneVolumeServer(i int) {
+	require.NoError(r.t, r.cluster.RestartVolumeServer(r.ctx, i))
+	require.NoError(r.t, waitForServer("127.0.0.1:"+chaosVolumePort(i), 30*time.Second))
+	time.Sleep(3 * time.Second)
+	r.relock()
+}
+
+// requireSingleGeneration asserts that, at a quiescent point, every EC shard
+// entry the master reports for the volume carries the same encode generation
+// stamp — the state the encode pipeline is supposed to leave behind.
+func (r *chaosRun) requireSingleGeneration(vid uint32, step string) {
+	r.t.Helper()
+	require.Eventually(r.t, func() bool {
+		generations := masterEcGenerations(r.env, vid)
+		return len(generations) == 1
+	}, 60*time.Second, 2*time.Second,
+		"volume %d reports mixed encode generations after %s: %v", vid, step, masterEcGenerations(r.env, vid))
+}
+
+// stashOneShardFile copies one current shard file of the volume into a stash
+// dir and returns the stash path ("" when none found).
+func (r *chaosRun) stashOneShardFile(vid uint32) string {
+	stashDir := filepath.Join(r.testDir, "stale_stash")
+	_ = os.MkdirAll(stashDir, 0o755)
+	for server := 0; server < chaosServerCount; server++ {
+		for disk := 0; disk < chaosDisksPerNode; disk++ {
+			pattern := filepath.Join(r.testDir, fmt.Sprintf("server%d_disk%d", server, disk),
+				fmt.Sprintf("%s_%d.ec*", chaosCollection, vid))
+			matches, _ := filepath.Glob(pattern)
+			for _, m := range matches {
+				if strings.HasSuffix(m, ".ecx") || strings.HasSuffix(m, ".ecj") || strings.HasSuffix(m, ".ecsum") {
+					continue
+				}
+				dst := filepath.Join(stashDir, filepath.Base(m))
+				if err := copyFileContents(m, dst); err != nil {
+					continue
+				}
+				return dst
+			}
+		}
+	}
+	return ""
+}
+
+func copyFileContents(src, dst string) error {
+	in, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer in.Close()
+	out, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+	if _, err := io.Copy(out, in); err != nil {
+		return err
+	}
+	return out.Sync()
+}
+
+// chaosDataNodes lists the data nodes from a fresh master topology snapshot.
+func chaosDataNodes(commandEnv *shell.CommandEnv) []*master_pb.DataNodeInfo {
+	var resp *master_pb.VolumeListResponse
+	err := commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
+		var e error
+		resp, e = client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		return e
+	})
+	if err != nil || resp.GetTopologyInfo() == nil {
+		return nil
+	}
+	var nodes []*master_pb.DataNodeInfo
+	for _, dc := range resp.GetTopologyInfo().GetDataCenterInfos() {
+		for _, rack := range dc.GetRackInfos() {
+			nodes = append(nodes, rack.GetDataNodeInfos()...)
+		}
+	}
+	return nodes
+}
+
+// masterEcGenerations returns the distinct encode generation stamps the master
+// currently reports for a volume's EC shards.
+func masterEcGenerations(commandEnv *shell.CommandEnv, volumeId uint32) map[int64]bool {
+	generations := map[int64]bool{}
+	var resp *master_pb.VolumeListResponse
+	err := commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
+		var e error
+		resp, e = client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		return e
+	})
+	if err != nil || resp.GetTopologyInfo() == nil {
+		return generations
+	}
+	for _, dc := range resp.GetTopologyInfo().GetDataCenterInfos() {
+		for _, rack := range dc.GetRackInfos() {
+			for _, dn := range rack.GetDataNodeInfos() {
+				for _, di := range dn.GetDiskInfos() {
+					for _, eci := range di.GetEcShardInfos() {
+						if eci.GetId() == volumeId {
+							generations[eci.GetEncodeTsNs()] = true
+						}
+					}
+				}
+			}
+		}
+	}
+	return generations
+}
+
+// ── payload plumbing against the chaos master ───────────────────────────────
+
+func chaosUploadPayload(data []byte) (needle.VolumeId, string, error) {
+	assignResult, err := operation.Assign(context.Background(), func(ctx context.Context) pb.ServerAddress {
+		return pb.ServerAddress(chaosMasterAddr)
+	}, grpc.WithInsecure(), &operation.VolumeAssignRequest{
+		Count:       1,
+		Collection:  chaosCollection,
+		Replication: "000",
+	})
+	if err != nil {
+		return 0, "", err
+	}
+	uploader, err := operation.NewUploader()
+	if err != nil {
+		return 0, "", err
+	}
+	uploadResult, err, _ := uploader.Upload(context.Background(), bytes.NewReader(data), &operation.UploadOption{
+		UploadUrl: "http://" + assignResult.Url + "/" + assignResult.Fid,
+		Filename:  "chaos.bin",
+		MimeType:  "application/octet-stream",
+	})
+	if err != nil {
+		return 0, "", err
+	}
+	if uploadResult.Error != "" {
+		return 0, "", fmt.Errorf("upload error: %s", uploadResult.Error)
+	}
+	fidObj, err := needle.ParseFileIdFromString(assignResult.Fid)
+	if err != nil {
+		return 0, "", err
+	}
+	return fidObj.VolumeId, assignResult.Fid, nil
+}
+
+func chaosLookupLocations(volumeId uint32) ([]string, error) {
+	resp, err := http.Get(fmt.Sprintf("http://%s/dir/lookup?volumeId=%d", chaosMasterAddr, volumeId))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	var lookup struct {
+		Locations []struct {
+			Url string `json:"url"`
+		} `json:"locations"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&lookup); err != nil {
+		return nil, err
+	}
+	var urls []string
+	for _, l := range lookup.Locations {
+		urls = append(urls, l.Url)
+	}
+	if len(urls) == 0 {
+		return nil, fmt.Errorf("no locations for volume %d", volumeId)
+	}
+	return urls, nil
+}
+
+func chaosReadFid(fid string, volumeId uint32) ([]byte, error) {
+	urls, err := chaosLookupLocations(volumeId)
+	if err != nil {
+		return nil, err
+	}
+	var lastErr error
+	for _, url := range urls {
+		get, err := http.Get(fmt.Sprintf("http://%s/%s", url, fid))
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		body, err := io.ReadAll(get.Body)
+		get.Body.Close()
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if get.StatusCode != http.StatusOK {
+			lastErr = fmt.Errorf("GET %s from %s: %d", fid, url, get.StatusCode)
+			continue
+		}
+		return body, nil
+	}
+	return nil, lastErr
+}
+
+func chaosDeleteFid(fid string, volumeId uint32) error {
+	urls, err := chaosLookupLocations(volumeId)
+	if err != nil {
+		return err
+	}
+	var lastErr error
+	for _, url := range urls {
+		req, err := http.NewRequest(http.MethodDelete, fmt.Sprintf("http://%s/%s", url, fid), nil)
+		if err != nil {
+			return err
+		}
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		io.Copy(io.Discard, resp.Body)
+		resp.Body.Close()
+		if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+			return nil
+		}
+		lastErr = fmt.Errorf("DELETE %s from %s: %d", fid, url, resp.StatusCode)
+	}
+	return lastErr
+}
+
+// ── cluster ─────────────────────────────────────────────────────────────────
+
+// chaosCluster is a master plus three volume servers, each with three data
+// disks (the third tagged ssd) and a separate -dir.idx directory, so the
+// .ecx/.ecj sidecars are shared across the server's disks — the layout whose
+// edge cases this test exists to exercise. Individual servers can be killed
+// and restarted over their existing directories.
+type chaosCluster struct {
+	masterCmd     *exec.Cmd
+	volumeServers []*exec.Cmd
+	testDir       string
+	logFiles      []*os.File
+}
+
+func (c *chaosCluster) Stop() {
+	for _, cmd := range c.volumeServers {
+		if cmd != nil && cmd.Process != nil {
+			cmd.Process.Kill()
+			cmd.Wait()
+		}
+	}
+	if c.masterCmd != nil && c.masterCmd.Process != nil {
+		c.masterCmd.Process.Kill()
+		c.masterCmd.Wait()
+	}
+	for _, f := range c.logFiles {
+		if f != nil {
+			f.Close()
+		}
+	}
+}
+
+func (c *chaosCluster) RestartVolumeServers(ctx context.Context) error {
+	for i := range c.volumeServers {
+		if err := c.RestartVolumeServer(ctx, i); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *chaosCluster) RestartVolumeServer(ctx context.Context, i int) error {
+	if cmd := c.volumeServers[i]; cmd != nil && cmd.Process != nil {
+		cmd.Process.Kill()
+		cmd.Wait()
+	}
+	time.Sleep(time.Second)
+	cmd, err := c.startVolumeServer(ctx, i, "volume-restart.log")
+	if err != nil {
+		return err
+	}
+	c.volumeServers[i] = cmd
+	time.Sleep(2 * time.Second)
+	return nil
+}
+
+func (c *chaosCluster) startVolumeServer(ctx context.Context, i int, logName string) (*exec.Cmd, error) {
+	weedBinary := findWeedBinary()
+	if weedBinary == "" {
+		return nil, fmt.Errorf("weed binary not found")
+	}
+	var diskDirs, maxVolumes, diskTypes []string
+	for d := 0; d < chaosDisksPerNode; d++ {
+		dir := filepath.Join(c.testDir, fmt.Sprintf("server%d_disk%d", i, d))
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			return nil, err
+		}
+		diskDirs = append(diskDirs, dir)
+		// ec.encode generates 14 shards on the source disk (2 volume-slot
+		// equivalents) and refuses a source whose disk has FreeVolumeCount < 2,
+		// and the cluster-wide capacity check needs at least one free EC shard
+		// slot. seedAndSpread's spread loop grows 4 volumes per tick and can
+		// over-grow before the master's topology catches up, so leave enough
+		// headroom that a near-full disk never starves the encode.
+		maxVolumes = append(maxVolumes, "8")
+		if d == chaosDisksPerNode-1 {
+			diskTypes = append(diskTypes, "ssd")
+		} else {
+			diskTypes = append(diskTypes, "hdd")
+		}
+	}
+	idxDir := filepath.Join(c.testDir, fmt.Sprintf("server%d_idx", i))
+	if err := os.MkdirAll(idxDir, 0o755); err != nil {
+		return nil, err
+	}
+	cmd := exec.CommandContext(ctx, weedBinary, "volume",
+		"-port", chaosVolumePort(i),
+		"-dir", strings.Join(diskDirs, ","),
+		"-dir.idx", idxDir,
+		"-disk", strings.Join(diskTypes, ","),
+		"-max", strings.Join(maxVolumes, ","),
+		"-minFreeSpace", "0",
+		"-master", chaosMasterAddr,
+		"-volume.allowUntrustedRemoteEndpoints",
+		"-ip", "127.0.0.1",
+		"-dataCenter", "dc1",
+		"-rack", fmt.Sprintf("rack%d", i),
+	)
+	logDir := filepath.Join(c.testDir, fmt.Sprintf("server%d_logs", i))
+	if err := os.MkdirAll(logDir, 0o755); err != nil {
+		return nil, err
+	}
+	logFile, err := os.OpenFile(filepath.Join(logDir, logName), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
+	if err != nil {
+		return nil, err
+	}
+	c.logFiles = append(c.logFiles, logFile)
+	cmd.Stdout = logFile
+	cmd.Stderr = logFile
+	if err := cmd.Start(); err != nil {
+		return nil, err
+	}
+	return cmd, nil
+}
+
+func startChaosCluster(ctx context.Context, dataDir string) (*chaosCluster, error) {
+	weedBinary := findWeedBinary()
+	if weedBinary == "" {
+		return nil, fmt.Errorf("weed binary not found")
+	}
+	// A leaked cluster from an earlier run would silently absorb this run's
+	// traffic (same fixed ports) and make every on-disk assertion meaningless.
+	// Refuse to start over occupied ports.
+	ports := []string{chaosMasterAddr}
+	for i := 0; i < chaosServerCount; i++ {
+		ports = append(ports, "127.0.0.1:"+chaosVolumePort(i))
+	}
+	for _, addr := range ports {
+		if conn, err := net.DialTimeout("tcp", addr, 300*time.Millisecond); err == nil {
+			conn.Close()
+			return nil, fmt.Errorf("port %s is already in use (stale cluster from an earlier run?)", addr)
+		}
+	}
+	cluster := &chaosCluster{testDir: dataDir}
+
+	masterDir := filepath.Join(dataDir, "master")
+	if err := os.MkdirAll(masterDir, 0o755); err != nil {
+		return nil, err
+	}
+	masterCmd := exec.CommandContext(ctx, weedBinary, "master",
+		"-port", chaosMasterPort,
+		"-mdir", masterDir,
+		"-volumeSizeLimitMB", "10",
+		"-ip", "127.0.0.1",
+		"-peers", "none",
+	)
+	masterLog, err := os.Create(filepath.Join(masterDir, "master.log"))
+	if err != nil {
+		return nil, err
+	}
+	cluster.logFiles = append(cluster.logFiles, masterLog)
+	masterCmd.Stdout = masterLog
+	masterCmd.Stderr = masterLog
+	if err := masterCmd.Start(); err != nil {
+		return nil, err
+	}
+	cluster.masterCmd = masterCmd
+	time.Sleep(2 * time.Second)
+
+	for i := 0; i < chaosServerCount; i++ {
+		cmd, err := cluster.startVolumeServer(ctx, i, "volume.log")
+		if err != nil {
+			cluster.Stop()
+			return nil, fmt.Errorf("start volume server %d: %w", i, err)
+		}
+		cluster.volumeServers = append(cluster.volumeServers, cmd)
+	}
+	time.Sleep(8 * time.Second)
+	return cluster, nil
+}
diff --git a/test/erasure_coding/ec_integration_test.go b/test/erasure_coding/ec_integration_test.go
index 75aaf5025b..33be5a46b8 100644
--- a/test/erasure_coding/ec_integration_test.go
+++ b/test/erasure_coding/ec_integration_test.go
@@ -3,9 +3,12 @@ package erasure_coding
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
 	"math"
+	"net"
+	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -13,6 +16,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/test/testutil"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
@@ -47,17 +51,15 @@ func TestECEncodingVolumeLocationTimingBug(t *testing.T) {
 	defer cluster.Stop()
 
 	// Wait for servers to be ready
-	require.NoError(t, waitForServer("127.0.0.1:9333", 30*time.Second))
-	require.NoError(t, waitForServer("127.0.0.1:8080", 30*time.Second))
-	require.NoError(t, waitForServer("127.0.0.1:8081", 30*time.Second))
-	require.NoError(t, waitForServer("127.0.0.1:8082", 30*time.Second))
-	require.NoError(t, waitForServer("127.0.0.1:8083", 30*time.Second))
-	require.NoError(t, waitForServer("127.0.0.1:8084", 30*time.Second))
-	require.NoError(t, waitForServer("127.0.0.1:8085", 30*time.Second))
+	require.NoError(t, waitForServer(cluster.masterAddr, 30*time.Second))
+	for _, addr := range cluster.volumeAddrs {
+		require.NoError(t, waitForServer(addr, 30*time.Second))
+	}
+	require.NoError(t, waitForMasterLeader(cluster.masterAddr, 30*time.Second))
 
 	// Create command environment
 	options := &shell.ShellOptions{
-		Masters:        stringPtr("127.0.0.1:9333"),
+		Masters:        stringPtr(cluster.masterAddr),
 		GrpcDialOption: grpc.WithInsecure(),
 		FilerGroup:     stringPtr("default"),
 	}
@@ -71,7 +73,7 @@ func TestECEncodingVolumeLocationTimingBug(t *testing.T) {
 
 	// Upload some test data to create volumes
 	testData := []byte("This is test data for EC encoding integration test")
-	volumeId, err := uploadTestData(testData, "127.0.0.1:9333")
+	volumeId, err := uploadTestData(testData, cluster.masterAddr)
 	require.NoError(t, err)
 	t.Logf("Created volume %d with test data", volumeId)
 
@@ -257,12 +259,13 @@ func TestECEncodingMasterTimingRaceCondition(t *testing.T) {
 	defer cluster.Stop()
 
 	// Wait for servers to be ready
-	require.NoError(t, waitForServer("127.0.0.1:9333", 30*time.Second))
-	require.NoError(t, waitForServer("127.0.0.1:8080", 30*time.Second))
+	require.NoError(t, waitForServer(cluster.masterAddr, 30*time.Second))
+	require.NoError(t, waitForServer(cluster.volumeAddrs[0], 30*time.Second))
+	require.NoError(t, waitForMasterLeader(cluster.masterAddr, 30*time.Second))
 
 	// Create command environment
 	options := &shell.ShellOptions{
-		Masters:        stringPtr("127.0.0.1:9333"),
+		Masters:        stringPtr(cluster.masterAddr),
 		GrpcDialOption: grpc.WithInsecure(),
 		FilerGroup:     stringPtr("default"),
 	}
@@ -276,7 +279,7 @@ func TestECEncodingMasterTimingRaceCondition(t *testing.T) {
 
 	// Upload test data
 	testData := []byte("Race condition test data")
-	volumeId, err := uploadTestData(testData, "127.0.0.1:9333")
+	volumeId, err := uploadTestData(testData, cluster.masterAddr)
 	require.NoError(t, err)
 	t.Logf("Created volume %d for race condition test", volumeId)
 
@@ -366,6 +369,8 @@ func TestECEncodingMasterTimingRaceCondition(t *testing.T) {
 type TestCluster struct {
 	masterCmd     *exec.Cmd
 	volumeServers []*exec.Cmd
+	masterAddr    string
+	volumeAddrs   []string
 }
 
 func (c *TestCluster) Stop() {
@@ -402,9 +407,23 @@ func startSeaweedFSCluster(ctx context.Context, dataDir string) (*TestCluster, e
 	securityToml := filepath.Join(dataDir, "security.toml")
 	os.WriteFile(securityToml, []byte("# Empty security config for testing\n"), 0644)
 
+	// Allocate ports instead of using the defaults: on a shared or reused
+	// runner a stale weed process can still hold 9333/808x, which kills the
+	// freshly started master at bind time and leaves the test talking to a
+	// raft follower that answers every assign with "not current leader".
+	// Mini-safe ports guarantee each HTTP port's derived gRPC port
+	// (port + 10000) is free as well.
+	ports, err := testutil.AllocateMiniPorts(7)
+	if err != nil {
+		return nil, fmt.Errorf("failed to allocate ports: %v", err)
+	}
+	masterPort := ports[0]
+	masterAddr := fmt.Sprintf("127.0.0.1:%d", masterPort)
+	cluster.masterAddr = masterAddr
+
 	// Start master server
 	masterCmd := exec.CommandContext(ctx, weedBinary, "master",
-		"-port", "9333",
+		"-port", fmt.Sprintf("%d", masterPort),
 		"-mdir", masterDir,
 		"-volumeSizeLimitMB", "10", // Small volumes for testing
 		"-ip", "127.0.0.1",
@@ -432,13 +451,15 @@ func startSeaweedFSCluster(ctx context.Context, dataDir string) (*TestCluster, e
 		volumeDir := filepath.Join(dataDir, fmt.Sprintf("volume%d", i))
 		os.MkdirAll(volumeDir, 0755)
 
-		port := fmt.Sprintf("808%d", i)
+		port := fmt.Sprintf("%d", ports[1+i])
+		cluster.volumeAddrs = append(cluster.volumeAddrs, fmt.Sprintf("127.0.0.1:%d", ports[1+i]))
 		rack := fmt.Sprintf("rack%d", i)
 		volumeCmd := exec.CommandContext(ctx, weedBinary, "volume",
 			"-port", port,
 			"-dir", volumeDir,
 			"-max", "10",
-			"-master", "127.0.0.1:9333",
+			"-master", masterAddr,
+			"-volume.allowUntrustedRemoteEndpoints",
 			"-ip", "127.0.0.1",
 			"-dataCenter", "dc1",
 			"-rack", rack,
@@ -497,7 +518,8 @@ func findWeedBinary() string {
 func waitForServer(address string, timeout time.Duration) error {
 	start := time.Now()
 	for time.Since(start) < timeout {
-		if conn, err := grpc.NewClient(address, grpc.WithInsecure()); err == nil {
+		conn, err := net.DialTimeout("tcp", address, time.Second)
+		if err == nil {
 			conn.Close()
 			return nil
 		}
@@ -506,6 +528,29 @@ func waitForServer(address string, timeout time.Duration) error {
 	return fmt.Errorf("timeout waiting for server %s", address)
 }
 
+// waitForMasterLeader polls the master's /cluster/status endpoint until it
+// reports itself as the raft leader. A goraft master can take up to the
+// configured election timeout (10s by default) before it is ready to serve
+// raft-gated requests like volume assign, so a bare port check is not enough.
+func waitForMasterLeader(masterAddr string, timeout time.Duration) error {
+	start := time.Now()
+	for time.Since(start) < timeout {
+		resp, err := http.Get(fmt.Sprintf("http://%s/cluster/status", masterAddr))
+		if err == nil {
+			var status struct {
+				IsLeader bool `json:"IsLeader"`
+			}
+			err = json.NewDecoder(resp.Body).Decode(&status)
+			resp.Body.Close()
+			if err == nil && status.IsLeader {
+				return nil
+			}
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	return fmt.Errorf("timeout waiting for master %s to become raft leader", masterAddr)
+}
+
 func uploadTestData(data []byte, masterAddress string) (needle.VolumeId, error) {
 	// Upload data to get a file ID
 	assignResult, err := operation.Assign(context.Background(), func(ctx context.Context) pb.ServerAddress {
@@ -1082,6 +1127,7 @@ func startMultiDiskCluster(ctx context.Context, dataDir string) (*MultiDiskClust
 			"-dir", strings.Join(diskDirs, ","),
 			"-max", strings.Join(maxVolumes, ","),
 			"-master", "127.0.0.1:9334",
+			"-volume.allowUntrustedRemoteEndpoints",
 			"-ip", "127.0.0.1",
 			"-dataCenter", "dc1",
 			"-rack", rack,
@@ -1478,6 +1524,7 @@ func startClusterWithDiskType(ctx context.Context, dataDir string, diskType stri
 			"-dir", diskDir,
 			"-max", "10",
 			"-mserver", "127.0.0.1:9335",
+			"-volume.allowUntrustedRemoteEndpoints",
 			"-ip", "127.0.0.1",
 			"-dataCenter", "dc1",
 			"-rack", rack,
@@ -1708,6 +1755,7 @@ func startMixedDiskTypeCluster(ctx context.Context, dataDir string) (*MultiDiskC
 			"-dir", diskDir,
 			"-max", "10",
 			"-mserver", "127.0.0.1:9336",
+			"-volume.allowUntrustedRemoteEndpoints",
 			"-ip", "127.0.0.1",
 			"-dataCenter", "dc1",
 			"-rack", rack,
@@ -2030,6 +2078,7 @@ func startLimitedSsdCluster(ctx context.Context, dataDir string) (*MultiDiskClus
 			"-dir", diskDir,
 			"-max", "10",
 			"-mserver", "127.0.0.1:9337",
+			"-volume.allowUntrustedRemoteEndpoints",
 			"-ip", "127.0.0.1",
 			"-dataCenter", "dc1",
 			"-rack", config.rack,
@@ -2112,6 +2161,7 @@ func startMultiRackCluster(ctx context.Context, dataDir string) (*MultiDiskClust
 			"-dir", diskDir,
 			"-max", "10",
 			"-mserver", "127.0.0.1:9338",
+			"-volume.allowUntrustedRemoteEndpoints",
 			"-ip", "127.0.0.1",
 			"-dataCenter", "dc1",
 			"-rack", rack,
@@ -2203,14 +2253,15 @@ func TestECEncodeReplicatedVolumeSync(t *testing.T) {
 	defer cluster.Stop()
 
 	// Wait for servers to be ready
-	require.NoError(t, waitForServer("127.0.0.1:9333", 30*time.Second))
-	for i := 0; i < 6; i++ {
-		require.NoError(t, waitForServer(fmt.Sprintf("127.0.0.1:%d", 8080+i), 30*time.Second))
+	require.NoError(t, waitForServer(cluster.masterAddr, 30*time.Second))
+	for _, addr := range cluster.volumeAddrs {
+		require.NoError(t, waitForServer(addr, 30*time.Second))
 	}
+	require.NoError(t, waitForMasterLeader(cluster.masterAddr, 30*time.Second))
 
 	// Create command environment
 	options := &shell.ShellOptions{
-		Masters:        stringPtr("127.0.0.1:9333"),
+		Masters:        stringPtr(cluster.masterAddr),
 		GrpcDialOption: grpc.WithInsecure(),
 		FilerGroup:     stringPtr("default"),
 	}
@@ -2234,7 +2285,7 @@ func TestECEncodeReplicatedVolumeSync(t *testing.T) {
 		var volumeId needle.VolumeId
 		var uploadErr error
 		for retry := 0; retry < 5; retry++ {
-			volumeId, uploadErr = uploadTestDataWithReplication(t, "127.0.0.1:9333", testCollection, testReplication)
+			volumeId, uploadErr = uploadTestDataWithReplication(t, cluster.masterAddr, testCollection, testReplication)
 			if uploadErr == nil {
 				break
 			}
@@ -2284,7 +2335,7 @@ func TestECEncodeReplicatedVolumeSync(t *testing.T) {
 		var volumeId needle.VolumeId
 		var uploadErr error
 		for retry := 0; retry < 5; retry++ {
-			volumeId, uploadErr = uploadTestDataWithReplication(t, "127.0.0.1:9333", testCollection, testReplication)
+			volumeId, uploadErr = uploadTestDataWithReplication(t, cluster.masterAddr, testCollection, testReplication)
 			if uploadErr == nil {
 				break
 			}
diff --git a/test/erasure_coding/multidisk_shardloss_test.go b/test/erasure_coding/multidisk_shardloss_test.go
index c58c6ec3d3..dc86b5bad1 100644
--- a/test/erasure_coding/multidisk_shardloss_test.go
+++ b/test/erasure_coding/multidisk_shardloss_test.go
@@ -200,7 +200,7 @@ func disksWithShards(testDir string, volumeId uint32) int {
 func nodeVolumeDiskCounts(t *testing.T, commandEnv *shell.CommandEnv) map[string]int {
 	t.Helper()
 	var resp *master_pb.VolumeListResponse
-	err := commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err := commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		var e error
 		resp, e = client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
 		return e
diff --git a/test/erasure_coding/multidisk_shell_lifecycle_test.go b/test/erasure_coding/multidisk_shell_lifecycle_test.go
new file mode 100644
index 0000000000..58c189910b
--- /dev/null
+++ b/test/erasure_coding/multidisk_shell_lifecycle_test.go
@@ -0,0 +1,411 @@
+package erasure_coding
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/shell"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// TestMultiDiskECShellLifecycle drives the real shell commands — ec.encode,
+// ec.balance, ec.rebuild — against a live multi-disk cluster, through the
+// sequence a production repository goes through, with one invariant checked
+// after every step: the bytes a client stored come back identical. Shard
+// counting alone cannot tell a healthy volume from one that was rebuilt out
+// of the wrong inputs; reading the payload back can.
+//
+// The damage step reproduces a support case: shard files removed from disk
+// while the cluster still lists them, so the subsequent ec.rebuild sees copy
+// failures ("CopyFile not found ec volume id ...") for locations the master
+// believes exist, and must recover from the shards that are really there.
+func TestMultiDiskECShellLifecycle(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping multi-disk EC shell lifecycle test in short mode")
+	}
+
+	testDir := t.TempDir()
+	ctx, cancel := context.WithTimeout(context.Background(), 360*time.Second)
+	defer cancel()
+
+	cluster, err := startMultiDiskCluster(ctx, testDir)
+	require.NoError(t, err)
+	defer cluster.Stop()
+
+	require.NoError(t, waitForServer("127.0.0.1:9334", 30*time.Second))
+	for i := 0; i < 3; i++ {
+		require.NoError(t, waitForServer(fmt.Sprintf("127.0.0.1:809%d", i), 30*time.Second))
+	}
+	t.Log("waiting for multi-disk volume servers to register...")
+	time.Sleep(10 * time.Second)
+
+	commandEnv := shell.NewCommandEnv(&shell.ShellOptions{
+		Masters:        stringPtr("127.0.0.1:9334"),
+		GrpcDialOption: grpc.WithInsecure(),
+		FilerGroup:     stringPtr("default"),
+	})
+	connectToMasterAndSync(ctx, t, commandEnv)
+
+	// A payload with no structure, so a rebuild that assembled the wrong bytes
+	// cannot accidentally reproduce it.
+	payload := make([]byte, 8192)
+	_, err = rand.Read(payload)
+	require.NoError(t, err)
+
+	var volumeId needle.VolumeId
+	var fid string
+	for retry := 0; retry < 5; retry++ {
+		volumeId, fid, err = uploadPayload(payload)
+		if err == nil {
+			break
+		}
+		time.Sleep(3 * time.Second)
+	}
+	require.NoError(t, err, "failed to upload payload")
+	for i := 0; i < 40; i++ {
+		if _, _, e := uploadPayload([]byte(strings.Repeat("filler ", 128))); e != nil {
+			break
+		}
+	}
+	t.Logf("payload of %d bytes in volume %d as %s", len(payload), volumeId, fid)
+	time.Sleep(3 * time.Second)
+
+	requirePayload := func(step string) {
+		t.Helper()
+		require.Eventually(t, func() bool {
+			got, err := readFid(fid, uint32(volumeId))
+			return err == nil && bytes.Equal(got, payload)
+		}, 30*time.Second, time.Second, "payload not readable byte-identical after %s", step)
+		t.Logf("payload verified after %s", step)
+	}
+	requirePayload("upload")
+
+	// Spread volumes across each node's disks before encoding; the master only
+	// enumerates disks that already hold data, and shards only spread across
+	// enumerated disks (see TestMultiDiskECBalanceNoShardLoss for the details).
+	require.Eventually(t, func() bool {
+		spread := nodeVolumeDiskCounts(t, commandEnv)
+		if len(spread) == 3 && allAtLeast(spread, 2) {
+			return true
+		}
+		for i := 0; i < 3; i++ {
+			server := fmt.Sprintf("127.0.0.1:809%d", i)
+			if spread[server] < 2 {
+				captureCommandOutput(t, shell.Commands[findCommandIndex("volume.grow")],
+					[]string{"-collection", "test", "-dataNode", server, "-count", "4"}, commandEnv)
+			}
+		}
+		return false
+	}, 60*time.Second, 2*time.Second, "volumes never spread across >=2 disks on all 3 nodes")
+
+	locked, unlock := tryLockWithTimeout(t, commandEnv, 15*time.Second)
+	require.True(t, locked, "could not acquire shell lock")
+	defer unlock()
+
+	// ── ec.encode ──
+	out, err := captureCommandOutput(t, shell.Commands[findCommandIndex("ec.encode")],
+		[]string{"-volumeId", fmt.Sprintf("%d", volumeId), "-collection", "test", "-force"}, commandEnv)
+	t.Logf("ec.encode output:\n%s", out)
+	require.NoError(t, err, "ec.encode failed")
+	require.Eventually(t, func() bool {
+		return len(collectDistinctShardIDs(testDir, uint32(volumeId))) == erasureShardCount
+	}, 30*time.Second, time.Second, "expected all %d shards after encode", erasureShardCount)
+	requirePayload("ec.encode")
+
+	// ── ec.balance ──
+	out, err = captureCommandOutput(t, shell.Commands[findCommandIndex("ec.balance")],
+		[]string{"-collection", "test", "-force"}, commandEnv)
+	t.Logf("ec.balance output:\n%s", out)
+	require.NoError(t, err, "ec.balance failed")
+	time.Sleep(3 * time.Second)
+	require.Len(t, collectDistinctShardIDs(testDir, uint32(volumeId)), erasureShardCount,
+		"ec.balance lost shards")
+	requirePayload("ec.balance")
+
+	// ── damage: two shard files vanish from disk ──
+	// Removed straight off disk, then the servers are restarted so the master
+	// relearns the shard set from disk rather than from stale heartbeat state.
+	// This is the recoverable form of the support case: the volume drops to 12
+	// of 14 shards, which is still above the 10 needed to read and rebuild.
+	removed := removeTwoShardFiles(t, testDir, uint32(volumeId))
+	t.Logf("removed shard files for shards %v", removed)
+	require.Len(t, collectDistinctShardIDs(testDir, uint32(volumeId)), erasureShardCount-2)
+
+	require.NoError(t, cluster.RestartVolumeServers(ctx))
+	for i := 0; i < 3; i++ {
+		require.NoError(t, waitForServer(fmt.Sprintf("127.0.0.1:809%d", i), 30*time.Second))
+	}
+	requirePayload("shard loss + restart") // 12 of 14 remain; reads must survive
+
+	// The master must now see exactly the 12 shards on disk before any repair
+	// runs. ec.rebuild is driven by the master's view, so a repair planned
+	// while that view still lists the two dead shards would target the wrong
+	// set. Restart-then-relearn is what makes disk truth and the master agree.
+	require.Eventually(t, func() bool {
+		return len(masterEcShardIds(commandEnv, uint32(volumeId))) == erasureShardCount-2
+	}, 60*time.Second, 2*time.Second,
+		"master never relearned the reduced shard set (got %v)",
+		sortedKeysOf(masterEcShardIds(commandEnv, uint32(volumeId))))
+
+	// The shell lock is dropped by the restart's master disconnect; retake it.
+	relocked, reunlock := tryLockWithTimeout(t, commandEnv, 15*time.Second)
+	require.True(t, relocked, "could not reacquire shell lock after restart")
+	defer reunlock()
+
+	// ── ec.rebuild, the command from the support case ──
+	out, err = captureCommandOutput(t, shell.Commands[findCommandIndex("ec.rebuild")],
+		[]string{"-collection", "test", "-apply"}, commandEnv)
+	t.Logf("ec.rebuild output:\n%s", out)
+	require.NoError(t, err, "ec.rebuild failed")
+	require.Eventually(t, func() bool {
+		return len(collectDistinctShardIDs(testDir, uint32(volumeId))) == erasureShardCount
+	}, 60*time.Second, time.Second, "ec.rebuild did not restore all %d shards on disk", erasureShardCount)
+	requirePayload("ec.rebuild")
+
+	// The rebuilt shards are real: master's view and disk truth agree on all 14.
+	require.Eventually(t, func() bool {
+		registered := masterEcShardIds(commandEnv, uint32(volumeId))
+		onDisk := collectDistinctShardIDs(testDir, uint32(volumeId))
+		if len(registered) != len(onDisk) || len(onDisk) != erasureShardCount {
+			return false
+		}
+		for id := range onDisk {
+			if !registered[id] {
+				return false
+			}
+		}
+		return true
+	}, 60*time.Second, 2*time.Second,
+		"master's EC shard view diverged from disk truth after rebuild: master=%v disk=%v",
+		sortedKeysOf(masterEcShardIds(commandEnv, uint32(volumeId))), sortedKeysOf(collectDistinctShardIDs(testDir, uint32(volumeId))))
+}
+
+// RestartVolumeServers kills every volume server process and starts fresh ones
+// over the same directories, so registration is rebuilt purely from disk.
+func (c *MultiDiskCluster) RestartVolumeServers(ctx context.Context) error {
+	for _, cmd := range c.volumeServers {
+		if cmd != nil && cmd.Process != nil {
+			cmd.Process.Kill()
+			cmd.Wait()
+		}
+	}
+	c.volumeServers = nil
+	time.Sleep(2 * time.Second)
+	return c.startVolumeServers(ctx)
+}
+
+// startVolumeServers launches the standard 3-server x 4-disk layout over the
+// cluster's existing directories, mirroring startMultiDiskCluster's loop so a
+// restart brings servers back exactly as they first started.
+func (c *MultiDiskCluster) startVolumeServers(ctx context.Context) error {
+	weedBinary := findWeedBinary()
+	if weedBinary == "" {
+		return fmt.Errorf("weed binary not found")
+	}
+	const numServers = 3
+	const disksPerServer = 4
+	for i := 0; i < numServers; i++ {
+		var diskDirs []string
+		var maxVolumes []string
+		for d := 0; d < disksPerServer; d++ {
+			diskDirs = append(diskDirs, filepath.Join(c.testDir, fmt.Sprintf("server%d_disk%d", i, d)))
+			maxVolumes = append(maxVolumes, "5")
+		}
+		volumeCmd := exec.CommandContext(ctx, weedBinary, "volume",
+			"-port", fmt.Sprintf("809%d", i),
+			"-dir", strings.Join(diskDirs, ","),
+			"-max", strings.Join(maxVolumes, ","),
+			"-master", "127.0.0.1:9334",
+			"-volume.allowUntrustedRemoteEndpoints",
+			"-ip", "127.0.0.1",
+			"-dataCenter", "dc1",
+			"-rack", fmt.Sprintf("rack%d", i),
+		)
+		logFile, err := os.OpenFile(filepath.Join(c.testDir, fmt.Sprintf("server%d_logs", i), "volume-restart.log"),
+			os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644)
+		if err != nil {
+			return fmt.Errorf("open restart log for server %d: %w", i, err)
+		}
+		c.logFiles = append(c.logFiles, logFile)
+		volumeCmd.Stdout = logFile
+		volumeCmd.Stderr = logFile
+		if err := volumeCmd.Start(); err != nil {
+			return fmt.Errorf("restart volume server %d: %w", i, err)
+		}
+		c.volumeServers = append(c.volumeServers, volumeCmd)
+	}
+	time.Sleep(8 * time.Second)
+	return nil
+}
+
+// uploadPayload stores data in collection "test" and returns the volume id and
+// fid so the same needle can be read back after every subsequent operation.
+func uploadPayload(data []byte) (needle.VolumeId, string, error) {
+	assignResult, err := operation.Assign(context.Background(), func(ctx context.Context) pb.ServerAddress {
+		return pb.ServerAddress("127.0.0.1:9334")
+	}, grpc.WithInsecure(), &operation.VolumeAssignRequest{
+		Count:       1,
+		Collection:  "test",
+		Replication: "000",
+	})
+	if err != nil {
+		return 0, "", err
+	}
+	uploader, err := operation.NewUploader()
+	if err != nil {
+		return 0, "", err
+	}
+	uploadResult, err, _ := uploader.Upload(context.Background(), bytes.NewReader(data), &operation.UploadOption{
+		UploadUrl: "http://" + assignResult.Url + "/" + assignResult.Fid,
+		Filename:  "payload.bin",
+		MimeType:  "application/octet-stream",
+	})
+	if err != nil {
+		return 0, "", err
+	}
+	if uploadResult.Error != "" {
+		return 0, "", fmt.Errorf("upload error: %s", uploadResult.Error)
+	}
+	fidObj, err := needle.ParseFileIdFromString(assignResult.Fid)
+	if err != nil {
+		return 0, "", err
+	}
+	return fidObj.VolumeId, assignResult.Fid, nil
+}
+
+// readFid locates the volume via the master and fetches the needle bytes from
+// a currently-registered location — the same route a client read takes, for a
+// plain volume before encoding and for the EC read path after.
+func readFid(fid string, volumeId uint32) ([]byte, error) {
+	resp, err := http.Get(fmt.Sprintf("http://127.0.0.1:9334/dir/lookup?volumeId=%d", volumeId))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	var lookup struct {
+		Locations []struct {
+			Url string `json:"url"`
+		} `json:"locations"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&lookup); err != nil {
+		return nil, err
+	}
+	if len(lookup.Locations) == 0 {
+		return nil, fmt.Errorf("no locations for volume %d", volumeId)
+	}
+	var lastErr error
+	for _, loc := range lookup.Locations {
+		get, err := http.Get(fmt.Sprintf("http://%s/%s", loc.Url, fid))
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		body, err := io.ReadAll(get.Body)
+		get.Body.Close()
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		if get.StatusCode != http.StatusOK {
+			lastErr = fmt.Errorf("GET %s from %s: %d", fid, loc.Url, get.StatusCode)
+			continue
+		}
+		return body, nil
+	}
+	return nil, lastErr
+}
+
+// removeTwoShardFiles deletes the files of two distinct shards straight off
+// the disks, without telling any server — the divergence between disk truth
+// and the master's view at the heart of the support case.
+func removeTwoShardFiles(t *testing.T, testDir string, volumeId uint32) []int {
+	t.Helper()
+	var removed []int
+	for server := 0; server < 3 && len(removed) < 2; server++ {
+		for disk := 0; disk < 4 && len(removed) < 2; disk++ {
+			diskDir := filepath.Join(testDir, fmt.Sprintf("server%d_disk%d", server, disk))
+			files, err := listECShardFiles(diskDir, volumeId)
+			if err != nil {
+				continue
+			}
+			for _, f := range files {
+				i := strings.LastIndex(f, ".ec")
+				if i < 0 {
+					continue
+				}
+				var id int
+				if _, err := fmt.Sscanf(f[i+3:], "%d", &id); err != nil {
+					continue
+				}
+				if err := os.Remove(filepath.Join(diskDir, f)); err != nil {
+					t.Fatalf("remove shard file %s: %v", f, err)
+				}
+				removed = append(removed, id)
+				break // at most one shard per disk, keep the loss spread out
+			}
+		}
+	}
+	require.Len(t, removed, 2, "could not find two shard files to remove")
+	return removed
+}
+
+// masterEcShardIds reports which shard ids the master currently believes exist
+// for the volume, across all nodes — the view every repair decision runs on.
+func masterEcShardIds(commandEnv *shell.CommandEnv, volumeId uint32) map[int]bool {
+	ids := map[int]bool{}
+	var resp *master_pb.VolumeListResponse
+	err := commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
+		var e error
+		resp, e = client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		return e
+	})
+	if err != nil || resp.GetTopologyInfo() == nil {
+		return ids
+	}
+	for _, dc := range resp.GetTopologyInfo().GetDataCenterInfos() {
+		for _, r := range dc.GetRackInfos() {
+			for _, dn := range r.GetDataNodeInfos() {
+				for _, di := range dn.GetDiskInfos() {
+					for _, eci := range di.GetEcShardInfos() {
+						if eci.GetId() != volumeId {
+							continue
+						}
+						for _, sid := range erasure_coding_ShardIds(eci.GetEcIndexBits()) {
+							ids[sid] = true
+						}
+					}
+				}
+			}
+		}
+	}
+	return ids
+}
+
+// erasure_coding_ShardIds expands an EC index bitmap into shard ids without
+// importing the storage package into this test's namespace twice.
+func erasure_coding_ShardIds(bits uint32) []int {
+	var out []int
+	for i := 0; i < 32; i++ {
+		if bits&(1<<uint(i)) != 0 {
+			out = append(out, i)
+		}
+	}
+	return out
+}
diff --git a/test/erasure_coding/systematic_interruption_test.go b/test/erasure_coding/systematic_interruption_test.go
new file mode 100644
index 0000000000..cd6b67847a
--- /dev/null
+++ b/test/erasure_coding/systematic_interruption_test.go
@@ -0,0 +1,232 @@
+package erasure_coding
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/shell"
+)
+
+// TestECInterruptionMatrix is the systematic counterpart of the randomized
+// chaos harness: instead of killing operations at random times, it enumerates
+// every phase of every interruptible EC operation and kills a real weed shell
+// exactly when that phase announces itself on the command's output. Each
+// (operation, phase) pair is one deterministic scenario: prepare the
+// precondition, kill at the phase marker, run the prescribed recovery, and
+// verify that every stored byte still reads back identical.
+//
+// The phase markers are the progress lines the pipelines print; each marker
+// below names the code that prints it. A marker is the START of its phase, so
+// killing on it lands the interruption inside that phase — deterministically
+// per phase, byte-exact timing within the phase left to the scheduler. Every
+// scenario REQUIRES its marker to appear: a marker that never prints means a
+// pipeline refactor renamed or dropped the progress line, and silently
+// degenerating into a no-interruption run would let CI pass without
+// exercising the boundary the scenario names. Update the marker with the
+// pipeline.
+//
+// Complementing this, weed/ec's TestECLifecycleModelExhaustive explores every
+// schedule of the same pipelines — crashes between every step, rollback
+// paths, restarts — exhaustively on a model whose steps mirror the code.
+func TestECInterruptionMatrix(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping EC interruption matrix in short mode")
+	}
+
+	testDir := t.TempDir()
+	ctx, cancel := context.WithTimeout(context.Background(), 25*time.Minute)
+	defer cancel()
+
+	cluster, err := startChaosCluster(ctx, testDir)
+	require.NoError(t, err)
+	defer cluster.Stop()
+
+	require.NoError(t, waitForServer(chaosMasterAddr, 30*time.Second))
+	for i := 0; i < chaosServerCount; i++ {
+		require.NoError(t, waitForServer("127.0.0.1:"+chaosVolumePort(i), 30*time.Second))
+	}
+	time.Sleep(8 * time.Second)
+
+	commandEnv := shell.NewCommandEnv(&shell.ShellOptions{
+		Masters:        stringPtr(chaosMasterAddr),
+		GrpcDialOption: grpc.WithInsecure(),
+		FilerGroup:     stringPtr("default"),
+	})
+	connectToMasterAndSync(ctx, t, commandEnv)
+
+	r := newChaosRun(t, ctx, cluster, commandEnv, testDir, 1)
+	r.relock()
+	defer r.unlockIfHeld()
+	r.seedAndSpread()
+	r.verify("seeding")
+
+	// One scenario per (operation, phase marker). The preparation puts a
+	// dedicated volume into the operation's precondition state, so scenarios
+	// stay independent even though they share the cluster.
+	type scenario struct {
+		op      string
+		marker  string // printed by ↓
+		printed string // the code that prints it, for the reader
+	}
+	encodeScenarios := []scenario{
+		{"ec.encode", "markVolumeReadonly ", "weed/ec markVolumeReplicaWritable"},
+		{"ec.encode", "generateEcShards ", "weed/ec generateEcShards"},
+		{"ec.encode", "mount ", "weed/ec MountEcShards"},
+		{"ec.encode", "Deleting original volumes", "weed/ec ProcessEcEncodeBatch, the commit boundary"},
+	}
+	decodeScenarios := []scenario{
+		{"ec.decode", " shard locations:", "weed/ec DoEcDecode, before collect"},
+		{"ec.decode", "generateNormalVolume", "weed/ec generateNormalVolume"},
+		{"ec.decode", "unmount ec volume", "weed/ec unmountAndDeleteEcShards, teardown begin"},
+		{"ec.decode", "delete ec volume", "weed/ec unmountAndDeleteEcShards, shard deletion"},
+	}
+
+	for _, sc := range encodeScenarios {
+		sc := sc
+		t.Run(fmt.Sprintf("encode@%s", trimMarker(sc.marker)), func(t *testing.T) {
+			vid := r.ensureRegularVolume()
+			r.unlockIfHeld()
+			out, hit := runShellKillAtMarker(t, r.ctx,
+				fmt.Sprintf("ec.encode -volumeId %d -collection %s -force", vid, chaosCollection), sc.marker)
+			r.t.Logf("killed %s at %q (marker hit: %v); output:\n%s", sc.op, sc.marker, hit, out)
+			r.relock()
+			require.True(t, hit, "marker %q never appeared (printed by %s); update the marker with the pipeline", sc.marker, sc.printed)
+			r.recoverInterruptedEncode(vid)
+			r.verify(fmt.Sprintf("encode killed at %q", sc.marker))
+		})
+	}
+	for _, sc := range decodeScenarios {
+		sc := sc
+		t.Run(fmt.Sprintf("decode@%s", trimMarker(sc.marker)), func(t *testing.T) {
+			vid := r.ensureEncodedVolume()
+			r.unlockIfHeld()
+			out, hit := runShellKillAtMarker(t, r.ctx,
+				fmt.Sprintf("ec.decode -volumeId %d -collection %s -checkMinFreeSpace=false", vid, chaosCollection), sc.marker)
+			r.t.Logf("killed %s at %q (marker hit: %v); output:\n%s", sc.op, sc.marker, hit, out)
+			r.relock()
+			require.True(t, hit, "marker %q never appeared (printed by %s); update the marker with the pipeline", sc.marker, sc.printed)
+			r.recoverInterruptedDecode(vid)
+			r.verify(fmt.Sprintf("decode killed at %q", sc.marker))
+		})
+	}
+
+	// Balance: encode without rebalancing first, so the standalone balance is
+	// guaranteed to plan moves and the marker is guaranteed to print.
+	t.Run("balance@moves", func(t *testing.T) {
+		vid := r.ensureRegularVolume()
+		out, err := r.shellCommand("ec.encode",
+			"-volumeId", fmt.Sprintf("%d", vid), "-collection", chaosCollection, "-force", "-rebalance=false")
+		r.t.Logf("clumped encode v%d output:\n%s", vid, out)
+		require.NoError(t, err, "encode without rebalance")
+		r.volumes[vid].encoded = true
+
+		r.unlockIfHeld()
+		killOut, hit := runShellKillAtMarker(t, r.ctx,
+			fmt.Sprintf("ec.balance -collection %s -apply", chaosCollection), "moves ec shard")
+		r.t.Logf("killed ec.balance at move (marker hit: %v); output:\n%s", hit, killOut)
+		r.relock()
+		require.True(t, hit, "the balance never printed a move; the -rebalance=false setup should have guaranteed one")
+		r.recoverInterruptedBalance()
+		r.verify("balance killed at move")
+	})
+
+	r.verify("final")
+	t.Logf("interruption matrix done: %d payloads live, %d deleted, %d volumes tracked",
+		len(r.payloads), len(r.deleted), len(r.volumes))
+}
+
+func trimMarker(m string) string {
+	out := make([]rune, 0, len(m))
+	for _, c := range m {
+		if c == ' ' || c == ':' {
+			continue
+		}
+		out = append(out, c)
+	}
+	return string(out)
+}
+
+// runShellKillAtMarker feeds "lock" plus the command to a weed shell
+// subprocess, scans its combined output live, and kills the process the
+// moment a line containing marker appears. Returns the captured output and
+// whether the marker was seen before the shell exited on its own.
+func runShellKillAtMarker(t *testing.T, ctx context.Context, command, marker string) (string, bool) {
+	t.Helper()
+	weedBinary := findWeedBinary()
+	require.NotEmpty(t, weedBinary, "weed binary not found")
+	cmd := exec.CommandContext(ctx, weedBinary, "shell", "-master="+chaosMasterAddr)
+
+	pr, pw, err := os.Pipe()
+	require.NoError(t, err)
+	cmd.Stdout, cmd.Stderr = pw, pw
+	stdin, err := cmd.StdinPipe()
+	require.NoError(t, err)
+	require.NoError(t, cmd.Start())
+	pw.Close() // the child keeps its dup; ours would hold the reader open
+
+	var buf bytes.Buffer
+	var mu sync.Mutex
+	markerSeen := make(chan struct{})
+	scanDone := make(chan struct{})
+	go func() {
+		defer close(scanDone)
+		signaled := false
+		scanner := bufio.NewScanner(pr)
+		scanner.Buffer(make([]byte, 0, 256*1024), 1024*1024)
+		for scanner.Scan() {
+			line := scanner.Text()
+			mu.Lock()
+			buf.WriteString(line)
+			buf.WriteByte('\n')
+			mu.Unlock()
+			if !signaled && bytesContains(line, marker) {
+				signaled = true
+				close(markerSeen)
+			}
+		}
+	}()
+
+	fmt.Fprintf(stdin, "lock\n%s\n", command)
+	// Stdin stays open: the shell must die by kill, never by graceful EOF —
+	// a graceful exit would release the cluster lock cleanly and dodge the
+	// dead-holder cleanup path this test also exercises.
+	hit := false
+	select {
+	case <-markerSeen:
+		hit = true
+	case <-scanDone: // shell exited before printing the marker
+	case <-time.After(90 * time.Second):
+	}
+	if !hit {
+		// A shell that printed the marker and exited immediately can make both
+		// channels ready at once, and select picks between ready cases at
+		// random; a printed marker must never be reported as missed.
+		select {
+		case <-markerSeen:
+			hit = true
+		default:
+		}
+	}
+	cmd.Process.Kill()
+	cmd.Wait()
+	pr.Close()
+	<-scanDone
+	mu.Lock()
+	defer mu.Unlock()
+	return buf.String(), hit
+}
+
+func bytesContains(line, marker string) bool {
+	return len(marker) > 0 && strings.Contains(line, marker)
+}
diff --git a/test/foundationdb/Dockerfile.build b/test/foundationdb/Dockerfile.build
index 58887acbb9..b93ca74563 100644
--- a/test/foundationdb/Dockerfile.build
+++ b/test/foundationdb/Dockerfile.build
@@ -1,6 +1,6 @@
 # Simplified single-stage build for SeaweedFS with FoundationDB support
 # Force x86_64 platform to use AMD64 FoundationDB packages
-FROM --platform=linux/amd64 golang:1.25-bookworm
+FROM --platform=linux/amd64 golang:1.26-bookworm
 
 ARG FOUNDATIONDB_VERSION=7.4.5
 ENV FOUNDATIONDB_VERSION=${FOUNDATIONDB_VERSION}
@@ -43,7 +43,7 @@ WORKDIR /build
 # Copy source code
 COPY . .
 
-# Using Go 1.24 to match project requirements
+# Using Go 1.26 to match project requirements
 
 # Download dependencies (using versions from go.mod for deterministic builds)
 RUN go mod download
diff --git a/test/foundationdb/Dockerfile.build.arm64 b/test/foundationdb/Dockerfile.build.arm64
index d62d7eda81..24c47f590d 100644
--- a/test/foundationdb/Dockerfile.build.arm64
+++ b/test/foundationdb/Dockerfile.build.arm64
@@ -1,5 +1,5 @@
 # Multi-stage Dockerfile to build SeaweedFS with FoundationDB support for ARM64
-FROM --platform=linux/arm64 golang:1.25-bookworm AS builder
+FROM --platform=linux/arm64 golang:1.26-bookworm AS builder
 
 ARG FOUNDATIONDB_VERSION=7.4.5
 ENV FOUNDATIONDB_VERSION=${FOUNDATIONDB_VERSION}
diff --git a/test/foundationdb/Dockerfile.test b/test/foundationdb/Dockerfile.test
index 70191f08b5..3e16ff10d8 100644
--- a/test/foundationdb/Dockerfile.test
+++ b/test/foundationdb/Dockerfile.test
@@ -1,5 +1,5 @@
 # Test environment with Go and FoundationDB support
-FROM golang:1.25-bookworm
+FROM golang:1.26-bookworm
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y \
diff --git a/test/fuse_dlm/dlm_concurrent_write_test.go b/test/fuse_dlm/dlm_concurrent_write_test.go
index 5f844e622d..c56cbac739 100644
--- a/test/fuse_dlm/dlm_concurrent_write_test.go
+++ b/test/fuse_dlm/dlm_concurrent_write_test.go
@@ -1,3 +1,5 @@
+//go:build linux || darwin
+
 package fuse_dlm
 
 import (
diff --git a/test/fuse_dlm/framework_test.go b/test/fuse_dlm/framework_test.go
index 366b95647f..fbc76414f2 100644
--- a/test/fuse_dlm/framework_test.go
+++ b/test/fuse_dlm/framework_test.go
@@ -1,3 +1,5 @@
+//go:build linux || darwin
+
 package fuse_dlm
 
 import (
@@ -8,6 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 	"syscall"
 	"testing"
@@ -90,6 +93,8 @@ func startDLMTestCluster(t testing.TB) *dlmTestCluster {
 	require.NoError(t, c.startVolume(configDir))
 	require.NoError(t, c.waitForTCP(fmt.Sprintf("127.0.0.1:%d", c.volumePort), 30*time.Second),
 		"volume not ready\n%s", c.tailLog("volume"))
+	require.NoError(t, c.waitForVolumeRegistered(30*time.Second),
+		"volume server registration\n%s", c.tailLog("master"))
 
 	// Start 2 filers
 	for i := 0; i < 2; i++ {
@@ -261,7 +266,10 @@ func (c *dlmTestCluster) tailLog(name string) string {
 }
 
 func (c *dlmTestCluster) copyLogsForCI() {
-	ciLogDir := "/tmp/seaweedfs-fuse-dlm-logs"
+	// One subdirectory per test: a flat layout lets every teardown overwrite
+	// the previous test's logs, so the CI artifact only ever shows the last
+	// cluster, never the failing one.
+	ciLogDir := filepath.Join("/tmp/seaweedfs-fuse-dlm-logs", strings.ReplaceAll(c.t.Name(), "/", "_"))
 	os.MkdirAll(ciLogDir, 0755)
 	logsDir := filepath.Join(c.baseDir, "logs")
 	entries, err := os.ReadDir(logsDir)
@@ -348,6 +356,44 @@ func (c *dlmTestCluster) waitForFilerCount(expected int, timeout time.Duration)
 	return fmt.Errorf("timed out waiting for %d filers in group %q", expected, filerGroup)
 }
 
+// waitForVolumeRegistered waits until the volume server shows up in the master
+// topology with its slots reported. An open volume port only means the process
+// is listening: until the master has elected itself and accepted a heartbeat,
+// an assign fails and the first write on a fresh mount surfaces it as ENOSPC.
+func (c *dlmTestCluster) waitForVolumeRegistered(timeout time.Duration) error {
+	addr := fmt.Sprintf("127.0.0.1:%d", c.masterGrpcPort)
+	conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+
+	client := master_pb.NewSeaweedClient(conn)
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		resp, err := client.VolumeList(ctx, &master_pb.VolumeListRequest{})
+		cancel()
+		if err == nil && resp.TopologyInfo != nil {
+			var slots int64
+			for _, dc := range resp.TopologyInfo.DataCenterInfos {
+				for _, rack := range dc.RackInfos {
+					for _, dn := range rack.DataNodeInfos {
+						for _, disk := range dn.DiskInfos {
+							slots += disk.MaxVolumeCount
+						}
+					}
+				}
+			}
+			if slots > 0 {
+				return nil
+			}
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	return fmt.Errorf("volume server not registered with the master within %v", timeout)
+}
+
 // waitForLockRingConverged verifies that both filers have a consistent view of
 // the lock ring by acquiring the same lock through each filer and checking
 // mutual exclusion. Adapted from test/s3/distributed_lock/.
diff --git a/test/fuse_dlm/posix_lock_ring_test.go b/test/fuse_dlm/posix_lock_ring_test.go
index 62210c3fb3..0874fe969d 100644
--- a/test/fuse_dlm/posix_lock_ring_test.go
+++ b/test/fuse_dlm/posix_lock_ring_test.go
@@ -1,3 +1,5 @@
+//go:build linux || darwin
+
 package fuse_dlm
 
 import (
diff --git a/test/fuse_failover/README.md b/test/fuse_failover/README.md
new file mode 100644
index 0000000000..422145b8be
--- /dev/null
+++ b/test/fuse_failover/README.md
@@ -0,0 +1,35 @@
+# FUSE volume server failover tests
+
+Integration tests for what happens to FUSE mounts when a volume server goes
+away, comes back, or restarts underneath in-flight IO. They automate the manual
+matrix reported in
+[discussion #10206](https://github.com/seaweedfs/seaweedfs/discussions/10206):
+one mount appends to a file while a second mount tails it, and a volume server
+is stopped, started or restarted mid-stream.
+
+The cluster is 1 master (`-defaultReplication=001`), 3 volume servers, 1 filer
+and 2 mounts, all as local processes. With 001 every chunk has a copy on two of
+the three servers, so losing any single server must be invisible to both mounts.
+
+| Reported scenario | Test |
+| --- | --- |
+| control: append + tail with nothing failing | `TestAppendWithoutChaos` |
+| read a file while one volume server is down | `TestReadWithVolumeServerDown` |
+| "STOP volumes": append + tail, kill a server mid-stream | `TestAppendWhileVolumeServerStops` |
+| "Start volumes": append + tail with a server down, start it mid-stream | `TestAppendWhileVolumeServerStarts` |
+| "Re-start volumes": append + tail, restart a server mid-stream | `TestAppendWhileVolumeServerRestarts` |
+| part 2: large file copy instead of small appends | `TestLargeWriteWhileVolumeServerStops` |
+
+Volume servers are dropped with SIGKILL, the closest local equivalent of a Swarm
+task disappearing from the overlay network: no deregistration, and the address
+stops answering.
+
+## Running
+
+```bash
+go build -o weed/weed ./weed
+WEED_BINARY=$PWD/weed/weed go test -v -count=1 -timeout=30m ./test/fuse_failover/...
+```
+
+Needs FUSE and, on Linux, a working `/dev/fuse`. Logs from a failed run are
+copied to `/tmp/seaweedfs-fuse-failover-logs/`.
diff --git a/test/fuse_failover/framework_test.go b/test/fuse_failover/framework_test.go
new file mode 100644
index 0000000000..1dd3b59c6d
--- /dev/null
+++ b/test/fuse_failover/framework_test.go
@@ -0,0 +1,660 @@
+//go:build linux || darwin
+
+package fuse_failover
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/stretchr/testify/require"
+)
+
+// failoverCluster runs 1 master, N volume servers, 1 filer and M FUSE mounts,
+// with the master defaulting to 001 replication so every chunk lands on two
+// distinct volume servers. Individual volume servers can be stopped and started
+// while IO is in flight, which is what the Docker Swarm reports in discussion
+// 10206 exercise: a volume server disappears mid-append and the mounts must
+// keep reading from the surviving replica and keep writing on another volume.
+type failoverCluster struct {
+	t          testing.TB
+	baseDir    string
+	weedBinary string
+
+	masterPort     int
+	masterGrpcPort int
+	filerPort      int
+	filerGrpcPort  int
+	volumePorts    []int
+	volumeGrpcPort []int
+	volumeDirs     []string
+
+	masterCmd   *exec.Cmd
+	filerCmd    *exec.Cmd
+	volumeCmds  []*exec.Cmd
+	mountCmds   []*exec.Cmd
+	mountPoints []string
+	logFiles    []*os.File
+
+	mu          sync.Mutex
+	waits       map[*exec.Cmd]chan error
+	cleanupOnce sync.Once
+}
+
+func startFailoverCluster(t testing.TB, numVolumes, numMounts int) *failoverCluster {
+	require.GreaterOrEqual(t, numVolumes, 2, "001 replication needs at least 2 volume servers")
+	require.GreaterOrEqual(t, numMounts, 1)
+
+	binary := findWeedBinary()
+	if binary == "" {
+		t.Skip("weed binary not found; set WEED_BINARY or ensure it is on PATH")
+	}
+	baseDir, err := os.MkdirTemp("", "seaweedfs_fuse_failover_")
+	require.NoError(t, err)
+
+	c := &failoverCluster{
+		t:              t,
+		baseDir:        baseDir,
+		weedBinary:     binary,
+		volumePorts:    make([]int, numVolumes),
+		volumeGrpcPort: make([]int, numVolumes),
+		volumeDirs:     make([]string, numVolumes),
+		volumeCmds:     make([]*exec.Cmd, numVolumes),
+		mountCmds:      make([]*exec.Cmd, numMounts),
+		mountPoints:    make([]string, numMounts),
+	}
+	t.Cleanup(c.Stop)
+
+	ports, err := testutil.AllocatePorts(4 + 2*numVolumes)
+	require.NoError(t, err)
+	c.masterPort, c.masterGrpcPort = ports[0], ports[1]
+	c.filerPort, c.filerGrpcPort = ports[2], ports[3]
+	for i := 0; i < numVolumes; i++ {
+		c.volumePorts[i] = ports[4+2*i]
+		c.volumeGrpcPort[i] = ports[5+2*i]
+		c.volumeDirs[i] = filepath.Join(baseDir, fmt.Sprintf("volume%d", i))
+		require.NoError(t, os.MkdirAll(c.volumeDirs[i], 0755))
+	}
+
+	require.NoError(t, c.startMaster())
+	require.NoError(t, c.waitForTCP(c.masterCmd, "master",
+		fmt.Sprintf("127.0.0.1:%d", c.masterPort), 30*time.Second))
+
+	for i := 0; i < numVolumes; i++ {
+		require.NoError(t, c.StartVolume(i))
+	}
+
+	require.NoError(t, c.startFiler())
+	require.NoError(t, c.waitForTCP(c.filerCmd, "filer",
+		fmt.Sprintf("127.0.0.1:%d", c.filerGrpcPort), 30*time.Second))
+
+	for i := 0; i < numMounts; i++ {
+		mp := filepath.Join(baseDir, fmt.Sprintf("mount%d", i))
+		require.NoError(t, os.MkdirAll(mp, 0755))
+		c.mountPoints[i] = mp
+		require.NoError(t, c.startMount(i))
+		require.NoError(t, c.waitForMount(mp, 30*time.Second),
+			"mount %d not ready\n%s", i, c.tailLog(fmt.Sprintf("mount%d", i)))
+	}
+	require.NoError(t, c.WaitForVolumeServers(60*time.Second))
+
+	// A mounted filesystem and registered volume servers do not yet guarantee
+	// that the lock ring has settled or the first replicated volume is ready.
+	// Exercise the write/read path during setup so the append latency checks
+	// measure failover on a running cluster rather than its cold start.
+	probeName := ".failover-ready"
+	probeData := []byte("ready\n")
+	probePath := filepath.Join(c.MountDir(0), probeName)
+	require.NoError(t, os.WriteFile(probePath, probeData, 0644),
+		"readiness write failed\n%s", c.tailLog("mount0"))
+	for i := 0; i < numMounts; i++ {
+		_, ready := waitForContent(filepath.Join(c.MountDir(i), probeName), probeData, convergeTimeout)
+		require.True(t, ready, "mount %d did not observe readiness write\n%s", i, c.tailLog(fmt.Sprintf("mount%d", i)))
+	}
+	require.NoError(t, os.Remove(probePath))
+	return c
+}
+
+func (c *failoverCluster) MountDir(i int) string { return c.mountPoints[i] }
+
+func (c *failoverCluster) Stop() {
+	if c == nil {
+		return
+	}
+	c.cleanupOnce.Do(func() {
+		for i := len(c.mountCmds) - 1; i >= 0; i-- {
+			c.stopCmd(c.mountCmds[i], syscall.SIGTERM)
+			_ = exec.Command("fusermount3", "-u", c.mountPoints[i]).Run()
+			_ = exec.Command("fusermount", "-u", c.mountPoints[i]).Run()
+		}
+		c.stopCmd(c.filerCmd, syscall.SIGTERM)
+		for i := len(c.volumeCmds) - 1; i >= 0; i-- {
+			c.stopCmd(c.volumeCmds[i], syscall.SIGTERM)
+		}
+		c.stopCmd(c.masterCmd, syscall.SIGTERM)
+
+		c.mu.Lock()
+		for _, f := range c.logFiles {
+			_ = f.Close()
+		}
+		c.mu.Unlock()
+		c.copyLogsForCI()
+		if !c.t.Failed() {
+			os.RemoveAll(c.baseDir)
+		}
+	})
+}
+
+// KillVolume drops a volume server without letting it deregister, the closest
+// local equivalent of a Swarm task vanishing from the overlay network.
+func (c *failoverCluster) KillVolume(i int) {
+	c.stopCmd(c.volumeCmds[i], syscall.SIGKILL)
+	c.volumeCmds[i] = nil
+}
+
+// StartVolume (re)starts volume server i on its original ports and data dir.
+func (c *failoverCluster) StartVolume(i int) error {
+	cmd := exec.Command(c.weedBinary,
+		"-logdir="+filepath.Join(c.baseDir, "logs"),
+		"volume",
+		"-ip=127.0.0.1",
+		"-ip.bind=127.0.0.1",
+		"-port="+strconv.Itoa(c.volumePorts[i]),
+		"-port.grpc="+strconv.Itoa(c.volumeGrpcPort[i]),
+		"-master="+c.masterAddress(),
+		"-dir="+c.volumeDirs[i],
+		"-dataCenter=dc1",
+		"-rack=rack1",
+		"-max=10",
+	)
+	c.volumeCmds[i] = cmd
+	if err := c.startCmd(cmd, fmt.Sprintf("volume%d", i)); err != nil {
+		return err
+	}
+	return c.waitForTCP(cmd, fmt.Sprintf("volume%d", i),
+		fmt.Sprintf("127.0.0.1:%d", c.volumePorts[i]), 30*time.Second)
+}
+
+func (c *failoverCluster) startMaster() error {
+	c.masterCmd = exec.Command(c.weedBinary,
+		"-logdir="+filepath.Join(c.baseDir, "logs"),
+		"master",
+		"-ip=127.0.0.1",
+		"-ip.bind=127.0.0.1",
+		"-port="+strconv.Itoa(c.masterPort),
+		"-port.grpc="+strconv.Itoa(c.masterGrpcPort),
+		"-mdir="+filepath.Join(c.baseDir, "master"),
+		"-defaultReplication=001",
+		"-volumeSizeLimitMB=64",
+	)
+	return c.startCmd(c.masterCmd, "master")
+}
+
+func (c *failoverCluster) startFiler() error {
+	filerDir := filepath.Join(c.baseDir, "filer")
+	if err := os.MkdirAll(filerDir, 0755); err != nil {
+		return fmt.Errorf("create filer dir: %w", err)
+	}
+	c.filerCmd = exec.Command(c.weedBinary,
+		"-logdir="+filepath.Join(c.baseDir, "logs"),
+		"filer",
+		"-ip=127.0.0.1",
+		"-ip.bind=127.0.0.1",
+		"-port="+strconv.Itoa(c.filerPort),
+		"-port.grpc="+strconv.Itoa(c.filerGrpcPort),
+		"-master="+c.masterAddress(),
+		"-defaultReplicaPlacement=001",
+		"-defaultStoreDir="+filerDir,
+	)
+	return c.startCmd(c.filerCmd, "filer")
+}
+
+func (c *failoverCluster) startMount(idx int) error {
+	cacheDir := filepath.Join(c.baseDir, fmt.Sprintf("cache%d", idx))
+	if err := os.MkdirAll(cacheDir, 0755); err != nil {
+		return fmt.Errorf("create cache dir: %w", err)
+	}
+	// Chunk-level detail needs -v=4; keep CI at -v=2 so the logs stay small.
+	verbosity := os.Getenv("FUSE_FAILOVER_MOUNT_V")
+	if verbosity == "" {
+		verbosity = "2"
+	}
+	c.mountCmds[idx] = exec.Command(c.weedBinary,
+		"-logdir="+filepath.Join(c.baseDir, "logs"),
+		"-v="+verbosity,
+		"mount",
+		"-filer="+c.filerAddress(),
+		"-dir="+c.mountPoints[idx],
+		"-filer.path=/",
+		"-dirAutoCreate",
+		"-allowOthers=false",
+		"-replication=001",
+		"-cacheDir="+cacheDir,
+	)
+	return c.startCmd(c.mountCmds[idx], fmt.Sprintf("mount%d", idx))
+}
+
+// MasterGet fetches a master HTTP endpoint, e.g. "/dir/status?pretty=y" or
+// "/dir/lookup?volumeId=6", so a failing test can show where the replicas are.
+func (c *failoverCluster) MasterGet(path string) string {
+	resp, err := http.Get(fmt.Sprintf("http://127.0.0.1:%d%s", c.masterPort, path))
+	if err != nil {
+		return fmt.Sprintf("(master %s failed: %v)", path, err)
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Sprintf("(master %s read failed: %v)", path, err)
+	}
+	return string(body)
+}
+
+// FilerGet reads a file back through the filer's own HTTP handler: a view of
+// the chunk list that neither mount's cache can colour.
+func (c *failoverCluster) FilerGet(path string) ([]byte, error) {
+	resp, err := http.Get(fmt.Sprintf("http://127.0.0.1:%d%s", c.filerPort, path))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("filer %s: %s", path, resp.Status)
+	}
+	return body, nil
+}
+
+// VolumeServerAddress is the address volume server i registers with the master.
+func (c *failoverCluster) VolumeServerAddress(i int) string {
+	return fmt.Sprintf("127.0.0.1:%d", c.volumePorts[i])
+}
+
+// FileVolumeIds returns the volume ids backing a file, read from the filer's
+// own entry rather than inferred, so a test can tell which servers a given
+// file actually depends on. Manifests are resolved first: a manifest chunk's
+// own fid names the volume holding the manifest, not the data.
+func (c *failoverCluster) FileVolumeIds(path string) ([]uint32, error) {
+	body, err := c.FilerGet(path + "?metadata=true&resolveManifest=true")
+	if err != nil {
+		return nil, err
+	}
+	var entry struct {
+		Chunks []struct {
+			FileId string `json:"file_id"`
+			Fid    struct {
+				VolumeId uint32 `json:"volume_id"`
+			} `json:"fid"`
+		} `json:"chunks"`
+	}
+	if err = json.Unmarshal(body, &entry); err != nil {
+		return nil, fmt.Errorf("decode entry %s: %w", path, err)
+	}
+	seen := make(map[uint32]bool)
+	var vids []uint32
+	for _, chunk := range entry.Chunks {
+		vid := chunk.Fid.VolumeId
+		if vid == 0 && chunk.FileId != "" {
+			parsed, parseErr := strconv.ParseUint(strings.SplitN(chunk.FileId, ",", 2)[0], 10, 32)
+			if parseErr != nil {
+				return nil, fmt.Errorf("parse file id %s: %w", chunk.FileId, parseErr)
+			}
+			vid = uint32(parsed)
+		}
+		if !seen[vid] {
+			seen[vid] = true
+			vids = append(vids, vid)
+		}
+	}
+	return vids, nil
+}
+
+// FileChunkList returns the filer's chunk list for a file: each chunk's file
+// id, logical offset, size, and the volume id it lives on. Used to pinpoint
+// which chunk covers a corrupted byte range and which volume server holds it.
+func (c *failoverCluster) FileChunkList(path string) ([]struct {
+	FileId   string
+	Offset   int64
+	Size     uint64
+	VolumeId uint32
+}, error) {
+	body, err := c.FilerGet(path + "?metadata=true&resolveManifest=true")
+	if err != nil {
+		return nil, err
+	}
+	var entry struct {
+		Chunks []struct {
+			FileId string `json:"file_id"`
+			Offset int64  `json:"offset"`
+			Size   uint64 `json:"size"`
+			Fid    struct {
+				VolumeId uint32 `json:"volume_id"`
+			} `json:"fid"`
+		} `json:"chunks"`
+	}
+	if err = json.Unmarshal(body, &entry); err != nil {
+		return nil, fmt.Errorf("decode entry %s: %w", path, err)
+	}
+	out := make([]struct {
+		FileId   string
+		Offset   int64
+		Size     uint64
+		VolumeId uint32
+	}, len(entry.Chunks))
+	for i, ch := range entry.Chunks {
+		vid := ch.Fid.VolumeId
+		if vid == 0 && ch.FileId != "" {
+			parsed, parseErr := strconv.ParseUint(strings.SplitN(ch.FileId, ",", 2)[0], 10, 32)
+			if parseErr != nil {
+				return nil, fmt.Errorf("parse file id %s: %w", ch.FileId, parseErr)
+			}
+			vid = uint32(parsed)
+		}
+		out[i] = struct {
+			FileId   string
+			Offset   int64
+			Size     uint64
+			VolumeId uint32
+		}{ch.FileId, ch.Offset, ch.Size, vid}
+	}
+	return out, nil
+}
+
+// VolumeHolders returns the volume server addresses the master currently lists
+// for a volume id.
+func (c *failoverCluster) VolumeHolders(vid uint32) ([]string, error) {
+	var lookup struct {
+		Locations []struct {
+			Url string `json:"url"`
+		} `json:"locations"`
+	}
+	body := c.MasterGet(fmt.Sprintf("/dir/lookup?volumeId=%d", vid))
+	if err := json.Unmarshal([]byte(body), &lookup); err != nil {
+		return nil, fmt.Errorf("decode lookup for volume %d: %w (%s)", vid, err, body)
+	}
+	holders := make([]string, 0, len(lookup.Locations))
+	for _, loc := range lookup.Locations {
+		holders = append(holders, loc.Url)
+	}
+	return holders, nil
+}
+
+// WaitForHolders polls the master until it lists exactly count servers for a
+// volume. The master only drops a dead node after three missed heartbeats, so a
+// test that depends on the cluster's view having caught up has to wait for it.
+func (c *failoverCluster) WaitForHolders(vid uint32, count int, timeout time.Duration) ([]string, error) {
+	deadline := time.Now().Add(timeout)
+	for {
+		holders, err := c.VolumeHolders(vid)
+		if err == nil && len(holders) == count {
+			return holders, nil
+		}
+		if time.Now().After(deadline) {
+			return holders, fmt.Errorf("volume %d still has %d holders (%v), want %d", vid, len(holders), holders, count)
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+}
+
+// WaitForVolumeServers blocks until the master's topology lists every volume
+// server. A volume server accepts connections well before the master knows it
+// exists: a lone master only elects itself once its bootstrap check expires,
+// and heartbeats sent before that are refused and retried with backoff, so
+// registration lands seconds after the process is up. Until it does the
+// topology has no data node at all, an assign fails with "no free volumes
+// left", and the mount reports that as ENOSPC instead of retrying.
+func (c *failoverCluster) WaitForVolumeServers(timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	for {
+		registered := c.registeredVolumeServers()
+		var missing []string
+		for i := range c.volumePorts {
+			if address := c.VolumeServerAddress(i); !registered[address] {
+				missing = append(missing, address)
+			}
+		}
+		if len(missing) == 0 {
+			return nil
+		}
+		if time.Now().After(deadline) {
+			return fmt.Errorf("volume servers %v not registered with the master within %v\n%s",
+				missing, timeout, c.MasterGet("/dir/status?pretty=y"))
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+}
+
+// registeredVolumeServers is the set of volume server addresses the master
+// currently holds in its topology.
+func (c *failoverCluster) registeredVolumeServers() map[string]bool {
+	var status struct {
+		Topology struct {
+			DataCenters []struct {
+				Racks []struct {
+					DataNodes []struct {
+						Url string `json:"Url"`
+					} `json:"DataNodes"`
+				} `json:"Racks"`
+			} `json:"DataCenters"`
+		} `json:"Topology"`
+	}
+	if err := json.Unmarshal([]byte(c.MasterGet("/dir/status")), &status); err != nil {
+		return nil
+	}
+	registered := make(map[string]bool)
+	for _, dc := range status.Topology.DataCenters {
+		for _, rack := range dc.Racks {
+			for _, dn := range rack.DataNodes {
+				registered[dn.Url] = true
+			}
+		}
+	}
+	return registered
+}
+
+// volumeIndexOf maps a server address back to its index, or -1.
+func (c *failoverCluster) volumeIndexOf(address string) int {
+	for i := range c.volumePorts {
+		if c.VolumeServerAddress(i) == address {
+			return i
+		}
+	}
+	return -1
+}
+
+// FileIsOn reports whether any of path's chunks live on the given volume
+// server, i.e. whether taking that server down actually costs this file a
+// replica.
+func (c *failoverCluster) FileIsOn(path, serverAddress string) (bool, error) {
+	vids, err := c.FileVolumeIds(path)
+	if err != nil {
+		return false, err
+	}
+	for _, vid := range vids {
+		holders, holdersErr := c.VolumeHolders(vid)
+		if holdersErr != nil {
+			return false, holdersErr
+		}
+		for _, holder := range holders {
+			if holder == serverAddress {
+				return true, nil
+			}
+		}
+	}
+	return false, nil
+}
+
+func (c *failoverCluster) masterAddress() string {
+	return string(pb.NewServerAddress("127.0.0.1", c.masterPort, c.masterGrpcPort))
+}
+
+func (c *failoverCluster) filerAddress() string {
+	return string(pb.NewServerAddress("127.0.0.1", c.filerPort, c.filerGrpcPort))
+}
+
+func (c *failoverCluster) startCmd(cmd *exec.Cmd, name string) error {
+	logPath := filepath.Join(c.baseDir, "logs")
+	if err := os.MkdirAll(logPath, 0755); err != nil {
+		return fmt.Errorf("create log dir: %w", err)
+	}
+	// Append so a restarted volume server keeps the log of its earlier run.
+	logFile, err := os.OpenFile(filepath.Join(logPath, name+".log"),
+		os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
+	if err != nil {
+		return err
+	}
+	c.mu.Lock()
+	c.logFiles = append(c.logFiles, logFile)
+	c.mu.Unlock()
+	cmd.Stdout = logFile
+	cmd.Stderr = logFile
+	if err := cmd.Start(); err != nil {
+		return err
+	}
+	// Reap in the background and publish the result: Signal(0) succeeds for a
+	// zombie, so an unreaped child that died at startup would otherwise look
+	// alive until the readiness timeout expired.
+	ch := make(chan error, 1)
+	c.mu.Lock()
+	if c.waits == nil {
+		c.waits = make(map[*exec.Cmd]chan error)
+	}
+	c.waits[cmd] = ch
+	c.mu.Unlock()
+	go func() {
+		ch <- cmd.Wait()
+		close(ch)
+	}()
+	return nil
+}
+
+// waitChan returns the channel carrying cmd's exit, or nil if it was never
+// started through startCmd. It stays readable after the exit is consumed.
+func (c *failoverCluster) waitChan(cmd *exec.Cmd) chan error {
+	if cmd == nil {
+		return nil
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.waits[cmd]
+}
+
+func (c *failoverCluster) tailLog(name string) string {
+	data, err := os.ReadFile(filepath.Join(c.baseDir, "logs", name+".log"))
+	if err != nil {
+		return fmt.Sprintf("(log %s not available: %v)", name, err)
+	}
+	const maxTail = 8192
+	if len(data) > maxTail {
+		data = data[len(data)-maxTail:]
+	}
+	return string(data)
+}
+
+func (c *failoverCluster) copyLogsForCI() {
+	// One directory per test: subtests share a log dir name otherwise, and the
+	// last one to finish would overwrite the logs of the one that failed.
+	ciLogDir := filepath.Join("/tmp/seaweedfs-fuse-failover-logs",
+		strings.ReplaceAll(c.t.Name(), "/", "_"))
+	os.MkdirAll(ciLogDir, 0755)
+	entries, err := os.ReadDir(filepath.Join(c.baseDir, "logs"))
+	if err != nil {
+		return
+	}
+	for _, e := range entries {
+		data, err := os.ReadFile(filepath.Join(c.baseDir, "logs", e.Name()))
+		if err != nil {
+			continue
+		}
+		os.WriteFile(filepath.Join(ciLogDir, e.Name()), data, 0644)
+	}
+}
+
+func (c *failoverCluster) waitForTCP(cmd *exec.Cmd, name, addr string, timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		conn, err := net.DialTimeout("tcp", addr, time.Second)
+		if err == nil {
+			conn.Close()
+			return nil
+		}
+		if ch := c.waitChan(cmd); ch != nil {
+			select {
+			case waitErr := <-ch:
+				return fmt.Errorf("%s exited before listening on %s: %v\n%s",
+					name, addr, waitErr, c.tailLog(name))
+			default:
+			}
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	return fmt.Errorf("service at %s not ready within timeout\n%s", addr, c.tailLog(name))
+}
+
+func (c *failoverCluster) waitForMount(mountPoint string, timeout time.Duration) error {
+	parentDir := filepath.Dir(mountPoint)
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		parentStat, err := os.Stat(parentDir)
+		if err != nil {
+			time.Sleep(200 * time.Millisecond)
+			continue
+		}
+		mountStat, err := os.Stat(mountPoint)
+		if err != nil {
+			time.Sleep(200 * time.Millisecond)
+			continue
+		}
+		if parentStat.Sys().(*syscall.Stat_t).Dev != mountStat.Sys().(*syscall.Stat_t).Dev {
+			return nil
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	return fmt.Errorf("mount point %s not ready within timeout (FUSE not detected)", mountPoint)
+}
+
+func findWeedBinary() string {
+	if env := os.Getenv("WEED_BINARY"); env != "" {
+		if _, err := os.Stat(env); err == nil {
+			return env
+		}
+	}
+	if p, err := exec.LookPath("weed"); err == nil {
+		return p
+	}
+	return ""
+}
+
+// stopCmd signals cmd and waits for the reaper goroutine started by startCmd to
+// report its exit, escalating to SIGKILL if it does not go quietly.
+func (c *failoverCluster) stopCmd(cmd *exec.Cmd, sig syscall.Signal) {
+	if cmd == nil || cmd.Process == nil {
+		return
+	}
+	_ = cmd.Process.Signal(sig)
+	done := c.waitChan(cmd)
+	if done == nil {
+		return
+	}
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		_ = cmd.Process.Signal(syscall.SIGKILL)
+		<-done
+	}
+}
diff --git a/test/fuse_failover/volume_failover_test.go b/test/fuse_failover/volume_failover_test.go
new file mode 100644
index 0000000000..04aa901bb7
--- /dev/null
+++ b/test/fuse_failover/volume_failover_test.go
@@ -0,0 +1,502 @@
+//go:build linux || darwin
+
+package fuse_failover
+
+import (
+	"bytes"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// The scenarios below come from the Docker Swarm report in discussion 10206:
+// one mount appends to a file while a second mount reads it, and a volume
+// server is stopped, started or restarted underneath. With 001 replication a
+// single volume server loss must never surface as EIO on either side.
+
+const (
+	appendLines      = 200
+	maxAppendLatency = 10 * time.Second
+	convergeTimeout  = 30 * time.Second
+)
+
+type appendResult struct {
+	errs       []error
+	maxLatency time.Duration
+	slowest    int
+}
+
+// appendLoop mimics `for i in ...; do echo $i >> file; done`: every line is its
+// own open/write/close, so every line forces a flush and a chunk upload.
+func appendLoop(path string, lines int, onLine func(i int)) *appendResult {
+	res := &appendResult{}
+	for i := 0; i < lines; i++ {
+		start := time.Now()
+		err := appendOnce(path, fmt.Sprintf("%07d\n", i))
+		elapsed := time.Since(start)
+		if elapsed > res.maxLatency {
+			res.maxLatency, res.slowest = elapsed, i
+		}
+		if err != nil {
+			res.errs = append(res.errs, fmt.Errorf("line %d: %w", i, err))
+		}
+		if onLine != nil {
+			onLine(i)
+		}
+	}
+	return res
+}
+
+func appendOnce(path, line string) error {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_APPEND|os.O_CREATE, 0644)
+	if err != nil {
+		return fmt.Errorf("open: %w", err)
+	}
+	if _, err = f.WriteString(line); err != nil {
+		f.Close()
+		return fmt.Errorf("write: %w", err)
+	}
+	if err = f.Close(); err != nil {
+		return fmt.Errorf("close: %w", err)
+	}
+	return nil
+}
+
+// reader is the `tail -f` side: it keeps re-reading the whole file from the
+// other mount and records every failure that is not "not created yet".
+type reader struct {
+	stop chan struct{}
+	done chan struct{}
+	errs []error
+}
+
+func startReader(path string) *reader {
+	r := &reader{stop: make(chan struct{}), done: make(chan struct{})}
+	go func() {
+		defer close(r.done)
+		for {
+			select {
+			case <-r.stop:
+				return
+			default:
+			}
+			if _, err := os.ReadFile(path); err != nil && !os.IsNotExist(err) {
+				r.errs = append(r.errs, err)
+			}
+			time.Sleep(200 * time.Millisecond)
+		}
+	}()
+	return r
+}
+
+func (r *reader) Stop() []error {
+	close(r.stop)
+	<-r.done
+	return r.errs
+}
+
+// waitForContent re-reads path until it matches want or the timeout passes.
+// A mount caches metadata for about a second, so a read taken the instant the
+// writer's last close returned can legitimately still be behind; content that
+// is wrong rather than merely late never converges and still fails.
+func waitForContent(path string, want []byte, timeout time.Duration) (got []byte, ok bool) {
+	deadline := time.Now().Add(timeout)
+	for {
+		data, err := os.ReadFile(path)
+		if err == nil {
+			got = data
+			if bytes.Equal(got, want) {
+				return got, true
+			}
+		}
+		if time.Now().After(deadline) {
+			return got, false
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+}
+
+func expectedAppendContent(lines int) []byte {
+	var buf []byte
+	for i := 0; i < lines; i++ {
+		buf = append(buf, []byte(fmt.Sprintf("%07d\n", i))...)
+	}
+	return buf
+}
+
+// TestReadWithVolumeServerDown covers the original report: a file written while
+// everything was healthy must stay readable from a second mount after any
+// single volume server goes away.
+func TestReadWithVolumeServerDown(t *testing.T) {
+	c := startFailoverCluster(t, 3, 2)
+
+	const fileSize = 8 << 20
+	payloads := make(map[string][]byte)
+	for i := 0; i < 3; i++ {
+		name := fmt.Sprintf("readfile-%d", i)
+		data := make([]byte, fileSize)
+		_, err := rand.Read(data)
+		require.NoError(t, err)
+		require.NoError(t, os.WriteFile(filepath.Join(c.MountDir(0), name), data, 0644))
+		payloads[name] = data
+	}
+	// Let the filer commit the last chunks before anything is torn down.
+	time.Sleep(2 * time.Second)
+
+	t.Logf("topology before chaos:\n%s", c.MasterGet("/dir/status?pretty=y"))
+
+	alreadyRead := make(map[string]bool)
+	for victim := 0; victim < 3; victim++ {
+		// Placement decides which two of the three servers hold each volume, so
+		// pick a file this victim actually backs: reading one it never held
+		// would pass without exercising recovery at all. Prefer a file no
+		// earlier iteration has read, whose chunks the reader has not cached.
+		name := ""
+		for _, allowRead := range []bool{false, true} {
+			for i := 0; i < 3 && name == ""; i++ {
+				candidate := fmt.Sprintf("readfile-%d", i)
+				if alreadyRead[candidate] && !allowRead {
+					continue
+				}
+				onVictim, err := c.FileIsOn("/"+candidate, c.VolumeServerAddress(victim))
+				require.NoError(t, err, "resolve placement of %s", candidate)
+				if onVictim {
+					name = candidate
+				}
+			}
+		}
+		require.NotEmpty(t, name, "no test file has a replica on volume%d, nothing to fail over from\n%s",
+			victim, c.MasterGet("/dir/status?pretty=y"))
+		alreadyRead[name] = true
+
+		c.KillVolume(victim)
+
+		start := time.Now()
+		got, err := os.ReadFile(filepath.Join(c.MountDir(1), name))
+		elapsed := time.Since(start)
+		if err != nil {
+			t.Logf("topology with volume%d down:\n%s", victim, c.MasterGet("/dir/status?pretty=y"))
+		}
+		require.NoError(t, err, "read %s with volume %d down\n%s", name, victim, c.tailLog("mount1"))
+		require.Equal(t, sha256.Sum256(payloads[name]), sha256.Sum256(got),
+			"content mismatch for %s with volume %d down", name, victim)
+		t.Logf("read %s (held by volume%d) with volume%d down in %v", name, victim, victim, elapsed)
+
+		require.NoError(t, c.StartVolume(victim))
+		// The next iteration picks its victim from the master's placement view,
+		// so wait for the restarted server to be in it again.
+		require.NoError(t, c.WaitForVolumeServers(60*time.Second))
+	}
+}
+
+// TestReadAfterCachedLocationDies pins the reason the read path needs a cache
+// invalidator at all. Reading a file for the first time after a server dies
+// proves nothing: the lookup is fresh and simply returns the survivor. The
+// damage needs a reader whose cached location list is both stale and useless,
+// which is what this sequence builds:
+//
+//  1. kill one of the two servers holding a volume and wait for the master to
+//     drop it, so a lookup now resolves to the survivor alone;
+//  2. read a file on that volume, which caches exactly that one location;
+//  3. bring the first server back, which the reader never hears about;
+//  4. kill the survivor, and read another file on the same volume.
+//
+// The reader's only cached location is now dead while the data is live on the
+// restarted server. Without the invalidator the mount retries the corpse until
+// it gives up with EIO.
+func TestReadAfterCachedLocationDies(t *testing.T) {
+	c := startFailoverCluster(t, 3, 2)
+
+	// Small files so each is a single chunk on a single volume, which keeps the
+	// mapping from file to server unambiguous. The master grows six 001 volumes
+	// at a time, so seven files put two of them on one volume however the
+	// writes are spread.
+	const fileSize = 256 << 10
+	payloads := make(map[string][]byte)
+	for i := 0; i < 7; i++ {
+		name := fmt.Sprintf("smallfile-%d", i)
+		data := make([]byte, fileSize)
+		_, err := rand.Read(data)
+		require.NoError(t, err)
+		require.NoError(t, os.WriteFile(filepath.Join(c.MountDir(0), name), data, 0644))
+		payloads[name] = data
+	}
+	time.Sleep(2 * time.Second)
+
+	// Two files on one volume: one to prime the reader's cache, one to probe
+	// with afterwards. The probe has to be a file the reader has never read, or
+	// its chunk would come from the local cache without a lookup at all.
+	filesByVolume := make(map[uint32][]string)
+	for name := range payloads {
+		vids, err := c.FileVolumeIds("/" + name)
+		require.NoError(t, err, "resolve volumes of %s", name)
+		require.Len(t, vids, 1, "%s should be a single chunk", name)
+		filesByVolume[vids[0]] = append(filesByVolume[vids[0]], name)
+	}
+	var vid uint32
+	var prime, probe string
+	for candidate, names := range filesByVolume {
+		if len(names) >= 2 {
+			vid, prime, probe = candidate, names[0], names[1]
+			break
+		}
+	}
+	require.NotEmpty(t, prime, "no volume holds two of the test files: %v", filesByVolume)
+
+	holders, err := c.VolumeHolders(vid)
+	require.NoError(t, err)
+	require.Len(t, holders, 2, "001 replication should put volume %d on two servers", vid)
+	first, second := c.volumeIndexOf(holders[0]), c.volumeIndexOf(holders[1])
+	require.NotEqual(t, -1, first)
+	require.NotEqual(t, -1, second)
+
+	c.KillVolume(first)
+	_, err = c.WaitForHolders(vid, 1, 90*time.Second)
+	require.NoError(t, err, "master did not drop the dead server")
+
+	got, err := os.ReadFile(filepath.Join(c.MountDir(1), prime))
+	require.NoError(t, err, "priming read\n%s", c.tailLog("mount1"))
+	require.Equal(t, sha256.Sum256(payloads[prime]), sha256.Sum256(got))
+
+	require.NoError(t, c.StartVolume(first))
+	_, err = c.WaitForHolders(vid, 2, 90*time.Second)
+	require.NoError(t, err, "restarted server did not re-register")
+
+	c.KillVolume(second)
+	start := time.Now()
+	got, err = os.ReadFile(filepath.Join(c.MountDir(1), probe))
+	require.NoError(t, err, "probe read after the cached location died\n%s", c.tailLog("mount1"))
+	require.Equal(t, sha256.Sum256(payloads[probe]), sha256.Sum256(got))
+	t.Logf("recovered %s from the restarted server in %v", probe, time.Since(start))
+}
+
+// TestAppendWithoutChaos is the control for the chaos runs below: the same
+// append-and-tail workload with nothing being stopped or started.
+func TestAppendWithoutChaos(t *testing.T) {
+	c := startFailoverCluster(t, 3, 2)
+	runChaosAppend(t, c, "no-chaos", func() {})
+}
+
+// TestAppendWhileVolumeServerStops is scenario "STOP volumes": append from
+// mount0 and tail from mount1 while one volume server is killed mid-stream.
+func TestAppendWhileVolumeServerStops(t *testing.T) {
+	for victim := 0; victim < 3; victim++ {
+		t.Run(fmt.Sprintf("volume%d", victim), func(t *testing.T) {
+			c := startFailoverCluster(t, 3, 2)
+			runChaosAppend(t, c, fmt.Sprintf("stop-%d", victim), func() {
+				c.KillVolume(victim)
+			})
+		})
+	}
+}
+
+// TestAppendWhileVolumeServerStarts is scenario "Start volumes": the cluster is
+// already one server down when the writer starts, and that server comes back
+// mid-stream. This is where the reporter saw 12-38 s stalls per append.
+func TestAppendWhileVolumeServerStarts(t *testing.T) {
+	for victim := 0; victim < 3; victim++ {
+		t.Run(fmt.Sprintf("volume%d", victim), func(t *testing.T) {
+			c := startFailoverCluster(t, 3, 2)
+			c.KillVolume(victim)
+			time.Sleep(3 * time.Second)
+			runChaosAppend(t, c, fmt.Sprintf("start-%d", victim), func() {
+				require.NoError(t, c.StartVolume(victim))
+			})
+		})
+	}
+}
+
+// TestAppendWhileVolumeServerRestarts is scenario "Re-start volumes".
+func TestAppendWhileVolumeServerRestarts(t *testing.T) {
+	for victim := 0; victim < 3; victim++ {
+		t.Run(fmt.Sprintf("volume%d", victim), func(t *testing.T) {
+			c := startFailoverCluster(t, 3, 2)
+			runChaosAppend(t, c, fmt.Sprintf("restart-%d", victim), func() {
+				c.KillVolume(victim)
+				time.Sleep(2 * time.Second)
+				require.NoError(t, c.StartVolume(victim))
+			})
+		})
+	}
+}
+
+// TestLargeWriteWhileVolumeServerStops is the part-2 variant: a single large
+// copy instead of many small appends, checksum-verified from the other mount.
+func TestLargeWriteWhileVolumeServerStops(t *testing.T) {
+	c := startFailoverCluster(t, 3, 2)
+
+	const size = 64 << 20
+	data := make([]byte, size)
+	_, err := rand.Read(data)
+	require.NoError(t, err)
+
+	path := filepath.Join(c.MountDir(0), "largefile")
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	require.NoError(t, err)
+
+	killed := false
+	const block = 1 << 20
+	for off := 0; off < size; off += block {
+		if !killed && off >= size/3 {
+			c.KillVolume(2)
+			killed = true
+		}
+		_, werr := f.Write(data[off : off+block])
+		require.NoError(t, werr, "write at offset %d with volume2 down\n%s", off, c.tailLog("mount0"))
+	}
+	require.NoError(t, f.Close())
+
+	got, converged := waitForContent(filepath.Join(c.MountDir(1), "largefile"), data, convergeTimeout)
+	require.True(t, converged, "large file did not converge on mount1: want %d bytes %x, got %d bytes %x\n%s",
+		len(data), sha256.Sum256(data), len(got), sha256.Sum256(got), c.tailLog("mount1"))
+}
+
+// runChaosAppend appends from mount0 with a reader tailing on mount1, firing
+// chaos once the writer is a quarter of the way in.
+func runChaosAppend(t *testing.T, c *failoverCluster, name string, chaos func()) {
+	t.Helper()
+
+	writePath := filepath.Join(c.MountDir(0), name)
+	readPath := filepath.Join(c.MountDir(1), name)
+
+	r := startReader(readPath)
+
+	var once sync.Once
+	res := appendLoop(writePath, appendLines, func(i int) {
+		if i == appendLines/4 {
+			once.Do(chaos)
+		}
+	})
+	readErrs := r.Stop()
+
+	require.Empty(t, res.errs, "append errors\n%s", c.tailLog("mount0"))
+	require.Empty(t, readErrs, "reader errors\n%s", c.tailLog("mount1"))
+	t.Logf("%s: slowest append was line %d at %v", name, res.slowest, res.maxLatency)
+	// A healthy append stays well under a second; the reported regression parked
+	// single appends at 12-38 s while a volume server was coming back.
+	require.Less(t, res.maxLatency, maxAppendLatency,
+		"append %d stalled for %v\n%s", res.slowest, res.maxLatency, c.tailLog("mount0"))
+
+	wantBytes := expectedAppendContent(appendLines)
+	want := string(wantBytes)
+	gotBytes, converged := waitForContent(readPath, wantBytes, convergeTimeout)
+	got := string(gotBytes)
+	if converged {
+		return
+	}
+
+	// The reader never caught up. Show where it diverges and what the writer's
+	// own mount and the filer make of the same file, which says whether the
+	// data was lost on the way in or is only invisible from this side.
+	d := firstDiff(want, got)
+	fromWriter, writerReadErr := os.ReadFile(writePath)
+	viaFiler, filerErr := c.FilerGet("/" + name)
+	require.Failf(t, "final content mismatch",
+		"%s: first difference at offset %d (want %d bytes, got %d)\nwant %q\ngot  %q\nmount0 matches=%v (writer read err %v) filer matches=%v (err %v)\n%s\n%s\n%s",
+		name, d, len(want), len(got), window(want, d), window(got, d),
+		string(fromWriter) == want, writerReadErr, string(viaFiler) == want, filerErr,
+		c.tailLog("mount0"),
+		dumpChunkList(c, "/"+name, d),
+		dumpHexAround(fromWriter, d, "writer mount"),
+	)
+}
+
+// dumpChunkList returns a human-readable summary of the filer's chunk list
+// for path, annotated with the volume id and the master's current holders
+// for each. When diffAt >= 0, the chunk covering that logical offset is
+// flagged so a corruption can be tied to a specific chunk and volume server.
+func dumpChunkList(c *failoverCluster, path string, diffAt int) string {
+	chunks, err := c.FileChunkList(path)
+	if err != nil {
+		return fmt.Sprintf("chunk list for %s: %v", path, err)
+	}
+	var b strings.Builder
+	fmt.Fprintf(&b, "chunk list for %s (%d chunks):", path, len(chunks))
+	for i, ch := range chunks {
+		holders, holdersErr := c.VolumeHolders(ch.VolumeId)
+		holdersStr := "unknown"
+		if holdersErr != nil {
+			holdersStr = fmt.Sprintf("lookup failed: %v", holdersErr)
+		} else if len(holders) > 0 {
+			holdersStr = strings.Join(holders, ",")
+		}
+		marker := ""
+		if diffAt >= 0 && int64(diffAt) >= ch.Offset && int64(diffAt) < ch.Offset+int64(ch.Size) {
+			marker = "  <-- covers diff"
+		}
+		fmt.Fprintf(&b, "\n  [%d] fid=%s offset=%d size=%d vid=%d holders=[%s]%s",
+			i, ch.FileId, ch.Offset, ch.Size, ch.VolumeId, holdersStr, marker)
+	}
+	return b.String()
+}
+
+// dumpHexAround returns a hex+ASCII dump of a 32-byte window around off in
+// label's copy of the file, so the exact zero-filled region is visible in
+// the failure message instead of only a quoted string window.
+func dumpHexAround(data []byte, off int, label string) string {
+	if off < 0 {
+		return fmt.Sprintf("%s hex dump: no divergence offset", label)
+	}
+	start := max(0, off-16)
+	end := min(len(data), off+16)
+	if start >= end {
+		return fmt.Sprintf("%s hex dump: offset %d out of range (len %d)", label, off, len(data))
+	}
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s hex dump around offset %d:", label, off)
+	for i := start; i < end; i += 16 {
+		lineEnd := min(i+16, end)
+		hexPart := hexDump(data[i:lineEnd])
+		asciiPart := asciiDump(data[i:lineEnd])
+		fmt.Fprintf(&b, "\n  %06x  %-48s  %s", i, hexPart, asciiPart)
+	}
+	return b.String()
+}
+
+func hexDump(b []byte) string {
+	var sb strings.Builder
+	for i, x := range b {
+		if i > 0 {
+			sb.WriteByte(' ')
+		}
+		fmt.Fprintf(&sb, "%02x", x)
+	}
+	return sb.String()
+}
+
+func asciiDump(b []byte) string {
+	var sb strings.Builder
+	for _, x := range b {
+		if x >= 0x20 && x < 0x7f {
+			sb.WriteByte(x)
+		} else {
+			sb.WriteByte('.')
+		}
+	}
+	return sb.String()
+}
+
+// firstDiff returns the offset of the first differing byte, or -1 when equal.
+func firstDiff(want, got string) int {
+	for i := 0; i < len(want) && i < len(got); i++ {
+		if want[i] != got[i] {
+			return i
+		}
+	}
+	if len(want) != len(got) {
+		return min(len(want), len(got))
+	}
+	return -1
+}
+
+func window(s string, at int) string {
+	return s[max(0, at-24):min(len(s), at+24)]
+}
diff --git a/test/fuse_integration/Makefile b/test/fuse_integration/Makefile
index 3c1e68d592..1da4647dee 100644
--- a/test/fuse_integration/Makefile
+++ b/test/fuse_integration/Makefile
@@ -2,7 +2,7 @@
 
 # Configuration
 WEED_BINARY := weed
-GO_VERSION := 1.24
+GO_VERSION := 1.26
 TEST_TIMEOUT := 30m
 COVERAGE_FILE := coverage.out
 
diff --git a/test/fuse_integration/POSIX_COMPLIANCE.md b/test/fuse_integration/POSIX_COMPLIANCE.md
new file mode 100644
index 0000000000..f68399b7fb
--- /dev/null
+++ b/test/fuse_integration/POSIX_COMPLIANCE.md
@@ -0,0 +1,645 @@
+# SeaweedFS FUSE POSIX Compliance Testing
+
+## Overview
+
+This comprehensive test suite provides full POSIX compliance testing for SeaweedFS FUSE mounts. It includes basic POSIX operations, extended features, external test suite integration, and performance benchmarking to ensure SeaweedFS meets filesystem standards.
+
+## 🎯 Key Features
+
+### ✅ **Comprehensive Test Coverage**
+- **Basic POSIX Operations**: File/directory create, read, write, delete, rename
+- **Advanced Features**: Extended attributes, file locking, memory mapping *(see roadmap)*
+- **I/O Operations**: Synchronous/asynchronous I/O, direct I/O, vectored I/O *(see roadmap)*
+- **Error Handling**: Comprehensive error condition testing
+- **Concurrent Operations**: Multi-threaded stress testing
+- **External Integration**: pjdfstest, nfstest, FIO integration
+
+> **📋 Implementation Status**: Some advanced features are currently skipped pending platform-specific implementations. See [`POSIX_IMPLEMENTATION_ROADMAP.md`](./POSIX_IMPLEMENTATION_ROADMAP.md) for a detailed implementation plan and current status.
+
+### 📊 **Performance Analysis**
+- **Benchmarking**: Built-in performance benchmarks
+- **Profiling**: CPU and memory profiling support
+- **Coverage Analysis**: Code coverage reporting
+- **Stress Testing**: High-load concurrent operation testing
+
+### 🔧 **External Tool Integration**
+- **pjdfstest**: Industry-standard POSIX filesystem test suite
+- **nfstest_posix**: Network filesystem POSIX API verification
+- **FIO**: Flexible I/O performance testing
+- **Custom Litmus Tests**: Focused edge case testing
+
+## 📋 Test Categories
+
+### 1. Basic POSIX Compliance (`posix_compliance_test.go`)
+
+#### File Operations
+- ✅ File creation with O_CREAT, O_EXCL flags
+- ✅ File truncation and size management
+- ✅ File deletion and unlinking
+- ✅ Atomic rename operations
+- ✅ File permission management
+
+#### Directory Operations
+- ✅ Directory creation and removal
+- ✅ Directory listing and traversal
+- ✅ Directory rename operations
+- ✅ Non-empty directory handling
+
+#### Symlink Operations
+- ✅ Symbolic link creation and resolution
+- ✅ Broken symlink handling
+- ✅ Symlink target verification
+- ✅ Symlink permission handling
+
+#### Permission Tests
+- ✅ File permission setting and verification
+- ✅ Directory permission enforcement
+- ✅ Permission inheritance
+- ✅ Access control validation
+
+#### Timestamp Tests
+- ✅ Access time (atime) updates
+- ✅ Modification time (mtime) tracking
+- ✅ Change time (ctime) management
+- ✅ Timestamp precision and setting
+
+#### I/O Operations
+- ✅ Read/write operations
+- ✅ File seeking and positioning
+- ✅ Append mode operations
+- ✅ Buffer management
+
+#### File Descriptors
+- ✅ File descriptor duplication
+- ✅ File descriptor flags
+- ✅ Close-on-exec handling
+- ✅ File descriptor limits
+
+#### Atomic Operations
+- ✅ Atomic file operations
+- ✅ Rename atomicity
+- ✅ Link/unlink atomicity
+
+#### Concurrent Access
+- ✅ Multi-reader scenarios
+- ✅ Concurrent write handling
+- ✅ Reader-writer coordination
+- ✅ Race condition prevention
+
+#### Error Handling
+- ✅ ENOENT (file not found) handling
+- ✅ EACCES (permission denied) handling
+- ✅ EBADF (bad file descriptor) handling
+- ✅ ENOTEMPTY (directory not empty) handling
+- ✅ Error code compliance
+
+### 2. Extended POSIX Features (`posix_extended_test.go`)
+
+#### Extended Attributes
+- ✅ Setting extended attributes (setxattr)
+- ✅ Getting extended attributes (getxattr)
+- ✅ Listing extended attributes (listxattr)
+- ✅ Removing extended attributes (removexattr)
+- ✅ Extended attribute namespaces
+
+#### File Locking
+- ✅ Advisory locking (fcntl)
+- ✅ Exclusive locks (F_WRLCK)
+- ✅ Shared locks (F_RDLCK)
+- ✅ Lock conflict detection
+- ✅ Lock release and cleanup
+
+#### Advanced I/O
+- ✅ Vectored I/O (readv/writev)
+- ✅ Positioned I/O (pread/pwrite)
+- ✅ Asynchronous I/O patterns
+- ✅ Scatter-gather operations
+
+#### Sparse Files
+- ✅ Sparse file creation
+- ✅ Hole detection and handling
+- ✅ Sparse file efficiency
+- ✅ Seek beyond EOF
+
+#### Large Files (>2GB)
+- ✅ Large file operations
+- ✅ 64-bit offset handling
+- ✅ Large file seeking
+- ✅ Large file truncation
+
+#### Memory Mapping
+- ✅ File memory mapping (mmap)
+- ✅ Memory-mapped I/O
+- ✅ Memory synchronization (msync)
+- ✅ Memory unmapping (munmap)
+- ✅ Shared/private mappings
+
+#### Direct I/O
+- ✅ Direct I/O operations (O_DIRECT)
+- ✅ Buffer alignment requirements
+- ✅ Direct I/O performance
+- ✅ Bypass buffer cache
+
+#### File Preallocation
+- ✅ Space preallocation (fallocate)
+- ✅ File hole punching
+- ✅ Space reservation
+- ✅ Allocation efficiency
+
+#### Zero-Copy Operations
+- ✅ Zero-copy file transfer (sendfile)
+- ✅ Efficient data movement
+- ✅ Cross-filesystem transfers
+
+### 3. External Test Suite Integration (`posix_external_test.go`)
+
+#### pjdfstest Integration
+- ✅ Comprehensive POSIX filesystem test suite
+- ✅ Industry-standard compliance verification
+- ✅ Automated test execution
+- ✅ Result analysis and reporting
+
+#### nfstest_posix Integration
+- ✅ POSIX API verification
+- ✅ Network filesystem compliance
+- ✅ API behavior validation
+- ✅ Comprehensive coverage
+
+#### Custom Litmus Tests
+- ✅ Atomic rename verification
+- ✅ Link count accuracy
+- ✅ Symlink cycle detection
+- ✅ Concurrent operation safety
+- ✅ Directory consistency
+
+#### Stress Testing
+- ✅ High-frequency operations
+- ✅ Concurrent access patterns
+- ✅ Resource exhaustion scenarios
+- ✅ Error recovery testing
+
+#### Edge Case Testing
+- ✅ Empty filenames
+- ✅ Very long filenames
+- ✅ Special characters
+- ✅ Deep directory nesting
+- ✅ Path length limits
+
+## 🚀 Quick Start
+
+### Prerequisites
+
+```bash
+# Install required tools
+sudo apt-get install fuse           # Linux
+brew install macfuse               # macOS
+
+# Install Go 1.21+
+go version
+
+# Build SeaweedFS
+cd /path/to/seaweedfs
+make
+```
+
+### Basic Usage
+
+```bash
+# Navigate to test directory
+cd test/fuse_integration
+
+# Check prerequisites
+make -f posix_Makefile check-prereqs
+
+# Run basic POSIX compliance tests
+make -f posix_Makefile test-posix-basic
+
+# Run complete test suite
+make -f posix_Makefile test-posix-full
+
+# Generate compliance report
+make -f posix_Makefile generate-report
+```
+
+## 🔧 Advanced Usage
+
+### Test Categories
+
+#### Critical Tests Only
+```bash
+# Run only critical POSIX compliance tests (faster)
+make -f posix_Makefile test-posix-critical
+```
+
+#### Extended Feature Tests
+```bash
+# Test advanced POSIX features
+make -f posix_Makefile test-posix-extended
+```
+
+#### External Tool Integration
+```bash
+# Setup and run external test suites
+make -f posix_Makefile setup-external-tools
+make -f posix_Makefile test-posix-external
+```
+
+#### Stress Testing
+```bash
+# Run stress tests for concurrent operations
+make -f posix_Makefile test-posix-stress
+```
+
+### Performance Analysis
+
+#### Benchmarking
+```bash
+# Run performance benchmarks
+make -f posix_Makefile benchmark-posix
+```
+
+#### Profiling
+```bash
+# Profile CPU and memory usage
+make -f posix_Makefile profile-posix
+
+# View CPU profile
+go tool pprof reports/posix.cpu.prof
+```
+
+#### Coverage Analysis
+```bash
+# Generate test coverage report
+make -f posix_Makefile coverage-posix
+# View: reports/posix_coverage.html
+```
+
+#### FIO Performance Testing
+```bash
+# Run FIO-based I/O performance tests
+make -f posix_Makefile test-fio-posix
+```
+
+### External Test Suites
+
+#### pjdfstest
+```bash
+# Setup and run pjdfstest
+make -f posix_Makefile setup-pjdfstest
+make -f posix_Makefile test-pjdfstest
+```
+
+#### nfstest_posix
+```bash
+# Install and run nfstest_posix
+make -f posix_Makefile setup-nfstest
+make -f posix_Makefile test-nfstest-posix
+```
+
+## 📊 Understanding Results
+
+### Test Status Indicators
+
+- ✅ **PASS**: Test completed successfully
+- ❌ **FAIL**: Test failed - indicates non-compliance
+- ⚠️ **SKIP**: Test skipped - feature not supported
+- 🔄 **RETRY**: Test retried due to transient failure
+
+### Report Formats
+
+#### HTML Report (`reports/posix_compliance_report.html`)
+- Interactive web-based report
+- Test category breakdown
+- Detailed results with navigation
+- Visual status indicators
+
+#### Text Summary (`reports/posix_compliance_summary.txt`)
+- Concise text-based summary
+- Key findings and recommendations
+- Command-line friendly format
+
+#### JSON Report (`reports/posix_compliance_report.json`)
+- Machine-readable results
+- Integration with CI/CD pipelines
+- Automated result processing
+
+### Log Files
+
+- `posix_basic_results.log`: Basic POSIX test detailed output
+- `posix_extended_results.log`: Extended feature test output
+- `posix_external_results.log`: External test suite output
+- `posix_benchmark_results.log`: Performance benchmark results
+
+## 🐛 Debugging Failed Tests
+
+### Common Issues
+
+#### Permission Denied Errors
+```bash
+# Ensure proper FUSE permissions
+sudo usermod -a -G fuse $USER
+# Re-login or run: newgrp fuse
+
+# Mount with -allowOthers if other users need access (test config MountOptions)
+```
+
+#### Extended Attributes Not Supported
+```bash
+# Check if xattr is supported by underlying filesystem
+getfattr --version
+# May need to skip xattr tests on certain filesystems
+```
+
+#### File Locking Issues
+```bash
+# Verify file locking support
+# Some network filesystems may not support full locking
+```
+
+#### Memory Issues
+```bash
+# Increase available memory for tests
+# Large file tests may require significant RAM
+```
+
+### Debug Mode
+
+```bash
+# Test targets already run go test -v and keep logs under reports/
+make -f posix_Makefile test-posix-basic
+
+# Run against an existing external mount instead of a fresh cluster
+make -f posix_Makefile test-posix-basic TEST_MOUNT_POINT=/path/to/mount
+
+# Extend the 45-minute per-suite timeout
+make -f posix_Makefile test-posix-full TEST_TIMEOUT=90m
+```
+
+### Manual Test Execution
+
+```bash
+# Run specific test
+cd test/fuse_integration
+go test -v -run 'TestPOSIXCompliance/FileOperations' .
+
+# Run with custom timeout
+go test -v -timeout 30m -run TestPOSIXExtended .
+```
+
+## 🔄 CI/CD Integration
+
+### GitHub Actions
+
+```yaml
+name: POSIX Compliance Tests
+
+on: [push, pull_request]
+
+jobs:
+  posix-compliance:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.21'
+    
+    - name: Install FUSE
+      run: sudo apt-get update && sudo apt-get install -y fuse
+    
+    - name: Build SeaweedFS
+      run: make
+    
+    - name: Run POSIX Compliance Tests
+      run: |
+        cd test/fuse_integration
+        make -f posix_Makefile ci-posix-tests
+    
+    - name: Upload Test Results
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: posix-test-results
+        path: test/fuse_integration/reports/
+```
+
+### Jenkins Pipeline
+
+```groovy
+pipeline {
+    agent any
+    stages {
+        stage('Setup') {
+            steps {
+                sh 'make'
+            }
+        }
+        stage('POSIX Compliance') {
+            steps {
+                dir('test/fuse_integration') {
+                    sh 'make -f posix_Makefile ci-posix-tests'
+                }
+            }
+            post {
+                always {
+                    archiveArtifacts 'test/fuse_integration/reports/**'
+                    publishHTML([
+                        allowMissing: false,
+                        alwaysLinkToLastBuild: true,
+                        keepAll: true,
+                        reportDir: 'test/fuse_integration/reports',
+                        reportFiles: 'posix_compliance_report.html',
+                        reportName: 'POSIX Compliance Report'
+                    ])
+                }
+            }
+        }
+    }
+}
+```
+
+## 🎯 POSIX Compliance Checklist
+
+### Critical POSIX Features
+- [ ] File creation, reading, writing, deletion
+- [ ] Directory operations (create, remove, list)
+- [ ] File permissions and ownership
+- [ ] Symbolic links
+- [ ] Hard links
+- [ ] File timestamps
+- [ ] Error handling compliance
+- [ ] Atomic operations
+
+### Advanced POSIX Features
+- [ ] Extended attributes
+- [ ] File locking (advisory)
+- [ ] Memory-mapped I/O
+- [ ] Vectored I/O (readv/writev)
+- [ ] Positioned I/O (pread/pwrite)
+- [ ] Direct I/O
+- [ ] File preallocation
+- [ ] Sparse files
+
+### Performance Requirements
+- [ ] Reasonable performance under load
+- [ ] Concurrent access handling
+- [ ] Memory usage optimization
+- [ ] CPU efficiency
+- [ ] I/O throughput
+
+### Reliability Requirements
+- [ ] Data consistency
+- [ ] Error recovery
+- [ ] Race condition prevention
+- [ ] Resource cleanup
+- [ ] Crash recovery
+
+## 📈 Performance Benchmarks
+
+### Expected Performance Characteristics
+
+| Operation | Expected Range | Notes |
+|-----------|----------------|-------|
+| File Create | 1000-10000 ops/sec | Depends on chunk size |
+| File Read | 100-1000 MB/sec | Network limited |
+| File Write | 50-500 MB/sec | Depends on replication |
+| Directory Ops | 500-5000 ops/sec | Metadata operations |
+| Concurrent Ops | Scales with cores | Up to hardware limits |
+
+### Benchmarking Commands
+
+```bash
+# Basic I/O performance
+make -f posix_Makefile benchmark-posix
+
+# FIO comprehensive testing
+make -f posix_Makefile test-fio-posix
+
+# Custom benchmark with specific parameters
+go test -v -bench=. -benchtime=30s posix_compliance_test.go
+```
+
+## 🔍 Troubleshooting
+
+### Common Test Failures
+
+#### 1. Mount Permission Issues
+```bash
+# Error: Permission denied mounting
+# Solution: Check FUSE permissions — add the user to the fuse group and
+# re-login rather than widening permissions on the device node
+sudo usermod -a -G fuse $USER
+```
+
+#### 2. Extended Attribute Tests Fail
+```bash
+# Error: Operation not supported (ENOTSUP)
+# Solution: Check filesystem xattr support
+mount | grep $(df . | tail -1 | awk '{print $1}')
+# May need to remount with xattr support
+```
+
+#### 3. File Locking Tests Fail
+```bash
+# Error: Function not implemented (ENOSYS)
+# Solution: Some network filesystems don't support locking
+# This may be expected behavior
+```
+
+#### 4. Large File Tests Fail
+```bash
+# Error: No space left on device
+# Solution: Ensure sufficient disk space
+df -h /tmp  # Check temp directory space
+# May need to clean up or use different temp directory
+```
+
+#### 5. Performance Tests Timeout
+```bash
+# Error: Test timeout exceeded
+# Solution: Increase timeout or reduce test scope
+go test -timeout 60m -run TestPOSIXCompliance
+```
+
+### Debug Information Collection
+
+```bash
+# Collect system information
+uname -a > debug_info.txt
+mount >> debug_info.txt
+df -h >> debug_info.txt
+free -h >> debug_info.txt
+
+# Collect SeaweedFS information
+./weed version >> debug_info.txt
+ps aux | grep weed >> debug_info.txt
+
+# Collect test logs
+cp reports/*.log debug_logs/
+```
+
+## 📚 Additional Resources
+
+### POSIX Standards
+- [POSIX.1-2017 (IEEE Std 1003.1-2017)](https://pubs.opengroup.org/onlinepubs/9699919799/)
+- [Single UNIX Specification](https://www.opengroup.org/openbrand/register/)
+
+### External Test Suites
+- [pjdfstest](https://github.com/pjd/pjdfstest) - Comprehensive POSIX filesystem tests
+- [nfstest](https://nfstest.readthedocs.io/) - Network filesystem testing
+- [FIO](https://fio.readthedocs.io/) - Flexible I/O tester
+
+### SeaweedFS Documentation
+- [SeaweedFS Wiki](https://github.com/seaweedfs/seaweedfs/wiki)
+- [FUSE Mount Documentation](https://github.com/seaweedfs/seaweedfs/wiki/FUSE-Mount)
+- [Performance Tuning Guide](https://github.com/seaweedfs/seaweedfs/wiki/Optimization)
+
+## 🤝 Contributing
+
+### Adding New Tests
+
+1. **Basic Tests**: Add to `posix_compliance_test.go`
+2. **Extended Tests**: Add to `posix_extended_test.go`
+3. **External Integration**: Add to `posix_external_test.go`
+
+### Test Guidelines
+
+```go
+func (s *POSIXTestSuite) TestNewFeature(t *testing.T) {
+    mountPoint := s.framework.GetMountPoint()
+    
+    t.Run("SubTestName", func(t *testing.T) {
+        // Test setup
+        testFile := filepath.Join(mountPoint, "test.txt")
+        
+        // Test execution
+        err := someOperation(testFile)
+        
+        // Assertions
+        require.NoError(t, err)
+        
+        // Cleanup (if needed)
+        defer os.Remove(testFile)
+    })
+}
+```
+
+### Submitting Improvements
+
+1. Fork the repository
+2. Create a feature branch
+3. Add comprehensive tests
+4. Ensure all existing tests pass
+5. Submit a pull request with detailed description
+
+## 📞 Support
+
+For questions, issues, or contributions:
+
+- **GitHub Issues**: [SeaweedFS Issues](https://github.com/seaweedfs/seaweedfs/issues)
+- **Discussions**: [SeaweedFS Discussions](https://github.com/seaweedfs/seaweedfs/discussions)
+- **Documentation**: [SeaweedFS Wiki](https://github.com/seaweedfs/seaweedfs/wiki)
+
+---
+
+*This comprehensive POSIX compliance test suite ensures SeaweedFS FUSE mounts meet industry standards for filesystem behavior, performance, and reliability.*
diff --git a/test/fuse_integration/POSIX_IMPLEMENTATION_ROADMAP.md b/test/fuse_integration/POSIX_IMPLEMENTATION_ROADMAP.md
new file mode 100644
index 0000000000..5ac9939e72
--- /dev/null
+++ b/test/fuse_integration/POSIX_IMPLEMENTATION_ROADMAP.md
@@ -0,0 +1,272 @@
+# POSIX Compliance Implementation Roadmap
+
+This document tracks the implementation status of POSIX features in the SeaweedFS FUSE mount compliance test suite and provides a roadmap for completing comprehensive POSIX compliance testing.
+
+## Overview
+
+The platform-specific tests listed below are implemented; this document records the implementation plan that produced them, plus the one feature still pending.
+
+## Current Status
+
+### ✅ Implemented Features
+- Basic file operations (create, read, write, delete)
+- Directory operations (mkdir, rmdir, rename)
+- File permissions and ownership
+- Symbolic and hard links
+- Basic I/O operations (seek, append, positioned I/O)
+- File descriptors and atomic operations
+- Concurrent access patterns
+- Error handling compliance
+- Timestamp operations
+
+### 🚧 Partially Implemented
+- Cross-platform compatibility (basic implementation with platform-specific access time handling)
+- File sealing (still skipped; Linux-specific, pending)
+
+### ✅ Implemented Platform-Specific Features
+
+#### 1. Extended Attributes (xattr)
+**Priority: High**
+**Platforms: Linux, macOS, FreeBSD**
+
+**Status:** Implemented
+- `TestExtendedAttributes/SetExtendedAttribute`
+- `TestExtendedAttributes/ListExtendedAttributes` 
+- `TestExtendedAttributes/RemoveExtendedAttribute`
+
+**Implementation Plan:**
+```go
+// Linux implementation
+//go:build linux
+func setXattr(path, name string, value []byte) error {
+    return syscall.Setxattr(path, name, value, 0)
+}
+
+// macOS implementation  
+//go:build darwin
+func setXattr(path, name string, value []byte) error {
+    return syscall.Setxattr(path, name, value, 0, 0)
+}
+```
+
+**Required Files:**
+- `xattr_linux.go` - Linux syscall implementations
+- `xattr_darwin.go` - macOS syscall implementations  
+- `xattr_freebsd.go` - FreeBSD syscall implementations
+- `xattr_unsupported.go` - Fallback for unsupported platforms
+
+#### 2. Memory Mapping (mmap)
+**Priority: High**
+**Platforms: All POSIX systems**
+
+**Status:** Implemented
+- `TestMemoryMapping/MemoryMappedRead`
+- `TestMemoryMapping/MemoryMappedWrite`
+
+**Implementation Plan:**
+```go
+func testMmap(t *testing.T, filePath string) {
+    fd, err := syscall.Open(filePath, syscall.O_RDWR, 0)
+    require.NoError(t, err)
+    defer syscall.Close(fd)
+    
+    // Platform-specific mmap implementation
+    data, err := syscall.Mmap(fd, 0, size, syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_SHARED)
+    require.NoError(t, err)
+    defer syscall.Munmap(data)
+}
+```
+
+**Required Files:**
+- `mmap_unix.go` - Unix-like systems implementation
+- `mmap_windows.go` - Windows implementation (if needed)
+
+#### 3. Vectored I/O (readv/writev)
+**Priority: Medium**
+**Platforms: All POSIX systems**
+
+**Status:** Implemented
+- `TestAdvancedIO/VectoredIO`
+
+**Implementation Plan:**
+```go
+func testVectoredIO(t *testing.T, filePath string) {
+    // Use syscall.Syscall for readv/writev
+    // Linux: SYS_READV, SYS_WRITEV
+    // Other platforms: platform-specific syscall numbers
+}
+```
+
+#### 4. Direct I/O
+**Priority: Medium**  
+**Platforms: Linux, some Unix variants**
+
+**Status:** Implemented
+- `TestDirectIO/DirectIO`
+
+**Implementation Plan:**
+```go
+//go:build linux
+func testDirectIO(t *testing.T, filePath string) {
+    fd, err := syscall.Open(filePath, syscall.O_RDWR|syscall.O_DIRECT, 0)
+    // Test with aligned buffers
+}
+```
+
+#### 5. File Preallocation (fallocate)
+**Priority: Medium**
+**Platforms: Linux, some Unix variants**
+
+**Status:** Implemented
+- `TestFilePreallocation/Fallocate`
+
+**Implementation Plan:**
+```go
+//go:build linux
+func testFallocate(t *testing.T, filePath string) {
+    fd, err := syscall.Open(filePath, syscall.O_RDWR, 0)
+    err = syscall.Syscall6(syscall.SYS_FALLOCATE, uintptr(fd), 0, 0, uintptr(size), 0, 0)
+}
+```
+
+#### 6. Zero-Copy Transfer (sendfile)
+**Priority: Low**
+**Platforms: Linux, FreeBSD, some Unix variants**
+
+**Status:** Implemented
+- `TestZeroCopyTransfer/Sendfile`
+
+**Implementation Plan:**
+```go
+//go:build linux
+func testSendfile(t *testing.T, srcPath, dstPath string) {
+    // Use syscall.Syscall for sendfile
+    // Platform-specific implementations
+}
+```
+
+#### 7. File Sealing (Linux-specific)
+**Priority: Low**
+**Platforms: Linux only**
+
+**Current Status:** File sealing test is still skipped
+- `TestFileSealing`
+
+**Implementation Plan:**
+```go
+//go:build linux
+func testFileSealing(t *testing.T) {
+    // Use fcntl with F_ADD_SEALS, F_GET_SEALS
+    // Test various seal types: F_SEAL_WRITE, F_SEAL_SHRINK, etc.
+}
+```
+
+## Implementation Strategy
+
+### Phase 1: Core Features (High Priority)
+1. **Extended Attributes** - Essential for many applications
+2. **Memory Mapping** - Critical for performance-sensitive applications
+
+### Phase 2: Advanced I/O (Medium Priority)  
+3. **Vectored I/O** - Important for efficient bulk operations
+4. **Direct I/O** - Needed for database and high-performance applications
+5. **File Preallocation** - Important for preventing fragmentation
+
+### Phase 3: Specialized Features (Low Priority)
+6. **Zero-Copy Transfer** - Performance optimization feature
+7. **File Sealing** - Security feature, Linux-specific
+
+## Platform Support Matrix
+
+| Feature | Linux | macOS | FreeBSD | Windows | Notes |
+|---------|-------|-------|---------|---------|-------|
+| Extended Attributes | ✅ | ✅ | ✅ | ❌ | Different syscall signatures |
+| Memory Mapping | ✅ | ✅ | ✅ | ✅ | Standard POSIX |
+| Vectored I/O | ✅ | ✅ | ✅ | ❌ | readv/writev syscalls |
+| Direct I/O | ✅ | ❌ | ✅ | ❌ | O_DIRECT flag |
+| fallocate | ✅ | ❌ | ❌ | ❌ | Linux-specific |
+| sendfile | ✅ | ❌ | ✅ | ❌ | Platform-specific |
+| File Sealing | ✅ | ❌ | ❌ | ❌ | Linux-only |
+
+## Development Guidelines
+
+### 1. Platform-Specific Implementation Pattern
+```go
+// feature_linux.go
+//go:build linux
+package fuse
+func platformSpecificFunction() { /* Linux implementation */ }
+
+// feature_darwin.go  
+//go:build darwin
+package fuse
+func platformSpecificFunction() { /* macOS implementation */ }
+
+// feature_unsupported.go
+//go:build !linux && !darwin
+package fuse
+func platformSpecificFunction() { /* Skip or error */ }
+```
+
+### 2. Test Structure Pattern
+```go
+func (s *POSIXExtendedTestSuite) TestFeature(t *testing.T) {
+    if !isFeatureSupported() {
+        t.Skip("Feature not supported on this platform")
+        return
+    }
+    
+    t.Run("FeatureTest", func(t *testing.T) {
+        // Actual test implementation
+    })
+}
+```
+
+### 3. Error Handling
+- Use platform-specific error checking
+- Provide meaningful error messages
+- Gracefully handle unsupported features
+
+## Testing Strategy
+
+### 1. Continuous Integration
+- Run tests on multiple platforms (Linux, macOS)
+- Use build tags to enable/disable platform-specific tests
+- Ensure graceful degradation on unsupported platforms
+
+### 2. Feature Detection
+- Implement runtime feature detection where possible
+- Skip tests gracefully when features are unavailable
+- Log clear messages about skipped functionality
+
+### 3. Documentation
+- Document platform-specific behavior
+- Provide examples for each implemented feature
+- Maintain compatibility matrices
+
+## Contributing
+
+When implementing these features:
+
+1. **Start with high-priority items** (Extended Attributes, Memory Mapping)
+2. **Follow the platform-specific pattern** outlined above
+3. **Add comprehensive tests** for each feature
+4. **Update this roadmap** as features are implemented
+5. **Document any platform-specific quirks** or limitations
+
+## Future Enhancements
+
+Beyond the current roadmap, consider:
+- **File locking** (flock, fcntl locks)
+- **Asynchronous I/O** (aio_read, aio_write)
+- **File change notifications** (inotify, kqueue)
+- **POSIX ACLs** (Access Control Lists)
+- **Sparse file operations**
+- **File hole punching**
+
+## References
+
+- [POSIX.1-2017 Standard](https://pubs.opengroup.org/onlinepubs/9699919799/)
+- [Linux Programmer's Manual](https://man7.org/linux/man-pages/)
+- [FreeBSD System Calls](https://www.freebsd.org/cgi/man.cgi)
+- [macOS System Calls](https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/)
diff --git a/test/fuse_integration/README.md b/test/fuse_integration/README.md
index 8c0387806a..3cae4b3883 100644
--- a/test/fuse_integration/README.md
+++ b/test/fuse_integration/README.md
@@ -216,7 +216,7 @@ jobs:
     - uses: actions/checkout@v3
     - uses: actions/setup-go@v3
       with:
-        go-version: '1.24'
+        go-version: '1.26'
     
     - name: Install FUSE
       run: sudo apt-get install -y fuse
@@ -232,7 +232,7 @@ jobs:
 
 ### Docker Testing
 ```dockerfile
-FROM golang:1.24
+FROM golang:1.26
 RUN apt-get update && apt-get install -y fuse
 COPY . /seaweedfs
 WORKDIR /seaweedfs
diff --git a/test/fuse_integration/atime_linux.go b/test/fuse_integration/atime_linux.go
new file mode 100644
index 0000000000..9d8e9579ae
--- /dev/null
+++ b/test/fuse_integration/atime_linux.go
@@ -0,0 +1,12 @@
+//go:build linux
+
+package fuse
+
+import (
+	"syscall"
+)
+
+// getAtimeNano returns the access time in nanoseconds for Linux systems
+func getAtimeNano(stat *syscall.Stat_t) int64 {
+	return stat.Atim.Sec*1e9 + stat.Atim.Nsec
+}
diff --git a/test/fuse_integration/atime_nonlinux.go b/test/fuse_integration/atime_nonlinux.go
new file mode 100644
index 0000000000..c3b7cda16a
--- /dev/null
+++ b/test/fuse_integration/atime_nonlinux.go
@@ -0,0 +1,12 @@
+//go:build !linux && !windows
+
+package fuse
+
+import (
+	"syscall"
+)
+
+// getAtimeNano returns the access time in nanoseconds for non-Linux systems (macOS, BSD, etc.)
+func getAtimeNano(stat *syscall.Stat_t) int64 {
+	return stat.Atimespec.Sec*1e9 + stat.Atimespec.Nsec
+}
diff --git a/test/fuse_integration/atime_windows.go b/test/fuse_integration/atime_windows.go
new file mode 100644
index 0000000000..4b8a7d9c6d
--- /dev/null
+++ b/test/fuse_integration/atime_windows.go
@@ -0,0 +1,12 @@
+//go:build windows
+
+package fuse
+
+import (
+	"syscall"
+)
+
+// getAtimeNano returns the access time in nanoseconds for Windows systems
+func getAtimeNano(stat *syscall.Win32FileAttributeData) int64 {
+	return stat.LastAccessTime.Nanoseconds()
+}
diff --git a/test/fuse_integration/directio_darwin.go b/test/fuse_integration/directio_darwin.go
new file mode 100644
index 0000000000..67ccaf9a03
--- /dev/null
+++ b/test/fuse_integration/directio_darwin.go
@@ -0,0 +1,39 @@
+//go:build darwin
+
+package fuse
+
+import (
+	"syscall"
+)
+
+// Direct I/O support for macOS
+
+const (
+	// macOS doesn't have O_DIRECT, but we can use fcntl with F_NOCACHE
+	F_NOCACHE = 48
+)
+
+func openDirectIO(path string, flags int, mode uint32) (int, error) {
+	// Open file normally first
+	fd, err := syscall.Open(path, flags, mode)
+	if err != nil {
+		return -1, err
+	}
+
+	// Set F_NOCACHE to bypass buffer cache (similar to O_DIRECT)
+	_, _, errno := syscall.Syscall(syscall.SYS_FCNTL,
+		uintptr(fd),
+		F_NOCACHE,
+		1) // enable
+
+	if errno != 0 {
+		syscall.Close(fd)
+		return -1, errno
+	}
+
+	return fd, nil
+}
+
+func isDirectIOSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/directio_linux.go b/test/fuse_integration/directio_linux.go
new file mode 100644
index 0000000000..1ade7474f5
--- /dev/null
+++ b/test/fuse_integration/directio_linux.go
@@ -0,0 +1,23 @@
+//go:build linux
+
+package fuse
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// Direct I/O support for Linux
+
+const (
+	O_DIRECT = unix.O_DIRECT
+)
+
+func openDirectIO(path string, flags int, mode uint32) (int, error) {
+	return syscall.Open(path, flags|O_DIRECT, mode)
+}
+
+func isDirectIOSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/directio_unsupported.go b/test/fuse_integration/directio_unsupported.go
new file mode 100644
index 0000000000..dc1168b1cc
--- /dev/null
+++ b/test/fuse_integration/directio_unsupported.go
@@ -0,0 +1,29 @@
+//go:build !linux && !darwin
+
+package fuse
+
+import (
+	"errors"
+	"syscall"
+)
+
+// Direct I/O support for unsupported platforms
+
+var ErrDirectIONotSupported = errors.New("direct I/O not supported on this platform")
+
+const (
+	O_DIRECT = 0x4000 // Dummy flag for compatibility
+)
+
+func openDirectIO(path string, flags int, mode uint32) (int, error) {
+	// Fall back to regular open
+	fd, err := syscall.Open(path, flags, mode)
+	if err != nil {
+		return -1, err
+	}
+	return int(fd), nil
+}
+
+func isDirectIOSupported() bool {
+	return false
+}
diff --git a/test/fuse_integration/fallocate_darwin.go b/test/fuse_integration/fallocate_darwin.go
new file mode 100644
index 0000000000..fa67f3f7a3
--- /dev/null
+++ b/test/fuse_integration/fallocate_darwin.go
@@ -0,0 +1,79 @@
+//go:build darwin
+
+package fuse
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// File allocation support for macOS using fcntl
+
+const (
+	// macOS doesn't have fallocate, but we can use fcntl with F_PREALLOCATE
+	F_ALLOCATECONTIG = 0x02
+	F_ALLOCATEALL    = 0x04
+
+	// Dummy flags for compatibility
+	FALLOC_FL_KEEP_SIZE      = 0x01
+	FALLOC_FL_PUNCH_HOLE     = 0x02
+	FALLOC_FL_NO_HIDE_STALE  = 0x04
+	FALLOC_FL_COLLAPSE_RANGE = 0x08
+	FALLOC_FL_ZERO_RANGE     = 0x10
+	FALLOC_FL_INSERT_RANGE   = 0x20
+	FALLOC_FL_UNSHARE_RANGE  = 0x40
+)
+
+// fstore_t structure for F_PREALLOCATE
+type fstore struct {
+	flags      uint32
+	posmode    int16
+	offset     int64
+	length     int64
+	bytesalloc int64
+}
+
+func fallocateFile(fd int, mode int, offset int64, length int64) error {
+	// Check for unsupported modes on macOS
+	unsupportedModes := FALLOC_FL_PUNCH_HOLE | FALLOC_FL_NO_HIDE_STALE | FALLOC_FL_COLLAPSE_RANGE | FALLOC_FL_ZERO_RANGE | FALLOC_FL_INSERT_RANGE | FALLOC_FL_UNSHARE_RANGE
+	if mode&unsupportedModes != 0 {
+		return syscall.ENOTSUP // Operation not supported
+	}
+
+	// On macOS, we use fcntl with F_PREALLOCATE
+	store := fstore{
+		flags:   F_ALLOCATECONTIG,
+		posmode: syscall.F_PEOFPOSMODE, // Allocate from EOF
+		offset:  0,
+		length:  length,
+	}
+
+	_, _, errno := syscall.Syscall(syscall.SYS_FCNTL,
+		uintptr(fd),
+		syscall.F_PREALLOCATE,
+		uintptr(unsafe.Pointer(&store)))
+
+	if errno != 0 {
+		// If contiguous allocation fails, try non-contiguous
+		store.flags = F_ALLOCATEALL
+		_, _, errno = syscall.Syscall(syscall.SYS_FCNTL,
+			uintptr(fd),
+			syscall.F_PREALLOCATE,
+			uintptr(unsafe.Pointer(&store)))
+
+		if errno != 0 {
+			return errno
+		}
+	}
+
+	// Set file size if not keeping size
+	if mode&FALLOC_FL_KEEP_SIZE == 0 {
+		return syscall.Ftruncate(fd, offset+length)
+	}
+
+	return nil
+}
+
+func isFallocateSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/fallocate_linux.go b/test/fuse_integration/fallocate_linux.go
new file mode 100644
index 0000000000..7b1feaa4e6
--- /dev/null
+++ b/test/fuse_integration/fallocate_linux.go
@@ -0,0 +1,38 @@
+//go:build linux
+
+package fuse
+
+import (
+	"syscall"
+)
+
+// File allocation support for Linux
+
+const (
+	// Fallocate flags
+	FALLOC_FL_KEEP_SIZE      = 0x01
+	FALLOC_FL_PUNCH_HOLE     = 0x02
+	FALLOC_FL_NO_HIDE_STALE  = 0x04
+	FALLOC_FL_COLLAPSE_RANGE = 0x08
+	FALLOC_FL_ZERO_RANGE     = 0x10
+	FALLOC_FL_INSERT_RANGE   = 0x20
+	FALLOC_FL_UNSHARE_RANGE  = 0x40
+)
+
+func fallocateFile(fd int, mode int, offset int64, length int64) error {
+	_, _, errno := syscall.Syscall6(syscall.SYS_FALLOCATE,
+		uintptr(fd),
+		uintptr(mode),
+		uintptr(offset),
+		uintptr(length),
+		0, 0)
+
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func isFallocateSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/fallocate_unsupported.go b/test/fuse_integration/fallocate_unsupported.go
new file mode 100644
index 0000000000..8be54785d0
--- /dev/null
+++ b/test/fuse_integration/fallocate_unsupported.go
@@ -0,0 +1,30 @@
+//go:build !linux && !darwin
+
+package fuse
+
+import (
+	"errors"
+)
+
+// File allocation support for unsupported platforms
+
+var ErrFallocateNotSupported = errors.New("fallocate not supported on this platform")
+
+const (
+	// Dummy flags for compatibility
+	FALLOC_FL_KEEP_SIZE      = 0x01
+	FALLOC_FL_PUNCH_HOLE     = 0x02
+	FALLOC_FL_NO_HIDE_STALE  = 0x04
+	FALLOC_FL_COLLAPSE_RANGE = 0x08
+	FALLOC_FL_ZERO_RANGE     = 0x10
+	FALLOC_FL_INSERT_RANGE   = 0x20
+	FALLOC_FL_UNSHARE_RANGE  = 0x40
+)
+
+func fallocateFile(fd int, mode int, offset int64, length int64) error {
+	return ErrFallocateNotSupported
+}
+
+func isFallocateSupported() bool {
+	return false
+}
diff --git a/test/fuse_integration/framework.go b/test/fuse_integration/framework.go
new file mode 100644
index 0000000000..9fe62fcd71
--- /dev/null
+++ b/test/fuse_integration/framework.go
@@ -0,0 +1,695 @@
+package fuse
+
+import (
+	"fmt"
+	"io/fs"
+	"net"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// FuseTestFramework provides utilities for FUSE integration testing.
+// It starts a single "weed mini" process (master+volume+filer in one)
+// and a separate "weed mount" process for the FUSE filesystem.
+type FuseTestFramework struct {
+	t             *testing.T
+	tempDir       string
+	mountPoint    string
+	dataDir       string
+	logDir        string
+	miniProcess   *managedProcess
+	mountProcess  *managedProcess
+	filerAddr     string
+	filerPort     int
+	weedBinary    string
+	isSetup       bool
+	config        *TestConfig
+	externalMount bool
+}
+
+// TestConfig holds configuration for FUSE tests
+type TestConfig struct {
+	Collection  string
+	Replication string
+	ChunkSizeMB int
+	CacheSizeMB int
+	NumVolumes  int
+	EnableDebug bool
+	// MountGlobalOptions are glog flags (-v, -logtostderr, ...) registered on
+	// weed's global flagset; they must precede the subcommand name or the
+	// mount process dies at flag parsing.
+	MountGlobalOptions []string
+	MountOptions       []string
+	SkipCleanup        bool // for debugging failed tests
+}
+
+// DefaultTestConfig returns a default configuration for FUSE tests
+func DefaultTestConfig() *TestConfig {
+	return &TestConfig{
+		Collection:   "",
+		Replication:  "000",
+		ChunkSizeMB:  4,
+		CacheSizeMB:  100,
+		NumVolumes:   3,
+		EnableDebug:  false,
+		MountOptions: []string{},
+		SkipCleanup:  false,
+	}
+}
+
+// NewFuseTestFramework creates a new FUSE testing framework.
+func NewFuseTestFramework(t *testing.T, config *TestConfig) *FuseTestFramework {
+	if config == nil {
+		config = DefaultTestConfig()
+	}
+
+	tempDir, err := os.MkdirTemp("", "seaweedfs_fuse_test_")
+	require.NoError(t, err)
+
+	filerPort := freePort(t)
+
+	return &FuseTestFramework{
+		t:          t,
+		tempDir:    tempDir,
+		mountPoint: filepath.Join(tempDir, "mount"),
+		dataDir:    filepath.Join(tempDir, "data"),
+		logDir:     filepath.Join(tempDir, "logs"),
+		filerPort:  filerPort,
+		filerAddr:  fmt.Sprintf("127.0.0.1:%d", filerPort),
+		weedBinary: findWeedBinary(),
+		isSetup:    false,
+		config:     config,
+	}
+}
+
+// grpcPortOffset mirrors weed's HTTP->gRPC port convention (gRPC = HTTP + offset);
+// "weed mount" derives the filer gRPC port from the filer HTTP address the same way.
+const grpcPortOffset = 10000
+
+// freePort returns a free filer HTTP port whose gRPC sibling (port+grpcPortOffset)
+// is also free. Both must stay below the Linux ephemeral floor (32768): a gRPC port
+// above it can be transiently grabbed by an outbound connection, forcing mini to
+// relocate its filer gRPC port while "weed mount" keeps dialing HTTP+10000 — the
+// mount then never connects and the test times out. Capping HTTP at 22000 keeps the
+// gRPC port at or below 32000.
+func freePort(t *testing.T) int {
+	t.Helper()
+	const (
+		minServicePort = 20000
+		maxServicePort = 22000
+	)
+
+	portCount := maxServicePort - minServicePort + 1
+	start := minServicePort + int(time.Now().UnixNano()%int64(portCount))
+
+	for attempt := 0; attempt < portCount; attempt++ {
+		port := minServicePort + (start-minServicePort+attempt)%portCount
+		if portIsFree(port) && portIsFree(port+grpcPortOffset) {
+			return port
+		}
+	}
+
+	t.Fatalf("failed to allocate a free HTTP/gRPC port pair in [%d,%d]", minServicePort, maxServicePort)
+	return 0
+}
+
+// portIsFree reports whether a TCP port can currently be bound on 127.0.0.1.
+func portIsFree(port int) bool {
+	l, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
+	if err != nil {
+		return false
+	}
+	l.Close()
+	return true
+}
+
+// Setup starts SeaweedFS cluster and mounts FUSE filesystem
+func (f *FuseTestFramework) Setup(config *TestConfig) error {
+	if f.isSetup {
+		return fmt.Errorf("framework already setup")
+	}
+	if config != nil {
+		f.config = config
+	}
+	config = f.config
+
+	// Check if we should skip cluster setup and use existing mount
+	if os.Getenv("TEST_SKIP_CLUSTER_SETUP") == "true" {
+		// Use existing mount point from environment
+		if existingMount := os.Getenv("TEST_MOUNT_POINT"); existingMount != "" {
+			f.externalMount = true
+
+			// Verify mount point is accessible
+			if _, err := os.Stat(existingMount); err != nil {
+				return fmt.Errorf("existing mount point not accessible: %v", err)
+			}
+
+			// A plain directory passes every check below; refuse to run the suite
+			// against the local disk
+			if !mountedAt(existingMount) {
+				return fmt.Errorf("mount point %s is not a mounted filesystem", existingMount)
+			}
+			// So can a non-FUSE mount like tmpfs: a device boundary alone does
+			// not make the results FUSE compliance
+			if !fuseFilesystem(existingMount) {
+				return fmt.Errorf("mount point %s is not a FUSE filesystem", existingMount)
+			}
+
+			// Run inside a private work dir so test files do not pile up in
+			// the shared mount root and cleanup can remove only what it made
+			workDir, err := os.MkdirTemp(existingMount, ".fuse_test_")
+			if err != nil {
+				return fmt.Errorf("creating work dir under existing mount: %v", err)
+			}
+			f.mountPoint = workDir
+			f.t.Logf("Using existing mount point: %s (work dir %s)", existingMount, f.mountPoint)
+
+			// Test basic functionality
+			testFile := filepath.Join(f.mountPoint, ".framework_test")
+			if err := os.WriteFile(testFile, []byte("test"), 0644); err != nil {
+				return fmt.Errorf("mount point not writable: %v", err)
+			}
+			if err := os.Remove(testFile); err != nil {
+				f.t.Logf("Warning: failed to cleanup test file: %v", err)
+			}
+
+			// Verify this is actually a SeaweedFS mount by checking for SeaweedFS-specific behavior
+			// Create a test file and verify it appears in the filer
+			verifyFile := filepath.Join(f.mountPoint, ".seaweedfs_mount_verification")
+			if err := os.WriteFile(verifyFile, []byte("SeaweedFS mount verification"), 0644); err != nil {
+				return fmt.Errorf("mount point verification failed - cannot write: %v", err)
+			}
+
+			// Read it back to ensure it's working
+			if data, err := os.ReadFile(verifyFile); err != nil {
+				return fmt.Errorf("mount point verification failed - cannot read: %v", err)
+			} else if string(data) != "SeaweedFS mount verification" {
+				return fmt.Errorf("mount point verification failed - data mismatch")
+			}
+
+			// Clean up verification file
+			if err := os.Remove(verifyFile); err != nil {
+				f.t.Logf("Warning: failed to cleanup verification file: %v", err)
+			}
+
+			f.t.Logf("✅ SeaweedFS mount point verified and working: %s", f.mountPoint)
+
+			f.isSetup = true
+			return nil
+		}
+	}
+
+	// Create directories for full cluster setup
+	dirs := []string{f.mountPoint, f.logDir, f.dataDir}
+	for _, dir := range dirs {
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			return fmt.Errorf("failed to create directory %s: %v", dir, err)
+		}
+	}
+
+	// Start weed mini (master + volume + filer in one process)
+	if err := f.startMini(config); err != nil {
+		return fmt.Errorf("failed to start weed mini: %v", err)
+	}
+
+	// Wait for filer to be ready (mini starts all services on filerPort)
+	if err := f.waitForService(f.miniProcess, f.filerAddr, 30*time.Second); err != nil {
+		f.dumpLog("mini")
+		return fmt.Errorf("weed mini not ready: %v", err)
+	}
+
+	// Skip rather than fail on a host with no FUSE device to mount through
+	if !fuseAvailable() {
+		f.t.Skip("no FUSE device node (/dev/fuse, /dev/macfuse0, /dev/osxfuse0)")
+	}
+
+	// Mount FUSE filesystem
+	if err := f.mountFuse(config); err != nil {
+		return fmt.Errorf("failed to mount FUSE: %v", err)
+	}
+
+	// Wait for mount to be ready
+	if err := f.waitForMount(30 * time.Second); err != nil {
+		f.dumpLog("mount")
+		return fmt.Errorf("FUSE mount not ready: %v", err)
+	}
+
+	// A mounted filesystem still cannot write until a volume registers and a
+	// grow round finishes, so gate on a real write instead of letting the
+	// first test hits ride out the startup window as EIO on close.
+	if err := f.waitForWritable(90 * time.Second); err != nil {
+		f.dumpLog("mount")
+		return fmt.Errorf("FUSE mount not writable: %v", err)
+	}
+
+	f.isSetup = true
+	return nil
+}
+
+// Cleanup stops all processes and removes temporary files.
+// If the test failed, it dumps logs automatically.
+func (f *FuseTestFramework) Cleanup() {
+	// An external mount needs no teardown; only this run's work dir is ours.
+	// A TEST_SKIP_CLUSTER_SETUP that fell through to a self-started cluster
+	// still owns its processes and must not skip stopping them.
+	if f.externalMount {
+		if !f.config.SkipCleanup {
+			os.RemoveAll(f.mountPoint)
+			os.RemoveAll(f.tempDir)
+		}
+		return
+	}
+
+	if f.t.Failed() {
+		f.DumpLogs()
+	}
+
+	// Stop processes in reverse order
+	f.unmountFuse()
+	if f.miniProcess != nil {
+		f.miniProcess.stop()
+		f.miniProcess = nil
+	}
+
+	f.copyLogsForCI()
+
+	// Remove temp directory
+	if !f.config.SkipCleanup {
+		os.RemoveAll(f.tempDir)
+	}
+}
+
+// DumpLogs prints the tail of all SeaweedFS process logs to test output.
+func (f *FuseTestFramework) DumpLogs() {
+	for _, name := range []string{"mini", "mount"} {
+		f.dumpLog(name)
+	}
+}
+
+// GetMountPoint returns the FUSE mount point path
+func (f *FuseTestFramework) GetMountPoint() string {
+	return f.mountPoint
+}
+
+// GetFilerAddr returns the filer address
+func (f *FuseTestFramework) GetFilerAddr() string {
+	return f.filerAddr
+}
+
+// managedProcess is a started weed sub-command whose exit is watched, so a wait
+// for it to come up ends the moment it dies instead of burning its full timeout.
+type managedProcess struct {
+	cmd     *exec.Cmd
+	done    chan struct{}
+	err     error // exit error, read only after done is closed
+	logPath string
+}
+
+// exited returns the exit error once the process is gone, nil while it runs.
+func (p *managedProcess) exited() error {
+	select {
+	case <-p.done:
+		if p.err != nil {
+			return p.err
+		}
+		return fmt.Errorf("exit status 0")
+	default:
+		return nil
+	}
+}
+
+// stop asks the process to terminate and waits for it to go away.
+func (p *managedProcess) stop() {
+	// Signal fails with os.ErrProcessDone when the child is already gone, which
+	// is exactly the case the select below handles.
+	_ = p.cmd.Process.Signal(syscall.SIGTERM)
+	select {
+	case <-p.done:
+	case <-time.After(10 * time.Second):
+		p.cmd.Process.Kill()
+		<-p.done
+	}
+}
+
+// startProcess is a helper that starts a weed sub-command with output captured
+// to a log file in f.logDir.
+func (f *FuseTestFramework) startProcess(name string, args []string) (*managedProcess, error) {
+	logPath := filepath.Join(f.logDir, name+".log")
+	logFile, err := os.Create(logPath)
+	if err != nil {
+		return nil, fmt.Errorf("create log file: %v", err)
+	}
+	cmd := exec.Command(f.weedBinary, args...)
+	cmd.Dir = f.tempDir
+	cmd.Stdout = logFile
+	cmd.Stderr = logFile
+	if err := cmd.Start(); err != nil {
+		logFile.Close()
+		return nil, err
+	}
+	// Close the file handle — the child process inherited it.
+	logFile.Close()
+
+	p := &managedProcess{cmd: cmd, done: make(chan struct{}), logPath: logPath}
+	go func() {
+		p.err = cmd.Wait()
+		close(p.done)
+	}()
+	return p, nil
+}
+
+// logTail returns the last bytes of a captured process log so a startup
+// failure message carries the fatal line instead of a bare timeout.
+func logTail(path string) string {
+	data, err := os.ReadFile(path)
+	if err != nil || len(data) == 0 {
+		return ""
+	}
+	const maxTail = 2 * 1024
+	if len(data) > maxTail {
+		data = data[len(data)-maxTail:]
+	}
+	return string(data)
+}
+
+// dumpLog prints the last lines of a process log file to the test output
+// for debugging when a service fails to start or a test fails.
+func (f *FuseTestFramework) dumpLog(name string) {
+	data, err := os.ReadFile(filepath.Join(f.logDir, name+".log"))
+	if err != nil {
+		f.t.Logf("[%s log] (not available: %v)", name, err)
+		return
+	}
+	// Show last 16KB on failure for meaningful context.
+	const maxTail = 16 * 1024
+	if len(data) > maxTail {
+		data = data[len(data)-maxTail:]
+	}
+	f.t.Logf("[%s log tail (%d bytes)]\n%s", name, len(data), string(data))
+}
+
+// copyLogsForCI copies SeaweedFS process logs under a per-test directory in
+// /tmp/seaweedfs-fuse-logs/ so the CI workflow can upload them as artifacts.
+// Each framework instance gets its own directory: every test in the suite
+// builds one, and fixed filenames would let a later passing test overwrite
+// the logs of an earlier failing one.
+func (f *FuseTestFramework) copyLogsForCI() {
+	ciLogDir := filepath.Join("/tmp/seaweedfs-fuse-logs", strings.NewReplacer("/", "_", " ", "_").Replace(f.t.Name()))
+	if err := os.MkdirAll(ciLogDir, 0755); err != nil {
+		return
+	}
+	for _, name := range []string{"mini", "mount"} {
+		src := filepath.Join(f.logDir, name+".log")
+		data, err := os.ReadFile(src)
+		if err != nil {
+			continue
+		}
+		os.WriteFile(filepath.Join(ciLogDir, name+".log"), data, 0644)
+	}
+}
+
+// startMini starts "weed mini" which runs master+volume+filer in one process.
+func (f *FuseTestFramework) startMini(config *TestConfig) error {
+	var args []string
+	if config.EnableDebug {
+		// -v is a global flag; before the subcommand or flag parsing dies
+		args = append(args, "-v=4")
+	}
+	adminPort := freePort(f.t)
+	for adminPort == f.filerPort {
+		adminPort = freePort(f.t)
+	}
+	args = append(args,
+		"mini",
+		"-dir="+f.dataDir,
+		"-ip=127.0.0.1",
+		"-ip.bind=127.0.0.1",
+		"-filer.port="+strconv.Itoa(f.filerPort),
+		"-s3=false",
+		"-webdav=false",
+		"-admin.ui=false",
+		"-admin.port="+strconv.Itoa(adminPort),
+		"-admin.port.grpc="+strconv.Itoa(adminPort+grpcPortOffset),
+		"-admin.port.legacy=0",
+	)
+
+	proc, err := f.startProcess("mini", args)
+	if err != nil {
+		return err
+	}
+	f.miniProcess = proc
+	return nil
+}
+
+// mountFuse mounts the SeaweedFS FUSE filesystem
+func (f *FuseTestFramework) mountFuse(config *TestConfig) error {
+	args := append([]string{}, config.MountGlobalOptions...)
+	if config.EnableDebug {
+		args = append(args, "-v=4")
+	}
+	args = append(args,
+		"mount",
+		"-filer="+f.filerAddr,
+		"-dir="+f.mountPoint,
+		"-filer.path=/",
+		"-dirAutoCreate",
+		"-allowOthers=false",
+	)
+
+	if config.Collection != "" {
+		args = append(args, "-collection="+config.Collection)
+	}
+	if config.Replication != "" {
+		args = append(args, "-replication="+config.Replication)
+	}
+	if config.ChunkSizeMB > 0 {
+		args = append(args, fmt.Sprintf("-chunkSizeLimitMB=%d", config.ChunkSizeMB))
+	}
+	if config.CacheSizeMB > 0 {
+		args = append(args, fmt.Sprintf("-cacheCapacityMB=%d", config.CacheSizeMB))
+	}
+
+	args = append(args, config.MountOptions...)
+
+	proc, err := f.startProcess("mount", args)
+	if err != nil {
+		return err
+	}
+	f.mountProcess = proc
+	return nil
+}
+
+// unmountFuse unmounts the FUSE filesystem
+func (f *FuseTestFramework) unmountFuse() error {
+	if f.mountProcess != nil {
+		f.mountProcess.stop()
+		f.mountProcess = nil
+	}
+
+	// Also try system unmount as backup
+	exec.Command("fusermount3", "-u", f.mountPoint).Run()
+	exec.Command("fusermount", "-u", f.mountPoint).Run()
+	exec.Command("umount", f.mountPoint).Run()
+	return nil
+}
+
+// waitForService waits until the weed process answers its own /healthz, so a
+// foreign listener on the port cannot pass for readiness.
+func (f *FuseTestFramework) waitForService(proc *managedProcess, addr string, timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	client := &http.Client{Timeout: time.Second}
+	for time.Now().Before(deadline) {
+		resp, err := client.Get("http://" + addr + "/healthz")
+		if err == nil {
+			resp.Body.Close()
+			if resp.StatusCode == http.StatusOK && proc.exited() == nil {
+				return nil
+			}
+		}
+		if exitErr := proc.exited(); exitErr != nil {
+			return fmt.Errorf("process exited (%v) before %s accepted connections: %s", exitErr, addr, logTail(proc.logPath))
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	return fmt.Errorf("service at %s not ready within timeout: %s", addr, logTail(proc.logPath))
+}
+
+// waitForMount waits for the FUSE mount to be ready. A stat/ReadDir probe
+// alone is not enough: the bare mount point directory passes both before the
+// mount process finishes starting, letting tests race ahead and write to the
+// local disk underneath the mount. The mount point's device ID differing from
+// its parent's confirms a filesystem is actually mounted there.
+func (f *FuseTestFramework) waitForMount(timeout time.Duration) error {
+	parentDev, err := deviceID(filepath.Dir(f.mountPoint))
+	if err != nil {
+		return fmt.Errorf("stat mount point parent: %w", err)
+	}
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if dev, err := deviceID(f.mountPoint); err == nil && dev != parentDev {
+			if _, err := os.ReadDir(f.mountPoint); err == nil {
+				return nil
+			}
+		}
+		// A mount that cannot mount at all (no /dev/fuse, fusermount not setuid)
+		// dies within a second; reporting that beats waiting out the timeout.
+		if exitErr := f.mountProcess.exited(); exitErr != nil {
+			return fmt.Errorf("mount process exited (%v): %s", exitErr, logTail(f.mountProcess.logPath))
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	return fmt.Errorf("mount point not ready within timeout: %s", logTail(f.mountProcess.logPath))
+}
+
+// waitForWritable probes the mount with a real write+read+remove until one
+// succeeds, covering the window where a fresh cluster cannot yet assign a
+// file id (volume not registered, grow pending, leader settle). Each attempt
+// runs off the loop because a wedged mount can hold a file op open, and one
+// attempt stays in flight until it finishes or the overall deadline passes.
+func (f *FuseTestFramework) waitForWritable(timeout time.Duration) error {
+	probe := filepath.Join(f.mountPoint, ".framework_write_probe")
+	payload := []byte("probe")
+	deadline := time.Now().Add(timeout)
+	var lastErr error
+	for time.Now().Before(deadline) {
+		if exitErr := f.mountProcess.exited(); exitErr != nil {
+			return fmt.Errorf("mount process exited (%v): %s", exitErr, logTail(f.mountProcess.logPath))
+		}
+		result := make(chan error, 1)
+		go func() {
+			if err := os.WriteFile(probe, payload, 0644); err != nil {
+				result <- err
+				return
+			}
+			data, err := os.ReadFile(probe)
+			if err != nil {
+				result <- err
+				return
+			}
+			if len(data) != len(payload) {
+				result <- fmt.Errorf("read back %d bytes, want %d", len(data), len(payload))
+				return
+			}
+			result <- os.Remove(probe)
+		}()
+		tick := time.NewTicker(500 * time.Millisecond)
+		attemptOpen := true
+		for attemptOpen {
+			select {
+			case err := <-result:
+				attemptOpen = false
+				if err == nil {
+					tick.Stop()
+					return nil
+				}
+				lastErr = err
+			case <-tick.C:
+				if exitErr := f.mountProcess.exited(); exitErr != nil {
+					tick.Stop()
+					return fmt.Errorf("mount process exited (%v): %s", exitErr, logTail(f.mountProcess.logPath))
+				}
+				if !time.Now().Before(deadline) {
+					tick.Stop()
+					if lastErr == nil {
+						return fmt.Errorf("write probe did not complete within timeout")
+					}
+					return fmt.Errorf("write probe failed within timeout: %v", lastErr)
+				}
+			}
+		}
+		tick.Stop()
+		time.Sleep(500 * time.Millisecond)
+	}
+	return fmt.Errorf("write probe failed within timeout: %v", lastErr)
+}
+
+// fuseAvailable reports whether the host has a FUSE device node to mount
+// through: /dev/fuse on Linux, /dev/macfuse* or /dev/osxfuse* on macOS.
+func fuseAvailable() bool {
+	for _, dev := range []string{"/dev/fuse", "/dev/macfuse0", "/dev/osxfuse0"} {
+		if _, err := os.Stat(dev); err == nil {
+			return true
+		}
+	}
+	return false
+}
+
+// findWeedBinary locates the weed binary. Candidates are resolved to
+// absolute paths because the started processes run with cmd.Dir set to the
+// framework's temp dir, where a relative path would not resolve.
+func findWeedBinary() string {
+	if p, err := exec.LookPath("weed"); err == nil {
+		return p
+	}
+
+	candidates := []string{
+		"../../weed/weed",
+		"./weed",
+		"../weed",
+	}
+	for _, candidate := range candidates {
+		if info, err := os.Stat(candidate); err == nil && !info.IsDir() && info.Mode()&0111 != 0 {
+			if abs, err := filepath.Abs(candidate); err == nil {
+				return abs
+			}
+		}
+	}
+
+	// Default fallback
+	return "weed"
+}
+
+// Helper functions for test assertions
+
+// AssertFileExists checks if a file exists in the mount point
+func (f *FuseTestFramework) AssertFileExists(relativePath string) {
+	fullPath := filepath.Join(f.mountPoint, relativePath)
+	_, err := os.Stat(fullPath)
+	require.NoError(f.t, err, "file should exist: %s", relativePath)
+}
+
+// AssertFileNotExists checks if a file does not exist in the mount point
+func (f *FuseTestFramework) AssertFileNotExists(relativePath string) {
+	fullPath := filepath.Join(f.mountPoint, relativePath)
+	_, err := os.Stat(fullPath)
+	require.True(f.t, os.IsNotExist(err), "file should not exist: %s", relativePath)
+}
+
+// AssertFileContent checks if a file has expected content
+func (f *FuseTestFramework) AssertFileContent(relativePath string, expectedContent []byte) {
+	fullPath := filepath.Join(f.mountPoint, relativePath)
+	actualContent, err := os.ReadFile(fullPath)
+	require.NoError(f.t, err, "failed to read file: %s", relativePath)
+	require.Equal(f.t, expectedContent, actualContent, "file content mismatch: %s", relativePath)
+}
+
+// AssertFileMode checks if a file has expected permissions
+func (f *FuseTestFramework) AssertFileMode(relativePath string, expectedMode fs.FileMode) {
+	fullPath := filepath.Join(f.mountPoint, relativePath)
+	info, err := os.Stat(fullPath)
+	require.NoError(f.t, err, "failed to stat file: %s", relativePath)
+	require.Equal(f.t, expectedMode, info.Mode(), "file mode mismatch: %s", relativePath)
+}
+
+// CreateTestFile creates a test file with specified content
+func (f *FuseTestFramework) CreateTestFile(relativePath string, content []byte) {
+	fullPath := filepath.Join(f.mountPoint, relativePath)
+	dir := filepath.Dir(fullPath)
+	require.NoError(f.t, os.MkdirAll(dir, 0755), "failed to create directory: %s", dir)
+	require.NoError(f.t, os.WriteFile(fullPath, content, 0644), "failed to create file: %s", relativePath)
+}
+
+// CreateTestDir creates a test directory
+func (f *FuseTestFramework) CreateTestDir(relativePath string) {
+	fullPath := filepath.Join(f.mountPoint, relativePath)
+	require.NoError(f.t, os.MkdirAll(fullPath, 0755), "failed to create directory: %s", relativePath)
+}
diff --git a/test/fuse_integration/framework_test.go b/test/fuse_integration/framework_test.go
index ec0fc19b5a..a7662e96e0 100644
--- a/test/fuse_integration/framework_test.go
+++ b/test/fuse_integration/framework_test.go
@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 	"testing"
 	"time"
@@ -30,6 +31,7 @@ type FuseTestFramework struct {
 	filerPort    int
 	weedBinary   string
 	isSetup      bool
+	config       *TestConfig
 }
 
 // TestConfig holds configuration for FUSE tests
@@ -83,6 +85,7 @@ func NewFuseTestFramework(t *testing.T, config *TestConfig) *FuseTestFramework {
 		filerAddr:  fmt.Sprintf("127.0.0.1:%d", filerPort),
 		weedBinary: findWeedBinary(),
 		isSetup:    false,
+		config:     config,
 	}
 }
 
@@ -132,6 +135,10 @@ func (f *FuseTestFramework) Setup(config *TestConfig) error {
 	if f.isSetup {
 		return fmt.Errorf("framework already setup")
 	}
+	if config != nil {
+		f.config = config
+	}
+	config = f.config
 
 	dirs := []string{f.mountPoint, f.logDir, f.dataDir}
 	for _, dir := range dirs {
@@ -146,7 +153,7 @@ func (f *FuseTestFramework) Setup(config *TestConfig) error {
 	}
 
 	// Wait for filer to be ready (mini starts all services on filerPort)
-	if err := f.waitForService(f.miniProcess, f.filerAddr, 30*time.Second); err != nil {
+	if err := f.waitForService(f.miniProcess, f.filerAddr, 90*time.Second); err != nil {
 		f.dumpLog("mini")
 		return fmt.Errorf("weed mini not ready: %v", err)
 	}
@@ -157,11 +164,18 @@ func (f *FuseTestFramework) Setup(config *TestConfig) error {
 	}
 
 	// Wait for mount to be ready
-	if err := f.waitForMount(30 * time.Second); err != nil {
+	if err := f.waitForMount(90 * time.Second); err != nil {
 		f.dumpLog("mount")
 		return fmt.Errorf("FUSE mount not ready: %v", err)
 	}
 
+	// Gate on a real write: a fresh mini still cannot assign a file id until
+	// its volume registers and a grow round finishes.
+	if err := f.waitForWritable(90 * time.Second); err != nil {
+		f.dumpLog("mount")
+		return fmt.Errorf("FUSE mount not writable: %v", err)
+	}
+
 	f.isSetup = true
 	return nil
 }
@@ -182,7 +196,7 @@ func (f *FuseTestFramework) Cleanup() {
 
 	f.copyLogsForCI()
 
-	if !DefaultTestConfig().SkipCleanup {
+	if !f.config.SkipCleanup {
 		os.RemoveAll(f.tempDir)
 	}
 }
@@ -280,11 +294,16 @@ func (f *FuseTestFramework) dumpLog(name string) {
 	f.t.Logf("[%s log tail (%d bytes)]\n%s", name, len(data), string(data))
 }
 
-// copyLogsForCI copies SeaweedFS process logs to /tmp/seaweedfs-fuse-logs/
-// so the CI workflow can upload them as artifacts.
+// copyLogsForCI copies SeaweedFS process logs under a per-test directory in
+// /tmp/seaweedfs-fuse-logs/ so the CI workflow can upload them as artifacts.
+// Each framework instance gets its own directory: every test in the suite
+// builds one, and fixed filenames would let a later passing test overwrite
+// the logs of an earlier failing one.
 func (f *FuseTestFramework) copyLogsForCI() {
-	ciLogDir := "/tmp/seaweedfs-fuse-logs"
-	os.MkdirAll(ciLogDir, 0755)
+	ciLogDir := filepath.Join("/tmp/seaweedfs-fuse-logs", strings.NewReplacer("/", "_", " ", "_").Replace(f.t.Name()))
+	if err := os.MkdirAll(ciLogDir, 0755); err != nil {
+		return
+	}
 	for _, name := range []string{"mini", "mount"} {
 		src := filepath.Join(f.logDir, name+".log")
 		data, err := os.ReadFile(src)
@@ -301,6 +320,10 @@ func (f *FuseTestFramework) startMini(config *TestConfig) error {
 	if config.EnableDebug {
 		args = append(args, "-v=4")
 	}
+	adminPort := freePort(f.t)
+	for adminPort == f.filerPort {
+		adminPort = freePort(f.t)
+	}
 	args = append(args,
 		"mini",
 		"-dir="+f.dataDir,
@@ -310,6 +333,9 @@ func (f *FuseTestFramework) startMini(config *TestConfig) error {
 		"-s3=false",
 		"-webdav=false",
 		"-admin.ui=false",
+		"-admin.port="+strconv.Itoa(adminPort),
+		"-admin.port.grpc="+strconv.Itoa(adminPort+grpcPortOffset),
+		"-admin.port.legacy=0",
 	)
 
 	proc, err := f.startProcess("mini", args)
@@ -415,6 +441,68 @@ func (f *FuseTestFramework) waitForMount(timeout time.Duration) error {
 	return fmt.Errorf("mount point not ready within timeout")
 }
 
+// waitForWritable probes the mount with a real write+read+remove until one
+// succeeds, covering the window where a fresh cluster cannot yet assign a
+// file id (volume not registered, grow pending, leader settle). Each attempt
+// runs off the loop because a wedged mount can hold a file op open, and one
+// attempt stays in flight until it finishes or the overall deadline passes.
+func (f *FuseTestFramework) waitForWritable(timeout time.Duration) error {
+	probe := filepath.Join(f.mountPoint, ".framework_write_probe")
+	payload := []byte("probe")
+	deadline := time.Now().Add(timeout)
+	var lastErr error
+	for time.Now().Before(deadline) {
+		if exitErr := f.mountProcess.exited(); exitErr != nil {
+			return fmt.Errorf("mount process exited (%v)", exitErr)
+		}
+		result := make(chan error, 1)
+		go func() {
+			if err := os.WriteFile(probe, payload, 0644); err != nil {
+				result <- err
+				return
+			}
+			data, err := os.ReadFile(probe)
+			if err != nil {
+				result <- err
+				return
+			}
+			if len(data) != len(payload) {
+				result <- fmt.Errorf("read back %d bytes, want %d", len(data), len(payload))
+				return
+			}
+			result <- os.Remove(probe)
+		}()
+		tick := time.NewTicker(500 * time.Millisecond)
+		attemptOpen := true
+		for attemptOpen {
+			select {
+			case err := <-result:
+				attemptOpen = false
+				if err == nil {
+					tick.Stop()
+					return nil
+				}
+				lastErr = err
+			case <-tick.C:
+				if exitErr := f.mountProcess.exited(); exitErr != nil {
+					tick.Stop()
+					return fmt.Errorf("mount process exited (%v)", exitErr)
+				}
+				if !time.Now().Before(deadline) {
+					tick.Stop()
+					if lastErr == nil {
+						return fmt.Errorf("write probe did not complete within timeout")
+					}
+					return fmt.Errorf("write probe failed within timeout: %v", lastErr)
+				}
+			}
+		}
+		tick.Stop()
+		time.Sleep(500 * time.Millisecond)
+	}
+	return fmt.Errorf("write probe failed within timeout: %v", lastErr)
+}
+
 // deviceID returns the device ID of the filesystem containing path.
 func deviceID(path string) (uint64, error) {
 	var st syscall.Stat_t
diff --git a/test/fuse_integration/fuse_mount_bsd.go b/test/fuse_integration/fuse_mount_bsd.go
new file mode 100644
index 0000000000..d1d731ad76
--- /dev/null
+++ b/test/fuse_integration/fuse_mount_bsd.go
@@ -0,0 +1,25 @@
+//go:build darwin || freebsd
+
+package fuse
+
+import (
+	"strings"
+	"syscall"
+)
+
+// fuseFilesystem reports whether path sits on a FUSE mount; macFUSE, osxfuse
+// and fusefs all carry "fuse" in the filesystem type name.
+func fuseFilesystem(path string) bool {
+	var st syscall.Statfs_t
+	if err := syscall.Statfs(path, &st); err != nil {
+		return false
+	}
+	name := make([]byte, 0, len(st.Fstypename))
+	for _, c := range st.Fstypename {
+		if c == 0 {
+			break
+		}
+		name = append(name, byte(c))
+	}
+	return strings.Contains(string(name), "fuse")
+}
diff --git a/test/fuse_integration/fuse_mount_linux.go b/test/fuse_integration/fuse_mount_linux.go
new file mode 100644
index 0000000000..2a181cb4ce
--- /dev/null
+++ b/test/fuse_integration/fuse_mount_linux.go
@@ -0,0 +1,17 @@
+//go:build linux
+
+package fuse
+
+import "syscall"
+
+// fuseSuperMagic is statfs f_type for fuse and fuseblk mounts.
+const fuseSuperMagic = 0x65735546
+
+// fuseFilesystem reports whether path sits on a FUSE mount.
+func fuseFilesystem(path string) bool {
+	var st syscall.Statfs_t
+	if err := syscall.Statfs(path, &st); err != nil {
+		return false
+	}
+	return st.Type == fuseSuperMagic
+}
diff --git a/test/fuse_integration/fuse_mount_other.go b/test/fuse_integration/fuse_mount_other.go
new file mode 100644
index 0000000000..21022f9a5c
--- /dev/null
+++ b/test/fuse_integration/fuse_mount_other.go
@@ -0,0 +1,9 @@
+//go:build (unix && !linux && !darwin && !freebsd) || (!unix && !windows)
+
+package fuse
+
+// fuseFilesystem has no portable check on these platforms; the mount check
+// and write verification in Setup stay the only gates.
+func fuseFilesystem(path string) bool {
+	return true
+}
diff --git a/test/fuse_integration/go.mod b/test/fuse_integration/go.mod
index 47246cdd8a..bb1f5aa09b 100644
--- a/test/fuse_integration/go.mod
+++ b/test/fuse_integration/go.mod
@@ -2,7 +2,10 @@ module seaweedfs-fuse-tests
 
 go 1.21
 
-require github.com/stretchr/testify v1.8.4
+require (
+	github.com/stretchr/testify v1.8.4
+	golang.org/x/sys v0.28.0
+)
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
diff --git a/test/fuse_integration/go.sum b/test/fuse_integration/go.sum
index fa4b6e6825..21c915f839 100644
--- a/test/fuse_integration/go.sum
+++ b/test/fuse_integration/go.sum
@@ -4,6 +4,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/test/fuse_integration/mmap_unix.go b/test/fuse_integration/mmap_unix.go
new file mode 100644
index 0000000000..4fa9619c1e
--- /dev/null
+++ b/test/fuse_integration/mmap_unix.go
@@ -0,0 +1,55 @@
+//go:build unix
+
+package fuse
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// Memory mapping support for Unix-like systems
+
+func mmapFile(fd int, offset int64, length int, prot int, flags int) ([]byte, error) {
+	return unix.Mmap(fd, offset, length, prot, flags)
+}
+
+func munmapFile(data []byte) error {
+	if len(data) == 0 {
+		return nil
+	}
+	return unix.Munmap(data)
+}
+
+func msyncFile(data []byte, flags int) error {
+	if len(data) == 0 {
+		return nil
+	}
+	return unix.Msync(data, flags)
+}
+
+func isMmapSupported() bool {
+	return true
+}
+
+// Memory protection flags
+const (
+	PROT_READ  = syscall.PROT_READ
+	PROT_WRITE = syscall.PROT_WRITE
+	PROT_EXEC  = syscall.PROT_EXEC
+	PROT_NONE  = syscall.PROT_NONE
+)
+
+// Memory mapping flags
+const (
+	MAP_SHARED    = syscall.MAP_SHARED
+	MAP_PRIVATE   = syscall.MAP_PRIVATE
+	MAP_ANONYMOUS = syscall.MAP_ANON
+)
+
+// Memory sync flags
+const (
+	MS_ASYNC      = syscall.MS_ASYNC
+	MS_SYNC       = syscall.MS_SYNC
+	MS_INVALIDATE = syscall.MS_INVALIDATE
+)
diff --git a/test/fuse_integration/mmap_unsupported.go b/test/fuse_integration/mmap_unsupported.go
new file mode 100644
index 0000000000..082f9333c4
--- /dev/null
+++ b/test/fuse_integration/mmap_unsupported.go
@@ -0,0 +1,47 @@
+//go:build !unix
+
+package fuse
+
+import (
+	"errors"
+)
+
+// Memory mapping support for unsupported platforms
+
+var ErrMmapNotSupported = errors.New("memory mapping not supported on this platform")
+
+func mmapFile(fd int, offset int64, length int, prot int, flags int) ([]byte, error) {
+	return nil, ErrMmapNotSupported
+}
+
+func munmapFile(data []byte) error {
+	return ErrMmapNotSupported
+}
+
+func msyncFile(data []byte, flags int) error {
+	return ErrMmapNotSupported
+}
+
+func isMmapSupported() bool {
+	return false
+}
+
+// Dummy constants for unsupported platforms
+const (
+	PROT_READ  = 0x1
+	PROT_WRITE = 0x2
+	PROT_EXEC  = 0x4
+	PROT_NONE  = 0x0
+)
+
+const (
+	MAP_SHARED    = 0x01
+	MAP_PRIVATE   = 0x02
+	MAP_ANONYMOUS = 0x20
+)
+
+const (
+	MS_ASYNC      = 0x1
+	MS_SYNC       = 0x4
+	MS_INVALIDATE = 0x2
+)
diff --git a/test/fuse_integration/mounted_linux_test.go b/test/fuse_integration/mounted_linux_test.go
new file mode 100644
index 0000000000..c2184cafff
--- /dev/null
+++ b/test/fuse_integration/mounted_linux_test.go
@@ -0,0 +1,27 @@
+//go:build linux
+
+package fuse
+
+import "testing"
+
+func TestMountedAt(t *testing.T) {
+	for _, p := range []string{"/proc", "/proc/"} {
+		if !mountedAt(p) {
+			t.Errorf("mountedAt(%q) = false, want true", p)
+		}
+	}
+	plain := t.TempDir()
+	for _, p := range []string{plain, plain + "/"} {
+		if mountedAt(p) {
+			t.Errorf("mountedAt(%q) = true, want false", p)
+		}
+	}
+}
+
+func TestFuseFilesystem(t *testing.T) {
+	for _, p := range []string{"/proc", t.TempDir()} {
+		if fuseFilesystem(p) {
+			t.Errorf("fuseFilesystem(%q) = true, want false", p)
+		}
+	}
+}
diff --git a/test/fuse_integration/mounted_unix.go b/test/fuse_integration/mounted_unix.go
new file mode 100644
index 0000000000..471b8bb655
--- /dev/null
+++ b/test/fuse_integration/mounted_unix.go
@@ -0,0 +1,33 @@
+//go:build unix
+
+package fuse
+
+import (
+	"path/filepath"
+	"syscall"
+)
+
+// deviceID returns the device ID of the filesystem containing path.
+func deviceID(path string) (uint64, error) {
+	var st syscall.Stat_t
+	if err := syscall.Stat(path, &st); err != nil {
+		return 0, err
+	}
+	return uint64(st.Dev), nil
+}
+
+// mountedAt reports whether something is actually mounted at path: a plain
+// directory shares its parent's device, a mount point does not. The path is
+// cleaned first so a trailing slash does not make Dir return the mount itself.
+func mountedAt(path string) bool {
+	path = filepath.Clean(path)
+	dev, err := deviceID(path)
+	if err != nil {
+		return false
+	}
+	parentDev, err := deviceID(filepath.Dir(path))
+	if err != nil {
+		return false
+	}
+	return dev != parentDev
+}
diff --git a/test/fuse_integration/mounted_unsupported.go b/test/fuse_integration/mounted_unsupported.go
new file mode 100644
index 0000000000..1d698e5241
--- /dev/null
+++ b/test/fuse_integration/mounted_unsupported.go
@@ -0,0 +1,16 @@
+//go:build !unix && !windows
+
+package fuse
+
+// FUSE mounts are unix-only: reporting one device keeps waitForMount from
+// mistaking the plain pre-mount directory for a live mount on platforms
+// where a mount can never appear.
+func deviceID(path string) (uint64, error) {
+	return 0, nil
+}
+
+// mountedAt cannot be detected off unix; report mounted so an external
+// TEST_MOUNT_POINT keeps its best-effort write verification.
+func mountedAt(path string) bool {
+	return true
+}
diff --git a/test/fuse_integration/mounted_windows.go b/test/fuse_integration/mounted_windows.go
new file mode 100644
index 0000000000..4855bb647b
--- /dev/null
+++ b/test/fuse_integration/mounted_windows.go
@@ -0,0 +1,40 @@
+//go:build windows
+
+package fuse
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+)
+
+// deviceID has no portable meaning here: reporting one device keeps
+// waitForMount from mistaking the plain pre-mount directory for a live mount.
+func deviceID(path string) (uint64, error) {
+	return 0, nil
+}
+
+// mountedAt reports whether path is a WinFsp mount: a directory mount is a
+// reparse point and a drive mount is a volume root, while a plain directory
+// is neither.
+func mountedAt(path string) bool {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return false
+	}
+	if filepath.Dir(abs) == abs {
+		return true
+	}
+	info, err := os.Lstat(abs)
+	if err != nil {
+		return false
+	}
+	data, ok := info.Sys().(*syscall.Win32FileAttributeData)
+	return ok && data.FileAttributes&syscall.FILE_ATTRIBUTE_REPARSE_POINT != 0
+}
+
+// fuseFilesystem is covered by the WinFsp checks in mountedAt: WinFsp is the
+// only FUSE provider on the platform.
+func fuseFilesystem(path string) bool {
+	return true
+}
diff --git a/test/fuse_integration/posix_Makefile b/test/fuse_integration/posix_Makefile
new file mode 100644
index 0000000000..32c5c2f45f
--- /dev/null
+++ b/test/fuse_integration/posix_Makefile
@@ -0,0 +1,531 @@
+# SeaweedFS POSIX Compliance Testing Makefile
+
+SHELL := /bin/bash
+# go test is piped through tee everywhere; without pipefail a failing suite
+# still exits 0 because only tee's status propagates.
+.SHELLFLAGS := -o pipefail -c
+
+# Configuration
+WEED_BINARY := $(shell which weed 2>/dev/null || echo "../../weed")
+GO_VERSION := 1.21
+TEST_TIMEOUT := 45m
+COVERAGE_FILE := posix_coverage.out
+REPORT_DIR := reports
+EXTERNAL_TOOLS_DIR := external_tools
+MOUNT_POINT ?= /tmp/seaweedfs_mount
+ifneq ($(TEST_MOUNT_POINT),)
+MOUNT_POINT := $(TEST_MOUNT_POINT)
+endif
+
+# Go test command prefix for external mount points
+GO_TEST_PREFIX :=
+ifneq ($(TEST_MOUNT_POINT),)
+GO_TEST_PREFIX := TEST_MOUNT_POINT="$(TEST_MOUNT_POINT)" TEST_SKIP_CLUSTER_SETUP="true"
+endif
+
+# Test categories
+POSIX_BASIC_TESTS := posix_compliance_test.go
+POSIX_EXTENDED_TESTS := posix_extended_test.go  
+POSIX_EXTERNAL_TESTS := posix_external_test.go
+
+# -f is not propagated through MAKEFLAGS, so recursive calls must name this
+# file explicitly or the sub-make reads the default Makefile instead.
+MAKE_SELF := $(MAKE) -f $(firstword $(MAKEFILE_LIST))
+
+# Colors for output — bash echo does not expand \033, so bake the escapes in
+RED := $(shell printf '\033[31m')
+GREEN := $(shell printf '\033[32m')
+YELLOW := $(shell printf '\033[33m')
+BLUE := $(shell printf '\033[34m')
+MAGENTA := $(shell printf '\033[35m')
+CYAN := $(shell printf '\033[36m')
+WHITE := $(shell printf '\033[37m')
+RESET := $(shell printf '\033[0m')
+
+.DEFAULT_GOAL := help
+
+# Prerequisites checks
+check-binary:
+	@if [ ! -f "$(WEED_BINARY)" ]; then \
+		echo "$(RED)❌ SeaweedFS binary not found at $(WEED_BINARY)$(RESET)"; \
+		echo "   Please run 'make' in the root directory first"; \
+		exit 1; \
+	fi
+	@echo "$(GREEN)[OK] SeaweedFS binary found at $(WEED_BINARY)$(RESET)"
+
+check-fuse:
+	@if command -v fusermount >/dev/null 2>&1; then \
+		echo "$(GREEN)[OK] FUSE is installed (Linux)$(RESET)"; \
+	elif command -v umount >/dev/null 2>&1 && [ "$$(uname)" = "Darwin" ]; then \
+		echo "$(GREEN)[OK] FUSE is available (macOS)$(RESET)"; \
+	else \
+		echo "$(RED)❌ FUSE not found. Please install:$(RESET)"; \
+		echo "   Ubuntu/Debian: sudo apt-get install fuse"; \
+		echo "   CentOS/RHEL:   sudo yum install fuse"; \
+		echo "   macOS:         brew install macfuse"; \
+		exit 1; \
+	fi
+
+check-go:
+	@go version | grep -Eq "go(1\.(2[1-9]|[3-9][0-9]+)|[2-9]\.)" || \
+	(echo "$(RED)❌ Go $(GO_VERSION)+ required. Current: $$(go version)$(RESET)" && exit 1)
+	@echo "$(GREEN)[OK] Go version check passed$(RESET)"
+
+check-prereqs: check-go check-fuse check-binary
+	@echo "$(GREEN)[OK] All prerequisites satisfied$(RESET)"
+
+# Setup and initialization
+
+
+setup-reports:
+	@mkdir -p $(REPORT_DIR)
+	@mkdir -p $(EXTERNAL_TOOLS_DIR)
+
+setup-external-tools: setup-reports
+	@echo "$(BLUE)🛠️  Setting up external POSIX test tools...$(RESET)"
+	@$(MAKE_SELF) setup-pjdfstest || echo "$(YELLOW)[WARNING] pjdfstest setup failed - continuing without it$(RESET)"
+	@$(MAKE_SELF) setup-nfstest || echo "$(YELLOW)[WARNING] nfstest setup failed - continuing without it$(RESET)"
+	@$(MAKE_SELF) setup-fio || echo "$(YELLOW)[WARNING] FIO setup failed - continuing without it$(RESET)"
+
+# External tools setup
+setup-pjdfstest:
+	@if [ ! -d "$(EXTERNAL_TOOLS_DIR)/pjdfstest" ]; then \
+		echo "$(BLUE)[SETUP] Setting up pjdfstest...$(RESET)"; \
+		if ! command -v autoreconf >/dev/null 2>&1; then \
+			echo "$(YELLOW)[WARNING] autoreconf not found - installing build-essential...$(RESET)"; \
+			if command -v apt-get >/dev/null 2>&1; then \
+				sudo apt-get update && sudo apt-get install -y build-essential autoconf automake libtool; \
+			elif command -v yum >/dev/null 2>&1; then \
+				sudo yum install -y gcc make autoconf automake libtool; \
+			else \
+				echo "$(YELLOW)[WARNING] Please install build tools manually$(RESET)"; \
+				exit 1; \
+			fi; \
+		fi; \
+		cd $(EXTERNAL_TOOLS_DIR) && \
+		git clone https://github.com/pjd/pjdfstest.git && \
+		cd pjdfstest && \
+		autoreconf -ifs && \
+		./configure && \
+		make; \
+	else \
+		echo "$(GREEN)[OK] pjdfstest already setup$(RESET)"; \
+	fi
+
+setup-nfstest:
+	@echo "$(BLUE)[INSTALL] Installing nfstest...$(RESET)"
+	@pip3 install --user nfstest || \
+	echo "$(YELLOW)[WARNING] nfstest installation failed. Install manually: pip3 install nfstest$(RESET)"
+
+setup-fio:
+	@if ! command -v fio >/dev/null 2>&1; then \
+		echo "$(BLUE)[SETUP] Installing FIO...$(RESET)"; \
+		if command -v apt-get >/dev/null 2>&1; then \
+			sudo apt-get update && sudo apt-get install -y fio; \
+		elif command -v yum >/dev/null 2>&1; then \
+			sudo yum install -y fio; \
+		elif command -v brew >/dev/null 2>&1; then \
+			brew install fio; \
+		else \
+			echo "$(YELLOW)[WARNING] Please install FIO manually$(RESET)"; \
+		fi; \
+	else \
+		echo "$(GREEN)[OK] FIO already installed$(RESET)"; \
+	fi
+
+# Core test execution
+test-posix-basic: check-prereqs setup-reports
+	@echo "$(CYAN)[TEST] Running basic POSIX compliance tests...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@$(GO_TEST_PREFIX) go test -v -timeout $(TEST_TIMEOUT) -failfast=false -run TestPOSIXCompliance . 2>&1 | \
+		tee $(REPORT_DIR)/posix_basic_results.log
+
+test-posix-extended: check-prereqs setup-reports
+	@echo "$(CYAN)[TEST] Running extended POSIX compliance tests...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@$(GO_TEST_PREFIX) go test -v -timeout $(TEST_TIMEOUT) -failfast=false -run TestPOSIXExtended . 2>&1 | \
+		tee $(REPORT_DIR)/posix_extended_results.log
+
+test-posix-external: check-prereqs setup-reports
+	@echo "$(CYAN)[TEST] Running external POSIX test suite integration...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@if [ -d "$(EXTERNAL_TOOLS_DIR)/pjdfstest" ] || command -v nfstest_posix >/dev/null 2>&1; then \
+		echo "$(GREEN)[OK] External tools available - running external tests$(RESET)"; \
+		$(GO_TEST_PREFIX) go test -v -timeout $(TEST_TIMEOUT) -failfast=false -run TestExternalPOSIXSuites . 2>&1 | \
+			tee $(REPORT_DIR)/posix_external_results.log; \
+	else \
+		echo "$(YELLOW)[WARNING] External tools not available - skipping external tests$(RESET)"; \
+		echo "External tests skipped - tools not available" > $(REPORT_DIR)/posix_external_results.log; \
+	fi
+
+# Comprehensive test suites
+test-posix-full: test-posix-basic test-posix-extended test-posix-external
+	@echo "$(GREEN)[OK] Full POSIX compliance test suite completed$(RESET)"
+	@$(MAKE_SELF) generate-report
+
+test-posix-critical: check-prereqs setup-reports
+	@echo "$(CYAN)[TEST] Running critical POSIX compliance tests...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@$(GO_TEST_PREFIX) go test -v -timeout 15m -failfast=false \
+		-run "TestPOSIXCompliance/(FileOperations|DirectoryOperations|PermissionTests|IOOperations)" \
+		. 2>&1 | tee $(REPORT_DIR)/posix_critical_results.log
+
+test-posix-stress: check-prereqs setup-reports
+	@echo "$(CYAN)[TEST] Running POSIX stress tests...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@if [ -d "$(EXTERNAL_TOOLS_DIR)/pjdfstest" ] || command -v nfstest_posix >/dev/null 2>&1; then \
+		echo "$(GREEN)[OK] External tools available - running stress tests$(RESET)"; \
+		$(GO_TEST_PREFIX) go test -v -timeout $(TEST_TIMEOUT) -failfast=false \
+			-run "TestExternalPOSIXSuites/CustomPOSIXTests" \
+			. 2>&1 | tee $(REPORT_DIR)/posix_stress_results.log; \
+	else \
+		echo "$(YELLOW)[WARNING] External tools not available - skipping stress tests$(RESET)"; \
+		echo "Stress tests skipped - tools not available" > $(REPORT_DIR)/posix_stress_results.log; \
+	fi
+
+# Performance and benchmarks
+benchmark-posix: check-prereqs setup-reports
+	@echo "$(CYAN)📈 Running POSIX performance benchmarks...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@$(GO_TEST_PREFIX) go test -v -timeout $(TEST_TIMEOUT) -run '^$$' -bench=. -benchmem \
+		. 2>&1 | \
+		tee $(REPORT_DIR)/posix_benchmark_results.log
+
+profile-posix: check-prereqs setup-reports
+	@echo "$(CYAN)[PROFILE] Running POSIX tests with profiling...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@$(GO_TEST_PREFIX) go test -v -timeout $(TEST_TIMEOUT) -cpuprofile $(REPORT_DIR)/posix.cpu.prof \
+		-memprofile $(REPORT_DIR)/posix.mem.prof -run TestPOSIXCompliance .
+	@echo "$(GREEN)[PROFILE] Profiles generated:$(RESET)"
+	@echo "  CPU: $(REPORT_DIR)/posix.cpu.prof"
+	@echo "  Memory: $(REPORT_DIR)/posix.mem.prof"
+	@echo "$(BLUE)View with: go tool pprof $(REPORT_DIR)/posix.cpu.prof$(RESET)"
+
+# Coverage analysis
+coverage-posix: check-prereqs setup-reports
+	@echo "$(CYAN)[COVERAGE] Running POSIX tests with coverage analysis...$(RESET)"
+ifneq ($(TEST_MOUNT_POINT),)
+	@echo "$(BLUE)Using external mount point: $(TEST_MOUNT_POINT)$(RESET)"
+endif
+	@$(GO_TEST_PREFIX) go test -v -timeout $(TEST_TIMEOUT) -coverprofile=$(REPORT_DIR)/$(COVERAGE_FILE) \
+		.
+	@go tool cover -html=$(REPORT_DIR)/$(COVERAGE_FILE) -o $(REPORT_DIR)/posix_coverage.html
+	@echo "$(GREEN)[COVERAGE] Coverage report generated: $(REPORT_DIR)/posix_coverage.html$(RESET)"
+
+# The external suites exercise whatever filesystem MOUNT_POINT resolves to;
+# mkdir -p would happily point them at a plain local directory and report a
+# pass the mount never earned.
+require-mounted:
+	@mnt="$(MOUNT_POINT)"; mnt="$${mnt%/}"; \
+	if ! mountpoint -q "$$mnt" 2>/dev/null && ! mount | grep -qF " $$mnt "; then \
+		echo "$(RED)❌ $$mnt is not a mounted filesystem - refusing to run against the local disk$(RESET)"; \
+		exit 1; \
+	fi
+
+# External tool tests
+test-pjdfstest: setup-pjdfstest setup-reports require-mounted
+	@echo "$(CYAN)[TEST] Running pjdfstest suite...$(RESET)"
+	@if [ -d "$(EXTERNAL_TOOLS_DIR)/pjdfstest" ]; then \
+		mkdir -p $(MOUNT_POINT)/pjdfstest_workdir; \
+		cd $(MOUNT_POINT)/pjdfstest_workdir && \
+		prove -r $(CURDIR)/$(EXTERNAL_TOOLS_DIR)/pjdfstest/tests/ 2>&1 | tee $(CURDIR)/$(REPORT_DIR)/pjdfstest_results.log; \
+	else \
+		echo "$(RED)❌ pjdfstest not setup$(RESET)"; \
+		exit 1; \
+	fi
+
+test-nfstest-posix: setup-nfstest setup-reports require-mounted
+	@echo "$(CYAN)[TEST] Running nfstest_posix...$(RESET)"
+	@if command -v nfstest_posix >/dev/null 2>&1; then \
+		mkdir -p $(MOUNT_POINT); \
+		nfstest_posix --path $(MOUNT_POINT) --verbose 2>&1 | \
+		tee $(REPORT_DIR)/nfstest_results.log; \
+	else \
+					echo "$(YELLOW)[WARNING] nfstest_posix not available$(RESET)"; \
+	fi
+
+# FIO-based performance tests
+test-fio-posix: setup-reports require-mounted
+	@echo "$(CYAN)[TEST] Running FIO-based POSIX I/O tests...$(RESET)"
+	@$(MAKE_SELF) create-fio-configs
+	@if command -v fio >/dev/null 2>&1; then \
+		mkdir -p $(MOUNT_POINT); \
+		for config in $(REPORT_DIR)/fio_*.conf; do \
+			echo "$(BLUE)Running FIO config: $$config$(RESET)"; \
+			fio $$config --output=$(REPORT_DIR)/$$(basename $$config .conf)_results.log; \
+		done; \
+	else \
+					echo "$(YELLOW)[WARNING] FIO not available$(RESET)"; \
+	fi
+
+create-fio-configs: setup-reports
+	@echo "$(BLUE)[CONFIG] Creating FIO test configurations...$(RESET)"
+	@echo "[global]" > $(REPORT_DIR)/fio_random_rw.conf
+	@echo "name=posix_random_rw" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "ioengine=sync" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "iodepth=1" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "rw=randrw" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "bs=4k" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "direct=0" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "size=100m" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "numjobs=4" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "runtime=30" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "time_based" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "[random_rw_test]" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "directory=$(MOUNT_POINT)" >> $(REPORT_DIR)/fio_random_rw.conf
+	@echo "[global]" > $(REPORT_DIR)/fio_sequential.conf
+	@echo "name=posix_sequential" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "ioengine=sync" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "iodepth=1" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "bs=1m" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "direct=0" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "size=500m" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "runtime=60" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "time_based" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "[seq_write]" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "rw=write" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "directory=$(MOUNT_POINT)" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "[seq_read]" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "rw=read" >> $(REPORT_DIR)/fio_sequential.conf
+	@echo "directory=$(MOUNT_POINT)" >> $(REPORT_DIR)/fio_sequential.conf
+
+# Reporting and analysis
+generate-report: setup-reports
+	@echo "$(BLUE)[REPORT] Generating comprehensive POSIX compliance report...$(RESET)"
+	@$(MAKE_SELF) generate-html-report
+	@$(MAKE_SELF) generate-text-report
+	@$(MAKE_SELF) generate-json-report
+
+generate-html-report:
+	@echo "$(BLUE)[REPORT] Generating HTML report...$(RESET)"
+	@echo "<!DOCTYPE html>" > $(REPORT_DIR)/posix_compliance_report.html
+	@echo "<html><head><title>SeaweedFS POSIX Compliance Report</title>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@echo "<style>body{font-family:Arial;margin:20px}.pass{color:green}.fail{color:red}.summary{background:#f5f5f5;padding:10px;margin:10px 0}.test-section{margin:20px 0;border-left:3px solid #ddd;padding-left:15px}</style>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@echo "</head><body><h1>SeaweedFS POSIX Compliance Report</h1>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@echo "<p>Generated on: $$(date)</p>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@echo "<div class='summary'>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@echo "<h2>Test Summary</h2>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@if [ -f "$(REPORT_DIR)/posix_basic_results.log" ]; then \
+		TOTAL=$$(awk '/RUN|PASS|FAIL/{c++} END{print c+0}' $(REPORT_DIR)/posix_basic_results.log 2>/dev/null || echo 0); \
+		PASSED=$$(awk '/PASS:/{c++} END{print c+0}' $(REPORT_DIR)/posix_basic_results.log 2>/dev/null || echo 0); \
+		FAILED=$$(awk '/FAIL:/{c++} END{print c+0}' $(REPORT_DIR)/posix_basic_results.log 2>/dev/null || echo 0); \
+		echo "<p>Basic Tests: <span class='pass'>$$PASSED passed</span>, <span class='fail'>$$FAILED failed</span></p>" >> $(REPORT_DIR)/posix_compliance_report.html; \
+	fi
+	@if [ -f "$(REPORT_DIR)/posix_critical_results.log" ]; then \
+		TOTAL=$$(awk '/RUN|PASS|FAIL/{c++} END{print c+0}' $(REPORT_DIR)/posix_critical_results.log 2>/dev/null || echo 0); \
+		PASSED=$$(awk '/PASS:/{c++} END{print c+0}' $(REPORT_DIR)/posix_critical_results.log 2>/dev/null || echo 0); \
+		FAILED=$$(awk '/FAIL:/{c++} END{print c+0}' $(REPORT_DIR)/posix_critical_results.log 2>/dev/null || echo 0); \
+		echo "<p>Critical Tests: <span class='pass'>$$PASSED passed</span>, <span class='fail'>$$FAILED failed</span></p>" >> $(REPORT_DIR)/posix_compliance_report.html; \
+	fi
+	@echo "</div>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@echo "<h2>Detailed Results</h2>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@for logfile in $(REPORT_DIR)/*.log; do \
+		if [ -f "$$logfile" ]; then \
+			basename=$$(basename "$$logfile" .log); \
+			echo "<div class='test-section'>" >> $(REPORT_DIR)/posix_compliance_report.html; \
+			echo "<h3>$$basename</h3>" >> $(REPORT_DIR)/posix_compliance_report.html; \
+			echo "<pre>" >> $(REPORT_DIR)/posix_compliance_report.html; \
+			tail -50 "$$logfile" | sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g' >> $(REPORT_DIR)/posix_compliance_report.html; \
+			echo "</pre></div>" >> $(REPORT_DIR)/posix_compliance_report.html; \
+		fi; \
+	done
+	@echo "</body></html>" >> $(REPORT_DIR)/posix_compliance_report.html
+	@echo "$(GREEN)[OK] HTML report generated: $(REPORT_DIR)/posix_compliance_report.html$(RESET)"
+
+generate-text-report:
+	@echo "$(BLUE)[REPORT] Generating text report...$(RESET)"
+	@echo "SeaweedFS POSIX Compliance Report" > $(REPORT_DIR)/posix_compliance_summary.txt
+	@echo "=================================" >> $(REPORT_DIR)/posix_compliance_summary.txt
+	@echo "" >> $(REPORT_DIR)/posix_compliance_summary.txt
+	@echo "Generated: $$(date)" >> $(REPORT_DIR)/posix_compliance_summary.txt
+	@echo "SeaweedFS Version: $$($(WEED_BINARY) version 2>/dev/null || echo 'Unknown')" >> $(REPORT_DIR)/posix_compliance_summary.txt
+	@echo "" >> $(REPORT_DIR)/posix_compliance_summary.txt
+	@echo "Test Summary: See individual log files for detailed results" >> $(REPORT_DIR)/posix_compliance_summary.txt
+	@echo "$(GREEN)[OK] Text report generated: $(REPORT_DIR)/posix_compliance_summary.txt$(RESET)"
+
+generate-json-report:
+	@echo "$(BLUE)[REPORT] Generating JSON report...$(RESET)"
+	@echo "{" > $(REPORT_DIR)/posix_compliance_report.json
+	@echo "  \"report_type\": \"posix_compliance\"," >> $(REPORT_DIR)/posix_compliance_report.json
+	@echo "  \"timestamp\": \"$$(date -u +"%Y-%m-%dT%H:%M:%SZ")\"," >> $(REPORT_DIR)/posix_compliance_report.json
+	@echo "  \"seaweedfs_version\": \"$$($(WEED_BINARY) version 2>/dev/null | head -n1 | sed 's/\\/\\\\/g; s/\"/\\\"/g' || echo 'Unknown')\"," >> $(REPORT_DIR)/posix_compliance_report.json
+	@echo "  \"test_environment\": { \"os\": \"$$(uname -s)\", \"arch\": \"$$(uname -m)\" }," >> $(REPORT_DIR)/posix_compliance_report.json
+	@echo "  \"test_suites\": {" >> $(REPORT_DIR)/posix_compliance_report.json
+	@FIRST=true; \
+	for logfile in $(REPORT_DIR)/*.log; do \
+		if [ -f "$$logfile" ]; then \
+			basename=$$(basename "$$logfile" .log); \
+			if [ "$$FIRST" = "true" ]; then \
+				FIRST=false; \
+			else \
+				echo "    ," >> $(REPORT_DIR)/posix_compliance_report.json; \
+			fi; \
+			PASSED=$$(awk '/PASS:/{c++} END{print c+0}' "$$logfile" 2>/dev/null || echo 0); \
+			FAILED=$$(awk '/FAIL:/{c++} END{print c+0}' "$$logfile" 2>/dev/null || echo 0); \
+			TOTAL=$$(expr "$$PASSED" + "$$FAILED" 2>/dev/null || echo 0); \
+			echo "    \"$$basename\": {" >> $(REPORT_DIR)/posix_compliance_report.json; \
+			echo "      \"total_tests\": $$TOTAL," >> $(REPORT_DIR)/posix_compliance_report.json; \
+			echo "      \"passed\": $$PASSED," >> $(REPORT_DIR)/posix_compliance_report.json; \
+			echo "      \"failed\": $$FAILED," >> $(REPORT_DIR)/posix_compliance_report.json; \
+			if [ "$$TOTAL" -gt 0 ] 2>/dev/null; then \
+				SUCCESS_RATE=$$(awk "BEGIN {printf \"%.2f\", ($$PASSED/$$TOTAL)*100}" 2>/dev/null || echo "0.00"); \
+			else \
+				SUCCESS_RATE="0.00"; \
+			fi; \
+			echo "      \"success_rate\": \"$$SUCCESS_RATE%\"" >> $(REPORT_DIR)/posix_compliance_report.json; \
+			echo "    }" >> $(REPORT_DIR)/posix_compliance_report.json; \
+		fi; \
+	done
+	@echo "  }," >> $(REPORT_DIR)/posix_compliance_report.json
+	@TOTAL_PASSED=0; TOTAL_FAILED=0; \
+	for logfile in $(REPORT_DIR)/*.log; do \
+		if [ -f "$$logfile" ]; then \
+			PASSED=$$(awk '/PASS:/{c++} END{print c+0}' "$$logfile" 2>/dev/null || echo 0); \
+			FAILED=$$(awk '/FAIL:/{c++} END{print c+0}' "$$logfile" 2>/dev/null || echo 0); \
+			TOTAL_PASSED=$$(expr "$$TOTAL_PASSED" + "$$PASSED" 2>/dev/null || echo "$$TOTAL_PASSED"); \
+			TOTAL_FAILED=$$(expr "$$TOTAL_FAILED" + "$$FAILED" 2>/dev/null || echo "$$TOTAL_FAILED"); \
+		fi; \
+	done; \
+	GRAND_TOTAL=$$(expr "$$TOTAL_PASSED" + "$$TOTAL_FAILED" 2>/dev/null || echo 0); \
+	if [ "$$GRAND_TOTAL" -gt 0 ] 2>/dev/null; then \
+		OVERALL_SUCCESS=$$(awk "BEGIN {printf \"%.2f\", ($$TOTAL_PASSED/$$GRAND_TOTAL)*100}" 2>/dev/null || echo "0.00"); \
+	else \
+		OVERALL_SUCCESS="0.00"; \
+	fi; \
+	echo "  \"summary\": {" >> $(REPORT_DIR)/posix_compliance_report.json; \
+	echo "    \"total_tests\": $$GRAND_TOTAL," >> $(REPORT_DIR)/posix_compliance_report.json; \
+	echo "    \"total_passed\": $$TOTAL_PASSED," >> $(REPORT_DIR)/posix_compliance_report.json; \
+	echo "    \"total_failed\": $$TOTAL_FAILED," >> $(REPORT_DIR)/posix_compliance_report.json; \
+	echo "    \"overall_success_rate\": \"$$OVERALL_SUCCESS%\"" >> $(REPORT_DIR)/posix_compliance_report.json; \
+	echo "  }" >> $(REPORT_DIR)/posix_compliance_report.json
+	@echo "}" >> $(REPORT_DIR)/posix_compliance_report.json
+	@echo "$(GREEN)[OK] JSON report generated: $(REPORT_DIR)/posix_compliance_report.json$(RESET)"
+
+# Cleanup and maintenance
+clean:
+	@echo "$(YELLOW)🧹 Cleaning up test artifacts...$(RESET)"
+	@rm -rf $(REPORT_DIR)
+	@rm -rf /tmp/seaweedfs_*_test_*
+	@go clean -testcache
+	@echo "$(GREEN)[OK] Cleanup complete$(RESET)"
+
+clean-external-tools:
+	@echo "$(YELLOW)🧹 Cleaning up external tools...$(RESET)"
+	@rm -rf $(EXTERNAL_TOOLS_DIR)
+
+clean-all: clean clean-external-tools
+
+# Development and debugging
+validate:
+	@echo "$(BLUE)[OK] Validating test files...$(RESET)"
+	@go build -o /dev/null ./...
+	@echo "$(GREEN)[OK] All test files compile successfully$(RESET)"
+
+fmt:
+	@echo "$(BLUE)🎨 Formatting Go code...$(RESET)"
+	@go fmt ./...
+
+lint:
+	@echo "$(BLUE)🔍 Running linter...$(RESET)"
+	@if command -v golangci-lint >/dev/null 2>&1; then \
+		golangci-lint run; \
+	else \
+					echo "$(YELLOW)[WARNING] golangci-lint not found, running go vet instead$(RESET)"; \
+		go vet ./...; \
+	fi
+
+# CI/CD integration
+ci-posix-tests: check-prereqs setup-external-tools
+	@echo "$(CYAN)🚀 Running POSIX tests for CI/CD...$(RESET)"
+	@$(MAKE_SELF) test-posix-critical
+	@$(MAKE_SELF) generate-report
+
+
+
+# Documentation and help
+list-tests:
+	@echo "$(BLUE)📋 Available POSIX test functions:$(RESET)"
+	@grep -r "^func Test" *.go 2>/dev/null | sed 's/.*func \(Test[^(]*\).*/  \1/' | sort || echo "No test files found"
+
+test-info:
+	@echo "$(BLUE)[INFO] POSIX Test Information:$(RESET)"
+	@echo "Test files:"
+	@echo "  - $(POSIX_BASIC_TESTS): Core POSIX compliance tests"
+	@echo "  - $(POSIX_EXTENDED_TESTS): Extended POSIX feature tests"  
+	@echo "  - $(POSIX_EXTERNAL_TESTS): External test suite integration"
+	@echo ""
+	@echo "External tools:"
+	@echo "  - pjdfstest: Comprehensive POSIX filesystem test suite"
+	@echo "  - nfstest: Network filesystem POSIX API verification"
+	@echo "  - FIO: Flexible I/O performance testing"
+
+help:
+	@echo "$(CYAN)SeaweedFS POSIX Compliance Testing$(RESET)"
+	@echo "=================================="
+	@echo ""
+	@echo "$(WHITE)Prerequisites:$(RESET)"
+	@echo "  $(GREEN)make check-prereqs$(RESET)      - Check all prerequisites"
+	@echo "  $(GREEN)make setup-external-tools$(RESET) - Setup external POSIX test tools"
+	@echo ""
+	@echo "$(WHITE)Core POSIX Tests:$(RESET)"
+	@echo "  $(GREEN)make test-posix-basic$(RESET)    - Run basic POSIX compliance tests"
+	@echo "  $(GREEN)make test-posix-extended$(RESET) - Run extended POSIX feature tests"
+	@echo "  $(GREEN)make test-posix-external$(RESET) - Run external test suite integration"
+	@echo "  $(GREEN)make test-posix-full$(RESET)     - Run complete POSIX test suite"
+	@echo ""
+	@echo "$(WHITE)Focused Tests:$(RESET)"
+	@echo "  $(GREEN)make test-posix-critical$(RESET) - Run critical POSIX compliance tests"
+	@echo "  $(GREEN)make test-posix-stress$(RESET)   - Run POSIX stress tests"
+	@echo ""
+	@echo "$(WHITE)Performance & Analysis:$(RESET)"
+	@echo "  $(GREEN)make benchmark-posix$(RESET)     - Run POSIX performance benchmarks"
+	@echo "  $(GREEN)make profile-posix$(RESET)       - Run tests with performance profiling"
+	@echo "  $(GREEN)make coverage-posix$(RESET)      - Run tests with coverage analysis"
+	@echo "  $(GREEN)make test-fio-posix$(RESET)      - Run FIO-based I/O performance tests"
+	@echo ""
+	@echo "$(WHITE)External Test Suites:$(RESET)"
+	@echo "  $(GREEN)make test-pjdfstest$(RESET)      - Run pjdfstest suite"
+	@echo "  $(GREEN)make test-nfstest-posix$(RESET)  - Run nfstest_posix"
+	@echo ""
+	@echo "$(WHITE)Reporting:$(RESET)"
+	@echo "  $(GREEN)make generate-report$(RESET)     - Generate comprehensive compliance report"
+	@echo ""
+	@echo "$(WHITE)Development:$(RESET)"
+	@echo "  $(GREEN)make validate$(RESET)            - Validate test file compilation"
+	@echo "  $(GREEN)make fmt$(RESET)                 - Format Go code"
+	@echo "  $(GREEN)make lint$(RESET)                - Run linter"
+	@echo "  $(GREEN)make list-tests$(RESET)          - List available test functions"
+	@echo ""
+	@echo "$(WHITE)Maintenance:$(RESET)"
+	@echo "  $(GREEN)make clean$(RESET)               - Clean up test artifacts"
+	@echo "  $(GREEN)make clean-all$(RESET)           - Clean everything including external tools"
+	@echo ""
+	@echo "$(WHITE)CI/CD Integration:$(RESET)"
+	@echo "  $(GREEN)make ci-posix-tests$(RESET)      - Run POSIX tests optimized for CI/CD"
+
+
+.PHONY: help check-prereqs check-binary check-fuse check-go setup-reports \
+        setup-external-tools setup-pjdfstest setup-nfstest setup-fio \
+        test-posix-basic test-posix-extended test-posix-external test-posix-full \
+        test-posix-critical test-posix-stress benchmark-posix profile-posix coverage-posix \
+        test-pjdfstest test-nfstest-posix test-fio-posix create-fio-configs \
+        generate-report generate-html-report generate-text-report generate-json-report \
+        clean clean-external-tools clean-all validate fmt lint ci-posix-tests \
+        list-tests test-info
diff --git a/test/fuse_integration/posix_compliance_test.go b/test/fuse_integration/posix_compliance_test.go
new file mode 100644
index 0000000000..6ce17a3a40
--- /dev/null
+++ b/test/fuse_integration/posix_compliance_test.go
@@ -0,0 +1,713 @@
+//go:build !windows
+
+package fuse
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// POSIXComplianceTestSuite provides comprehensive POSIX compliance testing for FUSE mounts
+type POSIXComplianceTestSuite struct {
+	framework *FuseTestFramework
+	t         *testing.T
+}
+
+// NewPOSIXComplianceTestSuite creates a new POSIX compliance test suite
+func NewPOSIXComplianceTestSuite(t *testing.T, framework *FuseTestFramework) *POSIXComplianceTestSuite {
+	return &POSIXComplianceTestSuite{
+		framework: framework,
+		t:         t,
+	}
+}
+
+// TestPOSIXCompliance runs all POSIX compliance tests
+func TestPOSIXCompliance(t *testing.T) {
+	config := DefaultTestConfig()
+	config.EnableDebug = true
+	config.MountOptions = []string{"-allowOthers", "-nonempty"}
+
+	framework := NewFuseTestFramework(t, config)
+	defer framework.Cleanup()
+	require.NoError(t, framework.Setup(config))
+
+	suite := NewPOSIXComplianceTestSuite(t, framework)
+
+	// Run all POSIX compliance test categories
+	t.Run("FileOperations", suite.TestFileOperations)
+	t.Run("DirectoryOperations", suite.TestDirectoryOperations)
+	t.Run("SymlinkOperations", suite.TestSymlinkOperations)
+	t.Run("PermissionTests", suite.TestPermissions)
+	t.Run("TimestampTests", suite.TestTimestamps)
+	t.Run("IOOperations", suite.TestIOOperations)
+	t.Run("FileDescriptorTests", suite.TestFileDescriptors)
+	t.Run("AtomicOperations", suite.TestAtomicOperations)
+	t.Run("ConcurrentAccess", suite.TestConcurrentAccess)
+	t.Run("ErrorHandling", suite.TestErrorHandling)
+}
+
+// TestFileOperations tests POSIX file operation compliance
+func (s *POSIXComplianceTestSuite) TestFileOperations(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("CreateFile", func(t *testing.T) {
+		filepath := filepath.Join(mountPoint, "test_create.txt")
+
+		// Test file creation with O_CREAT
+		fd, err := syscall.Open(filepath, syscall.O_CREAT|syscall.O_WRONLY, 0644)
+		require.NoError(t, err)
+		require.Greater(t, fd, 0)
+
+		err = syscall.Close(fd)
+		require.NoError(t, err)
+
+		// Verify file exists
+		_, err = os.Stat(filepath)
+		require.NoError(t, err)
+	})
+
+	t.Run("CreateExclusiveFile", func(t *testing.T) {
+		filepath := filepath.Join(mountPoint, "test_excl.txt")
+
+		// First creation should succeed
+		fd, err := syscall.Open(filepath, syscall.O_CREAT|syscall.O_EXCL|syscall.O_WRONLY, 0644)
+		require.NoError(t, err)
+		syscall.Close(fd)
+
+		// Second creation should fail with EEXIST
+		_, err = syscall.Open(filepath, syscall.O_CREAT|syscall.O_EXCL|syscall.O_WRONLY, 0644)
+		require.Error(t, err)
+		require.Equal(t, syscall.EEXIST, err)
+	})
+
+	t.Run("TruncateFile", func(t *testing.T) {
+		filepath := filepath.Join(mountPoint, "test_truncate.txt")
+		content := []byte("Hello, World! This is a test file for truncation.")
+
+		// Create file with content
+		err := os.WriteFile(filepath, content, 0644)
+		require.NoError(t, err)
+
+		// Truncate to 5 bytes
+		err = syscall.Truncate(filepath, 5)
+		require.NoError(t, err)
+
+		// Verify truncation
+		readContent, err := os.ReadFile(filepath)
+		require.NoError(t, err)
+		require.Equal(t, []byte("Hello"), readContent)
+	})
+
+	t.Run("UnlinkFile", func(t *testing.T) {
+		filepath := filepath.Join(mountPoint, "test_unlink.txt")
+
+		// Create file
+		err := os.WriteFile(filepath, []byte("test"), 0644)
+		require.NoError(t, err)
+
+		// Unlink file
+		err = syscall.Unlink(filepath)
+		require.NoError(t, err)
+
+		// Verify file no longer exists
+		_, err = os.Stat(filepath)
+		require.True(t, os.IsNotExist(err))
+	})
+}
+
+// TestDirectoryOperations tests POSIX directory operation compliance
+func (s *POSIXComplianceTestSuite) TestDirectoryOperations(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("CreateDirectory", func(t *testing.T) {
+		dirPath := filepath.Join(mountPoint, "test_mkdir")
+
+		err := syscall.Mkdir(dirPath, 0755)
+		require.NoError(t, err)
+
+		// Verify directory exists and has correct type
+		stat, err := os.Stat(dirPath)
+		require.NoError(t, err)
+		require.True(t, stat.IsDir())
+	})
+
+	t.Run("RemoveDirectory", func(t *testing.T) {
+		dirPath := filepath.Join(mountPoint, "test_rmdir")
+
+		// Create directory
+		err := os.Mkdir(dirPath, 0755)
+		require.NoError(t, err)
+
+		// Remove directory
+		err = syscall.Rmdir(dirPath)
+		require.NoError(t, err)
+
+		// Verify directory no longer exists
+		_, err = os.Stat(dirPath)
+		require.True(t, os.IsNotExist(err))
+	})
+
+	t.Run("RemoveNonEmptyDirectory", func(t *testing.T) {
+		dirPath := filepath.Join(mountPoint, "test_rmdir_nonempty")
+		filePath := filepath.Join(dirPath, "file.txt")
+
+		// Create directory and file
+		err := os.Mkdir(dirPath, 0755)
+		require.NoError(t, err)
+		err = os.WriteFile(filePath, []byte("test"), 0644)
+		require.NoError(t, err)
+
+		// Attempt to remove non-empty directory should fail
+		err = syscall.Rmdir(dirPath)
+		require.Error(t, err)
+		require.Equal(t, syscall.ENOTEMPTY, err)
+	})
+
+	t.Run("RenameDirectory", func(t *testing.T) {
+		oldPath := filepath.Join(mountPoint, "old_dir")
+		newPath := filepath.Join(mountPoint, "new_dir")
+
+		// Create directory
+		err := os.Mkdir(oldPath, 0755)
+		require.NoError(t, err)
+
+		// Rename directory
+		err = os.Rename(oldPath, newPath)
+		require.NoError(t, err)
+
+		// Verify old path doesn't exist and new path does
+		_, err = os.Stat(oldPath)
+		require.True(t, os.IsNotExist(err))
+		stat, err := os.Stat(newPath)
+		require.NoError(t, err)
+		require.True(t, stat.IsDir())
+	})
+}
+
+// TestSymlinkOperations tests POSIX symlink operation compliance
+func (s *POSIXComplianceTestSuite) TestSymlinkOperations(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("CreateSymlink", func(t *testing.T) {
+		targetFile := filepath.Join(mountPoint, "target.txt")
+		linkFile := filepath.Join(mountPoint, "link.txt")
+
+		// Create target file
+		err := os.WriteFile(targetFile, []byte("target content"), 0644)
+		require.NoError(t, err)
+
+		// Create symlink
+		err = os.Symlink(targetFile, linkFile)
+		require.NoError(t, err)
+
+		// Verify symlink properties
+		linkStat, err := os.Lstat(linkFile)
+		require.NoError(t, err)
+		require.Equal(t, os.ModeSymlink, linkStat.Mode()&os.ModeType)
+
+		// Verify symlink content
+		linkTarget, err := os.Readlink(linkFile)
+		require.NoError(t, err)
+		require.Equal(t, targetFile, linkTarget)
+
+		// Verify following symlink works
+		content, err := os.ReadFile(linkFile)
+		require.NoError(t, err)
+		require.Equal(t, []byte("target content"), content)
+	})
+
+	t.Run("BrokenSymlink", func(t *testing.T) {
+		nonexistentTarget := filepath.Join(mountPoint, "nonexistent.txt")
+		linkFile := filepath.Join(mountPoint, "broken_link.txt")
+
+		// Create symlink to nonexistent file
+		err := os.Symlink(nonexistentTarget, linkFile)
+		require.NoError(t, err)
+
+		// Lstat should work (doesn't follow symlink)
+		_, err = os.Lstat(linkFile)
+		require.NoError(t, err)
+
+		// Stat should fail (follows symlink to nonexistent target)
+		_, err = os.Stat(linkFile)
+		require.Error(t, err)
+		require.True(t, os.IsNotExist(err))
+	})
+}
+
+// TestPermissions tests POSIX permission compliance
+func (s *POSIXComplianceTestSuite) TestPermissions(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("FilePermissions", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "perm_test.txt")
+
+		// Create file with specific permissions
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_WRONLY, 0642)
+		require.NoError(t, err)
+		syscall.Close(fd)
+
+		// Verify permissions
+		stat, err := os.Stat(testFile)
+		require.NoError(t, err)
+
+		// Note: The final file permissions are affected by the system's umask.
+		// We check against the requested mode and the mode as affected by a common umask (e.g. 0022).
+		actualMode := stat.Mode() & os.ModePerm
+		expectedMode := os.FileMode(0642)
+		expectedModeWithUmask := os.FileMode(0640) // e.g., 0642 with umask 0002 or 0022
+
+		// Accept either the exact permissions or permissions as modified by umask
+		if actualMode != expectedMode && actualMode != expectedModeWithUmask {
+			t.Errorf("Expected file permissions %o or %o, but got %o",
+				expectedMode, expectedModeWithUmask, actualMode)
+		}
+	})
+
+	t.Run("ChangeFilePermissions", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "chmod_test.txt")
+
+		// Create file
+		err := os.WriteFile(testFile, []byte("test"), 0644)
+		require.NoError(t, err)
+
+		// Change permissions
+		err = os.Chmod(testFile, 0755)
+		require.NoError(t, err)
+
+		// Verify new permissions
+		stat, err := os.Stat(testFile)
+		require.NoError(t, err)
+		require.Equal(t, os.FileMode(0755), stat.Mode()&os.ModePerm)
+	})
+
+	t.Run("DirectoryPermissions", func(t *testing.T) {
+		testDir := filepath.Join(mountPoint, "perm_dir")
+
+		// Create directory with specific permissions
+		err := syscall.Mkdir(testDir, 0750)
+		require.NoError(t, err)
+
+		// Verify permissions
+		stat, err := os.Stat(testDir)
+		require.NoError(t, err)
+		require.Equal(t, os.FileMode(0750)|os.ModeDir, stat.Mode())
+	})
+}
+
+// TestTimestamps tests POSIX timestamp compliance
+func (s *POSIXComplianceTestSuite) TestTimestamps(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("AccessTime", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "atime_test.txt")
+
+		// Create file
+		err := os.WriteFile(testFile, []byte("test content"), 0644)
+		require.NoError(t, err)
+
+		// Get initial timestamps
+		stat1, err := os.Stat(testFile)
+		require.NoError(t, err)
+
+		// Wait a bit to ensure time difference
+		time.Sleep(100 * time.Millisecond)
+
+		// Read file (should update access time)
+		_, err = os.ReadFile(testFile)
+		require.NoError(t, err)
+
+		// Get new timestamps
+		stat2, err := os.Stat(testFile)
+		require.NoError(t, err)
+
+		// Access time should have been updated, and modification time should be unchanged.
+		stat1Sys := stat1.Sys().(*syscall.Stat_t)
+		stat2Sys := stat2.Sys().(*syscall.Stat_t)
+		require.True(t, getAtimeNano(stat2Sys) >= getAtimeNano(stat1Sys), "access time should be updated or stay the same")
+		require.Equal(t, stat1.ModTime(), stat2.ModTime(), "modification time should not change on read")
+	})
+
+	t.Run("ModificationTime", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "mtime_test.txt")
+
+		// Create file
+		err := os.WriteFile(testFile, []byte("initial content"), 0644)
+		require.NoError(t, err)
+
+		// Get initial timestamp
+		stat1, err := os.Stat(testFile)
+		require.NoError(t, err)
+
+		// Wait to ensure time difference
+		time.Sleep(100 * time.Millisecond)
+
+		// Modify file
+		err = os.WriteFile(testFile, []byte("modified content"), 0644)
+		require.NoError(t, err)
+
+		// Get new timestamp
+		stat2, err := os.Stat(testFile)
+		require.NoError(t, err)
+
+		// Modification time should have changed
+		require.True(t, stat2.ModTime().After(stat1.ModTime()))
+	})
+
+	t.Run("SetTimestamps", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "utime_test.txt")
+
+		// Create file
+		err := os.WriteFile(testFile, []byte("test"), 0644)
+		require.NoError(t, err)
+
+		// Set specific timestamps
+		atime := time.Now().Add(-24 * time.Hour)
+		mtime := time.Now().Add(-12 * time.Hour)
+
+		err = os.Chtimes(testFile, atime, mtime)
+		require.NoError(t, err)
+
+		// Verify timestamps were set
+		stat, err := os.Stat(testFile)
+		require.NoError(t, err)
+		require.True(t, stat.ModTime().Equal(mtime))
+	})
+}
+
+// TestIOOperations tests POSIX I/O operation compliance
+func (s *POSIXComplianceTestSuite) TestIOOperations(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("ReadWrite", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "rw_test.txt")
+		testData := []byte("Hello, POSIX World!")
+
+		// Write data
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_WRONLY, 0644)
+		require.NoError(t, err)
+
+		n, err := syscall.Write(fd, testData)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+
+		err = syscall.Close(fd)
+		require.NoError(t, err)
+
+		// Read data back
+		fd, err = syscall.Open(testFile, syscall.O_RDONLY, 0)
+		require.NoError(t, err)
+
+		readBuffer := make([]byte, len(testData))
+		n, err = syscall.Read(fd, readBuffer)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+		require.Equal(t, testData, readBuffer)
+
+		err = syscall.Close(fd)
+		require.NoError(t, err)
+	})
+
+	t.Run("Seek", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "seek_test.txt")
+		testData := []byte("0123456789ABCDEF")
+
+		// Create file with test data
+		err := os.WriteFile(testFile, testData, 0644)
+		require.NoError(t, err)
+
+		// Open for reading
+		fd, err := syscall.Open(testFile, syscall.O_RDONLY, 0)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Seek to position 5
+		pos, err := syscall.Seek(fd, 5, 0) // SEEK_SET
+		require.NoError(t, err)
+		require.Equal(t, int64(5), pos)
+
+		// Read 3 bytes
+		buffer := make([]byte, 3)
+		n, err := syscall.Read(fd, buffer)
+		require.NoError(t, err)
+		require.Equal(t, 3, n)
+		require.Equal(t, []byte("567"), buffer)
+
+		// Seek from current position
+		pos, err = syscall.Seek(fd, 2, 1) // SEEK_CUR
+		require.NoError(t, err)
+		require.Equal(t, int64(10), pos)
+
+		// Read 1 byte
+		buffer = make([]byte, 1)
+		n, err = syscall.Read(fd, buffer)
+		require.NoError(t, err)
+		require.Equal(t, 1, n)
+		require.Equal(t, []byte("A"), buffer)
+
+		// Test positioned I/O operations (pread/pwrite)
+		syscall.Close(fd)
+
+		// Open for read/write to test pwrite
+		fd, err = syscall.Open(testFile, syscall.O_RDWR, 0)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Positioned write test
+		writeData := []byte("XYZ")
+		n, err = syscall.Pwrite(fd, writeData, 5) // pwrite at offset 5
+		require.NoError(t, err)
+		require.Equal(t, len(writeData), n)
+
+		// Verify file position is unchanged by pwrite
+		currentPos, err := syscall.Seek(fd, 0, 1) // SEEK_CUR
+		require.NoError(t, err)
+		require.Equal(t, int64(0), currentPos, "file offset should not be changed by pwrite")
+
+		// Read back with pread
+		readBuffer := make([]byte, len(writeData))
+		n, err = syscall.Pread(fd, readBuffer, 5) // pread at offset 5
+		require.NoError(t, err)
+		require.Equal(t, len(writeData), n)
+		require.Equal(t, writeData, readBuffer)
+
+		// Verify file position is still unchanged by pread
+		currentPos, err = syscall.Seek(fd, 0, 1) // SEEK_CUR
+		require.NoError(t, err)
+		require.Equal(t, int64(0), currentPos, "file offset should not be changed by pread")
+	})
+
+	t.Run("AppendMode", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "append_test.txt")
+
+		// Create file with initial content
+		err := os.WriteFile(testFile, []byte("initial"), 0644)
+		require.NoError(t, err)
+
+		// Open in append mode
+		fd, err := syscall.Open(testFile, syscall.O_WRONLY|syscall.O_APPEND, 0)
+		require.NoError(t, err)
+
+		// Write additional content
+		appendData := []byte(" appended")
+		n, err := syscall.Write(fd, appendData)
+		require.NoError(t, err)
+		require.Equal(t, len(appendData), n)
+
+		err = syscall.Close(fd)
+		require.NoError(t, err)
+
+		// Verify content
+		content, err := os.ReadFile(testFile)
+		require.NoError(t, err)
+		require.Equal(t, []byte("initial appended"), content)
+	})
+}
+
+// TestFileDescriptors tests POSIX file descriptor behavior
+func (s *POSIXComplianceTestSuite) TestFileDescriptors(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("DuplicateFileDescriptors", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "dup_test.txt")
+		testData := []byte("duplicate test")
+
+		// Create and open file
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_RDWR, 0644)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Write initial data
+		n, err := syscall.Write(fd, testData)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+
+		// Duplicate file descriptor
+		dupFd, err := syscall.Dup(fd)
+		require.NoError(t, err)
+		defer syscall.Close(dupFd)
+
+		// Both descriptors should refer to the same file
+		// Seek on one should affect the other
+		pos, err := syscall.Seek(fd, 0, 0) // SEEK_SET
+		require.NoError(t, err)
+		require.Equal(t, int64(0), pos)
+
+		// Read from duplicate descriptor should start from position 0
+		buffer := make([]byte, 9)
+		n, err = syscall.Read(dupFd, buffer)
+		require.NoError(t, err)
+		require.Equal(t, 9, n)
+		require.Equal(t, []byte("duplicate"), buffer)
+	})
+
+	t.Run("FileDescriptorFlags", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "flags_test.txt")
+
+		// Create file
+		err := os.WriteFile(testFile, []byte("test"), 0644)
+		require.NoError(t, err)
+
+		// Open with close-on-exec flag
+		fd, err := syscall.Open(testFile, syscall.O_RDONLY|syscall.O_CLOEXEC, 0)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Verify close-on-exec flag is set
+		// Note: FcntlInt is not available on all platforms, this test may need platform-specific implementation
+		t.Skip("FcntlInt not available on this platform")
+	})
+}
+
+// TestAtomicOperations tests POSIX atomic operation compliance
+func (s *POSIXComplianceTestSuite) TestAtomicOperations(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("AtomicRename", func(t *testing.T) {
+		oldFile := filepath.Join(mountPoint, "atomic_old.txt")
+		newFile := filepath.Join(mountPoint, "atomic_new.txt")
+		testData := []byte("atomic test data")
+
+		// Create source file
+		err := os.WriteFile(oldFile, testData, 0644)
+		require.NoError(t, err)
+
+		// Create existing target file
+		err = os.WriteFile(newFile, []byte("old content"), 0644)
+		require.NoError(t, err)
+
+		// Atomic rename should replace target
+		err = os.Rename(oldFile, newFile)
+		require.NoError(t, err)
+
+		// Verify source no longer exists
+		_, err = os.Stat(oldFile)
+		require.True(t, os.IsNotExist(err))
+
+		// Verify target has new content
+		content, err := os.ReadFile(newFile)
+		require.NoError(t, err)
+		require.Equal(t, testData, content)
+	})
+}
+
+// TestConcurrentAccess tests concurrent access patterns
+func (s *POSIXComplianceTestSuite) TestConcurrentAccess(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("ConcurrentReads", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "concurrent_read.txt")
+		testData := []byte("concurrent read test data")
+
+		// Create test file
+		err := os.WriteFile(testFile, testData, 0644)
+		require.NoError(t, err)
+
+		// Launch multiple concurrent readers
+		const numReaders = 10
+		results := make(chan error, numReaders)
+
+		for i := 0; i < numReaders; i++ {
+			go func() {
+				content, err := os.ReadFile(testFile)
+				if err != nil {
+					results <- err
+					return
+				}
+				if string(content) != string(testData) {
+					results <- fmt.Errorf("content mismatch")
+					return
+				}
+				results <- nil
+			}()
+		}
+
+		// Check all readers succeeded
+		for i := 0; i < numReaders; i++ {
+			err := <-results
+			require.NoError(t, err)
+		}
+	})
+
+	t.Run("ConcurrentFileCreations", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "concurrent_write.txt")
+
+		// Launch multiple concurrent writers
+		const numWriters = 5
+		results := make(chan error, numWriters)
+
+		for i := 0; i < numWriters; i++ {
+			go func(id int) {
+				content := fmt.Sprintf("writer %d data", id)
+				err := os.WriteFile(fmt.Sprintf("%s_%d", testFile, id), []byte(content), 0644)
+				results <- err
+			}(i)
+		}
+
+		// Check all writers succeeded
+		for i := 0; i < numWriters; i++ {
+			err := <-results
+			require.NoError(t, err)
+		}
+
+		// Verify all files were created
+		for i := 0; i < numWriters; i++ {
+			fileName := fmt.Sprintf("%s_%d", testFile, i)
+			_, err := os.Stat(fileName)
+			require.NoError(t, err)
+		}
+	})
+}
+
+// TestErrorHandling tests POSIX error handling compliance
+func (s *POSIXComplianceTestSuite) TestErrorHandling(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("AccessNonexistentFile", func(t *testing.T) {
+		nonexistentFile := filepath.Join(mountPoint, "does_not_exist.txt")
+
+		// Reading nonexistent file should return ENOENT
+		_, err := os.ReadFile(nonexistentFile)
+		require.Error(t, err)
+		require.True(t, os.IsNotExist(err))
+	})
+
+	t.Run("CreateFileInNonexistentDirectory", func(t *testing.T) {
+		fileInNonexistentDir := filepath.Join(mountPoint, "nonexistent_dir", "file.txt")
+
+		// Creating file in nonexistent directory should fail
+		err := os.WriteFile(fileInNonexistentDir, []byte("test"), 0644)
+		require.Error(t, err)
+		require.True(t, os.IsNotExist(err))
+	})
+
+	t.Run("InvalidFileDescriptor", func(t *testing.T) {
+		// Using an invalid file descriptor should return appropriate error
+		buffer := make([]byte, 10)
+		_, err := syscall.Read(999, buffer) // 999 is likely an invalid fd
+		require.Error(t, err)
+		require.Equal(t, syscall.EBADF, err)
+	})
+
+	t.Run("PermissionDenied", func(t *testing.T) {
+		if os.Geteuid() == 0 {
+			t.Skip("running as root: mode bits are not enforced")
+		}
+		testFile := filepath.Join(mountPoint, "readonly.txt")
+
+		// Create read-only file
+		err := os.WriteFile(testFile, []byte("readonly"), 0444)
+		require.NoError(t, err)
+
+		// Attempting to write to read-only file should fail
+		err = os.WriteFile(testFile, []byte("modified"), 0444)
+		require.Error(t, err)
+		require.True(t, os.IsPermission(err))
+	})
+}
diff --git a/test/fuse_integration/posix_extended_test.go b/test/fuse_integration/posix_extended_test.go
new file mode 100644
index 0000000000..7e8cbd7724
--- /dev/null
+++ b/test/fuse_integration/posix_extended_test.go
@@ -0,0 +1,758 @@
+//go:build !windows
+
+package fuse
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// POSIXExtendedTestSuite provides additional POSIX compliance tests
+// covering extended attributes, file locking, and advanced features.
+//
+// NOTE: Some tests in this suite may be skipped or may have different behavior
+// depending on the FUSE implementation and platform support. This is expected
+// behavior for comprehensive POSIX compliance testing.
+//
+// See POSIX_IMPLEMENTATION_ROADMAP.md for a comprehensive plan to implement
+// these missing features.
+type POSIXExtendedTestSuite struct {
+	framework *FuseTestFramework
+	t         *testing.T
+}
+
+// ErrorCollector helps collect multiple test errors without stopping execution
+type ErrorCollector struct {
+	errors []string
+	t      *testing.T
+}
+
+// NewErrorCollector creates a new error collector
+func NewErrorCollector(t *testing.T) *ErrorCollector {
+	return &ErrorCollector{
+		errors: make([]string, 0),
+		t:      t,
+	}
+}
+
+// Add adds an error to the collection
+func (ec *ErrorCollector) Add(format string, args ...interface{}) {
+	ec.errors = append(ec.errors, fmt.Sprintf(format, args...))
+}
+
+// Check checks a condition and adds an error if it fails
+func (ec *ErrorCollector) Check(condition bool, format string, args ...interface{}) {
+	if !condition {
+		ec.Add(format, args...)
+	}
+}
+
+// CheckError checks if an error is nil and adds it if not
+func (ec *ErrorCollector) CheckError(err error, format string, args ...interface{}) {
+	if err != nil {
+		ec.Add(format+": %v", append(args, err)...)
+	}
+}
+
+// HasErrors returns true if any errors were collected
+func (ec *ErrorCollector) HasErrors() bool {
+	return len(ec.errors) > 0
+}
+
+// Report reports all collected errors to the test
+func (ec *ErrorCollector) Report() {
+	if len(ec.errors) > 0 {
+		ec.t.Errorf("Test completed with %d errors:\n%s", len(ec.errors), strings.Join(ec.errors, "\n"))
+	}
+}
+
+// NewPOSIXExtendedTestSuite creates a new extended POSIX compliance test suite
+func NewPOSIXExtendedTestSuite(t *testing.T, framework *FuseTestFramework) *POSIXExtendedTestSuite {
+	return &POSIXExtendedTestSuite{
+		framework: framework,
+		t:         t,
+	}
+}
+
+// TestPOSIXExtended runs extended POSIX compliance tests
+func TestPOSIXExtended(t *testing.T) {
+	config := DefaultTestConfig()
+	config.EnableDebug = true
+	config.MountOptions = []string{"-allowOthers", "-nonempty"}
+
+	framework := NewFuseTestFramework(t, config)
+	defer framework.Cleanup()
+
+	// Setup framework with better error handling
+	err := framework.Setup(config)
+	if err != nil {
+		t.Logf("Framework setup failed: %v", err)
+		t.Skip("Skipping extended tests due to framework setup failure")
+		return
+	}
+
+	// Verify framework is working
+	mountPoint := framework.GetMountPoint()
+	if mountPoint == "" {
+		t.Log("Framework mount point is empty")
+		t.Skip("Skipping extended tests due to invalid mount point")
+		return
+	}
+
+	suite := NewPOSIXExtendedTestSuite(t, framework)
+
+	// Run extended POSIX compliance test categories
+	// Use a resilient approach that continues even if individual tests fail
+	testCategories := []struct {
+		name string
+		fn   func(*testing.T)
+	}{
+		{"ExtendedAttributes", suite.TestExtendedAttributes},
+		{"FileLocking", suite.TestFileLocking},
+		{"AdvancedIO", suite.TestAdvancedIO},
+		{"SparseFiles", suite.TestSparseFiles},
+		{"LargeFiles", suite.TestLargeFiles},
+		{"MMap", suite.TestMemoryMapping},
+		{"DirectIO", suite.TestDirectIO},
+		{"FileSealing", suite.TestFileSealing},
+		{"Fallocate", suite.TestFallocate},
+		{"Sendfile", suite.TestSendfile},
+	}
+
+	// Run all test categories and collect results
+	var failedCategories []string
+	for _, category := range testCategories {
+		t.Run(category.name, func(subT *testing.T) {
+			// Capture panics and convert them to test failures
+			defer func() {
+				if r := recover(); r != nil {
+					subT.Errorf("Test category %s panicked: %v", category.name, r)
+					failedCategories = append(failedCategories, category.name)
+				}
+			}()
+
+			category.fn(subT)
+			if subT.Failed() {
+				failedCategories = append(failedCategories, category.name)
+			}
+		})
+	}
+
+	// Report overall results
+	if len(failedCategories) > 0 {
+		t.Logf("Extended POSIX tests completed. Failed categories: %v", failedCategories)
+	} else {
+		t.Logf("All extended POSIX test categories passed!")
+	}
+}
+
+// TestExtendedAttributes tests POSIX extended attribute support
+func (s *POSIXExtendedTestSuite) TestExtendedAttributes(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("SetAndGetXattr", func(t *testing.T) {
+		if !isXattrSupported() {
+			t.Skip("Extended attributes not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "xattr_test.txt")
+
+		// Create test file
+		err := os.WriteFile(testFile, []byte("xattr test"), 0644)
+		if !assert.NoError(t, err, "Failed to create test file") {
+			return
+		}
+
+		// Set extended attribute
+		attrName := "user.test_attr"
+		attrValue := []byte("test_value")
+		err = setXattr(testFile, attrName, attrValue, 0)
+		assert.NoError(t, err, "Failed to set extended attribute")
+
+		// Verify attribute was set
+		readValue := make([]byte, 256)
+		size, err := getXattr(testFile, attrName, readValue)
+		assert.NoError(t, err, "Failed to get extended attribute")
+		assert.Equal(t, len(attrValue), size, "Extended attribute size mismatch")
+		assert.Equal(t, attrValue, readValue[:size], "Extended attribute value mismatch")
+	})
+
+	t.Run("ListXattrs", func(t *testing.T) {
+		if !isXattrSupported() {
+			t.Skip("Extended attributes not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "xattr_list_test.txt")
+
+		// Create test file
+		err := os.WriteFile(testFile, []byte("list xattr test"), 0644)
+		if !assert.NoError(t, err, "Failed to create test file") {
+			return
+		}
+
+		// Set multiple extended attributes
+		attrs := map[string][]byte{
+			"user.attr1": []byte("value1"),
+			"user.attr2": []byte("value2"),
+			"user.attr3": []byte("value3"),
+		}
+
+		for name, value := range attrs {
+			err = setXattr(testFile, name, value, 0)
+			assert.NoError(t, err, "Failed to set extended attribute %s", name)
+		}
+
+		// List all attributes
+		listBuf := make([]byte, 1024)
+		size, err := listXattr(testFile, listBuf)
+		assert.NoError(t, err, "Failed to list extended attributes")
+		assert.Greater(t, size, 0, "No extended attributes found")
+
+		// Parse the null-separated list and verify attributes
+		if size > 0 {
+			attrList := parseXattrList(listBuf[:size])
+			expectedAttrs := []string{"user.attr1", "user.attr2", "user.attr3"}
+			for _, expectedAttr := range expectedAttrs {
+				assert.Contains(t, attrList, expectedAttr, "Expected attribute %s should be in the list", expectedAttr)
+			}
+		}
+	})
+
+	t.Run("RemoveXattr", func(t *testing.T) {
+		if !isXattrSupported() {
+			t.Skip("Extended attributes not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "xattr_remove_test.txt")
+
+		// Create test file
+		err := os.WriteFile(testFile, []byte("remove xattr test"), 0644)
+		require.NoError(t, err)
+
+		// Set extended attribute
+		attrName := "user.remove_test"
+		attrValue := []byte("to_be_removed")
+		err = setXattr(testFile, attrName, attrValue, 0)
+		require.NoError(t, err)
+
+		// Verify attribute exists
+		readValue := make([]byte, 256)
+		size, err := getXattr(testFile, attrName, readValue)
+		require.NoError(t, err)
+		require.Equal(t, len(attrValue), size)
+
+		// Remove the attribute
+		err = removeXattr(testFile, attrName)
+		require.NoError(t, err)
+
+		// Verify attribute is gone
+		_, err = getXattr(testFile, attrName, readValue)
+		require.Error(t, err) // Should fail with ENODATA or similar
+	})
+}
+
+// TestFileLocking tests POSIX file locking mechanisms
+// Note: File locking behavior may vary between FUSE implementations.
+// Some implementations may not enforce locks between file descriptors
+// from the same process, which is a known limitation.
+func (s *POSIXExtendedTestSuite) TestFileLocking(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("AdvisoryLocking", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "lock_test.txt")
+
+		// Create test file
+		err := os.WriteFile(testFile, []byte("locking test"), 0644)
+		if !assert.NoError(t, err, "Failed to create test file") {
+			return
+		}
+
+		// Open file
+		file, err := os.OpenFile(testFile, os.O_RDWR, 0644)
+		if !assert.NoError(t, err, "Failed to open test file") {
+			return
+		}
+		defer file.Close()
+
+		// Apply exclusive lock
+		flock := syscall.Flock_t{
+			Type:   syscall.F_WRLCK,
+			Whence: 0,
+			Start:  0,
+			Len:    0, // Lock entire file
+		}
+
+		err = syscall.FcntlFlock(file.Fd(), syscall.F_SETLK, &flock)
+		assert.NoError(t, err, "Failed to acquire exclusive lock")
+
+		// Try to lock from another file descriptor (should fail)
+		file2, err := os.OpenFile(testFile, os.O_RDWR, 0644)
+		if !assert.NoError(t, err, "Failed to open second file descriptor") {
+			return
+		}
+		defer file2.Close()
+
+		flock2 := syscall.Flock_t{
+			Type:   syscall.F_WRLCK,
+			Whence: 0,
+			Start:  0,
+			Len:    0,
+		}
+
+		// Note: Some FUSE implementations may not enforce file locking between file descriptors
+		// from the same process. This is a known limitation in some FUSE implementations.
+		err = syscall.FcntlFlock(file2.Fd(), syscall.F_SETLK, &flock2)
+		if err == syscall.EAGAIN {
+			// Lock was properly enforced
+			t.Log("File locking properly enforced between file descriptors")
+		} else if err == nil {
+			// Lock was not enforced (common in some FUSE implementations)
+			t.Log("File locking not enforced between file descriptors from same process (FUSE limitation)")
+		} else {
+			// Some other error occurred
+			t.Logf("File locking attempt resulted in error: %v", err)
+		}
+
+		// Log the actual error for debugging
+		t.Logf("File locking test completed with result: %v", err)
+
+		// Release lock
+		flock.Type = syscall.F_UNLCK
+		err = syscall.FcntlFlock(file.Fd(), syscall.F_SETLK, &flock)
+		assert.NoError(t, err, "Failed to release lock")
+
+		// Now second lock should succeed
+		err = syscall.FcntlFlock(file2.Fd(), syscall.F_SETLK, &flock2)
+		assert.NoError(t, err, "Failed to acquire lock after release")
+	})
+
+	t.Run("SharedLocking", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "shared_lock_test.txt")
+
+		// Create test file
+		err := os.WriteFile(testFile, []byte("shared locking test"), 0644)
+		if !assert.NoError(t, err, "Failed to create test file") {
+			return
+		}
+
+		// Open file for reading
+		file1, err := os.Open(testFile)
+		if !assert.NoError(t, err, "Failed to open first file descriptor") {
+			return
+		}
+		defer file1.Close()
+
+		file2, err := os.Open(testFile)
+		if !assert.NoError(t, err, "Failed to open second file descriptor") {
+			return
+		}
+		defer file2.Close()
+
+		// Apply shared locks (should both succeed)
+		flock1 := syscall.Flock_t{
+			Type:   syscall.F_RDLCK,
+			Whence: 0,
+			Start:  0,
+			Len:    0,
+		}
+
+		flock2 := syscall.Flock_t{
+			Type:   syscall.F_RDLCK,
+			Whence: 0,
+			Start:  0,
+			Len:    0,
+		}
+
+		err = syscall.FcntlFlock(file1.Fd(), syscall.F_SETLK, &flock1)
+		assert.NoError(t, err, "Failed to acquire first shared lock")
+
+		err = syscall.FcntlFlock(file2.Fd(), syscall.F_SETLK, &flock2)
+		assert.NoError(t, err, "Failed to acquire second shared lock")
+	})
+}
+
+// TestAdvancedIO tests advanced I/O operations
+// Note: Vectored I/O support may vary between FUSE implementations.
+// Some implementations may not properly support readv/writev operations.
+func (s *POSIXExtendedTestSuite) TestAdvancedIO(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("ReadWriteV", func(t *testing.T) {
+		if !isVectoredIOSupported() {
+			t.Skip("Vectored I/O not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "readwritev_test.txt")
+
+		// Create file
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_RDWR, 0644)
+		if !assert.NoError(t, err, "Failed to create test file") {
+			return
+		}
+		defer syscall.Close(fd)
+
+		// Prepare test data in multiple buffers
+		writeBuffers := [][]byte{
+			[]byte("Hello "),
+			[]byte("vectored "),
+			[]byte("I/O "),
+			[]byte("world!"),
+		}
+
+		// Write using writev
+		writeIOVs := makeIOVecs(writeBuffers)
+		t.Logf("Attempting vectored I/O write with %d buffers", len(writeIOVs))
+		totalWritten, err := writevFile(fd, writeIOVs)
+		if err != nil {
+			// Some FUSE implementations may not support vectored I/O properly
+			t.Logf("Vectored I/O write failed: %v - this may be a FUSE limitation", err)
+			t.Skip("Vectored I/O not properly supported by this FUSE implementation")
+			return
+		}
+
+		expectedTotal := 0
+		for _, buf := range writeBuffers {
+			expectedTotal += len(buf)
+		}
+		assert.Equal(t, expectedTotal, totalWritten, "Vectored write size mismatch")
+
+		// Seek back to beginning
+		_, err = syscall.Seek(fd, 0, 0)
+		if !assert.NoError(t, err, "Failed to seek to beginning") {
+			return
+		}
+
+		// Read using readv into multiple buffers
+		readBuffers := [][]byte{
+			make([]byte, 6), // "Hello "
+			make([]byte, 9), // "vectored "
+			make([]byte, 4), // "I/O "
+			make([]byte, 6), // "world!"
+		}
+
+		readIOVs := makeIOVecs(readBuffers)
+		t.Logf("Attempting vectored I/O read with %d buffers", len(readIOVs))
+		totalRead, err := readvFile(fd, readIOVs)
+		if err != nil {
+			t.Logf("Vectored I/O read failed: %v - this may be a FUSE limitation", err)
+			t.Skip("Vectored I/O not properly supported by this FUSE implementation")
+			return
+		}
+		assert.Equal(t, expectedTotal, totalRead, "Vectored read size mismatch")
+
+		// Verify data matches
+		for i, expected := range writeBuffers {
+			assert.Equal(t, expected, readBuffers[i], "Vectored I/O data mismatch at buffer %d", i)
+		}
+	})
+
+}
+
+// TestSparseFiles tests sparse file handling
+func (s *POSIXExtendedTestSuite) TestSparseFiles(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("CreateSparseFile", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "sparse_test.txt")
+
+		// Open file
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_RDWR, 0644)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Create a sparse file by seeking beyond end and writing
+		const sparseSize = 1024 * 1024 // 1MB
+		_, err = syscall.Seek(fd, sparseSize, 0)
+		require.NoError(t, err)
+
+		// Write at the end
+		endData := []byte("end")
+		n, err := syscall.Write(fd, endData)
+		require.NoError(t, err)
+		require.Equal(t, len(endData), n)
+
+		// Verify file size
+		stat, err := os.Stat(testFile)
+		require.NoError(t, err)
+		require.Equal(t, int64(sparseSize+len(endData)), stat.Size())
+
+		// Read from the beginning (should be zeros)
+		_, err = syscall.Seek(fd, 0, 0)
+		require.NoError(t, err)
+
+		buffer := make([]byte, 100)
+		n, err = syscall.Read(fd, buffer)
+		require.NoError(t, err)
+		require.Equal(t, 100, n)
+
+		// Should be all zeros
+		for _, b := range buffer {
+			require.Equal(t, byte(0), b)
+		}
+	})
+}
+
+// TestLargeFiles tests large file handling (>2GB)
+func (s *POSIXExtendedTestSuite) TestLargeFiles(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("LargeFileOperations", func(t *testing.T) {
+		testFile := filepath.Join(mountPoint, "large_file_test.txt")
+
+		// Open file
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_RDWR, 0644)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Seek to position > 2GB
+		const largeOffset = 3 * 1024 * 1024 * 1024 // 3GB
+		pos, err := syscall.Seek(fd, largeOffset, 0)
+		require.NoError(t, err)
+		require.Equal(t, int64(largeOffset), pos)
+
+		// Write at large offset
+		testData := []byte("large file data")
+		n, err := syscall.Write(fd, testData)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+
+		// Read back from large offset
+		_, err = syscall.Seek(fd, largeOffset, 0)
+		require.NoError(t, err)
+
+		readBuffer := make([]byte, len(testData))
+		n, err = syscall.Read(fd, readBuffer)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+		require.Equal(t, testData, readBuffer)
+	})
+}
+
+// TestMemoryMapping tests memory mapping functionality
+func (s *POSIXExtendedTestSuite) TestMemoryMapping(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("MmapFile", func(t *testing.T) {
+		if !isMmapSupported() {
+			t.Skip("Memory mapping not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "mmap_test.txt")
+		testData := make([]byte, 4096)
+		for i := range testData {
+			testData[i] = byte(i % 256)
+		}
+
+		// Create test file
+		err := os.WriteFile(testFile, testData, 0644)
+		require.NoError(t, err)
+
+		// Open file for reading
+		fd, err := syscall.Open(testFile, syscall.O_RDONLY, 0)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Memory map the file
+		mappedData, err := mmapFile(fd, 0, len(testData), PROT_READ, MAP_SHARED)
+		require.NoError(t, err)
+		defer munmapFile(mappedData)
+
+		// Verify mapped content matches original
+		require.Equal(t, testData, mappedData)
+	})
+
+	t.Run("MmapWrite", func(t *testing.T) {
+		if !isMmapSupported() {
+			t.Skip("Memory mapping not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "mmap_write_test.txt")
+		size := 4096
+
+		// Create empty file of specific size
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_RDWR, 0644)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		err = syscall.Ftruncate(fd, int64(size))
+		require.NoError(t, err)
+
+		// Memory map the file for writing
+		mappedData, err := mmapFile(fd, 0, size, PROT_READ|PROT_WRITE, MAP_SHARED)
+		require.NoError(t, err)
+		defer munmapFile(mappedData)
+
+		// Write test pattern to mapped memory
+		testPattern := []byte("Hello, mmap world!")
+		copy(mappedData, testPattern)
+
+		// Sync changes to disk
+		err = msyncFile(mappedData, MS_SYNC)
+		require.NoError(t, err)
+
+		// Verify changes were written by reading file directly
+		readData, err := os.ReadFile(testFile)
+		require.NoError(t, err)
+		require.True(t, len(readData) >= len(testPattern))
+		require.Equal(t, testPattern, readData[:len(testPattern)])
+	})
+}
+
+// TestDirectIO tests direct I/O operations
+func (s *POSIXExtendedTestSuite) TestDirectIO(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("DirectIO", func(t *testing.T) {
+		if !isDirectIOSupported() {
+			t.Skip("Direct I/O not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "directio_test.txt")
+
+		// Open file with direct I/O
+		fd, err := openDirectIO(testFile, syscall.O_CREAT|syscall.O_RDWR, 0644)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// For direct I/O, data must be aligned to sector boundaries
+		// Use 4KB aligned buffer (common sector size)
+		blockSize := 4096
+		testData := make([]byte, blockSize)
+		for i := range testData {
+			testData[i] = byte(i % 256)
+		}
+
+		// Write data using direct I/O
+		n, err := syscall.Write(fd, testData)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+
+		// Seek back to beginning
+		_, err = syscall.Seek(fd, 0, 0)
+		require.NoError(t, err)
+
+		// Read data using direct I/O
+		readData := make([]byte, blockSize)
+		n, err = syscall.Read(fd, readData)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+		require.Equal(t, testData, readData)
+	})
+}
+
+// TestFileSealing tests file sealing mechanisms (Linux-specific)
+func (s *POSIXExtendedTestSuite) TestFileSealing(t *testing.T) {
+	// This test is Linux-specific and may not be applicable to all systems
+	t.Skip("File sealing tests require Linux-specific features")
+}
+
+// TestFallocate tests file preallocation
+func (s *POSIXExtendedTestSuite) TestFallocate(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("FallocateSpace", func(t *testing.T) {
+		if !isFallocateSupported() {
+			t.Skip("fallocate not supported on this platform")
+			return
+		}
+
+		testFile := filepath.Join(mountPoint, "fallocate_test.txt")
+
+		// Open file
+		fd, err := syscall.Open(testFile, syscall.O_CREAT|syscall.O_RDWR, 0644)
+		require.NoError(t, err)
+		defer syscall.Close(fd)
+
+		// Preallocate 1MB of space
+		allocSize := int64(1024 * 1024)
+		err = fallocateFile(fd, 0, 0, allocSize)
+		require.NoError(t, err)
+
+		// Verify file size was extended
+		var stat syscall.Stat_t
+		err = syscall.Fstat(fd, &stat)
+		require.NoError(t, err)
+		require.GreaterOrEqual(t, stat.Size, allocSize)
+
+		// Write some data and verify it works
+		testData := []byte("fallocate test data")
+		n, err := syscall.Write(fd, testData)
+		require.NoError(t, err)
+		require.Equal(t, len(testData), n)
+	})
+}
+
+// TestSendfile tests zero-copy file transfer
+func (s *POSIXExtendedTestSuite) TestSendfile(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	t.Run("SendfileCopy", func(t *testing.T) {
+		sourceFile := filepath.Join(mountPoint, "sendfile_source.txt")
+		targetFile := filepath.Join(mountPoint, "sendfile_target.txt")
+
+		testData := make([]byte, 8192)
+		for i := range testData {
+			testData[i] = byte(i % 256)
+		}
+
+		// Create source file
+		err := os.WriteFile(sourceFile, testData, 0644)
+		require.NoError(t, err)
+
+		// Open source for reading
+		srcFd, err := syscall.Open(sourceFile, syscall.O_RDONLY, 0)
+		require.NoError(t, err)
+		defer syscall.Close(srcFd)
+
+		// Create target file
+		dstFd, err := syscall.Open(targetFile, syscall.O_CREAT|syscall.O_WRONLY, 0644)
+		require.NoError(t, err)
+		defer syscall.Close(dstFd)
+
+		// Sendfile test
+		if !isSendfileSupported() {
+			t.Skip("sendfile not supported on this platform")
+			return
+		}
+
+		// Use sendfile to copy data
+		var offset int64 = 0
+		transferred, err := sendfileTransfer(dstFd, srcFd, &offset, len(testData))
+		require.NoError(t, err)
+		require.Equal(t, len(testData), transferred)
+
+		// Verify copy
+		copiedData, err := os.ReadFile(targetFile)
+		require.NoError(t, err)
+		require.Equal(t, testData, copiedData)
+	})
+}
+
+// Helper function to parse null-separated xattr list
+func parseXattrList(data []byte) []string {
+	var attrs []string
+	start := 0
+	for i, b := range data {
+		if b == 0 {
+			if i > start {
+				attrs = append(attrs, string(data[start:i]))
+			}
+			start = i + 1
+		}
+	}
+	return attrs
+}
diff --git a/test/fuse_integration/posix_external_test.go b/test/fuse_integration/posix_external_test.go
new file mode 100644
index 0000000000..5a330fa2a4
--- /dev/null
+++ b/test/fuse_integration/posix_external_test.go
@@ -0,0 +1,579 @@
+package fuse
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// ExternalPOSIXTestSuite manages integration with external POSIX test suites
+type ExternalPOSIXTestSuite struct {
+	framework *FuseTestFramework
+	t         *testing.T
+	workDir   string
+}
+
+// NewExternalPOSIXTestSuite creates a new external POSIX test suite runner
+func NewExternalPOSIXTestSuite(t *testing.T, framework *FuseTestFramework) *ExternalPOSIXTestSuite {
+	workDir, err := os.MkdirTemp("", "posix_external_tests_")
+	require.NoError(t, err)
+
+	return &ExternalPOSIXTestSuite{
+		framework: framework,
+		t:         t,
+		workDir:   workDir,
+	}
+}
+
+// Cleanup removes temporary test directories
+func (s *ExternalPOSIXTestSuite) Cleanup() {
+	os.RemoveAll(s.workDir)
+}
+
+// TestExternalPOSIXSuites runs integration tests with external POSIX test suites
+func TestExternalPOSIXSuites(t *testing.T) {
+	config := DefaultTestConfig()
+	config.EnableDebug = true
+	config.MountOptions = []string{"-allowOthers", "-nonempty"}
+
+	framework := NewFuseTestFramework(t, config)
+	defer framework.Cleanup()
+	require.NoError(t, framework.Setup(config))
+
+	suite := NewExternalPOSIXTestSuite(t, framework)
+	defer suite.Cleanup()
+
+	// Run various external POSIX test suites
+	t.Run("PjdFsTest", suite.TestPjdFsTest)
+	t.Run("NFSTestPOSIX", suite.TestNFSTestPOSIX)
+	t.Run("LitmusTests", suite.TestLitmusTests)
+	t.Run("CustomPOSIXTests", suite.TestCustomPOSIXTests)
+}
+
+// TestPjdFsTest runs the comprehensive pjdfstest POSIX filesystem test suite
+func (s *ExternalPOSIXTestSuite) TestPjdFsTest(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	// Create test directory within mount point
+	testDir := filepath.Join(mountPoint, "pjdfstest")
+	err := os.MkdirAll(testDir, 0755)
+	require.NoError(t, err)
+
+	// List of critical POSIX operations to test
+	pjdTests := []struct {
+		name     string
+		testPath string
+		critical bool
+	}{
+		{"chflags", "tests/chflags", false},
+		{"chmod", "tests/chmod", true},
+		{"chown", "tests/chown", true},
+		{"create", "tests/create", true},
+		{"link", "tests/link", true},
+		{"mkdir", "tests/mkdir", true},
+		{"mkfifo", "tests/mkfifo", false},
+		{"mknod", "tests/mknod", false},
+		{"open", "tests/open", true},
+		{"rename", "tests/rename", true},
+		{"rmdir", "tests/rmdir", true},
+		{"symlink", "tests/symlink", true},
+		{"truncate", "tests/truncate", true},
+		{"unlink", "tests/unlink", true},
+	}
+
+	// Prefer the suite that `make setup-pjdfstest` builds under
+	// external_tools/ before cloning a second copy into the work dir
+	pjdDir := s.findPjdDir()
+	if pjdDir == "" {
+		pjdDir = filepath.Join(s.workDir, "pjdfstest")
+		if err := s.setupPjdFsTest(pjdDir); err != nil {
+			if os.Getenv("POSIX_REQUIRE_EXTERNAL_TOOLS") == "true" {
+				t.Fatalf("pjdfstest is required for comprehensive POSIX compliance testing: %v", err)
+			}
+			t.Skipf("pjdfstest not found and setup failed: %v", err)
+		}
+	}
+
+	// pjdfstest asserts full POSIX semantics the mount does not provide
+	// yet, so category failures are report-only unless the run asked for
+	// external tools to gate.
+	strict := os.Getenv("POSIX_REQUIRE_EXTERNAL_TOOLS") == "true"
+	for _, test := range pjdTests {
+		t.Run(test.name, func(t *testing.T) {
+			s.runPjdTest(t, pjdDir, test.testPath, testDir, strict && test.critical)
+		})
+	}
+}
+
+// TestNFSTestPOSIX runs nfstest_posix for POSIX API verification
+func (s *ExternalPOSIXTestSuite) TestNFSTestPOSIX(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	// Check if nfstest_posix is available
+	_, err := exec.LookPath("nfstest_posix")
+	if err != nil {
+		// For comprehensive POSIX compliance testing, external tools should be mandatory
+		if os.Getenv("POSIX_REQUIRE_EXTERNAL_TOOLS") == "true" {
+			t.Fatalf("nfstest_posix is required for comprehensive POSIX compliance testing but not found. Install via: pip install nfstest")
+		}
+		t.Skip("nfstest_posix not found. Install via: pip install nfstest")
+	}
+
+	testDir := filepath.Join(mountPoint, "nfstest")
+	err = os.MkdirAll(testDir, 0755)
+	require.NoError(t, err)
+
+	// Run nfstest_posix with comprehensive API testing
+	cmd := exec.Command("nfstest_posix",
+		"--path", testDir,
+		"--verbose",
+		"--createlog",
+		"--runid", fmt.Sprintf("seaweedfs_%d", time.Now().Unix()),
+	)
+
+	output, err := cmd.CombinedOutput()
+	t.Logf("nfstest_posix output:\n%s", string(output))
+
+	if err != nil {
+		t.Logf("nfstest_posix failed: %v", err)
+		// Don't fail the test completely, just log the failure
+	}
+}
+
+// TestLitmusTests runs focused POSIX compliance litmus tests
+func (s *ExternalPOSIXTestSuite) TestLitmusTests(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	// Create litmus test scripts for critical POSIX behaviors
+	litmusTests := []struct {
+		name   string
+		script string
+	}{
+		{
+			name: "AtomicRename",
+			script: `#!/bin/bash
+set -e
+cd "$1"
+echo "test data" > temp_file
+echo "original" > target_file
+mv temp_file target_file
+[ "$(cat target_file)" = "test data" ]
+echo "PASS: Atomic rename works"
+`,
+		},
+		{
+			name: "LinkCount",
+			script: `#!/bin/bash
+set -e
+cd "$1"
+echo "test" > original
+ln original hardlink
+if [[ "$(uname)" == "Darwin" ]]; then
+  [ $(stat -f %l original) -eq 2 ]
+else
+  [ $(stat -c %h original) -eq 2 ]
+fi
+rm hardlink
+if [[ "$(uname)" == "Darwin" ]]; then
+  [ $(stat -f %l original) -eq 1 ]
+else
+  [ $(stat -c %h original) -eq 1 ]
+fi
+echo "PASS: Hard link counting works"
+`,
+		},
+		{
+			name: "SymlinkCycles",
+			script: `#!/bin/bash
+set -e
+cd "$1"
+ln -s link1 link2
+ln -s link2 link1
+# Try to access the file, which should fail due to too many symbolic links
+if cat link1 2>/dev/null; then
+    echo "FAIL: Symlink cycle not detected"
+    exit 1
+fi
+echo "PASS: Symlink cycle handling works"
+`,
+		},
+		{
+			name: "ConcurrentCreate",
+			script: `#!/bin/bash
+set -e
+cd "$1"
+for i in {1..10}; do
+    (echo "process $i" > "file_$i") &
+done
+wait
+[ $(ls file_* | wc -l) -eq 10 ]
+echo "PASS: Concurrent file creation works"
+`,
+		},
+		{
+			name: "DirectoryConsistency",
+			script: `#!/bin/bash
+set -e
+cd "$1"
+mkdir testdir
+cd testdir
+touch file1 file2 file3
+cd ..
+entries=$(ls testdir | wc -l)
+[ $entries -eq 3 ]
+rmdir testdir 2>/dev/null && echo "FAIL: Non-empty directory removed" && exit 1
+rm testdir/*
+rmdir testdir
+echo "PASS: Directory consistency works"
+`,
+		},
+	}
+
+	testDir := filepath.Join(mountPoint, "litmus")
+	err := os.MkdirAll(testDir, 0755)
+	require.NoError(t, err)
+
+	// Run each litmus test
+	for _, test := range litmusTests {
+		t.Run(test.name, func(t *testing.T) {
+			s.runLitmusTest(t, test.name, test.script, testDir)
+		})
+	}
+}
+
+// TestCustomPOSIXTests runs custom POSIX compliance tests
+func (s *ExternalPOSIXTestSuite) TestCustomPOSIXTests(t *testing.T) {
+	mountPoint := s.framework.GetMountPoint()
+
+	// Custom stress tests for POSIX compliance
+	t.Run("StressRename", func(t *testing.T) {
+		s.stressTestRename(t, mountPoint)
+	})
+
+	t.Run("StressCreate", func(t *testing.T) {
+		s.stressTestCreate(t, mountPoint)
+	})
+
+	t.Run("StressDirectory", func(t *testing.T) {
+		s.stressTestDirectory(t, mountPoint)
+	})
+
+	t.Run("EdgeCases", func(t *testing.T) {
+		s.testEdgeCases(t, mountPoint)
+	})
+}
+
+// findPjdDir returns a directory holding a built pjdfstest suite, or ""
+// when none is installed. The path is absolute because tests run with
+// cmd.Dir inside the mount.
+func (s *ExternalPOSIXTestSuite) findPjdDir() string {
+	dir := filepath.Join("external_tools", "pjdfstest")
+	if info, err := os.Stat(filepath.Join(dir, "pjdfstest")); err == nil && !info.IsDir() && info.Mode()&0111 != 0 {
+		if abs, err := filepath.Abs(dir); err == nil {
+			return abs
+		}
+	}
+	return ""
+}
+
+// setupPjdFsTest downloads and sets up the pjdfstest suite
+func (s *ExternalPOSIXTestSuite) setupPjdFsTest(targetDir string) error {
+	// Clone pjdfstest repository
+	cmd := exec.Command("git", "clone", "https://github.com/pjd/pjdfstest.git", targetDir)
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("failed to clone pjdfstest: %w", err)
+	}
+
+	// pjdfstest is autotools-based: the fresh clone has no Makefile until
+	// configure runs
+	for _, step := range [][]string{
+		{"autoreconf", "-ifs"},
+		{"./configure"},
+		{"make"},
+	} {
+		cmd = exec.Command(step[0], step[1:]...)
+		cmd.Dir = targetDir
+		if out, err := cmd.CombinedOutput(); err != nil {
+			return fmt.Errorf("pjdfstest %s: %w: %s", step[0], err, out)
+		}
+	}
+
+	return nil
+}
+
+// runPjdTest executes a specific pjdfstest
+func (s *ExternalPOSIXTestSuite) runPjdTest(t *testing.T, pjdDir, testPath, mountDir string, critical bool) {
+	fullTestPath := filepath.Join(pjdDir, testPath)
+
+	// Check if test path exists
+	if _, err := os.Stat(fullTestPath); os.IsNotExist(err) {
+		t.Skipf("Test path does not exist: %s", fullTestPath)
+	}
+
+	cmd := exec.Command("prove", "-r", fullTestPath)
+	cmd.Dir = mountDir
+	cmd.Env = append(os.Environ(), "FSTEST="+filepath.Join(pjdDir, "pjdfstest"))
+
+	output, err := cmd.CombinedOutput()
+	t.Logf("pjdfstest %s output:\n%s", testPath, string(output))
+
+	if err != nil {
+		if critical {
+			t.Errorf("Critical pjdfstest failed: %s - %v", testPath, err)
+		} else {
+			t.Logf("Non-critical pjdfstest failed: %s - %v", testPath, err)
+		}
+	}
+}
+
+// runLitmusTest executes a litmus test script
+func (s *ExternalPOSIXTestSuite) runLitmusTest(t *testing.T, name, script, testDir string) {
+	scriptPath := filepath.Join(s.workDir, name+".sh")
+
+	// Write script to file
+	err := os.WriteFile(scriptPath, []byte(script), 0755)
+	require.NoError(t, err)
+
+	// Create isolated test directory
+	isolatedDir := filepath.Join(testDir, name)
+	err = os.MkdirAll(isolatedDir, 0755)
+	require.NoError(t, err)
+	defer os.RemoveAll(isolatedDir)
+
+	// Execute script
+	cmd := exec.Command("bash", scriptPath, isolatedDir)
+	output, err := cmd.CombinedOutput()
+
+	t.Logf("Litmus test %s output:\n%s", name, string(output))
+
+	if err != nil {
+		t.Errorf("Litmus test %s failed: %v", name, err)
+	}
+}
+
+// stressTestRename tests rename operations under stress
+func (s *ExternalPOSIXTestSuite) stressTestRename(t *testing.T, mountPoint string) {
+	testDir := filepath.Join(mountPoint, "stress_rename")
+	err := os.MkdirAll(testDir, 0755)
+	require.NoError(t, err)
+	defer os.RemoveAll(testDir)
+
+	// Create files and rename them concurrently
+	const numFiles = 100
+	const numWorkers = 10
+
+	// Create initial files
+	for i := 0; i < numFiles; i++ {
+		fileName := filepath.Join(testDir, fmt.Sprintf("file_%d.txt", i))
+		err := os.WriteFile(fileName, []byte(fmt.Sprintf("content_%d", i)), 0644)
+		if !assert.NoError(t, err, "Failed to create initial file %d", i) {
+			return // Skip test if setup fails
+		}
+	}
+
+	// Concurrent rename operations
+	results := make(chan error, numWorkers)
+	for w := 0; w < numWorkers; w++ {
+		go func(worker int) {
+			for i := worker; i < numFiles; i += numWorkers {
+				oldName := filepath.Join(testDir, fmt.Sprintf("file_%d.txt", i))
+				newName := filepath.Join(testDir, fmt.Sprintf("renamed_%d.txt", i))
+				err := os.Rename(oldName, newName)
+				if err != nil {
+					results <- err
+					return
+				}
+			}
+			results <- nil
+		}(w)
+	}
+
+	// Wait for all workers and collect errors
+	var errorCount int
+	for w := 0; w < numWorkers; w++ {
+		err := <-results
+		if err != nil {
+			assert.NoError(t, err, "Worker %d failed", w)
+			errorCount++
+		}
+	}
+
+	// Verify all files were renamed (if no errors occurred)
+	if errorCount == 0 {
+		files, err := filepath.Glob(filepath.Join(testDir, "renamed_*.txt"))
+		assert.NoError(t, err, "Failed to list renamed files")
+		assert.Equal(t, numFiles, len(files), "Not all files were renamed successfully")
+	}
+}
+
+// stressTestCreate tests file creation under stress
+func (s *ExternalPOSIXTestSuite) stressTestCreate(t *testing.T, mountPoint string) {
+	testDir := filepath.Join(mountPoint, "stress_create")
+	err := os.MkdirAll(testDir, 0755)
+	require.NoError(t, err)
+	defer os.RemoveAll(testDir)
+
+	const numFiles = 1000
+	const numWorkers = 20
+
+	results := make(chan error, numWorkers)
+
+	for w := 0; w < numWorkers; w++ {
+		go func(worker int) {
+			for i := worker; i < numFiles; i += numWorkers {
+				fileName := filepath.Join(testDir, fmt.Sprintf("stress_%d_%d.txt", worker, i))
+				err := os.WriteFile(fileName, []byte(fmt.Sprintf("data_%d_%d", worker, i)), 0644)
+				if err != nil {
+					results <- err
+					return
+				}
+			}
+			results <- nil
+		}(w)
+	}
+
+	// Wait for all workers
+	for w := 0; w < numWorkers; w++ {
+		err := <-results
+		require.NoError(t, err)
+	}
+
+	// Verify all files were created
+	files, err := filepath.Glob(filepath.Join(testDir, "stress_*.txt"))
+	require.NoError(t, err)
+	require.Equal(t, numFiles, len(files))
+}
+
+// stressTestDirectory tests directory operations under stress
+func (s *ExternalPOSIXTestSuite) stressTestDirectory(t *testing.T, mountPoint string) {
+	testDir := filepath.Join(mountPoint, "stress_directory")
+	err := os.MkdirAll(testDir, 0755)
+	require.NoError(t, err)
+	defer os.RemoveAll(testDir)
+
+	const numDirs = 500
+	const numWorkers = 10
+
+	results := make(chan error, numWorkers)
+
+	// Create directories concurrently
+	for w := 0; w < numWorkers; w++ {
+		go func(worker int) {
+			for i := worker; i < numDirs; i += numWorkers {
+				dirName := filepath.Join(testDir, fmt.Sprintf("dir_%d_%d", worker, i))
+				err := os.MkdirAll(dirName, 0755)
+				if err != nil {
+					results <- err
+					return
+				}
+
+				// Create a file in each directory
+				fileName := filepath.Join(dirName, "test.txt")
+				err = os.WriteFile(fileName, []byte("test"), 0644)
+				if err != nil {
+					results <- err
+					return
+				}
+			}
+			results <- nil
+		}(w)
+	}
+
+	// Wait for all workers
+	for w := 0; w < numWorkers; w++ {
+		err := <-results
+		require.NoError(t, err)
+	}
+
+	// Verify directory structure
+	dirs, err := filepath.Glob(filepath.Join(testDir, "dir_*"))
+	require.NoError(t, err)
+	require.Equal(t, numDirs, len(dirs))
+}
+
+// testEdgeCases tests various POSIX edge cases
+func (s *ExternalPOSIXTestSuite) testEdgeCases(t *testing.T, mountPoint string) {
+	testDir := filepath.Join(mountPoint, "edge_cases")
+	err := os.MkdirAll(testDir, 0755)
+	require.NoError(t, err)
+	defer os.RemoveAll(testDir)
+
+	t.Run("WriteToDirectoryAsFile", func(t *testing.T) {
+		// Test writing to a directory as if it were a file (should fail)
+		// Note: filepath.Join(testDir, "") returns testDir itself
+		err := os.WriteFile(testDir, []byte("test"), 0644)
+		require.Error(t, err)
+		// Verify the error is specifically about the target being a directory
+		var pathErr *os.PathError
+		require.ErrorAs(t, err, &pathErr)
+		require.Equal(t, syscall.EISDIR, pathErr.Err)
+	})
+
+	t.Run("VeryLongFileName", func(t *testing.T) {
+		// Test very long file names
+		longName := strings.Repeat("a", 255) // NAME_MAX is typically 255
+		longFile := filepath.Join(testDir, longName)
+
+		err := os.WriteFile(longFile, []byte("long name test"), 0644)
+		// This might succeed or fail depending on filesystem limits
+		if err == nil {
+			defer os.Remove(longFile)
+			t.Logf("Very long filename accepted")
+		} else {
+			t.Logf("Very long filename rejected: %v", err)
+		}
+	})
+
+	t.Run("SpecialCharacters", func(t *testing.T) {
+		// Test files with special characters
+		specialFiles := []string{
+			"file with spaces.txt",
+			"file-with-dashes.txt",
+			"file_with_underscores.txt",
+			"file.with.dots.txt",
+		}
+
+		for _, fileName := range specialFiles {
+			filePath := filepath.Join(testDir, fileName)
+			err := os.WriteFile(filePath, []byte("special char test"), 0644)
+			require.NoError(t, err, "Failed to create file with special chars: %s", fileName)
+
+			// Verify we can read it back
+			_, err = os.ReadFile(filePath)
+			require.NoError(t, err, "Failed to read file with special chars: %s", fileName)
+		}
+	})
+
+	t.Run("DeepDirectoryNesting", func(t *testing.T) {
+		// Test deep directory nesting
+		deepPath := testDir
+		for i := 0; i < 100; i++ {
+			deepPath = filepath.Join(deepPath, fmt.Sprintf("level_%d", i))
+		}
+
+		err := os.MkdirAll(deepPath, 0755)
+		// This might fail due to PATH_MAX limits
+		if err != nil {
+			t.Logf("Deep directory nesting failed at some level: %v", err)
+		} else {
+			t.Logf("Deep directory nesting succeeded")
+
+			// Test creating a file in the deep path
+			testFile := filepath.Join(deepPath, "deep_file.txt")
+			err = os.WriteFile(testFile, []byte("deep test"), 0644)
+			if err == nil {
+				t.Logf("File creation in deep path succeeded")
+			} else {
+				t.Logf("File creation in deep path failed: %v", err)
+			}
+		}
+	})
+}
diff --git a/test/fuse_integration/sendfile_darwin.go b/test/fuse_integration/sendfile_darwin.go
new file mode 100644
index 0000000000..1042ba7a08
--- /dev/null
+++ b/test/fuse_integration/sendfile_darwin.go
@@ -0,0 +1,45 @@
+//go:build darwin
+
+package fuse
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// Sendfile support for macOS
+
+func sendfileTransfer(outFd int, inFd int, offset *int64, count int) (int, error) {
+	// macOS sendfile has different signature: sendfile(in_fd, out_fd, offset, len, hdtr, flags)
+	var off int64
+	if offset != nil {
+		off = *offset
+	}
+
+	length := int64(count)
+
+	_, _, errno := syscall.Syscall6(syscall.SYS_SENDFILE,
+		uintptr(inFd),                    // input fd
+		uintptr(outFd),                   // output fd
+		uintptr(off),                     // offset
+		uintptr(unsafe.Pointer(&length)), // length (in/out parameter)
+		0,                                // hdtr (headers/trailers)
+		0)                                // flags
+
+	if errno != 0 {
+		return 0, errno
+	}
+
+	// Update offset if provided
+	if offset != nil {
+		*offset += length
+	}
+
+	return int(length), nil
+}
+
+func isSendfileSupported() bool {
+	// macOS sendfile(2) requires a socket destination; file-to-file copies
+	// fail with ENOTSOCK.
+	return false
+}
diff --git a/test/fuse_integration/sendfile_linux.go b/test/fuse_integration/sendfile_linux.go
new file mode 100644
index 0000000000..b5a0c0d610
--- /dev/null
+++ b/test/fuse_integration/sendfile_linux.go
@@ -0,0 +1,33 @@
+//go:build linux
+
+package fuse
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// Sendfile support for Linux
+
+func sendfileTransfer(outFd int, inFd int, offset *int64, count int) (int, error) {
+	var offsetPtr uintptr
+	if offset != nil {
+		offsetPtr = uintptr(unsafe.Pointer(offset))
+	}
+
+	n, _, errno := syscall.Syscall6(syscall.SYS_SENDFILE,
+		uintptr(outFd),
+		uintptr(inFd),
+		offsetPtr,
+		uintptr(count),
+		0, 0)
+
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(n), nil
+}
+
+func isSendfileSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/sendfile_unsupported.go b/test/fuse_integration/sendfile_unsupported.go
new file mode 100644
index 0000000000..64a7818dd2
--- /dev/null
+++ b/test/fuse_integration/sendfile_unsupported.go
@@ -0,0 +1,19 @@
+//go:build !linux && !darwin
+
+package fuse
+
+import (
+	"errors"
+)
+
+// Sendfile support for unsupported platforms
+
+var ErrSendfileNotSupported = errors.New("sendfile not supported on this platform")
+
+func sendfileTransfer(outFd int, inFd int, offset *int64, count int) (int, error) {
+	return 0, ErrSendfileNotSupported
+}
+
+func isSendfileSupported() bool {
+	return false
+}
diff --git a/test/fuse_integration/unlinked_open_test.go b/test/fuse_integration/unlinked_open_test.go
new file mode 100644
index 0000000000..72efa0306c
--- /dev/null
+++ b/test/fuse_integration/unlinked_open_test.go
@@ -0,0 +1,94 @@
+//go:build linux
+
+package fuse_test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/unix"
+)
+
+// TestMetadataOnUnlinkedOpen covers the POSIX rule that an inode outlives its
+// last name while a descriptor holds it open: metadata operations through the
+// descriptor keep working between the removal and the final close, for a file
+// after unlink and for a directory after rmdir.
+func TestMetadataOnUnlinkedOpen(t *testing.T) {
+	framework := NewFuseTestFramework(t, DefaultTestConfig())
+	defer framework.Cleanup()
+
+	require.NoError(t, framework.Setup(DefaultTestConfig()))
+
+	t.Run("UnlinkedOpenFile", func(t *testing.T) {
+		testUnlinkedOpenFile(t, framework)
+	})
+
+	t.Run("RemovedOpenDirectory", func(t *testing.T) {
+		testRemovedOpenDirectory(t, framework)
+	})
+}
+
+func testUnlinkedOpenFile(t *testing.T, framework *FuseTestFramework) {
+	path := filepath.Join(framework.GetMountPoint(), "unlinked_open_file")
+	fd, err := unix.Open(path, unix.O_CREAT|unix.O_RDWR, 0644)
+	require.NoError(t, err)
+	defer unix.Close(fd)
+	_, err = unix.Write(fd, []byte("hello"))
+	require.NoError(t, err)
+
+	require.NoError(t, os.Remove(path))
+
+	require.NoError(t, unix.Ftruncate(fd, 2), "ftruncate on an unlinked open file")
+	require.NoError(t, unix.Fchmod(fd, 0600), "fchmod on an unlinked open file")
+	require.NoError(t, unix.Futimes(fd, []unix.Timeval{{Sec: 1234567890}, {Sec: 987654321}}),
+		"futimes on an unlinked open file")
+
+	var st unix.Stat_t
+	require.NoError(t, unix.Fstat(fd, &st), "fstat on an unlinked open file")
+	assert.EqualValues(t, 0, st.Nlink, "nlink after unlink")
+	assert.EqualValues(t, 0600, st.Mode&0777, "mode after fchmod")
+	assert.EqualValues(t, 2, st.Size, "size after ftruncate")
+	assert.EqualValues(t, 1234567890, st.Atim.Sec, "atime after futimes")
+	assert.EqualValues(t, 987654321, st.Mtim.Sec, "mtime after futimes")
+
+	testFdXattrRoundTrip(t, fd)
+}
+
+func testRemovedOpenDirectory(t *testing.T, framework *FuseTestFramework) {
+	path := filepath.Join(framework.GetMountPoint(), "removed_open_dir")
+	require.NoError(t, os.Mkdir(path, 0755))
+	fd, err := unix.Open(path, unix.O_RDONLY|unix.O_DIRECTORY, 0)
+	require.NoError(t, err)
+	defer unix.Close(fd)
+
+	require.NoError(t, os.Remove(path))
+
+	require.NoError(t, unix.Fchmod(fd, 0770), "fchmod on a removed open directory")
+	require.NoError(t, unix.Futimes(fd, []unix.Timeval{{Sec: 1234567890}, {Sec: 987654321}}),
+		"futimes on a removed open directory")
+
+	var st unix.Stat_t
+	require.NoError(t, unix.Fstat(fd, &st), "fstat on a removed open directory")
+	assert.EqualValues(t, unix.S_IFDIR, st.Mode&unix.S_IFMT, "type after rmdir")
+	assert.EqualValues(t, 0770, st.Mode&0777, "mode after fchmod")
+	assert.EqualValues(t, 0, st.Nlink, "nlink after rmdir")
+	assert.EqualValues(t, 987654321, st.Mtim.Sec, "mtime after futimes")
+
+	testFdXattrRoundTrip(t, fd)
+}
+
+func testFdXattrRoundTrip(t *testing.T, fd int) {
+	require.NoError(t, unix.Fsetxattr(fd, "user.k", []byte("v"), 0), "fsetxattr on a removed open inode")
+
+	buf := make([]byte, 8)
+	n, err := unix.Fgetxattr(fd, "user.k", buf)
+	require.NoError(t, err, "fgetxattr on a removed open inode")
+	assert.Equal(t, "v", string(buf[:n]))
+
+	require.NoError(t, unix.Fremovexattr(fd, "user.k"), "fremovexattr on a removed open inode")
+	_, err = unix.Fgetxattr(fd, "user.k", buf)
+	assert.ErrorIs(t, err, unix.ENODATA, "fgetxattr after fremovexattr")
+}
diff --git a/test/fuse_integration/vectored_io_unix.go b/test/fuse_integration/vectored_io_unix.go
new file mode 100644
index 0000000000..59b2b2cc47
--- /dev/null
+++ b/test/fuse_integration/vectored_io_unix.go
@@ -0,0 +1,126 @@
+//go:build unix
+
+package fuse
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// Vectored I/O support for Unix-like systems
+
+// IOVec represents an I/O vector for readv/writev operations
+type IOVec struct {
+	Base *byte
+	Len  uint64
+}
+
+func readvFile(fd int, iovs []IOVec) (int, error) {
+	if len(iovs) == 0 {
+		return 0, nil
+	}
+
+	n, _, errno := syscall.Syscall(syscall.SYS_READV,
+		uintptr(fd),
+		uintptr(unsafe.Pointer(&iovs[0])),
+		uintptr(len(iovs)))
+
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(n), nil
+}
+
+func writevFile(fd int, iovs []IOVec) (int, error) {
+	if len(iovs) == 0 {
+		return 0, nil
+	}
+
+	n, _, errno := syscall.Syscall(syscall.SYS_WRITEV,
+		uintptr(fd),
+		uintptr(unsafe.Pointer(&iovs[0])),
+		uintptr(len(iovs)))
+
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(n), nil
+}
+
+func preadvFile(fd int, iovs []IOVec, offset int64) (int, error) {
+	if len(iovs) == 0 {
+		return 0, nil
+	}
+
+	// preadv/pwritev may not be available on all Unix systems
+	// Fall back to individual pread calls
+	totalRead := 0
+	currentOffset := offset
+
+	for _, iov := range iovs {
+		if iov.Len == 0 {
+			continue
+		}
+
+		buf := (*[1 << 30]byte)(unsafe.Pointer(iov.Base))[:iov.Len:iov.Len]
+		n, err := syscall.Pread(fd, buf, currentOffset)
+		if err != nil {
+			return totalRead, err
+		}
+		totalRead += n
+		currentOffset += int64(n)
+
+		if n < int(iov.Len) {
+			break // EOF or partial read
+		}
+	}
+
+	return totalRead, nil
+}
+
+func pwritevFile(fd int, iovs []IOVec, offset int64) (int, error) {
+	if len(iovs) == 0 {
+		return 0, nil
+	}
+
+	// preadv/pwritev may not be available on all Unix systems
+	// Fall back to individual pwrite calls
+	totalWritten := 0
+	currentOffset := offset
+
+	for _, iov := range iovs {
+		if iov.Len == 0 {
+			continue
+		}
+
+		buf := (*[1 << 30]byte)(unsafe.Pointer(iov.Base))[:iov.Len:iov.Len]
+		n, err := syscall.Pwrite(fd, buf, currentOffset)
+		if err != nil {
+			return totalWritten, err
+		}
+		totalWritten += n
+		currentOffset += int64(n)
+
+		if n < int(iov.Len) {
+			break // Partial write
+		}
+	}
+
+	return totalWritten, nil
+}
+
+// Helper function to create IOVec from byte slices
+func makeIOVecs(buffers [][]byte) []IOVec {
+	iovs := make([]IOVec, len(buffers))
+	for i, buf := range buffers {
+		if len(buf) > 0 {
+			iovs[i].Base = &buf[0]
+			iovs[i].Len = uint64(len(buf))
+		}
+	}
+	return iovs
+}
+
+func isVectoredIOSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/vectored_io_unsupported.go b/test/fuse_integration/vectored_io_unsupported.go
new file mode 100644
index 0000000000..963c6e2d4a
--- /dev/null
+++ b/test/fuse_integration/vectored_io_unsupported.go
@@ -0,0 +1,41 @@
+//go:build !unix
+
+package fuse
+
+import (
+	"errors"
+)
+
+// Vectored I/O support for unsupported platforms
+
+var ErrVectoredIONotSupported = errors.New("vectored I/O not supported on this platform")
+
+// IOVec represents an I/O vector for readv/writev operations
+type IOVec struct {
+	Base *byte
+	Len  uint64
+}
+
+func readvFile(fd int, iovs []IOVec) (int, error) {
+	return 0, ErrVectoredIONotSupported
+}
+
+func writevFile(fd int, iovs []IOVec) (int, error) {
+	return 0, ErrVectoredIONotSupported
+}
+
+func preadvFile(fd int, iovs []IOVec, offset int64) (int, error) {
+	return 0, ErrVectoredIONotSupported
+}
+
+func pwritevFile(fd int, iovs []IOVec, offset int64) (int, error) {
+	return 0, ErrVectoredIONotSupported
+}
+
+func makeIOVecs(buffers [][]byte) []IOVec {
+	return nil
+}
+
+func isVectoredIOSupported() bool {
+	return false
+}
diff --git a/test/fuse_integration/xattr_darwin.go b/test/fuse_integration/xattr_darwin.go
new file mode 100644
index 0000000000..6bd6f2a908
--- /dev/null
+++ b/test/fuse_integration/xattr_darwin.go
@@ -0,0 +1,125 @@
+//go:build darwin
+
+package fuse
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// Extended attributes support for macOS
+
+const (
+	// macOS-specific flags
+	XATTR_NOFOLLOW = 0x0001
+	XATTR_CREATE   = 0x0002
+	XATTR_REPLACE  = 0x0004
+)
+
+func setXattr(path, name string, value []byte, flags int) error {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return err
+	}
+	nameBytes, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return err
+	}
+
+	var valuePtr unsafe.Pointer
+	if len(value) > 0 {
+		valuePtr = unsafe.Pointer(&value[0])
+	}
+
+	_, _, errno := syscall.Syscall6(syscall.SYS_SETXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(valuePtr),
+		uintptr(len(value)),
+		uintptr(0), // position (not used for regular files)
+		uintptr(flags))
+
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func getXattr(path, name string, value []byte) (int, error) {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	nameBytes, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return 0, err
+	}
+
+	var valuePtr unsafe.Pointer
+	if len(value) > 0 {
+		valuePtr = unsafe.Pointer(&value[0])
+	}
+
+	size, _, errno := syscall.Syscall6(syscall.SYS_GETXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(valuePtr),
+		uintptr(len(value)),
+		uintptr(0), // position
+		uintptr(0)) // options
+
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(size), nil
+}
+
+func listXattr(path string, list []byte) (int, error) {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+
+	var listPtr unsafe.Pointer
+	if len(list) > 0 {
+		listPtr = unsafe.Pointer(&list[0])
+	}
+
+	size, _, errno := syscall.Syscall6(syscall.SYS_LISTXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(listPtr),
+		uintptr(len(list)),
+		uintptr(0), // options
+		0, 0)
+
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(size), nil
+}
+
+func removeXattr(path, name string) error {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return err
+	}
+	nameBytes, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return err
+	}
+
+	_, _, errno := syscall.Syscall6(syscall.SYS_REMOVEXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(0), // options
+		0, 0, 0)
+
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func isXattrSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/xattr_linux.go b/test/fuse_integration/xattr_linux.go
new file mode 100644
index 0000000000..82f40d1c7f
--- /dev/null
+++ b/test/fuse_integration/xattr_linux.go
@@ -0,0 +1,115 @@
+//go:build linux
+
+package fuse
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+// Extended attributes support for Linux
+
+func setXattr(path, name string, value []byte, flags int) error {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return err
+	}
+	nameBytes, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return err
+	}
+
+	var valuePtr unsafe.Pointer
+	if len(value) > 0 {
+		valuePtr = unsafe.Pointer(&value[0])
+	}
+
+	_, _, errno := syscall.Syscall6(syscall.SYS_SETXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(valuePtr),
+		uintptr(len(value)),
+		uintptr(flags),
+		0)
+
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func getXattr(path, name string, value []byte) (int, error) {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	nameBytes, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return 0, err
+	}
+
+	var valuePtr unsafe.Pointer
+	if len(value) > 0 {
+		valuePtr = unsafe.Pointer(&value[0])
+	}
+
+	size, _, errno := syscall.Syscall6(syscall.SYS_GETXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(unsafe.Pointer(nameBytes)),
+		uintptr(valuePtr),
+		uintptr(len(value)),
+		0,
+		0)
+
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(size), nil
+}
+
+func listXattr(path string, list []byte) (int, error) {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+
+	var listPtr unsafe.Pointer
+	if len(list) > 0 {
+		listPtr = unsafe.Pointer(&list[0])
+	}
+
+	size, _, errno := syscall.Syscall(syscall.SYS_LISTXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(listPtr),
+		uintptr(len(list)))
+
+	if errno != 0 {
+		return 0, errno
+	}
+	return int(size), nil
+}
+
+func removeXattr(path, name string) error {
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return err
+	}
+	nameBytes, err := syscall.BytePtrFromString(name)
+	if err != nil {
+		return err
+	}
+
+	_, _, errno := syscall.Syscall(syscall.SYS_REMOVEXATTR,
+		uintptr(unsafe.Pointer(pathBytes)),
+		uintptr(unsafe.Pointer(nameBytes)),
+		0)
+
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func isXattrSupported() bool {
+	return true
+}
diff --git a/test/fuse_integration/xattr_unsupported.go b/test/fuse_integration/xattr_unsupported.go
new file mode 100644
index 0000000000..945fc2ff69
--- /dev/null
+++ b/test/fuse_integration/xattr_unsupported.go
@@ -0,0 +1,31 @@
+//go:build !linux && !darwin
+
+package fuse
+
+import (
+	"errors"
+)
+
+// Extended attributes support for unsupported platforms
+
+var ErrXattrNotSupported = errors.New("extended attributes not supported on this platform")
+
+func setXattr(path, name string, value []byte, flags int) error {
+	return ErrXattrNotSupported
+}
+
+func getXattr(path, name string, value []byte) (int, error) {
+	return 0, ErrXattrNotSupported
+}
+
+func listXattr(path string, list []byte) (int, error) {
+	return 0, ErrXattrNotSupported
+}
+
+func removeXattr(path, name string) error {
+	return ErrXattrNotSupported
+}
+
+func isXattrSupported() bool {
+	return false
+}
diff --git a/test/fuse_p2p/framework_test.go b/test/fuse_p2p/framework_test.go
index 73e0a0af39..b98ee7ba2b 100644
--- a/test/fuse_p2p/framework_test.go
+++ b/test/fuse_p2p/framework_test.go
@@ -3,12 +3,14 @@
 package fuse_p2p
 
 import (
+	"context"
 	"fmt"
 	"net"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"sync"
 	"syscall"
 	"testing"
@@ -16,7 +18,10 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/test/testutil"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
 )
 
 // p2pTestCluster manages a minimal SeaweedFS cluster exercising the peer
@@ -100,6 +105,8 @@ func startP2PTestCluster(t testing.TB, numMounts int) *p2pTestCluster {
 	require.NoError(t, c.startVolume(configDir))
 	require.NoError(t, c.waitForTCP(c.volumeCmd, "volume",
 		fmt.Sprintf("127.0.0.1:%d", c.volumePort), 30*time.Second))
+	require.NoError(t, c.waitForVolumeRegistered(30*time.Second),
+		"volume server registration\n%s", c.tailLog("master"))
 
 	require.NoError(t, c.startFiler(configDir))
 	require.NoError(t, c.waitForTCP(c.filerCmd, "filer",
@@ -272,7 +279,10 @@ func (c *p2pTestCluster) tailLogFull(name string) string {
 }
 
 func (c *p2pTestCluster) copyLogsForCI() {
-	ciLogDir := "/tmp/seaweedfs-fuse-p2p-logs"
+	// One subdirectory per test: a flat layout lets every teardown overwrite
+	// the previous test's logs, so the CI artifact only ever shows the last
+	// cluster, never the failing one.
+	ciLogDir := filepath.Join("/tmp/seaweedfs-fuse-p2p-logs", strings.ReplaceAll(c.t.Name(), "/", "_"))
 	os.MkdirAll(ciLogDir, 0755)
 	logsDir := filepath.Join(c.baseDir, "logs")
 	entries, err := os.ReadDir(logsDir)
@@ -288,6 +298,44 @@ func (c *p2pTestCluster) copyLogsForCI() {
 	}
 }
 
+// waitForVolumeRegistered waits until the volume server shows up in the master
+// topology with its slots reported. An open volume port only means the process
+// is listening: until the master has elected itself and accepted a heartbeat,
+// an assign fails and the first write on a fresh mount surfaces it as ENOSPC.
+func (c *p2pTestCluster) waitForVolumeRegistered(timeout time.Duration) error {
+	addr := fmt.Sprintf("127.0.0.1:%d", c.masterGrpcPort)
+	conn, err := grpc.NewClient(addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+
+	client := master_pb.NewSeaweedClient(conn)
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		resp, err := client.VolumeList(ctx, &master_pb.VolumeListRequest{})
+		cancel()
+		if err == nil && resp.TopologyInfo != nil {
+			var slots int64
+			for _, dc := range resp.TopologyInfo.DataCenterInfos {
+				for _, rack := range dc.RackInfos {
+					for _, dn := range rack.DataNodeInfos {
+						for _, disk := range dn.DiskInfos {
+							slots += disk.MaxVolumeCount
+						}
+					}
+				}
+			}
+			if slots > 0 {
+				return nil
+			}
+		}
+		time.Sleep(200 * time.Millisecond)
+	}
+	return fmt.Errorf("volume server not registered with the master within %v", timeout)
+}
+
 // waitForTCP polls addr until it accepts a connection, OR the supplied
 // subprocess exits — whichever comes first. Short-circuiting on child
 // exit turns a 30 s-spin-on-dead-process into an immediate failure with
diff --git a/test/fuse_p2p/peer_chunk_sharing_test.go b/test/fuse_p2p/peer_chunk_sharing_test.go
index c64bc0c7f8..8daf0e1445 100644
--- a/test/fuse_p2p/peer_chunk_sharing_test.go
+++ b/test/fuse_p2p/peer_chunk_sharing_test.go
@@ -1,3 +1,5 @@
+//go:build linux || darwin
+
 package fuse_p2p
 
 import (
diff --git a/test/java/spark/pom.xml b/test/java/spark/pom.xml
index 37cf449d45..de069de358 100644
--- a/test/java/spark/pom.xml
+++ b/test/java/spark/pom.xml
@@ -16,12 +16,12 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.source>11</maven.compiler.source>
         <maven.compiler.target>11</maven.compiler.target>
-        <spark.version>3.5.7</spark.version>
+        <spark.version>3.5.8</spark.version>
         <hadoop.version>3.3.6</hadoop.version>
         <scala.binary.version>2.12</scala.binary.version>
         <junit.version>4.13.2</junit.version>
         <seaweedfs.hadoop3.client.version>4.00</seaweedfs.hadoop3.client.version>
-        <jackson.version>2.22.1</jackson.version> <!-- Upgraded from 2.15.3 -->
+        <jackson.version>2.22.3</jackson.version> <!-- Upgraded from 2.15.3 -->
         <!-- jackson-annotations dropped the patch digit in 2.20; matches jackson.version's major.minor -->
         <jackson.annotations.version>2.22</jackson.annotations.version>
         <netty.version>4.2.16.Final</netty.version> <!-- Upgraded to 4.1.125.Final for security fixes (CVE in netty-codec < 4.1.125.Final, netty-codec-http2 <= 4.1.123.Final) -->
diff --git a/test/kafka/Dockerfile.kafka-gateway b/test/kafka/Dockerfile.kafka-gateway
index 32b3d46631..a1300b070b 100644
--- a/test/kafka/Dockerfile.kafka-gateway
+++ b/test/kafka/Dockerfile.kafka-gateway
@@ -1,5 +1,5 @@
 # Dockerfile for Kafka Gateway Integration Testing
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git make gcc musl-dev sqlite-dev
diff --git a/test/kafka/Dockerfile.seaweedfs b/test/kafka/Dockerfile.seaweedfs
index ce889e25e4..84ddac3a9f 100644
--- a/test/kafka/Dockerfile.seaweedfs
+++ b/test/kafka/Dockerfile.seaweedfs
@@ -1,5 +1,5 @@
 # Dockerfile for building SeaweedFS components from the current workspace
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 RUN apk add --no-cache git make gcc musl-dev sqlite-dev
 
diff --git a/test/kafka/Dockerfile.test-setup b/test/kafka/Dockerfile.test-setup
index e4290ecdad..d5026c0751 100644
--- a/test/kafka/Dockerfile.test-setup
+++ b/test/kafka/Dockerfile.test-setup
@@ -1,5 +1,5 @@
 # Dockerfile for Kafka Integration Test Setup
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git make gcc musl-dev
diff --git a/test/kafka/go.mod b/test/kafka/go.mod
index fda49e8490..585ee973c8 100644
--- a/test/kafka/go.mod
+++ b/test/kafka/go.mod
@@ -1,30 +1,30 @@
 module github.com/seaweedfs/seaweedfs/test/kafka
 
-go 1.25.0
+go 1.26.6
 
 require (
 	github.com/IBM/sarama v1.46.0
 	github.com/linkedin/goavro/v2 v2.15.0
 	github.com/seaweedfs/seaweedfs v0.0.0-00010101000000-000000000000
 	github.com/segmentio/kafka-go v0.4.49
-	github.com/stretchr/testify v1.11.1
-	google.golang.org/grpc v1.81.1
+	github.com/stretchr/testify v1.12.1
+	google.golang.org/grpc v1.85.0-dev.0.20260915183914-4e49413dcab7
 )
 
 replace github.com/seaweedfs/seaweedfs => ../../
 
 require (
-	github.com/andybalholm/brotli v1.2.0 // indirect
+	github.com/andybalholm/brotli v1.2.3 // indirect
 	github.com/aws/aws-sdk-go v1.55.8 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cognusion/imaging v1.0.3 // indirect
+	github.com/cognusion/imaging v1.0.4 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/dustin/go-humanize v1.1.0 // indirect
 	github.com/eapache/go-resiliency v1.7.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 // indirect
 	github.com/eapache/queue v1.1.0 // indirect
-	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/ebitengine/purego v0.10.2 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
@@ -36,6 +36,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/jcmturner/aescts/v2 v2.0.0 // indirect
 	github.com/jcmturner/dnsutils/v2 v2.0.0 // indirect
 	github.com/jcmturner/gofork v1.7.6 // indirect
@@ -45,41 +46,41 @@ require (
 	github.com/jhump/protoreflect/v2 v2.0.0-beta.1 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/karlseguin/ccache/v2 v2.0.8 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
-	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
-	github.com/klauspost/reedsolomon v1.14.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
+	github.com/klauspost/reedsolomon v1.14.2 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260627054121-477a66015f15 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/onsi/ginkgo v1.16.5 // indirect
 	github.com/onsi/gomega v1.37.0 // indirect
 	github.com/orcaman/concurrent-map/v2 v2.0.1 // indirect
 	github.com/parquet-go/bitpack v1.0.0 // indirect
 	github.com/parquet-go/jsonlite v1.0.0 // indirect
-	github.com/parquet-go/parquet-go v0.30.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/parquet-go/parquet-go v0.32.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.3 // indirect
 	github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 // indirect
-	github.com/pierrec/lz4/v4 v4.1.27 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/pierrec/lz4/v4 v4.1.29 // indirect
+	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.67.5 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/client_golang v1.24.1 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
 	github.com/rdleal/intervalst v1.5.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/seaweedfs/goexif v1.0.3 // indirect
-	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
+	github.com/shirou/gopsutil/v4 v4.26.7 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.21.0 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.8.1 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965 // indirect
-	github.com/tklauser/go-sysconf v0.3.16 // indirect
-	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/tklauser/go-sysconf v0.4.0 // indirect
+	github.com/tklauser/numcpus v0.12.0 // indirect
 	github.com/twpayne/go-geom v1.6.1 // indirect
 	github.com/tylertreat/BoomFilters v0.0.0-20210315201527-1a82519a3e43 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
@@ -88,16 +89,14 @@ require (
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/image v0.41.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/image v0.46.0 // indirect
+	golang.org/x/net v0.58.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/grpc/security/advancedtls v1.0.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 )
diff --git a/test/kafka/go.sum b/test/kafka/go.sum
index 0def691bcb..238c0a71d6 100644
--- a/test/kafka/go.sum
+++ b/test/kafka/go.sum
@@ -10,8 +10,8 @@ github.com/alecthomas/assert/v2 v2.10.0 h1:jjRCHsj6hBJhkmhznrCzoNpbA3zqy0fYiUcYZ
 github.com/alecthomas/assert/v2 v2.10.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc=
 github.com/alecthomas/repr v0.4.0/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
-github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ=
-github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
+github.com/andybalholm/brotli v1.2.3 h1:8H1qwOkl2LPfjf3YezB90JnCliZb6SInJ/OJkEbA5NQ=
+github.com/andybalholm/brotli v1.2.3/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/aws/aws-sdk-go v1.55.8 h1:JRmEUbU52aJQZ2AjX4q4Wu7t4uZjOu71uyNmaWlUkJQ=
 github.com/aws/aws-sdk-go v1.55.8/go.mod h1:ZkViS9AqA6otK+JBBNH2++sx1sgxrPKcSzPPvQkUtXk=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -20,24 +20,24 @@ github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/
 github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cognusion/imaging v1.0.3 h1:nHyIeEVDV8JkBbuhgx8iSBW72W8rHbDEyruA0Jh7Lnk=
-github.com/cognusion/imaging v1.0.3/go.mod h1:38tFLFhGK81ORThZG8dVXPtp1uhd+3xM1WXuMn+unOA=
+github.com/cognusion/imaging v1.0.4 h1:hrmWVa4S9fiLJJFKEHYYRNBUnHEKZD8/oxnC77xTUa0=
+github.com/cognusion/imaging v1.0.4/go.mod h1:X1mPSSZpMyiva54chCO/1NROp+b6xG4uMcud8VLii+U=
 github.com/d4l3k/messagediff v1.2.1 h1:ZcAIMYsUg0EAp9X+tt8/enBE/Q8Yd5kzPynLyKptt9U=
 github.com/d4l3k/messagediff v1.2.1/go.mod h1:Oozbb1TVXFac9FtSIxHBMnBCq2qeH/2KkEQxENCrlLo=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
+github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
 github.com/eapache/go-resiliency v1.7.0 h1:n3NRTnBn5N0Cbi/IeOHuQn9s2UwVUH7Ga0ZWcP+9JTA=
 github.com/eapache/go-resiliency v1.7.0/go.mod h1:5yPzW0MIvSe0JDsv0v+DvcjEv2FyD6iZYSs1ZI+iQho=
 github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3 h1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws=
 github.com/eapache/go-xerial-snappy v0.0.0-20230731223053-c322873962e3/go.mod h1:YvSRo5mw33fLEx1+DlK6L2VV43tJt5Eyel9n9XBcR+0=
 github.com/eapache/queue v1.1.0 h1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=
 github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
-github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
-github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE=
+github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
 github.com/fortytw2/leaktest v1.3.0/go.mod h1:jDsjWgpAGjm2CA7WthBh/CdZYEPF31XHquHwclZch5g=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
@@ -50,10 +50,6 @@ github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8b
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
 github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
-github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
@@ -90,6 +86,8 @@ github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/z
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@@ -117,12 +115,12 @@ github.com/karlseguin/ccache/v2 v2.0.8 h1:lT38cE//uyf6KcFok0rlgXtGFBWxkI6h/qg4tb
 github.com/karlseguin/ccache/v2 v2.0.8/go.mod h1:2BDThcfQMf/c0jnZowt16eW405XIqZPavt+HoYEtcxQ=
 github.com/karlseguin/expect v1.0.2-0.20190806010014-778a5f0c6003 h1:vJ0Snvo+SLMY72r5J4sEfkuE7AFbixEP2qRbEcum/wA=
 github.com/karlseguin/expect v1.0.2-0.20190806010014-778a5f0c6003/go.mod h1:zNBxMY8P21owkeogJELCLeHIt+voOSduHYTFUbwRAV8=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
-github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
-github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
-github.com/klauspost/reedsolomon v1.14.0 h1:5YSZeclzSYg5nl349+GDG/agDtQ6MZiwUYXvVKN1Jx0=
-github.com/klauspost/reedsolomon v1.14.0/go.mod h1:yjqqjgMTQkBUHSG97/rm4zipffCNbCiZcB3kTqr++sQ=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
+github.com/klauspost/reedsolomon v1.14.2 h1:SafJYwpBBQBI6amHUygcjxZjXeN2HpiENHQDwuPWCCQ=
+github.com/klauspost/reedsolomon v1.14.2/go.mod h1:yjqqjgMTQkBUHSG97/rm4zipffCNbCiZcB3kTqr++sQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -131,8 +129,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/linkedin/goavro/v2 v2.15.0 h1:pDj1UrjUOO62iXhgBiE7jQkpNIc5/tA5eZsgolMjgVI=
 github.com/linkedin/goavro/v2 v2.15.0/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk=
-github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 h1:PTw+yKnXcOFCR6+8hHTyWBeQ/P4Nb7dd4/0ohEcWQuM=
-github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lufia/plan9stats v0.0.0-20260627054121-477a66015f15 h1:YkjVPl/YH5XlJ+/NiwzJtPYXXKRcyjmEUhsDci6YK3c=
+github.com/lufia/plan9stats v0.0.0-20260627054121-477a66015f15/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -155,43 +153,45 @@ github.com/parquet-go/bitpack v1.0.0 h1:AUqzlKzPPXf2bCdjfj4sTeacrUwsT7NlcYDMUQxP
 github.com/parquet-go/bitpack v1.0.0/go.mod h1:XnVk9TH+O40eOOmvpAVZ7K2ocQFrQwysLMnc6M/8lgs=
 github.com/parquet-go/jsonlite v1.0.0 h1:87QNdi56wOfsE5bdgas0vRzHPxfJgzrXGml1zZdd7VU=
 github.com/parquet-go/jsonlite v1.0.0/go.mod h1:nDjpkpL4EOtqs6NQugUsi0Rleq9sW/OtC1NnZEnxzF0=
-github.com/parquet-go/parquet-go v0.30.1 h1:Oy6ganNrAdFiVwy7wNmWagfPTWA2X9Z3tVHBc7JtuX8=
-github.com/parquet-go/parquet-go v0.30.1/go.mod h1:navtkAYr2LGoJVp141oXPlO/sxLvaOe3la2JEoD8+rg=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/parquet-go/parquet-go v0.32.0 h1:NWDqTUHfrCS4cJP/Fj2HlxvqsrVedWG3sayMkf+znzM=
+github.com/parquet-go/parquet-go v0.32.0/go.mod h1:navtkAYr2LGoJVp141oXPlO/sxLvaOe3la2JEoD8+rg=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741 h1:KPpdlQLZcHfTMQRi6bFQ7ogNO0ltFT4PmtwTLW4W+14=
 github.com/petermattis/goid v0.0.0-20260113132338-7c7de50cc741/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
-github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk=
-github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
+github.com/pierrec/lz4/v4 v4.1.29 h1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=
+github.com/pierrec/lz4/v4 v4.1.29/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
-github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=
-github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw=
-github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=
-github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo=
+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
+github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=
+github.com/prometheus/common v0.71.0/go.mod h1:CLJ5H8TEsGX8bl31BdMkfhIZ+QmZ9tBPPotUxUbfcmk=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 h1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=
 github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rdleal/intervalst v1.5.0 h1:SEB9bCFz5IqD1yhfH1Wv8IBnY/JQxDplwkxHjT6hamU=
 github.com/rdleal/intervalst v1.5.0/go.mod h1:xO89Z6BC+LQDH+IPQQw/OESt5UADgFD41tYMUINGpxQ=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc=
+github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
 github.com/seaweedfs/goexif v1.0.3 h1:ve/OjI7dxPW8X9YQsv3JuVMaxEyF9Rvfd04ouL+Bz30=
 github.com/seaweedfs/goexif v1.0.3/go.mod h1:Oni780Z236sXpIQzk1XoJlTwqrJ02smEin9zQeff7Fk=
 github.com/segmentio/kafka-go v0.4.49 h1:GJiNX1d/g+kG6ljyJEoi9++PUMdXGAxb7JGPiDCuNmk=
 github.com/segmentio/kafka-go v0.4.49/go.mod h1:Y1gn60kzLEEaW28YshXyk2+VCUKbJ3Qr6DrnT3i4+9E=
-github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
-github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/shirou/gopsutil/v4 v4.26.7 h1:IXzpHz/dkMRYAhKkOXr1HB6SuzWU3eoyyeWe7g3bNZc=
+github.com/shirou/gopsutil/v4 v4.26.7/go.mod h1:5O9FjBiXoTDFatIWjZZosqj4pV0DRtLx598xGbBehzM=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw=
 github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U=
 github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
@@ -202,8 +202,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
-github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
-github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E=
+github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -214,16 +214,16 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.5/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965 h1:1oFLiOyVl+W7bnBzGhf7BbIv9loSFQcieWWYIjLqcAw=
 github.com/syndtr/goleveldb v1.0.1-0.20190318030020-c3a204f8e965/go.mod h1:9OrXJhf154huy1nPWmuSrkgjPUtUNhA+Zmy+6AESzuA=
-github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
-github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
-github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
-github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/tklauser/go-sysconf v0.4.0 h1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=
+github.com/tklauser/go-sysconf v0.4.0/go.mod h1:8mTNWyog7H+MpKijp4VmKJAd2bbYQ2zuUwkYRbUArPI=
+github.com/tklauser/numcpus v0.12.0 h1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=
+github.com/tklauser/numcpus v0.12.0/go.mod h1:ABHeXzJnr/qqwguhClkZKT1/8VABcYrsyUiUGobwWJg=
 github.com/twpayne/go-geom v1.6.1 h1:iLE+Opv0Ihm/ABIcvQFGIiFBXd76oBIar9drAwHFhR4=
 github.com/twpayne/go-geom v1.6.1/go.mod h1:Kr+Nly6BswFsKM5sd31YaoWS5PeDDH2NftJTK7Gd028=
 github.com/tylertreat/BoomFilters v0.0.0-20210315201527-1a82519a3e43 h1:QEePdg0ty2r0t1+qwfZmQ4OOl/MB2UXIeJSpIZv56lg=
@@ -257,33 +257,21 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
-go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
-go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo=
-golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/image v0.46.0 h1:b1+oYj0Jbp6K5MDT4i4/eZpYlk3V8SJhhDKh6LBHAyQ=
+golang.org/x/image v0.46.0/go.mod h1:3B3W05VGVQyuXucLINLjXKrqISASfi4Xj+iCVkLMwew=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -296,16 +284,16 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -323,8 +311,8 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -332,8 +320,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
@@ -344,10 +332,10 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4 h1:tEkOQcXgF6dH1G+MVKZrfpYvozGrzb91k6ha7jireSM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260427160629-7cedc36a6bc4/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
-google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA=
+google.golang.org/grpc v1.85.0-dev.0.20260915183914-4e49413dcab7 h1:5+EEM1fC0yjOZID0NUZVrE2+8M/+1TclNrSz/l1xMYs=
+google.golang.org/grpc v1.85.0-dev.0.20260915183914-4e49413dcab7/go.mod h1:Ovl0ECo4xx5r4kn/6d4BPSNB7OIFuu6EAjOzjtVAKaM=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6 h1:ExN12ndbJ608cboPYflpTny6mXSzPrDLh0iTaVrRrds=
 google.golang.org/grpc/examples v0.0.0-20250407062114-b368379ef8f6/go.mod h1:6ytKWczdvnpnO+m+JiG9NjEDzR1FJfsnmJdG7B8QVZ8=
 google.golang.org/grpc/security/advancedtls v1.0.0 h1:/KQ7VP/1bs53/aopk9QhuPyFAp9Dm9Ejix3lzYkCrDA=
@@ -358,11 +346,9 @@ google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQ
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
diff --git a/test/kafka/kafka-client-loadtest/Dockerfile.loadtest b/test/kafka/kafka-client-loadtest/Dockerfile.loadtest
index b16bdb9c08..5e157744e0 100644
--- a/test/kafka/kafka-client-loadtest/Dockerfile.loadtest
+++ b/test/kafka/kafka-client-loadtest/Dockerfile.loadtest
@@ -2,7 +2,7 @@
 # Multi-stage build for cross-platform support
 
 # Stage 1: Builder
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 WORKDIR /app
 
diff --git a/test/kafka/kafka-client-loadtest/README.md b/test/kafka/kafka-client-loadtest/README.md
index 4f465a21bc..49375323be 100644
--- a/test/kafka/kafka-client-loadtest/README.md
+++ b/test/kafka/kafka-client-loadtest/README.md
@@ -314,7 +314,7 @@ make dev-env
 # Build load test binary
 make build
 
-# Run tests locally (requires Go 1.21+)
+# Run tests locally (requires Go 1.26+)
 cd cmd/loadtest && go run main.go -config ../../config/loadtest.yaml
 ```
 
diff --git a/test/kafka/kafka-client-loadtest/go.mod b/test/kafka/kafka-client-loadtest/go.mod
index 860c9599db..d40ec326ff 100644
--- a/test/kafka/kafka-client-loadtest/go.mod
+++ b/test/kafka/kafka-client-loadtest/go.mod
@@ -1,6 +1,6 @@
 module github.com/seaweedfs/seaweedfs/test/kafka/kafka-client-loadtest
 
-go 1.25.0
+go 1.26.6
 
 require (
 	github.com/IBM/sarama v1.46.1
@@ -24,7 +24,7 @@ require (
 	github.com/jcmturner/gofork v1.7.6 // indirect
 	github.com/jcmturner/gokrb5/v8 v8.4.4 // indirect
 	github.com/jcmturner/rpc/v2 v2.0.3 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/kr/text v0.2.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pierrec/lz4/v4 v4.1.22 // indirect
@@ -33,7 +33,7 @@ require (
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 )
diff --git a/test/kafka/kafka-client-loadtest/go.sum b/test/kafka/kafka-client-loadtest/go.sum
index 1ef256006d..5a4a3f6497 100644
--- a/test/kafka/kafka-client-loadtest/go.sum
+++ b/test/kafka/kafka-client-loadtest/go.sum
@@ -38,8 +38,8 @@ github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh6
 github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
 github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
 github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -84,8 +84,8 @@ go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -93,8 +93,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
@@ -105,8 +105,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
diff --git a/test/kafka/kafka-client-loadtest/tools/go.mod b/test/kafka/kafka-client-loadtest/tools/go.mod
index c63d94230c..46b21e0969 100644
--- a/test/kafka/kafka-client-loadtest/tools/go.mod
+++ b/test/kafka/kafka-client-loadtest/tools/go.mod
@@ -5,6 +5,6 @@ go 1.24.7
 require github.com/segmentio/kafka-go v0.4.49
 
 require (
-	github.com/klauspost/compress v1.15.9 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 )
diff --git a/test/kafka/kafka-client-loadtest/tools/go.sum b/test/kafka/kafka-client-loadtest/tools/go.sum
index 74b476c2d4..e959e83902 100644
--- a/test/kafka/kafka-client-loadtest/tools/go.sum
+++ b/test/kafka/kafka-client-loadtest/tools/go.sum
@@ -1,7 +1,7 @@
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/klauspost/compress v1.15.9 h1:wKRjX6JRtDdrE9qwa4b/Cip7ACOshUI4smpCQanqjSY=
-github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
diff --git a/test/kafka/simple-consumer/go.mod b/test/kafka/simple-consumer/go.mod
index 1ced43c66d..9c357277fc 100644
--- a/test/kafka/simple-consumer/go.mod
+++ b/test/kafka/simple-consumer/go.mod
@@ -1,10 +1,10 @@
 module simple-consumer
 
-go 1.21
+go 1.24
 
 require github.com/segmentio/kafka-go v0.4.47
 
 require (
-	github.com/klauspost/compress v1.17.0 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 )
diff --git a/test/kafka/simple-consumer/go.sum b/test/kafka/simple-consumer/go.sum
index c9f731f2bb..4cdfe5843b 100644
--- a/test/kafka/simple-consumer/go.sum
+++ b/test/kafka/simple-consumer/go.sum
@@ -2,8 +2,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM=
-github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
diff --git a/test/kafka/simple-publisher/go.mod b/test/kafka/simple-publisher/go.mod
index 09309f0f23..de391da489 100644
--- a/test/kafka/simple-publisher/go.mod
+++ b/test/kafka/simple-publisher/go.mod
@@ -1,10 +1,10 @@
 module simple-publisher
 
-go 1.21
+go 1.25
 
 require github.com/segmentio/kafka-go v0.4.47
 
 require (
-	github.com/klauspost/compress v1.17.0 // indirect
+	github.com/klauspost/compress v1.20.3 // indirect
 	github.com/pierrec/lz4/v4 v4.1.15 // indirect
 )
diff --git a/test/kafka/simple-publisher/go.sum b/test/kafka/simple-publisher/go.sum
index c9f731f2bb..82af443f27 100644
--- a/test/kafka/simple-publisher/go.sum
+++ b/test/kafka/simple-publisher/go.sum
@@ -2,8 +2,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM=
-github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.20.3 h1:zWNoFqq/lSuYQRim3dUXlXeA0IqwuZGicdG5ZTfY5j4=
+github.com/klauspost/compress v1.20.3/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
 github.com/pierrec/lz4/v4 v4.1.15 h1:MO0/ucJhngq7299dKLwIMtgTfbkoSPF6AoMYDd8Q4q0=
 github.com/pierrec/lz4/v4 v4.1.15/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
diff --git a/test/kms/Makefile b/test/kms/Makefile
index a46aa19b25..47736f6800 100644
--- a/test/kms/Makefile
+++ b/test/kms/Makefile
@@ -174,12 +174,12 @@ start-openbao-ci: ## Start OpenBao via Docker for CI
 		ghcr.io/openbao/openbao:latest \
 		bao server -dev -dev-root-token-id=$(OPENBAO_TOKEN) -dev-listen-address=0.0.0.0:8200
 	@echo "Waiting for OpenBao to be ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s $(OPENBAO_ADDR)/v1/sys/health > /dev/null 2>&1; then \
 			echo "$(GREEN)OpenBao is ready$(NC)"; \
 			break; \
 		fi; \
-		if [ $$i -eq 30 ]; then \
+		if [ $$i -eq 90 ]; then \
 			echo "$(RED)Timeout waiting for OpenBao$(NC)"; \
 			docker logs openbao-ci 2>&1 | tail -20; \
 			exit 1; \
@@ -213,12 +213,12 @@ start-seaweedfs-ci: check-binary ## Start weed mini with OpenBao KMS config
 		-ip=127.0.0.1 \
 		> /tmp/seaweedfs-kms-mini.log 2>&1 & echo $$! > /tmp/weed-kms-mini.pid
 	@echo "Checking S3 service is ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s http://127.0.0.1:$(S3_PORT) > /dev/null 2>&1; then \
 			echo "$(GREEN)S3 service is ready$(NC)"; \
 			break; \
 		fi; \
-		if [ $$i -eq 30 ]; then \
+		if [ $$i -eq 90 ]; then \
 			echo "$(RED)Timeout waiting for S3 service$(NC)"; \
 			echo "=== Last 50 lines of server log ==="; \
 			tail -50 /tmp/seaweedfs-kms-mini.log 2>/dev/null || echo "No server log found"; \
diff --git a/test/master_cold_start/assign_test.go b/test/master_cold_start/assign_test.go
index 6a5686a596..04a03a63c3 100644
--- a/test/master_cold_start/assign_test.go
+++ b/test/master_cold_start/assign_test.go
@@ -12,41 +12,51 @@ import (
 	"time"
 
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 )
 
-// The very first write against a fresh cluster must succeed in one shot: the
-// assign that triggers volume growth waits for it instead of shedding itself
-// with "volume growth in progress". No client retries — a single request per
-// assign, like a plain HTTP client.
+// The very first write against a fresh cluster must succeed: the assign that
+// triggers volume growth waits for it, and when growth outlasts that wait the
+// master sheds with a retryable 503/Retry-After. A normal client honors the
+// hint and retries, so the test does the same within a deadline.
 func TestColdStartFirstWrite(t *testing.T) {
 	c := StartCluster(t, 3)
 
 	// Each subtest uses its own replication so its volume layout starts cold.
 	t.Run("http_assign_and_write", func(t *testing.T) {
 		client := &http.Client{Timeout: 15 * time.Second}
-		resp, err := client.Get(c.MasterURL() + "/dir/assign?replication=002")
-		if err != nil {
-			t.Fatalf("dir/assign: %v", err)
-		}
-		body, _ := io.ReadAll(resp.Body)
-		resp.Body.Close()
-		if resp.StatusCode != http.StatusOK {
-			t.Fatalf("dir/assign returned %d: %s", resp.StatusCode, body)
-		}
 		var assign struct {
 			Fid   string `json:"fid"`
 			Url   string `json:"url"`
 			Error string `json:"error"`
 		}
-		if err := json.Unmarshal(body, &assign); err != nil {
-			t.Fatalf("parse assign response %q: %v", body, err)
-		}
-		if assign.Error != "" || assign.Fid == "" {
-			t.Fatalf("assign failed: %s", body)
+		deadline := time.Now().Add(60 * time.Second)
+		for {
+			resp, err := client.Get(c.MasterURL() + "/dir/assign?replication=002")
+			if err != nil {
+				t.Fatalf("dir/assign: %v", err)
+			}
+			body, _ := io.ReadAll(resp.Body)
+			resp.Body.Close()
+			if resp.StatusCode == http.StatusServiceUnavailable && time.Now().Before(deadline) {
+				time.Sleep(time.Second)
+				continue
+			}
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("dir/assign returned %d: %s", resp.StatusCode, body)
+			}
+			if err := json.Unmarshal(body, &assign); err != nil {
+				t.Fatalf("parse assign response %q: %v", body, err)
+			}
+			if assign.Error != "" || assign.Fid == "" {
+				t.Fatalf("assign failed: %s", body)
+			}
+			break
 		}
 
 		content := []byte("cold start write")
@@ -57,21 +67,28 @@ func TestColdStartFirstWrite(t *testing.T) {
 
 	t.Run("grpc_assign", func(t *testing.T) {
 		grpcDialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
-		err := pb.WithMasterClient(context.Background(), false, pb.ServerAddress(c.MasterAddress()), grpcDialOption, false,
-			func(client master_pb.SeaweedClient) error {
-				ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-				defer cancel()
-				resp, err := client.Assign(ctx, &master_pb.AssignRequest{Count: 1, Replication: "001"})
-				if err != nil {
-					return err
-				}
-				if resp.Error != "" || resp.Fid == "" {
-					return fmt.Errorf("assign failed: %+v", resp)
-				}
-				return nil
-			})
+		var err error
+		for deadline := time.Now().Add(60 * time.Second); ; {
+			err = pb.WithMasterClient(context.Background(), false, pb.ServerAddress(c.MasterAddress()), grpcDialOption, false,
+				func(client master_pb.SeaweedClient) error {
+					ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+					defer cancel()
+					resp, err := client.Assign(ctx, &master_pb.AssignRequest{Count: 1, Replication: "001"})
+					if err != nil {
+						return err
+					}
+					if resp.Error != "" || resp.Fid == "" {
+						return fmt.Errorf("assign failed: %+v", resp)
+					}
+					return nil
+				})
+			if err == nil || status.Code(err) != codes.ResourceExhausted || time.Now().After(deadline) {
+				break
+			}
+			time.Sleep(time.Second)
+		}
 		if err != nil {
-			t.Fatalf("single grpc assign on cold cluster: %v", err)
+			t.Fatalf("grpc assign on cold cluster: %v", err)
 		}
 	})
 }
diff --git a/test/mount_bench/main.go b/test/mount_bench/main.go
new file mode 100644
index 0000000000..174657feb5
--- /dev/null
+++ b/test/mount_bench/main.go
@@ -0,0 +1,408 @@
+// Command mount_bench times common filesystem operations against a mounted
+// directory and writes the results as JSON, so runs against different mounts
+// (WinFsp, rclone, libfuse) can be compared with -compare.
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"math/rand"
+	"mime/multipart"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	seqFileSize   = 256 << 20
+	seqBufSize    = 1 << 20
+	randReads     = 500
+	randReadSize  = 4 << 10
+	smallCount    = 400
+	smallSize     = 64 << 10
+	overwriteN    = 100
+	statRounds    = 3
+	listRounds    = 10
+	bigListCount  = 5000
+	bigListRounds = 3
+)
+
+type phaseResult struct {
+	Name    string  `json:"name"`
+	Seconds float64 `json:"seconds"`
+	Bytes   int64   `json:"bytes,omitempty"`
+	Ops     int64   `json:"ops,omitempty"`
+}
+
+type runResult struct {
+	Label  string        `json:"label"`
+	Phases []phaseResult `json:"phases"`
+}
+
+func main() {
+	dir := flag.String("dir", "", "directory on the mount to benchmark in; created if missing, must be a direct child of the mount root")
+	label := flag.String("label", "bench", "name for this result set")
+	out := flag.String("out", "", "write results as JSON to this file")
+	filer := flag.String("filer", "", "filer http address for out-of-band setup of the big-listing phase")
+	seed := flag.String("seed", "", "seed the big-listing directory at this filer-relative path and exit; for mounts that cache listings and would miss files created behind them")
+	compare := flag.String("compare", "", "comma-separated result JSON files; print a comparison table and exit")
+	flag.Parse()
+
+	if *compare != "" {
+		if err := printComparison(strings.Split(*compare, ",")); err != nil {
+			log.Fatal(err)
+		}
+		return
+	}
+	if *seed != "" {
+		if *filer == "" {
+			log.Fatal("-seed requires -filer")
+		}
+		if err := seedFilerDir(*filer, *seed, bigListCount); err != nil {
+			log.Fatal(err)
+		}
+		return
+	}
+	if *dir == "" {
+		log.Fatal("either -dir or -compare is required")
+	}
+	if err := os.MkdirAll(*dir, 0755); err != nil {
+		log.Fatal(err)
+	}
+
+	r := &runner{dir: *dir, filer: *filer, result: runResult{Label: *label}}
+	r.run()
+
+	data, err := json.MarshalIndent(r.result, "", "  ")
+	if err != nil {
+		log.Fatal(err)
+	}
+	if *out != "" {
+		if err := os.WriteFile(*out, data, 0644); err != nil {
+			log.Fatal(err)
+		}
+	}
+	fmt.Println(string(data))
+}
+
+type runner struct {
+	dir    string
+	filer  string
+	result runResult
+}
+
+func (r *runner) phase(name string, bytes, ops int64, fn func() error) {
+	start := time.Now()
+	if err := fn(); err != nil {
+		log.Fatalf("%s: %v", name, err)
+	}
+	elapsed := time.Since(start)
+	r.result.Phases = append(r.result.Phases, phaseResult{
+		Name: name, Seconds: elapsed.Seconds(), Bytes: bytes, Ops: ops,
+	})
+	fmt.Printf("%-14s %10.3fs%s\n", name, elapsed.Seconds(), rateSuffix(bytes, ops, elapsed.Seconds()))
+}
+
+func rateSuffix(bytes, ops int64, seconds float64) string {
+	if seconds <= 0 {
+		return ""
+	}
+	var parts []string
+	if bytes > 0 {
+		parts = append(parts, fmt.Sprintf("%8.1f MB/s", float64(bytes)/seconds/1e6))
+	}
+	if ops > 0 {
+		parts = append(parts, fmt.Sprintf("%8.1f ops/s", float64(ops)/seconds))
+	}
+	if len(parts) == 0 {
+		return ""
+	}
+	return "  " + strings.Join(parts, "  ")
+}
+
+func (r *runner) run() {
+	buf := make([]byte, seqBufSize)
+	rnd := rand.New(rand.NewSource(42))
+	rnd.Read(buf)
+
+	bigFile := filepath.Join(r.dir, "big.dat")
+	r.phase("seq_write", seqFileSize, 0, func() error {
+		f, err := os.Create(bigFile)
+		if err != nil {
+			return err
+		}
+		for written := 0; written < seqFileSize; written += len(buf) {
+			if _, err := f.Write(buf); err != nil {
+				f.Close()
+				return err
+			}
+		}
+		return f.Close()
+	})
+
+	r.phase("seq_read", seqFileSize, 0, func() error {
+		f, err := os.Open(bigFile)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+		n, err := io.CopyBuffer(io.Discard, f, buf)
+		if err != nil {
+			return err
+		}
+		if n != seqFileSize {
+			return fmt.Errorf("read %d bytes, want %d", n, seqFileSize)
+		}
+		return nil
+	})
+
+	r.phase("rand_read", randReads*randReadSize, randReads, func() error {
+		f, err := os.Open(bigFile)
+		if err != nil {
+			return err
+		}
+		defer f.Close()
+		block := make([]byte, randReadSize)
+		for i := 0; i < randReads; i++ {
+			off := rnd.Int63n(seqFileSize - randReadSize)
+			if _, err := f.ReadAt(block, off); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	smallDir := filepath.Join(r.dir, "small")
+	small := buf[:smallSize]
+	r.phase("small_write", smallCount*smallSize, smallCount, func() error {
+		if err := os.MkdirAll(smallDir, 0755); err != nil {
+			return err
+		}
+		for i := 0; i < smallCount; i++ {
+			if err := os.WriteFile(filepath.Join(smallDir, fmt.Sprintf("f%04d.dat", i)), small, 0644); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	r.phase("small_read", smallCount*smallSize, smallCount, func() error {
+		for i := 0; i < smallCount; i++ {
+			data, err := os.ReadFile(filepath.Join(smallDir, fmt.Sprintf("f%04d.dat", i)))
+			if err != nil {
+				return err
+			}
+			if len(data) != smallSize {
+				return fmt.Errorf("file %d: read %d bytes, want %d", i, len(data), smallSize)
+			}
+		}
+		return nil
+	})
+
+	r.phase("stat_files", 0, smallCount*statRounds, func() error {
+		for round := 0; round < statRounds; round++ {
+			for i := 0; i < smallCount; i++ {
+				if _, err := os.Stat(filepath.Join(smallDir, fmt.Sprintf("f%04d.dat", i))); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	})
+
+	r.phase("list_dir", 0, listRounds, func() error {
+		for round := 0; round < listRounds; round++ {
+			entries, err := os.ReadDir(smallDir)
+			if err != nil {
+				return err
+			}
+			if len(entries) != smallCount {
+				return fmt.Errorf("listed %d entries, want %d", len(entries), smallCount)
+			}
+		}
+		return nil
+	})
+
+	r.phase("overwrite", overwriteN*smallSize, overwriteN, func() error {
+		for i := 0; i < overwriteN; i++ {
+			if err := os.WriteFile(filepath.Join(smallDir, fmt.Sprintf("f%04d.dat", i)), small, 0644); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	r.phase("delete", 0, smallCount, func() error {
+		for i := 0; i < smallCount; i++ {
+			if err := os.Remove(filepath.Join(smallDir, fmt.Sprintf("f%04d.dat", i))); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+
+	if r.filer != "" {
+		r.bigListPhase()
+	}
+}
+
+// bigListPhase enumerates a directory whose files were created directly
+// against the filer, so the listing is measured on its own rather than after
+// this process has created (and possibly cached) every entry itself.
+func (r *runner) bigListPhase() {
+	// The bench dir is a direct child of the mount root, so its base name is
+	// also its path on the filer.
+	mountName := filepath.Base(r.dir)
+	bigDir := filepath.Join(r.dir, "biglist")
+	if err := seedFilerDir(r.filer, mountName+"/biglist", bigListCount); err != nil {
+		log.Fatalf("seeding %d files via filer: %v", bigListCount, err)
+	}
+
+	r.phase("list_5k", 0, bigListCount*bigListRounds, func() error {
+		for round := 0; round < bigListRounds; round++ {
+			entries, err := os.ReadDir(bigDir)
+			if err != nil {
+				return err
+			}
+			if len(entries) != bigListCount {
+				return fmt.Errorf("listed %d entries, want %d", len(entries), bigListCount)
+			}
+		}
+		return nil
+	})
+
+	r.phase("walk_5k", 0, bigListCount, func() error {
+		entries, err := os.ReadDir(bigDir)
+		if err != nil {
+			return err
+		}
+		for _, entry := range entries {
+			if _, err := entry.Info(); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}
+
+// seedFilerDir creates count tiny files under dir on the filer over plain
+// HTTP, in parallel, bypassing the mount entirely.
+func seedFilerDir(filer, dir string, count int) error {
+	content := []byte("x")
+	var wg sync.WaitGroup
+	errs := make(chan error, count)
+	sem := make(chan struct{}, 64)
+	client := &http.Client{Timeout: 30 * time.Second}
+	for i := 0; i < count; i++ {
+		wg.Add(1)
+		sem <- struct{}{}
+		go func(i int) {
+			defer wg.Done()
+			defer func() { <-sem }()
+			url := fmt.Sprintf("http://%s/%s/img%05d.jpg", filer, dir, i)
+			if err := uploadOne(client, url, content); err != nil {
+				errs <- fmt.Errorf("%s: %w", url, err)
+			}
+		}(i)
+	}
+	wg.Wait()
+	close(errs)
+	return <-errs
+}
+
+func uploadOne(client *http.Client, url string, content []byte) error {
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	part, err := writer.CreateFormFile("file", filepath.Base(url))
+	if err != nil {
+		return err
+	}
+	if _, err := part.Write(content); err != nil {
+		return err
+	}
+	if err := writer.Close(); err != nil {
+		return err
+	}
+	req, err := http.NewRequest(http.MethodPost, url, &body)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	resp, err := client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("status %s", resp.Status)
+	}
+	return nil
+}
+
+// printComparison renders the named result files side by side as a markdown
+// table, one row per phase, with throughput where the phase moved bytes and
+// operation rate otherwise.
+func printComparison(files []string) error {
+	var runs []runResult
+	for _, file := range files {
+		data, err := os.ReadFile(strings.TrimSpace(file))
+		if err != nil {
+			return err
+		}
+		var run runResult
+		if err := json.Unmarshal(data, &run); err != nil {
+			return fmt.Errorf("%s: %w", file, err)
+		}
+		runs = append(runs, run)
+	}
+	if len(runs) == 0 {
+		return fmt.Errorf("no result files")
+	}
+
+	// Preserve the phase order of the first run, appending any extras.
+	var order []string
+	seen := map[string]bool{}
+	for _, run := range runs {
+		for _, p := range run.Phases {
+			if !seen[p.Name] {
+				seen[p.Name] = true
+				order = append(order, p.Name)
+			}
+		}
+	}
+	byName := make([]map[string]phaseResult, len(runs))
+	for i, run := range runs {
+		byName[i] = map[string]phaseResult{}
+		for _, p := range run.Phases {
+			byName[i][p.Name] = p
+		}
+	}
+
+	header := []string{"phase"}
+	for _, run := range runs {
+		header = append(header, run.Label+" (s)", run.Label+" rate")
+	}
+	fmt.Println("| " + strings.Join(header, " | ") + " |")
+	fmt.Println("|" + strings.Repeat("---|", len(header)))
+	for _, name := range order {
+		row := []string{name}
+		for i := range runs {
+			p, ok := byName[i][name]
+			if !ok {
+				row = append(row, "-", "-")
+				continue
+			}
+			row = append(row, fmt.Sprintf("%.2f", p.Seconds), strings.TrimSpace(rateSuffix(p.Bytes, p.Ops, p.Seconds)))
+		}
+		fmt.Println("| " + strings.Join(row, " | ") + " |")
+	}
+	return nil
+}
diff --git a/test/multi_master/chaos_test.go b/test/multi_master/chaos_test.go
new file mode 100644
index 0000000000..50a2be6cad
--- /dev/null
+++ b/test/multi_master/chaos_test.go
@@ -0,0 +1,186 @@
+package multi_master
+
+import (
+	"fmt"
+	"math/rand/v2"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+)
+
+// chaosRounds is one stop or start per round, enough to walk in and out of
+// quorum several times without turning this into a soak test.
+const chaosRounds = 12
+
+// TestRandomStartStopElection bounces masters at random and holds the election
+// to the two things it must never get wrong: two masters claiming leadership at
+// once, and a quorum that comes back without agreeing on one. The cluster's
+// identity has to survive the whole walk — a master that re-mints a TopologyId
+// here is the split brain SetTopologyId kills its peers over.
+func TestRandomStartStopElection(t *testing.T) {
+	for _, impl := range raftImplementations {
+		t.Run(impl.name, func(t *testing.T) {
+			seed := chaosSeed(t)
+			t.Logf("seed %d — replay this walk with MULTI_MASTER_IT_SEED=%d", seed, seed)
+			rng := rand.New(rand.NewPCG(seed, seed))
+
+			mc := NewMasterCluster(t, impl.raftHashicorp)
+			for i := range 3 {
+				mc.StartNode(i)
+			}
+			if err := mc.WaitForLeader(waitTimeout); err != nil {
+				mc.DumpLogs()
+				t.Fatalf("cluster did not elect a leader: %v", err)
+			}
+			topologyId, err := mc.WaitForTopologyId(waitTimeout)
+			if err != nil {
+				mc.DumpLogs()
+				t.Fatalf("no initial TopologyId: %v", err)
+			}
+
+			for round := 1; round <= chaosRounds; round++ {
+				target := rng.IntN(3)
+				if mc.IsNodeRunning(target) {
+					mc.StopNode(target)
+					t.Logf("round %d: stopped master %d, %d left running", round, target, runningMasters(mc))
+				} else {
+					mc.StartNode(target)
+					t.Logf("round %d: started master %d, %d now running", round, target, runningMasters(mc))
+				}
+
+				if err := waitForSettledElection(mc, leaderElectionTimeout); err != nil {
+					mc.DumpLogs()
+					t.Fatalf("round %d (seed %d): %v", round, seed, err)
+				}
+
+				// /dir/status proxies to the leader, so this reads the value the
+				// cluster as a whole is carrying, not any one master's copy.
+				if runningMasters(mc) >= 2 {
+					id, err := mc.WaitForTopologyId(leaderElectionTimeout)
+					if err != nil {
+						mc.DumpLogs()
+						t.Fatalf("round %d (seed %d): %v", round, seed, err)
+					}
+					if id != topologyId {
+						mc.DumpLogs()
+						t.Fatalf("round %d (seed %d): TopologyId changed from %s to %s", round, seed, topologyId, id)
+					}
+				}
+			}
+
+			// Everything back up, so the walk ends on a full cluster.
+			for i := range 3 {
+				mc.StartNode(i)
+			}
+			if _, err := waitForCommonLeader(mc, leaderElectionTimeout); err != nil {
+				mc.DumpLogs()
+				t.Fatalf("cluster did not recover after the walk (seed %d): %v", seed, err)
+			}
+			for i := range 3 {
+				if err := waitForPeerCount(mc, i, 2, leaderElectionTimeout); err != nil {
+					mc.DumpLogs()
+					t.Fatalf("master %d does not see the full cluster (seed %d): %v", i, seed, err)
+				}
+			}
+			id, err := mc.WaitForTopologyId(leaderElectionTimeout)
+			if err != nil {
+				mc.DumpLogs()
+				t.Fatalf("no TopologyId after the walk (seed %d): %v", seed, err)
+			}
+			if id != topologyId {
+				mc.DumpLogs()
+				t.Fatalf("TopologyId changed from %s to %s over the walk (seed %d)", topologyId, id, seed)
+			}
+		})
+	}
+}
+
+// waitForSettledElection waits for a quorum to agree on one leader, and fails
+// if two masters claim leadership across consecutive polls — anything shorter
+// than that is a master on its way down.
+//
+// Below a quorum there is nothing to wait for: the walk moves on. A master that
+// has lost its quorum can keep claiming leadership for tens of seconds under
+// goraft, and it cannot commit anything in that window, so stepping down is a
+// liveness question rather than a safety one. TestTwoMastersDownAndRestart
+// holds that direction to account.
+func waitForSettledElection(mc *MasterCluster, timeout time.Duration) error {
+	if runningMasters(mc) < 2 {
+		return nil
+	}
+
+	var lastErr error
+	splitPolls := 0
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		claims, err := leaderClaims(mc)
+		if err != nil {
+			lastErr = err
+		}
+		if len(claims) > 1 {
+			splitPolls++
+			if splitPolls > 1 {
+				return fmt.Errorf("masters %v all claim leadership", claims)
+			}
+			time.Sleep(waitTick)
+			continue
+		}
+		splitPolls = 0
+
+		if _, err := commonLeader(mc); err == nil {
+			return nil
+		} else {
+			lastErr = err
+		}
+		time.Sleep(waitTick)
+	}
+	if lastErr == nil {
+		lastErr = fmt.Errorf("cluster did not settle within %v", timeout)
+	}
+	return lastErr
+}
+
+// leaderClaims returns the running masters that call themselves leader. The
+// error reports masters that did not answer at all, which is a reason to keep
+// waiting rather than a verdict.
+func leaderClaims(mc *MasterCluster) (claims []int, err error) {
+	for i := range 3 {
+		if !mc.IsNodeRunning(i) {
+			continue
+		}
+		cs, statusErr := mc.GetClusterStatus(i)
+		if statusErr != nil {
+			err = fmt.Errorf("master %d: %w", i, statusErr)
+			continue
+		}
+		if cs.IsLeader {
+			claims = append(claims, i)
+		}
+	}
+	return claims, err
+}
+
+func runningMasters(mc *MasterCluster) int {
+	count := 0
+	for i := range 3 {
+		if mc.IsNodeRunning(i) {
+			count++
+		}
+	}
+	return count
+}
+
+// chaosSeed picks the walk. It is random by default and always logged, so a
+// failure names the seed that reproduces it.
+func chaosSeed(t *testing.T) uint64 {
+	t.Helper()
+	if v := os.Getenv("MULTI_MASTER_IT_SEED"); v != "" {
+		seed, err := strconv.ParseUint(v, 10, 64)
+		if err != nil {
+			t.Fatalf("MULTI_MASTER_IT_SEED %q: %v", v, err)
+		}
+		return seed
+	}
+	return uint64(time.Now().UnixNano())
+}
diff --git a/test/multi_master/cluster.go b/test/multi_master/cluster.go
index f216f5d169..77d218281d 100644
--- a/test/multi_master/cluster.go
+++ b/test/multi_master/cluster.go
@@ -10,6 +10,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"strconv"
 	"strings"
@@ -33,6 +34,12 @@ type masterNode struct {
 	cmd      *exec.Cmd
 	logFile  string
 	stopped  bool
+	// peersStr overrides the cluster-wide peer list for this node, so a test
+	// can start a master that only knows about a subset of the cluster.
+	peersStr string
+	// raftBootstrap starts the master with -raftBootstrap, the way the helm
+	// chart renders master.raftBootstrap on every master, every restart.
+	raftBootstrap bool
 }
 
 // MasterCluster manages a 3-node master raft cluster for integration tests.
@@ -48,6 +55,9 @@ type MasterCluster struct {
 
 	// peers string shared by all nodes, e.g. "127.0.0.1:9333,127.0.0.1:9334,127.0.0.1:9335"
 	peersStr string
+
+	// raftHashicorp starts the masters with -raftHashicorp
+	raftHashicorp bool
 }
 
 // clusterStatus is the JSON returned by /cluster/status.
@@ -61,6 +71,35 @@ type clusterStatus struct {
 func StartMasterCluster(t testing.TB) *MasterCluster {
 	t.Helper()
 
+	mc := NewMasterCluster(t, false)
+	for i := range 3 {
+		mc.StartNode(i)
+	}
+
+	if err := mc.WaitForLeader(waitTimeout); err != nil {
+		mc.DumpLogs()
+		mc.StopAll()
+		t.Fatalf("cluster did not elect a leader: %v", err)
+	}
+
+	// Wait for TopologyId to be generated and propagated. This is async
+	// after leader election, and we need it committed before tests can
+	// reliably stop/restart nodes.
+	if _, err := mc.WaitForTopologyId(waitTimeout); err != nil {
+		mc.DumpLogs()
+		mc.StopAll()
+		t.Fatalf("TopologyId not generated: %v", err)
+	}
+
+	return mc
+}
+
+// NewMasterCluster allocates ports and data directories for a 3-node master
+// cluster without starting anything, so a test can choose what each node comes
+// up with.
+func NewMasterCluster(t testing.TB, raftHashicorp bool) *MasterCluster {
+	t.Helper()
+
 	weedBinary, err := findOrBuildWeedBinary()
 	if err != nil {
 		t.Fatalf("resolve weed binary: %v", err)
@@ -94,32 +133,14 @@ func StartMasterCluster(t testing.TB) *MasterCluster {
 	}
 
 	mc := &MasterCluster{
-		t:          t,
-		weedBinary: weedBinary,
-		baseDir:    baseDir,
-		logsDir:    logsDir,
-		keepLogs:   keepLogs,
-		nodes:      nodes,
-		peersStr:   strings.Join(peerParts, ","),
-	}
-
-	for i := range 3 {
-		mc.StartNode(i)
-	}
-
-	if err := mc.WaitForLeader(waitTimeout); err != nil {
-		mc.DumpLogs()
-		mc.StopAll()
-		t.Fatalf("cluster did not elect a leader: %v", err)
-	}
-
-	// Wait for TopologyId to be generated and propagated. This is async
-	// after leader election, and we need it committed before tests can
-	// reliably stop/restart nodes.
-	if err := mc.WaitForTopologyId(waitTimeout); err != nil {
-		mc.DumpLogs()
-		mc.StopAll()
-		t.Fatalf("TopologyId not generated: %v", err)
+		t:             t,
+		weedBinary:    weedBinary,
+		baseDir:       baseDir,
+		logsDir:       logsDir,
+		keepLogs:      keepLogs,
+		nodes:         nodes,
+		peersStr:      strings.Join(peerParts, ","),
+		raftHashicorp: raftHashicorp,
 	}
 
 	t.Cleanup(func() {
@@ -128,6 +149,21 @@ func StartMasterCluster(t testing.TB) *MasterCluster {
 	return mc
 }
 
+// SetNodePeers narrows the peer list node i starts with, mirroring a
+// StatefulSet whose replica count changed under a running master.
+func (mc *MasterCluster) SetNodePeers(i int, peers string) {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+	mc.nodes[i].peersStr = peers
+}
+
+// SetRaftBootstrap makes node i start with -raftBootstrap.
+func (mc *MasterCluster) SetRaftBootstrap(i int) {
+	mc.mu.Lock()
+	defer mc.mu.Unlock()
+	mc.nodes[i].raftBootstrap = true
+}
+
 // StartNode starts the master process at the given index (0–2).
 func (mc *MasterCluster) StartNode(i int) {
 	mc.t.Helper()
@@ -144,17 +180,27 @@ func (mc *MasterCluster) StartNode(i int) {
 		mc.t.Fatalf("create log for node %d: %v", i, err)
 	}
 
+	peersStr := n.peersStr
+	if peersStr == "" {
+		peersStr = mc.peersStr
+	}
 	args := []string{
 		"master",
 		"-ip=127.0.0.1",
 		"-port=" + strconv.Itoa(n.port),
 		"-port.grpc=" + strconv.Itoa(n.grpcPort),
 		"-mdir=" + n.dataDir,
-		"-peers=" + mc.peersStr,
+		"-peers=" + peersStr,
 		"-electionTimeout=3s",
 		"-volumeSizeLimitMB=32",
 		"-defaultReplication=000",
 	}
+	if mc.raftHashicorp {
+		args = append(args, "-raftHashicorp")
+	}
+	if n.raftBootstrap {
+		args = append(args, "-raftBootstrap")
+	}
 
 	n.cmd = exec.Command(mc.weedBinary, args...)
 	n.cmd.Dir = mc.baseDir
@@ -292,6 +338,24 @@ func (mc *MasterCluster) WaitForLeader(timeout time.Duration) error {
 	return fmt.Errorf("no leader elected within %v", timeout)
 }
 
+// WaitForNoLeader waits until no running master claims leadership. goraft only
+// checks whether it still has a quorum on an election-timeout ticker, and needs
+// its peers to go quiet for a full timeout first, so a master that has lost its
+// quorum can keep claiming leadership for tens of seconds. It cannot commit
+// anything in that window.
+func (mc *MasterCluster) WaitForNoLeader(timeout time.Duration) error {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		idx, _ := mc.FindLeader()
+		if idx < 0 {
+			return nil
+		}
+		time.Sleep(waitTick)
+	}
+	idx, addr := mc.FindLeader()
+	return fmt.Errorf("master %d at %s still claims leadership after %v", idx, addr, timeout)
+}
+
 // WaitForNewLeader waits for a leader that is different from the given address.
 func (mc *MasterCluster) WaitForNewLeader(oldLeaderAddr string, timeout time.Duration) (int, string, error) {
 	deadline := time.Now().Add(timeout)
@@ -305,18 +369,20 @@ func (mc *MasterCluster) WaitForNewLeader(oldLeaderAddr string, timeout time.Dur
 	return -1, "", fmt.Errorf("no new leader (different from %s) within %v", oldLeaderAddr, timeout)
 }
 
-// WaitForTopologyId waits until the leader reports a non-empty TopologyId.
-func (mc *MasterCluster) WaitForTopologyId(timeout time.Duration) error {
+// WaitForTopologyId waits until the leader reports a non-empty TopologyId, and
+// returns it. It is only readable once the leader has applied the raft entry
+// carrying it, which lands after the election it won.
+func (mc *MasterCluster) WaitForTopologyId(timeout time.Duration) (string, error) {
 	deadline := time.Now().Add(timeout)
 	for time.Now().Before(deadline) {
 		if idx, _ := mc.FindLeader(); idx >= 0 {
 			if id, err := mc.GetTopologyId(idx); err == nil && id != "" {
-				return nil
+				return id, nil
 			}
 		}
 		time.Sleep(waitTick)
 	}
-	return fmt.Errorf("TopologyId not available within %v", timeout)
+	return "", fmt.Errorf("TopologyId not available within %v", timeout)
 }
 
 // WaitForNodeReady waits for node i to respond to HTTP.
@@ -334,6 +400,57 @@ func (mc *MasterCluster) WaitForNodeReady(i int, timeout time.Duration) error {
 	return fmt.Errorf("node %d not ready within %v", i, timeout)
 }
 
+// LogContains reports whether node i's log holds the given text.
+func (mc *MasterCluster) LogContains(i int, text string) bool {
+	b, err := os.ReadFile(mc.nodes[i].logFile)
+	if err != nil {
+		return false
+	}
+	return strings.Contains(string(b), text)
+}
+
+// topologyIdLine matches every line a master logs when it learns a TopologyId,
+// whichever raft implementation applied it.
+var topologyIdLine = regexp.MustCompile(`TopologyId[^:]*: ([0-9a-f-]{36})`)
+
+// NodeTopologyIds returns the TopologyIds node i has logged. /dir/status is
+// proxied to the leader, so a master's own view of the cluster identity is only
+// visible in its log, and that is where a fork shows up.
+func (mc *MasterCluster) NodeTopologyIds(i int) []string {
+	b, err := os.ReadFile(mc.nodes[i].logFile)
+	if err != nil {
+		return nil
+	}
+	var ids []string
+	for _, m := range topologyIdLine.FindAllStringSubmatch(string(b), -1) {
+		ids = append(ids, m[1])
+	}
+	return ids
+}
+
+// WaitForNodeTopologyIds waits until every master has logged a TopologyId and
+// returns what each one saw.
+func (mc *MasterCluster) WaitForNodeTopologyIds(timeout time.Duration) ([3][]string, error) {
+	var ids [3][]string
+	deadline := time.Now().Add(timeout)
+	for {
+		missing := -1
+		for i := range 3 {
+			ids[i] = mc.NodeTopologyIds(i)
+			if len(ids[i]) == 0 {
+				missing = i
+			}
+		}
+		if missing < 0 {
+			return ids, nil
+		}
+		if !time.Now().Before(deadline) {
+			return ids, fmt.Errorf("master %d logged no TopologyId within %v", missing, timeout)
+		}
+		time.Sleep(waitTick)
+	}
+}
+
 // DumpLogs prints the tail of all master logs.
 func (mc *MasterCluster) DumpLogs() {
 	for i := range 3 {
diff --git a/test/multi_master/failover_test.go b/test/multi_master/failover_test.go
index 45ba204d48..acace3396e 100644
--- a/test/multi_master/failover_test.go
+++ b/test/multi_master/failover_test.go
@@ -9,7 +9,12 @@ import (
 
 const (
 	// Election timeout is 3s in our cluster config; allow generous margin.
-	leaderElectionTimeout = 20 * time.Second
+	leaderElectionTimeout = 30 * time.Second
+
+	// Losing a quorum is much slower to show than winning one. goraft only
+	// notices on an election-timeout ticker, after its peers have been quiet
+	// for a full timeout, and has been measured taking over 30s to step down.
+	leaderStepDownTimeout = 60 * time.Second
 )
 
 // TestLeaderDownAndRecoverQuickly verifies that when the leader is stopped and
@@ -149,20 +154,11 @@ func TestTwoMastersDownAndRestart(t *testing.T) {
 	mc.StopNode(down1)
 	mc.StopNode(down2)
 
-	// The surviving node alone cannot form a quorum — no leader expected.
-	// Wait long enough for any stale leadership to expire (election timeout
-	// is 3s in our config, quorum check fires every election timeout).
-	time.Sleep(5 * time.Second)
-	soloLeaderIdx, _ := mc.FindLeader()
-	if soloLeaderIdx >= 0 {
-		// It's possible the survivor briefly thinks it's leader before stepping down.
-		// Give it time to realize it lost quorum.
-		time.Sleep(5 * time.Second)
-		soloLeaderIdx, _ = mc.FindLeader()
-	}
-	if soloLeaderIdx >= 0 {
+	// The surviving node alone cannot form a quorum, so it has to give up the
+	// leadership it is still claiming.
+	if err := mc.WaitForNoLeader(leaderStepDownTimeout); err != nil {
 		mc.DumpLogs()
-		t.Fatalf("expected no leader with only 1 of 3 nodes, but node %d claims leadership", soloLeaderIdx)
+		t.Fatalf("expected no leader with only 1 of 3 nodes: %v", err)
 	}
 
 	// Restart both downed nodes.
@@ -294,9 +290,31 @@ func TestLeaderConsistencyAcrossNodes(t *testing.T) {
 	assertTopologyIdConsistent(t, mc, topologyId)
 }
 
-// assertTopologyIdConsistent verifies that all running nodes report the expected TopologyId.
+// assertTopologyIdConsistent waits until all running nodes report the expected
+// TopologyId. A restarted node only discovers it after the leader has admitted
+// it back into raft — /dir/status is proxied to the leader, so a node that has
+// not yet learned the leader reports its own empty id. That admission trails
+// HTTP readiness by several seconds, so a one-shot check races the propagation.
 func assertTopologyIdConsistent(t *testing.T, mc *MasterCluster, expectedId string) {
 	t.Helper()
+	deadline := time.Now().Add(waitTimeout)
+	for time.Now().Before(deadline) {
+		consistent := true
+		for i := range 3 {
+			if !mc.IsNodeRunning(i) {
+				continue
+			}
+			if id, err := mc.GetTopologyId(i); err != nil || id != expectedId {
+				consistent = false
+				break
+			}
+		}
+		if consistent {
+			return
+		}
+		time.Sleep(waitTick)
+	}
+	// Timed out: report what each node actually sees.
 	for i := range 3 {
 		if !mc.IsNodeRunning(i) {
 			continue
diff --git a/test/multi_master/join_test.go b/test/multi_master/join_test.go
new file mode 100644
index 0000000000..f8c847e659
--- /dev/null
+++ b/test/multi_master/join_test.go
@@ -0,0 +1,212 @@
+package multi_master
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+)
+
+var raftImplementations = []struct {
+	name          string
+	raftHashicorp bool
+}{
+	{"goraft", false},
+	{"hashicorp", true},
+}
+
+// TestFreshClusterFormsWithoutALeader covers the other half of the bootstrap
+// decision: with no leader anywhere, three masters starting together still have
+// to mint a cluster between them.
+func TestFreshClusterFormsWithoutALeader(t *testing.T) {
+	for _, impl := range raftImplementations {
+		t.Run(impl.name, func(t *testing.T) {
+			mc := NewMasterCluster(t, impl.raftHashicorp)
+			for i := range 3 {
+				mc.StartNode(i)
+			}
+
+			if _, err := waitForCommonLeader(mc, waitTimeout); err != nil {
+				mc.DumpLogs()
+				t.Fatalf("fresh cluster did not converge: %v", err)
+			}
+			for i := range 3 {
+				if err := waitForPeerCount(mc, i, 2, waitTimeout); err != nil {
+					mc.DumpLogs()
+					t.Fatalf("master %d does not see the full cluster: %v", i, err)
+				}
+			}
+		})
+	}
+}
+
+// TestScaleUpOntoExistingLeader mirrors a Kubernetes master StatefulSet whose
+// replica count goes back from one to three: master 0 keeps running as the
+// leader of a single-peer cluster while two fresh masters come up pointing at
+// all three. The newcomers start with an empty raft log, so neither raft
+// implementation lets them campaign — the sitting leader has to admit them.
+func TestScaleUpOntoExistingLeader(t *testing.T) {
+	for _, impl := range raftImplementations {
+		t.Run(impl.name, func(t *testing.T) {
+			mc := NewMasterCluster(t, impl.raftHashicorp)
+
+			// Master 0 is alone in its peer list, the way the operator renders
+			// -peers when spec.master.replicas is 1.
+			mc.SetNodePeers(0, mc.NodeAddress(0))
+			mc.StartNode(0)
+			if err := mc.WaitForLeader(waitTimeout); err != nil {
+				mc.DumpLogs()
+				t.Fatalf("single master did not become leader: %v", err)
+			}
+
+			// Scale up. These two carry the full peer list; master 0 still
+			// runs with the old one and has never heard of them.
+			mc.StartNode(1)
+			mc.StartNode(2)
+
+			leader, err := waitForCommonLeader(mc, waitTimeout)
+			if err != nil {
+				mc.DumpLogs()
+				t.Fatalf("masters did not converge after scaling up: %v", err)
+			}
+			if leader != mc.NodeAddress(0) {
+				t.Fatalf("leader moved to %s, want the sitting leader %s", leader, mc.NodeAddress(0))
+			}
+
+			if err := waitForPeerCount(mc, 0, 2, waitTimeout); err != nil {
+				mc.DumpLogs()
+				t.Fatalf("leader did not admit both new masters: %v", err)
+			}
+		})
+	}
+}
+
+// waitForCommonLeader waits until every running master names the same leader,
+// and returns it.
+func waitForCommonLeader(mc *MasterCluster, timeout time.Duration) (string, error) {
+	var lastErr error
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		leader, err := commonLeader(mc)
+		if err == nil {
+			return leader, nil
+		}
+		lastErr = err
+		time.Sleep(waitTick)
+	}
+	return "", lastErr
+}
+
+func commonLeader(mc *MasterCluster) (string, error) {
+	agreed := ""
+	for i := range 3 {
+		if !mc.IsNodeRunning(i) {
+			continue
+		}
+		cs, err := mc.GetClusterStatus(i)
+		if err != nil {
+			return "", err
+		}
+		leader := pb.ServerAddress(cs.Leader).ToHttpAddress()
+		if leader == "" {
+			return "", fmt.Errorf("master %d has no leader", i)
+		}
+		if agreed == "" {
+			agreed = leader
+		} else if agreed != leader {
+			return "", fmt.Errorf("masters disagree on the leader: %s and %s", agreed, leader)
+		}
+	}
+	if agreed == "" {
+		return "", fmt.Errorf("no master is running")
+	}
+	return agreed, nil
+}
+
+// waitForPeerCount waits until node i reports the given number of raft peers.
+// The count excludes the node itself.
+func waitForPeerCount(mc *MasterCluster, i, want int, timeout time.Duration) error {
+	got := -1
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		cs, err := mc.GetClusterStatus(i)
+		if err == nil {
+			got = peerCountExcludingSelf(cs.Peers, mc.NodeAddress(i))
+			if got == want {
+				return nil
+			}
+		}
+		time.Sleep(waitTick)
+	}
+	return fmt.Errorf("master %d reports %d peers, want %d", i, got, want)
+}
+
+func peerCountExcludingSelf(peers []string, self string) int {
+	count := 0
+	for _, peer := range peers {
+		if pb.ServerAddress(peer).ToHttpAddress() != self {
+			count++
+		}
+	}
+	return count
+}
+
+// TestRaftBootstrapKeepsExistingCluster covers a master restarting under
+// -raftBootstrap, the way the helm chart renders it on every master on every
+// roll. Bootstrapping is genesis: seeding a second cluster over committed raft
+// state mints a rival TopologyId, and the split-brain guard then Fatals every
+// master that still holds the first one.
+func TestRaftBootstrapKeepsExistingCluster(t *testing.T) {
+	for _, impl := range raftImplementations {
+		t.Run(impl.name, func(t *testing.T) {
+			mc := NewMasterCluster(t, impl.raftHashicorp)
+			for i := range 3 {
+				mc.SetRaftBootstrap(i)
+				mc.StartNode(i)
+			}
+			before, err := mc.WaitForTopologyId(waitTimeout)
+			if err != nil {
+				mc.DumpLogs()
+				t.Fatalf("cluster did not mint a TopologyId: %v", err)
+			}
+
+			for i := range 3 {
+				mc.StopNode(i)
+			}
+			for i := range 3 {
+				mc.StartNode(i)
+			}
+
+			after, err := mc.WaitForTopologyId(waitTimeout)
+			if err != nil {
+				mc.DumpLogs()
+				t.Fatalf("cluster did not come back after a restart: %v", err)
+			}
+			if after != before {
+				mc.DumpLogs()
+				t.Fatalf("-raftBootstrap re-seeded the cluster: TopologyId %s became %s", before, after)
+			}
+
+			// The leader answers for the whole cluster, so a follower that
+			// forked is only visible in its own log.
+			seen, err := mc.WaitForNodeTopologyIds(waitTimeout)
+			if err != nil {
+				mc.DumpLogs()
+				t.Fatal(err)
+			}
+			for i, ids := range seen {
+				for _, id := range ids {
+					if id != before {
+						mc.DumpLogs()
+						t.Fatalf("master %d saw TopologyId %s, want %s", i, id, before)
+					}
+				}
+				if mc.LogContains(i, "Split-brain detected") {
+					mc.DumpLogs()
+					t.Fatalf("master %d hit the split-brain guard", i)
+				}
+			}
+		})
+	}
+}
diff --git a/test/pjdfstest/Dockerfile b/test/pjdfstest/Dockerfile
index 9aeb1c3ca1..aec78954e3 100644
--- a/test/pjdfstest/Dockerfile
+++ b/test/pjdfstest/Dockerfile
@@ -1,17 +1,12 @@
 FROM chrislusf/seaweedfs:e2e
 
-RUN apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 update && \
-    DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 install -y \
-    --no-install-recommends \
-    --no-install-suggests \
+RUN apt-install \
     autoconf \
     automake \
     build-essential \
     git \
     libtap-harness-archive-perl \
-    perl \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
+    perl
 
 ARG PJDFSTEST_REPO=https://github.com/sanwan/pjdfstest.git
 ARG PJDFSTEST_REF=d25636a227606f8960e5179741d8f4ad7030ef41
diff --git a/test/plugin_workers/fake_volume_server.go b/test/plugin_workers/fake_volume_server.go
index 0b9480b31f..1ea58276e2 100644
--- a/test/plugin_workers/fake_volume_server.go
+++ b/test/plugin_workers/fake_volume_server.go
@@ -15,6 +15,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -32,6 +33,7 @@ type VolumeServer struct {
 
 	mu                   sync.Mutex
 	receivedFiles        map[string]uint64
+	readonlyVolumes      map[uint32]bool
 	mountRequests        []*volume_server_pb.VolumeEcShardsMountRequest
 	deleteRequests       []*volume_server_pb.VolumeDeleteRequest
 	markReadonlyCalls    int
@@ -67,12 +69,13 @@ func NewVolumeServer(t *testing.T, baseDir string) *VolumeServer {
 	grpcPort := listener.Addr().(*net.TCPAddr).Port
 	server := pb.NewGrpcServer()
 	vs := &VolumeServer{
-		t:             t,
-		server:        server,
-		listener:      listener,
-		address:       fmt.Sprintf("127.0.0.1:0.%d", grpcPort),
-		baseDir:       baseDir,
-		receivedFiles: make(map[string]uint64),
+		t:               t,
+		server:          server,
+		listener:        listener,
+		address:         fmt.Sprintf("127.0.0.1:0.%d", grpcPort),
+		baseDir:         baseDir,
+		receivedFiles:   make(map[string]uint64),
+		readonlyVolumes: make(map[uint32]bool),
 	}
 
 	volume_server_pb.RegisterVolumeServerServer(server, vs)
@@ -337,7 +340,14 @@ func (v *VolumeServer) VolumeEcShardsInfo(ctx context.Context, req *volume_serve
 		}
 	}
 
-	resp := &volume_server_pb.VolumeEcShardsInfoResponse{}
+	// Answer with the layout out of the .vif that was actually delivered here,
+	// the way a real holder answers from the context it mounted the shards
+	// with. A coordinator uses this to tell a server that understands the
+	// shard block layout from one that never knew the field, so a fake that
+	// always reported "unset" would look like a pre-upgrade server.
+	resp := &volume_server_pb.VolumeEcShardsInfoResponse{
+		EcShardConfig: v.ecShardConfigFromVif(req.VolumeId),
+	}
 	prefix := fmt.Sprintf("%d.ec", req.VolumeId)
 	entries, _ := os.ReadDir(v.baseDir)
 	for _, entry := range entries {
@@ -370,6 +380,16 @@ func (v *VolumeServer) VolumeEcShardsInfo(ctx context.Context, req *volume_serve
 	return resp, nil
 }
 
+// ecShardConfigFromVif reads the EC layout out of the .vif this server was
+// given, which distribution ships to every holder alongside its shards.
+func (v *VolumeServer) ecShardConfigFromVif(volumeID uint32) *volume_server_pb.EcShardConfig {
+	vi, _, found, err := volume_info.MaybeLoadVolumeInfo(v.filePath(volumeID, ".vif"))
+	if err != nil || !found {
+		return nil
+	}
+	return vi.GetEcShardConfig()
+}
+
 func (v *VolumeServer) VolumeDelete(ctx context.Context, req *volume_server_pb.VolumeDeleteRequest) (*volume_server_pb.VolumeDeleteResponse, error) {
 	v.mu.Lock()
 	v.deleteRequests = append(v.deleteRequests, req)
@@ -386,6 +406,9 @@ func (v *VolumeServer) VolumeDelete(ctx context.Context, req *volume_server_pb.V
 func (v *VolumeServer) VolumeMarkReadonly(ctx context.Context, req *volume_server_pb.VolumeMarkReadonlyRequest) (*volume_server_pb.VolumeMarkReadonlyResponse, error) {
 	v.mu.Lock()
 	v.markReadonlyCalls++
+	if req != nil {
+		v.readonlyVolumes[req.VolumeId] = true
+	}
 	v.mu.Unlock()
 	return &volume_server_pb.VolumeMarkReadonlyResponse{}, nil
 }
@@ -393,10 +416,19 @@ func (v *VolumeServer) VolumeMarkReadonly(ctx context.Context, req *volume_serve
 func (v *VolumeServer) VolumeMarkWritable(ctx context.Context, req *volume_server_pb.VolumeMarkWritableRequest) (*volume_server_pb.VolumeMarkWritableResponse, error) {
 	v.mu.Lock()
 	v.markWritableCalls++
+	if req != nil {
+		v.readonlyVolumes[req.VolumeId] = false
+	}
 	v.mu.Unlock()
 	return &volume_server_pb.VolumeMarkWritableResponse{}, nil
 }
 
+func (v *VolumeServer) VolumeStatus(ctx context.Context, req *volume_server_pb.VolumeStatusRequest) (*volume_server_pb.VolumeStatusResponse, error) {
+	v.mu.Lock()
+	defer v.mu.Unlock()
+	return &volume_server_pb.VolumeStatusResponse{IsReadOnly: v.readonlyVolumes[req.GetVolumeId()]}, nil
+}
+
 func (v *VolumeServer) ReadVolumeFileStatus(ctx context.Context, req *volume_server_pb.ReadVolumeFileStatusRequest) (*volume_server_pb.ReadVolumeFileStatusResponse, error) {
 	v.mu.Lock()
 	v.readFileStatusCalls++
diff --git a/test/plugin_workers/volume_balance/execution_test.go b/test/plugin_workers/volume_balance/execution_test.go
index 70709c6b31..5213c4c1f1 100644
--- a/test/plugin_workers/volume_balance/execution_test.go
+++ b/test/plugin_workers/volume_balance/execution_test.go
@@ -146,13 +146,14 @@ func TestVolumeBalanceBatchExecutionIntegration(t *testing.T) {
 		require.True(t, deletedVols[vid], "volume %d should have been deleted from source", vid)
 	}
 
-	// Each move reads source status once before copy and once inside the
-	// target's fake VolumeCopy implementation, then reads target status once
-	// before deleting the source.
+	// Each move reads source status once inside the target's fake VolumeCopy
+	// implementation and once for the pre-delete verification, and reads
+	// target status once probing for a pre-existing copy and once for the
+	// verification.
 	require.Equal(t, len(volumeIDs)*2, source.ReadFileStatusCount(),
-		"each move should read source volume status before copy and during target copy")
-	require.Equal(t, len(volumeIDs), target.ReadFileStatusCount(),
-		"each move should read target volume status before delete")
+		"each move should read source volume status during target copy and at verification")
+	require.Equal(t, len(volumeIDs)*2, target.ReadFileStatusCount(),
+		"each move should probe the target and read its status at verification")
 
 	// Target should have received copy and tail calls for all 3 volumes.
 	copyCalls, _, tailCalls := target.BalanceStats()
diff --git a/test/postgres/Dockerfile.client b/test/postgres/Dockerfile.client
index 789de64514..53871de1c1 100644
--- a/test/postgres/Dockerfile.client
+++ b/test/postgres/Dockerfile.client
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 # Set working directory
 WORKDIR /app
diff --git a/test/postgres/Dockerfile.producer b/test/postgres/Dockerfile.producer
index 77396ab1da..b64cd6a5c3 100644
--- a/test/postgres/Dockerfile.producer
+++ b/test/postgres/Dockerfile.producer
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 # Set working directory
 WORKDIR /app
diff --git a/test/postgres/Dockerfile.seaweedfs b/test/postgres/Dockerfile.seaweedfs
index 951c4b034d..b6f75d4dbe 100644
--- a/test/postgres/Dockerfile.seaweedfs
+++ b/test/postgres/Dockerfile.seaweedfs
@@ -1,4 +1,4 @@
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 # Install git and other build dependencies
 RUN apk add --no-cache git make
diff --git a/test/s3/checksum/issue11401_repro_test.go b/test/s3/checksum/issue11401_repro_test.go
new file mode 100644
index 0000000000..bd2635daf6
--- /dev/null
+++ b/test/s3/checksum/issue11401_repro_test.go
@@ -0,0 +1,291 @@
+package checksum_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/aws/smithy-go"
+	"github.com/stretchr/testify/require"
+)
+
+// newWhenRequiredChecksumClient returns a client that only sends checksum
+// headers when the request asks for them, so tests can upload parts with no
+// checksum headers at all.
+func newWhenRequiredChecksumClient(t *testing.T) *s3.Client {
+	t.Helper()
+
+	cfg, err := config.LoadDefaultConfig(context.TODO(),
+		config.WithRegion(defaultConfig.Region),
+		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(
+			defaultConfig.AccessKey, defaultConfig.SecretKey, "")),
+	)
+	require.NoError(t, err)
+	return s3.NewFromConfig(cfg, func(o *s3.Options) {
+		o.UsePathStyle = true
+		o.BaseEndpoint = aws.String(defaultConfig.Endpoint)
+		o.RequestChecksumCalculation = aws.RequestChecksumCalculationWhenRequired
+	})
+}
+
+// UploadPart without checksum headers inherits the algorithm declared at
+// CreateMultipartUpload, so the part still gets a checksum and the upload can
+// be completed with it (AWS behavior).
+func TestMultipartPartInheritsChecksumAlgorithm(t *testing.T) {
+	client := newWhenRequiredChecksumClient(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	body := bytes.Repeat([]byte("y"), 1024)
+	key := "inherit-algo"
+
+	create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+		Bucket:            aws.String(bucket),
+		Key:               aws.String(key),
+		ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+	})
+	require.NoError(t, err)
+
+	part, err := client.UploadPart(context.Background(), &s3.UploadPartInput{
+		Bucket:     aws.String(bucket),
+		Key:        aws.String(key),
+		UploadId:   create.UploadId,
+		PartNumber: aws.Int32(1),
+		Body:       bytes.NewReader(body),
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, aws.ToString(part.ChecksumSHA256))
+
+	done, err := client.CompleteMultipartUpload(context.Background(), &s3.CompleteMultipartUploadInput{
+		Bucket:   aws.String(bucket),
+		Key:      aws.String(key),
+		UploadId: create.UploadId,
+		MultipartUpload: &types.CompletedMultipartUpload{Parts: []types.CompletedPart{{
+			ETag:           part.ETag,
+			PartNumber:     aws.Int32(1),
+			ChecksumSHA256: part.ChecksumSHA256,
+		}}},
+	})
+	require.NoError(t, err)
+	require.Equal(t, types.ChecksumTypeComposite, done.ChecksumType)
+	require.NotEmpty(t, aws.ToString(done.ChecksumSHA256))
+}
+
+// Mimics the .NET repro in https://github.com/seaweedfs/seaweedfs/issues/11401:
+// UploadPart carries an explicit client-computed x-amz-checksum-sha256 value,
+// CompleteMultipartUpload echoes it back per part, and HeadObject returns the
+// object checksum when x-amz-checksum-mode: ENABLED is sent (same as AWS).
+func TestIssue11401(t *testing.T) {
+	client := getS3Client(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	body := bytes.Repeat([]byte("x"), 1024)
+	checksum := base64.StdEncoding.EncodeToString(func() []byte { s := sha256.Sum256(body); return s[:] }())
+	key := "issue-11401"
+
+	create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+		Bucket:            aws.String(bucket),
+		Key:               aws.String(key),
+		ContentType:       aws.String("application/octet-stream"),
+		ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+	})
+	require.NoError(t, err)
+
+	part, err := client.UploadPart(context.Background(), &s3.UploadPartInput{
+		Bucket:         aws.String(bucket),
+		Key:            aws.String(key),
+		UploadId:       create.UploadId,
+		PartNumber:     aws.Int32(1),
+		Body:           bytes.NewReader(body),
+		ChecksumSHA256: aws.String(checksum),
+	})
+	require.NoError(t, err)
+	require.Equal(t, checksum, aws.ToString(part.ChecksumSHA256))
+
+	done, err := client.CompleteMultipartUpload(context.Background(), &s3.CompleteMultipartUploadInput{
+		Bucket:   aws.String(bucket),
+		Key:      aws.String(key),
+		UploadId: create.UploadId,
+		MultipartUpload: &types.CompletedMultipartUpload{Parts: []types.CompletedPart{{
+			ETag:           part.ETag,
+			PartNumber:     aws.Int32(1),
+			ChecksumSHA256: part.ChecksumSHA256,
+		}}},
+	})
+	require.NoError(t, err)
+	require.Equal(t, types.ChecksumTypeComposite, done.ChecksumType)
+	require.NotEmpty(t, aws.ToString(done.ChecksumSHA256))
+
+	head, err := client.HeadObject(context.Background(), &s3.HeadObjectInput{
+		Bucket:       aws.String(bucket),
+		Key:          aws.String(key),
+		ChecksumMode: types.ChecksumModeEnabled,
+	})
+	require.NoError(t, err)
+	require.Equal(t, aws.ToString(done.ChecksumSHA256), aws.ToString(head.ChecksumSHA256))
+
+	headNoMode, err := client.HeadObject(context.Background(), &s3.HeadObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	})
+	require.NoError(t, err)
+	require.Empty(t, aws.ToString(headNoMode.ChecksumSHA256))
+}
+
+// CompleteMultipartUpload validates the per-part checksums it is given, like
+// AWS: missing checksums fail with InvalidRequest and wrong ones with
+// BadDigest.
+func TestCompleteMultipartUploadValidatesPartChecksums(t *testing.T) {
+	client := newWhenRequiredChecksumClient(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	body := bytes.Repeat([]byte("z"), 1024)
+	key := "validate-parts"
+
+	create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+		Bucket:            aws.String(bucket),
+		Key:               aws.String(key),
+		ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+	})
+	require.NoError(t, err)
+
+	part, err := client.UploadPart(context.Background(), &s3.UploadPartInput{
+		Bucket:     aws.String(bucket),
+		Key:        aws.String(key),
+		UploadId:   create.UploadId,
+		PartNumber: aws.Int32(1),
+		Body:       bytes.NewReader(body),
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, aws.ToString(part.ChecksumSHA256))
+
+	complete := func(checksum *string) error {
+		_, err := client.CompleteMultipartUpload(context.Background(), &s3.CompleteMultipartUploadInput{
+			Bucket:   aws.String(bucket),
+			Key:      aws.String(key),
+			UploadId: create.UploadId,
+			MultipartUpload: &types.CompletedMultipartUpload{Parts: []types.CompletedPart{{
+				ETag:           part.ETag,
+				PartNumber:     aws.Int32(1),
+				ChecksumSHA256: checksum,
+			}}},
+		})
+		return err
+	}
+
+	var apiErr smithy.APIError
+
+	err = complete(nil)
+	require.Error(t, err)
+	require.True(t, errors.As(err, &apiErr))
+	require.Equal(t, "InvalidRequest", apiErr.ErrorCode())
+
+	wrong := base64.StdEncoding.EncodeToString(func() []byte { s := sha256.Sum256([]byte("other")); return s[:] }())
+	err = complete(aws.String(wrong))
+	require.Error(t, err)
+	require.True(t, errors.As(err, &apiErr))
+	require.Equal(t, "BadDigest", apiErr.ErrorCode())
+
+	require.NoError(t, complete(part.ChecksumSHA256))
+}
+
+// FULL_OBJECT uploads need no per-part checksums in the complete request; the
+// whole-object checksum travels in a request header and is validated against
+// the computed value (BadDigest on mismatch), as on AWS.
+func TestCompleteMultipartUploadFullObjectChecksum(t *testing.T) {
+	client := newWhenRequiredChecksumClient(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	body := bytes.Repeat([]byte("w"), 1024)
+	key := "full-object"
+
+	create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+		Bucket:            aws.String(bucket),
+		Key:               aws.String(key),
+		ChecksumAlgorithm: types.ChecksumAlgorithmCrc64nvme,
+	})
+	require.NoError(t, err)
+	require.Equal(t, types.ChecksumTypeFullObject, create.ChecksumType)
+
+	part, err := client.UploadPart(context.Background(), &s3.UploadPartInput{
+		Bucket:     aws.String(bucket),
+		Key:        aws.String(key),
+		UploadId:   create.UploadId,
+		PartNumber: aws.Int32(1),
+		Body:       bytes.NewReader(body),
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, aws.ToString(part.ChecksumCRC64NVME))
+
+	complete := func(objectChecksum *string) error {
+		_, err := client.CompleteMultipartUpload(context.Background(), &s3.CompleteMultipartUploadInput{
+			Bucket:            aws.String(bucket),
+			Key:               aws.String(key),
+			UploadId:          create.UploadId,
+			ChecksumCRC64NVME: objectChecksum,
+			MultipartUpload: &types.CompletedMultipartUpload{Parts: []types.CompletedPart{{
+				ETag:       part.ETag,
+				PartNumber: aws.Int32(1),
+			}}},
+		})
+		return err
+	}
+
+	var apiErr smithy.APIError
+	wrong := base64.StdEncoding.EncodeToString(func() []byte { s := sha256.Sum256(body); return s[:] }())
+	err = complete(aws.String(wrong))
+	require.Error(t, err)
+	require.True(t, errors.As(err, &apiErr))
+	require.Equal(t, "BadDigest", apiErr.ErrorCode())
+
+	require.NoError(t, complete(part.ChecksumCRC64NVME))
+}
+
+// UploadPart with a checksum algorithm that conflicts with the one declared at
+// CreateMultipartUpload is rejected, as on AWS.
+func TestMultipartPartConflictingAlgorithm(t *testing.T) {
+	client := newWhenRequiredChecksumClient(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+		Bucket:            aws.String(bucket),
+		Key:               aws.String("conflict"),
+		ChecksumAlgorithm: types.ChecksumAlgorithmSha256,
+	})
+	require.NoError(t, err)
+
+	_, err = client.UploadPart(context.Background(), &s3.UploadPartInput{
+		Bucket:            aws.String(bucket),
+		Key:               aws.String("conflict"),
+		UploadId:          create.UploadId,
+		PartNumber:        aws.Int32(1),
+		Body:              bytes.NewReader([]byte("data")),
+		ChecksumAlgorithm: types.ChecksumAlgorithmCrc32,
+	})
+	var apiErr smithy.APIError
+	require.Error(t, err)
+	require.True(t, errors.As(err, &apiErr))
+	require.Equal(t, "InvalidRequest", apiErr.ErrorCode())
+}
diff --git a/test/s3/checksum/s3_checksum_multipart_test.go b/test/s3/checksum/s3_checksum_multipart_test.go
index 1482fe753c..a09af198a0 100644
--- a/test/s3/checksum/s3_checksum_multipart_test.go
+++ b/test/s3/checksum/s3_checksum_multipart_test.go
@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"net/http/httputil"
 	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
@@ -17,15 +18,18 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func TestMultipartCopyPreservesChecksum(t *testing.T) {
-	// aws-sdk-go-v2 sends flexible checksums as unsigned streaming trailers, which
-	// it refuses over plain HTTP, so front the HTTP endpoint with a TLS proxy.
+// newTrailerChecksumClient returns a client that can send flexible checksums.
+// aws-sdk-go-v2 sends them as unsigned streaming trailers, which it refuses over
+// plain HTTP, so front the HTTP endpoint with a TLS proxy.
+func newTrailerChecksumClient(t *testing.T) *s3.Client {
+	t.Helper()
+
 	target, err := url.Parse(defaultConfig.Endpoint)
 	require.NoError(t, err)
 
 	proxy := httputil.NewSingleHostReverseProxy(target)
 	server := httptest.NewTLSServer(proxy)
-	defer server.Close()
+	t.Cleanup(server.Close)
 
 	cfg, err := config.LoadDefaultConfig(context.Background(),
 		config.WithRegion(defaultConfig.Region),
@@ -34,10 +38,14 @@ func TestMultipartCopyPreservesChecksum(t *testing.T) {
 		config.WithHTTPClient(server.Client()),
 	)
 	require.NoError(t, err)
-	client := s3.NewFromConfig(cfg, func(o *s3.Options) {
+	return s3.NewFromConfig(cfg, func(o *s3.Options) {
 		o.BaseEndpoint = aws.String(server.URL)
 		o.UsePathStyle = true
 	})
+}
+
+func TestMultipartCopyPreservesChecksum(t *testing.T) {
+	client := newTrailerChecksumClient(t)
 
 	bucket := uniqueBucket()
 	createBucket(t, client, bucket)
@@ -122,3 +130,120 @@ func TestMultipartCopyPreservesChecksum(t *testing.T) {
 		})
 	}
 }
+
+// A multipart upload that asked for a checksum must report it in the
+// CompleteMultipartUpload response, alongside the algorithm and type that
+// CreateMultipartUpload echoed back.
+func TestMultipartUploadReturnsObjectChecksum(t *testing.T) {
+	client := newTrailerChecksumClient(t)
+
+	bucket := uniqueBucket()
+	createBucket(t, client, bucket)
+	defer cleanupBucket(t, client, bucket)
+
+	cases := []struct {
+		algorithm    types.ChecksumAlgorithm
+		expectedType types.ChecksumType
+		completeSum  func(*s3.CompleteMultipartUploadOutput) *string
+		headSum      func(*s3.HeadObjectOutput) *string
+		partSum      func(*s3.UploadPartOutput) *string
+		setPart      func(*types.CompletedPart, *string)
+	}{
+		{
+			algorithm:    types.ChecksumAlgorithmCrc32,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumCRC32 },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumCRC32 },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumCRC32 },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumCRC32 = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmCrc32c,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumCRC32C },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumCRC32C },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumCRC32C },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumCRC32C = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmCrc64nvme,
+			expectedType: types.ChecksumTypeFullObject,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumCRC64NVME },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumCRC64NVME },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumCRC64NVME },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumCRC64NVME = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmSha1,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumSHA1 },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumSHA1 },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumSHA1 },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumSHA1 = v },
+		},
+		{
+			algorithm:    types.ChecksumAlgorithmSha256,
+			expectedType: types.ChecksumTypeComposite,
+			completeSum:  func(o *s3.CompleteMultipartUploadOutput) *string { return o.ChecksumSHA256 },
+			headSum:      func(o *s3.HeadObjectOutput) *string { return o.ChecksumSHA256 },
+			partSum:      func(o *s3.UploadPartOutput) *string { return o.ChecksumSHA256 },
+			setPart:      func(p *types.CompletedPart, v *string) { p.ChecksumSHA256 = v },
+		},
+	}
+
+	// Every part but the last has to reach the 5MB multipart minimum.
+	parts := [][]byte{bytes.Repeat([]byte("a"), 5*1024*1024), []byte("tail")}
+
+	for _, tc := range cases {
+		t.Run(string(tc.algorithm), func(t *testing.T) {
+			key := "multipart-" + string(tc.algorithm)
+			create, err := client.CreateMultipartUpload(context.Background(), &s3.CreateMultipartUploadInput{
+				Bucket:            aws.String(bucket),
+				Key:               aws.String(key),
+				ChecksumAlgorithm: tc.algorithm,
+			})
+			require.NoError(t, err)
+			require.Equal(t, tc.algorithm, create.ChecksumAlgorithm)
+			require.Equal(t, tc.expectedType, create.ChecksumType)
+
+			var completed []types.CompletedPart
+			for i, data := range parts {
+				part, err := client.UploadPart(context.Background(), &s3.UploadPartInput{
+					Bucket:            aws.String(bucket),
+					Key:               aws.String(key),
+					UploadId:          create.UploadId,
+					PartNumber:        aws.Int32(int32(i + 1)),
+					Body:              bytes.NewReader(data),
+					ChecksumAlgorithm: tc.algorithm,
+				})
+				require.NoError(t, err)
+				require.NotEmpty(t, aws.ToString(tc.partSum(part)))
+
+				entry := types.CompletedPart{ETag: part.ETag, PartNumber: aws.Int32(int32(i + 1))}
+				tc.setPart(&entry, tc.partSum(part))
+				completed = append(completed, entry)
+			}
+
+			done, err := client.CompleteMultipartUpload(context.Background(), &s3.CompleteMultipartUploadInput{
+				Bucket:          aws.String(bucket),
+				Key:             aws.String(key),
+				UploadId:        create.UploadId,
+				MultipartUpload: &types.CompletedMultipartUpload{Parts: completed},
+			})
+			require.NoError(t, err)
+			require.NotEmpty(t, aws.ToString(tc.completeSum(done)))
+			require.Equal(t, tc.expectedType, done.ChecksumType)
+			if tc.expectedType == types.ChecksumTypeComposite {
+				require.True(t, strings.HasSuffix(aws.ToString(tc.completeSum(done)), fmt.Sprintf("-%d", len(parts))))
+			}
+
+			head, err := client.HeadObject(context.Background(), &s3.HeadObjectInput{
+				Bucket:       aws.String(bucket),
+				Key:          aws.String(key),
+				ChecksumMode: types.ChecksumModeEnabled,
+			})
+			require.NoError(t, err)
+			require.Equal(t, aws.ToString(tc.completeSum(done)), aws.ToString(tc.headSum(head)))
+		})
+	}
+}
diff --git a/test/s3/copying/Makefile b/test/s3/copying/Makefile
index ea399223f0..50bedf2007 100644
--- a/test/s3/copying/Makefile
+++ b/test/s3/copying/Makefile
@@ -76,12 +76,12 @@ start-seaweedfs: check-binary
 		-ip=127.0.0.1 \
 		> /tmp/seaweedfs-mini.log 2>&1 & echo $$! > /tmp/weed-mini.pid
 	@echo "$(YELLOW)Waiting for S3 service to be ready...$(NC)"
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s -f http://127.0.0.1:$(S3_PORT) > /dev/null 2>&1; then \
 			echo "$(GREEN)S3 service is ready$(NC)"; \
 			break; \
 		fi; \
-		echo "Waiting for S3 service... ($$i/30)"; \
+		echo "Waiting for S3 service... ($$i/90)"; \
 		sleep 1; \
 	done
 	@sleep 2
diff --git a/test/s3/copying/s3_rename_test.go b/test/s3/copying/s3_rename_test.go
index 881f4cca03..a3dc62e92d 100644
--- a/test/s3/copying/s3_rename_test.go
+++ b/test/s3/copying/s3_rename_test.go
@@ -156,8 +156,9 @@ func TestRenameObjectSourceIfMatch(t *testing.T) {
 	assert.True(t, objectExists(t, client, bucketName, "target.txt"))
 }
 
-// TestRenameObjectOntoDirectory: a key that already holds other objects is a
-// directory, and an object must not be allowed to replace one.
+// TestRenameObjectOntoDirectory: S3 keys are flat, so a key that other keys are
+// nested under is still a key of its own. The rename writes it without disturbing
+// them - it does not replace the directory, it stores the object on it.
 func TestRenameObjectOntoDirectory(t *testing.T) {
 	client := getS3Client(t)
 	bucketName := getNewBucketName()
@@ -172,9 +173,10 @@ func TestRenameObjectOntoDirectory(t *testing.T) {
 		Key:          aws.String("target"),
 		RenameSource: aws.String(createRenameSource("source.txt")),
 	})
-	requireRenameStatus(t, err, 409)
-	assert.True(t, objectExists(t, client, bucketName, "source.txt"))
-	assert.True(t, objectExists(t, client, bucketName, "target/child.txt"))
+	require.NoError(t, err)
+	assert.False(t, objectExists(t, client, bucketName, "source.txt"))
+	assert.Equal(t, "content", getObjectBody(t, getObject(t, client, bucketName, "target")))
+	assert.Equal(t, "child", getObjectBody(t, getObject(t, client, bucketName, "target/child.txt")))
 }
 
 // TestRenameObjectDirectorySource: a directory can be named without a trailing
diff --git a/test/s3/cors/Makefile b/test/s3/cors/Makefile
index 1378c7439e..ac56e11bc0 100644
--- a/test/s3/cors/Makefile
+++ b/test/s3/cors/Makefile
@@ -92,7 +92,7 @@ start-server: check-deps
 		echo $$! > weed-server.pid
 	
 	@echo "Waiting for S3 server to be ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if echo | nc -z localhost $(S3_PORT); then \
 			echo "S3 server is ready!"; \
 			exit 0; \
diff --git a/test/s3/distributed_lock/distributed_lock_cluster_test.go b/test/s3/distributed_lock/distributed_lock_cluster_test.go
index 2c09d0db94..dd9cc107ac 100644
--- a/test/s3/distributed_lock/distributed_lock_cluster_test.go
+++ b/test/s3/distributed_lock/distributed_lock_cluster_test.go
@@ -310,6 +310,7 @@ func (c *distributedLockCluster) startS3(index int) error {
 		"-port=" + strconv.Itoa(c.s3Ports[index]),
 		"-port.grpc=" + strconv.Itoa(c.s3GrpcPorts[index]),
 		"-port.iceberg=0",
+		"-port.lance=0",
 		"-filer=" + strings.Join(filers, ","),
 		"-config=" + c.s3Config,
 		"-iam.readOnly=false",
diff --git a/test/s3/error_compat/Makefile b/test/s3/error_compat/Makefile
new file mode 100644
index 0000000000..e9b697d193
--- /dev/null
+++ b/test/s3/error_compat/Makefile
@@ -0,0 +1,105 @@
+# S3/IAM error response compatibility test harness
+
+.PHONY: all test help build-weed check-deps start-server stop-server test-errors test-with-server clean logs
+
+WEED_BINARY := ../../../weed/weed_binary
+S3_PORT := 8334
+TEST_TIMEOUT := 10m
+SERVER_DIR := ./test-volume-data
+S3_CONFIG := ./test_s3.json
+
+.DEFAULT_GOAL := help
+
+all: test
+
+test: test-with-server
+
+help:
+	@echo "S3/IAM error response compatibility test harness"
+	@echo ""
+	@echo "Available targets:"
+	@echo "  build-weed      - Build the SeaweedFS binary"
+	@echo "  start-server    - Start SeaweedFS mini with S3 and embedded IAM enabled"
+	@echo "  stop-server     - Stop the test server"
+	@echo "  test-errors     - Run the error compatibility checks"
+	@echo "  test-with-server - Start server, run checks, stop server"
+	@echo "  logs            - Show server logs"
+	@echo "  clean           - Remove test artifacts"
+
+build-weed:
+	@echo "Building SeaweedFS binary..."
+	@cd ../../../weed && go build -o weed_binary .
+	@chmod +x $(WEED_BINARY)
+
+check-deps: build-weed
+	@command -v go >/dev/null 2>&1 || (echo "Go is required but not installed" && exit 1)
+	@command -v python3 >/dev/null 2>&1 || (echo "python3 is required but not installed" && exit 1)
+	@python3 -c "import botocore" 2>/dev/null || (echo "botocore is required: pip install botocore" && exit 1)
+	@test -f $(WEED_BINARY) || (echo "SeaweedFS binary not found at $(WEED_BINARY)" && exit 1)
+	@test -f $(S3_CONFIG) || (echo "S3 config not found at $(S3_CONFIG)" && exit 1)
+
+start-server: check-deps
+	@echo "Starting SeaweedFS mini for error compatibility tests..."
+	@rm -f weed-server.pid
+	@mkdir -p $(SERVER_DIR)
+	@if curl -sS -o /dev/null http://127.0.0.1:$(S3_PORT)/ >/dev/null 2>&1; then \
+		echo "port $(S3_PORT) is already served by another process; refusing to test against it"; \
+		exit 1; \
+	fi
+	@$(WEED_BINARY) mini \
+		-dir=$(SERVER_DIR) \
+		-s3 \
+		-s3.port=$(S3_PORT) \
+		-s3.config=$(S3_CONFIG) \
+		-s3.iam.readOnly=false \
+		-master.peers=none \
+		> weed-test.log 2>&1 & echo $$! > weed-server.pid
+	@for i in $$(seq 1 60); do \
+		kill -0 $$(cat weed-server.pid) 2>/dev/null || { \
+			echo "SeaweedFS server exited during startup"; \
+			echo "=== Server logs ==="; \
+			test -f weed-test.log && cat weed-test.log || true; \
+			exit 1; \
+		}; \
+		if curl -sS -o /dev/null http://127.0.0.1:$(S3_PORT)/ >/dev/null 2>&1; then \
+			echo "SeaweedFS S3 server is ready on port $(S3_PORT)"; \
+			sleep 3; \
+			exit 0; \
+		fi; \
+		sleep 1; \
+	done; \
+	echo "SeaweedFS S3 server failed to start"; \
+	echo "=== Server logs ==="; \
+	test -f weed-test.log && cat weed-test.log || true; \
+	$(MAKE) --no-print-directory stop-server; \
+	exit 1
+
+stop-server:
+	@if [ -f weed-server.pid ]; then \
+		pid=$$(cat weed-server.pid); \
+		if ps -p $$pid -o comm= 2>/dev/null | grep -q weed; then \
+			echo "Stopping SeaweedFS server..."; \
+			kill $$pid 2>/dev/null || true; \
+			sleep 2; \
+		fi; \
+		rm -f weed-server.pid; \
+	fi
+
+test-errors:
+	@echo "Running S3/IAM error compatibility checks..."
+	python3 s3_error_compat_test.py \
+		--endpoint http://127.0.0.1:$(S3_PORT) \
+		--access-key admin \
+		--secret-key admin
+
+test-with-server:
+	@$(MAKE) start-server; START_RESULT=$$?; \
+	if [ $$START_RESULT -eq 0 ]; then $(MAKE) test-errors; TEST_RESULT=$$?; else TEST_RESULT=$$START_RESULT; fi; \
+	$(MAKE) stop-server; exit $$TEST_RESULT
+
+logs:
+	@test -f weed-test.log && tail -100 weed-test.log || echo "No log file found"
+
+clean: stop-server
+	@rm -rf $(SERVER_DIR) weed-test.log weed-server.pid
+	@echo "Cleaned up test artifacts"
diff --git a/test/s3/error_compat/s3_error_compat_test.py b/test/s3/error_compat/s3_error_compat_test.py
new file mode 100644
index 0000000000..ccda33374b
--- /dev/null
+++ b/test/s3/error_compat/s3_error_compat_test.py
@@ -0,0 +1,216 @@
+#!/usr/bin/env python3
+"""Verify S3/IAM error responses match AWS for common client mistakes.
+
+Needs only botocore (pip install botocore). Sends raw SigV4 requests so the exact
+status and response body are visible, compares each with what AWS returns, then
+cleans up everything it created (one bucket, one IAM user).
+
+Usage:
+  python3 s3_error_compat_test.py --endpoint http://127.0.0.1:8333 \
+      --access-key <admin key> --secret-key <admin secret>
+
+The key needs Admin rights, and IAM writes must be enabled (-s3.iam.readOnly=false).
+"""
+import argparse, atexit, base64, datetime, hashlib, http.client, re, sys, time, urllib.parse, uuid
+
+from botocore.auth import S3SigV4Auth, SigV4Auth
+from botocore.awsrequest import AWSRequest
+from botocore.credentials import Credentials
+
+ap = argparse.ArgumentParser()
+ap.add_argument('--endpoint', default='http://127.0.0.1:8333')
+ap.add_argument('--access-key', required=True)
+ap.add_argument('--secret-key', required=True)
+ap.add_argument('--region', default='us-east-1')
+args = ap.parse_args()
+
+EP = args.endpoint.rstrip('/')
+U = urllib.parse.urlsplit(EP)
+ADMIN = Credentials(args.access_key, args.secret_key)
+BAD_KEY = Credentials('AKIAREPRONOSUCHKEY00', 'x' * 40)
+BAD_SECRET = Credentials(args.access_key, 'y' * 40)
+B = 'errorcompat-' + uuid.uuid4().hex[:8]
+S3DOC = 'https://docs.aws.amazon.com/AmazonS3/latest/API/'
+IAMDOC = 'https://docs.aws.amazon.com/IAM/latest/APIReference/'
+rows = []
+
+
+def send(method, path, body=b'', headers=None, creds=ADMIN, service='s3', mutate=None, sign=True,
+         keep_sha256_header=False):
+    headers = dict(headers or {})
+    url = EP + path
+    if sign:
+        req = AWSRequest(method=method, url=url, data=body, headers=headers)
+        if service == 's3':
+            if 'X-Amz-Content-SHA256' not in req.headers:
+                req.headers['X-Amz-Content-SHA256'] = hashlib.sha256(body).hexdigest()
+            # S3SigV4Auth always recomputes X-Amz-Content-SHA256 from the body; the
+            # generic SigV4Auth signs a caller-supplied value instead, which is how
+            # a mismatched declared hash can be produced on the wire.
+            signer = SigV4Auth if keep_sha256_header else S3SigV4Auth
+            signer(creds, 's3', args.region).add_auth(req)
+        else:
+            SigV4Auth(creds, service, args.region).add_auth(req)
+        headers = dict(req.headers.items())
+    if mutate:
+        headers = mutate(headers)
+    conn = http.client.HTTPConnection(U.hostname, U.port, timeout=30)
+    conn.request(method, path, body=body, headers=headers)
+    r = conn.getresponse()
+    data = r.read().decode('utf-8', 'replace')
+    conn.close()
+    return r.status, data
+
+
+def shape(data):
+    """Root element and <Code> of an XML error body."""
+    body = re.sub(r'<\?xml[^>]*\?>', '', data).strip()
+    root = re.match(r'<(\w+)', body)
+    code = re.search(r'<Code>([^<]*)</Code>', data)
+    return (root.group(1) if root else ('-' if not body else 'non-xml')), (code.group(1) if code else '')
+
+
+def iam(params, creds=ADMIN):
+    p = dict(params, Version='2010-05-08')
+    return dict(method='POST', path='/', body=urllib.parse.urlencode(p).encode(), creds=creds, service='iam',
+                headers={'Content-Type': 'application/x-www-form-urlencoded; charset=utf-8'})
+
+
+def case(group, name, expect, ref, req, check=None):
+    """expect = (status, root element or None, code or None); check() adds a side-effect note."""
+    st, data = send(**req)
+    root, code = shape(data)
+    note = check() if check else ''
+    ok = st == expect[0] and expect[1] in (None, root) and expect[2] in (None, code) and not note
+    rows.append((group, name, '%s %s %s' % (st, root, code), '%s %s %s' % (expect[0], expect[1] or '', expect[2] or ''), note, ok, ref))
+
+
+def exists(key):
+    return lambda: 'object %r now exists' % key if send('HEAD', '/%s/%s' % (B, key))[0] == 200 else ''
+
+
+def S3(method, path, **kw):
+    return dict(method=method, path=path, **kw)
+
+
+# ---------------- cleanup (atexit so failed runs still clean up) ----------------
+user = USER = upload_id = None
+
+
+def cleanup():
+    try:
+        if user and USER:
+            send(**iam({'Action': 'DeleteAccessKey', 'UserName': user, 'AccessKeyId': USER.access_key}))
+        if user:
+            send(**iam({'Action': 'DeleteUser', 'UserName': user}))
+        if upload_id:
+            send('DELETE', '/%s/mp?uploadId=%s' % (B, upload_id))
+        st, d = send('GET', '/%s?list-type=2' % B)
+        for k in re.findall(r'<Key>([^<]+)</Key>', d):
+            send('DELETE', '/%s/%s' % (B, urllib.parse.quote(k)))
+        send('DELETE', '/' + B)
+    except Exception as e:
+        print('cleanup failed: %s' % e)
+
+
+atexit.register(cleanup)
+
+# ---------------- setup ----------------
+st, d = send('PUT', '/' + B)
+if st != 200:
+    sys.exit('cannot create bucket %s: %s %s' % (B, st, d[:200]))
+send('PUT', '/%s/obj' % B, body=b'hello')
+st, d = send('POST', '/%s/mp?uploads' % B)
+upload_id = re.search(r'<UploadId>([^<]+)', d).group(1)
+user = 'errorcompat-' + uuid.uuid4().hex[:6]
+send(**iam({'Action': 'CreateUser', 'UserName': user}))
+st, d = send(**iam({'Action': 'CreateAccessKey', 'UserName': user}))
+USER = Credentials(re.search(r'<AccessKeyId>([^<]+)', d).group(1), re.search(r'<SecretAccessKey>([^<]+)', d).group(1))
+for _ in range(15):  # wait until the new key is accepted
+    if 'InvalidAccessKeyId' not in send('GET', '/', creds=USER)[1]:
+        break
+    time.sleep(1)
+
+# ---------------- 1. requests that run a different operation ----------------
+for sub in ('logging', 'notification', 'accelerate', 'website', 'replication',
+            'analytics&id=a', 'inventory&id=a', 'metrics&id=a', 'intelligent-tiering&id=a'):
+    case(1, 'PUT ?%s' % sub, (501, 'Error', 'NotImplemented'), S3DOC + 'API_Error.html#:~:text=Code%3A%20NotImplemented',
+         S3('PUT', '/%s?%s' % (B, sub), body=b'<X/>'))
+case(1, 'DELETE ?logging', (501, 'Error', 'NotImplemented'), S3DOC + 'API_Error.html#:~:text=Code%3A%20NotImplemented',
+     S3('DELETE', '/%s?logging' % B),
+     lambda: '' if send('HEAD', '/' + B)[0] == 200 else 'BUCKET DELETED')
+case(1, 'CopyObject, x-amz-copy-source without "/"', (400, 'Error', 'InvalidArgument'),
+     S3DOC + 'API_CopyObject.html#AmazonS3-CopyObject-request-header-CopySource',
+     S3('PUT', '/%s/copy-dst' % B, headers={'x-amz-copy-source': 'nobucketonly'}), exists('copy-dst'))
+case(1, 'UploadPart partNumber=abc', (400, 'Error', 'InvalidArgument'),
+     S3DOC + 'API_UploadPart.html#AmazonS3-UploadPart-request-uri-querystring-PartNumber',
+     S3('PUT', '/%s/mp?partNumber=abc&uploadId=%s' % (B, upload_id), body=b'part-body'), exists('mp'))
+case(1, 'PutObject, x-amz-content-sha256 != body', (400, 'Error', 'XAmzContentSHA256Mismatch'),
+     'undocumented code; ' + S3DOC + 'API_UploadPart.html#API_UploadPart_RequestSyntax',
+     S3('PUT', '/%s/sha-mismatch' % B, body=b'abc',
+        headers={'X-Amz-Content-SHA256': hashlib.sha256(b'zzz').hexdigest()}, keep_sha256_header=True),
+     exists('sha-mismatch'))
+case(1, 'PutObject, x-amz-content-sha256 not hex', (400, 'Error', None), 'undocumented',
+     S3('PUT', '/%s/sha-nothex' % B, body=b'abc',
+        headers={'X-Amz-Content-SHA256': 'nothex'}, keep_sha256_header=True), exists('sha-nothex'))
+
+# ---------------- 2. IAM failures in the S3 <Error> envelope ----------------
+case(2, 'IAM ListUsers, unknown access key', (403, 'ErrorResponse', 'InvalidClientTokenId'),
+     'checked against iam.amazonaws.com (docs list UnrecognizedClientException); ' + IAMDOC + 'CommonErrors.html#CommonErrors-UnrecognizedClientException', iam({'Action': 'ListUsers'}, creds=BAD_KEY))
+case(2, 'IAM ListUsers, wrong secret', (403, 'ErrorResponse', None), 'undocumented for IAM',
+     iam({'Action': 'ListUsers'}, creds=BAD_SECRET))
+case(2, 'IAM ListUsers, non-admin user', (403, 'ErrorResponse', 'AccessDenied'),
+     IAMDOC + 'CommonErrors.html#CommonErrors-AccessDeniedException', iam({'Action': 'ListUsers'}, creds=USER))
+case(2, 'IAM CreateUser, non-admin user', (403, 'ErrorResponse', 'AccessDenied'),
+     IAMDOC + 'CommonErrors.html#CommonErrors-AccessDeniedException', iam({'Action': 'CreateUser', 'UserName': user + 'x'}, creds=USER))
+
+# ---------------- 3. wrong status or code ----------------
+tags = [('Action', 'TagUser'), ('UserName', user)] + [('Tags.member.%d.%s' % (i, k), 'k%d' % i if k == 'Key' else 'v')
+                                                       for i in range(1, 52) for k in ('Key', 'Value')]
+case(3, 'IAM TagUser with 51 tags', (409, 'ErrorResponse', 'LimitExceeded'), IAMDOC + 'API_TagUser.html#API_TagUser_Errors',
+     iam(dict(tags)))
+case(3, 'IAM unknown Action', (404, 'ErrorResponse', 'InvalidAction'), 'checked against iam.amazonaws.com',
+     iam({'Action': 'NoSuchActionZZ'}))
+
+
+def no_date(h):
+    return {k: v for k, v in h.items() if k.lower() != 'x-amz-date'}
+
+
+def drop(field):
+    return lambda h: dict(h, Authorization=re.sub(r',? *%s=[^,]*' % field, '', h['Authorization']))
+
+
+case(3, 'S3 request without x-amz-date', (403, 'Error', 'AccessDenied'), 'checked against s3.amazonaws.com; ' + S3DOC + 'API_Error.html#:~:text=Code%3A%20AccessDenied',
+     S3('GET', '/' + B, mutate=no_date))
+case(3, 'Authorization without Signature=', (400, 'Error', 'AuthorizationHeaderMalformed'),
+     'checked against s3.amazonaws.com; ' + S3DOC + 'API_Error.html#:~:text=Code%3A%20AuthorizationHeaderMalformed', S3('GET', '/' + B, mutate=drop('Signature')))
+case(3, 'Authorization without Credential=', (400, 'Error', 'InvalidArgument'),
+     'checked against s3.amazonaws.com ("Unsupported Authorization Type")', S3('GET', '/' + B, mutate=drop('Credential')))
+for m, exp, chk in (('GET', (400, 'Error', 'InvalidArgument'), 'checked against s3.amazonaws.com ("Invalid version id specified"); '),
+                    ('HEAD', (400, None, None), 'checked against s3.amazonaws.com; '),
+                    ('DELETE', (400, None, None), 'unverified (needs write access); ')):
+    case(3, '%s ?versionId=bogus, unversioned bucket' % m, exp,
+         chk + S3DOC + 'API_GetObject.html#AmazonS3-GetObject-request-uri-querystring-VersionId',
+         S3(m, '/%s/obj?versionId=bogus' % B))
+for pn in ('0', '10001'):
+    case(3, 'UploadPart partNumber=%s' % pn, (400, 'Error', 'InvalidArgument'),
+         S3DOC + 'API_UploadPart.html#AmazonS3-UploadPart-request-uri-querystring-PartNumber',
+         S3('PUT', '/%s/mp?partNumber=%s&uploadId=%s' % (B, pn, upload_id), body=b'x'))
+case(3, 'DeleteObjects with 1001 keys', (400, 'Error', 'MalformedXML'), S3DOC + 'API_DeleteObjects.html#API_DeleteObjects_RequestBody',
+     S3('POST', '/%s?delete' % B, body=('<Delete>' + ''.join('<Object><Key>k%d</Key></Object>' % i for i in range(1001)) + '</Delete>').encode()))
+# last: this one deletes the user when it should be refused
+case(3, 'IAM DeleteUser while it has an access key', (409, 'ErrorResponse', 'DeleteConflict'),
+     IAMDOC + 'API_DeleteUser.html#API_DeleteUser_Errors', iam({'Action': 'DeleteUser', 'UserName': user}))
+
+# ---------------- report ----------------
+w = max(len(r[1]) for r in rows)
+print('%-4s %-*s  %-46s %-40s %s' % ('', w, 'case', 'got (status root code)', 'expected (AWS)', 'side effect'))
+for g, name, got, exp, note, ok, ref in rows:
+    print('%-4s %-*s  %-46s %-40s %s' % ('ok' if ok else 'DIFF', w, name, got, exp, note))
+print('\nreferences:')
+for g, name, got, exp, note, ok, ref in rows:
+    print('  %-*s  %s' % (w, name, ref))
+diff = sum(not r[5] for r in rows)
+print('\n%d cases, %d differ from AWS' % (len(rows), diff))
+sys.exit(1 if diff else 0)
diff --git a/test/s3/error_compat/test_s3.json b/test/s3/error_compat/test_s3.json
new file mode 100644
index 0000000000..1f9b460008
--- /dev/null
+++ b/test/s3/error_compat/test_s3.json
@@ -0,0 +1,20 @@
+{
+  "identities": [
+    {
+      "name": "admin",
+      "credentials": [
+        {
+          "accessKey": "admin",
+          "secretKey": "admin"
+        }
+      ],
+      "actions": [
+        "Admin",
+        "Read",
+        "List",
+        "Tagging",
+        "Write"
+      ]
+    }
+  ]
+}
diff --git a/test/s3/filer_group/Makefile b/test/s3/filer_group/Makefile
index 21d5c050a8..7420b23149 100644
--- a/test/s3/filer_group/Makefile
+++ b/test/s3/filer_group/Makefile
@@ -79,14 +79,14 @@ start-server: check-deps
 		echo $$! > weed-server.pid
 	
 	@echo "Waiting for S3 server to be ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if echo | nc -z localhost $(S3_PORT); then \
 			echo "S3 server is ready!"; \
 			exit 0; \
 		fi; \
 		sleep 1; \
 	done; \
-	echo "❌ Server failed to start within 30 seconds"; \
+	echo "❌ Server failed to start within 90 seconds"; \
 	if [ -f weed-server.log ]; then \
 		cat weed-server.log; \
 	fi; \
diff --git a/test/s3/iam/Dockerfile.s3 b/test/s3/iam/Dockerfile.s3
index 52ba670a5e..75b86c3a1d 100644
--- a/test/s3/iam/Dockerfile.s3
+++ b/test/s3/iam/Dockerfile.s3
@@ -1,5 +1,5 @@
 # Multi-stage build for SeaweedFS S3 with IAM
-FROM golang:1.25-alpine AS builder
+FROM golang:1.26-alpine AS builder
 
 # Install build dependencies
 RUN apk add --no-cache git make curl wget
diff --git a/test/s3/iam/Makefile b/test/s3/iam/Makefile
index 6dbb54299f..70f8972e14 100644
--- a/test/s3/iam/Makefile
+++ b/test/s3/iam/Makefile
@@ -81,7 +81,7 @@ start-services: ## Start SeaweedFS services for testing
 wait-for-services: ## Wait for all services to be ready
 	@echo "Waiting for services to be ready..."
 	@echo "Checking S3 API server..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s http://localhost:$(S3_PORT) > /dev/null 2>&1; then \
 			echo "OK S3 API server is ready"; \
 			exit 0; \
diff --git a/test/s3/iam/README.md b/test/s3/iam/README.md
index b28d0d2620..f6ebbdab2a 100644
--- a/test/s3/iam/README.md
+++ b/test/s3/iam/README.md
@@ -83,7 +83,7 @@ The S3 IAM integration tests validate the complete end-to-end functionality of:
 
 ### Prerequisites
 
-1. **Go 1.19+** with modules enabled
+1. **Go 1.26+** with modules enabled
 2. **SeaweedFS Binary** (`weed`) built with IAM support
 3. **Test Dependencies**:
    ```bash
@@ -425,7 +425,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.19'
+          go-version-file: 'go.mod'
       
       - name: Build SeaweedFS
         run: go build -o weed ./main.go
diff --git a/test/s3/iam/s3_iam_admin_test.go b/test/s3/iam/s3_iam_admin_test.go
index 75556b43f7..70906dd26e 100644
--- a/test/s3/iam/s3_iam_admin_test.go
+++ b/test/s3/iam/s3_iam_admin_test.go
@@ -295,8 +295,8 @@ func TestIAMPolicyManagement(t *testing.T) {
 		assert.Equal(t, true, aws.BoolValue(listVersionsResp.Versions[0].IsDefaultVersion))
 
 		getVersionResp, err := iamClient.GetPolicyVersion(&iam.GetPolicyVersionInput{
-			PolicyArn:  createResp.Policy.Arn,
-			VersionId:  aws.String("v1"),
+			PolicyArn: createResp.Policy.Arn,
+			VersionId: aws.String("v1"),
 		})
 		require.NoError(t, err)
 		require.NotNil(t, getVersionResp.PolicyVersion)
diff --git a/test/s3/iam/s3_iam_framework.go b/test/s3/iam/s3_iam_framework.go
index cdb5a38ea8..87659c3c08 100644
--- a/test/s3/iam/s3_iam_framework.go
+++ b/test/s3/iam/s3_iam_framework.go
@@ -2,9 +2,12 @@ package iam
 
 import (
 	"context"
+	"crypto/hmac"
 	cryptorand "crypto/rand"
 	"crypto/rsa"
+	"crypto/sha256"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -354,12 +357,12 @@ func (t *BearerTokenTransport) extractPrincipalFromJWT(tokenString string) strin
 }
 
 // generateSTSSessionToken creates a session token using the actual STS service for proper validation
-func (f *S3IAMTestFramework) generateSTSSessionToken(username, roleName string, validDuration time.Duration, account string, customClaims map[string]interface{}) (string, error) {
+func (f *S3IAMTestFramework) generateSTSSessionToken(username, roleName string, validDuration time.Duration, account string, customClaims map[string]interface{}) (string, *credentials.Credentials, error) {
 	now := time.Now()
 	signingKeyB64 := "dGVzdC1zaWduaW5nLWtleS0zMi1jaGFyYWN0ZXJzLWxvbmc="
 	signingKey, err := base64.StdEncoding.DecodeString(signingKeyB64)
 	if err != nil {
-		return "", fmt.Errorf("failed to decode signing key: %v", err)
+		return "", nil, fmt.Errorf("failed to decode signing key: %v", err)
 	}
 
 	// Generate a session ID that would be created by the STS service
@@ -404,10 +407,19 @@ func (f *S3IAMTestFramework) generateSTSSessionToken(username, roleName string,
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, sessionClaims)
 	tokenString, err := token.SignedString(signingKey)
 	if err != nil {
-		return "", err
+		return "", nil, err
 	}
 
-	return tokenString, nil
+	accessKeyHash := sha256.Sum256([]byte("access-key:" + sessionId))
+	mac := hmac.New(sha256.New, signingKey)
+	mac.Write([]byte("secret-key:" + sessionId))
+	creds := credentials.NewStaticCredentials(
+		"ASIA"+hex.EncodeToString(accessKeyHash[:8]),
+		base64.StdEncoding.EncodeToString(mac.Sum(nil)),
+		tokenString,
+	)
+
+	return tokenString, creds, nil
 }
 
 // CreateS3ClientWithJWT creates an S3 client authenticated with a JWT token for the specified role
@@ -417,36 +429,34 @@ func (f *S3IAMTestFramework) CreateS3ClientWithJWT(username, roleName string) (*
 
 // CreateS3ClientWithCustomClaims creates an S3 client with specific account ID and custom claims
 func (f *S3IAMTestFramework) CreateS3ClientWithCustomClaims(username, roleName, account string, claims map[string]interface{}) (*s3.S3, error) {
-	var token string
-	var err error
+	var httpClient *http.Client
+	creds := credentials.AnonymousCredentials
 
 	if f.useKeycloak && claims == nil && account == "" {
 		// Use real Keycloak authentication if no custom requirements
-		token, err = f.getKeycloakToken(username)
+		token, err := f.getKeycloakToken(username)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get Keycloak token: %v", err)
 		}
+		httpClient = &http.Client{
+			Transport: &BearerTokenTransport{
+				Token: token,
+			},
+		}
 	} else {
 		// Generate STS session token (mock mode or custom requirements)
-		token, err = f.generateSTSSessionToken(username, roleName, time.Hour, account, claims)
+		var err error
+		_, creds, err = f.generateSTSSessionToken(username, roleName, time.Hour, account, claims)
 		if err != nil {
 			return nil, fmt.Errorf("failed to generate STS session token: %v", err)
 		}
 	}
 
-	// Create custom HTTP client with Bearer token transport
-	httpClient := &http.Client{
-		Transport: &BearerTokenTransport{
-			Token: token,
-		},
-	}
-
 	sess, err := session.NewSession(&aws.Config{
-		Region:     aws.String(TestRegion),
-		Endpoint:   aws.String(TestS3Endpoint),
-		HTTPClient: httpClient,
-		// Use anonymous credentials to avoid AWS signature generation
-		Credentials:      credentials.AnonymousCredentials,
+		Region:           aws.String(TestRegion),
+		Endpoint:         aws.String(TestS3Endpoint),
+		HTTPClient:       httpClient,
+		Credentials:      creds,
 		DisableSSL:       aws.Bool(true),
 		S3ForcePathStyle: aws.Bool(true),
 	})
@@ -487,7 +497,7 @@ func (f *S3IAMTestFramework) CreateS3ClientWithInvalidJWT() (*s3.S3, error) {
 // CreateS3ClientWithExpiredJWT creates an S3 client with an expired JWT token
 func (f *S3IAMTestFramework) CreateS3ClientWithExpiredJWT(username, roleName string) (*s3.S3, error) {
 	// Generate expired STS session token (expired 1 hour ago)
-	token, err := f.generateSTSSessionToken(username, roleName, -time.Hour, "", nil)
+	token, _, err := f.generateSTSSessionToken(username, roleName, -time.Hour, "", nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate expired STS session token: %v", err)
 	}
@@ -942,36 +952,34 @@ func (f *S3IAMTestFramework) CreateIAMClientWithJWT(username, roleName string) (
 
 // CreateIAMClientWithCustomClaims creates an IAM client with specific account ID and custom claims
 func (f *S3IAMTestFramework) CreateIAMClientWithCustomClaims(username, roleName, account string, claims map[string]interface{}) (*iam.IAM, error) {
-	var token string
-	var err error
+	var httpClient *http.Client
+	creds := credentials.AnonymousCredentials
 
 	if f.useKeycloak && claims == nil && account == "" {
 		// Use real Keycloak authentication if no custom requirements
-		token, err = f.getKeycloakToken(username)
+		token, err := f.getKeycloakToken(username)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get Keycloak token: %v", err)
 		}
+		httpClient = &http.Client{
+			Transport: &BearerTokenTransport{
+				Token: token,
+			},
+		}
 	} else {
 		// Generate STS session token (mock mode or custom requirements)
-		token, err = f.generateSTSSessionToken(username, roleName, time.Hour, account, claims)
+		var err error
+		_, creds, err = f.generateSTSSessionToken(username, roleName, time.Hour, account, claims)
 		if err != nil {
 			return nil, fmt.Errorf("failed to generate STS session token: %v", err)
 		}
 	}
 
-	// Create custom HTTP client with Bearer token transport
-	httpClient := &http.Client{
-		Transport: &BearerTokenTransport{
-			Token: token,
-		},
-	}
-
 	sess, err := session.NewSession(&aws.Config{
-		Region:     aws.String(TestRegion),
-		Endpoint:   aws.String(TestS3Endpoint),
-		HTTPClient: httpClient,
-		// Use anonymous credentials to avoid AWS signature generation
-		Credentials: credentials.AnonymousCredentials,
+		Region:      aws.String(TestRegion),
+		Endpoint:    aws.String(TestS3Endpoint),
+		HTTPClient:  httpClient,
+		Credentials: creds,
 		DisableSSL:  aws.Bool(true),
 	})
 	if err != nil {
diff --git a/test/s3/iam/s3_iam_group_test.go b/test/s3/iam/s3_iam_group_test.go
index bcb9d895e3..e71121af00 100644
--- a/test/s3/iam/s3_iam_group_test.go
+++ b/test/s3/iam/s3_iam_group_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
+	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
 	"github.com/aws/aws-sdk-go/service/iam"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/stretchr/testify/assert"
@@ -693,23 +694,25 @@ type ListGroupsResponse struct {
 func callIAMAPIAuthenticated(_ *testing.T, framework *S3IAMTestFramework, action string, params url.Values) (*http.Response, error) {
 	params.Set("Action", action)
 
+	body := params.Encode()
 	req, err := http.NewRequest(http.MethodPost, TestIAMEndpoint+"/",
-		strings.NewReader(params.Encode()))
+		strings.NewReader(body))
 	if err != nil {
 		return nil, err
 	}
 
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-	token, err := framework.generateSTSSessionToken("admin-user", "TestAdminRole", time.Hour, "", nil)
+	_, creds, err := framework.generateSTSSessionToken("admin-user", "TestAdminRole", time.Hour, "", nil)
 	if err != nil {
 		return nil, err
 	}
 
-	client := &http.Client{
-		Timeout:   30 * time.Second,
-		Transport: &BearerTokenTransport{Token: token},
+	if _, err := v4.NewSigner(creds).Sign(req, strings.NewReader(body), "iam", TestRegion, time.Now()); err != nil {
+		return nil, err
 	}
+
+	client := &http.Client{Timeout: 30 * time.Second}
 	return client.Do(req)
 }
 
diff --git a/test/s3/iam/s3_sts_get_federation_token_test.go b/test/s3/iam/s3_sts_get_federation_token_test.go
index 2a718cba90..69807bb169 100644
--- a/test/s3/iam/s3_sts_get_federation_token_test.go
+++ b/test/s3/iam/s3_sts_get_federation_token_test.go
@@ -14,8 +14,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
 	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
diff --git a/test/s3/iam/s3_sts_web_identity_api_test.go b/test/s3/iam/s3_sts_web_identity_api_test.go
new file mode 100644
index 0000000000..87e3719d6a
--- /dev/null
+++ b/test/s3/iam/s3_sts_web_identity_api_test.go
@@ -0,0 +1,258 @@
+package iam
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/xml"
+	"io"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	webIdentityAudience = "web-identity-api-test"
+	webIdentitySubject  = "spiffe://example.org/ns/app/sa/app"
+)
+
+// webIdentityIssuer is an OIDC issuer served by the test: discovery document
+// and JWKS for one RSA key, so the server under test fetches real keys.
+type webIdentityIssuer struct {
+	server *httptest.Server
+	key    *rsa.PrivateKey
+}
+
+func newWebIdentityIssuer(t *testing.T) *webIdentityIssuer {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	issuer := &webIdentityIssuer{key: key}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"issuer":                                issuer.server.URL,
+			"jwks_uri":                              issuer.server.URL + "/keys",
+			"id_token_signing_alg_values_supported": []string{"RS256"},
+		})
+	})
+	mux.HandleFunc("/keys", func(w http.ResponseWriter, _ *http.Request) {
+		b64 := func(b []byte) string { return base64.RawURLEncoding.EncodeToString(b) }
+		_ = json.NewEncoder(w).Encode(map[string]any{"keys": []any{map[string]any{
+			"kty": "RSA", "kid": "k1", "use": "sig", "alg": "RS256",
+			"n": b64(key.PublicKey.N.Bytes()), "e": b64(big.NewInt(int64(key.PublicKey.E)).Bytes()),
+		}}})
+	})
+	issuer.server = httptest.NewServer(mux)
+	t.Cleanup(issuer.server.Close)
+	return issuer
+}
+
+func (i *webIdentityIssuer) claims(sub string) jwt.MapClaims {
+	now := time.Now()
+	return jwt.MapClaims{"iss": i.server.URL, "sub": sub, "aud": webIdentityAudience,
+		"iat": now.Unix(), "exp": now.Add(10 * time.Minute).Unix()}
+}
+
+func (i *webIdentityIssuer) token(t *testing.T, sub string, key *rsa.PrivateKey) string {
+	t.Helper()
+	tok := jwt.NewWithClaims(jwt.SigningMethodRS256, i.claims(sub))
+	tok.Header["kid"] = "k1"
+	signed, err := tok.SignedString(key)
+	require.NoError(t, err)
+	return signed
+}
+
+func (i *webIdentityIssuer) tokenForAudience(t *testing.T, sub, aud string) string {
+	t.Helper()
+	claims := i.claims(sub)
+	claims["aud"] = aud
+	tok := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tok.Header["kid"] = "k1"
+	signed, err := tok.SignedString(i.key)
+	require.NoError(t, err)
+	return signed
+}
+
+func (i *webIdentityIssuer) unsignedToken(t *testing.T, sub string) string {
+	t.Helper()
+	signed, err := jwt.NewWithClaims(jwt.SigningMethodNone, i.claims(sub)).SignedString(jwt.UnsafeAllowNoneSignatureType)
+	require.NoError(t, err)
+	return signed
+}
+
+func trustPolicyFor(issuerURL, sub string) string {
+	doc, _ := json.Marshal(map[string]any{"Version": "2012-10-17", "Statement": []any{map[string]any{
+		"Effect": "Allow", "Principal": map[string]any{"Federated": issuerURL},
+		"Action":    []string{"sts:AssumeRoleWithWebIdentity"},
+		"Condition": map[string]any{"StringEquals": map[string]any{"oidc:sub": sub}},
+	}}})
+	return string(doc)
+}
+
+// assumeWithWebIdentity returns session credentials, or nil and the error body.
+func assumeWithWebIdentity(t *testing.T, roleArn, token string) (*credentials.Credentials, string) {
+	t.Helper()
+	resp, err := callSTSAPI(t, url.Values{
+		"Action": {"AssumeRoleWithWebIdentity"}, "Version": {"2011-06-15"},
+		"RoleArn": {roleArn}, "RoleSessionName": {"web-identity-api"}, "WebIdentityToken": {token},
+	})
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	if resp.StatusCode != http.StatusOK {
+		return nil, string(body)
+	}
+	var out AssumeRoleWithWebIdentityTestResponse
+	require.NoError(t, xml.Unmarshal(body, &out), "body: %s", body)
+	c := out.Result.Credentials
+	return credentials.NewStaticCredentials(c.AccessKeyId, c.SecretAccessKey, c.SessionToken), ""
+}
+
+func s3ClientWith(t *testing.T, creds *credentials.Credentials) *s3.S3 {
+	t.Helper()
+	sess, err := session.NewSession(&aws.Config{
+		Region: aws.String(TestRegion), Endpoint: aws.String(TestS3Endpoint),
+		Credentials: creds, S3ForcePathStyle: aws.Bool(true), DisableSSL: aws.Bool(true),
+	})
+	require.NoError(t, err)
+	return s3.New(sess)
+}
+
+// TestWebIdentityWithProviderAndRoleManagedThroughIAMAPI configures STS
+// federation entirely at runtime — an OIDC provider, a managed policy and a role
+// created through the IAM API, with no static configuration — and checks that
+// the role admits exactly the subject its trust policy names, with exactly the
+// permissions of its attached policy.
+func TestWebIdentityWithProviderAndRoleManagedThroughIAMAPI(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	if !isSTSEndpointRunning(t) {
+		t.Fatal("SeaweedFS STS endpoint is not running at", TestSTSEndpoint, "- please run 'make setup-all-tests' first")
+	}
+
+	framework := NewS3IAMTestFramework(t)
+	defer framework.Cleanup()
+	admin, err := framework.CreateIAMClientWithJWT("admin-user", "TestAdminRole")
+	require.NoError(t, err)
+	adminS3, err := framework.CreateS3ClientWithJWT("admin-user", "TestAdminRole")
+	require.NoError(t, err)
+
+	issuer := newWebIdentityIssuer(t)
+	bucket := framework.GenerateUniqueBucketName("web-identity")
+	require.NoError(t, framework.CreateBucketWithCleanup(adminS3, bucket))
+
+	provider, err := admin.CreateOpenIDConnectProvider(&iam.CreateOpenIDConnectProviderInput{
+		Url:          aws.String(issuer.server.URL),
+		ClientIDList: []*string{aws.String(webIdentityAudience)},
+		// Required by this SDK version; pinning only applies to a TLS issuer,
+		// and the test issuer is plain HTTP.
+		ThumbprintList: []*string{aws.String("0000000000000000000000000000000000000000")},
+	})
+	require.NoError(t, err)
+	defer admin.DeleteOpenIDConnectProvider(&iam.DeleteOpenIDConnectProviderInput{OpenIDConnectProviderArn: provider.OpenIDConnectProviderArn})
+
+	policyDoc, _ := json.Marshal(map[string]any{"Version": "2012-10-17", "Statement": []any{map[string]any{
+		"Effect": "Allow", "Action": []string{"s3:*"},
+		"Resource": []string{"arn:aws:s3:::" + bucket, "arn:aws:s3:::" + bucket + "/*"},
+	}}})
+	policy, err := admin.CreatePolicy(&iam.CreatePolicyInput{
+		PolicyName: aws.String(bucket + "-rw"), PolicyDocument: aws.String(string(policyDoc)),
+	})
+	require.NoError(t, err)
+	defer admin.DeletePolicy(&iam.DeletePolicyInput{PolicyArn: policy.Policy.Arn})
+
+	// Role names are at most 64 characters; the bucket name is longer.
+	roleName := "web-identity-" + strconv.FormatInt(time.Now().UnixNano(), 36)
+	role, err := admin.CreateRole(&iam.CreateRoleInput{
+		RoleName:                 aws.String(roleName),
+		AssumeRolePolicyDocument: aws.String(trustPolicyFor(issuer.server.URL, webIdentitySubject)),
+	})
+	require.NoError(t, err)
+	defer admin.DeleteRole(&iam.DeleteRoleInput{RoleName: aws.String(roleName)})
+	_, err = admin.AttachRolePolicy(&iam.AttachRolePolicyInput{RoleName: aws.String(roleName), PolicyArn: policy.Policy.Arn})
+	require.NoError(t, err)
+	defer admin.DetachRolePolicy(&iam.DetachRolePolicyInput{RoleName: aws.String(roleName), PolicyArn: policy.Policy.Arn})
+	roleArn := aws.StringValue(role.Role.Arn)
+
+	t.Run("the trusted subject gets credentials scoped to the attached policy", func(t *testing.T) {
+		creds, failure := assumeWithWebIdentity(t, roleArn, issuer.token(t, webIdentitySubject, issuer.key))
+		require.NotNil(t, creds, "AssumeRoleWithWebIdentity refused the trusted subject: %s", failure)
+		client := s3ClientWith(t, creds)
+		_, err := client.PutObject(&s3.PutObjectInput{Bucket: aws.String(bucket), Key: aws.String("federated.txt")})
+		assert.NoError(t, err, "the session cannot write the bucket its policy grants")
+		_, err = client.CreateBucket(&s3.CreateBucketInput{Bucket: aws.String(bucket + "-other")})
+		assert.Error(t, err, "the session created a bucket its policy does not grant")
+	})
+
+	refusals := map[string]string{
+		"another subject": issuer.token(t, "spiffe://example.org/ns/other/sa/other", issuer.key),
+		"a token signed by another key": func() string {
+			other, err := rsa.GenerateKey(rand.Reader, 2048)
+			require.NoError(t, err)
+			return issuer.token(t, webIdentitySubject, other)
+		}(),
+		"an unsigned token": issuer.unsignedToken(t, webIdentitySubject),
+		// The provider accepts only its registered client IDs as audiences.
+		"a token issued for another audience": issuer.tokenForAudience(t, webIdentitySubject, "some-other-service"),
+	}
+	for name, token := range refusals {
+		t.Run("refuses "+name, func(t *testing.T) {
+			creds, _ := assumeWithWebIdentity(t, roleArn, token)
+			assert.Nil(t, creds, "AssumeRoleWithWebIdentity issued credentials for %s", name)
+		})
+	}
+
+	t.Run("an updated trust policy takes effect", func(t *testing.T) {
+		moved := "spiffe://example.org/ns/app/sa/moved"
+		_, err := admin.UpdateAssumeRolePolicy(&iam.UpdateAssumeRolePolicyInput{
+			RoleName: aws.String(roleName), PolicyDocument: aws.String(trustPolicyFor(issuer.server.URL, moved)),
+		})
+		require.NoError(t, err)
+		creds, _ := assumeWithWebIdentity(t, roleArn, issuer.token(t, webIdentitySubject, issuer.key))
+		assert.Nil(t, creds, "the subject removed from the trust policy still assumes the role")
+		creds, failure := assumeWithWebIdentity(t, roleArn, issuer.token(t, moved, issuer.key))
+		assert.NotNil(t, creds, "the subject added to the trust policy was refused: %s", failure)
+	})
+
+	t.Run("a session does not survive its role being deleted and created again", func(t *testing.T) {
+		trust := trustPolicyFor(issuer.server.URL, webIdentitySubject)
+		_, err := admin.UpdateAssumeRolePolicy(&iam.UpdateAssumeRolePolicyInput{RoleName: aws.String(roleName), PolicyDocument: aws.String(trust)})
+		require.NoError(t, err)
+		before, failure := assumeWithWebIdentity(t, roleArn, issuer.token(t, webIdentitySubject, issuer.key))
+		require.NotNil(t, before, "precondition: %s", failure)
+
+		_, err = admin.DetachRolePolicy(&iam.DetachRolePolicyInput{RoleName: aws.String(roleName), PolicyArn: policy.Policy.Arn})
+		require.NoError(t, err)
+		_, err = admin.DeleteRole(&iam.DeleteRoleInput{RoleName: aws.String(roleName)})
+		require.NoError(t, err)
+		recreated, err := admin.CreateRole(&iam.CreateRoleInput{RoleName: aws.String(roleName), AssumeRolePolicyDocument: aws.String(trust)})
+		require.NoError(t, err)
+		_, err = admin.AttachRolePolicy(&iam.AttachRolePolicyInput{RoleName: aws.String(roleName), PolicyArn: policy.Policy.Arn})
+		require.NoError(t, err)
+		assert.NotEqual(t, aws.StringValue(role.Role.RoleId), aws.StringValue(recreated.Role.RoleId), "the recreated role reuses the deleted role's ID")
+
+		_, err = s3ClientWith(t, before).PutObject(&s3.PutObjectInput{Bucket: aws.String(bucket), Key: aws.String("revived.txt")})
+		assert.Error(t, err, "a session of the deleted role works again under the new role of the same name")
+		after, failure := assumeWithWebIdentity(t, roleArn, issuer.token(t, webIdentitySubject, issuer.key))
+		require.NotNil(t, after, "the new role refuses its trusted subject: %s", failure)
+		_, err = s3ClientWith(t, after).PutObject(&s3.PutObjectInput{Bucket: aws.String(bucket), Key: aws.String("fresh.txt")})
+		assert.NoError(t, err, "a session of the new role cannot use its policy")
+	})
+}
diff --git a/test/s3/lifecycle/Makefile b/test/s3/lifecycle/Makefile
index 5fafcb10e2..cf55c424e6 100644
--- a/test/s3/lifecycle/Makefile
+++ b/test/s3/lifecycle/Makefile
@@ -12,7 +12,7 @@ FILER_PORT := 8888
 # Pin the filer gRPC port off the FILER_PORT+10000 convention so any
 # code path that assumes the offset breaks here, not in production.
 FILER_GRPC_PORT := 18890
-ADMIN_PORT := 23646
+ADMIN_PORT := 12535
 ACCESS_KEY ?= some_access_key1
 SECRET_KEY ?= some_secret_key1
 TEST_TIMEOUT := 10m
@@ -42,6 +42,8 @@ start-server: build-weed
 	@mkdir -p $(SERVER_DIR)
 	@AWS_ACCESS_KEY_ID=$(ACCESS_KEY) AWS_SECRET_ACCESS_KEY=$(SECRET_KEY) $(WEED_BINARY) mini \
 		-dir=$(SERVER_DIR) \
+		-ip=127.0.0.1 \
+		-ip.bind=127.0.0.1 \
 		-s3.port=$(S3_PORT) \
 		-filer.port.grpc=$(FILER_GRPC_PORT) \
 		> weed-test.log 2>&1 & \
diff --git a/test/s3/lifecycle/s3_lifecycle_object_lock_test.go b/test/s3/lifecycle/s3_lifecycle_object_lock_test.go
index 7196346de9..e601f85500 100644
--- a/test/s3/lifecycle/s3_lifecycle_object_lock_test.go
+++ b/test/s3/lifecycle/s3_lifecycle_object_lock_test.go
@@ -116,4 +116,3 @@ func TestLifecycleSkipsObjectLockedObjects(t *testing.T) {
 	})
 	require.NoError(t, err, "object under GOVERNANCE retention must survive the sweep")
 }
-
diff --git a/test/s3/lifecycle/s3_lifecycle_test.go b/test/s3/lifecycle/s3_lifecycle_test.go
index dd8bf117a1..a275f29863 100644
--- a/test/s3/lifecycle/s3_lifecycle_test.go
+++ b/test/s3/lifecycle/s3_lifecycle_test.go
@@ -41,7 +41,7 @@ const (
 	defaultS3Endpoint     = "http://localhost:8333"
 	defaultS3GrpcEndpoint = "localhost:18333"
 	defaultMasterEndpt    = "http://localhost:9333"
-	defaultAdminEndpoint  = "http://localhost:23646"
+	defaultAdminEndpoint  = "http://localhost:12535"
 	// Pinned off the FILER_PORT+10000 convention; see Makefile.
 	defaultFilerGRPC      = "localhost:18890"
 	bucketLifecycleXMLKey = "s3-bucket-lifecycle-configuration-xml"
diff --git a/test/s3/lifecycle/s3_lifecycle_versioning_test.go b/test/s3/lifecycle/s3_lifecycle_versioning_test.go
index c21a37e04b..a25fabcdc3 100644
--- a/test/s3/lifecycle/s3_lifecycle_versioning_test.go
+++ b/test/s3/lifecycle/s3_lifecycle_versioning_test.go
@@ -164,6 +164,55 @@ func TestLifecycleVersionedBucketCreatesDeleteMarker(t *testing.T) {
 	require.True(t, sawMarker, "ListObjectVersions must show a delete marker as latest for %s", key)
 }
 
+// TestLifecycleVersionedBucketExpiresOnSecondRun covers the reported
+// regression where Expiration.Days only fired on the cold-start walk: a
+// versioned PUT surfaces in the meta-log as a version-file event, which
+// the router used to drop, so once every shard had a saved cursor no
+// daily run ever scheduled another delete marker. The first run here
+// establishes the cursor; the second must expire an object that arrived
+// in between, with no rule change to force a recovery walk.
+func TestLifecycleVersionedBucketExpiresOnSecondRun(t *testing.T) {
+	c := s3Client(t)
+	fc, fcClose := filerClient(t)
+	defer fcClose()
+
+	bucket := uniqueBucket("vexp2")
+	mustCreateBucket(t, c, bucket)
+	putVersioningEnabled(t, c, bucket)
+	putExpirationLifecycle(t, c, bucket, "expire/", 1)
+
+	// First pass: any object will do — what matters is the cursor saved
+	// afterward, which switches later passes from the recovery walk to
+	// meta-log replay.
+	putObject(t, c, bucket, "expire/first.txt", "v1")
+	runLifecycleShard(t)
+
+	const key = "expire/daily.txt"
+	putObject(t, c, bucket, key, "v1")
+	headOut, err := c.HeadObject(context.Background(), &s3.HeadObjectInput{
+		Bucket: aws.String(bucket), Key: aws.String(key),
+	})
+	require.NoError(t, err)
+	versionID := aws.ToString(headOut.VersionId)
+	require.NotEmpty(t, versionID)
+	backdateVersionedMtime(t, fc, bucket, key, versionID, 30)
+
+	runLifecycleShard(t)
+
+	require.Eventuallyf(t, func() bool {
+		_, err := c.HeadObject(context.Background(), &s3.HeadObjectInput{
+			Bucket: aws.String(bucket), Key: aws.String(key),
+		})
+		return isS3NotFound(err)
+	}, 30*time.Second, 500*time.Millisecond, "second run must create a delete marker for %s/%s", bucket, key)
+
+	directHead, err := c.HeadObject(context.Background(), &s3.HeadObjectInput{
+		Bucket: aws.String(bucket), Key: aws.String(key), VersionId: aws.String(versionID),
+	})
+	require.NoError(t, err, "original version must still exist")
+	require.NotNil(t, directHead)
+}
+
 // TestLifecycleNoncurrentVersionExpiration: NoncurrentVersionExpiration
 // only fires on noncurrent versions. PUT v1, PUT v2 (so v1 → noncurrent),
 // backdate v1, run worker. v1 must be removed; v2 stays current.
diff --git a/test/s3/normal/s3_integration_test.go b/test/s3/normal/s3_integration_test.go
index b64ba4db79..e37972c4bb 100644
--- a/test/s3/normal/s3_integration_test.go
+++ b/test/s3/normal/s3_integration_test.go
@@ -114,10 +114,11 @@ func TestS3Integration(t *testing.T) {
 // findAvailablePort finds an available port by binding to port 0
 
 // startMiniCluster starts a weed mini instance directly without exec.
-// Extra flags (e.g. "-s3.allowDeleteBucketNotEmpty=false") can be appended via extraArgs.
+// Extra flags can be appended via extraArgs.
 func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {
 	// Allocate non-colliding ports (including gRPC offsets) for weed mini.
-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Volume", "Filer", "S3"})
+	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Volume", "Filer", "S3", "Admin"})
+	adminPort := ports[4]
 	masterPort := ports[0]
 	volumePort := ports[1]
 	filerPort := ports[2]
@@ -186,13 +187,15 @@ func startMiniCluster(t *testing.T, extraArgs ...string) (*TestCluster, error) {
 			"-volume.port=" + strconv.Itoa(volumePort),
 			"-filer.port=" + strconv.Itoa(filerPort),
 			"-s3.port=" + strconv.Itoa(s3Port),
-			"-webdav.port=0",               // Disable WebDAV
+			"-webdav=false", // Disable WebDAV
 			"-admin.ui=false",              // Disable admin UI
 			"-master.volumeSizeLimitMB=32", // Small volumes for testing
 			"-ip=127.0.0.1",
 			"-master.peers=none",     // Faster startup
 			"-s3.iam.readOnly=false", // Enable IAM write operations for tests
 		}, extraArgs...)
+		os.Args = append(os.Args, testutil.MiniAdminArgs(adminPort)...)
+		os.Args = append(os.Args, "-s3.port.lance=0", "-s3.port.iceberg=0")
 
 		// Suppress most logging during tests
 		glog.MaxSize = 1024 * 1024
@@ -872,7 +875,7 @@ func TestS3DeleteBucketNotEmpty(t *testing.T) {
 		t.Skip("Skipping integration test in short mode")
 	}
 
-	cluster, err := startMiniCluster(t, "-s3.allowDeleteBucketNotEmpty=false")
+	cluster, err := startMiniCluster(t)
 	require.NoError(t, err)
 	defer cluster.Stop()
 
diff --git a/test/s3/normal/s3_list_multipart_uploads_test.go b/test/s3/normal/s3_list_multipart_uploads_test.go
new file mode 100644
index 0000000000..fe1ca7edc5
--- /dev/null
+++ b/test/s3/normal/s3_list_multipart_uploads_test.go
@@ -0,0 +1,66 @@
+package example
+
+import (
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestListMultipartUploadsInitiated verifies that ListMultipartUploads
+// returns the Initiated timestamp for each in-progress upload, and that
+// the timestamp is preserved across repeated listings rather than
+// reflecting the time of the listing.
+func TestListMultipartUploadsInitiated(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	cluster, err := startMiniCluster(t)
+	require.NoError(t, err)
+	defer cluster.Stop()
+
+	bucket := createTestBucket(t, cluster, "test-list-mpu-initiated-")
+
+	beforeInit := time.Now().UTC()
+	createOut, err := cluster.s3Client.CreateMultipartUpload(&s3.CreateMultipartUploadInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String("unfinished.bin"),
+	})
+	require.NoError(t, err)
+	afterInit := time.Now().UTC()
+
+	listOut, err := cluster.s3Client.ListMultipartUploads(&s3.ListMultipartUploadsInput{
+		Bucket: aws.String(bucket),
+	})
+	require.NoError(t, err)
+	require.Len(t, listOut.Uploads, 1)
+
+	upload := listOut.Uploads[0]
+	assert.Equal(t, "unfinished.bin", aws.StringValue(upload.Key))
+	assert.Equal(t, aws.StringValue(createOut.UploadId), aws.StringValue(upload.UploadId))
+	require.NotNil(t, upload.Initiated, "Initiated timestamp must be populated")
+
+	initiated := upload.Initiated.UTC()
+	assert.False(t, initiated.Before(beforeInit.Add(-time.Second)), "Initiated %v is before upload creation %v", initiated, beforeInit)
+	assert.False(t, initiated.After(afterInit.Add(time.Second)), "Initiated %v is after upload creation %v", initiated, afterInit)
+
+	time.Sleep(2 * time.Second)
+	listOut2, err := cluster.s3Client.ListMultipartUploads(&s3.ListMultipartUploadsInput{
+		Bucket: aws.String(bucket),
+	})
+	require.NoError(t, err)
+	require.Len(t, listOut2.Uploads, 1)
+	require.NotNil(t, listOut2.Uploads[0].Initiated, "Initiated timestamp must be populated on repeated listing")
+	assert.True(t, listOut2.Uploads[0].Initiated.Equal(*upload.Initiated), "Initiated must be preserved across listings, got %v then %v", *upload.Initiated, *listOut2.Uploads[0].Initiated)
+
+	_, err = cluster.s3Client.AbortMultipartUpload(&s3.AbortMultipartUploadInput{
+		Bucket:   aws.String(bucket),
+		Key:      aws.String("unfinished.bin"),
+		UploadId: createOut.UploadId,
+	})
+	require.NoError(t, err)
+}
diff --git a/test/s3/normal/s3_prefix_object_test.go b/test/s3/normal/s3_prefix_object_test.go
new file mode 100644
index 0000000000..89fe154f00
--- /dev/null
+++ b/test/s3/normal/s3_prefix_object_test.go
@@ -0,0 +1,546 @@
+package example
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	v1credentials "github.com/aws/aws-sdk-go/aws/credentials"
+	v1signer "github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestS3PrefixObjectKeys covers keys that are a strict prefix of other keys: S3's
+// namespace is flat, so "collision/foo" and "collision/foo/bar" are independent
+// objects that coexist in either write order.
+func TestS3PrefixObjectKeys(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	cluster, err := startMiniCluster(t)
+	require.NoError(t, err)
+	defer cluster.Stop()
+
+	put := func(t *testing.T, bucket, key string, body []byte) {
+		t.Helper()
+		_, err := cluster.s3Client.PutObject(&s3.PutObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String(key),
+			Body:   bytes.NewReader(body),
+		})
+		require.NoError(t, err, "put %s", key)
+	}
+	// read checks both paths a client reaches an object by, since a directory entry
+	// carrying an object is served by neither the directory nor the plain object path
+	// alone.
+	read := func(t *testing.T, bucket, key string, want []byte) {
+		t.Helper()
+		head, err := cluster.s3Client.HeadObject(&s3.HeadObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String(key),
+		})
+		require.NoError(t, err, "head %s", key)
+		assert.Equal(t, int64(len(want)), aws.Int64Value(head.ContentLength), "head %s", key)
+
+		get, err := cluster.s3Client.GetObject(&s3.GetObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String(key),
+		})
+		require.NoError(t, err, "get %s", key)
+		defer get.Body.Close()
+		got, err := io.ReadAll(get.Body)
+		require.NoError(t, err, "read %s", key)
+		assert.Equal(t, want, got, "get %s", key)
+	}
+	// gone checks the key answers as absent rather than lingering on a directory
+	// entry that outlived the object.
+	gone := func(t *testing.T, bucket, key string) {
+		t.Helper()
+		_, err := cluster.s3Client.GetObject(&s3.GetObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String(key),
+		})
+		var missing awserr.RequestFailure
+		require.ErrorAs(t, err, &missing, "get %s", key)
+		assert.Equal(t, http.StatusNotFound, missing.StatusCode(), "get %s", key)
+
+		_, err = cluster.s3Client.HeadObject(&s3.HeadObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String(key),
+		})
+		require.ErrorAs(t, err, &missing, "head %s", key)
+		assert.Equal(t, http.StatusNotFound, missing.StatusCode(), "head %s", key)
+	}
+	listKeys := func(t *testing.T, bucket string) []string {
+		t.Helper()
+		resp, err := cluster.s3Client.ListObjectsV2(&s3.ListObjectsV2Input{Bucket: aws.String(bucket)})
+		require.NoError(t, err)
+		keys := collectKeys(resp.Contents)
+		sort.Strings(keys)
+		return keys
+	}
+
+	body := []byte("prefix object")
+	// Distinct bodies, so a read that resolves to the wrong entry cannot pass.
+	nested := []byte("nested under the prefix object")
+
+	// The reported order: the nested key is written first, so the prefix key has to
+	// land on a path the filer already holds a directory at.
+	t.Run("ChildFirst", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-child-first-")
+		put(t, bucket, "collision/foo/bar", nested)
+		put(t, bucket, "collision/foo", body)
+
+		assert.Equal(t, []string{"collision/foo", "collision/foo/bar"}, listKeys(t, bucket))
+		read(t, bucket, "collision/foo", body)
+		read(t, bucket, "collision/foo/bar", nested)
+	})
+
+	// The opposite order used to keep the prefix key's data but hide the key.
+	t.Run("PrefixFirst", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-first-")
+		put(t, bucket, "collision/foo", body)
+		put(t, bucket, "collision/foo/bar", nested)
+
+		assert.Equal(t, []string{"collision/foo", "collision/foo/bar"}, listKeys(t, bucket))
+		read(t, bucket, "collision/foo", body)
+		read(t, bucket, "collision/foo/bar", nested)
+	})
+
+	// An empty object leaves no chunks, content or mime behind, so it is the case a
+	// promoted directory carries no other trace of.
+	t.Run("EmptyObject", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-empty-")
+		put(t, bucket, "a/foo/bar", nil)
+		put(t, bucket, "a/foo", nil)
+		put(t, bucket, "b/foo", nil)
+		put(t, bucket, "b/foo/bar", nil)
+
+		assert.Equal(t, []string{"a/foo", "a/foo/bar", "b/foo", "b/foo/bar"}, listKeys(t, bucket))
+		read(t, bucket, "a/foo", []byte{})
+		read(t, bucket, "b/foo", []byte{})
+	})
+
+	// The key has no trailing slash, and the keys nested under it still roll up into
+	// their own CommonPrefix.
+	t.Run("Delimiter", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-delimiter-")
+		put(t, bucket, "collision/foo/bar", nested)
+		put(t, bucket, "collision/foo", body)
+		put(t, bucket, "collision/other", body)
+
+		resp, err := cluster.s3Client.ListObjectsV2(&s3.ListObjectsV2Input{
+			Bucket:    aws.String(bucket),
+			Prefix:    aws.String("collision/"),
+			Delimiter: aws.String("/"),
+		})
+		require.NoError(t, err)
+
+		keys := collectKeys(resp.Contents)
+		sort.Strings(keys)
+		assert.Equal(t, []string{"collision/foo", "collision/other"}, keys)
+		assert.Equal(t, []string{"collision/foo/"}, collectPrefixes(resp.CommonPrefixes))
+
+		// Listing the prefix itself names only what is under it.
+		resp, err = cluster.s3Client.ListObjectsV2(&s3.ListObjectsV2Input{
+			Bucket:    aws.String(bucket),
+			Prefix:    aws.String("collision/foo/"),
+			Delimiter: aws.String("/"),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, []string{"collision/foo/bar"}, collectKeys(resp.Contents))
+		assert.Empty(t, collectPrefixes(resp.CommonPrefixes))
+	})
+
+	// The key and the CommonPrefix its nested keys fold into come off one filer
+	// entry, so a page boundary must not drop either of them.
+	t.Run("Paged", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-paged-")
+		for _, key := range []string{"foo", "foo/bar", "foobar", "other", "zed", "zed/a"} {
+			put(t, bucket, key, body)
+		}
+
+		for _, maxKeys := range []int64{1, 2, 3, 4, 5} {
+			var keys, prefixes []string
+			var token *string
+			for page := 0; page < 12; page++ {
+				resp, err := cluster.s3Client.ListObjectsV2(&s3.ListObjectsV2Input{
+					Bucket:            aws.String(bucket),
+					Delimiter:         aws.String("/"),
+					MaxKeys:           aws.Int64(maxKeys),
+					ContinuationToken: token,
+				})
+				require.NoError(t, err)
+				// One entry over the budget is the documented same-entry exception;
+				// anything more means the unsigned budget wrapped.
+				assert.LessOrEqual(t, int64(len(resp.Contents)+len(resp.CommonPrefixes)), maxKeys+1,
+					"maxKeys=%d page %d", maxKeys, page)
+				keys = append(keys, collectKeys(resp.Contents)...)
+				prefixes = append(prefixes, collectPrefixes(resp.CommonPrefixes)...)
+				if !aws.BoolValue(resp.IsTruncated) {
+					token = nil
+					break
+				}
+				token = resp.NextContinuationToken
+				require.NotNil(t, token, "a truncated page must name where to resume")
+			}
+			require.Nil(t, token, "maxKeys=%d did not finish", maxKeys)
+			assert.Equal(t, []string{"foo", "foobar", "other", "zed"}, keys, "maxKeys=%d", maxKeys)
+			assert.Equal(t, []string{"foo/", "zed/"}, prefixes, "maxKeys=%d", maxKeys)
+		}
+	})
+
+	// Versioning reaches a prefix object from two directions: a suspended bucket
+	// writes the null version at the key's own path, and a bucket versioned later
+	// finds one already sitting there. Both leave a key that is a directory with
+	// version history beside it.
+	t.Run("Versioned", func(t *testing.T) {
+		setVersioning := func(t *testing.T, bucket, status string) {
+			t.Helper()
+			_, err := cluster.s3Client.PutBucketVersioning(&s3.PutBucketVersioningInput{
+				Bucket:                  aws.String(bucket),
+				VersioningConfiguration: &s3.VersioningConfiguration{Status: aws.String(status)},
+			})
+			require.NoError(t, err)
+		}
+
+		// Both write orders, in a bucket that is versioned and in one where versioning
+		// was suspended - the suspended one is the case that writes at the key's path.
+		for _, state := range []string{"Enabled", "Suspended"} {
+			bucket := createTestBucket(t, cluster, "test-prefix-"+strings.ToLower(state)+"-")
+			setVersioning(t, bucket, "Enabled")
+			if state == "Suspended" {
+				setVersioning(t, bucket, "Suspended")
+			}
+			put(t, bucket, "child/foo/bar", nested)
+			put(t, bucket, "child/foo", body)
+			put(t, bucket, "prefix/foo", body)
+			put(t, bucket, "prefix/foo/bar", nested)
+
+			assert.Equal(t, []string{"child/foo", "child/foo/bar", "prefix/foo", "prefix/foo/bar"},
+				listKeys(t, bucket), state)
+			for _, key := range []string{"child/foo", "prefix/foo"} {
+				read(t, bucket, key, body)
+			}
+			for _, key := range []string{"child/foo/bar", "prefix/foo/bar"} {
+				read(t, bucket, key, nested)
+			}
+		}
+
+		// A prefix object written before versioning is the key's null version. Removing
+		// that version by id must not take the keys nested under it with it.
+		bucket := createTestBucket(t, cluster, "test-prefix-nullversion-")
+		put(t, bucket, "collision/foo/bar", nested)
+		put(t, bucket, "collision/foo", body)
+		setVersioning(t, bucket, "Enabled")
+		newer := []byte("written after versioning was enabled")
+		versioned, err := cluster.s3Client.PutObject(&s3.PutObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String("collision/foo"),
+			Body:   bytes.NewReader(newer),
+		})
+		require.NoError(t, err)
+
+		for _, v := range []struct {
+			id   string
+			want []byte
+		}{{"null", body}, {aws.StringValue(versioned.VersionId), newer}} {
+			got, err := cluster.s3Client.GetObject(&s3.GetObjectInput{
+				Bucket:    aws.String(bucket),
+				Key:       aws.String("collision/foo"),
+				VersionId: aws.String(v.id),
+			})
+			require.NoError(t, err, "get version %s", v.id)
+			body, err := io.ReadAll(got.Body)
+			require.NoError(t, err)
+			got.Body.Close()
+			assert.Equal(t, v.want, body, "get version %s", v.id)
+		}
+
+		_, err = cluster.s3Client.DeleteObject(&s3.DeleteObjectInput{
+			Bucket:    aws.String(bucket),
+			Key:       aws.String("collision/foo"),
+			VersionId: aws.String("null"),
+		})
+		require.NoError(t, err, "the null version sits on a directory other keys live in")
+
+		read(t, bucket, "collision/foo", newer)
+		read(t, bucket, "collision/foo/bar", nested)
+		remaining, err := cluster.s3Client.ListObjectVersions(&s3.ListObjectVersionsInput{
+			Bucket: aws.String(bucket),
+			Prefix: aws.String("collision/foo"),
+		})
+		require.NoError(t, err)
+		for _, v := range remaining.Versions {
+			if aws.StringValue(v.Key) != "collision/foo" {
+				// collision/foo/bar predates versioning too, and keeps its null version.
+				continue
+			}
+			assert.NotEqual(t, "null", aws.StringValue(v.VersionId), "the null version was deleted")
+		}
+	})
+
+	// The two listings walk the tree differently, and a prefix object is the entry
+	// they disagree about: it is a directory the version listing descends through and
+	// a key at the same time. They have to name the same keys and the same prefixes.
+	t.Run("VersionListingMatchesObjectListing", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-parity-")
+		for _, key := range []string{"foo", "foo/bar", "other", "a/foo", "a/foo/bar", "a/z"} {
+			put(t, bucket, key, body)
+		}
+
+		for _, q := range []struct{ prefix, delimiter string }{
+			{"", ""},
+			{"foo/", ""},
+			{"a/", ""},
+			{"a/foo/", ""},
+			{"", "/"},
+			{"a/", "/"},
+		} {
+			name := "prefix=" + q.prefix + " delimiter=" + q.delimiter
+
+			objects, err := cluster.s3Client.ListObjectsV2(&s3.ListObjectsV2Input{
+				Bucket:    aws.String(bucket),
+				Prefix:    aws.String(q.prefix),
+				Delimiter: aws.String(q.delimiter),
+			})
+			require.NoError(t, err, name)
+
+			versions, err := cluster.s3Client.ListObjectVersions(&s3.ListObjectVersionsInput{
+				Bucket:    aws.String(bucket),
+				Prefix:    aws.String(q.prefix),
+				Delimiter: aws.String(q.delimiter),
+			})
+			require.NoError(t, err, name)
+
+			versionKeys := make([]string, 0, len(versions.Versions))
+			for _, v := range versions.Versions {
+				versionKeys = append(versionKeys, aws.StringValue(v.Key))
+			}
+			versionPrefixes := make([]string, 0, len(versions.CommonPrefixes))
+			for _, p := range versions.CommonPrefixes {
+				versionPrefixes = append(versionPrefixes, aws.StringValue(p.Prefix))
+			}
+			sort.Strings(versionKeys)
+			sort.Strings(versionPrefixes)
+
+			objectKeys := collectKeys(objects.Contents)
+			objectPrefixes := collectPrefixes(objects.CommonPrefixes)
+			sort.Strings(objectKeys)
+			sort.Strings(objectPrefixes)
+
+			assert.Equal(t, objectKeys, versionKeys, "keys, %s", name)
+			assert.Equal(t, objectPrefixes, versionPrefixes, "prefixes, %s", name)
+		}
+	})
+
+	// A prefix object written before versioning is the key's null version, so the
+	// version written after it has to take the latest flag off it.
+	t.Run("VersionedAfterPrefixObject", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-versioned-")
+		put(t, bucket, "collision/foo/bar", nested)
+		put(t, bucket, "collision/foo", body)
+		_, err := cluster.s3Client.PutBucketVersioning(&s3.PutBucketVersioningInput{
+			Bucket:                  aws.String(bucket),
+			VersioningConfiguration: &s3.VersioningConfiguration{Status: aws.String("Enabled")},
+		})
+		require.NoError(t, err)
+		newer := []byte("written after versioning was enabled")
+		put(t, bucket, "collision/foo", newer)
+
+		resp, err := cluster.s3Client.ListObjectVersions(&s3.ListObjectVersionsInput{Bucket: aws.String(bucket)})
+		require.NoError(t, err)
+
+		latest := map[string]int{}
+		var nullSize int64 = -1
+		for _, v := range resp.Versions {
+			if aws.BoolValue(v.IsLatest) {
+				latest[aws.StringValue(v.Key)]++
+			}
+			if aws.StringValue(v.Key) == "collision/foo" && aws.StringValue(v.VersionId) == "null" {
+				nullSize = aws.Int64Value(v.Size)
+				assert.False(t, aws.BoolValue(v.IsLatest), "the newer version is the latest one")
+			}
+		}
+		assert.Equal(t, 1, latest["collision/foo"], "exactly one version of a key is the latest")
+		assert.Equal(t, int64(len(body)), nullSize, "the null version keeps the prefix object's size")
+		read(t, bucket, "collision/foo", newer)
+		read(t, bucket, "collision/foo/bar", nested)
+	})
+
+	// A key that other keys are nested under is a copy source and a copy destination
+	// like any other. The keys nested under either end are not part of the copy.
+	t.Run("Copy", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-copy-")
+		copyObject := func(t *testing.T, src, dst string) {
+			t.Helper()
+			_, err := cluster.s3Client.CopyObject(&s3.CopyObjectInput{
+				Bucket:     aws.String(bucket),
+				Key:        aws.String(dst),
+				CopySource: aws.String(bucket + "/" + src),
+			})
+			require.NoError(t, err, "copy %s to %s", src, dst)
+		}
+
+		put(t, bucket, "collision/foo", body)
+		put(t, bucket, "collision/foo/bar", nested)
+
+		// Out of a prefix object, into a key of its own.
+		copyObject(t, "collision/foo", "plain")
+		read(t, bucket, "plain", body)
+		read(t, bucket, "collision/foo", body)
+		read(t, bucket, "collision/foo/bar", nested)
+
+		// Into a key that other keys are nested under.
+		put(t, bucket, "target/child", nested)
+		copyObject(t, "plain", "target")
+		read(t, bucket, "target", body)
+		read(t, bucket, "target/child", nested)
+
+		// And between two of them.
+		put(t, bucket, "other", []byte("copied between prefix keys"))
+		copyObject(t, "other", "collision/foo")
+		read(t, bucket, "collision/foo", []byte("copied between prefix keys"))
+		read(t, bucket, "collision/foo/bar", nested)
+
+		assert.Equal(t, []string{"collision/foo", "collision/foo/bar", "other", "plain", "target", "target/child"},
+			listKeys(t, bucket))
+	})
+
+	// Rename moves the object off the key without moving the keys nested under it,
+	// which is not what the filer's atomic rename of a directory would do.
+	t.Run("Rename", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-rename-")
+		renameObject := func(t *testing.T, src, dst string) {
+			t.Helper()
+			req, _ := http.NewRequest(http.MethodPut, cluster.s3Endpoint+"/"+bucket+"/"+dst+"?renameObject=", nil)
+			req.Header.Set("x-amz-rename-source", "/"+bucket+"/"+src)
+			signer := v1signer.NewSigner(v1credentials.NewStaticCredentials(testAccessKey, testSecretKey, ""))
+			_, err := signer.Sign(req, nil, "s3", testRegion, time.Now())
+			require.NoError(t, err)
+
+			resp, err := (&http.Client{Timeout: 20 * time.Second}).Do(req)
+			require.NoError(t, err, "rename %s to %s", src, dst)
+			defer resp.Body.Close()
+			io.Copy(io.Discard, resp.Body)
+			require.Equal(t, http.StatusOK, resp.StatusCode, "rename %s to %s", src, dst)
+		}
+
+		put(t, bucket, "collision/foo", body)
+		put(t, bucket, "collision/foo/bar", nested)
+
+		// Off a prefix object: the key goes, the keys under it stay.
+		renameObject(t, "collision/foo", "moved")
+		read(t, bucket, "moved", body)
+		read(t, bucket, "collision/foo/bar", nested)
+		gone(t, bucket, "collision/foo")
+
+		// Onto a key other keys are nested under.
+		put(t, bucket, "target/child", nested)
+		renameObject(t, "moved", "target")
+		read(t, bucket, "target", body)
+		read(t, bucket, "target/child", nested)
+		gone(t, bucket, "moved")
+
+		assert.Equal(t, []string{"collision/foo/bar", "target", "target/child"}, listKeys(t, bucket))
+	})
+
+	// A directory SeaweedFS keeps its own state in is not a prefix a key can be
+	// stored on: the object would replace that state with its own.
+	t.Run("ReservedDirectory", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-reserved-")
+		_, err := cluster.s3Client.PutBucketVersioning(&s3.PutBucketVersioningInput{
+			Bucket:                  aws.String(bucket),
+			VersioningConfiguration: &s3.VersioningConfiguration{Status: aws.String("Enabled")},
+		})
+		require.NoError(t, err)
+		put(t, bucket, "foo", body)
+		_, err = cluster.s3Client.PutBucketVersioning(&s3.PutBucketVersioningInput{
+			Bucket:                  aws.String(bucket),
+			VersioningConfiguration: &s3.VersioningConfiguration{Status: aws.String("Suspended")},
+		})
+		require.NoError(t, err)
+
+		_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String("foo.versions"),
+			Body:   bytes.NewReader(body),
+		})
+		// Not just any error: a permanently impossible write must not come back as a
+		// 500 the SDK retries.
+		var refused awserr.RequestFailure
+		require.ErrorAs(t, err, &refused, "the version history of foo is not a prefix of foo.versions")
+		assert.Equal(t, http.StatusConflict, refused.StatusCode())
+		assert.Equal(t, "ExistingObjectIsDirectory", refused.Code())
+
+		versions, err := cluster.s3Client.ListObjectVersions(&s3.ListObjectVersionsInput{Bucket: aws.String(bucket)})
+		require.NoError(t, err)
+		require.Len(t, versions.Versions, 1)
+		assert.Equal(t, "foo", aws.StringValue(versions.Versions[0].Key))
+		read(t, bucket, "foo", body)
+
+		// The multipart staging folder is the other one, and an in-flight upload has
+		// to survive the attempt.
+		staging := createTestBucket(t, cluster, "test-prefix-uploads-")
+		created, err := cluster.s3Client.CreateMultipartUpload(&s3.CreateMultipartUploadInput{
+			Bucket: aws.String(staging),
+			Key:    aws.String("mp.bin"),
+		})
+		require.NoError(t, err)
+
+		_, err = cluster.s3Client.PutObject(&s3.PutObjectInput{
+			Bucket: aws.String(staging),
+			Key:    aws.String(".uploads"),
+			Body:   bytes.NewReader(body),
+		})
+		require.ErrorAs(t, err, &refused, "the multipart staging folder is not a prefix of .uploads")
+		assert.Equal(t, http.StatusConflict, refused.StatusCode())
+		assert.Equal(t, "ExistingObjectIsDirectory", refused.Code())
+
+		uploads, err := cluster.s3Client.ListMultipartUploads(&s3.ListMultipartUploadsInput{Bucket: aws.String(staging)})
+		require.NoError(t, err)
+		require.Len(t, uploads.Uploads, 1)
+		assert.Equal(t, "mp.bin", aws.StringValue(uploads.Uploads[0].Key))
+		_, err = cluster.s3Client.AbortMultipartUpload(&s3.AbortMultipartUploadInput{
+			Bucket:   aws.String(staging),
+			Key:      aws.String("mp.bin"),
+			UploadId: created.UploadId,
+		})
+		require.NoError(t, err)
+	})
+
+	// Either key can be deleted without touching the other.
+	t.Run("Delete", func(t *testing.T) {
+		bucket := createTestBucket(t, cluster, "test-prefix-delete-")
+		put(t, bucket, "collision/foo/bar", nested)
+		put(t, bucket, "collision/foo", body)
+
+		_, err := cluster.s3Client.DeleteObject(&s3.DeleteObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String("collision/foo"),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, []string{"collision/foo/bar"}, listKeys(t, bucket))
+		read(t, bucket, "collision/foo/bar", nested)
+		gone(t, bucket, "collision/foo")
+
+		put(t, bucket, "collision/foo", body)
+		_, err = cluster.s3Client.DeleteObject(&s3.DeleteObjectInput{
+			Bucket: aws.String(bucket),
+			Key:    aws.String("collision/foo/bar"),
+		})
+		require.NoError(t, err)
+		assert.Equal(t, []string{"collision/foo"}, listKeys(t, bucket))
+		read(t, bucket, "collision/foo", body)
+		gone(t, bucket, "collision/foo/bar")
+	})
+}
diff --git a/test/s3/policy/policy_test.go b/test/s3/policy/policy_test.go
index 488f528841..302ddbceb5 100644
--- a/test/s3/policy/policy_test.go
+++ b/test/s3/policy/policy_test.go
@@ -705,17 +705,17 @@ func uniqueName(prefix string) string {
 
 func startMiniCluster(t *testing.T) (*TestCluster, error) {
 	// Allocate two extra ports for admin HTTP + gRPC. Without explicit
-	// values mini falls back to 23646/33646, which collide across the
+	// values mini falls back to 12535/22535, which collide across the
 	// sequential subtests in this package: each subtest spins up a fresh
 	// mini in a goroutine, but the previous mini's admin goroutine is
-	// still binding 23646 — so the next test's admin can never become
+	// still binding 12535 — so the next test's admin can never become
 	// ready and mini.go fatals on its readiness check.
-	ports := testutil.MustAllocatePorts(t, 10)
+	ports := testutil.MustAllocatePorts(t, 8)
+	adminPort := testutil.MustFreeMiniPort(t, "admin")
 	masterPort, masterGrpcPort := ports[0], ports[1]
 	volumePort, volumeGrpcPort := ports[2], ports[3]
 	filerPort, filerGrpcPort := ports[4], ports[5]
 	s3Port, s3GrpcPort := ports[6], ports[7]
-	adminPort, adminGrpcPort := ports[8], ports[9]
 
 	// Manually-managed temp dir (not t.TempDir()) so we control removal order:
 	// the dir is removed inside Stop() AFTER the mini goroutine has fully
@@ -786,15 +786,16 @@ enabled = true
 			"-filer.port.grpc=" + strconv.Itoa(filerGrpcPort),
 			"-s3.port=" + strconv.Itoa(s3Port),
 			"-s3.port.grpc=" + strconv.Itoa(s3GrpcPort),
-			"-admin.port=" + strconv.Itoa(adminPort),
-			"-admin.port.grpc=" + strconv.Itoa(adminGrpcPort),
-			"-webdav.port=0",
+			"-webdav=false",
+			"-s3.port.lance=0",
+			"-s3.port.iceberg=0",
 			"-admin.ui=false",
 			"-master.volumeSizeLimitMB=32",
 			"-ip=127.0.0.1",
 			"-master.peers=none",
 			"-s3.iam.readOnly=false",
 		}
+		os.Args = append(os.Args, testutil.MiniAdminArgs(adminPort)...)
 		glog.MaxSize = 1024 * 1024
 		for _, cmd := range command.Commands {
 			if cmd.Name() == "mini" && cmd.Run != nil {
diff --git a/test/s3/proxy_signature/README.md b/test/s3/proxy_signature/README.md
index 7a8f5dd817..558dcc6d38 100644
--- a/test/s3/proxy_signature/README.md
+++ b/test/s3/proxy_signature/README.md
@@ -26,16 +26,16 @@ nginx (:9000)
     v
 SeaweedFS S3 (:8333, -s3.externalUrl=http://localhost:9000)
     |  externalHost = "localhost:9000" (parsed at startup)
-    |  extractHostHeader() returns "localhost:9000"
+    |  extractHostHeaderCandidates() tries "localhost:9000" first
     |  Matches what AWS CLI signed with
     v
 Signature verification succeeds
 ```
 
-**Note:** When `-s3.externalUrl` is configured, direct access to the backend
-port (8333) will fail signature verification because the client signs with a
-different Host header than what `externalUrl` specifies. This is expected —
-all S3 traffic should go through the proxy.
+**Note:** `-s3.externalUrl` is tried first, not exclusively. A client that
+dials the backend port (8333) directly still verifies against the host it
+actually signed, so a mixed topology of proxied and in-cluster clients works
+with the flag set.
 
 ## Prerequisites
 
diff --git a/test/s3/remote_cache/Makefile b/test/s3/remote_cache/Makefile
index 762db65c58..bd6d693bde 100644
--- a/test/s3/remote_cache/Makefile
+++ b/test/s3/remote_cache/Makefile
@@ -128,6 +128,8 @@ start-primary: check-deps
 		-s3.allowDeleteBucketNotEmpty=true \
 		-s3.config=s3_config.json \
 		-volume.allowUntrustedRemoteEndpoints \
+		-filer.allowUntrustedRemoteEndpoints \
+		-s3.allowUntrustedRemoteEndpoints \
 		-dir=$(PRIMARY_DIR) \
 		-ip=127.0.0.1 \
 		-ip.bind=127.0.0.1 \
diff --git a/test/s3/remote_cache/README.md b/test/s3/remote_cache/README.md
index 516320a2c4..7a54032ab1 100644
--- a/test/s3/remote_cache/README.md
+++ b/test/s3/remote_cache/README.md
@@ -42,7 +42,7 @@ This tests the full remote caching workflow including singleflight deduplication
 
 | Test File | Commands Tested | Test Count | Description |
 |-----------|----------------|------------|-------------|
-| `remote_cache_test.go` | Basic caching | 5 tests | Original caching workflow and singleflight tests |
+| `remote_cache_test.go` | Basic caching | 6 tests | Original caching workflow and singleflight tests, plus a mount with `-cacheWait=0` reading straight from the remote |
 | `remote_cache_copy_test.go` | S3 CopyObject / UploadPartCopy from a remote-only source | 2 tests | Source object lives only in remote storage; CopyObject and UploadPartCopy must cache it locally before persisting the destination so the result is readable |
 | `command_remote_configure_test.go` | `remote.configure` | 6 tests | Configuration management |
 | `command_remote_mount_test.go` | `remote.mount`, `remote.unmount`, `remote.mount.buckets` | 10 tests | Mount operations |
@@ -51,7 +51,7 @@ This tests the full remote caching workflow including singleflight deduplication
 | `command_remote_meta_sync_test.go` | `remote.meta.sync` | 8 tests | Metadata synchronization |
 | `command_edge_cases_test.go` | All commands | 11 tests | Edge cases and stress tests |
 
-**Total: 67 test cases covering 8 weed shell commands and the S3 copy paths for remote-only sources**
+**Total: 68 test cases covering 8 weed shell commands and the S3 copy paths for remote-only sources**
 
 ### Commands Tested
 
@@ -223,6 +223,11 @@ Tests HTTP range requests work correctly after caching.
 ### TestRemoteCacheNotFound
 Tests proper error handling for non-existent objects.
 
+### TestRemoteCacheWaitZero
+Remounts with `remote.mount -cacheWait=0` and checks that a read of a remote-only
+object is served from the remote and leaves the object uncached, while the default
+size-based wait caches it.
+
 ## Troubleshooting
 
 ### View logs
diff --git a/test/s3/remote_cache/remote_cache_evict_test.go b/test/s3/remote_cache/remote_cache_evict_test.go
new file mode 100644
index 0000000000..8fab9c53b9
--- /dev/null
+++ b/test/s3/remote_cache/remote_cache_evict_test.go
@@ -0,0 +1,257 @@
+package remote_cache
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	evictRemoteS3      = "http://localhost:28334"
+	evictRemoteMaster  = "30334"
+	evictRemoteFiler   = "28889"
+	evictRemoteVolume  = "30341"
+	evictRemoteWebdav  = "27334"
+	evictRemoteMetrics = "30326"
+
+	evictPrimaryS3      = "http://localhost:28333"
+	evictPrimaryMaster  = "30333"
+	evictPrimaryFiler   = "28887"
+	evictPrimaryVolume  = "30340"
+	evictPrimaryWebdav  = "27333"
+	evictPrimaryMetrics = "30327"
+
+	evictBucket = "evictsrc"
+	evictMount  = "evictmnt"
+)
+
+var miniLogPaths []string
+
+func startMini(t *testing.T, dir string, args ...string) {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(dir, 0755))
+	logPath := filepath.Join(dir, "weed.log")
+	logFile, err := os.Create(logPath)
+	require.NoError(t, err)
+	miniLogPaths = append(miniLogPaths, logPath)
+	miniArgs := append([]string{"mini",
+		"-dir=" + dir,
+		"-s3.config=s3_config.json",
+		"-s3.allowDeleteBucketNotEmpty=true",
+		"-ip=127.0.0.1", "-ip.bind=127.0.0.1",
+	}, args...)
+	miniArgs = append(miniArgs, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-s3.port.lance=0", "-s3.port.iceberg=0")
+	cmd := exec.Command(weedBinary, miniArgs...)
+	cmd.Stdout = logFile
+	cmd.Stderr = logFile
+	require.NoError(t, cmd.Start())
+	t.Cleanup(func() {
+		cmd.Process.Kill()
+		cmd.Wait()
+		logFile.Close()
+	})
+}
+
+func waitForHTTP(t *testing.T, url string) {
+	t.Helper()
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		if resp, err := http.Get(url); err == nil {
+			resp.Body.Close()
+			return
+		}
+		time.Sleep(time.Second)
+	}
+	for _, p := range miniLogPaths {
+		if data, err := os.ReadFile(p); err == nil {
+			lines := strings.Split(string(data), "\n")
+			if len(lines) > 30 {
+				lines = lines[len(lines)-30:]
+			}
+			t.Logf("last lines of %s:\n%s", p, strings.Join(lines, "\n"))
+		}
+	}
+	t.Fatalf("timed out waiting for %s", url)
+}
+
+func shellOn(t *testing.T, masterPort, command string) string {
+	t.Helper()
+	cmd := exec.Command(weedBinary, "shell", "-master=localhost:"+masterPort)
+	cmd.Stdin = strings.NewReader(command + "\nexit\n")
+	out, err := cmd.CombinedOutput()
+	require.NoErrorf(t, err, "shell %q failed: %s", command, out)
+	return stripLogs(string(out))
+}
+
+// waitForFilerListed polls the master until it lists a filer. A fresh
+// single-filer mini registers its filer only after an ~10 s empty-membership
+// confirm, and weed shell finds the filer through that listing, so shell
+// commands sent before it fail.
+func waitForFilerListed(t *testing.T, masterPort string) {
+	t.Helper()
+	deadline := time.Now().Add(60 * time.Second)
+	for {
+		cmd := exec.Command(weedBinary, "shell", "-master=localhost:"+masterPort)
+		cmd.Stdin = strings.NewReader("cluster.ps\nexit\n")
+		out, err := cmd.CombinedOutput()
+		if err == nil && strings.Contains(string(out), "* filers ") && !strings.Contains(string(out), "* filers 0\n") {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("master on %s lists no filer after 60s: %v\n%s", masterPort, err, out)
+		}
+		time.Sleep(time.Second)
+	}
+}
+
+func chunkCountOn(t *testing.T, masterPort, path string) string {
+	meta := shellOn(t, masterPort, "fs.meta.cat "+path)
+	idx := strings.LastIndex(meta, "chunks ")
+	require.GreaterOrEqualf(t, idx, 0, "no chunk count in %s", meta)
+	return strings.Fields(meta[idx+len("chunks "):])[0]
+}
+
+func volumeStats(t *testing.T, volumePort string) (size, garbage uint64) {
+	t.Helper()
+	resp, err := http.Get("http://localhost:" + volumePort + "/status")
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	var status struct {
+		Volumes []struct {
+			Size             uint64 `json:"Size"`
+			DeletedByteCount uint64 `json:"DeletedByteCount"`
+		} `json:"Volumes"`
+	}
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&status))
+	for _, v := range status.Volumes {
+		size += v.Size
+		garbage += v.DeletedByteCount
+	}
+	return size, garbage
+}
+
+func readViaFiler(t *testing.T, filerPort, path string) []byte {
+	t.Helper()
+	resp, err := http.Get("http://localhost:" + filerPort + path)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode, "read %s", path)
+	data, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	return data
+}
+
+// TestRemoteCacheEvictUnderPressure fills a cache constrained to two small
+// volumes with remote-mounted objects until writes fail, then verifies the
+// filer evicts the oldest synced entry, vacuums the garbage, and a later read
+// caches again.
+func TestRemoteCacheEvictUnderPressure(t *testing.T) {
+	if testing.Short() {
+		t.Skip("spawns two weed mini clusters")
+	}
+	if _, err := os.Stat(weedBinary); err != nil {
+		t.Skipf("weed binary not found at %s; run make build-weed", weedBinary)
+	}
+	if isServerRunning(evictRemoteS3) || isServerRunning(evictPrimaryS3) {
+		t.Skip("eviction test ports are already in use")
+	}
+
+	tmp := t.TempDir()
+	startMini(t, filepath.Join(tmp, "remote"),
+		"-s3.port=28334", "-master.port="+evictRemoteMaster,
+		"-filer.port="+evictRemoteFiler, "-volume.port="+evictRemoteVolume,
+		"-webdav.port="+evictRemoteWebdav, "-metricsPort="+evictRemoteMetrics)
+	waitForHTTP(t, evictRemoteS3)
+	startMini(t, filepath.Join(tmp, "primary"),
+		"-s3.port=28333", "-master.port="+evictPrimaryMaster,
+		"-filer.port="+evictPrimaryFiler, "-volume.port="+evictPrimaryVolume,
+		"-webdav.port="+evictPrimaryWebdav, "-metricsPort="+evictPrimaryMetrics,
+		"-volume.allowUntrustedRemoteEndpoints", "-filer.allowUntrustedRemoteEndpoints",
+		"-s3.allowUntrustedRemoteEndpoints",
+		"-master.volumeSizeLimitMB=32", "-volume.max=2",
+		"-filer.remoteCacheEvictThreshold=0.99")
+	waitForHTTP(t, evictPrimaryS3)
+	waitForFilerListed(t, evictPrimaryMaster)
+
+	remote := createS3Client(evictRemoteS3)
+	_, err := remote.CreateBucket(&s3.CreateBucketInput{Bucket: aws.String(evictBucket)})
+	require.NoError(t, err)
+	for i := 0; i < 5; i++ {
+		data := make([]byte, 16*1024*1024)
+		for j := range data {
+			data[j] = byte(i + j%251)
+		}
+		_, err = remote.PutObject(&s3.PutObjectInput{
+			Bucket: aws.String(evictBucket),
+			Key:    aws.String(fmt.Sprintf("obj%d.bin", i)),
+			Body:   bytes.NewReader(data),
+		})
+		require.NoError(t, err)
+	}
+
+	shellOn(t, evictPrimaryMaster, fmt.Sprintf(
+		"remote.configure -name=evictremote -type=s3 -s3.access_key=%s -s3.secret_key=%s -s3.endpoint=%s -s3.region=us-east-1",
+		accessKey, secretKey, evictRemoteS3))
+	shellOn(t, evictPrimaryMaster, fmt.Sprintf(
+		"remote.mount -dir=/buckets/%s -remote=evictremote/%s -nonempty", evictMount, evictBucket))
+	shellOn(t, evictPrimaryMaster, fmt.Sprintf("remote.meta.sync -dir=/buckets/%s", evictMount))
+	time.Sleep(2 * time.Second)
+
+	mount := "/buckets/" + evictMount
+
+	// obj0 caches alone so it is the oldest evictable entry.
+	first := readViaFiler(t, evictPrimaryFiler, mount+"/obj0.bin")
+	require.Len(t, first, 16*1024*1024)
+	require.NotEqual(t, "0", chunkCountOn(t, evictPrimaryMaster, mount+"/obj0.bin"), "obj0 should be cached")
+
+	// 4 x 16MB against ~64MB of capacity: the fills overrun, hit the
+	// capacity error path, and trigger eviction + vacuum.
+	var wg sync.WaitGroup
+	for i := 1; i <= 4; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			data := readViaFiler(t, evictPrimaryFiler, fmt.Sprintf("%s/obj%d.bin", mount, i))
+			assert.Len(t, data, 16*1024*1024)
+		}(i)
+	}
+	wg.Wait()
+
+	// Eviction must have dropped obj0's local chunks and vacuumed the
+	// tombstoned bytes, leaving only live data within the two volumes.
+	require.True(t, waitForCondition(t, func() bool {
+		size, garbage := volumeStats(t, evictPrimaryVolume)
+		return garbage == 0 && size <= 72*1024*1024
+	}, 2*time.Minute, "volumes to be reclaimed by eviction+vacuum"),
+		"evicted chunks were not reclaimed")
+
+	assert.Equal(t, "0", chunkCountOn(t, evictPrimaryMaster, mount+"/obj0.bin"),
+		"oldest cached entry should be evicted back to remote-only")
+
+	// The cache self-heals: reading the evicted object re-caches it. Fills
+	// still running from the concurrent wave may evict it again, so retry
+	// the read until a commit sticks.
+	var again []byte
+	require.True(t, waitForCondition(t, func() bool {
+		again = readViaFiler(t, evictPrimaryFiler, mount+"/obj0.bin")
+		return chunkCountOn(t, evictPrimaryMaster, mount+"/obj0.bin") != "0"
+	}, 2*time.Minute, "obj0 to re-cache"),
+		"evicted object did not re-cache on read")
+	assert.Equal(t, first, again)
+}
diff --git a/test/s3/remote_cache/remote_cache_test.go b/test/s3/remote_cache/remote_cache_test.go
index 535c4ba89e..4da4c024e6 100644
--- a/test/s3/remote_cache/remote_cache_test.go
+++ b/test/s3/remote_cache/remote_cache_test.go
@@ -40,6 +40,9 @@ const (
 	// Bucket name - mounted on primary as remote storage
 	testBucket = "remotemounted"
 
+	// Bucket name on the remote that testBucket is mounted on
+	remoteBucket = "remotesourcebucket"
+
 	// Path to weed binary
 	weedBinary = "../../../weed/weed_binary"
 )
@@ -388,6 +391,66 @@ func TestRemoteCacheRangeRequest(t *testing.T) {
 	t.Log("Range request test passed")
 }
 
+// mountRemote remounts the test bucket, keeping the metadata already pulled,
+// with the given extra remote.mount flags.
+func mountRemote(t *testing.T, extraFlags string) {
+	cmd := fmt.Sprintf("remote.mount -dir=/buckets/%s -remote=seaweedremote/%s -nonempty -metadataStrategy=lazy %s", testBucket, remoteBucket, extraFlags)
+	output, err := runWeedShell(t, cmd)
+	require.NoErrorf(t, err, "remount failed: %s", output)
+	time.Sleep(time.Second)
+}
+
+// copyLocalToRemote pushes matching local objects to the remote, which is what
+// lets remote.uncache drop their local chunks afterwards.
+func copyLocalToRemote(t *testing.T, pattern string) {
+	output, err := runWeedShell(t, fmt.Sprintf("remote.copy.local -dir=/buckets/%s -include=%s", testBucket, pattern))
+	require.NoErrorf(t, err, "remote.copy.local failed: %s", output)
+}
+
+// localChunkCount reports how many local chunks an entry has, so a test can
+// tell a cached read from one served straight out of the remote.
+func localChunkCount(t *testing.T, key string) string {
+	meta, err := runWeedShell(t, fmt.Sprintf("fs.meta.cat /buckets/%s/%s", testBucket, key))
+	require.NoError(t, err)
+	// fs.meta.cat closes with "chunks N meta size: ..."
+	summary := strings.LastIndex(meta, "chunks ")
+	require.GreaterOrEqualf(t, summary, 0, "no chunk count in %s", meta)
+	return strings.Fields(meta[summary+len("chunks "):])[0]
+}
+
+// TestRemoteCacheWaitZero tests that a mount with -cacheWait=0 serves a read of
+// an uncached object from the remote without caching it locally.
+func TestRemoteCacheWaitZero(t *testing.T) {
+	checkServersRunning(t)
+
+	testKey := fmt.Sprintf("test-cachewait-%d.bin", time.Now().UnixNano())
+	testData := make([]byte, 1024*1024)
+	for i := range testData {
+		testData[i] = byte(i % 256)
+	}
+
+	t.Log("Step 1: Writing 1MB object, pushing it to the remote and dropping the local chunks...")
+	uploadToPrimary(t, testKey, testData)
+	copyLocalToRemote(t, testKey)
+	uncacheLocal(t, testKey)
+	require.Equal(t, "0", localChunkCount(t, testKey), "the object must start out remote-only")
+
+	t.Log("Step 2: Remounting with -cacheWait=0...")
+	mountRemote(t, "-cacheWait=0")
+	defer mountRemote(t, "")
+
+	t.Log("Step 3: Reading the object (should stream from remote)...")
+	assert.Equal(t, testData, getFromPrimary(t, testKey), "data mismatch reading from remote")
+	assert.Equal(t, "0", localChunkCount(t, testKey), "the read must not cache chunks locally")
+
+	t.Log("Step 4: Reading with the size based wait (should cache locally)...")
+	mountRemote(t, "")
+	assert.Equal(t, testData, getFromPrimary(t, testKey), "data mismatch reading through the cache")
+	assert.NotEqual(t, "0", localChunkCount(t, testKey), "the read must cache chunks locally")
+
+	t.Log("Zero cache wait test passed")
+}
+
 // TestRemoteCacheNotFound tests that non-existent objects return proper errors
 func TestRemoteCacheNotFound(t *testing.T) {
 	checkServersRunning(t)
diff --git a/test/s3/retention/s3_object_lock_directory_marker_test.go b/test/s3/retention/s3_object_lock_directory_marker_test.go
new file mode 100644
index 0000000000..6ae8132383
--- /dev/null
+++ b/test/s3/retention/s3_object_lock_directory_marker_test.go
@@ -0,0 +1,231 @@
+package retention
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/aws/smithy-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func requireAccessDenied(t *testing.T, err error, msg string) {
+	t.Helper()
+	require.Error(t, err, msg)
+	var apiErr smithy.APIError
+	require.True(t, errors.As(err, &apiErr), "expected an API error, got %T", err)
+	assert.Equal(t, "AccessDenied", apiErr.ErrorCode(), msg)
+}
+
+// A key ending in "/" is stored as the filer directory rather than as an object
+// beside it, and is deleted the unversioned way. Object Lock still covers it: the
+// gateway lists it as an object and serves retention set on it.
+func TestObjectLockDirectoryMarker(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+
+	createBucketWithObjectLock(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	retainUntil := time.Now().Add(24 * time.Hour)
+
+	t.Run("retention headers are honored, not dropped", func(t *testing.T) {
+		key := "records/evidence/"
+		_, err := client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket:                    aws.String(bucketName),
+			Key:                       aws.String(key),
+			Body:                      strings.NewReader("marker"),
+			ObjectLockMode:            types.ObjectLockModeCompliance,
+			ObjectLockRetainUntilDate: aws.Time(retainUntil),
+		})
+		require.NoError(t, err)
+
+		_, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+		})
+		requireAccessDenied(t, err, "a retained marker must not be deletable")
+
+		_, err = client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+		})
+		assert.NoError(t, err, "the marker must still be there after the refused delete")
+	})
+
+	t.Run("retention set through PutObjectRetention is honored", func(t *testing.T) {
+		key := "records/ledger/"
+		_, err := client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+			Body:   strings.NewReader("marker"),
+		})
+		require.NoError(t, err)
+
+		_, err = client.PutObjectRetention(context.TODO(), &s3.PutObjectRetentionInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+			Retention: &types.ObjectLockRetention{
+				Mode:            types.ObjectLockRetentionModeCompliance,
+				RetainUntilDate: aws.Time(retainUntil),
+			},
+		})
+		require.NoError(t, err)
+
+		_, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+		})
+		requireAccessDenied(t, err, "retention the gateway serves back must also block the delete")
+
+		_, err = client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+		})
+		assert.NoError(t, err, "the marker must still be there after the refused delete")
+	})
+
+	t.Run("multi-object delete is refused too", func(t *testing.T) {
+		key := "records/batch/"
+		_, err := client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket:                    aws.String(bucketName),
+			Key:                       aws.String(key),
+			Body:                      strings.NewReader("marker"),
+			ObjectLockMode:            types.ObjectLockModeCompliance,
+			ObjectLockRetainUntilDate: aws.Time(retainUntil),
+		})
+		require.NoError(t, err)
+
+		resp, err := client.DeleteObjects(context.TODO(), &s3.DeleteObjectsInput{
+			Bucket: aws.String(bucketName),
+			Delete: &types.Delete{Objects: []types.ObjectIdentifier{{Key: aws.String(key)}}},
+		})
+		require.NoError(t, err)
+		assert.Empty(t, resp.Deleted, "a retained marker must not be reported deleted")
+		require.Len(t, resp.Errors, 1)
+		assert.Equal(t, key, aws.ToString(resp.Errors[0].Key))
+		assert.Equal(t, "AccessDenied", aws.ToString(resp.Errors[0].Code))
+
+		_, err = client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+		})
+		assert.NoError(t, err, "the marker must survive the batch delete")
+	})
+
+	t.Run("invalid lock headers are rejected, as on a regular key", func(t *testing.T) {
+		_, err := client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket:                    aws.String(bucketName),
+			Key:                       aws.String("records/bad-mode/"),
+			Body:                      strings.NewReader("marker"),
+			ObjectLockMode:            "INVALID_MODE",
+			ObjectLockRetainUntilDate: aws.Time(retainUntil),
+		})
+		require.Error(t, err)
+
+		_, err = client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket:         aws.String(bucketName),
+			Key:            aws.String("records/no-date/"),
+			Body:           strings.NewReader("marker"),
+			ObjectLockMode: types.ObjectLockModeGovernance,
+		})
+		require.Error(t, err)
+	})
+
+	// Past 1KiB a trailing-slash key is a real versioned object, and the delete
+	// takes the whole history at once, so an older retained version has to block
+	// it even when the version on top carries no retention of its own.
+	t.Run("a retained version under an unretained one still blocks", func(t *testing.T) {
+		key := "records/history/"
+		body := strings.Repeat("x", 2048)
+
+		first, err := client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket:                    aws.String(bucketName),
+			Key:                       aws.String(key),
+			Body:                      strings.NewReader(body),
+			ObjectLockMode:            types.ObjectLockModeCompliance,
+			ObjectLockRetainUntilDate: aws.Time(retainUntil),
+		})
+		require.NoError(t, err)
+		require.NotNil(t, first.VersionId)
+
+		_, err = client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+			Body:   strings.NewReader(body),
+		})
+		require.NoError(t, err)
+
+		_, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+		})
+		requireAccessDenied(t, err, "the retained version underneath must block the delete")
+
+		_, err = client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+			Bucket:    aws.String(bucketName),
+			Key:       aws.String(key),
+			VersionId: first.VersionId,
+		})
+		assert.NoError(t, err, "the retained version must survive")
+	})
+
+	// mkdir replaces the marker entry outright, taking its lock metadata with it,
+	// so a plain PUT over a retained marker has to be refused - including once the
+	// key has grown a version history that the latest-version lookup would find
+	// instead of the marker.
+	t.Run("a plain PUT cannot replace a retained marker", func(t *testing.T) {
+		key := "records/overwrite/"
+		_, err := client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket:                    aws.String(bucketName),
+			Key:                       aws.String(key),
+			Body:                      strings.NewReader("marker"),
+			ObjectLockMode:            types.ObjectLockModeCompliance,
+			ObjectLockRetainUntilDate: aws.Time(retainUntil),
+		})
+		require.NoError(t, err)
+
+		_, err = client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+			Body:   strings.NewReader("replacement"),
+		})
+		requireAccessDenied(t, err, "a retained marker must not be replaceable")
+
+		_, err = client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+			Body:   strings.NewReader(strings.Repeat("x", 2048)),
+		})
+		require.NoError(t, err, "a versioned write of the same key adds a version")
+
+		_, err = client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+			Body:   strings.NewReader("replacement"),
+		})
+		requireAccessDenied(t, err, "the history must not hide the marker's own lock")
+	})
+
+	t.Run("an unretained marker still deletes", func(t *testing.T) {
+		key := "records/plain/"
+		_, err := client.PutObject(context.TODO(), &s3.PutObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+			Body:   strings.NewReader("marker"),
+		})
+		require.NoError(t, err)
+
+		_, err = client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
+			Bucket: aws.String(bucketName),
+			Key:    aws.String(key),
+		})
+		require.NoError(t, err)
+	})
+}
diff --git a/test/s3/sdk_v2_routing/s3_sdk_v2_routing_test.go b/test/s3/sdk_v2_routing/s3_sdk_v2_routing_test.go
index 2345fdf573..9adc2300f2 100644
--- a/test/s3/sdk_v2_routing/s3_sdk_v2_routing_test.go
+++ b/test/s3/sdk_v2_routing/s3_sdk_v2_routing_test.go
@@ -207,4 +207,3 @@ func TestCreateAndListBuckets_ServiceLevel(t *testing.T) {
 	}
 	require.True(t, found, "bucket %q must appear in service-level ListBuckets", bucket)
 }
-
diff --git a/test/s3/snowflake/README.md b/test/s3/snowflake/README.md
new file mode 100644
index 0000000000..eeda9acc5a
--- /dev/null
+++ b/test/s3/snowflake/README.md
@@ -0,0 +1,33 @@
+# Snowflake S3Compat API test suite
+
+Integration tests that run the upstream
+[Snowflake s3compat API test suite](https://github.com/snowflakedb/snowflake-s3compat-api-test-suite)
+against SeaweedFS. The suite covers `getBucketLocation`, `getObject` (including
+range reads), `getObjectMetadata`, `putObject` (including a 5 GB upload),
+`listObjectsV2` (including paged listing of >1000 objects), `deleteObject`,
+`deleteObjects`, `copyObject`, and `generatePresignedUrl`.
+
+## Running locally
+
+Requires `weed` (or `WEED_BIN`), the `aws` CLI, `mvn`, and JDK 11+ on `PATH`.
+
+```sh
+(cd weed && go install -buildvcs=false)   # build weed first
+bash test/s3/snowflake/run.sh
+```
+
+`run.sh` starts a `weed server` with S3 enabled, calls `prepare.sh` to create
+the fixtures, clones the suite into a scratch dir, and runs
+`mvn -Dtest=S3CompatApiTest`. Set `WORK_DIR` to keep the server log and suite
+clone around, `SKIP_SERVER_START=1` with `ENDPOINT_URL` to run against an
+already-running server, and see the top of `run.sh` for the other overrides.
+
+## Notes
+
+- The server runs with `-s3.autoCreateBucket=false` so PUTs to a missing bucket
+  return `NoSuchBucket` like AWS; the suite asserts this.
+- The suite forces virtual-hosted-style bucket addressing, which requires
+  wildcard DNS that does not exist for a local endpoint. `run.sh` switches it
+  to path-style access with a `sed` patch.
+- `NOT_ACCESSIBLE_BUCKET` is a real bucket carrying a deny-all bucket policy,
+  which is how the suite's `AccessDenied` negative tests are satisfied.
diff --git a/test/s3/snowflake/prepare.sh b/test/s3/snowflake/prepare.sh
new file mode 100755
index 0000000000..030857b7cb
--- /dev/null
+++ b/test/s3/snowflake/prepare.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+#
+# Prepares the fixtures required by the Snowflake s3compat API test suite
+# (https://github.com/snowflakedb/snowflake-s3compat-api-test-suite) against a
+# running SeaweedFS S3 endpoint:
+#
+#   BUCKET_NAME_1           versioning-enabled bucket the suite writes to
+#   NOT_ACCESSIBLE_BUCKET   bucket with a deny-all bucket policy; the suite
+#                           expects 403 AccessDenied for every operation on it
+#   PREFIX_FOR_PAGE_LISTING prefix under BUCKET_NAME_1 holding more than 1000
+#                           objects (the suite asserts paged listing works)
+#
+# Requires: aws CLI on PATH, AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY set.
+
+set -euo pipefail
+
+ENDPOINT_URL="${ENDPOINT_URL:-http://127.0.0.1:8333}"
+BUCKET_NAME_1="${BUCKET_NAME_1:-sf-snowflake-test}"
+NOT_ACCESSIBLE_BUCKET="${NOT_ACCESSIBLE_BUCKET:-sf-denied-bucket}"
+PREFIX_FOR_PAGE_LISTING="${PREFIX_FOR_PAGE_LISTING:-test-suite/page-listing/}"
+PAGE_LISTING_TOTAL_SIZE="${PAGE_LISTING_TOTAL_SIZE:-1100}"
+
+aws="aws --endpoint-url $ENDPOINT_URL"
+
+echo "Creating test bucket $BUCKET_NAME_1 with versioning enabled"
+$aws s3api create-bucket --bucket "$BUCKET_NAME_1"
+$aws s3api put-bucket-versioning --bucket "$BUCKET_NAME_1" --versioning-configuration Status=Enabled
+$aws s3api get-bucket-versioning --bucket "$BUCKET_NAME_1"
+
+echo "Creating not-accessible bucket $NOT_ACCESSIBLE_BUCKET with a deny-all bucket policy"
+$aws s3api create-bucket --bucket "$NOT_ACCESSIBLE_BUCKET"
+POLICY_FILE="$(mktemp)"
+cat > "$POLICY_FILE" <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "DenyAll",
+      "Effect": "Deny",
+      "Principal": "*",
+      "Action": "s3:*",
+      "Resource": [
+        "arn:aws:s3:::${NOT_ACCESSIBLE_BUCKET}",
+        "arn:aws:s3:::${NOT_ACCESSIBLE_BUCKET}/*"
+      ]
+    }
+  ]
+}
+EOF
+$aws s3api put-bucket-policy --bucket "$NOT_ACCESSIBLE_BUCKET" --policy "file://$POLICY_FILE"
+rm -f "$POLICY_FILE"
+
+if OUT="$($aws s3api get-bucket-location --bucket "$NOT_ACCESSIBLE_BUCKET" 2>&1)"; then
+  echo "ERROR: expected AccessDenied on $NOT_ACCESSIBLE_BUCKET, got success" >&2
+  exit 1
+elif ! echo "$OUT" | grep -q "AccessDenied"; then
+  echo "ERROR: expected AccessDenied on $NOT_ACCESSIBLE_BUCKET, got: $OUT" >&2
+  exit 1
+fi
+echo "Verified $NOT_ACCESSIBLE_BUCKET denies access"
+
+if [ "$PAGE_LISTING_TOTAL_SIZE" -le 1000 ]; then
+  echo "ERROR: PAGE_LISTING_TOTAL_SIZE must be > 1000, got $PAGE_LISTING_TOTAL_SIZE" >&2
+  exit 1
+fi
+
+echo "Uploading $PAGE_LISTING_TOTAL_SIZE objects to s3://$BUCKET_NAME_1/$PREFIX_FOR_PAGE_LISTING"
+WORKDIR="$(mktemp -d)"
+for i in $(seq 1 "$PAGE_LISTING_TOTAL_SIZE"); do
+  echo "object-$i" > "$WORKDIR/file_$(printf %05d "$i").txt"
+done
+$aws s3 sync "$WORKDIR" "s3://$BUCKET_NAME_1/$PREFIX_FOR_PAGE_LISTING" --quiet
+rm -rf "$WORKDIR"
+
+COUNT=$($aws s3 ls "s3://$BUCKET_NAME_1/$PREFIX_FOR_PAGE_LISTING" | wc -l | tr -d ' ')
+if [ "$COUNT" != "$PAGE_LISTING_TOTAL_SIZE" ]; then
+  echo "ERROR: expected $PAGE_LISTING_TOTAL_SIZE objects under $PREFIX_FOR_PAGE_LISTING, found $COUNT" >&2
+  exit 1
+fi
+echo "Verified $COUNT objects under s3://$BUCKET_NAME_1/$PREFIX_FOR_PAGE_LISTING"
+echo "Fixtures ready."
diff --git a/test/s3/snowflake/run.sh b/test/s3/snowflake/run.sh
new file mode 100755
index 0000000000..667c4d0bd2
--- /dev/null
+++ b/test/s3/snowflake/run.sh
@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+#
+# Runs the Snowflake s3compat API test suite
+# (https://github.com/snowflakedb/snowflake-s3compat-api-test-suite) against a
+# locally-built SeaweedFS server.
+#
+# Required on PATH: weed (or WEED_BIN), aws, mvn, java, git.
+#
+# Env overrides:
+#   WEED_BIN            path to the weed binary               (default: weed)
+#   WORK_DIR            scratch dir for data + suite clone    (default: mktemp -d,
+#                       removed on success, kept on failure)
+#   MASTER_PORT         master http port                      (default: 9333)
+#   VOLUME_PORT         volume http port                      (default: 8080)
+#   FILER_PORT          filer http port                       (default: 8888)
+#   S3_PORT             s3 endpoint port                      (default: 8333)
+#   METRICS_PORT        metrics http port                     (default: 9324)
+#   SKIP_SERVER_START   if set, do not start weed; prepare and run the suite
+#                       against ENDPOINT_URL
+#   SUITE_REPO          git url of the test suite             (default: upstream)
+#   SUITE_REV           suite commit to check out             (default: pinned SHA)
+#
+# The suite env vars (BUCKET_NAME_1, PREFIX_FOR_PAGE_LISTING,
+# PAGE_LISTING_TOTAL_SIZE, NOT_ACCESSIBLE_BUCKET) default to the same values
+# prepare.sh uses.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+WEED_BIN="${WEED_BIN:-weed}"
+MASTER_PORT="${MASTER_PORT:-9333}"
+VOLUME_PORT="${VOLUME_PORT:-8080}"
+FILER_PORT="${FILER_PORT:-8888}"
+S3_PORT="${S3_PORT:-8333}"
+METRICS_PORT="${METRICS_PORT:-9324}"
+ENDPOINT_URL="${ENDPOINT_URL:-http://127.0.0.1:$S3_PORT}"
+SUITE_REPO="${SUITE_REPO:-https://github.com/snowflakedb/snowflake-s3compat-api-test-suite.git}"
+# Pinned upstream revision verified against SeaweedFS; bump deliberately.
+SUITE_REV="${SUITE_REV:-8ae535b35fff0d8a72e21bba4e51281ac991cab9}"
+WORK_DIR_CREATED=""
+if [ -z "${WORK_DIR:-}" ]; then
+  WORK_DIR="$(mktemp -d)"
+  WORK_DIR_CREATED=1
+fi
+
+export BUCKET_NAME_1="${BUCKET_NAME_1:-sf-snowflake-test}"
+export NOT_ACCESSIBLE_BUCKET="${NOT_ACCESSIBLE_BUCKET:-sf-denied-bucket}"
+export PREFIX_FOR_PAGE_LISTING="${PREFIX_FOR_PAGE_LISTING:-test-suite/page-listing/}"
+export PAGE_LISTING_TOTAL_SIZE="${PAGE_LISTING_TOTAL_SIZE:-1100}"
+export ENDPOINT_URL
+
+# The suite reads credentials from these variables.
+export S3COMPAT_ACCESS_KEY="${S3COMPAT_ACCESS_KEY:-snowflake_compat_access}"
+export S3COMPAT_SECRET_KEY="${S3COMPAT_SECRET_KEY:-snowflake_compat_secret}"
+export AWS_ACCESS_KEY_ID="$S3COMPAT_ACCESS_KEY"
+export AWS_SECRET_ACCESS_KEY="$S3COMPAT_SECRET_KEY"
+
+WEED_PID=""
+cleanup() {
+  status=$?
+  if [ -n "$WEED_PID" ]; then
+    kill "$WEED_PID" 2>/dev/null || true
+    sleep 2
+    kill -9 "$WEED_PID" 2>/dev/null || true
+  fi
+  if [ -n "$WORK_DIR_CREATED" ]; then
+    if [ "$status" -eq 0 ]; then
+      rm -rf "$WORK_DIR"
+    else
+      echo "Work dir kept for debugging: $WORK_DIR" >&2
+    fi
+  fi
+}
+trap cleanup EXIT
+
+wait_for_url() {
+  local url="$1" name="$2"
+  for i in $(seq 1 30); do
+    if curl -s "$url" > /dev/null 2>&1; then
+      echo "$name is ready"
+      return 0
+    fi
+    echo "Waiting for $name... ($i/30)"
+    sleep 2
+  done
+  echo "ERROR: $name did not become ready" >&2
+  return 1
+}
+
+if [ -z "${SKIP_SERVER_START:-}" ]; then
+  WEED_DATA_DIR="$WORK_DIR/data"
+  mkdir -p "$WEED_DATA_DIR"
+
+  echo "Starting SeaweedFS (data dir: $WEED_DATA_DIR)"
+  "$WEED_BIN" server -filer -filer.maxMB=64 -s3 -ip 127.0.0.1 -ip.bind 127.0.0.1 \
+    -dir="$WEED_DATA_DIR" \
+    -master.raftHashicorp -master.electionTimeout 1s -master.volumeSizeLimitMB=5000 \
+    -volume.max=4 -volume.preStopSeconds=1 \
+    -master.peers=none \
+    -master.port="$MASTER_PORT" -volume.port="$VOLUME_PORT" -filer.port="$FILER_PORT" -s3.port="$S3_PORT" \
+    -metricsPort="$METRICS_PORT" \
+    -s3.allowDeleteBucketNotEmpty=true \
+    -s3.autoCreateBucket=false \
+    -s3.port.iceberg=0 -s3.port.lance=0 \
+    -s3.config="$SCRIPT_DIR/s3.json" \
+    > "$WORK_DIR/weed.log" 2>&1 &
+  WEED_PID=$!
+
+  wait_for_url "http://127.0.0.1:$MASTER_PORT/cluster/status" "Master server"
+  wait_for_url "http://127.0.0.1:$VOLUME_PORT/status" "Volume server"
+  wait_for_url "http://127.0.0.1:$FILER_PORT/" "Filer"
+  wait_for_url "$ENDPOINT_URL/" "S3 API"
+  echo "All SeaweedFS components are ready"
+fi
+
+"$SCRIPT_DIR/prepare.sh"
+
+SUITE_DIR="$WORK_DIR/snowflake-s3compat-api-test-suite"
+if [ ! -d "$SUITE_DIR" ]; then
+  git init -q "$SUITE_DIR"
+  git -C "$SUITE_DIR" remote add origin "$SUITE_REPO"
+  git -C "$SUITE_DIR" fetch -q --depth 1 origin "$SUITE_REV"
+  git -C "$SUITE_DIR" checkout -q FETCH_HEAD
+fi
+
+# The suite forces virtual-hosted style bucket addressing, which needs wildcard
+# DNS (<bucket>.<endpoint>) that does not exist for a local endpoint. Switch it
+# to path-style access, which SeaweedFS supports.
+STORAGE_CLIENT="$SUITE_DIR/s3compatapi/src/main/java/com/snowflake/s3compatapitestsuite/compatapi/S3CompatStorageClient.java"
+sed -i.bak 's/setPathStyleAccess(false)/setPathStyleAccess(true)/' "$STORAGE_CLIENT"
+rm -f "$STORAGE_CLIENT.bak"
+grep -q 'setPathStyleAccess(true)' "$STORAGE_CLIENT"
+
+cd "$SUITE_DIR/s3compatapi"
+
+END_POINT="$ENDPOINT_URL" \
+REGION_1=us-east-1 \
+REGION_2=us-west-2 \
+mvn -B test -Dtest=S3CompatApiTest
diff --git a/test/s3/snowflake/s3.json b/test/s3/snowflake/s3.json
new file mode 100644
index 0000000000..0f52e9ab45
--- /dev/null
+++ b/test/s3/snowflake/s3.json
@@ -0,0 +1,20 @@
+{
+  "identities": [
+    {
+      "name": "snowflake_compat_admin",
+      "credentials": [
+        {
+          "accessKey": "snowflake_compat_access",
+          "secretKey": "snowflake_compat_secret"
+        }
+      ],
+      "actions": [
+        "Admin",
+        "Read",
+        "List",
+        "Tagging",
+        "Write"
+      ]
+    }
+  ]
+}
diff --git a/test/s3/spark/setup_test.go b/test/s3/spark/setup_test.go
index efdb2c60d5..3b647a2f8e 100644
--- a/test/s3/spark/setup_test.go
+++ b/test/s3/spark/setup_test.go
@@ -94,7 +94,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		t.Fatalf("failed to create temp directory: %v", err)
 	}
 
-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3"})
+	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3", "Admin"})
 	env.masterPort = ports[0]
 	env.filerPort = ports[1]
 	env.s3Port = ports[2]
@@ -105,8 +105,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		t.Fatalf("failed to create IAM config: %v", err)
 	}
 
-	env.masterProcess = exec.Command(
-		env.weedBinary, "mini",
+	miniArgs := append([]string{"mini",
 		"-ip", bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
@@ -114,7 +113,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-s3.port", fmt.Sprintf("%d", env.s3Port),
 		"-s3.config", iamConfigPath,
 		"-dir", env.seaweedfsDataDir,
-	)
+	}, testutil.MiniAdminArgs(ports[3])...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0", "-s3.port.iceberg=0")
+	env.masterProcess = exec.Command(env.weedBinary, miniArgs...)
 	weedLogPath := filepath.Join(env.seaweedfsDataDir, "weed-mini.log")
 	weedLogFile, err := os.Create(weedLogPath)
 	if err != nil {
diff --git a/test/s3/sse/Makefile b/test/s3/sse/Makefile
index cd7d50e9e8..e5072dbdba 100644
--- a/test/s3/sse/Makefile
+++ b/test/s3/sse/Makefile
@@ -106,7 +106,7 @@ start-seaweedfs: check-binary
 		> /tmp/seaweedfs-sse-mini.log 2>&1 & echo $$! > /tmp/weed-mini.pid
 
 	@echo "Checking S3 service is ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s http://127.0.0.1:$(S3_PORT) > /dev/null 2>&1; then \
 			echo "✅ S3 service is ready"; \
 			break; \
@@ -347,7 +347,7 @@ start-seaweedfs-ci: check-binary
 		> /tmp/seaweedfs-sse-mini.log 2>&1 & echo $$! > /tmp/weed-mini.pid
 	
 	@echo "Checking S3 service is ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s http://127.0.0.1:$(S3_PORT) > /dev/null 2>&1; then \
 			echo "✅ S3 service is ready"; \
 			break; \
@@ -491,7 +491,7 @@ test-volume-encryption: build-weed
 		-ip=127.0.0.1 \
 		> /tmp/seaweedfs-sse-mini.log 2>&1 & echo $$! > /tmp/weed-mini.pid
 	@echo "Checking S3 service is ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s http://127.0.0.1:$(S3_PORT) > /dev/null 2>&1; then \
 			echo "✅ S3 service is ready"; \
 			break; \
diff --git a/test/s3/versioning/Makefile b/test/s3/versioning/Makefile
index 5fde72044b..26ec27704f 100644
--- a/test/s3/versioning/Makefile
+++ b/test/s3/versioning/Makefile
@@ -94,6 +94,7 @@ start-server: check-deps
 	@echo "🔍 DEBUG: Launching SeaweedFS server in background..."
 	@echo "🔍 DEBUG: Command: $(WEED_BINARY) mini -dir=./test-volume-data -s3.port=$(S3_PORT) -s3.config=../../../docker/compose/s3.json"
 	@$(WEED_BINARY) mini \
+		-ip=127.0.0.1 -ip.bind=127.0.0.1 \
 		-dir=./test-volume-data \
 		-s3.port=$(S3_PORT) \
 		-s3.config=../../../docker/compose/s3.json \
@@ -228,14 +229,14 @@ test-with-server: start-server
 # Test with different configurations
 test-versioning-with-configs: check-deps
 	@echo "Testing with different S3 configurations..."
-	@echo "Testing with empty folder allowed..."
-	@$(WEED_BINARY) mini -s3.port=$(S3_PORT) > weed-test-config1.log 2>&1 & echo $$! > weed-config1.pid
+	@echo "Testing with delete bucket not empty allowed..."
+	@$(WEED_BINARY) mini -ip=127.0.0.1 -ip.bind=127.0.0.1 -s3.port=$(S3_PORT) -s3.allowDeleteBucketNotEmpty=true > weed-test-config1.log 2>&1 & echo $$! > weed-config1.pid
 	@sleep 5
 	@go test -v -timeout=5m -run "TestVersioningBasicWorkflow" . || true
 	@if [ -f weed-config1.pid ]; then kill -TERM $$(cat weed-config1.pid) 2>/dev/null || true; rm -f weed-config1.pid; fi
 	@sleep 2
 	@echo "Testing with delete bucket not empty disabled..."
-	@$(WEED_BINARY) mini -s3.port=$(S3_PORT) -s3.allowDeleteBucketNotEmpty=false > weed-test-config2.log 2>&1 & echo $$! > weed-config2.pid
+	@$(WEED_BINARY) mini -ip=127.0.0.1 -ip.bind=127.0.0.1 -s3.port=$(S3_PORT) -s3.allowDeleteBucketNotEmpty=false > weed-test-config2.log 2>&1 & echo $$! > weed-config2.pid
 	@sleep 5
 	@go test -v -timeout=5m -run "TestVersioningBasicWorkflow" . || true
 	@if [ -f weed-config2.pid ]; then kill -TERM $$(cat weed-config2.pid) 2>/dev/null || true; rm -f weed-config2.pid; fi
@@ -279,6 +280,7 @@ debug-server:
 	@$(MAKE) stop-server
 	@mkdir -p ./test-volume-data
 	@$(WEED_BINARY) mini \
+		-ip=127.0.0.1 -ip.bind=127.0.0.1 \
 		-debug \
 		-s3.port=$(S3_PORT) \
 		-s3.allowDeleteBucketNotEmpty=true \
@@ -323,6 +325,7 @@ health-check:
 start-server-simple: check-deps
 	@echo "Starting SeaweedFS server (simple mode)..."
 	@$(WEED_BINARY) mini \
+		-ip=127.0.0.1 -ip.bind=127.0.0.1 \
 		-dir=$(SERVER_DIR) \
 		-s3 \
 		-s3.port=$(S3_PORT) \
@@ -331,7 +334,7 @@ start-server-simple: check-deps
 		echo $$! > weed-server.pid
 	
 	@echo "Waiting for S3 server to be ready..."
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if echo | nc -z localhost $(S3_PORT); then \
 			echo "S3 server is ready!"; \
 			exit 0; \
diff --git a/test/s3/versioning/s3_conditional_reads_test.go b/test/s3/versioning/s3_conditional_reads_test.go
new file mode 100644
index 0000000000..83dab53668
--- /dev/null
+++ b/test/s3/versioning/s3_conditional_reads_test.go
@@ -0,0 +1,130 @@
+package s3api
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/smithy-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func requireAPIErrorCode(t *testing.T, err error, expected string) {
+	t.Helper()
+	require.Error(t, err)
+	var apiErr smithy.APIError
+	require.True(t, errors.As(err, &apiErr), "expected a smithy.APIError, got %T: %v", err, err)
+	assert.Equal(t, expected, apiErr.ErrorCode())
+}
+
+// TestConditionalReadsOfMissingObject verifies that a missing key stays a missing key
+// under If-Match and If-Unmodified-Since instead of surfacing as 412.
+// reproduces issue #10984
+func TestConditionalReadsOfMissingObject(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	existing := putObject(t, client, bucketName, "etag-source", "content")
+	require.NotNil(t, existing.ETag)
+	future := aws.Time(time.Now().Add(24 * time.Hour))
+	missing := aws.String("conditional-missing")
+
+	t.Run("HeadObject If-Match", func(t *testing.T) {
+		_, err := client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+			Bucket: aws.String(bucketName), Key: missing, IfMatch: existing.ETag,
+		})
+		requireAPIErrorCode(t, err, "NotFound")
+	})
+
+	t.Run("HeadObject If-Unmodified-Since", func(t *testing.T) {
+		_, err := client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+			Bucket: aws.String(bucketName), Key: missing, IfUnmodifiedSince: future,
+		})
+		requireAPIErrorCode(t, err, "NotFound")
+	})
+
+	t.Run("GetObject If-Match", func(t *testing.T) {
+		_, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+			Bucket: aws.String(bucketName), Key: missing, IfMatch: existing.ETag,
+		})
+		requireAPIErrorCode(t, err, "NoSuchKey")
+	})
+
+	t.Run("GetObject If-Unmodified-Since", func(t *testing.T) {
+		_, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+			Bucket: aws.String(bucketName), Key: missing, IfUnmodifiedSince: future,
+		})
+		requireAPIErrorCode(t, err, "NoSuchKey")
+	})
+
+	t.Run("GetObject stale If-Match on a live object stays 412", func(t *testing.T) {
+		_, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+			Bucket: aws.String(bucketName), Key: aws.String("etag-source"),
+			IfMatch: aws.String(`"0000000000000000000000000000dead"`),
+		})
+		requireAPIErrorCode(t, err, "PreconditionFailed")
+	})
+}
+
+// TestConditionalReadsOfNamedVersion verifies that a conditional GET or HEAD of an
+// explicit versionId is evaluated against that version rather than the latest one,
+// including when the latest version is a delete marker.
+func TestConditionalReadsOfNamedVersion(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+	enableVersioning(t, client, bucketName)
+
+	key := "conditional-read-version"
+	v1 := putObject(t, client, bucketName, key, "content-v1")
+	require.NotNil(t, v1.ETag)
+	require.NotNil(t, v1.VersionId)
+	v2 := putObject(t, client, bucketName, key, "content-v2")
+	require.NotNil(t, v2.ETag)
+	require.NotEqual(t, *v1.ETag, *v2.ETag)
+
+	t.Run("If-Match matches the named version, not the latest", func(t *testing.T) {
+		_, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+			Bucket: aws.String(bucketName), Key: aws.String(key),
+			VersionId: v1.VersionId, IfMatch: v1.ETag,
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("If-Match against the latest ETag fails on the named version", func(t *testing.T) {
+		_, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+			Bucket: aws.String(bucketName), Key: aws.String(key),
+			VersionId: v1.VersionId, IfMatch: v2.ETag,
+		})
+		requireAPIErrorCode(t, err, "PreconditionFailed")
+	})
+
+	_, err := client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
+		Bucket: aws.String(bucketName), Key: aws.String(key),
+	})
+	require.NoError(t, err)
+
+	t.Run("named version survives a delete marker on the latest", func(t *testing.T) {
+		_, err := client.HeadObject(context.TODO(), &s3.HeadObjectInput{
+			Bucket: aws.String(bucketName), Key: aws.String(key),
+			VersionId: v1.VersionId, IfMatch: v1.ETag,
+		})
+		require.NoError(t, err)
+	})
+
+	t.Run("delete marker latest is a missing object", func(t *testing.T) {
+		_, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+			Bucket: aws.String(bucketName), Key: aws.String(key), IfMatch: v1.ETag,
+		})
+		requireAPIErrorCode(t, err, "NoSuchKey")
+	})
+}
diff --git a/test/s3/versioning/s3_listing_regression_test.go b/test/s3/versioning/s3_listing_regression_test.go
new file mode 100644
index 0000000000..169c8511bb
--- /dev/null
+++ b/test/s3/versioning/s3_listing_regression_test.go
@@ -0,0 +1,112 @@
+package s3api
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"sort"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Check both wire APIs with small pages. The directory walker alone does
+// not exercise prefix normalization, delimiter-marker adjustment, or tokens.
+func TestListingPrefixAndDelimiterPagination(t *testing.T) {
+	client := getS3Client(t)
+	ctx := context.Background()
+	for _, versioning := range []string{"", "Enabled", "Suspended"} {
+		t.Run("versioning="+versioning, func(t *testing.T) {
+			bucket := getNewBucketName()
+			createBucket(t, client, bucket)
+			defer deleteBucket(t, client, bucket)
+			if versioning != "" {
+				enableVersioning(t, client, bucket)
+				if versioning == "Suspended" {
+					_, err := client.PutBucketVersioning(ctx, &s3.PutBucketVersioningInput{
+						Bucket: aws.String(bucket), VersioningConfiguration: &types.VersioningConfiguration{Status: types.BucketVersioningStatusSuspended},
+					})
+					require.NoError(t, err)
+				}
+			}
+			for _, key := range []string{"a", "a-c", "a.txt", "a/b", "foo_bar", "foo_bar_baz", "foo_baz"} {
+				_, err := client.PutObject(ctx, &s3.PutObjectInput{Bucket: aws.String(bucket), Key: aws.String(key), Body: bytes.NewReader([]byte("x"))})
+				require.NoError(t, err)
+			}
+			for _, tc := range []struct {
+				name, prefix, delimiter, startAfter string
+				keys, prefixes                      []string
+			}{
+				{"trailing slash", "a/", "", "", []string{"a/b"}, nil},
+				{"trailing slash custom delimiter", "a/", "_", "", []string{"a/b"}, nil},
+				{"custom delimiter", "foo", "_", "", nil, []string{"foo_"}},
+				{"custom delimiter nested group", "foo_", "_", "", []string{"foo_bar", "foo_baz"}, []string{"foo_bar_"}},
+				{"marker names directory", "a", "", "a", []string{"a-c", "a.txt", "a/b"}, nil},
+				{"marker between name and slash", "a", "", "a.txt", []string{"a/b"}, nil},
+			} {
+				for _, v2 := range []bool{false, true} {
+					for _, pageSize := range []int32{1, 2, 1000} {
+						t.Run(fmt.Sprintf("%s/v2=%t/max=%d", tc.name, v2, pageSize), func(t *testing.T) {
+							var keys, prefixes []string
+							marker, token := tc.startAfter, ""
+							for page := 0; ; page++ {
+								require.Less(t, page, 10, "listing must terminate without repeating a prefix")
+								var objects []types.Object
+								var commonPrefixes []types.CommonPrefix
+								var truncated bool
+								if v2 {
+									in := &s3.ListObjectsV2Input{Bucket: aws.String(bucket), Prefix: aws.String(tc.prefix), Delimiter: aws.String(tc.delimiter), MaxKeys: aws.Int32(pageSize)}
+									if token != "" {
+										in.ContinuationToken = aws.String(token)
+									} else if marker != "" {
+										in.StartAfter = aws.String(marker)
+									}
+									out, err := client.ListObjectsV2(ctx, in)
+									require.NoError(t, err)
+									objects, commonPrefixes, truncated = out.Contents, out.CommonPrefixes, aws.ToBool(out.IsTruncated)
+									next := aws.ToString(out.NextContinuationToken)
+									if truncated {
+										require.NotEmpty(t, next)
+										require.NotEqual(t, token, next, "token must advance")
+									}
+									token = next
+								} else {
+									out, err := client.ListObjects(ctx, &s3.ListObjectsInput{
+										Bucket: aws.String(bucket), Prefix: aws.String(tc.prefix), Delimiter: aws.String(tc.delimiter), MaxKeys: aws.Int32(pageSize), Marker: aws.String(marker),
+									})
+									require.NoError(t, err)
+									objects, commonPrefixes, truncated = out.Contents, out.CommonPrefixes, aws.ToBool(out.IsTruncated)
+									next := aws.ToString(out.NextMarker)
+									if truncated {
+										if next == "" && len(objects) > 0 {
+											next = aws.ToString(objects[len(objects)-1].Key)
+										}
+										require.Greater(t, next, marker, "marker must advance")
+									}
+									marker = next
+								}
+								for _, object := range objects {
+									keys = append(keys, aws.ToString(object.Key))
+								}
+								for _, prefix := range commonPrefixes {
+									prefixes = append(prefixes, aws.ToString(prefix.Prefix))
+								}
+								if !truncated {
+									break
+								}
+							}
+							sort.Strings(keys)
+							sort.Strings(prefixes)
+							assert.Equal(t, tc.keys, keys)
+							assert.Equal(t, tc.prefixes, prefixes)
+						})
+					}
+				}
+			}
+		})
+	}
+}
diff --git a/test/s3/versioning/s3_post_policy_versioning_test.go b/test/s3/versioning/s3_post_policy_versioning_test.go
new file mode 100644
index 0000000000..63bc813ab6
--- /dev/null
+++ b/test/s3/versioning/s3_post_policy_versioning_test.go
@@ -0,0 +1,285 @@
+package s3api
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/stretchr/testify/require"
+)
+
+type postPolicyUploadResult struct {
+	versionID string
+	etag      string
+}
+
+func postPolicyUpload(ctx context.Context, client *s3.Client, bucket, key string, body []byte) (postPolicyUploadResult, error) {
+	return postPolicyUploadWithFields(ctx, client, bucket, key, body, nil)
+}
+
+func postPolicyUploadWithFields(ctx context.Context, client *s3.Client, bucket, key string, body []byte, extraFields map[string]string) (postPolicyUploadResult, error) {
+	presigner := s3.NewPresignClient(client, s3.WithPresignClientFromClientOptions(func(options *s3.Options) {
+		options.BaseEndpoint = aws.String(defaultConfig.Endpoint)
+		options.EndpointResolver = nil
+		options.UsePathStyle = true
+	}))
+	presigned, err := presigner.PresignPostObject(ctx, &s3.PutObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	}, func(options *s3.PresignPostOptions) {
+		options.Expires = time.Hour
+		for name, value := range extraFields {
+			options.Conditions = append(options.Conditions, map[string]string{name: value})
+		}
+	})
+	if err != nil {
+		return postPolicyUploadResult{}, err
+	}
+
+	var requestBody bytes.Buffer
+	writer := multipart.NewWriter(&requestBody)
+	for name, value := range presigned.Values {
+		if err := writer.WriteField(name, value); err != nil {
+			return postPolicyUploadResult{}, err
+		}
+	}
+	for name, value := range extraFields {
+		if err := writer.WriteField(name, value); err != nil {
+			return postPolicyUploadResult{}, err
+		}
+	}
+	file, err := writer.CreateFormFile("file", "payload.bin")
+	if err != nil {
+		return postPolicyUploadResult{}, err
+	}
+	if _, err := file.Write(body); err != nil {
+		return postPolicyUploadResult{}, err
+	}
+	if err := writer.Close(); err != nil {
+		return postPolicyUploadResult{}, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, presigned.URL, &requestBody)
+	if err != nil {
+		return postPolicyUploadResult{}, err
+	}
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	resp, err := (&http.Client{Timeout: 30 * time.Second}).Do(req)
+	if err != nil {
+		return postPolicyUploadResult{}, err
+	}
+	defer resp.Body.Close()
+	responseBody, readErr := io.ReadAll(resp.Body)
+	if readErr != nil {
+		return postPolicyUploadResult{}, readErr
+	}
+	if resp.StatusCode != http.StatusNoContent {
+		return postPolicyUploadResult{}, fmt.Errorf("POST Object returned %s: %s", resp.Status, responseBody)
+	}
+	return postPolicyUploadResult{
+		versionID: resp.Header.Get("x-amz-version-id"),
+		etag:      resp.Header.Get("ETag"),
+	}, nil
+}
+
+func TestPostPolicyPreservesVersionHistoryAcrossPutAndDelete(t *testing.T) {
+	ctx := context.Background()
+	client := getS3Client(t)
+	bucket := getNewBucketName()
+	key := "post-policy-history.bin"
+	createBucket(t, client, bucket)
+	defer deleteBucket(t, client, bucket)
+
+	putObject(t, client, bucket, key, "legacy-null")
+	enableVersioning(t, client, bucket)
+
+	postOne, err := postPolicyUpload(ctx, client, bucket, key, []byte("post-one"))
+	require.NoError(t, err)
+	require.NotEmpty(t, postOne.versionID)
+	require.NotEmpty(t, postOne.etag)
+
+	putTwo := putObject(t, client, bucket, key, "put-two")
+	require.NotNil(t, putTwo.VersionId)
+	require.NotEmpty(t, *putTwo.VersionId)
+
+	postThree, err := postPolicyUpload(ctx, client, bucket, key, []byte("post-three"))
+	require.NoError(t, err)
+	require.NotEmpty(t, postThree.versionID)
+
+	deleted, err := client.DeleteObject(ctx, &s3.DeleteObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	})
+	require.NoError(t, err)
+	require.True(t, aws.ToBool(deleted.DeleteMarker))
+	require.NotEmpty(t, aws.ToString(deleted.VersionId))
+
+	postFour, err := postPolicyUpload(ctx, client, bucket, key, []byte("post-four"))
+	require.NoError(t, err)
+	require.NotEmpty(t, postFour.versionID)
+
+	requireVersionBody(t, client, bucket, key, "null", []byte("legacy-null"), "legacy null version")
+	requireVersionBody(t, client, bucket, key, postOne.versionID, []byte("post-one"), "first POST version")
+	requireVersionBody(t, client, bucket, key, aws.ToString(putTwo.VersionId), []byte("put-two"), "interleaved PUT version")
+	requireVersionBody(t, client, bucket, key, postThree.versionID, []byte("post-three"), "second POST version")
+	requireVersionBody(t, client, bucket, key, postFour.versionID, []byte("post-four"), "POST after delete marker")
+
+	listed, err := client.ListObjectVersions(ctx, &s3.ListObjectVersionsInput{
+		Bucket: aws.String(bucket),
+		Prefix: aws.String(key),
+	})
+	require.NoError(t, err)
+	require.Len(t, listed.Versions, 5)
+	require.Len(t, listed.DeleteMarkers, 1)
+	latest := 0
+	latestVersionID := ""
+	for _, version := range listed.Versions {
+		if aws.ToBool(version.IsLatest) {
+			latest++
+			latestVersionID = aws.ToString(version.VersionId)
+		}
+	}
+	require.Equal(t, 1, latest)
+	require.Equal(t, postFour.versionID, latestVersionID)
+	require.False(t, aws.ToBool(listed.DeleteMarkers[0].IsLatest))
+}
+
+func TestPostPolicyRejectsIncompleteObjectLockHeaders(t *testing.T) {
+	ctx := context.Background()
+	client := getS3Client(t)
+	bucket := getNewBucketName()
+	key := "post-policy-invalid-object-lock.bin"
+	createBucketWithObjectLock(t, client, bucket)
+	defer deleteBucket(t, client, bucket)
+
+	_, err := postPolicyUploadWithFields(ctx, client, bucket, key, []byte("rejected"), map[string]string{
+		"x-amz-object-lock-mode": "GOVERNANCE",
+	})
+	require.ErrorContains(t, err, "400 Bad Request")
+	require.ErrorContains(t, err, "<Code>InvalidRequest</Code>")
+
+	listed, listErr := client.ListObjectVersions(ctx, &s3.ListObjectVersionsInput{
+		Bucket: aws.String(bucket),
+		Prefix: aws.String(key),
+	})
+	require.NoError(t, listErr)
+	require.Empty(t, listed.Versions)
+}
+
+func TestPostPolicyVersioningStateCompatibility(t *testing.T) {
+	ctx := context.Background()
+	client := getS3Client(t)
+	bucket := getNewBucketName()
+	key := "post-policy-state.bin"
+	createBucket(t, client, bucket)
+	defer deleteBucket(t, client, bucket)
+
+	unconfigured, err := postPolicyUpload(ctx, client, bucket, key, []byte("unconfigured"))
+	require.NoError(t, err)
+	require.Empty(t, unconfigured.versionID)
+	unconfigured, err = postPolicyUpload(ctx, client, bucket, key, []byte("unconfigured-two"))
+	require.NoError(t, err)
+	require.Empty(t, unconfigured.versionID)
+	requireVersionBody(t, client, bucket, key, "null", []byte("unconfigured-two"), "unconfigured POST replaces null version")
+
+	enableVersioning(t, client, bucket)
+	versioned := putObject(t, client, bucket, key, "numbered")
+	require.NotEmpty(t, aws.ToString(versioned.VersionId))
+	suspendVersioning(t, client, bucket)
+
+	suspended, err := postPolicyUpload(ctx, client, bucket, key, []byte("suspended-one"))
+	require.NoError(t, err)
+	require.Empty(t, suspended.versionID)
+	suspended, err = postPolicyUpload(ctx, client, bucket, key, []byte("suspended-two"))
+	require.NoError(t, err)
+	require.Empty(t, suspended.versionID)
+	requireVersionBody(t, client, bucket, key, "null", []byte("suspended-two"), "suspended POST replaces null version")
+	requireVersionBody(t, client, bucket, key, aws.ToString(versioned.VersionId), []byte("numbered"), "suspended POST preserves numbered version")
+
+	listed, err := client.ListObjectVersions(ctx, &s3.ListObjectVersionsInput{
+		Bucket: aws.String(bucket),
+		Prefix: aws.String(key),
+	})
+	require.NoError(t, err)
+	require.Len(t, listed.Versions, 2)
+}
+
+func TestPostPolicyConcurrentWritesKeepEveryVersion(t *testing.T) {
+	const writeCount = 8
+
+	ctx := context.Background()
+	client := getS3Client(t)
+	bucket := getNewBucketName()
+	key := "post-policy-concurrent.bin"
+	createBucket(t, client, bucket)
+	defer deleteBucket(t, client, bucket)
+	enableVersioning(t, client, bucket)
+
+	type writeResult struct {
+		versionID string
+		body      []byte
+		err       error
+	}
+	start := make(chan struct{})
+	results := make(chan writeResult, writeCount)
+	var wg sync.WaitGroup
+	for i := 0; i < writeCount; i++ {
+		i := i
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			<-start
+			body := []byte(fmt.Sprintf("concurrent-%d", i))
+			if i%2 == 0 {
+				post, err := postPolicyUpload(ctx, client, bucket, key, body)
+				results <- writeResult{versionID: post.versionID, body: body, err: err}
+				return
+			}
+			put, err := client.PutObject(ctx, &s3.PutObjectInput{
+				Bucket: aws.String(bucket),
+				Key:    aws.String(key),
+				Body:   bytes.NewReader(body),
+			})
+			versionID := ""
+			if put != nil {
+				versionID = aws.ToString(put.VersionId)
+			}
+			results <- writeResult{versionID: versionID, body: body, err: err}
+		}()
+	}
+	close(start)
+	wg.Wait()
+	close(results)
+
+	seen := make(map[string]struct{}, writeCount)
+	for result := range results {
+		require.NoError(t, result.err)
+		require.NotEmpty(t, result.versionID)
+		_, duplicate := seen[result.versionID]
+		require.False(t, duplicate, "each successful write must receive a unique version ID")
+		seen[result.versionID] = struct{}{}
+		requireVersionBody(t, client, bucket, key, result.versionID, result.body, "concurrent version body")
+	}
+
+	listed, err := client.ListObjectVersions(ctx, &s3.ListObjectVersionsInput{
+		Bucket: aws.String(bucket),
+		Prefix: aws.String(key),
+	})
+	require.NoError(t, err)
+	require.Len(t, listed.Versions, writeCount)
+	latest := 0
+	for _, version := range listed.Versions {
+		if aws.ToBool(version.IsLatest) {
+			latest++
+		}
+	}
+	require.Equal(t, 1, latest)
+}
diff --git a/test/s3/versioning/s3_preversioning_delete_test.go b/test/s3/versioning/s3_preversioning_delete_test.go
new file mode 100644
index 0000000000..bf6653c425
--- /dev/null
+++ b/test/s3/versioning/s3_preversioning_delete_test.go
@@ -0,0 +1,293 @@
+package s3api
+
+import (
+	"context"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Deleting a key whose null version predates versioning records the delete
+// marker under <key>.versions but leaves the null object at the base path.
+// The listing must retract that stale entry, on whichever page it lands.
+
+func deleteObject(t *testing.T, client *s3.Client, bucket, key string) {
+	t.Helper()
+	resp, err := client.DeleteObject(context.TODO(), &s3.DeleteObjectInput{
+		Bucket: aws.String(bucket), Key: aws.String(key),
+	})
+	require.NoError(t, err)
+	require.True(t, resp.DeleteMarker != nil && *resp.DeleteMarker, "the delete must record a delete marker")
+}
+
+func TestPreVersioningNullObjectDeleteHidesKey(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	putObject(t, client, bucketName, "k.txt", "pre-versioning")
+	enableVersioning(t, client, bucketName)
+	deleteObject(t, client, bucketName, "k.txt")
+
+	assert.Empty(t, listAllKeys(t, client, bucketName, 0), "the deleted key must leave the listing")
+
+	_, err := client.GetObject(context.TODO(), &s3.GetObjectInput{
+		Bucket: aws.String(bucketName), Key: aws.String("k.txt"),
+	})
+	assert.Error(t, err, "the deleted key must not be readable")
+
+	versions, err := client.ListObjectVersions(context.TODO(), &s3.ListObjectVersionsInput{
+		Bucket: aws.String(bucketName),
+	})
+	require.NoError(t, err)
+	require.Len(t, versions.DeleteMarkers, 1)
+	assert.True(t, *versions.DeleteMarkers[0].IsLatest, "the delete marker is the current version")
+	require.Len(t, versions.Versions, 1)
+	assert.Equal(t, "null", *versions.Versions[0].VersionId)
+	assert.False(t, *versions.Versions[0].IsLatest, "the null version is shadowed by the marker")
+}
+
+func TestPreVersioningNullObjectDeleteAfterOverwriteHidesKey(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	putObject(t, client, bucketName, "k.txt", "pre-versioning")
+	enableVersioning(t, client, bucketName)
+	putObject(t, client, bucketName, "k.txt", "versioned overwrite")
+	deleteObject(t, client, bucketName, "k.txt")
+
+	assert.Empty(t, listAllKeys(t, client, bucketName, 0), "the deleted key must leave the listing")
+}
+
+// The retraction and the replacement must both survive a page boundary landing
+// between a key and its .versions sibling.
+func TestPreVersioningNullObjectAcrossPageBoundary(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	putObject(t, client, bucketName, "a.txt", "old")
+	enableVersioning(t, client, bucketName)
+	deleteObject(t, client, bucketName, "a.txt")
+	putObjectVersioned(t, client, bucketName, "b.txt")
+
+	assert.Equal(t, []string{"b.txt"}, listAllKeys(t, client, bucketName, 1),
+		"a page ending on the stale null object must still retract it")
+}
+
+func TestPreVersioningNullObjectMetadataAcrossPageBoundary(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	overwrite := "versioned overwrite"
+	putObject(t, client, bucketName, "a.txt", "old")
+	enableVersioning(t, client, bucketName)
+	putObject(t, client, bucketName, "a.txt", overwrite)
+	putObjectVersioned(t, client, bucketName, "b.txt")
+
+	page, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{
+		Bucket: aws.String(bucketName), MaxKeys: aws.Int32(1),
+	})
+	require.NoError(t, err)
+	require.Len(t, page.Contents, 1)
+	assert.Equal(t, "a.txt", *page.Contents[0].Key)
+	assert.Equal(t, int64(len(overwrite)), *page.Contents[0].Size,
+		"a page ending on the null object must still pick up the current version's metadata")
+}
+
+// A key such as "a.txt.bak" sorts between "a.txt" and "a.txt.versions", so the
+// sibling's outcome arrives entries later, possibly on a later page.
+func TestPreVersioningInterveningKeyRetraction(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	putObject(t, client, bucketName, "a.txt", "pre-versioning")
+	putObject(t, client, bucketName, "a.txt!between", "pre-versioning")
+	putObject(t, client, bucketName, "a.txt.bak", "pre-versioning")
+	enableVersioning(t, client, bucketName)
+	deleteObject(t, client, bucketName, "a.txt")
+
+	for _, maxKeys := range []int32{0, 1, 2} {
+		assert.Equal(t, []string{"a.txt!between", "a.txt.bak"}, listAllKeys(t, client, bucketName, maxKeys),
+			"maxKeys=%d must not list the deleted key", maxKeys)
+	}
+}
+
+func TestPreVersioningInterveningKeyMetadata(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	overwrite := "versioned overwrite"
+	putObject(t, client, bucketName, "a.txt", "old")
+	putObject(t, client, bucketName, "a.txt!between", "pre-versioning")
+	putObject(t, client, bucketName, "a.txt.bak", "pre-versioning")
+	enableVersioning(t, client, bucketName)
+	putObject(t, client, bucketName, "a.txt", overwrite)
+
+	for _, maxKeys := range []int32{1, 2} {
+		var keys []string
+		var token *string
+		for {
+			page, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{
+				Bucket: aws.String(bucketName), MaxKeys: aws.Int32(maxKeys), ContinuationToken: token,
+			})
+			require.NoError(t, err)
+			for _, o := range page.Contents {
+				keys = append(keys, *o.Key)
+				if *o.Key == "a.txt" {
+					assert.Equal(t, int64(len(overwrite)), *o.Size,
+						"maxKeys=%d must list the current version's metadata", maxKeys)
+				}
+			}
+			if page.IsTruncated == nil || !*page.IsTruncated {
+				break
+			}
+			token = page.NextContinuationToken
+		}
+		assert.Equal(t, []string{"a.txt", "a.txt!between", "a.txt.bak"}, keys, "maxKeys=%d", maxKeys)
+	}
+}
+
+// CommonPrefixes derive from listable keys, so deleting the only pre-versioning
+// object under a prefix takes the prefix with it.
+func TestPreVersioningDeletedPrefixHidesCommonPrefix(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	putObject(t, client, bucketName, "p/k.txt", "pre-versioning")
+	enableVersioning(t, client, bucketName)
+	deleteObject(t, client, bucketName, "p/k.txt")
+
+	page, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{
+		Bucket: aws.String(bucketName), Delimiter: aws.String("/"),
+	})
+	require.NoError(t, err)
+	assert.Empty(t, page.Contents)
+	assert.Empty(t, page.CommonPrefixes, "no listable key remains under p/")
+}
+
+// A non-slash delimiter derives prefixes straight from base-path keys, so a
+// delete-marked null object must take its prefix along; a live key under the
+// same prefix brings it back.
+func TestPreVersioningDeletedKeyHidesCustomDelimiterPrefix(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	putObject(t, client, bucketName, "group-item", "pre-versioning")
+	putObject(t, client, bucketName, "solo", "pre-versioning")
+	enableVersioning(t, client, bucketName)
+	deleteObject(t, client, bucketName, "group-item")
+
+	listDashed := func() (keys, prefixes []string) {
+		page, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{
+			Bucket: aws.String(bucketName), Delimiter: aws.String("-"),
+		})
+		require.NoError(t, err)
+		for _, o := range page.Contents {
+			keys = append(keys, *o.Key)
+		}
+		for _, p := range page.CommonPrefixes {
+			prefixes = append(prefixes, *p.Prefix)
+		}
+		return
+	}
+
+	keys, prefixes := listDashed()
+	assert.Equal(t, []string{"solo"}, keys)
+	assert.Empty(t, prefixes, "the deleted key was the prefix's only backer")
+
+	putObject(t, client, bucketName, "group-live", "versioned")
+	keys, prefixes = listDashed()
+	assert.Equal(t, []string{"solo"}, keys)
+	assert.Equal(t, []string{"group-"}, prefixes, "a live key restores the prefix")
+}
+
+// A delete marker for a version-only key (never a base object) must not debit
+// the backers of a prefix a live null object still stands behind.
+func TestVersionOnlyMarkerLeavesForeignPrefixAlone(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	putObject(t, client, bucketName, "group-a", "pre-versioning")
+	enableVersioning(t, client, bucketName)
+	putObjectVersioned(t, client, bucketName, "group-b")
+	deleteObject(t, client, bucketName, "group-b")
+
+	page, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{
+		Bucket: aws.String(bucketName), Delimiter: aws.String("-"),
+	})
+	require.NoError(t, err)
+	assert.Empty(t, page.Contents)
+	require.Len(t, page.CommonPrefixes, 1, "group-a still backs the prefix")
+	assert.Equal(t, "group-", *page.CommonPrefixes[0].Prefix)
+}
+
+// Nested names (k, k!, k!!, ...) can hold more unresolved null objects than the
+// pending cap; the evicted key must still be settled, on any page size.
+func TestPreVersioningNestedNullObjectsBeyondCap(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	var live []string
+	for i := 0; i < 10; i++ {
+		key := "k" + strings.Repeat("!", i)
+		putObject(t, client, bucketName, key, "pre-versioning")
+		if i > 0 {
+			live = append(live, key)
+		}
+	}
+	enableVersioning(t, client, bucketName)
+	deleteObject(t, client, bucketName, "k")
+
+	sort.Strings(live)
+	for _, maxKeys := range []int32{0, 3, 9} {
+		assert.Equal(t, live, listAllKeys(t, client, bucketName, maxKeys),
+			"maxKeys=%d must not list the deleted key", maxKeys)
+	}
+}
+
+// A suspended-versioning write is the current null version; its .versions
+// sibling (whose latest pointer the write cleared) must not list it a second
+// time or resurrect an older version's metadata.
+func TestSuspendedNullObjectListsOnce(t *testing.T) {
+	client := getS3Client(t)
+	bucketName := getNewBucketName()
+	createBucket(t, client, bucketName)
+	defer deleteBucket(t, client, bucketName)
+
+	enableVersioning(t, client, bucketName)
+	putObject(t, client, bucketName, "k.txt", "versioned")
+	suspendVersioning(t, client, bucketName)
+	current := "suspended current"
+	putObject(t, client, bucketName, "k.txt", current)
+
+	page, err := client.ListObjectsV2(context.TODO(), &s3.ListObjectsV2Input{
+		Bucket: aws.String(bucketName),
+	})
+	require.NoError(t, err)
+	require.Len(t, page.Contents, 1, "one key must list exactly once")
+	assert.Equal(t, int64(len(current)), *page.Contents[0].Size, "the null version is current")
+}
diff --git a/test/s3/versioning/s3_versioning_pagination_stress_test.go b/test/s3/versioning/s3_versioning_pagination_stress_test.go
index f22074fab3..5da4f15f0f 100644
--- a/test/s3/versioning/s3_versioning_pagination_stress_test.go
+++ b/test/s3/versioning/s3_versioning_pagination_stress_test.go
@@ -3,6 +3,7 @@ package s3api
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
 	"strings"
 	"testing"
@@ -184,11 +185,11 @@ func TestVersioningPaginationOver1000Versions(t *testing.T) {
 			})
 			require.NoError(t, err, "Failed to get version at index %d", idx)
 
-			buf := make([]byte, len(expectedContent))
-			_, err = getResp.Body.Read(buf)
+			body, err := io.ReadAll(getResp.Body)
 			getResp.Body.Close()
+			require.NoError(t, err, "Failed to read version at index %d", idx)
 
-			assert.Equal(t, expectedContent, string(buf), "Content mismatch for version %d", idx+1)
+			assert.Equal(t, expectedContent, string(body), "Content mismatch for version %d", idx+1)
 		}
 	})
 }
diff --git a/test/s3tables/admin/admin_iceberg_pages_test.go b/test/s3tables/admin/admin_iceberg_pages_test.go
index 4b6b2e4102..e914c3d2a7 100644
--- a/test/s3tables/admin/admin_iceberg_pages_test.go
+++ b/test/s3tables/admin/admin_iceberg_pages_test.go
@@ -91,7 +91,11 @@ func TestMain(m *testing.M) {
 }
 
 func startCluster(testDir string) (*testCluster, error) {
-	ports, err := testutil.AllocatePorts(10)
+	ports, err := testutil.AllocatePorts(9)
+	if err != nil {
+		return nil, err
+	}
+	adminPorts, err := testutil.AllocateMiniPorts(1)
 	if err != nil {
 		return nil, err
 	}
@@ -99,7 +103,8 @@ func startCluster(testDir string) (*testCluster, error) {
 	volumePort, volumeGrpc := ports[2], ports[3]
 	filerPort, filerGrpc := ports[4], ports[5]
 	s3Port, s3Grpc := ports[6], ports[7]
-	adminPort, adminGrpc := ports[8], ports[9]
+	adminPort := adminPorts[0]
+	icebergPort := ports[8]
 
 	// Empty security.toml disables JWT auth.
 	if err := os.WriteFile(filepath.Join(testDir, "security.toml"), []byte("# test\n"), 0644); err != nil {
@@ -150,14 +155,15 @@ func startCluster(testDir string) (*testCluster, error) {
 			"-filer.port.grpc=" + strconv.Itoa(filerGrpc),
 			"-s3.port=" + strconv.Itoa(s3Port),
 			"-s3.port.grpc=" + strconv.Itoa(s3Grpc),
-			"-admin.port=" + strconv.Itoa(adminPort),
-			"-admin.port.grpc=" + strconv.Itoa(adminGrpc),
-			"-webdav.port=0",
+			"-webdav=false",    // Disable WebDAV
+			"-s3.port.lance=0", // Disable Lance
+			"-s3.port.iceberg=" + strconv.Itoa(icebergPort),
 			"-master.volumeSizeLimitMB=32",
 			"-ip=127.0.0.1",
 			"-master.peers=none",
 			"-s3.iam.readOnly=false",
 		}
+		args = append(args, testutil.MiniAdminArgs(adminPort)...)
 		os.Args = append([]string{"weed"}, args...)
 		glog.MaxSize = 1024 * 1024
 		for _, cmd := range command.Commands {
diff --git a/test/s3tables/catalog/Dockerfile.lance b/test/s3tables/catalog/Dockerfile.lance
new file mode 100644
index 0000000000..5824eeb1d7
--- /dev/null
+++ b/test/s3tables/catalog/Dockerfile.lance
@@ -0,0 +1,13 @@
+# Lance client container for Lance Namespace REST compatibility testing.
+# The point of this image is to exercise the namespace with the real client
+# rather than hand-built HTTP: every serious bug in this surface so far looked
+# fine to a request we wrote ourselves.
+FROM python:3.11-slim
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir lance-namespace pylance pyarrow
+
+COPY test_lance_namespace.py /app/
+
+CMD ["python3", "/app/test_lance_namespace.py", "--help"]
diff --git a/test/s3tables/catalog/duckdb_deterministic_location_test.go b/test/s3tables/catalog/duckdb_deterministic_location_test.go
index 8cccdddadc..256efb68c7 100644
--- a/test/s3tables/catalog/duckdb_deterministic_location_test.go
+++ b/test/s3tables/catalog/duckdb_deterministic_location_test.go
@@ -115,6 +115,9 @@ SELECT 'duckdb deterministic-location describe ok' AS marker;
 	t.Logf("DuckDB output:\n%s", outputStr)
 
 	if err != nil {
+		if testutil.IsIllegalInstruction(err) {
+			t.Skipf("DuckDB image cannot run on this CPU: %v", err)
+		}
 		// Tolerate environments where the Iceberg extension/version is too
 		// limited to exercise this code path. The intent is to gain
 		// coverage where it's available, not to require it everywhere.
diff --git a/test/s3tables/catalog/duckdb_oauth_test.go b/test/s3tables/catalog/duckdb_oauth_test.go
index 4d9eb1f1ba..aa151f48e3 100644
--- a/test/s3tables/catalog/duckdb_oauth_test.go
+++ b/test/s3tables/catalog/duckdb_oauth_test.go
@@ -60,7 +60,12 @@ func newOAuthTestEnv(t *testing.T) *oauthTestEnv {
 	}
 
 	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
-	if info, err := os.Stat(weedBinary); err != nil || info.IsDir() {
+	if info, err := os.Stat(weedBinary); err == nil && !info.IsDir() {
+		// Say which binary and how old it is. `make test` rebuilds first, but
+		// `go test` on its own happily runs a weeks-old binary and reports a
+		// pass for code that is not being exercised.
+		t.Logf("using %s, built %s", weedBinary, info.ModTime().Format(time.RFC3339))
+	} else {
 		weedBinary = "weed"
 		if _, err := exec.LookPath(weedBinary); err != nil {
 			t.Skip("weed binary not found, skipping integration test")
@@ -130,6 +135,8 @@ func (env *oauthTestEnv) start(t *testing.T) {
 	if env.s3ExternalURL != "" {
 		args = append(args, "-s3.externalUrl", env.s3ExternalURL)
 	}
+	args = append(args, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	args = append(args, "-s3.port.lance=0")
 
 	cmd := exec.CommandContext(ctx, env.weedBinary, args...)
 	cmd.Dir = env.dataDir
@@ -344,6 +351,9 @@ SELECT 'DuckDB Iceberg OAuth secret created successfully' as result;
 	t.Logf("DuckDB output:\n%s", outputStr)
 
 	if err != nil {
+		if testutil.IsIllegalInstruction(err) {
+			t.Skipf("DuckDB image cannot run on this CPU: %v", err)
+		}
 		if strings.Contains(outputStr, "iceberg extension is not available") ||
 			strings.Contains(outputStr, "Failed to load") {
 			t.Skip("Skipping: Iceberg extension not available in DuckDB Docker image")
@@ -372,6 +382,9 @@ SELECT 'DuckDB Iceberg OAuth secret created successfully' as result;
 			t.Logf("DuckDB fallback output:\n%s", fallbackStr)
 
 			if fallbackErr != nil {
+				if testutil.IsIllegalInstruction(fallbackErr) {
+					t.Skipf("DuckDB image cannot run on this CPU: %v", fallbackErr)
+				}
 				if strings.Contains(fallbackStr, "NotFound_404") && strings.Contains(fallbackStr, "/v1/oauth/tokens") {
 					t.Fatal("OAuth token endpoint returned 404 - the fix is not working")
 				}
diff --git a/test/s3tables/catalog/iceberg_catalog_test.go b/test/s3tables/catalog/iceberg_catalog_test.go
index 50d187de7f..d8490fa629 100644
--- a/test/s3tables/catalog/iceberg_catalog_test.go
+++ b/test/s3tables/catalog/iceberg_catalog_test.go
@@ -62,6 +62,8 @@ type TestEnvironment struct {
 	s3Port          int
 	s3GrpcPort      int
 	icebergPort     int
+	lancePort       int
+	adminPort       int
 	masterPort      int
 	masterGrpcPort  int
 	filerPort       int
@@ -92,7 +94,12 @@ func newTestEnvironmentForMain() (*TestEnvironment, error) {
 
 	// Check for weed binary
 	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
-	if _, err := os.Stat(weedBinary); os.IsNotExist(err) {
+	if info, statErr := os.Stat(weedBinary); statErr == nil {
+		// Name the binary and its age. `make test` rebuilds first, but a plain
+		// `go test` will happily drive a weeks-old binary and report a pass for
+		// code it never ran.
+		fmt.Fprintf(os.Stderr, "using %s, built %s\n", weedBinary, info.ModTime().Format(time.RFC3339))
+	} else if os.IsNotExist(statErr) {
 		weedBinary = "weed"
 		if _, err := exec.LookPath(weedBinary); err != nil {
 			return nil, fmt.Errorf("weed binary not found")
@@ -105,12 +112,16 @@ func newTestEnvironmentForMain() (*TestEnvironment, error) {
 		return nil, fmt.Errorf("create temp dir: %w", err)
 	}
 
-	// Allocate 9 unique ports atomically: s3, iceberg, s3Grpc, master, masterGrpc,
-	// filer, filerGrpc, volume, volumeGrpc
-	ports, err := testutil.AllocatePorts(9)
+	// Allocate 10 unique ports atomically: s3, iceberg, s3Grpc, master, masterGrpc,
+	// filer, filerGrpc, volume, volumeGrpc, lance
+	ports, err := testutil.AllocatePorts(10)
 	if err != nil {
 		return nil, fmt.Errorf("allocate ports: %w", err)
 	}
+	adminPorts, err := testutil.AllocateMiniPorts(1)
+	if err != nil {
+		return nil, fmt.Errorf("allocate admin port: %w", err)
+	}
 
 	return &TestEnvironment{
 		seaweedDir:      seaweedDir,
@@ -125,6 +136,8 @@ func newTestEnvironmentForMain() (*TestEnvironment, error) {
 		filerGrpcPort:   ports[6],
 		volumePort:      ports[7],
 		volumeGrpcPort:  ports[8],
+		lancePort:       ports[9],
+		adminPort:       adminPorts[0],
 		dockerAvailable: testutil.HasDocker(),
 	}, nil
 }
@@ -145,7 +158,7 @@ func (env *TestEnvironment) startSeaweedFSForMain() error {
 		}
 	}
 
-	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
+	miniArgs := append([]string{"mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -155,9 +168,12 @@ func (env *TestEnvironment) startSeaweedFSForMain() error {
 		"-s3.port", fmt.Sprintf("%d", env.s3Port),
 		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
 		"-s3.port.iceberg", fmt.Sprintf("%d", env.icebergPort),
+		"-s3.port.lance", fmt.Sprintf("%d", env.lancePort),
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(env.adminPort)...)
+	miniArgs = append(miniArgs, "-webdav=false")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 
@@ -211,6 +227,11 @@ func (env *TestEnvironment) IcebergURL() string {
 	return fmt.Sprintf("http://127.0.0.1:%d", env.icebergPort)
 }
 
+// LanceURL returns the Lance Namespace server URL
+func (env *TestEnvironment) LanceURL() string {
+	return fmt.Sprintf("http://127.0.0.1:%d", env.lancePort)
+}
+
 // TestIcebergConfig tests the /v1/config endpoint
 func TestIcebergConfig(t *testing.T) {
 	if testing.Short() {
@@ -252,7 +273,7 @@ func TestIcebergNamespaces(t *testing.T) {
 
 	// Create the default table bucket first via S3
 	bucketName := "warehouse-ns-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, bucketName, "")
 
 	// Test GET /v1/namespaces (should return empty list initially)
 	resp, err := http.Get(env.IcebergURL() + icebergPath(bucketName, "/v1/namespaces"))
@@ -275,7 +296,7 @@ func TestStageCreateAndFinalizeFlow(t *testing.T) {
 
 	env := sharedEnv
 	bucketName := "warehouse-stage-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, bucketName, "")
 
 	namespace := "stage_ns_" + randomSuffix()
 	tableName := "orders"
@@ -369,7 +390,7 @@ func TestCommitMissingTableWithoutAssertCreate(t *testing.T) {
 
 	env := sharedEnv
 	bucketName := "warehouse-missing-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, bucketName, "")
 
 	namespace := "stage_missing_assert_ns_" + randomSuffix()
 	tableName := "missing_table"
@@ -458,11 +479,16 @@ func icebergPath(prefix, path string) string {
 // The request is AWS V4 signed for SERVICE=s3tables so the S3 Tables
 // route matcher accepts it; signing with regular SERVICE=s3 would let
 // the request fall through to the S3 CreateBucket handler.
-func createTableBucket(t *testing.T, env *TestEnvironment, bucketName string) {
+// createTableBucket makes a table bucket of the given format. An empty format
+// leaves it to the server, which means ICEBERG.
+func createTableBucket(t *testing.T, env *TestEnvironment, bucketName, format string) {
 	t.Helper()
 
 	endpoint := fmt.Sprintf("http://localhost:%d/buckets", env.s3Port)
 	reqBody := fmt.Sprintf(`{"name":"%s"}`, bucketName)
+	if format != "" {
+		reqBody = fmt.Sprintf(`{"name":"%s","format":"%s"}`, bucketName, format)
+	}
 
 	req, err := http.NewRequest(http.MethodPut, endpoint, strings.NewReader(reqBody))
 	if err != nil {
@@ -548,6 +574,9 @@ SELECT 'Iceberg extension loaded successfully' as result;
 	output, err := cmd.CombinedOutput()
 	if err != nil {
 		t.Logf("DuckDB output: %s", output)
+		if testutil.IsIllegalInstruction(err) {
+			t.Skipf("DuckDB image cannot run on this CPU: %v", err)
+		}
 		// Check for expected errors in certain CI environments
 		outputStr := string(output)
 		if strings.Contains(outputStr, "iceberg extension is not available") ||
diff --git a/test/s3tables/catalog/issue_9103_test.go b/test/s3tables/catalog/issue_9103_test.go
index 4e00ab8f56..0d2f86b360 100644
--- a/test/s3tables/catalog/issue_9103_test.go
+++ b/test/s3tables/catalog/issue_9103_test.go
@@ -52,7 +52,7 @@ func TestIssue9103_ConfigDoesNotVendWarehousePrefix(t *testing.T) {
 
 	env := sharedEnv
 	bucketName := "warehouse-9103cfg-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, bucketName, "")
 
 	warehouse := fmt.Sprintf("s3://%s/", bucketName)
 	u := fmt.Sprintf("%s/v1/config?warehouse=%s", env.IcebergURL(), url.QueryEscape(warehouse))
@@ -88,7 +88,7 @@ func TestIssue9103_BareNamespacesListMissesNamespaceInAttachedBucket(t *testing.
 
 	env := sharedEnv
 	bucketName := "warehouse-9103ns-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, bucketName, "")
 
 	namespace := "ovirt"
 	status, _, err := doIcebergJSONRequest(env, http.MethodPost,
@@ -218,6 +218,9 @@ SELECT * FROM test_catalog.%s.%s LIMIT 0;
 	}
 
 	if runErr != nil {
+		if testutil.IsIllegalInstruction(runErr) {
+			t.Skipf("DuckDB image cannot run on this CPU: %v", runErr)
+		}
 		if strings.Contains(outStr, "does not exist because schema") &&
 			strings.Contains(outStr, namespace) {
 			t.Fatalf("reproduced issue #9103: DuckDB cannot see namespace %q after ATTACH 's3://%s/'; see output above",
diff --git a/test/s3tables/catalog/lance_client_test.go b/test/s3tables/catalog/lance_client_test.go
new file mode 100644
index 0000000000..a9abac6f42
--- /dev/null
+++ b/test/s3tables/catalog/lance_client_test.go
@@ -0,0 +1,68 @@
+package catalog
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// TestLanceNamespaceRealClient drives the namespace with the Lance client rather
+// than hand-built HTTP. The Go tests beside this one cover the catalog surface;
+// what this adds is that the location and storage_options the namespace vends
+// are actually enough to write and read a dataset, which needs the S3 layout
+// guard, the endpoint and the credentials all to be right at once.
+//
+// To run manually:
+//
+//	cd test/s3tables/catalog
+//	docker build -t lance-namespace-test -f Dockerfile.lance .
+func TestLanceNamespaceRealClient(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	env := sharedEnv
+	if !env.dockerAvailable {
+		t.Skip("Docker not available, skipping Lance client integration test")
+	}
+
+	bucketName := "lance-client-test-" + randomSuffix()
+	createTableBucket(t, env, bucketName, s3tables.FormatLance)
+
+	testDir := filepath.Join(env.seaweedDir, "test", "s3tables", "catalog")
+
+	buildCmd := exec.Command("docker", "build", "-t", "lance-namespace-test", "-f", "Dockerfile.lance", ".")
+	buildCmd.Dir = testDir
+	if out, err := buildCmd.CombinedOutput(); err != nil {
+		t.Fatalf("Failed to build test image: %v\n%s", err, string(out))
+	}
+
+	namespaceURL := fmt.Sprintf("http://host.docker.internal:%d", env.lancePort)
+	s3Endpoint := fmt.Sprintf("http://host.docker.internal:%d", env.s3Port)
+
+	cmd := exec.Command("docker", "run", "--rm",
+		"--add-host", "host.docker.internal:host-gateway",
+		"-v", fmt.Sprintf("%s:/app:ro", testDir),
+		"lance-namespace-test",
+		"python3", "/app/test_lance_namespace.py",
+		"--namespace-url", namespaceURL,
+		"--s3-endpoint", s3Endpoint,
+		"--bucket", bucketName,
+	)
+	cmd.Dir = testDir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	t.Logf("Running Lance client test against %s", namespaceURL)
+	if err := cmd.Run(); err != nil {
+		if testutil.IsIllegalInstruction(err) {
+			t.Skipf("Lance client image cannot run on this CPU: %v", err)
+		}
+		t.Errorf("Lance client test failed: %v", err)
+	}
+}
diff --git a/test/s3tables/catalog/lance_namespace_test.go b/test/s3tables/catalog/lance_namespace_test.go
new file mode 100644
index 0000000000..acf7dba96f
--- /dev/null
+++ b/test/s3tables/catalog/lance_namespace_test.go
@@ -0,0 +1,378 @@
+// Integration tests for the Lance Namespace REST server, driven against a live
+// gateway rather than an in-memory filer. The bugs this surface has produced -
+// a deregister that deleted the dataset, an S3 door that refused every Lance
+// file - all looked fine against a fake.
+package catalog
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// lanceCall posts to the Lance namespace and returns the status and body.
+func lanceCall(t *testing.T, env *TestEnvironment, method, path, body string) (int, []byte) {
+	t.Helper()
+	req, err := http.NewRequest(method, env.LanceURL()+path, strings.NewReader(body))
+	if err != nil {
+		t.Fatalf("build request: %v", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, path, err)
+	}
+	defer resp.Body.Close()
+	payload, _ := io.ReadAll(resp.Body)
+	return resp.StatusCode, payload
+}
+
+func lanceMust(t *testing.T, env *TestEnvironment, method, path, body string, want int) []byte {
+	t.Helper()
+	status, payload := lanceCall(t, env, method, path, body)
+	if status != want {
+		t.Fatalf("%s %s = %d (%s), want %d", method, path, status, payload, want)
+	}
+	return payload
+}
+
+// filerEntryExists reports whether a path exists on storage, which is how these
+// tests tell "the catalog forgot the table" from "the data is gone".
+func filerEntryExists(t *testing.T, env *TestEnvironment, path string) bool {
+	t.Helper()
+	url := fmt.Sprintf("http://127.0.0.1:%d%s", env.filerPort, path)
+	resp, err := http.Get(url)
+	if err != nil {
+		t.Fatalf("filer GET %s: %v", path, err)
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+	return resp.StatusCode == http.StatusOK
+}
+
+// lanceTestBucket makes a uniquely named table bucket of the given format. Most
+// tests want LANCE; the one that checks what the Lance surface hides needs an
+// Iceberg bucket, because a declared bucket holds one format only.
+func lanceTestBucket(t *testing.T, env *TestEnvironment, prefix, format string) string {
+	t.Helper()
+	bucket := prefix + "-" + randomSuffix()
+	createTableBucket(t, env, bucket, format)
+	return bucket
+}
+
+func TestLanceNamespaceLifecycle(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	env := sharedEnv
+	bucket := lanceTestBucket(t, env, "lance-ns", s3tables.FormatLance)
+
+	lanceMust(t, env, http.MethodPost, "/v1/namespace/"+bucket+"$sales/create", `{}`, http.StatusOK)
+	lanceMust(t, env, http.MethodPost, "/v1/namespace/"+bucket+"$sales/exists", `{}`, http.StatusOK)
+
+	// The root lists table buckets, which is the first namespace level here.
+	var roots struct {
+		Namespaces []string `json:"namespaces"`
+	}
+	if err := json.Unmarshal(lanceMust(t, env, http.MethodGet, "/v1/namespace/$/list", "", http.StatusOK), &roots); err != nil {
+		t.Fatalf("decode root listing: %v", err)
+	}
+	found := false
+	for _, name := range roots.Namespaces {
+		if name == bucket {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("root listing %v does not include %s", roots.Namespaces, bucket)
+	}
+
+	var children struct {
+		Namespaces []string `json:"namespaces"`
+	}
+	if err := json.Unmarshal(lanceMust(t, env, http.MethodGet, "/v1/namespace/"+bucket+"/list", "", http.StatusOK), &children); err != nil {
+		t.Fatalf("decode namespace listing: %v", err)
+	}
+	if len(children.Namespaces) != 1 || children.Namespaces[0] != "sales" {
+		t.Fatalf("namespace listing = %v, want [sales]", children.Namespaces)
+	}
+
+	// A namespace is never created as a side effect of naming one inside a
+	// bucket that does not exist.
+	status, _ := lanceCall(t, env, http.MethodPost, "/v1/namespace/nosuchbucket$ns/create", `{}`)
+	if status != http.StatusNotFound {
+		t.Fatalf("create under a missing bucket = %d, want 404", status)
+	}
+}
+
+func TestLanceTableLifecyclePreservesData(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	env := sharedEnv
+	bucket := lanceTestBucket(t, env, "lance-tbl", s3tables.FormatLance)
+	lanceMust(t, env, http.MethodPost, "/v1/namespace/"+bucket+"$ml/create", `{}`, http.StatusOK)
+
+	table := "/v1/table/" + bucket + "$ml$vectors"
+	var declared struct {
+		Location       string            `json:"location"`
+		StorageOptions map[string]string `json:"storage_options"`
+	}
+	if err := json.Unmarshal(lanceMust(t, env, http.MethodPost, table+"/declare", `{}`, http.StatusOK), &declared); err != nil {
+		t.Fatalf("decode declare: %v", err)
+	}
+	want := fmt.Sprintf("s3://%s/ml/vectors", bucket)
+	if declared.Location != want {
+		t.Fatalf("declared location = %q, want %q", declared.Location, want)
+	}
+
+	datasetPath := fmt.Sprintf("/buckets/%s/ml/vectors/", bucket)
+	if !filerEntryExists(t, env, datasetPath) {
+		t.Fatal("declare did not create the dataset directory")
+	}
+
+	var listed struct {
+		Tables []string `json:"tables"`
+	}
+	if err := json.Unmarshal(lanceMust(t, env, http.MethodGet, "/v1/namespace/"+bucket+"$ml/table/list", "", http.StatusOK), &listed); err != nil {
+		t.Fatalf("decode listing: %v", err)
+	}
+	if len(listed.Tables) != 1 || listed.Tables[0] != bucket+"$ml$vectors" {
+		t.Fatalf("table listing = %v, want the full identifier", listed.Tables)
+	}
+
+	// Deregistering forgets the table but keeps every byte. The catalog entry is
+	// the dataset directory, so a drop of the entry would take the data too.
+	lanceMust(t, env, http.MethodPost, table+"/deregister", `{}`, http.StatusOK)
+	lanceMust(t, env, http.MethodPost, table+"/exists", `{}`, http.StatusNotFound)
+	if !filerEntryExists(t, env, datasetPath) {
+		t.Fatal("deregister deleted the dataset")
+	}
+
+	registerBody := fmt.Sprintf(`{"location":%q}`, want)
+	lanceMust(t, env, http.MethodPost, table+"/register", registerBody, http.StatusOK)
+	lanceMust(t, env, http.MethodPost, table+"/exists", `{}`, http.StatusOK)
+
+	// Dropping is the operation that does remove the data.
+	lanceMust(t, env, http.MethodPost, table+"/drop", `{}`, http.StatusOK)
+	if filerEntryExists(t, env, datasetPath) {
+		t.Fatal("drop left the dataset behind")
+	}
+}
+
+// A Lance client must never resolve an Iceberg table's location, or it writes a
+// dataset over a table another engine owns.
+func TestLanceHidesIcebergTables(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	env := sharedEnv
+	// An Iceberg bucket, because a bucket that declares LANCE cannot hold an
+	// Iceberg table at all now. The invariant still matters from this side: the
+	// Lance surface can be pointed at any bucket, and must not describe or list
+	// a table whose format it does not serve.
+	bucket := lanceTestBucket(t, env, "lance-mixed", s3tables.FormatIceberg)
+	lanceMust(t, env, http.MethodPost, "/v1/namespace/"+bucket+"$mixed/create", `{}`, http.StatusOK)
+
+	createIcebergTable(t, env, bucket, "mixed", "ledger")
+
+	status, _ := lanceCall(t, env, http.MethodPost, "/v1/table/"+bucket+"$mixed$ledger/describe", `{}`)
+	if status != http.StatusNotFound {
+		t.Fatalf("describing an iceberg table through lance = %d, want 404", status)
+	}
+	status, _ = lanceCall(t, env, http.MethodPost, "/v1/table/"+bucket+"$mixed$ledger/declare", `{}`)
+	if status != http.StatusConflict {
+		t.Fatalf("declaring over an iceberg table = %d, want 409", status)
+	}
+	// And a new Lance table cannot be smuggled in beside it either.
+	status, _ = lanceCall(t, env, http.MethodPost, "/v1/table/"+bucket+"$mixed$vectors/declare", `{}`)
+	if status != http.StatusConflict {
+		t.Fatalf("declaring a lance table in an iceberg bucket = %d, want 409", status)
+	}
+
+	var listed struct {
+		Tables []string `json:"tables"`
+	}
+	if err := json.Unmarshal(lanceMust(t, env, http.MethodGet, "/v1/namespace/"+bucket+"$mixed/table/list", "", http.StatusOK), &listed); err != nil {
+		t.Fatalf("decode listing: %v", err)
+	}
+	if len(listed.Tables) != 0 {
+		t.Fatalf("lance listing shows iceberg tables: %v", listed.Tables)
+	}
+}
+
+// The S3 door validates every object written into a table bucket. A Lance
+// dataset's files have to get through it, or the catalog is decorative.
+func TestLanceFilesAreAcceptedByTheS3Door(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	env := sharedEnv
+	bucket := lanceTestBucket(t, env, "lance-layout", s3tables.FormatLance)
+	lanceMust(t, env, http.MethodPost, "/v1/namespace/"+bucket+"$ml/create", `{}`, http.StatusOK)
+	lanceMust(t, env, http.MethodPost, "/v1/table/"+bucket+"$ml$vectors/declare", `{}`, http.StatusOK)
+
+	accepted := []string{
+		"ml/vectors/data/0111111010111000110101116.lance",
+		"ml/vectors/_versions/18446744073709551614.manifest",
+		"ml/vectors/_versions/18446744073709551614.manifest-a3a292ad",
+		"ml/vectors/_transactions/0-ddb27ab7.txn",
+		"ml/vectors/_indices/85814508-fts/index.idx",
+		"ml/vectors/.lance-reserved",
+	}
+	for _, object := range accepted {
+		if status := putS3Object(t, env, bucket, object); status != http.StatusOK {
+			t.Errorf("PUT %s = %d, want 200", object, status)
+		}
+	}
+
+	// The guard still rejects files that belong to no table layout.
+	for _, object := range []string{"ml/vectors/random.txt", "ml/vectors/notadir/x.lance"} {
+		if status := putS3Object(t, env, bucket, object); status == http.StatusOK {
+			t.Errorf("PUT %s = 200, want a rejection", object)
+		}
+	}
+}
+
+// A Lance commit is a conditional PUT of the next manifest: object_store turns
+// PutMode::Create into If-None-Match: *, and lance treats the refusal as a
+// commit conflict and rebases. So the whole safety of concurrent writers rests
+// on this store answering that precondition atomically. It does, because the
+// gateway reduces the header to a filer WriteCondition evaluated at the
+// object's owner under a per-path lock.
+//
+// This is the reason the namespace does not manage versions itself.
+func TestLanceCommitPreconditionAdmitsOneWriter(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	env := sharedEnv
+	bucket := lanceTestBucket(t, env, "lance-commit", s3tables.FormatLance)
+	lanceMust(t, env, http.MethodPost, "/v1/namespace/"+bucket+"$ml/create", `{}`, http.StatusOK)
+	lanceMust(t, env, http.MethodPost, "/v1/table/"+bucket+"$ml$vectors/declare", `{}`, http.StatusOK)
+
+	const writers = 8
+	var wg sync.WaitGroup
+	statuses := make([]int, writers)
+	failures := make([]error, writers)
+	for i := 0; i < writers; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			// Not t.Fatalf: from a goroutine it ends only that goroutine, and
+			// the status stays zero, which reads as a bogus response later.
+			statuses[i], failures[i] = putIfAbsent(env, bucket, "ml/vectors/_versions/1.manifest")
+		}(i)
+	}
+	wg.Wait()
+
+	for i, err := range failures {
+		if err != nil {
+			t.Fatalf("writer %d could not reach the gateway: %v", i, err)
+		}
+	}
+
+	won, refused := 0, 0
+	for _, status := range statuses {
+		switch status {
+		case http.StatusOK:
+			won++
+		case http.StatusPreconditionFailed:
+			refused++
+		default:
+			t.Fatalf("unexpected status %d committing a manifest", status)
+		}
+	}
+	if won != 1 {
+		t.Fatalf("%d writers committed version 1; exactly one may win, %d were refused", won, refused)
+	}
+}
+
+// The namespace answers managed_versioning=false: the dataset owns its version
+// history, and a reader that never goes through this catalog still sees all of
+// it.
+func TestLanceDoesNotManageVersions(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	env := sharedEnv
+	bucket := lanceTestBucket(t, env, "lance-ver", s3tables.FormatLance)
+	lanceMust(t, env, http.MethodPost, "/v1/namespace/"+bucket+"$ml/create", `{}`, http.StatusOK)
+	table := "/v1/table/" + bucket + "$ml$vectors"
+
+	var declared struct {
+		ManagedVersioning bool `json:"managed_versioning"`
+	}
+	if err := json.Unmarshal(lanceMust(t, env, http.MethodPost, table+"/declare", `{}`, http.StatusOK), &declared); err != nil {
+		t.Fatalf("decode declare: %v", err)
+	}
+	if declared.ManagedVersioning {
+		t.Fatal("managed_versioning must be false; the dataset owns its versions")
+	}
+
+	// The version ops answer with the spec's Unsupported code rather than a
+	// bare 404, so a client that asks learns why.
+	status, _ := lanceCall(t, env, http.MethodPost, table+"/version/list", `{}`)
+	if status != http.StatusNotImplemented {
+		t.Fatalf("version/list = %d, want 501", status)
+	}
+}
+
+// putIfAbsent writes an object only if the key is free, the way a Lance commit
+// does. It returns an error rather than failing the test, so it is safe to call
+// from the racing goroutines.
+func putIfAbsent(env *TestEnvironment, bucket, object string) (int, error) {
+	url := fmt.Sprintf("http://127.0.0.1:%d/%s/%s", env.s3Port, bucket, object)
+	req, err := http.NewRequest(http.MethodPut, url, bytes.NewReader([]byte("manifest")))
+	if err != nil {
+		return 0, err
+	}
+	req.Header.Set("If-None-Match", "*")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return 0, err
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+	return resp.StatusCode, nil
+}
+
+// putS3Object writes an object through the S3 gateway and returns the status.
+func putS3Object(t *testing.T, env *TestEnvironment, bucket, object string) int {
+	t.Helper()
+	url := fmt.Sprintf("http://127.0.0.1:%d/%s/%s", env.s3Port, bucket, object)
+	req, err := http.NewRequest(http.MethodPut, url, bytes.NewReader([]byte("x")))
+	if err != nil {
+		t.Fatalf("build request: %v", err)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("PUT %s: %v", object, err)
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+	return resp.StatusCode
+}
+
+// createIcebergTable registers an ordinary Iceberg table so the mixed-catalog
+// tests have one to be confused by.
+func createIcebergTable(t *testing.T, env *TestEnvironment, bucket, namespace, name string) {
+	t.Helper()
+	body := fmt.Sprintf(`{"name":%q,"schema":{"type":"struct","schema-id":0,"fields":[{"id":1,"name":"id","required":false,"type":"long"}]}}`, name)
+	url := fmt.Sprintf("%s/v1/%s/namespaces/%s/tables", env.IcebergURL(), bucket, namespace)
+	resp, err := http.Post(url, "application/json", strings.NewReader(body))
+	if err != nil {
+		t.Fatalf("create iceberg table: %v", err)
+	}
+	defer resp.Body.Close()
+	payload, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("create iceberg table = %d: %s", resp.StatusCode, payload)
+	}
+}
diff --git a/test/s3tables/catalog/pyiceberg_test.go b/test/s3tables/catalog/pyiceberg_test.go
index 54f4f84b80..0a9fa6f1d1 100644
--- a/test/s3tables/catalog/pyiceberg_test.go
+++ b/test/s3tables/catalog/pyiceberg_test.go
@@ -34,7 +34,7 @@ func TestPyIcebergRestCatalog(t *testing.T) {
 
 	// Create the test bucket first
 	bucketName := "pyiceberg-compat-test-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, bucketName, "")
 
 	// Build the test working directory path
 	testDir := filepath.Join(env.seaweedDir, "test", "s3tables", "catalog")
@@ -93,7 +93,7 @@ func TestPyIcebergRestCatalogAuthenticated(t *testing.T) {
 
 	// Create the test bucket first (using unauthenticated request, which works with DefaultAllow)
 	bucketName := "pyiceberg-auth-test-" + randomSuffix()
-	createTableBucket(t, env, bucketName)
+	createTableBucket(t, env, bucketName, "")
 
 	// Build the test working directory path
 	testDir := filepath.Join(env.seaweedDir, "test", "s3tables", "catalog")
diff --git a/test/s3tables/catalog/test_lance_namespace.py b/test/s3tables/catalog/test_lance_namespace.py
new file mode 100755
index 0000000000..1c160add7a
--- /dev/null
+++ b/test/s3tables/catalog/test_lance_namespace.py
@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+"""Drive the SeaweedFS Lance Namespace with the real Lance client.
+
+The catalog half can be checked with plain HTTP, and the Go integration tests
+do. What only a real client proves is that the location and storage_options it
+hands back are enough to write and read a dataset: the layout guard on the S3
+door, the endpoint and allow_http options, and the credentials all have to be
+right at once, and a hand-built request checks none of that.
+"""
+
+import argparse
+import sys
+import warnings
+
+warnings.filterwarnings("ignore")
+
+import lance
+import lance_namespace as ln
+import pyarrow as pa
+
+
+def sample_table():
+    return pa.table(
+        {
+            "id": pa.array([1, 2, 3, 4]),
+            "vec": pa.array([[1.0, 2.0]] * 4, type=pa.list_(pa.float32(), 2)),
+        }
+    )
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--namespace-url", required=True, help="Lance namespace REST URL")
+    parser.add_argument("--s3-endpoint", required=True, help="S3 endpoint the dataset lives behind")
+    parser.add_argument("--bucket", required=True, help="table bucket to use, already created")
+    parser.add_argument("--access-key", default="any")
+    parser.add_argument("--secret-key", default="any")
+    args = parser.parse_args()
+
+    ns = ln.connect("rest", {"uri": args.namespace_url})
+    ns.create_namespace(ln.CreateNamespaceRequest(id=[args.bucket, "ml"]))
+    table_id = [args.bucket, "ml", "vectors"]
+
+    declared = ns.declare_table(ln.DeclareTableRequest(id=table_id))
+    print(f"declared {table_id} at {declared.location}")
+    if not declared.location:
+        print("FAIL: declare returned no location", file=sys.stderr)
+        return 1
+
+    described = ns.describe_table(ln.DescribeTableRequest(id=table_id))
+    if described.location != declared.location:
+        print(
+            f"FAIL: describe location {described.location} != declare {declared.location}",
+            file=sys.stderr,
+        )
+        return 1
+
+    options = dict(described.storage_options or {})
+    print(f"storage options from the namespace: {sorted(options)}")
+    # The endpoint is overridden with the container's view of the same gateway:
+    # what the namespace vends is correct for its own host, and a test harness
+    # bound to a wildcard address vends nothing at all. That the namespace vends
+    # a usable endpoint when it can is covered by the unit tests; what matters
+    # here is that everything else it hands back is enough to reach the data.
+    options["aws_endpoint"] = args.s3_endpoint
+    options["allow_http"] = "true"
+    # A deployment without STS still needs credentials to sign with.
+    options.setdefault("aws_access_key_id", args.access_key)
+    options.setdefault("aws_secret_access_key", args.secret_key)
+
+    lance.write_dataset(sample_table(), described.location, storage_options=options,
+                        mode="overwrite")
+    dataset = lance.dataset(described.location, storage_options=options)
+    rows = dataset.count_rows()
+    print(f"wrote and read back {rows} rows at version {dataset.version}")
+    if rows != 4:
+        print(f"FAIL: read back {rows} rows, want 4", file=sys.stderr)
+        return 1
+
+    # The table is listed, and a client that skips the namespace entirely can
+    # still open the dataset by URI.
+    listed = ns.list_tables(ln.ListTablesRequest(id=[args.bucket, "ml"])).tables
+    if f"{args.bucket}$ml$vectors" not in listed:
+        print(f"FAIL: {listed} does not contain the table", file=sys.stderr)
+        return 1
+
+    if lance.dataset(declared.location, storage_options=options).count_rows() != 4:
+        print("FAIL: the dataset is not readable straight off its URI", file=sys.stderr)
+        return 1
+
+    # Deregistering hides the table and keeps the data, which is the difference
+    # between it and a drop.
+    ns.deregister_table(ln.DeregisterTableRequest(id=table_id))
+    if f"{args.bucket}$ml$vectors" in ns.list_tables(ln.ListTablesRequest(id=[args.bucket, "ml"])).tables:
+        print("FAIL: a deregistered table is still listed", file=sys.stderr)
+        return 1
+    if lance.dataset(declared.location, storage_options=options).count_rows() != 4:
+        print("FAIL: deregister destroyed the dataset", file=sys.stderr)
+        return 1
+
+    print("PASS")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/test/s3tables/catalog/test_rest_catalog.py b/test/s3tables/catalog/test_rest_catalog.py
index 84b6ffb455..36433a8855 100644
--- a/test/s3tables/catalog/test_rest_catalog.py
+++ b/test/s3tables/catalog/test_rest_catalog.py
@@ -201,6 +201,7 @@ def main():
                     "uri": args.catalog_url,
                     "warehouse": args.warehouse,
                     "prefix": args.prefix,
+                    "auth": {"type": "noop"},
                     "s3.anonymous": "true",  # Disable AWS request signing for unauthenticated access
                 }
             )
diff --git a/test/s3tables/catalog/test_rest_catalog_auth.py b/test/s3tables/catalog/test_rest_catalog_auth.py
index 626d9480e7..5b7d2a1ce7 100644
--- a/test/s3tables/catalog/test_rest_catalog_auth.py
+++ b/test/s3tables/catalog/test_rest_catalog_auth.py
@@ -173,6 +173,7 @@ def main():
                     "uri": args.catalog_url,
                     "warehouse": args.warehouse,
                     "prefix": args.prefix,
+                    "auth": {"type": "noop"},
                     "s3.access-key-id": args.access_key,
                     "s3.secret-access-key": args.secret_key,
                 }
diff --git a/test/s3tables/catalog_clickhouse/README.md b/test/s3tables/catalog_clickhouse/README.md
index 139070593c..ffa1b70bc4 100644
--- a/test/s3tables/catalog_clickhouse/README.md
+++ b/test/s3tables/catalog_clickhouse/README.md
@@ -15,7 +15,9 @@ database engine.
 4. Creates a second table and populates it with three rows by running a
    PyIceberg writer container (`Dockerfile.writer` + `append_rows.py`) before
    ClickHouse connects, so the snapshot is part of the catalog's first scan.
-5. Starts `clickhouse/clickhouse-server:25.8` and waits for the HTTP interface.
+5. Starts the ClickHouse server container (`clickhouse/clickhouse-server:25.8`
+   by default, overridable via `CLICKHOUSE_IMAGE`) and waits for the HTTP
+   interface.
 6. Attaches the catalog with `CREATE DATABASE ... ENGINE = DataLakeCatalog`
    (`catalog_type = 'rest'`), authenticating to the catalog via the OAuth2
    client-credentials flow (`catalog_credential` + `oauth_server_uri`) and to
@@ -38,6 +40,12 @@ database engine.
      SeaweedFS catalog repairs the manifests at commit time and stamps a
      default name mapping on the table, so PyIceberg (`read_rows.py`, a strict
      reader) must return the rows ClickHouse wrote.
+   - `CreateTableViaCatalog`: ClickHouse creates a table through the catalog
+     (`CREATE TABLE ... ENGINE = IcebergS3(...)` with
+     `write_full_path_in_iceberg_metadata = 1`), the test verifies it is
+     registered in the REST catalog, inserts rows, reads them back, and has
+     PyIceberg read them too. ClickHouse only issues the catalog createTable
+     from 26.4, so the subtest skips on older servers.
 
 Queries go through ClickHouse's HTTP interface (port 8123, mapped to a
 dynamically allocated host port), so the test needs no ClickHouse client
@@ -52,8 +60,16 @@ cd test/s3tables/catalog_clickhouse
 go test -v -timeout 20m .
 ```
 
+The ClickHouse image defaults to `clickhouse/clickhouse-server:25.8` and can
+be overridden:
+
+```bash
+CLICKHOUSE_IMAGE=clickhouse/clickhouse-server:latest go test -v -timeout 20m .
+```
+
 The test requires Docker. The GitHub Actions job runs on `ubuntu-22.04` and
-executes the test for pull requests.
+executes the test for pull requests against both the pinned baseline image
+and `latest`, so new ClickHouse releases are covered as they ship.
 
 ## Configuration
 
diff --git a/test/s3tables/catalog_clickhouse/clickhouse_catalog_test.go b/test/s3tables/catalog_clickhouse/clickhouse_catalog_test.go
index b89eb6a686..b85629fed4 100644
--- a/test/s3tables/catalog_clickhouse/clickhouse_catalog_test.go
+++ b/test/s3tables/catalog_clickhouse/clickhouse_catalog_test.go
@@ -14,6 +14,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -22,7 +23,7 @@ import (
 )
 
 const (
-	clickhouseImage        = "clickhouse/clickhouse-server:25.8"
+	clickhouseDefaultImage = "clickhouse/clickhouse-server:25.8"
 	clickhouseDatabase     = "iceberg_catalog"
 	clickhouseHTTPPort     = 8123
 	clickhouseStartTimeout = 2 * time.Minute
@@ -195,6 +196,92 @@ func TestClickHouseIcebergCatalog(t *testing.T) {
 			t.Fatalf("PyIceberg read of ClickHouse-written table = %q, want %q", rows, want)
 		}
 	})
+
+	// From 26.4 ClickHouse registers CREATE TABLE on a DataLakeCatalog database
+	// with the REST catalog; older versions write storage files without a
+	// catalog createTable, so the subtest skips there.
+	t.Run("CreateTableViaCatalog", func(t *testing.T) {
+		version := env.mustQuery(t, "SELECT version()")
+		if !versionAtLeast(version, 26, 4) {
+			t.Skipf("catalog CREATE TABLE requires ClickHouse 26.4+, server is %s", version)
+		}
+
+		ddlTable := "chddl_" + randomString(6)
+		ddlRef := fmt.Sprintf("%s.`%s.%s`", clickhouseDatabase, namespace, ddlTable)
+		location := fmt.Sprintf("http://host.docker.internal:%d/%s/%s/%s/", env.s3Port, tableBucket, namespace, ddlTable)
+		create := fmt.Sprintf("CREATE TABLE %s (id Int64, label Nullable(String)) ENGINE = IcebergS3('%s', '%s', '%s')",
+			ddlRef, location, env.accessKey, env.secretKey)
+		if _, err := env.query(create, map[string]string{
+			"allow_experimental_database_iceberg": "1",
+			// Without this ClickHouse registers a bare "/namespace/table"
+			// location, which the catalog rejects.
+			"write_full_path_in_iceberg_metadata": "1",
+		}); err != nil {
+			t.Fatalf("%s: %v\nContainer logs:\n%s", create, err, clickhouseContainerLogs(env.clickhouseContainer))
+		}
+
+		// The table must exist in the catalog itself, not just in ClickHouse.
+		token := requestIcebergOAuthToken(t, env)
+		listing := doIcebergJSONRequest(t, env, token, http.MethodGet,
+			fmt.Sprintf("/v1/%s/namespaces/%s/tables", url.PathEscape(tableBucket), url.PathEscape(namespace)),
+			nil, http.StatusOK)
+		var tables struct {
+			Identifiers []struct {
+				Namespace []string `json:"namespace"`
+				Name      string   `json:"name"`
+			} `json:"identifiers"`
+		}
+		if err := json.Unmarshal([]byte(listing), &tables); err != nil {
+			t.Fatalf("decode catalog table listing: %v\n%s", err, listing)
+		}
+		registered := false
+		for _, id := range tables.Identifiers {
+			if id.Name == ddlTable && len(id.Namespace) == 1 && id.Namespace[0] == namespace {
+				registered = true
+				break
+			}
+		}
+		if !registered {
+			t.Fatalf("catalog table listing is missing %s: %s", ddlTable, listing)
+		}
+
+		insert := fmt.Sprintf("INSERT INTO %s (id, label) VALUES (1, 'alpha'), (2, 'beta')", ddlRef)
+		if _, err := env.query(insert, map[string]string{"allow_experimental_insert_into_iceberg": "1"}); err != nil {
+			t.Fatalf("%s: %v\nContainer logs:\n%s", insert, err, clickhouseContainerLogs(env.clickhouseContainer))
+		}
+
+		out := env.mustQuery(t, fmt.Sprintf("SELECT id, label FROM %s ORDER BY id", ddlRef))
+		if want := "1\talpha\n2\tbeta"; out != want {
+			t.Fatalf("ClickHouse read-back = %q, want %q", out, want)
+		}
+
+		rows := readIcebergRows(t, env, tableBucket, []string{namespace}, ddlTable)
+		if want := "1,alpha\n2,beta"; rows != want {
+			t.Fatalf("PyIceberg read of ClickHouse-created table = %q, want %q", rows, want)
+		}
+	})
+}
+
+// TestVersionAtLeast exercises the gate that decides whether the catalog DDL
+// subtest runs.
+func TestVersionAtLeast(t *testing.T) {
+	cases := []struct {
+		version      string
+		major, minor int
+		want         bool
+	}{
+		{"26.7.3.19", 26, 4, true},
+		{"26.4.5.143", 26, 4, true},
+		{"26.3.17.110", 26, 4, false},
+		{"25.8.29.51", 26, 4, false},
+		{"27.1.1.1", 26, 4, true},
+		{"weird", 26, 4, false},
+	}
+	for _, c := range cases {
+		if got := versionAtLeast(c.version, c.major, c.minor); got != c.want {
+			t.Errorf("versionAtLeast(%q, %d, %d) = %v, want %v", c.version, c.major, c.minor, got, c.want)
+		}
+	}
 }
 
 // NewTestEnvironment allocates ports and returns an environment for the test.
@@ -277,7 +364,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel
 
-	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
+	miniArgs := append([]string{"mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -291,7 +378,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Dir = env.dataDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
@@ -393,13 +482,38 @@ func (env *TestEnvironment) startClickHouseContainer(t *testing.T) {
 		"--ulimit", "nofile=262144:262144",
 		"-e", "CLICKHOUSE_USER="+clickhouseUser,
 		"-e", "CLICKHOUSE_PASSWORD="+clickhousePassword,
-		clickhouseImage,
+		clickhouseImage(),
 	)
 	if output, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("Failed to start ClickHouse container: %v\n%s", err, string(output))
 	}
 }
 
+// clickhouseImage returns the server image under test. CI overrides it via
+// CLICKHOUSE_IMAGE to also run the suite against latest, so new ClickHouse
+// releases are exercised without a code change.
+func clickhouseImage() string {
+	if img := os.Getenv("CLICKHOUSE_IMAGE"); img != "" {
+		return img
+	}
+	return clickhouseDefaultImage
+}
+
+// versionAtLeast reports whether a "major.minor.*" version string is at least
+// major.minor.
+func versionAtLeast(version string, major, minor int) bool {
+	parts := strings.Split(strings.TrimSpace(version), ".")
+	if len(parts) < 2 {
+		return false
+	}
+	gotMajor, errMajor := strconv.Atoi(parts[0])
+	gotMinor, errMinor := strconv.Atoi(parts[1])
+	if errMajor != nil || errMinor != nil {
+		return false
+	}
+	return gotMajor > major || (gotMajor == major && gotMinor >= minor)
+}
+
 // clickhouseContainerLogs returns the tail of the container logs for diagnostics.
 func clickhouseContainerLogs(containerName string) string {
 	cmd := exec.Command("docker", "logs", "--tail", "200", containerName)
@@ -757,6 +871,11 @@ func requireClickHouseRuntime(t *testing.T) {
 	if !hasDocker() {
 		t.Skip("Docker not available, skipping ClickHouse integration test")
 	}
+	// ClickHouse builds for x86-64-v3 (AVX2) since 26.5; on a CPU without it
+	// the binary dies on SIGILL inside the entrypoint before the server can
+	// come up.
+	testutil.RequireImageRunnable(t,
+		"--entrypoint", "clickhouse", clickhouseImage(), "local", "--query", "SELECT 1")
 }
 
 // hasDocker reports whether `docker version` can run, which we treat as a
diff --git a/test/s3tables/catalog_doris/doris_catalog_test.go b/test/s3tables/catalog_doris/doris_catalog_test.go
index b7b071b3f2..3a8aaf9e22 100644
--- a/test/s3tables/catalog_doris/doris_catalog_test.go
+++ b/test/s3tables/catalog_doris/doris_catalog_test.go
@@ -303,7 +303,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel
 
-	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
+	miniArgs := append([]string{"mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -317,7 +317,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Dir = env.dataDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/s3tables/catalog_dremio/dremio_catalog_test.go b/test/s3tables/catalog_dremio/dremio_catalog_test.go
index 09eed0055e..35fedb00f1 100644
--- a/test/s3tables/catalog_dremio/dremio_catalog_test.go
+++ b/test/s3tables/catalog_dremio/dremio_catalog_test.go
@@ -289,7 +289,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel
 
-	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
+	miniArgs := append([]string{"mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -303,7 +303,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Dir = env.dataDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/s3tables/catalog_duckdb_lance/Dockerfile.seed b/test/s3tables/catalog_duckdb_lance/Dockerfile.seed
new file mode 100644
index 0000000000..40b9202b1b
--- /dev/null
+++ b/test/s3tables/catalog_duckdb_lance/Dockerfile.seed
@@ -0,0 +1,15 @@
+# Seeds a Lance dataset so DuckDB has something to read. The catalog records
+# where a table lives and does not carry its data, so the writing half is
+# pylance; DuckDB then reads it over S3 with no catalog involved.
+FROM python:3.11-slim
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir \
+    "lance-namespace==0.8.6" \
+    "pylance==10.0.0" \
+    "pyarrow==25.0.1"
+
+COPY seed_table.py /app/
+
+CMD ["python3", "/app/seed_table.py", "--help"]
diff --git a/test/s3tables/catalog_duckdb_lance/README.md b/test/s3tables/catalog_duckdb_lance/README.md
new file mode 100644
index 0000000000..bf1656c04e
--- /dev/null
+++ b/test/s3tables/catalog_duckdb_lance/README.md
@@ -0,0 +1,66 @@
+# DuckDB Lance Integration Test
+
+Reads SeaweedFS Lance tables from DuckDB's `lance` core extension, the
+counterpart of the DuckDB Iceberg tests in `../catalog/`.
+
+## What this one proves that the others do not
+
+The LanceDB and Spark suites go through the catalog. DuckDB does not: it reaches
+the data over S3 with no namespace involved. That exercises the other half of the
+design — a table bucket's layout is a valid Lance dataset directory, so a table
+stays readable when the catalog is not in the path.
+
+## What it does
+
+`TestDuckDBLance`:
+
+1. Starts a `weed mini` cluster with S3 and the Lance Namespace enabled.
+2. Creates a table bucket declared `LANCE`, then declares a table through the
+   namespace and writes a dataset into it with pylance.
+3. Runs `duckdb_lance_ops.sql` in `duckdb/duckdb:latest`.
+
+| Step | What it proves |
+| --- | --- |
+| `__lance_scan(s3://…)` | DuckDB reads a table this catalog created |
+| `DESCRIBE` | the schema survived, vector column included |
+| `WHERE id < 5` | the filter path |
+| `lance_vector_search` | vector search over data behind SeaweedFS |
+| a `.lance` path | the replacement scan works on a suffixed path |
+| a suffix-less path | and does **not** see one without the suffix |
+
+## The `.lance` suffix
+
+DuckDB's replacement scan — `SELECT * FROM 's3://…'` — recognises a Lance dataset
+by a `.lance` path suffix. Tables created through this catalog deliberately have
+none: the catalog entry *is* the dataset directory, table names may not contain a
+dot, and a suffix would leak into ARNs and policies.
+
+So from DuckDB, a table in a SeaweedFS table bucket is read with
+`__lance_scan('s3://bucket/namespace/table')` rather than the bare `FROM 's3://…'`
+form. The test asserts both halves, so if the extension ever recognises a
+suffix-less directory the test fails and tells us to update the documentation.
+
+## Credentials
+
+```sql
+CREATE SECRET seaweedfs (
+    TYPE lance,
+    ACCESS_KEY_ID '…', SECRET_ACCESS_KEY '…',
+    REGION 'us-east-1',
+    ENDPOINT 'http://seaweed:8333',
+    ALLOW_HTTP true,
+    VIRTUAL_HOSTED_STYLE_REQUEST false
+);
+```
+
+Those are object_store's key names, the same as everywhere else Lance touches
+storage.
+
+## Running it
+
+    cd test/s3tables/catalog_duckdb_lance
+    (cd ../../../weed && go build .)     # the harness runs this binary
+    go test -run TestDuckDBLance -v -timeout 30m .
+
+Skipped without Docker, in `-short` mode, and if the DuckDB image cannot load the
+extension.
diff --git a/test/s3tables/catalog_duckdb_lance/duckdb_lance_ops.sql b/test/s3tables/catalog_duckdb_lance/duckdb_lance_ops.sql
new file mode 100644
index 0000000000..2a64fd1877
--- /dev/null
+++ b/test/s3tables/catalog_duckdb_lance/duckdb_lance_ops.sql
@@ -0,0 +1,48 @@
+-- Read a SeaweedFS Lance table from DuckDB.
+--
+-- The lance extension reaches the data over S3 rather than through the
+-- namespace, so what is exercised here is the layout on the S3 door and the
+-- credentials, not the catalog protocol. That is the point: this is the client
+-- that proves a Lance table stays readable without a catalog at all.
+--
+-- Placeholders are substituted by the Go harness: __ENDPOINT__, __KEY__,
+-- __SECRET__, __TABLE__ (s3://bucket/ns/table), __SUFFIXED__ (the same data at a
+-- path ending in .lance).
+
+INSTALL lance;
+LOAD lance;
+
+CREATE SECRET seaweedfs (
+    TYPE lance,
+    ACCESS_KEY_ID '__KEY__',
+    SECRET_ACCESS_KEY '__SECRET__',
+    REGION 'us-east-1',
+    ENDPOINT '__ENDPOINT__',
+    ALLOW_HTTP true,
+    VIRTUAL_HOSTED_STYLE_REQUEST false
+);
+
+-- 1. The table the catalog created, read by URI. A table bucket's layout is a
+--    valid Lance dataset directory, which is what makes this possible.
+SELECT 'scan_rows=' || count(*) FROM __lance_scan('__TABLE__');
+
+-- 2. Its schema survived, vector column included. Ordered, because string_agg
+--    over an unordered relation is free to return the names in any order.
+SELECT 'scan_columns=' || string_agg(column_name, ',' ORDER BY column_name)
+FROM (DESCRIBE SELECT * FROM __lance_scan('__TABLE__'));
+
+-- 3. A filter, so it is not only a full scan.
+SELECT 'filtered_rows=' || count(*) FROM __lance_scan('__TABLE__') WHERE id < 5;
+
+-- 4. Vector search, which is what the format is for. No index is built here, so
+--    this is a brute-force search; the ids nearest the query are what matters.
+SELECT 'nearest=' || string_agg(id::VARCHAR, ',' ORDER BY _distance ASC, id ASC)
+FROM lance_vector_search('__TABLE__', 'vector',
+                         [1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0], k := 3);
+
+-- 5. DuckDB's replacement scan recognises a path by its .lance suffix. Tables
+--    this catalog creates deliberately have no suffix - the name is the table's
+--    name, and a suffix would leak into ARNs and policies - so the bare
+--    SELECT ... FROM 's3://…' form does not see them, and __lance_scan is the
+--    way in. This asserts both halves so that a change upstream is noticed.
+SELECT 'suffixed_rows=' || count(*) FROM '__SUFFIXED__';
diff --git a/test/s3tables/catalog_duckdb_lance/duckdb_lance_test.go b/test/s3tables/catalog_duckdb_lance/duckdb_lance_test.go
new file mode 100644
index 0000000000..5cefd12059
--- /dev/null
+++ b/test/s3tables/catalog_duckdb_lance/duckdb_lance_test.go
@@ -0,0 +1,392 @@
+// Package duckdblance reads SeaweedFS Lance tables from DuckDB's lance
+// extension, the counterpart of the DuckDB Iceberg tests next door.
+//
+// DuckDB reaches the data over S3 rather than through the namespace, so what
+// this proves is the other half of the design: a table bucket's layout is a
+// valid Lance dataset directory, and a table stays readable with no catalog in
+// the path at all. It also pins the one place that costs us - DuckDB's
+// replacement scan recognises a dataset by its .lance suffix, which tables
+// created through this catalog deliberately do not have.
+package duckdblance
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+)
+
+const (
+	// Tracks whatever DuckDB users are actually running; the lance extension is
+	// a core extension, so there is nothing to pin beyond the image.
+	duckDBImage = "duckdb/duckdb:latest"
+	// Seeds a dataset for DuckDB to read.
+	seedImage      = "seaweedfs-lance-seed"
+	startupTimeout = 60 * time.Second
+	clientTimeout  = 15 * time.Minute
+	seededRows     = 128
+)
+
+// TestDuckDBLance reads a table this catalog created, from DuckDB.
+func TestDuckDBLance(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	if !hasDocker() {
+		t.Skip("Docker not available, skipping DuckDB Lance integration test")
+	}
+
+	env := newEnvironment(t)
+	defer env.cleanup()
+
+	env.start(t)
+
+	bucket := "duckdb-" + randomSuffix()
+	env.createTableBucket(t, bucket)
+
+	requireDuckDBLance(t)
+	buildSeedImage(t)
+	env.seedTable(t, bucket)
+	env.runDuckDB(t, bucket)
+}
+
+type environment struct {
+	weedBinary string
+	dataDir    string
+	bindIP     string
+
+	masterPort     int
+	masterGrpcPort int
+	volumePort     int
+	volumeGrpcPort int
+	filerPort      int
+	filerGrpcPort  int
+	s3Port         int
+	s3GrpcPort     int
+	lancePort      int
+
+	accessKey string
+	secretKey string
+
+	weedCancel context.CancelFunc
+	weedCmd    *exec.Cmd
+}
+
+func newEnvironment(t *testing.T) *environment {
+	t.Helper()
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("get working directory: %v", err)
+	}
+	seaweedDir := wd
+	for i := 0; i < 5; i++ {
+		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
+			break
+		}
+		seaweedDir = filepath.Dir(seaweedDir)
+	}
+
+	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
+	if info, statErr := os.Stat(weedBinary); statErr == nil && !info.IsDir() {
+		// `make test` builds first; a plain `go test` will otherwise drive a
+		// binary from days ago and report a pass for code it never ran.
+		t.Logf("using %s, built %s", weedBinary, info.ModTime().Format(time.RFC3339))
+	} else {
+		weedBinary = "weed"
+		if _, err := exec.LookPath(weedBinary); err != nil {
+			t.Skip("weed binary not found, skipping integration test")
+		}
+	}
+
+	dataDir, err := os.MkdirTemp("", "seaweed-duckdb-lance-test-*")
+	if err != nil {
+		t.Fatalf("create temp dir: %v", err)
+	}
+
+	ports := testutil.MustAllocatePorts(t, 9)
+	return &environment{
+		weedBinary:     weedBinary,
+		dataDir:        dataDir,
+		bindIP:         testutil.FindBindIP(),
+		masterPort:     ports[0],
+		masterGrpcPort: ports[1],
+		volumePort:     ports[2],
+		volumeGrpcPort: ports[3],
+		filerPort:      ports[4],
+		filerGrpcPort:  ports[5],
+		s3Port:         ports[6],
+		s3GrpcPort:     ports[7],
+		lancePort:      ports[8],
+		accessKey:      "AKIAIOSFODNN7EXAMPLE",
+		secretKey:      "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+	}
+}
+
+func (env *environment) start(t *testing.T) {
+	t.Helper()
+
+	iamConfigPath, err := testutil.WriteIAMConfig(env.dataDir, env.accessKey, env.secretKey)
+	if err != nil {
+		t.Fatalf("write IAM config: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	env.weedCancel = cancel
+
+	miniArgs := append([]string{"mini",
+		"-master.port", fmt.Sprintf("%d", env.masterPort),
+		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
+		"-volume.port", fmt.Sprintf("%d", env.volumePort),
+		"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort),
+		"-filer.port", fmt.Sprintf("%d", env.filerPort),
+		"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort),
+		"-s3.port", fmt.Sprintf("%d", env.s3Port),
+		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
+		"-s3.port.lance", fmt.Sprintf("%d", env.lancePort),
+		"-s3.config", iamConfigPath,
+		"-ip", env.bindIP,
+		"-ip.bind", "0.0.0.0",
+		"-dir", env.dataDir,
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.iceberg=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
+	cmd.Dir = env.dataDir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Env = append(os.Environ(),
+		"AWS_ACCESS_KEY_ID="+env.accessKey,
+		"AWS_SECRET_ACCESS_KEY="+env.secretKey,
+	)
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("start SeaweedFS: %v", err)
+	}
+	env.weedCmd = cmd
+
+	// The namespace answers /v1/table once it is serving, which is a cheaper
+	// readiness check than waiting on a bucket that does not exist yet.
+	url := fmt.Sprintf("http://%s:%d/v1/table", env.bindIP, env.lancePort)
+	if !waitForHTTP(url, startupTimeout) {
+		t.Fatalf("the Lance namespace did not become ready at %s", url)
+	}
+}
+
+// waitForHTTP polls until the URL answers at all. An auth refusal counts: it
+// means the server is up, which is the only thing being waited on.
+func waitForHTTP(url string, timeout time.Duration) bool {
+	client := &http.Client{Timeout: 2 * time.Second}
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		resp, err := client.Get(url)
+		if err != nil {
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		status := resp.StatusCode
+		resp.Body.Close()
+		if status < 500 {
+			return true
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	return false
+}
+
+func (env *environment) cleanup() {
+	if env.weedCancel != nil {
+		env.weedCancel()
+	}
+	if env.weedCmd != nil {
+		_ = env.weedCmd.Wait()
+	}
+	if env.dataDir != "" {
+		_ = os.RemoveAll(env.dataDir)
+	}
+}
+
+// createTableBucket makes the bucket LanceDB will read through, declared LANCE
+// so the catalog refuses anything of another format in it.
+func (env *environment) createTableBucket(t *testing.T, bucket string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, env.weedBinary, "shell",
+		fmt.Sprintf("-master=%s:%d.%d", env.bindIP, env.masterPort, env.masterGrpcPort),
+	)
+	cmd.Stdin = strings.NewReader(fmt.Sprintf(
+		"s3tables.bucket -create -name %s -format LANCE -account 000000000000\nexit\n", bucket))
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("create table bucket %s: %v\n%s", bucket, err, out)
+	}
+	// weed shell reports a command's own failure on stdout and still exits 0, so
+	// the exit code alone would let a missing bucket through and turn a setup
+	// failure into a confusing engine failure later.
+	if !env.tableBucketExists(t, bucket) {
+		t.Fatalf("table bucket %s was not created:\n%s", bucket, out)
+	}
+	t.Logf("created LANCE table bucket %s", bucket)
+}
+
+// tableBucketExists asks the namespace, which lists table buckets at its root.
+func (env *environment) tableBucketExists(t *testing.T, bucket string) bool {
+	t.Helper()
+
+	url := fmt.Sprintf("http://%s:%d/v1/namespace/%s/exists", env.bindIP, env.lancePort, bucket)
+	resp, err := http.Post(url, "application/json", strings.NewReader("{}"))
+	if err != nil {
+		t.Fatalf("ask the namespace whether %s exists: %v", bucket, err)
+	}
+	defer resp.Body.Close()
+	return resp.StatusCode == http.StatusOK
+}
+
+// runSpark runs the SQL driver inside the stock Spark image. The connector is
+// pulled from Maven at submit time, the way the Iceberg Spark suite pulls its
+// runtime, so nothing has to be built here.
+// requireDuckDBLance skips rather than fails when the image cannot load the
+// extension, so a DuckDB build without it reads as "not applicable" rather than
+// as a broken catalog.
+func requireDuckDBLance(t *testing.T) {
+	t.Helper()
+
+	const ready = "lance extension ready"
+	cmd := exec.Command("docker", "run", "--rm", "--entrypoint", "duckdb", duckDBImage,
+		"-c", fmt.Sprintf("INSTALL lance; LOAD lance; SELECT '%s' AS marker;", ready))
+	out, err := cmd.CombinedOutput()
+	if err != nil || !strings.Contains(string(out), ready) {
+		t.Skipf("DuckDB image cannot load the lance extension: %v\n%s", err, out)
+	}
+}
+
+func buildSeedImage(t *testing.T) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "docker", "build", "-t", seedImage, "-f", "Dockerfile.seed", ".")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("build the seed image: %v\n%s", err, out)
+	}
+}
+
+// seedTable declares a table through the namespace and writes a dataset into
+// it, which is the split the catalog serves: it records where a table lives and
+// does not carry its data.
+func (env *environment) seedTable(t *testing.T, bucket string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), clientTimeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "docker", "run", "--rm",
+		"--add-host", "host.docker.internal:host-gateway",
+		"-e", "AWS_ACCESS_KEY_ID="+env.accessKey,
+		"-e", "AWS_SECRET_ACCESS_KEY="+env.secretKey,
+		"-e", "AWS_REGION=us-east-1",
+		seedImage,
+		"python3", "/app/seed_table.py",
+		"--namespace-url", fmt.Sprintf("http://host.docker.internal:%d", env.lancePort),
+		"--s3-endpoint", fmt.Sprintf("http://host.docker.internal:%d", env.s3Port),
+		"--bucket", bucket,
+		"--rows", fmt.Sprintf("%d", seededRows),
+		"--access-key", env.accessKey,
+		"--secret-key", env.secretKey,
+	)
+	out, err := cmd.CombinedOutput()
+	t.Logf("seeder:\n%s", out)
+	if err != nil {
+		t.Fatalf("seeding the table failed: %v", err)
+	}
+}
+
+// runDuckDB substitutes the endpoint and paths into the SQL and runs it.
+func (env *environment) runDuckDB(t *testing.T, bucket string) {
+	t.Helper()
+
+	sqlBytes, err := os.ReadFile("duckdb_lance_ops.sql")
+	if err != nil {
+		t.Fatalf("read the SQL: %v", err)
+	}
+	table := fmt.Sprintf("s3://%s/ml/embeddings", bucket)
+	sql := strings.NewReplacer(
+		"__ENDPOINT__", fmt.Sprintf("http://host.docker.internal:%d", env.s3Port),
+		"__KEY__", env.accessKey,
+		"__SECRET__", env.secretKey,
+		"__TABLE__", table,
+		"__SUFFIXED__", table+"-direct.lance",
+	).Replace(string(sqlBytes))
+
+	ctx, cancel := context.WithTimeout(context.Background(), clientTimeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "docker", "run", "--rm", "-i",
+		"--add-host", "host.docker.internal:host-gateway",
+		"--entrypoint", "duckdb", duckDBImage, "-c", sql)
+	out, err := cmd.CombinedOutput()
+	t.Logf("DuckDB output:\n%s", out)
+	if err != nil {
+		t.Fatalf("the DuckDB query failed: %v", err)
+	}
+
+	output := string(out)
+	for _, want := range []string{
+		fmt.Sprintf("scan_rows=%d", seededRows),
+		"scan_columns=id,title,vector",
+		"filtered_rows=5",
+		"nearest=1,0,2",
+		fmt.Sprintf("suffixed_rows=%d", seededRows),
+	} {
+		if !strings.Contains(output, want) {
+			t.Fatalf("DuckDB did not report %q", want)
+		}
+	}
+
+	// The other half of the suffix rule: a table this catalog created has no
+	// .lance suffix, so DuckDB's replacement scan does not see it and
+	// __lance_scan is the way in. If this ever starts working, the docs saying
+	// otherwise are wrong.
+	bare := exec.CommandContext(ctx, "docker", "run", "--rm", "-i",
+		"--add-host", "host.docker.internal:host-gateway",
+		"--entrypoint", "duckdb", duckDBImage,
+		"-c", fmt.Sprintf("INSTALL lance; LOAD lance; SELECT count(*) FROM '%s';", table))
+	bareOut, bareErr := bare.CombinedOutput()
+	// DuckDB exits nonzero for any error, so the exit status alone does not tell
+	// "the replacement scan refused the path" from "the query never ran": require
+	// the catalog error either way.
+	if !strings.Contains(string(bareOut), "does not exist") {
+		t.Fatalf("a suffix-less path did not fail the way the docs say it does (%v); "+
+			"if the replacement scan now reads it, update them:\n%s", bareErr, bareOut)
+	}
+	t.Logf("a suffix-less path is not seen by the replacement scan, as expected")
+}
+
+// hasDocker reports whether a Docker daemon answers. Bounded, because an
+// unhealthy daemon makes `docker version` hang, and this runs before the test
+// has a timeout of its own: better to skip than to eat the whole budget.
+func hasDocker() bool {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	return exec.CommandContext(ctx, "docker", "version").Run() == nil
+}
+
+func randomSuffix() string {
+	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
+	suffix := make([]byte, 8)
+	for i := range suffix {
+		suffix[i] = charset[rand.Intn(len(charset))]
+	}
+	return string(suffix)
+}
diff --git a/test/s3tables/catalog_duckdb_lance/seed_table.py b/test/s3tables/catalog_duckdb_lance/seed_table.py
new file mode 100644
index 0000000000..051f2f519f
--- /dev/null
+++ b/test/s3tables/catalog_duckdb_lance/seed_table.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Declare a table through the namespace and write a dataset into it.
+
+Also writes the same rows to a second path whose name ends in `.lance`, because
+DuckDB's replacement scan recognises a dataset by that suffix and tables created
+through this catalog do not have one. The test asserts both behaviours so a
+change upstream is noticed rather than silently making the docs wrong.
+"""
+
+import argparse
+import sys
+import warnings
+
+warnings.filterwarnings("ignore")
+
+import lance
+import lance_namespace as ln
+import pyarrow as pa
+
+DIM = 8
+
+
+def rows(count):
+    return pa.table(
+        {
+            "id": pa.array(list(range(count)), type=pa.int64()),
+            "title": pa.array([f"row-{i}" for i in range(count)]),
+            "vector": pa.array(
+                [[float(i) + d for d in range(DIM)] for i in range(count)],
+                type=pa.list_(pa.float32(), DIM),
+            ),
+        }
+    )
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--namespace-url", required=True)
+    parser.add_argument("--s3-endpoint", required=True)
+    parser.add_argument("--bucket", required=True)
+    parser.add_argument("--namespace", default="ml")
+    parser.add_argument("--table", default="embeddings")
+    parser.add_argument("--rows", type=int, default=128)
+    parser.add_argument("--access-key", default="any")
+    parser.add_argument("--secret-key", default="any")
+    args = parser.parse_args()
+
+    storage = {
+        "aws_endpoint": args.s3_endpoint,
+        "allow_http": "true",
+        "aws_access_key_id": args.access_key,
+        "aws_secret_access_key": args.secret_key,
+        "aws_region": "us-east-1",
+    }
+
+    ns = ln.connect("rest", {"uri": args.namespace_url})
+    ns.create_namespace(ln.CreateNamespaceRequest(id=[args.bucket], mode="EXIST_OK"))
+    ns.create_namespace(
+        ln.CreateNamespaceRequest(id=[args.bucket, args.namespace], mode="EXIST_OK")
+    )
+    declared = ns.declare_table(
+        ln.DeclareTableRequest(id=[args.bucket, args.namespace, args.table])
+    )
+    lance.write_dataset(rows(args.rows), declared.location, storage_options=storage,
+                        mode="overwrite")
+    print(f"seeded {args.rows} rows at {declared.location}")
+
+    # The same data under a name DuckDB's replacement scan recognises. Written
+    # directly rather than declared, because a table name containing a dot is
+    # not a valid catalog name.
+    suffixed = f"s3://{args.bucket}/{args.namespace}/{args.table}-direct.lance"
+    lance.write_dataset(rows(args.rows), suffixed, storage_options=storage,
+                        mode="overwrite")
+    print(f"seeded {args.rows} rows at {suffixed}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/test/s3tables/catalog_lancedb/Dockerfile.client b/test/s3tables/catalog_lancedb/Dockerfile.client
new file mode 100644
index 0000000000..29d6ffd720
--- /dev/null
+++ b/test/s3tables/catalog_lancedb/Dockerfile.client
@@ -0,0 +1,22 @@
+# LanceDB client for the SeaweedFS Lance Namespace integration test.
+#
+# The Iceberg suites point Spark, Trino and ClickHouse at the catalog; this is
+# the same idea for Lance. LanceDB connects with connect_namespace("rest", ...),
+# which speaks the routes this catalog implements, so what it exercises is the
+# protocol rather than requests we wrote ourselves.
+FROM python:3.11-slim
+
+WORKDIR /app
+
+# Pinned to the versions this suite was verified against. An unrelated upstream
+# release should not be able to change what an old commit reproduces, and this
+# client is the thing under test as much as the server is.
+RUN pip install --no-cache-dir \
+    "lancedb==0.37.1" \
+    "lance-namespace==0.8.6" \
+    "pylance==10.0.0" \
+    "pyarrow==25.0.1"
+
+COPY lancedb_ops.py /app/
+
+CMD ["python3", "/app/lancedb_ops.py", "--help"]
diff --git a/test/s3tables/catalog_lancedb/README.md b/test/s3tables/catalog_lancedb/README.md
new file mode 100644
index 0000000000..c165c32a9b
--- /dev/null
+++ b/test/s3tables/catalog_lancedb/README.md
@@ -0,0 +1,56 @@
+# LanceDB Integration Test
+
+Drives the SeaweedFS Lance Namespace with [LanceDB](https://lancedb.com), the way
+`catalog_spark`, `catalog_trino` and `catalog_clickhouse` drive the Iceberg REST
+catalog with their engines.
+
+## Why a real client
+
+Every serious bug in this catalog so far looked correct to a request written by
+hand: a deregister that deleted the dataset, an S3 door that refused every Lance
+file, a namespace that listed tables it would then deny. A hand-built HTTP test
+checks the shape of a response. A client checks whether the response is *usable* —
+that the location it hands back, the storage options beside it and the layout
+rules on the S3 door all line up at once.
+
+LanceDB connects with `connect_namespace("rest", ...)`, which speaks the routes
+this catalog implements, so what runs here is the protocol rather than our own
+idea of it.
+
+## What it does
+
+`TestLanceDBNamespace`:
+
+1. Starts a `weed mini` cluster with S3 and the Lance Namespace enabled.
+2. Creates a table bucket declared `LANCE`, so the catalog refuses tables of any
+   other format in it.
+3. Builds `Dockerfile.client` (LanceDB, pylance, lance-namespace) and runs
+   `lancedb_ops.py` against the namespace.
+
+Inside the container:
+
+| Step | What it proves |
+| --- | --- |
+| seed a table | the namespace's location and credentials are enough to write |
+| `table_names` | the catalog is browsable through LanceDB |
+| `open_table` | LanceDB resolves a table through the catalog and reads it |
+| schema check | the vector column survived the round trip |
+| `create_index` | an IVF_PQ index builds, and its files land through the S3 door's layout rules |
+| `search(...)` | approximate search over that index, on data behind SeaweedFS |
+| `where("id < 5")` | so does the scan path, not only the index |
+| `create_table` | LanceDB declares through the namespace and writes the data itself |
+| `create_table` with pushdown | either the client falls back and the table is complete, or the catalog refuses with the spec's Unsupported and leaves nothing behind |
+| direct `lance.dataset(uri)` | the catalog stays optional; the dataset opens without it |
+
+The seeding is pylance rather than LanceDB, because the namespace records where
+a table lives and does not carry its data. That split is the design, not a
+limitation of the test.
+
+## Running it
+
+    cd test/s3tables/catalog_lancedb
+    (cd ../../../weed && go build .)     # the harness runs this binary
+    go test -run TestLanceDBNamespace -v -timeout 30m .
+
+Skipped without Docker, and in `-short` mode. The first run builds the client
+image, which takes a few minutes; later runs reuse it.
diff --git a/test/s3tables/catalog_lancedb/lancedb_catalog_test.go b/test/s3tables/catalog_lancedb/lancedb_catalog_test.go
new file mode 100644
index 0000000000..be45fd7f18
--- /dev/null
+++ b/test/s3tables/catalog_lancedb/lancedb_catalog_test.go
@@ -0,0 +1,296 @@
+// Package lancedb drives the SeaweedFS Lance Namespace with LanceDB, the way
+// the catalog_spark, catalog_trino and catalog_clickhouse suites drive the
+// Iceberg REST catalog with their engines.
+//
+// A catalog is only as good as what a real client can do with it. Every serious
+// bug in this surface so far - a deregister that deleted the dataset, an S3 door
+// that refused every Lance file, a namespace that listed tables it would then
+// deny - looked correct to a request written by hand.
+package lancedb
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+)
+
+const (
+	clientImage    = "seaweedfs-lancedb-test"
+	startupTimeout = 60 * time.Second
+	clientTimeout  = 15 * time.Minute
+)
+
+// TestLanceDBNamespace runs LanceDB against the namespace end to end: it lists
+// what the catalog holds, opens a table through it, searches the vectors, and
+// reads the same dataset straight off its URI to show the catalog stays
+// optional.
+func TestLanceDBNamespace(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	if !hasDocker() {
+		t.Skip("Docker not available, skipping LanceDB integration test")
+	}
+
+	env := newEnvironment(t)
+	defer env.cleanup()
+
+	env.start(t)
+
+	bucket := "lancedb-" + randomSuffix()
+	env.createTableBucket(t, bucket)
+
+	buildClientImage(t)
+	env.runClient(t, bucket)
+}
+
+type environment struct {
+	weedBinary string
+	dataDir    string
+	bindIP     string
+
+	masterPort     int
+	masterGrpcPort int
+	volumePort     int
+	volumeGrpcPort int
+	filerPort      int
+	filerGrpcPort  int
+	s3Port         int
+	s3GrpcPort     int
+	lancePort      int
+
+	accessKey string
+	secretKey string
+
+	weedCancel context.CancelFunc
+	weedCmd    *exec.Cmd
+}
+
+func newEnvironment(t *testing.T) *environment {
+	t.Helper()
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("get working directory: %v", err)
+	}
+	seaweedDir := wd
+	for i := 0; i < 5; i++ {
+		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
+			break
+		}
+		seaweedDir = filepath.Dir(seaweedDir)
+	}
+
+	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
+	if info, statErr := os.Stat(weedBinary); statErr == nil && !info.IsDir() {
+		// `make test` builds first; a plain `go test` will otherwise drive a
+		// binary from days ago and report a pass for code it never ran.
+		t.Logf("using %s, built %s", weedBinary, info.ModTime().Format(time.RFC3339))
+	} else {
+		weedBinary = "weed"
+		if _, err := exec.LookPath(weedBinary); err != nil {
+			t.Skip("weed binary not found, skipping integration test")
+		}
+	}
+
+	dataDir, err := os.MkdirTemp("", "seaweed-lancedb-test-*")
+	if err != nil {
+		t.Fatalf("create temp dir: %v", err)
+	}
+
+	ports := testutil.MustAllocatePorts(t, 9)
+	return &environment{
+		weedBinary:     weedBinary,
+		dataDir:        dataDir,
+		bindIP:         testutil.FindBindIP(),
+		masterPort:     ports[0],
+		masterGrpcPort: ports[1],
+		volumePort:     ports[2],
+		volumeGrpcPort: ports[3],
+		filerPort:      ports[4],
+		filerGrpcPort:  ports[5],
+		s3Port:         ports[6],
+		s3GrpcPort:     ports[7],
+		lancePort:      ports[8],
+		accessKey:      "AKIAIOSFODNN7EXAMPLE",
+		secretKey:      "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+	}
+}
+
+func (env *environment) start(t *testing.T) {
+	t.Helper()
+
+	iamConfigPath, err := testutil.WriteIAMConfig(env.dataDir, env.accessKey, env.secretKey)
+	if err != nil {
+		t.Fatalf("write IAM config: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	env.weedCancel = cancel
+
+	miniArgs := append([]string{"mini",
+		"-master.port", fmt.Sprintf("%d", env.masterPort),
+		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
+		"-volume.port", fmt.Sprintf("%d", env.volumePort),
+		"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort),
+		"-filer.port", fmt.Sprintf("%d", env.filerPort),
+		"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort),
+		"-s3.port", fmt.Sprintf("%d", env.s3Port),
+		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
+		"-s3.port.lance", fmt.Sprintf("%d", env.lancePort),
+		"-s3.config", iamConfigPath,
+		"-ip", env.bindIP,
+		"-ip.bind", "0.0.0.0",
+		"-dir", env.dataDir,
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.iceberg=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
+	cmd.Dir = env.dataDir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Env = append(os.Environ(),
+		"AWS_ACCESS_KEY_ID="+env.accessKey,
+		"AWS_SECRET_ACCESS_KEY="+env.secretKey,
+	)
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("start SeaweedFS: %v", err)
+	}
+	env.weedCmd = cmd
+
+	// The namespace answers /v1/table once it is serving, which is a cheaper
+	// readiness check than waiting on a bucket that does not exist yet.
+	url := fmt.Sprintf("http://%s:%d/v1/table", env.bindIP, env.lancePort)
+	if !waitForHTTP(url, startupTimeout) {
+		t.Fatalf("the Lance namespace did not become ready at %s", url)
+	}
+}
+
+// waitForHTTP polls until the URL answers at all. An auth refusal counts: it
+// means the server is up, which is the only thing being waited on.
+func waitForHTTP(url string, timeout time.Duration) bool {
+	client := &http.Client{Timeout: 2 * time.Second}
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		resp, err := client.Get(url)
+		if err != nil {
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		status := resp.StatusCode
+		resp.Body.Close()
+		if status < 500 {
+			return true
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	return false
+}
+
+func (env *environment) cleanup() {
+	if env.weedCancel != nil {
+		env.weedCancel()
+	}
+	if env.weedCmd != nil {
+		_ = env.weedCmd.Wait()
+	}
+	if env.dataDir != "" {
+		_ = os.RemoveAll(env.dataDir)
+	}
+}
+
+// createTableBucket makes the bucket LanceDB will read through, declared LANCE
+// so the catalog refuses anything of another format in it.
+func (env *environment) createTableBucket(t *testing.T, bucket string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, env.weedBinary, "shell",
+		fmt.Sprintf("-master=%s:%d.%d", env.bindIP, env.masterPort, env.masterGrpcPort),
+	)
+	cmd.Stdin = strings.NewReader(fmt.Sprintf(
+		"s3tables.bucket -create -name %s -format LANCE -account 000000000000\nexit\n", bucket))
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("create table bucket %s: %v\n%s", bucket, err, out)
+	}
+	t.Logf("created LANCE table bucket %s", bucket)
+}
+
+func buildClientImage(t *testing.T) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "docker", "build",
+		"-t", clientImage, "-f", "Dockerfile.client", ".")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("build the LanceDB client image: %v\n%s", err, out)
+	}
+}
+
+func (env *environment) runClient(t *testing.T, bucket string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), clientTimeout)
+	defer cancel()
+
+	// The container reaches the gateway through the host gateway address, which
+	// is not the address the namespace advertises to its own clients.
+	namespaceURL := fmt.Sprintf("http://host.docker.internal:%d", env.lancePort)
+	s3Endpoint := fmt.Sprintf("http://host.docker.internal:%d", env.s3Port)
+
+	cmd := exec.CommandContext(ctx, "docker", "run", "--rm",
+		"--add-host", "host.docker.internal:host-gateway",
+		// Also in the environment, not only in storage_options: LanceDB takes
+		// some paths through the options the namespace vends, and a gateway
+		// without STS vends none, leaving lance's provider chain to find them.
+		"-e", "AWS_ACCESS_KEY_ID="+env.accessKey,
+		"-e", "AWS_SECRET_ACCESS_KEY="+env.secretKey,
+		"-e", "AWS_REGION=us-east-1",
+		"-e", "AWS_ENDPOINT_URL="+s3Endpoint,
+		"-e", "AWS_ALLOW_HTTP=true",
+		clientImage,
+		"python3", "/app/lancedb_ops.py",
+		"--namespace-url", namespaceURL,
+		"--s3-endpoint", s3Endpoint,
+		"--bucket", bucket,
+		"--access-key", env.accessKey,
+		"--secret-key", env.secretKey,
+	)
+	out, err := cmd.CombinedOutput()
+	t.Logf("LanceDB client output:\n%s", out)
+	if err != nil {
+		if testutil.IsIllegalInstruction(err) {
+			t.Skipf("LanceDB client image cannot run on this CPU: %v", err)
+		}
+		t.Fatalf("the LanceDB client failed: %v", err)
+	}
+	if !strings.Contains(string(out), "PASS") {
+		t.Fatalf("the LanceDB client did not report PASS")
+	}
+}
+
+func hasDocker() bool {
+	return exec.Command("docker", "version").Run() == nil
+}
+
+func randomSuffix() string {
+	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
+	suffix := make([]byte, 8)
+	for i := range suffix {
+		suffix[i] = charset[rand.Intn(len(charset))]
+	}
+	return string(suffix)
+}
diff --git a/test/s3tables/catalog_lancedb/lancedb_ops.py b/test/s3tables/catalog_lancedb/lancedb_ops.py
new file mode 100644
index 0000000000..9f8fe1d447
--- /dev/null
+++ b/test/s3tables/catalog_lancedb/lancedb_ops.py
@@ -0,0 +1,244 @@
+#!/usr/bin/env python3
+"""Drive the SeaweedFS Lance Namespace with LanceDB.
+
+The existing client test uses `lance_namespace` and `pylance` directly, which is
+the protocol's reference client. LanceDB is what people actually point at a
+catalog: it connects with `connect_namespace("rest", ...)`, lists what is there,
+opens a table and searches it. This checks the catalog against that path, the
+way the Spark, Trino and ClickHouse suites check the Iceberg one.
+
+Everything it prints is either "PASS" or a line starting with FAIL, so the Go
+harness can report the first real failure rather than a stack trace.
+"""
+
+import argparse
+import sys
+import warnings
+
+warnings.filterwarnings("ignore")
+
+import lance
+import lance_namespace as ln
+import lancedb
+import pyarrow as pa
+
+DIM = 8
+
+
+def sample_rows(count):
+    """A vector table, which is the only kind worth putting in Lance."""
+    return pa.table(
+        {
+            "id": pa.array(list(range(count)), type=pa.int64()),
+            "title": pa.array([f"row-{i}" for i in range(count)]),
+            "vector": pa.array(
+                [[float(i) + d for d in range(DIM)] for i in range(count)],
+                type=pa.list_(pa.float32(), DIM),
+            ),
+        }
+    )
+
+
+def seed_table(namespace_url, storage, bucket, namespace, table, rows):
+    """Declares a table through the namespace and writes a dataset into it.
+
+    LanceDB reads through the catalog; the writing half is pylance, because the
+    namespace records where a table lives and does not carry its data.
+    """
+    ns = ln.connect("rest", {"uri": namespace_url})
+    ns.create_namespace(
+        ln.CreateNamespaceRequest(id=[bucket], mode="EXIST_OK")
+    )
+    ns.create_namespace(
+        ln.CreateNamespaceRequest(id=[bucket, namespace], mode="EXIST_OK")
+    )
+    table_id = [bucket, namespace, table]
+    declared = ns.declare_table(ln.DeclareTableRequest(id=table_id))
+    lance.write_dataset(
+        sample_rows(rows), declared.location, storage_options=storage, mode="overwrite"
+    )
+    print(f"seeded {rows} rows at {declared.location}")
+    return declared.location
+
+
+def check(condition, message):
+    if not condition:
+        print(f"FAIL: {message}", file=sys.stderr)
+        raise SystemExit(1)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--namespace-url", required=True)
+    parser.add_argument("--s3-endpoint", required=True)
+    parser.add_argument("--bucket", required=True)
+    parser.add_argument("--namespace", default="ml")
+    parser.add_argument("--table", default="embeddings")
+    # Enough rows for an IVF_PQ index to be worth building, which is the point
+    # of step 4: without one, a search is a brute-force scan.
+    parser.add_argument("--rows", type=int, default=1024)
+    parser.add_argument("--access-key", default="any")
+    parser.add_argument("--secret-key", default="any")
+    args = parser.parse_args()
+
+    # The namespace vends an endpoint correct for its own host; a container
+    # reaches the same gateway by another name, so the endpoint is overridden
+    # here and the credentials filled in for a deployment without STS.
+    storage = {
+        "aws_endpoint": args.s3_endpoint,
+        "allow_http": "true",
+        "aws_access_key_id": args.access_key,
+        "aws_secret_access_key": args.secret_key,
+        "aws_region": "us-east-1",
+    }
+
+    location = seed_table(
+        args.namespace_url, storage, args.bucket, args.namespace, args.table, args.rows
+    )
+
+    print(f"lancedb {lancedb.__version__} connecting to {args.namespace_url}")
+    db = lancedb.connect_namespace(
+        "rest", {"uri": args.namespace_url}, storage_options=storage
+    )
+
+    # 1. The catalog is browsable: the bucket is a namespace, and the table is
+    #    in it under the name the namespace gave it.
+    tables = list(db.table_names(namespace_path=[args.bucket, args.namespace], limit=100))
+    print(f"table_names -> {tables}")
+    check(
+        any(args.table in name for name in tables),
+        f"{args.table} is not listed in {tables}",
+    )
+
+    # 2. Opening it goes through the catalog: LanceDB asks the namespace where
+    #    the table is and reads it from there.
+    # storage_options is passed per call as well as on the connection: what the
+    # namespace vends for a table is merged in, and a deployment without STS
+    # vends no credentials, which is what the client would otherwise be left with.
+    table = db.open_table(
+        args.table,
+        namespace_path=[args.bucket, args.namespace],
+        storage_options=storage,
+    )
+    count = table.count_rows()
+    print(f"open_table -> {count} rows")
+    check(count == args.rows, f"read {count} rows, want {args.rows}")
+
+    # 3. The schema survived the round trip, vector column included. This is the
+    #    part a catalog that only records a location cannot fake.
+    names = table.schema.names
+    print(f"schema -> {names}")
+    check("vector" in names and "title" in names, f"schema lost columns: {names}")
+
+    # 4. Build a vector index, then search it. Both halves matter: an index
+    #    writes files into a directory of the table the S3 door has to admit -
+    #    the layout guard has refused a Lance directory before - and without one
+    #    a search is a brute-force scan that proves nothing about the index path
+    #    the maintenance worker exists to keep in shape.
+    table.create_index(
+        metric="l2",
+        vector_column_name="vector",
+        index_type="IVF_PQ",
+        num_partitions=1,
+        num_sub_vectors=4,
+    )
+    indices = table.list_indices()
+    print(f"create_index -> {indices}")
+    check(len(indices) >= 1, "no index was created")
+
+    # Vectors are laid out so that id N sits near id N+1, so a query built from
+    # id 1 should come back with its neighbourhood. The assertion is a
+    # neighbourhood and not an exact id: an IVF_PQ index quantizes, so the
+    # nearest hit is approximate by construction - with this data it answers 0
+    # as readily as 1, and both are right.
+    query = [float(1) + d for d in range(DIM)]
+    hits = table.search(query).limit(3).to_list()
+    ids = [hit["id"] for hit in hits]
+    print(f"search -> {ids}")
+    check(len(hits) == 3, f"search returned {len(hits)} hits, want 3")
+    check(
+        all(i <= 5 for i in ids),
+        f"search returned {ids}, which is not the neighbourhood of the query",
+    )
+
+    # 5. A filtered scan, so it is not only the ANN path that works.
+    filtered = table.search().where("id < 5").limit(10).to_list()
+    print(f"filtered scan -> {len(filtered)} rows")
+    check(len(filtered) == 5, f"filter returned {len(filtered)} rows, want 5")
+
+    # 6. Creating a table. By default LanceDB declares it through the namespace
+    #    and writes the data itself, which is exactly the split this catalog
+    #    serves, so this has to work.
+    created = db.create_table(
+        "created_by_lancedb",
+        data=sample_rows(4),
+        namespace_path=[args.bucket, args.namespace],
+        storage_options=storage,
+    )
+    check(created.count_rows() == 4, "create_table wrote the wrong number of rows")
+    listed = list(db.table_names(namespace_path=[args.bucket, args.namespace], limit=100))
+    check(
+        any("created_by_lancedb" in name for name in listed),
+        f"a table created through LanceDB is not listed: {listed}",
+    )
+    print(f"create_table -> {created.count_rows()} rows, listed by the catalog")
+
+    # 7. The same creation with server-side pushdown, which asks the namespace
+    #    to run CreateTable itself. That operation carries Arrow data and this
+    #    catalog answers the spec's Unsupported for it. What matters is that the
+    #    client is left with something coherent either way - it falls back to
+    #    declare-and-write - rather than a hang, a 404, or a half-made table.
+    pushdown = lancedb.connect_namespace(
+        "rest",
+        {"uri": args.namespace_url},
+        storage_options=storage,
+        namespace_client_pushdown_operations=["CreateTable"],
+    )
+    pushed_error = None
+    try:
+        pushdown.create_table(
+            "pushed_by_lancedb",
+            data=sample_rows(2),
+            namespace_path=[args.bucket, args.namespace],
+            storage_options=storage,
+        )
+    except Exception as err:  # noqa: BLE001 - the point is what the client sees
+        pushed_error = err
+
+    after = list(db.table_names(namespace_path=[args.bucket, args.namespace], limit=100))
+    landed = any("pushed_by_lancedb" in name for name in after)
+    print(f"create_table with pushdown: error={pushed_error!r}, catalog has it={landed}")
+
+    if pushed_error is None:
+        # The client fell back to declare-and-write, so the table is real and
+        # has to be readable and complete.
+        check(landed, "create_table reported success but the catalog has no table")
+        rows = db.open_table(
+            "pushed_by_lancedb",
+            namespace_path=[args.bucket, args.namespace],
+            storage_options=storage,
+        ).count_rows()
+        check(rows == 2, f"the pushed table holds {rows} rows, want 2")
+    else:
+        # Refused, which is what this catalog answers for a data-plane
+        # operation. It has to be that refusal and not some other failure, and
+        # it must not have left a half-made table behind.
+        message = str(pushed_error).lower()
+        check(
+            "unsupported" in message or "501" in message or "not implemented" in message,
+            f"pushdown failed for an unexpected reason: {pushed_error}",
+        )
+        check(not landed, "a refused create left a table behind in the catalog")
+
+    # 8. And the dataset is still readable straight off its URI, which is what
+    #    keeps the catalog optional.
+    direct = lance.dataset(location, storage_options=storage).count_rows()
+    check(direct == args.rows, f"direct read got {direct} rows, want {args.rows}")
+    print(f"direct read without the catalog -> {direct} rows")
+
+    print("PASS")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/test/s3tables/catalog_olake/Dockerfile.reader b/test/s3tables/catalog_olake/Dockerfile.reader
new file mode 100644
index 0000000000..63d38077c8
--- /dev/null
+++ b/test/s3tables/catalog_olake/Dockerfile.reader
@@ -0,0 +1,14 @@
+# Strict Iceberg reader used by the OLake integration test. PyIceberg is
+# deliberate here: it rejects manifests that omit the spec's field ids and
+# parquet without either field ids or a name mapping, so a passing read proves
+# the catalog served something every engine can consume -- not just something
+# OLake itself can read back.
+FROM python:3.11-slim
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir "pyiceberg[s3fs]==0.11.1" "pyarrow==25.0.0"
+
+COPY inspect_table.py /app/
+
+ENTRYPOINT ["python3", "/app/inspect_table.py"]
diff --git a/test/s3tables/catalog_olake/README.md b/test/s3tables/catalog_olake/README.md
new file mode 100644
index 0000000000..f8d1219091
--- /dev/null
+++ b/test/s3tables/catalog_olake/README.md
@@ -0,0 +1,105 @@
+# OLake Iceberg Catalog Integration Test
+
+An integration test for [OLake](https://github.com/datazip-inc/olake) against
+SeaweedFS's Iceberg REST Catalog, in the same shape as `catalog_clickhouse`.
+
+## Why OLake, given we already test other engines
+
+Two things here are covered by nothing else in this directory.
+
+**It is a strict Java Iceberg client.** OLake does not write Iceberg from Go —
+its Go process spawns a Java sidecar over gRPC and writes through the official
+Apache Iceberg library, because the Go library has no equality deletes and CDC
+needs them. So this test exercises the client class that
+`weed/s3api/iceberg/metadata_compliance.go` exists to serve: the one
+that fails with *"Cannot parse missing long current-snapshot-id"* when the
+catalog omits spec-required keys that `iceberg-go` strips via `omitempty`.
+
+**It produces equality deletes.** OLake is a CDC tool. Its upsert path commits
+`operation=overwrite` with an equality-delete file, and a delete manifest
+alongside the data manifests. ClickHouse, StarRocks, Doris and DuckDB all only
+append.
+
+## What it asserts
+
+`TestOLakeIcebergCatalog` runs six subtests against a `weed mini` cluster with
+a pre-created table bucket and a Postgres source:
+
+| Subtest | What a failure means |
+|---|---|
+| `CheckDestination` | `olake check` did not reach `SUCCEEDED`, or it passed without ever loading `org.apache.iceberg.rest.RESTSessionCatalog` — the second case means the destination was never actually contacted. |
+| `Discover` | OLake could not enumerate the source table, or wrote no `streams.json`. |
+| `FullSyncAppendsRows` | The sync read fewer than the three seeded rows, or committed no Iceberg snapshot. |
+| `StrictReaderSeesRows` | PyIceberg could not read back what the Java writer committed, or the values differ. This is the data path, not just metadata. |
+| `UpsertProducesEqualityDelete` | After an `UPDATE` and a re-sync, no snapshot recorded an overwrite carrying equality deletes, or the current snapshot has no delete manifest. |
+| `CompliantWriterNeedsNoRepair` | The catalog rewrote a manifest the official Iceberg Java writer produced. That is a regression in the repair gate, not a problem with OLake. |
+
+## The one thing this test deliberately does not check
+
+It does **not** assert that a reader sees the updated row and no duplicate.
+
+PyIceberg refuses to scan a table carrying equality deletes
+([apache/iceberg#6568](https://github.com/apache/iceberg/issues/6568)) while
+reading its metadata perfectly well — so a rows-mode read after the upsert would
+raise, not pass. The alternative is an engine that applies equality deletes,
+which for StarRocks means a 3 GB image and 12 GB of RAM in CI.
+
+The line drawn instead: **recording the commit correctly is the catalog's
+contract; applying deletes on read is the query engine's.** The metadata
+assertions cover our half.
+
+This was verified once by hand outside CI, on 2026-09-23, with StarRocks 4.1.4
+attached to the same catalog: after the upsert it read 3 rows / 3 distinct ids
+with `id=1` showing the updated value and `_op_type=u`. If someone later wants
+that inside the gate, add a reader that supports equality deletes — **do not**
+"upgrade" this test to a PyIceberg rows-mode read after the upsert. It would not
+pass; and if PyIceberg ever starts silently skipping deletes instead of raising,
+it would pass by not looking.
+
+## What the config proves
+
+Nothing in the destination config is SeaweedFS-specific:
+
+```json
+{
+  "catalog_type": "rest",
+  "rest_catalog_url": "http://HOST:ICEBERG_PORT",
+  "iceberg_s3_path": "s3://olake-tables",
+  "s3_endpoint": "http://HOST:S3_PORT",
+  "rest_auth_type": "oauth2",
+  "oauth2_uri": "http://HOST:ICEBERG_PORT/v1/oauth/tokens",
+  "credential": "ACCESS_KEY:SECRET_KEY"
+}
+```
+
+`catalog_type` is the generic `rest`, auth is the standard OAuth2
+client-credentials flow, and the test config sets `s3_path_style` explicitly;
+OLake also defaults to path style whenever `s3_endpoint` is non-empty, so
+either form works. As of
+OLake v0.10.1 this works with no change on either side.
+
+## Running it
+
+```sh
+go test ./test/s3tables/catalog_olake/ -run TestOLakeIcebergCatalog -v -timeout 25m
+```
+
+Needs Docker and a `weed` binary (at `weed/weed` under the repo root, or on
+`PATH`). Takes about 35 seconds. It skips rather than fails when Docker is
+absent, and `SEAWEEDFS_SKIP_OLAKE_TESTS=1` skips it outright.
+
+Overrides: `OLAKE_IMAGE` (default `olakego/source-postgres:latest`),
+`POSTGRES_IMAGE` (default `postgres:16`).
+
+## In CI
+
+Runs as `olake-iceberg-catalog-tests` in `.github/workflows/s3-tables-tests.yml`,
+on a matrix of a pinned image plus `latest` — the same shape the ClickHouse job
+uses, and for the same reason: OLake's Iceberg writer is a Java sidecar whose
+library version moves independently of the Go release, so the `latest` leg is
+what catches drift in the client rather than in OLake itself.
+
+The job asserts the suite actually ran — at least one top-level `--- PASS` and
+zero `--- SKIP` — rather than trusting a green exit. This suite skips itself
+when Docker is unavailable, and a skipped suite reporting success is how a gate
+quietly stops being one.
diff --git a/test/s3tables/catalog_olake/inspect_table.py b/test/s3tables/catalog_olake/inspect_table.py
new file mode 100644
index 0000000000..0f8edca226
--- /dev/null
+++ b/test/s3tables/catalog_olake/inspect_table.py
@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+"""Inspect an Iceberg table written by OLake, through the SeaweedFS REST catalog.
+
+Two modes, because a strict reader cannot do both:
+
+  rows      -- scan the table and print "id,region,amount" per row, ordered by
+               id. Only valid while the table has no equality deletes.
+  snapshots -- print one line per snapshot with its operation and delete-file
+               counters, plus the manifest content kinds of the current
+               snapshot.
+
+The split exists because PyIceberg refuses to scan a table carrying equality
+deletes (apache/iceberg#6568) while reading its metadata perfectly well. OLake
+is a CDC tool, so its upsert path produces exactly those deletes -- asserting
+the commit landed is the catalog's concern, and applying deletes on read is the
+query engine's.
+"""
+
+import argparse
+import sys
+
+from pyiceberg.catalog import load_catalog
+
+
+def main() -> int:
+    p = argparse.ArgumentParser()
+    p.add_argument("mode", choices=["rows", "snapshots"])
+    p.add_argument("--catalog-url", required=True)
+    p.add_argument("--warehouse", required=True)
+    p.add_argument("--prefix", required=True)
+    p.add_argument("--s3-endpoint", required=True)
+    p.add_argument("--access-key", required=True)
+    p.add_argument("--secret-key", required=True)
+    p.add_argument("--region", default="us-east-1")
+    p.add_argument("--namespace", action="append", required=True)
+    p.add_argument("--table", required=True)
+    args = p.parse_args()
+
+    catalog = load_catalog(
+        "rest",
+        **{
+            "type": "rest",
+            "uri": args.catalog_url,
+            "warehouse": args.warehouse,
+            "prefix": args.prefix,
+            "credential": f"{args.access_key}:{args.secret_key}",
+            "s3.access-key-id": args.access_key,
+            "s3.secret-access-key": args.secret_key,
+            "s3.endpoint": args.s3_endpoint,
+            "s3.region": args.region,
+            "s3.path-style-access": "true",
+        },
+    )
+
+    table = catalog.load_table(tuple(args.namespace) + (args.table,))
+
+    if args.mode == "rows":
+        data = table.scan().to_arrow().to_pydict()
+        # amount is decimal(10,2) in Postgres but arrives here as a float, whose
+        # repr drops trailing zeros (120.5, not 120.50). Format it to the source
+        # scale so the expected values in the Go test stay readable.
+        for row_id, region, amount in sorted(
+            zip(data["id"], data["region"], data["amount"])
+        ):
+            print("%s,%s,%.2f" % (row_id, region, float(amount)))
+        return 0
+
+    print("format-version=%d" % table.metadata.format_version)
+    ids = table.metadata.schemas[-1].identifier_field_ids
+    print("identifier-field-ids=%s" % ",".join(str(i) for i in ids))
+    for snap in table.metadata.snapshots:
+        s = snap.summary
+        print(
+            "snapshot operation=%s total-delete-files=%s added-delete-files=%s "
+            "added-equality-deletes=%s total-records=%s"
+            % (
+                s.operation,
+                s.get("total-delete-files", "0"),
+                s.get("added-delete-files", "0"),
+                s.get("added-equality-deletes", "0"),
+                s.get("total-records", "0"),
+            )
+        )
+    current = table.current_snapshot()
+    kinds = [str(m.content).rsplit(".", 1)[-1] for m in current.manifests(table.io)]
+    print("current-manifest-kinds=%s" % ",".join(kinds))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/test/s3tables/catalog_olake/olake_catalog_test.go b/test/s3tables/catalog_olake/olake_catalog_test.go
new file mode 100644
index 0000000000..bbed0c2a3d
--- /dev/null
+++ b/test/s3tables/catalog_olake/olake_catalog_test.go
@@ -0,0 +1,625 @@
+// Package catalog_olake provides an integration test for OLake
+// (github.com/datazip-inc/olake) against the SeaweedFS Iceberg REST Catalog.
+//
+// OLake matters here for two reasons that no other engine in this directory
+// covers. First, it does not write Iceberg from Go: it spawns a Java sidecar
+// over gRPC and writes through the official Apache Iceberg library, so this is
+// a strict Java client -- the class that iceberg/metadata_compliance.go exists
+// to serve. Second, it is a CDC tool, so its upsert path emits equality
+// deletes, which neither the ClickHouse nor the Doris test exercises.
+package catalog_olake
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+)
+
+const (
+	olakeDefaultImage    = "olakego/source-postgres:latest"
+	postgresDefaultImage = "postgres:16"
+	readerImage          = "seaweedfs-olake-reader:test"
+
+	tableBucketName = "olake-tables"
+	sourceDatabase  = "olakedb"
+	sourceUser      = "olake"
+	sourcePassword  = "olakepw"
+
+	// OLake derives the destination namespace from the source: it joins the
+	// connector name, database and schema. Asserting the derived name rather
+	// than configuring one keeps the test honest about what OLake actually
+	// does with our catalog.
+	expectedNamespace = "postgres_olakedb_public"
+	expectedTable     = "orders"
+
+	postgresStartTimeout = 90 * time.Second
+	olakeRunTimeout      = 6 * time.Minute
+)
+
+type TestEnvironment struct {
+	seaweedDir string
+	weedBinary string
+	dataDir    string
+	configDir  string
+	bindIP     string
+
+	masterPort     int
+	masterGrpcPort int
+	volumePort     int
+	volumeGrpcPort int
+	filerPort      int
+	filerGrpcPort  int
+	s3Port         int
+	s3GrpcPort     int
+	icebergPort    int
+	postgresPort   int
+
+	accessKey string
+	secretKey string
+
+	weedProcess       *exec.Cmd
+	weedCancel        func()
+	postgresContainer string
+}
+
+func TestOLakeIcebergCatalog(t *testing.T) {
+	requireOLakeRuntime(t)
+
+	env := NewTestEnvironment(t)
+	defer env.Cleanup(t)
+
+	env.StartSeaweedFS(t)
+	env.startPostgres(t)
+	env.seedSource(t)
+
+	buildReaderImage(t)
+	env.writeOLakeConfigs(t)
+
+	t.Run("CheckDestination", func(t *testing.T) {
+		out := env.runOLake(t, "check",
+			"--config", "/mnt/config/source.json",
+			"--destination", "/mnt/config/destination.json")
+		if !strings.Contains(out, `"status":"SUCCEEDED"`) {
+			t.Fatalf("olake check did not report SUCCEEDED.\n%s", tailLines(out, 40))
+		}
+		// The Java sidecar, not the Go process, is what talks to our catalog.
+		// If this line is missing the check passed without exercising the
+		// Iceberg REST path at all.
+		if !strings.Contains(out, "org.apache.iceberg.rest.RESTSessionCatalog") {
+			t.Errorf("check passed but never loaded the Iceberg REST catalog; "+
+				"the destination may not have been contacted.\n%s", tailLines(out, 40))
+		}
+	})
+
+	t.Run("Discover", func(t *testing.T) {
+		out := env.runOLake(t, "discover",
+			"--config", "/mnt/config/source.json",
+			"--destination", "/mnt/config/destination.json")
+		if !strings.Contains(out, `"stream_name":"`+expectedTable+`"`) {
+			t.Fatalf("discover did not report the %s stream.\n%s", expectedTable, tailLines(out, 20))
+		}
+		if _, err := os.Stat(filepath.Join(env.configDir, "streams.json")); err != nil {
+			t.Fatalf("discover did not write streams.json: %v", err)
+		}
+	})
+
+	t.Run("FullSyncAppendsRows", func(t *testing.T) {
+		out := env.runOLake(t, "sync",
+			"--config", "/mnt/config/source.json",
+			"--destination", "/mnt/config/destination.json",
+			"--streams", "/mnt/config/streams.json",
+			"--state", "/mnt/config/state.json")
+		if !strings.Contains(out, "Total records read: 3") {
+			t.Fatalf("sync did not read the three seeded rows.\n%s", tailLines(out, 30))
+		}
+		if !strings.Contains(out, "Committed snapshot") {
+			t.Fatalf("sync never committed an Iceberg snapshot.\n%s", tailLines(out, 30))
+		}
+	})
+
+	t.Run("StrictReaderSeesRows", func(t *testing.T) {
+		rows := env.readTable(t, "rows")
+		want := []string{"1,us-east,120.50", "2,us-west,87.20", "3,eu-west,210.00"}
+		got := nonEmptyLines(rows)
+		if len(got) != len(want) {
+			t.Fatalf("PyIceberg read %d rows, want %d.\n%s", len(got), len(want), rows)
+		}
+		for i := range want {
+			if got[i] != want[i] {
+				t.Errorf("row %d = %q, want %q", i, got[i], want[i])
+			}
+		}
+	})
+
+	t.Run("UpsertProducesEqualityDelete", func(t *testing.T) {
+		// Push the row past the incremental cursor so the next sync re-emits it
+		// as an update rather than skipping it.
+		env.execSQL(t, "UPDATE orders SET amount=999.99, region='ap-south' WHERE id=1")
+
+		out := env.runOLake(t, "sync",
+			"--config", "/mnt/config/source.json",
+			"--destination", "/mnt/config/destination.json",
+			"--streams", "/mnt/config/streams.json",
+			"--state", "/mnt/config/state.json")
+		if !strings.Contains(out, "delete files") {
+			t.Fatalf("re-sync committed no delete files.\n%s", tailLines(out, 30))
+		}
+
+		meta := env.readTable(t, "snapshots")
+		if !strings.Contains(meta, "format-version=2") {
+			t.Errorf("expected Iceberg format-version 2, got:\n%s", meta)
+		}
+		if !strings.Contains(meta, "identifier-field-ids=") ||
+			strings.Contains(meta, "identifier-field-ids=\n") {
+			t.Errorf("table carries no identifier fields, so OLake could not "+
+				"have upserted:\n%s", meta)
+		}
+
+		var sawOverwrite bool
+		for _, line := range nonEmptyLines(meta) {
+			if !strings.HasPrefix(line, "snapshot operation=") {
+				continue
+			}
+			if strings.Contains(line, "operation=Operation.OVERWRITE") &&
+				!strings.Contains(line, "added-equality-deletes=0") {
+				sawOverwrite = true
+			}
+		}
+		if !sawOverwrite {
+			t.Errorf("no snapshot recorded an overwrite carrying equality "+
+				"deletes:\n%s", meta)
+		}
+		if !strings.Contains(meta, "current-manifest-kinds=") ||
+			!strings.Contains(meta, "DELETES") {
+			t.Errorf("current snapshot has no delete manifest:\n%s", meta)
+		}
+		// Deliberately NOT asserted here: that a reader sees the updated value
+		// and no duplicate row. PyIceberg refuses to scan a table carrying
+		// equality deletes (apache/iceberg#6568), so a rows-mode read would
+		// fail rather than pass, and swapping in an engine that can apply them
+		// costs this test a multi-gigabyte image. Applying deletes on read is
+		// the engine's contract; recording the commit correctly is ours, and
+		// that is what the assertions above cover. See the README.
+	})
+
+	t.Run("CompliantWriterNeedsNoRepair", func(t *testing.T) {
+		names := env.listTableMetadata(t)
+		if len(names) == 0 {
+			t.Fatalf("no metadata files found for %s.%s", expectedNamespace, expectedTable)
+		}
+		for _, n := range names {
+			if strings.HasPrefix(n, "repaired-") {
+				t.Errorf("catalog repaired a manifest written by OLake (%s); "+
+					"the official Iceberg Java writer is expected to be "+
+					"spec-compliant, so this is a regression in the repair "+
+					"gate rather than in OLake", n)
+			}
+		}
+	})
+}
+
+func NewTestEnvironment(t *testing.T) *TestEnvironment {
+	t.Helper()
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("Failed to get working directory: %v", err)
+	}
+
+	seaweedDir := wd
+	for i := 0; i < 6; i++ {
+		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
+			break
+		}
+		seaweedDir = filepath.Dir(seaweedDir)
+	}
+
+	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
+	if info, err := os.Stat(weedBinary); err != nil || info.IsDir() {
+		weedBinary = filepath.Join(seaweedDir, "weed", "weed", "weed")
+		if info, err := os.Stat(weedBinary); err != nil || info.IsDir() {
+			weedBinary = "weed"
+			if _, err := exec.LookPath(weedBinary); err != nil {
+				t.Skip("weed binary not found, skipping integration test")
+			}
+		}
+	}
+
+	dataDir, err := os.MkdirTemp("", "seaweed-olake-test-*")
+	if err != nil {
+		t.Fatalf("Failed to create temp dir: %v", err)
+	}
+	configDir := filepath.Join(dataDir, "olake")
+	if err := os.MkdirAll(configDir, 0755); err != nil {
+		t.Fatalf("Failed to create config dir: %v", err)
+	}
+
+	// 9 for the mini cluster, 1 for the Postgres source mapped on the host.
+	ports := testutil.MustAllocatePorts(t, 10)
+
+	return &TestEnvironment{
+		seaweedDir:     seaweedDir,
+		weedBinary:     weedBinary,
+		dataDir:        dataDir,
+		configDir:      configDir,
+		bindIP:         testutil.FindBindIP(),
+		masterPort:     ports[0],
+		masterGrpcPort: ports[1],
+		volumePort:     ports[2],
+		volumeGrpcPort: ports[3],
+		filerPort:      ports[4],
+		filerGrpcPort:  ports[5],
+		s3Port:         ports[6],
+		s3GrpcPort:     ports[7],
+		icebergPort:    ports[8],
+		postgresPort:   ports[9],
+		accessKey:      "AKIAIOSFODNN7EXAMPLE",
+		secretKey:      "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+	}
+}
+
+func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
+	t.Helper()
+
+	iamConfigPath, err := testutil.WriteIAMConfig(env.dataDir, env.accessKey, env.secretKey)
+	if err != nil {
+		t.Fatalf("Failed to create IAM config: %v", err)
+	}
+
+	miniArgs := append([]string{"mini",
+		"-master.port", fmt.Sprintf("%d", env.masterPort),
+		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
+		"-volume.port", fmt.Sprintf("%d", env.volumePort),
+		"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort),
+		"-filer.port", fmt.Sprintf("%d", env.filerPort),
+		"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort),
+		"-s3.port", fmt.Sprintf("%d", env.s3Port),
+		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
+		"-s3.port.iceberg", fmt.Sprintf("%d", env.icebergPort),
+		"-s3.config", iamConfigPath,
+		// Pre-create the table bucket the way an operator would, rather than
+		// reaching for the S3 Tables control plane from the test.
+		"-tableBucket", tableBucketName,
+		"-ip", env.bindIP,
+		"-ip.bind", "0.0.0.0",
+		"-dir", env.dataDir,
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0")
+	cmd := exec.Command(env.weedBinary, miniArgs...)
+	cmd.Dir = env.dataDir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Env = append(os.Environ(),
+		"AWS_ACCESS_KEY_ID="+env.accessKey,
+		"AWS_SECRET_ACCESS_KEY="+env.secretKey,
+	)
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Failed to start SeaweedFS: %v", err)
+	}
+	env.weedProcess = cmd
+	env.weedCancel = func() {
+		if cmd.Process != nil {
+			_ = cmd.Process.Kill()
+		}
+	}
+
+	url := fmt.Sprintf("http://%s:%d/v1/config", env.bindIP, env.icebergPort)
+	if !waitForService(url, 45*time.Second) {
+		t.Fatalf("Iceberg REST API did not become ready at %s", url)
+	}
+}
+
+func (env *TestEnvironment) startPostgres(t *testing.T) {
+	t.Helper()
+
+	name := fmt.Sprintf("olake-pg-%d", env.postgresPort)
+	_ = exec.Command("docker", "rm", "-f", name).Run()
+
+	cmd := exec.Command("docker", "run", "-d", "--name", name,
+		"-e", "POSTGRES_USER="+sourceUser,
+		"-e", "POSTGRES_PASSWORD="+sourcePassword,
+		"-e", "POSTGRES_DB="+sourceDatabase,
+		"-p", fmt.Sprintf("%d:5432", env.postgresPort),
+		postgresImage(),
+	)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("Failed to start Postgres: %v\n%s", err, out)
+	}
+	env.postgresContainer = name
+
+	deadline := time.Now().Add(postgresStartTimeout)
+	for time.Now().Before(deadline) {
+		probe := exec.Command("docker", "exec", name,
+			"pg_isready", "-U", sourceUser, "-d", sourceDatabase)
+		if err := probe.Run(); err == nil {
+			return
+		}
+		time.Sleep(2 * time.Second)
+	}
+	t.Fatalf("Postgres did not become ready within %s", postgresStartTimeout)
+}
+
+func (env *TestEnvironment) seedSource(t *testing.T) {
+	t.Helper()
+	env.execSQL(t, `
+CREATE TABLE orders (
+    id       int PRIMARY KEY,
+    region   text,
+    amount   numeric(10,2),
+    order_ts timestamp
+);
+INSERT INTO orders VALUES
+    (1,'us-east',120.50,'2026-07-27 09:15'),
+    (2,'us-west', 87.20,'2026-07-27 09:20'),
+    (3,'eu-west',210.00,'2026-07-27 09:31');
+ALTER TABLE orders REPLICA IDENTITY FULL;`)
+}
+
+func (env *TestEnvironment) execSQL(t *testing.T, sqlText string) {
+	t.Helper()
+	cmd := exec.Command("docker", "exec", env.postgresContainer,
+		"psql", "-v", "ON_ERROR_STOP=1", "-U", sourceUser, "-d", sourceDatabase,
+		"-c", sqlText)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("psql failed: %v\n%s", err, out)
+	}
+}
+
+// writeOLakeConfigs writes the source and destination configs. The destination
+// is the point of this test: nothing in it is SeaweedFS-specific. catalog_type
+// is the generic "rest", auth is the standard OAuth2 client-credentials flow,
+// and path-style access is set explicitly here; OLake also turns it on by
+// itself whenever s3_endpoint is non-empty, so either form works.
+func (env *TestEnvironment) writeOLakeConfigs(t *testing.T) {
+	t.Helper()
+
+	source := map[string]any{
+		"host":            env.bindIP,
+		"port":            env.postgresPort,
+		"database":        sourceDatabase,
+		"username":        sourceUser,
+		"password":        sourcePassword,
+		"jdbc_url_params": map[string]any{},
+		"ssl":             map[string]any{"mode": "disable"},
+		"update_method":   map[string]any{"type": "Standalone"},
+		"max_threads":     2,
+		"retry_count":     0,
+	}
+
+	catalogURL := fmt.Sprintf("http://%s:%d", env.bindIP, env.icebergPort)
+	destination := map[string]any{
+		"type": "ICEBERG",
+		"writer": map[string]any{
+			"catalog_type":     "rest",
+			"rest_catalog_url": catalogURL,
+			"catalog_name":     "olake",
+			"iceberg_s3_path":  "s3://" + tableBucketName,
+			"s3_endpoint":      fmt.Sprintf("http://%s:%d", env.bindIP, env.s3Port),
+			"s3_use_ssl":       false,
+			"s3_path_style":    true,
+			"aws_region":       "us-east-1",
+			"aws_access_key":   env.accessKey,
+			"aws_secret_key":   env.secretKey,
+			"rest_auth_type":   "oauth2",
+			"oauth2_uri":       catalogURL + "/v1/oauth/tokens",
+			"credential":       env.accessKey + ":" + env.secretKey,
+		},
+	}
+
+	writeJSON(t, filepath.Join(env.configDir, "source.json"), source)
+	writeJSON(t, filepath.Join(env.configDir, "destination.json"), destination)
+	if err := os.WriteFile(filepath.Join(env.configDir, "state.json"), []byte("{}\n"), 0644); err != nil {
+		t.Fatalf("Failed to write state.json: %v", err)
+	}
+}
+
+func (env *TestEnvironment) runOLake(t *testing.T, args ...string) string {
+	t.Helper()
+
+	full := append([]string{
+		"run", "--rm",
+		"-v", dockerMount(env.configDir) + ":/mnt/config",
+		olakeImage(),
+	}, args...)
+
+	cmd := exec.Command("docker", full...)
+	done := make(chan struct{})
+	var out []byte
+	var err error
+	go func() {
+		out, err = cmd.CombinedOutput()
+		close(done)
+	}()
+	select {
+	case <-done:
+	case <-time.After(olakeRunTimeout):
+		if cmd.Process != nil {
+			_ = cmd.Process.Kill()
+		}
+		t.Fatalf("olake %s did not finish within %s", args[0], olakeRunTimeout)
+	}
+	if err != nil {
+		t.Fatalf("olake %s failed: %v\n%s", args[0], err, tailLines(string(out), 40))
+	}
+	return string(out)
+}
+
+func (env *TestEnvironment) readTable(t *testing.T, mode string) string {
+	t.Helper()
+
+	cmd := exec.Command("docker", "run", "--rm", readerImage, mode,
+		"--catalog-url", fmt.Sprintf("http://%s:%d", env.bindIP, env.icebergPort),
+		"--warehouse", "s3://"+tableBucketName,
+		"--prefix", tableBucketName,
+		"--s3-endpoint", fmt.Sprintf("http://%s:%d", env.bindIP, env.s3Port),
+		"--access-key", env.accessKey,
+		"--secret-key", env.secretKey,
+		"--namespace", expectedNamespace,
+		"--table", expectedTable,
+	)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("reader (%s) failed: %v\n%s", mode, err, tailLines(string(out), 30))
+	}
+	return string(out)
+}
+
+// listTableMetadata lists the table's metadata directory through the filer so
+// the repair assertion looks at real objects rather than at what the catalog
+// reports about itself.
+func (env *TestEnvironment) listTableMetadata(t *testing.T) []string {
+	t.Helper()
+
+	url := fmt.Sprintf("http://%s:%d/buckets/%s/%s/%s/metadata/?limit=200",
+		env.bindIP, env.filerPort, tableBucketName, expectedNamespace, expectedTable)
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		t.Fatalf("Failed to build filer request: %v", err)
+	}
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("filer listing failed: %v", err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("filer listing returned %d: %s", resp.StatusCode, body)
+	}
+
+	var parsed struct {
+		Entries []struct {
+			FullPath string `json:"FullPath"`
+		} `json:"Entries"`
+	}
+	if err := json.Unmarshal(body, &parsed); err != nil {
+		t.Fatalf("Failed to parse filer listing: %v\n%s", err, body)
+	}
+
+	names := make([]string, 0, len(parsed.Entries))
+	for _, e := range parsed.Entries {
+		names = append(names, e.FullPath[strings.LastIndex(e.FullPath, "/")+1:])
+	}
+	return names
+}
+
+func (env *TestEnvironment) Cleanup(t *testing.T) {
+	t.Helper()
+
+	if env.postgresContainer != "" {
+		_ = exec.Command("docker", "rm", "-f", env.postgresContainer).Run()
+	}
+	if env.weedCancel != nil {
+		env.weedCancel()
+	}
+	if env.weedProcess != nil {
+		_ = env.weedProcess.Wait()
+	}
+	if env.dataDir != "" {
+		_ = os.RemoveAll(env.dataDir)
+	}
+}
+
+func buildReaderImage(t *testing.T) {
+	t.Helper()
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("Failed to get working directory: %v", err)
+	}
+	cmd := exec.Command("docker", "build",
+		"-f", filepath.Join(wd, "Dockerfile.reader"),
+		"-t", readerImage, wd)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("Failed to build reader image: %v\n%s", err, tailLines(string(out), 30))
+	}
+}
+
+func olakeImage() string {
+	if v := os.Getenv("OLAKE_IMAGE"); v != "" {
+		return v
+	}
+	return olakeDefaultImage
+}
+
+func postgresImage() string {
+	if v := os.Getenv("POSTGRES_IMAGE"); v != "" {
+		return v
+	}
+	return postgresDefaultImage
+}
+
+func requireOLakeRuntime(t *testing.T) {
+	t.Helper()
+	if os.Getenv("SEAWEEDFS_SKIP_OLAKE_TESTS") != "" {
+		t.Skip("SEAWEEDFS_SKIP_OLAKE_TESTS set")
+	}
+	if _, err := exec.LookPath("docker"); err != nil {
+		t.Skip("docker not available, skipping OLake integration test")
+	}
+	if err := exec.Command("docker", "info").Run(); err != nil {
+		t.Skip("docker daemon not reachable, skipping OLake integration test")
+	}
+}
+
+func waitForService(url string, timeout time.Duration) bool {
+	deadline := time.Now().Add(timeout)
+	client := &http.Client{Timeout: 3 * time.Second}
+	for time.Now().Before(deadline) {
+		resp, err := client.Get(url)
+		if err == nil {
+			resp.Body.Close()
+			if resp.StatusCode < 500 {
+				return true
+			}
+		}
+		time.Sleep(time.Second)
+	}
+	return false
+}
+
+func writeJSON(t *testing.T, path string, v any) {
+	t.Helper()
+	body, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		t.Fatalf("Failed to marshal %s: %v", path, err)
+	}
+	if err := os.WriteFile(path, append(body, '\n'), 0644); err != nil {
+		t.Fatalf("Failed to write %s: %v", path, err)
+	}
+}
+
+// dockerMount normalises a host path for a -v bind mount. Docker Desktop
+// accepts forward slashes on Windows; the native separator it does not.
+func dockerMount(path string) string {
+	return strings.ReplaceAll(path, `\`, "/")
+}
+
+func nonEmptyLines(s string) []string {
+	var out []string
+	for _, line := range strings.Split(s, "\n") {
+		if trimmed := strings.TrimSpace(line); trimmed != "" {
+			out = append(out, trimmed)
+		}
+	}
+	return out
+}
+
+func tailLines(s string, n int) string {
+	lines := strings.Split(strings.TrimRight(s, "\n"), "\n")
+	if len(lines) > n {
+		lines = lines[len(lines)-n:]
+	}
+	return strings.Join(lines, "\n")
+}
diff --git a/test/s3tables/catalog_risingwave/setup_test.go b/test/s3tables/catalog_risingwave/setup_test.go
index b893c1d91a..f2adf83433 100644
--- a/test/s3tables/catalog_risingwave/setup_test.go
+++ b/test/s3tables/catalog_risingwave/setup_test.go
@@ -113,7 +113,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		t.Fatalf("failed to create temp directory: %v", err)
 	}
 
-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3", "Iceberg"})
+	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3", "Iceberg", "Admin"})
 	env.masterPort = ports[0]
 	env.filerPort = ports[1]
 	env.s3Port = ports[2]
@@ -134,8 +134,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	env.logFile = logFile
 
 	// Start SeaweedFS using weed mini (all-in-one including Iceberg REST)
-	env.masterProcess = exec.Command(
-		"weed", "mini",
+	miniArgs := append([]string{"mini",
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
@@ -144,7 +143,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-s3.port.iceberg", fmt.Sprintf("%d", env.icebergRestPort),
 		"-s3.config", iamConfigPath,
 		"-dir", env.seaweedfsDataDir,
-	)
+	}, testutil.MiniAdminArgs(ports[4])...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0")
+	env.masterProcess = exec.Command("weed", miniArgs...)
 	env.masterProcess.Stdout = logFile
 	env.masterProcess.Stderr = logFile
 	env.masterProcess.Env = append(os.Environ(),
@@ -193,6 +194,7 @@ func (env *TestEnvironment) StartRisingWave(t *testing.T) {
 	if output, err := cmd.CombinedOutput(); err != nil {
 		t.Fatalf("failed to start RisingWave container: %v\n%s", err, string(output))
 	}
+	env.checkRisingWaveContainer(t)
 
 	// Start a sidecar postgres container for running psql commands
 	sidecarName := "seaweed-risingwave-sidecar-" + randomString(8)
@@ -204,6 +206,7 @@ func (env *TestEnvironment) StartRisingWave(t *testing.T) {
 		"sleep", "infinity",
 	)
 	if output, err := sidecarCmd.CombinedOutput(); err != nil {
+		env.checkRisingWaveContainer(t)
 		t.Fatalf("failed to start postgres sidecar: %v\n%s", err, string(output))
 	}
 
@@ -219,6 +222,7 @@ func (env *TestEnvironment) waitForRisingWave(timeout time.Duration) bool {
 	deadline := time.Now().Add(timeout)
 	env.t.Logf(">>> Waiting for RisingWave to be ready (timeout %v)...\n", timeout)
 	for time.Now().Before(deadline) {
+		env.checkRisingWaveContainer(env.t)
 		if output, err := runPostgresClientSQL(env.postgresSidecar, "SELECT 1;"); err == nil {
 			env.t.Logf(">>> RisingWave is ready.\n")
 			return true
@@ -230,6 +234,26 @@ func (env *TestEnvironment) waitForRisingWave(timeout time.Duration) bool {
 	return false
 }
 
+func (env *TestEnvironment) checkRisingWaveContainer(t *testing.T) {
+	t.Helper()
+	out, err := exec.Command("docker", "inspect", "--format", "{{.State.Running}} {{.State.ExitCode}} {{.State.OOMKilled}}", env.risingwaveContainer).CombinedOutput()
+	if err != nil {
+		t.Fatalf("inspect RisingWave container: %v\n%s", err, out)
+	}
+	state := strings.Fields(string(out))
+	if len(state) != 3 {
+		t.Fatalf("unexpected RisingWave container state: %s", out)
+	}
+	if state[0] == "true" {
+		return
+	}
+	if state[1] == "132" && state[2] == "false" {
+		t.Skip("RisingWave image exited with illegal instruction on this CPU")
+	}
+	logs, _ := exec.Command("docker", "logs", env.risingwaveContainer).CombinedOutput()
+	t.Fatalf("RisingWave container exited before it became ready (code %s, OOM killed: %s):\n%s", state[1], state[2], logs)
+}
+
 func runPostgresClientSQL(containerName, sql string) ([]byte, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
diff --git a/test/s3tables/catalog_spark/setup_test.go b/test/s3tables/catalog_spark/setup_test.go
index 9091b201c8..7d64dfd6eb 100644
--- a/test/s3tables/catalog_spark/setup_test.go
+++ b/test/s3tables/catalog_spark/setup_test.go
@@ -90,7 +90,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		t.Fatalf("failed to create temp directory: %v", err)
 	}
 
-	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3", "Iceberg"})
+	ports := testutil.MustFreeMiniPorts(t, []string{"Master", "Filer", "S3", "Iceberg", "Admin"})
 	env.masterPort = ports[0]
 	env.filerPort = ports[1]
 	env.s3Port = ports[2]
@@ -104,8 +104,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	}
 
 	// Start SeaweedFS using weed mini (all-in-one including Iceberg REST)
-	env.masterProcess = exec.Command(
-		"weed", "mini",
+	miniArgs := append([]string{"mini",
 		"-ip", bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
@@ -114,7 +113,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-s3.port.iceberg", fmt.Sprintf("%d", env.icebergRestPort),
 		"-s3.config", iamConfigPath,
 		"-dir", env.seaweedfsDataDir,
-	)
+	}, testutil.MiniAdminArgs(ports[4])...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0")
+	env.masterProcess = exec.Command("weed", miniArgs...)
 	env.masterProcess.Env = append(os.Environ(),
 		"AWS_ACCESS_KEY_ID="+env.accessKey,
 		"AWS_SECRET_ACCESS_KEY="+env.secretKey,
diff --git a/test/s3tables/catalog_spark_lance/README.md b/test/s3tables/catalog_spark_lance/README.md
new file mode 100644
index 0000000000..7ba408b809
--- /dev/null
+++ b/test/s3tables/catalog_spark_lance/README.md
@@ -0,0 +1,63 @@
+# Spark Lance Integration Test
+
+Drives the SeaweedFS Lance Namespace with Spark, through the Lance Spark
+connector's DSV2 catalog. The Lance counterpart of `catalog_spark`, which does
+the same for the Iceberg REST catalog.
+
+## Why Spark
+
+Spark is the engine most likely to be pointed at a lakehouse, and it reaches the
+catalog over the same Lance Namespace routes as every other client. Between this
+and `catalog_lancedb`, the catalog is exercised by the two clients people
+actually use, rather than only by the protocol's reference implementation.
+
+## What it does
+
+`TestSparkLanceNamespace`:
+
+1. Starts a `weed mini` cluster with S3 and the Lance Namespace enabled.
+2. Creates a table bucket declared `LANCE`.
+3. Runs `spark_lance_ops.py` inside the stock `apache/spark:3.5.1` image, with
+   the connector pulled from Maven at submit time.
+
+Inside Spark:
+
+| Step | What it proves |
+| --- | --- |
+| `CREATE NAMESPACE` / `SHOW NAMESPACES` | the bucket is the first level of the path, and the catalog is writable |
+| `CREATE TABLE ... USING lance` | the connector declares through the namespace and writes the data itself |
+| `INSERT` / `SELECT count(*)` | a write lands and reads back through the catalog |
+| schema check | the vector column survived the round trip |
+| `WHERE id >= 2` | the filter path, not only a full scan |
+| a second `INSERT` | the commit a store that cannot order commits fails on |
+
+## Configuration
+
+The connector's catalog properties. The host names below are placeholders — the
+test passes dynamically allocated `host.docker.internal` ports, and a real
+deployment uses whatever address the gateway answers on:
+
+```
+spark.sql.catalog.lance                        org.lance.spark.LanceNamespaceSparkCatalog
+spark.sql.catalog.lance.impl                   rest
+spark.sql.catalog.lance.uri                    http://seaweed:9101
+spark.sql.catalog.lance.storage.aws_endpoint   http://seaweed:8333
+spark.sql.catalog.lance.storage.allow_http     true
+spark.sql.catalog.lance.storage.aws_access_key_id      …
+spark.sql.catalog.lance.storage.aws_secret_access_key  …
+```
+
+Anything under `storage.` is handed to lance as object_store options, so those
+are object_store's key names rather than Spark's `s3a` ones. Credentials belong
+there because a gateway without STS vends none — see the note in
+`../catalog_lancedb/README.md`.
+
+## Running it
+
+    cd test/s3tables/catalog_spark_lance
+    (cd ../../../weed && go build .)     # the harness runs this binary
+    go test -run TestSparkLanceNamespace -v -timeout 40m .
+
+Skipped without Docker, and in `-short` mode. The first run downloads the Spark
+image and the connector bundle, which is a few hundred megabytes; later runs
+reuse both.
diff --git a/test/s3tables/catalog_spark_lance/spark_lance_ops.py b/test/s3tables/catalog_spark_lance/spark_lance_ops.py
new file mode 100644
index 0000000000..bb824e2ad1
--- /dev/null
+++ b/test/s3tables/catalog_spark_lance/spark_lance_ops.py
@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+"""Drive the SeaweedFS Lance Namespace with Spark.
+
+Spark reaches the catalog through the Lance Spark connector's DSV2 catalog,
+`org.lance.spark.LanceNamespaceSparkCatalog` with `impl=rest`, which speaks the
+same routes this catalog implements. It is the Lance counterpart of the Spark
+Iceberg suite next door.
+
+Every step prints what happened. The last line is PASS, or a line starting with
+FAIL that names the step, so the Go harness can report something useful rather
+than a stack trace.
+"""
+
+import argparse
+import sys
+
+from pyspark.sql import SparkSession
+from pyspark.sql.types import ArrayType, FloatType
+
+
+def check(condition, message):
+    if not condition:
+        print(f"FAIL: {message}", file=sys.stderr)
+        raise SystemExit(1)
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--namespace-url", required=True)
+    parser.add_argument("--s3-endpoint", required=True)
+    parser.add_argument("--bucket", required=True)
+    parser.add_argument("--namespace", default="ml")
+    parser.add_argument("--table", default="embeddings")
+    parser.add_argument("--access-key", default="any")
+    parser.add_argument("--secret-key", default="any")
+    parser.add_argument("--packages", required=True)
+    parser.add_argument("--ivy-dir", default="/tmp/ivy")
+    args = parser.parse_args()
+
+    # storage.* is handed to lance as its object_store options, so these are
+    # object_store's own key names rather than Spark's s3a ones.
+    spark = (
+        SparkSession.builder.appName("SeaweedFS Lance Namespace Test")
+        .config("spark.jars.ivy", args.ivy_dir)
+        .config("spark.jars.packages", args.packages)
+        .config("spark.sql.catalog.lance", "org.lance.spark.LanceNamespaceSparkCatalog")
+        .config("spark.sql.catalog.lance.impl", "rest")
+        .config("spark.sql.catalog.lance.uri", args.namespace_url)
+        .config("spark.sql.catalog.lance.storage.aws_endpoint", args.s3_endpoint)
+        .config("spark.sql.catalog.lance.storage.allow_http", "true")
+        .config("spark.sql.catalog.lance.storage.aws_access_key_id", args.access_key)
+        .config("spark.sql.catalog.lance.storage.aws_secret_access_key", args.secret_key)
+        .config("spark.sql.catalog.lance.storage.aws_region", "us-east-1")
+        .config("spark.sql.catalog.lance.storage.virtual_hosted_style_request", "false")
+        .getOrCreate()
+    )
+    spark.sparkContext.setLogLevel("WARN")
+    print(f"spark {spark.version} connected to {args.namespace_url}")
+
+    ns = f"lance.`{args.bucket}`.{args.namespace}"
+    table = f"{ns}.{args.table}"
+
+    # 1. A table bucket is the first level of the namespace path, so the
+    #    namespace below it is created through the catalog like any other.
+    spark.sql(f"CREATE NAMESPACE IF NOT EXISTS {ns}")
+    namespaces = [row[0] for row in spark.sql(f"SHOW NAMESPACES IN lance.`{args.bucket}`").collect()]
+    print(f"SHOW NAMESPACES -> {namespaces}")
+    check(
+        any(args.namespace in name for name in namespaces),
+        f"{args.namespace} is not listed in {namespaces}",
+    )
+
+    # 2. Creating a table. The connector declares it through the namespace and
+    #    writes the data itself, which is the split this catalog serves.
+    spark.sql(f"DROP TABLE IF EXISTS {table}")
+    spark.sql(
+        f"CREATE TABLE {table} (id BIGINT, title STRING, vector ARRAY<FLOAT>) USING lance"
+    )
+    # SHOW TABLES gives back the namespace's own identifiers - bucket, namespace
+    # and name joined by the delimiter - rather than a bare Spark table name.
+    tables = [row[1] for row in spark.sql(f"SHOW TABLES IN {ns}").collect()]
+    print(f"SHOW TABLES -> {tables}")
+    check(
+        any(args.table in name for name in tables),
+        f"{args.table} is not listed in {tables}",
+    )
+
+    # 3. Write, and read back through the catalog.
+    spark.sql(
+        f"""INSERT INTO {table} VALUES
+        (1, 'one',   array(1.0f, 2.0f, 3.0f)),
+        (2, 'two',   array(2.0f, 3.0f, 4.0f)),
+        (3, 'three', array(3.0f, 4.0f, 5.0f))"""
+    )
+    count = spark.sql(f"SELECT count(*) FROM {table}").collect()[0][0]
+    print(f"count -> {count}")
+    check(count == 3, f"read back {count} rows, want 3")
+
+    # 4. The schema survived the round trip, vector column included - the type
+    #    as well as the name, since a column that came back as ARRAY<DOUBLE> or
+    #    ARRAY<STRING> would still be called "vector".
+    fields = {field.name: field.dataType for field in spark.table(table).schema.fields}
+    print(f"schema -> {[(n, t.simpleString()) for n, t in sorted(fields.items())]}")
+    check({"id", "title", "vector"} <= set(fields), f"schema lost columns: {sorted(fields)}")
+    vector = fields["vector"]
+    check(
+        isinstance(vector, ArrayType) and isinstance(vector.elementType, FloatType),
+        f"vector came back as {vector.simpleString()}, want array<float>",
+    )
+    check(
+        fields["id"].simpleString() == "bigint",
+        f"id came back as {fields['id'].simpleString()}, want bigint",
+    )
+
+    # 5. A filter, so it is not only a full scan.
+    rows = spark.sql(f"SELECT id, title FROM {table} WHERE id >= 2 ORDER BY id").collect()
+    print(f"filtered -> {[(r[0], r[1]) for r in rows]}")
+    check(len(rows) == 2, f"filter returned {len(rows)} rows, want 2")
+    check(rows[0][0] == 2, f"filter returned {rows[0][0]} first, want 2")
+
+    # 6. Appending again, because a second commit is the one that fails when a
+    #    store cannot order commits - this store can, so it must not.
+    spark.sql(f"INSERT INTO {table} VALUES (4, 'four', array(4.0f, 5.0f, 6.0f))")
+    count = spark.sql(f"SELECT count(*) FROM {table}").collect()[0][0]
+    print(f"count after a second commit -> {count}")
+    check(count == 4, f"after appending, {count} rows, want 4")
+
+    # 7. And the dataset is readable straight off its location, with no catalog
+    #    in the path. This is the property that lets duckdb, pandas and
+    #    DataFusion read these tables, so it is read rather than asserted by
+    #    comment: the reader is given the storage options directly and never
+    #    consults spark.sql.catalog.lance.
+    location = f"s3://{args.bucket}/{args.namespace}/{args.table}"
+    direct = (
+        spark.read.format("lance")
+        .option("aws_endpoint", args.s3_endpoint)
+        .option("allow_http", "true")
+        .option("aws_access_key_id", args.access_key)
+        .option("aws_secret_access_key", args.secret_key)
+        .option("aws_region", "us-east-1")
+        .load(location)
+    )
+    direct_count = direct.count()
+    print(f"direct read of {location} -> {direct_count} rows")
+    check(direct_count == 4, f"direct read got {direct_count} rows, want 4")
+
+    spark.stop()
+    print("PASS")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/test/s3tables/catalog_spark_lance/spark_lance_test.go b/test/s3tables/catalog_spark_lance/spark_lance_test.go
new file mode 100644
index 0000000000..5bf1a0359f
--- /dev/null
+++ b/test/s3tables/catalog_spark_lance/spark_lance_test.go
@@ -0,0 +1,341 @@
+// Package sparklance drives the SeaweedFS Lance Namespace with Spark, through
+// the Lance Spark connector's DSV2 catalog. It is the Lance counterpart of the
+// catalog_spark suite, which does the same for the Iceberg REST catalog.
+//
+// Spark is the engine most likely to be pointed at a lakehouse, and it reaches
+// the catalog over the same routes as every other client - so what this proves
+// is the protocol, not our idea of it.
+package sparklance
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+)
+
+const (
+	sparkImage = "apache/spark:3.5.1"
+	// Pinned: the connector is as much the thing under test as the server, and
+	// an unrelated release should not change what an old commit reproduces.
+	lancePackages  = "org.lance:lance-spark-bundle-3.5_2.12:0.7.1"
+	startupTimeout = 60 * time.Second
+	clientTimeout  = 25 * time.Minute
+)
+
+// TestSparkLanceNamespace runs Spark SQL against the namespace end to end:
+// create a namespace and a table through the catalog, write, read back, filter,
+// and append a second time.
+func TestSparkLanceNamespace(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	if !hasDocker() {
+		t.Skip("Docker not available, skipping Spark Lance integration test")
+	}
+
+	env := newEnvironment(t)
+	defer env.cleanup()
+
+	env.start(t)
+
+	bucket := "sparklance-" + randomSuffix()
+	env.createTableBucket(t, bucket)
+
+	env.runSpark(t, bucket)
+}
+
+type environment struct {
+	weedBinary string
+	dataDir    string
+	bindIP     string
+
+	masterPort     int
+	masterGrpcPort int
+	volumePort     int
+	volumeGrpcPort int
+	filerPort      int
+	filerGrpcPort  int
+	s3Port         int
+	s3GrpcPort     int
+	lancePort      int
+
+	accessKey string
+	secretKey string
+
+	weedCancel context.CancelFunc
+	weedCmd    *exec.Cmd
+}
+
+func newEnvironment(t *testing.T) *environment {
+	t.Helper()
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatalf("get working directory: %v", err)
+	}
+	seaweedDir := wd
+	for i := 0; i < 5; i++ {
+		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
+			break
+		}
+		seaweedDir = filepath.Dir(seaweedDir)
+	}
+
+	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
+	if info, statErr := os.Stat(weedBinary); statErr == nil && !info.IsDir() {
+		// `make test` builds first; a plain `go test` will otherwise drive a
+		// binary from days ago and report a pass for code it never ran.
+		t.Logf("using %s, built %s", weedBinary, info.ModTime().Format(time.RFC3339))
+	} else {
+		weedBinary = "weed"
+		if _, err := exec.LookPath(weedBinary); err != nil {
+			t.Skip("weed binary not found, skipping integration test")
+		}
+	}
+
+	dataDir, err := os.MkdirTemp("", "seaweed-spark-lance-test-*")
+	if err != nil {
+		t.Fatalf("create temp dir: %v", err)
+	}
+
+	ports := testutil.MustAllocatePorts(t, 9)
+	return &environment{
+		weedBinary:     weedBinary,
+		dataDir:        dataDir,
+		bindIP:         testutil.FindBindIP(),
+		masterPort:     ports[0],
+		masterGrpcPort: ports[1],
+		volumePort:     ports[2],
+		volumeGrpcPort: ports[3],
+		filerPort:      ports[4],
+		filerGrpcPort:  ports[5],
+		s3Port:         ports[6],
+		s3GrpcPort:     ports[7],
+		lancePort:      ports[8],
+		accessKey:      "AKIAIOSFODNN7EXAMPLE",
+		secretKey:      "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+	}
+}
+
+func (env *environment) start(t *testing.T) {
+	t.Helper()
+
+	iamConfigPath, err := testutil.WriteIAMConfig(env.dataDir, env.accessKey, env.secretKey)
+	if err != nil {
+		t.Fatalf("write IAM config: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	env.weedCancel = cancel
+
+	miniArgs := append([]string{"mini",
+		"-master.port", fmt.Sprintf("%d", env.masterPort),
+		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
+		"-volume.port", fmt.Sprintf("%d", env.volumePort),
+		"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort),
+		"-filer.port", fmt.Sprintf("%d", env.filerPort),
+		"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort),
+		"-s3.port", fmt.Sprintf("%d", env.s3Port),
+		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
+		"-s3.port.lance", fmt.Sprintf("%d", env.lancePort),
+		"-s3.config", iamConfigPath,
+		"-ip", env.bindIP,
+		"-ip.bind", "0.0.0.0",
+		"-dir", env.dataDir,
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.iceberg=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
+	cmd.Dir = env.dataDir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Env = append(os.Environ(),
+		"AWS_ACCESS_KEY_ID="+env.accessKey,
+		"AWS_SECRET_ACCESS_KEY="+env.secretKey,
+	)
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("start SeaweedFS: %v", err)
+	}
+	env.weedCmd = cmd
+
+	// The namespace answers /v1/table once it is serving, which is a cheaper
+	// readiness check than waiting on a bucket that does not exist yet.
+	url := fmt.Sprintf("http://%s:%d/v1/table", env.bindIP, env.lancePort)
+	if !waitForHTTP(url, startupTimeout) {
+		t.Fatalf("the Lance namespace did not become ready at %s", url)
+	}
+}
+
+// waitForHTTP polls until the URL answers at all. An auth refusal counts: it
+// means the server is up, which is the only thing being waited on.
+func waitForHTTP(url string, timeout time.Duration) bool {
+	client := &http.Client{Timeout: 2 * time.Second}
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		resp, err := client.Get(url)
+		if err != nil {
+			time.Sleep(500 * time.Millisecond)
+			continue
+		}
+		status := resp.StatusCode
+		resp.Body.Close()
+		if status < 500 {
+			return true
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	return false
+}
+
+func (env *environment) cleanup() {
+	if env.weedCancel != nil {
+		env.weedCancel()
+	}
+	if env.weedCmd != nil {
+		_ = env.weedCmd.Wait()
+	}
+	if env.dataDir != "" {
+		_ = os.RemoveAll(env.dataDir)
+	}
+}
+
+// createTableBucket makes the bucket LanceDB will read through, declared LANCE
+// so the catalog refuses anything of another format in it.
+func (env *environment) createTableBucket(t *testing.T, bucket string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, env.weedBinary, "shell",
+		fmt.Sprintf("-master=%s:%d.%d", env.bindIP, env.masterPort, env.masterGrpcPort),
+	)
+	cmd.Stdin = strings.NewReader(fmt.Sprintf(
+		"s3tables.bucket -create -name %s -format LANCE -account 000000000000\nexit\n", bucket))
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("create table bucket %s: %v\n%s", bucket, err, out)
+	}
+	// weed shell reports a command's own failure on stdout and still exits 0, so
+	// the exit code alone would let a missing bucket through and turn a setup
+	// failure into a confusing engine failure later.
+	if !env.tableBucketExists(t, bucket) {
+		t.Fatalf("table bucket %s was not created:\n%s", bucket, out)
+	}
+	t.Logf("created LANCE table bucket %s", bucket)
+}
+
+// tableBucketExists asks the namespace, which lists table buckets at its root.
+func (env *environment) tableBucketExists(t *testing.T, bucket string) bool {
+	t.Helper()
+
+	url := fmt.Sprintf("http://%s:%d/v1/namespace/%s/exists", env.bindIP, env.lancePort, bucket)
+	resp, err := http.Post(url, "application/json", strings.NewReader("{}"))
+	if err != nil {
+		t.Fatalf("ask the namespace whether %s exists: %v", bucket, err)
+	}
+	defer resp.Body.Close()
+	return resp.StatusCode == http.StatusOK
+}
+
+// runSpark runs the SQL driver inside the stock Spark image. The connector is
+// pulled from Maven at submit time, the way the Iceberg Spark suite pulls its
+// runtime, so nothing has to be built here.
+func (env *environment) runSpark(t *testing.T, bucket string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), clientTimeout)
+	defer cancel()
+
+	script, absErr := filepath.Abs("spark_lance_ops.py")
+	if absErr != nil {
+		t.Fatalf("resolve the driver script: %v", absErr)
+	}
+
+	// Ivy needs somewhere writable, and the Spark image runs as a user without a
+	// home directory it can write to. Kept outside the run's data directory so
+	// the 287MB connector bundle is downloaded once rather than on every run,
+	// and under the user's own cache rather than a shared temp path: this is
+	// mounted into a container running as root, so another local user must not
+	// be able to pre-create it and choose what Spark loads.
+	cacheRoot, err := os.UserCacheDir()
+	if err != nil {
+		cacheRoot = env.dataDir
+	}
+	ivyDir := filepath.Join(cacheRoot, "seaweedfs-lance-spark-ivy")
+	if err := os.MkdirAll(ivyDir, 0o755); err != nil {
+		t.Fatalf("create the ivy directory: %v", err)
+	}
+
+	// The container reaches the gateway through the host gateway address, which
+	// is not the address the namespace advertises to its own clients.
+	namespaceURL := fmt.Sprintf("http://host.docker.internal:%d", env.lancePort)
+	s3Endpoint := fmt.Sprintf("http://host.docker.internal:%d", env.s3Port)
+
+	cmd := exec.CommandContext(ctx, "docker", "run", "--rm",
+		"--add-host", "host.docker.internal:host-gateway",
+		"-v", script+":/opt/spark/work-dir/spark_lance_ops.py:ro",
+		"-v", ivyDir+":/tmp/ivy",
+		"-e", "HOME=/tmp",
+		"-e", "SPARK_LOCAL_IP=127.0.0.1",
+		"-u", "root",
+		sparkImage,
+		"/opt/spark/bin/spark-submit",
+		"--packages", lancePackages,
+		"--conf", "spark.jars.ivy=/tmp/ivy",
+		"/opt/spark/work-dir/spark_lance_ops.py",
+		"--namespace-url", namespaceURL,
+		"--s3-endpoint", s3Endpoint,
+		"--bucket", bucket,
+		"--access-key", env.accessKey,
+		"--secret-key", env.secretKey,
+		"--packages", lancePackages,
+		"--ivy-dir", "/tmp/ivy",
+	)
+	out, err := cmd.CombinedOutput()
+	t.Logf("Spark output:\n%s", tailLines(string(out), 60))
+	if err != nil {
+		t.Fatalf("the Spark driver failed: %v", err)
+	}
+	if !strings.Contains(string(out), "PASS") {
+		t.Fatalf("the Spark driver did not report PASS")
+	}
+}
+
+// tailLines keeps the end of Spark's very chatty output, which is where the
+// driver's own lines and any failure are.
+func tailLines(out string, n int) string {
+	lines := strings.Split(strings.TrimRight(out, "\n"), "\n")
+	if len(lines) <= n {
+		return out
+	}
+	return "... " + fmt.Sprintf("%d earlier lines omitted", len(lines)-n) + "\n" +
+		strings.Join(lines[len(lines)-n:], "\n")
+}
+
+// hasDocker reports whether a Docker daemon answers. Bounded, because an
+// unhealthy daemon makes `docker version` hang, and this runs before the test
+// has a timeout of its own: better to skip than to eat the whole budget.
+func hasDocker() bool {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	return exec.CommandContext(ctx, "docker", "version").Run() == nil
+}
+
+func randomSuffix() string {
+	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
+	suffix := make([]byte, 8)
+	for i := range suffix {
+		suffix[i] = charset[rand.Intn(len(charset))]
+	}
+	return string(suffix)
+}
diff --git a/test/s3tables/catalog_trino/trino_catalog_test.go b/test/s3tables/catalog_trino/trino_catalog_test.go
index 7645dd2a8a..ddfc60fdeb 100644
--- a/test/s3tables/catalog_trino/trino_catalog_test.go
+++ b/test/s3tables/catalog_trino/trino_catalog_test.go
@@ -256,7 +256,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel
 
-	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
+	miniArgs := append([]string{"mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -270,7 +270,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Dir = env.dataDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/s3tables/lakekeeper/lakekeeper_test.go b/test/s3tables/lakekeeper/lakekeeper_test.go
index 7076cf187a..d3a23c76c4 100644
--- a/test/s3tables/lakekeeper/lakekeeper_test.go
+++ b/test/s3tables/lakekeeper/lakekeeper_test.go
@@ -205,7 +205,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	env.weedCancel = cancel
 
 	// Start weed mini with both S3 config (standard IAM) and IAM config (advanced IAM/STS)
-	cmd := exec.CommandContext(ctx, env.weedBinary, "-v", "4", "mini",
+	miniArgs := append([]string{"-v", "4", "mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -220,7 +220,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0", "-s3.port.iceberg=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Dir = env.dataDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/s3tables/lifecycle/Dockerfile.lance b/test/s3tables/lifecycle/Dockerfile.lance
new file mode 100644
index 0000000000..519b9b93fb
--- /dev/null
+++ b/test/s3tables/lifecycle/Dockerfile.lance
@@ -0,0 +1,17 @@
+# Lance client for the Lance half of the lifecycle test.
+#
+# Pinned to the versions this suite was verified against, the way
+# catalog_lancedb pins its client: an unrelated upstream release should not be
+# able to change what an old commit reproduces.
+FROM python:3.11-slim
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir \
+    "lance-namespace==0.8.6" \
+    "pylance==10.0.0" \
+    "pyarrow==25.0.1"
+
+COPY lance_lifecycle.py /app/
+
+CMD ["python3", "/app/lance_lifecycle.py", "--help"]
diff --git a/test/s3tables/lifecycle/Dockerfile.pyiceberg b/test/s3tables/lifecycle/Dockerfile.pyiceberg
new file mode 100644
index 0000000000..6c1c2903ee
--- /dev/null
+++ b/test/s3tables/lifecycle/Dockerfile.pyiceberg
@@ -0,0 +1,10 @@
+# PyIceberg client for the Iceberg half of the lifecycle test.
+FROM python:3.11-slim
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir "pyiceberg[s3fs]" pyarrow
+
+COPY iceberg_lifecycle.py /app/
+
+CMD ["python3", "/app/iceberg_lifecycle.py", "--help"]
diff --git a/test/s3tables/lifecycle/README.md b/test/s3tables/lifecycle/README.md
new file mode 100644
index 0000000000..2e36bc27c5
--- /dev/null
+++ b/test/s3tables/lifecycle/README.md
@@ -0,0 +1,77 @@
+# Table Lifecycle Integration Tests
+
+One table, all the way through: created in the catalog, filled by a real client,
+maintained, read again, dropped. Once for Iceberg and once for Lance. The
+Iceberg half always maintains through the worker; the Lance half maintains
+through the Rust worker or through the lance library, depending on what the
+environment has - see below.
+
+## Why this suite exists
+
+[#10853](https://github.com/seaweedfs/seaweedfs/issues/10853) was a compaction
+that rewrote every dictionary-encoded column onto a single value. It shipped.
+The maintenance tests we had were thorough about the bookkeeping - sequence
+numbers, added and deleted manifest entries, metadata versions, the manifest
+list - and every one of them passed, because not one of them opened the parquet
+file the worker had just written.
+
+So the assertion here is the dull one nothing else was making: tally the table
+before maintenance, tally it again after, and require the two to be equal. The
+tally is a row count, the cardinality of each dictionary-encoded column, and an
+md5 over whole rows. The cardinalities name the failure that happened; the
+digest catches a rewrite that keeps every column's cardinality and hands the
+values to the wrong rows.
+
+The same shape covers Lance, because the exposure is the same: a compaction that
+merges fragments can hand back a table that reads without complaint and answers
+wrongly.
+
+## What runs
+
+`TestIcebergTableLifecycle` starts a `weed mini` cluster, declares an `ICEBERG`
+table bucket, and runs two clients against it:
+
+| Client | Why both |
+| --- | --- |
+| DuckDB | the client the bug was reported against, and the only one here that writes the deprecated `PLAIN_DICTIONARY` encoding - parquet-go normalizes it away on write, so a Go writer cannot produce it |
+| PyIceberg | writes `RLE_DICTIONARY`, the modern spelling, so between the two the merge is checked against both dictionary encodings in the spec |
+
+Between the write and the read, the test runs the worker's whole maintenance
+cycle in-process against the live filer: compact, expire snapshots, remove
+orphans, rewrite manifests. A compaction that merged nothing fails the test
+rather than passing it - otherwise the read afterwards is checking a file the
+worker never wrote.
+
+`TestLanceTableLifecycle` does the same against a `LANCE` bucket: declare
+through the namespace, write a fragment per append, maintain, read, drop.
+Maintenance goes through the Rust worker's own handlers where cargo is
+installed, and through the two lance calls those handlers wrap where it is not.
+`WEED_LANCE_MAINTENANCE=library|worker` picks one instead of letting the test
+guess; CI sets `library`, because a cold build of the lance crate costs more
+than the layer it would be checking.
+
+Both tests finish by dropping the table and checking the data actually left the
+filer, which is the half of a lifecycle a catalog test never reaches.
+
+## Running it
+
+    cd test/s3tables/lifecycle
+    (cd ../../../weed && go build .)     # the harness runs this binary
+    go test -v -timeout 40m .
+
+Skipped without Docker and in `-short` mode. The first run builds the two client
+images and pulls `duckdb/duckdb:latest`; later runs reuse them. The DuckDB half
+skips itself, rather than failing, on an image whose iceberg extension cannot
+write through a REST catalog.
+
+To watch it catch the bug it was written for, pin parquet-go back to the version
+that had it:
+
+    go mod edit -require=github.com/parquet-go/parquet-go@v0.30.1 && go mod tidy
+    go test -run TestIcebergTableLifecycle/DuckDB -v .
+
+    maintenance collapsed the category column: 7 distinct values -> 1
+    maintenance collapsed the value column: 13 distinct values -> 1
+
+The PyIceberg half still passes there, which is the reason both clients are in
+this directory.
diff --git a/test/s3tables/lifecycle/cluster_test.go b/test/s3tables/lifecycle/cluster_test.go
new file mode 100644
index 0000000000..ce5037f6b5
--- /dev/null
+++ b/test/s3tables/lifecycle/cluster_test.go
@@ -0,0 +1,292 @@
+// Package lifecycle takes a table through everything that happens to it: made
+// through the catalog, filled by a real client, maintained by the worker, read
+// again, and dropped.
+//
+// The step that matters is the read after maintenance. A compaction once
+// rewrote every dictionary-encoded column onto a single value and went out in a
+// release, because the tests we had checked the bookkeeping - sequence numbers,
+// manifest entries, metadata versions - and none of them opened the file the
+// worker had just written. A tally taken before maintenance and the same tally
+// taken after is the whole idea, and it is the same idea for both formats:
+// Iceberg compaction merges parquet files, Lance compaction merges fragments,
+// and either can hand back a table that reads without complaint and answers
+// wrongly.
+package lifecycle
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"math/rand"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+const (
+	// The keys the issue's own recipe uses. weed mini turns them into the
+	// admin identity, which is what the clients then sign with.
+	accessKey = "AKIAIOSFODNN7EXAMPLE"
+	secretKey = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+
+	startupTimeout = 60 * time.Second
+	clientTimeout  = 20 * time.Minute
+)
+
+// shared is the one cluster both formats run against. They use separate table
+// buckets, and a bucket holds one format only.
+var shared *environment
+
+// errNoBinary is the one setup failure worth skipping over.
+var errNoBinary = errors.New("weed binary not found")
+
+func TestMain(m *testing.M) {
+	flag.Parse()
+	if testing.Short() {
+		os.Exit(m.Run())
+	}
+
+	// A checkout without a weed binary cannot run this and says so. Anything
+	// else - ports, a cluster that will not come up - is a failure, because a
+	// suite that turns its own breakage into a green run is the thing this
+	// directory exists to stop.
+	env, err := newEnvironment()
+	if errors.Is(err, errNoBinary) {
+		fmt.Fprintf(os.Stderr, "SKIP: %v\n", err)
+		os.Exit(m.Run())
+	}
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "FAIL: %v\n", err)
+		os.Exit(1)
+	}
+	if err := env.start(); err != nil {
+		fmt.Fprintf(os.Stderr, "FAIL: weed mini did not start: %v\n", err)
+		env.cleanup()
+		os.Exit(1)
+	}
+	shared = env
+
+	code := m.Run()
+	shared.cleanup()
+	os.Exit(code)
+}
+
+type environment struct {
+	weedBinary string
+	rootDir    string
+	testDir    string
+	dataDir    string
+
+	masterPort     int
+	masterGrpcPort int
+	volumePort     int
+	volumeGrpcPort int
+	filerPort      int
+	filerGrpcPort  int
+	s3Port         int
+	s3GrpcPort     int
+	icebergPort    int
+	lancePort      int
+	adminPort      int
+
+	weedCancel context.CancelFunc
+	weedCmd    *exec.Cmd
+}
+
+func newEnvironment() (*environment, error) {
+	wd, err := os.Getwd()
+	if err != nil {
+		return nil, fmt.Errorf("get working directory: %w", err)
+	}
+	seaweedDir := wd
+	for i := 0; i < 5; i++ {
+		if _, err := os.Stat(filepath.Join(seaweedDir, "go.mod")); err == nil {
+			break
+		}
+		seaweedDir = filepath.Dir(seaweedDir)
+	}
+
+	weedBinary := filepath.Join(seaweedDir, "weed", "weed")
+	if info, statErr := os.Stat(weedBinary); statErr == nil && !info.IsDir() {
+		// A plain `go test` will otherwise drive a binary from days ago and
+		// report a pass for code it never ran.
+		fmt.Fprintf(os.Stderr, "using %s, built %s\n", weedBinary, info.ModTime().Format(time.RFC3339))
+	} else {
+		weedBinary = "weed"
+		if _, err := exec.LookPath(weedBinary); err != nil {
+			return nil, errNoBinary
+		}
+	}
+
+	dataDir, err := os.MkdirTemp("", "seaweed-lifecycle-*")
+	if err != nil {
+		return nil, fmt.Errorf("create temp dir: %w", err)
+	}
+
+	ports, err := testutil.AllocatePorts(10)
+	if err != nil {
+		return nil, fmt.Errorf("allocate ports: %w", err)
+	}
+	adminPorts, err := testutil.AllocateMiniPorts(1)
+	if err != nil {
+		return nil, fmt.Errorf("allocate admin port: %w", err)
+	}
+	return &environment{
+		weedBinary:     weedBinary,
+		rootDir:        seaweedDir,
+		testDir:        wd,
+		dataDir:        dataDir,
+		masterPort:     ports[0],
+		masterGrpcPort: ports[1],
+		volumePort:     ports[2],
+		volumeGrpcPort: ports[3],
+		filerPort:      ports[4],
+		filerGrpcPort:  ports[5],
+		s3Port:         ports[6],
+		s3GrpcPort:     ports[7],
+		icebergPort:    ports[8],
+		lancePort:      ports[9],
+		adminPort:      adminPorts[0],
+	}, nil
+}
+
+func (env *environment) start() error {
+	// The catalog clients here do not sign, so anonymous access is configured explicitly.
+	iamConfigPath, err := testutil.WriteIAMConfig(env.dataDir, accessKey, secretKey)
+	if err != nil {
+		return fmt.Errorf("write IAM config: %w", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	env.weedCancel = cancel
+
+	miniArgs := append([]string{"mini",
+		"-master.port", fmt.Sprintf("%d", env.masterPort),
+		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
+		"-volume.port", fmt.Sprintf("%d", env.volumePort),
+		"-volume.port.grpc", fmt.Sprintf("%d", env.volumeGrpcPort),
+		"-filer.port", fmt.Sprintf("%d", env.filerPort),
+		"-filer.port.grpc", fmt.Sprintf("%d", env.filerGrpcPort),
+		"-s3.port", fmt.Sprintf("%d", env.s3Port),
+		"-s3.port.grpc", fmt.Sprintf("%d", env.s3GrpcPort),
+		"-s3.port.iceberg", fmt.Sprintf("%d", env.icebergPort),
+		"-s3.port.lance", fmt.Sprintf("%d", env.lancePort),
+		"-s3.config", iamConfigPath,
+		"-ip.bind", "0.0.0.0",
+		"-dir", env.dataDir,
+	}, testutil.MiniAdminArgs(env.adminPort)...)
+	miniArgs = append(miniArgs, "-webdav=false")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
+	cmd.Dir = env.dataDir
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	// mini makes its admin identity from these, so they are the keys the
+	// clients sign with rather than a separate IAM file to keep in step.
+	cmd.Env = append(os.Environ(),
+		"AWS_ACCESS_KEY_ID="+accessKey,
+		"AWS_SECRET_ACCESS_KEY="+secretKey,
+	)
+
+	if err := cmd.Start(); err != nil {
+		cancel()
+		return err
+	}
+	env.weedCmd = cmd
+
+	if !testutil.WaitForService(env.catalogURL()+"/v1/config", startupTimeout) {
+		cancel()
+		return fmt.Errorf("the Iceberg catalog never answered on port %d", env.icebergPort)
+	}
+	if !testutil.WaitForPort(env.lancePort, startupTimeout) {
+		cancel()
+		return fmt.Errorf("the Lance namespace never answered on port %d", env.lancePort)
+	}
+	return nil
+}
+
+func (env *environment) cleanup() {
+	if env.weedCancel != nil {
+		env.weedCancel()
+	}
+	if env.weedCmd != nil {
+		_ = env.weedCmd.Wait()
+	}
+	if env.dataDir != "" {
+		_ = os.RemoveAll(env.dataDir)
+	}
+}
+
+func (env *environment) catalogURL() string {
+	return fmt.Sprintf("http://127.0.0.1:%d", env.icebergPort)
+}
+
+// A container reaches the same gateway by another name than the host does.
+func (env *environment) containerURL(port int) string {
+	return fmt.Sprintf("http://host.docker.internal:%d", port)
+}
+
+// createTableBucket makes a bucket declared for one format, so the catalog
+// refuses tables of any other kind in it.
+func (env *environment) createTableBucket(t *testing.T, bucket, format string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, env.weedBinary, "shell",
+		fmt.Sprintf("-master=127.0.0.1:%d.%d", env.masterPort, env.masterGrpcPort),
+	)
+	cmd.Stdin = strings.NewReader(fmt.Sprintf(
+		"s3tables.bucket -create -name %s -format %s -account 000000000000\nexit\n", bucket, format))
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("create the %s table bucket %s: %v\n%s", format, bucket, err, out)
+	}
+}
+
+// filerClient dials the filer the maintenance handlers talk to.
+func (env *environment) filerClient(t *testing.T) filer_pb.SeaweedFilerClient {
+	t.Helper()
+
+	conn, err := grpc.NewClient(fmt.Sprintf("127.0.0.1:%d", env.filerGrpcPort),
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatalf("dial the filer: %v", err)
+	}
+	t.Cleanup(func() { conn.Close() })
+	return filer_pb.NewSeaweedFilerClient(conn)
+}
+
+// entryExists tells "the catalog forgot the table" from "the data is gone".
+func (env *environment) entryExists(t *testing.T, path string) bool {
+	t.Helper()
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Get(fmt.Sprintf("http://127.0.0.1:%d%s", env.filerPort, path))
+	if err != nil {
+		t.Fatalf("filer GET %s: %v", path, err)
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, resp.Body)
+	return resp.StatusCode == http.StatusOK
+}
+
+func randomSuffix() string {
+	const charset = "abcdefghijklmnopqrstuvwxyz0123456789"
+	suffix := make([]byte, 8)
+	for i := range suffix {
+		suffix[i] = charset[rand.Intn(len(charset))]
+	}
+	return string(suffix)
+}
diff --git a/test/s3tables/lifecycle/iceberg_lifecycle.py b/test/s3tables/lifecycle/iceberg_lifecycle.py
new file mode 100644
index 0000000000..d8965abd7b
--- /dev/null
+++ b/test/s3tables/lifecycle/iceberg_lifecycle.py
@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""PyIceberg half of the table lifecycle, run one phase per invocation.
+
+The Go test calls this three times - write, verify, drop - and runs the
+maintenance worker between the first two. Splitting it that way is the whole
+point: a tally taken before compaction and the same tally taken after are the
+only thing that catches a merge that rewrote every dictionary-encoded column
+onto a single value and said nothing.
+"""
+
+import argparse
+import hashlib
+import json
+import sys
+import time
+
+import pyarrow as pa
+from pyiceberg.catalog import load_catalog
+from pyiceberg.exceptions import NamespaceAlreadyExistsError, NoSuchTableError
+from pyiceberg.schema import Schema
+from pyiceberg.types import LongType, NestedField, StringType, TimestamptzType
+
+# Few enough distinct values in the two string columns that any writer worth
+# the name dictionary-encodes them, which is the encoding that broke.
+CATEGORIES = 7
+VALUES = 13
+ROWS_PER_BATCH = 4000
+BATCHES = 3
+
+SCHEMA = Schema(
+    NestedField(1, "id", LongType(), required=True),
+    NestedField(2, "category", StringType(), required=True),
+    NestedField(3, "value", StringType(), required=True),
+    NestedField(4, "ts", TimestamptzType(), required=True),
+)
+
+ARROW_SCHEMA = pa.schema(
+    [
+        pa.field("id", pa.int64(), nullable=False),
+        pa.field("category", pa.string(), nullable=False),
+        pa.field("value", pa.string(), nullable=False),
+        pa.field("ts", pa.timestamp("us", tz="UTC"), nullable=False),
+    ]
+)
+
+
+def batch(start, count):
+    ids = list(range(start, start + count))
+    return pa.Table.from_pydict(
+        {
+            "id": ids,
+            "category": [f"cat-{i % CATEGORIES}" for i in ids],
+            "value": [f"v-{i % VALUES}" for i in ids],
+            # An hour apart, so the rows spread over months the way a real
+            # table's do without needing a partition spec to prove it.
+            "ts": [1772323200000000 + i * 3600000000 for i in ids],
+        },
+        schema=ARROW_SCHEMA,
+    )
+
+
+def tally(table):
+    """Row count, per-column cardinality, and a digest of every row.
+
+    The cardinalities catch a column collapsed onto one dictionary entry; the
+    digest catches everything else, including a merge that keeps the right
+    number of distinct values while handing them to the wrong rows. Every
+    column goes into it, not just the two the cardinalities watch - compaction
+    rewrites the whole row. ts goes in as microseconds so no timezone sits
+    between the two runs.
+    """
+    scanned = table.scan().to_arrow()
+    categories = scanned.column("category").to_pylist()
+    values = scanned.column("value").to_pylist()
+    rows = [
+        f"{i}|{t}|{c}|{v}"
+        for i, t, c, v in zip(
+            scanned.column("id").to_pylist(),
+            scanned.column("ts").cast(pa.int64()).to_pylist(),
+            categories,
+            values,
+            strict=True,
+        )
+    ]
+    digest = hashlib.md5(
+        "\n".join(sorted(rows)).encode(), usedforsecurity=False
+    ).hexdigest()
+    return {
+        "rows": scanned.num_rows,
+        "categories": len(set(categories)),
+        "values": len(set(values)),
+        "digest": digest,
+    }
+
+
+def connect(args):
+    properties = {
+        "type": "rest",
+        "uri": args.catalog_url,
+        "warehouse": f"s3://{args.bucket}/",
+        "prefix": args.bucket,
+        "auth": {"type": "noop"},
+        "s3.endpoint": args.s3_endpoint,
+        "s3.access-key-id": args.access_key,
+        "s3.secret-access-key": args.secret_key,
+        "s3.region": "us-east-1",
+        "s3.path-style-access": "true",
+    }
+    last = None
+    for attempt in range(10):
+        try:
+            return load_catalog("rest", **properties)
+        except Exception as err:  # the gateway may still be coming up
+            last = err
+            print(f"connect attempt {attempt + 1} failed: {err}", file=sys.stderr)
+            time.sleep(2)
+    raise last
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--phase", required=True, choices=["write", "verify", "drop"])
+    parser.add_argument("--catalog-url", required=True)
+    parser.add_argument("--s3-endpoint", required=True)
+    parser.add_argument("--bucket", required=True)
+    parser.add_argument("--namespace", required=True)
+    parser.add_argument("--table", required=True)
+    parser.add_argument("--access-key", required=True)
+    parser.add_argument("--secret-key", required=True)
+    args = parser.parse_args()
+
+    catalog = connect(args)
+    identifier = f"{args.namespace}.{args.table}"
+
+    if args.phase == "write":
+        try:
+            catalog.create_namespace(args.namespace)
+        except NamespaceAlreadyExistsError:
+            pass
+        table = catalog.create_table(identifier, schema=SCHEMA)
+        # One append per batch, so compaction has several files to merge
+        # rather than one it would leave alone.
+        for i in range(BATCHES):
+            table.append(batch(i * ROWS_PER_BATCH + 1, ROWS_PER_BATCH))
+        table = catalog.load_table(identifier)
+        print(json.dumps(tally(table)))
+        return
+
+    if args.phase == "verify":
+        print(json.dumps(tally(catalog.load_table(identifier))))
+        return
+
+    catalog.drop_table(identifier)
+    try:
+        catalog.load_table(identifier)
+    except NoSuchTableError:
+        pass
+    else:
+        raise SystemExit("the table is still in the catalog after a drop")
+    catalog.drop_namespace(args.namespace)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/test/s3tables/lifecycle/iceberg_lifecycle_test.go b/test/s3tables/lifecycle/iceberg_lifecycle_test.go
new file mode 100644
index 0000000000..0eae42a575
--- /dev/null
+++ b/test/s3tables/lifecycle/iceberg_lifecycle_test.go
@@ -0,0 +1,399 @@
+package lifecycle
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/iceberg"
+)
+
+const (
+	pyicebergImage = "seaweedfs-lifecycle-pyiceberg"
+	duckdbImage    = "duckdb/duckdb:latest"
+
+	// The phase that installs the extension, and so the only one whose failure
+	// can mean the image rather than the code.
+	firstPhase = "write"
+
+	// Three appends of this many rows, all inside one month so they land in
+	// one partition and compaction has something to merge. The two string
+	// columns hold few enough distinct values to be dictionary-encoded, which
+	// is the encoding the merge destroyed.
+	rowsPerBatch = 4000
+	batches      = 3
+	categories   = 7
+	values       = 13
+)
+
+// tally is what a client reports about a table. Both halves of this suite
+// speak it, and the point of the whole suite is that the one taken before
+// maintenance equals the one taken after.
+type tally struct {
+	Rows       int    `json:"rows"`
+	Categories int    `json:"categories"`
+	Values     int    `json:"values"`
+	Digest     string `json:"digest"`
+	// Lance only: a compaction that merged nothing would otherwise let this
+	// test pass without having tested anything.
+	Fragments int `json:"fragments"`
+	Version   int `json:"version"`
+}
+
+func TestIcebergTableLifecycle(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+	if shared == nil {
+		t.Skip("no cluster")
+	}
+	if !testutil.HasDocker() {
+		t.Skip("Docker not available")
+	}
+
+	// DuckDB is the client the bug was reported against, and the only one
+	// here that writes the deprecated PLAIN_DICTIONARY encoding a Go writer
+	// will not produce. PyIceberg writes the modern one, so between them the
+	// merge is checked against both dictionary encodings in the spec.
+	t.Run("DuckDB", testIcebergLifecycleWithDuckDB)
+	t.Run("PyIceberg", testIcebergLifecycleWithPyIceberg)
+}
+
+func testIcebergLifecycleWithDuckDB(t *testing.T) {
+	env := shared
+
+	// The write phase's first act is INSTALLing the iceberg extension, whose
+	// binary can itself target a newer x86-64 baseline than the host CPU has.
+	testutil.RequireImageRunnable(t,
+		"--entrypoint", "duckdb", duckdbImage,
+		"-c", "INSTALL iceberg; LOAD iceberg; SELECT 1;")
+
+	bucket := "lifecycle-duckdb-" + randomSuffix()
+	namespace, table := "sales", "events"
+	env.createTableBucket(t, bucket, "ICEBERG")
+
+	inserts := make([]string, 0, batches)
+	for i := 0; i < batches; i++ {
+		inserts = append(inserts, fmt.Sprintf(
+			"INSERT INTO cat.%s.%s SELECT g, TIMESTAMPTZ '2026-03-01 00:00:00' + INTERVAL (g %% 600) MINUTE, "+
+				"'cat-' || (g %% %d), 'v-' || (g %% %d) FROM generate_series(%d, %d) t(g);",
+			namespace, table, categories, values, i*rowsPerBatch+1, (i+1)*rowsPerBatch))
+	}
+
+	before := env.duckdb(t, bucket, "write", strings.Join([]string{
+		fmt.Sprintf("CREATE SCHEMA cat.%s;", namespace),
+		// Partitioned, the way the table in the report was. Compaction bins
+		// per partition, so this is also what puts more than one bin in play.
+		fmt.Sprintf("CREATE TABLE cat.%s.%s(id int, ts timestamptz, category text, value text) PARTITIONED BY (month(ts));", namespace, table),
+		strings.Join(inserts, "\n"),
+		duckdbTallySQL(namespace, table),
+	}, "\n"))
+	assertSeeded(t, before)
+
+	env.maintainIcebergTable(t, bucket, namespace+"/"+table)
+
+	after := env.duckdb(t, bucket, "verify", duckdbTallySQL(namespace, table))
+	assertSameData(t, before, after)
+
+	env.duckdb(t, bucket, "drop", fmt.Sprintf("DROP TABLE cat.%s.%s;\nDROP SCHEMA cat.%s;", namespace, table, namespace))
+	if env.entryExists(t, fmt.Sprintf("/buckets/%s/%s/%s/", bucket, namespace, table)) {
+		t.Fatal("the dropped table's data is still on disk")
+	}
+}
+
+func testIcebergLifecycleWithPyIceberg(t *testing.T) {
+	env := shared
+	bucket := "lifecycle-pyiceberg-" + randomSuffix()
+	namespace, table := "sales", "events"
+	env.createTableBucket(t, bucket, "ICEBERG")
+	buildClientImage(t, pyicebergImage, "Dockerfile.pyiceberg")
+	testutil.RequireImageRunnable(t,
+		"--entrypoint", "python3", pyicebergImage,
+		"-c", "import pyarrow; from pyiceberg.catalog import load_catalog")
+
+	before := env.pyiceberg(t, "write", bucket, namespace, table)
+	assertSeeded(t, before)
+
+	env.maintainIcebergTable(t, bucket, namespace+"/"+table)
+
+	after := env.pyiceberg(t, "verify", bucket, namespace, table)
+	assertSameData(t, before, after)
+
+	env.pyiceberg(t, "drop", bucket, namespace, table)
+	if env.entryExists(t, fmt.Sprintf("/buckets/%s/%s/%s/", bucket, namespace, table)) {
+		t.Fatal("the dropped table's data is still on disk")
+	}
+}
+
+// maintainIcebergTable runs the worker's whole maintenance cycle against the
+// live filer, in the order a scheduled worker would: merge the small files,
+// drop the snapshots that referenced them, sweep what nothing references any
+// more, then fold the manifests together.
+func (env *environment) maintainIcebergTable(t *testing.T, bucket, tablePath string) {
+	t.Helper()
+
+	client := env.filerClient(t)
+	handler := iceberg.NewHandler(nil)
+	config := iceberg.Config{
+		TargetFileSizeBytes:  256 << 20,
+		MinInputFiles:        2,
+		MaxCommitRetries:     3,
+		SnapshotRetentionMs:  1,
+		MaxSnapshotsToKeep:   1,
+		OrphanOlderThanHours: 1,
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	operations := []struct {
+		name string
+		run  func() (string, map[string]int64, error)
+	}{
+		{"compact", func() (string, map[string]int64, error) {
+			return handler.CompactDataFiles(ctx, client, bucket, tablePath, config)
+		}},
+		{"expire", func() (string, map[string]int64, error) {
+			return handler.ExpireSnapshots(ctx, client, bucket, tablePath, config)
+		}},
+		{"orphans", func() (string, map[string]int64, error) {
+			return handler.RemoveOrphans(ctx, client, bucket, tablePath, config)
+		}},
+		{"manifests", func() (string, map[string]int64, error) {
+			return handler.RewriteManifests(ctx, client, bucket, tablePath, config)
+		}},
+	}
+	for _, operation := range operations {
+		result, metrics, err := operation.run()
+		if err != nil {
+			t.Fatalf("%s: %v", operation.name, err)
+		}
+		t.Logf("%s: %s %v", operation.name, result, metrics)
+
+		// A compaction that merged nothing leaves the read below checking a
+		// file the worker never wrote, which proves nothing at all.
+		if operation.name == "compact" && metrics[iceberg.MetricFilesMerged] < batches {
+			t.Fatalf("compaction merged %d files, want all %d written by the client: %s",
+				metrics[iceberg.MetricFilesMerged], batches, result)
+		}
+	}
+}
+
+// duckdb runs a script against the catalog and returns whatever tally it
+// printed. The prelude is the reporter's own ATTACH, SigV4 and all.
+func (env *environment) duckdb(t *testing.T, bucket, phase, body string) tally {
+	t.Helper()
+
+	script := fmt.Sprintf(`INSTALL iceberg;
+LOAD iceberg;
+CREATE SECRET s3_secret (TYPE S3, KEY_ID '%s', SECRET '%s', ENDPOINT 'host.docker.internal:%d', URL_STYLE 'path', USE_SSL false);
+ATTACH 's3://%s' AS cat (TYPE ICEBERG, ENDPOINT '%s', AUTHORIZATION_TYPE SigV4, SECRET 's3_secret', SIGV4_SERVICE 's3', SIGV4_REGION 'us-east-1', ACCESS_DELEGATION_MODE 'none', READ_ONLY false);
+%s
+`, accessKey, secretKey, env.s3Port, bucket, env.containerURL(env.icebergPort), body)
+
+	name := fmt.Sprintf("duckdb-%s-%s.sql", bucket, phase)
+	if err := os.WriteFile(filepath.Join(env.dataDir, name), []byte(script), 0644); err != nil {
+		t.Fatalf("write the DuckDB script: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), clientTimeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "docker", "run", "--rm",
+		"-v", fmt.Sprintf("%s:/test", env.dataDir),
+		"--add-host", "host.docker.internal:host-gateway",
+		"--entrypoint", "duckdb",
+		duckdbImage,
+		"-init", "/test/"+name,
+		"-c", "SELECT 1",
+	)
+	out, err := cmd.CombinedOutput()
+	t.Logf("DuckDB %s:\n%s", phase, out)
+	if err != nil {
+		if phase == firstPhase && lacksIcebergExtension(string(out)) {
+			t.Skipf("this DuckDB image has no iceberg extension: %v", err)
+		}
+		t.Fatalf("DuckDB %s: %v", phase, err)
+	}
+	if !strings.Contains(body, "TALLY") {
+		return tally{}
+	}
+	return parseDuckDBTally(t, string(out))
+}
+
+func duckdbTallySQL(namespace, table string) string {
+	// The digest covers whole rows - every column, not just the two the
+	// cardinalities watch - because counting each column on its own passes a
+	// merge that keeps every column's cardinality and hands the values to the
+	// wrong rows. ts goes in as microseconds so the session's timezone cannot
+	// change how it renders between the two runs.
+	return fmt.Sprintf("SELECT 'TALLY ' || count(*) || ' ' || count(DISTINCT category) || ' ' || count(DISTINCT value)"+
+		" || ' ' || md5(string_agg(id || '|' || epoch_us(ts) || '|' || category || '|' || value, chr(10) ORDER BY id)) AS marker"+
+		" FROM cat.%s.%s;",
+		namespace, table)
+}
+
+var duckdbTallyPattern = regexp.MustCompile(`TALLY (\d+) (\d+) (\d+) ([0-9a-f]{32})`)
+
+func parseDuckDBTally(t *testing.T, out string) tally {
+	t.Helper()
+
+	fields := duckdbTallyPattern.FindStringSubmatch(out)
+	if fields == nil {
+		t.Fatalf("DuckDB printed no tally:\n%s", out)
+	}
+	number := func(s string) int {
+		value, err := strconv.Atoi(s)
+		if err != nil {
+			t.Fatalf("parse %q: %v", s, err)
+		}
+		return value
+	}
+	return tally{
+		Rows:       number(fields[1]),
+		Categories: number(fields[2]),
+		Values:     number(fields[3]),
+		Digest:     fields[4],
+	}
+}
+
+// lacksIcebergExtension reports whether DuckDB never got as far as this
+// repository's code, which is the only failure worth skipping over.
+//
+// The extension ships separately from the image, so an environment that cannot
+// fetch it has nothing to say about compaction. Everything past LOAD - a parse
+// error on the ATTACH, a refusal from the catalog, a bad read - is ours, and
+// has to fail: this is the one test covering the PLAIN_DICTIONARY encoding, and
+// a skip nobody reads is how the corruption it was written for shipped.
+func lacksIcebergExtension(out string) bool {
+	for _, marker := range []string{
+		"iceberg extension is not available",
+		"Failed to download extension",
+		`Extension "iceberg" not found`,
+		"Unknown extension",
+	} {
+		if strings.Contains(out, marker) {
+			return true
+		}
+	}
+	return false
+}
+
+func (env *environment) pyiceberg(t *testing.T, phase, bucket, namespace, table string) tally {
+	t.Helper()
+
+	out := env.runClient(t, pyicebergImage, phase, "/app/iceberg_lifecycle.py",
+		"--catalog-url", env.containerURL(env.icebergPort),
+		"--s3-endpoint", env.containerURL(env.s3Port),
+		"--bucket", bucket,
+		"--namespace", namespace,
+		"--table", table,
+	)
+	if phase == "drop" {
+		return tally{}
+	}
+	return decodeTally(t, out)
+}
+
+// runClient runs one phase of a python client and returns its stdout.
+func (env *environment) runClient(t *testing.T, image, phase, script string, args ...string) string {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), clientTimeout)
+	defer cancel()
+
+	run := []string{"run", "--rm",
+		"--add-host", "host.docker.internal:host-gateway",
+		"-e", "AWS_ACCESS_KEY_ID=" + accessKey,
+		"-e", "AWS_SECRET_ACCESS_KEY=" + secretKey,
+		"-e", "AWS_REGION=us-east-1",
+		"-e", "AWS_ALLOW_HTTP=true",
+		image, "python3", script, "--phase", phase,
+		"--access-key", accessKey, "--secret-key", secretKey,
+	}
+	cmd := exec.CommandContext(ctx, "docker", append(run, args...)...)
+	var stderr strings.Builder
+	cmd.Stderr = &stderr
+	out, err := cmd.Output()
+	if stderr.Len() > 0 {
+		t.Logf("%s %s (stderr):\n%s", image, phase, stderr.String())
+	}
+	if err != nil {
+		t.Fatalf("%s %s: %v\n%s", image, phase, err, out)
+	}
+	t.Logf("%s %s: %s", image, phase, strings.TrimSpace(string(out)))
+	return string(out)
+}
+
+func decodeTally(t *testing.T, out string) tally {
+	t.Helper()
+
+	// The clients print the tally last; anything a library logged before it
+	// is not JSON and not ours.
+	lines := strings.Split(strings.TrimSpace(out), "\n")
+	var decoded tally
+	if err := json.Unmarshal([]byte(lines[len(lines)-1]), &decoded); err != nil {
+		t.Fatalf("decode the tally from %q: %v", out, err)
+	}
+	return decoded
+}
+
+func buildClientImage(t *testing.T, image, dockerfile string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "docker", "build", "-t", image, "-f", dockerfile, ".")
+	cmd.Dir = shared.testDir
+	if out, err := cmd.CombinedOutput(); err != nil {
+		t.Fatalf("build %s: %v\n%s", image, err, out)
+	}
+}
+
+// assertSeeded checks the client wrote what this suite assumes it wrote. Every
+// comparison below is against these numbers, so a client that quietly seeded
+// one row would otherwise make the whole test vacuous.
+func assertSeeded(t *testing.T, seeded tally) {
+	t.Helper()
+
+	if want := rowsPerBatch * batches; seeded.Rows != want {
+		t.Fatalf("seeded %d rows, want %d", seeded.Rows, want)
+	}
+	if seeded.Categories != categories || seeded.Values != values {
+		t.Fatalf("seeded %d categories and %d values, want %d and %d",
+			seeded.Categories, seeded.Values, categories, values)
+	}
+}
+
+// assertSameData is the test. Maintenance rewrites files; it must not change a
+// single row, and the cardinalities are called out separately because that is
+// the shape the failure took: a dictionary column collapsed onto one entry,
+// read back without an error, and answered wrongly.
+func assertSameData(t *testing.T, before, after tally) {
+	t.Helper()
+
+	if after.Rows != before.Rows {
+		t.Errorf("maintenance changed the row count: %d -> %d", before.Rows, after.Rows)
+	}
+	if after.Categories != before.Categories {
+		t.Errorf("maintenance collapsed the category column: %d distinct values -> %d",
+			before.Categories, after.Categories)
+	}
+	if after.Values != before.Values {
+		t.Errorf("maintenance collapsed the value column: %d distinct values -> %d",
+			before.Values, after.Values)
+	}
+	if after.Digest != before.Digest {
+		t.Errorf("maintenance changed the rows: digest %s -> %s", before.Digest, after.Digest)
+	}
+}
diff --git a/test/s3tables/lifecycle/lance_lifecycle.py b/test/s3tables/lifecycle/lance_lifecycle.py
new file mode 100644
index 0000000000..60d62604c7
--- /dev/null
+++ b/test/s3tables/lifecycle/lance_lifecycle.py
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""Lance half of the table lifecycle, run one phase per invocation.
+
+The Go test calls this for each step and maintains the table in between, so the
+tally taken before maintenance and the tally taken after are directly
+comparable. That comparison is the test: the Iceberg side of this suite exists
+because compaction once rewrote a table's dictionary columns onto a single
+value and every check we had still passed, and a Lance dataset is rewritten by
+the same kind of job.
+
+The maintain phase is a fallback. When the Rust worker can be built, the Go test
+runs its handlers against this table instead and skips this phase - what runs
+here are the same two lance calls the handlers make.
+"""
+
+import argparse
+import hashlib
+import json
+import sys
+import warnings
+from datetime import timedelta
+
+warnings.filterwarnings("ignore")
+
+import lance
+import lance_namespace as ln
+import pyarrow as pa
+
+# Low enough cardinality that these two columns are dictionary-encoded.
+CATEGORIES = 7
+VALUES = 13
+ROWS_PER_BATCH = 4000
+BATCHES = 3
+DIM = 8
+
+
+def rows(start, count):
+    ids = list(range(start, start + count))
+    return pa.table(
+        {
+            "id": pa.array(ids, type=pa.int64()),
+            "category": pa.array([f"cat-{i % CATEGORIES}" for i in ids]),
+            "value": pa.array([f"v-{i % VALUES}" for i in ids]),
+            "vector": pa.array(
+                [[float(i % 97) + d for d in range(DIM)] for i in ids],
+                type=pa.list_(pa.float32(), DIM),
+            ),
+        }
+    )
+
+
+def tally(dataset):
+    """What the table holds, in a form two runs can be compared by.
+
+    The cardinalities catch a column collapsed onto one value; the digest
+    catches a rewrite that keeps the values and moves them to the wrong rows.
+    Every column goes into the digest, the vectors included - compaction
+    rewrites whole fragments, so leaving a column out leaves a place for it to
+    go wrong unnoticed. Fragments come along because a compaction that merged
+    nothing would otherwise let this test pass without having tested anything.
+    """
+    scanned = dataset.to_table(columns=["id", "category", "value", "vector"])
+    ids = scanned.column("id").to_pylist()
+    categories = scanned.column("category").to_pylist()
+    values = scanned.column("value").to_pylist()
+    vectors = scanned.column("vector").to_pylist()
+    serialized = (
+        f"{i}|{c}|{v}|{w}"
+        for i, c, v, w in zip(ids, categories, values, vectors, strict=True)
+    )
+    digest = hashlib.md5(
+        "\n".join(sorted(serialized)).encode(), usedforsecurity=False
+    ).hexdigest()
+    return {
+        "rows": scanned.num_rows,
+        "categories": len(set(categories)),
+        "values": len(set(values)),
+        "digest": digest,
+        "fragments": len(dataset.get_fragments()),
+        "version": dataset.version,
+    }
+
+
+def resolve(args):
+    """Ask the namespace where the table lives, the way the worker does."""
+    namespace = ln.connect("rest", {"uri": args.namespace_url})
+    table_id = [args.bucket, args.namespace, args.table]
+    described = namespace.describe_table(ln.DescribeTableRequest(id=table_id))
+    return namespace, table_id, described.location, storage_options(args, described)
+
+
+def storage_options(args, described=None):
+    # The namespace vends an endpoint correct for its own host; this container
+    # reaches the same gateway by another name. Credentials are filled in
+    # because a deployment without STS vends none.
+    options = dict((described.storage_options or {}) if described else {})
+    options["aws_endpoint"] = args.s3_endpoint
+    options["allow_http"] = "true"
+    options.setdefault("aws_access_key_id", args.access_key)
+    options.setdefault("aws_secret_access_key", args.secret_key)
+    options.setdefault("aws_region", "us-east-1")
+    return options
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--phase", required=True, choices=["write", "maintain", "verify", "drop"])
+    parser.add_argument("--namespace-url", required=True)
+    parser.add_argument("--s3-endpoint", required=True)
+    parser.add_argument("--bucket", required=True)
+    parser.add_argument("--namespace", required=True)
+    parser.add_argument("--table", required=True)
+    parser.add_argument("--access-key", default="any")
+    parser.add_argument("--secret-key", default="any")
+    args = parser.parse_args()
+
+    if args.phase == "write":
+        namespace = ln.connect("rest", {"uri": args.namespace_url})
+        for parent in ([args.bucket], [args.bucket, args.namespace]):
+            namespace.create_namespace(ln.CreateNamespaceRequest(id=parent, mode="EXIST_OK"))
+        table_id = [args.bucket, args.namespace, args.table]
+        declared = namespace.declare_table(ln.DeclareTableRequest(id=table_id))
+        options = storage_options(args)
+        # A fragment per append, so the compaction that follows has something
+        # to merge.
+        for i in range(BATCHES):
+            lance.write_dataset(
+                rows(i * ROWS_PER_BATCH + 1, ROWS_PER_BATCH),
+                declared.location,
+                storage_options=options,
+                mode="overwrite" if i == 0 else "append",
+            )
+        print(json.dumps(tally(lance.dataset(declared.location, storage_options=options))))
+        return 0
+
+    if args.phase == "maintain":
+        _, _, location, options = resolve(args)
+        dataset = lance.dataset(location, storage_options=options)
+        dataset.optimize.compact_files()
+        dataset = lance.dataset(location, storage_options=options)
+        dataset.cleanup_old_versions(older_than=timedelta(seconds=0), delete_unverified=True)
+        print(json.dumps(tally(lance.dataset(location, storage_options=options))))
+        return 0
+
+    if args.phase == "verify":
+        _, _, location, options = resolve(args)
+        print(json.dumps(tally(lance.dataset(location, storage_options=options))))
+        return 0
+
+    namespace, table_id, location, options = resolve(args)
+    namespace.drop_table(ln.DropTableRequest(id=table_id))
+    try:
+        lance.dataset(location, storage_options=options)
+    except ValueError as err:
+        # pylance turns every load failure into a ValueError, so the message is
+        # the only thing separating a dataset that is gone from credentials
+        # that stopped working halfway through the test.
+        if "was not found" in str(err):
+            return 0
+        print(f"FAIL: reading the dropped dataset failed for another reason: {err}",
+              file=sys.stderr)
+        return 1
+    print("FAIL: the dataset is still readable after a drop", file=sys.stderr)
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/test/s3tables/lifecycle/lance_lifecycle_test.go b/test/s3tables/lifecycle/lance_lifecycle_test.go
new file mode 100644
index 0000000000..31b5b6c173
--- /dev/null
+++ b/test/s3tables/lifecycle/lance_lifecycle_test.go
@@ -0,0 +1,133 @@
+package lifecycle
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/test/testutil"
+)
+
+const lanceImage = "seaweedfs-lifecycle-lance"
+
+// TestLanceTableLifecycle is the Iceberg test's counterpart. A Lance table is
+// declared through the namespace, written a fragment at a time, compacted, its
+// superseded versions dropped, and read again - and the read has to answer
+// exactly what the write put there. Compaction rewrites fragments the way
+// Iceberg compaction rewrites parquet files, and the failure that suite exists
+// for is the kind that reads back without an error and answers wrongly.
+func TestLanceTableLifecycle(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+	if shared == nil {
+		t.Skip("no cluster")
+	}
+	if !testutil.HasDocker() {
+		t.Skip("Docker not available")
+	}
+
+	env := shared
+	bucket := "lifecycle-lance-" + randomSuffix()
+	namespace, table := "ml", "events"
+	env.createTableBucket(t, bucket, "LANCE")
+	buildClientImage(t, lanceImage, "Dockerfile.lance")
+	testutil.RequireImageRunnable(t,
+		"--entrypoint", "python3", lanceImage,
+		"-c", "import lance; import lance_namespace; import pyarrow")
+
+	before := env.lance(t, "write", bucket, namespace, table)
+	assertSeeded(t, before)
+	if before.Fragments != batches {
+		t.Fatalf("the client wrote %d fragments, want one per append (%d)", before.Fragments, batches)
+	}
+
+	env.maintainLanceTable(t, bucket, namespace, table)
+
+	after := env.lance(t, "verify", bucket, namespace, table)
+	assertSameData(t, before, after)
+	// Without this the comparison above would pass on a table nothing touched.
+	if after.Fragments >= before.Fragments {
+		t.Fatalf("maintenance merged nothing: %d fragments before, %d after",
+			before.Fragments, after.Fragments)
+	}
+
+	env.lance(t, "drop", bucket, namespace, table)
+	if env.entryExists(t, fmt.Sprintf("/buckets/%s/%s/%s/", bucket, namespace, table)) {
+		t.Fatal("the dropped table's data is still on disk")
+	}
+}
+
+// maintainLanceTable compacts the table and drops what compaction superseded.
+//
+// Lance maintenance lives in the Rust worker, so where its toolchain is around
+// the handlers themselves do the work against this table. Where it is not, the
+// same two lance calls those handlers wrap run in the client container instead.
+// The lifecycle is checked either way; only the layer above the format changes.
+// WEED_LANCE_MAINTENANCE picks one - CI sets "library", because a cold build of
+// the lance crate costs more than the layer it is checking.
+func (env *environment) maintainLanceTable(t *testing.T, bucket, namespace, table string) {
+	t.Helper()
+
+	if !maintainWithWorker(t) {
+		env.lance(t, "maintain", bucket, namespace, table)
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), clientTimeout)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, "cargo", "test",
+		"-p", "weed-lance-worker", "--test", "lifecycle", "--", "--nocapture")
+	cmd.Dir = filepath.Join(env.rootDir, "seaweed-worker")
+	cmd.Env = append(cmd.Environ(),
+		fmt.Sprintf("WEED_LANCE_NAMESPACE=http://127.0.0.1:%d", env.lancePort),
+		fmt.Sprintf("WEED_LANCE_TABLE=%s$%s$%s", bucket, namespace, table),
+		"AWS_ACCESS_KEY_ID="+accessKey,
+		"AWS_SECRET_ACCESS_KEY="+secretKey,
+		"AWS_REGION=us-east-1",
+		fmt.Sprintf("AWS_ENDPOINT_URL=http://127.0.0.1:%d", env.s3Port),
+	)
+	out, err := cmd.CombinedOutput()
+	t.Logf("lance worker:\n%s", out)
+	if err != nil {
+		t.Fatalf("the Lance maintenance worker failed: %v", err)
+	}
+}
+
+// maintainWithWorker says whether to maintain through the Rust worker.
+func maintainWithWorker(t *testing.T) bool {
+	t.Helper()
+
+	switch os.Getenv("WEED_LANCE_MAINTENANCE") {
+	case "library":
+		t.Log("maintaining through the lance library, as WEED_LANCE_MAINTENANCE asks")
+		return false
+	case "worker":
+		return true
+	}
+	if _, err := exec.LookPath("cargo"); err != nil {
+		t.Log("cargo is not installed, maintaining through the lance library rather than the worker")
+		return false
+	}
+	return true
+}
+
+func (env *environment) lance(t *testing.T, phase, bucket, namespace, table string) tally {
+	t.Helper()
+
+	out := env.runClient(t, lanceImage, phase, "/app/lance_lifecycle.py",
+		"--namespace-url", env.containerURL(env.lancePort),
+		"--s3-endpoint", env.containerURL(env.s3Port),
+		"--bucket", bucket,
+		"--namespace", namespace,
+		"--table", table,
+	)
+	if phase == "drop" {
+		return tally{}
+	}
+	return decodeTally(t, out)
+}
diff --git a/test/s3tables/maintenance/maintenance_integration_test.go b/test/s3tables/maintenance/maintenance_integration_test.go
index 0fd1425160..ddbfb69172 100644
--- a/test/s3tables/maintenance/maintenance_integration_test.go
+++ b/test/s3tables/maintenance/maintenance_integration_test.go
@@ -92,7 +92,11 @@ func TestMain(m *testing.M) {
 }
 
 func startCluster(testDir string, extraArgs []string) (*testCluster, error) {
-	ports, err := testutil.AllocatePorts(10)
+	ports, err := testutil.AllocatePorts(9)
+	if err != nil {
+		return nil, err
+	}
+	adminPorts, err := testutil.AllocateMiniPorts(1)
 	if err != nil {
 		return nil, err
 	}
@@ -100,7 +104,8 @@ func startCluster(testDir string, extraArgs []string) (*testCluster, error) {
 	volumePort, volumeGrpc := ports[2], ports[3]
 	filerPort, filerGrpc := ports[4], ports[5]
 	s3Port, s3Grpc := ports[6], ports[7]
-	adminPort, adminGrpc := ports[8], ports[9]
+	adminPort := adminPorts[0]
+	icebergPort := ports[8]
 
 	_ = os.Remove(filepath.Join(testDir, "mini.options"))
 
@@ -146,15 +151,16 @@ func startCluster(testDir string, extraArgs []string) (*testCluster, error) {
 			"-filer.port.grpc=" + strconv.Itoa(filerGrpc),
 			"-s3.port=" + strconv.Itoa(s3Port),
 			"-s3.port.grpc=" + strconv.Itoa(s3Grpc),
-			"-admin.port=" + strconv.Itoa(adminPort),
-			"-admin.port.grpc=" + strconv.Itoa(adminGrpc),
-			"-webdav.port=0",
+			"-webdav=false",    // Disable WebDAV
+			"-s3.port.lance=0", // Disable Lance
+			"-s3.port.iceberg=" + strconv.Itoa(icebergPort),
 			"-admin.ui=false",
 			"-master.volumeSizeLimitMB=32",
 			"-ip=127.0.0.1",
 			"-master.peers=none",
 			"-s3.iam.readOnly=false",
 		}
+		args = append(args, testutil.MiniAdminArgs(adminPort)...)
 		args = append(args, extraArgs...)
 		os.Args = append([]string{"weed"}, args...)
 		glog.MaxSize = 1024 * 1024
@@ -600,9 +606,9 @@ func testExpireSnapshots(t *testing.T) {
 
 	handler := icebergHandler.NewHandler(nil)
 	config := icebergHandler.Config{
-		SnapshotRetentionHours: 0, // instant expiry — everything eligible
-		MaxSnapshotsToKeep:     1, // keep only the current snapshot
-		MaxCommitRetries:       3,
+		SnapshotRetentionMs: 0, // instant expiry — everything eligible
+		MaxSnapshotsToKeep:  1, // keep only the current snapshot
+		MaxCommitRetries:    3,
 	}
 
 	result, _, err := handler.ExpireSnapshots(context.Background(), client, bucket, path.Join(ns, tbl), config)
@@ -796,7 +802,7 @@ func testCompactDataFiles(t *testing.T) {
 	}
 
 	require.Len(t, addedPaths, 1, "compaction should add exactly one merged parquet file")
-	assert.Contains(t, addedPaths, path.Join("data", compacted.Name))
+	assert.Contains(t, addedPaths, fmt.Sprintf("s3://%s/%s/data/%s", bucket, tablePath, compacted.Name))
 	require.Len(t, deletedPaths, len(files), "compaction should delete every original small input file")
 	for _, file := range files {
 		assert.Contains(t, deletedPaths, path.Join("data", file.name))
@@ -932,9 +938,9 @@ func testFullMaintenanceCycle(t *testing.T) {
 
 	// Step 1: Expire snapshots
 	expireConfig := icebergHandler.Config{
-		SnapshotRetentionHours: 0, // instant expiry
-		MaxSnapshotsToKeep:     1,
-		MaxCommitRetries:       3,
+		SnapshotRetentionMs: 0, // instant expiry
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
 	}
 	result, _, err := handler.ExpireSnapshots(ctx, client, bucket, tablePath, expireConfig)
 	require.NoError(t, err)
diff --git a/test/s3tables/polaris/polaris_env_test.go b/test/s3tables/polaris/polaris_env_test.go
index fe286e18ab..8a0c58a505 100644
--- a/test/s3tables/polaris/polaris_env_test.go
+++ b/test/s3tables/polaris/polaris_env_test.go
@@ -182,7 +182,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel
 
-	cmd := exec.CommandContext(ctx, env.weedBinary, "-v", "4", "mini",
+	miniArgs := append([]string{"-v", "4", "mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -197,7 +197,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0", "-s3.port.iceberg=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Dir = env.dataDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/s3tables/sts_integration/sts_integration_test.go b/test/s3tables/sts_integration/sts_integration_test.go
index 672043cab3..524713fe47 100644
--- a/test/s3tables/sts_integration/sts_integration_test.go
+++ b/test/s3tables/sts_integration/sts_integration_test.go
@@ -242,7 +242,7 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	env.weedCancel = cancel
 
-	cmd := exec.CommandContext(ctx, env.weedBinary, "mini",
+	miniArgs := append([]string{"mini",
 		"-master.port", fmt.Sprintf("%d", env.masterPort),
 		"-master.port.grpc", fmt.Sprintf("%d", env.masterGrpcPort),
 		"-volume.port", fmt.Sprintf("%d", env.volumePort),
@@ -257,7 +257,9 @@ func (env *TestEnvironment) StartSeaweedFS(t *testing.T) {
 		"-ip", env.bindIP,
 		"-ip.bind", "0.0.0.0",
 		"-dir", env.dataDir,
-	)
+	}, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	miniArgs = append(miniArgs, "-webdav=false", "-s3.port.lance=0", "-s3.port.iceberg=0")
+	cmd := exec.CommandContext(ctx, env.weedBinary, miniArgs...)
 	cmd.Dir = env.dataDir
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
diff --git a/test/s3tables/table-buckets/s3tables_integration_test.go b/test/s3tables/table-buckets/s3tables_integration_test.go
index 80b711e478..70d7979df1 100644
--- a/test/s3tables/table-buckets/s3tables_integration_test.go
+++ b/test/s3tables/table-buckets/s3tables_integration_test.go
@@ -594,11 +594,16 @@ func testTargetOperations(t *testing.T, client *S3TablesClient) {
 // directory. It does not require a *testing.T so it can be called from TestMain.
 // extraArgs are appended to the default mini command flags.
 func startMiniClusterInDir(testDir string, extraArgs []string) (*TestCluster, error) {
-	// We need 10 unique ports: Master(2), Volume(2), Filer(2), S3(2), Admin(2)
-	ports, err := testutil.AllocatePorts(10)
+	// We need 9 unique ports: Master(2), Volume(2), Filer(2), S3(2), Iceberg(1);
+	// the admin pair comes from the mini-safe range.
+	ports, err := testutil.AllocatePorts(9)
 	if err != nil {
 		return nil, fmt.Errorf("failed to find available ports: %v", err)
 	}
+	adminPorts, err := testutil.AllocateMiniPorts(1)
+	if err != nil {
+		return nil, fmt.Errorf("failed to allocate admin port: %v", err)
+	}
 
 	masterPort := ports[0]
 	masterGrpcPort := ports[1]
@@ -608,8 +613,8 @@ func startMiniClusterInDir(testDir string, extraArgs []string) (*TestCluster, er
 	filerGrpcPort := ports[5]
 	s3Port := ports[6]
 	s3GrpcPort := ports[7]
-	adminPort := ports[8]
-	adminGrpcPort := ports[9]
+	adminPort := adminPorts[0]
+	icebergPort := ports[8]
 
 	// Ensure no configuration file from previous runs
 	configFile := filepath.Join(testDir, "mini.options")
@@ -674,15 +679,16 @@ func startMiniClusterInDir(testDir string, extraArgs []string) (*TestCluster, er
 			"-filer.port.grpc=" + strconv.Itoa(filerGrpcPort),
 			"-s3.port=" + strconv.Itoa(s3Port),
 			"-s3.port.grpc=" + strconv.Itoa(s3GrpcPort),
-			"-admin.port=" + strconv.Itoa(adminPort),
-			"-admin.port.grpc=" + strconv.Itoa(adminGrpcPort),
-			"-webdav.port=0",               // Disable WebDAV
+			"-webdav=false",    // Disable WebDAV
+			"-s3.port.lance=0", // Disable Lance
+			"-s3.port.iceberg=" + strconv.Itoa(icebergPort),
 			"-admin.ui=false",              // Disable admin UI
 			"-master.volumeSizeLimitMB=32", // Small volumes for testing
 			"-ip=127.0.0.1",
 			"-master.peers=none",     // Faster startup
 			"-s3.iam.readOnly=false", // Enable IAM write operations for tests
 		}
+		baseArgs = append(baseArgs, testutil.MiniAdminArgs(adminPort)...)
 		if len(extraArgs) > 0 {
 			baseArgs = append(baseArgs, extraArgs...)
 		}
diff --git a/test/s3tables/table-buckets/verify_object_test.go b/test/s3tables/table-buckets/verify_object_test.go
new file mode 100644
index 0000000000..cf8bd2394d
--- /dev/null
+++ b/test/s3tables/table-buckets/verify_object_test.go
@@ -0,0 +1,139 @@
+package s3tables
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/smithy-go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newObjectClient(t *testing.T) *s3.Client {
+	t.Helper()
+	cfg, err := config.LoadDefaultConfig(context.Background(),
+		config.WithRegion(testRegion),
+		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(testAccessKey, testSecretKey, "")),
+	)
+	require.NoError(t, err)
+	return s3.NewFromConfig(cfg, func(o *s3.Options) {
+		o.BaseEndpoint = aws.String(sharedCluster.s3Endpoint)
+		o.UsePathStyle = true
+	})
+}
+
+func apiErrorCode(err error) string {
+	var apiErr smithy.APIError
+	if errors.As(err, &apiErr) {
+		return apiErr.ErrorCode()
+	}
+	return ""
+}
+
+// The external-volume verification object round-trips at a table bucket's
+// root the way the check uses it: PUT, HEAD, GET, list, DELETE. Any other key
+// at the root is still refused.
+func TestTableBucketExternalVolumeVerificationRoundTrip(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	ctx := context.Background()
+	tables := NewS3TablesClient(sharedCluster.s3Endpoint, testRegion, testAccessKey, testSecretKey)
+	bucket := "verify-" + randomString(8)
+	created, err := tables.CreateTableBucket(bucket, nil)
+	require.NoError(t, err)
+	defer tables.DeleteTableBucket(created.ARN)
+	client := newObjectClient(t)
+
+	body := []byte("verification payload!") // 21 bytes
+	key := fmt.Sprintf("verify_%d_%d", time.Now().UnixMilli(), 1081846483)
+
+	// the control: an ordinary key at the root is refused
+	_, err = client.PutObject(ctx, &s3.PutObjectInput{Bucket: aws.String(bucket), Key: aws.String("notes.parquet"), Body: bytes.NewReader(body)})
+	require.Error(t, err)
+	assert.Equal(t, "AccessDenied", apiErrorCode(err))
+
+	_, err = client.PutObject(ctx, &s3.PutObjectInput{Bucket: aws.String(bucket), Key: aws.String(key), Body: bytes.NewReader(body), ContentLength: aws.Int64(int64(len(body)))})
+	require.NoError(t, err)
+
+	head, err := client.HeadObject(ctx, &s3.HeadObjectInput{Bucket: aws.String(bucket), Key: aws.String(key)})
+	require.NoError(t, err)
+	assert.Equal(t, int64(len(body)), aws.ToInt64(head.ContentLength))
+
+	got, err := client.GetObject(ctx, &s3.GetObjectInput{Bucket: aws.String(bucket), Key: aws.String(key)})
+	require.NoError(t, err)
+	data, err := io.ReadAll(got.Body)
+	got.Body.Close()
+	require.NoError(t, err)
+	assert.Equal(t, body, data)
+
+	list, err := client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{Bucket: aws.String(bucket), Prefix: aws.String("verify_")})
+	require.NoError(t, err)
+	var keys []string
+	for _, o := range list.Contents {
+		keys = append(keys, aws.ToString(o.Key))
+	}
+	assert.Equal(t, []string{key}, keys)
+
+	_, err = client.DeleteObject(ctx, &s3.DeleteObjectInput{Bucket: aws.String(bucket), Key: aws.String(key)})
+	require.NoError(t, err)
+	_, err = client.HeadObject(ctx, &s3.HeadObjectInput{Bucket: aws.String(bucket), Key: aws.String(key)})
+	require.Error(t, err, "the verification object must be gone after DELETE")
+}
+
+// A namespace can carry a name of the verification key's shape. The key
+// then names the namespace's directory: a PUT or DELETE through it must not
+// replace or remove the namespace.
+func TestTableBucketVerificationKeyLeavesNamespaceAlone(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	ctx := context.Background()
+	tables := NewS3TablesClient(sharedCluster.s3Endpoint, testRegion, testAccessKey, testSecretKey)
+	bucket := "verify-ns-" + randomString(8)
+	created, err := tables.CreateTableBucket(bucket, nil)
+	require.NoError(t, err)
+	defer tables.DeleteTableBucket(created.ARN)
+	client := newObjectClient(t)
+	body := []byte("verification payload!")
+
+	listed := func(name string) bool {
+		resp, err := tables.ListNamespaces(created.ARN, "", "", 0)
+		require.NoError(t, err)
+		for _, ns := range resp.Namespaces {
+			if len(ns.Namespace) == 1 && ns.Namespace[0] == name {
+				return true
+			}
+		}
+		return false
+	}
+	for i, op := range []string{"PUT", "DELETE"} {
+		t.Run(op, func(t *testing.T) {
+			name := fmt.Sprintf("verify_%d_%d", time.Now().UnixMilli(), 7+i)
+			_, err := tables.CreateNamespace(created.ARN, []string{name})
+			require.NoError(t, err)
+			defer tables.DeleteNamespace(created.ARN, []string{name})
+			require.True(t, listed(name), "setup: the namespace is listed")
+
+			if op == "PUT" {
+				_, err = client.PutObject(ctx, &s3.PutObjectInput{Bucket: aws.String(bucket), Key: aws.String(name), Body: bytes.NewReader(body), ContentLength: aws.Int64(int64(len(body)))})
+				assert.Error(t, err, "a PUT over a namespace must be refused")
+			} else {
+				_, err = client.DeleteObject(ctx, &s3.DeleteObjectInput{Bucket: aws.String(bucket), Key: aws.String(name)})
+				assert.Error(t, err, "a DELETE of a namespace must be refused")
+			}
+			_, err = tables.GetNamespace(created.ARN, []string{name})
+			assert.NoError(t, err, "the namespace survives the %s", op)
+			assert.True(t, listed(name), "the namespace is still listed after the %s", op)
+		})
+	}
+}
diff --git a/test/s3tables/unity_catalog/setup_test.go b/test/s3tables/unity_catalog/setup_test.go
index f3351c4415..3309aff254 100644
--- a/test/s3tables/unity_catalog/setup_test.go
+++ b/test/s3tables/unity_catalog/setup_test.go
@@ -26,6 +26,10 @@ const (
 	ucAPIBase      = "/api/2.1/unity-catalog"
 	ucWarehouse    = "lakehouse"
 	ucWarehouseKey = "warehouse"
+	// A non-empty s3.sessionToken.N puts UC's credential vendor on its
+	// StaticAwsCredentialGenerator path: it vends the configured access key,
+	// secret key and this token verbatim instead of calling AWS STS.
+	ucVendedSessionToken = "unity-catalog-vended-session-token"
 
 	// Role used by the master-role STS-vended variant of the test. The trust
 	// policy is wide open so any caller can assume it; in production UC
@@ -65,6 +69,9 @@ type ucServerOpts struct {
 	// MasterRoleArn populates aws.masterRoleArn. Empty means UC falls back to
 	// static aws.accessKey / aws.secretKey for storage operations.
 	MasterRoleArn string
+	// SessionToken populates s3.sessionToken.0, selecting UC's static
+	// credential generator for the per-bucket config.
+	SessionToken string
 	// ExtraEnv adds environment variables to the UC container, useful for
 	// AWS_ENDPOINT_URL_STS-style overrides.
 	ExtraEnv map[string]string
@@ -176,6 +183,8 @@ func (env *testEnv) startSeaweedFS(t *testing.T, iamJSON string) {
 	if enableSTS {
 		weedArgs = append(weedArgs, "-s3.iam.config", iamConfigPath, "-s3.iam.readOnly=false")
 	}
+	weedArgs = append(weedArgs, testutil.MiniAdminArgs(testutil.MustFreeMiniPort(t, "admin"))...)
+	weedArgs = append(weedArgs, "-webdav=false", "-s3.port.lance=0", "-s3.port.iceberg=0")
 
 	cmd := exec.CommandContext(ctx, env.weedBinary, weedArgs...)
 	cmd.Dir = env.dataDir
@@ -220,6 +229,7 @@ func (env *testEnv) startUnityCatalog(t *testing.T, ctx context.Context, opts uc
 		fmt.Sprintf("s3.awsRoleArn.0=%s", opts.MasterRoleArn),
 		fmt.Sprintf("s3.accessKey.0=%s", env.accessKey),
 		fmt.Sprintf("s3.secretKey.0=%s", env.secretKey),
+		fmt.Sprintf("s3.sessionToken.0=%s", opts.SessionToken),
 		fmt.Sprintf("s3.endpoint.0=%s", s3EndpointForContainer),
 		"",
 	}, "\n")
diff --git a/test/s3tables/unity_catalog/unity_catalog_test.go b/test/s3tables/unity_catalog/unity_catalog_test.go
index 35b48be09c..97b024815d 100644
--- a/test/s3tables/unity_catalog/unity_catalog_test.go
+++ b/test/s3tables/unity_catalog/unity_catalog_test.go
@@ -8,6 +8,7 @@ package unity_catalog
 import (
 	"context"
 	"fmt"
+	"strings"
 	"testing"
 	"time"
 
@@ -46,7 +47,7 @@ func TestUnityCatalogDeltaIntegration(t *testing.T) {
 	}
 
 	t.Log(">>> starting Unity Catalog server (static keys)...")
-	env.startUnityCatalog(t, ctx, ucServerOpts{})
+	env.startUnityCatalog(t, ctx, ucServerOpts{SessionToken: ucVendedSessionToken})
 	t.Log(">>> Unity Catalog ready")
 
 	uc := newUCClient(fmt.Sprintf("http://127.0.0.1:%d", env.ucHostPort))
@@ -145,28 +146,41 @@ func TestUnityCatalogDeltaIntegration(t *testing.T) {
 		}
 	})
 
-	t.Run("TemporaryTableCredentialsRejected", func(t *testing.T) {
-		// With aws.masterRoleArn empty AND no s3.sessionToken.0 set, UC OSS
-		// always tries to AssumeRole via its internal StsClient (see
-		// AwsCredentialVendor.createPerBucketCredentialGenerator). Against a
-		// non-AWS endpoint, that call doesn't reach a real STS, so UC returns
-		// "S3 bucket configuration not found." or an STS-side error. This is
-		// the gap users hit at <https://github.com/data-engineering-helpers/mds-in-a-box/blob/main/unitycatalog-playground/etc/conf/server.properties#L45>:
-		// "with simple S3 access and secret keys, Unity Catalog does not seem
-		// to work."
-		//
-		// The assertion is therefore inverted: we expect a non-nil error from
-		// /temporary-table-credentials with this configuration. A future
-		// variant can pin s3.sessionToken.0 (UC's StaticAwsCredentialGenerator
-		// path) once SeaweedFS' SigV4 path tolerates the vended session token.
+	t.Run("TemporaryTableCredentials", func(t *testing.T) {
+		// s3.sessionToken.0 is set, so UC's AwsCredentialVendor takes the
+		// StaticAwsCredentialGenerator path and vends the configured keys
+		// verbatim, token included — no STS call at all. SeaweedFS authenticates
+		// the request on the static access key and tolerates the foreign token.
 		if createdTable.TableID == "" {
 			t.Fatalf("created table has empty table_id; cannot request temporary credentials")
 		}
-		_, err := uc.generateTemporaryTableCredentials(ctx, createdTable.TableID, "READ_WRITE")
-		if err == nil {
-			t.Fatalf("expected /temporary-table-credentials to fail with the static-key playground configuration; it succeeded unexpectedly")
+		creds, err := uc.generateTemporaryTableCredentials(ctx, createdTable.TableID, "READ_WRITE")
+		if err != nil {
+			t.Fatalf("temporary-table-credentials: %v", err)
+		}
+		awsCreds := creds.AwsTempCredentials
+		if awsCreds == nil || awsCreds.AccessKeyID == "" || awsCreds.SessionToken == "" {
+			t.Fatalf("expected aws_temp_credentials with a session_token, got %+v", creds)
+		}
+		if awsCreds.AccessKeyID != env.accessKey || awsCreds.SessionToken != ucVendedSessionToken {
+			t.Fatalf("expected UC to vend the configured static credential, got %+v", awsCreds)
+		}
+
+		s3v := env.newHostS3ClientWithCreds(t, ctx, awsCreds.AccessKeyID, awsCreds.SecretAccessKey, awsCreds.SessionToken)
+		probeKey := fmt.Sprintf("%s/%s/%s/vended.txt", ucWarehouseKey, schemaName, tableName)
+		if _, err := s3v.PutObject(ctx, &s3.PutObjectInput{
+			Bucket: aws.String(ucWarehouse),
+			Key:    aws.String(probeKey),
+			Body:   strings.NewReader("ok"),
+		}); err != nil {
+			t.Fatalf("PutObject with UC-vended credentials: %v", err)
+		}
+		if _, err := s3v.DeleteObject(ctx, &s3.DeleteObjectInput{
+			Bucket: aws.String(ucWarehouse),
+			Key:    aws.String(probeKey),
+		}); err != nil {
+			t.Fatalf("DeleteObject with UC-vended credentials: %v", err)
 		}
-		t.Logf("expected failure (UC static-key path requires AWS STS): %v", err)
 	})
 
 	t.Run("DeleteTableSchemaCatalog", func(t *testing.T) {
diff --git a/test/samba/Dockerfile b/test/samba/Dockerfile
index e2756a586f..8e8bbf296c 100644
--- a/test/samba/Dockerfile
+++ b/test/samba/Dockerfile
@@ -1,14 +1,9 @@
 FROM chrislusf/seaweedfs:e2e
 
-RUN apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 update && \
-    DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 install -y \
-    --no-install-recommends \
-    --no-install-suggests \
+RUN apt-install \
     samba \
     smbclient \
-    python3-minimal \
-    && apt-get clean \
-    && rm -rf /var/lib/apt/lists/*
+    python3-minimal
 
 COPY smb.conf.template /smb.conf.template
 COPY smb_tests.sh /smb_tests.sh
diff --git a/test/sftp/basic_test.go b/test/sftp/basic_test.go
index bad875208b..17f3b191f7 100644
--- a/test/sftp/basic_test.go
+++ b/test/sftp/basic_test.go
@@ -3,6 +3,7 @@ package sftp
 import (
 	"bytes"
 	"io"
+	"os"
 	"path"
 	"testing"
 
@@ -602,6 +603,32 @@ func TestFileContent(t *testing.T) {
 		sftpClient.Remove("/binary.bin")
 	})
 
+	t.Run("WriteAtOffsetKeepsExistingBytes", func(t *testing.T) {
+		file, err := sftpClient.Create("/resume.txt")
+		require.NoError(t, err)
+		_, err = file.Write([]byte("hello world"))
+		require.NoError(t, err)
+		require.NoError(t, file.Close())
+
+		// Reopen without O_TRUNC and write past the start, as a resumed upload does
+		file, err = sftpClient.OpenFile("/resume.txt", os.O_WRONLY)
+		require.NoError(t, err)
+		_, err = file.WriteAt([]byte("WORLD!"), 6)
+		require.NoError(t, err)
+		require.NoError(t, file.Close())
+
+		readFile, err := sftpClient.Open("/resume.txt")
+		require.NoError(t, err)
+		content, err := io.ReadAll(readFile)
+		require.NoError(t, err)
+		readFile.Close()
+
+		require.Equal(t, "hello WORLD!", string(content))
+
+		// Clean up
+		sftpClient.Remove("/resume.txt")
+	})
+
 	t.Run("EmptyFile", func(t *testing.T) {
 		file, err := sftpClient.Create("/empty.txt")
 		require.NoError(t, err)
diff --git a/test/sftp/go.mod b/test/sftp/go.mod
index 29bbaa342f..3c0e5f9273 100644
--- a/test/sftp/go.mod
+++ b/test/sftp/go.mod
@@ -1,17 +1,17 @@
 module seaweedfs-sftp-tests
 
-go 1.25.0
+go 1.26.6
 
 require (
 	github.com/pkg/sftp v1.13.7
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/crypto v0.52.0
+	golang.org/x/crypto v0.56.0
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/test/sftp/go.sum b/test/sftp/go.sum
index 14400b5360..c3211c4e18 100644
--- a/test/sftp/go.sum
+++ b/test/sftp/go.sum
@@ -17,8 +17,8 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -37,15 +37,15 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
diff --git a/test/testutil/helpers.go b/test/testutil/helpers.go
index 7272722cae..e0eafb33f3 100644
--- a/test/testutil/helpers.go
+++ b/test/testutil/helpers.go
@@ -2,12 +2,15 @@ package testutil
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"net/http"
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
+	"testing"
 	"time"
 )
 
@@ -20,6 +23,39 @@ func HasDocker() bool {
 	return cmd.Run() == nil
 }
 
+// RequireImageRunnable runs a throwaway container with the given `docker run`
+// arguments and skips the test when its process dies on SIGILL. Upstream
+// images increasingly target x86-64-v3 (AVX2) - ClickHouse since 26.5 - so a
+// host CPU without those instructions cannot run them at all, and the failure
+// says nothing about the code under test. Any other outcome, whether a clean
+// run, an ordinary non-zero exit, or a pull failure, is left for the test
+// itself to report: the probe can only skip on the one failure the code
+// cannot cause.
+func RequireImageRunnable(t *testing.T, args ...string) {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	cmd := exec.CommandContext(ctx, "docker", append([]string{"run", "--rm"}, args...)...)
+	out, err := cmd.CombinedOutput()
+	if err == nil {
+		return
+	}
+	var exitErr *exec.ExitError
+	// 132 = 128 + SIGILL: docker propagates the container process's death.
+	if errors.As(err, &exitErr) &&
+		(exitErr.ExitCode() == 132 ||
+			strings.Contains(string(out), "Illegal instruction")) {
+		t.Skipf("image cannot execute on this CPU (illegal instruction): docker run %s\n%s",
+			strings.Join(args, " "), out)
+	}
+}
+
+func IsIllegalInstruction(err error) bool {
+	var exitErr *exec.ExitError
+	return errors.As(err, &exitErr) && exitErr.ExitCode() == 132
+}
+
 func FindBindIP() string {
 	addrs, err := net.InterfaceAddrs()
 	if err != nil {
@@ -58,6 +94,9 @@ func WriteIAMConfig(dir, accessKey, secretKey string) (string, error) {
         "Tagging",
         "Write"
       ]
+    },
+    {
+      "name": "anonymous"
     }
   ]
 }`, accessKey, secretKey)
diff --git a/test/testutil/helpers_test.go b/test/testutil/helpers_test.go
new file mode 100644
index 0000000000..efc302fc6c
--- /dev/null
+++ b/test/testutil/helpers_test.go
@@ -0,0 +1,39 @@
+package testutil
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"testing"
+)
+
+func TestIsIllegalInstruction(t *testing.T) {
+	if code := os.Getenv("SEAWEEDFS_TEST_EXIT_CODE"); code != "" {
+		status, _ := strconv.Atoi(code)
+		os.Exit(status)
+	}
+
+	for _, tc := range []struct {
+		name string
+		code string
+		want bool
+	}{
+		{"illegal instruction", "132", true},
+		{"ordinary failure", "1", false},
+		{"out of memory", "137", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			cmd := exec.Command(os.Args[0], "-test.run=^TestIsIllegalInstruction$")
+			cmd.Env = append(os.Environ(), "SEAWEEDFS_TEST_EXIT_CODE="+tc.code)
+			err := cmd.Run()
+			if got := IsIllegalInstruction(fmt.Errorf("docker run: %w", err)); got != tc.want {
+				t.Fatalf("IsIllegalInstruction(%v) = %v, want %v", err, got, tc.want)
+			}
+		})
+	}
+	if IsIllegalInstruction(nil) || IsIllegalInstruction(errors.New("exit status 132")) {
+		t.Fatal("non-process errors must not be treated as illegal instructions")
+	}
+}
diff --git a/test/testutil/ports.go b/test/testutil/ports.go
index 103f5a4409..5a1ce76d46 100644
--- a/test/testutil/ports.go
+++ b/test/testutil/ports.go
@@ -38,8 +38,9 @@ var miniDefaultPorts = []int{
 	9340,  // volume.port
 	8333,  // s3.port
 	8181,  // s3.port.iceberg
+	9101,  // s3.port.lance
 	7333,  // webdav.port
-	23646, // admin.port
+	12535, // admin.port
 }
 
 func reservedMiniPorts() map[int]bool {
@@ -166,6 +167,22 @@ func MustFreeMiniPort(t *testing.T, name string) int {
 	return MustFreeMiniPorts(t, []string{name})[0]
 }
 
+// MiniAdminArgs returns weed mini flags pinning the admin server to
+// adminPort and adminPort+GrpcPortOffset and disabling the legacy compat
+// listener. Unconfigured minis all bind the fixed default admin port 12535
+// and the legacy port 23646 (+33646 gRPC), so sequential or concurrent
+// minis on one host collide on them. Allocate adminPort with
+// MustFreeMiniPort(s) — the admin binds late in mini startup, after the
+// cluster's own outbound connections may steal an ephemeral port, so it
+// must stay below the Linux ephemeral port floor.
+func MiniAdminArgs(adminPort int) []string {
+	return []string{
+		fmt.Sprintf("-admin.port=%d", adminPort),
+		fmt.Sprintf("-admin.port.grpc=%d", adminPort+GrpcPortOffset),
+		"-admin.port.legacy=0",
+	}
+}
+
 // AllocatePortSet atomically allocates miniCount master-style port pairs (each
 // with port and port+GrpcPortOffset reserved) plus regularCount additional
 // distinct ports. All listeners are held open until the entire batch is
diff --git a/test/testutil/ports_test.go b/test/testutil/ports_test.go
index 8d22c51e76..e65f1d99e0 100644
--- a/test/testutil/ports_test.go
+++ b/test/testutil/ports_test.go
@@ -4,7 +4,7 @@ import "testing"
 
 // AllocateMiniPorts must never hand out a port that weed mini will reserve
 // for one of its default services (or that default's gRPC offset). A real
-// failure: Filer was given 33646 (Admin default 23646 + GrpcPortOffset),
+// failure: Filer was given 22535 (Admin default 12535 + GrpcPortOffset),
 // which mini then refused as "reserved for gRPC calculation".
 func TestAllocateMiniPortsAvoidsMiniDefaults(t *testing.T) {
 	reserved := reservedMiniPorts()
diff --git a/test/tus/Makefile b/test/tus/Makefile
index 172b3af506..63f2ed50cc 100644
--- a/test/tus/Makefile
+++ b/test/tus/Makefile
@@ -106,17 +106,17 @@ start-seaweedfs: check-binary
 	
 	# Wait for filer to be ready
 	@echo "$(YELLOW)Waiting for filer to be ready...$(NC)"
-	@for i in $$(seq 1 30); do \
+	@for i in $$(seq 1 90); do \
 		if curl -s -f http://127.0.0.1:$(FILER_PORT)/ > /dev/null 2>&1; then \
 			echo "$(GREEN)Filer is ready$(NC)"; \
 			break; \
 		fi; \
-		if [ $$i -eq 30 ]; then \
-			echo "$(RED)Filer failed to start within 30 seconds$(NC)"; \
+		if [ $$i -eq 90 ]; then \
+			echo "$(RED)Filer failed to start within 90 seconds$(NC)"; \
 			$(MAKE) debug-logs; \
 			exit 1; \
 		fi; \
-		echo "Waiting for filer... ($$i/30)"; \
+		echo "Waiting for filer... ($$i/90)"; \
 		sleep 1; \
 	done
 	
diff --git a/test/tus/tus_integration_test.go b/test/tus/tus_integration_test.go
index c923577e37..cf9456325c 100644
--- a/test/tus/tus_integration_test.go
+++ b/test/tus/tus_integration_test.go
@@ -1,11 +1,13 @@
 package tus
 
 import (
+	"bufio"
 	"bytes"
 	"context"
 	"encoding/base64"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"os"
 	"os/exec"
@@ -685,6 +687,135 @@ func TestTusCreationWithUpload(t *testing.T) {
 	assert.Equal(t, testData, body)
 }
 
+// TestTusConcatenation tests the concatenation extension: partial uploads
+// assembled into a final upload
+func TestTusConcatenation(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	defer cancel()
+
+	cluster, err := startTestCluster(t, ctx)
+	require.NoError(t, err)
+	defer func() {
+		cluster.Stop()
+		os.RemoveAll(cluster.dataDir)
+	}()
+
+	client := &http.Client{}
+
+	// The extension is announced
+	optionsReq, err := http.NewRequest(http.MethodOptions, cluster.TusURL()+"/", nil)
+	require.NoError(t, err)
+	optionsReq.Header.Set("Tus-Resumable", TusVersion)
+	optionsResp, err := client.Do(optionsReq)
+	require.NoError(t, err)
+	optionsResp.Body.Close()
+	assert.Contains(t, optionsResp.Header.Get("Tus-Extension"), "concatenation")
+
+	partA := []byte("Hello, ")
+	partB := []byte("concatenated TUS world!")
+	targetPath := "/concat/final.txt"
+
+	createPartial := func(size int) string {
+		req, err := http.NewRequest(http.MethodPost, cluster.TusURL()+targetPath, nil)
+		require.NoError(t, err)
+		req.Header.Set("Tus-Resumable", TusVersion)
+		req.Header.Set("Upload-Length", strconv.Itoa(size))
+		req.Header.Set("Upload-Concat", "partial")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		require.Equal(t, http.StatusCreated, resp.StatusCode)
+		location := resp.Header.Get("Location")
+		require.NotEmpty(t, location)
+		return location
+	}
+
+	patchAll := func(location string, data []byte) {
+		req, err := http.NewRequest(http.MethodPatch, cluster.FullURL(location), bytes.NewReader(data))
+		require.NoError(t, err)
+		req.Header.Set("Tus-Resumable", TusVersion)
+		req.Header.Set("Upload-Offset", "0")
+		req.Header.Set("Content-Type", "application/offset+octet-stream")
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		resp.Body.Close()
+		require.Equal(t, http.StatusNoContent, resp.StatusCode)
+	}
+
+	locationA := createPartial(len(partA))
+	locationB := createPartial(len(partB))
+	concatHeader := "final;" + locationA + " " + locationB
+
+	patchAll(locationA, partA)
+
+	// Concatenation is rejected while a listed partial is unfinished
+	prematureReq, err := http.NewRequest(http.MethodPost, cluster.TusURL()+targetPath, nil)
+	require.NoError(t, err)
+	prematureReq.Header.Set("Tus-Resumable", TusVersion)
+	prematureReq.Header.Set("Upload-Concat", concatHeader)
+	prematureResp, err := client.Do(prematureReq)
+	require.NoError(t, err)
+	prematureResp.Body.Close()
+	require.Equal(t, http.StatusBadRequest, prematureResp.StatusCode)
+
+	patchAll(locationB, partB)
+
+	// A completed partial reports its status and does not land at the target
+	headReq, err := http.NewRequest(http.MethodHead, cluster.FullURL(locationA), nil)
+	require.NoError(t, err)
+	headReq.Header.Set("Tus-Resumable", TusVersion)
+	headResp, err := client.Do(headReq)
+	require.NoError(t, err)
+	headResp.Body.Close()
+	require.Equal(t, http.StatusOK, headResp.StatusCode)
+	assert.Equal(t, "partial", headResp.Header.Get("Upload-Concat"))
+
+	getResp, err := client.Get(cluster.FilerURL() + targetPath)
+	require.NoError(t, err)
+	getResp.Body.Close()
+	require.Equal(t, http.StatusNotFound, getResp.StatusCode,
+		"completed partials should not land at the target path")
+
+	// Concatenate into the final upload
+	finalReq, err := http.NewRequest(http.MethodPost, cluster.TusURL()+targetPath, nil)
+	require.NoError(t, err)
+	finalReq.Header.Set("Tus-Resumable", TusVersion)
+	finalReq.Header.Set("Upload-Concat", concatHeader)
+	finalReq.Header.Set("Upload-Metadata", encodeTusMetadata(map[string]string{
+		"content-type": "text/plain",
+	}))
+	finalResp, err := client.Do(finalReq)
+	require.NoError(t, err)
+	finalResp.Body.Close()
+	require.Equal(t, http.StatusCreated, finalResp.StatusCode)
+	assert.NotEmpty(t, finalResp.Header.Get("Location"))
+
+	// The target file holds both parts in order
+	expected := append(append([]byte{}, partA...), partB...)
+	getResp2, err := client.Get(cluster.FilerURL() + targetPath)
+	require.NoError(t, err)
+	defer getResp2.Body.Close()
+	require.Equal(t, http.StatusOK, getResp2.StatusCode)
+	body, err := io.ReadAll(getResp2.Body)
+	require.NoError(t, err)
+	assert.Equal(t, expected, body, "Concatenated file should hold both parts in order")
+	assert.Contains(t, getResp2.Header.Get("Content-Type"), "text/plain")
+
+	// The consumed partials are gone
+	headReq2, err := http.NewRequest(http.MethodHead, cluster.FullURL(locationA), nil)
+	require.NoError(t, err)
+	headReq2.Header.Set("Tus-Resumable", TusVersion)
+	headResp2, err := client.Do(headReq2)
+	require.NoError(t, err)
+	headResp2.Body.Close()
+	require.Equal(t, http.StatusNotFound, headResp2.StatusCode,
+		"consumed partial should be removed after concatenation")
+}
+
 // TestTusResumeAfterInterruption simulates resuming an upload after failure
 func TestTusResumeAfterInterruption(t *testing.T) {
 	if testing.Short() {
@@ -773,3 +904,202 @@ func TestTusResumeAfterInterruption(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, testData, body, "Resumed upload should produce complete file")
 }
+
+// TestTusAbortedPatchKeepsStoredChunks checks that a PATCH cut off mid-body
+// leaves the sub-chunks it already stored in place. The filer splits a PATCH
+// into 4MB sub-chunks and records each one as it lands; the offset a resuming
+// client reads back covers them, so their data has to survive the failure.
+func TestTusAbortedPatchKeepsStoredChunks(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
+	defer cancel()
+
+	cluster, err := startTestCluster(t, ctx)
+	require.NoError(t, err)
+	defer func() {
+		cluster.Stop()
+		os.RemoveAll(cluster.dataDir)
+	}()
+
+	const subChunkSize = 4 * 1024 * 1024
+	testData := make([]byte, 3*subChunkSize)
+	for i := range testData {
+		testData[i] = byte(i % 251)
+	}
+	targetPath := "/aborted/interrupted.bin"
+	client := &http.Client{}
+
+	createReq, err := http.NewRequest(http.MethodPost, cluster.TusURL()+targetPath, nil)
+	require.NoError(t, err)
+	createReq.Header.Set("Tus-Resumable", TusVersion)
+	createReq.Header.Set("Upload-Length", strconv.Itoa(len(testData)))
+
+	createResp, err := client.Do(createReq)
+	require.NoError(t, err)
+	createResp.Body.Close()
+	require.Equal(t, http.StatusCreated, createResp.StatusCode)
+	uploadLocation := createResp.Header.Get("Location")
+
+	// Promise the whole body, then reset the connection while a later
+	// sub-chunk is still being read.
+	conn, err := net.Dial("tcp", "127.0.0.1:"+testFilerPort)
+	require.NoError(t, err)
+	_, err = fmt.Fprintf(conn, "PATCH %s HTTP/1.1\r\nHost: 127.0.0.1:%s\r\nTus-Resumable: %s\r\nContent-Type: application/offset+octet-stream\r\nUpload-Offset: 0\r\nContent-Length: %d\r\n\r\n",
+		uploadLocation, testFilerPort, TusVersion, len(testData))
+	require.NoError(t, err)
+	_, err = conn.Write(testData[:subChunkSize+1024*1024])
+	require.NoError(t, err)
+	time.Sleep(3 * time.Second)
+	require.NoError(t, conn.(*net.TCPConn).SetLinger(0))
+	require.NoError(t, conn.Close())
+	t.Log("PATCH connection reset mid-body")
+
+	time.Sleep(5 * time.Second)
+
+	headReq, err := http.NewRequest(http.MethodHead, cluster.FullURL(uploadLocation), nil)
+	require.NoError(t, err)
+	headReq.Header.Set("Tus-Resumable", TusVersion)
+
+	headResp, err := client.Do(headReq)
+	require.NoError(t, err)
+	headResp.Body.Close()
+	require.Equal(t, http.StatusOK, headResp.StatusCode)
+	currentOffset, err := strconv.Atoi(headResp.Header.Get("Upload-Offset"))
+	require.NoError(t, err)
+	require.Equal(t, subChunkSize, currentOffset, "the sub-chunk stored before the reset should count towards the offset")
+
+	patchReq, err := http.NewRequest(http.MethodPatch, cluster.FullURL(uploadLocation), bytes.NewReader(testData[currentOffset:]))
+	require.NoError(t, err)
+	patchReq.Header.Set("Tus-Resumable", TusVersion)
+	patchReq.Header.Set("Upload-Offset", strconv.Itoa(currentOffset))
+	patchReq.Header.Set("Content-Type", "application/offset+octet-stream")
+
+	patchResp, err := client.Do(patchReq)
+	require.NoError(t, err)
+	patchResp.Body.Close()
+	require.Equal(t, http.StatusNoContent, patchResp.StatusCode)
+
+	// A vacuum reclaims whatever the filer deleted, so the file survives this
+	// only if the chunks the session kept are still stored.
+	vacuumResp, err := client.Get(fmt.Sprintf("http://127.0.0.1:%s/vol/vacuum?garbageThreshold=0.001", testMasterPort))
+	require.NoError(t, err)
+	vacuumResp.Body.Close()
+	require.Equal(t, http.StatusOK, vacuumResp.StatusCode)
+
+	getResp, err := client.Get(cluster.FilerURL() + targetPath)
+	require.NoError(t, err)
+	defer getResp.Body.Close()
+	require.Equal(t, http.StatusOK, getResp.StatusCode)
+	body, err := io.ReadAll(getResp.Body)
+	require.NoError(t, err)
+	assert.Equal(t, testData, body, "the resumed upload should read back whole")
+}
+
+// TestTusConcurrentPatchRefused checks that a PATCH sent while another PATCH
+// on the same session is still consuming its body is refused with 423 Locked.
+// Before the per-session claim, both were accepted at the same offset, recorded
+// the range twice, and completion failed on the duplicate while HEAD reported
+// the upload fully received - the file was never created and every stored byte
+// became garbage when the session expired.
+func TestTusConcurrentPatchRefused(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 180*time.Second)
+	defer cancel()
+
+	cluster, err := startTestCluster(t, ctx)
+	require.NoError(t, err)
+	defer func() {
+		cluster.Stop()
+		os.RemoveAll(cluster.dataDir)
+	}()
+
+	const subChunkSize = 4 * 1024 * 1024
+	testData := make([]byte, 3*subChunkSize)
+	for i := range testData {
+		testData[i] = byte(i % 251)
+	}
+	targetPath := "/raced/video.bin"
+	client := &http.Client{}
+
+	createReq, err := http.NewRequest(http.MethodPost, cluster.TusURL()+targetPath, nil)
+	require.NoError(t, err)
+	createReq.Header.Set("Tus-Resumable", TusVersion)
+	createReq.Header.Set("Upload-Length", strconv.Itoa(len(testData)))
+
+	createResp, err := client.Do(createReq)
+	require.NoError(t, err)
+	createResp.Body.Close()
+	require.Equal(t, http.StatusCreated, createResp.StatusCode)
+	uploadLocation := createResp.Header.Get("Location")
+
+	// PATCH A promises one sub-chunk and stalls mid-body, holding the session.
+	conn, err := net.Dial("tcp", "127.0.0.1:"+testFilerPort)
+	require.NoError(t, err)
+	defer conn.Close()
+	// bound the raw reads below so a filer that never answers fails here
+	require.NoError(t, conn.SetDeadline(time.Now().Add(60*time.Second)))
+	_, err = fmt.Fprintf(conn, "PATCH %s HTTP/1.1\r\nHost: 127.0.0.1:%s\r\nTus-Resumable: %s\r\nContent-Type: application/offset+octet-stream\r\nUpload-Offset: 0\r\nContent-Length: %d\r\n\r\n",
+		uploadLocation, testFilerPort, TusVersion, subChunkSize)
+	require.NoError(t, err)
+	_, err = conn.Write(testData[:1024*1024])
+	require.NoError(t, err)
+	time.Sleep(2 * time.Second)
+
+	// PATCH B is the client's retry of the same range while A is in flight.
+	retryReq, err := http.NewRequest(http.MethodPatch, cluster.FullURL(uploadLocation), bytes.NewReader(testData[:subChunkSize]))
+	require.NoError(t, err)
+	retryReq.Header.Set("Tus-Resumable", TusVersion)
+	retryReq.Header.Set("Upload-Offset", "0")
+	retryReq.Header.Set("Content-Type", "application/offset+octet-stream")
+
+	retryResp, err := client.Do(retryReq)
+	require.NoError(t, err)
+	retryResp.Body.Close()
+	require.Equal(t, http.StatusLocked, retryResp.StatusCode, "a concurrent PATCH must be refused, not recorded twice")
+
+	// Finish PATCH A and read its response.
+	_, err = conn.Write(testData[1024*1024 : subChunkSize])
+	require.NoError(t, err)
+	respReader := bufio.NewReader(conn)
+	respA, err := http.ReadResponse(respReader, nil)
+	require.NoError(t, err)
+	respA.Body.Close()
+	require.Equal(t, http.StatusNoContent, respA.StatusCode)
+
+	headReq, err := http.NewRequest(http.MethodHead, cluster.FullURL(uploadLocation), nil)
+	require.NoError(t, err)
+	headReq.Header.Set("Tus-Resumable", TusVersion)
+
+	headResp, err := client.Do(headReq)
+	require.NoError(t, err)
+	headResp.Body.Close()
+	require.Equal(t, http.StatusOK, headResp.StatusCode)
+	currentOffset, err := strconv.Atoi(headResp.Header.Get("Upload-Offset"))
+	require.NoError(t, err)
+	require.Equal(t, subChunkSize, currentOffset, "only PATCH A's sub-chunk should be recorded")
+
+	patchReq, err := http.NewRequest(http.MethodPatch, cluster.FullURL(uploadLocation), bytes.NewReader(testData[currentOffset:]))
+	require.NoError(t, err)
+	patchReq.Header.Set("Tus-Resumable", TusVersion)
+	patchReq.Header.Set("Upload-Offset", strconv.Itoa(currentOffset))
+	patchReq.Header.Set("Content-Type", "application/offset+octet-stream")
+
+	patchResp, err := client.Do(patchReq)
+	require.NoError(t, err)
+	patchResp.Body.Close()
+	require.Equal(t, http.StatusNoContent, patchResp.StatusCode)
+
+	getResp, err := client.Get(cluster.FilerURL() + targetPath)
+	require.NoError(t, err)
+	defer getResp.Body.Close()
+	require.Equal(t, http.StatusOK, getResp.StatusCode)
+	body, err := io.ReadAll(getResp.Body)
+	require.NoError(t, err)
+	assert.Equal(t, testData, body, "the raced upload should complete with intact content")
+}
diff --git a/test/vacuum/vacuum_integration_test.go b/test/vacuum/vacuum_integration_test.go
index 6d7d14585a..0d0c8e1c5a 100644
--- a/test/vacuum/vacuum_integration_test.go
+++ b/test/vacuum/vacuum_integration_test.go
@@ -315,10 +315,15 @@ func TestVacuumIntegration(t *testing.T) {
 		}
 		commandEnv := shell.NewCommandEnv(options)
 
-		shellCtx, shellCancel := context.WithTimeout(context.Background(), 60*time.Second)
+		// The session context outlives the vacuum command: a deadline here
+		// closes the master connection mid-command on a slow runner, and the
+		// leaked lock renewal then spins until the test binary's timeout.
+		shellCtx, shellCancel := context.WithCancel(context.Background())
 		defer shellCancel()
 		go commandEnv.MasterClient.KeepConnectedToMaster(shellCtx)
-		commandEnv.MasterClient.WaitUntilConnected(shellCtx)
+		connectCtx, connectCancel := context.WithTimeout(shellCtx, 30*time.Second)
+		commandEnv.MasterClient.WaitUntilConnected(connectCtx)
+		connectCancel()
 		time.Sleep(2 * time.Second)
 
 		// Acquire lock (required by shell commands)
diff --git a/test/volume_server/framework/cluster.go b/test/volume_server/framework/cluster.go
index ae84ede075..a134250f5f 100644
--- a/test/volume_server/framework/cluster.go
+++ b/test/volume_server/framework/cluster.go
@@ -20,8 +20,20 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/test/testutil"
 	"github.com/seaweedfs/seaweedfs/test/volume_server/matrix"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
 
+// goBuildTags names the build tags a server the harness compiles must carry to
+// hold the same offsets as the test binary asking for it. A 4-byte server and a
+// 5-byte one disagree about every .idx row and reject each other's .vif, and
+// the mixed Go/Rust suites run both at once.
+func goBuildTags() []string {
+	if types.OffsetSize == 5 {
+		return []string{"-tags", "5BytesOffset"}
+	}
+	return nil
+}
+
 const (
 	defaultWaitTimeout    = 30 * time.Second
 	defaultWaitTick       = 200 * time.Millisecond
@@ -395,7 +407,9 @@ func FindOrBuildWeedBinary() (string, error) {
 		}
 		binPath := filepath.Join(binDir, "weed")
 
-		cmd := exec.Command("go", "build", "-o", binPath, ".")
+		args := append([]string{"build"}, goBuildTags()...)
+		args = append(args, "-o", binPath, ".")
+		cmd := exec.Command("go", args...)
 		cmd.Dir = filepath.Join(repoRoot, "weed")
 		var out bytes.Buffer
 		cmd.Stdout = &out
diff --git a/test/volume_server/framework/cluster_rust.go b/test/volume_server/framework/cluster_rust.go
index 77b724e167..88d594d739 100644
--- a/test/volume_server/framework/cluster_rust.go
+++ b/test/volume_server/framework/cluster_rust.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/test/testutil"
 	"github.com/seaweedfs/seaweedfs/test/volume_server/matrix"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
 
 // RustCluster wraps a Go master + Rust volume server for integration testing.
@@ -200,6 +201,7 @@ func rustVolumeArgs(
 		"--dir", dataDir,
 		"--max", "16",
 		"--master", "127.0.0.1:" + strconv.Itoa(masterPort),
+		"--volume.allowUntrustedRemoteEndpoints",
 		"--securityFile", filepath.Join(configDir, "security.toml"),
 		"--readMode", profile.ReadMode,
 		"--concurrentUploadLimitMB", strconv.Itoa(profile.ConcurrentUploadLimitMB),
@@ -267,8 +269,15 @@ func FindOrBuildRustBinary() (string, error) {
 
 		releaseBin := filepath.Join(rustCrateDir, "target", "release", "weed-volume")
 
-		// Always rebuild once per test process so the harness uses current source and features.
-		cmd := exec.Command("cargo", "build", "--release")
+		// Always rebuild once per test process so the harness uses current source
+		// and features. The crate defaults to 5bytes, so a test binary built
+		// without 5BytesOffset has to turn it off or the Rust server refuses the
+		// .vif the Go server just wrote.
+		args := []string{"build", "--release"}
+		if types.OffsetSize != 5 {
+			args = append(args, "--no-default-features")
+		}
+		cmd := exec.Command("cargo", args...)
 		cmd.Dir = rustCrateDir
 		var out bytes.Buffer
 		cmd.Stdout = &out
diff --git a/test/volume_server/framework/volume_fixture.go b/test/volume_server/framework/volume_fixture.go
index 1ba40434ae..7cf044443a 100644
--- a/test/volume_server/framework/volume_fixture.go
+++ b/test/volume_server/framework/volume_fixture.go
@@ -16,6 +16,18 @@ import (
 
 func AllocateVolume(t testing.TB, client volume_server_pb.VolumeServerClient, volumeID uint32, collection string) {
 	t.Helper()
+	allocateVolume(t, client, volumeID, collection, "")
+}
+
+// AllocateVolumeWithTTL allocates a volume whose needles expire after ttl
+// (e.g. "10m").
+func AllocateVolumeWithTTL(t testing.TB, client volume_server_pb.VolumeServerClient, volumeID uint32, collection string, ttl string) {
+	t.Helper()
+	allocateVolume(t, client, volumeID, collection, ttl)
+}
+
+func allocateVolume(t testing.TB, client volume_server_pb.VolumeServerClient, volumeID uint32, collection string, ttl string) {
+	t.Helper()
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
@@ -24,6 +36,7 @@ func AllocateVolume(t testing.TB, client volume_server_pb.VolumeServerClient, vo
 		VolumeId:    volumeID,
 		Collection:  collection,
 		Replication: "000",
+		Ttl:         ttl,
 		Version:     uint32(needle.GetCurrentVersion()),
 	})
 	if err != nil {
diff --git a/test/volume_server/grpc/admin_lifecycle_test.go b/test/volume_server/grpc/admin_lifecycle_test.go
index 7ec5d64ef8..10aaba34be 100644
--- a/test/volume_server/grpc/admin_lifecycle_test.go
+++ b/test/volume_server/grpc/admin_lifecycle_test.go
@@ -179,7 +179,9 @@ func TestAllocateDuplicateAndMountUnmountMissingVariants(t *testing.T) {
 	}
 }
 
-func TestMaintenanceModeRejectsVolumeDelete(t *testing.T) {
+// Evacuating a server in maintenance mode ends each move by deleting the source
+// volume, so VolumeDelete must stay available in that mode (issue #11066).
+func TestMaintenanceModeAllowsVolumeDelete(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
 	}
@@ -194,22 +196,14 @@ func TestMaintenanceModeRejectsVolumeDelete(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
 
-	stateResp, err := client.GetState(ctx, &volume_server_pb.GetStateRequest{})
-	if err != nil {
-		t.Fatalf("GetState failed: %v", err)
-	}
-	_, err = client.SetState(ctx, &volume_server_pb.SetStateRequest{
-		State: &volume_server_pb.VolumeServerState{Maintenance: true, Version: stateResp.GetState().GetVersion()},
-	})
-	if err != nil {
-		t.Fatalf("SetState maintenance=true failed: %v", err)
+	framework.EnableMaintenanceMode(t, ctx, client)
+
+	if _, err := client.VolumeDelete(ctx, &volume_server_pb.VolumeDeleteRequest{VolumeId: volumeID, OnlyEmpty: true}); err != nil {
+		t.Fatalf("VolumeDelete should succeed in maintenance mode, got: %v", err)
 	}
 
-	_, err = client.VolumeDelete(ctx, &volume_server_pb.VolumeDeleteRequest{VolumeId: volumeID, OnlyEmpty: true})
+	_, err := client.VolumeStatus(ctx, &volume_server_pb.VolumeStatusRequest{VolumeId: volumeID})
 	if err == nil {
-		t.Fatalf("VolumeDelete should fail when maintenance mode is enabled")
-	}
-	if !strings.Contains(err.Error(), "maintenance mode") {
-		t.Fatalf("expected maintenance mode error, got: %v", err)
+		t.Fatalf("VolumeStatus should fail once the volume is deleted")
 	}
 }
diff --git a/test/volume_server/grpc/admin_readonly_collection_test.go b/test/volume_server/grpc/admin_readonly_collection_test.go
index 5f9679f2e4..16760209c8 100644
--- a/test/volume_server/grpc/admin_readonly_collection_test.go
+++ b/test/volume_server/grpc/admin_readonly_collection_test.go
@@ -117,19 +117,27 @@ func TestVolumeMarkReadonlyWritableErrorPaths(t *testing.T) {
 	// enter maintenance mode
 	framework.EnableMaintenanceMode(t, ctx, grpcClient)
 
-	// existing volume in maintenance mode should return "maintenance mode" error
+	// marking readonly only restricts the server further and is the first step
+	// of evacuating it, so maintenance mode lets it through (issue #11066)
 	_, err = grpcClient.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{VolumeId: volumeID, Persist: true})
-	if err == nil || !strings.Contains(err.Error(), "maintenance mode") {
-		t.Fatalf("VolumeMarkReadonly maintenance error mismatch: %v", err)
+	if err != nil {
+		t.Fatalf("VolumeMarkReadonly should succeed in maintenance mode, got: %v", err)
+	}
+	statusResp, err := grpcClient.VolumeStatus(ctx, &volume_server_pb.VolumeStatusRequest{VolumeId: volumeID})
+	if err != nil {
+		t.Fatalf("VolumeStatus after readonly in maintenance failed: %v", err)
+	}
+	if !statusResp.GetIsReadOnly() {
+		t.Fatalf("VolumeStatus expected readonly=true after VolumeMarkReadonly in maintenance mode")
 	}
 
+	// reopening a volume for writes is still refused on a read-only server
 	_, err = grpcClient.VolumeMarkWritable(ctx, &volume_server_pb.VolumeMarkWritableRequest{VolumeId: volumeID})
 	if err == nil || !strings.Contains(err.Error(), "maintenance mode") {
 		t.Fatalf("VolumeMarkWritable maintenance error mismatch: %v", err)
 	}
 
 	// non-existent volume in maintenance mode should still return "not found"
-	// (volume lookup happens before maintenance check)
 	_, err = grpcClient.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{VolumeId: 98773, Persist: true})
 	if err == nil || !strings.Contains(err.Error(), "not found") {
 		t.Fatalf("VolumeMarkReadonly missing-volume in maintenance error mismatch: %v", err)
diff --git a/test/volume_server/grpc/copy_sync_test.go b/test/volume_server/grpc/copy_sync_test.go
index 810395fb63..f47fa186bb 100644
--- a/test/volume_server/grpc/copy_sync_test.go
+++ b/test/volume_server/grpc/copy_sync_test.go
@@ -3,6 +3,7 @@ package volume_server_grpc_test
 import (
 	"context"
 	"io"
+	"math/rand"
 	"net/http"
 	"strings"
 	"testing"
@@ -295,3 +296,100 @@ func TestVolumeCopyOverwritesExistingDestinationVolume(t *testing.T) {
 		t.Fatalf("destination post-copy payload mismatch: got %q want %q", string(destReadAfterBody), string(sourcePayload))
 	}
 }
+
+// A VolumeCopy whose caller goes away must not leave a mounted volume behind on
+// the destination. weed-admin's batch balance routinely starts far more copies
+// than it finishes, and each abandoned copy that still mounts costs the
+// destination a volume it was never asked to hold: a per-volume index cache that
+// is never reclaimed, and — under replication=000 — a second writable copy of a
+// volume id that two writers can diverge.
+//
+// The copy is throttled so it is demonstrably still in flight when the caller
+// cancels; the assertion before the cancel keeps the test from passing
+// vacuously if the throttle ever stops biting.
+func TestVolumeCopyCancelledByCallerDoesNotMountDestination(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	clusterHarness := framework.StartDualVolumeCluster(t, matrix.P1())
+	sourceConn, sourceClient := framework.DialVolumeServer(t, clusterHarness.VolumeGRPCAddress(0))
+	defer sourceConn.Close()
+	destConn, destClient := framework.DialVolumeServer(t, clusterHarness.VolumeGRPCAddress(1))
+	defer destConn.Close()
+
+	const volumeID = uint32(44)
+	const payloadMiB = 192
+	framework.AllocateVolume(t, sourceClient, volumeID, "")
+
+	// The fixture size is load-bearing twice over; do not shrink it to save CI
+	// time without reading both reasons.
+	//
+	// First, the copy has to still be running when the caller cancels, and the
+	// only lever for that is IoBytePerSecond. It is a no-op below ~100ms of wall
+	// clock — the throttler never re-checks within its first window — and on a
+	// tmpfs loopback cluster 64 MiB copies in ~110ms.
+	//
+	// Second, 192 MiB is above the 128 MiB progress-report interval, which is
+	// what lets this test be green on Go: a failing stream.Send from that report
+	// is Go's only abort signal. Measured below the interval (120 MiB), a Go
+	// destination mounts the abandoned copy too, so a smaller fixture would fail
+	// the Go leg without any Rust change.
+	//
+	// The bytes are pseudo-random because the volume server gzips compressible
+	// uploads; a repeating payload lands on disk as a few KB and the throttle
+	// never bites.
+	httpClient := framework.NewHTTPClient()
+	chunk := make([]byte, 1024*1024)
+	if _, err := rand.New(rand.NewSource(11186)).Read(chunk); err != nil {
+		t.Fatalf("generate payload: %v", err)
+	}
+	for i := 0; i < payloadMiB; i++ {
+		fid := framework.NewFileID(volumeID, uint64(880100+i), 0x3456789a)
+		uploadResp := framework.UploadBytes(t, httpClient, clusterHarness.VolumeAdminURL(0), fid, chunk)
+		_ = framework.ReadAllAndClose(t, uploadResp)
+		if uploadResp.StatusCode != http.StatusCreated {
+			t.Fatalf("upload %d to source expected 201, got %d", i, uploadResp.StatusCode)
+		}
+	}
+
+	// 192 MiB at 16 MiB/s is about twelve seconds of copying.
+	copyCtx, cancelCopy := context.WithCancel(context.Background())
+	defer cancelCopy()
+	_, err := destClient.VolumeCopy(copyCtx, &volume_server_pb.VolumeCopyRequest{
+		VolumeId:        volumeID,
+		Collection:      "",
+		SourceDataNode:  clusterHarness.VolumeAdminAddress(0) + "." + strings.Split(clusterHarness.VolumeGRPCAddress(0), ":")[1],
+		IoBytePerSecond: 16 * 1024 * 1024,
+	})
+	if err != nil {
+		t.Fatalf("VolumeCopy start failed: %v", err)
+	}
+
+	time.Sleep(2 * time.Second)
+
+	// Premise: the copy must still be running when we cancel. If the
+	// destination has already mounted, the throttle no longer bites and the
+	// rest of this test would prove nothing.
+	premiseCtx, cancelPremise := context.WithTimeout(context.Background(), 5*time.Second)
+	_, premiseErr := destClient.ReadVolumeFileStatus(premiseCtx, &volume_server_pb.ReadVolumeFileStatusRequest{VolumeId: volumeID})
+	cancelPremise()
+	if premiseErr == nil {
+		t.Fatalf("copy of volume %d already completed before the cancel; raise payloadMiB or lower IoBytePerSecond", volumeID)
+	}
+
+	cancelCopy()
+
+	// Well past the ~10s the unabandoned copy would have needed: the volume
+	// must never appear on the destination.
+	deadline := time.Now().Add(25 * time.Second)
+	for time.Now().Before(deadline) {
+		pollCtx, cancelPoll := context.WithTimeout(context.Background(), 5*time.Second)
+		_, statusErr := destClient.ReadVolumeFileStatus(pollCtx, &volume_server_pb.ReadVolumeFileStatusRequest{VolumeId: volumeID})
+		cancelPoll()
+		if statusErr == nil {
+			t.Fatalf("destination mounted volume %d after its VolumeCopy caller cancelled", volumeID)
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+}
diff --git a/test/volume_server/grpc/erasure_coding_test.go b/test/volume_server/grpc/erasure_coding_test.go
index af75b6f502..7fd20be774 100644
--- a/test/volume_server/grpc/erasure_coding_test.go
+++ b/test/volume_server/grpc/erasure_coding_test.go
@@ -27,24 +27,27 @@ func TestEcMaintenanceModeRejections(t *testing.T) {
 	conn, grpcClient := framework.DialVolumeServer(t, clusterHarness.VolumeGRPCAddress())
 	defer conn.Close()
 
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	// Encode a volume before entering maintenance mode so the shard delete
+	// below has real shards to remove.
+	const ecVolumeID = uint32(1)
+	framework.AllocateVolume(t, grpcClient, ecVolumeID, "")
+	httpClient := framework.NewHTTPClient()
+	uploadResp := framework.UploadBytes(t, httpClient, clusterHarness.VolumeAdminURL(), framework.NewFileID(ecVolumeID, 990001, 0x11223344), []byte("ec-maintenance-content"))
+	_ = framework.ReadAllAndClose(t, uploadResp)
+	if uploadResp.StatusCode != http.StatusCreated {
+		t.Fatalf("upload expected 201, got %d", uploadResp.StatusCode)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 
-	stateResp, err := grpcClient.GetState(ctx, &volume_server_pb.GetStateRequest{})
-	if err != nil {
-		t.Fatalf("GetState failed: %v", err)
-	}
-	_, err = grpcClient.SetState(ctx, &volume_server_pb.SetStateRequest{
-		State: &volume_server_pb.VolumeServerState{
-			Maintenance: true,
-			Version:     stateResp.GetState().GetVersion(),
-		},
-	})
-	if err != nil {
-		t.Fatalf("SetState maintenance=true failed: %v", err)
+	if _, err := grpcClient.VolumeEcShardsGenerate(ctx, &volume_server_pb.VolumeEcShardsGenerateRequest{VolumeId: ecVolumeID, Collection: ""}); err != nil {
+		t.Fatalf("VolumeEcShardsGenerate before maintenance failed: %v", err)
 	}
 
-	_, err = grpcClient.VolumeEcShardsGenerate(ctx, &volume_server_pb.VolumeEcShardsGenerateRequest{VolumeId: 1, Collection: ""})
+	framework.EnableMaintenanceMode(t, ctx, grpcClient)
+
+	_, err := grpcClient.VolumeEcShardsGenerate(ctx, &volume_server_pb.VolumeEcShardsGenerateRequest{VolumeId: 1, Collection: ""})
 	if err == nil || !strings.Contains(err.Error(), "maintenance mode") {
 		t.Fatalf("VolumeEcShardsGenerate maintenance error mismatch: %v", err)
 	}
@@ -59,13 +62,23 @@ func TestEcMaintenanceModeRejections(t *testing.T) {
 		t.Fatalf("VolumeEcShardsCopy maintenance error mismatch: %v", err)
 	}
 
+	// Deleting shards removes data rather than adding it, and is how evacuating
+	// EC shards off a server in maintenance mode finishes (issue #11066).
 	_, err = grpcClient.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
-		VolumeId:   1,
+		VolumeId:   ecVolumeID,
 		Collection: "",
 		ShardIds:   []uint32{0},
 	})
-	if err == nil || !strings.Contains(err.Error(), "maintenance mode") {
-		t.Fatalf("VolumeEcShardsDelete maintenance error mismatch: %v", err)
+	if err != nil {
+		t.Fatalf("VolumeEcShardsDelete should succeed in maintenance mode, got: %v", err)
+	}
+	_, err = grpcClient.VolumeEcShardsMount(ctx, &volume_server_pb.VolumeEcShardsMountRequest{
+		VolumeId:   ecVolumeID,
+		Collection: "",
+		ShardIds:   []uint32{0},
+	})
+	if err == nil {
+		t.Fatalf("VolumeEcShardsMount should fail once shard 0 has been deleted")
 	}
 
 	_, err = grpcClient.VolumeEcBlobDelete(ctx, &volume_server_pb.VolumeEcBlobDeleteRequest{
diff --git a/test/volume_server/grpc/fetch_remote_s3_test.go b/test/volume_server/grpc/fetch_remote_s3_test.go
index d3c9aa673e..856b712357 100644
--- a/test/volume_server/grpc/fetch_remote_s3_test.go
+++ b/test/volume_server/grpc/fetch_remote_s3_test.go
@@ -37,23 +37,28 @@ func startWeedMini(t *testing.T) (s3Endpoint string, cleanup func()) {
 		}
 	}
 
-	miniPorts := testutil.MustFreeMiniPorts(t, []string{"Master", "Volume", "Filer", "S3"})
+	miniPorts := testutil.MustFreeMiniPorts(t, []string{"Master", "Volume", "Filer", "S3", "Admin"})
 	miniMasterPort := miniPorts[0]
 	miniVolumePort := miniPorts[1]
 	miniFilerPort := miniPorts[2]
 	miniS3Port := miniPorts[3]
+	miniAdminPort := miniPorts[4]
 	miniDir := t.TempDir()
 	os.WriteFile(filepath.Join(miniDir, "security.toml"), []byte("# empty\n"), 0644)
 
 	ctx, cancel := context.WithCancel(context.Background())
 
-	miniCmd := exec.CommandContext(ctx, weedBin, "mini",
+	miniArgs := append([]string{"mini",
 		fmt.Sprintf("-dir=%s", miniDir),
 		fmt.Sprintf("-master.port=%d", miniMasterPort),
 		fmt.Sprintf("-volume.port=%d", miniVolumePort),
 		fmt.Sprintf("-filer.port=%d", miniFilerPort),
 		fmt.Sprintf("-s3.port=%d", miniS3Port),
-	)
+		"-webdav=false",
+		"-s3.port.lance=0",
+		"-s3.port.iceberg=0",
+	}, testutil.MiniAdminArgs(miniAdminPort)...)
+	miniCmd := exec.CommandContext(ctx, weedBin, miniArgs...)
 	miniCmd.Env = append(os.Environ(), "AWS_ACCESS_KEY_ID=admin", "AWS_SECRET_ACCESS_KEY=admin")
 	miniCmd.Dir = miniDir
 	logFile, _ := os.CreateTemp("", "weed-mini-*.log")
diff --git a/test/volume_server/grpc/scrub_integration_test.go b/test/volume_server/grpc/scrub_integration_test.go
index 5b8da8af40..cd844f6261 100644
--- a/test/volume_server/grpc/scrub_integration_test.go
+++ b/test/volume_server/grpc/scrub_integration_test.go
@@ -3,6 +3,7 @@ package volume_server_grpc_test
 import (
 	"context"
 	"net/http"
+	"strings"
 	"testing"
 	"time"
 
@@ -414,3 +415,87 @@ func TestScrubEcVolumeIndexCorruptEcx(t *testing.T) {
 		t.Fatalf("expected broken volume after ECX corruption")
 	}
 }
+
+// scrubEcUntilLocated runs an EC scrub, retrying while the server is still waiting on
+// the master for the shard locations a distributed scrub needs.
+func scrubEcUntilLocated(t *testing.T, ctx context.Context, grpcClient volume_server_pb.VolumeServerClient, volumeID uint32, mode volume_server_pb.VolumeScrubMode) *volume_server_pb.ScrubEcVolumeResponse {
+	t.Helper()
+	deadline := time.Now().Add(60 * time.Second)
+	for {
+		resp, err := grpcClient.ScrubEcVolume(ctx, &volume_server_pb.ScrubEcVolumeRequest{
+			VolumeIds: []uint32{volumeID},
+			Mode:      mode,
+		})
+		if err != nil {
+			t.Fatalf("ScrubEcVolume %s failed: %v", mode, err)
+		}
+		waiting := false
+		for _, d := range resp.GetDetails() {
+			if strings.Contains(d, "failed to locate shard via master grpc") {
+				waiting = true
+				break
+			}
+		}
+		if !waiting {
+			return resp
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("master never reported EC shard locations for volume %d: %v", volumeID, resp.GetDetails())
+		}
+		time.Sleep(time.Second)
+	}
+}
+
+// With a shard gone, FULL cannot read the intervals that lived on it, while READS
+// rebuilds them from parity. Either way the missing shard has to be reported: a
+// volume that scrubs clean is a volume nobody repairs.
+func TestScrubEcVolumeReadsRecoversMissingShard(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	clusterHarness := framework.StartVolumeCluster(t, matrix.P1())
+	conn, grpcClient := framework.DialVolumeServer(t, clusterHarness.VolumeGRPCAddress())
+	defer conn.Close()
+
+	const volumeID = uint32(216)
+	const missingShard = uint32(0)
+	httpClient := framework.NewHTTPClient()
+	ecSetup(t, grpcClient, httpClient, clusterHarness.VolumeAdminURL(), volumeID)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	if _, err := grpcClient.VolumeEcShardsUnmount(ctx, &volume_server_pb.VolumeEcShardsUnmountRequest{
+		VolumeId: volumeID,
+		ShardIds: []uint32{missingShard},
+	}); err != nil {
+		t.Fatalf("VolumeEcShardsUnmount shard %d failed: %v", missingShard, err)
+	}
+	if _, err := grpcClient.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
+		VolumeId: volumeID,
+		ShardIds: []uint32{missingShard},
+	}); err != nil {
+		t.Fatalf("VolumeEcShardsDelete shard %d failed: %v", missingShard, err)
+	}
+
+	fullResp := scrubEcUntilLocated(t, ctx, grpcClient, volumeID, volume_server_pb.VolumeScrubMode_FULL)
+	assertOnlyBrokenShard(t, "FULL", fullResp, missingShard)
+	if len(fullResp.GetDetails()) == 0 {
+		t.Fatalf("FULL should report the needles it could not read")
+	}
+
+	readsResp := scrubEcUntilLocated(t, ctx, grpcClient, volumeID, volume_server_pb.VolumeScrubMode_READS)
+	assertOnlyBrokenShard(t, "READS", readsResp, missingShard)
+	if len(readsResp.GetDetails()) != 0 {
+		t.Fatalf("READS should rebuild every needle from parity, got: %v", readsResp.GetDetails())
+	}
+}
+
+func assertOnlyBrokenShard(t *testing.T, mode string, resp *volume_server_pb.ScrubEcVolumeResponse, shardID uint32) {
+	t.Helper()
+	infos := resp.GetBrokenShardInfos()
+	if len(infos) != 1 || infos[0].GetShardId() != shardID {
+		t.Fatalf("%s reported broken shards %v, want only shard %d (details: %v)", mode, infos, shardID, resp.GetDetails())
+	}
+}
diff --git a/test/volume_server/grpc/scrub_query_test.go b/test/volume_server/grpc/scrub_query_test.go
index a4a776df2e..fda4ce29d1 100644
--- a/test/volume_server/grpc/scrub_query_test.go
+++ b/test/volume_server/grpc/scrub_query_test.go
@@ -520,14 +520,25 @@ func TestScrubVolumeMarkBrokenReadonlyInMaintenanceMode(t *testing.T) {
 
 	framework.EnableMaintenanceMode(t, ctx, grpcClient)
 
-	// scrub with the flag in maintenance mode: makeVolumeReadonly should fail
-	// and ScrubVolume should propagate the error
-	_, err := grpcClient.ScrubVolume(ctx, &volume_server_pb.ScrubVolumeRequest{
+	// marking a volume readonly only restricts a server that is already
+	// read-only, so maintenance mode does not block fencing broken volumes
+	resp, err := grpcClient.ScrubVolume(ctx, &volume_server_pb.ScrubVolumeRequest{
 		VolumeIds:                 []uint32{volumeID},
 		Mode:                      volume_server_pb.VolumeScrubMode_INDEX,
 		MarkBrokenVolumesReadonly: true,
 	})
-	if err == nil || !strings.Contains(err.Error(), "maintenance mode") {
-		t.Fatalf("ScrubVolume with MarkBrokenVolumesReadonly in maintenance mode error mismatch: %v", err)
+	if err != nil {
+		t.Fatalf("ScrubVolume with MarkBrokenVolumesReadonly in maintenance mode failed: %v", err)
+	}
+	if len(resp.GetBrokenVolumeIds()) == 0 {
+		t.Fatalf("expected broken volume after corruption")
+	}
+
+	statusResp, err := grpcClient.VolumeStatus(ctx, &volume_server_pb.VolumeStatusRequest{VolumeId: volumeID})
+	if err != nil {
+		t.Fatalf("VolumeStatus after scrub in maintenance mode failed: %v", err)
+	}
+	if !statusResp.GetIsReadOnly() {
+		t.Fatalf("broken volume should be read-only after MarkBrokenVolumesReadonly scrub in maintenance mode")
 	}
 }
diff --git a/test/winfsp/semantics_test.go b/test/winfsp/semantics_test.go
index 28175ee6c5..12bf3fb263 100644
--- a/test/winfsp/semantics_test.go
+++ b/test/winfsp/semantics_test.go
@@ -175,11 +175,36 @@ func TestRenameOverExisting(t *testing.T) {
 	if string(got) != "new" {
 		t.Fatalf("target holds %q, want the source content", got)
 	}
-	if _, err := os.Stat(src); !os.IsNotExist(err) {
-		t.Fatal("source survived the rename")
+	if fi, err := os.Stat(src); !os.IsNotExist(err) {
+		// Both a stale positive and a transient non-ENOENT error land here, and
+		// they indict different layers; a second look says whether it persists.
+		time.Sleep(200 * time.Millisecond)
+		fi2, err2 := os.Stat(src)
+		// A listing reads no per-path cache and the mount's own forgets
+		// within a second, so a name that survives both is back on the filer.
+		listed := dirNames(t, dir)
+		time.Sleep(2 * time.Second)
+		_, errLater := os.Stat(src)
+		t.Fatalf("stat of the renamed-away source did not return not-exist: stat=%v err=%v; 200ms later stat=%v err=%v; past the path cache err=%v; %s lists %v",
+			describeFileInfo(fi), err, describeFileInfo(fi2), err2, errLater, dir, listed)
 	}
 }
 
+// dirNames lists a directory for a failure message, reporting the error in
+// place of the names rather than failing a test that is already failing.
+func dirNames(t *testing.T, dir string) []string {
+	t.Helper()
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return []string{"readdir: " + err.Error()}
+	}
+	names := make([]string, 0, len(entries))
+	for _, entry := range entries {
+		names = append(names, entry.Name())
+	}
+	return names
+}
+
 func TestRenameAcrossDirectories(t *testing.T) {
 	dir := testRoot(t)
 	from := filepath.Join(dir, "from")
@@ -515,3 +540,10 @@ func TestDeleteOnClose(t *testing.T) {
 		t.Fatalf("close after recreate: %v", err)
 	}
 }
+
+func describeFileInfo(fi os.FileInfo) string {
+	if fi == nil {
+		return "<nil>"
+	}
+	return fmt.Sprintf("{size=%d mode=%v mtime=%s}", fi.Size(), fi.Mode(), fi.ModTime().Format(time.RFC3339Nano))
+}
diff --git a/unmaintained/check_disk_size/check_disk_size.go b/unmaintained/check_disk_size/check_disk_size.go
index 4a8b92b887..c0e78f0e99 100644
--- a/unmaintained/check_disk_size/check_disk_size.go
+++ b/unmaintained/check_disk_size/check_disk_size.go
@@ -1,3 +1,5 @@
+//go:build !windows && !openbsd && !netbsd && !plan9 && !solaris
+
 package main
 
 import (
diff --git a/weed/admin/dash/admin_data.go b/weed/admin/dash/admin_data.go
index bc61871bf5..f0324a0d7b 100644
--- a/weed/admin/dash/admin_data.go
+++ b/weed/admin/dash/admin_data.go
@@ -44,6 +44,10 @@ type AdminData struct {
 	// Trends holds at-a-glance sparklines built from the admin's own recent
 	// cluster snapshots (no Prometheus required).
 	Trends DashboardTrends `json:"trends"`
+
+	// TierStats breaks volumes and EC shards down by storage tier: local
+	// disk types plus one entry per remote storage holding tiered volumes.
+	TierStats []TierStats `json:"tier_stats"`
 }
 
 // Object Store Users management structures
@@ -109,6 +113,34 @@ type UserDetails struct {
 	Groups      []string        `json:"groups"`
 }
 
+// RoleReadOnly is the session role assigned to read-only (view-only) admin
+// accounts. It matches the value stored by HandleLogin when the read-only
+// credentials are used.
+const RoleReadOnly = "readonly"
+
+// IsReadOnlyRole reports whether the given admin session role grants only
+// view-only access. Any other role (admin, or the empty role used when auth
+// is disabled) is treated as non-read-only.
+func IsReadOnlyRole(role string) bool {
+	return role == RoleReadOnly
+}
+
+// RedactSecretKey clears the plaintext S3 secret key from an object-store
+// user record. The access key (a public identifier) is retained so the
+// identity can still be listed; only the reusable secret is removed.
+func (u *ObjectStoreUser) RedactSecretKey() {
+	u.SecretKey = ""
+}
+
+// RedactSecretKeys clears the plaintext S3 secret keys from a user's access
+// key records. Access key identifiers are retained so the set of keys remains
+// visible; only the reusable secrets are removed.
+func (d *UserDetails) RedactSecretKeys() {
+	for i := range d.AccessKeys {
+		d.AccessKeys[i].SecretKey = ""
+	}
+}
+
 type FilerNode struct {
 	Address     string    `json:"address"`
 	DataCenter  string    `json:"datacenter"`
@@ -213,6 +245,7 @@ func (s *AdminServer) GetAdminData(username string) (AdminData, error) {
 		TotalEcShards:     totalEcShards,
 		TotalMountClients: totalMountClients,
 		Trends:            s.GetDashboardTrends(),
+		TierStats:         topology.TierStats,
 	}
 
 	return adminData, nil
@@ -249,7 +282,7 @@ func (s *AdminServer) ShowOverview(w http.ResponseWriter, r *http.Request) {
 // dashboard never shows an empty list.
 func (s *AdminServer) getMasterNodesStatus() []MasterNode {
 	masterMap := make(map[string]MasterNode)
-	raftCallSucceeded := false
+	raftReturnedEmpty := false
 
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
 		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
@@ -258,16 +291,19 @@ func (s *AdminServer) getMasterNodesStatus() []MasterNode {
 		if err != nil {
 			return err
 		}
-		raftCallSucceeded = true
+		raftReturnedEmpty = len(resp.ClusterServers) == 0
 		for _, server := range resp.ClusterServers {
-			// pb.GrpcAddressToServerAddress calls glog.Fatalf on a parse
-			// error, so pre-validate the raft address with net.SplitHostPort
-			// and skip malformed entries instead of taking the process down.
+			// Skip malformed raft addresses instead of letting an
+			// unconvertible value into masterMap.
 			if _, _, splitErr := net.SplitHostPort(server.Address); splitErr != nil {
 				glog.Warningf("skip master with invalid raft address %q: %v", server.Address, splitErr)
 				continue
 			}
 			httpAddress := pb.GrpcAddressToServerAddress(server.Address)
+			if httpAddress == "" {
+				glog.Warningf("skip master with invalid raft address %q", server.Address)
+				continue
+			}
 			masterMap[httpAddress] = MasterNode{
 				Address:  httpAddress,
 				IsLeader: server.IsLeader,
@@ -287,10 +323,11 @@ func (s *AdminServer) getMasterNodesStatus() []MasterNode {
 			addr := pb.ServerAddress(currentMaster).ToHttpAddress()
 			// A successful empty raft response means raft is not initialized
 			// (standalone/non-raft cluster); the only master IS the leader.
-			// A failed RPC means connectivity issue; do not claim leadership.
+			// A failed RPC or a nonempty response whose entries were all
+			// rejected must not claim leadership.
 			masterMap[addr] = MasterNode{
 				Address:  addr,
-				IsLeader: raftCallSucceeded,
+				IsLeader: raftReturnedEmpty,
 			}
 		}
 	}
diff --git a/weed/admin/dash/admin_server.go b/weed/admin/dash/admin_server.go
index bfe965161b..4f66c9fc46 100644
--- a/weed/admin/dash/admin_server.go
+++ b/weed/admin/dash/admin_server.go
@@ -2,15 +2,19 @@ package dash
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
+	"net/url"
 	"sort"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/seaweedfs/seaweedfs/weed/admin/maintenance"
 	adminplugin "github.com/seaweedfs/seaweedfs/weed/admin/plugin"
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
@@ -34,6 +38,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/lifecycle_xml"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/scheduler"
@@ -156,11 +161,16 @@ type AdminServer struct {
 
 	s3TablesManager *s3tables.Manager
 	icebergPort     int
+	lancePort       int
+
+	// s3PublicEndpoint is the client-facing S3 address from admin.toml
+	// (s3.public_endpoint); discovered S3 servers are the fallback.
+	s3PublicEndpoint string
 }
 
 // Type definitions moved to types.go
 
-func NewAdminServer(masters string, filerGroup string, templateFS http.FileSystem, dataDir string, icebergPort int) *AdminServer {
+func NewAdminServer(masters string, filerGroup string, templateFS http.FileSystem, dataDir string, icebergPort, lancePort int, s3PublicEndpoint string) *AdminServer {
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.admin")
 
 	// Create master client with multiple master support
@@ -196,6 +206,8 @@ func NewAdminServer(masters string, filerGroup string, templateFS http.FileSyste
 		collectionStatsCacheThreshold: defaultStatsCacheTimeout,
 		s3TablesManager:               newS3TablesManager(),
 		icebergPort:                   icebergPort,
+		lancePort:                     lancePort,
+		s3PublicEndpoint:              normalizeS3PublicEndpoint(s3PublicEndpoint),
 		pluginLock:                    lockManager,
 		adminPresenceLock:             presenceLock,
 		bgCancel:                      bgCancel,
@@ -257,33 +269,25 @@ func NewAdminServer(masters string, filerGroup string, templateFS http.FileSyste
 			maintenanceConfig = maintenance.DefaultMaintenanceConfig()
 		}
 
-		// Apply new defaults to handle schema changes (like enabling by default)
-		schema := maintenance.GetMaintenanceConfigSchema()
-		if err := schema.ApplyDefaultsToProtobuf(maintenanceConfig); err != nil {
-			glog.Warningf("Failed to apply schema defaults to loaded config: %v", err)
-		}
-
-		// Force enable maintenance system for new default behavior
-		// This handles the case where old configs had Enabled=false as default
-		if !maintenanceConfig.Enabled {
-			glog.V(1).Infof("Enabling maintenance system (new default behavior)")
-			maintenanceConfig.Enabled = true
-		}
-
-		glog.V(1).Infof("Maintenance system initialized with persistent configuration (enabled: %v)", maintenanceConfig.Enabled)
+		glog.V(1).Infof("Maintenance system initialized with persistent configuration (enabled: %v)", maintenanceConfig.GetEnabled())
 	} else {
 		maintenanceConfig = maintenance.DefaultMaintenanceConfig()
-		glog.V(1).Infof("No data directory configured, maintenance system will run in memory-only mode (enabled: %v)", maintenanceConfig.Enabled)
+		glog.V(1).Infof("No data directory configured, maintenance system will run in memory-only mode (enabled: %v)", maintenanceConfig.GetEnabled())
 	}
 
+	// Load saved task configurations from persistence. This has to run before the maintenance
+	// manager is created: creating it applies the maintenance policy to the registered
+	// detectors and schedulers, while this call replaces each task's whole config object, so
+	// running it afterwards would discard what the policy just applied. Both read the same
+	// persisted task config files, so the policy ends up as the last writer and stays
+	// authoritative for the task types it covers.
+	server.loadTaskConfigurationsFromPersistence()
+
 	// Always initialize maintenance manager
 	server.InitMaintenanceManager(maintenanceConfig)
 
-	// Load saved task configurations from persistence
-	server.loadTaskConfigurationsFromPersistence()
-
 	// Start maintenance manager if enabled
-	if maintenanceConfig.Enabled {
+	if maintenanceConfig.GetEnabled() {
 		go func() {
 			// Give master client a bit of time to connect before starting scans
 			time.Sleep(2 * time.Second)
@@ -291,6 +295,8 @@ func NewAdminServer(masters string, filerGroup string, templateFS http.FileSyste
 				glog.Errorf("Failed to start maintenance manager: %v", err)
 			}
 		}()
+	} else {
+		glog.V(0).Infof("Maintenance system is disabled by configuration, not starting the maintenance manager")
 	}
 
 	pluginOpts := adminplugin.Options{
@@ -430,7 +436,72 @@ func (s *AdminServer) publishMaintenanceMetrics(ctx context.Context) {
 	}
 }
 
+// workerFleetTotals aggregates connected workers and their task slots across
+// BOTH worker registries the admin server keeps: the legacy maintenance-worker
+// registry (workers that register over the worker gRPC stream) and the plugin
+// worker registry (workers started as `weed worker`). Reading only the legacy
+// one reported zero workers on clusters that run the admin and the workers as
+// separate components, where no legacy worker ever registers.
+//
+// A worker can appear in both registries: `weed mini` starts both runtimes from
+// one working directory, so they share the persisted worker ID. Merging by ID
+// keeps such a worker counted once, and its slots are taken from the legacy
+// registry, which is where they were accounted for before.
+func (s *AdminServer) workerFleetTotals() (workers, usedSlots, maxSlots int) {
+	var legacySlots map[string]maintenance.WorkerSlots
+	if s.maintenanceManager != nil {
+		legacySlots = s.maintenanceManager.GetWorkerSlots()
+	}
+	return mergeWorkerFleetTotals(legacySlots, s.GetPluginWorkers())
+}
+
+// mergeWorkerFleetTotals unions the legacy and plugin worker registries by
+// worker ID. Plugin workers report their slots in the heartbeat, so one that
+// has connected but not yet sent a heartbeat adds to the worker count with zero
+// slots until its first heartbeat lands.
+func mergeWorkerFleetTotals(legacySlots map[string]maintenance.WorkerSlots, pluginWorkers []*adminplugin.WorkerSession) (workers, usedSlots, maxSlots int) {
+	for _, slots := range legacySlots {
+		workers++
+		usedSlots += slots.Used
+		maxSlots += slots.Max
+	}
+
+	for _, session := range pluginWorkers {
+		if session == nil {
+			continue
+		}
+		if _, counted := legacySlots[session.WorkerID]; counted {
+			continue
+		}
+		workers++
+		if heartbeat := session.Heartbeat; heartbeat != nil {
+			used := int(heartbeat.DetectionSlotsUsed) + int(heartbeat.ExecutionSlotsUsed)
+			max := int(heartbeat.DetectionSlotsTotal) + int(heartbeat.ExecutionSlotsTotal)
+			// A worker's self-reported slots are untrusted input; a stale or
+			// misbehaving one should not be able to drive the aggregate gauge
+			// negative, matching the same defensiveness as registry.go's own
+			// slot arithmetic.
+			if used < 0 {
+				used = 0
+			}
+			if max < 0 {
+				max = 0
+			}
+			usedSlots += used
+			maxSlots += max
+		}
+	}
+	return
+}
+
 func (s *AdminServer) collectMaintenanceMetrics() {
+	// Published before the maintenanceManager guard below: plugin workers are
+	// tracked independently of the maintenance manager.
+	workers, usedSlots, maxSlots := s.workerFleetTotals()
+	stats_collect.AdminWorkersConnected.Set(float64(workers))
+	stats_collect.AdminWorkerSlots.WithLabelValues("used").Set(float64(usedSlots))
+	stats_collect.AdminWorkerSlots.WithLabelValues("max").Set(float64(maxSlots))
+
 	if s.maintenanceManager == nil {
 		return
 	}
@@ -454,11 +525,6 @@ func (s *AdminServer) collectMaintenanceMetrics() {
 	} else {
 		stats_collect.AdminMaintenanceNextScanTimestampSeconds.Set(0)
 	}
-
-	workers, usedSlots, maxSlots := s.maintenanceManager.GetWorkerSlotTotals()
-	stats_collect.AdminWorkersConnected.Set(float64(workers))
-	stats_collect.AdminWorkerSlots.WithLabelValues("used").Set(float64(usedSlots))
-	stats_collect.AdminWorkerSlots.WithLabelValues("max").Set(float64(maxSlots))
 }
 
 // loadTaskConfigurationsFromPersistence loads saved task configurations from protobuf files
@@ -821,6 +887,7 @@ func (s *AdminServer) GetS3Buckets() ([]S3Bucket, error) {
 					Owner:                 owner,
 					LifecycleRuleCount:    lifecycleRuleCount,
 					LifecycleEnabledCount: lifecycleEnabledCount,
+					PolicyStatementCount:  extractPolicyStatementCountFromEntry(resp.Entry),
 				}
 				buckets = append(buckets, bucket)
 			}
@@ -926,6 +993,7 @@ func (s *AdminServer) GetBucketDetails(bucketName string) (*BucketDetails, error
 		details.Bucket.ObjectLockDuration = objectLockDuration
 		details.Bucket.Owner = owner
 		details.Bucket.LifecycleRuleCount, details.Bucket.LifecycleEnabledCount = extractLifecycleCountsFromEntry(bucketResp.Entry)
+		details.Bucket.PolicyStatementCount = extractPolicyStatementCountFromEntry(bucketResp.Entry)
 
 		return nil
 	})
@@ -999,6 +1067,134 @@ func toBucketLifecycleRule(rule *s3lifecycle.Rule) BucketLifecycleRule {
 	return out
 }
 
+// fromBucketLifecycleRule is the inverse of toBucketLifecycleRule, turning a
+// rule edited in the admin UI back into the engine's canonical shape.
+func fromBucketLifecycleRule(rule BucketLifecycleRule) (*s3lifecycle.Rule, error) {
+	out := &s3lifecycle.Rule{
+		ID:                              rule.ID,
+		Status:                          rule.Status,
+		Prefix:                          rule.Prefix,
+		FilterTags:                      rule.Tags,
+		FilterSizeGreaterThan:           rule.SizeGreaterThan,
+		FilterSizeLessThan:              rule.SizeLessThan,
+		ExpirationDays:                  rule.ExpirationDays,
+		ExpiredObjectDeleteMarker:       rule.ExpiredObjectDeleteMarker,
+		NoncurrentVersionExpirationDays: rule.NoncurrentVersionExpirationDays,
+		NewerNoncurrentVersions:         rule.NewerNoncurrentVersions,
+		AbortMPUDaysAfterInitiation:     rule.AbortMultipartDays,
+	}
+	if rule.ExpirationDate != "" {
+		date, err := time.Parse(time.DateOnly, rule.ExpirationDate)
+		if err != nil {
+			return nil, fmt.Errorf("invalid expiration date %q: %w", rule.ExpirationDate, err)
+		}
+		out.ExpirationDate = date
+	}
+	return out, nil
+}
+
+// ErrBucketNotFound reports that the named bucket has no filer entry, so a
+// handler can answer 404 rather than 500.
+var ErrBucketNotFound = errors.New("bucket not found")
+
+// SetBucketLifecycle replaces the lifecycle configuration stored on a
+// bucket's filer entry. An empty rule list clears the configuration
+// entirely, mirroring clearStoredBucketLifecycleConfiguration on the S3 API
+// side. Callers must validate rules before calling this (see
+// validateBucketLifecycleRules) — this only rejects what marshaling itself
+// rejects.
+func (s *AdminServer) SetBucketLifecycle(bucketName string, rules []BucketLifecycleRule) error {
+	canonicalRules := make([]*s3lifecycle.Rule, 0, len(rules))
+	for _, rule := range rules {
+		canonicalRule, err := fromBucketLifecycleRule(rule)
+		if err != nil {
+			return err
+		}
+		canonicalRules = append(canonicalRules, canonicalRule)
+	}
+
+	var lifecycleXML []byte
+	if len(canonicalRules) > 0 {
+		var err error
+		lifecycleXML, err = lifecycle_xml.MarshalCanonical(canonicalRules)
+		if err != nil {
+			return fmt.Errorf("marshal lifecycle configuration: %w", err)
+		}
+		if len(lifecycleXML) > scheduler.MaxBucketLifecycleConfigurationSize {
+			return fmt.Errorf("lifecycle configuration is %d bytes, which exceeds the %d byte limit", len(lifecycleXML), scheduler.MaxBucketLifecycleConfigurationSize)
+		}
+	}
+
+	filerConfig, err := s.getFilerConfig()
+	if err != nil {
+		return fmt.Errorf("get filer configuration: %w", err)
+	}
+	collection := getCollectionName(filerConfig.FilerGroup, bucketName)
+
+	return s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		// PATCH_EXTENDED is a no-op on a missing entry, so the existence
+		// check has to happen here rather than fall out of the write.
+		if _, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: filerConfig.BucketsPath,
+			Name:      bucketName,
+		}); err != nil {
+			if errors.Is(err, filer_pb.ErrNotFound) {
+				return fmt.Errorf("%w: %s", ErrBucketNotFound, bucketName)
+			}
+			return fmt.Errorf("look up bucket %s: %w", bucketName, err)
+		}
+
+		// Migration: clear any legacy day-TTL filer.conf entries before
+		// writing the new XML, so a failure here leaves the bucket entry
+		// untouched instead of committing the new policy alongside a stale
+		// TTL rule. Same step and ordering as
+		// PutBucketLifecycleConfigurationHandler.
+		if err := filer.ClearBucketLifecycleDayTTLs(context.Background(), client, filerConfig.BucketsPath, bucketName, collection); err != nil {
+			return fmt.Errorf("failed to clear legacy lifecycle TTLs: %w", err)
+		}
+
+		bucketPath := filerConfig.BucketsPath + "/" + bucketName
+		resp, err := client.ObjectTransaction(context.Background(), &filer_pb.ObjectTransactionRequest{
+			LockKey:   bucketPath,
+			RequestId: uuid.NewString(),
+			RouteKey:  s3_constants.ObjectWriteRouteKeyPrefix + bucketPath,
+			Mutations: []*filer_pb.ObjectMutation{bucketLifecycleMutation(filerConfig.BucketsPath, bucketName, lifecycleXML)},
+		})
+		if err != nil {
+			return fmt.Errorf("failed to update bucket lifecycle: %w", err)
+		}
+		if resp.Error != "" {
+			return fmt.Errorf("failed to update bucket lifecycle: %s", resp.Error)
+		}
+		return nil
+	})
+}
+
+// bucketLifecycleMutation patches the two lifecycle keys rather than writing
+// the whole entry back: the filer re-reads and merges under the bucket path
+// lock, so a concurrent owner/quota/versioning change is preserved instead of
+// being reverted by a stale snapshot. Same mutation the S3 gateway uses for
+// these keys (see patchBucketEntry in s3api_bucket_config.go). Empty XML
+// clears the configuration, transition minimum size included.
+func bucketLifecycleMutation(bucketsPath, bucketName string, lifecycleXML []byte) *filer_pb.ObjectMutation {
+	mutation := &filer_pb.ObjectMutation{
+		Type:      filer_pb.ObjectMutation_PATCH_EXTENDED,
+		Directory: bucketsPath,
+		Name:      bucketName,
+	}
+	if len(lifecycleXML) > 0 {
+		mutation.SetExtended = map[string][]byte{
+			scheduler.BucketLifecycleConfigurationXMLKey: lifecycleXML,
+		}
+		return mutation
+	}
+	mutation.DeleteExtended = []string{
+		scheduler.BucketLifecycleConfigurationXMLKey,
+		scheduler.BucketLifecycleTransitionMinimumObjectSizeKey,
+	}
+	return mutation
+}
+
 // CreateS3Bucket creates a new S3 bucket
 func (s *AdminServer) CreateS3Bucket(bucketName string) error {
 	return s.CreateS3BucketWithQuota(bucketName, 0, false)
@@ -1039,14 +1235,8 @@ func (s *AdminServer) DeleteS3Bucket(bucketName string) error {
 	// Then delete bucket directory recursively from filer
 	// Use same parameters as s3.bucket.delete shell command and S3 API
 	return s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		_, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-			Directory:            filerConfig.BucketsPath,
-			Name:                 bucketName,
-			IsDeleteData:         false, // Collection already deleted, just remove metadata
-			IsRecursive:          true,
-			IgnoreRecursiveError: true, // Same as S3 API and shell command
-		})
-		if err != nil {
+		// The collection is already gone, so this only has to drop the metadata.
+		if err := filer_pb.DoRemove(ctx, client, filerConfig.BucketsPath, bucketName, false, true, true, false, nil); err != nil {
 			return fmt.Errorf("failed to delete bucket: %w", err)
 		}
 
@@ -1153,16 +1343,21 @@ func (s *AdminServer) GetClusterMasters() (*ClusterMastersData, error) {
 	}
 
 	// Then, get additional master information from Raft cluster
+	raftReturnedEmpty := false
 	err = s.WithMasterClient(func(client master_pb.SeaweedClient) error {
 		resp, err := client.RaftListClusterServers(context.Background(), &master_pb.RaftListClusterServersRequest{})
 		if err != nil {
 			return err
 		}
+		raftReturnedEmpty = len(resp.ClusterServers) == 0
 
 		// Process each raft server
 		for _, server := range resp.ClusterServers {
 			// Raft stores gRPC addresses, convert to HTTP address
 			httpAddress := pb.GrpcAddressToServerAddress(server.Address)
+			if httpAddress == "" {
+				continue
+			}
 
 			// Update existing master info or create new one
 			if masterInfo, exists := masterMap[httpAddress]; exists {
@@ -1210,10 +1405,12 @@ func (s *AdminServer) GetClusterMasters() (*ClusterMastersData, error) {
 		if currentMaster != "" {
 			masters = append(masters, MasterInfo{
 				Address:  pb.ServerAddress(currentMaster).ToHttpAddress(),
-				IsLeader: true,
+				IsLeader: raftReturnedEmpty,
 				Suffrage: "Voter",
 			})
-			leaderCount = 1
+			if raftReturnedEmpty {
+				leaderCount = 1
+			}
 		}
 	}
 
@@ -1359,6 +1556,32 @@ func (s *AdminServer) GetClusterS3Servers() (*ClusterS3ServersData, error) {
 	}, nil
 }
 
+// GetS3Endpoint returns the configured address clients reach the S3 gateway
+// at, or "". S3 servers register only their gRPC address with the master, so
+// the client-facing address cannot be discovered and must be configured.
+func (s *AdminServer) GetS3Endpoint() string {
+	return s.s3PublicEndpoint
+}
+
+// normalizeS3PublicEndpoint trims a trailing slash and drops, with a warning,
+// a value that is not a plain absolute http or https URL, so the file browser
+// hides its URL actions instead of copying broken links. Checking the string
+// for "?" and "#" rather than the parsed query and fragment also catches
+// delimiters with nothing after them, which url.Parse stores as empty.
+func normalizeS3PublicEndpoint(endpoint string) string {
+	endpoint = strings.TrimRight(endpoint, "/")
+	if endpoint == "" {
+		return ""
+	}
+	u, err := url.Parse(endpoint)
+	if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" || u.User != nil || strings.ContainsAny(endpoint, "?#") {
+		// the value is not echoed: it may hold credentials in userinfo or a query
+		glog.Warningf("ignoring s3.public_endpoint: expecting an http:// or https:// URL with a host and no credentials, query, or fragment")
+		return ""
+	}
+	return endpoint
+}
+
 // GetAllFilers method moved to client_management.go
 
 // GetVolumeDetails method moved to volume_management.go
@@ -1385,6 +1608,7 @@ func (as *AdminServer) GetConfigInfo(w http.ResponseWriter, r *http.Request) {
 	configInfo["master_address"] = string(currentMaster)
 	configInfo["cache_expiration"] = as.cacheExpiration.String()
 	configInfo["filer_cache_expiration"] = as.filerCacheExpiration.String()
+	configInfo["s3_public_endpoint"] = as.s3PublicEndpoint
 
 	// Add maintenance system info
 	if as.maintenanceManager != nil {
@@ -1401,14 +1625,29 @@ func (as *AdminServer) GetConfigInfo(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
-// StartWorkerGrpcServer starts the worker gRPC server
-func (s *AdminServer) StartWorkerGrpcServer(grpcPort int) error {
+// StartWorkerGrpcServer starts the worker gRPC server. bindIp is honored when no
+// listener is supplied so the worker gRPC does not wildcard-bind past -ip.
+func (s *AdminServer) StartWorkerGrpcServer(bindIp string, grpcPort int, listener net.Listener) error {
 	if s.workerGrpcServer != nil {
 		return fmt.Errorf("worker gRPC server is already running")
 	}
 
 	s.workerGrpcServer = NewWorkerGrpcServer(s)
-	return s.workerGrpcServer.StartWithTLS(grpcPort)
+	return s.workerGrpcServer.StartWithTLS(bindIp, grpcPort, listener)
+}
+
+// WorkerGrpcMTLSEnabled reports whether the worker gRPC server actually loaded
+// grpc.admin mTLS credentials, not just whether they were configured.
+func (s *AdminServer) WorkerGrpcMTLSEnabled() bool {
+	return s.workerGrpcServer != nil && s.workerGrpcServer.mtlsEnabled
+}
+
+// ServeWorkerGrpcOn serves the worker gRPC API on an additional already-bound
+// listener, e.g. a legacy compat port kept for backward compatibility.
+func (s *AdminServer) ServeWorkerGrpcOn(listener net.Listener) {
+	if s.workerGrpcServer != nil {
+		s.workerGrpcServer.ServeOn(listener)
+	}
 }
 
 // StopWorkerGrpcServer stops the worker gRPC server
@@ -1650,7 +1889,16 @@ func (s *AdminServer) ListPluginSchedulerStates() ([]adminplugin.SchedulerJobTyp
 
 // InitMaintenanceManager initializes the maintenance manager
 func (s *AdminServer) InitMaintenanceManager(config *maintenance.MaintenanceConfig) {
-	s.maintenanceManager = maintenance.NewMaintenanceManager(s, config)
+	// Hand the real config store to the manager so that, if it has to build the maintenance policy
+	// itself, it reads the persisted task configs instead of compiled-in defaults. Only pass it when
+	// a data directory is actually configured: an unconfigured store has nothing to read, and a typed
+	// nil pointer would satisfy the loaders' type assertion and then panic on use.
+	var configPersistence interface{}
+	if s.configPersistence != nil && s.configPersistence.IsConfigured() {
+		configPersistence = s.configPersistence
+	}
+
+	s.maintenanceManager = maintenance.NewMaintenanceManager(s, config, configPersistence)
 
 	// Set up task persistence if config persistence is available
 	if s.configPersistence != nil {
@@ -1665,7 +1913,7 @@ func (s *AdminServer) InitMaintenanceManager(config *maintenance.MaintenanceConf
 		}
 	}
 
-	glog.V(1).Infof("Maintenance manager initialized (enabled: %v)", config.Enabled)
+	glog.V(1).Infof("Maintenance manager initialized (enabled: %v)", config.GetEnabled())
 }
 
 // GetMaintenanceManager returns the maintenance manager
@@ -1903,6 +2151,21 @@ func extractLifecycleCountsFromEntry(entry *filer_pb.Entry) (ruleCount, enabledC
 	return
 }
 
+// extractPolicyStatementCountFromEntry returns the number of statements in
+// the bucket's policy, or 0 if it has none or the stored JSON can't be
+// parsed. Forgiving on parse failure, same as extractLifecycleCountsFromEntry.
+func extractPolicyStatementCountFromEntry(entry *filer_pb.Entry) int {
+	policyJSON := entry.Extended[s3api.BUCKET_POLICY_METADATA_KEY]
+	if len(policyJSON) == 0 {
+		return 0
+	}
+	var doc policy_engine.PolicyDocument
+	if err := json.Unmarshal(policyJSON, &doc); err != nil {
+		return 0
+	}
+	return len(doc.Statement)
+}
+
 // GetConfigPersistence returns the config persistence manager
 func (as *AdminServer) GetConfigPersistence() *ConfigPersistence {
 	return as.configPersistence
@@ -2050,7 +2313,7 @@ func (s *AdminServer) getCollectionStats() (map[string]collectionStats, error) {
 	}
 
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
diff --git a/weed/admin/dash/auth_middleware.go b/weed/admin/dash/auth_middleware.go
index d2c3ee5955..c3b039c61c 100644
--- a/weed/admin/dash/auth_middleware.go
+++ b/weed/admin/dash/auth_middleware.go
@@ -44,7 +44,7 @@ func (s *AdminServer) HandleLogin(store sessions.Store, adminUser, adminPassword
 			authenticated = true
 		} else if readOnlyPassword != "" && loginUsername == readOnlyUser && subtle.ConstantTimeCompare([]byte(loginPassword), []byte(readOnlyPassword)) == 1 {
 			// Check read-only credentials.
-			role = "readonly"
+			role = RoleReadOnly
 			authenticated = true
 		}
 
diff --git a/weed/admin/dash/bucket_lifecycle_test.go b/weed/admin/dash/bucket_lifecycle_test.go
new file mode 100644
index 0000000000..63cc9c1cb2
--- /dev/null
+++ b/weed/admin/dash/bucket_lifecycle_test.go
@@ -0,0 +1,350 @@
+package dash
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/scheduler"
+)
+
+func minimalLifecycleRule() BucketLifecycleRule {
+	return BucketLifecycleRule{
+		ID:             "rule-1",
+		Status:         s3lifecycle.StatusEnabled,
+		ExpirationDays: 30,
+	}
+}
+
+func TestValidateBucketLifecycleRules_Valid(t *testing.T) {
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{minimalLifecycleRule()}); err != nil {
+		t.Fatalf("expected valid rule set to pass, got: %v", err)
+	}
+}
+
+func TestValidateBucketLifecycleRules_Empty(t *testing.T) {
+	if err := validateBucketLifecycleRules(nil); err != nil {
+		t.Fatalf("expected empty rule set to pass, got: %v", err)
+	}
+}
+
+func TestValidateBucketLifecycleRules_TooManyRules(t *testing.T) {
+	rules := make([]BucketLifecycleRule, MaxBucketLifecycleRules+1)
+	for i := range rules {
+		rules[i] = BucketLifecycleRule{Status: s3lifecycle.StatusEnabled, ExpirationDays: 30}
+	}
+	if err := validateBucketLifecycleRules(rules); err == nil {
+		t.Fatal("expected error for exceeding the rule count cap")
+	}
+}
+
+func TestValidateBucketLifecycleRules_DuplicateIDs(t *testing.T) {
+	rule := minimalLifecycleRule()
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule, rule}); err == nil {
+		t.Fatal("expected error for duplicate rule IDs")
+	}
+}
+
+func TestValidateBucketLifecycleRules_IDTooLong(t *testing.T) {
+	rule := minimalLifecycleRule()
+	longID := ""
+	for i := 0; i < MaxBucketLifecycleRuleIDLength+1; i++ {
+		longID += "a"
+	}
+	rule.ID = longID
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for an ID longer than the cap")
+	}
+}
+
+func TestValidateBucketLifecycleRules_InvalidStatus(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.Status = "sort-of-enabled"
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for an invalid status")
+	}
+}
+
+func TestValidateBucketLifecycleRules_ExpirationDaysAndDateMutuallyExclusive(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.ExpirationDate = "2030-01-01"
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error when both expiration_days and expiration_date are set")
+	}
+}
+
+func TestValidateBucketLifecycleRules_DeleteMarkerWithExpirationDaysRejected(t *testing.T) {
+	// AWS forbids combining ExpiredObjectDeleteMarker with Days/Date in the
+	// same Expiration element; ruleFromCanonical would otherwise emit both
+	// on the same <Expiration>.
+	rule := minimalLifecycleRule()
+	rule.ExpiredObjectDeleteMarker = true
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error when expired_object_delete_marker is combined with expiration_days")
+	}
+}
+
+func TestValidateBucketLifecycleRules_DeleteMarkerWithExpirationDateRejected(t *testing.T) {
+	rule := BucketLifecycleRule{
+		Status:                    s3lifecycle.StatusEnabled,
+		ExpirationDate:            "2030-01-01",
+		ExpiredObjectDeleteMarker: true,
+	}
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error when expired_object_delete_marker is combined with expiration_date")
+	}
+}
+
+func TestValidateBucketLifecycleRules_DeleteMarkerAlone(t *testing.T) {
+	rule := BucketLifecycleRule{
+		Status:                    s3lifecycle.StatusEnabled,
+		ExpiredObjectDeleteMarker: true,
+	}
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err != nil {
+		t.Fatalf("expected standalone expired_object_delete_marker to be accepted, got: %v", err)
+	}
+}
+
+func TestValidateBucketLifecycleRules_InvalidExpirationDate(t *testing.T) {
+	rule := BucketLifecycleRule{Status: s3lifecycle.StatusEnabled, ExpirationDate: "01/01/2030"}
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for a malformed expiration_date")
+	}
+}
+
+func TestValidateBucketLifecycleRules_NegativeExpirationDays(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.ExpirationDays = -1
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for negative expiration_days")
+	}
+}
+
+// TestValidateBucketLifecycleRules_StandaloneNewerNoncurrentVersions guards
+// against re-adding a NoncurrentVersionExpirationDays requirement:
+// s3lifecycle.RuleActionKinds recognizes a standalone NewerNoncurrentVersions
+// (no days) as ActionKindNewerNoncurrent, a valid count-only retention rule
+// the S3 API already accepts and stores.
+func TestValidateBucketLifecycleRules_StandaloneNewerNoncurrentVersions(t *testing.T) {
+	rule := BucketLifecycleRule{
+		Status:                  s3lifecycle.StatusEnabled,
+		NewerNoncurrentVersions: 2,
+	}
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err != nil {
+		t.Fatalf("expected standalone newer_noncurrent_versions to be accepted, got: %v", err)
+	}
+}
+
+func TestValidateBucketLifecycleRules_NegativeAbortMultipartDays(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.AbortMultipartDays = -5
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for negative abort_multipart_days")
+	}
+}
+
+func TestValidateBucketLifecycleRules_SizeGreaterThanNotLessThanSizeLessThan(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.SizeGreaterThan = 2048
+	rule.SizeLessThan = 1024
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error when size_greater_than >= size_less_than")
+	}
+}
+
+func TestValidateBucketLifecycleRules_NegativeSizeBounds(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.SizeGreaterThan = -1
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for a negative size_greater_than")
+	}
+}
+
+func TestValidateBucketLifecycleRules_EmptyTagKey(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.Tags = map[string]string{"": "value"}
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for an empty tag key")
+	}
+}
+
+func TestValidateBucketLifecycleRules_EmptyTagValue(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.Tags = map[string]string{"env": " "}
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for a blank tag value")
+	}
+}
+
+func TestValidateBucketLifecycleRules_NoAction(t *testing.T) {
+	rule := BucketLifecycleRule{Status: s3lifecycle.StatusEnabled, Prefix: "logs/"}
+	if err := validateBucketLifecycleRules([]BucketLifecycleRule{rule}); err == nil {
+		t.Fatal("expected error for a rule with no action")
+	}
+}
+
+func TestFromBucketLifecycleRule_MapsAllFields(t *testing.T) {
+	rule := BucketLifecycleRule{
+		ID:                              "rule-1",
+		Status:                          s3lifecycle.StatusEnabled,
+		Prefix:                          "logs/",
+		Tags:                            map[string]string{"env": "dev"},
+		SizeGreaterThan:                 1024,
+		SizeLessThan:                    2048,
+		ExpirationDate:                  "2030-01-15",
+		ExpiredObjectDeleteMarker:       true,
+		NoncurrentVersionExpirationDays: 30,
+		NewerNoncurrentVersions:         2,
+		AbortMultipartDays:              7,
+	}
+
+	out, err := fromBucketLifecycleRule(rule)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if out.ID != rule.ID {
+		t.Errorf("ID = %q, want %q", out.ID, rule.ID)
+	}
+	if out.Status != rule.Status {
+		t.Errorf("Status = %q, want %q", out.Status, rule.Status)
+	}
+	if out.Prefix != rule.Prefix {
+		t.Errorf("Prefix = %q, want %q", out.Prefix, rule.Prefix)
+	}
+	if len(out.FilterTags) != 1 || out.FilterTags["env"] != "dev" {
+		t.Errorf("FilterTags = %v, want {env: dev}", out.FilterTags)
+	}
+	if out.FilterSizeGreaterThan != rule.SizeGreaterThan {
+		t.Errorf("FilterSizeGreaterThan = %d, want %d", out.FilterSizeGreaterThan, rule.SizeGreaterThan)
+	}
+	if out.FilterSizeLessThan != rule.SizeLessThan {
+		t.Errorf("FilterSizeLessThan = %d, want %d", out.FilterSizeLessThan, rule.SizeLessThan)
+	}
+	wantDate, _ := time.Parse(time.DateOnly, rule.ExpirationDate)
+	if !out.ExpirationDate.Equal(wantDate) {
+		t.Errorf("ExpirationDate = %v, want %v", out.ExpirationDate, wantDate)
+	}
+	if !out.ExpiredObjectDeleteMarker {
+		t.Error("expected ExpiredObjectDeleteMarker=true")
+	}
+	if out.NoncurrentVersionExpirationDays != rule.NoncurrentVersionExpirationDays {
+		t.Errorf("NoncurrentVersionExpirationDays = %d, want %d", out.NoncurrentVersionExpirationDays, rule.NoncurrentVersionExpirationDays)
+	}
+	if out.NewerNoncurrentVersions != rule.NewerNoncurrentVersions {
+		t.Errorf("NewerNoncurrentVersions = %d, want %d", out.NewerNoncurrentVersions, rule.NewerNoncurrentVersions)
+	}
+	if out.AbortMPUDaysAfterInitiation != rule.AbortMultipartDays {
+		t.Errorf("AbortMPUDaysAfterInitiation = %d, want %d", out.AbortMPUDaysAfterInitiation, rule.AbortMultipartDays)
+	}
+}
+
+func TestFromBucketLifecycleRule_EmptyExpirationDate(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.ExpirationDate = ""
+
+	out, err := fromBucketLifecycleRule(rule)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !out.ExpirationDate.IsZero() {
+		t.Errorf("expected zero ExpirationDate, got %v", out.ExpirationDate)
+	}
+}
+
+func TestFromBucketLifecycleRule_InvalidExpirationDate(t *testing.T) {
+	rule := minimalLifecycleRule()
+	rule.ExpirationDate = "not-a-date"
+
+	if _, err := fromBucketLifecycleRule(rule); err == nil {
+		t.Fatal("expected error for a malformed expiration date")
+	}
+}
+
+func TestBucketLifecycleMutation_SetsXML(t *testing.T) {
+	m := bucketLifecycleMutation("/buckets", "mybucket", []byte("<LifecycleConfiguration/>"))
+
+	if m.Type != filer_pb.ObjectMutation_PATCH_EXTENDED {
+		t.Fatalf("expected a PATCH_EXTENDED mutation, got %v", m.Type)
+	}
+	if m.Directory != "/buckets" || m.Name != "mybucket" {
+		t.Fatalf("expected the mutation to target /buckets/mybucket, got %s/%s", m.Directory, m.Name)
+	}
+	if got := string(m.SetExtended[scheduler.BucketLifecycleConfigurationXMLKey]); got != "<LifecycleConfiguration/>" {
+		t.Fatalf("expected the XML key to carry the marshaled config, got %q", got)
+	}
+	if len(m.DeleteExtended) != 0 {
+		t.Fatalf("expected no key deletions when saving rules, got %v", m.DeleteExtended)
+	}
+}
+
+func TestBucketLifecycleMutation_ClearsBothKeys(t *testing.T) {
+	m := bucketLifecycleMutation("/buckets", "mybucket", nil)
+
+	if len(m.SetExtended) != 0 {
+		t.Fatalf("expected no key writes when clearing, got %v", m.SetExtended)
+	}
+	want := map[string]bool{
+		scheduler.BucketLifecycleConfigurationXMLKey:            true,
+		scheduler.BucketLifecycleTransitionMinimumObjectSizeKey: true,
+	}
+	if len(m.DeleteExtended) != len(want) {
+		t.Fatalf("expected both lifecycle keys to be cleared, got %v", m.DeleteExtended)
+	}
+	for _, k := range m.DeleteExtended {
+		if !want[k] {
+			t.Fatalf("unexpected key cleared: %s", k)
+		}
+	}
+}
+
+// A whole-entry write would have carried the rest of the bucket entry with it;
+// the patch must name only the keys it owns, so a concurrent owner or quota
+// change survives.
+func TestBucketLifecycleMutation_TouchesOnlyLifecycleKeys(t *testing.T) {
+	for _, m := range []*filer_pb.ObjectMutation{
+		bucketLifecycleMutation("/buckets", "mybucket", []byte("<LifecycleConfiguration/>")),
+		bucketLifecycleMutation("/buckets", "mybucket", nil),
+	} {
+		if m.Entry != nil {
+			t.Fatal("expected the mutation to carry no entry snapshot")
+		}
+		if m.SetContent {
+			t.Fatal("expected the mutation to leave entry content alone")
+		}
+		for k := range m.SetExtended {
+			if k != scheduler.BucketLifecycleConfigurationXMLKey {
+				t.Fatalf("unexpected key written: %s", k)
+			}
+		}
+	}
+}
+
+func TestSetBucketLifecycle_RejectsOversizedConfiguration(t *testing.T) {
+	// A single rule ID long enough to blow the cap: this must fail before any
+	// filer call, which is what makes it testable without one.
+	rule := minimalLifecycleRule()
+	rule.ID = strings.Repeat("x", scheduler.MaxBucketLifecycleConfigurationSize+1)
+
+	err := (&AdminServer{}).SetBucketLifecycle("mybucket", []BucketLifecycleRule{rule})
+	if err == nil {
+		t.Fatal("expected an oversized lifecycle configuration to be rejected")
+	}
+	if !strings.Contains(err.Error(), "exceeds") {
+		t.Fatalf("expected a size-limit error, got: %v", err)
+	}
+}
+
+func TestBucketLifecycleErrorStatus(t *testing.T) {
+	if got := bucketLifecycleErrorStatus(fmt.Errorf("%w: mybucket", ErrBucketNotFound)); got != http.StatusNotFound {
+		t.Fatalf("expected a missing bucket to map to 404, got %d", got)
+	}
+	if got := bucketLifecycleErrorStatus(errors.New("filer unreachable")); got != http.StatusInternalServerError {
+		t.Fatalf("expected an unrelated failure to stay 500, got %d", got)
+	}
+}
diff --git a/weed/admin/dash/bucket_management.go b/weed/admin/dash/bucket_management.go
index b68d764bf7..a799964d01 100644
--- a/weed/admin/dash/bucket_management.go
+++ b/weed/admin/dash/bucket_management.go
@@ -2,6 +2,7 @@ package dash
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"os"
@@ -12,9 +13,17 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
 )
 
+// MaxBucketLifecycleRules mirrors AWS S3's limit of 1000 lifecycle rules per bucket.
+const MaxBucketLifecycleRules = 1000
+
+// MaxBucketLifecycleRuleIDLength mirrors the S3 API's limit on a lifecycle rule's <ID>.
+const MaxBucketLifecycleRuleIDLength = 255
+
 // MaxOwnerNameLength is the maximum allowed length for bucket owner identity names.
 // This is a reasonable limit to prevent abuse; AWS IAM user names are limited to 64 chars,
 // but we use 256 to allow for more complex identity formats (e.g., email addresses).
@@ -102,6 +111,253 @@ func (s *AdminServer) ShowBucketLifecycle(w http.ResponseWriter, r *http.Request
 	writeJSON(w, http.StatusOK, lifecycle)
 }
 
+// UpdateBucketLifecycle replaces the entire lifecycle configuration for a bucket.
+func (s *AdminServer) UpdateBucketLifecycle(w http.ResponseWriter, r *http.Request) {
+	if !requireSessionCSRFToken(w, r) {
+		return
+	}
+
+	bucketName := mux.Vars(r)["bucket"]
+	if bucketName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Bucket name is required")
+		return
+	}
+
+	var req struct {
+		Rules []BucketLifecycleRule `json:"rules"`
+	}
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+
+	if err := validateBucketLifecycleRules(req.Rules); err != nil {
+		writeJSONError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	if err := s.SetBucketLifecycle(bucketName, req.Rules); err != nil {
+		writeJSONError(w, bucketLifecycleErrorStatus(err), "Failed to update bucket lifecycle: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Bucket lifecycle updated successfully",
+		"bucket":  bucketName,
+	})
+}
+
+// DeleteBucketLifecycle clears the entire lifecycle configuration for a bucket.
+func (s *AdminServer) DeleteBucketLifecycle(w http.ResponseWriter, r *http.Request) {
+	if !requireSessionCSRFToken(w, r) {
+		return
+	}
+
+	bucketName := mux.Vars(r)["bucket"]
+	if bucketName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Bucket name is required")
+		return
+	}
+
+	if err := s.SetBucketLifecycle(bucketName, nil); err != nil {
+		writeJSONError(w, bucketLifecycleErrorStatus(err), "Failed to delete bucket lifecycle: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Bucket lifecycle deleted successfully",
+		"bucket":  bucketName,
+	})
+}
+
+// bucketLifecycleErrorStatus keeps a request for a bucket that does not exist
+// out of the 5xx bucket, where a client would retry it.
+func bucketLifecycleErrorStatus(err error) int {
+	if errors.Is(err, ErrBucketNotFound) {
+		return http.StatusNotFound
+	}
+	return http.StatusInternalServerError
+}
+
+// validateBucketLifecycleRules rejects a rule set before any write is
+// attempted, so a malformed PUT can't half-apply. Mirrors the constraints
+// AWS enforces on PutBucketLifecycleConfiguration plus the local rule cap.
+func validateBucketLifecycleRules(rules []BucketLifecycleRule) error {
+	if len(rules) > MaxBucketLifecycleRules {
+		return fmt.Errorf("a bucket may have at most %d lifecycle rules, got %d", MaxBucketLifecycleRules, len(rules))
+	}
+
+	seenIDs := make(map[string]bool, len(rules))
+	for i, rule := range rules {
+		label := fmt.Sprintf("rule %d", i+1)
+		if rule.ID != "" {
+			label = fmt.Sprintf("rule %q", rule.ID)
+			if len(rule.ID) > MaxBucketLifecycleRuleIDLength {
+				return fmt.Errorf("%s: ID must be %d characters or less", label, MaxBucketLifecycleRuleIDLength)
+			}
+			if seenIDs[rule.ID] {
+				return fmt.Errorf("duplicate rule ID %q", rule.ID)
+			}
+			seenIDs[rule.ID] = true
+		}
+
+		switch rule.Status {
+		case s3lifecycle.StatusEnabled, s3lifecycle.StatusDisabled:
+		default:
+			return fmt.Errorf("%s: status must be %q or %q, got %q", label, s3lifecycle.StatusEnabled, s3lifecycle.StatusDisabled, rule.Status)
+		}
+
+		if rule.ExpirationDays > 0 && rule.ExpirationDate != "" {
+			return fmt.Errorf("%s: expiration_days and expiration_date are mutually exclusive", label)
+		}
+		if rule.ExpirationDays < 0 {
+			return fmt.Errorf("%s: expiration_days must be positive", label)
+		}
+		if rule.ExpirationDate != "" {
+			if _, err := time.Parse(time.DateOnly, rule.ExpirationDate); err != nil {
+				return fmt.Errorf("%s: invalid expiration_date %q, expected YYYY-MM-DD", label, rule.ExpirationDate)
+			}
+		}
+		if rule.ExpiredObjectDeleteMarker && (rule.ExpirationDays > 0 || rule.ExpirationDate != "") {
+			return fmt.Errorf("%s: expired_object_delete_marker cannot be combined with expiration_days or expiration_date", label)
+		}
+
+		if rule.NoncurrentVersionExpirationDays < 0 {
+			return fmt.Errorf("%s: noncurrent_version_expiration_days must be positive", label)
+		}
+		if rule.NewerNoncurrentVersions < 0 {
+			return fmt.Errorf("%s: newer_noncurrent_versions must be positive", label)
+		}
+		if rule.AbortMultipartDays < 0 {
+			return fmt.Errorf("%s: abort_multipart_days must be positive", label)
+		}
+
+		if rule.SizeGreaterThan < 0 || rule.SizeLessThan < 0 {
+			return fmt.Errorf("%s: size_greater_than and size_less_than must be positive", label)
+		}
+		if rule.SizeGreaterThan > 0 && rule.SizeLessThan > 0 && rule.SizeGreaterThan >= rule.SizeLessThan {
+			return fmt.Errorf("%s: size_greater_than must be less than size_less_than", label)
+		}
+
+		for k, v := range rule.Tags {
+			if strings.TrimSpace(k) == "" {
+				return fmt.Errorf("%s: tag keys must not be empty", label)
+			}
+			if strings.TrimSpace(v) == "" {
+				return fmt.Errorf("%s: tag value for key %q must not be empty", label, k)
+			}
+		}
+
+		hasAction := rule.ExpirationDays > 0 || rule.ExpirationDate != "" || rule.ExpiredObjectDeleteMarker ||
+			rule.NoncurrentVersionExpirationDays > 0 || rule.NewerNoncurrentVersions > 0 || rule.AbortMultipartDays > 0
+		if !hasAction {
+			return fmt.Errorf("%s: must specify at least one action (expiration, noncurrent version expiration, or abort incomplete multipart upload)", label)
+		}
+	}
+
+	return nil
+}
+
+// ShowBucketPolicy returns the policy document for a specific bucket, or
+// {"bucket": ..., "policy": null} if the bucket has none.
+func (s *AdminServer) ShowBucketPolicy(w http.ResponseWriter, r *http.Request) {
+	bucketName := mux.Vars(r)["bucket"]
+	if bucketName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Bucket name is required")
+		return
+	}
+
+	policy, raw, err := s.GetBucketPolicy(bucketName)
+	if err != nil {
+		writeJSONError(w, bucketPolicyErrorStatus(err), "Failed to get bucket policy: "+err.Error())
+		return
+	}
+
+	resp := map[string]interface{}{
+		"bucket": bucketName,
+		"policy": policy,
+	}
+	if policy == nil && len(raw) > 0 {
+		// Stored bytes the decoder rejects: hand them to the JSON tab so
+		// the operator can fix or delete the document.
+		resp["policy_text"] = string(raw)
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// UpdateBucketPolicy replaces the bucket policy for a bucket.
+func (s *AdminServer) UpdateBucketPolicy(w http.ResponseWriter, r *http.Request) {
+	if !requireSessionCSRFToken(w, r) {
+		return
+	}
+
+	bucketName := mux.Vars(r)["bucket"]
+	if bucketName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Bucket name is required")
+		return
+	}
+
+	var req struct {
+		Policy *policy_engine.PolicyDocument `json:"policy"`
+	}
+	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
+		return
+	}
+	if req.Policy == nil {
+		writeJSONError(w, http.StatusBadRequest, "policy is required; use DELETE to clear a bucket policy")
+		return
+	}
+
+	if err := s.SetBucketPolicy(bucketName, req.Policy); err != nil {
+		writeJSONError(w, bucketPolicyErrorStatus(err), "Failed to update bucket policy: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Bucket policy updated successfully",
+		"bucket":  bucketName,
+	})
+}
+
+// RemoveBucketPolicy clears the bucket policy for a bucket. Named
+// "Remove", not "Delete", because (*AdminServer).DeleteBucketPolicy is the
+// data-layer method this handler calls.
+func (s *AdminServer) RemoveBucketPolicy(w http.ResponseWriter, r *http.Request) {
+	if !requireSessionCSRFToken(w, r) {
+		return
+	}
+
+	bucketName := mux.Vars(r)["bucket"]
+	if bucketName == "" {
+		writeJSONError(w, http.StatusBadRequest, "Bucket name is required")
+		return
+	}
+
+	if err := s.DeleteBucketPolicy(bucketName); err != nil {
+		writeJSONError(w, bucketPolicyErrorStatus(err), "Failed to delete bucket policy: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message": "Bucket policy deleted successfully",
+		"bucket":  bucketName,
+	})
+}
+
+// bucketPolicyErrorStatus keeps a request for a bucket that does not exist,
+// or an invalid policy document, out of the 5xx bucket where a client
+// would retry it. Mirrors bucketLifecycleErrorStatus.
+func bucketPolicyErrorStatus(err error) int {
+	if errors.Is(err, ErrBucketNotFound) {
+		return http.StatusNotFound
+	}
+	if errors.Is(err, ErrInvalidBucketPolicy) {
+		return http.StatusBadRequest
+	}
+	return http.StatusInternalServerError
+}
+
 // CreateBucket creates a new S3 bucket
 func (s *AdminServer) CreateBucket(w http.ResponseWriter, r *http.Request) {
 	var req CreateBucketRequest
diff --git a/weed/admin/dash/bucket_policy.go b/weed/admin/dash/bucket_policy.go
new file mode 100644
index 0000000000..ebc1b397a3
--- /dev/null
+++ b/weed/admin/dash/bucket_policy.go
@@ -0,0 +1,163 @@
+package dash
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+// ErrInvalidBucketPolicy wraps a validation failure from SetBucketPolicy so
+// callers (the HTTP handler) can map it to 400 instead of 500 without
+// resorting to matching on the error string.
+var ErrInvalidBucketPolicy = errors.New("invalid bucket policy")
+
+// GetBucketPolicy returns the policy document stored on a bucket's filer
+// entry, or (nil, nil, nil) if the bucket has no policy — that is not an
+// error, it just means the caller (e.g. the admin UI) should show an empty
+// editor instead of special-casing a 404. Stored bytes the current decoder
+// rejects come back as (nil, raw, nil): a 500 here would leave the UI
+// unable to show, fix, or even delete the one policy an operator most
+// needs to remove — and DeleteBucketPolicy never reads the document.
+func (s *AdminServer) GetBucketPolicy(bucketName string) (*policy_engine.PolicyDocument, []byte, error) {
+	filerConfig, err := s.getFilerConfig()
+	if err != nil {
+		return nil, nil, fmt.Errorf("get filer configuration: %w", err)
+	}
+
+	var doc *policy_engine.PolicyDocument
+	var raw []byte
+	err = s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: filerConfig.BucketsPath,
+			Name:      bucketName,
+		})
+		if err != nil {
+			if errors.Is(err, filer_pb.ErrNotFound) {
+				return fmt.Errorf("%w: %s", ErrBucketNotFound, bucketName)
+			}
+			return fmt.Errorf("look up bucket %s: %w", bucketName, err)
+		}
+
+		policyJSON := resp.Entry.Extended[s3api.BUCKET_POLICY_METADATA_KEY]
+		if len(policyJSON) == 0 {
+			return nil
+		}
+		raw = policyJSON
+
+		var parsed policy_engine.PolicyDocument
+		if err := json.Unmarshal(policyJSON, &parsed); err == nil {
+			doc = &parsed
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return doc, raw, nil
+}
+
+// SetBucketPolicy validates and stores a bucket policy, applying the exact
+// same validation the S3 gateway's PutBucketPolicy enforces
+// (policy_engine.ValidatePolicy + policy_engine.ValidateBucketPolicy), so
+// the admin UI and the S3 API never disagree about what's a valid policy.
+//
+// Propagation to every S3 gateway is automatic: writing the
+// s3-bucket-policy extended attribute drives the filer metadata log, which
+// each gateway's onBucketMetadataChange subscription watches to rebuild its
+// bucket policy cache and to maintain the advanced-IAM
+// "bucket-policy:<bucket>" mirror (mirrorBucketPolicyToIAM in
+// weed/s3api/s3api_bucket_policy_handlers.go). No separate notify step is
+// needed here.
+func (s *AdminServer) SetBucketPolicy(bucketName string, doc *policy_engine.PolicyDocument) error {
+	if err := policy_engine.ValidatePolicy(doc); err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidBucketPolicy, err)
+	}
+	if err := policy_engine.ValidateBucketPolicy(doc, bucketName); err != nil {
+		return fmt.Errorf("%w: %w", ErrInvalidBucketPolicy, err)
+	}
+
+	policyJSON, err := json.Marshal(doc)
+	if err != nil {
+		return fmt.Errorf("marshal policy document: %w", err)
+	}
+	if len(policyJSON) > policy_engine.MaxBucketPolicySize {
+		return fmt.Errorf("%w: bucket policy is %d bytes, which exceeds the %d byte limit", ErrInvalidBucketPolicy, len(policyJSON), policy_engine.MaxBucketPolicySize)
+	}
+
+	return s.writeBucketPolicy(bucketName, policyJSON)
+}
+
+// DeleteBucketPolicy clears the bucket policy stored on a bucket's filer
+// entry. Deleting a policy that doesn't exist is a success, matching
+// DeleteBucketLifecycle's idempotent behavior. This cannot go through
+// SetBucketPolicy: validation there rejects a nil document.
+func (s *AdminServer) DeleteBucketPolicy(bucketName string) error {
+	return s.writeBucketPolicy(bucketName, nil)
+}
+
+// writeBucketPolicy patches the policy key on the bucket's filer entry; a
+// nil policyJSON clears it.
+func (s *AdminServer) writeBucketPolicy(bucketName string, policyJSON []byte) error {
+	filerConfig, err := s.getFilerConfig()
+	if err != nil {
+		return fmt.Errorf("get filer configuration: %w", err)
+	}
+
+	return s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		// PATCH_EXTENDED is a no-op on a missing entry, so the existence
+		// check has to happen here rather than fall out of the write.
+		if _, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: filerConfig.BucketsPath,
+			Name:      bucketName,
+		}); err != nil {
+			if errors.Is(err, filer_pb.ErrNotFound) {
+				return fmt.Errorf("%w: %s", ErrBucketNotFound, bucketName)
+			}
+			return fmt.Errorf("look up bucket %s: %w", bucketName, err)
+		}
+
+		bucketPath := filerConfig.BucketsPath + "/" + bucketName
+		resp, err := client.ObjectTransaction(context.Background(), &filer_pb.ObjectTransactionRequest{
+			LockKey:   bucketPath,
+			RequestId: uuid.NewString(),
+			RouteKey:  s3_constants.ObjectWriteRouteKeyPrefix + bucketPath,
+			Mutations: []*filer_pb.ObjectMutation{bucketPolicyMutation(filerConfig.BucketsPath, bucketName, policyJSON)},
+		})
+		if err != nil {
+			return fmt.Errorf("write bucket policy: %w", err)
+		}
+		if resp.Error != "" {
+			return fmt.Errorf("write bucket policy: %s", resp.Error)
+		}
+		return nil
+	})
+}
+
+// bucketPolicyMutation patches only the policy key rather than writing the
+// whole entry back: the filer re-reads and merges under the bucket path
+// lock, so a concurrent owner/quota/versioning/lifecycle change is
+// preserved instead of being reverted by a stale snapshot. Same pattern as
+// bucketLifecycleMutation. A nil/empty policyJSON clears the key.
+func bucketPolicyMutation(bucketsPath, bucketName string, policyJSON []byte) *filer_pb.ObjectMutation {
+	mutation := &filer_pb.ObjectMutation{
+		Type:      filer_pb.ObjectMutation_PATCH_EXTENDED,
+		Directory: bucketsPath,
+		Name:      bucketName,
+	}
+	if len(policyJSON) > 0 {
+		mutation.SetExtended = map[string][]byte{
+			s3api.BUCKET_POLICY_METADATA_KEY: policyJSON,
+		}
+		return mutation
+	}
+	mutation.DeleteExtended = []string{s3api.BUCKET_POLICY_METADATA_KEY}
+	return mutation
+}
diff --git a/weed/admin/dash/bucket_policy_test.go b/weed/admin/dash/bucket_policy_test.go
new file mode 100644
index 0000000000..422c352948
--- /dev/null
+++ b/weed/admin/dash/bucket_policy_test.go
@@ -0,0 +1,168 @@
+package dash
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func validBucketPolicyJSON(bucket string) []byte {
+	return []byte(fmt.Sprintf(`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::%s/*"}]}`, bucket))
+}
+
+func validBucketPolicyDoc(bucket string) *policy_engine.PolicyDocument {
+	var doc policy_engine.PolicyDocument
+	if err := json.Unmarshal(validBucketPolicyJSON(bucket), &doc); err != nil {
+		panic(err)
+	}
+	return &doc
+}
+
+func TestBucketPolicyMutation_SetsPolicy(t *testing.T) {
+	policyJSON := validBucketPolicyJSON("mybucket")
+	m := bucketPolicyMutation("/buckets", "mybucket", policyJSON)
+
+	if m.Type != filer_pb.ObjectMutation_PATCH_EXTENDED {
+		t.Fatalf("expected a PATCH_EXTENDED mutation, got %v", m.Type)
+	}
+	if m.Directory != "/buckets" || m.Name != "mybucket" {
+		t.Fatalf("expected the mutation to target /buckets/mybucket, got %s/%s", m.Directory, m.Name)
+	}
+	if got := m.SetExtended[s3api.BUCKET_POLICY_METADATA_KEY]; string(got) != string(policyJSON) {
+		t.Fatalf("expected the policy key to carry the marshaled document, got %q", got)
+	}
+	if len(m.DeleteExtended) != 0 {
+		t.Fatalf("expected no key deletions when saving a policy, got %v", m.DeleteExtended)
+	}
+}
+
+func TestBucketPolicyMutation_ClearsKey(t *testing.T) {
+	m := bucketPolicyMutation("/buckets", "mybucket", nil)
+
+	if len(m.SetExtended) != 0 {
+		t.Fatalf("expected no key writes when clearing, got %v", m.SetExtended)
+	}
+	if len(m.DeleteExtended) != 1 || m.DeleteExtended[0] != s3api.BUCKET_POLICY_METADATA_KEY {
+		t.Fatalf("expected only the policy key to be cleared, got %v", m.DeleteExtended)
+	}
+}
+
+// A whole-entry write would have carried the rest of the bucket entry with
+// it; the patch must name only the key it owns, so a concurrent owner,
+// quota, or lifecycle change survives.
+func TestBucketPolicyMutation_TouchesOnlyPolicyKey(t *testing.T) {
+	for _, m := range []*filer_pb.ObjectMutation{
+		bucketPolicyMutation("/buckets", "mybucket", validBucketPolicyJSON("mybucket")),
+		bucketPolicyMutation("/buckets", "mybucket", nil),
+	} {
+		if m.Entry != nil {
+			t.Fatal("expected the mutation to carry no entry snapshot")
+		}
+		if m.SetContent {
+			t.Fatal("expected the mutation to leave entry content alone")
+		}
+		for k := range m.SetExtended {
+			if k != s3api.BUCKET_POLICY_METADATA_KEY {
+				t.Fatalf("unexpected key written: %s", k)
+			}
+		}
+		for _, k := range m.DeleteExtended {
+			if k != s3api.BUCKET_POLICY_METADATA_KEY {
+				t.Fatalf("unexpected key deleted: %s", k)
+			}
+		}
+	}
+}
+
+func TestExtractPolicyStatementCountFromEntry(t *testing.T) {
+	tests := []struct {
+		name  string
+		entry *filer_pb.Entry
+		want  int
+	}{
+		{"no extended attrs", &filer_pb.Entry{}, 0},
+		{"absent key", &filer_pb.Entry{Extended: map[string][]byte{"other": []byte("x")}}, 0},
+		{"one statement", &filer_pb.Entry{Extended: map[string][]byte{
+			s3api.BUCKET_POLICY_METADATA_KEY: validBucketPolicyJSON("b"),
+		}}, 1},
+		{"three statements", &filer_pb.Entry{Extended: map[string][]byte{
+			s3api.BUCKET_POLICY_METADATA_KEY: []byte(`{"Version":"2012-10-17","Statement":[
+				{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"},
+				{"Effect":"Allow","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::b/*"},
+				{"Effect":"Deny","Principal":"*","Action":"s3:DeleteObject","Resource":"arn:aws:s3:::b/*"}
+			]}`),
+		}}, 3},
+		{"garbage bytes", &filer_pb.Entry{Extended: map[string][]byte{
+			s3api.BUCKET_POLICY_METADATA_KEY: []byte("not json"),
+		}}, 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := extractPolicyStatementCountFromEntry(tt.entry); got != tt.want {
+				t.Errorf("extractPolicyStatementCountFromEntry() = %d, want %d", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestBucketPolicyErrorStatus(t *testing.T) {
+	if got := bucketPolicyErrorStatus(fmt.Errorf("%w: mybucket", ErrBucketNotFound)); got != http.StatusNotFound {
+		t.Fatalf("expected a missing bucket to map to 404, got %d", got)
+	}
+	if got := bucketPolicyErrorStatus(fmt.Errorf("%w: bad statement", ErrInvalidBucketPolicy)); got != http.StatusBadRequest {
+		t.Fatalf("expected an invalid policy to map to 400, got %d", got)
+	}
+	if got := bucketPolicyErrorStatus(errors.New("filer unreachable")); got != http.StatusInternalServerError {
+		t.Fatalf("expected an unrelated failure to stay 500, got %d", got)
+	}
+}
+
+func TestSetBucketPolicy_RejectsOversized(t *testing.T) {
+	// A resource list long enough to blow the cap: this must fail before
+	// any filer call, which is what makes it testable without one.
+	doc := validBucketPolicyDoc("mybucket")
+	doc.Statement[0].Sid = strings.Repeat("x", policy_engine.MaxBucketPolicySize+1)
+
+	err := (&AdminServer{}).SetBucketPolicy("mybucket", doc)
+	if err == nil {
+		t.Fatal("expected an oversized bucket policy to be rejected")
+	}
+	if !errors.Is(err, ErrInvalidBucketPolicy) {
+		t.Fatalf("expected an ErrInvalidBucketPolicy, got: %v", err)
+	}
+}
+
+func TestSetBucketPolicy_RejectsForeignResource(t *testing.T) {
+	// Proves the shared policy_engine.ValidateBucketPolicy validator is
+	// actually wired in: this is exactly the check the S3 gateway applies.
+	doc := validBucketPolicyDoc("mybucket")
+	doc.Statement[0].Resource = policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::other-bucket/*")
+
+	err := (&AdminServer{}).SetBucketPolicy("mybucket", doc)
+	if err == nil {
+		t.Fatal("expected a policy referencing a different bucket to be rejected")
+	}
+	if !errors.Is(err, ErrInvalidBucketPolicy) {
+		t.Fatalf("expected an ErrInvalidBucketPolicy, got: %v", err)
+	}
+}
+
+func TestSetBucketPolicy_RejectsMissingPrincipal(t *testing.T) {
+	doc := validBucketPolicyDoc("mybucket")
+	doc.Statement[0].Principal = nil
+
+	err := (&AdminServer{}).SetBucketPolicy("mybucket", doc)
+	if err == nil {
+		t.Fatal("expected a policy with no Principal to be rejected")
+	}
+	if !errors.Is(err, ErrInvalidBucketPolicy) {
+		t.Fatalf("expected an ErrInvalidBucketPolicy, got: %v", err)
+	}
+}
diff --git a/weed/admin/dash/client_management.go b/weed/admin/dash/client_management.go
index 46948a6288..6de7d1901b 100644
--- a/weed/admin/dash/client_management.go
+++ b/weed/admin/dash/client_management.go
@@ -20,7 +20,7 @@ import (
 
 // WithMasterClient executes a function with a master client connection
 func (s *AdminServer) WithMasterClient(f func(client master_pb.SeaweedClient) error) error {
-	return s.masterClient.WithClient(false, f)
+	return s.masterClient.WithClient(context.Background(), false, f)
 }
 
 // WithFilerClient executes a function with a filer client connection
diff --git a/weed/admin/dash/cluster_topology.go b/weed/admin/dash/cluster_topology.go
index b91f3dd6cb..21759dd34a 100644
--- a/weed/admin/dash/cluster_topology.go
+++ b/weed/admin/dash/cluster_topology.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
@@ -116,7 +117,7 @@ func (s *AdminServer) getTopologyViaGRPC(topology *ClusterTopology) error {
 
 	// Get cluster status from master
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			currentMaster := s.masterClient.GetMaster(context.Background())
 			glog.Errorf("Failed to get volume list from master %s: %v", currentMaster, err)
@@ -124,6 +125,12 @@ func (s *AdminServer) getTopologyViaGRPC(topology *ClusterTopology) error {
 		}
 
 		if resp.TopologyInfo != nil {
+			// Get volume size limit from response, default to 30GB if not set
+			volumeSizeLimitMb := resp.VolumeSizeLimitMb
+			if volumeSizeLimitMb == 0 {
+				volumeSizeLimitMb = 30000
+			}
+
 			// Process gRPC response
 			for _, dc := range resp.TopologyInfo.DataCenterInfos {
 				dataCenter := DataCenter{
@@ -142,6 +149,7 @@ func (s *AdminServer) getTopologyViaGRPC(topology *ClusterTopology) error {
 						var totalVolumes int64
 						var totalMaxVolumes int64
 						var totalSize int64
+						var remoteSize int64
 						// Prefer the real physical disk capacity the volume server
 						// reports per disk; the slot-based estimate overstates capacity
 						// when maxVolumeCount is configured higher than the disk holds.
@@ -153,12 +161,18 @@ func (s *AdminServer) getTopologyViaGRPC(topology *ClusterTopology) error {
 							if diskInfo.DiskTotalBytes > 0 {
 								diskCapacity += int64(diskInfo.DiskTotalBytes)
 							} else {
-								diskCapacity += diskInfo.MaxVolumeCount * int64(resp.VolumeSizeLimitMb) * 1024 * 1024
+								diskCapacity += diskInfo.MaxVolumeCount * int64(volumeSizeLimitMb) * 1024 * 1024
 							}
 
-							// Sum up individual volume information
+							// A remote-tiered volume reports its cloud object's
+							// size; keep those bytes out of the local disk usage
+							// that is compared against diskCapacity.
 							for _, volInfo := range diskInfo.VolumeInfos {
-								totalSize += int64(volInfo.Size)
+								if volInfo.RemoteStorageName != "" {
+									remoteSize += int64(volInfo.Size)
+								} else {
+									totalSize += int64(volInfo.Size)
+								}
 							}
 
 							// ShardSizes is local to this node, so summing
@@ -192,12 +206,15 @@ func (s *AdminServer) getTopologyViaGRPC(topology *ClusterTopology) error {
 							DiskUsage:     totalSize,
 							DiskCapacity:  diskCapacity,
 							LastHeartbeat: time.Now(),
+							RemoteSize:    remoteSize,
 						}
 
 						rackObj.Nodes = append(rackObj.Nodes, vs)
 						topology.VolumeServers = append(topology.VolumeServers, vs)
 						topology.TotalVolumes += vs.Volumes
-						topology.TotalSize += totalSize
+						// TotalSize is the logical data size, wherever the
+						// bytes live, so remote-tiered volumes still count.
+						topology.TotalSize += totalSize + remoteSize
 					}
 
 					dataCenter.Racks = append(dataCenter.Racks, rackObj)
@@ -210,6 +227,8 @@ func (s *AdminServer) getTopologyViaGRPC(topology *ClusterTopology) error {
 			// nets out tombstones and counts a chunk once no matter how many
 			// volume replicas or EC shard holders report it.
 			topology.TotalChunks = totalCollectionFileCount(resp.TopologyInfo)
+
+			topology.TierStats = CollectTierStats(resp.TopologyInfo, volumeSizeLimitMb)
 		}
 
 		return nil
diff --git a/weed/admin/dash/collection_management.go b/weed/admin/dash/collection_management.go
index fe55cf402f..f868ca90e8 100644
--- a/weed/admin/dash/collection_management.go
+++ b/weed/admin/dash/collection_management.go
@@ -5,6 +5,7 @@ import (
 	"sort"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 )
 
@@ -19,7 +20,7 @@ func (s *AdminServer) GetClusterCollections() (*ClusterCollectionsData, error) {
 
 	// Get actual collection information from volume data
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
diff --git a/weed/admin/dash/config_persistence.go b/weed/admin/dash/config_persistence.go
index fa3a0b43de..f0b3e0e85b 100644
--- a/weed/admin/dash/config_persistence.go
+++ b/weed/admin/dash/config_persistence.go
@@ -14,6 +14,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/balance"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/ec_balance"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/vacuum"
 	"google.golang.org/protobuf/encoding/protojson"
@@ -29,6 +30,7 @@ const (
 	VacuumTaskConfigFile      = "task_vacuum.pb"
 	ECTaskConfigFile          = "task_erasure_coding.pb"
 	BalanceTaskConfigFile     = "task_balance.pb"
+	EcBalanceTaskConfigFile   = "task_ec_balance.pb"
 	ReplicationTaskConfigFile = "task_replication.pb"
 
 	// JSON reference files
@@ -36,6 +38,7 @@ const (
 	VacuumTaskConfigJSONFile      = "task_vacuum.json"
 	ECTaskConfigJSONFile          = "task_erasure_coding.json"
 	BalanceTaskConfigJSONFile     = "task_balance.json"
+	EcBalanceTaskConfigJSONFile   = "task_ec_balance.json"
 	ReplicationTaskConfigJSONFile = "task_replication.json"
 
 	// Task persistence subdirectories and settings
@@ -53,6 +56,7 @@ type (
 	VacuumTaskConfig        = worker_pb.VacuumTaskConfig
 	ErasureCodingTaskConfig = worker_pb.ErasureCodingTaskConfig
 	BalanceTaskConfig       = worker_pb.BalanceTaskConfig
+	EcBalanceTaskConfig     = worker_pb.EcBalanceTaskConfig
 	ReplicationTaskConfig   = worker_pb.ReplicationTaskConfig
 )
 
@@ -155,8 +159,19 @@ func (cp *ConfigPersistence) LoadMaintenanceConfig() (*MaintenanceConfig, error)
 	if configData, err := os.ReadFile(configPath); err == nil {
 		var config MaintenanceConfig
 		if err := proto.Unmarshal(configData, &config); err == nil {
+			// Fill in fields added to the schema after this file was written. The
+			// enabled flag tracks presence, so an explicitly persisted false survives
+			// this, while a file from before presence tracking (where an operator's
+			// explicit false and the field's absence look the same on the wire) keeps
+			// the enabled default rather than silently switching maintenance off.
+			if err := maintenance.GetMaintenanceConfigSchema().ApplyDefaultsToProtobuf(&config); err != nil {
+				glog.Warningf("Failed to apply schema defaults to loaded maintenance config: %v", err)
+			}
+			if config.Enabled == nil {
+				config.Enabled = proto.Bool(true)
+			}
 			// Always populate policy from separate task configuration files
-			config.Policy = buildPolicyFromTaskConfigs()
+			config.Policy = cp.buildPolicyFromTaskConfigs()
 			return &config, nil
 		}
 	}
@@ -268,6 +283,28 @@ func (cp *ConfigPersistence) RestoreConfig(filename, backupName string) error {
 	return nil
 }
 
+// Default task policies. These derive from each task's own NewDefaultConfig() so that a
+// task type has exactly one definition of its defaults. They used to be hand-written copies
+// here, and had drifted from the values the tasks themselves and the admin UI schema use:
+// vacuum scanned every 24h instead of 2h, balance every 6h instead of 30m with a 0.1 instead
+// of 0.2 imbalance threshold, and erasure coding every 168h instead of 1h with a 0.90 instead
+// of 0.95 fullness ratio and a 1024MB instead of 30MB minimum volume size.
+func defaultVacuumTaskPolicy() *worker_pb.TaskPolicy {
+	return vacuum.NewDefaultConfig().ToTaskPolicy()
+}
+
+func defaultErasureCodingTaskPolicy() *worker_pb.TaskPolicy {
+	return erasure_coding.NewDefaultConfig().ToTaskPolicy()
+}
+
+func defaultBalanceTaskPolicy() *worker_pb.TaskPolicy {
+	return balance.NewDefaultConfig().ToTaskPolicy()
+}
+
+func defaultEcBalanceTaskPolicy() *worker_pb.TaskPolicy {
+	return ec_balance.NewDefaultConfig().ToTaskPolicy()
+}
+
 // SaveVacuumTaskConfig saves vacuum task configuration to protobuf file
 func (cp *ConfigPersistence) SaveVacuumTaskConfig(config *VacuumTaskConfig) error {
 	return cp.saveTaskConfig(VacuumTaskConfigFile, config)
@@ -288,28 +325,14 @@ func (cp *ConfigPersistence) LoadVacuumTaskConfig() (*VacuumTaskConfig, error) {
 	}
 
 	// Return default config if no valid config found
-	return &VacuumTaskConfig{
-		GarbageThreshold:  0.3,
-		MinVolumeAgeHours: 24,
-	}, nil
+	return defaultVacuumTaskPolicy().GetVacuumConfig(), nil
 }
 
 // LoadVacuumTaskPolicy loads complete vacuum task policy from protobuf file
 func (cp *ConfigPersistence) LoadVacuumTaskPolicy() (*worker_pb.TaskPolicy, error) {
 	if cp.dataDir == "" {
 		// Return default policy if no data directory
-		return &worker_pb.TaskPolicy{
-			Enabled:               true,
-			MaxConcurrent:         2,
-			RepeatIntervalSeconds: 24 * 3600, // 24 hours in seconds
-			CheckIntervalSeconds:  6 * 3600,  // 6 hours in seconds
-			TaskConfig: &worker_pb.TaskPolicy_VacuumConfig{
-				VacuumConfig: &worker_pb.VacuumTaskConfig{
-					GarbageThreshold:  0.3,
-					MinVolumeAgeHours: 24,
-				},
-			},
-		}, nil
+		return defaultVacuumTaskPolicy(), nil
 	}
 
 	confDir := filepath.Join(cp.dataDir, ConfigSubdir)
@@ -318,18 +341,7 @@ func (cp *ConfigPersistence) LoadVacuumTaskPolicy() (*worker_pb.TaskPolicy, erro
 	// Check if file exists
 	if _, err := os.Stat(configPath); os.IsNotExist(err) {
 		// Return default policy if file doesn't exist
-		return &worker_pb.TaskPolicy{
-			Enabled:               true,
-			MaxConcurrent:         2,
-			RepeatIntervalSeconds: 24 * 3600, // 24 hours in seconds
-			CheckIntervalSeconds:  6 * 3600,  // 6 hours in seconds
-			TaskConfig: &worker_pb.TaskPolicy_VacuumConfig{
-				VacuumConfig: &worker_pb.VacuumTaskConfig{
-					GarbageThreshold:  0.3,
-					MinVolumeAgeHours: 24,
-				},
-			},
-		}, nil
+		return defaultVacuumTaskPolicy(), nil
 	}
 
 	// Read file
@@ -371,32 +383,14 @@ func (cp *ConfigPersistence) LoadErasureCodingTaskConfig() (*ErasureCodingTaskCo
 	}
 
 	// Return default config if no valid config found
-	return &ErasureCodingTaskConfig{
-		FullnessRatio:    0.9,
-		QuietForSeconds:  3600,
-		MinVolumeSizeMb:  1024,
-		CollectionFilter: "",
-	}, nil
+	return defaultErasureCodingTaskPolicy().GetErasureCodingConfig(), nil
 }
 
 // LoadErasureCodingTaskPolicy loads complete EC task policy from protobuf file
 func (cp *ConfigPersistence) LoadErasureCodingTaskPolicy() (*worker_pb.TaskPolicy, error) {
 	if cp.dataDir == "" {
 		// Return default policy if no data directory
-		return &worker_pb.TaskPolicy{
-			Enabled:               true,
-			MaxConcurrent:         1,
-			RepeatIntervalSeconds: 168 * 3600, // 1 week in seconds
-			CheckIntervalSeconds:  24 * 3600,  // 24 hours in seconds
-			TaskConfig: &worker_pb.TaskPolicy_ErasureCodingConfig{
-				ErasureCodingConfig: &worker_pb.ErasureCodingTaskConfig{
-					FullnessRatio:    0.9,
-					QuietForSeconds:  3600,
-					MinVolumeSizeMb:  1024,
-					CollectionFilter: "",
-				},
-			},
-		}, nil
+		return defaultErasureCodingTaskPolicy(), nil
 	}
 
 	confDir := filepath.Join(cp.dataDir, ConfigSubdir)
@@ -405,20 +399,7 @@ func (cp *ConfigPersistence) LoadErasureCodingTaskPolicy() (*worker_pb.TaskPolic
 	// Check if file exists
 	if _, err := os.Stat(configPath); os.IsNotExist(err) {
 		// Return default policy if file doesn't exist
-		return &worker_pb.TaskPolicy{
-			Enabled:               true,
-			MaxConcurrent:         1,
-			RepeatIntervalSeconds: 168 * 3600, // 1 week in seconds
-			CheckIntervalSeconds:  24 * 3600,  // 24 hours in seconds
-			TaskConfig: &worker_pb.TaskPolicy_ErasureCodingConfig{
-				ErasureCodingConfig: &worker_pb.ErasureCodingTaskConfig{
-					FullnessRatio:    0.9,
-					QuietForSeconds:  3600,
-					MinVolumeSizeMb:  1024,
-					CollectionFilter: "",
-				},
-			},
-		}, nil
+		return defaultErasureCodingTaskPolicy(), nil
 	}
 
 	// Read file
@@ -460,28 +441,14 @@ func (cp *ConfigPersistence) LoadBalanceTaskConfig() (*BalanceTaskConfig, error)
 	}
 
 	// Return default config if no valid config found
-	return &BalanceTaskConfig{
-		ImbalanceThreshold: 0.1,
-		MinServerCount:     2,
-	}, nil
+	return defaultBalanceTaskPolicy().GetBalanceConfig(), nil
 }
 
 // LoadBalanceTaskPolicy loads complete balance task policy from protobuf file
 func (cp *ConfigPersistence) LoadBalanceTaskPolicy() (*worker_pb.TaskPolicy, error) {
 	if cp.dataDir == "" {
 		// Return default policy if no data directory
-		return &worker_pb.TaskPolicy{
-			Enabled:               true,
-			MaxConcurrent:         1,
-			RepeatIntervalSeconds: 6 * 3600,  // 6 hours in seconds
-			CheckIntervalSeconds:  12 * 3600, // 12 hours in seconds
-			TaskConfig: &worker_pb.TaskPolicy_BalanceConfig{
-				BalanceConfig: &worker_pb.BalanceTaskConfig{
-					ImbalanceThreshold: 0.1,
-					MinServerCount:     2,
-				},
-			},
-		}, nil
+		return defaultBalanceTaskPolicy(), nil
 	}
 
 	confDir := filepath.Join(cp.dataDir, ConfigSubdir)
@@ -490,18 +457,7 @@ func (cp *ConfigPersistence) LoadBalanceTaskPolicy() (*worker_pb.TaskPolicy, err
 	// Check if file exists
 	if _, err := os.Stat(configPath); os.IsNotExist(err) {
 		// Return default policy if file doesn't exist
-		return &worker_pb.TaskPolicy{
-			Enabled:               true,
-			MaxConcurrent:         1,
-			RepeatIntervalSeconds: 6 * 3600,  // 6 hours in seconds
-			CheckIntervalSeconds:  12 * 3600, // 12 hours in seconds
-			TaskConfig: &worker_pb.TaskPolicy_BalanceConfig{
-				BalanceConfig: &worker_pb.BalanceTaskConfig{
-					ImbalanceThreshold: 0.1,
-					MinServerCount:     2,
-				},
-			},
-		}, nil
+		return defaultBalanceTaskPolicy(), nil
 	}
 
 	// Read file
@@ -523,6 +479,60 @@ func (cp *ConfigPersistence) LoadBalanceTaskPolicy() (*worker_pb.TaskPolicy, err
 	return nil, fmt.Errorf("failed to unmarshal balance task configuration")
 }
 
+// SaveEcBalanceTaskPolicy saves complete EC balance task policy to protobuf file
+func (cp *ConfigPersistence) SaveEcBalanceTaskPolicy(policy *worker_pb.TaskPolicy) error {
+	return cp.saveTaskConfig(EcBalanceTaskConfigFile, policy)
+}
+
+// LoadEcBalanceTaskConfig loads EC balance task configuration from protobuf file
+func (cp *ConfigPersistence) LoadEcBalanceTaskConfig() (*EcBalanceTaskConfig, error) {
+	if taskPolicy, err := cp.LoadEcBalanceTaskPolicy(); err == nil && taskPolicy != nil {
+		if ecBalanceConfig := taskPolicy.GetEcBalanceConfig(); ecBalanceConfig != nil {
+			return ecBalanceConfig, nil
+		}
+	}
+
+	// Return default config if no valid config found
+	return defaultEcBalanceTaskPolicy().GetEcBalanceConfig(), nil
+}
+
+// LoadEcBalanceTaskPolicy loads complete EC balance task policy from protobuf file.
+// ec_balance is registered like the other maintenance tasks and ec_balance.LoadConfigFromPersistence
+// asserts on this accessor, so without it the task could never be configured at all.
+func (cp *ConfigPersistence) LoadEcBalanceTaskPolicy() (*worker_pb.TaskPolicy, error) {
+	if cp.dataDir == "" {
+		// Return default policy if no data directory
+		return defaultEcBalanceTaskPolicy(), nil
+	}
+
+	confDir := filepath.Join(cp.dataDir, ConfigSubdir)
+	configPath := filepath.Join(confDir, EcBalanceTaskConfigFile)
+
+	// Check if file exists
+	if _, err := os.Stat(configPath); os.IsNotExist(err) {
+		// Return default policy if file doesn't exist
+		return defaultEcBalanceTaskPolicy(), nil
+	}
+
+	// Read file
+	configData, err := os.ReadFile(configPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read EC balance task config file: %w", err)
+	}
+
+	// Try to unmarshal as TaskPolicy
+	var policy worker_pb.TaskPolicy
+	if err := proto.Unmarshal(configData, &policy); err == nil {
+		// Validate that it's actually a TaskPolicy with EC balance config
+		if policy.GetEcBalanceConfig() != nil {
+			glog.V(1).Infof("Loaded EC balance task policy from %s", configPath)
+			return &policy, nil
+		}
+	}
+
+	return nil, fmt.Errorf("failed to unmarshal EC balance task configuration")
+}
+
 // SaveReplicationTaskConfig saves replication task configuration to protobuf file
 func (cp *ConfigPersistence) SaveReplicationTaskConfig(config *ReplicationTaskConfig) error {
 	return cp.saveTaskConfig(ReplicationTaskConfigFile, config)
@@ -632,6 +642,8 @@ func (cp *ConfigPersistence) SaveTaskPolicy(taskType string, policy *worker_pb.T
 		return cp.SaveErasureCodingTaskPolicy(policy)
 	case "balance":
 		return cp.SaveBalanceTaskPolicy(policy)
+	case "ec_balance":
+		return cp.SaveEcBalanceTaskPolicy(policy)
 	case "replication":
 		return cp.SaveReplicationTaskPolicy(policy)
 	}
@@ -687,67 +699,13 @@ func (cp *ConfigPersistence) GetConfigInfo() map[string]interface{} {
 	return info
 }
 
-// buildPolicyFromTaskConfigs loads task configurations from separate files and builds a MaintenancePolicy
-func buildPolicyFromTaskConfigs() *worker_pb.MaintenancePolicy {
-	policy := &worker_pb.MaintenancePolicy{
-		GlobalMaxConcurrent:          4,
-		DefaultRepeatIntervalSeconds: 6 * 3600,  // 6 hours in seconds
-		DefaultCheckIntervalSeconds:  12 * 3600, // 12 hours in seconds
-		TaskPolicies:                 make(map[string]*worker_pb.TaskPolicy),
-	}
-
-	// Load vacuum task configuration
-	if vacuumConfig := vacuum.LoadConfigFromPersistence(nil); vacuumConfig != nil {
-		policy.TaskPolicies["vacuum"] = &worker_pb.TaskPolicy{
-			Enabled:               vacuumConfig.Enabled,
-			MaxConcurrent:         int32(vacuumConfig.MaxConcurrent),
-			RepeatIntervalSeconds: int32(vacuumConfig.ScanIntervalSeconds),
-			CheckIntervalSeconds:  int32(vacuumConfig.ScanIntervalSeconds),
-			TaskConfig: &worker_pb.TaskPolicy_VacuumConfig{
-				VacuumConfig: &worker_pb.VacuumTaskConfig{
-					GarbageThreshold:  float64(vacuumConfig.GarbageThreshold),
-					MinVolumeAgeHours: int32((vacuumConfig.MinVolumeAgeSeconds + 3599) / 3600), // round up so sub-hour values don't become 0
-				},
-			},
-		}
-	}
-
-	// Load erasure coding task configuration
-	if ecConfig := erasure_coding.LoadConfigFromPersistence(nil); ecConfig != nil {
-		policy.TaskPolicies["erasure_coding"] = &worker_pb.TaskPolicy{
-			Enabled:               ecConfig.Enabled,
-			MaxConcurrent:         int32(ecConfig.MaxConcurrent),
-			RepeatIntervalSeconds: int32(ecConfig.ScanIntervalSeconds),
-			CheckIntervalSeconds:  int32(ecConfig.ScanIntervalSeconds),
-			TaskConfig: &worker_pb.TaskPolicy_ErasureCodingConfig{
-				ErasureCodingConfig: &worker_pb.ErasureCodingTaskConfig{
-					FullnessRatio:    float64(ecConfig.FullnessRatio),
-					QuietForSeconds:  int32(ecConfig.QuietForSeconds),
-					MinVolumeSizeMb:  int32(ecConfig.MinSizeMB),
-					CollectionFilter: ecConfig.CollectionFilter,
-				},
-			},
-		}
-	}
-
-	// Load balance task configuration
-	if balanceConfig := balance.LoadConfigFromPersistence(nil); balanceConfig != nil {
-		policy.TaskPolicies["balance"] = &worker_pb.TaskPolicy{
-			Enabled:               balanceConfig.Enabled,
-			MaxConcurrent:         int32(balanceConfig.MaxConcurrent),
-			RepeatIntervalSeconds: int32(balanceConfig.ScanIntervalSeconds),
-			CheckIntervalSeconds:  int32(balanceConfig.ScanIntervalSeconds),
-			TaskConfig: &worker_pb.TaskPolicy_BalanceConfig{
-				BalanceConfig: &worker_pb.BalanceTaskConfig{
-					ImbalanceThreshold: float64(balanceConfig.ImbalanceThreshold),
-					MinServerCount:     int32(balanceConfig.MinServerCount),
-				},
-			},
-		}
-	}
-
-	glog.V(1).Infof("Built maintenance policy from separate task configs - %d task policies loaded", len(policy.TaskPolicies))
-	return policy
+// buildPolicyFromTaskConfigs builds the maintenance policy from the persisted task configs.
+//
+// The body lives in weed/admin/maintenance because the maintenance manager needs the same
+// policy when it has to build one itself, and this package already imports that one. Keeping
+// a second copy here is what let the two drift apart in the first place.
+func (cp *ConfigPersistence) buildPolicyFromTaskConfigs() *worker_pb.MaintenancePolicy {
+	return maintenance.BuildPolicyFromTaskConfigs(cp)
 }
 
 // SaveTaskDetail saves detailed task information to disk
@@ -937,7 +895,7 @@ func (cp *ConfigPersistence) ListTaskDetails() ([]string, error) {
 	return taskIDs, nil
 }
 
-// CleanupCompletedTasks removes old completed tasks beyond the retention limit
+// CleanupCompletedTasks removes old terminal task files beyond the retention limit
 func (cp *ConfigPersistence) CleanupCompletedTasks() error {
 	cp.tasksMu.Lock()
 	defer cp.tasksMu.Unlock()
@@ -956,10 +914,10 @@ func (cp *ConfigPersistence) CleanupCompletedTasks() error {
 		return fmt.Errorf("failed to load tasks for cleanup: %w", err)
 	}
 
-	// Filter completed and failed tasks, sort by completion time
 	var completedTasks []*maintenance.MaintenanceTask
 	for _, task := range allTasks {
-		if (task.Status == maintenance.TaskStatusCompleted || task.Status == maintenance.TaskStatusFailed) && task.CompletedAt != nil {
+		switch task.Status {
+		case maintenance.TaskStatusCompleted, maintenance.TaskStatusFailed, maintenance.TaskStatusCancelled:
 			completedTasks = append(completedTasks, task)
 		}
 	}
diff --git a/weed/admin/dash/config_toml.go b/weed/admin/dash/config_toml.go
index 3872d5b9e6..bdc00a7328 100644
--- a/weed/admin/dash/config_toml.go
+++ b/weed/admin/dash/config_toml.go
@@ -12,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/base"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/vacuum"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
@@ -30,6 +31,20 @@ type TomlConfig interface {
 // directory loss and override admin UI edits on restart. Absent keys keep
 // their persisted values.
 func (cp *ConfigPersistence) ApplyMaintenanceConfigFromToml(v TomlConfig) error {
+	var maintenanceConf *MaintenanceConfig
+	maintenanceChanged := false
+	if k := "maintenance.enabled"; v.IsSet(k) {
+		conf, err := cp.LoadMaintenanceConfig()
+		if err != nil {
+			return fmt.Errorf("load maintenance config: %w", err)
+		}
+		conf.Enabled = proto.Bool(v.GetBool(k))
+		// the policy lives in the per-task config files; don't snapshot it here
+		conf.Policy = nil
+		maintenanceConf = conf
+		maintenanceChanged = true
+	}
+
 	vacuumConf := vacuum.LoadConfigFromPersistence(cp)
 	vacuumChanged := applyBaseConfigFromToml(v, "maintenance.vacuum.", &vacuumConf.BaseConfig)
 	if k := "maintenance.vacuum.garbage_threshold"; v.IsSet(k) {
@@ -83,14 +98,33 @@ func (cp *ConfigPersistence) ApplyMaintenanceConfigFromToml(v TomlConfig) error
 		ecConf.ReplicaPlacement = v.GetString(k)
 		ecChanged = true
 	}
+	if k := "maintenance.erasure_coding.strict_placement"; v.IsSet(k) {
+		ecConf.StrictPlacement = v.GetBool(k)
+		ecChanged = true
+	}
+	if k := "maintenance.erasure_coding.free_slots_deadband"; v.IsSet(k) {
+		ecConf.FreeSlotsDeadband = v.GetInt(k)
+		if ecConf.FreeSlotsDeadband < 0 {
+			ecConf.FreeSlotsDeadband = 0
+		} else if ecConf.FreeSlotsDeadband > 100000 {
+			ecConf.FreeSlotsDeadband = 100000
+		}
+		ecChanged = true
+	}
 
-	if !vacuumChanged && !balanceChanged && !ecChanged {
+	if !maintenanceChanged && !vacuumChanged && !balanceChanged && !ecChanged {
 		return nil
 	}
 	if !cp.IsConfigured() {
 		return fmt.Errorf("admin.toml maintenance settings require -dataDir to persist")
 	}
 
+	if maintenanceChanged {
+		if err := cp.SaveMaintenanceConfig(maintenanceConf); err != nil {
+			return fmt.Errorf("save maintenance config: %w", err)
+		}
+		glog.V(0).Infof("Applied [maintenance] settings from admin.toml (enabled: %v)", maintenanceConf.GetEnabled())
+	}
 	if vacuumChanged {
 		if err := cp.SaveVacuumTaskPolicy(vacuumConf.ToTaskPolicy()); err != nil {
 			return fmt.Errorf("save vacuum task config: %w", err)
@@ -198,11 +232,13 @@ var pluginConfigSections = []pluginConfigSection{
 		jobType: "erasure_coding",
 		prefix:  "maintenance.erasure_coding",
 		workerKeys: map[string]func(v TomlConfig, key string) *plugin_pb.ConfigValue{
-			"fullness_ratio":    doubleValue,
-			"quiet_for_seconds": int64Value,
-			"min_size_mb":       int64Value,
-			"preferred_tags":    stringListValue,
-			"replica_placement": stringValue,
+			"fullness_ratio":      doubleValue,
+			"quiet_for_seconds":   int64Value,
+			"min_size_mb":         int64Value,
+			"preferred_tags":      stringListValue,
+			"replica_placement":   stringValue,
+			"strict_placement":    boolValue,
+			"free_slots_deadband": int64Value,
 		},
 		// workers read collection_filter from the admin values, not the worker values
 		adminKeys: map[string]func(v TomlConfig, key string) *plugin_pb.ConfigValue{
@@ -219,6 +255,10 @@ func int64Value(v TomlConfig, key string) *plugin_pb.ConfigValue {
 	return &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: int64(v.GetInt(key))}}
 }
 
+func boolValue(v TomlConfig, key string) *plugin_pb.ConfigValue {
+	return &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_BoolValue{BoolValue: v.GetBool(key)}}
+}
+
 func stringValue(v TomlConfig, key string) *plugin_pb.ConfigValue {
 	return &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_StringValue{StringValue: v.GetString(key)}}
 }
diff --git a/weed/admin/dash/config_toml_test.go b/weed/admin/dash/config_toml_test.go
index c68e31a68b..111c3ccff7 100644
--- a/weed/admin/dash/config_toml_test.go
+++ b/weed/admin/dash/config_toml_test.go
@@ -90,6 +90,36 @@ preferred_tags = "Fast, ssd"
 	}
 }
 
+func TestApplyMaintenanceConfigFromTomlEnabledToggle(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	if err := cp.ApplyMaintenanceConfigFromToml(tomlConfig(t, "[maintenance]\nenabled = false\n")); err != nil {
+		t.Fatalf("apply: %v", err)
+	}
+	conf, err := cp.LoadMaintenanceConfig()
+	if err != nil {
+		t.Fatalf("load maintenance config: %v", err)
+	}
+	if conf.GetEnabled() {
+		t.Errorf("maintenance still enabled after [maintenance] enabled = false")
+	}
+	if conf.ScanIntervalSeconds != 30*60 {
+		t.Errorf("scan interval = %d, want default 1800 kept alongside the toggle", conf.ScanIntervalSeconds)
+	}
+
+	if err := cp.ApplyMaintenanceConfigFromToml(tomlConfig(t, "[maintenance]\nenabled = true\n")); err != nil {
+		t.Fatalf("apply: %v", err)
+	}
+	conf, err = cp.LoadMaintenanceConfig()
+	if err != nil {
+		t.Fatalf("load maintenance config: %v", err)
+	}
+	if !conf.GetEnabled() {
+		t.Errorf("maintenance still disabled after [maintenance] enabled = true")
+	}
+}
+
 func TestApplyMaintenanceConfigFromTomlNoKeys(t *testing.T) {
 	dir := t.TempDir()
 	cp := NewConfigPersistence(dir)
diff --git a/weed/admin/dash/dashboard_metrics.go b/weed/admin/dash/dashboard_metrics.go
index be208354db..2efd008905 100644
--- a/weed/admin/dash/dashboard_metrics.go
+++ b/weed/admin/dash/dashboard_metrics.go
@@ -73,9 +73,12 @@ func (s *AdminServer) recordDashboardSample() {
 				}
 			}
 			sample.tasks = float64(active)
-			sample.workers = float64(stats.ActiveWorkers)
 		}
 	}
+	// Counted across both worker registries, same as the Prometheus gauge, so
+	// the card isn't stuck at 0 on clusters that only run plugin workers.
+	workers, _, _ := s.workerFleetTotals()
+	sample.workers = float64(workers)
 
 	s.dashSamplesMu.Lock()
 	s.dashSamples = append(s.dashSamples, sample)
diff --git a/weed/admin/dash/ec_shard_management.go b/weed/admin/dash/ec_shard_management.go
index 7dc9277c6b..02862247ea 100644
--- a/weed/admin/dash/ec_shard_management.go
+++ b/weed/admin/dash/ec_shard_management.go
@@ -6,6 +6,7 @@ import (
 	"sort"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 )
@@ -44,7 +45,7 @@ func (s *AdminServer) GetClusterEcShards(page int, pageSize int, sortBy string,
 
 	// Get detailed EC shard information via gRPC
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
@@ -65,6 +66,7 @@ func (s *AdminServer) GetClusterEcShards(page int, pageSize int, sortBy string,
 
 								// Create individual shard entries for each shard this server has
 								shardBits := ecShardInfo.EcIndexBits
+								shardsInfo := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecShardInfo)
 								for shardId := 0; shardId < erasure_coding.MaxShardCount; shardId++ {
 									if (shardBits & (1 << uint(shardId))) != 0 {
 										// Mark this shard as present for this volume
@@ -74,7 +76,7 @@ func (s *AdminServer) GetClusterEcShards(page int, pageSize int, sortBy string,
 											VolumeID:     volumeId,
 											ShardID:      uint32(shardId),
 											Collection:   ecShardInfo.Collection,
-											Size:         0, // EC shards don't have individual size in the API response
+											Size:         uint64(shardsInfo.Size(erasure_coding.ShardId(shardId))),
 											Server:       node.Id,
 											DataCenter:   dc.Id,
 											Rack:         rack.Id,
@@ -261,7 +263,7 @@ func (s *AdminServer) GetClusterEcVolumes(page int, pageSize int, sortBy string,
 
 	// Get detailed EC shard information via gRPC
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
@@ -559,7 +561,7 @@ func (s *AdminServer) GetEcVolumeDetails(volumeID uint32, sortBy string, sortOrd
 
 	// Get detailed EC shard information for the specific volume via gRPC
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{VolumeIds: []uint32{volumeID}})
 		if err != nil {
 			return err
 		}
@@ -571,6 +573,7 @@ func (s *AdminServer) GetEcVolumeDetails(volumeID uint32, sortBy string, sortOrd
 						for _, diskInfo := range node.DiskInfos {
 							// Process EC shard information for this specific volume
 							for _, ecShardInfo := range diskInfo.EcShardInfos {
+								// An older master ignores the filter.
 								if ecShardInfo.Id == volumeID {
 									collection = ecShardInfo.Collection
 									dataCenters[dc.Id] = true
diff --git a/weed/admin/dash/file_browser_data.go b/weed/admin/dash/file_browser_data.go
index 225b8dd417..37385f5fb4 100644
--- a/weed/admin/dash/file_browser_data.go
+++ b/weed/admin/dash/file_browser_data.go
@@ -2,6 +2,7 @@ package dash
 
 import (
 	"context"
+	"net/url"
 	"path"
 	"strings"
 	"time"
@@ -46,6 +47,7 @@ type FileBrowserData struct {
 	BucketName        string    `json:"bucket_name"`
 	IsTableBucketPath bool      `json:"is_table_bucket_path"`
 	TableBucketName   string    `json:"table_bucket_name"`
+	S3Endpoint        string    `json:"s3_endpoint,omitempty"`
 	// Pagination fields
 	PageSize            int    `json:"page_size"`
 	HasNextPage         bool   `json:"has_next_page"`
@@ -53,8 +55,11 @@ type FileBrowserData struct {
 	CurrentLastFileName string `json:"current_last_file_name"` // Cursor from current request (for page size changes)
 }
 
-// GetFileBrowser retrieves file browser data for a given path with cursor-based pagination
-func (s *AdminServer) GetFileBrowser(dir string, lastFileName string, pageSize int) (*FileBrowserData, error) {
+// GetFileBrowser retrieves file browser data for a given path with cursor-based
+// pagination. A non-empty prefix limits the listing to entries whose name starts
+// with it, so callers that only want part of a large directory don't have to page
+// through all of it.
+func (s *AdminServer) GetFileBrowser(dir string, prefix string, lastFileName string, pageSize int) (*FileBrowserData, error) {
 	if dir == "" {
 		dir = "/"
 	}
@@ -76,7 +81,7 @@ func (s *AdminServer) GetFileBrowser(dir string, lastFileName string, pageSize i
 		// Fetch entries starting from the cursor (lastFileName)
 		stream, err := client.ListEntries(context.Background(), &filer_pb.ListEntriesRequest{
 			Directory:          dir,
-			Prefix:             "",
+			Prefix:             prefix,
 			Limit:              uint32(fetchLimit),
 			StartFromFileName:  lastFileName,
 			InclusiveStartFrom: false, // Don't include the cursor file itself
@@ -185,6 +190,7 @@ func (s *AdminServer) GetFileBrowser(dir string, lastFileName string, pageSize i
 	bucketName := ""
 	isTableBucketPath := false
 	tableBucketName := ""
+	isRegularBucket := false
 	if strings.HasPrefix(dir, "/buckets/") {
 		isBucketPath = true
 		pathParts := strings.Split(strings.Trim(dir, "/"), "/")
@@ -202,6 +208,8 @@ func (s *AdminServer) GetFileBrowser(dir string, lastFileName string, pageSize i
 				if s3tables.IsTableBucketEntry(resp.Entry) {
 					isTableBucketPath = true
 					tableBucketName = bucketName
+				} else {
+					isRegularBucket = true
 				}
 				return nil
 			}); err != nil {
@@ -210,6 +218,11 @@ func (s *AdminServer) GetFileBrowser(dir string, lastFileName string, pageSize i
 		}
 	}
 
+	s3Endpoint := ""
+	if isRegularBucket {
+		s3Endpoint = s.GetS3Endpoint()
+	}
+
 	return &FileBrowserData{
 		CurrentPath: dir,
 		ParentPath:  parentPath,
@@ -221,6 +234,7 @@ func (s *AdminServer) GetFileBrowser(dir string, lastFileName string, pageSize i
 		BucketName:        bucketName,
 		IsTableBucketPath: isTableBucketPath,
 		TableBucketName:   tableBucketName,
+		S3Endpoint:        s3Endpoint,
 		// Pagination metadata
 		PageSize:            pageSize,
 		HasNextPage:         hasNextPage,
@@ -269,3 +283,52 @@ func (s *AdminServer) generateBreadcrumbs(dir string) []BreadcrumbItem {
 
 	return breadcrumbs
 }
+
+// S3ObjectURL builds the path-style S3 URL for a filer path under /buckets/,
+// percent-encoding each path segment. Returns "" for other paths.
+func S3ObjectURL(endpoint, fullPath string) string {
+	rel, ok := strings.CutPrefix(fullPath, "/buckets/")
+	if !ok || rel == "" || endpoint == "" {
+		return ""
+	}
+	segments := strings.Split(rel, "/")
+	for i, segment := range segments {
+		segments[i] = url.PathEscape(segment)
+	}
+	return strings.TrimRight(endpoint, "/") + "/" + strings.Join(segments, "/")
+}
+
+// GetS3ObjectURL returns the S3 URL an object under a regular bucket is served
+// at, or "" when the path is not a bucket object, the bucket is an S3 Tables
+// bucket, or no S3 endpoint is known.
+func (s *AdminServer) GetS3ObjectURL(fullPath string) string {
+	rel, ok := strings.CutPrefix(fullPath, "/buckets/")
+	if !ok {
+		return ""
+	}
+	bucketName, key, found := strings.Cut(rel, "/")
+	if !found || key == "" {
+		return ""
+	}
+	endpoint := s.GetS3Endpoint()
+	if endpoint == "" {
+		return ""
+	}
+	if err := s.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: "/buckets",
+			Name:      bucketName,
+		})
+		if err != nil {
+			return err
+		}
+		if s3tables.IsTableBucketEntry(resp.Entry) {
+			endpoint = ""
+		}
+		return nil
+	}); err != nil {
+		glog.V(1).Infof("object url bucket lookup failed for %s: %v", bucketName, err)
+		return ""
+	}
+	return S3ObjectURL(endpoint, fullPath)
+}
diff --git a/weed/admin/dash/file_browser_data_test.go b/weed/admin/dash/file_browser_data_test.go
index 0605735af8..a9736449fa 100644
--- a/weed/admin/dash/file_browser_data_test.go
+++ b/weed/admin/dash/file_browser_data_test.go
@@ -93,6 +93,98 @@ func TestGenerateBreadcrumbs(t *testing.T) {
 	}
 }
 
+// TestS3ObjectURL verifies path-style S3 URL construction with per-segment
+// percent-encoding
+func TestS3ObjectURL(t *testing.T) {
+	tests := []struct {
+		name     string
+		endpoint string
+		fullPath string
+		expected string
+	}{
+		{
+			name:     "simple object",
+			endpoint: "https://s3.example.com",
+			fullPath: "/buckets/public-images/homarr/example.png",
+			expected: "https://s3.example.com/public-images/homarr/example.png",
+		},
+		{
+			name:     "space hash and question mark in key",
+			endpoint: "https://s3.example.com",
+			fullPath: "/buckets/b/a b#c?d.txt",
+			expected: "https://s3.example.com/b/a%20b%23c%3Fd.txt",
+		},
+		{
+			name:     "non-ascii key",
+			endpoint: "https://s3.example.com",
+			fullPath: "/buckets/b/图片.png",
+			expected: "https://s3.example.com/b/%E5%9B%BE%E7%89%87.png",
+		},
+		{
+			name:     "percent in key",
+			endpoint: "https://s3.example.com",
+			fullPath: "/buckets/b/100%.txt",
+			expected: "https://s3.example.com/b/100%25.txt",
+		},
+		{
+			name:     "trailing slash on endpoint",
+			endpoint: "https://s3.example.com/",
+			fullPath: "/buckets/b/k",
+			expected: "https://s3.example.com/b/k",
+		},
+		{
+			name:     "not a bucket path",
+			endpoint: "https://s3.example.com",
+			fullPath: "/topics/t/k",
+			expected: "",
+		},
+		{
+			name:     "empty endpoint",
+			endpoint: "",
+			fullPath: "/buckets/b/k",
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := S3ObjectURL(tt.endpoint, tt.fullPath); got != tt.expected {
+				t.Errorf("S3ObjectURL(%q, %q) = %q, expected %q", tt.endpoint, tt.fullPath, got, tt.expected)
+			}
+		})
+	}
+}
+
+// TestNormalizeS3PublicEndpoint verifies unusable configured endpoints are
+// dropped rather than producing broken links
+func TestNormalizeS3PublicEndpoint(t *testing.T) {
+	tests := []struct {
+		endpoint string
+		expected string
+	}{
+		{"https://s3.example.com", "https://s3.example.com"},
+		{"http://10.0.0.1:8333/", "http://10.0.0.1:8333"},
+		{"http://[::1]:8333", "http://[::1]:8333"},
+		{"https://proxy.example.com/s3", "https://proxy.example.com/s3"},
+		{"", ""},
+		{"/", ""},
+		{"s3.example.com", ""},
+		{"ftp://s3.example.com", ""},
+		{"https://", ""},
+		{"https://s3.example.com?x=1", ""},
+		{"https://s3.example.com/?", ""},
+		{"https://s3.example.com#frag", ""},
+		{"https://s3.example.com/#", ""},
+		{"http://user:pass@s3.example.com", ""},
+	}
+
+	for _, tt := range tests {
+		if got := normalizeS3PublicEndpoint(tt.endpoint); got != tt.expected {
+			t.Errorf("normalizeS3PublicEndpoint(%q) = %q, expected %q", tt.endpoint, got, tt.expected)
+		}
+	}
+}
+
 // TestPathHandlingWithForwardSlashes verifies that the production code
 // correctly handles paths with forward slashes (not OS-specific backslashes)
 func TestPathHandlingWithForwardSlashes(t *testing.T) {
diff --git a/weed/admin/dash/iceberg_data_preview.go b/weed/admin/dash/iceberg_data_preview.go
index adb7a9e3bd..1c9e90809d 100644
--- a/weed/admin/dash/iceberg_data_preview.go
+++ b/weed/admin/dash/iceberg_data_preview.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/apache/iceberg-go"
 	"github.com/parquet-go/parquet-go"
+	"github.com/seaweedfs/seaweedfs/weed/admin/plugin"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
@@ -27,6 +28,10 @@ const (
 	icebergPreviewMaxListed    = 500
 	icebergPreviewMaxCellChars = 200
 	icebergPreviewMaxMetaBytes = 64 << 20
+
+	// workerPreviewTimeout bounds one round trip to a worker. A page waiting on
+	// a worker that has gone quiet should say so rather than hang.
+	workerPreviewTimeout = 15 * time.Second
 )
 
 type IcebergDataFileInfo struct {
@@ -60,6 +65,10 @@ type IcebergDataPreviewData struct {
 	PreviewNotes      []string              `json:"preview_notes,omitempty"`
 	PreviewError      string                `json:"preview_error,omitempty"`
 	LastUpdated       time.Time             `json:"last_updated"`
+	// Format is what the catalog recorded. Anything but ICEBERG means the rows
+	// below, if any, came from a worker rather than from metadata this server read.
+	Format      string `json:"format,omitempty"`
+	PreviewedBy string `json:"previewed_by,omitempty"`
 }
 
 // GetIcebergTableDataPreview walks the selected snapshot's manifests and reads
@@ -92,6 +101,11 @@ func (s *AdminServer) GetIcebergTableDataPreview(ctx context.Context, catalogNam
 	if err := s.executeS3TablesOperation(ctx, "GetTable", req, &resp); err != nil {
 		return data, err
 	}
+	data.Format = resp.Format
+	if !strings.EqualFold(resp.Format, s3tables.FormatIceberg) && resp.Format != "" {
+		s.applyWorkerPreview(ctx, &data, bucketArn, namespaceParts, tableName, rowLimit)
+		return data, nil
+	}
 	if resp.Metadata == nil || len(resp.Metadata.FullMetadata) == 0 {
 		data.PreviewError = "Table has no Iceberg metadata."
 		return data, nil
@@ -467,3 +481,56 @@ func (w *sliceWriter) Write(p []byte) (int, error) {
 	w.n += c
 	return c, nil
 }
+
+// applyWorkerPreview asks the worker that last described this table for sample
+// rows. Admin has no reader for a format it does not implement, so this is the
+// only way the page shows anything but a location.
+//
+// The rows are fetched, never cached: they are the table's data rather than a
+// description of it, and a stale copy sitting in admin would be worse than
+// asking.
+func (s *AdminServer) applyWorkerPreview(ctx context.Context, data *IcebergDataPreviewData, bucketArn string, namespaceParts []string, tableName string, rowLimit int) {
+	plugin := s.GetPlugin()
+	if plugin == nil {
+		data.PreviewError = fmt.Sprintf("Reading a %s table needs a plugin worker, and none is configured.", data.Format)
+		return
+	}
+	bucketName, err := s3tables.ParseBucketNameFromARN(bucketArn)
+	if err != nil {
+		data.PreviewError = err.Error()
+		return
+	}
+
+	objectID := append(append([]string{bucketName}, namespaceParts...), tableName)
+	requestCtx, cancel := context.WithTimeout(ctx, workerPreviewTimeout)
+	defer cancel()
+
+	response, err := plugin.RequestObjectPreview(requestCtx, objectID, data.Format, rowLimit)
+	if err != nil {
+		data.PreviewError = fmt.Sprintf("Could not read this %s table: %v", data.Format, err)
+		return
+	}
+
+	data.Columns = response.Columns
+	data.Rows = make([][]string, 0, len(response.Rows))
+	for _, row := range response.Rows {
+		cells := make([]string, len(row.Values))
+		for i, value := range row.Values {
+			cells[i] = truncateCell(value)
+		}
+		data.Rows = append(data.Rows, cells)
+	}
+	data.TotalRecords = response.TotalRows
+	data.PreviewedBy = pluginWorkerForObject(plugin, objectID, data.Format)
+	if int64(len(data.Rows)) < response.TotalRows {
+		data.PreviewNotes = append(data.PreviewNotes, fmt.Sprintf("Showing %d of %d rows.", len(data.Rows), response.TotalRows))
+	}
+}
+
+// pluginWorkerForObject names the worker that answered, for the page to show.
+func pluginWorkerForObject(p *plugin.Plugin, objectID []string, format string) string {
+	if observed, ok := p.Observations().GetFormat(objectID, format); ok {
+		return observed.WorkerID
+	}
+	return ""
+}
diff --git a/weed/admin/dash/maintenance_policy_persistence_test.go b/weed/admin/dash/maintenance_policy_persistence_test.go
new file mode 100644
index 0000000000..1f9e1b23a6
--- /dev/null
+++ b/weed/admin/dash/maintenance_policy_persistence_test.go
@@ -0,0 +1,73 @@
+package dash
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/balance"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/vacuum"
+)
+
+// TestLoadMaintenanceConfigHonoursPersistedTaskConfigs guards against a regression: buildPolicyFromTaskConfigs used to call
+// LoadConfigFromPersistence(nil), which can never satisfy the loaders' type assertion, so every
+// task silently fell back to its compiled-in defaults (Enabled: true) and a task disabled in the
+// admin UI kept being scheduled.
+func TestLoadMaintenanceConfigHonoursPersistedTaskConfigs(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	// A maintenance.pb must exist, otherwise LoadMaintenanceConfig returns early with defaults.
+	if err := cp.SaveMaintenanceConfig(DefaultMaintenanceConfig()); err != nil {
+		t.Fatalf("save maintenance config: %v", err)
+	}
+
+	// Disable balance and vacuum the way the admin UI does, and change a value that is not a bool
+	// so a fallback to defaults cannot pass by coincidence.
+	disabledBalance := balance.NewDefaultConfig()
+	disabledBalance.Enabled = false
+	disabledBalance.MinServerCount = 7
+	if err := cp.SaveBalanceTaskPolicy(disabledBalance.ToTaskPolicy()); err != nil {
+		t.Fatalf("save balance policy: %v", err)
+	}
+
+	disabledVacuum := vacuum.NewDefaultConfig()
+	disabledVacuum.Enabled = false
+	if err := cp.SaveVacuumTaskPolicy(disabledVacuum.ToTaskPolicy()); err != nil {
+		t.Fatalf("save vacuum policy: %v", err)
+	}
+
+	config, err := cp.LoadMaintenanceConfig()
+	if err != nil {
+		t.Fatalf("load maintenance config: %v", err)
+	}
+	if config.Policy == nil {
+		t.Fatal("policy is nil, want it populated from the persisted task configs")
+	}
+
+	balancePolicy := config.Policy.TaskPolicies["balance"]
+	if balancePolicy == nil {
+		t.Fatal("no balance task policy in the built maintenance policy")
+	}
+	if balancePolicy.Enabled {
+		t.Error("balance enabled = true, want false from the persisted config")
+	}
+	if got := balancePolicy.GetBalanceConfig().GetMinServerCount(); got != 7 {
+		t.Errorf("balance min server count = %d, want persisted 7", got)
+	}
+
+	vacuumPolicy := config.Policy.TaskPolicies["vacuum"]
+	if vacuumPolicy == nil {
+		t.Fatal("no vacuum task policy in the built maintenance policy")
+	}
+	if vacuumPolicy.Enabled {
+		t.Error("vacuum enabled = true, want false from the persisted config")
+	}
+
+	// erasure_coding was never saved, so it keeps the loader's default of enabled.
+	ecPolicy := config.Policy.TaskPolicies["erasure_coding"]
+	if ecPolicy == nil {
+		t.Fatal("no erasure_coding task policy in the built maintenance policy")
+	}
+	if !ecPolicy.Enabled {
+		t.Error("erasure_coding enabled = false, want the default true for a config never saved")
+	}
+}
diff --git a/weed/admin/dash/maintenance_startup_test.go b/weed/admin/dash/maintenance_startup_test.go
new file mode 100644
index 0000000000..b0f300e025
--- /dev/null
+++ b/weed/admin/dash/maintenance_startup_test.go
@@ -0,0 +1,187 @@
+package dash
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/maintenance"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/balance"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/vacuum"
+	"github.com/seaweedfs/seaweedfs/weed/worker/types"
+	"google.golang.org/protobuf/proto"
+)
+
+// The task definitions these tests configure are process-global, so put them back the way a
+// fresh process would have them. Passing no config store makes every task fall back to its
+// own NewDefaultConfig, which is exactly the state package init left them in.
+func restoreGlobalTaskState(t *testing.T) {
+	t.Helper()
+
+	t.Cleanup(func() {
+		tasks.GetGlobalConfigUpdateRegistry().UpdateAllConfigs(nil)
+	})
+}
+
+// TestDisabledTaskIsNotScannedAfterStartup walks the admin server's startup sequence over a
+// data directory that has a disabled balance task saved in it, and checks the end state that
+// actually matters: the balance detector reports disabled, so ScanWithTaskDetectors skips it.
+//
+// This is the whole reported bug in one test. The reporter disabled balance, and the
+// scanner kept detecting balance tasks, cancelling them and re-detecting them. Two separate
+// defects had to line up for the disabled flag to survive to here: the policy had to be built
+// from the persisted configs rather than from a nil store, and the policy had to reach
+// detector.IsEnabled() rather than dying in a failed type assertion.
+func TestDisabledTaskIsNotScannedAfterStartup(t *testing.T) {
+	restoreGlobalTaskState(t)
+
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	// What the admin writes when a user turns balance off, and leaves vacuum on.
+	disabledBalance := balance.NewDefaultConfig()
+	disabledBalance.Enabled = false
+	if err := cp.SaveBalanceTaskPolicy(disabledBalance.ToTaskPolicy()); err != nil {
+		t.Fatalf("save balance policy: %v", err)
+	}
+
+	enabledVacuum := vacuum.NewDefaultConfig()
+	enabledVacuum.Enabled = true
+	if err := cp.SaveVacuumTaskPolicy(enabledVacuum.ToTaskPolicy()); err != nil {
+		t.Fatalf("save vacuum policy: %v", err)
+	}
+
+	// The admin server's startup sequence, in order:
+	// loadTaskConfigurationsFromPersistence, then InitMaintenanceManager.
+	tasks.GetGlobalConfigUpdateRegistry().UpdateAllConfigs(cp)
+
+	maintenanceConfig, err := cp.LoadMaintenanceConfig()
+	if err != nil {
+		t.Fatalf("load maintenance config: %v", err)
+	}
+	manager := maintenance.NewMaintenanceManager(nil, maintenanceConfig, cp)
+	if manager == nil {
+		t.Fatal("NewMaintenanceManager returned nil")
+	}
+
+	registry := tasks.GetGlobalTypesRegistry()
+
+	balanceDetector := registry.GetDetector(types.TaskTypeBalance)
+	if balanceDetector == nil {
+		t.Fatal("no balance detector registered")
+	}
+	if balanceDetector.IsEnabled() {
+		t.Error("balance detector reports enabled after startup over a data directory where " +
+			"balance is saved as disabled; the scanner will keep detecting and cancelling balance tasks")
+	}
+
+	vacuumDetector := registry.GetDetector(types.TaskTypeVacuum)
+	if vacuumDetector == nil {
+		t.Fatal("no vacuum detector registered")
+	}
+	if !vacuumDetector.IsEnabled() {
+		t.Error("vacuum detector reports disabled although vacuum is saved as enabled; " +
+			"the fix must not switch off tasks the user left on")
+	}
+
+	// Tasks the user never touched keep their compiled-in default of enabled rather than
+	// being switched off by a policy entry built from a config that was never saved.
+	for _, taskType := range []types.TaskType{types.TaskTypeErasureCoding, types.TaskTypeECBalance} {
+		detector := registry.GetDetector(taskType)
+		if detector == nil {
+			t.Fatalf("no %s detector registered", taskType)
+		}
+		if !detector.IsEnabled() {
+			t.Errorf("%s detector reports disabled although its config was never saved", taskType)
+		}
+	}
+}
+
+// TestLoadMaintenanceConfigKeepsPersistedEnabledFalse covers the top of issue-shaped startup:
+// an operator persisted enabled=false, and the load path used to lose it twice over — once to
+// ApplyDefaultsToProtobuf treating the bool zero value as unset, and once to an explicit
+// force-enable "migration" block. The persisted flag must come back as saved, while fields the
+// old file never carried still pick up their schema defaults.
+func TestLoadMaintenanceConfigKeepsPersistedEnabledFalse(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	// A file that only knows about the enabled flag: everything else zero.
+	if err := cp.SaveMaintenanceConfig(&MaintenanceConfig{Enabled: proto.Bool(false)}); err != nil {
+		t.Fatalf("save maintenance config: %v", err)
+	}
+
+	loaded, err := cp.LoadMaintenanceConfig()
+	if err != nil {
+		t.Fatalf("load maintenance config: %v", err)
+	}
+	if loaded.GetEnabled() {
+		t.Error("persisted enabled=false came back true; the maintenance system cannot be disabled")
+	}
+	if loaded.ScanIntervalSeconds != 30*60 {
+		t.Errorf("scan interval = %d, want schema default 1800 filled in", loaded.ScanIntervalSeconds)
+	}
+
+	// And with no file at all, the default is enabled.
+	fresh, err := NewConfigPersistence(t.TempDir()).LoadMaintenanceConfig()
+	if err != nil {
+		t.Fatalf("load maintenance config: %v", err)
+	}
+	if !fresh.GetEnabled() {
+		t.Error("maintenance not enabled by default when nothing is persisted")
+	}
+}
+
+// TestLoadMaintenanceConfigTreatsLegacyAbsentEnabledAsOn: a maintenance.pb written before
+// enabled tracked presence carries no enabled field on the wire whether the old default left
+// it false or an operator unchecked it — the two are indistinguishable. Such files must keep
+// the enabled default rather than silently switching maintenance off on upgrade; only a file
+// that explicitly persists the toggle may disable it.
+func TestLoadMaintenanceConfigTreatsLegacyAbsentEnabledAsOn(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	// What an old writer produced for enabled=false plus a tuned scan interval: the bool is
+	// simply absent from the wire.
+	if err := cp.SaveMaintenanceConfig(&MaintenanceConfig{ScanIntervalSeconds: 15 * 60}); err != nil {
+		t.Fatalf("save maintenance config: %v", err)
+	}
+
+	loaded, err := cp.LoadMaintenanceConfig()
+	if err != nil {
+		t.Fatalf("load maintenance config: %v", err)
+	}
+	if !loaded.GetEnabled() {
+		t.Error("legacy config without an enabled field loads as disabled; " +
+			"upgrading would silently switch the maintenance system off")
+	}
+	if loaded.ScanIntervalSeconds != 15*60 {
+		t.Errorf("scan interval = %d, want persisted 900 kept", loaded.ScanIntervalSeconds)
+	}
+}
+
+// TestPolicyMirrorsWhatTheDetectorsReport checks that the maintenance policy the queue and
+// the scanner run on agrees with the detectors. A disagreement means one of the two paths
+// into the task configs has gone stale again.
+func TestPolicyMirrorsWhatTheDetectorsReport(t *testing.T) {
+	restoreGlobalTaskState(t)
+
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	disabledBalance := balance.NewDefaultConfig()
+	disabledBalance.Enabled = false
+	if err := cp.SaveBalanceTaskPolicy(disabledBalance.ToTaskPolicy()); err != nil {
+		t.Fatalf("save balance policy: %v", err)
+	}
+
+	tasks.GetGlobalConfigUpdateRegistry().UpdateAllConfigs(cp)
+	policy := cp.buildPolicyFromTaskConfigs()
+
+	for taskType, detector := range tasks.GetGlobalTypesRegistry().GetAllDetectors() {
+		policyEnabled := maintenance.IsTaskEnabled(policy, maintenance.MaintenanceTaskType(taskType))
+		if policyEnabled != detector.IsEnabled() {
+			t.Errorf("%s: policy says enabled=%v but the detector says enabled=%v",
+				taskType, policyEnabled, detector.IsEnabled())
+		}
+	}
+}
diff --git a/weed/admin/dash/maintenance_task_persistence_test.go b/weed/admin/dash/maintenance_task_persistence_test.go
new file mode 100644
index 0000000000..ea72dcfbee
--- /dev/null
+++ b/weed/admin/dash/maintenance_task_persistence_test.go
@@ -0,0 +1,108 @@
+package dash
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/maintenance"
+)
+
+func countTaskStateFiles(t *testing.T, dir string) int {
+	t.Helper()
+	entries, err := os.ReadDir(filepath.Join(dir, TasksSubdir))
+	if os.IsNotExist(err) {
+		return 0
+	}
+	if err != nil {
+		t.Fatalf("read tasks dir: %v", err)
+	}
+	count := 0
+	for _, entry := range entries {
+		if !entry.IsDir() && filepath.Ext(entry.Name()) == ".pb" {
+			count++
+		}
+	}
+	return count
+}
+
+// TestCancelledTaskFilesDoNotAccumulate reproduces issue #11595: every scan
+// cycle cancels pending tasks of each detected type and re-detects them, so a
+// cancelled task file per candidate volume accumulates on disk forever.
+func TestCancelledTaskFilesDoNotAccumulate(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	queue := maintenance.NewMaintenanceQueue(nil)
+	queue.SetPersistence(cp)
+
+	for cycle := 0; cycle < 3; cycle++ {
+		queue.AddTask(&maintenance.MaintenanceTask{
+			ID:       fmt.Sprintf("ec_vol_%d_cycle_%d", cycle, cycle),
+			Type:     "erasure_coding",
+			VolumeID: uint32(cycle + 1),
+			Server:   "server1",
+		})
+		if cancelled := queue.CancelPendingTasksByType("erasure_coding"); cancelled != 1 {
+			t.Fatalf("cycle %d: cancelled %d tasks, want 1", cycle, cancelled)
+		}
+	}
+
+	if n := countTaskStateFiles(t, dir); n != 0 {
+		t.Errorf("%d task files on disk after %d cancel cycles, want 0", n, 3)
+	}
+}
+
+// TestManuallyCancelledTaskFileIsRemoved covers the CancelTask path used by
+// the UI: a cancelled pending task must not leave its file behind, where a
+// restart would resurrect it as pending.
+func TestManuallyCancelledTaskFileIsRemoved(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	manager := maintenance.NewMaintenanceManager(nil, nil, cp)
+	queue := manager.GetQueue()
+	queue.SetPersistence(cp)
+
+	queue.AddTask(&maintenance.MaintenanceTask{
+		ID:       "manual_1",
+		Type:     "vacuum",
+		VolumeID: 7,
+		Server:   "server1",
+	})
+	if n := countTaskStateFiles(t, dir); n != 1 {
+		t.Fatalf("%d task files after AddTask, want 1", n)
+	}
+
+	if err := manager.CancelTask("manual_1"); err != nil {
+		t.Fatalf("CancelTask: %v", err)
+	}
+	if n := countTaskStateFiles(t, dir); n != 0 {
+		t.Errorf("%d task files on disk after CancelTask, want 0", n)
+	}
+}
+
+// TestCleanupCompletedTasksBoundsCancelledFiles checks retention covers
+// cancelled files, e.g. ones written by older versions.
+func TestCleanupCompletedTasksBoundsCancelledFiles(t *testing.T) {
+	dir := t.TempDir()
+	cp := NewConfigPersistence(dir)
+
+	for i := 0; i < MaxCompletedTasks+5; i++ {
+		if err := cp.SaveTaskState(&maintenance.MaintenanceTask{
+			ID:     fmt.Sprintf("old_cancelled_%02d", i),
+			Type:   "erasure_coding",
+			Status: maintenance.TaskStatusCancelled,
+		}); err != nil {
+			t.Fatalf("save task state: %v", err)
+		}
+	}
+
+	if err := cp.CleanupCompletedTasks(); err != nil {
+		t.Fatalf("CleanupCompletedTasks: %v", err)
+	}
+	if n := countTaskStateFiles(t, dir); n > MaxCompletedTasks {
+		t.Errorf("%d task files after cleanup, want at most %d", n, MaxCompletedTasks)
+	}
+}
diff --git a/weed/admin/dash/plugin_api.go b/weed/admin/dash/plugin_api.go
index e21a4e1d19..c38b0aa26a 100644
--- a/weed/admin/dash/plugin_api.go
+++ b/weed/admin/dash/plugin_api.go
@@ -982,3 +982,27 @@ func parsePositiveInt(raw string, defaultValue int) int {
 }
 
 // cloneConfigValueMap is now exported by the plugin package as CloneConfigValueMap
+
+// GetPluginObservationsAPI returns what workers last reported about the objects
+// they inspected. Accepts an optional ?format= filter.
+//
+// These are cached, not live: a worker reports what it saw when it last looked,
+// and the timestamp is served with each one so a reader can judge the age.
+func (s *AdminServer) GetPluginObservationsAPI(w http.ResponseWriter, r *http.Request) {
+	plugin := s.GetPlugin()
+	if plugin == nil {
+		writeJSON(w, http.StatusOK, []interface{}{})
+		return
+	}
+
+	formatFilter := strings.TrimSpace(r.URL.Query().Get("format"))
+	observed := plugin.Observations().List()
+	payload := make([]interface{}, 0, len(observed))
+	for _, o := range observed {
+		if formatFilter != "" && !strings.EqualFold(o.Format, formatFilter) {
+			continue
+		}
+		payload = append(payload, o)
+	}
+	writeJSON(w, http.StatusOK, payload)
+}
diff --git a/weed/admin/dash/policies_management.go b/weed/admin/dash/policies_management.go
index 8f8d6dc277..8a736d4996 100644
--- a/weed/admin/dash/policies_management.go
+++ b/weed/admin/dash/policies_management.go
@@ -2,7 +2,9 @@ package dash
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/credential"
@@ -10,6 +12,10 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 )
 
+// ErrPolicyStillAttached is returned when deleting a managed policy that is
+// still attached to one or more users or groups.
+var ErrPolicyStillAttached = errors.New("policy is still attached")
+
 type IAMPolicy struct {
 	Name         string                       `json:"name"`
 	Document     policy_engine.PolicyDocument `json:"document"`
@@ -146,7 +152,10 @@ func (s *AdminServer) UpdatePolicy(name string, document policy_engine.PolicyDoc
 	return policyManager.UpdatePolicy(ctx, name, document)
 }
 
-// DeletePolicy deletes an IAM policy
+// DeletePolicy deletes an IAM policy. Deletion is rejected while the policy is
+// still attached to any user or group, matching AWS IAM behavior and the IAM
+// API handler, so a deleted policy name never lingers in an attached policy
+// list.
 func (s *AdminServer) DeletePolicy(name string) error {
 	policyManager := s.GetPolicyManager()
 	if policyManager == nil {
@@ -154,9 +163,67 @@ func (s *AdminServer) DeletePolicy(name string) error {
 	}
 
 	ctx := context.Background()
+	attached, err := s.IsPolicyAttached(ctx, name)
+	if err != nil {
+		return fmt.Errorf("failed to check policy attachments: %w", err)
+	}
+	if len(attached) > 0 {
+		return fmt.Errorf("policy %s is still attached to: %s: %w", name, strings.Join(attached, ", "), ErrPolicyStillAttached)
+	}
+
 	return policyManager.DeletePolicy(ctx, name)
 }
 
+// IsPolicyAttached returns the names of users and groups that still have the
+// given managed policy attached. The returned entries are prefixed with
+// "user:" or "group:". Returns nil when the policy is not attached anywhere.
+func (s *AdminServer) IsPolicyAttached(ctx context.Context, policyName string) ([]string, error) {
+	if s.credentialManager == nil {
+		return nil, fmt.Errorf("credential manager not available")
+	}
+
+	var attached []string
+
+	usernames, err := s.credentialManager.ListUsers(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list users: %w", err)
+	}
+	for _, username := range usernames {
+		policies, err := s.credentialManager.ListAttachedUserPolicies(ctx, username)
+		if err != nil {
+			return nil, fmt.Errorf("failed to list policies for user %s: %w", username, err)
+		}
+		for _, p := range policies {
+			if p == policyName {
+				attached = append(attached, "user:"+username)
+				break
+			}
+		}
+	}
+
+	groupNames, err := s.credentialManager.ListGroups(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list groups: %w", err)
+	}
+	for _, groupName := range groupNames {
+		group, err := s.credentialManager.GetGroup(ctx, groupName)
+		if errors.Is(err, credential.ErrGroupNotFound) {
+			continue
+		}
+		if err != nil {
+			return nil, fmt.Errorf("failed to get group %s: %w", groupName, err)
+		}
+		for _, p := range group.PolicyNames {
+			if p == policyName {
+				attached = append(attached, "group:"+groupName)
+				break
+			}
+		}
+	}
+
+	return attached, nil
+}
+
 // GetPolicy retrieves a specific IAM policy
 func (s *AdminServer) GetPolicy(name string) (*IAMPolicy, error) {
 	policyManager := s.GetPolicyManager()
diff --git a/weed/admin/dash/policies_management_test.go b/weed/admin/dash/policies_management_test.go
new file mode 100644
index 0000000000..b92de340ff
--- /dev/null
+++ b/weed/admin/dash/policies_management_test.go
@@ -0,0 +1,160 @@
+package dash
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/memory" // register memory store
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func newAdminServerWithMemoryStore(t *testing.T) *AdminServer {
+	t.Helper()
+	cm, err := credential.NewCredentialManagerWithDefaults(credential.StoreTypeMemory)
+	if err != nil {
+		t.Fatalf("failed to create credential manager: %v", err)
+	}
+	return &AdminServer{credentialManager: cm}
+}
+
+func samplePolicyDocument() policy_engine.PolicyDocument {
+	return policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{{
+			Effect:   policy_engine.PolicyEffectAllow,
+			Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+			Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::test/*"),
+		}},
+	}
+}
+
+func TestIsPolicyAttached(t *testing.T) {
+	server := newAdminServerWithMemoryStore(t)
+	ctx := context.Background()
+	const policyName = "policy_a"
+
+	if err := server.CreatePolicy(policyName, samplePolicyDocument()); err != nil {
+		t.Fatalf("CreatePolicy: %v", err)
+	}
+
+	if attached, err := server.IsPolicyAttached(ctx, policyName); err != nil {
+		t.Fatalf("IsPolicyAttached: %v", err)
+	} else if len(attached) != 0 {
+		t.Fatalf("expected no attachments, got %v", attached)
+	}
+
+	if err := server.credentialManager.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	if err := server.credentialManager.AttachUserPolicy(ctx, "alice", policyName); err != nil {
+		t.Fatalf("AttachUserPolicy: %v", err)
+	}
+
+	attached, err := server.IsPolicyAttached(ctx, policyName)
+	if err != nil {
+		t.Fatalf("IsPolicyAttached: %v", err)
+	}
+	if len(attached) != 1 || attached[0] != "user:alice" {
+		t.Fatalf("expected [user:alice], got %v", attached)
+	}
+
+	if err := server.credentialManager.CreateGroup(ctx, &iam_pb.Group{Name: "devs", PolicyNames: []string{policyName}}); err != nil {
+		t.Fatalf("CreateGroup: %v", err)
+	}
+	attached, err = server.IsPolicyAttached(ctx, policyName)
+	if err != nil {
+		t.Fatalf("IsPolicyAttached: %v", err)
+	}
+	if len(attached) != 2 {
+		t.Fatalf("expected 2 attachments, got %v", attached)
+	}
+}
+
+func TestDeletePolicyRejectsWhenAttachedToUser(t *testing.T) {
+	server := newAdminServerWithMemoryStore(t)
+	ctx := context.Background()
+	const policyName = "policy_u"
+
+	if err := server.CreatePolicy(policyName, samplePolicyDocument()); err != nil {
+		t.Fatalf("CreatePolicy: %v", err)
+	}
+	if err := server.credentialManager.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+	if err := server.credentialManager.AttachUserPolicy(ctx, "bob", policyName); err != nil {
+		t.Fatalf("AttachUserPolicy: %v", err)
+	}
+
+	if err := server.DeletePolicy(policyName); !errors.Is(err, ErrPolicyStillAttached) {
+		t.Fatalf("expected ErrPolicyStillAttached, got %v", err)
+	}
+
+	if p, err := server.GetPolicy(policyName); err != nil {
+		t.Fatalf("policy should still exist after rejected deletion: %v", err)
+	} else if p == nil {
+		t.Fatal("policy should still exist after rejected deletion, got nil")
+	}
+
+	attached, err := server.credentialManager.ListAttachedUserPolicies(ctx, "bob")
+	if err != nil {
+		t.Fatalf("ListAttachedUserPolicies: %v", err)
+	}
+	if len(attached) != 1 || attached[0] != policyName {
+		t.Fatalf("expected policy %q to remain attached, got %v", policyName, attached)
+	}
+
+	if err := server.credentialManager.DetachUserPolicy(ctx, "bob", policyName); err != nil {
+		t.Fatalf("DetachUserPolicy: %v", err)
+	}
+	if err := server.DeletePolicy(policyName); err != nil {
+		t.Fatalf("DeletePolicy after detach failed: %v", err)
+	}
+	if p, err := server.GetPolicy(policyName); err != nil {
+		t.Fatalf("GetPolicy after detach-delete: %v", err)
+	} else if p != nil {
+		t.Fatalf("policy should be gone after deletion, got %v", p)
+	}
+}
+
+func TestDeletePolicyRejectsWhenAttachedToGroup(t *testing.T) {
+	server := newAdminServerWithMemoryStore(t)
+	ctx := context.Background()
+	const policyName = "policy_g"
+
+	if err := server.CreatePolicy(policyName, samplePolicyDocument()); err != nil {
+		t.Fatalf("CreatePolicy: %v", err)
+	}
+	if err := server.credentialManager.CreateGroup(ctx, &iam_pb.Group{Name: "team_g", PolicyNames: []string{policyName}}); err != nil {
+		t.Fatalf("CreateGroup: %v", err)
+	}
+
+	if err := server.DeletePolicy(policyName); !errors.Is(err, ErrPolicyStillAttached) {
+		t.Fatalf("expected ErrPolicyStillAttached, got %v", err)
+	}
+
+	if p, err := server.GetPolicy(policyName); err != nil {
+		t.Fatalf("policy should still exist after rejected deletion: %v", err)
+	} else if p == nil {
+		t.Fatal("policy should still exist after rejected deletion, got nil")
+	}
+}
+
+func TestDeletePolicySucceedsWhenNotAttached(t *testing.T) {
+	server := newAdminServerWithMemoryStore(t)
+	const policyName = "policy_free"
+
+	if err := server.CreatePolicy(policyName, samplePolicyDocument()); err != nil {
+		t.Fatalf("CreatePolicy: %v", err)
+	}
+	if err := server.DeletePolicy(policyName); err != nil {
+		t.Fatalf("DeletePolicy for unattached policy failed: %v", err)
+	}
+	if p, err := server.GetPolicy(policyName); err != nil {
+		t.Fatalf("GetPolicy after delete: %v", err)
+	} else if p != nil {
+		t.Fatalf("policy should be gone after deletion, got %v", p)
+	}
+}
diff --git a/weed/admin/dash/principal_suggestions.go b/weed/admin/dash/principal_suggestions.go
new file mode 100644
index 0000000000..a3a2256820
--- /dev/null
+++ b/weed/admin/dash/principal_suggestions.go
@@ -0,0 +1,57 @@
+package dash
+
+import (
+	"context"
+
+	weediam "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// principalRoleArn builds the ARN SeaweedFS assigns a role by default (when
+// its RoleDefinition.RoleArn isn't explicitly set) - see
+// weed/iam/integration/iam_manager.go's CreateRole. ListRoles only returns
+// role names, so this reconstructs the well-known default rather than
+// fetching every role's stored definition just to populate a suggestion list.
+func principalRoleArn(roleName string) string {
+	return "arn:aws:iam::role/" + roleName
+}
+
+// GetPrincipalSuggestions returns candidate ARNs for the policy editor's
+// Principal/NotPrincipal autocomplete: one per S3 user, plus one per IAM
+// role. Service accounts are deliberately not listed separately - a service
+// account is just an additional credential for its parent user, so its ARN
+// is identical to the one already suggested for that user.
+//
+// Role listing is best-effort: if the filer or role store is unavailable,
+// the error is logged and suggestions fall back to users only, since an
+// incomplete autocomplete list is far less disruptive than blocking policy
+// editing over a suggestions-only feature.
+func (s *AdminServer) GetPrincipalSuggestions(ctx context.Context) ([]string, error) {
+	var suggestions []string
+
+	users, err := s.GetObjectStoreUsers(ctx)
+	if err != nil {
+		return nil, err
+	}
+	for _, u := range users {
+		suggestions = append(suggestions, weediam.UserArn(u.Username))
+	}
+
+	roleStore, err := integration.NewFilerRoleStore(nil, func() string { return s.GetFilerAddress() })
+	if err != nil {
+		glog.Warningf("GetPrincipalSuggestions: failed to create role store: %v", err)
+		return suggestions, nil
+	}
+	roleNames, err := roleStore.ListRoles(ctx, s.GetFilerAddress())
+	if err != nil {
+		glog.Warningf("GetPrincipalSuggestions: failed to list roles: %v", err)
+		return suggestions, nil
+	}
+	for _, roleName := range roleNames {
+		suggestions = append(suggestions, principalRoleArn(roleName))
+	}
+
+	return suggestions, nil
+}
diff --git a/weed/admin/dash/principal_suggestions_test.go b/weed/admin/dash/principal_suggestions_test.go
new file mode 100644
index 0000000000..8c3927ed13
--- /dev/null
+++ b/weed/admin/dash/principal_suggestions_test.go
@@ -0,0 +1,11 @@
+package dash
+
+import "testing"
+
+func TestPrincipalRoleArn(t *testing.T) {
+	got := principalRoleArn("S3ReadOnlyRole")
+	want := "arn:aws:iam::role/S3ReadOnlyRole"
+	if got != want {
+		t.Fatalf("principalRoleArn() = %q, want %q", got, want)
+	}
+}
diff --git a/weed/admin/dash/readonly_secret_redaction_test.go b/weed/admin/dash/readonly_secret_redaction_test.go
new file mode 100644
index 0000000000..cf8e66d574
--- /dev/null
+++ b/weed/admin/dash/readonly_secret_redaction_test.go
@@ -0,0 +1,75 @@
+package dash
+
+import (
+	"testing"
+)
+
+// TestIsReadOnlyRole verifies that only the read-only session role is treated
+// as view-only. The admin role and the empty role (used when auth is
+// disabled) must not be treated as read-only, otherwise admins and no-auth
+// deployments would lose legitimate access to credentials.
+func TestIsReadOnlyRole(t *testing.T) {
+	if !IsReadOnlyRole(RoleReadOnly) {
+		t.Errorf("IsReadOnlyRole(%q) = false, want true", RoleReadOnly)
+	}
+	if !IsReadOnlyRole("readonly") {
+		t.Errorf("IsReadOnlyRole(\"readonly\") = false, want true")
+	}
+	if IsReadOnlyRole("admin") {
+		t.Errorf("IsReadOnlyRole(\"admin\") = true, want false")
+	}
+	if IsReadOnlyRole("") {
+		t.Errorf("IsReadOnlyRole(\"\") = true, want false; no-auth mode must not be redacted")
+	}
+}
+
+// TestObjectStoreUserRedactSecretKey verifies that redaction clears the
+// reusable secret while preserving the public access key identifier.
+func TestObjectStoreUserRedactSecretKey(t *testing.T) {
+	u := ObjectStoreUser{
+		Username:  "victim",
+		AccessKey: "AKIAEXAMPLEKEY",
+		SecretKey: "super-secret-value",
+	}
+	u.RedactSecretKey()
+	if u.SecretKey != "" {
+		t.Errorf("SecretKey = %q, want empty after redaction", u.SecretKey)
+	}
+	if u.AccessKey == "" {
+		t.Errorf("AccessKey was emptied; only the secret should be redacted")
+	}
+	if u.Username == "" {
+		t.Errorf("Username was emptied; only the secret should be redacted")
+	}
+}
+
+// TestUserDetailsRedactSecretKeys verifies that redaction clears every
+// access key's secret while preserving the access key identifiers.
+func TestUserDetailsRedactSecretKeys(t *testing.T) {
+	d := &UserDetails{
+		Username: "victim",
+		AccessKeys: []AccessKeyInfo{
+			{AccessKey: "AKIAONE", SecretKey: "secret-one"},
+			{AccessKey: "AKIATWO", SecretKey: "secret-two"},
+		},
+	}
+	d.RedactSecretKeys()
+	for i, ak := range d.AccessKeys {
+		if ak.SecretKey != "" {
+			t.Errorf("AccessKeys[%d].SecretKey = %q, want empty after redaction", i, ak.SecretKey)
+		}
+		if ak.AccessKey == "" {
+			t.Errorf("AccessKeys[%d].AccessKey was emptied; only the secret should be redacted", i)
+		}
+	}
+}
+
+// TestUserDetailsRedactSecretKeys_Empty verifies redaction is a no-op
+// (and does not panic) when there are no access keys.
+func TestUserDetailsRedactSecretKeys_Empty(t *testing.T) {
+	d := &UserDetails{Username: "victim"}
+	d.RedactSecretKeys()
+	if len(d.AccessKeys) != 0 {
+		t.Errorf("expected no access keys, got %d", len(d.AccessKeys))
+	}
+}
diff --git a/weed/admin/dash/s3tables_management.go b/weed/admin/dash/s3tables_management.go
index 21aca5aed4..0db9e81d05 100644
--- a/weed/admin/dash/s3tables_management.go
+++ b/weed/admin/dash/s3tables_management.go
@@ -25,6 +25,7 @@ type S3TablesBucketsData struct {
 	Buckets      []S3TablesBucketSummary `json:"buckets"`
 	TotalBuckets int                     `json:"total_buckets"`
 	IcebergPort  int                     `json:"iceberg_port"`
+	LancePort    int                     `json:"lance_port"`
 	LastUpdated  time.Time               `json:"last_updated"`
 }
 
@@ -33,29 +34,45 @@ type S3TablesBucketSummary struct {
 	Name           string    `json:"name"`
 	OwnerAccountID string    `json:"ownerAccountId"`
 	CreatedAt      time.Time `json:"createdAt"`
+	// Format is empty for a bucket created before formats were declared. Such a
+	// bucket takes tables of either format, which is what it always did.
+	Format string `json:"format,omitempty"`
+	// PolicyStatementCount is the number of statements in the table bucket's
+	// resource policy, or 0 if it has none. Unrelated to the S3 bucket
+	// policy mechanism (policy_engine.PolicyDocument / s3-bucket-policy):
+	// S3 Tables stores its own s3tables.PolicyDocument under the
+	// s3tables.policy extended attribute.
+	PolicyStatementCount int `json:"policy_statement_count"`
 }
 
 type S3TablesNamespacesData struct {
 	Username        string                      `json:"username"`
 	BucketARN       string                      `json:"bucket_arn"`
+	BucketFormat    string                      `json:"bucket_format,omitempty"`
 	Namespaces      []s3tables.NamespaceSummary `json:"namespaces"`
 	TotalNamespaces int                         `json:"total_namespaces"`
 	LastUpdated     time.Time                   `json:"last_updated"`
 }
 
 type S3TablesTablesData struct {
-	Username    string                  `json:"username"`
-	BucketARN   string                  `json:"bucket_arn"`
-	Namespace   string                  `json:"namespace"`
-	Tables      []s3tables.TableSummary `json:"tables"`
-	TotalTables int                     `json:"total_tables"`
-	LastUpdated time.Time               `json:"last_updated"`
+	Username     string                  `json:"username"`
+	BucketARN    string                  `json:"bucket_arn"`
+	BucketFormat string                  `json:"bucket_format,omitempty"`
+	Namespace    string                  `json:"namespace"`
+	Tables       []s3tables.TableSummary `json:"tables"`
+	TotalTables  int                     `json:"total_tables"`
+	// ObservedRows holds what a worker last counted, by table name, for formats
+	// this server cannot read itself. A table nothing has looked at is absent
+	// rather than zero: those are different facts.
+	ObservedRows map[string]string `json:"observed_rows,omitempty"`
+	LastUpdated  time.Time         `json:"last_updated"`
 }
 
 type tableBucketMetadata struct {
 	Name           string    `json:"name"`
 	CreatedAt      time.Time `json:"createdAt"`
 	OwnerAccountID string    `json:"ownerAccountId"`
+	Format         string    `json:"format,omitempty"`
 }
 
 // S3Tables manager helpers
@@ -133,10 +150,12 @@ func (s *AdminServer) GetS3TablesBucketsData(ctx context.Context) (S3TablesBucke
 				continue
 			}
 			buckets = append(buckets, S3TablesBucketSummary{
-				ARN:            arn,
-				Name:           entry.Entry.Name,
-				OwnerAccountID: metadata.OwnerAccountID,
-				CreatedAt:      metadata.CreatedAt,
+				ARN:                  arn,
+				Name:                 entry.Entry.Name,
+				OwnerAccountID:       metadata.OwnerAccountID,
+				CreatedAt:            metadata.CreatedAt,
+				Format:               metadata.Format,
+				PolicyStatementCount: extractS3TablesPolicyStatementCountFromEntry(entry.Entry),
 			})
 		}
 		return nil
@@ -148,10 +167,77 @@ func (s *AdminServer) GetS3TablesBucketsData(ctx context.Context) (S3TablesBucke
 		Buckets:      buckets,
 		TotalBuckets: len(buckets),
 		IcebergPort:  s.icebergPort,
+		LancePort:    s.lancePort,
 		LastUpdated:  time.Now(),
 	}, nil
 }
 
+// extractS3TablesPolicyStatementCountFromEntry returns the number of
+// statements in the table bucket's resource policy, or 0 if it has none or
+// the stored JSON can't be parsed. Forgiving on parse failure, matching
+// extractPolicyStatementCountFromEntry (the S3 bucket policy equivalent in
+// admin_server.go, which is a different, unrelated policy mechanism).
+func extractS3TablesPolicyStatementCountFromEntry(entry *filer_pb.Entry) int {
+	policyJSON := entry.Extended[s3tables.ExtendedKeyPolicy]
+	if len(policyJSON) == 0 {
+		return 0
+	}
+	var doc s3tables.PolicyDocument
+	if err := json.Unmarshal(policyJSON, &doc); err != nil {
+		return 0
+	}
+	return len(doc.Statement)
+}
+
+// observedRowCounts collects what workers last reported for these tables. For a
+// format admin cannot read, this is the only row count that exists.
+func (s *AdminServer) observedRowCounts(bucketArn string, namespaceParts []string, tables []s3tables.TableSummary) map[string]string {
+	plugin := s.GetPlugin()
+	if plugin == nil || len(tables) == 0 {
+		return nil
+	}
+	bucketName, err := s3tables.ParseBucketNameFromARN(bucketArn)
+	if err != nil {
+		return nil
+	}
+	counts := make(map[string]string)
+	for _, table := range tables {
+		objectID := append(append([]string{bucketName}, namespaceParts...), table.Name)
+		if observed, ok := plugin.Observations().GetFormat(objectID, table.Format); ok {
+			if rows := observed.AttributeString("rows"); rows != "" {
+				counts[table.Name] = rows
+			}
+		}
+	}
+	if len(counts) == 0 {
+		return nil
+	}
+	return counts
+}
+
+// catalogPortForFormat is the port serving a format, or 0 when this cluster
+// does not run that catalog.
+func (s *AdminServer) catalogPortForFormat(format string) int {
+	if strings.EqualFold(format, s3tables.FormatLance) {
+		return s.lancePort
+	}
+	return s.icebergPort
+}
+
+// tableBucketFormat reports what the bucket says it holds, or "" for one made
+// before the declaration existed. A page inside a bucket asks so it can label
+// itself and constrain what can be created; failing to read it is not worth
+// failing the page over, so it degrades to undeclared.
+func (s *AdminServer) tableBucketFormat(ctx context.Context, bucketArn string) string {
+	var resp s3tables.GetTableBucketResponse
+	req := &s3tables.GetTableBucketRequest{TableBucketARN: bucketArn}
+	if err := s.executeS3TablesOperation(ctx, "GetTableBucket", req, &resp); err != nil {
+		glog.V(1).Infof("S3Tables: failed to read format of %s: %v", bucketArn, err)
+		return ""
+	}
+	return resp.Format
+}
+
 func (s *AdminServer) GetS3TablesNamespacesData(ctx context.Context, bucketArn string) (S3TablesNamespacesData, error) {
 	var resp s3tables.ListNamespacesResponse
 	req := &s3tables.ListNamespacesRequest{TableBucketARN: bucketArn, MaxNamespaces: s3TablesAdminListLimit}
@@ -160,6 +246,7 @@ func (s *AdminServer) GetS3TablesNamespacesData(ctx context.Context, bucketArn s
 	}
 	return S3TablesNamespacesData{
 		BucketARN:       bucketArn,
+		BucketFormat:    s.tableBucketFormat(ctx, bucketArn),
 		Namespaces:      resp.Namespaces,
 		TotalNamespaces: len(resp.Namespaces),
 		LastUpdated:     time.Now(),
@@ -180,13 +267,16 @@ func (s *AdminServer) GetS3TablesTablesData(ctx context.Context, bucketArn, name
 	if err := s.executeS3TablesOperation(ctx, "ListTables", req, &resp); err != nil {
 		return S3TablesTablesData{}, err
 	}
-	return S3TablesTablesData{
-		BucketARN:   bucketArn,
-		Namespace:   namespace,
-		Tables:      resp.Tables,
-		TotalTables: len(resp.Tables),
-		LastUpdated: time.Now(),
-	}, nil
+	data := S3TablesTablesData{
+		BucketARN:    bucketArn,
+		BucketFormat: s.tableBucketFormat(ctx, bucketArn),
+		Namespace:    namespace,
+		Tables:       resp.Tables,
+		TotalTables:  len(resp.Tables),
+		LastUpdated:  time.Now(),
+	}
+	data.ObservedRows = s.observedRowCounts(bucketArn, ns, resp.Tables)
+	return data, nil
 }
 
 // Iceberg Catalog data providers
@@ -299,9 +389,75 @@ func (s *AdminServer) GetIcebergTableDetailsData(ctx context.Context, catalogNam
 	}
 
 	applyIcebergMetadata(resp.Metadata, &details)
+	s.applyWorkerObservation(&details, bucketArn, namespaceParts, resp.Name)
 	return details, nil
 }
 
+// applyWorkerObservation fills in what a plugin worker last reported about a
+// table this server cannot read itself. Only the catalog knows a Lance table
+// exists; only a worker with the format's runtime can say what is in it, so
+// without this the page has nothing to show but a location.
+//
+// The observation is cached, not live, which is why the page carries the time
+// and the worker that took it.
+func (s *AdminServer) applyWorkerObservation(details *IcebergTableDetailsData, bucketArn string, namespaceParts []string, tableName string) {
+	if len(details.SchemaFields) > 0 {
+		return
+	}
+	plugin := s.GetPlugin()
+	if plugin == nil {
+		return
+	}
+	bucketName, err := s3tables.ParseBucketNameFromARN(bucketArn)
+	if err != nil {
+		return
+	}
+	objectID := append(append([]string{bucketName}, namespaceParts...), tableName)
+	observed, ok := plugin.Observations().GetFormat(objectID, details.Format)
+	if !ok {
+		return
+	}
+
+	details.ObservedBy = observed.WorkerID
+	details.ObservedAt = observed.ObservedAt
+	details.SchemaFields = observationSchemaFields(observed.AttributeString("schema"))
+	for _, name := range []string{"rows", "fragments", "versions"} {
+		if value := observed.AttributeString(name); value != "" {
+			details.Properties = append(details.Properties, IcebergPropertyInfo{Key: name, Value: value})
+		}
+	}
+}
+
+// observationSchemaFields parses the schema a worker reported. A schema it
+// could not render is not worth failing the page over.
+func observationSchemaFields(schema string) []IcebergSchemaFieldInfo {
+	if schema == "" {
+		return nil
+	}
+	var reported []struct {
+		Name     string `json:"name"`
+		Type     string `json:"type"`
+		Nullable bool   `json:"nullable"`
+	}
+	if err := json.Unmarshal([]byte(schema), &reported); err != nil {
+		return nil
+	}
+	fields := make([]IcebergSchemaFieldInfo, 0, len(reported))
+	for i, field := range reported {
+		encoded, err := json.Marshal(field.Type)
+		if err != nil {
+			continue
+		}
+		fields = append(fields, IcebergSchemaFieldInfo{
+			ID:       i + 1,
+			Name:     field.Name,
+			Type:     encoded,
+			Required: !field.Nullable,
+		})
+	}
+	return fields
+}
+
 type icebergFullMetadata struct {
 	FormatVersion     int                    `json:"format-version"`
 	TableUUID         string                 `json:"table-uuid"`
@@ -582,9 +738,10 @@ func (s *AdminServer) CreateS3TablesBucket(w http.ResponseWriter, r *http.Reques
 		return
 	}
 	var req struct {
-		Name  string            `json:"name"`
-		Tags  map[string]string `json:"tags"`
-		Owner string            `json:"owner"`
+		Name   string            `json:"name"`
+		Tags   map[string]string `json:"tags"`
+		Owner  string            `json:"owner"`
+		Format string            `json:"format"`
 	}
 	if err := decodeJSONBody(newJSONMaxReader(w, r), &req); err != nil {
 		writeJSONError(w, http.StatusBadRequest, "Invalid request: "+err.Error())
@@ -605,7 +762,24 @@ func (s *AdminServer) CreateS3TablesBucket(w http.ResponseWriter, r *http.Reques
 			return
 		}
 	}
-	createReq := &s3tables.CreateTableBucketRequest{Name: req.Name, Tags: req.Tags}
+	format := s3tables.FormatIceberg
+	if req.Format != "" {
+		normalized, ok := s3tables.NormalizeFormat(req.Format)
+		if !ok {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Unsupported format %q", req.Format))
+			return
+		}
+		format = normalized
+	}
+	// A bucket of a format this cluster does not serve is a bucket no client can
+	// reach. The picker disables the option; refuse it here too, since the API
+	// is reachable without the page.
+	if port := s.catalogPortForFormat(format); port == 0 {
+		writeJSONError(w, http.StatusBadRequest,
+			fmt.Sprintf("No %s endpoint is configured, so a %s bucket would be unreachable", format, format))
+		return
+	}
+	createReq := &s3tables.CreateTableBucketRequest{Name: req.Name, Tags: req.Tags, Format: format}
 	var resp s3tables.CreateTableBucketResponse
 	if err := s.executeS3TablesOperation(r.Context(), "CreateTableBucket", createReq, &resp); err != nil {
 		writeS3TablesError(w, err)
@@ -869,8 +1043,11 @@ func (s *AdminServer) GetS3TablesBucketPolicy(w http.ResponseWriter, r *http.Req
 	getReq := &s3tables.GetTableBucketPolicyRequest{TableBucketARN: bucketArn}
 	var resp s3tables.GetTableBucketPolicyResponse
 	if err := s.executeS3TablesOperation(r.Context(), "GetTableBucketPolicy", getReq, &resp); err != nil {
-		writeS3TablesError(w, err)
-		return
+		// No policy is a normal state for the UI (empty editor), not an error.
+		if !isS3TablesNoSuchPolicy(err) {
+			writeS3TablesError(w, err)
+			return
+		}
 	}
 	writeJSON(w, http.StatusOK, map[string]interface{}{"policy": resp.ResourcePolicy})
 }
@@ -937,8 +1114,10 @@ func (s *AdminServer) GetS3TablesTablePolicy(w http.ResponseWriter, r *http.Requ
 	getReq := &s3tables.GetTablePolicyRequest{TableBucketARN: bucketArn, Namespace: namespaceParts, Name: name}
 	var resp s3tables.GetTablePolicyResponse
 	if err := s.executeS3TablesOperation(r.Context(), "GetTablePolicy", getReq, &resp); err != nil {
-		writeS3TablesError(w, err)
-		return
+		if !isS3TablesNoSuchPolicy(err) {
+			writeS3TablesError(w, err)
+			return
+		}
 	}
 	writeJSON(w, http.StatusOK, map[string]interface{}{"policy": resp.ResourcePolicy})
 }
@@ -1051,6 +1230,11 @@ func writeS3TablesError(w http.ResponseWriter, err error) {
 	writeJSONError(w, s3TablesErrorStatus(err), parseS3TablesErrorMessage(err))
 }
 
+func isS3TablesNoSuchPolicy(err error) bool {
+	var s3Err *s3tables.S3TablesError
+	return errors.As(err, &s3Err) && s3Err.Type == s3tables.ErrCodeNoSuchPolicy
+}
+
 func s3TablesErrorStatus(err error) int {
 	var s3Err *s3tables.S3TablesError
 	if errors.As(err, &s3Err) {
diff --git a/weed/admin/dash/task_policy_defaults_test.go b/weed/admin/dash/task_policy_defaults_test.go
new file mode 100644
index 0000000000..3335232bbc
--- /dev/null
+++ b/weed/admin/dash/task_policy_defaults_test.go
@@ -0,0 +1,184 @@
+package dash
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/balance"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/ec_balance"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/vacuum"
+	"google.golang.org/protobuf/proto"
+)
+
+// TestLoadTaskPolicyDefaultsMatchTaskDefaults pins the persistence layer's "nothing saved
+// yet" defaults to each task's own NewDefaultConfig(). They used to be a second, hand-written
+// copy and had drifted: with a data directory but no config file on disk, vacuum ran on a 24h
+// scan interval instead of 2h, balance on 6h with a 0.1 imbalance threshold instead of 30m
+// with 0.2, and erasure coding on 168h with a 0.90 fullness ratio and a 1024MB minimum volume
+// size instead of 1h with 0.95 and 30MB - none of which is what the admin UI shows as the
+// default for those fields.
+func TestLoadTaskPolicyDefaultsMatchTaskDefaults(t *testing.T) {
+	cases := []struct {
+		name string
+		want *worker_pb.TaskPolicy
+		load func(cp *ConfigPersistence) (*worker_pb.TaskPolicy, error)
+	}{
+		{
+			name: "vacuum",
+			want: vacuum.NewDefaultConfig().ToTaskPolicy(),
+			load: func(cp *ConfigPersistence) (*worker_pb.TaskPolicy, error) { return cp.LoadVacuumTaskPolicy() },
+		},
+		{
+			name: "erasure_coding",
+			want: erasure_coding.NewDefaultConfig().ToTaskPolicy(),
+			load: func(cp *ConfigPersistence) (*worker_pb.TaskPolicy, error) {
+				return cp.LoadErasureCodingTaskPolicy()
+			},
+		},
+		{
+			name: "balance",
+			want: balance.NewDefaultConfig().ToTaskPolicy(),
+			load: func(cp *ConfigPersistence) (*worker_pb.TaskPolicy, error) { return cp.LoadBalanceTaskPolicy() },
+		},
+		{
+			name: "ec_balance",
+			want: ec_balance.NewDefaultConfig().ToTaskPolicy(),
+			load: func(cp *ConfigPersistence) (*worker_pb.TaskPolicy, error) { return cp.LoadEcBalanceTaskPolicy() },
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Both no-file branches have to agree with the task's own defaults: no data
+			// directory at all, and a data directory that has never been written to.
+			for _, cp := range []*ConfigPersistence{NewConfigPersistence(""), NewConfigPersistence(t.TempDir())} {
+				got, err := tc.load(cp)
+				if err != nil {
+					t.Fatalf("load %s policy: %v", tc.name, err)
+				}
+				if !proto.Equal(got, tc.want) {
+					t.Errorf("%s default policy (dataDir=%q) =\n  %v\nwant NewDefaultConfig().ToTaskPolicy() =\n  %v",
+						tc.name, cp.GetDataDir(), got, tc.want)
+				}
+			}
+		})
+	}
+}
+
+// TestLoadTaskConfigDefaultsMatchTaskDefaults covers the narrower Load*TaskConfig accessors,
+// which carried a third copy of the same defaults.
+func TestLoadTaskConfigDefaultsMatchTaskDefaults(t *testing.T) {
+	cp := NewConfigPersistence(t.TempDir())
+
+	vacuumConfig, err := cp.LoadVacuumTaskConfig()
+	if err != nil {
+		t.Fatalf("load vacuum config: %v", err)
+	}
+	if want := vacuum.NewDefaultConfig().ToTaskPolicy().GetVacuumConfig(); !proto.Equal(vacuumConfig, want) {
+		t.Errorf("vacuum default config = %v, want %v", vacuumConfig, want)
+	}
+
+	ecConfig, err := cp.LoadErasureCodingTaskConfig()
+	if err != nil {
+		t.Fatalf("load erasure coding config: %v", err)
+	}
+	if want := erasure_coding.NewDefaultConfig().ToTaskPolicy().GetErasureCodingConfig(); !proto.Equal(ecConfig, want) {
+		t.Errorf("erasure coding default config = %v, want %v", ecConfig, want)
+	}
+
+	balanceConfig, err := cp.LoadBalanceTaskConfig()
+	if err != nil {
+		t.Fatalf("load balance config: %v", err)
+	}
+	if want := balance.NewDefaultConfig().ToTaskPolicy().GetBalanceConfig(); !proto.Equal(balanceConfig, want) {
+		t.Errorf("balance default config = %v, want %v", balanceConfig, want)
+	}
+}
+
+// TestEcBalanceTaskPolicyRoundTrip checks the accessor ec_balance.LoadConfigFromPersistence
+// asserts on. Before it existed, ec_balance was the one registered maintenance task whose
+// configuration could not be persisted at all.
+func TestEcBalanceTaskPolicyRoundTrip(t *testing.T) {
+	cp := NewConfigPersistence(t.TempDir())
+
+	saved := ec_balance.NewDefaultConfig()
+	saved.Enabled = false
+	saved.MinServerCount = 9
+	saved.ImbalanceThreshold = 0.42
+	saved.CollectionFilter = "pictures"
+
+	if err := cp.SaveEcBalanceTaskPolicy(saved.ToTaskPolicy()); err != nil {
+		t.Fatalf("save ec_balance policy: %v", err)
+	}
+
+	loaded := ec_balance.LoadConfigFromPersistence(cp)
+	if loaded == nil {
+		t.Fatal("ec_balance.LoadConfigFromPersistence returned nil")
+	}
+	if loaded.Enabled {
+		t.Error("ec_balance enabled = true, want the persisted false")
+	}
+	if loaded.MinServerCount != 9 {
+		t.Errorf("ec_balance min server count = %d, want the persisted 9", loaded.MinServerCount)
+	}
+	if loaded.ImbalanceThreshold != 0.42 {
+		t.Errorf("ec_balance imbalance threshold = %v, want the persisted 0.42", loaded.ImbalanceThreshold)
+	}
+	if loaded.CollectionFilter != "pictures" {
+		t.Errorf("ec_balance collection filter = %q, want the persisted %q", loaded.CollectionFilter, "pictures")
+	}
+
+	// The generic dispatcher the maintenance manager uses has to know the type too, and
+	// has to write the same file the dedicated loader reads.
+	dispatched := NewConfigPersistence(t.TempDir())
+	if err := dispatched.SaveTaskPolicy("ec_balance", saved.ToTaskPolicy()); err != nil {
+		t.Fatalf("SaveTaskPolicy(ec_balance): %v", err)
+	}
+	roundTripped := ec_balance.LoadConfigFromPersistence(dispatched)
+	if roundTripped == nil || roundTripped.MinServerCount != 9 {
+		t.Errorf("SaveTaskPolicy(ec_balance) did not round-trip through the ec_balance store: %+v", roundTripped)
+	}
+}
+
+// TestBuildPolicyKeepsTaskSpecificFields guards the fields the hand-written policy builder
+// used to drop on the floor: the erasure coding preferred tags and replica placement, and
+// the balance IO rate limit. Building each entry from the task's own ToTaskPolicy() keeps
+// them, so a value set in admin.toml survives into the maintenance policy.
+func TestBuildPolicyKeepsTaskSpecificFields(t *testing.T) {
+	cp := NewConfigPersistence(t.TempDir())
+
+	ecConfig := erasure_coding.NewDefaultConfig()
+	ecConfig.PreferredTags = []string{"ssd", "archive"}
+	ecConfig.ReplicaPlacement = "020"
+	if err := cp.SaveErasureCodingTaskPolicy(ecConfig.ToTaskPolicy()); err != nil {
+		t.Fatalf("save erasure coding policy: %v", err)
+	}
+
+	balanceConfig := balance.NewDefaultConfig()
+	balanceConfig.IoBytePerSecond = 5 << 20
+	if err := cp.SaveBalanceTaskPolicy(balanceConfig.ToTaskPolicy()); err != nil {
+		t.Fatalf("save balance policy: %v", err)
+	}
+
+	policy := cp.buildPolicyFromTaskConfigs()
+
+	ecPolicy := policy.TaskPolicies["erasure_coding"].GetErasureCodingConfig()
+	if ecPolicy == nil {
+		t.Fatal("no erasure coding config in the built policy")
+	}
+	if got := ecPolicy.GetReplicaPlacement(); got != "020" {
+		t.Errorf("erasure coding replica placement = %q, want the persisted %q", got, "020")
+	}
+	if got := ecPolicy.GetPreferredTags(); len(got) != 2 || got[0] != "ssd" || got[1] != "archive" {
+		t.Errorf("erasure coding preferred tags = %v, want the persisted [ssd archive]", got)
+	}
+
+	balancePolicy := policy.TaskPolicies["balance"].GetBalanceConfig()
+	if balancePolicy == nil {
+		t.Fatal("no balance config in the built policy")
+	}
+	if got := balancePolicy.GetIoBytePerSecond(); got != 5<<20 {
+		t.Errorf("balance IO limit = %d, want the persisted %d", got, 5<<20)
+	}
+}
diff --git a/weed/admin/dash/tier_stats.go b/weed/admin/dash/tier_stats.go
new file mode 100644
index 0000000000..97f379dadf
--- /dev/null
+++ b/weed/admin/dash/tier_stats.go
@@ -0,0 +1,134 @@
+package dash
+
+import (
+	"sort"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+)
+
+// TierStats aggregates the volumes and EC shards that live on one storage
+// tier: a local disk type ("hdd", "ssd", or a custom tag), or the remote
+// storage a tiered volume was uploaded to. A remote-tiered volume reports
+// the size of its cloud object, so its bytes belong to the remote tier,
+// not to the local disk that holds only its index.
+type TierStats struct {
+	Name         string `json:"name"`
+	IsRemote     bool   `json:"is_remote"`
+	VolumeCount  int    `json:"volume_count"`
+	EcShardCount int    `json:"ec_shard_count"`
+	DataSize     int64  `json:"data_size"`
+	DiskUsed     int64  `json:"disk_used"`
+	DiskCapacity int64  `json:"disk_capacity"`
+	MaxVolumes   int64  `json:"max_volumes"`
+}
+
+// UsagePercent is the tier's local disk usage in percent, clamped to
+// [0, 100]. Remote tiers have no capacity and return 0.
+func (t TierStats) UsagePercent() int {
+	if t.IsRemote || t.DiskCapacity <= 0 {
+		return 0
+	}
+	percent := int(float64(t.DiskUsed) / float64(t.DiskCapacity) * 100)
+	if percent < 0 {
+		return 0
+	}
+	if percent > 100 {
+		return 100
+	}
+	return percent
+}
+
+// tierDiskType maps the empty disk type to its display name.
+func tierDiskType(diskType string) string {
+	if diskType == "" {
+		return "hdd"
+	}
+	return diskType
+}
+
+// CollectTierStats walks the topology and groups capacity and usage by
+// tier. DiskUsed/DiskCapacity come from the statfs numbers the volume
+// servers report per disk type; a disk that predates disk_total_bytes
+// falls back to the slot-based capacity estimate and to the logical
+// bytes it holds, so mixed-version tiers don't underreport usage.
+// Remote tiers have no local disk, so only VolumeCount and DataSize are
+// meaningful there.
+func CollectTierStats(topo *master_pb.TopologyInfo, volumeSizeLimitMb uint64) []TierStats {
+	if topo == nil {
+		return nil
+	}
+	tiers := make(map[string]*TierStats)
+	tier := func(name string, isRemote bool) *TierStats {
+		key := name
+		if isRemote {
+			key = "remote\x00" + name
+		}
+		t := tiers[key]
+		if t == nil {
+			t = &TierStats{Name: name, IsRemote: isRemote}
+			tiers[key] = t
+		}
+		return t
+	}
+
+	for _, dc := range topo.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, node := range rack.DataNodeInfos {
+				for _, diskInfo := range node.DiskInfos {
+					local := tier(tierDiskType(diskInfo.Type), false)
+					local.MaxVolumes += diskInfo.MaxVolumeCount
+					hasStatfs := diskInfo.DiskTotalBytes > 0
+					if hasStatfs {
+						local.DiskCapacity += int64(diskInfo.DiskTotalBytes)
+						if diskInfo.DiskTotalBytes > diskInfo.DiskFreeBytes {
+							local.DiskUsed += int64(diskInfo.DiskTotalBytes - diskInfo.DiskFreeBytes)
+						}
+					} else {
+						local.DiskCapacity += diskInfo.MaxVolumeCount * int64(volumeSizeLimitMb) * 1024 * 1024
+					}
+
+					var diskLocalBytes int64
+					for _, volInfo := range diskInfo.VolumeInfos {
+						if volInfo.RemoteStorageName != "" {
+							remote := tier(volInfo.RemoteStorageName, true)
+							remote.VolumeCount++
+							remote.DataSize += int64(volInfo.Size)
+						} else {
+							local.VolumeCount++
+							local.DataSize += int64(volInfo.Size)
+							diskLocalBytes += int64(volInfo.Size)
+						}
+					}
+
+					// ShardSizes is local to this node, so summing across
+					// nodes gives the tier's physical footprint.
+					for _, ecShardInfo := range diskInfo.EcShardInfos {
+						local.EcShardCount += erasure_coding.GetShardCount(ecShardInfo)
+						ecBytes := erasure_coding.EcShardsTotalSize(ecShardInfo)
+						local.DataSize += ecBytes
+						diskLocalBytes += ecBytes
+					}
+
+					// Without statfs numbers, approximate this disk's
+					// footprint with the logical bytes it holds.
+					if !hasStatfs {
+						local.DiskUsed += diskLocalBytes
+					}
+				}
+			}
+		}
+	}
+
+	result := make([]TierStats, 0, len(tiers))
+	for _, t := range tiers {
+		result = append(result, *t)
+	}
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].IsRemote != result[j].IsRemote {
+			return !result[i].IsRemote
+		}
+		return result[i].Name < result[j].Name
+	})
+	return result
+}
diff --git a/weed/admin/dash/tier_stats_test.go b/weed/admin/dash/tier_stats_test.go
new file mode 100644
index 0000000000..543033731b
--- /dev/null
+++ b/weed/admin/dash/tier_stats_test.go
@@ -0,0 +1,91 @@
+package dash
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+func TestCollectTierStats(t *testing.T) {
+	topo := &master_pb.TopologyInfo{
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id: "dc1",
+			RackInfos: []*master_pb.RackInfo{{
+				Id: "rack1",
+				DataNodeInfos: []*master_pb.DataNodeInfo{
+					{
+						Id: "node1:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"": {
+								Type:           "",
+								MaxVolumeCount: 10,
+								DiskTotalBytes: 1_000_000,
+								DiskFreeBytes:  400_000,
+								VolumeInfos: []*master_pb.VolumeInformationMessage{
+									{Id: 1, Size: 1000},
+									{Id: 2, Size: 5000, RemoteStorageName: "s3.backup", RemoteStorageKey: "/2.dat"},
+								},
+								EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{
+									{Id: 7, EcIndexBits: 0b111, ShardSizes: []int64{10, 20, 30}},
+								},
+							},
+						},
+					},
+					{
+						Id: "node2:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"ssd": {
+								Type:           "ssd",
+								MaxVolumeCount: 5,
+								// No statfs numbers: capacity falls back to
+								// slots and usage to logical bytes.
+								VolumeInfos: []*master_pb.VolumeInformationMessage{
+									{Id: 3, Size: 2000, DiskType: "ssd"},
+									{Id: 4, Size: 7000, DiskType: "ssd", RemoteStorageName: "s3.backup", RemoteStorageKey: "/4.dat"},
+									{Id: 5, Size: 100, DiskType: "ssd", RemoteStorageName: "gcs.archive", RemoteStorageKey: "/5.dat"},
+								},
+							},
+						},
+					},
+					{
+						// An old server without statfs numbers sharing the
+						// hdd tier with node1: its logical bytes must still
+						// count toward the tier's DiskUsed.
+						Id: "node3:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"": {
+								Type:           "",
+								MaxVolumeCount: 2,
+								VolumeInfos: []*master_pb.VolumeInformationMessage{
+									{Id: 6, Size: 800},
+								},
+							},
+						},
+					},
+				},
+			}},
+		}},
+	}
+
+	got := CollectTierStats(topo, 30)
+
+	want := []TierStats{
+		{Name: "hdd", VolumeCount: 2, EcShardCount: 3, DataSize: 1860, DiskUsed: 600_800, DiskCapacity: 1_000_000 + 2*30*1024*1024, MaxVolumes: 12},
+		{Name: "ssd", VolumeCount: 1, DataSize: 2000, DiskUsed: 2000, DiskCapacity: 5 * 30 * 1024 * 1024, MaxVolumes: 5},
+		{Name: "gcs.archive", IsRemote: true, VolumeCount: 1, DataSize: 100},
+		{Name: "s3.backup", IsRemote: true, VolumeCount: 2, DataSize: 12000},
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("CollectTierStats mismatch:\n got: %+v\nwant: %+v", got, want)
+	}
+}
+
+func TestCollectTierStatsEmpty(t *testing.T) {
+	if got := CollectTierStats(nil, 30); got != nil {
+		t.Errorf("expected nil for nil topology, got %+v", got)
+	}
+	if got := CollectTierStats(&master_pb.TopologyInfo{}, 30); len(got) != 0 {
+		t.Errorf("expected no tiers for empty topology, got %+v", got)
+	}
+}
diff --git a/weed/admin/dash/topic_retention.go b/weed/admin/dash/topic_retention.go
index 1a91403682..22e1181844 100644
--- a/weed/admin/dash/topic_retention.go
+++ b/weed/admin/dash/topic_retention.go
@@ -277,11 +277,7 @@ func (p *TopicRetentionPurger) deleteDirectoryRecursively(client filer_pb.Seawee
 			}
 		} else {
 			// Delete file
-			_, err = client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
-				Directory: dirPath,
-				Name:      resp.Entry.Name,
-			})
-			if err != nil {
+			if err := filer_pb.DoRemove(context.Background(), client, dirPath, resp.Entry.Name, false, false, false, false, nil); err != nil {
 				return fmt.Errorf("failed to delete file %s: %v", entryPath, err)
 			}
 		}
@@ -291,11 +287,7 @@ func (p *TopicRetentionPurger) deleteDirectoryRecursively(client filer_pb.Seawee
 	parentDir := path.Dir(dirPath)
 	dirName := path.Base(dirPath)
 
-	_, err = client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
-		Directory: parentDir,
-		Name:      dirName,
-	})
-	if err != nil {
+	if err := filer_pb.DoRemove(context.Background(), client, parentDir, dirName, false, false, false, false, nil); err != nil {
 		return fmt.Errorf("failed to delete directory %s: %v", dirPath, err)
 	}
 
diff --git a/weed/admin/dash/types.go b/weed/admin/dash/types.go
index 6fb8f55c6c..b30da79612 100644
--- a/weed/admin/dash/types.go
+++ b/weed/admin/dash/types.go
@@ -19,6 +19,9 @@ type ClusterTopology struct {
 	TotalChunks int64     `json:"total_chunks"`
 	TotalSize   int64     `json:"total_size"`
 	UpdatedAt   time.Time `json:"updated_at"`
+	// TierStats breaks volumes and EC shards down by storage tier: local
+	// disk types plus one entry per remote storage holding tiered volumes.
+	TierStats []TierStats `json:"tier_stats"`
 }
 
 type MasterNode struct {
@@ -52,6 +55,11 @@ type VolumeServer struct {
 	EcVolumes      int                  `json:"ec_volumes"`       // Number of EC volumes this server has shards for
 	EcShards       int                  `json:"ec_shards"`        // Total number of EC shards on this server
 	EcShardDetails []VolumeServerEcInfo `json:"ec_shard_details"` // Detailed EC shard information
+
+	// RemoteSize is the bytes this server's remote-tiered volumes hold in
+	// cloud storage. Those bytes are excluded from DiskUsage, which only
+	// counts what occupies local disks.
+	RemoteSize int64 `json:"remote_size"`
 }
 
 func (vs *VolumeServer) GetDisplayAddress() string {
@@ -90,6 +98,12 @@ type S3Bucket struct {
 
 	LifecycleRuleCount    int `json:"lifecycle_rule_count"`
 	LifecycleEnabledCount int `json:"lifecycle_enabled_count"`
+
+	// PolicyStatementCount is the number of statements in the bucket policy,
+	// or 0 if the bucket has none. A policy document can't have zero
+	// statements (see policy_engine.ValidatePolicy), so >0 is a faithful
+	// "has a policy" flag.
+	PolicyStatementCount int `json:"policy_statement_count"`
 }
 
 type S3Object struct {
@@ -770,4 +784,8 @@ type IcebergTableDetailsData struct {
 	TotalSizeBytes   int64                       `json:"total_size_bytes"`
 	HasTotalSize     bool                        `json:"has_total_size"`
 	MetadataError    string                      `json:"metadata_error,omitempty"`
+	// Set when the details came from a plugin worker rather than from metadata
+	// this server can read, so the page can say whose account it is and when.
+	ObservedBy string    `json:"observed_by,omitempty"`
+	ObservedAt time.Time `json:"observed_at,omitempty"`
 }
diff --git a/weed/admin/dash/volume_export.go b/weed/admin/dash/volume_export.go
index 58a63d9efb..520e964562 100644
--- a/weed/admin/dash/volume_export.go
+++ b/weed/admin/dash/volume_export.go
@@ -5,6 +5,7 @@ import (
 	"sort"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
@@ -93,7 +94,6 @@ type ExportVolume struct {
 	DiskType          string  `json:"disk_type"`
 	DiskId            uint32  `json:"disk_id"`
 	RemoteStorageName string  `json:"remote_storage_name,omitempty"`
-	RemoteStorageKey  string  `json:"remote_storage_key,omitempty"`
 }
 
 type ExportEcShard struct {
@@ -122,7 +122,7 @@ func (s *AdminServer) ExportClusterVolumeList(ctx context.Context, collection st
 	}
 
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(ctx, &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(ctx, client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
@@ -251,7 +251,6 @@ func buildExportVolume(m *master_pb.VolumeInformationMessage, volumeSizeLimit ui
 		DiskType:          m.DiskType,
 		DiskId:            m.DiskId,
 		RemoteStorageName: m.RemoteStorageName,
-		RemoteStorageKey:  m.RemoteStorageKey,
 	}
 	// Decode replica placement and TTL the way volume.list does.
 	if vi, err := storage.NewVolumeInfo(m); err == nil {
diff --git a/weed/admin/dash/volume_management.go b/weed/admin/dash/volume_management.go
index a0543a647a..da848e1eab 100644
--- a/weed/admin/dash/volume_management.go
+++ b/weed/admin/dash/volume_management.go
@@ -7,7 +7,9 @@ import (
 	"sort"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 )
 
@@ -32,7 +34,7 @@ func (s *AdminServer) GetClusterVolumes(page int, pageSize int, sortBy string, s
 
 	// Get detailed volume information via gRPC
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
@@ -121,7 +123,11 @@ func (s *AdminServer) GetClusterVolumes(page int, pageSize int, sortBy string, s
 	diskTypeMap := make(map[string]bool)
 	collectionMap := make(map[string]bool)
 	versionMap := make(map[string]bool)
+	hasRemoteVolumes := false
 	for _, volume := range volumes {
+		if volume.RemoteStorageName != "" {
+			hasRemoteVolumes = true
+		}
 		if volume.DataCenter != "" {
 			dataCenterMap[volume.DataCenter] = true
 		}
@@ -189,7 +195,9 @@ func (s *AdminServer) GetClusterVolumes(page int, pageSize int, sortBy string, s
 	// Determine conditional display flags and extract single values
 	showDataCenterColumn := dataCenterCount > 1
 	showRackColumn := rackCount > 1
-	showDiskTypeColumn := diskTypeCount > 1
+	// Remote-tiered volumes surface in the disk type column, so show it
+	// whenever any volume lives on a remote tier.
+	showDiskTypeColumn := diskTypeCount > 1 || hasRemoteVolumes
 	showCollectionColumn := collectionCount > 1 && collection == "" // Hide column when filtering by collection
 	showVersionColumn := versionCount > 1
 
@@ -309,7 +317,7 @@ func (s *AdminServer) sortVolumes(volumes []VolumeWithTopology, sortBy string, s
 }
 
 // GetVolumeDetails retrieves detailed information about a specific volume
-func (s *AdminServer) GetVolumeDetails(volumeID int, server string) (*VolumeDetailsData, error) {
+func (s *AdminServer) GetVolumeDetails(volumeID uint32, server string) (*VolumeDetailsData, error) {
 	var primaryVolume VolumeWithTopology
 	var replicas []VolumeWithTopology
 	var volumeSizeLimit uint64
@@ -317,7 +325,7 @@ func (s *AdminServer) GetVolumeDetails(volumeID int, server string) (*VolumeDeta
 
 	// Find the volume and all its replicas in the cluster
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{VolumeIds: []uint32{volumeID}})
 		if err != nil {
 			return err
 		}
@@ -328,7 +336,8 @@ func (s *AdminServer) GetVolumeDetails(volumeID int, server string) (*VolumeDeta
 					for _, node := range rack.DataNodeInfos {
 						for _, diskInfo := range node.DiskInfos {
 							for _, volInfo := range diskInfo.VolumeInfos {
-								if int(volInfo.Id) == volumeID {
+								// An older master ignores the filter.
+								if volInfo.Id == volumeID {
 									diskType := volInfo.DiskType
 									if diskType == "" {
 										diskType = "hdd"
@@ -391,6 +400,57 @@ func (s *AdminServer) GetVolumeDetails(volumeID int, server string) (*VolumeDeta
 	}, nil
 }
 
+// SetVolumeReadOnly changes the access mode of a single volume replica.
+func (s *AdminServer) SetVolumeReadOnly(ctx context.Context, volumeID uint32, server string, readOnly bool) error {
+	var address pb.ServerAddress
+	err := s.masterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+		resp, err := client.VolumeList(ctx, &master_pb.VolumeListRequest{VolumeIds: []uint32{volumeID}})
+		if err != nil {
+			return err
+		}
+		address, err = volumeReplicaAddress(resp.GetTopologyInfo(), volumeID, server)
+		return err
+	})
+	if err != nil {
+		return err
+	}
+
+	return s.WithVolumeServerClient(address, func(client volume_server_pb.VolumeServerClient) error {
+		if readOnly {
+			_, err := client.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{
+				VolumeId: volumeID,
+				Persist:  true,
+			})
+			return err
+		}
+		_, err := client.VolumeMarkWritable(ctx, &volume_server_pb.VolumeMarkWritableRequest{VolumeId: volumeID})
+		return err
+	})
+}
+
+// Resolve the selected replica through the master rather than dialing a
+// user-supplied address. Node IDs can differ from their network addresses.
+func volumeReplicaAddress(topology *master_pb.TopologyInfo, volumeID uint32, server string) (pb.ServerAddress, error) {
+	for _, dc := range topology.GetDataCenterInfos() {
+		for _, rack := range dc.GetRackInfos() {
+			for _, node := range rack.GetDataNodeInfos() {
+				if node.GetId() != server {
+					continue
+				}
+				for _, disk := range node.GetDiskInfos() {
+					for _, volume := range disk.GetVolumeInfos() {
+						// Older masters may ignore the volume ID filter.
+						if volume.GetId() == volumeID {
+							return pb.NewServerAddressFromDataNode(node), nil
+						}
+					}
+				}
+			}
+		}
+	}
+	return "", fmt.Errorf("volume %d not found on server %s", volumeID, server)
+}
+
 // VacuumVolume performs a vacuum operation on a specific volume
 func (s *AdminServer) VacuumVolume(volumeID int, server string) error {
 	// Validate volumeID range before converting to uint32
@@ -418,7 +478,7 @@ func (s *AdminServer) GetClusterVolumeServers() (*ClusterVolumeServersData, erro
 
 	// Make only ONE VolumeList call and use it for both topology building AND EC shard processing
 	err := s.WithMasterClient(func(client master_pb.SeaweedClient) error {
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
@@ -480,10 +540,17 @@ func (s *AdminServer) GetClusterVolumeServers() (*ClusterVolumeServersData, erro
 								vs.DiskCapacity += int64(diskInfo.MaxVolumeCount) * int64(volumeSizeLimitMB) * 1024 * 1024
 							}
 
-							// Count regular volumes and calculate disk usage
+							// Count regular volumes and calculate disk usage.
+							// A remote-tiered volume reports its cloud object's
+							// size; keep those bytes out of the local disk usage
+							// that is compared against DiskCapacity.
 							for _, volInfo := range diskInfo.VolumeInfos {
 								vs.Volumes++
-								vs.DiskUsage += int64(volInfo.Size)
+								if volInfo.RemoteStorageName != "" {
+									vs.RemoteSize += int64(volInfo.Size)
+								} else {
+									vs.DiskUsage += int64(volInfo.Size)
+								}
 							}
 
 							// Accumulate EC shard information across all disks for this volume server
diff --git a/weed/admin/dash/volume_management_test.go b/weed/admin/dash/volume_management_test.go
new file mode 100644
index 0000000000..7381dec71f
--- /dev/null
+++ b/weed/admin/dash/volume_management_test.go
@@ -0,0 +1,159 @@
+package dash
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+type volumeAccessTestMaster struct {
+	master_pb.UnimplementedSeaweedServer
+	topology *master_pb.TopologyInfo
+}
+
+type volumeAccessTestServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	rpcError error
+	calls    chan any
+}
+
+func (s *volumeAccessTestMaster) KeepConnected(stream master_pb.Seaweed_KeepConnectedServer) error {
+	if _, err := stream.Recv(); err != nil {
+		return err
+	}
+	if err := stream.Send(&master_pb.KeepConnectedResponse{}); err != nil {
+		return err
+	}
+	<-stream.Context().Done()
+	return stream.Context().Err()
+}
+
+func (s *volumeAccessTestMaster) VolumeList(context.Context, *master_pb.VolumeListRequest) (*master_pb.VolumeListResponse, error) {
+	// Return unfiltered topology to exercise compatibility with older masters.
+	return &master_pb.VolumeListResponse{TopologyInfo: s.topology}, nil
+}
+
+func (s *volumeAccessTestServer) VolumeMarkReadonly(_ context.Context, req *volume_server_pb.VolumeMarkReadonlyRequest) (*volume_server_pb.VolumeMarkReadonlyResponse, error) {
+	s.calls <- req
+	return &volume_server_pb.VolumeMarkReadonlyResponse{}, s.rpcError
+}
+
+func (s *volumeAccessTestServer) VolumeMarkWritable(_ context.Context, req *volume_server_pb.VolumeMarkWritableRequest) (*volume_server_pb.VolumeMarkWritableResponse, error) {
+	s.calls <- req
+	return &volume_server_pb.VolumeMarkWritableResponse{}, s.rpcError
+}
+
+func volumeAccessTestTopology(nodes ...*master_pb.DataNodeInfo) *master_pb.TopologyInfo {
+	return &master_pb.TopologyInfo{DataCenterInfos: []*master_pb.DataCenterInfo{{
+		RackInfos: []*master_pb.RackInfo{{DataNodeInfos: nodes}},
+	}}}
+}
+
+func TestSetVolumeReadOnly(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		readOnly bool
+		volumeID uint32
+		server   string
+		rpcError error
+		wantCall bool
+	}{
+		{name: "persist read-only", readOnly: true, volumeID: 7, server: "node-a", wantCall: true},
+		{name: "restore read-write", volumeID: 7, server: "node-a", wantCall: true},
+		{name: "propagate volume server error", volumeID: 7, server: "node-a", wantCall: true, rpcError: status.Error(codes.PermissionDenied, "server is in maintenance mode")},
+		{name: "reject unknown volume", readOnly: true, volumeID: 8, server: "node-a"},
+		{name: "reject unknown server", readOnly: true, volumeID: 7, server: "127.0.0.1:9999"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			listener, err := net.Listen("tcp", "127.0.0.1:0")
+			require.NoError(t, err)
+			port := listener.Addr().(*net.TCPAddr).Port
+			master := &volumeAccessTestMaster{
+				topology: volumeAccessTestTopology(&master_pb.DataNodeInfo{
+					Id: "node-a", Address: "127.0.0.1:8080", GrpcPort: uint32(port),
+					DiskInfos: map[string]*master_pb.DiskInfo{"hdd": {
+						VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 7}},
+					}},
+				}),
+			}
+			fake := &volumeAccessTestServer{
+				rpcError: tc.rpcError,
+				calls:    make(chan any, 1),
+			}
+			grpcServer := grpc.NewServer()
+			master_pb.RegisterSeaweedServer(grpcServer, master)
+			volume_server_pb.RegisterVolumeServerServer(grpcServer, fake)
+			go grpcServer.Serve(listener)
+			t.Cleanup(grpcServer.Stop)
+
+			dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+			address := pb.NewServerAddress("127.0.0.1", 9333, port)
+			discovery := pb.NewServiceDiscoveryFromMap(map[string]pb.ServerAddress{"master": address})
+			masterClient := wdclient.NewMasterClient(dialOption, "", "admin", "", "", "", *discovery)
+			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+			defer cancel()
+			go masterClient.KeepConnectedToMaster(ctx)
+			admin := &AdminServer{masterClient: masterClient, grpcDialOption: dialOption}
+
+			err = admin.SetVolumeReadOnly(ctx, tc.volumeID, tc.server, tc.readOnly)
+			if !tc.wantCall {
+				require.ErrorContains(t, err, "not found on server")
+				require.Empty(t, fake.calls, "an unknown replica must not receive a mutation")
+				return
+			}
+			if tc.rpcError != nil {
+				require.Equal(t, status.Code(tc.rpcError), status.Code(err))
+			} else {
+				require.NoError(t, err)
+			}
+			select {
+			case call := <-fake.calls:
+				if tc.readOnly {
+					req, ok := call.(*volume_server_pb.VolumeMarkReadonlyRequest)
+					require.True(t, ok)
+					require.Equal(t, tc.volumeID, req.VolumeId)
+					require.True(t, req.Persist, "operator changes must survive a restart")
+					require.False(t, req.CanDelete)
+				} else {
+					req, ok := call.(*volume_server_pb.VolumeMarkWritableRequest)
+					require.True(t, ok)
+					require.Equal(t, tc.volumeID, req.VolumeId)
+				}
+			default:
+				t.Fatal("volume server did not receive an access mode change")
+			}
+		})
+	}
+}
+
+func TestVolumeReplicaAddress(t *testing.T) {
+	topology := volumeAccessTestTopology(
+		&master_pb.DataNodeInfo{Id: "legacy:8080", DiskInfos: map[string]*master_pb.DiskInfo{
+			"hdd": {VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 7}}},
+		}},
+		&master_pb.DataNodeInfo{Id: "node-b", Address: "host-b:8081", GrpcPort: 18082, DiskInfos: map[string]*master_pb.DiskInfo{
+			"ssd": {VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 7}}, EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{{Id: 8}}},
+		}},
+	)
+	address, err := volumeReplicaAddress(topology, 7, "legacy:8080")
+	require.NoError(t, err)
+	require.Equal(t, "legacy:18080", address.ToGrpcAddress())
+	address, err = volumeReplicaAddress(topology, 7, "node-b")
+	require.NoError(t, err)
+	require.Equal(t, "host-b:18082", address.ToGrpcAddress())
+	_, err = volumeReplicaAddress(topology, 8, "node-b")
+	require.Error(t, err, "EC shards must not be treated as regular volumes")
+	_, err = volumeReplicaAddress(nil, 7, "node-b")
+	require.Error(t, err)
+}
diff --git a/weed/admin/dash/worker_fleet_metrics_test.go b/weed/admin/dash/worker_fleet_metrics_test.go
new file mode 100644
index 0000000000..412ab338df
--- /dev/null
+++ b/weed/admin/dash/worker_fleet_metrics_test.go
@@ -0,0 +1,130 @@
+package dash
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/maintenance"
+	adminplugin "github.com/seaweedfs/seaweedfs/weed/admin/plugin"
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+)
+
+// TestMergeWorkerFleetTotals covers the accounting behind
+// SeaweedFS_admin_workers_connected / SeaweedFS_admin_worker_slots and the
+// dashboard's Workers card. Both used to read the legacy maintenance-worker
+// registry only, so a cluster whose admin and workers run as separate
+// components reported 0 workers (issue #10525).
+func TestMergeWorkerFleetTotals(t *testing.T) {
+	pluginWorker := func(id string, detectUsed, detectTotal, executeUsed, executeTotal int32) *adminplugin.WorkerSession {
+		return &adminplugin.WorkerSession{
+			WorkerID: id,
+			Heartbeat: &plugin_pb.WorkerHeartbeat{
+				DetectionSlotsUsed:  detectUsed,
+				DetectionSlotsTotal: detectTotal,
+				ExecutionSlotsUsed:  executeUsed,
+				ExecutionSlotsTotal: executeTotal,
+			},
+		}
+	}
+
+	testCases := []struct {
+		name          string
+		legacySlots   map[string]maintenance.WorkerSlots
+		pluginWorkers []*adminplugin.WorkerSession
+		wantWorkers   int
+		wantUsedSlots int
+		wantMaxSlots  int
+	}{
+		{
+			name: "no workers at all",
+		},
+		{
+			name: "legacy workers only, unchanged accounting",
+			legacySlots: map[string]maintenance.WorkerSlots{
+				"w-legacy-a": {Used: 1, Max: 2},
+				"w-legacy-b": {Used: 0, Max: 4},
+			},
+			wantWorkers:   2,
+			wantUsedSlots: 1,
+			wantMaxSlots:  6,
+		},
+		{
+			// The reported bug: admin and workers deployed separately, so
+			// nothing ever lands in the legacy registry.
+			name: "plugin workers only are counted",
+			pluginWorkers: []*adminplugin.WorkerSession{
+				pluginWorker("w-plugin-a", 0, 1, 2, 4),
+				pluginWorker("w-plugin-b", 1, 1, 0, 4),
+			},
+			wantWorkers:   2,
+			wantUsedSlots: 3,
+			wantMaxSlots:  10,
+		},
+		{
+			name: "distinct workers in both registries are summed",
+			legacySlots: map[string]maintenance.WorkerSlots{
+				"w-legacy-a": {Used: 1, Max: 2},
+			},
+			pluginWorkers: []*adminplugin.WorkerSession{
+				pluginWorker("w-plugin-a", 0, 1, 1, 4),
+			},
+			wantWorkers:   2,
+			wantUsedSlots: 2,
+			wantMaxSlots:  7,
+		},
+		{
+			// `weed mini` runs both worker runtimes out of one working
+			// directory, so they share the persisted worker ID and must not be
+			// counted twice. Legacy slots win for such a worker.
+			name: "same worker ID in both registries counts once",
+			legacySlots: map[string]maintenance.WorkerSlots{
+				"w-host-abcd": {Used: 1, Max: 2},
+			},
+			pluginWorkers: []*adminplugin.WorkerSession{
+				pluginWorker("w-host-abcd", 1, 1, 3, 4),
+			},
+			wantWorkers:   1,
+			wantUsedSlots: 1,
+			wantMaxSlots:  2,
+		},
+		{
+			name: "plugin worker without a heartbeat still counts as connected",
+			pluginWorkers: []*adminplugin.WorkerSession{
+				{WorkerID: "w-plugin-a"},
+			},
+			wantWorkers: 1,
+		},
+		{
+			name:          "nil session is skipped",
+			pluginWorkers: []*adminplugin.WorkerSession{nil, pluginWorker("w-plugin-a", 0, 1, 0, 2)},
+			wantWorkers:   1,
+			wantMaxSlots:  3,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			workers, usedSlots, maxSlots := mergeWorkerFleetTotals(tc.legacySlots, tc.pluginWorkers)
+			if workers != tc.wantWorkers {
+				t.Errorf("workers = %d, want %d", workers, tc.wantWorkers)
+			}
+			if usedSlots != tc.wantUsedSlots {
+				t.Errorf("usedSlots = %d, want %d", usedSlots, tc.wantUsedSlots)
+			}
+			if maxSlots != tc.wantMaxSlots {
+				t.Errorf("maxSlots = %d, want %d", maxSlots, tc.wantMaxSlots)
+			}
+		})
+	}
+}
+
+// TestWorkerFleetTotalsWithoutMaintenanceManager guards the nil-manager path:
+// an admin server with no maintenance manager must still report its plugin
+// workers rather than returning early.
+func TestWorkerFleetTotalsWithoutMaintenanceManager(t *testing.T) {
+	server := &AdminServer{}
+
+	workers, usedSlots, maxSlots := server.workerFleetTotals()
+	if workers != 0 || usedSlots != 0 || maxSlots != 0 {
+		t.Fatalf("empty admin server reported workers=%d used=%d max=%d, want all 0", workers, usedSlots, maxSlots)
+	}
+}
diff --git a/weed/admin/dash/worker_grpc_server.go b/weed/admin/dash/worker_grpc_server.go
index 9fbce29c55..a6e9294d87 100644
--- a/weed/admin/dash/worker_grpc_server.go
+++ b/weed/admin/dash/worker_grpc_server.go
@@ -47,10 +47,11 @@ type WorkerGrpcServer struct {
 	logRequestsMutex   sync.RWMutex
 
 	// gRPC server
-	grpcServer *grpc.Server
-	listener   net.Listener
-	running    bool
-	stopChan   chan struct{}
+	grpcServer  *grpc.Server
+	listener    net.Listener
+	running     bool
+	stopChan    chan struct{}
+	mtlsEnabled bool
 }
 
 // LogRequestContext tracks pending log requests
@@ -83,20 +84,26 @@ func NewWorkerGrpcServer(adminServer *AdminServer) *WorkerGrpcServer {
 	}
 }
 
-// StartWithTLS starts the gRPC server on the specified port with optional TLS
-func (s *WorkerGrpcServer) StartWithTLS(port int) error {
+// StartWithTLS starts the gRPC server on the specified port with optional TLS.
+// A caller that already holds the port passes its listener instead. When no
+// listener is supplied the server binds to bindIp to honor the operator's -ip.
+func (s *WorkerGrpcServer) StartWithTLS(bindIp string, port int, listener net.Listener) error {
 	if s.running {
 		return fmt.Errorf("worker gRPC server is already running")
 	}
 
-	// Create listener
-	listener, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
-	if err != nil {
-		return fmt.Errorf("failed to listen on port %d: %v", port, err)
+	if listener == nil {
+		var err error
+		listener, err = net.Listen("tcp", util.JoinHostPort(bindIp, port))
+		if err != nil {
+			return fmt.Errorf("failed to listen on port %d: %v", port, err)
+		}
 	}
 
 	// Create gRPC server with optional TLS
-	grpcServer := pb.NewGrpcServer(security.LoadServerTLS(util.GetViper(), "grpc.admin"))
+	tlsOption, _ := security.LoadServerTLS(util.GetViper(), "grpc.admin")
+	s.mtlsEnabled = tlsOption != nil
+	grpcServer := pb.NewGrpcServer(tlsOption)
 
 	worker_pb.RegisterWorkerServiceServer(grpcServer, s)
 	if plugin := s.adminServer.GetPlugin(); plugin != nil {
@@ -126,6 +133,17 @@ func (s *WorkerGrpcServer) StartWithTLS(port int) error {
 	return nil
 }
 
+// ServeOn serves the worker gRPC API on an additional already-bound listener,
+// e.g. a legacy compat port kept alongside the primary one. grpc.Server tracks
+// every listener passed to Serve, so Stop closes it together with the primary.
+func (s *WorkerGrpcServer) ServeOn(listener net.Listener) {
+	go func() {
+		if err := s.grpcServer.Serve(listener); err != nil && s.running {
+			glog.Warningf("Worker gRPC compat listener on %s stopped: %v", listener.Addr(), err)
+		}
+	}()
+}
+
 // ListenPort returns the currently bound worker gRPC listen port.
 func (s *WorkerGrpcServer) ListenPort() int {
 	if s == nil || s.listener == nil {
@@ -181,6 +199,10 @@ func (s *WorkerGrpcServer) Stop() error {
 func (s *WorkerGrpcServer) WorkerStream(stream worker_pb.WorkerService_WorkerStreamServer) error {
 	ctx := stream.Context()
 
+	if err := security.CheckGrpcAdminPeer(ctx, security.SigningKey(util.GetViper().GetString("jwt.filer_signing.key"))); err != nil {
+		return err
+	}
+
 	// get client address
 	address := findClientAddress(ctx)
 
diff --git a/weed/admin/handlers/admin_handlers.go b/weed/admin/handlers/admin_handlers.go
index 73029f2605..007d1e14b1 100644
--- a/weed/admin/handlers/admin_handlers.go
+++ b/weed/admin/handlers/admin_handlers.go
@@ -179,8 +179,13 @@ func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) {
 	s3Api.Handle("/buckets/{bucket}", wrapWrite(h.adminServer.DeleteBucket)).Methods(http.MethodDelete)
 	s3Api.HandleFunc("/buckets/{bucket}", h.adminServer.ShowBucketDetails).Methods(http.MethodGet)
 	s3Api.HandleFunc("/buckets/{bucket}/lifecycle", h.adminServer.ShowBucketLifecycle).Methods(http.MethodGet)
+	s3Api.Handle("/buckets/{bucket}/lifecycle", wrapWrite(h.adminServer.UpdateBucketLifecycle)).Methods(http.MethodPut)
+	s3Api.Handle("/buckets/{bucket}/lifecycle", wrapWrite(h.adminServer.DeleteBucketLifecycle)).Methods(http.MethodDelete)
 	s3Api.Handle("/buckets/{bucket}/quota", wrapWrite(h.adminServer.UpdateBucketQuota)).Methods(http.MethodPut)
 	s3Api.Handle("/buckets/{bucket}/owner", wrapWrite(h.adminServer.UpdateBucketOwner)).Methods(http.MethodPut)
+	s3Api.HandleFunc("/buckets/{bucket}/policy", h.adminServer.ShowBucketPolicy).Methods(http.MethodGet)
+	s3Api.Handle("/buckets/{bucket}/policy", wrapWrite(h.adminServer.UpdateBucketPolicy)).Methods(http.MethodPut)
+	s3Api.Handle("/buckets/{bucket}/policy", wrapWrite(h.adminServer.RemoveBucketPolicy)).Methods(http.MethodDelete)
 
 	usersApi := api.PathPrefix("/users").Subrouter()
 	usersApi.HandleFunc("", h.userHandlers.GetUsers).Methods(http.MethodGet)
@@ -222,6 +227,10 @@ func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) {
 	policyApi.Handle("/{name}", wrapWrite(h.policyHandlers.DeletePolicy)).Methods(http.MethodDelete)
 	policyApi.HandleFunc("/validate", h.policyHandlers.ValidatePolicy).Methods(http.MethodPost)
 
+	// Registered at the API root, not under policyApi: policyApi's "/{name}"
+	// GET route would shadow any single-segment GET route registered after it.
+	api.HandleFunc("/principals", h.policyHandlers.GetPrincipalSuggestions).Methods(http.MethodGet)
+
 	s3TablesApi := api.PathPrefix("/s3tables").Subrouter()
 	s3TablesApi.HandleFunc("/buckets", h.adminServer.ListS3TablesBucketsAPI).Methods(http.MethodGet)
 	s3TablesApi.Handle("/buckets", wrapWrite(h.adminServer.CreateS3TablesBucket)).Methods(http.MethodPost)
@@ -251,10 +260,12 @@ func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) {
 	filesApi.HandleFunc("/view", h.fileBrowserHandlers.ViewFile).Methods(http.MethodGet)
 	filesApi.HandleFunc("/properties", h.fileBrowserHandlers.GetFileProperties).Methods(http.MethodGet)
 	filesApi.HandleFunc("/metadata", h.fileBrowserHandlers.ExportMetadata).Methods(http.MethodGet)
+	filesApi.HandleFunc("/list-folders", h.fileBrowserHandlers.ListFolders).Methods(http.MethodGet)
 
 	volumeApi := api.PathPrefix("/volumes").Subrouter()
 	volumeApi.HandleFunc("/export", h.clusterHandlers.ExportClusterVolumes).Methods(http.MethodGet)
 	volumeApi.Handle("/{id}/{server}/vacuum", wrapWrite(h.clusterHandlers.VacuumVolume)).Methods(http.MethodPost)
+	volumeApi.Handle("/{id}/{server}/read-only", wrapWrite(h.clusterHandlers.SetVolumeReadOnly)).Methods(http.MethodPost)
 
 	pluginApi := api.PathPrefix("/plugin").Subrouter()
 	pluginApi.HandleFunc("/status", h.adminServer.GetPluginStatusAPI).Methods(http.MethodGet)
@@ -266,6 +277,7 @@ func (h *AdminHandlers) registerAPIRoutes(api *mux.Router, enforceWrite bool) {
 	pluginApi.HandleFunc("/jobs/{jobId}/detail", h.adminServer.GetPluginJobDetailAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/activities", h.adminServer.GetPluginActivitiesAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/scheduler-states", h.adminServer.GetPluginSchedulerStatesAPI).Methods(http.MethodGet)
+	pluginApi.HandleFunc("/observations", h.adminServer.GetPluginObservationsAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/scheduler-status", h.adminServer.GetPluginSchedulerStatusAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/job-types/{jobType}/descriptor", h.adminServer.GetPluginJobTypeDescriptorAPI).Methods(http.MethodGet)
 	pluginApi.HandleFunc("/job-types/{jobType}/schema", h.adminServer.RequestPluginJobTypeSchemaAPI).Methods(http.MethodPost)
diff --git a/weed/admin/handlers/admin_handlers_routes_test.go b/weed/admin/handlers/admin_handlers_routes_test.go
index a34102d7ef..1cc0728cad 100644
--- a/weed/admin/handlers/admin_handlers_routes_test.go
+++ b/weed/admin/handlers/admin_handlers_routes_test.go
@@ -42,6 +42,88 @@ func TestSetupRoutes_RegistersPluginSchedulerStatesAPI_WithAuth(t *testing.T) {
 	}
 }
 
+func TestSetupRoutes_RegistersBucketLifecycleAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/lifecycle")
+}
+
+func TestSetupRoutes_RegistersBucketLifecycleAPI_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/lifecycle")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/lifecycle")
+}
+
+func TestSetupRoutes_RegistersBucketPolicyAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/policy")
+}
+
+func TestSetupRoutes_RegistersBucketPolicyAPI_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodPut, "/api/s3/buckets/example/policy")
+	assertHasRoute(t, router, http.MethodDelete, "/api/s3/buckets/example/policy")
+}
+
+func TestSetupRoutes_RegistersPolicyAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPut, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodDelete, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies/validate")
+}
+
+func TestSetupRoutes_RegistersPolicyAPI_WithAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, true, "admin", "password", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies")
+	assertHasRoute(t, router, http.MethodGet, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPut, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodDelete, "/api/object-store/policies/example")
+	assertHasRoute(t, router, http.MethodPost, "/api/object-store/policies/validate")
+}
+
+func TestSetupRoutes_RegistersPrincipalsAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/principals")
+}
+
+func TestSetupRoutes_RegistersFilesListFoldersAPI_NoAuth(t *testing.T) {
+	router := mux.NewRouter()
+
+	newRouteTestAdminHandlers().SetupRoutes(router, false, "", "", "", "", true)
+
+	assertHasRoute(t, router, http.MethodGet, "/api/files/list-folders")
+}
+
 func TestSetupRoutes_RegistersPluginPages_NoAuth(t *testing.T) {
 	router := mux.NewRouter()
 
diff --git a/weed/admin/handlers/cluster_handlers.go b/weed/admin/handlers/cluster_handlers.go
index 1d7d490ab8..5551d33558 100644
--- a/weed/admin/handlers/cluster_handlers.go
+++ b/weed/admin/handlers/cluster_handlers.go
@@ -1,8 +1,10 @@
 package handlers
 
 import (
+	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"math"
 	"mime"
 	"net/http"
@@ -155,14 +157,14 @@ func (h *ClusterHandlers) ShowVolumeDetails(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	volumeID, err := strconv.Atoi(volumeIDStr)
+	volumeID, err := strconv.ParseUint(volumeIDStr, 10, 32)
 	if err != nil {
 		writeJSONError(w, http.StatusBadRequest, "Invalid volume ID")
 		return
 	}
 
 	// Get volume details
-	volumeDetails, err := h.adminServer.GetVolumeDetails(volumeID, server)
+	volumeDetails, err := h.adminServer.GetVolumeDetails(uint32(volumeID), server)
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "Failed to get volume details: "+err.Error())
 		return
@@ -416,6 +418,50 @@ func (h *ClusterHandlers) GetVolumeServers(w http.ResponseWriter, r *http.Reques
 	writeJSON(w, http.StatusOK, map[string]interface{}{"volume_servers": topology.VolumeServers})
 }
 
+// SetVolumeReadOnly handles access mode changes for a single volume replica.
+func (h *ClusterHandlers) SetVolumeReadOnly(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	volumeID, err := strconv.ParseUint(vars["id"], 10, 32)
+	if err != nil {
+		writeJSONError(w, http.StatusBadRequest, "Invalid volume ID")
+		return
+	}
+	server := vars["server"]
+	if server == "" {
+		writeJSONError(w, http.StatusBadRequest, "Server is required")
+		return
+	}
+	var request struct {
+		ReadOnly *bool `json:"read_only"`
+	}
+	decoder := json.NewDecoder(r.Body)
+	if err := decoder.Decode(&request); err != nil || request.ReadOnly == nil {
+		writeJSONError(w, http.StatusBadRequest, "read_only must be a boolean")
+		return
+	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		writeJSONError(w, http.StatusBadRequest, "read_only must be a boolean")
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(r.Context(), 30*time.Second)
+	defer cancel()
+	if err := h.adminServer.SetVolumeReadOnly(ctx, uint32(volumeID), server, *request.ReadOnly); err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to change volume access mode: "+err.Error())
+		return
+	}
+	mode := "read/write"
+	if *request.ReadOnly {
+		mode = "read-only"
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"message":   fmt.Sprintf("Volume %d on %s marked %s", volumeID, server, mode),
+		"volume_id": volumeID,
+		"server":    server,
+		"read_only": *request.ReadOnly,
+	})
+}
+
 // VacuumVolume handles volume vacuum requests via API
 func (h *ClusterHandlers) VacuumVolume(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
diff --git a/weed/admin/handlers/cluster_handlers_test.go b/weed/admin/handlers/cluster_handlers_test.go
new file mode 100644
index 0000000000..4dfa8de648
--- /dev/null
+++ b/weed/admin/handlers/cluster_handlers_test.go
@@ -0,0 +1,62 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetVolumeReadOnlyInvalidRequests(t *testing.T) {
+	for _, tc := range []struct {
+		name, id, server, body string
+	}{
+		{"missing volume", "", "node-a", `{"read_only":true}`},
+		{"negative volume", "-1", "node-a", `{"read_only":true}`},
+		{"overflow volume", "4294967296", "node-a", `{"read_only":true}`},
+		{"invalid volume", "abc", "node-a", `{"read_only":true}`},
+		{"missing server", "7", "", `{"read_only":true}`},
+		{"missing mode", "7", "node-a", `{}`},
+		{"null mode", "7", "node-a", `{"read_only":null}`},
+		{"string mode", "7", "node-a", `{"read_only":"false"}`},
+		{"malformed JSON", "7", "node-a", `{"read_only":`},
+		{"trailing JSON", "7", "node-a", `{"read_only":true}{}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(tc.body))
+			req = mux.SetURLVars(req, map[string]string{"id": tc.id, "server": tc.server})
+			w := httptest.NewRecorder()
+			// Invalid input must be rejected before accessing the cluster.
+			(&ClusterHandlers{}).SetVolumeReadOnly(w, req)
+			require.Equal(t, http.StatusBadRequest, w.Code, w.Body.String())
+		})
+	}
+}
+
+func TestSetVolumeReadOnlyRoutePermissions(t *testing.T) {
+	for _, tc := range []struct {
+		name, role string
+		enforce    bool
+		wantStatus int
+	}{
+		{"read-only user", dash.RoleReadOnly, true, http.StatusForbidden},
+		{"admin", "admin", true, http.StatusBadRequest},
+		{"no authentication", "", false, http.StatusBadRequest},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			router := mux.NewRouter()
+			newRouteTestAdminHandlers().registerAPIRoutes(router.PathPrefix("/api").Subrouter(), tc.enforce)
+			// Deliberately omit the mode: allowed callers reach validation, while
+			// read-only callers must be rejected by the route's write guard.
+			req := httptest.NewRequest(http.MethodPost, "/api/volumes/7/node-a/read-only", strings.NewReader(`{}`))
+			req = req.WithContext(dash.WithAuthContext(req.Context(), "", tc.role, ""))
+			w := httptest.NewRecorder()
+			router.ServeHTTP(w, req)
+			require.Equal(t, tc.wantStatus, w.Code, w.Body.String())
+		})
+	}
+}
diff --git a/weed/admin/handlers/file_browser_grpc.go b/weed/admin/handlers/file_browser_grpc.go
index a79e84d7e4..9239688ed0 100644
--- a/weed/admin/handlers/file_browser_grpc.go
+++ b/weed/admin/handlers/file_browser_grpc.go
@@ -145,6 +145,7 @@ func (h *FileBrowserHandlers) uploadFileGrpc(ctx context.Context, filePath strin
 			PublicUrl: assignResp.Location.PublicUrl,
 			Count:     uint64(count),
 			Auth:      security.EncodedJwt(assignResp.Auth),
+			Fsync:     assignResp.Fsync,
 		}, nil
 	}
 
@@ -152,6 +153,9 @@ func (h *FileBrowserHandlers) uploadFileGrpc(ctx context.Context, filePath strin
 		ChunkSize:  adminUploadChunkSize,
 		MimeType:   mimeType,
 		AssignFunc: assignFunc,
+		LookupJwtFunc: func(lookupCtx context.Context, fileId string) security.EncodedJwt {
+			return operation.LookupJwt(lookupCtx, h.adminServer.GetMasterClient().GetMaster(lookupCtx), h.adminServer.GetGrpcDialOption(), fileId)
+		},
 	})
 	if err != nil {
 		// Partial chunks come back even on error so we can clean them up rather
diff --git a/weed/admin/handlers/file_browser_handlers.go b/weed/admin/handlers/file_browser_handlers.go
index e68b5db6f1..15d7a24b03 100644
--- a/weed/admin/handlers/file_browser_handlers.go
+++ b/weed/admin/handlers/file_browser_handlers.go
@@ -66,7 +66,7 @@ func (h *FileBrowserHandlers) ShowFileBrowser(w http.ResponseWriter, r *http.Req
 	}
 
 	// Get file browser data with cursor-based pagination
-	browserData, err := h.adminServer.GetFileBrowser(path, lastFileName, pageSize)
+	browserData, err := h.adminServer.GetFileBrowser(path, "", lastFileName, pageSize)
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "Failed to get file browser data: "+err.Error())
 		return
@@ -109,14 +109,7 @@ func (h *FileBrowserHandlers) DeleteFile(w http.ResponseWriter, r *http.Request)
 
 	// Delete file via filer
 	err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		_, err := client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
-			Directory:            path.Dir(request.Path),
-			Name:                 path.Base(request.Path),
-			IsDeleteData:         true,
-			IsRecursive:          true,
-			IgnoreRecursiveError: false,
-		})
-		return err
+		return filer_pb.DoRemove(context.Background(), client, path.Dir(request.Path), path.Base(request.Path), true, true, false, false, nil)
 	})
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "Failed to delete file: "+err.Error())
@@ -156,14 +149,7 @@ func (h *FileBrowserHandlers) DeleteMultipleFiles(w http.ResponseWriter, r *http
 	// Delete each file/folder
 	for _, p := range request.Paths {
 		err := h.adminServer.WithFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-			_, err := client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
-				Directory:            path.Dir(p),
-				Name:                 path.Base(p),
-				IsDeleteData:         true,
-				IsRecursive:          true,
-				IgnoreRecursiveError: false,
-			})
-			return err
+			return filer_pb.DoRemove(context.Background(), client, path.Dir(p), path.Base(p), true, true, false, false, nil)
 		})
 
 		if err != nil {
@@ -631,6 +617,12 @@ func (h *FileBrowserHandlers) GetFileProperties(w http.ResponseWriter, r *http.R
 		return
 	}
 
+	if isDir, _ := properties["is_directory"].(bool); !isDir {
+		if objectURL := h.adminServer.GetS3ObjectURL(filePath); objectURL != "" {
+			properties["object_url"] = objectURL
+		}
+	}
+
 	writeJSON(w, http.StatusOK, properties)
 }
 
@@ -778,3 +770,63 @@ func min(a, b int64) int64 {
 	}
 	return b
 }
+
+// maxListFoldersEntries caps how many subfolder names ListFolders will
+// collect for a single request, so a directory with an unusually large
+// number of children can't turn one autocomplete keystroke into an
+// unbounded, slow full-directory walk.
+const maxListFoldersEntries = 2000
+
+// maxListFoldersScanned caps how many entries ListFolders will page through
+// looking for those subfolders. The folder cap alone doesn't bound the work:
+// a bucket holding nothing but flat object keys has no subfolders to count,
+// so the walk runs to the end of the directory - a million keys is a million
+// entries read, 200 per round trip, behind a single keystroke.
+const maxListFoldersScanned = 10000
+
+// ListFolders returns, as JSON, the names of the subdirectories directly
+// under the given path. It exists to back progressive autocomplete (e.g. the
+// policy editor's Resource ARN field building up "bucket/folder/subfolder"
+// one path segment at a time) rather than to be a general directory listing
+// API, so it's restricted to paths under /buckets. The optional prefix is the
+// segment the caller is still typing, and narrows the listing to it.
+func (h *FileBrowserHandlers) ListFolders(w http.ResponseWriter, r *http.Request) {
+	dirPath := defaultQuery(r.URL.Query().Get("path"), "/buckets")
+	// Clean before the scope check: CleanWindowsPath only rewrites backslashes,
+	// so "/buckets/../etc" would otherwise satisfy the prefix test below.
+	dirPath = path.Clean(util.CleanWindowsPath(dirPath))
+
+	if dirPath != "/buckets" && !strings.HasPrefix(dirPath, "/buckets/") {
+		writeJSONError(w, http.StatusBadRequest, "path must be under /buckets")
+		return
+	}
+
+	prefix := r.URL.Query().Get("prefix")
+
+	folders := []string{}
+	lastFileName := ""
+	scanned := 0
+	for {
+		browserData, err := h.adminServer.GetFileBrowser(dirPath, prefix, lastFileName, 200)
+		if err != nil {
+			writeJSONError(w, http.StatusInternalServerError, "Failed to list directory: "+err.Error())
+			return
+		}
+		scanned += len(browserData.Entries)
+		for _, entry := range browserData.Entries {
+			if entry.IsDirectory {
+				folders = append(folders, entry.Name)
+				if len(folders) >= maxListFoldersEntries {
+					break
+				}
+			}
+		}
+		if len(browserData.Entries) == 0 || !browserData.HasNextPage ||
+			len(folders) >= maxListFoldersEntries || scanned >= maxListFoldersScanned {
+			break
+		}
+		lastFileName = browserData.Entries[len(browserData.Entries)-1].Name
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{"folders": folders})
+}
diff --git a/weed/admin/handlers/file_browser_handlers_test.go b/weed/admin/handlers/file_browser_handlers_test.go
index 3baf9b3747..65d05dad9b 100644
--- a/weed/admin/handlers/file_browser_handlers_test.go
+++ b/weed/admin/handlers/file_browser_handlers_test.go
@@ -1,7 +1,11 @@
 package handlers
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
 )
 
 func TestValidateAndCleanFilePath_AllowsControlChars(t *testing.T) {
@@ -42,3 +46,20 @@ func TestValidateAndCleanFilePath_RejectsEmpty(t *testing.T) {
 	}
 }
 
+func TestListFolders_RejectsPathOutsideBuckets(t *testing.T) {
+	h := &FileBrowserHandlers{adminServer: &dash.AdminServer{}}
+
+	cases := []string{"/etc/seaweedfs", "/", "/notbuckets/foo", "/buckets-not-really/foo",
+		"/buckets/../etc", "/buckets/..", "/buckets/foo/../../etc", `/buckets\..\etc`}
+	for _, path := range cases {
+		req := httptest.NewRequest(http.MethodGet, "/api/files/list-folders?path="+path, nil)
+		w := httptest.NewRecorder()
+
+		h.ListFolders(w, req)
+
+		if w.Code != http.StatusBadRequest {
+			t.Errorf("path %q: expected 400, got %d (body: %s)", path, w.Code, w.Body.String())
+		}
+	}
+}
+
diff --git a/weed/admin/handlers/policy_handlers.go b/weed/admin/handlers/policy_handlers.go
index 81868213ff..117145acbd 100644
--- a/weed/admin/handlers/policy_handlers.go
+++ b/weed/admin/handlers/policy_handlers.go
@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"errors"
 	"fmt"
 	"net/http"
 	"time"
@@ -51,6 +52,17 @@ func (h *PolicyHandlers) GetPolicies(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]interface{}{"policies": policies})
 }
 
+// GetPrincipalSuggestions returns candidate ARNs (existing users and IAM
+// roles) for the policy editor's Principal/NotPrincipal autocomplete.
+func (h *PolicyHandlers) GetPrincipalSuggestions(w http.ResponseWriter, r *http.Request) {
+	suggestions, err := h.adminServer.GetPrincipalSuggestions(r.Context())
+	if err != nil {
+		writeJSONError(w, http.StatusInternalServerError, "Failed to get principal suggestions: "+err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]interface{}{"principals": suggestions})
+}
+
 // CreatePolicy handles policy creation
 func (h *PolicyHandlers) CreatePolicy(w http.ResponseWriter, r *http.Request) {
 	var req dash.CreatePolicyRequest
@@ -175,8 +187,13 @@ func (h *PolicyHandlers) DeletePolicy(w http.ResponseWriter, r *http.Request) {
 	// Delete the policy
 	err = h.adminServer.DeletePolicy(policyName)
 	if err != nil {
-		glog.Errorf("Failed to delete policy %s: %v", policyName, err)
-		writeJSONError(w, http.StatusInternalServerError, "Failed to delete policy: "+err.Error())
+		status := http.StatusInternalServerError
+		if errors.Is(err, dash.ErrPolicyStillAttached) {
+			status = http.StatusConflict
+		} else {
+			glog.Errorf("Failed to delete policy %s: %v", policyName, err)
+		}
+		writeJSONError(w, status, "Failed to delete policy: "+err.Error())
 		return
 	}
 
@@ -221,8 +238,18 @@ func (h *PolicyHandlers) ValidatePolicy(w http.ResponseWriter, r *http.Request)
 			return
 		}
 
-		if len(statement.Resource.Strings()) == 0 {
-			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: Resource is required", i+1))
+		if len(statement.Resource.Strings()) == 0 && len(statement.NotResource.Strings()) == 0 {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: Resource or NotResource is required", i+1))
+			return
+		}
+
+		if statement.Resource != nil && statement.NotResource != nil {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: cannot specify both Resource and NotResource", i+1))
+			return
+		}
+
+		if statement.Principal != nil && statement.NotPrincipal != nil {
+			writeJSONError(w, http.StatusBadRequest, fmt.Sprintf("Statement %d: cannot specify both Principal and NotPrincipal", i+1))
 			return
 		}
 	}
diff --git a/weed/admin/handlers/policy_handlers_test.go b/weed/admin/handlers/policy_handlers_test.go
new file mode 100644
index 0000000000..21484148ba
--- /dev/null
+++ b/weed/admin/handlers/policy_handlers_test.go
@@ -0,0 +1,161 @@
+package handlers
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func newValidatePolicyRequest(t *testing.T, document map[string]interface{}) *http.Request {
+	t.Helper()
+	body, err := json.Marshal(map[string]interface{}{"document": document})
+	if err != nil {
+		t.Fatalf("failed to marshal request body: %v", err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/object-store/policies/validate", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	return req
+}
+
+func TestValidatePolicy(t *testing.T) {
+	handlers := &PolicyHandlers{adminServer: &dash.AdminServer{}}
+
+	tests := []struct {
+		name       string
+		document   map[string]interface{}
+		wantStatus int
+	}{
+		{
+			name: "valid document with Resource",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusOK,
+		},
+		{
+			name: "valid document with NotResource only",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "NotResource": "arn:aws:s3:::secret-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusOK,
+		},
+		{
+			name: "missing version",
+			document: map[string]interface{}{
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "no statements",
+			document: map[string]interface{}{
+				"Version":   "2012-10-17",
+				"Statement": []map[string]interface{}{},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "invalid effect",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Maybe", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "missing action",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Resource": "arn:aws:s3:::my-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "neither Resource nor NotResource",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "both Resource and NotResource",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*", "NotResource": "arn:aws:s3:::secret-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "empty Resource alongside non-empty NotResource is still a conflict",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": []string{}, "NotResource": "arn:aws:s3:::secret-bucket/*"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+		{
+			name: "both Principal and NotPrincipal",
+			document: map[string]interface{}{
+				"Version": "2012-10-17",
+				"Statement": []map[string]interface{}{
+					{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-bucket/*", "Principal": "*", "NotPrincipal": "arn:aws:iam::123456789012:user/bob"},
+				},
+			},
+			wantStatus: http.StatusBadRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := newValidatePolicyRequest(t, tt.document)
+			w := httptest.NewRecorder()
+
+			handlers.ValidatePolicy(w, req)
+
+			if w.Code != tt.wantStatus {
+				t.Fatalf("expected status %d, got %d (body: %s)", tt.wantStatus, w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
+// Sanity check that policy_engine.PolicyStatement (the type ValidatePolicy
+// actually decodes into) round-trips NotResource-only statements the way the
+// test above assumes.
+func TestValidatePolicy_NotResourceOnlyDecodes(t *testing.T) {
+	raw := []byte(`{"Effect":"Allow","Action":"s3:GetObject","NotResource":"arn:aws:s3:::secret/*"}`)
+	var stmt policy_engine.PolicyStatement
+	if err := json.Unmarshal(raw, &stmt); err != nil {
+		t.Fatalf("failed to unmarshal statement: %v", err)
+	}
+	if len(stmt.Resource.Strings()) != 0 {
+		t.Fatalf("expected no Resource, got %v", stmt.Resource.Strings())
+	}
+	if len(stmt.NotResource.Strings()) != 1 {
+		t.Fatalf("expected exactly one NotResource entry, got %v", stmt.NotResource.Strings())
+	}
+}
diff --git a/weed/admin/handlers/user_handlers.go b/weed/admin/handlers/user_handlers.go
index e439b3ad87..dfd327cc14 100644
--- a/weed/admin/handlers/user_handlers.go
+++ b/weed/admin/handlers/user_handlers.go
@@ -55,6 +55,14 @@ func (h *UserHandlers) GetUsers(w http.ResponseWriter, r *http.Request) {
 		writeJSONError(w, http.StatusInternalServerError, "Failed to get users: "+err.Error())
 		return
 	}
+	// Read-only (view-only) admin sessions must never receive reusable
+	// object-store secrets. Redact the secret key before serializing so a
+	// viewer cannot lift another user's live S3 credential pair.
+	if dash.IsReadOnlyRole(dash.RoleFromContext(r.Context())) {
+		for i := range users {
+			users[i].RedactSecretKey()
+		}
+	}
 	writeJSON(w, http.StatusOK, map[string]interface{}{"users": users})
 }
 
@@ -156,6 +164,13 @@ func (h *UserHandlers) GetUserDetails(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Read-only (view-only) admin sessions must never receive reusable
+	// object-store secrets. Redact the secret keys before serializing so a
+	// viewer cannot lift another user's live S3 credential pair.
+	if dash.IsReadOnlyRole(dash.RoleFromContext(r.Context())) {
+		user.RedactSecretKeys()
+	}
+
 	writeJSON(w, http.StatusOK, user)
 }
 
@@ -321,6 +336,14 @@ func (h *UserHandlers) getObjectStoreUsersData(r *http.Request) dash.ObjectStore
 		}
 	}
 
+	// Read-only (view-only) admin sessions must never receive reusable
+	// object-store secrets, including via the rendered HTML users page.
+	if dash.IsReadOnlyRole(dash.RoleFromContext(r.Context())) {
+		for i := range users {
+			users[i].RedactSecretKey()
+		}
+	}
+
 	hasAnonymous := false
 	for _, u := range users {
 		if u.Username == "anonymous" {
diff --git a/weed/admin/maintenance/maintenance_config_proto.go b/weed/admin/maintenance/maintenance_config_proto.go
index 4295a706f2..64163f9ba9 100644
--- a/weed/admin/maintenance/maintenance_config_proto.go
+++ b/weed/admin/maintenance/maintenance_config_proto.go
@@ -2,12 +2,13 @@ package maintenance
 
 import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	"google.golang.org/protobuf/proto"
 )
 
 // DefaultMaintenanceConfigProto returns default configuration as protobuf
 func DefaultMaintenanceConfigProto() *worker_pb.MaintenanceConfig {
 	return &worker_pb.MaintenanceConfig{
-		Enabled:                true,
+		Enabled:                proto.Bool(true),
 		ScanIntervalSeconds:    30 * 60,     // 30 minutes
 		WorkerTimeoutSeconds:   5 * 60,      // 5 minutes
 		TaskTimeoutSeconds:     2 * 60 * 60, // 2 hours
diff --git a/weed/admin/maintenance/maintenance_integration.go b/weed/admin/maintenance/maintenance_integration.go
index 68e72ff0b6..04aa06c5d0 100644
--- a/weed/admin/maintenance/maintenance_integration.go
+++ b/weed/admin/maintenance/maintenance_integration.go
@@ -122,6 +122,22 @@ func (s *MaintenanceIntegration) registerAllTasks() {
 	glog.V(1).Infof("Registered tasks: %v", registeredTaskTypes)
 }
 
+// SetPolicy replaces the maintenance policy the integration configures tasks from and
+// applies it immediately. Without this the integration kept the policy it was built with,
+// so a policy updated at runtime reached the queue but never the detectors that decide
+// which task types are scanned for.
+//
+// Not safe to call concurrently with a running scan. ConfigureTasksFromPolicy writes
+// TaskDefinition.Config and TaskDefinition.MaxConcurrent, which ScanWithTaskDetectors reads
+// through detector.IsEnabled(); nothing synchronises the two. Today every caller runs during
+// admin server startup, before the scan loop exists. Anything that wires this to an HTTP
+// handler has to add that synchronisation first - the same applies to
+// tasks.ConfigUpdateRegistry.UpdateAllConfigs, which replaces TaskDefinition.Config outright.
+func (s *MaintenanceIntegration) SetPolicy(policy *MaintenancePolicy) {
+	s.maintenancePolicy = policy
+	s.ConfigureTasksFromPolicy()
+}
+
 // ConfigureTasksFromPolicy dynamically configures all registered tasks based on the maintenance policy
 func (s *MaintenanceIntegration) ConfigureTasksFromPolicy() {
 	if s.maintenancePolicy == nil {
@@ -155,20 +171,32 @@ func (s *MaintenanceIntegration) configureDetectorFromPolicy(taskType types.Task
 		return
 	}
 
-	// Apply basic configuration that all detectors should support
-	if basicDetector, ok := detector.(interface{ SetEnabled(bool) }); ok {
-		// Convert task system type to maintenance task type for policy lookup
-		maintenanceTaskType, exists := s.taskTypeMap[taskType]
-		if exists {
-			enabled := IsTaskEnabled(s.maintenancePolicy, maintenanceTaskType)
-			basicDetector.SetEnabled(enabled)
-			glog.V(3).Infof("Set enabled=%v for detector %s", enabled, taskType)
-		}
+	// Convert task system type to maintenance task type for policy lookup
+	maintenanceTaskType, exists := s.taskTypeMap[taskType]
+	if !exists {
+		glog.V(3).Infof("No maintenance task type mapping for %s, skipping configuration", taskType)
+		return
 	}
 
-	// For detectors that don't implement PolicyConfigurableDetector interface,
-	// they should be updated to implement it for full policy-based configuration
-	glog.V(2).Infof("Detector %s should implement PolicyConfigurableDetector interface for full policy support", taskType)
+	// A task type the policy says nothing about is left alone. IsTaskEnabled reports
+	// false for a missing entry, so applying it unconditionally would silently disable
+	// every task the policy does not list - which is how ec_balance would have been
+	// switched off the moment SetEnabled started working.
+	if GetTaskPolicy(s.maintenancePolicy, maintenanceTaskType) == nil {
+		glog.V(2).Infof("Maintenance policy has no entry for %s, leaving its detector configuration untouched", taskType)
+		return
+	}
+
+	// Apply basic configuration that all detectors should support
+	if basicDetector, ok := detector.(interface{ SetEnabled(bool) }); ok {
+		enabled := IsTaskEnabled(s.maintenancePolicy, maintenanceTaskType)
+		basicDetector.SetEnabled(enabled)
+		glog.V(3).Infof("Set enabled=%v for detector %s", enabled, taskType)
+	} else {
+		// For detectors that don't implement PolicyConfigurableDetector interface,
+		// they should be updated to implement it for full policy-based configuration
+		glog.V(2).Infof("Detector %s supports neither PolicyConfigurableDetector nor SetEnabled, its policy is ignored", taskType)
+	}
 }
 
 // configureSchedulerFromPolicy configures a scheduler using policy-based configuration
@@ -187,11 +215,21 @@ func (s *MaintenanceIntegration) configureSchedulerFromPolicy(taskType types.Tas
 		return
 	}
 
+	// Same guard as on the detector side: no policy entry means no opinion, not disabled.
+	if GetTaskPolicy(s.maintenancePolicy, maintenanceTaskType) == nil {
+		glog.V(2).Infof("Maintenance policy has no entry for %s, leaving its scheduler configuration untouched", taskType)
+		return
+	}
+
 	// Set enabled status if scheduler supports it
 	if enableableScheduler, ok := scheduler.(interface{ SetEnabled(bool) }); ok {
 		enabled := IsTaskEnabled(s.maintenancePolicy, maintenanceTaskType)
 		enableableScheduler.SetEnabled(enabled)
 		glog.V(3).Infof("Set enabled=%v for scheduler %s", enabled, taskType)
+	} else {
+		// For schedulers that don't implement PolicyConfigurableScheduler interface,
+		// they should be updated to implement it for full policy-based configuration
+		glog.V(2).Infof("Scheduler %s supports neither PolicyConfigurableScheduler nor SetEnabled, its policy is ignored", taskType)
 	}
 
 	// Set max concurrent if scheduler supports it
@@ -202,10 +240,6 @@ func (s *MaintenanceIntegration) configureSchedulerFromPolicy(taskType types.Tas
 			glog.V(3).Infof("Set max concurrent=%d for scheduler %s", maxConcurrent, taskType)
 		}
 	}
-
-	// For schedulers that don't implement PolicyConfigurableScheduler interface,
-	// they should be updated to implement it for full policy-based configuration
-	glog.V(2).Infof("Scheduler %s should implement PolicyConfigurableScheduler interface for full policy support", taskType)
 }
 
 // ScanWithTaskDetectors performs a scan using the task system
diff --git a/weed/admin/maintenance/maintenance_manager.go b/weed/admin/maintenance/maintenance_manager.go
index 509cdc8991..4d2a518e18 100644
--- a/weed/admin/maintenance/maintenance_manager.go
+++ b/weed/admin/maintenance/maintenance_manager.go
@@ -10,12 +10,29 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
 	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/balance"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/ec_balance"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/vacuum"
+	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 )
 
-// buildPolicyFromTaskConfigs loads task configurations from separate files and builds a MaintenancePolicy
-func buildPolicyFromTaskConfigs() *worker_pb.MaintenancePolicy {
+// BuildPolicyFromTaskConfigs loads each registered task's configuration and builds the
+// MaintenancePolicy the maintenance system runs on.
+//
+// Every entry is produced by the task's own ToTaskPolicy(), so a policy entry always carries
+// exactly what that task's config holds. Hand-copying the fields here instead made this a
+// second, silently diverging definition of every task's policy: it dropped the erasure
+// coding preferred tags and replica placement and the balance IO rate limit outright.
+//
+// Every task registered through base.RegisterTask needs an entry, because a task type the
+// policy does not list has no enabled flag and no concurrency limit of its own -
+// IsTaskEnabled reports false for a missing entry.
+//
+// configPersistence is duck-typed as interface{} because weed/admin/dash already imports this
+// package, so importing *dash.ConfigPersistence back here would create an import cycle. It must be
+// a value implementing the LoadXTaskPolicy() accessors the task loaders assert on; passing nil (or
+// anything else) makes every task fall back to its compiled-in defaults.
+func BuildPolicyFromTaskConfigs(configPersistence interface{}) *worker_pb.MaintenancePolicy {
 	policy := &worker_pb.MaintenancePolicy{
 		GlobalMaxConcurrent:          4,
 		DefaultRepeatIntervalSeconds: 6 * 3600,  // 6 hours in seconds
@@ -23,54 +40,20 @@ func buildPolicyFromTaskConfigs() *worker_pb.MaintenancePolicy {
 		TaskPolicies:                 make(map[string]*worker_pb.TaskPolicy),
 	}
 
-	// Load vacuum task configuration
-	if vacuumConfig := vacuum.LoadConfigFromPersistence(nil); vacuumConfig != nil {
-		policy.TaskPolicies["vacuum"] = &worker_pb.TaskPolicy{
-			Enabled:               vacuumConfig.Enabled,
-			MaxConcurrent:         int32(vacuumConfig.MaxConcurrent),
-			RepeatIntervalSeconds: int32(vacuumConfig.ScanIntervalSeconds),
-			CheckIntervalSeconds:  int32(vacuumConfig.ScanIntervalSeconds),
-			TaskConfig: &worker_pb.TaskPolicy_VacuumConfig{
-				VacuumConfig: &worker_pb.VacuumTaskConfig{
-					GarbageThreshold:  float64(vacuumConfig.GarbageThreshold),
-					MinVolumeAgeHours: int32((vacuumConfig.MinVolumeAgeSeconds + 3599) / 3600), // round up so sub-hour values don't become 0
-				},
-			},
-		}
+	if vacuumConfig := vacuum.LoadConfigFromPersistence(configPersistence); vacuumConfig != nil {
+		policy.TaskPolicies[string(types.TaskTypeVacuum)] = vacuumConfig.ToTaskPolicy()
 	}
 
-	// Load erasure coding task configuration
-	if ecConfig := erasure_coding.LoadConfigFromPersistence(nil); ecConfig != nil {
-		policy.TaskPolicies["erasure_coding"] = &worker_pb.TaskPolicy{
-			Enabled:               ecConfig.Enabled,
-			MaxConcurrent:         int32(ecConfig.MaxConcurrent),
-			RepeatIntervalSeconds: int32(ecConfig.ScanIntervalSeconds),
-			CheckIntervalSeconds:  int32(ecConfig.ScanIntervalSeconds),
-			TaskConfig: &worker_pb.TaskPolicy_ErasureCodingConfig{
-				ErasureCodingConfig: &worker_pb.ErasureCodingTaskConfig{
-					FullnessRatio:    float64(ecConfig.FullnessRatio),
-					QuietForSeconds:  int32(ecConfig.QuietForSeconds),
-					MinVolumeSizeMb:  int32(ecConfig.MinSizeMB),
-					CollectionFilter: ecConfig.CollectionFilter,
-				},
-			},
-		}
+	if ecConfig := erasure_coding.LoadConfigFromPersistence(configPersistence); ecConfig != nil {
+		policy.TaskPolicies[string(types.TaskTypeErasureCoding)] = ecConfig.ToTaskPolicy()
 	}
 
-	// Load balance task configuration
-	if balanceConfig := balance.LoadConfigFromPersistence(nil); balanceConfig != nil {
-		policy.TaskPolicies["balance"] = &worker_pb.TaskPolicy{
-			Enabled:               balanceConfig.Enabled,
-			MaxConcurrent:         int32(balanceConfig.MaxConcurrent),
-			RepeatIntervalSeconds: int32(balanceConfig.ScanIntervalSeconds),
-			CheckIntervalSeconds:  int32(balanceConfig.ScanIntervalSeconds),
-			TaskConfig: &worker_pb.TaskPolicy_BalanceConfig{
-				BalanceConfig: &worker_pb.BalanceTaskConfig{
-					ImbalanceThreshold: float64(balanceConfig.ImbalanceThreshold),
-					MinServerCount:     int32(balanceConfig.MinServerCount),
-				},
-			},
-		}
+	if balanceConfig := balance.LoadConfigFromPersistence(configPersistence); balanceConfig != nil {
+		policy.TaskPolicies[string(types.TaskTypeBalance)] = balanceConfig.ToTaskPolicy()
+	}
+
+	if ecBalanceConfig := ec_balance.LoadConfigFromPersistence(configPersistence); ecBalanceConfig != nil {
+		policy.TaskPolicies[string(types.TaskTypeECBalance)] = ecBalanceConfig.ToTaskPolicy()
 	}
 
 	glog.V(1).Infof("Built maintenance policy from separate task configs - %d task policies loaded", len(policy.TaskPolicies))
@@ -94,8 +77,12 @@ type MaintenanceManager struct {
 	scanInProgress bool
 }
 
-// NewMaintenanceManager creates a new maintenance manager
-func NewMaintenanceManager(adminClient AdminClient, config *MaintenanceConfig) *MaintenanceManager {
+// NewMaintenanceManager creates a new maintenance manager.
+//
+// configPersistence is the config store to read persisted task configs from when the policy has to
+// be built here. See BuildPolicyFromTaskConfigs for why it is duck-typed; pass nil when no config
+// store is available.
+func NewMaintenanceManager(adminClient AdminClient, config *MaintenanceConfig, configPersistence interface{}) *MaintenanceManager {
 	if config == nil {
 		config = DefaultMaintenanceConfig()
 	}
@@ -104,7 +91,7 @@ func NewMaintenanceManager(adminClient AdminClient, config *MaintenanceConfig) *
 	policy := config.Policy
 	if policy == nil {
 		// Fallback: build policy from separate task configuration files if not already populated
-		policy = buildPolicyFromTaskConfigs()
+		policy = BuildPolicyFromTaskConfigs(configPersistence)
 	}
 
 	queue := NewMaintenanceQueue(policy)
@@ -122,7 +109,7 @@ func NewMaintenanceManager(adminClient AdminClient, config *MaintenanceConfig) *
 
 // Start begins the maintenance manager
 func (mm *MaintenanceManager) Start() error {
-	if !mm.config.Enabled {
+	if !mm.config.GetEnabled() {
 		glog.V(1).Infof("Maintenance system is disabled")
 		return nil
 	}
@@ -132,7 +119,9 @@ func (mm *MaintenanceManager) Start() error {
 		return fmt.Errorf("invalid maintenance configuration: %w", err)
 	}
 
+	mm.mutex.Lock()
 	mm.running = true
+	mm.mutex.Unlock()
 
 	// Start background processes
 	go mm.scanLoop()
@@ -178,30 +167,53 @@ func (mm *MaintenanceManager) validateConfig() error {
 	return nil
 }
 
-// IsRunning returns whether the maintenance manager is currently running
+// IsRunning returns whether the maintenance manager is currently running.
+// running is guarded by mm.mutex because the background loops read it on every
+// iteration while Start and Stop are called from the admin server's goroutines.
 func (mm *MaintenanceManager) IsRunning() bool {
+	mm.mutex.RLock()
+	defer mm.mutex.RUnlock()
 	return mm.running
 }
 
-// Stop terminates the maintenance manager
+// Stop terminates the maintenance manager. It is a no-op when the manager is not
+// running, so a second call cannot close the already closed stop channel.
 func (mm *MaintenanceManager) Stop() {
+	mm.mutex.Lock()
+	if !mm.running {
+		mm.mutex.Unlock()
+		return
+	}
 	mm.running = false
 	close(mm.stopChan)
+	mm.mutex.Unlock()
+
 	glog.Infof("Maintenance manager stopped")
 }
 
 // scanLoop periodically scans for maintenance tasks with adaptive timing
 func (mm *MaintenanceManager) scanLoop() {
 	scanInterval := time.Duration(mm.config.ScanIntervalSeconds) * time.Second
-	ticker := time.NewTicker(scanInterval)
-	defer ticker.Stop()
 
-	for mm.running {
+	// activeInterval is the interval the ticker is actually running at right now. It has
+	// to be tracked separately from the configured scanInterval, because the error backoff
+	// replaces the ticker with a much shorter one. Comparing the target against the
+	// configured interval instead never restores the normal cadence: once the errors stop,
+	// getScanInterval returns scanInterval again, the comparison comes out false, and the
+	// ticker is left at the backoff delay. A single transient scan failure therefore pinned
+	// the scanner to one scan per second forever.
+	activeInterval := scanInterval
+	ticker := time.NewTicker(activeInterval)
+	// Wrapped in a closure so the replacement ticker is stopped, not the one that happened
+	// to be current when the defer was registered.
+	defer func() { ticker.Stop() }()
+
+	for mm.IsRunning() {
 		select {
 		case <-mm.stopChan:
 			return
 		case <-ticker.C:
-			glog.V(1).Infof("Performing maintenance scan every %v", scanInterval)
+			glog.V(1).Infof("Performing maintenance scan every %v", activeInterval)
 
 			// Use the same synchronization as TriggerScan to prevent concurrent scans
 			if err := mm.triggerScanInternal(false); err != nil {
@@ -211,10 +223,13 @@ func (mm *MaintenanceManager) scanLoop() {
 			// Adjust ticker interval based on error state (read error state safely)
 			currentInterval := mm.getScanInterval(scanInterval)
 
-			// Reset ticker with new interval if needed
-			if currentInterval != scanInterval {
+			// Reset ticker whenever the target differs from what the ticker is running at,
+			// which covers both entering the backoff and returning to the normal cadence.
+			if currentInterval != activeInterval {
 				ticker.Stop()
 				ticker = time.NewTicker(currentInterval)
+				glog.V(1).Infof("Maintenance scan cadence changed from %v to %v", activeInterval, currentInterval)
+				activeInterval = currentInterval
 			}
 		}
 	}
@@ -246,7 +261,7 @@ func (mm *MaintenanceManager) cleanupLoop() {
 	ticker := time.NewTicker(cleanupInterval)
 	defer ticker.Stop()
 
-	for mm.running {
+	for mm.IsRunning() {
 		select {
 		case <-mm.stopChan:
 			return
@@ -263,7 +278,7 @@ func (mm *MaintenanceManager) topologyStatusLoop() {
 	ticker := time.NewTicker(statusInterval)
 	defer ticker.Stop()
 
-	for mm.running {
+	for mm.IsRunning() {
 		select {
 		case <-mm.stopChan:
 			return
@@ -437,6 +452,7 @@ func (mm *MaintenanceManager) performCleanup() {
 
 	removedTasks := mm.queue.CleanupOldTasks(taskRetention)
 	removedWorkers := mm.queue.RemoveStaleWorkers(workerTimeout)
+	mm.queue.cleanupCompletedTasks()
 
 	// Clean up stale pending operations (operations running for more than 4 hours)
 	staleOperationTimeout := 4 * time.Hour
@@ -520,9 +536,9 @@ func (mm *MaintenanceManager) GetWorkers() []*MaintenanceWorker {
 	return mm.queue.GetWorkers()
 }
 
-// GetWorkerSlotTotals returns worker count and aggregate used/max task slots.
-func (mm *MaintenanceManager) GetWorkerSlotTotals() (workers, used, max int) {
-	return mm.queue.GetWorkerSlotTotals()
+// GetWorkerSlots returns used/max task slots per worker ID.
+func (mm *MaintenanceManager) GetWorkerSlots() map[string]WorkerSlots {
+	return mm.queue.GetWorkerSlots()
 }
 
 // TriggerScan manually triggers a maintenance scan
@@ -532,12 +548,15 @@ func (mm *MaintenanceManager) TriggerScan() error {
 
 // triggerScanInternal handles both manual and automatic scan triggers
 func (mm *MaintenanceManager) triggerScanInternal(isManual bool) error {
+	// running and scanInProgress are checked under one lock so a Stop that lands
+	// between the two checks cannot leave a scan running after shutdown.
+	mm.mutex.Lock()
 	if !mm.running {
+		mm.mutex.Unlock()
 		return fmt.Errorf("maintenance manager is not running")
 	}
 
 	// Prevent multiple concurrent scans
-	mm.mutex.Lock()
 	if mm.scanInProgress {
 		mm.mutex.Unlock()
 		if isManual {
@@ -569,6 +588,14 @@ func (mm *MaintenanceManager) UpdateConfig(config *MaintenanceConfig) error {
 		mm.saveTaskConfigsFromPolicy(config.Policy)
 	}
 
+	// The integration holds its own reference to the policy and is what pushes the
+	// enabled flag and the concurrency limit into the registered detectors and
+	// schedulers. Without this the queue and the scanner saw the new policy while the
+	// detectors kept scanning under the old one until the next restart.
+	if mm.scanner != nil && mm.scanner.integration != nil {
+		mm.scanner.integration.SetPolicy(config.Policy)
+	}
+
 	glog.V(1).Infof("Maintenance configuration updated")
 	return nil
 }
@@ -590,37 +617,48 @@ func (mm *MaintenanceManager) saveTaskConfigsFromPolicy(policy *worker_pb.Mainte
 // CancelTask cancels a pending task
 func (mm *MaintenanceManager) CancelTask(taskID string) error {
 	mm.queue.mutex.Lock()
-	defer mm.queue.mutex.Unlock()
 
 	task, exists := mm.queue.tasks[taskID]
 	if !exists {
+		mm.queue.mutex.Unlock()
 		return fmt.Errorf("task %s not found", taskID)
 	}
-
-	if task.Status == TaskStatusPending {
-		task.Status = TaskStatusCancelled
-		task.CompletedAt = &[]time.Time{time.Now()}[0]
-
-		// Remove from pending tasks
-		for i, pendingTask := range mm.queue.pendingTasks {
-			if pendingTask.ID == taskID {
-				mm.queue.pendingTasks = append(mm.queue.pendingTasks[:i], mm.queue.pendingTasks[i+1:]...)
-				break
-			}
-		}
-
-		// Notify ActiveTopology to release capacity
-		if mm.scanner != nil && mm.scanner.integration != nil {
-			if at := mm.scanner.integration.GetActiveTopology(); at != nil {
-				_ = at.CompleteTask(taskID)
-			}
-		}
-
-		glog.V(2).Infof("Cancelled task %s", taskID)
-		return nil
+	if task.Status != TaskStatusPending {
+		status := task.Status
+		mm.queue.mutex.Unlock()
+		return fmt.Errorf("task %s cannot be cancelled (status: %s)", taskID, status)
 	}
 
-	return fmt.Errorf("task %s cannot be cancelled (status: %s)", taskID, task.Status)
+	task.Status = TaskStatusCancelled
+	completedTime := time.Now()
+	task.CompletedAt = &completedTime
+	cancelledSnapshot := snapshotTask(task)
+
+	// Remove from pending tasks
+	for i, pendingTask := range mm.queue.pendingTasks {
+		if pendingTask.ID == taskID {
+			mm.queue.pendingTasks = append(mm.queue.pendingTasks[:i], mm.queue.pendingTasks[i+1:]...)
+			break
+		}
+	}
+
+	// Notify ActiveTopology to release capacity
+	if mm.scanner != nil && mm.scanner.integration != nil {
+		if at := mm.scanner.integration.GetActiveTopology(); at != nil {
+			_ = at.CompleteTask(taskID)
+		}
+	}
+	mm.queue.mutex.Unlock()
+
+	if mm.queue.persistence != nil {
+		mm.queue.persistMu.Lock()
+		if mm.queue.deleteTaskStateLocked(taskID) != nil {
+			mm.queue.saveTaskStateLocked(cancelledSnapshot)
+		}
+		mm.queue.persistMu.Unlock()
+	}
+	glog.V(2).Infof("Cancelled task %s", taskID)
+	return nil
 }
 
 // RegisterWorker registers a new worker
diff --git a/weed/admin/maintenance/maintenance_manager_test.go b/weed/admin/maintenance/maintenance_manager_test.go
index 243a88f5e3..06b446baf0 100644
--- a/weed/admin/maintenance/maintenance_manager_test.go
+++ b/weed/admin/maintenance/maintenance_manager_test.go
@@ -10,7 +10,7 @@ func TestMaintenanceManager_ErrorHandling(t *testing.T) {
 	config := DefaultMaintenanceConfig()
 	config.ScanIntervalSeconds = 1 // Short interval for testing (1 second)
 
-	manager := NewMaintenanceManager(nil, config)
+	manager := NewMaintenanceManager(nil, config, nil)
 
 	// Test initial state
 	if manager.errorCount != 0 {
@@ -96,7 +96,7 @@ func TestIsConnectionError(t *testing.T) {
 
 func TestMaintenanceManager_GetErrorState(t *testing.T) {
 	config := DefaultMaintenanceConfig()
-	manager := NewMaintenanceManager(nil, config)
+	manager := NewMaintenanceManager(nil, config, nil)
 
 	// Test initial state
 	errorCount, lastError, backoffDelay := manager.GetErrorState()
@@ -118,7 +118,7 @@ func TestMaintenanceManager_GetErrorState(t *testing.T) {
 
 func TestMaintenanceManager_LogThrottling(t *testing.T) {
 	config := DefaultMaintenanceConfig()
-	manager := NewMaintenanceManager(nil, config)
+	manager := NewMaintenanceManager(nil, config, nil)
 
 	// This is a basic test to ensure the error handling doesn't panic
 	// In practice, you'd want to capture log output to verify throttling
diff --git a/weed/admin/maintenance/maintenance_policy_test.go b/weed/admin/maintenance/maintenance_policy_test.go
new file mode 100644
index 0000000000..4ae3c94d6b
--- /dev/null
+++ b/weed/admin/maintenance/maintenance_policy_test.go
@@ -0,0 +1,133 @@
+package maintenance
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+)
+
+// stubConfigPersistence implements the LoadXTaskPolicy accessors that the task config loaders
+// type-assert on. The real implementation is *dash.ConfigPersistence, which this package cannot
+// import: weed/admin/dash already imports weed/admin/maintenance, so the dependency only runs one
+// way and the persistence argument has to stay duck-typed.
+type stubConfigPersistence struct {
+	vacuum    *worker_pb.TaskPolicy
+	ec        *worker_pb.TaskPolicy
+	balance   *worker_pb.TaskPolicy
+	ecBalance *worker_pb.TaskPolicy
+}
+
+func (s *stubConfigPersistence) LoadVacuumTaskPolicy() (*worker_pb.TaskPolicy, error) {
+	return s.vacuum, nil
+}
+
+func (s *stubConfigPersistence) LoadErasureCodingTaskPolicy() (*worker_pb.TaskPolicy, error) {
+	return s.ec, nil
+}
+
+func (s *stubConfigPersistence) LoadBalanceTaskPolicy() (*worker_pb.TaskPolicy, error) {
+	return s.balance, nil
+}
+
+func (s *stubConfigPersistence) LoadEcBalanceTaskPolicy() (*worker_pb.TaskPolicy, error) {
+	return s.ecBalance, nil
+}
+
+func disabledStub() *stubConfigPersistence {
+	return &stubConfigPersistence{
+		vacuum: &worker_pb.TaskPolicy{
+			Enabled:               false,
+			MaxConcurrent:         2,
+			RepeatIntervalSeconds: 2 * 3600,
+			TaskConfig: &worker_pb.TaskPolicy_VacuumConfig{
+				VacuumConfig: &worker_pb.VacuumTaskConfig{GarbageThreshold: 0.3, MinVolumeAgeHours: 24},
+			},
+		},
+		ec: &worker_pb.TaskPolicy{
+			Enabled:               false,
+			MaxConcurrent:         1,
+			RepeatIntervalSeconds: 3600,
+			TaskConfig: &worker_pb.TaskPolicy_ErasureCodingConfig{
+				ErasureCodingConfig: &worker_pb.ErasureCodingTaskConfig{FullnessRatio: 0.95, QuietForSeconds: 3600, MinVolumeSizeMb: 30},
+			},
+		},
+		balance: &worker_pb.TaskPolicy{
+			Enabled:               false,
+			MaxConcurrent:         1,
+			RepeatIntervalSeconds: 30 * 60,
+			TaskConfig: &worker_pb.TaskPolicy_BalanceConfig{
+				BalanceConfig: &worker_pb.BalanceTaskConfig{ImbalanceThreshold: 0.2, MinServerCount: 7},
+			},
+		},
+		ecBalance: &worker_pb.TaskPolicy{
+			Enabled:               false,
+			MaxConcurrent:         1,
+			RepeatIntervalSeconds: 60 * 60,
+			TaskConfig: &worker_pb.TaskPolicy_EcBalanceConfig{
+				EcBalanceConfig: &worker_pb.EcBalanceTaskConfig{ImbalanceThreshold: 0.2, MinServerCount: 5},
+			},
+		},
+	}
+}
+
+// TestBuildPolicyFromTaskConfigsUsesPersistence covers a reported bug: the persistence argument used to be a
+// literal nil, which no type assertion can satisfy, so a task disabled on disk came back enabled.
+func TestBuildPolicyFromTaskConfigsUsesPersistence(t *testing.T) {
+	policy := BuildPolicyFromTaskConfigs(disabledStub())
+
+	for _, taskType := range []string{"vacuum", "erasure_coding", "balance", "ec_balance"} {
+		taskPolicy := policy.TaskPolicies[taskType]
+		if taskPolicy == nil {
+			t.Fatalf("no %s task policy built", taskType)
+		}
+		if taskPolicy.Enabled {
+			t.Errorf("%s enabled = true, want false from the persisted config", taskType)
+		}
+	}
+
+	if got := policy.TaskPolicies["balance"].GetBalanceConfig().GetMinServerCount(); got != 7 {
+		t.Errorf("balance min server count = %d, want persisted 7", got)
+	}
+}
+
+// TestBuildPolicyFromTaskConfigsWithoutPersistence keeps the documented fallback: with no config
+// store there is nothing to read, so the compiled-in defaults apply.
+func TestBuildPolicyFromTaskConfigsWithoutPersistence(t *testing.T) {
+	policy := BuildPolicyFromTaskConfigs(nil)
+
+	for _, taskType := range []string{"vacuum", "erasure_coding", "balance", "ec_balance"} {
+		taskPolicy := policy.TaskPolicies[taskType]
+		if taskPolicy == nil {
+			t.Fatalf("no %s task policy built", taskType)
+		}
+		if !taskPolicy.Enabled {
+			t.Errorf("%s enabled = false, want the compiled-in default true", taskType)
+		}
+	}
+}
+
+// TestNewMaintenanceManagerUsesPersistenceForPolicyFallback covers the path the admin server takes
+// when no maintenance.pb has been written yet: the config carries no policy, so the manager builds
+// one itself and must read the persisted task configs to do it.
+func TestNewMaintenanceManagerUsesPersistenceForPolicyFallback(t *testing.T) {
+	config := DefaultMaintenanceConfig()
+	if config.Policy != nil {
+		t.Fatal("default config unexpectedly carries a policy, test no longer covers the fallback")
+	}
+
+	manager := NewMaintenanceManager(nil, config, disabledStub())
+
+	policy := manager.queue.policy
+	if policy == nil {
+		t.Fatal("queue policy is nil")
+	}
+	if IsTaskEnabled(policy, MaintenanceTaskType("balance")) {
+		t.Error("balance enabled = true, want false from the persisted config")
+	}
+	if IsTaskEnabled(policy, MaintenanceTaskType("vacuum")) {
+		t.Error("vacuum enabled = true, want false from the persisted config")
+	}
+	if manager.scanner.policy != policy {
+		t.Error("scanner and queue disagree on the policy")
+	}
+}
diff --git a/weed/admin/maintenance/maintenance_policy_wiring_test.go b/weed/admin/maintenance/maintenance_policy_wiring_test.go
new file mode 100644
index 0000000000..fbbf4ab2f4
--- /dev/null
+++ b/weed/admin/maintenance/maintenance_policy_wiring_test.go
@@ -0,0 +1,209 @@
+package maintenance
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks"
+	"github.com/seaweedfs/seaweedfs/weed/worker/types"
+)
+
+// The detectors and schedulers live in a process-global registry, so these tests restore
+// whatever they change. Otherwise a test that disables a task leaks that state into every
+// later test in the package.
+func snapshotDetectorState(t *testing.T) {
+	t.Helper()
+
+	registry := tasks.GetGlobalTypesRegistry()
+	enabled := make(map[types.TaskType]bool)
+	maxConcurrent := make(map[types.TaskType]int)
+	for taskType, detector := range registry.GetAllDetectors() {
+		enabled[taskType] = detector.IsEnabled()
+	}
+	for taskType, scheduler := range registry.GetAllSchedulers() {
+		maxConcurrent[taskType] = scheduler.GetMaxConcurrent()
+	}
+
+	t.Cleanup(func() {
+		for taskType, detector := range registry.GetAllDetectors() {
+			if setter, ok := detector.(interface{ SetEnabled(bool) }); ok {
+				setter.SetEnabled(enabled[taskType])
+			}
+		}
+		for taskType, scheduler := range registry.GetAllSchedulers() {
+			if setter, ok := scheduler.(interface{ SetMaxConcurrent(int) }); ok {
+				setter.SetMaxConcurrent(maxConcurrent[taskType])
+			}
+		}
+	})
+}
+
+// TestPolicyReachesRegisteredDetectors is the regression test for the half of the scan-flood bug
+// that a corrected policy alone did not fix: MaintenanceIntegration pushes the policy into
+// detectors and schedulers through interface{ SetEnabled(bool) } and
+// interface{ SetMaxConcurrent(int) } type assertions, but every task is backed by
+// base.GenericDetector/base.GenericScheduler, which implemented neither. The assertions
+// failed silently for every task on every startup, so the policy never reached
+// detector.IsEnabled() - which is what ScanWithTaskDetectors gates scanning on.
+func TestPolicyReachesRegisteredDetectors(t *testing.T) {
+	snapshotDetectorState(t)
+
+	registry := tasks.GetGlobalTypesRegistry()
+	if len(registry.GetAllDetectors()) == 0 {
+		t.Fatal("no detectors registered, the test cannot prove anything")
+	}
+
+	// Enable everything first so the disabling below cannot pass by accident.
+	policy := policyWithAllTasks(t, true)
+	NewMaintenanceIntegration(NewMaintenanceQueue(policy), policy)
+
+	for taskType, detector := range registry.GetAllDetectors() {
+		if !detector.IsEnabled() {
+			t.Fatalf("detector %s is disabled after an all-enabled policy was applied", taskType)
+		}
+	}
+
+	// Now disable everything through the policy and check it lands on the detectors.
+	policy = policyWithAllTasks(t, false)
+	NewMaintenanceIntegration(NewMaintenanceQueue(policy), policy)
+
+	for taskType, detector := range registry.GetAllDetectors() {
+		if detector.IsEnabled() {
+			t.Errorf("detector %s still reports enabled after the policy disabled it; "+
+				"the policy is not reaching the flag ScanWithTaskDetectors gates on", taskType)
+		}
+	}
+	for taskType, scheduler := range registry.GetAllSchedulers() {
+		if scheduler.IsEnabled() {
+			t.Errorf("scheduler %s still reports enabled after the policy disabled it", taskType)
+		}
+	}
+}
+
+// TestPolicyMaxConcurrentReachesSchedulers covers the SetMaxConcurrent half of the same
+// wiring. GetMaxConcurrent is what MaintenanceQueue.getMaxConcurrentForTaskType asks before
+// starting another task of a type.
+func TestPolicyMaxConcurrentReachesSchedulers(t *testing.T) {
+	snapshotDetectorState(t)
+
+	const wantMaxConcurrent = 7
+
+	policy := policyWithAllTasks(t, true)
+	for _, taskPolicy := range policy.TaskPolicies {
+		taskPolicy.MaxConcurrent = wantMaxConcurrent
+	}
+	NewMaintenanceIntegration(NewMaintenanceQueue(policy), policy)
+
+	registry := tasks.GetGlobalTypesRegistry()
+	for taskType, scheduler := range registry.GetAllSchedulers() {
+		if _, covered := policy.TaskPolicies[string(taskType)]; !covered {
+			continue
+		}
+		if got := scheduler.GetMaxConcurrent(); got != wantMaxConcurrent {
+			t.Errorf("scheduler %s max concurrent = %d, want %d from the policy", taskType, got, wantMaxConcurrent)
+		}
+	}
+}
+
+// TestPolicyWithoutEntryLeavesTaskAlone guards the direction that would have been a silent
+// outage: IsTaskEnabled reports false for a task type the policy does not list, so applying
+// it unconditionally would disable every task the policy has no entry for.
+func TestPolicyWithoutEntryLeavesTaskAlone(t *testing.T) {
+	snapshotDetectorState(t)
+
+	registry := tasks.GetGlobalTypesRegistry()
+
+	// Start from a policy that enables everything.
+	enabling := policyWithAllTasks(t, true)
+	NewMaintenanceIntegration(NewMaintenanceQueue(enabling), enabling)
+
+	// An empty policy has an entry for nothing at all.
+	empty := &MaintenancePolicy{TaskPolicies: make(map[string]*worker_pb.TaskPolicy)}
+	NewMaintenanceIntegration(NewMaintenanceQueue(empty), empty)
+
+	for taskType, detector := range registry.GetAllDetectors() {
+		if !detector.IsEnabled() {
+			t.Errorf("detector %s was disabled by a policy that has no entry for it; "+
+				"a missing entry means no opinion, not disabled", taskType)
+		}
+	}
+}
+
+// TestBuildPolicyCoversEveryRegisteredTask keeps BuildPolicyFromTaskConfigs and the task
+// registry in step. A registered task with no policy entry has no enabled flag and no
+// concurrency limit of its own, which is the state ec_balance was in.
+func TestBuildPolicyCoversEveryRegisteredTask(t *testing.T) {
+	policy := BuildPolicyFromTaskConfigs(nil)
+
+	for taskType := range tasks.GetGlobalTypesRegistry().GetAllDetectors() {
+		if _, ok := policy.TaskPolicies[string(taskType)]; !ok {
+			t.Errorf("task %s is registered as a detector but BuildPolicyFromTaskConfigs "+
+				"builds no policy entry for it, so IsTaskEnabled reports false for it", taskType)
+		}
+	}
+}
+
+// TestBuildPolicyIncludesEcBalance pins the specific gap above.
+func TestBuildPolicyIncludesEcBalance(t *testing.T) {
+	policy := BuildPolicyFromTaskConfigs(nil)
+
+	ecBalance := policy.TaskPolicies[string(types.TaskTypeECBalance)]
+	if ecBalance == nil {
+		t.Fatal("no ec_balance entry in the built maintenance policy")
+	}
+	if !IsTaskEnabled(policy, MaintenanceTaskType(types.TaskTypeECBalance)) {
+		t.Error("ec_balance reports disabled with no persisted config, want the compiled-in default of enabled")
+	}
+	if ecBalance.GetEcBalanceConfig() == nil {
+		t.Error("ec_balance policy entry carries no EcBalanceConfig")
+	}
+}
+
+// policyWithAllTasks builds a policy that has an entry for every registered task type,
+// all sharing the same enabled flag.
+func policyWithAllTasks(t *testing.T, enabled bool) *MaintenancePolicy {
+	t.Helper()
+
+	policy := &MaintenancePolicy{
+		GlobalMaxConcurrent: 4,
+		TaskPolicies:        make(map[string]*worker_pb.TaskPolicy),
+	}
+	for taskType := range tasks.GetGlobalTypesRegistry().GetAllDetectors() {
+		policy.TaskPolicies[string(taskType)] = &worker_pb.TaskPolicy{
+			Enabled:               enabled,
+			MaxConcurrent:         1,
+			RepeatIntervalSeconds: 3600,
+		}
+	}
+	return policy
+}
+
+// TestPolicyHelpersTolerateNilPolicy pins the nil handling in the exported policy helpers.
+// MaintenanceConfig.Policy is nil until something builds one, and UpdateConfig accepts a
+// config that has none, so these are reachable with a nil policy - GetTaskPolicy used to
+// dereference it and take the admin process down.
+func TestPolicyHelpersTolerateNilPolicy(t *testing.T) {
+	const taskType = MaintenanceTaskType("balance")
+
+	if got := GetTaskPolicy(nil, taskType); got != nil {
+		t.Errorf("GetTaskPolicy(nil) = %v, want nil", got)
+	}
+	if IsTaskEnabled(nil, taskType) {
+		t.Error("IsTaskEnabled(nil) = true, want false")
+	}
+	if got := GetMaxConcurrent(nil, taskType); got != 1 {
+		t.Errorf("GetMaxConcurrent(nil) = %d, want the safe default 1", got)
+	}
+	if got := GetRepeatInterval(nil, taskType); got != 0 {
+		t.Errorf("GetRepeatInterval(nil) = %d, want 0 so callers fall back to their own default", got)
+	}
+
+	// A policy that exists but lists nothing must behave the same way.
+	empty := &MaintenancePolicy{}
+	if got := GetTaskPolicy(empty, taskType); got != nil {
+		t.Errorf("GetTaskPolicy(empty) = %v, want nil", got)
+	}
+	if IsTaskEnabled(empty, taskType) {
+		t.Error("IsTaskEnabled(empty) = true, want false")
+	}
+}
diff --git a/weed/admin/maintenance/maintenance_queue.go b/weed/admin/maintenance/maintenance_queue.go
index 8af9c8f909..de4e2643b6 100644
--- a/weed/admin/maintenance/maintenance_queue.go
+++ b/weed/admin/maintenance/maintenance_queue.go
@@ -97,21 +97,53 @@ func (mq *MaintenanceQueue) LoadTasksFromPersistence() error {
 	return nil
 }
 
-// saveTaskState saves a task to persistent storage
+// isTerminalStatus reports whether the status is a terminal task state.
+func isTerminalStatus(status MaintenanceTaskStatus) bool {
+	return status == TaskStatusCompleted || status == TaskStatusFailed || status == TaskStatusCancelled
+}
+
+// saveTaskState saves a task to persistent storage. persistMu orders the
+// status check and the write against the cancel paths' deletes, so a stale
+// non-terminal file cannot resurrect the task on the next restart.
 func (mq *MaintenanceQueue) saveTaskState(task *MaintenanceTask) {
-	if mq.persistence != nil {
-		if err := mq.persistence.SaveTaskState(task); err != nil {
-			glog.Errorf("Failed to save task state for %s: %v", task.ID, err)
-		}
+	if mq.persistence == nil {
+		return
+	}
+	mq.persistMu.Lock()
+	defer mq.persistMu.Unlock()
+	mq.saveTaskStateLocked(task)
+}
+
+// saveTaskStateLocked must be called with persistMu held.
+func (mq *MaintenanceQueue) saveTaskStateLocked(task *MaintenanceTask) {
+	mq.mutex.RLock()
+	live, ok := mq.tasks[task.ID]
+	stale := !isTerminalStatus(task.Status) && (!ok || isTerminalStatus(live.Status))
+	mq.mutex.RUnlock()
+	if stale {
+		return
+	}
+	if err := mq.persistence.SaveTaskState(task); err != nil {
+		glog.Errorf("Failed to save task state for %s: %v", task.ID, err)
 	}
 }
 
-func (mq *MaintenanceQueue) deleteTaskState(taskID string) {
-	if mq.persistence != nil {
-		if err := mq.persistence.DeleteTaskState(taskID); err != nil {
-			glog.V(2).Infof("Failed to delete task state for %s: %v", taskID, err)
-		}
+func (mq *MaintenanceQueue) deleteTaskState(taskID string) error {
+	if mq.persistence == nil {
+		return nil
 	}
+	mq.persistMu.Lock()
+	defer mq.persistMu.Unlock()
+	return mq.deleteTaskStateLocked(taskID)
+}
+
+// deleteTaskStateLocked must be called with persistMu held.
+func (mq *MaintenanceQueue) deleteTaskStateLocked(taskID string) error {
+	if err := mq.persistence.DeleteTaskState(taskID); err != nil {
+		glog.Warningf("Failed to delete task state for %s: %v", taskID, err)
+		return err
+	}
+	return nil
 }
 
 // cleanupCompletedTasks removes old completed tasks beyond the retention limit
@@ -297,9 +329,18 @@ func (mq *MaintenanceQueue) CancelPendingTasksByType(taskType MaintenanceTaskTyp
 	mq.pendingTasks = remaining
 	mq.mutex.Unlock()
 
-	// Persist cancelled state outside the lock to avoid blocking
-	for _, snapshot := range cancelledSnapshots {
-		mq.saveTaskState(snapshot)
+	// Cancelled is terminal: drop the file like CompleteTask does instead of
+	// leaving one orphaned .pb per cancelled task per scan cycle. If removal
+	// fails, persist the cancelled state so a restart drops it instead of
+	// re-queueing it.
+	if mq.persistence != nil {
+		mq.persistMu.Lock()
+		for _, snapshot := range cancelledSnapshots {
+			if mq.deleteTaskStateLocked(snapshot.ID) != nil {
+				mq.saveTaskStateLocked(snapshot)
+			}
+		}
+		mq.persistMu.Unlock()
 	}
 	return cancelled
 }
@@ -884,18 +925,19 @@ func (mq *MaintenanceQueue) GetWorkers() []*MaintenanceWorker {
 	return workers
 }
 
-// GetWorkerSlotTotals aggregates worker count and used/max task slots under the
-// lock, so callers don't read live worker fields that task updates mutate.
-func (mq *MaintenanceQueue) GetWorkerSlotTotals() (workers, used, max int) {
+// GetWorkerSlots returns used/max task slots per worker ID, snapshotted under
+// the lock so callers don't read live worker fields that task updates mutate.
+// Keyed by ID so callers can merge this registry with the plugin worker
+// registry without counting a worker that appears in both twice.
+func (mq *MaintenanceQueue) GetWorkerSlots() map[string]WorkerSlots {
 	mq.mutex.RLock()
 	defer mq.mutex.RUnlock()
 
-	for _, worker := range mq.workers {
-		workers++
-		used += worker.CurrentLoad
-		max += worker.MaxConcurrent
+	slots := make(map[string]WorkerSlots, len(mq.workers))
+	for id, worker := range mq.workers {
+		slots[id] = WorkerSlots{Used: worker.CurrentLoad, Max: worker.MaxConcurrent}
 	}
-	return
+	return slots
 }
 
 // generateTaskID generates a unique ID for tasks
@@ -921,7 +963,7 @@ func generateTaskID() string {
 	return fmt.Sprintf("%s-%04d", string(b), timestamp)
 }
 
-// CleanupOldTasks removes old completed and failed tasks
+// CleanupOldTasks removes old terminal tasks from memory
 func (mq *MaintenanceQueue) CleanupOldTasks(retention time.Duration) int {
 	mq.mutex.Lock()
 	defer mq.mutex.Unlock()
@@ -930,7 +972,7 @@ func (mq *MaintenanceQueue) CleanupOldTasks(retention time.Duration) int {
 	removed := 0
 
 	for id, task := range mq.tasks {
-		if (task.Status == TaskStatusCompleted || task.Status == TaskStatusFailed) &&
+		if (task.Status == TaskStatusCompleted || task.Status == TaskStatusFailed || task.Status == TaskStatusCancelled) &&
 			task.CompletedAt != nil &&
 			task.CompletedAt.Before(cutoff) {
 			delete(mq.tasks, id)
diff --git a/weed/admin/maintenance/maintenance_queue_test.go b/weed/admin/maintenance/maintenance_queue_test.go
index 7a1328919c..5da1de337e 100644
--- a/weed/admin/maintenance/maintenance_queue_test.go
+++ b/weed/admin/maintenance/maintenance_queue_test.go
@@ -618,7 +618,7 @@ func TestMaintenanceQueue_StaleWorkerCapacityRelease(t *testing.T) {
 func TestMaintenanceManager_CancelTaskCapacityRelease(t *testing.T) {
 	// Setup Manager
 	config := DefaultMaintenanceConfig()
-	mm := NewMaintenanceManager(nil, config)
+	mm := NewMaintenanceManager(nil, config, nil)
 	integration := mm.scanner.integration
 	mq := mm.queue
 	at := integration.GetActiveTopology()
diff --git a/weed/admin/maintenance/maintenance_scan_cadence_test.go b/weed/admin/maintenance/maintenance_scan_cadence_test.go
new file mode 100644
index 0000000000..e8db972345
--- /dev/null
+++ b/weed/admin/maintenance/maintenance_scan_cadence_test.go
@@ -0,0 +1,168 @@
+package maintenance
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+// scanCadenceClient is a minimal AdminClient whose first call blocks until the test
+// releases it. Blocking the first scan is what makes the cadence test deterministic:
+// the scan loop evaluates the error state right after triggering a scan, and that scan
+// runs in its own goroutine, so without the block the loop could observe the error
+// counter either before or after the scan finished.
+type scanCadenceClient struct {
+	mu      sync.Mutex
+	calls   int
+	release chan struct{}
+}
+
+func (c *scanCadenceClient) WithMasterClient(fn func(client master_pb.SeaweedClient) error) error {
+	c.mu.Lock()
+	c.calls++
+	first := c.calls == 1
+	c.mu.Unlock()
+
+	if first {
+		<-c.release
+	}
+
+	// Returning nil without invoking fn yields an empty, successful scan.
+	return nil
+}
+
+func (c *scanCadenceClient) callCount() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.calls
+}
+
+// TestScanLoopRestoresIntervalAfterBackoff is the regression test for the scan flood. The loop shortens its ticker to the
+// error backoff delay after a failed scan. It used to compare the target interval against
+// the *configured* scan interval rather than against the interval the ticker was actually
+// running at, so once the errors stopped the comparison came out false and the ticker was
+// never restored: one transient failure pinned the scanner to one scan per second for as
+// long as the process lived.
+//
+// The test seeds the error state, lets the loop drop into the 1s backoff, then lets a scan
+// succeed and asserts the loop goes back to the configured 3s cadence instead of keeping
+// the 1s one.
+func TestScanLoopRestoresIntervalAfterBackoff(t *testing.T) {
+	const baseInterval = 3 * time.Second
+
+	client := &scanCadenceClient{release: make(chan struct{})}
+
+	config := DefaultMaintenanceConfig()
+	config.ScanIntervalSeconds = int32(baseInterval / time.Second)
+	manager := NewMaintenanceManager(client, config, nil)
+
+	// Seed a failed scan so the very first cadence decision drops to the backoff delay.
+	// backoffDelay is what getScanInterval returns while errorCount > 0.
+	manager.mutex.Lock()
+	manager.errorCount = 1
+	manager.backoffDelay = time.Second
+	manager.running = true
+	manager.mutex.Unlock()
+
+	go manager.scanLoop()
+	defer manager.Stop()
+
+	// First tick at ~3s: the scan blocks in the client, so the loop still sees errorCount == 1
+	// and switches the ticker to the 1s backoff.
+	deadline := time.Now().Add(baseInterval + 2*time.Second)
+	for client.callCount() == 0 {
+		if time.Now().After(deadline) {
+			t.Fatal("scan loop never triggered its first scan")
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+
+	// Let the blocked scan complete successfully, which clears the error state.
+	close(client.release)
+
+	// Wait for the error state to clear so the next cadence decision is unambiguous.
+	deadline = time.Now().Add(2 * time.Second)
+	for {
+		errorCount, _, _ := manager.GetErrorState()
+		if errorCount == 0 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("error tracking never reset, errorCount=%d", errorCount)
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+
+	// The ticker is at 1s now. Wait for the next tick, where the loop must notice the
+	// recovery and restore the 3s cadence.
+	time.Sleep(1500 * time.Millisecond)
+	before := client.callCount()
+
+	// Observe a window that a 1s cadence would fill with scans and a 3s cadence would not.
+	const window = 5 * time.Second
+	time.Sleep(window)
+	callsInWindow := client.callCount() - before
+
+	// One scan makes two master-client calls. 3s cadence: at most 2 scans (4 calls) in 5s,
+	// even if a stall shifts the window. 1s cadence: about 5 scans (10 calls).
+	if callsInWindow > 4 {
+		t.Errorf("scan loop made %d master-client calls in %v after recovering from a failed scan; "+
+			"the ticker was left at the %v backoff instead of returning to the configured %v",
+			callsInWindow, window, time.Second, baseInterval)
+	}
+	if callsInWindow == 0 {
+		t.Errorf("scan loop ran no scans in %v, expected the %v cadence to fire at least once", window, baseInterval)
+	}
+}
+
+// TestScanLoopEntersBackoffOnError checks the other half of the cadence logic: a failing
+// scan still has to shorten the ticker, so the fix above did not simply pin the loop to
+// the configured interval.
+func TestScanLoopEntersBackoffOnError(t *testing.T) {
+	config := DefaultMaintenanceConfig()
+	config.ScanIntervalSeconds = 600
+	manager := NewMaintenanceManager(nil, config, nil)
+
+	baseInterval := time.Duration(config.ScanIntervalSeconds) * time.Second
+
+	if got := manager.getScanInterval(baseInterval); got != baseInterval {
+		t.Errorf("healthy scan interval = %v, want the configured %v", got, baseInterval)
+	}
+
+	manager.mutex.Lock()
+	manager.errorCount = 1
+	manager.backoffDelay = time.Second
+	manager.mutex.Unlock()
+
+	if got := manager.getScanInterval(baseInterval); got != time.Second {
+		t.Errorf("scan interval while failing = %v, want the %v backoff", got, time.Second)
+	}
+
+	manager.mutex.Lock()
+	manager.resetErrorTracking()
+	manager.mutex.Unlock()
+
+	if got := manager.getScanInterval(baseInterval); got != baseInterval {
+		t.Errorf("scan interval after recovery = %v, want the configured %v", got, baseInterval)
+	}
+}
+
+// TestStopIsIdempotent guards the stop channel against a double close, which used to panic
+// when StopMaintenanceManager ran twice (for example on a shutdown path that also runs on
+// a signal handler).
+func TestStopIsIdempotent(t *testing.T) {
+	manager := NewMaintenanceManager(nil, DefaultMaintenanceConfig(), nil)
+
+	manager.mutex.Lock()
+	manager.running = true
+	manager.mutex.Unlock()
+
+	manager.Stop()
+	manager.Stop()
+
+	if manager.IsRunning() {
+		t.Error("manager still reports running after Stop")
+	}
+}
diff --git a/weed/admin/maintenance/maintenance_scanner.go b/weed/admin/maintenance/maintenance_scanner.go
index 5b963c1e99..f3fdd4d727 100644
--- a/weed/admin/maintenance/maintenance_scanner.go
+++ b/weed/admin/maintenance/maintenance_scanner.go
@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 )
@@ -101,7 +102,8 @@ func (ms *MaintenanceScanner) getVolumeHealthMetrics() ([]*types.VolumeHealthMet
 	glog.V(1).Infof("Collecting volume health metrics from master")
 	err := ms.adminClient.WithMasterClient(func(client master_pb.SeaweedClient) error {
 
-		resp, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+		// Streamed, so the master never builds the whole listing to send it.
+		resp, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
diff --git a/weed/admin/maintenance/maintenance_types.go b/weed/admin/maintenance/maintenance_types.go
index 8118939538..f7120a3c54 100644
--- a/weed/admin/maintenance/maintenance_types.go
+++ b/weed/admin/maintenance/maintenance_types.go
@@ -144,9 +144,14 @@ func DefaultMaintenanceConfig() *MaintenanceConfig {
 
 // Policy helper functions (since we can't add methods to type aliases)
 
-// GetTaskPolicy returns the policy for a specific task type
+// GetTaskPolicy returns the policy for a specific task type, or nil when the maintenance
+// policy has no entry for it.
+//
+// A nil maintenance policy is a legitimate state, not a programming error:
+// MaintenanceConfig.Policy is unset until something builds one, and UpdateConfig accepts a
+// config that carries none. Dereferencing it here panicked the whole admin process.
 func GetTaskPolicy(mp *MaintenancePolicy, taskType MaintenanceTaskType) *TaskPolicy {
-	if mp.TaskPolicies == nil {
+	if mp == nil || mp.TaskPolicies == nil {
 		return nil
 	}
 	return mp.TaskPolicies[string(taskType)]
@@ -174,6 +179,9 @@ func GetMaxConcurrent(mp *MaintenancePolicy, taskType MaintenanceTaskType) int {
 func GetRepeatInterval(mp *MaintenancePolicy, taskType MaintenanceTaskType) int {
 	policy := GetTaskPolicy(mp, taskType)
 	if policy == nil {
+		if mp == nil {
+			return 0
+		}
 		return int(mp.DefaultRepeatIntervalSeconds)
 	}
 	return int(policy.RepeatIntervalSeconds)
@@ -194,6 +202,13 @@ type MaintenanceWorker struct {
 	CurrentLoad   int                   `json:"current_load"`
 }
 
+// WorkerSlots is a point-in-time snapshot of one worker's task slot usage,
+// taken under the queue lock so callers never read live worker fields.
+type WorkerSlots struct {
+	Used int `json:"used"`
+	Max  int `json:"max"`
+}
+
 // MaintenanceQueue manages the task queue and worker coordination
 type MaintenanceQueue struct {
 	tasks        map[string]*MaintenanceTask
@@ -203,6 +218,10 @@ type MaintenanceQueue struct {
 	policy       *MaintenancePolicy
 	integration  *MaintenanceIntegration
 	persistence  TaskPersistence // Interface for task persistence
+	// persistMu serializes the check+write in saveTaskState against the
+	// deletes in the cancel paths, so a stale pending save cannot land on
+	// disk after the task's file was removed.
+	persistMu sync.Mutex
 }
 
 // MaintenanceScanner analyzes the cluster and generates maintenance tasks
diff --git a/weed/admin/plugin/DESIGN.md b/weed/admin/plugin/DESIGN.md
index 04688cbae1..fb7067d4ee 100644
--- a/weed/admin/plugin/DESIGN.md
+++ b/weed/admin/plugin/DESIGN.md
@@ -180,9 +180,9 @@ Phase 4 status (starter)
 
 Run example:
 - Start admin: `weed admin -master=localhost:9333`
-- Start worker: `weed worker -admin=localhost:23646`
-- Optional explicit job type: `weed worker -admin=localhost:23646 -jobType=vacuum`
-- Optional stable worker ID persistence: `weed worker -admin=localhost:23646 -workingDir=/var/lib/seaweedfs-plugin`
+- Start worker: `weed worker -admin=localhost:12535`
+- Optional explicit job type: `weed worker -admin=localhost:12535 -jobType=vacuum`
+- Optional stable worker ID persistence: `weed worker -admin=localhost:12535 -workingDir=/var/lib/seaweedfs-plugin`
 
 Phase 5
 - Migrate remaining job types and deprecate old mechanism.
diff --git a/weed/admin/plugin/host_affinity.go b/weed/admin/plugin/host_affinity.go
new file mode 100644
index 0000000000..ddff60ece0
--- /dev/null
+++ b/weed/admin/plugin/host_affinity.go
@@ -0,0 +1,66 @@
+package plugin
+
+import (
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+
+	"google.golang.org/protobuf/proto"
+)
+
+// JobReplicaHosts are the volume-replica hosts a job will read from.
+// Used so executor pick prefers a worker on one of those machines.
+// Sources with ShardIds are EC-cleanup rows, not encode replicas.
+func JobReplicaHosts(job *plugin_pb.JobSpec) []string {
+	if job == nil {
+		return nil
+	}
+	var addrs []string
+	addrs = append(addrs, pluginworker.ReadStringListConfig(job.Parameters, "replica_servers")...)
+	if src := strings.TrimSpace(pluginworker.ReadStringConfig(job.Parameters, "source_server", "")); src != "" {
+		addrs = append(addrs, src)
+	}
+	if payload := pluginworker.ReadBytesConfig(job.Parameters, "task_params_pb"); len(payload) > 0 {
+		params := &worker_pb.TaskParams{}
+		if err := proto.Unmarshal(payload, params); err == nil {
+			for _, s := range params.GetSources() {
+				if s == nil || s.Node == "" || len(s.ShardIds) > 0 {
+					continue
+				}
+				addrs = append(addrs, s.Node)
+			}
+		}
+	}
+	return util.HostKeysFromAddresses(addrs)
+}
+
+// partitionByPreferredHost splits candidates into (host matches, others).
+// No preferred hosts, or no matches, returns (nil, all) so callers keep
+// the existing slots+round-robin path.
+func partitionByPreferredHost(candidates []*WorkerSession, preferredHosts []string) (pref, rest []*WorkerSession) {
+	want := util.HostKeysFromAddresses(preferredHosts)
+	if len(want) == 0 || len(candidates) == 0 {
+		return nil, candidates
+	}
+	set := make(map[string]struct{}, len(want))
+	for _, h := range want {
+		set[h] = struct{}{}
+	}
+	for _, c := range candidates {
+		if c == nil {
+			continue
+		}
+		if _, ok := set[util.HostKey(c.Address)]; ok {
+			pref = append(pref, c)
+			continue
+		}
+		rest = append(rest, c)
+	}
+	if len(pref) == 0 {
+		return nil, candidates
+	}
+	return pref, rest
+}
diff --git a/weed/admin/plugin/observations.go b/weed/admin/plugin/observations.go
new file mode 100644
index 0000000000..67f4b2a0ee
--- /dev/null
+++ b/weed/admin/plugin/observations.go
@@ -0,0 +1,179 @@
+package plugin
+
+import (
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+)
+
+// maxObservations caps the store. Observations are a convenience for display,
+// so a cluster with more objects than this loses the oldest rather than growing
+// admin's memory without limit.
+const maxObservations = 10000
+
+// observationKey identifies one observed object across workers.
+func observationKey(objectID []string) string {
+	return strings.Join(objectID, "\x1f")
+}
+
+// ObservationStore keeps the last thing a worker said about each object.
+//
+// It is deliberately not authoritative: a worker reports what it saw when it
+// last looked, and admin serves that back with its timestamp so a reader can
+// judge how stale it is. Nothing schedules work from it.
+type ObservationStore struct {
+	mu      sync.RWMutex
+	entries map[string]*Observation
+}
+
+// Observation is one object as a worker last reported it.
+type Observation struct {
+	ObjectID   []string `json:"object_id"`
+	ObjectKind string   `json:"object_kind"`
+	Format     string   `json:"format"`
+	// Attributes are flattened on the way in: they exist to be displayed and
+	// served as JSON, and the typed form is the worker's business.
+	Attributes map[string]interface{} `json:"attributes"`
+	JobType    string                 `json:"job_type"`
+	WorkerID   string                 `json:"worker_id"`
+	ObservedAt time.Time              `json:"observed_at"`
+}
+
+func NewObservationStore() *ObservationStore {
+	return &ObservationStore{entries: make(map[string]*Observation)}
+}
+
+// Record stores what one worker reported, replacing whatever was there for the
+// same object. A later observation from a different worker still wins: the
+// newest look at an object is the useful one.
+func (s *ObservationStore) Record(workerID string, report *plugin_pb.WorkerObservations) {
+	if report == nil {
+		return
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for _, observed := range report.Observations {
+		if observed == nil || len(observed.ObjectId) == 0 {
+			continue
+		}
+		at := time.Now()
+		if observed.ObservedAt != nil {
+			at = observed.ObservedAt.AsTime()
+		}
+		s.entries[observationKey(observed.ObjectId)] = &Observation{
+			ObjectID:   observed.ObjectId,
+			ObjectKind: observed.ObjectKind,
+			Format:     observed.Format,
+			Attributes: flattenAttributes(observed.Attributes),
+			JobType:    report.JobType,
+			WorkerID:   workerID,
+			ObservedAt: at,
+		}
+	}
+	s.evictOldest()
+}
+
+// evictOldest trims the store back under the cap. Called with the lock held.
+func (s *ObservationStore) evictOldest() {
+	if len(s.entries) <= maxObservations {
+		return
+	}
+	keys := make([]string, 0, len(s.entries))
+	for key := range s.entries {
+		keys = append(keys, key)
+	}
+	sort.Slice(keys, func(i, j int) bool {
+		return s.entries[keys[i]].ObservedAt.Before(s.entries[keys[j]].ObservedAt)
+	})
+	for _, key := range keys[:len(s.entries)-maxObservations] {
+		delete(s.entries, key)
+	}
+}
+
+// flattenAttributes unwraps the ConfigValue envelope that configValueMapToPlain
+// preserves. An observation exists to be read, and {"int64_value":"16"} is not
+// a number anyone wants to render; a protojson int64 also arrives as a string,
+// so it is converted back.
+func flattenAttributes(values map[string]*plugin_pb.ConfigValue) map[string]interface{} {
+	plain := configValueMapToPlain(values)
+	if plain == nil {
+		return nil
+	}
+	flat := make(map[string]interface{}, len(plain))
+	for name, value := range plain {
+		wrapper, ok := value.(map[string]interface{})
+		if !ok || len(wrapper) != 1 {
+			flat[name] = value
+			continue
+		}
+		for kind, inner := range wrapper {
+			if kind == "int64_value" {
+				if text, ok := inner.(string); ok {
+					if parsed, err := strconv.ParseInt(text, 10, 64); err == nil {
+						flat[name] = parsed
+						continue
+					}
+				}
+			}
+			flat[name] = inner
+		}
+	}
+	return flat
+}
+
+// Get returns the last observation of one object, if any.
+func (s *ObservationStore) Get(objectID []string) (*Observation, bool) {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	observed, ok := s.entries[observationKey(objectID)]
+	return observed, ok
+}
+
+// GetFormat returns the last observation of one object only when it describes
+// the format asked for. A table can be dropped and remade in another format at
+// the same path, and the stale observation would then describe something that
+// no longer exists.
+func (s *ObservationStore) GetFormat(objectID []string, format string) (*Observation, bool) {
+	observed, ok := s.Get(objectID)
+	if !ok || !strings.EqualFold(observed.Format, format) {
+		return nil, false
+	}
+	return observed, true
+}
+
+// List returns every observation, newest first.
+func (s *ObservationStore) List() []*Observation {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	all := make([]*Observation, 0, len(s.entries))
+	for _, observed := range s.entries {
+		all = append(all, observed)
+	}
+	sort.Slice(all, func(i, j int) bool {
+		return all[i].ObservedAt.After(all[j].ObservedAt)
+	})
+	return all
+}
+
+// AttributeString renders one attribute for display, or "" when it is absent.
+func (o *Observation) AttributeString(name string) string {
+	if o == nil {
+		return ""
+	}
+	value, ok := o.Attributes[name]
+	if !ok || value == nil {
+		return ""
+	}
+	return fmt.Sprintf("%v", value)
+}
+
+// Observations exposes the store so admin handlers can serve it.
+func (r *Plugin) Observations() *ObservationStore {
+	return r.observations
+}
diff --git a/weed/admin/plugin/observations_test.go b/weed/admin/plugin/observations_test.go
new file mode 100644
index 0000000000..f719339f5d
--- /dev/null
+++ b/weed/admin/plugin/observations_test.go
@@ -0,0 +1,126 @@
+package plugin
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func intValue(v int64) *plugin_pb.ConfigValue {
+	return &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: v}}
+}
+
+func stringValue(v string) *plugin_pb.ConfigValue {
+	return &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_StringValue{StringValue: v}}
+}
+
+// An observation exists to be rendered, so the ConfigValue envelope comes off
+// on the way in. A page asking for "fragments" wants 16, not a wrapper holding
+// the string "16".
+func TestObservationAttributesAreFlattened(t *testing.T) {
+	store := NewObservationStore()
+	store.Record("worker-1", &plugin_pb.WorkerObservations{
+		JobType: "lance_compact",
+		Observations: []*plugin_pb.ObjectObservation{{
+			ObjectId:   []string{"bucket", "ns", "table"},
+			ObjectKind: "table",
+			Format:     "LANCE",
+			Attributes: map[string]*plugin_pb.ConfigValue{
+				"fragments": intValue(16),
+				"schema":    stringValue(`[{"name":"id"}]`),
+			},
+			ObservedAt: timestamppb.New(time.Now()),
+		}},
+	})
+
+	observed, ok := store.Get([]string{"bucket", "ns", "table"})
+	if !ok {
+		t.Fatal("observation was not stored")
+	}
+	if got, ok := observed.Attributes["fragments"].(int64); !ok || got != 16 {
+		t.Fatalf("fragments = %#v, want int64 16", observed.Attributes["fragments"])
+	}
+	if got := observed.AttributeString("fragments"); got != "16" {
+		t.Fatalf("AttributeString(fragments) = %q, want \"16\"", got)
+	}
+	if got := observed.AttributeString("schema"); got != `[{"name":"id"}]` {
+		t.Fatalf("AttributeString(schema) = %q", got)
+	}
+	if observed.WorkerID != "worker-1" || observed.JobType != "lance_compact" {
+		t.Fatalf("provenance lost: %+v", observed)
+	}
+}
+
+// The newest look at an object is the useful one, whichever worker took it.
+func TestObservationIsReplacedByALaterOne(t *testing.T) {
+	store := NewObservationStore()
+	record := func(worker string, fragments int64) {
+		store.Record(worker, &plugin_pb.WorkerObservations{
+			JobType: "lance_compact",
+			Observations: []*plugin_pb.ObjectObservation{{
+				ObjectId:   []string{"bucket", "ns", "table"},
+				Format:     "LANCE",
+				Attributes: map[string]*plugin_pb.ConfigValue{"fragments": intValue(fragments)},
+				ObservedAt: timestamppb.New(time.Now()),
+			}},
+		})
+	}
+	record("worker-1", 16)
+	record("worker-2", 1)
+
+	observed, _ := store.Get([]string{"bucket", "ns", "table"})
+	if got := observed.AttributeString("fragments"); got != "1" {
+		t.Fatalf("fragments = %q, want the later observation's 1", got)
+	}
+	if observed.WorkerID != "worker-2" {
+		t.Fatalf("worker = %q, want worker-2", observed.WorkerID)
+	}
+	if len(store.List()) != 1 {
+		t.Fatalf("store holds %d entries, want 1", len(store.List()))
+	}
+}
+
+// Missing attributes read as empty rather than panicking a template.
+func TestObservationAttributeStringHandlesAbsence(t *testing.T) {
+	var absent *Observation
+	if got := absent.AttributeString("fragments"); got != "" {
+		t.Fatalf("nil observation returned %q", got)
+	}
+	store := NewObservationStore()
+	store.Record("worker-1", &plugin_pb.WorkerObservations{
+		Observations: []*plugin_pb.ObjectObservation{{
+			ObjectId: []string{"b", "n", "t"},
+		}},
+	})
+	observed, _ := store.Get([]string{"b", "n", "t"})
+	if got := observed.AttributeString("nothing"); got != "" {
+		t.Fatalf("absent attribute returned %q", got)
+	}
+}
+
+// A table path can be dropped and remade in another format. The observation left
+// behind describes something that is no longer there, so a caller asking about
+// the new format must not be handed it.
+func TestObservationLookupIsScopedToFormat(t *testing.T) {
+	store := NewObservationStore()
+	objectID := []string{"bucket", "ns", "table"}
+	store.Record("worker-1", &plugin_pb.WorkerObservations{
+		Observations: []*plugin_pb.ObjectObservation{{
+			ObjectId:   objectID,
+			Format:     "LANCE",
+			ObservedAt: timestamppb.New(time.Now()),
+		}},
+	})
+
+	if _, ok := store.GetFormat(objectID, "ICEBERG"); ok {
+		t.Fatal("a LANCE observation was returned for an ICEBERG table")
+	}
+	if _, ok := store.GetFormat(objectID, "lance"); !ok {
+		t.Fatal("format matching must not depend on case")
+	}
+	if _, ok := store.GetFormat(objectID, ""); ok {
+		t.Fatal("an unknown format must not match a recorded one")
+	}
+}
diff --git a/weed/admin/plugin/plugin.go b/weed/admin/plugin/plugin.go
index 8f1944d8c9..fda1a86586 100644
--- a/weed/admin/plugin/plugin.go
+++ b/weed/admin/plugin/plugin.go
@@ -14,6 +14,8 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
@@ -97,6 +99,11 @@ type Plugin struct {
 	pendingExecutionMu sync.Mutex
 	pendingExecution   map[string]chan *plugin_pb.JobCompleted
 
+	pendingPreviewMu sync.Mutex
+	pendingPreview   map[string]chan *plugin_pb.ObjectPreviewResponse
+
+	observations *ObservationStore
+
 	jobsMu sync.RWMutex
 	jobs   map[string]*TrackedJob
 	// serialize stale job cleanup to avoid duplicate expirations
@@ -180,6 +187,8 @@ func New(options Options) (*Plugin, error) {
 		pendingSchema:             make(map[string]chan *plugin_pb.ConfigSchemaResponse),
 		pendingDetection:          make(map[string]*pendingDetectionState),
 		pendingExecution:          make(map[string]chan *plugin_pb.JobCompleted),
+		pendingPreview:            make(map[string]chan *plugin_pb.ObjectPreviewResponse),
+		observations:              NewObservationStore(),
 		nextDetectionAt:           make(map[string]time.Time),
 		detectionInFlight:         make(map[string]bool),
 		detectorLeases:            make(map[string]string),
@@ -235,6 +244,13 @@ func (r *Plugin) Shutdown() {
 	}
 	r.pendingSchemaMu.Unlock()
 
+	r.pendingPreviewMu.Lock()
+	for requestID, ch := range r.pendingPreview {
+		close(ch)
+		delete(r.pendingPreview, requestID)
+	}
+	r.pendingPreviewMu.Unlock()
+
 	r.pendingDetectionMu.Lock()
 	for requestID, state := range r.pendingDetection {
 		close(state.complete)
@@ -253,6 +269,10 @@ func (r *Plugin) Shutdown() {
 }
 
 func (r *Plugin) WorkerStream(stream plugin_pb.PluginControlService_WorkerStreamServer) error {
+	if err := security.CheckGrpcAdminPeer(stream.Context(), security.SigningKey(util.GetViper().GetString("jwt.filer_signing.key"))); err != nil {
+		return err
+	}
+
 	first, err := stream.Recv()
 	if err != nil {
 		if errors.Is(err, io.EOF) {
@@ -595,7 +615,7 @@ func (r *Plugin) ExecuteJob(
 	releaseGate := r.acquireDetectionExecutionGate(jobType, true)
 	defer releaseGate()
 
-	executor, err := r.registry.PickExecutor(jobType)
+	executor, err := r.registry.PickExecutor(jobType, JobReplicaHosts(job)...)
 	if err != nil {
 		return nil, err
 	}
@@ -978,6 +998,10 @@ func (r *Plugin) handleWorkerMessage(workerID string, message *plugin_pb.WorkerT
 		r.handleJobProgressUpdate(workerID, body.JobProgressUpdate)
 	case *plugin_pb.WorkerToAdminMessage_JobCompleted:
 		r.handleJobCompleted(body.JobCompleted)
+	case *plugin_pb.WorkerToAdminMessage_Observations:
+		r.observations.Record(workerID, body.Observations)
+	case *plugin_pb.WorkerToAdminMessage_ObjectPreviewResponse:
+		r.handleObjectPreviewResponse(body.ObjectPreviewResponse)
 	case *plugin_pb.WorkerToAdminMessage_Acknowledge:
 		if !body.Acknowledge.Accepted {
 			glog.Warningf("Plugin worker %s rejected request %s: %s", workerID, body.Acknowledge.RequestId, body.Acknowledge.Message)
diff --git a/weed/admin/plugin/plugin_monitor.go b/weed/admin/plugin/plugin_monitor.go
index 9a5327ca18..c8a58e298c 100644
--- a/weed/admin/plugin/plugin_monitor.go
+++ b/weed/admin/plugin/plugin_monitor.go
@@ -887,6 +887,37 @@ func (r *Plugin) trackExecutionQueued(job *plugin_pb.JobSpec) {
 	})
 }
 
+// bindQueuedJobWorker records the home worker while the job stays pending/queued.
+func (r *Plugin) bindQueuedJobWorker(job *plugin_pb.JobSpec, workerID string) {
+	if job == nil || strings.TrimSpace(job.JobId) == "" || strings.TrimSpace(workerID) == "" {
+		return
+	}
+
+	now := time.Now().UTC()
+	r.jobsMu.Lock()
+	tracked := r.jobs[job.JobId]
+	if tracked == nil {
+		r.jobsMu.Unlock()
+		return
+	}
+	if isTerminalTrackedJobState(tracked.State) {
+		r.jobsMu.Unlock()
+		return
+	}
+	tracked.WorkerID = workerID
+	tracked.Message = "queued on worker " + workerID
+	tracked.UpdatedAt = timeToPtr(now)
+	snap := cloneTrackedJob(*tracked)
+	r.dirtyJobs = true
+	r.jobsMu.Unlock()
+
+	r.persistJobDetailSnapshot(job.JobId, func(detail *TrackedJob) {
+		detail.WorkerID = snap.WorkerID
+		detail.Message = snap.Message
+		detail.UpdatedAt = snap.UpdatedAt
+	})
+}
+
 func (r *Plugin) cancelQueuedJob(job *plugin_pb.JobSpec, cause error) {
 	reason := "job canceled"
 	if cause != nil {
diff --git a/weed/admin/plugin/plugin_scheduler.go b/weed/admin/plugin/plugin_scheduler.go
index 294bfd6f1e..58ad878d6a 100644
--- a/weed/admin/plugin/plugin_scheduler.go
+++ b/weed/admin/plugin/plugin_scheduler.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -11,6 +12,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
@@ -28,12 +30,20 @@ const (
 	defaultScheduledMaxResults           int32 = 1000
 	defaultScheduledExecutionConcurrency       = 1
 	defaultScheduledPerWorkerConcurrency       = 1
-	maxScheduledExecutionConcurrency           = 128
-	defaultScheduledRetryBackoff               = 5 * time.Second
-	defaultClusterContextTimeout               = 10 * time.Second
-	defaultWaitingBacklogFloor                 = 8
-	defaultWaitingBacklogMultiplier            = 4
-	maxEstimatedRuntimeCap                     = 8 * time.Hour
+	// Hold a job on replica-host workers until their reservation load
+	// reaches this; 0 disables the pin and spills immediately.
+	defaultLocalQueuePin = 5
+	// Wait this long after a home worker disappears before stealing
+	// its queue; 0 steals immediately. Covers a reconnect blink.
+	defaultOrphanRehomeGrace         = 30 * time.Second
+	maxScheduledExecutionConcurrency = 128
+	defaultScheduledRetryBackoff     = 5 * time.Second
+	defaultClusterContextTimeout     = 10 * time.Second
+	defaultWaitingBacklogFloor       = 8
+	defaultWaitingBacklogMultiplier  = 4
+	maxEstimatedRuntimeCap           = 8 * time.Hour
+	// How long started jobs may drain past the run window close.
+	scheduledExecutionDrainGrace = 30 * time.Minute
 )
 
 type schedulerPolicy struct {
@@ -47,6 +57,12 @@ type schedulerPolicy struct {
 	PerWorkerConcurrency   int
 	RetryLimit             int
 	ExecutorReserveBackoff time.Duration
+	// LocalQueuePin is K: do not spill off replica-host workers while
+	// min(load(pref)) < K. Zero is the old immediate-spill path.
+	LocalQueuePin int
+	// OrphanRehomeGrace is how long a missing home's queue is held
+	// before steal-without-K. Zero steals as soon as the worker is gone.
+	OrphanRehomeGrace time.Duration
 }
 
 // laneSchedulerLoop is the main scheduling goroutine for a single lane.
@@ -411,15 +427,10 @@ func (r *Plugin) runJobTypeIteration(jobType string, policy schedulerPolicy) boo
 	if execPolicy.ExecutionTimeout <= 0 {
 		execPolicy.ExecutionTimeout = defaultScheduledExecutionTimeout
 	}
-	if execPolicy.ExecutionTimeout > remaining {
-		execPolicy.ExecutionTimeout = remaining
-	}
 
-	// jobCtx bounds how long this run keeps STARTING jobs; a started job
-	// runs on its own estimated-runtime deadline (see
-	// executeScheduledJobWithExecutor). Jobs still queued when the window
-	// closes are canceled and re-proposed by a later detection, so one large
-	// backlog cannot monopolise the lane for hours.
+	// jobCtx bounds how long this run keeps STARTING jobs; started jobs
+	// drain past the window close (see scheduledAttemptContext), while
+	// still-queued jobs are canceled and re-proposed by a later detection.
 	successCount, errorCount, canceledCount := r.dispatchScheduledProposals(jobCtx, jobType, filtered, clusterContext, execPolicy)
 
 	status := "success"
@@ -469,6 +480,8 @@ func (r *Plugin) loadSchedulerPolicy(jobType string) (schedulerPolicy, bool, err
 		PerWorkerConcurrency:   int(adminRuntime.PerWorkerExecutionConcurrency),
 		RetryLimit:             int(adminRuntime.RetryLimit),
 		ExecutorReserveBackoff: 200 * time.Millisecond,
+		LocalQueuePin:          defaultLocalQueuePin,
+		OrphanRehomeGrace:      defaultOrphanRehomeGrace,
 	}
 
 	if policy.DetectionInterval < r.schedulerTick {
@@ -499,6 +512,9 @@ func (r *Plugin) loadSchedulerPolicy(jobType string) (schedulerPolicy, bool, err
 	if policy.ExecutionTimeout < defaultScheduledExecutionTimeout {
 		policy.ExecutionTimeout = defaultScheduledExecutionTimeout
 	}
+	if policy.LocalQueuePin < 0 {
+		policy.LocalQueuePin = 0
+	}
 
 	return policy, true, nil
 }
@@ -599,7 +615,7 @@ func deriveSchedulerAdminRuntime(
 	descriptor *plugin_pb.JobTypeDescriptor,
 ) *plugin_pb.AdminRuntimeConfig {
 	if cfg != nil && cfg.AdminRuntime != nil {
-		adminConfig := *cfg.AdminRuntime
+		adminConfig := proto.Clone(cfg.AdminRuntime).(*plugin_pb.AdminRuntimeConfig)
 		// Overlay descriptor defaults for any zero numeric fields. Persisted
 		// configs from older versions have no execution_timeout_seconds, and
 		// without this overlay the scheduler would fall back to the 90s
@@ -631,7 +647,7 @@ func deriveSchedulerAdminRuntime(
 				adminConfig.ExecutionTimeoutSeconds = defaults.ExecutionTimeoutSeconds
 			}
 		}
-		return &adminConfig
+		return adminConfig
 	}
 
 	if descriptor == nil || descriptor.AdminRuntimeDefaults == nil {
@@ -816,19 +832,22 @@ func (r *Plugin) dispatchScheduledProposals(
 	// whole dispatch lets manual shell operations interleave between jobs.
 	jobsRequireLock := LaneRequiresLock(JobTypeLane(jobType))
 
-	jobQueue := make(chan *plugin_pb.JobSpec, len(proposals))
+	jobs := make([]*plugin_pb.JobSpec, 0, len(proposals))
 	for index, proposal := range proposals {
-		job := buildScheduledJobSpec(jobType, proposal, index)
-		r.trackExecutionQueued(job)
 		select {
 		case <-r.shutdownCh:
-			close(jobQueue)
-			return 0, 0, 0
+			for _, job := range jobs {
+				r.cancelQueuedJob(job, errSchedulerShutdown)
+			}
+			return 0, 0, len(jobs)
 		default:
-			jobQueue <- job
 		}
+		job := buildScheduledJobSpec(jobType, proposal, index)
+		r.trackExecutionQueued(job)
+		jobs = append(jobs, job)
 	}
-	close(jobQueue)
+
+	queues := r.assignJobsToWorkerQueues(jobType, jobs, policy)
 
 	var wg sync.WaitGroup
 	var statsMu sync.Mutex
@@ -845,130 +864,110 @@ func (r *Plugin) dispatchScheduledProposals(
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-
-		jobLoop:
-			for job := range jobQueue {
+			for {
 				select {
 				case <-r.shutdownCh:
 					return
 				default:
 				}
-
 				if ctx.Err() != nil {
-					r.cancelQueuedJob(job, ctx.Err())
-					statsMu.Lock()
-					canceledCount++
-					statsMu.Unlock()
+					return
+				}
+				if queues.isEmpty() {
+					return
+				}
+
+				item, targetID := r.takeQueuedJob(queues, jobType, policy)
+				if item == nil {
+					if queues.isEmpty() {
+						return
+					}
+					if !waitForShutdownOrTimerWithContext(r.shutdownCh, ctx, policy.ExecutorReserveBackoff) {
+						return
+					}
+					continue
+				}
+				if ctx.Err() != nil {
+					queues.pushFront(item)
+					return
+				}
+
+				executor, release, reserveErr := r.reserveExecutorByID(jobType, policy, targetID)
+				if reserveErr != nil {
+					queues.pushFront(item)
+					if ctx.Err() != nil {
+						return
+					}
+					if !waitForShutdownOrTimerWithContext(r.shutdownCh, ctx, policy.ExecutorReserveBackoff) {
+						return
+					}
 					continue
 				}
 
-				for {
-					select {
-					case <-r.shutdownCh:
-						return
-					default:
+				var releaseJobLock func()
+				if jobsRequireLock {
+					var lockErr error
+					releaseJobLock, lockErr = r.acquireAdminLock(fmt.Sprintf("plugin scheduler %s job %s", jobType, item.job.JobId))
+					if lockErr != nil {
+						release()
+						statsMu.Lock()
+						errorCount++
+						statsMu.Unlock()
+						r.appendActivity(JobActivity{
+							JobID:      item.job.JobId,
+							JobType:    item.job.JobType,
+							Source:     "admin_scheduler",
+							Message:    fmt.Sprintf("scheduled execution lock failed: %v", lockErr),
+							Stage:      "failed",
+							OccurredAt: timeToPtr(time.Now().UTC()),
+						})
+						continue
 					}
 					if ctx.Err() != nil {
-						r.cancelQueuedJob(job, ctx.Err())
+						releaseJobLock()
+						release()
+						queues.pushFront(item)
+						return
+					}
+				}
+
+				err := r.executeScheduledJobWithExecutor(ctx, executor, item.job, clusterContext, policy)
+				if releaseJobLock != nil {
+					releaseJobLock()
+				}
+				release()
+				if errors.Is(err, errExecutorAtCapacity) {
+					queues.pushFront(item)
+					if !waitForShutdownOrTimerWithContext(r.shutdownCh, ctx, policy.ExecutorReserveBackoff) {
+						return
+					}
+					continue
+				}
+				if err != nil {
+					if ctx.Err() != nil || errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+						r.cancelQueuedJob(item.job, err)
 						statsMu.Lock()
 						canceledCount++
 						statsMu.Unlock()
-						continue jobLoop
-					}
-
-					executor, release, reserveErr := r.reserveScheduledExecutor(ctx, jobType, policy)
-					if reserveErr != nil {
-						if ctx.Err() != nil {
-							r.cancelQueuedJob(job, ctx.Err())
-							statsMu.Lock()
-							canceledCount++
-							statsMu.Unlock()
-							continue jobLoop
-						}
-						statsMu.Lock()
-						errorCount++
-						statsMu.Unlock()
-						r.appendActivity(JobActivity{
-							JobType:    jobType,
-							Source:     "admin_scheduler",
-							Message:    fmt.Sprintf("scheduled execution reservation failed: %v", reserveErr),
-							Stage:      "failed",
-							OccurredAt: timeToPtr(time.Now().UTC()),
-						})
-						break
-					}
-
-					var releaseJobLock func()
-					if jobsRequireLock {
-						var lockErr error
-						releaseJobLock, lockErr = r.acquireAdminLock(fmt.Sprintf("plugin scheduler %s job %s", jobType, job.JobId))
-						if lockErr != nil {
-							release()
-							statsMu.Lock()
-							errorCount++
-							statsMu.Unlock()
-							r.appendActivity(JobActivity{
-								JobID:      job.JobId,
-								JobType:    job.JobType,
-								Source:     "admin_scheduler",
-								Message:    fmt.Sprintf("scheduled execution lock failed: %v", lockErr),
-								Stage:      "failed",
-								OccurredAt: timeToPtr(time.Now().UTC()),
-							})
-							break
-						}
-						// The lock may have been held by an operator for a
-						// while; re-check the execution window.
-						if ctx.Err() != nil {
-							releaseJobLock()
-							release()
-							r.cancelQueuedJob(job, ctx.Err())
-							statsMu.Lock()
-							canceledCount++
-							statsMu.Unlock()
-							continue jobLoop
-						}
-					}
-
-					err := r.executeScheduledJobWithExecutor(ctx, executor, job, clusterContext, policy)
-					if releaseJobLock != nil {
-						releaseJobLock()
-					}
-					release()
-					if errors.Is(err, errExecutorAtCapacity) {
-						r.trackExecutionQueued(job)
-						if !waitForShutdownOrTimerWithContext(r.shutdownCh, ctx, policy.ExecutorReserveBackoff) {
-							return
-						}
 						continue
 					}
-					if err != nil {
-						if ctx.Err() != nil || errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
-							r.cancelQueuedJob(job, err)
-							statsMu.Lock()
-							canceledCount++
-							statsMu.Unlock()
-							continue jobLoop
-						}
-						statsMu.Lock()
-						errorCount++
-						statsMu.Unlock()
-						r.appendActivity(JobActivity{
-							JobID:      job.JobId,
-							JobType:    job.JobType,
-							Source:     "admin_scheduler",
-							Message:    fmt.Sprintf("scheduled execution failed: %v", err),
-							Stage:      "failed",
-							OccurredAt: timeToPtr(time.Now().UTC()),
-						})
-						break
-					}
-
 					statsMu.Lock()
-					successCount++
+					errorCount++
 					statsMu.Unlock()
-					break
+					r.appendActivity(JobActivity{
+						JobID:      item.job.JobId,
+						JobType:    item.job.JobType,
+						Source:     "admin_scheduler",
+						Message:    fmt.Sprintf("scheduled execution failed: %v", err),
+						Stage:      "failed",
+						OccurredAt: timeToPtr(time.Now().UTC()),
+					})
+					continue
 				}
+
+				statsMu.Lock()
+				successCount++
+				statsMu.Unlock()
 			}
 		}()
 	}
@@ -979,8 +978,8 @@ func (r *Plugin) dispatchScheduledProposals(
 	if drainErr == nil {
 		drainErr = errSchedulerShutdown
 	}
-	for job := range jobQueue {
-		r.cancelQueuedJob(job, drainErr)
+	for _, item := range queues.drain() {
+		r.cancelQueuedJob(item.job, drainErr)
 		canceledCount++
 	}
 
@@ -991,6 +990,7 @@ func (r *Plugin) reserveScheduledExecutor(
 	ctx context.Context,
 	jobType string,
 	policy schedulerPolicy,
+	preferredHosts []string,
 ) (*WorkerSession, func(), error) {
 	if ctx == nil {
 		ctx = context.Background()
@@ -1018,7 +1018,7 @@ func (r *Plugin) reserveScheduledExecutor(
 			return nil, nil, fmt.Errorf("timed out waiting for executor capacity for %s", jobType)
 		}
 
-		executors, err := r.registry.ListExecutors(jobType)
+		executors, err := r.registry.ListExecutors(jobType, preferredHosts...)
 		if err != nil {
 			if !waitForShutdownOrTimerWithContext(r.shutdownCh, ctx, policy.ExecutorReserveBackoff) {
 				if ctx.Err() != nil {
@@ -1029,11 +1029,19 @@ func (r *Plugin) reserveScheduledExecutor(
 			continue
 		}
 
-		for _, executor := range executors {
-			release, ok := r.tryReserveExecutorCapacity(executor, jobType, policy)
-			if !ok {
-				continue
+		pref, rest := partitionByPreferredHost(executors, preferredHosts)
+		lane := JobTypeLane(jobType)
+		loadOf := func(e *WorkerSession) int { return r.executorReservationLoad(e, lane) }
+
+		if len(pref) > 0 {
+			sortExecutorsByLoad(pref, loadOf)
+			if executor, release, ok := r.tryReserveFirst(pref, jobType, policy); ok {
+				return executor, release, nil
 			}
+		}
+
+		sortExecutorsByLoad(rest, loadOf)
+		if executor, release, ok := r.tryReserveFirst(rest, jobType, policy); ok {
 			return executor, release, nil
 		}
 
@@ -1054,6 +1062,75 @@ func (r *Plugin) tryReserveExecutorCapacity(
 	return r.tryReserveExecutorCapacityForLane(executor, jobType, policy, JobTypeLane(jobType))
 }
 
+func (r *Plugin) tryReserveFirst(executors []*WorkerSession, jobType string, policy schedulerPolicy) (*WorkerSession, func(), bool) {
+	for _, executor := range executors {
+		release, ok := r.tryReserveExecutorCapacity(executor, jobType, policy)
+		if ok {
+			return executor, release, true
+		}
+	}
+	return nil, nil, false
+}
+
+func (r *Plugin) reserveExecutorByID(jobType string, policy schedulerPolicy, workerID string) (*WorkerSession, func(), error) {
+	workerID = strings.TrimSpace(workerID)
+	if workerID == "" {
+		return nil, nil, fmt.Errorf("executor id is empty")
+	}
+	executors, err := r.registry.ListExecutors(jobType)
+	if err != nil {
+		return nil, nil, err
+	}
+	for _, executor := range executors {
+		if executor == nil || executor.WorkerID != workerID {
+			continue
+		}
+		release, ok := r.tryReserveExecutorCapacity(executor, jobType, policy)
+		if !ok {
+			return nil, nil, errExecutorAtCapacity
+		}
+		return executor, release, nil
+	}
+	return nil, nil, fmt.Errorf("executor %s is not available for %s", workerID, jobType)
+}
+
+func (r *Plugin) executorReservationLoad(executor *WorkerSession, lane SchedulerLane) int {
+	if executor == nil {
+		return 0
+	}
+	load := 0
+	if executor.Heartbeat != nil && executor.Heartbeat.ExecutionSlotsUsed > 0 {
+		load = int(executor.Heartbeat.ExecutionSlotsUsed)
+	}
+	workerID := strings.TrimSpace(executor.WorkerID)
+	if ls := r.lanes[lane]; ls != nil {
+		ls.execMu.Lock()
+		load += ls.execRes[workerID]
+		ls.execMu.Unlock()
+		return load
+	}
+	r.schedulerExecMu.Lock()
+	load += r.schedulerExecReservations[workerID]
+	r.schedulerExecMu.Unlock()
+	return load
+}
+
+func sortExecutorsByLoad(executors []*WorkerSession, load func(*WorkerSession) int) {
+	sort.SliceStable(executors, func(i, j int) bool {
+		if executors[i] == nil {
+			return false
+		}
+		if executors[j] == nil {
+			return true
+		}
+		li, lj := load(executors[i]), load(executors[j])
+		if li != lj {
+			return li < lj
+		}
+		return executors[i].WorkerID < executors[j].WorkerID
+	})
+}
+
 // tryReserveExecutorCapacityForLane reserves an execution slot on the
 // per-lane reservation pool so that lanes cannot starve each other.
 func (r *Plugin) tryReserveExecutorCapacityForLane(
@@ -1201,24 +1278,11 @@ func (r *Plugin) executeScheduledJobWithExecutor(
 		// default execution timeout. This lets handlers like vacuum scale
 		// the timeout based on volume size so large volumes are not killed.
 		timeout := policy.ExecutionTimeout
-		if job.Parameters != nil {
-			if est, ok := job.Parameters["estimated_runtime_seconds"]; ok {
-				if v := est.GetInt64Value(); v > 0 {
-					estimated := time.Duration(v) * time.Second
-					if estimated > maxEstimatedRuntimeCap {
-						estimated = maxEstimatedRuntimeCap
-					}
-					if estimated > timeout {
-						timeout = estimated
-					}
-				}
-			}
+		estimated := scheduledEstimatedRuntime(job.Parameters)
+		if estimated > timeout {
+			timeout = estimated
 		}
-		// The attempt runs against its own deadline, detached from the
-		// dispatch window (ctx): a job started near the end of the window
-		// may run to completion; the window only stops further jobs from
-		// starting.
-		execCtx, cancel := context.WithTimeout(context.Background(), timeout)
+		execCtx, cancel := scheduledAttemptContext(ctx, timeout, estimated)
 		_, err := r.executeJobWithExecutor(execCtx, executor, job, clusterContext, int32(attempt))
 		cancel()
 		if err == nil {
@@ -1253,6 +1317,43 @@ func (r *Plugin) executeScheduledJobWithExecutor(
 	return lastErr
 }
 
+// scheduledEstimatedRuntime returns the job's declared estimated runtime,
+// capped at maxEstimatedRuntimeCap. The seconds are capped before the
+// Duration conversion so oversized values cannot overflow.
+func scheduledEstimatedRuntime(parameters map[string]*plugin_pb.ConfigValue) time.Duration {
+	est, ok := parameters["estimated_runtime_seconds"]
+	if !ok {
+		return 0
+	}
+	v := est.GetInt64Value()
+	if v <= 0 {
+		return 0
+	}
+	if v > int64(maxEstimatedRuntimeCap/time.Second) {
+		v = int64(maxEstimatedRuntimeCap / time.Second)
+	}
+	return time.Duration(v) * time.Second
+}
+
+// scheduledAttemptContext bounds one execution attempt: its own timeout,
+// capped at the window deadline plus scheduledExecutionDrainGrace so a
+// draining job cannot hold the lane indefinitely, but never below the
+// job's declared estimated runtime.
+func scheduledAttemptContext(window context.Context, timeout, estimated time.Duration) (context.Context, context.CancelFunc) {
+	deadline := time.Now().Add(timeout)
+	if window != nil {
+		if windowEnd, ok := window.Deadline(); ok {
+			if drainDeadline := windowEnd.Add(scheduledExecutionDrainGrace); deadline.After(drainDeadline) {
+				if floor := time.Now().Add(estimated); floor.After(drainDeadline) {
+					drainDeadline = floor
+				}
+				deadline = drainDeadline
+			}
+		}
+	}
+	return context.WithDeadline(context.Background(), deadline)
+}
+
 func (r *Plugin) shouldSkipDetectionForWaitingJobs(jobType string, policy schedulerPolicy) (bool, int, int) {
 	waitingCount := r.countWaitingTrackedJobs(jobType)
 	threshold := waitingBacklogThreshold(policy)
@@ -1556,6 +1657,8 @@ func (r *Plugin) DispatchProposals(
 			ExecutionTimeout:       defaultScheduledExecutionTimeout,
 			RetryBackoff:           defaultScheduledRetryBackoff,
 			ExecutorReserveBackoff: 200 * time.Millisecond,
+			LocalQueuePin:          defaultLocalQueuePin,
+			OrphanRehomeGrace:      defaultOrphanRehomeGrace,
 		}
 	}
 
diff --git a/weed/admin/plugin/plugin_scheduler_test.go b/weed/admin/plugin/plugin_scheduler_test.go
index 9b1d5e8104..b7aa3757ca 100644
--- a/weed/admin/plugin/plugin_scheduler_test.go
+++ b/weed/admin/plugin/plugin_scheduler_test.go
@@ -3,11 +3,13 @@ package plugin
 import (
 	"context"
 	"fmt"
+	"math"
 	"sync"
 	"testing"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 func TestLoadSchedulerPolicyUsesAdminConfig(t *testing.T) {
@@ -59,6 +61,12 @@ func TestLoadSchedulerPolicyUsesAdminConfig(t *testing.T) {
 	if policy.JobTypeMaxRuntime != 30*time.Minute {
 		t.Fatalf("unexpected max runtime: got=%v", policy.JobTypeMaxRuntime)
 	}
+	if policy.LocalQueuePin != defaultLocalQueuePin {
+		t.Fatalf("unexpected local queue pin: got=%d", policy.LocalQueuePin)
+	}
+	if policy.OrphanRehomeGrace != defaultOrphanRehomeGrace {
+		t.Fatalf("unexpected orphan rehome grace: got=%v", policy.OrphanRehomeGrace)
+	}
 }
 
 func TestLoadSchedulerPolicyUsesDescriptorDefaultsWhenConfigMissing(t *testing.T) {
@@ -136,13 +144,13 @@ func TestReserveScheduledExecutorRespectsPerWorkerLimit(t *testing.T) {
 		ExecutorReserveBackoff: time.Millisecond,
 	}
 
-	executor1, release1, err := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy)
+	executor1, release1, err := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy, nil)
 	if err != nil {
 		t.Fatalf("reserve executor 1: %v", err)
 	}
 	defer release1()
 
-	executor2, release2, err := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy)
+	executor2, release2, err := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy, nil)
 	if err != nil {
 		t.Fatalf("reserve executor 2: %v", err)
 	}
@@ -264,7 +272,7 @@ func TestReserveScheduledExecutorTimesOutWhenNoExecutor(t *testing.T) {
 
 	start := time.Now()
 	pluginSvc.Shutdown()
-	_, _, err = pluginSvc.reserveScheduledExecutor(context.Background(), "missing-job-type", policy)
+	_, _, err = pluginSvc.reserveScheduledExecutor(context.Background(), "missing-job-type", policy, nil)
 	if err == nil {
 		t.Fatalf("expected reservation shutdown error")
 	}
@@ -295,7 +303,7 @@ func TestReserveScheduledExecutorWaitsForWorkerCapacity(t *testing.T) {
 		ExecutorReserveBackoff: 5 * time.Millisecond,
 	}
 
-	_, release1, err := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy)
+	_, release1, err := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy, nil)
 	if err != nil {
 		t.Fatalf("reserve executor 1: %v", err)
 	}
@@ -306,7 +314,7 @@ func TestReserveScheduledExecutorWaitsForWorkerCapacity(t *testing.T) {
 	}
 	secondReserveCh := make(chan reserveResult, 1)
 	go func() {
-		_, release2, reserveErr := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy)
+		_, release2, reserveErr := pluginSvc.reserveScheduledExecutor(context.Background(), "balance", policy, nil)
 		if release2 != nil {
 			release2()
 		}
@@ -738,6 +746,144 @@ func TestDispatchScheduledProposalsLocksPerJob(t *testing.T) {
 	}
 }
 
+func TestScheduledAttemptContextDrainGrace(t *testing.T) {
+	t.Parallel()
+
+	assertDeadline := func(t *testing.T, ctx context.Context, want time.Time) {
+		t.Helper()
+		got, ok := ctx.Deadline()
+		if !ok {
+			t.Fatal("expected attempt context to carry a deadline")
+		}
+		if diff := got.Sub(want); diff < -5*time.Second || diff > 5*time.Second {
+			t.Fatalf("unexpected attempt deadline: got=%v want~%v", got, want)
+		}
+	}
+
+	windowEnd := time.Now().Add(time.Minute)
+	window, cancelWindow := context.WithDeadline(context.Background(), windowEnd)
+	defer cancelWindow()
+
+	// Fits inside the window: keeps its own deadline.
+	ctx, cancel := scheduledAttemptContext(window, 30*time.Second, 0)
+	assertDeadline(t, ctx, time.Now().Add(30*time.Second))
+	cancel()
+
+	// Longer: capped at window close plus the grace.
+	ctx, cancel = scheduledAttemptContext(window, 3*time.Hour, 0)
+	assertDeadline(t, ctx, windowEnd.Add(scheduledExecutionDrainGrace))
+	cancel()
+
+	// Estimated runtime: keeps its full deadline.
+	ctx, cancel = scheduledAttemptContext(window, 3*time.Hour, 3*time.Hour)
+	assertDeadline(t, ctx, time.Now().Add(3*time.Hour))
+	cancel()
+
+	// An estimate below the timeout floors the drain cap.
+	ctx, cancel = scheduledAttemptContext(window, 3*time.Hour, 45*time.Minute)
+	assertDeadline(t, ctx, time.Now().Add(45*time.Minute))
+	cancel()
+
+	// No window deadline: the timeout stands alone.
+	ctx, cancel = scheduledAttemptContext(context.Background(), 2*time.Hour, 0)
+	assertDeadline(t, ctx, time.Now().Add(2*time.Hour))
+	cancel()
+}
+
+func TestScheduledEstimatedRuntime(t *testing.T) {
+	t.Parallel()
+
+	estimate := func(v int64) map[string]*plugin_pb.ConfigValue {
+		return map[string]*plugin_pb.ConfigValue{
+			"estimated_runtime_seconds": {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: v}},
+		}
+	}
+
+	if got := scheduledEstimatedRuntime(nil); got != 0 {
+		t.Fatalf("nil parameters: got=%v want=0", got)
+	}
+	if got := scheduledEstimatedRuntime(estimate(-5)); got != 0 {
+		t.Fatalf("negative estimate: got=%v want=0", got)
+	}
+	if got := scheduledEstimatedRuntime(estimate(600)); got != 10*time.Minute {
+		t.Fatalf("normal estimate: got=%v want=10m", got)
+	}
+	// Oversized seconds cap before the Duration conversion can overflow.
+	if got := scheduledEstimatedRuntime(estimate(math.MaxInt64)); got != maxEstimatedRuntimeCap {
+		t.Fatalf("oversized estimate: got=%v want=%v", got, maxEstimatedRuntimeCap)
+	}
+}
+
+func TestDispatchScheduledProposalsDrainsStartedJobOnWindowClose(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	const workerID = "worker-drain"
+	const jobType = "s3_lifecycle" // lifecycle lane: no admin lock needed
+	pluginSvc.registry.UpsertFromHello(&plugin_pb.WorkerHello{
+		WorkerId: workerID,
+		Capabilities: []*plugin_pb.JobTypeCapability{
+			{JobType: jobType, CanExecute: true, MaxExecutionConcurrency: 1},
+		},
+	})
+	session := &streamSession{workerID: workerID, outgoing: make(chan *plugin_pb.AdminToWorkerMessage, 8), done: make(chan struct{})}
+	pluginSvc.putSession(session)
+
+	windowCtx, closeWindow := context.WithCancel(context.Background())
+	defer closeWindow()
+
+	policy := schedulerPolicy{
+		ExecutionConcurrency:   1,
+		PerWorkerConcurrency:   1,
+		ExecutionTimeout:       time.Hour,
+		ExecutorReserveBackoff: time.Millisecond,
+	}
+	proposals := []*plugin_pb.JobProposal{
+		{ProposalId: "p1", JobType: jobType, DedupeKey: "k1"},
+		{ProposalId: "p2", JobType: jobType, DedupeKey: "k2"},
+	}
+
+	resultCh := make(chan [3]int, 1)
+	go func() {
+		success, errCount, canceled := pluginSvc.dispatchScheduledProposals(
+			windowCtx, jobType, proposals, &plugin_pb.ClusterContext{}, policy)
+		resultCh <- [3]int{success, errCount, canceled}
+	}()
+
+	first := <-session.outgoing
+	execReq := first.GetExecuteJobRequest()
+	if execReq == nil {
+		t.Fatalf("expected execute_job_request, got %+v", first)
+	}
+
+	// Close the window mid-job: the job must drain to completion while the
+	// still-queued second proposal is canceled.
+	closeWindow()
+	pluginSvc.handleJobCompleted(&plugin_pb.JobCompleted{
+		RequestId:   first.RequestId,
+		JobId:       execReq.Job.JobId,
+		JobType:     jobType,
+		Success:     true,
+		CompletedAt: timestamppb.Now(),
+	})
+
+	result := <-resultCh
+	if result[0] != 1 || result[1] != 0 || result[2] != 1 {
+		t.Fatalf("unexpected dispatch counts: success=%d errors=%d canceled=%d", result[0], result[1], result[2])
+	}
+
+	select {
+	case unexpected := <-session.outgoing:
+		t.Fatalf("expected no further worker messages (no cancel for the draining job), got %+v", unexpected)
+	default:
+	}
+}
+
 // ---------- lane-scoped prune ----------
 
 func TestPruneSchedulerState_DefaultLaneKeepsForeignLanesAndPrunesOwnStale(t *testing.T) {
@@ -852,3 +998,50 @@ func TestLaneStatus_LifecycleNextDetectionSurvivesDefaultLanePrune(t *testing.T)
 			status.NextDetectionAt, expected)
 	}
 }
+
+func TestReserveWaterfillsPreferredHosts(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	ids := []string{"worker-a", "worker-b", "worker-c", "worker-d"}
+	for _, id := range ids {
+		pluginSvc.registry.UpsertFromHello(&plugin_pb.WorkerHello{
+			WorkerId: id,
+			Address:  "10.0.0.1:9334",
+			Capabilities: []*plugin_pb.JobTypeCapability{
+				{JobType: "erasure_coding", CanExecute: true, MaxExecutionConcurrency: 8},
+			},
+		})
+	}
+
+	policy := schedulerPolicy{
+		PerWorkerConcurrency:   8,
+		ExecutorReserveBackoff: time.Millisecond,
+		LocalQueuePin:          5,
+	}
+	preferred := []string{"10.0.0.1:8080"}
+
+	seen := map[string]int{}
+	var releases []func()
+	defer func() {
+		for _, release := range releases {
+			release()
+		}
+	}()
+	for i := 0; i < 4; i++ {
+		exec, release, err := pluginSvc.reserveScheduledExecutor(context.Background(), "erasure_coding", policy, preferred)
+		if err != nil {
+			t.Fatalf("reserve %d: %v", i, err)
+		}
+		releases = append(releases, release)
+		seen[exec.WorkerID]++
+	}
+	if len(seen) != 4 {
+		t.Fatalf("want one job per worker, got %v", seen)
+	}
+}
diff --git a/weed/admin/plugin/preview.go b/weed/admin/plugin/preview.go
new file mode 100644
index 0000000000..4b03ad579c
--- /dev/null
+++ b/weed/admin/plugin/preview.go
@@ -0,0 +1,105 @@
+package plugin
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+// maxPreviewRows caps what admin will ask for. A preview is a look at the
+// object, not an export, and the rows cross the control stream.
+const maxPreviewRows = 200
+
+// RequestObjectPreview asks the worker that last described an object for sample
+// rows of it, and waits for the answer.
+//
+// The worker is chosen from the observation store rather than by job type: the
+// one that last looked at this object is the one that can read it, and it says
+// so by having reported. That also means a preview is only available once
+// detection has run, which the caller should surface rather than hide.
+func (r *Plugin) RequestObjectPreview(ctx context.Context, objectID []string, format string, rowLimit int) (*plugin_pb.ObjectPreviewResponse, error) {
+	if len(objectID) == 0 {
+		return nil, fmt.Errorf("preview needs an object id")
+	}
+	// The conversion happens only inside the bound check, so what reaches the
+	// wire cannot depend on int being wider than int32 here.
+	requestedRows := int32(maxPreviewRows)
+	if rowLimit >= 1 && rowLimit <= maxPreviewRows {
+		requestedRows = int32(rowLimit)
+	}
+
+	observed, ok := r.observations.GetFormat(objectID, format)
+	if !ok {
+		return nil, fmt.Errorf("no worker has described this object as %s yet", format)
+	}
+	if _, connected := r.registry.Get(observed.WorkerID); !connected {
+		return nil, fmt.Errorf("worker %s is not connected", observed.WorkerID)
+	}
+
+	requestID, err := newRequestID("preview")
+	if err != nil {
+		return nil, err
+	}
+
+	responseCh := make(chan *plugin_pb.ObjectPreviewResponse, 1)
+	r.pendingPreviewMu.Lock()
+	r.pendingPreview[requestID] = responseCh
+	r.pendingPreviewMu.Unlock()
+	defer func() {
+		r.pendingPreviewMu.Lock()
+		delete(r.pendingPreview, requestID)
+		r.pendingPreviewMu.Unlock()
+	}()
+
+	request := &plugin_pb.AdminToWorkerMessage{
+		RequestId: requestID,
+		SentAt:    timestamppb.Now(),
+		Body: &plugin_pb.AdminToWorkerMessage_RequestObjectPreview{
+			RequestObjectPreview: &plugin_pb.RequestObjectPreview{
+				ObjectId: objectID,
+				Format:   format,
+				RowLimit: requestedRows,
+			},
+		},
+	}
+	if err := r.sendToWorker(observed.WorkerID, request); err != nil {
+		return nil, err
+	}
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case response, ok := <-responseCh:
+		if !ok {
+			return nil, fmt.Errorf("preview request %s interrupted", requestID)
+		}
+		if response == nil {
+			return nil, fmt.Errorf("preview request %s returned nothing", requestID)
+		}
+		if !response.Success {
+			return nil, fmt.Errorf("worker %s could not preview the object: %s", observed.WorkerID, response.ErrorMessage)
+		}
+		return response, nil
+	}
+}
+
+// handleObjectPreviewResponse routes one reply back to whoever is waiting.
+func (r *Plugin) handleObjectPreviewResponse(response *plugin_pb.ObjectPreviewResponse) {
+	if response == nil {
+		return
+	}
+	// Held across the send: Shutdown closes these channels under the same lock,
+	// and a send that raced it would panic on a closed channel.
+	r.pendingPreviewMu.Lock()
+	defer r.pendingPreviewMu.Unlock()
+	ch := r.pendingPreview[response.RequestId]
+	if ch == nil {
+		return
+	}
+	select {
+	case ch <- response:
+	default:
+	}
+}
diff --git a/weed/admin/plugin/preview_test.go b/weed/admin/plugin/preview_test.go
new file mode 100644
index 0000000000..a5f4345802
--- /dev/null
+++ b/weed/admin/plugin/preview_test.go
@@ -0,0 +1,202 @@
+package plugin
+
+import (
+	"context"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func previewPlugin(t *testing.T, workerID string) (*Plugin, *streamSession) {
+	t.Helper()
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New plugin error: %v", err)
+	}
+	t.Cleanup(pluginSvc.Shutdown)
+
+	pluginSvc.registry.UpsertFromHello(&plugin_pb.WorkerHello{WorkerId: workerID})
+	session := &streamSession{workerID: workerID, outgoing: make(chan *plugin_pb.AdminToWorkerMessage, 4), done: make(chan struct{})}
+	pluginSvc.putSession(session)
+	return pluginSvc, session
+}
+
+func observeObject(p *Plugin, workerID string, objectID []string) {
+	p.observations.Record(workerID, &plugin_pb.WorkerObservations{
+		JobType: "lance_compact",
+		Observations: []*plugin_pb.ObjectObservation{{
+			ObjectId:   objectID,
+			Format:     "LANCE",
+			ObservedAt: timestamppb.Now(),
+		}},
+	})
+}
+
+// The round trip the details page makes: ask the worker that described this
+// object, and render what it sends back.
+func TestRequestObjectPreviewReturnsTheWorkersRows(t *testing.T) {
+	t.Parallel()
+	const workerID = "lance-worker-1"
+	objectID := []string{"vectors", "ml", "embeddings"}
+	pluginSvc, session := previewPlugin(t, workerID)
+	observeObject(pluginSvc, workerID, objectID)
+
+	type result struct {
+		response *plugin_pb.ObjectPreviewResponse
+		err      error
+	}
+	results := make(chan result, 1)
+	go func() {
+		response, err := pluginSvc.RequestObjectPreview(context.Background(), objectID, "LANCE", 2)
+		results <- result{response, err}
+	}()
+
+	var request *plugin_pb.AdminToWorkerMessage
+	select {
+	case request = <-session.outgoing:
+	case <-time.After(2 * time.Second):
+		t.Fatal("no preview request reached the worker")
+	}
+	asked := request.GetRequestObjectPreview()
+	if asked == nil {
+		t.Fatalf("expected a preview request, got %T", request.Body)
+	}
+	if asked.RowLimit != 2 || asked.Format != "LANCE" {
+		t.Fatalf("request lost its parameters: %+v", asked)
+	}
+
+	pluginSvc.handleWorkerMessage(workerID, &plugin_pb.WorkerToAdminMessage{
+		WorkerId: workerID,
+		Body: &plugin_pb.WorkerToAdminMessage_ObjectPreviewResponse{
+			ObjectPreviewResponse: &plugin_pb.ObjectPreviewResponse{
+				RequestId: request.RequestId,
+				Success:   true,
+				Columns:   []string{"id", "vec"},
+				Rows:      []*plugin_pb.PreviewRow{{Values: []string{"1", "[0.1, 0.2]"}}},
+				TotalRows: 1024,
+			},
+		},
+	})
+
+	select {
+	case got := <-results:
+		if got.err != nil {
+			t.Fatalf("preview failed: %v", got.err)
+		}
+		if len(got.response.Rows) != 1 || got.response.Rows[0].Values[1] != "[0.1, 0.2]" {
+			t.Fatalf("rows did not survive the round trip: %+v", got.response.Rows)
+		}
+		if got.response.TotalRows != 1024 {
+			t.Fatalf("total_rows = %d, want 1024", got.response.TotalRows)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("preview never returned")
+	}
+}
+
+// A worker that cannot read the object says so, and the page shows its reason
+// rather than an empty table.
+func TestRequestObjectPreviewSurfacesTheWorkersError(t *testing.T) {
+	t.Parallel()
+	const workerID = "lance-worker-1"
+	objectID := []string{"vectors", "ml", "embeddings"}
+	pluginSvc, session := previewPlugin(t, workerID)
+	observeObject(pluginSvc, workerID, objectID)
+
+	errs := make(chan error, 1)
+	go func() {
+		_, err := pluginSvc.RequestObjectPreview(context.Background(), objectID, "LANCE", 10)
+		errs <- err
+	}()
+
+	request := <-session.outgoing
+	pluginSvc.handleWorkerMessage(workerID, &plugin_pb.WorkerToAdminMessage{
+		WorkerId: workerID,
+		Body: &plugin_pb.WorkerToAdminMessage_ObjectPreviewResponse{
+			ObjectPreviewResponse: &plugin_pb.ObjectPreviewResponse{
+				RequestId:    request.RequestId,
+				Success:      false,
+				ErrorMessage: "open lance dataset: access denied",
+			},
+		},
+	})
+
+	select {
+	case err := <-errs:
+		if err == nil || !strings.Contains(err.Error(), "access denied") {
+			t.Fatalf("error = %v, want the worker's reason", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("preview never returned")
+	}
+}
+
+// Nothing has looked at the object, so there is nobody to ask. Worth its own
+// message: it means detection has not run, not that the table is unreadable.
+func TestRequestObjectPreviewNeedsAnObservation(t *testing.T) {
+	t.Parallel()
+	pluginSvc, _ := previewPlugin(t, "lance-worker-1")
+
+	_, err := pluginSvc.RequestObjectPreview(context.Background(), []string{"vectors", "ml", "nothing"}, "LANCE", 10)
+	if err == nil || !strings.Contains(err.Error(), "described") {
+		t.Fatalf("error = %v, want one naming the missing description", err)
+	}
+}
+
+// The worker that described the object has since gone away.
+func TestRequestObjectPreviewNeedsAConnectedWorker(t *testing.T) {
+	t.Parallel()
+	objectID := []string{"vectors", "ml", "embeddings"}
+	pluginSvc, _ := previewPlugin(t, "lance-worker-1")
+	observeObject(pluginSvc, "lance-worker-gone", objectID)
+
+	_, err := pluginSvc.RequestObjectPreview(context.Background(), objectID, "LANCE", 10)
+	if err == nil || !strings.Contains(err.Error(), "not connected") {
+		t.Fatalf("error = %v, want one naming the absent worker", err)
+	}
+}
+
+// Shutdown closes every pending channel, and a reply can arrive at the same
+// moment; delivering it outside the lock panics with "send on closed channel".
+// The window is narrow enough that this test does not reliably reproduce it -
+// widening it with a Gosched between the lookup and the send does, every time -
+// so treat this as exercising the path rather than as a regression alarm.
+func TestObjectPreviewResponseRacesShutdown(t *testing.T) {
+	t.Parallel()
+	const workerID = "lance-worker-1"
+	objectID := []string{"vectors", "ml", "embeddings"}
+
+	for i := 0; i < 50; i++ {
+		pluginSvc, session := previewPlugin(t, workerID)
+		observeObject(pluginSvc, workerID, objectID)
+
+		go func() {
+			_, _ = pluginSvc.RequestObjectPreview(context.Background(), objectID, "LANCE", 10)
+		}()
+		request := <-session.outgoing
+
+		var wg sync.WaitGroup
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			pluginSvc.Shutdown()
+		}()
+		go func() {
+			defer wg.Done()
+			pluginSvc.handleWorkerMessage(workerID, &plugin_pb.WorkerToAdminMessage{
+				WorkerId: workerID,
+				Body: &plugin_pb.WorkerToAdminMessage_ObjectPreviewResponse{
+					ObjectPreviewResponse: &plugin_pb.ObjectPreviewResponse{
+						RequestId: request.RequestId,
+						Success:   true,
+					},
+				},
+			})
+		}()
+		wg.Wait()
+	}
+}
diff --git a/weed/admin/plugin/registry.go b/weed/admin/plugin/registry.go
index 46d51e79d9..6e27d30411 100644
--- a/weed/admin/plugin/registry.go
+++ b/weed/admin/plugin/registry.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"google.golang.org/protobuf/proto"
 )
 
 const defaultWorkerStaleTimeout = 2 * time.Minute
@@ -277,14 +278,24 @@ func (r *Registry) PickDetector(jobType string) (*WorkerSession, error) {
 }
 
 // PickExecutor picks one executor worker for a job type.
-func (r *Registry) PickExecutor(jobType string) (*WorkerSession, error) {
-	return r.pickByKind(jobType, false)
+// preferredHosts, when set, ranks workers whose Hello Address host matches a
+// replica/source host ahead of others (same-machine EC pull). Empty means the
+// previous slots+round-robin order.
+func (r *Registry) PickExecutor(jobType string, preferredHosts ...string) (*WorkerSession, error) {
+	list, err := r.ListExecutors(jobType, preferredHosts...)
+	if err != nil {
+		return nil, err
+	}
+	return list[0], nil
 }
 
 // ListExecutors returns sorted executor candidates for one job type.
 // Ordering is by most available execution slots, then lexical worker ID.
 // The top tie group is rotated round-robin to prevent sticky assignment.
-func (r *Registry) ListExecutors(jobType string) ([]*WorkerSession, error) {
+// preferredHosts, when any worker matches, are listed first (then the rest);
+// rotation applies only inside the preferred group so a local worker is not
+// rotated away in favor of a remote one.
+func (r *Registry) ListExecutors(jobType string, preferredHosts ...string) ([]*WorkerSession, error) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 
@@ -293,8 +304,16 @@ func (r *Registry) ListExecutors(jobType string) ([]*WorkerSession, error) {
 		return nil, fmt.Errorf("no executor worker available for job_type=%s", jobType)
 	}
 
-	sortByKind(candidates, jobType, false)
-	r.rotateTopCandidatesLocked(candidates, jobType, false)
+	pref, rest := partitionByPreferredHost(candidates, preferredHosts)
+	if len(pref) > 0 {
+		sortByKind(pref, jobType, false)
+		r.rotateTopCandidatesLocked(pref, jobType, false)
+		sortByKind(rest, jobType, false)
+		candidates = append(pref, rest...)
+	} else {
+		sortByKind(candidates, jobType, false)
+		r.rotateTopCandidatesLocked(candidates, jobType, false)
+	}
 
 	out := make([]*WorkerSession, 0, len(candidates))
 	for _, candidate := range candidates {
@@ -477,36 +496,35 @@ func cloneJobTypeCapability(in *plugin_pb.JobTypeCapability) *plugin_pb.JobTypeC
 	if in == nil {
 		return nil
 	}
-	out := *in
-	return &out
+	return proto.Clone(in).(*plugin_pb.JobTypeCapability)
 }
 
 func cloneWorkerHeartbeat(in *plugin_pb.WorkerHeartbeat) *plugin_pb.WorkerHeartbeat {
 	if in == nil {
 		return nil
 	}
-	out := *in
+	out := proto.Clone(in).(*plugin_pb.WorkerHeartbeat)
 	if in.RunningWork != nil {
-		out.RunningWork = make([]*plugin_pb.RunningWork, 0, len(in.RunningWork))
-		for _, rw := range in.RunningWork {
-			if rw == nil {
-				continue
+		running := out.RunningWork[:0]
+		// Clone can turn nil messages into empty messages, so filter using
+		// their original positions while reusing the cloned entries.
+		for i, work := range in.RunningWork {
+			if work != nil {
+				running = append(running, out.RunningWork[i])
 			}
-			clone := *rw
-			out.RunningWork = append(out.RunningWork, &clone)
 		}
-	}
-	if in.QueuedJobsByType != nil {
-		out.QueuedJobsByType = make(map[string]int32, len(in.QueuedJobsByType))
-		for k, v := range in.QueuedJobsByType {
-			out.QueuedJobsByType[k] = v
+		clear(out.RunningWork[len(running):])
+		if running == nil {
+			running = []*plugin_pb.RunningWork{}
 		}
+		out.RunningWork = running
 	}
-	if in.Metadata != nil {
-		out.Metadata = make(map[string]string, len(in.Metadata))
-		for k, v := range in.Metadata {
-			out.Metadata[k] = v
-		}
+	// Preserve writable empty maps without rebuilding populated clones.
+	if in.QueuedJobsByType != nil && out.QueuedJobsByType == nil {
+		out.QueuedJobsByType = make(map[string]int32)
 	}
-	return &out
+	if in.Metadata != nil && out.Metadata == nil {
+		out.Metadata = make(map[string]string)
+	}
+	return out
 }
diff --git a/weed/admin/plugin/registry_snapshot_test.go b/weed/admin/plugin/registry_snapshot_test.go
new file mode 100644
index 0000000000..1546096048
--- /dev/null
+++ b/weed/admin/plugin/registry_snapshot_test.go
@@ -0,0 +1,65 @@
+package plugin
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+)
+
+func TestCloneWorkerHeartbeatFiltersNilAndIsolatesState(t *testing.T) {
+	t.Parallel()
+	source := &plugin_pb.WorkerHeartbeat{
+		RunningWork:      []*plugin_pb.RunningWork{nil, {WorkId: "first"}, nil, {WorkId: "second"}, nil},
+		QueuedJobsByType: map[string]int32{"vacuum": 2},
+		Metadata:         map[string]string{"rack": "rack-a"},
+	}
+	got := cloneWorkerHeartbeat(source)
+	if len(got.RunningWork) != 2 || got.RunningWork[0].GetWorkId() != "first" || got.RunningWork[1].GetWorkId() != "second" {
+		t.Fatalf("unexpected filtered work: %v", got.RunningWork)
+	}
+	got.RunningWork[0].WorkId = "changed"
+	got.QueuedJobsByType["vacuum"] = 99
+	got.Metadata["rack"] = "changed"
+	if len(source.RunningWork) != 5 || source.RunningWork[0] != nil || source.RunningWork[1].WorkId != "first" {
+		t.Fatalf("cloning mutated source work: %v", source.RunningWork)
+	}
+	if source.QueuedJobsByType["vacuum"] != 2 || source.Metadata["rack"] != "rack-a" {
+		t.Fatal("cloned maps alias the source")
+	}
+}
+
+func TestCloneWorkerHeartbeatPreservesEmptyCollections(t *testing.T) {
+	t.Parallel()
+	if cloneWorkerHeartbeat(nil) != nil {
+		t.Fatal("nil heartbeat must stay nil")
+	}
+	for _, tc := range []struct {
+		name        string
+		source      *plugin_pb.WorkerHeartbeat
+		wantNilWork bool
+	}{
+		{"nil", &plugin_pb.WorkerHeartbeat{}, true},
+		{"empty", &plugin_pb.WorkerHeartbeat{
+			RunningWork:      []*plugin_pb.RunningWork{},
+			QueuedJobsByType: map[string]int32{},
+			Metadata:         map[string]string{},
+		}, false},
+		{"all nil work", &plugin_pb.WorkerHeartbeat{RunningWork: []*plugin_pb.RunningWork{nil, nil}}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := cloneWorkerHeartbeat(tc.source)
+			if len(got.RunningWork) != 0 || (got.RunningWork == nil) != tc.wantNilWork {
+				t.Fatalf("unexpected empty work slice: %#v", got.RunningWork)
+			}
+			if (got.QueuedJobsByType == nil) != (tc.source.QueuedJobsByType == nil) || (got.Metadata == nil) != (tc.source.Metadata == nil) {
+				t.Fatal("clone changed whether empty maps are writable")
+			}
+			if got.Metadata != nil {
+				got.Metadata["added"] = "value"
+				if len(tc.source.Metadata) != 0 {
+					t.Fatal("empty metadata map aliases source")
+				}
+			}
+		})
+	}
+}
diff --git a/weed/admin/plugin/registry_test.go b/weed/admin/plugin/registry_test.go
index 1d331278cb..d023e3ec99 100644
--- a/weed/admin/plugin/registry_test.go
+++ b/weed/admin/plugin/registry_test.go
@@ -401,3 +401,70 @@ func TestRegistryHasCapableWorkerIgnoresNilCapability(t *testing.T) {
 		t.Fatalf("expected HasCapableWorker to return false when capability has no detect or execute")
 	}
 }
+
+func TestListExecutorsPrefersMatchingReplicaHost(t *testing.T) {
+	t.Parallel()
+
+	r := NewRegistry()
+	r.UpsertFromHello(&plugin_pb.WorkerHello{
+		WorkerId: "worker-remote",
+		Address:  "10.87.0.4:33646",
+		Capabilities: []*plugin_pb.JobTypeCapability{
+			{JobType: "erasure_coding", CanExecute: true, MaxExecutionConcurrency: 8},
+		},
+	})
+	r.UpsertFromHello(&plugin_pb.WorkerHello{
+		WorkerId: "worker-local",
+		Address:  "10.87.0.3:33646",
+		Capabilities: []*plugin_pb.JobTypeCapability{
+			{JobType: "erasure_coding", CanExecute: true, MaxExecutionConcurrency: 1},
+		},
+	})
+	r.UpdateHeartbeat("worker-remote", &plugin_pb.WorkerHeartbeat{
+		WorkerId: "worker-remote", ExecutionSlotsUsed: 0, ExecutionSlotsTotal: 8,
+	})
+	r.UpdateHeartbeat("worker-local", &plugin_pb.WorkerHeartbeat{
+		WorkerId: "worker-local", ExecutionSlotsUsed: 0, ExecutionSlotsTotal: 1,
+	})
+
+	// Without preference the emptier remote worker wins on slots.
+	plain, err := r.ListExecutors("erasure_coding")
+	if err != nil {
+		t.Fatalf("ListExecutors: %v", err)
+	}
+	if plain[0].WorkerID != "worker-remote" {
+		t.Fatalf("without preference want remote first, got %s", plain[0].WorkerID)
+	}
+
+	// Replica on :8080 of the same host as worker-local.
+	pref, err := r.ListExecutors("erasure_coding", "10.87.0.3:8080")
+	if err != nil {
+		t.Fatalf("ListExecutors preferred: %v", err)
+	}
+	if pref[0].WorkerID != "worker-local" {
+		t.Fatalf("preferred host want worker-local first, got %s", pref[0].WorkerID)
+	}
+	if pref[1].WorkerID != "worker-remote" {
+		t.Fatalf("remote should still be fallback, got %s", pref[1].WorkerID)
+	}
+}
+
+func TestJobReplicaHostsFromSourcesAndReplicaServers(t *testing.T) {
+	t.Parallel()
+	job := &plugin_pb.JobSpec{
+		Parameters: map[string]*plugin_pb.ConfigValue{
+			"source_server": {
+				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: "10.87.0.1:8080"},
+			},
+			"replica_servers": {
+				Kind: &plugin_pb.ConfigValue_StringList{
+					StringList: &plugin_pb.StringList{Values: []string{"10.87.0.1:8080", "10.87.0.2:8081"}},
+				},
+			},
+		},
+	}
+	got := JobReplicaHosts(job)
+	if len(got) != 2 {
+		t.Fatalf("got %v", got)
+	}
+}
diff --git a/weed/admin/plugin/scheduler_lane.go b/weed/admin/plugin/scheduler_lane.go
index abb69145c0..070b0025f0 100644
--- a/weed/admin/plugin/scheduler_lane.go
+++ b/weed/admin/plugin/scheduler_lane.go
@@ -22,11 +22,15 @@ const (
 	// LaneLifecycle handles S3 object store lifecycle management
 	// (expiration, transition, abort incomplete multipart uploads).
 	LaneLifecycle SchedulerLane = "lifecycle"
+
+	// LaneLance handles table-bucket Lance maintenance: fragment compaction,
+	// index optimization and version cleanup.
+	LaneLance SchedulerLane = "lance"
 )
 
 // AllLanes returns every defined scheduler lane in a stable order.
 func AllLanes() []SchedulerLane {
-	return []SchedulerLane{LaneDefault, LaneIceberg, LaneLifecycle}
+	return []SchedulerLane{LaneDefault, LaneIceberg, LaneLifecycle, LaneLance}
 }
 
 // laneIdleSleep maps each lane to its default idle sleep duration.
@@ -36,6 +40,7 @@ var laneIdleSleep = map[SchedulerLane]time.Duration{
 	LaneDefault:   61 * time.Second,
 	LaneIceberg:   61 * time.Second,
 	LaneLifecycle: 5 * time.Minute,
+	LaneLance:     61 * time.Second,
 }
 
 // laneRequiresLock maps each lane to whether its job types must be
@@ -48,6 +53,9 @@ var laneRequiresLock = map[SchedulerLane]bool{
 	LaneDefault:   true,
 	LaneIceberg:   false,
 	LaneLifecycle: false,
+	// Lance maintenance rewrites files inside one table and shares no global
+	// state, so it has no more need of the cluster admin lock than Iceberg does.
+	LaneLance: false,
 }
 
 // LaneRequiresLock returns true if the given lane serialises its job types
@@ -83,6 +91,13 @@ var jobTypeLaneMap = map[string]SchedulerLane{
 
 	// S3 lifecycle management
 	"s3_lifecycle": LaneLifecycle,
+
+	// Lance table maintenance. Without these the job types fall back to the
+	// default lane, which serialises everything under the cluster admin lock
+	// and would queue a compaction behind volume balancing.
+	"lance_compact":          LaneLance,
+	"lance_optimize_indices": LaneLance,
+	"lance_cleanup_versions": LaneLance,
 }
 
 // JobTypeLane returns the scheduler lane for the given job type.
diff --git a/weed/admin/plugin/scheduler_lane_test.go b/weed/admin/plugin/scheduler_lane_test.go
index 1bdd19436d..e9c47380fe 100644
--- a/weed/admin/plugin/scheduler_lane_test.go
+++ b/weed/admin/plugin/scheduler_lane_test.go
@@ -5,10 +5,16 @@ import (
 )
 
 func TestJobTypeLaneMapCoversKnownTypes(t *testing.T) {
-	// Every job type in the map must resolve to a valid lane.
+	// Every job type in the map must resolve to a lane the scheduler runs.
+	// Checked against AllLanes rather than a list spelled out here, so adding a
+	// lane does not silently leave its job types unscheduled.
+	known := make(map[SchedulerLane]bool, len(AllLanes()))
+	for _, lane := range AllLanes() {
+		known[lane] = true
+	}
 	for jobType, lane := range jobTypeLaneMap {
-		if lane != LaneDefault && lane != LaneIceberg && lane != LaneLifecycle {
-			t.Errorf("jobTypeLaneMap[%q] = %q, want a known lane", jobType, lane)
+		if !known[lane] {
+			t.Errorf("jobTypeLaneMap[%q] = %q, want a lane from AllLanes()", jobType, lane)
 		}
 	}
 }
diff --git a/weed/admin/plugin/worker_job_queues.go b/weed/admin/plugin/worker_job_queues.go
new file mode 100644
index 0000000000..1e036a816c
--- /dev/null
+++ b/weed/admin/plugin/worker_job_queues.go
@@ -0,0 +1,317 @@
+package plugin
+
+import (
+	"sync"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+)
+
+// queuedJob is one scheduled spec parked on a home worker's admin-side queue.
+type queuedJob struct {
+	job  *plugin_pb.JobSpec
+	home string
+}
+
+// workerJobQueues holds per-worker FIFOs for one dispatch batch.
+// Home assignment is done once up front; run goroutines only pop/steal.
+// leftover is the homeless FIFO: replica hostnames with no currently
+// registered worker. Orphan grace does not apply here.
+type workerJobQueues struct {
+	mu           sync.Mutex
+	q            map[string][]*queuedJob
+	leftover     []*queuedJob
+	remaining    int
+	missingSince map[string]time.Time
+	homes        map[string]struct{}
+}
+
+func newWorkerJobQueues() *workerJobQueues {
+	return &workerJobQueues{
+		q:            make(map[string][]*queuedJob),
+		missingSince: make(map[string]time.Time),
+		homes:        make(map[string]struct{}),
+	}
+}
+
+func (qs *workerJobQueues) hasHome(workerID string) bool {
+	if qs == nil || workerID == "" {
+		return false
+	}
+	_, ok := qs.homes[workerID]
+	return ok
+}
+
+func (qs *workerJobQueues) push(home string, job *plugin_pb.JobSpec) {
+	if qs == nil || job == nil {
+		return
+	}
+	item := &queuedJob{job: job, home: home}
+	qs.mu.Lock()
+	defer qs.mu.Unlock()
+	qs.pushLocked(item, false)
+}
+
+func (qs *workerJobQueues) pushFront(item *queuedJob) {
+	if qs == nil || item == nil {
+		return
+	}
+	qs.mu.Lock()
+	defer qs.mu.Unlock()
+	qs.pushLocked(item, true)
+}
+
+func (qs *workerJobQueues) pushLocked(item *queuedJob, front bool) {
+	qs.remaining++
+	if item.home == "" {
+		if front {
+			qs.leftover = append([]*queuedJob{item}, qs.leftover...)
+			return
+		}
+		qs.leftover = append(qs.leftover, item)
+		return
+	}
+	if front {
+		qs.q[item.home] = append([]*queuedJob{item}, qs.q[item.home]...)
+		return
+	}
+	qs.q[item.home] = append(qs.q[item.home], item)
+}
+
+func (qs *workerJobQueues) isEmpty() bool {
+	if qs == nil {
+		return true
+	}
+	qs.mu.Lock()
+	defer qs.mu.Unlock()
+	return qs.remaining == 0
+}
+
+func (qs *workerJobQueues) queueLen(workerID string) int {
+	if qs == nil {
+		return 0
+	}
+	qs.mu.Lock()
+	defer qs.mu.Unlock()
+	return len(qs.q[workerID])
+}
+
+func (qs *workerJobQueues) leftoverLen() int {
+	if qs == nil {
+		return 0
+	}
+	qs.mu.Lock()
+	defer qs.mu.Unlock()
+	return len(qs.leftover)
+}
+
+func (qs *workerJobQueues) drain() []*queuedJob {
+	if qs == nil {
+		return nil
+	}
+	qs.mu.Lock()
+	defer qs.mu.Unlock()
+	out := make([]*queuedJob, 0, qs.remaining)
+	for id, qq := range qs.q {
+		out = append(out, qq...)
+		qs.q[id] = nil
+	}
+	out = append(out, qs.leftover...)
+	qs.leftover = nil
+	qs.remaining = 0
+	return out
+}
+
+func popFront(qq []*queuedJob) (*queuedJob, []*queuedJob) {
+	item := qq[0]
+	if len(qq) == 1 {
+		return item, nil
+	}
+	return item, qq[1:]
+}
+
+// assignJobsToWorkerQueues parks each job on the least-loaded replica-host
+// worker. A home exists only if a currently registered worker's -address
+// hostname matches a replica host. Otherwise the job is homeless: global
+// leftover FIFO, no fake home, no K, no orphan grace. Single-threaded.
+func (r *Plugin) assignJobsToWorkerQueues(
+	jobType string,
+	jobs []*plugin_pb.JobSpec,
+	_ schedulerPolicy,
+) *workerJobQueues {
+	qs := newWorkerJobQueues()
+	executors, err := r.registry.ListExecutors(jobType)
+	lane := JobTypeLane(jobType)
+	queued := make(map[string]int, len(executors))
+
+	for _, job := range jobs {
+		if job == nil {
+			continue
+		}
+		if err != nil || len(executors) == 0 {
+			qs.push("", job)
+			continue
+		}
+		pref, _ := partitionByPreferredHost(executors, JobReplicaHosts(job))
+		if len(pref) == 0 {
+			// Never registered for that hostname: homeless, not an orphan.
+			qs.push("", job)
+			continue
+		}
+		for _, e := range pref {
+			if e != nil && e.WorkerID != "" {
+				qs.homes[e.WorkerID] = struct{}{}
+			}
+		}
+		sortExecutorsByLoad(pref, func(e *WorkerSession) int {
+			return r.executorReservationLoad(e, lane) + queued[e.WorkerID]
+		})
+		home := pref[0].WorkerID
+		qs.push(home, job)
+		queued[home]++
+		r.bindQueuedJobWorker(job, home)
+	}
+	return qs
+}
+
+// takeQueuedJob pops a job for a free worker.
+// Home worker (hostname matched a replica / has a home-queue identity):
+//  1. own home queue
+//  2. steal from another home if len>=K, or orphan past OrphanRehomeGrace
+//  3. homeless leftover FIFO
+// No-home worker (no matching replica, no home-queue identity):
+//  1. homeless leftover FIFO
+//  2. only if leftover empty: steal (K / orphan), same rules
+func (r *Plugin) takeQueuedJob(
+	qs *workerJobQueues,
+	jobType string,
+	policy schedulerPolicy,
+) (item *queuedJob, targetID string) {
+	if qs == nil {
+		return nil, ""
+	}
+	executors, err := r.registry.ListExecutors(jobType)
+	if err != nil || len(executors) == 0 {
+		return nil, ""
+	}
+	lane := JobTypeLane(jobType)
+	pin := policy.LocalQueuePin
+	defer func() {
+		if item != nil && targetID != "" {
+			r.bindQueuedJobWorker(item.job, targetID)
+		}
+	}()
+
+	qs.mu.Lock()
+	defer qs.mu.Unlock()
+	if qs.remaining == 0 {
+		return nil, ""
+	}
+
+	var bestHome *WorkerSession
+	bestLoad := 0
+	for _, exec := range executors {
+		if len(qs.q[exec.WorkerID]) == 0 {
+			continue
+		}
+		limit := schedulerWorkerExecutionLimit(exec, jobType, policy)
+		if limit <= 0 {
+			continue
+		}
+		load := r.executorReservationLoad(exec, lane)
+		if load >= limit {
+			continue
+		}
+		if bestHome == nil || load < bestLoad || (load == bestLoad && exec.WorkerID < bestHome.WorkerID) {
+			bestHome = exec
+			bestLoad = load
+		}
+	}
+	if bestHome != nil {
+		id := bestHome.WorkerID
+		item, qs.q[id] = popFront(qs.q[id])
+		qs.remaining--
+		return item, id
+	}
+
+	var thief *WorkerSession
+	for _, exec := range executors {
+		limit := schedulerWorkerExecutionLimit(exec, jobType, policy)
+		if limit <= 0 {
+			continue
+		}
+		if r.executorReservationLoad(exec, lane) >= limit {
+			continue
+		}
+		if thief == nil || exec.WorkerID < thief.WorkerID {
+			thief = exec
+		}
+	}
+	if thief == nil {
+		return nil, ""
+	}
+
+	takeLeftover := func() (*queuedJob, string) {
+		if len(qs.leftover) == 0 {
+			return nil, ""
+		}
+		item, qs.leftover = popFront(qs.leftover)
+		qs.remaining--
+		return item, thief.WorkerID
+	}
+	if !qs.hasHome(thief.WorkerID) {
+		if item, id := takeLeftover(); item != nil {
+			return item, id
+		}
+	}
+
+	live := make(map[string]struct{}, len(executors))
+	for _, exec := range executors {
+		live[exec.WorkerID] = struct{}{}
+		delete(qs.missingSince, exec.WorkerID)
+	}
+
+	now := time.Now()
+	grace := policy.OrphanRehomeGrace
+	victimID := ""
+	victimLen := 0
+	victimOrphan := false
+	for id, qq := range qs.q {
+		if len(qq) == 0 {
+			delete(qs.missingSince, id)
+			continue
+		}
+		_, isLive := live[id]
+		orphan := !isLive
+		if isLive {
+			if pin > 0 && len(qq) < pin {
+				continue
+			}
+		} else {
+			if _, ok := qs.missingSince[id]; !ok {
+				qs.missingSince[id] = now
+			}
+			if grace > 0 && now.Sub(qs.missingSince[id]) < grace {
+				continue
+			}
+		}
+		better := victimID == ""
+		if !better && orphan != victimOrphan {
+			better = orphan
+		}
+		if !better && orphan == victimOrphan {
+			better = len(qq) > victimLen || (len(qq) == victimLen && id < victimID)
+		}
+		if better {
+			victimID = id
+			victimLen = len(qq)
+			victimOrphan = orphan
+		}
+	}
+	if victimID != "" {
+		item, qs.q[victimID] = popFront(qs.q[victimID])
+		qs.remaining--
+		return item, thief.WorkerID
+	}
+	return takeLeftover()
+}
diff --git a/weed/admin/plugin/worker_job_queues_test.go b/weed/admin/plugin/worker_job_queues_test.go
new file mode 100644
index 0000000000..662ac4e7b7
--- /dev/null
+++ b/weed/admin/plugin/worker_job_queues_test.go
@@ -0,0 +1,600 @@
+package plugin
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+)
+
+func replicaJob(id, source string) *plugin_pb.JobSpec {
+	return &plugin_pb.JobSpec{
+		JobId:     id,
+		JobType:   "erasure_coding",
+		Summary:   id,
+		DedupeKey: id,
+		Parameters: map[string]*plugin_pb.ConfigValue{
+			"source_server": {
+				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: source},
+			},
+		},
+	}
+}
+
+func registerECWorkers(t *testing.T, pluginSvc *Plugin, workers map[string]string) {
+	t.Helper()
+	for id, addr := range workers {
+		pluginSvc.registry.UpsertFromHello(&plugin_pb.WorkerHello{
+			WorkerId: id,
+			Address:  addr,
+			Capabilities: []*plugin_pb.JobTypeCapability{
+				{JobType: "erasure_coding", CanExecute: true, MaxExecutionConcurrency: 8},
+			},
+		})
+	}
+}
+
+func TestAssignJobsWaterfillsPreferredWorkers(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-a": "10.0.0.1:9334",
+		"worker-b": "10.0.0.2:9334",
+		"worker-c": "10.0.0.3:9334",
+		"worker-d": "10.0.0.4:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{
+		replicaJob("j1", "10.0.0.1:8080"),
+		replicaJob("j2", "10.0.0.1:8080"),
+		replicaJob("j3", "10.0.0.1:8080"),
+		replicaJob("j4", "10.0.0.1:8080"),
+	}
+	// All four replica IPs listed so every worker is preferred.
+	for _, job := range jobs {
+		job.Parameters["replica_servers"] = &plugin_pb.ConfigValue{
+			Kind: &plugin_pb.ConfigValue_StringList{StringList: &plugin_pb.StringList{
+				Values: []string{"10.0.0.1:8080", "10.0.0.2:8080", "10.0.0.3:8080", "10.0.0.4:8080"},
+			}},
+		}
+	}
+
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, schedulerPolicy{LocalQueuePin: 5})
+	if qs.queueLen("worker-a")+qs.queueLen("worker-b")+qs.queueLen("worker-c")+qs.queueLen("worker-d") != 4 {
+		t.Fatalf("expected 4 assigned jobs")
+	}
+	for _, id := range []string{"worker-a", "worker-b", "worker-c", "worker-d"} {
+		if qs.queueLen(id) != 1 {
+			t.Fatalf("want 1 job on %s, got %d", id, qs.queueLen(id))
+		}
+	}
+}
+
+func TestAssignAndTakeDoesNotStarveOtherHomes(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{
+		replicaJob("local-1", "10.0.0.1:8080"),
+		replicaJob("local-2", "10.0.0.1:8080"),
+		replicaJob("remote-1", "10.0.0.2:8080"),
+	}
+	policy := schedulerPolicy{PerWorkerConcurrency: 1, LocalQueuePin: 5}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-local") != 2 || qs.queueLen("worker-remote") != 1 {
+		t.Fatalf("homes local=%d remote=%d", qs.queueLen("worker-local"), qs.queueLen("worker-remote"))
+	}
+
+	_, target1 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	_, release1, err := pluginSvc.reserveExecutorByID("erasure_coding", policy, target1)
+	if err != nil {
+		t.Fatalf("reserve 1: %v", err)
+	}
+	defer release1()
+
+	item2, target2 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item2 == nil || target2 != "worker-remote" {
+		t.Fatalf("second take should start remote home, got job=%v target=%s", item2, target2)
+	}
+}
+
+func TestTakeStealsOnlyWhenHomeQueueReachesK(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := make([]*plugin_pb.JobSpec, 0, 6)
+	for i := 0; i < 6; i++ {
+		jobs = append(jobs, replicaJob(fmt.Sprintf("j%d", i), "10.0.0.1:8080"))
+	}
+	policy := schedulerPolicy{PerWorkerConcurrency: 1, LocalQueuePin: 5}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-local") != 6 {
+		t.Fatalf("all jobs should home on local, got %d", qs.queueLen("worker-local"))
+	}
+
+	_, target := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if target != "worker-local" {
+		t.Fatalf("first take want local, got %s", target)
+	}
+	_, release, err := pluginSvc.reserveExecutorByID("erasure_coding", policy, "worker-local")
+	if err != nil {
+		t.Fatalf("reserve local: %v", err)
+	}
+	defer release()
+
+	// 5 still queued on local (>=K) and local has no slot → steal to remote.
+	stolen, stealTarget := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if stolen == nil || stealTarget != "worker-remote" {
+		t.Fatalf("expected steal to remote, got job=%v target=%s", stolen, stealTarget)
+	}
+	if qs.queueLen("worker-local") != 4 {
+		t.Fatalf("after steal want 4 left on local, got %d", qs.queueLen("worker-local"))
+	}
+
+	// 4 < K: do not steal again.
+	if item, tgt := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy); item != nil {
+		t.Fatalf("pin should hold remaining jobs, got target=%s", tgt)
+	}
+}
+
+func TestTakeStealsImmediatelyWhenPinDisabled(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{
+		replicaJob("a", "10.0.0.1:8080"),
+		replicaJob("b", "10.0.0.1:8080"),
+	}
+	policy := schedulerPolicy{PerWorkerConcurrency: 1, LocalQueuePin: 0}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+
+	_, target := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if target != "worker-local" {
+		t.Fatalf("first take want local, got %s", target)
+	}
+	_, release, err := pluginSvc.reserveExecutorByID("erasure_coding", policy, "worker-local")
+	if err != nil {
+		t.Fatalf("reserve local: %v", err)
+	}
+	defer release()
+
+	stolen, stealTarget := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if stolen == nil || stealTarget != "worker-remote" {
+		t.Fatalf("K=0 should steal immediately, got job=%v target=%s", stolen, stealTarget)
+	}
+}
+
+func TestTakeStealsOrphanedHomeWithoutK(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{
+		replicaJob("o1", "10.0.0.1:8080"),
+		replicaJob("o2", "10.0.0.1:8080"),
+	}
+	policy := schedulerPolicy{
+		PerWorkerConcurrency: 1,
+		LocalQueuePin:        5,
+		OrphanRehomeGrace:    30 * time.Second,
+	}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-local") != 2 {
+		t.Fatalf("want 2 on local, got %d", qs.queueLen("worker-local"))
+	}
+
+	pluginSvc.registry.Remove("worker-local")
+
+	if item, tgt := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy); item != nil {
+		t.Fatalf("within grace should hold orphan queue, got target=%s", tgt)
+	}
+	if qs.queueLen("worker-local") != 2 {
+		t.Fatalf("held queue changed: %d", qs.queueLen("worker-local"))
+	}
+
+	qs.mu.Lock()
+	qs.missingSince["worker-local"] = time.Now().Add(-time.Minute)
+	qs.mu.Unlock()
+
+	stolen, stealTarget := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if stolen == nil || stealTarget != "worker-remote" {
+		t.Fatalf("after grace should steal without K, got job=%v target=%s", stolen, stealTarget)
+	}
+	if qs.queueLen("worker-local") != 1 {
+		t.Fatalf("want 1 orphan left, got %d", qs.queueLen("worker-local"))
+	}
+
+	stolen2, stealTarget2 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if stolen2 == nil || stealTarget2 != "worker-remote" {
+		t.Fatalf("second orphan should also move, got job=%v target=%s", stolen2, stealTarget2)
+	}
+}
+
+func TestTakeKeepsOrphanWhenHomeReconnectsDuringGrace(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{replicaJob("blink", "10.0.0.1:8080")}
+	policy := schedulerPolicy{
+		PerWorkerConcurrency: 1,
+		LocalQueuePin:        5,
+		OrphanRehomeGrace:    30 * time.Second,
+	}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	pluginSvc.registry.Remove("worker-local")
+	if item, _ := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy); item != nil {
+		t.Fatal("expected hold during grace")
+	}
+
+	registerECWorkers(t, pluginSvc, map[string]string{"worker-local": "10.0.0.1:9334"})
+	item, target := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item == nil || target != "worker-local" {
+		t.Fatalf("reconnected home should run its queue, got job=%v target=%s", item, target)
+	}
+}
+
+func TestTakeStealsOrphanImmediatelyWhenGraceDisabled(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{replicaJob("o1", "10.0.0.1:8080")}
+	policy := schedulerPolicy{PerWorkerConcurrency: 1, LocalQueuePin: 5, OrphanRehomeGrace: 0}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	pluginSvc.registry.Remove("worker-local")
+
+	stolen, stealTarget := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if stolen == nil || stealTarget != "worker-remote" {
+		t.Fatalf("grace=0 should steal immediately, got job=%v target=%s", stolen, stealTarget)
+	}
+}
+
+func TestBindQueuedJobWorkerKeepsPendingState(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	job := replicaJob("bind-1", "10.0.0.1:8080")
+	pluginSvc.trackExecutionQueued(job)
+	pluginSvc.bindQueuedJobWorker(job, "worker-local")
+
+	pluginSvc.jobsMu.Lock()
+	tracked := pluginSvc.jobs[job.JobId]
+	pluginSvc.jobsMu.Unlock()
+	if tracked == nil {
+		t.Fatal("missing tracked job")
+	}
+	if tracked.State != "job_state_pending" {
+		t.Fatalf("state=%s", tracked.State)
+	}
+	if tracked.Stage != "queued" {
+		t.Fatalf("stage=%s", tracked.Stage)
+	}
+	if tracked.WorkerID != "worker-local" {
+		t.Fatalf("worker=%s", tracked.WorkerID)
+	}
+}
+
+func TestHomelessAllRemoteWorkersUseFIFOWithoutPinOrGrace(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	// Workers never registered on the replica hostname — homeless, not orphan.
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-a": "10.0.0.5:9334",
+		"worker-b": "10.0.0.6:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{
+		replicaJob("h1", "10.0.0.1:8080"),
+		replicaJob("h2", "10.0.0.1:8080"),
+		replicaJob("h3", "10.0.0.1:8080"),
+	}
+	policy := schedulerPolicy{
+		PerWorkerConcurrency: 1,
+		LocalQueuePin:        5,
+		OrphanRehomeGrace:    30 * time.Second,
+	}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-a") != 0 || qs.queueLen("worker-b") != 0 {
+		t.Fatalf("homeless jobs must not get a fake home, a=%d b=%d", qs.queueLen("worker-a"), qs.queueLen("worker-b"))
+	}
+	if qs.leftoverLen() != 3 {
+		t.Fatalf("want 3 homeless FIFO, got %d", qs.leftoverLen())
+	}
+
+	item1, target1 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item1 == nil || item1.job.JobId != "h1" {
+		t.Fatalf("FIFO first want h1, got %v", item1)
+	}
+	_, release1, err := pluginSvc.reserveExecutorByID("erasure_coding", policy, target1)
+	if err != nil {
+		t.Fatalf("reserve 1: %v", err)
+	}
+	defer release1()
+
+	item2, target2 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item2 == nil || item2.job.JobId != "h2" {
+		t.Fatalf("FIFO second want h2 immediately, got %v", item2)
+	}
+	if target2 == "" || target2 == target1 {
+		t.Fatalf("second take should hit the other idle worker, t1=%s t2=%s", target1, target2)
+	}
+	if qs.leftoverLen() != 1 {
+		t.Fatalf("want 1 homeless left, got %d", qs.leftoverLen())
+	}
+}
+
+func TestMixedReplicaLocalJobsStayHomeBeforeHomeless(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{
+		replicaJob("local-1", "10.0.0.1:8080"),
+		replicaJob("local-2", "10.0.0.1:8080"),
+		replicaJob("homeless-1", "10.0.0.9:8080"),
+		replicaJob("homeless-2", "10.0.0.9:8080"),
+	}
+	policy := schedulerPolicy{
+		PerWorkerConcurrency: 1,
+		LocalQueuePin:        5,
+		OrphanRehomeGrace:    30 * time.Second,
+	}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-local") != 2 || qs.queueLen("worker-remote") != 0 || qs.leftoverLen() != 2 {
+		t.Fatalf("homes local=%d remote=%d leftover=%d", qs.queueLen("worker-local"), qs.queueLen("worker-remote"), qs.leftoverLen())
+	}
+
+	item1, target1 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item1 == nil || item1.job.JobId != "local-1" || target1 != "worker-local" {
+		t.Fatalf("first take want local-1 on home, got job=%v target=%s", item1, target1)
+	}
+	_, release, err := pluginSvc.reserveExecutorByID("erasure_coding", policy, "worker-local")
+	if err != nil {
+		t.Fatalf("reserve local: %v", err)
+	}
+	defer release()
+
+	item2, target2 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item2 == nil || item2.job.JobId != "homeless-1" || target2 != "worker-remote" {
+		t.Fatalf("remote should take homeless, not steal pinned home, got job=%v target=%s", item2, target2)
+	}
+	if qs.queueLen("worker-local") != 1 {
+		t.Fatalf("remaining replica-local job must stay home, got %d", qs.queueLen("worker-local"))
+	}
+	if qs.leftoverLen() != 1 {
+		t.Fatalf("one homeless should remain, leftover=%d", qs.leftoverLen())
+	}
+}
+
+func TestIdleHomeWorkerTakesHomelessAfterEmptyHomeQueue(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local": "10.0.0.1:9334",
+	})
+
+	jobs := []*plugin_pb.JobSpec{
+		replicaJob("home-1", "10.0.0.1:8080"),
+		replicaJob("homeless-1", "10.0.0.9:8080"),
+	}
+	policy := schedulerPolicy{
+		PerWorkerConcurrency: 1,
+		LocalQueuePin:        5,
+		OrphanRehomeGrace:    30 * time.Second,
+	}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-local") != 1 || qs.leftoverLen() != 1 {
+		t.Fatalf("home=%d leftover=%d", qs.queueLen("worker-local"), qs.leftoverLen())
+	}
+
+	item1, target1 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item1 == nil || item1.job.JobId != "home-1" || target1 != "worker-local" {
+		t.Fatalf("first take want home-1, got job=%v target=%s", item1, target1)
+	}
+	item2, target2 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item2 == nil || item2.job.JobId != "homeless-1" || target2 != "worker-local" {
+		t.Fatalf("idle home with empty queue may take homeless, got job=%v target=%s", item2, target2)
+	}
+	if qs.leftoverLen() != 0 {
+		t.Fatalf("homeless should be gone, leftover=%d", qs.leftoverLen())
+	}
+}
+
+func TestHomelessWorkerTakesFIFOBeforeStealableHome(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local":  "10.0.0.1:9334",
+		"worker-remote": "10.0.0.2:9334",
+	})
+
+	jobs := make([]*plugin_pb.JobSpec, 0, 7)
+	for i := 0; i < 6; i++ {
+		jobs = append(jobs, replicaJob(fmt.Sprintf("j%d", i), "10.0.0.1:8080"))
+	}
+	jobs = append(jobs, replicaJob("homeless-1", "10.0.0.9:8080"))
+	policy := schedulerPolicy{PerWorkerConcurrency: 1, LocalQueuePin: 5}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-local") != 6 || qs.leftoverLen() != 1 {
+		t.Fatalf("home=%d leftover=%d", qs.queueLen("worker-local"), qs.leftoverLen())
+	}
+	if qs.hasHome("worker-remote") {
+		t.Fatal("remote must have no home identity")
+	}
+
+	_, target := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if target != "worker-local" {
+		t.Fatalf("first take want local, got %s", target)
+	}
+	_, release, err := pluginSvc.reserveExecutorByID("erasure_coding", policy, "worker-local")
+	if err != nil {
+		t.Fatalf("reserve local: %v", err)
+	}
+	defer release()
+
+	item, takeTarget := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item == nil || takeTarget != "worker-remote" || item.job.JobId != "homeless-1" {
+		t.Fatalf("remote must take homeless FIFO before K-steal, got job=%v target=%s", item, takeTarget)
+	}
+	if qs.leftoverLen() != 0 {
+		t.Fatalf("homeless should be gone, leftover=%d", qs.leftoverLen())
+	}
+	if qs.queueLen("worker-local") != 5 {
+		t.Fatalf("stealable home must stay until FIFO empty, got %d", qs.queueLen("worker-local"))
+	}
+
+	stolen, stealTarget := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if stolen == nil || stealTarget != "worker-remote" || stolen.job.JobId == "homeless-1" {
+		t.Fatalf("after FIFO empty remote may steal >=K, got job=%v target=%s", stolen, stealTarget)
+	}
+}
+
+func TestHomeWorkerStealsBeforeHomelessAfterOwnQueueEmpty(t *testing.T) {
+	t.Parallel()
+
+	pluginSvc, err := New(Options{})
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	defer pluginSvc.Shutdown()
+
+	registerECWorkers(t, pluginSvc, map[string]string{
+		"worker-local": "10.0.0.1:9334",
+		"worker-other": "10.0.0.2:9334",
+	})
+
+	jobs := make([]*plugin_pb.JobSpec, 0, 8)
+	for i := 0; i < 6; i++ {
+		jobs = append(jobs, replicaJob(fmt.Sprintf("j%d", i), "10.0.0.1:8080"))
+	}
+	jobs = append(jobs, replicaJob("other-1", "10.0.0.2:8080"))
+	jobs = append(jobs, replicaJob("homeless-1", "10.0.0.9:8080"))
+	policy := schedulerPolicy{PerWorkerConcurrency: 1, LocalQueuePin: 5}
+	qs := pluginSvc.assignJobsToWorkerQueues("erasure_coding", jobs, policy)
+	if qs.queueLen("worker-local") != 6 || qs.queueLen("worker-other") != 1 || qs.leftoverLen() != 1 {
+		t.Fatalf("local=%d other=%d leftover=%d", qs.queueLen("worker-local"), qs.queueLen("worker-other"), qs.leftoverLen())
+	}
+	if !qs.hasHome("worker-other") {
+		t.Fatal("other must keep home identity")
+	}
+
+	item1, target1 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item1 == nil || target1 != "worker-local" {
+		t.Fatalf("first take want local home, got job=%v target=%s", item1, target1)
+	}
+	_, release, err := pluginSvc.reserveExecutorByID("erasure_coding", policy, "worker-local")
+	if err != nil {
+		t.Fatalf("reserve local: %v", err)
+	}
+	defer release()
+
+	item2, target2 := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if item2 == nil || item2.job.JobId != "other-1" || target2 != "worker-other" {
+		t.Fatalf("other should drain own home first, got job=%v target=%s", item2, target2)
+	}
+
+	stolen, stealTarget := pluginSvc.takeQueuedJob(qs, "erasure_coding", policy)
+	if stolen == nil || stealTarget != "worker-other" || stolen.job.JobId == "homeless-1" {
+		t.Fatalf("home worker with empty own queue still steals before homeless, got job=%v target=%s", stolen, stealTarget)
+	}
+	if qs.leftoverLen() != 1 {
+		t.Fatalf("homeless should still wait, leftover=%d", qs.leftoverLen())
+	}
+}
diff --git a/weed/admin/static/css/admin.css b/weed/admin/static/css/admin.css
index cc6b46cfb0..35a0071220 100644
--- a/weed/admin/static/css/admin.css
+++ b/weed/admin/static/css/admin.css
@@ -4,6 +4,34 @@
     --navbar-height: 56px;
 }
 
+/* Icon sizing and animation helpers used by the admin templates. */
+.icon-fixed-width {
+    width: 1.25em;
+    text-align: center;
+}
+
+.icon-sm {
+    font-size: .875em;
+}
+
+.icon-2x {
+    font-size: 2em;
+}
+
+.icon-3x {
+    font-size: 3em;
+}
+
+.icon-spin {
+    animation: icon-spin 1s linear infinite;
+}
+
+@keyframes icon-spin {
+    to {
+        transform: rotate(360deg);
+    }
+}
+
 /* Link colors - muted */
 a {
     color: #5b7c99;
@@ -286,7 +314,7 @@ main {
 }
 
 /* Navbar user icon color */
-.navbar-toggler .fa-user {
+.navbar-toggler .bi-person {
     color: rgba(255, 255, 255, 0.75);
 }
 
@@ -295,11 +323,11 @@ main {
     position: relative;
 }
 
-.nav-link[data-bs-toggle="collapse"] .fa-chevron-down {
+.nav-link[data-bs-toggle="collapse"] .bi-chevron-down {
     transition: transform 0.2s ease;
 }
 
-.nav-link[data-bs-toggle="collapse"][aria-expanded="true"] .fa-chevron-down {
+.nav-link[data-bs-toggle="collapse"][aria-expanded="true"] .bi-chevron-down {
     transform: rotate(180deg);
 }
 
@@ -307,7 +335,7 @@ main {
     color: #5b7c99;
 }
 
-.nav-link[data-bs-toggle="collapse"]:not(.collapsed) .fa-chevron-down {
+.nav-link[data-bs-toggle="collapse"]:not(.collapsed) .bi-chevron-down {
     color: #5b7c99;
 }
 
@@ -335,4 +363,4 @@ main {
     .h5 {
         font-size: 1rem;
     }
-} 
\ No newline at end of file
+}
diff --git a/weed/admin/static/css/bootstrap-icons.min.css b/weed/admin/static/css/bootstrap-icons.min.css
new file mode 100644
index 0000000000..706a5c8b8f
--- /dev/null
+++ b/weed/admin/static/css/bootstrap-icons.min.css
@@ -0,0 +1,5 @@
+/*!
+ * Bootstrap Icons v1.13.1 (https://icons.getbootstrap.com/)
+ * Copyright 2019-2024 The Bootstrap Authors
+ * Licensed under MIT (https://github.com/twbs/icons/blob/main/LICENSE)
+ */@font-face{font-display:block;font-family:bootstrap-icons;src:url("fonts/bootstrap-icons.woff2?e34853135f9e39acf64315236852cd5a") format("woff2"),url("fonts/bootstrap-icons.woff?e34853135f9e39acf64315236852cd5a") format("woff")}.bi::before,[class*=" bi-"]::before,[class^=bi-]::before{display:inline-block;font-family:bootstrap-icons!important;font-style:normal;font-weight:400!important;font-variant:normal;text-transform:none;line-height:1;vertical-align:-.125em;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.bi-123::before{content:"\f67f"}.bi-alarm-fill::before{content:"\f101"}.bi-alarm::before{content:"\f102"}.bi-align-bottom::before{content:"\f103"}.bi-align-center::before{content:"\f104"}.bi-align-end::before{content:"\f105"}.bi-align-middle::before{content:"\f106"}.bi-align-start::before{content:"\f107"}.bi-align-top::before{content:"\f108"}.bi-alt::before{content:"\f109"}.bi-app-indicator::before{content:"\f10a"}.bi-app::before{content:"\f10b"}.bi-archive-fill::before{content:"\f10c"}.bi-archive::before{content:"\f10d"}.bi-arrow-90deg-down::before{content:"\f10e"}.bi-arrow-90deg-left::before{content:"\f10f"}.bi-arrow-90deg-right::before{content:"\f110"}.bi-arrow-90deg-up::before{content:"\f111"}.bi-arrow-bar-down::before{content:"\f112"}.bi-arrow-bar-left::before{content:"\f113"}.bi-arrow-bar-right::before{content:"\f114"}.bi-arrow-bar-up::before{content:"\f115"}.bi-arrow-clockwise::before{content:"\f116"}.bi-arrow-counterclockwise::before{content:"\f117"}.bi-arrow-down-circle-fill::before{content:"\f118"}.bi-arrow-down-circle::before{content:"\f119"}.bi-arrow-down-left-circle-fill::before{content:"\f11a"}.bi-arrow-down-left-circle::before{content:"\f11b"}.bi-arrow-down-left-square-fill::before{content:"\f11c"}.bi-arrow-down-left-square::before{content:"\f11d"}.bi-arrow-down-left::before{content:"\f11e"}.bi-arrow-down-right-circle-fill::before{content:"\f11f"}.bi-arrow-down-right-circle::before{content:"\f120"}.bi-arrow-down-right-square-fill::before{content:"\f121"}.bi-arrow-down-right-square::before{content:"\f122"}.bi-arrow-down-right::before{content:"\f123"}.bi-arrow-down-short::before{content:"\f124"}.bi-arrow-down-square-fill::before{content:"\f125"}.bi-arrow-down-square::before{content:"\f126"}.bi-arrow-down-up::before{content:"\f127"}.bi-arrow-down::before{content:"\f128"}.bi-arrow-left-circle-fill::before{content:"\f129"}.bi-arrow-left-circle::before{content:"\f12a"}.bi-arrow-left-right::before{content:"\f12b"}.bi-arrow-left-short::before{content:"\f12c"}.bi-arrow-left-square-fill::before{content:"\f12d"}.bi-arrow-left-square::before{content:"\f12e"}.bi-arrow-left::before{content:"\f12f"}.bi-arrow-repeat::before{content:"\f130"}.bi-arrow-return-left::before{content:"\f131"}.bi-arrow-return-right::before{content:"\f132"}.bi-arrow-right-circle-fill::before{content:"\f133"}.bi-arrow-right-circle::before{content:"\f134"}.bi-arrow-right-short::before{content:"\f135"}.bi-arrow-right-square-fill::before{content:"\f136"}.bi-arrow-right-square::before{content:"\f137"}.bi-arrow-right::before{content:"\f138"}.bi-arrow-up-circle-fill::before{content:"\f139"}.bi-arrow-up-circle::before{content:"\f13a"}.bi-arrow-up-left-circle-fill::before{content:"\f13b"}.bi-arrow-up-left-circle::before{content:"\f13c"}.bi-arrow-up-left-square-fill::before{content:"\f13d"}.bi-arrow-up-left-square::before{content:"\f13e"}.bi-arrow-up-left::before{content:"\f13f"}.bi-arrow-up-right-circle-fill::before{content:"\f140"}.bi-arrow-up-right-circle::before{content:"\f141"}.bi-arrow-up-right-square-fill::before{content:"\f142"}.bi-arrow-up-right-square::before{content:"\f143"}.bi-arrow-up-right::before{content:"\f144"}.bi-arrow-up-short::before{content:"\f145"}.bi-arrow-up-square-fill::before{content:"\f146"}.bi-arrow-up-square::before{content:"\f147"}.bi-arrow-up::before{content:"\f148"}.bi-arrows-angle-contract::before{content:"\f149"}.bi-arrows-angle-expand::before{content:"\f14a"}.bi-arrows-collapse::before{content:"\f14b"}.bi-arrows-expand::before{content:"\f14c"}.bi-arrows-fullscreen::before{content:"\f14d"}.bi-arrows-move::before{content:"\f14e"}.bi-aspect-ratio-fill::before{content:"\f14f"}.bi-aspect-ratio::before{content:"\f150"}.bi-asterisk::before{content:"\f151"}.bi-at::before{content:"\f152"}.bi-award-fill::before{content:"\f153"}.bi-award::before{content:"\f154"}.bi-back::before{content:"\f155"}.bi-backspace-fill::before{content:"\f156"}.bi-backspace-reverse-fill::before{content:"\f157"}.bi-backspace-reverse::before{content:"\f158"}.bi-backspace::before{content:"\f159"}.bi-badge-3d-fill::before{content:"\f15a"}.bi-badge-3d::before{content:"\f15b"}.bi-badge-4k-fill::before{content:"\f15c"}.bi-badge-4k::before{content:"\f15d"}.bi-badge-8k-fill::before{content:"\f15e"}.bi-badge-8k::before{content:"\f15f"}.bi-badge-ad-fill::before{content:"\f160"}.bi-badge-ad::before{content:"\f161"}.bi-badge-ar-fill::before{content:"\f162"}.bi-badge-ar::before{content:"\f163"}.bi-badge-cc-fill::before{content:"\f164"}.bi-badge-cc::before{content:"\f165"}.bi-badge-hd-fill::before{content:"\f166"}.bi-badge-hd::before{content:"\f167"}.bi-badge-tm-fill::before{content:"\f168"}.bi-badge-tm::before{content:"\f169"}.bi-badge-vo-fill::before{content:"\f16a"}.bi-badge-vo::before{content:"\f16b"}.bi-badge-vr-fill::before{content:"\f16c"}.bi-badge-vr::before{content:"\f16d"}.bi-badge-wc-fill::before{content:"\f16e"}.bi-badge-wc::before{content:"\f16f"}.bi-bag-check-fill::before{content:"\f170"}.bi-bag-check::before{content:"\f171"}.bi-bag-dash-fill::before{content:"\f172"}.bi-bag-dash::before{content:"\f173"}.bi-bag-fill::before{content:"\f174"}.bi-bag-plus-fill::before{content:"\f175"}.bi-bag-plus::before{content:"\f176"}.bi-bag-x-fill::before{content:"\f177"}.bi-bag-x::before{content:"\f178"}.bi-bag::before{content:"\f179"}.bi-bar-chart-fill::before{content:"\f17a"}.bi-bar-chart-line-fill::before{content:"\f17b"}.bi-bar-chart-line::before{content:"\f17c"}.bi-bar-chart-steps::before{content:"\f17d"}.bi-bar-chart::before{content:"\f17e"}.bi-basket-fill::before{content:"\f17f"}.bi-basket::before{content:"\f180"}.bi-basket2-fill::before{content:"\f181"}.bi-basket2::before{content:"\f182"}.bi-basket3-fill::before{content:"\f183"}.bi-basket3::before{content:"\f184"}.bi-battery-charging::before{content:"\f185"}.bi-battery-full::before{content:"\f186"}.bi-battery-half::before{content:"\f187"}.bi-battery::before{content:"\f188"}.bi-bell-fill::before{content:"\f189"}.bi-bell::before{content:"\f18a"}.bi-bezier::before{content:"\f18b"}.bi-bezier2::before{content:"\f18c"}.bi-bicycle::before{content:"\f18d"}.bi-binoculars-fill::before{content:"\f18e"}.bi-binoculars::before{content:"\f18f"}.bi-blockquote-left::before{content:"\f190"}.bi-blockquote-right::before{content:"\f191"}.bi-book-fill::before{content:"\f192"}.bi-book-half::before{content:"\f193"}.bi-book::before{content:"\f194"}.bi-bookmark-check-fill::before{content:"\f195"}.bi-bookmark-check::before{content:"\f196"}.bi-bookmark-dash-fill::before{content:"\f197"}.bi-bookmark-dash::before{content:"\f198"}.bi-bookmark-fill::before{content:"\f199"}.bi-bookmark-heart-fill::before{content:"\f19a"}.bi-bookmark-heart::before{content:"\f19b"}.bi-bookmark-plus-fill::before{content:"\f19c"}.bi-bookmark-plus::before{content:"\f19d"}.bi-bookmark-star-fill::before{content:"\f19e"}.bi-bookmark-star::before{content:"\f19f"}.bi-bookmark-x-fill::before{content:"\f1a0"}.bi-bookmark-x::before{content:"\f1a1"}.bi-bookmark::before{content:"\f1a2"}.bi-bookmarks-fill::before{content:"\f1a3"}.bi-bookmarks::before{content:"\f1a4"}.bi-bookshelf::before{content:"\f1a5"}.bi-bootstrap-fill::before{content:"\f1a6"}.bi-bootstrap-reboot::before{content:"\f1a7"}.bi-bootstrap::before{content:"\f1a8"}.bi-border-all::before{content:"\f1a9"}.bi-border-bottom::before{content:"\f1aa"}.bi-border-center::before{content:"\f1ab"}.bi-border-inner::before{content:"\f1ac"}.bi-border-left::before{content:"\f1ad"}.bi-border-middle::before{content:"\f1ae"}.bi-border-outer::before{content:"\f1af"}.bi-border-right::before{content:"\f1b0"}.bi-border-style::before{content:"\f1b1"}.bi-border-top::before{content:"\f1b2"}.bi-border-width::before{content:"\f1b3"}.bi-border::before{content:"\f1b4"}.bi-bounding-box-circles::before{content:"\f1b5"}.bi-bounding-box::before{content:"\f1b6"}.bi-box-arrow-down-left::before{content:"\f1b7"}.bi-box-arrow-down-right::before{content:"\f1b8"}.bi-box-arrow-down::before{content:"\f1b9"}.bi-box-arrow-in-down-left::before{content:"\f1ba"}.bi-box-arrow-in-down-right::before{content:"\f1bb"}.bi-box-arrow-in-down::before{content:"\f1bc"}.bi-box-arrow-in-left::before{content:"\f1bd"}.bi-box-arrow-in-right::before{content:"\f1be"}.bi-box-arrow-in-up-left::before{content:"\f1bf"}.bi-box-arrow-in-up-right::before{content:"\f1c0"}.bi-box-arrow-in-up::before{content:"\f1c1"}.bi-box-arrow-left::before{content:"\f1c2"}.bi-box-arrow-right::before{content:"\f1c3"}.bi-box-arrow-up-left::before{content:"\f1c4"}.bi-box-arrow-up-right::before{content:"\f1c5"}.bi-box-arrow-up::before{content:"\f1c6"}.bi-box-seam::before{content:"\f1c7"}.bi-box::before{content:"\f1c8"}.bi-braces::before{content:"\f1c9"}.bi-bricks::before{content:"\f1ca"}.bi-briefcase-fill::before{content:"\f1cb"}.bi-briefcase::before{content:"\f1cc"}.bi-brightness-alt-high-fill::before{content:"\f1cd"}.bi-brightness-alt-high::before{content:"\f1ce"}.bi-brightness-alt-low-fill::before{content:"\f1cf"}.bi-brightness-alt-low::before{content:"\f1d0"}.bi-brightness-high-fill::before{content:"\f1d1"}.bi-brightness-high::before{content:"\f1d2"}.bi-brightness-low-fill::before{content:"\f1d3"}.bi-brightness-low::before{content:"\f1d4"}.bi-broadcast-pin::before{content:"\f1d5"}.bi-broadcast::before{content:"\f1d6"}.bi-brush-fill::before{content:"\f1d7"}.bi-brush::before{content:"\f1d8"}.bi-bucket-fill::before{content:"\f1d9"}.bi-bucket::before{content:"\f1da"}.bi-bug-fill::before{content:"\f1db"}.bi-bug::before{content:"\f1dc"}.bi-building::before{content:"\f1dd"}.bi-bullseye::before{content:"\f1de"}.bi-calculator-fill::before{content:"\f1df"}.bi-calculator::before{content:"\f1e0"}.bi-calendar-check-fill::before{content:"\f1e1"}.bi-calendar-check::before{content:"\f1e2"}.bi-calendar-date-fill::before{content:"\f1e3"}.bi-calendar-date::before{content:"\f1e4"}.bi-calendar-day-fill::before{content:"\f1e5"}.bi-calendar-day::before{content:"\f1e6"}.bi-calendar-event-fill::before{content:"\f1e7"}.bi-calendar-event::before{content:"\f1e8"}.bi-calendar-fill::before{content:"\f1e9"}.bi-calendar-minus-fill::before{content:"\f1ea"}.bi-calendar-minus::before{content:"\f1eb"}.bi-calendar-month-fill::before{content:"\f1ec"}.bi-calendar-month::before{content:"\f1ed"}.bi-calendar-plus-fill::before{content:"\f1ee"}.bi-calendar-plus::before{content:"\f1ef"}.bi-calendar-range-fill::before{content:"\f1f0"}.bi-calendar-range::before{content:"\f1f1"}.bi-calendar-week-fill::before{content:"\f1f2"}.bi-calendar-week::before{content:"\f1f3"}.bi-calendar-x-fill::before{content:"\f1f4"}.bi-calendar-x::before{content:"\f1f5"}.bi-calendar::before{content:"\f1f6"}.bi-calendar2-check-fill::before{content:"\f1f7"}.bi-calendar2-check::before{content:"\f1f8"}.bi-calendar2-date-fill::before{content:"\f1f9"}.bi-calendar2-date::before{content:"\f1fa"}.bi-calendar2-day-fill::before{content:"\f1fb"}.bi-calendar2-day::before{content:"\f1fc"}.bi-calendar2-event-fill::before{content:"\f1fd"}.bi-calendar2-event::before{content:"\f1fe"}.bi-calendar2-fill::before{content:"\f1ff"}.bi-calendar2-minus-fill::before{content:"\f200"}.bi-calendar2-minus::before{content:"\f201"}.bi-calendar2-month-fill::before{content:"\f202"}.bi-calendar2-month::before{content:"\f203"}.bi-calendar2-plus-fill::before{content:"\f204"}.bi-calendar2-plus::before{content:"\f205"}.bi-calendar2-range-fill::before{content:"\f206"}.bi-calendar2-range::before{content:"\f207"}.bi-calendar2-week-fill::before{content:"\f208"}.bi-calendar2-week::before{content:"\f209"}.bi-calendar2-x-fill::before{content:"\f20a"}.bi-calendar2-x::before{content:"\f20b"}.bi-calendar2::before{content:"\f20c"}.bi-calendar3-event-fill::before{content:"\f20d"}.bi-calendar3-event::before{content:"\f20e"}.bi-calendar3-fill::before{content:"\f20f"}.bi-calendar3-range-fill::before{content:"\f210"}.bi-calendar3-range::before{content:"\f211"}.bi-calendar3-week-fill::before{content:"\f212"}.bi-calendar3-week::before{content:"\f213"}.bi-calendar3::before{content:"\f214"}.bi-calendar4-event::before{content:"\f215"}.bi-calendar4-range::before{content:"\f216"}.bi-calendar4-week::before{content:"\f217"}.bi-calendar4::before{content:"\f218"}.bi-camera-fill::before{content:"\f219"}.bi-camera-reels-fill::before{content:"\f21a"}.bi-camera-reels::before{content:"\f21b"}.bi-camera-video-fill::before{content:"\f21c"}.bi-camera-video-off-fill::before{content:"\f21d"}.bi-camera-video-off::before{content:"\f21e"}.bi-camera-video::before{content:"\f21f"}.bi-camera::before{content:"\f220"}.bi-camera2::before{content:"\f221"}.bi-capslock-fill::before{content:"\f222"}.bi-capslock::before{content:"\f223"}.bi-card-checklist::before{content:"\f224"}.bi-card-heading::before{content:"\f225"}.bi-card-image::before{content:"\f226"}.bi-card-list::before{content:"\f227"}.bi-card-text::before{content:"\f228"}.bi-caret-down-fill::before{content:"\f229"}.bi-caret-down-square-fill::before{content:"\f22a"}.bi-caret-down-square::before{content:"\f22b"}.bi-caret-down::before{content:"\f22c"}.bi-caret-left-fill::before{content:"\f22d"}.bi-caret-left-square-fill::before{content:"\f22e"}.bi-caret-left-square::before{content:"\f22f"}.bi-caret-left::before{content:"\f230"}.bi-caret-right-fill::before{content:"\f231"}.bi-caret-right-square-fill::before{content:"\f232"}.bi-caret-right-square::before{content:"\f233"}.bi-caret-right::before{content:"\f234"}.bi-caret-up-fill::before{content:"\f235"}.bi-caret-up-square-fill::before{content:"\f236"}.bi-caret-up-square::before{content:"\f237"}.bi-caret-up::before{content:"\f238"}.bi-cart-check-fill::before{content:"\f239"}.bi-cart-check::before{content:"\f23a"}.bi-cart-dash-fill::before{content:"\f23b"}.bi-cart-dash::before{content:"\f23c"}.bi-cart-fill::before{content:"\f23d"}.bi-cart-plus-fill::before{content:"\f23e"}.bi-cart-plus::before{content:"\f23f"}.bi-cart-x-fill::before{content:"\f240"}.bi-cart-x::before{content:"\f241"}.bi-cart::before{content:"\f242"}.bi-cart2::before{content:"\f243"}.bi-cart3::before{content:"\f244"}.bi-cart4::before{content:"\f245"}.bi-cash-stack::before{content:"\f246"}.bi-cash::before{content:"\f247"}.bi-cast::before{content:"\f248"}.bi-chat-dots-fill::before{content:"\f249"}.bi-chat-dots::before{content:"\f24a"}.bi-chat-fill::before{content:"\f24b"}.bi-chat-left-dots-fill::before{content:"\f24c"}.bi-chat-left-dots::before{content:"\f24d"}.bi-chat-left-fill::before{content:"\f24e"}.bi-chat-left-quote-fill::before{content:"\f24f"}.bi-chat-left-quote::before{content:"\f250"}.bi-chat-left-text-fill::before{content:"\f251"}.bi-chat-left-text::before{content:"\f252"}.bi-chat-left::before{content:"\f253"}.bi-chat-quote-fill::before{content:"\f254"}.bi-chat-quote::before{content:"\f255"}.bi-chat-right-dots-fill::before{content:"\f256"}.bi-chat-right-dots::before{content:"\f257"}.bi-chat-right-fill::before{content:"\f258"}.bi-chat-right-quote-fill::before{content:"\f259"}.bi-chat-right-quote::before{content:"\f25a"}.bi-chat-right-text-fill::before{content:"\f25b"}.bi-chat-right-text::before{content:"\f25c"}.bi-chat-right::before{content:"\f25d"}.bi-chat-square-dots-fill::before{content:"\f25e"}.bi-chat-square-dots::before{content:"\f25f"}.bi-chat-square-fill::before{content:"\f260"}.bi-chat-square-quote-fill::before{content:"\f261"}.bi-chat-square-quote::before{content:"\f262"}.bi-chat-square-text-fill::before{content:"\f263"}.bi-chat-square-text::before{content:"\f264"}.bi-chat-square::before{content:"\f265"}.bi-chat-text-fill::before{content:"\f266"}.bi-chat-text::before{content:"\f267"}.bi-chat::before{content:"\f268"}.bi-check-all::before{content:"\f269"}.bi-check-circle-fill::before{content:"\f26a"}.bi-check-circle::before{content:"\f26b"}.bi-check-square-fill::before{content:"\f26c"}.bi-check-square::before{content:"\f26d"}.bi-check::before{content:"\f26e"}.bi-check2-all::before{content:"\f26f"}.bi-check2-circle::before{content:"\f270"}.bi-check2-square::before{content:"\f271"}.bi-check2::before{content:"\f272"}.bi-chevron-bar-contract::before{content:"\f273"}.bi-chevron-bar-down::before{content:"\f274"}.bi-chevron-bar-expand::before{content:"\f275"}.bi-chevron-bar-left::before{content:"\f276"}.bi-chevron-bar-right::before{content:"\f277"}.bi-chevron-bar-up::before{content:"\f278"}.bi-chevron-compact-down::before{content:"\f279"}.bi-chevron-compact-left::before{content:"\f27a"}.bi-chevron-compact-right::before{content:"\f27b"}.bi-chevron-compact-up::before{content:"\f27c"}.bi-chevron-contract::before{content:"\f27d"}.bi-chevron-double-down::before{content:"\f27e"}.bi-chevron-double-left::before{content:"\f27f"}.bi-chevron-double-right::before{content:"\f280"}.bi-chevron-double-up::before{content:"\f281"}.bi-chevron-down::before{content:"\f282"}.bi-chevron-expand::before{content:"\f283"}.bi-chevron-left::before{content:"\f284"}.bi-chevron-right::before{content:"\f285"}.bi-chevron-up::before{content:"\f286"}.bi-circle-fill::before{content:"\f287"}.bi-circle-half::before{content:"\f288"}.bi-circle-square::before{content:"\f289"}.bi-circle::before{content:"\f28a"}.bi-clipboard-check::before{content:"\f28b"}.bi-clipboard-data::before{content:"\f28c"}.bi-clipboard-minus::before{content:"\f28d"}.bi-clipboard-plus::before{content:"\f28e"}.bi-clipboard-x::before{content:"\f28f"}.bi-clipboard::before{content:"\f290"}.bi-clock-fill::before{content:"\f291"}.bi-clock-history::before{content:"\f292"}.bi-clock::before{content:"\f293"}.bi-cloud-arrow-down-fill::before{content:"\f294"}.bi-cloud-arrow-down::before{content:"\f295"}.bi-cloud-arrow-up-fill::before{content:"\f296"}.bi-cloud-arrow-up::before{content:"\f297"}.bi-cloud-check-fill::before{content:"\f298"}.bi-cloud-check::before{content:"\f299"}.bi-cloud-download-fill::before{content:"\f29a"}.bi-cloud-download::before{content:"\f29b"}.bi-cloud-drizzle-fill::before{content:"\f29c"}.bi-cloud-drizzle::before{content:"\f29d"}.bi-cloud-fill::before{content:"\f29e"}.bi-cloud-fog-fill::before{content:"\f29f"}.bi-cloud-fog::before{content:"\f2a0"}.bi-cloud-fog2-fill::before{content:"\f2a1"}.bi-cloud-fog2::before{content:"\f2a2"}.bi-cloud-hail-fill::before{content:"\f2a3"}.bi-cloud-hail::before{content:"\f2a4"}.bi-cloud-haze-fill::before{content:"\f2a6"}.bi-cloud-haze::before{content:"\f2a7"}.bi-cloud-haze2-fill::before{content:"\f2a8"}.bi-cloud-lightning-fill::before{content:"\f2a9"}.bi-cloud-lightning-rain-fill::before{content:"\f2aa"}.bi-cloud-lightning-rain::before{content:"\f2ab"}.bi-cloud-lightning::before{content:"\f2ac"}.bi-cloud-minus-fill::before{content:"\f2ad"}.bi-cloud-minus::before{content:"\f2ae"}.bi-cloud-moon-fill::before{content:"\f2af"}.bi-cloud-moon::before{content:"\f2b0"}.bi-cloud-plus-fill::before{content:"\f2b1"}.bi-cloud-plus::before{content:"\f2b2"}.bi-cloud-rain-fill::before{content:"\f2b3"}.bi-cloud-rain-heavy-fill::before{content:"\f2b4"}.bi-cloud-rain-heavy::before{content:"\f2b5"}.bi-cloud-rain::before{content:"\f2b6"}.bi-cloud-slash-fill::before{content:"\f2b7"}.bi-cloud-slash::before{content:"\f2b8"}.bi-cloud-sleet-fill::before{content:"\f2b9"}.bi-cloud-sleet::before{content:"\f2ba"}.bi-cloud-snow-fill::before{content:"\f2bb"}.bi-cloud-snow::before{content:"\f2bc"}.bi-cloud-sun-fill::before{content:"\f2bd"}.bi-cloud-sun::before{content:"\f2be"}.bi-cloud-upload-fill::before{content:"\f2bf"}.bi-cloud-upload::before{content:"\f2c0"}.bi-cloud::before{content:"\f2c1"}.bi-clouds-fill::before{content:"\f2c2"}.bi-clouds::before{content:"\f2c3"}.bi-cloudy-fill::before{content:"\f2c4"}.bi-cloudy::before{content:"\f2c5"}.bi-code-slash::before{content:"\f2c6"}.bi-code-square::before{content:"\f2c7"}.bi-code::before{content:"\f2c8"}.bi-collection-fill::before{content:"\f2c9"}.bi-collection-play-fill::before{content:"\f2ca"}.bi-collection-play::before{content:"\f2cb"}.bi-collection::before{content:"\f2cc"}.bi-columns-gap::before{content:"\f2cd"}.bi-columns::before{content:"\f2ce"}.bi-command::before{content:"\f2cf"}.bi-compass-fill::before{content:"\f2d0"}.bi-compass::before{content:"\f2d1"}.bi-cone-striped::before{content:"\f2d2"}.bi-cone::before{content:"\f2d3"}.bi-controller::before{content:"\f2d4"}.bi-cpu-fill::before{content:"\f2d5"}.bi-cpu::before{content:"\f2d6"}.bi-credit-card-2-back-fill::before{content:"\f2d7"}.bi-credit-card-2-back::before{content:"\f2d8"}.bi-credit-card-2-front-fill::before{content:"\f2d9"}.bi-credit-card-2-front::before{content:"\f2da"}.bi-credit-card-fill::before{content:"\f2db"}.bi-credit-card::before{content:"\f2dc"}.bi-crop::before{content:"\f2dd"}.bi-cup-fill::before{content:"\f2de"}.bi-cup-straw::before{content:"\f2df"}.bi-cup::before{content:"\f2e0"}.bi-cursor-fill::before{content:"\f2e1"}.bi-cursor-text::before{content:"\f2e2"}.bi-cursor::before{content:"\f2e3"}.bi-dash-circle-dotted::before{content:"\f2e4"}.bi-dash-circle-fill::before{content:"\f2e5"}.bi-dash-circle::before{content:"\f2e6"}.bi-dash-square-dotted::before{content:"\f2e7"}.bi-dash-square-fill::before{content:"\f2e8"}.bi-dash-square::before{content:"\f2e9"}.bi-dash::before{content:"\f2ea"}.bi-diagram-2-fill::before{content:"\f2eb"}.bi-diagram-2::before{content:"\f2ec"}.bi-diagram-3-fill::before{content:"\f2ed"}.bi-diagram-3::before{content:"\f2ee"}.bi-diamond-fill::before{content:"\f2ef"}.bi-diamond-half::before{content:"\f2f0"}.bi-diamond::before{content:"\f2f1"}.bi-dice-1-fill::before{content:"\f2f2"}.bi-dice-1::before{content:"\f2f3"}.bi-dice-2-fill::before{content:"\f2f4"}.bi-dice-2::before{content:"\f2f5"}.bi-dice-3-fill::before{content:"\f2f6"}.bi-dice-3::before{content:"\f2f7"}.bi-dice-4-fill::before{content:"\f2f8"}.bi-dice-4::before{content:"\f2f9"}.bi-dice-5-fill::before{content:"\f2fa"}.bi-dice-5::before{content:"\f2fb"}.bi-dice-6-fill::before{content:"\f2fc"}.bi-dice-6::before{content:"\f2fd"}.bi-disc-fill::before{content:"\f2fe"}.bi-disc::before{content:"\f2ff"}.bi-discord::before{content:"\f300"}.bi-display-fill::before{content:"\f301"}.bi-display::before{content:"\f302"}.bi-distribute-horizontal::before{content:"\f303"}.bi-distribute-vertical::before{content:"\f304"}.bi-door-closed-fill::before{content:"\f305"}.bi-door-closed::before{content:"\f306"}.bi-door-open-fill::before{content:"\f307"}.bi-door-open::before{content:"\f308"}.bi-dot::before{content:"\f309"}.bi-download::before{content:"\f30a"}.bi-droplet-fill::before{content:"\f30b"}.bi-droplet-half::before{content:"\f30c"}.bi-droplet::before{content:"\f30d"}.bi-earbuds::before{content:"\f30e"}.bi-easel-fill::before{content:"\f30f"}.bi-easel::before{content:"\f310"}.bi-egg-fill::before{content:"\f311"}.bi-egg-fried::before{content:"\f312"}.bi-egg::before{content:"\f313"}.bi-eject-fill::before{content:"\f314"}.bi-eject::before{content:"\f315"}.bi-emoji-angry-fill::before{content:"\f316"}.bi-emoji-angry::before{content:"\f317"}.bi-emoji-dizzy-fill::before{content:"\f318"}.bi-emoji-dizzy::before{content:"\f319"}.bi-emoji-expressionless-fill::before{content:"\f31a"}.bi-emoji-expressionless::before{content:"\f31b"}.bi-emoji-frown-fill::before{content:"\f31c"}.bi-emoji-frown::before{content:"\f31d"}.bi-emoji-heart-eyes-fill::before{content:"\f31e"}.bi-emoji-heart-eyes::before{content:"\f31f"}.bi-emoji-laughing-fill::before{content:"\f320"}.bi-emoji-laughing::before{content:"\f321"}.bi-emoji-neutral-fill::before{content:"\f322"}.bi-emoji-neutral::before{content:"\f323"}.bi-emoji-smile-fill::before{content:"\f324"}.bi-emoji-smile-upside-down-fill::before{content:"\f325"}.bi-emoji-smile-upside-down::before{content:"\f326"}.bi-emoji-smile::before{content:"\f327"}.bi-emoji-sunglasses-fill::before{content:"\f328"}.bi-emoji-sunglasses::before{content:"\f329"}.bi-emoji-wink-fill::before{content:"\f32a"}.bi-emoji-wink::before{content:"\f32b"}.bi-envelope-fill::before{content:"\f32c"}.bi-envelope-open-fill::before{content:"\f32d"}.bi-envelope-open::before{content:"\f32e"}.bi-envelope::before{content:"\f32f"}.bi-eraser-fill::before{content:"\f330"}.bi-eraser::before{content:"\f331"}.bi-exclamation-circle-fill::before{content:"\f332"}.bi-exclamation-circle::before{content:"\f333"}.bi-exclamation-diamond-fill::before{content:"\f334"}.bi-exclamation-diamond::before{content:"\f335"}.bi-exclamation-octagon-fill::before{content:"\f336"}.bi-exclamation-octagon::before{content:"\f337"}.bi-exclamation-square-fill::before{content:"\f338"}.bi-exclamation-square::before{content:"\f339"}.bi-exclamation-triangle-fill::before{content:"\f33a"}.bi-exclamation-triangle::before{content:"\f33b"}.bi-exclamation::before{content:"\f33c"}.bi-exclude::before{content:"\f33d"}.bi-eye-fill::before{content:"\f33e"}.bi-eye-slash-fill::before{content:"\f33f"}.bi-eye-slash::before{content:"\f340"}.bi-eye::before{content:"\f341"}.bi-eyedropper::before{content:"\f342"}.bi-eyeglasses::before{content:"\f343"}.bi-facebook::before{content:"\f344"}.bi-file-arrow-down-fill::before{content:"\f345"}.bi-file-arrow-down::before{content:"\f346"}.bi-file-arrow-up-fill::before{content:"\f347"}.bi-file-arrow-up::before{content:"\f348"}.bi-file-bar-graph-fill::before{content:"\f349"}.bi-file-bar-graph::before{content:"\f34a"}.bi-file-binary-fill::before{content:"\f34b"}.bi-file-binary::before{content:"\f34c"}.bi-file-break-fill::before{content:"\f34d"}.bi-file-break::before{content:"\f34e"}.bi-file-check-fill::before{content:"\f34f"}.bi-file-check::before{content:"\f350"}.bi-file-code-fill::before{content:"\f351"}.bi-file-code::before{content:"\f352"}.bi-file-diff-fill::before{content:"\f353"}.bi-file-diff::before{content:"\f354"}.bi-file-earmark-arrow-down-fill::before{content:"\f355"}.bi-file-earmark-arrow-down::before{content:"\f356"}.bi-file-earmark-arrow-up-fill::before{content:"\f357"}.bi-file-earmark-arrow-up::before{content:"\f358"}.bi-file-earmark-bar-graph-fill::before{content:"\f359"}.bi-file-earmark-bar-graph::before{content:"\f35a"}.bi-file-earmark-binary-fill::before{content:"\f35b"}.bi-file-earmark-binary::before{content:"\f35c"}.bi-file-earmark-break-fill::before{content:"\f35d"}.bi-file-earmark-break::before{content:"\f35e"}.bi-file-earmark-check-fill::before{content:"\f35f"}.bi-file-earmark-check::before{content:"\f360"}.bi-file-earmark-code-fill::before{content:"\f361"}.bi-file-earmark-code::before{content:"\f362"}.bi-file-earmark-diff-fill::before{content:"\f363"}.bi-file-earmark-diff::before{content:"\f364"}.bi-file-earmark-easel-fill::before{content:"\f365"}.bi-file-earmark-easel::before{content:"\f366"}.bi-file-earmark-excel-fill::before{content:"\f367"}.bi-file-earmark-excel::before{content:"\f368"}.bi-file-earmark-fill::before{content:"\f369"}.bi-file-earmark-font-fill::before{content:"\f36a"}.bi-file-earmark-font::before{content:"\f36b"}.bi-file-earmark-image-fill::before{content:"\f36c"}.bi-file-earmark-image::before{content:"\f36d"}.bi-file-earmark-lock-fill::before{content:"\f36e"}.bi-file-earmark-lock::before{content:"\f36f"}.bi-file-earmark-lock2-fill::before{content:"\f370"}.bi-file-earmark-lock2::before{content:"\f371"}.bi-file-earmark-medical-fill::before{content:"\f372"}.bi-file-earmark-medical::before{content:"\f373"}.bi-file-earmark-minus-fill::before{content:"\f374"}.bi-file-earmark-minus::before{content:"\f375"}.bi-file-earmark-music-fill::before{content:"\f376"}.bi-file-earmark-music::before{content:"\f377"}.bi-file-earmark-person-fill::before{content:"\f378"}.bi-file-earmark-person::before{content:"\f379"}.bi-file-earmark-play-fill::before{content:"\f37a"}.bi-file-earmark-play::before{content:"\f37b"}.bi-file-earmark-plus-fill::before{content:"\f37c"}.bi-file-earmark-plus::before{content:"\f37d"}.bi-file-earmark-post-fill::before{content:"\f37e"}.bi-file-earmark-post::before{content:"\f37f"}.bi-file-earmark-ppt-fill::before{content:"\f380"}.bi-file-earmark-ppt::before{content:"\f381"}.bi-file-earmark-richtext-fill::before{content:"\f382"}.bi-file-earmark-richtext::before{content:"\f383"}.bi-file-earmark-ruled-fill::before{content:"\f384"}.bi-file-earmark-ruled::before{content:"\f385"}.bi-file-earmark-slides-fill::before{content:"\f386"}.bi-file-earmark-slides::before{content:"\f387"}.bi-file-earmark-spreadsheet-fill::before{content:"\f388"}.bi-file-earmark-spreadsheet::before{content:"\f389"}.bi-file-earmark-text-fill::before{content:"\f38a"}.bi-file-earmark-text::before{content:"\f38b"}.bi-file-earmark-word-fill::before{content:"\f38c"}.bi-file-earmark-word::before{content:"\f38d"}.bi-file-earmark-x-fill::before{content:"\f38e"}.bi-file-earmark-x::before{content:"\f38f"}.bi-file-earmark-zip-fill::before{content:"\f390"}.bi-file-earmark-zip::before{content:"\f391"}.bi-file-earmark::before{content:"\f392"}.bi-file-easel-fill::before{content:"\f393"}.bi-file-easel::before{content:"\f394"}.bi-file-excel-fill::before{content:"\f395"}.bi-file-excel::before{content:"\f396"}.bi-file-fill::before{content:"\f397"}.bi-file-font-fill::before{content:"\f398"}.bi-file-font::before{content:"\f399"}.bi-file-image-fill::before{content:"\f39a"}.bi-file-image::before{content:"\f39b"}.bi-file-lock-fill::before{content:"\f39c"}.bi-file-lock::before{content:"\f39d"}.bi-file-lock2-fill::before{content:"\f39e"}.bi-file-lock2::before{content:"\f39f"}.bi-file-medical-fill::before{content:"\f3a0"}.bi-file-medical::before{content:"\f3a1"}.bi-file-minus-fill::before{content:"\f3a2"}.bi-file-minus::before{content:"\f3a3"}.bi-file-music-fill::before{content:"\f3a4"}.bi-file-music::before{content:"\f3a5"}.bi-file-person-fill::before{content:"\f3a6"}.bi-file-person::before{content:"\f3a7"}.bi-file-play-fill::before{content:"\f3a8"}.bi-file-play::before{content:"\f3a9"}.bi-file-plus-fill::before{content:"\f3aa"}.bi-file-plus::before{content:"\f3ab"}.bi-file-post-fill::before{content:"\f3ac"}.bi-file-post::before{content:"\f3ad"}.bi-file-ppt-fill::before{content:"\f3ae"}.bi-file-ppt::before{content:"\f3af"}.bi-file-richtext-fill::before{content:"\f3b0"}.bi-file-richtext::before{content:"\f3b1"}.bi-file-ruled-fill::before{content:"\f3b2"}.bi-file-ruled::before{content:"\f3b3"}.bi-file-slides-fill::before{content:"\f3b4"}.bi-file-slides::before{content:"\f3b5"}.bi-file-spreadsheet-fill::before{content:"\f3b6"}.bi-file-spreadsheet::before{content:"\f3b7"}.bi-file-text-fill::before{content:"\f3b8"}.bi-file-text::before{content:"\f3b9"}.bi-file-word-fill::before{content:"\f3ba"}.bi-file-word::before{content:"\f3bb"}.bi-file-x-fill::before{content:"\f3bc"}.bi-file-x::before{content:"\f3bd"}.bi-file-zip-fill::before{content:"\f3be"}.bi-file-zip::before{content:"\f3bf"}.bi-file::before{content:"\f3c0"}.bi-files-alt::before{content:"\f3c1"}.bi-files::before{content:"\f3c2"}.bi-film::before{content:"\f3c3"}.bi-filter-circle-fill::before{content:"\f3c4"}.bi-filter-circle::before{content:"\f3c5"}.bi-filter-left::before{content:"\f3c6"}.bi-filter-right::before{content:"\f3c7"}.bi-filter-square-fill::before{content:"\f3c8"}.bi-filter-square::before{content:"\f3c9"}.bi-filter::before{content:"\f3ca"}.bi-flag-fill::before{content:"\f3cb"}.bi-flag::before{content:"\f3cc"}.bi-flower1::before{content:"\f3cd"}.bi-flower2::before{content:"\f3ce"}.bi-flower3::before{content:"\f3cf"}.bi-folder-check::before{content:"\f3d0"}.bi-folder-fill::before{content:"\f3d1"}.bi-folder-minus::before{content:"\f3d2"}.bi-folder-plus::before{content:"\f3d3"}.bi-folder-symlink-fill::before{content:"\f3d4"}.bi-folder-symlink::before{content:"\f3d5"}.bi-folder-x::before{content:"\f3d6"}.bi-folder::before{content:"\f3d7"}.bi-folder2-open::before{content:"\f3d8"}.bi-folder2::before{content:"\f3d9"}.bi-fonts::before{content:"\f3da"}.bi-forward-fill::before{content:"\f3db"}.bi-forward::before{content:"\f3dc"}.bi-front::before{content:"\f3dd"}.bi-fullscreen-exit::before{content:"\f3de"}.bi-fullscreen::before{content:"\f3df"}.bi-funnel-fill::before{content:"\f3e0"}.bi-funnel::before{content:"\f3e1"}.bi-gear-fill::before{content:"\f3e2"}.bi-gear-wide-connected::before{content:"\f3e3"}.bi-gear-wide::before{content:"\f3e4"}.bi-gear::before{content:"\f3e5"}.bi-gem::before{content:"\f3e6"}.bi-geo-alt-fill::before{content:"\f3e7"}.bi-geo-alt::before{content:"\f3e8"}.bi-geo-fill::before{content:"\f3e9"}.bi-geo::before{content:"\f3ea"}.bi-gift-fill::before{content:"\f3eb"}.bi-gift::before{content:"\f3ec"}.bi-github::before{content:"\f3ed"}.bi-globe::before{content:"\f3ee"}.bi-globe2::before{content:"\f3ef"}.bi-google::before{content:"\f3f0"}.bi-graph-down::before{content:"\f3f1"}.bi-graph-up::before{content:"\f3f2"}.bi-grid-1x2-fill::before{content:"\f3f3"}.bi-grid-1x2::before{content:"\f3f4"}.bi-grid-3x2-gap-fill::before{content:"\f3f5"}.bi-grid-3x2-gap::before{content:"\f3f6"}.bi-grid-3x2::before{content:"\f3f7"}.bi-grid-3x3-gap-fill::before{content:"\f3f8"}.bi-grid-3x3-gap::before{content:"\f3f9"}.bi-grid-3x3::before{content:"\f3fa"}.bi-grid-fill::before{content:"\f3fb"}.bi-grid::before{content:"\f3fc"}.bi-grip-horizontal::before{content:"\f3fd"}.bi-grip-vertical::before{content:"\f3fe"}.bi-hammer::before{content:"\f3ff"}.bi-hand-index-fill::before{content:"\f400"}.bi-hand-index-thumb-fill::before{content:"\f401"}.bi-hand-index-thumb::before{content:"\f402"}.bi-hand-index::before{content:"\f403"}.bi-hand-thumbs-down-fill::before{content:"\f404"}.bi-hand-thumbs-down::before{content:"\f405"}.bi-hand-thumbs-up-fill::before{content:"\f406"}.bi-hand-thumbs-up::before{content:"\f407"}.bi-handbag-fill::before{content:"\f408"}.bi-handbag::before{content:"\f409"}.bi-hash::before{content:"\f40a"}.bi-hdd-fill::before{content:"\f40b"}.bi-hdd-network-fill::before{content:"\f40c"}.bi-hdd-network::before{content:"\f40d"}.bi-hdd-rack-fill::before{content:"\f40e"}.bi-hdd-rack::before{content:"\f40f"}.bi-hdd-stack-fill::before{content:"\f410"}.bi-hdd-stack::before{content:"\f411"}.bi-hdd::before{content:"\f412"}.bi-headphones::before{content:"\f413"}.bi-headset::before{content:"\f414"}.bi-heart-fill::before{content:"\f415"}.bi-heart-half::before{content:"\f416"}.bi-heart::before{content:"\f417"}.bi-heptagon-fill::before{content:"\f418"}.bi-heptagon-half::before{content:"\f419"}.bi-heptagon::before{content:"\f41a"}.bi-hexagon-fill::before{content:"\f41b"}.bi-hexagon-half::before{content:"\f41c"}.bi-hexagon::before{content:"\f41d"}.bi-hourglass-bottom::before{content:"\f41e"}.bi-hourglass-split::before{content:"\f41f"}.bi-hourglass-top::before{content:"\f420"}.bi-hourglass::before{content:"\f421"}.bi-house-door-fill::before{content:"\f422"}.bi-house-door::before{content:"\f423"}.bi-house-fill::before{content:"\f424"}.bi-house::before{content:"\f425"}.bi-hr::before{content:"\f426"}.bi-hurricane::before{content:"\f427"}.bi-image-alt::before{content:"\f428"}.bi-image-fill::before{content:"\f429"}.bi-image::before{content:"\f42a"}.bi-images::before{content:"\f42b"}.bi-inbox-fill::before{content:"\f42c"}.bi-inbox::before{content:"\f42d"}.bi-inboxes-fill::before{content:"\f42e"}.bi-inboxes::before{content:"\f42f"}.bi-info-circle-fill::before{content:"\f430"}.bi-info-circle::before{content:"\f431"}.bi-info-square-fill::before{content:"\f432"}.bi-info-square::before{content:"\f433"}.bi-info::before{content:"\f434"}.bi-input-cursor-text::before{content:"\f435"}.bi-input-cursor::before{content:"\f436"}.bi-instagram::before{content:"\f437"}.bi-intersect::before{content:"\f438"}.bi-journal-album::before{content:"\f439"}.bi-journal-arrow-down::before{content:"\f43a"}.bi-journal-arrow-up::before{content:"\f43b"}.bi-journal-bookmark-fill::before{content:"\f43c"}.bi-journal-bookmark::before{content:"\f43d"}.bi-journal-check::before{content:"\f43e"}.bi-journal-code::before{content:"\f43f"}.bi-journal-medical::before{content:"\f440"}.bi-journal-minus::before{content:"\f441"}.bi-journal-plus::before{content:"\f442"}.bi-journal-richtext::before{content:"\f443"}.bi-journal-text::before{content:"\f444"}.bi-journal-x::before{content:"\f445"}.bi-journal::before{content:"\f446"}.bi-journals::before{content:"\f447"}.bi-joystick::before{content:"\f448"}.bi-justify-left::before{content:"\f449"}.bi-justify-right::before{content:"\f44a"}.bi-justify::before{content:"\f44b"}.bi-kanban-fill::before{content:"\f44c"}.bi-kanban::before{content:"\f44d"}.bi-key-fill::before{content:"\f44e"}.bi-key::before{content:"\f44f"}.bi-keyboard-fill::before{content:"\f450"}.bi-keyboard::before{content:"\f451"}.bi-ladder::before{content:"\f452"}.bi-lamp-fill::before{content:"\f453"}.bi-lamp::before{content:"\f454"}.bi-laptop-fill::before{content:"\f455"}.bi-laptop::before{content:"\f456"}.bi-layer-backward::before{content:"\f457"}.bi-layer-forward::before{content:"\f458"}.bi-layers-fill::before{content:"\f459"}.bi-layers-half::before{content:"\f45a"}.bi-layers::before{content:"\f45b"}.bi-layout-sidebar-inset-reverse::before{content:"\f45c"}.bi-layout-sidebar-inset::before{content:"\f45d"}.bi-layout-sidebar-reverse::before{content:"\f45e"}.bi-layout-sidebar::before{content:"\f45f"}.bi-layout-split::before{content:"\f460"}.bi-layout-text-sidebar-reverse::before{content:"\f461"}.bi-layout-text-sidebar::before{content:"\f462"}.bi-layout-text-window-reverse::before{content:"\f463"}.bi-layout-text-window::before{content:"\f464"}.bi-layout-three-columns::before{content:"\f465"}.bi-layout-wtf::before{content:"\f466"}.bi-life-preserver::before{content:"\f467"}.bi-lightbulb-fill::before{content:"\f468"}.bi-lightbulb-off-fill::before{content:"\f469"}.bi-lightbulb-off::before{content:"\f46a"}.bi-lightbulb::before{content:"\f46b"}.bi-lightning-charge-fill::before{content:"\f46c"}.bi-lightning-charge::before{content:"\f46d"}.bi-lightning-fill::before{content:"\f46e"}.bi-lightning::before{content:"\f46f"}.bi-link-45deg::before{content:"\f470"}.bi-link::before{content:"\f471"}.bi-linkedin::before{content:"\f472"}.bi-list-check::before{content:"\f473"}.bi-list-nested::before{content:"\f474"}.bi-list-ol::before{content:"\f475"}.bi-list-stars::before{content:"\f476"}.bi-list-task::before{content:"\f477"}.bi-list-ul::before{content:"\f478"}.bi-list::before{content:"\f479"}.bi-lock-fill::before{content:"\f47a"}.bi-lock::before{content:"\f47b"}.bi-mailbox::before{content:"\f47c"}.bi-mailbox2::before{content:"\f47d"}.bi-map-fill::before{content:"\f47e"}.bi-map::before{content:"\f47f"}.bi-markdown-fill::before{content:"\f480"}.bi-markdown::before{content:"\f481"}.bi-mask::before{content:"\f482"}.bi-megaphone-fill::before{content:"\f483"}.bi-megaphone::before{content:"\f484"}.bi-menu-app-fill::before{content:"\f485"}.bi-menu-app::before{content:"\f486"}.bi-menu-button-fill::before{content:"\f487"}.bi-menu-button-wide-fill::before{content:"\f488"}.bi-menu-button-wide::before{content:"\f489"}.bi-menu-button::before{content:"\f48a"}.bi-menu-down::before{content:"\f48b"}.bi-menu-up::before{content:"\f48c"}.bi-mic-fill::before{content:"\f48d"}.bi-mic-mute-fill::before{content:"\f48e"}.bi-mic-mute::before{content:"\f48f"}.bi-mic::before{content:"\f490"}.bi-minecart-loaded::before{content:"\f491"}.bi-minecart::before{content:"\f492"}.bi-moisture::before{content:"\f493"}.bi-moon-fill::before{content:"\f494"}.bi-moon-stars-fill::before{content:"\f495"}.bi-moon-stars::before{content:"\f496"}.bi-moon::before{content:"\f497"}.bi-mouse-fill::before{content:"\f498"}.bi-mouse::before{content:"\f499"}.bi-mouse2-fill::before{content:"\f49a"}.bi-mouse2::before{content:"\f49b"}.bi-mouse3-fill::before{content:"\f49c"}.bi-mouse3::before{content:"\f49d"}.bi-music-note-beamed::before{content:"\f49e"}.bi-music-note-list::before{content:"\f49f"}.bi-music-note::before{content:"\f4a0"}.bi-music-player-fill::before{content:"\f4a1"}.bi-music-player::before{content:"\f4a2"}.bi-newspaper::before{content:"\f4a3"}.bi-node-minus-fill::before{content:"\f4a4"}.bi-node-minus::before{content:"\f4a5"}.bi-node-plus-fill::before{content:"\f4a6"}.bi-node-plus::before{content:"\f4a7"}.bi-nut-fill::before{content:"\f4a8"}.bi-nut::before{content:"\f4a9"}.bi-octagon-fill::before{content:"\f4aa"}.bi-octagon-half::before{content:"\f4ab"}.bi-octagon::before{content:"\f4ac"}.bi-option::before{content:"\f4ad"}.bi-outlet::before{content:"\f4ae"}.bi-paint-bucket::before{content:"\f4af"}.bi-palette-fill::before{content:"\f4b0"}.bi-palette::before{content:"\f4b1"}.bi-palette2::before{content:"\f4b2"}.bi-paperclip::before{content:"\f4b3"}.bi-paragraph::before{content:"\f4b4"}.bi-patch-check-fill::before{content:"\f4b5"}.bi-patch-check::before{content:"\f4b6"}.bi-patch-exclamation-fill::before{content:"\f4b7"}.bi-patch-exclamation::before{content:"\f4b8"}.bi-patch-minus-fill::before{content:"\f4b9"}.bi-patch-minus::before{content:"\f4ba"}.bi-patch-plus-fill::before{content:"\f4bb"}.bi-patch-plus::before{content:"\f4bc"}.bi-patch-question-fill::before{content:"\f4bd"}.bi-patch-question::before{content:"\f4be"}.bi-pause-btn-fill::before{content:"\f4bf"}.bi-pause-btn::before{content:"\f4c0"}.bi-pause-circle-fill::before{content:"\f4c1"}.bi-pause-circle::before{content:"\f4c2"}.bi-pause-fill::before{content:"\f4c3"}.bi-pause::before{content:"\f4c4"}.bi-peace-fill::before{content:"\f4c5"}.bi-peace::before{content:"\f4c6"}.bi-pen-fill::before{content:"\f4c7"}.bi-pen::before{content:"\f4c8"}.bi-pencil-fill::before{content:"\f4c9"}.bi-pencil-square::before{content:"\f4ca"}.bi-pencil::before{content:"\f4cb"}.bi-pentagon-fill::before{content:"\f4cc"}.bi-pentagon-half::before{content:"\f4cd"}.bi-pentagon::before{content:"\f4ce"}.bi-people-fill::before{content:"\f4cf"}.bi-people::before{content:"\f4d0"}.bi-percent::before{content:"\f4d1"}.bi-person-badge-fill::before{content:"\f4d2"}.bi-person-badge::before{content:"\f4d3"}.bi-person-bounding-box::before{content:"\f4d4"}.bi-person-check-fill::before{content:"\f4d5"}.bi-person-check::before{content:"\f4d6"}.bi-person-circle::before{content:"\f4d7"}.bi-person-dash-fill::before{content:"\f4d8"}.bi-person-dash::before{content:"\f4d9"}.bi-person-fill::before{content:"\f4da"}.bi-person-lines-fill::before{content:"\f4db"}.bi-person-plus-fill::before{content:"\f4dc"}.bi-person-plus::before{content:"\f4dd"}.bi-person-square::before{content:"\f4de"}.bi-person-x-fill::before{content:"\f4df"}.bi-person-x::before{content:"\f4e0"}.bi-person::before{content:"\f4e1"}.bi-phone-fill::before{content:"\f4e2"}.bi-phone-landscape-fill::before{content:"\f4e3"}.bi-phone-landscape::before{content:"\f4e4"}.bi-phone-vibrate-fill::before{content:"\f4e5"}.bi-phone-vibrate::before{content:"\f4e6"}.bi-phone::before{content:"\f4e7"}.bi-pie-chart-fill::before{content:"\f4e8"}.bi-pie-chart::before{content:"\f4e9"}.bi-pin-angle-fill::before{content:"\f4ea"}.bi-pin-angle::before{content:"\f4eb"}.bi-pin-fill::before{content:"\f4ec"}.bi-pin::before{content:"\f4ed"}.bi-pip-fill::before{content:"\f4ee"}.bi-pip::before{content:"\f4ef"}.bi-play-btn-fill::before{content:"\f4f0"}.bi-play-btn::before{content:"\f4f1"}.bi-play-circle-fill::before{content:"\f4f2"}.bi-play-circle::before{content:"\f4f3"}.bi-play-fill::before{content:"\f4f4"}.bi-play::before{content:"\f4f5"}.bi-plug-fill::before{content:"\f4f6"}.bi-plug::before{content:"\f4f7"}.bi-plus-circle-dotted::before{content:"\f4f8"}.bi-plus-circle-fill::before{content:"\f4f9"}.bi-plus-circle::before{content:"\f4fa"}.bi-plus-square-dotted::before{content:"\f4fb"}.bi-plus-square-fill::before{content:"\f4fc"}.bi-plus-square::before{content:"\f4fd"}.bi-plus::before{content:"\f4fe"}.bi-power::before{content:"\f4ff"}.bi-printer-fill::before{content:"\f500"}.bi-printer::before{content:"\f501"}.bi-puzzle-fill::before{content:"\f502"}.bi-puzzle::before{content:"\f503"}.bi-question-circle-fill::before{content:"\f504"}.bi-question-circle::before{content:"\f505"}.bi-question-diamond-fill::before{content:"\f506"}.bi-question-diamond::before{content:"\f507"}.bi-question-octagon-fill::before{content:"\f508"}.bi-question-octagon::before{content:"\f509"}.bi-question-square-fill::before{content:"\f50a"}.bi-question-square::before{content:"\f50b"}.bi-question::before{content:"\f50c"}.bi-rainbow::before{content:"\f50d"}.bi-receipt-cutoff::before{content:"\f50e"}.bi-receipt::before{content:"\f50f"}.bi-reception-0::before{content:"\f510"}.bi-reception-1::before{content:"\f511"}.bi-reception-2::before{content:"\f512"}.bi-reception-3::before{content:"\f513"}.bi-reception-4::before{content:"\f514"}.bi-record-btn-fill::before{content:"\f515"}.bi-record-btn::before{content:"\f516"}.bi-record-circle-fill::before{content:"\f517"}.bi-record-circle::before{content:"\f518"}.bi-record-fill::before{content:"\f519"}.bi-record::before{content:"\f51a"}.bi-record2-fill::before{content:"\f51b"}.bi-record2::before{content:"\f51c"}.bi-reply-all-fill::before{content:"\f51d"}.bi-reply-all::before{content:"\f51e"}.bi-reply-fill::before{content:"\f51f"}.bi-reply::before{content:"\f520"}.bi-rss-fill::before{content:"\f521"}.bi-rss::before{content:"\f522"}.bi-rulers::before{content:"\f523"}.bi-save-fill::before{content:"\f524"}.bi-save::before{content:"\f525"}.bi-save2-fill::before{content:"\f526"}.bi-save2::before{content:"\f527"}.bi-scissors::before{content:"\f528"}.bi-screwdriver::before{content:"\f529"}.bi-search::before{content:"\f52a"}.bi-segmented-nav::before{content:"\f52b"}.bi-server::before{content:"\f52c"}.bi-share-fill::before{content:"\f52d"}.bi-share::before{content:"\f52e"}.bi-shield-check::before{content:"\f52f"}.bi-shield-exclamation::before{content:"\f530"}.bi-shield-fill-check::before{content:"\f531"}.bi-shield-fill-exclamation::before{content:"\f532"}.bi-shield-fill-minus::before{content:"\f533"}.bi-shield-fill-plus::before{content:"\f534"}.bi-shield-fill-x::before{content:"\f535"}.bi-shield-fill::before{content:"\f536"}.bi-shield-lock-fill::before{content:"\f537"}.bi-shield-lock::before{content:"\f538"}.bi-shield-minus::before{content:"\f539"}.bi-shield-plus::before{content:"\f53a"}.bi-shield-shaded::before{content:"\f53b"}.bi-shield-slash-fill::before{content:"\f53c"}.bi-shield-slash::before{content:"\f53d"}.bi-shield-x::before{content:"\f53e"}.bi-shield::before{content:"\f53f"}.bi-shift-fill::before{content:"\f540"}.bi-shift::before{content:"\f541"}.bi-shop-window::before{content:"\f542"}.bi-shop::before{content:"\f543"}.bi-shuffle::before{content:"\f544"}.bi-signpost-2-fill::before{content:"\f545"}.bi-signpost-2::before{content:"\f546"}.bi-signpost-fill::before{content:"\f547"}.bi-signpost-split-fill::before{content:"\f548"}.bi-signpost-split::before{content:"\f549"}.bi-signpost::before{content:"\f54a"}.bi-sim-fill::before{content:"\f54b"}.bi-sim::before{content:"\f54c"}.bi-skip-backward-btn-fill::before{content:"\f54d"}.bi-skip-backward-btn::before{content:"\f54e"}.bi-skip-backward-circle-fill::before{content:"\f54f"}.bi-skip-backward-circle::before{content:"\f550"}.bi-skip-backward-fill::before{content:"\f551"}.bi-skip-backward::before{content:"\f552"}.bi-skip-end-btn-fill::before{content:"\f553"}.bi-skip-end-btn::before{content:"\f554"}.bi-skip-end-circle-fill::before{content:"\f555"}.bi-skip-end-circle::before{content:"\f556"}.bi-skip-end-fill::before{content:"\f557"}.bi-skip-end::before{content:"\f558"}.bi-skip-forward-btn-fill::before{content:"\f559"}.bi-skip-forward-btn::before{content:"\f55a"}.bi-skip-forward-circle-fill::before{content:"\f55b"}.bi-skip-forward-circle::before{content:"\f55c"}.bi-skip-forward-fill::before{content:"\f55d"}.bi-skip-forward::before{content:"\f55e"}.bi-skip-start-btn-fill::before{content:"\f55f"}.bi-skip-start-btn::before{content:"\f560"}.bi-skip-start-circle-fill::before{content:"\f561"}.bi-skip-start-circle::before{content:"\f562"}.bi-skip-start-fill::before{content:"\f563"}.bi-skip-start::before{content:"\f564"}.bi-slack::before{content:"\f565"}.bi-slash-circle-fill::before{content:"\f566"}.bi-slash-circle::before{content:"\f567"}.bi-slash-square-fill::before{content:"\f568"}.bi-slash-square::before{content:"\f569"}.bi-slash::before{content:"\f56a"}.bi-sliders::before{content:"\f56b"}.bi-smartwatch::before{content:"\f56c"}.bi-snow::before{content:"\f56d"}.bi-snow2::before{content:"\f56e"}.bi-snow3::before{content:"\f56f"}.bi-sort-alpha-down-alt::before{content:"\f570"}.bi-sort-alpha-down::before{content:"\f571"}.bi-sort-alpha-up-alt::before{content:"\f572"}.bi-sort-alpha-up::before{content:"\f573"}.bi-sort-down-alt::before{content:"\f574"}.bi-sort-down::before{content:"\f575"}.bi-sort-numeric-down-alt::before{content:"\f576"}.bi-sort-numeric-down::before{content:"\f577"}.bi-sort-numeric-up-alt::before{content:"\f578"}.bi-sort-numeric-up::before{content:"\f579"}.bi-sort-up-alt::before{content:"\f57a"}.bi-sort-up::before{content:"\f57b"}.bi-soundwave::before{content:"\f57c"}.bi-speaker-fill::before{content:"\f57d"}.bi-speaker::before{content:"\f57e"}.bi-speedometer::before{content:"\f57f"}.bi-speedometer2::before{content:"\f580"}.bi-spellcheck::before{content:"\f581"}.bi-square-fill::before{content:"\f582"}.bi-square-half::before{content:"\f583"}.bi-square::before{content:"\f584"}.bi-stack::before{content:"\f585"}.bi-star-fill::before{content:"\f586"}.bi-star-half::before{content:"\f587"}.bi-star::before{content:"\f588"}.bi-stars::before{content:"\f589"}.bi-stickies-fill::before{content:"\f58a"}.bi-stickies::before{content:"\f58b"}.bi-sticky-fill::before{content:"\f58c"}.bi-sticky::before{content:"\f58d"}.bi-stop-btn-fill::before{content:"\f58e"}.bi-stop-btn::before{content:"\f58f"}.bi-stop-circle-fill::before{content:"\f590"}.bi-stop-circle::before{content:"\f591"}.bi-stop-fill::before{content:"\f592"}.bi-stop::before{content:"\f593"}.bi-stoplights-fill::before{content:"\f594"}.bi-stoplights::before{content:"\f595"}.bi-stopwatch-fill::before{content:"\f596"}.bi-stopwatch::before{content:"\f597"}.bi-subtract::before{content:"\f598"}.bi-suit-club-fill::before{content:"\f599"}.bi-suit-club::before{content:"\f59a"}.bi-suit-diamond-fill::before{content:"\f59b"}.bi-suit-diamond::before{content:"\f59c"}.bi-suit-heart-fill::before{content:"\f59d"}.bi-suit-heart::before{content:"\f59e"}.bi-suit-spade-fill::before{content:"\f59f"}.bi-suit-spade::before{content:"\f5a0"}.bi-sun-fill::before{content:"\f5a1"}.bi-sun::before{content:"\f5a2"}.bi-sunglasses::before{content:"\f5a3"}.bi-sunrise-fill::before{content:"\f5a4"}.bi-sunrise::before{content:"\f5a5"}.bi-sunset-fill::before{content:"\f5a6"}.bi-sunset::before{content:"\f5a7"}.bi-symmetry-horizontal::before{content:"\f5a8"}.bi-symmetry-vertical::before{content:"\f5a9"}.bi-table::before{content:"\f5aa"}.bi-tablet-fill::before{content:"\f5ab"}.bi-tablet-landscape-fill::before{content:"\f5ac"}.bi-tablet-landscape::before{content:"\f5ad"}.bi-tablet::before{content:"\f5ae"}.bi-tag-fill::before{content:"\f5af"}.bi-tag::before{content:"\f5b0"}.bi-tags-fill::before{content:"\f5b1"}.bi-tags::before{content:"\f5b2"}.bi-telegram::before{content:"\f5b3"}.bi-telephone-fill::before{content:"\f5b4"}.bi-telephone-forward-fill::before{content:"\f5b5"}.bi-telephone-forward::before{content:"\f5b6"}.bi-telephone-inbound-fill::before{content:"\f5b7"}.bi-telephone-inbound::before{content:"\f5b8"}.bi-telephone-minus-fill::before{content:"\f5b9"}.bi-telephone-minus::before{content:"\f5ba"}.bi-telephone-outbound-fill::before{content:"\f5bb"}.bi-telephone-outbound::before{content:"\f5bc"}.bi-telephone-plus-fill::before{content:"\f5bd"}.bi-telephone-plus::before{content:"\f5be"}.bi-telephone-x-fill::before{content:"\f5bf"}.bi-telephone-x::before{content:"\f5c0"}.bi-telephone::before{content:"\f5c1"}.bi-terminal-fill::before{content:"\f5c2"}.bi-terminal::before{content:"\f5c3"}.bi-text-center::before{content:"\f5c4"}.bi-text-indent-left::before{content:"\f5c5"}.bi-text-indent-right::before{content:"\f5c6"}.bi-text-left::before{content:"\f5c7"}.bi-text-paragraph::before{content:"\f5c8"}.bi-text-right::before{content:"\f5c9"}.bi-textarea-resize::before{content:"\f5ca"}.bi-textarea-t::before{content:"\f5cb"}.bi-textarea::before{content:"\f5cc"}.bi-thermometer-half::before{content:"\f5cd"}.bi-thermometer-high::before{content:"\f5ce"}.bi-thermometer-low::before{content:"\f5cf"}.bi-thermometer-snow::before{content:"\f5d0"}.bi-thermometer-sun::before{content:"\f5d1"}.bi-thermometer::before{content:"\f5d2"}.bi-three-dots-vertical::before{content:"\f5d3"}.bi-three-dots::before{content:"\f5d4"}.bi-toggle-off::before{content:"\f5d5"}.bi-toggle-on::before{content:"\f5d6"}.bi-toggle2-off::before{content:"\f5d7"}.bi-toggle2-on::before{content:"\f5d8"}.bi-toggles::before{content:"\f5d9"}.bi-toggles2::before{content:"\f5da"}.bi-tools::before{content:"\f5db"}.bi-tornado::before{content:"\f5dc"}.bi-trash-fill::before{content:"\f5dd"}.bi-trash::before{content:"\f5de"}.bi-trash2-fill::before{content:"\f5df"}.bi-trash2::before{content:"\f5e0"}.bi-tree-fill::before{content:"\f5e1"}.bi-tree::before{content:"\f5e2"}.bi-triangle-fill::before{content:"\f5e3"}.bi-triangle-half::before{content:"\f5e4"}.bi-triangle::before{content:"\f5e5"}.bi-trophy-fill::before{content:"\f5e6"}.bi-trophy::before{content:"\f5e7"}.bi-tropical-storm::before{content:"\f5e8"}.bi-truck-flatbed::before{content:"\f5e9"}.bi-truck::before{content:"\f5ea"}.bi-tsunami::before{content:"\f5eb"}.bi-tv-fill::before{content:"\f5ec"}.bi-tv::before{content:"\f5ed"}.bi-twitch::before{content:"\f5ee"}.bi-twitter::before{content:"\f5ef"}.bi-type-bold::before{content:"\f5f0"}.bi-type-h1::before{content:"\f5f1"}.bi-type-h2::before{content:"\f5f2"}.bi-type-h3::before{content:"\f5f3"}.bi-type-italic::before{content:"\f5f4"}.bi-type-strikethrough::before{content:"\f5f5"}.bi-type-underline::before{content:"\f5f6"}.bi-type::before{content:"\f5f7"}.bi-ui-checks-grid::before{content:"\f5f8"}.bi-ui-checks::before{content:"\f5f9"}.bi-ui-radios-grid::before{content:"\f5fa"}.bi-ui-radios::before{content:"\f5fb"}.bi-umbrella-fill::before{content:"\f5fc"}.bi-umbrella::before{content:"\f5fd"}.bi-union::before{content:"\f5fe"}.bi-unlock-fill::before{content:"\f5ff"}.bi-unlock::before{content:"\f600"}.bi-upc-scan::before{content:"\f601"}.bi-upc::before{content:"\f602"}.bi-upload::before{content:"\f603"}.bi-vector-pen::before{content:"\f604"}.bi-view-list::before{content:"\f605"}.bi-view-stacked::before{content:"\f606"}.bi-vinyl-fill::before{content:"\f607"}.bi-vinyl::before{content:"\f608"}.bi-voicemail::before{content:"\f609"}.bi-volume-down-fill::before{content:"\f60a"}.bi-volume-down::before{content:"\f60b"}.bi-volume-mute-fill::before{content:"\f60c"}.bi-volume-mute::before{content:"\f60d"}.bi-volume-off-fill::before{content:"\f60e"}.bi-volume-off::before{content:"\f60f"}.bi-volume-up-fill::before{content:"\f610"}.bi-volume-up::before{content:"\f611"}.bi-vr::before{content:"\f612"}.bi-wallet-fill::before{content:"\f613"}.bi-wallet::before{content:"\f614"}.bi-wallet2::before{content:"\f615"}.bi-watch::before{content:"\f616"}.bi-water::before{content:"\f617"}.bi-whatsapp::before{content:"\f618"}.bi-wifi-1::before{content:"\f619"}.bi-wifi-2::before{content:"\f61a"}.bi-wifi-off::before{content:"\f61b"}.bi-wifi::before{content:"\f61c"}.bi-wind::before{content:"\f61d"}.bi-window-dock::before{content:"\f61e"}.bi-window-sidebar::before{content:"\f61f"}.bi-window::before{content:"\f620"}.bi-wrench::before{content:"\f621"}.bi-x-circle-fill::before{content:"\f622"}.bi-x-circle::before{content:"\f623"}.bi-x-diamond-fill::before{content:"\f624"}.bi-x-diamond::before{content:"\f625"}.bi-x-octagon-fill::before{content:"\f626"}.bi-x-octagon::before{content:"\f627"}.bi-x-square-fill::before{content:"\f628"}.bi-x-square::before{content:"\f629"}.bi-x::before{content:"\f62a"}.bi-youtube::before{content:"\f62b"}.bi-zoom-in::before{content:"\f62c"}.bi-zoom-out::before{content:"\f62d"}.bi-bank::before{content:"\f62e"}.bi-bank2::before{content:"\f62f"}.bi-bell-slash-fill::before{content:"\f630"}.bi-bell-slash::before{content:"\f631"}.bi-cash-coin::before{content:"\f632"}.bi-check-lg::before{content:"\f633"}.bi-coin::before{content:"\f634"}.bi-currency-bitcoin::before{content:"\f635"}.bi-currency-dollar::before{content:"\f636"}.bi-currency-euro::before{content:"\f637"}.bi-currency-exchange::before{content:"\f638"}.bi-currency-pound::before{content:"\f639"}.bi-currency-yen::before{content:"\f63a"}.bi-dash-lg::before{content:"\f63b"}.bi-exclamation-lg::before{content:"\f63c"}.bi-file-earmark-pdf-fill::before{content:"\f63d"}.bi-file-earmark-pdf::before{content:"\f63e"}.bi-file-pdf-fill::before{content:"\f63f"}.bi-file-pdf::before{content:"\f640"}.bi-gender-ambiguous::before{content:"\f641"}.bi-gender-female::before{content:"\f642"}.bi-gender-male::before{content:"\f643"}.bi-gender-trans::before{content:"\f644"}.bi-headset-vr::before{content:"\f645"}.bi-info-lg::before{content:"\f646"}.bi-mastodon::before{content:"\f647"}.bi-messenger::before{content:"\f648"}.bi-piggy-bank-fill::before{content:"\f649"}.bi-piggy-bank::before{content:"\f64a"}.bi-pin-map-fill::before{content:"\f64b"}.bi-pin-map::before{content:"\f64c"}.bi-plus-lg::before{content:"\f64d"}.bi-question-lg::before{content:"\f64e"}.bi-recycle::before{content:"\f64f"}.bi-reddit::before{content:"\f650"}.bi-safe-fill::before{content:"\f651"}.bi-safe2-fill::before{content:"\f652"}.bi-safe2::before{content:"\f653"}.bi-sd-card-fill::before{content:"\f654"}.bi-sd-card::before{content:"\f655"}.bi-skype::before{content:"\f656"}.bi-slash-lg::before{content:"\f657"}.bi-translate::before{content:"\f658"}.bi-x-lg::before{content:"\f659"}.bi-safe::before{content:"\f65a"}.bi-apple::before{content:"\f65b"}.bi-microsoft::before{content:"\f65d"}.bi-windows::before{content:"\f65e"}.bi-behance::before{content:"\f65c"}.bi-dribbble::before{content:"\f65f"}.bi-line::before{content:"\f660"}.bi-medium::before{content:"\f661"}.bi-paypal::before{content:"\f662"}.bi-pinterest::before{content:"\f663"}.bi-signal::before{content:"\f664"}.bi-snapchat::before{content:"\f665"}.bi-spotify::before{content:"\f666"}.bi-stack-overflow::before{content:"\f667"}.bi-strava::before{content:"\f668"}.bi-wordpress::before{content:"\f669"}.bi-vimeo::before{content:"\f66a"}.bi-activity::before{content:"\f66b"}.bi-easel2-fill::before{content:"\f66c"}.bi-easel2::before{content:"\f66d"}.bi-easel3-fill::before{content:"\f66e"}.bi-easel3::before{content:"\f66f"}.bi-fan::before{content:"\f670"}.bi-fingerprint::before{content:"\f671"}.bi-graph-down-arrow::before{content:"\f672"}.bi-graph-up-arrow::before{content:"\f673"}.bi-hypnotize::before{content:"\f674"}.bi-magic::before{content:"\f675"}.bi-person-rolodex::before{content:"\f676"}.bi-person-video::before{content:"\f677"}.bi-person-video2::before{content:"\f678"}.bi-person-video3::before{content:"\f679"}.bi-person-workspace::before{content:"\f67a"}.bi-radioactive::before{content:"\f67b"}.bi-webcam-fill::before{content:"\f67c"}.bi-webcam::before{content:"\f67d"}.bi-yin-yang::before{content:"\f67e"}.bi-bandaid-fill::before{content:"\f680"}.bi-bandaid::before{content:"\f681"}.bi-bluetooth::before{content:"\f682"}.bi-body-text::before{content:"\f683"}.bi-boombox::before{content:"\f684"}.bi-boxes::before{content:"\f685"}.bi-dpad-fill::before{content:"\f686"}.bi-dpad::before{content:"\f687"}.bi-ear-fill::before{content:"\f688"}.bi-ear::before{content:"\f689"}.bi-envelope-check-fill::before{content:"\f68b"}.bi-envelope-check::before{content:"\f68c"}.bi-envelope-dash-fill::before{content:"\f68e"}.bi-envelope-dash::before{content:"\f68f"}.bi-envelope-exclamation-fill::before{content:"\f691"}.bi-envelope-exclamation::before{content:"\f692"}.bi-envelope-plus-fill::before{content:"\f693"}.bi-envelope-plus::before{content:"\f694"}.bi-envelope-slash-fill::before{content:"\f696"}.bi-envelope-slash::before{content:"\f697"}.bi-envelope-x-fill::before{content:"\f699"}.bi-envelope-x::before{content:"\f69a"}.bi-explicit-fill::before{content:"\f69b"}.bi-explicit::before{content:"\f69c"}.bi-git::before{content:"\f69d"}.bi-infinity::before{content:"\f69e"}.bi-list-columns-reverse::before{content:"\f69f"}.bi-list-columns::before{content:"\f6a0"}.bi-meta::before{content:"\f6a1"}.bi-nintendo-switch::before{content:"\f6a4"}.bi-pc-display-horizontal::before{content:"\f6a5"}.bi-pc-display::before{content:"\f6a6"}.bi-pc-horizontal::before{content:"\f6a7"}.bi-pc::before{content:"\f6a8"}.bi-playstation::before{content:"\f6a9"}.bi-plus-slash-minus::before{content:"\f6aa"}.bi-projector-fill::before{content:"\f6ab"}.bi-projector::before{content:"\f6ac"}.bi-qr-code-scan::before{content:"\f6ad"}.bi-qr-code::before{content:"\f6ae"}.bi-quora::before{content:"\f6af"}.bi-quote::before{content:"\f6b0"}.bi-robot::before{content:"\f6b1"}.bi-send-check-fill::before{content:"\f6b2"}.bi-send-check::before{content:"\f6b3"}.bi-send-dash-fill::before{content:"\f6b4"}.bi-send-dash::before{content:"\f6b5"}.bi-send-exclamation-fill::before{content:"\f6b7"}.bi-send-exclamation::before{content:"\f6b8"}.bi-send-fill::before{content:"\f6b9"}.bi-send-plus-fill::before{content:"\f6ba"}.bi-send-plus::before{content:"\f6bb"}.bi-send-slash-fill::before{content:"\f6bc"}.bi-send-slash::before{content:"\f6bd"}.bi-send-x-fill::before{content:"\f6be"}.bi-send-x::before{content:"\f6bf"}.bi-send::before{content:"\f6c0"}.bi-steam::before{content:"\f6c1"}.bi-terminal-dash::before{content:"\f6c3"}.bi-terminal-plus::before{content:"\f6c4"}.bi-terminal-split::before{content:"\f6c5"}.bi-ticket-detailed-fill::before{content:"\f6c6"}.bi-ticket-detailed::before{content:"\f6c7"}.bi-ticket-fill::before{content:"\f6c8"}.bi-ticket-perforated-fill::before{content:"\f6c9"}.bi-ticket-perforated::before{content:"\f6ca"}.bi-ticket::before{content:"\f6cb"}.bi-tiktok::before{content:"\f6cc"}.bi-window-dash::before{content:"\f6cd"}.bi-window-desktop::before{content:"\f6ce"}.bi-window-fullscreen::before{content:"\f6cf"}.bi-window-plus::before{content:"\f6d0"}.bi-window-split::before{content:"\f6d1"}.bi-window-stack::before{content:"\f6d2"}.bi-window-x::before{content:"\f6d3"}.bi-xbox::before{content:"\f6d4"}.bi-ethernet::before{content:"\f6d5"}.bi-hdmi-fill::before{content:"\f6d6"}.bi-hdmi::before{content:"\f6d7"}.bi-usb-c-fill::before{content:"\f6d8"}.bi-usb-c::before{content:"\f6d9"}.bi-usb-fill::before{content:"\f6da"}.bi-usb-plug-fill::before{content:"\f6db"}.bi-usb-plug::before{content:"\f6dc"}.bi-usb-symbol::before{content:"\f6dd"}.bi-usb::before{content:"\f6de"}.bi-boombox-fill::before{content:"\f6df"}.bi-displayport::before{content:"\f6e1"}.bi-gpu-card::before{content:"\f6e2"}.bi-memory::before{content:"\f6e3"}.bi-modem-fill::before{content:"\f6e4"}.bi-modem::before{content:"\f6e5"}.bi-motherboard-fill::before{content:"\f6e6"}.bi-motherboard::before{content:"\f6e7"}.bi-optical-audio-fill::before{content:"\f6e8"}.bi-optical-audio::before{content:"\f6e9"}.bi-pci-card::before{content:"\f6ea"}.bi-router-fill::before{content:"\f6eb"}.bi-router::before{content:"\f6ec"}.bi-thunderbolt-fill::before{content:"\f6ef"}.bi-thunderbolt::before{content:"\f6f0"}.bi-usb-drive-fill::before{content:"\f6f1"}.bi-usb-drive::before{content:"\f6f2"}.bi-usb-micro-fill::before{content:"\f6f3"}.bi-usb-micro::before{content:"\f6f4"}.bi-usb-mini-fill::before{content:"\f6f5"}.bi-usb-mini::before{content:"\f6f6"}.bi-cloud-haze2::before{content:"\f6f7"}.bi-device-hdd-fill::before{content:"\f6f8"}.bi-device-hdd::before{content:"\f6f9"}.bi-device-ssd-fill::before{content:"\f6fa"}.bi-device-ssd::before{content:"\f6fb"}.bi-displayport-fill::before{content:"\f6fc"}.bi-mortarboard-fill::before{content:"\f6fd"}.bi-mortarboard::before{content:"\f6fe"}.bi-terminal-x::before{content:"\f6ff"}.bi-arrow-through-heart-fill::before{content:"\f700"}.bi-arrow-through-heart::before{content:"\f701"}.bi-badge-sd-fill::before{content:"\f702"}.bi-badge-sd::before{content:"\f703"}.bi-bag-heart-fill::before{content:"\f704"}.bi-bag-heart::before{content:"\f705"}.bi-balloon-fill::before{content:"\f706"}.bi-balloon-heart-fill::before{content:"\f707"}.bi-balloon-heart::before{content:"\f708"}.bi-balloon::before{content:"\f709"}.bi-box2-fill::before{content:"\f70a"}.bi-box2-heart-fill::before{content:"\f70b"}.bi-box2-heart::before{content:"\f70c"}.bi-box2::before{content:"\f70d"}.bi-braces-asterisk::before{content:"\f70e"}.bi-calendar-heart-fill::before{content:"\f70f"}.bi-calendar-heart::before{content:"\f710"}.bi-calendar2-heart-fill::before{content:"\f711"}.bi-calendar2-heart::before{content:"\f712"}.bi-chat-heart-fill::before{content:"\f713"}.bi-chat-heart::before{content:"\f714"}.bi-chat-left-heart-fill::before{content:"\f715"}.bi-chat-left-heart::before{content:"\f716"}.bi-chat-right-heart-fill::before{content:"\f717"}.bi-chat-right-heart::before{content:"\f718"}.bi-chat-square-heart-fill::before{content:"\f719"}.bi-chat-square-heart::before{content:"\f71a"}.bi-clipboard-check-fill::before{content:"\f71b"}.bi-clipboard-data-fill::before{content:"\f71c"}.bi-clipboard-fill::before{content:"\f71d"}.bi-clipboard-heart-fill::before{content:"\f71e"}.bi-clipboard-heart::before{content:"\f71f"}.bi-clipboard-minus-fill::before{content:"\f720"}.bi-clipboard-plus-fill::before{content:"\f721"}.bi-clipboard-pulse::before{content:"\f722"}.bi-clipboard-x-fill::before{content:"\f723"}.bi-clipboard2-check-fill::before{content:"\f724"}.bi-clipboard2-check::before{content:"\f725"}.bi-clipboard2-data-fill::before{content:"\f726"}.bi-clipboard2-data::before{content:"\f727"}.bi-clipboard2-fill::before{content:"\f728"}.bi-clipboard2-heart-fill::before{content:"\f729"}.bi-clipboard2-heart::before{content:"\f72a"}.bi-clipboard2-minus-fill::before{content:"\f72b"}.bi-clipboard2-minus::before{content:"\f72c"}.bi-clipboard2-plus-fill::before{content:"\f72d"}.bi-clipboard2-plus::before{content:"\f72e"}.bi-clipboard2-pulse-fill::before{content:"\f72f"}.bi-clipboard2-pulse::before{content:"\f730"}.bi-clipboard2-x-fill::before{content:"\f731"}.bi-clipboard2-x::before{content:"\f732"}.bi-clipboard2::before{content:"\f733"}.bi-emoji-kiss-fill::before{content:"\f734"}.bi-emoji-kiss::before{content:"\f735"}.bi-envelope-heart-fill::before{content:"\f736"}.bi-envelope-heart::before{content:"\f737"}.bi-envelope-open-heart-fill::before{content:"\f738"}.bi-envelope-open-heart::before{content:"\f739"}.bi-envelope-paper-fill::before{content:"\f73a"}.bi-envelope-paper-heart-fill::before{content:"\f73b"}.bi-envelope-paper-heart::before{content:"\f73c"}.bi-envelope-paper::before{content:"\f73d"}.bi-filetype-aac::before{content:"\f73e"}.bi-filetype-ai::before{content:"\f73f"}.bi-filetype-bmp::before{content:"\f740"}.bi-filetype-cs::before{content:"\f741"}.bi-filetype-css::before{content:"\f742"}.bi-filetype-csv::before{content:"\f743"}.bi-filetype-doc::before{content:"\f744"}.bi-filetype-docx::before{content:"\f745"}.bi-filetype-exe::before{content:"\f746"}.bi-filetype-gif::before{content:"\f747"}.bi-filetype-heic::before{content:"\f748"}.bi-filetype-html::before{content:"\f749"}.bi-filetype-java::before{content:"\f74a"}.bi-filetype-jpg::before{content:"\f74b"}.bi-filetype-js::before{content:"\f74c"}.bi-filetype-jsx::before{content:"\f74d"}.bi-filetype-key::before{content:"\f74e"}.bi-filetype-m4p::before{content:"\f74f"}.bi-filetype-md::before{content:"\f750"}.bi-filetype-mdx::before{content:"\f751"}.bi-filetype-mov::before{content:"\f752"}.bi-filetype-mp3::before{content:"\f753"}.bi-filetype-mp4::before{content:"\f754"}.bi-filetype-otf::before{content:"\f755"}.bi-filetype-pdf::before{content:"\f756"}.bi-filetype-php::before{content:"\f757"}.bi-filetype-png::before{content:"\f758"}.bi-filetype-ppt::before{content:"\f75a"}.bi-filetype-psd::before{content:"\f75b"}.bi-filetype-py::before{content:"\f75c"}.bi-filetype-raw::before{content:"\f75d"}.bi-filetype-rb::before{content:"\f75e"}.bi-filetype-sass::before{content:"\f75f"}.bi-filetype-scss::before{content:"\f760"}.bi-filetype-sh::before{content:"\f761"}.bi-filetype-svg::before{content:"\f762"}.bi-filetype-tiff::before{content:"\f763"}.bi-filetype-tsx::before{content:"\f764"}.bi-filetype-ttf::before{content:"\f765"}.bi-filetype-txt::before{content:"\f766"}.bi-filetype-wav::before{content:"\f767"}.bi-filetype-woff::before{content:"\f768"}.bi-filetype-xls::before{content:"\f76a"}.bi-filetype-xml::before{content:"\f76b"}.bi-filetype-yml::before{content:"\f76c"}.bi-heart-arrow::before{content:"\f76d"}.bi-heart-pulse-fill::before{content:"\f76e"}.bi-heart-pulse::before{content:"\f76f"}.bi-heartbreak-fill::before{content:"\f770"}.bi-heartbreak::before{content:"\f771"}.bi-hearts::before{content:"\f772"}.bi-hospital-fill::before{content:"\f773"}.bi-hospital::before{content:"\f774"}.bi-house-heart-fill::before{content:"\f775"}.bi-house-heart::before{content:"\f776"}.bi-incognito::before{content:"\f777"}.bi-magnet-fill::before{content:"\f778"}.bi-magnet::before{content:"\f779"}.bi-person-heart::before{content:"\f77a"}.bi-person-hearts::before{content:"\f77b"}.bi-phone-flip::before{content:"\f77c"}.bi-plugin::before{content:"\f77d"}.bi-postage-fill::before{content:"\f77e"}.bi-postage-heart-fill::before{content:"\f77f"}.bi-postage-heart::before{content:"\f780"}.bi-postage::before{content:"\f781"}.bi-postcard-fill::before{content:"\f782"}.bi-postcard-heart-fill::before{content:"\f783"}.bi-postcard-heart::before{content:"\f784"}.bi-postcard::before{content:"\f785"}.bi-search-heart-fill::before{content:"\f786"}.bi-search-heart::before{content:"\f787"}.bi-sliders2-vertical::before{content:"\f788"}.bi-sliders2::before{content:"\f789"}.bi-trash3-fill::before{content:"\f78a"}.bi-trash3::before{content:"\f78b"}.bi-valentine::before{content:"\f78c"}.bi-valentine2::before{content:"\f78d"}.bi-wrench-adjustable-circle-fill::before{content:"\f78e"}.bi-wrench-adjustable-circle::before{content:"\f78f"}.bi-wrench-adjustable::before{content:"\f790"}.bi-filetype-json::before{content:"\f791"}.bi-filetype-pptx::before{content:"\f792"}.bi-filetype-xlsx::before{content:"\f793"}.bi-1-circle-fill::before{content:"\f796"}.bi-1-circle::before{content:"\f797"}.bi-1-square-fill::before{content:"\f798"}.bi-1-square::before{content:"\f799"}.bi-2-circle-fill::before{content:"\f79c"}.bi-2-circle::before{content:"\f79d"}.bi-2-square-fill::before{content:"\f79e"}.bi-2-square::before{content:"\f79f"}.bi-3-circle-fill::before{content:"\f7a2"}.bi-3-circle::before{content:"\f7a3"}.bi-3-square-fill::before{content:"\f7a4"}.bi-3-square::before{content:"\f7a5"}.bi-4-circle-fill::before{content:"\f7a8"}.bi-4-circle::before{content:"\f7a9"}.bi-4-square-fill::before{content:"\f7aa"}.bi-4-square::before{content:"\f7ab"}.bi-5-circle-fill::before{content:"\f7ae"}.bi-5-circle::before{content:"\f7af"}.bi-5-square-fill::before{content:"\f7b0"}.bi-5-square::before{content:"\f7b1"}.bi-6-circle-fill::before{content:"\f7b4"}.bi-6-circle::before{content:"\f7b5"}.bi-6-square-fill::before{content:"\f7b6"}.bi-6-square::before{content:"\f7b7"}.bi-7-circle-fill::before{content:"\f7ba"}.bi-7-circle::before{content:"\f7bb"}.bi-7-square-fill::before{content:"\f7bc"}.bi-7-square::before{content:"\f7bd"}.bi-8-circle-fill::before{content:"\f7c0"}.bi-8-circle::before{content:"\f7c1"}.bi-8-square-fill::before{content:"\f7c2"}.bi-8-square::before{content:"\f7c3"}.bi-9-circle-fill::before{content:"\f7c6"}.bi-9-circle::before{content:"\f7c7"}.bi-9-square-fill::before{content:"\f7c8"}.bi-9-square::before{content:"\f7c9"}.bi-airplane-engines-fill::before{content:"\f7ca"}.bi-airplane-engines::before{content:"\f7cb"}.bi-airplane-fill::before{content:"\f7cc"}.bi-airplane::before{content:"\f7cd"}.bi-alexa::before{content:"\f7ce"}.bi-alipay::before{content:"\f7cf"}.bi-android::before{content:"\f7d0"}.bi-android2::before{content:"\f7d1"}.bi-box-fill::before{content:"\f7d2"}.bi-box-seam-fill::before{content:"\f7d3"}.bi-browser-chrome::before{content:"\f7d4"}.bi-browser-edge::before{content:"\f7d5"}.bi-browser-firefox::before{content:"\f7d6"}.bi-browser-safari::before{content:"\f7d7"}.bi-c-circle-fill::before{content:"\f7da"}.bi-c-circle::before{content:"\f7db"}.bi-c-square-fill::before{content:"\f7dc"}.bi-c-square::before{content:"\f7dd"}.bi-capsule-pill::before{content:"\f7de"}.bi-capsule::before{content:"\f7df"}.bi-car-front-fill::before{content:"\f7e0"}.bi-car-front::before{content:"\f7e1"}.bi-cassette-fill::before{content:"\f7e2"}.bi-cassette::before{content:"\f7e3"}.bi-cc-circle-fill::before{content:"\f7e6"}.bi-cc-circle::before{content:"\f7e7"}.bi-cc-square-fill::before{content:"\f7e8"}.bi-cc-square::before{content:"\f7e9"}.bi-cup-hot-fill::before{content:"\f7ea"}.bi-cup-hot::before{content:"\f7eb"}.bi-currency-rupee::before{content:"\f7ec"}.bi-dropbox::before{content:"\f7ed"}.bi-escape::before{content:"\f7ee"}.bi-fast-forward-btn-fill::before{content:"\f7ef"}.bi-fast-forward-btn::before{content:"\f7f0"}.bi-fast-forward-circle-fill::before{content:"\f7f1"}.bi-fast-forward-circle::before{content:"\f7f2"}.bi-fast-forward-fill::before{content:"\f7f3"}.bi-fast-forward::before{content:"\f7f4"}.bi-filetype-sql::before{content:"\f7f5"}.bi-fire::before{content:"\f7f6"}.bi-google-play::before{content:"\f7f7"}.bi-h-circle-fill::before{content:"\f7fa"}.bi-h-circle::before{content:"\f7fb"}.bi-h-square-fill::before{content:"\f7fc"}.bi-h-square::before{content:"\f7fd"}.bi-indent::before{content:"\f7fe"}.bi-lungs-fill::before{content:"\f7ff"}.bi-lungs::before{content:"\f800"}.bi-microsoft-teams::before{content:"\f801"}.bi-p-circle-fill::before{content:"\f804"}.bi-p-circle::before{content:"\f805"}.bi-p-square-fill::before{content:"\f806"}.bi-p-square::before{content:"\f807"}.bi-pass-fill::before{content:"\f808"}.bi-pass::before{content:"\f809"}.bi-prescription::before{content:"\f80a"}.bi-prescription2::before{content:"\f80b"}.bi-r-circle-fill::before{content:"\f80e"}.bi-r-circle::before{content:"\f80f"}.bi-r-square-fill::before{content:"\f810"}.bi-r-square::before{content:"\f811"}.bi-repeat-1::before{content:"\f812"}.bi-repeat::before{content:"\f813"}.bi-rewind-btn-fill::before{content:"\f814"}.bi-rewind-btn::before{content:"\f815"}.bi-rewind-circle-fill::before{content:"\f816"}.bi-rewind-circle::before{content:"\f817"}.bi-rewind-fill::before{content:"\f818"}.bi-rewind::before{content:"\f819"}.bi-train-freight-front-fill::before{content:"\f81a"}.bi-train-freight-front::before{content:"\f81b"}.bi-train-front-fill::before{content:"\f81c"}.bi-train-front::before{content:"\f81d"}.bi-train-lightrail-front-fill::before{content:"\f81e"}.bi-train-lightrail-front::before{content:"\f81f"}.bi-truck-front-fill::before{content:"\f820"}.bi-truck-front::before{content:"\f821"}.bi-ubuntu::before{content:"\f822"}.bi-unindent::before{content:"\f823"}.bi-unity::before{content:"\f824"}.bi-universal-access-circle::before{content:"\f825"}.bi-universal-access::before{content:"\f826"}.bi-virus::before{content:"\f827"}.bi-virus2::before{content:"\f828"}.bi-wechat::before{content:"\f829"}.bi-yelp::before{content:"\f82a"}.bi-sign-stop-fill::before{content:"\f82b"}.bi-sign-stop-lights-fill::before{content:"\f82c"}.bi-sign-stop-lights::before{content:"\f82d"}.bi-sign-stop::before{content:"\f82e"}.bi-sign-turn-left-fill::before{content:"\f82f"}.bi-sign-turn-left::before{content:"\f830"}.bi-sign-turn-right-fill::before{content:"\f831"}.bi-sign-turn-right::before{content:"\f832"}.bi-sign-turn-slight-left-fill::before{content:"\f833"}.bi-sign-turn-slight-left::before{content:"\f834"}.bi-sign-turn-slight-right-fill::before{content:"\f835"}.bi-sign-turn-slight-right::before{content:"\f836"}.bi-sign-yield-fill::before{content:"\f837"}.bi-sign-yield::before{content:"\f838"}.bi-ev-station-fill::before{content:"\f839"}.bi-ev-station::before{content:"\f83a"}.bi-fuel-pump-diesel-fill::before{content:"\f83b"}.bi-fuel-pump-diesel::before{content:"\f83c"}.bi-fuel-pump-fill::before{content:"\f83d"}.bi-fuel-pump::before{content:"\f83e"}.bi-0-circle-fill::before{content:"\f83f"}.bi-0-circle::before{content:"\f840"}.bi-0-square-fill::before{content:"\f841"}.bi-0-square::before{content:"\f842"}.bi-rocket-fill::before{content:"\f843"}.bi-rocket-takeoff-fill::before{content:"\f844"}.bi-rocket-takeoff::before{content:"\f845"}.bi-rocket::before{content:"\f846"}.bi-stripe::before{content:"\f847"}.bi-subscript::before{content:"\f848"}.bi-superscript::before{content:"\f849"}.bi-trello::before{content:"\f84a"}.bi-envelope-at-fill::before{content:"\f84b"}.bi-envelope-at::before{content:"\f84c"}.bi-regex::before{content:"\f84d"}.bi-text-wrap::before{content:"\f84e"}.bi-sign-dead-end-fill::before{content:"\f84f"}.bi-sign-dead-end::before{content:"\f850"}.bi-sign-do-not-enter-fill::before{content:"\f851"}.bi-sign-do-not-enter::before{content:"\f852"}.bi-sign-intersection-fill::before{content:"\f853"}.bi-sign-intersection-side-fill::before{content:"\f854"}.bi-sign-intersection-side::before{content:"\f855"}.bi-sign-intersection-t-fill::before{content:"\f856"}.bi-sign-intersection-t::before{content:"\f857"}.bi-sign-intersection-y-fill::before{content:"\f858"}.bi-sign-intersection-y::before{content:"\f859"}.bi-sign-intersection::before{content:"\f85a"}.bi-sign-merge-left-fill::before{content:"\f85b"}.bi-sign-merge-left::before{content:"\f85c"}.bi-sign-merge-right-fill::before{content:"\f85d"}.bi-sign-merge-right::before{content:"\f85e"}.bi-sign-no-left-turn-fill::before{content:"\f85f"}.bi-sign-no-left-turn::before{content:"\f860"}.bi-sign-no-parking-fill::before{content:"\f861"}.bi-sign-no-parking::before{content:"\f862"}.bi-sign-no-right-turn-fill::before{content:"\f863"}.bi-sign-no-right-turn::before{content:"\f864"}.bi-sign-railroad-fill::before{content:"\f865"}.bi-sign-railroad::before{content:"\f866"}.bi-building-add::before{content:"\f867"}.bi-building-check::before{content:"\f868"}.bi-building-dash::before{content:"\f869"}.bi-building-down::before{content:"\f86a"}.bi-building-exclamation::before{content:"\f86b"}.bi-building-fill-add::before{content:"\f86c"}.bi-building-fill-check::before{content:"\f86d"}.bi-building-fill-dash::before{content:"\f86e"}.bi-building-fill-down::before{content:"\f86f"}.bi-building-fill-exclamation::before{content:"\f870"}.bi-building-fill-gear::before{content:"\f871"}.bi-building-fill-lock::before{content:"\f872"}.bi-building-fill-slash::before{content:"\f873"}.bi-building-fill-up::before{content:"\f874"}.bi-building-fill-x::before{content:"\f875"}.bi-building-fill::before{content:"\f876"}.bi-building-gear::before{content:"\f877"}.bi-building-lock::before{content:"\f878"}.bi-building-slash::before{content:"\f879"}.bi-building-up::before{content:"\f87a"}.bi-building-x::before{content:"\f87b"}.bi-buildings-fill::before{content:"\f87c"}.bi-buildings::before{content:"\f87d"}.bi-bus-front-fill::before{content:"\f87e"}.bi-bus-front::before{content:"\f87f"}.bi-ev-front-fill::before{content:"\f880"}.bi-ev-front::before{content:"\f881"}.bi-globe-americas::before{content:"\f882"}.bi-globe-asia-australia::before{content:"\f883"}.bi-globe-central-south-asia::before{content:"\f884"}.bi-globe-europe-africa::before{content:"\f885"}.bi-house-add-fill::before{content:"\f886"}.bi-house-add::before{content:"\f887"}.bi-house-check-fill::before{content:"\f888"}.bi-house-check::before{content:"\f889"}.bi-house-dash-fill::before{content:"\f88a"}.bi-house-dash::before{content:"\f88b"}.bi-house-down-fill::before{content:"\f88c"}.bi-house-down::before{content:"\f88d"}.bi-house-exclamation-fill::before{content:"\f88e"}.bi-house-exclamation::before{content:"\f88f"}.bi-house-gear-fill::before{content:"\f890"}.bi-house-gear::before{content:"\f891"}.bi-house-lock-fill::before{content:"\f892"}.bi-house-lock::before{content:"\f893"}.bi-house-slash-fill::before{content:"\f894"}.bi-house-slash::before{content:"\f895"}.bi-house-up-fill::before{content:"\f896"}.bi-house-up::before{content:"\f897"}.bi-house-x-fill::before{content:"\f898"}.bi-house-x::before{content:"\f899"}.bi-person-add::before{content:"\f89a"}.bi-person-down::before{content:"\f89b"}.bi-person-exclamation::before{content:"\f89c"}.bi-person-fill-add::before{content:"\f89d"}.bi-person-fill-check::before{content:"\f89e"}.bi-person-fill-dash::before{content:"\f89f"}.bi-person-fill-down::before{content:"\f8a0"}.bi-person-fill-exclamation::before{content:"\f8a1"}.bi-person-fill-gear::before{content:"\f8a2"}.bi-person-fill-lock::before{content:"\f8a3"}.bi-person-fill-slash::before{content:"\f8a4"}.bi-person-fill-up::before{content:"\f8a5"}.bi-person-fill-x::before{content:"\f8a6"}.bi-person-gear::before{content:"\f8a7"}.bi-person-lock::before{content:"\f8a8"}.bi-person-slash::before{content:"\f8a9"}.bi-person-up::before{content:"\f8aa"}.bi-scooter::before{content:"\f8ab"}.bi-taxi-front-fill::before{content:"\f8ac"}.bi-taxi-front::before{content:"\f8ad"}.bi-amd::before{content:"\f8ae"}.bi-database-add::before{content:"\f8af"}.bi-database-check::before{content:"\f8b0"}.bi-database-dash::before{content:"\f8b1"}.bi-database-down::before{content:"\f8b2"}.bi-database-exclamation::before{content:"\f8b3"}.bi-database-fill-add::before{content:"\f8b4"}.bi-database-fill-check::before{content:"\f8b5"}.bi-database-fill-dash::before{content:"\f8b6"}.bi-database-fill-down::before{content:"\f8b7"}.bi-database-fill-exclamation::before{content:"\f8b8"}.bi-database-fill-gear::before{content:"\f8b9"}.bi-database-fill-lock::before{content:"\f8ba"}.bi-database-fill-slash::before{content:"\f8bb"}.bi-database-fill-up::before{content:"\f8bc"}.bi-database-fill-x::before{content:"\f8bd"}.bi-database-fill::before{content:"\f8be"}.bi-database-gear::before{content:"\f8bf"}.bi-database-lock::before{content:"\f8c0"}.bi-database-slash::before{content:"\f8c1"}.bi-database-up::before{content:"\f8c2"}.bi-database-x::before{content:"\f8c3"}.bi-database::before{content:"\f8c4"}.bi-houses-fill::before{content:"\f8c5"}.bi-houses::before{content:"\f8c6"}.bi-nvidia::before{content:"\f8c7"}.bi-person-vcard-fill::before{content:"\f8c8"}.bi-person-vcard::before{content:"\f8c9"}.bi-sina-weibo::before{content:"\f8ca"}.bi-tencent-qq::before{content:"\f8cb"}.bi-wikipedia::before{content:"\f8cc"}.bi-alphabet-uppercase::before{content:"\f2a5"}.bi-alphabet::before{content:"\f68a"}.bi-amazon::before{content:"\f68d"}.bi-arrows-collapse-vertical::before{content:"\f690"}.bi-arrows-expand-vertical::before{content:"\f695"}.bi-arrows-vertical::before{content:"\f698"}.bi-arrows::before{content:"\f6a2"}.bi-ban-fill::before{content:"\f6a3"}.bi-ban::before{content:"\f6b6"}.bi-bing::before{content:"\f6c2"}.bi-cake::before{content:"\f6e0"}.bi-cake2::before{content:"\f6ed"}.bi-cookie::before{content:"\f6ee"}.bi-copy::before{content:"\f759"}.bi-crosshair::before{content:"\f769"}.bi-crosshair2::before{content:"\f794"}.bi-emoji-astonished-fill::before{content:"\f795"}.bi-emoji-astonished::before{content:"\f79a"}.bi-emoji-grimace-fill::before{content:"\f79b"}.bi-emoji-grimace::before{content:"\f7a0"}.bi-emoji-grin-fill::before{content:"\f7a1"}.bi-emoji-grin::before{content:"\f7a6"}.bi-emoji-surprise-fill::before{content:"\f7a7"}.bi-emoji-surprise::before{content:"\f7ac"}.bi-emoji-tear-fill::before{content:"\f7ad"}.bi-emoji-tear::before{content:"\f7b2"}.bi-envelope-arrow-down-fill::before{content:"\f7b3"}.bi-envelope-arrow-down::before{content:"\f7b8"}.bi-envelope-arrow-up-fill::before{content:"\f7b9"}.bi-envelope-arrow-up::before{content:"\f7be"}.bi-feather::before{content:"\f7bf"}.bi-feather2::before{content:"\f7c4"}.bi-floppy-fill::before{content:"\f7c5"}.bi-floppy::before{content:"\f7d8"}.bi-floppy2-fill::before{content:"\f7d9"}.bi-floppy2::before{content:"\f7e4"}.bi-gitlab::before{content:"\f7e5"}.bi-highlighter::before{content:"\f7f8"}.bi-marker-tip::before{content:"\f802"}.bi-nvme-fill::before{content:"\f803"}.bi-nvme::before{content:"\f80c"}.bi-opencollective::before{content:"\f80d"}.bi-pci-card-network::before{content:"\f8cd"}.bi-pci-card-sound::before{content:"\f8ce"}.bi-radar::before{content:"\f8cf"}.bi-send-arrow-down-fill::before{content:"\f8d0"}.bi-send-arrow-down::before{content:"\f8d1"}.bi-send-arrow-up-fill::before{content:"\f8d2"}.bi-send-arrow-up::before{content:"\f8d3"}.bi-sim-slash-fill::before{content:"\f8d4"}.bi-sim-slash::before{content:"\f8d5"}.bi-sourceforge::before{content:"\f8d6"}.bi-substack::before{content:"\f8d7"}.bi-threads-fill::before{content:"\f8d8"}.bi-threads::before{content:"\f8d9"}.bi-transparency::before{content:"\f8da"}.bi-twitter-x::before{content:"\f8db"}.bi-type-h4::before{content:"\f8dc"}.bi-type-h5::before{content:"\f8dd"}.bi-type-h6::before{content:"\f8de"}.bi-backpack-fill::before{content:"\f8df"}.bi-backpack::before{content:"\f8e0"}.bi-backpack2-fill::before{content:"\f8e1"}.bi-backpack2::before{content:"\f8e2"}.bi-backpack3-fill::before{content:"\f8e3"}.bi-backpack3::before{content:"\f8e4"}.bi-backpack4-fill::before{content:"\f8e5"}.bi-backpack4::before{content:"\f8e6"}.bi-brilliance::before{content:"\f8e7"}.bi-cake-fill::before{content:"\f8e8"}.bi-cake2-fill::before{content:"\f8e9"}.bi-duffle-fill::before{content:"\f8ea"}.bi-duffle::before{content:"\f8eb"}.bi-exposure::before{content:"\f8ec"}.bi-gender-neuter::before{content:"\f8ed"}.bi-highlights::before{content:"\f8ee"}.bi-luggage-fill::before{content:"\f8ef"}.bi-luggage::before{content:"\f8f0"}.bi-mailbox-flag::before{content:"\f8f1"}.bi-mailbox2-flag::before{content:"\f8f2"}.bi-noise-reduction::before{content:"\f8f3"}.bi-passport-fill::before{content:"\f8f4"}.bi-passport::before{content:"\f8f5"}.bi-person-arms-up::before{content:"\f8f6"}.bi-person-raised-hand::before{content:"\f8f7"}.bi-person-standing-dress::before{content:"\f8f8"}.bi-person-standing::before{content:"\f8f9"}.bi-person-walking::before{content:"\f8fa"}.bi-person-wheelchair::before{content:"\f8fb"}.bi-shadows::before{content:"\f8fc"}.bi-suitcase-fill::before{content:"\f8fd"}.bi-suitcase-lg-fill::before{content:"\f8fe"}.bi-suitcase-lg::before{content:"\f8ff"}.bi-suitcase::before{content:"\f900"}.bi-suitcase2-fill::before{content:"\f901"}.bi-suitcase2::before{content:"\f902"}.bi-vignette::before{content:"\f903"}.bi-bluesky::before{content:"\f7f9"}.bi-tux::before{content:"\f904"}.bi-beaker-fill::before{content:"\f905"}.bi-beaker::before{content:"\f906"}.bi-flask-fill::before{content:"\f907"}.bi-flask-florence-fill::before{content:"\f908"}.bi-flask-florence::before{content:"\f909"}.bi-flask::before{content:"\f90a"}.bi-leaf-fill::before{content:"\f90b"}.bi-leaf::before{content:"\f90c"}.bi-measuring-cup-fill::before{content:"\f90d"}.bi-measuring-cup::before{content:"\f90e"}.bi-unlock2-fill::before{content:"\f90f"}.bi-unlock2::before{content:"\f910"}.bi-battery-low::before{content:"\f911"}.bi-anthropic::before{content:"\f912"}.bi-apple-music::before{content:"\f913"}.bi-claude::before{content:"\f914"}.bi-openai::before{content:"\f915"}.bi-perplexity::before{content:"\f916"}.bi-css::before{content:"\f917"}.bi-javascript::before{content:"\f918"}.bi-typescript::before{content:"\f919"}.bi-fork-knife::before{content:"\f91a"}.bi-globe-americas-fill::before{content:"\f91b"}.bi-globe-asia-australia-fill::before{content:"\f91c"}.bi-globe-central-south-asia-fill::before{content:"\f91d"}.bi-globe-europe-africa-fill::before{content:"\f91e"}
\ No newline at end of file
diff --git a/weed/admin/static/css/fontawesome.min.css b/weed/admin/static/css/fontawesome.min.css
deleted file mode 100644
index 1f367c1fa5..0000000000
--- a/weed/admin/static/css/fontawesome.min.css
+++ /dev/null
@@ -1,9 +0,0 @@
-/*!
- * Font Awesome Free 6.4.0 by @fontawesome - https://fontawesome.com
- * License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License)
- * Copyright 2023 Fonticons, Inc.
- */
-.fa{font-family:var(--fa-style-family,"Font Awesome 6 Free");font-weight:var(--fa-style,900)}.fa,.fa-brands,.fa-classic,.fa-regular,.fa-sharp,.fa-solid,.fab,.far,.fas{-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased;display:var(--fa-display,inline-block);font-style:normal;font-variant:normal;line-height:1;text-rendering:auto}.fa-classic,.fa-regular,.fa-solid,.far,.fas{font-family:"Font Awesome 6 Free"}.fa-brands,.fab{font-family:"Font Awesome 6 Brands"}.fa-1x{font-size:1em}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-6x{font-size:6em}.fa-7x{font-size:7em}.fa-8x{font-size:8em}.fa-9x{font-size:9em}.fa-10x{font-size:10em}.fa-2xs{font-size:.625em;line-height:.1em;vertical-align:.225em}.fa-xs{font-size:.75em;line-height:.08333em;vertical-align:.125em}.fa-sm{font-size:.875em;line-height:.07143em;vertical-align:.05357em}.fa-lg{font-size:1.25em;line-height:.05em;vertical-align:-.075em}.fa-xl{font-size:1.5em;line-height:.04167em;vertical-align:-.125em}.fa-2xl{font-size:2em;line-height:.03125em;vertical-align:-.1875em}.fa-fw{text-align:center;width:1.25em}.fa-ul{list-style-type:none;margin-left:var(--fa-li-margin,2.5em);padding-left:0}.fa-ul>li{position:relative}.fa-li{left:calc(var(--fa-li-width, 2em)*-1);position:absolute;text-align:center;width:var(--fa-li-width,2em);line-height:inherit}.fa-border{border-radius:var(--fa-border-radius,.1em);border:var(--fa-border-width,.08em) var(--fa-border-style,solid) var(--fa-border-color,#eee);padding:var(--fa-border-padding,.2em .25em .15em)}.fa-pull-left{float:left;margin-right:var(--fa-pull-margin,.3em)}.fa-pull-right{float:right;margin-left:var(--fa-pull-margin,.3em)}.fa-beat{-webkit-animation-name:fa-beat;animation-name:fa-beat;-webkit-animation-delay:var(--fa-animation-delay,0s);animation-delay:var(--fa-animation-delay,0s);-webkit-animation-direction:var(--fa-animation-direction,normal);animation-direction:var(--fa-animation-direction,normal);-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s);-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,ease-in-out);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-bounce{-webkit-animation-name:fa-bounce;animation-name:fa-bounce;-webkit-animation-delay:var(--fa-animation-delay,0s);animation-delay:var(--fa-animation-delay,0s);-webkit-animation-direction:var(--fa-animation-direction,normal);animation-direction:var(--fa-animation-direction,normal);-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s);-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,cubic-bezier(.28,.84,.42,1));animation-timing-function:var(--fa-animation-timing,cubic-bezier(.28,.84,.42,1))}.fa-fade{-webkit-animation-name:fa-fade;animation-name:fa-fade;-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,cubic-bezier(.4,0,.6,1));animation-timing-function:var(--fa-animation-timing,cubic-bezier(.4,0,.6,1))}.fa-beat-fade,.fa-fade{-webkit-animation-delay:var(--fa-animation-delay,0s);animation-delay:var(--fa-animation-delay,0s);-webkit-animation-direction:var(--fa-animation-direction,normal);animation-direction:var(--fa-animation-direction,normal);-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s)}.fa-beat-fade{-webkit-animation-name:fa-beat-fade;animation-name:fa-beat-fade;-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,cubic-bezier(.4,0,.6,1));animation-timing-function:var(--fa-animation-timing,cubic-bezier(.4,0,.6,1))}.fa-flip{-webkit-animation-name:fa-flip;animation-name:fa-flip;-webkit-animation-delay:var(--fa-animation-delay,0s);animation-delay:var(--fa-animation-delay,0s);-webkit-animation-direction:var(--fa-animation-direction,normal);animation-direction:var(--fa-animation-direction,normal);-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s);-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,ease-in-out);animation-timing-function:var(--fa-animation-timing,ease-in-out)}.fa-shake{-webkit-animation-name:fa-shake;animation-name:fa-shake;-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s);-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,linear);animation-timing-function:var(--fa-animation-timing,linear)}.fa-shake,.fa-spin{-webkit-animation-delay:var(--fa-animation-delay,0s);animation-delay:var(--fa-animation-delay,0s);-webkit-animation-direction:var(--fa-animation-direction,normal);animation-direction:var(--fa-animation-direction,normal)}.fa-spin{-webkit-animation-name:fa-spin;animation-name:fa-spin;-webkit-animation-duration:var(--fa-animation-duration,2s);animation-duration:var(--fa-animation-duration,2s);-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,linear);animation-timing-function:var(--fa-animation-timing,linear)}.fa-spin-reverse{--fa-animation-direction:reverse}.fa-pulse,.fa-spin-pulse{-webkit-animation-name:fa-spin;animation-name:fa-spin;-webkit-animation-direction:var(--fa-animation-direction,normal);animation-direction:var(--fa-animation-direction,normal);-webkit-animation-duration:var(--fa-animation-duration,1s);animation-duration:var(--fa-animation-duration,1s);-webkit-animation-iteration-count:var(--fa-animation-iteration-count,infinite);animation-iteration-count:var(--fa-animation-iteration-count,infinite);-webkit-animation-timing-function:var(--fa-animation-timing,steps(8));animation-timing-function:var(--fa-animation-timing,steps(8))}@media (prefers-reduced-motion:reduce){.fa-beat,.fa-beat-fade,.fa-bounce,.fa-fade,.fa-flip,.fa-pulse,.fa-shake,.fa-spin,.fa-spin-pulse{-webkit-animation-delay:-1ms;animation-delay:-1ms;-webkit-animation-duration:1ms;animation-duration:1ms;-webkit-animation-iteration-count:1;animation-iteration-count:1;-webkit-transition-delay:0s;transition-delay:0s;-webkit-transition-duration:0s;transition-duration:0s}}@-webkit-keyframes fa-beat{0%,90%{-webkit-transform:scale(1);transform:scale(1)}45%{-webkit-transform:scale(var(--fa-beat-scale,1.25));transform:scale(var(--fa-beat-scale,1.25))}}@keyframes fa-beat{0%,90%{-webkit-transform:scale(1);transform:scale(1)}45%{-webkit-transform:scale(var(--fa-beat-scale,1.25));transform:scale(var(--fa-beat-scale,1.25))}}@-webkit-keyframes fa-bounce{0%{-webkit-transform:scale(1) translateY(0);transform:scale(1) translateY(0)}10%{-webkit-transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0);transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0)}30%{-webkit-transform:scale(var(--fa-bounce-jump-scale-x,.9),var(--fa-bounce-jump-scale-y,1.1)) translateY(var(--fa-bounce-height,-.5em));transform:scale(var(--fa-bounce-jump-scale-x,.9),var(--fa-bounce-jump-scale-y,1.1)) translateY(var(--fa-bounce-height,-.5em))}50%{-webkit-transform:scale(var(--fa-bounce-land-scale-x,1.05),var(--fa-bounce-land-scale-y,.95)) translateY(0);transform:scale(var(--fa-bounce-land-scale-x,1.05),var(--fa-bounce-land-scale-y,.95)) translateY(0)}57%{-webkit-transform:scale(1) translateY(var(--fa-bounce-rebound,-.125em));transform:scale(1) translateY(var(--fa-bounce-rebound,-.125em))}64%{-webkit-transform:scale(1) translateY(0);transform:scale(1) translateY(0)}to{-webkit-transform:scale(1) translateY(0);transform:scale(1) translateY(0)}}@keyframes fa-bounce{0%{-webkit-transform:scale(1) translateY(0);transform:scale(1) translateY(0)}10%{-webkit-transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0);transform:scale(var(--fa-bounce-start-scale-x,1.1),var(--fa-bounce-start-scale-y,.9)) translateY(0)}30%{-webkit-transform:scale(var(--fa-bounce-jump-scale-x,.9),var(--fa-bounce-jump-scale-y,1.1)) translateY(var(--fa-bounce-height,-.5em));transform:scale(var(--fa-bounce-jump-scale-x,.9),var(--fa-bounce-jump-scale-y,1.1)) translateY(var(--fa-bounce-height,-.5em))}50%{-webkit-transform:scale(var(--fa-bounce-land-scale-x,1.05),var(--fa-bounce-land-scale-y,.95)) translateY(0);transform:scale(var(--fa-bounce-land-scale-x,1.05),var(--fa-bounce-land-scale-y,.95)) translateY(0)}57%{-webkit-transform:scale(1) translateY(var(--fa-bounce-rebound,-.125em));transform:scale(1) translateY(var(--fa-bounce-rebound,-.125em))}64%{-webkit-transform:scale(1) translateY(0);transform:scale(1) translateY(0)}to{-webkit-transform:scale(1) translateY(0);transform:scale(1) translateY(0)}}@-webkit-keyframes fa-fade{50%{opacity:var(--fa-fade-opacity,.4)}}@keyframes fa-fade{50%{opacity:var(--fa-fade-opacity,.4)}}@-webkit-keyframes fa-beat-fade{0%,to{opacity:var(--fa-beat-fade-opacity,.4);-webkit-transform:scale(1);transform:scale(1)}50%{opacity:1;-webkit-transform:scale(var(--fa-beat-fade-scale,1.125));transform:scale(var(--fa-beat-fade-scale,1.125))}}@keyframes fa-beat-fade{0%,to{opacity:var(--fa-beat-fade-opacity,.4);-webkit-transform:scale(1);transform:scale(1)}50%{opacity:1;-webkit-transform:scale(var(--fa-beat-fade-scale,1.125));transform:scale(var(--fa-beat-fade-scale,1.125))}}@-webkit-keyframes fa-flip{50%{-webkit-transform:rotate3d(var(--fa-flip-x,0),var(--fa-flip-y,1),var(--fa-flip-z,0),var(--fa-flip-angle,-180deg));transform:rotate3d(var(--fa-flip-x,0),var(--fa-flip-y,1),var(--fa-flip-z,0),var(--fa-flip-angle,-180deg))}}@keyframes fa-flip{50%{-webkit-transform:rotate3d(var(--fa-flip-x,0),var(--fa-flip-y,1),var(--fa-flip-z,0),var(--fa-flip-angle,-180deg));transform:rotate3d(var(--fa-flip-x,0),var(--fa-flip-y,1),var(--fa-flip-z,0),var(--fa-flip-angle,-180deg))}}@-webkit-keyframes fa-shake{0%{-webkit-transform:rotate(-15deg);transform:rotate(-15deg)}4%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}8%,24%{-webkit-transform:rotate(-18deg);transform:rotate(-18deg)}12%,28%{-webkit-transform:rotate(18deg);transform:rotate(18deg)}16%{-webkit-transform:rotate(-22deg);transform:rotate(-22deg)}20%{-webkit-transform:rotate(22deg);transform:rotate(22deg)}32%{-webkit-transform:rotate(-12deg);transform:rotate(-12deg)}36%{-webkit-transform:rotate(12deg);transform:rotate(12deg)}40%,to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes fa-shake{0%{-webkit-transform:rotate(-15deg);transform:rotate(-15deg)}4%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}8%,24%{-webkit-transform:rotate(-18deg);transform:rotate(-18deg)}12%,28%{-webkit-transform:rotate(18deg);transform:rotate(18deg)}16%{-webkit-transform:rotate(-22deg);transform:rotate(-22deg)}20%{-webkit-transform:rotate(22deg);transform:rotate(22deg)}32%{-webkit-transform:rotate(-12deg);transform:rotate(-12deg)}36%{-webkit-transform:rotate(12deg);transform:rotate(12deg)}40%,to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}.fa-rotate-90{-webkit-transform:rotate(90deg);transform:rotate(90deg)}.fa-rotate-180{-webkit-transform:rotate(180deg);transform:rotate(180deg)}.fa-rotate-270{-webkit-transform:rotate(270deg);transform:rotate(270deg)}.fa-flip-horizontal{-webkit-transform:scaleX(-1);transform:scaleX(-1)}.fa-flip-vertical{-webkit-transform:scaleY(-1);transform:scaleY(-1)}.fa-flip-both,.fa-flip-horizontal.fa-flip-vertical{-webkit-transform:scale(-1);transform:scale(-1)}.fa-rotate-by{-webkit-transform:rotate(var(--fa-rotate-angle,none));transform:rotate(var(--fa-rotate-angle,none))}.fa-stack{display:inline-block;height:2em;line-height:2em;position:relative;vertical-align:middle;width:2.5em}.fa-stack-1x,.fa-stack-2x{left:0;position:absolute;text-align:center;width:100%;z-index:var(--fa-stack-z-index,auto)}.fa-stack-1x{line-height:inherit}.fa-stack-2x{font-size:2em}.fa-inverse{color:var(--fa-inverse,#fff)}
-
-.fa-0:before{content:"\30"}.fa-1:before{content:"\31"}.fa-2:before{content:"\32"}.fa-3:before{content:"\33"}.fa-4:before{content:"\34"}.fa-5:before{content:"\35"}.fa-6:before{content:"\36"}.fa-7:before{content:"\37"}.fa-8:before{content:"\38"}.fa-9:before{content:"\39"}.fa-fill-drip:before{content:"\f576"}.fa-arrows-to-circle:before{content:"\e4bd"}.fa-chevron-circle-right:before,.fa-circle-chevron-right:before{content:"\f138"}.fa-at:before{content:"\40"}.fa-trash-alt:before,.fa-trash-can:before{content:"\f2ed"}.fa-text-height:before{content:"\f034"}.fa-user-times:before,.fa-user-xmark:before{content:"\f235"}.fa-stethoscope:before{content:"\f0f1"}.fa-comment-alt:before,.fa-message:before{content:"\f27a"}.fa-info:before{content:"\f129"}.fa-compress-alt:before,.fa-down-left-and-up-right-to-center:before{content:"\f422"}.fa-explosion:before{content:"\e4e9"}.fa-file-alt:before,.fa-file-lines:before,.fa-file-text:before{content:"\f15c"}.fa-wave-square:before{content:"\f83e"}.fa-ring:before{content:"\f70b"}.fa-building-un:before{content:"\e4d9"}.fa-dice-three:before{content:"\f527"}.fa-calendar-alt:before,.fa-calendar-days:before{content:"\f073"}.fa-anchor-circle-check:before{content:"\e4aa"}.fa-building-circle-arrow-right:before{content:"\e4d1"}.fa-volleyball-ball:before,.fa-volleyball:before{content:"\f45f"}.fa-arrows-up-to-line:before{content:"\e4c2"}.fa-sort-desc:before,.fa-sort-down:before{content:"\f0dd"}.fa-circle-minus:before,.fa-minus-circle:before{content:"\f056"}.fa-door-open:before{content:"\f52b"}.fa-right-from-bracket:before,.fa-sign-out-alt:before{content:"\f2f5"}.fa-atom:before{content:"\f5d2"}.fa-soap:before{content:"\e06e"}.fa-heart-music-camera-bolt:before,.fa-icons:before{content:"\f86d"}.fa-microphone-alt-slash:before,.fa-microphone-lines-slash:before{content:"\f539"}.fa-bridge-circle-check:before{content:"\e4c9"}.fa-pump-medical:before{content:"\e06a"}.fa-fingerprint:before{content:"\f577"}.fa-hand-point-right:before{content:"\f0a4"}.fa-magnifying-glass-location:before,.fa-search-location:before{content:"\f689"}.fa-forward-step:before,.fa-step-forward:before{content:"\f051"}.fa-face-smile-beam:before,.fa-smile-beam:before{content:"\f5b8"}.fa-flag-checkered:before{content:"\f11e"}.fa-football-ball:before,.fa-football:before{content:"\f44e"}.fa-school-circle-exclamation:before{content:"\e56c"}.fa-crop:before{content:"\f125"}.fa-angle-double-down:before,.fa-angles-down:before{content:"\f103"}.fa-users-rectangle:before{content:"\e594"}.fa-people-roof:before{content:"\e537"}.fa-people-line:before{content:"\e534"}.fa-beer-mug-empty:before,.fa-beer:before{content:"\f0fc"}.fa-diagram-predecessor:before{content:"\e477"}.fa-arrow-up-long:before,.fa-long-arrow-up:before{content:"\f176"}.fa-burn:before,.fa-fire-flame-simple:before{content:"\f46a"}.fa-male:before,.fa-person:before{content:"\f183"}.fa-laptop:before{content:"\f109"}.fa-file-csv:before{content:"\f6dd"}.fa-menorah:before{content:"\f676"}.fa-truck-plane:before{content:"\e58f"}.fa-record-vinyl:before{content:"\f8d9"}.fa-face-grin-stars:before,.fa-grin-stars:before{content:"\f587"}.fa-bong:before{content:"\f55c"}.fa-pastafarianism:before,.fa-spaghetti-monster-flying:before{content:"\f67b"}.fa-arrow-down-up-across-line:before{content:"\e4af"}.fa-spoon:before,.fa-utensil-spoon:before{content:"\f2e5"}.fa-jar-wheat:before{content:"\e517"}.fa-envelopes-bulk:before,.fa-mail-bulk:before{content:"\f674"}.fa-file-circle-exclamation:before{content:"\e4eb"}.fa-circle-h:before,.fa-hospital-symbol:before{content:"\f47e"}.fa-pager:before{content:"\f815"}.fa-address-book:before,.fa-contact-book:before{content:"\f2b9"}.fa-strikethrough:before{content:"\f0cc"}.fa-k:before{content:"\4b"}.fa-landmark-flag:before{content:"\e51c"}.fa-pencil-alt:before,.fa-pencil:before{content:"\f303"}.fa-backward:before{content:"\f04a"}.fa-caret-right:before{content:"\f0da"}.fa-comments:before{content:"\f086"}.fa-file-clipboard:before,.fa-paste:before{content:"\f0ea"}.fa-code-pull-request:before{content:"\e13c"}.fa-clipboard-list:before{content:"\f46d"}.fa-truck-loading:before,.fa-truck-ramp-box:before{content:"\f4de"}.fa-user-check:before{content:"\f4fc"}.fa-vial-virus:before{content:"\e597"}.fa-sheet-plastic:before{content:"\e571"}.fa-blog:before{content:"\f781"}.fa-user-ninja:before{content:"\f504"}.fa-person-arrow-up-from-line:before{content:"\e539"}.fa-scroll-torah:before,.fa-torah:before{content:"\f6a0"}.fa-broom-ball:before,.fa-quidditch-broom-ball:before,.fa-quidditch:before{content:"\f458"}.fa-toggle-off:before{content:"\f204"}.fa-archive:before,.fa-box-archive:before{content:"\f187"}.fa-person-drowning:before{content:"\e545"}.fa-arrow-down-9-1:before,.fa-sort-numeric-desc:before,.fa-sort-numeric-down-alt:before{content:"\f886"}.fa-face-grin-tongue-squint:before,.fa-grin-tongue-squint:before{content:"\f58a"}.fa-spray-can:before{content:"\f5bd"}.fa-truck-monster:before{content:"\f63b"}.fa-w:before{content:"\57"}.fa-earth-africa:before,.fa-globe-africa:before{content:"\f57c"}.fa-rainbow:before{content:"\f75b"}.fa-circle-notch:before{content:"\f1ce"}.fa-tablet-alt:before,.fa-tablet-screen-button:before{content:"\f3fa"}.fa-paw:before{content:"\f1b0"}.fa-cloud:before{content:"\f0c2"}.fa-trowel-bricks:before{content:"\e58a"}.fa-face-flushed:before,.fa-flushed:before{content:"\f579"}.fa-hospital-user:before{content:"\f80d"}.fa-tent-arrow-left-right:before{content:"\e57f"}.fa-gavel:before,.fa-legal:before{content:"\f0e3"}.fa-binoculars:before{content:"\f1e5"}.fa-microphone-slash:before{content:"\f131"}.fa-box-tissue:before{content:"\e05b"}.fa-motorcycle:before{content:"\f21c"}.fa-bell-concierge:before,.fa-concierge-bell:before{content:"\f562"}.fa-pen-ruler:before,.fa-pencil-ruler:before{content:"\f5ae"}.fa-people-arrows-left-right:before,.fa-people-arrows:before{content:"\e068"}.fa-mars-and-venus-burst:before{content:"\e523"}.fa-caret-square-right:before,.fa-square-caret-right:before{content:"\f152"}.fa-cut:before,.fa-scissors:before{content:"\f0c4"}.fa-sun-plant-wilt:before{content:"\e57a"}.fa-toilets-portable:before{content:"\e584"}.fa-hockey-puck:before{content:"\f453"}.fa-table:before{content:"\f0ce"}.fa-magnifying-glass-arrow-right:before{content:"\e521"}.fa-digital-tachograph:before,.fa-tachograph-digital:before{content:"\f566"}.fa-users-slash:before{content:"\e073"}.fa-clover:before{content:"\e139"}.fa-mail-reply:before,.fa-reply:before{content:"\f3e5"}.fa-star-and-crescent:before{content:"\f699"}.fa-house-fire:before{content:"\e50c"}.fa-minus-square:before,.fa-square-minus:before{content:"\f146"}.fa-helicopter:before{content:"\f533"}.fa-compass:before{content:"\f14e"}.fa-caret-square-down:before,.fa-square-caret-down:before{content:"\f150"}.fa-file-circle-question:before{content:"\e4ef"}.fa-laptop-code:before{content:"\f5fc"}.fa-swatchbook:before{content:"\f5c3"}.fa-prescription-bottle:before{content:"\f485"}.fa-bars:before,.fa-navicon:before{content:"\f0c9"}.fa-people-group:before{content:"\e533"}.fa-hourglass-3:before,.fa-hourglass-end:before{content:"\f253"}.fa-heart-broken:before,.fa-heart-crack:before{content:"\f7a9"}.fa-external-link-square-alt:before,.fa-square-up-right:before{content:"\f360"}.fa-face-kiss-beam:before,.fa-kiss-beam:before{content:"\f597"}.fa-film:before{content:"\f008"}.fa-ruler-horizontal:before{content:"\f547"}.fa-people-robbery:before{content:"\e536"}.fa-lightbulb:before{content:"\f0eb"}.fa-caret-left:before{content:"\f0d9"}.fa-circle-exclamation:before,.fa-exclamation-circle:before{content:"\f06a"}.fa-school-circle-xmark:before{content:"\e56d"}.fa-arrow-right-from-bracket:before,.fa-sign-out:before{content:"\f08b"}.fa-chevron-circle-down:before,.fa-circle-chevron-down:before{content:"\f13a"}.fa-unlock-alt:before,.fa-unlock-keyhole:before{content:"\f13e"}.fa-cloud-showers-heavy:before{content:"\f740"}.fa-headphones-alt:before,.fa-headphones-simple:before{content:"\f58f"}.fa-sitemap:before{content:"\f0e8"}.fa-circle-dollar-to-slot:before,.fa-donate:before{content:"\f4b9"}.fa-memory:before{content:"\f538"}.fa-road-spikes:before{content:"\e568"}.fa-fire-burner:before{content:"\e4f1"}.fa-flag:before{content:"\f024"}.fa-hanukiah:before{content:"\f6e6"}.fa-feather:before{content:"\f52d"}.fa-volume-down:before,.fa-volume-low:before{content:"\f027"}.fa-comment-slash:before{content:"\f4b3"}.fa-cloud-sun-rain:before{content:"\f743"}.fa-compress:before{content:"\f066"}.fa-wheat-alt:before,.fa-wheat-awn:before{content:"\e2cd"}.fa-ankh:before{content:"\f644"}.fa-hands-holding-child:before{content:"\e4fa"}.fa-asterisk:before{content:"\2a"}.fa-check-square:before,.fa-square-check:before{content:"\f14a"}.fa-peseta-sign:before{content:"\e221"}.fa-header:before,.fa-heading:before{content:"\f1dc"}.fa-ghost:before{content:"\f6e2"}.fa-list-squares:before,.fa-list:before{content:"\f03a"}.fa-phone-square-alt:before,.fa-square-phone-flip:before{content:"\f87b"}.fa-cart-plus:before{content:"\f217"}.fa-gamepad:before{content:"\f11b"}.fa-circle-dot:before,.fa-dot-circle:before{content:"\f192"}.fa-dizzy:before,.fa-face-dizzy:before{content:"\f567"}.fa-egg:before{content:"\f7fb"}.fa-house-medical-circle-xmark:before{content:"\e513"}.fa-campground:before{content:"\f6bb"}.fa-folder-plus:before{content:"\f65e"}.fa-futbol-ball:before,.fa-futbol:before,.fa-soccer-ball:before{content:"\f1e3"}.fa-paint-brush:before,.fa-paintbrush:before{content:"\f1fc"}.fa-lock:before{content:"\f023"}.fa-gas-pump:before{content:"\f52f"}.fa-hot-tub-person:before,.fa-hot-tub:before{content:"\f593"}.fa-map-location:before,.fa-map-marked:before{content:"\f59f"}.fa-house-flood-water:before{content:"\e50e"}.fa-tree:before{content:"\f1bb"}.fa-bridge-lock:before{content:"\e4cc"}.fa-sack-dollar:before{content:"\f81d"}.fa-edit:before,.fa-pen-to-square:before{content:"\f044"}.fa-car-side:before{content:"\f5e4"}.fa-share-alt:before,.fa-share-nodes:before{content:"\f1e0"}.fa-heart-circle-minus:before{content:"\e4ff"}.fa-hourglass-2:before,.fa-hourglass-half:before{content:"\f252"}.fa-microscope:before{content:"\f610"}.fa-sink:before{content:"\e06d"}.fa-bag-shopping:before,.fa-shopping-bag:before{content:"\f290"}.fa-arrow-down-z-a:before,.fa-sort-alpha-desc:before,.fa-sort-alpha-down-alt:before{content:"\f881"}.fa-mitten:before{content:"\f7b5"}.fa-person-rays:before{content:"\e54d"}.fa-users:before{content:"\f0c0"}.fa-eye-slash:before{content:"\f070"}.fa-flask-vial:before{content:"\e4f3"}.fa-hand-paper:before,.fa-hand:before{content:"\f256"}.fa-om:before{content:"\f679"}.fa-worm:before{content:"\e599"}.fa-house-circle-xmark:before{content:"\e50b"}.fa-plug:before{content:"\f1e6"}.fa-chevron-up:before{content:"\f077"}.fa-hand-spock:before{content:"\f259"}.fa-stopwatch:before{content:"\f2f2"}.fa-face-kiss:before,.fa-kiss:before{content:"\f596"}.fa-bridge-circle-xmark:before{content:"\e4cb"}.fa-face-grin-tongue:before,.fa-grin-tongue:before{content:"\f589"}.fa-chess-bishop:before{content:"\f43a"}.fa-face-grin-wink:before,.fa-grin-wink:before{content:"\f58c"}.fa-deaf:before,.fa-deafness:before,.fa-ear-deaf:before,.fa-hard-of-hearing:before{content:"\f2a4"}.fa-road-circle-check:before{content:"\e564"}.fa-dice-five:before{content:"\f523"}.fa-rss-square:before,.fa-square-rss:before{content:"\f143"}.fa-land-mine-on:before{content:"\e51b"}.fa-i-cursor:before{content:"\f246"}.fa-stamp:before{content:"\f5bf"}.fa-stairs:before{content:"\e289"}.fa-i:before{content:"\49"}.fa-hryvnia-sign:before,.fa-hryvnia:before{content:"\f6f2"}.fa-pills:before{content:"\f484"}.fa-face-grin-wide:before,.fa-grin-alt:before{content:"\f581"}.fa-tooth:before{content:"\f5c9"}.fa-v:before{content:"\56"}.fa-bangladeshi-taka-sign:before{content:"\e2e6"}.fa-bicycle:before{content:"\f206"}.fa-rod-asclepius:before,.fa-rod-snake:before,.fa-staff-aesculapius:before,.fa-staff-snake:before{content:"\e579"}.fa-head-side-cough-slash:before{content:"\e062"}.fa-ambulance:before,.fa-truck-medical:before{content:"\f0f9"}.fa-wheat-awn-circle-exclamation:before{content:"\e598"}.fa-snowman:before{content:"\f7d0"}.fa-mortar-pestle:before{content:"\f5a7"}.fa-road-barrier:before{content:"\e562"}.fa-school:before{content:"\f549"}.fa-igloo:before{content:"\f7ae"}.fa-joint:before{content:"\f595"}.fa-angle-right:before{content:"\f105"}.fa-horse:before{content:"\f6f0"}.fa-q:before{content:"\51"}.fa-g:before{content:"\47"}.fa-notes-medical:before{content:"\f481"}.fa-temperature-2:before,.fa-temperature-half:before,.fa-thermometer-2:before,.fa-thermometer-half:before{content:"\f2c9"}.fa-dong-sign:before{content:"\e169"}.fa-capsules:before{content:"\f46b"}.fa-poo-bolt:before,.fa-poo-storm:before{content:"\f75a"}.fa-face-frown-open:before,.fa-frown-open:before{content:"\f57a"}.fa-hand-point-up:before{content:"\f0a6"}.fa-money-bill:before{content:"\f0d6"}.fa-bookmark:before{content:"\f02e"}.fa-align-justify:before{content:"\f039"}.fa-umbrella-beach:before{content:"\f5ca"}.fa-helmet-un:before{content:"\e503"}.fa-bullseye:before{content:"\f140"}.fa-bacon:before{content:"\f7e5"}.fa-hand-point-down:before{content:"\f0a7"}.fa-arrow-up-from-bracket:before{content:"\e09a"}.fa-folder-blank:before,.fa-folder:before{content:"\f07b"}.fa-file-medical-alt:before,.fa-file-waveform:before{content:"\f478"}.fa-radiation:before{content:"\f7b9"}.fa-chart-simple:before{content:"\e473"}.fa-mars-stroke:before{content:"\f229"}.fa-vial:before{content:"\f492"}.fa-dashboard:before,.fa-gauge-med:before,.fa-gauge:before,.fa-tachometer-alt-average:before{content:"\f624"}.fa-magic-wand-sparkles:before,.fa-wand-magic-sparkles:before{content:"\e2ca"}.fa-e:before{content:"\45"}.fa-pen-alt:before,.fa-pen-clip:before{content:"\f305"}.fa-bridge-circle-exclamation:before{content:"\e4ca"}.fa-user:before{content:"\f007"}.fa-school-circle-check:before{content:"\e56b"}.fa-dumpster:before{content:"\f793"}.fa-shuttle-van:before,.fa-van-shuttle:before{content:"\f5b6"}.fa-building-user:before{content:"\e4da"}.fa-caret-square-left:before,.fa-square-caret-left:before{content:"\f191"}.fa-highlighter:before{content:"\f591"}.fa-key:before{content:"\f084"}.fa-bullhorn:before{content:"\f0a1"}.fa-globe:before{content:"\f0ac"}.fa-synagogue:before{content:"\f69b"}.fa-person-half-dress:before{content:"\e548"}.fa-road-bridge:before{content:"\e563"}.fa-location-arrow:before{content:"\f124"}.fa-c:before{content:"\43"}.fa-tablet-button:before{content:"\f10a"}.fa-building-lock:before{content:"\e4d6"}.fa-pizza-slice:before{content:"\f818"}.fa-money-bill-wave:before{content:"\f53a"}.fa-area-chart:before,.fa-chart-area:before{content:"\f1fe"}.fa-house-flag:before{content:"\e50d"}.fa-person-circle-minus:before{content:"\e540"}.fa-ban:before,.fa-cancel:before{content:"\f05e"}.fa-camera-rotate:before{content:"\e0d8"}.fa-air-freshener:before,.fa-spray-can-sparkles:before{content:"\f5d0"}.fa-star:before{content:"\f005"}.fa-repeat:before{content:"\f363"}.fa-cross:before{content:"\f654"}.fa-box:before{content:"\f466"}.fa-venus-mars:before{content:"\f228"}.fa-arrow-pointer:before,.fa-mouse-pointer:before{content:"\f245"}.fa-expand-arrows-alt:before,.fa-maximize:before{content:"\f31e"}.fa-charging-station:before{content:"\f5e7"}.fa-shapes:before,.fa-triangle-circle-square:before{content:"\f61f"}.fa-random:before,.fa-shuffle:before{content:"\f074"}.fa-person-running:before,.fa-running:before{content:"\f70c"}.fa-mobile-retro:before{content:"\e527"}.fa-grip-lines-vertical:before{content:"\f7a5"}.fa-spider:before{content:"\f717"}.fa-hands-bound:before{content:"\e4f9"}.fa-file-invoice-dollar:before{content:"\f571"}.fa-plane-circle-exclamation:before{content:"\e556"}.fa-x-ray:before{content:"\f497"}.fa-spell-check:before{content:"\f891"}.fa-slash:before{content:"\f715"}.fa-computer-mouse:before,.fa-mouse:before{content:"\f8cc"}.fa-arrow-right-to-bracket:before,.fa-sign-in:before{content:"\f090"}.fa-shop-slash:before,.fa-store-alt-slash:before{content:"\e070"}.fa-server:before{content:"\f233"}.fa-virus-covid-slash:before{content:"\e4a9"}.fa-shop-lock:before{content:"\e4a5"}.fa-hourglass-1:before,.fa-hourglass-start:before{content:"\f251"}.fa-blender-phone:before{content:"\f6b6"}.fa-building-wheat:before{content:"\e4db"}.fa-person-breastfeeding:before{content:"\e53a"}.fa-right-to-bracket:before,.fa-sign-in-alt:before{content:"\f2f6"}.fa-venus:before{content:"\f221"}.fa-passport:before{content:"\f5ab"}.fa-heart-pulse:before,.fa-heartbeat:before{content:"\f21e"}.fa-people-carry-box:before,.fa-people-carry:before{content:"\f4ce"}.fa-temperature-high:before{content:"\f769"}.fa-microchip:before{content:"\f2db"}.fa-crown:before{content:"\f521"}.fa-weight-hanging:before{content:"\f5cd"}.fa-xmarks-lines:before{content:"\e59a"}.fa-file-prescription:before{content:"\f572"}.fa-weight-scale:before,.fa-weight:before{content:"\f496"}.fa-user-friends:before,.fa-user-group:before{content:"\f500"}.fa-arrow-up-a-z:before,.fa-sort-alpha-up:before{content:"\f15e"}.fa-chess-knight:before{content:"\f441"}.fa-face-laugh-squint:before,.fa-laugh-squint:before{content:"\f59b"}.fa-wheelchair:before{content:"\f193"}.fa-arrow-circle-up:before,.fa-circle-arrow-up:before{content:"\f0aa"}.fa-toggle-on:before{content:"\f205"}.fa-person-walking:before,.fa-walking:before{content:"\f554"}.fa-l:before{content:"\4c"}.fa-fire:before{content:"\f06d"}.fa-bed-pulse:before,.fa-procedures:before{content:"\f487"}.fa-shuttle-space:before,.fa-space-shuttle:before{content:"\f197"}.fa-face-laugh:before,.fa-laugh:before{content:"\f599"}.fa-folder-open:before{content:"\f07c"}.fa-heart-circle-plus:before{content:"\e500"}.fa-code-fork:before{content:"\e13b"}.fa-city:before{content:"\f64f"}.fa-microphone-alt:before,.fa-microphone-lines:before{content:"\f3c9"}.fa-pepper-hot:before{content:"\f816"}.fa-unlock:before{content:"\f09c"}.fa-colon-sign:before{content:"\e140"}.fa-headset:before{content:"\f590"}.fa-store-slash:before{content:"\e071"}.fa-road-circle-xmark:before{content:"\e566"}.fa-user-minus:before{content:"\f503"}.fa-mars-stroke-up:before,.fa-mars-stroke-v:before{content:"\f22a"}.fa-champagne-glasses:before,.fa-glass-cheers:before{content:"\f79f"}.fa-clipboard:before{content:"\f328"}.fa-house-circle-exclamation:before{content:"\e50a"}.fa-file-arrow-up:before,.fa-file-upload:before{content:"\f574"}.fa-wifi-3:before,.fa-wifi-strong:before,.fa-wifi:before{content:"\f1eb"}.fa-bath:before,.fa-bathtub:before{content:"\f2cd"}.fa-underline:before{content:"\f0cd"}.fa-user-edit:before,.fa-user-pen:before{content:"\f4ff"}.fa-signature:before{content:"\f5b7"}.fa-stroopwafel:before{content:"\f551"}.fa-bold:before{content:"\f032"}.fa-anchor-lock:before{content:"\e4ad"}.fa-building-ngo:before{content:"\e4d7"}.fa-manat-sign:before{content:"\e1d5"}.fa-not-equal:before{content:"\f53e"}.fa-border-style:before,.fa-border-top-left:before{content:"\f853"}.fa-map-location-dot:before,.fa-map-marked-alt:before{content:"\f5a0"}.fa-jedi:before{content:"\f669"}.fa-poll:before,.fa-square-poll-vertical:before{content:"\f681"}.fa-mug-hot:before{content:"\f7b6"}.fa-battery-car:before,.fa-car-battery:before{content:"\f5df"}.fa-gift:before{content:"\f06b"}.fa-dice-two:before{content:"\f528"}.fa-chess-queen:before{content:"\f445"}.fa-glasses:before{content:"\f530"}.fa-chess-board:before{content:"\f43c"}.fa-building-circle-check:before{content:"\e4d2"}.fa-person-chalkboard:before{content:"\e53d"}.fa-mars-stroke-h:before,.fa-mars-stroke-right:before{content:"\f22b"}.fa-hand-back-fist:before,.fa-hand-rock:before{content:"\f255"}.fa-caret-square-up:before,.fa-square-caret-up:before{content:"\f151"}.fa-cloud-showers-water:before{content:"\e4e4"}.fa-bar-chart:before,.fa-chart-bar:before{content:"\f080"}.fa-hands-bubbles:before,.fa-hands-wash:before{content:"\e05e"}.fa-less-than-equal:before{content:"\f537"}.fa-train:before{content:"\f238"}.fa-eye-low-vision:before,.fa-low-vision:before{content:"\f2a8"}.fa-crow:before{content:"\f520"}.fa-sailboat:before{content:"\e445"}.fa-window-restore:before{content:"\f2d2"}.fa-plus-square:before,.fa-square-plus:before{content:"\f0fe"}.fa-torii-gate:before{content:"\f6a1"}.fa-frog:before{content:"\f52e"}.fa-bucket:before{content:"\e4cf"}.fa-image:before{content:"\f03e"}.fa-microphone:before{content:"\f130"}.fa-cow:before{content:"\f6c8"}.fa-caret-up:before{content:"\f0d8"}.fa-screwdriver:before{content:"\f54a"}.fa-folder-closed:before{content:"\e185"}.fa-house-tsunami:before{content:"\e515"}.fa-square-nfi:before{content:"\e576"}.fa-arrow-up-from-ground-water:before{content:"\e4b5"}.fa-glass-martini-alt:before,.fa-martini-glass:before{content:"\f57b"}.fa-rotate-back:before,.fa-rotate-backward:before,.fa-rotate-left:before,.fa-undo-alt:before{content:"\f2ea"}.fa-columns:before,.fa-table-columns:before{content:"\f0db"}.fa-lemon:before{content:"\f094"}.fa-head-side-mask:before{content:"\e063"}.fa-handshake:before{content:"\f2b5"}.fa-gem:before{content:"\f3a5"}.fa-dolly-box:before,.fa-dolly:before{content:"\f472"}.fa-smoking:before{content:"\f48d"}.fa-compress-arrows-alt:before,.fa-minimize:before{content:"\f78c"}.fa-monument:before{content:"\f5a6"}.fa-snowplow:before{content:"\f7d2"}.fa-angle-double-right:before,.fa-angles-right:before{content:"\f101"}.fa-cannabis:before{content:"\f55f"}.fa-circle-play:before,.fa-play-circle:before{content:"\f144"}.fa-tablets:before{content:"\f490"}.fa-ethernet:before{content:"\f796"}.fa-eur:before,.fa-euro-sign:before,.fa-euro:before{content:"\f153"}.fa-chair:before{content:"\f6c0"}.fa-check-circle:before,.fa-circle-check:before{content:"\f058"}.fa-circle-stop:before,.fa-stop-circle:before{content:"\f28d"}.fa-compass-drafting:before,.fa-drafting-compass:before{content:"\f568"}.fa-plate-wheat:before{content:"\e55a"}.fa-icicles:before{content:"\f7ad"}.fa-person-shelter:before{content:"\e54f"}.fa-neuter:before{content:"\f22c"}.fa-id-badge:before{content:"\f2c1"}.fa-marker:before{content:"\f5a1"}.fa-face-laugh-beam:before,.fa-laugh-beam:before{content:"\f59a"}.fa-helicopter-symbol:before{content:"\e502"}.fa-universal-access:before{content:"\f29a"}.fa-chevron-circle-up:before,.fa-circle-chevron-up:before{content:"\f139"}.fa-lari-sign:before{content:"\e1c8"}.fa-volcano:before{content:"\f770"}.fa-person-walking-dashed-line-arrow-right:before{content:"\e553"}.fa-gbp:before,.fa-pound-sign:before,.fa-sterling-sign:before{content:"\f154"}.fa-viruses:before{content:"\e076"}.fa-square-person-confined:before{content:"\e577"}.fa-user-tie:before{content:"\f508"}.fa-arrow-down-long:before,.fa-long-arrow-down:before{content:"\f175"}.fa-tent-arrow-down-to-line:before{content:"\e57e"}.fa-certificate:before{content:"\f0a3"}.fa-mail-reply-all:before,.fa-reply-all:before{content:"\f122"}.fa-suitcase:before{content:"\f0f2"}.fa-person-skating:before,.fa-skating:before{content:"\f7c5"}.fa-filter-circle-dollar:before,.fa-funnel-dollar:before{content:"\f662"}.fa-camera-retro:before{content:"\f083"}.fa-arrow-circle-down:before,.fa-circle-arrow-down:before{content:"\f0ab"}.fa-arrow-right-to-file:before,.fa-file-import:before{content:"\f56f"}.fa-external-link-square:before,.fa-square-arrow-up-right:before{content:"\f14c"}.fa-box-open:before{content:"\f49e"}.fa-scroll:before{content:"\f70e"}.fa-spa:before{content:"\f5bb"}.fa-location-pin-lock:before{content:"\e51f"}.fa-pause:before{content:"\f04c"}.fa-hill-avalanche:before{content:"\e507"}.fa-temperature-0:before,.fa-temperature-empty:before,.fa-thermometer-0:before,.fa-thermometer-empty:before{content:"\f2cb"}.fa-bomb:before{content:"\f1e2"}.fa-registered:before{content:"\f25d"}.fa-address-card:before,.fa-contact-card:before,.fa-vcard:before{content:"\f2bb"}.fa-balance-scale-right:before,.fa-scale-unbalanced-flip:before{content:"\f516"}.fa-subscript:before{content:"\f12c"}.fa-diamond-turn-right:before,.fa-directions:before{content:"\f5eb"}.fa-burst:before{content:"\e4dc"}.fa-house-laptop:before,.fa-laptop-house:before{content:"\e066"}.fa-face-tired:before,.fa-tired:before{content:"\f5c8"}.fa-money-bills:before{content:"\e1f3"}.fa-smog:before{content:"\f75f"}.fa-crutch:before{content:"\f7f7"}.fa-cloud-arrow-up:before,.fa-cloud-upload-alt:before,.fa-cloud-upload:before{content:"\f0ee"}.fa-palette:before{content:"\f53f"}.fa-arrows-turn-right:before{content:"\e4c0"}.fa-vest:before{content:"\e085"}.fa-ferry:before{content:"\e4ea"}.fa-arrows-down-to-people:before{content:"\e4b9"}.fa-seedling:before,.fa-sprout:before{content:"\f4d8"}.fa-arrows-alt-h:before,.fa-left-right:before{content:"\f337"}.fa-boxes-packing:before{content:"\e4c7"}.fa-arrow-circle-left:before,.fa-circle-arrow-left:before{content:"\f0a8"}.fa-group-arrows-rotate:before{content:"\e4f6"}.fa-bowl-food:before{content:"\e4c6"}.fa-candy-cane:before{content:"\f786"}.fa-arrow-down-wide-short:before,.fa-sort-amount-asc:before,.fa-sort-amount-down:before{content:"\f160"}.fa-cloud-bolt:before,.fa-thunderstorm:before{content:"\f76c"}.fa-remove-format:before,.fa-text-slash:before{content:"\f87d"}.fa-face-smile-wink:before,.fa-smile-wink:before{content:"\f4da"}.fa-file-word:before{content:"\f1c2"}.fa-file-powerpoint:before{content:"\f1c4"}.fa-arrows-h:before,.fa-arrows-left-right:before{content:"\f07e"}.fa-house-lock:before{content:"\e510"}.fa-cloud-arrow-down:before,.fa-cloud-download-alt:before,.fa-cloud-download:before{content:"\f0ed"}.fa-children:before{content:"\e4e1"}.fa-blackboard:before,.fa-chalkboard:before{content:"\f51b"}.fa-user-alt-slash:before,.fa-user-large-slash:before{content:"\f4fa"}.fa-envelope-open:before{content:"\f2b6"}.fa-handshake-alt-slash:before,.fa-handshake-simple-slash:before{content:"\e05f"}.fa-mattress-pillow:before{content:"\e525"}.fa-guarani-sign:before{content:"\e19a"}.fa-arrows-rotate:before,.fa-refresh:before,.fa-sync:before{content:"\f021"}.fa-fire-extinguisher:before{content:"\f134"}.fa-cruzeiro-sign:before{content:"\e152"}.fa-greater-than-equal:before{content:"\f532"}.fa-shield-alt:before,.fa-shield-halved:before{content:"\f3ed"}.fa-atlas:before,.fa-book-atlas:before{content:"\f558"}.fa-virus:before{content:"\e074"}.fa-envelope-circle-check:before{content:"\e4e8"}.fa-layer-group:before{content:"\f5fd"}.fa-arrows-to-dot:before{content:"\e4be"}.fa-archway:before{content:"\f557"}.fa-heart-circle-check:before{content:"\e4fd"}.fa-house-chimney-crack:before,.fa-house-damage:before{content:"\f6f1"}.fa-file-archive:before,.fa-file-zipper:before{content:"\f1c6"}.fa-square:before{content:"\f0c8"}.fa-glass-martini:before,.fa-martini-glass-empty:before{content:"\f000"}.fa-couch:before{content:"\f4b8"}.fa-cedi-sign:before{content:"\e0df"}.fa-italic:before{content:"\f033"}.fa-church:before{content:"\f51d"}.fa-comments-dollar:before{content:"\f653"}.fa-democrat:before{content:"\f747"}.fa-z:before{content:"\5a"}.fa-person-skiing:before,.fa-skiing:before{content:"\f7c9"}.fa-road-lock:before{content:"\e567"}.fa-a:before{content:"\41"}.fa-temperature-arrow-down:before,.fa-temperature-down:before{content:"\e03f"}.fa-feather-alt:before,.fa-feather-pointed:before{content:"\f56b"}.fa-p:before{content:"\50"}.fa-snowflake:before{content:"\f2dc"}.fa-newspaper:before{content:"\f1ea"}.fa-ad:before,.fa-rectangle-ad:before{content:"\f641"}.fa-arrow-circle-right:before,.fa-circle-arrow-right:before{content:"\f0a9"}.fa-filter-circle-xmark:before{content:"\e17b"}.fa-locust:before{content:"\e520"}.fa-sort:before,.fa-unsorted:before{content:"\f0dc"}.fa-list-1-2:before,.fa-list-numeric:before,.fa-list-ol:before{content:"\f0cb"}.fa-person-dress-burst:before{content:"\e544"}.fa-money-check-alt:before,.fa-money-check-dollar:before{content:"\f53d"}.fa-vector-square:before{content:"\f5cb"}.fa-bread-slice:before{content:"\f7ec"}.fa-language:before{content:"\f1ab"}.fa-face-kiss-wink-heart:before,.fa-kiss-wink-heart:before{content:"\f598"}.fa-filter:before{content:"\f0b0"}.fa-question:before{content:"\3f"}.fa-file-signature:before{content:"\f573"}.fa-arrows-alt:before,.fa-up-down-left-right:before{content:"\f0b2"}.fa-house-chimney-user:before{content:"\e065"}.fa-hand-holding-heart:before{content:"\f4be"}.fa-puzzle-piece:before{content:"\f12e"}.fa-money-check:before{content:"\f53c"}.fa-star-half-alt:before,.fa-star-half-stroke:before{content:"\f5c0"}.fa-code:before{content:"\f121"}.fa-glass-whiskey:before,.fa-whiskey-glass:before{content:"\f7a0"}.fa-building-circle-exclamation:before{content:"\e4d3"}.fa-magnifying-glass-chart:before{content:"\e522"}.fa-arrow-up-right-from-square:before,.fa-external-link:before{content:"\f08e"}.fa-cubes-stacked:before{content:"\e4e6"}.fa-krw:before,.fa-won-sign:before,.fa-won:before{content:"\f159"}.fa-virus-covid:before{content:"\e4a8"}.fa-austral-sign:before{content:"\e0a9"}.fa-f:before{content:"\46"}.fa-leaf:before{content:"\f06c"}.fa-road:before{content:"\f018"}.fa-cab:before,.fa-taxi:before{content:"\f1ba"}.fa-person-circle-plus:before{content:"\e541"}.fa-chart-pie:before,.fa-pie-chart:before{content:"\f200"}.fa-bolt-lightning:before{content:"\e0b7"}.fa-sack-xmark:before{content:"\e56a"}.fa-file-excel:before{content:"\f1c3"}.fa-file-contract:before{content:"\f56c"}.fa-fish-fins:before{content:"\e4f2"}.fa-building-flag:before{content:"\e4d5"}.fa-face-grin-beam:before,.fa-grin-beam:before{content:"\f582"}.fa-object-ungroup:before{content:"\f248"}.fa-poop:before{content:"\f619"}.fa-location-pin:before,.fa-map-marker:before{content:"\f041"}.fa-kaaba:before{content:"\f66b"}.fa-toilet-paper:before{content:"\f71e"}.fa-hard-hat:before,.fa-hat-hard:before,.fa-helmet-safety:before{content:"\f807"}.fa-eject:before{content:"\f052"}.fa-arrow-alt-circle-right:before,.fa-circle-right:before{content:"\f35a"}.fa-plane-circle-check:before{content:"\e555"}.fa-face-rolling-eyes:before,.fa-meh-rolling-eyes:before{content:"\f5a5"}.fa-object-group:before{content:"\f247"}.fa-chart-line:before,.fa-line-chart:before{content:"\f201"}.fa-mask-ventilator:before{content:"\e524"}.fa-arrow-right:before{content:"\f061"}.fa-map-signs:before,.fa-signs-post:before{content:"\f277"}.fa-cash-register:before{content:"\f788"}.fa-person-circle-question:before{content:"\e542"}.fa-h:before{content:"\48"}.fa-tarp:before{content:"\e57b"}.fa-screwdriver-wrench:before,.fa-tools:before{content:"\f7d9"}.fa-arrows-to-eye:before{content:"\e4bf"}.fa-plug-circle-bolt:before{content:"\e55b"}.fa-heart:before{content:"\f004"}.fa-mars-and-venus:before{content:"\f224"}.fa-home-user:before,.fa-house-user:before{content:"\e1b0"}.fa-dumpster-fire:before{content:"\f794"}.fa-house-crack:before{content:"\e3b1"}.fa-cocktail:before,.fa-martini-glass-citrus:before{content:"\f561"}.fa-face-surprise:before,.fa-surprise:before{content:"\f5c2"}.fa-bottle-water:before{content:"\e4c5"}.fa-circle-pause:before,.fa-pause-circle:before{content:"\f28b"}.fa-toilet-paper-slash:before{content:"\e072"}.fa-apple-alt:before,.fa-apple-whole:before{content:"\f5d1"}.fa-kitchen-set:before{content:"\e51a"}.fa-r:before{content:"\52"}.fa-temperature-1:before,.fa-temperature-quarter:before,.fa-thermometer-1:before,.fa-thermometer-quarter:before{content:"\f2ca"}.fa-cube:before{content:"\f1b2"}.fa-bitcoin-sign:before{content:"\e0b4"}.fa-shield-dog:before{content:"\e573"}.fa-solar-panel:before{content:"\f5ba"}.fa-lock-open:before{content:"\f3c1"}.fa-elevator:before{content:"\e16d"}.fa-money-bill-transfer:before{content:"\e528"}.fa-money-bill-trend-up:before{content:"\e529"}.fa-house-flood-water-circle-arrow-right:before{content:"\e50f"}.fa-poll-h:before,.fa-square-poll-horizontal:before{content:"\f682"}.fa-circle:before{content:"\f111"}.fa-backward-fast:before,.fa-fast-backward:before{content:"\f049"}.fa-recycle:before{content:"\f1b8"}.fa-user-astronaut:before{content:"\f4fb"}.fa-plane-slash:before{content:"\e069"}.fa-trademark:before{content:"\f25c"}.fa-basketball-ball:before,.fa-basketball:before{content:"\f434"}.fa-satellite-dish:before{content:"\f7c0"}.fa-arrow-alt-circle-up:before,.fa-circle-up:before{content:"\f35b"}.fa-mobile-alt:before,.fa-mobile-screen-button:before{content:"\f3cd"}.fa-volume-high:before,.fa-volume-up:before{content:"\f028"}.fa-users-rays:before{content:"\e593"}.fa-wallet:before{content:"\f555"}.fa-clipboard-check:before{content:"\f46c"}.fa-file-audio:before{content:"\f1c7"}.fa-burger:before,.fa-hamburger:before{content:"\f805"}.fa-wrench:before{content:"\f0ad"}.fa-bugs:before{content:"\e4d0"}.fa-rupee-sign:before,.fa-rupee:before{content:"\f156"}.fa-file-image:before{content:"\f1c5"}.fa-circle-question:before,.fa-question-circle:before{content:"\f059"}.fa-plane-departure:before{content:"\f5b0"}.fa-handshake-slash:before{content:"\e060"}.fa-book-bookmark:before{content:"\e0bb"}.fa-code-branch:before{content:"\f126"}.fa-hat-cowboy:before{content:"\f8c0"}.fa-bridge:before{content:"\e4c8"}.fa-phone-alt:before,.fa-phone-flip:before{content:"\f879"}.fa-truck-front:before{content:"\e2b7"}.fa-cat:before{content:"\f6be"}.fa-anchor-circle-exclamation:before{content:"\e4ab"}.fa-truck-field:before{content:"\e58d"}.fa-route:before{content:"\f4d7"}.fa-clipboard-question:before{content:"\e4e3"}.fa-panorama:before{content:"\e209"}.fa-comment-medical:before{content:"\f7f5"}.fa-teeth-open:before{content:"\f62f"}.fa-file-circle-minus:before{content:"\e4ed"}.fa-tags:before{content:"\f02c"}.fa-wine-glass:before{content:"\f4e3"}.fa-fast-forward:before,.fa-forward-fast:before{content:"\f050"}.fa-face-meh-blank:before,.fa-meh-blank:before{content:"\f5a4"}.fa-parking:before,.fa-square-parking:before{content:"\f540"}.fa-house-signal:before{content:"\e012"}.fa-bars-progress:before,.fa-tasks-alt:before{content:"\f828"}.fa-faucet-drip:before{content:"\e006"}.fa-cart-flatbed:before,.fa-dolly-flatbed:before{content:"\f474"}.fa-ban-smoking:before,.fa-smoking-ban:before{content:"\f54d"}.fa-terminal:before{content:"\f120"}.fa-mobile-button:before{content:"\f10b"}.fa-house-medical-flag:before{content:"\e514"}.fa-basket-shopping:before,.fa-shopping-basket:before{content:"\f291"}.fa-tape:before{content:"\f4db"}.fa-bus-alt:before,.fa-bus-simple:before{content:"\f55e"}.fa-eye:before{content:"\f06e"}.fa-face-sad-cry:before,.fa-sad-cry:before{content:"\f5b3"}.fa-audio-description:before{content:"\f29e"}.fa-person-military-to-person:before{content:"\e54c"}.fa-file-shield:before{content:"\e4f0"}.fa-user-slash:before{content:"\f506"}.fa-pen:before{content:"\f304"}.fa-tower-observation:before{content:"\e586"}.fa-file-code:before{content:"\f1c9"}.fa-signal-5:before,.fa-signal-perfect:before,.fa-signal:before{content:"\f012"}.fa-bus:before{content:"\f207"}.fa-heart-circle-xmark:before{content:"\e501"}.fa-home-lg:before,.fa-house-chimney:before{content:"\e3af"}.fa-window-maximize:before{content:"\f2d0"}.fa-face-frown:before,.fa-frown:before{content:"\f119"}.fa-prescription:before{content:"\f5b1"}.fa-shop:before,.fa-store-alt:before{content:"\f54f"}.fa-floppy-disk:before,.fa-save:before{content:"\f0c7"}.fa-vihara:before{content:"\f6a7"}.fa-balance-scale-left:before,.fa-scale-unbalanced:before{content:"\f515"}.fa-sort-asc:before,.fa-sort-up:before{content:"\f0de"}.fa-comment-dots:before,.fa-commenting:before{content:"\f4ad"}.fa-plant-wilt:before{content:"\e5aa"}.fa-diamond:before{content:"\f219"}.fa-face-grin-squint:before,.fa-grin-squint:before{content:"\f585"}.fa-hand-holding-dollar:before,.fa-hand-holding-usd:before{content:"\f4c0"}.fa-bacterium:before{content:"\e05a"}.fa-hand-pointer:before{content:"\f25a"}.fa-drum-steelpan:before{content:"\f56a"}.fa-hand-scissors:before{content:"\f257"}.fa-hands-praying:before,.fa-praying-hands:before{content:"\f684"}.fa-arrow-right-rotate:before,.fa-arrow-rotate-forward:before,.fa-arrow-rotate-right:before,.fa-redo:before{content:"\f01e"}.fa-biohazard:before{content:"\f780"}.fa-location-crosshairs:before,.fa-location:before{content:"\f601"}.fa-mars-double:before{content:"\f227"}.fa-child-dress:before{content:"\e59c"}.fa-users-between-lines:before{content:"\e591"}.fa-lungs-virus:before{content:"\e067"}.fa-face-grin-tears:before,.fa-grin-tears:before{content:"\f588"}.fa-phone:before{content:"\f095"}.fa-calendar-times:before,.fa-calendar-xmark:before{content:"\f273"}.fa-child-reaching:before{content:"\e59d"}.fa-head-side-virus:before{content:"\e064"}.fa-user-cog:before,.fa-user-gear:before{content:"\f4fe"}.fa-arrow-up-1-9:before,.fa-sort-numeric-up:before{content:"\f163"}.fa-door-closed:before{content:"\f52a"}.fa-shield-virus:before{content:"\e06c"}.fa-dice-six:before{content:"\f526"}.fa-mosquito-net:before{content:"\e52c"}.fa-bridge-water:before{content:"\e4ce"}.fa-person-booth:before{content:"\f756"}.fa-text-width:before{content:"\f035"}.fa-hat-wizard:before{content:"\f6e8"}.fa-pen-fancy:before{content:"\f5ac"}.fa-digging:before,.fa-person-digging:before{content:"\f85e"}.fa-trash:before{content:"\f1f8"}.fa-gauge-simple-med:before,.fa-gauge-simple:before,.fa-tachometer-average:before{content:"\f629"}.fa-book-medical:before{content:"\f7e6"}.fa-poo:before{content:"\f2fe"}.fa-quote-right-alt:before,.fa-quote-right:before{content:"\f10e"}.fa-shirt:before,.fa-t-shirt:before,.fa-tshirt:before{content:"\f553"}.fa-cubes:before{content:"\f1b3"}.fa-divide:before{content:"\f529"}.fa-tenge-sign:before,.fa-tenge:before{content:"\f7d7"}.fa-headphones:before{content:"\f025"}.fa-hands-holding:before{content:"\f4c2"}.fa-hands-clapping:before{content:"\e1a8"}.fa-republican:before{content:"\f75e"}.fa-arrow-left:before{content:"\f060"}.fa-person-circle-xmark:before{content:"\e543"}.fa-ruler:before{content:"\f545"}.fa-align-left:before{content:"\f036"}.fa-dice-d6:before{content:"\f6d1"}.fa-restroom:before{content:"\f7bd"}.fa-j:before{content:"\4a"}.fa-users-viewfinder:before{content:"\e595"}.fa-file-video:before{content:"\f1c8"}.fa-external-link-alt:before,.fa-up-right-from-square:before{content:"\f35d"}.fa-table-cells:before,.fa-th:before{content:"\f00a"}.fa-file-pdf:before{content:"\f1c1"}.fa-bible:before,.fa-book-bible:before{content:"\f647"}.fa-o:before{content:"\4f"}.fa-medkit:before,.fa-suitcase-medical:before{content:"\f0fa"}.fa-user-secret:before{content:"\f21b"}.fa-otter:before{content:"\f700"}.fa-female:before,.fa-person-dress:before{content:"\f182"}.fa-comment-dollar:before{content:"\f651"}.fa-briefcase-clock:before,.fa-business-time:before{content:"\f64a"}.fa-table-cells-large:before,.fa-th-large:before{content:"\f009"}.fa-book-tanakh:before,.fa-tanakh:before{content:"\f827"}.fa-phone-volume:before,.fa-volume-control-phone:before{content:"\f2a0"}.fa-hat-cowboy-side:before{content:"\f8c1"}.fa-clipboard-user:before{content:"\f7f3"}.fa-child:before{content:"\f1ae"}.fa-lira-sign:before{content:"\f195"}.fa-satellite:before{content:"\f7bf"}.fa-plane-lock:before{content:"\e558"}.fa-tag:before{content:"\f02b"}.fa-comment:before{content:"\f075"}.fa-birthday-cake:before,.fa-cake-candles:before,.fa-cake:before{content:"\f1fd"}.fa-envelope:before{content:"\f0e0"}.fa-angle-double-up:before,.fa-angles-up:before{content:"\f102"}.fa-paperclip:before{content:"\f0c6"}.fa-arrow-right-to-city:before{content:"\e4b3"}.fa-ribbon:before{content:"\f4d6"}.fa-lungs:before{content:"\f604"}.fa-arrow-up-9-1:before,.fa-sort-numeric-up-alt:before{content:"\f887"}.fa-litecoin-sign:before{content:"\e1d3"}.fa-border-none:before{content:"\f850"}.fa-circle-nodes:before{content:"\e4e2"}.fa-parachute-box:before{content:"\f4cd"}.fa-indent:before{content:"\f03c"}.fa-truck-field-un:before{content:"\e58e"}.fa-hourglass-empty:before,.fa-hourglass:before{content:"\f254"}.fa-mountain:before{content:"\f6fc"}.fa-user-doctor:before,.fa-user-md:before{content:"\f0f0"}.fa-circle-info:before,.fa-info-circle:before{content:"\f05a"}.fa-cloud-meatball:before{content:"\f73b"}.fa-camera-alt:before,.fa-camera:before{content:"\f030"}.fa-square-virus:before{content:"\e578"}.fa-meteor:before{content:"\f753"}.fa-car-on:before{content:"\e4dd"}.fa-sleigh:before{content:"\f7cc"}.fa-arrow-down-1-9:before,.fa-sort-numeric-asc:before,.fa-sort-numeric-down:before{content:"\f162"}.fa-hand-holding-droplet:before,.fa-hand-holding-water:before{content:"\f4c1"}.fa-water:before{content:"\f773"}.fa-calendar-check:before{content:"\f274"}.fa-braille:before{content:"\f2a1"}.fa-prescription-bottle-alt:before,.fa-prescription-bottle-medical:before{content:"\f486"}.fa-landmark:before{content:"\f66f"}.fa-truck:before{content:"\f0d1"}.fa-crosshairs:before{content:"\f05b"}.fa-person-cane:before{content:"\e53c"}.fa-tent:before{content:"\e57d"}.fa-vest-patches:before{content:"\e086"}.fa-check-double:before{content:"\f560"}.fa-arrow-down-a-z:before,.fa-sort-alpha-asc:before,.fa-sort-alpha-down:before{content:"\f15d"}.fa-money-bill-wheat:before{content:"\e52a"}.fa-cookie:before{content:"\f563"}.fa-arrow-left-rotate:before,.fa-arrow-rotate-back:before,.fa-arrow-rotate-backward:before,.fa-arrow-rotate-left:before,.fa-undo:before{content:"\f0e2"}.fa-hard-drive:before,.fa-hdd:before{content:"\f0a0"}.fa-face-grin-squint-tears:before,.fa-grin-squint-tears:before{content:"\f586"}.fa-dumbbell:before{content:"\f44b"}.fa-list-alt:before,.fa-rectangle-list:before{content:"\f022"}.fa-tarp-droplet:before{content:"\e57c"}.fa-house-medical-circle-check:before{content:"\e511"}.fa-person-skiing-nordic:before,.fa-skiing-nordic:before{content:"\f7ca"}.fa-calendar-plus:before{content:"\f271"}.fa-plane-arrival:before{content:"\f5af"}.fa-arrow-alt-circle-left:before,.fa-circle-left:before{content:"\f359"}.fa-subway:before,.fa-train-subway:before{content:"\f239"}.fa-chart-gantt:before{content:"\e0e4"}.fa-indian-rupee-sign:before,.fa-indian-rupee:before,.fa-inr:before{content:"\e1bc"}.fa-crop-alt:before,.fa-crop-simple:before{content:"\f565"}.fa-money-bill-1:before,.fa-money-bill-alt:before{content:"\f3d1"}.fa-left-long:before,.fa-long-arrow-alt-left:before{content:"\f30a"}.fa-dna:before{content:"\f471"}.fa-virus-slash:before{content:"\e075"}.fa-minus:before,.fa-subtract:before{content:"\f068"}.fa-chess:before{content:"\f439"}.fa-arrow-left-long:before,.fa-long-arrow-left:before{content:"\f177"}.fa-plug-circle-check:before{content:"\e55c"}.fa-street-view:before{content:"\f21d"}.fa-franc-sign:before{content:"\e18f"}.fa-volume-off:before{content:"\f026"}.fa-american-sign-language-interpreting:before,.fa-asl-interpreting:before,.fa-hands-american-sign-language-interpreting:before,.fa-hands-asl-interpreting:before{content:"\f2a3"}.fa-cog:before,.fa-gear:before{content:"\f013"}.fa-droplet-slash:before,.fa-tint-slash:before{content:"\f5c7"}.fa-mosque:before{content:"\f678"}.fa-mosquito:before{content:"\e52b"}.fa-star-of-david:before{content:"\f69a"}.fa-person-military-rifle:before{content:"\e54b"}.fa-cart-shopping:before,.fa-shopping-cart:before{content:"\f07a"}.fa-vials:before{content:"\f493"}.fa-plug-circle-plus:before{content:"\e55f"}.fa-place-of-worship:before{content:"\f67f"}.fa-grip-vertical:before{content:"\f58e"}.fa-arrow-turn-up:before,.fa-level-up:before{content:"\f148"}.fa-u:before{content:"\55"}.fa-square-root-alt:before,.fa-square-root-variable:before{content:"\f698"}.fa-clock-four:before,.fa-clock:before{content:"\f017"}.fa-backward-step:before,.fa-step-backward:before{content:"\f048"}.fa-pallet:before{content:"\f482"}.fa-faucet:before{content:"\e005"}.fa-baseball-bat-ball:before{content:"\f432"}.fa-s:before{content:"\53"}.fa-timeline:before{content:"\e29c"}.fa-keyboard:before{content:"\f11c"}.fa-caret-down:before{content:"\f0d7"}.fa-clinic-medical:before,.fa-house-chimney-medical:before{content:"\f7f2"}.fa-temperature-3:before,.fa-temperature-three-quarters:before,.fa-thermometer-3:before,.fa-thermometer-three-quarters:before{content:"\f2c8"}.fa-mobile-android-alt:before,.fa-mobile-screen:before{content:"\f3cf"}.fa-plane-up:before{content:"\e22d"}.fa-piggy-bank:before{content:"\f4d3"}.fa-battery-3:before,.fa-battery-half:before{content:"\f242"}.fa-mountain-city:before{content:"\e52e"}.fa-coins:before{content:"\f51e"}.fa-khanda:before{content:"\f66d"}.fa-sliders-h:before,.fa-sliders:before{content:"\f1de"}.fa-folder-tree:before{content:"\f802"}.fa-network-wired:before{content:"\f6ff"}.fa-map-pin:before{content:"\f276"}.fa-hamsa:before{content:"\f665"}.fa-cent-sign:before{content:"\e3f5"}.fa-flask:before{content:"\f0c3"}.fa-person-pregnant:before{content:"\e31e"}.fa-wand-sparkles:before{content:"\f72b"}.fa-ellipsis-v:before,.fa-ellipsis-vertical:before{content:"\f142"}.fa-ticket:before{content:"\f145"}.fa-power-off:before{content:"\f011"}.fa-long-arrow-alt-right:before,.fa-right-long:before{content:"\f30b"}.fa-flag-usa:before{content:"\f74d"}.fa-laptop-file:before{content:"\e51d"}.fa-teletype:before,.fa-tty:before{content:"\f1e4"}.fa-diagram-next:before{content:"\e476"}.fa-person-rifle:before{content:"\e54e"}.fa-house-medical-circle-exclamation:before{content:"\e512"}.fa-closed-captioning:before{content:"\f20a"}.fa-hiking:before,.fa-person-hiking:before{content:"\f6ec"}.fa-venus-double:before{content:"\f226"}.fa-images:before{content:"\f302"}.fa-calculator:before{content:"\f1ec"}.fa-people-pulling:before{content:"\e535"}.fa-n:before{content:"\4e"}.fa-cable-car:before,.fa-tram:before{content:"\f7da"}.fa-cloud-rain:before{content:"\f73d"}.fa-building-circle-xmark:before{content:"\e4d4"}.fa-ship:before{content:"\f21a"}.fa-arrows-down-to-line:before{content:"\e4b8"}.fa-download:before{content:"\f019"}.fa-face-grin:before,.fa-grin:before{content:"\f580"}.fa-backspace:before,.fa-delete-left:before{content:"\f55a"}.fa-eye-dropper-empty:before,.fa-eye-dropper:before,.fa-eyedropper:before{content:"\f1fb"}.fa-file-circle-check:before{content:"\e5a0"}.fa-forward:before{content:"\f04e"}.fa-mobile-android:before,.fa-mobile-phone:before,.fa-mobile:before{content:"\f3ce"}.fa-face-meh:before,.fa-meh:before{content:"\f11a"}.fa-align-center:before{content:"\f037"}.fa-book-dead:before,.fa-book-skull:before{content:"\f6b7"}.fa-drivers-license:before,.fa-id-card:before{content:"\f2c2"}.fa-dedent:before,.fa-outdent:before{content:"\f03b"}.fa-heart-circle-exclamation:before{content:"\e4fe"}.fa-home-alt:before,.fa-home-lg-alt:before,.fa-home:before,.fa-house:before{content:"\f015"}.fa-calendar-week:before{content:"\f784"}.fa-laptop-medical:before{content:"\f812"}.fa-b:before{content:"\42"}.fa-file-medical:before{content:"\f477"}.fa-dice-one:before{content:"\f525"}.fa-kiwi-bird:before{content:"\f535"}.fa-arrow-right-arrow-left:before,.fa-exchange:before{content:"\f0ec"}.fa-redo-alt:before,.fa-rotate-forward:before,.fa-rotate-right:before{content:"\f2f9"}.fa-cutlery:before,.fa-utensils:before{content:"\f2e7"}.fa-arrow-up-wide-short:before,.fa-sort-amount-up:before{content:"\f161"}.fa-mill-sign:before{content:"\e1ed"}.fa-bowl-rice:before{content:"\e2eb"}.fa-skull:before{content:"\f54c"}.fa-broadcast-tower:before,.fa-tower-broadcast:before{content:"\f519"}.fa-truck-pickup:before{content:"\f63c"}.fa-long-arrow-alt-up:before,.fa-up-long:before{content:"\f30c"}.fa-stop:before{content:"\f04d"}.fa-code-merge:before{content:"\f387"}.fa-upload:before{content:"\f093"}.fa-hurricane:before{content:"\f751"}.fa-mound:before{content:"\e52d"}.fa-toilet-portable:before{content:"\e583"}.fa-compact-disc:before{content:"\f51f"}.fa-file-arrow-down:before,.fa-file-download:before{content:"\f56d"}.fa-caravan:before{content:"\f8ff"}.fa-shield-cat:before{content:"\e572"}.fa-bolt:before,.fa-zap:before{content:"\f0e7"}.fa-glass-water:before{content:"\e4f4"}.fa-oil-well:before{content:"\e532"}.fa-vault:before{content:"\e2c5"}.fa-mars:before{content:"\f222"}.fa-toilet:before{content:"\f7d8"}.fa-plane-circle-xmark:before{content:"\e557"}.fa-cny:before,.fa-jpy:before,.fa-rmb:before,.fa-yen-sign:before,.fa-yen:before{content:"\f157"}.fa-rouble:before,.fa-rub:before,.fa-ruble-sign:before,.fa-ruble:before{content:"\f158"}.fa-sun:before{content:"\f185"}.fa-guitar:before{content:"\f7a6"}.fa-face-laugh-wink:before,.fa-laugh-wink:before{content:"\f59c"}.fa-horse-head:before{content:"\f7ab"}.fa-bore-hole:before{content:"\e4c3"}.fa-industry:before{content:"\f275"}.fa-arrow-alt-circle-down:before,.fa-circle-down:before{content:"\f358"}.fa-arrows-turn-to-dots:before{content:"\e4c1"}.fa-florin-sign:before{content:"\e184"}.fa-arrow-down-short-wide:before,.fa-sort-amount-desc:before,.fa-sort-amount-down-alt:before{content:"\f884"}.fa-less-than:before{content:"\3c"}.fa-angle-down:before{content:"\f107"}.fa-car-tunnel:before{content:"\e4de"}.fa-head-side-cough:before{content:"\e061"}.fa-grip-lines:before{content:"\f7a4"}.fa-thumbs-down:before{content:"\f165"}.fa-user-lock:before{content:"\f502"}.fa-arrow-right-long:before,.fa-long-arrow-right:before{content:"\f178"}.fa-anchor-circle-xmark:before{content:"\e4ac"}.fa-ellipsis-h:before,.fa-ellipsis:before{content:"\f141"}.fa-chess-pawn:before{content:"\f443"}.fa-first-aid:before,.fa-kit-medical:before{content:"\f479"}.fa-person-through-window:before{content:"\e5a9"}.fa-toolbox:before{content:"\f552"}.fa-hands-holding-circle:before{content:"\e4fb"}.fa-bug:before{content:"\f188"}.fa-credit-card-alt:before,.fa-credit-card:before{content:"\f09d"}.fa-automobile:before,.fa-car:before{content:"\f1b9"}.fa-hand-holding-hand:before{content:"\e4f7"}.fa-book-open-reader:before,.fa-book-reader:before{content:"\f5da"}.fa-mountain-sun:before{content:"\e52f"}.fa-arrows-left-right-to-line:before{content:"\e4ba"}.fa-dice-d20:before{content:"\f6cf"}.fa-truck-droplet:before{content:"\e58c"}.fa-file-circle-xmark:before{content:"\e5a1"}.fa-temperature-arrow-up:before,.fa-temperature-up:before{content:"\e040"}.fa-medal:before{content:"\f5a2"}.fa-bed:before{content:"\f236"}.fa-h-square:before,.fa-square-h:before{content:"\f0fd"}.fa-podcast:before{content:"\f2ce"}.fa-temperature-4:before,.fa-temperature-full:before,.fa-thermometer-4:before,.fa-thermometer-full:before{content:"\f2c7"}.fa-bell:before{content:"\f0f3"}.fa-superscript:before{content:"\f12b"}.fa-plug-circle-xmark:before{content:"\e560"}.fa-star-of-life:before{content:"\f621"}.fa-phone-slash:before{content:"\f3dd"}.fa-paint-roller:before{content:"\f5aa"}.fa-hands-helping:before,.fa-handshake-angle:before{content:"\f4c4"}.fa-location-dot:before,.fa-map-marker-alt:before{content:"\f3c5"}.fa-file:before{content:"\f15b"}.fa-greater-than:before{content:"\3e"}.fa-person-swimming:before,.fa-swimmer:before{content:"\f5c4"}.fa-arrow-down:before{content:"\f063"}.fa-droplet:before,.fa-tint:before{content:"\f043"}.fa-eraser:before{content:"\f12d"}.fa-earth-america:before,.fa-earth-americas:before,.fa-earth:before,.fa-globe-americas:before{content:"\f57d"}.fa-person-burst:before{content:"\e53b"}.fa-dove:before{content:"\f4ba"}.fa-battery-0:before,.fa-battery-empty:before{content:"\f244"}.fa-socks:before{content:"\f696"}.fa-inbox:before{content:"\f01c"}.fa-section:before{content:"\e447"}.fa-gauge-high:before,.fa-tachometer-alt-fast:before,.fa-tachometer-alt:before{content:"\f625"}.fa-envelope-open-text:before{content:"\f658"}.fa-hospital-alt:before,.fa-hospital-wide:before,.fa-hospital:before{content:"\f0f8"}.fa-wine-bottle:before{content:"\f72f"}.fa-chess-rook:before{content:"\f447"}.fa-bars-staggered:before,.fa-reorder:before,.fa-stream:before{content:"\f550"}.fa-dharmachakra:before{content:"\f655"}.fa-hotdog:before{content:"\f80f"}.fa-blind:before,.fa-person-walking-with-cane:before{content:"\f29d"}.fa-drum:before{content:"\f569"}.fa-ice-cream:before{content:"\f810"}.fa-heart-circle-bolt:before{content:"\e4fc"}.fa-fax:before{content:"\f1ac"}.fa-paragraph:before{content:"\f1dd"}.fa-check-to-slot:before,.fa-vote-yea:before{content:"\f772"}.fa-star-half:before{content:"\f089"}.fa-boxes-alt:before,.fa-boxes-stacked:before,.fa-boxes:before{content:"\f468"}.fa-chain:before,.fa-link:before{content:"\f0c1"}.fa-assistive-listening-systems:before,.fa-ear-listen:before{content:"\f2a2"}.fa-tree-city:before{content:"\e587"}.fa-play:before{content:"\f04b"}.fa-font:before{content:"\f031"}.fa-rupiah-sign:before{content:"\e23d"}.fa-magnifying-glass:before,.fa-search:before{content:"\f002"}.fa-ping-pong-paddle-ball:before,.fa-table-tennis-paddle-ball:before,.fa-table-tennis:before{content:"\f45d"}.fa-diagnoses:before,.fa-person-dots-from-line:before{content:"\f470"}.fa-trash-can-arrow-up:before,.fa-trash-restore-alt:before{content:"\f82a"}.fa-naira-sign:before{content:"\e1f6"}.fa-cart-arrow-down:before{content:"\f218"}.fa-walkie-talkie:before{content:"\f8ef"}.fa-file-edit:before,.fa-file-pen:before{content:"\f31c"}.fa-receipt:before{content:"\f543"}.fa-pen-square:before,.fa-pencil-square:before,.fa-square-pen:before{content:"\f14b"}.fa-suitcase-rolling:before{content:"\f5c1"}.fa-person-circle-exclamation:before{content:"\e53f"}.fa-chevron-down:before{content:"\f078"}.fa-battery-5:before,.fa-battery-full:before,.fa-battery:before{content:"\f240"}.fa-skull-crossbones:before{content:"\f714"}.fa-code-compare:before{content:"\e13a"}.fa-list-dots:before,.fa-list-ul:before{content:"\f0ca"}.fa-school-lock:before{content:"\e56f"}.fa-tower-cell:before{content:"\e585"}.fa-down-long:before,.fa-long-arrow-alt-down:before{content:"\f309"}.fa-ranking-star:before{content:"\e561"}.fa-chess-king:before{content:"\f43f"}.fa-person-harassing:before{content:"\e549"}.fa-brazilian-real-sign:before{content:"\e46c"}.fa-landmark-alt:before,.fa-landmark-dome:before{content:"\f752"}.fa-arrow-up:before{content:"\f062"}.fa-television:before,.fa-tv-alt:before,.fa-tv:before{content:"\f26c"}.fa-shrimp:before{content:"\e448"}.fa-list-check:before,.fa-tasks:before{content:"\f0ae"}.fa-jug-detergent:before{content:"\e519"}.fa-circle-user:before,.fa-user-circle:before{content:"\f2bd"}.fa-user-shield:before{content:"\f505"}.fa-wind:before{content:"\f72e"}.fa-car-burst:before,.fa-car-crash:before{content:"\f5e1"}.fa-y:before{content:"\59"}.fa-person-snowboarding:before,.fa-snowboarding:before{content:"\f7ce"}.fa-shipping-fast:before,.fa-truck-fast:before{content:"\f48b"}.fa-fish:before{content:"\f578"}.fa-user-graduate:before{content:"\f501"}.fa-adjust:before,.fa-circle-half-stroke:before{content:"\f042"}.fa-clapperboard:before{content:"\e131"}.fa-circle-radiation:before,.fa-radiation-alt:before{content:"\f7ba"}.fa-baseball-ball:before,.fa-baseball:before{content:"\f433"}.fa-jet-fighter-up:before{content:"\e518"}.fa-diagram-project:before,.fa-project-diagram:before{content:"\f542"}.fa-copy:before{content:"\f0c5"}.fa-volume-mute:before,.fa-volume-times:before,.fa-volume-xmark:before{content:"\f6a9"}.fa-hand-sparkles:before{content:"\e05d"}.fa-grip-horizontal:before,.fa-grip:before{content:"\f58d"}.fa-share-from-square:before,.fa-share-square:before{content:"\f14d"}.fa-child-combatant:before,.fa-child-rifle:before{content:"\e4e0"}.fa-gun:before{content:"\e19b"}.fa-phone-square:before,.fa-square-phone:before{content:"\f098"}.fa-add:before,.fa-plus:before{content:"\2b"}.fa-expand:before{content:"\f065"}.fa-computer:before{content:"\e4e5"}.fa-close:before,.fa-multiply:before,.fa-remove:before,.fa-times:before,.fa-xmark:before{content:"\f00d"}.fa-arrows-up-down-left-right:before,.fa-arrows:before{content:"\f047"}.fa-chalkboard-teacher:before,.fa-chalkboard-user:before{content:"\f51c"}.fa-peso-sign:before{content:"\e222"}.fa-building-shield:before{content:"\e4d8"}.fa-baby:before{content:"\f77c"}.fa-users-line:before{content:"\e592"}.fa-quote-left-alt:before,.fa-quote-left:before{content:"\f10d"}.fa-tractor:before{content:"\f722"}.fa-trash-arrow-up:before,.fa-trash-restore:before{content:"\f829"}.fa-arrow-down-up-lock:before{content:"\e4b0"}.fa-lines-leaning:before{content:"\e51e"}.fa-ruler-combined:before{content:"\f546"}.fa-copyright:before{content:"\f1f9"}.fa-equals:before{content:"\3d"}.fa-blender:before{content:"\f517"}.fa-teeth:before{content:"\f62e"}.fa-ils:before,.fa-shekel-sign:before,.fa-shekel:before,.fa-sheqel-sign:before,.fa-sheqel:before{content:"\f20b"}.fa-map:before{content:"\f279"}.fa-rocket:before{content:"\f135"}.fa-photo-film:before,.fa-photo-video:before{content:"\f87c"}.fa-folder-minus:before{content:"\f65d"}.fa-store:before{content:"\f54e"}.fa-arrow-trend-up:before{content:"\e098"}.fa-plug-circle-minus:before{content:"\e55e"}.fa-sign-hanging:before,.fa-sign:before{content:"\f4d9"}.fa-bezier-curve:before{content:"\f55b"}.fa-bell-slash:before{content:"\f1f6"}.fa-tablet-android:before,.fa-tablet:before{content:"\f3fb"}.fa-school-flag:before{content:"\e56e"}.fa-fill:before{content:"\f575"}.fa-angle-up:before{content:"\f106"}.fa-drumstick-bite:before{content:"\f6d7"}.fa-holly-berry:before{content:"\f7aa"}.fa-chevron-left:before{content:"\f053"}.fa-bacteria:before{content:"\e059"}.fa-hand-lizard:before{content:"\f258"}.fa-notdef:before{content:"\e1fe"}.fa-disease:before{content:"\f7fa"}.fa-briefcase-medical:before{content:"\f469"}.fa-genderless:before{content:"\f22d"}.fa-chevron-right:before{content:"\f054"}.fa-retweet:before{content:"\f079"}.fa-car-alt:before,.fa-car-rear:before{content:"\f5de"}.fa-pump-soap:before{content:"\e06b"}.fa-video-slash:before{content:"\f4e2"}.fa-battery-2:before,.fa-battery-quarter:before{content:"\f243"}.fa-radio:before{content:"\f8d7"}.fa-baby-carriage:before,.fa-carriage-baby:before{content:"\f77d"}.fa-traffic-light:before{content:"\f637"}.fa-thermometer:before{content:"\f491"}.fa-vr-cardboard:before{content:"\f729"}.fa-hand-middle-finger:before{content:"\f806"}.fa-percent:before,.fa-percentage:before{content:"\25"}.fa-truck-moving:before{content:"\f4df"}.fa-glass-water-droplet:before{content:"\e4f5"}.fa-display:before{content:"\e163"}.fa-face-smile:before,.fa-smile:before{content:"\f118"}.fa-thumb-tack:before,.fa-thumbtack:before{content:"\f08d"}.fa-trophy:before{content:"\f091"}.fa-person-praying:before,.fa-pray:before{content:"\f683"}.fa-hammer:before{content:"\f6e3"}.fa-hand-peace:before{content:"\f25b"}.fa-rotate:before,.fa-sync-alt:before{content:"\f2f1"}.fa-spinner:before{content:"\f110"}.fa-robot:before{content:"\f544"}.fa-peace:before{content:"\f67c"}.fa-cogs:before,.fa-gears:before{content:"\f085"}.fa-warehouse:before{content:"\f494"}.fa-arrow-up-right-dots:before{content:"\e4b7"}.fa-splotch:before{content:"\f5bc"}.fa-face-grin-hearts:before,.fa-grin-hearts:before{content:"\f584"}.fa-dice-four:before{content:"\f524"}.fa-sim-card:before{content:"\f7c4"}.fa-transgender-alt:before,.fa-transgender:before{content:"\f225"}.fa-mercury:before{content:"\f223"}.fa-arrow-turn-down:before,.fa-level-down:before{content:"\f149"}.fa-person-falling-burst:before{content:"\e547"}.fa-award:before{content:"\f559"}.fa-ticket-alt:before,.fa-ticket-simple:before{content:"\f3ff"}.fa-building:before{content:"\f1ad"}.fa-angle-double-left:before,.fa-angles-left:before{content:"\f100"}.fa-qrcode:before{content:"\f029"}.fa-clock-rotate-left:before,.fa-history:before{content:"\f1da"}.fa-face-grin-beam-sweat:before,.fa-grin-beam-sweat:before{content:"\f583"}.fa-arrow-right-from-file:before,.fa-file-export:before{content:"\f56e"}.fa-shield-blank:before,.fa-shield:before{content:"\f132"}.fa-arrow-up-short-wide:before,.fa-sort-amount-up-alt:before{content:"\f885"}.fa-house-medical:before{content:"\e3b2"}.fa-golf-ball-tee:before,.fa-golf-ball:before{content:"\f450"}.fa-chevron-circle-left:before,.fa-circle-chevron-left:before{content:"\f137"}.fa-house-chimney-window:before{content:"\e00d"}.fa-pen-nib:before{content:"\f5ad"}.fa-tent-arrow-turn-left:before{content:"\e580"}.fa-tents:before{content:"\e582"}.fa-magic:before,.fa-wand-magic:before{content:"\f0d0"}.fa-dog:before{content:"\f6d3"}.fa-carrot:before{content:"\f787"}.fa-moon:before{content:"\f186"}.fa-wine-glass-alt:before,.fa-wine-glass-empty:before{content:"\f5ce"}.fa-cheese:before{content:"\f7ef"}.fa-yin-yang:before{content:"\f6ad"}.fa-music:before{content:"\f001"}.fa-code-commit:before{content:"\f386"}.fa-temperature-low:before{content:"\f76b"}.fa-biking:before,.fa-person-biking:before{content:"\f84a"}.fa-broom:before{content:"\f51a"}.fa-shield-heart:before{content:"\e574"}.fa-gopuram:before{content:"\f664"}.fa-earth-oceania:before,.fa-globe-oceania:before{content:"\e47b"}.fa-square-xmark:before,.fa-times-square:before,.fa-xmark-square:before{content:"\f2d3"}.fa-hashtag:before{content:"\23"}.fa-expand-alt:before,.fa-up-right-and-down-left-from-center:before{content:"\f424"}.fa-oil-can:before{content:"\f613"}.fa-t:before{content:"\54"}.fa-hippo:before{content:"\f6ed"}.fa-chart-column:before{content:"\e0e3"}.fa-infinity:before{content:"\f534"}.fa-vial-circle-check:before{content:"\e596"}.fa-person-arrow-down-to-line:before{content:"\e538"}.fa-voicemail:before{content:"\f897"}.fa-fan:before{content:"\f863"}.fa-person-walking-luggage:before{content:"\e554"}.fa-arrows-alt-v:before,.fa-up-down:before{content:"\f338"}.fa-cloud-moon-rain:before{content:"\f73c"}.fa-calendar:before{content:"\f133"}.fa-trailer:before{content:"\e041"}.fa-bahai:before,.fa-haykal:before{content:"\f666"}.fa-sd-card:before{content:"\f7c2"}.fa-dragon:before{content:"\f6d5"}.fa-shoe-prints:before{content:"\f54b"}.fa-circle-plus:before,.fa-plus-circle:before{content:"\f055"}.fa-face-grin-tongue-wink:before,.fa-grin-tongue-wink:before{content:"\f58b"}.fa-hand-holding:before{content:"\f4bd"}.fa-plug-circle-exclamation:before{content:"\e55d"}.fa-chain-broken:before,.fa-chain-slash:before,.fa-link-slash:before,.fa-unlink:before{content:"\f127"}.fa-clone:before{content:"\f24d"}.fa-person-walking-arrow-loop-left:before{content:"\e551"}.fa-arrow-up-z-a:before,.fa-sort-alpha-up-alt:before{content:"\f882"}.fa-fire-alt:before,.fa-fire-flame-curved:before{content:"\f7e4"}.fa-tornado:before{content:"\f76f"}.fa-file-circle-plus:before{content:"\e494"}.fa-book-quran:before,.fa-quran:before{content:"\f687"}.fa-anchor:before{content:"\f13d"}.fa-border-all:before{content:"\f84c"}.fa-angry:before,.fa-face-angry:before{content:"\f556"}.fa-cookie-bite:before{content:"\f564"}.fa-arrow-trend-down:before{content:"\e097"}.fa-feed:before,.fa-rss:before{content:"\f09e"}.fa-draw-polygon:before{content:"\f5ee"}.fa-balance-scale:before,.fa-scale-balanced:before{content:"\f24e"}.fa-gauge-simple-high:before,.fa-tachometer-fast:before,.fa-tachometer:before{content:"\f62a"}.fa-shower:before{content:"\f2cc"}.fa-desktop-alt:before,.fa-desktop:before{content:"\f390"}.fa-m:before{content:"\4d"}.fa-table-list:before,.fa-th-list:before{content:"\f00b"}.fa-comment-sms:before,.fa-sms:before{content:"\f7cd"}.fa-book:before{content:"\f02d"}.fa-user-plus:before{content:"\f234"}.fa-check:before{content:"\f00c"}.fa-battery-4:before,.fa-battery-three-quarters:before{content:"\f241"}.fa-house-circle-check:before{content:"\e509"}.fa-angle-left:before{content:"\f104"}.fa-diagram-successor:before{content:"\e47a"}.fa-truck-arrow-right:before{content:"\e58b"}.fa-arrows-split-up-and-left:before{content:"\e4bc"}.fa-fist-raised:before,.fa-hand-fist:before{content:"\f6de"}.fa-cloud-moon:before{content:"\f6c3"}.fa-briefcase:before{content:"\f0b1"}.fa-person-falling:before{content:"\e546"}.fa-image-portrait:before,.fa-portrait:before{content:"\f3e0"}.fa-user-tag:before{content:"\f507"}.fa-rug:before{content:"\e569"}.fa-earth-europe:before,.fa-globe-europe:before{content:"\f7a2"}.fa-cart-flatbed-suitcase:before,.fa-luggage-cart:before{content:"\f59d"}.fa-rectangle-times:before,.fa-rectangle-xmark:before,.fa-times-rectangle:before,.fa-window-close:before{content:"\f410"}.fa-baht-sign:before{content:"\e0ac"}.fa-book-open:before{content:"\f518"}.fa-book-journal-whills:before,.fa-journal-whills:before{content:"\f66a"}.fa-handcuffs:before{content:"\e4f8"}.fa-exclamation-triangle:before,.fa-triangle-exclamation:before,.fa-warning:before{content:"\f071"}.fa-database:before{content:"\f1c0"}.fa-arrow-turn-right:before,.fa-mail-forward:before,.fa-share:before{content:"\f064"}.fa-bottle-droplet:before{content:"\e4c4"}.fa-mask-face:before{content:"\e1d7"}.fa-hill-rockslide:before{content:"\e508"}.fa-exchange-alt:before,.fa-right-left:before{content:"\f362"}.fa-paper-plane:before{content:"\f1d8"}.fa-road-circle-exclamation:before{content:"\e565"}.fa-dungeon:before{content:"\f6d9"}.fa-align-right:before{content:"\f038"}.fa-money-bill-1-wave:before,.fa-money-bill-wave-alt:before{content:"\f53b"}.fa-life-ring:before{content:"\f1cd"}.fa-hands:before,.fa-sign-language:before,.fa-signing:before{content:"\f2a7"}.fa-calendar-day:before{content:"\f783"}.fa-ladder-water:before,.fa-swimming-pool:before,.fa-water-ladder:before{content:"\f5c5"}.fa-arrows-up-down:before,.fa-arrows-v:before{content:"\f07d"}.fa-face-grimace:before,.fa-grimace:before{content:"\f57f"}.fa-wheelchair-alt:before,.fa-wheelchair-move:before{content:"\e2ce"}.fa-level-down-alt:before,.fa-turn-down:before{content:"\f3be"}.fa-person-walking-arrow-right:before{content:"\e552"}.fa-envelope-square:before,.fa-square-envelope:before{content:"\f199"}.fa-dice:before{content:"\f522"}.fa-bowling-ball:before{content:"\f436"}.fa-brain:before{content:"\f5dc"}.fa-band-aid:before,.fa-bandage:before{content:"\f462"}.fa-calendar-minus:before{content:"\f272"}.fa-circle-xmark:before,.fa-times-circle:before,.fa-xmark-circle:before{content:"\f057"}.fa-gifts:before{content:"\f79c"}.fa-hotel:before{content:"\f594"}.fa-earth-asia:before,.fa-globe-asia:before{content:"\f57e"}.fa-id-card-alt:before,.fa-id-card-clip:before{content:"\f47f"}.fa-magnifying-glass-plus:before,.fa-search-plus:before{content:"\f00e"}.fa-thumbs-up:before{content:"\f164"}.fa-user-clock:before{content:"\f4fd"}.fa-allergies:before,.fa-hand-dots:before{content:"\f461"}.fa-file-invoice:before{content:"\f570"}.fa-window-minimize:before{content:"\f2d1"}.fa-coffee:before,.fa-mug-saucer:before{content:"\f0f4"}.fa-brush:before{content:"\f55d"}.fa-mask:before{content:"\f6fa"}.fa-magnifying-glass-minus:before,.fa-search-minus:before{content:"\f010"}.fa-ruler-vertical:before{content:"\f548"}.fa-user-alt:before,.fa-user-large:before{content:"\f406"}.fa-train-tram:before{content:"\e5b4"}.fa-user-nurse:before{content:"\f82f"}.fa-syringe:before{content:"\f48e"}.fa-cloud-sun:before{content:"\f6c4"}.fa-stopwatch-20:before{content:"\e06f"}.fa-square-full:before{content:"\f45c"}.fa-magnet:before{content:"\f076"}.fa-jar:before{content:"\e516"}.fa-note-sticky:before,.fa-sticky-note:before{content:"\f249"}.fa-bug-slash:before{content:"\e490"}.fa-arrow-up-from-water-pump:before{content:"\e4b6"}.fa-bone:before{content:"\f5d7"}.fa-user-injured:before{content:"\f728"}.fa-face-sad-tear:before,.fa-sad-tear:before{content:"\f5b4"}.fa-plane:before{content:"\f072"}.fa-tent-arrows-down:before{content:"\e581"}.fa-exclamation:before{content:"\21"}.fa-arrows-spin:before{content:"\e4bb"}.fa-print:before{content:"\f02f"}.fa-try:before,.fa-turkish-lira-sign:before,.fa-turkish-lira:before{content:"\e2bb"}.fa-dollar-sign:before,.fa-dollar:before,.fa-usd:before{content:"\24"}.fa-x:before{content:"\58"}.fa-magnifying-glass-dollar:before,.fa-search-dollar:before{content:"\f688"}.fa-users-cog:before,.fa-users-gear:before{content:"\f509"}.fa-person-military-pointing:before{content:"\e54a"}.fa-bank:before,.fa-building-columns:before,.fa-institution:before,.fa-museum:before,.fa-university:before{content:"\f19c"}.fa-umbrella:before{content:"\f0e9"}.fa-trowel:before{content:"\e589"}.fa-d:before{content:"\44"}.fa-stapler:before{content:"\e5af"}.fa-masks-theater:before,.fa-theater-masks:before{content:"\f630"}.fa-kip-sign:before{content:"\e1c4"}.fa-hand-point-left:before{content:"\f0a5"}.fa-handshake-alt:before,.fa-handshake-simple:before{content:"\f4c6"}.fa-fighter-jet:before,.fa-jet-fighter:before{content:"\f0fb"}.fa-share-alt-square:before,.fa-square-share-nodes:before{content:"\f1e1"}.fa-barcode:before{content:"\f02a"}.fa-plus-minus:before{content:"\e43c"}.fa-video-camera:before,.fa-video:before{content:"\f03d"}.fa-graduation-cap:before,.fa-mortar-board:before{content:"\f19d"}.fa-hand-holding-medical:before{content:"\e05c"}.fa-person-circle-check:before{content:"\e53e"}.fa-level-up-alt:before,.fa-turn-up:before{content:"\f3bf"}
-.fa-sr-only,.fa-sr-only-focusable:not(:focus),.sr-only,.sr-only-focusable:not(:focus){position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border-width:0}:host,:root{--fa-style-family-brands:"Font Awesome 6 Brands";--fa-font-brands:normal 400 1em/1 "Font Awesome 6 Brands"}@font-face{font-family:"Font Awesome 6 Brands";font-style:normal;font-weight:400;font-display:block;src:url(../webfonts/fa-brands-400.woff2) format("woff2"),url(../webfonts/fa-brands-400.ttf) format("truetype")}.fa-brands,.fab{font-weight:400}.fa-monero:before{content:"\f3d0"}.fa-hooli:before{content:"\f427"}.fa-yelp:before{content:"\f1e9"}.fa-cc-visa:before{content:"\f1f0"}.fa-lastfm:before{content:"\f202"}.fa-shopware:before{content:"\f5b5"}.fa-creative-commons-nc:before{content:"\f4e8"}.fa-aws:before{content:"\f375"}.fa-redhat:before{content:"\f7bc"}.fa-yoast:before{content:"\f2b1"}.fa-cloudflare:before{content:"\e07d"}.fa-ups:before{content:"\f7e0"}.fa-wpexplorer:before{content:"\f2de"}.fa-dyalog:before{content:"\f399"}.fa-bity:before{content:"\f37a"}.fa-stackpath:before{content:"\f842"}.fa-buysellads:before{content:"\f20d"}.fa-first-order:before{content:"\f2b0"}.fa-modx:before{content:"\f285"}.fa-guilded:before{content:"\e07e"}.fa-vnv:before{content:"\f40b"}.fa-js-square:before,.fa-square-js:before{content:"\f3b9"}.fa-microsoft:before{content:"\f3ca"}.fa-qq:before{content:"\f1d6"}.fa-orcid:before{content:"\f8d2"}.fa-java:before{content:"\f4e4"}.fa-invision:before{content:"\f7b0"}.fa-creative-commons-pd-alt:before{content:"\f4ed"}.fa-centercode:before{content:"\f380"}.fa-glide-g:before{content:"\f2a6"}.fa-drupal:before{content:"\f1a9"}.fa-hire-a-helper:before{content:"\f3b0"}.fa-creative-commons-by:before{content:"\f4e7"}.fa-unity:before{content:"\e049"}.fa-whmcs:before{content:"\f40d"}.fa-rocketchat:before{content:"\f3e8"}.fa-vk:before{content:"\f189"}.fa-untappd:before{content:"\f405"}.fa-mailchimp:before{content:"\f59e"}.fa-css3-alt:before{content:"\f38b"}.fa-reddit-square:before,.fa-square-reddit:before{content:"\f1a2"}.fa-vimeo-v:before{content:"\f27d"}.fa-contao:before{content:"\f26d"}.fa-square-font-awesome:before{content:"\e5ad"}.fa-deskpro:before{content:"\f38f"}.fa-sistrix:before{content:"\f3ee"}.fa-instagram-square:before,.fa-square-instagram:before{content:"\e055"}.fa-battle-net:before{content:"\f835"}.fa-the-red-yeti:before{content:"\f69d"}.fa-hacker-news-square:before,.fa-square-hacker-news:before{content:"\f3af"}.fa-edge:before{content:"\f282"}.fa-napster:before{content:"\f3d2"}.fa-snapchat-square:before,.fa-square-snapchat:before{content:"\f2ad"}.fa-google-plus-g:before{content:"\f0d5"}.fa-artstation:before{content:"\f77a"}.fa-markdown:before{content:"\f60f"}.fa-sourcetree:before{content:"\f7d3"}.fa-google-plus:before{content:"\f2b3"}.fa-diaspora:before{content:"\f791"}.fa-foursquare:before{content:"\f180"}.fa-stack-overflow:before{content:"\f16c"}.fa-github-alt:before{content:"\f113"}.fa-phoenix-squadron:before{content:"\f511"}.fa-pagelines:before{content:"\f18c"}.fa-algolia:before{content:"\f36c"}.fa-red-river:before{content:"\f3e3"}.fa-creative-commons-sa:before{content:"\f4ef"}.fa-safari:before{content:"\f267"}.fa-google:before{content:"\f1a0"}.fa-font-awesome-alt:before,.fa-square-font-awesome-stroke:before{content:"\f35c"}.fa-atlassian:before{content:"\f77b"}.fa-linkedin-in:before{content:"\f0e1"}.fa-digital-ocean:before{content:"\f391"}.fa-nimblr:before{content:"\f5a8"}.fa-chromecast:before{content:"\f838"}.fa-evernote:before{content:"\f839"}.fa-hacker-news:before{content:"\f1d4"}.fa-creative-commons-sampling:before{content:"\f4f0"}.fa-adversal:before{content:"\f36a"}.fa-creative-commons:before{content:"\f25e"}.fa-watchman-monitoring:before{content:"\e087"}.fa-fonticons:before{content:"\f280"}.fa-weixin:before{content:"\f1d7"}.fa-shirtsinbulk:before{content:"\f214"}.fa-codepen:before{content:"\f1cb"}.fa-git-alt:before{content:"\f841"}.fa-lyft:before{content:"\f3c3"}.fa-rev:before{content:"\f5b2"}.fa-windows:before{content:"\f17a"}.fa-wizards-of-the-coast:before{content:"\f730"}.fa-square-viadeo:before,.fa-viadeo-square:before{content:"\f2aa"}.fa-meetup:before{content:"\f2e0"}.fa-centos:before{content:"\f789"}.fa-adn:before{content:"\f170"}.fa-cloudsmith:before{content:"\f384"}.fa-pied-piper-alt:before{content:"\f1a8"}.fa-dribbble-square:before,.fa-square-dribbble:before{content:"\f397"}.fa-codiepie:before{content:"\f284"}.fa-node:before{content:"\f419"}.fa-mix:before{content:"\f3cb"}.fa-steam:before{content:"\f1b6"}.fa-cc-apple-pay:before{content:"\f416"}.fa-scribd:before{content:"\f28a"}.fa-openid:before{content:"\f19b"}.fa-instalod:before{content:"\e081"}.fa-expeditedssl:before{content:"\f23e"}.fa-sellcast:before{content:"\f2da"}.fa-square-twitter:before,.fa-twitter-square:before{content:"\f081"}.fa-r-project:before{content:"\f4f7"}.fa-delicious:before{content:"\f1a5"}.fa-freebsd:before{content:"\f3a4"}.fa-vuejs:before{content:"\f41f"}.fa-accusoft:before{content:"\f369"}.fa-ioxhost:before{content:"\f208"}.fa-fonticons-fi:before{content:"\f3a2"}.fa-app-store:before{content:"\f36f"}.fa-cc-mastercard:before{content:"\f1f1"}.fa-itunes-note:before{content:"\f3b5"}.fa-golang:before{content:"\e40f"}.fa-kickstarter:before{content:"\f3bb"}.fa-grav:before{content:"\f2d6"}.fa-weibo:before{content:"\f18a"}.fa-uncharted:before{content:"\e084"}.fa-firstdraft:before{content:"\f3a1"}.fa-square-youtube:before,.fa-youtube-square:before{content:"\f431"}.fa-wikipedia-w:before{content:"\f266"}.fa-rendact:before,.fa-wpressr:before{content:"\f3e4"}.fa-angellist:before{content:"\f209"}.fa-galactic-republic:before{content:"\f50c"}.fa-nfc-directional:before{content:"\e530"}.fa-skype:before{content:"\f17e"}.fa-joget:before{content:"\f3b7"}.fa-fedora:before{content:"\f798"}.fa-stripe-s:before{content:"\f42a"}.fa-meta:before{content:"\e49b"}.fa-laravel:before{content:"\f3bd"}.fa-hotjar:before{content:"\f3b1"}.fa-bluetooth-b:before{content:"\f294"}.fa-sticker-mule:before{content:"\f3f7"}.fa-creative-commons-zero:before{content:"\f4f3"}.fa-hips:before{content:"\f452"}.fa-behance:before{content:"\f1b4"}.fa-reddit:before{content:"\f1a1"}.fa-discord:before{content:"\f392"}.fa-chrome:before{content:"\f268"}.fa-app-store-ios:before{content:"\f370"}.fa-cc-discover:before{content:"\f1f2"}.fa-wpbeginner:before{content:"\f297"}.fa-confluence:before{content:"\f78d"}.fa-mdb:before{content:"\f8ca"}.fa-dochub:before{content:"\f394"}.fa-accessible-icon:before{content:"\f368"}.fa-ebay:before{content:"\f4f4"}.fa-amazon:before{content:"\f270"}.fa-unsplash:before{content:"\e07c"}.fa-yarn:before{content:"\f7e3"}.fa-square-steam:before,.fa-steam-square:before{content:"\f1b7"}.fa-500px:before{content:"\f26e"}.fa-square-vimeo:before,.fa-vimeo-square:before{content:"\f194"}.fa-asymmetrik:before{content:"\f372"}.fa-font-awesome-flag:before,.fa-font-awesome-logo-full:before,.fa-font-awesome:before{content:"\f2b4"}.fa-gratipay:before{content:"\f184"}.fa-apple:before{content:"\f179"}.fa-hive:before{content:"\e07f"}.fa-gitkraken:before{content:"\f3a6"}.fa-keybase:before{content:"\f4f5"}.fa-apple-pay:before{content:"\f415"}.fa-padlet:before{content:"\e4a0"}.fa-amazon-pay:before{content:"\f42c"}.fa-github-square:before,.fa-square-github:before{content:"\f092"}.fa-stumbleupon:before{content:"\f1a4"}.fa-fedex:before{content:"\f797"}.fa-phoenix-framework:before{content:"\f3dc"}.fa-shopify:before{content:"\e057"}.fa-neos:before{content:"\f612"}.fa-hackerrank:before{content:"\f5f7"}.fa-researchgate:before{content:"\f4f8"}.fa-swift:before{content:"\f8e1"}.fa-angular:before{content:"\f420"}.fa-speakap:before{content:"\f3f3"}.fa-angrycreative:before{content:"\f36e"}.fa-y-combinator:before{content:"\f23b"}.fa-empire:before{content:"\f1d1"}.fa-envira:before{content:"\f299"}.fa-gitlab-square:before,.fa-square-gitlab:before{content:"\e5ae"}.fa-studiovinari:before{content:"\f3f8"}.fa-pied-piper:before{content:"\f2ae"}.fa-wordpress:before{content:"\f19a"}.fa-product-hunt:before{content:"\f288"}.fa-firefox:before{content:"\f269"}.fa-linode:before{content:"\f2b8"}.fa-goodreads:before{content:"\f3a8"}.fa-odnoklassniki-square:before,.fa-square-odnoklassniki:before{content:"\f264"}.fa-jsfiddle:before{content:"\f1cc"}.fa-sith:before{content:"\f512"}.fa-themeisle:before{content:"\f2b2"}.fa-page4:before{content:"\f3d7"}.fa-hashnode:before{content:"\e499"}.fa-react:before{content:"\f41b"}.fa-cc-paypal:before{content:"\f1f4"}.fa-squarespace:before{content:"\f5be"}.fa-cc-stripe:before{content:"\f1f5"}.fa-creative-commons-share:before{content:"\f4f2"}.fa-bitcoin:before{content:"\f379"}.fa-keycdn:before{content:"\f3ba"}.fa-opera:before{content:"\f26a"}.fa-itch-io:before{content:"\f83a"}.fa-umbraco:before{content:"\f8e8"}.fa-galactic-senate:before{content:"\f50d"}.fa-ubuntu:before{content:"\f7df"}.fa-draft2digital:before{content:"\f396"}.fa-stripe:before{content:"\f429"}.fa-houzz:before{content:"\f27c"}.fa-gg:before{content:"\f260"}.fa-dhl:before{content:"\f790"}.fa-pinterest-square:before,.fa-square-pinterest:before{content:"\f0d3"}.fa-xing:before{content:"\f168"}.fa-blackberry:before{content:"\f37b"}.fa-creative-commons-pd:before{content:"\f4ec"}.fa-playstation:before{content:"\f3df"}.fa-quinscape:before{content:"\f459"}.fa-less:before{content:"\f41d"}.fa-blogger-b:before{content:"\f37d"}.fa-opencart:before{content:"\f23d"}.fa-vine:before{content:"\f1ca"}.fa-paypal:before{content:"\f1ed"}.fa-gitlab:before{content:"\f296"}.fa-typo3:before{content:"\f42b"}.fa-reddit-alien:before{content:"\f281"}.fa-yahoo:before{content:"\f19e"}.fa-dailymotion:before{content:"\e052"}.fa-affiliatetheme:before{content:"\f36b"}.fa-pied-piper-pp:before{content:"\f1a7"}.fa-bootstrap:before{content:"\f836"}.fa-odnoklassniki:before{content:"\f263"}.fa-nfc-symbol:before{content:"\e531"}.fa-ethereum:before{content:"\f42e"}.fa-speaker-deck:before{content:"\f83c"}.fa-creative-commons-nc-eu:before{content:"\f4e9"}.fa-patreon:before{content:"\f3d9"}.fa-avianex:before{content:"\f374"}.fa-ello:before{content:"\f5f1"}.fa-gofore:before{content:"\f3a7"}.fa-bimobject:before{content:"\f378"}.fa-facebook-f:before{content:"\f39e"}.fa-google-plus-square:before,.fa-square-google-plus:before{content:"\f0d4"}.fa-mandalorian:before{content:"\f50f"}.fa-first-order-alt:before{content:"\f50a"}.fa-osi:before{content:"\f41a"}.fa-google-wallet:before{content:"\f1ee"}.fa-d-and-d-beyond:before{content:"\f6ca"}.fa-periscope:before{content:"\f3da"}.fa-fulcrum:before{content:"\f50b"}.fa-cloudscale:before{content:"\f383"}.fa-forumbee:before{content:"\f211"}.fa-mizuni:before{content:"\f3cc"}.fa-schlix:before{content:"\f3ea"}.fa-square-xing:before,.fa-xing-square:before{content:"\f169"}.fa-bandcamp:before{content:"\f2d5"}.fa-wpforms:before{content:"\f298"}.fa-cloudversify:before{content:"\f385"}.fa-usps:before{content:"\f7e1"}.fa-megaport:before{content:"\f5a3"}.fa-magento:before{content:"\f3c4"}.fa-spotify:before{content:"\f1bc"}.fa-optin-monster:before{content:"\f23c"}.fa-fly:before{content:"\f417"}.fa-aviato:before{content:"\f421"}.fa-itunes:before{content:"\f3b4"}.fa-cuttlefish:before{content:"\f38c"}.fa-blogger:before{content:"\f37c"}.fa-flickr:before{content:"\f16e"}.fa-viber:before{content:"\f409"}.fa-soundcloud:before{content:"\f1be"}.fa-digg:before{content:"\f1a6"}.fa-tencent-weibo:before{content:"\f1d5"}.fa-symfony:before{content:"\f83d"}.fa-maxcdn:before{content:"\f136"}.fa-etsy:before{content:"\f2d7"}.fa-facebook-messenger:before{content:"\f39f"}.fa-audible:before{content:"\f373"}.fa-think-peaks:before{content:"\f731"}.fa-bilibili:before{content:"\e3d9"}.fa-erlang:before{content:"\f39d"}.fa-cotton-bureau:before{content:"\f89e"}.fa-dashcube:before{content:"\f210"}.fa-42-group:before,.fa-innosoft:before{content:"\e080"}.fa-stack-exchange:before{content:"\f18d"}.fa-elementor:before{content:"\f430"}.fa-pied-piper-square:before,.fa-square-pied-piper:before{content:"\e01e"}.fa-creative-commons-nd:before{content:"\f4eb"}.fa-palfed:before{content:"\f3d8"}.fa-superpowers:before{content:"\f2dd"}.fa-resolving:before{content:"\f3e7"}.fa-xbox:before{content:"\f412"}.fa-searchengin:before{content:"\f3eb"}.fa-tiktok:before{content:"\e07b"}.fa-facebook-square:before,.fa-square-facebook:before{content:"\f082"}.fa-renren:before{content:"\f18b"}.fa-linux:before{content:"\f17c"}.fa-glide:before{content:"\f2a5"}.fa-linkedin:before{content:"\f08c"}.fa-hubspot:before{content:"\f3b2"}.fa-deploydog:before{content:"\f38e"}.fa-twitch:before{content:"\f1e8"}.fa-ravelry:before{content:"\f2d9"}.fa-mixer:before{content:"\e056"}.fa-lastfm-square:before,.fa-square-lastfm:before{content:"\f203"}.fa-vimeo:before{content:"\f40a"}.fa-mendeley:before{content:"\f7b3"}.fa-uniregistry:before{content:"\f404"}.fa-figma:before{content:"\f799"}.fa-creative-commons-remix:before{content:"\f4ee"}.fa-cc-amazon-pay:before{content:"\f42d"}.fa-dropbox:before{content:"\f16b"}.fa-instagram:before{content:"\f16d"}.fa-cmplid:before{content:"\e360"}.fa-facebook:before{content:"\f09a"}.fa-gripfire:before{content:"\f3ac"}.fa-jedi-order:before{content:"\f50e"}.fa-uikit:before{content:"\f403"}.fa-fort-awesome-alt:before{content:"\f3a3"}.fa-phabricator:before{content:"\f3db"}.fa-ussunnah:before{content:"\f407"}.fa-earlybirds:before{content:"\f39a"}.fa-trade-federation:before{content:"\f513"}.fa-autoprefixer:before{content:"\f41c"}.fa-whatsapp:before{content:"\f232"}.fa-slideshare:before{content:"\f1e7"}.fa-google-play:before{content:"\f3ab"}.fa-viadeo:before{content:"\f2a9"}.fa-line:before{content:"\f3c0"}.fa-google-drive:before{content:"\f3aa"}.fa-servicestack:before{content:"\f3ec"}.fa-simplybuilt:before{content:"\f215"}.fa-bitbucket:before{content:"\f171"}.fa-imdb:before{content:"\f2d8"}.fa-deezer:before{content:"\e077"}.fa-raspberry-pi:before{content:"\f7bb"}.fa-jira:before{content:"\f7b1"}.fa-docker:before{content:"\f395"}.fa-screenpal:before{content:"\e570"}.fa-bluetooth:before{content:"\f293"}.fa-gitter:before{content:"\f426"}.fa-d-and-d:before{content:"\f38d"}.fa-microblog:before{content:"\e01a"}.fa-cc-diners-club:before{content:"\f24c"}.fa-gg-circle:before{content:"\f261"}.fa-pied-piper-hat:before{content:"\f4e5"}.fa-kickstarter-k:before{content:"\f3bc"}.fa-yandex:before{content:"\f413"}.fa-readme:before{content:"\f4d5"}.fa-html5:before{content:"\f13b"}.fa-sellsy:before{content:"\f213"}.fa-sass:before{content:"\f41e"}.fa-wirsindhandwerk:before,.fa-wsh:before{content:"\e2d0"}.fa-buromobelexperte:before{content:"\f37f"}.fa-salesforce:before{content:"\f83b"}.fa-octopus-deploy:before{content:"\e082"}.fa-medapps:before{content:"\f3c6"}.fa-ns8:before{content:"\f3d5"}.fa-pinterest-p:before{content:"\f231"}.fa-apper:before{content:"\f371"}.fa-fort-awesome:before{content:"\f286"}.fa-waze:before{content:"\f83f"}.fa-cc-jcb:before{content:"\f24b"}.fa-snapchat-ghost:before,.fa-snapchat:before{content:"\f2ab"}.fa-fantasy-flight-games:before{content:"\f6dc"}.fa-rust:before{content:"\e07a"}.fa-wix:before{content:"\f5cf"}.fa-behance-square:before,.fa-square-behance:before{content:"\f1b5"}.fa-supple:before{content:"\f3f9"}.fa-rebel:before{content:"\f1d0"}.fa-css3:before{content:"\f13c"}.fa-staylinked:before{content:"\f3f5"}.fa-kaggle:before{content:"\f5fa"}.fa-space-awesome:before{content:"\e5ac"}.fa-deviantart:before{content:"\f1bd"}.fa-cpanel:before{content:"\f388"}.fa-goodreads-g:before{content:"\f3a9"}.fa-git-square:before,.fa-square-git:before{content:"\f1d2"}.fa-square-tumblr:before,.fa-tumblr-square:before{content:"\f174"}.fa-trello:before{content:"\f181"}.fa-creative-commons-nc-jp:before{content:"\f4ea"}.fa-get-pocket:before{content:"\f265"}.fa-perbyte:before{content:"\e083"}.fa-grunt:before{content:"\f3ad"}.fa-weebly:before{content:"\f5cc"}.fa-connectdevelop:before{content:"\f20e"}.fa-leanpub:before{content:"\f212"}.fa-black-tie:before{content:"\f27e"}.fa-themeco:before{content:"\f5c6"}.fa-python:before{content:"\f3e2"}.fa-android:before{content:"\f17b"}.fa-bots:before{content:"\e340"}.fa-free-code-camp:before{content:"\f2c5"}.fa-hornbill:before{content:"\f592"}.fa-js:before{content:"\f3b8"}.fa-ideal:before{content:"\e013"}.fa-git:before{content:"\f1d3"}.fa-dev:before{content:"\f6cc"}.fa-sketch:before{content:"\f7c6"}.fa-yandex-international:before{content:"\f414"}.fa-cc-amex:before{content:"\f1f3"}.fa-uber:before{content:"\f402"}.fa-github:before{content:"\f09b"}.fa-php:before{content:"\f457"}.fa-alipay:before{content:"\f642"}.fa-youtube:before{content:"\f167"}.fa-skyatlas:before{content:"\f216"}.fa-firefox-browser:before{content:"\e007"}.fa-replyd:before{content:"\f3e6"}.fa-suse:before{content:"\f7d6"}.fa-jenkins:before{content:"\f3b6"}.fa-twitter:before{content:"\f099"}.fa-rockrms:before{content:"\f3e9"}.fa-pinterest:before{content:"\f0d2"}.fa-buffer:before{content:"\f837"}.fa-npm:before{content:"\f3d4"}.fa-yammer:before{content:"\f840"}.fa-btc:before{content:"\f15a"}.fa-dribbble:before{content:"\f17d"}.fa-stumbleupon-circle:before{content:"\f1a3"}.fa-internet-explorer:before{content:"\f26b"}.fa-stubber:before{content:"\e5c7"}.fa-telegram-plane:before,.fa-telegram:before{content:"\f2c6"}.fa-old-republic:before{content:"\f510"}.fa-odysee:before{content:"\e5c6"}.fa-square-whatsapp:before,.fa-whatsapp-square:before{content:"\f40c"}.fa-node-js:before{content:"\f3d3"}.fa-edge-legacy:before{content:"\e078"}.fa-slack-hash:before,.fa-slack:before{content:"\f198"}.fa-medrt:before{content:"\f3c8"}.fa-usb:before{content:"\f287"}.fa-tumblr:before{content:"\f173"}.fa-vaadin:before{content:"\f408"}.fa-quora:before{content:"\f2c4"}.fa-reacteurope:before{content:"\f75d"}.fa-medium-m:before,.fa-medium:before{content:"\f23a"}.fa-amilia:before{content:"\f36d"}.fa-mixcloud:before{content:"\f289"}.fa-flipboard:before{content:"\f44d"}.fa-viacoin:before{content:"\f237"}.fa-critical-role:before{content:"\f6c9"}.fa-sitrox:before{content:"\e44a"}.fa-discourse:before{content:"\f393"}.fa-joomla:before{content:"\f1aa"}.fa-mastodon:before{content:"\f4f6"}.fa-airbnb:before{content:"\f834"}.fa-wolf-pack-battalion:before{content:"\f514"}.fa-buy-n-large:before{content:"\f8a6"}.fa-gulp:before{content:"\f3ae"}.fa-creative-commons-sampling-plus:before{content:"\f4f1"}.fa-strava:before{content:"\f428"}.fa-ember:before{content:"\f423"}.fa-canadian-maple-leaf:before{content:"\f785"}.fa-teamspeak:before{content:"\f4f9"}.fa-pushed:before{content:"\f3e1"}.fa-wordpress-simple:before{content:"\f411"}.fa-nutritionix:before{content:"\f3d6"}.fa-wodu:before{content:"\e088"}.fa-google-pay:before{content:"\e079"}.fa-intercom:before{content:"\f7af"}.fa-zhihu:before{content:"\f63f"}.fa-korvue:before{content:"\f42f"}.fa-pix:before{content:"\e43a"}.fa-steam-symbol:before{content:"\f3f6"}:host,:root{--fa-font-regular:normal 400 1em/1 "Font Awesome 6 Free"}@font-face{font-family:"Font Awesome 6 Free";font-style:normal;font-weight:400;font-display:block;src:url(../webfonts/fa-regular-400.woff2) format("woff2"),url(../webfonts/fa-regular-400.ttf) format("truetype")}.fa-regular,.far{font-weight:400}:host,:root{--fa-style-family-classic:"Font Awesome 6 Free";--fa-font-solid:normal 900 1em/1 "Font Awesome 6 Free"}@font-face{font-family:"Font Awesome 6 Free";font-style:normal;font-weight:900;font-display:block;src:url(../webfonts/fa-solid-900.woff2) format("woff2"),url(../webfonts/fa-solid-900.ttf) format("truetype")}.fa-solid,.fas{font-weight:900}@font-face{font-family:"Font Awesome 5 Brands";font-display:block;font-weight:400;src:url(../webfonts/fa-brands-400.woff2) format("woff2"),url(../webfonts/fa-brands-400.ttf) format("truetype")}@font-face{font-family:"Font Awesome 5 Free";font-display:block;font-weight:900;src:url(../webfonts/fa-solid-900.woff2) format("woff2"),url(../webfonts/fa-solid-900.ttf) format("truetype")}@font-face{font-family:"Font Awesome 5 Free";font-display:block;font-weight:400;src:url(../webfonts/fa-regular-400.woff2) format("woff2"),url(../webfonts/fa-regular-400.ttf) format("truetype")}@font-face{font-family:"FontAwesome";font-display:block;src:url(../webfonts/fa-solid-900.woff2) format("woff2"),url(../webfonts/fa-solid-900.ttf) format("truetype")}@font-face{font-family:"FontAwesome";font-display:block;src:url(../webfonts/fa-brands-400.woff2) format("woff2"),url(../webfonts/fa-brands-400.ttf) format("truetype")}@font-face{font-family:"FontAwesome";font-display:block;src:url(../webfonts/fa-regular-400.woff2) format("woff2"),url(../webfonts/fa-regular-400.ttf) format("truetype");unicode-range:u+f003,u+f006,u+f014,u+f016-f017,u+f01a-f01b,u+f01d,u+f022,u+f03e,u+f044,u+f046,u+f05c-f05d,u+f06e,u+f070,u+f087-f088,u+f08a,u+f094,u+f096-f097,u+f09d,u+f0a0,u+f0a2,u+f0a4-f0a7,u+f0c5,u+f0c7,u+f0e5-f0e6,u+f0eb,u+f0f6-f0f8,u+f10c,u+f114-f115,u+f118-f11a,u+f11c-f11d,u+f133,u+f147,u+f14e,u+f150-f152,u+f185-f186,u+f18e,u+f190-f192,u+f196,u+f1c1-f1c9,u+f1d9,u+f1db,u+f1e3,u+f1ea,u+f1f7,u+f1f9,u+f20a,u+f247-f248,u+f24a,u+f24d,u+f255-f25b,u+f25d,u+f271-f274,u+f278,u+f27b,u+f28c,u+f28e,u+f29c,u+f2b5,u+f2b7,u+f2ba,u+f2bc,u+f2be,u+f2c0-f2c1,u+f2c3,u+f2d0,u+f2d2,u+f2d4,u+f2dc}@font-face{font-family:"FontAwesome";font-display:block;src:url(../webfonts/fa-v4compatibility.woff2) format("woff2"),url(../webfonts/fa-v4compatibility.ttf) format("truetype");unicode-range:u+f041,u+f047,u+f065-f066,u+f07d-f07e,u+f080,u+f08b,u+f08e,u+f090,u+f09a,u+f0ac,u+f0ae,u+f0b2,u+f0d0,u+f0d6,u+f0e4,u+f0ec,u+f10a-f10b,u+f123,u+f13e,u+f148-f149,u+f14c,u+f156,u+f15e,u+f160-f161,u+f163,u+f175-f178,u+f195,u+f1f8,u+f219,u+f27a}
\ No newline at end of file
diff --git a/weed/admin/static/css/fonts/bootstrap-icons.woff b/weed/admin/static/css/fonts/bootstrap-icons.woff
new file mode 100644
index 0000000000..a4fa4f024c
Binary files /dev/null and b/weed/admin/static/css/fonts/bootstrap-icons.woff differ
diff --git a/weed/admin/static/css/fonts/bootstrap-icons.woff2 b/weed/admin/static/css/fonts/bootstrap-icons.woff2
new file mode 100644
index 0000000000..4d8c490e1e
Binary files /dev/null and b/weed/admin/static/css/fonts/bootstrap-icons.woff2 differ
diff --git a/weed/admin/static/js/admin.js b/weed/admin/static/js/admin.js
index ad9db59c0b..5de9b8bd64 100644
--- a/weed/admin/static/js/admin.js
+++ b/weed/admin/static/js/admin.js
@@ -5,6 +5,15 @@ function basePath(path) {
     return (window.__BASE_PATH__ || '') + path;
 }
 
+// Current-location checks against app paths, ignoring the URL prefix
+function isCurrentPath(path) {
+    return window.location.pathname === basePath(path);
+}
+
+function currentPathStartsWith(path) {
+    return window.location.pathname.startsWith(basePath(path));
+}
+
 // Global variables
 let bucketToDelete = '';
 
@@ -16,7 +25,7 @@ document.addEventListener('DOMContentLoaded', function () {
     setupFileManagerEventHandlers();
 
     // Initialize delete button visibility on file browser page
-    if (window.location.pathname === basePath('/files')) {
+    if (isCurrentPath('/files')) {
         updateDeleteSelectedButton();
     }
 });
@@ -71,7 +80,7 @@ function initializeTooltips() {
 function setupAutoRefresh() {
     // Refresh dashboard data every 30 seconds
     setInterval(function () {
-        if (window.location.pathname === basePath('/dashboard')) {
+        if (isCurrentPath('/dashboard')) {
             htmx.trigger('#dashboard-content', 'refresh');
         }
     }, 30000);
@@ -88,9 +97,9 @@ function setActiveNavigation() {
 
         if (href === currentPath) {
             isActive = true;
-        } else if (currentPath === '/' && href === '/admin') {
+        } else if (isCurrentPath('/') && href === basePath('/admin')) {
             isActive = true;
-        } else if (currentPath.startsWith('/s3/') && href === '/s3/buckets') {
+        } else if (currentPathStartsWith('/s3/') && href === basePath('/s3/buckets')) {
             isActive = true;
         }
         // Note: Removed the problematic cluster condition that was highlighting all submenu items
@@ -105,10 +114,8 @@ function setActiveNavigation() {
 
 // Set up submenu behavior
 function setupSubmenuBehavior() {
-    const currentPath = window.location.pathname;
-
     // If we're on a cluster page, expand the cluster submenu
-    if (currentPath.startsWith('/cluster/')) {
+    if (currentPathStartsWith('/cluster/')) {
         const clusterSubmenu = document.getElementById('clusterSubmenu');
         if (clusterSubmenu) {
             clusterSubmenu.classList.add('show');
@@ -123,7 +130,7 @@ function setupSubmenuBehavior() {
     }
 
     // If we're on an object store page, expand the object store submenu
-    if (currentPath.startsWith('/object-store/')) {
+    if (currentPathStartsWith('/object-store/')) {
         const objectStoreSubmenu = document.getElementById('objectStoreSubmenu');
         if (objectStoreSubmenu) {
             objectStoreSubmenu.classList.add('show');
@@ -272,7 +279,7 @@ function showErrorMessage(message) {
     toast.innerHTML = `
         <div class="d-flex">
             <div class="toast-body">
-                <i class="fas fa-exclamation-triangle me-2"></i>
+                <i class="bi bi-exclamation-triangle me-2"></i>
                 ${message}
             </div>
             <button type="button" class="btn-close btn-close-white me-2 m-auto" data-bs-dismiss="toast"></button>
@@ -312,7 +319,7 @@ function showSuccessMessage(message) {
     toast.innerHTML = `
         <div class="d-flex">
             <div class="toast-body">
-                <i class="fas fa-check-circle me-2"></i>
+                <i class="bi bi-check-circle me-2"></i>
                 ${message}
             </div>
             <button type="button" class="btn-close btn-close-white me-2 m-auto" data-bs-dismiss="toast"></button>
@@ -389,11 +396,7 @@ window.Dashboard = {
 // Initialize event handlers
 function initializeEventHandlers() {
     // S3 Bucket Management
-    const createBucketForm = document.getElementById('createBucketForm');
-    if (createBucketForm) {
-        createBucketForm.addEventListener('submit', handleCreateBucket);
-    }
-
+   
     // Delete bucket buttons
     document.addEventListener('click', function (e) {
         if (e.target.closest('.delete-bucket-btn')) {
@@ -627,7 +630,7 @@ function formatDate(date) {
 function adminCopyToClipboard(text) {
     if (navigator.clipboard && navigator.clipboard.writeText) {
         navigator.clipboard.writeText(text).then(() => {
-            showAlert('Copied to clipboard!', 'success');
+            showToast('Copied to clipboard!');
         }).catch(err => {
             console.error('Failed to copy text: ', err);
             fallbackCopyText(text);
@@ -653,7 +656,7 @@ function fallbackCopyText(text) {
     try {
         const successful = document.execCommand('copy');
         if (successful) {
-            showAlert('Copied to clipboard!', 'success');
+            showToast('Copied to clipboard!');
         } else {
             showAlert('Failed to copy to clipboard', 'danger');
         }
@@ -970,7 +973,7 @@ function updateDeleteSelectedButton() {
     if (deleteBtn) {
         if (checkboxes.length > 0) {
             deleteBtn.style.display = 'inline-block';
-            deleteBtn.innerHTML = `<i class="fas fa-trash me-1"></i>Delete Selected (${checkboxes.length})`;
+            deleteBtn.innerHTML = `<i class="bi bi-trash me-1"></i>Delete Selected (${checkboxes.length})`;
         } else {
             deleteBtn.style.display = 'none';
         }
@@ -1037,7 +1040,7 @@ async function deleteSelectedFiles(filePaths) {
     const deleteBtn = document.getElementById('deleteSelectedBtn');
     const originalText = deleteBtn.innerHTML;
     deleteBtn.disabled = true;
-    deleteBtn.innerHTML = '<i class="fas fa-spinner fa-spin me-1"></i>Deleting...';
+    deleteBtn.innerHTML = '<i class="bi bi-arrow-repeat icon-spin me-1"></i>Deleting...';
 
     try {
         const response = await fetch(basePath('/api/files/delete-multiple'), {
@@ -1125,7 +1128,7 @@ async function submitCreateFolder() {
     const submitButton = document.querySelector('#createFolderModal .btn-primary');
     const originalText = submitButton.innerHTML;
     submitButton.disabled = true;
-    submitButton.innerHTML = '<i class="fas fa-spinner fa-spin me-1"></i>Creating...';
+    submitButton.innerHTML = '<i class="bi bi-arrow-repeat icon-spin me-1"></i>Creating...';
 
     try {
         const response = await fetch(basePath('/api/files/create-folder'), {
@@ -1205,7 +1208,7 @@ async function submitUploadFile() {
     progressBar.textContent = '0%';
     uploadStatus.textContent = `Uploading ${files.length} file(s)...`;
     submitButton.disabled = true;
-    submitButton.innerHTML = '<i class="fas fa-spinner fa-spin me-1"></i>Uploading...';
+    submitButton.innerHTML = '<i class="bi bi-arrow-repeat icon-spin me-1"></i>Uploading...';
 
     try {
         const xhr = new XMLHttpRequest();
@@ -1506,7 +1509,7 @@ function setupDragAndDrop() {
             overlay.className = 'drag-overlay';
             overlay.innerHTML = `
                 <div class="text-center p-5">
-                    <i class="fas fa-cloud-upload-alt fa-3x text-primary mb-3"></i>
+                    <i class="bi bi-cloud-upload icon-3x text-primary mb-3"></i>
                     <h5>Drop files here to upload</h5>
                     <p class="text-muted">Release to upload files to this directory</p>
                 </div>
@@ -1586,7 +1589,7 @@ function updateFileListPreview() {
         const fileIcon = getFileIconByName(file.name);
         html += `<div class="d-flex justify-content-between align-items-center py-1 ${index > 0 ? 'border-top' : ''}">
             <div class="d-flex align-items-center">
-                <i class="fas ${fileIcon} me-2 text-muted"></i>
+                <i class="bi ${fileIcon} me-2 text-muted"></i>
                 <span class="text-truncate" style="max-width: 200px;" title="${file.name}">${file.name}</span>
             </div>
             <small class="text-muted">${formatBytes(file.size)}</small>
@@ -1608,47 +1611,47 @@ function getFileIconByName(fileName) {
         case 'gif':
         case 'bmp':
         case 'svg':
-            return 'fa-image';
+            return 'bi-image';
         case 'mp4':
         case 'avi':
         case 'mov':
         case 'wmv':
         case 'flv':
-            return 'fa-video';
+            return 'bi-camera-video';
         case 'mp3':
         case 'wav':
         case 'flac':
         case 'aac':
-            return 'fa-music';
+            return 'bi-music-note';
         case 'pdf':
-            return 'fa-file-pdf';
+            return 'bi-file-earmark-pdf';
         case 'doc':
         case 'docx':
-            return 'fa-file-word';
+            return 'bi-file-earmark-word';
         case 'xls':
         case 'xlsx':
-            return 'fa-file-excel';
+            return 'bi-file-earmark-excel';
         case 'ppt':
         case 'pptx':
-            return 'fa-file-powerpoint';
+            return 'bi-file-earmark-slides';
         case 'txt':
         case 'md':
-            return 'fa-file-text';
+            return 'bi-file-earmark-text';
         case 'zip':
         case 'rar':
         case '7z':
         case 'tar':
         case 'gz':
-            return 'fa-file-archive';
+            return 'bi-file-earmark-zip';
         case 'js':
         case 'ts':
         case 'html':
         case 'css':
         case 'json':
         case 'xml':
-            return 'fa-file-code';
+            return 'bi-file-earmark-code';
         default:
-            return 'fa-file';
+            return 'bi-file-earmark';
     }
 }
 
@@ -1758,7 +1761,7 @@ function showFileViewer(data) {
                 <div class="modal-content">
                     <div class="modal-header">
                         <h5 class="modal-title" id="fileViewerModalLabel">
-                            <i class="fas fa-eye me-2"></i>File Viewer: ${file.name}
+                            <i class="bi bi-eye me-2"></i>File Viewer: ${file.name}
                         </h5>
                         <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                     </div>
@@ -1767,7 +1770,7 @@ function showFileViewer(data) {
                     </div>
                     <div class="modal-footer">
                         <button type="button" class="btn btn-primary" onclick="downloadFile('${file.full_path}')">
-                            <i class="fas fa-download me-1"></i>Download
+                            <i class="bi bi-download me-1"></i>Download
                         </button>
                         <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
                     </div>
@@ -1809,7 +1812,7 @@ function createFileViewerContent(file, content) {
         return `
             <div class="mb-3">
                 <small class="text-muted">
-                    <i class="fas fa-info-circle me-1"></i>
+                    <i class="bi bi-info-circle me-1"></i>
                     Size: ${formatBytes(file.size)} | Type: ${file.mime}
                 </small>
             </div>
@@ -1831,7 +1834,7 @@ function createFileViewerContent(file, content) {
 function createNonViewableContent(reason) {
     return `
         <div class="text-center py-5">
-            <i class="fas fa-file fa-3x text-muted mb-3"></i>
+            <i class="bi bi-file-earmark icon-3x text-muted mb-3"></i>
             <h5 class="text-muted">Cannot preview file</h5>
             <p class="text-muted">${reason}</p>
         </div>
@@ -1909,7 +1912,7 @@ function showPropertiesModal(properties) {
                 <div class="modal-content">
                     <div class="modal-header">
                         <h5 class="modal-title" id="propertiesModalLabel">
-                            <i class="fas fa-info me-2"></i>Properties: ${properties.name}
+                            <i class="bi bi-info me-2"></i>Properties: ${properties.name}
                         </h5>
                         <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                     </div>
@@ -1948,7 +1951,7 @@ function createPropertiesContent(properties) {
     let html = `
         <div class="row">
             <div class="col-md-6">
-                <h6 class="text-primary"><i class="fas fa-file me-1"></i>Basic Information</h6>
+                <h6 class="text-primary"><i class="bi bi-file-earmark me-1"></i>Basic Information</h6>
                 <table class="table table-sm">
                     <tr><td><strong>Name:</strong></td><td>${properties.name}</td></tr>
                     <tr><td><strong>Full Path:</strong></td><td><code>${properties.full_path}</code></td></tr>
@@ -1966,7 +1969,7 @@ function createPropertiesContent(properties) {
                 </table>
             </div>
             <div class="col-md-6">
-                <h6 class="text-primary"><i class="fas fa-clock me-1"></i>Timestamps</h6>
+                <h6 class="text-primary"><i class="bi bi-clock me-1"></i>Timestamps</h6>
                 <table class="table table-sm">
     `;
 
@@ -1980,7 +1983,7 @@ function createPropertiesContent(properties) {
     html += `
                 </table>
                 
-                <h6 class="text-primary"><i class="fas fa-shield-alt me-1"></i>Permissions</h6>
+                <h6 class="text-primary"><i class="bi bi-shield me-1"></i>Permissions</h6>
                 <table class="table table-sm">
                     <tr><td><strong>Mode:</strong></td><td><code>${properties.file_mode_formatted || properties.file_mode}</code></td></tr>
                     <tr><td><strong>UID:</strong></td><td>${properties.uid || 'N/A'}</td></tr>
@@ -1995,7 +1998,7 @@ function createPropertiesContent(properties) {
         html += `
             <div class="row mt-3">
                 <div class="col-12">
-                    <h6 class="text-primary"><i class="fas fa-hourglass-half me-1"></i>TTL (Time To Live)</h6>
+                    <h6 class="text-primary"><i class="bi bi-hourglass-split me-1"></i>TTL (Time To Live)</h6>
                     <table class="table table-sm">
                         <tr><td><strong>TTL:</strong></td><td>${properties.ttl_formatted || properties.ttl_seconds + ' seconds'}</td></tr>
                     </table>
@@ -2009,7 +2012,7 @@ function createPropertiesContent(properties) {
         html += `
             <div class="row mt-3">
                 <div class="col-12">
-                    <h6 class="text-primary"><i class="fas fa-puzzle-piece me-1"></i>Chunks (${properties.chunk_count})</h6>
+                    <h6 class="text-primary"><i class="bi bi-puzzle me-1"></i>Chunks (${properties.chunk_count})</h6>
                     <div class="table-responsive" style="max-height: 200px; overflow-y: auto;">
                         <table class="table table-sm">
                             <thead>
@@ -2048,7 +2051,7 @@ function createPropertiesContent(properties) {
         html += `
             <div class="row mt-3">
                 <div class="col-12">
-                    <h6 class="text-primary"><i class="fas fa-tags me-1"></i>Extended Attributes</h6>
+                    <h6 class="text-primary"><i class="bi bi-tags me-1"></i>Extended Attributes</h6>
                     <table class="table table-sm">
         `;
 
@@ -2169,7 +2172,7 @@ function showSecretKey(accessKey, secretKey) {
 
     const content = `
         <div class="alert alert-info">
-            <i class="fas fa-info-circle me-2"></i>
+            <i class="bi bi-info-circle me-2"></i>
             <strong>Access Key Details:</strong> These credentials provide access to your object storage. Keep them secure and don't share them.
         </div>
         <div class="mb-3">
@@ -2177,7 +2180,7 @@ function showSecretKey(accessKey, secretKey) {
             <div class="input-group">
                 <input type="text" id="${modalId}_accessKey" class="form-control" value="${escapedAccessKey}" readonly>
                 <button class="btn btn-outline-secondary" onclick="copyFromInput('${modalId}_accessKey')">
-                    <i class="fas fa-copy"></i>
+                    <i class="bi bi-copy"></i>
                 </button>
             </div>
         </div>
@@ -2186,7 +2189,7 @@ function showSecretKey(accessKey, secretKey) {
             <div class="input-group">
                 <input type="text" id="${modalId}_secretKey" class="form-control" value="${escapedSecretKey}" readonly>
                 <button class="btn btn-outline-secondary" onclick="copyFromInput('${modalId}_secretKey')">
-                    <i class="fas fa-copy"></i>
+                    <i class="bi bi-copy"></i>
                 </button>
             </div>
         </div>
@@ -2196,7 +2199,7 @@ function showSecretKey(accessKey, secretKey) {
                 <textarea id="${modalId}_exportCommands" class="form-control font-monospace" rows="2" readonly>export AWS_ACCESS_KEY_ID=${escapedAccessKey}
 export AWS_SECRET_ACCESS_KEY=${escapedSecretKey}</textarea>
                 <button class="btn btn-outline-secondary" onclick="copyFromInput('${modalId}_exportCommands')">
-                    <i class="fas fa-copy"></i>
+                    <i class="bi bi-copy"></i>
                 </button>
             </div>
         </div>
@@ -2212,7 +2215,7 @@ function showNewAccessKeyModal(accessKeyData) {
 
     const content = `
         <div class="alert alert-success">
-            <i class="fas fa-check-circle me-2"></i>
+            <i class="bi bi-check-circle me-2"></i>
             <strong>Success!</strong> Your new access key has been created.
         </div>
         <div class="mb-3">
@@ -2220,7 +2223,7 @@ function showNewAccessKeyModal(accessKeyData) {
             <div class="input-group">
                 <input type="text" id="${modalId}_accessKey" class="form-control" value="${escapedAccessKey}" readonly>
                 <button class="btn btn-outline-secondary" onclick="copyFromInput('${modalId}_accessKey')">
-                    <i class="fas fa-copy"></i>
+                    <i class="bi bi-copy"></i>
                 </button>
             </div>
         </div>
@@ -2229,7 +2232,7 @@ function showNewAccessKeyModal(accessKeyData) {
             <div class="input-group">
                 <input type="text" id="${modalId}_secretKey" class="form-control" value="${escapedSecretKey}" readonly>
                 <button class="btn btn-outline-secondary" onclick="copyFromInput('${modalId}_secretKey')">
-                    <i class="fas fa-copy"></i>
+                    <i class="bi bi-copy"></i>
                 </button>
             </div>
         </div>
@@ -2239,7 +2242,7 @@ function showNewAccessKeyModal(accessKeyData) {
                 <textarea id="${modalId}_exportCommands" class="form-control font-monospace" rows="2" readonly>export AWS_ACCESS_KEY_ID=${escapedAccessKey}
 export AWS_SECRET_ACCESS_KEY=${escapedSecretKey}</textarea>
                 <button class="btn btn-outline-secondary" onclick="copyFromInput('${modalId}_exportCommands')">
-                    <i class="fas fa-copy"></i>
+                    <i class="bi bi-copy"></i>
                 </button>
             </div>
         </div>
@@ -2258,11 +2261,11 @@ function copyFromInput(inputId) {
         try {
             const successful = document.execCommand('copy');
             if (successful) {
-                showAlert('Copied to clipboard!', 'success');
+                showToast('Copied to clipboard!');
             } else {
                 // Try modern clipboard API as fallback
                 navigator.clipboard.writeText(input.value).then(() => {
-                    showAlert('Copied to clipboard!', 'success');
+                    showToast('Copied to clipboard!');
                 }).catch(() => {
                     showAlert('Failed to copy', 'danger');
                 });
@@ -2270,7 +2273,7 @@ function copyFromInput(inputId) {
         } catch (err) {
             // Try modern clipboard API as fallback
             navigator.clipboard.writeText(input.value).then(() => {
-                showAlert('Copied to clipboard!', 'success');
+                showToast('Copied to clipboard!');
             }).catch(() => {
                 showAlert('Failed to copy', 'danger');
             });
diff --git a/weed/admin/static/js/modal-alerts.js b/weed/admin/static/js/modal-alerts.js
index e8ccd54b88..4286759fd3 100644
--- a/weed/admin/static/js/modal-alerts.js
+++ b/weed/admin/static/js/modal-alerts.js
@@ -23,7 +23,7 @@
                     <div class="modal-content">
                         <div class="modal-header" id="globalAlertModalHeader">
                             <h5 class="modal-title" id="globalAlertModalLabel">
-                                <i class="fas fa-info-circle me-2" id="globalAlertModalIcon"></i>
+                                <i class="bi bi-info-circle me-2" id="globalAlertModalIcon"></i>
                                 <span id="globalAlertModalTitle">Notice</span>
                             </h5>
                             <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
@@ -44,7 +44,7 @@
                     <div class="modal-content">
                         <div class="modal-header bg-warning">
                             <h5 class="modal-title" id="globalConfirmModalLabel">
-                                <i class="fas fa-question-circle me-2"></i><span id="globalConfirmModalTitleText">Confirm Action</span>
+                                <i class="bi bi-question-circle me-2"></i><span id="globalConfirmModalTitleText">Confirm Action</span>
                             </h5>
                             <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                         </div>
@@ -65,7 +65,7 @@
                     <div class="modal-content">
                         <div class="modal-header bg-danger text-white">
                             <h5 class="modal-title" id="globalDeleteModalLabel">
-                                <i class="fas fa-exclamation-triangle me-2"></i>Confirm Delete
+                                <i class="bi bi-exclamation-triangle me-2"></i>Confirm Delete
                             </h5>
                             <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal" aria-label="Close"></button>
                         </div>
@@ -77,7 +77,7 @@
                         <div class="modal-footer">
                             <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                             <button type="button" class="btn btn-danger" id="globalDeleteConfirmBtn">
-                                <i class="fas fa-trash me-1"></i>Delete
+                                <i class="bi bi-trash me-1"></i>Delete
                             </button>
                         </div>
                     </div>
@@ -119,25 +119,25 @@
         const types = {
             'success': {
                 title: 'Success',
-                icon: 'fa-check-circle',
+                icon: 'bi-check-circle',
                 headerClass: 'bg-success text-white',
                 btnClose: 'btn-close-white'
             },
             'error': {
                 title: 'Error',
-                icon: 'fa-exclamation-triangle',
+                icon: 'bi-exclamation-triangle',
                 headerClass: 'bg-danger text-white',
                 btnClose: 'btn-close-white'
             },
             'warning': {
                 title: 'Warning',
-                icon: 'fa-exclamation-circle',
+                icon: 'bi-exclamation-circle',
                 headerClass: 'bg-warning text-dark',
                 btnClose: ''
             },
             'info': {
                 title: 'Notice',
-                icon: 'fa-info-circle',
+                icon: 'bi-info-circle',
                 headerClass: 'bg-info text-white',
                 btnClose: 'btn-close-white'
             }
@@ -151,7 +151,7 @@
         closeBtn.className = 'btn-close ' + config.btnClose;
 
         // Update icon
-        iconEl.className = 'fas ' + config.icon + ' me-2';
+        iconEl.className = 'bi ' + config.icon + ' me-2';
 
         // Update title
         titleEl.textContent = title || config.title;
@@ -168,6 +168,36 @@
         bsModal.show();
     };
 
+    /**
+     * Show a transient message that does not have to be dismissed
+     * @param {string} message - The message to display
+     * @param {string} type - Bootstrap contextual color, defaults to 'success'
+     */
+    window.showToast = function (message, type) {
+        let container = document.getElementById('globalToastContainer');
+        if (!container) {
+            container = document.createElement('div');
+            container.id = 'globalToastContainer';
+            container.className = 'toast-container position-fixed top-0 end-0 p-3';
+            // Above any modal, however deeply they are stacked.
+            container.style.zIndex = '9999';
+            document.body.appendChild(container);
+        }
+
+        const toast = document.createElement('div');
+        toast.className = 'toast align-items-center text-white bg-' + (type || 'success') + ' border-0';
+        toast.setAttribute('role', 'alert');
+        toast.innerHTML = '<div class="d-flex"><div class="toast-body">' + escapeHtml(message) + '</div>' +
+            '<button type="button" class="btn-close btn-close-white me-2 m-auto" data-bs-dismiss="toast" aria-label="Close"></button></div>';
+        container.appendChild(toast);
+
+        toast.addEventListener('hidden.bs.toast', function () {
+            toast.remove();
+        });
+
+        new bootstrap.Toast(toast, { delay: 3000 }).show();
+    };
+
     /**
      * Show a confirmation dialog using Bootstrap modal
      * @param {string} message - The confirmation message
@@ -290,6 +320,40 @@
         return text.replace(/[&<>"']/g, function (m) { return map[m]; });
     }
 
+    // Bootstrap gives every modal and backdrop the same z-index, so a modal
+    // opened while another one is showing paints behind it and cannot be
+    // clicked. Lift each nested modal, and its backdrop, above what is already
+    // on screen.
+    const MODAL_Z_INDEX = 1055;
+    const MODAL_Z_INDEX_STEP = 20;
+
+    document.addEventListener('show.bs.modal', function (event) {
+        const depth = document.querySelectorAll('.modal.show').length;
+        if (depth === 0) {
+            return;
+        }
+
+        const zIndex = MODAL_Z_INDEX + depth * MODAL_Z_INDEX_STEP;
+        event.target.style.zIndex = zIndex;
+
+        // Bootstrap only creates the backdrop after this event returns.
+        setTimeout(function () {
+            const backdrops = document.querySelectorAll('.modal-backdrop');
+            const backdrop = backdrops[backdrops.length - 1];
+            if (backdrop) {
+                backdrop.style.zIndex = zIndex - 1;
+            }
+        }, 0);
+    });
+
+    document.addEventListener('hidden.bs.modal', function (event) {
+        event.target.style.zIndex = '';
+        // Closing any modal releases the scroll lock the others still need.
+        if (document.querySelector('.modal.show')) {
+            document.body.classList.add('modal-open');
+        }
+    });
+
     // Auto-initialize on DOMContentLoaded
     if (document.readyState === 'loading') {
         document.addEventListener('DOMContentLoaded', ensureModalsExist);
diff --git a/weed/admin/static/js/policy_editor.js b/weed/admin/static/js/policy_editor.js
new file mode 100644
index 0000000000..6814b4c9c9
--- /dev/null
+++ b/weed/admin/static/js/policy_editor.js
@@ -0,0 +1,1003 @@
+// Shared visual policy editor: renders and edits an IAM/bucket policy
+// document (Version + Statement list) via a structured form alongside a
+// raw-JSON tab, kept in sync in both directions.
+//
+// Extracted from weed/admin/view/app/policies.templ (the IAM policy
+// management page), which was its original and, for a while, only
+// consumer. Any page embedding this editor must first render the shared
+// datalists (see the PolicyDatalists templ component in
+// weed/admin/view/app/policy_datalists.templ) and load this script after
+// admin.js (for basePath/escapeHtml) and modal-alerts.js (for showAlert).
+//
+// Usage: call registerPolicyEditor(which, config) once to declare an
+// editor instance (see its doc comment for the id conventions and
+// config knobs), then setupPolicyEditor(which) once to wire up its DOM
+// listeners. which is an arbitrary string ("create", "edit",
+// "bucketPolicy", ...) that namespaces one editor instance's DOM ids and
+// state from another's on the same page.
+
+// Per-`which` editor configuration. See registerPolicyEditor.
+const POLICY_EDITOR_CONFIG = {};
+
+// registerPolicyEditor declares (or redeclares) the configuration for one
+// editor instance. Call before setupPolicyEditor(which), and again any
+// time a config value (e.g. `bucket`) needs to change for an
+// already-set-up instance (setupPolicyEditor only needs to run once per
+// `which`; its DOM listeners read POLICY_EDITOR_CONFIG live).
+//
+// config:
+//   textareaId          - id of the JSON <textarea>. Default: which + 'PolicyDocument'.
+//   editorBodyId        - id of the structured-editor container. Default: which + 'PolicyEditorBody'.
+//   addStatementBtnId   - id of the "Add statement" button. Default: which + 'PolicyAddStatementBtn'.
+//   editorTabBtnId      - id of the Editor tab button. Default: which + 'PolicyEditorTabBtn'.
+//   jsonTabBtnId        - id of the JSON tab button. Default: which + 'PolicyJsonTabBtn'.
+//   actionDatalistId    - id of the shared action-suggestions <datalist>. Default: 'policyActionSuggestions'.
+//   resourceDatalistId  - id of the shared resource-suggestions <datalist>. Default: 'policyResourceSuggestions'.
+//   principalDatalistId - id of the shared principal-suggestions <datalist>. Default: 'policyPrincipalSuggestions'.
+//   requirePrincipal    - if true, a new statement seeds Principal with '*'
+//                         instead of leaving it empty, and the NotPrincipal
+//                         mode is not offered (the bucket policy backend
+//                         rejects statements without a Principal). The
+//                         server remains the source of truth for this rule
+//                         either way - see policy_engine.ValidateBucketPolicy.
+//   allowNegation       - if false, the NotResource/NotPrincipal mode
+//                         dropdowns are not offered and a loaded document
+//                         using them falls back to the JSON tab. For
+//                         backends whose evaluator has no Not* fields
+//                         (s3tables silently drops them, turning e.g.
+//                         Allow+NotResource into allow-everything).
+//   bucket              - if set, the Resource autocomplete only offers
+//                         this bucket's ARN and ARN/*, instead of fetching
+//                         every bucket, and a new statement's Resource is
+//                         seeded with arn:aws:s3:::<bucket>/*.
+//   resourceSuggestions - if set, the Resource autocomplete offers exactly
+//                         these values and never fetches bucket/folder
+//                         names. For non-S3 ARN dialects (s3tables).
+function registerPolicyEditor(which, config) {
+    POLICY_EDITOR_CONFIG[which] = Object.assign({
+        textareaId: which + 'PolicyDocument',
+        editorBodyId: which + 'PolicyEditorBody',
+        addStatementBtnId: which + 'PolicyAddStatementBtn',
+        editorTabBtnId: which + 'PolicyEditorTabBtn',
+        jsonTabBtnId: which + 'PolicyJsonTabBtn',
+        actionDatalistId: 'policyActionSuggestions',
+        resourceDatalistId: 'policyResourceSuggestions',
+        principalDatalistId: 'policyPrincipalSuggestions',
+        requirePrincipal: false,
+        allowNegation: true,
+        bucket: null,
+        resourceSuggestions: null
+    }, config || {});
+}
+
+function policyEditorConfig(which) {
+    return POLICY_EDITOR_CONFIG[which] || (registerPolicyEditor(which, {}), POLICY_EDITOR_CONFIG[which]);
+}
+
+    // Structured-editor state, one entry per modal ("create" / "edit"). Each
+    // entry is { version, statements: [{ sid, effect, actions, resources, extras }] }.
+    // "extras" holds the JSON text of any statement fields the structured
+    // editor doesn't expose (Principal, NotPrincipal, NotResource, Condition,
+    // or any future/unknown key), so they round-trip untouched.
+    let policyEditors = {
+        create: { version: '2012-10-17', statements: [], otherFields: {} },
+        edit: { version: '2012-10-17', statements: [], otherFields: {} }
+    };
+
+    // Lazily initializes and returns policyEditors[which]. 'create'/'edit'
+    // are pre-populated above, but a page with its own `which` (e.g. the
+    // bucket policy modal) doesn't populate one until its first successful
+    // load - and that load is asynchronous, so the Editor/JSON tabs and
+    // Add-statement button can be reachable before it resolves (nothing in
+    // this file enforces that a page hide them meanwhile). Route reads
+    // through this instead of policyEditors[which] directly wherever that
+    // race is possible, so a click in that window gets a valid empty state
+    // instead of a TypeError on undefined.
+    function policyEditorState(which) {
+        if (!policyEditors[which]) {
+            policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {} };
+        }
+        return policyEditors[which];
+    }
+
+    const POLICY_STATEMENT_KNOWN_KEYS = ['Sid', 'Effect', 'Action', 'Resource', 'NotResource'];
+
+    // Shown for a policy that parsed as JSON but that the structured editor
+    // can't represent, so its editor state carries { unparsed: true } and the
+    // document only ever lives in the JSON tab.
+    const POLICY_JSON_TAB_ONLY_MESSAGE = 'This policy can only be edited on the JSON tab.';
+
+    // Maps a policy-list-item's data-field attribute to the editor-state
+    // array it belongs to.
+    const POLICY_LIST_FIELD_TO_STATE_KEY = { action: 'actions', resource: 'resources', principal: 'principalValues' };
+
+    function policyTextareaId(which) {
+        return policyEditorConfig(which).textareaId;
+    }
+
+    function policyEditorOffersNotPrincipal(which) {
+        const cfg = policyEditorConfig(which);
+        return cfg.allowNegation && !cfg.requirePrincipal;
+    }
+
+    // True when the serialized policy carries at least one statement. Guards
+    // Save in the consumers: an empty editor commits as {"Statement":[]},
+    // which is never what a user wants stored - on backends with no
+    // server-side validation (s3tables) it evaluates default-deny for every
+    // non-owner while the UI still shows "Not configured".
+    function policyTextHasStatements(text) {
+        try {
+            const stmts = (JSON.parse(text) || {}).Statement;
+            return Array.isArray(stmts) ? stmts.length > 0 : !!stmts;
+        } catch (e) {
+            return true;
+        }
+    }
+
+    function policyEditorBodyId(which) {
+        return policyEditorConfig(which).editorBodyId;
+    }
+
+    function normalizeToStringArray(value) {
+        if (value === undefined || value === null) return [];
+        const values = Array.isArray(value) ? value : [value];
+        return values.map(function(v) {
+            if (v !== null && typeof v === 'object') {
+                // String(v) would render '[object Object]' (or comma-join a
+                // nested array) and a later save would persist that coercion;
+                // send the document to the JSON tab instead.
+                throw new Error('Policy list entries must be strings (got ' + JSON.stringify(v) + ')');
+            }
+            // Coerce scalars: these feed escapeHtml, which calls text.replace,
+            // and a policy is free to carry a number or a boolean here.
+            return String(v);
+        });
+    }
+
+    const POLICY_DOCUMENT_KNOWN_KEYS = ['Version', 'Statement'];
+
+    // Converts a policy document (as parsed from JSON) into editor state.
+    //
+    // Top-level keys the editor doesn't model (e.g. Id) are kept verbatim in
+    // state.otherFields and merged back on serialization, so a round-trip
+    // through the Editor tab doesn't rewrite text the user typed in the JSON
+    // tab. The admin API's PolicyDocument only carries Version and Statement,
+    // so such fields are still dropped by the server on save; see
+    // confirmPolicyFieldDiscard, which warns the user before that happens.
+    function policyDocToEditorState(which, doc) {
+        const cfg = policyEditorConfig(which);
+        if (doc === null || typeof doc !== 'object' || Array.isArray(doc)) {
+            // null, a bare scalar, or an array (typeof [] is 'object', and a
+            // pasted statement array is a common mistake) can't represent a
+            // policy document; treating it as "zero statements" would hide
+            // from the user that their input wasn't actually a document.
+            throw new Error('Policy document must be a JSON object (got ' + JSON.stringify(doc) + ')');
+        }
+        const state = { version: doc.Version || '2012-10-17', statements: [], otherFields: {} };
+        Object.keys(doc).forEach(function(key) {
+            if (POLICY_DOCUMENT_KNOWN_KEYS.indexOf(key) === -1) {
+                state.otherFields[key] = doc[key];
+            }
+        });
+        const rawStatements = doc && doc.Statement
+            ? (Array.isArray(doc.Statement) ? doc.Statement : [doc.Statement])
+            : [];
+        rawStatements.forEach(function(stmt, idx) {
+            stmt = stmt || {};
+            if (stmt.Effect !== 'Allow' && stmt.Effect !== 'Deny') {
+                // Defaulting a missing/malformed Effect to "Allow" would
+                // silently turn e.g. a typo'd "deny" into a permissive
+                // statement. Reject instead of guessing.
+                throw new Error('Statement ' + (idx + 1) + ': Effect must be exactly "Allow" or "Deny" (got ' +
+                    JSON.stringify(stmt.Effect === undefined ? null : stmt.Effect) + ')');
+            }
+            const hasResource = Object.prototype.hasOwnProperty.call(stmt, 'Resource');
+            const hasNotResource = Object.prototype.hasOwnProperty.call(stmt, 'NotResource');
+            if (hasResource && hasNotResource) {
+                // The two are mutually exclusive; a document with both isn't
+                // representable by the mode dropdown, so ask the user to fix
+                // it in the JSON tab rather than silently picking one.
+                throw new Error('Statement ' + (idx + 1) + ': cannot specify both Resource and NotResource');
+            }
+            if (hasNotResource && !cfg.allowNegation) {
+                throw new Error('Statement ' + (idx + 1) + ': NotResource is not supported for this policy type');
+            }
+            const resourceMode = hasNotResource ? 'NotResource' : 'Resource';
+
+            const hasPrincipal = Object.prototype.hasOwnProperty.call(stmt, 'Principal');
+            const hasNotPrincipal = Object.prototype.hasOwnProperty.call(stmt, 'NotPrincipal');
+            if (hasPrincipal && hasNotPrincipal) {
+                throw new Error('Statement ' + (idx + 1) + ': cannot specify both Principal and NotPrincipal');
+            }
+            if (hasNotPrincipal && (!cfg.allowNegation || cfg.requirePrincipal)) {
+                throw new Error('Statement ' + (idx + 1) + ': NotPrincipal is not supported for this policy type');
+            }
+            let principalMode = 'Principal';
+            let principalValues = [];
+            let principalManaged = false;
+            let hasComplexPrincipal = false;
+            if (hasPrincipal || hasNotPrincipal) {
+                const principalKey = hasNotPrincipal ? 'NotPrincipal' : 'Principal';
+                const parsedValues = parseSimpleAwsPrincipal(stmt[principalKey]);
+                if (parsedValues) {
+                    principalMode = principalKey;
+                    principalValues = parsedValues;
+                    principalManaged = true;
+                } else {
+                    // Bare string/array, a type other than AWS, or multiple
+                    // types at once - this v1 editor only models a single
+                    // {"AWS": ...} form. Leave it in extras rather than
+                    // guessing or discarding it.
+                    hasComplexPrincipal = true;
+                }
+            }
+
+            const extras = {};
+            Object.keys(stmt).forEach(function(key) {
+                if (POLICY_STATEMENT_KNOWN_KEYS.indexOf(key) !== -1) return;
+                if (principalManaged && (key === 'Principal' || key === 'NotPrincipal')) return;
+                extras[key] = stmt[key];
+            });
+            state.statements.push({
+                sid: String(stmt.Sid || ''),
+                effect: stmt.Effect,
+                actions: normalizeToStringArray(stmt.Action),
+                resourceMode: resourceMode,
+                resources: normalizeToStringArray(hasNotResource ? stmt.NotResource : stmt.Resource),
+                principalMode: principalMode,
+                principalValues: principalValues,
+                hasComplexPrincipal: hasComplexPrincipal,
+                extras: Object.keys(extras).length ? JSON.stringify(extras, null, 2) : ''
+            });
+        });
+        return state;
+    }
+
+    // Returns the flattened list of values if `value` is a policy Principal /
+    // NotPrincipal expressed as one of the two forms this editor's simple
+    // text field models: the bare wildcard "*" (standard AWS shorthand for
+    // "everyone"), or a single-key {"AWS": "..."} / {"AWS": ["...", ...]}
+    // object. Returns null for anything else (any other bare string/array, a
+    // different type key, or multiple type keys at once), which the caller
+    // then leaves untouched in "extras".
+    function parseSimpleAwsPrincipal(value) {
+        if (value === '*') return ['*'];
+        if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+        const keys = Object.keys(value);
+        if (keys.length !== 1 || keys[0] !== 'AWS') return null;
+        try {
+            return normalizeToStringArray(value.AWS);
+        } catch (e) {
+            // Non-string entries: not the simple form; fall back to extras.
+            return null;
+        }
+    }
+
+    // Converts editor state back into a policy document. Structured fields
+    // (Sid/Effect/Action/Resource-or-NotResource) always take precedence over
+    // whatever is in "extras" in case of a conflicting key.
+    //
+    // Throws if a statement's "advanced fields" box holds malformed or
+    // non-object JSON, instead of silently dropping it: those fields can
+    // carry Principal/NotPrincipal/Condition, so silently continuing with an
+    // empty object would change the policy's authorization behavior without
+    // the user noticing.
+    function policyEditorStateToDoc(state) {
+        // Unmanaged top-level keys first, so Version/Statement below always win.
+        const doc = Object.assign({}, state.otherFields || {});
+        doc.Version = state.version || '2012-10-17';
+        doc.Statement = [];
+        (state.statements || []).forEach(function(s, idx) {
+            let stmt = {};
+            if (s.extras && s.extras.trim()) {
+                let parsed;
+                try {
+                    parsed = JSON.parse(s.extras);
+                } catch (e) {
+                    throw new Error('Statement ' + (idx + 1) + ': advanced fields contain invalid JSON (' + e.message + ')');
+                }
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                    throw new Error('Statement ' + (idx + 1) + ': advanced fields must be a JSON object');
+                }
+                stmt = parsed;
+            }
+            if (s.sid) {
+                stmt.Sid = s.sid;
+            } else {
+                delete stmt.Sid;
+            }
+            stmt.Effect = s.effect === 'Deny' ? 'Deny' : 'Allow';
+            const actions = (s.actions || []).map(function(a) { return (a || '').trim(); }).filter(Boolean);
+            if (actions.length) {
+                stmt.Action = actions.length === 1 ? actions[0] : actions;
+            } else {
+                delete stmt.Action;
+            }
+            const resources = (s.resources || []).map(function(r) { return (r || '').trim(); }).filter(Boolean);
+            if (resources.length) {
+                // Resource and NotResource are mutually exclusive; only the
+                // key matching the selected mode is ever written.
+                if (s.resourceMode === 'NotResource') {
+                    stmt.NotResource = resources.length === 1 ? resources[0] : resources;
+                    delete stmt.Resource;
+                } else {
+                    stmt.Resource = resources.length === 1 ? resources[0] : resources;
+                    delete stmt.NotResource;
+                }
+            } else {
+                delete stmt.Resource;
+                delete stmt.NotResource;
+            }
+            const principalValues = (s.principalValues || []).map(function(p) { return (p || '').trim(); }).filter(Boolean);
+            if (principalValues.length) {
+                // Same exclusivity rule as Resource/NotResource. Structured
+                // values always win over whatever "extras" held for these
+                // keys. A lone "*" is written as the bare wildcard (standard
+                // AWS shorthand for "everyone"); anything else is wrapped in
+                // the standard {"AWS": ...} form (v1 only models AWS
+                // principals).
+                delete stmt.Principal;
+                delete stmt.NotPrincipal;
+                const wrappedPrincipal = (principalValues.length === 1 && principalValues[0] === '*')
+                    ? '*'
+                    : { AWS: principalValues.length === 1 ? principalValues[0] : principalValues };
+                if (s.principalMode === 'NotPrincipal') {
+                    stmt.NotPrincipal = wrappedPrincipal;
+                } else {
+                    stmt.Principal = wrappedPrincipal;
+                }
+            }
+            // If principalValues is empty, leave stmt.Principal/NotPrincipal
+            // untouched: it may hold a complex form preserved verbatim from
+            // "extras" (see parseSimpleAwsPrincipal) that the user never
+            // touched via this field, and clearing it here would silently
+            // discard it.
+            doc.Statement.push(stmt);
+        });
+        return doc;
+    }
+
+    // Renders the structured editor for the given modal ("create"/"edit")
+    // from policyEditors[which] into its container.
+    function renderPolicyEditor(which) {
+        const container = document.getElementById(policyEditorBodyId(which));
+        if (!container) return;
+        const state = policyEditorState(which);
+
+        if (state.unparsed) {
+            container.innerHTML = '<p class="text-muted">This policy uses a form the structured editor cannot show. Edit it on the JSON tab.</p>';
+            return;
+        }
+
+        if (state.statements.length === 0) {
+            container.innerHTML = '<p class="text-muted">No statements yet. Click "Add statement" to create one.</p>';
+            return;
+        }
+
+        let html = '';
+        state.statements.forEach(function(stmt, idx) {
+            const actionRows = stmt.actions.map(function(action, actionIdx) {
+                return policyListRowHtml(which, idx, 'action', actionIdx, action);
+            }).join('');
+            const resourceRows = stmt.resources.map(function(resource, resourceIdx) {
+                return policyListRowHtml(which, idx, 'resource', resourceIdx, resource);
+            }).join('');
+            const principalRows = stmt.principalValues.map(function(principal, principalIdx) {
+                return policyListRowHtml(which, idx, 'principal', principalIdx, principal);
+            }).join('');
+
+            html +=
+                '<div class="card mb-3" data-statement-index="' + idx + '">' +
+                '<div class="card-body">' +
+                '<div class="d-flex justify-content-between align-items-start mb-2">' +
+                '<h6 class="card-title mb-0">Statement ' + (idx + 1) + '</h6>' +
+                '<button type="button" class="btn btn-sm btn-outline-danger policy-remove-statement-btn" data-which="' + which + '" data-index="' + idx + '"><i class="bi bi-trash"></i></button>' +
+                '</div>' +
+                '<div class="row mb-2">' +
+                '<div class="col-md-6">' +
+                '<label class="form-label">Sid (optional)</label>' +
+                '<input type="text" class="form-control form-control-sm policy-stmt-sid" data-which="' + which + '" data-index="' + idx + '" value="' + escapeHtml(stmt.sid) + '">' +
+                '</div>' +
+                '<div class="col-md-6">' +
+                '<label class="form-label d-block">Effect</label>' +
+                '<div class="btn-group" role="group">' +
+                '<input type="radio" class="btn-check policy-stmt-effect" name="policyEffect-' + which + '-' + idx + '" id="policyEffectAllow-' + which + '-' + idx + '" data-which="' + which + '" data-index="' + idx + '" value="Allow"' + (stmt.effect === 'Allow' ? ' checked' : '') + '>' +
+                '<label class="btn btn-outline-success btn-sm" for="policyEffectAllow-' + which + '-' + idx + '">Allow</label>' +
+                '<input type="radio" class="btn-check policy-stmt-effect" name="policyEffect-' + which + '-' + idx + '" id="policyEffectDeny-' + which + '-' + idx + '" data-which="' + which + '" data-index="' + idx + '" value="Deny"' + (stmt.effect === 'Deny' ? ' checked' : '') + '>' +
+                '<label class="btn btn-outline-danger btn-sm" for="policyEffectDeny-' + which + '-' + idx + '">Deny</label>' +
+                '</div>' +
+                '</div>' +
+                '</div>' +
+                '<fieldset class="policy-stmt-fieldset">' +
+                '<legend class="policy-stmt-legend border rounded">Actions</legend>' +
+                '<div class="policy-action-rows" data-which="' + which + '" data-index="' + idx + '">' + actionRows + '</div>' +
+                '<button type="button" class="btn btn-sm btn-outline-secondary policy-add-list-item-btn" data-which="' + which + '" data-index="' + idx + '" data-field="action"><i class="bi bi-plus me-1"></i>Add action</button>' +
+                '</fieldset>' +
+                '<fieldset class="policy-stmt-fieldset">' +
+                '<legend class="policy-stmt-legend' + (policyEditorConfig(which).allowNegation ? '' : ' border rounded') + '">' +
+                (policyEditorConfig(which).allowNegation
+                    ? '<select class="form-select form-select-sm d-inline-block w-auto policy-stmt-resource-mode" data-which="' + which + '" data-index="' + idx + '">' +
+                      '<option value="Resource"' + (stmt.resourceMode !== 'NotResource' ? ' selected' : '') + '>Resource</option>' +
+                      '<option value="NotResource"' + (stmt.resourceMode === 'NotResource' ? ' selected' : '') + '>NotResource</option>' +
+                      '</select>'
+                    : 'Resource') +
+                '</legend>' +
+                (stmt.resourceMode === 'NotResource' ? '<div class="form-text mt-0 mb-1">The statement applies to every resource except the ones listed.</div>' : '') +
+                '<div class="policy-resource-rows" data-which="' + which + '" data-index="' + idx + '">' + resourceRows + '</div>' +
+                '<button type="button" class="btn btn-sm btn-outline-secondary policy-add-list-item-btn" data-which="' + which + '" data-index="' + idx + '" data-field="resource"><i class="bi bi-plus me-1"></i>Add resource</button>' +
+                '</fieldset>' +
+                '<fieldset class="policy-stmt-fieldset">' +
+                '<legend class="policy-stmt-legend' + (policyEditorOffersNotPrincipal(which) ? '' : ' border rounded') + '">' +
+                (policyEditorOffersNotPrincipal(which)
+                    ? '<select class="form-select form-select-sm d-inline-block w-auto policy-stmt-principal-mode" data-which="' + which + '" data-index="' + idx + '">' +
+                      '<option value="Principal"' + (stmt.principalMode !== 'NotPrincipal' ? ' selected' : '') + '>Principal</option>' +
+                      '<option value="NotPrincipal"' + (stmt.principalMode === 'NotPrincipal' ? ' selected' : '') + '>NotPrincipal</option>' +
+                      '</select>'
+                    : 'Principal') +
+                '</legend>' +
+                '<div class="form-text mt-0 mb-1">' + (policyEditorOffersNotPrincipal(which) ? 'Principal / NotPrincipal' : 'Principal') + ' (AWS account/user ARN, or "*" for everyone). Only the AWS type and "*" are supported here; other forms stay editable via Advanced fields.</div>' +
+                (stmt.hasComplexPrincipal ? '<div class="form-text text-warning mt-0 mb-1"><i class="bi bi-exclamation-triangle me-1"></i>This statement\'s Principal/NotPrincipal uses a form not supported by this field &mdash; see Advanced fields below.</div>' : '') +
+                '<div class="policy-principal-rows" data-which="' + which + '" data-index="' + idx + '">' + principalRows + '</div>' +
+                '<button type="button" class="btn btn-sm btn-outline-secondary policy-add-list-item-btn" data-which="' + which + '" data-index="' + idx + '" data-field="principal"><i class="bi bi-plus me-1"></i>Add principal</button>' +
+                '</fieldset>' +
+                '<details class="mt-3"' + (stmt.extras ? ' open' : '') + '>' +
+                '<summary class="text-muted">Advanced fields (Principal, NotPrincipal, Condition, raw JSON)</summary>' +
+                '<textarea class="form-control form-control-sm mt-2 policy-stmt-extras" data-which="' + which + '" data-index="' + idx + '" rows="4" placeholder="{}">' + escapeHtml(stmt.extras) + '</textarea>' +
+                '</details>' +
+                '</div>' +
+                '</div>';
+        });
+        container.innerHTML = html;
+    }
+
+    function policyListRowHtml(which, stmtIdx, field, itemIdx, value) {
+        const cfg = policyEditorConfig(which);
+        let listAttr = '';
+        if (field === 'action') listAttr = ' list="' + cfg.actionDatalistId + '"';
+        else if (field === 'resource') listAttr = ' list="' + cfg.resourceDatalistId + '"';
+        else if (field === 'principal') listAttr = ' list="' + cfg.principalDatalistId + '"';
+        return '<div class="input-group input-group-sm mb-1">' +
+            '<input type="text" class="form-control policy-list-item" ' + listAttr + ' data-which="' + which + '" data-index="' + stmtIdx + '" data-field="' + field + '" data-item-index="' + itemIdx + '" value="' + escapeHtml(value) + '">' +
+            '<button type="button" class="btn btn-outline-danger policy-remove-list-item-btn" data-which="' + which + '" data-index="' + stmtIdx + '" data-field="' + field + '" data-item-index="' + itemIdx + '"><i class="bi bi-x"></i></button>' +
+            '</div>';
+    }
+
+    // Reads whatever is currently displayed in the editor tab's DOM back into
+    // policyEditors[which], so nothing typed is lost before a save/tab-switch/serialize.
+    function commitPolicyEditorForm(which) {
+        const state = policyEditors[which];
+        if (!state) return;
+
+        document.querySelectorAll('.policy-stmt-sid[data-which="' + which + '"]').forEach(function(el) {
+            const idx = parseInt(el.getAttribute('data-index'), 10);
+            if (state.statements[idx]) state.statements[idx].sid = el.value;
+        });
+        document.querySelectorAll('.policy-stmt-effect[data-which="' + which + '"]:checked').forEach(function(el) {
+            const idx = parseInt(el.getAttribute('data-index'), 10);
+            if (state.statements[idx]) state.statements[idx].effect = el.value;
+        });
+        document.querySelectorAll('.policy-stmt-extras[data-which="' + which + '"]').forEach(function(el) {
+            const idx = parseInt(el.getAttribute('data-index'), 10);
+            if (state.statements[idx]) state.statements[idx].extras = el.value;
+        });
+        document.querySelectorAll('.policy-stmt-resource-mode[data-which="' + which + '"]').forEach(function(el) {
+            const idx = parseInt(el.getAttribute('data-index'), 10);
+            if (state.statements[idx]) state.statements[idx].resourceMode = el.value;
+        });
+        document.querySelectorAll('.policy-stmt-principal-mode[data-which="' + which + '"]').forEach(function(el) {
+            const idx = parseInt(el.getAttribute('data-index'), 10);
+            if (state.statements[idx]) state.statements[idx].principalMode = el.value;
+        });
+        document.querySelectorAll('.policy-list-item[data-which="' + which + '"]').forEach(function(el) {
+            const idx = parseInt(el.getAttribute('data-index'), 10);
+            const itemIdx = parseInt(el.getAttribute('data-item-index'), 10);
+            const field = POLICY_LIST_FIELD_TO_STATE_KEY[el.getAttribute('data-field')] || 'resources';
+            if (state.statements[idx] && state.statements[idx][field]) {
+                state.statements[idx][field][itemIdx] = el.value;
+            }
+        });
+    }
+
+    // Serializes policyEditors[which] into the JSON textarea. Call before
+    // switching to the JSON tab or before submitting, so the textarea always
+    // reflects the editor's current contents.
+    function commitPolicyEditorToTextarea(which) {
+        commitPolicyEditorForm(which);
+        const doc = policyEditorStateToDoc(policyEditors[which]);
+        document.getElementById(policyTextareaId(which)).value = JSON.stringify(doc, null, 2);
+    }
+
+    // Parses the JSON textarea into policyEditors[which] and re-renders the
+    // editor. Returns false (and shows an alert) if the JSON is invalid or a
+    // statement's Effect isn't exactly "Allow"/"Deny", leaving the JSON tab
+    // as the active one so the user can fix it.
+    function commitPolicyTextareaToEditor(which) {
+        const text = document.getElementById(policyTextareaId(which)).value;
+        if (!text || !text.trim()) {
+            policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {} };
+            renderPolicyEditor(which);
+            return true;
+        }
+        let doc;
+        try {
+            doc = JSON.parse(text);
+        } catch (e) {
+            showAlert('Invalid JSON in policy document: ' + e.message, 'error');
+            return false;
+        }
+        let newState;
+        try {
+            newState = policyDocToEditorState(which, doc);
+        } catch (e) {
+            showAlert(e.message, 'error');
+            return false;
+        }
+        policyEditors[which] = newState;
+        renderPolicyEditor(which);
+        return true;
+    }
+
+    function activatePolicyTab(idKey, which) {
+        const btn = document.getElementById(policyEditorConfig(which)[idKey]);
+        if (btn) bootstrap.Tab.getOrCreateInstance(btn).show();
+    }
+
+    // Populates the editor for `which` from whatever is currently in its
+    // JSON textarea (typically right after a GET fills the textarea) and
+    // switches to whichever tab can actually show the result.
+    //
+    // Unlike commitPolicyTextareaToEditor - which assumes a tab is already
+    // showing and leaves it in place on failure so a Save can't silently
+    // clobber it - this function has no "current tab" to defer to: it is
+    // the thing that establishes one. So on a document the structured
+    // editor can't represent (invalid JSON, or valid JSON
+    // policyDocToEditorState rejects), it marks the state `unparsed` and
+    // switches to the JSON tab instead of leaving the Editor tab showing
+    // empty/stale state that a careless Save would serialize over the
+    // real document. Mirrors editPolicy's fallback in policies.templ.
+    function loadPolicyTextareaIntoEditor(which) {
+        const text = document.getElementById(policyTextareaId(which)).value;
+        if (!text || !text.trim()) {
+            policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {} };
+            renderPolicyEditor(which);
+            activatePolicyTab('editorTabBtnId', which);
+            return true;
+        }
+        let doc;
+        try {
+            doc = JSON.parse(text);
+        } catch (e) {
+            policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {}, unparsed: true };
+            renderPolicyEditor(which);
+            showAlert('Invalid JSON in stored policy: ' + e.message + '. ' + POLICY_JSON_TAB_ONLY_MESSAGE, 'error');
+            activatePolicyTab('jsonTabBtnId', which);
+            return false;
+        }
+        let state;
+        try {
+            state = policyDocToEditorState(which, doc);
+        } catch (e) {
+            policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {}, unparsed: true };
+            renderPolicyEditor(which);
+            showAlert(e.message + '. ' + POLICY_JSON_TAB_ONLY_MESSAGE, 'error');
+            activatePolicyTab('jsonTabBtnId', which);
+            return false;
+        }
+        policyEditors[which] = state;
+        renderPolicyEditor(which);
+        activatePolicyTab('editorTabBtnId', which);
+        return true;
+    }
+
+    function addPolicyStatement(which) {
+        if (policyEditorState(which).unparsed) {
+            showAlert(POLICY_JSON_TAB_ONLY_MESSAGE, 'error');
+            return;
+        }
+        const cfg = policyEditorConfig(which);
+        commitPolicyEditorForm(which);
+        // Seed Resource with the broadest pinned suggestion, mirroring the
+        // arn:aws:s3::: seeding cfg.bucket gets.
+        const seededResources = cfg.bucket ? ['arn:aws:s3:::' + cfg.bucket + '/*']
+            : (cfg.resourceSuggestions ? [cfg.resourceSuggestions[cfg.resourceSuggestions.length - 1]] : []);
+        policyEditorState(which).statements.push({
+            sid: '', effect: 'Allow', actions: [],
+            resourceMode: 'Resource', resources: seededResources,
+            principalMode: 'Principal', principalValues: cfg.requirePrincipal ? ['*'] : [], hasComplexPrincipal: false,
+            extras: ''
+        });
+        renderPolicyEditor(which);
+    }
+
+    // True while the JSON tab (rather than the Editor tab) is the one
+    // currently shown for `which`.
+    function isPolicyJsonTabActive(which) {
+        const jsonTabBtn = document.getElementById(policyEditorConfig(which).jsonTabBtnId);
+        return !!(jsonTabBtn && jsonTabBtn.classList.contains('active'));
+    }
+
+    // Commits whichever tab is currently visible into the other side, so a
+    // save/validate action always uses what the user is actually looking at
+    // instead of silently overwriting it with stale state from the tab
+    // they're not on. Returns false (after alerting the user) if that isn't
+    // possible - e.g. invalid JSON on either side - so the caller can abort.
+    function commitPolicyActiveTab(which) {
+        if (isPolicyJsonTabActive(which)) {
+            // The JSON tab is the source of truth right now; parse it back
+            // into the structured editor to keep both in sync, but leave the
+            // textarea's own text untouched.
+            const text = document.getElementById(policyTextareaId(which)).value;
+            if (text && text.trim()) {
+                let doc;
+                try {
+                    doc = JSON.parse(text);
+                } catch (e) {
+                    showAlert('Invalid JSON in policy document: ' + e.message, 'error');
+                    return false;
+                }
+                try {
+                    policyEditors[which] = policyDocToEditorState(which, doc);
+                } catch (e) {
+                    // Valid JSON the structured editor can't model is still
+                    // saveable from here - exactly the documents the load path
+                    // shunts to this tab. It just stays JSON-tab-only.
+                    policyEditors[which] = { version: '2012-10-17', statements: [], otherFields: {}, unparsed: true };
+                }
+                renderPolicyEditor(which);
+            } else if (!commitPolicyTextareaToEditor(which)) {
+                return false;
+            }
+        } else {
+            if (policyEditorState(which).unparsed) {
+                // The editor never held this document, so serializing it would
+                // write an empty policy over whatever is in the JSON tab.
+                showAlert(POLICY_JSON_TAB_ONLY_MESSAGE, 'error');
+                return false;
+            }
+            try {
+                commitPolicyEditorToTextarea(which);
+            } catch (e) {
+                showAlert(e.message, 'error');
+                return false;
+            }
+        }
+        // Final gate over what would actually be saved. The mode dropdowns
+        // being hidden is not enough: the JSON tab and a statement's
+        // Advanced-fields box can both carry Not* keys, and where negation
+        // is disallowed the backend's evaluator silently drops them -
+        // Allow+NotResource would come back as allow-everything.
+        const negationError = policyTextDisallowedNegationError(which);
+        if (negationError) {
+            showAlert(negationError, 'error');
+            return false;
+        }
+        return true;
+    }
+
+    // Returns an error message if the JSON textarea for `which` holds a
+    // statement using NotResource/NotPrincipal while the instance disallows
+    // negation, or null. Unparseable/empty text is left to other checks.
+    function policyTextDisallowedNegationError(which) {
+        if (policyEditorConfig(which).allowNegation) return null;
+        let doc;
+        try {
+            doc = JSON.parse(document.getElementById(policyTextareaId(which)).value);
+        } catch (e) {
+            return null;
+        }
+        const stmts = doc && doc.Statement ? (Array.isArray(doc.Statement) ? doc.Statement : [doc.Statement]) : [];
+        for (let i = 0; i < stmts.length; i++) {
+            const stmt = stmts[i] || {};
+            if (Object.prototype.hasOwnProperty.call(stmt, 'NotResource') ||
+                Object.prototype.hasOwnProperty.call(stmt, 'NotPrincipal')) {
+                return 'Statement ' + (i + 1) + ': NotResource/NotPrincipal are not supported for this policy type and would be silently ignored. Remove them before saving.';
+            }
+        }
+        return null;
+    }
+
+    // The admin API's policy document carries only Version and Statement, so
+    // any other top-level key (e.g. Id) is discarded server-side on save even
+    // though the editor round-trips it between tabs. Warn before that happens
+    // rather than letting the field vanish silently. Returns false if the
+    // user cancels.
+    function confirmPolicyFieldDiscard(which) {
+        const otherFields = Object.keys((policyEditors[which] || {}).otherFields || {});
+        if (otherFields.length === 0) return true;
+        return confirm(
+            'The following top-level field(s) are not supported and will be dropped when this policy is saved: ' +
+            otherFields.join(', ') + '.\n\nSave anyway?');
+    }
+
+    // Client-side check for the requirePrincipal config knob: returns an
+    // error message naming the first statement missing a Principal /
+    // NotPrincipal, or null if the document is fine. Purely a fast-feedback
+    // convenience - the server (policy_engine.ValidateBucketPolicy) is the
+    // actual authority on this rule and re-checks it regardless.
+    function validatePolicyEditorDoc(which, doc) {
+        if (!policyEditorConfig(which).requirePrincipal) return null;
+        const statements = (doc && doc.Statement) || [];
+        for (let i = 0; i < statements.length; i++) {
+            const stmt = statements[i] || {};
+            // Principal specifically: the server rule this front-runs
+            // (policy_engine.ValidateBucketPolicy) rejects NotPrincipal-only
+            // statements too.
+            if (stmt.Principal === undefined) {
+                return 'Statement ' + (i + 1) + ': a Principal is required.';
+            }
+        }
+        return null;
+    }
+
+    function setupPolicyEditor(which) {
+        const cfg = policyEditorConfig(which);
+        document.getElementById(cfg.addStatementBtnId).addEventListener('click', function() {
+            addPolicyStatement(which);
+        });
+
+        const editorTabBtn = document.getElementById(cfg.editorTabBtnId);
+        const jsonTabBtn = document.getElementById(cfg.jsonTabBtnId);
+
+        jsonTabBtn.addEventListener('show.bs.tab', function(event) {
+            if (policyEditorState(which).unparsed) {
+                // The editor never held this document; serializing its empty
+                // placeholder state would overwrite the textarea we are about
+                // to show, which is the only copy of it.
+                return;
+            }
+            try {
+                commitPolicyEditorToTextarea(which);
+            } catch (e) {
+                showAlert(e.message, 'error');
+                event.preventDefault();
+            }
+        });
+        editorTabBtn.addEventListener('show.bs.tab', function(event) {
+            if (!commitPolicyTextareaToEditor(which)) {
+                event.preventDefault();
+            }
+        });
+
+        const body = document.getElementById(policyEditorBodyId(which));
+        body.addEventListener('change', function(event) {
+            if (event.target.classList.contains('policy-stmt-resource-mode')) {
+                // Redraw so the NotResource hint follows the selected mode.
+                commitPolicyEditorForm(which);
+                renderPolicyEditor(which);
+            }
+        });
+        body.addEventListener('click', function(event) {
+            const removeStmtBtn = event.target.closest('.policy-remove-statement-btn');
+            if (removeStmtBtn) {
+                commitPolicyEditorForm(which);
+                const idx = parseInt(removeStmtBtn.getAttribute('data-index'), 10);
+                policyEditors[which].statements.splice(idx, 1);
+                renderPolicyEditor(which);
+                return;
+            }
+            const addItemBtn = event.target.closest('.policy-add-list-item-btn');
+            if (addItemBtn) {
+                commitPolicyEditorForm(which);
+                const idx = parseInt(addItemBtn.getAttribute('data-index'), 10);
+                const field = POLICY_LIST_FIELD_TO_STATE_KEY[addItemBtn.getAttribute('data-field')] || 'resources';
+                policyEditors[which].statements[idx][field].push('');
+                renderPolicyEditor(which);
+                return;
+            }
+            const removeItemBtn = event.target.closest('.policy-remove-list-item-btn');
+            if (removeItemBtn) {
+                commitPolicyEditorForm(which);
+                const idx = parseInt(removeItemBtn.getAttribute('data-index'), 10);
+                const itemIdx = parseInt(removeItemBtn.getAttribute('data-item-index'), 10);
+                const field = POLICY_LIST_FIELD_TO_STATE_KEY[removeItemBtn.getAttribute('data-field')] || 'resources';
+                policyEditors[which].statements[idx][field].splice(itemIdx, 1);
+                renderPolicyEditor(which);
+            }
+        });
+
+        // Populate the shared Resource datalist as the user types/focuses a
+        // Resource field. Bootstrap's datalist filtering then narrows down
+        // whatever set of options was last loaded for the current path stage.
+        body.addEventListener('input', function(event) {
+            const target = event.target;
+            if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'resource') {
+                updatePolicyResourceSuggestions(which, target);
+            }
+        });
+        body.addEventListener('focusin', function(event) {
+            const target = event.target;
+            if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'resource') {
+                updatePolicyResourceSuggestions(which, target);
+            }
+        });
+
+        // Same idea for the shared Principal datalist: a flat, one-time
+        // fetch (see loadPolicyPrincipalSuggestions), no per-segment logic
+        // needed since users/roles aren't hierarchical like bucket paths.
+        body.addEventListener('input', function(event) {
+            const target = event.target;
+            if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'principal') {
+                updatePolicyPrincipalSuggestions(which);
+            }
+        });
+        body.addEventListener('focusin', function(event) {
+            const target = event.target;
+            if (target.classList.contains('policy-list-item') && target.getAttribute('data-field') === 'principal') {
+                updatePolicyPrincipalSuggestions(which);
+            }
+        });
+    }
+
+    // ------------------------------------------------------------------
+    // Progressive Resource ARN autocomplete: suggests bucket names first
+    // (arn:aws:s3:::bucket), then once a bucket + "/" is typed, suggests
+    // arn:aws:s3:::bucket/* plus the direct subfolders one path segment at a
+    // time (fetched from the server on demand, one directory level per
+    // request, and cached per directory for the life of the page).
+    // ------------------------------------------------------------------
+
+    const POLICY_RESOURCE_ARN_PREFIX = 'arn:aws:s3:::';
+    let policyBucketArnsPromise = null;
+    const policyFolderListCache = new Map();
+
+    function loadPolicyBucketArns() {
+        if (!policyBucketArnsPromise) {
+            policyBucketArnsPromise = fetch(basePath('/api/s3/buckets'))
+                .then(function(r) { return r.ok ? r.json() : { buckets: [] }; })
+                .then(function(data) {
+                    // Offer both the bucket itself and "every object in it",
+                    // since the latter is what most Resource entries actually need.
+                    return (data.buckets || []).reduce(function(acc, b) {
+                        const arn = POLICY_RESOURCE_ARN_PREFIX + b.name;
+                        acc.push(arn, arn + '/*');
+                        return acc;
+                    }, []);
+                })
+                .catch(function() { return []; });
+        }
+        return policyBucketArnsPromise;
+    }
+
+    function loadPolicyFolderNames(dirPath, prefix) {
+        // Send the segment still being typed as a prefix so the filer does the
+        // filtering: without it the server pages through every entry in the
+        // directory, which on a bucket of flat object keys is the whole bucket.
+        const key = dirPath + '\n' + prefix;
+        if (!policyFolderListCache.has(key)) {
+            policyFolderListCache.set(key, fetch(basePath('/api/files/list-folders?path=' + encodeURIComponent(dirPath) +
+                    '&prefix=' + encodeURIComponent(prefix)))
+                .then(function(r) {
+                    if (!r.ok) throw new Error('list-folders request failed with status ' + r.status);
+                    return r.json();
+                })
+                .then(function(data) { return data.folders || []; })
+                .catch(function() {
+                    // Don't let a transient failure permanently poison the
+                    // cache for this directory; let the next call retry.
+                    policyFolderListCache.delete(key);
+                    return [];
+                }));
+        }
+        return policyFolderListCache.get(key);
+    }
+
+    // Figures out what stage of the ARN the user is currently typing:
+    // still the bucket name ("bucket"), or a folder path segment after the
+    // bucket ("folder", with dirPath being the filer directory to list and
+    // arnPrefix being the ARN text to append suggestions onto).
+    function policyResourcePathState(value) {
+        value = value || '';
+        if (value.indexOf(POLICY_RESOURCE_ARN_PREFIX) !== 0) {
+            return { stage: 'bucket' };
+        }
+        const rest = value.slice(POLICY_RESOURCE_ARN_PREFIX.length);
+        const segments = rest.split('/');
+        if (segments.length === 1) {
+            return { stage: 'bucket' };
+        }
+        const bucket = segments[0];
+        const pathSegments = segments.slice(1, segments.length - 1);
+        const suffix = pathSegments.length ? '/' + pathSegments.join('/') : '';
+        return {
+            stage: 'folder',
+            dirPath: '/buckets/' + bucket + suffix,
+            // The trailing, still-incomplete segment. The datalist narrows on
+            // it too, but sending it keeps the server's listing bounded.
+            prefix: segments[segments.length - 1],
+            arnPrefix: POLICY_RESOURCE_ARN_PREFIX + bucket + suffix
+        };
+    }
+
+    function renderPolicyDatalistOptions(datalist, values) {
+        datalist.innerHTML = values.map(function(v) {
+            return '<option value="' + escapeHtml(v) + '"></option>';
+        }).join('');
+    }
+
+    function updatePolicyResourceSuggestions(which, inputEl) {
+        const cfg = policyEditorConfig(which);
+        const datalist = document.getElementById(cfg.resourceDatalistId);
+        if (!datalist) return;
+        if (cfg.resourceSuggestions) {
+            renderPolicyDatalistOptions(datalist, cfg.resourceSuggestions);
+            return;
+        }
+        const state = policyResourcePathState(inputEl.value);
+
+        if (state.stage === 'bucket') {
+            if (cfg.bucket) {
+                // Pinned to one bucket: no need to fetch and offer every
+                // bucket in the cluster, and the user can't be offered an
+                // ARN the server would reject anyway (see
+                // policy_engine.ValidateBucketPolicy).
+                renderPolicyDatalistOptions(datalist, [
+                    POLICY_RESOURCE_ARN_PREFIX + cfg.bucket,
+                    POLICY_RESOURCE_ARN_PREFIX + cfg.bucket + '/*'
+                ]);
+                return;
+            }
+            loadPolicyBucketArns().then(function(arns) {
+                renderPolicyDatalistOptions(datalist, arns);
+            });
+            return;
+        }
+
+        loadPolicyFolderNames(state.dirPath, state.prefix).then(function(folders) {
+            const options = [state.arnPrefix + '/*'];
+            folders.forEach(function(name) {
+                options.push(state.arnPrefix + '/' + name);
+            });
+            renderPolicyDatalistOptions(datalist, options);
+        });
+    }
+
+    // ------------------------------------------------------------------
+    // Principal autocomplete: a flat list of existing users and IAM roles,
+    // fetched once from /api/principals and cached for the life of the page
+    // (unlike Resource ARNs, users/roles have no hierarchy to drill into).
+    // ------------------------------------------------------------------
+
+    let policyPrincipalSuggestionsPromise = null;
+
+    function loadPolicyPrincipalSuggestions() {
+        if (!policyPrincipalSuggestionsPromise) {
+            policyPrincipalSuggestionsPromise = fetch(basePath('/api/principals'))
+                .then(function(r) { return r.ok ? r.json() : { principals: [] }; })
+                .then(function(data) { return ['*'].concat(data.principals || []); })
+                .catch(function() { return ['*']; });
+        }
+        return policyPrincipalSuggestionsPromise;
+    }
+
+    function updatePolicyPrincipalSuggestions(which) {
+        const datalist = document.getElementById(policyEditorConfig(which).principalDatalistId);
+        if (!datalist) return;
+        loadPolicyPrincipalSuggestions().then(function(principals) {
+            renderPolicyDatalistOptions(datalist, principals);
+        });
+    }
+
+    // Fills the structured editor (and the JSON tab) with a sample policy,
+    // regardless of which tab is currently active.
+    const POLICY_SAMPLE_DOCUMENT = {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "s3:GetObject",
+                    "s3:PutObject"
+                ],
+                "Resource": [
+                    "arn:aws:s3:::my-bucket/*"
+                ]
+            }
+        ]
+    };
+
+    function insertSamplePolicy(which, sampleDoc) {
+        const doc = sampleDoc || POLICY_SAMPLE_DOCUMENT;
+        policyEditors[which] = policyDocToEditorState(which, doc);
+        renderPolicyEditor(which);
+        document.getElementById(policyTextareaId(which)).value = JSON.stringify(doc, null, 2);
+    }
diff --git a/weed/admin/static/js/s3tables.js b/weed/admin/static/js/s3tables.js
index 1c7bc8c4de..0bfa8c9ef5 100644
--- a/weed/admin/static/js/s3tables.js
+++ b/weed/admin/static/js/s3tables.js
@@ -15,6 +15,58 @@ let s3tablesTablePolicyModal = null;
 let s3tablesTagsModal = null;
 let icebergTableDeleteModal = null;
 
+// True only once a bucket/table policy GET has actually completed
+// successfully (a genuinely empty policy counts). Guards the Save handlers
+// below: a failed GET must not let a Save serialize the editor's cleared-out
+// placeholder state as a real "Statement: []" document and overwrite
+// whatever is actually stored.
+let s3tablesBucketPolicyLoaded = false;
+let s3tablesTablePolicyLoaded = false;
+
+// Bumped on every bucket/table policy load; a response only gets applied if
+// its captured sequence number still matches. Without this, opening one
+// resource's policy dialog and then another's before the first GET resolves
+// lets the late response overwrite the second resource's textarea/editor
+// state and mark it loaded, so a subsequent Save would push the first
+// resource's policy onto the second resource.
+let s3tablesBucketPolicyRequestSeq = 0;
+let s3tablesTablePolicyRequestSeq = 0;
+
+// True while a policy PUT/DELETE is in flight, so a double-click - or Save
+// and Delete fired in quick succession - can't send overlapping mutations.
+// Same pattern as the classic bucket modal in s3_buckets.templ.
+let s3tablesBucketPolicyMutationInFlight = false;
+let s3tablesTablePolicyMutationInFlight = false;
+
+function setS3TablesBucketPolicyMutationInFlight(inFlight) {
+    s3tablesBucketPolicyMutationInFlight = inFlight;
+    const save = document.getElementById('s3tablesBucketPolicySaveBtn');
+    const del = document.getElementById('s3tablesBucketPolicyDeleteBtn');
+    if (save) save.disabled = inFlight;
+    if (del) del.disabled = inFlight;
+}
+
+function setS3TablesTablePolicyMutationInFlight(inFlight) {
+    s3tablesTablePolicyMutationInFlight = inFlight;
+    const save = document.getElementById('s3tablesTablePolicySaveBtn');
+    const del = document.getElementById('s3tablesTablePolicyDeleteBtn');
+    if (save) save.disabled = inFlight;
+    if (del) del.disabled = inFlight;
+}
+
+// The dialog identity captured when a mutation started, so a completion
+// that lands after the shared modal moved on to a different resource can't
+// alert against, hide, or reload over that other resource's state.
+function currentS3TablesBucketPolicyTarget() {
+    return document.getElementById('s3tablesBucketPolicyArn').value;
+}
+
+function currentS3TablesTablePolicyTarget() {
+    return document.getElementById('s3tablesTablePolicyBucketArn').value + '\n' +
+        document.getElementById('s3tablesTablePolicyNamespace').value + '\n' +
+        document.getElementById('s3tablesTablePolicyName').value;
+}
+
 function getCSRFToken() {
     const tokenMeta = document.querySelector('meta[name="csrf-token"]');
     if (!tokenMeta) {
@@ -40,6 +92,9 @@ function initS3TablesBuckets() {
     s3tablesBucketPolicyModal = new bootstrap.Modal(document.getElementById('s3tablesBucketPolicyModal'));
     s3tablesTagsModal = new bootstrap.Modal(document.getElementById('s3tablesTagsModal'));
 
+    registerS3TablesBucketPolicyEditor('');
+    setupPolicyEditor('s3tablesBucket');
+
     const ownerSelect = document.getElementById('s3tablesBucketOwner');
     if (ownerSelect) {
         document.getElementById('createS3TablesBucketModal').addEventListener('show.bs.modal', async function () {
@@ -81,6 +136,7 @@ function initS3TablesBuckets() {
         button.addEventListener('click', function () {
             const bucketArn = this.dataset.bucketArn || '';
             document.getElementById('s3tablesBucketPolicyArn').value = bucketArn;
+            registerS3TablesBucketPolicyEditor(bucketArn);
             loadS3TablesBucketPolicy(bucketArn);
             s3tablesBucketPolicyModal.show();
         });
@@ -108,7 +164,8 @@ function initS3TablesBuckets() {
             const tagsInput = document.getElementById('s3tablesBucketTags').value.trim();
             const tags = parseTagsInput(tagsInput);
             if (tags === null) return;
-            const payload = { name: name, tags: tags, owner: owner };
+            const formatInput = document.querySelector('#s3tablesBucketFormatPicker input[name="format"]:checked');
+            const payload = { name: name, tags: tags, owner: owner, format: formatInput ? formatInput.value : 'ICEBERG' };
 
             try {
                 const response = await fetch(s3tBasePath('/api/s3tables/buckets'), {
@@ -129,33 +186,58 @@ function initS3TablesBuckets() {
         });
     }
 
-    const policyForm = document.getElementById('s3tablesBucketPolicyForm');
-    if (policyForm) {
-        policyForm.addEventListener('submit', async function (e) {
-            e.preventDefault();
-            const bucketArn = document.getElementById('s3tablesBucketPolicyArn').value;
-            const policy = document.getElementById('s3tablesBucketPolicyText').value.trim();
-            if (!policy) {
-                alert('Policy JSON is required');
+    // The endpoint is the whole reason the format matters, so show it changing
+    // rather than making the operator work it out after the fact.
+    const formatPicker = document.getElementById('s3tablesBucketFormatPicker');
+    const formatHint = document.getElementById('s3tablesBucketFormatHint');
+    if (formatPicker && formatHint) {
+        const icebergPort = formatHint.dataset.icebergPort;
+        const lancePort = formatHint.dataset.lancePort;
+        const origin = window.location.protocol + '//' + window.location.hostname;
+        const describeEndpoint = function () {
+            const chosen = formatPicker.querySelector('input[name="format"]:checked');
+            const isLance = chosen && chosen.value === 'LANCE';
+            const port = isLance ? lancePort : icebergPort;
+            const name = (document.getElementById('s3tablesBucketName').value || '').trim();
+            // The bucket name is whatever the operator is typing, so it goes in
+            // as text. Building this with innerHTML would run their input.
+            formatHint.textContent = '';
+            if (!port || port === '0') {
+                formatHint.appendChild(document.createTextNode('A bucket holds one format. Tables of the other are refused. '));
+                const warning = document.createElement('span');
+                warning.className = 'text-warning';
+                warning.textContent = 'No server is running for this format.';
+                formatHint.appendChild(warning);
                 return;
             }
-            try {
-                const response = await fetch(s3tBasePath('/api/s3tables/bucket-policy'), {
-                    method: 'PUT',
-                    headers: s3tWriteHeaders({ 'Content-Type': 'application/json' }),
-                    body: JSON.stringify({ bucket_arn: bucketArn, policy: policy })
-                });
-                const data = await response.json();
-                if (!response.ok) {
-                    alert(data.error || 'Failed to update policy');
-                    return;
-                }
-                alert('Policy updated');
-                s3tablesBucketPolicyModal.hide();
-            } catch (error) {
-                alert('Failed to update policy: ' + error.message);
-            }
-        });
+            const path = isLance
+                ? '/v1/namespace/' + (name || '<bucket>') + '/list'
+                : '/v1/' + (name || '<bucket>') + '/namespaces';
+            formatHint.appendChild(document.createTextNode('Clients reach this bucket at '));
+            const endpoint = document.createElement('code');
+            endpoint.textContent = origin + ':' + port + path;
+            formatHint.appendChild(endpoint);
+        };
+        formatPicker.addEventListener('change', describeEndpoint);
+        const bucketNameField = document.getElementById('s3tablesBucketName');
+        if (bucketNameField) {
+            bucketNameField.addEventListener('input', describeEndpoint);
+        }
+        describeEndpoint();
+    }
+
+    // The banner prints localhost server-side; the browser knows the real host.
+    document.querySelectorAll('.s3tables-origin').forEach(function (el) {
+        el.textContent = window.location.protocol + '//' + window.location.hostname + ':' + el.dataset.port;
+    });
+
+    const policyForm = document.getElementById('s3tablesBucketPolicyForm');
+    if (policyForm) {
+        // Saves go through the Save button only; implicit form submission
+        // (Enter in a single-line editor input) must never PUT half-built
+        // state, which the backend would store verbatim.
+        policyForm.addEventListener('submit', function (e) { e.preventDefault(); });
+        document.getElementById('s3tablesBucketPolicySaveBtn').addEventListener('click', saveS3TablesBucketPolicy);
     }
 
     const tagsForm = document.getElementById('s3tablesTagsForm');
@@ -181,6 +263,9 @@ function initS3TablesTables() {
     s3tablesTablePolicyModal = new bootstrap.Modal(document.getElementById('s3tablesTablePolicyModal'));
     s3tablesTagsModal = new bootstrap.Modal(document.getElementById('s3tablesTagsModal'));
 
+    registerS3TablesTablePolicyEditor('', '', '');
+    setupPolicyEditor('s3tablesTable');
+
     const dataContainer = document.getElementById('s3tables-tables-content');
     const dataBucketArn = dataContainer.dataset.bucketArn || '';
     const dataNamespace = dataContainer.dataset.namespace || '';
@@ -198,6 +283,7 @@ function initS3TablesTables() {
             document.getElementById('s3tablesTablePolicyBucketArn').value = dataBucketArn;
             document.getElementById('s3tablesTablePolicyNamespace').value = dataNamespace;
             document.getElementById('s3tablesTablePolicyName').value = this.dataset.tableName || '';
+            registerS3TablesTablePolicyEditor(dataBucketArn, dataNamespace, this.dataset.tableName || '');
             loadS3TablesTablePolicy(dataBucketArn, dataNamespace, this.dataset.tableName || '');
             s3tablesTablePolicyModal.show();
         });
@@ -266,30 +352,9 @@ function initS3TablesTables() {
 
     const policyForm = document.getElementById('s3tablesTablePolicyForm');
     if (policyForm) {
-        policyForm.addEventListener('submit', async function (e) {
-            e.preventDefault();
-            const policy = document.getElementById('s3tablesTablePolicyText').value.trim();
-            if (!policy) {
-                alert('Policy JSON is required');
-                return;
-            }
-            try {
-                const response = await fetch(s3tBasePath('/api/s3tables/table-policy'), {
-                    method: 'PUT',
-                    headers: s3tWriteHeaders({ 'Content-Type': 'application/json' }),
-                    body: JSON.stringify({ bucket_arn: dataBucketArn, namespace: dataNamespace, name: document.getElementById('s3tablesTablePolicyName').value, policy: policy })
-                });
-                const data = await response.json();
-                if (!response.ok) {
-                    alert(data.error || 'Failed to update policy');
-                    return;
-                }
-                alert('Policy updated');
-                s3tablesTablePolicyModal.hide();
-            } catch (error) {
-                alert('Failed to update policy: ' + error.message);
-            }
-        });
+        // Same Enter-must-not-submit rule as the bucket policy form.
+        policyForm.addEventListener('submit', function (e) { e.preventDefault(); });
+        document.getElementById('s3tablesTablePolicySaveBtn').addEventListener('click', saveS3TablesTablePolicy);
     }
 
     const tagsForm = document.getElementById('s3tablesTagsForm');
@@ -407,7 +472,7 @@ async function loadIcebergNamespaceTables(node, bucketArn, catalogName) {
             link.className = 'text-decoration-none';
             link.href = s3tBasePath(`/object-store/s3tables/buckets/${encodeURIComponent(catalogName)}/namespaces/${encodeURIComponent(namespace)}/tables/${encodeURIComponent(table.name)}`);
             const icon = document.createElement('i');
-            icon.className = 'fas fa-table text-primary me-2';
+            icon.className = 'bi bi-table text-primary me-2';
             link.appendChild(icon);
             const nameSpan = document.createElement('span');
             nameSpan.textContent = table.name;
@@ -534,34 +599,196 @@ async function deleteS3TablesBucket() {
     }
 }
 
+// Shared visual policy editor (weed/admin/static/js/policy_editor.js),
+// configured for the S3 Tables policy engine: only s3tables: action
+// suggestions, resource suggestions pinned to the open resource's ARN, and
+// no NotResource/NotPrincipal modes - the s3tables evaluator has no such
+// fields and would silently drop them (see s3tables/permissions.go).
+// Re-registered on every dialog open so the suggestions track the resource.
+function registerS3TablesBucketPolicyEditor(bucketArn) {
+    registerPolicyEditor('s3tablesBucket', {
+        textareaId: 's3tablesBucketPolicyText',
+        actionDatalistId: 's3tablesPolicyActionSuggestions',
+        allowNegation: false,
+        resourceSuggestions: bucketArn ? [bucketArn, bucketArn + '/table/*'] : null
+    });
+}
+
+function registerS3TablesTablePolicyEditor(bucketArn, namespace, name) {
+    registerPolicyEditor('s3tablesTable', {
+        textareaId: 's3tablesTablePolicyText',
+        actionDatalistId: 's3tablesPolicyActionSuggestions',
+        allowNegation: false,
+        resourceSuggestions: bucketArn && namespace && name ? [bucketArn + '/table/' + namespace + '/' + name] : null
+    });
+}
+
 async function loadS3TablesBucketPolicy(bucketArn) {
+    const requestSeq = ++s3tablesBucketPolicyRequestSeq;
     document.getElementById('s3tablesBucketPolicyText').value = '';
-    if (!bucketArn) return;
-    try {
-        const response = await fetch(s3tBasePath(`/api/s3tables/bucket-policy?bucket=${encodeURIComponent(bucketArn)}`));
-        const data = await response.json();
-        if (response.ok && data.policy) {
-            document.getElementById('s3tablesBucketPolicyText').value = data.policy;
+    s3tablesBucketPolicyLoaded = false;
+    // Reset the structured editor immediately too, so a still-open Editor
+    // tab doesn't keep showing the previously loaded resource's statements
+    // while this fetch is in flight.
+    loadPolicyTextareaIntoEditor('s3tablesBucket');
+    if (bucketArn) {
+        let policyText = '';
+        let loadError = null;
+        try {
+            const response = await fetch(s3tBasePath(`/api/s3tables/bucket-policy?bucket=${encodeURIComponent(bucketArn)}`));
+            const data = await response.json();
+            if (!response.ok) {
+                throw new Error(data.error || ('HTTP ' + response.status));
+            }
+            if (data.policy) {
+                policyText = data.policy;
+            }
+        } catch (error) {
+            loadError = error;
         }
+        // A newer load (a different bucket, or this one reopened) has since
+        // superseded this response - don't let it touch the shared textarea,
+        // the editor state, or the loaded flag.
+        if (requestSeq !== s3tablesBucketPolicyRequestSeq) return;
+        if (loadError) {
+            console.error('Failed to load bucket policy', loadError);
+            alert('Failed to load bucket policy: ' + loadError.message + '. Close and reopen this dialog to try again.');
+            return;
+        }
+        document.getElementById('s3tablesBucketPolicyText').value = policyText;
+    }
+    if (requestSeq !== s3tablesBucketPolicyRequestSeq) return;
+    s3tablesBucketPolicyLoaded = true;
+    loadPolicyTextareaIntoEditor('s3tablesBucket');
+}
+
+async function saveS3TablesBucketPolicy() {
+    if (s3tablesBucketPolicyMutationInFlight) return;
+    if (!s3tablesBucketPolicyLoaded) {
+        alert('The current policy has not finished loading. Close and reopen this dialog before saving.');
+        return;
+    }
+    if (!commitPolicyActiveTab('s3tablesBucket')) return;
+    const bucketArn = currentS3TablesBucketPolicyTarget();
+    const policy = document.getElementById('s3tablesBucketPolicyText').value.trim();
+    if (!policy || !policyTextHasStatements(policy)) {
+        alert('Add at least one statement, or use Delete Policy to remove the policy.');
+        return;
+    }
+    setS3TablesBucketPolicyMutationInFlight(true);
+    try {
+        const response = await fetch(s3tBasePath('/api/s3tables/bucket-policy'), {
+            method: 'PUT',
+            headers: s3tWriteHeaders({ 'Content-Type': 'application/json' }),
+            body: JSON.stringify({ bucket_arn: bucketArn, policy: policy })
+        });
+        const data = await response.json();
+        setS3TablesBucketPolicyMutationInFlight(false);
+        const stillCurrent = bucketArn === currentS3TablesBucketPolicyTarget();
+        if (!response.ok) {
+            if (stillCurrent) {
+                alert(data.error || 'Failed to update policy');
+            } else {
+                console.error('Error saving policy for ' + bucketArn + ' (no longer the open resource): ' + (data.error || 'unknown error'));
+            }
+            return;
+        }
+        if (!stillCurrent) return;
+        s3tablesBucketPolicyModal.hide();
+        // Reload so the Policy column reflects the change.
+        setTimeout(() => location.reload(), 500);
     } catch (error) {
-        console.error('Failed to load bucket policy', error);
+        setS3TablesBucketPolicyMutationInFlight(false);
+        if (bucketArn === currentS3TablesBucketPolicyTarget()) {
+            alert('Failed to update policy: ' + error.message);
+        } else {
+            console.error('Error saving policy for ' + bucketArn + ': ' + error.message);
+        }
+    }
+}
+
+async function saveS3TablesTablePolicy() {
+    if (s3tablesTablePolicyMutationInFlight) return;
+    if (!s3tablesTablePolicyLoaded) {
+        alert('The current policy has not finished loading. Close and reopen this dialog before saving.');
+        return;
+    }
+    if (!commitPolicyActiveTab('s3tablesTable')) return;
+    const target = currentS3TablesTablePolicyTarget();
+    const policy = document.getElementById('s3tablesTablePolicyText').value.trim();
+    if (!policy || !policyTextHasStatements(policy)) {
+        alert('Add at least one statement, or use Delete Policy to remove the policy.');
+        return;
+    }
+    setS3TablesTablePolicyMutationInFlight(true);
+    try {
+        const response = await fetch(s3tBasePath('/api/s3tables/table-policy'), {
+            method: 'PUT',
+            headers: s3tWriteHeaders({ 'Content-Type': 'application/json' }),
+            body: JSON.stringify({
+                bucket_arn: document.getElementById('s3tablesTablePolicyBucketArn').value,
+                namespace: document.getElementById('s3tablesTablePolicyNamespace').value,
+                name: document.getElementById('s3tablesTablePolicyName').value,
+                policy: policy
+            })
+        });
+        const data = await response.json();
+        setS3TablesTablePolicyMutationInFlight(false);
+        const stillCurrent = target === currentS3TablesTablePolicyTarget();
+        if (!response.ok) {
+            if (stillCurrent) {
+                alert(data.error || 'Failed to update policy');
+            } else {
+                console.error('Error saving table policy (no longer the open resource): ' + (data.error || 'unknown error'));
+            }
+            return;
+        }
+        if (!stillCurrent) return;
+        s3tablesTablePolicyModal.hide();
+        setTimeout(() => location.reload(), 500);
+    } catch (error) {
+        setS3TablesTablePolicyMutationInFlight(false);
+        if (target === currentS3TablesTablePolicyTarget()) {
+            alert('Failed to update policy: ' + error.message);
+        } else {
+            console.error('Error saving table policy: ' + error.message);
+        }
     }
 }
 
 async function deleteS3TablesBucketPolicy() {
-    const bucketArn = document.getElementById('s3tablesBucketPolicyArn').value;
+    const bucketArn = currentS3TablesBucketPolicyTarget();
     if (!bucketArn) return;
+    if (s3tablesBucketPolicyMutationInFlight) return;
+    if (!s3tablesBucketPolicyLoaded) {
+        alert('The current policy has not finished loading. Close and reopen this dialog before deleting.');
+        return;
+    }
+    if (!confirm('Delete this table bucket policy? This cannot be undone.')) return;
+    setS3TablesBucketPolicyMutationInFlight(true);
     try {
         const response = await fetch(s3tBasePath(`/api/s3tables/bucket-policy?bucket=${encodeURIComponent(bucketArn)}`), { method: 'DELETE', headers: s3tWriteHeaders() });
         const data = await response.json();
+        setS3TablesBucketPolicyMutationInFlight(false);
+        const stillCurrent = bucketArn === currentS3TablesBucketPolicyTarget();
         if (!response.ok) {
-            alert(data.error || 'Failed to delete policy');
+            if (stillCurrent) {
+                alert(data.error || 'Failed to delete policy');
+            } else {
+                console.error('Error deleting policy for ' + bucketArn + ' (no longer the open resource): ' + (data.error || 'unknown error'));
+            }
             return;
         }
-        alert('Policy deleted');
-        document.getElementById('s3tablesBucketPolicyText').value = '';
+        if (!stillCurrent) return;
+        s3tablesBucketPolicyModal.hide();
+        setTimeout(() => location.reload(), 500);
     } catch (error) {
-        alert('Failed to delete policy: ' + error.message);
+        setS3TablesBucketPolicyMutationInFlight(false);
+        if (bucketArn === currentS3TablesBucketPolicyTarget()) {
+            alert('Failed to delete policy: ' + error.message);
+        } else {
+            console.error('Error deleting policy for ' + bucketArn + ': ' + error.message);
+        }
     }
 }
 
@@ -631,36 +858,82 @@ async function deleteIcebergTable() {
 }
 
 async function loadS3TablesTablePolicy(bucketArn, namespace, name) {
+    const requestSeq = ++s3tablesTablePolicyRequestSeq;
     document.getElementById('s3tablesTablePolicyText').value = '';
-    if (!bucketArn || !namespace || !name) return;
-    const query = new URLSearchParams({ bucket: bucketArn, namespace: namespace, name: name });
-    try {
-        const response = await fetch(s3tBasePath(`/api/s3tables/table-policy?${query.toString()}`));
-        const data = await response.json();
-        if (response.ok && data.policy) {
-            document.getElementById('s3tablesTablePolicyText').value = data.policy;
+    s3tablesTablePolicyLoaded = false;
+    // Reset the structured editor immediately too, so a still-open Editor
+    // tab doesn't keep showing the previously loaded resource's statements
+    // while this fetch is in flight.
+    loadPolicyTextareaIntoEditor('s3tablesTable');
+    if (bucketArn && namespace && name) {
+        const query = new URLSearchParams({ bucket: bucketArn, namespace: namespace, name: name });
+        let policyText = '';
+        let loadError = null;
+        try {
+            const response = await fetch(s3tBasePath(`/api/s3tables/table-policy?${query.toString()}`));
+            const data = await response.json();
+            if (!response.ok) {
+                throw new Error(data.error || ('HTTP ' + response.status));
+            }
+            if (data.policy) {
+                policyText = data.policy;
+            }
+        } catch (error) {
+            loadError = error;
         }
-    } catch (error) {
-        console.error('Failed to load table policy', error);
+        // A newer load (a different table, or this one reopened) has since
+        // superseded this response - don't let it touch the shared textarea,
+        // the editor state, or the loaded flag.
+        if (requestSeq !== s3tablesTablePolicyRequestSeq) return;
+        if (loadError) {
+            console.error('Failed to load table policy', loadError);
+            alert('Failed to load table policy: ' + loadError.message + '. Close and reopen this dialog to try again.');
+            return;
+        }
+        document.getElementById('s3tablesTablePolicyText').value = policyText;
     }
+    if (requestSeq !== s3tablesTablePolicyRequestSeq) return;
+    s3tablesTablePolicyLoaded = true;
+    loadPolicyTextareaIntoEditor('s3tablesTable');
 }
 
 async function deleteS3TablesTablePolicy() {
-    const dataContainer = document.getElementById('s3tables-tables-content');
-    const dataBucketArn = dataContainer.dataset.bucketArn || '';
-    const dataNamespace = dataContainer.dataset.namespace || '';
-    const query = new URLSearchParams({ bucket: dataBucketArn, namespace: dataNamespace, name: document.getElementById('s3tablesTablePolicyName').value });
+    if (s3tablesTablePolicyMutationInFlight) return;
+    if (!s3tablesTablePolicyLoaded) {
+        alert('The current policy has not finished loading. Close and reopen this dialog before deleting.');
+        return;
+    }
+    const target = currentS3TablesTablePolicyTarget();
+    const query = new URLSearchParams({
+        bucket: document.getElementById('s3tablesTablePolicyBucketArn').value,
+        namespace: document.getElementById('s3tablesTablePolicyNamespace').value,
+        name: document.getElementById('s3tablesTablePolicyName').value
+    });
+    if (!confirm('Delete the policy for table ' + document.getElementById('s3tablesTablePolicyName').value + '? This cannot be undone.')) return;
+    setS3TablesTablePolicyMutationInFlight(true);
     try {
         const response = await fetch(s3tBasePath(`/api/s3tables/table-policy?${query.toString()}`), { method: 'DELETE', headers: s3tWriteHeaders() });
         const data = await response.json();
+        setS3TablesTablePolicyMutationInFlight(false);
+        const stillCurrent = target === currentS3TablesTablePolicyTarget();
         if (!response.ok) {
-            alert(data.error || 'Failed to delete policy');
+            if (stillCurrent) {
+                alert(data.error || 'Failed to delete policy');
+            } else {
+                console.error('Error deleting table policy (no longer the open resource): ' + (data.error || 'unknown error'));
+            }
             return;
         }
-        alert('Policy deleted');
-        document.getElementById('s3tablesTablePolicyText').value = '';
+        if (!stillCurrent) return;
+        s3tablesTablePolicyModal.hide();
+        setTimeout(() => location.reload(), 500);
     } catch (error) {
-        alert('Failed to delete policy: ' + error.message);
+        setS3TablesTablePolicyMutationInFlight(false);
+        if (target === currentS3TablesTablePolicyTarget()) {
+            alert('Failed to delete policy: ' + error.message);
+        } else {
+            console.error('Error deleting table policy: ' + error.message);
+        }
     }
 }
 
diff --git a/weed/admin/static/licenses/bootstrap-icons-LICENSE.txt b/weed/admin/static/licenses/bootstrap-icons-LICENSE.txt
new file mode 100644
index 0000000000..f952439110
--- /dev/null
+++ b/weed/admin/static/licenses/bootstrap-icons-LICENSE.txt
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2019-2024 The Bootstrap Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/weed/admin/static/webfonts/fa-brands-400.ttf b/weed/admin/static/webfonts/fa-brands-400.ttf
deleted file mode 100644
index 774d51ac4b..0000000000
Binary files a/weed/admin/static/webfonts/fa-brands-400.ttf and /dev/null differ
diff --git a/weed/admin/static/webfonts/fa-brands-400.woff2 b/weed/admin/static/webfonts/fa-brands-400.woff2
deleted file mode 100644
index 71e3185268..0000000000
Binary files a/weed/admin/static/webfonts/fa-brands-400.woff2 and /dev/null differ
diff --git a/weed/admin/static/webfonts/fa-regular-400.ttf b/weed/admin/static/webfonts/fa-regular-400.ttf
deleted file mode 100644
index 8a9d6344d1..0000000000
Binary files a/weed/admin/static/webfonts/fa-regular-400.ttf and /dev/null differ
diff --git a/weed/admin/static/webfonts/fa-regular-400.woff2 b/weed/admin/static/webfonts/fa-regular-400.woff2
deleted file mode 100644
index 7f021680b9..0000000000
Binary files a/weed/admin/static/webfonts/fa-regular-400.woff2 and /dev/null differ
diff --git a/weed/admin/static/webfonts/fa-solid-900.ttf b/weed/admin/static/webfonts/fa-solid-900.ttf
deleted file mode 100644
index 993dbe1f95..0000000000
Binary files a/weed/admin/static/webfonts/fa-solid-900.ttf and /dev/null differ
diff --git a/weed/admin/static/webfonts/fa-solid-900.woff2 b/weed/admin/static/webfonts/fa-solid-900.woff2
deleted file mode 100644
index 5c16cd3e8a..0000000000
Binary files a/weed/admin/static/webfonts/fa-solid-900.woff2 and /dev/null differ
diff --git a/weed/admin/static_gz/css/admin.css.gz b/weed/admin/static_gz/css/admin.css.gz
index 70f6739e1c..6f9cf739fb 100644
Binary files a/weed/admin/static_gz/css/admin.css.gz and b/weed/admin/static_gz/css/admin.css.gz differ
diff --git a/weed/admin/static_gz/css/bootstrap-icons.min.css.gz b/weed/admin/static_gz/css/bootstrap-icons.min.css.gz
new file mode 100644
index 0000000000..3b5e3be836
Binary files /dev/null and b/weed/admin/static_gz/css/bootstrap-icons.min.css.gz differ
diff --git a/weed/admin/static_gz/css/fontawesome.min.css.gz b/weed/admin/static_gz/css/fontawesome.min.css.gz
deleted file mode 100644
index 0983ddea7d..0000000000
Binary files a/weed/admin/static_gz/css/fontawesome.min.css.gz and /dev/null differ
diff --git a/weed/admin/static_gz/css/fonts/bootstrap-icons.woff.gz b/weed/admin/static_gz/css/fonts/bootstrap-icons.woff.gz
new file mode 100644
index 0000000000..3e9ad0c86f
Binary files /dev/null and b/weed/admin/static_gz/css/fonts/bootstrap-icons.woff.gz differ
diff --git a/weed/admin/static_gz/css/fonts/bootstrap-icons.woff2.gz b/weed/admin/static_gz/css/fonts/bootstrap-icons.woff2.gz
new file mode 100644
index 0000000000..8f0a88d4a3
Binary files /dev/null and b/weed/admin/static_gz/css/fonts/bootstrap-icons.woff2.gz differ
diff --git a/weed/admin/static_gz/js/admin.js.gz b/weed/admin/static_gz/js/admin.js.gz
index 67efcbc799..a4ebc6fd53 100644
Binary files a/weed/admin/static_gz/js/admin.js.gz and b/weed/admin/static_gz/js/admin.js.gz differ
diff --git a/weed/admin/static_gz/js/modal-alerts.js.gz b/weed/admin/static_gz/js/modal-alerts.js.gz
index 3dfccb61d8..4e3ce929f9 100644
Binary files a/weed/admin/static_gz/js/modal-alerts.js.gz and b/weed/admin/static_gz/js/modal-alerts.js.gz differ
diff --git a/weed/admin/static_gz/js/policy_editor.js.gz b/weed/admin/static_gz/js/policy_editor.js.gz
new file mode 100644
index 0000000000..faec0d2cb0
Binary files /dev/null and b/weed/admin/static_gz/js/policy_editor.js.gz differ
diff --git a/weed/admin/static_gz/js/s3tables.js.gz b/weed/admin/static_gz/js/s3tables.js.gz
index f8430e4f81..eac465e584 100644
Binary files a/weed/admin/static_gz/js/s3tables.js.gz and b/weed/admin/static_gz/js/s3tables.js.gz differ
diff --git a/weed/admin/static_gz/licenses/bootstrap-icons-LICENSE.txt.gz b/weed/admin/static_gz/licenses/bootstrap-icons-LICENSE.txt.gz
new file mode 100644
index 0000000000..33406b54ee
Binary files /dev/null and b/weed/admin/static_gz/licenses/bootstrap-icons-LICENSE.txt.gz differ
diff --git a/weed/admin/static_gz/webfonts/fa-brands-400.ttf.gz b/weed/admin/static_gz/webfonts/fa-brands-400.ttf.gz
deleted file mode 100644
index 671c00b798..0000000000
Binary files a/weed/admin/static_gz/webfonts/fa-brands-400.ttf.gz and /dev/null differ
diff --git a/weed/admin/static_gz/webfonts/fa-brands-400.woff2.gz b/weed/admin/static_gz/webfonts/fa-brands-400.woff2.gz
deleted file mode 100644
index 49b4342ffe..0000000000
Binary files a/weed/admin/static_gz/webfonts/fa-brands-400.woff2.gz and /dev/null differ
diff --git a/weed/admin/static_gz/webfonts/fa-regular-400.ttf.gz b/weed/admin/static_gz/webfonts/fa-regular-400.ttf.gz
deleted file mode 100644
index d1524c81ca..0000000000
Binary files a/weed/admin/static_gz/webfonts/fa-regular-400.ttf.gz and /dev/null differ
diff --git a/weed/admin/static_gz/webfonts/fa-regular-400.woff2.gz b/weed/admin/static_gz/webfonts/fa-regular-400.woff2.gz
deleted file mode 100644
index 60a602df80..0000000000
Binary files a/weed/admin/static_gz/webfonts/fa-regular-400.woff2.gz and /dev/null differ
diff --git a/weed/admin/static_gz/webfonts/fa-solid-900.ttf.gz b/weed/admin/static_gz/webfonts/fa-solid-900.ttf.gz
deleted file mode 100644
index 009edbc6dc..0000000000
Binary files a/weed/admin/static_gz/webfonts/fa-solid-900.ttf.gz and /dev/null differ
diff --git a/weed/admin/static_gz/webfonts/fa-solid-900.woff2.gz b/weed/admin/static_gz/webfonts/fa-solid-900.woff2.gz
deleted file mode 100644
index 98a96cc4a0..0000000000
Binary files a/weed/admin/static_gz/webfonts/fa-solid-900.woff2.gz and /dev/null differ
diff --git a/weed/admin/topology/empty_disk_type_test.go b/weed/admin/topology/empty_disk_type_test.go
new file mode 100644
index 0000000000..37e3a9fdda
--- /dev/null
+++ b/weed/admin/topology/empty_disk_type_test.go
@@ -0,0 +1,174 @@
+package topology
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+// A master that answered a capacity question for a disk type a node lacks
+// published an empty DiskInfo of that type for the node: no capacity, no
+// volumes, DiskId 0 -- the same id as the node's real first disk. Disks are
+// keyed by node and disk id here, so whichever DiskInfo the map iteration
+// visited last won disk 0: an SSD-only node sometimes looked like an empty
+// HDD disk (and a balance destination for HDD volumes), and an HDD node
+// sometimes lost its volumes behind an empty "ssd" disk.
+func TestUpdateTopologyIgnoresEmptyDiskTypeEntries(t *testing.T) {
+	topo := &master_pb.TopologyInfo{
+		Id: "phantom_disk_types",
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id: "dc1",
+			RackInfos: []*master_pb.RackInfo{{
+				Id: "rack1",
+				DataNodeInfos: []*master_pb.DataNodeInfo{
+					{
+						Id:      "ssd-node",
+						Address: "ssd-node:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"ssd": {Type: "ssd", MaxVolumeCount: 200, VolumeCount: 1,
+								VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 7, DiskType: "ssd"}}},
+							"": {Type: ""}, // the empty entry the master made up
+						},
+					},
+					{
+						Id:      "hdd-node",
+						Address: "hdd-node:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"": {Type: "", MaxVolumeCount: 100, VolumeCount: 1,
+								VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 3}}},
+							"ssd": {Type: "ssd"},
+						},
+					},
+					{
+						// An empty disk of unknown capacity with nothing else on the
+						// node is a disk, not a leftover: it must stay.
+						Id:        "new-node",
+						Address:   "new-node:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{"": {Type: ""}},
+					},
+				},
+			}},
+		}},
+	}
+
+	at := NewActiveTopology(0)
+	// Map iteration order is random; repeat so a shadowed disk would show.
+	for i := 0; i < 64; i++ {
+		if err := at.UpdateTopology(topo); err != nil {
+			t.Fatalf("UpdateTopology: %v", err)
+		}
+		for node, want := range map[string]string{"ssd-node": "ssd", "hdd-node": "", "new-node": ""} {
+			disks := at.GetNodeDisks(node)
+			if len(disks) != 1 || disks[0].DiskType != want || (node != "new-node" && disks[0].DiskInfo.MaxVolumeCount == 0) {
+				var got []string
+				for _, d := range disks {
+					got = append(got, "\""+d.DiskType+"\"")
+				}
+				t.Fatalf("pass %d: %s disks %v, want exactly its real %q disk", i, node, got, want)
+			}
+		}
+	}
+	if _, _, disks := CountTopologyResources(topo); disks != 3 {
+		t.Errorf("CountTopologyResources disks = %d, want 3 (a made-up empty entry is not a disk)", disks)
+	}
+}
+
+// The volume index is built from the per-disk map, so a shadowed disk 0 also
+// hid its volumes: planners failed to find a volume on the server that holds
+// it ("Could not find volume N on source server").
+func TestUpdateTopologyKeepsVolumesBehindEmptyDiskTypeEntries(t *testing.T) {
+	topo := &master_pb.TopologyInfo{
+		Id: "phantom_disk_types_index",
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id: "dc1",
+			RackInfos: []*master_pb.RackInfo{{
+				Id: "rack1",
+				DataNodeInfos: []*master_pb.DataNodeInfo{{
+					Id:      "hdd-node",
+					Address: "hdd-node:8080",
+					DiskInfos: map[string]*master_pb.DiskInfo{
+						"": {Type: "", MaxVolumeCount: 100, VolumeCount: 1,
+							VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 3, Collection: "c1"}}},
+						"ssd": {Type: "ssd"},
+					},
+				}},
+			}},
+		}},
+	}
+
+	at := NewActiveTopology(0)
+	for i := 0; i < 64; i++ {
+		if err := at.UpdateTopology(topo); err != nil {
+			t.Fatalf("UpdateTopology: %v", err)
+		}
+		locations := at.GetVolumeLocations(3, "c1")
+		if len(locations) != 1 || locations[0].ServerID != "hdd-node" {
+			t.Fatalf("pass %d: volume 3 locations %+v, want it on hdd-node", i, locations)
+		}
+	}
+}
+
+// The made-up entry always carries DiskId 0, so it need not collide with a
+// real disk: here each node's only usable disk is location 1 (location 0 is
+// unavailable, so the volume server does not report it). The entry must still
+// not count as a disk, nor reach planners as an empty disk of unknown
+// capacity on a node that has no disk of its type.
+func TestUpdateTopologyIgnoresEmptyDiskTypeEntriesAtAnyDiskId(t *testing.T) {
+	topo := &master_pb.TopologyInfo{
+		Id: "phantom_disk_types_no_collision",
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id: "dc1",
+			RackInfos: []*master_pb.RackInfo{{
+				Id: "rack1",
+				DataNodeInfos: []*master_pb.DataNodeInfo{
+					{
+						Id:      "ssd-node",
+						Address: "ssd-node:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"ssd": {Type: "ssd", DiskId: 1, MaxVolumeCount: 200, VolumeCount: 1,
+								MaxVolumeCountByDisk: map[uint32]int64{1: 200},
+								VolumeInfos:          []*master_pb.VolumeInformationMessage{{Id: 7, DiskType: "ssd", DiskId: 1}}},
+							"": {Type: ""},
+						},
+					},
+					{
+						Id:      "hdd-node",
+						Address: "hdd-node:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"": {Type: "", DiskId: 1, MaxVolumeCount: 100, VolumeCount: 1,
+								MaxVolumeCountByDisk: map[uint32]int64{1: 100},
+								VolumeInfos:          []*master_pb.VolumeInformationMessage{{Id: 3, DiskId: 1}}},
+							"ssd": {Type: "ssd"},
+						},
+					},
+				},
+			}},
+		}},
+	}
+
+	at := NewActiveTopology(0)
+	for i := 0; i < 16; i++ {
+		if err := at.UpdateTopology(topo); err != nil {
+			t.Fatalf("UpdateTopology: %v", err)
+		}
+		for node, want := range map[string]string{"ssd-node": "ssd", "hdd-node": ""} {
+			disks := at.GetNodeDisks(node)
+			if len(disks) != 1 || disks[0].DiskType != want || disks[0].DiskID != 1 {
+				var got []string
+				for _, d := range disks {
+					got = append(got, fmt.Sprintf("%q@%d", d.DiskType, d.DiskID))
+				}
+				t.Fatalf("pass %d: %s disks %v, want only its real %q disk 1", i, node, got, want)
+			}
+		}
+	}
+	for _, disk := range at.GetDisksWithEffectiveCapacity(TaskTypeBalance, "", 1) {
+		if disk.DiskID == 0 {
+			t.Errorf("planners offered %s disk 0 (%q), which does not exist", disk.NodeID, disk.DiskType)
+		}
+	}
+	if _, _, disks := CountTopologyResources(topo); disks != 2 {
+		t.Errorf("CountTopologyResources disks = %d, want 2", disks)
+	}
+}
diff --git a/weed/admin/topology/topology_management.go b/weed/admin/topology/topology_management.go
index adc512b82f..624bd403a5 100644
--- a/weed/admin/topology/topology_management.go
+++ b/weed/admin/topology/topology_management.go
@@ -9,6 +9,36 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 )
 
+// isEmptyDiskTypeEntry reports a DiskInfo with no capacity and nothing on it.
+func isEmptyDiskTypeEntry(diskInfo *master_pb.DiskInfo) bool {
+	return diskInfo != nil &&
+		diskInfo.MaxVolumeCount <= 0 &&
+		diskInfo.VolumeCount == 0 &&
+		diskInfo.RemoteVolumeCount == 0 &&
+		len(diskInfo.VolumeInfos) == 0 &&
+		len(diskInfo.EcShardInfos) == 0 &&
+		len(diskInfo.MaxVolumeCountByDisk) == 0
+}
+
+// IsPhantomDiskTypeEntry reports whether node's DiskInfo of diskType is an
+// empty entry on a node that has a disk of another type with capacity or
+// data. Masters used to publish such an entry for every disk type a capacity
+// check had asked about; keyed by node and disk id it can replace or pose as
+// a real disk and be offered to planners as an empty destination of a type
+// the node lacks. A node whose entries are all empty keeps them, as disks of
+// unknown capacity.
+func IsPhantomDiskTypeEntry(node *master_pb.DataNodeInfo, diskType string) bool {
+	if node == nil || !isEmptyDiskTypeEntry(node.DiskInfos[diskType]) {
+		return false
+	}
+	for otherType, other := range node.DiskInfos {
+		if otherType != diskType && other != nil && !isEmptyDiskTypeEntry(other) {
+			return true
+		}
+	}
+	return false
+}
+
 // CountTopologyResources counts datacenters, nodes, and disks in topology info
 func CountTopologyResources(topologyInfo *master_pb.TopologyInfo) (dcCount, nodeCount, diskCount int) {
 	if topologyInfo == nil {
@@ -22,7 +52,10 @@ func CountTopologyResources(topologyInfo *master_pb.TopologyInfo) (dcCount, node
 				// DiskInfos is keyed by disk type, so same-type physical disks
 				// collapse into one entry. Count physical disks so the number
 				// matches the per-disk activeDisk map.
-				for _, diskInfo := range node.DiskInfos {
+				for diskType, diskInfo := range node.DiskInfos {
+					if IsPhantomDiskTypeEntry(node, diskType) {
+						continue
+					}
 					diskCount += len(diskInfo.SplitByPhysicalDisk())
 				}
 			}
@@ -82,6 +115,9 @@ func (at *ActiveTopology) UpdateTopology(topologyInfo *master_pb.TopologyInfo) e
 				// One activeDisk per physical disk_id: the master keys
 				// DiskInfos by disk type, so same-type disks must be split out.
 				for diskType, diskInfo := range nodeInfo.DiskInfos {
+					if IsPhantomDiskTypeEntry(nodeInfo, diskType) {
+						continue
+					}
 					perDiskInfos := diskInfo.SplitByPhysicalDisk()
 					for _, perDisk := range perDiskInfos {
 						disk := &activeDisk{
diff --git a/weed/admin/view/app/admin.templ b/weed/admin/view/app/admin.templ
index 43346d0c0d..8594f19346 100644
--- a/weed/admin/view/app/admin.templ
+++ b/weed/admin/view/app/admin.templ
@@ -8,12 +8,12 @@ import (
 templ Admin(data dash.AdminData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <h1 class="h2">
-            <i class="fas fa-tachometer-alt me-2"></i>Dashboard
+            <i class="bi bi-speedometer2 me-2"></i>Dashboard
         </h1>
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
                  				<a href={ dash.PUrl(ctx, "/object-store/buckets") } class="btn btn-sm btn-primary">
-					<i class="fas fa-cube me-1"></i>Object Store Buckets
+					<i class="bi bi-box me-1"></i>Object Store Buckets
                 </a>
 
             </div>
@@ -32,12 +32,12 @@ templ Admin(data dash.AdminData) {
                                 <div class="text-xs font-weight-bold text-success text-uppercase mb-1">
                                     Total Volumes
                                 </div>
-                                <div class="h5 mb-0 font-weight-bold text-gray-800">
+                                <div class="h5 mb-0 font-weight-bold text-body-emphasis">
                                     {fmt.Sprintf("%d", data.TotalVolumes)}
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-database fa-2x text-gray-300"></i>
+                                <i class="bi bi-database icon-2x text-gray-300"></i>
                             </div>
                         </div>
                         @templ.Raw(data.Trends.Volumes)
@@ -58,7 +58,7 @@ templ Admin(data dash.AdminData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-cubes fa-2x text-gray-300"></i>
+                                <i class="bi bi-boxes icon-2x text-gray-300"></i>
                             </div>
                         </div>
                         @templ.Raw(data.Trends.Chunks)
@@ -79,7 +79,7 @@ templ Admin(data dash.AdminData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-hdd fa-2x text-gray-300"></i>
+                                <i class="bi bi-device-hdd icon-2x text-gray-300"></i>
                             </div>
                         </div>
                         @templ.Raw(data.Trends.DiskUsed)
@@ -100,7 +100,7 @@ templ Admin(data dash.AdminData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-cogs fa-2x text-gray-300"></i>
+                                <i class="bi bi-gear-wide-connected icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -123,7 +123,7 @@ templ Admin(data dash.AdminData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-layer-group fa-2x text-gray-300"></i>
+                                <i class="bi bi-layers icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -143,7 +143,7 @@ templ Admin(data dash.AdminData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-puzzle-piece fa-2x text-gray-300"></i>
+                                <i class="bi bi-puzzle icon-2x text-gray-300"></i>
                             </div>
                         </div>
                         @templ.Raw(data.Trends.EcShards)
@@ -164,7 +164,7 @@ templ Admin(data dash.AdminData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-tasks fa-2x text-gray-300"></i>
+                                <i class="bi bi-list-check icon-2x text-gray-300"></i>
                             </div>
                         </div>
                         @templ.Raw(data.Trends.Tasks)
@@ -185,7 +185,7 @@ templ Admin(data dash.AdminData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-users-cog fa-2x text-gray-300"></i>
+                                <i class="bi bi-people-fill icon-2x text-gray-300"></i>
                             </div>
                         </div>
                         @templ.Raw(data.Trends.Workers)
@@ -194,21 +194,104 @@ templ Admin(data dash.AdminData) {
             </div>
         </div>
 
+        <!-- Storage Tiers -->
+        if len(data.TierStats) > 0 {
+            <div class="row mb-4">
+                <div class="col-12">
+                    <div class="card shadow mb-4">
+                        <div class="card-header py-3">
+                            <h6 class="m-0 font-weight-bold text-primary">
+                                <i class="bi bi-layers me-2"></i>Storage Tiers
+                            </h6>
+                        </div>
+                        <div class="card-body">
+                            <div class="table-responsive">
+                                <table class="table table-hover" width="100%" cellspacing="0">
+                                    <thead>
+                                        <tr>
+                                            <th>Tier</th>
+                                            <th>Volumes</th>
+                                            <th>EC Shards</th>
+                                            <th>Data Size</th>
+                                            <th>Disk Used</th>
+                                            <th>Capacity</th>
+                                            <th>Usage</th>
+                                        </tr>
+                                    </thead>
+                                    <tbody>
+                                        for _, tier := range data.TierStats {
+                                            <tr>
+                                                <td>
+                                                    if tier.IsRemote {
+                                                        <i class="bi bi-cloud me-1 text-info"></i>{tier.Name}
+                                                        <span class="badge bg-info text-white ms-1">remote</span>
+                                                    } else {
+                                                        <i class="bi bi-device-hdd me-1 text-muted"></i>{tier.Name}
+                                                    }
+                                                </td>
+                                                <td>{fmt.Sprintf("%d", tier.VolumeCount)}</td>
+                                                <td>
+                                                    if tier.IsRemote {
+                                                        <span class="text-muted">-</span>
+                                                    } else {
+                                                        {fmt.Sprintf("%d", tier.EcShardCount)}
+                                                    }
+                                                </td>
+                                                <td>{formatBytes(tier.DataSize)}</td>
+                                                <td>
+                                                    if tier.IsRemote || tier.DiskUsed == 0 {
+                                                        <span class="text-muted">-</span>
+                                                    } else {
+                                                        {formatBytes(tier.DiskUsed)}
+                                                    }
+                                                </td>
+                                                <td>
+                                                    if tier.IsRemote {
+                                                        <span class="text-muted">-</span>
+                                                    } else {
+                                                        {formatBytes(tier.DiskCapacity)}
+                                                    }
+                                                </td>
+                                                <td>
+                                                    if tier.IsRemote {
+                                                        <span class="text-muted">-</span>
+                                                    } else {
+                                                        <div class="d-flex align-items-center">
+                                                            <div class="progress flex-grow-1" style="height: 20px; min-width: 48px;">
+                                                                <div class="progress-bar" role="progressbar"
+                                                                     style={fmt.Sprintf("width: %d%%", tier.UsagePercent())}>
+                                                                </div>
+                                                            </div>
+                                                            <span class="ms-2 text-nowrap">{fmt.Sprintf("%d%%", tier.UsagePercent())}</span>
+                                                        </div>
+                                                    }
+                                                </td>
+                                            </tr>
+                                        }
+                                    </tbody>
+                                </table>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </div>
+        }
+
         <!-- Mount Clients -->
         <div class="row mb-4">
             <div class="col-12">
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex justify-content-between align-items-center">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-plug me-2"></i>Mount Clients
+                            <i class="bi bi-plug me-2"></i>Mount Clients
                         </h6>
-                        <a id="mountClientsDetailsLink" href="/cluster/mount-clients" class="btn btn-sm btn-outline-primary">
-                            View Details <i class="fas fa-arrow-right ms-1"></i>
+                        <a href={ dash.PUrl(ctx, "/cluster/mount-clients") } class="btn btn-sm btn-outline-primary">
+                            View Details <i class="bi bi-arrow-right ms-1"></i>
                         </a>
                     </div>
                     <div class="card-body">
                         <div class="d-flex align-items-center">
-                            <i class="fas fa-plug fa-2x text-gray-300 me-3"></i>
+                            <i class="bi bi-plug icon-2x text-gray-300 me-3"></i>
                             <div>
                                 <div class="h4 mb-0 font-weight-bold text-gray-800">{fmt.Sprintf("%d", data.TotalMountClients)}</div>
                                 <div class="text-xs text-muted text-uppercase">Connected FUSE/VFS mount clients</div>
@@ -218,9 +301,6 @@ templ Admin(data dash.AdminData) {
                 </div>
             </div>
         </div>
-        <script>
-        (function(){var l=document.getElementById('mountClientsDetailsLink'); if(l){l.href=(window.__BASE_PATH__||'')+'/cluster/mount-clients';}})();
-        </script>
 
         <!-- Master Nodes Status -->
         <div class="row mb-4">
@@ -228,7 +308,7 @@ templ Admin(data dash.AdminData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-server me-2"></i>Master Nodes
+                            <i class="bi bi-server me-2"></i>Master Nodes
                         </h6>
                     </div>
                     <div class="card-body">
@@ -246,7 +326,7 @@ templ Admin(data dash.AdminData) {
                                             <td>
                                                 <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", master.Address))} target="_blank">
                                                     {master.Address}
-                                                    <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                    <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                                 </a>
                                             </td>
                                             <td>
@@ -270,7 +350,7 @@ templ Admin(data dash.AdminData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-chart-pie me-2"></i>Cluster
+                            <i class="bi bi-pie-chart me-2"></i>Cluster
                         </h6>
                     </div>
                     <div class="card-body text-center">
@@ -327,11 +407,11 @@ templ Admin(data dash.AdminData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-database me-2"></i>Volume Servers
+                            <i class="bi bi-database me-2"></i>Volume Servers
                         </h6>
                         <div class="dropdown no-arrow">
                             <a class="dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown">
-                                <i class="fas fa-ellipsis-v fa-sm fa-fw text-gray-400"></i>
+                                <i class="bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400"></i>
                             </a>
                             <div class="dropdown-menu dropdown-menu-right shadow animated--fade-in">
                                 <div class="dropdown-header">Actions:</div>
@@ -351,7 +431,7 @@ templ Admin(data dash.AdminData) {
                                         <th>Rack</th>
                                         <th>Volumes</th>
                                         <th>EC Shards</th>
-                                        <th>Capacity</th>
+                                        <th>Usage / Capacity</th>
                                     </tr>
                                 </thead>
                                 <tbody>
@@ -361,17 +441,19 @@ templ Admin(data dash.AdminData) {
                                             <td>
                                                 <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", vs.GetDisplayAddress()))} target="_blank">
                                                     {vs.GetDisplayAddress()}
-                                                    <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                    <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                                 </a>
                                             </td>
                                             <td>{vs.DataCenter}</td>
                                             <td>{vs.Rack}</td>
                                             <td>
-                                                <div class="progress" style="height: 20px;">
-                                                    <div class="progress-bar" role="progressbar" 
-                                                         style={fmt.Sprintf("width: %d%%", calculatePercent(vs.Volumes, vs.MaxVolumes))}>
-                                                        {fmt.Sprintf("%d/%d", vs.Volumes, vs.MaxVolumes)}
+                                                <div class="d-flex align-items-center">
+                                                    <div class="progress flex-grow-1" style="height: 20px; min-width: 48px;">
+                                                        <div class="progress-bar" role="progressbar" 
+                                                             style={fmt.Sprintf("width: %d%%", calculatePercent(vs.Volumes, vs.MaxVolumes))}>
+                                                        </div>
                                                     </div>
+                                                    <span class="ms-2 text-nowrap">{fmt.Sprintf("%d/%d", vs.Volumes, vs.MaxVolumes)}</span>
                                                 </div>
                                             </td>
                                             <td>
@@ -384,13 +466,19 @@ templ Admin(data dash.AdminData) {
                                                     <span class="text-muted">-</span>
                                                 }
                                             </td>
-                                            <td>{formatBytes(vs.DiskUsage)} / {formatBytes(vs.DiskCapacity)}</td>
+                                            <td>
+                                                {formatBytes(vs.DiskUsage)} / {formatBytes(vs.DiskCapacity)}
+                                                if vs.RemoteSize > 0 {
+                                                    <br/>
+                                                    <small class="text-muted"><i class="bi bi-cloud me-1"></i>{formatBytes(vs.RemoteSize)} remote</small>
+                                                }
+                                            </td>
                                         </tr>
                                     }
                                     if len(data.VolumeServers) == 0 {
                                         <tr>
                                             <td colspan="7" class="text-center text-muted py-4">
-                                                <i class="fas fa-info-circle me-2"></i>
+                                                <i class="bi bi-info-circle me-2"></i>
                                                 No volume servers found
                                             </td>
                                         </tr>
@@ -409,11 +497,11 @@ templ Admin(data dash.AdminData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-folder me-2"></i>Filer Nodes
+                            <i class="bi bi-folder me-2"></i>Filer Nodes
                         </h6>
                         <div class="dropdown no-arrow">
                             <a class="dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown">
-                                <i class="fas fa-ellipsis-v fa-sm fa-fw text-gray-400"></i>
+                                <i class="bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400"></i>
                             </a>
                             <div class="dropdown-menu dropdown-menu-right shadow animated--fade-in">
                                 <div class="dropdown-header">Actions:</div>
@@ -439,7 +527,7 @@ templ Admin(data dash.AdminData) {
                                             <td>
                                                 <a href={templ.SafeURL(fmt.Sprintf("//%s", filer.Address))} target="_blank">
                                                     {filer.Address}
-                                                    <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                    <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                                 </a>
                                             </td>
                                             <td>{filer.DataCenter}</td>
@@ -450,7 +538,7 @@ templ Admin(data dash.AdminData) {
                                     if len(data.FilerNodes) == 0 {
                                         <tr>
                                             <td colspan="4" class="text-center text-muted py-4">
-                                                <i class="fas fa-info-circle me-2"></i>
+                                                <i class="bi bi-info-circle me-2"></i>
                                                 No filer nodes found
                                             </td>
                                         </tr>
@@ -469,11 +557,11 @@ templ Admin(data dash.AdminData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-cloud me-2"></i>S3 Servers
+                            <i class="bi bi-cloud me-2"></i>S3 Servers
                         </h6>
                         <div class="dropdown no-arrow">
                             <a class="dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown">
-                                <i class="fas fa-ellipsis-v fa-sm fa-fw text-gray-400"></i>
+                                <i class="bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400"></i>
                             </a>
                             <div class="dropdown-menu dropdown-menu-right shadow animated--fade-in">
                                 <div class="dropdown-header">Actions:</div>
@@ -502,7 +590,7 @@ templ Admin(data dash.AdminData) {
                                     if len(data.S3Nodes) == 0 {
                                         <tr>
                                             <td colspan="3" class="text-center text-muted py-4">
-                                                <i class="fas fa-info-circle me-2"></i>
+                                                <i class="bi bi-info-circle me-2"></i>
                                                 No S3 servers found
                                             </td>
                                         </tr>
@@ -519,7 +607,7 @@ templ Admin(data dash.AdminData) {
         <div class="row">
             <div class="col-12">
                 <small class="text-muted">
-                    <i class="fas fa-clock me-1"></i>
+                    <i class="bi bi-clock me-1"></i>
                     Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
                 </small>
             </div>
diff --git a/weed/admin/view/app/admin_templ.go b/weed/admin/view/app/admin_templ.go
index 0a05cc0420..1c81b8531b 100644
--- a/weed/admin/view/app/admin_templ.go
+++ b/weed/admin/view/app/admin_templ.go
@@ -34,7 +34,7 @@ func Admin(data dash.AdminData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-tachometer-alt me-2\"></i>Dashboard</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-speedometer2 me-2\"></i>Dashboard</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\" class=\"btn btn-sm btn-primary\"><i class=\"fas fa-cube me-1\"></i>Object Store Buckets</a></div></div></div><div id=\"dashboard-content\"><!-- Summary Cards — each carries an inline sparkline of recent history\n             from the admin's own snapshots (no Prometheus required). --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\" class=\"btn btn-sm btn-primary\"><i class=\"bi bi-box me-1\"></i>Object Store Buckets</a></div></div></div><div id=\"dashboard-content\"><!-- Summary Cards — each carries an inline sparkline of recent history\n             from the admin's own snapshots (no Prometheus required). --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +60,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-database fa-2x text-gray-300\"></i></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-database icon-2x text-gray-300\"></i></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -81,7 +81,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</div></div><div class=\"col-auto\"><i class=\"fas fa-cubes fa-2x text-gray-300\"></i></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</div></div><div class=\"col-auto\"><i class=\"bi bi-boxes icon-2x text-gray-300\"></i></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -102,7 +102,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</div></div><div class=\"col-auto\"><i class=\"fas fa-hdd fa-2x text-gray-300\"></i></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</div></div><div class=\"col-auto\"><i class=\"bi bi-device-hdd icon-2x text-gray-300\"></i></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -123,7 +123,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</div></div><div class=\"col-auto\"><i class=\"fas fa-cogs fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Second Row for EC Shards Information --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-secondary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-secondary text-uppercase mb-1\">EC Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</div></div><div class=\"col-auto\"><i class=\"bi bi-gear-wide-connected icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Second Row for EC Shards Information --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-secondary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-secondary text-uppercase mb-1\">EC Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -136,7 +136,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "</div></div><div class=\"col-auto\"><i class=\"fas fa-layer-group fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-dark shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-dark text-uppercase mb-1\">EC Shards</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "</div></div><div class=\"col-auto\"><i class=\"bi bi-layers icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-dark shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-dark text-uppercase mb-1\">EC Shards</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -149,7 +149,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"fas fa-puzzle-piece fa-2x text-gray-300\"></i></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"bi bi-puzzle icon-2x text-gray-300\"></i></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -170,7 +170,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</div></div><div class=\"col-auto\"><i class=\"fas fa-tasks fa-2x text-gray-300\"></i></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</div></div><div class=\"col-auto\"><i class=\"bi bi-list-check icon-2x text-gray-300\"></i></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -191,7 +191,7 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</div></div><div class=\"col-auto\"><i class=\"fas fa-users-cog fa-2x text-gray-300\"></i></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</div></div><div class=\"col-auto\"><i class=\"bi bi-people-fill icon-2x text-gray-300\"></i></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -199,530 +199,750 @@ func Admin(data dash.AdminData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</div></div></div></div><!-- Mount Clients --><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex justify-content-between align-items-center\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-plug me-2\"></i>Mount Clients</h6><a id=\"mountClientsDetailsLink\" href=\"/cluster/mount-clients\" class=\"btn btn-sm btn-outline-primary\">View Details <i class=\"fas fa-arrow-right ms-1\"></i></a></div><div class=\"card-body\"><div class=\"d-flex align-items-center\"><i class=\"fas fa-plug fa-2x text-gray-300 me-3\"></i><div><div class=\"h4 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</div></div></div></div><!-- Storage Tiers -->")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var11 string
-		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalMountClients))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 213, Col: 126}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</div><div class=\"text-xs text-muted text-uppercase\">Connected FUSE/VFS mount clients</div></div></div></div></div></div></div><script>\n        (function(){var l=document.getElementById('mountClientsDetailsLink'); if(l){l.href=(window.__BASE_PATH__||'')+'/cluster/mount-clients';}})();\n        </script><!-- Master Nodes Status --><div class=\"row mb-4\"><div class=\"col-lg-4\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-server me-2\"></i>Master Nodes</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-bordered\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Address</th><th>Role</th></tr></thead> <tbody>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		for _, master := range data.MasterNodes {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<tr><td><a href=\"")
+		if len(data.TierStats) > 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "<div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-layers me-2\"></i>Storage Tiers</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Tier</th><th>Volumes</th><th>EC Shards</th><th>Data Size</th><th>Disk Used</th><th>Capacity</th><th>Usage</th></tr></thead> <tbody>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var12 templ.SafeURL
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", master.Address)))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 247, Col: 121}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\" target=\"_blank\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var13 string
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(master.Address)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 248, Col: 67}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if master.IsLeader {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<span class=\"badge bg-primary\">Leader</span>")
+			for _, tier := range data.TierStats {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<tr><td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<span class=\"badge bg-secondary\">Follower</span>")
+				if tier.IsRemote {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<i class=\"bi bi-cloud me-1 text-info\"></i>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var11 string
+					templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(tier.Name)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 226, Col: 108}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, " <span class=\"badge bg-info text-white ms-1\">remote</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<i class=\"bi bi-device-hdd me-1 text-muted\"></i>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var12 string
+					templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(tier.Name)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 229, Col: 114}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var13 string
+				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", tier.VolumeCount))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 232, Col: 88}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if tier.IsRemote {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "<span class=\"text-muted\">-</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					var templ_7745c5c3_Var14 string
+					templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", tier.EcShardCount))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 237, Col: 93}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var15 string
+				templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(tier.DataSize))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 240, Col: 79}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if tier.IsRemote || tier.DiskUsed == 0 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<span class=\"text-muted\">-</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					var templ_7745c5c3_Var16 string
+					templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(tier.DiskUsed))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 245, Col: 83}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if tier.IsRemote {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<span class=\"text-muted\">-</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					var templ_7745c5c3_Var17 string
+					templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(tier.DiskCapacity))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 252, Col: 87}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if tier.IsRemote {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<span class=\"text-muted\">-</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<div class=\"d-flex align-items-center\"><div class=\"progress flex-grow-1\" style=\"height: 20px; min-width: 48px;\"><div class=\"progress-bar\" role=\"progressbar\" style=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var18 string
+					templ_7745c5c3_Var18, templ_7745c5c3_Err = templruntime.SanitizeStyleAttributeValues(fmt.Sprintf("width: %d%%", tier.UsagePercent()))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 262, Col: 123}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "\"></div></div><span class=\"ms-2 text-nowrap\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var19 string
+					templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d%%", tier.UsagePercent()))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 265, Col: 132}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</span></div>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</tbody></table></div></div></div></div></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</tbody></table></div></div></div></div><!-- System Health --><div class=\"col-lg-8\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-chart-pie me-2\"></i>Cluster</h6></div><div class=\"card-body text-center\"><div class=\"row\"><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var14 string
-		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.MasterNodes)))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 281, Col: 85}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "</h5><small class=\"text-muted\">Masters</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var15 string
-		templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.VolumeServers)))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 289, Col: 87}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</h5><small class=\"text-muted\">Volume Servers</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var16 string
-		templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.FilerNodes)))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 297, Col: 84}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</h5><small class=\"text-muted\">Filers</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var17 string
-		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.S3Nodes)))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 305, Col: 81}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</h5><small class=\"text-muted\">S3 Servers</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var18 string
-		templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.MessageBrokers)))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 313, Col: 88}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "</h5><small class=\"text-muted\">Message Brokers</small></div></div></div></div></div></div></div></div><!-- Volume Servers --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-database me-2\"></i>Volume Servers</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"fas fa-ellipsis-v fa-sm fa-fw text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var19 templ.SafeURL
-		templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/volumes"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 338, Col: 90}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\">View Details</a> <a class=\"dropdown-item\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<!-- Mount Clients --><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex justify-content-between align-items-center\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-plug me-2\"></i>Mount Clients</h6><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var20 templ.SafeURL
-		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/cluster"))
+		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/cluster/mount-clients"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 339, Col: 90}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 288, Col: 74}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\">Topology View</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>ID</th><th>Address</th><th>Data Center</th><th>Rack</th><th>Volumes</th><th>EC Shards</th><th>Capacity</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "\" class=\"btn btn-sm btn-outline-primary\">View Details <i class=\"bi bi-arrow-right ms-1\"></i></a></div><div class=\"card-body\"><div class=\"d-flex align-items-center\"><i class=\"bi bi-plug icon-2x text-gray-300 me-3\"></i><div><div class=\"h4 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		for _, vs := range data.VolumeServers {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<tr><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var21 string
-			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(vs.ID)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 360, Col: 54}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</td><td><a href=\"")
+		var templ_7745c5c3_Var21 string
+		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalMountClients))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 296, Col: 126}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</div><div class=\"text-xs text-muted text-uppercase\">Connected FUSE/VFS mount clients</div></div></div></div></div></div></div><!-- Master Nodes Status --><div class=\"row mb-4\"><div class=\"col-lg-4\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-server me-2\"></i>Master Nodes</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-bordered\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Address</th><th>Role</th></tr></thead> <tbody>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, master := range data.MasterNodes {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<tr><td><a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var22 templ.SafeURL
-			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", vs.GetDisplayAddress())))
+			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", master.Address)))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 362, Col: 129}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 327, Col: 121}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\" target=\"_blank\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "\" target=\"_blank\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var23 string
-			templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(vs.GetDisplayAddress())
+			templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(master.Address)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 363, Col: 75}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 328, Col: 67}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var24 string
-			templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(vs.DataCenter)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 367, Col: 62}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var25 string
-			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(vs.Rack)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 368, Col: 56}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "</td><td><div class=\"progress\" style=\"height: 20px;\"><div class=\"progress-bar\" role=\"progressbar\" style=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var26 string
-			templ_7745c5c3_Var26, templ_7745c5c3_Err = templruntime.SanitizeStyleAttributeValues(fmt.Sprintf("width: %d%%", calculatePercent(vs.Volumes, vs.MaxVolumes)))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 372, Col: 135}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var27 string
-			templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d/%d", vs.Volumes, vs.MaxVolumes))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 373, Col: 104}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</div></div></td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if vs.EcShards > 0 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<span class=\"badge bg-info text-white me-1\">")
+			if master.IsLeader {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<span class=\"badge bg-primary\">Leader</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var28 string
-				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", vs.EcShards))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 379, Col: 127}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</span> ")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				if vs.EcVolumes > 0 {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<small class=\"text-muted\">(")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					var templ_7745c5c3_Var29 string
-					templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d vol", vs.EcVolumes))
-					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 381, Col: 119}
-					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, ")</small>")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<span class=\"text-muted\">-</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<span class=\"badge bg-secondary\">Follower</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "</td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var30 string
-			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(vs.DiskUsage))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 387, Col: 74}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, " / ")
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "</tbody></table></div></div></div></div><!-- System Health --><div class=\"col-lg-8\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-pie-chart me-2\"></i>Cluster</h6></div><div class=\"card-body text-center\"><div class=\"row\"><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var24 string
+		templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.MasterNodes)))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 361, Col: 85}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</h5><small class=\"text-muted\">Masters</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var25 string
+		templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.VolumeServers)))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 369, Col: 87}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "</h5><small class=\"text-muted\">Volume Servers</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var26 string
+		templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.FilerNodes)))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 377, Col: 84}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "</h5><small class=\"text-muted\">Filers</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var27 string
+		templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.S3Nodes)))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 385, Col: 81}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "</h5><small class=\"text-muted\">S3 Servers</small></div></div></div><div class=\"col\"><div class=\"card bg-light\"><div class=\"card-body\"><h5>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var28 string
+		templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(data.MessageBrokers)))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 393, Col: 88}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "</h5><small class=\"text-muted\">Message Brokers</small></div></div></div></div></div></div></div></div><!-- Volume Servers --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-database me-2\"></i>Volume Servers</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var29 templ.SafeURL
+		templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/volumes"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 418, Col: 90}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "\">View Details</a> <a class=\"dropdown-item\" href=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var30 templ.SafeURL
+		templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/cluster"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 419, Col: 90}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "\">Topology View</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>ID</th><th>Address</th><th>Data Center</th><th>Rack</th><th>Volumes</th><th>EC Shards</th><th>Usage / Capacity</th></tr></thead> <tbody>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, vs := range data.VolumeServers {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<tr><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var31 string
-			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(vs.DiskCapacity))
+			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(vs.ID)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 387, Col: 107}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 440, Col: 54}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</td><td><a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-		}
-		if len(data.VolumeServers) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<tr><td colspan=\"7\" class=\"text-center text-muted py-4\"><i class=\"fas fa-info-circle me-2\"></i> No volume servers found</td></tr>")
+			var templ_7745c5c3_Var32 templ.SafeURL
+			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", vs.GetDisplayAddress())))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 442, Col: 129}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "</tbody></table></div></div></div></div></div><!-- Filer Nodes --><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-folder me-2\"></i>Filer Nodes</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"fas fa-ellipsis-v fa-sm fa-fw text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var32 templ.SafeURL
-		templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/filer"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 420, Col: 88}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "\">File Browser</a> <a class=\"dropdown-item\" href=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var33 templ.SafeURL
-		templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/cluster"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 421, Col: 90}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "\">Topology View</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Address</th><th>Data Center</th><th>Rack</th><th>Last Updated</th></tr></thead> <tbody>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		for _, filer := range data.FilerNodes {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "<tr><td><a href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "\" target=\"_blank\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var34 templ.SafeURL
-			templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(fmt.Sprintf("//%s", filer.Address)))
+			var templ_7745c5c3_Var33 string
+			templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(vs.GetDisplayAddress())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 440, Col: 106}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 443, Col: 75}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var34 string
+			templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(vs.DataCenter)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 447, Col: 62}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "\" target=\"_blank\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var35 string
-			templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(filer.Address)
+			templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(vs.Rack)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 441, Col: 66}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 448, Col: 56}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "</td><td><div class=\"d-flex align-items-center\"><div class=\"progress flex-grow-1\" style=\"height: 20px; min-width: 48px;\"><div class=\"progress-bar\" role=\"progressbar\" style=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var36 string
-			templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(filer.DataCenter)
+			templ_7745c5c3_Var36, templ_7745c5c3_Err = templruntime.SanitizeStyleAttributeValues(fmt.Sprintf("width: %d%%", calculatePercent(vs.Volumes, vs.MaxVolumes)))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 445, Col: 65}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 453, Col: 139}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "\"></div></div><span class=\"ms-2 text-nowrap\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var37 string
-			templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(filer.Rack)
+			templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d/%d", vs.Volumes, vs.MaxVolumes))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 446, Col: 59}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 456, Col: 131}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "</span></div></td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var38 string
-			templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(filer.LastUpdated.Format("2006-01-02 15:04:05"))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 447, Col: 96}
+			if vs.EcShards > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "<span class=\"badge bg-info text-white me-1\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var38 string
+				templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", vs.EcShards))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 461, Col: 127}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "</span> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if vs.EcVolumes > 0 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<small class=\"text-muted\">(")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var39 string
+					templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d vol", vs.EcVolumes))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 463, Col: 119}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, ")</small>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "<span class=\"text-muted\">-</span>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "</td></tr>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		if len(data.FilerNodes) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"fas fa-info-circle me-2\"></i> No filer nodes found</td></tr>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "</tbody></table></div></div></div></div></div><!-- S3 Servers --><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-cloud me-2\"></i>S3 Servers</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"fas fa-ellipsis-v fa-sm fa-fw text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var39 templ.SafeURL
-		templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/cluster/s3"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 480, Col: 93}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "\">View Details</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Address</th><th>Data Center</th><th>Last Updated</th></tr></thead> <tbody>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		for _, s3Node := range data.S3Nodes {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<tr><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var40 string
-			templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(s3Node.Address)
+			templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(vs.DiskUsage))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 497, Col: 63}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 470, Col: 74}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, " / ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var41 string
-			templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(s3Node.DataCenter)
+			templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(vs.DiskCapacity))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 498, Col: 66}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 470, Col: 107}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, " ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var42 string
-			templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(s3Node.LastUpdated.Format("2006-01-02 15:04:05"))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 499, Col: 97}
+			if vs.RemoteSize > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "<br><small class=\"text-muted\"><i class=\"bi bi-cloud me-1\"></i>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var42 string
+				templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(vs.RemoteSize))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 473, Col: 137}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, " remote</small>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "</td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "</td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		if len(data.S3Nodes) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "<tr><td colspan=\"3\" class=\"text-center text-muted py-4\"><i class=\"fas fa-info-circle me-2\"></i> No S3 servers found</td></tr>")
+		if len(data.VolumeServers) == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "<tr><td colspan=\"7\" class=\"text-center text-muted py-4\"><i class=\"bi bi-info-circle me-2\"></i> No volume servers found</td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "</tbody></table></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "</tbody></table></div></div></div></div></div><!-- Filer Nodes --><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-folder me-2\"></i>Filer Nodes</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var43 string
-		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
+		var templ_7745c5c3_Var43 templ.SafeURL
+		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/filer"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 523, Col: 81}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 508, Col: 88}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "</small></div></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "\">File Browser</a> <a class=\"dropdown-item\" href=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var44 templ.SafeURL
+		templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/cluster"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 509, Col: 90}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, "\">Topology View</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Address</th><th>Data Center</th><th>Rack</th><th>Last Updated</th></tr></thead> <tbody>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, filer := range data.FilerNodes {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, "<tr><td><a href=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var45 templ.SafeURL
+			templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(fmt.Sprintf("//%s", filer.Address)))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 528, Col: 106}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var45))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, "\" target=\"_blank\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var46 string
+			templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(filer.Address)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 529, Col: 66}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var47 string
+			templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinStringErrs(filer.DataCenter)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 533, Col: 65}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var47))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "</td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var48 string
+			templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinStringErrs(filer.Rack)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 534, Col: 59}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var48))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "</td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var49 string
+			templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinStringErrs(filer.LastUpdated.Format("2006-01-02 15:04:05"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 535, Col: 96}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var49))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "</td></tr>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		if len(data.FilerNodes) == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"bi bi-info-circle me-2\"></i> No filer nodes found</td></tr>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "</tbody></table></div></div></div></div></div><!-- S3 Servers --><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-cloud me-2\"></i>S3 Servers</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var50 templ.SafeURL
+		templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/cluster/s3"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 568, Col: 93}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var50))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "\">View Details</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Address</th><th>Data Center</th><th>Last Updated</th></tr></thead> <tbody>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, s3Node := range data.S3Nodes {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "<tr><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var51 string
+			templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(s3Node.Address)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 585, Col: 63}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var51))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "</td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var52 string
+			templ_7745c5c3_Var52, templ_7745c5c3_Err = templ.JoinStringErrs(s3Node.DataCenter)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 586, Col: 66}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var52))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "</td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var53 string
+			templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.JoinStringErrs(s3Node.LastUpdated.Format("2006-01-02 15:04:05"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 587, Col: 97}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var53))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "</td></tr>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		if len(data.S3Nodes) == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "<tr><td colspan=\"3\" class=\"text-center text-muted py-4\"><i class=\"bi bi-info-circle me-2\"></i> No S3 servers found</td></tr>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "</tbody></table></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var54 string
+		templ_7745c5c3_Var54, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/admin.templ`, Line: 611, Col: 81}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var54))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "</small></div></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/cluster_brokers.templ b/weed/admin/view/app/cluster_brokers.templ
index d80a14c699..6b40c4d9fd 100644
--- a/weed/admin/view/app/cluster_brokers.templ
+++ b/weed/admin/view/app/cluster_brokers.templ
@@ -8,12 +8,12 @@ import (
 templ ClusterBrokers(data dash.ClusterBrokersData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-comments me-2"></i>Message Brokers
+			<i class="bi bi-chat-dots me-2"></i>Message Brokers
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-outline-primary" onclick="exportBrokers()">
-					<i class="fas fa-download me-1"></i>Export
+					<i class="bi bi-download me-1"></i>Export
 				</button>
 			</div>
 		</div>
@@ -35,7 +35,7 @@ templ ClusterBrokers(data dash.ClusterBrokersData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-comments fa-2x text-gray-300"></i>
+								<i class="bi bi-chat-dots icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -47,7 +47,7 @@ templ ClusterBrokers(data dash.ClusterBrokersData) {
 		<div class="card shadow mb-4">
 			<div class="card-header py-3">
 				<h6 class="m-0 font-weight-bold text-primary">
-					<i class="fas fa-comments me-2"></i>Message Brokers
+					<i class="bi bi-chat-dots me-2"></i>Message Brokers
 				</h6>
 			</div>
 			<div class="card-body">
@@ -92,7 +92,7 @@ templ ClusterBrokers(data dash.ClusterBrokersData) {
 					</div>
 				} else {
 					<div class="text-center py-5">
-						<i class="fas fa-comments fa-3x text-muted mb-3"></i>
+						<i class="bi bi-chat-dots icon-3x text-muted mb-3"></i>
 						<h5 class="text-muted">No Message Brokers Found</h5>
 						<p class="text-muted">No message broker servers are currently available in the cluster.</p>
 					</div>
@@ -104,7 +104,7 @@ templ ClusterBrokers(data dash.ClusterBrokersData) {
 		<div class="row">
 			<div class="col-12">
 				<small class="text-muted">
-					<i class="fas fa-clock me-1"></i>
+					<i class="bi bi-clock me-1"></i>
 					Last updated: { data.LastUpdated.Format("2006-01-02 15:04:05") }
 				</small>
 			</div>
diff --git a/weed/admin/view/app/cluster_brokers_templ.go b/weed/admin/view/app/cluster_brokers_templ.go
index e2439a880f..f26c65bd2d 100644
--- a/weed/admin/view/app/cluster_brokers_templ.go
+++ b/weed/admin/view/app/cluster_brokers_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func ClusterBrokers(data dash.ClusterBrokersData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-comments me-2\"></i>Message Brokers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportBrokers()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><div id=\"brokers-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Message Brokers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-chat-dots me-2\"></i>Message Brokers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportBrokers()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><div id=\"brokers-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Message Brokers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ClusterBrokers(data dash.ClusterBrokersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-comments fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Brokers Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-comments me-2\"></i>Message Brokers</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-chat-dots icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Brokers Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-chat-dots me-2\"></i>Message Brokers</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -139,12 +139,12 @@ func ClusterBrokers(data dash.ClusterBrokersData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<div class=\"text-center py-5\"><i class=\"fas fa-comments fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Message Brokers Found</h5><p class=\"text-muted\">No message broker servers are currently available in the cluster.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<div class=\"text-center py-5\"><i class=\"bi bi-chat-dots icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Message Brokers Found</h5><p class=\"text-muted\">No message broker servers are currently available in the cluster.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/cluster_collections.templ b/weed/admin/view/app/cluster_collections.templ
index e8a6d348a8..6752cae106 100644
--- a/weed/admin/view/app/cluster_collections.templ
+++ b/weed/admin/view/app/cluster_collections.templ
@@ -8,12 +8,12 @@ import (
 templ ClusterCollections(data dash.ClusterCollectionsData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <h1 class="h2">
-            <i class="fas fa-layer-group me-2"></i>Cluster Collections
+            <i class="bi bi-layers me-2"></i>Cluster Collections
         </h1>
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="exportCollections()">
-                    <i class="fas fa-download me-1"></i>Export
+                    <i class="bi bi-download me-1"></i>Export
                 </button>
             </div>
         </div>
@@ -35,7 +35,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-layer-group fa-2x text-gray-300"></i>
+                                <i class="bi bi-layers icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -55,7 +55,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-database fa-2x text-gray-300"></i>
+                                <i class="bi bi-database icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -75,7 +75,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-th-large fa-2x text-gray-300"></i>
+                                <i class="bi bi-grid icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -95,7 +95,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-cubes fa-2x text-gray-300"></i>
+                                <i class="bi bi-boxes icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -115,7 +115,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-hdd fa-2x text-gray-300"></i>
+                                <i class="bi bi-device-hdd icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -127,7 +127,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
         <div class="card shadow mb-4">
             <div class="card-header py-3">
                 <h6 class="m-0 font-weight-bold text-primary">
-                    <i class="fas fa-layer-group me-2"></i>Collection Details
+                    <i class="bi bi-layers me-2"></i>Collection Details
                 </h6>
             </div>
             <div class="card-body">
@@ -156,7 +156,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                         <td>
                                             <a href={ dash.PUrl(ctx, fmt.Sprintf("/storage/volumes?collection=%s", collection.Name)) } class="text-decoration-none">
                                             <div class="d-flex align-items-center">
-                                                <i class="fas fa-database me-2 text-muted"></i>
+                                                <i class="bi bi-database me-2 text-muted"></i>
                                                 if collection.VolumeCount > 0 {
                                                     {fmt.Sprintf("%d", collection.VolumeCount)}
                                                 } else {
@@ -168,7 +168,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                         <td>
                                             <a href={ dash.PUrl(ctx, fmt.Sprintf("/storage/ec-shards?collection=%s", collection.Name)) } class="text-decoration-none">
                                             <div class="d-flex align-items-center">
-                                                <i class="fas fa-th-large me-2 text-muted"></i>
+                                                <i class="bi bi-grid me-2 text-muted"></i>
                                                 if collection.EcVolumeCount > 0 {
                                                     {fmt.Sprintf("%d", collection.EcVolumeCount)}
                                                 } else {
@@ -179,13 +179,13 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                         </td>
                                         <td>
                                             <div class="d-flex align-items-center">
-                                                <i class="fas fa-cubes me-2 text-muted"></i>
+                                                <i class="bi bi-boxes me-2 text-muted"></i>
                                                 {fmt.Sprintf("%d", collection.ChunkCount)}
                                             </div>
                                         </td>
                                         <td>
                                             <div class="d-flex align-items-center">
-                                                <i class="fas fa-hdd me-2 text-muted"></i>
+                                                <i class="bi bi-device-hdd me-2 text-muted"></i>
                                                 {formatBytes(collection.TotalSize)}
                                             </div>
                                         </td>
@@ -212,7 +212,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                                                     data-chunk-count={fmt.Sprintf("%d", collection.ChunkCount)}
                                                     data-total-size={fmt.Sprintf("%d", collection.TotalSize)}
                                                     data-disk-types={formatDiskTypes(collection.DiskTypes)}>
-                                                <i class="fas fa-eye"></i>
+                                                <i class="bi bi-eye"></i>
                                             </button>
                                         </td>
                                     </tr>
@@ -222,7 +222,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
                     </div>
                 } else {
                     <div class="text-center py-5">
-                        <i class="fas fa-layer-group fa-3x text-muted mb-3"></i>
+                        <i class="bi bi-layers icon-3x text-muted mb-3"></i>
                         <h5 class="text-muted">No Collections Found</h5>
                         <p class="text-muted">No collections are currently configured in the cluster.</p>
                     </div>
@@ -234,7 +234,7 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
         <div class="row">
             <div class="col-12">
                 <small class="text-muted">
-                    <i class="fas fa-clock me-1"></i>
+                    <i class="bi bi-clock me-1"></i>
                     Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
                 </small>
             </div>
@@ -277,13 +277,13 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
             '<div class="modal-dialog modal-lg">' +
             '<div class="modal-content">' +
             '<div class="modal-header">' +
-            '<h5 class="modal-title"><i class="fas fa-layer-group me-2"></i>Collection Details: ' + collection.name + '</h5>' +
+            '<h5 class="modal-title"><i class="bi bi-layers me-2"></i>Collection Details: ' + collection.name + '</h5>' +
             '<button type="button" class="btn-close" data-bs-dismiss="modal"></button>' +
             '</div>' +
             '<div class="modal-body">' +
             '<div class="row">' +
             '<div class="col-md-6">' +
-            '<h6 class="text-primary"><i class="fas fa-info-circle me-1"></i>Basic Information</h6>' +
+            '<h6 class="text-primary"><i class="bi bi-info-circle me-1"></i>Basic Information</h6>' +
             '<table class="table table-sm">' +
             '<tr><td><strong>Collection Name:</strong></td><td><code>' + collection.name + '</code></td></tr>' +
             '<tr><td><strong>Data Center:</strong></td><td>' +
@@ -297,29 +297,29 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
             '</table>' +
             '</div>' +
             '<div class="col-md-6">' +
-            '<h6 class="text-primary"><i class="fas fa-chart-bar me-1"></i>Storage Statistics</h6>' +
+            '<h6 class="text-primary"><i class="bi bi-bar-chart me-1"></i>Storage Statistics</h6>' +
             '<table class="table table-sm">' +
             '<tr><td><strong>Regular Volumes:</strong></td><td>' +
             '<div class="d-flex align-items-center">' +
-            '<i class="fas fa-database me-2 text-muted"></i>' +
+            '<i class="bi bi-database me-2 text-muted"></i>' +
             '<span>' + collection.volumeCount.toLocaleString() + '</span>' +
             '</div>' +
             '</td></tr>' +
             '<tr><td><strong>EC Volumes:</strong></td><td>' +
             '<div class="d-flex align-items-center">' +
-            '<i class="fas fa-th-large me-2 text-muted"></i>' +
+            '<i class="bi bi-grid me-2 text-muted"></i>' +
             '<span>' + collection.ecVolumeCount.toLocaleString() + '</span>' +
             '</div>' +
             '</td></tr>' +
             '<tr><td><strong>Total Chunks:</strong></td><td>' +
             '<div class="d-flex align-items-center">' +
-            '<i class="fas fa-cubes me-2 text-muted"></i>' +
+            '<i class="bi bi-boxes me-2 text-muted"></i>' +
             '<span>' + collection.chunkCount.toLocaleString() + '</span>' +
             '</div>' +
             '</td></tr>' +
             '<tr><td><strong>Total Size (Logical):</strong></td><td>' +
             '<div class="d-flex align-items-center">' +
-            '<i class="fas fa-hdd me-2 text-muted"></i>' +
+            '<i class="bi bi-device-hdd me-2 text-muted"></i>' +
             '<span>' + formatBytes(collection.totalSize) + '</span>' +
             '</div>' +
             '</td></tr>' +
@@ -328,16 +328,16 @@ templ ClusterCollections(data dash.ClusterCollectionsData) {
             '</div>' +
             '<div class="row mt-3">' +
             '<div class="col-12">' +
-            '<h6 class="text-primary"><i class="fas fa-link me-1"></i>Quick Actions</h6>' +
+            '<h6 class="text-primary"><i class="bi bi-link me-1"></i>Quick Actions</h6>' +
             '<div class="d-grid gap-2 d-md-flex">' +
             '<a href="' + (window.__BASE_PATH__ || '') + '/storage/volumes?collection=' + encodeURIComponent(collection.name) + '" class="btn btn-outline-primary">' +
-            '<i class="fas fa-database me-1"></i>View Volumes' +
+            '<i class="bi bi-database me-1"></i>View Volumes' +
             '</a>' +
             '<a href="' + (window.__BASE_PATH__ || '') + '/storage/ec-shards?collection=' + encodeURIComponent(collection.name) + '" class="btn btn-outline-secondary">' +
-            '<i class="fas fa-th-large me-1"></i>View EC Volumes' +
+            '<i class="bi bi-grid me-1"></i>View EC Volumes' +
             '</a>' +
             '<a href="' + (window.__BASE_PATH__ || '') + '/files?collection=' + encodeURIComponent(collection.name) + '" class="btn btn-outline-info">' +
-            '<i class="fas fa-folder me-1"></i>Browse Files' +
+            '<i class="bi bi-folder me-1"></i>Browse Files' +
             '</a>' +
             '</div>' +
             '</div>' +
diff --git a/weed/admin/view/app/cluster_collections_templ.go b/weed/admin/view/app/cluster_collections_templ.go
index 008078b01b..1850fe446e 100644
--- a/weed/admin/view/app/cluster_collections_templ.go
+++ b/weed/admin/view/app/cluster_collections_templ.go
@@ -34,7 +34,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-layer-group me-2\"></i>Cluster Collections</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportCollections()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><div id=\"collections-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Collections</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-layers me-2\"></i>Cluster Collections</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportCollections()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><div id=\"collections-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Collections</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-layer-group fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Regular Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-layers icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Regular Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +60,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-database fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">EC Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-database icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">EC Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -73,7 +73,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"fas fa-th-large fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\" title=\"Chunks stored in volumes. A file is split into one or more chunks, so this is not the number of files.\">Total Chunks</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"bi bi-grid icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\" title=\"Chunks stored in volumes. A file is split into one or more chunks, so this is not the number of files.\">Total Chunks</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -86,7 +86,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</div></div><div class=\"col-auto\"><i class=\"fas fa-cubes fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-secondary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-secondary text-uppercase mb-1\">Total Storage Size (Logical)</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</div></div><div class=\"col-auto\"><i class=\"bi bi-boxes icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-lg-3 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-secondary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-secondary text-uppercase mb-1\">Total Storage Size (Logical)</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -99,7 +99,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</div></div><div class=\"col-auto\"><i class=\"fas fa-hdd fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Collections Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-layer-group me-2\"></i>Collection Details</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</div></div><div class=\"col-auto\"><i class=\"bi bi-device-hdd icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Collections Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-layers me-2\"></i>Collection Details</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -148,7 +148,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\" class=\"text-decoration-none\"><div class=\"d-flex align-items-center\"><i class=\"fas fa-database me-2 text-muted\"></i> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\" class=\"text-decoration-none\"><div class=\"d-flex align-items-center\"><i class=\"bi bi-database me-2 text-muted\"></i> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -181,7 +181,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\" class=\"text-decoration-none\"><div class=\"d-flex align-items-center\"><i class=\"fas fa-th-large me-2 text-muted\"></i> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\" class=\"text-decoration-none\"><div class=\"d-flex align-items-center\"><i class=\"bi bi-grid me-2 text-muted\"></i> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -201,7 +201,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</div></a></td><td><div class=\"d-flex align-items-center\"><i class=\"fas fa-cubes me-2 text-muted\"></i> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</div></a></td><td><div class=\"d-flex align-items-center\"><i class=\"bi bi-boxes me-2 text-muted\"></i> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -214,7 +214,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</div></td><td><div class=\"d-flex align-items-center\"><i class=\"fas fa-hdd me-2 text-muted\"></i> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</div></td><td><div class=\"d-flex align-items-center\"><i class=\"bi bi-device-hdd me-2 text-muted\"></i> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -375,7 +375,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "\"><i class=\"fas fa-eye\"></i></button></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "\"><i class=\"bi bi-eye\"></i></button></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -385,12 +385,12 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<div class=\"text-center py-5\"><i class=\"fas fa-layer-group fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Collections Found</h5><p class=\"text-muted\">No collections are currently configured in the cluster.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<div class=\"text-center py-5\"><i class=\"bi bi-layers icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Collections Found</h5><p class=\"text-muted\">No collections are currently configured in the cluster.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -403,7 +403,7 @@ func ClusterCollections(data dash.ClusterCollectionsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</small></div></div></div><!-- JavaScript for cluster collections functionality --><script>\n    document.addEventListener('DOMContentLoaded', function() {\n        // Handle collection action buttons\n        document.addEventListener('click', function(e) {\n            const button = e.target.closest('[data-action]');\n            if (!button) return;\n            \n            const action = button.getAttribute('data-action');\n            \n            switch(action) {\n                case 'view-details':\n                    const collectionData = {\n                        name: button.getAttribute('data-name'),\n                        datacenter: button.getAttribute('data-datacenter'),\n                        volumeCount: parseInt(button.getAttribute('data-volume-count')),\n                        ecVolumeCount: parseInt(button.getAttribute('data-ec-volume-count')),\n                        chunkCount: parseInt(button.getAttribute('data-chunk-count')),\n                        totalSize: parseInt(button.getAttribute('data-total-size')),\n                        diskTypes: button.getAttribute('data-disk-types')\n                    };\n                    showCollectionDetails(collectionData);\n                    break;\n            }\n        });\n    });\n    \n    function showCollectionDetails(collection) {\n        const modalHtml = '<div class=\"modal fade\" id=\"collectionDetailsModal\" tabindex=\"-1\">' +\n            '<div class=\"modal-dialog modal-lg\">' +\n            '<div class=\"modal-content\">' +\n            '<div class=\"modal-header\">' +\n            '<h5 class=\"modal-title\"><i class=\"fas fa-layer-group me-2\"></i>Collection Details: ' + collection.name + '</h5>' +\n            '<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n            '</div>' +\n            '<div class=\"modal-body\">' +\n            '<div class=\"row\">' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"fas fa-info-circle me-1\"></i>Basic Information</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Collection Name:</strong></td><td><code>' + collection.name + '</code></td></tr>' +\n            '<tr><td><strong>Data Center:</strong></td><td>' +\n            (collection.datacenter ? '<span class=\"badge bg-light text-dark\">' + collection.datacenter + '</span>' : '<span class=\"text-muted\">N/A</span>') +\n            '</td></tr>' +\n            '<tr><td><strong>Disk Types:</strong></td><td>' +\n            (collection.diskTypes ? collection.diskTypes.split(', ').map(type => \n                '<span class=\"badge bg-' + getDiskTypeBadgeColor(type) + ' me-1\">' + type + '</span>'\n            ).join('') : '<span class=\"text-muted\">Unknown</span>') +\n            '</td></tr>' +\n            '</table>' +\n            '</div>' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"fas fa-chart-bar me-1\"></i>Storage Statistics</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Regular Volumes:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"fas fa-database me-2 text-muted\"></i>' +\n            '<span>' + collection.volumeCount.toLocaleString() + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>EC Volumes:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"fas fa-th-large me-2 text-muted\"></i>' +\n            '<span>' + collection.ecVolumeCount.toLocaleString() + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Total Chunks:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"fas fa-cubes me-2 text-muted\"></i>' +\n            '<span>' + collection.chunkCount.toLocaleString() + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Total Size (Logical):</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"fas fa-hdd me-2 text-muted\"></i>' +\n            '<span>' + formatBytes(collection.totalSize) + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '</table>' +\n            '</div>' +\n            '</div>' +\n            '<div class=\"row mt-3\">' +\n            '<div class=\"col-12\">' +\n            '<h6 class=\"text-primary\"><i class=\"fas fa-link me-1\"></i>Quick Actions</h6>' +\n            '<div class=\"d-grid gap-2 d-md-flex\">' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/storage/volumes?collection=' + encodeURIComponent(collection.name) + '\" class=\"btn btn-outline-primary\">' +\n            '<i class=\"fas fa-database me-1\"></i>View Volumes' +\n            '</a>' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/storage/ec-shards?collection=' + encodeURIComponent(collection.name) + '\" class=\"btn btn-outline-secondary\">' +\n            '<i class=\"fas fa-th-large me-1\"></i>View EC Volumes' +\n            '</a>' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/files?collection=' + encodeURIComponent(collection.name) + '\" class=\"btn btn-outline-info\">' +\n            '<i class=\"fas fa-folder me-1\"></i>Browse Files' +\n            '</a>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '<div class=\"modal-footer\">' +\n            '<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>';\n        \n        // Remove existing modal if present\n        const existingModal = document.getElementById('collectionDetailsModal');\n        if (existingModal) {\n            existingModal.remove();\n        }\n        \n        // Add modal to body and show\n        document.body.insertAdjacentHTML('beforeend', modalHtml);\n        const modal = new bootstrap.Modal(document.getElementById('collectionDetailsModal'));\n        modal.show();\n        \n        // Remove modal when hidden\n        document.getElementById('collectionDetailsModal').addEventListener('hidden.bs.modal', function() {\n            this.remove();\n        });\n    }\n    \n    function getDiskTypeBadgeColor(diskType) {\n        switch(diskType.toLowerCase()) {\n            case 'ssd':\n                return 'primary';\n            case 'hdd':\n            case '':\n                return 'secondary';\n            default:\n                return 'info';\n        }\n    }\n    \n    function formatBytes(bytes) {\n        if (bytes === 0) return '0 Bytes';\n        const k = 1024;\n        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n        const i = Math.floor(Math.log(bytes) / Math.log(k));\n        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n    }\n    \n    function exportCollections() {\n        // Simple CSV export of collections list\n        const rows = Array.from(document.querySelectorAll('#collectionsTable tbody tr')).map(row => {\n            const cells = row.querySelectorAll('td');\n            if (cells.length > 1) {\n                return {\n                    name: cells[0].textContent.trim(),\n                    volumes: cells[1].textContent.trim(),\n                    ecVolumes: cells[2].textContent.trim(),\n                    chunks: cells[3].textContent.trim(),\n                    size: cells[4].textContent.trim(),\n                    diskTypes: cells[5].textContent.trim()\n                };\n            }\n            return null;\n        }).filter(row => row !== null);\n\n        const csvContent = \"data:text/csv;charset=utf-8,\" +\n            \"Collection Name,Volumes,EC Volumes,Chunks,Size,Disk Types\\n\" +\n            rows.map(r => '\"' + r.name + '\",\"' + r.volumes + '\",\"' + r.ecVolumes + '\",\"' + r.chunks + '\",\"' + r.size + '\",\"' + r.diskTypes + '\"').join(\"\\n\");\n        \n        const encodedUri = encodeURI(csvContent);\n        const link = document.createElement(\"a\");\n        link.setAttribute(\"href\", encodedUri);\n        link.setAttribute(\"download\", \"collections.csv\");\n        document.body.appendChild(link);\n        link.click();\n        document.body.removeChild(link);\n    }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</small></div></div></div><!-- JavaScript for cluster collections functionality --><script>\n    document.addEventListener('DOMContentLoaded', function() {\n        // Handle collection action buttons\n        document.addEventListener('click', function(e) {\n            const button = e.target.closest('[data-action]');\n            if (!button) return;\n            \n            const action = button.getAttribute('data-action');\n            \n            switch(action) {\n                case 'view-details':\n                    const collectionData = {\n                        name: button.getAttribute('data-name'),\n                        datacenter: button.getAttribute('data-datacenter'),\n                        volumeCount: parseInt(button.getAttribute('data-volume-count')),\n                        ecVolumeCount: parseInt(button.getAttribute('data-ec-volume-count')),\n                        chunkCount: parseInt(button.getAttribute('data-chunk-count')),\n                        totalSize: parseInt(button.getAttribute('data-total-size')),\n                        diskTypes: button.getAttribute('data-disk-types')\n                    };\n                    showCollectionDetails(collectionData);\n                    break;\n            }\n        });\n    });\n    \n    function showCollectionDetails(collection) {\n        const modalHtml = '<div class=\"modal fade\" id=\"collectionDetailsModal\" tabindex=\"-1\">' +\n            '<div class=\"modal-dialog modal-lg\">' +\n            '<div class=\"modal-content\">' +\n            '<div class=\"modal-header\">' +\n            '<h5 class=\"modal-title\"><i class=\"bi bi-layers me-2\"></i>Collection Details: ' + collection.name + '</h5>' +\n            '<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n            '</div>' +\n            '<div class=\"modal-body\">' +\n            '<div class=\"row\">' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"bi bi-info-circle me-1\"></i>Basic Information</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Collection Name:</strong></td><td><code>' + collection.name + '</code></td></tr>' +\n            '<tr><td><strong>Data Center:</strong></td><td>' +\n            (collection.datacenter ? '<span class=\"badge bg-light text-dark\">' + collection.datacenter + '</span>' : '<span class=\"text-muted\">N/A</span>') +\n            '</td></tr>' +\n            '<tr><td><strong>Disk Types:</strong></td><td>' +\n            (collection.diskTypes ? collection.diskTypes.split(', ').map(type => \n                '<span class=\"badge bg-' + getDiskTypeBadgeColor(type) + ' me-1\">' + type + '</span>'\n            ).join('') : '<span class=\"text-muted\">Unknown</span>') +\n            '</td></tr>' +\n            '</table>' +\n            '</div>' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"bi bi-bar-chart me-1\"></i>Storage Statistics</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Regular Volumes:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"bi bi-database me-2 text-muted\"></i>' +\n            '<span>' + collection.volumeCount.toLocaleString() + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>EC Volumes:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"bi bi-grid me-2 text-muted\"></i>' +\n            '<span>' + collection.ecVolumeCount.toLocaleString() + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Total Chunks:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"bi bi-boxes me-2 text-muted\"></i>' +\n            '<span>' + collection.chunkCount.toLocaleString() + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Total Size (Logical):</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<i class=\"bi bi-device-hdd me-2 text-muted\"></i>' +\n            '<span>' + formatBytes(collection.totalSize) + '</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '</table>' +\n            '</div>' +\n            '</div>' +\n            '<div class=\"row mt-3\">' +\n            '<div class=\"col-12\">' +\n            '<h6 class=\"text-primary\"><i class=\"bi bi-link me-1\"></i>Quick Actions</h6>' +\n            '<div class=\"d-grid gap-2 d-md-flex\">' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/storage/volumes?collection=' + encodeURIComponent(collection.name) + '\" class=\"btn btn-outline-primary\">' +\n            '<i class=\"bi bi-database me-1\"></i>View Volumes' +\n            '</a>' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/storage/ec-shards?collection=' + encodeURIComponent(collection.name) + '\" class=\"btn btn-outline-secondary\">' +\n            '<i class=\"bi bi-grid me-1\"></i>View EC Volumes' +\n            '</a>' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/files?collection=' + encodeURIComponent(collection.name) + '\" class=\"btn btn-outline-info\">' +\n            '<i class=\"bi bi-folder me-1\"></i>Browse Files' +\n            '</a>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '<div class=\"modal-footer\">' +\n            '<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>';\n        \n        // Remove existing modal if present\n        const existingModal = document.getElementById('collectionDetailsModal');\n        if (existingModal) {\n            existingModal.remove();\n        }\n        \n        // Add modal to body and show\n        document.body.insertAdjacentHTML('beforeend', modalHtml);\n        const modal = new bootstrap.Modal(document.getElementById('collectionDetailsModal'));\n        modal.show();\n        \n        // Remove modal when hidden\n        document.getElementById('collectionDetailsModal').addEventListener('hidden.bs.modal', function() {\n            this.remove();\n        });\n    }\n    \n    function getDiskTypeBadgeColor(diskType) {\n        switch(diskType.toLowerCase()) {\n            case 'ssd':\n                return 'primary';\n            case 'hdd':\n            case '':\n                return 'secondary';\n            default:\n                return 'info';\n        }\n    }\n    \n    function formatBytes(bytes) {\n        if (bytes === 0) return '0 Bytes';\n        const k = 1024;\n        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n        const i = Math.floor(Math.log(bytes) / Math.log(k));\n        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n    }\n    \n    function exportCollections() {\n        // Simple CSV export of collections list\n        const rows = Array.from(document.querySelectorAll('#collectionsTable tbody tr')).map(row => {\n            const cells = row.querySelectorAll('td');\n            if (cells.length > 1) {\n                return {\n                    name: cells[0].textContent.trim(),\n                    volumes: cells[1].textContent.trim(),\n                    ecVolumes: cells[2].textContent.trim(),\n                    chunks: cells[3].textContent.trim(),\n                    size: cells[4].textContent.trim(),\n                    diskTypes: cells[5].textContent.trim()\n                };\n            }\n            return null;\n        }).filter(row => row !== null);\n\n        const csvContent = \"data:text/csv;charset=utf-8,\" +\n            \"Collection Name,Volumes,EC Volumes,Chunks,Size,Disk Types\\n\" +\n            rows.map(r => '\"' + r.name + '\",\"' + r.volumes + '\",\"' + r.ecVolumes + '\",\"' + r.chunks + '\",\"' + r.size + '\",\"' + r.diskTypes + '\"').join(\"\\n\");\n        \n        const encodedUri = encodeURI(csvContent);\n        const link = document.createElement(\"a\");\n        link.setAttribute(\"href\", encodedUri);\n        link.setAttribute(\"download\", \"collections.csv\");\n        document.body.appendChild(link);\n        link.click();\n        document.body.removeChild(link);\n    }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/cluster_ec_shards.templ b/weed/admin/view/app/cluster_ec_shards.templ
index 81105ebc94..5e4edefa63 100644
--- a/weed/admin/view/app/cluster_ec_shards.templ
+++ b/weed/admin/view/app/cluster_ec_shards.templ
@@ -9,21 +9,21 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <div>
             <h1 class="h2">
-                <i class="fas fa-th-large me-2"></i>EC Shards
+                <i class="bi bi-grid me-2"></i>EC Shards
             </h1>
             if data.FilterCollection != "" {
                 <div class="d-flex align-items-center mt-2">
                     if data.FilterCollection == "default" {
                         <span class="badge bg-secondary text-white me-2">
-                            <i class="fas fa-filter me-1"></i>Collection: default
+                            <i class="bi bi-funnel me-1"></i>Collection: default
                         </span>
                     } else {
                         <span class="badge bg-info text-white me-2">
-                            <i class="fas fa-filter me-1"></i>Collection: {data.FilterCollection}
+                            <i class="bi bi-funnel me-1"></i>Collection: {data.FilterCollection}
                         </span>
                     }
                     <a href={ dash.PUrl(ctx, "/storage/ec-shards") } class="btn btn-sm btn-outline-secondary">
-                        <i class="fas fa-times me-1"></i>Clear Filter
+                        <i class="bi bi-x me-1"></i>Clear Filter
                     </a>
                 </div>
             }
@@ -37,7 +37,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                     <option value="500" if data.PageSize == 500 { selected="selected" }>500 per page</option>
                 </select>
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="exportEcShards()">
-                    <i class="fas fa-download me-1"></i>Export
+                    <i class="bi bi-download me-1"></i>Export
                 </button>
             </div>
         </div>
@@ -54,7 +54,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             <h4 class="mb-0">{fmt.Sprintf("%d", data.TotalShards)}</h4>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-puzzle-piece fa-2x"></i>
+                            <i class="bi bi-puzzle icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -69,7 +69,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             <h4 class="mb-0">{fmt.Sprintf("%d", data.TotalVolumes)}</h4>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-database fa-2x"></i>
+                            <i class="bi bi-database icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -85,7 +85,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             <small>Complete (14/14 shards)</small>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-check-circle fa-2x"></i>
+                            <i class="bi bi-check-circle icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -101,7 +101,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             <small>Incomplete/Critical</small>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-exclamation-triangle fa-2x"></i>
+                            <i class="bi bi-exclamation-triangle icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -119,12 +119,12 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             Volume ID
                             if data.SortBy == "volume_id" {
                                 if data.SortOrder == "asc" {
-                                    <i class="fas fa-sort-up ms-1"></i>
+                                    <i class="bi bi-sort-up ms-1"></i>
                                 } else {
-                                    <i class="fas fa-sort-down ms-1"></i>
+                                    <i class="bi bi-sort-down ms-1"></i>
                                 }
                             } else {
-                                <i class="fas fa-sort ms-1 text-muted"></i>
+                                <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                             }
                         </a>
                     </th>
@@ -135,12 +135,12 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                                 Collection
                                 if data.SortBy == "collection" {
                                     if data.SortOrder == "asc" {
-                                        <i class="fas fa-sort-up ms-1"></i>
+                                        <i class="bi bi-sort-up ms-1"></i>
                                     } else {
-                                        <i class="fas fa-sort-down ms-1"></i>
+                                        <i class="bi bi-sort-down ms-1"></i>
                                     }
                                 } else {
-                                    <i class="fas fa-sort ms-1 text-muted"></i>
+                                    <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                 }
                             </a>
                         </th>
@@ -151,12 +151,12 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                                 Data Center
                                 if data.SortBy == "datacenter" {
                                     if data.SortOrder == "asc" {
-                                        <i class="fas fa-sort-up ms-1"></i>
+                                        <i class="bi bi-sort-up ms-1"></i>
                                     } else {
-                                        <i class="fas fa-sort-down ms-1"></i>
+                                        <i class="bi bi-sort-down ms-1"></i>
                                     }
                                 } else {
-                                    <i class="fas fa-sort ms-1 text-muted"></i>
+                                    <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                 }
                             </a>
                         </th>
@@ -166,12 +166,12 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                             Server
                             if data.SortBy == "server" {
                                 if data.SortOrder == "asc" {
-                                    <i class="fas fa-sort-up ms-1"></i>
+                                    <i class="bi bi-sort-up ms-1"></i>
                                 } else {
-                                    <i class="fas fa-sort-down ms-1"></i>
+                                    <i class="bi bi-sort-down ms-1"></i>
                                 }
                             } else {
-                                <i class="fas fa-sort ms-1 text-muted"></i>
+                                <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                             }
                         </a>
                     </th>
@@ -181,12 +181,12 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                                 Rack
                                 if data.SortBy == "rack" {
                                     if data.SortOrder == "asc" {
-                                        <i class="fas fa-sort-up ms-1"></i>
+                                        <i class="bi bi-sort-up ms-1"></i>
                                     } else {
-                                        <i class="fas fa-sort-down ms-1"></i>
+                                        <i class="bi bi-sort-down ms-1"></i>
                                     }
                                 } else {
-                                    <i class="fas fa-sort ms-1 text-muted"></i>
+                                    <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                 }
                             </a>
                         </th>
@@ -240,7 +240,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                                         onclick="showShardDetails(event)" 
                                         data-volume-id={ fmt.Sprintf("%d", shard.VolumeID) }
                                         title="View EC volume details">
-                                    <i class="fas fa-info-circle"></i>
+                                    <i class="bi bi-info-circle"></i>
                                 </button>
                             </div>
                         </td>
@@ -257,7 +257,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                 if data.CurrentPage > 1 {
                     <li class="page-item">
                         <a class="page-link" href="#" onclick="goToPage(event)" data-page={ fmt.Sprintf("%d", data.CurrentPage-1) }>
-                            <i class="fas fa-chevron-left"></i>
+                            <i class="bi bi-chevron-left"></i>
                         </a>
                     </li>
                 }
@@ -306,7 +306,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
                 if data.CurrentPage < data.TotalPages {
                     <li class="page-item">
                         <a class="page-link" href="#" onclick="goToPage(event)" data-page={ fmt.Sprintf("%d", data.CurrentPage+1) }>
-                            <i class="fas fa-chevron-right"></i>
+                            <i class="bi bi-chevron-right"></i>
                         </a>
                     </li>
                 }
@@ -386,7 +386,7 @@ templ ClusterEcShards(data dash.ClusterEcShardsData) {
 // displayShardDistribution shows the distribution summary for a volume's shards
 templ displayShardDistribution(shard dash.EcShardWithInfo, allShards []dash.EcShardWithInfo) {
     <div class="small">
-        <i class="fas fa-sitemap me-1"></i>
+        <i class="bi bi-diagram-3 me-1"></i>
         { calculateDistributionSummary(shard.VolumeID, allShards) }
     </div>
 }
@@ -394,16 +394,16 @@ templ displayShardDistribution(shard dash.EcShardWithInfo, allShards []dash.EcSh
 // displayVolumeStatus shows an improved status display
 templ displayVolumeStatus(shard dash.EcShardWithInfo) {
     if shard.IsComplete {
-        <span class="badge bg-success"><i class="fas fa-check me-1"></i>Complete</span>
+        <span class="badge bg-success"><i class="bi bi-check me-1"></i>Complete</span>
     } else {
         if len(shard.MissingShards) > 10 {
-            <span class="badge bg-danger"><i class="fas fa-skull me-1"></i>Critical ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
+            <span class="badge bg-danger"><i class="bi bi-exclamation-octagon me-1"></i>Critical ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
         } else if len(shard.MissingShards) > 6 {
-            <span class="badge bg-warning"><i class="fas fa-exclamation-triangle me-1"></i>Degraded ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
+            <span class="badge bg-warning"><i class="bi bi-exclamation-triangle me-1"></i>Degraded ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
         } else if len(shard.MissingShards) > 2 {
-            <span class="badge bg-warning"><i class="fas fa-info-circle me-1"></i>Incomplete ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
+            <span class="badge bg-warning"><i class="bi bi-info-circle me-1"></i>Incomplete ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
         } else {
-            <span class="badge bg-info"><i class="fas fa-info-circle me-1"></i>Minor Issues ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
+            <span class="badge bg-info"><i class="bi bi-info-circle me-1"></i>Minor Issues ({fmt.Sprintf("%d", len(shard.MissingShards))} missing)</span>
         }
     }
 }
diff --git a/weed/admin/view/app/cluster_ec_shards_templ.go b/weed/admin/view/app/cluster_ec_shards_templ.go
index f13495262e..d89ffde258 100644
--- a/weed/admin/view/app/cluster_ec_shards_templ.go
+++ b/weed/admin/view/app/cluster_ec_shards_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"fas fa-th-large me-2\"></i>EC Shards</h1>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"bi bi-grid me-2\"></i>EC Shards</h1>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -44,19 +44,19 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if data.FilterCollection == "default" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<span class=\"badge bg-secondary text-white me-2\"><i class=\"fas fa-filter me-1\"></i>Collection: default</span> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<span class=\"badge bg-secondary text-white me-2\"><i class=\"bi bi-funnel me-1\"></i>Collection: default</span> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<span class=\"badge bg-info text-white me-2\"><i class=\"fas fa-filter me-1\"></i>Collection: ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<span class=\"badge bg-info text-white me-2\"><i class=\"bi bi-funnel me-1\"></i>Collection: ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var2 string
 				templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(data.FilterCollection)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 22, Col: 96}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 22, Col: 95}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
 				if templ_7745c5c3_Err != nil {
@@ -80,7 +80,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-times me-1\"></i>Clear Filter</a></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-x me-1\"></i>Clear Filter</a></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -125,7 +125,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, ">500 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportEcShards()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><!-- Statistics Cards --><div class=\"row mb-4\"><div class=\"col-md-3\"><div class=\"card text-bg-primary\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Shards</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, ">500 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportEcShards()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><!-- Statistics Cards --><div class=\"row mb-4\"><div class=\"col-md-3\"><div class=\"card text-bg-primary\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Shards</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -138,7 +138,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</h4></div><div class=\"align-self-center\"><i class=\"fas fa-puzzle-piece fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-info\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">EC Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</h4></div><div class=\"align-self-center\"><i class=\"bi bi-puzzle icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-info\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">EC Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -151,7 +151,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</h4></div><div class=\"align-self-center\"><i class=\"fas fa-database fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-success\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Healthy Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</h4></div><div class=\"align-self-center\"><i class=\"bi bi-database icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-success\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Healthy Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -164,7 +164,7 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</h4><small>Complete (14/14 shards)</small></div><div class=\"align-self-center\"><i class=\"fas fa-check-circle fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-warning\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Degraded Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</h4><small>Complete (14/14 shards)</small></div><div class=\"align-self-center\"><i class=\"bi bi-check-circle icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-warning\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Degraded Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -177,24 +177,24 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</h4><small>Incomplete/Critical</small></div><div class=\"align-self-center\"><i class=\"fas fa-exclamation-triangle fa-2x\"></i></div></div></div></div></div></div><!-- Shards Table --><div class=\"table-responsive\"><table class=\"table table-striped table-hover\" id=\"ecShardsTable\"><thead><tr><th><a href=\"#\" onclick=\"sortBy('volume_id')\" class=\"text-dark text-decoration-none\">Volume ID ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</h4><small>Incomplete/Critical</small></div><div class=\"align-self-center\"><i class=\"bi bi-exclamation-triangle icon-2x\"></i></div></div></div></div></div></div><!-- Shards Table --><div class=\"table-responsive\"><table class=\"table table-striped table-hover\" id=\"ecShardsTable\"><thead><tr><th><a href=\"#\" onclick=\"sortBy('volume_id')\" class=\"text-dark text-decoration-none\">Volume ID ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.SortBy == "volume_id" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<i class=\"bi bi-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<i class=\"bi bi-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -210,18 +210,18 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 			}
 			if data.SortBy == "collection" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -238,18 +238,18 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 			}
 			if data.SortBy == "datacenter" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -265,18 +265,18 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 		}
 		if data.SortBy == "server" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"bi bi-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"bi bi-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -292,18 +292,18 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 			}
 			if data.SortBy == "rack" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -471,15 +471,15 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var15 string
-			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", shard.VolumeID))
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", shard.VolumeID))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 241, Col: 90}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "\" title=\"View EC volume details\"><i class=\"fas fa-info-circle\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "\" title=\"View EC volume details\"><i class=\"bi bi-info-circle\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -499,15 +499,15 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var16 string
-				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage-1))
+				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage-1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 259, Col: 129}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\"><i class=\"fas fa-chevron-left\"></i></a></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\"><i class=\"bi bi-chevron-left\"></i></a></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -538,11 +538,11 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var17 string
-				templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage-1))
+				templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage-1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 280, Col: 129}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -587,11 +587,11 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var20 string
-				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage+1))
+				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage+1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 290, Col: 129}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -629,11 +629,11 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var22 string
-				templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalPages))
+				templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.TotalPages))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 302, Col: 126}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -661,15 +661,15 @@ func ClusterEcShards(data dash.ClusterEcShardsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var24 string
-				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage+1))
+				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage+1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 308, Col: 129}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "\"><i class=\"fas fa-chevron-right\"></i></a></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "\"><i class=\"bi bi-chevron-right\"></i></a></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -709,7 +709,7 @@ func displayShardDistribution(shard dash.EcShardWithInfo, allShards []dash.EcSha
 			templ_7745c5c3_Var25 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "<div class=\"small\"><i class=\"fas fa-sitemap me-1\"></i> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "<div class=\"small\"><i class=\"bi bi-diagram-3 me-1\"></i> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -753,20 +753,20 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 		}
 		ctx = templ.ClearChildren(ctx)
 		if shard.IsComplete {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "<span class=\"badge bg-success\"><i class=\"fas fa-check me-1\"></i>Complete</span>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "<span class=\"badge bg-success\"><i class=\"bi bi-check me-1\"></i>Complete</span>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
 			if len(shard.MissingShards) > 10 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "<span class=\"badge bg-danger\"><i class=\"fas fa-skull me-1\"></i>Critical (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "<span class=\"badge bg-danger\"><i class=\"bi bi-exclamation-octagon me-1\"></i>Critical (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var28 string
 				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 400, Col: 129}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 400, Col: 142}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 				if templ_7745c5c3_Err != nil {
@@ -777,14 +777,14 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			} else if len(shard.MissingShards) > 6 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "<span class=\"badge bg-warning\"><i class=\"fas fa-exclamation-triangle me-1\"></i>Degraded (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "<span class=\"badge bg-warning\"><i class=\"bi bi-exclamation-triangle me-1\"></i>Degraded (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var29 string
 				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 402, Col: 145}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 402, Col: 144}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 				if templ_7745c5c3_Err != nil {
@@ -795,14 +795,14 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			} else if len(shard.MissingShards) > 2 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "<span class=\"badge bg-warning\"><i class=\"fas fa-info-circle me-1\"></i>Incomplete (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "<span class=\"badge bg-warning\"><i class=\"bi bi-info-circle me-1\"></i>Incomplete (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var30 string
 				templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 404, Col: 138}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 404, Col: 137}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
 				if templ_7745c5c3_Err != nil {
@@ -813,14 +813,14 @@ func displayVolumeStatus(shard dash.EcShardWithInfo) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "<span class=\"badge bg-info\"><i class=\"fas fa-info-circle me-1\"></i>Minor Issues (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "<span class=\"badge bg-info\"><i class=\"bi bi-info-circle me-1\"></i>Minor Issues (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var31 string
 				templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(shard.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 406, Col: 137}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_shards.templ`, Line: 406, Col: 136}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
 				if templ_7745c5c3_Err != nil {
diff --git a/weed/admin/view/app/cluster_ec_volumes.templ b/weed/admin/view/app/cluster_ec_volumes.templ
index 7399689f04..133cd54886 100644
--- a/weed/admin/view/app/cluster_ec_volumes.templ
+++ b/weed/admin/view/app/cluster_ec_volumes.templ
@@ -12,21 +12,21 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <div>
             <h1 class="h2">
-                <i class="fas fa-database me-2"></i>EC Volumes
+                <i class="bi bi-database me-2"></i>EC Volumes
             </h1>
             if data.Collection != "" {
                 <div class="d-flex align-items-center mt-2">
                     if data.Collection == "default" {
                         <span class="badge bg-secondary text-white me-2">
-                            <i class="fas fa-filter me-1"></i>Collection: default
+                            <i class="bi bi-funnel me-1"></i>Collection: default
                         </span>
                     } else {
                         <span class="badge bg-info text-white me-2">
-                            <i class="fas fa-filter me-1"></i>Collection: {data.Collection}
+                            <i class="bi bi-funnel me-1"></i>Collection: {data.Collection}
                         </span>
                     }
                     <a href={ dash.PUrl(ctx, "/storage/ec-volumes") } class="btn btn-sm btn-outline-secondary">
-                        <i class="fas fa-times me-1"></i>Clear Filter
+                        <i class="bi bi-x me-1"></i>Clear Filter
                     </a>
                 </div>
             }
@@ -41,7 +41,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                     <option value="100" if data.PageSize == 100 { selected="selected" }>100 per page</option>
                 </select>
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="window.location.reload()">
-                    <i class="fas fa-refresh me-1"></i>Refresh
+                    <i class="bi bi-arrow-clockwise me-1"></i>Refresh
                 </button>
             </div>
         </div>
@@ -58,7 +58,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                             <h4 class="mb-0">{fmt.Sprintf("%d", data.TotalVolumes)}</h4>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-cubes fa-2x"></i>
+                            <i class="bi bi-boxes icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -73,7 +73,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                             <h4 class="mb-0">{fmt.Sprintf("%d", data.TotalShards)}</h4>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-puzzle-piece fa-2x"></i>
+                            <i class="bi bi-puzzle icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -89,7 +89,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                             <small>All { fmt.Sprintf("%d", erasure_coding.TotalShardsCount) } shards present</small>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-check-circle fa-2x"></i>
+                            <i class="bi bi-check-circle icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -105,7 +105,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                             <small>Incomplete/Critical</small>
                         </div>
                         <div class="align-self-center">
-                            <i class="fas fa-exclamation-triangle fa-2x"></i>
+                            <i class="bi bi-exclamation-triangle icon-2x"></i>
                         </div>
                     </div>
                 </div>
@@ -115,7 +115,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
 
     <!-- EC Storage Information Note -->
     <div class="alert alert-info mb-4" role="alert">
-        <i class="fas fa-info-circle me-2"></i>
+        <i class="bi bi-info-circle me-2"></i>
         <strong>EC Storage Note:</strong> 
         EC volumes use erasure coding ({ fmt.Sprintf("%d+%d", erasure_coding.DataShardsCount, erasure_coding.ParityShardsCount) }) which stores data across { fmt.Sprintf("%d", erasure_coding.TotalShardsCount) } shards with redundancy. 
         Physical storage is approximately { fmt.Sprintf("%.1fx", float64(erasure_coding.TotalShardsCount)/float64(erasure_coding.DataShardsCount)) } the original logical data size due to { fmt.Sprintf("%d", erasure_coding.ParityShardsCount) } parity shards.
@@ -131,12 +131,12 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                             Volume ID
                             if data.SortBy == "volume_id" {
                                 if data.SortOrder == "asc" {
-                                    <i class="fas fa-sort-up ms-1"></i>
+                                    <i class="bi bi-sort-up ms-1"></i>
                                 } else {
-                                    <i class="fas fa-sort-down ms-1"></i>
+                                    <i class="bi bi-sort-down ms-1"></i>
                                 }
                             } else {
-                                <i class="fas fa-sort ms-1 text-muted"></i>
+                                <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                             }
                         </a>
                     </th>
@@ -146,12 +146,12 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                                 Collection
                                 if data.SortBy == "collection" {
                                     if data.SortOrder == "asc" {
-                                        <i class="fas fa-sort-up ms-1"></i>
+                                        <i class="bi bi-sort-up ms-1"></i>
                                     } else {
-                                        <i class="fas fa-sort-down ms-1"></i>
+                                        <i class="bi bi-sort-down ms-1"></i>
                                     }
                                 } else {
-                                    <i class="fas fa-sort ms-1 text-muted"></i>
+                                    <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                 }
                             </a>
                         </th>
@@ -161,12 +161,12 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                             Shard Count
                             if data.SortBy == "total_shards" {
                                 if data.SortOrder == "asc" {
-                                    <i class="fas fa-sort-up ms-1"></i>
+                                    <i class="bi bi-sort-up ms-1"></i>
                                 } else {
-                                    <i class="fas fa-sort-down ms-1"></i>
+                                    <i class="bi bi-sort-down ms-1"></i>
                                 }
                             } else {
-                                <i class="fas fa-sort ms-1 text-muted"></i>
+                                <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                             }
                         </a>
                     </th>
@@ -177,12 +177,12 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                             Status
                             if data.SortBy == "completeness" {
                                 if data.SortOrder == "asc" {
-                                    <i class="fas fa-sort-up ms-1"></i>
+                                    <i class="bi bi-sort-up ms-1"></i>
                                 } else {
-                                    <i class="fas fa-sort-down ms-1"></i>
+                                    <i class="bi bi-sort-down ms-1"></i>
                                 }
                             } else {
-                                <i class="fas fa-sort ms-1 text-muted"></i>
+                                <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                             }
                         </a>
                     </th>
@@ -239,7 +239,7 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                                         onclick="showVolumeDetails(event)" 
                                         data-volume-id={ fmt.Sprintf("%d", volume.VolumeID) }
                                         title="View EC volume details">
-                                    <i class="fas fa-info-circle"></i>
+                                    <i class="bi bi-info-circle"></i>
                                 </button>
                             </div>
                         </td>
@@ -256,12 +256,12 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                 if data.Page > 1 {
                     <li class="page-item">
                         <a class="page-link" href="#" onclick="goToPage(event)" data-page="1">
-                            <i class="fas fa-angle-double-left"></i>
+                            <i class="bi bi-chevron-double-left"></i>
                         </a>
                     </li>
                     <li class="page-item">
                         <a class="page-link" href="#" onclick="goToPage(event)" data-page={ fmt.Sprintf("%d", data.Page-1) }>
-                            <i class="fas fa-chevron-left"></i>
+                            <i class="bi bi-chevron-left"></i>
                         </a>
                     </li>
                 }
@@ -310,12 +310,12 @@ templ ClusterEcVolumes(data dash.ClusterEcVolumesData) {
                 if data.Page < data.TotalPages {
                     <li class="page-item">
                         <a class="page-link" href="#" onclick="goToPage(event)" data-page={ fmt.Sprintf("%d", data.Page+1) }>
-                            <i class="fas fa-chevron-right"></i>
+                            <i class="bi bi-chevron-right"></i>
                         </a>
                     </li>
                     <li class="page-item">
                         <a class="page-link" href="#" onclick="goToPage(event)" data-page={ fmt.Sprintf("%d", data.TotalPages) }>
-                            <i class="fas fa-angle-double-right"></i>
+                            <i class="bi bi-chevron-double-right"></i>
                         </a>
                     </li>
                 }
@@ -560,7 +560,7 @@ func formatIndividualShardSizes(shardSizes map[int]int64) string {
 // displayVolumeDistribution shows the distribution summary for a volume
 templ displayVolumeDistribution(volume dash.EcVolumeWithShards) {
     <div class="small">
-        <i class="fas fa-sitemap me-1"></i>
+        <i class="bi bi-diagram-3 me-1"></i>
         { calculateVolumeDistributionSummary(volume) }
     </div>
 }
@@ -573,20 +573,20 @@ templ displayVolumeDistribution(volume dash.EcVolumeWithShards) {
 // - Minor Issues: Few shards missing (still fully recoverable)
 templ displayEcVolumeStatus(volume dash.EcVolumeWithShards) {
     if volume.IsComplete {
-        <span class="badge bg-success"><i class="fas fa-check me-1"></i>Complete</span>
+        <span class="badge bg-success"><i class="bi bi-check me-1"></i>Complete</span>
     } else {
         if len(volume.MissingShards) > erasure_coding.DataShardsCount {
             // Unrecoverable: more shards missing than EC can reconstruct
-            <span class="badge bg-danger"><i class="fas fa-skull me-1"></i>Critical ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
+            <span class="badge bg-danger"><i class="bi bi-exclamation-octagon me-1"></i>Critical ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
         } else if len(volume.MissingShards) > (erasure_coding.DataShardsCount/2) {
             // High risk: approaching unrecoverable state
-            <span class="badge bg-warning"><i class="fas fa-exclamation-triangle me-1"></i>Degraded ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
+            <span class="badge bg-warning"><i class="bi bi-exclamation-triangle me-1"></i>Degraded ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
         } else if len(volume.MissingShards) > (erasure_coding.ParityShardsCount/2) {
             // Reduced redundancy but still recoverable
-            <span class="badge bg-warning"><i class="fas fa-info-circle me-1"></i>Incomplete ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
+            <span class="badge bg-warning"><i class="bi bi-info-circle me-1"></i>Incomplete ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
         } else {
             // Minor: few shards missing, fully recoverable with good margin
-            <span class="badge bg-info"><i class="fas fa-info-circle me-1"></i>Minor Issues ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
+            <span class="badge bg-info"><i class="bi bi-info-circle me-1"></i>Minor Issues ({fmt.Sprintf("%d", len(volume.MissingShards))} missing)</span>
         }
     }
 }
diff --git a/weed/admin/view/app/cluster_ec_volumes_templ.go b/weed/admin/view/app/cluster_ec_volumes_templ.go
index 22260978f7..a4224cbaf1 100644
--- a/weed/admin/view/app/cluster_ec_volumes_templ.go
+++ b/weed/admin/view/app/cluster_ec_volumes_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -37,7 +37,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"fas fa-database me-2\"></i>EC Volumes</h1>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"bi bi-database me-2\"></i>EC Volumes</h1>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,19 +47,19 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if data.Collection == "default" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<span class=\"badge bg-secondary text-white me-2\"><i class=\"fas fa-filter me-1\"></i>Collection: default</span> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<span class=\"badge bg-secondary text-white me-2\"><i class=\"bi bi-funnel me-1\"></i>Collection: default</span> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<span class=\"badge bg-info text-white me-2\"><i class=\"fas fa-filter me-1\"></i>Collection: ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<span class=\"badge bg-info text-white me-2\"><i class=\"bi bi-funnel me-1\"></i>Collection: ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var2 string
 				templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(data.Collection)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 25, Col: 90}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 25, Col: 89}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
 				if templ_7745c5c3_Err != nil {
@@ -83,7 +83,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-times me-1\"></i>Clear Filter</a></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-x me-1\"></i>Clear Filter</a></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -138,7 +138,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, ">100 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"fas fa-refresh me-1\"></i>Refresh</button></div></div></div><!-- Statistics Cards --><div class=\"row mb-4\"><div class=\"col-md-3\"><div class=\"card text-bg-primary\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, ">100 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"bi bi-arrow-clockwise me-1\"></i>Refresh</button></div></div></div><!-- Statistics Cards --><div class=\"row mb-4\"><div class=\"col-md-3\"><div class=\"card text-bg-primary\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -151,7 +151,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</h4></div><div class=\"align-self-center\"><i class=\"fas fa-cubes fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-info\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Shards</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</h4></div><div class=\"align-self-center\"><i class=\"bi bi-boxes icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-info\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Shards</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -164,7 +164,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</h4></div><div class=\"align-self-center\"><i class=\"fas fa-puzzle-piece fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-success\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Healthy Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</h4></div><div class=\"align-self-center\"><i class=\"bi bi-puzzle icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-success\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Healthy Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -190,7 +190,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, " shards present</small></div><div class=\"align-self-center\"><i class=\"fas fa-check-circle fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-warning\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Degraded Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, " shards present</small></div><div class=\"align-self-center\"><i class=\"bi bi-check-circle icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-warning\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Degraded Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -203,7 +203,7 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</h4><small>Incomplete/Critical</small></div><div class=\"align-self-center\"><i class=\"fas fa-exclamation-triangle fa-2x\"></i></div></div></div></div></div></div><!-- EC Storage Information Note --><div class=\"alert alert-info mb-4\" role=\"alert\"><i class=\"fas fa-info-circle me-2\"></i> <strong>EC Storage Note:</strong> EC volumes use erasure coding (")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</h4><small>Incomplete/Critical</small></div><div class=\"align-self-center\"><i class=\"bi bi-exclamation-triangle icon-2x\"></i></div></div></div></div></div></div><!-- EC Storage Information Note --><div class=\"alert alert-info mb-4\" role=\"alert\"><i class=\"bi bi-info-circle me-2\"></i> <strong>EC Storage Note:</strong> EC volumes use erasure coding (")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -261,18 +261,18 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 		}
 		if data.SortBy == "volume_id" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<i class=\"bi bi-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<i class=\"bi bi-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -288,18 +288,18 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 			}
 			if data.SortBy == "collection" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -315,18 +315,18 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 		}
 		if data.SortBy == "total_shards" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<i class=\"bi bi-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<i class=\"bi bi-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -337,18 +337,18 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 		}
 		if data.SortBy == "completeness" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<i class=\"bi bi-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<i class=\"bi bi-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -526,15 +526,15 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var19 string
-			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", volume.VolumeID))
+			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", volume.VolumeID))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 240, Col: 91}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var19)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\" title=\"View EC volume details\"><i class=\"fas fa-info-circle\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\" title=\"View EC volume details\"><i class=\"bi bi-info-circle\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -549,20 +549,20 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if data.Page > 1 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "<li class=\"page-item\"><a class=\"page-link\" href=\"#\" onclick=\"goToPage(event)\" data-page=\"1\"><i class=\"fas fa-angle-double-left\"></i></a></li><li class=\"page-item\"><a class=\"page-link\" href=\"#\" onclick=\"goToPage(event)\" data-page=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "<li class=\"page-item\"><a class=\"page-link\" href=\"#\" onclick=\"goToPage(event)\" data-page=\"1\"><i class=\"bi bi-chevron-double-left\"></i></a></li><li class=\"page-item\"><a class=\"page-link\" href=\"#\" onclick=\"goToPage(event)\" data-page=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var20 string
-				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.Page-1))
+				templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.Page-1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 263, Col: 122}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "\"><i class=\"fas fa-chevron-left\"></i></a></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "\"><i class=\"bi bi-chevron-left\"></i></a></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -593,11 +593,11 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var21 string
-				templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.Page-1))
+				templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.Page-1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 284, Col: 122}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -642,11 +642,11 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var24 string
-				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.Page+1))
+				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.Page+1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 294, Col: 122}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -684,11 +684,11 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var26 string
-				templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalPages))
+				templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.TotalPages))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 306, Col: 126}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -716,28 +716,28 @@ func ClusterEcVolumes(data dash.ClusterEcVolumesData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var28 string
-				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.Page+1))
+				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.Page+1))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 312, Col: 122}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\"><i class=\"fas fa-chevron-right\"></i></a></li><li class=\"page-item\"><a class=\"page-link\" href=\"#\" onclick=\"goToPage(event)\" data-page=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\"><i class=\"bi bi-chevron-right\"></i></a></li><li class=\"page-item\"><a class=\"page-link\" href=\"#\" onclick=\"goToPage(event)\" data-page=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var29 string
-				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalPages))
+				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.TotalPages))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 317, Col: 126}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "\"><i class=\"fas fa-angle-double-right\"></i></a></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "\"><i class=\"bi bi-chevron-double-right\"></i></a></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -1041,7 +1041,7 @@ func displayVolumeDistribution(volume dash.EcVolumeWithShards) templ.Component {
 			templ_7745c5c3_Var34 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 100, "<div class=\"small\"><i class=\"fas fa-sitemap me-1\"></i> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 100, "<div class=\"small\"><i class=\"bi bi-diagram-3 me-1\"></i> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1090,20 +1090,20 @@ func displayEcVolumeStatus(volume dash.EcVolumeWithShards) templ.Component {
 		}
 		ctx = templ.ClearChildren(ctx)
 		if volume.IsComplete {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 102, "<span class=\"badge bg-success\"><i class=\"fas fa-check me-1\"></i>Complete</span>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 102, "<span class=\"badge bg-success\"><i class=\"bi bi-check me-1\"></i>Complete</span>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
 			if len(volume.MissingShards) > erasure_coding.DataShardsCount {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 103, " <span class=\"badge bg-danger\"><i class=\"fas fa-skull me-1\"></i>Critical (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 103, " <span class=\"badge bg-danger\"><i class=\"bi bi-exclamation-octagon me-1\"></i>Critical (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var37 string
 				templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(volume.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 580, Col: 130}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 580, Col: 143}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
 				if templ_7745c5c3_Err != nil {
@@ -1114,14 +1114,14 @@ func displayEcVolumeStatus(volume dash.EcVolumeWithShards) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			} else if len(volume.MissingShards) > (erasure_coding.DataShardsCount / 2) {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 105, " <span class=\"badge bg-warning\"><i class=\"fas fa-exclamation-triangle me-1\"></i>Degraded (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 105, " <span class=\"badge bg-warning\"><i class=\"bi bi-exclamation-triangle me-1\"></i>Degraded (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var38 string
 				templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(volume.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 583, Col: 146}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 583, Col: 145}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
 				if templ_7745c5c3_Err != nil {
@@ -1132,14 +1132,14 @@ func displayEcVolumeStatus(volume dash.EcVolumeWithShards) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			} else if len(volume.MissingShards) > (erasure_coding.ParityShardsCount / 2) {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 107, " <span class=\"badge bg-warning\"><i class=\"fas fa-info-circle me-1\"></i>Incomplete (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 107, " <span class=\"badge bg-warning\"><i class=\"bi bi-info-circle me-1\"></i>Incomplete (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var39 string
 				templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(volume.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 586, Col: 139}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 586, Col: 138}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
 				if templ_7745c5c3_Err != nil {
@@ -1150,14 +1150,14 @@ func displayEcVolumeStatus(volume dash.EcVolumeWithShards) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, " <span class=\"badge bg-info\"><i class=\"fas fa-info-circle me-1\"></i>Minor Issues (")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, " <span class=\"badge bg-info\"><i class=\"bi bi-info-circle me-1\"></i>Minor Issues (")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var40 string
 				templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", len(volume.MissingShards)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 589, Col: 138}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_ec_volumes.templ`, Line: 589, Col: 137}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40))
 				if templ_7745c5c3_Err != nil {
diff --git a/weed/admin/view/app/cluster_filers.templ b/weed/admin/view/app/cluster_filers.templ
index b20025662e..f28cda10e4 100644
--- a/weed/admin/view/app/cluster_filers.templ
+++ b/weed/admin/view/app/cluster_filers.templ
@@ -8,12 +8,12 @@ import (
 templ ClusterFilers(data dash.ClusterFilersData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-folder-open me-2"></i>Filers
+			<i class="bi bi-folder2-open me-2"></i>Filers
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-outline-primary" onclick="exportFilers()">
-					<i class="fas fa-download me-1"></i>Export
+					<i class="bi bi-download me-1"></i>Export
 				</button>
 			</div>
 		</div>
@@ -35,7 +35,7 @@ templ ClusterFilers(data dash.ClusterFilersData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-folder-open fa-2x text-gray-300"></i>
+								<i class="bi bi-folder2-open icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -47,7 +47,7 @@ templ ClusterFilers(data dash.ClusterFilersData) {
 		<div class="card shadow mb-4">
 			<div class="card-header py-3">
 				<h6 class="m-0 font-weight-bold text-primary">
-					<i class="fas fa-folder-open me-2"></i>Filers
+					<i class="bi bi-folder2-open me-2"></i>Filers
 				</h6>
 			</div>
 			<div class="card-body">
@@ -70,7 +70,7 @@ templ ClusterFilers(data dash.ClusterFilersData) {
 										<td>
 											<a href={ templ.SafeURL(fmt.Sprintf("//%s", filer.Address)) } target="_blank" class="text-decoration-none">
 												{ filer.Address }
-												<i class="fas fa-external-link-alt ms-1 text-muted"></i>
+												<i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
 											</a>
 										</td>
 										<td>
@@ -92,7 +92,7 @@ templ ClusterFilers(data dash.ClusterFilersData) {
 										<td>
 											<div class="btn-group btn-group-sm" role="group">
 												<button type="button" class="btn btn-outline-secondary btn-sm" title="File Browser" data-action="open-filer" data-address={ filer.Address }>
-													<i class="fas fa-folder-open"></i>
+													<i class="bi bi-folder2-open"></i>
 												</button>
 											</div>
 										</td>
@@ -103,7 +103,7 @@ templ ClusterFilers(data dash.ClusterFilersData) {
 					</div>
 				} else {
 					<div class="text-center py-5">
-						<i class="fas fa-folder-open fa-3x text-muted mb-3"></i>
+						<i class="bi bi-folder2-open icon-3x text-muted mb-3"></i>
 						<h5 class="text-muted">No Filers Found</h5>
 						<p class="text-muted">No filer servers are currently available in the cluster.</p>
 					</div>
@@ -115,7 +115,7 @@ templ ClusterFilers(data dash.ClusterFilersData) {
 		<div class="row">
 			<div class="col-12">
 				<small class="text-muted">
-					<i class="fas fa-clock me-1"></i>
+					<i class="bi bi-clock me-1"></i>
 					Last updated: { data.LastUpdated.Format("2006-01-02 15:04:05") }
 				</small>
 			</div>
@@ -145,7 +145,7 @@ templ ClusterFilers(data dash.ClusterFilersData) {
 	
 	function openFilerBrowser(address) {
 		// Open file browser for specific filer
-		window.open('/files?filer=' + encodeURIComponent(address), '_blank');
+		window.open((window.__BASE_PATH__ || '') + '/files?filer=' + encodeURIComponent(address), '_blank');
 	}
 	
 	function exportFilers() {
diff --git a/weed/admin/view/app/cluster_filers_templ.go b/weed/admin/view/app/cluster_filers_templ.go
index 87f9f45ebc..40a815d545 100644
--- a/weed/admin/view/app/cluster_filers_templ.go
+++ b/weed/admin/view/app/cluster_filers_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func ClusterFilers(data dash.ClusterFilersData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-folder-open me-2\"></i>Filers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportFilers()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><div id=\"filers-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Filers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-folder2-open me-2\"></i>Filers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportFilers()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><div id=\"filers-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Filers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ClusterFilers(data dash.ClusterFilersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-folder-open fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Filers Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-folder-open me-2\"></i>Filers</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-folder2-open icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Filers Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-folder2-open me-2\"></i>Filers</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -83,7 +83,7 @@ func ClusterFilers(data dash.ClusterFilersData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></td><td><span class=\"badge bg-light text-dark\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></td><td><span class=\"badge bg-light text-dark\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -147,15 +147,15 @@ func ClusterFilers(data dash.ClusterFilersData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var9 string
-				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(filer.Address)
+				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue(filer.Address)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_filers.templ`, Line: 94, Col: 149}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"fas fa-folder-open\"></i></button></div></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"bi bi-folder2-open\"></i></button></div></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -165,12 +165,12 @@ func ClusterFilers(data dash.ClusterFilersData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<div class=\"text-center py-5\"><i class=\"fas fa-folder-open fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Filers Found</h5><p class=\"text-muted\">No filer servers are currently available in the cluster.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<div class=\"text-center py-5\"><i class=\"bi bi-folder2-open icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Filers Found</h5><p class=\"text-muted\">No filer servers are currently available in the cluster.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -183,7 +183,7 @@ func ClusterFilers(data dash.ClusterFilersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</small></div></div></div><!-- JavaScript for cluster filers functionality --><script>\n\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t// Handle filer action buttons\n\t\tdocument.addEventListener('click', function(e) {\n\t\t\tconst button = e.target.closest('[data-action]');\n\t\t\tif (!button) return;\n\t\t\t\n\t\t\tconst action = button.getAttribute('data-action');\n\t\t\tconst address = button.getAttribute('data-address');\n\t\t\t\n\t\t\tif (!address) return;\n\t\t\t\n\t\t\tswitch(action) {\n\t\t\t\tcase 'open-filer':\n\t\t\t\t\topenFilerBrowser(address);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t});\n\t});\n\t\n\tfunction openFilerBrowser(address) {\n\t\t// Open file browser for specific filer\n\t\twindow.open('/files?filer=' + encodeURIComponent(address), '_blank');\n\t}\n\t\n\tfunction exportFilers() {\n\t\t// Simple CSV export of filers list\n\t\tconst rows = Array.from(document.querySelectorAll('#filersTable tbody tr')).map(row => {\n\t\t\tconst cells = row.querySelectorAll('td');\n\t\t\tif (cells.length > 1) {\n\t\t\t\treturn {\n\t\t\t\t\taddress: cells[0].textContent.trim(),\n\t\t\t\t\tversion: cells[1].textContent.trim(),\n\t\t\t\t\tdatacenter: cells[2].textContent.trim(),\n\t\t\t\t\track: cells[3].textContent.trim(),\n\t\t\t\t\tcreated: cells[4].textContent.trim()\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn null;\n\t\t}).filter(row => row !== null);\n\t\t\n\t\tconst csvContent = \"data:text/csv;charset=utf-8,\" + \n\t\t\t\"Address,Version,Data Center,Rack,Created At\\n\" +\n\t\t\trows.map(r => '\"' + r.address + '\",\"' + r.version + '\",\"' + r.datacenter + '\",\"' + r.rack + '\",\"' + r.created + '\"').join(\"\\n\");\n\t\t\n\t\tconst encodedUri = encodeURI(csvContent);\n\t\tconst link = document.createElement(\"a\");\n\t\tlink.setAttribute(\"href\", encodedUri);\n\t\tlink.setAttribute(\"download\", \"filers.csv\");\n\t\tdocument.body.appendChild(link);\n\t\tlink.click();\n\t\tdocument.body.removeChild(link);\n\t}\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</small></div></div></div><!-- JavaScript for cluster filers functionality --><script>\n\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t// Handle filer action buttons\n\t\tdocument.addEventListener('click', function(e) {\n\t\t\tconst button = e.target.closest('[data-action]');\n\t\t\tif (!button) return;\n\t\t\t\n\t\t\tconst action = button.getAttribute('data-action');\n\t\t\tconst address = button.getAttribute('data-address');\n\t\t\t\n\t\t\tif (!address) return;\n\t\t\t\n\t\t\tswitch(action) {\n\t\t\t\tcase 'open-filer':\n\t\t\t\t\topenFilerBrowser(address);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t});\n\t});\n\t\n\tfunction openFilerBrowser(address) {\n\t\t// Open file browser for specific filer\n\t\twindow.open((window.__BASE_PATH__ || '') + '/files?filer=' + encodeURIComponent(address), '_blank');\n\t}\n\t\n\tfunction exportFilers() {\n\t\t// Simple CSV export of filers list\n\t\tconst rows = Array.from(document.querySelectorAll('#filersTable tbody tr')).map(row => {\n\t\t\tconst cells = row.querySelectorAll('td');\n\t\t\tif (cells.length > 1) {\n\t\t\t\treturn {\n\t\t\t\t\taddress: cells[0].textContent.trim(),\n\t\t\t\t\tversion: cells[1].textContent.trim(),\n\t\t\t\t\tdatacenter: cells[2].textContent.trim(),\n\t\t\t\t\track: cells[3].textContent.trim(),\n\t\t\t\t\tcreated: cells[4].textContent.trim()\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn null;\n\t\t}).filter(row => row !== null);\n\t\t\n\t\tconst csvContent = \"data:text/csv;charset=utf-8,\" + \n\t\t\t\"Address,Version,Data Center,Rack,Created At\\n\" +\n\t\t\trows.map(r => '\"' + r.address + '\",\"' + r.version + '\",\"' + r.datacenter + '\",\"' + r.rack + '\",\"' + r.created + '\"').join(\"\\n\");\n\t\t\n\t\tconst encodedUri = encodeURI(csvContent);\n\t\tconst link = document.createElement(\"a\");\n\t\tlink.setAttribute(\"href\", encodedUri);\n\t\tlink.setAttribute(\"download\", \"filers.csv\");\n\t\tdocument.body.appendChild(link);\n\t\tlink.click();\n\t\tdocument.body.removeChild(link);\n\t}\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/cluster_masters.templ b/weed/admin/view/app/cluster_masters.templ
index 05e2e1bd98..7688ba0cfa 100644
--- a/weed/admin/view/app/cluster_masters.templ
+++ b/weed/admin/view/app/cluster_masters.templ
@@ -8,12 +8,12 @@ import (
 templ ClusterMasters(data dash.ClusterMastersData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-crown me-2"></i>Masters
+			<i class="bi bi-award me-2"></i>Masters
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-outline-primary" onclick="exportMasters()">
-					<i class="fas fa-download me-1"></i>Export
+					<i class="bi bi-download me-1"></i>Export
 				</button>
 			</div>
 		</div>
@@ -35,7 +35,7 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-crown fa-2x text-gray-300"></i>
+								<i class="bi bi-award icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -55,7 +55,7 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-star fa-2x text-gray-300"></i>
+								<i class="bi bi-star icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -79,7 +79,7 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-heartbeat fa-2x text-gray-300"></i>
+								<i class="bi bi-activity icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -91,7 +91,7 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 		<div class="card shadow mb-4">
 			<div class="card-header py-3">
 				<h6 class="m-0 font-weight-bold text-primary">
-					<i class="fas fa-crown me-2"></i>Masters
+					<i class="bi bi-award me-2"></i>Masters
 				</h6>
 			</div>
 			<div class="card-body">
@@ -112,17 +112,17 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 										<td>
 											<a href={ templ.SafeURL(fmt.Sprintf("//%s", master.Address)) } target="_blank" class="text-decoration-none">
 												{ master.Address }
-												<i class="fas fa-external-link-alt ms-1 text-muted"></i>
+												<i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
 											</a>
 										</td>
 										<td>
 											if master.IsLeader {
 												<span class="badge bg-warning text-dark">
-													<i class="fas fa-star me-1"></i>Leader
+													<i class="bi bi-star me-1"></i>Leader
 												</span>
 											} else {
 												<span class="badge bg-secondary">
-													<i class="fas fa-circle me-1"></i>Follower
+													<i class="bi bi-circle-fill me-1"></i>Follower
 												</span>
 											}
 										</td>
@@ -143,7 +143,7 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 													data-address={master.Address}
 													data-leader={fmt.Sprintf("%t", master.IsLeader)}
 													data-suffrage={master.Suffrage}>
-												<i class="fas fa-eye"></i>
+												<i class="bi bi-eye"></i>
 											</button>
 										</td>
 									</tr>
@@ -153,7 +153,7 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 					</div>
 				} else {
 					<div class="text-center py-5">
-						<i class="fas fa-crown fa-3x text-muted mb-3"></i>
+						<i class="bi bi-award icon-3x text-muted mb-3"></i>
 						<h5 class="text-muted">No Masters Found</h5>
 						<p class="text-muted">No master servers are currently available in the cluster.</p>
 					</div>
@@ -165,7 +165,7 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 		<div class="row">
 			<div class="col-12">
 				<small class="text-muted">
-					<i class="fas fa-clock me-1"></i>
+					<i class="bi bi-clock me-1"></i>
 					Last updated: { data.LastUpdated.Format("2006-01-02 15:04:05") }
 				</small>
 			</div>
@@ -200,27 +200,27 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 			'<div class="modal-dialog modal-lg">' +
 			'<div class="modal-content">' +
 			'<div class="modal-header">' +
-			'<h5 class="modal-title"><i class="fas fa-crown me-2"></i>Master Details: ' + address + '</h5>' +
+			'<h5 class="modal-title"><i class="bi bi-award me-2"></i>Master Details: ' + address + '</h5>' +
 			'<button type="button" class="btn-close" data-bs-dismiss="modal"></button>' +
 			'</div>' +
 			'<div class="modal-body">' +
 			'<div class="row">' +
 			'<div class="col-md-6">' +
-			'<h6 class="text-primary"><i class="fas fa-info-circle me-1"></i>Basic Information</h6>' +
+			'<h6 class="text-primary"><i class="bi bi-info-circle me-1"></i>Basic Information</h6>' +
 			'<table class="table table-sm">' +
 			'<tr><td><strong>Address:</strong></td><td>' + address + '</td></tr>' +
 			'<tr><td><strong>Role:</strong></td><td>' + 
-			(isLeader ? '<span class="badge bg-warning text-dark"><i class="fas fa-star me-1"></i>Leader</span>' : 
+			(isLeader ? '<span class="badge bg-warning text-dark"><i class="bi bi-star me-1"></i>Leader</span>' :
 			'<span class="badge bg-secondary">Follower</span>') + '</td></tr>' +
 			'<tr><td><strong>Suffrage:</strong></td><td>' + (suffrage || 'N/A') + '</td></tr>' +
 			'<tr><td><strong>Status:</strong></td><td><span class="badge bg-success">Active</span></td></tr>' +
 			'</table>' +
 			'</div>' +
 			'<div class="col-md-6">' +
-			'<h6 class="text-primary"><i class="fas fa-link me-1"></i>Quick Actions</h6>' +
+			'<h6 class="text-primary"><i class="bi bi-link me-1"></i>Quick Actions</h6>' +
 			'<div class="d-grid gap-2">' +
 			'<a href="//' + address + '" target="_blank" class="btn btn-outline-primary">' +
-			'<i class="fas fa-external-link-alt me-1"></i>Open Master UI' +
+			'<i class="bi bi-box-arrow-up-right me-1"></i>Open Master UI' +
 			'</a>' +
 			'</div>' +
 			'</div>' +
@@ -278,5 +278,3 @@ templ ClusterMasters(data dash.ClusterMastersData) {
 	}
 	</script>
 }
-
- 
\ No newline at end of file
diff --git a/weed/admin/view/app/cluster_masters_templ.go b/weed/admin/view/app/cluster_masters_templ.go
index 8a1d5cc481..e1b72a4492 100644
--- a/weed/admin/view/app/cluster_masters_templ.go
+++ b/weed/admin/view/app/cluster_masters_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-crown me-2\"></i>Masters</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportMasters()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><div id=\"masters-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Masters</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-award me-2\"></i>Masters</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportMasters()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><div id=\"masters-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Masters</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-crown fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Leaders</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-award icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Leaders</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +60,7 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-star fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Cluster Health</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-star icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Cluster Health</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -75,7 +75,7 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</div></div><div class=\"col-auto\"><i class=\"fas fa-heartbeat fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Masters Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-crown me-2\"></i>Masters</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</div></div><div class=\"col-auto\"><i class=\"bi bi-activity icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Masters Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-award me-2\"></i>Masters</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -111,17 +111,17 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></td><td>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></td><td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				if master.IsLeader {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "<span class=\"badge bg-warning text-dark\"><i class=\"fas fa-star me-1\"></i>Leader</span>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "<span class=\"badge bg-warning text-dark\"><i class=\"bi bi-star me-1\"></i>Leader</span>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<span class=\"badge bg-secondary\"><i class=\"fas fa-circle me-1\"></i>Follower</span>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<span class=\"badge bg-secondary\"><i class=\"bi bi-circle-fill me-1\"></i>Follower</span>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -159,11 +159,11 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var7 string
-				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(master.Address)
+				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.ResolveAttributeValue(master.Address)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_masters.templ`, Line: 143, Col: 41}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var7)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -172,11 +172,11 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var8 string
-				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%t", master.IsLeader))
+				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%t", master.IsLeader))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_masters.templ`, Line: 144, Col: 60}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var8)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -185,15 +185,15 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var9 string
-				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(master.Suffrage)
+				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue(master.Suffrage)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_masters.templ`, Line: 145, Col: 43}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\"><i class=\"fas fa-eye\"></i></button></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\"><i class=\"bi bi-eye\"></i></button></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -203,12 +203,12 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<div class=\"text-center py-5\"><i class=\"fas fa-crown fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Masters Found</h5><p class=\"text-muted\">No master servers are currently available in the cluster.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<div class=\"text-center py-5\"><i class=\"bi bi-award icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Masters Found</h5><p class=\"text-muted\">No master servers are currently available in the cluster.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -221,7 +221,7 @@ func ClusterMasters(data dash.ClusterMastersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</small></div></div></div><!-- JavaScript for cluster masters functionality --><script>\n\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t// Handle master action buttons\n\t\tdocument.addEventListener('click', function(e) {\n\t\t\tconst button = e.target.closest('[data-action]');\n\t\t\tif (!button) return;\n\t\t\t\n\t\t\tconst action = button.getAttribute('data-action');\n\t\t\tconst address = button.getAttribute('data-address');\n\t\t\t\n\t\t\tif (!address) return;\n\t\t\t\n\t\t\tswitch(action) {\n\t\t\t\tcase 'view-details':\n\t\t\t\t\tconst isLeader = button.getAttribute('data-leader') === 'true';\n\t\t\t\t\tconst suffrage = button.getAttribute('data-suffrage');\n\t\t\t\t\tshowMasterDetails(address, isLeader, suffrage);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t});\n\t});\n\t\n\tfunction showMasterDetails(address, isLeader, suffrage) {\n\t\tconst modalHtml = '<div class=\"modal fade\" id=\"masterDetailsModal\" tabindex=\"-1\">' +\n\t\t\t'<div class=\"modal-dialog modal-lg\">' +\n\t\t\t'<div class=\"modal-content\">' +\n\t\t\t'<div class=\"modal-header\">' +\n\t\t\t'<h5 class=\"modal-title\"><i class=\"fas fa-crown me-2\"></i>Master Details: ' + address + '</h5>' +\n\t\t\t'<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-body\">' +\n\t\t\t'<div class=\"row\">' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-info-circle me-1\"></i>Basic Information</h6>' +\n\t\t\t'<table class=\"table table-sm\">' +\n\t\t\t'<tr><td><strong>Address:</strong></td><td>' + address + '</td></tr>' +\n\t\t\t'<tr><td><strong>Role:</strong></td><td>' + \n\t\t\t(isLeader ? '<span class=\"badge bg-warning text-dark\"><i class=\"fas fa-star me-1\"></i>Leader</span>' : \n\t\t\t'<span class=\"badge bg-secondary\">Follower</span>') + '</td></tr>' +\n\t\t\t'<tr><td><strong>Suffrage:</strong></td><td>' + (suffrage || 'N/A') + '</td></tr>' +\n\t\t\t'<tr><td><strong>Status:</strong></td><td><span class=\"badge bg-success\">Active</span></td></tr>' +\n\t\t\t'</table>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-link me-1\"></i>Quick Actions</h6>' +\n\t\t\t'<div class=\"d-grid gap-2\">' +\n\t\t\t'<a href=\"//' + address + '\" target=\"_blank\" class=\"btn btn-outline-primary\">' +\n\t\t\t'<i class=\"fas fa-external-link-alt me-1\"></i>Open Master UI' +\n\t\t\t'</a>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-footer\">' +\n\t\t\t'<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Remove existing modal if present\n\t\tconst existingModal = document.getElementById('masterDetailsModal');\n\t\tif (existingModal) {\n\t\t\texistingModal.remove();\n\t\t}\n\t\t\n\t\t// Add modal to body and show\n\t\tdocument.body.insertAdjacentHTML('beforeend', modalHtml);\n\t\tconst modal = new bootstrap.Modal(document.getElementById('masterDetailsModal'));\n\t\tmodal.show();\n\t\t\n\t\t// Remove modal when hidden\n\t\tdocument.getElementById('masterDetailsModal').addEventListener('hidden.bs.modal', function() {\n\t\t\tthis.remove();\n\t\t});\n\t}\n\t\n\tfunction exportMasters() {\n\t\t// Simple CSV export of masters list\n\t\tconst rows = Array.from(document.querySelectorAll('#mastersTable tbody tr')).map(row => {\n\t\t\tconst cells = row.querySelectorAll('td');\n\t\t\tif (cells.length > 1) {\n\t\t\t\treturn {\n\t\t\t\t\taddress: cells[0].textContent.trim(),\n\t\t\t\t\trole: cells[1].textContent.trim(),\n\t\t\t\t\tsuffrage: cells[2].textContent.trim()\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn null;\n\t\t}).filter(row => row !== null);\n\t\t\n\t\tconst csvContent = \"data:text/csv;charset=utf-8,\" + \n\t\t\t\"Address,Role,Suffrage\\n\" +\n\t\t\trows.map(r => '\"' + r.address + '\",\"' + r.role + '\",\"' + r.suffrage + '\"').join(\"\\n\");\n\t\t\n\t\tconst encodedUri = encodeURI(csvContent);\n\t\tconst link = document.createElement(\"a\");\n\t\tlink.setAttribute(\"href\", encodedUri);\n\t\tlink.setAttribute(\"download\", \"masters.csv\");\n\t\tdocument.body.appendChild(link);\n\t\tlink.click();\n\t\tdocument.body.removeChild(link);\n\t}\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</small></div></div></div><!-- JavaScript for cluster masters functionality --><script>\n\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t// Handle master action buttons\n\t\tdocument.addEventListener('click', function(e) {\n\t\t\tconst button = e.target.closest('[data-action]');\n\t\t\tif (!button) return;\n\t\t\t\n\t\t\tconst action = button.getAttribute('data-action');\n\t\t\tconst address = button.getAttribute('data-address');\n\t\t\t\n\t\t\tif (!address) return;\n\t\t\t\n\t\t\tswitch(action) {\n\t\t\t\tcase 'view-details':\n\t\t\t\t\tconst isLeader = button.getAttribute('data-leader') === 'true';\n\t\t\t\t\tconst suffrage = button.getAttribute('data-suffrage');\n\t\t\t\t\tshowMasterDetails(address, isLeader, suffrage);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t});\n\t});\n\t\n\tfunction showMasterDetails(address, isLeader, suffrage) {\n\t\tconst modalHtml = '<div class=\"modal fade\" id=\"masterDetailsModal\" tabindex=\"-1\">' +\n\t\t\t'<div class=\"modal-dialog modal-lg\">' +\n\t\t\t'<div class=\"modal-content\">' +\n\t\t\t'<div class=\"modal-header\">' +\n\t\t\t'<h5 class=\"modal-title\"><i class=\"bi bi-award me-2\"></i>Master Details: ' + address + '</h5>' +\n\t\t\t'<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-body\">' +\n\t\t\t'<div class=\"row\">' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-info-circle me-1\"></i>Basic Information</h6>' +\n\t\t\t'<table class=\"table table-sm\">' +\n\t\t\t'<tr><td><strong>Address:</strong></td><td>' + address + '</td></tr>' +\n\t\t\t'<tr><td><strong>Role:</strong></td><td>' + \n\t\t\t(isLeader ? '<span class=\"badge bg-warning text-dark\"><i class=\"bi bi-star me-1\"></i>Leader</span>' :\n\t\t\t'<span class=\"badge bg-secondary\">Follower</span>') + '</td></tr>' +\n\t\t\t'<tr><td><strong>Suffrage:</strong></td><td>' + (suffrage || 'N/A') + '</td></tr>' +\n\t\t\t'<tr><td><strong>Status:</strong></td><td><span class=\"badge bg-success\">Active</span></td></tr>' +\n\t\t\t'</table>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-link me-1\"></i>Quick Actions</h6>' +\n\t\t\t'<div class=\"d-grid gap-2\">' +\n\t\t\t'<a href=\"//' + address + '\" target=\"_blank\" class=\"btn btn-outline-primary\">' +\n\t\t\t'<i class=\"bi bi-box-arrow-up-right me-1\"></i>Open Master UI' +\n\t\t\t'</a>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-footer\">' +\n\t\t\t'<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Remove existing modal if present\n\t\tconst existingModal = document.getElementById('masterDetailsModal');\n\t\tif (existingModal) {\n\t\t\texistingModal.remove();\n\t\t}\n\t\t\n\t\t// Add modal to body and show\n\t\tdocument.body.insertAdjacentHTML('beforeend', modalHtml);\n\t\tconst modal = new bootstrap.Modal(document.getElementById('masterDetailsModal'));\n\t\tmodal.show();\n\t\t\n\t\t// Remove modal when hidden\n\t\tdocument.getElementById('masterDetailsModal').addEventListener('hidden.bs.modal', function() {\n\t\t\tthis.remove();\n\t\t});\n\t}\n\t\n\tfunction exportMasters() {\n\t\t// Simple CSV export of masters list\n\t\tconst rows = Array.from(document.querySelectorAll('#mastersTable tbody tr')).map(row => {\n\t\t\tconst cells = row.querySelectorAll('td');\n\t\t\tif (cells.length > 1) {\n\t\t\t\treturn {\n\t\t\t\t\taddress: cells[0].textContent.trim(),\n\t\t\t\t\trole: cells[1].textContent.trim(),\n\t\t\t\t\tsuffrage: cells[2].textContent.trim()\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn null;\n\t\t}).filter(row => row !== null);\n\t\t\n\t\tconst csvContent = \"data:text/csv;charset=utf-8,\" + \n\t\t\t\"Address,Role,Suffrage\\n\" +\n\t\t\trows.map(r => '\"' + r.address + '\",\"' + r.role + '\",\"' + r.suffrage + '\"').join(\"\\n\");\n\t\t\n\t\tconst encodedUri = encodeURI(csvContent);\n\t\tconst link = document.createElement(\"a\");\n\t\tlink.setAttribute(\"href\", encodedUri);\n\t\tlink.setAttribute(\"download\", \"masters.csv\");\n\t\tdocument.body.appendChild(link);\n\t\tlink.click();\n\t\tdocument.body.removeChild(link);\n\t}\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/cluster_s3_servers.templ b/weed/admin/view/app/cluster_s3_servers.templ
index 2b464c535d..066629e725 100644
--- a/weed/admin/view/app/cluster_s3_servers.templ
+++ b/weed/admin/view/app/cluster_s3_servers.templ
@@ -8,12 +8,12 @@ import (
 templ ClusterS3Servers(data dash.ClusterS3ServersData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-cloud me-2"></i>S3 Servers
+			<i class="bi bi-cloud me-2"></i>S3 Servers
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-outline-primary" onclick="exportS3Servers()">
-					<i class="fas fa-download me-1"></i>Export
+					<i class="bi bi-download me-1"></i>Export
 				</button>
 			</div>
 		</div>
@@ -35,7 +35,7 @@ templ ClusterS3Servers(data dash.ClusterS3ServersData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-cloud fa-2x text-gray-300"></i>
+								<i class="bi bi-cloud icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -47,7 +47,7 @@ templ ClusterS3Servers(data dash.ClusterS3ServersData) {
 		<div class="card shadow mb-4">
 			<div class="card-header py-3">
 				<h6 class="m-0 font-weight-bold text-primary">
-					<i class="fas fa-cloud me-2"></i>S3 Servers
+					<i class="bi bi-cloud me-2"></i>S3 Servers
 				</h6>
 			</div>
 			<div class="card-body">
@@ -88,7 +88,7 @@ templ ClusterS3Servers(data dash.ClusterS3ServersData) {
 					</div>
 				} else {
 					<div class="text-center py-5">
-						<i class="fas fa-cloud fa-3x text-muted mb-3"></i>
+						<i class="bi bi-cloud icon-3x text-muted mb-3"></i>
 						<h5 class="text-muted">No S3 Servers Found</h5>
 						<p class="text-muted">No S3 servers are currently available in the cluster.</p>
 					</div>
@@ -100,7 +100,7 @@ templ ClusterS3Servers(data dash.ClusterS3ServersData) {
 		<div class="row">
 			<div class="col-12">
 				<small class="text-muted">
-					<i class="fas fa-clock me-1"></i>
+					<i class="bi bi-clock me-1"></i>
 					Last updated: { data.LastUpdated.Format("2006-01-02 15:04:05") }
 				</small>
 			</div>
diff --git a/weed/admin/view/app/cluster_s3_servers_templ.go b/weed/admin/view/app/cluster_s3_servers_templ.go
index 9fcf7ae078..1dd00e9ecf 100644
--- a/weed/admin/view/app/cluster_s3_servers_templ.go
+++ b/weed/admin/view/app/cluster_s3_servers_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func ClusterS3Servers(data dash.ClusterS3ServersData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-cloud me-2\"></i>S3 Servers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportS3Servers()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><div id=\"s3-servers-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total S3 Servers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-cloud me-2\"></i>S3 Servers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportS3Servers()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><div id=\"s3-servers-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total S3 Servers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ClusterS3Servers(data dash.ClusterS3ServersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-cloud fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- S3 Servers Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-cloud me-2\"></i>S3 Servers</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-cloud icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- S3 Servers Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-cloud me-2\"></i>S3 Servers</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -126,12 +126,12 @@ func ClusterS3Servers(data dash.ClusterS3ServersData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "<div class=\"text-center py-5\"><i class=\"fas fa-cloud fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No S3 Servers Found</h5><p class=\"text-muted\">No S3 servers are currently available in the cluster.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "<div class=\"text-center py-5\"><i class=\"bi bi-cloud icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No S3 Servers Found</h5><p class=\"text-muted\">No S3 servers are currently available in the cluster.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/cluster_volume_servers.templ b/weed/admin/view/app/cluster_volume_servers.templ
index aa1bc7516a..d0d1589abf 100644
--- a/weed/admin/view/app/cluster_volume_servers.templ
+++ b/weed/admin/view/app/cluster_volume_servers.templ
@@ -8,12 +8,12 @@ import (
 templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <h1 class="h2">
-            <i class="fas fa-server me-2"></i>Volume Servers
+            <i class="bi bi-server me-2"></i>Volume Servers
         </h1>
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="exportVolumeServers()">
-                    <i class="fas fa-download me-1"></i>Export
+                    <i class="bi bi-download me-1"></i>Export
                 </button>
             </div>
         </div>
@@ -35,7 +35,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-server fa-2x text-gray-300"></i>
+                                <i class="bi bi-server icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -57,7 +57,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-database fa-2x text-gray-300"></i>
+                                <i class="bi bi-database icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -77,7 +77,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-hdd fa-2x text-gray-300"></i>
+                                <i class="bi bi-device-hdd icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -89,7 +89,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
         <div class="card shadow mb-4">
             <div class="card-header py-3">
                 <h6 class="m-0 font-weight-bold text-primary">
-                    <i class="fas fa-server me-2"></i>Volume Servers
+                    <i class="bi bi-server me-2"></i>Volume Servers
                 </h6>
             </div>
             <div class="card-body">
@@ -116,12 +116,12 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                             if host.PublicURL != "" {
                                                 <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", host.PublicURL))} target="_blank" class="text-decoration-none">
                                                     {host.Address}
-                                                    <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                    <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                                 </a>
                                             } else {
                                                 <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", host.Address))} target="_blank" class="text-decoration-none">
                                                     {host.Address}
-                                                    <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                    <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                                 </a>
                                             }
                                         </td>
@@ -147,7 +147,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                         <td>
                                             if host.EcShards > 0 {
                                                 <div class="d-flex align-items-center">
-                                                    <i class="fas fa-layer-group me-1 text-info"></i>
+                                                    <i class="bi bi-layers me-1 text-info"></i>
                                                     <span class="badge bg-info text-white me-1">{fmt.Sprintf("%d", host.EcShards)}</span>
                                                     <small class="text-muted">shards</small>
                                                 </div>
@@ -164,12 +164,17 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                         <td>
                                             <div class="d-flex align-items-center">
                                                 <div class="progress me-2" style="width: 60px; height: 16px;">
-                                                    <div class="progress-bar" role="progressbar" 
+                                                    <div class="progress-bar" role="progressbar"
                                                          style={fmt.Sprintf("width: %d%%", calculatePercent(int(host.DiskUsage), int(host.DiskCapacity)))}>
                                                     </div>
                                                 </div>
                                                 <small>{formatBytes(host.DiskUsage)}</small>
                                             </div>
+                                            if host.RemoteSize > 0 {
+                                                <div class="mt-1">
+                                                    <small class="text-muted"><i class="bi bi-cloud me-1"></i>{formatBytes(host.RemoteSize)} remote</small>
+                                                </div>
+                                            }
                                         </td>
                                         <td>
                                             if host.PublicURL != "" {
@@ -186,10 +191,11 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                                         data-max-volumes={fmt.Sprintf("%d", host.MaxVolumes)}
                                                         data-disk-usage={fmt.Sprintf("%d", host.DiskUsage)}
                                                         data-disk-capacity={fmt.Sprintf("%d", host.DiskCapacity)}
+                                                        data-remote-size={fmt.Sprintf("%d", host.RemoteSize)}
                                                         data-ec-volumes={fmt.Sprintf("%d", host.EcVolumes)}
                                                         data-ec-shards={fmt.Sprintf("%d", host.EcShards)}
                                                         data-last-heartbeat={host.LastHeartbeat.Format("2006-01-02 15:04:05")}>
-                                                    <i class="fas fa-eye"></i>
+                                                    <i class="bi bi-eye"></i>
                                                 </button>
                                             } else {
                                                 <button type="button" 
@@ -205,10 +211,11 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                                                         data-max-volumes={fmt.Sprintf("%d", host.MaxVolumes)}
                                                         data-disk-usage={fmt.Sprintf("%d", host.DiskUsage)}
                                                         data-disk-capacity={fmt.Sprintf("%d", host.DiskCapacity)}
+                                                        data-remote-size={fmt.Sprintf("%d", host.RemoteSize)}
                                                         data-ec-volumes={fmt.Sprintf("%d", host.EcVolumes)}
                                                         data-ec-shards={fmt.Sprintf("%d", host.EcShards)}
                                                         data-last-heartbeat={host.LastHeartbeat.Format("2006-01-02 15:04:05")}>
-                                                    <i class="fas fa-eye"></i>
+                                                    <i class="bi bi-eye"></i>
                                                 </button>
                                             }
                                         </td>
@@ -219,7 +226,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                     </div>
                 } else {
                     <div class="text-center py-5">
-                        <i class="fas fa-server fa-3x text-muted mb-3"></i>
+                        <i class="bi bi-server icon-3x text-muted mb-3"></i>
                         <h5 class="text-muted">No Volume Servers Found</h5>
                         <p class="text-muted">No volume servers are currently available in the cluster.</p>
                     </div>
@@ -231,7 +238,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
         <div class="row">
             <div class="col-12">
                 <small class="text-muted">
-                    <i class="fas fa-clock me-1"></i>
+                    <i class="bi bi-clock me-1"></i>
                     Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
                 </small>
             </div>
@@ -260,6 +267,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
                         maxVolumes: parseInt(button.getAttribute('data-max-volumes')),
                         diskUsage: parseInt(button.getAttribute('data-disk-usage')),
                         diskCapacity: parseInt(button.getAttribute('data-disk-capacity')),
+                        remoteSize: parseInt(button.getAttribute('data-remote-size')) || 0,
                         ecVolumes: parseInt(button.getAttribute('data-ec-volumes')),
                         ecShards: parseInt(button.getAttribute('data-ec-shards')),
                         lastHeartbeat: button.getAttribute('data-last-heartbeat')
@@ -278,13 +286,13 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
             '<div class="modal-dialog modal-lg">' +
             '<div class="modal-content">' +
             '<div class="modal-header">' +
-            '<h5 class="modal-title"><i class="fas fa-server me-2"></i>Volume Server Details: ' + server.address + '</h5>' +
+            '<h5 class="modal-title"><i class="bi bi-server me-2"></i>Volume Server Details: ' + server.address + '</h5>' +
             '<button type="button" class="btn-close" data-bs-dismiss="modal"></button>' +
             '</div>' +
             '<div class="modal-body">' +
             '<div class="row">' +
             '<div class="col-md-6">' +
-            '<h6 class="text-primary"><i class="fas fa-info-circle me-1"></i>Basic Information</h6>' +
+            '<h6 class="text-primary"><i class="bi bi-info-circle me-1"></i>Basic Information</h6>' +
             '<table class="table table-sm">' +
             '<tr><td><strong>Server ID:</strong></td><td><code>' + server.id + '</code></td></tr>' +
             '<tr><td><strong>Address:</strong></td><td>' + server.address + '</td></tr>' +
@@ -295,7 +303,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
             '</table>' +
             '</div>' +
             '<div class="col-md-6">' +
-            '<h6 class="text-primary"><i class="fas fa-chart-bar me-1"></i>Usage Statistics</h6>' +
+            '<h6 class="text-primary"><i class="bi bi-bar-chart me-1"></i>Usage Statistics</h6>' +
             '<table class="table table-sm">' +
             '<tr><td><strong>Volumes:</strong></td><td>' +
             '<div class="d-flex align-items-center">' +
@@ -314,6 +322,8 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
             '</div>' +
             '</td></tr>' +
             '<tr><td><strong>Available Space:</strong></td><td>' + formatBytes(server.diskCapacity - server.diskUsage) + '</td></tr>' +
+            (server.remoteSize > 0 ?
+            '<tr><td><strong>Remote Data:</strong></td><td><i class="bi bi-cloud me-1"></i>' + formatBytes(server.remoteSize) + '</td></tr>' : '') +
             '</table>' +
             '</div>' +
             '</div>' +
@@ -322,7 +332,7 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
             (server.ecShards > 0 ? 
             '<div class="row mt-3">' +
             '<div class="col-12">' +
-            '<h6 class="text-primary"><i class="fas fa-layer-group me-1"></i>Erasure Coding Information</h6>' +
+            '<h6 class="text-primary"><i class="bi bi-layers me-1"></i>Erasure Coding Information</h6>' +
             '<table class="table table-sm">' +
             '<tr><td><strong>EC Volumes:</strong></td><td><span class="badge bg-info text-white">' + server.ecVolumes + '</span></td></tr>' +
             '<tr><td><strong>EC Shards:</strong></td><td><span class="badge bg-info text-white">' + server.ecShards + '</span></td></tr>' +
@@ -332,13 +342,13 @@ templ ClusterVolumeServers(data dash.ClusterVolumeServersData) {
             
             '<div class="row mt-3">' +
             '<div class="col-12">' +
-            '<h6 class="text-primary"><i class="fas fa-link me-1"></i>Quick Actions</h6>' +
+            '<h6 class="text-primary"><i class="bi bi-link me-1"></i>Quick Actions</h6>' +
             '<div class="d-grid gap-2 d-md-flex">' +
             '<a href="//' + (server.publicUrl || server.address) + '/ui/index.html" target="_blank" class="btn btn-outline-primary">' +
-            '<i class="fas fa-external-link-alt me-1"></i>Open Volume Server UI' +
+            '<i class="bi bi-box-arrow-up-right me-1"></i>Open Volume Server UI' +
             '</a>' +
             '<a href="' + (window.__BASE_PATH__ || '') + '/storage/volumes?server=' + encodeURIComponent(server.address) + '" class="btn btn-outline-info">' +
-            '<i class="fas fa-database me-1"></i>View Volumes' +
+            '<i class="bi bi-database me-1"></i>View Volumes' +
             '</a>' +
             '</div>' +
             '</div>' +
diff --git a/weed/admin/view/app/cluster_volume_servers_templ.go b/weed/admin/view/app/cluster_volume_servers_templ.go
index b1b93111ff..b6bbca477d 100644
--- a/weed/admin/view/app/cluster_volume_servers_templ.go
+++ b/weed/admin/view/app/cluster_volume_servers_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-server me-2\"></i>Volume Servers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportVolumeServers()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><div id=\"hosts-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Volume Servers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-server me-2\"></i>Volume Servers</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportVolumeServers()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><div id=\"hosts-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Volume Servers</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-server fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Total Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-server icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Total Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +60,7 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-database fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Total Capacity</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-database icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Total Capacity</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -73,7 +73,7 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"fas fa-hdd fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Hosts Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-server me-2\"></i>Volume Servers</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"bi bi-device-hdd icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Hosts Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-server me-2\"></i>Volume Servers</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -114,7 +114,7 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -145,7 +145,7 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -220,7 +220,7 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				if host.EcShards > 0 {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<div class=\"d-flex align-items-center\"><i class=\"fas fa-layer-group me-1 text-info\"></i> <span class=\"badge bg-info text-white me-1\">")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<div class=\"d-flex align-items-center\"><i class=\"bi bi-layers me-1 text-info\"></i> <span class=\"badge bg-info text-white me-1\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -301,362 +301,411 @@ func ClusterVolumeServers(data dash.ClusterVolumeServersData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</small></div></td><td>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</small></div>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				if host.PublicURL != "" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" title=\"View Details\" data-action=\"view-details\" data-id=\"")
+				if host.RemoteSize > 0 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<div class=\"mt-1\"><small class=\"text-muted\"><i class=\"bi bi-cloud me-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var19 string
-					templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(host.ID)
+					templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(host.RemoteSize))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 180, Col: 72}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 175, Col: 139}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\" data-address=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, " remote</small></div>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if host.PublicURL != "" {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" title=\"View Details\" data-action=\"view-details\" data-id=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var20 string
-					templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(host.Address)
+					templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.ID)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 181, Col: 82}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 185, Col: 72}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\" data-public-url=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "\" data-address=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var21 string
-					templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(host.PublicURL)
+					templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.Address)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 182, Col: 87}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 186, Col: 82}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\" data-datacenter=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "\" data-public-url=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var22 string
-					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(host.DataCenter)
+					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.PublicURL)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 183, Col: 88}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 187, Col: 87}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "\" data-rack=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\" data-datacenter=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var23 string
-					templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(host.Rack)
+					templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.DataCenter)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 184, Col: 76}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 188, Col: 88}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "\" data-volumes=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "\" data-rack=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var24 string
-					templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.Volumes))
+					templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.Rack)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 185, Col: 101}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 189, Col: 76}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\" data-max-volumes=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "\" data-volumes=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var25 string
-					templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.MaxVolumes))
+					templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.Volumes))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 186, Col: 108}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 190, Col: 101}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var25)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "\" data-disk-usage=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\" data-max-volumes=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var26 string
-					templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.DiskUsage))
+					templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.MaxVolumes))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 187, Col: 106}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 191, Col: 108}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "\" data-disk-capacity=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "\" data-disk-usage=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var27 string
-					templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.DiskCapacity))
+					templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.DiskUsage))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 188, Col: 112}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 192, Col: 106}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\" data-ec-volumes=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "\" data-disk-capacity=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var28 string
-					templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.EcVolumes))
+					templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.DiskCapacity))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 189, Col: 106}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 193, Col: 112}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "\" data-ec-shards=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "\" data-remote-size=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var29 string
-					templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.EcShards))
+					templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.RemoteSize))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 190, Col: 104}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 194, Col: 108}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "\" data-last-heartbeat=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "\" data-ec-volumes=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var30 string
-					templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(host.LastHeartbeat.Format("2006-01-02 15:04:05"))
+					templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.EcVolumes))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 191, Col: 125}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 195, Col: 106}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var30)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "\"><i class=\"fas fa-eye\"></i></button>")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" title=\"View Details\" data-action=\"view-details\" data-id=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "\" data-ec-shards=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var31 string
-					templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(host.ID)
+					templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.EcShards))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 199, Col: 72}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 196, Col: 104}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var31)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "\" data-address=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\" data-last-heartbeat=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var32 string
-					templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(host.Address)
+					templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.LastHeartbeat.Format("2006-01-02 15:04:05"))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 200, Col: 82}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 197, Col: 125}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var32)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\" data-public-url=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "\"><i class=\"bi bi-eye\"></i></button>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" title=\"View Details\" data-action=\"view-details\" data-id=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var33 string
-					templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(host.Address)
+					templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.ID)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 201, Col: 85}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 205, Col: 72}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var33)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "\" data-datacenter=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "\" data-address=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var34 string
-					templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(host.DataCenter)
+					templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.Address)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 202, Col: 88}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 206, Col: 82}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var34)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "\" data-rack=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "\" data-public-url=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var35 string
-					templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(host.Rack)
+					templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.Address)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 203, Col: 76}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 207, Col: 85}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var35)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "\" data-volumes=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "\" data-datacenter=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var36 string
-					templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.Volumes))
+					templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.DataCenter)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 204, Col: 101}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 208, Col: 88}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var36)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "\" data-max-volumes=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "\" data-rack=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var37 string
-					templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.MaxVolumes))
+					templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.Rack)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 205, Col: 108}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 209, Col: 76}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var37)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "\" data-disk-usage=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "\" data-volumes=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var38 string
-					templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.DiskUsage))
+					templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.Volumes))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 206, Col: 106}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 210, Col: 101}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var38)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "\" data-disk-capacity=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "\" data-max-volumes=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var39 string
-					templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.DiskCapacity))
+					templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.MaxVolumes))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 207, Col: 112}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 211, Col: 108}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var39)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "\" data-ec-volumes=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "\" data-disk-usage=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var40 string
-					templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.EcVolumes))
+					templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.DiskUsage))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 208, Col: 106}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 212, Col: 106}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var40)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "\" data-ec-shards=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "\" data-disk-capacity=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var41 string
-					templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", host.EcShards))
+					templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.DiskCapacity))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 209, Col: 104}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 213, Col: 112}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var41)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "\" data-last-heartbeat=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "\" data-remote-size=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var42 string
-					templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(host.LastHeartbeat.Format("2006-01-02 15:04:05"))
+					templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.RemoteSize))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 210, Col: 125}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 214, Col: 108}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var42)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "\"><i class=\"fas fa-eye\"></i></button>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "\" data-ec-volumes=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var43 string
+					templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.EcVolumes))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 215, Col: 106}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var43)
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "\" data-ec-shards=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var44 string
+					templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", host.EcShards))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 216, Col: 104}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var44)
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "\" data-last-heartbeat=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var45 string
+					templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.ResolveAttributeValue(host.LastHeartbeat.Format("2006-01-02 15:04:05"))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 217, Col: 125}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var45)
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "\"><i class=\"bi bi-eye\"></i></button>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "</td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "</td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</tbody></table></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "</tbody></table></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "<div class=\"text-center py-5\"><i class=\"fas fa-server fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Volume Servers Found</h5><p class=\"text-muted\">No volume servers are currently available in the cluster.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<div class=\"text-center py-5\"><i class=\"bi bi-server icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Volume Servers Found</h5><p class=\"text-muted\">No volume servers are currently available in the cluster.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var43 string
-		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
+		var templ_7745c5c3_Var46 string
+		templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 235, Col: 81}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volume_servers.templ`, Line: 242, Col: 81}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "</small></div></div></div><!-- JavaScript for cluster volume servers functionality --><script>\n    document.addEventListener('DOMContentLoaded', function() {\n        // Handle volume server action buttons\n        document.addEventListener('click', function(e) {\n            const button = e.target.closest('[data-action]');\n            if (!button) return;\n            \n            const action = button.getAttribute('data-action');\n            \n            switch(action) {\n                case 'view-details':\n                    const serverData = {\n                        id: button.getAttribute('data-id'),\n                        address: button.getAttribute('data-address'),\n                        publicUrl: button.getAttribute('data-public-url'),\n                        datacenter: button.getAttribute('data-datacenter'),\n                        rack: button.getAttribute('data-rack'),\n                        volumes: parseInt(button.getAttribute('data-volumes')),\n                        maxVolumes: parseInt(button.getAttribute('data-max-volumes')),\n                        diskUsage: parseInt(button.getAttribute('data-disk-usage')),\n                        diskCapacity: parseInt(button.getAttribute('data-disk-capacity')),\n                        ecVolumes: parseInt(button.getAttribute('data-ec-volumes')),\n                        ecShards: parseInt(button.getAttribute('data-ec-shards')),\n                        lastHeartbeat: button.getAttribute('data-last-heartbeat')\n                    };\n                    showVolumeServerDetails(serverData);\n                    break;\n            }\n        });\n    });\n    \n    function showVolumeServerDetails(server) {\n        const volumePercent = server.maxVolumes > 0 ? Math.round((server.volumes / server.maxVolumes) * 100) : 0;\n        const diskPercent = server.diskCapacity > 0 ? Math.round((server.diskUsage / server.diskCapacity) * 100) : 0;\n        \n        const modalHtml = '<div class=\"modal fade\" id=\"volumeServerDetailsModal\" tabindex=\"-1\">' +\n            '<div class=\"modal-dialog modal-lg\">' +\n            '<div class=\"modal-content\">' +\n            '<div class=\"modal-header\">' +\n            '<h5 class=\"modal-title\"><i class=\"fas fa-server me-2\"></i>Volume Server Details: ' + server.address + '</h5>' +\n            '<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n            '</div>' +\n            '<div class=\"modal-body\">' +\n            '<div class=\"row\">' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"fas fa-info-circle me-1\"></i>Basic Information</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Server ID:</strong></td><td><code>' + server.id + '</code></td></tr>' +\n            '<tr><td><strong>Address:</strong></td><td>' + server.address + '</td></tr>' +\n            '<tr><td><strong>Public URL:</strong></td><td>' + server.publicUrl + '</td></tr>' +\n            '<tr><td><strong>Data Center:</strong></td><td><span class=\"badge bg-light text-dark\">' + server.datacenter + '</span></td></tr>' +\n            '<tr><td><strong>Rack:</strong></td><td><span class=\"badge bg-light text-dark\">' + server.rack + '</span></td></tr>' +\n            '<tr><td><strong>Last Heartbeat:</strong></td><td>' + server.lastHeartbeat + '</td></tr>' +\n            '</table>' +\n            '</div>' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"fas fa-chart-bar me-1\"></i>Usage Statistics</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Volumes:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<div class=\"progress me-2\" style=\"width: 100px; height: 20px;\">' +\n            '<div class=\"progress-bar\" role=\"progressbar\" style=\"width: ' + volumePercent + '%\"></div>' +\n            '</div>' +\n            '<span>' + server.volumes + '/' + server.maxVolumes + ' (' + volumePercent + '%)</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Disk Usage:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<div class=\"progress me-2\" style=\"width: 100px; height: 20px;\">' +\n            '<div class=\"progress-bar\" role=\"progressbar\" style=\"width: ' + diskPercent + '%\"></div>' +\n            '</div>' +\n            '<span>' + formatBytes(server.diskUsage) + '/' + formatBytes(server.diskCapacity) + ' (' + diskPercent + '%)</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Available Space:</strong></td><td>' + formatBytes(server.diskCapacity - server.diskUsage) + '</td></tr>' +\n            '</table>' +\n            '</div>' +\n            '</div>' +\n            \n            // Add EC Shard information if available\n            (server.ecShards > 0 ? \n            '<div class=\"row mt-3\">' +\n            '<div class=\"col-12\">' +\n            '<h6 class=\"text-primary\"><i class=\"fas fa-layer-group me-1\"></i>Erasure Coding Information</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>EC Volumes:</strong></td><td><span class=\"badge bg-info text-white\">' + server.ecVolumes + '</span></td></tr>' +\n            '<tr><td><strong>EC Shards:</strong></td><td><span class=\"badge bg-info text-white\">' + server.ecShards + '</span></td></tr>' +\n            '</table>' +\n            '</div>' +\n            '</div>' : '') +\n            \n            '<div class=\"row mt-3\">' +\n            '<div class=\"col-12\">' +\n            '<h6 class=\"text-primary\"><i class=\"fas fa-link me-1\"></i>Quick Actions</h6>' +\n            '<div class=\"d-grid gap-2 d-md-flex\">' +\n            '<a href=\"//' + (server.publicUrl || server.address) + '/ui/index.html\" target=\"_blank\" class=\"btn btn-outline-primary\">' +\n            '<i class=\"fas fa-external-link-alt me-1\"></i>Open Volume Server UI' +\n            '</a>' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/storage/volumes?server=' + encodeURIComponent(server.address) + '\" class=\"btn btn-outline-info\">' +\n            '<i class=\"fas fa-database me-1\"></i>View Volumes' +\n            '</a>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '<div class=\"modal-footer\">' +\n            '<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>';\n        \n        // Remove existing modal if present\n        const existingModal = document.getElementById('volumeServerDetailsModal');\n        if (existingModal) {\n            existingModal.remove();\n        }\n        \n        // Add modal to body and show\n        document.body.insertAdjacentHTML('beforeend', modalHtml);\n        const modal = new bootstrap.Modal(document.getElementById('volumeServerDetailsModal'));\n        modal.show();\n        \n        // Remove modal when hidden\n        document.getElementById('volumeServerDetailsModal').addEventListener('hidden.bs.modal', function() {\n            this.remove();\n        });\n    }\n    \n    function formatBytes(bytes) {\n        if (bytes === 0) return '0 Bytes';\n        const k = 1024;\n        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n        const i = Math.floor(Math.log(bytes) / Math.log(k));\n        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n    }\n    \n    function exportVolumeServers() {\n        // Simple CSV export of volume servers list\n        const rows = Array.from(document.querySelectorAll('#hostsTable tbody tr')).map(row => {\n            const cells = row.querySelectorAll('td');\n            if (cells.length > 1) {\n                return {\n                    id: cells[0].textContent.trim(),\n                    address: cells[1].textContent.trim(),\n                    datacenter: cells[2].textContent.trim(),\n                    rack: cells[3].textContent.trim(),\n                    volumes: cells[4].textContent.trim(),\n                    capacity: cells[5].textContent.trim(),\n                    usage: cells[6].textContent.trim()\n                };\n            }\n            return null;\n        }).filter(row => row !== null);\n        \n        const csvContent = \"data:text/csv;charset=utf-8,\" + \n            \"Server ID,Address,Data Center,Rack,Volumes,Capacity,Usage\\n\" +\n            rows.map(r => '\"' + r.id + '\",\"' + r.address + '\",\"' + r.datacenter + '\",\"' + r.rack + '\",\"' + r.volumes + '\",\"' + r.capacity + '\",\"' + r.usage + '\"').join(\"\\n\");\n        \n        const encodedUri = encodeURI(csvContent);\n        const link = document.createElement(\"a\");\n        link.setAttribute(\"href\", encodedUri);\n        link.setAttribute(\"download\", \"volume_servers.csv\");\n        document.body.appendChild(link);\n        link.click();\n        document.body.removeChild(link);\n    }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "</small></div></div></div><!-- JavaScript for cluster volume servers functionality --><script>\n    document.addEventListener('DOMContentLoaded', function() {\n        // Handle volume server action buttons\n        document.addEventListener('click', function(e) {\n            const button = e.target.closest('[data-action]');\n            if (!button) return;\n            \n            const action = button.getAttribute('data-action');\n            \n            switch(action) {\n                case 'view-details':\n                    const serverData = {\n                        id: button.getAttribute('data-id'),\n                        address: button.getAttribute('data-address'),\n                        publicUrl: button.getAttribute('data-public-url'),\n                        datacenter: button.getAttribute('data-datacenter'),\n                        rack: button.getAttribute('data-rack'),\n                        volumes: parseInt(button.getAttribute('data-volumes')),\n                        maxVolumes: parseInt(button.getAttribute('data-max-volumes')),\n                        diskUsage: parseInt(button.getAttribute('data-disk-usage')),\n                        diskCapacity: parseInt(button.getAttribute('data-disk-capacity')),\n                        remoteSize: parseInt(button.getAttribute('data-remote-size')) || 0,\n                        ecVolumes: parseInt(button.getAttribute('data-ec-volumes')),\n                        ecShards: parseInt(button.getAttribute('data-ec-shards')),\n                        lastHeartbeat: button.getAttribute('data-last-heartbeat')\n                    };\n                    showVolumeServerDetails(serverData);\n                    break;\n            }\n        });\n    });\n    \n    function showVolumeServerDetails(server) {\n        const volumePercent = server.maxVolumes > 0 ? Math.round((server.volumes / server.maxVolumes) * 100) : 0;\n        const diskPercent = server.diskCapacity > 0 ? Math.round((server.diskUsage / server.diskCapacity) * 100) : 0;\n        \n        const modalHtml = '<div class=\"modal fade\" id=\"volumeServerDetailsModal\" tabindex=\"-1\">' +\n            '<div class=\"modal-dialog modal-lg\">' +\n            '<div class=\"modal-content\">' +\n            '<div class=\"modal-header\">' +\n            '<h5 class=\"modal-title\"><i class=\"bi bi-server me-2\"></i>Volume Server Details: ' + server.address + '</h5>' +\n            '<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n            '</div>' +\n            '<div class=\"modal-body\">' +\n            '<div class=\"row\">' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"bi bi-info-circle me-1\"></i>Basic Information</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Server ID:</strong></td><td><code>' + server.id + '</code></td></tr>' +\n            '<tr><td><strong>Address:</strong></td><td>' + server.address + '</td></tr>' +\n            '<tr><td><strong>Public URL:</strong></td><td>' + server.publicUrl + '</td></tr>' +\n            '<tr><td><strong>Data Center:</strong></td><td><span class=\"badge bg-light text-dark\">' + server.datacenter + '</span></td></tr>' +\n            '<tr><td><strong>Rack:</strong></td><td><span class=\"badge bg-light text-dark\">' + server.rack + '</span></td></tr>' +\n            '<tr><td><strong>Last Heartbeat:</strong></td><td>' + server.lastHeartbeat + '</td></tr>' +\n            '</table>' +\n            '</div>' +\n            '<div class=\"col-md-6\">' +\n            '<h6 class=\"text-primary\"><i class=\"bi bi-bar-chart me-1\"></i>Usage Statistics</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>Volumes:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<div class=\"progress me-2\" style=\"width: 100px; height: 20px;\">' +\n            '<div class=\"progress-bar\" role=\"progressbar\" style=\"width: ' + volumePercent + '%\"></div>' +\n            '</div>' +\n            '<span>' + server.volumes + '/' + server.maxVolumes + ' (' + volumePercent + '%)</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Disk Usage:</strong></td><td>' +\n            '<div class=\"d-flex align-items-center\">' +\n            '<div class=\"progress me-2\" style=\"width: 100px; height: 20px;\">' +\n            '<div class=\"progress-bar\" role=\"progressbar\" style=\"width: ' + diskPercent + '%\"></div>' +\n            '</div>' +\n            '<span>' + formatBytes(server.diskUsage) + '/' + formatBytes(server.diskCapacity) + ' (' + diskPercent + '%)</span>' +\n            '</div>' +\n            '</td></tr>' +\n            '<tr><td><strong>Available Space:</strong></td><td>' + formatBytes(server.diskCapacity - server.diskUsage) + '</td></tr>' +\n            (server.remoteSize > 0 ?\n            '<tr><td><strong>Remote Data:</strong></td><td><i class=\"bi bi-cloud me-1\"></i>' + formatBytes(server.remoteSize) + '</td></tr>' : '') +\n            '</table>' +\n            '</div>' +\n            '</div>' +\n            \n            // Add EC Shard information if available\n            (server.ecShards > 0 ? \n            '<div class=\"row mt-3\">' +\n            '<div class=\"col-12\">' +\n            '<h6 class=\"text-primary\"><i class=\"bi bi-layers me-1\"></i>Erasure Coding Information</h6>' +\n            '<table class=\"table table-sm\">' +\n            '<tr><td><strong>EC Volumes:</strong></td><td><span class=\"badge bg-info text-white\">' + server.ecVolumes + '</span></td></tr>' +\n            '<tr><td><strong>EC Shards:</strong></td><td><span class=\"badge bg-info text-white\">' + server.ecShards + '</span></td></tr>' +\n            '</table>' +\n            '</div>' +\n            '</div>' : '') +\n            \n            '<div class=\"row mt-3\">' +\n            '<div class=\"col-12\">' +\n            '<h6 class=\"text-primary\"><i class=\"bi bi-link me-1\"></i>Quick Actions</h6>' +\n            '<div class=\"d-grid gap-2 d-md-flex\">' +\n            '<a href=\"//' + (server.publicUrl || server.address) + '/ui/index.html\" target=\"_blank\" class=\"btn btn-outline-primary\">' +\n            '<i class=\"bi bi-box-arrow-up-right me-1\"></i>Open Volume Server UI' +\n            '</a>' +\n            '<a href=\"' + (window.__BASE_PATH__ || '') + '/storage/volumes?server=' + encodeURIComponent(server.address) + '\" class=\"btn btn-outline-info\">' +\n            '<i class=\"bi bi-database me-1\"></i>View Volumes' +\n            '</a>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '<div class=\"modal-footer\">' +\n            '<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n            '</div>' +\n            '</div>' +\n            '</div>' +\n            '</div>';\n        \n        // Remove existing modal if present\n        const existingModal = document.getElementById('volumeServerDetailsModal');\n        if (existingModal) {\n            existingModal.remove();\n        }\n        \n        // Add modal to body and show\n        document.body.insertAdjacentHTML('beforeend', modalHtml);\n        const modal = new bootstrap.Modal(document.getElementById('volumeServerDetailsModal'));\n        modal.show();\n        \n        // Remove modal when hidden\n        document.getElementById('volumeServerDetailsModal').addEventListener('hidden.bs.modal', function() {\n            this.remove();\n        });\n    }\n    \n    function formatBytes(bytes) {\n        if (bytes === 0) return '0 Bytes';\n        const k = 1024;\n        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n        const i = Math.floor(Math.log(bytes) / Math.log(k));\n        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n    }\n    \n    function exportVolumeServers() {\n        // Simple CSV export of volume servers list\n        const rows = Array.from(document.querySelectorAll('#hostsTable tbody tr')).map(row => {\n            const cells = row.querySelectorAll('td');\n            if (cells.length > 1) {\n                return {\n                    id: cells[0].textContent.trim(),\n                    address: cells[1].textContent.trim(),\n                    datacenter: cells[2].textContent.trim(),\n                    rack: cells[3].textContent.trim(),\n                    volumes: cells[4].textContent.trim(),\n                    capacity: cells[5].textContent.trim(),\n                    usage: cells[6].textContent.trim()\n                };\n            }\n            return null;\n        }).filter(row => row !== null);\n        \n        const csvContent = \"data:text/csv;charset=utf-8,\" + \n            \"Server ID,Address,Data Center,Rack,Volumes,Capacity,Usage\\n\" +\n            rows.map(r => '\"' + r.id + '\",\"' + r.address + '\",\"' + r.datacenter + '\",\"' + r.rack + '\",\"' + r.volumes + '\",\"' + r.capacity + '\",\"' + r.usage + '\"').join(\"\\n\");\n        \n        const encodedUri = encodeURI(csvContent);\n        const link = document.createElement(\"a\");\n        link.setAttribute(\"href\", encodedUri);\n        link.setAttribute(\"download\", \"volume_servers.csv\");\n        document.body.appendChild(link);\n        link.click();\n        document.body.removeChild(link);\n    }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/cluster_volumes.templ b/weed/admin/view/app/cluster_volumes.templ
index fb4a0bba66..ea3526b003 100644
--- a/weed/admin/view/app/cluster_volumes.templ
+++ b/weed/admin/view/app/cluster_volumes.templ
@@ -10,15 +10,15 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <div>
             <h1 class="h2">
-                <i class="fas fa-database me-2"></i>Cluster Volumes
+                <i class="bi bi-database me-2"></i>Cluster Volumes
             </h1>
             if data.FilterCollection != "" {
                 <div class="d-flex align-items-center mt-2">
                     <span class="badge bg-info me-2">
-                        <i class="fas fa-filter me-1"></i>Collection: {data.FilterCollection}
+                        <i class="bi bi-funnel me-1"></i>Collection: {data.FilterCollection}
                     </span>
                     <a href={ dash.PUrl(ctx, "/storage/volumes") } class="btn btn-sm btn-outline-secondary">
-                        <i class="fas fa-times me-1"></i>Clear Filter
+                        <i class="bi bi-x me-1"></i>Clear Filter
                     </a>
                 </div>
             }
@@ -32,10 +32,10 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                     <option value="500" if data.PageSize == 500 { selected="selected" }>500 per page</option>
                 </select>
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="exportVolumes()">
-                    <i class="fas fa-download me-1"></i>Export Page
+                    <i class="bi bi-download me-1"></i>Export Page
                 </button>
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="exportVolumeList()" title="Download the full cluster volume list as JSON">
-                    <i class="fas fa-file-export me-1"></i>Export All (JSON)
+                    <i class="bi bi-file-earmark-arrow-up me-1"></i>Export All (JSON)
                 </button>
             </div>
         </div>
@@ -57,7 +57,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-database fa-2x text-gray-300"></i>
+                                <i class="bi bi-database icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -85,7 +85,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-layer-group fa-2x text-gray-300"></i>
+                                <i class="bi bi-layers icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -113,7 +113,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-building fa-2x text-gray-300"></i>
+                                <i class="bi bi-building icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -141,7 +141,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-server fa-2x text-gray-300"></i>
+                                <i class="bi bi-server icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -169,7 +169,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-hdd fa-2x text-gray-300"></i>
+                                <i class="bi bi-device-hdd icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -197,7 +197,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-code-branch fa-2x text-gray-300"></i>
+                                <i class="bi bi-diagram-3 icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -217,7 +217,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-chart-area fa-2x text-gray-300"></i>
+                                <i class="bi bi-graph-up icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -229,7 +229,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
         <div class="card shadow mb-4">
             <div class="card-header py-3">
                 <h6 class="m-0 font-weight-bold text-primary">
-                    <i class="fas fa-database me-2"></i>Volume Details
+                    <i class="bi bi-database me-2"></i>Volume Details
                 </h6>
             </div>
             <div class="card-body">
@@ -325,7 +325,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                         <td>
                                             <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", volume.Server))} target="_blank" class="text-decoration-none">
                                                 {volume.Server}
-                                                <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                             </a>
                                         </td>
                                         if data.ShowDataCenterColumn {
@@ -400,7 +400,12 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                         </td>
                                         if data.ShowDiskTypeColumn {
                                             <td>
-                                                <span class="badge bg-primary">{volume.DiskType}</span>
+                                                <span class="badge bg-primary">{displayDiskType(volume.DiskType)}</span>
+                                                if volume.RemoteStorageName != "" {
+                                                    <span class="badge bg-info text-white ms-1" title={volume.RemoteStorageKey}>
+                                                        <i class="bi bi-cloud me-1"></i>{volume.RemoteStorageName}
+                                                    </span>
+                                                }
                                             </td>
                                         }
                                         if data.ShowVersionColumn {
@@ -412,13 +417,13 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                             <div class="btn-group btn-group-sm">
                                                 <button type="button" class="btn btn-outline-primary btn-sm view-details-btn" 
                                                         title="View Details" data-volume-id={fmt.Sprintf("%d", volume.Id)}>
-                                                    <i class="fas fa-eye"></i>
+                                                    <i class="bi bi-eye"></i>
                                                 </button>
                                                 <button type="button" class="btn btn-outline-secondary btn-sm vacuum-btn" 
                                                         title="Vacuum"
                                                         data-volume-id={fmt.Sprintf("%d", volume.Id)}
                                                         data-server={volume.Server}>
-                                                    <i class="fas fa-compress-alt"></i>
+                                                    <i class="bi bi-arrows-angle-contract"></i>
                                                 </button>
                                             </div>
                                         </td>
@@ -453,13 +458,13 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                     if data.CurrentPage > 1 {
                                         <li class="page-item">
                                             <a class="page-link pagination-link" href="#" data-page={fmt.Sprintf("%d", data.CurrentPage-1)}>
-                                                <i class="fas fa-chevron-left"></i>
+                                                <i class="bi bi-chevron-left"></i>
                                             </a>
                                         </li>
                                     } else {
                                         <li class="page-item disabled">
                                             <span class="page-link">
-                                                <i class="fas fa-chevron-left"></i>
+                                                <i class="bi bi-chevron-left"></i>
                                             </span>
                                         </li>
                                     }
@@ -481,13 +486,13 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                                     if data.CurrentPage < data.TotalPages {
                                         <li class="page-item">
                                             <a class="page-link pagination-link" href="#" data-page={fmt.Sprintf("%d", data.CurrentPage+1)}>
-                                                <i class="fas fa-chevron-right"></i>
+                                                <i class="bi bi-chevron-right"></i>
                                             </a>
                                         </li>
                                     } else {
                                         <li class="page-item disabled">
                                             <span class="page-link">
-                                                <i class="fas fa-chevron-right"></i>
+                                                <i class="bi bi-chevron-right"></i>
                                             </span>
                                         </li>
                                     }
@@ -497,7 +502,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
                     }
                 } else {
                     <div class="text-center py-5">
-                        <i class="fas fa-database fa-3x text-muted mb-3"></i>
+                        <i class="bi bi-database icon-3x text-muted mb-3"></i>
                         <h5 class="text-muted">No Volumes Found</h5>
                         <p class="text-muted">No volumes are currently available in the cluster.</p>
                     </div>
@@ -509,7 +514,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
         <div class="row">
             <div class="col-12">
                 <small class="text-muted">
-                    <i class="fas fa-clock me-1"></i>
+                    <i class="bi bi-clock me-1"></i>
                     Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
                 </small>
             </div>
@@ -602,7 +607,7 @@ templ ClusterVolumes(data dash.ClusterVolumesData) {
             // Disable button and show loading state
             const originalHTML = button.innerHTML;
             button.disabled = true;
-            button.innerHTML = '<i class="fas fa-spinner fa-spin"></i>';
+            button.innerHTML = '<i class="bi bi-arrow-repeat icon-spin"></i>';
 
             // Send vacuum request
             fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/vacuum`, {
@@ -683,14 +688,18 @@ func countUniqueRacks(volumes []dash.VolumeWithTopology) int {
     return len(rackMap)
 }
 
+// displayDiskType maps the empty disk type to its display name.
+func displayDiskType(diskType string) string {
+    if diskType == "" {
+        return "hdd"
+    }
+    return diskType
+}
+
 func countUniqueDiskTypes(volumes []dash.VolumeWithTopology) int {
     diskTypeMap := make(map[string]bool)
     for _, volume := range volumes {
-        diskType := volume.DiskType
-        if diskType == "" {
-            diskType = "hdd"
-        }
-        diskTypeMap[diskType] = true
+        diskTypeMap[displayDiskType(volume.DiskType)] = true
     }
     return len(diskTypeMap)
 }
@@ -699,11 +708,11 @@ func countUniqueDiskTypes(volumes []dash.VolumeWithTopology) int {
 
 templ getSortIcon(column, currentSort, currentOrder string) {
     if column != currentSort {
-        <i class="fas fa-sort text-muted ms-1"></i>
+        <i class="bi bi-arrow-down-up text-muted ms-1"></i>
     } else if currentOrder == "asc" {
-        <i class="fas fa-sort-up text-primary ms-1"></i>
+        <i class="bi bi-sort-up text-primary ms-1"></i>
     } else {
-        <i class="fas fa-sort-down text-primary ms-1"></i>
+        <i class="bi bi-sort-down text-primary ms-1"></i>
     }
 }
 
diff --git a/weed/admin/view/app/cluster_volumes_templ.go b/weed/admin/view/app/cluster_volumes_templ.go
index 806fe6ba04..ee4a80606d 100644
--- a/weed/admin/view/app/cluster_volumes_templ.go
+++ b/weed/admin/view/app/cluster_volumes_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -35,19 +35,19 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"fas fa-database me-2\"></i>Cluster Volumes</h1>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"bi bi-database me-2\"></i>Cluster Volumes</h1>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.FilterCollection != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<div class=\"d-flex align-items-center mt-2\"><span class=\"badge bg-info me-2\"><i class=\"fas fa-filter me-1\"></i>Collection: ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<div class=\"d-flex align-items-center mt-2\"><span class=\"badge bg-info me-2\"><i class=\"bi bi-funnel me-1\"></i>Collection: ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var2 string
 			templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(data.FilterCollection)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 18, Col: 92}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 18, Col: 91}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
 			if templ_7745c5c3_Err != nil {
@@ -66,7 +66,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-times me-1\"></i>Clear Filter</a></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-x me-1\"></i>Clear Filter</a></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -111,7 +111,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, ">500 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportVolumes()\"><i class=\"fas fa-download me-1\"></i>Export Page</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportVolumeList()\" title=\"Download the full cluster volume list as JSON\"><i class=\"fas fa-file-export me-1\"></i>Export All (JSON)</button></div></div></div><div id=\"volumes-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, ">500 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportVolumes()\"><i class=\"bi bi-download me-1\"></i>Export Page</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportVolumeList()\" title=\"Download the full cluster volume list as JSON\"><i class=\"bi bi-file-earmark-arrow-up me-1\"></i>Export All (JSON)</button></div></div></div><div id=\"volumes-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Volumes</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -124,7 +124,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "</div></div><div class=\"col-auto\"><i class=\"fas fa-database fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "</div></div><div class=\"col-auto\"><i class=\"bi bi-database icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -164,7 +164,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</div></div><div class=\"col-auto\"><i class=\"fas fa-layer-group fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</div></div><div class=\"col-auto\"><i class=\"bi bi-layers icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -204,7 +204,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</div></div><div class=\"col-auto\"><i class=\"fas fa-building fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-secondary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-secondary text-uppercase mb-1\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</div></div><div class=\"col-auto\"><i class=\"bi bi-building icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-secondary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-secondary text-uppercase mb-1\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -244,7 +244,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</div></div><div class=\"col-auto\"><i class=\"fas fa-server fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-dark shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-dark text-uppercase mb-1\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</div></div><div class=\"col-auto\"><i class=\"bi bi-server icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-dark shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-dark text-uppercase mb-1\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -284,7 +284,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</div></div><div class=\"col-auto\"><i class=\"fas fa-hdd fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-purple shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-purple text-uppercase mb-1\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</div></div><div class=\"col-auto\"><i class=\"bi bi-device-hdd icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-purple shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-purple text-uppercase mb-1\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -324,7 +324,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div></div><div class=\"col-auto\"><i class=\"fas fa-code-branch fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Total Size</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div></div><div class=\"col-auto\"><i class=\"bi bi-diagram-3 icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-2 col-md-4 col-sm-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Total Size</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -337,7 +337,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</div></div><div class=\"col-auto\"><i class=\"fas fa-chart-area fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Volumes Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-database me-2\"></i>Volume Details</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</div></div><div class=\"col-auto\"><i class=\"bi bi-graph-up icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Volumes Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-database me-2\"></i>Volume Details</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -470,11 +470,11 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var16 string
-				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", volume.Id))
+				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", volume.Id))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 320, Col: 94}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -517,7 +517,7 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></td>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -659,11 +659,11 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var27 string
-				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Active: %s", formatBytes(int64(volume.Size-volume.DeletedByteCount))))
+				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("Active: %s", formatBytes(int64(volume.Size-volume.DeletedByteCount))))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 370, Col: 132}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -694,11 +694,11 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var29 string
-				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Garbage: %s", formatBytes(int64(volume.DeletedByteCount))))
+				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("Garbage: %s", formatBytes(int64(volume.DeletedByteCount))))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 384, Col: 119}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -756,299 +756,335 @@ func ClusterVolumes(data dash.ClusterVolumesData) templ.Component {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var33 string
-					templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(volume.DiskType)
+					templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(displayDiskType(volume.DiskType))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 403, Col: 95}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 403, Col: 112}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "</span></td>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "</span> ")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					if volume.RemoteStorageName != "" {
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "<span class=\"badge bg-info text-white ms-1\" title=\"")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						var templ_7745c5c3_Var34 string
+						templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.ResolveAttributeValue(volume.RemoteStorageKey)
+						if templ_7745c5c3_Err != nil {
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 405, Col: 126}
+						}
+						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var34)
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "\"><i class=\"bi bi-cloud me-1\"></i>")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						var templ_7745c5c3_Var35 string
+						templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(volume.RemoteStorageName)
+						if templ_7745c5c3_Err != nil {
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 406, Col: 113}
+						}
+						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "</span>")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "</td>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 				if data.ShowVersionColumn {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "<td><span class=\"badge bg-dark\">")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "<td><span class=\"badge bg-dark\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					var templ_7745c5c3_Var34 string
-					templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("v%d", volume.Version))
+					var templ_7745c5c3_Var36 string
+					templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("v%d", volume.Version))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 408, Col: 111}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 413, Col: 111}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "</span></td>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "</span></td>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "<td><div class=\"btn-group btn-group-sm\"><button type=\"button\" class=\"btn btn-outline-primary btn-sm view-details-btn\" title=\"View Details\" data-volume-id=\"")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var35 string
-				templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", volume.Id))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 414, Col: 121}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "\"><i class=\"fas fa-eye\"></i></button> <button type=\"button\" class=\"btn btn-outline-secondary btn-sm vacuum-btn\" title=\"Vacuum\" data-volume-id=\"")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var36 string
-				templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", volume.Id))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 419, Col: 100}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "\" data-server=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "<td><div class=\"btn-group btn-group-sm\"><button type=\"button\" class=\"btn btn-outline-primary btn-sm view-details-btn\" title=\"View Details\" data-volume-id=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var37 string
-				templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(volume.Server)
+				templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", volume.Id))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 420, Col: 82}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 419, Col: 121}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var37)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "\"><i class=\"fas fa-compress-alt\"></i></button></div></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "\"><i class=\"bi bi-eye\"></i></button> <button type=\"button\" class=\"btn btn-outline-secondary btn-sm vacuum-btn\" title=\"Vacuum\" data-volume-id=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var38 string
+				templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", volume.Id))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 424, Col: 100}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var38)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "\" data-server=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var39 string
+				templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.ResolveAttributeValue(volume.Server)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 425, Col: 82}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var39)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "\"><i class=\"bi bi-arrows-angle-contract\"></i></button></div></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "</tbody></table></div><!-- Volume Summary --> <div class=\"d-flex justify-content-between align-items-center mt-3\"><div><small class=\"text-muted\">Showing ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var38 string
-			templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", (data.CurrentPage-1)*data.PageSize+1))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 435, Col: 98}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, " to ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var39 string
-			templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", minInt(data.CurrentPage*data.PageSize, data.TotalVolumes)))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 435, Col: 180}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, " of ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "</tbody></table></div><!-- Volume Summary --> <div class=\"d-flex justify-content-between align-items-center mt-3\"><div><small class=\"text-muted\">Showing ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var40 string
-			templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalVolumes))
+			templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", (data.CurrentPage-1)*data.PageSize+1))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 435, Col: 222}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 440, Col: 98}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, " volumes</small></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, " to ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var41 string
+			templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", minInt(data.CurrentPage*data.PageSize, data.TotalVolumes)))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 440, Col: 180}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, " of ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var42 string
+			templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalVolumes))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 440, Col: 222}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, " volumes</small></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if data.TotalPages > 1 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "<div><small class=\"text-muted\">Page ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "<div><small class=\"text-muted\">Page ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var41 string
-				templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage))
+				var templ_7745c5c3_Var43 string
+				templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 441, Col: 77}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 446, Col: 77}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, " of ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, " of ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var42 string
-				templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalPages))
+				var templ_7745c5c3_Var44 string
+				templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalPages))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 441, Col: 117}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 446, Col: 117}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "</small></div>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "</small></div>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, "</div><!-- Pagination Controls --> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, "</div><!-- Pagination Controls --> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if data.TotalPages > 1 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "<div class=\"d-flex justify-content-center mt-3\"><nav aria-label=\"Volumes pagination\"><ul class=\"pagination pagination-sm mb-0\"><!-- Previous Button -->")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "<div class=\"d-flex justify-content-center mt-3\"><nav aria-label=\"Volumes pagination\"><ul class=\"pagination pagination-sm mb-0\"><!-- Previous Button -->")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				if data.CurrentPage > 1 {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 100, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					var templ_7745c5c3_Var43 string
-					templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage-1))
+					var templ_7745c5c3_Var45 string
+					templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage-1))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 455, Col: 138}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 460, Col: 138}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var45)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "\"><i class=\"fas fa-chevron-left\"></i></a></li>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 101, "\"><i class=\"bi bi-chevron-left\"></i></a></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"fas fa-chevron-left\"></i></span></li>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 102, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"bi bi-chevron-left\"></i></span></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "<!-- Page Numbers -->")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 103, "<!-- Page Numbers -->")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				for i := maxInt(1, data.CurrentPage-2); i <= minInt(data.TotalPages, data.CurrentPage+2); i++ {
 					if i == data.CurrentPage {
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 100, "<li class=\"page-item active\"><span class=\"page-link\">")
-						if templ_7745c5c3_Err != nil {
-							return templ_7745c5c3_Err
-						}
-						var templ_7745c5c3_Var44 string
-						templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
-						if templ_7745c5c3_Err != nil {
-							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 471, Col: 93}
-						}
-						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
-						if templ_7745c5c3_Err != nil {
-							return templ_7745c5c3_Err
-						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 101, "</span></li>")
-						if templ_7745c5c3_Err != nil {
-							return templ_7745c5c3_Err
-						}
-					} else {
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 102, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
-						if templ_7745c5c3_Err != nil {
-							return templ_7745c5c3_Err
-						}
-						var templ_7745c5c3_Var45 string
-						templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
-						if templ_7745c5c3_Err != nil {
-							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 475, Col: 125}
-						}
-						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var45))
-						if templ_7745c5c3_Err != nil {
-							return templ_7745c5c3_Err
-						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 103, "\">")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 104, "<li class=\"page-item active\"><span class=\"page-link\">")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 						var templ_7745c5c3_Var46 string
 						templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
 						if templ_7745c5c3_Err != nil {
-							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 475, Col: 148}
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 476, Col: 93}
 						}
 						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46))
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 104, "</a></li>")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 105, "</span></li>")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+					} else {
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 106, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						var templ_7745c5c3_Var47 string
+						templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", i))
+						if templ_7745c5c3_Err != nil {
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 480, Col: 125}
+						}
+						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var47)
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 107, "\">")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						var templ_7745c5c3_Var48 string
+						templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
+						if templ_7745c5c3_Err != nil {
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 480, Col: 148}
+						}
+						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var48))
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 108, "</a></li>")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 105, "<!-- Next Button -->")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, "<!-- Next Button -->")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				if data.CurrentPage < data.TotalPages {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 106, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 110, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					var templ_7745c5c3_Var47 string
-					templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage+1))
+					var templ_7745c5c3_Var49 string
+					templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage+1))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 483, Col: 138}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 488, Col: 138}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var47))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var49)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 107, "\"><i class=\"fas fa-chevron-right\"></i></a></li>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 111, "\"><i class=\"bi bi-chevron-right\"></i></a></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 108, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"fas fa-chevron-right\"></i></span></li>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 112, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"bi bi-chevron-right\"></i></span></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, "</ul></nav></div>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 113, "</ul></nav></div>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 110, "<div class=\"text-center py-5\"><i class=\"fas fa-database fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Volumes Found</h5><p class=\"text-muted\">No volumes are currently available in the cluster.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 114, "<div class=\"text-center py-5\"><i class=\"bi bi-database icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Volumes Found</h5><p class=\"text-muted\">No volumes are currently available in the cluster.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 111, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 115, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var48 string
-		templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
+		var templ_7745c5c3_Var50 string
+		templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 513, Col: 81}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/cluster_volumes.templ`, Line: 518, Col: 81}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var48))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var50))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 112, "</small></div></div></div><!-- JavaScript for pagination and sorting --><script>\n        // Initialize pagination links when page loads\n        document.addEventListener('DOMContentLoaded', function() {\n            // Add click handlers to pagination links\n            document.querySelectorAll('.pagination-link').forEach(link => {\n                link.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const page = this.getAttribute('data-page');\n                    goToPage(page);\n                });\n            });\n            \n            // Add click handlers to view details buttons\n            document.querySelectorAll('.view-details-btn').forEach(button => {\n                button.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const volumeId = this.getAttribute('data-volume-id');\n                    viewVolumeDetails(volumeId);\n                });\n            });\n\n            // Add click handlers to volume ID links\n            document.querySelectorAll('.volume-id-link').forEach(link => {\n                link.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const volumeId = this.getAttribute('data-volume-id');\n                    viewVolumeDetails(volumeId);\n                });\n            });\n\n            // Add click handlers to vacuum buttons\n            document.querySelectorAll('.vacuum-btn').forEach(button => {\n                button.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const volumeId = this.getAttribute('data-volume-id');\n                    const server = this.getAttribute('data-server');\n                    performVacuum(volumeId, server, this);\n                });\n            });\n        });\n        \n        function goToPage(page) {\n            const url = new URL(window.location);\n            url.searchParams.set('page', page);\n            window.location.href = url.toString();\n        }\n        \n        function changePageSize() {\n            const pageSize = document.getElementById('pageSizeSelect').value;\n            const url = new URL(window.location);\n            url.searchParams.set('pageSize', pageSize);\n            url.searchParams.set('page', '1'); // Reset to first page\n            window.location.href = url.toString();\n        }\n        \n        function sortTable(column) {\n            const url = new URL(window.location);\n            const currentSort = url.searchParams.get('sortBy');\n            const currentOrder = url.searchParams.get('sortOrder') || 'asc';\n            \n            let newOrder = 'asc';\n            if (currentSort === column && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            url.searchParams.set('sortBy', column);\n            url.searchParams.set('sortOrder', newOrder);\n            url.searchParams.set('page', '1'); // Reset to first page\n            window.location.href = url.toString();\n        }\n        \n        function viewVolumeDetails(volumeId) {\n            // Get the server from the current row - works for both buttons and volume ID links\n            const clickedElement = event.target;\n            const row = clickedElement.closest('tr');\n            const serverCell = row.querySelector('td:nth-child(2) a');\n            const server = serverCell ? serverCell.textContent.trim() : 'unknown';\n            \n            window.location.href = (window.__BASE_PATH__ || '') + `/storage/volumes/${volumeId}/${encodeURIComponent(server)}`;\n        }\n\n        function performVacuum(volumeId, server, button) {\n            // Disable button and show loading state\n            const originalHTML = button.innerHTML;\n            button.disabled = true;\n            button.innerHTML = '<i class=\"fas fa-spinner fa-spin\"></i>';\n\n            // Send vacuum request\n            fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/vacuum`, {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                }\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    showMessage(data.error, 'error');\n                } else {\n                    showMessage(data.message || 'Volume vacuum started successfully', 'success');\n                    // Optionally refresh the page after a delay to show updated vacuum status\n                    setTimeout(() => {\n                        window.location.reload();\n                    }, 2000);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showMessage('Failed to start vacuum operation', 'error');\n            })\n            .finally(() => {\n                // Re-enable button\n                button.disabled = false;\n                button.innerHTML = originalHTML;\n            });\n        }\n\n        function showMessage(message, type) {\n            // Create toast notification\n            const toast = document.createElement('div');\n            toast.className = `alert alert-${type === 'error' ? 'danger' : 'success'} alert-dismissible fade show position-fixed`;\n            toast.style.top = '20px';\n            toast.style.right = '20px';\n            toast.style.zIndex = '9999';\n            toast.style.minWidth = '300px';\n            \n            toast.innerHTML = `\n                ${message}\n                <button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"alert\"></button>\n            `;\n            \n            document.body.appendChild(toast);\n            \n            // Auto-remove after 5 seconds\n            setTimeout(() => {\n                if (toast.parentNode) {\n                    toast.parentNode.removeChild(toast);\n                }\n            }, 5000);\n        }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 116, "</small></div></div></div><!-- JavaScript for pagination and sorting --><script>\n        // Initialize pagination links when page loads\n        document.addEventListener('DOMContentLoaded', function() {\n            // Add click handlers to pagination links\n            document.querySelectorAll('.pagination-link').forEach(link => {\n                link.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const page = this.getAttribute('data-page');\n                    goToPage(page);\n                });\n            });\n            \n            // Add click handlers to view details buttons\n            document.querySelectorAll('.view-details-btn').forEach(button => {\n                button.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const volumeId = this.getAttribute('data-volume-id');\n                    viewVolumeDetails(volumeId);\n                });\n            });\n\n            // Add click handlers to volume ID links\n            document.querySelectorAll('.volume-id-link').forEach(link => {\n                link.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const volumeId = this.getAttribute('data-volume-id');\n                    viewVolumeDetails(volumeId);\n                });\n            });\n\n            // Add click handlers to vacuum buttons\n            document.querySelectorAll('.vacuum-btn').forEach(button => {\n                button.addEventListener('click', function(e) {\n                    e.preventDefault();\n                    const volumeId = this.getAttribute('data-volume-id');\n                    const server = this.getAttribute('data-server');\n                    performVacuum(volumeId, server, this);\n                });\n            });\n        });\n        \n        function goToPage(page) {\n            const url = new URL(window.location);\n            url.searchParams.set('page', page);\n            window.location.href = url.toString();\n        }\n        \n        function changePageSize() {\n            const pageSize = document.getElementById('pageSizeSelect').value;\n            const url = new URL(window.location);\n            url.searchParams.set('pageSize', pageSize);\n            url.searchParams.set('page', '1'); // Reset to first page\n            window.location.href = url.toString();\n        }\n        \n        function sortTable(column) {\n            const url = new URL(window.location);\n            const currentSort = url.searchParams.get('sortBy');\n            const currentOrder = url.searchParams.get('sortOrder') || 'asc';\n            \n            let newOrder = 'asc';\n            if (currentSort === column && currentOrder === 'asc') {\n                newOrder = 'desc';\n            }\n            \n            url.searchParams.set('sortBy', column);\n            url.searchParams.set('sortOrder', newOrder);\n            url.searchParams.set('page', '1'); // Reset to first page\n            window.location.href = url.toString();\n        }\n        \n        function viewVolumeDetails(volumeId) {\n            // Get the server from the current row - works for both buttons and volume ID links\n            const clickedElement = event.target;\n            const row = clickedElement.closest('tr');\n            const serverCell = row.querySelector('td:nth-child(2) a');\n            const server = serverCell ? serverCell.textContent.trim() : 'unknown';\n            \n            window.location.href = (window.__BASE_PATH__ || '') + `/storage/volumes/${volumeId}/${encodeURIComponent(server)}`;\n        }\n\n        function performVacuum(volumeId, server, button) {\n            // Disable button and show loading state\n            const originalHTML = button.innerHTML;\n            button.disabled = true;\n            button.innerHTML = '<i class=\"bi bi-arrow-repeat icon-spin\"></i>';\n\n            // Send vacuum request\n            fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/vacuum`, {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                }\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    showMessage(data.error, 'error');\n                } else {\n                    showMessage(data.message || 'Volume vacuum started successfully', 'success');\n                    // Optionally refresh the page after a delay to show updated vacuum status\n                    setTimeout(() => {\n                        window.location.reload();\n                    }, 2000);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showMessage('Failed to start vacuum operation', 'error');\n            })\n            .finally(() => {\n                // Re-enable button\n                button.disabled = false;\n                button.innerHTML = originalHTML;\n            });\n        }\n\n        function showMessage(message, type) {\n            // Create toast notification\n            const toast = document.createElement('div');\n            toast.className = `alert alert-${type === 'error' ? 'danger' : 'success'} alert-dismissible fade show position-fixed`;\n            toast.style.top = '20px';\n            toast.style.right = '20px';\n            toast.style.zIndex = '9999';\n            toast.style.minWidth = '300px';\n            \n            toast.innerHTML = `\n                ${message}\n                <button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"alert\"></button>\n            `;\n            \n            document.body.appendChild(toast);\n            \n            // Auto-remove after 5 seconds\n            setTimeout(() => {\n                if (toast.parentNode) {\n                    toast.parentNode.removeChild(toast);\n                }\n            }, 5000);\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1079,14 +1115,18 @@ func countUniqueRacks(volumes []dash.VolumeWithTopology) int {
 	return len(rackMap)
 }
 
+// displayDiskType maps the empty disk type to its display name.
+func displayDiskType(diskType string) string {
+	if diskType == "" {
+		return "hdd"
+	}
+	return diskType
+}
+
 func countUniqueDiskTypes(volumes []dash.VolumeWithTopology) int {
 	diskTypeMap := make(map[string]bool)
 	for _, volume := range volumes {
-		diskType := volume.DiskType
-		if diskType == "" {
-			diskType = "hdd"
-		}
-		diskTypeMap[diskType] = true
+		diskTypeMap[displayDiskType(volume.DiskType)] = true
 	}
 	return len(diskTypeMap)
 }
@@ -1107,23 +1147,23 @@ func getSortIcon(column, currentSort, currentOrder string) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var49 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var49 == nil {
-			templ_7745c5c3_Var49 = templ.NopComponent
+		templ_7745c5c3_Var51 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var51 == nil {
+			templ_7745c5c3_Var51 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		if column != currentSort {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 113, "<i class=\"fas fa-sort text-muted ms-1\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 117, "<i class=\"bi bi-arrow-down-up text-muted ms-1\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else if currentOrder == "asc" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 114, "<i class=\"fas fa-sort-up text-primary ms-1\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 118, "<i class=\"bi bi-sort-up text-primary ms-1\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 115, "<i class=\"fas fa-sort-down text-primary ms-1\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 119, "<i class=\"bi bi-sort-down text-primary ms-1\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
diff --git a/weed/admin/view/app/collection_details.templ b/weed/admin/view/app/collection_details.templ
index c48a4e48a7..cae94c2e8f 100644
--- a/weed/admin/view/app/collection_details.templ
+++ b/weed/admin/view/app/collection_details.templ
@@ -10,7 +10,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<div>
 			<h1 class="h2">
-				<i class="fas fa-layer-group me-2"></i>Collection Details: {data.CollectionName}
+				<i class="bi bi-layers me-2"></i>Collection Details: {data.CollectionName}
 			</h1>
 			<nav aria-label="breadcrumb">
 				<ol class="breadcrumb">
@@ -23,10 +23,10 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-outline-secondary" onclick="history.back()">
-					<i class="fas fa-arrow-left me-1"></i>Back
+					<i class="bi bi-arrow-left me-1"></i>Back
 				</button>
 				<button type="button" class="btn btn-sm btn-outline-primary" onclick="window.location.reload()">
-					<i class="fas fa-refresh me-1"></i>Refresh
+					<i class="bi bi-arrow-clockwise me-1"></i>Refresh
 				</button>
 			</div>
 		</div>
@@ -44,7 +44,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 							<small>Traditional volumes</small>
 						</div>
 						<div class="align-self-center">
-							<i class="fas fa-database fa-2x"></i>
+							<i class="bi bi-database icon-2x"></i>
 						</div>
 					</div>
 				</div>
@@ -60,7 +60,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 							<small>Erasure coded volumes</small>
 						</div>
 						<div class="align-self-center">
-							<i class="fas fa-th-large fa-2x"></i>
+							<i class="bi bi-grid icon-2x"></i>
 						</div>
 					</div>
 				</div>
@@ -76,7 +76,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 							<small>A file is split into one or more chunks</small>
 						</div>
 						<div class="align-self-center">
-							<i class="fas fa-cubes fa-2x"></i>
+							<i class="bi bi-boxes icon-2x"></i>
 						</div>
 					</div>
 				</div>
@@ -92,7 +92,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 							<small>Data stored (regular volumes only)</small>
 						</div>
 						<div class="align-self-center">
-							<i class="fas fa-hdd fa-2x"></i>
+							<i class="bi bi-device-hdd icon-2x"></i>
 						</div>
 					</div>
 				</div>
@@ -102,7 +102,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 
 	<!-- Size Information Note -->
 	<div class="alert alert-info" role="alert">
-		<i class="fas fa-info-circle me-2"></i>
+		<i class="bi bi-info-circle me-2"></i>
 		<strong>Size Information:</strong> 
 		Logical size represents the actual data stored (regular volumes only). 
 		EC volumes show shard counts instead of size - physical storage for EC volumes is approximately 1.4x the original data due to erasure coding redundancy.
@@ -145,12 +145,12 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 							Volume ID
 							if data.SortBy == "volume_id" {
 								if data.SortOrder == "asc" {
-									<i class="fas fa-sort-up ms-1"></i>
+									<i class="bi bi-sort-up ms-1"></i>
 								} else {
-									<i class="fas fa-sort-down ms-1"></i>
+									<i class="bi bi-sort-down ms-1"></i>
 								}
 							} else {
-								<i class="fas fa-sort ms-1 text-muted"></i>
+								<i class="bi bi-arrow-down-up ms-1 text-muted"></i>
 							}
 						</a>
 					</th>
@@ -159,12 +159,12 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 							Type
 							if data.SortBy == "type" {
 								if data.SortOrder == "asc" {
-									<i class="fas fa-sort-up ms-1"></i>
+									<i class="bi bi-sort-up ms-1"></i>
 								} else {
-									<i class="fas fa-sort-down ms-1"></i>
+									<i class="bi bi-sort-down ms-1"></i>
 								}
 							} else {
-								<i class="fas fa-sort ms-1 text-muted"></i>
+								<i class="bi bi-arrow-down-up ms-1 text-muted"></i>
 							}
 						</a>
 					</th>
@@ -183,7 +183,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 						</td>
 						<td>
 							<span class="badge bg-primary">
-								<i class="fas fa-database me-1"></i>Regular
+								<i class="bi bi-database me-1"></i>Regular
 							</span>
 						</td>
 						<td>
@@ -206,7 +206,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 										data-volume-id={ fmt.Sprintf("%d", volume.Id) }
 										data-server={ volume.Server }
 										title="View volume details">
-									<i class="fas fa-info-circle"></i>
+									<i class="bi bi-info-circle"></i>
 								</button>
 							</div>
 						</td>
@@ -221,7 +221,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 						</td>
 						<td>
 							<span class="badge bg-info">
-								<i class="fas fa-th-large me-1"></i>EC
+								<i class="bi bi-grid me-1"></i>EC
 							</span>
 						</td>
 						<td>
@@ -233,11 +233,11 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 						<td>
 							if ecVolume.IsComplete {
 								<span class="badge bg-success">
-									<i class="fas fa-check me-1"></i>Complete
+									<i class="bi bi-check me-1"></i>Complete
 								</span>
 							} else {
 								<span class="badge bg-warning">
-									<i class="fas fa-exclamation-triangle me-1"></i>
+									<i class="bi bi-exclamation-triangle me-1"></i>
 									Missing {fmt.Sprintf("%d", len(ecVolume.MissingShards))} shards
 								</span>
 							}
@@ -248,7 +248,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 										onclick="showEcVolumeDetails(event)" 
 										data-volume-id={ fmt.Sprintf("%d", ecVolume.VolumeID) }
 										title="View EC volume details">
-									<i class="fas fa-info-circle"></i>
+									<i class="bi bi-info-circle"></i>
 								</button>
 							</div>
 						</td>
@@ -259,7 +259,7 @@ templ CollectionDetails(data dash.CollectionDetailsData) {
 				if len(data.RegularVolumes) == 0 && len(data.EcVolumes) == 0 {
 					<tr>
 						<td colspan="6" class="text-center text-muted py-4">
-							<i class="fas fa-info-circle me-2"></i>
+							<i class="bi bi-info-circle me-2"></i>
 							No volumes found for collection "{data.CollectionName}"
 						</td>
 					</tr>
diff --git a/weed/admin/view/app/collection_details_templ.go b/weed/admin/view/app/collection_details_templ.go
index d3be97a9aa..ff8667cd13 100644
--- a/weed/admin/view/app/collection_details_templ.go
+++ b/weed/admin/view/app/collection_details_templ.go
@@ -35,14 +35,14 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"fas fa-layer-group me-2\"></i>Collection Details: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"bi bi-layers me-2\"></i>Collection Details: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var2 string
 		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(data.CollectionName)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/collection_details.templ`, Line: 13, Col: 83}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/collection_details.templ`, Line: 13, Col: 77}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
 		if templ_7745c5c3_Err != nil {
@@ -87,7 +87,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</li></ol></nav></div><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"history.back()\"><i class=\"fas fa-arrow-left me-1\"></i>Back</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"fas fa-refresh me-1\"></i>Refresh</button></div></div></div><!-- Collection Summary --><div class=\"row mb-4\"><div class=\"col-md-3\"><div class=\"card text-bg-primary\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Regular Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</li></ol></nav></div><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"history.back()\"><i class=\"bi bi-arrow-left me-1\"></i>Back</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"bi bi-arrow-clockwise me-1\"></i>Refresh</button></div></div></div><!-- Collection Summary --><div class=\"row mb-4\"><div class=\"col-md-3\"><div class=\"card text-bg-primary\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Regular Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -100,7 +100,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</h4><small>Traditional volumes</small></div><div class=\"align-self-center\"><i class=\"fas fa-database fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-info\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">EC Volumes</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</h4><small>Traditional volumes</small></div><div class=\"align-self-center\"><i class=\"bi bi-database icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-info\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">EC Volumes</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -113,7 +113,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</h4><small>Erasure coded volumes</small></div><div class=\"align-self-center\"><i class=\"fas fa-th-large fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-success\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Chunks</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</h4><small>Erasure coded volumes</small></div><div class=\"align-self-center\"><i class=\"bi bi-grid icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-success\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Chunks</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -126,7 +126,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "</h4><small>A file is split into one or more chunks</small></div><div class=\"align-self-center\"><i class=\"fas fa-cubes fa-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-warning\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Size (Logical)</h6><h4 class=\"mb-0\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "</h4><small>A file is split into one or more chunks</small></div><div class=\"align-self-center\"><i class=\"bi bi-boxes icon-2x\"></i></div></div></div></div></div><div class=\"col-md-3\"><div class=\"card text-bg-warning\"><div class=\"card-body\"><div class=\"d-flex justify-content-between\"><div><h6 class=\"card-title\">Total Size (Logical)</h6><h4 class=\"mb-0\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -139,7 +139,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</h4><small>Data stored (regular volumes only)</small></div><div class=\"align-self-center\"><i class=\"fas fa-hdd fa-2x\"></i></div></div></div></div></div></div><!-- Size Information Note --><div class=\"alert alert-info\" role=\"alert\"><i class=\"fas fa-info-circle me-2\"></i> <strong>Size Information:</strong> Logical size represents the actual data stored (regular volumes only).  EC volumes show shard counts instead of size - physical storage for EC volumes is approximately 1.4x the original data due to erasure coding redundancy.</div><!-- Pagination Info --><div class=\"d-flex justify-content-between align-items-center mb-3\"><div class=\"d-flex align-items-center\"><span class=\"me-3\">Showing ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</h4><small>Data stored (regular volumes only)</small></div><div class=\"align-self-center\"><i class=\"bi bi-device-hdd icon-2x\"></i></div></div></div></div></div></div><!-- Size Information Note --><div class=\"alert alert-info\" role=\"alert\"><i class=\"bi bi-info-circle me-2\"></i> <strong>Size Information:</strong> Logical size represents the actual data stored (regular volumes only).  EC volumes show shard counts instead of size - physical storage for EC volumes is approximately 1.4x the original data due to erasure coding redundancy.</div><!-- Pagination Info --><div class=\"d-flex justify-content-between align-items-center mb-3\"><div class=\"d-flex align-items-center\"><span class=\"me-3\">Showing ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -231,18 +231,18 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 		}
 		if data.SortBy == "volume_id" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<i class=\"bi bi-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<i class=\"bi bi-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -253,18 +253,18 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 		}
 		if data.SortBy == "type" {
 			if data.SortOrder == "asc" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<i class=\"fas fa-sort-up ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<i class=\"bi bi-sort-up ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<i class=\"fas fa-sort-down ms-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<i class=\"bi bi-sort-down ms-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -287,7 +287,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</strong></td><td><span class=\"badge bg-primary\"><i class=\"fas fa-database me-1\"></i>Regular</span></td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</strong></td><td><span class=\"badge bg-primary\"><i class=\"bi bi-database me-1\"></i>Regular</span></td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -354,7 +354,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\" title=\"View volume details\"><i class=\"fas fa-info-circle\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\" title=\"View volume details\"><i class=\"bi bi-info-circle\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -373,7 +373,7 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</strong></td><td><span class=\"badge bg-info\"><i class=\"fas fa-th-large me-1\"></i>EC</span></td><td><span class=\"badge bg-primary\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</strong></td><td><span class=\"badge bg-info\"><i class=\"bi bi-grid me-1\"></i>EC</span></td><td><span class=\"badge bg-primary\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -391,12 +391,12 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if ecVolume.IsComplete {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<span class=\"badge bg-success\"><i class=\"fas fa-check me-1\"></i>Complete</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<span class=\"badge bg-success\"><i class=\"bi bi-check me-1\"></i>Complete</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<span class=\"badge bg-warning\"><i class=\"fas fa-exclamation-triangle me-1\"></i> Missing ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<span class=\"badge bg-warning\"><i class=\"bi bi-exclamation-triangle me-1\"></i> Missing ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -427,13 +427,13 @@ func CollectionDetails(data dash.CollectionDetailsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "\" title=\"View EC volume details\"><i class=\"fas fa-info-circle\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "\" title=\"View EC volume details\"><i class=\"bi bi-info-circle\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.RegularVolumes) == 0 && len(data.EcVolumes) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<tr><td colspan=\"6\" class=\"text-center text-muted py-4\"><i class=\"fas fa-info-circle me-2\"></i> No volumes found for collection \"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<tr><td colspan=\"6\" class=\"text-center text-muted py-4\"><i class=\"bi bi-info-circle me-2\"></i> No volumes found for collection \"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
diff --git a/weed/admin/view/app/ec_volume_details.templ b/weed/admin/view/app/ec_volume_details.templ
index c60191a7ce..f456cd6b5c 100644
--- a/weed/admin/view/app/ec_volume_details.templ
+++ b/weed/admin/view/app/ec_volume_details.templ
@@ -10,7 +10,7 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <div>
             <h1 class="h2">
-                <i class="fas fa-th-large me-2"></i>EC Volume Details
+                <i class="bi bi-grid me-2"></i>EC Volume Details
             </h1>
             <nav aria-label="breadcrumb">
                 <ol class="breadcrumb">
@@ -23,10 +23,10 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
                 <button type="button" class="btn btn-sm btn-outline-secondary" onclick="history.back()">
-                    <i class="fas fa-arrow-left me-1"></i>Back
+                    <i class="bi bi-arrow-left me-1"></i>Back
                 </button>
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="window.location.reload()">
-                    <i class="fas fa-refresh me-1"></i>Refresh
+                    <i class="bi bi-arrow-clockwise me-1"></i>Refresh
                 </button>
             </div>
         </div>
@@ -38,7 +38,7 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
             <div class="card">
                 <div class="card-header">
                     <h5 class="card-title mb-0">
-                        <i class="fas fa-info-circle me-2"></i>Volume Information
+                        <i class="bi bi-info-circle me-2"></i>Volume Information
                     </h5>
                 </div>
                 <div class="card-body">
@@ -62,11 +62,11 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
                             <td>
                                 if data.IsComplete {
                                     <span class="badge bg-success">
-                                        <i class="fas fa-check me-1"></i>Complete ({data.TotalShards}/{fmt.Sprintf("%d", erasure_coding.TotalShardsCount)} shards)
+                                        <i class="bi bi-check me-1"></i>Complete ({data.TotalShards}/{fmt.Sprintf("%d", erasure_coding.TotalShardsCount)} shards)
                                     </span>
                                 } else {
                                     <span class="badge bg-warning">
-                                        <i class="fas fa-exclamation-triangle me-1"></i>Incomplete ({data.TotalShards}/{fmt.Sprintf("%d", erasure_coding.TotalShardsCount)} shards)
+                                        <i class="bi bi-exclamation-triangle me-1"></i>Incomplete ({data.TotalShards}/{fmt.Sprintf("%d", erasure_coding.TotalShardsCount)} shards)
                                     </span>
                                 }
                             </td>
@@ -116,7 +116,7 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
             <div class="card">
                 <div class="card-header">
                     <h5 class="card-title mb-0">
-                        <i class="fas fa-chart-pie me-2"></i>Shard Distribution
+                        <i class="bi bi-pie-chart me-2"></i>Shard Distribution
                     </h5>
                 </div>
                 <div class="card-body">
@@ -172,7 +172,7 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
     <div class="card">
         <div class="card-header">
             <h5 class="card-title mb-0">
-                <i class="fas fa-list me-2"></i>Shard Details
+                <i class="bi bi-list me-2"></i>Shard Details
             </h5>
         </div>
         <div class="card-body">
@@ -186,12 +186,12 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
                                         Shard ID
                                         if data.SortBy == "shard_id" {
                                             if data.SortOrder == "asc" {
-                                                <i class="fas fa-sort-up ms-1"></i>
+                                                <i class="bi bi-sort-up ms-1"></i>
                                             } else {
-                                                <i class="fas fa-sort-down ms-1"></i>
+                                                <i class="bi bi-sort-down ms-1"></i>
                                             }
                                         } else {
-                                            <i class="fas fa-sort ms-1 text-muted"></i>
+                                            <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                         }
                                     </a>
                                 </th>
@@ -200,12 +200,12 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
                                         Server
                                         if data.SortBy == "server" {
                                             if data.SortOrder == "asc" {
-                                                <i class="fas fa-sort-up ms-1"></i>
+                                                <i class="bi bi-sort-up ms-1"></i>
                                             } else {
-                                                <i class="fas fa-sort-down ms-1"></i>
+                                                <i class="bi bi-sort-down ms-1"></i>
                                             }
                                         } else {
-                                            <i class="fas fa-sort ms-1 text-muted"></i>
+                                            <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                         }
                                     </a>
                                 </th>
@@ -214,12 +214,12 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
                                         Data Center
                                         if data.SortBy == "data_center" {
                                             if data.SortOrder == "asc" {
-                                                <i class="fas fa-sort-up ms-1"></i>
+                                                <i class="bi bi-sort-up ms-1"></i>
                                             } else {
-                                                <i class="fas fa-sort-down ms-1"></i>
+                                                <i class="bi bi-sort-down ms-1"></i>
                                             }
                                         } else {
-                                            <i class="fas fa-sort ms-1 text-muted"></i>
+                                            <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                         }
                                     </a>
                                 </th>
@@ -228,12 +228,12 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
                                         Rack
                                         if data.SortBy == "rack" {
                                             if data.SortOrder == "asc" {
-                                                <i class="fas fa-sort-up ms-1"></i>
+                                                <i class="bi bi-sort-up ms-1"></i>
                                             } else {
-                                                <i class="fas fa-sort-down ms-1"></i>
+                                                <i class="bi bi-sort-down ms-1"></i>
                                             }
                                         } else {
-                                            <i class="fas fa-sort ms-1 text-muted"></i>
+                                            <i class="bi bi-arrow-down-up ms-1 text-muted"></i>
                                         }
                                     </a>
                                 </th>
@@ -267,7 +267,7 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
                                         </td>
                                         <td>
                                             <a href={ templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", shard.Server)) } target="_blank" rel="noopener noreferrer" class="btn btn-sm btn-primary">
-                                                <i class="fas fa-external-link-alt me-1"></i>Volume Server
+                                                <i class="bi bi-box-arrow-up-right me-1"></i>Volume Server
                                             </a>
                                         </td>
                                     </tr>
@@ -277,7 +277,7 @@ templ EcVolumeDetails(data dash.EcVolumeDetailsData) {
                 </div>
             } else {
                 <div class="text-center py-4">
-                    <i class="fas fa-exclamation-triangle fa-3x text-warning mb-3"></i>
+                    <i class="bi bi-exclamation-triangle icon-3x text-warning mb-3"></i>
                     <h5>No EC shards found</h5>
                     <p class="text-muted">This volume may not be EC encoded yet.</p>
                 </div>
diff --git a/weed/admin/view/app/ec_volume_details_templ.go b/weed/admin/view/app/ec_volume_details_templ.go
index 0da9a8d86d..f545440682 100644
--- a/weed/admin/view/app/ec_volume_details_templ.go
+++ b/weed/admin/view/app/ec_volume_details_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -35,7 +35,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"fas fa-th-large me-2\"></i>EC Volume Details</h1><nav aria-label=\"breadcrumb\"><ol class=\"breadcrumb\"><li class=\"breadcrumb-item\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"bi bi-grid me-2\"></i>EC Volume Details</h1><nav aria-label=\"breadcrumb\"><ol class=\"breadcrumb\"><li class=\"breadcrumb-item\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -74,7 +74,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</li></ol></nav></div><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"history.back()\"><i class=\"fas fa-arrow-left me-1\"></i>Back</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"fas fa-refresh me-1\"></i>Refresh</button></div></div></div><!-- EC Volume Summary --><div class=\"row mb-4\"><div class=\"col-md-6\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"fas fa-info-circle me-2\"></i>Volume Information</h5></div><div class=\"card-body\"><table class=\"table table-borderless\"><tr><td><strong>Volume ID:</strong></td><td>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</li></ol></nav></div><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"history.back()\"><i class=\"bi bi-arrow-left me-1\"></i>Back</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"bi bi-arrow-clockwise me-1\"></i>Refresh</button></div></div></div><!-- EC Volume Summary --><div class=\"row mb-4\"><div class=\"col-md-6\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"bi bi-info-circle me-2\"></i>Volume Information</h5></div><div class=\"card-body\"><table class=\"table table-borderless\"><tr><td><strong>Volume ID:</strong></td><td>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -120,14 +120,14 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if data.IsComplete {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<span class=\"badge bg-success\"><i class=\"fas fa-check me-1\"></i>Complete (")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<span class=\"badge bg-success\"><i class=\"bi bi-check me-1\"></i>Complete (")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var7 string
 			templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(data.TotalShards)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 65, Col: 100}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 65, Col: 99}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 			if templ_7745c5c3_Err != nil {
@@ -140,7 +140,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			var templ_7745c5c3_Var8 string
 			templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", erasure_coding.TotalShardsCount))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 65, Col: 153}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 65, Col: 152}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 			if templ_7745c5c3_Err != nil {
@@ -151,14 +151,14 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<span class=\"badge bg-warning\"><i class=\"fas fa-exclamation-triangle me-1\"></i>Incomplete (")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<span class=\"badge bg-warning\"><i class=\"bi bi-exclamation-triangle me-1\"></i>Incomplete (")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var9 string
 			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(data.TotalShards)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 69, Col: 117}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 69, Col: 116}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
 			if templ_7745c5c3_Err != nil {
@@ -171,7 +171,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			var templ_7745c5c3_Var10 string
 			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", erasure_coding.TotalShardsCount))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 69, Col: 170}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 69, Col: 169}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 			if templ_7745c5c3_Err != nil {
@@ -267,7 +267,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</span></td></tr></table></div></div></div><div class=\"col-md-6\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"fas fa-chart-pie me-2\"></i>Shard Distribution</h5></div><div class=\"card-body\"><div class=\"row text-center\"><div class=\"col-4\"><div class=\"border rounded p-3\"><h3 class=\"text-primary mb-1\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</span></td></tr></table></div></div></div><div class=\"col-md-6\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"bi bi-pie-chart me-2\"></i>Shard Distribution</h5></div><div class=\"card-body\"><div class=\"row text-center\"><div class=\"col-4\"><div class=\"border rounded p-3\"><h3 class=\"text-primary mb-1\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -336,7 +336,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div></div></div></div></div><!-- Shard Details Table --><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"fas fa-list me-2\"></i>Shard Details</h5></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div></div></div></div></div><!-- Shard Details Table --><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"bi bi-list me-2\"></i>Shard Details</h5></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -347,18 +347,18 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			}
 			if data.SortBy == "shard_id" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -369,18 +369,18 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			}
 			if data.SortBy == "server" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -391,18 +391,18 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			}
 			if data.SortBy == "data_center" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -413,18 +413,18 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 			}
 			if data.SortBy == "rack" {
 				if data.SortOrder == "asc" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<i class=\"fas fa-sort-up ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<i class=\"bi bi-sort-up ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "<i class=\"fas fa-sort-down ms-1\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "<i class=\"bi bi-sort-down ms-1\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "<i class=\"fas fa-sort ms-1 text-muted\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "<i class=\"bi bi-arrow-down-up ms-1 text-muted\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -533,7 +533,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"btn btn-sm btn-primary\"><i class=\"fas fa-external-link-alt me-1\"></i>Volume Server</a></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "\" target=\"_blank\" rel=\"noopener noreferrer\" class=\"btn btn-sm btn-primary\"><i class=\"bi bi-box-arrow-up-right me-1\"></i>Volume Server</a></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -543,7 +543,7 @@ func EcVolumeDetails(data dash.EcVolumeDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "<div class=\"text-center py-4\"><i class=\"fas fa-exclamation-triangle fa-3x text-warning mb-3\"></i><h5>No EC shards found</h5><p class=\"text-muted\">This volume may not be EC encoded yet.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "<div class=\"text-center py-4\"><i class=\"bi bi-exclamation-triangle icon-3x text-warning mb-3\"></i><h5>No EC shards found</h5><p class=\"text-muted\">This volume may not be EC encoded yet.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -584,11 +584,11 @@ func renderEcShardBadge(shardID uint32, missing bool) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var25 string
-				templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Missing data shard %d", shardID))
+				templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("Missing data shard %d", shardID))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 310, Col: 108}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var25)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -615,11 +615,11 @@ func renderEcShardBadge(shardID uint32, missing bool) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var27 string
-				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Data shard %d", shardID))
+				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("Data shard %d", shardID))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 312, Col: 89}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -648,11 +648,11 @@ func renderEcShardBadge(shardID uint32, missing bool) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var29 string
-				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Missing parity shard %d", shardID))
+				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("Missing parity shard %d", shardID))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 316, Col: 120}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -679,11 +679,11 @@ func renderEcShardBadge(shardID uint32, missing bool) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var31 string
-				templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Parity shard %d", shardID))
+				templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("Parity shard %d", shardID))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/ec_volume_details.templ`, Line: 318, Col: 101}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var31)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
diff --git a/weed/admin/view/app/file_browser.templ b/weed/admin/view/app/file_browser.templ
index bc35781e2a..4367d74698 100644
--- a/weed/admin/view/app/file_browser.templ
+++ b/weed/admin/view/app/file_browser.templ
@@ -19,35 +19,35 @@ templ FileBrowser(data dash.FileBrowserData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
 		if data.IsTableBucketPath && data.TableBucketName != "" {
-			<i class="fas fa-table me-2"></i>Table Bucket: {data.TableBucketName}
+			<i class="bi bi-table me-2"></i>Table Bucket: {data.TableBucketName}
 		} else if data.IsBucketPath && data.BucketName != "" {
-			<i class="fas fa-cube me-2"></i>S3 Bucket: {data.BucketName}
+			<i class="bi bi-box me-2"></i>S3 Bucket: {data.BucketName}
 		} else {
-			<i class="fas fa-folder-open me-2"></i>File Browser
+			<i class="bi bi-folder2-open me-2"></i>File Browser
 		}
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 			if data.IsTableBucketPath && data.TableBucketName != "" {
 				<a href={ dash.PUrl(ctx, "/object-store/s3tables/buckets") } class="btn btn-sm btn-outline-secondary">
-					<i class="fas fa-arrow-left me-1"></i>Back to Table Buckets
+					<i class="bi bi-arrow-left me-1"></i>Back to Table Buckets
 				</a>
 			} else if data.IsBucketPath && data.BucketName != "" {
 				<a href={ dash.PUrl(ctx, "/object-store/buckets") } class="btn btn-sm btn-outline-secondary">
-					<i class="fas fa-arrow-left me-1"></i>Back to Buckets
+					<i class="bi bi-arrow-left me-1"></i>Back to Buckets
 				</a>
 			}
 				<button type="button" class="btn btn-sm btn-outline-primary" onclick="createFolder()">
-					<i class="fas fa-folder-plus me-1"></i>New Folder
+					<i class="bi bi-folder-plus me-1"></i>New Folder
 				</button>
 				<button type="button" class="btn btn-sm btn-outline-secondary" onclick="uploadFile()">
-					<i class="fas fa-upload me-1"></i>Upload
+					<i class="bi bi-upload me-1"></i>Upload
 				</button>
 				<button type="button" class="btn btn-sm btn-outline-danger" id="deleteSelectedBtn" onclick="confirmDeleteSelected()" style="display: none;">
-					<i class="fas fa-trash me-1"></i>Delete Selected
+					<i class="bi bi-trash me-1"></i>Delete Selected
 				</button>
 				<button type="button" class="btn btn-sm btn-outline-info" onclick="exportFileList()">
-					<i class="fas fa-download me-1"></i>Export
+					<i class="bi bi-download me-1"></i>Export
 				</button>
 			</div>
 		</div>
@@ -67,7 +67,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 					<li class="breadcrumb-item">
 						<a href={ dash.PUrl(ctx, fileBrowserPathURL(crumb.Path)) } class="text-decoration-none">
 							if crumb.Name == "Root" {
-								<i class="fas fa-home me-1"></i>
+								<i class="bi bi-house me-1"></i>
 							}
 							{ crumb.Name }
 						</a>
@@ -81,13 +81,13 @@ templ FileBrowser(data dash.FileBrowserData) {
 	<div class="card shadow mb-4">
 		<div class="card-header py-3 d-flex justify-content-between align-items-center flex-wrap">
 			<h6 class="m-0 font-weight-bold text-primary">
-				<i class="fas fa-folder-open me-2"></i>
+				<i class="bi bi-folder2-open me-2"></i>
 			if data.CurrentPath == "/" {
 				<a href={ dash.PUrl(ctx, fileBrowserPathURL("/")) } class="text-decoration-none text-primary">Root Directory</a>
 			} else if data.CurrentPath == "/buckets" {
 										<a href={ dash.PUrl(ctx, fileBrowserPathURL("/buckets")) } class="text-decoration-none text-primary">Object Store Buckets Directory</a>
 				<a href={ dash.PUrl(ctx, "/object-store/buckets") } class="btn btn-sm btn-outline-primary ms-2">
-					<i class="fas fa-cube me-1"></i>Manage Buckets
+					<i class="bi bi-box me-1"></i>Manage Buckets
 				</a>
 		} else {
 				<a href={ dash.PUrl(ctx, fileBrowserPathURL(data.CurrentPath)) } class="text-decoration-none text-primary">{ filepath.Base(data.CurrentPath) }</a>
@@ -108,16 +108,16 @@ templ FileBrowser(data dash.FileBrowserData) {
 				<div class="btn-group btn-group-sm" role="group">
 					if data.HasNextPage {
 						<a href={ dash.PUrl(ctx, fileBrowserPageURL(data.CurrentPath, data.LastFileName, data.PageSize)) } class="btn btn-outline-primary" title="Next page">
-							Next <i class="fas fa-angle-right"></i>
+							Next <i class="bi bi-chevron-right"></i>
 						</a>
 					} else {
 						<button class="btn btn-outline-secondary" disabled title="Next page">
-							Next <i class="fas fa-angle-right"></i>
+							Next <i class="bi bi-chevron-right"></i>
 						</button>
 					}
 					if data.ParentPath != data.CurrentPath {
 						<a href={ dash.PUrl(ctx, fileBrowserPathURL(data.ParentPath)) } class="btn btn-outline-secondary" title="Go up one directory">
-							<i class="fas fa-arrow-up"></i> Up
+							<i class="bi bi-arrow-up"></i> Up
 						</a>
 					}
 				</div>
@@ -149,12 +149,12 @@ templ FileBrowser(data dash.FileBrowserData) {
 									<td>
 										<div class="d-flex align-items-center">
 											if entry.IsDirectory {
-												<i class="fas fa-folder text-warning me-2"></i>
+												<i class="bi bi-folder text-warning me-2"></i>
 												<a href={ dash.PUrl(ctx, fileBrowserPathURL(entry.FullPath)) } class="text-decoration-none">
 													{ entry.Name }
 												</a>
 											} else {
-												<i class={ fmt.Sprintf("fas %s text-muted me-2", getFileIcon(entry.Mime)) }></i>
+												<i class={ fmt.Sprintf("bi %s text-muted me-2", getFileIcon(entry.Mime)) }></i>
 												<span>{ entry.Name }</span>
 											}
 										</div>
@@ -189,20 +189,25 @@ templ FileBrowser(data dash.FileBrowserData) {
 										<div class="btn-group btn-group-sm" role="group">
 											if !entry.IsDirectory {
 												<button type="button" class="btn btn-outline-primary btn-sm" title="Download" data-action="download" data-path={ entry.FullPath }>
-													<i class="fas fa-download"></i>
+													<i class="bi bi-download"></i>
 												</button>
 												<button type="button" class="btn btn-outline-info btn-sm" title="View" data-action="view" data-path={ entry.FullPath }>
-													<i class="fas fa-eye"></i>
+													<i class="bi bi-eye"></i>
 												</button>
+												if data.S3Endpoint != "" {
+													<button type="button" class="btn btn-outline-secondary btn-sm" title="Copy S3 URL" data-action="copy-url" data-url={ dash.S3ObjectURL(data.S3Endpoint, entry.FullPath) }>
+														<i class="bi bi-link"></i>
+													</button>
+												}
 											}
 											<button type="button" class="btn btn-outline-secondary btn-sm" title="Properties" data-action="properties" data-path={ entry.FullPath }>
-												<i class="fas fa-info-circle"></i>
+												<i class="bi bi-info-circle"></i>
 											</button>
 											<button type="button" class="btn btn-outline-success btn-sm" title="Export metadata" data-action="export-metadata" data-path={ entry.FullPath }>
-												<i class="fas fa-file-export"></i>
+												<i class="bi bi-file-earmark-arrow-up"></i>
 											</button>
 											<button type="button" class="btn btn-outline-danger btn-sm" title="Delete" data-action="delete" data-path={ entry.FullPath }>
-												<i class="fas fa-trash"></i>
+												<i class="bi bi-trash"></i>
 											</button>
 										</div>
 									</td>
@@ -213,7 +218,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 				</div>
 			} else {
 				<div class="text-center py-5">
-					<i class="fas fa-folder-open fa-3x text-muted mb-3"></i>
+					<i class="bi bi-folder2-open icon-3x text-muted mb-3"></i>
 					<h5 class="text-muted">Empty Directory</h5>
 					<p class="text-muted">This directory contains no files or subdirectories.</p>
 				</div>
@@ -242,11 +247,11 @@ templ FileBrowser(data dash.FileBrowserData) {
 
 					if data.HasNextPage {
 						<a href={ dash.PUrl(ctx, fileBrowserPageURL(data.CurrentPath, data.LastFileName, data.PageSize)) } class="btn btn-outline-primary">
-							Next <i class="fas fa-angle-right ms-1"></i>
+							Next <i class="bi bi-chevron-right ms-1"></i>
 						</a>
 					} else {
 						<button class="btn btn-outline-secondary" disabled>
-							Next <i class="fas fa-angle-right ms-1"></i>
+							Next <i class="bi bi-chevron-right ms-1"></i>
 						</button>
 					}
 				</div>
@@ -255,7 +260,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 	<div class="row">
 		<div class="col-12">
 			<small class="text-muted">
-				<i class="fas fa-clock me-1"></i>
+				<i class="bi bi-clock me-1"></i>
 				Last updated: { data.LastUpdated.Format("2006-01-02 15:04:05") }
 			</small>
 		</div>
@@ -267,7 +272,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="createFolderModalLabel">
-						<i class="fas fa-folder-plus me-2"></i>Create New Folder
+						<i class="bi bi-folder-plus me-2"></i>Create New Folder
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -287,7 +292,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 				<div class="modal-footer">
 					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 					<button type="button" class="btn btn-primary" onclick="submitCreateFolder()">
-						<i class="fas fa-folder-plus me-1"></i>Create Folder
+						<i class="bi bi-folder-plus me-1"></i>Create Folder
 					</button>
 				</div>
 			</div>
@@ -300,7 +305,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="uploadFileModalLabel">
-						<i class="fas fa-upload me-2"></i>Upload Files
+						<i class="bi bi-upload me-2"></i>Upload Files
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -338,7 +343,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 				<div class="modal-footer">
 					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 					<button type="button" class="btn btn-primary" onclick="submitUploadFile()">
-						<i class="fas fa-upload me-1"></i>Upload Files
+						<i class="bi bi-upload me-1"></i>Upload Files
 					</button>
 				</div>
 			</div>
@@ -363,8 +368,13 @@ templ FileBrowser(data dash.FileBrowserData) {
 			if (!button) return;
 			
 			const action = button.getAttribute('data-action');
+			if (action === 'copy-url') {
+				const url = button.getAttribute('data-url');
+				if (url) adminCopyToClipboard(url);
+				return;
+			}
 			const path = button.getAttribute('data-path');
-			
+
 			if (!path) return;
 			
 			switch(action) {
@@ -434,7 +444,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 			'<div class="modal-dialog modal-lg">' +
 			'<div class="modal-content">' +
 			'<div class="modal-header">' +
-			'<h5 class="modal-title"><i class="fas fa-info-circle me-2"></i>Properties: ' + (data.name || 'Unknown') + '</h5>' +
+			'<h5 class="modal-title"><i class="bi bi-info-circle me-2"></i>Properties: ' + (data.name || 'Unknown') + '</h5>' +
 			'<button type="button" class="btn-close" data-bs-dismiss="modal"></button>' +
 			'</div>' +
 			'<div class="modal-body">' +
@@ -467,7 +477,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 	function createFilePropertiesContent(data) {
 		let html = '<div class="row">' +
 			'<div class="col-12">' +
-			'<h6 class="text-primary"><i class="fas fa-file me-1"></i>Basic Information</h6>' +
+			'<h6 class="text-primary"><i class="bi bi-file-earmark me-1"></i>Basic Information</h6>' +
 			'<table class="table table-sm">' +
 			'<tr><td style="width: 120px;"><strong>Name:</strong></td><td>' + (data.name || 'N/A') + '</td></tr>' +
 			'<tr><td><strong>Full Path:</strong></td><td><code class="text-break">' + (data.full_path || 'N/A') + '</code></td></tr>' +
@@ -476,6 +486,10 @@ templ FileBrowser(data dash.FileBrowserData) {
 		if (!data.is_directory) {
 			html += '<tr><td><strong>Size:</strong></td><td>' + (data.size_formatted || (data.size ? formatBytes(data.size) : 'N/A')) + '</td></tr>' +
 				'<tr><td><strong>MIME Type:</strong></td><td>' + (data.mime_type || 'N/A') + '</td></tr>';
+			if (data.object_url) {
+				html += '<tr><td><strong>Object URL:</strong></td><td><code class="text-break">' + data.object_url + '</code>' +
+					' <button type="button" class="btn btn-outline-secondary btn-sm" title="Copy S3 URL" data-action="copy-url" data-url="' + data.object_url + '"><i class="bi bi-copy"></i></button></td></tr>';
+			}
 		}
 		
 		html += '</table>' +
@@ -483,7 +497,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 			'</div>' +
 			'<div class="row">' +
 			'<div class="col-md-6">' +
-			'<h6 class="text-primary"><i class="fas fa-clock me-1"></i>Timestamps</h6>' +
+			'<h6 class="text-primary"><i class="bi bi-clock me-1"></i>Timestamps</h6>' +
 			'<table class="table table-sm">';
 		
 		if (data.modified_time) {
@@ -496,7 +510,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 		html += '</table>' +
 			'</div>' +
 			'<div class="col-md-6">' +
-			'<h6 class="text-primary"><i class="fas fa-shield-alt me-1"></i>Permissions</h6>' +
+			'<h6 class="text-primary"><i class="bi bi-shield me-1"></i>Permissions</h6>' +
 			'<table class="table table-sm">';
 		
 		if (data.file_mode) {
@@ -517,7 +531,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 		// Add advanced info
 		html += '<div class="row">' +
 			'<div class="col-12">' +
-			'<h6 class="text-primary"><i class="fas fa-cog me-1"></i>Advanced</h6>' +
+			'<h6 class="text-primary"><i class="bi bi-gear me-1"></i>Advanced</h6>' +
 			'<table class="table table-sm">';
 		
 		if (data.chunk_count) {
@@ -536,7 +550,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 			const chunksToShow = data.chunks.slice(0, 5);
 			html += '<div class="row mt-3">' +
 				'<div class="col-12">' +
-				'<h6 class="text-primary"><i class="fas fa-puzzle-piece me-1"></i>Chunk Details' +
+				'<h6 class="text-primary"><i class="bi bi-puzzle me-1"></i>Chunk Details' +
 				(data.chunk_count > 5 ? ' (Top 5 of ' + data.chunk_count + ')' : ' (' + data.chunk_count + ')') +
 				'</h6>' +
 				'<div class="table-responsive" style="max-height: 200px; overflow-y: auto;">' +
@@ -571,7 +585,7 @@ templ FileBrowser(data dash.FileBrowserData) {
 		if (data.extended && Object.keys(data.extended).length > 0) {
 			html += '<div class="row">' +
 				'<div class="col-12">' +
-				'<h6 class="text-primary"><i class="fas fa-tags me-1"></i>Extended Attributes</h6>' +
+				'<h6 class="text-primary"><i class="bi bi-tags me-1"></i>Extended Attributes</h6>' +
 				'<table class="table table-sm">';
 			
 			for (const [key, value] of Object.entries(data.extended)) {
@@ -734,23 +748,23 @@ templ FileBrowser(data dash.FileBrowserData) {
 func getFileIcon(mime string) string {
 	switch {
 	case strings.HasPrefix(mime, "image/"):
-		return "fa-image"
+		return "bi-image"
 	case strings.HasPrefix(mime, "video/"):
-		return "fa-video"
+		return "bi-camera-video"
 	case strings.HasPrefix(mime, "audio/"):
-		return "fa-music"
+		return "bi-music-note"
 	case strings.HasPrefix(mime, "text/"):
-		return "fa-file-text"
+		return "bi-file-earmark-text"
 	case mime == "application/pdf":
-		return "fa-file-pdf"
+		return "bi-file-earmark-pdf"
 	case mime == "application/zip" || strings.Contains(mime, "archive"):
-		return "fa-file-archive"
+		return "bi-file-earmark-zip"
 	case mime == "application/json":
-		return "fa-file-code"
+		return "bi-file-earmark-code"
 	case strings.Contains(mime, "script") || strings.Contains(mime, "javascript"):
-		return "fa-file-code"
+		return "bi-file-earmark-code"
 	default:
-		return "fa-file"
+		return "bi-file-earmark"
 	}
 }
 
diff --git a/weed/admin/view/app/file_browser_templ.go b/weed/admin/view/app/file_browser_templ.go
index 1f1b3b53a2..3b64803672 100644
--- a/weed/admin/view/app/file_browser_templ.go
+++ b/weed/admin/view/app/file_browser_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -55,35 +55,35 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if data.IsTableBucketPath && data.TableBucketName != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<i class=\"fas fa-table me-2\"></i>Table Bucket: ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<i class=\"bi bi-table me-2\"></i>Table Bucket: ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var2 string
 			templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(data.TableBucketName)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 22, Col: 71}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 22, Col: 70}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else if data.IsBucketPath && data.BucketName != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<i class=\"fas fa-cube me-2\"></i>S3 Bucket: ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<i class=\"bi bi-box me-2\"></i>S3 Bucket: ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var3 string
 			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketName)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 24, Col: 62}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 24, Col: 60}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<i class=\"fas fa-folder-open me-2\"></i>File Browser")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<i class=\"bi bi-folder2-open me-2\"></i>File Browser")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -106,7 +106,7 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-arrow-left me-1\"></i>Back to Table Buckets</a> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-arrow-left me-1\"></i>Back to Table Buckets</a> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -124,12 +124,12 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-arrow-left me-1\"></i>Back to Buckets</a> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-arrow-left me-1\"></i>Back to Buckets</a> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"createFolder()\"><i class=\"fas fa-folder-plus me-1\"></i>New Folder</button> <button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"uploadFile()\"><i class=\"fas fa-upload me-1\"></i>Upload</button> <button type=\"button\" class=\"btn btn-sm btn-outline-danger\" id=\"deleteSelectedBtn\" onclick=\"confirmDeleteSelected()\" style=\"display: none;\"><i class=\"fas fa-trash me-1\"></i>Delete Selected</button> <button type=\"button\" class=\"btn btn-sm btn-outline-info\" onclick=\"exportFileList()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><!-- Breadcrumb Navigation --><nav aria-label=\"breadcrumb\" class=\"mb-3\"><ol class=\"breadcrumb\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"createFolder()\"><i class=\"bi bi-folder-plus me-1\"></i>New Folder</button> <button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"uploadFile()\"><i class=\"bi bi-upload me-1\"></i>Upload</button> <button type=\"button\" class=\"btn btn-sm btn-outline-danger\" id=\"deleteSelectedBtn\" onclick=\"confirmDeleteSelected()\" style=\"display: none;\"><i class=\"bi bi-trash me-1\"></i>Delete Selected</button> <button type=\"button\" class=\"btn btn-sm btn-outline-info\" onclick=\"exportFileList()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><!-- Breadcrumb Navigation --><nav aria-label=\"breadcrumb\" class=\"mb-3\"><ol class=\"breadcrumb\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -184,7 +184,7 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				if crumb.Name == "Root" {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<i class=\"fas fa-home me-1\"></i> ")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<i class=\"bi bi-house me-1\"></i> ")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -204,7 +204,7 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 				}
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</ol></nav><!-- File Listing --><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex justify-content-between align-items-center flex-wrap\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-folder-open me-2\"></i> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</ol></nav><!-- File Listing --><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex justify-content-between align-items-center flex-wrap\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-folder2-open me-2\"></i> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -253,7 +253,7 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "\" class=\"btn btn-sm btn-outline-primary ms-2\"><i class=\"fas fa-cube me-1\"></i>Manage Buckets</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "\" class=\"btn btn-sm btn-outline-primary ms-2\"><i class=\"bi bi-box me-1\"></i>Manage Buckets</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -364,12 +364,12 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "\" class=\"btn btn-outline-primary\" title=\"Next page\">Next <i class=\"fas fa-angle-right\"></i></a> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "\" class=\"btn btn-outline-primary\" title=\"Next page\">Next <i class=\"bi bi-chevron-right\"></i></a> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<button class=\"btn btn-outline-secondary\" disabled title=\"Next page\">Next <i class=\"fas fa-angle-right\"></i></button> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<button class=\"btn btn-outline-secondary\" disabled title=\"Next page\">Next <i class=\"bi bi-chevron-right\"></i></button> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -388,7 +388,7 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "\" class=\"btn btn-outline-secondary\" title=\"Go up one directory\"><i class=\"fas fa-arrow-up\"></i> Up</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "\" class=\"btn btn-outline-secondary\" title=\"Go up one directory\"><i class=\"bi bi-arrow-up\"></i> Up</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -408,11 +408,11 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var18 string
-				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(entry.FullPath)
+				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue(entry.FullPath)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 147, Col: 77}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -421,7 +421,7 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				if entry.IsDirectory {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "<i class=\"fas fa-folder text-warning me-2\"></i> <a href=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "<i class=\"bi bi-folder text-warning me-2\"></i> <a href=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -452,7 +452,7 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					var templ_7745c5c3_Var21 = []any{fmt.Sprintf("fas %s text-muted me-2", getFileIcon(entry.Mime))}
+					var templ_7745c5c3_Var21 = []any{fmt.Sprintf("bi %s text-muted me-2", getFileIcon(entry.Mime))}
 					templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var21...)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
@@ -462,11 +462,11 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var22 string
-					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var21).String())
+					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var21).String())
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 1, Col: 0}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -553,11 +553,11 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var27 string
-				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(entry.Mode)
+				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(entry.Mode)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 186, Col: 72}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -566,11 +566,11 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var28 string
-				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%t", entry.IsDirectory))
+				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%t", entry.IsDirectory))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 186, Col: 131}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -597,87 +597,106 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var30 string
-					templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(entry.FullPath)
+					templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.ResolveAttributeValue(entry.FullPath)
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 191, Col: 139}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var30)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "\"><i class=\"fas fa-download\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm\" title=\"View\" data-action=\"view\" data-path=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "\"><i class=\"bi bi-download\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm\" title=\"View\" data-action=\"view\" data-path=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var31 string
-					templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(entry.FullPath)
+					templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.ResolveAttributeValue(entry.FullPath)
 					if templ_7745c5c3_Err != nil {
 						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 194, Col: 128}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var31)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "\"><i class=\"fas fa-eye\"></i></button> ")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "\"><i class=\"bi bi-eye\"></i></button> ")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
+					if data.S3Endpoint != "" {
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "<button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" title=\"Copy S3 URL\" data-action=\"copy-url\" data-url=\"")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						var templ_7745c5c3_Var32 string
+						templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.ResolveAttributeValue(dash.S3ObjectURL(data.S3Endpoint, entry.FullPath))
+						if templ_7745c5c3_Err != nil {
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 198, Col: 179}
+						}
+						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var32)
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "\"><i class=\"bi bi-link\"></i></button> ")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "<button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" title=\"Properties\" data-action=\"properties\" data-path=\"")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var32 string
-				templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(entry.FullPath)
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 198, Col: 144}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "\"><i class=\"fas fa-info-circle\"></i></button> <button type=\"button\" class=\"btn btn-outline-success btn-sm\" title=\"Export metadata\" data-action=\"export-metadata\" data-path=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "<button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" title=\"Properties\" data-action=\"properties\" data-path=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var33 string
-				templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(entry.FullPath)
+				templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.ResolveAttributeValue(entry.FullPath)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 201, Col: 152}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 203, Col: 144}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var33)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\"><i class=\"fas fa-file-export\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm\" title=\"Delete\" data-action=\"delete\" data-path=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "\"><i class=\"bi bi-info-circle\"></i></button> <button type=\"button\" class=\"btn btn-outline-success btn-sm\" title=\"Export metadata\" data-action=\"export-metadata\" data-path=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var34 string
-				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(entry.FullPath)
+				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.ResolveAttributeValue(entry.FullPath)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 204, Col: 133}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 206, Col: 152}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var34)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "\"><i class=\"bi bi-file-earmark-arrow-up\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm\" title=\"Delete\" data-action=\"delete\" data-path=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var35 string
+				templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.ResolveAttributeValue(entry.FullPath)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 209, Col: 133}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var35)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "</tbody></table></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "</tbody></table></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "<div class=\"text-center py-5\"><i class=\"fas fa-folder-open fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">Empty Directory</h5><p class=\"text-muted\">This directory contains no files or subdirectories.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "<div class=\"text-center py-5\"><i class=\"bi bi-folder2-open icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">Empty Directory</h5><p class=\"text-muted\">This directory contains no files or subdirectories.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "</div></div><!-- Last Updated --><!-- Pagination Controls (Bottom) --><div class=\"row mb-3\"><div class=\"col-md-6\"><div class=\"d-flex align-items-center\"><label class=\"me-2 mb-0\">Show:</label> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "</div></div><!-- Last Updated --><!-- Pagination Controls (Bottom) --><div class=\"row mb-3\"><div class=\"col-md-6\"><div class=\"d-flex align-items-center\"><label class=\"me-2 mb-0\">Show:</label> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -685,123 +704,123 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "<select id=\"file-browser-page-size-bottom\" class=\"form-select form-select-sm\" style=\"width: auto;\" onchange=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "<select id=\"file-browser-page-size-bottom\" class=\"form-select form-select-sm\" style=\"width: auto;\" onchange=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var35 templ.ComponentScript = changePageSize(data.CurrentPath, data.CurrentLastFileName, "file-browser-page-size-bottom")
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var35.Call)
+		var templ_7745c5c3_Var36 templ.ComponentScript = changePageSize(data.CurrentPath, data.CurrentLastFileName, "file-browser-page-size-bottom")
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var36.Call)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "\"><option value=\"20\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, "\"><option value=\"20\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.PageSize == 20 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, " selected")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, ">20</option> <option value=\"50\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if data.PageSize == 50 {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, " selected")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, ">50</option> <option value=\"100\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, ">20</option> <option value=\"50\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if data.PageSize == 100 {
+		if data.PageSize == 50 {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, " selected")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, ">100</option> <option value=\"200\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, ">50</option> <option value=\"100\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if data.PageSize == 200 {
+		if data.PageSize == 100 {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, " selected")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, ">200</option></select> <span class=\"ms-2 text-muted\">entries per page</span></div></div><div class=\"col-md-6 text-end\"><div class=\"btn-group btn-group-sm\" role=\"group\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, ">100</option> <option value=\"200\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if data.PageSize == 200 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, " selected")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, ">200</option></select> <span class=\"ms-2 text-muted\">entries per page</span></div></div><div class=\"col-md-6 text-end\"><div class=\"btn-group btn-group-sm\" role=\"group\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.HasNextPage {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "<a href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "<a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var36 templ.SafeURL
-			templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fileBrowserPageURL(data.CurrentPath, data.LastFileName, data.PageSize)))
+			var templ_7745c5c3_Var37 templ.SafeURL
+			templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fileBrowserPageURL(data.CurrentPath, data.LastFileName, data.PageSize)))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 244, Col: 102}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 249, Col: 102}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "\" class=\"btn btn-outline-primary\">Next <i class=\"fas fa-angle-right ms-1\"></i></a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "\" class=\"btn btn-outline-primary\">Next <i class=\"bi bi-chevron-right ms-1\"></i></a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "<button class=\"btn btn-outline-secondary\" disabled>Next <i class=\"fas fa-angle-right ms-1\"></i></button>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "<button class=\"btn btn-outline-secondary\" disabled>Next <i class=\"bi bi-chevron-right ms-1\"></i></button>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "</div></div></div><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var37 string
-		templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 259, Col: 66}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "</small></div></div><!-- Create Folder Modal --><div class=\"modal fade\" id=\"createFolderModal\" tabindex=\"-1\" aria-labelledby=\"createFolderModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createFolderModalLabel\"><i class=\"fas fa-folder-plus me-2\"></i>Create New Folder</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"createFolderForm\"><div class=\"mb-3\"><label for=\"folderName\" class=\"form-label\">Folder Name</label> <input type=\"text\" class=\"form-control\" id=\"folderName\" name=\"folderName\" required placeholder=\"Enter folder name\" maxlength=\"255\"><div class=\"form-text\">Folder names cannot contain / or \\ characters.</div></div><input type=\"hidden\" id=\"currentPath\" name=\"currentPath\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "</div></div></div><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var38 string
-		templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(data.CurrentPath)
+		templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 284, Col: 87}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 264, Col: 66}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "\"></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"submitCreateFolder()\"><i class=\"fas fa-folder-plus me-1\"></i>Create Folder</button></div></div></div></div><!-- Upload File Modal --><div class=\"modal fade\" id=\"uploadFileModal\" tabindex=\"-1\" aria-labelledby=\"uploadFileModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"uploadFileModalLabel\"><i class=\"fas fa-upload me-2\"></i>Upload Files</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"uploadFileForm\" enctype=\"multipart/form-data\"><div class=\"mb-3\"><label for=\"fileInput\" class=\"form-label\">Select Files</label> <input type=\"file\" class=\"form-control\" id=\"fileInput\" name=\"files\" multiple required><div class=\"form-text\">Choose one or more files to upload to the current directory. You can select multiple files by holding Ctrl (Cmd on Mac) while clicking.</div></div><input type=\"hidden\" id=\"uploadPath\" name=\"path\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "</small></div></div><!-- Create Folder Modal --><div class=\"modal fade\" id=\"createFolderModal\" tabindex=\"-1\" aria-labelledby=\"createFolderModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createFolderModalLabel\"><i class=\"bi bi-folder-plus me-2\"></i>Create New Folder</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"createFolderForm\"><div class=\"mb-3\"><label for=\"folderName\" class=\"form-label\">Folder Name</label> <input type=\"text\" class=\"form-control\" id=\"folderName\" name=\"folderName\" required placeholder=\"Enter folder name\" maxlength=\"255\"><div class=\"form-text\">Folder names cannot contain / or \\ characters.</div></div><input type=\"hidden\" id=\"currentPath\" name=\"currentPath\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var39 string
-		templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(data.CurrentPath)
+		templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.CurrentPath)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 316, Col: 79}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 289, Col: 87}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var39)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "\"><!-- File List Preview --><div id=\"fileListPreview\" class=\"mb-3\" style=\"display: none;\"><label class=\"form-label\">Selected Files:</label><div id=\"selectedFilesList\" class=\"border rounded p-2 bg-light\"><!-- Files will be listed here --></div></div><!-- Upload Progress --><div class=\"mb-3\" id=\"uploadProgress\" style=\"display: none;\"><label class=\"form-label\">Upload Progress:</label><div class=\"progress mb-2\"><div class=\"progress-bar progress-bar-striped progress-bar-animated\" role=\"progressbar\" style=\"width: 0%\" aria-valuenow=\"0\" aria-valuemin=\"0\" aria-valuemax=\"100\">0%</div></div><div id=\"uploadStatus\" class=\"small text-muted\">Preparing upload...</div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"submitUploadFile()\"><i class=\"fas fa-upload me-1\"></i>Upload Files</button></div></div></div></div><!-- JavaScript for file browser functionality --><script>\n\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t// Format permissions in the main table\n\t\tdocument.querySelectorAll('.permissions-display').forEach(element => {\n\t\t\tconst mode = element.getAttribute('data-mode');\n\t\t\tconst isDirectory = element.getAttribute('data-is-directory') === 'true';\n\t\t\tif (mode) {\n\t\t\t\telement.textContent = formatPermissions(mode, isDirectory);\n\t\t\t}\n\t\t});\n\t\t\n\t\t// Handle file browser action buttons (download, view, properties, export-metadata, delete)\n\t\tdocument.addEventListener('click', function(e) {\n\t\t\tconst button = e.target.closest('[data-action]');\n\t\t\tif (!button) return;\n\t\t\t\n\t\t\tconst action = button.getAttribute('data-action');\n\t\t\tconst path = button.getAttribute('data-path');\n\t\t\t\n\t\t\tif (!path) return;\n\t\t\t\n\t\t\tswitch(action) {\n\t\t\t\tcase 'download':\n\t\t\t\t\tdownloadFile(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'view':\n\t\t\t\t\tviewFile(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'properties':\n\t\t\t\t\tshowFileProperties(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'export-metadata':\n\t\t\t\t\texportMetadata(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'delete':\n\t\t\t\t\tconst fileName = path.split('/').pop();\n\t\t\t\t\tshowDeleteConfirm(fileName, function() {\n\t\t\t\t\t\tdeleteFile(path);\n\t\t\t\t\t}, `Are you sure you want to delete \"${fileName}\"? This action cannot be undone.`);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t});\n\t\t\n\t\t// Initialize file manager event handlers from admin.js\n\t\tif (typeof setupFileManagerEventHandlers === 'function') {\n\t\t\tsetupFileManagerEventHandlers();\n\t\t}\n\t});\n\t\n\t// File browser specific functions\n\tfunction downloadFile(path) {\n\t\t// Open download URL in new tab\n\t\twindow.open((window.__BASE_PATH__ || '') + '/api/files/download?path=' + encodeURIComponent(path), '_blank');\n\t}\n\n\tfunction viewFile(path) {\n\t\t// Open file viewer in new tab\n\t\twindow.open((window.__BASE_PATH__ || '') + '/api/files/view?path=' + encodeURIComponent(path), '_blank');\n\t}\n\n\tfunction exportMetadata(path) {\n\t\t// Download metadata as an fs.meta.load-compatible .meta.gz\n\t\twindow.open((window.__BASE_PATH__ || '') + '/api/files/metadata?path=' + encodeURIComponent(path), '_blank');\n\t}\n\n\tfunction showFileProperties(path) {\n\t\t// Fetch file properties and show in modal\n\t\tfetch((window.__BASE_PATH__ || '') + '/api/files/properties?path=' + encodeURIComponent(path))\n\t\t\t.then(response => response.json())\n\t\t\t.then(data => {\n\t\t\t\tif (data.error) {\n\t\t\t\t\tshowAlert('Error loading file properties: ' + data.error, 'error');\n\t\t\t\t} else {\n\t\t\t\t\tdisplayFileProperties(data);\n\t\t\t\t}\n\t\t\t})\n\t\t\t.catch(error => {\n\t\t\t\tconsole.error('Error fetching file properties:', error);\n\t\t\t\tshowAlert('Error loading file properties: ' + error.message, 'error');\n\t\t\t});\n\t}\n\t\n\tfunction displayFileProperties(data) {\n\t\t// Create a comprehensive modal for file properties\n\t\tconst modalHtml = '<div class=\"modal fade\" id=\"filePropertiesModal\" tabindex=\"-1\">' +\n\t\t\t'<div class=\"modal-dialog modal-lg\">' +\n\t\t\t'<div class=\"modal-content\">' +\n\t\t\t'<div class=\"modal-header\">' +\n\t\t\t'<h5 class=\"modal-title\"><i class=\"fas fa-info-circle me-2\"></i>Properties: ' + (data.name || 'Unknown') + '</h5>' +\n\t\t\t'<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-body\">' +\n\t\t\tcreateFilePropertiesContent(data) +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-footer\">' +\n\t\t\t'<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Remove existing modal if present\n\t\tconst existingModal = document.getElementById('filePropertiesModal');\n\t\tif (existingModal) {\n\t\t\texistingModal.remove();\n\t\t}\n\t\t\n\t\t// Add modal to body and show\n\t\tdocument.body.insertAdjacentHTML('beforeend', modalHtml);\n\t\tconst modal = new bootstrap.Modal(document.getElementById('filePropertiesModal'));\n\t\tmodal.show();\n\t\t\n\t\t// Remove modal when hidden\n\t\tdocument.getElementById('filePropertiesModal').addEventListener('hidden.bs.modal', function() {\n\t\t\tthis.remove();\n\t\t});\n\t}\n\t\n\tfunction createFilePropertiesContent(data) {\n\t\tlet html = '<div class=\"row\">' +\n\t\t\t'<div class=\"col-12\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-file me-1\"></i>Basic Information</h6>' +\n\t\t\t'<table class=\"table table-sm\">' +\n\t\t\t'<tr><td style=\"width: 120px;\"><strong>Name:</strong></td><td>' + (data.name || 'N/A') + '</td></tr>' +\n\t\t\t'<tr><td><strong>Full Path:</strong></td><td><code class=\"text-break\">' + (data.full_path || 'N/A') + '</code></td></tr>' +\n\t\t\t'<tr><td><strong>Type:</strong></td><td>' + (data.is_directory ? 'Directory' : 'File') + '</td></tr>';\n\t\t\n\t\tif (!data.is_directory) {\n\t\t\thtml += '<tr><td><strong>Size:</strong></td><td>' + (data.size_formatted || (data.size ? formatBytes(data.size) : 'N/A')) + '</td></tr>' +\n\t\t\t\t'<tr><td><strong>MIME Type:</strong></td><td>' + (data.mime_type || 'N/A') + '</td></tr>';\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"row\">' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-clock me-1\"></i>Timestamps</h6>' +\n\t\t\t'<table class=\"table table-sm\">';\n\t\t\n\t\tif (data.modified_time) {\n\t\t\thtml += '<tr><td><strong>Modified:</strong></td><td>' + data.modified_time + '</td></tr>';\n\t\t}\n\t\tif (data.created_time) {\n\t\t\thtml += '<tr><td><strong>Created:</strong></td><td>' + data.created_time + '</td></tr>';\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-shield-alt me-1\"></i>Permissions</h6>' +\n\t\t\t'<table class=\"table table-sm\">';\n\t\t\n\t\tif (data.file_mode) {\n\t\t\tconst rwxPermissions = formatPermissions(data.file_mode, data.is_directory);\n\t\t\thtml += '<tr><td><strong>Permissions:</strong></td><td><code>' + rwxPermissions + '</code></td></tr>';\n\t\t}\n\t\tif (data.uid !== undefined) {\n\t\t\thtml += '<tr><td><strong>User ID:</strong></td><td>' + data.uid + '</td></tr>';\n\t\t}\n\t\tif (data.gid !== undefined) {\n\t\t\thtml += '<tr><td><strong>Group ID:</strong></td><td>' + data.gid + '</td></tr>';\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Add advanced info\n\t\thtml += '<div class=\"row\">' +\n\t\t\t'<div class=\"col-12\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-cog me-1\"></i>Advanced</h6>' +\n\t\t\t'<table class=\"table table-sm\">';\n\t\t\n\t\tif (data.chunk_count) {\n\t\t\thtml += '<tr><td style=\"width: 120px;\"><strong>Chunks:</strong></td><td>' + data.chunk_count + '</td></tr>';\n\t\t}\n\t\tif (data.ttl_formatted) {\n\t\t\thtml += '<tr><td><strong>TTL:</strong></td><td>' + data.ttl_formatted + '</td></tr>';\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Add chunk details if available (show top 5)\n\t\tif (data.chunks && data.chunks.length > 0) {\n\t\t\tconst chunksToShow = data.chunks.slice(0, 5);\n\t\t\thtml += '<div class=\"row mt-3\">' +\n\t\t\t\t'<div class=\"col-12\">' +\n\t\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-puzzle-piece me-1\"></i>Chunk Details' +\n\t\t\t\t(data.chunk_count > 5 ? ' (Top 5 of ' + data.chunk_count + ')' : ' (' + data.chunk_count + ')') +\n\t\t\t\t'</h6>' +\n\t\t\t\t'<div class=\"table-responsive\" style=\"max-height: 200px; overflow-y: auto;\">' +\n\t\t\t\t'<table class=\"table table-sm table-striped\">' +\n\t\t\t\t'<thead>' +\n\t\t\t\t'<tr>' +\n\t\t\t\t'<th>File ID</th>' +\n\t\t\t\t'<th>Offset</th>' +\n\t\t\t\t'<th>Size</th>' +\n\t\t\t\t'<th>ETag</th>' +\n\t\t\t\t'</tr>' +\n\t\t\t\t'</thead>' +\n\t\t\t\t'<tbody>';\n\t\t\t\n\t\t\tchunksToShow.forEach(chunk => {\n\t\t\t\thtml += '<tr>' +\n\t\t\t\t\t'<td><code class=\"small\">' + (chunk.file_id || 'N/A') + '</code></td>' +\n\t\t\t\t\t'<td>' + formatBytes(chunk.offset || 0) + '</td>' +\n\t\t\t\t\t'<td>' + formatBytes(chunk.size || 0) + '</td>' +\n\t\t\t\t\t'<td><code class=\"small\">' + (chunk.e_tag || 'N/A') + '</code></td>' +\n\t\t\t\t\t'</tr>';\n\t\t\t});\n\t\t\t\n\t\t\thtml += '</tbody>' +\n\t\t\t\t'</table>' +\n\t\t\t\t'</div>' +\n\t\t\t\t'</div>' +\n\t\t\t\t'</div>';\n\t\t}\n\t\t\n\t\t// Add extended attributes if present\n\t\tif (data.extended && Object.keys(data.extended).length > 0) {\n\t\t\thtml += '<div class=\"row\">' +\n\t\t\t\t'<div class=\"col-12\">' +\n\t\t\t\t'<h6 class=\"text-primary\"><i class=\"fas fa-tags me-1\"></i>Extended Attributes</h6>' +\n\t\t\t\t'<table class=\"table table-sm\">';\n\t\t\t\n\t\t\tfor (const [key, value] of Object.entries(data.extended)) {\n\t\t\t\thtml += '<tr><td><strong>' + key + ':</strong></td><td>' + value + '</td></tr>';\n\t\t\t}\n\t\t\t\n\t\t\thtml += '</table>' +\n\t\t\t\t'</div>' +\n\t\t\t\t'</div>';\n\t\t}\n\t\t\n\t\treturn html;\n\t}\n\t\n\tfunction uploadFile() {\n\t\tconst modal = new bootstrap.Modal(document.getElementById('uploadFileModal'));\n\t\tmodal.show();\n\t}\n\t\n\tfunction toggleSelectAll() {\n\t\tconst selectAllCheckbox = document.getElementById('selectAll');\n\t\tconst checkboxes = document.querySelectorAll('.file-checkbox');\n\t\t\n\t\tcheckboxes.forEach(checkbox => {\n\t\t\tcheckbox.checked = selectAllCheckbox.checked;\n\t\t});\n\t\t\n\t\tupdateDeleteSelectedButton();\n\t}\n\t\n\tfunction updateDeleteSelectedButton() {\n\t\tconst checkboxes = document.querySelectorAll('.file-checkbox:checked');\n\t\tconst deleteBtn = document.getElementById('deleteSelectedBtn');\n\t\t\n\t\tif (checkboxes.length > 0) {\n\t\t\tdeleteBtn.style.display = 'inline-block';\n\t\t} else {\n\t\t\tdeleteBtn.style.display = 'none';\n\t\t}\n\t}\n\t\n\t// Helper function to format bytes\n\tfunction formatBytes(bytes) {\n\t\tif (bytes === 0) return '0 Bytes';\n\t\tconst k = 1024;\n\t\tconst sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n\t\tconst i = Math.floor(Math.log(bytes) / Math.log(k));\n\t\treturn parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n\t}\n\t\n\t// Helper function to format permissions in rwxrwxrwx format\n\tfunction formatPermissions(mode, isDirectory) {\n\t\t// Check if mode is already in rwxrwxrwx format (e.g., \"drwxr-xr-x\" or \"-rw-r--r--\")\n\t\tif (mode && (mode.startsWith('d') || mode.startsWith('-') || mode.startsWith('l')) && mode.length === 10) {\n\t\t\treturn mode; // Already formatted\n\t\t}\n\t\t\n\t\t// Convert to number - could be octal string or decimal\n\t\tlet permissions;\n\t\tif (typeof mode === 'string') {\n\t\t\t// Try parsing as octal first, then decimal\n\t\t\tif (mode.startsWith('0') && mode.length <= 4) {\n\t\t\t\tpermissions = parseInt(mode, 8);\n\t\t\t} else {\n\t\t\t\tpermissions = parseInt(mode, 10);\n\t\t\t}\n\t\t} else {\n\t\t\tpermissions = parseInt(mode, 10);\n\t\t}\n\t\t\n\t\tif (isNaN(permissions)) {\n\t\t\treturn isDirectory ? 'drwxr-xr-x' : '-rw-r--r--'; // Default fallback\n\t\t}\n\t\t\n\t\t// Handle Go's os.ModeDir conversion\n\t\t// Go's os.ModeDir is 0x80000000 (2147483648), but Unix S_IFDIR is 0o40000 (16384)\n\t\tlet fileType = '-';\n\t\t\n\t\t// Check for Go's os.ModeDir flag\n\t\tif (permissions & 0x80000000) {\n\t\t\tfileType = 'd';\n\t\t}\n\t\t// Check for standard Unix file type bits\n\t\telse if ((permissions & 0xF000) === 0x4000) { // S_IFDIR (0o40000)\n\t\t\tfileType = 'd';\n\t\t} else if ((permissions & 0xF000) === 0x8000) { // S_IFREG (0o100000)\n\t\t\tfileType = '-';\n\t\t} else if ((permissions & 0xF000) === 0xA000) { // S_IFLNK (0o120000)\n\t\t\tfileType = 'l';\n\t\t} else if ((permissions & 0xF000) === 0x2000) { // S_IFCHR (0o020000)\n\t\t\tfileType = 'c';\n\t\t} else if ((permissions & 0xF000) === 0x6000) { // S_IFBLK (0o060000)\n\t\t\tfileType = 'b';\n\t\t} else if ((permissions & 0xF000) === 0x1000) { // S_IFIFO (0o010000)\n\t\t\tfileType = 'p';\n\t\t} else if ((permissions & 0xF000) === 0xC000) { // S_IFSOCK (0o140000)\n\t\t\tfileType = 's';\n\t\t}\n\t\t// Fallback to isDirectory parameter if file type detection fails\n\t\telse if (isDirectory) {\n\t\t\tfileType = 'd';\n\t\t}\n\t\t\n\t\t// Permission bits (always use the lower 12 bits for permissions)\n\t\tconst owner = (permissions >> 6) & 7;\n\t\tconst group = (permissions >> 3) & 7;\n\t\tconst others = permissions & 7;\n\t\t\n\t\t// Convert number to rwx format\n\t\tfunction numToRwx(num) {\n\t\t\tconst r = (num & 4) ? 'r' : '-';\n\t\t\tconst w = (num & 2) ? 'w' : '-';\n\t\t\tconst x = (num & 1) ? 'x' : '-';\n\t\t\treturn r + w + x;\n\t\t}\n\t\t\n\t\treturn fileType + numToRwx(owner) + numToRwx(group) + numToRwx(others);\n\t}\n\t\n\tfunction exportFileList() {\n\t\t// Simple CSV export of file list\n\t\tconst rows = Array.from(document.querySelectorAll('#fileTable tbody tr')).map(row => {\n\t\t\tconst cells = row.querySelectorAll('td');\n\t\t\tif (cells.length > 1) {\n\t\t\t\treturn {\n\t\t\t\t\tname: cells[1].textContent.trim(),\n\t\t\t\t\tsize: cells[2].textContent.trim(),\n\t\t\t\t\ttype: cells[3].textContent.trim(),\n\t\t\t\t\tmodified: cells[4].textContent.trim(),\n\t\t\t\t\tpermissions: cells[5].textContent.trim()\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn null;\n\t\t}).filter(row => row !== null);\n\t\t\n\t\tconst csvContent = \"data:text/csv;charset=utf-8,\" + \n\t\t\t\"Name,Size,Type,Modified,Permissions\\n\" +\n\t\t\trows.map(r => '\"' + r.name + '\",\"' + r.size + '\",\"' + r.type + '\",\"' + r.modified + '\",\"' + r.permissions + '\"').join(\"\\n\");\n\t\t\n\t\tconst encodedUri = encodeURI(csvContent);\n\t\tconst link = document.createElement(\"a\");\n\t\tlink.setAttribute(\"href\", encodedUri);\n\t\tlink.setAttribute(\"download\", \"files.csv\");\n\t\tdocument.body.appendChild(link);\n\t\tlink.click();\n\t\tdocument.body.removeChild(link);\n\t}\n\t\n\t// Handle file checkbox changes\n\tdocument.addEventListener('change', function(e) {\n\t\tif (e.target.classList.contains('file-checkbox')) {\n\t\t\tupdateDeleteSelectedButton();\n\t\t}\n\t});\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "\"></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"submitCreateFolder()\"><i class=\"bi bi-folder-plus me-1\"></i>Create Folder</button></div></div></div></div><!-- Upload File Modal --><div class=\"modal fade\" id=\"uploadFileModal\" tabindex=\"-1\" aria-labelledby=\"uploadFileModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"uploadFileModalLabel\"><i class=\"bi bi-upload me-2\"></i>Upload Files</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"uploadFileForm\" enctype=\"multipart/form-data\"><div class=\"mb-3\"><label for=\"fileInput\" class=\"form-label\">Select Files</label> <input type=\"file\" class=\"form-control\" id=\"fileInput\" name=\"files\" multiple required><div class=\"form-text\">Choose one or more files to upload to the current directory. You can select multiple files by holding Ctrl (Cmd on Mac) while clicking.</div></div><input type=\"hidden\" id=\"uploadPath\" name=\"path\" value=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var40 string
+		templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.CurrentPath)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/file_browser.templ`, Line: 321, Col: 79}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var40)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\"><!-- File List Preview --><div id=\"fileListPreview\" class=\"mb-3\" style=\"display: none;\"><label class=\"form-label\">Selected Files:</label><div id=\"selectedFilesList\" class=\"border rounded p-2 bg-light\"><!-- Files will be listed here --></div></div><!-- Upload Progress --><div class=\"mb-3\" id=\"uploadProgress\" style=\"display: none;\"><label class=\"form-label\">Upload Progress:</label><div class=\"progress mb-2\"><div class=\"progress-bar progress-bar-striped progress-bar-animated\" role=\"progressbar\" style=\"width: 0%\" aria-valuenow=\"0\" aria-valuemin=\"0\" aria-valuemax=\"100\">0%</div></div><div id=\"uploadStatus\" class=\"small text-muted\">Preparing upload...</div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"submitUploadFile()\"><i class=\"bi bi-upload me-1\"></i>Upload Files</button></div></div></div></div><!-- JavaScript for file browser functionality --><script>\n\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t// Format permissions in the main table\n\t\tdocument.querySelectorAll('.permissions-display').forEach(element => {\n\t\t\tconst mode = element.getAttribute('data-mode');\n\t\t\tconst isDirectory = element.getAttribute('data-is-directory') === 'true';\n\t\t\tif (mode) {\n\t\t\t\telement.textContent = formatPermissions(mode, isDirectory);\n\t\t\t}\n\t\t});\n\t\t\n\t\t// Handle file browser action buttons (download, view, properties, export-metadata, delete)\n\t\tdocument.addEventListener('click', function(e) {\n\t\t\tconst button = e.target.closest('[data-action]');\n\t\t\tif (!button) return;\n\t\t\t\n\t\t\tconst action = button.getAttribute('data-action');\n\t\t\tif (action === 'copy-url') {\n\t\t\t\tconst url = button.getAttribute('data-url');\n\t\t\t\tif (url) adminCopyToClipboard(url);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst path = button.getAttribute('data-path');\n\n\t\t\tif (!path) return;\n\t\t\t\n\t\t\tswitch(action) {\n\t\t\t\tcase 'download':\n\t\t\t\t\tdownloadFile(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'view':\n\t\t\t\t\tviewFile(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'properties':\n\t\t\t\t\tshowFileProperties(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'export-metadata':\n\t\t\t\t\texportMetadata(path);\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'delete':\n\t\t\t\t\tconst fileName = path.split('/').pop();\n\t\t\t\t\tshowDeleteConfirm(fileName, function() {\n\t\t\t\t\t\tdeleteFile(path);\n\t\t\t\t\t}, `Are you sure you want to delete \"${fileName}\"? This action cannot be undone.`);\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t});\n\t\t\n\t\t// Initialize file manager event handlers from admin.js\n\t\tif (typeof setupFileManagerEventHandlers === 'function') {\n\t\t\tsetupFileManagerEventHandlers();\n\t\t}\n\t});\n\t\n\t// File browser specific functions\n\tfunction downloadFile(path) {\n\t\t// Open download URL in new tab\n\t\twindow.open((window.__BASE_PATH__ || '') + '/api/files/download?path=' + encodeURIComponent(path), '_blank');\n\t}\n\n\tfunction viewFile(path) {\n\t\t// Open file viewer in new tab\n\t\twindow.open((window.__BASE_PATH__ || '') + '/api/files/view?path=' + encodeURIComponent(path), '_blank');\n\t}\n\n\tfunction exportMetadata(path) {\n\t\t// Download metadata as an fs.meta.load-compatible .meta.gz\n\t\twindow.open((window.__BASE_PATH__ || '') + '/api/files/metadata?path=' + encodeURIComponent(path), '_blank');\n\t}\n\n\tfunction showFileProperties(path) {\n\t\t// Fetch file properties and show in modal\n\t\tfetch((window.__BASE_PATH__ || '') + '/api/files/properties?path=' + encodeURIComponent(path))\n\t\t\t.then(response => response.json())\n\t\t\t.then(data => {\n\t\t\t\tif (data.error) {\n\t\t\t\t\tshowAlert('Error loading file properties: ' + data.error, 'error');\n\t\t\t\t} else {\n\t\t\t\t\tdisplayFileProperties(data);\n\t\t\t\t}\n\t\t\t})\n\t\t\t.catch(error => {\n\t\t\t\tconsole.error('Error fetching file properties:', error);\n\t\t\t\tshowAlert('Error loading file properties: ' + error.message, 'error');\n\t\t\t});\n\t}\n\t\n\tfunction displayFileProperties(data) {\n\t\t// Create a comprehensive modal for file properties\n\t\tconst modalHtml = '<div class=\"modal fade\" id=\"filePropertiesModal\" tabindex=\"-1\">' +\n\t\t\t'<div class=\"modal-dialog modal-lg\">' +\n\t\t\t'<div class=\"modal-content\">' +\n\t\t\t'<div class=\"modal-header\">' +\n\t\t\t'<h5 class=\"modal-title\"><i class=\"bi bi-info-circle me-2\"></i>Properties: ' + (data.name || 'Unknown') + '</h5>' +\n\t\t\t'<button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-body\">' +\n\t\t\tcreateFilePropertiesContent(data) +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"modal-footer\">' +\n\t\t\t'<button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Remove existing modal if present\n\t\tconst existingModal = document.getElementById('filePropertiesModal');\n\t\tif (existingModal) {\n\t\t\texistingModal.remove();\n\t\t}\n\t\t\n\t\t// Add modal to body and show\n\t\tdocument.body.insertAdjacentHTML('beforeend', modalHtml);\n\t\tconst modal = new bootstrap.Modal(document.getElementById('filePropertiesModal'));\n\t\tmodal.show();\n\t\t\n\t\t// Remove modal when hidden\n\t\tdocument.getElementById('filePropertiesModal').addEventListener('hidden.bs.modal', function() {\n\t\t\tthis.remove();\n\t\t});\n\t}\n\t\n\tfunction createFilePropertiesContent(data) {\n\t\tlet html = '<div class=\"row\">' +\n\t\t\t'<div class=\"col-12\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-file-earmark me-1\"></i>Basic Information</h6>' +\n\t\t\t'<table class=\"table table-sm\">' +\n\t\t\t'<tr><td style=\"width: 120px;\"><strong>Name:</strong></td><td>' + (data.name || 'N/A') + '</td></tr>' +\n\t\t\t'<tr><td><strong>Full Path:</strong></td><td><code class=\"text-break\">' + (data.full_path || 'N/A') + '</code></td></tr>' +\n\t\t\t'<tr><td><strong>Type:</strong></td><td>' + (data.is_directory ? 'Directory' : 'File') + '</td></tr>';\n\t\t\n\t\tif (!data.is_directory) {\n\t\t\thtml += '<tr><td><strong>Size:</strong></td><td>' + (data.size_formatted || (data.size ? formatBytes(data.size) : 'N/A')) + '</td></tr>' +\n\t\t\t\t'<tr><td><strong>MIME Type:</strong></td><td>' + (data.mime_type || 'N/A') + '</td></tr>';\n\t\t\tif (data.object_url) {\n\t\t\t\thtml += '<tr><td><strong>Object URL:</strong></td><td><code class=\"text-break\">' + data.object_url + '</code>' +\n\t\t\t\t\t' <button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" title=\"Copy S3 URL\" data-action=\"copy-url\" data-url=\"' + data.object_url + '\"><i class=\"bi bi-copy\"></i></button></td></tr>';\n\t\t\t}\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"row\">' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-clock me-1\"></i>Timestamps</h6>' +\n\t\t\t'<table class=\"table table-sm\">';\n\t\t\n\t\tif (data.modified_time) {\n\t\t\thtml += '<tr><td><strong>Modified:</strong></td><td>' + data.modified_time + '</td></tr>';\n\t\t}\n\t\tif (data.created_time) {\n\t\t\thtml += '<tr><td><strong>Created:</strong></td><td>' + data.created_time + '</td></tr>';\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'<div class=\"col-md-6\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-shield me-1\"></i>Permissions</h6>' +\n\t\t\t'<table class=\"table table-sm\">';\n\t\t\n\t\tif (data.file_mode) {\n\t\t\tconst rwxPermissions = formatPermissions(data.file_mode, data.is_directory);\n\t\t\thtml += '<tr><td><strong>Permissions:</strong></td><td><code>' + rwxPermissions + '</code></td></tr>';\n\t\t}\n\t\tif (data.uid !== undefined) {\n\t\t\thtml += '<tr><td><strong>User ID:</strong></td><td>' + data.uid + '</td></tr>';\n\t\t}\n\t\tif (data.gid !== undefined) {\n\t\t\thtml += '<tr><td><strong>Group ID:</strong></td><td>' + data.gid + '</td></tr>';\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Add advanced info\n\t\thtml += '<div class=\"row\">' +\n\t\t\t'<div class=\"col-12\">' +\n\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-gear me-1\"></i>Advanced</h6>' +\n\t\t\t'<table class=\"table table-sm\">';\n\t\t\n\t\tif (data.chunk_count) {\n\t\t\thtml += '<tr><td style=\"width: 120px;\"><strong>Chunks:</strong></td><td>' + data.chunk_count + '</td></tr>';\n\t\t}\n\t\tif (data.ttl_formatted) {\n\t\t\thtml += '<tr><td><strong>TTL:</strong></td><td>' + data.ttl_formatted + '</td></tr>';\n\t\t}\n\t\t\n\t\thtml += '</table>' +\n\t\t\t'</div>' +\n\t\t\t'</div>';\n\t\t\n\t\t// Add chunk details if available (show top 5)\n\t\tif (data.chunks && data.chunks.length > 0) {\n\t\t\tconst chunksToShow = data.chunks.slice(0, 5);\n\t\t\thtml += '<div class=\"row mt-3\">' +\n\t\t\t\t'<div class=\"col-12\">' +\n\t\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-puzzle me-1\"></i>Chunk Details' +\n\t\t\t\t(data.chunk_count > 5 ? ' (Top 5 of ' + data.chunk_count + ')' : ' (' + data.chunk_count + ')') +\n\t\t\t\t'</h6>' +\n\t\t\t\t'<div class=\"table-responsive\" style=\"max-height: 200px; overflow-y: auto;\">' +\n\t\t\t\t'<table class=\"table table-sm table-striped\">' +\n\t\t\t\t'<thead>' +\n\t\t\t\t'<tr>' +\n\t\t\t\t'<th>File ID</th>' +\n\t\t\t\t'<th>Offset</th>' +\n\t\t\t\t'<th>Size</th>' +\n\t\t\t\t'<th>ETag</th>' +\n\t\t\t\t'</tr>' +\n\t\t\t\t'</thead>' +\n\t\t\t\t'<tbody>';\n\t\t\t\n\t\t\tchunksToShow.forEach(chunk => {\n\t\t\t\thtml += '<tr>' +\n\t\t\t\t\t'<td><code class=\"small\">' + (chunk.file_id || 'N/A') + '</code></td>' +\n\t\t\t\t\t'<td>' + formatBytes(chunk.offset || 0) + '</td>' +\n\t\t\t\t\t'<td>' + formatBytes(chunk.size || 0) + '</td>' +\n\t\t\t\t\t'<td><code class=\"small\">' + (chunk.e_tag || 'N/A') + '</code></td>' +\n\t\t\t\t\t'</tr>';\n\t\t\t});\n\t\t\t\n\t\t\thtml += '</tbody>' +\n\t\t\t\t'</table>' +\n\t\t\t\t'</div>' +\n\t\t\t\t'</div>' +\n\t\t\t\t'</div>';\n\t\t}\n\t\t\n\t\t// Add extended attributes if present\n\t\tif (data.extended && Object.keys(data.extended).length > 0) {\n\t\t\thtml += '<div class=\"row\">' +\n\t\t\t\t'<div class=\"col-12\">' +\n\t\t\t\t'<h6 class=\"text-primary\"><i class=\"bi bi-tags me-1\"></i>Extended Attributes</h6>' +\n\t\t\t\t'<table class=\"table table-sm\">';\n\t\t\t\n\t\t\tfor (const [key, value] of Object.entries(data.extended)) {\n\t\t\t\thtml += '<tr><td><strong>' + key + ':</strong></td><td>' + value + '</td></tr>';\n\t\t\t}\n\t\t\t\n\t\t\thtml += '</table>' +\n\t\t\t\t'</div>' +\n\t\t\t\t'</div>';\n\t\t}\n\t\t\n\t\treturn html;\n\t}\n\t\n\tfunction uploadFile() {\n\t\tconst modal = new bootstrap.Modal(document.getElementById('uploadFileModal'));\n\t\tmodal.show();\n\t}\n\t\n\tfunction toggleSelectAll() {\n\t\tconst selectAllCheckbox = document.getElementById('selectAll');\n\t\tconst checkboxes = document.querySelectorAll('.file-checkbox');\n\t\t\n\t\tcheckboxes.forEach(checkbox => {\n\t\t\tcheckbox.checked = selectAllCheckbox.checked;\n\t\t});\n\t\t\n\t\tupdateDeleteSelectedButton();\n\t}\n\t\n\tfunction updateDeleteSelectedButton() {\n\t\tconst checkboxes = document.querySelectorAll('.file-checkbox:checked');\n\t\tconst deleteBtn = document.getElementById('deleteSelectedBtn');\n\t\t\n\t\tif (checkboxes.length > 0) {\n\t\t\tdeleteBtn.style.display = 'inline-block';\n\t\t} else {\n\t\t\tdeleteBtn.style.display = 'none';\n\t\t}\n\t}\n\t\n\t// Helper function to format bytes\n\tfunction formatBytes(bytes) {\n\t\tif (bytes === 0) return '0 Bytes';\n\t\tconst k = 1024;\n\t\tconst sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n\t\tconst i = Math.floor(Math.log(bytes) / Math.log(k));\n\t\treturn parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n\t}\n\t\n\t// Helper function to format permissions in rwxrwxrwx format\n\tfunction formatPermissions(mode, isDirectory) {\n\t\t// Check if mode is already in rwxrwxrwx format (e.g., \"drwxr-xr-x\" or \"-rw-r--r--\")\n\t\tif (mode && (mode.startsWith('d') || mode.startsWith('-') || mode.startsWith('l')) && mode.length === 10) {\n\t\t\treturn mode; // Already formatted\n\t\t}\n\t\t\n\t\t// Convert to number - could be octal string or decimal\n\t\tlet permissions;\n\t\tif (typeof mode === 'string') {\n\t\t\t// Try parsing as octal first, then decimal\n\t\t\tif (mode.startsWith('0') && mode.length <= 4) {\n\t\t\t\tpermissions = parseInt(mode, 8);\n\t\t\t} else {\n\t\t\t\tpermissions = parseInt(mode, 10);\n\t\t\t}\n\t\t} else {\n\t\t\tpermissions = parseInt(mode, 10);\n\t\t}\n\t\t\n\t\tif (isNaN(permissions)) {\n\t\t\treturn isDirectory ? 'drwxr-xr-x' : '-rw-r--r--'; // Default fallback\n\t\t}\n\t\t\n\t\t// Handle Go's os.ModeDir conversion\n\t\t// Go's os.ModeDir is 0x80000000 (2147483648), but Unix S_IFDIR is 0o40000 (16384)\n\t\tlet fileType = '-';\n\t\t\n\t\t// Check for Go's os.ModeDir flag\n\t\tif (permissions & 0x80000000) {\n\t\t\tfileType = 'd';\n\t\t}\n\t\t// Check for standard Unix file type bits\n\t\telse if ((permissions & 0xF000) === 0x4000) { // S_IFDIR (0o40000)\n\t\t\tfileType = 'd';\n\t\t} else if ((permissions & 0xF000) === 0x8000) { // S_IFREG (0o100000)\n\t\t\tfileType = '-';\n\t\t} else if ((permissions & 0xF000) === 0xA000) { // S_IFLNK (0o120000)\n\t\t\tfileType = 'l';\n\t\t} else if ((permissions & 0xF000) === 0x2000) { // S_IFCHR (0o020000)\n\t\t\tfileType = 'c';\n\t\t} else if ((permissions & 0xF000) === 0x6000) { // S_IFBLK (0o060000)\n\t\t\tfileType = 'b';\n\t\t} else if ((permissions & 0xF000) === 0x1000) { // S_IFIFO (0o010000)\n\t\t\tfileType = 'p';\n\t\t} else if ((permissions & 0xF000) === 0xC000) { // S_IFSOCK (0o140000)\n\t\t\tfileType = 's';\n\t\t}\n\t\t// Fallback to isDirectory parameter if file type detection fails\n\t\telse if (isDirectory) {\n\t\t\tfileType = 'd';\n\t\t}\n\t\t\n\t\t// Permission bits (always use the lower 12 bits for permissions)\n\t\tconst owner = (permissions >> 6) & 7;\n\t\tconst group = (permissions >> 3) & 7;\n\t\tconst others = permissions & 7;\n\t\t\n\t\t// Convert number to rwx format\n\t\tfunction numToRwx(num) {\n\t\t\tconst r = (num & 4) ? 'r' : '-';\n\t\t\tconst w = (num & 2) ? 'w' : '-';\n\t\t\tconst x = (num & 1) ? 'x' : '-';\n\t\t\treturn r + w + x;\n\t\t}\n\t\t\n\t\treturn fileType + numToRwx(owner) + numToRwx(group) + numToRwx(others);\n\t}\n\t\n\tfunction exportFileList() {\n\t\t// Simple CSV export of file list\n\t\tconst rows = Array.from(document.querySelectorAll('#fileTable tbody tr')).map(row => {\n\t\t\tconst cells = row.querySelectorAll('td');\n\t\t\tif (cells.length > 1) {\n\t\t\t\treturn {\n\t\t\t\t\tname: cells[1].textContent.trim(),\n\t\t\t\t\tsize: cells[2].textContent.trim(),\n\t\t\t\t\ttype: cells[3].textContent.trim(),\n\t\t\t\t\tmodified: cells[4].textContent.trim(),\n\t\t\t\t\tpermissions: cells[5].textContent.trim()\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn null;\n\t\t}).filter(row => row !== null);\n\t\t\n\t\tconst csvContent = \"data:text/csv;charset=utf-8,\" + \n\t\t\t\"Name,Size,Type,Modified,Permissions\\n\" +\n\t\t\trows.map(r => '\"' + r.name + '\",\"' + r.size + '\",\"' + r.type + '\",\"' + r.modified + '\",\"' + r.permissions + '\"').join(\"\\n\");\n\t\t\n\t\tconst encodedUri = encodeURI(csvContent);\n\t\tconst link = document.createElement(\"a\");\n\t\tlink.setAttribute(\"href\", encodedUri);\n\t\tlink.setAttribute(\"download\", \"files.csv\");\n\t\tdocument.body.appendChild(link);\n\t\tlink.click();\n\t\tdocument.body.removeChild(link);\n\t}\n\t\n\t// Handle file checkbox changes\n\tdocument.addEventListener('change', function(e) {\n\t\tif (e.target.classList.contains('file-checkbox')) {\n\t\t\tupdateDeleteSelectedButton();\n\t\t}\n\t});\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -812,23 +831,23 @@ func FileBrowser(data dash.FileBrowserData) templ.Component {
 func getFileIcon(mime string) string {
 	switch {
 	case strings.HasPrefix(mime, "image/"):
-		return "fa-image"
+		return "bi-image"
 	case strings.HasPrefix(mime, "video/"):
-		return "fa-video"
+		return "bi-camera-video"
 	case strings.HasPrefix(mime, "audio/"):
-		return "fa-music"
+		return "bi-music-note"
 	case strings.HasPrefix(mime, "text/"):
-		return "fa-file-text"
+		return "bi-file-earmark-text"
 	case mime == "application/pdf":
-		return "fa-file-pdf"
+		return "bi-file-earmark-pdf"
 	case mime == "application/zip" || strings.Contains(mime, "archive"):
-		return "fa-file-archive"
+		return "bi-file-earmark-zip"
 	case mime == "application/json":
-		return "fa-file-code"
+		return "bi-file-earmark-code"
 	case strings.Contains(mime, "script") || strings.Contains(mime, "javascript"):
-		return "fa-file-code"
+		return "bi-file-earmark-code"
 	default:
-		return "fa-file"
+		return "bi-file-earmark"
 	}
 }
 
diff --git a/weed/admin/view/app/groups.templ b/weed/admin/view/app/groups.templ
index 1e6cfab84b..683b4a5137 100644
--- a/weed/admin/view/app/groups.templ
+++ b/weed/admin/view/app/groups.templ
@@ -11,7 +11,7 @@ templ Groups(data dash.GroupsPageData) {
         <div class="d-sm-flex align-items-center justify-content-between mb-4">
             <div>
                 <h1 class="h3 mb-0 text-gray-800">
-                    <i class="fas fa-users-cog me-2"></i>Groups
+                    <i class="bi bi-people-fill me-2"></i>Groups
                 </h1>
                 <p class="mb-0 text-muted">Manage IAM groups for organizing users and policies</p>
             </div>
@@ -19,7 +19,7 @@ templ Groups(data dash.GroupsPageData) {
                 <button type="button" class="btn btn-primary"
                         data-bs-toggle="modal"
                         data-bs-target="#createGroupModal">
-                    <i class="fas fa-plus me-1"></i>Create Group
+                    <i class="bi bi-plus me-1"></i>Create Group
                 </button>
             </div>
         </div>
@@ -39,7 +39,7 @@ templ Groups(data dash.GroupsPageData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-users-cog fa-2x text-gray-300"></i>
+                                <i class="bi bi-people-fill icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -58,7 +58,7 @@ templ Groups(data dash.GroupsPageData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-check-circle fa-2x text-gray-300"></i>
+                                <i class="bi bi-check-circle icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -74,7 +74,7 @@ templ Groups(data dash.GroupsPageData) {
             <div class="card-body">
                 if len(data.Groups) == 0 {
                     <div class="text-center py-5 text-muted">
-                        <i class="fas fa-users-cog fa-3x mb-3"></i>
+                        <i class="bi bi-people-fill icon-3x mb-3"></i>
                         <p>No groups found. Create a group to get started.</p>
                     </div>
                 } else {
@@ -114,14 +114,14 @@ templ Groups(data dash.GroupsPageData) {
                                                     data-action="view"
                                                     aria-label={"View group " + group.Name}
                                                     title={"View " + group.Name}>
-                                                <i class="fas fa-eye"></i>
+                                                <i class="bi bi-eye"></i>
                                             </button>
                                             <button class="btn btn-sm btn-outline-danger"
                                                     data-group-name={group.Name}
                                                     data-action="delete"
                                                     aria-label={"Delete group " + group.Name}
                                                     title={"Delete " + group.Name}>
-                                                <i class="fas fa-trash"></i>
+                                                <i class="bi bi-trash"></i>
                                             </button>
                                         </td>
                                     </tr>
@@ -190,7 +190,7 @@ templ Groups(data dash.GroupsPageData) {
                                             }
                                         </select>
                                         <button class="btn btn-outline-primary" type="button" onclick="addMemberToGroup()">
-                                            <i class="fas fa-plus"></i> Add
+                                            <i class="bi bi-plus"></i> Add
                                         </button>
                                     </div>
                                 </div>
@@ -207,7 +207,7 @@ templ Groups(data dash.GroupsPageData) {
                                             }
                                         </select>
                                         <button class="btn btn-outline-primary" type="button" onclick="attachPolicyToGroup()">
-                                            <i class="fas fa-plus"></i> Attach
+                                            <i class="bi bi-plus"></i> Attach
                                         </button>
                                     </div>
                                 </div>
@@ -288,7 +288,7 @@ templ Groups(data dash.GroupsPageData) {
                         const btn = document.createElement('button');
                         btn.className = 'btn btn-sm btn-outline-danger';
                         btn.onclick = () => removeMember(member);
-                        btn.innerHTML = '<i class="fas fa-times"></i>';
+                        btn.innerHTML = '<i class="bi bi-x"></i>';
                         td2.appendChild(btn);
                     }
                 } else {
@@ -315,7 +315,7 @@ templ Groups(data dash.GroupsPageData) {
                         const btn = document.createElement('button');
                         btn.className = 'btn btn-sm btn-outline-danger';
                         btn.onclick = () => detachPolicy(policy);
-                        btn.innerHTML = '<i class="fas fa-times"></i>';
+                        btn.innerHTML = '<i class="bi bi-x"></i>';
                         td2.appendChild(btn);
                     }
                 } else {
diff --git a/weed/admin/view/app/groups_templ.go b/weed/admin/view/app/groups_templ.go
index 26619a9d11..fe774074c6 100644
--- a/weed/admin/view/app/groups_templ.go
+++ b/weed/admin/view/app/groups_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func Groups(data dash.GroupsPageData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"container-fluid\"><!-- Page Header --><div class=\"d-sm-flex align-items-center justify-content-between mb-4\"><div><h1 class=\"h3 mb-0 text-gray-800\"><i class=\"fas fa-users-cog me-2\"></i>Groups</h1><p class=\"mb-0 text-muted\">Manage IAM groups for organizing users and policies</p></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createGroupModal\"><i class=\"fas fa-plus me-1\"></i>Create Group</button></div></div><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Groups</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"container-fluid\"><!-- Page Header --><div class=\"d-sm-flex align-items-center justify-content-between mb-4\"><div><h1 class=\"h3 mb-0 text-gray-800\"><i class=\"bi bi-people-fill me-2\"></i>Groups</h1><p class=\"mb-0 text-muted\">Manage IAM groups for organizing users and policies</p></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createGroupModal\"><i class=\"bi bi-plus me-1\"></i>Create Group</button></div></div><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Groups</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func Groups(data dash.GroupsPageData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-users-cog fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Active Groups</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-people-fill icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Active Groups</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,12 +60,12 @@ func Groups(data dash.GroupsPageData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-check-circle fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Groups Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\">Groups</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-check-circle icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Groups Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\">Groups</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Groups) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<div class=\"text-center py-5 text-muted\"><i class=\"fas fa-users-cog fa-3x mb-3\"></i><p>No groups found. Create a group to get started.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<div class=\"text-center py-5 text-muted\"><i class=\"bi bi-people-fill icon-3x mb-3\"></i><p>No groups found. Create a group to get started.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -134,11 +134,11 @@ func Groups(data dash.GroupsPageData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var7 string
-				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(group.Name)
+				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.ResolveAttributeValue(group.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 113, Col: 79}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var7)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -147,11 +147,11 @@ func Groups(data dash.GroupsPageData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var8 string
-				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs("View group " + group.Name)
+				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.ResolveAttributeValue("View group " + group.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 115, Col: 90}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var8)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -160,24 +160,24 @@ func Groups(data dash.GroupsPageData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var9 string
-				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs("View " + group.Name)
+				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue("View " + group.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 116, Col: 79}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\"><i class=\"fas fa-eye\"></i></button> <button class=\"btn btn-sm btn-outline-danger\" data-group-name=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\"><i class=\"bi bi-eye\"></i></button> <button class=\"btn btn-sm btn-outline-danger\" data-group-name=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var10 string
-				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(group.Name)
+				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(group.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 120, Col: 79}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -186,11 +186,11 @@ func Groups(data dash.GroupsPageData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var11 string
-				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs("Delete group " + group.Name)
+				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.ResolveAttributeValue("Delete group " + group.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 122, Col: 92}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var11)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -199,15 +199,15 @@ func Groups(data dash.GroupsPageData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var12 string
-				templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs("Delete " + group.Name)
+				templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.ResolveAttributeValue("Delete " + group.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 123, Col: 81}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var12)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "\"><i class=\"fas fa-trash\"></i></button></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "\"><i class=\"bi bi-trash\"></i></button></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -227,11 +227,11 @@ func Groups(data dash.GroupsPageData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var13 string
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(user)
+			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(user)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 189, Col: 67}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -253,7 +253,7 @@ func Groups(data dash.GroupsPageData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</select> <button class=\"btn btn-outline-primary\" type=\"button\" onclick=\"addMemberToGroup()\"><i class=\"fas fa-plus\"></i> Add</button></div></div><div id=\"membersList\"></div></div><!-- Policies Tab --><div class=\"tab-pane fade\" id=\"policiesPane\" role=\"tabpanel\"><div class=\"mb-3\"><div class=\"input-group\"><select class=\"form-select\" id=\"attachPolicySelect\"><option value=\"\">Select policy to attach...</option> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</select> <button class=\"btn btn-outline-primary\" type=\"button\" onclick=\"addMemberToGroup()\"><i class=\"bi bi-plus\"></i> Add</button></div></div><div id=\"membersList\"></div></div><!-- Policies Tab --><div class=\"tab-pane fade\" id=\"policiesPane\" role=\"tabpanel\"><div class=\"mb-3\"><div class=\"input-group\"><select class=\"form-select\" id=\"attachPolicySelect\"><option value=\"\">Select policy to attach...</option> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -263,11 +263,11 @@ func Groups(data dash.GroupsPageData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var15 string
-			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(policy)
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(policy)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/groups.templ`, Line: 206, Col: 69}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -289,7 +289,7 @@ func Groups(data dash.GroupsPageData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</select> <button class=\"btn btn-outline-primary\" type=\"button\" onclick=\"attachPolicyToGroup()\"><i class=\"fas fa-plus\"></i> Attach</button></div></div><div id=\"policiesList\"></div></div><!-- Settings Tab --><div class=\"tab-pane fade\" id=\"settingsPane\" role=\"tabpanel\"><div class=\"form-check form-switch mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"groupEnabledSwitch\" checked onchange=\"toggleGroupStatus()\"> <label class=\"form-check-label\" for=\"groupEnabledSwitch\">Group Enabled</label></div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div></div><script>\n        // Groups page JavaScript\n        let currentGroupName = '';\n\n        async function createGroup() {\n            const name = document.getElementById('groupName').value.trim();\n            if (!name) {\n                showAlert('Group name is required', 'error');\n                return;\n            }\n            try {\n                const response = await fetch(basePath('/api/groups'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ name: name })\n                });\n                if (response.ok) {\n                    showAlert('Group created successfully', 'success');\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to create group: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to create group: ' + error.message, 'error');\n            }\n        }\n\n        async function viewGroup(name) {\n            currentGroupName = name;\n            document.getElementById('viewGroupTitle').textContent = 'Group: ' + name;\n            await refreshGroupDetails(name);\n            new bootstrap.Modal(document.getElementById('viewGroupModal')).show();\n        }\n\n        async function refreshGroupDetails(requestedName) {\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(requestedName)));\n                if (!response.ok) throw new Error('Failed to fetch group');\n                if (requestedName !== currentGroupName) return; // stale response\n                const group = await response.json();\n\n                // Render members using DOM APIs to prevent XSS\n                const membersList = document.getElementById('membersList');\n                membersList.innerHTML = '';\n                const membersTable = document.createElement('table');\n                membersTable.className = 'table table-sm';\n                const membersTbody = document.createElement('tbody');\n                if (group.members && group.members.length > 0) {\n                    for (const member of group.members) {\n                        const tr = membersTbody.insertRow();\n                        const td1 = tr.insertCell();\n                        td1.textContent = member;\n                        const td2 = tr.insertCell();\n                        const btn = document.createElement('button');\n                        btn.className = 'btn btn-sm btn-outline-danger';\n                        btn.onclick = () => removeMember(member);\n                        btn.innerHTML = '<i class=\"fas fa-times\"></i>';\n                        td2.appendChild(btn);\n                    }\n                } else {\n                    const tr = membersTbody.insertRow();\n                    const td = tr.insertCell();\n                    td.className = 'text-muted';\n                    td.textContent = 'No members';\n                }\n                membersTable.appendChild(membersTbody);\n                membersList.appendChild(membersTable);\n\n                // Render policies using DOM APIs to prevent XSS\n                const policiesList = document.getElementById('policiesList');\n                policiesList.innerHTML = '';\n                const policiesTable = document.createElement('table');\n                policiesTable.className = 'table table-sm';\n                const policiesTbody = document.createElement('tbody');\n                if (group.policy_names && group.policy_names.length > 0) {\n                    for (const policy of group.policy_names) {\n                        const tr = policiesTbody.insertRow();\n                        const td1 = tr.insertCell();\n                        td1.textContent = policy;\n                        const td2 = tr.insertCell();\n                        const btn = document.createElement('button');\n                        btn.className = 'btn btn-sm btn-outline-danger';\n                        btn.onclick = () => detachPolicy(policy);\n                        btn.innerHTML = '<i class=\"fas fa-times\"></i>';\n                        td2.appendChild(btn);\n                    }\n                } else {\n                    const tr = policiesTbody.insertRow();\n                    const td = tr.insertCell();\n                    td.className = 'text-muted';\n                    td.textContent = 'No policies attached';\n                }\n                policiesTable.appendChild(policiesTbody);\n                policiesList.appendChild(policiesTable);\n\n                // Update status toggle\n                document.getElementById('groupEnabledSwitch').checked = (group.status === 'enabled');\n            } catch (error) {\n                console.error('Error fetching group details:', error);\n            }\n        }\n\n        async function addMemberToGroup() {\n            const username = document.getElementById('addMemberSelect').value;\n            if (!username) return;\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/members'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ username: username })\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Member added', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to add member: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to add member: ' + error.message, 'error');\n            }\n        }\n\n        async function removeMember(username) {\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/members/' + encodeURIComponent(username)), {\n                    method: 'DELETE'\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Member removed', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to remove member: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to remove member: ' + error.message, 'error');\n            }\n        }\n\n        async function attachPolicyToGroup() {\n            const policyName = document.getElementById('attachPolicySelect').value;\n            if (!policyName) return;\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/policies'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ policy_name: policyName })\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Policy attached', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to attach policy: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to attach policy: ' + error.message, 'error');\n            }\n        }\n\n        async function detachPolicy(policyName) {\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/policies/' + encodeURIComponent(policyName)), {\n                    method: 'DELETE'\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Policy detached', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to detach policy: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to detach policy: ' + error.message, 'error');\n            }\n        }\n\n        async function toggleGroupStatus() {\n            const enabled = document.getElementById('groupEnabledSwitch').checked;\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/status'), {\n                    method: 'PUT',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ enabled: enabled })\n                });\n                if (response.ok) {\n                    showAlert('Group status updated', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to update status: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to update status: ' + error.message, 'error');\n            }\n        }\n\n        // Event delegation for group action buttons\n        document.addEventListener('click', function(e) {\n            const btn = e.target.closest('[data-action]');\n            if (!btn) return;\n            const name = btn.dataset.groupName;\n            if (!name) return;\n            if (btn.dataset.action === 'view') viewGroup(name);\n            else if (btn.dataset.action === 'delete') deleteGroup(name);\n        });\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</select> <button class=\"btn btn-outline-primary\" type=\"button\" onclick=\"attachPolicyToGroup()\"><i class=\"bi bi-plus\"></i> Attach</button></div></div><div id=\"policiesList\"></div></div><!-- Settings Tab --><div class=\"tab-pane fade\" id=\"settingsPane\" role=\"tabpanel\"><div class=\"form-check form-switch mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"groupEnabledSwitch\" checked onchange=\"toggleGroupStatus()\"> <label class=\"form-check-label\" for=\"groupEnabledSwitch\">Group Enabled</label></div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div></div><script>\n        // Groups page JavaScript\n        let currentGroupName = '';\n\n        async function createGroup() {\n            const name = document.getElementById('groupName').value.trim();\n            if (!name) {\n                showAlert('Group name is required', 'error');\n                return;\n            }\n            try {\n                const response = await fetch(basePath('/api/groups'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ name: name })\n                });\n                if (response.ok) {\n                    showAlert('Group created successfully', 'success');\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to create group: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to create group: ' + error.message, 'error');\n            }\n        }\n\n        async function viewGroup(name) {\n            currentGroupName = name;\n            document.getElementById('viewGroupTitle').textContent = 'Group: ' + name;\n            await refreshGroupDetails(name);\n            new bootstrap.Modal(document.getElementById('viewGroupModal')).show();\n        }\n\n        async function refreshGroupDetails(requestedName) {\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(requestedName)));\n                if (!response.ok) throw new Error('Failed to fetch group');\n                if (requestedName !== currentGroupName) return; // stale response\n                const group = await response.json();\n\n                // Render members using DOM APIs to prevent XSS\n                const membersList = document.getElementById('membersList');\n                membersList.innerHTML = '';\n                const membersTable = document.createElement('table');\n                membersTable.className = 'table table-sm';\n                const membersTbody = document.createElement('tbody');\n                if (group.members && group.members.length > 0) {\n                    for (const member of group.members) {\n                        const tr = membersTbody.insertRow();\n                        const td1 = tr.insertCell();\n                        td1.textContent = member;\n                        const td2 = tr.insertCell();\n                        const btn = document.createElement('button');\n                        btn.className = 'btn btn-sm btn-outline-danger';\n                        btn.onclick = () => removeMember(member);\n                        btn.innerHTML = '<i class=\"bi bi-x\"></i>';\n                        td2.appendChild(btn);\n                    }\n                } else {\n                    const tr = membersTbody.insertRow();\n                    const td = tr.insertCell();\n                    td.className = 'text-muted';\n                    td.textContent = 'No members';\n                }\n                membersTable.appendChild(membersTbody);\n                membersList.appendChild(membersTable);\n\n                // Render policies using DOM APIs to prevent XSS\n                const policiesList = document.getElementById('policiesList');\n                policiesList.innerHTML = '';\n                const policiesTable = document.createElement('table');\n                policiesTable.className = 'table table-sm';\n                const policiesTbody = document.createElement('tbody');\n                if (group.policy_names && group.policy_names.length > 0) {\n                    for (const policy of group.policy_names) {\n                        const tr = policiesTbody.insertRow();\n                        const td1 = tr.insertCell();\n                        td1.textContent = policy;\n                        const td2 = tr.insertCell();\n                        const btn = document.createElement('button');\n                        btn.className = 'btn btn-sm btn-outline-danger';\n                        btn.onclick = () => detachPolicy(policy);\n                        btn.innerHTML = '<i class=\"bi bi-x\"></i>';\n                        td2.appendChild(btn);\n                    }\n                } else {\n                    const tr = policiesTbody.insertRow();\n                    const td = tr.insertCell();\n                    td.className = 'text-muted';\n                    td.textContent = 'No policies attached';\n                }\n                policiesTable.appendChild(policiesTbody);\n                policiesList.appendChild(policiesTable);\n\n                // Update status toggle\n                document.getElementById('groupEnabledSwitch').checked = (group.status === 'enabled');\n            } catch (error) {\n                console.error('Error fetching group details:', error);\n            }\n        }\n\n        async function addMemberToGroup() {\n            const username = document.getElementById('addMemberSelect').value;\n            if (!username) return;\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/members'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ username: username })\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Member added', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to add member: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to add member: ' + error.message, 'error');\n            }\n        }\n\n        async function removeMember(username) {\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/members/' + encodeURIComponent(username)), {\n                    method: 'DELETE'\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Member removed', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to remove member: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to remove member: ' + error.message, 'error');\n            }\n        }\n\n        async function attachPolicyToGroup() {\n            const policyName = document.getElementById('attachPolicySelect').value;\n            if (!policyName) return;\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/policies'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ policy_name: policyName })\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Policy attached', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to attach policy: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to attach policy: ' + error.message, 'error');\n            }\n        }\n\n        async function detachPolicy(policyName) {\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/policies/' + encodeURIComponent(policyName)), {\n                    method: 'DELETE'\n                });\n                if (response.ok) {\n                    await refreshGroupDetails(currentGroupName);\n                    showAlert('Policy detached', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to detach policy: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to detach policy: ' + error.message, 'error');\n            }\n        }\n\n        async function toggleGroupStatus() {\n            const enabled = document.getElementById('groupEnabledSwitch').checked;\n            try {\n                const response = await fetch(basePath('/api/groups/' + encodeURIComponent(currentGroupName) + '/status'), {\n                    method: 'PUT',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ enabled: enabled })\n                });\n                if (response.ok) {\n                    showAlert('Group status updated', 'success');\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to update status: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to update status: ' + error.message, 'error');\n            }\n        }\n\n        // Event delegation for group action buttons\n        document.addEventListener('click', function(e) {\n            const btn = e.target.closest('[data-action]');\n            if (!btn) return;\n            const name = btn.dataset.groupName;\n            if (!name) return;\n            if (btn.dataset.action === 'view') viewGroup(name);\n            else if (btn.dataset.action === 'delete') deleteGroup(name);\n        });\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/iceberg_catalog.templ b/weed/admin/view/app/iceberg_catalog.templ
index 16dbb305f6..8023f48f37 100644
--- a/weed/admin/view/app/iceberg_catalog.templ
+++ b/weed/admin/view/app/iceberg_catalog.templ
@@ -11,17 +11,17 @@ import (
 templ IcebergCatalog(data dash.IcebergCatalogData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-snowflake me-2"></i>Iceberg Catalog
+			<i class="bi bi-snow me-2"></i>Iceberg Catalog
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<a href={ dash.PUrl(ctx, "/object-store/s3tables/buckets") } class="btn btn-sm btn-primary">
-					<i class="fas fa-plus me-1"></i>Create Table Bucket
+					<i class="bi bi-plus me-1"></i>Create Table Bucket
 				</a>
 			</div>
 			<div class="btn-group me-2">
 				<a id="iceberg-rest-link" href={ templ.SafeURL(fmt.Sprintf("//localhost:%d/v1/config", data.IcebergPort)) } target="_blank" class="btn btn-sm btn-outline-secondary">
-					<i class="fas fa-external-link-alt me-1"></i>REST API
+					<i class="bi bi-box-arrow-up-right me-1"></i>REST API
 				</a>
 			</div>
 		</div>
@@ -30,7 +30,7 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 		<!-- Info Alert about Iceberg REST -->
 		<div class="alert alert-info mb-4">
 			<div class="d-flex align-items-center">
-				<i class="fas fa-info-circle fa-2x me-3"></i>
+				<i class="bi bi-info-circle icon-2x me-3"></i>
 				<div>
 					<strong>Iceberg REST Catalog</strong>
 					<p id="iceberg-rest-info" class="mb-0 mt-1" data-iceberg-port={ fmt.Sprintf("%d", data.IcebergPort) }>
@@ -71,7 +71,7 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-database fa-2x text-gray-300"></i>
+								<i class="bi bi-database icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -90,7 +90,7 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-plug fa-2x text-gray-300"></i>
+								<i class="bi bi-plug icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -113,7 +113,7 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-clock fa-2x text-gray-300"></i>
+								<i class="bi bi-clock icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -127,7 +127,7 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-snowflake me-2"></i>Available Catalogs
+							<i class="bi bi-snow me-2"></i>Available Catalogs
 						</h6>
 					</div>
 					<div class="card-body">
@@ -149,7 +149,7 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 									for _, catalog := range data.Catalogs {
 										<tr>
 											<td>
-												<i class="fas fa-snowflake text-info me-2"></i>
+												<i class="bi bi-snow text-info me-2"></i>
 												<strong>{ catalog.Name }</strong>
 											</td>
 											<td>{ catalog.OwnerAccountID }</td>
@@ -168,11 +168,11 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 													{{ bucketName, parseErr := s3tables.ParseBucketNameFromARN(catalog.ARN) }}
 													if parseErr == nil {
 														<a class="btn btn-outline-primary btn-sm" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/iceberg/%s/namespaces", url.PathEscape(bucketName))) } title="Browse Namespaces">
-															<i class="fas fa-folder-open"></i>
+															<i class="bi bi-folder2-open"></i>
 														</a>
 													} else {
 														<button type="button" class="btn btn-outline-secondary btn-sm" disabled title={ parseErr.Error() }>
-															<i class="fas fa-exclamation-triangle"></i>
+															<i class="bi bi-exclamation-triangle"></i>
 														</button>
 													}
 												</div>
@@ -182,12 +182,12 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 									if len(data.Catalogs) == 0 {
 										<tr>
 											<td colspan="5" class="text-center text-muted py-4">
-												<i class="fas fa-snowflake fa-3x mb-3 text-muted"></i>
+												<i class="bi bi-snow icon-3x mb-3 text-muted"></i>
 												<div>
 													<h5>No catalogs available</h5>
 													<p>Create an S3 Table Bucket first to use as an Iceberg catalog.</p>
 													<a href={ dash.PUrl(ctx, "/object-store/s3tables/buckets") } class="btn btn-primary">
-														<i class="fas fa-plus me-1"></i>Create Table Bucket
+														<i class="bi bi-plus me-1"></i>Create Table Bucket
 													</a>
 												</div>
 											</td>
@@ -207,7 +207,7 @@ templ IcebergCatalog(data dash.IcebergCatalogData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-code me-2"></i>Example Usage
+							<i class="bi bi-code me-2"></i>Example Usage
 						</h6>
 					</div>
 					<div class="card-body">
diff --git a/weed/admin/view/app/iceberg_catalog_templ.go b/weed/admin/view/app/iceberg_catalog_templ.go
index 3070b11d6a..ae8cb0b81f 100644
--- a/weed/admin/view/app/iceberg_catalog_templ.go
+++ b/weed/admin/view/app/iceberg_catalog_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -37,7 +37,7 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-snowflake me-2\"></i>Iceberg Catalog</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-snow me-2\"></i>Iceberg Catalog</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -50,7 +50,7 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\" class=\"btn btn-sm btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create Table Bucket</a></div><div class=\"btn-group me-2\"><a id=\"iceberg-rest-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\" class=\"btn btn-sm btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create Table Bucket</a></div><div class=\"btn-group me-2\"><a id=\"iceberg-rest-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -63,16 +63,16 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\" target=\"_blank\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-external-link-alt me-1\"></i>REST API</a></div></div></div><div id=\"iceberg-catalog-content\"><!-- Info Alert about Iceberg REST --><div class=\"alert alert-info mb-4\"><div class=\"d-flex align-items-center\"><i class=\"fas fa-info-circle fa-2x me-3\"></i><div><strong>Iceberg REST Catalog</strong><p id=\"iceberg-rest-info\" class=\"mb-0 mt-1\" data-iceberg-port=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\" target=\"_blank\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-box-arrow-up-right me-1\"></i>REST API</a></div></div></div><div id=\"iceberg-catalog-content\"><!-- Info Alert about Iceberg REST --><div class=\"alert alert-info mb-4\"><div class=\"d-flex align-items-center\"><i class=\"bi bi-info-circle icon-2x me-3\"></i><div><strong>Iceberg REST Catalog</strong><p id=\"iceberg-rest-info\" class=\"mb-0 mt-1\" data-iceberg-port=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var4 string
-		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.IcebergPort))
+		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.IcebergPort))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_catalog.templ`, Line: 36, Col: 104}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -102,7 +102,7 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</div></div><div class=\"col-auto\"><i class=\"fas fa-database fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">REST Port</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</div></div><div class=\"col-auto\"><i class=\"bi bi-database icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">REST Port</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -115,7 +115,7 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</div></div><div class=\"col-auto\"><i class=\"fas fa-plug fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</div></div><div class=\"col-auto\"><i class=\"bi bi-plug icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -135,12 +135,12 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Catalog List --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-snowflake me-2\"></i>Available Catalogs</h6></div><div class=\"card-body\"><p class=\"text-muted mb-3\">Each S3 Table Bucket acts as an Iceberg catalog. Use the bucket name as the catalog prefix in your REST API calls.</p><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"icebergCatalogsTable\"><thead><tr><th>Catalog Name</th><th>Owner</th><th>REST Endpoint</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Catalog List --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-snow me-2\"></i>Available Catalogs</h6></div><div class=\"card-body\"><p class=\"text-muted mb-3\">Each S3 Table Bucket acts as an Iceberg catalog. Use the bucket name as the catalog prefix in your REST API calls.</p><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"icebergCatalogsTable\"><thead><tr><th>Catalog Name</th><th>Owner</th><th>REST Endpoint</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, catalog := range data.Catalogs {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<tr><td><i class=\"fas fa-snowflake text-info me-2\"></i> <strong>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<tr><td><i class=\"bi bi-snow text-info me-2\"></i> <strong>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -218,7 +218,7 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\" title=\"Browse Namespaces\"><i class=\"fas fa-folder-open\"></i></a>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\" title=\"Browse Namespaces\"><i class=\"bi bi-folder2-open\"></i></a>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -228,15 +228,15 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var14 string
-				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(parseErr.Error())
+				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(parseErr.Error())
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_catalog.templ`, Line: 174, Col: 110}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\"><i class=\"fas fa-exclamation-triangle\"></i></button>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\"><i class=\"bi bi-exclamation-triangle\"></i></button>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -247,7 +247,7 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 			}
 		}
 		if len(data.Catalogs) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<tr><td colspan=\"5\" class=\"text-center text-muted py-4\"><i class=\"fas fa-snowflake fa-3x mb-3 text-muted\"></i><div><h5>No catalogs available</h5><p>Create an S3 Table Bucket first to use as an Iceberg catalog.</p><a href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<tr><td colspan=\"5\" class=\"text-center text-muted py-4\"><i class=\"bi bi-snow icon-3x mb-3 text-muted\"></i><div><h5>No catalogs available</h5><p>Create an S3 Table Bucket first to use as an Iceberg catalog.</p><a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -260,12 +260,12 @@ func IcebergCatalog(data dash.IcebergCatalogData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\" class=\"btn btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create Table Bucket</a></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\" class=\"btn btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create Table Bucket</a></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</tbody></table></div></div></div></div></div><!-- Example Usage Card --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-code me-2\"></i>Example Usage</h6></div><div class=\"card-body\"><h6>DuckDB</h6><pre class=\"bg-light p-3 border rounded\"><code>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</tbody></table></div></div></div></div></div><!-- Example Usage Card --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-code me-2\"></i>Example Usage</h6></div><div class=\"card-body\"><h6>DuckDB</h6><pre class=\"bg-light p-3 border rounded\"><code>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/iceberg_namespaces.templ b/weed/admin/view/app/iceberg_namespaces.templ
index d2fec7b0a7..330013a90d 100644
--- a/weed/admin/view/app/iceberg_namespaces.templ
+++ b/weed/admin/view/app/iceberg_namespaces.templ
@@ -14,7 +14,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 				<ol class="breadcrumb mb-0">
 					<li class="breadcrumb-item">
 						<a href={ dash.PUrl(ctx, "/object-store/iceberg") }>
-							<i class="fas fa-snowflake me-1"></i>Iceberg Catalog
+							<i class="bi bi-snow me-1"></i>Iceberg Catalog
 						</a>
 					</li>
 					<li class="breadcrumb-item active">{ data.CatalogName }</li>
@@ -24,7 +24,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-primary" data-bs-toggle="modal" data-bs-target="#createIcebergNamespaceModal">
-					<i class="fas fa-plus me-1"></i>Create Namespace
+					<i class="bi bi-plus me-1"></i>Create Namespace
 				</button>
 			</div>
 		</div>
@@ -48,7 +48,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-snowflake fa-2x text-gray-300"></i>
+								<i class="bi bi-snow icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -67,7 +67,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-folder fa-2x text-gray-300"></i>
+								<i class="bi bi-folder icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -81,7 +81,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-sitemap me-2"></i>Catalog Browser
+							<i class="bi bi-diagram-3 me-2"></i>Catalog Browser
 						</h6>
 					</div>
 					<div class="card-body">
@@ -91,10 +91,10 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 									{{ namespaceID := fmt.Sprintf("iceberg-namespace-%d", idx) }}
 									<div class="d-flex align-items-center justify-content-between">
 										<button class="btn btn-link p-0 text-decoration-none iceberg-namespace-toggle" type="button" data-bs-toggle="collapse" data-bs-target={ "#" + namespaceID } aria-expanded="false" aria-controls={ namespaceID }>
-											<i class="fas fa-folder text-warning me-2"></i>{ ns.Name }
+											<i class="bi bi-folder text-warning me-2"></i>{ ns.Name }
 										</button>
 										<a class="btn btn-sm btn-outline-primary" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/iceberg/%s/namespaces/%s/tables", url.PathEscape(data.CatalogName), url.PathEscape(ns.Name))) }>
-											<i class="fas fa-table me-1"></i>Open
+											<i class="bi bi-table me-1"></i>Open
 										</a>
 									</div>
 									<div class="collapse mt-2 iceberg-namespace-collapse" id={ namespaceID } data-namespace={ ns.Name } data-catalog-name={ data.CatalogName }>
@@ -104,7 +104,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 							}
 							if len(data.Namespaces) == 0 {
 								<li class="list-group-item text-center text-muted py-4">
-									<i class="fas fa-folder-open fa-2x mb-2 text-muted"></i>
+									<i class="bi bi-folder2-open icon-2x mb-2 text-muted"></i>
 									<div>No namespaces available.</div>
 								</li>
 							}
@@ -120,7 +120,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-folder me-2"></i>Namespaces
+							<i class="bi bi-folder me-2"></i>Namespaces
 						</h6>
 					</div>
 					<div class="card-body">
@@ -138,7 +138,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 									for _, ns := range data.Namespaces {
 										<tr>
 											<td>
-												<i class="fas fa-folder text-warning me-2"></i>
+												<i class="bi bi-folder text-warning me-2"></i>
 												<strong>{ ns.Name }</strong>
 											</td>
 											<td>
@@ -154,7 +154,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 											<td>
 												<div class="btn-group btn-group-sm" role="group">
 													<a class="btn btn-outline-primary btn-sm" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/iceberg/%s/namespaces/%s/tables", url.PathEscape(data.CatalogName), url.PathEscape(ns.Name))) } title="Browse Tables">
-														<i class="fas fa-table"></i>
+														<i class="bi bi-table"></i>
 													</a>
 												</div>
 											</td>
@@ -163,7 +163,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 									if len(data.Namespaces) == 0 {
 										<tr>
 											<td colspan="4" class="text-center text-muted py-4">
-												<i class="fas fa-folder-open fa-3x mb-3 text-muted"></i>
+												<i class="bi bi-folder2-open icon-3x mb-3 text-muted"></i>
 												<div>
 													<h5>No namespaces found</h5>
 													<p>Create namespaces via the Iceberg REST API or S3 Tables API.</p>
@@ -184,7 +184,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="createIcebergNamespaceModalLabel">
-						<i class="fas fa-plus me-2"></i>Create Namespace
+						<i class="bi bi-plus me-2"></i>Create Namespace
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -201,7 +201,7 @@ templ IcebergNamespaces(data dash.IcebergNamespacesData) {
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-plus me-1"></i>Create
+							<i class="bi bi-plus me-1"></i>Create
 						</button>
 					</div>
 				</form>
diff --git a/weed/admin/view/app/iceberg_namespaces_templ.go b/weed/admin/view/app/iceberg_namespaces_templ.go
index 80e318a488..8c4e65642b 100644
--- a/weed/admin/view/app/iceberg_namespaces_templ.go
+++ b/weed/admin/view/app/iceberg_namespaces_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -49,7 +49,7 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"fas fa-snowflake me-1\"></i>Iceberg Catalog</a></li><li class=\"breadcrumb-item active\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"bi bi-snow me-1\"></i>Iceberg Catalog</a></li><li class=\"breadcrumb-item active\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -62,7 +62,7 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</li></ol></nav></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createIcebergNamespaceModal\"><i class=\"fas fa-plus me-1\"></i>Create Namespace</button></div></div></div><div class=\"mb-3\"><span class=\"text-muted\">Bucket ARN: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</li></ol></nav></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createIcebergNamespaceModal\"><i class=\"bi bi-plus me-1\"></i>Create Namespace</button></div></div></div><div class=\"mb-3\"><span class=\"text-muted\">Bucket ARN: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -80,11 +80,11 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var5 string
-		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 35, Col: 70}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var5)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -93,11 +93,11 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var6 string
-		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(data.CatalogName)
+		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.CatalogName)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 35, Col: 109}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var6)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -114,7 +114,7 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</div></div><div class=\"col-auto\"><i class=\"fas fa-snowflake fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Namespaces</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</div></div><div class=\"col-auto\"><i class=\"bi bi-snow icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Namespaces</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -127,7 +127,7 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "</div></div><div class=\"col-auto\"><i class=\"fas fa-folder fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Catalog Browser Tree --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-sitemap me-2\"></i>Catalog Browser</h6></div><div class=\"card-body\"><ul class=\"list-group\" id=\"icebergNamespaceTree\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "</div></div><div class=\"col-auto\"><i class=\"bi bi-folder icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Catalog Browser Tree --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-diagram-3 me-2\"></i>Catalog Browser</h6></div><div class=\"card-body\"><ul class=\"list-group\" id=\"icebergNamespaceTree\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -142,11 +142,11 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var9 string
-			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs("#" + namespaceID)
+			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue("#" + namespaceID)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 93, Col: 163}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -155,22 +155,22 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(namespaceID)
+			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(namespaceID)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 93, Col: 215}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"fas fa-folder text-warning me-2\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"bi bi-folder text-warning me-2\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var11 string
 			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(ns.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 94, Col: 67}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 94, Col: 66}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 			if templ_7745c5c3_Err != nil {
@@ -189,16 +189,16 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\"><i class=\"fas fa-table me-1\"></i>Open</a></div><div class=\"collapse mt-2 iceberg-namespace-collapse\" id=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\"><i class=\"bi bi-table me-1\"></i>Open</a></div><div class=\"collapse mt-2 iceberg-namespace-collapse\" id=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var13 string
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(namespaceID)
+			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(namespaceID)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 100, Col: 79}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -207,11 +207,11 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var14 string
-			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(ns.Name)
+			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(ns.Name)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 100, Col: 106}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -220,11 +220,11 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var15 string
-			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(data.CatalogName)
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.CatalogName)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 100, Col: 145}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -234,17 +234,17 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 			}
 		}
 		if len(data.Namespaces) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<li class=\"list-group-item text-center text-muted py-4\"><i class=\"fas fa-folder-open fa-2x mb-2 text-muted\"></i><div>No namespaces available.</div></li>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<li class=\"list-group-item text-center text-muted py-4\"><i class=\"bi bi-folder2-open icon-2x mb-2 text-muted\"></i><div>No namespaces available.</div></li>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</ul></div></div></div></div><!-- Namespace List --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-folder me-2\"></i>Namespaces</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Namespace</th><th>REST Endpoint</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</ul></div></div></div></div><!-- Namespace List --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-folder me-2\"></i>Namespaces</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Namespace</th><th>REST Endpoint</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, ns := range data.Namespaces {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<tr><td><i class=\"fas fa-folder text-warning me-2\"></i> <strong>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<tr><td><i class=\"bi bi-folder text-warning me-2\"></i> <strong>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -316,31 +316,31 @@ func IcebergNamespaces(data dash.IcebergNamespacesData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "\" title=\"Browse Tables\"><i class=\"fas fa-table\"></i></a></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "\" title=\"Browse Tables\"><i class=\"bi bi-table\"></i></a></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.Namespaces) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"fas fa-folder-open fa-3x mb-3 text-muted\"></i><div><h5>No namespaces found</h5><p>Create namespaces via the Iceberg REST API or S3 Tables API.</p></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"bi bi-folder2-open icon-3x mb-3 text-muted\"></i><div><h5>No namespaces found</h5><p>Create namespaces via the Iceberg REST API or S3 Tables API.</p></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createIcebergNamespaceModal\" tabindex=\"-1\" aria-labelledby=\"createIcebergNamespaceModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createIcebergNamespaceModalLabel\"><i class=\"fas fa-plus me-2\"></i>Create Namespace</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createIcebergNamespaceForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"icebergNamespaceBucketArn\" name=\"bucket_arn\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createIcebergNamespaceModal\" tabindex=\"-1\" aria-labelledby=\"createIcebergNamespaceModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createIcebergNamespaceModalLabel\"><i class=\"bi bi-plus me-2\"></i>Create Namespace</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createIcebergNamespaceForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"icebergNamespaceBucketArn\" name=\"bucket_arn\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var21 string
-		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_namespaces.templ`, Line: 193, Col: 98}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\"> <input type=\"hidden\" id=\"icebergNamespaceCsrfToken\" name=\"csrf_token\"><div class=\"mb-3\"><label for=\"icebergNamespaceName\" class=\"form-label\">Namespace</label> <input type=\"text\" class=\"form-control\" id=\"icebergNamespaceName\" name=\"name\" placeholder=\"analytics\" required><div class=\"form-text\">Use lowercase letters, numbers, and underscores. Use dots for nested namespaces (for example, analytics.daily).</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create</button></div></form></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitIcebergNamespaces();\n\t\t});\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\"> <input type=\"hidden\" id=\"icebergNamespaceCsrfToken\" name=\"csrf_token\"><div class=\"mb-3\"><label for=\"icebergNamespaceName\" class=\"form-label\">Namespace</label> <input type=\"text\" class=\"form-control\" id=\"icebergNamespaceName\" name=\"name\" placeholder=\"analytics\" required><div class=\"form-text\">Use lowercase letters, numbers, and underscores. Use dots for nested namespaces (for example, analytics.daily).</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create</button></div></form></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitIcebergNamespaces();\n\t\t});\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/iceberg_table_data.templ b/weed/admin/view/app/iceberg_table_data.templ
index 1fefcd06a6..d1e7a1a1b3 100644
--- a/weed/admin/view/app/iceberg_table_data.templ
+++ b/weed/admin/view/app/iceberg_table_data.templ
@@ -15,7 +15,7 @@ templ IcebergTableData(data dash.IcebergDataPreviewData) {
 				<ol class="breadcrumb mb-0">
 					<li class="breadcrumb-item">
 						<a href={ dash.PUrl(ctx, "/object-store/s3tables/buckets") }>
-							<i class="fas fa-table me-1"></i>Table Buckets
+							<i class="bi bi-table me-1"></i>Table Buckets
 						</a>
 					</li>
 					<li class="breadcrumb-item">
@@ -40,126 +40,128 @@ templ IcebergTableData(data dash.IcebergDataPreviewData) {
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<a class="btn btn-sm btn-outline-secondary" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(data.CatalogName), url.PathEscape(data.NamespaceName), url.PathEscape(data.TableName))) }>
-					<i class="fas fa-info-circle me-1"></i>Table Details
+					<i class="bi bi-info-circle me-1"></i>Table Details
 				</a>
 			</div>
 		</div>
 	</div>
 	if data.PreviewError != "" {
 		<div class="alert alert-warning">
-			<i class="fas fa-exclamation-triangle me-2"></i>{ data.PreviewError }
+			<i class="bi bi-exclamation-triangle me-2"></i>{ data.PreviewError }
 		</div>
 	}
 	for _, note := range data.PreviewNotes {
 		<div class="alert alert-info py-2 mb-2">
-			<i class="fas fa-info-circle me-2"></i>{ note }
+			<i class="bi bi-info-circle me-2"></i>{ note }
 		</div>
 	}
-	<div class="row mb-4">
-		<div class="col-xl-4 col-md-6 mb-4">
-			<div class="card border-left-primary shadow h-100 py-2">
-				<div class="card-body">
-					<div class="row no-gutters align-items-center">
-						<div class="col mr-2">
-							<div class="text-xs font-weight-bold text-primary text-uppercase mb-1">
-								Snapshot
-							</div>
-							<div class="h6 mb-0 font-weight-bold text-gray-800">
-								if data.SnapshotID != 0 {
-									{ fmt.Sprintf("%d", data.SnapshotID) }
-									if data.SnapshotID == data.CurrentSnapshotID {
-										<span class="badge bg-success ms-1">current</span>
+	if !previewIsWorkerSourced(data) {
+		<div class="row mb-4">
+			<div class="col-xl-4 col-md-6 mb-4">
+				<div class="card border-left-primary shadow h-100 py-2">
+					<div class="card-body">
+						<div class="row no-gutters align-items-center">
+							<div class="col mr-2">
+								<div class="text-xs font-weight-bold text-primary text-uppercase mb-1">
+									Snapshot
+								</div>
+								<div class="h6 mb-0 font-weight-bold text-gray-800">
+									if data.SnapshotID != 0 {
+										{ fmt.Sprintf("%d", data.SnapshotID) }
+										if data.SnapshotID == data.CurrentSnapshotID {
+											<span class="badge bg-success ms-1">current</span>
+										}
+									} else {
+										-
 									}
-								} else {
-									-
+								</div>
+								if !data.SnapshotTime.IsZero() {
+									<div class="small text-muted">{ data.SnapshotTime.Format("2006-01-02 15:04:05") }</div>
 								}
 							</div>
-							if !data.SnapshotTime.IsZero() {
-								<div class="small text-muted">{ data.SnapshotTime.Format("2006-01-02 15:04:05") }</div>
-							}
-						</div>
-						<div class="col-auto">
-							if len(data.Snapshots) > 1 {
-								<div class="dropdown">
-									<button class="btn btn-sm btn-outline-secondary dropdown-toggle" type="button" data-bs-toggle="dropdown" aria-expanded="false">
-										Switch
-									</button>
-									<ul class="dropdown-menu dropdown-menu-end">
-										for i, snapshot := range data.Snapshots {
-											if i < 25 {
+							<div class="col-auto">
+								if len(data.Snapshots) > 1 {
+									<div class="dropdown">
+										<button class="btn btn-sm btn-outline-secondary dropdown-toggle" type="button" data-bs-toggle="dropdown" aria-expanded="false">
+											Switch
+										</button>
+										<ul class="dropdown-menu dropdown-menu-end">
+											for i, snapshot := range data.Snapshots {
+												if i < 25 {
+													<li>
+														<a class="dropdown-item small" href={ dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, snapshot.SnapshotID, data.RowLimit, "")) }>
+															{ fmt.Sprintf("%d", snapshot.SnapshotID) }
+															if !snapshot.Timestamp.IsZero() {
+																<span class="text-muted ms-1">{ snapshot.Timestamp.Format("2006-01-02 15:04") }</span>
+															}
+														</a>
+													</li>
+												}
+											}
+											if len(data.Snapshots) > 25 {
+												<li><hr class="dropdown-divider"/></li>
 												<li>
-													<a class="dropdown-item small" href={ dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, snapshot.SnapshotID, data.RowLimit, "")) }>
-														{ fmt.Sprintf("%d", snapshot.SnapshotID) }
-														if !snapshot.Timestamp.IsZero() {
-															<span class="text-muted ms-1">{ snapshot.Timestamp.Format("2006-01-02 15:04") }</span>
-														}
+													<a class="dropdown-item small text-muted" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(data.CatalogName), url.PathEscape(data.NamespaceName), url.PathEscape(data.TableName))) }>
+														{ fmt.Sprintf("%d more in snapshot history…", len(data.Snapshots)-25) }
 													</a>
 												</li>
 											}
-										}
-										if len(data.Snapshots) > 25 {
-											<li><hr class="dropdown-divider"/></li>
-											<li>
-												<a class="dropdown-item small text-muted" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(data.CatalogName), url.PathEscape(data.NamespaceName), url.PathEscape(data.TableName))) }>
-													{ fmt.Sprintf("%d more in snapshot history…", len(data.Snapshots)-25) }
-												</a>
-											</li>
-										}
-									</ul>
+										</ul>
+									</div>
+								} else {
+									<i class="bi bi-clock-history icon-2x text-gray-300"></i>
+								}
+							</div>
+						</div>
+					</div>
+				</div>
+			</div>
+			<div class="col-xl-4 col-md-6 mb-4">
+				<div class="card border-left-success shadow h-100 py-2">
+					<div class="card-body">
+						<div class="row no-gutters align-items-center">
+							<div class="col mr-2">
+								<div class="text-xs font-weight-bold text-success text-uppercase mb-1">
+									Data Files
 								</div>
-							} else {
-								<i class="fas fa-history fa-2x text-gray-300"></i>
-							}
+								<div class="h5 mb-0 font-weight-bold text-gray-800">
+									{ formatNumber(int64(data.TotalDataFiles)) }
+								</div>
+							</div>
+							<div class="col-auto">
+								<i class="bi bi-copy icon-2x text-gray-300"></i>
+							</div>
+						</div>
+					</div>
+				</div>
+			</div>
+			<div class="col-xl-4 col-md-6 mb-4">
+				<div class="card border-left-info shadow h-100 py-2">
+					<div class="card-body">
+						<div class="row no-gutters align-items-center">
+							<div class="col mr-2">
+								<div class="text-xs font-weight-bold text-info text-uppercase mb-1">
+									Total Records
+								</div>
+								<div class="h5 mb-0 font-weight-bold text-gray-800">
+									{ formatNumber(data.TotalRecords) }
+								</div>
+							</div>
+							<div class="col-auto">
+								<i class="bi bi-list-ol icon-2x text-gray-300"></i>
+							</div>
 						</div>
 					</div>
 				</div>
 			</div>
 		</div>
-		<div class="col-xl-4 col-md-6 mb-4">
-			<div class="card border-left-success shadow h-100 py-2">
-				<div class="card-body">
-					<div class="row no-gutters align-items-center">
-						<div class="col mr-2">
-							<div class="text-xs font-weight-bold text-success text-uppercase mb-1">
-								Data Files
-							</div>
-							<div class="h5 mb-0 font-weight-bold text-gray-800">
-								{ formatNumber(int64(data.TotalDataFiles)) }
-							</div>
-						</div>
-						<div class="col-auto">
-							<i class="fas fa-copy fa-2x text-gray-300"></i>
-						</div>
-					</div>
-				</div>
-			</div>
-		</div>
-		<div class="col-xl-4 col-md-6 mb-4">
-			<div class="card border-left-info shadow h-100 py-2">
-				<div class="card-body">
-					<div class="row no-gutters align-items-center">
-						<div class="col mr-2">
-							<div class="text-xs font-weight-bold text-info text-uppercase mb-1">
-								Total Records
-							</div>
-							<div class="h5 mb-0 font-weight-bold text-gray-800">
-								{ formatNumber(data.TotalRecords) }
-							</div>
-						</div>
-						<div class="col-auto">
-							<i class="fas fa-list-ol fa-2x text-gray-300"></i>
-						</div>
-					</div>
-				</div>
-			</div>
-		</div>
-	</div>
+	}
 	<div class="row">
 		<div class="col-12 mb-4">
 			<div class="card shadow">
 				<div class="card-header py-3 d-flex justify-content-between align-items-center">
 					<h6 class="m-0 font-weight-bold text-primary">
-						<i class="fas fa-table me-2"></i>Sample Rows
+						<i class="bi bi-table me-2"></i>Sample Rows
 						if data.SelectedFile != "" {
 							<span class="badge bg-secondary ms-2">{ path.Base(data.SelectedFile) }</span>
 							<a class="small ms-2" href={ dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, data.RowLimit, "")) }>all files</a>
@@ -199,9 +201,15 @@ templ IcebergTableData(data dash.IcebergDataPreviewData) {
 								</tbody>
 							</table>
 						</div>
-						<div class="small text-muted">
-							{ fmt.Sprintf("Showing %d row(s) from %d data file(s).", len(data.Rows), data.ScannedFiles) }
-						</div>
+						if previewIsWorkerSourced(data) {
+							<div class="small text-muted">
+								{ fmt.Sprintf("Showing %d row(s), read from the %s dataset by worker %s.", len(data.Rows), data.Format, data.PreviewedBy) }
+							</div>
+						} else {
+							<div class="small text-muted">
+								{ fmt.Sprintf("Showing %d row(s) from %d data file(s).", len(data.Rows), data.ScannedFiles) }
+							</div>
+						}
 					} else {
 						<div class="text-center text-muted py-4">No rows to preview.</div>
 					}
@@ -209,50 +217,52 @@ templ IcebergTableData(data dash.IcebergDataPreviewData) {
 			</div>
 		</div>
 	</div>
-	<div class="row">
-		<div class="col-12 mb-4">
-			<div class="card shadow">
-				<div class="card-header py-3">
-					<h6 class="m-0 font-weight-bold text-primary">
-						<i class="fas fa-copy me-2"></i>Data Files
-					</h6>
-				</div>
-				<div class="card-body">
-					<div class="table-responsive">
-						<table class="table table-sm table-hover">
-							<thead>
-								<tr>
-									<th>Path</th>
-									<th>Format</th>
-									<th>Records</th>
-									<th>Size</th>
-									<th></th>
-								</tr>
-							</thead>
-							<tbody>
-								for _, file := range data.DataFiles {
+	if !previewIsWorkerSourced(data) {
+		<div class="row">
+			<div class="col-12 mb-4">
+				<div class="card shadow">
+					<div class="card-header py-3">
+						<h6 class="m-0 font-weight-bold text-primary">
+							<i class="bi bi-copy me-2"></i>Data Files
+						</h6>
+					</div>
+					<div class="card-body">
+						<div class="table-responsive">
+							<table class="table table-sm table-hover">
+								<thead>
 									<tr>
-										<td><code class="small">{ file.Path }</code></td>
-										<td><span class="badge bg-secondary">{ file.Format }</span></td>
-										<td>{ formatNumber(file.RecordCount) }</td>
-										<td>{ formatBytes(file.SizeBytes) }</td>
-										<td>
-											<a class="btn btn-sm btn-outline-primary" href={ dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, data.RowLimit, file.Path)) }>
-												<i class="fas fa-eye me-1"></i>Preview
-											</a>
-										</td>
+										<th>Path</th>
+										<th>Format</th>
+										<th>Records</th>
+										<th>Size</th>
+										<th></th>
 									</tr>
-								}
-								if len(data.DataFiles) == 0 {
-									<tr>
-										<td colspan="5" class="text-center text-muted">No data files in this snapshot.</td>
-									</tr>
-								}
-							</tbody>
-						</table>
+								</thead>
+								<tbody>
+									for _, file := range data.DataFiles {
+										<tr>
+											<td><code class="small">{ file.Path }</code></td>
+											<td><span class="badge bg-secondary">{ file.Format }</span></td>
+											<td>{ formatNumber(file.RecordCount) }</td>
+											<td>{ formatBytes(file.SizeBytes) }</td>
+											<td>
+												<a class="btn btn-sm btn-outline-primary" href={ dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, data.RowLimit, file.Path)) }>
+													<i class="bi bi-eye me-1"></i>Preview
+												</a>
+											</td>
+										</tr>
+									}
+									if len(data.DataFiles) == 0 {
+										<tr>
+											<td colspan="5" class="text-center text-muted">No data files in this snapshot.</td>
+										</tr>
+									}
+								</tbody>
+							</table>
+						</div>
 					</div>
 				</div>
 			</div>
 		</div>
-	</div>
+	}
 }
diff --git a/weed/admin/view/app/iceberg_table_data_templ.go b/weed/admin/view/app/iceberg_table_data_templ.go
index 91ef699f5c..14e0cc2ff3 100644
--- a/weed/admin/view/app/iceberg_table_data_templ.go
+++ b/weed/admin/view/app/iceberg_table_data_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -50,7 +50,7 @@ func IcebergTableData(data dash.IcebergDataPreviewData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"fas fa-table me-1\"></i>Table Buckets</a></li><li class=\"breadcrumb-item\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"bi bi-table me-1\"></i>Table Buckets</a></li><li class=\"breadcrumb-item\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -141,19 +141,19 @@ func IcebergTableData(data dash.IcebergDataPreviewData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\"><i class=\"fas fa-info-circle me-1\"></i>Table Details</a></div></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\"><i class=\"bi bi-info-circle me-1\"></i>Table Details</a></div></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.PreviewError != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<div class=\"alert alert-warning\"><i class=\"fas fa-exclamation-triangle me-2\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<div class=\"alert alert-warning\"><i class=\"bi bi-exclamation-triangle me-2\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var10 string
 			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(data.PreviewError)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 50, Col: 70}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 50, Col: 69}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 			if templ_7745c5c3_Err != nil {
@@ -165,14 +165,14 @@ func IcebergTableData(data dash.IcebergDataPreviewData) templ.Component {
 			}
 		}
 		for _, note := range data.PreviewNotes {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<div class=\"alert alert-info py-2 mb-2\"><i class=\"fas fa-info-circle me-2\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<div class=\"alert alert-info py-2 mb-2\"><i class=\"bi bi-info-circle me-2\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var11 string
 			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(note)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 55, Col: 48}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 55, Col: 47}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 			if templ_7745c5c3_Err != nil {
@@ -183,479 +183,515 @@ func IcebergTableData(data dash.IcebergDataPreviewData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Snapshot</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if data.SnapshotID != 0 {
-			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.SnapshotID))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 69, Col: 45}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+		if !previewIsWorkerSourced(data) {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Snapshot</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, " ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if data.SnapshotID == data.CurrentSnapshotID {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<span class=\"badge bg-success ms-1\">current</span>")
+			if data.SnapshotID != 0 {
+				var templ_7745c5c3_Var12 string
+				templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.SnapshotID))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 70, Col: 46}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, " ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if data.SnapshotID == data.CurrentSnapshotID {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<span class=\"badge bg-success ms-1\">current</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "-")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "-")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</div>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if !data.SnapshotTime.IsZero() {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<div class=\"small text-muted\">")
+			if !data.SnapshotTime.IsZero() {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<div class=\"small text-muted\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var13 string
+				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(data.SnapshotTime.Format("2006-01-02 15:04:05"))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 79, Col: 88}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</div>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</div><div class=\"col-auto\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var13 string
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(data.SnapshotTime.Format("2006-01-02 15:04:05"))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 78, Col: 87}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</div>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</div><div class=\"col-auto\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if len(data.Snapshots) > 1 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<div class=\"dropdown\"><button class=\"btn btn-sm btn-outline-secondary dropdown-toggle\" type=\"button\" data-bs-toggle=\"dropdown\" aria-expanded=\"false\">Switch</button><ul class=\"dropdown-menu dropdown-menu-end\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			for i, snapshot := range data.Snapshots {
-				if i < 25 {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<li><a class=\"dropdown-item small\" href=\"")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					var templ_7745c5c3_Var14 templ.SafeURL
-					templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, snapshot.SnapshotID, data.RowLimit, "")))
-					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 91, Col: 180}
-					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "\">")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					var templ_7745c5c3_Var15 string
-					templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", snapshot.SnapshotID))
-					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 92, Col: 54}
-					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, " ")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					if !snapshot.Timestamp.IsZero() {
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<span class=\"text-muted ms-1\">")
+			if len(data.Snapshots) > 1 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<div class=\"dropdown\"><button class=\"btn btn-sm btn-outline-secondary dropdown-toggle\" type=\"button\" data-bs-toggle=\"dropdown\" aria-expanded=\"false\">Switch</button><ul class=\"dropdown-menu dropdown-menu-end\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				for i, snapshot := range data.Snapshots {
+					if i < 25 {
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<li><a class=\"dropdown-item small\" href=\"")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-						var templ_7745c5c3_Var16 string
-						templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.Timestamp.Format("2006-01-02 15:04"))
+						var templ_7745c5c3_Var14 templ.SafeURL
+						templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, snapshot.SnapshotID, data.RowLimit, "")))
 						if templ_7745c5c3_Err != nil {
-							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 94, Col: 92}
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 92, Col: 181}
 						}
-						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
-						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</span>")
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "\">")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						var templ_7745c5c3_Var15 string
+						templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", snapshot.SnapshotID))
+						if templ_7745c5c3_Err != nil {
+							return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 93, Col: 55}
+						}
+						_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, " ")
+						if templ_7745c5c3_Err != nil {
+							return templ_7745c5c3_Err
+						}
+						if !snapshot.Timestamp.IsZero() {
+							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<span class=\"text-muted ms-1\">")
+							if templ_7745c5c3_Err != nil {
+								return templ_7745c5c3_Err
+							}
+							var templ_7745c5c3_Var16 string
+							templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.Timestamp.Format("2006-01-02 15:04"))
+							if templ_7745c5c3_Err != nil {
+								return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 95, Col: 93}
+							}
+							_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+							if templ_7745c5c3_Err != nil {
+								return templ_7745c5c3_Err
+							}
+							templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</span>")
+							if templ_7745c5c3_Err != nil {
+								return templ_7745c5c3_Err
+							}
+						}
+						templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</a></li>")
 						if templ_7745c5c3_Err != nil {
 							return templ_7745c5c3_Err
 						}
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</a></li>")
+				}
+				if len(data.Snapshots) > 25 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<li><hr class=\"dropdown-divider\"></li><li><a class=\"dropdown-item small text-muted\" href=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var17 templ.SafeURL
+					templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(data.CatalogName), url.PathEscape(data.NamespaceName), url.PathEscape(data.TableName))))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 104, Col: 252}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var18 string
+					templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d more in snapshot history…", len(data.Snapshots)-25))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 105, Col: 85}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "</a></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-			}
-			if len(data.Snapshots) > 25 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<li><hr class=\"dropdown-divider\"></li><li><a class=\"dropdown-item small text-muted\" href=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</ul></div>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var17 templ.SafeURL
-				templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(data.CatalogName), url.PathEscape(data.NamespaceName), url.PathEscape(data.TableName))))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 103, Col: 251}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\">")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var18 string
-				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d more in snapshot history…", len(data.Snapshots)-25))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 104, Col: 84}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "</a></li>")
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<i class=\"bi bi-clock-history icon-2x text-gray-300\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</ul></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Data Files</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<i class=\"fas fa-history fa-2x text-gray-300\"></i>")
+			var templ_7745c5c3_Var19 string
+			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(int64(data.TotalDataFiles)))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 128, Col: 51}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</div></div><div class=\"col-auto\"><i class=\"bi bi-copy icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Total Records</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var20 string
+			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(data.TotalRecords))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 147, Col: 42}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</div></div><div class=\"col-auto\"><i class=\"bi bi-list-ol icon-2x text-gray-300\"></i></div></div></div></div></div></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Data Files</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var19 string
-		templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(int64(data.TotalDataFiles)))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 127, Col: 50}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</div></div><div class=\"col-auto\"><i class=\"fas fa-copy fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Total Records</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var20 string
-		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(data.TotalRecords))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 146, Col: 41}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</div></div><div class=\"col-auto\"><i class=\"fas fa-list-ol fa-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3 d-flex justify-content-between align-items-center\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-table me-2\"></i>Sample Rows ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3 d-flex justify-content-between align-items-center\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-table me-2\"></i>Sample Rows ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.SelectedFile != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<span class=\"badge bg-secondary ms-2\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<span class=\"badge bg-secondary ms-2\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var21 string
 			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(path.Base(data.SelectedFile))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 164, Col: 75}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 166, Col: 75}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</span> <a class=\"small ms-2\" href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</span> <a class=\"small ms-2\" href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var22 templ.SafeURL
 			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, data.RowLimit, "")))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 165, Col: 161}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 167, Col: 161}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "\">all files</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "\">all files</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "</h6><div class=\"btn-group btn-group-sm\" role=\"group\" aria-label=\"Row limit\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</h6><div class=\"btn-group btn-group-sm\" role=\"group\" aria-label=\"Row limit\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, limit := range []int{25, 50, 100, 200} {
 			if limit == data.RowLimit {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<a class=\"btn btn-primary\" href=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<a class=\"btn btn-primary\" href=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var23 templ.SafeURL
 				templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, limit, data.SelectedFile)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 171, Col: 174}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 173, Col: 174}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var24 string
 				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", limit))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 171, Col: 203}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 173, Col: 203}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "</a>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "</a>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<a class=\"btn btn-outline-primary\" href=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<a class=\"btn btn-outline-primary\" href=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var25 templ.SafeURL
 				templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, limit, data.SelectedFile)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 173, Col: 182}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 175, Col: 182}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var26 string
 				templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", limit))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 173, Col: 211}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 175, Col: 211}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "</a>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</a>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</div></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "</div></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Columns) > 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<div class=\"table-responsive\"><table class=\"table table-sm table-hover table-striped\"><thead><tr><th class=\"text-muted\">#</th>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "<div class=\"table-responsive\"><table class=\"table table-sm table-hover table-striped\"><thead><tr><th class=\"text-muted\">#</th>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			for _, col := range data.Columns {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "<th>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "<th>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var27 string
 				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(col)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 186, Col: 20}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 188, Col: 20}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "</th>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "</th>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "</tr></thead> <tbody>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "</tr></thead> <tbody>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			for i, row := range data.Rows {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "<tr><td class=\"text-muted\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "<tr><td class=\"text-muted\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var28 string
 				templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i+1))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 193, Col: 58}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 195, Col: 58}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</td>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "</td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				for _, cell := range row {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<td><span class=\"small\">")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "<td><span class=\"small\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 					var templ_7745c5c3_Var29 string
 					templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(cell)
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 195, Col: 42}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 197, Col: 42}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</span></td>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</span></td>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "</tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "</tbody></table></div><div class=\"small text-muted\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "</tbody></table></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var30 string
-			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Showing %d row(s) from %d data file(s).", len(data.Rows), data.ScannedFiles))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 203, Col: 98}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "</div>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
+			if previewIsWorkerSourced(data) {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "<div class=\"small text-muted\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var30 string
+				templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Showing %d row(s), read from the %s dataset by worker %s.", len(data.Rows), data.Format, data.PreviewedBy))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 206, Col: 129}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "</div>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<div class=\"small text-muted\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var31 string
+				templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("Showing %d row(s) from %d data file(s).", len(data.Rows), data.ScannedFiles))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 210, Col: 99}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</div>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "<div class=\"text-center text-muted py-4\">No rows to preview.</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "<div class=\"text-center text-muted py-4\">No rows to preview.</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "</div></div></div></div><div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-copy me-2\"></i>Data Files</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-sm table-hover\"><thead><tr><th>Path</th><th>Format</th><th>Records</th><th>Size</th><th></th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "</div></div></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		for _, file := range data.DataFiles {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<tr><td><code class=\"small\">")
+		if !previewIsWorkerSourced(data) {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "<div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-copy me-2\"></i>Data Files</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-sm table-hover\"><thead><tr><th>Path</th><th>Format</th><th>Records</th><th>Size</th><th></th></tr></thead> <tbody>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var31 string
-			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(file.Path)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 235, Col: 45}
+			for _, file := range data.DataFiles {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "<tr><td><code class=\"small\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var32 string
+				templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(file.Path)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 244, Col: 46}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "</code></td><td><span class=\"badge bg-secondary\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var33 string
+				templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(file.Format)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 245, Col: 61}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "</span></td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var34 string
+				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(file.RecordCount))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 246, Col: 47}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var35 string
+				templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(file.SizeBytes))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 247, Col: 44}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "</td><td><a class=\"btn btn-sm btn-outline-primary\" href=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var36 templ.SafeURL
+				templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, data.RowLimit, file.Path)))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 249, Col: 193}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "\"><i class=\"bi bi-eye me-1\"></i>Preview</a></td></tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+			if len(data.DataFiles) == 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "<tr><td colspan=\"5\" class=\"text-center text-muted\">No data files in this snapshot.</td></tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "</tbody></table></div></div></div></div></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</code></td><td><span class=\"badge bg-secondary\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var32 string
-			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(file.Format)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 236, Col: 60}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "</span></td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var33 string
-			templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(file.RecordCount))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 237, Col: 46}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "</td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var34 string
-			templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(file.SizeBytes))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 238, Col: 43}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "</td><td><a class=\"btn btn-sm btn-outline-primary\" href=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var35 templ.SafeURL
-			templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, data.SnapshotID, data.RowLimit, file.Path)))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_data.templ`, Line: 240, Col: 192}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "\"><i class=\"fas fa-eye me-1\"></i>Preview</a></td></tr>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		if len(data.DataFiles) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "<tr><td colspan=\"5\" class=\"text-center text-muted\">No data files in this snapshot.</td></tr>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "</tbody></table></div></div></div></div></div>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
 		}
 		return nil
 	})
diff --git a/weed/admin/view/app/iceberg_table_data_urls.go b/weed/admin/view/app/iceberg_table_data_urls.go
index a106ceda51..82ce7d5b38 100644
--- a/weed/admin/view/app/iceberg_table_data_urls.go
+++ b/weed/admin/view/app/iceberg_table_data_urls.go
@@ -3,6 +3,10 @@ package app
 import (
 	"net/url"
 	"strconv"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 )
 
 // icebergTableDataURL builds the table data-preview page URL. Zero snapshotID
@@ -26,3 +30,10 @@ func icebergTableDataURL(catalog, namespace, table string, snapshotID int64, lim
 	}
 	return u
 }
+
+// previewIsWorkerSourced reports whether these rows came from a plugin worker
+// rather than from metadata admin read itself. Snapshots and data files are
+// Iceberg's shape, and showing them empty for another format reads as a fault.
+func previewIsWorkerSourced(data dash.IcebergDataPreviewData) bool {
+	return data.Format != "" && !strings.EqualFold(data.Format, s3tables.FormatIceberg)
+}
diff --git a/weed/admin/view/app/iceberg_table_details.templ b/weed/admin/view/app/iceberg_table_details.templ
index b6a286a193..6b5b40a97f 100644
--- a/weed/admin/view/app/iceberg_table_details.templ
+++ b/weed/admin/view/app/iceberg_table_details.templ
@@ -14,7 +14,7 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 				<ol class="breadcrumb mb-0">
 					<li class="breadcrumb-item">
 						<a href={ dash.PUrl(ctx, "/object-store/s3tables/buckets") }>
-							<i class="fas fa-table me-1"></i>Table Buckets
+							<i class="bi bi-table me-1"></i>Table Buckets
 						</a>
 					</li>
 					<li class="breadcrumb-item">
@@ -27,26 +27,31 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 							{ data.NamespaceName }
 						</a>
 					</li>
-					<li class="breadcrumb-item active">{ data.TableName }</li>
+					<li class="breadcrumb-item active">
+						{ data.TableName }
+						if data.Format != "" {
+							<span class={ formatBadgeClass(data.Format), "ms-2 align-middle" } title={ formatBadgeTitle(data.Format) }>{ formatLabel(data.Format) }</span>
+						}
+					</li>
 				</ol>
 			</nav>
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<a class="btn btn-sm btn-primary" href={ dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, 0, 0, "")) }>
-					<i class="fas fa-table me-1"></i>Browse Data
+					<i class="bi bi-table me-1"></i>Browse Data
 				</a>
 			</div>
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-danger iceberg-delete-table-btn" data-bucket-arn={ data.BucketARN } data-namespace={ data.NamespaceName } data-table-name={ data.TableName } data-catalog-name={ data.CatalogName }>
-					<i class="fas fa-trash me-1"></i>Drop Table
+					<i class="bi bi-trash me-1"></i>Drop Table
 				</button>
 			</div>
 		</div>
 	</div>
 	if data.MetadataError != "" {
 		<div class="alert alert-warning">
-			<i class="fas fa-exclamation-triangle me-2"></i>{ data.MetadataError }
+			<i class="bi bi-exclamation-triangle me-2"></i>{ data.MetadataError }
 		</div>
 	}
 	<div class="row mb-4">
@@ -67,7 +72,7 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 							</div>
 						</div>
 						<div class="col-auto">
-							<i class="fas fa-copy fa-2x text-gray-300"></i>
+							<i class="bi bi-copy icon-2x text-gray-300"></i>
 						</div>
 					</div>
 				</div>
@@ -90,7 +95,7 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 							</div>
 						</div>
 						<div class="col-auto">
-							<i class="fas fa-database fa-2x text-gray-300"></i>
+							<i class="bi bi-database icon-2x text-gray-300"></i>
 						</div>
 					</div>
 				</div>
@@ -113,7 +118,7 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 							</div>
 						</div>
 						<div class="col-auto">
-							<i class="fas fa-history fa-2x text-gray-300"></i>
+							<i class="bi bi-clock-history icon-2x text-gray-300"></i>
 						</div>
 					</div>
 				</div>
@@ -125,7 +130,7 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 			<div class="card shadow h-100">
 				<div class="card-header py-3">
 					<h6 class="m-0 font-weight-bold text-primary">
-						<i class="fas fa-info-circle me-2"></i>Table Metadata
+						<i class="bi bi-info-circle me-2"></i>Table Metadata
 					</h6>
 				</div>
 				<div class="card-body">
@@ -188,7 +193,7 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 			<div class="card shadow h-100">
 				<div class="card-header py-3">
 					<h6 class="m-0 font-weight-bold text-primary">
-						<i class="fas fa-sliders-h me-2"></i>Properties
+						<i class="bi bi-sliders me-2"></i>Properties
 					</h6>
 				</div>
 				<div class="card-body">
@@ -222,7 +227,12 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 			<div class="card shadow">
 				<div class="card-header py-3">
 					<h6 class="m-0 font-weight-bold text-primary">
-						<i class="fas fa-list me-2"></i>Schema
+						<i class="bi bi-list me-2"></i>Schema
+						if data.ObservedBy != "" {
+							<span class="badge bg-secondary ms-2" title={ "reported by " + data.ObservedBy }>
+								as seen { data.ObservedAt.Format("2006-01-02 15:04") }
+							</span>
+						}
 					</h6>
 				</div>
 				<div class="card-body">
@@ -253,7 +263,13 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 								}
 								if len(data.SchemaFields) == 0 {
 									<tr>
-										<td colspan="4" class="text-center text-muted">No schema available.</td>
+										if data.Format != "" && data.Format != "ICEBERG" {
+											<td colspan="4" class="text-center text-muted">
+												The catalog records where this { data.Format } table lives, not what is in it. Run a { data.Format } plugin worker and its schema appears here.
+											</td>
+										} else {
+											<td colspan="4" class="text-center text-muted">No schema available.</td>
+										}
 									</tr>
 								}
 							</tbody>
@@ -263,110 +279,149 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 			</div>
 		</div>
 	</div>
-	<div class="row">
-		<div class="col-12 mb-4">
-			<div class="card shadow">
-				<div class="card-header py-3">
-					<h6 class="m-0 font-weight-bold text-primary">
-						<i class="fas fa-layer-group me-2"></i>Partitions
-					</h6>
-				</div>
-				<div class="card-body">
-					<div class="table-responsive">
-						<table class="table table-hover">
-							<thead>
-								<tr>
-									<th>Name</th>
-									<th>Transform</th>
-									<th>Source ID</th>
-									<th>Field ID</th>
-								</tr>
-							</thead>
-							<tbody>
-								for _, field := range data.PartitionFields {
+	if !isLanceFormat(data.Format) {
+		<div class="row">
+			<div class="col-12 mb-4">
+				<div class="card shadow">
+					<div class="card-header py-3">
+						<h6 class="m-0 font-weight-bold text-primary">
+							<i class="bi bi-layers me-2"></i>Partitions
+						</h6>
+					</div>
+					<div class="card-body">
+						<div class="table-responsive">
+							<table class="table table-hover">
+								<thead>
 									<tr>
-										<td>{ field.Name }</td>
-										<td>{ field.Transform }</td>
-										<td>{ fmt.Sprintf("%d", field.SourceID) }</td>
-										<td>{ fmt.Sprintf("%d", field.FieldID) }</td>
+										<th>Name</th>
+										<th>Transform</th>
+										<th>Source ID</th>
+										<th>Field ID</th>
 									</tr>
-								}
-								if len(data.PartitionFields) == 0 {
-									<tr>
-										<td colspan="4" class="text-center text-muted">No partitions defined.</td>
-									</tr>
-								}
-							</tbody>
-						</table>
+								</thead>
+								<tbody>
+									for _, field := range data.PartitionFields {
+										<tr>
+											<td>{ field.Name }</td>
+											<td>{ field.Transform }</td>
+											<td>{ fmt.Sprintf("%d", field.SourceID) }</td>
+											<td>{ fmt.Sprintf("%d", field.FieldID) }</td>
+										</tr>
+									}
+									if len(data.PartitionFields) == 0 {
+										<tr>
+											<td colspan="4" class="text-center text-muted">No partitions defined.</td>
+										</tr>
+									}
+								</tbody>
+							</table>
+						</div>
 					</div>
 				</div>
 			</div>
 		</div>
-	</div>
-	<div class="row">
-		<div class="col-12">
-			<div class="card shadow mb-4">
-				<div class="card-header py-3">
-					<h6 class="m-0 font-weight-bold text-primary">
-						<i class="fas fa-history me-2"></i>Snapshot History
-					</h6>
-				</div>
-				<div class="card-body">
-					<div class="table-responsive">
-						<table class="table table-hover">
-							<thead>
-								<tr>
-									<th>Snapshot ID</th>
-									<th>Timestamp</th>
-									<th>Operation</th>
-									<th>Manifest List</th>
-								</tr>
-							</thead>
-							<tbody>
-								for _, snapshot := range data.Snapshots {
+	}
+	if !isLanceFormat(data.Format) {
+		<div class="row">
+			<div class="col-12">
+				<div class="card shadow mb-4">
+					<div class="card-header py-3">
+						<h6 class="m-0 font-weight-bold text-primary">
+							<i class="bi bi-clock-history me-2"></i>Snapshot History
+						</h6>
+					</div>
+					<div class="card-body">
+						<div class="table-responsive">
+							<table class="table table-hover">
+								<thead>
 									<tr>
-										<td>{ fmt.Sprintf("%d", snapshot.SnapshotID) }</td>
-										<td>
-											if snapshot.Timestamp.IsZero() {
-												<span class="text-muted">-</span>
-											} else {
-												{ snapshot.Timestamp.Format("2006-01-02 15:04") }
-											}
-										</td>
-										<td>
-											if snapshot.Operation != "" {
-												{ snapshot.Operation }
-											} else {
-												<span class="text-muted">-</span>
-											}
-										</td>
-										<td>
-											if snapshot.ManifestList != "" {
-												<code class="small">{ snapshot.ManifestList }</code>
-											} else {
-												<span class="text-muted">-</span>
-											}
-										</td>
+										<th>Snapshot ID</th>
+										<th>Timestamp</th>
+										<th>Operation</th>
+										<th>Manifest List</th>
 									</tr>
-								}
-								if len(data.Snapshots) == 0 {
-									<tr>
-										<td colspan="4" class="text-center text-muted">No snapshots available.</td>
-									</tr>
-								}
-							</tbody>
-						</table>
+								</thead>
+								<tbody>
+									for _, snapshot := range data.Snapshots {
+										<tr>
+											<td>{ fmt.Sprintf("%d", snapshot.SnapshotID) }</td>
+											<td>
+												if snapshot.Timestamp.IsZero() {
+													<span class="text-muted">-</span>
+												} else {
+													{ snapshot.Timestamp.Format("2006-01-02 15:04") }
+												}
+											</td>
+											<td>
+												if snapshot.Operation != "" {
+													{ snapshot.Operation }
+												} else {
+													<span class="text-muted">-</span>
+												}
+											</td>
+											<td>
+												if snapshot.ManifestList != "" {
+													<code class="small">{ snapshot.ManifestList }</code>
+												} else {
+													<span class="text-muted">-</span>
+												}
+											</td>
+										</tr>
+									}
+									if len(data.Snapshots) == 0 {
+										<tr>
+											if data.Format != "" && data.Format != "ICEBERG" {
+												<td colspan="4" class="text-center text-muted">
+													A { data.Format } table keeps its own version history; the catalog does not mirror it here.
+												</td>
+											} else {
+												<td colspan="4" class="text-center text-muted">No snapshots available.</td>
+											}
+										</tr>
+									}
+								</tbody>
+							</table>
+						</div>
 					</div>
 				</div>
 			</div>
 		</div>
-	</div>
+	}
+	if isLanceFormat(data.Format) {
+		<div class="row">
+			<div class="col-12 mb-4">
+				<div class="card shadow">
+					<div class="card-header py-3">
+						<h6 class="m-0 font-weight-bold text-primary">
+							<i class="bi bi-clock-history me-2"></i>Versions
+							if data.ObservedBy != "" {
+								<span class="badge bg-secondary ms-2" title={ "reported by " + data.ObservedBy }>
+									as seen { data.ObservedAt.Format("2006-01-02 15:04") }
+								</span>
+							}
+						</h6>
+					</div>
+					<div class="card-body">
+						if len(data.Properties) > 0 {
+							<p class="text-muted mb-0">
+								A { data.Format } dataset keeps its own version history. What a worker last saw is listed under Properties above.
+							</p>
+						} else {
+							<p class="text-muted mb-0">
+								No worker has reported on this table yet, so its version history is unknown here. It lives in the dataset either way.
+							</p>
+						}
+					</div>
+				</div>
+			</div>
+		</div>
+	}
 	<div class="modal fade" id="deleteIcebergTableModal" tabindex="-1" aria-labelledby="deleteIcebergTableModalLabel" aria-hidden="true">
 		<div class="modal-dialog">
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="deleteIcebergTableModalLabel">
-						<i class="fas fa-exclamation-triangle me-2 text-warning"></i>Drop Table
+						<i class="bi bi-exclamation-triangle me-2 text-warning"></i>Drop Table
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -380,7 +435,7 @@ templ IcebergTableDetails(data dash.IcebergTableDetailsData) {
 				<div class="modal-footer">
 					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 					<button type="button" class="btn btn-danger" onclick="deleteIcebergTable()">
-						<i class="fas fa-trash me-1"></i>Drop Table
+						<i class="bi bi-trash me-1"></i>Drop Table
 					</button>
 				</div>
 			</div>
diff --git a/weed/admin/view/app/iceberg_table_details_templ.go b/weed/admin/view/app/iceberg_table_details_templ.go
index faeedf4b9c..e480f679f5 100644
--- a/weed/admin/view/app/iceberg_table_details_templ.go
+++ b/weed/admin/view/app/iceberg_table_details_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -49,7 +49,7 @@ func IcebergTableDetails(data dash.IcebergTableDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"fas fa-table me-1\"></i>Table Buckets</a></li><li class=\"breadcrumb-item\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"bi bi-table me-1\"></i>Table Buckets</a></li><li class=\"breadcrumb-item\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -108,339 +108,351 @@ func IcebergTableDetails(data dash.IcebergTableDetailsData) templ.Component {
 		var templ_7745c5c3_Var7 string
 		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(data.TableName)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 30, Col: 56}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 31, Col: 22}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</li></ol></nav></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><a class=\"btn btn-sm btn-primary\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, " ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var8 templ.SafeURL
-		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, 0, 0, "")))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 36, Col: 144}
+		if data.Format != "" {
+			var templ_7745c5c3_Var8 = []any{formatBadgeClass(data.Format), "ms-2 align-middle"}
+			templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var8...)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "<span class=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var9 string
+			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var8).String())
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 1, Col: 0}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\" title=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var10 string
+			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(formatBadgeTitle(data.Format))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 33, Col: 111}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var11 string
+			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(formatLabel(data.Format))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 33, Col: 140}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</span>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</li></ol></nav></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><a class=\"btn btn-sm btn-primary\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "\"><i class=\"fas fa-table me-1\"></i>Browse Data</a></div><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-danger iceberg-delete-table-btn\" data-bucket-arn=\"")
+		var templ_7745c5c3_Var12 templ.SafeURL
+		templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, icebergTableDataURL(data.CatalogName, data.NamespaceName, data.TableName, 0, 0, "")))
 		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var9 string
-		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 41, Col: 113}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\" data-namespace=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var10 string
-		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(data.NamespaceName)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 41, Col: 151}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "\" data-table-name=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var11 string
-		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(data.TableName)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 41, Col: 186}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\" data-catalog-name=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var12 string
-		templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(data.CatalogName)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 41, Col: 225}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 41, Col: 144}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"fas fa-trash me-1\"></i>Drop Table</button></div></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><i class=\"bi bi-table me-1\"></i>Browse Data</a></div><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-danger iceberg-delete-table-btn\" data-bucket-arn=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var13 string
+		templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 46, Col: 113}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\" data-namespace=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var14 string
+		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.NamespaceName)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 46, Col: 151}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\" data-table-name=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var15 string
+		templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.TableName)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 46, Col: 186}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "\" data-catalog-name=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var16 string
+		templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.CatalogName)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 46, Col: 225}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\"><i class=\"bi bi-trash me-1\"></i>Drop Table</button></div></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.MetadataError != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<div class=\"alert alert-warning\"><i class=\"fas fa-exclamation-triangle me-2\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<div class=\"alert alert-warning\"><i class=\"bi bi-exclamation-triangle me-2\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var13 string
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(data.MetadataError)
+			var templ_7745c5c3_Var17 string
+			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(data.MetadataError)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 49, Col: 71}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 54, Col: 70}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "<div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Data Files</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Data Files</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.HasDataFileCount {
-			var templ_7745c5c3_Var14 string
-			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(data.DataFileCount))
+			var templ_7745c5c3_Var18 string
+			templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(data.DataFileCount))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 63, Col: 43}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 68, Col: 43}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "-")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "-")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</div></div><div class=\"col-auto\"><i class=\"fas fa-copy fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Size</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</div></div><div class=\"col-auto\"><i class=\"bi bi-copy icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Size</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.HasTotalSize {
-			var templ_7745c5c3_Var15 string
-			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(data.TotalSizeBytes))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 86, Col: 43}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "-")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</div></div><div class=\"col-auto\"><i class=\"fas fa-database fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Snapshots</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if data.HasSnapshotCount {
-			var templ_7745c5c3_Var16 string
-			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(int64(data.SnapshotCount)))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 109, Col: 50}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "-")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</div></div><div class=\"col-auto\"><i class=\"fas fa-history fa-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-lg-6 mb-4\"><div class=\"card shadow h-100\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-info-circle me-2\"></i>Table Metadata</h6></div><div class=\"card-body\"><table class=\"table table-sm\"><tbody><tr><th>Table ARN</th><td class=\"text-muted small\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var17 string
-		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(data.TableARN)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 136, Col: 52}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</td></tr><tr><th>Format</th><td>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var18 string
-		templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(data.Format)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 140, Col: 25}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "</td></tr><tr><th>Table Location</th><td>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if data.TableLocation != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "<code class=\"small\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
 			var templ_7745c5c3_Var19 string
-			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(data.TableLocation)
+			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(data.TotalSizeBytes))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 146, Col: 50}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 91, Col: 43}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "</code>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<span class=\"text-muted\">-</span>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "-")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</td></tr><tr><th>Metadata Location</th><td>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</div></div><div class=\"col-auto\"><i class=\"bi bi-database icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Snapshots</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if data.MetadataLocation != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<code class=\"small\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
+		if data.HasSnapshotCount {
 			var templ_7745c5c3_Var20 string
-			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(data.MetadataLocation)
+			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(formatNumber(int64(data.SnapshotCount)))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 156, Col: 53}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 114, Col: 50}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "</code>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<span class=\"text-muted\">-</span>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "-")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "</td></tr><tr><th>Created</th><td>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock-history icon-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-lg-6 mb-4\"><div class=\"card shadow h-100\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-info-circle me-2\"></i>Table Metadata</h6></div><div class=\"card-body\"><table class=\"table table-sm\"><tbody><tr><th>Table ARN</th><td class=\"text-muted small\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if !data.CreatedAt.IsZero() {
-			var templ_7745c5c3_Var21 string
-			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(data.CreatedAt.Format("2006-01-02 15:04"))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 166, Col: 53}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<span class=\"text-muted\">-</span>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
+		var templ_7745c5c3_Var21 string
+		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(data.TableARN)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 141, Col: 52}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</td></tr><tr><th>Modified</th><td>")
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if !data.ModifiedAt.IsZero() {
-			var templ_7745c5c3_Var22 string
-			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(data.ModifiedAt.Format("2006-01-02 15:04"))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 176, Col: 54}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "<span class=\"text-muted\">-</span>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</td></tr></tbody></table></div></div></div><div class=\"col-lg-6 mb-4\"><div class=\"card shadow h-100\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-sliders-h me-2\"></i>Properties</h6></div><div class=\"card-body\"><table class=\"table table-sm\"><thead><tr><th>Key</th><th>Value</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</td></tr><tr><th>Format</th><td>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		for _, prop := range data.Properties {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<tr><td>")
+		var templ_7745c5c3_Var22 string
+		templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(data.Format)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 145, Col: 25}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</td></tr><tr><th>Table Location</th><td>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if data.TableLocation != "" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<code class=\"small\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var23 string
-			templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(prop.Key)
+			templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(data.TableLocation)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 205, Col: 23}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 151, Col: 50}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</code>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<span class=\"text-muted\">-</span>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</td></tr><tr><th>Metadata Location</th><td>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if data.MetadataLocation != "" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<code class=\"small\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var24 string
-			templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(prop.Value)
+			templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(data.MetadataLocation)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 206, Col: 25}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 161, Col: 53}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</code>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "<span class=\"text-muted\">-</span>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		if len(data.Properties) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<tr><td colspan=\"2\" class=\"text-center text-muted\">No properties available.</td></tr>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "</tbody></table></div></div></div></div><div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-list me-2\"></i>Schema</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\"><thead><tr><th>ID</th><th>Name</th><th>Type</th><th>Required</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</td></tr><tr><th>Created</th><td>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		for _, field := range data.SchemaFields {
+		if !data.CreatedAt.IsZero() {
+			var templ_7745c5c3_Var25 string
+			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(data.CreatedAt.Format("2006-01-02 15:04"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 171, Col: 53}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<span class=\"text-muted\">-</span>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</td></tr><tr><th>Modified</th><td>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if !data.ModifiedAt.IsZero() {
+			var templ_7745c5c3_Var26 string
+			templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(data.ModifiedAt.Format("2006-01-02 15:04"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 181, Col: 54}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<span class=\"text-muted\">-</span>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "</td></tr></tbody></table></div></div></div><div class=\"col-lg-6 mb-4\"><div class=\"card shadow h-100\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-sliders me-2\"></i>Properties</h6></div><div class=\"card-body\"><table class=\"table table-sm\"><thead><tr><th>Key</th><th>Value</th></tr></thead> <tbody>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, prop := range data.Properties {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<tr><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var25 string
-			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", field.ID))
+			var templ_7745c5c3_Var27 string
+			templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(prop.Key)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 242, Col: 43}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 210, Col: 23}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -448,69 +460,77 @@ func IcebergTableDetails(data dash.IcebergTableDetailsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var26 string
-			templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(field.Name)
+			var templ_7745c5c3_Var28 string
+			templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(prop.Value)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 243, Col: 26}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 211, Col: 25}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "</td><td><code>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var27 string
-			templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(string(field.Type))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 244, Col: 40}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "</code></td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if field.Required {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<span class=\"badge bg-success\">Yes</span>")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<span class=\"badge bg-secondary\">No</span>")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "</td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "</td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		if len(data.SchemaFields) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "<tr><td colspan=\"4\" class=\"text-center text-muted\">No schema available.</td></tr>")
+		if len(data.Properties) == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<tr><td colspan=\"2\" class=\"text-center text-muted\">No properties available.</td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "</tbody></table></div></div></div></div></div><div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-layer-group me-2\"></i>Partitions</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\"><thead><tr><th>Name</th><th>Transform</th><th>Source ID</th><th>Field ID</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "</tbody></table></div></div></div></div><div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-list me-2\"></i>Schema ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		for _, field := range data.PartitionFields {
+		if data.ObservedBy != "" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<span class=\"badge bg-secondary ms-2\" title=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var29 string
+			templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue("reported by " + data.ObservedBy)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 232, Col: 85}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "\">as seen ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var30 string
+			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(data.ObservedAt.Format("2006-01-02 15:04"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 233, Col: 60}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "</span>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\"><thead><tr><th>ID</th><th>Name</th><th>Type</th><th>Required</th></tr></thead> <tbody>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, field := range data.SchemaFields {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "<tr><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var28 string
-			templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(field.Name)
+			var templ_7745c5c3_Var31 string
+			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", field.ID))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 288, Col: 26}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 252, Col: 43}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -518,150 +538,375 @@ func IcebergTableDetails(data dash.IcebergTableDetailsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var29 string
-			templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(field.Transform)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 289, Col: 31}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "</td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var30 string
-			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", field.SourceID))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 290, Col: 49}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var31 string
-			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", field.FieldID))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 291, Col: 48}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "</td></tr>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		if len(data.PartitionFields) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "<tr><td colspan=\"4\" class=\"text-center text-muted\">No partitions defined.</td></tr>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</tbody></table></div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-history me-2\"></i>Snapshot History</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\"><thead><tr><th>Snapshot ID</th><th>Timestamp</th><th>Operation</th><th>Manifest List</th></tr></thead> <tbody>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		for _, snapshot := range data.Snapshots {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "<tr><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
 			var templ_7745c5c3_Var32 string
-			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", snapshot.SnapshotID))
+			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(field.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 328, Col: 54}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 253, Col: 26}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "</td><td><code>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			if snapshot.Timestamp.IsZero() {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "<span class=\"text-muted\">-</span>")
+			var templ_7745c5c3_Var33 string
+			templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(string(field.Type))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 254, Col: 40}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "</code></td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if field.Required {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<span class=\"badge bg-success\">Yes</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				var templ_7745c5c3_Var33 string
-				templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.Timestamp.Format("2006-01-02 15:04"))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 333, Col: 59}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "<span class=\"badge bg-secondary\">No</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			if snapshot.Operation != "" {
-				var templ_7745c5c3_Var34 string
-				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.Operation)
+		}
+		if len(data.SchemaFields) == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "<tr>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if data.Format != "" && data.Format != "ICEBERG" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "<td colspan=\"4\" class=\"text-center text-muted\">The catalog records where this ")
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 338, Col: 32}
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var34 string
+				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(data.Format)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 268, Col: 56}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<span class=\"text-muted\">-</span>")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if snapshot.ManifestList != "" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "<code class=\"small\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, " table lives, not what is in it. Run a ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var35 string
-				templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.ManifestList)
+				templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(data.Format)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 345, Col: 55}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 268, Col: 110}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "</code>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, " plugin worker and its schema appears here.</td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "<span class=\"text-muted\">-</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<td colspan=\"4\" class=\"text-center text-muted\">No schema available.</td>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "</td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "</tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		if len(data.Snapshots) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "<tr><td colspan=\"4\" class=\"text-center text-muted\">No snapshots available.</td></tr>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "</tbody></table></div></div></div></div></div>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if !isLanceFormat(data.Format) {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-layers me-2\"></i>Partitions</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\"><thead><tr><th>Name</th><th>Transform</th><th>Source ID</th><th>Field ID</th></tr></thead> <tbody>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			for _, field := range data.PartitionFields {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "<tr><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var36 string
+				templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(field.Name)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 305, Col: 27}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var37 string
+				templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(field.Transform)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 306, Col: 32}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var38 string
+				templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", field.SourceID))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 307, Col: 50}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var39 string
+				templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", field.FieldID))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 308, Col: 49}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "</td></tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			if len(data.PartitionFields) == 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "<tr><td colspan=\"4\" class=\"text-center text-muted\">No partitions defined.</td></tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "</tbody></table></div></div></div></div></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "</tbody></table></div></div></div></div></div><div class=\"modal fade\" id=\"deleteIcebergTableModal\" tabindex=\"-1\" aria-labelledby=\"deleteIcebergTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteIcebergTableModalLabel\"><i class=\"fas fa-exclamation-triangle me-2 text-warning\"></i>Drop Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to drop the table <strong id=\"deleteIcebergTableName\"></strong>?</p><div class=\"mb-3\"><label for=\"deleteIcebergTableVersion\" class=\"form-label\">Version Token (optional)</label> <input type=\"text\" class=\"form-control\" id=\"deleteIcebergTableVersion\" placeholder=\"Version token\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteIcebergTable()\"><i class=\"fas fa-trash me-1\"></i>Drop Table</button></div></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitIcebergTableDetails();\n\t\t});\n\t</script>")
+		if !isLanceFormat(data.Format) {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "<div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-clock-history me-2\"></i>Snapshot History</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\"><thead><tr><th>Snapshot ID</th><th>Timestamp</th><th>Operation</th><th>Manifest List</th></tr></thead> <tbody>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			for _, snapshot := range data.Snapshots {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "<tr><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var40 string
+				templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", snapshot.SnapshotID))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 347, Col: 55}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if snapshot.Timestamp.IsZero() {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "<span class=\"text-muted\">-</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					var templ_7745c5c3_Var41 string
+					templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.Timestamp.Format("2006-01-02 15:04"))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 352, Col: 60}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if snapshot.Operation != "" {
+					var templ_7745c5c3_Var42 string
+					templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.Operation)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 357, Col: 33}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, "<span class=\"text-muted\">-</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, "</td><td>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if snapshot.ManifestList != "" {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, "<code class=\"small\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var43 string
+					templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(snapshot.ManifestList)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 364, Col: 56}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "</code>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "<span class=\"text-muted\">-</span>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "</td></tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			if len(data.Snapshots) == 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "<tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if data.Format != "" && data.Format != "ICEBERG" {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "<td colspan=\"4\" class=\"text-center text-muted\">A ")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var44 string
+					templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(data.Format)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 375, Col: 28}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, " table keeps its own version history; the catalog does not mirror it here.</td>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "<td colspan=\"4\" class=\"text-center text-muted\">No snapshots available.</td>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "</tr>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "</tbody></table></div></div></div></div></div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		if isLanceFormat(data.Format) {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "<div class=\"row\"><div class=\"col-12 mb-4\"><div class=\"card shadow\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-clock-history me-2\"></i>Versions ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if data.ObservedBy != "" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "<span class=\"badge bg-secondary ms-2\" title=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var45 string
+				templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.ResolveAttributeValue("reported by " + data.ObservedBy)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 398, Col: 86}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var45)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\">as seen ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var46 string
+				templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(data.ObservedAt.Format("2006-01-02 15:04"))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 399, Col: 61}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "</span>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "</h6></div><div class=\"card-body\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if len(data.Properties) > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, "<p class=\"text-muted mb-0\">A ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var47 string
+				templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinStringErrs(data.Format)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_table_details.templ`, Line: 407, Col: 23}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var47))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, " dataset keeps its own version history. What a worker last saw is listed under Properties above.</p>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "<p class=\"text-muted mb-0\">No worker has reported on this table yet, so its version history is unknown here. It lives in the dataset either way.</p>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "</div></div></div></div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, "<div class=\"modal fade\" id=\"deleteIcebergTableModal\" tabindex=\"-1\" aria-labelledby=\"deleteIcebergTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteIcebergTableModalLabel\"><i class=\"bi bi-exclamation-triangle me-2 text-warning\"></i>Drop Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to drop the table <strong id=\"deleteIcebergTableName\"></strong>?</p><div class=\"mb-3\"><label for=\"deleteIcebergTableVersion\" class=\"form-label\">Version Token (optional)</label> <input type=\"text\" class=\"form-control\" id=\"deleteIcebergTableVersion\" placeholder=\"Version token\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteIcebergTable()\"><i class=\"bi bi-trash me-1\"></i>Drop Table</button></div></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitIcebergTableDetails();\n\t\t});\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/iceberg_tables.templ b/weed/admin/view/app/iceberg_tables.templ
index f28423cc96..acd422b43a 100644
--- a/weed/admin/view/app/iceberg_tables.templ
+++ b/weed/admin/view/app/iceberg_tables.templ
@@ -14,7 +14,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 				<ol class="breadcrumb mb-0">
 					<li class="breadcrumb-item">
 						<a href={ dash.PUrl(ctx, "/object-store/iceberg") }>
-							<i class="fas fa-snowflake me-1"></i>Iceberg Catalog
+							<i class="bi bi-snow me-1"></i>Iceberg Catalog
 						</a>
 					</li>
 					<li class="breadcrumb-item">
@@ -29,7 +29,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-primary" data-bs-toggle="modal" data-bs-target="#createIcebergTableModal">
-					<i class="fas fa-plus me-1"></i>Create Table
+					<i class="bi bi-plus me-1"></i>Create Table
 				</button>
 			</div>
 		</div>
@@ -54,7 +54,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-folder fa-2x text-gray-300"></i>
+								<i class="bi bi-folder icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -73,7 +73,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-table fa-2x text-gray-300"></i>
+								<i class="bi bi-table icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -87,7 +87,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-table me-2"></i>Tables
+							<i class="bi bi-table me-2"></i>Tables
 						</h6>
 					</div>
 					<div class="card-body">
@@ -106,7 +106,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 									for _, table := range data.Tables {
 										<tr>
 											<td>
-												<i class="fas fa-table text-primary me-2"></i>
+												<i class="bi bi-table text-primary me-2"></i>
 												<strong>{ table.Name }</strong>
 											</td>
 											<td>
@@ -125,10 +125,10 @@ templ IcebergTables(data dash.IcebergTablesData) {
 											<td>
 												<div class="btn-group btn-group-sm" role="group">
 													<a class="btn btn-outline-primary btn-sm" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/iceberg/%s/namespaces/%s/tables/%s", url.PathEscape(data.CatalogName), url.PathEscape(data.NamespaceName), url.PathEscape(table.Name))) } title="View Details">
-														<i class="fas fa-eye"></i>
+														<i class="bi bi-eye"></i>
 													</a>
 													<button type="button" class="btn btn-outline-danger btn-sm iceberg-delete-table-btn" data-bucket-arn={ data.BucketARN } data-namespace={ data.NamespaceName } data-table-name={ table.Name } data-catalog-name={ data.CatalogName } title="Drop Table">
-														<i class="fas fa-trash"></i>
+														<i class="bi bi-trash"></i>
 													</button>
 												</div>
 											</td>
@@ -137,7 +137,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 									if len(data.Tables) == 0 {
 										<tr>
 											<td colspan="5" class="text-center text-muted py-4">
-												<i class="fas fa-table fa-3x mb-3 text-muted"></i>
+												<i class="bi bi-table icon-3x mb-3 text-muted"></i>
 												<div>
 													<h5>No tables found</h5>
 													<p>Create tables via the Iceberg REST API.</p>
@@ -158,7 +158,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="createIcebergTableModalLabel">
-						<i class="fas fa-plus me-2"></i>Create Table
+						<i class="bi bi-plus me-2"></i>Create Table
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -187,7 +187,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-plus me-1"></i>Create
+							<i class="bi bi-plus me-1"></i>Create
 						</button>
 					</div>
 				</form>
@@ -199,7 +199,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="deleteIcebergTableModalLabel">
-						<i class="fas fa-exclamation-triangle me-2 text-warning"></i>Drop Table
+						<i class="bi bi-exclamation-triangle me-2 text-warning"></i>Drop Table
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -213,7 +213,7 @@ templ IcebergTables(data dash.IcebergTablesData) {
 				<div class="modal-footer">
 					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 					<button type="button" class="btn btn-danger" onclick="deleteIcebergTable()">
-						<i class="fas fa-trash me-1"></i>Drop Table
+						<i class="bi bi-trash me-1"></i>Drop Table
 					</button>
 				</div>
 			</div>
diff --git a/weed/admin/view/app/iceberg_tables_templ.go b/weed/admin/view/app/iceberg_tables_templ.go
index 8645575965..68cc4dfeb6 100644
--- a/weed/admin/view/app/iceberg_tables_templ.go
+++ b/weed/admin/view/app/iceberg_tables_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -49,7 +49,7 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"fas fa-snowflake me-1\"></i>Iceberg Catalog</a></li><li class=\"breadcrumb-item\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\"><i class=\"bi bi-snow me-1\"></i>Iceberg Catalog</a></li><li class=\"breadcrumb-item\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -88,7 +88,7 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</li></ol></nav></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createIcebergTableModal\"><i class=\"fas fa-plus me-1\"></i>Create Table</button></div></div></div><div class=\"mb-3\"><span class=\"text-muted\">Bucket ARN: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</li></ol></nav></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createIcebergTableModal\"><i class=\"bi bi-plus me-1\"></i>Create Table</button></div></div></div><div class=\"mb-3\"><span class=\"text-muted\">Bucket ARN: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -119,11 +119,11 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var8 string
-		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_tables.templ`, Line: 41, Col: 66}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var8)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -132,11 +132,11 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var9 string
-		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(data.NamespaceName)
+		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.NamespaceName)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_tables.templ`, Line: 41, Col: 104}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -145,11 +145,11 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var10 string
-		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(data.CatalogName)
+		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.CatalogName)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_tables.templ`, Line: 41, Col: 143}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -166,7 +166,7 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"fas fa-folder fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Tables</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"bi bi-folder icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Tables</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -179,12 +179,12 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><div class=\"col-auto\"><i class=\"fas fa-table fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Tables List --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-table me-2\"></i>Tables</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Table Name</th><th>Type</th><th>S3 Location</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><div class=\"col-auto\"><i class=\"bi bi-table icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Tables List --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-table me-2\"></i>Tables</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Table Name</th><th>Type</th><th>S3 Location</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, table := range data.Tables {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<tr><td><i class=\"fas fa-table text-primary me-2\"></i> <strong>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<tr><td><i class=\"bi bi-table text-primary me-2\"></i> <strong>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -269,16 +269,16 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\" title=\"View Details\"><i class=\"fas fa-eye\"></i></a> <button type=\"button\" class=\"btn btn-outline-danger btn-sm iceberg-delete-table-btn\" data-bucket-arn=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\" title=\"View Details\"><i class=\"bi bi-eye\"></i></a> <button type=\"button\" class=\"btn btn-outline-danger btn-sm iceberg-delete-table-btn\" data-bucket-arn=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var19 string
-			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_tables.templ`, Line: 130, Col: 130}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var19)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -287,11 +287,11 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var20 string
-			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(data.NamespaceName)
+			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.NamespaceName)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_tables.templ`, Line: 130, Col: 168}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -300,11 +300,11 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var21 string
-			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(table.Name)
+			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(table.Name)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_tables.templ`, Line: 130, Col: 199}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -313,26 +313,26 @@ func IcebergTables(data dash.IcebergTablesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var22 string
-			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(data.CatalogName)
+			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.CatalogName)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/iceberg_tables.templ`, Line: 130, Col: 238}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "\" title=\"Drop Table\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "\" title=\"Drop Table\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.Tables) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<tr><td colspan=\"5\" class=\"text-center text-muted py-4\"><i class=\"fas fa-table fa-3x mb-3 text-muted\"></i><div><h5>No tables found</h5><p>Create tables via the Iceberg REST API.</p></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<tr><td colspan=\"5\" class=\"text-center text-muted py-4\"><i class=\"bi bi-table icon-3x mb-3 text-muted\"></i><div><h5>No tables found</h5><p>Create tables via the Iceberg REST API.</p></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createIcebergTableModal\" tabindex=\"-1\" aria-labelledby=\"createIcebergTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createIcebergTableModalLabel\"><i class=\"fas fa-plus me-2\"></i>Create Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createIcebergTableForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"icebergTableCsrfToken\" name=\"csrf_token\"><div class=\"mb-3\"><label for=\"icebergTableName\" class=\"form-label\">Table Name</label> <input type=\"text\" class=\"form-control\" id=\"icebergTableName\" name=\"name\" required></div><div class=\"mb-3\"><label for=\"icebergTableFormat\" class=\"form-label\">Format</label> <select class=\"form-select\" id=\"icebergTableFormat\" name=\"format\"><option value=\"ICEBERG\" selected>ICEBERG</option></select></div><div class=\"mb-3\"><label for=\"icebergTableMetadata\" class=\"form-label\">Metadata JSON (optional)</label> <textarea class=\"form-control\" id=\"icebergTableMetadata\" name=\"metadata\" rows=\"6\" placeholder=\"{ }\"></textarea></div><div class=\"mb-3\"><label for=\"icebergTableTags\" class=\"form-label\">Tags</label> <input type=\"text\" class=\"form-control\" id=\"icebergTableTags\" name=\"tags\" placeholder=\"key1=value1,key2=value2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteIcebergTableModal\" tabindex=\"-1\" aria-labelledby=\"deleteIcebergTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteIcebergTableModalLabel\"><i class=\"fas fa-exclamation-triangle me-2 text-warning\"></i>Drop Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to drop the table <strong id=\"deleteIcebergTableName\"></strong>?</p><div class=\"mb-3\"><label for=\"deleteIcebergTableVersion\" class=\"form-label\">Version Token (optional)</label> <input type=\"text\" class=\"form-control\" id=\"deleteIcebergTableVersion\" placeholder=\"Version token\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteIcebergTable()\"><i class=\"fas fa-trash me-1\"></i>Drop Table</button></div></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitIcebergTables();\n\t\t});\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createIcebergTableModal\" tabindex=\"-1\" aria-labelledby=\"createIcebergTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createIcebergTableModalLabel\"><i class=\"bi bi-plus me-2\"></i>Create Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createIcebergTableForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"icebergTableCsrfToken\" name=\"csrf_token\"><div class=\"mb-3\"><label for=\"icebergTableName\" class=\"form-label\">Table Name</label> <input type=\"text\" class=\"form-control\" id=\"icebergTableName\" name=\"name\" required></div><div class=\"mb-3\"><label for=\"icebergTableFormat\" class=\"form-label\">Format</label> <select class=\"form-select\" id=\"icebergTableFormat\" name=\"format\"><option value=\"ICEBERG\" selected>ICEBERG</option></select></div><div class=\"mb-3\"><label for=\"icebergTableMetadata\" class=\"form-label\">Metadata JSON (optional)</label> <textarea class=\"form-control\" id=\"icebergTableMetadata\" name=\"metadata\" rows=\"6\" placeholder=\"{ }\"></textarea></div><div class=\"mb-3\"><label for=\"icebergTableTags\" class=\"form-label\">Tags</label> <input type=\"text\" class=\"form-control\" id=\"icebergTableTags\" name=\"tags\" placeholder=\"key1=value1,key2=value2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteIcebergTableModal\" tabindex=\"-1\" aria-labelledby=\"deleteIcebergTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteIcebergTableModalLabel\"><i class=\"bi bi-exclamation-triangle me-2 text-warning\"></i>Drop Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to drop the table <strong id=\"deleteIcebergTableName\"></strong>?</p><div class=\"mb-3\"><label for=\"deleteIcebergTableVersion\" class=\"form-label\">Version Token (optional)</label> <input type=\"text\" class=\"form-control\" id=\"deleteIcebergTableVersion\" placeholder=\"Version token\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteIcebergTable()\"><i class=\"bi bi-trash me-1\"></i>Drop Table</button></div></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitIcebergTables();\n\t\t});\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/mount_clients.templ b/weed/admin/view/app/mount_clients.templ
index cebd7527f7..aaffb18bed 100644
--- a/weed/admin/view/app/mount_clients.templ
+++ b/weed/admin/view/app/mount_clients.templ
@@ -8,12 +8,12 @@ import (
 templ MountClients(data dash.MountClientsData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-plug me-2"></i>Mount Clients
+			<i class="bi bi-plug me-2"></i>Mount Clients
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-outline-primary" onclick="exportMountClients()">
-					<i class="fas fa-download me-1"></i>Export
+					<i class="bi bi-download me-1"></i>Export
 				</button>
 			</div>
 		</div>
@@ -35,7 +35,7 @@ templ MountClients(data dash.MountClientsData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-plug fa-2x text-gray-300"></i>
+								<i class="bi bi-plug icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -47,7 +47,7 @@ templ MountClients(data dash.MountClientsData) {
 		<div class="card shadow mb-4">
 			<div class="card-header py-3">
 				<h6 class="m-0 font-weight-bold text-primary">
-					<i class="fas fa-plug me-2"></i>Mount Clients
+					<i class="bi bi-plug me-2"></i>Mount Clients
 				</h6>
 			</div>
 			<div class="card-body">
@@ -90,7 +90,7 @@ templ MountClients(data dash.MountClientsData) {
 					</div>
 				} else {
 					<div class="text-center py-5">
-						<i class="fas fa-plug fa-3x text-muted mb-3"></i>
+						<i class="bi bi-plug icon-3x text-muted mb-3"></i>
 						<h5 class="text-muted">No Mount Clients Found</h5>
 						<p class="text-muted">No FUSE or VFS mounts are currently connected to the cluster's filers.</p>
 					</div>
@@ -102,7 +102,7 @@ templ MountClients(data dash.MountClientsData) {
 		<div class="row">
 			<div class="col-12">
 				<small class="text-muted">
-					<i class="fas fa-clock me-1"></i>
+					<i class="bi bi-clock me-1"></i>
 					Last updated: { data.LastUpdated.Format("2006-01-02 15:04:05") }
 				</small>
 			</div>
diff --git a/weed/admin/view/app/mount_clients_templ.go b/weed/admin/view/app/mount_clients_templ.go
index 1fee4fcd2f..6656609ac7 100644
--- a/weed/admin/view/app/mount_clients_templ.go
+++ b/weed/admin/view/app/mount_clients_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func MountClients(data dash.MountClientsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-plug me-2\"></i>Mount Clients</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportMountClients()\"><i class=\"fas fa-download me-1\"></i>Export</button></div></div></div><div id=\"mount-clients-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Connected Mount Clients</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-plug me-2\"></i>Mount Clients</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"exportMountClients()\"><i class=\"bi bi-download me-1\"></i>Export</button></div></div></div><div id=\"mount-clients-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-12 col-md-12 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Connected Mount Clients</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func MountClients(data dash.MountClientsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-plug fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Mount Clients Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-plug me-2\"></i>Mount Clients</h6></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-plug icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Mount Clients Table --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-plug me-2\"></i>Mount Clients</h6></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -152,12 +152,12 @@ func MountClients(data dash.MountClientsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<div class=\"text-center py-5\"><i class=\"fas fa-plug fa-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Mount Clients Found</h5><p class=\"text-muted\">No FUSE or VFS mounts are currently connected to the cluster's filers.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<div class=\"text-center py-5\"><i class=\"bi bi-plug icon-3x text-muted mb-3\"></i><h5 class=\"text-muted\">No Mount Clients Found</h5><p class=\"text-muted\">No FUSE or VFS mounts are currently connected to the cluster's filers.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "</div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/object_store_users.templ b/weed/admin/view/app/object_store_users.templ
index ded49d85e3..aa47ab539b 100644
--- a/weed/admin/view/app/object_store_users.templ
+++ b/weed/admin/view/app/object_store_users.templ
@@ -11,7 +11,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
         <div class="d-sm-flex align-items-center justify-content-between mb-4">
             <div>
                 <h1 class="h3 mb-0 text-gray-800">
-                    <i class="fas fa-users me-2"></i>Object Store Users
+                    <i class="bi bi-people me-2"></i>Object Store Users
                 </h1>
                 <p class="mb-0 text-muted">Manage S3 API users and their access credentials</p>
             </div>
@@ -19,7 +19,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                 <button type="button" class="btn btn-primary"
                         data-bs-toggle="modal"
                         data-bs-target="#createUserModal">
-                    <i class="fas fa-plus me-1"></i>Create User
+                    <i class="bi bi-plus me-1"></i>Create User
                 </button>
             </div>
         </div>
@@ -39,7 +39,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-users fa-2x text-gray-300"></i>
+                                <i class="bi bi-people icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -59,7 +59,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-user-check fa-2x text-gray-300"></i>
+                                <i class="bi bi-person-check icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -79,7 +79,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-clock fa-2x text-gray-300"></i>
+                                <i class="bi bi-clock icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -93,16 +93,16 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-users me-2"></i>Object Store Users
+                            <i class="bi bi-people me-2"></i>Object Store Users
                         </h6>
                         <div class="dropdown no-arrow">
                             <a class="dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown">
-                                <i class="fas fa-ellipsis-v fa-sm fa-fw text-gray-400"></i>
+                                <i class="bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400"></i>
                             </a>
                             <div class="dropdown-menu dropdown-menu-right shadow animated--fade-in">
                                 <div class="dropdown-header">Actions:</div>
                                 <a class="dropdown-item" href="#" onclick="exportUsers()">
-                                    <i class="fas fa-download me-2"></i>Export List
+                                    <i class="bi bi-download me-2"></i>Export List
                                 </a>
                             </div>
                         </div>
@@ -123,7 +123,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                         <tr>
                                             <td>
                                                 <div class="d-flex align-items-center">
-                                                    <i class="fas fa-user me-2 text-muted"></i>
+                                                    <i class="bi bi-person me-2 text-muted"></i>
                                                     <strong>{user.Username}</strong>
                                                     if user.IsStatic {
                                                         <span class="badge bg-secondary ms-2" title="Loaded from config file (read-only)">static</span>
@@ -138,24 +138,24 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                                 <div class="btn-group btn-group-sm" role="group">
                                                     <button type="button" class="btn btn-outline-info"
                                                             data-action="show-user-details" data-username={ user.Username }>
-                                                        <i class="fas fa-info-circle"></i>
+                                                        <i class="bi bi-info-circle"></i>
                                                     </button>
                                                     if !user.IsStatic {
                                                         <button type="button" class="btn btn-outline-primary"
                                                                 data-action="edit-user" data-username={ user.Username }>
-                                                            <i class="fas fa-edit"></i>
+                                                            <i class="bi bi-pencil-square"></i>
                                                         </button>
                                                     }
                                                     if user.Username != "anonymous" && !user.IsStatic {
                                                         <button type="button" class="btn btn-outline-secondary"
                                                                 data-action="manage-access-keys" data-username={ user.Username }>
-                                                            <i class="fas fa-key"></i>
+                                                            <i class="bi bi-key"></i>
                                                         </button>
                                                     }
                                                     if !user.IsStatic {
                                                         <button type="button" class="btn btn-outline-danger"
                                                                 data-action="delete-user" data-username={ user.Username }>
-                                                            <i class="fas fa-trash"></i>
+                                                            <i class="bi bi-trash"></i>
                                                         </button>
                                                     }
                                                 </div>
@@ -165,7 +165,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                     if len(data.Users) == 0 {
                                         <tr>
                                             <td colspan="4" class="text-center text-muted py-4">
-                                                <i class="fas fa-users fa-3x mb-3 text-muted"></i>
+                                                <i class="bi bi-people icon-3x mb-3 text-muted"></i>
                                                 <div>
                                                     <h5>No users found</h5>
                                                     <p>Create your first object store user to get started.</p>
@@ -185,7 +185,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
         <div class="row">
             <div class="col-12">
                 <small class="text-muted">
-                    <i class="fas fa-clock me-1"></i>
+                    <i class="bi bi-clock me-1"></i>
                     Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
                 </small>
             </div>
@@ -198,7 +198,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-user-plus me-2"></i>Create New User
+                        <i class="bi bi-person-plus me-2"></i>Create New User
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -323,7 +323,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-user-edit me-2"></i>Edit User
+                        <i class="bi bi-person-gear me-2"></i>Edit User
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -422,7 +422,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                 </select>
                                 <button class="btn btn-outline-primary" type="button" onclick="addUserToGroupFromEdit()"
                                         aria-label="Add user to group" title="Add user to group">
-                                    <i class="fas fa-plus"></i>
+                                    <i class="bi bi-plus"></i>
                                 </button>
                             </div>
                         </div>
@@ -442,7 +442,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-user me-2"></i>User Details
+                        <i class="bi bi-person me-2"></i>User Details
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -462,7 +462,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-key me-2"></i>Manage Access Keys
+                        <i class="bi bi-key me-2"></i>Manage Access Keys
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -470,7 +470,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                     <div class="d-flex justify-content-between align-items-center mb-3">
                         <h6>Access Keys for <span id="accessKeysUsername"></span></h6>
                         <button type="button" class="btn btn-primary btn-sm" onclick="toggleCreateKeyForm()">
-                            <i class="fas fa-plus me-1"></i>Create New Key
+                            <i class="bi bi-plus me-1"></i>Create New Key
                         </button>
                     </div>
                     <div id="createKeyForm" class="card mb-3" style="display: none;">
@@ -485,7 +485,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                                 <div class="input-group input-group-sm">
                                     <input type="password" class="form-control form-control-sm" id="newSecretKeyInput" placeholder="Auto-generated if empty" minlength="8" maxlength="128">
                                     <button class="btn btn-outline-secondary" type="button" onclick="toggleSecretKeyVisibility()" aria-label="Toggle secret key visibility">
-                                        <i class="fas fa-eye" id="secretKeyToggleIcon"></i>
+                                        <i class="bi bi-eye" id="secretKeyToggleIcon"></i>
                                     </button>
                                 </div>
                             </div>
@@ -1145,7 +1145,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                         badge.className = 'badge bg-primary me-1 mb-1';
                         badge.textContent = group + ' ';
                         const removeIcon = document.createElement('i');
-                        removeIcon.className = 'fas fa-times ms-1';
+                        removeIcon.className = 'bi bi-x ms-1';
                         removeIcon.style.cursor = 'pointer';
                         removeIcon.setAttribute('aria-label', 'Remove from group ' + group);
                         removeIcon.setAttribute('title', 'Remove from group');
@@ -1351,11 +1351,11 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
                 keysHtml += '<td>';
                 // Add "View Secret" button with data attributes
                 keysHtml += '<button class="btn btn-outline-secondary btn-sm me-2 view-secret-btn" data-access-key="' + escapeHtml(key.access_key) + '" data-secret-key="' + escapeHtml(key.secret_key) + '">';
-                keysHtml += '<i class="fas fa-eye"></i> View Secret';
+                keysHtml += '<i class="bi bi-eye"></i> View Secret';
                 keysHtml += '</button>';
                 // Delete button
                 keysHtml += '<button class="btn btn-outline-danger btn-sm delete-access-key-btn" data-username="' + escapeHtml(user.username) + '" data-access-key="' + escapeHtml(key.access_key) + '">';
-                keysHtml += '<i class="fas fa-trash"></i> Delete';
+                keysHtml += '<i class="bi bi-trash"></i> Delete';
                 keysHtml += '</button>';
                 keysHtml += '</td>';
                 keysHtml += '</tr>';
@@ -1426,7 +1426,7 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             document.getElementById('newAccessKeyInput').value = '';
             document.getElementById('newSecretKeyInput').value = '';
             document.getElementById('newSecretKeyInput').type = 'password';
-            document.getElementById('secretKeyToggleIcon').className = 'fas fa-eye';
+            document.getElementById('secretKeyToggleIcon').className = 'bi bi-eye';
         }
 
         // Toggle create key form visibility
@@ -1445,10 +1445,10 @@ templ ObjectStoreUsers(data dash.ObjectStoreUsersData) {
             const icon = document.getElementById('secretKeyToggleIcon');
             if (input.type === 'password') {
                 input.type = 'text';
-                icon.className = 'fas fa-eye-slash';
+                icon.className = 'bi bi-eye-slash';
             } else {
                 input.type = 'password';
-                icon.className = 'fas fa-eye';
+                icon.className = 'bi bi-eye';
             }
         }
 
diff --git a/weed/admin/view/app/object_store_users_templ.go b/weed/admin/view/app/object_store_users_templ.go
index 6bab48447e..d9b8cc6188 100644
--- a/weed/admin/view/app/object_store_users_templ.go
+++ b/weed/admin/view/app/object_store_users_templ.go
@@ -34,7 +34,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"container-fluid\"><!-- Page Header --><div class=\"d-sm-flex align-items-center justify-content-between mb-4\"><div><h1 class=\"h3 mb-0 text-gray-800\"><i class=\"fas fa-users me-2\"></i>Object Store Users</h1><p class=\"mb-0 text-muted\">Manage S3 API users and their access credentials</p></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createUserModal\"><i class=\"fas fa-plus me-1\"></i>Create User</button></div></div><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Users</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"container-fluid\"><!-- Page Header --><div class=\"d-sm-flex align-items-center justify-content-between mb-4\"><div><h1 class=\"h3 mb-0 text-gray-800\"><i class=\"bi bi-people me-2\"></i>Object Store Users</h1><p class=\"mb-0 text-muted\">Manage S3 API users and their access credentials</p></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createUserModal\"><i class=\"bi bi-plus me-1\"></i>Create User</button></div></div><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Users</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-users fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Users</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-people icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Users</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +60,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-user-check fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-person-check icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -73,12 +73,12 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Users Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-users me-2\"></i>Object Store Users</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"fas fa-ellipsis-v fa-sm fa-fw text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"#\" onclick=\"exportUsers()\"><i class=\"fas fa-download me-2\"></i>Export List</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"usersTable\"><thead><tr><th>Username</th><th>Email</th><th>Access Key</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Users Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-people me-2\"></i>Object Store Users</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"#\" onclick=\"exportUsers()\"><i class=\"bi bi-download me-2\"></i>Export List</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"usersTable\"><thead><tr><th>Username</th><th>Email</th><th>Access Key</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, user := range data.Users {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<tr><td><div class=\"d-flex align-items-center\"><i class=\"fas fa-user me-2 text-muted\"></i> <strong>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<tr><td><div class=\"d-flex align-items-center\"><i class=\"bi bi-person me-2 text-muted\"></i> <strong>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -140,7 +140,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\"><i class=\"fas fa-info-circle\"></i></button> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\"><i class=\"bi bi-info-circle\"></i></button> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -158,7 +158,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><i class=\"fas fa-edit\"></i></button> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><i class=\"bi bi-pencil-square\"></i></button> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -177,7 +177,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\"><i class=\"fas fa-key\"></i></button> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\"><i class=\"bi bi-key\"></i></button> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -196,7 +196,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\"><i class=\"fas fa-trash\"></i></button>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\"><i class=\"bi bi-trash\"></i></button>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -207,12 +207,12 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 			}
 		}
 		if len(data.Users) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"fas fa-users fa-3x mb-3 text-muted\"></i><div><h5>No users found</h5><p>Create your first object store user to get started.</p></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"bi bi-people icon-3x mb-3 text-muted\"></i><div><h5>No users found</h5><p>Create your first object store user to get started.</p></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</tbody></table></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</tbody></table></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -225,7 +225,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</small></div></div></div><!-- Create User Modal --><div class=\"modal fade\" id=\"createUserModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-user-plus me-2\"></i>Create New User</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"createUserForm\"><div class=\"mb-3\"><label for=\"username\" class=\"form-label\">Username *</label> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</small></div></div></div><!-- Create User Modal --><div class=\"modal fade\" id=\"createUserModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-person-plus me-2\"></i>Create New User</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"createUserForm\"><div class=\"mb-3\"><label for=\"username\" class=\"form-label\">Username *</label> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -240,7 +240,7 @@ func ObjectStoreUsers(data dash.ObjectStoreUsersData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</div><div class=\"mb-3\"><label for=\"email\" class=\"form-label\">Email</label> <input type=\"email\" class=\"form-control\" id=\"email\" name=\"email\"></div><div class=\"mb-3\"><label for=\"actions\" class=\"form-label\">Permissions</label> <select multiple class=\"form-control\" id=\"actions\" name=\"actions\" size=\"10\"><option value=\"Admin\">Admin (Full Access)</option> <option value=\"Read\">Read</option> <option value=\"Write\">Write</option> <option value=\"List\">List</option> <option value=\"Tagging\">Tagging</option> <optgroup label=\"Object Lock Permissions\"><option value=\"BypassGovernanceRetention\">Bypass Governance Retention</option> <option value=\"GetObjectRetention\">Get Object Retention</option> <option value=\"PutObjectRetention\">Put Object Retention</option> <option value=\"GetObjectLegalHold\">Get Object Legal Hold</option> <option value=\"PutObjectLegalHold\">Put Object Legal Hold</option> <option value=\"GetBucketObjectLockConfiguration\">Get Bucket Object Lock Configuration</option> <option value=\"PutBucketObjectLockConfiguration\">Put Bucket Object Lock Configuration</option></optgroup> <optgroup label=\"Bucket Policy Permissions\"><option value=\"PutBucketPolicy\">Put Bucket Policy</option> <option value=\"DeleteBucketPolicy\">Delete Bucket Policy</option></optgroup> <optgroup label=\"S3 Tables Permissions\"><option value=\"S3TablesAdmin\">S3 Tables Admin (Full Access)</option> <option value=\"CreateTableBucket\">Create Table Bucket</option> <option value=\"GetTableBucket\">Get Table Bucket</option> <option value=\"ListTableBuckets\">List Table Buckets</option> <option value=\"DeleteTableBucket\">Delete Table Bucket</option> <option value=\"PutTableBucketPolicy\">Put Table Bucket Policy</option> <option value=\"GetTableBucketPolicy\">Get Table Bucket Policy</option> <option value=\"DeleteTableBucketPolicy\">Delete Table Bucket Policy</option> <option value=\"CreateNamespace\">Create Namespace</option> <option value=\"GetNamespace\">Get Namespace</option> <option value=\"ListNamespaces\">List Namespaces</option> <option value=\"DeleteNamespace\">Delete Namespace</option> <option value=\"CreateTable\">Create Table</option> <option value=\"GetTable\">Get Table</option> <option value=\"ListTables\">List Tables</option> <option value=\"DeleteTable\">Delete Table</option> <option value=\"PutTablePolicy\">Put Table Policy</option> <option value=\"GetTablePolicy\">Get Table Policy</option> <option value=\"DeleteTablePolicy\">Delete Table Policy</option> <option value=\"TagResource\">Tag Resource</option> <option value=\"ListTagsForResource\">List Tags</option> <option value=\"UntagResource\">Untag Resource</option></optgroup></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple permissions</small></div><div class=\"mb-3\"><label class=\"form-label\">Bucket Scope</label> <small class=\"form-text text-muted d-block mb-2\">Apply selected permissions to specific buckets or all buckets</small><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"bucketScope\" id=\"allBuckets\" value=\"all\" checked onchange=\"toggleBucketList()\"> <label class=\"form-check-label\" for=\"allBuckets\">All Buckets</label></div><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"bucketScope\" id=\"specificBuckets\" value=\"specific\" onchange=\"toggleBucketList()\"> <label class=\"form-check-label\" for=\"specificBuckets\">Specific Buckets</label></div><div id=\"bucketSelectionList\" class=\"mt-2\" style=\"display: none;\"><select multiple class=\"form-select\" id=\"selectedBuckets\" size=\"5\"><!-- Options loaded dynamically --></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple buckets</small></div></div><div class=\"mb-3\"><label for=\"policies\" class=\"form-label\">Attached Policies</label> <select multiple class=\"form-control\" id=\"policies\" name=\"policies\" size=\"5\"><!-- Options loaded dynamically --></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple policies</small></div><div class=\"mb-3 form-check\"><input type=\"checkbox\" class=\"form-check-input\" id=\"generateKey\" name=\"generateKey\" checked> <label class=\"form-check-label\" for=\"generateKey\">Generate access key automatically</label></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"handleCreateUser()\">Create User</button></div></div></div></div><!-- Edit User Modal --><div class=\"modal fade\" id=\"editUserModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-user-edit me-2\"></i>Edit User</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"editUserForm\"><input type=\"hidden\" id=\"editUsername\" name=\"username\"><div class=\"mb-3\"><label for=\"editEmail\" class=\"form-label\">Email</label> <input type=\"email\" class=\"form-control\" id=\"editEmail\" name=\"email\"></div><div class=\"mb-3\"><label for=\"editActions\" class=\"form-label\">Permissions</label> <select multiple class=\"form-control\" id=\"editActions\" name=\"actions\" size=\"10\"><option value=\"Admin\">Admin (Full Access)</option> <option value=\"Read\">Read</option> <option value=\"Write\">Write</option> <option value=\"List\">List</option> <option value=\"Tagging\">Tagging</option> <optgroup label=\"Object Lock Permissions\"><option value=\"BypassGovernanceRetention\">Bypass Governance Retention</option> <option value=\"GetObjectRetention\">Get Object Retention</option> <option value=\"PutObjectRetention\">Put Object Retention</option> <option value=\"GetObjectLegalHold\">Get Object Legal Hold</option> <option value=\"PutObjectLegalHold\">Put Object Legal Hold</option> <option value=\"GetBucketObjectLockConfiguration\">Get Bucket Object Lock Configuration</option> <option value=\"PutBucketObjectLockConfiguration\">Put Bucket Object Lock Configuration</option></optgroup> <optgroup label=\"Bucket Policy Permissions\"><option value=\"PutBucketPolicy\">Put Bucket Policy</option> <option value=\"DeleteBucketPolicy\">Delete Bucket Policy</option></optgroup> <optgroup label=\"S3 Tables Permissions\"><option value=\"S3TablesAdmin\">S3 Tables Admin (Full Access)</option> <option value=\"CreateTableBucket\">Create Table Bucket</option> <option value=\"GetTableBucket\">Get Table Bucket</option> <option value=\"ListTableBuckets\">List Table Buckets</option> <option value=\"DeleteTableBucket\">Delete Table Bucket</option> <option value=\"PutTableBucketPolicy\">Put Table Bucket Policy</option> <option value=\"GetTableBucketPolicy\">Get Table Bucket Policy</option> <option value=\"DeleteTableBucketPolicy\">Delete Table Bucket Policy</option> <option value=\"CreateNamespace\">Create Namespace</option> <option value=\"GetNamespace\">Get Namespace</option> <option value=\"ListNamespaces\">List Namespaces</option> <option value=\"DeleteNamespace\">Delete Namespace</option> <option value=\"CreateTable\">Create Table</option> <option value=\"GetTable\">Get Table</option> <option value=\"ListTables\">List Tables</option> <option value=\"DeleteTable\">Delete Table</option> <option value=\"PutTablePolicy\">Put Table Policy</option> <option value=\"GetTablePolicy\">Get Table Policy</option> <option value=\"DeleteTablePolicy\">Delete Table Policy</option> <option value=\"TagResource\">Tag Resource</option> <option value=\"ListTagsForResource\">List Tags</option> <option value=\"UntagResource\">Untag Resource</option></optgroup></select></div><div class=\"mb-3\"><label class=\"form-label\">Bucket Scope</label> <small class=\"form-text text-muted d-block mb-2\">Apply selected permissions to specific buckets or all buckets</small><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"editBucketScope\" id=\"editAllBuckets\" value=\"all\" checked onchange=\"toggleBucketList('edit')\"> <label class=\"form-check-label\" for=\"editAllBuckets\">All Buckets</label></div><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"editBucketScope\" id=\"editSpecificBuckets\" value=\"specific\" onchange=\"toggleBucketList('edit')\"> <label class=\"form-check-label\" for=\"editSpecificBuckets\">Specific Buckets</label></div><div id=\"editBucketSelectionList\" class=\"mt-2\" style=\"display: none;\"><select multiple class=\"form-select\" id=\"editSelectedBuckets\" size=\"5\"><!-- Options loaded dynamically --></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple buckets</small></div></div><div class=\"mb-3\"><label for=\"editPolicies\" class=\"form-label\">Attached Policies</label> <select multiple class=\"form-control\" id=\"editPolicies\" name=\"policies\" size=\"5\"><!-- Options loaded dynamically --></select></div><div class=\"mb-3\"><label class=\"form-label\">Groups</label><div id=\"editUserGroups\"><!-- Groups loaded dynamically --></div><div class=\"input-group mt-2\"><select class=\"form-select\" id=\"editGroupSelect\"><option value=\"\">Add to group...</option></select> <button class=\"btn btn-outline-primary\" type=\"button\" onclick=\"addUserToGroupFromEdit()\" aria-label=\"Add user to group\" title=\"Add user to group\"><i class=\"fas fa-plus\"></i></button></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"handleUpdateUser()\">Update User</button></div></div></div></div><!-- User Details Modal --><div class=\"modal fade\" id=\"userDetailsModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-user me-2\"></i>User Details</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\" id=\"userDetailsContent\"><!-- Content will be loaded dynamically --></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- Access Keys Management Modal --><div class=\"modal fade\" id=\"accessKeysModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-key me-2\"></i>Manage Access Keys</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><div class=\"d-flex justify-content-between align-items-center mb-3\"><h6>Access Keys for <span id=\"accessKeysUsername\"></span></h6><button type=\"button\" class=\"btn btn-primary btn-sm\" onclick=\"toggleCreateKeyForm()\"><i class=\"fas fa-plus me-1\"></i>Create New Key</button></div><div id=\"createKeyForm\" class=\"card mb-3\" style=\"display: none;\"><div class=\"card-body\"><p class=\"text-muted small mb-2\">Leave blank to auto-generate.</p><div class=\"mb-2\"><label for=\"newAccessKeyInput\" class=\"form-label form-label-sm\">Access Key</label> <input type=\"text\" class=\"form-control form-control-sm\" id=\"newAccessKeyInput\" placeholder=\"Auto-generated if empty\" minlength=\"4\" maxlength=\"128\"></div><div class=\"mb-2\"><label for=\"newSecretKeyInput\" class=\"form-label form-label-sm\">Secret Key</label><div class=\"input-group input-group-sm\"><input type=\"password\" class=\"form-control form-control-sm\" id=\"newSecretKeyInput\" placeholder=\"Auto-generated if empty\" minlength=\"8\" maxlength=\"128\"> <button class=\"btn btn-outline-secondary\" type=\"button\" onclick=\"toggleSecretKeyVisibility()\" aria-label=\"Toggle secret key visibility\"><i class=\"fas fa-eye\" id=\"secretKeyToggleIcon\"></i></button></div></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary btn-sm\" onclick=\"createAccessKey()\">Create</button> <button type=\"button\" class=\"btn btn-secondary btn-sm\" onclick=\"toggleCreateKeyForm()\">Cancel</button></div></div></div><div id=\"accessKeysContent\"><!-- Content will be loaded dynamically --></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- JavaScript for user management --><script>\n        // Access key status constants\n        const STATUS_ACTIVE = 'Active';\n        const STATUS_INACTIVE = 'Inactive';\n\n        // Use basePath() from admin.js for -urlPrefix; it is loaded in the layout footer before DOMContentLoaded fires.\n        document.addEventListener('DOMContentLoaded', function() {\n\n            // Event delegation for user action buttons\n            document.addEventListener('click', function(e) {\n                const button = e.target.closest('[data-action]');\n                if (!button) return;\n\n                const action = button.getAttribute('data-action');\n                const username = button.getAttribute('data-username');\n\n                switch (action) {\n                    case 'show-user-details':\n                        showUserDetails(username);\n                        break;\n                    case 'edit-user':\n                        editUser(username);\n                        break;\n                    case 'manage-access-keys':\n                        manageAccessKeys(username);\n                        break;\n                    case 'delete-user':\n                        deleteUser(username);\n                        break;\n                }\n            });\n\n            // Event delegation for delete access key buttons\n            document.addEventListener('click', function(e) {\n                const deleteBtn = e.target.closest('.delete-access-key-btn');\n                if (deleteBtn) {\n                    const username = deleteBtn.getAttribute('data-username');\n                    const accessKey = deleteBtn.getAttribute('data-access-key');\n                    deleteAccessKey(username, accessKey);\n                }\n            });\n\n            // Event delegation for access key status changes\n            document.addEventListener('change', function(e) {\n                const statusSelect = e.target.closest('.access-key-status-select');\n                if (statusSelect) {\n                    const username = statusSelect.getAttribute('data-username');\n                    const accessKey = statusSelect.getAttribute('data-access-key');\n                    const newStatus = statusSelect.value;\n                    updateAccessKeyStatus(username, accessKey, newStatus);\n                }\n            });\n\n            // Load policies for dropdowns\n            loadPolicies();\n\n            // Load buckets for bucket permissions\n            loadBuckets();\n        });\n\n        // Global variable to store available buckets\n        var availableBuckets = [];\n        var bucketPermissionCounter = 0;\n        const s3TablesPermissions = new Set([\n            'CreateTableBucket',\n            'GetTableBucket',\n            'ListTableBuckets',\n            'DeleteTableBucket',\n            'PutTableBucketPolicy',\n            'GetTableBucketPolicy',\n            'DeleteTableBucketPolicy',\n            'CreateNamespace',\n            'GetNamespace',\n            'ListNamespaces',\n            'DeleteNamespace',\n            'CreateTable',\n            'GetTable',\n            'ListTables',\n            'DeleteTable',\n            'PutTablePolicy',\n            'GetTablePolicy',\n            'DeleteTablePolicy',\n            'TagResource',\n            'ListTagsForResource',\n            'UntagResource'\n        ]);\n        function isS3TablesPermission(permission) {\n            return permission === 'S3TablesAdmin' || s3TablesPermissions.has(permission);\n        }\n\n        // Load buckets\n        async function loadBuckets() {\n            try {\n                const response = await fetch(basePath('/api/s3/buckets'));\n                if (response.ok) {\n                    const data = await response.json();\n                    availableBuckets = (data.buckets || []).map(bucket => ({ name: bucket.name, type: 's3' }));\n                    console.log('Loaded', availableBuckets.length, 'buckets');\n                } else {\n                    console.warn('Failed to load buckets');\n                    availableBuckets = [];\n                }\n            } catch (error) {\n                console.error('Error loading buckets:', error);\n                availableBuckets = [];\n            }\n            try {\n                const response = await fetch(basePath('/api/s3tables/buckets'));\n                if (response.ok) {\n                    const data = await response.json();\n                    const tableBuckets = (data.buckets || data.tableBuckets || []).map(bucket => ({ name: bucket.name, type: 's3tables' }));\n                    availableBuckets = availableBuckets.concat(tableBuckets);\n                } else {\n                    console.warn('Failed to load table buckets');\n                }\n            } catch (error) {\n                console.warn('Error loading table buckets:', error);\n            }\n            // Populate bucket selection dropdowns\n            populateBucketSelections();\n        }\n\n        // Load policies\n        async function loadPolicies() {\n            try {\n                const response = await fetch(basePath('/api/object-store/policies'));\n                if (response.ok) {\n                    const data = await response.json();\n                    const policies = data.policies || [];\n\n                    const createSelect = document.getElementById('policies');\n                    const editSelect = document.getElementById('editPolicies');\n\n                    // Check if elements exist\n                    if (!createSelect || !editSelect) {\n                        console.warn('Policy select elements not found');\n                        return;\n                    }\n\n                    // Clear existing options\n                    createSelect.innerHTML = '';\n                    editSelect.innerHTML = '';\n\n                    if (policies && policies.length > 0) {\n                        policies.forEach(policy => {\n                            const option = document.createElement('option');\n                            option.value = policy.name;\n                            option.textContent = policy.name;\n                            createSelect.appendChild(option);\n                            editSelect.appendChild(option.cloneNode(true));\n                        });\n                    } else {\n                        const emptyOption = document.createElement('option');\n                        emptyOption.disabled = true;\n                        emptyOption.textContent = 'No policies available';\n                        createSelect.appendChild(emptyOption);\n                        editSelect.appendChild(emptyOption.cloneNode(true));\n                    }\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to load policies: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error loading policies:', error);\n                showAlert('Failed to load policies: ' + error.message, 'error');\n            }\n        }\n\n        // Toggle bucket permission fields when Admin checkbox changes\n        function toggleBucketPermissionFields(mode) {\n            mode = mode || 'create';\n            const adminCheckbox = document.getElementById(mode === 'edit' ? 'editBucketAdmin' : 'bucketAdmin');\n            const permissionFields = document.getElementById(mode === 'edit' ? 'editBucketPermissionFields' : 'bucketPermissionFields');\n\n            if (adminCheckbox && permissionFields) {\n                permissionFields.style.display = adminCheckbox.checked ? 'none' : 'block';\n            }\n        }\n\n        // Toggle bucket list visibility when bucket scope changes\n        function toggleBucketList(mode) {\n            mode = mode || 'create';\n            const specificRadio = document.getElementById(mode === 'edit' ? 'editSpecificBuckets' : 'specificBuckets');\n            const bucketList = document.getElementById(mode === 'edit' ? 'editBucketSelectionList' : 'bucketSelectionList');\n\n            if (specificRadio && bucketList) {\n                bucketList.style.display = specificRadio.checked ? 'block' : 'none';\n            }\n        }\n\n        // Toggle anonymous user checkbox\n        function toggleAnonymousUser() {\n            const checkbox = document.getElementById('anonymousCheck');\n            const usernameInput = document.getElementById('username');\n            const generateKey = document.getElementById('generateKey');\n            if (checkbox.checked) {\n                usernameInput.value = 'anonymous';\n                usernameInput.readOnly = true;\n                generateKey.checked = false;\n                generateKey.disabled = true;\n            } else {\n                usernameInput.value = '';\n                usernameInput.readOnly = false;\n                generateKey.disabled = false;\n                generateKey.checked = true;\n            }\n        }\n\n        // Populate bucket selection dropdowns\n        function populateBucketSelections() {\n            const createSelect = document.getElementById('selectedBuckets');\n            const editSelect = document.getElementById('editSelectedBuckets');\n\n            [createSelect, editSelect].forEach(select => {\n                if (select) {\n                    select.innerHTML = '';\n                    availableBuckets.forEach(bucket => {\n                        const option = document.createElement('option');\n                        option.value = bucket.type + ':' + bucket.name;\n                        option.textContent = bucket.type === 's3tables' ? `Table: ${bucket.name}` : bucket.name;\n                        select.appendChild(option);\n                    });\n                }\n            });\n        }\n\n        // Parse bucket permissions from actions array for new UI\n        function parseBucketPermissions(actions) {\n            const result = {\n                isAdmin: false,\n                permissions: [],\n                applyToAll: false,\n                specificBuckets: []\n            };\n\n            // Check if user has Admin permission\n            if (actions.includes('Admin')) {\n                result.isAdmin = true;\n                return result;\n            }\n\n            // Separate bucket-scoped from global actions\n            const bucketActions = [];\n            const globalBucketPerms = [];\n\n            actions.forEach(action => {\n                if (action.startsWith('s3tables:')) {\n                    const actionValue = action.slice('s3tables:'.length);\n                    if (actionValue === '*') {\n                        globalBucketPerms.push('S3TablesAdmin');\n                        return;\n                    }\n                    const parts = actionValue.split(':');\n                    const perm = parts[0];\n                    const bucket = parts.length > 1 ? parts.slice(1).join(':').replace(/\\/\\*$/, '') : '';\n                    if (bucket) {\n                        bucketActions.push({ permission: perm, bucketId: 's3tables:' + bucket });\n                    } else {\n                        globalBucketPerms.push(perm);\n                    }\n                } else if (action.includes(':')) {\n                    const parts = action.split(':');\n                    const perm = parts[0];\n                    const bucket = parts.slice(1).join(':').replace(/\\/\\*$/, '');\n                    bucketActions.push({ permission: perm, bucketId: 's3:' + bucket });\n                } else {\n                    globalBucketPerms.push(action);\n                }\n            });\n\n            // If we have global bucket permissions (no colon), they apply to all buckets\n            if (globalBucketPerms.length > 0) {\n                result.permissions = globalBucketPerms;\n                result.applyToAll = true;\n            } else if (bucketActions.length > 0) {\n                // Get unique permissions and buckets\n                const perms = [...new Set(bucketActions.map(ba => ba.permission))];\n                const buckets = [...new Set(bucketActions.map(ba => ba.bucketId))];\n\n                result.permissions = perms;\n                result.applyToAll = false;\n                result.specificBuckets = buckets;\n            }\n\n            return result;\n        }\n\n        function parseBucketOptionValue(value) {\n            if (value.startsWith('s3tables:')) {\n                return { type: 's3tables', name: value.slice('s3tables:'.length) };\n            }\n            if (value.startsWith('s3:')) {\n                return { type: 's3', name: value.slice('s3:'.length) };\n            }\n            return { type: 's3', name: value };\n        }\n\n        // Build bucket permission action strings using original permissions dropdown\n        /**\n         * Builds bucket permission strings based on selected permissions and bucket scope.\n         * @param {string} mode - The operation mode, either 'create' or 'edit'.\n         * @returns {string[]|null} Array of permission strings (e.g., ['Read:bucket1']) or null if validation fails (specific scope selected but no buckets).\n         */\n        function buildBucketPermissions(mode) {\n            mode = mode || 'create';\n            const selectId = mode === 'edit' ? 'editActions' : 'actions';\n            const permSelect = document.getElementById(selectId);\n\n            if (!permSelect) return [];\n\n            // Get selected permissions from the original multi-select\n            const selectedPerms = Array.from(permSelect.selectedOptions).map(opt => opt.value);\n\n            const hasAdmin = selectedPerms.includes('Admin');\n            const hasS3TablesAdmin = selectedPerms.includes('S3TablesAdmin');\n\n            if (selectedPerms.length === 0) {\n                return [];\n            }\n\n            // Check if applying to all buckets or specific ones\n            // Use querySelector to find the checked radio button by name group\n            const scopeName = mode === 'edit' ? 'editBucketScope' : 'bucketScope';\n\n            // Try multiple methods to find the checked radio\n            let checkedRadio = document.querySelector(`input[name=\"${scopeName}\"]:checked`);\n\n            // Fallback: check both radio buttons explicitly\n            if (!checkedRadio) {\n                const allBucketsId = mode === 'edit' ? 'editAllBuckets' : 'allBuckets';\n                const specificBucketsId = mode === 'edit' ? 'editSpecificBuckets' : 'specificBuckets';\n\n                const allBucketsRadio = document.getElementById(allBucketsId);\n                const specificBucketsRadio = document.getElementById(specificBucketsId);\n\n                if (specificBucketsRadio && specificBucketsRadio.checked) {\n                    checkedRadio = specificBucketsRadio;\n                } else if (allBucketsRadio && allBucketsRadio.checked) {\n                    checkedRadio = allBucketsRadio;\n                }\n            }\n\n            // Default to 'all' if nothing is checked (shouldn't happen) or if 'all' is checked\n            const applyToAll = !checkedRadio || checkedRadio.value === 'all';\n\n            if (applyToAll) {\n                // Return global permissions (no bucket specification)\n                const actions = [];\n                if (hasAdmin) {\n                    actions.push('Admin');\n                }\n                if (hasS3TablesAdmin) {\n                    actions.push('s3tables:*');\n                }\n                selectedPerms.forEach(perm => {\n                    if (perm === 'Admin' || perm === 'S3TablesAdmin') {\n                        return;\n                    }\n                    if (isS3TablesPermission(perm)) {\n                        actions.push('s3tables:' + perm);\n                    } else {\n                        actions.push(perm);\n                    }\n                });\n                return actions;\n            } else {\n                // Get selected specific buckets\n                const bucketSelect = document.getElementById(mode === 'edit' ? 'editSelectedBuckets' : 'selectedBuckets');\n                if (!bucketSelect) return null;\n\n                const selectedBuckets = [...new Set(Array.from(bucketSelect.selectedOptions).map(opt => opt.value))];\n\n                // Return null to signal validation failure if no buckets selected\n                if (selectedBuckets.length === 0) {\n                    return null;\n                }\n\n                // Build bucket-scoped permissions\n                const actions = [];\n                if (hasAdmin) {\n                    selectedBuckets.forEach((bucket) => {\n                        const bucketInfo = parseBucketOptionValue(bucket);\n                        actions.push(\"Admin:\" + bucketInfo.name);\n                    });\n                }\n                if (hasS3TablesAdmin) {\n                    actions.push('s3tables:*');\n                }\n                selectedPerms.forEach(perm => {\n                    if (perm === 'Admin' || perm === 'S3TablesAdmin') {\n                        return;\n                    }\n                    selectedBuckets.forEach(bucket => {\n                        const bucketInfo = parseBucketOptionValue(bucket);\n                        if (isS3TablesPermission(perm)) {\n                            if (bucketInfo.type === 's3tables') {\n                                actions.push('s3tables:' + perm + ':' + bucketInfo.name);\n                            }\n                        } else if (bucketInfo.type === 's3') {\n                            actions.push(perm + ':' + bucketInfo.name);\n                        }\n                    });\n                });\n\n                return [...new Set(actions)];\n            }\n        }\n\n        // Show user details modal\n        async function showUserDetails(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n                    document.getElementById('userDetailsContent').innerHTML = createUserDetailsContent(user);\n                    const modal = new bootstrap.Modal(document.getElementById('userDetailsModal'));\n                    modal.show();\n                } else {\n                    showAlert('Failed to load user details', 'error');\n                }\n            } catch (error) {\n                console.error('Error loading user details:', error);\n                showAlert('Failed to load user details', 'error');\n            }\n        }\n\n        // Edit user function\n        async function editUser(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n\n                    // Populate edit form\n                    document.getElementById('editUsername').value = username;\n                    document.getElementById('editEmail').value = user.email || '';\n\n                    // Set selected actions\n                    const actionsSelect = document.getElementById('editActions');\n                    Array.from(actionsSelect.options).forEach(option => {\n                        option.selected = user.actions && user.actions.includes(option.value);\n                    });\n\n                    // Set selected policies\n                    const policiesSelect = document.getElementById('editPolicies');\n                    if (policiesSelect) {\n                        Array.from(policiesSelect.options).forEach(option => {\n                            option.selected = user.policy_names && user.policy_names.includes(option.value);\n                        });\n                    }\n\n                    // Populate bucket permissions using original permissions dropdown\n                    if (user.actions && user.actions.length > 0) {\n                        const bucketPerms = parseBucketPermissions(user.actions);\n\n                        // Set permissions in the original multi-select\n                        const actionsSelect = document.getElementById('editActions');\n                        if (actionsSelect) {\n                            Array.from(actionsSelect.options).forEach(option => {\n                                if (bucketPerms.isAdmin && option.value === 'Admin') {\n                                    option.selected = true;\n                                } else if (!bucketPerms.isAdmin && bucketPerms.permissions.includes(option.value)) {\n                                    option.selected = true;\n                                }\n                            });\n                        }\n\n                        // Set bucket scope (all or specific)\n                        const allBucketsRadio = document.getElementById('editAllBuckets');\n                        const specificBucketsRadio = document.getElementById('editSpecificBuckets');\n\n                        if (!bucketPerms.isAdmin) {\n                            if (bucketPerms.applyToAll) {\n                                if (allBucketsRadio) allBucketsRadio.checked = true;\n                            } else if (bucketPerms.specificBuckets.length > 0) {\n                                if (specificBucketsRadio) specificBucketsRadio.checked = true;\n                                toggleBucketList('edit');\n\n                                // Select specific buckets\n                                const bucketSelect = document.getElementById('editSelectedBuckets');\n                                if (bucketSelect) {\n                                    Array.from(bucketSelect.options).forEach(option => {\n                                        option.selected = bucketPerms.specificBuckets.includes(option.value);\n                                    });\n                                }\n                            }\n                        }\n                    }\n\n                    // Populate groups\n                    await populateEditUserGroups(username);\n\n                    // Show modal\n                    const modal = new bootstrap.Modal(document.getElementById('editUserModal'));\n                    modal.show();\n                } else {\n                    showAlert('Failed to load user details', 'error');\n                }\n            } catch (error) {\n                console.error('Error loading user:', error);\n                showAlert('Failed to load user details', 'error');\n            }\n        }\n\n        // Manage access keys function\n        async function manageAccessKeys(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n                    document.getElementById('accessKeysUsername').textContent = username;\n                    document.getElementById('accessKeysContent').innerHTML = createAccessKeysContent(user);\n                    const modal = new bootstrap.Modal(document.getElementById('accessKeysModal'));\n                    modal.show();\n                } else {\n                    showAlert('Failed to load access keys', 'error');\n                }\n            } catch (error) {\n                console.error('Error loading access keys:', error);\n                showAlert('Failed to load access keys', 'error');\n            }\n        }\n\n        // Delete user function\n        async function deleteUser(username) {\n            showDeleteConfirm(username, async function() {\n                try {\n                    const encodedUsername = encodeURIComponent(username);\n                    const response = await fetch(basePath(`/api/users/${encodedUsername}`), {\n                        method: 'DELETE'\n                    });\n\n                    if (response.ok) {\n                        showSuccessMessage('User deleted successfully');\n                        setTimeout(() => window.location.reload(), 1000);\n                    } else {\n                        const error = await response.json();\n                        showErrorMessage('Failed to delete user: ' + (error.error || 'Unknown error'));\n                    }\n                } catch (error) {\n                    console.error('Error deleting user:', error);\n                    showErrorMessage('Failed to delete user: ' + error.message);\n                }\n            }, 'Are you sure you want to delete this user? This action cannot be undone.');\n        }\n\n        // Handle create user form submission\n        async function handleCreateUser() {\n            const form = document.getElementById('createUserForm');\n            const formData = new FormData(form);\n\n            // Get permissions with bucket scope applied\n            const allActions = buildBucketPermissions('create');\n\n            if (allActions === null) {\n                showAlert('Please select at least one bucket when using specific bucket permissions', 'error');\n                return;\n            }\n\n            if (!allActions || allActions.length === 0) {\n                showAlert('At least one permission must be selected', 'error');\n                return;\n            }\n\n            const userData = {\n                username: formData.get('username'),\n                email: formData.get('email'),\n                actions: allActions,\n                policy_names: Array.from(document.getElementById('policies').selectedOptions).map(option => option.value),\n                generate_key: document.getElementById('generateKey').checked\n            };\n\n            try {\n                const response = await fetch(basePath('/api/users'), {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify(userData)\n                });\n\n                if (response.ok) {\n                    const result = await response.json();\n                    showSuccessMessage('User created successfully');\n\n                    // Show the created access key if generated\n                    if (result.user && result.user.access_key) {\n                        showNewAccessKeyModal(result.user);\n                    }\n\n                    // Close modal and refresh page\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('createUserModal'));\n                    modal.hide();\n                    form.reset();\n                    document.getElementById('username').readOnly = false;\n                    document.getElementById('generateKey').disabled = false;\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json();\n                    showAlert('Failed to create user: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error creating user:', error);\n                showAlert('Failed to create user: ' + error.message, 'error');\n            }\n        }\n\n\n        // Populate groups in the edit user modal\n        async function populateEditUserGroups(username) {\n            const container = document.getElementById('editUserGroups');\n            const groupSelect = document.getElementById('editGroupSelect');\n            container.innerHTML = '';\n            groupSelect.innerHTML = '<option value=\"\">Add to group...</option>';\n\n            try {\n                // Fetch all groups\n                const groupsResp = await fetch(basePath('/api/groups'));\n                if (!groupsResp.ok) return;\n                const groupsData = await groupsResp.json();\n                const allGroups = groupsData.groups || [];\n\n                // Fetch user details to get current groups\n                const userResp = await fetch(basePath(`/api/users/${encodeURIComponent(username)}`));\n                if (!userResp.ok) return;\n                const user = await userResp.json();\n                const userGroups = user.groups || [];\n\n                // Show current group badges with remove button\n                if (userGroups.length > 0) {\n                    userGroups.forEach(function(group) {\n                        const badge = document.createElement('span');\n                        badge.className = 'badge bg-primary me-1 mb-1';\n                        badge.textContent = group + ' ';\n                        const removeIcon = document.createElement('i');\n                        removeIcon.className = 'fas fa-times ms-1';\n                        removeIcon.style.cursor = 'pointer';\n                        removeIcon.setAttribute('aria-label', 'Remove from group ' + group);\n                        removeIcon.setAttribute('title', 'Remove from group');\n                        removeIcon.addEventListener('click', function() {\n                            removeUserFromGroupInEdit(group);\n                        });\n                        badge.appendChild(removeIcon);\n                        container.appendChild(badge);\n                    });\n                } else {\n                    container.innerHTML = '<span class=\"text-muted\">No groups</span>';\n                }\n\n                // Populate dropdown with groups the user is NOT in\n                allGroups.forEach(function(g) {\n                    if (!userGroups.includes(g.name)) {\n                        const opt = document.createElement('option');\n                        opt.value = g.name;\n                        opt.textContent = g.name;\n                        groupSelect.appendChild(opt);\n                    }\n                });\n            } catch (error) {\n                console.error('Error loading groups:', error);\n            }\n        }\n\n        // Add user to group from edit modal\n        async function addUserToGroupFromEdit() {\n            const username = document.getElementById('editUsername').value;\n            const groupSelect = document.getElementById('editGroupSelect');\n            const groupName = groupSelect.value;\n            if (!groupName) return;\n\n            try {\n                const response = await fetch(basePath(`/api/groups/${encodeURIComponent(groupName)}/members`), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ username: username })\n                });\n                if (response.ok) {\n                    await populateEditUserGroups(username);\n                } else {\n                    const error = await response.json();\n                    showAlert('Failed to add to group: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to add to group: ' + error.message, 'error');\n            }\n        }\n\n        // Remove user from group in edit modal\n        async function removeUserFromGroupInEdit(groupName) {\n            const username = document.getElementById('editUsername').value;\n            try {\n                const response = await fetch(basePath(`/api/groups/${encodeURIComponent(groupName)}/members/${encodeURIComponent(username)}`), {\n                    method: 'DELETE'\n                });\n                if (response.ok) {\n                    await populateEditUserGroups(username);\n                } else {\n                    const error = await response.json();\n                    showAlert('Failed to remove from group: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to remove from group: ' + error.message, 'error');\n            }\n        }\n\n        // Handle update user form submission\n        async function handleUpdateUser() {\n            const username = document.getElementById('editUsername').value;\n            if (!username) {\n                showAlert('Username is required', 'error');\n                return;\n            }\n\n            // Get permissions with bucket scope applied\n            const allActions = buildBucketPermissions('edit');\n\n            // Check for null (validation failure from buildBucketPermissions)\n            if (allActions === null) {\n                showAlert('Please select at least one bucket when using specific bucket permissions', 'error');\n                return;\n            }\n\n            // Validate that permissions are not empty\n            if (!allActions || allActions.length === 0) {\n                showAlert('At least one permission must be selected', 'error');\n                return;\n            }\n\n            const userData = {\n                email: document.getElementById('editEmail').value,\n                actions: allActions,\n                policy_names: Array.from(document.getElementById('editPolicies').selectedOptions).map(option => option.value)\n            };\n\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`), {\n                    method: 'PUT',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify(userData)\n                });\n\n                if (response.ok) {\n                    showSuccessMessage('User updated successfully');\n\n                    // Close modal and refresh page\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('editUserModal'));\n                    modal.hide();\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json();\n                        showAlert('Failed to update user: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error updating user:', error);\n                showAlert('Failed to update user: ' + error.message, 'error');\n            }\n        }\n\n\n        // Create user details content\n        function createUserDetailsContent(user) {\n            var detailsHtml = '<div class=\"row\">';\n            detailsHtml += '<div class=\"col-md-6\">';\n            detailsHtml += '<h6 class=\"text-muted\">Basic Information</h6>';\n            detailsHtml += '<table class=\"table table-sm\">';\n            detailsHtml += '<tr><td><strong>Username:</strong></td><td>' + escapeHtml(user.username) + '</td></tr>';\n            detailsHtml += '<tr><td><strong>Email:</strong></td><td>' + escapeHtml(user.email || 'Not set') + '</td></tr>';\n            detailsHtml += '</table>';\n            detailsHtml += '</div>';\n            detailsHtml += '<div class=\"col-md-6\">';\n                         detailsHtml += '<h6 class=\"text-muted\">Permissions</h6>';\n             detailsHtml += '<div class=\"mb-3\">';\n             if (user.actions && user.actions.length > 0) {\n                 detailsHtml += user.actions.map(function(action) {\n                     return '<span class=\"badge bg-info me-1\">' + escapeHtml(action) + '</span>';\n                 }).join('');\n             } else {\n                 detailsHtml += '<span class=\"text-muted\">No permissions assigned</span>';\n             }\n              detailsHtml += '</div>';\n              detailsHtml += '<h6 class=\"text-muted\">Attached Policy Names</h6>';\n              detailsHtml += '<div class=\"mb-3\">';\n              if (user.policy_names && user.policy_names.length > 0) {\n                  detailsHtml += user.policy_names.map(function(policy) {\n                      return '<span class=\"badge bg-secondary me-1\">' + escapeHtml(policy) + '</span>';\n                  }).join('');\n              } else {\n                  detailsHtml += '<span class=\"text-muted\">No policies attached</span>';\n              }\n              detailsHtml += '</div>';\n              detailsHtml += '<h6 class=\"text-muted\">Groups</h6>';\n              detailsHtml += '<div class=\"mb-3\">';\n              if (user.groups && user.groups.length > 0) {\n                  detailsHtml += user.groups.map(function(group) {\n                      return '<span class=\"badge bg-primary me-1\">' + escapeHtml(group) + '</span>';\n                  }).join('');\n              } else {\n                  detailsHtml += '<span class=\"text-muted\">No groups</span>';\n              }\n              detailsHtml += '</div>';\n              detailsHtml += '<h6 class=\"text-muted\">Access Keys</h6>';\n             if (user.access_keys && user.access_keys.length > 0) {\n                 detailsHtml += '<div class=\"mb-2\">';\n                 user.access_keys.forEach(function(key) {\n                     detailsHtml += '<div><code class=\"text-muted\">' + escapeHtml(key.access_key) + '</code></div>';\n                 });\n                 detailsHtml += '</div>';\n             } else {\n                 detailsHtml += '<p class=\"text-muted\">No access keys</p>';\n             }\n            detailsHtml += '</div>';\n            detailsHtml += '</div>';\n            return detailsHtml;\n        }\n\n        // Create access keys content\n        function createAccessKeysContent(user) {\n            if (!user.access_keys || user.access_keys.length === 0) {\n                return '<p class=\"text-muted\">No access keys available</p>';\n            }\n\n            var keysHtml = '<div class=\"table-responsive\">';\n            keysHtml += '<table class=\"table table-sm\">';\n            keysHtml += '<thead><tr><th>Access Key</th><th>Status</th><th>Actions</th></tr></thead>';\n            keysHtml += '<tbody>';\n\n            user.access_keys.forEach(function(key) {\n                keysHtml += '<tr>';\n                keysHtml += '<td><code>' + escapeHtml(key.access_key) + '</code></td>';\n                keysHtml += '<td>';\n                keysHtml += '<select class=\"form-select form-select-sm access-key-status-select\" data-username=\"' + escapeHtml(user.username) + '\" data-access-key=\"' + escapeHtml(key.access_key) + '\" style=\"width: 110px;\">';\n                keysHtml += '<option value=\"' + STATUS_ACTIVE + '\" ' + (key.status === STATUS_ACTIVE || !key.status ? 'selected' : '') + '>' + STATUS_ACTIVE + '</option>';\n                keysHtml += '<option value=\"' + STATUS_INACTIVE + '\" ' + (key.status === STATUS_INACTIVE ? 'selected' : '') + '>' + STATUS_INACTIVE + '</option>';\n                keysHtml += '</select>';\n                keysHtml += '</td>';\n                keysHtml += '<td>';\n                // Add \"View Secret\" button with data attributes\n                keysHtml += '<button class=\"btn btn-outline-secondary btn-sm me-2 view-secret-btn\" data-access-key=\"' + escapeHtml(key.access_key) + '\" data-secret-key=\"' + escapeHtml(key.secret_key) + '\">';\n                keysHtml += '<i class=\"fas fa-eye\"></i> View Secret';\n                keysHtml += '</button>';\n                // Delete button\n                keysHtml += '<button class=\"btn btn-outline-danger btn-sm delete-access-key-btn\" data-username=\"' + escapeHtml(user.username) + '\" data-access-key=\"' + escapeHtml(key.access_key) + '\">';\n                keysHtml += '<i class=\"fas fa-trash\"></i> Delete';\n                keysHtml += '</button>';\n                keysHtml += '</td>';\n                keysHtml += '</tr>';\n            });\n\n            keysHtml += '</tbody>';\n            keysHtml += '</table>';\n            keysHtml += '</div>';\n\n            // Add delegated event listener for view secret buttons\n            setTimeout(() => {\n                document.querySelectorAll('.view-secret-btn').forEach(btn => {\n                    btn.addEventListener('click', function() {\n                        const accessKey = this.getAttribute('data-access-key');\n                        const secretKey = this.getAttribute('data-secret-key');\n                        showSecretKey(accessKey, secretKey);\n                    });\n                });\n            }, 100);\n\n            return keysHtml;\n        }\n\n        // Refresh access keys list content\n        async function refreshAccessKeysList(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n                    document.getElementById('accessKeysContent').innerHTML = createAccessKeysContent(user);\n                }\n            } catch (error) {\n                console.error('Error refreshing access keys:', error);\n            }\n        }\n\n        // Update access key status\n        async function updateAccessKeyStatus(username, accessKey, status) {\n            try {\n                const response = await fetch(basePath(`/api/users/${encodeURIComponent(username)}/access-keys/${encodeURIComponent(accessKey)}/status`), {\n                    method: 'PUT',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify({ status: status })\n                });\n\n                if (response.ok) {\n                    showSuccessMessage('Access key status updated successfully');\n                    // Refresh access keys display without toggling modal\n                    refreshAccessKeysList(username);\n                } else {\n                    const error = await response.json();\n                        showAlert('Failed to update access key status: ' + (error.error || 'Unknown error'), 'error');\n                    refreshAccessKeysList(username);\n                }\n            } catch (error) {\n                console.error('Error updating access key status:', error);\n                showAlert('Failed to update access key status: ' + error.message, 'error');\n                refreshAccessKeysList(username);\n            }\n        }\n\n        // Reset and hide the create key form\n        function resetCreateKeyForm() {\n            document.getElementById('createKeyForm').style.display = 'none';\n            document.getElementById('newAccessKeyInput').value = '';\n            document.getElementById('newSecretKeyInput').value = '';\n            document.getElementById('newSecretKeyInput').type = 'password';\n            document.getElementById('secretKeyToggleIcon').className = 'fas fa-eye';\n        }\n\n        // Toggle create key form visibility\n        function toggleCreateKeyForm() {\n            const form = document.getElementById('createKeyForm');\n            if (form.style.display === 'none') {\n                form.style.display = 'block';\n            } else {\n                resetCreateKeyForm();\n            }\n        }\n\n        // Toggle secret key input visibility\n        function toggleSecretKeyVisibility() {\n            const input = document.getElementById('newSecretKeyInput');\n            const icon = document.getElementById('secretKeyToggleIcon');\n            if (input.type === 'password') {\n                input.type = 'text';\n                icon.className = 'fas fa-eye-slash';\n            } else {\n                input.type = 'password';\n                icon.className = 'fas fa-eye';\n            }\n        }\n\n        // Reset form when modal is dismissed\n        document.getElementById('accessKeysModal').addEventListener('hidden.bs.modal', resetCreateKeyForm);\n\n        // Create new access key\n        var isCreatingKey = false;\n        async function createAccessKey() {\n            if (isCreatingKey) return;\n\n            const username = document.getElementById('accessKeysUsername').textContent;\n            const accessKeyInput = document.getElementById('newAccessKeyInput');\n            const secretKeyInput = document.getElementById('newSecretKeyInput');\n            if ((accessKeyInput.value.trim() && !accessKeyInput.reportValidity()) ||\n                (secretKeyInput.value.trim() && !secretKeyInput.reportValidity())) {\n                return;\n            }\n            const accessKey = accessKeyInput.value.trim();\n            const secretKey = secretKeyInput.value.trim();\n\n            const body = {};\n            if (accessKey) body.access_key = accessKey;\n            if (secretKey) body.secret_key = secretKey;\n\n            isCreatingKey = true;\n            const createBtn = document.querySelector('#createKeyForm .btn-primary');\n            const cancelBtn = document.querySelector('#createKeyForm .btn-secondary');\n            if (createBtn) createBtn.disabled = true;\n            if (cancelBtn) cancelBtn.disabled = true;\n\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}/access-keys`), {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify(body)\n                });\n\n                if (response.ok) {\n                    const result = await response.json();\n\n                    // Show the new access key details\n                    if (result.access_key) {\n                        showNewAccessKeyModal(result.access_key);\n                    }\n\n                    showSuccessMessage('Access key created successfully');\n                    resetCreateKeyForm();\n\n                    // Refresh access keys display\n                    refreshAccessKeysList(username);\n                } else {\n                    const error = await response.json();\n                        showAlert('Failed to create access key: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error creating access key:', error);\n                showAlert('Failed to create access key: ' + error.message, 'error');\n            } finally {\n                isCreatingKey = false;\n                if (createBtn) createBtn.disabled = false;\n                if (cancelBtn) cancelBtn.disabled = false;\n            }\n        }\n\n        // Delete access key\n        async function deleteAccessKey(username, accessKey) {\n            showDeleteConfirm(accessKey, async function() {\n                try {\n                    const encodedUsername = encodeURIComponent(username);\n                    const encodedAccessKey = encodeURIComponent(accessKey);\n                    const response = await fetch(basePath(`/api/users/${encodedUsername}/access-keys/${encodedAccessKey}`), {\n                        method: 'DELETE'\n                    });\n\n                    if (response.ok) {\n                        showSuccessMessage('Access key deleted successfully');\n\n                        // Refresh access keys display\n                        refreshAccessKeysList(username);\n                    } else {\n                        const error = await response.json();\n                        showErrorMessage('Failed to delete access key: ' + (error.error || 'Unknown error'));\n                    }\n                } catch (error) {\n                    console.error('Error deleting access key:', error);\n                    showErrorMessage('Failed to delete access key: ' + error.message);\n                }\n            }, 'Are you sure you want to delete this access key?');\n        }\n\n\n        // Utility functions\n        function showSuccessMessage(message) {\n            // Simple implementation - could be enhanced with toast notifications\n            alert('Success: ' + message);\n        }\n\n        function showErrorMessage(message) {\n            showAlert(message, 'error');\n        }\n\n        function escapeHtml(text) {\n            if (!text) return '';\n            const div = document.createElement('div');\n            div.textContent = text;\n            return div.innerHTML;\n        }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</div><div class=\"mb-3\"><label for=\"email\" class=\"form-label\">Email</label> <input type=\"email\" class=\"form-control\" id=\"email\" name=\"email\"></div><div class=\"mb-3\"><label for=\"actions\" class=\"form-label\">Permissions</label> <select multiple class=\"form-control\" id=\"actions\" name=\"actions\" size=\"10\"><option value=\"Admin\">Admin (Full Access)</option> <option value=\"Read\">Read</option> <option value=\"Write\">Write</option> <option value=\"List\">List</option> <option value=\"Tagging\">Tagging</option> <optgroup label=\"Object Lock Permissions\"><option value=\"BypassGovernanceRetention\">Bypass Governance Retention</option> <option value=\"GetObjectRetention\">Get Object Retention</option> <option value=\"PutObjectRetention\">Put Object Retention</option> <option value=\"GetObjectLegalHold\">Get Object Legal Hold</option> <option value=\"PutObjectLegalHold\">Put Object Legal Hold</option> <option value=\"GetBucketObjectLockConfiguration\">Get Bucket Object Lock Configuration</option> <option value=\"PutBucketObjectLockConfiguration\">Put Bucket Object Lock Configuration</option></optgroup> <optgroup label=\"Bucket Policy Permissions\"><option value=\"PutBucketPolicy\">Put Bucket Policy</option> <option value=\"DeleteBucketPolicy\">Delete Bucket Policy</option></optgroup> <optgroup label=\"S3 Tables Permissions\"><option value=\"S3TablesAdmin\">S3 Tables Admin (Full Access)</option> <option value=\"CreateTableBucket\">Create Table Bucket</option> <option value=\"GetTableBucket\">Get Table Bucket</option> <option value=\"ListTableBuckets\">List Table Buckets</option> <option value=\"DeleteTableBucket\">Delete Table Bucket</option> <option value=\"PutTableBucketPolicy\">Put Table Bucket Policy</option> <option value=\"GetTableBucketPolicy\">Get Table Bucket Policy</option> <option value=\"DeleteTableBucketPolicy\">Delete Table Bucket Policy</option> <option value=\"CreateNamespace\">Create Namespace</option> <option value=\"GetNamespace\">Get Namespace</option> <option value=\"ListNamespaces\">List Namespaces</option> <option value=\"DeleteNamespace\">Delete Namespace</option> <option value=\"CreateTable\">Create Table</option> <option value=\"GetTable\">Get Table</option> <option value=\"ListTables\">List Tables</option> <option value=\"DeleteTable\">Delete Table</option> <option value=\"PutTablePolicy\">Put Table Policy</option> <option value=\"GetTablePolicy\">Get Table Policy</option> <option value=\"DeleteTablePolicy\">Delete Table Policy</option> <option value=\"TagResource\">Tag Resource</option> <option value=\"ListTagsForResource\">List Tags</option> <option value=\"UntagResource\">Untag Resource</option></optgroup></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple permissions</small></div><div class=\"mb-3\"><label class=\"form-label\">Bucket Scope</label> <small class=\"form-text text-muted d-block mb-2\">Apply selected permissions to specific buckets or all buckets</small><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"bucketScope\" id=\"allBuckets\" value=\"all\" checked onchange=\"toggleBucketList()\"> <label class=\"form-check-label\" for=\"allBuckets\">All Buckets</label></div><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"bucketScope\" id=\"specificBuckets\" value=\"specific\" onchange=\"toggleBucketList()\"> <label class=\"form-check-label\" for=\"specificBuckets\">Specific Buckets</label></div><div id=\"bucketSelectionList\" class=\"mt-2\" style=\"display: none;\"><select multiple class=\"form-select\" id=\"selectedBuckets\" size=\"5\"><!-- Options loaded dynamically --></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple buckets</small></div></div><div class=\"mb-3\"><label for=\"policies\" class=\"form-label\">Attached Policies</label> <select multiple class=\"form-control\" id=\"policies\" name=\"policies\" size=\"5\"><!-- Options loaded dynamically --></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple policies</small></div><div class=\"mb-3 form-check\"><input type=\"checkbox\" class=\"form-check-input\" id=\"generateKey\" name=\"generateKey\" checked> <label class=\"form-check-label\" for=\"generateKey\">Generate access key automatically</label></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"handleCreateUser()\">Create User</button></div></div></div></div><!-- Edit User Modal --><div class=\"modal fade\" id=\"editUserModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-person-gear me-2\"></i>Edit User</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"editUserForm\"><input type=\"hidden\" id=\"editUsername\" name=\"username\"><div class=\"mb-3\"><label for=\"editEmail\" class=\"form-label\">Email</label> <input type=\"email\" class=\"form-control\" id=\"editEmail\" name=\"email\"></div><div class=\"mb-3\"><label for=\"editActions\" class=\"form-label\">Permissions</label> <select multiple class=\"form-control\" id=\"editActions\" name=\"actions\" size=\"10\"><option value=\"Admin\">Admin (Full Access)</option> <option value=\"Read\">Read</option> <option value=\"Write\">Write</option> <option value=\"List\">List</option> <option value=\"Tagging\">Tagging</option> <optgroup label=\"Object Lock Permissions\"><option value=\"BypassGovernanceRetention\">Bypass Governance Retention</option> <option value=\"GetObjectRetention\">Get Object Retention</option> <option value=\"PutObjectRetention\">Put Object Retention</option> <option value=\"GetObjectLegalHold\">Get Object Legal Hold</option> <option value=\"PutObjectLegalHold\">Put Object Legal Hold</option> <option value=\"GetBucketObjectLockConfiguration\">Get Bucket Object Lock Configuration</option> <option value=\"PutBucketObjectLockConfiguration\">Put Bucket Object Lock Configuration</option></optgroup> <optgroup label=\"Bucket Policy Permissions\"><option value=\"PutBucketPolicy\">Put Bucket Policy</option> <option value=\"DeleteBucketPolicy\">Delete Bucket Policy</option></optgroup> <optgroup label=\"S3 Tables Permissions\"><option value=\"S3TablesAdmin\">S3 Tables Admin (Full Access)</option> <option value=\"CreateTableBucket\">Create Table Bucket</option> <option value=\"GetTableBucket\">Get Table Bucket</option> <option value=\"ListTableBuckets\">List Table Buckets</option> <option value=\"DeleteTableBucket\">Delete Table Bucket</option> <option value=\"PutTableBucketPolicy\">Put Table Bucket Policy</option> <option value=\"GetTableBucketPolicy\">Get Table Bucket Policy</option> <option value=\"DeleteTableBucketPolicy\">Delete Table Bucket Policy</option> <option value=\"CreateNamespace\">Create Namespace</option> <option value=\"GetNamespace\">Get Namespace</option> <option value=\"ListNamespaces\">List Namespaces</option> <option value=\"DeleteNamespace\">Delete Namespace</option> <option value=\"CreateTable\">Create Table</option> <option value=\"GetTable\">Get Table</option> <option value=\"ListTables\">List Tables</option> <option value=\"DeleteTable\">Delete Table</option> <option value=\"PutTablePolicy\">Put Table Policy</option> <option value=\"GetTablePolicy\">Get Table Policy</option> <option value=\"DeleteTablePolicy\">Delete Table Policy</option> <option value=\"TagResource\">Tag Resource</option> <option value=\"ListTagsForResource\">List Tags</option> <option value=\"UntagResource\">Untag Resource</option></optgroup></select></div><div class=\"mb-3\"><label class=\"form-label\">Bucket Scope</label> <small class=\"form-text text-muted d-block mb-2\">Apply selected permissions to specific buckets or all buckets</small><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"editBucketScope\" id=\"editAllBuckets\" value=\"all\" checked onchange=\"toggleBucketList('edit')\"> <label class=\"form-check-label\" for=\"editAllBuckets\">All Buckets</label></div><div class=\"form-check mb-2\"><input class=\"form-check-input\" type=\"radio\" name=\"editBucketScope\" id=\"editSpecificBuckets\" value=\"specific\" onchange=\"toggleBucketList('edit')\"> <label class=\"form-check-label\" for=\"editSpecificBuckets\">Specific Buckets</label></div><div id=\"editBucketSelectionList\" class=\"mt-2\" style=\"display: none;\"><select multiple class=\"form-select\" id=\"editSelectedBuckets\" size=\"5\"><!-- Options loaded dynamically --></select> <small class=\"form-text text-muted\">Hold Ctrl/Cmd to select multiple buckets</small></div></div><div class=\"mb-3\"><label for=\"editPolicies\" class=\"form-label\">Attached Policies</label> <select multiple class=\"form-control\" id=\"editPolicies\" name=\"policies\" size=\"5\"><!-- Options loaded dynamically --></select></div><div class=\"mb-3\"><label class=\"form-label\">Groups</label><div id=\"editUserGroups\"><!-- Groups loaded dynamically --></div><div class=\"input-group mt-2\"><select class=\"form-select\" id=\"editGroupSelect\"><option value=\"\">Add to group...</option></select> <button class=\"btn btn-outline-primary\" type=\"button\" onclick=\"addUserToGroupFromEdit()\" aria-label=\"Add user to group\" title=\"Add user to group\"><i class=\"bi bi-plus\"></i></button></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"handleUpdateUser()\">Update User</button></div></div></div></div><!-- User Details Modal --><div class=\"modal fade\" id=\"userDetailsModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-person me-2\"></i>User Details</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\" id=\"userDetailsContent\"><!-- Content will be loaded dynamically --></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- Access Keys Management Modal --><div class=\"modal fade\" id=\"accessKeysModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-key me-2\"></i>Manage Access Keys</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><div class=\"d-flex justify-content-between align-items-center mb-3\"><h6>Access Keys for <span id=\"accessKeysUsername\"></span></h6><button type=\"button\" class=\"btn btn-primary btn-sm\" onclick=\"toggleCreateKeyForm()\"><i class=\"bi bi-plus me-1\"></i>Create New Key</button></div><div id=\"createKeyForm\" class=\"card mb-3\" style=\"display: none;\"><div class=\"card-body\"><p class=\"text-muted small mb-2\">Leave blank to auto-generate.</p><div class=\"mb-2\"><label for=\"newAccessKeyInput\" class=\"form-label form-label-sm\">Access Key</label> <input type=\"text\" class=\"form-control form-control-sm\" id=\"newAccessKeyInput\" placeholder=\"Auto-generated if empty\" minlength=\"4\" maxlength=\"128\"></div><div class=\"mb-2\"><label for=\"newSecretKeyInput\" class=\"form-label form-label-sm\">Secret Key</label><div class=\"input-group input-group-sm\"><input type=\"password\" class=\"form-control form-control-sm\" id=\"newSecretKeyInput\" placeholder=\"Auto-generated if empty\" minlength=\"8\" maxlength=\"128\"> <button class=\"btn btn-outline-secondary\" type=\"button\" onclick=\"toggleSecretKeyVisibility()\" aria-label=\"Toggle secret key visibility\"><i class=\"bi bi-eye\" id=\"secretKeyToggleIcon\"></i></button></div></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary btn-sm\" onclick=\"createAccessKey()\">Create</button> <button type=\"button\" class=\"btn btn-secondary btn-sm\" onclick=\"toggleCreateKeyForm()\">Cancel</button></div></div></div><div id=\"accessKeysContent\"><!-- Content will be loaded dynamically --></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- JavaScript for user management --><script>\n        // Access key status constants\n        const STATUS_ACTIVE = 'Active';\n        const STATUS_INACTIVE = 'Inactive';\n\n        // Use basePath() from admin.js for -urlPrefix; it is loaded in the layout footer before DOMContentLoaded fires.\n        document.addEventListener('DOMContentLoaded', function() {\n\n            // Event delegation for user action buttons\n            document.addEventListener('click', function(e) {\n                const button = e.target.closest('[data-action]');\n                if (!button) return;\n\n                const action = button.getAttribute('data-action');\n                const username = button.getAttribute('data-username');\n\n                switch (action) {\n                    case 'show-user-details':\n                        showUserDetails(username);\n                        break;\n                    case 'edit-user':\n                        editUser(username);\n                        break;\n                    case 'manage-access-keys':\n                        manageAccessKeys(username);\n                        break;\n                    case 'delete-user':\n                        deleteUser(username);\n                        break;\n                }\n            });\n\n            // Event delegation for delete access key buttons\n            document.addEventListener('click', function(e) {\n                const deleteBtn = e.target.closest('.delete-access-key-btn');\n                if (deleteBtn) {\n                    const username = deleteBtn.getAttribute('data-username');\n                    const accessKey = deleteBtn.getAttribute('data-access-key');\n                    deleteAccessKey(username, accessKey);\n                }\n            });\n\n            // Event delegation for access key status changes\n            document.addEventListener('change', function(e) {\n                const statusSelect = e.target.closest('.access-key-status-select');\n                if (statusSelect) {\n                    const username = statusSelect.getAttribute('data-username');\n                    const accessKey = statusSelect.getAttribute('data-access-key');\n                    const newStatus = statusSelect.value;\n                    updateAccessKeyStatus(username, accessKey, newStatus);\n                }\n            });\n\n            // Load policies for dropdowns\n            loadPolicies();\n\n            // Load buckets for bucket permissions\n            loadBuckets();\n        });\n\n        // Global variable to store available buckets\n        var availableBuckets = [];\n        var bucketPermissionCounter = 0;\n        const s3TablesPermissions = new Set([\n            'CreateTableBucket',\n            'GetTableBucket',\n            'ListTableBuckets',\n            'DeleteTableBucket',\n            'PutTableBucketPolicy',\n            'GetTableBucketPolicy',\n            'DeleteTableBucketPolicy',\n            'CreateNamespace',\n            'GetNamespace',\n            'ListNamespaces',\n            'DeleteNamespace',\n            'CreateTable',\n            'GetTable',\n            'ListTables',\n            'DeleteTable',\n            'PutTablePolicy',\n            'GetTablePolicy',\n            'DeleteTablePolicy',\n            'TagResource',\n            'ListTagsForResource',\n            'UntagResource'\n        ]);\n        function isS3TablesPermission(permission) {\n            return permission === 'S3TablesAdmin' || s3TablesPermissions.has(permission);\n        }\n\n        // Load buckets\n        async function loadBuckets() {\n            try {\n                const response = await fetch(basePath('/api/s3/buckets'));\n                if (response.ok) {\n                    const data = await response.json();\n                    availableBuckets = (data.buckets || []).map(bucket => ({ name: bucket.name, type: 's3' }));\n                    console.log('Loaded', availableBuckets.length, 'buckets');\n                } else {\n                    console.warn('Failed to load buckets');\n                    availableBuckets = [];\n                }\n            } catch (error) {\n                console.error('Error loading buckets:', error);\n                availableBuckets = [];\n            }\n            try {\n                const response = await fetch(basePath('/api/s3tables/buckets'));\n                if (response.ok) {\n                    const data = await response.json();\n                    const tableBuckets = (data.buckets || data.tableBuckets || []).map(bucket => ({ name: bucket.name, type: 's3tables' }));\n                    availableBuckets = availableBuckets.concat(tableBuckets);\n                } else {\n                    console.warn('Failed to load table buckets');\n                }\n            } catch (error) {\n                console.warn('Error loading table buckets:', error);\n            }\n            // Populate bucket selection dropdowns\n            populateBucketSelections();\n        }\n\n        // Load policies\n        async function loadPolicies() {\n            try {\n                const response = await fetch(basePath('/api/object-store/policies'));\n                if (response.ok) {\n                    const data = await response.json();\n                    const policies = data.policies || [];\n\n                    const createSelect = document.getElementById('policies');\n                    const editSelect = document.getElementById('editPolicies');\n\n                    // Check if elements exist\n                    if (!createSelect || !editSelect) {\n                        console.warn('Policy select elements not found');\n                        return;\n                    }\n\n                    // Clear existing options\n                    createSelect.innerHTML = '';\n                    editSelect.innerHTML = '';\n\n                    if (policies && policies.length > 0) {\n                        policies.forEach(policy => {\n                            const option = document.createElement('option');\n                            option.value = policy.name;\n                            option.textContent = policy.name;\n                            createSelect.appendChild(option);\n                            editSelect.appendChild(option.cloneNode(true));\n                        });\n                    } else {\n                        const emptyOption = document.createElement('option');\n                        emptyOption.disabled = true;\n                        emptyOption.textContent = 'No policies available';\n                        createSelect.appendChild(emptyOption);\n                        editSelect.appendChild(emptyOption.cloneNode(true));\n                    }\n                } else {\n                    const error = await response.json().catch(() => ({}));\n                    showAlert('Failed to load policies: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error loading policies:', error);\n                showAlert('Failed to load policies: ' + error.message, 'error');\n            }\n        }\n\n        // Toggle bucket permission fields when Admin checkbox changes\n        function toggleBucketPermissionFields(mode) {\n            mode = mode || 'create';\n            const adminCheckbox = document.getElementById(mode === 'edit' ? 'editBucketAdmin' : 'bucketAdmin');\n            const permissionFields = document.getElementById(mode === 'edit' ? 'editBucketPermissionFields' : 'bucketPermissionFields');\n\n            if (adminCheckbox && permissionFields) {\n                permissionFields.style.display = adminCheckbox.checked ? 'none' : 'block';\n            }\n        }\n\n        // Toggle bucket list visibility when bucket scope changes\n        function toggleBucketList(mode) {\n            mode = mode || 'create';\n            const specificRadio = document.getElementById(mode === 'edit' ? 'editSpecificBuckets' : 'specificBuckets');\n            const bucketList = document.getElementById(mode === 'edit' ? 'editBucketSelectionList' : 'bucketSelectionList');\n\n            if (specificRadio && bucketList) {\n                bucketList.style.display = specificRadio.checked ? 'block' : 'none';\n            }\n        }\n\n        // Toggle anonymous user checkbox\n        function toggleAnonymousUser() {\n            const checkbox = document.getElementById('anonymousCheck');\n            const usernameInput = document.getElementById('username');\n            const generateKey = document.getElementById('generateKey');\n            if (checkbox.checked) {\n                usernameInput.value = 'anonymous';\n                usernameInput.readOnly = true;\n                generateKey.checked = false;\n                generateKey.disabled = true;\n            } else {\n                usernameInput.value = '';\n                usernameInput.readOnly = false;\n                generateKey.disabled = false;\n                generateKey.checked = true;\n            }\n        }\n\n        // Populate bucket selection dropdowns\n        function populateBucketSelections() {\n            const createSelect = document.getElementById('selectedBuckets');\n            const editSelect = document.getElementById('editSelectedBuckets');\n\n            [createSelect, editSelect].forEach(select => {\n                if (select) {\n                    select.innerHTML = '';\n                    availableBuckets.forEach(bucket => {\n                        const option = document.createElement('option');\n                        option.value = bucket.type + ':' + bucket.name;\n                        option.textContent = bucket.type === 's3tables' ? `Table: ${bucket.name}` : bucket.name;\n                        select.appendChild(option);\n                    });\n                }\n            });\n        }\n\n        // Parse bucket permissions from actions array for new UI\n        function parseBucketPermissions(actions) {\n            const result = {\n                isAdmin: false,\n                permissions: [],\n                applyToAll: false,\n                specificBuckets: []\n            };\n\n            // Check if user has Admin permission\n            if (actions.includes('Admin')) {\n                result.isAdmin = true;\n                return result;\n            }\n\n            // Separate bucket-scoped from global actions\n            const bucketActions = [];\n            const globalBucketPerms = [];\n\n            actions.forEach(action => {\n                if (action.startsWith('s3tables:')) {\n                    const actionValue = action.slice('s3tables:'.length);\n                    if (actionValue === '*') {\n                        globalBucketPerms.push('S3TablesAdmin');\n                        return;\n                    }\n                    const parts = actionValue.split(':');\n                    const perm = parts[0];\n                    const bucket = parts.length > 1 ? parts.slice(1).join(':').replace(/\\/\\*$/, '') : '';\n                    if (bucket) {\n                        bucketActions.push({ permission: perm, bucketId: 's3tables:' + bucket });\n                    } else {\n                        globalBucketPerms.push(perm);\n                    }\n                } else if (action.includes(':')) {\n                    const parts = action.split(':');\n                    const perm = parts[0];\n                    const bucket = parts.slice(1).join(':').replace(/\\/\\*$/, '');\n                    bucketActions.push({ permission: perm, bucketId: 's3:' + bucket });\n                } else {\n                    globalBucketPerms.push(action);\n                }\n            });\n\n            // If we have global bucket permissions (no colon), they apply to all buckets\n            if (globalBucketPerms.length > 0) {\n                result.permissions = globalBucketPerms;\n                result.applyToAll = true;\n            } else if (bucketActions.length > 0) {\n                // Get unique permissions and buckets\n                const perms = [...new Set(bucketActions.map(ba => ba.permission))];\n                const buckets = [...new Set(bucketActions.map(ba => ba.bucketId))];\n\n                result.permissions = perms;\n                result.applyToAll = false;\n                result.specificBuckets = buckets;\n            }\n\n            return result;\n        }\n\n        function parseBucketOptionValue(value) {\n            if (value.startsWith('s3tables:')) {\n                return { type: 's3tables', name: value.slice('s3tables:'.length) };\n            }\n            if (value.startsWith('s3:')) {\n                return { type: 's3', name: value.slice('s3:'.length) };\n            }\n            return { type: 's3', name: value };\n        }\n\n        // Build bucket permission action strings using original permissions dropdown\n        /**\n         * Builds bucket permission strings based on selected permissions and bucket scope.\n         * @param {string} mode - The operation mode, either 'create' or 'edit'.\n         * @returns {string[]|null} Array of permission strings (e.g., ['Read:bucket1']) or null if validation fails (specific scope selected but no buckets).\n         */\n        function buildBucketPermissions(mode) {\n            mode = mode || 'create';\n            const selectId = mode === 'edit' ? 'editActions' : 'actions';\n            const permSelect = document.getElementById(selectId);\n\n            if (!permSelect) return [];\n\n            // Get selected permissions from the original multi-select\n            const selectedPerms = Array.from(permSelect.selectedOptions).map(opt => opt.value);\n\n            const hasAdmin = selectedPerms.includes('Admin');\n            const hasS3TablesAdmin = selectedPerms.includes('S3TablesAdmin');\n\n            if (selectedPerms.length === 0) {\n                return [];\n            }\n\n            // Check if applying to all buckets or specific ones\n            // Use querySelector to find the checked radio button by name group\n            const scopeName = mode === 'edit' ? 'editBucketScope' : 'bucketScope';\n\n            // Try multiple methods to find the checked radio\n            let checkedRadio = document.querySelector(`input[name=\"${scopeName}\"]:checked`);\n\n            // Fallback: check both radio buttons explicitly\n            if (!checkedRadio) {\n                const allBucketsId = mode === 'edit' ? 'editAllBuckets' : 'allBuckets';\n                const specificBucketsId = mode === 'edit' ? 'editSpecificBuckets' : 'specificBuckets';\n\n                const allBucketsRadio = document.getElementById(allBucketsId);\n                const specificBucketsRadio = document.getElementById(specificBucketsId);\n\n                if (specificBucketsRadio && specificBucketsRadio.checked) {\n                    checkedRadio = specificBucketsRadio;\n                } else if (allBucketsRadio && allBucketsRadio.checked) {\n                    checkedRadio = allBucketsRadio;\n                }\n            }\n\n            // Default to 'all' if nothing is checked (shouldn't happen) or if 'all' is checked\n            const applyToAll = !checkedRadio || checkedRadio.value === 'all';\n\n            if (applyToAll) {\n                // Return global permissions (no bucket specification)\n                const actions = [];\n                if (hasAdmin) {\n                    actions.push('Admin');\n                }\n                if (hasS3TablesAdmin) {\n                    actions.push('s3tables:*');\n                }\n                selectedPerms.forEach(perm => {\n                    if (perm === 'Admin' || perm === 'S3TablesAdmin') {\n                        return;\n                    }\n                    if (isS3TablesPermission(perm)) {\n                        actions.push('s3tables:' + perm);\n                    } else {\n                        actions.push(perm);\n                    }\n                });\n                return actions;\n            } else {\n                // Get selected specific buckets\n                const bucketSelect = document.getElementById(mode === 'edit' ? 'editSelectedBuckets' : 'selectedBuckets');\n                if (!bucketSelect) return null;\n\n                const selectedBuckets = [...new Set(Array.from(bucketSelect.selectedOptions).map(opt => opt.value))];\n\n                // Return null to signal validation failure if no buckets selected\n                if (selectedBuckets.length === 0) {\n                    return null;\n                }\n\n                // Build bucket-scoped permissions\n                const actions = [];\n                if (hasAdmin) {\n                    selectedBuckets.forEach((bucket) => {\n                        const bucketInfo = parseBucketOptionValue(bucket);\n                        actions.push(\"Admin:\" + bucketInfo.name);\n                    });\n                }\n                if (hasS3TablesAdmin) {\n                    actions.push('s3tables:*');\n                }\n                selectedPerms.forEach(perm => {\n                    if (perm === 'Admin' || perm === 'S3TablesAdmin') {\n                        return;\n                    }\n                    selectedBuckets.forEach(bucket => {\n                        const bucketInfo = parseBucketOptionValue(bucket);\n                        if (isS3TablesPermission(perm)) {\n                            if (bucketInfo.type === 's3tables') {\n                                actions.push('s3tables:' + perm + ':' + bucketInfo.name);\n                            }\n                        } else if (bucketInfo.type === 's3') {\n                            actions.push(perm + ':' + bucketInfo.name);\n                        }\n                    });\n                });\n\n                return [...new Set(actions)];\n            }\n        }\n\n        // Show user details modal\n        async function showUserDetails(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n                    document.getElementById('userDetailsContent').innerHTML = createUserDetailsContent(user);\n                    const modal = new bootstrap.Modal(document.getElementById('userDetailsModal'));\n                    modal.show();\n                } else {\n                    showAlert('Failed to load user details', 'error');\n                }\n            } catch (error) {\n                console.error('Error loading user details:', error);\n                showAlert('Failed to load user details', 'error');\n            }\n        }\n\n        // Edit user function\n        async function editUser(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n\n                    // Populate edit form\n                    document.getElementById('editUsername').value = username;\n                    document.getElementById('editEmail').value = user.email || '';\n\n                    // Set selected actions\n                    const actionsSelect = document.getElementById('editActions');\n                    Array.from(actionsSelect.options).forEach(option => {\n                        option.selected = user.actions && user.actions.includes(option.value);\n                    });\n\n                    // Set selected policies\n                    const policiesSelect = document.getElementById('editPolicies');\n                    if (policiesSelect) {\n                        Array.from(policiesSelect.options).forEach(option => {\n                            option.selected = user.policy_names && user.policy_names.includes(option.value);\n                        });\n                    }\n\n                    // Populate bucket permissions using original permissions dropdown\n                    if (user.actions && user.actions.length > 0) {\n                        const bucketPerms = parseBucketPermissions(user.actions);\n\n                        // Set permissions in the original multi-select\n                        const actionsSelect = document.getElementById('editActions');\n                        if (actionsSelect) {\n                            Array.from(actionsSelect.options).forEach(option => {\n                                if (bucketPerms.isAdmin && option.value === 'Admin') {\n                                    option.selected = true;\n                                } else if (!bucketPerms.isAdmin && bucketPerms.permissions.includes(option.value)) {\n                                    option.selected = true;\n                                }\n                            });\n                        }\n\n                        // Set bucket scope (all or specific)\n                        const allBucketsRadio = document.getElementById('editAllBuckets');\n                        const specificBucketsRadio = document.getElementById('editSpecificBuckets');\n\n                        if (!bucketPerms.isAdmin) {\n                            if (bucketPerms.applyToAll) {\n                                if (allBucketsRadio) allBucketsRadio.checked = true;\n                            } else if (bucketPerms.specificBuckets.length > 0) {\n                                if (specificBucketsRadio) specificBucketsRadio.checked = true;\n                                toggleBucketList('edit');\n\n                                // Select specific buckets\n                                const bucketSelect = document.getElementById('editSelectedBuckets');\n                                if (bucketSelect) {\n                                    Array.from(bucketSelect.options).forEach(option => {\n                                        option.selected = bucketPerms.specificBuckets.includes(option.value);\n                                    });\n                                }\n                            }\n                        }\n                    }\n\n                    // Populate groups\n                    await populateEditUserGroups(username);\n\n                    // Show modal\n                    const modal = new bootstrap.Modal(document.getElementById('editUserModal'));\n                    modal.show();\n                } else {\n                    showAlert('Failed to load user details', 'error');\n                }\n            } catch (error) {\n                console.error('Error loading user:', error);\n                showAlert('Failed to load user details', 'error');\n            }\n        }\n\n        // Manage access keys function\n        async function manageAccessKeys(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n                    document.getElementById('accessKeysUsername').textContent = username;\n                    document.getElementById('accessKeysContent').innerHTML = createAccessKeysContent(user);\n                    const modal = new bootstrap.Modal(document.getElementById('accessKeysModal'));\n                    modal.show();\n                } else {\n                    showAlert('Failed to load access keys', 'error');\n                }\n            } catch (error) {\n                console.error('Error loading access keys:', error);\n                showAlert('Failed to load access keys', 'error');\n            }\n        }\n\n        // Delete user function\n        async function deleteUser(username) {\n            showDeleteConfirm(username, async function() {\n                try {\n                    const encodedUsername = encodeURIComponent(username);\n                    const response = await fetch(basePath(`/api/users/${encodedUsername}`), {\n                        method: 'DELETE'\n                    });\n\n                    if (response.ok) {\n                        showSuccessMessage('User deleted successfully');\n                        setTimeout(() => window.location.reload(), 1000);\n                    } else {\n                        const error = await response.json();\n                        showErrorMessage('Failed to delete user: ' + (error.error || 'Unknown error'));\n                    }\n                } catch (error) {\n                    console.error('Error deleting user:', error);\n                    showErrorMessage('Failed to delete user: ' + error.message);\n                }\n            }, 'Are you sure you want to delete this user? This action cannot be undone.');\n        }\n\n        // Handle create user form submission\n        async function handleCreateUser() {\n            const form = document.getElementById('createUserForm');\n            const formData = new FormData(form);\n\n            // Get permissions with bucket scope applied\n            const allActions = buildBucketPermissions('create');\n\n            if (allActions === null) {\n                showAlert('Please select at least one bucket when using specific bucket permissions', 'error');\n                return;\n            }\n\n            if (!allActions || allActions.length === 0) {\n                showAlert('At least one permission must be selected', 'error');\n                return;\n            }\n\n            const userData = {\n                username: formData.get('username'),\n                email: formData.get('email'),\n                actions: allActions,\n                policy_names: Array.from(document.getElementById('policies').selectedOptions).map(option => option.value),\n                generate_key: document.getElementById('generateKey').checked\n            };\n\n            try {\n                const response = await fetch(basePath('/api/users'), {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify(userData)\n                });\n\n                if (response.ok) {\n                    const result = await response.json();\n                    showSuccessMessage('User created successfully');\n\n                    // Show the created access key if generated\n                    if (result.user && result.user.access_key) {\n                        showNewAccessKeyModal(result.user);\n                    }\n\n                    // Close modal and refresh page\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('createUserModal'));\n                    modal.hide();\n                    form.reset();\n                    document.getElementById('username').readOnly = false;\n                    document.getElementById('generateKey').disabled = false;\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json();\n                    showAlert('Failed to create user: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error creating user:', error);\n                showAlert('Failed to create user: ' + error.message, 'error');\n            }\n        }\n\n\n        // Populate groups in the edit user modal\n        async function populateEditUserGroups(username) {\n            const container = document.getElementById('editUserGroups');\n            const groupSelect = document.getElementById('editGroupSelect');\n            container.innerHTML = '';\n            groupSelect.innerHTML = '<option value=\"\">Add to group...</option>';\n\n            try {\n                // Fetch all groups\n                const groupsResp = await fetch(basePath('/api/groups'));\n                if (!groupsResp.ok) return;\n                const groupsData = await groupsResp.json();\n                const allGroups = groupsData.groups || [];\n\n                // Fetch user details to get current groups\n                const userResp = await fetch(basePath(`/api/users/${encodeURIComponent(username)}`));\n                if (!userResp.ok) return;\n                const user = await userResp.json();\n                const userGroups = user.groups || [];\n\n                // Show current group badges with remove button\n                if (userGroups.length > 0) {\n                    userGroups.forEach(function(group) {\n                        const badge = document.createElement('span');\n                        badge.className = 'badge bg-primary me-1 mb-1';\n                        badge.textContent = group + ' ';\n                        const removeIcon = document.createElement('i');\n                        removeIcon.className = 'bi bi-x ms-1';\n                        removeIcon.style.cursor = 'pointer';\n                        removeIcon.setAttribute('aria-label', 'Remove from group ' + group);\n                        removeIcon.setAttribute('title', 'Remove from group');\n                        removeIcon.addEventListener('click', function() {\n                            removeUserFromGroupInEdit(group);\n                        });\n                        badge.appendChild(removeIcon);\n                        container.appendChild(badge);\n                    });\n                } else {\n                    container.innerHTML = '<span class=\"text-muted\">No groups</span>';\n                }\n\n                // Populate dropdown with groups the user is NOT in\n                allGroups.forEach(function(g) {\n                    if (!userGroups.includes(g.name)) {\n                        const opt = document.createElement('option');\n                        opt.value = g.name;\n                        opt.textContent = g.name;\n                        groupSelect.appendChild(opt);\n                    }\n                });\n            } catch (error) {\n                console.error('Error loading groups:', error);\n            }\n        }\n\n        // Add user to group from edit modal\n        async function addUserToGroupFromEdit() {\n            const username = document.getElementById('editUsername').value;\n            const groupSelect = document.getElementById('editGroupSelect');\n            const groupName = groupSelect.value;\n            if (!groupName) return;\n\n            try {\n                const response = await fetch(basePath(`/api/groups/${encodeURIComponent(groupName)}/members`), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ username: username })\n                });\n                if (response.ok) {\n                    await populateEditUserGroups(username);\n                } else {\n                    const error = await response.json();\n                    showAlert('Failed to add to group: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to add to group: ' + error.message, 'error');\n            }\n        }\n\n        // Remove user from group in edit modal\n        async function removeUserFromGroupInEdit(groupName) {\n            const username = document.getElementById('editUsername').value;\n            try {\n                const response = await fetch(basePath(`/api/groups/${encodeURIComponent(groupName)}/members/${encodeURIComponent(username)}`), {\n                    method: 'DELETE'\n                });\n                if (response.ok) {\n                    await populateEditUserGroups(username);\n                } else {\n                    const error = await response.json();\n                    showAlert('Failed to remove from group: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                showAlert('Failed to remove from group: ' + error.message, 'error');\n            }\n        }\n\n        // Handle update user form submission\n        async function handleUpdateUser() {\n            const username = document.getElementById('editUsername').value;\n            if (!username) {\n                showAlert('Username is required', 'error');\n                return;\n            }\n\n            // Get permissions with bucket scope applied\n            const allActions = buildBucketPermissions('edit');\n\n            // Check for null (validation failure from buildBucketPermissions)\n            if (allActions === null) {\n                showAlert('Please select at least one bucket when using specific bucket permissions', 'error');\n                return;\n            }\n\n            // Validate that permissions are not empty\n            if (!allActions || allActions.length === 0) {\n                showAlert('At least one permission must be selected', 'error');\n                return;\n            }\n\n            const userData = {\n                email: document.getElementById('editEmail').value,\n                actions: allActions,\n                policy_names: Array.from(document.getElementById('editPolicies').selectedOptions).map(option => option.value)\n            };\n\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`), {\n                    method: 'PUT',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify(userData)\n                });\n\n                if (response.ok) {\n                    showSuccessMessage('User updated successfully');\n\n                    // Close modal and refresh page\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('editUserModal'));\n                    modal.hide();\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json();\n                        showAlert('Failed to update user: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error updating user:', error);\n                showAlert('Failed to update user: ' + error.message, 'error');\n            }\n        }\n\n\n        // Create user details content\n        function createUserDetailsContent(user) {\n            var detailsHtml = '<div class=\"row\">';\n            detailsHtml += '<div class=\"col-md-6\">';\n            detailsHtml += '<h6 class=\"text-muted\">Basic Information</h6>';\n            detailsHtml += '<table class=\"table table-sm\">';\n            detailsHtml += '<tr><td><strong>Username:</strong></td><td>' + escapeHtml(user.username) + '</td></tr>';\n            detailsHtml += '<tr><td><strong>Email:</strong></td><td>' + escapeHtml(user.email || 'Not set') + '</td></tr>';\n            detailsHtml += '</table>';\n            detailsHtml += '</div>';\n            detailsHtml += '<div class=\"col-md-6\">';\n                         detailsHtml += '<h6 class=\"text-muted\">Permissions</h6>';\n             detailsHtml += '<div class=\"mb-3\">';\n             if (user.actions && user.actions.length > 0) {\n                 detailsHtml += user.actions.map(function(action) {\n                     return '<span class=\"badge bg-info me-1\">' + escapeHtml(action) + '</span>';\n                 }).join('');\n             } else {\n                 detailsHtml += '<span class=\"text-muted\">No permissions assigned</span>';\n             }\n              detailsHtml += '</div>';\n              detailsHtml += '<h6 class=\"text-muted\">Attached Policy Names</h6>';\n              detailsHtml += '<div class=\"mb-3\">';\n              if (user.policy_names && user.policy_names.length > 0) {\n                  detailsHtml += user.policy_names.map(function(policy) {\n                      return '<span class=\"badge bg-secondary me-1\">' + escapeHtml(policy) + '</span>';\n                  }).join('');\n              } else {\n                  detailsHtml += '<span class=\"text-muted\">No policies attached</span>';\n              }\n              detailsHtml += '</div>';\n              detailsHtml += '<h6 class=\"text-muted\">Groups</h6>';\n              detailsHtml += '<div class=\"mb-3\">';\n              if (user.groups && user.groups.length > 0) {\n                  detailsHtml += user.groups.map(function(group) {\n                      return '<span class=\"badge bg-primary me-1\">' + escapeHtml(group) + '</span>';\n                  }).join('');\n              } else {\n                  detailsHtml += '<span class=\"text-muted\">No groups</span>';\n              }\n              detailsHtml += '</div>';\n              detailsHtml += '<h6 class=\"text-muted\">Access Keys</h6>';\n             if (user.access_keys && user.access_keys.length > 0) {\n                 detailsHtml += '<div class=\"mb-2\">';\n                 user.access_keys.forEach(function(key) {\n                     detailsHtml += '<div><code class=\"text-muted\">' + escapeHtml(key.access_key) + '</code></div>';\n                 });\n                 detailsHtml += '</div>';\n             } else {\n                 detailsHtml += '<p class=\"text-muted\">No access keys</p>';\n             }\n            detailsHtml += '</div>';\n            detailsHtml += '</div>';\n            return detailsHtml;\n        }\n\n        // Create access keys content\n        function createAccessKeysContent(user) {\n            if (!user.access_keys || user.access_keys.length === 0) {\n                return '<p class=\"text-muted\">No access keys available</p>';\n            }\n\n            var keysHtml = '<div class=\"table-responsive\">';\n            keysHtml += '<table class=\"table table-sm\">';\n            keysHtml += '<thead><tr><th>Access Key</th><th>Status</th><th>Actions</th></tr></thead>';\n            keysHtml += '<tbody>';\n\n            user.access_keys.forEach(function(key) {\n                keysHtml += '<tr>';\n                keysHtml += '<td><code>' + escapeHtml(key.access_key) + '</code></td>';\n                keysHtml += '<td>';\n                keysHtml += '<select class=\"form-select form-select-sm access-key-status-select\" data-username=\"' + escapeHtml(user.username) + '\" data-access-key=\"' + escapeHtml(key.access_key) + '\" style=\"width: 110px;\">';\n                keysHtml += '<option value=\"' + STATUS_ACTIVE + '\" ' + (key.status === STATUS_ACTIVE || !key.status ? 'selected' : '') + '>' + STATUS_ACTIVE + '</option>';\n                keysHtml += '<option value=\"' + STATUS_INACTIVE + '\" ' + (key.status === STATUS_INACTIVE ? 'selected' : '') + '>' + STATUS_INACTIVE + '</option>';\n                keysHtml += '</select>';\n                keysHtml += '</td>';\n                keysHtml += '<td>';\n                // Add \"View Secret\" button with data attributes\n                keysHtml += '<button class=\"btn btn-outline-secondary btn-sm me-2 view-secret-btn\" data-access-key=\"' + escapeHtml(key.access_key) + '\" data-secret-key=\"' + escapeHtml(key.secret_key) + '\">';\n                keysHtml += '<i class=\"bi bi-eye\"></i> View Secret';\n                keysHtml += '</button>';\n                // Delete button\n                keysHtml += '<button class=\"btn btn-outline-danger btn-sm delete-access-key-btn\" data-username=\"' + escapeHtml(user.username) + '\" data-access-key=\"' + escapeHtml(key.access_key) + '\">';\n                keysHtml += '<i class=\"bi bi-trash\"></i> Delete';\n                keysHtml += '</button>';\n                keysHtml += '</td>';\n                keysHtml += '</tr>';\n            });\n\n            keysHtml += '</tbody>';\n            keysHtml += '</table>';\n            keysHtml += '</div>';\n\n            // Add delegated event listener for view secret buttons\n            setTimeout(() => {\n                document.querySelectorAll('.view-secret-btn').forEach(btn => {\n                    btn.addEventListener('click', function() {\n                        const accessKey = this.getAttribute('data-access-key');\n                        const secretKey = this.getAttribute('data-secret-key');\n                        showSecretKey(accessKey, secretKey);\n                    });\n                });\n            }, 100);\n\n            return keysHtml;\n        }\n\n        // Refresh access keys list content\n        async function refreshAccessKeysList(username) {\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}`));\n                if (response.ok) {\n                    const user = await response.json();\n                    document.getElementById('accessKeysContent').innerHTML = createAccessKeysContent(user);\n                }\n            } catch (error) {\n                console.error('Error refreshing access keys:', error);\n            }\n        }\n\n        // Update access key status\n        async function updateAccessKeyStatus(username, accessKey, status) {\n            try {\n                const response = await fetch(basePath(`/api/users/${encodeURIComponent(username)}/access-keys/${encodeURIComponent(accessKey)}/status`), {\n                    method: 'PUT',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify({ status: status })\n                });\n\n                if (response.ok) {\n                    showSuccessMessage('Access key status updated successfully');\n                    // Refresh access keys display without toggling modal\n                    refreshAccessKeysList(username);\n                } else {\n                    const error = await response.json();\n                        showAlert('Failed to update access key status: ' + (error.error || 'Unknown error'), 'error');\n                    refreshAccessKeysList(username);\n                }\n            } catch (error) {\n                console.error('Error updating access key status:', error);\n                showAlert('Failed to update access key status: ' + error.message, 'error');\n                refreshAccessKeysList(username);\n            }\n        }\n\n        // Reset and hide the create key form\n        function resetCreateKeyForm() {\n            document.getElementById('createKeyForm').style.display = 'none';\n            document.getElementById('newAccessKeyInput').value = '';\n            document.getElementById('newSecretKeyInput').value = '';\n            document.getElementById('newSecretKeyInput').type = 'password';\n            document.getElementById('secretKeyToggleIcon').className = 'bi bi-eye';\n        }\n\n        // Toggle create key form visibility\n        function toggleCreateKeyForm() {\n            const form = document.getElementById('createKeyForm');\n            if (form.style.display === 'none') {\n                form.style.display = 'block';\n            } else {\n                resetCreateKeyForm();\n            }\n        }\n\n        // Toggle secret key input visibility\n        function toggleSecretKeyVisibility() {\n            const input = document.getElementById('newSecretKeyInput');\n            const icon = document.getElementById('secretKeyToggleIcon');\n            if (input.type === 'password') {\n                input.type = 'text';\n                icon.className = 'bi bi-eye-slash';\n            } else {\n                input.type = 'password';\n                icon.className = 'bi bi-eye';\n            }\n        }\n\n        // Reset form when modal is dismissed\n        document.getElementById('accessKeysModal').addEventListener('hidden.bs.modal', resetCreateKeyForm);\n\n        // Create new access key\n        var isCreatingKey = false;\n        async function createAccessKey() {\n            if (isCreatingKey) return;\n\n            const username = document.getElementById('accessKeysUsername').textContent;\n            const accessKeyInput = document.getElementById('newAccessKeyInput');\n            const secretKeyInput = document.getElementById('newSecretKeyInput');\n            if ((accessKeyInput.value.trim() && !accessKeyInput.reportValidity()) ||\n                (secretKeyInput.value.trim() && !secretKeyInput.reportValidity())) {\n                return;\n            }\n            const accessKey = accessKeyInput.value.trim();\n            const secretKey = secretKeyInput.value.trim();\n\n            const body = {};\n            if (accessKey) body.access_key = accessKey;\n            if (secretKey) body.secret_key = secretKey;\n\n            isCreatingKey = true;\n            const createBtn = document.querySelector('#createKeyForm .btn-primary');\n            const cancelBtn = document.querySelector('#createKeyForm .btn-secondary');\n            if (createBtn) createBtn.disabled = true;\n            if (cancelBtn) cancelBtn.disabled = true;\n\n            try {\n                const encodedUsername = encodeURIComponent(username);\n                const response = await fetch(basePath(`/api/users/${encodedUsername}/access-keys`), {\n                    method: 'POST',\n                    headers: {\n                        'Content-Type': 'application/json',\n                    },\n                    body: JSON.stringify(body)\n                });\n\n                if (response.ok) {\n                    const result = await response.json();\n\n                    // Show the new access key details\n                    if (result.access_key) {\n                        showNewAccessKeyModal(result.access_key);\n                    }\n\n                    showSuccessMessage('Access key created successfully');\n                    resetCreateKeyForm();\n\n                    // Refresh access keys display\n                    refreshAccessKeysList(username);\n                } else {\n                    const error = await response.json();\n                        showAlert('Failed to create access key: ' + (error.error || 'Unknown error'), 'error');\n                }\n            } catch (error) {\n                console.error('Error creating access key:', error);\n                showAlert('Failed to create access key: ' + error.message, 'error');\n            } finally {\n                isCreatingKey = false;\n                if (createBtn) createBtn.disabled = false;\n                if (cancelBtn) cancelBtn.disabled = false;\n            }\n        }\n\n        // Delete access key\n        async function deleteAccessKey(username, accessKey) {\n            showDeleteConfirm(accessKey, async function() {\n                try {\n                    const encodedUsername = encodeURIComponent(username);\n                    const encodedAccessKey = encodeURIComponent(accessKey);\n                    const response = await fetch(basePath(`/api/users/${encodedUsername}/access-keys/${encodedAccessKey}`), {\n                        method: 'DELETE'\n                    });\n\n                    if (response.ok) {\n                        showSuccessMessage('Access key deleted successfully');\n\n                        // Refresh access keys display\n                        refreshAccessKeysList(username);\n                    } else {\n                        const error = await response.json();\n                        showErrorMessage('Failed to delete access key: ' + (error.error || 'Unknown error'));\n                    }\n                } catch (error) {\n                    console.error('Error deleting access key:', error);\n                    showErrorMessage('Failed to delete access key: ' + error.message);\n                }\n            }, 'Are you sure you want to delete this access key?');\n        }\n\n\n        // Utility functions\n        function showSuccessMessage(message) {\n            // Simple implementation - could be enhanced with toast notifications\n            alert('Success: ' + message);\n        }\n\n        function showErrorMessage(message) {\n            showAlert(message, 'error');\n        }\n\n        function escapeHtml(text) {\n            if (!text) return '';\n            const div = document.createElement('div');\n            div.textContent = text;\n            return div.innerHTML;\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/plugin.templ b/weed/admin/view/app/plugin.templ
index 19593acf6f..e1a3263a98 100644
--- a/weed/admin/view/app/plugin.templ
+++ b/weed/admin/view/app/plugin.templ
@@ -18,12 +18,12 @@ templ Plugin(page string, initialJob string, lane string) {
             <div class="col-12">
                 <div class="d-flex justify-content-between align-items-center flex-wrap gap-2">
                     <div>
-                        <h2 class="mb-0"><i class="fas fa-plug me-2"></i>{ laneTitle }</h2>
+                        <h2 class="mb-0"><i class="bi bi-plug me-2"></i>{ laneTitle }</h2>
                         <p class="text-muted mb-0">{ laneDescription }</p>
                     </div>
                     <div class="btn-group">
                         <button type="button" class="btn btn-outline-secondary" id="plugin-refresh-all-btn">
-                            <i class="fas fa-sync-alt me-1"></i>Refresh
+                            <i class="bi bi-arrow-repeat me-1"></i>Refresh
                         </button>
                     </div>
                 </div>
@@ -35,7 +35,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <ul class="nav nav-tabs" id="plugin-top-tabs">
                     <li class="nav-item">
                         <button type="button" class="nav-link active" data-plugin-top-tab="overview">
-                            <i class="fas fa-chart-line me-1"></i>Overview
+                            <i class="bi bi-graph-up-arrow me-1"></i>Overview
                         </button>
                     </li>
                 </ul>
@@ -47,22 +47,22 @@ templ Plugin(page string, initialJob string, lane string) {
                 <ul class="nav nav-pills gap-2" id="plugin-subtabs">
                     <li class="nav-item">
                         <button type="button" class="nav-link active" data-plugin-subtab="configuration">
-                            <i class="fas fa-sliders-h me-1"></i>Configuration
+                            <i class="bi bi-sliders me-1"></i>Configuration
                         </button>
                     </li>
                     <li class="nav-item">
                         <button type="button" class="nav-link" data-plugin-subtab="detection">
-                            <i class="fas fa-search me-1"></i>Job Detection
+                            <i class="bi bi-search me-1"></i>Job Detection
                         </button>
                     </li>
                     <li class="nav-item">
                         <button type="button" class="nav-link" data-plugin-subtab="queue">
-                            <i class="fas fa-list me-1"></i>Job Queue
+                            <i class="bi bi-list me-1"></i>Job Queue
                         </button>
                     </li>
                     <li class="nav-item">
                         <button type="button" class="nav-link" data-plugin-subtab="execution">
-                            <i class="fas fa-tasks me-1"></i>Job Execution
+                            <i class="bi bi-list-check me-1"></i>Job Execution
                         </button>
                     </li>
                 </ul>
@@ -109,7 +109,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-12">
                     <div class="card shadow-sm">
                         <div class="card-header">
-                            <h5 class="mb-0"><i class="fas fa-chart-bar me-2"></i>Per Job Type Summary</h5>
+                            <h5 class="mb-0"><i class="bi bi-bar-chart me-2"></i>Per Job Type Summary</h5>
                         </div>
                         <div class="card-body p-0">
                             <div class="table-responsive">
@@ -134,7 +134,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-12">
                     <div class="card shadow-sm">
                         <div class="card-header d-flex justify-content-between align-items-center flex-wrap gap-2">
-                            <h5 class="mb-0"><i class="fas fa-clock me-2"></i>Scheduler State</h5>
+                            <h5 class="mb-0"><i class="bi bi-clock me-2"></i>Scheduler State</h5>
                             <small class="text-muted">Sequential scheduler with per-job runtime limits</small>
                         </div>
                         <div class="card-body p-0">
@@ -167,7 +167,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-12">
                     <div class="card shadow-sm">
                         <div class="card-header">
-                            <h5 class="mb-0"><i class="fas fa-users me-2"></i>Workers</h5>
+                            <h5 class="mb-0"><i class="bi bi-people me-2"></i>Workers</h5>
                         </div>
                         <div class="card-body p-0">
                             <div class="table-responsive" style="max-height: 560px; overflow-y: auto;">
@@ -196,7 +196,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-lg-8 mb-3">
                     <div class="card shadow-sm h-100">
                         <div class="card-header d-flex justify-content-between align-items-center">
-                            <h5 class="mb-0"><i class="fas fa-sliders-h me-2"></i>Job Type Configuration</h5>
+                            <h5 class="mb-0"><i class="bi bi-sliders me-2"></i>Job Type Configuration</h5>
                             <small class="text-muted" id="plugin-config-updated-at">Not loaded</small>
                         </div>
                         <div class="card-body">
@@ -209,7 +209,7 @@ templ Plugin(page string, initialJob string, lane string) {
                                 <div class="d-flex justify-content-between align-items-center mb-2">
                                     <h6 class="mb-0">Descriptor</h6>
                                     <button type="button" class="btn btn-sm btn-outline-secondary" id="plugin-refresh-schema-btn">
-                                        <i class="fas fa-cloud-download-alt me-1"></i>Refresh Schema
+                                        <i class="bi bi-cloud-download me-1"></i>Refresh Schema
                                     </button>
                                 </div>
                                 <div class="alert alert-light border" id="plugin-descriptor-summary">Select a job type to load schema and config.</div>
@@ -231,13 +231,13 @@ templ Plugin(page string, initialJob string, lane string) {
 
                             <div class="d-flex flex-wrap gap-2">
                                 <button type="button" class="btn btn-primary" id="plugin-save-config-btn">
-                                    <i class="fas fa-save me-1"></i>Save Config
+                                    <i class="bi bi-floppy me-1"></i>Save Config
                                 </button>
                                 <button type="button" class="btn btn-outline-primary" id="plugin-trigger-detection-btn">
-                                    <i class="fas fa-search me-1"></i>Run Detection
+                                    <i class="bi bi-search me-1"></i>Run Detection
                                 </button>
                                 <button type="button" class="btn btn-outline-success" id="plugin-run-workflow-btn">
-                                    <i class="fas fa-play me-1"></i>Run Detect + Execute
+                                    <i class="bi bi-play me-1"></i>Run Detect + Execute
                                 </button>
                             </div>
                         </div>
@@ -247,7 +247,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-lg-4 mb-3">
                     <div class="card shadow-sm">
                         <div class="card-header">
-                            <h5 class="mb-0"><i class="fas fa-cogs me-2"></i>Job Scheduling Settings</h5>
+                            <h5 class="mb-0"><i class="bi bi-gear-wide-connected me-2"></i>Job Scheduling Settings</h5>
                         </div>
                         <div class="card-body">
                             <div class="row g-2" id="plugin-admin-settings-form">
@@ -301,7 +301,7 @@ templ Plugin(page string, initialJob string, lane string) {
 
                     <div class="card shadow-sm mt-3">
                         <div class="card-header d-flex justify-content-between align-items-center">
-                            <h5 class="mb-0"><i class="fas fa-hourglass-half me-2"></i>Next Run</h5>
+                            <h5 class="mb-0"><i class="bi bi-hourglass-split me-2"></i>Next Run</h5>
                             <small class="text-muted">Scheduler</small>
                         </div>
                         <div class="card-body">
@@ -316,7 +316,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-lg-6 mb-3">
                     <div class="card shadow-sm h-100">
                         <div class="card-header d-flex justify-content-between align-items-center">
-                            <h5 class="mb-0"><i class="fas fa-clipboard-check me-2"></i>Run History</h5>
+                            <h5 class="mb-0"><i class="bi bi-clipboard-check me-2"></i>Run History</h5>
                             <small class="text-muted">Keep last 10 success + last 10 errors</small>
                         </div>
                         <div class="card-body">
@@ -365,7 +365,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-lg-6 mb-3">
                     <div class="card shadow-sm h-100">
                         <div class="card-header">
-                            <h5 class="mb-0"><i class="fas fa-lightbulb me-2"></i>Detection Results</h5>
+                            <h5 class="mb-0"><i class="bi bi-lightbulb me-2"></i>Detection Results</h5>
                         </div>
                         <div class="card-body" id="plugin-detection-results">
                             <div class="text-muted">Run detection to see proposals.</div>
@@ -380,7 +380,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-12">
                     <div class="card shadow-sm">
                         <div class="card-header d-flex justify-content-between align-items-center flex-wrap gap-2">
-                            <h5 class="mb-0"><i class="fas fa-list me-2"></i>Job Queue</h5>
+                            <h5 class="mb-0"><i class="bi bi-list me-2"></i>Job Queue</h5>
                             <div class="d-flex gap-2 align-items-center flex-wrap">
                                 <small class="text-muted">States: pending/assigned/running</small>
                             </div>
@@ -415,7 +415,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-12">
                     <div class="card shadow-sm">
                         <div class="card-header d-flex justify-content-between align-items-center flex-wrap gap-2">
-                            <h5 class="mb-0"><i class="fas fa-search me-2"></i>Detection Jobs</h5>
+                            <h5 class="mb-0"><i class="bi bi-search me-2"></i>Detection Jobs</h5>
                             <div class="small text-muted">Detection activities for selected job type</div>
                         </div>
                         <div class="card-body p-0">
@@ -448,7 +448,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-12">
                     <div class="card shadow-sm">
                         <div class="card-header d-flex justify-content-between align-items-center flex-wrap gap-2">
-                            <h5 class="mb-0"><i class="fas fa-tasks me-2"></i>Execution Jobs</h5>
+                            <h5 class="mb-0"><i class="bi bi-list-check me-2"></i>Execution Jobs</h5>
                             <div class="d-flex gap-2 align-items-center flex-wrap">
                                 <select class="form-select form-select-sm" id="plugin-monitor-job-state-filter" style="min-width: 180px;">
                                     <option value="">All States</option>
@@ -488,7 +488,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 <div class="col-12">
                     <div class="card shadow-sm">
                         <div class="card-header d-flex justify-content-between align-items-center flex-wrap gap-2">
-                            <h5 class="mb-0"><i class="fas fa-stream me-2"></i>Execution Activities</h5>
+                            <h5 class="mb-0"><i class="bi bi-list-nested me-2"></i>Execution Activities</h5>
                             <small class="text-muted">Non-detection events only</small>
                         </div>
                         <div class="card-body p-0">
@@ -520,10 +520,10 @@ templ Plugin(page string, initialJob string, lane string) {
         <div class="modal-dialog modal-xl modal-dialog-scrollable">
             <div class="modal-content">
                 <div class="modal-header">
-                    <h5 class="modal-title" id="plugin-job-detail-modal-label"><i class="fas fa-file-alt me-2"></i>Job Detail</h5>
+                    <h5 class="modal-title" id="plugin-job-detail-modal-label"><i class="bi bi-file-earmark-text me-2"></i>Job Detail</h5>
                     <div class="ms-auto me-2">
                         <button type="button" class="btn btn-outline-danger btn-sm" id="plugin-expire-job-btn" disabled>
-                            <i class="fas fa-stop-circle me-1"></i>Expire Job
+                            <i class="bi bi-stop-circle me-1"></i>Expire Job
                         </button>
                     </div>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
@@ -889,7 +889,7 @@ templ Plugin(page string, initialJob string, lane string) {
                 var html = '' +
                     '<li class="nav-item">' +
                     '<button type="button" class="nav-link" data-plugin-top-tab="overview">' +
-                    '<i class="fas fa-chart-line me-1"></i>Overview' +
+                    '<i class="bi bi-graph-up-arrow me-1"></i>Overview' +
                     '</button>' +
                     '</li>';
 
diff --git a/weed/admin/view/app/plugin_lane.templ b/weed/admin/view/app/plugin_lane.templ
index bc0ef00394..18583e5cfc 100644
--- a/weed/admin/view/app/plugin_lane.templ
+++ b/weed/admin/view/app/plugin_lane.templ
@@ -1,5 +1,9 @@
 package app
 
+import (
+    "github.com/seaweedfs/seaweedfs/weed/admin/dash"
+)
+
 templ PluginLane(page string, lane string) {
     {{
         currentPage := page
@@ -12,15 +16,15 @@ templ PluginLane(page string, lane string) {
             <div class="col-12">
                 <div class="d-flex justify-content-between align-items-center flex-wrap gap-2">
                     <div>
-                        <h2 class="mb-0"><i class="fas fa-layer-group me-2"></i>{ lane } Lane Workers</h2>
+                        <h2 class="mb-0"><i class="bi bi-layers me-2"></i>{ lane } Lane Workers</h2>
                         <p class="text-muted mb-0">Workers and scheduler status for the { lane } scheduling lane.</p>
                     </div>
                     <div class="btn-group">
-                        <a href="/plugin" class="btn btn-outline-secondary">
-                            <i class="fas fa-arrow-left me-1"></i>All Workers
+                        <a href={ dash.PUrl(ctx, "/plugin") } class="btn btn-outline-secondary">
+                            <i class="bi bi-arrow-left me-1"></i>All Workers
                         </a>
                         <button type="button" class="btn btn-outline-secondary" id="plugin-lane-refresh-btn">
-                            <i class="fas fa-sync-alt me-1"></i>Refresh
+                            <i class="bi bi-arrow-repeat me-1"></i>Refresh
                         </button>
                     </div>
                 </div>
@@ -31,11 +35,11 @@ templ PluginLane(page string, lane string) {
             <div class="col-12">
                 <div class="card">
                     <div class="card-header">
-                        <h5 class="card-title mb-0"><i class="fas fa-server me-2"></i>Lane Scheduler Status</h5>
+                        <h5 class="card-title mb-0"><i class="bi bi-server me-2"></i>Lane Scheduler Status</h5>
                     </div>
                     <div class="card-body" id="plugin-lane-scheduler-status">
                         <div class="text-center text-muted py-3">
-                            <i class="fas fa-spinner fa-spin me-1"></i>Loading scheduler status...
+                            <i class="bi bi-arrow-repeat icon-spin me-1"></i>Loading scheduler status...
                         </div>
                     </div>
                 </div>
@@ -46,11 +50,11 @@ templ PluginLane(page string, lane string) {
             <div class="col-12">
                 <div class="card">
                     <div class="card-header">
-                        <h5 class="card-title mb-0"><i class="fas fa-tasks me-2"></i>Job Types</h5>
+                        <h5 class="card-title mb-0"><i class="bi bi-list-check me-2"></i>Job Types</h5>
                     </div>
                     <div class="card-body" id="plugin-lane-job-types">
                         <div class="text-center text-muted py-3">
-                            <i class="fas fa-spinner fa-spin me-1"></i>Loading job types...
+                            <i class="bi bi-arrow-repeat icon-spin me-1"></i>Loading job types...
                         </div>
                     </div>
                 </div>
@@ -61,11 +65,11 @@ templ PluginLane(page string, lane string) {
             <div class="col-12">
                 <div class="card">
                     <div class="card-header">
-                        <h5 class="card-title mb-0"><i class="fas fa-plug me-2"></i>Connected Workers</h5>
+                        <h5 class="card-title mb-0"><i class="bi bi-plug me-2"></i>Connected Workers</h5>
                     </div>
                     <div class="card-body" id="plugin-lane-workers">
                         <div class="text-center text-muted py-3">
-                            <i class="fas fa-spinner fa-spin me-1"></i>Loading workers...
+                            <i class="bi bi-arrow-repeat icon-spin me-1"></i>Loading workers...
                         </div>
                     </div>
                 </div>
diff --git a/weed/admin/view/app/plugin_lane_templ.go b/weed/admin/view/app/plugin_lane_templ.go
index a33f198e12..5cb5d0a388 100644
--- a/weed/admin/view/app/plugin_lane_templ.go
+++ b/weed/admin/view/app/plugin_lane_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -8,6 +8,10 @@ package app
 import "github.com/a-h/templ"
 import templruntime "github.com/a-h/templ/runtime"
 
+import (
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+)
+
 func PluginLane(page string, lane string) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
@@ -38,11 +42,11 @@ func PluginLane(page string, lane string) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var2 string
-		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(currentPage)
+		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue(currentPage)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 10, Col: 85}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 14, Col: 85}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -51,22 +55,22 @@ func PluginLane(page string, lane string) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var3 string
-		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(lane)
+		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(lane)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 10, Col: 111}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 14, Col: 111}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"d-flex justify-content-between align-items-center flex-wrap gap-2\"><div><h2 class=\"mb-0\"><i class=\"fas fa-layer-group me-2\"></i>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"d-flex justify-content-between align-items-center flex-wrap gap-2\"><div><h2 class=\"mb-0\"><i class=\"bi bi-layers me-2\"></i>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var4 string
 		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(lane)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 15, Col: 86}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 19, Col: 80}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 		if templ_7745c5c3_Err != nil {
@@ -79,13 +83,26 @@ func PluginLane(page string, lane string) templ.Component {
 		var templ_7745c5c3_Var5 string
 		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(lane)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 16, Col: 94}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 20, Col: 94}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, " scheduling lane.</p></div><div class=\"btn-group\"><a href=\"/plugin\" class=\"btn btn-outline-secondary\"><i class=\"fas fa-arrow-left me-1\"></i>All Workers</a> <button type=\"button\" class=\"btn btn-outline-secondary\" id=\"plugin-lane-refresh-btn\"><i class=\"fas fa-sync-alt me-1\"></i>Refresh</button></div></div></div></div><div class=\"row mb-3\"><div class=\"col-12\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"fas fa-server me-2\"></i>Lane Scheduler Status</h5></div><div class=\"card-body\" id=\"plugin-lane-scheduler-status\"><div class=\"text-center text-muted py-3\"><i class=\"fas fa-spinner fa-spin me-1\"></i>Loading scheduler status...</div></div></div></div></div><div class=\"row mb-3\"><div class=\"col-12\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"fas fa-tasks me-2\"></i>Job Types</h5></div><div class=\"card-body\" id=\"plugin-lane-job-types\"><div class=\"text-center text-muted py-3\"><i class=\"fas fa-spinner fa-spin me-1\"></i>Loading job types...</div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"fas fa-plug me-2\"></i>Connected Workers</h5></div><div class=\"card-body\" id=\"plugin-lane-workers\"><div class=\"text-center text-muted py-3\"><i class=\"fas fa-spinner fa-spin me-1\"></i>Loading workers...</div></div></div></div></div></div><script>\n    (function() {\n        const page = document.getElementById('plugin-lane-page');\n        if (!page) return;\n        const lane = page.dataset.pluginLane || '';\n        if (!lane) return;\n\n        function basePath(path) {\n            return (window.__BASE_PATH__ || '') + path;\n        }\n\n        function fetchAndRender(url, containerId, renderFn) {\n            fetch(basePath(url))\n                .then(r => r.json())\n                .then(data => {\n                    const el = document.getElementById(containerId);\n                    if (el) el.innerHTML = renderFn(data);\n                })\n                .catch(err => {\n                    const el = document.getElementById(containerId);\n                    if (el) el.innerHTML = '<div class=\"alert alert-danger\">Failed to load: ' + err.message + '</div>';\n                });\n        }\n\n        function renderSchedulerStatus(data) {\n            if (!data || !data.scheduler) return '<div class=\"text-muted\">No scheduler data</div>';\n            const s = data.scheduler;\n            let html = '<div class=\"row\">';\n            html += '<div class=\"col-md-3\"><strong>Phase:</strong> ' + (s.current_phase || 'idle') + '</div>';\n            html += '<div class=\"col-md-3\"><strong>Idle Sleep:</strong> ' + (s.idle_sleep_seconds || 0) + 's</div>';\n            html += '<div class=\"col-md-3\"><strong>Current Job Type:</strong> ' + (s.current_job_type || '-') + '</div>';\n            html += '<div class=\"col-md-3\"><strong>Next Detection:</strong> ' + (s.next_detection_at ? new Date(s.next_detection_at).toLocaleTimeString() : '-') + '</div>';\n            html += '</div>';\n            if (s.job_types && s.job_types.length > 0) {\n                html += '<hr><table class=\"table table-sm table-hover mb-0\"><thead><tr><th>Job Type</th><th>Enabled</th><th>Interval</th><th>In Flight</th><th>Next Detection</th></tr></thead><tbody>';\n                s.job_types.forEach(jt => {\n                    html += '<tr>';\n                    html += '<td>' + jt.job_type + '</td>';\n                    html += '<td>' + (jt.enabled ? '<span class=\"badge bg-success\">Yes</span>' : '<span class=\"badge bg-secondary\">No</span>') + '</td>';\n                    html += '<td>' + (jt.detection_interval_minutes || '-') + 'm</td>';\n                    html += '<td>' + (jt.detection_in_flight ? '<span class=\"badge bg-warning\">Yes</span>' : 'No') + '</td>';\n                    html += '<td>' + (jt.next_detection_at ? new Date(jt.next_detection_at).toLocaleTimeString() : '-') + '</td>';\n                    html += '</tr>';\n                });\n                html += '</tbody></table>';\n            }\n            return html;\n        }\n\n        function renderJobTypes(data) {\n            if (!data || data.length === 0) return '<div class=\"text-muted\">No job types in this lane</div>';\n            const filtered = data.filter(s => s.lane === lane);\n            if (filtered.length === 0) return '<div class=\"text-muted\">No job types in this lane</div>';\n            let html = '<table class=\"table table-sm table-hover mb-0\"><thead><tr><th>Job Type</th><th>Enabled</th><th>Concurrency</th><th>Detection Interval</th><th>Status</th></tr></thead><tbody>';\n            filtered.forEach(s => {\n                html += '<tr>';\n                html += '<td><a href=\"' + basePath('/plugin/configuration?job=' + s.job_type) + '\">' + s.job_type + '</a></td>';\n                html += '<td>' + (s.enabled ? '<span class=\"badge bg-success\">Yes</span>' : '<span class=\"badge bg-secondary\">No</span>') + '</td>';\n                html += '<td>' + (s.global_execution_concurrency || 1) + '</td>';\n                html += '<td>' + (s.detection_interval_minutes || '-') + 'm</td>';\n                html += '<td>' + (s.last_run_status || '-') + '</td>';\n                html += '</tr>';\n            });\n            html += '</tbody></table>';\n            return html;\n        }\n\n        function renderWorkers(data) {\n            if (!data || data.length === 0) return '<div class=\"text-muted\">No workers connected for this lane</div>';\n            let html = '<table class=\"table table-sm table-hover mb-0\"><thead><tr><th>Worker ID</th><th>Address</th><th>Job Types</th><th>Connected</th><th>Last Seen</th></tr></thead><tbody>';\n            data.forEach(w => {\n                const jobTypes = Object.keys(w.Capabilities || {}).join(', ');\n                html += '<tr>';\n                html += '<td>' + (w.WorkerID || '-') + '</td>';\n                html += '<td>' + (w.Address || '-') + '</td>';\n                html += '<td>' + jobTypes + '</td>';\n                html += '<td>' + (w.ConnectedAt ? new Date(w.ConnectedAt).toLocaleString() : '-') + '</td>';\n                html += '<td>' + (w.LastSeenAt ? new Date(w.LastSeenAt).toLocaleString() : '-') + '</td>';\n                html += '</tr>';\n            });\n            html += '</tbody></table>';\n            return html;\n        }\n\n        function refresh() {\n            fetchAndRender('/api/plugin/scheduler-status?lane=' + lane, 'plugin-lane-scheduler-status', renderSchedulerStatus);\n            fetchAndRender('/api/plugin/scheduler-states?lane=' + lane, 'plugin-lane-job-types', renderJobTypes);\n            fetchAndRender('/api/plugin/workers?lane=' + lane, 'plugin-lane-workers', renderWorkers);\n        }\n\n        refresh();\n        const btn = document.getElementById('plugin-lane-refresh-btn');\n        if (btn) btn.addEventListener('click', refresh);\n    })();\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, " scheduling lane.</p></div><div class=\"btn-group\"><a href=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var6 templ.SafeURL
+		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/plugin"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin_lane.templ`, Line: 23, Col: 59}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "\" class=\"btn btn-outline-secondary\"><i class=\"bi bi-arrow-left me-1\"></i>All Workers</a> <button type=\"button\" class=\"btn btn-outline-secondary\" id=\"plugin-lane-refresh-btn\"><i class=\"bi bi-arrow-repeat me-1\"></i>Refresh</button></div></div></div></div><div class=\"row mb-3\"><div class=\"col-12\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"bi bi-server me-2\"></i>Lane Scheduler Status</h5></div><div class=\"card-body\" id=\"plugin-lane-scheduler-status\"><div class=\"text-center text-muted py-3\"><i class=\"bi bi-arrow-repeat icon-spin me-1\"></i>Loading scheduler status...</div></div></div></div></div><div class=\"row mb-3\"><div class=\"col-12\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"bi bi-list-check me-2\"></i>Job Types</h5></div><div class=\"card-body\" id=\"plugin-lane-job-types\"><div class=\"text-center text-muted py-3\"><i class=\"bi bi-arrow-repeat icon-spin me-1\"></i>Loading job types...</div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card\"><div class=\"card-header\"><h5 class=\"card-title mb-0\"><i class=\"bi bi-plug me-2\"></i>Connected Workers</h5></div><div class=\"card-body\" id=\"plugin-lane-workers\"><div class=\"text-center text-muted py-3\"><i class=\"bi bi-arrow-repeat icon-spin me-1\"></i>Loading workers...</div></div></div></div></div></div><script>\n    (function() {\n        const page = document.getElementById('plugin-lane-page');\n        if (!page) return;\n        const lane = page.dataset.pluginLane || '';\n        if (!lane) return;\n\n        function basePath(path) {\n            return (window.__BASE_PATH__ || '') + path;\n        }\n\n        function fetchAndRender(url, containerId, renderFn) {\n            fetch(basePath(url))\n                .then(r => r.json())\n                .then(data => {\n                    const el = document.getElementById(containerId);\n                    if (el) el.innerHTML = renderFn(data);\n                })\n                .catch(err => {\n                    const el = document.getElementById(containerId);\n                    if (el) el.innerHTML = '<div class=\"alert alert-danger\">Failed to load: ' + err.message + '</div>';\n                });\n        }\n\n        function renderSchedulerStatus(data) {\n            if (!data || !data.scheduler) return '<div class=\"text-muted\">No scheduler data</div>';\n            const s = data.scheduler;\n            let html = '<div class=\"row\">';\n            html += '<div class=\"col-md-3\"><strong>Phase:</strong> ' + (s.current_phase || 'idle') + '</div>';\n            html += '<div class=\"col-md-3\"><strong>Idle Sleep:</strong> ' + (s.idle_sleep_seconds || 0) + 's</div>';\n            html += '<div class=\"col-md-3\"><strong>Current Job Type:</strong> ' + (s.current_job_type || '-') + '</div>';\n            html += '<div class=\"col-md-3\"><strong>Next Detection:</strong> ' + (s.next_detection_at ? new Date(s.next_detection_at).toLocaleTimeString() : '-') + '</div>';\n            html += '</div>';\n            if (s.job_types && s.job_types.length > 0) {\n                html += '<hr><table class=\"table table-sm table-hover mb-0\"><thead><tr><th>Job Type</th><th>Enabled</th><th>Interval</th><th>In Flight</th><th>Next Detection</th></tr></thead><tbody>';\n                s.job_types.forEach(jt => {\n                    html += '<tr>';\n                    html += '<td>' + jt.job_type + '</td>';\n                    html += '<td>' + (jt.enabled ? '<span class=\"badge bg-success\">Yes</span>' : '<span class=\"badge bg-secondary\">No</span>') + '</td>';\n                    html += '<td>' + (jt.detection_interval_minutes || '-') + 'm</td>';\n                    html += '<td>' + (jt.detection_in_flight ? '<span class=\"badge bg-warning\">Yes</span>' : 'No') + '</td>';\n                    html += '<td>' + (jt.next_detection_at ? new Date(jt.next_detection_at).toLocaleTimeString() : '-') + '</td>';\n                    html += '</tr>';\n                });\n                html += '</tbody></table>';\n            }\n            return html;\n        }\n\n        function renderJobTypes(data) {\n            if (!data || data.length === 0) return '<div class=\"text-muted\">No job types in this lane</div>';\n            const filtered = data.filter(s => s.lane === lane);\n            if (filtered.length === 0) return '<div class=\"text-muted\">No job types in this lane</div>';\n            let html = '<table class=\"table table-sm table-hover mb-0\"><thead><tr><th>Job Type</th><th>Enabled</th><th>Concurrency</th><th>Detection Interval</th><th>Status</th></tr></thead><tbody>';\n            filtered.forEach(s => {\n                html += '<tr>';\n                html += '<td><a href=\"' + basePath('/plugin/configuration?job=' + s.job_type) + '\">' + s.job_type + '</a></td>';\n                html += '<td>' + (s.enabled ? '<span class=\"badge bg-success\">Yes</span>' : '<span class=\"badge bg-secondary\">No</span>') + '</td>';\n                html += '<td>' + (s.global_execution_concurrency || 1) + '</td>';\n                html += '<td>' + (s.detection_interval_minutes || '-') + 'm</td>';\n                html += '<td>' + (s.last_run_status || '-') + '</td>';\n                html += '</tr>';\n            });\n            html += '</tbody></table>';\n            return html;\n        }\n\n        function renderWorkers(data) {\n            if (!data || data.length === 0) return '<div class=\"text-muted\">No workers connected for this lane</div>';\n            let html = '<table class=\"table table-sm table-hover mb-0\"><thead><tr><th>Worker ID</th><th>Address</th><th>Job Types</th><th>Connected</th><th>Last Seen</th></tr></thead><tbody>';\n            data.forEach(w => {\n                const jobTypes = Object.keys(w.Capabilities || {}).join(', ');\n                html += '<tr>';\n                html += '<td>' + (w.WorkerID || '-') + '</td>';\n                html += '<td>' + (w.Address || '-') + '</td>';\n                html += '<td>' + jobTypes + '</td>';\n                html += '<td>' + (w.ConnectedAt ? new Date(w.ConnectedAt).toLocaleString() : '-') + '</td>';\n                html += '<td>' + (w.LastSeenAt ? new Date(w.LastSeenAt).toLocaleString() : '-') + '</td>';\n                html += '</tr>';\n            });\n            html += '</tbody></table>';\n            return html;\n        }\n\n        function refresh() {\n            fetchAndRender('/api/plugin/scheduler-status?lane=' + lane, 'plugin-lane-scheduler-status', renderSchedulerStatus);\n            fetchAndRender('/api/plugin/scheduler-states?lane=' + lane, 'plugin-lane-job-types', renderJobTypes);\n            fetchAndRender('/api/plugin/workers?lane=' + lane, 'plugin-lane-workers', renderWorkers);\n        }\n\n        refresh();\n        const btn = document.getElementById('plugin-lane-refresh-btn');\n        if (btn) btn.addEventListener('click', refresh);\n    })();\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/plugin_templ.go b/weed/admin/view/app/plugin_templ.go
index 735da58d05..e6110ad062 100644
--- a/weed/admin/view/app/plugin_templ.go
+++ b/weed/admin/view/app/plugin_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -44,11 +44,11 @@ func Plugin(page string, initialJob string, lane string) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var2 string
-		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(currentPage)
+		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue(currentPage)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin.templ`, Line: 16, Col: 80}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -57,11 +57,11 @@ func Plugin(page string, initialJob string, lane string) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var3 string
-		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(initialJob)
+		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(initialJob)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin.templ`, Line: 16, Col: 111}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -70,22 +70,22 @@ func Plugin(page string, initialJob string, lane string) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var4 string
-		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(currentLane)
+		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(currentLane)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin.templ`, Line: 16, Col: 144}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"d-flex justify-content-between align-items-center flex-wrap gap-2\"><div><h2 class=\"mb-0\"><i class=\"fas fa-plug me-2\"></i>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"d-flex justify-content-between align-items-center flex-wrap gap-2\"><div><h2 class=\"mb-0\"><i class=\"bi bi-plug me-2\"></i>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var5 string
 		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(laneTitle)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin.templ`, Line: 21, Col: 84}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/plugin.templ`, Line: 21, Col: 83}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 		if templ_7745c5c3_Err != nil {
@@ -104,7 +104,7 @@ func Plugin(page string, initialJob string, lane string) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</p></div><div class=\"btn-group\"><button type=\"button\" class=\"btn btn-outline-secondary\" id=\"plugin-refresh-all-btn\"><i class=\"fas fa-sync-alt me-1\"></i>Refresh</button></div></div></div></div><div class=\"row mb-3\"><div class=\"col-12\"><ul class=\"nav nav-tabs\" id=\"plugin-top-tabs\"><li class=\"nav-item\"><button type=\"button\" class=\"nav-link active\" data-plugin-top-tab=\"overview\"><i class=\"fas fa-chart-line me-1\"></i>Overview</button></li></ul></div></div><div class=\"row mb-3 d-none\" id=\"plugin-subtab-row\"><div class=\"col-12\"><ul class=\"nav nav-pills gap-2\" id=\"plugin-subtabs\"><li class=\"nav-item\"><button type=\"button\" class=\"nav-link active\" data-plugin-subtab=\"configuration\"><i class=\"fas fa-sliders-h me-1\"></i>Configuration</button></li><li class=\"nav-item\"><button type=\"button\" class=\"nav-link\" data-plugin-subtab=\"detection\"><i class=\"fas fa-search me-1\"></i>Job Detection</button></li><li class=\"nav-item\"><button type=\"button\" class=\"nav-link\" data-plugin-subtab=\"queue\"><i class=\"fas fa-list me-1\"></i>Job Queue</button></li><li class=\"nav-item\"><button type=\"button\" class=\"nav-link\" data-plugin-subtab=\"execution\"><i class=\"fas fa-tasks me-1\"></i>Job Execution</button></li></ul></div></div><div class=\"plugin-section plugin-section-overview\"><div class=\"row mb-4\"><div class=\"col-md-3 mb-3\"><div class=\"card border-info h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Workers</div><h4 class=\"mb-0\" id=\"plugin-status-workers\">0</h4></div></div></div><div class=\"col-md-3 mb-3\"><div class=\"card border-warning h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Active Jobs</div><h4 class=\"mb-0\" id=\"plugin-status-active-jobs\">0</h4></div></div></div><div class=\"col-md-3 mb-3\"><div class=\"card border-success h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Activities (recent)</div><h4 class=\"mb-0\" id=\"plugin-status-activities\">0</h4></div></div></div><div class=\"col-md-3 mb-3\"><div class=\"card border-secondary h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Next Run</div><h4 class=\"mb-0 plugin-scheduler-next-run\">-</h4><div class=\"text-muted small plugin-scheduler-next-run-meta\"></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"fas fa-chart-bar me-2\"></i>Per Job Type Summary</h5></div><div class=\"card-body p-0\"><div class=\"table-responsive\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light\"><tr><th>Job Type</th><th>Active Jobs</th><th>Recent Activities</th></tr></thead> <tbody id=\"plugin-jobtype-summary-body\"><tr><td colspan=\"3\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"fas fa-clock me-2\"></i>Scheduler State</h5><small class=\"text-muted\">Sequential scheduler with per-job runtime limits</small></div><div class=\"card-body p-0\"><div class=\"table-responsive\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light\"><tr><th>Job Type</th><th>Enabled</th><th>Detector</th><th>In Flight</th><th>Max Runtime</th><th>Exec Global</th><th>Exec/Worker</th><th>Executor Workers</th><th>Effective Exec</th><th>Last Run</th></tr></thead> <tbody id=\"plugin-scheduler-table-body\"><tr><td colspan=\"10\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"fas fa-users me-2\"></i>Workers</h5></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 560px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Worker</th><th>Address</th><th>Capabilities</th><th>Load</th></tr></thead> <tbody id=\"plugin-workers-table-body\"><tr><td colspan=\"4\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div><div class=\"plugin-section plugin-section-configuration\"><div class=\"row mb-4\"><div class=\"col-lg-8 mb-3\"><div class=\"card shadow-sm h-100\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"fas fa-sliders-h me-2\"></i>Job Type Configuration</h5><small class=\"text-muted\" id=\"plugin-config-updated-at\">Not loaded</small></div><div class=\"card-body\"><div class=\"mb-3\"><div class=\"small text-muted\">Selected Job Type</div><div class=\"fw-semibold\" id=\"plugin-selected-job-type\">-</div></div><div class=\"mb-3\"><div class=\"d-flex justify-content-between align-items-center mb-2\"><h6 class=\"mb-0\">Descriptor</h6><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"plugin-refresh-schema-btn\"><i class=\"fas fa-cloud-download-alt me-1\"></i>Refresh Schema</button></div><div class=\"alert alert-light border\" id=\"plugin-descriptor-summary\">Select a job type to load schema and config.</div></div><div class=\"mb-3\"><h6>Admin Config Form</h6><div id=\"plugin-admin-config-form\" class=\"plugin-form-root\"><div class=\"text-muted\">No admin form loaded.</div></div></div><div class=\"mb-3\"><h6>Worker Config Form</h6><div id=\"plugin-worker-config-form\" class=\"plugin-form-root\"><div class=\"text-muted\">No worker form loaded.</div></div></div><div class=\"d-flex flex-wrap gap-2\"><button type=\"button\" class=\"btn btn-primary\" id=\"plugin-save-config-btn\"><i class=\"fas fa-save me-1\"></i>Save Config</button> <button type=\"button\" class=\"btn btn-outline-primary\" id=\"plugin-trigger-detection-btn\"><i class=\"fas fa-search me-1\"></i>Run Detection</button> <button type=\"button\" class=\"btn btn-outline-success\" id=\"plugin-run-workflow-btn\"><i class=\"fas fa-play me-1\"></i>Run Detect + Execute</button></div></div></div></div><div class=\"col-lg-4 mb-3\"><div class=\"card shadow-sm\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"fas fa-cogs me-2\"></i>Job Scheduling Settings</h5></div><div class=\"card-body\"><div class=\"row g-2\" id=\"plugin-admin-settings-form\"><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-enabled\">Enabled</label><div class=\"form-check form-switch mt-1\"><input class=\"form-check-input\" type=\"checkbox\" id=\"plugin-admin-enabled\"></div></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-detection-interval\">Detection Interval (min)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-detection-interval\" min=\"0\"><div class=\"form-text\">How often to check for new work.</div></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-detection-timeout\">Detection Timeout (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-detection-timeout\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-execution-timeout\">Execution Timeout (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-execution-timeout\" min=\"0\"><div class=\"form-text\">Per-attempt deadline for one job. Size-aware tasks may extend this automatically.</div></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-max-runtime\">Job Type Max Runtime (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-max-runtime\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-max-results\">Max Jobs / Detection</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-max-results\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-global-exec\">Global Execution Concurrency</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-global-exec\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-per-worker-exec\">Per Worker Concurrency</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-per-worker-exec\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-retry-limit\">Retry Limit</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-retry-limit\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-retry-backoff\">Retry Backoff (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-retry-backoff\" min=\"0\"></div></div></div></div><div class=\"card shadow-sm mt-3\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"fas fa-hourglass-half me-2\"></i>Next Run</h5><small class=\"text-muted\">Scheduler</small></div><div class=\"card-body\"><div class=\"h5 mb-1 plugin-scheduler-next-run\">-</div><div class=\"text-muted small plugin-scheduler-next-run-meta\">Not scheduled</div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-lg-6 mb-3\"><div class=\"card shadow-sm h-100\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"fas fa-clipboard-check me-2\"></i>Run History</h5><small class=\"text-muted\">Keep last 10 success + last 10 errors</small></div><div class=\"card-body\"><div class=\"row\"><div class=\"col-12 mb-3\"><h6 class=\"text-success\">Successful Runs</h6><div class=\"table-responsive\"><table class=\"table table-sm table-striped\"><thead><tr><th>Time</th><th>Job ID</th><th>Worker</th><th>Duration</th></tr></thead> <tbody id=\"plugin-runs-success-body\"><tr><td colspan=\"4\" class=\"text-muted\">No data</td></tr></tbody></table></div></div><div class=\"col-12\"><h6 class=\"text-danger\">Error Runs</h6><div class=\"table-responsive\"><table class=\"table table-sm table-striped\"><thead><tr><th>Time</th><th>Job ID</th><th>Worker</th><th>Error</th></tr></thead> <tbody id=\"plugin-runs-error-body\"><tr><td colspan=\"4\" class=\"text-muted\">No data</td></tr></tbody></table></div></div></div></div></div></div><div class=\"col-lg-6 mb-3\"><div class=\"card shadow-sm h-100\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"fas fa-lightbulb me-2\"></i>Detection Results</h5></div><div class=\"card-body\" id=\"plugin-detection-results\"><div class=\"text-muted\">Run detection to see proposals.</div></div></div></div></div></div><div class=\"plugin-section plugin-section-queue\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"fas fa-list me-2\"></i>Job Queue</h5><div class=\"d-flex gap-2 align-items-center flex-wrap\"><small class=\"text-muted\">States: pending/assigned/running</small></div></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 560px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Job ID</th><th>Type</th><th>State</th><th>Progress</th><th>Worker</th><th>Updated</th><th>Message</th></tr></thead> <tbody id=\"plugin-queue-jobs-table-body\"><tr><td colspan=\"7\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div><div class=\"plugin-section plugin-section-detection\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"fas fa-search me-2\"></i>Detection Jobs</h5><div class=\"small text-muted\">Detection activities for selected job type</div></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 420px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Time</th><th>Job Type</th><th>Request ID</th><th>Worker</th><th>Stage</th><th>Source</th><th>Message</th></tr></thead> <tbody id=\"plugin-detection-table-body\"><tr><td colspan=\"7\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div><div class=\"plugin-section plugin-section-execution\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"fas fa-tasks me-2\"></i>Execution Jobs</h5><div class=\"d-flex gap-2 align-items-center flex-wrap\"><select class=\"form-select form-select-sm\" id=\"plugin-monitor-job-state-filter\" style=\"min-width: 180px;\"><option value=\"\">All States</option> <option value=\"assigned\">Assigned</option> <option value=\"running\">Running</option> <option value=\"succeeded\">Succeeded</option> <option value=\"failed\">Failed</option> <option value=\"canceled\">Canceled</option></select></div></div><div class=\"card-body p-0\"><div class=\"table-responsive\"><table class=\"table table-hover mb-0\"><thead class=\"table-light\"><tr><th>Job ID</th><th>Type</th><th>State</th><th>Progress</th><th>Worker</th><th>Updated</th><th>Message</th></tr></thead> <tbody id=\"plugin-execution-jobs-table-body\"><tr><td colspan=\"7\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"fas fa-stream me-2\"></i>Execution Activities</h5><small class=\"text-muted\">Non-detection events only</small></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 420px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Time</th><th>Job Type</th><th>Job ID</th><th>Source</th><th>Stage</th><th>Message</th></tr></thead> <tbody id=\"plugin-execution-activities-table-body\"><tr><td colspan=\"6\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div></div><div class=\"modal fade\" id=\"plugin-job-detail-modal\" tabindex=\"-1\" aria-labelledby=\"plugin-job-detail-modal-label\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl modal-dialog-scrollable\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"plugin-job-detail-modal-label\"><i class=\"fas fa-file-alt me-2\"></i>Job Detail</h5><div class=\"ms-auto me-2\"><button type=\"button\" class=\"btn btn-outline-danger btn-sm\" id=\"plugin-expire-job-btn\" disabled><i class=\"fas fa-stop-circle me-1\"></i>Expire Job</button></div><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\" id=\"plugin-job-detail-content\"><div class=\"text-muted\">Select a job to view details.</div></div></div></div></div><style>\n        .plugin-section {\n            display: none;\n        }\n\n        .plugin-section.plugin-section-active {\n            display: block;\n        }\n\n        .plugin-form-root .card {\n            border: 1px solid #dee2e6;\n        }\n        .plugin-form-root textarea {\n            min-height: 12rem;\n        }\n\n        .plugin-field-hidden {\n            display: none;\n        }\n\n        .plugin-capability-badge {\n            font-size: 0.72rem;\n            margin-right: 0.25rem;\n        }\n\n        .plugin-job-progress {\n            min-width: 120px;\n        }\n\n        .plugin-detection-item {\n            border: 1px solid #dee2e6;\n            border-radius: 6px;\n            padding: 0.5rem 0.75rem;\n            margin-bottom: 0.5rem;\n            background: #fbfcfd;\n        }\n\n        .plugin-job-link {\n            text-decoration: none;\n        }\n\n        .plugin-job-detail-json {\n            max-height: 220px;\n            overflow: auto;\n            background: #f8f9fa;\n            border: 1px solid #dee2e6;\n            border-radius: 6px;\n            padding: 0.5rem;\n            margin-bottom: 0;\n            font-size: 0.82rem;\n        }\n        </style><script>\n        (function() {\n            var page = document.getElementById('plugin-page');\n            if (!page) {\n                return;\n            }\n\n            var pluginLane = String(page.getAttribute('data-plugin-lane') || '').trim();\n\n            function basePath(path) {\n                return (window.__BASE_PATH__ || '') + path;\n            }\n\n            var state = {\n                selectedJobType: '',\n                jobTypes: [],\n                lastDetectionByJobType: {},\n                initialPage: String(page.getAttribute('data-plugin-page') || 'overview').trim().toLowerCase(),\n                initialJob: String(page.getAttribute('data-plugin-job') || '').trim(),\n                activeTopTab: 'overview',\n                activeSubTab: 'configuration',\n                initialNavigationApplied: false,\n                monitorExecutionJobState: '',\n                workers: [],\n                jobs: [],\n                activities: [],\n                schedulerStates: [],\n                schedulerStatus: null,\n                allJobs: [],\n                allActivities: [],\n                loadedJobType: '',\n                descriptor: null,\n                config: null,\n                refreshTimer: null,\n            };\n\n            // appendLaneParam appends ?lane= or &lane= to a URL if a lane filter is active.\n            function appendLaneParam(url) {\n                if (!pluginLane) return url;\n                var sep = url.indexOf('?') === -1 ? '?' : '&';\n                return url + sep + 'lane=' + encodeURIComponent(pluginLane);\n            }\n\n            function getCSRFToken() {\n                var meta = document.querySelector('meta[name=\"csrf-token\"]');\n                if (!meta) {\n                    return '';\n                }\n                return meta.getAttribute('content') || '';\n            }\n\n            function notify(message, level) {\n                if (typeof window.showAlert === 'function') {\n                    window.showAlert(message, level || 'info');\n                    return;\n                }\n                if (level === 'error') {\n                    console.error(message);\n                }\n                alert(message);\n            }\n\n            async function readResponseJSON(response) {\n                var bodyText = await response.text();\n                if (!bodyText) {\n                    return {};\n                }\n                try {\n                    return JSON.parse(bodyText);\n                } catch (e) {\n                    return { error: bodyText };\n                }\n            }\n\n            async function pluginRequest(method, url, payload) {\n                var headers = {};\n                var requestOptions = {\n                    method: method,\n                    headers: headers,\n                };\n\n                if (payload !== undefined && payload !== null) {\n                    headers['Content-Type'] = 'application/json';\n                    requestOptions.body = JSON.stringify(payload);\n                }\n\n                if (method !== 'GET') {\n                    var csrf = getCSRFToken();\n                    if (csrf) {\n                        headers['X-CSRF-Token'] = csrf;\n                    }\n                }\n\n                var response = await fetch(basePath(url), requestOptions);\n                var data = await readResponseJSON(response);\n                if (!response.ok) {\n                    var message = (data && (data.error || data.message)) ? (data.error || data.message) : ('Request failed: ' + response.status);\n                    var requestError = new Error(message);\n                    requestError.responseData = data;\n                    requestError.responseStatus = response.status;\n                    throw requestError;\n                }\n                return data;\n            }\n\n            function textOrDash(value) {\n                if (value === null || value === undefined || value === '') {\n                    return '-';\n                }\n                return String(value);\n            }\n\n            function escapeHtml(value) {\n                if (value === null || value === undefined) {\n                    return '';\n                }\n                return String(value)\n                    .replace(/&/g, '&amp;')\n                    .replace(/</g, '&lt;')\n                    .replace(/>/g, '&gt;')\n                    .replace(/\"/g, '&quot;')\n                    .replace(/'/g, '&#039;');\n            }\n\n            function encodePath(value) {\n                return encodeURIComponent(value || '');\n            }\n\n            function normalizeEnum(value) {\n                if (value === undefined || value === null) {\n                    return '';\n                }\n                return String(value).toUpperCase();\n            }\n\n            function parseTime(value) {\n                if (!value) {\n                    return '';\n                }\n                var date = new Date(value);\n                if (Number.isNaN(date.getTime())) {\n                    return '';\n                }\n                return date.toLocaleString();\n            }\n\n            function normalizeSubTab(value) {\n                var normalized = String(value || '').toLowerCase();\n                if (normalized === 'configuration' || normalized === 'detection' || normalized === 'queue' || normalized === 'execution') {\n                    return normalized;\n                }\n                return 'configuration';\n            }\n\n            function buildPluginURL(topTab, subTab, jobType) {\n                var laneName = pluginLane || 'default';\n                var laneBase = '/plugin/lanes/' + encodeURIComponent(laneName);\n                if (topTab === 'overview') {\n                    return laneBase;\n                }\n                var effectiveSubTab = normalizeSubTab(subTab);\n                var path = laneBase + '/' + encodeURIComponent(effectiveSubTab);\n                var jt = String(jobType || '').trim();\n                if (jt) {\n                    path += '?job=' + encodeURIComponent(jt);\n                }\n                return path;\n            }\n\n            function updateURL(replace) {\n                var url = basePath(buildPluginURL(state.activeTopTab, state.activeSubTab, state.selectedJobType));\n                if (replace) {\n                    history.replaceState({ pluginTopTab: state.activeTopTab, pluginSubTab: state.activeSubTab, pluginJob: state.selectedJobType }, '', url);\n                } else {\n                    history.pushState({ pluginTopTab: state.activeTopTab, pluginSubTab: state.activeSubTab, pluginJob: state.selectedJobType }, '', url);\n                }\n            }\n\n            // Parse a job type item (string or object) into a safe object shape\n            function parseJobTypeItem(item) {\n                var jobType = '';\n                var displayName = '';\n                \n                if (typeof item === 'string') {\n                    jobType = String(item || '').trim();\n                    displayName = jobType;\n                } else if (item && typeof item === 'object') {\n                    jobType = String(item.job_type || item.jobType || '').trim();\n                    displayName = String(item.display_name || item.displayName || jobType || '').trim();\n                    if (!displayName) {\n                        displayName = jobType;\n                    }\n                }\n                \n                return { jobType: jobType, displayName: displayName };\n            }\n\n            function topTabKeyForJobType(jobType) {\n                var normalized = String(jobType || '').trim();\n                if (!normalized) {\n                    return '';\n                }\n                return 'job:' + normalized;\n            }\n\n            function parseJobTypeFromTopTab(tabKey) {\n                var normalized = String(tabKey || '').trim();\n                if (normalized.indexOf('job:') !== 0) {\n                    return '';\n                }\n                return normalized.slice(4);\n            }\n\n            function hasJobType(jobType) {\n                var normalized = String(jobType || '').trim();\n                if (!normalized) {\n                    return false;\n                }\n                var jobTypes = Array.isArray(state.jobTypes) ? state.jobTypes : [];\n                for (var i = 0; i < jobTypes.length; i++) {\n                    var item = parseJobTypeItem(jobTypes[i]);\n                    if (item.jobType === normalized) {\n                        return true;\n                    }\n                }\n                return false;\n            }\n\n            function applyInitialNavigation() {\n                if (state.initialNavigationApplied) {\n                    return;\n                }\n                state.initialNavigationApplied = true;\n                state.activeSubTab = normalizeSubTab(state.initialPage);\n\n                if (state.initialPage === 'overview') {\n                    state.activeTopTab = 'overview';\n                    return;\n                }\n                if (!Array.isArray(state.jobTypes) || state.jobTypes.length === 0) {\n                    state.activeTopTab = 'overview';\n                    return;\n                }\n                // If a specific job type was provided in the URL, use it\n                if (state.initialJob && hasJobType(state.initialJob)) {\n                    state.selectedJobType = state.initialJob;\n                } else {\n                    var firstItem = parseJobTypeItem(state.jobTypes[0]);\n                    state.selectedJobType = firstItem.jobType;\n                }\n                state.activeTopTab = topTabKeyForJobType(state.selectedJobType);\n            }\n\n            function ensureActiveNavigation() {\n                state.activeSubTab = normalizeSubTab(state.activeSubTab);\n\n                if (state.selectedJobType && !hasJobType(state.selectedJobType)) {\n                    state.selectedJobType = '';\n                    state.descriptor = null;\n                    state.config = null;\n                }\n\n                var topTabJobType = parseJobTypeFromTopTab(state.activeTopTab);\n                if (topTabJobType && !hasJobType(topTabJobType)) {\n                    state.activeTopTab = 'overview';\n                    topTabJobType = '';\n                }\n\n                if (state.activeTopTab === 'overview') {\n                    if (!state.selectedJobType && Array.isArray(state.jobTypes) && state.jobTypes.length > 0) {\n                        var item = parseJobTypeItem(state.jobTypes[0]);\n                        state.selectedJobType = item.jobType;\n                    }\n                    return;\n                }\n\n                if (!topTabJobType && state.selectedJobType) {\n                    topTabJobType = state.selectedJobType;\n                }\n                if (!topTabJobType && Array.isArray(state.jobTypes) && state.jobTypes.length > 0) {\n                    var item = parseJobTypeItem(state.jobTypes[0]);\n                    topTabJobType = item.jobType;\n                }\n                if (!topTabJobType) {\n                    state.activeTopTab = 'overview';\n                    return;\n                }\n\n                state.selectedJobType = topTabJobType;\n                state.activeTopTab = topTabKeyForJobType(topTabJobType);\n            }\n\n            function renderTopTabs() {\n                var root = document.getElementById('plugin-top-tabs');\n                if (!root) {\n                    return;\n                }\n\n                var html = '' +\n                    '<li class=\"nav-item\">' +\n                    '<button type=\"button\" class=\"nav-link\" data-plugin-top-tab=\"overview\">' +\n                    '<i class=\"fas fa-chart-line me-1\"></i>Overview' +\n                    '</button>' +\n                    '</li>';\n\n                var jobTypes = Array.isArray(state.jobTypes) ? state.jobTypes : [];\n                for (var i = 0; i < jobTypes.length; i++) {\n                    var item = parseJobTypeItem(jobTypes[i]);\n                    var jobType = item.jobType;\n                    var displayName = item.displayName;\n                    \n                    if (!jobType) {\n                        continue;\n                    }\n                    html += '' +\n                        '<li class=\"nav-item\">' +\n                        '<button type=\"button\" class=\"nav-link\" data-plugin-top-tab=\"' + escapeHtml(topTabKeyForJobType(jobType)) + '\">' +\n                        escapeHtml(displayName) +\n                        '</button>' +\n                        '</li>';\n                }\n                root.innerHTML = html;\n            }\n\n            function renderNavigationState() {\n                var selectedJobTypeLabel = document.getElementById('plugin-selected-job-type');\n                if (selectedJobTypeLabel) {\n                    selectedJobTypeLabel.textContent = state.selectedJobType || '-';\n                }\n\n                var isOverview = state.activeTopTab === 'overview';\n                var subtabRow = document.getElementById('plugin-subtab-row');\n                if (subtabRow) {\n                    subtabRow.classList.toggle('d-none', isOverview);\n                }\n\n                var topTabs = document.querySelectorAll('#plugin-top-tabs [data-plugin-top-tab]');\n                for (var i = 0; i < topTabs.length; i++) {\n                    var topTab = topTabs[i];\n                    var topKey = String(topTab.getAttribute('data-plugin-top-tab') || '');\n                    topTab.classList.toggle('active', topKey === state.activeTopTab);\n                }\n\n                var subTabs = document.querySelectorAll('#plugin-subtabs [data-plugin-subtab]');\n                for (var j = 0; j < subTabs.length; j++) {\n                    var subTab = subTabs[j];\n                    var subKey = String(subTab.getAttribute('data-plugin-subtab') || '');\n                    subTab.classList.toggle('active', !isOverview && subKey === state.activeSubTab);\n                }\n\n                function toggleSection(sectionName, visible) {\n                    var section = document.querySelector('.plugin-section-' + sectionName);\n                    if (!section) {\n                        return;\n                    }\n                    section.classList.toggle('plugin-section-active', !!visible);\n                }\n\n                toggleSection('overview', isOverview);\n                toggleSection('configuration', !isOverview && state.activeSubTab === 'configuration');\n                toggleSection('detection', !isOverview && state.activeSubTab === 'detection');\n                toggleSection('queue', !isOverview && state.activeSubTab === 'queue');\n                toggleSection('execution', !isOverview && state.activeSubTab === 'execution');\n            }\n\n            function renderJobLink(jobID) {\n                var normalized = String(jobID || '').trim();\n                if (!normalized) {\n                    return '<small>-</small>';\n                }\n                return '<button type=\"button\" class=\"btn btn-link btn-sm p-0 align-baseline plugin-job-link\" data-job-id=\"' + escapeHtml(normalized) + '\">' + escapeHtml(normalized) + '</button>';\n            }\n\n            function toPrettyJson(value) {\n                if (value === null || value === undefined || value === '') {\n                    return '';\n                }\n                if (typeof value === 'string') {\n                    return value;\n                }\n                try {\n                    return JSON.stringify(value, null, 2);\n                } catch (e) {\n                    return String(value);\n                }\n            }\n\n            function clonePlainObject(value) {\n                if (!value || typeof value !== 'object') {\n                    return null;\n                }\n                try {\n                    return JSON.parse(JSON.stringify(value));\n                } catch (e) {\n                    return null;\n                }\n            }\n\n            function extractExecutionPlan(job) {\n                if (!job || !job.parameters) {\n                    return null;\n                }\n                var plan = job.parameters.execution_plan;\n                if (!plan) {\n                    return null;\n                }\n                if (typeof plan === 'string') {\n                    try {\n                        plan = JSON.parse(plan);\n                    } catch (e) {\n                        return null;\n                    }\n                }\n                if (typeof plan !== 'object' || Array.isArray(plan)) {\n                    return null;\n                }\n                return plan;\n            }\n\n            function removeExecutionPlanForDisplay(parameters) {\n                var copy = clonePlainObject(parameters);\n                if (!copy) {\n                    return parameters;\n                }\n                if (copy.execution_plan !== undefined) {\n                    delete copy.execution_plan;\n                }\n                if (Object.keys(copy).length === 0) {\n                    return null;\n                }\n                return copy;\n            }\n\n            function parseIntOrDefault(value, fallback) {\n                var parsed = parseInt(value, 10);\n                if (Number.isNaN(parsed)) {\n                    return fallback;\n                }\n                return parsed;\n            }\n\n            function normalizeShardIDs(value) {\n                if (!Array.isArray(value)) {\n                    return [];\n                }\n                var out = [];\n                for (var i = 0; i < value.length; i++) {\n                    var parsed = parseIntOrDefault(value[i], -1);\n                    if (parsed >= 0) {\n                        out.push(parsed);\n                    }\n                }\n                out.sort(function(a, b) { return a - b; });\n                return out;\n            }\n\n            function classifyShardLabel(shardID, dataShardCount) {\n                if (shardID < dataShardCount) {\n                    return {\n                        kind: 'data',\n                        label: String(shardID),\n                        className: 'bg-primary',\n                        title: 'Data shard ' + shardID,\n                    };\n                }\n                var parityIndex = shardID - dataShardCount;\n                return {\n                    kind: 'parity',\n                    label: String(shardID),\n                    className: 'bg-warning text-dark',\n                    title: 'Parity shard ' + shardID + ' (index ' + parityIndex + ')',\n                };\n            }\n\n            function renderShardBadges(shardIDs, dataShardCount) {\n                if (!Array.isArray(shardIDs) || shardIDs.length === 0) {\n                    return '<span class=\"text-muted\">-</span>';\n                }\n                var html = '';\n                for (var i = 0; i < shardIDs.length; i++) {\n                    var shard = classifyShardLabel(shardIDs[i], dataShardCount);\n                    html += '<span class=\"badge me-1 ' + shard.className + '\" title=\"' + escapeHtml(shard.title) + '\">' + escapeHtml(shard.label) + '</span>';\n                }\n                return html;\n            }\n\n            function renderExecutionPlan(plan) {\n                if (!plan || typeof plan !== 'object') {\n                    return '';\n                }\n\n                var jobType = String(plan.job_type || '').trim().toLowerCase();\n                if (jobType === 'volume_balance') {\n                    return renderBalanceExecutionPlan(plan);\n                }\n                if (jobType !== 'erasure_coding') {\n                    var fallbackText = toPrettyJson(plan);\n                    if (!fallbackText) {\n                        return '';\n                    }\n                    return '<div class=\"mb-3\"><h6>Execution Plan</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(fallbackText) + '</pre></div>';\n                }\n\n                var dataShards = parseIntOrDefault(plan.data_shards, 10);\n                var parityShards = parseIntOrDefault(plan.parity_shards, 4);\n                var totalShards = parseIntOrDefault(plan.total_shards, dataShards + parityShards);\n                var sources = Array.isArray(plan.sources) ? plan.sources : [];\n                var targets = Array.isArray(plan.targets) ? plan.targets : [];\n                var assignments = Array.isArray(plan.shard_assignments) ? plan.shard_assignments : [];\n\n                var html = '';\n                html += '<div class=\"mb-3\"><h6>Execution Plan</h6>';\n                html += '<div class=\"row g-2 mb-2\">' +\n                    '<div class=\"col-md-3\"><small><strong>Volume:</strong> ' + escapeHtml(textOrDash(plan.volume_id)) + '</small></div>' +\n                    '<div class=\"col-md-3\"><small><strong>Collection:</strong> ' + escapeHtml(textOrDash(plan.collection)) + '</small></div>' +\n                    '<div class=\"col-md-3\"><small><strong>Shards:</strong> ' + escapeHtml(String(dataShards)) + '+' + escapeHtml(String(parityShards)) + '</small></div>' +\n                    '<div class=\"col-md-3\"><small><strong>Total:</strong> ' + escapeHtml(String(totalShards)) + '</small></div>' +\n                    '</div>';\n\n                html += '<div class=\"small text-muted mb-2\">' +\n                    '<span class=\"badge bg-primary me-1\">Data</span>' +\n                    '<span class=\"badge bg-warning text-dark me-2\">Parity</span>' +\n                    'Source and target placement per shard.' +\n                    '</div>';\n\n                function renderEndpointsTable(title, endpoints) {\n                    if (!endpoints.length) {\n                        return '<div class=\"mb-2\"><strong>' + escapeHtml(title) + ':</strong> <span class=\"text-muted\">none</span></div>';\n                    }\n                    var table = '<div class=\"table-responsive mb-2\"><table class=\"table table-sm table-striped mb-0\">' +\n                        '<thead><tr><th>#</th><th>Node</th><th>DC</th><th>Rack</th><th>Volume</th><th>Shards</th></tr></thead><tbody>';\n                    for (var i = 0; i < endpoints.length; i++) {\n                        var endpoint = endpoints[i] || {};\n                        var endpointShards = normalizeShardIDs(endpoint.shard_ids);\n                        table += '<tr>' +\n                            '<td>' + escapeHtml(String(i + 1)) + '</td>' +\n                            '<td><code>' + escapeHtml(textOrDash(endpoint.node)) + '</code></td>' +\n                            '<td>' + escapeHtml(textOrDash(endpoint.data_center)) + '</td>' +\n                            '<td>' + escapeHtml(textOrDash(endpoint.rack)) + '</td>' +\n                            '<td>' + escapeHtml(textOrDash(endpoint.volume_id)) + '</td>' +\n                            '<td>' + renderShardBadges(endpointShards, dataShards) + '</td>' +\n                            '</tr>';\n                    }\n                    table += '</tbody></table></div>';\n                    return '<div class=\"mb-2\"><strong>' + escapeHtml(title) + '</strong></div>' + table;\n                }\n\n                html += renderEndpointsTable('Sources', sources);\n                html += renderEndpointsTable('Targets', targets);\n\n                if (assignments.length) {\n                    html += '<div class=\"mb-2\"><strong>Shard Assignments</strong></div>';\n                    html += '<div class=\"table-responsive\"><table class=\"table table-sm table-striped mb-0\">' +\n                        '<thead><tr><th>Shard</th><th>Kind</th><th>Target</th><th>DC</th><th>Rack</th></tr></thead><tbody>';\n                    for (var j = 0; j < assignments.length; j++) {\n                        var assignment = assignments[j] || {};\n                        var shardID = parseIntOrDefault(assignment.shard_id, -1);\n                        if (shardID < 0) {\n                            continue;\n                        }\n                        var shard = classifyShardLabel(shardID, dataShards);\n                        html += '<tr>' +\n                            '<td><span class=\"badge ' + shard.className + '\">' + escapeHtml(shard.label) + '</span></td>' +\n                            '<td>' + escapeHtml(textOrDash(assignment.kind || shard.kind)) + '</td>' +\n                            '<td><code>' + escapeHtml(textOrDash(assignment.target_node)) + '</code></td>' +\n                            '<td>' + escapeHtml(textOrDash(assignment.target_data_center)) + '</td>' +\n                            '<td>' + escapeHtml(textOrDash(assignment.target_rack)) + '</td>' +\n                            '</tr>';\n                    }\n                    html += '</tbody></table></div>';\n                }\n\n                html += '</div>';\n                return html;\n            }\n\n            function renderBalanceExecutionPlan(plan) {\n                var html = '<div class=\"mb-3\"><h6>Execution Plan</h6>';\n                var moves = Array.isArray(plan.moves) ? plan.moves : [];\n\n                if (moves.length === 0) {\n                    // Single-move balance job\n                    var src = textOrDash(plan.source_node || plan.source_server);\n                    var dst = textOrDash(plan.target_node || plan.target_server);\n                    var vid = textOrDash(plan.volume_id);\n                    var col = textOrDash(plan.collection);\n                    html += `<div class=\"row g-2 mb-2\">\n                        <div class=\"col-md-3\"><small><strong>Volume:</strong> ${escapeHtml(vid)}</small></div>\n                        <div class=\"col-md-3\"><small><strong>Collection:</strong> ${escapeHtml(col)}</small></div>\n                        <div class=\"col-md-3\"><small><strong>Source:</strong> <code>${escapeHtml(src)}</code></small></div>\n                        <div class=\"col-md-3\"><small><strong>Target:</strong> <code>${escapeHtml(dst)}</code></small></div>\n                        </div>`;\n                } else {\n                    // Batch balance job\n                    html += '<div class=\"mb-2\"><span class=\"badge bg-info\">' + escapeHtml(String(moves.length)) + ' moves</span></div>';\n                    html += '<div class=\"table-responsive\"><table class=\"table table-sm table-striped mb-0\">' +\n                        '<thead><tr><th>#</th><th>Volume</th><th>Source</th><th>Target</th><th>Collection</th></tr></thead><tbody>';\n                    for (var i = 0; i < moves.length; i++) {\n                        var move = moves[i] || {};\n                        html += `<tr>\n                            <td>${escapeHtml(String(i + 1))}</td>\n                            <td>${escapeHtml(textOrDash(move.volume_id))}</td>\n                            <td><code>${escapeHtml(textOrDash(move.source_node))}</code></td>\n                            <td><code>${escapeHtml(textOrDash(move.target_node))}</code></td>\n                            <td>${escapeHtml(textOrDash(move.collection))}</td>\n                        </tr>`;\n                    }\n                    html += '</tbody></table></div>';\n                }\n\n                html += '</div>';\n                return html;\n            }\n\n            function isActiveJobState(candidateState) {\n                var jobState = candidateState;\n                if (candidateState && typeof candidateState === 'object' && candidateState.state !== undefined) {\n                    jobState = candidateState.state;\n                }\n                var st = String(jobState || '').toLowerCase();\n                return st === 'job_state_pending' || st === 'job_state_assigned' || st === 'job_state_running' ||\n                    st === 'pending' || st === 'assigned' || st === 'running' || st === 'in_progress';\n            }\n\n            function setExpireButtonState(job) {\n                var expireBtn = document.getElementById('plugin-expire-job-btn');\n                if (!expireBtn) {\n                    return;\n                }\n                var jobID = job && job.job_id ? String(job.job_id) : '';\n                var active = isActiveJobState(job);\n                expireBtn.setAttribute('data-job-id', jobID);\n                expireBtn.disabled = !jobID || !active;\n                if (!jobID) {\n                    expireBtn.title = 'Select a job to expire.';\n                } else if (!active) {\n                    expireBtn.title = 'Job is not active.';\n                } else {\n                    expireBtn.title = 'Expire job to unblock scheduling.';\n                }\n            }\n\n            async function expireJob(jobID) {\n                var normalizedJobID = String(jobID || '').trim();\n                if (!normalizedJobID) {\n                    return;\n                }\n\n                var reason = window.prompt('Expire job ' + normalizedJobID + '? Optional reason:', 'job expired by admin request');\n                if (reason === null) {\n                    return;\n                }\n\n                var expireBtn = document.getElementById('plugin-expire-job-btn');\n                if (expireBtn) {\n                    expireBtn.disabled = true;\n                }\n\n                try {\n                    var response = await pluginRequest('POST', '/api/plugin/jobs/' + encodePath(normalizedJobID) + '/expire', {\n                        reason: reason,\n                    });\n                    if (response && response.expired === false) {\n                        notify(response.message || 'Job is not active.', 'info');\n                    } else {\n                        notify('Job expired: ' + normalizedJobID, 'success');\n                    }\n                    await refreshJobsAndActivities();\n                    await openJobDetail(normalizedJobID);\n                } catch (e) {\n                    notify('Failed to expire job: ' + e.message, 'error');\n                }\n            }\n\n            async function openJobDetail(jobID) {\n                var normalizedJobID = String(jobID || '').trim();\n                if (!normalizedJobID) {\n                    return;\n                }\n\n                var modalElement = document.getElementById('plugin-job-detail-modal');\n                var contentRoot = document.getElementById('plugin-job-detail-content');\n                if (!modalElement || !contentRoot) {\n                    return;\n                }\n\n                var modal;\n                if (window.bootstrap && window.bootstrap.Modal) {\n                    modal = window.bootstrap.Modal.getOrCreateInstance(modalElement);\n                }\n                if (modal) {\n                    modal.show();\n                }\n\n                setExpireButtonState(null);\n                contentRoot.innerHTML = '<div class=\"text-muted\">Loading job detail...</div>';\n                try {\n                    var detail = await pluginRequest('GET', '/api/plugin/jobs/' + encodePath(normalizedJobID) + '/detail?activity_limit=500&related_limit=20');\n                    var job = (detail && detail.job) ? detail.job : {};\n                    setExpireButtonState(job);\n                    var runRecord = detail && detail.run_record ? detail.run_record : null;\n                    var activities = (detail && Array.isArray(detail.activities)) ? detail.activities : [];\n                    var relatedJobs = (detail && Array.isArray(detail.related_jobs)) ? detail.related_jobs : [];\n                    var html = '';\n\n                    html += '<div class=\"row g-3 mb-3\">' +\n                        '<div class=\"col-lg-8\">' +\n                        '<div><strong>Job ID:</strong> ' + escapeHtml(textOrDash(job.job_id || normalizedJobID)) + '</div>' +\n                        '<div><strong>Type:</strong> ' + escapeHtml(textOrDash(job.job_type)) + '</div>' +\n                        '<div><strong>State:</strong> ' + escapeHtml(textOrDash(job.state)) + '</div>' +\n                        '<div><strong>Worker:</strong> ' + escapeHtml(textOrDash(job.worker_id)) + '</div>' +\n                        '<div><strong>Updated:</strong> ' + escapeHtml(parseTime(job.updated_at) || '-') + '</div>' +\n                        '</div>' +\n                        '<div class=\"col-lg-4\">' +\n                        '<div><strong>Attempt:</strong> ' + escapeHtml(textOrDash(job.attempt)) + '</div>' +\n                        '<div><strong>Progress:</strong> ' + escapeHtml(String(Math.round(Number(job.progress || 0)))) + '%</div>' +\n                        '<div><strong>Created:</strong> ' + escapeHtml(parseTime(job.created_at) || '-') + '</div>' +\n                        '<div><strong>Completed:</strong> ' + escapeHtml(parseTime(job.completed_at) || '-') + '</div>' +\n                        '</div>' +\n                        '</div>';\n\n                    if (job.summary) {\n                        html += '<div class=\"mb-2\"><strong>Summary:</strong> ' + escapeHtml(String(job.summary)) + '</div>';\n                    }\n                    if (job.detail) {\n                        html += '<div class=\"mb-2\"><strong>Detail:</strong> ' + escapeHtml(String(job.detail)) + '</div>';\n                    }\n                    if (job.message) {\n                        html += '<div class=\"mb-2\"><strong>Message:</strong> ' + escapeHtml(String(job.message)) + '</div>';\n                    }\n                    if (job.error_message) {\n                        html += '<div class=\"mb-2 text-danger\"><strong>Error:</strong> ' + escapeHtml(String(job.error_message)) + '</div>';\n                    }\n                    if (job.result_summary) {\n                        html += '<div class=\"mb-2\"><strong>Result:</strong> ' + escapeHtml(String(job.result_summary)) + '</div>';\n                    }\n\n                    var executionPlan = extractExecutionPlan(job);\n                    if (executionPlan) {\n                        html += renderExecutionPlan(executionPlan);\n                    }\n\n                    var parametersText = toPrettyJson(removeExecutionPlanForDisplay(job.parameters));\n                    if (parametersText) {\n                        html += '<div class=\"mb-3\"><h6>Parameters</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(parametersText) + '</pre></div>';\n                    }\n                    var labelsText = toPrettyJson(job.labels);\n                    if (labelsText) {\n                        html += '<div class=\"mb-3\"><h6>Labels</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(labelsText) + '</pre></div>';\n                    }\n                    var outputsText = toPrettyJson(job.result_output_values);\n                    if (outputsText) {\n                        html += '<div class=\"mb-3\"><h6>Result Output Values</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(outputsText) + '</pre></div>';\n                    }\n\n                    if (runRecord) {\n                        html += '<div class=\"mb-3\"><h6>Run Record</h6>' +\n                            '<div><strong>Outcome:</strong> ' + escapeHtml(textOrDash(runRecord.outcome)) + '</div>' +\n                            '<div><strong>Duration:</strong> ' + escapeHtml(formatDurationMs(runRecord.duration_ms)) + '</div>' +\n                            '<div><strong>Completed:</strong> ' + escapeHtml(parseTime(runRecord.completed_at) || '-') + '</div>' +\n                            '<div><strong>Message:</strong> ' + escapeHtml(textOrDash(runRecord.message)) + '</div>' +\n                            '</div>';\n                    }\n\n                    html += '<h6 class=\"mt-3\">Activity Timeline</h6>';\n                    if (!activities.length) {\n                        html += '<div class=\"text-muted mb-3\">No activity records.</div>';\n                    } else {\n                        html += '<div class=\"table-responsive mb-3\"><table class=\"table table-sm table-striped\">' +\n                            '<thead><tr><th>Time</th><th>Stage</th><th>Source</th><th>Worker</th><th>Message</th></tr></thead><tbody>';\n                        for (var i = 0; i < activities.length; i++) {\n                            var activity = activities[i] || {};\n                            html += '<tr>' +\n                                '<td><small>' + escapeHtml(parseTime(activity.occurred_at) || '-') + '</small></td>' +\n                                '<td>' + escapeHtml(textOrDash(activity.stage)) + '</td>' +\n                                '<td>' + escapeHtml(textOrDash(activity.source)) + '</td>' +\n                                '<td>' + escapeHtml(textOrDash(activity.worker_id)) + '</td>' +\n                                '<td><small>' + escapeHtml(textOrDash(activity.message)) + '</small></td>' +\n                                '</tr>';\n                        }\n                        html += '</tbody></table></div>';\n                    }\n\n                    if (relatedJobs.length) {\n                        html += '<h6>Related Jobs</h6><div class=\"table-responsive\"><table class=\"table table-sm table-hover\">' +\n                            '<thead><tr><th>Job ID</th><th>State</th><th>Worker</th><th>Updated</th></tr></thead><tbody>';\n                        for (var j = 0; j < relatedJobs.length; j++) {\n                            var related = relatedJobs[j] || {};\n                            html += '<tr>' +\n                                '<td><small>' + escapeHtml(textOrDash(related.job_id)) + '</small></td>' +\n                                '<td>' + escapeHtml(textOrDash(related.state)) + '</td>' +\n                                '<td>' + escapeHtml(textOrDash(related.worker_id)) + '</td>' +\n                                '<td><small>' + escapeHtml(parseTime(related.updated_at) || '-') + '</small></td>' +\n                                '</tr>';\n                        }\n                        html += '</tbody></table></div>';\n                    }\n\n                    contentRoot.innerHTML = html;\n                } catch (e) {\n                    setExpireButtonState(null);\n                    contentRoot.innerHTML = '<div class=\"alert alert-danger mb-0\">Failed to load job detail: ' + escapeHtml(e.message) + '</div>';\n                }\n            }\n\n            function formatDurationMs(value) {\n                var ms = Number(value || 0);\n                if (!Number.isFinite(ms) || ms <= 0) {\n                    return '-';\n                }\n                if (ms < 1000) {\n                    return ms + 'ms';\n                }\n                var sec = Math.floor(ms / 1000);\n                var remainMs = ms % 1000;\n                if (sec < 60) {\n                    return sec + '.' + String(Math.floor(remainMs / 100)) + 's';\n                }\n                var min = Math.floor(sec / 60);\n                var remainSec = sec % 60;\n                return min + 'm ' + remainSec + 's';\n            }\n\n            function getWorkerField(worker, name) {\n                if (!worker) {\n                    return null;\n                }\n                if (worker[name] !== undefined) {\n                    return worker[name];\n                }\n                var camel = name.charAt(0).toUpperCase() + name.slice(1);\n                if (worker[camel] !== undefined) {\n                    return worker[camel];\n                }\n                return null;\n            }\n\n            function renderStatus() {\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n\n                var activeCount = allJobs.filter(function(job) {\n                    return isActiveJobState(job);\n                }).length;\n\n                document.getElementById('plugin-status-workers').textContent = String(state.workers.length);\n                document.getElementById('plugin-status-active-jobs').textContent = String(activeCount);\n                document.getElementById('plugin-status-activities').textContent = String(allActivities.length);\n            }\n\n            function renderJobTypeSummary() {\n                var tbody = document.getElementById('plugin-jobtype-summary-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var activeByType = {};\n                var activityByType = {};\n\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n\n                for (var i = 0; i < allJobs.length; i++) {\n                    var job = allJobs[i] || {};\n                    var jobType = String(job.job_type || '').trim();\n                    if (!jobType) {\n                        continue;\n                    }\n                    var isActive = isActiveJobState(job);\n                    if (!isActive) {\n                        continue;\n                    }\n                    if (!activeByType[jobType]) {\n                        activeByType[jobType] = 0;\n                    }\n                    activeByType[jobType]++;\n                }\n\n                for (var j = 0; j < allActivities.length; j++) {\n                    var activity = allActivities[j] || {};\n                    var activityJobType = String(activity.job_type || '').trim();\n                    if (!activityJobType) {\n                        continue;\n                    }\n                    if (!activityByType[activityJobType]) {\n                        activityByType[activityJobType] = 0;\n                    }\n                    activityByType[activityJobType]++;\n                }\n\n                var known = Array.isArray(state.jobTypes) ? state.jobTypes.slice() : [];\n                var seen = {};\n                var jobTypes = [];\n\n                for (var k = 0; k < known.length; k++) {\n                    var item = parseJobTypeItem(known[k]);\n                    var knownType = item && item.jobType ? String(item.jobType).trim() : '';\n                    if (!knownType || seen[knownType]) {\n                        continue;\n                    }\n                    seen[knownType] = true;\n                    jobTypes.push(knownType);\n                }\n\n                Object.keys(activeByType).forEach(function(jobType) {\n                    if (!seen[jobType]) {\n                        seen[jobType] = true;\n                        jobTypes.push(jobType);\n                    }\n                });\n                Object.keys(activityByType).forEach(function(jobType) {\n                    if (!seen[jobType]) {\n                        seen[jobType] = true;\n                        jobTypes.push(jobType);\n                    }\n                });\n\n                jobTypes.sort();\n\n                if (jobTypes.length === 0) {\n                    tbody.innerHTML = '<tr><td colspan=\\\"3\\\" class=\\\"text-muted text-center py-3\\\">No job types discovered</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var m = 0; m < jobTypes.length; m++) {\n                    var rowType = jobTypes[m];\n                    rows += '<tr>' +\n                        '<td>' + escapeHtml(rowType) + '</td>' +\n                        '<td><span class=\\\"badge bg-warning text-dark\\\">' + escapeHtml(String(activeByType[rowType] || 0)) + '</span></td>' +\n                        '<td><span class=\\\"badge bg-info\\\">' + escapeHtml(String(activityByType[rowType] || 0)) + '</span></td>' +\n                        '</tr>';\n                }\n                tbody.innerHTML = rows;\n            }\n\n            function computeEffectiveExecutionCapacity(globalExec, perWorkerExec, executorWorkers) {\n                var capacities = [];\n                if (globalExec > 0) {\n                    capacities.push(globalExec);\n                }\n                var workerCapacity = perWorkerExec > 0 && executorWorkers > 0 ? (perWorkerExec * executorWorkers) : 0;\n                if (workerCapacity > 0) {\n                    capacities.push(workerCapacity);\n                }\n                if (!capacities.length) {\n                    return 0;\n                }\n                var effective = capacities[0];\n                for (var i = 1; i < capacities.length; i++) {\n                    if (capacities[i] < effective) {\n                        effective = capacities[i];\n                    }\n                }\n                return effective;\n            }\n\n            function renderSchedulerStates() {\n                var tbody = document.getElementById('plugin-scheduler-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var states = Array.isArray(state.schedulerStates) ? state.schedulerStates : [];\n                if (!states.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"10\" class=\"text-muted text-center py-3\">No scheduler state available</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var i = 0; i < states.length; i++) {\n                    var item = states[i] || {};\n                    var enabled = !!item.enabled;\n                    var inFlight = !!item.detection_in_flight;\n                    var detector = item.detector_available ? textOrDash(item.detector_worker_id) : 'No detector';\n                    var maxRuntimeSeconds = Number(item.job_type_max_runtime_seconds || 0);\n                    var maxRuntimeText = maxRuntimeSeconds > 0 ? (String(maxRuntimeSeconds) + 's') : '-';\n                    var globalExec = Number(item.global_execution_concurrency || 0);\n                    var perWorkerExec = Number(item.per_worker_execution_concurrency || 0);\n                    var executorWorkers = Number(item.executor_worker_count || 0);\n                    var effectiveExec = computeEffectiveExecutionCapacity(globalExec, perWorkerExec, executorWorkers);\n                    var globalExecText = enabled ? String(globalExec) : '-';\n                    var perWorkerExecText = enabled ? String(perWorkerExec) : '-';\n                    var executorWorkersText = enabled ? String(executorWorkers) : '-';\n                    var effectiveExecText = enabled ? String(effectiveExec) : '-';\n                    var lastRunStatus = textOrDash(item.last_run_status);\n                    var lastRunTime = parseTime(item.last_run_completed_at);\n                    var lastRunText = '-';\n                    if (lastRunStatus !== '-' || lastRunTime) {\n                        var statusLabel = lastRunStatus !== '-' ? lastRunStatus : 'run';\n                        lastRunText = lastRunTime ? (statusLabel + ' @ ' + lastRunTime) : statusLabel;\n                    }\n\n                    var enabledBadge = enabled ? '<span class=\"badge bg-success\">Enabled</span>' : '<span class=\"badge bg-secondary\">Disabled</span>';\n                    var inFlightBadge = inFlight ? '<span class=\"badge bg-warning text-dark\">Yes</span>' : '<span class=\"badge bg-light text-dark\">No</span>';\n                    var policyErrorHtml = '';\n                    if (item.policy_error) {\n                        policyErrorHtml = '<div><small class=\"text-danger\">' + escapeHtml(String(item.policy_error)) + '</small></div>';\n                    }\n\n                    rows += '<tr>' +\n                        '<td>' + escapeHtml(textOrDash(item.job_type)) + policyErrorHtml + '</td>' +\n                        '<td>' + enabledBadge + '</td>' +\n                        '<td><small>' + escapeHtml(detector) + '</small></td>' +\n                        '<td>' + inFlightBadge + '</td>' +\n                        '<td><small>' + escapeHtml(maxRuntimeText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(globalExecText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(perWorkerExecText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(executorWorkersText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(effectiveExecText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(lastRunText) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderSchedulerStatus() {\n                var valueNodes = document.querySelectorAll('.plugin-scheduler-next-run');\n                if (!valueNodes.length) {\n                    return;\n                }\n                var metaNodes = document.querySelectorAll('.plugin-scheduler-next-run-meta');\n                var status = state.schedulerStatus || {};\n                var nextRun = parseTime(status.next_detection_at);\n                var display = nextRun || '-';\n                valueNodes.forEach(function(node) {\n                    node.textContent = display;\n                });\n                var metaText = nextRun ? 'Local time' : 'Not scheduled';\n                if (metaNodes.length) {\n                    metaNodes.forEach(function(node) {\n                        node.textContent = metaText;\n                    });\n                }\n            }\n\n            function renderWorkers() {\n                var tbody = document.getElementById('plugin-workers-table-body');\n                if (!state.workers.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"4\" class=\"text-muted text-center py-3\">No connected workers</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var i = 0; i < state.workers.length; i++) {\n                    var worker = state.workers[i];\n                    var workerID = textOrDash(getWorkerField(worker, 'workerID'));\n                    var address = textOrDash(getWorkerField(worker, 'address'));\n                    var caps = getWorkerField(worker, 'capabilities') || {};\n                    var capBadges = [];\n\n                    Object.keys(caps).sort().forEach(function(jobType) {\n                        var cap = caps[jobType] || {};\n                        var labels = [];\n                        if (cap.can_detect) {\n                            labels.push('D');\n                        }\n                        if (cap.can_execute) {\n                            labels.push('E');\n                        }\n                        var text = jobType;\n                        if (labels.length) {\n                            text += ' (' + labels.join('/') + ')';\n                        }\n                        capBadges.push('<span class=\"badge bg-secondary plugin-capability-badge\">' + escapeHtml(text) + '</span>');\n                    });\n\n                    if (!capBadges.length) {\n                        capBadges.push('<span class=\"text-muted\">-</span>');\n                    }\n\n                    var heartbeat = getWorkerField(worker, 'heartbeat') || {};\n                    var detUsed = Number(heartbeat.detection_slots_used || heartbeat.DetectionSlotsUsed || 0);\n                    var detTotal = Number(heartbeat.detection_slots_total || heartbeat.DetectionSlotsTotal || 0);\n                    var execUsed = Number(heartbeat.execution_slots_used || heartbeat.ExecutionSlotsUsed || 0);\n                    var execTotal = Number(heartbeat.execution_slots_total || heartbeat.ExecutionSlotsTotal || 0);\n                    var runningWork = heartbeat.running_work || heartbeat.RunningWork || [];\n                    var queuedByType = heartbeat.queued_jobs_by_type || heartbeat.QueuedJobsByType || {};\n                    var queuedTotal = 0;\n                    Object.keys(queuedByType || {}).forEach(function(jobType) {\n                        var queuedCount = Number(queuedByType[jobType] || 0);\n                        if (Number.isFinite(queuedCount) && queuedCount > 0) {\n                            queuedTotal += queuedCount;\n                        }\n                    });\n                    var loadLines = [];\n                    loadLines.push('Detect: ' + String(detUsed) + '/' + String(detTotal));\n                    loadLines.push('Execute: ' + String(execUsed) + '/' + String(execTotal));\n                    loadLines.push('Running: ' + String(Array.isArray(runningWork) ? runningWork.length : 0));\n                    loadLines.push('Queued: ' + String(queuedTotal));\n\n                    rows += '<tr>' +\n                        '<td><div class=\"fw-semibold\">' + escapeHtml(workerID) + '</div></td>' +\n                        '<td><small>' + escapeHtml(address) + '</small></td>' +\n                        '<td>' + capBadges.join('') + '</td>' +\n                        '<td><small>' + escapeHtml(loadLines.join(' | ')) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function normalizeJobStateForFilter(value) {\n                var normalized = String(value || '').toLowerCase();\n                if (normalized.indexOf('job_state_') === 0) {\n                    normalized = normalized.slice('job_state_'.length);\n                }\n                return normalized;\n            }\n\n            function matchesExecutionStateFilter(jobState, selectedFilter) {\n                var target = normalizeJobStateForFilter(selectedFilter);\n                if (!target) {\n                    return true;\n                }\n                var actual = normalizeJobStateForFilter(jobState);\n                if (actual === target) {\n                    return true;\n                }\n                if (target === 'running' && actual === 'in_progress') {\n                    return true;\n                }\n                return false;\n            }\n\n            function isDetectionActivitySource(source) {\n                var normalized = String(source || '').toLowerCase();\n                if (!normalized) {\n                    return false;\n                }\n                if (normalized === 'worker_detection') {\n                    return true;\n                }\n                return normalized.indexOf('detector') >= 0;\n            }\n\n            function renderExecutionJobs() {\n                var tbody = document.getElementById('plugin-execution-jobs-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredJobs = [];\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                for (var i = 0; i < allJobs.length; i++) {\n                    var job = allJobs[i] || {};\n                    var jobType = String(job.job_type || '').trim();\n                    if (state.selectedJobType && jobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    if (!matchesExecutionStateFilter(job.state, state.monitorExecutionJobState)) {\n                        continue;\n                    }\n                    filteredJobs.push(job);\n                }\n\n                if (!filteredJobs.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"7\" class=\"text-muted text-center py-3\">No execution jobs tracked yet</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredJobs.length; j++) {\n                    var executionJob = filteredJobs[j] || {};\n                    var progress = Number(executionJob.progress || 0);\n                    if (!Number.isFinite(progress) || progress < 0) {\n                        progress = 0;\n                    }\n                    if (progress > 100) {\n                        progress = 100;\n                    }\n\n                    var barClass = 'bg-info';\n                    var stateText = String(executionJob.state || 'unknown').toLowerCase();\n                    if (stateText.indexOf('failed') >= 0) {\n                        barClass = 'bg-danger';\n                    } else if (stateText.indexOf('succeed') >= 0 || stateText.indexOf('complete') >= 0) {\n                        barClass = 'bg-success';\n                    } else if (stateText.indexOf('run') >= 0 || stateText.indexOf('progress') >= 0) {\n                        barClass = 'bg-warning';\n                    }\n\n                    var jobTypeCell = escapeHtml(textOrDash(executionJob.job_type));\n                    var execLabels = executionJob.labels || {};\n                    if (execLabels.batch === 'true' && execLabels.batch_size) {\n                        jobTypeCell += ' <span class=\"badge bg-info\">' + escapeHtml(execLabels.batch_size) + ' moves</span>';\n                    }\n\n                    rows += '<tr>' +\n                        '<td>' + renderJobLink(executionJob.job_id) + '</td>' +\n                        '<td>' + jobTypeCell + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(executionJob.state)) + '</span></td>' +\n                        '<td class=\"plugin-job-progress\"><div class=\"progress\" style=\"height: 14px;\"><div class=\"progress-bar ' + barClass + '\" role=\"progressbar\" style=\"width:' + progress + '%\">' + Math.round(progress) + '%</div></div></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(executionJob.worker_id)) + '</small></td>' +\n                        '<td><small>' + escapeHtml(parseTime(executionJob.updated_at) || '-') + '</small></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(executionJob.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderQueueJobs() {\n                var tbody = document.getElementById('plugin-queue-jobs-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredJobs = [];\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                for (var i = 0; i < allJobs.length; i++) {\n                    var queueJob = allJobs[i] || {};\n                    var queueJobType = String(queueJob.job_type || '').trim();\n                    if (state.selectedJobType && queueJobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    var normalizedState = normalizeJobStateForFilter(queueJob.state);\n                    if (normalizedState !== 'pending' && normalizedState !== 'assigned' && normalizedState !== 'running' && normalizedState !== 'in_progress') {\n                        continue;\n                    }\n                    filteredJobs.push(queueJob);\n                }\n\n                if (!filteredJobs.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"7\" class=\"text-muted text-center py-3\">No queued/active jobs</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredJobs.length; j++) {\n                    var queueItem = filteredJobs[j] || {};\n                    var progress = Number(queueItem.progress || 0);\n                    if (!Number.isFinite(progress) || progress < 0) {\n                        progress = 0;\n                    }\n                    if (progress > 100) {\n                        progress = 100;\n                    }\n\n                    var barClass = 'bg-warning';\n                    var queueStateText = String(queueItem.state || 'unknown').toLowerCase();\n                    if (queueStateText.indexOf('run') >= 0 || queueStateText.indexOf('progress') >= 0) {\n                        barClass = 'bg-info';\n                    }\n\n                    rows += '<tr>' +\n                        '<td>' + renderJobLink(queueItem.job_id) + '</td>' +\n                        '<td>' + escapeHtml(textOrDash(queueItem.job_type)) + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(queueItem.state)) + '</span></td>' +\n                        '<td class=\"plugin-job-progress\"><div class=\"progress\" style=\"height: 14px;\"><div class=\"progress-bar ' + barClass + '\" role=\"progressbar\" style=\"width:' + progress + '%\">' + Math.round(progress) + '%</div></div></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(queueItem.worker_id)) + '</small></td>' +\n                        '<td><small>' + escapeHtml(parseTime(queueItem.updated_at) || '-') + '</small></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(queueItem.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderDetectionJobs() {\n                var tbody = document.getElementById('plugin-detection-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredActivities = [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n                for (var i = 0; i < allActivities.length; i++) {\n                    var activity = allActivities[i] || {};\n                    var jobType = String(activity.job_type || '').trim();\n                    if (state.selectedJobType && jobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    if (!isDetectionActivitySource(activity.source)) {\n                        continue;\n                    }\n                    filteredActivities.push(activity);\n                }\n\n                if (!filteredActivities.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"7\" class=\"text-muted text-center py-3\">No detection jobs tracked yet</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredActivities.length; j++) {\n                    var detectionActivity = filteredActivities[j] || {};\n                    rows += '<tr>' +\n                        '<td><small>' + escapeHtml(parseTime(detectionActivity.occurred_at) || '-') + '</small></td>' +\n                        '<td>' + escapeHtml(textOrDash(detectionActivity.job_type)) + '</td>' +\n                        '<td><small>' + escapeHtml(textOrDash(detectionActivity.request_id)) + '</small></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(detectionActivity.worker_id)) + '</small></td>' +\n                        '<td>' + escapeHtml(textOrDash(detectionActivity.stage)) + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(detectionActivity.source)) + '</span></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(detectionActivity.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderExecutionActivities() {\n                var tbody = document.getElementById('plugin-execution-activities-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredActivities = [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n                for (var i = 0; i < allActivities.length; i++) {\n                    var activity = allActivities[i] || {};\n                    if (isDetectionActivitySource(activity.source)) {\n                        continue;\n                    }\n                    var jobType = String(activity.job_type || '').trim();\n                    if (state.selectedJobType && jobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    filteredActivities.push(activity);\n                }\n\n                if (!filteredActivities.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"6\" class=\"text-muted text-center py-3\">No execution activities yet</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredActivities.length; j++) {\n                    var executionActivity = filteredActivities[j] || {};\n                    rows += '<tr>' +\n                        '<td><small>' + escapeHtml(parseTime(executionActivity.occurred_at) || '-') + '</small></td>' +\n                        '<td>' + escapeHtml(textOrDash(executionActivity.job_type)) + '</td>' +\n                        '<td>' + renderJobLink(executionActivity.job_id) + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(executionActivity.source)) + '</span></td>' +\n                        '<td>' + escapeHtml(textOrDash(executionActivity.stage)) + '</td>' +\n                        '<td><small>' + escapeHtml(textOrDash(executionActivity.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function getSelectValueArray(selectEl) {\n                if (!selectEl) {\n                    return [];\n                }\n                var values = [];\n                for (var i = 0; i < selectEl.options.length; i++) {\n                    if (selectEl.options[i].selected) {\n                        values.push(selectEl.options[i].value);\n                    }\n                }\n                return values;\n            }\n\n            function configValueToNative(configValue) {\n                if (!configValue || typeof configValue !== 'object') {\n                    return null;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'bool_value')) {\n                    return !!configValue.bool_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'int64_value')) {\n                    return configValue.int64_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'double_value')) {\n                    return configValue.double_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'string_value')) {\n                    return configValue.string_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'bytes_value')) {\n                    return configValue.bytes_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'duration_value')) {\n                    return configValue.duration_value;\n                }\n                if (configValue.string_list && Array.isArray(configValue.string_list.values)) {\n                    return configValue.string_list.values.slice();\n                }\n                if (configValue.int64_list && Array.isArray(configValue.int64_list.values)) {\n                    return configValue.int64_list.values.slice();\n                }\n                if (configValue.double_list && Array.isArray(configValue.double_list.values)) {\n                    return configValue.double_list.values.slice();\n                }\n                if (configValue.bool_list && Array.isArray(configValue.bool_list.values)) {\n                    return configValue.bool_list.values.slice();\n                }\n                if (configValue.list_value && Array.isArray(configValue.list_value.values)) {\n                    return configValue.list_value.values.map(function(v) {\n                        return configValueToNative(v);\n                    });\n                }\n                if (configValue.map_value && configValue.map_value.fields) {\n                    var out = {};\n                    Object.keys(configValue.map_value.fields).forEach(function(k) {\n                        out[k] = configValueToNative(configValue.map_value.fields[k]);\n                    });\n                    return out;\n                }\n                return null;\n            }\n\n            function inferConfigValue(value) {\n                if (value === null || value === undefined) {\n                    return { string_value: '' };\n                }\n                if (typeof value === 'boolean') {\n                    return { bool_value: value };\n                }\n                if (typeof value === 'number') {\n                    if (Number.isInteger(value)) {\n                        return { int64_value: String(value) };\n                    }\n                    return { double_value: value };\n                }\n                if (typeof value === 'string') {\n                    return { string_value: value };\n                }\n                if (Array.isArray(value)) {\n                    var listValues = value.map(function(item) {\n                        return inferConfigValue(item);\n                    });\n                    return { list_value: { values: listValues } };\n                }\n                if (typeof value === 'object') {\n                    var fields = {};\n                    Object.keys(value).forEach(function(key) {\n                        fields[key] = inferConfigValue(value[key]);\n                    });\n                    return { map_value: { fields: fields } };\n                }\n                return { string_value: String(value) };\n            }\n\n            function nativeToConfigValue(value, fieldType, widget, field) {\n                var normalizedFieldType = normalizeEnum(fieldType);\n                var normalizedWidget = normalizeEnum(widget);\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_BOOL') {\n                    return { bool_value: !!value };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_INT64') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    var intValue = parseInt(value, 10);\n                    if (Number.isNaN(intValue)) {\n                        throw new Error('Invalid int64 value for field ' + field.name);\n                    }\n                    return { int64_value: String(intValue) };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_DOUBLE') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    var doubleValue = parseFloat(value);\n                    if (Number.isNaN(doubleValue)) {\n                        throw new Error('Invalid number for field ' + field.name);\n                    }\n                    return { double_value: doubleValue };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_DURATION') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    var text = String(value).trim();\n                    if (!text) {\n                        return null;\n                    }\n                    if (/^\\d+$/.test(text)) {\n                        text += 's';\n                    }\n                    return { duration_value: text };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_LIST') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n\n                    if (normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT' && Array.isArray(value)) {\n                        return { string_list: { values: value } };\n                    }\n\n                    if (typeof value === 'string') {\n                        try {\n                            var parsed = JSON.parse(value);\n                            if (!Array.isArray(parsed)) {\n                                throw new Error('Expected JSON array');\n                            }\n                            return inferConfigValue(parsed);\n                        } catch (e) {\n                            throw new Error('Invalid JSON list for field ' + field.name + ': ' + e.message);\n                        }\n                    }\n                    return inferConfigValue(value);\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_OBJECT') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    if (typeof value === 'string') {\n                        try {\n                            var parsedObject = JSON.parse(value);\n                            if (!parsedObject || typeof parsedObject !== 'object' || Array.isArray(parsedObject)) {\n                                throw new Error('Expected JSON object');\n                            }\n                            return inferConfigValue(parsedObject);\n                        } catch (e) {\n                            throw new Error('Invalid JSON object for field ' + field.name + ': ' + e.message);\n                        }\n                    }\n                    return inferConfigValue(value);\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_ENUM') {\n                    if (normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT') {\n                        if (!value || !value.length) {\n                            return null;\n                        }\n                        return { string_list: { values: value } };\n                    }\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    return { string_value: String(value) };\n                }\n\n                if (value === '' || value === null || value === undefined) {\n                    return null;\n                }\n\n                return { string_value: String(value) };\n            }\n\n            function toInputID(scope, fieldName) {\n                return 'plugin-' + scope + '-field-' + String(fieldName || '').replace(/[^a-zA-Z0-9_-]/g, '_');\n            }\n\n            function resolveFieldConfigValue(scope, field) {\n                if (!field || !field.name) {\n                    return null;\n                }\n                var fromConfig = null;\n                if (state.config) {\n                    if (scope === 'admin' && state.config.admin_config_values) {\n                        fromConfig = state.config.admin_config_values[field.name];\n                    }\n                    if (scope === 'worker' && state.config.worker_config_values) {\n                        fromConfig = state.config.worker_config_values[field.name];\n                    }\n                }\n                if (fromConfig) {\n                    return fromConfig;\n                }\n\n                var formDefaults = null;\n                if (scope === 'admin' && state.descriptor && state.descriptor.admin_config_form && state.descriptor.admin_config_form.default_values) {\n                    formDefaults = state.descriptor.admin_config_form.default_values[field.name];\n                }\n                if (scope === 'worker' && state.descriptor && state.descriptor.worker_config_form && state.descriptor.worker_config_form.default_values) {\n                    formDefaults = state.descriptor.worker_config_form.default_values[field.name];\n                }\n                if (formDefaults) {\n                    return formDefaults;\n                }\n\n                if (scope === 'worker' && state.descriptor && state.descriptor.worker_default_values) {\n                    return state.descriptor.worker_default_values[field.name] || null;\n                }\n\n                return null;\n            }\n\n            function renderFieldInput(scope, field, value) {\n                var inputID = toInputID(scope, field.name);\n                var normalizedType = normalizeEnum(field.field_type);\n                var normalizedWidget = normalizeEnum(field.widget);\n                var input;\n\n                if (normalizedType === 'CONFIG_FIELD_TYPE_BOOL' || normalizedWidget === 'CONFIG_WIDGET_TOGGLE') {\n                    input = document.createElement('input');\n                    input.type = 'checkbox';\n                    input.className = 'form-check-input';\n                    input.id = inputID;\n                    input.checked = !!value;\n                } else if ((normalizedType === 'CONFIG_FIELD_TYPE_ENUM' && normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT') || normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT') {\n                    input = document.createElement('select');\n                    input.className = 'form-select';\n                    input.id = inputID;\n                    input.multiple = true;\n                    var selected = Array.isArray(value) ? value : [];\n                    var options = Array.isArray(field.options) ? field.options : [];\n                    for (var i = 0; i < options.length; i++) {\n                        var option = document.createElement('option');\n                        option.value = options[i].value || '';\n                        option.textContent = options[i].label || options[i].value || '';\n                        if (selected.indexOf(option.value) >= 0) {\n                            option.selected = true;\n                        }\n                        input.appendChild(option);\n                    }\n                } else if (normalizedType === 'CONFIG_FIELD_TYPE_ENUM' || normalizedWidget === 'CONFIG_WIDGET_SELECT') {\n                    input = document.createElement('select');\n                    input.className = 'form-select';\n                    input.id = inputID;\n                    var blankOption = document.createElement('option');\n                    blankOption.value = '';\n                    blankOption.textContent = '-- select --';\n                    input.appendChild(blankOption);\n                    var enumOptions = Array.isArray(field.options) ? field.options : [];\n                    for (var j = 0; j < enumOptions.length; j++) {\n                        var enumOption = document.createElement('option');\n                        enumOption.value = enumOptions[j].value || '';\n                        enumOption.textContent = enumOptions[j].label || enumOptions[j].value || '';\n                        if (String(value) === enumOption.value) {\n                            enumOption.selected = true;\n                        }\n                        input.appendChild(enumOption);\n                    }\n                } else if (normalizedType === 'CONFIG_FIELD_TYPE_INT64' || normalizedType === 'CONFIG_FIELD_TYPE_DOUBLE' || normalizedWidget === 'CONFIG_WIDGET_NUMBER') {\n                    input = document.createElement('input');\n                    input.type = 'number';\n                    if (normalizedType === 'CONFIG_FIELD_TYPE_DOUBLE') {\n                        input.step = 'any';\n                    }\n                    input.className = 'form-control';\n                    input.id = inputID;\n                    if (value !== null && value !== undefined && value !== '') {\n                        input.value = String(value);\n                    }\n                } else if (normalizedType === 'CONFIG_FIELD_TYPE_LIST' || normalizedType === 'CONFIG_FIELD_TYPE_OBJECT' || normalizedWidget === 'CONFIG_WIDGET_TEXTAREA') {\n                    input = document.createElement('textarea');\n                    input.className = 'form-control';\n                    input.id = inputID;\n                    input.rows = 4;\n                    if (normalizedType === 'CONFIG_FIELD_TYPE_LIST' || normalizedType === 'CONFIG_FIELD_TYPE_OBJECT') {\n                        input.placeholder = normalizedType === 'CONFIG_FIELD_TYPE_LIST' ? '[...]' : '{...}';\n                    }\n                    if (value !== null && value !== undefined && value !== '') {\n                        if (typeof value === 'object') {\n                            input.value = JSON.stringify(value, null, 2);\n                        } else {\n                            input.value = String(value);\n                        }\n                    }\n                } else {\n                    input = document.createElement('input');\n                    input.className = 'form-control';\n                    input.id = inputID;\n                    if (normalizedWidget === 'CONFIG_WIDGET_PASSWORD' || field.sensitive) {\n                        input.type = 'password';\n                    } else {\n                        input.type = 'text';\n                    }\n                    if (value !== null && value !== undefined && value !== '') {\n                        input.value = String(value);\n                    }\n                }\n\n                if (field.placeholder && input.tagName === 'INPUT') {\n                    input.placeholder = field.placeholder;\n                }\n                if (field.placeholder && input.tagName === 'TEXTAREA') {\n                    input.placeholder = field.placeholder;\n                }\n\n                if (field.required) {\n                    input.required = true;\n                }\n                if (field.read_only) {\n                    input.disabled = true;\n                }\n\n                return input;\n            }\n\n            function renderConfigForm(scope, rootID, form) {\n                var root = document.getElementById(rootID);\n                if (!root) {\n                    return;\n                }\n\n                root.innerHTML = '';\n                if (!form || !Array.isArray(form.sections) || form.sections.length === 0) {\n                    root.innerHTML = '<div class=\"text-muted\">No fields provided by descriptor.</div>';\n                    return;\n                }\n\n                for (var s = 0; s < form.sections.length; s++) {\n                    var section = form.sections[s] || {};\n                    var sectionCard = document.createElement('div');\n                    sectionCard.className = 'card mb-3';\n\n                    var sectionHeader = document.createElement('div');\n                    sectionHeader.className = 'card-header py-2';\n                    sectionHeader.innerHTML = '<strong>' + escapeHtml(textOrDash(section.title || section.section_id)) + '</strong>';\n                    sectionCard.appendChild(sectionHeader);\n\n                    var sectionBody = document.createElement('div');\n                    sectionBody.className = 'card-body';\n\n                    if (section.description) {\n                        var sectionDescription = document.createElement('p');\n                        sectionDescription.className = 'text-muted small';\n                        sectionDescription.textContent = section.description;\n                        sectionBody.appendChild(sectionDescription);\n                    }\n\n                    var fields = Array.isArray(section.fields) ? section.fields : [];\n                    if (!fields.length) {\n                        var noFields = document.createElement('div');\n                        noFields.className = 'text-muted';\n                        noFields.textContent = 'No fields in this section.';\n                        sectionBody.appendChild(noFields);\n                    }\n\n                    for (var f = 0; f < fields.length; f++) {\n                        var field = fields[f] || {};\n                        if (!field.name) {\n                            continue;\n                        }\n\n                        var configValue = resolveFieldConfigValue(scope, field);\n                        var nativeValue = configValueToNative(configValue);\n\n                        var wrapper = document.createElement('div');\n                        wrapper.className = 'mb-3 plugin-field';\n                        wrapper.dataset.scope = scope;\n                        wrapper.dataset.fieldName = field.name;\n                        wrapper.dataset.fieldType = normalizeEnum(field.field_type);\n                        wrapper.dataset.widget = normalizeEnum(field.widget);\n                        wrapper.dataset.visibleWhenField = field.visible_when_field || '';\n                        wrapper.dataset.visibleWhenEquals = JSON.stringify(field.visible_when_equals || null);\n\n                        var label = document.createElement('label');\n                        label.className = 'form-label';\n                        label.setAttribute('for', toInputID(scope, field.name));\n                        label.innerHTML = escapeHtml(field.label || field.name) + (field.required ? ' <span class=\"text-danger\">*</span>' : '');\n                        wrapper.appendChild(label);\n\n                        var input = renderFieldInput(scope, field, nativeValue);\n                        wrapper.appendChild(input);\n\n                        if (field.description || field.help_text) {\n                            var help = document.createElement('div');\n                            help.className = 'form-text';\n                            help.textContent = field.help_text || field.description || '';\n                            wrapper.appendChild(help);\n                        }\n\n                        sectionBody.appendChild(wrapper);\n                    }\n\n                    sectionCard.appendChild(sectionBody);\n                    root.appendChild(sectionCard);\n                }\n\n                root.addEventListener('change', function() {\n                    applyVisibility(scope);\n                });\n                root.addEventListener('input', function() {\n                    applyVisibility(scope);\n                });\n\n                applyVisibility(scope);\n            }\n\n            function readRawFieldValue(scope, fieldName) {\n                var input = document.getElementById(toInputID(scope, fieldName));\n                if (!input) {\n                    return null;\n                }\n                if (input.tagName === 'SELECT' && input.multiple) {\n                    return getSelectValueArray(input);\n                }\n                if (input.type === 'checkbox') {\n                    return !!input.checked;\n                }\n                return input.value;\n            }\n\n            function compareVisibleValue(currentValue, expectedValueObject) {\n                if (!expectedValueObject) {\n                    return true;\n                }\n                var expectedNative = configValueToNative(expectedValueObject);\n                if (Array.isArray(expectedNative)) {\n                    if (!Array.isArray(currentValue)) {\n                        return false;\n                    }\n                    if (expectedNative.length !== currentValue.length) {\n                        return false;\n                    }\n                    for (var i = 0; i < expectedNative.length; i++) {\n                        if (String(expectedNative[i]) !== String(currentValue[i])) {\n                            return false;\n                        }\n                    }\n                    return true;\n                }\n                return String(currentValue) === String(expectedNative);\n            }\n\n            function applyVisibility(scope) {\n                var fields = document.querySelectorAll('.plugin-field[data-scope=\"' + scope + '\"]');\n                for (var i = 0; i < fields.length; i++) {\n                    var wrapper = fields[i];\n                    var dependsOn = wrapper.dataset.visibleWhenField;\n                    if (!dependsOn) {\n                        wrapper.classList.remove('plugin-field-hidden');\n                        continue;\n                    }\n\n                    var expectedRaw = null;\n                    try {\n                        expectedRaw = JSON.parse(wrapper.dataset.visibleWhenEquals || 'null');\n                    } catch (e) {\n                        expectedRaw = null;\n                    }\n                    var current = readRawFieldValue(scope, dependsOn);\n                    var visible = compareVisibleValue(current, expectedRaw);\n                    if (visible) {\n                        wrapper.classList.remove('plugin-field-hidden');\n                    } else {\n                        wrapper.classList.add('plugin-field-hidden');\n                    }\n                }\n            }\n\n            function collectConfigValues(scope, form) {\n                var out = {};\n                if (!form || !Array.isArray(form.sections)) {\n                    return out;\n                }\n\n                for (var s = 0; s < form.sections.length; s++) {\n                    var section = form.sections[s] || {};\n                    var fields = Array.isArray(section.fields) ? section.fields : [];\n                    for (var f = 0; f < fields.length; f++) {\n                        var field = fields[f] || {};\n                        if (!field.name) {\n                            continue;\n                        }\n\n                        var wrapper = document.querySelector('.plugin-field[data-scope=\"' + scope + '\"][data-field-name=\"' + field.name + '\"]');\n                        if (wrapper && wrapper.classList.contains('plugin-field-hidden')) {\n                            continue;\n                        }\n\n                        var input = document.getElementById(toInputID(scope, field.name));\n                        if (!input) {\n                            continue;\n                        }\n\n                        var rawValue;\n                        if (input.tagName === 'SELECT' && input.multiple) {\n                            rawValue = getSelectValueArray(input);\n                        } else if (input.type === 'checkbox') {\n                            rawValue = !!input.checked;\n                        } else {\n                            rawValue = input.value;\n                        }\n\n                        if (field.required) {\n                            var missing = false;\n                            if (input.type === 'checkbox') {\n                                missing = false;\n                            } else if (Array.isArray(rawValue)) {\n                                missing = rawValue.length === 0;\n                            } else {\n                                missing = String(rawValue || '').trim() === '';\n                            }\n                            if (missing) {\n                                throw new Error('Missing required field: ' + (field.label || field.name));\n                            }\n                        }\n\n                        var converted = nativeToConfigValue(rawValue, field.field_type, field.widget, field);\n                        if (converted !== null) {\n                            out[field.name] = converted;\n                        }\n                    }\n                }\n\n                return out;\n            }\n\n            function renderDescriptorSummary() {\n                var summary = document.getElementById('plugin-descriptor-summary');\n                if (!state.descriptor) {\n                    summary.innerHTML = 'No descriptor loaded.';\n                    return;\n                }\n\n                var descriptor = state.descriptor;\n                var html = '';\n                html += '<div><strong>' + escapeHtml(textOrDash(descriptor.display_name || descriptor.job_type)) + '</strong></div>';\n                html += '<div><small>Job Type: ' + escapeHtml(textOrDash(descriptor.job_type)) + '</small></div>';\n                html += '<div><small>Descriptor Version: ' + escapeHtml(textOrDash(descriptor.descriptor_version)) + '</small></div>';\n                if (descriptor.description) {\n                    html += '<div class=\"mt-1\">' + escapeHtml(descriptor.description) + '</div>';\n                }\n                summary.innerHTML = html;\n            }\n\n            function fillAdminSettings() {\n                var runtimeConfig = (state.config && state.config.admin_runtime) ? state.config.admin_runtime : {};\n                var defaults = (state.descriptor && state.descriptor.admin_runtime_defaults) ? state.descriptor.admin_runtime_defaults : {};\n\n                function pickNumber(key) {\n                    if (runtimeConfig && runtimeConfig[key] !== undefined && runtimeConfig[key] !== null) {\n                        return runtimeConfig[key];\n                    }\n                    if (defaults && defaults[key] !== undefined && defaults[key] !== null) {\n                        return defaults[key];\n                    }\n                    return 0;\n                }\n\n                function pickBool(key) {\n                    if (runtimeConfig && runtimeConfig[key] !== undefined && runtimeConfig[key] !== null) {\n                        return !!runtimeConfig[key];\n                    }\n                    if (defaults && defaults[key] !== undefined && defaults[key] !== null) {\n                        return !!defaults[key];\n                    }\n                    return true;\n                }\n\n                document.getElementById('plugin-admin-enabled').checked = pickBool('enabled');\n                document.getElementById('plugin-admin-detection-interval').value = String(pickNumber('detection_interval_minutes'));\n                document.getElementById('plugin-admin-detection-timeout').value = String(pickNumber('detection_timeout_seconds'));\n                document.getElementById('plugin-admin-execution-timeout').value = String(pickNumber('execution_timeout_seconds'));\n                document.getElementById('plugin-admin-max-runtime').value = String(pickNumber('job_type_max_runtime_seconds'));\n                document.getElementById('plugin-admin-max-results').value = String(pickNumber('max_jobs_per_detection'));\n                document.getElementById('plugin-admin-global-exec').value = String(pickNumber('global_execution_concurrency'));\n                document.getElementById('plugin-admin-per-worker-exec').value = String(pickNumber('per_worker_execution_concurrency'));\n                document.getElementById('plugin-admin-retry-limit').value = String(pickNumber('retry_limit'));\n                document.getElementById('plugin-admin-retry-backoff').value = String(pickNumber('retry_backoff_seconds'));\n            }\n\n            function collectAdminSettings() {\n                function getInt(id) {\n                    var raw = String(document.getElementById(id).value || '').trim();\n                    if (!raw) {\n                        return 0;\n                    }\n                    var parsed = parseInt(raw, 10);\n                    if (Number.isNaN(parsed) || parsed < 0) {\n                        throw new Error('Invalid number for ' + id);\n                    }\n                    return parsed;\n                }\n\n                return {\n                    enabled: !!document.getElementById('plugin-admin-enabled').checked,\n                    detection_interval_minutes: getInt('plugin-admin-detection-interval'),\n                    detection_timeout_seconds: getInt('plugin-admin-detection-timeout'),\n                    execution_timeout_seconds: getInt('plugin-admin-execution-timeout'),\n                    job_type_max_runtime_seconds: getInt('plugin-admin-max-runtime'),\n                    max_jobs_per_detection: getInt('plugin-admin-max-results'),\n                    global_execution_concurrency: getInt('plugin-admin-global-exec'),\n                    per_worker_execution_concurrency: getInt('plugin-admin-per-worker-exec'),\n                    retry_limit: getInt('plugin-admin-retry-limit'),\n                    retry_backoff_seconds: getInt('plugin-admin-retry-backoff'),\n                };\n            }\n\n            function renderRunHistory(history) {\n                var successBody = document.getElementById('plugin-runs-success-body');\n                var errorBody = document.getElementById('plugin-runs-error-body');\n\n                var successRuns = (history && Array.isArray(history.successful_runs)) ? history.successful_runs : [];\n                var errorRuns = (history && Array.isArray(history.error_runs)) ? history.error_runs : [];\n\n                if (!successRuns.length) {\n                    successBody.innerHTML = '<tr><td colspan=\"4\" class=\"text-muted\">No successful runs</td></tr>';\n                } else {\n                    var successRows = '';\n                    for (var i = 0; i < successRuns.length; i++) {\n                        var run = successRuns[i] || {};\n                        successRows += '<tr>' +\n                            '<td><small>' + escapeHtml(parseTime(run.completed_at) || '-') + '</small></td>' +\n                            '<td>' + renderJobLink(run.job_id) + '</td>' +\n                            '<td><small>' + escapeHtml(textOrDash(run.worker_id)) + '</small></td>' +\n                            '<td><small>' + escapeHtml(formatDurationMs(run.duration_ms)) + '</small></td>' +\n                            '</tr>';\n                    }\n                    successBody.innerHTML = successRows;\n                }\n\n                if (!errorRuns.length) {\n                    errorBody.innerHTML = '<tr><td colspan=\"4\" class=\"text-muted\">No error runs</td></tr>';\n                } else {\n                    var errorRows = '';\n                    for (var j = 0; j < errorRuns.length; j++) {\n                        var errorRun = errorRuns[j] || {};\n                        errorRows += '<tr>' +\n                            '<td><small>' + escapeHtml(parseTime(errorRun.completed_at) || '-') + '</small></td>' +\n                            '<td>' + renderJobLink(errorRun.job_id) + '</td>' +\n                            '<td><small>' + escapeHtml(textOrDash(errorRun.worker_id)) + '</small></td>' +\n                            '<td><small class=\"text-danger\">' + escapeHtml(textOrDash(errorRun.message)) + '</small></td>' +\n                            '</tr>';\n                    }\n                    errorBody.innerHTML = errorRows;\n                }\n            }\n\n            function renderDetectionResult(data) {\n                var root = document.getElementById('plugin-detection-results');\n                if (!root) {\n                    return;\n                }\n\n                function normalizeProposals(payload) {\n                    if (!payload || typeof payload !== 'object') {\n                        return [];\n                    }\n                    if (Array.isArray(payload.proposals)) {\n                        return payload.proposals;\n                    }\n                    if (payload.proposals && typeof payload.proposals === 'object') {\n                        return Object.keys(payload.proposals).map(function(key) {\n                            return payload.proposals[key];\n                        }).filter(function(item) {\n                            return !!item;\n                        });\n                    }\n                    return [];\n                }\n\n                function proposalID(proposal) {\n                    return proposal.proposal_id || proposal.proposalId || proposal.id || '';\n                }\n\n                function proposalSummary(proposal) {\n                    return proposal.summary || proposal.title || proposalID(proposal) || 'Proposal';\n                }\n\n                function proposalDetail(proposal) {\n                    return proposal.detail || proposal.reason || proposal.message || '-';\n                }\n\n                function normalizeActivities(payload) {\n                    if (!payload || typeof payload !== 'object') {\n                        return [];\n                    }\n                    if (Array.isArray(payload.activities)) {\n                        return payload.activities;\n                    }\n                    return [];\n                }\n\n                function encodeDetails(details) {\n                    if (!details || typeof details !== 'object') {\n                        return '';\n                    }\n                    var text = '';\n                    try {\n                        text = JSON.stringify(details);\n                    } catch (e) {\n                        text = '';\n                    }\n                    if (!text) {\n                        return '';\n                    }\n                    if (text.length > 360) {\n                        text = text.slice(0, 360) + '...';\n                    }\n                    return text;\n                }\n\n                if (!data) {\n                    root.innerHTML = '<div class=\"text-muted\">No results.</div>';\n                    return;\n                }\n\n                var proposals = normalizeProposals(data);\n                var activities = normalizeActivities(data);\n                var responseCount = Number(data.count || 0);\n                if (!Number.isFinite(responseCount) || responseCount < 0) {\n                    responseCount = proposals.length;\n                }\n                var requestID = data.request_id || data.requestId || '';\n                var detectorWorkerID = data.detector_worker_id || data.detectorWorkerId || '';\n                var totalProposals = Number(data.total_proposals || 0);\n                if (!Number.isFinite(totalProposals) || totalProposals < 0) {\n                    totalProposals = responseCount;\n                }\n\n                var html = '';\n                html += '<div class=\"mb-2\"><strong>Detection Run</strong></div>';\n                if (requestID) {\n                    html += '<div><small>request_id: ' + escapeHtml(String(requestID)) + '</small></div>';\n                }\n                if (detectorWorkerID) {\n                    html += '<div><small>detector: ' + escapeHtml(String(detectorWorkerID)) + '</small></div>';\n                }\n                html += '<div><small>proposals: ' + escapeHtml(String(responseCount)) + ' / total: ' + escapeHtml(String(totalProposals)) + '</small></div>';\n                if (data.error) {\n                    html += '<div class=\"mt-1 text-danger\"><small>' + escapeHtml(String(data.error)) + '</small></div>';\n                }\n\n                if (!proposals.length) {\n                    html += '<div class=\"mt-2 text-muted\">No proposals returned.</div>';\n                } else {\n                    html += '<div class=\"mt-2 mb-1\"><strong>' + escapeHtml(String(proposals.length)) + '</strong> proposal(s)</div>';\n                    for (var i = 0; i < proposals.length; i++) {\n                        var proposal = proposals[i] || {};\n                        var pID = proposalID(proposal);\n                        var pSummary = proposalSummary(proposal);\n                        var pDetail = proposalDetail(proposal);\n                        var pPriority = proposal.priority;\n                        if (pPriority === null || pPriority === undefined || pPriority === '') {\n                            pPriority = '-';\n                        }\n                        html += '<div class=\"plugin-detection-item\">' +\n                            '<div class=\"fw-semibold\">' + escapeHtml(textOrDash(pSummary)) + '</div>' +\n                            '<div><small>proposal_id: ' + escapeHtml(textOrDash(pID)) + '</small></div>' +\n                            '<div><small>priority: ' + escapeHtml(textOrDash(pPriority)) + '</small></div>' +\n                            '<div><small>detail: ' + escapeHtml(textOrDash(pDetail)) + '</small></div>' +\n                            '</div>';\n                    }\n                }\n\n                if (activities.length) {\n                    html += '<hr class=\"my-2\"/>';\n                    html += '<div class=\"mb-2\"><strong>Detection Process</strong></div>';\n                    for (var j = 0; j < activities.length; j++) {\n                        var activity = activities[j] || {};\n                        var activityStage = activity.stage || '-';\n                        var activitySource = activity.source || '-';\n                        var activityMessage = activity.message || '-';\n                        var activityTime = parseTime(activity.occurred_at) || '-';\n                        var detailsText = encodeDetails(activity.details);\n                        html += '<div class=\"plugin-detection-item\">' +\n                            '<div class=\"fw-semibold\">' + escapeHtml(textOrDash(activityStage)) + '</div>' +\n                            '<div><small>source: ' + escapeHtml(textOrDash(activitySource)) + ' | at: ' + escapeHtml(activityTime) + '</small></div>' +\n                            '<div><small>' + escapeHtml(textOrDash(activityMessage)) + '</small></div>';\n                        if (detailsText) {\n                            html += '<div><small class=\"text-muted\">details: ' + escapeHtml(detailsText) + '</small></div>';\n                        }\n                        html += '</div>';\n                    }\n                }\n\n                root.innerHTML = html;\n            }\n\n            function getSelectedJobType() {\n                return String(state.selectedJobType || '').trim();\n            }\n\n            function resetJobTypePanels() {\n                state.loadedJobType = '';\n                state.descriptor = null;\n                state.config = null;\n                document.getElementById('plugin-descriptor-summary').textContent = 'No descriptor loaded.';\n                document.getElementById('plugin-admin-config-form').innerHTML = '<div class=\"text-muted\">No admin form loaded.</div>';\n                document.getElementById('plugin-worker-config-form').innerHTML = '<div class=\"text-muted\">No worker form loaded.</div>';\n                document.getElementById('plugin-config-updated-at').textContent = 'Not loaded';\n                renderRunHistory(null);\n                renderDetectionResult(null);\n            }\n\n            async function loadDescriptorAndConfig(jobType, forceRefresh) {\n                if (!jobType) {\n                    return;\n                }\n\n                state.selectedJobType = jobType;\n                renderNavigationState();\n\n                var summary = document.getElementById('plugin-descriptor-summary');\n                summary.textContent = 'Loading descriptor and config...';\n\n                try {\n                    if (forceRefresh) {\n                        var refreshURL = '/api/plugin/job-types/' + encodePath(jobType) + '/schema?force_refresh=true';\n                        state.descriptor = await pluginRequest('POST', refreshURL, null);\n                    } else {\n                        try {\n                            state.descriptor = await pluginRequest('GET', '/api/plugin/job-types/' + encodePath(jobType) + '/descriptor');\n                        } catch (descriptorLoadError) {\n                            state.descriptor = await pluginRequest('POST', '/api/plugin/job-types/' + encodePath(jobType) + '/schema', null);\n                        }\n                    }\n                } catch (schemaError) {\n                    state.loadedJobType = '';\n                    state.descriptor = null;\n                    summary.innerHTML = '<span class=\"text-danger\">Failed to load descriptor: ' + escapeHtml(schemaError.message) + '</span>';\n                    document.getElementById('plugin-admin-config-form').innerHTML = '<div class=\"text-muted\">No admin form loaded.</div>';\n                    document.getElementById('plugin-worker-config-form').innerHTML = '<div class=\"text-muted\">No worker form loaded.</div>';\n                    throw schemaError;\n                }\n\n                try {\n                    state.config = await pluginRequest('GET', '/api/plugin/job-types/' + encodePath(jobType) + '/config');\n                } catch (configError) {\n                    state.config = null;\n                    notify('Failed to load config: ' + configError.message, 'error');\n                }\n\n                renderDescriptorSummary();\n                fillAdminSettings();\n\n                if (state.descriptor) {\n                    renderConfigForm('admin', 'plugin-admin-config-form', state.descriptor.admin_config_form || {});\n                    renderConfigForm('worker', 'plugin-worker-config-form', state.descriptor.worker_config_form || {});\n                }\n\n                if (state.config && state.config.updated_at) {\n                    document.getElementById('plugin-config-updated-at').textContent = 'Updated: ' + (parseTime(state.config.updated_at) || state.config.updated_at);\n                } else {\n                    document.getElementById('plugin-config-updated-at').textContent = 'Not saved yet';\n                }\n                state.loadedJobType = jobType;\n\n                await loadRunHistory(jobType);\n\n                if (state.lastDetectionByJobType && state.lastDetectionByJobType[jobType]) {\n                    renderDetectionResult(state.lastDetectionByJobType[jobType]);\n                } else {\n                    renderDetectionResult(null);\n                }\n            }\n\n            async function loadRunHistory(jobType) {\n                if (!jobType) {\n                    renderRunHistory(null);\n                    return;\n                }\n                try {\n                    var history = await pluginRequest('GET', '/api/plugin/job-types/' + encodePath(jobType) + '/runs');\n                    renderRunHistory(history);\n                } catch (e) {\n                    renderRunHistory(null);\n                    notify('Failed to load run history: ' + e.message, 'error');\n                }\n            }\n\n            async function saveConfig() {\n                var jobType = state.selectedJobType || getSelectedJobType();\n                if (!jobType) {\n                    notify('Select a job type first.', 'error');\n                    return;\n                }\n                if (!state.descriptor) {\n                    notify('Load descriptor before saving config.', 'error');\n                    return;\n                }\n\n                var payload;\n                try {\n                    payload = {\n                        job_type: jobType,\n                        descriptor_version: state.descriptor.descriptor_version || 0,\n                        admin_runtime: collectAdminSettings(),\n                        admin_config_values: collectConfigValues('admin', state.descriptor.admin_config_form || {}),\n                        worker_config_values: collectConfigValues('worker', state.descriptor.worker_config_form || {}),\n                    };\n                } catch (err) {\n                    notify(err.message, 'error');\n                    return;\n                }\n\n                try {\n                    state.config = await pluginRequest('PUT', '/api/plugin/job-types/' + encodePath(jobType) + '/config', payload);\n                    document.getElementById('plugin-config-updated-at').textContent = 'Updated: ' + (parseTime(state.config.updated_at) || state.config.updated_at || 'just now');\n                    notify('Config saved for ' + jobType, 'success');\n                } catch (e) {\n                    notify('Failed to save config: ' + e.message, 'error');\n                }\n            }\n\n            function getMaxResults() {\n                var raw = String(document.getElementById('plugin-admin-max-results').value || '').trim();\n                if (!raw) {\n                    return 0;\n                }\n                var parsed = parseInt(raw, 10);\n                if (Number.isNaN(parsed) || parsed < 0) {\n                    return 0;\n                }\n                return parsed;\n            }\n\n            async function runDetection() {\n                var jobType = state.selectedJobType || getSelectedJobType();\n                if (!jobType) {\n                    notify('Select a job type first.', 'error');\n                    return;\n                }\n\n                try {\n                    var data = await pluginRequest('POST', '/api/plugin/job-types/' + encodePath(jobType) + '/detect', {\n                        max_results: getMaxResults(),\n                    });\n                    state.lastDetectionByJobType[jobType] = data;\n                    renderDetectionResult(data);\n                } catch (e) {\n                    if (e && e.responseData) {\n                        state.lastDetectionByJobType[jobType] = e.responseData;\n                        renderDetectionResult(e.responseData);\n                    }\n                    notify('Detection failed: ' + e.message, 'error');\n                    return;\n                }\n\n                try {\n                    await refreshJobsAndActivities();\n                } catch (refreshErr) {\n                    notify('Detection succeeded, but monitoring refresh failed: ' + refreshErr.message, 'error');\n                }\n            }\n\n            async function runWorkflow() {\n                var jobType = state.selectedJobType || getSelectedJobType();\n                if (!jobType) {\n                    notify('Select a job type first.', 'error');\n                    return;\n                }\n\n                try {\n                    var data = await pluginRequest('POST', '/api/plugin/job-types/' + encodePath(jobType) + '/run', {\n                        max_results: getMaxResults(),\n                    });\n                    var resultRoot = document.getElementById('plugin-detection-results');\n                    resultRoot.innerHTML = '<div class=\"mb-2\"><strong>Workflow completed</strong></div>' +\n                        '<div>Detected: <strong>' + escapeHtml(String(data.detected_count || 0)) + '</strong></div>' +\n                        '<div>Ready to Execute: <strong>' + escapeHtml(String(data.ready_to_execute_count || 0)) + '</strong></div>' +\n                        '<div>Skipped (Already Active): <strong>' + escapeHtml(String(data.skipped_active_count || 0)) + '</strong></div>' +\n                        '<div>Executed: <strong>' + escapeHtml(String(data.executed_count || 0)) + '</strong></div>' +\n                        '<div class=\"text-success\">Success: ' + escapeHtml(String(data.success_count || 0)) + '</div>' +\n                        '<div class=\"text-danger\">Errors: ' + escapeHtml(String(data.error_count || 0)) + '</div>';\n                    await loadRunHistory(jobType);\n                    await refreshJobsAndActivities();\n                } catch (e) {\n                    notify('Workflow run failed: ' + e.message, 'error');\n                }\n            }\n\n            async function refreshJobsAndActivities() {\n                var executionStateFilter = document.getElementById('plugin-monitor-job-state-filter');\n\n                state.monitorExecutionJobState = executionStateFilter ? String(executionStateFilter.value || '').trim() : '';\n\n                var allJobsPromise = pluginRequest('GET', appendLaneParam('/api/plugin/jobs?limit=500'));\n                var allActivitiesPromise = pluginRequest('GET', appendLaneParam('/api/plugin/activities?limit=500'));\n                var schedulerPromise = pluginRequest('GET', appendLaneParam('/api/plugin/scheduler-states'));\n                var schedulerStatusPromise = pluginRequest('GET', appendLaneParam('/api/plugin/scheduler-status'));\n\n                var allJobs = await allJobsPromise;\n                var allActivities = await allActivitiesPromise;\n                var schedulerStates = await schedulerPromise;\n                var schedulerStatus = null;\n                try {\n                    schedulerStatus = await schedulerStatusPromise;\n                } catch (e) {\n                    schedulerStatus = null;\n                }\n\n                state.jobs = Array.isArray(allJobs) ? allJobs : [];\n                state.activities = Array.isArray(allActivities) ? allActivities : [];\n                state.allJobs = state.jobs;\n                state.allActivities = state.activities;\n                state.schedulerStates = Array.isArray(schedulerStates) ? schedulerStates : [];\n                state.schedulerStatus = schedulerStatus && schedulerStatus.scheduler ? schedulerStatus.scheduler : null;\n                renderQueueJobs();\n                renderDetectionJobs();\n                renderExecutionJobs();\n                renderExecutionActivities();\n                renderSchedulerStates();\n                renderSchedulerStatus();\n                renderStatus();\n                renderJobTypeSummary();\n            }\n\n            async function refreshAll() {\n                try {\n                    var previousSelectedJobType = state.selectedJobType;\n\n                    var workers = await pluginRequest('GET', appendLaneParam('/api/plugin/workers'));\n                    state.workers = Array.isArray(workers) ? workers : [];\n                    renderWorkers();\n\n                    var jobTypes = await pluginRequest('GET', appendLaneParam('/api/plugin/job-types'));\n                    state.jobTypes = Array.isArray(jobTypes) ? jobTypes : [];\n                    applyInitialNavigation();\n                    ensureActiveNavigation();\n                    renderTopTabs();\n                    renderNavigationState();\n\n                    if (!state.selectedJobType) {\n                        resetJobTypePanels();\n                    } else if (state.loadedJobType !== state.selectedJobType || previousSelectedJobType !== state.selectedJobType) {\n                        try {\n                            await loadDescriptorAndConfig(state.selectedJobType, false);\n                        } catch (loadError) {\n                            // Already rendered in UI.\n                        }\n                    }\n\n                    await refreshJobsAndActivities();\n                } catch (e) {\n                    notify('Refresh failed: ' + e.message, 'error');\n                }\n            }\n\n            function bindActions() {\n                var monitorStateFilter = document.getElementById('plugin-monitor-job-state-filter');\n                if (monitorStateFilter) {\n                    monitorStateFilter.addEventListener('change', function() {\n                        state.monitorExecutionJobState = String(monitorStateFilter.value || '').trim();\n                        renderExecutionJobs();\n                    });\n                }\n\n                var expireBtn = document.getElementById('plugin-expire-job-btn');\n                if (expireBtn) {\n                    expireBtn.addEventListener('click', function() {\n                        var jobID = String(expireBtn.getAttribute('data-job-id') || '').trim();\n                        if (!jobID) {\n                            return;\n                        }\n                        expireJob(jobID);\n                    });\n                }\n\n                document.getElementById('plugin-refresh-all-btn').addEventListener('click', function() {\n                    refreshAll();\n                });\n\n                document.getElementById('plugin-refresh-schema-btn').addEventListener('click', async function() {\n                    var jobType = getSelectedJobType();\n                    if (!jobType) {\n                        notify('Select a job type first.', 'error');\n                        return;\n                    }\n                    try {\n                        await loadDescriptorAndConfig(jobType, true);\n                        notify('Schema refreshed for ' + jobType, 'success');\n                    } catch (e) {\n                        notify('Schema refresh failed: ' + e.message, 'error');\n                    }\n                });\n\n                document.getElementById('plugin-save-config-btn').addEventListener('click', function() {\n                    saveConfig();\n                });\n\n                document.getElementById('plugin-trigger-detection-btn').addEventListener('click', function() {\n                    runDetection();\n                });\n\n                document.getElementById('plugin-run-workflow-btn').addEventListener('click', function() {\n                    runWorkflow();\n                });\n\n                page.addEventListener('click', async function(event) {\n                    var target = event.target;\n                    if (!target) {\n                        return;\n                    }\n\n                    var topTab = target.closest('[data-plugin-top-tab]');\n                    if (topTab) {\n                        event.preventDefault();\n                        var topTabKey = String(topTab.getAttribute('data-plugin-top-tab') || '').trim();\n                        if (!topTabKey) {\n                            return;\n                        }\n                        if (topTabKey === 'overview') {\n                            state.activeTopTab = 'overview';\n                            renderNavigationState();\n                            updateURL(false);\n                            return;\n                        }\n\n                        var jobType = parseJobTypeFromTopTab(topTabKey);\n                        if (!jobType) {\n                            return;\n                        }\n                        state.activeTopTab = topTabKey;\n                        state.selectedJobType = jobType;\n                        ensureActiveNavigation();\n                        renderNavigationState();\n                        updateURL(false);\n                        if (state.loadedJobType !== jobType) {\n                            try {\n                                await loadDescriptorAndConfig(jobType, false);\n                            } catch (e) {\n                                // Already rendered in UI.\n                            }\n                        } else {\n                            if (state.lastDetectionByJobType && state.lastDetectionByJobType[jobType]) {\n                                renderDetectionResult(state.lastDetectionByJobType[jobType]);\n                            } else {\n                                renderDetectionResult(null);\n                            }\n                            await loadRunHistory(jobType);\n                        }\n                        renderQueueJobs();\n                        renderDetectionJobs();\n                        renderExecutionJobs();\n                        renderExecutionActivities();\n                        return;\n                    }\n\n                    var subTab = target.closest('[data-plugin-subtab]');\n                    if (subTab) {\n                        event.preventDefault();\n                        var subTabKey = normalizeSubTab(subTab.getAttribute('data-plugin-subtab'));\n                        state.activeSubTab = subTabKey;\n                        renderNavigationState();\n                        updateURL(false);\n                        return;\n                    }\n\n                    var trigger = target.closest('.plugin-job-link');\n                    if (!trigger) {\n                        return;\n                    }\n                    event.preventDefault();\n                    var jobID = trigger.getAttribute('data-job-id');\n                    if (!jobID) {\n                        return;\n                    }\n                    openJobDetail(jobID);\n                });\n            }\n\n            async function init() {\n                bindActions();\n                renderTopTabs();\n                ensureActiveNavigation();\n                renderNavigationState();\n                await refreshAll();\n\n                // Set the initial browser history state to match the current view\n                updateURL(true);\n\n                state.refreshTimer = setInterval(function() {\n                    refreshAll();\n                }, 3000);\n            }\n\n            window.addEventListener('popstate', async function(event) {\n                var s = event.state;\n                if (!s || !s.pluginTopTab) {\n                    // No plugin state — treat as overview\n                    state.activeTopTab = 'overview';\n                    renderNavigationState();\n                    return;\n                }\n                state.activeTopTab = String(s.pluginTopTab || 'overview');\n                state.activeSubTab = normalizeSubTab(s.pluginSubTab);\n                var jobType = String(s.pluginJob || '').trim();\n                if (jobType) {\n                    state.selectedJobType = jobType;\n                }\n                ensureActiveNavigation();\n                renderNavigationState();\n                // If a job type is selected and not loaded yet, load it\n                if (state.selectedJobType && state.loadedJobType !== state.selectedJobType) {\n                    try {\n                        await loadDescriptorAndConfig(state.selectedJobType, false);\n                    } catch (e) {\n                        console.error('Failed to load data on popstate navigation:', e);\n                    }\n                }\n                renderQueueJobs();\n                renderDetectionJobs();\n                renderExecutionJobs();\n                renderExecutionActivities();\n            });\n\n            window.addEventListener('beforeunload', function() {\n                if (state.refreshTimer) {\n                    clearInterval(state.refreshTimer);\n                    state.refreshTimer = null;\n                }\n            });\n\n            init();\n        })();\n        </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</p></div><div class=\"btn-group\"><button type=\"button\" class=\"btn btn-outline-secondary\" id=\"plugin-refresh-all-btn\"><i class=\"bi bi-arrow-repeat me-1\"></i>Refresh</button></div></div></div></div><div class=\"row mb-3\"><div class=\"col-12\"><ul class=\"nav nav-tabs\" id=\"plugin-top-tabs\"><li class=\"nav-item\"><button type=\"button\" class=\"nav-link active\" data-plugin-top-tab=\"overview\"><i class=\"bi bi-graph-up-arrow me-1\"></i>Overview</button></li></ul></div></div><div class=\"row mb-3 d-none\" id=\"plugin-subtab-row\"><div class=\"col-12\"><ul class=\"nav nav-pills gap-2\" id=\"plugin-subtabs\"><li class=\"nav-item\"><button type=\"button\" class=\"nav-link active\" data-plugin-subtab=\"configuration\"><i class=\"bi bi-sliders me-1\"></i>Configuration</button></li><li class=\"nav-item\"><button type=\"button\" class=\"nav-link\" data-plugin-subtab=\"detection\"><i class=\"bi bi-search me-1\"></i>Job Detection</button></li><li class=\"nav-item\"><button type=\"button\" class=\"nav-link\" data-plugin-subtab=\"queue\"><i class=\"bi bi-list me-1\"></i>Job Queue</button></li><li class=\"nav-item\"><button type=\"button\" class=\"nav-link\" data-plugin-subtab=\"execution\"><i class=\"bi bi-list-check me-1\"></i>Job Execution</button></li></ul></div></div><div class=\"plugin-section plugin-section-overview\"><div class=\"row mb-4\"><div class=\"col-md-3 mb-3\"><div class=\"card border-info h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Workers</div><h4 class=\"mb-0\" id=\"plugin-status-workers\">0</h4></div></div></div><div class=\"col-md-3 mb-3\"><div class=\"card border-warning h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Active Jobs</div><h4 class=\"mb-0\" id=\"plugin-status-active-jobs\">0</h4></div></div></div><div class=\"col-md-3 mb-3\"><div class=\"card border-success h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Activities (recent)</div><h4 class=\"mb-0\" id=\"plugin-status-activities\">0</h4></div></div></div><div class=\"col-md-3 mb-3\"><div class=\"card border-secondary h-100\"><div class=\"card-body text-center\"><div class=\"text-uppercase text-muted small mb-1\">Next Run</div><h4 class=\"mb-0 plugin-scheduler-next-run\">-</h4><div class=\"text-muted small plugin-scheduler-next-run-meta\"></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"bi bi-bar-chart me-2\"></i>Per Job Type Summary</h5></div><div class=\"card-body p-0\"><div class=\"table-responsive\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light\"><tr><th>Job Type</th><th>Active Jobs</th><th>Recent Activities</th></tr></thead> <tbody id=\"plugin-jobtype-summary-body\"><tr><td colspan=\"3\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"bi bi-clock me-2\"></i>Scheduler State</h5><small class=\"text-muted\">Sequential scheduler with per-job runtime limits</small></div><div class=\"card-body p-0\"><div class=\"table-responsive\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light\"><tr><th>Job Type</th><th>Enabled</th><th>Detector</th><th>In Flight</th><th>Max Runtime</th><th>Exec Global</th><th>Exec/Worker</th><th>Executor Workers</th><th>Effective Exec</th><th>Last Run</th></tr></thead> <tbody id=\"plugin-scheduler-table-body\"><tr><td colspan=\"10\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"bi bi-people me-2\"></i>Workers</h5></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 560px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Worker</th><th>Address</th><th>Capabilities</th><th>Load</th></tr></thead> <tbody id=\"plugin-workers-table-body\"><tr><td colspan=\"4\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div><div class=\"plugin-section plugin-section-configuration\"><div class=\"row mb-4\"><div class=\"col-lg-8 mb-3\"><div class=\"card shadow-sm h-100\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"bi bi-sliders me-2\"></i>Job Type Configuration</h5><small class=\"text-muted\" id=\"plugin-config-updated-at\">Not loaded</small></div><div class=\"card-body\"><div class=\"mb-3\"><div class=\"small text-muted\">Selected Job Type</div><div class=\"fw-semibold\" id=\"plugin-selected-job-type\">-</div></div><div class=\"mb-3\"><div class=\"d-flex justify-content-between align-items-center mb-2\"><h6 class=\"mb-0\">Descriptor</h6><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"plugin-refresh-schema-btn\"><i class=\"bi bi-cloud-download me-1\"></i>Refresh Schema</button></div><div class=\"alert alert-light border\" id=\"plugin-descriptor-summary\">Select a job type to load schema and config.</div></div><div class=\"mb-3\"><h6>Admin Config Form</h6><div id=\"plugin-admin-config-form\" class=\"plugin-form-root\"><div class=\"text-muted\">No admin form loaded.</div></div></div><div class=\"mb-3\"><h6>Worker Config Form</h6><div id=\"plugin-worker-config-form\" class=\"plugin-form-root\"><div class=\"text-muted\">No worker form loaded.</div></div></div><div class=\"d-flex flex-wrap gap-2\"><button type=\"button\" class=\"btn btn-primary\" id=\"plugin-save-config-btn\"><i class=\"bi bi-floppy me-1\"></i>Save Config</button> <button type=\"button\" class=\"btn btn-outline-primary\" id=\"plugin-trigger-detection-btn\"><i class=\"bi bi-search me-1\"></i>Run Detection</button> <button type=\"button\" class=\"btn btn-outline-success\" id=\"plugin-run-workflow-btn\"><i class=\"bi bi-play me-1\"></i>Run Detect + Execute</button></div></div></div></div><div class=\"col-lg-4 mb-3\"><div class=\"card shadow-sm\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"bi bi-gear-wide-connected me-2\"></i>Job Scheduling Settings</h5></div><div class=\"card-body\"><div class=\"row g-2\" id=\"plugin-admin-settings-form\"><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-enabled\">Enabled</label><div class=\"form-check form-switch mt-1\"><input class=\"form-check-input\" type=\"checkbox\" id=\"plugin-admin-enabled\"></div></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-detection-interval\">Detection Interval (min)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-detection-interval\" min=\"0\"><div class=\"form-text\">How often to check for new work.</div></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-detection-timeout\">Detection Timeout (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-detection-timeout\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-execution-timeout\">Execution Timeout (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-execution-timeout\" min=\"0\"><div class=\"form-text\">Per-attempt deadline for one job. Size-aware tasks may extend this automatically.</div></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-max-runtime\">Job Type Max Runtime (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-max-runtime\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-max-results\">Max Jobs / Detection</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-max-results\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-global-exec\">Global Execution Concurrency</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-global-exec\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-per-worker-exec\">Per Worker Concurrency</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-per-worker-exec\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-retry-limit\">Retry Limit</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-retry-limit\" min=\"0\"></div><div class=\"col-12\"><label class=\"form-label\" for=\"plugin-admin-retry-backoff\">Retry Backoff (s)</label> <input type=\"number\" class=\"form-control\" id=\"plugin-admin-retry-backoff\" min=\"0\"></div></div></div></div><div class=\"card shadow-sm mt-3\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"bi bi-hourglass-split me-2\"></i>Next Run</h5><small class=\"text-muted\">Scheduler</small></div><div class=\"card-body\"><div class=\"h5 mb-1 plugin-scheduler-next-run\">-</div><div class=\"text-muted small plugin-scheduler-next-run-meta\">Not scheduled</div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-lg-6 mb-3\"><div class=\"card shadow-sm h-100\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"bi bi-clipboard-check me-2\"></i>Run History</h5><small class=\"text-muted\">Keep last 10 success + last 10 errors</small></div><div class=\"card-body\"><div class=\"row\"><div class=\"col-12 mb-3\"><h6 class=\"text-success\">Successful Runs</h6><div class=\"table-responsive\"><table class=\"table table-sm table-striped\"><thead><tr><th>Time</th><th>Job ID</th><th>Worker</th><th>Duration</th></tr></thead> <tbody id=\"plugin-runs-success-body\"><tr><td colspan=\"4\" class=\"text-muted\">No data</td></tr></tbody></table></div></div><div class=\"col-12\"><h6 class=\"text-danger\">Error Runs</h6><div class=\"table-responsive\"><table class=\"table table-sm table-striped\"><thead><tr><th>Time</th><th>Job ID</th><th>Worker</th><th>Error</th></tr></thead> <tbody id=\"plugin-runs-error-body\"><tr><td colspan=\"4\" class=\"text-muted\">No data</td></tr></tbody></table></div></div></div></div></div></div><div class=\"col-lg-6 mb-3\"><div class=\"card shadow-sm h-100\"><div class=\"card-header\"><h5 class=\"mb-0\"><i class=\"bi bi-lightbulb me-2\"></i>Detection Results</h5></div><div class=\"card-body\" id=\"plugin-detection-results\"><div class=\"text-muted\">Run detection to see proposals.</div></div></div></div></div></div><div class=\"plugin-section plugin-section-queue\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"bi bi-list me-2\"></i>Job Queue</h5><div class=\"d-flex gap-2 align-items-center flex-wrap\"><small class=\"text-muted\">States: pending/assigned/running</small></div></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 560px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Job ID</th><th>Type</th><th>State</th><th>Progress</th><th>Worker</th><th>Updated</th><th>Message</th></tr></thead> <tbody id=\"plugin-queue-jobs-table-body\"><tr><td colspan=\"7\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div><div class=\"plugin-section plugin-section-detection\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"bi bi-search me-2\"></i>Detection Jobs</h5><div class=\"small text-muted\">Detection activities for selected job type</div></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 420px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Time</th><th>Job Type</th><th>Request ID</th><th>Worker</th><th>Stage</th><th>Source</th><th>Message</th></tr></thead> <tbody id=\"plugin-detection-table-body\"><tr><td colspan=\"7\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div><div class=\"plugin-section plugin-section-execution\"><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"bi bi-list-check me-2\"></i>Execution Jobs</h5><div class=\"d-flex gap-2 align-items-center flex-wrap\"><select class=\"form-select form-select-sm\" id=\"plugin-monitor-job-state-filter\" style=\"min-width: 180px;\"><option value=\"\">All States</option> <option value=\"assigned\">Assigned</option> <option value=\"running\">Running</option> <option value=\"succeeded\">Succeeded</option> <option value=\"failed\">Failed</option> <option value=\"canceled\">Canceled</option></select></div></div><div class=\"card-body p-0\"><div class=\"table-responsive\"><table class=\"table table-hover mb-0\"><thead class=\"table-light\"><tr><th>Job ID</th><th>Type</th><th>State</th><th>Progress</th><th>Worker</th><th>Updated</th><th>Message</th></tr></thead> <tbody id=\"plugin-execution-jobs-table-body\"><tr><td colspan=\"7\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div><div class=\"row mb-4\"><div class=\"col-12\"><div class=\"card shadow-sm\"><div class=\"card-header d-flex justify-content-between align-items-center flex-wrap gap-2\"><h5 class=\"mb-0\"><i class=\"bi bi-list-nested me-2\"></i>Execution Activities</h5><small class=\"text-muted\">Non-detection events only</small></div><div class=\"card-body p-0\"><div class=\"table-responsive\" style=\"max-height: 420px; overflow-y: auto;\"><table class=\"table table-sm table-hover mb-0\"><thead class=\"table-light sticky-top\"><tr><th>Time</th><th>Job Type</th><th>Job ID</th><th>Source</th><th>Stage</th><th>Message</th></tr></thead> <tbody id=\"plugin-execution-activities-table-body\"><tr><td colspan=\"6\" class=\"text-muted text-center py-3\">Loading...</td></tr></tbody></table></div></div></div></div></div></div></div><div class=\"modal fade\" id=\"plugin-job-detail-modal\" tabindex=\"-1\" aria-labelledby=\"plugin-job-detail-modal-label\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl modal-dialog-scrollable\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"plugin-job-detail-modal-label\"><i class=\"bi bi-file-earmark-text me-2\"></i>Job Detail</h5><div class=\"ms-auto me-2\"><button type=\"button\" class=\"btn btn-outline-danger btn-sm\" id=\"plugin-expire-job-btn\" disabled><i class=\"bi bi-stop-circle me-1\"></i>Expire Job</button></div><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\" id=\"plugin-job-detail-content\"><div class=\"text-muted\">Select a job to view details.</div></div></div></div></div><style>\n        .plugin-section {\n            display: none;\n        }\n\n        .plugin-section.plugin-section-active {\n            display: block;\n        }\n\n        .plugin-form-root .card {\n            border: 1px solid #dee2e6;\n        }\n        .plugin-form-root textarea {\n            min-height: 12rem;\n        }\n\n        .plugin-field-hidden {\n            display: none;\n        }\n\n        .plugin-capability-badge {\n            font-size: 0.72rem;\n            margin-right: 0.25rem;\n        }\n\n        .plugin-job-progress {\n            min-width: 120px;\n        }\n\n        .plugin-detection-item {\n            border: 1px solid #dee2e6;\n            border-radius: 6px;\n            padding: 0.5rem 0.75rem;\n            margin-bottom: 0.5rem;\n            background: #fbfcfd;\n        }\n\n        .plugin-job-link {\n            text-decoration: none;\n        }\n\n        .plugin-job-detail-json {\n            max-height: 220px;\n            overflow: auto;\n            background: #f8f9fa;\n            border: 1px solid #dee2e6;\n            border-radius: 6px;\n            padding: 0.5rem;\n            margin-bottom: 0;\n            font-size: 0.82rem;\n        }\n        </style><script>\n        (function() {\n            var page = document.getElementById('plugin-page');\n            if (!page) {\n                return;\n            }\n\n            var pluginLane = String(page.getAttribute('data-plugin-lane') || '').trim();\n\n            function basePath(path) {\n                return (window.__BASE_PATH__ || '') + path;\n            }\n\n            var state = {\n                selectedJobType: '',\n                jobTypes: [],\n                lastDetectionByJobType: {},\n                initialPage: String(page.getAttribute('data-plugin-page') || 'overview').trim().toLowerCase(),\n                initialJob: String(page.getAttribute('data-plugin-job') || '').trim(),\n                activeTopTab: 'overview',\n                activeSubTab: 'configuration',\n                initialNavigationApplied: false,\n                monitorExecutionJobState: '',\n                workers: [],\n                jobs: [],\n                activities: [],\n                schedulerStates: [],\n                schedulerStatus: null,\n                allJobs: [],\n                allActivities: [],\n                loadedJobType: '',\n                descriptor: null,\n                config: null,\n                refreshTimer: null,\n            };\n\n            // appendLaneParam appends ?lane= or &lane= to a URL if a lane filter is active.\n            function appendLaneParam(url) {\n                if (!pluginLane) return url;\n                var sep = url.indexOf('?') === -1 ? '?' : '&';\n                return url + sep + 'lane=' + encodeURIComponent(pluginLane);\n            }\n\n            function getCSRFToken() {\n                var meta = document.querySelector('meta[name=\"csrf-token\"]');\n                if (!meta) {\n                    return '';\n                }\n                return meta.getAttribute('content') || '';\n            }\n\n            function notify(message, level) {\n                if (typeof window.showAlert === 'function') {\n                    window.showAlert(message, level || 'info');\n                    return;\n                }\n                if (level === 'error') {\n                    console.error(message);\n                }\n                alert(message);\n            }\n\n            async function readResponseJSON(response) {\n                var bodyText = await response.text();\n                if (!bodyText) {\n                    return {};\n                }\n                try {\n                    return JSON.parse(bodyText);\n                } catch (e) {\n                    return { error: bodyText };\n                }\n            }\n\n            async function pluginRequest(method, url, payload) {\n                var headers = {};\n                var requestOptions = {\n                    method: method,\n                    headers: headers,\n                };\n\n                if (payload !== undefined && payload !== null) {\n                    headers['Content-Type'] = 'application/json';\n                    requestOptions.body = JSON.stringify(payload);\n                }\n\n                if (method !== 'GET') {\n                    var csrf = getCSRFToken();\n                    if (csrf) {\n                        headers['X-CSRF-Token'] = csrf;\n                    }\n                }\n\n                var response = await fetch(basePath(url), requestOptions);\n                var data = await readResponseJSON(response);\n                if (!response.ok) {\n                    var message = (data && (data.error || data.message)) ? (data.error || data.message) : ('Request failed: ' + response.status);\n                    var requestError = new Error(message);\n                    requestError.responseData = data;\n                    requestError.responseStatus = response.status;\n                    throw requestError;\n                }\n                return data;\n            }\n\n            function textOrDash(value) {\n                if (value === null || value === undefined || value === '') {\n                    return '-';\n                }\n                return String(value);\n            }\n\n            function escapeHtml(value) {\n                if (value === null || value === undefined) {\n                    return '';\n                }\n                return String(value)\n                    .replace(/&/g, '&amp;')\n                    .replace(/</g, '&lt;')\n                    .replace(/>/g, '&gt;')\n                    .replace(/\"/g, '&quot;')\n                    .replace(/'/g, '&#039;');\n            }\n\n            function encodePath(value) {\n                return encodeURIComponent(value || '');\n            }\n\n            function normalizeEnum(value) {\n                if (value === undefined || value === null) {\n                    return '';\n                }\n                return String(value).toUpperCase();\n            }\n\n            function parseTime(value) {\n                if (!value) {\n                    return '';\n                }\n                var date = new Date(value);\n                if (Number.isNaN(date.getTime())) {\n                    return '';\n                }\n                return date.toLocaleString();\n            }\n\n            function normalizeSubTab(value) {\n                var normalized = String(value || '').toLowerCase();\n                if (normalized === 'configuration' || normalized === 'detection' || normalized === 'queue' || normalized === 'execution') {\n                    return normalized;\n                }\n                return 'configuration';\n            }\n\n            function buildPluginURL(topTab, subTab, jobType) {\n                var laneName = pluginLane || 'default';\n                var laneBase = '/plugin/lanes/' + encodeURIComponent(laneName);\n                if (topTab === 'overview') {\n                    return laneBase;\n                }\n                var effectiveSubTab = normalizeSubTab(subTab);\n                var path = laneBase + '/' + encodeURIComponent(effectiveSubTab);\n                var jt = String(jobType || '').trim();\n                if (jt) {\n                    path += '?job=' + encodeURIComponent(jt);\n                }\n                return path;\n            }\n\n            function updateURL(replace) {\n                var url = basePath(buildPluginURL(state.activeTopTab, state.activeSubTab, state.selectedJobType));\n                if (replace) {\n                    history.replaceState({ pluginTopTab: state.activeTopTab, pluginSubTab: state.activeSubTab, pluginJob: state.selectedJobType }, '', url);\n                } else {\n                    history.pushState({ pluginTopTab: state.activeTopTab, pluginSubTab: state.activeSubTab, pluginJob: state.selectedJobType }, '', url);\n                }\n            }\n\n            // Parse a job type item (string or object) into a safe object shape\n            function parseJobTypeItem(item) {\n                var jobType = '';\n                var displayName = '';\n                \n                if (typeof item === 'string') {\n                    jobType = String(item || '').trim();\n                    displayName = jobType;\n                } else if (item && typeof item === 'object') {\n                    jobType = String(item.job_type || item.jobType || '').trim();\n                    displayName = String(item.display_name || item.displayName || jobType || '').trim();\n                    if (!displayName) {\n                        displayName = jobType;\n                    }\n                }\n                \n                return { jobType: jobType, displayName: displayName };\n            }\n\n            function topTabKeyForJobType(jobType) {\n                var normalized = String(jobType || '').trim();\n                if (!normalized) {\n                    return '';\n                }\n                return 'job:' + normalized;\n            }\n\n            function parseJobTypeFromTopTab(tabKey) {\n                var normalized = String(tabKey || '').trim();\n                if (normalized.indexOf('job:') !== 0) {\n                    return '';\n                }\n                return normalized.slice(4);\n            }\n\n            function hasJobType(jobType) {\n                var normalized = String(jobType || '').trim();\n                if (!normalized) {\n                    return false;\n                }\n                var jobTypes = Array.isArray(state.jobTypes) ? state.jobTypes : [];\n                for (var i = 0; i < jobTypes.length; i++) {\n                    var item = parseJobTypeItem(jobTypes[i]);\n                    if (item.jobType === normalized) {\n                        return true;\n                    }\n                }\n                return false;\n            }\n\n            function applyInitialNavigation() {\n                if (state.initialNavigationApplied) {\n                    return;\n                }\n                state.initialNavigationApplied = true;\n                state.activeSubTab = normalizeSubTab(state.initialPage);\n\n                if (state.initialPage === 'overview') {\n                    state.activeTopTab = 'overview';\n                    return;\n                }\n                if (!Array.isArray(state.jobTypes) || state.jobTypes.length === 0) {\n                    state.activeTopTab = 'overview';\n                    return;\n                }\n                // If a specific job type was provided in the URL, use it\n                if (state.initialJob && hasJobType(state.initialJob)) {\n                    state.selectedJobType = state.initialJob;\n                } else {\n                    var firstItem = parseJobTypeItem(state.jobTypes[0]);\n                    state.selectedJobType = firstItem.jobType;\n                }\n                state.activeTopTab = topTabKeyForJobType(state.selectedJobType);\n            }\n\n            function ensureActiveNavigation() {\n                state.activeSubTab = normalizeSubTab(state.activeSubTab);\n\n                if (state.selectedJobType && !hasJobType(state.selectedJobType)) {\n                    state.selectedJobType = '';\n                    state.descriptor = null;\n                    state.config = null;\n                }\n\n                var topTabJobType = parseJobTypeFromTopTab(state.activeTopTab);\n                if (topTabJobType && !hasJobType(topTabJobType)) {\n                    state.activeTopTab = 'overview';\n                    topTabJobType = '';\n                }\n\n                if (state.activeTopTab === 'overview') {\n                    if (!state.selectedJobType && Array.isArray(state.jobTypes) && state.jobTypes.length > 0) {\n                        var item = parseJobTypeItem(state.jobTypes[0]);\n                        state.selectedJobType = item.jobType;\n                    }\n                    return;\n                }\n\n                if (!topTabJobType && state.selectedJobType) {\n                    topTabJobType = state.selectedJobType;\n                }\n                if (!topTabJobType && Array.isArray(state.jobTypes) && state.jobTypes.length > 0) {\n                    var item = parseJobTypeItem(state.jobTypes[0]);\n                    topTabJobType = item.jobType;\n                }\n                if (!topTabJobType) {\n                    state.activeTopTab = 'overview';\n                    return;\n                }\n\n                state.selectedJobType = topTabJobType;\n                state.activeTopTab = topTabKeyForJobType(topTabJobType);\n            }\n\n            function renderTopTabs() {\n                var root = document.getElementById('plugin-top-tabs');\n                if (!root) {\n                    return;\n                }\n\n                var html = '' +\n                    '<li class=\"nav-item\">' +\n                    '<button type=\"button\" class=\"nav-link\" data-plugin-top-tab=\"overview\">' +\n                    '<i class=\"bi bi-graph-up-arrow me-1\"></i>Overview' +\n                    '</button>' +\n                    '</li>';\n\n                var jobTypes = Array.isArray(state.jobTypes) ? state.jobTypes : [];\n                for (var i = 0; i < jobTypes.length; i++) {\n                    var item = parseJobTypeItem(jobTypes[i]);\n                    var jobType = item.jobType;\n                    var displayName = item.displayName;\n                    \n                    if (!jobType) {\n                        continue;\n                    }\n                    html += '' +\n                        '<li class=\"nav-item\">' +\n                        '<button type=\"button\" class=\"nav-link\" data-plugin-top-tab=\"' + escapeHtml(topTabKeyForJobType(jobType)) + '\">' +\n                        escapeHtml(displayName) +\n                        '</button>' +\n                        '</li>';\n                }\n                root.innerHTML = html;\n            }\n\n            function renderNavigationState() {\n                var selectedJobTypeLabel = document.getElementById('plugin-selected-job-type');\n                if (selectedJobTypeLabel) {\n                    selectedJobTypeLabel.textContent = state.selectedJobType || '-';\n                }\n\n                var isOverview = state.activeTopTab === 'overview';\n                var subtabRow = document.getElementById('plugin-subtab-row');\n                if (subtabRow) {\n                    subtabRow.classList.toggle('d-none', isOverview);\n                }\n\n                var topTabs = document.querySelectorAll('#plugin-top-tabs [data-plugin-top-tab]');\n                for (var i = 0; i < topTabs.length; i++) {\n                    var topTab = topTabs[i];\n                    var topKey = String(topTab.getAttribute('data-plugin-top-tab') || '');\n                    topTab.classList.toggle('active', topKey === state.activeTopTab);\n                }\n\n                var subTabs = document.querySelectorAll('#plugin-subtabs [data-plugin-subtab]');\n                for (var j = 0; j < subTabs.length; j++) {\n                    var subTab = subTabs[j];\n                    var subKey = String(subTab.getAttribute('data-plugin-subtab') || '');\n                    subTab.classList.toggle('active', !isOverview && subKey === state.activeSubTab);\n                }\n\n                function toggleSection(sectionName, visible) {\n                    var section = document.querySelector('.plugin-section-' + sectionName);\n                    if (!section) {\n                        return;\n                    }\n                    section.classList.toggle('plugin-section-active', !!visible);\n                }\n\n                toggleSection('overview', isOverview);\n                toggleSection('configuration', !isOverview && state.activeSubTab === 'configuration');\n                toggleSection('detection', !isOverview && state.activeSubTab === 'detection');\n                toggleSection('queue', !isOverview && state.activeSubTab === 'queue');\n                toggleSection('execution', !isOverview && state.activeSubTab === 'execution');\n            }\n\n            function renderJobLink(jobID) {\n                var normalized = String(jobID || '').trim();\n                if (!normalized) {\n                    return '<small>-</small>';\n                }\n                return '<button type=\"button\" class=\"btn btn-link btn-sm p-0 align-baseline plugin-job-link\" data-job-id=\"' + escapeHtml(normalized) + '\">' + escapeHtml(normalized) + '</button>';\n            }\n\n            function toPrettyJson(value) {\n                if (value === null || value === undefined || value === '') {\n                    return '';\n                }\n                if (typeof value === 'string') {\n                    return value;\n                }\n                try {\n                    return JSON.stringify(value, null, 2);\n                } catch (e) {\n                    return String(value);\n                }\n            }\n\n            function clonePlainObject(value) {\n                if (!value || typeof value !== 'object') {\n                    return null;\n                }\n                try {\n                    return JSON.parse(JSON.stringify(value));\n                } catch (e) {\n                    return null;\n                }\n            }\n\n            function extractExecutionPlan(job) {\n                if (!job || !job.parameters) {\n                    return null;\n                }\n                var plan = job.parameters.execution_plan;\n                if (!plan) {\n                    return null;\n                }\n                if (typeof plan === 'string') {\n                    try {\n                        plan = JSON.parse(plan);\n                    } catch (e) {\n                        return null;\n                    }\n                }\n                if (typeof plan !== 'object' || Array.isArray(plan)) {\n                    return null;\n                }\n                return plan;\n            }\n\n            function removeExecutionPlanForDisplay(parameters) {\n                var copy = clonePlainObject(parameters);\n                if (!copy) {\n                    return parameters;\n                }\n                if (copy.execution_plan !== undefined) {\n                    delete copy.execution_plan;\n                }\n                if (Object.keys(copy).length === 0) {\n                    return null;\n                }\n                return copy;\n            }\n\n            function parseIntOrDefault(value, fallback) {\n                var parsed = parseInt(value, 10);\n                if (Number.isNaN(parsed)) {\n                    return fallback;\n                }\n                return parsed;\n            }\n\n            function normalizeShardIDs(value) {\n                if (!Array.isArray(value)) {\n                    return [];\n                }\n                var out = [];\n                for (var i = 0; i < value.length; i++) {\n                    var parsed = parseIntOrDefault(value[i], -1);\n                    if (parsed >= 0) {\n                        out.push(parsed);\n                    }\n                }\n                out.sort(function(a, b) { return a - b; });\n                return out;\n            }\n\n            function classifyShardLabel(shardID, dataShardCount) {\n                if (shardID < dataShardCount) {\n                    return {\n                        kind: 'data',\n                        label: String(shardID),\n                        className: 'bg-primary',\n                        title: 'Data shard ' + shardID,\n                    };\n                }\n                var parityIndex = shardID - dataShardCount;\n                return {\n                    kind: 'parity',\n                    label: String(shardID),\n                    className: 'bg-warning text-dark',\n                    title: 'Parity shard ' + shardID + ' (index ' + parityIndex + ')',\n                };\n            }\n\n            function renderShardBadges(shardIDs, dataShardCount) {\n                if (!Array.isArray(shardIDs) || shardIDs.length === 0) {\n                    return '<span class=\"text-muted\">-</span>';\n                }\n                var html = '';\n                for (var i = 0; i < shardIDs.length; i++) {\n                    var shard = classifyShardLabel(shardIDs[i], dataShardCount);\n                    html += '<span class=\"badge me-1 ' + shard.className + '\" title=\"' + escapeHtml(shard.title) + '\">' + escapeHtml(shard.label) + '</span>';\n                }\n                return html;\n            }\n\n            function renderExecutionPlan(plan) {\n                if (!plan || typeof plan !== 'object') {\n                    return '';\n                }\n\n                var jobType = String(plan.job_type || '').trim().toLowerCase();\n                if (jobType === 'volume_balance') {\n                    return renderBalanceExecutionPlan(plan);\n                }\n                if (jobType !== 'erasure_coding') {\n                    var fallbackText = toPrettyJson(plan);\n                    if (!fallbackText) {\n                        return '';\n                    }\n                    return '<div class=\"mb-3\"><h6>Execution Plan</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(fallbackText) + '</pre></div>';\n                }\n\n                var dataShards = parseIntOrDefault(plan.data_shards, 10);\n                var parityShards = parseIntOrDefault(plan.parity_shards, 4);\n                var totalShards = parseIntOrDefault(plan.total_shards, dataShards + parityShards);\n                var sources = Array.isArray(plan.sources) ? plan.sources : [];\n                var targets = Array.isArray(plan.targets) ? plan.targets : [];\n                var assignments = Array.isArray(plan.shard_assignments) ? plan.shard_assignments : [];\n\n                var html = '';\n                html += '<div class=\"mb-3\"><h6>Execution Plan</h6>';\n                html += '<div class=\"row g-2 mb-2\">' +\n                    '<div class=\"col-md-3\"><small><strong>Volume:</strong> ' + escapeHtml(textOrDash(plan.volume_id)) + '</small></div>' +\n                    '<div class=\"col-md-3\"><small><strong>Collection:</strong> ' + escapeHtml(textOrDash(plan.collection)) + '</small></div>' +\n                    '<div class=\"col-md-3\"><small><strong>Shards:</strong> ' + escapeHtml(String(dataShards)) + '+' + escapeHtml(String(parityShards)) + '</small></div>' +\n                    '<div class=\"col-md-3\"><small><strong>Total:</strong> ' + escapeHtml(String(totalShards)) + '</small></div>' +\n                    '</div>';\n\n                html += '<div class=\"small text-muted mb-2\">' +\n                    '<span class=\"badge bg-primary me-1\">Data</span>' +\n                    '<span class=\"badge bg-warning text-dark me-2\">Parity</span>' +\n                    'Source and target placement per shard.' +\n                    '</div>';\n\n                function renderEndpointsTable(title, endpoints) {\n                    if (!endpoints.length) {\n                        return '<div class=\"mb-2\"><strong>' + escapeHtml(title) + ':</strong> <span class=\"text-muted\">none</span></div>';\n                    }\n                    var table = '<div class=\"table-responsive mb-2\"><table class=\"table table-sm table-striped mb-0\">' +\n                        '<thead><tr><th>#</th><th>Node</th><th>DC</th><th>Rack</th><th>Volume</th><th>Shards</th></tr></thead><tbody>';\n                    for (var i = 0; i < endpoints.length; i++) {\n                        var endpoint = endpoints[i] || {};\n                        var endpointShards = normalizeShardIDs(endpoint.shard_ids);\n                        table += '<tr>' +\n                            '<td>' + escapeHtml(String(i + 1)) + '</td>' +\n                            '<td><code>' + escapeHtml(textOrDash(endpoint.node)) + '</code></td>' +\n                            '<td>' + escapeHtml(textOrDash(endpoint.data_center)) + '</td>' +\n                            '<td>' + escapeHtml(textOrDash(endpoint.rack)) + '</td>' +\n                            '<td>' + escapeHtml(textOrDash(endpoint.volume_id)) + '</td>' +\n                            '<td>' + renderShardBadges(endpointShards, dataShards) + '</td>' +\n                            '</tr>';\n                    }\n                    table += '</tbody></table></div>';\n                    return '<div class=\"mb-2\"><strong>' + escapeHtml(title) + '</strong></div>' + table;\n                }\n\n                html += renderEndpointsTable('Sources', sources);\n                html += renderEndpointsTable('Targets', targets);\n\n                if (assignments.length) {\n                    html += '<div class=\"mb-2\"><strong>Shard Assignments</strong></div>';\n                    html += '<div class=\"table-responsive\"><table class=\"table table-sm table-striped mb-0\">' +\n                        '<thead><tr><th>Shard</th><th>Kind</th><th>Target</th><th>DC</th><th>Rack</th></tr></thead><tbody>';\n                    for (var j = 0; j < assignments.length; j++) {\n                        var assignment = assignments[j] || {};\n                        var shardID = parseIntOrDefault(assignment.shard_id, -1);\n                        if (shardID < 0) {\n                            continue;\n                        }\n                        var shard = classifyShardLabel(shardID, dataShards);\n                        html += '<tr>' +\n                            '<td><span class=\"badge ' + shard.className + '\">' + escapeHtml(shard.label) + '</span></td>' +\n                            '<td>' + escapeHtml(textOrDash(assignment.kind || shard.kind)) + '</td>' +\n                            '<td><code>' + escapeHtml(textOrDash(assignment.target_node)) + '</code></td>' +\n                            '<td>' + escapeHtml(textOrDash(assignment.target_data_center)) + '</td>' +\n                            '<td>' + escapeHtml(textOrDash(assignment.target_rack)) + '</td>' +\n                            '</tr>';\n                    }\n                    html += '</tbody></table></div>';\n                }\n\n                html += '</div>';\n                return html;\n            }\n\n            function renderBalanceExecutionPlan(plan) {\n                var html = '<div class=\"mb-3\"><h6>Execution Plan</h6>';\n                var moves = Array.isArray(plan.moves) ? plan.moves : [];\n\n                if (moves.length === 0) {\n                    // Single-move balance job\n                    var src = textOrDash(plan.source_node || plan.source_server);\n                    var dst = textOrDash(plan.target_node || plan.target_server);\n                    var vid = textOrDash(plan.volume_id);\n                    var col = textOrDash(plan.collection);\n                    html += `<div class=\"row g-2 mb-2\">\n                        <div class=\"col-md-3\"><small><strong>Volume:</strong> ${escapeHtml(vid)}</small></div>\n                        <div class=\"col-md-3\"><small><strong>Collection:</strong> ${escapeHtml(col)}</small></div>\n                        <div class=\"col-md-3\"><small><strong>Source:</strong> <code>${escapeHtml(src)}</code></small></div>\n                        <div class=\"col-md-3\"><small><strong>Target:</strong> <code>${escapeHtml(dst)}</code></small></div>\n                        </div>`;\n                } else {\n                    // Batch balance job\n                    html += '<div class=\"mb-2\"><span class=\"badge bg-info\">' + escapeHtml(String(moves.length)) + ' moves</span></div>';\n                    html += '<div class=\"table-responsive\"><table class=\"table table-sm table-striped mb-0\">' +\n                        '<thead><tr><th>#</th><th>Volume</th><th>Source</th><th>Target</th><th>Collection</th></tr></thead><tbody>';\n                    for (var i = 0; i < moves.length; i++) {\n                        var move = moves[i] || {};\n                        html += `<tr>\n                            <td>${escapeHtml(String(i + 1))}</td>\n                            <td>${escapeHtml(textOrDash(move.volume_id))}</td>\n                            <td><code>${escapeHtml(textOrDash(move.source_node))}</code></td>\n                            <td><code>${escapeHtml(textOrDash(move.target_node))}</code></td>\n                            <td>${escapeHtml(textOrDash(move.collection))}</td>\n                        </tr>`;\n                    }\n                    html += '</tbody></table></div>';\n                }\n\n                html += '</div>';\n                return html;\n            }\n\n            function isActiveJobState(candidateState) {\n                var jobState = candidateState;\n                if (candidateState && typeof candidateState === 'object' && candidateState.state !== undefined) {\n                    jobState = candidateState.state;\n                }\n                var st = String(jobState || '').toLowerCase();\n                return st === 'job_state_pending' || st === 'job_state_assigned' || st === 'job_state_running' ||\n                    st === 'pending' || st === 'assigned' || st === 'running' || st === 'in_progress';\n            }\n\n            function setExpireButtonState(job) {\n                var expireBtn = document.getElementById('plugin-expire-job-btn');\n                if (!expireBtn) {\n                    return;\n                }\n                var jobID = job && job.job_id ? String(job.job_id) : '';\n                var active = isActiveJobState(job);\n                expireBtn.setAttribute('data-job-id', jobID);\n                expireBtn.disabled = !jobID || !active;\n                if (!jobID) {\n                    expireBtn.title = 'Select a job to expire.';\n                } else if (!active) {\n                    expireBtn.title = 'Job is not active.';\n                } else {\n                    expireBtn.title = 'Expire job to unblock scheduling.';\n                }\n            }\n\n            async function expireJob(jobID) {\n                var normalizedJobID = String(jobID || '').trim();\n                if (!normalizedJobID) {\n                    return;\n                }\n\n                var reason = window.prompt('Expire job ' + normalizedJobID + '? Optional reason:', 'job expired by admin request');\n                if (reason === null) {\n                    return;\n                }\n\n                var expireBtn = document.getElementById('plugin-expire-job-btn');\n                if (expireBtn) {\n                    expireBtn.disabled = true;\n                }\n\n                try {\n                    var response = await pluginRequest('POST', '/api/plugin/jobs/' + encodePath(normalizedJobID) + '/expire', {\n                        reason: reason,\n                    });\n                    if (response && response.expired === false) {\n                        notify(response.message || 'Job is not active.', 'info');\n                    } else {\n                        notify('Job expired: ' + normalizedJobID, 'success');\n                    }\n                    await refreshJobsAndActivities();\n                    await openJobDetail(normalizedJobID);\n                } catch (e) {\n                    notify('Failed to expire job: ' + e.message, 'error');\n                }\n            }\n\n            async function openJobDetail(jobID) {\n                var normalizedJobID = String(jobID || '').trim();\n                if (!normalizedJobID) {\n                    return;\n                }\n\n                var modalElement = document.getElementById('plugin-job-detail-modal');\n                var contentRoot = document.getElementById('plugin-job-detail-content');\n                if (!modalElement || !contentRoot) {\n                    return;\n                }\n\n                var modal;\n                if (window.bootstrap && window.bootstrap.Modal) {\n                    modal = window.bootstrap.Modal.getOrCreateInstance(modalElement);\n                }\n                if (modal) {\n                    modal.show();\n                }\n\n                setExpireButtonState(null);\n                contentRoot.innerHTML = '<div class=\"text-muted\">Loading job detail...</div>';\n                try {\n                    var detail = await pluginRequest('GET', '/api/plugin/jobs/' + encodePath(normalizedJobID) + '/detail?activity_limit=500&related_limit=20');\n                    var job = (detail && detail.job) ? detail.job : {};\n                    setExpireButtonState(job);\n                    var runRecord = detail && detail.run_record ? detail.run_record : null;\n                    var activities = (detail && Array.isArray(detail.activities)) ? detail.activities : [];\n                    var relatedJobs = (detail && Array.isArray(detail.related_jobs)) ? detail.related_jobs : [];\n                    var html = '';\n\n                    html += '<div class=\"row g-3 mb-3\">' +\n                        '<div class=\"col-lg-8\">' +\n                        '<div><strong>Job ID:</strong> ' + escapeHtml(textOrDash(job.job_id || normalizedJobID)) + '</div>' +\n                        '<div><strong>Type:</strong> ' + escapeHtml(textOrDash(job.job_type)) + '</div>' +\n                        '<div><strong>State:</strong> ' + escapeHtml(textOrDash(job.state)) + '</div>' +\n                        '<div><strong>Worker:</strong> ' + escapeHtml(textOrDash(job.worker_id)) + '</div>' +\n                        '<div><strong>Updated:</strong> ' + escapeHtml(parseTime(job.updated_at) || '-') + '</div>' +\n                        '</div>' +\n                        '<div class=\"col-lg-4\">' +\n                        '<div><strong>Attempt:</strong> ' + escapeHtml(textOrDash(job.attempt)) + '</div>' +\n                        '<div><strong>Progress:</strong> ' + escapeHtml(String(Math.round(Number(job.progress || 0)))) + '%</div>' +\n                        '<div><strong>Created:</strong> ' + escapeHtml(parseTime(job.created_at) || '-') + '</div>' +\n                        '<div><strong>Completed:</strong> ' + escapeHtml(parseTime(job.completed_at) || '-') + '</div>' +\n                        '</div>' +\n                        '</div>';\n\n                    if (job.summary) {\n                        html += '<div class=\"mb-2\"><strong>Summary:</strong> ' + escapeHtml(String(job.summary)) + '</div>';\n                    }\n                    if (job.detail) {\n                        html += '<div class=\"mb-2\"><strong>Detail:</strong> ' + escapeHtml(String(job.detail)) + '</div>';\n                    }\n                    if (job.message) {\n                        html += '<div class=\"mb-2\"><strong>Message:</strong> ' + escapeHtml(String(job.message)) + '</div>';\n                    }\n                    if (job.error_message) {\n                        html += '<div class=\"mb-2 text-danger\"><strong>Error:</strong> ' + escapeHtml(String(job.error_message)) + '</div>';\n                    }\n                    if (job.result_summary) {\n                        html += '<div class=\"mb-2\"><strong>Result:</strong> ' + escapeHtml(String(job.result_summary)) + '</div>';\n                    }\n\n                    var executionPlan = extractExecutionPlan(job);\n                    if (executionPlan) {\n                        html += renderExecutionPlan(executionPlan);\n                    }\n\n                    var parametersText = toPrettyJson(removeExecutionPlanForDisplay(job.parameters));\n                    if (parametersText) {\n                        html += '<div class=\"mb-3\"><h6>Parameters</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(parametersText) + '</pre></div>';\n                    }\n                    var labelsText = toPrettyJson(job.labels);\n                    if (labelsText) {\n                        html += '<div class=\"mb-3\"><h6>Labels</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(labelsText) + '</pre></div>';\n                    }\n                    var outputsText = toPrettyJson(job.result_output_values);\n                    if (outputsText) {\n                        html += '<div class=\"mb-3\"><h6>Result Output Values</h6><pre class=\"plugin-job-detail-json\">' + escapeHtml(outputsText) + '</pre></div>';\n                    }\n\n                    if (runRecord) {\n                        html += '<div class=\"mb-3\"><h6>Run Record</h6>' +\n                            '<div><strong>Outcome:</strong> ' + escapeHtml(textOrDash(runRecord.outcome)) + '</div>' +\n                            '<div><strong>Duration:</strong> ' + escapeHtml(formatDurationMs(runRecord.duration_ms)) + '</div>' +\n                            '<div><strong>Completed:</strong> ' + escapeHtml(parseTime(runRecord.completed_at) || '-') + '</div>' +\n                            '<div><strong>Message:</strong> ' + escapeHtml(textOrDash(runRecord.message)) + '</div>' +\n                            '</div>';\n                    }\n\n                    html += '<h6 class=\"mt-3\">Activity Timeline</h6>';\n                    if (!activities.length) {\n                        html += '<div class=\"text-muted mb-3\">No activity records.</div>';\n                    } else {\n                        html += '<div class=\"table-responsive mb-3\"><table class=\"table table-sm table-striped\">' +\n                            '<thead><tr><th>Time</th><th>Stage</th><th>Source</th><th>Worker</th><th>Message</th></tr></thead><tbody>';\n                        for (var i = 0; i < activities.length; i++) {\n                            var activity = activities[i] || {};\n                            html += '<tr>' +\n                                '<td><small>' + escapeHtml(parseTime(activity.occurred_at) || '-') + '</small></td>' +\n                                '<td>' + escapeHtml(textOrDash(activity.stage)) + '</td>' +\n                                '<td>' + escapeHtml(textOrDash(activity.source)) + '</td>' +\n                                '<td>' + escapeHtml(textOrDash(activity.worker_id)) + '</td>' +\n                                '<td><small>' + escapeHtml(textOrDash(activity.message)) + '</small></td>' +\n                                '</tr>';\n                        }\n                        html += '</tbody></table></div>';\n                    }\n\n                    if (relatedJobs.length) {\n                        html += '<h6>Related Jobs</h6><div class=\"table-responsive\"><table class=\"table table-sm table-hover\">' +\n                            '<thead><tr><th>Job ID</th><th>State</th><th>Worker</th><th>Updated</th></tr></thead><tbody>';\n                        for (var j = 0; j < relatedJobs.length; j++) {\n                            var related = relatedJobs[j] || {};\n                            html += '<tr>' +\n                                '<td><small>' + escapeHtml(textOrDash(related.job_id)) + '</small></td>' +\n                                '<td>' + escapeHtml(textOrDash(related.state)) + '</td>' +\n                                '<td>' + escapeHtml(textOrDash(related.worker_id)) + '</td>' +\n                                '<td><small>' + escapeHtml(parseTime(related.updated_at) || '-') + '</small></td>' +\n                                '</tr>';\n                        }\n                        html += '</tbody></table></div>';\n                    }\n\n                    contentRoot.innerHTML = html;\n                } catch (e) {\n                    setExpireButtonState(null);\n                    contentRoot.innerHTML = '<div class=\"alert alert-danger mb-0\">Failed to load job detail: ' + escapeHtml(e.message) + '</div>';\n                }\n            }\n\n            function formatDurationMs(value) {\n                var ms = Number(value || 0);\n                if (!Number.isFinite(ms) || ms <= 0) {\n                    return '-';\n                }\n                if (ms < 1000) {\n                    return ms + 'ms';\n                }\n                var sec = Math.floor(ms / 1000);\n                var remainMs = ms % 1000;\n                if (sec < 60) {\n                    return sec + '.' + String(Math.floor(remainMs / 100)) + 's';\n                }\n                var min = Math.floor(sec / 60);\n                var remainSec = sec % 60;\n                return min + 'm ' + remainSec + 's';\n            }\n\n            function getWorkerField(worker, name) {\n                if (!worker) {\n                    return null;\n                }\n                if (worker[name] !== undefined) {\n                    return worker[name];\n                }\n                var camel = name.charAt(0).toUpperCase() + name.slice(1);\n                if (worker[camel] !== undefined) {\n                    return worker[camel];\n                }\n                return null;\n            }\n\n            function renderStatus() {\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n\n                var activeCount = allJobs.filter(function(job) {\n                    return isActiveJobState(job);\n                }).length;\n\n                document.getElementById('plugin-status-workers').textContent = String(state.workers.length);\n                document.getElementById('plugin-status-active-jobs').textContent = String(activeCount);\n                document.getElementById('plugin-status-activities').textContent = String(allActivities.length);\n            }\n\n            function renderJobTypeSummary() {\n                var tbody = document.getElementById('plugin-jobtype-summary-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var activeByType = {};\n                var activityByType = {};\n\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n\n                for (var i = 0; i < allJobs.length; i++) {\n                    var job = allJobs[i] || {};\n                    var jobType = String(job.job_type || '').trim();\n                    if (!jobType) {\n                        continue;\n                    }\n                    var isActive = isActiveJobState(job);\n                    if (!isActive) {\n                        continue;\n                    }\n                    if (!activeByType[jobType]) {\n                        activeByType[jobType] = 0;\n                    }\n                    activeByType[jobType]++;\n                }\n\n                for (var j = 0; j < allActivities.length; j++) {\n                    var activity = allActivities[j] || {};\n                    var activityJobType = String(activity.job_type || '').trim();\n                    if (!activityJobType) {\n                        continue;\n                    }\n                    if (!activityByType[activityJobType]) {\n                        activityByType[activityJobType] = 0;\n                    }\n                    activityByType[activityJobType]++;\n                }\n\n                var known = Array.isArray(state.jobTypes) ? state.jobTypes.slice() : [];\n                var seen = {};\n                var jobTypes = [];\n\n                for (var k = 0; k < known.length; k++) {\n                    var item = parseJobTypeItem(known[k]);\n                    var knownType = item && item.jobType ? String(item.jobType).trim() : '';\n                    if (!knownType || seen[knownType]) {\n                        continue;\n                    }\n                    seen[knownType] = true;\n                    jobTypes.push(knownType);\n                }\n\n                Object.keys(activeByType).forEach(function(jobType) {\n                    if (!seen[jobType]) {\n                        seen[jobType] = true;\n                        jobTypes.push(jobType);\n                    }\n                });\n                Object.keys(activityByType).forEach(function(jobType) {\n                    if (!seen[jobType]) {\n                        seen[jobType] = true;\n                        jobTypes.push(jobType);\n                    }\n                });\n\n                jobTypes.sort();\n\n                if (jobTypes.length === 0) {\n                    tbody.innerHTML = '<tr><td colspan=\\\"3\\\" class=\\\"text-muted text-center py-3\\\">No job types discovered</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var m = 0; m < jobTypes.length; m++) {\n                    var rowType = jobTypes[m];\n                    rows += '<tr>' +\n                        '<td>' + escapeHtml(rowType) + '</td>' +\n                        '<td><span class=\\\"badge bg-warning text-dark\\\">' + escapeHtml(String(activeByType[rowType] || 0)) + '</span></td>' +\n                        '<td><span class=\\\"badge bg-info\\\">' + escapeHtml(String(activityByType[rowType] || 0)) + '</span></td>' +\n                        '</tr>';\n                }\n                tbody.innerHTML = rows;\n            }\n\n            function computeEffectiveExecutionCapacity(globalExec, perWorkerExec, executorWorkers) {\n                var capacities = [];\n                if (globalExec > 0) {\n                    capacities.push(globalExec);\n                }\n                var workerCapacity = perWorkerExec > 0 && executorWorkers > 0 ? (perWorkerExec * executorWorkers) : 0;\n                if (workerCapacity > 0) {\n                    capacities.push(workerCapacity);\n                }\n                if (!capacities.length) {\n                    return 0;\n                }\n                var effective = capacities[0];\n                for (var i = 1; i < capacities.length; i++) {\n                    if (capacities[i] < effective) {\n                        effective = capacities[i];\n                    }\n                }\n                return effective;\n            }\n\n            function renderSchedulerStates() {\n                var tbody = document.getElementById('plugin-scheduler-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var states = Array.isArray(state.schedulerStates) ? state.schedulerStates : [];\n                if (!states.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"10\" class=\"text-muted text-center py-3\">No scheduler state available</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var i = 0; i < states.length; i++) {\n                    var item = states[i] || {};\n                    var enabled = !!item.enabled;\n                    var inFlight = !!item.detection_in_flight;\n                    var detector = item.detector_available ? textOrDash(item.detector_worker_id) : 'No detector';\n                    var maxRuntimeSeconds = Number(item.job_type_max_runtime_seconds || 0);\n                    var maxRuntimeText = maxRuntimeSeconds > 0 ? (String(maxRuntimeSeconds) + 's') : '-';\n                    var globalExec = Number(item.global_execution_concurrency || 0);\n                    var perWorkerExec = Number(item.per_worker_execution_concurrency || 0);\n                    var executorWorkers = Number(item.executor_worker_count || 0);\n                    var effectiveExec = computeEffectiveExecutionCapacity(globalExec, perWorkerExec, executorWorkers);\n                    var globalExecText = enabled ? String(globalExec) : '-';\n                    var perWorkerExecText = enabled ? String(perWorkerExec) : '-';\n                    var executorWorkersText = enabled ? String(executorWorkers) : '-';\n                    var effectiveExecText = enabled ? String(effectiveExec) : '-';\n                    var lastRunStatus = textOrDash(item.last_run_status);\n                    var lastRunTime = parseTime(item.last_run_completed_at);\n                    var lastRunText = '-';\n                    if (lastRunStatus !== '-' || lastRunTime) {\n                        var statusLabel = lastRunStatus !== '-' ? lastRunStatus : 'run';\n                        lastRunText = lastRunTime ? (statusLabel + ' @ ' + lastRunTime) : statusLabel;\n                    }\n\n                    var enabledBadge = enabled ? '<span class=\"badge bg-success\">Enabled</span>' : '<span class=\"badge bg-secondary\">Disabled</span>';\n                    var inFlightBadge = inFlight ? '<span class=\"badge bg-warning text-dark\">Yes</span>' : '<span class=\"badge bg-light text-dark\">No</span>';\n                    var policyErrorHtml = '';\n                    if (item.policy_error) {\n                        policyErrorHtml = '<div><small class=\"text-danger\">' + escapeHtml(String(item.policy_error)) + '</small></div>';\n                    }\n\n                    rows += '<tr>' +\n                        '<td>' + escapeHtml(textOrDash(item.job_type)) + policyErrorHtml + '</td>' +\n                        '<td>' + enabledBadge + '</td>' +\n                        '<td><small>' + escapeHtml(detector) + '</small></td>' +\n                        '<td>' + inFlightBadge + '</td>' +\n                        '<td><small>' + escapeHtml(maxRuntimeText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(globalExecText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(perWorkerExecText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(executorWorkersText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(effectiveExecText) + '</small></td>' +\n                        '<td><small>' + escapeHtml(lastRunText) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderSchedulerStatus() {\n                var valueNodes = document.querySelectorAll('.plugin-scheduler-next-run');\n                if (!valueNodes.length) {\n                    return;\n                }\n                var metaNodes = document.querySelectorAll('.plugin-scheduler-next-run-meta');\n                var status = state.schedulerStatus || {};\n                var nextRun = parseTime(status.next_detection_at);\n                var display = nextRun || '-';\n                valueNodes.forEach(function(node) {\n                    node.textContent = display;\n                });\n                var metaText = nextRun ? 'Local time' : 'Not scheduled';\n                if (metaNodes.length) {\n                    metaNodes.forEach(function(node) {\n                        node.textContent = metaText;\n                    });\n                }\n            }\n\n            function renderWorkers() {\n                var tbody = document.getElementById('plugin-workers-table-body');\n                if (!state.workers.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"4\" class=\"text-muted text-center py-3\">No connected workers</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var i = 0; i < state.workers.length; i++) {\n                    var worker = state.workers[i];\n                    var workerID = textOrDash(getWorkerField(worker, 'workerID'));\n                    var address = textOrDash(getWorkerField(worker, 'address'));\n                    var caps = getWorkerField(worker, 'capabilities') || {};\n                    var capBadges = [];\n\n                    Object.keys(caps).sort().forEach(function(jobType) {\n                        var cap = caps[jobType] || {};\n                        var labels = [];\n                        if (cap.can_detect) {\n                            labels.push('D');\n                        }\n                        if (cap.can_execute) {\n                            labels.push('E');\n                        }\n                        var text = jobType;\n                        if (labels.length) {\n                            text += ' (' + labels.join('/') + ')';\n                        }\n                        capBadges.push('<span class=\"badge bg-secondary plugin-capability-badge\">' + escapeHtml(text) + '</span>');\n                    });\n\n                    if (!capBadges.length) {\n                        capBadges.push('<span class=\"text-muted\">-</span>');\n                    }\n\n                    var heartbeat = getWorkerField(worker, 'heartbeat') || {};\n                    var detUsed = Number(heartbeat.detection_slots_used || heartbeat.DetectionSlotsUsed || 0);\n                    var detTotal = Number(heartbeat.detection_slots_total || heartbeat.DetectionSlotsTotal || 0);\n                    var execUsed = Number(heartbeat.execution_slots_used || heartbeat.ExecutionSlotsUsed || 0);\n                    var execTotal = Number(heartbeat.execution_slots_total || heartbeat.ExecutionSlotsTotal || 0);\n                    var runningWork = heartbeat.running_work || heartbeat.RunningWork || [];\n                    var queuedByType = heartbeat.queued_jobs_by_type || heartbeat.QueuedJobsByType || {};\n                    var queuedTotal = 0;\n                    Object.keys(queuedByType || {}).forEach(function(jobType) {\n                        var queuedCount = Number(queuedByType[jobType] || 0);\n                        if (Number.isFinite(queuedCount) && queuedCount > 0) {\n                            queuedTotal += queuedCount;\n                        }\n                    });\n                    var loadLines = [];\n                    loadLines.push('Detect: ' + String(detUsed) + '/' + String(detTotal));\n                    loadLines.push('Execute: ' + String(execUsed) + '/' + String(execTotal));\n                    loadLines.push('Running: ' + String(Array.isArray(runningWork) ? runningWork.length : 0));\n                    loadLines.push('Queued: ' + String(queuedTotal));\n\n                    rows += '<tr>' +\n                        '<td><div class=\"fw-semibold\">' + escapeHtml(workerID) + '</div></td>' +\n                        '<td><small>' + escapeHtml(address) + '</small></td>' +\n                        '<td>' + capBadges.join('') + '</td>' +\n                        '<td><small>' + escapeHtml(loadLines.join(' | ')) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function normalizeJobStateForFilter(value) {\n                var normalized = String(value || '').toLowerCase();\n                if (normalized.indexOf('job_state_') === 0) {\n                    normalized = normalized.slice('job_state_'.length);\n                }\n                return normalized;\n            }\n\n            function matchesExecutionStateFilter(jobState, selectedFilter) {\n                var target = normalizeJobStateForFilter(selectedFilter);\n                if (!target) {\n                    return true;\n                }\n                var actual = normalizeJobStateForFilter(jobState);\n                if (actual === target) {\n                    return true;\n                }\n                if (target === 'running' && actual === 'in_progress') {\n                    return true;\n                }\n                return false;\n            }\n\n            function isDetectionActivitySource(source) {\n                var normalized = String(source || '').toLowerCase();\n                if (!normalized) {\n                    return false;\n                }\n                if (normalized === 'worker_detection') {\n                    return true;\n                }\n                return normalized.indexOf('detector') >= 0;\n            }\n\n            function renderExecutionJobs() {\n                var tbody = document.getElementById('plugin-execution-jobs-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredJobs = [];\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                for (var i = 0; i < allJobs.length; i++) {\n                    var job = allJobs[i] || {};\n                    var jobType = String(job.job_type || '').trim();\n                    if (state.selectedJobType && jobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    if (!matchesExecutionStateFilter(job.state, state.monitorExecutionJobState)) {\n                        continue;\n                    }\n                    filteredJobs.push(job);\n                }\n\n                if (!filteredJobs.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"7\" class=\"text-muted text-center py-3\">No execution jobs tracked yet</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredJobs.length; j++) {\n                    var executionJob = filteredJobs[j] || {};\n                    var progress = Number(executionJob.progress || 0);\n                    if (!Number.isFinite(progress) || progress < 0) {\n                        progress = 0;\n                    }\n                    if (progress > 100) {\n                        progress = 100;\n                    }\n\n                    var barClass = 'bg-info';\n                    var stateText = String(executionJob.state || 'unknown').toLowerCase();\n                    if (stateText.indexOf('failed') >= 0) {\n                        barClass = 'bg-danger';\n                    } else if (stateText.indexOf('succeed') >= 0 || stateText.indexOf('complete') >= 0) {\n                        barClass = 'bg-success';\n                    } else if (stateText.indexOf('run') >= 0 || stateText.indexOf('progress') >= 0) {\n                        barClass = 'bg-warning';\n                    }\n\n                    var jobTypeCell = escapeHtml(textOrDash(executionJob.job_type));\n                    var execLabels = executionJob.labels || {};\n                    if (execLabels.batch === 'true' && execLabels.batch_size) {\n                        jobTypeCell += ' <span class=\"badge bg-info\">' + escapeHtml(execLabels.batch_size) + ' moves</span>';\n                    }\n\n                    rows += '<tr>' +\n                        '<td>' + renderJobLink(executionJob.job_id) + '</td>' +\n                        '<td>' + jobTypeCell + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(executionJob.state)) + '</span></td>' +\n                        '<td class=\"plugin-job-progress\"><div class=\"progress\" style=\"height: 14px;\"><div class=\"progress-bar ' + barClass + '\" role=\"progressbar\" style=\"width:' + progress + '%\">' + Math.round(progress) + '%</div></div></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(executionJob.worker_id)) + '</small></td>' +\n                        '<td><small>' + escapeHtml(parseTime(executionJob.updated_at) || '-') + '</small></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(executionJob.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderQueueJobs() {\n                var tbody = document.getElementById('plugin-queue-jobs-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredJobs = [];\n                var allJobs = Array.isArray(state.allJobs) ? state.allJobs : [];\n                for (var i = 0; i < allJobs.length; i++) {\n                    var queueJob = allJobs[i] || {};\n                    var queueJobType = String(queueJob.job_type || '').trim();\n                    if (state.selectedJobType && queueJobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    var normalizedState = normalizeJobStateForFilter(queueJob.state);\n                    if (normalizedState !== 'pending' && normalizedState !== 'assigned' && normalizedState !== 'running' && normalizedState !== 'in_progress') {\n                        continue;\n                    }\n                    filteredJobs.push(queueJob);\n                }\n\n                if (!filteredJobs.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"7\" class=\"text-muted text-center py-3\">No queued/active jobs</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredJobs.length; j++) {\n                    var queueItem = filteredJobs[j] || {};\n                    var progress = Number(queueItem.progress || 0);\n                    if (!Number.isFinite(progress) || progress < 0) {\n                        progress = 0;\n                    }\n                    if (progress > 100) {\n                        progress = 100;\n                    }\n\n                    var barClass = 'bg-warning';\n                    var queueStateText = String(queueItem.state || 'unknown').toLowerCase();\n                    if (queueStateText.indexOf('run') >= 0 || queueStateText.indexOf('progress') >= 0) {\n                        barClass = 'bg-info';\n                    }\n\n                    rows += '<tr>' +\n                        '<td>' + renderJobLink(queueItem.job_id) + '</td>' +\n                        '<td>' + escapeHtml(textOrDash(queueItem.job_type)) + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(queueItem.state)) + '</span></td>' +\n                        '<td class=\"plugin-job-progress\"><div class=\"progress\" style=\"height: 14px;\"><div class=\"progress-bar ' + barClass + '\" role=\"progressbar\" style=\"width:' + progress + '%\">' + Math.round(progress) + '%</div></div></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(queueItem.worker_id)) + '</small></td>' +\n                        '<td><small>' + escapeHtml(parseTime(queueItem.updated_at) || '-') + '</small></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(queueItem.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderDetectionJobs() {\n                var tbody = document.getElementById('plugin-detection-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredActivities = [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n                for (var i = 0; i < allActivities.length; i++) {\n                    var activity = allActivities[i] || {};\n                    var jobType = String(activity.job_type || '').trim();\n                    if (state.selectedJobType && jobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    if (!isDetectionActivitySource(activity.source)) {\n                        continue;\n                    }\n                    filteredActivities.push(activity);\n                }\n\n                if (!filteredActivities.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"7\" class=\"text-muted text-center py-3\">No detection jobs tracked yet</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredActivities.length; j++) {\n                    var detectionActivity = filteredActivities[j] || {};\n                    rows += '<tr>' +\n                        '<td><small>' + escapeHtml(parseTime(detectionActivity.occurred_at) || '-') + '</small></td>' +\n                        '<td>' + escapeHtml(textOrDash(detectionActivity.job_type)) + '</td>' +\n                        '<td><small>' + escapeHtml(textOrDash(detectionActivity.request_id)) + '</small></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(detectionActivity.worker_id)) + '</small></td>' +\n                        '<td>' + escapeHtml(textOrDash(detectionActivity.stage)) + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(detectionActivity.source)) + '</span></td>' +\n                        '<td><small>' + escapeHtml(textOrDash(detectionActivity.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function renderExecutionActivities() {\n                var tbody = document.getElementById('plugin-execution-activities-table-body');\n                if (!tbody) {\n                    return;\n                }\n\n                var filteredActivities = [];\n                var allActivities = Array.isArray(state.allActivities) ? state.allActivities : [];\n                for (var i = 0; i < allActivities.length; i++) {\n                    var activity = allActivities[i] || {};\n                    if (isDetectionActivitySource(activity.source)) {\n                        continue;\n                    }\n                    var jobType = String(activity.job_type || '').trim();\n                    if (state.selectedJobType && jobType !== state.selectedJobType) {\n                        continue;\n                    }\n                    filteredActivities.push(activity);\n                }\n\n                if (!filteredActivities.length) {\n                    tbody.innerHTML = '<tr><td colspan=\"6\" class=\"text-muted text-center py-3\">No execution activities yet</td></tr>';\n                    return;\n                }\n\n                var rows = '';\n                for (var j = 0; j < filteredActivities.length; j++) {\n                    var executionActivity = filteredActivities[j] || {};\n                    rows += '<tr>' +\n                        '<td><small>' + escapeHtml(parseTime(executionActivity.occurred_at) || '-') + '</small></td>' +\n                        '<td>' + escapeHtml(textOrDash(executionActivity.job_type)) + '</td>' +\n                        '<td>' + renderJobLink(executionActivity.job_id) + '</td>' +\n                        '<td><span class=\"badge bg-light text-dark\">' + escapeHtml(textOrDash(executionActivity.source)) + '</span></td>' +\n                        '<td>' + escapeHtml(textOrDash(executionActivity.stage)) + '</td>' +\n                        '<td><small>' + escapeHtml(textOrDash(executionActivity.message)) + '</small></td>' +\n                        '</tr>';\n                }\n\n                tbody.innerHTML = rows;\n            }\n\n            function getSelectValueArray(selectEl) {\n                if (!selectEl) {\n                    return [];\n                }\n                var values = [];\n                for (var i = 0; i < selectEl.options.length; i++) {\n                    if (selectEl.options[i].selected) {\n                        values.push(selectEl.options[i].value);\n                    }\n                }\n                return values;\n            }\n\n            function configValueToNative(configValue) {\n                if (!configValue || typeof configValue !== 'object') {\n                    return null;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'bool_value')) {\n                    return !!configValue.bool_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'int64_value')) {\n                    return configValue.int64_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'double_value')) {\n                    return configValue.double_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'string_value')) {\n                    return configValue.string_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'bytes_value')) {\n                    return configValue.bytes_value;\n                }\n                if (Object.prototype.hasOwnProperty.call(configValue, 'duration_value')) {\n                    return configValue.duration_value;\n                }\n                if (configValue.string_list && Array.isArray(configValue.string_list.values)) {\n                    return configValue.string_list.values.slice();\n                }\n                if (configValue.int64_list && Array.isArray(configValue.int64_list.values)) {\n                    return configValue.int64_list.values.slice();\n                }\n                if (configValue.double_list && Array.isArray(configValue.double_list.values)) {\n                    return configValue.double_list.values.slice();\n                }\n                if (configValue.bool_list && Array.isArray(configValue.bool_list.values)) {\n                    return configValue.bool_list.values.slice();\n                }\n                if (configValue.list_value && Array.isArray(configValue.list_value.values)) {\n                    return configValue.list_value.values.map(function(v) {\n                        return configValueToNative(v);\n                    });\n                }\n                if (configValue.map_value && configValue.map_value.fields) {\n                    var out = {};\n                    Object.keys(configValue.map_value.fields).forEach(function(k) {\n                        out[k] = configValueToNative(configValue.map_value.fields[k]);\n                    });\n                    return out;\n                }\n                return null;\n            }\n\n            function inferConfigValue(value) {\n                if (value === null || value === undefined) {\n                    return { string_value: '' };\n                }\n                if (typeof value === 'boolean') {\n                    return { bool_value: value };\n                }\n                if (typeof value === 'number') {\n                    if (Number.isInteger(value)) {\n                        return { int64_value: String(value) };\n                    }\n                    return { double_value: value };\n                }\n                if (typeof value === 'string') {\n                    return { string_value: value };\n                }\n                if (Array.isArray(value)) {\n                    var listValues = value.map(function(item) {\n                        return inferConfigValue(item);\n                    });\n                    return { list_value: { values: listValues } };\n                }\n                if (typeof value === 'object') {\n                    var fields = {};\n                    Object.keys(value).forEach(function(key) {\n                        fields[key] = inferConfigValue(value[key]);\n                    });\n                    return { map_value: { fields: fields } };\n                }\n                return { string_value: String(value) };\n            }\n\n            function nativeToConfigValue(value, fieldType, widget, field) {\n                var normalizedFieldType = normalizeEnum(fieldType);\n                var normalizedWidget = normalizeEnum(widget);\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_BOOL') {\n                    return { bool_value: !!value };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_INT64') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    var intValue = parseInt(value, 10);\n                    if (Number.isNaN(intValue)) {\n                        throw new Error('Invalid int64 value for field ' + field.name);\n                    }\n                    return { int64_value: String(intValue) };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_DOUBLE') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    var doubleValue = parseFloat(value);\n                    if (Number.isNaN(doubleValue)) {\n                        throw new Error('Invalid number for field ' + field.name);\n                    }\n                    return { double_value: doubleValue };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_DURATION') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    var text = String(value).trim();\n                    if (!text) {\n                        return null;\n                    }\n                    if (/^\\d+$/.test(text)) {\n                        text += 's';\n                    }\n                    return { duration_value: text };\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_LIST') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n\n                    if (normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT' && Array.isArray(value)) {\n                        return { string_list: { values: value } };\n                    }\n\n                    if (typeof value === 'string') {\n                        try {\n                            var parsed = JSON.parse(value);\n                            if (!Array.isArray(parsed)) {\n                                throw new Error('Expected JSON array');\n                            }\n                            return inferConfigValue(parsed);\n                        } catch (e) {\n                            throw new Error('Invalid JSON list for field ' + field.name + ': ' + e.message);\n                        }\n                    }\n                    return inferConfigValue(value);\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_OBJECT') {\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    if (typeof value === 'string') {\n                        try {\n                            var parsedObject = JSON.parse(value);\n                            if (!parsedObject || typeof parsedObject !== 'object' || Array.isArray(parsedObject)) {\n                                throw new Error('Expected JSON object');\n                            }\n                            return inferConfigValue(parsedObject);\n                        } catch (e) {\n                            throw new Error('Invalid JSON object for field ' + field.name + ': ' + e.message);\n                        }\n                    }\n                    return inferConfigValue(value);\n                }\n\n                if (normalizedFieldType === 'CONFIG_FIELD_TYPE_ENUM') {\n                    if (normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT') {\n                        if (!value || !value.length) {\n                            return null;\n                        }\n                        return { string_list: { values: value } };\n                    }\n                    if (value === '' || value === null || value === undefined) {\n                        return null;\n                    }\n                    return { string_value: String(value) };\n                }\n\n                if (value === '' || value === null || value === undefined) {\n                    return null;\n                }\n\n                return { string_value: String(value) };\n            }\n\n            function toInputID(scope, fieldName) {\n                return 'plugin-' + scope + '-field-' + String(fieldName || '').replace(/[^a-zA-Z0-9_-]/g, '_');\n            }\n\n            function resolveFieldConfigValue(scope, field) {\n                if (!field || !field.name) {\n                    return null;\n                }\n                var fromConfig = null;\n                if (state.config) {\n                    if (scope === 'admin' && state.config.admin_config_values) {\n                        fromConfig = state.config.admin_config_values[field.name];\n                    }\n                    if (scope === 'worker' && state.config.worker_config_values) {\n                        fromConfig = state.config.worker_config_values[field.name];\n                    }\n                }\n                if (fromConfig) {\n                    return fromConfig;\n                }\n\n                var formDefaults = null;\n                if (scope === 'admin' && state.descriptor && state.descriptor.admin_config_form && state.descriptor.admin_config_form.default_values) {\n                    formDefaults = state.descriptor.admin_config_form.default_values[field.name];\n                }\n                if (scope === 'worker' && state.descriptor && state.descriptor.worker_config_form && state.descriptor.worker_config_form.default_values) {\n                    formDefaults = state.descriptor.worker_config_form.default_values[field.name];\n                }\n                if (formDefaults) {\n                    return formDefaults;\n                }\n\n                if (scope === 'worker' && state.descriptor && state.descriptor.worker_default_values) {\n                    return state.descriptor.worker_default_values[field.name] || null;\n                }\n\n                return null;\n            }\n\n            function renderFieldInput(scope, field, value) {\n                var inputID = toInputID(scope, field.name);\n                var normalizedType = normalizeEnum(field.field_type);\n                var normalizedWidget = normalizeEnum(field.widget);\n                var input;\n\n                if (normalizedType === 'CONFIG_FIELD_TYPE_BOOL' || normalizedWidget === 'CONFIG_WIDGET_TOGGLE') {\n                    input = document.createElement('input');\n                    input.type = 'checkbox';\n                    input.className = 'form-check-input';\n                    input.id = inputID;\n                    input.checked = !!value;\n                } else if ((normalizedType === 'CONFIG_FIELD_TYPE_ENUM' && normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT') || normalizedWidget === 'CONFIG_WIDGET_MULTI_SELECT') {\n                    input = document.createElement('select');\n                    input.className = 'form-select';\n                    input.id = inputID;\n                    input.multiple = true;\n                    var selected = Array.isArray(value) ? value : [];\n                    var options = Array.isArray(field.options) ? field.options : [];\n                    for (var i = 0; i < options.length; i++) {\n                        var option = document.createElement('option');\n                        option.value = options[i].value || '';\n                        option.textContent = options[i].label || options[i].value || '';\n                        if (selected.indexOf(option.value) >= 0) {\n                            option.selected = true;\n                        }\n                        input.appendChild(option);\n                    }\n                } else if (normalizedType === 'CONFIG_FIELD_TYPE_ENUM' || normalizedWidget === 'CONFIG_WIDGET_SELECT') {\n                    input = document.createElement('select');\n                    input.className = 'form-select';\n                    input.id = inputID;\n                    var blankOption = document.createElement('option');\n                    blankOption.value = '';\n                    blankOption.textContent = '-- select --';\n                    input.appendChild(blankOption);\n                    var enumOptions = Array.isArray(field.options) ? field.options : [];\n                    for (var j = 0; j < enumOptions.length; j++) {\n                        var enumOption = document.createElement('option');\n                        enumOption.value = enumOptions[j].value || '';\n                        enumOption.textContent = enumOptions[j].label || enumOptions[j].value || '';\n                        if (String(value) === enumOption.value) {\n                            enumOption.selected = true;\n                        }\n                        input.appendChild(enumOption);\n                    }\n                } else if (normalizedType === 'CONFIG_FIELD_TYPE_INT64' || normalizedType === 'CONFIG_FIELD_TYPE_DOUBLE' || normalizedWidget === 'CONFIG_WIDGET_NUMBER') {\n                    input = document.createElement('input');\n                    input.type = 'number';\n                    if (normalizedType === 'CONFIG_FIELD_TYPE_DOUBLE') {\n                        input.step = 'any';\n                    }\n                    input.className = 'form-control';\n                    input.id = inputID;\n                    if (value !== null && value !== undefined && value !== '') {\n                        input.value = String(value);\n                    }\n                } else if (normalizedType === 'CONFIG_FIELD_TYPE_LIST' || normalizedType === 'CONFIG_FIELD_TYPE_OBJECT' || normalizedWidget === 'CONFIG_WIDGET_TEXTAREA') {\n                    input = document.createElement('textarea');\n                    input.className = 'form-control';\n                    input.id = inputID;\n                    input.rows = 4;\n                    if (normalizedType === 'CONFIG_FIELD_TYPE_LIST' || normalizedType === 'CONFIG_FIELD_TYPE_OBJECT') {\n                        input.placeholder = normalizedType === 'CONFIG_FIELD_TYPE_LIST' ? '[...]' : '{...}';\n                    }\n                    if (value !== null && value !== undefined && value !== '') {\n                        if (typeof value === 'object') {\n                            input.value = JSON.stringify(value, null, 2);\n                        } else {\n                            input.value = String(value);\n                        }\n                    }\n                } else {\n                    input = document.createElement('input');\n                    input.className = 'form-control';\n                    input.id = inputID;\n                    if (normalizedWidget === 'CONFIG_WIDGET_PASSWORD' || field.sensitive) {\n                        input.type = 'password';\n                    } else {\n                        input.type = 'text';\n                    }\n                    if (value !== null && value !== undefined && value !== '') {\n                        input.value = String(value);\n                    }\n                }\n\n                if (field.placeholder && input.tagName === 'INPUT') {\n                    input.placeholder = field.placeholder;\n                }\n                if (field.placeholder && input.tagName === 'TEXTAREA') {\n                    input.placeholder = field.placeholder;\n                }\n\n                if (field.required) {\n                    input.required = true;\n                }\n                if (field.read_only) {\n                    input.disabled = true;\n                }\n\n                return input;\n            }\n\n            function renderConfigForm(scope, rootID, form) {\n                var root = document.getElementById(rootID);\n                if (!root) {\n                    return;\n                }\n\n                root.innerHTML = '';\n                if (!form || !Array.isArray(form.sections) || form.sections.length === 0) {\n                    root.innerHTML = '<div class=\"text-muted\">No fields provided by descriptor.</div>';\n                    return;\n                }\n\n                for (var s = 0; s < form.sections.length; s++) {\n                    var section = form.sections[s] || {};\n                    var sectionCard = document.createElement('div');\n                    sectionCard.className = 'card mb-3';\n\n                    var sectionHeader = document.createElement('div');\n                    sectionHeader.className = 'card-header py-2';\n                    sectionHeader.innerHTML = '<strong>' + escapeHtml(textOrDash(section.title || section.section_id)) + '</strong>';\n                    sectionCard.appendChild(sectionHeader);\n\n                    var sectionBody = document.createElement('div');\n                    sectionBody.className = 'card-body';\n\n                    if (section.description) {\n                        var sectionDescription = document.createElement('p');\n                        sectionDescription.className = 'text-muted small';\n                        sectionDescription.textContent = section.description;\n                        sectionBody.appendChild(sectionDescription);\n                    }\n\n                    var fields = Array.isArray(section.fields) ? section.fields : [];\n                    if (!fields.length) {\n                        var noFields = document.createElement('div');\n                        noFields.className = 'text-muted';\n                        noFields.textContent = 'No fields in this section.';\n                        sectionBody.appendChild(noFields);\n                    }\n\n                    for (var f = 0; f < fields.length; f++) {\n                        var field = fields[f] || {};\n                        if (!field.name) {\n                            continue;\n                        }\n\n                        var configValue = resolveFieldConfigValue(scope, field);\n                        var nativeValue = configValueToNative(configValue);\n\n                        var wrapper = document.createElement('div');\n                        wrapper.className = 'mb-3 plugin-field';\n                        wrapper.dataset.scope = scope;\n                        wrapper.dataset.fieldName = field.name;\n                        wrapper.dataset.fieldType = normalizeEnum(field.field_type);\n                        wrapper.dataset.widget = normalizeEnum(field.widget);\n                        wrapper.dataset.visibleWhenField = field.visible_when_field || '';\n                        wrapper.dataset.visibleWhenEquals = JSON.stringify(field.visible_when_equals || null);\n\n                        var label = document.createElement('label');\n                        label.className = 'form-label';\n                        label.setAttribute('for', toInputID(scope, field.name));\n                        label.innerHTML = escapeHtml(field.label || field.name) + (field.required ? ' <span class=\"text-danger\">*</span>' : '');\n                        wrapper.appendChild(label);\n\n                        var input = renderFieldInput(scope, field, nativeValue);\n                        wrapper.appendChild(input);\n\n                        if (field.description || field.help_text) {\n                            var help = document.createElement('div');\n                            help.className = 'form-text';\n                            help.textContent = field.help_text || field.description || '';\n                            wrapper.appendChild(help);\n                        }\n\n                        sectionBody.appendChild(wrapper);\n                    }\n\n                    sectionCard.appendChild(sectionBody);\n                    root.appendChild(sectionCard);\n                }\n\n                root.addEventListener('change', function() {\n                    applyVisibility(scope);\n                });\n                root.addEventListener('input', function() {\n                    applyVisibility(scope);\n                });\n\n                applyVisibility(scope);\n            }\n\n            function readRawFieldValue(scope, fieldName) {\n                var input = document.getElementById(toInputID(scope, fieldName));\n                if (!input) {\n                    return null;\n                }\n                if (input.tagName === 'SELECT' && input.multiple) {\n                    return getSelectValueArray(input);\n                }\n                if (input.type === 'checkbox') {\n                    return !!input.checked;\n                }\n                return input.value;\n            }\n\n            function compareVisibleValue(currentValue, expectedValueObject) {\n                if (!expectedValueObject) {\n                    return true;\n                }\n                var expectedNative = configValueToNative(expectedValueObject);\n                if (Array.isArray(expectedNative)) {\n                    if (!Array.isArray(currentValue)) {\n                        return false;\n                    }\n                    if (expectedNative.length !== currentValue.length) {\n                        return false;\n                    }\n                    for (var i = 0; i < expectedNative.length; i++) {\n                        if (String(expectedNative[i]) !== String(currentValue[i])) {\n                            return false;\n                        }\n                    }\n                    return true;\n                }\n                return String(currentValue) === String(expectedNative);\n            }\n\n            function applyVisibility(scope) {\n                var fields = document.querySelectorAll('.plugin-field[data-scope=\"' + scope + '\"]');\n                for (var i = 0; i < fields.length; i++) {\n                    var wrapper = fields[i];\n                    var dependsOn = wrapper.dataset.visibleWhenField;\n                    if (!dependsOn) {\n                        wrapper.classList.remove('plugin-field-hidden');\n                        continue;\n                    }\n\n                    var expectedRaw = null;\n                    try {\n                        expectedRaw = JSON.parse(wrapper.dataset.visibleWhenEquals || 'null');\n                    } catch (e) {\n                        expectedRaw = null;\n                    }\n                    var current = readRawFieldValue(scope, dependsOn);\n                    var visible = compareVisibleValue(current, expectedRaw);\n                    if (visible) {\n                        wrapper.classList.remove('plugin-field-hidden');\n                    } else {\n                        wrapper.classList.add('plugin-field-hidden');\n                    }\n                }\n            }\n\n            function collectConfigValues(scope, form) {\n                var out = {};\n                if (!form || !Array.isArray(form.sections)) {\n                    return out;\n                }\n\n                for (var s = 0; s < form.sections.length; s++) {\n                    var section = form.sections[s] || {};\n                    var fields = Array.isArray(section.fields) ? section.fields : [];\n                    for (var f = 0; f < fields.length; f++) {\n                        var field = fields[f] || {};\n                        if (!field.name) {\n                            continue;\n                        }\n\n                        var wrapper = document.querySelector('.plugin-field[data-scope=\"' + scope + '\"][data-field-name=\"' + field.name + '\"]');\n                        if (wrapper && wrapper.classList.contains('plugin-field-hidden')) {\n                            continue;\n                        }\n\n                        var input = document.getElementById(toInputID(scope, field.name));\n                        if (!input) {\n                            continue;\n                        }\n\n                        var rawValue;\n                        if (input.tagName === 'SELECT' && input.multiple) {\n                            rawValue = getSelectValueArray(input);\n                        } else if (input.type === 'checkbox') {\n                            rawValue = !!input.checked;\n                        } else {\n                            rawValue = input.value;\n                        }\n\n                        if (field.required) {\n                            var missing = false;\n                            if (input.type === 'checkbox') {\n                                missing = false;\n                            } else if (Array.isArray(rawValue)) {\n                                missing = rawValue.length === 0;\n                            } else {\n                                missing = String(rawValue || '').trim() === '';\n                            }\n                            if (missing) {\n                                throw new Error('Missing required field: ' + (field.label || field.name));\n                            }\n                        }\n\n                        var converted = nativeToConfigValue(rawValue, field.field_type, field.widget, field);\n                        if (converted !== null) {\n                            out[field.name] = converted;\n                        }\n                    }\n                }\n\n                return out;\n            }\n\n            function renderDescriptorSummary() {\n                var summary = document.getElementById('plugin-descriptor-summary');\n                if (!state.descriptor) {\n                    summary.innerHTML = 'No descriptor loaded.';\n                    return;\n                }\n\n                var descriptor = state.descriptor;\n                var html = '';\n                html += '<div><strong>' + escapeHtml(textOrDash(descriptor.display_name || descriptor.job_type)) + '</strong></div>';\n                html += '<div><small>Job Type: ' + escapeHtml(textOrDash(descriptor.job_type)) + '</small></div>';\n                html += '<div><small>Descriptor Version: ' + escapeHtml(textOrDash(descriptor.descriptor_version)) + '</small></div>';\n                if (descriptor.description) {\n                    html += '<div class=\"mt-1\">' + escapeHtml(descriptor.description) + '</div>';\n                }\n                summary.innerHTML = html;\n            }\n\n            function fillAdminSettings() {\n                var runtimeConfig = (state.config && state.config.admin_runtime) ? state.config.admin_runtime : {};\n                var defaults = (state.descriptor && state.descriptor.admin_runtime_defaults) ? state.descriptor.admin_runtime_defaults : {};\n\n                function pickNumber(key) {\n                    if (runtimeConfig && runtimeConfig[key] !== undefined && runtimeConfig[key] !== null) {\n                        return runtimeConfig[key];\n                    }\n                    if (defaults && defaults[key] !== undefined && defaults[key] !== null) {\n                        return defaults[key];\n                    }\n                    return 0;\n                }\n\n                function pickBool(key) {\n                    if (runtimeConfig && runtimeConfig[key] !== undefined && runtimeConfig[key] !== null) {\n                        return !!runtimeConfig[key];\n                    }\n                    if (defaults && defaults[key] !== undefined && defaults[key] !== null) {\n                        return !!defaults[key];\n                    }\n                    return true;\n                }\n\n                document.getElementById('plugin-admin-enabled').checked = pickBool('enabled');\n                document.getElementById('plugin-admin-detection-interval').value = String(pickNumber('detection_interval_minutes'));\n                document.getElementById('plugin-admin-detection-timeout').value = String(pickNumber('detection_timeout_seconds'));\n                document.getElementById('plugin-admin-execution-timeout').value = String(pickNumber('execution_timeout_seconds'));\n                document.getElementById('plugin-admin-max-runtime').value = String(pickNumber('job_type_max_runtime_seconds'));\n                document.getElementById('plugin-admin-max-results').value = String(pickNumber('max_jobs_per_detection'));\n                document.getElementById('plugin-admin-global-exec').value = String(pickNumber('global_execution_concurrency'));\n                document.getElementById('plugin-admin-per-worker-exec').value = String(pickNumber('per_worker_execution_concurrency'));\n                document.getElementById('plugin-admin-retry-limit').value = String(pickNumber('retry_limit'));\n                document.getElementById('plugin-admin-retry-backoff').value = String(pickNumber('retry_backoff_seconds'));\n            }\n\n            function collectAdminSettings() {\n                function getInt(id) {\n                    var raw = String(document.getElementById(id).value || '').trim();\n                    if (!raw) {\n                        return 0;\n                    }\n                    var parsed = parseInt(raw, 10);\n                    if (Number.isNaN(parsed) || parsed < 0) {\n                        throw new Error('Invalid number for ' + id);\n                    }\n                    return parsed;\n                }\n\n                return {\n                    enabled: !!document.getElementById('plugin-admin-enabled').checked,\n                    detection_interval_minutes: getInt('plugin-admin-detection-interval'),\n                    detection_timeout_seconds: getInt('plugin-admin-detection-timeout'),\n                    execution_timeout_seconds: getInt('plugin-admin-execution-timeout'),\n                    job_type_max_runtime_seconds: getInt('plugin-admin-max-runtime'),\n                    max_jobs_per_detection: getInt('plugin-admin-max-results'),\n                    global_execution_concurrency: getInt('plugin-admin-global-exec'),\n                    per_worker_execution_concurrency: getInt('plugin-admin-per-worker-exec'),\n                    retry_limit: getInt('plugin-admin-retry-limit'),\n                    retry_backoff_seconds: getInt('plugin-admin-retry-backoff'),\n                };\n            }\n\n            function renderRunHistory(history) {\n                var successBody = document.getElementById('plugin-runs-success-body');\n                var errorBody = document.getElementById('plugin-runs-error-body');\n\n                var successRuns = (history && Array.isArray(history.successful_runs)) ? history.successful_runs : [];\n                var errorRuns = (history && Array.isArray(history.error_runs)) ? history.error_runs : [];\n\n                if (!successRuns.length) {\n                    successBody.innerHTML = '<tr><td colspan=\"4\" class=\"text-muted\">No successful runs</td></tr>';\n                } else {\n                    var successRows = '';\n                    for (var i = 0; i < successRuns.length; i++) {\n                        var run = successRuns[i] || {};\n                        successRows += '<tr>' +\n                            '<td><small>' + escapeHtml(parseTime(run.completed_at) || '-') + '</small></td>' +\n                            '<td>' + renderJobLink(run.job_id) + '</td>' +\n                            '<td><small>' + escapeHtml(textOrDash(run.worker_id)) + '</small></td>' +\n                            '<td><small>' + escapeHtml(formatDurationMs(run.duration_ms)) + '</small></td>' +\n                            '</tr>';\n                    }\n                    successBody.innerHTML = successRows;\n                }\n\n                if (!errorRuns.length) {\n                    errorBody.innerHTML = '<tr><td colspan=\"4\" class=\"text-muted\">No error runs</td></tr>';\n                } else {\n                    var errorRows = '';\n                    for (var j = 0; j < errorRuns.length; j++) {\n                        var errorRun = errorRuns[j] || {};\n                        errorRows += '<tr>' +\n                            '<td><small>' + escapeHtml(parseTime(errorRun.completed_at) || '-') + '</small></td>' +\n                            '<td>' + renderJobLink(errorRun.job_id) + '</td>' +\n                            '<td><small>' + escapeHtml(textOrDash(errorRun.worker_id)) + '</small></td>' +\n                            '<td><small class=\"text-danger\">' + escapeHtml(textOrDash(errorRun.message)) + '</small></td>' +\n                            '</tr>';\n                    }\n                    errorBody.innerHTML = errorRows;\n                }\n            }\n\n            function renderDetectionResult(data) {\n                var root = document.getElementById('plugin-detection-results');\n                if (!root) {\n                    return;\n                }\n\n                function normalizeProposals(payload) {\n                    if (!payload || typeof payload !== 'object') {\n                        return [];\n                    }\n                    if (Array.isArray(payload.proposals)) {\n                        return payload.proposals;\n                    }\n                    if (payload.proposals && typeof payload.proposals === 'object') {\n                        return Object.keys(payload.proposals).map(function(key) {\n                            return payload.proposals[key];\n                        }).filter(function(item) {\n                            return !!item;\n                        });\n                    }\n                    return [];\n                }\n\n                function proposalID(proposal) {\n                    return proposal.proposal_id || proposal.proposalId || proposal.id || '';\n                }\n\n                function proposalSummary(proposal) {\n                    return proposal.summary || proposal.title || proposalID(proposal) || 'Proposal';\n                }\n\n                function proposalDetail(proposal) {\n                    return proposal.detail || proposal.reason || proposal.message || '-';\n                }\n\n                function normalizeActivities(payload) {\n                    if (!payload || typeof payload !== 'object') {\n                        return [];\n                    }\n                    if (Array.isArray(payload.activities)) {\n                        return payload.activities;\n                    }\n                    return [];\n                }\n\n                function encodeDetails(details) {\n                    if (!details || typeof details !== 'object') {\n                        return '';\n                    }\n                    var text = '';\n                    try {\n                        text = JSON.stringify(details);\n                    } catch (e) {\n                        text = '';\n                    }\n                    if (!text) {\n                        return '';\n                    }\n                    if (text.length > 360) {\n                        text = text.slice(0, 360) + '...';\n                    }\n                    return text;\n                }\n\n                if (!data) {\n                    root.innerHTML = '<div class=\"text-muted\">No results.</div>';\n                    return;\n                }\n\n                var proposals = normalizeProposals(data);\n                var activities = normalizeActivities(data);\n                var responseCount = Number(data.count || 0);\n                if (!Number.isFinite(responseCount) || responseCount < 0) {\n                    responseCount = proposals.length;\n                }\n                var requestID = data.request_id || data.requestId || '';\n                var detectorWorkerID = data.detector_worker_id || data.detectorWorkerId || '';\n                var totalProposals = Number(data.total_proposals || 0);\n                if (!Number.isFinite(totalProposals) || totalProposals < 0) {\n                    totalProposals = responseCount;\n                }\n\n                var html = '';\n                html += '<div class=\"mb-2\"><strong>Detection Run</strong></div>';\n                if (requestID) {\n                    html += '<div><small>request_id: ' + escapeHtml(String(requestID)) + '</small></div>';\n                }\n                if (detectorWorkerID) {\n                    html += '<div><small>detector: ' + escapeHtml(String(detectorWorkerID)) + '</small></div>';\n                }\n                html += '<div><small>proposals: ' + escapeHtml(String(responseCount)) + ' / total: ' + escapeHtml(String(totalProposals)) + '</small></div>';\n                if (data.error) {\n                    html += '<div class=\"mt-1 text-danger\"><small>' + escapeHtml(String(data.error)) + '</small></div>';\n                }\n\n                if (!proposals.length) {\n                    html += '<div class=\"mt-2 text-muted\">No proposals returned.</div>';\n                } else {\n                    html += '<div class=\"mt-2 mb-1\"><strong>' + escapeHtml(String(proposals.length)) + '</strong> proposal(s)</div>';\n                    for (var i = 0; i < proposals.length; i++) {\n                        var proposal = proposals[i] || {};\n                        var pID = proposalID(proposal);\n                        var pSummary = proposalSummary(proposal);\n                        var pDetail = proposalDetail(proposal);\n                        var pPriority = proposal.priority;\n                        if (pPriority === null || pPriority === undefined || pPriority === '') {\n                            pPriority = '-';\n                        }\n                        html += '<div class=\"plugin-detection-item\">' +\n                            '<div class=\"fw-semibold\">' + escapeHtml(textOrDash(pSummary)) + '</div>' +\n                            '<div><small>proposal_id: ' + escapeHtml(textOrDash(pID)) + '</small></div>' +\n                            '<div><small>priority: ' + escapeHtml(textOrDash(pPriority)) + '</small></div>' +\n                            '<div><small>detail: ' + escapeHtml(textOrDash(pDetail)) + '</small></div>' +\n                            '</div>';\n                    }\n                }\n\n                if (activities.length) {\n                    html += '<hr class=\"my-2\"/>';\n                    html += '<div class=\"mb-2\"><strong>Detection Process</strong></div>';\n                    for (var j = 0; j < activities.length; j++) {\n                        var activity = activities[j] || {};\n                        var activityStage = activity.stage || '-';\n                        var activitySource = activity.source || '-';\n                        var activityMessage = activity.message || '-';\n                        var activityTime = parseTime(activity.occurred_at) || '-';\n                        var detailsText = encodeDetails(activity.details);\n                        html += '<div class=\"plugin-detection-item\">' +\n                            '<div class=\"fw-semibold\">' + escapeHtml(textOrDash(activityStage)) + '</div>' +\n                            '<div><small>source: ' + escapeHtml(textOrDash(activitySource)) + ' | at: ' + escapeHtml(activityTime) + '</small></div>' +\n                            '<div><small>' + escapeHtml(textOrDash(activityMessage)) + '</small></div>';\n                        if (detailsText) {\n                            html += '<div><small class=\"text-muted\">details: ' + escapeHtml(detailsText) + '</small></div>';\n                        }\n                        html += '</div>';\n                    }\n                }\n\n                root.innerHTML = html;\n            }\n\n            function getSelectedJobType() {\n                return String(state.selectedJobType || '').trim();\n            }\n\n            function resetJobTypePanels() {\n                state.loadedJobType = '';\n                state.descriptor = null;\n                state.config = null;\n                document.getElementById('plugin-descriptor-summary').textContent = 'No descriptor loaded.';\n                document.getElementById('plugin-admin-config-form').innerHTML = '<div class=\"text-muted\">No admin form loaded.</div>';\n                document.getElementById('plugin-worker-config-form').innerHTML = '<div class=\"text-muted\">No worker form loaded.</div>';\n                document.getElementById('plugin-config-updated-at').textContent = 'Not loaded';\n                renderRunHistory(null);\n                renderDetectionResult(null);\n            }\n\n            async function loadDescriptorAndConfig(jobType, forceRefresh) {\n                if (!jobType) {\n                    return;\n                }\n\n                state.selectedJobType = jobType;\n                renderNavigationState();\n\n                var summary = document.getElementById('plugin-descriptor-summary');\n                summary.textContent = 'Loading descriptor and config...';\n\n                try {\n                    if (forceRefresh) {\n                        var refreshURL = '/api/plugin/job-types/' + encodePath(jobType) + '/schema?force_refresh=true';\n                        state.descriptor = await pluginRequest('POST', refreshURL, null);\n                    } else {\n                        try {\n                            state.descriptor = await pluginRequest('GET', '/api/plugin/job-types/' + encodePath(jobType) + '/descriptor');\n                        } catch (descriptorLoadError) {\n                            state.descriptor = await pluginRequest('POST', '/api/plugin/job-types/' + encodePath(jobType) + '/schema', null);\n                        }\n                    }\n                } catch (schemaError) {\n                    state.loadedJobType = '';\n                    state.descriptor = null;\n                    summary.innerHTML = '<span class=\"text-danger\">Failed to load descriptor: ' + escapeHtml(schemaError.message) + '</span>';\n                    document.getElementById('plugin-admin-config-form').innerHTML = '<div class=\"text-muted\">No admin form loaded.</div>';\n                    document.getElementById('plugin-worker-config-form').innerHTML = '<div class=\"text-muted\">No worker form loaded.</div>';\n                    throw schemaError;\n                }\n\n                try {\n                    state.config = await pluginRequest('GET', '/api/plugin/job-types/' + encodePath(jobType) + '/config');\n                } catch (configError) {\n                    state.config = null;\n                    notify('Failed to load config: ' + configError.message, 'error');\n                }\n\n                renderDescriptorSummary();\n                fillAdminSettings();\n\n                if (state.descriptor) {\n                    renderConfigForm('admin', 'plugin-admin-config-form', state.descriptor.admin_config_form || {});\n                    renderConfigForm('worker', 'plugin-worker-config-form', state.descriptor.worker_config_form || {});\n                }\n\n                if (state.config && state.config.updated_at) {\n                    document.getElementById('plugin-config-updated-at').textContent = 'Updated: ' + (parseTime(state.config.updated_at) || state.config.updated_at);\n                } else {\n                    document.getElementById('plugin-config-updated-at').textContent = 'Not saved yet';\n                }\n                state.loadedJobType = jobType;\n\n                await loadRunHistory(jobType);\n\n                if (state.lastDetectionByJobType && state.lastDetectionByJobType[jobType]) {\n                    renderDetectionResult(state.lastDetectionByJobType[jobType]);\n                } else {\n                    renderDetectionResult(null);\n                }\n            }\n\n            async function loadRunHistory(jobType) {\n                if (!jobType) {\n                    renderRunHistory(null);\n                    return;\n                }\n                try {\n                    var history = await pluginRequest('GET', '/api/plugin/job-types/' + encodePath(jobType) + '/runs');\n                    renderRunHistory(history);\n                } catch (e) {\n                    renderRunHistory(null);\n                    notify('Failed to load run history: ' + e.message, 'error');\n                }\n            }\n\n            async function saveConfig() {\n                var jobType = state.selectedJobType || getSelectedJobType();\n                if (!jobType) {\n                    notify('Select a job type first.', 'error');\n                    return;\n                }\n                if (!state.descriptor) {\n                    notify('Load descriptor before saving config.', 'error');\n                    return;\n                }\n\n                var payload;\n                try {\n                    payload = {\n                        job_type: jobType,\n                        descriptor_version: state.descriptor.descriptor_version || 0,\n                        admin_runtime: collectAdminSettings(),\n                        admin_config_values: collectConfigValues('admin', state.descriptor.admin_config_form || {}),\n                        worker_config_values: collectConfigValues('worker', state.descriptor.worker_config_form || {}),\n                    };\n                } catch (err) {\n                    notify(err.message, 'error');\n                    return;\n                }\n\n                try {\n                    state.config = await pluginRequest('PUT', '/api/plugin/job-types/' + encodePath(jobType) + '/config', payload);\n                    document.getElementById('plugin-config-updated-at').textContent = 'Updated: ' + (parseTime(state.config.updated_at) || state.config.updated_at || 'just now');\n                    notify('Config saved for ' + jobType, 'success');\n                } catch (e) {\n                    notify('Failed to save config: ' + e.message, 'error');\n                }\n            }\n\n            function getMaxResults() {\n                var raw = String(document.getElementById('plugin-admin-max-results').value || '').trim();\n                if (!raw) {\n                    return 0;\n                }\n                var parsed = parseInt(raw, 10);\n                if (Number.isNaN(parsed) || parsed < 0) {\n                    return 0;\n                }\n                return parsed;\n            }\n\n            async function runDetection() {\n                var jobType = state.selectedJobType || getSelectedJobType();\n                if (!jobType) {\n                    notify('Select a job type first.', 'error');\n                    return;\n                }\n\n                try {\n                    var data = await pluginRequest('POST', '/api/plugin/job-types/' + encodePath(jobType) + '/detect', {\n                        max_results: getMaxResults(),\n                    });\n                    state.lastDetectionByJobType[jobType] = data;\n                    renderDetectionResult(data);\n                } catch (e) {\n                    if (e && e.responseData) {\n                        state.lastDetectionByJobType[jobType] = e.responseData;\n                        renderDetectionResult(e.responseData);\n                    }\n                    notify('Detection failed: ' + e.message, 'error');\n                    return;\n                }\n\n                try {\n                    await refreshJobsAndActivities();\n                } catch (refreshErr) {\n                    notify('Detection succeeded, but monitoring refresh failed: ' + refreshErr.message, 'error');\n                }\n            }\n\n            async function runWorkflow() {\n                var jobType = state.selectedJobType || getSelectedJobType();\n                if (!jobType) {\n                    notify('Select a job type first.', 'error');\n                    return;\n                }\n\n                try {\n                    var data = await pluginRequest('POST', '/api/plugin/job-types/' + encodePath(jobType) + '/run', {\n                        max_results: getMaxResults(),\n                    });\n                    var resultRoot = document.getElementById('plugin-detection-results');\n                    resultRoot.innerHTML = '<div class=\"mb-2\"><strong>Workflow completed</strong></div>' +\n                        '<div>Detected: <strong>' + escapeHtml(String(data.detected_count || 0)) + '</strong></div>' +\n                        '<div>Ready to Execute: <strong>' + escapeHtml(String(data.ready_to_execute_count || 0)) + '</strong></div>' +\n                        '<div>Skipped (Already Active): <strong>' + escapeHtml(String(data.skipped_active_count || 0)) + '</strong></div>' +\n                        '<div>Executed: <strong>' + escapeHtml(String(data.executed_count || 0)) + '</strong></div>' +\n                        '<div class=\"text-success\">Success: ' + escapeHtml(String(data.success_count || 0)) + '</div>' +\n                        '<div class=\"text-danger\">Errors: ' + escapeHtml(String(data.error_count || 0)) + '</div>';\n                    await loadRunHistory(jobType);\n                    await refreshJobsAndActivities();\n                } catch (e) {\n                    notify('Workflow run failed: ' + e.message, 'error');\n                }\n            }\n\n            async function refreshJobsAndActivities() {\n                var executionStateFilter = document.getElementById('plugin-monitor-job-state-filter');\n\n                state.monitorExecutionJobState = executionStateFilter ? String(executionStateFilter.value || '').trim() : '';\n\n                var allJobsPromise = pluginRequest('GET', appendLaneParam('/api/plugin/jobs?limit=500'));\n                var allActivitiesPromise = pluginRequest('GET', appendLaneParam('/api/plugin/activities?limit=500'));\n                var schedulerPromise = pluginRequest('GET', appendLaneParam('/api/plugin/scheduler-states'));\n                var schedulerStatusPromise = pluginRequest('GET', appendLaneParam('/api/plugin/scheduler-status'));\n\n                var allJobs = await allJobsPromise;\n                var allActivities = await allActivitiesPromise;\n                var schedulerStates = await schedulerPromise;\n                var schedulerStatus = null;\n                try {\n                    schedulerStatus = await schedulerStatusPromise;\n                } catch (e) {\n                    schedulerStatus = null;\n                }\n\n                state.jobs = Array.isArray(allJobs) ? allJobs : [];\n                state.activities = Array.isArray(allActivities) ? allActivities : [];\n                state.allJobs = state.jobs;\n                state.allActivities = state.activities;\n                state.schedulerStates = Array.isArray(schedulerStates) ? schedulerStates : [];\n                state.schedulerStatus = schedulerStatus && schedulerStatus.scheduler ? schedulerStatus.scheduler : null;\n                renderQueueJobs();\n                renderDetectionJobs();\n                renderExecutionJobs();\n                renderExecutionActivities();\n                renderSchedulerStates();\n                renderSchedulerStatus();\n                renderStatus();\n                renderJobTypeSummary();\n            }\n\n            async function refreshAll() {\n                try {\n                    var previousSelectedJobType = state.selectedJobType;\n\n                    var workers = await pluginRequest('GET', appendLaneParam('/api/plugin/workers'));\n                    state.workers = Array.isArray(workers) ? workers : [];\n                    renderWorkers();\n\n                    var jobTypes = await pluginRequest('GET', appendLaneParam('/api/plugin/job-types'));\n                    state.jobTypes = Array.isArray(jobTypes) ? jobTypes : [];\n                    applyInitialNavigation();\n                    ensureActiveNavigation();\n                    renderTopTabs();\n                    renderNavigationState();\n\n                    if (!state.selectedJobType) {\n                        resetJobTypePanels();\n                    } else if (state.loadedJobType !== state.selectedJobType || previousSelectedJobType !== state.selectedJobType) {\n                        try {\n                            await loadDescriptorAndConfig(state.selectedJobType, false);\n                        } catch (loadError) {\n                            // Already rendered in UI.\n                        }\n                    }\n\n                    await refreshJobsAndActivities();\n                } catch (e) {\n                    notify('Refresh failed: ' + e.message, 'error');\n                }\n            }\n\n            function bindActions() {\n                var monitorStateFilter = document.getElementById('plugin-monitor-job-state-filter');\n                if (monitorStateFilter) {\n                    monitorStateFilter.addEventListener('change', function() {\n                        state.monitorExecutionJobState = String(monitorStateFilter.value || '').trim();\n                        renderExecutionJobs();\n                    });\n                }\n\n                var expireBtn = document.getElementById('plugin-expire-job-btn');\n                if (expireBtn) {\n                    expireBtn.addEventListener('click', function() {\n                        var jobID = String(expireBtn.getAttribute('data-job-id') || '').trim();\n                        if (!jobID) {\n                            return;\n                        }\n                        expireJob(jobID);\n                    });\n                }\n\n                document.getElementById('plugin-refresh-all-btn').addEventListener('click', function() {\n                    refreshAll();\n                });\n\n                document.getElementById('plugin-refresh-schema-btn').addEventListener('click', async function() {\n                    var jobType = getSelectedJobType();\n                    if (!jobType) {\n                        notify('Select a job type first.', 'error');\n                        return;\n                    }\n                    try {\n                        await loadDescriptorAndConfig(jobType, true);\n                        notify('Schema refreshed for ' + jobType, 'success');\n                    } catch (e) {\n                        notify('Schema refresh failed: ' + e.message, 'error');\n                    }\n                });\n\n                document.getElementById('plugin-save-config-btn').addEventListener('click', function() {\n                    saveConfig();\n                });\n\n                document.getElementById('plugin-trigger-detection-btn').addEventListener('click', function() {\n                    runDetection();\n                });\n\n                document.getElementById('plugin-run-workflow-btn').addEventListener('click', function() {\n                    runWorkflow();\n                });\n\n                page.addEventListener('click', async function(event) {\n                    var target = event.target;\n                    if (!target) {\n                        return;\n                    }\n\n                    var topTab = target.closest('[data-plugin-top-tab]');\n                    if (topTab) {\n                        event.preventDefault();\n                        var topTabKey = String(topTab.getAttribute('data-plugin-top-tab') || '').trim();\n                        if (!topTabKey) {\n                            return;\n                        }\n                        if (topTabKey === 'overview') {\n                            state.activeTopTab = 'overview';\n                            renderNavigationState();\n                            updateURL(false);\n                            return;\n                        }\n\n                        var jobType = parseJobTypeFromTopTab(topTabKey);\n                        if (!jobType) {\n                            return;\n                        }\n                        state.activeTopTab = topTabKey;\n                        state.selectedJobType = jobType;\n                        ensureActiveNavigation();\n                        renderNavigationState();\n                        updateURL(false);\n                        if (state.loadedJobType !== jobType) {\n                            try {\n                                await loadDescriptorAndConfig(jobType, false);\n                            } catch (e) {\n                                // Already rendered in UI.\n                            }\n                        } else {\n                            if (state.lastDetectionByJobType && state.lastDetectionByJobType[jobType]) {\n                                renderDetectionResult(state.lastDetectionByJobType[jobType]);\n                            } else {\n                                renderDetectionResult(null);\n                            }\n                            await loadRunHistory(jobType);\n                        }\n                        renderQueueJobs();\n                        renderDetectionJobs();\n                        renderExecutionJobs();\n                        renderExecutionActivities();\n                        return;\n                    }\n\n                    var subTab = target.closest('[data-plugin-subtab]');\n                    if (subTab) {\n                        event.preventDefault();\n                        var subTabKey = normalizeSubTab(subTab.getAttribute('data-plugin-subtab'));\n                        state.activeSubTab = subTabKey;\n                        renderNavigationState();\n                        updateURL(false);\n                        return;\n                    }\n\n                    var trigger = target.closest('.plugin-job-link');\n                    if (!trigger) {\n                        return;\n                    }\n                    event.preventDefault();\n                    var jobID = trigger.getAttribute('data-job-id');\n                    if (!jobID) {\n                        return;\n                    }\n                    openJobDetail(jobID);\n                });\n            }\n\n            async function init() {\n                bindActions();\n                renderTopTabs();\n                ensureActiveNavigation();\n                renderNavigationState();\n                await refreshAll();\n\n                // Set the initial browser history state to match the current view\n                updateURL(true);\n\n                state.refreshTimer = setInterval(function() {\n                    refreshAll();\n                }, 3000);\n            }\n\n            window.addEventListener('popstate', async function(event) {\n                var s = event.state;\n                if (!s || !s.pluginTopTab) {\n                    // No plugin state — treat as overview\n                    state.activeTopTab = 'overview';\n                    renderNavigationState();\n                    return;\n                }\n                state.activeTopTab = String(s.pluginTopTab || 'overview');\n                state.activeSubTab = normalizeSubTab(s.pluginSubTab);\n                var jobType = String(s.pluginJob || '').trim();\n                if (jobType) {\n                    state.selectedJobType = jobType;\n                }\n                ensureActiveNavigation();\n                renderNavigationState();\n                // If a job type is selected and not loaded yet, load it\n                if (state.selectedJobType && state.loadedJobType !== state.selectedJobType) {\n                    try {\n                        await loadDescriptorAndConfig(state.selectedJobType, false);\n                    } catch (e) {\n                        console.error('Failed to load data on popstate navigation:', e);\n                    }\n                }\n                renderQueueJobs();\n                renderDetectionJobs();\n                renderExecutionJobs();\n                renderExecutionActivities();\n            });\n\n            window.addEventListener('beforeunload', function() {\n                if (state.refreshTimer) {\n                    clearInterval(state.refreshTimer);\n                    state.refreshTimer = null;\n                }\n            });\n\n            init();\n        })();\n        </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/policies.templ b/weed/admin/view/app/policies.templ
index 6d7ade5dab..16273178e8 100644
--- a/weed/admin/view/app/policies.templ
+++ b/weed/admin/view/app/policies.templ
@@ -8,12 +8,12 @@ import (
 templ Policies(data dash.PoliciesData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <h1 class="h2">
-            <i class="fas fa-shield-alt me-2"></i>IAM Policies
+            <i class="bi bi-shield me-2"></i>IAM Policies
         </h1>
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
                 <button type="button" class="btn btn-sm btn-primary" data-bs-toggle="modal" data-bs-target="#createPolicyModal">
-                    <i class="fas fa-plus me-1"></i>Create Policy
+                    <i class="bi bi-plus me-1"></i>Create Policy
                 </button>
             </div>
         </div>
@@ -35,7 +35,7 @@ templ Policies(data dash.PoliciesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-shield-alt fa-2x text-gray-300"></i>
+                                <i class="bi bi-shield icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -55,7 +55,7 @@ templ Policies(data dash.PoliciesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-check-circle fa-2x text-gray-300"></i>
+                                <i class="bi bi-check-circle icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -75,7 +75,7 @@ templ Policies(data dash.PoliciesData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-clock fa-2x text-gray-300"></i>
+                                <i class="bi bi-clock icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -89,16 +89,16 @@ templ Policies(data dash.PoliciesData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-shield-alt me-2"></i>IAM Policies
+                            <i class="bi bi-shield me-2"></i>IAM Policies
                         </h6>
                         <div class="dropdown no-arrow">
                             <a class="dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown">
-                                <i class="fas fa-ellipsis-v fa-sm fa-fw text-gray-400"></i>
+                                <i class="bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400"></i>
                             </a>
                             <div class="dropdown-menu dropdown-menu-right shadow animated--fade-in">
                                 <div class="dropdown-header">Actions:</div>
                                 <a class="dropdown-item" href="#">
-                                    <i class="fas fa-download me-2"></i>Export List
+                                    <i class="bi bi-download me-2"></i>Export List
                                 </a>
                             </div>
                         </div>
@@ -137,13 +137,13 @@ templ Policies(data dash.PoliciesData) {
                                             <td>
                                                 <div class="btn-group btn-group-sm" role="group">
                                                     <button type="button" class="btn btn-outline-info view-policy-btn" title="View Policy" data-policy-name={policy.Name}>
-                                                        <i class="fas fa-eye"></i>
+                                                        <i class="bi bi-eye"></i>
                                                     </button>
                                                     <button type="button" class="btn btn-outline-primary edit-policy-btn" title="Edit Policy" data-policy-name={policy.Name}>
-                                                        <i class="fas fa-edit"></i>
+                                                        <i class="bi bi-pencil-square"></i>
                                                     </button>
                                                     <button type="button" class="btn btn-outline-danger delete-policy-btn" title="Delete Policy" data-policy-name={policy.Name}>
-                                                        <i class="fas fa-trash"></i>
+                                                        <i class="bi bi-trash"></i>
                                                     </button>
                                                 </div>
                                             </td>
@@ -152,12 +152,12 @@ templ Policies(data dash.PoliciesData) {
                                     if len(data.Policies) == 0 {
                                         <tr>
                                             <td colspan="6" class="text-center text-muted py-4">
-                                                <i class="fas fa-shield-alt fa-3x mb-3 text-muted"></i>
+                                                <i class="bi bi-shield icon-3x mb-3 text-muted"></i>
                                                 <div>
                                                     <h5>No IAM policies found</h5>
                                                     <p>Create your first policy to manage access permissions.</p>
                                                     <button type="button" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#createPolicyModal">
-                                                        <i class="fas fa-plus me-1"></i>Create Policy
+                                                        <i class="bi bi-plus me-1"></i>Create Policy
                                                     </button>
                                                 </div>
                                             </td>
@@ -172,13 +172,15 @@ templ Policies(data dash.PoliciesData) {
         </div>
     </div>
 
+    @PolicyDatalists()
+
     <!-- Create Policy Modal -->
     <div class="modal fade" id="createPolicyModal" tabindex="-1" aria-labelledby="createPolicyModalLabel" aria-hidden="true">
-        <div class="modal-dialog modal-lg">
+        <div class="modal-dialog modal-xl">
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="createPolicyModalLabel">
-                        <i class="fas fa-shield-alt me-2"></i>Create IAM Policy
+                        <i class="bi bi-shield me-2"></i>Create IAM Policy
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -189,33 +191,42 @@ templ Policies(data dash.PoliciesData) {
                             <input type="text" class="form-control" id="policyName" name="name" required placeholder="e.g., S3ReadOnlyPolicy">
                             <div class="form-text">Enter a unique name for this policy (alphanumeric and underscores only)</div>
                         </div>
-                        
-                        <div class="mb-3">
-                            <label for="policyDocument" class="form-label">Policy Document</label>
-                            <textarea class="form-control" id="policyDocument" name="document" rows="15" required placeholder="Enter IAM policy JSON document..."></textarea>
-                            <div class="form-text">Enter the policy document in AWS IAM JSON format</div>
+
+                        <ul class="nav nav-tabs" role="tablist">
+                            <li class="nav-item" role="presentation">
+                                <button class="nav-link active" id="createPolicyEditorTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#createPolicyEditorTab">Editor</button>
+                            </li>
+                            <li class="nav-item" role="presentation">
+                                <button class="nav-link" id="createPolicyJsonTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#createPolicyJsonTab">JSON</button>
+                            </li>
+                        </ul>
+                        <div class="tab-content border border-top-0 rounded-bottom p-3 mb-3">
+                            <div class="tab-pane fade show active" id="createPolicyEditorTab">
+                                <div id="createPolicyEditorBody"></div>
+                                <button type="button" class="btn btn-sm btn-outline-secondary" id="createPolicyAddStatementBtn">
+                                    <i class="bi bi-plus me-1"></i>Add statement
+                                </button>
+                            </div>
+                            <div class="tab-pane fade" id="createPolicyJsonTab">
+                                <textarea class="form-control" id="policyDocument" name="document" rows="15" placeholder="Enter IAM policy JSON document..."></textarea>
+                                <div class="form-text">Enter the policy document in AWS IAM JSON format</div>
+                            </div>
                         </div>
 
-                        <div class="mb-3">
-                            <div class="row">
-                                <div class="col-md-6">
-                                    <button type="button" class="btn btn-outline-info btn-sm" onclick="insertSamplePolicy()">
-                                        <i class="fas fa-file-alt me-1"></i>Use Sample Policy
-                                    </button>
-                                </div>
-                                <div class="col-md-6 text-end">
-                                    <button type="button" class="btn btn-outline-secondary btn-sm" onclick="validatePolicyDocument()">
-                                        <i class="fas fa-check me-1"></i>Validate JSON
-                                    </button>
-                                </div>
-                            </div>
+                        <div class="mb-3 d-flex justify-content-between">
+                            <button type="button" class="btn btn-outline-info btn-sm" onclick="insertSamplePolicy('create')">
+                                <i class="bi bi-file-earmark-text me-1"></i>Use Sample Policy
+                            </button>
+                            <button type="button" class="btn btn-outline-secondary btn-sm" onclick="validatePolicyDocument('create')">
+                                <i class="bi bi-check me-1"></i>Validate
+                            </button>
                         </div>
                     </form>
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                     <button type="button" class="btn btn-primary" onclick="createPolicy()">
-                        <i class="fas fa-plus me-1"></i>Create Policy
+                        <i class="bi bi-plus me-1"></i>Create Policy
                     </button>
                 </div>
             </div>
@@ -228,7 +239,7 @@ templ Policies(data dash.PoliciesData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="viewPolicyModalLabel">
-                        <i class="fas fa-eye me-2"></i>View IAM Policy
+                        <i class="bi bi-eye me-2"></i>View IAM Policy
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -245,7 +256,7 @@ templ Policies(data dash.PoliciesData) {
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
                     <button type="button" class="btn btn-primary" id="editFromViewBtn">
-                        <i class="fas fa-edit me-1"></i>Edit Policy
+                        <i class="bi bi-pencil-square me-1"></i>Edit Policy
                     </button>
                 </div>
             </div>
@@ -254,11 +265,11 @@ templ Policies(data dash.PoliciesData) {
 
     <!-- Edit Policy Modal -->
     <div class="modal fade" id="editPolicyModal" tabindex="-1" aria-labelledby="editPolicyModalLabel" aria-hidden="true">
-        <div class="modal-dialog modal-lg">
+        <div class="modal-dialog modal-xl">
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="editPolicyModalLabel">
-                        <i class="fas fa-edit me-2"></i>Edit IAM Policy
+                        <i class="bi bi-pencil-square me-2"></i>Edit IAM Policy
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -269,33 +280,42 @@ templ Policies(data dash.PoliciesData) {
                             <input type="text" class="form-control" id="editPolicyName" name="name" readonly>
                             <div class="form-text">Policy name cannot be changed</div>
                         </div>
-                        
-                        <div class="mb-3">
-                            <label for="editPolicyDocument" class="form-label">Policy Document</label>
-                            <textarea class="form-control" id="editPolicyDocument" name="document" rows="15" required></textarea>
-                            <div class="form-text">Edit the policy document in AWS IAM JSON format</div>
+
+                        <ul class="nav nav-tabs" role="tablist">
+                            <li class="nav-item" role="presentation">
+                                <button class="nav-link active" id="editPolicyEditorTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#editPolicyEditorTab">Editor</button>
+                            </li>
+                            <li class="nav-item" role="presentation">
+                                <button class="nav-link" id="editPolicyJsonTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#editPolicyJsonTab">JSON</button>
+                            </li>
+                        </ul>
+                        <div class="tab-content border border-top-0 rounded-bottom p-3 mb-3">
+                            <div class="tab-pane fade show active" id="editPolicyEditorTab">
+                                <div id="editPolicyEditorBody"></div>
+                                <button type="button" class="btn btn-sm btn-outline-secondary" id="editPolicyAddStatementBtn">
+                                    <i class="bi bi-plus me-1"></i>Add statement
+                                </button>
+                            </div>
+                            <div class="tab-pane fade" id="editPolicyJsonTab">
+                                <textarea class="form-control" id="editPolicyDocument" name="document" rows="15"></textarea>
+                                <div class="form-text">Edit the policy document in AWS IAM JSON format</div>
+                            </div>
                         </div>
 
-                        <div class="mb-3">
-                            <div class="row">
-                                <div class="col-md-6">
-                                    <button type="button" class="btn btn-outline-info btn-sm" onclick="insertSamplePolicyEdit()">
-                                        <i class="fas fa-file-alt me-1"></i>Reset to Sample
-                                    </button>
-                                </div>
-                                <div class="col-md-6 text-end">
-                                    <button type="button" class="btn btn-outline-secondary btn-sm" onclick="validateEditPolicyDocument()">
-                                        <i class="fas fa-check me-1"></i>Validate JSON
-                                    </button>
-                                </div>
-                            </div>
+                        <div class="mb-3 d-flex justify-content-between">
+                            <button type="button" class="btn btn-outline-info btn-sm" onclick="insertSamplePolicy('edit')">
+                                <i class="bi bi-file-earmark-text me-1"></i>Reset to Sample
+                            </button>
+                            <button type="button" class="btn btn-outline-secondary btn-sm" onclick="validatePolicyDocument('edit')">
+                                <i class="bi bi-check me-1"></i>Validate
+                            </button>
                         </div>
                     </form>
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                     <button type="button" class="btn btn-primary" onclick="updatePolicy()">
-                        <i class="fas fa-save me-1"></i>Save Changes
+                        <i class="bi bi-floppy me-1"></i>Save Changes
                     </button>
                 </div>
             </div>
@@ -306,9 +326,27 @@ templ Policies(data dash.PoliciesData) {
     <script>
     // Current policy being viewed/edited
     let currentPolicy = null;
-    
+    // Drop edit-modal GET responses superseded by a later editPolicy call,
+    // so a stalled load for one policy can't populate the editor while the
+    // name field already says another. Same pattern as the bucket and
+    // S3 Tables policy dialogs.
+    let editPolicyRequestSeq = 0;
+
     // Event listeners for policy actions
     document.addEventListener('DOMContentLoaded', function() {
+        // Register the two editor instances used on this page. Config
+        // overrides here preserve the pre-extraction ids exactly, so this
+        // page's markup did not need to change. This has to run after
+        // DOMContentLoaded (not at the top of this script) because
+        // policy_editor.js - which defines registerPolicyEditor - is
+        // loaded by layout.templ's script bundle at the end of <body>,
+        // i.e. after this page's own content (including this inline
+        // script) has already been parsed and run.
+        registerPolicyEditor('create', { textareaId: 'policyDocument' });
+        registerPolicyEditor('edit', { textareaId: 'editPolicyDocument' });
+        setupPolicyEditor('create');
+        setupPolicyEditor('edit');
+
         // View policy buttons
         document.querySelectorAll('.view-policy-btn').forEach(button => {
             button.addEventListener('click', function() {
@@ -316,7 +354,7 @@ templ Policies(data dash.PoliciesData) {
                 viewPolicy(policyName);
             });
         });
-        
+
         // Edit policy buttons
         document.querySelectorAll('.edit-policy-btn').forEach(button => {
             button.addEventListener('click', function() {
@@ -324,7 +362,7 @@ templ Policies(data dash.PoliciesData) {
                 editPolicy(policyName);
             });
         });
-        
+
         // Delete policy buttons
         document.querySelectorAll('.delete-policy-btn').forEach(button => {
             button.addEventListener('click', function() {
@@ -332,7 +370,7 @@ templ Policies(data dash.PoliciesData) {
                 deletePolicy(policyName);
             });
         });
-        
+
         // Edit from view button
         document.getElementById('editFromViewBtn').addEventListener('click', function() {
             if (currentPolicy) {
@@ -341,20 +379,30 @@ templ Policies(data dash.PoliciesData) {
                 editPolicy(currentPolicy.name);
             }
         });
+
+        // Reset the create modal's editor each time it's opened, so leftover
+        // state from a previous (possibly cancelled) create doesn't leak in.
+        document.getElementById('createPolicyModal').addEventListener('show.bs.modal', function() {
+            document.getElementById('createPolicyForm').reset();
+            policyEditors.create = { version: '2012-10-17', statements: [], otherFields: {} };
+            renderPolicyEditor('create');
+            const editorTab = bootstrap.Tab.getOrCreateInstance(document.getElementById('createPolicyEditorTabBtn'));
+            editorTab.show();
+        });
     });
-    
+
     function createPolicy() {
-        const form = document.getElementById('createPolicyForm');
-        const formData = new FormData(form);
-        
-        const policyName = formData.get('name');
-        const policyDocumentText = formData.get('document');
-        
+        if (!commitPolicyActiveTab('create')) return;
+        if (!confirmPolicyFieldDiscard('create')) return;
+
+        const policyName = document.getElementById('policyName').value;
+        const policyDocumentText = document.getElementById('policyDocument').value;
+
         if (!policyName || !policyDocumentText) {
             showAlert('Please fill in all required fields', 'warning');
             return;
         }
-        
+
         let policyDocument;
         try {
             policyDocument = JSON.parse(policyDocumentText);
@@ -362,41 +410,45 @@ templ Policies(data dash.PoliciesData) {
             showAlert('Invalid JSON in policy document: ' + e.message, 'error');
             return;
         }
-        
+
         const requestData = {
             name: policyName,
             document: policyDocument
         };
-        
-        fetch(basePath('/api/object-store/policies'), {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(requestData)
-        })
-        .then(response => response.json())
-        .then(data => {
-            if (data.success) {
-                showAlert('Policy created successfully!', 'success');
-                const modal = bootstrap.Modal.getInstance(document.getElementById('createPolicyModal'));
-                if (modal) modal.hide();
-                location.reload(); // Refresh the page to show the new policy
-            } else {
-                showAlert('Error creating policy: ' + (data.error || 'Unknown error'), 'error');
-            }
-        })
-        .catch(error => {
-            console.error('Error:', error);
-            showAlert('Error creating policy: ' + error.message, 'error');
+
+        validatePolicyJSON(policyDocumentText, true).then(valid => {
+            if (!valid) return;
+
+            fetch(basePath('/api/object-store/policies'), {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(requestData)
+            })
+            .then(response => response.json())
+            .then(data => {
+                if (data.success) {
+                    showAlert('Policy created successfully!', 'success');
+                    const modal = bootstrap.Modal.getInstance(document.getElementById('createPolicyModal'));
+                    if (modal) modal.hide();
+                    location.reload(); // Refresh the page to show the new policy
+                } else {
+                    showAlert('Error creating policy: ' + (data.error || 'Unknown error'), 'error');
+                }
+            })
+            .catch(error => {
+                console.error('Error:', error);
+                showAlert('Error creating policy: ' + error.message, 'error');
+            });
         });
     }
-    
+
     function viewPolicy(policyName) {
         // Show the modal first
         const modal = new bootstrap.Modal(document.getElementById('viewPolicyModal'));
         modal.show();
-        
+
         // Reset content to loading state
         document.getElementById('viewPolicyContent').innerHTML = `
             <div class="text-center">
@@ -406,7 +458,7 @@ templ Policies(data dash.PoliciesData) {
                 <p class="mt-2">Loading policy...</p>
             </div>
         `;
-        
+
         // Fetch policy data
         fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)))
         .then(response => {
@@ -423,77 +475,113 @@ templ Policies(data dash.PoliciesData) {
             console.error('Error:', error);
             document.getElementById('viewPolicyContent').innerHTML = `
                 <div class="alert alert-danger" role="alert">
-                    <i class="fas fa-exclamation-triangle me-2"></i>
+                    <i class="bi bi-exclamation-triangle me-2"></i>
                     Error loading policy: ${error.message}
                 </div>
             `;
         });
     }
-    
+
     function displayPolicyDetails(policy) {
         const content = document.getElementById('viewPolicyContent');
-        
+
+        // Escapes a policy value for display, whether it's carried as a
+        // single value or a list, and whatever type it turns out to be.
+        function escapedJoin(list) {
+            if (list === undefined || list === null) return '';
+            return (Array.isArray(list) ? list : [list]).map(function(v) { return escapeHtml(String(v)); }).join(', ');
+        }
+
+        // Summarizes a Principal/NotPrincipal value for read-only display,
+        // regardless of shape (bare string/array, or a {"Type": ...} object -
+        // possibly with several type keys), since the View modal must stay
+        // correct even for forms the structured editor doesn't model.
+        function principalSummary(value) {
+            if (value === undefined || value === null) return '';
+            if (Array.isArray(value)) return escapedJoin(value);
+            if (typeof value === 'object') {
+                return Object.keys(value).map(function(key) {
+                    const v = value[key];
+                    return escapeHtml(key) + ': ' + escapedJoin(v);
+                }).join('; ');
+            }
+            return escapeHtml(String(value));
+        }
+
         let statementsHtml = '';
         if (policy.document && policy.document.Statement) {
             statementsHtml = policy.document.Statement.map((stmt, index) => `
                 <div class="card mb-2">
                     <div class="card-header py-2">
-                        <h6 class="mb-0">Statement ${index + 1}</h6>
+                        <h6 class="mb-0">Statement ${index + 1}${stmt.Sid ? ' &mdash; ' + escapeHtml(stmt.Sid) : ''}</h6>
                     </div>
                     <div class="card-body py-2">
                         <div class="row">
                             <div class="col-md-6">
-                                <strong>Effect:</strong> 
-                                <span class="badge ${stmt.Effect === 'Allow' ? 'bg-success' : 'bg-danger'}">${stmt.Effect}</span>
+                                <strong>Effect:</strong>
+                                <span class="badge ${stmt.Effect === 'Allow' ? 'bg-success' : 'bg-danger'}">${escapedJoin(stmt.Effect)}</span>
                             </div>
                             <div class="col-md-6">
-                                <strong>Actions:</strong> ${Array.isArray(stmt.Action) ? stmt.Action.join(', ') : stmt.Action}
+                                <strong>Actions:</strong> ${escapedJoin(stmt.Action)}
                             </div>
                         </div>
                         <div class="row mt-2">
                             <div class="col-12">
-                                <strong>Resources:</strong> ${Array.isArray(stmt.Resource) ? stmt.Resource.join(', ') : stmt.Resource}
+                                ${stmt.NotResource
+                                    ? '<strong>NotResource (excluded):</strong> ' + escapedJoin(stmt.NotResource)
+                                    : '<strong>Resource:</strong> ' + escapedJoin(stmt.Resource)}
                             </div>
                         </div>
+                        ${(stmt.Principal || stmt.NotPrincipal)
+                            ? '<div class="row mt-2"><div class="col-12">' +
+                                (stmt.NotPrincipal
+                                    ? '<strong>NotPrincipal (excluded):</strong> ' + principalSummary(stmt.NotPrincipal)
+                                    : '<strong>Principal:</strong> ' + principalSummary(stmt.Principal)) +
+                                '</div></div>'
+                            : ''}
                     </div>
                 </div>
             `).join('');
         }
-        
+
         content.innerHTML = `
             <div class="row mb-3">
                 <div class="col-md-6">
-                    <strong>Policy Name:</strong> ${policy.name || 'Unknown'}
+                    <strong>Policy Name:</strong> ${escapedJoin(policy.name || 'Unknown')}
                 </div>
                 <div class="col-md-6">
-                    <strong>Version:</strong> <span class="badge bg-info">${policy.document?.Version || 'Unknown'}</span>
+                    <strong>Version:</strong> <span class="badge bg-info">${escapedJoin(policy.document?.Version || 'Unknown')}</span>
                 </div>
             </div>
-            
+
             <div class="mb-3">
                 <strong>Statements:</strong>
                 <div class="mt-2">
                     ${statementsHtml || '<p class="text-muted">No statements found</p>'}
                 </div>
             </div>
-            
+
             <div class="mb-3">
                 <strong>Raw Policy Document:</strong>
-                <pre class="bg-light p-3 border rounded mt-2"><code>${JSON.stringify(policy.document, null, 2)}</code></pre>
+                <pre class="bg-light p-3 border rounded mt-2"><code>${escapeHtml(JSON.stringify(policy.document, null, 2))}</code></pre>
             </div>
         `;
     }
-    
+
     function editPolicy(policyName) {
         // Show the modal first
         const modal = new bootstrap.Modal(document.getElementById('editPolicyModal'));
         modal.show();
-        
+
         // Set policy name
         document.getElementById('editPolicyName').value = policyName;
         document.getElementById('editPolicyDocument').value = 'Loading...';
-        
-        // Fetch policy data
+        policyEditors.edit = { version: '2012-10-17', statements: [], otherFields: {} };
+        renderPolicyEditor('edit');
+
+        // Fetch policy data; drop the response if another editPolicy call
+        // superseded this one meanwhile.
+        const requestSeq = ++editPolicyRequestSeq;
         fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)))
         .then(response => {
             if (!response.ok) {
@@ -502,26 +590,48 @@ templ Policies(data dash.PoliciesData) {
             return response.json();
         })
         .then(policy => {
+            if (requestSeq !== editPolicyRequestSeq) return;
             currentPolicy = policy;
             document.getElementById('editPolicyDocument').value = JSON.stringify(policy.document, null, 2);
+            let state;
+            try {
+                state = policyDocToEditorState('edit', policy.document);
+            } catch (e) {
+                // Valid JSON the structured editor can't model. The JSON tab
+                // exists for exactly this, so hand the document over to it
+                // rather than closing the modal on the only view of it.
+                policyEditors.edit = { version: '2012-10-17', statements: [], otherFields: {}, unparsed: true };
+                renderPolicyEditor('edit');
+                showAlert(e.message + '. ' + POLICY_JSON_TAB_ONLY_MESSAGE, 'error');
+                bootstrap.Tab.getOrCreateInstance(document.getElementById('editPolicyJsonTabBtn')).show();
+                return;
+            }
+            policyEditors.edit = state;
+            renderPolicyEditor('edit');
+            const editorTab = bootstrap.Tab.getOrCreateInstance(document.getElementById('editPolicyEditorTabBtn'));
+            editorTab.show();
         })
         .catch(error => {
+            if (requestSeq !== editPolicyRequestSeq) return;
             console.error('Error:', error);
             showAlert('Error loading policy for editing: ' + error.message, 'error');
             const editModal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));
             if (editModal) editModal.hide();
         });
     }
-    
+
     function updatePolicy() {
+        if (!commitPolicyActiveTab('edit')) return;
+        if (!confirmPolicyFieldDiscard('edit')) return;
+
         const policyName = document.getElementById('editPolicyName').value;
         const policyDocumentText = document.getElementById('editPolicyDocument').value;
-        
+
         if (!policyName || !policyDocumentText) {
             showAlert('Please fill in all required fields', 'warning');
             return;
         }
-        
+
         let policyDocument;
         try {
             policyDocument = JSON.parse(policyDocumentText);
@@ -529,111 +639,88 @@ templ Policies(data dash.PoliciesData) {
             showAlert('Invalid JSON in policy document: ' + e.message, 'error');
             return;
         }
-        
+
         const requestData = {
             document: policyDocument
         };
-        
-        fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)), {
-            method: 'PUT',
+
+        validatePolicyJSON(policyDocumentText, true).then(valid => {
+            if (!valid) return;
+
+            fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)), {
+                method: 'PUT',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(requestData)
+            })
+            .then(response => response.json())
+            .then(data => {
+                if (data.success) {
+                    showAlert('Policy updated successfully!', 'success');
+                    const modal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));
+                    if (modal) modal.hide();
+                    location.reload(); // Refresh the page to show the updated policy
+                } else {
+                    showAlert('Error updating policy: ' + (data.error || 'Unknown error'), 'error');
+                }
+            })
+            .catch(error => {
+                console.error('Error:', error);
+                showAlert('Error updating policy: ' + error.message, 'error');
+            });
+        });
+    }
+
+    function validatePolicyDocument(which) {
+        if (!commitPolicyActiveTab(which)) return;
+        const policyText = document.getElementById(policyTextareaId(which)).value;
+        validatePolicyJSON(policyText);
+    }
+
+    // Runs a policy document past the server's validator. Resolves to true
+    // when it passes, and to false after alerting the user when it doesn't.
+    // `quiet` suppresses the success alert for callers that go on to report
+    // an outcome of their own.
+    function validatePolicyJSON(policyText, quiet) {
+        if (!policyText) {
+            showAlert('Please enter a policy document first', 'warning');
+            return Promise.resolve(false);
+        }
+
+        let policyDocument;
+        try {
+            policyDocument = JSON.parse(policyText);
+        } catch (e) {
+            showAlert('Invalid JSON: ' + e.message, 'error');
+            return Promise.resolve(false);
+        }
+
+        return fetch(basePath('/api/object-store/policies/validate'), {
+            method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
             },
-            body: JSON.stringify(requestData)
+            body: JSON.stringify({ document: policyDocument })
         })
-        .then(response => response.json())
-        .then(data => {
-            if (data.success) {
-                showAlert('Policy updated successfully!', 'success');
-                const modal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));
-                if (modal) modal.hide();
-                location.reload(); // Refresh the page to show the updated policy
-            } else {
-                showAlert('Error updating policy: ' + (data.error || 'Unknown error'), 'error');
+        .then(response => response.json().then(data => ({ ok: response.ok, data })))
+        .then(({ ok, data }) => {
+            if (ok && data.valid) {
+                if (!quiet) {
+                    showAlert(data.message || 'Policy document is valid!', 'success');
+                }
+                return true;
             }
+            showAlert('Invalid policy: ' + (data.error || 'unknown error'), 'error');
+            return false;
         })
         .catch(error => {
             console.error('Error:', error);
-            showAlert('Error updating policy: ' + error.message, 'error');
+            showAlert('Error validating policy: ' + error.message, 'error');
+            return false;
         });
     }
-    
-    function insertSamplePolicy() {
-        const samplePolicy = {
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                    "Effect": "Allow",
-                    "Action": [
-                        "s3:GetObject",
-                        "s3:PutObject"
-                    ],
-                    "Resource": [
-                        "arn:aws:s3:::my-bucket/*"
-                    ]
-                }
-            ]
-        };
-        
-        document.getElementById('policyDocument').value = JSON.stringify(samplePolicy, null, 2);
-    }
-    
-    function insertSamplePolicyEdit() {
-        const samplePolicy = {
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                    "Effect": "Allow",
-                    "Action": [
-                        "s3:GetObject",
-                        "s3:PutObject"
-                    ],
-                    "Resource": [
-                        "arn:aws:s3:::my-bucket/*"
-                    ]
-                }
-            ]
-        };
-        
-        document.getElementById('editPolicyDocument').value = JSON.stringify(samplePolicy, null, 2);
-    }
-    
-    function validatePolicyDocument() {
-        const policyText = document.getElementById('policyDocument').value;
-        validatePolicyJSON(policyText);
-    }
-    
-    function validateEditPolicyDocument() {
-        const policyText = document.getElementById('editPolicyDocument').value;
-        validatePolicyJSON(policyText);
-    }
-    
-    function validatePolicyJSON(policyText) {
-        if (!policyText) {
-            showAlert('Please enter a policy document first', 'warning');
-            return;
-        }
-        
-        try {
-            const policy = JSON.parse(policyText);
-            
-            // Basic validation
-            if (!policy.Version) {
-                showAlert('Policy must have a Version field', 'error');
-                return;
-            }
-            
-            if (!policy.Statement || !Array.isArray(policy.Statement)) {
-                showAlert('Policy must have a Statement array', 'error');
-                return;
-            }
-            
-            showAlert('Policy document is valid JSON!', 'success');
-        } catch (e) {
-            showAlert('Invalid JSON: ' + e.message, 'error');
-        }
-    }
-    
+
     function deletePolicy(policyName) {
         showDeleteConfirm(policyName, function() {
             fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)), {
@@ -655,4 +742,4 @@ templ Policies(data dash.PoliciesData) {
         });
     }
     </script>
-} 
\ No newline at end of file
+}
diff --git a/weed/admin/view/app/policies_templ.go b/weed/admin/view/app/policies_templ.go
index abee882abb..8141d1ec63 100644
--- a/weed/admin/view/app/policies_templ.go
+++ b/weed/admin/view/app/policies_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func Policies(data dash.PoliciesData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-shield-alt me-2\"></i>IAM Policies</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createPolicyModal\"><i class=\"fas fa-plus me-1\"></i>Create Policy</button></div></div></div><div id=\"policies-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Policies</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-shield me-2\"></i>IAM Policies</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createPolicyModal\"><i class=\"bi bi-plus me-1\"></i>Create Policy</button></div></div></div><div id=\"policies-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Policies</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func Policies(data dash.PoliciesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-shield-alt fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Active Policies</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-shield icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Active Policies</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +60,7 @@ func Policies(data dash.PoliciesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-check-circle fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-check-circle icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -73,7 +73,7 @@ func Policies(data dash.PoliciesData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Policies Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-shield-alt me-2\"></i>IAM Policies</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"fas fa-ellipsis-v fa-sm fa-fw text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"#\"><i class=\"fas fa-download me-2\"></i>Export List</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Policy Name</th><th>Version</th><th>Statements</th><th>Created</th><th>Updated</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Policies Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-shield me-2\"></i>IAM Policies</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"#\"><i class=\"bi bi-download me-2\"></i>Export List</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\"><thead><tr><th>Policy Name</th><th>Version</th><th>Statements</th><th>Created</th><th>Updated</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -148,52 +148,60 @@ func Policies(data dash.PoliciesData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(policy.Name)
+			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(policy.Name)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/policies.templ`, Line: 139, Col: 168}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\"><i class=\"fas fa-eye\"></i></button> <button type=\"button\" class=\"btn btn-outline-primary edit-policy-btn\" title=\"Edit Policy\" data-policy-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\"><i class=\"bi bi-eye\"></i></button> <button type=\"button\" class=\"btn btn-outline-primary edit-policy-btn\" title=\"Edit Policy\" data-policy-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var11 string
-			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(policy.Name)
+			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.ResolveAttributeValue(policy.Name)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/policies.templ`, Line: 142, Col: 171}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var11)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"fas fa-edit\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger delete-policy-btn\" title=\"Delete Policy\" data-policy-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"bi bi-pencil-square\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger delete-policy-btn\" title=\"Delete Policy\" data-policy-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(policy.Name)
+			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.ResolveAttributeValue(policy.Name)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/policies.templ`, Line: 145, Col: 174}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var12)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.Policies) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<tr><td colspan=\"6\" class=\"text-center text-muted py-4\"><i class=\"fas fa-shield-alt fa-3x mb-3 text-muted\"></i><div><h5>No IAM policies found</h5><p>Create your first policy to manage access permissions.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createPolicyModal\"><i class=\"fas fa-plus me-1\"></i>Create Policy</button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<tr><td colspan=\"6\" class=\"text-center text-muted py-4\"><i class=\"bi bi-shield icon-3x mb-3 text-muted\"></i><div><h5>No IAM policies found</h5><p>Create your first policy to manage access permissions.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createPolicyModal\"><i class=\"bi bi-plus me-1\"></i>Create Policy</button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</tbody></table></div></div></div></div></div></div><!-- Create Policy Modal --><div class=\"modal fade\" id=\"createPolicyModal\" tabindex=\"-1\" aria-labelledby=\"createPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createPolicyModalLabel\"><i class=\"fas fa-shield-alt me-2\"></i>Create IAM Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"createPolicyForm\"><div class=\"mb-3\"><label for=\"policyName\" class=\"form-label\">Policy Name</label> <input type=\"text\" class=\"form-control\" id=\"policyName\" name=\"name\" required placeholder=\"e.g., S3ReadOnlyPolicy\"><div class=\"form-text\">Enter a unique name for this policy (alphanumeric and underscores only)</div></div><div class=\"mb-3\"><label for=\"policyDocument\" class=\"form-label\">Policy Document</label> <textarea class=\"form-control\" id=\"policyDocument\" name=\"document\" rows=\"15\" required placeholder=\"Enter IAM policy JSON document...\"></textarea><div class=\"form-text\">Enter the policy document in AWS IAM JSON format</div></div><div class=\"mb-3\"><div class=\"row\"><div class=\"col-md-6\"><button type=\"button\" class=\"btn btn-outline-info btn-sm\" onclick=\"insertSamplePolicy()\"><i class=\"fas fa-file-alt me-1\"></i>Use Sample Policy</button></div><div class=\"col-md-6 text-end\"><button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" onclick=\"validatePolicyDocument()\"><i class=\"fas fa-check me-1\"></i>Validate JSON</button></div></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"createPolicy()\"><i class=\"fas fa-plus me-1\"></i>Create Policy</button></div></div></div></div><!-- View Policy Modal --><div class=\"modal fade\" id=\"viewPolicyModal\" tabindex=\"-1\" aria-labelledby=\"viewPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"viewPolicyModalLabel\"><i class=\"fas fa-eye me-2\"></i>View IAM Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><div id=\"viewPolicyContent\"><div class=\"text-center\"><div class=\"spinner-border\" role=\"status\"><span class=\"visually-hidden\">Loading...</span></div><p class=\"mt-2\">Loading policy...</p></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-primary\" id=\"editFromViewBtn\"><i class=\"fas fa-edit me-1\"></i>Edit Policy</button></div></div></div></div><!-- Edit Policy Modal --><div class=\"modal fade\" id=\"editPolicyModal\" tabindex=\"-1\" aria-labelledby=\"editPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"editPolicyModalLabel\"><i class=\"fas fa-edit me-2\"></i>Edit IAM Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"editPolicyForm\"><div class=\"mb-3\"><label for=\"editPolicyName\" class=\"form-label\">Policy Name</label> <input type=\"text\" class=\"form-control\" id=\"editPolicyName\" name=\"name\" readonly><div class=\"form-text\">Policy name cannot be changed</div></div><div class=\"mb-3\"><label for=\"editPolicyDocument\" class=\"form-label\">Policy Document</label> <textarea class=\"form-control\" id=\"editPolicyDocument\" name=\"document\" rows=\"15\" required></textarea><div class=\"form-text\">Edit the policy document in AWS IAM JSON format</div></div><div class=\"mb-3\"><div class=\"row\"><div class=\"col-md-6\"><button type=\"button\" class=\"btn btn-outline-info btn-sm\" onclick=\"insertSamplePolicyEdit()\"><i class=\"fas fa-file-alt me-1\"></i>Reset to Sample</button></div><div class=\"col-md-6 text-end\"><button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" onclick=\"validateEditPolicyDocument()\"><i class=\"fas fa-check me-1\"></i>Validate JSON</button></div></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"updatePolicy()\"><i class=\"fas fa-save me-1\"></i>Save Changes</button></div></div></div></div><!-- JavaScript for Policy Management --><script>\n    // Current policy being viewed/edited\n    let currentPolicy = null;\n    \n    // Event listeners for policy actions\n    document.addEventListener('DOMContentLoaded', function() {\n        // View policy buttons\n        document.querySelectorAll('.view-policy-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const policyName = this.getAttribute('data-policy-name');\n                viewPolicy(policyName);\n            });\n        });\n        \n        // Edit policy buttons\n        document.querySelectorAll('.edit-policy-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const policyName = this.getAttribute('data-policy-name');\n                editPolicy(policyName);\n            });\n        });\n        \n        // Delete policy buttons\n        document.querySelectorAll('.delete-policy-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const policyName = this.getAttribute('data-policy-name');\n                deletePolicy(policyName);\n            });\n        });\n        \n        // Edit from view button\n        document.getElementById('editFromViewBtn').addEventListener('click', function() {\n            if (currentPolicy) {\n                const viewModal = bootstrap.Modal.getInstance(document.getElementById('viewPolicyModal'));\n                if (viewModal) viewModal.hide();\n                editPolicy(currentPolicy.name);\n            }\n        });\n    });\n    \n    function createPolicy() {\n        const form = document.getElementById('createPolicyForm');\n        const formData = new FormData(form);\n        \n        const policyName = formData.get('name');\n        const policyDocumentText = formData.get('document');\n        \n        if (!policyName || !policyDocumentText) {\n            showAlert('Please fill in all required fields', 'warning');\n            return;\n        }\n        \n        let policyDocument;\n        try {\n            policyDocument = JSON.parse(policyDocumentText);\n        } catch (e) {\n            showAlert('Invalid JSON in policy document: ' + e.message, 'error');\n            return;\n        }\n        \n        const requestData = {\n            name: policyName,\n            document: policyDocument\n        };\n        \n        fetch(basePath('/api/object-store/policies'), {\n            method: 'POST',\n            headers: {\n                'Content-Type': 'application/json',\n            },\n            body: JSON.stringify(requestData)\n        })\n        .then(response => response.json())\n        .then(data => {\n            if (data.success) {\n                showAlert('Policy created successfully!', 'success');\n                const modal = bootstrap.Modal.getInstance(document.getElementById('createPolicyModal'));\n                if (modal) modal.hide();\n                location.reload(); // Refresh the page to show the new policy\n            } else {\n                showAlert('Error creating policy: ' + (data.error || 'Unknown error'), 'error');\n            }\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            showAlert('Error creating policy: ' + error.message, 'error');\n        });\n    }\n    \n    function viewPolicy(policyName) {\n        // Show the modal first\n        const modal = new bootstrap.Modal(document.getElementById('viewPolicyModal'));\n        modal.show();\n        \n        // Reset content to loading state\n        document.getElementById('viewPolicyContent').innerHTML = `\n            <div class=\"text-center\">\n                <div class=\"spinner-border\" role=\"status\">\n                    <span class=\"visually-hidden\">Loading...</span>\n                </div>\n                <p class=\"mt-2\">Loading policy...</p>\n            </div>\n        `;\n        \n        // Fetch policy data\n        fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)))\n        .then(response => {\n            if (!response.ok) {\n                throw new Error('Policy not found');\n            }\n            return response.json();\n        })\n        .then(policy => {\n            currentPolicy = policy;\n            displayPolicyDetails(policy);\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            document.getElementById('viewPolicyContent').innerHTML = `\n                <div class=\"alert alert-danger\" role=\"alert\">\n                    <i class=\"fas fa-exclamation-triangle me-2\"></i>\n                    Error loading policy: ${error.message}\n                </div>\n            `;\n        });\n    }\n    \n    function displayPolicyDetails(policy) {\n        const content = document.getElementById('viewPolicyContent');\n        \n        let statementsHtml = '';\n        if (policy.document && policy.document.Statement) {\n            statementsHtml = policy.document.Statement.map((stmt, index) => `\n                <div class=\"card mb-2\">\n                    <div class=\"card-header py-2\">\n                        <h6 class=\"mb-0\">Statement ${index + 1}</h6>\n                    </div>\n                    <div class=\"card-body py-2\">\n                        <div class=\"row\">\n                            <div class=\"col-md-6\">\n                                <strong>Effect:</strong> \n                                <span class=\"badge ${stmt.Effect === 'Allow' ? 'bg-success' : 'bg-danger'}\">${stmt.Effect}</span>\n                            </div>\n                            <div class=\"col-md-6\">\n                                <strong>Actions:</strong> ${Array.isArray(stmt.Action) ? stmt.Action.join(', ') : stmt.Action}\n                            </div>\n                        </div>\n                        <div class=\"row mt-2\">\n                            <div class=\"col-12\">\n                                <strong>Resources:</strong> ${Array.isArray(stmt.Resource) ? stmt.Resource.join(', ') : stmt.Resource}\n                            </div>\n                        </div>\n                    </div>\n                </div>\n            `).join('');\n        }\n        \n        content.innerHTML = `\n            <div class=\"row mb-3\">\n                <div class=\"col-md-6\">\n                    <strong>Policy Name:</strong> ${policy.name || 'Unknown'}\n                </div>\n                <div class=\"col-md-6\">\n                    <strong>Version:</strong> <span class=\"badge bg-info\">${policy.document?.Version || 'Unknown'}</span>\n                </div>\n            </div>\n            \n            <div class=\"mb-3\">\n                <strong>Statements:</strong>\n                <div class=\"mt-2\">\n                    ${statementsHtml || '<p class=\"text-muted\">No statements found</p>'}\n                </div>\n            </div>\n            \n            <div class=\"mb-3\">\n                <strong>Raw Policy Document:</strong>\n                <pre class=\"bg-light p-3 border rounded mt-2\"><code>${JSON.stringify(policy.document, null, 2)}</code></pre>\n            </div>\n        `;\n    }\n    \n    function editPolicy(policyName) {\n        // Show the modal first\n        const modal = new bootstrap.Modal(document.getElementById('editPolicyModal'));\n        modal.show();\n        \n        // Set policy name\n        document.getElementById('editPolicyName').value = policyName;\n        document.getElementById('editPolicyDocument').value = 'Loading...';\n        \n        // Fetch policy data\n        fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)))\n        .then(response => {\n            if (!response.ok) {\n                throw new Error('Policy not found');\n            }\n            return response.json();\n        })\n        .then(policy => {\n            currentPolicy = policy;\n            document.getElementById('editPolicyDocument').value = JSON.stringify(policy.document, null, 2);\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            showAlert('Error loading policy for editing: ' + error.message, 'error');\n            const editModal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));\n            if (editModal) editModal.hide();\n        });\n    }\n    \n    function updatePolicy() {\n        const policyName = document.getElementById('editPolicyName').value;\n        const policyDocumentText = document.getElementById('editPolicyDocument').value;\n        \n        if (!policyName || !policyDocumentText) {\n            showAlert('Please fill in all required fields', 'warning');\n            return;\n        }\n        \n        let policyDocument;\n        try {\n            policyDocument = JSON.parse(policyDocumentText);\n        } catch (e) {\n            showAlert('Invalid JSON in policy document: ' + e.message, 'error');\n            return;\n        }\n        \n        const requestData = {\n            document: policyDocument\n        };\n        \n        fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)), {\n            method: 'PUT',\n            headers: {\n                'Content-Type': 'application/json',\n            },\n            body: JSON.stringify(requestData)\n        })\n        .then(response => response.json())\n        .then(data => {\n            if (data.success) {\n                showAlert('Policy updated successfully!', 'success');\n                const modal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));\n                if (modal) modal.hide();\n                location.reload(); // Refresh the page to show the updated policy\n            } else {\n                showAlert('Error updating policy: ' + (data.error || 'Unknown error'), 'error');\n            }\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            showAlert('Error updating policy: ' + error.message, 'error');\n        });\n    }\n    \n    function insertSamplePolicy() {\n        const samplePolicy = {\n            \"Version\": \"2012-10-17\",\n            \"Statement\": [\n                {\n                    \"Effect\": \"Allow\",\n                    \"Action\": [\n                        \"s3:GetObject\",\n                        \"s3:PutObject\"\n                    ],\n                    \"Resource\": [\n                        \"arn:aws:s3:::my-bucket/*\"\n                    ]\n                }\n            ]\n        };\n        \n        document.getElementById('policyDocument').value = JSON.stringify(samplePolicy, null, 2);\n    }\n    \n    function insertSamplePolicyEdit() {\n        const samplePolicy = {\n            \"Version\": \"2012-10-17\",\n            \"Statement\": [\n                {\n                    \"Effect\": \"Allow\",\n                    \"Action\": [\n                        \"s3:GetObject\",\n                        \"s3:PutObject\"\n                    ],\n                    \"Resource\": [\n                        \"arn:aws:s3:::my-bucket/*\"\n                    ]\n                }\n            ]\n        };\n        \n        document.getElementById('editPolicyDocument').value = JSON.stringify(samplePolicy, null, 2);\n    }\n    \n    function validatePolicyDocument() {\n        const policyText = document.getElementById('policyDocument').value;\n        validatePolicyJSON(policyText);\n    }\n    \n    function validateEditPolicyDocument() {\n        const policyText = document.getElementById('editPolicyDocument').value;\n        validatePolicyJSON(policyText);\n    }\n    \n    function validatePolicyJSON(policyText) {\n        if (!policyText) {\n            showAlert('Please enter a policy document first', 'warning');\n            return;\n        }\n        \n        try {\n            const policy = JSON.parse(policyText);\n            \n            // Basic validation\n            if (!policy.Version) {\n                showAlert('Policy must have a Version field', 'error');\n                return;\n            }\n            \n            if (!policy.Statement || !Array.isArray(policy.Statement)) {\n                showAlert('Policy must have a Statement array', 'error');\n                return;\n            }\n            \n            showAlert('Policy document is valid JSON!', 'success');\n        } catch (e) {\n            showAlert('Invalid JSON: ' + e.message, 'error');\n        }\n    }\n    \n    function deletePolicy(policyName) {\n        showDeleteConfirm(policyName, function() {\n            fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)), {\n                method: 'DELETE'\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.success) {\n                    showAlert('Policy deleted successfully!', 'success');\n                    location.reload();\n                } else {\n                    showAlert('Error deleting policy: ' + (data.error || 'Unknown error'), 'error');\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showAlert('Error deleting policy: ' + error.message, 'error');\n            });\n        });\n    }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</tbody></table></div></div></div></div></div></div>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<!-- Create Policy Modal --><div class=\"modal fade\" id=\"createPolicyModal\" tabindex=\"-1\" aria-labelledby=\"createPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createPolicyModalLabel\"><i class=\"bi bi-shield me-2\"></i>Create IAM Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"createPolicyForm\"><div class=\"mb-3\"><label for=\"policyName\" class=\"form-label\">Policy Name</label> <input type=\"text\" class=\"form-control\" id=\"policyName\" name=\"name\" required placeholder=\"e.g., S3ReadOnlyPolicy\"><div class=\"form-text\">Enter a unique name for this policy (alphanumeric and underscores only)</div></div><ul class=\"nav nav-tabs\" role=\"tablist\"><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link active\" id=\"createPolicyEditorTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#createPolicyEditorTab\">Editor</button></li><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link\" id=\"createPolicyJsonTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#createPolicyJsonTab\">JSON</button></li></ul><div class=\"tab-content border border-top-0 rounded-bottom p-3 mb-3\"><div class=\"tab-pane fade show active\" id=\"createPolicyEditorTab\"><div id=\"createPolicyEditorBody\"></div><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"createPolicyAddStatementBtn\"><i class=\"bi bi-plus me-1\"></i>Add statement</button></div><div class=\"tab-pane fade\" id=\"createPolicyJsonTab\"><textarea class=\"form-control\" id=\"policyDocument\" name=\"document\" rows=\"15\" placeholder=\"Enter IAM policy JSON document...\"></textarea><div class=\"form-text\">Enter the policy document in AWS IAM JSON format</div></div></div><div class=\"mb-3 d-flex justify-content-between\"><button type=\"button\" class=\"btn btn-outline-info btn-sm\" onclick=\"insertSamplePolicy('create')\"><i class=\"bi bi-file-earmark-text me-1\"></i>Use Sample Policy</button> <button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" onclick=\"validatePolicyDocument('create')\"><i class=\"bi bi-check me-1\"></i>Validate</button></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"createPolicy()\"><i class=\"bi bi-plus me-1\"></i>Create Policy</button></div></div></div></div><!-- View Policy Modal --><div class=\"modal fade\" id=\"viewPolicyModal\" tabindex=\"-1\" aria-labelledby=\"viewPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"viewPolicyModalLabel\"><i class=\"bi bi-eye me-2\"></i>View IAM Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><div id=\"viewPolicyContent\"><div class=\"text-center\"><div class=\"spinner-border\" role=\"status\"><span class=\"visually-hidden\">Loading...</span></div><p class=\"mt-2\">Loading policy...</p></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-primary\" id=\"editFromViewBtn\"><i class=\"bi bi-pencil-square me-1\"></i>Edit Policy</button></div></div></div></div><!-- Edit Policy Modal --><div class=\"modal fade\" id=\"editPolicyModal\" tabindex=\"-1\" aria-labelledby=\"editPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"editPolicyModalLabel\"><i class=\"bi bi-pencil-square me-2\"></i>Edit IAM Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><form id=\"editPolicyForm\"><div class=\"mb-3\"><label for=\"editPolicyName\" class=\"form-label\">Policy Name</label> <input type=\"text\" class=\"form-control\" id=\"editPolicyName\" name=\"name\" readonly><div class=\"form-text\">Policy name cannot be changed</div></div><ul class=\"nav nav-tabs\" role=\"tablist\"><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link active\" id=\"editPolicyEditorTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#editPolicyEditorTab\">Editor</button></li><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link\" id=\"editPolicyJsonTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#editPolicyJsonTab\">JSON</button></li></ul><div class=\"tab-content border border-top-0 rounded-bottom p-3 mb-3\"><div class=\"tab-pane fade show active\" id=\"editPolicyEditorTab\"><div id=\"editPolicyEditorBody\"></div><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"editPolicyAddStatementBtn\"><i class=\"bi bi-plus me-1\"></i>Add statement</button></div><div class=\"tab-pane fade\" id=\"editPolicyJsonTab\"><textarea class=\"form-control\" id=\"editPolicyDocument\" name=\"document\" rows=\"15\"></textarea><div class=\"form-text\">Edit the policy document in AWS IAM JSON format</div></div></div><div class=\"mb-3 d-flex justify-content-between\"><button type=\"button\" class=\"btn btn-outline-info btn-sm\" onclick=\"insertSamplePolicy('edit')\"><i class=\"bi bi-file-earmark-text me-1\"></i>Reset to Sample</button> <button type=\"button\" class=\"btn btn-outline-secondary btn-sm\" onclick=\"validatePolicyDocument('edit')\"><i class=\"bi bi-check me-1\"></i>Validate</button></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"updatePolicy()\"><i class=\"bi bi-floppy me-1\"></i>Save Changes</button></div></div></div></div><!-- JavaScript for Policy Management --><script>\n    // Current policy being viewed/edited\n    let currentPolicy = null;\n    // Drop edit-modal GET responses superseded by a later editPolicy call,\n    // so a stalled load for one policy can't populate the editor while the\n    // name field already says another. Same pattern as the bucket and\n    // S3 Tables policy dialogs.\n    let editPolicyRequestSeq = 0;\n\n    // Event listeners for policy actions\n    document.addEventListener('DOMContentLoaded', function() {\n        // Register the two editor instances used on this page. Config\n        // overrides here preserve the pre-extraction ids exactly, so this\n        // page's markup did not need to change. This has to run after\n        // DOMContentLoaded (not at the top of this script) because\n        // policy_editor.js - which defines registerPolicyEditor - is\n        // loaded by layout.templ's script bundle at the end of <body>,\n        // i.e. after this page's own content (including this inline\n        // script) has already been parsed and run.\n        registerPolicyEditor('create', { textareaId: 'policyDocument' });\n        registerPolicyEditor('edit', { textareaId: 'editPolicyDocument' });\n        setupPolicyEditor('create');\n        setupPolicyEditor('edit');\n\n        // View policy buttons\n        document.querySelectorAll('.view-policy-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const policyName = this.getAttribute('data-policy-name');\n                viewPolicy(policyName);\n            });\n        });\n\n        // Edit policy buttons\n        document.querySelectorAll('.edit-policy-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const policyName = this.getAttribute('data-policy-name');\n                editPolicy(policyName);\n            });\n        });\n\n        // Delete policy buttons\n        document.querySelectorAll('.delete-policy-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const policyName = this.getAttribute('data-policy-name');\n                deletePolicy(policyName);\n            });\n        });\n\n        // Edit from view button\n        document.getElementById('editFromViewBtn').addEventListener('click', function() {\n            if (currentPolicy) {\n                const viewModal = bootstrap.Modal.getInstance(document.getElementById('viewPolicyModal'));\n                if (viewModal) viewModal.hide();\n                editPolicy(currentPolicy.name);\n            }\n        });\n\n        // Reset the create modal's editor each time it's opened, so leftover\n        // state from a previous (possibly cancelled) create doesn't leak in.\n        document.getElementById('createPolicyModal').addEventListener('show.bs.modal', function() {\n            document.getElementById('createPolicyForm').reset();\n            policyEditors.create = { version: '2012-10-17', statements: [], otherFields: {} };\n            renderPolicyEditor('create');\n            const editorTab = bootstrap.Tab.getOrCreateInstance(document.getElementById('createPolicyEditorTabBtn'));\n            editorTab.show();\n        });\n    });\n\n    function createPolicy() {\n        if (!commitPolicyActiveTab('create')) return;\n        if (!confirmPolicyFieldDiscard('create')) return;\n\n        const policyName = document.getElementById('policyName').value;\n        const policyDocumentText = document.getElementById('policyDocument').value;\n\n        if (!policyName || !policyDocumentText) {\n            showAlert('Please fill in all required fields', 'warning');\n            return;\n        }\n\n        let policyDocument;\n        try {\n            policyDocument = JSON.parse(policyDocumentText);\n        } catch (e) {\n            showAlert('Invalid JSON in policy document: ' + e.message, 'error');\n            return;\n        }\n\n        const requestData = {\n            name: policyName,\n            document: policyDocument\n        };\n\n        validatePolicyJSON(policyDocumentText, true).then(valid => {\n            if (!valid) return;\n\n            fetch(basePath('/api/object-store/policies'), {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(requestData)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.success) {\n                    showAlert('Policy created successfully!', 'success');\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('createPolicyModal'));\n                    if (modal) modal.hide();\n                    location.reload(); // Refresh the page to show the new policy\n                } else {\n                    showAlert('Error creating policy: ' + (data.error || 'Unknown error'), 'error');\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showAlert('Error creating policy: ' + error.message, 'error');\n            });\n        });\n    }\n\n    function viewPolicy(policyName) {\n        // Show the modal first\n        const modal = new bootstrap.Modal(document.getElementById('viewPolicyModal'));\n        modal.show();\n\n        // Reset content to loading state\n        document.getElementById('viewPolicyContent').innerHTML = `\n            <div class=\"text-center\">\n                <div class=\"spinner-border\" role=\"status\">\n                    <span class=\"visually-hidden\">Loading...</span>\n                </div>\n                <p class=\"mt-2\">Loading policy...</p>\n            </div>\n        `;\n\n        // Fetch policy data\n        fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)))\n        .then(response => {\n            if (!response.ok) {\n                throw new Error('Policy not found');\n            }\n            return response.json();\n        })\n        .then(policy => {\n            currentPolicy = policy;\n            displayPolicyDetails(policy);\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            document.getElementById('viewPolicyContent').innerHTML = `\n                <div class=\"alert alert-danger\" role=\"alert\">\n                    <i class=\"bi bi-exclamation-triangle me-2\"></i>\n                    Error loading policy: ${error.message}\n                </div>\n            `;\n        });\n    }\n\n    function displayPolicyDetails(policy) {\n        const content = document.getElementById('viewPolicyContent');\n\n        // Escapes a policy value for display, whether it's carried as a\n        // single value or a list, and whatever type it turns out to be.\n        function escapedJoin(list) {\n            if (list === undefined || list === null) return '';\n            return (Array.isArray(list) ? list : [list]).map(function(v) { return escapeHtml(String(v)); }).join(', ');\n        }\n\n        // Summarizes a Principal/NotPrincipal value for read-only display,\n        // regardless of shape (bare string/array, or a {\"Type\": ...} object -\n        // possibly with several type keys), since the View modal must stay\n        // correct even for forms the structured editor doesn't model.\n        function principalSummary(value) {\n            if (value === undefined || value === null) return '';\n            if (Array.isArray(value)) return escapedJoin(value);\n            if (typeof value === 'object') {\n                return Object.keys(value).map(function(key) {\n                    const v = value[key];\n                    return escapeHtml(key) + ': ' + escapedJoin(v);\n                }).join('; ');\n            }\n            return escapeHtml(String(value));\n        }\n\n        let statementsHtml = '';\n        if (policy.document && policy.document.Statement) {\n            statementsHtml = policy.document.Statement.map((stmt, index) => `\n                <div class=\"card mb-2\">\n                    <div class=\"card-header py-2\">\n                        <h6 class=\"mb-0\">Statement ${index + 1}${stmt.Sid ? ' &mdash; ' + escapeHtml(stmt.Sid) : ''}</h6>\n                    </div>\n                    <div class=\"card-body py-2\">\n                        <div class=\"row\">\n                            <div class=\"col-md-6\">\n                                <strong>Effect:</strong>\n                                <span class=\"badge ${stmt.Effect === 'Allow' ? 'bg-success' : 'bg-danger'}\">${escapedJoin(stmt.Effect)}</span>\n                            </div>\n                            <div class=\"col-md-6\">\n                                <strong>Actions:</strong> ${escapedJoin(stmt.Action)}\n                            </div>\n                        </div>\n                        <div class=\"row mt-2\">\n                            <div class=\"col-12\">\n                                ${stmt.NotResource\n                                    ? '<strong>NotResource (excluded):</strong> ' + escapedJoin(stmt.NotResource)\n                                    : '<strong>Resource:</strong> ' + escapedJoin(stmt.Resource)}\n                            </div>\n                        </div>\n                        ${(stmt.Principal || stmt.NotPrincipal)\n                            ? '<div class=\"row mt-2\"><div class=\"col-12\">' +\n                                (stmt.NotPrincipal\n                                    ? '<strong>NotPrincipal (excluded):</strong> ' + principalSummary(stmt.NotPrincipal)\n                                    : '<strong>Principal:</strong> ' + principalSummary(stmt.Principal)) +\n                                '</div></div>'\n                            : ''}\n                    </div>\n                </div>\n            `).join('');\n        }\n\n        content.innerHTML = `\n            <div class=\"row mb-3\">\n                <div class=\"col-md-6\">\n                    <strong>Policy Name:</strong> ${escapedJoin(policy.name || 'Unknown')}\n                </div>\n                <div class=\"col-md-6\">\n                    <strong>Version:</strong> <span class=\"badge bg-info\">${escapedJoin(policy.document?.Version || 'Unknown')}</span>\n                </div>\n            </div>\n\n            <div class=\"mb-3\">\n                <strong>Statements:</strong>\n                <div class=\"mt-2\">\n                    ${statementsHtml || '<p class=\"text-muted\">No statements found</p>'}\n                </div>\n            </div>\n\n            <div class=\"mb-3\">\n                <strong>Raw Policy Document:</strong>\n                <pre class=\"bg-light p-3 border rounded mt-2\"><code>${escapeHtml(JSON.stringify(policy.document, null, 2))}</code></pre>\n            </div>\n        `;\n    }\n\n    function editPolicy(policyName) {\n        // Show the modal first\n        const modal = new bootstrap.Modal(document.getElementById('editPolicyModal'));\n        modal.show();\n\n        // Set policy name\n        document.getElementById('editPolicyName').value = policyName;\n        document.getElementById('editPolicyDocument').value = 'Loading...';\n        policyEditors.edit = { version: '2012-10-17', statements: [], otherFields: {} };\n        renderPolicyEditor('edit');\n\n        // Fetch policy data; drop the response if another editPolicy call\n        // superseded this one meanwhile.\n        const requestSeq = ++editPolicyRequestSeq;\n        fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)))\n        .then(response => {\n            if (!response.ok) {\n                throw new Error('Policy not found');\n            }\n            return response.json();\n        })\n        .then(policy => {\n            if (requestSeq !== editPolicyRequestSeq) return;\n            currentPolicy = policy;\n            document.getElementById('editPolicyDocument').value = JSON.stringify(policy.document, null, 2);\n            let state;\n            try {\n                state = policyDocToEditorState('edit', policy.document);\n            } catch (e) {\n                // Valid JSON the structured editor can't model. The JSON tab\n                // exists for exactly this, so hand the document over to it\n                // rather than closing the modal on the only view of it.\n                policyEditors.edit = { version: '2012-10-17', statements: [], otherFields: {}, unparsed: true };\n                renderPolicyEditor('edit');\n                showAlert(e.message + '. ' + POLICY_JSON_TAB_ONLY_MESSAGE, 'error');\n                bootstrap.Tab.getOrCreateInstance(document.getElementById('editPolicyJsonTabBtn')).show();\n                return;\n            }\n            policyEditors.edit = state;\n            renderPolicyEditor('edit');\n            const editorTab = bootstrap.Tab.getOrCreateInstance(document.getElementById('editPolicyEditorTabBtn'));\n            editorTab.show();\n        })\n        .catch(error => {\n            if (requestSeq !== editPolicyRequestSeq) return;\n            console.error('Error:', error);\n            showAlert('Error loading policy for editing: ' + error.message, 'error');\n            const editModal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));\n            if (editModal) editModal.hide();\n        });\n    }\n\n    function updatePolicy() {\n        if (!commitPolicyActiveTab('edit')) return;\n        if (!confirmPolicyFieldDiscard('edit')) return;\n\n        const policyName = document.getElementById('editPolicyName').value;\n        const policyDocumentText = document.getElementById('editPolicyDocument').value;\n\n        if (!policyName || !policyDocumentText) {\n            showAlert('Please fill in all required fields', 'warning');\n            return;\n        }\n\n        let policyDocument;\n        try {\n            policyDocument = JSON.parse(policyDocumentText);\n        } catch (e) {\n            showAlert('Invalid JSON in policy document: ' + e.message, 'error');\n            return;\n        }\n\n        const requestData = {\n            document: policyDocument\n        };\n\n        validatePolicyJSON(policyDocumentText, true).then(valid => {\n            if (!valid) return;\n\n            fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)), {\n                method: 'PUT',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(requestData)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.success) {\n                    showAlert('Policy updated successfully!', 'success');\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('editPolicyModal'));\n                    if (modal) modal.hide();\n                    location.reload(); // Refresh the page to show the updated policy\n                } else {\n                    showAlert('Error updating policy: ' + (data.error || 'Unknown error'), 'error');\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showAlert('Error updating policy: ' + error.message, 'error');\n            });\n        });\n    }\n\n    function validatePolicyDocument(which) {\n        if (!commitPolicyActiveTab(which)) return;\n        const policyText = document.getElementById(policyTextareaId(which)).value;\n        validatePolicyJSON(policyText);\n    }\n\n    // Runs a policy document past the server's validator. Resolves to true\n    // when it passes, and to false after alerting the user when it doesn't.\n    // `quiet` suppresses the success alert for callers that go on to report\n    // an outcome of their own.\n    function validatePolicyJSON(policyText, quiet) {\n        if (!policyText) {\n            showAlert('Please enter a policy document first', 'warning');\n            return Promise.resolve(false);\n        }\n\n        let policyDocument;\n        try {\n            policyDocument = JSON.parse(policyText);\n        } catch (e) {\n            showAlert('Invalid JSON: ' + e.message, 'error');\n            return Promise.resolve(false);\n        }\n\n        return fetch(basePath('/api/object-store/policies/validate'), {\n            method: 'POST',\n            headers: {\n                'Content-Type': 'application/json',\n            },\n            body: JSON.stringify({ document: policyDocument })\n        })\n        .then(response => response.json().then(data => ({ ok: response.ok, data })))\n        .then(({ ok, data }) => {\n            if (ok && data.valid) {\n                if (!quiet) {\n                    showAlert(data.message || 'Policy document is valid!', 'success');\n                }\n                return true;\n            }\n            showAlert('Invalid policy: ' + (data.error || 'unknown error'), 'error');\n            return false;\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            showAlert('Error validating policy: ' + error.message, 'error');\n            return false;\n        });\n    }\n\n    function deletePolicy(policyName) {\n        showDeleteConfirm(policyName, function() {\n            fetch(basePath('/api/object-store/policies/' + encodeURIComponent(policyName)), {\n                method: 'DELETE'\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.success) {\n                    showAlert('Policy deleted successfully!', 'success');\n                    location.reload();\n                } else {\n                    showAlert('Error deleting policy: ' + (data.error || 'Unknown error'), 'error');\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showAlert('Error deleting policy: ' + error.message, 'error');\n            });\n        });\n    }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/policy_action_suggestions.go b/weed/admin/view/app/policy_action_suggestions.go
new file mode 100644
index 0000000000..2bb11ef170
--- /dev/null
+++ b/weed/admin/view/app/policy_action_suggestions.go
@@ -0,0 +1,123 @@
+package app
+
+import (
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+// PolicyActionSuggestions feeds the <datalist> used by the structured policy
+// editor's Action inputs. This is an input-assistance aid, NOT a validation
+// list: the editor accepts any action string typed by hand, since IAM policy
+// actions are not restricted to this set (custom/future actions, wildcards
+// like "s3:Get*", etc.).
+var PolicyActionSuggestions = buildPolicyActionSuggestions()
+
+// S3TablesPolicyActionSuggestions is the s3tables: subset, for the S3 Tables
+// policy editors whose evaluator only matches s3tables actions.
+var S3TablesPolicyActionSuggestions = func() []string {
+	var out []string
+	for _, a := range PolicyActionSuggestions {
+		if strings.HasPrefix(a, "s3tables:") {
+			out = append(out, a)
+		}
+	}
+	return out
+}()
+
+func buildPolicyActionSuggestions() []string {
+	return []string{
+		// s3: actions, sourced from the constants used elsewhere for policy
+		// evaluation (weed/s3api/s3_constants/s3_action_strings.go) so the
+		// suggestion list can't drift from the strings the engine actually
+		// understands.
+		s3_constants.S3_ACTION_ALL,
+		s3_constants.S3_ACTION_GET_OBJECT,
+		s3_constants.S3_ACTION_PUT_OBJECT,
+		s3_constants.S3_ACTION_DELETE_OBJECT,
+		s3_constants.S3_ACTION_DELETE_OBJECT_VERSION,
+		s3_constants.S3_ACTION_GET_OBJECT_VERSION,
+		s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES,
+		s3_constants.S3_ACTION_GET_OBJECT_ACL,
+		s3_constants.S3_ACTION_PUT_OBJECT_ACL,
+		s3_constants.S3_ACTION_GET_OBJECT_TAGGING,
+		s3_constants.S3_ACTION_PUT_OBJECT_TAGGING,
+		s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING,
+		s3_constants.S3_ACTION_GET_OBJECT_RETENTION,
+		s3_constants.S3_ACTION_PUT_OBJECT_RETENTION,
+		s3_constants.S3_ACTION_GET_OBJECT_LEGAL_HOLD,
+		s3_constants.S3_ACTION_PUT_OBJECT_LEGAL_HOLD,
+		s3_constants.S3_ACTION_BYPASS_GOVERNANCE,
+		s3_constants.S3_ACTION_CREATE_MULTIPART,
+		s3_constants.S3_ACTION_UPLOAD_PART,
+		s3_constants.S3_ACTION_COMPLETE_MULTIPART,
+		s3_constants.S3_ACTION_ABORT_MULTIPART,
+		s3_constants.S3_ACTION_UPLOAD_PART_COPY,
+		s3_constants.S3_ACTION_LIST_PARTS,
+		s3_constants.S3_ACTION_LIST_MULTIPART_UPLOADS,
+		s3_constants.S3_ACTION_CREATE_BUCKET,
+		s3_constants.S3_ACTION_DELETE_BUCKET,
+		s3_constants.S3_ACTION_LIST_BUCKET,
+		s3_constants.S3_ACTION_LIST_BUCKET_VERSIONS,
+		s3_constants.S3_ACTION_GET_BUCKET_ACL,
+		s3_constants.S3_ACTION_PUT_BUCKET_ACL,
+		s3_constants.S3_ACTION_GET_BUCKET_POLICY,
+		s3_constants.S3_ACTION_PUT_BUCKET_POLICY,
+		s3_constants.S3_ACTION_DELETE_BUCKET_POLICY,
+		s3_constants.S3_ACTION_GET_BUCKET_TAGGING,
+		s3_constants.S3_ACTION_PUT_BUCKET_TAGGING,
+		s3_constants.S3_ACTION_DELETE_BUCKET_TAGGING,
+		s3_constants.S3_ACTION_GET_BUCKET_CORS,
+		s3_constants.S3_ACTION_PUT_BUCKET_CORS,
+		s3_constants.S3_ACTION_DELETE_BUCKET_CORS,
+		s3_constants.S3_ACTION_GET_BUCKET_LIFECYCLE,
+		s3_constants.S3_ACTION_PUT_BUCKET_LIFECYCLE,
+		s3_constants.S3_ACTION_GET_BUCKET_VERSIONING,
+		s3_constants.S3_ACTION_PUT_BUCKET_VERSIONING,
+		s3_constants.S3_ACTION_GET_BUCKET_LOCATION,
+		s3_constants.S3_ACTION_GET_BUCKET_NOTIFICATION,
+		s3_constants.S3_ACTION_PUT_BUCKET_NOTIFICATION,
+		s3_constants.S3_ACTION_GET_BUCKET_OBJECT_LOCK,
+		s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK,
+
+		// s3tables: actions, sourced from weed/s3api/s3_constants so this list
+		// can't drift from the strings the s3tables engine actually understands.
+		s3_constants.S3TABLES_ACTION_ALL,
+		s3_constants.S3TABLES_ACTION_CREATE_TABLE_BUCKET,
+		s3_constants.S3TABLES_ACTION_GET_TABLE_BUCKET,
+		s3_constants.S3TABLES_ACTION_LIST_TABLE_BUCKETS,
+		s3_constants.S3TABLES_ACTION_DELETE_TABLE_BUCKET,
+		s3_constants.S3TABLES_ACTION_PUT_TABLE_BUCKET_POLICY,
+		s3_constants.S3TABLES_ACTION_GET_TABLE_BUCKET_POLICY,
+		s3_constants.S3TABLES_ACTION_DELETE_TABLE_BUCKET_POLICY,
+		s3_constants.S3TABLES_ACTION_CREATE_NAMESPACE,
+		s3_constants.S3TABLES_ACTION_GET_NAMESPACE,
+		s3_constants.S3TABLES_ACTION_UPDATE_NAMESPACE,
+		s3_constants.S3TABLES_ACTION_LIST_NAMESPACES,
+		s3_constants.S3TABLES_ACTION_DELETE_NAMESPACE,
+		s3_constants.S3TABLES_ACTION_CREATE_TABLE,
+		s3_constants.S3TABLES_ACTION_REGISTER_TABLE,
+		s3_constants.S3TABLES_ACTION_GET_TABLE,
+		s3_constants.S3TABLES_ACTION_LIST_TABLES,
+		s3_constants.S3TABLES_ACTION_UPDATE_TABLE,
+		s3_constants.S3TABLES_ACTION_DELETE_TABLE,
+		s3_constants.S3TABLES_ACTION_RENAME_TABLE,
+		s3_constants.S3TABLES_ACTION_CREATE_VIEW,
+		s3_constants.S3TABLES_ACTION_GET_VIEW,
+		s3_constants.S3TABLES_ACTION_LIST_VIEWS,
+		s3_constants.S3TABLES_ACTION_UPDATE_VIEW,
+		s3_constants.S3TABLES_ACTION_DELETE_VIEW,
+		s3_constants.S3TABLES_ACTION_RENAME_VIEW,
+		s3_constants.S3TABLES_ACTION_PUT_TABLE_POLICY,
+		s3_constants.S3TABLES_ACTION_GET_TABLE_POLICY,
+		s3_constants.S3TABLES_ACTION_DELETE_TABLE_POLICY,
+		s3_constants.S3TABLES_ACTION_PUT_TABLE_BUCKET_MAINTENANCE_CONFIGURATION,
+		s3_constants.S3TABLES_ACTION_GET_TABLE_BUCKET_MAINTENANCE_CONFIGURATION,
+		s3_constants.S3TABLES_ACTION_PUT_TABLE_MAINTENANCE_CONFIGURATION,
+		s3_constants.S3TABLES_ACTION_GET_TABLE_MAINTENANCE_CONFIGURATION,
+		s3_constants.S3TABLES_ACTION_GET_TABLE_MAINTENANCE_JOB_STATUS,
+		s3_constants.S3TABLES_ACTION_TAG_RESOURCE,
+		s3_constants.S3TABLES_ACTION_LIST_TAGS_FOR_RESOURCE,
+		s3_constants.S3TABLES_ACTION_UNTAG_RESOURCE,
+	}
+}
diff --git a/weed/admin/view/app/policy_action_suggestions_test.go b/weed/admin/view/app/policy_action_suggestions_test.go
new file mode 100644
index 0000000000..d45cee4204
--- /dev/null
+++ b/weed/admin/view/app/policy_action_suggestions_test.go
@@ -0,0 +1,38 @@
+package app
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestPolicyActionSuggestions_NotEmpty(t *testing.T) {
+	if len(PolicyActionSuggestions) == 0 {
+		t.Fatal("expected at least one suggestion")
+	}
+}
+
+func TestPolicyActionSuggestions_NoDuplicates(t *testing.T) {
+	seen := make(map[string]bool, len(PolicyActionSuggestions))
+	for _, action := range PolicyActionSuggestions {
+		if seen[action] {
+			t.Errorf("duplicate action suggestion: %q", action)
+		}
+		seen[action] = true
+	}
+}
+
+func TestPolicyActionSuggestions_AllPrefixed(t *testing.T) {
+	for _, action := range PolicyActionSuggestions {
+		if !strings.HasPrefix(action, "s3:") && !strings.HasPrefix(action, "s3tables:") {
+			t.Errorf("action suggestion %q is not prefixed with a known service", action)
+		}
+	}
+}
+
+func TestPolicyActionSuggestions_NoEmptyStrings(t *testing.T) {
+	for i, action := range PolicyActionSuggestions {
+		if strings.TrimSpace(action) == "" {
+			t.Errorf("suggestion at index %d is empty", i)
+		}
+	}
+}
diff --git a/weed/admin/view/app/policy_datalists.templ b/weed/admin/view/app/policy_datalists.templ
new file mode 100644
index 0000000000..d29f0de06a
--- /dev/null
+++ b/weed/admin/view/app/policy_datalists.templ
@@ -0,0 +1,62 @@
+package app
+
+// PolicyDatalists renders the <datalist> elements the shared visual policy
+// editor (weed/admin/static/js/policy_editor.js) attaches its
+// action/resource/principal <input list="..."> suggestions to, plus the
+// styles the editor's generated markup depends on. Any page embedding that
+// editor must render this once; the ids (policyActionSuggestions,
+// policyResourceSuggestions, policyPrincipalSuggestions) are the
+// registerPolicyEditor defaults, so a page only needs to override them if
+// it renders more than one instance of this component.
+templ PolicyDatalists() {
+	<style>
+	/* Groups a statement's Sid/Effect and its Action/Resource/Principal
+	   sections in the structured policy editor. Plain <fieldset>/<legend>
+	   render fine natively, but Bootstrap's form reset stretches <legend> to
+	   the fieldset's full width (float: left; width: 100%), which loses the
+	   usual "notch in the border" look and makes the label bar as wide as
+	   the card. Undo just that here so the legend hugs its content instead.
+	*/
+	.policy-stmt-fieldset {
+		border: 1px solid var(--bs-border-color, #dee2e6);
+		border-radius: 0.375rem;
+		padding: 0 0.75rem 0.75rem;
+		margin: 0.75rem 0 0;
+	}
+	.policy-stmt-legend {
+		float: none;
+		width: auto;
+		max-width: 100%;
+		padding: 0 0.5rem;
+		margin: 0 0 0.25rem;
+		font-size: 0.8125rem;
+		font-weight: 600;
+		color: var(--bs-secondary-color, #6c757d);
+	}
+	</style>
+
+	<!-- Datalist of suggested action names, shared by every policy editor on this page -->
+	<datalist id="policyActionSuggestions">
+		for _, action := range PolicyActionSuggestions {
+			<option value={ action }></option>
+		}
+	</datalist>
+
+	<!-- The s3tables: subset, for editors over the S3 Tables policy engine
+	     (registered with actionDatalistId: 's3tablesPolicyActionSuggestions') -->
+	<datalist id="s3tablesPolicyActionSuggestions">
+		for _, action := range S3TablesPolicyActionSuggestions {
+			<option value={ action }></option>
+		}
+	</datalist>
+
+	<!-- Populated dynamically as the user types in a Resource field: bucket
+	     names first, then subfolders one path segment at a time. See
+	     updatePolicyResourceSuggestions() in policy_editor.js. -->
+	<datalist id="policyResourceSuggestions"></datalist>
+
+	<!-- Populated dynamically as the user types/focuses a Principal field:
+	     existing users and IAM roles, fetched once from /api/principals. See
+	     updatePolicyPrincipalSuggestions() in policy_editor.js. -->
+	<datalist id="policyPrincipalSuggestions"></datalist>
+}
diff --git a/weed/admin/view/app/policy_datalists_templ.go b/weed/admin/view/app/policy_datalists_templ.go
new file mode 100644
index 0000000000..a1ab32fab1
--- /dev/null
+++ b/weed/admin/view/app/policy_datalists_templ.go
@@ -0,0 +1,94 @@
+// Code generated by templ - DO NOT EDIT.
+
+// templ: version: v0.3.1020
+package app
+
+//lint:file-ignore SA4006 This context is only used if a nested component is present.
+
+import "github.com/a-h/templ"
+import templruntime "github.com/a-h/templ/runtime"
+
+// PolicyDatalists renders the <datalist> elements the shared visual policy
+// editor (weed/admin/static/js/policy_editor.js) attaches its
+// action/resource/principal <input list="..."> suggestions to, plus the
+// styles the editor's generated markup depends on. Any page embedding that
+// editor must render this once; the ids (policyActionSuggestions,
+// policyResourceSuggestions, policyPrincipalSuggestions) are the
+// registerPolicyEditor defaults, so a page only needs to override them if
+// it renders more than one instance of this component.
+func PolicyDatalists() templ.Component {
+	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
+			return templ_7745c5c3_CtxErr
+		}
+		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+		if !templ_7745c5c3_IsBuffer {
+			defer func() {
+				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+				if templ_7745c5c3_Err == nil {
+					templ_7745c5c3_Err = templ_7745c5c3_BufErr
+				}
+			}()
+		}
+		ctx = templ.InitializeContext(ctx)
+		templ_7745c5c3_Var1 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var1 == nil {
+			templ_7745c5c3_Var1 = templ.NopComponent
+		}
+		ctx = templ.ClearChildren(ctx)
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<style>\n\t/* Groups a statement's Sid/Effect and its Action/Resource/Principal\n\t   sections in the structured policy editor. Plain <fieldset>/<legend>\n\t   render fine natively, but Bootstrap's form reset stretches <legend> to\n\t   the fieldset's full width (float: left; width: 100%), which loses the\n\t   usual \"notch in the border\" look and makes the label bar as wide as\n\t   the card. Undo just that here so the legend hugs its content instead.\n\t*/\n\t.policy-stmt-fieldset {\n\t\tborder: 1px solid var(--bs-border-color, #dee2e6);\n\t\tborder-radius: 0.375rem;\n\t\tpadding: 0 0.75rem 0.75rem;\n\t\tmargin: 0.75rem 0 0;\n\t}\n\t.policy-stmt-legend {\n\t\tfloat: none;\n\t\twidth: auto;\n\t\tmax-width: 100%;\n\t\tpadding: 0 0.5rem;\n\t\tmargin: 0 0 0.25rem;\n\t\tfont-size: 0.8125rem;\n\t\tfont-weight: 600;\n\t\tcolor: var(--bs-secondary-color, #6c757d);\n\t}\n\t</style><!-- Datalist of suggested action names, shared by every policy editor on this page --><datalist id=\"policyActionSuggestions\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, action := range PolicyActionSuggestions {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<option value=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var2 string
+			templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue(action)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/policy_datalists.templ`, Line: 41, Col: 25}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\"></option>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</datalist><!-- The s3tables: subset, for editors over the S3 Tables policy engine\n\t     (registered with actionDatalistId: 's3tablesPolicyActionSuggestions') --><datalist id=\"s3tablesPolicyActionSuggestions\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, action := range S3TablesPolicyActionSuggestions {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<option value=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var3 string
+			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(action)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/policy_datalists.templ`, Line: 49, Col: 25}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "\"></option>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</datalist><!-- Populated dynamically as the user types in a Resource field: bucket\n\t     names first, then subfolders one path segment at a time. See\n\t     updatePolicyResourceSuggestions() in policy_editor.js. --><datalist id=\"policyResourceSuggestions\"></datalist><!-- Populated dynamically as the user types/focuses a Principal field:\n\t     existing users and IAM roles, fetched once from /api/principals. See\n\t     updatePolicyPrincipalSuggestions() in policy_editor.js. --><datalist id=\"policyPrincipalSuggestions\"></datalist>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		return nil
+	})
+}
+
+var _ = templruntime.GeneratedTemplate
diff --git a/weed/admin/view/app/s3_buckets.templ b/weed/admin/view/app/s3_buckets.templ
index 224de2adcb..fb9384f333 100644
--- a/weed/admin/view/app/s3_buckets.templ
+++ b/weed/admin/view/app/s3_buckets.templ
@@ -8,7 +8,7 @@ import (
 templ S3Buckets(data dash.S3BucketsData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <h1 class="h2">
-            <i class="fas fa-cube me-2"></i>Object Store Buckets
+            <i class="bi bi-box me-2"></i>Object Store Buckets
         </h1>
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
@@ -21,7 +21,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                 <button type="button" class="btn btn-sm btn-primary"
                         data-bs-toggle="modal"
                         data-bs-target="#createBucketModal">
-                    <i class="fas fa-plus me-1"></i>Create Bucket
+                    <i class="bi bi-plus me-1"></i>Create Bucket
                 </button>
             </div>
         </div>
@@ -43,7 +43,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-cube fa-2x text-gray-300"></i>
+                                <i class="bi bi-box icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -63,7 +63,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-hdd fa-2x text-gray-300"></i>
+                                <i class="bi bi-device-hdd icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -84,7 +84,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-clock fa-2x text-gray-300"></i>
+                                <i class="bi bi-clock icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -98,16 +98,16 @@ templ S3Buckets(data dash.S3BucketsData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-cube me-2"></i>Object Store Buckets
+                            <i class="bi bi-box me-2"></i>Object Store Buckets
                         </h6>
                         <div class="dropdown no-arrow">
                             <a class="dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown">
-                                <i class="fas fa-ellipsis-v fa-sm fa-fw text-gray-400"></i>
+                                <i class="bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400"></i>
                             </a>
                             <div class="dropdown-menu dropdown-menu-right shadow animated--fade-in">
                                 <div class="dropdown-header">Actions:</div>
                                 <a class="dropdown-item" href="#" onclick="exportBucketList()">
-                                    <i class="fas fa-download me-2"></i>Export List
+                                    <i class="bi bi-download me-2"></i>Export List
                                 </a>
                             </div>
                         </div>
@@ -151,6 +151,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                                         <th>Versioning</th>
                                         <th>Object Lock</th>
                                         <th>Lifecycle</th>
+                                        <th>Policy</th>
                                         <th>Actions</th>
                                     </tr>
                                 </thead>
@@ -160,19 +161,19 @@ templ S3Buckets(data dash.S3BucketsData) {
                                             <td>
                                                 <a href={dash.PUrl(ctx, fmt.Sprintf("/files?path=/buckets/%s", bucket.Name))}
                                                    class="text-decoration-none">
-                                                    <i class="fas fa-cube me-2"></i>
+                                                    <i class="bi bi-box me-2"></i>
                                                     {bucket.Name}
                                                 </a>
                                                 if bucket.ReadOnly {
                                                     <span class="badge bg-danger ms-2" title="Bucket is read-only (quota enforcement or manual lock); writes are rejected">
-                                                        <i class="fas fa-lock me-1"></i>Read-only
+                                                        <i class="bi bi-lock me-1"></i>Read-only
                                                     </span>
                                                 }
                                             </td>
                                             <td>
                                                 if bucket.Owner != "" {
                                                     <span class="badge bg-info">
-                                                        <i class="fas fa-user me-1"></i>{bucket.Owner}
+                                                        <i class="bi bi-person me-1"></i>{bucket.Owner}
                                                     </span>
                                                 } else {
                                                     <span class="text-muted small">No owner</span>
@@ -209,11 +210,11 @@ templ S3Buckets(data dash.S3BucketsData) {
                                             <td>
                                                 if bucket.VersioningStatus == "Enabled" {
                                                     <span class="badge bg-success">
-                                                        <i class="fas fa-check me-1"></i>Enabled
+                                                        <i class="bi bi-check me-1"></i>Enabled
                                                     </span>
                                                 } else if bucket.VersioningStatus == "Suspended" {
                                                     <span class="badge bg-warning">
-                                                        <i class="fas fa-pause me-1"></i>Suspended
+                                                        <i class="bi bi-pause me-1"></i>Suspended
                                                     </span>
                                                 } else {
                                                     <span class="text-muted">Not configured</span>
@@ -223,7 +224,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                                                 if bucket.ObjectLockEnabled {
                                                     <div>
                                                         <span class="badge bg-warning">
-                                                            <i class="fas fa-lock me-1"></i>Enabled
+                                                            <i class="bi bi-lock me-1"></i>Enabled
                                                         </span>
                                                         <div class="small text-muted">
                                                             {bucket.ObjectLockMode} • {fmt.Sprintf("%d days", bucket.ObjectLockDuration)}
@@ -255,31 +256,52 @@ templ S3Buckets(data dash.S3BucketsData) {
                                                     <span class="text-muted">Not configured</span>
                                                 }
                                             </td>
+                                            <td>
+                                                if bucket.PolicyStatementCount > 0 {
+                                                    <button type="button" class="badge bg-primary border-0 policy-btn"
+                                                            data-bucket-name={bucket.Name}
+                                                            title="View Bucket Policy">
+                                                        if bucket.PolicyStatementCount == 1 {
+                                                            1 statement
+                                                        } else {
+                                                            {fmt.Sprintf("%d statements", bucket.PolicyStatementCount)}
+                                                        }
+                                                    </button>
+                                                } else {
+                                                    <span class="text-muted">Not configured</span>
+                                                }
+                                            </td>
                                             <td>
                                                 <div class="btn-group btn-group-sm" role="group">
                                                     <a href={dash.PUrl(ctx, fmt.Sprintf("/files?path=/buckets/%s", bucket.Name))}
                                                        class="btn btn-outline-success btn-sm"
                                                        title="Browse Files">
-                                                        <i class="fas fa-folder-open"></i>
+                                                        <i class="bi bi-folder2-open"></i>
                                                     </a>
                                                     <button type="button"
                                                             class="btn btn-outline-primary btn-sm view-details-btn"
                                                             data-bucket-name={bucket.Name}
                                                             title="View Details">
-                                                        <i class="fas fa-eye"></i>
+                                                        <i class="bi bi-eye"></i>
                                                     </button>
                                                     <button type="button"
                                                             class="btn btn-outline-secondary btn-sm lifecycle-btn"
                                                             data-bucket-name={bucket.Name}
                                                             title="Lifecycle Rules">
-                                                        <i class="fas fa-recycle"></i>
+                                                        <i class="bi bi-recycle"></i>
                                                     </button>
-                                                    <button type="button" 
+                                                    <button type="button"
+                                                            class="btn btn-outline-info btn-sm policy-btn"
+                                                            data-bucket-name={bucket.Name}
+                                                            title="Bucket Policy">
+                                                        <i class="bi bi-shield"></i>
+                                                    </button>
+                                                    <button type="button"
                                                             class="btn btn-outline-info btn-sm owner-btn"
                                                             data-bucket-name={bucket.Name}
                                                             data-current-owner={bucket.Owner}
                                                             title="Manage Owner">
-                                                        <i class="fas fa-user-edit"></i>
+                                                        <i class="bi bi-person-gear"></i>
                                                     </button>
                                                     <button type="button" 
                                                             class="btn btn-outline-warning btn-sm quota-btn"
@@ -287,13 +309,13 @@ templ S3Buckets(data dash.S3BucketsData) {
                                                             data-current-quota={fmt.Sprintf("%d", getQuotaInMB(bucket.Quota))}
                                                             data-quota-enabled={fmt.Sprintf("%t", bucket.QuotaEnabled)}
                                                             title="Manage Quota">
-                                                        <i class="fas fa-tachometer-alt"></i>
+                                                        <i class="bi bi-speedometer2"></i>
                                                     </button>
                                                     <button type="button" 
                                                             class="btn btn-outline-danger btn-sm delete-bucket-btn"
                                                             data-bucket-name={bucket.Name}
                                                             title="Delete Bucket">
-                                                        <i class="fas fa-trash"></i>
+                                                        <i class="bi bi-trash"></i>
                                                     </button>
                                                 </div>
                                             </td>
@@ -301,15 +323,15 @@ templ S3Buckets(data dash.S3BucketsData) {
                                     }
                                     if len(data.Buckets) == 0 {
                                         <tr>
-                                            <td colspan="10" class="text-center text-muted py-4">
-                                                <i class="fas fa-cube fa-3x mb-3 text-muted"></i>
+                                            <td colspan="11" class="text-center text-muted py-4">
+                                                <i class="bi bi-box icon-3x mb-3 text-muted"></i>
                                                 <div>
                                                     					<h5>No Object Store buckets found</h5>
                                                     <p>Create your first bucket to get started with S3 storage.</p>
                                                     <button type="button" class="btn btn-primary" 
                                                             data-bs-toggle="modal" 
                                                             data-bs-target="#createBucketModal">
-                                                        <i class="fas fa-plus me-1"></i>Create Bucket
+                                                        <i class="bi bi-plus me-1"></i>Create Bucket
                                                     </button>
                                                 </div>
                                             </td>
@@ -331,13 +353,13 @@ templ S3Buckets(data dash.S3BucketsData) {
                                         if data.CurrentPage > 1 {
                                             <li class="page-item">
                                                 <a class="page-link pagination-link" href="#" data-page={fmt.Sprintf("%d", data.CurrentPage-1)}>
-                                                    <i class="fas fa-chevron-left"></i>
+                                                    <i class="bi bi-chevron-left"></i>
                                                 </a>
                                             </li>
                                         } else {
                                             <li class="page-item disabled">
                                                 <span class="page-link">
-                                                    <i class="fas fa-chevron-left"></i>
+                                                    <i class="bi bi-chevron-left"></i>
                                                 </span>
                                             </li>
                                         }
@@ -359,13 +381,13 @@ templ S3Buckets(data dash.S3BucketsData) {
                                         if data.CurrentPage < data.TotalPages {
                                             <li class="page-item">
                                                 <a class="page-link pagination-link" href="#" data-page={fmt.Sprintf("%d", data.CurrentPage+1)}>
-                                                    <i class="fas fa-chevron-right"></i>
+                                                    <i class="bi bi-chevron-right"></i>
                                                 </a>
                                             </li>
                                         } else {
                                             <li class="page-item disabled">
                                                 <span class="page-link">
-                                                    <i class="fas fa-chevron-right"></i>
+                                                    <i class="bi bi-chevron-right"></i>
                                                 </span>
                                             </li>
                                         }
@@ -382,7 +404,7 @@ templ S3Buckets(data dash.S3BucketsData) {
         <div class="row">
             <div class="col-12">
                 <small class="text-muted">
-                    <i class="fas fa-clock me-1"></i>
+                    <i class="bi bi-clock me-1"></i>
                     Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
                 </small>
             </div>
@@ -395,7 +417,7 @@ templ S3Buckets(data dash.S3BucketsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="createBucketModalLabel">
-                        <i class="fas fa-plus me-2"></i>Create New S3 Bucket
+                        <i class="bi bi-plus me-2"></i>Create New S3 Bucket
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -515,7 +537,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                         <button type="submit" class="btn btn-primary">
-                            <i class="fas fa-plus me-1"></i>Create Bucket
+                            <i class="bi bi-plus me-1"></i>Create Bucket
                         </button>
                     </div>
                 </form>
@@ -529,21 +551,21 @@ templ S3Buckets(data dash.S3BucketsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="deleteBucketModalLabel">
-                        <i class="fas fa-exclamation-triangle me-2 text-warning"></i>Delete Bucket
+                        <i class="bi bi-exclamation-triangle me-2 text-warning"></i>Delete Bucket
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
                 <div class="modal-body">
                     <p>Are you sure you want to delete the bucket <strong id="deleteBucketName"></strong>?</p>
                     <div class="alert alert-warning">
-                        <i class="fas fa-exclamation-triangle me-2"></i>
+                        <i class="bi bi-exclamation-triangle me-2"></i>
                         <strong>Warning:</strong> This action cannot be undone. All objects in the bucket will be permanently deleted.
                     </div>
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                     <button type="button" class="btn btn-danger" onclick="deleteBucket()">
-                        <i class="fas fa-trash me-1"></i>Delete Bucket
+                        <i class="bi bi-trash me-1"></i>Delete Bucket
                     </button>
                 </div>
             </div>
@@ -556,7 +578,7 @@ templ S3Buckets(data dash.S3BucketsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="manageQuotaModalLabel">
-                        <i class="fas fa-tachometer-alt me-2"></i>Manage Bucket Quota
+                        <i class="bi bi-speedometer2 me-2"></i>Manage Bucket Quota
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -600,7 +622,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                         <button type="submit" class="btn btn-warning">
-                            <i class="fas fa-save me-1"></i>Update Quota
+                            <i class="bi bi-floppy me-1"></i>Update Quota
                         </button>
                     </div>
                 </form>
@@ -614,7 +636,7 @@ templ S3Buckets(data dash.S3BucketsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="bucketDetailsModalLabel">
-                        <i class="fas fa-cube me-2"></i>Bucket Details
+                        <i class="bi bi-box me-2"></i>Bucket Details
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -637,11 +659,11 @@ templ S3Buckets(data dash.S3BucketsData) {
 
     <!-- Bucket Lifecycle Modal -->
     <div class="modal fade" id="bucketLifecycleModal" tabindex="-1" aria-labelledby="bucketLifecycleModalLabel" aria-hidden="true">
-        <div class="modal-dialog modal-lg">
+        <div class="modal-dialog modal-xl">
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="bucketLifecycleModalLabel">
-                        <i class="fas fa-recycle me-2"></i>Lifecycle
+                        <i class="bi bi-recycle me-2"></i>Lifecycle
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -649,7 +671,80 @@ templ S3Buckets(data dash.S3BucketsData) {
                     <div id="bucketLifecycleContent"></div>
                 </div>
                 <div class="modal-footer">
-                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                    <button type="button" class="btn btn-outline-danger me-auto" id="lifecycleDeleteAllBtn">
+                        <i class="bi bi-trash me-1"></i>Delete all rules
+                    </button>
+                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                    <button type="button" class="btn btn-primary" id="lifecycleSaveAllBtn">
+                        <i class="bi bi-floppy me-1"></i>Save
+                    </button>
+                </div>
+            </div>
+        </div>
+    </div>
+
+    @PolicyDatalists()
+
+    <!-- Bucket Policy Modal -->
+    <div class="modal fade" id="bucketPolicyModal" tabindex="-1" aria-labelledby="bucketPolicyModalLabel" aria-hidden="true">
+        <div class="modal-dialog modal-xl">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <h5 class="modal-title" id="bucketPolicyModalLabel">
+                        <i class="bi bi-file-earmark-lock me-2"></i>Bucket Policy
+                    </h5>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                </div>
+                <div class="modal-body">
+                    <div id="bucketPolicyLoading" class="text-center py-4">
+                        <div class="spinner-border text-primary" role="status">
+                            <span class="visually-hidden">Loading...</span>
+                        </div>
+                        <div class="mt-2">Loading bucket policy...</div>
+                    </div>
+                    <div id="bucketPolicyError" class="alert alert-danger" style="display: none;"></div>
+                    <div id="bucketPolicyEditorWrapper" style="display: none;">
+                        <p class="text-muted small">
+                            Every statement must specify a Principal, and every Resource must refer to this bucket.
+                            Leave the document empty and click Delete to remove the policy.
+                        </p>
+                        <ul class="nav nav-tabs" role="tablist">
+                            <li class="nav-item" role="presentation">
+                                <button class="nav-link active" id="bucketPolicyEditorTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#bucketPolicyEditorTab" role="tab" aria-controls="bucketPolicyEditorTab" aria-selected="true">Editor</button>
+                            </li>
+                            <li class="nav-item" role="presentation">
+                                <button class="nav-link" id="bucketPolicyJsonTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#bucketPolicyJsonTab" role="tab" aria-controls="bucketPolicyJsonTab" aria-selected="false">JSON</button>
+                            </li>
+                        </ul>
+                        <div class="tab-content border border-top-0 rounded-bottom p-3 mb-3">
+                            <div class="tab-pane fade show active" id="bucketPolicyEditorTab" role="tabpanel" aria-labelledby="bucketPolicyEditorTabBtn">
+                                <div id="bucketPolicyEditorBody"></div>
+                                <button type="button" class="btn btn-sm btn-outline-secondary" id="bucketPolicyAddStatementBtn">
+                                    <i class="bi bi-plus me-1"></i>Add statement
+                                </button>
+                            </div>
+                            <div class="tab-pane fade" id="bucketPolicyJsonTab" role="tabpanel" aria-labelledby="bucketPolicyJsonTabBtn">
+                                <textarea class="form-control" id="bucketPolicyDocument" rows="15"
+                                          style="font-family: monospace;" spellcheck="false"
+                                          placeholder='{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::bucket-name/*"}]}'></textarea>
+                                <div class="form-text">Enter the bucket policy document as JSON</div>
+                            </div>
+                        </div>
+                        <div class="mb-3">
+                            <button type="button" class="btn btn-outline-info btn-sm" id="bucketPolicyInsertSampleBtn">
+                                <i class="bi bi-file-earmark-text me-1"></i>Use Sample Policy
+                            </button>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-outline-danger me-auto" id="bucketPolicyDeleteBtn">
+                        <i class="bi bi-trash me-1"></i>Delete
+                    </button>
+                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                    <button type="button" class="btn btn-primary" id="bucketPolicySaveBtn">
+                        <i class="bi bi-floppy me-1"></i>Save
+                    </button>
                 </div>
             </div>
         </div>
@@ -661,7 +756,7 @@ templ S3Buckets(data dash.S3BucketsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title" id="manageOwnerModalLabel">
-                        <i class="fas fa-user-edit me-2"></i>Manage Bucket Owner
+                        <i class="bi bi-person-gear me-2"></i>Manage Bucket Owner
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
                 </div>
@@ -693,7 +788,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                     <div class="modal-footer">
                         <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                         <button type="submit" class="btn btn-info">
-                            <i class="fas fa-save me-1"></i>Update Owner
+                            <i class="bi bi-floppy me-1"></i>Update Owner
                         </button>
                     </div>
                 </form>
@@ -710,8 +805,95 @@ templ S3Buckets(data dash.S3BucketsData) {
     let detailsModalInstance = null;
     let lifecycleModalInstance = null;
     let lifecycleRequestSeq = 0;
+    let policyModalInstance = null;
+    let policyRequestSeq = 0;
+    let policyEditorBucket = null;
+    // True only once the bucket-policy GET for the currently open bucket has
+    // actually completed successfully. The Save button lives outside the
+    // (initially hidden) editor wrapper, so it stays clickable while a load
+    // is in flight or has failed; without this guard, Save could commit
+    // whatever the editor happened to hold - a stale previous bucket's
+    // statements, or a freshly-initialized empty state - onto
+    // policyEditorBucket before its own policy ever loaded.
+    let bucketPolicyLoaded = false;
+    // True while a Save (PUT) or Delete (DELETE) request for the bucket
+    // policy is in flight, so a double-click - or Save and Delete fired in
+    // quick succession - can't send two overlapping mutations for the same
+    // bucket. Cleared on failure so the user can retry; left set on success,
+    // since the modal hides and the page reloads shortly after anyway.
+    let bucketPolicyMutationInFlight = false;
+
+    function setBucketPolicyMutationInFlight(inFlight) {
+        bucketPolicyMutationInFlight = inFlight;
+        document.getElementById('bucketPolicySaveBtn').disabled = inFlight;
+        document.getElementById('bucketPolicyDeleteBtn').disabled = inFlight;
+    }
+
     let cachedUsers = null;
 
+    // Working copy of the lifecycle rules currently shown in the modal.
+    // Edits (add/edit/delete rule) only mutate this local state; nothing is
+    // sent to the server until "Save" or "Delete all rules" is clicked.
+    let lifecycleEditor = { bucket: null, rules: [], editingIndex: null, editingRule: null, rawXml: '', hasTransition: false };
+
+    function escapeHtml(v) {
+        return String(v ?? '')
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
+            .replace(/"/g, '&quot;')
+            .replace(/'/g, '&#39;');
+    }
+
+    // Shadows admin.js's formatBytes for this page, so it keeps that
+    // signature and unit list; the extra guard is for a size the API left
+    // out, which the shared one renders as "NaN undefined".
+    function formatBytes(bytes, decimals = 2) {
+        if (!bytes) return '0 Bytes';
+        const k = 1024;
+        const dm = decimals < 0 ? 0 : decimals;
+        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB', 'PB'];
+        const i = Math.floor(Math.log(bytes) / Math.log(k));
+        return parseFloat((bytes / Math.pow(k, i)).toFixed(dm)) + ' ' + sizes[i];
+    }
+
+    function formatDays(n) {
+        return n + (n === 1 ? ' day' : ' days');
+    }
+
+    // csrfHeaders reads the token the layout stamps into every page
+    // (<meta name="csrf-token">) so mutating lifecycle requests pass it the
+    // same way the newer admin pages (e.g. s3tables) do.
+    function csrfHeaders() {
+        const meta = document.querySelector('meta[name="csrf-token"]');
+        const token = meta ? (meta.getAttribute('content') || '') : '';
+        const headers = { 'Content-Type': 'application/json' };
+        if (token) {
+            headers['X-CSRF-Token'] = token;
+        }
+        return headers;
+    }
+
+    // parseLifecycleResponse reads the body as text before parsing, so a
+    // non-JSON response (a proxy's HTML error page, an empty body, plain
+    // text from some middleware) surfaces the HTTP status instead of
+    // throwing a raw JSON syntax error out of response.json().
+    function parseLifecycleResponse(response) {
+        return response.text().then(text => {
+            let data = {};
+            if (text) {
+                try {
+                    data = JSON.parse(text);
+                } catch (e) {
+                    data = { error: response.statusText || ('HTTP ' + response.status) };
+                }
+            } else if (!response.ok) {
+                data = { error: response.statusText || ('HTTP ' + response.status) };
+            }
+            return { ok: response.ok, data: data };
+        });
+    }
+
     document.addEventListener('DOMContentLoaded', function() {
         // Add click handlers to pagination links
         document.querySelectorAll('.pagination-link').forEach(link => {
@@ -728,6 +910,7 @@ templ S3Buckets(data dash.S3BucketsData) {
         ownerModalInstance = new bootstrap.Modal(document.getElementById('manageOwnerModal'));
         detailsModalInstance = new bootstrap.Modal(document.getElementById('bucketDetailsModal'));
         lifecycleModalInstance = new bootstrap.Modal(document.getElementById('bucketLifecycleModal'));
+        policyModalInstance = new bootstrap.Modal(document.getElementById('bucketPolicyModal'));
 
         const quotaCheckbox = document.getElementById('enableQuota');
         const quotaSettings = document.getElementById('quotaSettings');
@@ -1031,7 +1214,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                 
                 // Update modal title
                 document.getElementById('bucketDetailsModalLabel').innerHTML = 
-                    '<i class="fas fa-cube me-2"></i>Bucket Details - ' + bucketName;
+                    '<i class="bi bi-box me-2"></i>Bucket Details - ' + bucketName;
                 
                 // Show loading spinner
                 document.getElementById('bucketDetailsContent').innerHTML = 
@@ -1051,7 +1234,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                         if (data.error) {
                             document.getElementById('bucketDetailsContent').innerHTML = 
                                 '<div class="alert alert-danger">' +
-                                '<i class="fas fa-exclamation-triangle me-2"></i>' +
+                                '<i class="bi bi-exclamation-triangle me-2"></i>' +
                                 'Error loading bucket details: ' + data.error +
                                 '<\\/div>';
                         } else {
@@ -1062,7 +1245,7 @@ templ S3Buckets(data dash.S3BucketsData) {
                         console.error('Error fetching bucket details:', error);
                         document.getElementById('bucketDetailsContent').innerHTML = 
                             '<div class="alert alert-danger">' +
-                            '<i class="fas fa-exclamation-triangle me-2"></i>' +
+                            '<i class="bi bi-exclamation-triangle me-2"></i>' +
                             'Error loading bucket details: ' + error.message +
                             '<\\/div>';
                     });
@@ -1074,8 +1257,12 @@ templ S3Buckets(data dash.S3BucketsData) {
             button.addEventListener('click', function() {
                 const bucketName = this.dataset.bucketName;
 
+                // Reset the working copy until the GET below repopulates it,
+                // so Save/Delete-all can't act on the previous bucket's rules.
+                lifecycleEditor = { bucket: null, rules: [], editingIndex: null, editingRule: null, rawXml: '', hasTransition: false };
+
                 document.getElementById('bucketLifecycleModalLabel').innerHTML =
-                    '<i class="fas fa-recycle me-2"></i>Lifecycle - ' + bucketName;
+                    '<i class="bi bi-recycle me-2"></i>Lifecycle - ' + bucketName;
 
                 document.getElementById('bucketLifecycleContent').innerHTML =
                     '<div class="text-center py-4">' +
@@ -1090,14 +1277,14 @@ templ S3Buckets(data dash.S3BucketsData) {
                 // Drop responses that arrive after another bucket was opened
                 const requestSeq = ++lifecycleRequestSeq;
                 fetch(basePath('/api/s3/buckets/' + bucketName + '/lifecycle'))
-                    .then(response => response.json())
-                    .then(data => {
+                    .then(parseLifecycleResponse)
+                    .then(({ ok, data }) => {
                         if (requestSeq !== lifecycleRequestSeq) return;
-                        if (data.error) {
+                        if (!ok || data.error) {
                             document.getElementById('bucketLifecycleContent').innerHTML =
                                 '<div class="alert alert-danger">' +
-                                '<i class="fas fa-exclamation-triangle me-2"></i>' +
-                                'Error loading lifecycle rules: ' + data.error +
+                                '<i class="bi bi-exclamation-triangle me-2"></i>' +
+                                'Error loading lifecycle rules: ' + (data.error || 'unknown error') +
                                 '<\/div>';
                         } else {
                             displayBucketLifecycle(data);
@@ -1108,12 +1295,273 @@ templ S3Buckets(data dash.S3BucketsData) {
                         console.error('Error fetching bucket lifecycle:', error);
                         document.getElementById('bucketLifecycleContent').innerHTML =
                             '<div class="alert alert-danger">' +
-                            '<i class="fas fa-exclamation-triangle me-2"></i>' +
+                            '<i class="bi bi-exclamation-triangle me-2"></i>' +
                             'Error loading lifecycle rules: ' + error.message +
                             '<\/div>';
                     });
             });
         });
+
+        // Save the whole working rule set back to the bucket.
+        document.getElementById('lifecycleSaveAllBtn').addEventListener('click', function() {
+            if (!lifecycleEditor.bucket) return;
+            // Fold in any rule the user is still editing so Save doesn't
+            // silently discard it; abort if that form isn't valid yet.
+            if (!commitOpenLifecycleRuleForm()) return;
+            // An empty list clears the configuration, same as Delete all rules,
+            // so it gets the same prompt.
+            if (lifecycleEditor.rules.length === 0 &&
+                !confirm('No rules left: saving removes the lifecycle configuration for ' + lifecycleEditor.bucket + '. This cannot be undone.')) {
+                return;
+            }
+
+            fetch(basePath('/api/s3/buckets/' + lifecycleEditor.bucket + '/lifecycle'), {
+                method: 'PUT',
+                headers: csrfHeaders(),
+                body: JSON.stringify({ rules: lifecycleEditor.rules })
+            })
+                .then(parseLifecycleResponse)
+                .then(({ ok, data }) => {
+                    if (!ok || data.error) {
+                        alert('Error saving lifecycle rules: ' + (data.error || 'unknown error'));
+                        return;
+                    }
+                    if (lifecycleModalInstance) {
+                        lifecycleModalInstance.hide();
+                    }
+                    setTimeout(() => location.reload(), 500);
+                })
+                .catch(error => {
+                    console.error('Error:', error);
+                    alert('Error saving lifecycle rules: ' + error.message);
+                });
+        });
+
+        // Clear the lifecycle configuration entirely.
+        document.getElementById('lifecycleDeleteAllBtn').addEventListener('click', function() {
+            if (!lifecycleEditor.bucket) return;
+            if (!confirm('Delete all lifecycle rules for ' + lifecycleEditor.bucket + '? This cannot be undone.')) return;
+
+            fetch(basePath('/api/s3/buckets/' + lifecycleEditor.bucket + '/lifecycle'), {
+                method: 'DELETE',
+                headers: csrfHeaders()
+            })
+                .then(parseLifecycleResponse)
+                .then(({ ok, data }) => {
+                    if (!ok || data.error) {
+                        alert('Error deleting lifecycle rules: ' + (data.error || 'unknown error'));
+                        return;
+                    }
+                    if (lifecycleModalInstance) {
+                        lifecycleModalInstance.hide();
+                    }
+                    setTimeout(() => location.reload(), 500);
+                })
+                .catch(error => {
+                    console.error('Error:', error);
+                    alert('Error deleting lifecycle rules: ' + error.message);
+                });
+        });
+
+        // Policy buttons: column badge and action button. The visual editor
+        // (weed/admin/static/js/policy_editor.js) is set up once per page
+        // load; registerPolicyEditor is re-called on every open so the
+        // resource-ARN autocomplete and default Principal stay pinned to
+        // whichever bucket is currently open.
+        let bucketPolicyEditorSetUp = false;
+        document.getElementById('bucketPolicyInsertSampleBtn').addEventListener('click', function() {
+            if (!policyEditorBucket) return;
+            insertSamplePolicy('bucket', {
+                Version: '2012-10-17',
+                Statement: [{
+                    Effect: 'Allow',
+                    Principal: '*',
+                    Action: ['s3:GetObject'],
+                    Resource: ['arn:aws:s3:::' + policyEditorBucket + '/*']
+                }]
+            });
+        });
+
+        document.querySelectorAll('.policy-btn').forEach(button => {
+            button.addEventListener('click', function() {
+                const bucketName = this.dataset.bucketName;
+                policyEditorBucket = bucketName;
+                bucketPolicyLoaded = false;
+                // Deliberately not resetting bucketPolicyMutationInFlight
+                // here: if a Save/Delete for a previously open bucket is
+                // still in flight, Save/Delete for this bucket must stay
+                // blocked until that request settles (its own completion
+                // handler releases the flag once done, whether or not it's
+                // still the active bucket by then) - otherwise this bucket's
+                // mutation could race the abandoned one.
+                registerPolicyEditor('bucket', { requirePrincipal: true, bucket: bucketName });
+                if (!bucketPolicyEditorSetUp) {
+                    setupPolicyEditor('bucket');
+                    bucketPolicyEditorSetUp = true;
+                }
+
+                document.getElementById('bucketPolicyModalLabel').innerHTML =
+                    '<i class="bi bi-file-earmark-lock me-2"></i>Bucket Policy - ' + escapeHtml(bucketName);
+                document.getElementById('bucketPolicyLoading').style.display = '';
+                document.getElementById('bucketPolicyError').style.display = 'none';
+                document.getElementById('bucketPolicyEditorWrapper').style.display = 'none';
+
+                policyModalInstance.show();
+
+                // Drop responses that arrive after another bucket was opened
+                const requestSeq = ++policyRequestSeq;
+                fetch(basePath('/api/s3/buckets/' + encodeURIComponent(bucketName) + '/policy'))
+                    .then(parseLifecycleResponse)
+                    .then(({ ok, data }) => {
+                        if (requestSeq !== policyRequestSeq) return;
+                        document.getElementById('bucketPolicyLoading').style.display = 'none';
+                        if (!ok || data.error) {
+                            document.getElementById('bucketPolicyError').textContent =
+                                'Error loading bucket policy: ' + (data.error || 'unknown error');
+                            document.getElementById('bucketPolicyError').style.display = '';
+                            return;
+                        }
+                        document.getElementById('bucketPolicyEditorWrapper').style.display = '';
+                        // policy_text carries stored bytes the server-side
+                        // decoder rejects; the JSON tab shows them so they
+                        // can be fixed or deleted.
+                        document.getElementById('bucketPolicyDocument').value =
+                            data.policy ? JSON.stringify(data.policy, null, 2) : (data.policy_text || '');
+                        bucketPolicyLoaded = true;
+                        loadPolicyTextareaIntoEditor('bucket');
+                    })
+                    .catch(error => {
+                        if (requestSeq !== policyRequestSeq) return;
+                        console.error('Error fetching bucket policy:', error);
+                        document.getElementById('bucketPolicyLoading').style.display = 'none';
+                        document.getElementById('bucketPolicyError').textContent =
+                            'Error loading bucket policy: ' + error.message;
+                        document.getElementById('bucketPolicyError').style.display = '';
+                    });
+            });
+        });
+
+        // Save the policy document currently shown (whichever tab is active).
+        document.getElementById('bucketPolicySaveBtn').addEventListener('click', function() {
+            if (!policyEditorBucket) return;
+            if (bucketPolicyMutationInFlight) return;
+            if (!bucketPolicyLoaded) {
+                alert('The current policy has not finished loading. Close and reopen this dialog before saving.');
+                return;
+            }
+
+            // Commit first: if the Editor tab is active, the textarea still
+            // holds whatever was there at load time until this runs, so a
+            // policy entered purely through the structured form (no tab
+            // switch) would otherwise read back as empty here.
+            if (!commitPolicyActiveTab('bucket')) return;
+
+            const raw = document.getElementById('bucketPolicyDocument').value.trim();
+            if (!raw || !policyTextHasStatements(raw)) {
+                alert('Add at least one statement, or use Delete to remove the bucket policy.');
+                return;
+            }
+
+            let policy;
+            try {
+                policy = JSON.parse(document.getElementById('bucketPolicyDocument').value);
+            } catch (e) {
+                alert('Invalid JSON: ' + e.message);
+                return;
+            }
+            const validationError = validatePolicyEditorDoc('bucket', policy);
+            if (validationError) {
+                alert(validationError);
+                return;
+            }
+            // The admin API decodes only Version and Statement, so warn
+            // before other top-level fields are silently dropped - the IAM
+            // policies page already does. (The S3 Tables dialogs don't:
+            // their backend stores the document verbatim.)
+            if (!confirmPolicyFieldDiscard('bucket')) return;
+
+            // Captured now: if the dialog moves on to a different bucket
+            // before this PUT resolves, the completion below must not hide
+            // or reload over whatever that other bucket is now showing.
+            const targetBucket = policyEditorBucket;
+            setBucketPolicyMutationInFlight(true);
+            fetch(basePath('/api/s3/buckets/' + encodeURIComponent(targetBucket) + '/policy'), {
+                method: 'PUT',
+                headers: csrfHeaders(),
+                body: JSON.stringify({ policy: policy })
+            })
+                .then(parseLifecycleResponse)
+                .then(({ ok, data }) => {
+                    setBucketPolicyMutationInFlight(false);
+                    const stillCurrent = targetBucket === policyEditorBucket;
+                    if (!ok || data.error) {
+                        if (stillCurrent) {
+                            alert('Error saving bucket policy: ' + (data.error || 'unknown error'));
+                        } else {
+                            console.error('Error saving policy for ' + targetBucket + ' (no longer the open bucket): ' + (data.error || 'unknown error'));
+                        }
+                        return;
+                    }
+                    if (!stillCurrent) return;
+                    if (policyModalInstance) {
+                        policyModalInstance.hide();
+                    }
+                    setTimeout(() => location.reload(), 500);
+                })
+                .catch(error => {
+                    setBucketPolicyMutationInFlight(false);
+                    console.error('Error:', error);
+                    if (targetBucket === policyEditorBucket) {
+                        alert('Error saving bucket policy: ' + error.message);
+                    }
+                });
+        });
+
+        // Clear the bucket policy entirely.
+        document.getElementById('bucketPolicyDeleteBtn').addEventListener('click', function() {
+            if (!policyEditorBucket) return;
+            if (bucketPolicyMutationInFlight) return;
+            if (!bucketPolicyLoaded) {
+                alert('The current policy has not finished loading. Close and reopen this dialog before deleting.');
+                return;
+            }
+            if (!confirm('Delete the bucket policy for ' + policyEditorBucket + '? This cannot be undone.')) return;
+
+            // Captured now: if the dialog moves on to a different bucket
+            // before this DELETE resolves, the completion below must not
+            // hide or reload over whatever that other bucket is now showing.
+            const targetBucket = policyEditorBucket;
+            setBucketPolicyMutationInFlight(true);
+            fetch(basePath('/api/s3/buckets/' + encodeURIComponent(targetBucket) + '/policy'), {
+                method: 'DELETE',
+                headers: csrfHeaders()
+            })
+                .then(parseLifecycleResponse)
+                .then(({ ok, data }) => {
+                    setBucketPolicyMutationInFlight(false);
+                    const stillCurrent = targetBucket === policyEditorBucket;
+                    if (!ok || data.error) {
+                        if (stillCurrent) {
+                            alert('Error deleting bucket policy: ' + (data.error || 'unknown error'));
+                        } else {
+                            console.error('Error deleting policy for ' + targetBucket + ' (no longer the open bucket): ' + (data.error || 'unknown error'));
+                        }
+                        return;
+                    }
+                    if (!stillCurrent) return;
+                    if (policyModalInstance) {
+                        policyModalInstance.hide();
+                    }
+                    setTimeout(() => location.reload(), 500);
+                })
+                .catch(error => {
+                    setBucketPolicyMutationInFlight(false);
+                    console.error('Error:', error);
+                    if (targetBucket === policyEditorBucket) {
+                        alert('Error deleting bucket policy: ' + error.message);
+                    }
+                });
+        });
     });
 
     function deleteBucket() {
@@ -1145,23 +1593,6 @@ templ S3Buckets(data dash.S3BucketsData) {
 function displayBucketDetails(data) {
     const bucket = data.bucket;
 
-    function escapeHtml(v) {
-        return String(v ?? '')
-            .replace(/&/g, '&amp;')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;')
-            .replace(/"/g, '&quot;')
-            .replace(/'/g, '&#39;');
-    }
-
-    function formatBytes(bytes) {
-        if (bytes === 0) return '0 Bytes';
-        const k = 1024;
-        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
-        const i = Math.floor(Math.log(bytes) / Math.log(k));
-        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
-    }
-
     function formatDate(dateString) {
         const date = new Date(dateString);
         return date.toLocaleString();
@@ -1169,7 +1600,7 @@ function displayBucketDetails(data) {
 
     let ownerHtml = '<span class="text-muted">No owner (admin-only)</span>';
     if (bucket.owner) {
-        ownerHtml = '<span class="badge bg-info"><i class="fas fa-user me-1"></i>' + escapeHtml(bucket.owner) + '</span>';
+        ownerHtml = '<span class="badge bg-info"><i class="bi bi-person me-1"></i>' + escapeHtml(bucket.owner) + '</span>';
     }
 
     let usageHtml = '';
@@ -1185,14 +1616,14 @@ function displayBucketDetails(data) {
 
     let versioningHtml = '<span class="text-muted">Not configured</span>';
     if (bucket.versioning_status === 'Enabled') {
-        versioningHtml = '<span class="badge bg-success"><i class="fas fa-check me-1"></i>Enabled</span>';
+        versioningHtml = '<span class="badge bg-success"><i class="bi bi-check me-1"></i>Enabled</span>';
     } else if (bucket.versioning_status === 'Suspended') {
-        versioningHtml = '<span class="badge bg-warning"><i class="fas fa-pause me-1"></i>Suspended</span>';
+        versioningHtml = '<span class="badge bg-warning"><i class="bi bi-pause me-1"></i>Suspended</span>';
     }
 
     let statusHtml = '<span class="badge bg-success">Writable</span>';
     if (bucket.read_only) {
-        statusHtml = '<span class="badge bg-danger"><i class="fas fa-lock me-1"></i>Read-only</span>';
+        statusHtml = '<span class="badge bg-danger"><i class="bi bi-lock me-1"></i>Read-only</span>';
     }
 
     let objectLockHtml = '<span class="text-muted">Not configured</span>';
@@ -1201,13 +1632,19 @@ function displayBucketDetails(data) {
         if (bucket.object_lock_mode && bucket.object_lock_duration > 0) {
             details = '<br><small class="text-muted">' + escapeHtml(bucket.object_lock_mode) + ' • ' + bucket.object_lock_duration + ' days<\/small>';
         }
-        objectLockHtml = '<span class="badge bg-warning"><i class="fas fa-lock me-1"></i>Enabled</span>' + details;
+        objectLockHtml = '<span class="badge bg-warning"><i class="bi bi-lock me-1"></i>Enabled</span>' + details;
+    }
+
+    let policyHtml = '<span class="text-muted">Not configured</span>';
+    if (bucket.policy_statement_count > 0) {
+        const label = bucket.policy_statement_count === 1 ? '1 statement' : bucket.policy_statement_count + ' statements';
+        policyHtml = '<span class="badge bg-primary">' + label + '<\/span>';
     }
 
     const rows = [
         '<div class="row">',
         '<div class="col-md-6">',
-        '<h6><i class="fas fa-info-circle me-2"></i>Bucket Information</h6>',
+        '<h6><i class="bi bi-info-circle me-2"></i>Bucket Information</h6>',
         '<table class="table table-sm">',
         '<tr><td><strong>Name:</strong></td><td>' + escapeHtml(bucket.name) + '<\/td><\/tr>',
         '<tr><td><strong>Owner:</strong></td><td>' + ownerHtml + '<\/td><\/tr>',
@@ -1218,12 +1655,13 @@ function displayBucketDetails(data) {
         '<\/table>',
         '<\/div>',
         '<div class="col-md-6">',
-        '<h6><i class="fas fa-cogs me-2"></i>Configuration</h6>',
+        '<h6><i class="bi bi-gear-wide-connected me-2"></i>Configuration</h6>',
         '<table class="table table-sm">',
         '<tr><td><strong>Status:</strong></td><td>' + statusHtml + '<\/td><\/tr>',
         '<tr><td><strong>Quota:</strong></td><td>' + quotaHtml + '<\/td><\/tr>',
         '<tr><td><strong>Versioning:</strong></td><td>' + versioningHtml + '<\/td><\/tr>',
         '<tr><td><strong>Object Lock:</strong></td><td>' + objectLockHtml + '<\/td><\/tr>',
+        '<tr><td><strong>Policy:</strong></td><td>' + policyHtml + '<\/td><\/tr>',
         '<\/table>',
         '<\/div>',
         '<\/div>'
@@ -1232,112 +1670,518 @@ function displayBucketDetails(data) {
     document.getElementById('bucketDetailsContent').innerHTML = rows.join('');
 }
 
+// displayBucketLifecycle loads the GET response into the local working copy
+// and renders the editor. Nothing is sent back to the server until Save or
+// Delete all rules is clicked.
 function displayBucketLifecycle(data) {
-    function escapeHtml(v) {
-        return String(v ?? '')
-            .replace(/&/g, '&amp;')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;')
-            .replace(/"/g, '&quot;')
-            .replace(/'/g, '&#39;');
+    lifecycleEditor.bucket = data.bucket || lifecycleEditor.bucket;
+    lifecycleEditor.rules = (data.rules || []).map(cloneLifecycleRule);
+    lifecycleEditor.editingIndex = null;
+    lifecycleEditor.editingRule = null;
+    lifecycleEditor.rawXml = data.xml || '';
+    // SeaweedFS doesn't support Transition rules (PutBucketLifecycleConfiguration
+    // rejects them for Enabled rules), and the canonical rule shape the admin
+    // edits has no field for one, so a Transition set by another client would
+    // silently disappear on the next Save. Warn instead.
+    // Matches <Transition> and <NoncurrentVersionTransition> however they are
+    // spelled: with attributes, self-closed, or namespace-prefixed.
+    lifecycleEditor.hasTransition = /<(\w+:)?(NoncurrentVersion)?Transition[\s>\/]/.test(data.xml || '');
+    renderLifecycleEditor();
+}
+
+// normalizeLifecycleStatus maps a stored status onto the two the editor can
+// show. The S3 API stores <Status> unvalidated, and the engine runs a rule
+// only on an exact "Enabled", so everything else is Disabled - collapsing it
+// here keeps an odd spelling from leaving both radios unchecked, which would
+// throw out of readLifecycleRuleFromForm and make the modal look dead.
+function normalizeLifecycleStatus(status) {
+    return status === 'Enabled' ? 'Enabled' : 'Disabled';
+}
+
+function cloneLifecycleRule(r) {
+    return {
+        id: r.id || '',
+        status: normalizeLifecycleStatus(r.status),
+        prefix: r.prefix || '',
+        tags: Object.assign({}, r.tags || {}),
+        size_greater_than: r.size_greater_than || null,
+        size_less_than: r.size_less_than || null,
+        expiration_days: r.expiration_days || null,
+        expiration_date: r.expiration_date || '',
+        expired_object_delete_marker: !!r.expired_object_delete_marker,
+        noncurrent_version_expiration_days: r.noncurrent_version_expiration_days || null,
+        newer_noncurrent_versions: r.newer_noncurrent_versions || null,
+        abort_multipart_days: r.abort_multipart_days || null,
+    };
+}
+
+function blankLifecycleRule() {
+    return {
+        id: '', status: 'Enabled', prefix: '', tags: {},
+        size_greater_than: null, size_less_than: null,
+        expiration_days: null, expiration_date: '',
+        expired_object_delete_marker: false,
+        noncurrent_version_expiration_days: null, newer_noncurrent_versions: null,
+        abort_multipart_days: null,
+    };
+}
+
+function describeLifecycleScope(rule) {
+    const parts = [];
+    if (rule.prefix) {
+        parts.push('<code>' + escapeHtml(rule.prefix) + '<\/code>');
+    }
+    Object.entries(rule.tags || {}).forEach(([k, v]) => {
+        parts.push('<span class="badge bg-light text-dark border">' + escapeHtml(k) + '=' + escapeHtml(v) + '<\/span>');
+    });
+    if (rule.size_greater_than) {
+        parts.push('size &gt; ' + formatBytes(rule.size_greater_than));
+    }
+    if (rule.size_less_than) {
+        parts.push('size &lt; ' + formatBytes(rule.size_less_than));
+    }
+    return parts.length ? parts.join(' ') : '<span class="text-muted">Whole bucket<\/span>';
+}
+
+function describeLifecycleActions(rule) {
+    const actions = [];
+    if (rule.expiration_days) {
+        actions.push('Expire after ' + formatDays(rule.expiration_days));
+    }
+    if (rule.expiration_date) {
+        actions.push('Expire on ' + escapeHtml(rule.expiration_date));
+    }
+    if (rule.expired_object_delete_marker) {
+        actions.push('Remove expired object delete markers');
+    }
+    if (rule.noncurrent_version_expiration_days) {
+        let action = 'Expire noncurrent versions after ' + formatDays(rule.noncurrent_version_expiration_days);
+        if (rule.newer_noncurrent_versions) {
+            action += ', keep ' + rule.newer_noncurrent_versions + ' newest';
+        }
+        actions.push(action);
+    } else if (rule.newer_noncurrent_versions) {
+        // Standalone (no expiration_days): the engine still recognizes this
+        // as an action that expires noncurrent versions beyond the N newest.
+        actions.push('Keep ' + rule.newer_noncurrent_versions + ' newest noncurrent versions');
+    }
+    if (rule.abort_multipart_days) {
+        actions.push('Abort incomplete multipart uploads after ' + formatDays(rule.abort_multipart_days));
+    }
+    if (actions.length === 0) {
+        return '<span class="text-muted">None<\/span>';
+    }
+    return actions.join('<br>');
+}
+
+function lifecycleRuleRowHtml(rule, idx) {
+    const statusHtml = rule.status === 'Enabled'
+        ? '<span class="badge bg-success">Enabled<\/span>'
+        : '<span class="badge bg-secondary">' + escapeHtml(rule.status) + '<\/span>';
+    return '<tr>' +
+        '<td>' + (rule.id ? escapeHtml(rule.id) : '<span class="text-muted">unnamed<\/span>') + '<\/td>' +
+        '<td>' + statusHtml + '<\/td>' +
+        '<td>' + describeLifecycleScope(rule) + '<\/td>' +
+        '<td>' + describeLifecycleActions(rule) + '<\/td>' +
+        '<td class="text-end text-nowrap">' +
+        '<button type="button" class="btn btn-sm btn-outline-secondary lifecycle-edit-rule-btn" data-index="' + idx + '" title="Edit rule"><i class="bi bi-pen"><\/i><\/button> ' +
+        '<button type="button" class="btn btn-sm btn-outline-danger lifecycle-delete-rule-btn" data-index="' + idx + '" title="Delete rule"><i class="bi bi-trash"><\/i><\/button>' +
+        '<\/td>' +
+        '<\/tr>';
+}
+
+function lifecycleRuleFormHtml() {
+    const rule = lifecycleEditor.editingRule;
+    const tagRowHtml = (k, v) =>
+        '<div class="input-group input-group-sm mb-1 lifecycle-tag-row">' +
+        '<input type="text" class="form-control lifecycle-tag-key" placeholder="Key" value="' + escapeHtml(k) + '">' +
+        '<input type="text" class="form-control lifecycle-tag-value" placeholder="Value" value="' + escapeHtml(v) + '">' +
+        '<button type="button" class="btn btn-outline-danger lifecycle-remove-tag-btn"><i class="bi bi-x"><\/i><\/button>' +
+        '<\/div>';
+    const tagRows = Object.entries(rule.tags || {}).map(([k, v]) => tagRowHtml(k, v)).join('');
+
+    return '' +
+        '<div class="card mb-3" id="lifecycleRuleForm">' +
+        '<div class="card-body">' +
+        '<h6 class="card-title">' + (lifecycleEditor.editingIndex === 'new' ? 'Add rule' : 'Edit rule') + '<\/h6>' +
+
+        '<div class="row g-2 mb-2">' +
+        '<div class="col-md-6">' +
+        '<label class="form-label small">ID (optional)<\/label>' +
+        '<input type="text" class="form-control form-control-sm" id="lifecycleRuleId" value="' + escapeHtml(rule.id) + '">' +
+        '<\/div>' +
+        '<div class="col-md-6">' +
+        '<label class="form-label small d-block">Status<\/label>' +
+        '<div class="form-check form-check-inline">' +
+        '<input class="form-check-input" type="radio" name="lifecycleRuleStatus" id="lifecycleStatusEnabled" value="Enabled"' + (rule.status === 'Enabled' ? ' checked' : '') + '>' +
+        '<label class="form-check-label" for="lifecycleStatusEnabled">Enabled<\/label>' +
+        '<\/div>' +
+        '<div class="form-check form-check-inline">' +
+        '<input class="form-check-input" type="radio" name="lifecycleRuleStatus" id="lifecycleStatusDisabled" value="Disabled"' + (rule.status === 'Disabled' ? ' checked' : '') + '>' +
+        '<label class="form-check-label" for="lifecycleStatusDisabled">Disabled<\/label>' +
+        '<\/div>' +
+        '<\/div>' +
+        '<\/div>' +
+
+        '<div class="mb-2">' +
+        '<label class="form-label small">Prefix<\/label>' +
+        '<input type="text" class="form-control form-control-sm" id="lifecycleRulePrefix" placeholder="logs/" value="' + escapeHtml(rule.prefix) + '">' +
+        '<\/div>' +
+
+        '<div class="mb-2">' +
+        '<label class="form-label small d-block">Tags<\/label>' +
+        '<div id="lifecycleTagRows">' + tagRows + '<\/div>' +
+        '<button type="button" class="btn btn-sm btn-outline-secondary" id="lifecycleAddTagBtn"><i class="bi bi-plus me-1"><\/i>Add tag<\/button>' +
+        '<\/div>' +
+
+        '<div class="row g-2 mb-3">' +
+        '<div class="col-md-6">' +
+        '<label class="form-label small">Size greater than (bytes)<\/label>' +
+        '<input type="number" class="form-control form-control-sm" id="lifecycleRuleSizeGT" min="0" step="1" value="' + (rule.size_greater_than || '') + '">' +
+        '<\/div>' +
+        '<div class="col-md-6">' +
+        '<label class="form-label small">Size less than (bytes)<\/label>' +
+        '<input type="number" class="form-control form-control-sm" id="lifecycleRuleSizeLT" min="0" step="1" value="' + (rule.size_less_than || '') + '">' +
+        '<\/div>' +
+        '<\/div>' +
+
+        '<hr>' +
+        '<h6 class="small text-muted text-uppercase">Actions<\/h6>' +
+
+        '<div class="row g-2 align-items-center mb-2">' +
+        '<div class="col-auto">' +
+        '<div class="form-check">' +
+        '<input class="form-check-input" type="checkbox" id="lifecycleExpireDaysEnabled"' + (rule.expiration_days ? ' checked' : '') + '>' +
+        '<label class="form-check-label" for="lifecycleExpireDaysEnabled">Expire after<\/label>' +
+        '<\/div>' +
+        '<\/div>' +
+        '<div class="col-auto">' +
+        '<input type="number" class="form-control form-control-sm" id="lifecycleExpireDays" min="1" step="1" style="width: 6rem;" value="' + (rule.expiration_days || '') + '"' + (rule.expiration_days ? '' : ' disabled') + '>' +
+        '<\/div><div class="col-auto">days<\/div>' +
+        '<\/div>' +
+
+        '<div class="row g-2 align-items-center mb-2">' +
+        '<div class="col-auto">' +
+        '<div class="form-check">' +
+        '<input class="form-check-input" type="checkbox" id="lifecycleExpireDateEnabled"' + (rule.expiration_date ? ' checked' : '') + '>' +
+        '<label class="form-check-label" for="lifecycleExpireDateEnabled">Expire on date<\/label>' +
+        '<\/div>' +
+        '<\/div>' +
+        '<div class="col-auto">' +
+        '<input type="date" class="form-control form-control-sm" id="lifecycleExpireDate" value="' + escapeHtml(rule.expiration_date) + '"' + (rule.expiration_date ? '' : ' disabled') + '>' +
+        '<\/div>' +
+        '<\/div>' +
+
+        '<div class="form-check mb-2">' +
+        '<input class="form-check-input" type="checkbox" id="lifecycleDeleteMarker"' + (rule.expired_object_delete_marker ? ' checked' : '') + '>' +
+        '<label class="form-check-label" for="lifecycleDeleteMarker">Remove expired object delete markers<\/label>' +
+        '<\/div>' +
+
+        (() => {
+            const noncurrentActive = !!(rule.noncurrent_version_expiration_days || rule.newer_noncurrent_versions);
+            return '<div class="row g-2 align-items-center mb-2">' +
+            '<div class="col-auto">' +
+            '<div class="form-check">' +
+            '<input class="form-check-input" type="checkbox" id="lifecycleNoncurrentEnabled"' + (noncurrentActive ? ' checked' : '') + '>' +
+            '<label class="form-check-label" for="lifecycleNoncurrentEnabled">Limit noncurrent versions<\/label>' +
+            '<\/div>' +
+            '<\/div>' +
+            '<div class="col-auto">after<\/div>' +
+            '<div class="col-auto">' +
+            '<input type="number" class="form-control form-control-sm" id="lifecycleNoncurrentDays" min="1" step="1" style="width: 6rem;" value="' + (rule.noncurrent_version_expiration_days || '') + '"' + (noncurrentActive ? '' : ' disabled') + '>' +
+            '<\/div><div class="col-auto">days (optional), keep<\/div>' +
+            '<div class="col-auto">' +
+            '<input type="number" class="form-control form-control-sm" id="lifecycleNoncurrentKeep" min="0" step="1" style="width: 6rem;" value="' + (rule.newer_noncurrent_versions || '') + '"' + (noncurrentActive ? '' : ' disabled') + '>' +
+            '<\/div><div class="col-auto">newest (optional)<\/div>' +
+            '<\/div>';
+        })() +
+
+        '<div class="row g-2 align-items-center mb-3">' +
+        '<div class="col-auto">' +
+        '<div class="form-check">' +
+        '<input class="form-check-input" type="checkbox" id="lifecycleAbortMPUEnabled"' + (rule.abort_multipart_days ? ' checked' : '') + '>' +
+        '<label class="form-check-label" for="lifecycleAbortMPUEnabled">Abort incomplete multipart uploads after<\/label>' +
+        '<\/div>' +
+        '<\/div>' +
+        '<div class="col-auto">' +
+        '<input type="number" class="form-control form-control-sm" id="lifecycleAbortMPUDays" min="1" step="1" style="width: 6rem;" value="' + (rule.abort_multipart_days || '') + '"' + (rule.abort_multipart_days ? '' : ' disabled') + '>' +
+        '<\/div><div class="col-auto">days<\/div>' +
+        '<\/div>' +
+
+        '<div class="text-end">' +
+        '<button type="button" class="btn btn-sm btn-secondary" id="lifecycleCancelRuleBtn">Cancel<\/button> ' +
+        '<button type="button" class="btn btn-sm btn-primary" id="lifecycleSaveRuleBtn">Save rule<\/button>' +
+        '<\/div>' +
+        '<\/div>' +
+        '<\/div>';
+}
+
+function renderLifecycleEditor() {
+    const container = document.getElementById('bucketLifecycleContent');
+    const rowsHtml = lifecycleEditor.rules.map(lifecycleRuleRowHtml).join('') ||
+        '<tr><td colspan="5" class="text-center text-muted py-3">No lifecycle rules<\/td><\/tr>';
+
+    let html = '';
+    if (lifecycleEditor.hasTransition) {
+        html += '<div class="alert alert-warning small">' +
+            '<i class="bi bi-exclamation-triangle me-1"><\/i>' +
+            'This bucket has a Transition rule set outside the admin (SeaweedFS does not support storage class transitions). Saving from here will drop it.' +
+            '<\/div>';
     }
 
-    function formatBytes(bytes) {
-        if (bytes === 0) return '0 Bytes';
-        const k = 1024;
-        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
-        const i = Math.floor(Math.log(bytes) / Math.log(k));
-        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+    html += '<div class="table-responsive mb-3">' +
+        '<table class="table table-sm align-middle">' +
+        '<thead><tr><th>Rule<\/th><th>Status<\/th><th>Scope<\/th><th>Actions<\/th><th><\/th><\/tr><\/thead>' +
+        '<tbody>' + rowsHtml + '<\/tbody>' +
+        '<\/table>' +
+        '<\/div>' +
+        '<button type="button" class="btn btn-sm btn-outline-primary mb-3" id="lifecycleAddRuleBtn">' +
+        '<i class="bi bi-plus me-1"><\/i>Add rule' +
+        '<\/button>';
+
+    if (lifecycleEditor.editingIndex !== null) {
+        html += lifecycleRuleFormHtml();
     }
 
-    function days(n) {
-        return n + (n === 1 ? ' day' : ' days');
+    if (lifecycleEditor.rawXml) {
+        html += '<details class="mt-2">' +
+            '<summary class="text-muted small">Raw XML (as currently stored)<\/summary>' +
+            '<pre class="bg-light border rounded p-2 mt-2 small mb-0">' + escapeHtml(lifecycleEditor.rawXml) + '<\/pre>' +
+            '<\/details>';
     }
 
-    const rules = data.rules || [];
-    if (rules.length === 0) {
-        document.getElementById('bucketLifecycleContent').innerHTML =
-            '<div class="text-center text-muted py-4">No lifecycle configuration<\/div>';
+    container.innerHTML = html;
+    bindLifecycleEditorEvents();
+}
+
+function bindLifecycleToggle(checkboxId, fieldId, mutuallyExclusiveId) {
+    const checkbox = document.getElementById(checkboxId);
+    const field = document.getElementById(fieldId);
+    if (!checkbox || !field) return;
+    checkbox.addEventListener('change', function() {
+        field.disabled = !this.checked;
+        if (this.checked && mutuallyExclusiveId) {
+            const other = document.getElementById(mutuallyExclusiveId);
+            if (other && other.checked) {
+                other.checked = false;
+                other.dispatchEvent(new Event('change'));
+            }
+        }
+    });
+}
+
+function bindLifecycleEditorEvents() {
+    const addBtn = document.getElementById('lifecycleAddRuleBtn');
+    if (addBtn) {
+        addBtn.addEventListener('click', function() {
+            // Fold in any rule already being edited before switching forms,
+            // so an invalid in-progress draft isn't silently discarded.
+            if (!commitOpenLifecycleRuleForm()) return;
+            lifecycleEditor.editingIndex = 'new';
+            lifecycleEditor.editingRule = blankLifecycleRule();
+            renderLifecycleEditor();
+        });
+    }
+
+    document.querySelectorAll('.lifecycle-edit-rule-btn').forEach(btn => {
+        btn.addEventListener('click', function() {
+            const idx = parseInt(this.dataset.index, 10);
+            // Same as above: committing never shifts indices (it either
+            // pushes a new rule at the end or replaces one in place), so
+            // idx captured above is still valid after this call.
+            if (!commitOpenLifecycleRuleForm()) return;
+            lifecycleEditor.editingIndex = idx;
+            lifecycleEditor.editingRule = cloneLifecycleRule(lifecycleEditor.rules[idx]);
+            renderLifecycleEditor();
+        });
+    });
+
+    document.querySelectorAll('.lifecycle-delete-rule-btn').forEach(btn => {
+        btn.addEventListener('click', function() {
+            const idx = parseInt(this.dataset.index, 10);
+            // Fold in an open form first, like every other transition does:
+            // re-rendering after the splice would otherwise redraw it from the
+            // snapshot taken when editing began and lose what was typed.
+            if (lifecycleEditor.editingIndex !== null && lifecycleEditor.editingIndex !== idx) {
+                if (!commitOpenLifecycleRuleForm()) return;
+            }
+            lifecycleEditor.rules.splice(idx, 1);
+            // Deleting a rule shifts every later index down by one, so an
+            // open edit form must follow its rule rather than silently
+            // start targeting whatever now sits at its old index.
+            if (lifecycleEditor.editingIndex === idx) {
+                lifecycleEditor.editingIndex = null;
+                lifecycleEditor.editingRule = null;
+            } else if (typeof lifecycleEditor.editingIndex === 'number' && lifecycleEditor.editingIndex > idx) {
+                lifecycleEditor.editingIndex -= 1;
+            }
+            renderLifecycleEditor();
+        });
+    });
+
+    const cancelBtn = document.getElementById('lifecycleCancelRuleBtn');
+    if (cancelBtn) {
+        cancelBtn.addEventListener('click', function() {
+            lifecycleEditor.editingIndex = null;
+            lifecycleEditor.editingRule = null;
+            renderLifecycleEditor();
+        });
+    }
+
+    const addTagBtn = document.getElementById('lifecycleAddTagBtn');
+    if (addTagBtn) {
+        addTagBtn.addEventListener('click', function() {
+            const rows = document.getElementById('lifecycleTagRows');
+            const row = document.createElement('div');
+            row.className = 'input-group input-group-sm mb-1 lifecycle-tag-row';
+            row.innerHTML =
+                '<input type="text" class="form-control lifecycle-tag-key" placeholder="Key">' +
+                '<input type="text" class="form-control lifecycle-tag-value" placeholder="Value">' +
+                '<button type="button" class="btn btn-outline-danger lifecycle-remove-tag-btn"><i class="bi bi-x"><\/i><\/button>';
+            rows.appendChild(row);
+            row.querySelector('.lifecycle-remove-tag-btn').addEventListener('click', function() {
+                row.remove();
+            });
+        });
+    }
+
+    document.querySelectorAll('.lifecycle-remove-tag-btn').forEach(btn => {
+        btn.addEventListener('click', function() {
+            this.closest('.lifecycle-tag-row').remove();
+        });
+    });
+
+    bindLifecycleToggle('lifecycleExpireDaysEnabled', 'lifecycleExpireDays', 'lifecycleExpireDateEnabled');
+    bindLifecycleToggle('lifecycleExpireDateEnabled', 'lifecycleExpireDate', 'lifecycleExpireDaysEnabled');
+    bindLifecycleToggle('lifecycleNoncurrentEnabled', 'lifecycleNoncurrentDays');
+    bindLifecycleToggle('lifecycleNoncurrentEnabled', 'lifecycleNoncurrentKeep');
+    bindLifecycleToggle('lifecycleAbortMPUEnabled', 'lifecycleAbortMPUDays');
+
+    const saveRuleBtn = document.getElementById('lifecycleSaveRuleBtn');
+    if (saveRuleBtn) {
+        saveRuleBtn.addEventListener('click', saveLifecycleRuleFromForm);
+    }
+}
+
+// readLifecycleRuleFromForm builds and validates a rule from the currently
+// open edit form's DOM inputs. Returns { rule: null, error: '...' } when the
+// form doesn't hold a valid rule, without mutating any state.
+function readLifecycleRuleFromForm() {
+    const id = document.getElementById('lifecycleRuleId').value.trim();
+    const status = document.querySelector('input[name="lifecycleRuleStatus"]:checked').value;
+    const prefix = document.getElementById('lifecycleRulePrefix').value.trim();
+
+    const tags = {};
+    document.querySelectorAll('#lifecycleTagRows .lifecycle-tag-row').forEach(row => {
+        const key = row.querySelector('.lifecycle-tag-key').value.trim();
+        const value = row.querySelector('.lifecycle-tag-value').value.trim();
+        if (key) {
+            tags[key] = value;
+        }
+    });
+
+    const sizeGT = parseInt(document.getElementById('lifecycleRuleSizeGT').value, 10) || 0;
+    const sizeLT = parseInt(document.getElementById('lifecycleRuleSizeLT').value, 10) || 0;
+
+    const expireDaysEnabled = document.getElementById('lifecycleExpireDaysEnabled').checked;
+    const expireDateEnabled = document.getElementById('lifecycleExpireDateEnabled').checked;
+    const expirationDays = expireDaysEnabled ? (parseInt(document.getElementById('lifecycleExpireDays').value, 10) || 0) : 0;
+    const expirationDate = expireDateEnabled ? document.getElementById('lifecycleExpireDate').value : '';
+
+    const deleteMarker = document.getElementById('lifecycleDeleteMarker').checked;
+
+    const noncurrentEnabled = document.getElementById('lifecycleNoncurrentEnabled').checked;
+    const noncurrentDays = noncurrentEnabled ? (parseInt(document.getElementById('lifecycleNoncurrentDays').value, 10) || 0) : 0;
+    const noncurrentKeep = noncurrentEnabled ? (parseInt(document.getElementById('lifecycleNoncurrentKeep').value, 10) || 0) : 0;
+
+    const abortEnabled = document.getElementById('lifecycleAbortMPUEnabled').checked;
+    const abortDays = abortEnabled ? (parseInt(document.getElementById('lifecycleAbortMPUDays').value, 10) || 0) : 0;
+
+    if (expireDaysEnabled && expirationDays <= 0) {
+        return { rule: null, error: 'Enter a valid number of days for expiration.' };
+    }
+    if (expireDateEnabled && !expirationDate) {
+        return { rule: null, error: 'Enter a valid expiration date.' };
+    }
+    if (noncurrentEnabled && noncurrentDays <= 0 && noncurrentKeep <= 0) {
+        return { rule: null, error: 'Enter a number of days and/or a newest-versions-to-keep count for noncurrent version handling.' };
+    }
+    if (abortEnabled && abortDays <= 0) {
+        return { rule: null, error: 'Enter a valid number of days for aborting incomplete multipart uploads.' };
+    }
+    if (!expireDaysEnabled && !expireDateEnabled && !deleteMarker && !noncurrentEnabled && !abortEnabled) {
+        return { rule: null, error: 'Select at least one action for this rule.' };
+    }
+    // The server rejects this combination too; catching it here names the two
+    // fields instead of surfacing a 400 after the whole set is submitted.
+    if (deleteMarker && (expireDaysEnabled || expireDateEnabled)) {
+        return { rule: null, error: 'Removing expired object delete markers cannot be combined with an expiration.' };
+    }
+    if (sizeGT > 0 && sizeLT > 0 && sizeGT >= sizeLT) {
+        return { rule: null, error: '"Size greater than" must be less than "size less than".' };
+    }
+
+    return {
+        rule: {
+            id: id,
+            status: status,
+            prefix: prefix,
+            tags: tags,
+            size_greater_than: sizeGT > 0 ? sizeGT : null,
+            size_less_than: sizeLT > 0 ? sizeLT : null,
+            expiration_days: expirationDays > 0 ? expirationDays : null,
+            expiration_date: expirationDate || '',
+            expired_object_delete_marker: deleteMarker,
+            noncurrent_version_expiration_days: noncurrentDays > 0 ? noncurrentDays : null,
+            newer_noncurrent_versions: noncurrentKeep > 0 ? noncurrentKeep : null,
+            abort_multipart_days: abortDays > 0 ? abortDays : null,
+        },
+        error: null,
+    };
+}
+
+function saveLifecycleRuleFromForm() {
+    const { rule, error } = readLifecycleRuleFromForm();
+    if (error) {
+        alert(error);
         return;
     }
 
-    function describeScope(rule) {
-        const parts = [];
-        if (rule.prefix) {
-            parts.push('<code>' + escapeHtml(rule.prefix) + '<\/code>');
-        }
-        Object.entries(rule.tags || {}).forEach(([k, v]) => {
-            parts.push('<span class="badge bg-light text-dark border">' + escapeHtml(k) + '=' + escapeHtml(v) + '<\/span>');
-        });
-        if (rule.size_greater_than) {
-            parts.push('size &gt; ' + formatBytes(rule.size_greater_than));
-        }
-        if (rule.size_less_than) {
-            parts.push('size &lt; ' + formatBytes(rule.size_less_than));
-        }
-        return parts.length ? parts.join(' ') : '<span class="text-muted">Whole bucket<\/span>';
+    if (lifecycleEditor.editingIndex === 'new') {
+        lifecycleEditor.rules.push(rule);
+    } else {
+        lifecycleEditor.rules[lifecycleEditor.editingIndex] = rule;
+    }
+    lifecycleEditor.editingIndex = null;
+    lifecycleEditor.editingRule = null;
+    renderLifecycleEditor();
+}
+
+// commitOpenLifecycleRuleForm folds an in-progress add/edit form into
+// lifecycleEditor.rules before the whole rule set is sent to the server, so
+// clicking the modal's "Save" without first clicking "Save rule" doesn't
+// silently drop the open edit. Returns false (and leaves the form open) when
+// the open form doesn't hold a valid rule, so the caller can abort the save.
+function commitOpenLifecycleRuleForm() {
+    if (lifecycleEditor.editingIndex === null) {
+        return true;
     }
 
-    function describeActions(rule) {
-        const actions = [];
-        if (rule.expiration_days) {
-            actions.push('Expire after ' + days(rule.expiration_days));
-        }
-        if (rule.expiration_date) {
-            actions.push('Expire on ' + escapeHtml(rule.expiration_date));
-        }
-        if (rule.expired_object_delete_marker) {
-            actions.push('Remove expired object delete markers');
-        }
-        if (rule.noncurrent_version_expiration_days) {
-            let action = 'Expire noncurrent versions after ' + days(rule.noncurrent_version_expiration_days);
-            if (rule.newer_noncurrent_versions) {
-                action += ', keep ' + rule.newer_noncurrent_versions + ' newest';
-            }
-            actions.push(action);
-        }
-        if (rule.abort_multipart_days) {
-            actions.push('Abort incomplete multipart uploads after ' + days(rule.abort_multipart_days));
-        }
-        if (actions.length === 0) {
-            return '<span class="text-muted">None<\/span>';
-        }
-        return actions.join('<br>');
+    const { rule, error } = readLifecycleRuleFromForm();
+    if (error) {
+        alert(error);
+        return false;
     }
 
-    const rows = [
-        '<div class="table-responsive">',
-        '<table class="table table-sm">',
-        '<thead><tr><th>Rule<\/th><th>Status<\/th><th>Scope<\/th><th>Actions<\/th><\/tr><\/thead>',
-        '<tbody>'
-    ];
-
-    rules.forEach(rule => {
-        const statusHtml = rule.status === 'Enabled'
-            ? '<span class="badge bg-success">Enabled<\/span>'
-            : '<span class="badge bg-secondary">' + escapeHtml(rule.status) + '<\/span>';
-        rows.push(
-            '<tr>' +
-            '<td>' + (rule.id ? escapeHtml(rule.id) : '<span class="text-muted">unnamed<\/span>') + '<\/td>' +
-            '<td>' + statusHtml + '<\/td>' +
-            '<td>' + describeScope(rule) + '<\/td>' +
-            '<td>' + describeActions(rule) + '<\/td>' +
-            '<\/tr>'
-        );
-    });
-
-    rows.push('<\/tbody>', '<\/table>', '<\/div>');
-
-    if (data.xml) {
-        rows.push(
-            '<details class="mt-2">',
-            '<summary class="text-muted small">Raw XML<\/summary>',
-            '<pre class="bg-light border rounded p-2 mt-2 small mb-0">' + escapeHtml(data.xml) + '<\/pre>',
-            '<\/details>'
-        );
+    if (lifecycleEditor.editingIndex === 'new') {
+        lifecycleEditor.rules.push(rule);
+    } else {
+        lifecycleEditor.rules[lifecycleEditor.editingIndex] = rule;
     }
-
-    document.getElementById('bucketLifecycleContent').innerHTML = rows.join('');
+    lifecycleEditor.editingIndex = null;
+    lifecycleEditor.editingRule = null;
+    renderLifecycleEditor();
+    return true;
 }
 
     function goToPage(page) {
@@ -1380,14 +2224,6 @@ function displayBucketLifecycle(data) {
             return '"' + str + '"';
         }
 
-        function formatBytes(bytes) {
-            if (bytes === 0) return '0 Bytes';
-            const k = 1024;
-            const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];
-            const i = Math.floor(Math.log(bytes) / Math.log(k));
-            return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
-        }
-
         // Fetch all buckets from the API (not just the current page)
         fetch(basePath('/api/s3/buckets'))
             .then(response => response.json())
diff --git a/weed/admin/view/app/s3_buckets_templ.go b/weed/admin/view/app/s3_buckets_templ.go
index b570a700ae..b1d832df25 100644
--- a/weed/admin/view/app/s3_buckets_templ.go
+++ b/weed/admin/view/app/s3_buckets_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-cube me-2\"></i>Object Store Buckets</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><select class=\"form-select form-select-sm me-2\" id=\"pageSizeSelect\" onchange=\"changePageSize()\" style=\"width: auto;\"><option value=\"50\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-box me-2\"></i>Object Store Buckets</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><select class=\"form-select form-select-sm me-2\" id=\"pageSizeSelect\" onchange=\"changePageSize()\" style=\"width: auto;\"><option value=\"50\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -74,7 +74,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, ">500 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createBucketModal\"><i class=\"fas fa-plus me-1\"></i>Create Bucket</button></div></div></div><div id=\"s3-buckets-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Buckets</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, ">500 per page</option></select> <button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createBucketModal\"><i class=\"bi bi-plus me-1\"></i>Create Bucket</button></div></div></div><div id=\"s3-buckets-content\"><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Buckets</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -87,7 +87,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "</div></div><div class=\"col-auto\"><i class=\"fas fa-cube fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Storage</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "</div></div><div class=\"col-auto\"><i class=\"bi bi-box icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Total Storage</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -100,7 +100,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"fas fa-hdd fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"bi bi-device-hdd icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-warning shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-warning text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -113,7 +113,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Buckets Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-cube me-2\"></i>Object Store Buckets</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"fas fa-ellipsis-v fa-sm fa-fw text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"#\" onclick=\"exportBucketList()\"><i class=\"fas fa-download me-2\"></i>Export List</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"bucketsTable\"><thead><tr><th><a href=\"#\" onclick=\"sortTable('name')\" class=\"text-decoration-none text-dark\">Name")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Buckets Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-box me-2\"></i>Object Store Buckets</h6><div class=\"dropdown no-arrow\"><a class=\"dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"bi bi-three-dots-vertical icon-sm icon-fixed-width text-gray-400\"></i></a><div class=\"dropdown-menu dropdown-menu-right shadow animated--fade-in\"><div class=\"dropdown-header\">Actions:</div><a class=\"dropdown-item\" href=\"#\" onclick=\"exportBucketList()\"><i class=\"bi bi-download me-2\"></i>Export List</a></div></div></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"bucketsTable\"><thead><tr><th><a href=\"#\" onclick=\"sortTable('name')\" class=\"text-decoration-none text-dark\">Name")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -153,7 +153,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</a></th><th>Quota</th><th>Versioning</th><th>Object Lock</th><th>Lifecycle</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</a></th><th>Quota</th><th>Versioning</th><th>Object Lock</th><th>Lifecycle</th><th>Policy</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -165,20 +165,20 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 			var templ_7745c5c3_Var5 templ.SafeURL
 			templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/files?path=/buckets/%s", bucket.Name)))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 161, Col: 124}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 162, Col: 124}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\" class=\"text-decoration-none\"><i class=\"fas fa-cube me-2\"></i> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\" class=\"text-decoration-none\"><i class=\"bi bi-box me-2\"></i> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var6 string
 			templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 164, Col: 64}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 165, Col: 64}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 			if templ_7745c5c3_Err != nil {
@@ -189,7 +189,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if bucket.ReadOnly {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<span class=\"badge bg-danger ms-2\" title=\"Bucket is read-only (quota enforcement or manual lock); writes are rejected\"><i class=\"fas fa-lock me-1\"></i>Read-only</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<span class=\"badge bg-danger ms-2\" title=\"Bucket is read-only (quota enforcement or manual lock); writes are rejected\"><i class=\"bi bi-lock me-1\"></i>Read-only</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -199,14 +199,14 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if bucket.Owner != "" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<span class=\"badge bg-info\"><i class=\"fas fa-user me-1\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<span class=\"badge bg-info\"><i class=\"bi bi-person me-1\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var7 string
 				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Owner)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 175, Col: 101}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 176, Col: 102}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 				if templ_7745c5c3_Err != nil {
@@ -229,7 +229,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 			var templ_7745c5c3_Var8 string
 			templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.CreatedAt.Format("2006-01-02 15:04"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 181, Col: 92}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 182, Col: 92}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 			if templ_7745c5c3_Err != nil {
@@ -242,7 +242,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 			var templ_7745c5c3_Var9 string
 			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(bucket.LogicalSize))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 183, Col: 85}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 184, Col: 85}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
 			if templ_7745c5c3_Err != nil {
@@ -260,7 +260,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				var templ_7745c5c3_Var10 string
 				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.1fx overhead", float64(bucket.PhysicalSize)/float64(bucket.LogicalSize)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 186, Col: 144}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 187, Col: 144}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 				if templ_7745c5c3_Err != nil {
@@ -278,7 +278,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 			var templ_7745c5c3_Var11 string
 			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(bucket.PhysicalSize))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 190, Col: 81}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 191, Col: 81}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 			if templ_7745c5c3_Err != nil {
@@ -303,11 +303,11 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var13 string
-				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var12).String())
+				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var12).String())
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 1, Col: 0}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -318,7 +318,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				var templ_7745c5c3_Var14 string
 				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(formatBytes(bucket.Quota))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 195, Col: 86}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 196, Col: 86}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 				if templ_7745c5c3_Err != nil {
@@ -336,7 +336,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 					var templ_7745c5c3_Var15 string
 					templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.1f%% used", float64(bucket.LogicalSize)/float64(bucket.Quota)*100))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 199, Col: 146}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 200, Col: 146}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
 					if templ_7745c5c3_Err != nil {
@@ -367,12 +367,12 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if bucket.VersioningStatus == "Enabled" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<span class=\"badge bg-success\"><i class=\"fas fa-check me-1\"></i>Enabled</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "<span class=\"badge bg-success\"><i class=\"bi bi-check me-1\"></i>Enabled</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else if bucket.VersioningStatus == "Suspended" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<span class=\"badge bg-warning\"><i class=\"fas fa-pause me-1\"></i>Suspended</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<span class=\"badge bg-warning\"><i class=\"bi bi-pause me-1\"></i>Suspended</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -387,14 +387,14 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if bucket.ObjectLockEnabled {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "<div><span class=\"badge bg-warning\"><i class=\"fas fa-lock me-1\"></i>Enabled</span><div class=\"small text-muted\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "<div><span class=\"badge bg-warning\"><i class=\"bi bi-lock me-1\"></i>Enabled</span><div class=\"small text-muted\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var16 string
 				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.ObjectLockMode)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 229, Col: 82}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 230, Col: 82}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
 				if templ_7745c5c3_Err != nil {
@@ -407,7 +407,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 				var templ_7745c5c3_Var17 string
 				templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d days", bucket.ObjectLockDuration))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 229, Col: 138}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 230, Col: 138}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 				if templ_7745c5c3_Err != nil {
@@ -433,11 +433,11 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var18 string
-				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
+				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 240, Col: 93}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 241, Col: 93}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -454,7 +454,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 					var templ_7745c5c3_Var19 string
 					templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d rules", bucket.LifecycleRuleCount))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 245, Col: 115}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 246, Col: 115}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 					if templ_7745c5c3_Err != nil {
@@ -473,7 +473,7 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 					var templ_7745c5c3_Var20 string
 					templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d enabled", bucket.LifecycleEnabledCount))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 250, Col: 120}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 251, Col: 120}
 					}
 					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
 					if templ_7745c5c3_Err != nil {
@@ -494,309 +494,378 @@ func S3Buckets(data dash.S3BucketsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\"><a href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var21 templ.SafeURL
-			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/files?path=/buckets/%s", bucket.Name)))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 260, Col: 128}
+			if bucket.PolicyStatementCount > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<button type=\"button\" class=\"badge bg-primary border-0 policy-btn\" data-bucket-name=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var21 string
+				templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 262, Col: 89}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "\" title=\"View Bucket Policy\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if bucket.PolicyStatementCount == 1 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "1 statement")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					var templ_7745c5c3_Var22 string
+					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d statements", bucket.PolicyStatementCount))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 267, Col: 118}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "</button>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "<span class=\"text-muted\">Not configured</span>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\"><a href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "\" class=\"btn btn-outline-success btn-sm\" title=\"Browse Files\"><i class=\"fas fa-folder-open\"></i></a> <button type=\"button\" class=\"btn btn-outline-primary btn-sm view-details-btn\" data-bucket-name=\"")
+			var templ_7745c5c3_Var23 templ.SafeURL
+			templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/files?path=/buckets/%s", bucket.Name)))
 			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var22 string
-			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 267, Col: 89}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, "\" title=\"View Details\"><i class=\"fas fa-eye\"></i></button> <button type=\"button\" class=\"btn btn-outline-secondary btn-sm lifecycle-btn\" data-bucket-name=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var23 string
-			templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 273, Col: 89}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 276, Col: 128}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "\" title=\"Lifecycle Rules\"><i class=\"fas fa-recycle\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm owner-btn\" data-bucket-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "\" class=\"btn btn-outline-success btn-sm\" title=\"Browse Files\"><i class=\"bi bi-folder2-open\"></i></a> <button type=\"button\" class=\"btn btn-outline-primary btn-sm view-details-btn\" data-bucket-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var24 string
-			templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
+			templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 279, Col: 89}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 283, Col: 89}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "\" data-current-owner=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\" title=\"View Details\"><i class=\"bi bi-eye\"></i></button> <button type=\"button\" class=\"btn btn-outline-secondary btn-sm lifecycle-btn\" data-bucket-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var25 string
-			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Owner)
+			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 280, Col: 92}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 289, Col: 89}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var25)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "\" title=\"Manage Owner\"><i class=\"fas fa-user-edit\"></i></button> <button type=\"button\" class=\"btn btn-outline-warning btn-sm quota-btn\" data-bucket-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "\" title=\"Lifecycle Rules\"><i class=\"bi bi-recycle\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm policy-btn\" data-bucket-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var26 string
-			templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
+			templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 286, Col: 89}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 295, Col: 89}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "\" data-current-quota=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "\" title=\"Bucket Policy\"><i class=\"bi bi-shield\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm owner-btn\" data-bucket-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var27 string
-			templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", getQuotaInMB(bucket.Quota)))
+			templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 287, Col: 125}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 301, Col: 89}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "\" data-quota-enabled=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "\" data-current-owner=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var28 string
-			templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%t", bucket.QuotaEnabled))
+			templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Owner)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 288, Col: 118}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 302, Col: 92}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\" title=\"Manage Quota\"><i class=\"fas fa-tachometer-alt\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm delete-bucket-btn\" data-bucket-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "\" title=\"Manage Owner\"><i class=\"bi bi-person-gear\"></i></button> <button type=\"button\" class=\"btn btn-outline-warning btn-sm quota-btn\" data-bucket-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var29 string
-			templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
+			templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 294, Col: 89}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 308, Col: 89}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "\" title=\"Delete Bucket\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "\" data-current-quota=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var30 string
+			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", getQuotaInMB(bucket.Quota)))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 309, Col: 125}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var30)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "\" data-quota-enabled=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var31 string
+			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%t", bucket.QuotaEnabled))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 310, Col: 118}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var31)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "\" title=\"Manage Quota\"><i class=\"bi bi-speedometer2\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm delete-bucket-btn\" data-bucket-name=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var32 string
+			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 316, Col: 89}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var32)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, "\" title=\"Delete Bucket\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.Buckets) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "<tr><td colspan=\"10\" class=\"text-center text-muted py-4\"><i class=\"fas fa-cube fa-3x mb-3 text-muted\"></i><div><h5>No Object Store buckets found</h5><p>Create your first bucket to get started with S3 storage.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createBucketModal\"><i class=\"fas fa-plus me-1\"></i>Create Bucket</button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, "<tr><td colspan=\"11\" class=\"text-center text-muted py-4\"><i class=\"bi bi-box icon-3x mb-3 text-muted\"></i><div><h5>No Object Store buckets found</h5><p>Create your first bucket to get started with S3 storage.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createBucketModal\"><i class=\"bi bi-plus me-1\"></i>Create Bucket</button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "</tbody></table></div><!-- Pagination Controls -->")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, "</tbody></table></div><!-- Pagination Controls -->")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.TotalPages > 1 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "<div class=\"d-flex justify-content-between align-items-center mt-3\"><small class=\"text-muted\">Showing ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, "<div class=\"d-flex justify-content-between align-items-center mt-3\"><small class=\"text-muted\">Showing ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var30 string
-			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", (data.CurrentPage-1)*data.PageSize+1))
+			var templ_7745c5c3_Var33 string
+			templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", (data.CurrentPage-1)*data.PageSize+1))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 326, Col: 101}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 348, Col: 101}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, " to ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, " to ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var31 string
-			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", minInt(data.CurrentPage*data.PageSize, data.TotalBuckets)))
+			var templ_7745c5c3_Var34 string
+			templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", minInt(data.CurrentPage*data.PageSize, data.TotalBuckets)))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 326, Col: 185}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 348, Col: 185}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, " of ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, " of ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var32 string
-			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalBuckets))
+			var templ_7745c5c3_Var35 string
+			templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalBuckets))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 326, Col: 229}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 348, Col: 229}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, " buckets</small><nav aria-label=\"Buckets pagination\"><ul class=\"pagination pagination-sm mb-0\"><!-- Previous Button -->")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, " buckets</small><nav aria-label=\"Buckets pagination\"><ul class=\"pagination pagination-sm mb-0\"><!-- Previous Button -->")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if data.CurrentPage > 1 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var33 string
-				templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage-1))
+				var templ_7745c5c3_Var36 string
+				templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage-1))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 333, Col: 142}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 355, Col: 142}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var36)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, "\"><i class=\"fas fa-chevron-left\"></i></a></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "\"><i class=\"bi bi-chevron-left\"></i></a></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"fas fa-chevron-left\"></i></span></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"bi bi-chevron-left\"></i></span></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, "<!-- Page Numbers -->")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "<!-- Page Numbers -->")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			for i := maxInt(1, data.CurrentPage-2); i <= minInt(data.TotalPages, data.CurrentPage+2); i++ {
 				if i == data.CurrentPage {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "<li class=\"page-item active\"><span class=\"page-link\">")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "<li class=\"page-item active\"><span class=\"page-link\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					var templ_7745c5c3_Var34 string
-					templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
+					var templ_7745c5c3_Var37 string
+					templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 349, Col: 97}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 371, Col: 97}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "</span></li>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "</span></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					var templ_7745c5c3_Var35 string
-					templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
+					var templ_7745c5c3_Var38 string
+					templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", i))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 353, Col: 129}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 375, Col: 129}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var38)
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "\">")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "\">")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					var templ_7745c5c3_Var36 string
-					templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
+					var templ_7745c5c3_Var39 string
+					templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", i))
 					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 353, Col: 152}
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 375, Col: 152}
 					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "</a></li>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "</a></li>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "<!-- Next Button -->")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "<!-- Next Button -->")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if data.CurrentPage < data.TotalPages {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "<li class=\"page-item\"><a class=\"page-link pagination-link\" href=\"#\" data-page=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var37 string
-				templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.CurrentPage+1))
+				var templ_7745c5c3_Var40 string
+				templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.CurrentPage+1))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 361, Col: 142}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 383, Col: 142}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var40)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "\"><i class=\"fas fa-chevron-right\"></i></a></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, "\"><i class=\"bi bi-chevron-right\"></i></a></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"fas fa-chevron-right\"></i></span></li>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "<li class=\"page-item disabled\"><span class=\"page-link\"><i class=\"bi bi-chevron-right\"></i></span></li>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "</ul></nav></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "</ul></nav></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "</div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "</div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var38 string
-		templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
+		var templ_7745c5c3_Var41 string
+		templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 386, Col: 81}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3_buckets.templ`, Line: 408, Col: 81}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "</small></div></div></div><!-- Create Bucket Modal --><div class=\"modal fade\" id=\"createBucketModal\" tabindex=\"-1\" aria-labelledby=\"createBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createBucketModalLabel\"><i class=\"fas fa-plus me-2\"></i>Create New S3 Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createBucketForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label for=\"bucketName\" class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"bucketName\" name=\"name\" placeholder=\"my-bucket-name\" required pattern=\"[a-z0-9.-]+\" title=\"Bucket name must contain only lowercase letters, numbers, dots, and hyphens\"><div class=\"form-text\">Bucket names must be between 3 and 63 characters, contain only lowercase letters, numbers, dots, and hyphens.</div></div><div class=\"mb-3\"><label for=\"bucketOwner\" class=\"form-label\">Owner (Optional)</label> <select class=\"form-select\" id=\"bucketOwner\" name=\"owner\"><option value=\"\">No owner (admin-only access)</option><!-- Options will be populated dynamically when modal opens --></select><div class=\"form-text\">The S3 identity that owns this bucket. Non-admin users can only access buckets they own.</div></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableQuota\" name=\"quota_enabled\"> <label class=\"form-check-label\" for=\"enableQuota\">Enable Storage Quota</label></div></div><div class=\"mb-3\" id=\"quotaSettings\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-8\"><label for=\"quotaSize\" class=\"form-label\">Quota Size</label> <input type=\"number\" class=\"form-control\" id=\"quotaSize\" name=\"quota_size\" placeholder=\"1024\" min=\"1\" step=\"1\"></div><div class=\"col-md-4\"><label for=\"quotaUnit\" class=\"form-label\">Unit</label> <select class=\"form-select\" id=\"quotaUnit\" name=\"quota_unit\"><option value=\"MB\" selected>MB</option> <option value=\"GB\">GB</option> <option value=\"TB\">TB</option></select></div></div><div class=\"form-text\">Set the maximum storage size for this bucket.</div></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableVersioning\" name=\"versioning_enabled\"> <label class=\"form-check-label\" for=\"enableVersioning\">Enable Object Versioning</label></div><div class=\"form-text\">Keep multiple versions of objects in this bucket.</div></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableObjectLock\" name=\"object_lock_enabled\"> <label class=\"form-check-label\" for=\"enableObjectLock\">Enable Object Lock</label></div><div class=\"form-text\">Prevent objects from being deleted or overwritten for a specified period. Automatically enables versioning.</div></div><div class=\"mb-3\" id=\"objectLockSettings\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-6\"><label for=\"objectLockMode\" class=\"form-label\">Object Lock Mode</label> <select class=\"form-select\" id=\"objectLockMode\" name=\"object_lock_mode\"><option value=\"GOVERNANCE\" selected>Governance</option> <option value=\"COMPLIANCE\">Compliance</option></select><div class=\"form-text\">Governance allows override with special permissions, Compliance is immutable.</div></div><div class=\"col-md-6\"><div class=\"form-check mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"setDefaultRetention\" name=\"set_default_retention\"> <label class=\"form-check-label\" for=\"setDefaultRetention\">Set Default Retention</label><div class=\"form-text\">Apply default retention to all new objects in this bucket.</div></div><div id=\"defaultRetentionSettings\" style=\"display: none;\"><label for=\"objectLockDuration\" class=\"form-label\">Default Retention (days)</label> <input type=\"number\" class=\"form-control\" id=\"objectLockDuration\" name=\"object_lock_duration\" placeholder=\"30\" min=\"1\" max=\"36500\" step=\"1\"><div class=\"form-text\">Default retention period for new objects (1-36500 days).</div></div></div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create Bucket</button></div></form></div></div></div><!-- Delete Confirmation Modal --><div class=\"modal fade\" id=\"deleteBucketModal\" tabindex=\"-1\" aria-labelledby=\"deleteBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteBucketModalLabel\"><i class=\"fas fa-exclamation-triangle me-2 text-warning\"></i>Delete Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the bucket <strong id=\"deleteBucketName\"></strong>?</p><div class=\"alert alert-warning\"><i class=\"fas fa-exclamation-triangle me-2\"></i> <strong>Warning:</strong> This action cannot be undone. All objects in the bucket will be permanently deleted.</div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteBucket()\"><i class=\"fas fa-trash me-1\"></i>Delete Bucket</button></div></div></div></div><!-- Manage Quota Modal --><div class=\"modal fade\" id=\"manageQuotaModal\" tabindex=\"-1\" aria-labelledby=\"manageQuotaModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"manageQuotaModalLabel\"><i class=\"fas fa-tachometer-alt me-2\"></i>Manage Bucket Quota</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"quotaForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"quotaBucketName\" readonly></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"quotaEnabled\" name=\"quota_enabled\"> <label class=\"form-check-label\" for=\"quotaEnabled\">Enable Storage Quota</label></div></div><div class=\"mb-3\" id=\"quotaSizeSettings\"><div class=\"row\"><div class=\"col-md-8\"><label for=\"quotaSizeMB\" class=\"form-label\">Quota Size</label> <input type=\"number\" class=\"form-control\" id=\"quotaSizeMB\" name=\"quota_size\" placeholder=\"1024\" min=\"0\" step=\"1\"></div><div class=\"col-md-4\"><label for=\"quotaUnitMB\" class=\"form-label\">Unit</label> <select class=\"form-select\" id=\"quotaUnitMB\" name=\"quota_unit\"><option value=\"MB\" selected>MB</option> <option value=\"GB\">GB</option> <option value=\"TB\">TB</option></select></div></div><div class=\"form-text\">Set the maximum storage size for this bucket. Set to 0 to remove quota.</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-warning\"><i class=\"fas fa-save me-1\"></i>Update Quota</button></div></form></div></div></div><!-- Bucket Details Modal --><div class=\"modal fade\" id=\"bucketDetailsModal\" tabindex=\"-1\" aria-labelledby=\"bucketDetailsModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"bucketDetailsModalLabel\"><i class=\"fas fa-cube me-2\"></i>Bucket Details</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><div id=\"bucketDetailsContent\"><div class=\"text-center py-4\"><div class=\"spinner-border text-primary\" role=\"status\"><span class=\"visually-hidden\">Loading...</span></div><div class=\"mt-2\">Loading bucket details...</div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- Bucket Lifecycle Modal --><div class=\"modal fade\" id=\"bucketLifecycleModal\" tabindex=\"-1\" aria-labelledby=\"bucketLifecycleModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"bucketLifecycleModalLabel\"><i class=\"fas fa-recycle me-2\"></i>Lifecycle</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><div id=\"bucketLifecycleContent\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- Manage Owner Modal --><div class=\"modal fade\" id=\"manageOwnerModal\" tabindex=\"-1\" aria-labelledby=\"manageOwnerModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"manageOwnerModalLabel\"><i class=\"fas fa-user-edit me-2\"></i>Manage Bucket Owner</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"ownerForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"ownerBucketName\" readonly></div><div class=\"mb-3\"><label for=\"bucketOwnerSelect\" class=\"form-label\">Owner</label> <select class=\"form-select\" id=\"bucketOwnerSelect\" name=\"owner\"><option value=\"\">No owner (admin-only access)</option><!-- Options will be populated dynamically --></select><div class=\"form-text\">Select the S3 identity that owns this bucket. Non-admin users can only access buckets they own.</div></div><div id=\"ownerLoadingSpinner\" class=\"text-center py-2\" style=\"display: none;\"><div class=\"spinner-border spinner-border-sm text-primary\" role=\"status\"><span class=\"visually-hidden\">Loading users...</span></div><span class=\"ms-2\">Loading users...</span></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-info\"><i class=\"fas fa-save me-1\"></i>Update Owner</button></div></form></div></div></div><!-- JavaScript for bucket management --><script>\n    // Global state (shared between DOMContentLoaded handlers and global functions)\n    let deleteModalInstance = null;\n    let quotaModalInstance = null;\n    let ownerModalInstance = null;\n    let detailsModalInstance = null;\n    let lifecycleModalInstance = null;\n    let lifecycleRequestSeq = 0;\n    let cachedUsers = null;\n\n    document.addEventListener('DOMContentLoaded', function() {\n        // Add click handlers to pagination links\n        document.querySelectorAll('.pagination-link').forEach(link => {\n            link.addEventListener('click', function(e) {\n                e.preventDefault();\n                const page = this.getAttribute('data-page');\n                goToPage(page);\n            });\n        });\n\n        // Initialize modal instances once (reuse with show/hide)\n        deleteModalInstance = new bootstrap.Modal(document.getElementById('deleteBucketModal'));\n        quotaModalInstance = new bootstrap.Modal(document.getElementById('manageQuotaModal'));\n        ownerModalInstance = new bootstrap.Modal(document.getElementById('manageOwnerModal'));\n        detailsModalInstance = new bootstrap.Modal(document.getElementById('bucketDetailsModal'));\n        lifecycleModalInstance = new bootstrap.Modal(document.getElementById('bucketLifecycleModal'));\n\n        const quotaCheckbox = document.getElementById('enableQuota');\n        const quotaSettings = document.getElementById('quotaSettings');\n        const versioningCheckbox = document.getElementById('enableVersioning');\n        const objectLockCheckbox = document.getElementById('enableObjectLock');\n        const objectLockSettings = document.getElementById('objectLockSettings');\n        const setDefaultRetentionCheckbox = document.getElementById('setDefaultRetention');\n        const defaultRetentionSettings = document.getElementById('defaultRetentionSettings');\n        const createBucketForm = document.getElementById('createBucketForm');\n\n        // Toggle quota settings\n        quotaCheckbox.addEventListener('change', function() {\n            quotaSettings.style.display = this.checked ? 'block' : 'none';\n        });\n\n        // Toggle object lock settings and automatically enable versioning\n        objectLockCheckbox.addEventListener('change', function() {\n            objectLockSettings.style.display = this.checked ? 'block' : 'none';\n            if (this.checked) {\n                versioningCheckbox.checked = true;\n                versioningCheckbox.disabled = true;\n            } else {\n                versioningCheckbox.disabled = false;\n                // Reset default retention settings when object lock is disabled\n                setDefaultRetentionCheckbox.checked = false;\n                defaultRetentionSettings.style.display = 'none';\n            }\n        });\n\n        // Toggle default retention settings\n        setDefaultRetentionCheckbox.addEventListener('change', function() {\n            defaultRetentionSettings.style.display = this.checked ? 'block' : 'none';\n        });\n\n        // Populate owner dropdown when create bucket modal opens\n        document.getElementById('createBucketModal').addEventListener('show.bs.modal', async function() {\n            const ownerSelect = document.getElementById('bucketOwner');\n            \n            // Only fetch if not already populated\n            if (ownerSelect.options.length <= 1) {\n                try {\n                    const response = await fetch(basePath('/api/users'));\n                    const data = await response.json();\n                    const users = data.users || [];\n                    \n                    users.forEach(user => {\n                        const option = document.createElement('option');\n                        option.value = user.username;\n                        option.textContent = user.username;\n                        ownerSelect.appendChild(option);\n                    });\n                } catch (error) {\n                    console.error('Error fetching users for owner dropdown:', error);\n                    // Reset to default state on error - user can still create bucket without owner\n                    ownerSelect.innerHTML = '<option value=\"\">No owner (admin-only access)</option>';\n                    ownerSelect.selectedIndex = 0;\n                }\n            }\n        });\n\n        // Handle form submission\n        createBucketForm.addEventListener('submit', function(e) {\n            e.preventDefault();\n            \n            const formData = new FormData(this);\n            const data = {\n                name: formData.get('name'),\n                owner: formData.get('owner') || '',\n                region: formData.get('region') || '',\n                quota_size: quotaCheckbox.checked ? parseInt(formData.get('quota_size')) || 0 : 0,\n                quota_unit: formData.get('quota_unit') || 'MB',\n                quota_enabled: quotaCheckbox.checked,\n                versioning_enabled: versioningCheckbox.checked,\n                object_lock_enabled: objectLockCheckbox.checked,\n                object_lock_mode: formData.get('object_lock_mode') || 'GOVERNANCE',\n                set_default_retention: setDefaultRetentionCheckbox.checked,\n                object_lock_duration: setDefaultRetentionCheckbox.checked ? parseInt(formData.get('object_lock_duration')) || 30 : 0\n            };\n\n            // Validate object lock settings\n            if (data.object_lock_enabled && data.set_default_retention && data.object_lock_duration <= 0) {\n                alert('Please enter a valid retention duration for object lock.');\n                return;\n            }\n\n            fetch(basePath('/api/s3/buckets'), {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error creating bucket: ' + data.error);\n                } else {\n                    alert('Bucket created successfully!');\n                    // Properly close the modal before reloading\n                    const createModal = bootstrap.Modal.getInstance(document.getElementById('createBucketModal'));\n                    if (createModal) {\n                        createModal.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error creating bucket: ' + error.message);\n            });\n        });\n\n        // Handle delete bucket\n        const deleteForm = document.getElementById('deleteBucketModal');\n        document.querySelectorAll('.delete-bucket-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n                document.getElementById('deleteBucketName').textContent = bucketName;\n                // Store bucket name on modal element instead of global window property\n                deleteForm.dataset.bucketName = bucketName;\n                deleteModalInstance.show();\n            });\n        });\n\n        // Handle quota management\n        const quotaForm = document.getElementById('quotaForm');\n        document.querySelectorAll('.quota-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n                const currentQuota = parseInt(this.dataset.currentQuota);\n                const quotaEnabled = this.dataset.quotaEnabled === 'true';\n                \n                document.getElementById('quotaBucketName').value = bucketName;\n                document.getElementById('quotaEnabled').checked = quotaEnabled;\n                document.getElementById('quotaSizeMB').value = currentQuota;\n                \n                // Toggle quota size settings\n                document.getElementById('quotaSizeSettings').style.display = quotaEnabled ? 'block' : 'none';\n                \n                // Store bucket name on form element instead of global window property\n                quotaForm.dataset.bucketName = bucketName;\n                quotaModalInstance.show();\n            });\n        });\n\n        // Add event listener to properly dispose of quota modal when hidden\n        document.getElementById('manageQuotaModal').addEventListener('hidden.bs.modal', function() {\n            if (quotaModalInstance) {\n                quotaModalInstance.dispose();\n                quotaModalInstance = null;\n            }\n            // Force remove any remaining backdrops\n            document.querySelectorAll('.modal-backdrop').forEach(backdrop => {\n                backdrop.remove();\n            });\n            // Ensure body classes are removed\n            document.body.classList.remove('modal-open');\n            document.body.style.removeProperty('padding-right');\n        });\n\n        // Handle quota form submission\n        document.getElementById('quotaForm').addEventListener('submit', function(e) {\n            e.preventDefault();\n            \n            const bucketName = this.dataset.bucketName;\n            if (!bucketName) return;\n\n            const formData = new FormData(this);\n            const enabled = document.getElementById('quotaEnabled').checked;\n            const data = {\n                quota_size: enabled ? parseInt(formData.get('quota_size')) || 0 : 0,\n                quota_unit: formData.get('quota_unit') || 'MB',\n                quota_enabled: enabled\n            };\n\n            fetch(basePath(`/api/s3/buckets/${bucketName}/quota`), {\n                method: 'PUT',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error updating quota: ' + data.error);\n                } else {\n                    alert('Quota updated successfully!');\n                    // Properly close the modal before reloading\n                    if (quotaModalInstance) {\n                        quotaModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error updating quota: ' + error.message);\n            });\n        });\n\n        // Handle quota enabled checkbox\n        document.getElementById('quotaEnabled').addEventListener('change', function() {\n            document.getElementById('quotaSizeSettings').style.display = this.checked ? 'block' : 'none';\n        });\n\n        // Handle owner management\n        const ownerForm = document.getElementById('ownerForm');\n        document.querySelectorAll('.owner-btn').forEach(button => {\n            button.addEventListener('click', async function() {\n                const bucketName = this.dataset.bucketName;\n                const currentOwner = this.dataset.currentOwner || '';\n                \n                document.getElementById('ownerBucketName').value = bucketName;\n                // Store bucket name on form element instead of global window property\n                ownerForm.dataset.bucketName = bucketName;\n                \n                // Show loading spinner\n                document.getElementById('ownerLoadingSpinner').style.display = 'block';\n                document.getElementById('bucketOwnerSelect').disabled = true;\n                \n                ownerModalInstance.show();\n                \n                // Fetch users if not cached\n                try {\n                    if (!cachedUsers) {\n                        const response = await fetch(basePath('/api/users'));\n                        const data = await response.json();\n                        cachedUsers = data.users || [];\n                    }\n                    \n                    // Populate the select dropdown\n                    const select = document.getElementById('bucketOwnerSelect');\n                    select.innerHTML = '<option value=\"\">No owner (admin-only access)</option>';\n                    \n                    cachedUsers.forEach(user => {\n                        const option = document.createElement('option');\n                        option.value = user.username;\n                        option.textContent = user.username;\n                        if (user.username === currentOwner) {\n                            option.selected = true;\n                        }\n                        select.appendChild(option);\n                    });\n                    \n                    select.disabled = false;\n                } catch (error) {\n                    console.error('Error fetching users:', error);\n                    alert('Error loading users: ' + error.message);\n                    // Re-enable select and reset to default on error\n                    const select = document.getElementById('bucketOwnerSelect');\n                    select.innerHTML = '<option value=\"\">No owner (admin-only access)</option>';\n                    select.selectedIndex = 0;\n                    select.disabled = false;\n                } finally {\n                    document.getElementById('ownerLoadingSpinner').style.display = 'none';\n                }\n            });\n        });\n\n        // Handle owner form submission\n        document.getElementById('ownerForm').addEventListener('submit', function(e) {\n            e.preventDefault();\n            \n            const bucketName = this.dataset.bucketName;\n            if (!bucketName) return;\n\n            const owner = document.getElementById('bucketOwnerSelect').value;\n            const data = { owner: owner };\n\n            fetch(basePath(`/api/s3/buckets/${bucketName}/owner`), {\n                method: 'PUT',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error updating owner: ' + data.error);\n                } else {\n                    alert('Bucket owner updated successfully!');\n                    // Properly close the modal before reloading\n                    if (ownerModalInstance) {\n                        ownerModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error updating owner: ' + error.message);\n            });\n        });\n\n        // Handle view details button\n        document.querySelectorAll('.view-details-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n                \n                // Update modal title\n                document.getElementById('bucketDetailsModalLabel').innerHTML = \n                    '<i class=\"fas fa-cube me-2\"></i>Bucket Details - ' + bucketName;\n                \n                // Show loading spinner\n                document.getElementById('bucketDetailsContent').innerHTML = \n                    '<div class=\"text-center py-4\">' +\n                    '<div class=\"spinner-border text-primary\" role=\"status\">' +\n                    '<span class=\"visually-hidden\">Loading...</span>' +\n                    '<\\\\/div>' +\n                    '<div class=\"mt-2\">Loading bucket details...</div>' +\n                    '<\\\\/div>';\n                \n                detailsModalInstance.show();\n                \n                // Fetch bucket details\n                fetch(basePath('/api/s3/buckets/' + bucketName))\n                    .then(response => response.json())\n                    .then(data => {\n                        if (data.error) {\n                            document.getElementById('bucketDetailsContent').innerHTML = \n                                '<div class=\"alert alert-danger\">' +\n                                '<i class=\"fas fa-exclamation-triangle me-2\"></i>' +\n                                'Error loading bucket details: ' + data.error +\n                                '<\\\\/div>';\n                        } else {\n                            displayBucketDetails(data);\n                        }\n                    })\n                    .catch(error => {\n                        console.error('Error fetching bucket details:', error);\n                        document.getElementById('bucketDetailsContent').innerHTML = \n                            '<div class=\"alert alert-danger\">' +\n                            '<i class=\"fas fa-exclamation-triangle me-2\"></i>' +\n                            'Error loading bucket details: ' + error.message +\n                            '<\\\\/div>';\n                    });\n            });\n        });\n\n        // Lifecycle buttons: column badge and action button\n        document.querySelectorAll('.lifecycle-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n\n                document.getElementById('bucketLifecycleModalLabel').innerHTML =\n                    '<i class=\"fas fa-recycle me-2\"></i>Lifecycle - ' + bucketName;\n\n                document.getElementById('bucketLifecycleContent').innerHTML =\n                    '<div class=\"text-center py-4\">' +\n                    '<div class=\"spinner-border text-primary\" role=\"status\">' +\n                    '<span class=\"visually-hidden\">Loading...</span>' +\n                    '<\\/div>' +\n                    '<div class=\"mt-2\">Loading lifecycle rules...</div>' +\n                    '<\\/div>';\n\n                lifecycleModalInstance.show();\n\n                // Drop responses that arrive after another bucket was opened\n                const requestSeq = ++lifecycleRequestSeq;\n                fetch(basePath('/api/s3/buckets/' + bucketName + '/lifecycle'))\n                    .then(response => response.json())\n                    .then(data => {\n                        if (requestSeq !== lifecycleRequestSeq) return;\n                        if (data.error) {\n                            document.getElementById('bucketLifecycleContent').innerHTML =\n                                '<div class=\"alert alert-danger\">' +\n                                '<i class=\"fas fa-exclamation-triangle me-2\"></i>' +\n                                'Error loading lifecycle rules: ' + data.error +\n                                '<\\/div>';\n                        } else {\n                            displayBucketLifecycle(data);\n                        }\n                    })\n                    .catch(error => {\n                        if (requestSeq !== lifecycleRequestSeq) return;\n                        console.error('Error fetching bucket lifecycle:', error);\n                        document.getElementById('bucketLifecycleContent').innerHTML =\n                            '<div class=\"alert alert-danger\">' +\n                            '<i class=\"fas fa-exclamation-triangle me-2\"></i>' +\n                            'Error loading lifecycle rules: ' + error.message +\n                            '<\\/div>';\n                    });\n            });\n        });\n    });\n\n    function deleteBucket() {\n        const bucketName = document.getElementById('deleteBucketModal').dataset.bucketName;\n        if (!bucketName) return;\n\n        fetch(basePath(`/api/s3/buckets/${bucketName}`), {\n            method: 'DELETE'\n        })\n        .then(response => response.json())\n        .then(data => {\n            if (data.error) {\n                alert('Error deleting bucket: ' + data.error);\n            } else {\n                alert('Bucket deleted successfully!');\n                // Properly close the modal before reloading\n                if (deleteModalInstance) {\n                    deleteModalInstance.hide();\n                }\n                setTimeout(() => location.reload(), 500);\n            }\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            alert('Error deleting bucket: ' + error.message);\n        });\n    }\n\nfunction displayBucketDetails(data) {\n    const bucket = data.bucket;\n\n    function escapeHtml(v) {\n        return String(v ?? '')\n            .replace(/&/g, '&amp;')\n            .replace(/</g, '&lt;')\n            .replace(/>/g, '&gt;')\n            .replace(/\"/g, '&quot;')\n            .replace(/'/g, '&#39;');\n    }\n\n    function formatBytes(bytes) {\n        if (bytes === 0) return '0 Bytes';\n        const k = 1024;\n        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n        const i = Math.floor(Math.log(bytes) / Math.log(k));\n        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n    }\n\n    function formatDate(dateString) {\n        const date = new Date(dateString);\n        return date.toLocaleString();\n    }\n\n    let ownerHtml = '<span class=\"text-muted\">No owner (admin-only)</span>';\n    if (bucket.owner) {\n        ownerHtml = '<span class=\"badge bg-info\"><i class=\"fas fa-user me-1\"></i>' + escapeHtml(bucket.owner) + '</span>';\n    }\n\n    let usageHtml = '';\n    if (bucket.physical_size > 0 && bucket.logical_size > 0 && bucket.physical_size > bucket.logical_size) {\n        const overhead = (bucket.physical_size / bucket.logical_size).toFixed(1);\n        usageHtml = '<br><small class=\"text-muted\">' + overhead + 'x overhead<\\/small>';\n    }\n\n    let quotaHtml = '<span class=\"badge bg-secondary\">Disabled</span>';\n    if (bucket.quota_enabled) {\n        quotaHtml = '<span class=\"badge bg-success\">' + formatBytes(bucket.quota) + '</span>';\n    }\n\n    let versioningHtml = '<span class=\"text-muted\">Not configured</span>';\n    if (bucket.versioning_status === 'Enabled') {\n        versioningHtml = '<span class=\"badge bg-success\"><i class=\"fas fa-check me-1\"></i>Enabled</span>';\n    } else if (bucket.versioning_status === 'Suspended') {\n        versioningHtml = '<span class=\"badge bg-warning\"><i class=\"fas fa-pause me-1\"></i>Suspended</span>';\n    }\n\n    let statusHtml = '<span class=\"badge bg-success\">Writable</span>';\n    if (bucket.read_only) {\n        statusHtml = '<span class=\"badge bg-danger\"><i class=\"fas fa-lock me-1\"></i>Read-only</span>';\n    }\n\n    let objectLockHtml = '<span class=\"text-muted\">Not configured</span>';\n    if (bucket.object_lock_enabled) {\n        let details = '';\n        if (bucket.object_lock_mode && bucket.object_lock_duration > 0) {\n            details = '<br><small class=\"text-muted\">' + escapeHtml(bucket.object_lock_mode) + ' • ' + bucket.object_lock_duration + ' days<\\/small>';\n        }\n        objectLockHtml = '<span class=\"badge bg-warning\"><i class=\"fas fa-lock me-1\"></i>Enabled</span>' + details;\n    }\n\n    const rows = [\n        '<div class=\"row\">',\n        '<div class=\"col-md-6\">',\n        '<h6><i class=\"fas fa-info-circle me-2\"></i>Bucket Information</h6>',\n        '<table class=\"table table-sm\">',\n        '<tr><td><strong>Name:</strong></td><td>' + escapeHtml(bucket.name) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Owner:</strong></td><td>' + ownerHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Created:</strong></td><td>' + formatDate(bucket.created_at) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Last Modified:</strong></td><td>' + formatDate(bucket.last_modified) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Logical Size:</strong></td><td>' + formatBytes(bucket.logical_size) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Physical Size:</strong></td><td>' + formatBytes(bucket.physical_size) + usageHtml + '<\\/td><\\/tr>',\n        '<\\/table>',\n        '<\\/div>',\n        '<div class=\"col-md-6\">',\n        '<h6><i class=\"fas fa-cogs me-2\"></i>Configuration</h6>',\n        '<table class=\"table table-sm\">',\n        '<tr><td><strong>Status:</strong></td><td>' + statusHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Quota:</strong></td><td>' + quotaHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Versioning:</strong></td><td>' + versioningHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Object Lock:</strong></td><td>' + objectLockHtml + '<\\/td><\\/tr>',\n        '<\\/table>',\n        '<\\/div>',\n        '<\\/div>'\n    ];\n\n    document.getElementById('bucketDetailsContent').innerHTML = rows.join('');\n}\n\nfunction displayBucketLifecycle(data) {\n    function escapeHtml(v) {\n        return String(v ?? '')\n            .replace(/&/g, '&amp;')\n            .replace(/</g, '&lt;')\n            .replace(/>/g, '&gt;')\n            .replace(/\"/g, '&quot;')\n            .replace(/'/g, '&#39;');\n    }\n\n    function formatBytes(bytes) {\n        if (bytes === 0) return '0 Bytes';\n        const k = 1024;\n        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n        const i = Math.floor(Math.log(bytes) / Math.log(k));\n        return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n    }\n\n    function days(n) {\n        return n + (n === 1 ? ' day' : ' days');\n    }\n\n    const rules = data.rules || [];\n    if (rules.length === 0) {\n        document.getElementById('bucketLifecycleContent').innerHTML =\n            '<div class=\"text-center text-muted py-4\">No lifecycle configuration<\\/div>';\n        return;\n    }\n\n    function describeScope(rule) {\n        const parts = [];\n        if (rule.prefix) {\n            parts.push('<code>' + escapeHtml(rule.prefix) + '<\\/code>');\n        }\n        Object.entries(rule.tags || {}).forEach(([k, v]) => {\n            parts.push('<span class=\"badge bg-light text-dark border\">' + escapeHtml(k) + '=' + escapeHtml(v) + '<\\/span>');\n        });\n        if (rule.size_greater_than) {\n            parts.push('size &gt; ' + formatBytes(rule.size_greater_than));\n        }\n        if (rule.size_less_than) {\n            parts.push('size &lt; ' + formatBytes(rule.size_less_than));\n        }\n        return parts.length ? parts.join(' ') : '<span class=\"text-muted\">Whole bucket<\\/span>';\n    }\n\n    function describeActions(rule) {\n        const actions = [];\n        if (rule.expiration_days) {\n            actions.push('Expire after ' + days(rule.expiration_days));\n        }\n        if (rule.expiration_date) {\n            actions.push('Expire on ' + escapeHtml(rule.expiration_date));\n        }\n        if (rule.expired_object_delete_marker) {\n            actions.push('Remove expired object delete markers');\n        }\n        if (rule.noncurrent_version_expiration_days) {\n            let action = 'Expire noncurrent versions after ' + days(rule.noncurrent_version_expiration_days);\n            if (rule.newer_noncurrent_versions) {\n                action += ', keep ' + rule.newer_noncurrent_versions + ' newest';\n            }\n            actions.push(action);\n        }\n        if (rule.abort_multipart_days) {\n            actions.push('Abort incomplete multipart uploads after ' + days(rule.abort_multipart_days));\n        }\n        if (actions.length === 0) {\n            return '<span class=\"text-muted\">None<\\/span>';\n        }\n        return actions.join('<br>');\n    }\n\n    const rows = [\n        '<div class=\"table-responsive\">',\n        '<table class=\"table table-sm\">',\n        '<thead><tr><th>Rule<\\/th><th>Status<\\/th><th>Scope<\\/th><th>Actions<\\/th><\\/tr><\\/thead>',\n        '<tbody>'\n    ];\n\n    rules.forEach(rule => {\n        const statusHtml = rule.status === 'Enabled'\n            ? '<span class=\"badge bg-success\">Enabled<\\/span>'\n            : '<span class=\"badge bg-secondary\">' + escapeHtml(rule.status) + '<\\/span>';\n        rows.push(\n            '<tr>' +\n            '<td>' + (rule.id ? escapeHtml(rule.id) : '<span class=\"text-muted\">unnamed<\\/span>') + '<\\/td>' +\n            '<td>' + statusHtml + '<\\/td>' +\n            '<td>' + describeScope(rule) + '<\\/td>' +\n            '<td>' + describeActions(rule) + '<\\/td>' +\n            '<\\/tr>'\n        );\n    });\n\n    rows.push('<\\/tbody>', '<\\/table>', '<\\/div>');\n\n    if (data.xml) {\n        rows.push(\n            '<details class=\"mt-2\">',\n            '<summary class=\"text-muted small\">Raw XML<\\/summary>',\n            '<pre class=\"bg-light border rounded p-2 mt-2 small mb-0\">' + escapeHtml(data.xml) + '<\\/pre>',\n            '<\\/details>'\n        );\n    }\n\n    document.getElementById('bucketLifecycleContent').innerHTML = rows.join('');\n}\n\n    function goToPage(page) {\n        const url = new URL(window.location);\n        url.searchParams.set('page', page);\n        window.location.href = url.toString();\n    }\n\n    function changePageSize() {\n        const pageSize = document.getElementById('pageSizeSelect').value;\n        const url = new URL(window.location);\n        url.searchParams.set('pageSize', pageSize);\n        url.searchParams.set('page', '1');\n        window.location.href = url.toString();\n    }\n\n    function sortTable(column) {\n        const url = new URL(window.location);\n        const currentSort = url.searchParams.get('sortBy');\n        const currentOrder = url.searchParams.get('sortOrder') || 'asc';\n\n        let newOrder = 'asc';\n        if (currentSort === column && currentOrder === 'asc') {\n            newOrder = 'desc';\n        }\n\n        url.searchParams.set('sortBy', column);\n        url.searchParams.set('sortOrder', newOrder);\n        url.searchParams.set('page', '1');\n        window.location.href = url.toString();\n    }\n\n    function exportBucketList() {\n        // RFC 4180 compliant CSV escaping: escape double quotes by doubling them\n        function escapeCsvField(value) {\n            const str = String(value ?? '');\n            if (str.includes(',') || str.includes('\"') || str.includes('\\n') || str.includes('\\r')) {\n                return '\"' + str.replace(/\"/g, '\"\"') + '\"';\n            }\n            return '\"' + str + '\"';\n        }\n\n        function formatBytes(bytes) {\n            if (bytes === 0) return '0 Bytes';\n            const k = 1024;\n            const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB'];\n            const i = Math.floor(Math.log(bytes) / Math.log(k));\n            return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];\n        }\n\n        // Fetch all buckets from the API (not just the current page)\n        fetch(basePath('/api/s3/buckets'))\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error exporting buckets: ' + data.error);\n                    return;\n                }\n\n                const buckets = data.buckets || [];\n                const csvContent = \"data:text/csv;charset=utf-8,\" +\n                    \"Name,Owner,Logical Size,Physical Size,Created,Quota,Versioning,Object Lock\\n\" +\n                    buckets.map(b => [\n                        escapeCsvField(b.name),\n                        escapeCsvField(b.owner),\n                        escapeCsvField(formatBytes(b.logical_size)),\n                        escapeCsvField(formatBytes(b.physical_size)),\n                        escapeCsvField(b.created_at),\n                        escapeCsvField(b.quota_enabled ? formatBytes(b.quota) : 'No quota'),\n                        escapeCsvField(b.versioning_status || 'Not configured'),\n                        escapeCsvField(b.object_lock_enabled ? 'Enabled' : 'Not configured')\n                    ].join(',')).join(\"\\n\");\n\n                const encodedUri = encodeURI(csvContent);\n                const link = document.createElement(\"a\");\n                link.setAttribute(\"href\", encodedUri);\n                link.setAttribute(\"download\", \"buckets.csv\");\n                document.body.appendChild(link);\n                link.click();\n                document.body.removeChild(link);\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error exporting buckets: ' + error.message);\n            });\n    }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, "</small></div></div></div><!-- Create Bucket Modal --><div class=\"modal fade\" id=\"createBucketModal\" tabindex=\"-1\" aria-labelledby=\"createBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createBucketModalLabel\"><i class=\"bi bi-plus me-2\"></i>Create New S3 Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createBucketForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label for=\"bucketName\" class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"bucketName\" name=\"name\" placeholder=\"my-bucket-name\" required pattern=\"[a-z0-9.-]+\" title=\"Bucket name must contain only lowercase letters, numbers, dots, and hyphens\"><div class=\"form-text\">Bucket names must be between 3 and 63 characters, contain only lowercase letters, numbers, dots, and hyphens.</div></div><div class=\"mb-3\"><label for=\"bucketOwner\" class=\"form-label\">Owner (Optional)</label> <select class=\"form-select\" id=\"bucketOwner\" name=\"owner\"><option value=\"\">No owner (admin-only access)</option><!-- Options will be populated dynamically when modal opens --></select><div class=\"form-text\">The S3 identity that owns this bucket. Non-admin users can only access buckets they own.</div></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableQuota\" name=\"quota_enabled\"> <label class=\"form-check-label\" for=\"enableQuota\">Enable Storage Quota</label></div></div><div class=\"mb-3\" id=\"quotaSettings\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-8\"><label for=\"quotaSize\" class=\"form-label\">Quota Size</label> <input type=\"number\" class=\"form-control\" id=\"quotaSize\" name=\"quota_size\" placeholder=\"1024\" min=\"1\" step=\"1\"></div><div class=\"col-md-4\"><label for=\"quotaUnit\" class=\"form-label\">Unit</label> <select class=\"form-select\" id=\"quotaUnit\" name=\"quota_unit\"><option value=\"MB\" selected>MB</option> <option value=\"GB\">GB</option> <option value=\"TB\">TB</option></select></div></div><div class=\"form-text\">Set the maximum storage size for this bucket.</div></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableVersioning\" name=\"versioning_enabled\"> <label class=\"form-check-label\" for=\"enableVersioning\">Enable Object Versioning</label></div><div class=\"form-text\">Keep multiple versions of objects in this bucket.</div></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableObjectLock\" name=\"object_lock_enabled\"> <label class=\"form-check-label\" for=\"enableObjectLock\">Enable Object Lock</label></div><div class=\"form-text\">Prevent objects from being deleted or overwritten for a specified period. Automatically enables versioning.</div></div><div class=\"mb-3\" id=\"objectLockSettings\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-6\"><label for=\"objectLockMode\" class=\"form-label\">Object Lock Mode</label> <select class=\"form-select\" id=\"objectLockMode\" name=\"object_lock_mode\"><option value=\"GOVERNANCE\" selected>Governance</option> <option value=\"COMPLIANCE\">Compliance</option></select><div class=\"form-text\">Governance allows override with special permissions, Compliance is immutable.</div></div><div class=\"col-md-6\"><div class=\"form-check mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"setDefaultRetention\" name=\"set_default_retention\"> <label class=\"form-check-label\" for=\"setDefaultRetention\">Set Default Retention</label><div class=\"form-text\">Apply default retention to all new objects in this bucket.</div></div><div id=\"defaultRetentionSettings\" style=\"display: none;\"><label for=\"objectLockDuration\" class=\"form-label\">Default Retention (days)</label> <input type=\"number\" class=\"form-control\" id=\"objectLockDuration\" name=\"object_lock_duration\" placeholder=\"30\" min=\"1\" max=\"36500\" step=\"1\"><div class=\"form-text\">Default retention period for new objects (1-36500 days).</div></div></div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create Bucket</button></div></form></div></div></div><!-- Delete Confirmation Modal --><div class=\"modal fade\" id=\"deleteBucketModal\" tabindex=\"-1\" aria-labelledby=\"deleteBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteBucketModalLabel\"><i class=\"bi bi-exclamation-triangle me-2 text-warning\"></i>Delete Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the bucket <strong id=\"deleteBucketName\"></strong>?</p><div class=\"alert alert-warning\"><i class=\"bi bi-exclamation-triangle me-2\"></i> <strong>Warning:</strong> This action cannot be undone. All objects in the bucket will be permanently deleted.</div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteBucket()\"><i class=\"bi bi-trash me-1\"></i>Delete Bucket</button></div></div></div></div><!-- Manage Quota Modal --><div class=\"modal fade\" id=\"manageQuotaModal\" tabindex=\"-1\" aria-labelledby=\"manageQuotaModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"manageQuotaModalLabel\"><i class=\"bi bi-speedometer2 me-2\"></i>Manage Bucket Quota</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"quotaForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"quotaBucketName\" readonly></div><div class=\"mb-3\"><div class=\"form-check\"><input class=\"form-check-input\" type=\"checkbox\" id=\"quotaEnabled\" name=\"quota_enabled\"> <label class=\"form-check-label\" for=\"quotaEnabled\">Enable Storage Quota</label></div></div><div class=\"mb-3\" id=\"quotaSizeSettings\"><div class=\"row\"><div class=\"col-md-8\"><label for=\"quotaSizeMB\" class=\"form-label\">Quota Size</label> <input type=\"number\" class=\"form-control\" id=\"quotaSizeMB\" name=\"quota_size\" placeholder=\"1024\" min=\"0\" step=\"1\"></div><div class=\"col-md-4\"><label for=\"quotaUnitMB\" class=\"form-label\">Unit</label> <select class=\"form-select\" id=\"quotaUnitMB\" name=\"quota_unit\"><option value=\"MB\" selected>MB</option> <option value=\"GB\">GB</option> <option value=\"TB\">TB</option></select></div></div><div class=\"form-text\">Set the maximum storage size for this bucket. Set to 0 to remove quota.</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-warning\"><i class=\"bi bi-floppy me-1\"></i>Update Quota</button></div></form></div></div></div><!-- Bucket Details Modal --><div class=\"modal fade\" id=\"bucketDetailsModal\" tabindex=\"-1\" aria-labelledby=\"bucketDetailsModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"bucketDetailsModalLabel\"><i class=\"bi bi-box me-2\"></i>Bucket Details</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><div id=\"bucketDetailsContent\"><div class=\"text-center py-4\"><div class=\"spinner-border text-primary\" role=\"status\"><span class=\"visually-hidden\">Loading...</span></div><div class=\"mt-2\">Loading bucket details...</div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- Bucket Lifecycle Modal --><div class=\"modal fade\" id=\"bucketLifecycleModal\" tabindex=\"-1\" aria-labelledby=\"bucketLifecycleModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"bucketLifecycleModalLabel\"><i class=\"bi bi-recycle me-2\"></i>Lifecycle</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><div id=\"bucketLifecycleContent\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-outline-danger me-auto\" id=\"lifecycleDeleteAllBtn\"><i class=\"bi bi-trash me-1\"></i>Delete all rules</button> <button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" id=\"lifecycleSaveAllBtn\"><i class=\"bi bi-floppy me-1\"></i>Save</button></div></div></div></div>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "<!-- Bucket Policy Modal --><div class=\"modal fade\" id=\"bucketPolicyModal\" tabindex=\"-1\" aria-labelledby=\"bucketPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"bucketPolicyModalLabel\"><i class=\"bi bi-file-earmark-lock me-2\"></i>Bucket Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><div id=\"bucketPolicyLoading\" class=\"text-center py-4\"><div class=\"spinner-border text-primary\" role=\"status\"><span class=\"visually-hidden\">Loading...</span></div><div class=\"mt-2\">Loading bucket policy...</div></div><div id=\"bucketPolicyError\" class=\"alert alert-danger\" style=\"display: none;\"></div><div id=\"bucketPolicyEditorWrapper\" style=\"display: none;\"><p class=\"text-muted small\">Every statement must specify a Principal, and every Resource must refer to this bucket. Leave the document empty and click Delete to remove the policy.</p><ul class=\"nav nav-tabs\" role=\"tablist\"><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link active\" id=\"bucketPolicyEditorTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#bucketPolicyEditorTab\" role=\"tab\" aria-controls=\"bucketPolicyEditorTab\" aria-selected=\"true\">Editor</button></li><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link\" id=\"bucketPolicyJsonTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#bucketPolicyJsonTab\" role=\"tab\" aria-controls=\"bucketPolicyJsonTab\" aria-selected=\"false\">JSON</button></li></ul><div class=\"tab-content border border-top-0 rounded-bottom p-3 mb-3\"><div class=\"tab-pane fade show active\" id=\"bucketPolicyEditorTab\" role=\"tabpanel\" aria-labelledby=\"bucketPolicyEditorTabBtn\"><div id=\"bucketPolicyEditorBody\"></div><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"bucketPolicyAddStatementBtn\"><i class=\"bi bi-plus me-1\"></i>Add statement</button></div><div class=\"tab-pane fade\" id=\"bucketPolicyJsonTab\" role=\"tabpanel\" aria-labelledby=\"bucketPolicyJsonTabBtn\"><textarea class=\"form-control\" id=\"bucketPolicyDocument\" rows=\"15\" style=\"font-family: monospace;\" spellcheck=\"false\" placeholder='{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"s3:GetObject\",\"Resource\":\"arn:aws:s3:::bucket-name/*\"}]}'></textarea><div class=\"form-text\">Enter the bucket policy document as JSON</div></div></div><div class=\"mb-3\"><button type=\"button\" class=\"btn btn-outline-info btn-sm\" id=\"bucketPolicyInsertSampleBtn\"><i class=\"bi bi-file-earmark-text me-1\"></i>Use Sample Policy</button></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-outline-danger me-auto\" id=\"bucketPolicyDeleteBtn\"><i class=\"bi bi-trash me-1\"></i>Delete</button> <button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" id=\"bucketPolicySaveBtn\"><i class=\"bi bi-floppy me-1\"></i>Save</button></div></div></div></div><!-- Manage Owner Modal --><div class=\"modal fade\" id=\"manageOwnerModal\" tabindex=\"-1\" aria-labelledby=\"manageOwnerModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"manageOwnerModalLabel\"><i class=\"bi bi-person-gear me-2\"></i>Manage Bucket Owner</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"ownerForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"ownerBucketName\" readonly></div><div class=\"mb-3\"><label for=\"bucketOwnerSelect\" class=\"form-label\">Owner</label> <select class=\"form-select\" id=\"bucketOwnerSelect\" name=\"owner\"><option value=\"\">No owner (admin-only access)</option><!-- Options will be populated dynamically --></select><div class=\"form-text\">Select the S3 identity that owns this bucket. Non-admin users can only access buckets they own.</div></div><div id=\"ownerLoadingSpinner\" class=\"text-center py-2\" style=\"display: none;\"><div class=\"spinner-border spinner-border-sm text-primary\" role=\"status\"><span class=\"visually-hidden\">Loading users...</span></div><span class=\"ms-2\">Loading users...</span></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-info\"><i class=\"bi bi-floppy me-1\"></i>Update Owner</button></div></form></div></div></div><!-- JavaScript for bucket management --><script>\n    // Global state (shared between DOMContentLoaded handlers and global functions)\n    let deleteModalInstance = null;\n    let quotaModalInstance = null;\n    let ownerModalInstance = null;\n    let detailsModalInstance = null;\n    let lifecycleModalInstance = null;\n    let lifecycleRequestSeq = 0;\n    let policyModalInstance = null;\n    let policyRequestSeq = 0;\n    let policyEditorBucket = null;\n    // True only once the bucket-policy GET for the currently open bucket has\n    // actually completed successfully. The Save button lives outside the\n    // (initially hidden) editor wrapper, so it stays clickable while a load\n    // is in flight or has failed; without this guard, Save could commit\n    // whatever the editor happened to hold - a stale previous bucket's\n    // statements, or a freshly-initialized empty state - onto\n    // policyEditorBucket before its own policy ever loaded.\n    let bucketPolicyLoaded = false;\n    // True while a Save (PUT) or Delete (DELETE) request for the bucket\n    // policy is in flight, so a double-click - or Save and Delete fired in\n    // quick succession - can't send two overlapping mutations for the same\n    // bucket. Cleared on failure so the user can retry; left set on success,\n    // since the modal hides and the page reloads shortly after anyway.\n    let bucketPolicyMutationInFlight = false;\n\n    function setBucketPolicyMutationInFlight(inFlight) {\n        bucketPolicyMutationInFlight = inFlight;\n        document.getElementById('bucketPolicySaveBtn').disabled = inFlight;\n        document.getElementById('bucketPolicyDeleteBtn').disabled = inFlight;\n    }\n\n    let cachedUsers = null;\n\n    // Working copy of the lifecycle rules currently shown in the modal.\n    // Edits (add/edit/delete rule) only mutate this local state; nothing is\n    // sent to the server until \"Save\" or \"Delete all rules\" is clicked.\n    let lifecycleEditor = { bucket: null, rules: [], editingIndex: null, editingRule: null, rawXml: '', hasTransition: false };\n\n    function escapeHtml(v) {\n        return String(v ?? '')\n            .replace(/&/g, '&amp;')\n            .replace(/</g, '&lt;')\n            .replace(/>/g, '&gt;')\n            .replace(/\"/g, '&quot;')\n            .replace(/'/g, '&#39;');\n    }\n\n    // Shadows admin.js's formatBytes for this page, so it keeps that\n    // signature and unit list; the extra guard is for a size the API left\n    // out, which the shared one renders as \"NaN undefined\".\n    function formatBytes(bytes, decimals = 2) {\n        if (!bytes) return '0 Bytes';\n        const k = 1024;\n        const dm = decimals < 0 ? 0 : decimals;\n        const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB', 'PB'];\n        const i = Math.floor(Math.log(bytes) / Math.log(k));\n        return parseFloat((bytes / Math.pow(k, i)).toFixed(dm)) + ' ' + sizes[i];\n    }\n\n    function formatDays(n) {\n        return n + (n === 1 ? ' day' : ' days');\n    }\n\n    // csrfHeaders reads the token the layout stamps into every page\n    // (<meta name=\"csrf-token\">) so mutating lifecycle requests pass it the\n    // same way the newer admin pages (e.g. s3tables) do.\n    function csrfHeaders() {\n        const meta = document.querySelector('meta[name=\"csrf-token\"]');\n        const token = meta ? (meta.getAttribute('content') || '') : '';\n        const headers = { 'Content-Type': 'application/json' };\n        if (token) {\n            headers['X-CSRF-Token'] = token;\n        }\n        return headers;\n    }\n\n    // parseLifecycleResponse reads the body as text before parsing, so a\n    // non-JSON response (a proxy's HTML error page, an empty body, plain\n    // text from some middleware) surfaces the HTTP status instead of\n    // throwing a raw JSON syntax error out of response.json().\n    function parseLifecycleResponse(response) {\n        return response.text().then(text => {\n            let data = {};\n            if (text) {\n                try {\n                    data = JSON.parse(text);\n                } catch (e) {\n                    data = { error: response.statusText || ('HTTP ' + response.status) };\n                }\n            } else if (!response.ok) {\n                data = { error: response.statusText || ('HTTP ' + response.status) };\n            }\n            return { ok: response.ok, data: data };\n        });\n    }\n\n    document.addEventListener('DOMContentLoaded', function() {\n        // Add click handlers to pagination links\n        document.querySelectorAll('.pagination-link').forEach(link => {\n            link.addEventListener('click', function(e) {\n                e.preventDefault();\n                const page = this.getAttribute('data-page');\n                goToPage(page);\n            });\n        });\n\n        // Initialize modal instances once (reuse with show/hide)\n        deleteModalInstance = new bootstrap.Modal(document.getElementById('deleteBucketModal'));\n        quotaModalInstance = new bootstrap.Modal(document.getElementById('manageQuotaModal'));\n        ownerModalInstance = new bootstrap.Modal(document.getElementById('manageOwnerModal'));\n        detailsModalInstance = new bootstrap.Modal(document.getElementById('bucketDetailsModal'));\n        lifecycleModalInstance = new bootstrap.Modal(document.getElementById('bucketLifecycleModal'));\n        policyModalInstance = new bootstrap.Modal(document.getElementById('bucketPolicyModal'));\n\n        const quotaCheckbox = document.getElementById('enableQuota');\n        const quotaSettings = document.getElementById('quotaSettings');\n        const versioningCheckbox = document.getElementById('enableVersioning');\n        const objectLockCheckbox = document.getElementById('enableObjectLock');\n        const objectLockSettings = document.getElementById('objectLockSettings');\n        const setDefaultRetentionCheckbox = document.getElementById('setDefaultRetention');\n        const defaultRetentionSettings = document.getElementById('defaultRetentionSettings');\n        const createBucketForm = document.getElementById('createBucketForm');\n\n        // Toggle quota settings\n        quotaCheckbox.addEventListener('change', function() {\n            quotaSettings.style.display = this.checked ? 'block' : 'none';\n        });\n\n        // Toggle object lock settings and automatically enable versioning\n        objectLockCheckbox.addEventListener('change', function() {\n            objectLockSettings.style.display = this.checked ? 'block' : 'none';\n            if (this.checked) {\n                versioningCheckbox.checked = true;\n                versioningCheckbox.disabled = true;\n            } else {\n                versioningCheckbox.disabled = false;\n                // Reset default retention settings when object lock is disabled\n                setDefaultRetentionCheckbox.checked = false;\n                defaultRetentionSettings.style.display = 'none';\n            }\n        });\n\n        // Toggle default retention settings\n        setDefaultRetentionCheckbox.addEventListener('change', function() {\n            defaultRetentionSettings.style.display = this.checked ? 'block' : 'none';\n        });\n\n        // Populate owner dropdown when create bucket modal opens\n        document.getElementById('createBucketModal').addEventListener('show.bs.modal', async function() {\n            const ownerSelect = document.getElementById('bucketOwner');\n            \n            // Only fetch if not already populated\n            if (ownerSelect.options.length <= 1) {\n                try {\n                    const response = await fetch(basePath('/api/users'));\n                    const data = await response.json();\n                    const users = data.users || [];\n                    \n                    users.forEach(user => {\n                        const option = document.createElement('option');\n                        option.value = user.username;\n                        option.textContent = user.username;\n                        ownerSelect.appendChild(option);\n                    });\n                } catch (error) {\n                    console.error('Error fetching users for owner dropdown:', error);\n                    // Reset to default state on error - user can still create bucket without owner\n                    ownerSelect.innerHTML = '<option value=\"\">No owner (admin-only access)</option>';\n                    ownerSelect.selectedIndex = 0;\n                }\n            }\n        });\n\n        // Handle form submission\n        createBucketForm.addEventListener('submit', function(e) {\n            e.preventDefault();\n            \n            const formData = new FormData(this);\n            const data = {\n                name: formData.get('name'),\n                owner: formData.get('owner') || '',\n                region: formData.get('region') || '',\n                quota_size: quotaCheckbox.checked ? parseInt(formData.get('quota_size')) || 0 : 0,\n                quota_unit: formData.get('quota_unit') || 'MB',\n                quota_enabled: quotaCheckbox.checked,\n                versioning_enabled: versioningCheckbox.checked,\n                object_lock_enabled: objectLockCheckbox.checked,\n                object_lock_mode: formData.get('object_lock_mode') || 'GOVERNANCE',\n                set_default_retention: setDefaultRetentionCheckbox.checked,\n                object_lock_duration: setDefaultRetentionCheckbox.checked ? parseInt(formData.get('object_lock_duration')) || 30 : 0\n            };\n\n            // Validate object lock settings\n            if (data.object_lock_enabled && data.set_default_retention && data.object_lock_duration <= 0) {\n                alert('Please enter a valid retention duration for object lock.');\n                return;\n            }\n\n            fetch(basePath('/api/s3/buckets'), {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error creating bucket: ' + data.error);\n                } else {\n                    alert('Bucket created successfully!');\n                    // Properly close the modal before reloading\n                    const createModal = bootstrap.Modal.getInstance(document.getElementById('createBucketModal'));\n                    if (createModal) {\n                        createModal.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error creating bucket: ' + error.message);\n            });\n        });\n\n        // Handle delete bucket\n        const deleteForm = document.getElementById('deleteBucketModal');\n        document.querySelectorAll('.delete-bucket-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n                document.getElementById('deleteBucketName').textContent = bucketName;\n                // Store bucket name on modal element instead of global window property\n                deleteForm.dataset.bucketName = bucketName;\n                deleteModalInstance.show();\n            });\n        });\n\n        // Handle quota management\n        const quotaForm = document.getElementById('quotaForm');\n        document.querySelectorAll('.quota-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n                const currentQuota = parseInt(this.dataset.currentQuota);\n                const quotaEnabled = this.dataset.quotaEnabled === 'true';\n                \n                document.getElementById('quotaBucketName').value = bucketName;\n                document.getElementById('quotaEnabled').checked = quotaEnabled;\n                document.getElementById('quotaSizeMB').value = currentQuota;\n                \n                // Toggle quota size settings\n                document.getElementById('quotaSizeSettings').style.display = quotaEnabled ? 'block' : 'none';\n                \n                // Store bucket name on form element instead of global window property\n                quotaForm.dataset.bucketName = bucketName;\n                quotaModalInstance.show();\n            });\n        });\n\n        // Add event listener to properly dispose of quota modal when hidden\n        document.getElementById('manageQuotaModal').addEventListener('hidden.bs.modal', function() {\n            if (quotaModalInstance) {\n                quotaModalInstance.dispose();\n                quotaModalInstance = null;\n            }\n            // Force remove any remaining backdrops\n            document.querySelectorAll('.modal-backdrop').forEach(backdrop => {\n                backdrop.remove();\n            });\n            // Ensure body classes are removed\n            document.body.classList.remove('modal-open');\n            document.body.style.removeProperty('padding-right');\n        });\n\n        // Handle quota form submission\n        document.getElementById('quotaForm').addEventListener('submit', function(e) {\n            e.preventDefault();\n            \n            const bucketName = this.dataset.bucketName;\n            if (!bucketName) return;\n\n            const formData = new FormData(this);\n            const enabled = document.getElementById('quotaEnabled').checked;\n            const data = {\n                quota_size: enabled ? parseInt(formData.get('quota_size')) || 0 : 0,\n                quota_unit: formData.get('quota_unit') || 'MB',\n                quota_enabled: enabled\n            };\n\n            fetch(basePath(`/api/s3/buckets/${bucketName}/quota`), {\n                method: 'PUT',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error updating quota: ' + data.error);\n                } else {\n                    alert('Quota updated successfully!');\n                    // Properly close the modal before reloading\n                    if (quotaModalInstance) {\n                        quotaModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error updating quota: ' + error.message);\n            });\n        });\n\n        // Handle quota enabled checkbox\n        document.getElementById('quotaEnabled').addEventListener('change', function() {\n            document.getElementById('quotaSizeSettings').style.display = this.checked ? 'block' : 'none';\n        });\n\n        // Handle owner management\n        const ownerForm = document.getElementById('ownerForm');\n        document.querySelectorAll('.owner-btn').forEach(button => {\n            button.addEventListener('click', async function() {\n                const bucketName = this.dataset.bucketName;\n                const currentOwner = this.dataset.currentOwner || '';\n                \n                document.getElementById('ownerBucketName').value = bucketName;\n                // Store bucket name on form element instead of global window property\n                ownerForm.dataset.bucketName = bucketName;\n                \n                // Show loading spinner\n                document.getElementById('ownerLoadingSpinner').style.display = 'block';\n                document.getElementById('bucketOwnerSelect').disabled = true;\n                \n                ownerModalInstance.show();\n                \n                // Fetch users if not cached\n                try {\n                    if (!cachedUsers) {\n                        const response = await fetch(basePath('/api/users'));\n                        const data = await response.json();\n                        cachedUsers = data.users || [];\n                    }\n                    \n                    // Populate the select dropdown\n                    const select = document.getElementById('bucketOwnerSelect');\n                    select.innerHTML = '<option value=\"\">No owner (admin-only access)</option>';\n                    \n                    cachedUsers.forEach(user => {\n                        const option = document.createElement('option');\n                        option.value = user.username;\n                        option.textContent = user.username;\n                        if (user.username === currentOwner) {\n                            option.selected = true;\n                        }\n                        select.appendChild(option);\n                    });\n                    \n                    select.disabled = false;\n                } catch (error) {\n                    console.error('Error fetching users:', error);\n                    alert('Error loading users: ' + error.message);\n                    // Re-enable select and reset to default on error\n                    const select = document.getElementById('bucketOwnerSelect');\n                    select.innerHTML = '<option value=\"\">No owner (admin-only access)</option>';\n                    select.selectedIndex = 0;\n                    select.disabled = false;\n                } finally {\n                    document.getElementById('ownerLoadingSpinner').style.display = 'none';\n                }\n            });\n        });\n\n        // Handle owner form submission\n        document.getElementById('ownerForm').addEventListener('submit', function(e) {\n            e.preventDefault();\n            \n            const bucketName = this.dataset.bucketName;\n            if (!bucketName) return;\n\n            const owner = document.getElementById('bucketOwnerSelect').value;\n            const data = { owner: owner };\n\n            fetch(basePath(`/api/s3/buckets/${bucketName}/owner`), {\n                method: 'PUT',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error updating owner: ' + data.error);\n                } else {\n                    alert('Bucket owner updated successfully!');\n                    // Properly close the modal before reloading\n                    if (ownerModalInstance) {\n                        ownerModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error updating owner: ' + error.message);\n            });\n        });\n\n        // Handle view details button\n        document.querySelectorAll('.view-details-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n                \n                // Update modal title\n                document.getElementById('bucketDetailsModalLabel').innerHTML = \n                    '<i class=\"bi bi-box me-2\"></i>Bucket Details - ' + bucketName;\n                \n                // Show loading spinner\n                document.getElementById('bucketDetailsContent').innerHTML = \n                    '<div class=\"text-center py-4\">' +\n                    '<div class=\"spinner-border text-primary\" role=\"status\">' +\n                    '<span class=\"visually-hidden\">Loading...</span>' +\n                    '<\\\\/div>' +\n                    '<div class=\"mt-2\">Loading bucket details...</div>' +\n                    '<\\\\/div>';\n                \n                detailsModalInstance.show();\n                \n                // Fetch bucket details\n                fetch(basePath('/api/s3/buckets/' + bucketName))\n                    .then(response => response.json())\n                    .then(data => {\n                        if (data.error) {\n                            document.getElementById('bucketDetailsContent').innerHTML = \n                                '<div class=\"alert alert-danger\">' +\n                                '<i class=\"bi bi-exclamation-triangle me-2\"></i>' +\n                                'Error loading bucket details: ' + data.error +\n                                '<\\\\/div>';\n                        } else {\n                            displayBucketDetails(data);\n                        }\n                    })\n                    .catch(error => {\n                        console.error('Error fetching bucket details:', error);\n                        document.getElementById('bucketDetailsContent').innerHTML = \n                            '<div class=\"alert alert-danger\">' +\n                            '<i class=\"bi bi-exclamation-triangle me-2\"></i>' +\n                            'Error loading bucket details: ' + error.message +\n                            '<\\\\/div>';\n                    });\n            });\n        });\n\n        // Lifecycle buttons: column badge and action button\n        document.querySelectorAll('.lifecycle-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n\n                // Reset the working copy until the GET below repopulates it,\n                // so Save/Delete-all can't act on the previous bucket's rules.\n                lifecycleEditor = { bucket: null, rules: [], editingIndex: null, editingRule: null, rawXml: '', hasTransition: false };\n\n                document.getElementById('bucketLifecycleModalLabel').innerHTML =\n                    '<i class=\"bi bi-recycle me-2\"></i>Lifecycle - ' + bucketName;\n\n                document.getElementById('bucketLifecycleContent').innerHTML =\n                    '<div class=\"text-center py-4\">' +\n                    '<div class=\"spinner-border text-primary\" role=\"status\">' +\n                    '<span class=\"visually-hidden\">Loading...</span>' +\n                    '<\\/div>' +\n                    '<div class=\"mt-2\">Loading lifecycle rules...</div>' +\n                    '<\\/div>';\n\n                lifecycleModalInstance.show();\n\n                // Drop responses that arrive after another bucket was opened\n                const requestSeq = ++lifecycleRequestSeq;\n                fetch(basePath('/api/s3/buckets/' + bucketName + '/lifecycle'))\n                    .then(parseLifecycleResponse)\n                    .then(({ ok, data }) => {\n                        if (requestSeq !== lifecycleRequestSeq) return;\n                        if (!ok || data.error) {\n                            document.getElementById('bucketLifecycleContent').innerHTML =\n                                '<div class=\"alert alert-danger\">' +\n                                '<i class=\"bi bi-exclamation-triangle me-2\"></i>' +\n                                'Error loading lifecycle rules: ' + (data.error || 'unknown error') +\n                                '<\\/div>';\n                        } else {\n                            displayBucketLifecycle(data);\n                        }\n                    })\n                    .catch(error => {\n                        if (requestSeq !== lifecycleRequestSeq) return;\n                        console.error('Error fetching bucket lifecycle:', error);\n                        document.getElementById('bucketLifecycleContent').innerHTML =\n                            '<div class=\"alert alert-danger\">' +\n                            '<i class=\"bi bi-exclamation-triangle me-2\"></i>' +\n                            'Error loading lifecycle rules: ' + error.message +\n                            '<\\/div>';\n                    });\n            });\n        });\n\n        // Save the whole working rule set back to the bucket.\n        document.getElementById('lifecycleSaveAllBtn').addEventListener('click', function() {\n            if (!lifecycleEditor.bucket) return;\n            // Fold in any rule the user is still editing so Save doesn't\n            // silently discard it; abort if that form isn't valid yet.\n            if (!commitOpenLifecycleRuleForm()) return;\n            // An empty list clears the configuration, same as Delete all rules,\n            // so it gets the same prompt.\n            if (lifecycleEditor.rules.length === 0 &&\n                !confirm('No rules left: saving removes the lifecycle configuration for ' + lifecycleEditor.bucket + '. This cannot be undone.')) {\n                return;\n            }\n\n            fetch(basePath('/api/s3/buckets/' + lifecycleEditor.bucket + '/lifecycle'), {\n                method: 'PUT',\n                headers: csrfHeaders(),\n                body: JSON.stringify({ rules: lifecycleEditor.rules })\n            })\n                .then(parseLifecycleResponse)\n                .then(({ ok, data }) => {\n                    if (!ok || data.error) {\n                        alert('Error saving lifecycle rules: ' + (data.error || 'unknown error'));\n                        return;\n                    }\n                    if (lifecycleModalInstance) {\n                        lifecycleModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                })\n                .catch(error => {\n                    console.error('Error:', error);\n                    alert('Error saving lifecycle rules: ' + error.message);\n                });\n        });\n\n        // Clear the lifecycle configuration entirely.\n        document.getElementById('lifecycleDeleteAllBtn').addEventListener('click', function() {\n            if (!lifecycleEditor.bucket) return;\n            if (!confirm('Delete all lifecycle rules for ' + lifecycleEditor.bucket + '? This cannot be undone.')) return;\n\n            fetch(basePath('/api/s3/buckets/' + lifecycleEditor.bucket + '/lifecycle'), {\n                method: 'DELETE',\n                headers: csrfHeaders()\n            })\n                .then(parseLifecycleResponse)\n                .then(({ ok, data }) => {\n                    if (!ok || data.error) {\n                        alert('Error deleting lifecycle rules: ' + (data.error || 'unknown error'));\n                        return;\n                    }\n                    if (lifecycleModalInstance) {\n                        lifecycleModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                })\n                .catch(error => {\n                    console.error('Error:', error);\n                    alert('Error deleting lifecycle rules: ' + error.message);\n                });\n        });\n\n        // Policy buttons: column badge and action button. The visual editor\n        // (weed/admin/static/js/policy_editor.js) is set up once per page\n        // load; registerPolicyEditor is re-called on every open so the\n        // resource-ARN autocomplete and default Principal stay pinned to\n        // whichever bucket is currently open.\n        let bucketPolicyEditorSetUp = false;\n        document.getElementById('bucketPolicyInsertSampleBtn').addEventListener('click', function() {\n            if (!policyEditorBucket) return;\n            insertSamplePolicy('bucket', {\n                Version: '2012-10-17',\n                Statement: [{\n                    Effect: 'Allow',\n                    Principal: '*',\n                    Action: ['s3:GetObject'],\n                    Resource: ['arn:aws:s3:::' + policyEditorBucket + '/*']\n                }]\n            });\n        });\n\n        document.querySelectorAll('.policy-btn').forEach(button => {\n            button.addEventListener('click', function() {\n                const bucketName = this.dataset.bucketName;\n                policyEditorBucket = bucketName;\n                bucketPolicyLoaded = false;\n                // Deliberately not resetting bucketPolicyMutationInFlight\n                // here: if a Save/Delete for a previously open bucket is\n                // still in flight, Save/Delete for this bucket must stay\n                // blocked until that request settles (its own completion\n                // handler releases the flag once done, whether or not it's\n                // still the active bucket by then) - otherwise this bucket's\n                // mutation could race the abandoned one.\n                registerPolicyEditor('bucket', { requirePrincipal: true, bucket: bucketName });\n                if (!bucketPolicyEditorSetUp) {\n                    setupPolicyEditor('bucket');\n                    bucketPolicyEditorSetUp = true;\n                }\n\n                document.getElementById('bucketPolicyModalLabel').innerHTML =\n                    '<i class=\"bi bi-file-earmark-lock me-2\"></i>Bucket Policy - ' + escapeHtml(bucketName);\n                document.getElementById('bucketPolicyLoading').style.display = '';\n                document.getElementById('bucketPolicyError').style.display = 'none';\n                document.getElementById('bucketPolicyEditorWrapper').style.display = 'none';\n\n                policyModalInstance.show();\n\n                // Drop responses that arrive after another bucket was opened\n                const requestSeq = ++policyRequestSeq;\n                fetch(basePath('/api/s3/buckets/' + encodeURIComponent(bucketName) + '/policy'))\n                    .then(parseLifecycleResponse)\n                    .then(({ ok, data }) => {\n                        if (requestSeq !== policyRequestSeq) return;\n                        document.getElementById('bucketPolicyLoading').style.display = 'none';\n                        if (!ok || data.error) {\n                            document.getElementById('bucketPolicyError').textContent =\n                                'Error loading bucket policy: ' + (data.error || 'unknown error');\n                            document.getElementById('bucketPolicyError').style.display = '';\n                            return;\n                        }\n                        document.getElementById('bucketPolicyEditorWrapper').style.display = '';\n                        // policy_text carries stored bytes the server-side\n                        // decoder rejects; the JSON tab shows them so they\n                        // can be fixed or deleted.\n                        document.getElementById('bucketPolicyDocument').value =\n                            data.policy ? JSON.stringify(data.policy, null, 2) : (data.policy_text || '');\n                        bucketPolicyLoaded = true;\n                        loadPolicyTextareaIntoEditor('bucket');\n                    })\n                    .catch(error => {\n                        if (requestSeq !== policyRequestSeq) return;\n                        console.error('Error fetching bucket policy:', error);\n                        document.getElementById('bucketPolicyLoading').style.display = 'none';\n                        document.getElementById('bucketPolicyError').textContent =\n                            'Error loading bucket policy: ' + error.message;\n                        document.getElementById('bucketPolicyError').style.display = '';\n                    });\n            });\n        });\n\n        // Save the policy document currently shown (whichever tab is active).\n        document.getElementById('bucketPolicySaveBtn').addEventListener('click', function() {\n            if (!policyEditorBucket) return;\n            if (bucketPolicyMutationInFlight) return;\n            if (!bucketPolicyLoaded) {\n                alert('The current policy has not finished loading. Close and reopen this dialog before saving.');\n                return;\n            }\n\n            // Commit first: if the Editor tab is active, the textarea still\n            // holds whatever was there at load time until this runs, so a\n            // policy entered purely through the structured form (no tab\n            // switch) would otherwise read back as empty here.\n            if (!commitPolicyActiveTab('bucket')) return;\n\n            const raw = document.getElementById('bucketPolicyDocument').value.trim();\n            if (!raw || !policyTextHasStatements(raw)) {\n                alert('Add at least one statement, or use Delete to remove the bucket policy.');\n                return;\n            }\n\n            let policy;\n            try {\n                policy = JSON.parse(document.getElementById('bucketPolicyDocument').value);\n            } catch (e) {\n                alert('Invalid JSON: ' + e.message);\n                return;\n            }\n            const validationError = validatePolicyEditorDoc('bucket', policy);\n            if (validationError) {\n                alert(validationError);\n                return;\n            }\n            // The admin API decodes only Version and Statement, so warn\n            // before other top-level fields are silently dropped - the IAM\n            // policies page already does. (The S3 Tables dialogs don't:\n            // their backend stores the document verbatim.)\n            if (!confirmPolicyFieldDiscard('bucket')) return;\n\n            // Captured now: if the dialog moves on to a different bucket\n            // before this PUT resolves, the completion below must not hide\n            // or reload over whatever that other bucket is now showing.\n            const targetBucket = policyEditorBucket;\n            setBucketPolicyMutationInFlight(true);\n            fetch(basePath('/api/s3/buckets/' + encodeURIComponent(targetBucket) + '/policy'), {\n                method: 'PUT',\n                headers: csrfHeaders(),\n                body: JSON.stringify({ policy: policy })\n            })\n                .then(parseLifecycleResponse)\n                .then(({ ok, data }) => {\n                    setBucketPolicyMutationInFlight(false);\n                    const stillCurrent = targetBucket === policyEditorBucket;\n                    if (!ok || data.error) {\n                        if (stillCurrent) {\n                            alert('Error saving bucket policy: ' + (data.error || 'unknown error'));\n                        } else {\n                            console.error('Error saving policy for ' + targetBucket + ' (no longer the open bucket): ' + (data.error || 'unknown error'));\n                        }\n                        return;\n                    }\n                    if (!stillCurrent) return;\n                    if (policyModalInstance) {\n                        policyModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                })\n                .catch(error => {\n                    setBucketPolicyMutationInFlight(false);\n                    console.error('Error:', error);\n                    if (targetBucket === policyEditorBucket) {\n                        alert('Error saving bucket policy: ' + error.message);\n                    }\n                });\n        });\n\n        // Clear the bucket policy entirely.\n        document.getElementById('bucketPolicyDeleteBtn').addEventListener('click', function() {\n            if (!policyEditorBucket) return;\n            if (bucketPolicyMutationInFlight) return;\n            if (!bucketPolicyLoaded) {\n                alert('The current policy has not finished loading. Close and reopen this dialog before deleting.');\n                return;\n            }\n            if (!confirm('Delete the bucket policy for ' + policyEditorBucket + '? This cannot be undone.')) return;\n\n            // Captured now: if the dialog moves on to a different bucket\n            // before this DELETE resolves, the completion below must not\n            // hide or reload over whatever that other bucket is now showing.\n            const targetBucket = policyEditorBucket;\n            setBucketPolicyMutationInFlight(true);\n            fetch(basePath('/api/s3/buckets/' + encodeURIComponent(targetBucket) + '/policy'), {\n                method: 'DELETE',\n                headers: csrfHeaders()\n            })\n                .then(parseLifecycleResponse)\n                .then(({ ok, data }) => {\n                    setBucketPolicyMutationInFlight(false);\n                    const stillCurrent = targetBucket === policyEditorBucket;\n                    if (!ok || data.error) {\n                        if (stillCurrent) {\n                            alert('Error deleting bucket policy: ' + (data.error || 'unknown error'));\n                        } else {\n                            console.error('Error deleting policy for ' + targetBucket + ' (no longer the open bucket): ' + (data.error || 'unknown error'));\n                        }\n                        return;\n                    }\n                    if (!stillCurrent) return;\n                    if (policyModalInstance) {\n                        policyModalInstance.hide();\n                    }\n                    setTimeout(() => location.reload(), 500);\n                })\n                .catch(error => {\n                    setBucketPolicyMutationInFlight(false);\n                    console.error('Error:', error);\n                    if (targetBucket === policyEditorBucket) {\n                        alert('Error deleting bucket policy: ' + error.message);\n                    }\n                });\n        });\n    });\n\n    function deleteBucket() {\n        const bucketName = document.getElementById('deleteBucketModal').dataset.bucketName;\n        if (!bucketName) return;\n\n        fetch(basePath(`/api/s3/buckets/${bucketName}`), {\n            method: 'DELETE'\n        })\n        .then(response => response.json())\n        .then(data => {\n            if (data.error) {\n                alert('Error deleting bucket: ' + data.error);\n            } else {\n                alert('Bucket deleted successfully!');\n                // Properly close the modal before reloading\n                if (deleteModalInstance) {\n                    deleteModalInstance.hide();\n                }\n                setTimeout(() => location.reload(), 500);\n            }\n        })\n        .catch(error => {\n            console.error('Error:', error);\n            alert('Error deleting bucket: ' + error.message);\n        });\n    }\n\nfunction displayBucketDetails(data) {\n    const bucket = data.bucket;\n\n    function formatDate(dateString) {\n        const date = new Date(dateString);\n        return date.toLocaleString();\n    }\n\n    let ownerHtml = '<span class=\"text-muted\">No owner (admin-only)</span>';\n    if (bucket.owner) {\n        ownerHtml = '<span class=\"badge bg-info\"><i class=\"bi bi-person me-1\"></i>' + escapeHtml(bucket.owner) + '</span>';\n    }\n\n    let usageHtml = '';\n    if (bucket.physical_size > 0 && bucket.logical_size > 0 && bucket.physical_size > bucket.logical_size) {\n        const overhead = (bucket.physical_size / bucket.logical_size).toFixed(1);\n        usageHtml = '<br><small class=\"text-muted\">' + overhead + 'x overhead<\\/small>';\n    }\n\n    let quotaHtml = '<span class=\"badge bg-secondary\">Disabled</span>';\n    if (bucket.quota_enabled) {\n        quotaHtml = '<span class=\"badge bg-success\">' + formatBytes(bucket.quota) + '</span>';\n    }\n\n    let versioningHtml = '<span class=\"text-muted\">Not configured</span>';\n    if (bucket.versioning_status === 'Enabled') {\n        versioningHtml = '<span class=\"badge bg-success\"><i class=\"bi bi-check me-1\"></i>Enabled</span>';\n    } else if (bucket.versioning_status === 'Suspended') {\n        versioningHtml = '<span class=\"badge bg-warning\"><i class=\"bi bi-pause me-1\"></i>Suspended</span>';\n    }\n\n    let statusHtml = '<span class=\"badge bg-success\">Writable</span>';\n    if (bucket.read_only) {\n        statusHtml = '<span class=\"badge bg-danger\"><i class=\"bi bi-lock me-1\"></i>Read-only</span>';\n    }\n\n    let objectLockHtml = '<span class=\"text-muted\">Not configured</span>';\n    if (bucket.object_lock_enabled) {\n        let details = '';\n        if (bucket.object_lock_mode && bucket.object_lock_duration > 0) {\n            details = '<br><small class=\"text-muted\">' + escapeHtml(bucket.object_lock_mode) + ' • ' + bucket.object_lock_duration + ' days<\\/small>';\n        }\n        objectLockHtml = '<span class=\"badge bg-warning\"><i class=\"bi bi-lock me-1\"></i>Enabled</span>' + details;\n    }\n\n    let policyHtml = '<span class=\"text-muted\">Not configured</span>';\n    if (bucket.policy_statement_count > 0) {\n        const label = bucket.policy_statement_count === 1 ? '1 statement' : bucket.policy_statement_count + ' statements';\n        policyHtml = '<span class=\"badge bg-primary\">' + label + '<\\/span>';\n    }\n\n    const rows = [\n        '<div class=\"row\">',\n        '<div class=\"col-md-6\">',\n        '<h6><i class=\"bi bi-info-circle me-2\"></i>Bucket Information</h6>',\n        '<table class=\"table table-sm\">',\n        '<tr><td><strong>Name:</strong></td><td>' + escapeHtml(bucket.name) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Owner:</strong></td><td>' + ownerHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Created:</strong></td><td>' + formatDate(bucket.created_at) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Last Modified:</strong></td><td>' + formatDate(bucket.last_modified) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Logical Size:</strong></td><td>' + formatBytes(bucket.logical_size) + '<\\/td><\\/tr>',\n        '<tr><td><strong>Physical Size:</strong></td><td>' + formatBytes(bucket.physical_size) + usageHtml + '<\\/td><\\/tr>',\n        '<\\/table>',\n        '<\\/div>',\n        '<div class=\"col-md-6\">',\n        '<h6><i class=\"bi bi-gear-wide-connected me-2\"></i>Configuration</h6>',\n        '<table class=\"table table-sm\">',\n        '<tr><td><strong>Status:</strong></td><td>' + statusHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Quota:</strong></td><td>' + quotaHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Versioning:</strong></td><td>' + versioningHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Object Lock:</strong></td><td>' + objectLockHtml + '<\\/td><\\/tr>',\n        '<tr><td><strong>Policy:</strong></td><td>' + policyHtml + '<\\/td><\\/tr>',\n        '<\\/table>',\n        '<\\/div>',\n        '<\\/div>'\n    ];\n\n    document.getElementById('bucketDetailsContent').innerHTML = rows.join('');\n}\n\n// displayBucketLifecycle loads the GET response into the local working copy\n// and renders the editor. Nothing is sent back to the server until Save or\n// Delete all rules is clicked.\nfunction displayBucketLifecycle(data) {\n    lifecycleEditor.bucket = data.bucket || lifecycleEditor.bucket;\n    lifecycleEditor.rules = (data.rules || []).map(cloneLifecycleRule);\n    lifecycleEditor.editingIndex = null;\n    lifecycleEditor.editingRule = null;\n    lifecycleEditor.rawXml = data.xml || '';\n    // SeaweedFS doesn't support Transition rules (PutBucketLifecycleConfiguration\n    // rejects them for Enabled rules), and the canonical rule shape the admin\n    // edits has no field for one, so a Transition set by another client would\n    // silently disappear on the next Save. Warn instead.\n    // Matches <Transition> and <NoncurrentVersionTransition> however they are\n    // spelled: with attributes, self-closed, or namespace-prefixed.\n    lifecycleEditor.hasTransition = /<(\\w+:)?(NoncurrentVersion)?Transition[\\s>\\/]/.test(data.xml || '');\n    renderLifecycleEditor();\n}\n\n// normalizeLifecycleStatus maps a stored status onto the two the editor can\n// show. The S3 API stores <Status> unvalidated, and the engine runs a rule\n// only on an exact \"Enabled\", so everything else is Disabled - collapsing it\n// here keeps an odd spelling from leaving both radios unchecked, which would\n// throw out of readLifecycleRuleFromForm and make the modal look dead.\nfunction normalizeLifecycleStatus(status) {\n    return status === 'Enabled' ? 'Enabled' : 'Disabled';\n}\n\nfunction cloneLifecycleRule(r) {\n    return {\n        id: r.id || '',\n        status: normalizeLifecycleStatus(r.status),\n        prefix: r.prefix || '',\n        tags: Object.assign({}, r.tags || {}),\n        size_greater_than: r.size_greater_than || null,\n        size_less_than: r.size_less_than || null,\n        expiration_days: r.expiration_days || null,\n        expiration_date: r.expiration_date || '',\n        expired_object_delete_marker: !!r.expired_object_delete_marker,\n        noncurrent_version_expiration_days: r.noncurrent_version_expiration_days || null,\n        newer_noncurrent_versions: r.newer_noncurrent_versions || null,\n        abort_multipart_days: r.abort_multipart_days || null,\n    };\n}\n\nfunction blankLifecycleRule() {\n    return {\n        id: '', status: 'Enabled', prefix: '', tags: {},\n        size_greater_than: null, size_less_than: null,\n        expiration_days: null, expiration_date: '',\n        expired_object_delete_marker: false,\n        noncurrent_version_expiration_days: null, newer_noncurrent_versions: null,\n        abort_multipart_days: null,\n    };\n}\n\nfunction describeLifecycleScope(rule) {\n    const parts = [];\n    if (rule.prefix) {\n        parts.push('<code>' + escapeHtml(rule.prefix) + '<\\/code>');\n    }\n    Object.entries(rule.tags || {}).forEach(([k, v]) => {\n        parts.push('<span class=\"badge bg-light text-dark border\">' + escapeHtml(k) + '=' + escapeHtml(v) + '<\\/span>');\n    });\n    if (rule.size_greater_than) {\n        parts.push('size &gt; ' + formatBytes(rule.size_greater_than));\n    }\n    if (rule.size_less_than) {\n        parts.push('size &lt; ' + formatBytes(rule.size_less_than));\n    }\n    return parts.length ? parts.join(' ') : '<span class=\"text-muted\">Whole bucket<\\/span>';\n}\n\nfunction describeLifecycleActions(rule) {\n    const actions = [];\n    if (rule.expiration_days) {\n        actions.push('Expire after ' + formatDays(rule.expiration_days));\n    }\n    if (rule.expiration_date) {\n        actions.push('Expire on ' + escapeHtml(rule.expiration_date));\n    }\n    if (rule.expired_object_delete_marker) {\n        actions.push('Remove expired object delete markers');\n    }\n    if (rule.noncurrent_version_expiration_days) {\n        let action = 'Expire noncurrent versions after ' + formatDays(rule.noncurrent_version_expiration_days);\n        if (rule.newer_noncurrent_versions) {\n            action += ', keep ' + rule.newer_noncurrent_versions + ' newest';\n        }\n        actions.push(action);\n    } else if (rule.newer_noncurrent_versions) {\n        // Standalone (no expiration_days): the engine still recognizes this\n        // as an action that expires noncurrent versions beyond the N newest.\n        actions.push('Keep ' + rule.newer_noncurrent_versions + ' newest noncurrent versions');\n    }\n    if (rule.abort_multipart_days) {\n        actions.push('Abort incomplete multipart uploads after ' + formatDays(rule.abort_multipart_days));\n    }\n    if (actions.length === 0) {\n        return '<span class=\"text-muted\">None<\\/span>';\n    }\n    return actions.join('<br>');\n}\n\nfunction lifecycleRuleRowHtml(rule, idx) {\n    const statusHtml = rule.status === 'Enabled'\n        ? '<span class=\"badge bg-success\">Enabled<\\/span>'\n        : '<span class=\"badge bg-secondary\">' + escapeHtml(rule.status) + '<\\/span>';\n    return '<tr>' +\n        '<td>' + (rule.id ? escapeHtml(rule.id) : '<span class=\"text-muted\">unnamed<\\/span>') + '<\\/td>' +\n        '<td>' + statusHtml + '<\\/td>' +\n        '<td>' + describeLifecycleScope(rule) + '<\\/td>' +\n        '<td>' + describeLifecycleActions(rule) + '<\\/td>' +\n        '<td class=\"text-end text-nowrap\">' +\n        '<button type=\"button\" class=\"btn btn-sm btn-outline-secondary lifecycle-edit-rule-btn\" data-index=\"' + idx + '\" title=\"Edit rule\"><i class=\"bi bi-pen\"><\\/i><\\/button> ' +\n        '<button type=\"button\" class=\"btn btn-sm btn-outline-danger lifecycle-delete-rule-btn\" data-index=\"' + idx + '\" title=\"Delete rule\"><i class=\"bi bi-trash\"><\\/i><\\/button>' +\n        '<\\/td>' +\n        '<\\/tr>';\n}\n\nfunction lifecycleRuleFormHtml() {\n    const rule = lifecycleEditor.editingRule;\n    const tagRowHtml = (k, v) =>\n        '<div class=\"input-group input-group-sm mb-1 lifecycle-tag-row\">' +\n        '<input type=\"text\" class=\"form-control lifecycle-tag-key\" placeholder=\"Key\" value=\"' + escapeHtml(k) + '\">' +\n        '<input type=\"text\" class=\"form-control lifecycle-tag-value\" placeholder=\"Value\" value=\"' + escapeHtml(v) + '\">' +\n        '<button type=\"button\" class=\"btn btn-outline-danger lifecycle-remove-tag-btn\"><i class=\"bi bi-x\"><\\/i><\\/button>' +\n        '<\\/div>';\n    const tagRows = Object.entries(rule.tags || {}).map(([k, v]) => tagRowHtml(k, v)).join('');\n\n    return '' +\n        '<div class=\"card mb-3\" id=\"lifecycleRuleForm\">' +\n        '<div class=\"card-body\">' +\n        '<h6 class=\"card-title\">' + (lifecycleEditor.editingIndex === 'new' ? 'Add rule' : 'Edit rule') + '<\\/h6>' +\n\n        '<div class=\"row g-2 mb-2\">' +\n        '<div class=\"col-md-6\">' +\n        '<label class=\"form-label small\">ID (optional)<\\/label>' +\n        '<input type=\"text\" class=\"form-control form-control-sm\" id=\"lifecycleRuleId\" value=\"' + escapeHtml(rule.id) + '\">' +\n        '<\\/div>' +\n        '<div class=\"col-md-6\">' +\n        '<label class=\"form-label small d-block\">Status<\\/label>' +\n        '<div class=\"form-check form-check-inline\">' +\n        '<input class=\"form-check-input\" type=\"radio\" name=\"lifecycleRuleStatus\" id=\"lifecycleStatusEnabled\" value=\"Enabled\"' + (rule.status === 'Enabled' ? ' checked' : '') + '>' +\n        '<label class=\"form-check-label\" for=\"lifecycleStatusEnabled\">Enabled<\\/label>' +\n        '<\\/div>' +\n        '<div class=\"form-check form-check-inline\">' +\n        '<input class=\"form-check-input\" type=\"radio\" name=\"lifecycleRuleStatus\" id=\"lifecycleStatusDisabled\" value=\"Disabled\"' + (rule.status === 'Disabled' ? ' checked' : '') + '>' +\n        '<label class=\"form-check-label\" for=\"lifecycleStatusDisabled\">Disabled<\\/label>' +\n        '<\\/div>' +\n        '<\\/div>' +\n        '<\\/div>' +\n\n        '<div class=\"mb-2\">' +\n        '<label class=\"form-label small\">Prefix<\\/label>' +\n        '<input type=\"text\" class=\"form-control form-control-sm\" id=\"lifecycleRulePrefix\" placeholder=\"logs/\" value=\"' + escapeHtml(rule.prefix) + '\">' +\n        '<\\/div>' +\n\n        '<div class=\"mb-2\">' +\n        '<label class=\"form-label small d-block\">Tags<\\/label>' +\n        '<div id=\"lifecycleTagRows\">' + tagRows + '<\\/div>' +\n        '<button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"lifecycleAddTagBtn\"><i class=\"bi bi-plus me-1\"><\\/i>Add tag<\\/button>' +\n        '<\\/div>' +\n\n        '<div class=\"row g-2 mb-3\">' +\n        '<div class=\"col-md-6\">' +\n        '<label class=\"form-label small\">Size greater than (bytes)<\\/label>' +\n        '<input type=\"number\" class=\"form-control form-control-sm\" id=\"lifecycleRuleSizeGT\" min=\"0\" step=\"1\" value=\"' + (rule.size_greater_than || '') + '\">' +\n        '<\\/div>' +\n        '<div class=\"col-md-6\">' +\n        '<label class=\"form-label small\">Size less than (bytes)<\\/label>' +\n        '<input type=\"number\" class=\"form-control form-control-sm\" id=\"lifecycleRuleSizeLT\" min=\"0\" step=\"1\" value=\"' + (rule.size_less_than || '') + '\">' +\n        '<\\/div>' +\n        '<\\/div>' +\n\n        '<hr>' +\n        '<h6 class=\"small text-muted text-uppercase\">Actions<\\/h6>' +\n\n        '<div class=\"row g-2 align-items-center mb-2\">' +\n        '<div class=\"col-auto\">' +\n        '<div class=\"form-check\">' +\n        '<input class=\"form-check-input\" type=\"checkbox\" id=\"lifecycleExpireDaysEnabled\"' + (rule.expiration_days ? ' checked' : '') + '>' +\n        '<label class=\"form-check-label\" for=\"lifecycleExpireDaysEnabled\">Expire after<\\/label>' +\n        '<\\/div>' +\n        '<\\/div>' +\n        '<div class=\"col-auto\">' +\n        '<input type=\"number\" class=\"form-control form-control-sm\" id=\"lifecycleExpireDays\" min=\"1\" step=\"1\" style=\"width: 6rem;\" value=\"' + (rule.expiration_days || '') + '\"' + (rule.expiration_days ? '' : ' disabled') + '>' +\n        '<\\/div><div class=\"col-auto\">days<\\/div>' +\n        '<\\/div>' +\n\n        '<div class=\"row g-2 align-items-center mb-2\">' +\n        '<div class=\"col-auto\">' +\n        '<div class=\"form-check\">' +\n        '<input class=\"form-check-input\" type=\"checkbox\" id=\"lifecycleExpireDateEnabled\"' + (rule.expiration_date ? ' checked' : '') + '>' +\n        '<label class=\"form-check-label\" for=\"lifecycleExpireDateEnabled\">Expire on date<\\/label>' +\n        '<\\/div>' +\n        '<\\/div>' +\n        '<div class=\"col-auto\">' +\n        '<input type=\"date\" class=\"form-control form-control-sm\" id=\"lifecycleExpireDate\" value=\"' + escapeHtml(rule.expiration_date) + '\"' + (rule.expiration_date ? '' : ' disabled') + '>' +\n        '<\\/div>' +\n        '<\\/div>' +\n\n        '<div class=\"form-check mb-2\">' +\n        '<input class=\"form-check-input\" type=\"checkbox\" id=\"lifecycleDeleteMarker\"' + (rule.expired_object_delete_marker ? ' checked' : '') + '>' +\n        '<label class=\"form-check-label\" for=\"lifecycleDeleteMarker\">Remove expired object delete markers<\\/label>' +\n        '<\\/div>' +\n\n        (() => {\n            const noncurrentActive = !!(rule.noncurrent_version_expiration_days || rule.newer_noncurrent_versions);\n            return '<div class=\"row g-2 align-items-center mb-2\">' +\n            '<div class=\"col-auto\">' +\n            '<div class=\"form-check\">' +\n            '<input class=\"form-check-input\" type=\"checkbox\" id=\"lifecycleNoncurrentEnabled\"' + (noncurrentActive ? ' checked' : '') + '>' +\n            '<label class=\"form-check-label\" for=\"lifecycleNoncurrentEnabled\">Limit noncurrent versions<\\/label>' +\n            '<\\/div>' +\n            '<\\/div>' +\n            '<div class=\"col-auto\">after<\\/div>' +\n            '<div class=\"col-auto\">' +\n            '<input type=\"number\" class=\"form-control form-control-sm\" id=\"lifecycleNoncurrentDays\" min=\"1\" step=\"1\" style=\"width: 6rem;\" value=\"' + (rule.noncurrent_version_expiration_days || '') + '\"' + (noncurrentActive ? '' : ' disabled') + '>' +\n            '<\\/div><div class=\"col-auto\">days (optional), keep<\\/div>' +\n            '<div class=\"col-auto\">' +\n            '<input type=\"number\" class=\"form-control form-control-sm\" id=\"lifecycleNoncurrentKeep\" min=\"0\" step=\"1\" style=\"width: 6rem;\" value=\"' + (rule.newer_noncurrent_versions || '') + '\"' + (noncurrentActive ? '' : ' disabled') + '>' +\n            '<\\/div><div class=\"col-auto\">newest (optional)<\\/div>' +\n            '<\\/div>';\n        })() +\n\n        '<div class=\"row g-2 align-items-center mb-3\">' +\n        '<div class=\"col-auto\">' +\n        '<div class=\"form-check\">' +\n        '<input class=\"form-check-input\" type=\"checkbox\" id=\"lifecycleAbortMPUEnabled\"' + (rule.abort_multipart_days ? ' checked' : '') + '>' +\n        '<label class=\"form-check-label\" for=\"lifecycleAbortMPUEnabled\">Abort incomplete multipart uploads after<\\/label>' +\n        '<\\/div>' +\n        '<\\/div>' +\n        '<div class=\"col-auto\">' +\n        '<input type=\"number\" class=\"form-control form-control-sm\" id=\"lifecycleAbortMPUDays\" min=\"1\" step=\"1\" style=\"width: 6rem;\" value=\"' + (rule.abort_multipart_days || '') + '\"' + (rule.abort_multipart_days ? '' : ' disabled') + '>' +\n        '<\\/div><div class=\"col-auto\">days<\\/div>' +\n        '<\\/div>' +\n\n        '<div class=\"text-end\">' +\n        '<button type=\"button\" class=\"btn btn-sm btn-secondary\" id=\"lifecycleCancelRuleBtn\">Cancel<\\/button> ' +\n        '<button type=\"button\" class=\"btn btn-sm btn-primary\" id=\"lifecycleSaveRuleBtn\">Save rule<\\/button>' +\n        '<\\/div>' +\n        '<\\/div>' +\n        '<\\/div>';\n}\n\nfunction renderLifecycleEditor() {\n    const container = document.getElementById('bucketLifecycleContent');\n    const rowsHtml = lifecycleEditor.rules.map(lifecycleRuleRowHtml).join('') ||\n        '<tr><td colspan=\"5\" class=\"text-center text-muted py-3\">No lifecycle rules<\\/td><\\/tr>';\n\n    let html = '';\n    if (lifecycleEditor.hasTransition) {\n        html += '<div class=\"alert alert-warning small\">' +\n            '<i class=\"bi bi-exclamation-triangle me-1\"><\\/i>' +\n            'This bucket has a Transition rule set outside the admin (SeaweedFS does not support storage class transitions). Saving from here will drop it.' +\n            '<\\/div>';\n    }\n\n    html += '<div class=\"table-responsive mb-3\">' +\n        '<table class=\"table table-sm align-middle\">' +\n        '<thead><tr><th>Rule<\\/th><th>Status<\\/th><th>Scope<\\/th><th>Actions<\\/th><th><\\/th><\\/tr><\\/thead>' +\n        '<tbody>' + rowsHtml + '<\\/tbody>' +\n        '<\\/table>' +\n        '<\\/div>' +\n        '<button type=\"button\" class=\"btn btn-sm btn-outline-primary mb-3\" id=\"lifecycleAddRuleBtn\">' +\n        '<i class=\"bi bi-plus me-1\"><\\/i>Add rule' +\n        '<\\/button>';\n\n    if (lifecycleEditor.editingIndex !== null) {\n        html += lifecycleRuleFormHtml();\n    }\n\n    if (lifecycleEditor.rawXml) {\n        html += '<details class=\"mt-2\">' +\n            '<summary class=\"text-muted small\">Raw XML (as currently stored)<\\/summary>' +\n            '<pre class=\"bg-light border rounded p-2 mt-2 small mb-0\">' + escapeHtml(lifecycleEditor.rawXml) + '<\\/pre>' +\n            '<\\/details>';\n    }\n\n    container.innerHTML = html;\n    bindLifecycleEditorEvents();\n}\n\nfunction bindLifecycleToggle(checkboxId, fieldId, mutuallyExclusiveId) {\n    const checkbox = document.getElementById(checkboxId);\n    const field = document.getElementById(fieldId);\n    if (!checkbox || !field) return;\n    checkbox.addEventListener('change', function() {\n        field.disabled = !this.checked;\n        if (this.checked && mutuallyExclusiveId) {\n            const other = document.getElementById(mutuallyExclusiveId);\n            if (other && other.checked) {\n                other.checked = false;\n                other.dispatchEvent(new Event('change'));\n            }\n        }\n    });\n}\n\nfunction bindLifecycleEditorEvents() {\n    const addBtn = document.getElementById('lifecycleAddRuleBtn');\n    if (addBtn) {\n        addBtn.addEventListener('click', function() {\n            // Fold in any rule already being edited before switching forms,\n            // so an invalid in-progress draft isn't silently discarded.\n            if (!commitOpenLifecycleRuleForm()) return;\n            lifecycleEditor.editingIndex = 'new';\n            lifecycleEditor.editingRule = blankLifecycleRule();\n            renderLifecycleEditor();\n        });\n    }\n\n    document.querySelectorAll('.lifecycle-edit-rule-btn').forEach(btn => {\n        btn.addEventListener('click', function() {\n            const idx = parseInt(this.dataset.index, 10);\n            // Same as above: committing never shifts indices (it either\n            // pushes a new rule at the end or replaces one in place), so\n            // idx captured above is still valid after this call.\n            if (!commitOpenLifecycleRuleForm()) return;\n            lifecycleEditor.editingIndex = idx;\n            lifecycleEditor.editingRule = cloneLifecycleRule(lifecycleEditor.rules[idx]);\n            renderLifecycleEditor();\n        });\n    });\n\n    document.querySelectorAll('.lifecycle-delete-rule-btn').forEach(btn => {\n        btn.addEventListener('click', function() {\n            const idx = parseInt(this.dataset.index, 10);\n            // Fold in an open form first, like every other transition does:\n            // re-rendering after the splice would otherwise redraw it from the\n            // snapshot taken when editing began and lose what was typed.\n            if (lifecycleEditor.editingIndex !== null && lifecycleEditor.editingIndex !== idx) {\n                if (!commitOpenLifecycleRuleForm()) return;\n            }\n            lifecycleEditor.rules.splice(idx, 1);\n            // Deleting a rule shifts every later index down by one, so an\n            // open edit form must follow its rule rather than silently\n            // start targeting whatever now sits at its old index.\n            if (lifecycleEditor.editingIndex === idx) {\n                lifecycleEditor.editingIndex = null;\n                lifecycleEditor.editingRule = null;\n            } else if (typeof lifecycleEditor.editingIndex === 'number' && lifecycleEditor.editingIndex > idx) {\n                lifecycleEditor.editingIndex -= 1;\n            }\n            renderLifecycleEditor();\n        });\n    });\n\n    const cancelBtn = document.getElementById('lifecycleCancelRuleBtn');\n    if (cancelBtn) {\n        cancelBtn.addEventListener('click', function() {\n            lifecycleEditor.editingIndex = null;\n            lifecycleEditor.editingRule = null;\n            renderLifecycleEditor();\n        });\n    }\n\n    const addTagBtn = document.getElementById('lifecycleAddTagBtn');\n    if (addTagBtn) {\n        addTagBtn.addEventListener('click', function() {\n            const rows = document.getElementById('lifecycleTagRows');\n            const row = document.createElement('div');\n            row.className = 'input-group input-group-sm mb-1 lifecycle-tag-row';\n            row.innerHTML =\n                '<input type=\"text\" class=\"form-control lifecycle-tag-key\" placeholder=\"Key\">' +\n                '<input type=\"text\" class=\"form-control lifecycle-tag-value\" placeholder=\"Value\">' +\n                '<button type=\"button\" class=\"btn btn-outline-danger lifecycle-remove-tag-btn\"><i class=\"bi bi-x\"><\\/i><\\/button>';\n            rows.appendChild(row);\n            row.querySelector('.lifecycle-remove-tag-btn').addEventListener('click', function() {\n                row.remove();\n            });\n        });\n    }\n\n    document.querySelectorAll('.lifecycle-remove-tag-btn').forEach(btn => {\n        btn.addEventListener('click', function() {\n            this.closest('.lifecycle-tag-row').remove();\n        });\n    });\n\n    bindLifecycleToggle('lifecycleExpireDaysEnabled', 'lifecycleExpireDays', 'lifecycleExpireDateEnabled');\n    bindLifecycleToggle('lifecycleExpireDateEnabled', 'lifecycleExpireDate', 'lifecycleExpireDaysEnabled');\n    bindLifecycleToggle('lifecycleNoncurrentEnabled', 'lifecycleNoncurrentDays');\n    bindLifecycleToggle('lifecycleNoncurrentEnabled', 'lifecycleNoncurrentKeep');\n    bindLifecycleToggle('lifecycleAbortMPUEnabled', 'lifecycleAbortMPUDays');\n\n    const saveRuleBtn = document.getElementById('lifecycleSaveRuleBtn');\n    if (saveRuleBtn) {\n        saveRuleBtn.addEventListener('click', saveLifecycleRuleFromForm);\n    }\n}\n\n// readLifecycleRuleFromForm builds and validates a rule from the currently\n// open edit form's DOM inputs. Returns { rule: null, error: '...' } when the\n// form doesn't hold a valid rule, without mutating any state.\nfunction readLifecycleRuleFromForm() {\n    const id = document.getElementById('lifecycleRuleId').value.trim();\n    const status = document.querySelector('input[name=\"lifecycleRuleStatus\"]:checked').value;\n    const prefix = document.getElementById('lifecycleRulePrefix').value.trim();\n\n    const tags = {};\n    document.querySelectorAll('#lifecycleTagRows .lifecycle-tag-row').forEach(row => {\n        const key = row.querySelector('.lifecycle-tag-key').value.trim();\n        const value = row.querySelector('.lifecycle-tag-value').value.trim();\n        if (key) {\n            tags[key] = value;\n        }\n    });\n\n    const sizeGT = parseInt(document.getElementById('lifecycleRuleSizeGT').value, 10) || 0;\n    const sizeLT = parseInt(document.getElementById('lifecycleRuleSizeLT').value, 10) || 0;\n\n    const expireDaysEnabled = document.getElementById('lifecycleExpireDaysEnabled').checked;\n    const expireDateEnabled = document.getElementById('lifecycleExpireDateEnabled').checked;\n    const expirationDays = expireDaysEnabled ? (parseInt(document.getElementById('lifecycleExpireDays').value, 10) || 0) : 0;\n    const expirationDate = expireDateEnabled ? document.getElementById('lifecycleExpireDate').value : '';\n\n    const deleteMarker = document.getElementById('lifecycleDeleteMarker').checked;\n\n    const noncurrentEnabled = document.getElementById('lifecycleNoncurrentEnabled').checked;\n    const noncurrentDays = noncurrentEnabled ? (parseInt(document.getElementById('lifecycleNoncurrentDays').value, 10) || 0) : 0;\n    const noncurrentKeep = noncurrentEnabled ? (parseInt(document.getElementById('lifecycleNoncurrentKeep').value, 10) || 0) : 0;\n\n    const abortEnabled = document.getElementById('lifecycleAbortMPUEnabled').checked;\n    const abortDays = abortEnabled ? (parseInt(document.getElementById('lifecycleAbortMPUDays').value, 10) || 0) : 0;\n\n    if (expireDaysEnabled && expirationDays <= 0) {\n        return { rule: null, error: 'Enter a valid number of days for expiration.' };\n    }\n    if (expireDateEnabled && !expirationDate) {\n        return { rule: null, error: 'Enter a valid expiration date.' };\n    }\n    if (noncurrentEnabled && noncurrentDays <= 0 && noncurrentKeep <= 0) {\n        return { rule: null, error: 'Enter a number of days and/or a newest-versions-to-keep count for noncurrent version handling.' };\n    }\n    if (abortEnabled && abortDays <= 0) {\n        return { rule: null, error: 'Enter a valid number of days for aborting incomplete multipart uploads.' };\n    }\n    if (!expireDaysEnabled && !expireDateEnabled && !deleteMarker && !noncurrentEnabled && !abortEnabled) {\n        return { rule: null, error: 'Select at least one action for this rule.' };\n    }\n    // The server rejects this combination too; catching it here names the two\n    // fields instead of surfacing a 400 after the whole set is submitted.\n    if (deleteMarker && (expireDaysEnabled || expireDateEnabled)) {\n        return { rule: null, error: 'Removing expired object delete markers cannot be combined with an expiration.' };\n    }\n    if (sizeGT > 0 && sizeLT > 0 && sizeGT >= sizeLT) {\n        return { rule: null, error: '\"Size greater than\" must be less than \"size less than\".' };\n    }\n\n    return {\n        rule: {\n            id: id,\n            status: status,\n            prefix: prefix,\n            tags: tags,\n            size_greater_than: sizeGT > 0 ? sizeGT : null,\n            size_less_than: sizeLT > 0 ? sizeLT : null,\n            expiration_days: expirationDays > 0 ? expirationDays : null,\n            expiration_date: expirationDate || '',\n            expired_object_delete_marker: deleteMarker,\n            noncurrent_version_expiration_days: noncurrentDays > 0 ? noncurrentDays : null,\n            newer_noncurrent_versions: noncurrentKeep > 0 ? noncurrentKeep : null,\n            abort_multipart_days: abortDays > 0 ? abortDays : null,\n        },\n        error: null,\n    };\n}\n\nfunction saveLifecycleRuleFromForm() {\n    const { rule, error } = readLifecycleRuleFromForm();\n    if (error) {\n        alert(error);\n        return;\n    }\n\n    if (lifecycleEditor.editingIndex === 'new') {\n        lifecycleEditor.rules.push(rule);\n    } else {\n        lifecycleEditor.rules[lifecycleEditor.editingIndex] = rule;\n    }\n    lifecycleEditor.editingIndex = null;\n    lifecycleEditor.editingRule = null;\n    renderLifecycleEditor();\n}\n\n// commitOpenLifecycleRuleForm folds an in-progress add/edit form into\n// lifecycleEditor.rules before the whole rule set is sent to the server, so\n// clicking the modal's \"Save\" without first clicking \"Save rule\" doesn't\n// silently drop the open edit. Returns false (and leaves the form open) when\n// the open form doesn't hold a valid rule, so the caller can abort the save.\nfunction commitOpenLifecycleRuleForm() {\n    if (lifecycleEditor.editingIndex === null) {\n        return true;\n    }\n\n    const { rule, error } = readLifecycleRuleFromForm();\n    if (error) {\n        alert(error);\n        return false;\n    }\n\n    if (lifecycleEditor.editingIndex === 'new') {\n        lifecycleEditor.rules.push(rule);\n    } else {\n        lifecycleEditor.rules[lifecycleEditor.editingIndex] = rule;\n    }\n    lifecycleEditor.editingIndex = null;\n    lifecycleEditor.editingRule = null;\n    renderLifecycleEditor();\n    return true;\n}\n\n    function goToPage(page) {\n        const url = new URL(window.location);\n        url.searchParams.set('page', page);\n        window.location.href = url.toString();\n    }\n\n    function changePageSize() {\n        const pageSize = document.getElementById('pageSizeSelect').value;\n        const url = new URL(window.location);\n        url.searchParams.set('pageSize', pageSize);\n        url.searchParams.set('page', '1');\n        window.location.href = url.toString();\n    }\n\n    function sortTable(column) {\n        const url = new URL(window.location);\n        const currentSort = url.searchParams.get('sortBy');\n        const currentOrder = url.searchParams.get('sortOrder') || 'asc';\n\n        let newOrder = 'asc';\n        if (currentSort === column && currentOrder === 'asc') {\n            newOrder = 'desc';\n        }\n\n        url.searchParams.set('sortBy', column);\n        url.searchParams.set('sortOrder', newOrder);\n        url.searchParams.set('page', '1');\n        window.location.href = url.toString();\n    }\n\n    function exportBucketList() {\n        // RFC 4180 compliant CSV escaping: escape double quotes by doubling them\n        function escapeCsvField(value) {\n            const str = String(value ?? '');\n            if (str.includes(',') || str.includes('\"') || str.includes('\\n') || str.includes('\\r')) {\n                return '\"' + str.replace(/\"/g, '\"\"') + '\"';\n            }\n            return '\"' + str + '\"';\n        }\n\n        // Fetch all buckets from the API (not just the current page)\n        fetch(basePath('/api/s3/buckets'))\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    alert('Error exporting buckets: ' + data.error);\n                    return;\n                }\n\n                const buckets = data.buckets || [];\n                const csvContent = \"data:text/csv;charset=utf-8,\" +\n                    \"Name,Owner,Logical Size,Physical Size,Created,Quota,Versioning,Object Lock\\n\" +\n                    buckets.map(b => [\n                        escapeCsvField(b.name),\n                        escapeCsvField(b.owner),\n                        escapeCsvField(formatBytes(b.logical_size)),\n                        escapeCsvField(formatBytes(b.physical_size)),\n                        escapeCsvField(b.created_at),\n                        escapeCsvField(b.quota_enabled ? formatBytes(b.quota) : 'No quota'),\n                        escapeCsvField(b.versioning_status || 'Not configured'),\n                        escapeCsvField(b.object_lock_enabled ? 'Enabled' : 'Not configured')\n                    ].join(',')).join(\"\\n\");\n\n                const encodedUri = encodeURI(csvContent);\n                const link = document.createElement(\"a\");\n                link.setAttribute(\"href\", encodedUri);\n                link.setAttribute(\"download\", \"buckets.csv\");\n                document.body.appendChild(link);\n                link.click();\n                document.body.removeChild(link);\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error exporting buckets: ' + error.message);\n            });\n    }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/s3tables_buckets.templ b/weed/admin/view/app/s3tables_buckets.templ
index f0e6c090eb..6533e32545 100644
--- a/weed/admin/view/app/s3tables_buckets.templ
+++ b/weed/admin/view/app/s3tables_buckets.templ
@@ -11,55 +11,61 @@ import (
 templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-table me-2"></i>S3 Tables Buckets
+			<i class="bi bi-table me-2"></i>S3 Tables Buckets
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-primary" data-bs-toggle="modal" data-bs-target="#createS3TablesBucketModal">
-					<i class="fas fa-plus me-1"></i>Create Bucket
+					<i class="bi bi-plus me-1"></i>Create Bucket
 				</button>
 			</div>
 			if data.IcebergPort > 0 {
 				<div class="btn-group me-2">
 					<a id="s3tables-iceberg-rest-link" href={ templ.SafeURL(fmt.Sprintf("//localhost:%d/v1/config", data.IcebergPort)) } target="_blank" class="btn btn-sm btn-outline-secondary">
-						<i class="fas fa-snowflake me-1"></i>Iceberg REST API
+						<i class="bi bi-snow me-1"></i>Iceberg REST API
+					</a>
+				</div>
+			}
+			if data.LancePort > 0 {
+				<div class="btn-group me-2">
+					<a id="s3tables-lance-rest-link" href={ templ.SafeURL(fmt.Sprintf("//localhost:%d/v1/table", data.LancePort)) } target="_blank" class="btn btn-sm btn-outline-secondary">
+						<i class="bi bi-bounding-box me-1"></i>Lance Namespace API
 					</a>
 				</div>
 			}
 		</div>
 	</div>
-	<div id="s3tables-buckets-content" data-iceberg-port={ fmt.Sprintf("%d", data.IcebergPort) }>
-		if data.IcebergPort > 0 {
+	<div id="s3tables-buckets-content" data-iceberg-port={ fmt.Sprintf("%d", data.IcebergPort) } data-lance-port={ fmt.Sprintf("%d", data.LancePort) }>
+		if data.IcebergPort > 0 || data.LancePort > 0 {
 			<div class="alert alert-info mb-4">
-				<div class="d-flex align-items-center">
-					<i class="fas fa-info-circle fa-2x me-3"></i>
+				<div class="d-flex align-items-start">
+					<i class="bi bi-info-circle icon-2x me-3"></i>
 					<div>
-						<strong>Iceberg REST Catalog</strong>
-						<p id="s3tables-iceberg-info" class="mb-0 mt-1" data-iceberg-port={ fmt.Sprintf("%d", data.IcebergPort) }>
-							Each table bucket is an Iceberg catalog. Connect clients to:
-							<code><span id="s3tables-iceberg-protocol">http</span>://<span id="s3tables-iceberg-host">localhost</span>:{ fmt.Sprintf("%d", data.IcebergPort) }/v1</code>
+						<strong>Catalog endpoints</strong>
+						<p class="mb-0 mt-1">
+							Each table bucket is a catalog. Which endpoint serves it depends on the format it holds.
 						</p>
-						<script>
-							const s3tablesInfo = document.getElementById('s3tables-iceberg-info');
-							const s3tablesIcebergHost = window.location.hostname;
-							const s3tablesIcebergProtocol = window.location.protocol.slice(0, -1);
-							const s3tablesIcebergPort = s3tablesInfo ? s3tablesInfo.dataset.icebergPort : '';
-							document.getElementById('s3tables-iceberg-host').innerText = s3tablesIcebergHost;
-							const s3tablesIcebergProtocolEl = document.getElementById('s3tables-iceberg-protocol');
-							if (s3tablesIcebergProtocolEl) {
-								s3tablesIcebergProtocolEl.innerText = s3tablesIcebergProtocol;
+						<div class="mt-2">
+							if data.IcebergPort > 0 {
+								<div>
+									<span class="badge bg-primary">ICEBERG</span>
+									<code class="ms-1"><span class="s3tables-origin" data-port={ fmt.Sprintf("%d", data.IcebergPort) }>{ fmt.Sprintf("http://localhost:%d", data.IcebergPort) }</span>/v1</code>
+								</div>
 							}
-							const s3tablesRestLink = document.getElementById('s3tables-iceberg-rest-link');
-							if (s3tablesRestLink && s3tablesIcebergPort) {
-								s3tablesRestLink.href = `//${s3tablesIcebergHost}:${s3tablesIcebergPort}/v1/config`;
+							if data.LancePort > 0 {
+								<div class="mt-1">
+									<span class="badge bg-success">LANCE</span>
+									<code class="ms-1"><span class="s3tables-origin" data-port={ fmt.Sprintf("%d", data.LancePort) }>{ fmt.Sprintf("http://localhost:%d", data.LancePort) }</span></code>
+								</div>
 							}
-						</script>
+						</div>
 					</div>
 				</div>
 			</div>
-		} else {
+		}
+		if data.IcebergPort == 0 && data.LancePort == 0 {
 			<div class="alert alert-warning mb-4">
-				<i class="fas fa-exclamation-triangle me-2"></i>Iceberg REST endpoint is disabled. Start `weed s3` with `-s3.port.iceberg` to enable it.
+				<i class="bi bi-exclamation-triangle me-2"></i>No catalog endpoint is running. Start `weed s3` with `-s3.port.iceberg` or `-s3.port.lance`, and point admin at it with `-iceberg.port` or `-lance.port`.
 			</div>
 		}
 		<div class="row mb-4">
@@ -76,7 +82,7 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-table fa-2x text-gray-300"></i>
+								<i class="bi bi-table icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -95,7 +101,7 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-clock fa-2x text-gray-300"></i>
+								<i class="bi bi-clock icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -118,7 +124,7 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-snowflake fa-2x text-gray-300"></i>
+								<i class="bi bi-snow icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -130,7 +136,7 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-table me-2"></i>Table Buckets
+							<i class="bi bi-table me-2"></i>Table Buckets
 						</h6>
 					</div>
 					<div class="card-body">
@@ -139,10 +145,12 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 								<thead>
 									<tr>
 										<th>Name</th>
+										<th>Format</th>
 										<th>Owner</th>
 										<th>ARN</th>
-										<th>Iceberg Endpoint</th>
+										<th>Catalog Endpoint</th>
 										<th>Created</th>
+										<th>Policy</th>
 										<th>Actions</th>
 									</tr>
 								</thead>
@@ -150,30 +158,47 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 									for _, bucket := range data.Buckets {
 										<tr>
 											<td>{ bucket.Name }</td>
+											<td>
+												<span class={ formatBadgeClass(bucket.Format) } title={ formatBadgeTitle(bucket.Format) }>{ formatLabel(bucket.Format) }</span>
+											</td>
 											<td>{ bucket.OwnerAccountID }</td>
 											<td class="text-muted small">{ bucket.ARN }</td>
-											<td><code class="small">/v1/{ bucket.Name }/namespaces</code></td>
+											<td><code class="small">{ bucketCatalogPath(bucket.Format, bucket.Name) }</code></td>
 											<td>{ bucket.CreatedAt.Format("2006-01-02 15:04") }</td>
+											<td>
+												if bucket.PolicyStatementCount > 0 {
+													<button type="button" class="badge bg-primary border-0 s3tables-bucket-policy-btn"
+															data-bucket-arn={ bucket.ARN } title="View Bucket Policy">
+														if bucket.PolicyStatementCount == 1 {
+															1 statement
+														} else {
+															{ fmt.Sprintf("%d statements", bucket.PolicyStatementCount) }
+														}
+													</button>
+												} else {
+													<span class="text-muted">Not configured</span>
+												}
+											</td>
 											<td>
 												<div class="btn-group btn-group-sm" role="group">
 													{{ bucketName, parseErr := s3tables.ParseBucketNameFromARN(bucket.ARN) }}
 													if parseErr == nil {
 														<a class="btn btn-outline-primary btn-sm" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces", url.PathEscape(bucketName))) }>
-															<i class="fas fa-folder-open"></i>
+															<i class="bi bi-folder2-open"></i>
 														</a>
 													} else {
 														<button type="button" class="btn btn-outline-primary btn-sm" disabled title="Invalid bucket ARN">
-															<i class="fas fa-folder-open"></i>
+															<i class="bi bi-folder2-open"></i>
 														</button>
 													}
 													<button type="button" class="btn btn-outline-success btn-sm s3tables-tags-btn" data-resource-arn={ bucket.ARN } title="Tags">
-														<i class="fas fa-tags"></i>
+														<i class="bi bi-tags"></i>
 													</button>
 													<button type="button" class="btn btn-outline-info btn-sm s3tables-bucket-policy-btn" data-bucket-arn={ bucket.ARN } title="Bucket Policy">
-														<i class="fas fa-shield-alt"></i>
+														<i class="bi bi-shield"></i>
 													</button>
 													<button type="button" class="btn btn-outline-danger btn-sm s3tables-delete-bucket-btn" data-bucket-arn={ bucket.ARN } data-bucket-name={ bucket.Name } title="Delete">
-														<i class="fas fa-trash"></i>
+														<i class="bi bi-trash"></i>
 													</button>
 												</div>
 											</td>
@@ -181,13 +206,13 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 									}
 									if len(data.Buckets) == 0 {
 										<tr>
-											<td colspan="6" class="text-center text-muted py-4">
-												<i class="fas fa-table fa-3x mb-3 text-muted"></i>
+											<td colspan="8" class="text-center text-muted py-4">
+												<i class="bi bi-table icon-3x mb-3 text-muted"></i>
 												<div>
 													<h5>No table buckets found</h5>
 													<p>Create your first S3 Tables bucket to get started.</p>
 													<button type="button" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#createS3TablesBucketModal">
-														<i class="fas fa-plus me-1"></i>Create Bucket
+														<i class="bi bi-plus me-1"></i>Create Bucket
 													</button>
 												</div>
 											</td>
@@ -200,17 +225,18 @@ templ S3TablesBuckets(data dash.S3TablesBucketsData) {
 				</div>
 			</div>
 		</div>
-		if data.IcebergPort > 0 {
+		if data.IcebergPort > 0 || data.LancePort > 0 {
 			<div class="row">
 				<div class="col-12">
 					<div class="card shadow mb-4">
 						<div class="card-header py-3">
 							<h6 class="m-0 font-weight-bold text-primary">
-								<i class="fas fa-code me-2"></i>Iceberg Client Examples
+								<i class="bi bi-code me-2"></i>Client Examples
 							</h6>
 						</div>
 						<div class="card-body">
-							<h6>DuckDB</h6>
+							if data.IcebergPort > 0 {
+								<h6><span class="badge bg-primary me-2">ICEBERG</span>DuckDB</h6>
 							<pre class="bg-light p-3 border rounded">
 								<code id="s3tables-duckdb-example">
 									{ `INSTALL iceberg;
@@ -225,7 +251,7 @@ CREATE SECRET (
 SELECT * FROM iceberg_scan('s3://my-table-bucket/my-namespace/my-table');` }
 								</code>
 							</pre>
-							<h6 class="mt-4">Python (PyIceberg)</h6>
+								<h6 class="mt-4"><span class="badge bg-primary me-2">ICEBERG</span>Python (PyIceberg)</h6>
 							<pre class="bg-light p-3 border rounded">
 								<code id="s3tables-pyiceberg-example">
 									{ `from pyiceberg.catalog import load_catalog
@@ -242,11 +268,40 @@ catalog = load_catalog(
 namespaces = catalog.list_namespaces()` }
 								</code>
 							</pre>
+							}
+							if data.LancePort > 0 {
+								<h6 class={ templ.KV("mt-4", data.IcebergPort > 0) }><span class="badge bg-success me-2">LANCE</span>Python (lance-namespace)</h6>
+								<pre class="bg-light p-3 border rounded">
+									<code id="s3tables-lance-namespace-example">
+										{ `from lance_namespace import connect
+
+ns = connect("rest", {"uri": "http://localhost:` + fmt.Sprintf("%d", data.LancePort) + `"})
+
+ns.list_namespaces(id=["my-table-bucket"])
+ns.describe_table(id=["my-table-bucket", "my-namespace", "my-table"])` }
+									</code>
+								</pre>
+								<h6 class="mt-4"><span class="badge bg-success me-2">LANCE</span>Python (pylance)</h6>
+								<pre class="bg-light p-3 border rounded">
+									<code id="s3tables-pylance-example">
+										{ `import lance
+from lance_namespace import connect
+
+ns = connect("rest", {"uri": "http://localhost:` + fmt.Sprintf("%d", data.LancePort) + `"})
+table = ns.describe_table(id=["my-table-bucket", "my-namespace", "my-table"])
+
+# The namespace vends both the location and the credentials to read it.
+dataset = lance.dataset(table.location, storage_options=table.storage_options)` }
+									</code>
+								</pre>
+							}
 							<script>
 								const s3tablesExamplesHost = window.location.hostname;
 								const s3tablesExamples = [
 									document.getElementById('s3tables-duckdb-example'),
-									document.getElementById('s3tables-pyiceberg-example')
+									document.getElementById('s3tables-pyiceberg-example'),
+									document.getElementById('s3tables-lance-namespace-example'),
+									document.getElementById('s3tables-pylance-example')
 								];
 								s3tablesExamples.forEach(example => {
 									if (!example) {
@@ -266,7 +321,7 @@ namespaces = catalog.list_namespaces()` }
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="createS3TablesBucketModalLabel">
-						<i class="fas fa-plus me-2"></i>Create Table Bucket
+						<i class="bi bi-plus me-2"></i>Create Table Bucket
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -276,6 +331,39 @@ namespaces = catalog.list_namespaces()` }
 							<label for="s3tablesBucketName" class="form-label">Bucket Name</label>
 							<input type="text" class="form-control" id="s3tablesBucketName" name="name" placeholder="table-bucket-name" required/>
 						</div>
+						<div class="mb-3">
+							<label class="form-label">Table Format</label>
+							<div class="row g-2" id="s3tablesBucketFormatPicker">
+								<div class="col-6">
+									if data.IcebergPort > 0 {
+										<input type="radio" class="btn-check" name="format" id="s3tablesBucketFormatIceberg" value="ICEBERG" checked/>
+									} else {
+										<input type="radio" class="btn-check" name="format" id="s3tablesBucketFormatIceberg" value="ICEBERG" disabled/>
+									}
+									<label class="btn btn-outline-primary w-100 text-start p-3" for="s3tablesBucketFormatIceberg">
+										<span class="d-block fw-semibold"><i class="bi bi-snow me-1"></i>Iceberg</span>
+										<span class="d-block small text-muted mt-1">Served over the Iceberg REST catalog. Spark, Trino, PyIceberg, DuckDB, OLake Go.</span>
+									</label>
+								</div>
+								<div class="col-6">
+									if data.LancePort > 0 && data.IcebergPort <= 0 {
+										// The only format this cluster serves, so it is the one preselected.
+										<input type="radio" class="btn-check" name="format" id="s3tablesBucketFormatLance" value="LANCE" checked/>
+									} else if data.LancePort > 0 {
+										<input type="radio" class="btn-check" name="format" id="s3tablesBucketFormatLance" value="LANCE"/>
+									} else {
+										<input type="radio" class="btn-check" name="format" id="s3tablesBucketFormatLance" value="LANCE" disabled/>
+									}
+									<label class="btn btn-outline-success w-100 text-start p-3" for="s3tablesBucketFormatLance">
+										<span class="d-block fw-semibold"><i class="bi bi-bounding-box me-1"></i>Lance</span>
+										<span class="d-block small text-muted mt-1">Served over the Lance Namespace API. pylance, LanceDB, Ray.</span>
+									</label>
+								</div>
+							</div>
+							<div class="form-text" id="s3tablesBucketFormatHint" data-iceberg-port={ fmt.Sprintf("%d", data.IcebergPort) } data-lance-port={ fmt.Sprintf("%d", data.LancePort) }>
+								A bucket holds one format. Tables of the other are refused.
+							</div>
+						</div>
 						<div class="mb-3">
 							<label for="s3tablesBucketOwner" class="form-label">Owner (Optional)</label>
 							<select class="form-select" id="s3tablesBucketOwner" name="owner">
@@ -294,7 +382,7 @@ namespaces = catalog.list_namespaces()` }
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-plus me-1"></i>Create
+							<i class="bi bi-plus me-1"></i>Create
 						</button>
 					</div>
 				</form>
@@ -306,7 +394,7 @@ namespaces = catalog.list_namespaces()` }
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="deleteS3TablesBucketModalLabel">
-						<i class="fas fa-exclamation-triangle me-2 text-warning"></i>Delete Table Bucket
+						<i class="bi bi-exclamation-triangle me-2 text-warning"></i>Delete Table Bucket
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -316,27 +404,44 @@ namespaces = catalog.list_namespaces()` }
 				<div class="modal-footer">
 					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 					<button type="button" class="btn btn-danger" onclick="deleteS3TablesBucket()">
-						<i class="fas fa-trash me-1"></i>Delete
+						<i class="bi bi-trash me-1"></i>Delete
 					</button>
 				</div>
 			</div>
 		</div>
 	</div>
+	@PolicyDatalists()
+
 	<div class="modal fade" id="s3tablesBucketPolicyModal" tabindex="-1" aria-labelledby="s3tablesBucketPolicyModalLabel" aria-hidden="true">
-		<div class="modal-dialog modal-lg">
+		<div class="modal-dialog modal-xl">
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="s3tablesBucketPolicyModalLabel">
-						<i class="fas fa-shield-alt me-2"></i>Table Bucket Policy
+						<i class="bi bi-shield me-2"></i>Table Bucket Policy
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
 				<form id="s3tablesBucketPolicyForm">
 					<div class="modal-body">
 						<input type="hidden" id="s3tablesBucketPolicyArn" name="bucket_arn"/>
-						<div class="mb-3">
-							<label for="s3tablesBucketPolicyText" class="form-label">Policy JSON</label>
-							<textarea class="form-control" id="s3tablesBucketPolicyText" name="policy" rows="12" placeholder="{ }"></textarea>
+						<ul class="nav nav-tabs" role="tablist">
+							<li class="nav-item" role="presentation">
+								<button class="nav-link active" id="s3tablesBucketPolicyEditorTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#s3tablesBucketPolicyEditorTab" role="tab" aria-controls="s3tablesBucketPolicyEditorTab" aria-selected="true">Editor</button>
+							</li>
+							<li class="nav-item" role="presentation">
+								<button class="nav-link" id="s3tablesBucketPolicyJsonTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#s3tablesBucketPolicyJsonTab" role="tab" aria-controls="s3tablesBucketPolicyJsonTab" aria-selected="false">JSON</button>
+							</li>
+						</ul>
+						<div class="tab-content border border-top-0 rounded-bottom p-3 mb-3">
+							<div class="tab-pane fade show active" id="s3tablesBucketPolicyEditorTab" role="tabpanel" aria-labelledby="s3tablesBucketPolicyEditorTabBtn">
+								<div id="s3tablesBucketPolicyEditorBody"></div>
+								<button type="button" class="btn btn-sm btn-outline-secondary" id="s3tablesBucketPolicyAddStatementBtn">
+									<i class="bi bi-plus me-1"></i>Add statement
+								</button>
+							</div>
+							<div class="tab-pane fade" id="s3tablesBucketPolicyJsonTab" role="tabpanel" aria-labelledby="s3tablesBucketPolicyJsonTabBtn">
+								<textarea class="form-control" id="s3tablesBucketPolicyText" name="policy" rows="12" placeholder="{ }"></textarea>
+							</div>
 						</div>
 						<div class="form-text">
 							Provide a policy JSON; use Delete Policy to remove the policy.
@@ -344,11 +449,14 @@ namespaces = catalog.list_namespaces()` }
 					</div>
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-						<button type="button" class="btn btn-outline-danger" onclick="deleteS3TablesBucketPolicy()">
-							<i class="fas fa-trash me-1"></i>Delete Policy
+						<button type="button" class="btn btn-outline-danger" id="s3tablesBucketPolicyDeleteBtn" onclick="deleteS3TablesBucketPolicy()">
+							<i class="bi bi-trash me-1"></i>Delete Policy
 						</button>
-						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-save me-1"></i>Save Policy
+						<!-- type="button": a submit button would make Enter in any
+						     single-line editor input implicitly submit a half-built
+						     policy, which the backend stores verbatim. -->
+						<button type="button" class="btn btn-primary" id="s3tablesBucketPolicySaveBtn">
+							<i class="bi bi-floppy me-1"></i>Save Policy
 						</button>
 					</div>
 				</form>
@@ -360,7 +468,7 @@ namespaces = catalog.list_namespaces()` }
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="s3tablesTagsModalLabel">
-						<i class="fas fa-tags me-2"></i>Resource Tags
+						<i class="bi bi-tags me-2"></i>Resource Tags
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -383,10 +491,10 @@ namespaces = catalog.list_namespaces()` }
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
 						<button type="button" class="btn btn-outline-danger" onclick="deleteS3TablesTags()">
-							<i class="fas fa-trash me-1"></i>Remove Tags
+							<i class="bi bi-trash me-1"></i>Remove Tags
 						</button>
 						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-save me-1"></i>Update Tags
+							<i class="bi bi-floppy me-1"></i>Update Tags
 						</button>
 					</div>
 				</form>
diff --git a/weed/admin/view/app/s3tables_buckets_templ.go b/weed/admin/view/app/s3tables_buckets_templ.go
index f57dab5668..d43c7fabb0 100644
--- a/weed/admin/view/app/s3tables_buckets_templ.go
+++ b/weed/admin/view/app/s3tables_buckets_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -37,7 +37,7 @@ func S3TablesBuckets(data dash.S3TablesBucketsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-table me-2\"></i>S3 Tables Buckets</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesBucketModal\"><i class=\"fas fa-plus me-1\"></i>Create Bucket</button></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-table me-2\"></i>S3 Tables Buckets</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesBucketModal\"><i class=\"bi bi-plus me-1\"></i>Create Bucket</button></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -55,284 +55,460 @@ func S3TablesBuckets(data dash.S3TablesBucketsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\" target=\"_blank\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-snowflake me-1\"></i>Iceberg REST API</a></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\" target=\"_blank\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-snow me-1\"></i>Iceberg REST API</a></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div id=\"s3tables-buckets-content\" data-iceberg-port=\"")
+		if data.LancePort > 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<div class=\"btn-group me-2\"><a id=\"s3tables-lance-rest-link\" href=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var3 templ.SafeURL
+			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(fmt.Sprintf("//localhost:%d/v1/table", data.LancePort)))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 31, Col: 114}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "\" target=\"_blank\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-bounding-box me-1\"></i>Lance Namespace API</a></div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</div></div><div id=\"s3tables-buckets-content\" data-iceberg-port=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var3 string
-		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.IcebergPort))
+		var templ_7745c5c3_Var4 string
+		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.IcebergPort))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 31, Col: 91}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 38, Col: 91}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" data-lance-port=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var5 string
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.LancePort))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 38, Col: 145}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var5)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if data.IcebergPort > 0 || data.LancePort > 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "<div class=\"alert alert-info mb-4\"><div class=\"d-flex align-items-start\"><i class=\"bi bi-info-circle icon-2x me-3\"></i><div><strong>Catalog endpoints</strong><p class=\"mb-0 mt-1\">Each table bucket is a catalog. Which endpoint serves it depends on the format it holds.</p><div class=\"mt-2\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if data.IcebergPort > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<div><span class=\"badge bg-primary\">ICEBERG</span> <code class=\"ms-1\"><span class=\"s3tables-origin\" data-port=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var6 string
+				templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.IcebergPort))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 52, Col: 105}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var6)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var7 string
+				templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("http://localhost:%d", data.IcebergPort))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 52, Col: 162}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</span>/v1</code></div>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			if data.LancePort > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<div class=\"mt-1\"><span class=\"badge bg-success\">LANCE</span> <code class=\"ms-1\"><span class=\"s3tables-origin\" data-port=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var8 string
+				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.LancePort))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 58, Col: 103}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var8)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var9 string
+				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("http://localhost:%d", data.LancePort))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 58, Col: 158}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</span></code></div>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</div></div></div></div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		if data.IcebergPort == 0 && data.LancePort == 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "<div class=\"alert alert-warning mb-4\"><i class=\"bi bi-exclamation-triangle me-2\"></i>No catalog endpoint is running. Start `weed s3` with `-s3.port.iceberg` or `-s3.port.lance`, and point admin at it with `-iceberg.port` or `-lance.port`.</div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Buckets</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var10 string
+		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalBuckets))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 81, Col: 47}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</div></div><div class=\"col-auto\"><i class=\"bi bi-table icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var11 string
+		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 100, Col: 54}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Iceberg REST Port</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if data.IcebergPort > 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "<div class=\"alert alert-info mb-4\"><div class=\"d-flex align-items-center\"><i class=\"fas fa-info-circle fa-2x me-3\"></i><div><strong>Iceberg REST Catalog</strong><p id=\"s3tables-iceberg-info\" class=\"mb-0 mt-1\" data-iceberg-port=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var4 string
-			templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.IcebergPort))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 38, Col: 109}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\">Each table bucket is an Iceberg catalog. Connect clients to: <code><span id=\"s3tables-iceberg-protocol\">http</span>://<span id=\"s3tables-iceberg-host\">localhost</span>:")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var5 string
-			templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.IcebergPort))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 40, Col: 151}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "/v1</code></p><script>\n\t\t\t\t\t\t\tconst s3tablesInfo = document.getElementById('s3tables-iceberg-info');\n\t\t\t\t\t\t\tconst s3tablesIcebergHost = window.location.hostname;\n\t\t\t\t\t\t\tconst s3tablesIcebergProtocol = window.location.protocol.slice(0, -1);\n\t\t\t\t\t\t\tconst s3tablesIcebergPort = s3tablesInfo ? s3tablesInfo.dataset.icebergPort : '';\n\t\t\t\t\t\t\tdocument.getElementById('s3tables-iceberg-host').innerText = s3tablesIcebergHost;\n\t\t\t\t\t\t\tconst s3tablesIcebergProtocolEl = document.getElementById('s3tables-iceberg-protocol');\n\t\t\t\t\t\t\tif (s3tablesIcebergProtocolEl) {\n\t\t\t\t\t\t\t\ts3tablesIcebergProtocolEl.innerText = s3tablesIcebergProtocol;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tconst s3tablesRestLink = document.getElementById('s3tables-iceberg-rest-link');\n\t\t\t\t\t\t\tif (s3tablesRestLink && s3tablesIcebergPort) {\n\t\t\t\t\t\t\t\ts3tablesRestLink.href = `//${s3tablesIcebergHost}:${s3tablesIcebergPort}/v1/config`;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t</script></div></div></div>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "<div class=\"alert alert-warning mb-4\"><i class=\"fas fa-exclamation-triangle me-2\"></i>Iceberg REST endpoint is disabled. Start `weed s3` with `-s3.port.iceberg` to enable it.</div>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Buckets</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var6 string
-		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalBuckets))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 75, Col: 47}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"fas fa-table fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var7 string
-		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 94, Col: 54}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Iceberg REST Port</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if data.IcebergPort > 0 {
-			var templ_7745c5c3_Var8 string
-			templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.IcebergPort))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 114, Col: 47}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "-")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "</div></div><div class=\"col-auto\"><i class=\"fas fa-snowflake fa-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-table me-2\"></i>Table Buckets</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"s3tablesBucketsTable\"><thead><tr><th>Name</th><th>Owner</th><th>ARN</th><th>Iceberg Endpoint</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		for _, bucket := range data.Buckets {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "<tr><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var9 string
-			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 152, Col: 28}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.OwnerAccountID)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 153, Col: 38}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</td><td class=\"text-muted small\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var11 string
-			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.ARN)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 154, Col: 52}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</td><td><code class=\"small\">/v1/")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
 			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
+			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.IcebergPort))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 155, Col: 52}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 120, Col: 47}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "/namespaces</code></td><td>")
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "-")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</div></div><div class=\"col-auto\"><i class=\"bi bi-snow icon-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-table me-2\"></i>Table Buckets</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"s3tablesBucketsTable\"><thead><tr><th>Name</th><th>Format</th><th>Owner</th><th>ARN</th><th>Catalog Endpoint</th><th>Created</th><th>Policy</th><th>Actions</th></tr></thead> <tbody>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		for _, bucket := range data.Buckets {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<tr><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var13 string
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.CreatedAt.Format("2006-01-02 15:04"))
+			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 156, Col: 60}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 160, Col: 28}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			bucketName, parseErr := s3tables.ParseBucketNameFromARN(bucket.ARN)
-			if parseErr == nil {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<a class=\"btn btn-outline-primary btn-sm\" href=\"")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var14 templ.SafeURL
-				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces", url.PathEscape(bucketName))))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 161, Col: 166}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\"><i class=\"fas fa-folder-open\"></i></a> ")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" disabled title=\"Invalid bucket ARN\"><i class=\"fas fa-folder-open\"></i></button> ")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
+			var templ_7745c5c3_Var14 = []any{formatBadgeClass(bucket.Format)}
+			templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var14...)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "<button type=\"button\" class=\"btn btn-outline-success btn-sm s3tables-tags-btn\" data-resource-arn=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<span class=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var15 string
-			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.ARN)
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var14).String())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 169, Col: 122}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 1, Col: 0}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "\" title=\"Tags\"><i class=\"fas fa-tags\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm s3tables-bucket-policy-btn\" data-bucket-arn=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "\" title=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var16 string
-			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.ARN)
+			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(formatBadgeTitle(bucket.Format))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 172, Col: 126}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 162, Col: 99}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "\" title=\"Bucket Policy\"><i class=\"fas fa-shield-alt\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm s3tables-delete-bucket-btn\" data-bucket-arn=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var17 string
-			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.ARN)
+			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(formatLabel(bucket.Format))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 175, Col: 128}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 162, Col: 130}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "\" data-bucket-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</span></td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var18 string
-			templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.Name)
+			templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.OwnerAccountID)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 175, Col: 161}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 164, Col: 38}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "\" title=\"Delete\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "</td><td class=\"text-muted small\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var19 string
+			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.ARN)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 165, Col: 52}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</td><td><code class=\"small\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var20 string
+			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(bucketCatalogPath(bucket.Format, bucket.Name))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 166, Col: 82}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "</code></td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var21 string
+			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(bucket.CreatedAt.Format("2006-01-02 15:04"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 167, Col: 60}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if bucket.PolicyStatementCount > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<button type=\"button\" class=\"badge bg-primary border-0 s3tables-bucket-policy-btn\" data-bucket-arn=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var22 string
+				templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.ARN)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 171, Col: 43}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\" title=\"View Bucket Policy\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				if bucket.PolicyStatementCount == 1 {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "1 statement")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				} else {
+					var templ_7745c5c3_Var23 string
+					templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d statements", bucket.PolicyStatementCount))
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 175, Col: 74}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</button>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<span class=\"text-muted\">Not configured</span>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			bucketName, parseErr := s3tables.ParseBucketNameFromARN(bucket.ARN)
+			if parseErr == nil {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<a class=\"btn btn-outline-primary btn-sm\" href=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var24 templ.SafeURL
+				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces", url.PathEscape(bucketName))))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 186, Col: 166}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "\"><i class=\"bi bi-folder2-open\"></i></a> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" disabled title=\"Invalid bucket ARN\"><i class=\"bi bi-folder2-open\"></i></button> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<button type=\"button\" class=\"btn btn-outline-success btn-sm s3tables-tags-btn\" data-resource-arn=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var25 string
+			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.ARN)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 194, Col: 122}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var25)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\" title=\"Tags\"><i class=\"bi bi-tags\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm s3tables-bucket-policy-btn\" data-bucket-arn=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var26 string
+			templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.ARN)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 197, Col: 126}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "\" title=\"Bucket Policy\"><i class=\"bi bi-shield\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm s3tables-delete-bucket-btn\" data-bucket-arn=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var27 string
+			templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.ARN)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 200, Col: 128}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "\" data-bucket-name=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var28 string
+			templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue(bucket.Name)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 200, Col: 161}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "\" title=\"Delete\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.Buckets) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<tr><td colspan=\"6\" class=\"text-center text-muted py-4\"><i class=\"fas fa-table fa-3x mb-3 text-muted\"></i><div><h5>No table buckets found</h5><p>Create your first S3 Tables bucket to get started.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesBucketModal\"><i class=\"fas fa-plus me-1\"></i>Create Bucket</button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "<tr><td colspan=\"8\" class=\"text-center text-muted py-4\"><i class=\"bi bi-table icon-3x mb-3 text-muted\"></i><div><h5>No table buckets found</h5><p>Create your first S3 Tables bucket to get started.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesBucketModal\"><i class=\"bi bi-plus me-1\"></i>Create Bucket</button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</tbody></table></div></div></div></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "</tbody></table></div></div></div></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if data.IcebergPort > 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-code me-2\"></i>Iceberg Client Examples</h6></div><div class=\"card-body\"><h6>DuckDB</h6><pre class=\"bg-light p-3 border rounded\"><code id=\"s3tables-duckdb-example\">")
+		if data.IcebergPort > 0 || data.LancePort > 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "<div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-code me-2\"></i>Client Examples</h6></div><div class=\"card-body\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var19 string
-			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(`INSTALL iceberg;
+			if data.IcebergPort > 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "<h6><span class=\"badge bg-primary me-2\">ICEBERG</span>DuckDB</h6><pre class=\"bg-light p-3 border rounded\"><code id=\"s3tables-duckdb-example\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var29 string
+				templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(`INSTALL iceberg;
 LOAD iceberg;
 
 CREATE SECRET (
@@ -342,19 +518,19 @@ CREATE SECRET (
 );
 
 SELECT * FROM iceberg_scan('s3://my-table-bucket/my-namespace/my-table');`)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 225, Col: 74}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</code></pre><h6 class=\"mt-4\">Python (PyIceberg)</h6><pre class=\"bg-light p-3 border rounded\"><code id=\"s3tables-pyiceberg-example\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var20 string
-			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(`from pyiceberg.catalog import load_catalog
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 251, Col: 74}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "</code></pre><h6 class=\"mt-4\"><span class=\"badge bg-primary me-2\">ICEBERG</span>Python (PyIceberg)</h6><pre class=\"bg-light p-3 border rounded\"><code id=\"s3tables-pyiceberg-example\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var30 string
+				templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(`from pyiceberg.catalog import load_catalog
 
 catalog = load_catalog(
     name="seaweedfs",
@@ -366,19 +542,155 @@ catalog = load_catalog(
 )
 
 namespaces = catalog.list_namespaces()`)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 242, Col: 39}
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 268, Col: 39}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "</code></pre>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
+			if data.LancePort > 0 {
+				var templ_7745c5c3_Var31 = []any{templ.KV("mt-4", data.IcebergPort > 0)}
+				templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var31...)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "<h6 class=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var32 string
+				templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var31).String())
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 1, Col: 0}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var32)
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "\"><span class=\"badge bg-success me-2\">LANCE</span>Python (lance-namespace)</h6><pre class=\"bg-light p-3 border rounded\"><code id=\"s3tables-lance-namespace-example\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var33 string
+				templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinStringErrs(`from lance_namespace import connect
+
+ns = connect("rest", {"uri": "http://localhost:` + fmt.Sprintf("%d", data.LancePort) + `"})
+
+ns.list_namespaces(id=["my-table-bucket"])
+ns.describe_table(id=["my-table-bucket", "my-namespace", "my-table"])`)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 281, Col: 70}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</code></pre><h6 class=\"mt-4\"><span class=\"badge bg-success me-2\">LANCE</span>Python (pylance)</h6><pre class=\"bg-light p-3 border rounded\"><code id=\"s3tables-pylance-example\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var34 string
+				templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(`import lance
+from lance_namespace import connect
+
+ns = connect("rest", {"uri": "http://localhost:` + fmt.Sprintf("%d", data.LancePort) + `"})
+table = ns.describe_table(id=["my-table-bucket", "my-namespace", "my-table"])
+
+# The namespace vends both the location and the credentials to read it.
+dataset = lance.dataset(table.location, storage_options=table.storage_options)`)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 294, Col: 79}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "</code></pre>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</code></pre><script>\n\t\t\t\t\t\t\t\tconst s3tablesExamplesHost = window.location.hostname;\n\t\t\t\t\t\t\t\tconst s3tablesExamples = [\n\t\t\t\t\t\t\t\t\tdocument.getElementById('s3tables-duckdb-example'),\n\t\t\t\t\t\t\t\t\tdocument.getElementById('s3tables-pyiceberg-example')\n\t\t\t\t\t\t\t\t];\n\t\t\t\t\t\t\t\ts3tablesExamples.forEach(example => {\n\t\t\t\t\t\t\t\t\tif (!example) {\n\t\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\texample.textContent = example.textContent.replaceAll('localhost', s3tablesExamplesHost);\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t</script></div></div></div></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 57, "<script>\n\t\t\t\t\t\t\t\tconst s3tablesExamplesHost = window.location.hostname;\n\t\t\t\t\t\t\t\tconst s3tablesExamples = [\n\t\t\t\t\t\t\t\t\tdocument.getElementById('s3tables-duckdb-example'),\n\t\t\t\t\t\t\t\t\tdocument.getElementById('s3tables-pyiceberg-example'),\n\t\t\t\t\t\t\t\t\tdocument.getElementById('s3tables-lance-namespace-example'),\n\t\t\t\t\t\t\t\t\tdocument.getElementById('s3tables-pylance-example')\n\t\t\t\t\t\t\t\t];\n\t\t\t\t\t\t\t\ts3tablesExamples.forEach(example => {\n\t\t\t\t\t\t\t\t\tif (!example) {\n\t\t\t\t\t\t\t\t\t\treturn;\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t\texample.textContent = example.textContent.replaceAll('localhost', s3tablesExamplesHost);\n\t\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\t</script></div></div></div></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</div><div class=\"modal fade\" id=\"createS3TablesBucketModal\" tabindex=\"-1\" aria-labelledby=\"createS3TablesBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createS3TablesBucketModalLabel\"><i class=\"fas fa-plus me-2\"></i>Create Table Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createS3TablesBucketForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label for=\"s3tablesBucketName\" class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesBucketName\" name=\"name\" placeholder=\"table-bucket-name\" required></div><div class=\"mb-3\"><label for=\"s3tablesBucketOwner\" class=\"form-label\">Owner (Optional)</label> <select class=\"form-select\" id=\"s3tablesBucketOwner\" name=\"owner\"><option value=\"\">No owner (admin-only access)</option></select><div class=\"form-text\">The S3 identity that owns this table bucket. Non-admin users can only access table buckets they own.</div></div><div class=\"mb-3\"><label for=\"s3tablesBucketTags\" class=\"form-label\">Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesBucketTags\" name=\"tags\" placeholder=\"key1=value1,key2=value2\"><div class=\"form-text\">Optional tags in key=value format.</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteS3TablesBucketModal\" tabindex=\"-1\" aria-labelledby=\"deleteS3TablesBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteS3TablesBucketModalLabel\"><i class=\"fas fa-exclamation-triangle me-2 text-warning\"></i>Delete Table Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the table bucket <strong id=\"deleteS3TablesBucketName\"></strong>?</p></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteS3TablesBucket()\"><i class=\"fas fa-trash me-1\"></i>Delete</button></div></div></div></div><div class=\"modal fade\" id=\"s3tablesBucketPolicyModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesBucketPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesBucketPolicyModalLabel\"><i class=\"fas fa-shield-alt me-2\"></i>Table Bucket Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesBucketPolicyForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesBucketPolicyArn\" name=\"bucket_arn\"><div class=\"mb-3\"><label for=\"s3tablesBucketPolicyText\" class=\"form-label\">Policy JSON</label> <textarea class=\"form-control\" id=\"s3tablesBucketPolicyText\" name=\"policy\" rows=\"12\" placeholder=\"{ }\"></textarea></div><div class=\"form-text\">Provide a policy JSON; use Delete Policy to remove the policy.</div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" onclick=\"deleteS3TablesBucketPolicy()\"><i class=\"fas fa-trash me-1\"></i>Delete Policy</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-save me-1\"></i>Save Policy</button></div></form></div></div></div><div class=\"modal fade\" id=\"s3tablesTagsModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesTagsModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesTagsModalLabel\"><i class=\"fas fa-tags me-2\"></i>Resource Tags</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesTagsForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesTagsResourceArn\" name=\"resource_arn\"><div class=\"mb-3\"><label class=\"form-label\">Existing Tags</label><pre class=\"bg-light p-3 border rounded\" id=\"s3tablesTagsList\">Loading...</pre></div><div class=\"mb-3\"><label for=\"s3tablesTagsInput\" class=\"form-label\">Add or Update Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsInput\" placeholder=\"key1=value1,key2=value2\"></div><div class=\"mb-3\"><label for=\"s3tablesTagsDeleteInput\" class=\"form-label\">Remove Tag Keys</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsDeleteInput\" placeholder=\"key1,key2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" onclick=\"deleteS3TablesTags()\"><i class=\"fas fa-trash me-1\"></i>Remove Tags</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-save me-1\"></i>Update Tags</button></div></form></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitS3TablesBuckets();\n\t\t});\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "</div><div class=\"modal fade\" id=\"createS3TablesBucketModal\" tabindex=\"-1\" aria-labelledby=\"createS3TablesBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createS3TablesBucketModalLabel\"><i class=\"bi bi-plus me-2\"></i>Create Table Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createS3TablesBucketForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label for=\"s3tablesBucketName\" class=\"form-label\">Bucket Name</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesBucketName\" name=\"name\" placeholder=\"table-bucket-name\" required></div><div class=\"mb-3\"><label class=\"form-label\">Table Format</label><div class=\"row g-2\" id=\"s3tablesBucketFormatPicker\"><div class=\"col-6\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if data.IcebergPort > 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 59, "<input type=\"radio\" class=\"btn-check\" name=\"format\" id=\"s3tablesBucketFormatIceberg\" value=\"ICEBERG\" checked> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "<input type=\"radio\" class=\"btn-check\" name=\"format\" id=\"s3tablesBucketFormatIceberg\" value=\"ICEBERG\" disabled> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "<label class=\"btn btn-outline-primary w-100 text-start p-3\" for=\"s3tablesBucketFormatIceberg\"><span class=\"d-block fw-semibold\"><i class=\"bi bi-snow me-1\"></i>Iceberg</span> <span class=\"d-block small text-muted mt-1\">Served over the Iceberg REST catalog. Spark, Trino, PyIceberg, DuckDB, OLake Go.</span></label></div><div class=\"col-6\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if data.LancePort > 0 && data.IcebergPort <= 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 62, " <input type=\"radio\" class=\"btn-check\" name=\"format\" id=\"s3tablesBucketFormatLance\" value=\"LANCE\" checked> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else if data.LancePort > 0 {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "<input type=\"radio\" class=\"btn-check\" name=\"format\" id=\"s3tablesBucketFormatLance\" value=\"LANCE\"> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 64, "<input type=\"radio\" class=\"btn-check\" name=\"format\" id=\"s3tablesBucketFormatLance\" value=\"LANCE\" disabled> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "<label class=\"btn btn-outline-success w-100 text-start p-3\" for=\"s3tablesBucketFormatLance\"><span class=\"d-block fw-semibold\"><i class=\"bi bi-bounding-box me-1\"></i>Lance</span> <span class=\"d-block small text-muted mt-1\">Served over the Lance Namespace API. pylance, LanceDB, Ray.</span></label></div></div><div class=\"form-text\" id=\"s3tablesBucketFormatHint\" data-iceberg-port=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var35 string
+		templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.IcebergPort))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 363, Col: 115}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var35)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "\" data-lance-port=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var36 string
+		templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.LancePort))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_buckets.templ`, Line: 363, Col: 169}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var36)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "\">A bucket holds one format. Tables of the other are refused.</div></div><div class=\"mb-3\"><label for=\"s3tablesBucketOwner\" class=\"form-label\">Owner (Optional)</label> <select class=\"form-select\" id=\"s3tablesBucketOwner\" name=\"owner\"><option value=\"\">No owner (admin-only access)</option></select><div class=\"form-text\">The S3 identity that owns this table bucket. Non-admin users can only access table buckets they own.</div></div><div class=\"mb-3\"><label for=\"s3tablesBucketTags\" class=\"form-label\">Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesBucketTags\" name=\"tags\" placeholder=\"key1=value1,key2=value2\"><div class=\"form-text\">Optional tags in key=value format.</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteS3TablesBucketModal\" tabindex=\"-1\" aria-labelledby=\"deleteS3TablesBucketModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteS3TablesBucketModalLabel\"><i class=\"bi bi-exclamation-triangle me-2 text-warning\"></i>Delete Table Bucket</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the table bucket <strong id=\"deleteS3TablesBucketName\"></strong>?</p></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteS3TablesBucket()\"><i class=\"bi bi-trash me-1\"></i>Delete</button></div></div></div></div>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "<div class=\"modal fade\" id=\"s3tablesBucketPolicyModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesBucketPolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesBucketPolicyModalLabel\"><i class=\"bi bi-shield me-2\"></i>Table Bucket Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesBucketPolicyForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesBucketPolicyArn\" name=\"bucket_arn\"><ul class=\"nav nav-tabs\" role=\"tablist\"><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link active\" id=\"s3tablesBucketPolicyEditorTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#s3tablesBucketPolicyEditorTab\" role=\"tab\" aria-controls=\"s3tablesBucketPolicyEditorTab\" aria-selected=\"true\">Editor</button></li><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link\" id=\"s3tablesBucketPolicyJsonTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#s3tablesBucketPolicyJsonTab\" role=\"tab\" aria-controls=\"s3tablesBucketPolicyJsonTab\" aria-selected=\"false\">JSON</button></li></ul><div class=\"tab-content border border-top-0 rounded-bottom p-3 mb-3\"><div class=\"tab-pane fade show active\" id=\"s3tablesBucketPolicyEditorTab\" role=\"tabpanel\" aria-labelledby=\"s3tablesBucketPolicyEditorTabBtn\"><div id=\"s3tablesBucketPolicyEditorBody\"></div><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"s3tablesBucketPolicyAddStatementBtn\"><i class=\"bi bi-plus me-1\"></i>Add statement</button></div><div class=\"tab-pane fade\" id=\"s3tablesBucketPolicyJsonTab\" role=\"tabpanel\" aria-labelledby=\"s3tablesBucketPolicyJsonTabBtn\"><textarea class=\"form-control\" id=\"s3tablesBucketPolicyText\" name=\"policy\" rows=\"12\" placeholder=\"{ }\"></textarea></div></div><div class=\"form-text\">Provide a policy JSON; use Delete Policy to remove the policy.</div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" id=\"s3tablesBucketPolicyDeleteBtn\" onclick=\"deleteS3TablesBucketPolicy()\"><i class=\"bi bi-trash me-1\"></i>Delete Policy</button><!-- type=\"button\": a submit button would make Enter in any\n\t\t\t\t\t\t     single-line editor input implicitly submit a half-built\n\t\t\t\t\t\t     policy, which the backend stores verbatim. --><button type=\"button\" class=\"btn btn-primary\" id=\"s3tablesBucketPolicySaveBtn\"><i class=\"bi bi-floppy me-1\"></i>Save Policy</button></div></form></div></div></div><div class=\"modal fade\" id=\"s3tablesTagsModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesTagsModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesTagsModalLabel\"><i class=\"bi bi-tags me-2\"></i>Resource Tags</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesTagsForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesTagsResourceArn\" name=\"resource_arn\"><div class=\"mb-3\"><label class=\"form-label\">Existing Tags</label><pre class=\"bg-light p-3 border rounded\" id=\"s3tablesTagsList\">Loading...</pre></div><div class=\"mb-3\"><label for=\"s3tablesTagsInput\" class=\"form-label\">Add or Update Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsInput\" placeholder=\"key1=value1,key2=value2\"></div><div class=\"mb-3\"><label for=\"s3tablesTagsDeleteInput\" class=\"form-label\">Remove Tag Keys</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsDeleteInput\" placeholder=\"key1,key2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" onclick=\"deleteS3TablesTags()\"><i class=\"bi bi-trash me-1\"></i>Remove Tags</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-floppy me-1\"></i>Update Tags</button></div></form></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitS3TablesBuckets();\n\t\t});\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/s3tables_namespaces.templ b/weed/admin/view/app/s3tables_namespaces.templ
index ee345e31c4..f4a30022f6 100644
--- a/weed/admin/view/app/s3tables_namespaces.templ
+++ b/weed/admin/view/app/s3tables_namespaces.templ
@@ -11,19 +11,20 @@ import (
 templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-layer-group me-2"></i>S3 Tables Namespaces
+			<i class="bi bi-layers me-2"></i>S3 Tables Namespaces
+			<span class={ formatBadgeClass(data.BucketFormat), "ms-2 align-middle" } title={ formatBadgeTitle(data.BucketFormat) }>{ formatLabel(data.BucketFormat) }</span>
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-primary" data-bs-toggle="modal" data-bs-target="#createS3TablesNamespaceModal">
-					<i class="fas fa-plus me-1"></i>Create Namespace
+					<i class="bi bi-plus me-1"></i>Create Namespace
 				</button>
 			</div>
 		</div>
 	</div>
 	<div class="mb-3">
 		<a href={ dash.PUrl(ctx, "/object-store/s3tables/buckets") } class="btn btn-sm btn-outline-secondary">
-			<i class="fas fa-arrow-left me-1"></i>Back to Buckets
+			<i class="bi bi-arrow-left me-1"></i>Back to Buckets
 		</a>
 		<span class="text-muted ms-2">Bucket ARN: { data.BucketARN }</span>
 		{{ bucketName, parseErr := s3tables.ParseBucketNameFromARN(data.BucketARN) }}
@@ -46,7 +47,7 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-layer-group fa-2x text-gray-300"></i>
+								<i class="bi bi-layers icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -65,7 +66,7 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-clock fa-2x text-gray-300"></i>
+								<i class="bi bi-clock icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -77,7 +78,7 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-layer-group me-2"></i>Namespaces
+							<i class="bi bi-layers me-2"></i>Namespaces
 						</h6>
 					</div>
 					<div class="card-body">
@@ -108,15 +109,15 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 												<div class="btn-group btn-group-sm" role="group">
 													if parseErr == nil {
 														<a class="btn btn-outline-primary btn-sm" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables", bucketName, namespaceName)) }>
-															<i class="fas fa-table"></i>
+															<i class="bi bi-table"></i>
 														</a>
 													} else {
 														<button type="button" class="btn btn-outline-primary btn-sm" disabled title="Invalid bucket ARN">
-															<i class="fas fa-table"></i>
+															<i class="bi bi-table"></i>
 														</button>
 													}
 													<button type="button" class="btn btn-outline-danger btn-sm s3tables-delete-namespace-btn" data-namespace-name={ namespaceName } title="Delete">
-														<i class="fas fa-trash"></i>
+														<i class="bi bi-trash"></i>
 													</button>
 												</div>
 											</td>
@@ -125,12 +126,12 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 									if len(data.Namespaces) == 0 {
 										<tr>
 											<td colspan="4" class="text-center text-muted py-4">
-												<i class="fas fa-layer-group fa-3x mb-3 text-muted"></i>
+												<i class="bi bi-layers icon-3x mb-3 text-muted"></i>
 												<div>
 													<h5>No namespaces found</h5>
 													<p>Create your first namespace to organize tables.</p>
 													<button type="button" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#createS3TablesNamespaceModal">
-														<i class="fas fa-plus me-1"></i>Create Namespace
+														<i class="bi bi-plus me-1"></i>Create Namespace
 													</button>
 												</div>
 											</td>
@@ -149,7 +150,7 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="createS3TablesNamespaceModalLabel">
-						<i class="fas fa-plus me-2"></i>Create Namespace
+						<i class="bi bi-plus me-2"></i>Create Namespace
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -165,7 +166,7 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-plus me-1"></i>Create
+							<i class="bi bi-plus me-1"></i>Create
 						</button>
 					</div>
 				</form>
@@ -177,7 +178,7 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="deleteS3TablesNamespaceModalLabel">
-						<i class="fas fa-exclamation-triangle me-2 text-warning"></i>Delete Namespace
+						<i class="bi bi-exclamation-triangle me-2 text-warning"></i>Delete Namespace
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -187,7 +188,7 @@ templ S3TablesNamespaces(data dash.S3TablesNamespacesData) {
 				<div class="modal-footer">
 					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 					<button type="button" class="btn btn-danger" onclick="deleteS3TablesNamespace()">
-						<i class="fas fa-trash me-1"></i>Delete
+						<i class="bi bi-trash me-1"></i>Delete
 					</button>
 				</div>
 			</div>
diff --git a/weed/admin/view/app/s3tables_namespaces_templ.go b/weed/admin/view/app/s3tables_namespaces_templ.go
index 54f701eaef..3ba6dd5d22 100644
--- a/weed/admin/view/app/s3tables_namespaces_templ.go
+++ b/weed/admin/view/app/s3tables_namespaces_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -37,225 +37,273 @@ func S3TablesNamespaces(data dash.S3TablesNamespacesData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-layer-group me-2\"></i>S3 Tables Namespaces</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesNamespaceModal\"><i class=\"fas fa-plus me-1\"></i>Create Namespace</button></div></div></div><div class=\"mb-3\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-layers me-2\"></i>S3 Tables Namespaces ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var2 templ.SafeURL
-		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/object-store/s3tables/buckets"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 25, Col: 60}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
+		var templ_7745c5c3_Var2 = []any{formatBadgeClass(data.BucketFormat), "ms-2 align-middle"}
+		templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var2...)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-arrow-left me-1\"></i>Back to Buckets</a> <span class=\"text-muted ms-2\">Bucket ARN: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<span class=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var3 string
-		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 28, Col: 60}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 1, Col: 0}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</span>")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		bucketName, parseErr := s3tables.ParseBucketNameFromARN(data.BucketARN)
-		if parseErr != nil {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<span class=\"text-danger ms-2\">Invalid bucket ARN</span>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</div><div id=\"s3tables-namespaces-content\" data-bucket-arn=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\" title=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var4 string
-		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(formatBadgeTitle(data.BucketFormat))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 34, Col: 71}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 15, Col: 119}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "\"><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Namespaces</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var5 string
-		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalNamespaces))
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(formatLabel(data.BucketFormat))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 45, Col: 50}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 15, Col: 154}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</div></div><div class=\"col-auto\"><i class=\"fas fa-layer-group fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</span></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesNamespaceModal\"><i class=\"bi bi-plus me-1\"></i>Create Namespace</button></div></div></div><div class=\"mb-3\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var6 string
-		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("15:04"))
+		var templ_7745c5c3_Var6 templ.SafeURL
+		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, "/object-store/s3tables/buckets"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 64, Col: 43}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 26, Col: 60}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-layer-group me-2\"></i>Namespaces</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"s3tablesNamespacesTable\"><thead><tr><th>Namespace</th><th>Iceberg Endpoint</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-arrow-left me-1\"></i>Back to Buckets</a> <span class=\"text-muted ms-2\">Bucket ARN: ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var7 string
+		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 29, Col: 60}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</span>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		bucketName, parseErr := s3tables.ParseBucketNameFromARN(data.BucketARN)
+		if parseErr != nil {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "<span class=\"text-danger ms-2\">Invalid bucket ARN</span>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</div><div id=\"s3tables-namespaces-content\" data-bucket-arn=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var8 string
+		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 35, Col: 71}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var8)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "\"><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Namespaces</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var9 string
+		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalNamespaces))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 46, Col: 50}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</div></div><div class=\"col-auto\"><i class=\"bi bi-layers icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var10 string
+		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("15:04"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 65, Col: 43}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-layers me-2\"></i>Namespaces</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"s3tablesNamespacesTable\"><thead><tr><th>Namespace</th><th>Iceberg Endpoint</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, namespace := range data.Namespaces {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "<tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			namespaceName := strings.Join(namespace.Namespace, ".")
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var7 string
-			templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(namespaceName)
+			var templ_7745c5c3_Var11 string
+			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(namespaceName)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 98, Col: 30}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 99, Col: 30}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if parseErr == nil {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<code class=\"small\">/v1/")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<code class=\"small\">/v1/")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var8 string
-				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(bucketName)
+				var templ_7745c5c3_Var12 string
+				templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(bucketName)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 101, Col: 49}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 102, Col: 49}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "/namespaces/")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "/namespaces/")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var9 string
-				templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(namespaceName)
+				var templ_7745c5c3_Var13 string
+				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(namespaceName)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 101, Col: 78}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 102, Col: 78}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "/tables</code>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "/tables</code>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "<span class=\"text-muted\">-</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<span class=\"text-muted\">-</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(namespace.CreatedAt.Format("2006-01-02 15:04"))
+			var templ_7745c5c3_Var14 string
+			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(namespace.CreatedAt.Format("2006-01-02 15:04"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 106, Col: 63}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 107, Col: 63}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			if parseErr == nil {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<a class=\"btn btn-outline-primary btn-sm\" href=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<a class=\"btn btn-outline-primary btn-sm\" href=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var11 templ.SafeURL
-				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables", bucketName, namespaceName)))
+				var templ_7745c5c3_Var15 templ.SafeURL
+				templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables", bucketName, namespaceName)))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 110, Col: 175}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 111, Col: 175}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\"><i class=\"fas fa-table\"></i></a> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "\"><i class=\"bi bi-table\"></i></a> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" disabled title=\"Invalid bucket ARN\"><i class=\"fas fa-table\"></i></button> ")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" disabled title=\"Invalid bucket ARN\"><i class=\"bi bi-table\"></i></button> ")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<button type=\"button\" class=\"btn btn-outline-danger btn-sm s3tables-delete-namespace-btn\" data-namespace-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<button type=\"button\" class=\"btn btn-outline-danger btn-sm s3tables-delete-namespace-btn\" data-namespace-name=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(namespaceName)
+			var templ_7745c5c3_Var16 string
+			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(namespaceName)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 118, Col: 138}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 119, Col: 138}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\" title=\"Delete\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "\" title=\"Delete\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.Namespaces) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"fas fa-layer-group fa-3x mb-3 text-muted\"></i><div><h5>No namespaces found</h5><p>Create your first namespace to organize tables.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesNamespaceModal\"><i class=\"fas fa-plus me-1\"></i>Create Namespace</button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<tr><td colspan=\"4\" class=\"text-center text-muted py-4\"><i class=\"bi bi-layers icon-3x mb-3 text-muted\"></i><div><h5>No namespaces found</h5><p>Create your first namespace to organize tables.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesNamespaceModal\"><i class=\"bi bi-plus me-1\"></i>Create Namespace</button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createS3TablesNamespaceModal\" tabindex=\"-1\" aria-labelledby=\"createS3TablesNamespaceModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createS3TablesNamespaceModalLabel\"><i class=\"fas fa-plus me-2\"></i>Create Namespace</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createS3TablesNamespaceForm\"><div class=\"modal-body\"><input type=\"hidden\" name=\"bucket_arn\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createS3TablesNamespaceModal\" tabindex=\"-1\" aria-labelledby=\"createS3TablesNamespaceModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createS3TablesNamespaceModalLabel\"><i class=\"bi bi-plus me-2\"></i>Create Namespace</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createS3TablesNamespaceForm\"><div class=\"modal-body\"><input type=\"hidden\" name=\"bucket_arn\" value=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var13 string
-		templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		var templ_7745c5c3_Var17 string
+		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 158, Col: 68}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_namespaces.templ`, Line: 159, Col: 68}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "\"><div class=\"mb-3\"><label for=\"s3tablesNamespaceName\" class=\"form-label\">Namespace</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesNamespaceName\" name=\"name\" placeholder=\"analytics\" required><div class=\"form-text\">Use lowercase letters, numbers, and underscores. Use dots for nested namespaces (for example, analytics.daily).</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteS3TablesNamespaceModal\" tabindex=\"-1\" aria-labelledby=\"deleteS3TablesNamespaceModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteS3TablesNamespaceModalLabel\"><i class=\"fas fa-exclamation-triangle me-2 text-warning\"></i>Delete Namespace</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the namespace <strong id=\"deleteS3TablesNamespaceName\"></strong>?</p></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteS3TablesNamespace()\"><i class=\"fas fa-trash me-1\"></i>Delete</button></div></div></div></div><script>\n\t\tlet s3tablesNamespaceDeleteModalInstance = null;\n\t\tconst dataBucketArn = document.getElementById('s3tables-namespaces-content').dataset.bucketArn || '';\n\t\tconst csrfTokenMeta = document.querySelector('meta[name=\"csrf-token\"]');\n\t\tconst csrfToken = csrfTokenMeta ? (csrfTokenMeta.getAttribute('content') || '') : '';\n\n\t\tfunction makeJSONHeaders() {\n\t\t\tconst headers = { 'Content-Type': 'application/json' };\n\t\t\tif (csrfToken) {\n\t\t\t\theaders['X-CSRF-Token'] = csrfToken;\n\t\t\t}\n\t\t\treturn headers;\n\t\t}\n\n\t\tasync function readErrorMessage(response, fallbackMessage) {\n\t\t\tconst responseBody = await response.text();\n\t\t\tif (!responseBody) {\n\t\t\t\treturn fallbackMessage;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst payload = JSON.parse(responseBody);\n\t\t\t\tif (payload && typeof payload.error === 'string' && payload.error) {\n\t\t\t\t\treturn payload.error;\n\t\t\t\t}\n\t\t\t\tif (payload && typeof payload.message === 'string' && payload.message) {\n\t\t\t\t\treturn payload.message;\n\t\t\t\t}\n\t\t\t} catch (parseError) {\n\t\t\t\t// Fall through to the raw response body when parsing fails.\n\t\t\t}\n\t\t\treturn responseBody;\n\t\t}\n\n\t\tfunction validateNamespaceInput(input, allowEmpty) {\n\t\t\tif (typeof window.applyS3TablesNamespaceNameValidity === 'function') {\n\t\t\t\treturn window.applyS3TablesNamespaceNameValidity(input, allowEmpty);\n\t\t\t}\n\t\t\tconst name = (input.value || '').trim();\n\t\t\tif (allowEmpty && name === '') {\n\t\t\t\tinput.setCustomValidity('');\n\t\t\t\treturn '';\n\t\t\t}\n\t\t\t\tlet message = '';\n\t\t\t\tif (!name) {\n\t\t\t\t\tmessage = 'Namespace name is required';\n\t\t\t\t} else if (name.length < 1 || name.length > 255) {\n\t\t\t\t\tmessage = 'Namespace name must be between 1 and 255 characters';\n\t\t\t\t} else if (name === '.' || name === '..') {\n\t\t\t\t\tmessage = \"namespace name cannot be '.' or '..'\";\n\t\t\t\t} else if (name.includes('/')) {\n\t\t\t\t\tmessage = \"namespace name cannot contain '/'\";\n\t\t\t\t} else {\n\t\t\t\t\tfor (const part of name.split('.')) {\n\t\t\t\t\t\tif (!part) {\n\t\t\t\t\t\t\tmessage = 'namespace levels cannot be empty';\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst start = part[0];\n\t\t\t\t\t\tconst end = part[part.length - 1];\n\t\t\t\t\t\tconst isStartValid = (start >= 'a' && start <= 'z') || (start >= '0' && start <= '9');\n\t\t\t\t\t\tconst isEndValid = (end >= 'a' && end <= 'z') || (end >= '0' && end <= '9');\n\t\t\t\t\t\tif (!isStartValid) {\n\t\t\t\t\t\t\tmessage = 'Namespace name must start with a letter or digit';\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (!isEndValid) {\n\t\t\t\t\t\t\tmessage = 'Namespace name must end with a letter or digit';\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tfor (const ch of part) {\n\t\t\t\t\t\t\tconst isLower = ch >= 'a' && ch <= 'z';\n\t\t\t\t\t\t\tconst isDigit = ch >= '0' && ch <= '9';\n\t\t\t\t\t\t\tif (!(isLower || isDigit || ch === '_')) {\n\t\t\t\t\t\t\t\tmessage = \"invalid namespace name: only 'a-z', '0-9', and '_' are allowed\";\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (message) {\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (part.startsWith('aws')) {\n\t\t\t\t\t\t\tmessage = \"namespace name cannot start with reserved prefix 'aws'\";\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tinput.setCustomValidity(message);\n\t\t\t\treturn message;\n\t\t\t}\n\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\ts3tablesNamespaceDeleteModalInstance = new bootstrap.Modal(document.getElementById('deleteS3TablesNamespaceModal'));\n\n\t\t\tdocument.querySelectorAll('.s3tables-delete-namespace-btn').forEach(button => {\n\t\t\t\tbutton.addEventListener('click', function() {\n\t\t\t\t\tdocument.getElementById('deleteS3TablesNamespaceName').textContent = this.dataset.namespaceName || '';\n\t\t\t\t\tdocument.getElementById('deleteS3TablesNamespaceModal').dataset.namespaceName = this.dataset.namespaceName || '';\n\t\t\t\t\ts3tablesNamespaceDeleteModalInstance.show();\n\t\t\t\t});\n\t\t\t});\n\n\t\t\tconst namespaceInput = document.getElementById('s3tablesNamespaceName');\n\t\t\tif (namespaceInput) {\n\t\t\t\tnamespaceInput.addEventListener('input', function() {\n\t\t\t\t\tvalidateNamespaceInput(this, true);\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tdocument.getElementById('createS3TablesNamespaceForm').addEventListener('submit', async function(e) {\n\t\t\t\te.preventDefault();\n\t\t\t\tconst namespaceInput = document.getElementById('s3tablesNamespaceName');\n\t\t\t\tconst name = namespaceInput.value.trim();\n\t\t\t\tconst nameError = validateNamespaceInput(namespaceInput, false);\n\t\t\t\tif (nameError) {\n\t\t\t\t\tnamespaceInput.reportValidity();\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await fetch((window.__BASE_PATH__ || '') + '/api/s3tables/namespaces', {\n\t\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\t\theaders: makeJSONHeaders(),\n\t\t\t\t\t\tbody: JSON.stringify({ bucket_arn: dataBucketArn, name: name })\n\t\t\t\t\t});\n\t\t\t\t\tif (!response.ok) {\n\t\t\t\t\t\tconst errorMessage = await readErrorMessage(response, 'Failed to create namespace');\n\t\t\t\t\t\talert(errorMessage);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\talert('Namespace created');\n\t\t\t\t\tlocation.reload();\n\t\t\t\t} catch (error) {\n\t\t\t\t\talert('Failed to create namespace: ' + error.message);\n\t\t\t\t}\n\t\t\t});\n\n\t\t});\n\n\t\tasync function deleteS3TablesNamespace() {\n\t\t\tconst namespace = document.getElementById('deleteS3TablesNamespaceModal').dataset.namespaceName;\n\t\t\tif (!namespace) return;\n\t\t\ttry {\n\t\t\t\tconst requestOptions = { method: 'DELETE' };\n\t\t\t\tif (csrfToken) {\n\t\t\t\t\trequestOptions.headers = { 'X-CSRF-Token': csrfToken };\n\t\t\t\t}\n\t\t\t\tconst response = await fetch((window.__BASE_PATH__ || '') + `/api/s3tables/namespaces?bucket=${encodeURIComponent(dataBucketArn)}&name=${encodeURIComponent(namespace)}`, requestOptions);\n\t\t\t\tif (!response.ok) {\n\t\t\t\t\tconst errorMessage = await readErrorMessage(response, 'Failed to delete namespace');\n\t\t\t\t\talert(errorMessage);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\talert('Namespace deleted');\n\t\t\t\tlocation.reload();\n\t\t\t} catch (error) {\n\t\t\t\talert('Failed to delete namespace: ' + error.message);\n\t\t\t}\n\t\t}\n\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\"><div class=\"mb-3\"><label for=\"s3tablesNamespaceName\" class=\"form-label\">Namespace</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesNamespaceName\" name=\"name\" placeholder=\"analytics\" required><div class=\"form-text\">Use lowercase letters, numbers, and underscores. Use dots for nested namespaces (for example, analytics.daily).</div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteS3TablesNamespaceModal\" tabindex=\"-1\" aria-labelledby=\"deleteS3TablesNamespaceModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteS3TablesNamespaceModalLabel\"><i class=\"bi bi-exclamation-triangle me-2 text-warning\"></i>Delete Namespace</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the namespace <strong id=\"deleteS3TablesNamespaceName\"></strong>?</p></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteS3TablesNamespace()\"><i class=\"bi bi-trash me-1\"></i>Delete</button></div></div></div></div><script>\n\t\tlet s3tablesNamespaceDeleteModalInstance = null;\n\t\tconst dataBucketArn = document.getElementById('s3tables-namespaces-content').dataset.bucketArn || '';\n\t\tconst csrfTokenMeta = document.querySelector('meta[name=\"csrf-token\"]');\n\t\tconst csrfToken = csrfTokenMeta ? (csrfTokenMeta.getAttribute('content') || '') : '';\n\n\t\tfunction makeJSONHeaders() {\n\t\t\tconst headers = { 'Content-Type': 'application/json' };\n\t\t\tif (csrfToken) {\n\t\t\t\theaders['X-CSRF-Token'] = csrfToken;\n\t\t\t}\n\t\t\treturn headers;\n\t\t}\n\n\t\tasync function readErrorMessage(response, fallbackMessage) {\n\t\t\tconst responseBody = await response.text();\n\t\t\tif (!responseBody) {\n\t\t\t\treturn fallbackMessage;\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst payload = JSON.parse(responseBody);\n\t\t\t\tif (payload && typeof payload.error === 'string' && payload.error) {\n\t\t\t\t\treturn payload.error;\n\t\t\t\t}\n\t\t\t\tif (payload && typeof payload.message === 'string' && payload.message) {\n\t\t\t\t\treturn payload.message;\n\t\t\t\t}\n\t\t\t} catch (parseError) {\n\t\t\t\t// Fall through to the raw response body when parsing fails.\n\t\t\t}\n\t\t\treturn responseBody;\n\t\t}\n\n\t\tfunction validateNamespaceInput(input, allowEmpty) {\n\t\t\tif (typeof window.applyS3TablesNamespaceNameValidity === 'function') {\n\t\t\t\treturn window.applyS3TablesNamespaceNameValidity(input, allowEmpty);\n\t\t\t}\n\t\t\tconst name = (input.value || '').trim();\n\t\t\tif (allowEmpty && name === '') {\n\t\t\t\tinput.setCustomValidity('');\n\t\t\t\treturn '';\n\t\t\t}\n\t\t\t\tlet message = '';\n\t\t\t\tif (!name) {\n\t\t\t\t\tmessage = 'Namespace name is required';\n\t\t\t\t} else if (name.length < 1 || name.length > 255) {\n\t\t\t\t\tmessage = 'Namespace name must be between 1 and 255 characters';\n\t\t\t\t} else if (name === '.' || name === '..') {\n\t\t\t\t\tmessage = \"namespace name cannot be '.' or '..'\";\n\t\t\t\t} else if (name.includes('/')) {\n\t\t\t\t\tmessage = \"namespace name cannot contain '/'\";\n\t\t\t\t} else {\n\t\t\t\t\tfor (const part of name.split('.')) {\n\t\t\t\t\t\tif (!part) {\n\t\t\t\t\t\t\tmessage = 'namespace levels cannot be empty';\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tconst start = part[0];\n\t\t\t\t\t\tconst end = part[part.length - 1];\n\t\t\t\t\t\tconst isStartValid = (start >= 'a' && start <= 'z') || (start >= '0' && start <= '9');\n\t\t\t\t\t\tconst isEndValid = (end >= 'a' && end <= 'z') || (end >= '0' && end <= '9');\n\t\t\t\t\t\tif (!isStartValid) {\n\t\t\t\t\t\t\tmessage = 'Namespace name must start with a letter or digit';\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (!isEndValid) {\n\t\t\t\t\t\t\tmessage = 'Namespace name must end with a letter or digit';\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tfor (const ch of part) {\n\t\t\t\t\t\t\tconst isLower = ch >= 'a' && ch <= 'z';\n\t\t\t\t\t\t\tconst isDigit = ch >= '0' && ch <= '9';\n\t\t\t\t\t\t\tif (!(isLower || isDigit || ch === '_')) {\n\t\t\t\t\t\t\t\tmessage = \"invalid namespace name: only 'a-z', '0-9', and '_' are allowed\";\n\t\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (message) {\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tif (part.startsWith('aws')) {\n\t\t\t\t\t\t\tmessage = \"namespace name cannot start with reserved prefix 'aws'\";\n\t\t\t\t\t\t\tbreak;\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tinput.setCustomValidity(message);\n\t\t\t\treturn message;\n\t\t\t}\n\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\ts3tablesNamespaceDeleteModalInstance = new bootstrap.Modal(document.getElementById('deleteS3TablesNamespaceModal'));\n\n\t\t\tdocument.querySelectorAll('.s3tables-delete-namespace-btn').forEach(button => {\n\t\t\t\tbutton.addEventListener('click', function() {\n\t\t\t\t\tdocument.getElementById('deleteS3TablesNamespaceName').textContent = this.dataset.namespaceName || '';\n\t\t\t\t\tdocument.getElementById('deleteS3TablesNamespaceModal').dataset.namespaceName = this.dataset.namespaceName || '';\n\t\t\t\t\ts3tablesNamespaceDeleteModalInstance.show();\n\t\t\t\t});\n\t\t\t});\n\n\t\t\tconst namespaceInput = document.getElementById('s3tablesNamespaceName');\n\t\t\tif (namespaceInput) {\n\t\t\t\tnamespaceInput.addEventListener('input', function() {\n\t\t\t\t\tvalidateNamespaceInput(this, true);\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tdocument.getElementById('createS3TablesNamespaceForm').addEventListener('submit', async function(e) {\n\t\t\t\te.preventDefault();\n\t\t\t\tconst namespaceInput = document.getElementById('s3tablesNamespaceName');\n\t\t\t\tconst name = namespaceInput.value.trim();\n\t\t\t\tconst nameError = validateNamespaceInput(namespaceInput, false);\n\t\t\t\tif (nameError) {\n\t\t\t\t\tnamespaceInput.reportValidity();\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await fetch((window.__BASE_PATH__ || '') + '/api/s3tables/namespaces', {\n\t\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\t\theaders: makeJSONHeaders(),\n\t\t\t\t\t\tbody: JSON.stringify({ bucket_arn: dataBucketArn, name: name })\n\t\t\t\t\t});\n\t\t\t\t\tif (!response.ok) {\n\t\t\t\t\t\tconst errorMessage = await readErrorMessage(response, 'Failed to create namespace');\n\t\t\t\t\t\talert(errorMessage);\n\t\t\t\t\t\treturn;\n\t\t\t\t\t}\n\t\t\t\t\talert('Namespace created');\n\t\t\t\t\tlocation.reload();\n\t\t\t\t} catch (error) {\n\t\t\t\t\talert('Failed to create namespace: ' + error.message);\n\t\t\t\t}\n\t\t\t});\n\n\t\t});\n\n\t\tasync function deleteS3TablesNamespace() {\n\t\t\tconst namespace = document.getElementById('deleteS3TablesNamespaceModal').dataset.namespaceName;\n\t\t\tif (!namespace) return;\n\t\t\ttry {\n\t\t\t\tconst requestOptions = { method: 'DELETE' };\n\t\t\t\tif (csrfToken) {\n\t\t\t\t\trequestOptions.headers = { 'X-CSRF-Token': csrfToken };\n\t\t\t\t}\n\t\t\t\tconst response = await fetch((window.__BASE_PATH__ || '') + `/api/s3tables/namespaces?bucket=${encodeURIComponent(dataBucketArn)}&name=${encodeURIComponent(namespace)}`, requestOptions);\n\t\t\t\tif (!response.ok) {\n\t\t\t\t\tconst errorMessage = await readErrorMessage(response, 'Failed to delete namespace');\n\t\t\t\t\talert(errorMessage);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\talert('Namespace deleted');\n\t\t\t\tlocation.reload();\n\t\t\t} catch (error) {\n\t\t\t\talert('Failed to delete namespace: ' + error.message);\n\t\t\t}\n\t\t}\n\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/s3tables_tables.templ b/weed/admin/view/app/s3tables_tables.templ
index e27f2320ad..6e1b53f646 100644
--- a/weed/admin/view/app/s3tables_tables.templ
+++ b/weed/admin/view/app/s3tables_tables.templ
@@ -11,12 +11,13 @@ import (
 templ S3TablesTables(data dash.S3TablesTablesData) {
 	<div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
 		<h1 class="h2">
-			<i class="fas fa-table me-2"></i>S3 Tables
+			<i class="bi bi-table me-2"></i>S3 Tables
+			<span class={ formatBadgeClass(data.BucketFormat), "ms-2 align-middle" } title={ formatBadgeTitle(data.BucketFormat) }>{ formatLabel(data.BucketFormat) }</span>
 		</h1>
 		<div class="btn-toolbar mb-2 mb-md-0">
 			<div class="btn-group me-2">
 				<button type="button" class="btn btn-sm btn-primary" data-bs-toggle="modal" data-bs-target="#createS3TablesTableModal">
-					<i class="fas fa-plus me-1"></i>Create Table
+					<i class="bi bi-plus me-1"></i>Create Table
 				</button>
 			</div>
 		</div>
@@ -25,11 +26,11 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 		{{ bucketName, parseErr := s3tables.ParseBucketNameFromARN(data.BucketARN) }}
 		if parseErr == nil {
 			<a href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces", url.PathEscape(bucketName))) } class="btn btn-sm btn-outline-secondary">
-				<i class="fas fa-arrow-left me-1"></i>Back to Namespaces
+				<i class="bi bi-arrow-left me-1"></i>Back to Namespaces
 			</a>
 		} else {
 			<button type="button" class="btn btn-sm btn-outline-secondary" disabled title="Invalid bucket ARN">
-				<i class="fas fa-arrow-left me-1"></i>Back to Namespaces
+				<i class="bi bi-arrow-left me-1"></i>Back to Namespaces
 			</button>
 		}
 		<span class="text-muted ms-2">Bucket ARN: { data.BucketARN }</span>
@@ -53,7 +54,7 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-table fa-2x text-gray-300"></i>
+								<i class="bi bi-table icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -72,7 +73,7 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 								</div>
 							</div>
 							<div class="col-auto">
-								<i class="fas fa-clock fa-2x text-gray-300"></i>
+								<i class="bi bi-clock icon-2x text-gray-300"></i>
 							</div>
 						</div>
 					</div>
@@ -84,7 +85,7 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 				<div class="card shadow mb-4">
 					<div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
 						<h6 class="m-0 font-weight-bold text-primary">
-							<i class="fas fa-table me-2"></i>Tables
+							<i class="bi bi-table me-2"></i>Tables
 						</h6>
 					</div>
 					<div class="card-body">
@@ -93,6 +94,8 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 								<thead>
 									<tr>
 										<th>Name</th>
+										<th>Format</th>
+										<th>Rows</th>
 										<th>Table ARN</th>
 										<th>Created</th>
 										<th>Modified</th>
@@ -106,6 +109,16 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 										<tr>
 											{{ tableName := table.Name }}
 											<td>{ tableName }</td>
+											<td>
+												<span class={ formatBadgeClass(table.Format) } title={ formatBadgeTitle(table.Format) }>{ formatLabel(table.Format) }</span>
+											</td>
+											<td>
+												if rows, ok := data.ObservedRows[tableName]; ok {
+													<span title="Reported by a plugin worker">{ rows }</span>
+												} else {
+													<span class="text-muted">&mdash;</span>
+												}
+											</td>
 											<td class="text-muted small">{ table.TableARN }</td>
 											<td>{ table.CreatedAt.Format("2006-01-02 15:04") }</td>
 											<td>{ table.ModifiedAt.Format("2006-01-02 15:04") }</td>
@@ -126,22 +139,22 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 											<td>
 												<div class="btn-group btn-group-sm" role="group">
 													if parseErr == nil {
-														<a class="btn btn-outline-primary btn-sm" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(bucketName), url.PathEscape(data.Namespace), url.PathEscape(tableName))) } title="View Iceberg Details">
-															<i class="fas fa-eye"></i>
+														<a class="btn btn-outline-primary btn-sm" href={ dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(bucketName), url.PathEscape(data.Namespace), url.PathEscape(tableName))) } title="View Table Details">
+															<i class="bi bi-eye"></i>
 														</a>
 													} else {
 														<button type="button" class="btn btn-outline-primary btn-sm" disabled title="Invalid bucket ARN">
-															<i class="fas fa-eye"></i>
+															<i class="bi bi-eye"></i>
 														</button>
 													}
 													<button type="button" class="btn btn-outline-success btn-sm s3tables-tags-btn" data-resource-arn={ table.TableARN } title="Tags">
-														<i class="fas fa-tags"></i>
+														<i class="bi bi-tags"></i>
 													</button>
 													<button type="button" class="btn btn-outline-info btn-sm s3tables-table-policy-btn" data-table-arn={ table.TableARN } data-table-name={ tableName } title="Table Policy">
-														<i class="fas fa-shield-alt"></i>
+														<i class="bi bi-shield"></i>
 													</button>
 													<button type="button" class="btn btn-outline-danger btn-sm s3tables-delete-table-btn" data-table-name={ tableName } title="Delete">
-														<i class="fas fa-trash"></i>
+														<i class="bi bi-trash"></i>
 													</button>
 												</div>
 											</td>
@@ -149,13 +162,13 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 									}
 									if len(data.Tables) == 0 {
 										<tr>
-											<td colspan="7" class="text-center text-muted py-4">
-												<i class="fas fa-table fa-3x mb-3 text-muted"></i>
+											<td colspan="9" class="text-center text-muted py-4">
+												<i class="bi bi-table icon-3x mb-3 text-muted"></i>
 												<div>
 													<h5>No tables found</h5>
 													<p>Create your first table to start storing data.</p>
 													<button type="button" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#createS3TablesTableModal">
-														<i class="fas fa-plus me-1"></i>Create Table
+														<i class="bi bi-plus me-1"></i>Create Table
 													</button>
 												</div>
 											</td>
@@ -174,7 +187,7 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="createS3TablesTableModalLabel">
-						<i class="fas fa-plus me-2"></i>Create Table
+						<i class="bi bi-plus me-2"></i>Create Table
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -186,9 +199,16 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 						</div>
 						<div class="mb-3">
 							<label for="s3tablesTableFormat" class="form-label">Format</label>
-							<select class="form-select" id="s3tablesTableFormat" name="format">
-								<option value="ICEBERG" selected>ICEBERG</option>
-							</select>
+							if data.BucketFormat != "" {
+								<input type="text" class="form-control-plaintext ps-2 border rounded bg-light" id="s3tablesTableFormat" name="format" value={ formatLabel(data.BucketFormat) } readonly/>
+								<div class="form-text">Set by the bucket, which holds one format.</div>
+							} else {
+								<select class="form-select" id="s3tablesTableFormat" name="format">
+									<option value="ICEBERG" selected>ICEBERG</option>
+									<option value="LANCE">LANCE</option>
+								</select>
+								<div class="form-text">This bucket was created before formats were declared, so either is allowed.</div>
+							}
 						</div>
 						<div class="mb-3">
 							<label for="s3tablesTableMetadata" class="form-label">Metadata JSON (optional)</label>
@@ -202,7 +222,7 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-plus me-1"></i>Create
+							<i class="bi bi-plus me-1"></i>Create
 						</button>
 					</div>
 				</form>
@@ -214,7 +234,7 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="deleteS3TablesTableModalLabel">
-						<i class="fas fa-exclamation-triangle me-2 text-warning"></i>Delete Table
+						<i class="bi bi-exclamation-triangle me-2 text-warning"></i>Delete Table
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -228,18 +248,20 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 				<div class="modal-footer">
 					<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
 					<button type="button" class="btn btn-danger" onclick="deleteS3TablesTable()">
-						<i class="fas fa-trash me-1"></i>Delete
+						<i class="bi bi-trash me-1"></i>Delete
 					</button>
 				</div>
 			</div>
 		</div>
 	</div>
+	@PolicyDatalists()
+
 	<div class="modal fade" id="s3tablesTablePolicyModal" tabindex="-1" aria-labelledby="s3tablesTablePolicyModalLabel" aria-hidden="true">
-		<div class="modal-dialog modal-lg">
+		<div class="modal-dialog modal-xl">
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="s3tablesTablePolicyModalLabel">
-						<i class="fas fa-shield-alt me-2"></i>Table Policy
+						<i class="bi bi-shield me-2"></i>Table Policy
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -248,18 +270,36 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 						<input type="hidden" id="s3tablesTablePolicyBucketArn" name="bucket_arn"/>
 						<input type="hidden" id="s3tablesTablePolicyNamespace" name="namespace"/>
 						<input type="hidden" id="s3tablesTablePolicyName" name="name"/>
-						<div class="mb-3">
-							<label for="s3tablesTablePolicyText" class="form-label">Policy JSON</label>
-							<textarea class="form-control" id="s3tablesTablePolicyText" name="policy" rows="12" placeholder="{ }"></textarea>
+						<ul class="nav nav-tabs" role="tablist">
+							<li class="nav-item" role="presentation">
+								<button class="nav-link active" id="s3tablesTablePolicyEditorTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#s3tablesTablePolicyEditorTab" role="tab" aria-controls="s3tablesTablePolicyEditorTab" aria-selected="true">Editor</button>
+							</li>
+							<li class="nav-item" role="presentation">
+								<button class="nav-link" id="s3tablesTablePolicyJsonTabBtn" type="button" data-bs-toggle="tab" data-bs-target="#s3tablesTablePolicyJsonTab" role="tab" aria-controls="s3tablesTablePolicyJsonTab" aria-selected="false">JSON</button>
+							</li>
+						</ul>
+						<div class="tab-content border border-top-0 rounded-bottom p-3 mb-3">
+							<div class="tab-pane fade show active" id="s3tablesTablePolicyEditorTab" role="tabpanel" aria-labelledby="s3tablesTablePolicyEditorTabBtn">
+								<div id="s3tablesTablePolicyEditorBody"></div>
+								<button type="button" class="btn btn-sm btn-outline-secondary" id="s3tablesTablePolicyAddStatementBtn">
+									<i class="bi bi-plus me-1"></i>Add statement
+								</button>
+							</div>
+							<div class="tab-pane fade" id="s3tablesTablePolicyJsonTab" role="tabpanel" aria-labelledby="s3tablesTablePolicyJsonTabBtn">
+								<textarea class="form-control" id="s3tablesTablePolicyText" name="policy" rows="12" placeholder="{ }"></textarea>
+							</div>
 						</div>
 					</div>
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
-						<button type="button" class="btn btn-outline-danger" onclick="deleteS3TablesTablePolicy()">
-							<i class="fas fa-trash me-1"></i>Delete Policy
+						<button type="button" class="btn btn-outline-danger" id="s3tablesTablePolicyDeleteBtn" onclick="deleteS3TablesTablePolicy()">
+							<i class="bi bi-trash me-1"></i>Delete Policy
 						</button>
-						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-save me-1"></i>Save Policy
+						<!-- type="button": a submit button would make Enter in any
+						     single-line editor input implicitly submit a half-built
+						     policy, which the backend stores verbatim. -->
+						<button type="button" class="btn btn-primary" id="s3tablesTablePolicySaveBtn">
+							<i class="bi bi-floppy me-1"></i>Save Policy
 						</button>
 					</div>
 				</form>
@@ -271,7 +311,7 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 			<div class="modal-content">
 				<div class="modal-header">
 					<h5 class="modal-title" id="s3tablesTagsModalLabel">
-						<i class="fas fa-tags me-2"></i>Resource Tags
+						<i class="bi bi-tags me-2"></i>Resource Tags
 					</h5>
 					<button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
 				</div>
@@ -294,10 +334,10 @@ templ S3TablesTables(data dash.S3TablesTablesData) {
 					<div class="modal-footer">
 						<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
 						<button type="button" class="btn btn-outline-danger" onclick="deleteS3TablesTags()">
-							<i class="fas fa-trash me-1"></i>Remove Tags
+							<i class="bi bi-trash me-1"></i>Remove Tags
 						</button>
 						<button type="submit" class="btn btn-primary">
-							<i class="fas fa-save me-1"></i>Update Tags
+							<i class="bi bi-floppy me-1"></i>Update Tags
 						</button>
 					</div>
 				</form>
diff --git a/weed/admin/view/app/s3tables_tables_templ.go b/weed/admin/view/app/s3tables_tables_templ.go
index 113c8b8614..3fe5918e5c 100644
--- a/weed/admin/view/app/s3tables_tables_templ.go
+++ b/weed/admin/view/app/s3tables_tables_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -37,359 +37,519 @@ func S3TablesTables(data dash.S3TablesTablesData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"fas fa-table me-2\"></i>S3 Tables</h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesTableModal\"><i class=\"fas fa-plus me-1\"></i>Create Table</button></div></div></div><div class=\"mb-3\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><h1 class=\"h2\"><i class=\"bi bi-table me-2\"></i>S3 Tables ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		bucketName, parseErr := s3tables.ParseBucketNameFromARN(data.BucketARN)
-		if parseErr == nil {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<a href=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var2 templ.SafeURL
-			templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces", url.PathEscape(bucketName))))
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 27, Col: 116}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"fas fa-arrow-left me-1\"></i>Back to Namespaces</a> ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" disabled title=\"Invalid bucket ARN\"><i class=\"fas fa-arrow-left me-1\"></i>Back to Namespaces</button> ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
+		var templ_7745c5c3_Var2 = []any{formatBadgeClass(data.BucketFormat), "ms-2 align-middle"}
+		templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var2...)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<span class=\"text-muted ms-2\">Bucket ARN: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "<span class=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var3 string
-		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 35, Col: 60}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 1, Col: 0}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</span> <span class=\"text-muted ms-2\">Namespace: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "\" title=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var4 string
-		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(data.Namespace)
+		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(formatBadgeTitle(data.BucketFormat))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 36, Col: 59}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 15, Col: 119}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "</span> ")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if parseErr != nil {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "<span class=\"text-danger ms-2\">Invalid bucket ARN</span>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</div><div id=\"s3tables-tables-content\" data-bucket-arn=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var5 string
-		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(formatLabel(data.BucketFormat))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 41, Col: 67}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 15, Col: 154}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "\" data-namespace=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</span></h1><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesTableModal\"><i class=\"bi bi-plus me-1\"></i>Create Table</button></div></div></div><div class=\"mb-3\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var6 string
-		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(data.Namespace)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 41, Col: 101}
+		bucketName, parseErr := s3tables.ParseBucketNameFromARN(data.BucketARN)
+		if parseErr == nil {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "<a href=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var6 templ.SafeURL
+			templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces", url.PathEscape(bucketName))))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 28, Col: 116}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "\" class=\"btn btn-sm btn-outline-secondary\"><i class=\"bi bi-arrow-left me-1\"></i>Back to Namespaces</a> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "<button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" disabled title=\"Invalid bucket ARN\"><i class=\"bi bi-arrow-left me-1\"></i>Back to Namespaces</button> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\"><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Tables</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "<span class=\"text-muted ms-2\">Bucket ARN: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var7 string
-		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalTables))
+		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(data.BucketARN)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 52, Col: 46}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 36, Col: 60}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</div></div><div class=\"col-auto\"><i class=\"fas fa-table fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "</span> <span class=\"text-muted ms-2\">Namespace: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var8 string
-		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("15:04"))
+		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(data.Namespace)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 71, Col: 43}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 37, Col: 59}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-table me-2\"></i>Tables</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"s3tablesTablesTable\"><thead><tr><th>Name</th><th>Table ARN</th><th>Created</th><th>Modified</th><th>S3 Location</th><th>Metadata</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</span> ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if parseErr != nil {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<span class=\"text-danger ms-2\">Invalid bucket ARN</span>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</div><div id=\"s3tables-tables-content\" data-bucket-arn=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var9 string
+		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.BucketARN)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 42, Col: 67}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "\" data-namespace=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var10 string
+		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Namespace)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 42, Col: 101}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\"><div class=\"row mb-4\"><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Tables</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var11 string
+		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.TotalTables))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 53, Col: 46}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</div></div><div class=\"col-auto\"><i class=\"bi bi-table icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-4 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var12 string
+		templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("15:04"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 72, Col: 43}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div></div><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-table me-2\"></i>Tables</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"s3tablesTablesTable\"><thead><tr><th>Name</th><th>Format</th><th>Rows</th><th>Table ARN</th><th>Created</th><th>Modified</th><th>S3 Location</th><th>Metadata</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, table := range data.Tables {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			tableName := table.Name
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "<td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "<td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var9 string
-			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(tableName)
+			var templ_7745c5c3_Var13 string
+			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(tableName)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 108, Col: 26}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 111, Col: 26}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</td><td class=\"text-muted small\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(table.TableARN)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 109, Col: 56}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+			var templ_7745c5c3_Var14 = []any{formatBadgeClass(table.Format)}
+			templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var14...)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "<span class=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var11 string
-			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(table.CreatedAt.Format("2006-01-02 15:04"))
+			var templ_7745c5c3_Var15 string
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var14).String())
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 110, Col: 59}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 1, Col: 0}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\" title=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(table.ModifiedAt.Format("2006-01-02 15:04"))
+			var templ_7745c5c3_Var16 string
+			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(formatBadgeTitle(table.Format))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 111, Col: 60}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 113, Col: 97}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</td><td>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			if parseErr == nil {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<code class=\"small\">s3://")
+			var templ_7745c5c3_Var17 string
+			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(formatLabel(table.Format))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 113, Col: 127}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</span></td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if rows, ok := data.ObservedRows[tableName]; ok {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<span title=\"Reported by a plugin worker\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				var templ_7745c5c3_Var13 string
-				templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(bucketName)
+				var templ_7745c5c3_Var18 string
+				templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(rows)
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 114, Col: 50}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 117, Col: 61}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "/")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var14 string
-				templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(data.Namespace)
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 114, Col: 69}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "/")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var15 string
-				templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(tableName)
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 114, Col: 83}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "/</code>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "<span class=\"text-muted\">-</span>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "<span class=\"text-muted\">&mdash;</span>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "</td><td>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if table.MetadataLocation != "" {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<span class=\"text-muted small\">")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var16 string
-				templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(table.MetadataLocation)
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 121, Col: 68}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</span>")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<span class=\"text-muted\">-</span>")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\">")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			if parseErr == nil {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<a class=\"btn btn-outline-primary btn-sm\" href=\"")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				var templ_7745c5c3_Var17 templ.SafeURL
-				templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(bucketName), url.PathEscape(data.Namespace), url.PathEscape(tableName))))
-				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 129, Col: 238}
-				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\" title=\"View Iceberg Details\"><i class=\"fas fa-eye\"></i></a> ")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" disabled title=\"Invalid bucket ARN\"><i class=\"fas fa-eye\"></i></button> ")
-				if templ_7745c5c3_Err != nil {
-					return templ_7745c5c3_Err
-				}
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "<button type=\"button\" class=\"btn btn-outline-success btn-sm s3tables-tags-btn\" data-resource-arn=\"")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var18 string
-			templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinStringErrs(table.TableARN)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 137, Col: 126}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\" title=\"Tags\"><i class=\"fas fa-tags\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm s3tables-table-policy-btn\" data-table-arn=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "</td><td class=\"text-muted small\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var19 string
 			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(table.TableARN)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 140, Col: 128}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 122, Col: 56}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "\" data-table-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var20 string
-			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(tableName)
+			templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(table.CreatedAt.Format("2006-01-02 15:04"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 140, Col: 158}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 123, Col: 59}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "\" title=\"Table Policy\"><i class=\"fas fa-shield-alt\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm s3tables-delete-table-btn\" data-table-name=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "</td><td>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var21 string
-			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(tableName)
+			templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(table.ModifiedAt.Format("2006-01-02 15:04"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 143, Col: 126}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 124, Col: 60}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\" title=\"Delete\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "</td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if parseErr == nil {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<code class=\"small\">s3://")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var22 string
+				templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(bucketName)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 127, Col: 50}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "/")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var23 string
+				templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(data.Namespace)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 127, Col: 69}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "/")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var24 string
+				templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(tableName)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 127, Col: 83}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "/</code>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<span class=\"text-muted\">-</span>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "</td><td>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if table.MetadataLocation != "" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<span class=\"text-muted small\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var25 string
+				templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(table.MetadataLocation)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 134, Col: 68}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</span>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<span class=\"text-muted\">-</span>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</td><td><div class=\"btn-group btn-group-sm\" role=\"group\">")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if parseErr == nil {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "<a class=\"btn btn-outline-primary btn-sm\" href=\"")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var26 templ.SafeURL
+				templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinURLErrs(dash.PUrl(ctx, fmt.Sprintf("/object-store/s3tables/buckets/%s/namespaces/%s/tables/%s", url.PathEscape(bucketName), url.PathEscape(data.Namespace), url.PathEscape(tableName))))
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 142, Col: 238}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\" title=\"View Table Details\"><i class=\"bi bi-eye\"></i></a> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "<button type=\"button\" class=\"btn btn-outline-primary btn-sm\" disabled title=\"Invalid bucket ARN\"><i class=\"bi bi-eye\"></i></button> ")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 45, "<button type=\"button\" class=\"btn btn-outline-success btn-sm s3tables-tags-btn\" data-resource-arn=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var27 string
+			templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(table.TableARN)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 150, Col: 126}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "\" title=\"Tags\"><i class=\"bi bi-tags\"></i></button> <button type=\"button\" class=\"btn btn-outline-info btn-sm s3tables-table-policy-btn\" data-table-arn=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var28 string
+			templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue(table.TableARN)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 153, Col: 128}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "\" data-table-name=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var29 string
+			templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(tableName)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 153, Col: 158}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 48, "\" title=\"Table Policy\"><i class=\"bi bi-shield\"></i></button> <button type=\"button\" class=\"btn btn-outline-danger btn-sm s3tables-delete-table-btn\" data-table-name=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var30 string
+			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.ResolveAttributeValue(tableName)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 156, Col: 126}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var30)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "\" title=\"Delete\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.Tables) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<tr><td colspan=\"7\" class=\"text-center text-muted py-4\"><i class=\"fas fa-table fa-3x mb-3 text-muted\"></i><div><h5>No tables found</h5><p>Create your first table to start storing data.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesTableModal\"><i class=\"fas fa-plus me-1\"></i>Create Table</button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 50, "<tr><td colspan=\"9\" class=\"text-center text-muted py-4\"><i class=\"bi bi-table icon-3x mb-3 text-muted\"></i><div><h5>No tables found</h5><p>Create your first table to start storing data.</p><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createS3TablesTableModal\"><i class=\"bi bi-plus me-1\"></i>Create Table</button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createS3TablesTableModal\" tabindex=\"-1\" aria-labelledby=\"createS3TablesTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createS3TablesTableModalLabel\"><i class=\"fas fa-plus me-2\"></i>Create Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createS3TablesTableForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label for=\"s3tablesTableName\" class=\"form-label\">Table Name</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTableName\" name=\"name\" required></div><div class=\"mb-3\"><label for=\"s3tablesTableFormat\" class=\"form-label\">Format</label> <select class=\"form-select\" id=\"s3tablesTableFormat\" name=\"format\"><option value=\"ICEBERG\" selected>ICEBERG</option></select></div><div class=\"mb-3\"><label for=\"s3tablesTableMetadata\" class=\"form-label\">Metadata JSON (optional)</label> <textarea class=\"form-control\" id=\"s3tablesTableMetadata\" name=\"metadata\" rows=\"6\" placeholder=\"{ }\"></textarea></div><div class=\"mb-3\"><label for=\"s3tablesTableTags\" class=\"form-label\">Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTableTags\" name=\"tags\" placeholder=\"key1=value1,key2=value2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteS3TablesTableModal\" tabindex=\"-1\" aria-labelledby=\"deleteS3TablesTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteS3TablesTableModalLabel\"><i class=\"fas fa-exclamation-triangle me-2 text-warning\"></i>Delete Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the table <strong id=\"deleteS3TablesTableName\"></strong>?</p><div class=\"mb-3\"><label for=\"deleteS3TablesTableVersion\" class=\"form-label\">Version Token (optional)</label> <input type=\"text\" class=\"form-control\" id=\"deleteS3TablesTableVersion\" placeholder=\"Version token\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteS3TablesTable()\"><i class=\"fas fa-trash me-1\"></i>Delete</button></div></div></div></div><div class=\"modal fade\" id=\"s3tablesTablePolicyModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesTablePolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesTablePolicyModalLabel\"><i class=\"fas fa-shield-alt me-2\"></i>Table Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesTablePolicyForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesTablePolicyBucketArn\" name=\"bucket_arn\"> <input type=\"hidden\" id=\"s3tablesTablePolicyNamespace\" name=\"namespace\"> <input type=\"hidden\" id=\"s3tablesTablePolicyName\" name=\"name\"><div class=\"mb-3\"><label for=\"s3tablesTablePolicyText\" class=\"form-label\">Policy JSON</label> <textarea class=\"form-control\" id=\"s3tablesTablePolicyText\" name=\"policy\" rows=\"12\" placeholder=\"{ }\"></textarea></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" onclick=\"deleteS3TablesTablePolicy()\"><i class=\"fas fa-trash me-1\"></i>Delete Policy</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-save me-1\"></i>Save Policy</button></div></form></div></div></div><div class=\"modal fade\" id=\"s3tablesTagsModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesTagsModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesTagsModalLabel\"><i class=\"fas fa-tags me-2\"></i>Resource Tags</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesTagsForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesTagsResourceArn\" name=\"resource_arn\"><div class=\"mb-3\"><label class=\"form-label\">Existing Tags</label><pre class=\"bg-light p-3 border rounded\" id=\"s3tablesTagsList\">Loading...</pre></div><div class=\"mb-3\"><label for=\"s3tablesTagsInput\" class=\"form-label\">Add or Update Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsInput\" placeholder=\"key1=value1,key2=value2\"></div><div class=\"mb-3\"><label for=\"s3tablesTagsDeleteInput\" class=\"form-label\">Remove Tag Keys</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsDeleteInput\" placeholder=\"key1,key2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" onclick=\"deleteS3TablesTags()\"><i class=\"fas fa-trash me-1\"></i>Remove Tags</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"fas fa-save me-1\"></i>Update Tags</button></div></form></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitS3TablesTables();\n\t\t});\n\t</script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 51, "</tbody></table></div></div></div></div></div></div><div class=\"modal fade\" id=\"createS3TablesTableModal\" tabindex=\"-1\" aria-labelledby=\"createS3TablesTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"createS3TablesTableModalLabel\"><i class=\"bi bi-plus me-2\"></i>Create Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"createS3TablesTableForm\"><div class=\"modal-body\"><div class=\"mb-3\"><label for=\"s3tablesTableName\" class=\"form-label\">Table Name</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTableName\" name=\"name\" required></div><div class=\"mb-3\"><label for=\"s3tablesTableFormat\" class=\"form-label\">Format</label> ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if data.BucketFormat != "" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "<input type=\"text\" class=\"form-control-plaintext ps-2 border rounded bg-light\" id=\"s3tablesTableFormat\" name=\"format\" value=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var31 string
+			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.ResolveAttributeValue(formatLabel(data.BucketFormat))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/s3tables_tables.templ`, Line: 203, Col: 164}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var31)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "\" readonly><div class=\"form-text\">Set by the bucket, which holds one format.</div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 54, "<select class=\"form-select\" id=\"s3tablesTableFormat\" name=\"format\"><option value=\"ICEBERG\" selected>ICEBERG</option> <option value=\"LANCE\">LANCE</option></select><div class=\"form-text\">This bucket was created before formats were declared, so either is allowed.</div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 55, "</div><div class=\"mb-3\"><label for=\"s3tablesTableMetadata\" class=\"form-label\">Metadata JSON (optional)</label> <textarea class=\"form-control\" id=\"s3tablesTableMetadata\" name=\"metadata\" rows=\"6\" placeholder=\"{ }\"></textarea></div><div class=\"mb-3\"><label for=\"s3tablesTableTags\" class=\"form-label\">Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTableTags\" name=\"tags\" placeholder=\"key1=value1,key2=value2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-plus me-1\"></i>Create</button></div></form></div></div></div><div class=\"modal fade\" id=\"deleteS3TablesTableModal\" tabindex=\"-1\" aria-labelledby=\"deleteS3TablesTableModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"deleteS3TablesTableModalLabel\"><i class=\"bi bi-exclamation-triangle me-2 text-warning\"></i>Delete Table</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><div class=\"modal-body\"><p>Are you sure you want to delete the table <strong id=\"deleteS3TablesTableName\"></strong>?</p><div class=\"mb-3\"><label for=\"deleteS3TablesTableVersion\" class=\"form-label\">Version Token (optional)</label> <input type=\"text\" class=\"form-control\" id=\"deleteS3TablesTableVersion\" placeholder=\"Version token\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-danger\" onclick=\"deleteS3TablesTable()\"><i class=\"bi bi-trash me-1\"></i>Delete</button></div></div></div></div>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = PolicyDatalists().Render(ctx, templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "<div class=\"modal fade\" id=\"s3tablesTablePolicyModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesTablePolicyModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-xl\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesTablePolicyModalLabel\"><i class=\"bi bi-shield me-2\"></i>Table Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesTablePolicyForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesTablePolicyBucketArn\" name=\"bucket_arn\"> <input type=\"hidden\" id=\"s3tablesTablePolicyNamespace\" name=\"namespace\"> <input type=\"hidden\" id=\"s3tablesTablePolicyName\" name=\"name\"><ul class=\"nav nav-tabs\" role=\"tablist\"><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link active\" id=\"s3tablesTablePolicyEditorTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#s3tablesTablePolicyEditorTab\" role=\"tab\" aria-controls=\"s3tablesTablePolicyEditorTab\" aria-selected=\"true\">Editor</button></li><li class=\"nav-item\" role=\"presentation\"><button class=\"nav-link\" id=\"s3tablesTablePolicyJsonTabBtn\" type=\"button\" data-bs-toggle=\"tab\" data-bs-target=\"#s3tablesTablePolicyJsonTab\" role=\"tab\" aria-controls=\"s3tablesTablePolicyJsonTab\" aria-selected=\"false\">JSON</button></li></ul><div class=\"tab-content border border-top-0 rounded-bottom p-3 mb-3\"><div class=\"tab-pane fade show active\" id=\"s3tablesTablePolicyEditorTab\" role=\"tabpanel\" aria-labelledby=\"s3tablesTablePolicyEditorTabBtn\"><div id=\"s3tablesTablePolicyEditorBody\"></div><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" id=\"s3tablesTablePolicyAddStatementBtn\"><i class=\"bi bi-plus me-1\"></i>Add statement</button></div><div class=\"tab-pane fade\" id=\"s3tablesTablePolicyJsonTab\" role=\"tabpanel\" aria-labelledby=\"s3tablesTablePolicyJsonTabBtn\"><textarea class=\"form-control\" id=\"s3tablesTablePolicyText\" name=\"policy\" rows=\"12\" placeholder=\"{ }\"></textarea></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" id=\"s3tablesTablePolicyDeleteBtn\" onclick=\"deleteS3TablesTablePolicy()\"><i class=\"bi bi-trash me-1\"></i>Delete Policy</button><!-- type=\"button\": a submit button would make Enter in any\n\t\t\t\t\t\t     single-line editor input implicitly submit a half-built\n\t\t\t\t\t\t     policy, which the backend stores verbatim. --><button type=\"button\" class=\"btn btn-primary\" id=\"s3tablesTablePolicySaveBtn\"><i class=\"bi bi-floppy me-1\"></i>Save Policy</button></div></form></div></div></div><div class=\"modal fade\" id=\"s3tablesTagsModal\" tabindex=\"-1\" aria-labelledby=\"s3tablesTagsModalLabel\" aria-hidden=\"true\"><div class=\"modal-dialog modal-lg\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\" id=\"s3tablesTagsModalLabel\"><i class=\"bi bi-tags me-2\"></i>Resource Tags</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\" aria-label=\"Close\"></button></div><form id=\"s3tablesTagsForm\"><div class=\"modal-body\"><input type=\"hidden\" id=\"s3tablesTagsResourceArn\" name=\"resource_arn\"><div class=\"mb-3\"><label class=\"form-label\">Existing Tags</label><pre class=\"bg-light p-3 border rounded\" id=\"s3tablesTagsList\">Loading...</pre></div><div class=\"mb-3\"><label for=\"s3tablesTagsInput\" class=\"form-label\">Add or Update Tags</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsInput\" placeholder=\"key1=value1,key2=value2\"></div><div class=\"mb-3\"><label for=\"s3tablesTagsDeleteInput\" class=\"form-label\">Remove Tag Keys</label> <input type=\"text\" class=\"form-control\" id=\"s3tablesTagsDeleteInput\" placeholder=\"key1,key2\"></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button> <button type=\"button\" class=\"btn btn-outline-danger\" onclick=\"deleteS3TablesTags()\"><i class=\"bi bi-trash me-1\"></i>Remove Tags</button> <button type=\"submit\" class=\"btn btn-primary\"><i class=\"bi bi-floppy me-1\"></i>Update Tags</button></div></form></div></div></div><script>\n\t\tdocument.addEventListener('DOMContentLoaded', function() {\n\t\t\tinitS3TablesTables();\n\t\t});\n\t</script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/service_accounts.templ b/weed/admin/view/app/service_accounts.templ
index 2fb18e187b..b69916ed15 100644
--- a/weed/admin/view/app/service_accounts.templ
+++ b/weed/admin/view/app/service_accounts.templ
@@ -11,7 +11,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
         <div class="d-sm-flex align-items-center justify-content-between mb-4">
             <div>
                 <h1 class="h3 mb-0 text-gray-800">
-                    <i class="fas fa-robot me-2"></i>Service Accounts
+                    <i class="bi bi-robot me-2"></i>Service Accounts
                 </h1>
                 <p class="mb-0 text-muted">Manage application credentials for automated processes</p>
             </div>
@@ -19,7 +19,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                 <button type="button" class="btn btn-primary" 
                         data-bs-toggle="modal" 
                         data-bs-target="#createServiceAccountModal">
-                    <i class="fas fa-plus me-1"></i>Create Service Account
+                    <i class="bi bi-plus me-1"></i>Create Service Account
                 </button>
             </div>
         </div>
@@ -39,7 +39,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-id-card fa-2x text-gray-300"></i>
+                                <i class="bi bi-person-vcard icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -59,7 +59,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-check-circle fa-2x text-gray-300"></i>
+                                <i class="bi bi-check-circle icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -79,7 +79,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                                 </div>
                             </div>
                             <div class="col-auto">
-                                <i class="fas fa-clock fa-2x text-gray-300"></i>
+                                <i class="bi bi-clock icon-2x text-gray-300"></i>
                             </div>
                         </div>
                     </div>
@@ -93,7 +93,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3 d-flex flex-row align-items-center justify-content-between">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-robot me-2"></i>Service Accounts
+                            <i class="bi bi-robot me-2"></i>Service Accounts
                         </h6>
                     </div>
                     <div class="card-body">
@@ -114,12 +114,12 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                                         <tr>
                                             <td>
                                                 <div class="d-flex align-items-center">
-                                                    <i class="fas fa-robot me-2 text-muted"></i>
+                                                    <i class="bi bi-robot me-2 text-muted"></i>
                                                     <code>{sa.ID}</code>
                                                 </div>
                                             </td>
                                             <td>
-                                                <i class="fas fa-user me-1 text-muted"></i>
+                                                <i class="bi bi-person me-1 text-muted"></i>
                                                 {sa.ParentUser}
                                             </td>
                                             <td>
@@ -137,19 +137,19 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                                                 <div class="btn-group btn-group-sm" role="group">
                                                     <button type="button" class="btn btn-outline-info" 
                                                             data-action="show-sa-details" data-sa-id={ sa.ID }>
-                                                        <i class="fas fa-info-circle"></i>
+                                                        <i class="bi bi-info-circle"></i>
                                                     </button>
                                                     <button type="button" class="btn btn-outline-primary" 
                                                             data-action="toggle-sa-status" data-sa-id={ sa.ID } data-current-status={ sa.Status }>
                                                         if sa.Status == dash.StatusActive {
-                                                            <i class="fas fa-pause"></i>
+                                                            <i class="bi bi-pause"></i>
                                                         } else {
-                                                            <i class="fas fa-play"></i>
+                                                            <i class="bi bi-play"></i>
                                                         }
                                                     </button>
                                                     <button type="button" class="btn btn-outline-danger" 
                                                             data-action="delete-sa" data-sa-id={ sa.ID }>
-                                                        <i class="fas fa-trash"></i>
+                                                        <i class="bi bi-trash"></i>
                                                     </button>
                                                 </div>
                                             </td>
@@ -158,7 +158,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                                     if len(data.ServiceAccounts) == 0 {
                                         <tr>
                                             <td colspan="6" class="text-center text-muted py-4">
-                                                <i class="fas fa-robot fa-3x mb-3 text-muted"></i>
+                                                <i class="bi bi-robot icon-3x mb-3 text-muted"></i>
                                                 <div>
                                                     <h5>No service accounts found</h5>
                                                     <p>Create your first service account for automated processes.</p>
@@ -178,7 +178,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
         <div class="row">
             <div class="col-12">
                 <small class="text-muted">
-                    <i class="fas fa-clock me-1"></i>
+                    <i class="bi bi-clock me-1"></i>
                     Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
                 </small>
             </div>
@@ -191,7 +191,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-plus me-2"></i>Create Service Account
+                        <i class="bi bi-plus me-2"></i>Create Service Account
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -233,7 +233,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-robot me-2"></i>Service Account Details
+                        <i class="bi bi-robot me-2"></i>Service Account Details
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -253,12 +253,12 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
             <div class="modal-content">
                 <div class="modal-header bg-success text-white">
                     <h5 class="modal-title">
-                        <i class="fas fa-check-circle me-2"></i>Service Account Created Successfully
+                        <i class="bi bi-check-circle me-2"></i>Service Account Created Successfully
                     </h5>
                 </div>
                 <div class="modal-body">
                     <div class="alert alert-warning">
-                        <i class="fas fa-exclamation-triangle me-2"></i>
+                        <i class="bi bi-exclamation-triangle me-2"></i>
                         <strong>Important:</strong> This is the only time you will see the secret access key. Please save it securely.
                     </div>
                     
@@ -271,7 +271,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                             <div class="input-group">
                                 <input type="text" class="form-control font-monospace" id="displayAccessKey" readonly>
                                 <button class="btn btn-outline-secondary" type="button" onclick="copyCredentialToClipboard(this, 'displayAccessKey')">
-                                    <i class="fas fa-copy"></i> Copy
+                                    <i class="bi bi-copy"></i> Copy
                                 </button>
                             </div>
                         </div>
@@ -281,7 +281,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                             <div class="input-group">
                                 <input type="text" class="form-control font-monospace" id="displaySecretKey" readonly>
                                 <button class="btn btn-outline-secondary" type="button" onclick="copyCredentialToClipboard(this, 'displaySecretKey')">
-                                    <i class="fas fa-copy"></i> Copy
+                                    <i class="bi bi-copy"></i> Copy
                                 </button>
                             </div>
                         </div>
@@ -302,7 +302,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
                 </div>
                 <div class="modal-footer">
                     <button type="button" class="btn btn-primary" onclick="closeCredentialsModal()">
-                        <i class="fas fa-check me-1"></i>I have saved the credentials
+                        <i class="bi bi-check me-1"></i>I have saved the credentials
                     </button>
                 </div>
             </div>
@@ -498,7 +498,7 @@ templ ServiceAccounts(data dash.ServiceAccountsData) {
             // Visual feedback
             const originalHTML = button.innerHTML;
             
-            button.innerHTML = '<i class="fas fa-check"></i>';
+            button.innerHTML = '<i class="bi bi-check"></i>';
             button.classList.remove('btn-outline-secondary');
             button.classList.add('btn-success');
             
diff --git a/weed/admin/view/app/service_accounts_templ.go b/weed/admin/view/app/service_accounts_templ.go
index 323102d858..d4fa24d1af 100644
--- a/weed/admin/view/app/service_accounts_templ.go
+++ b/weed/admin/view/app/service_accounts_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -34,7 +34,7 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"container-fluid\"><!-- Page Header --><div class=\"d-sm-flex align-items-center justify-content-between mb-4\"><div><h1 class=\"h3 mb-0 text-gray-800\"><i class=\"fas fa-robot me-2\"></i>Service Accounts</h1><p class=\"mb-0 text-muted\">Manage application credentials for automated processes</p></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createServiceAccountModal\"><i class=\"fas fa-plus me-1\"></i>Create Service Account</button></div></div><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Service Accounts</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"container-fluid\"><!-- Page Header --><div class=\"d-sm-flex align-items-center justify-content-between mb-4\"><div><h1 class=\"h3 mb-0 text-gray-800\"><i class=\"bi bi-robot me-2\"></i>Service Accounts</h1><p class=\"mb-0 text-muted\">Manage application credentials for automated processes</p></div><div class=\"d-flex gap-2\"><button type=\"button\" class=\"btn btn-primary\" data-bs-toggle=\"modal\" data-bs-target=\"#createServiceAccountModal\"><i class=\"bi bi-plus me-1\"></i>Create Service Account</button></div></div><!-- Summary Cards --><div class=\"row mb-4\"><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-primary shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-primary text-uppercase mb-1\">Total Service Accounts</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -47,7 +47,7 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"fas fa-id-card fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Active Accounts</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</div></div><div class=\"col-auto\"><i class=\"bi bi-person-vcard icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-success shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-success text-uppercase mb-1\">Active Accounts</div><div class=\"h5 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +60,7 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"fas fa-check-circle fa-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</div></div><div class=\"col-auto\"><i class=\"bi bi-check-circle icon-2x text-gray-300\"></i></div></div></div></div></div><div class=\"col-xl-3 col-md-6 mb-4\"><div class=\"card border-left-info shadow h-100 py-2\"><div class=\"card-body\"><div class=\"row no-gutters align-items-center\"><div class=\"col mr-2\"><div class=\"text-xs font-weight-bold text-info text-uppercase mb-1\">Last Updated</div><div class=\"h6 mb-0 font-weight-bold text-gray-800\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -73,12 +73,12 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"fas fa-clock fa-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Service Accounts Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-robot me-2\"></i>Service Accounts</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"serviceAccountsTable\"><thead><tr><th>ID</th><th>Parent User</th><th>Access Key</th><th>Status</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</div></div><div class=\"col-auto\"><i class=\"bi bi-clock icon-2x text-gray-300\"></i></div></div></div></div></div></div><!-- Service Accounts Table --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3 d-flex flex-row align-items-center justify-content-between\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-robot me-2\"></i>Service Accounts</h6></div><div class=\"card-body\"><div class=\"table-responsive\"><table class=\"table table-hover\" width=\"100%\" cellspacing=\"0\" id=\"serviceAccountsTable\"><thead><tr><th>ID</th><th>Parent User</th><th>Access Key</th><th>Status</th><th>Created</th><th>Actions</th></tr></thead> <tbody>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		for _, sa := range data.ServiceAccounts {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<tr><td><div class=\"d-flex align-items-center\"><i class=\"fas fa-robot me-2 text-muted\"></i> <code>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<tr><td><div class=\"d-flex align-items-center\"><i class=\"bi bi-robot me-2 text-muted\"></i> <code>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -91,7 +91,7 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</code></div></td><td><i class=\"fas fa-user me-1 text-muted\"></i> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</code></div></td><td><i class=\"bi bi-person me-1 text-muted\"></i> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -150,24 +150,24 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var9 string
-			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(sa.ID)
+			templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.ResolveAttributeValue(sa.ID)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/service_accounts.templ`, Line: 139, Col: 108}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var9)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><i class=\"fas fa-info-circle\"></i></button> <button type=\"button\" class=\"btn btn-outline-primary\" data-action=\"toggle-sa-status\" data-sa-id=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "\"><i class=\"bi bi-info-circle\"></i></button> <button type=\"button\" class=\"btn btn-outline-primary\" data-action=\"toggle-sa-status\" data-sa-id=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(sa.ID)
+			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(sa.ID)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/service_accounts.templ`, Line: 143, Col: 109}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -176,11 +176,11 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var11 string
-			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(sa.Status)
+			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.ResolveAttributeValue(sa.Status)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/service_accounts.templ`, Line: 143, Col: 143}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var11)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -189,12 +189,12 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			if sa.Status == dash.StatusActive {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<i class=\"fas fa-pause\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "<i class=\"bi bi-pause\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 			} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "<i class=\"fas fa-play\"></i>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "<i class=\"bi bi-play\"></i>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -204,26 +204,26 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(sa.ID)
+			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.ResolveAttributeValue(sa.ID)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/service_accounts.templ`, Line: 151, Col: 102}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var12)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\"><i class=\"fas fa-trash\"></i></button></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\"><i class=\"bi bi-trash\"></i></button></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		if len(data.ServiceAccounts) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<tr><td colspan=\"6\" class=\"text-center text-muted py-4\"><i class=\"fas fa-robot fa-3x mb-3 text-muted\"></i><div><h5>No service accounts found</h5><p>Create your first service account for automated processes.</p></div></td></tr>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "<tr><td colspan=\"6\" class=\"text-center text-muted py-4\"><i class=\"bi bi-robot icon-3x mb-3 text-muted\"></i><div><h5>No service accounts found</h5><p>Create your first service account for automated processes.</p></div></td></tr>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</tbody></table></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "</tbody></table></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -236,7 +236,7 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</small></div></div></div><!-- Create Service Account Modal --><div class=\"modal fade\" id=\"createServiceAccountModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-plus me-2\"></i>Create Service Account</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"createSAForm\"><div class=\"mb-3\"><label for=\"parentUser\" class=\"form-label\">Parent User *</label> <select class=\"form-select\" id=\"parentUser\" name=\"parent_user\" required><option value=\"\">-- Select a user --</option> ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "</small></div></div></div><!-- Create Service Account Modal --><div class=\"modal fade\" id=\"createServiceAccountModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-plus me-2\"></i>Create Service Account</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"createSAForm\"><div class=\"mb-3\"><label for=\"parentUser\" class=\"form-label\">Parent User *</label> <select class=\"form-select\" id=\"parentUser\" name=\"parent_user\" required><option value=\"\">-- Select a user --</option> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -246,11 +246,11 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var14 string
-			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(user)
+			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(user)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/service_accounts.templ`, Line: 205, Col: 56}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -272,7 +272,7 @@ func ServiceAccounts(data dash.ServiceAccountsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</select> <small class=\"form-text text-muted\">The service account will inherit permissions from this user</small></div><div class=\"mb-3\"><label for=\"description\" class=\"form-label\">Description</label> <textarea class=\"form-control\" id=\"description\" name=\"description\" rows=\"2\" placeholder=\"What is this service account used for?\"></textarea></div><div class=\"mb-3\"><label for=\"expiration\" class=\"form-label\">Expiration (optional)</label> <input type=\"datetime-local\" class=\"form-control\" id=\"expiration\" name=\"expiration\"> <small class=\"form-text text-muted\">Leave empty for no expiration</small></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"handleCreateServiceAccount()\">Create</button></div></div></div></div><!-- Service Account Details Modal --><div class=\"modal fade\" id=\"saDetailsModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-robot me-2\"></i>Service Account Details</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\" id=\"saDetailsContent\"><!-- Content will be loaded dynamically --></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- Credentials Display Modal --><div class=\"modal fade\" id=\"credentialsModal\" tabindex=\"-1\" role=\"dialog\" data-bs-backdrop=\"static\" data-bs-keyboard=\"false\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header bg-success text-white\"><h5 class=\"modal-title\"><i class=\"fas fa-check-circle me-2\"></i>Service Account Created Successfully</h5></div><div class=\"modal-body\"><div class=\"alert alert-warning\"><i class=\"fas fa-exclamation-triangle me-2\"></i> <strong>Important:</strong> This is the only time you will see the secret access key. Please save it securely.</div><div class=\"mb-4\"><h6 class=\"text-muted mb-3\">AWS CLI Configuration</h6><p class=\"text-muted small\">Use these credentials to configure AWS CLI or SDKs:</p><div class=\"mb-3\"><label class=\"form-label fw-bold\">AWS_ACCESS_KEY_ID</label><div class=\"input-group\"><input type=\"text\" class=\"form-control font-monospace\" id=\"displayAccessKey\" readonly> <button class=\"btn btn-outline-secondary\" type=\"button\" onclick=\"copyCredentialToClipboard(this, 'displayAccessKey')\"><i class=\"fas fa-copy\"></i> Copy</button></div></div><div class=\"mb-3\"><label class=\"form-label fw-bold\">AWS_SECRET_ACCESS_KEY</label><div class=\"input-group\"><input type=\"text\" class=\"form-control font-monospace\" id=\"displaySecretKey\" readonly> <button class=\"btn btn-outline-secondary\" type=\"button\" onclick=\"copyCredentialToClipboard(this, 'displaySecretKey')\"><i class=\"fas fa-copy\"></i> Copy</button></div></div></div><div class=\"bg-light p-3 rounded\"><h6 class=\"text-muted mb-2\">Example AWS CLI Usage:</h6><div class=\"font-monospace small\"><div>export AWS_ACCESS_KEY_ID=<span id=\"exampleAccessKey\"></span></div><div>export AWS_SECRET_ACCESS_KEY=<span id=\"exampleSecretKey\"></span></div><div>export AWS_ENDPOINT_URL=http://localhost:8333</div><div class=\"mt-2\"># List buckets</div><div>aws s3 ls</div><div class=\"mt-2\"># Upload a file</div><div>aws s3 cp myfile.txt s3://mybucket/</div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-primary\" onclick=\"closeCredentialsModal()\"><i class=\"fas fa-check me-1\"></i>I have saved the credentials</button></div></div></div></div><!-- JavaScript for service account management --><script>\n        document.addEventListener('DOMContentLoaded', function() {\n            document.addEventListener('click', function(e) {\n                const button = e.target.closest('[data-action]');\n                if (!button) return;\n                \n                const action = button.getAttribute('data-action');\n                const saId = button.getAttribute('data-sa-id');\n                \n                switch (action) {\n                    case 'show-sa-details':\n                        showSADetails(saId);\n                        break;\n                    case 'toggle-sa-status':\n                        toggleSAStatus(saId, button.getAttribute('data-current-status'));\n                        break;\n                    case 'delete-sa':\n                        deleteSA(saId);\n                        break;\n                }\n            });\n        });\n\n        async function showSADetails(id) {\n            try {\n                const encodedId = encodeURIComponent(id);\n                const response = await fetch(basePath(`/api/service-accounts/${encodedId}`));\n                if (response.ok) {\n                    const sa = await response.json();\n                    document.getElementById('saDetailsContent').innerHTML = createSADetailsContent(sa);\n                    const modal = new bootstrap.Modal(document.getElementById('saDetailsModal'));\n                    modal.show();\n                } else {\n                    showErrorMessage('Failed to load service account details');\n                }\n            } catch (error) {\n                console.error('Error loading service account details:', error);\n                showErrorMessage('Failed to load service account details');\n            }\n        }\n\n        async function toggleSAStatus(id, currentStatus) {\n            const newStatus = currentStatus === 'Active' ? 'Inactive' : 'Active';\n            try {\n                const encodedId = encodeURIComponent(id);\n                const response = await fetch(basePath(`/api/service-accounts/${encodedId}`), {\n                    method: 'PUT',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ status: newStatus })\n                });\n                \n                if (response.ok) {\n                    showSuccessMessage(`Service account ${newStatus === 'Active' ? 'activated' : 'deactivated'}`);\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json();\n                    showErrorMessage('Failed to update status: ' + (error.error || 'Unknown error'));\n                }\n            } catch (error) {\n                console.error('Error updating status:', error);\n                showErrorMessage('Failed to update status: ' + error.message);\n            }\n        }\n\n        async function deleteSA(id) {\n            showDeleteConfirm(id, async function() {\n                try {\n                    const encodedId = encodeURIComponent(id);\n                    const response = await fetch(basePath(`/api/service-accounts/${encodedId}`), {\n                        method: 'DELETE'\n                    });\n                    \n                    if (response.ok) {\n                        showSuccessMessage('Service account deleted successfully');\n                        setTimeout(() => window.location.reload(), 1000);\n                    } else {\n                        const error = await response.json();\n                        showErrorMessage('Failed to delete: ' + (error.error || 'Unknown error'));\n                    }\n                } catch (error) {\n                    console.error('Error deleting service account:', error);\n                    showErrorMessage('Failed to delete: ' + error.message);\n                }\n            }, 'Are you sure you want to delete this service account? This action cannot be undone.');\n        }\n\n        async function handleCreateServiceAccount() {\n            const form = document.getElementById('createSAForm');\n            const formData = new FormData(form);\n            \n            const saData = {\n                parent_user: formData.get('parent_user'),\n                description: formData.get('description')\n            };\n            \n            // Handle expiration if set\n            const expiration = formData.get('expiration');\n            if (expiration) {\n                // Validate the date before using it\n                const date = new Date(expiration);\n                const now = new Date();\n                \n                if (isNaN(date.getTime())) {\n                    showErrorMessage('Invalid expiration date format');\n                    return;\n                }\n                \n                // Ensure expiration is in the future\n                if (date <= now) {\n                    showErrorMessage('Expiration date must be in the future');\n                    return;\n                }\n                \n                saData.expiration = date.toISOString();\n            }\n            \n            try {\n                const response = await fetch(basePath('/api/service-accounts'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify(saData)\n                });\n                \n                if (response.ok) {\n                    const result = await response.json();\n                    \n                    // Hide create modal\n                    const createModal = bootstrap.Modal.getInstance(document.getElementById('createServiceAccountModal'));\n                    createModal.hide();\n                    form.reset();\n                    \n                    // Show credentials if returned\n                    if (result.service_account && result.service_account.secret_access_key) {\n                        showCredentials(result.service_account);\n                    } else {\n                        showSuccessMessage('Service account created successfully');\n                        setTimeout(() => window.location.reload(), 1000);\n                    }\n                } else {\n                    const error = await response.json();\n                    showErrorMessage('Failed to create service account: ' + (error.error || 'Unknown error'));\n                }\n            } catch (error) {\n                console.error('Error creating service account:', error);\n                showErrorMessage('Failed to create service account: ' + error.message);\n            }\n        }\n\n        function showCredentials(serviceAccount) {\n            // Populate the credentials modal\n            document.getElementById('displayAccessKey').value = serviceAccount.access_key_id;\n            document.getElementById('displaySecretKey').value = serviceAccount.secret_access_key;\n            document.getElementById('exampleAccessKey').textContent = serviceAccount.access_key_id;\n            document.getElementById('exampleSecretKey').textContent = serviceAccount.secret_access_key;\n            \n            // Show the modal\n            const credentialsModal = new bootstrap.Modal(document.getElementById('credentialsModal'));\n            credentialsModal.show();\n        }\n\n        function closeCredentialsModal() {\n            const modal = bootstrap.Modal.getInstance(document.getElementById('credentialsModal'));\n            modal.hide();\n            // Reload to show the new service account in the list\n            setTimeout(() => window.location.reload(), 500);\n        }\n\n        function copyCredentialToClipboard(button, elementId) {\n            const element = document.getElementById(elementId);\n            const textToCopy = element.value;\n            \n            // Use modern Clipboard API if available\n            if (navigator.clipboard && navigator.clipboard.writeText) {\n                 navigator.clipboard.writeText(textToCopy).then(() => {\n                     showSuccessMessage('Copied to clipboard!');\n                 }).catch(err => {\n                     console.warn('Clipboard API failed:', err);\n                     // Fallback\n                     fallbackCopyTextToClipboard(element);\n                 });\n            } else {\n                // Fallback for older browsers or non-secure contexts\n                fallbackCopyTextToClipboard(element);\n            }\n            \n            // Visual feedback\n            const originalHTML = button.innerHTML;\n            \n            button.innerHTML = '<i class=\"fas fa-check\"></i>';\n            button.classList.remove('btn-outline-secondary');\n            button.classList.add('btn-success');\n            \n            setTimeout(() => {\n                button.innerHTML = originalHTML;\n                button.classList.remove('btn-success');\n                button.classList.add('btn-outline-secondary');\n            }, 1000);\n        }\n\n        function fallbackCopyTextToClipboard(element) {\n            element.select();\n            element.setSelectionRange(0, 99999); // For mobile devices\n            \n            try {\n                const successful = document.execCommand('copy');\n                if (successful) {\n                    showSuccessMessage('Copied to clipboard!');\n                } else {\n                    showErrorMessage('Failed to copy to clipboard');\n                }\n            } catch (err) {\n                console.error('Fallback copy failed:', err);\n                showErrorMessage('Failed to copy to clipboard');\n            }\n            \n            // Clear selection\n            window.getSelection().removeAllRanges();\n        }\n\n\n        function createSADetailsContent(sa) {\n            // Create DOM elements safely to prevent XSS\n            const container = document.createElement('div');\n            container.className = 'row';\n            \n            // Basic Information column\n            const col1 = document.createElement('div');\n            col1.className = 'col-md-6';\n            \n            const h6_1 = document.createElement('h6');\n            h6_1.className = 'text-muted';\n            h6_1.textContent = 'Basic Information';\n            col1.appendChild(h6_1);\n            \n            const table1 = document.createElement('table');\n            table1.className = 'table table-sm';\n            \n            // ID row\n            const idRow = document.createElement('tr');\n            idRow.innerHTML = '<td><strong>ID:</strong></td><td><code></code></td>';\n            idRow.querySelector('code').textContent = sa.id || '';\n            table1.appendChild(idRow);\n            \n            // Parent User row\n            const parentRow = document.createElement('tr');\n            parentRow.innerHTML = '<td><strong>Parent User:</strong></td><td></td>';\n            parentRow.querySelectorAll('td')[1].textContent = sa.parent_user || '';\n            table1.appendChild(parentRow);\n            \n            // Access Key row\n            const keyRow = document.createElement('tr');\n            keyRow.innerHTML = '<td><strong>Access Key:</strong></td><td><code></code></td>';\n            keyRow.querySelector('code').textContent = sa.access_key_id || '';\n            table1.appendChild(keyRow);\n            \n            // Status row\n            const statusRow = document.createElement('tr');\n            const statusTd1 = document.createElement('td');\n            statusTd1.innerHTML = '<strong>Status:</strong>';\n            const statusTd2 = document.createElement('td');\n            const statusBadge = document.createElement('span');\n            statusBadge.className = sa.status === 'Active' ? 'badge bg-success' : 'badge bg-secondary';\n            statusBadge.textContent = sa.status || 'Unknown';\n            statusTd2.appendChild(statusBadge);\n            statusRow.appendChild(statusTd1);\n            statusRow.appendChild(statusTd2);\n            table1.appendChild(statusRow);\n            \n            col1.appendChild(table1);\n            container.appendChild(col1);\n            \n            // Details column\n            const col2 = document.createElement('div');\n            col2.className = 'col-md-6';\n            \n            const h6_2 = document.createElement('h6');\n            h6_2.className = 'text-muted';\n            h6_2.textContent = 'Details';\n            col2.appendChild(h6_2);\n            \n            const table2 = document.createElement('table');\n            table2.className = 'table table-sm';\n            \n            // Description row\n            const descRow = document.createElement('tr');\n            descRow.innerHTML = '<td><strong>Description:</strong></td><td></td>';\n            descRow.querySelectorAll('td')[1].textContent = sa.description || 'Not set';\n            table2.appendChild(descRow);\n            \n            // Created row\n            const createdRow = document.createElement('tr');\n            createdRow.innerHTML = '<td><strong>Created:</strong></td><td></td>';\n            try {\n                createdRow.querySelectorAll('td')[1].textContent = new Date(sa.create_date).toLocaleString();\n            } catch (e) {\n                createdRow.querySelectorAll('td')[1].textContent = 'Invalid date';\n            }\n            table2.appendChild(createdRow);\n            \n            // Expiration row\n            const expRow = document.createElement('tr');\n            expRow.innerHTML = '<td><strong>Expires:</strong></td><td></td>';\n            expRow.querySelectorAll('td')[1].textContent = sa.expiration || 'Never';\n            table2.appendChild(expRow);\n            \n            col2.appendChild(table2);\n            container.appendChild(col2);\n            \n            return container.outerHTML;\n        }\n\n\n        function showSuccessMessage(message) {\n            showToast(message, 'success');\n        }\n\n        function showErrorMessage(message) {\n            showToast(message, 'danger');\n        }\n\n        function showToast(message, type) {\n            // Create toast container if it doesn't exist\n            let toastContainer = document.getElementById('toastContainer');\n            if (!toastContainer) {\n                toastContainer = document.createElement('div');\n                toastContainer.id = 'toastContainer';\n                toastContainer.className = 'toast-container position-fixed top-0 end-0 p-3';\n                toastContainer.style.zIndex = '9999';\n                document.body.appendChild(toastContainer);\n            }\n\n            // Create toast element\n            const toastId = 'toast-' + Date.now();\n            const toastHTML = `\n                <div id=\"${toastId}\" class=\"toast align-items-center text-white bg-${type} border-0\" role=\"alert\" aria-live=\"assertive\" aria-atomic=\"true\">\n                    <div class=\"d-flex\">\n                        <div class=\"toast-body\">\n                            ${escapeHtml(message)}\n                        </div>\n                        <button type=\"button\" class=\"btn-close btn-close-white me-2 m-auto\" data-bs-dismiss=\"toast\" aria-label=\"Close\"></button>\n                    </div>\n                </div>\n            `;\n            \n            toastContainer.insertAdjacentHTML('beforeend', toastHTML);\n            const toastElement = document.getElementById(toastId);\n            const toast = new bootstrap.Toast(toastElement, { autohide: true, delay: 5000 });\n            toast.show();\n            \n            // Remove toast element after it's hidden\n            toastElement.addEventListener('hidden.bs.toast', () => {\n                toastElement.remove();\n            });\n        }\n\n        function escapeHtml(text) {\n            const div = document.createElement('div');\n            div.textContent = text;\n            return div.innerHTML;\n        }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "</select> <small class=\"form-text text-muted\">The service account will inherit permissions from this user</small></div><div class=\"mb-3\"><label for=\"description\" class=\"form-label\">Description</label> <textarea class=\"form-control\" id=\"description\" name=\"description\" rows=\"2\" placeholder=\"What is this service account used for?\"></textarea></div><div class=\"mb-3\"><label for=\"expiration\" class=\"form-label\">Expiration (optional)</label> <input type=\"datetime-local\" class=\"form-control\" id=\"expiration\" name=\"expiration\"> <small class=\"form-text text-muted\">Leave empty for no expiration</small></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"handleCreateServiceAccount()\">Create</button></div></div></div></div><!-- Service Account Details Modal --><div class=\"modal fade\" id=\"saDetailsModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-robot me-2\"></i>Service Account Details</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\" id=\"saDetailsContent\"><!-- Content will be loaded dynamically --></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Close</button></div></div></div></div><!-- Credentials Display Modal --><div class=\"modal fade\" id=\"credentialsModal\" tabindex=\"-1\" role=\"dialog\" data-bs-backdrop=\"static\" data-bs-keyboard=\"false\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header bg-success text-white\"><h5 class=\"modal-title\"><i class=\"bi bi-check-circle me-2\"></i>Service Account Created Successfully</h5></div><div class=\"modal-body\"><div class=\"alert alert-warning\"><i class=\"bi bi-exclamation-triangle me-2\"></i> <strong>Important:</strong> This is the only time you will see the secret access key. Please save it securely.</div><div class=\"mb-4\"><h6 class=\"text-muted mb-3\">AWS CLI Configuration</h6><p class=\"text-muted small\">Use these credentials to configure AWS CLI or SDKs:</p><div class=\"mb-3\"><label class=\"form-label fw-bold\">AWS_ACCESS_KEY_ID</label><div class=\"input-group\"><input type=\"text\" class=\"form-control font-monospace\" id=\"displayAccessKey\" readonly> <button class=\"btn btn-outline-secondary\" type=\"button\" onclick=\"copyCredentialToClipboard(this, 'displayAccessKey')\"><i class=\"bi bi-copy\"></i> Copy</button></div></div><div class=\"mb-3\"><label class=\"form-label fw-bold\">AWS_SECRET_ACCESS_KEY</label><div class=\"input-group\"><input type=\"text\" class=\"form-control font-monospace\" id=\"displaySecretKey\" readonly> <button class=\"btn btn-outline-secondary\" type=\"button\" onclick=\"copyCredentialToClipboard(this, 'displaySecretKey')\"><i class=\"bi bi-copy\"></i> Copy</button></div></div></div><div class=\"bg-light p-3 rounded\"><h6 class=\"text-muted mb-2\">Example AWS CLI Usage:</h6><div class=\"font-monospace small\"><div>export AWS_ACCESS_KEY_ID=<span id=\"exampleAccessKey\"></span></div><div>export AWS_SECRET_ACCESS_KEY=<span id=\"exampleSecretKey\"></span></div><div>export AWS_ENDPOINT_URL=http://localhost:8333</div><div class=\"mt-2\"># List buckets</div><div>aws s3 ls</div><div class=\"mt-2\"># Upload a file</div><div>aws s3 cp myfile.txt s3://mybucket/</div></div></div></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-primary\" onclick=\"closeCredentialsModal()\"><i class=\"bi bi-check me-1\"></i>I have saved the credentials</button></div></div></div></div><!-- JavaScript for service account management --><script>\n        document.addEventListener('DOMContentLoaded', function() {\n            document.addEventListener('click', function(e) {\n                const button = e.target.closest('[data-action]');\n                if (!button) return;\n                \n                const action = button.getAttribute('data-action');\n                const saId = button.getAttribute('data-sa-id');\n                \n                switch (action) {\n                    case 'show-sa-details':\n                        showSADetails(saId);\n                        break;\n                    case 'toggle-sa-status':\n                        toggleSAStatus(saId, button.getAttribute('data-current-status'));\n                        break;\n                    case 'delete-sa':\n                        deleteSA(saId);\n                        break;\n                }\n            });\n        });\n\n        async function showSADetails(id) {\n            try {\n                const encodedId = encodeURIComponent(id);\n                const response = await fetch(basePath(`/api/service-accounts/${encodedId}`));\n                if (response.ok) {\n                    const sa = await response.json();\n                    document.getElementById('saDetailsContent').innerHTML = createSADetailsContent(sa);\n                    const modal = new bootstrap.Modal(document.getElementById('saDetailsModal'));\n                    modal.show();\n                } else {\n                    showErrorMessage('Failed to load service account details');\n                }\n            } catch (error) {\n                console.error('Error loading service account details:', error);\n                showErrorMessage('Failed to load service account details');\n            }\n        }\n\n        async function toggleSAStatus(id, currentStatus) {\n            const newStatus = currentStatus === 'Active' ? 'Inactive' : 'Active';\n            try {\n                const encodedId = encodeURIComponent(id);\n                const response = await fetch(basePath(`/api/service-accounts/${encodedId}`), {\n                    method: 'PUT',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ status: newStatus })\n                });\n                \n                if (response.ok) {\n                    showSuccessMessage(`Service account ${newStatus === 'Active' ? 'activated' : 'deactivated'}`);\n                    setTimeout(() => window.location.reload(), 1000);\n                } else {\n                    const error = await response.json();\n                    showErrorMessage('Failed to update status: ' + (error.error || 'Unknown error'));\n                }\n            } catch (error) {\n                console.error('Error updating status:', error);\n                showErrorMessage('Failed to update status: ' + error.message);\n            }\n        }\n\n        async function deleteSA(id) {\n            showDeleteConfirm(id, async function() {\n                try {\n                    const encodedId = encodeURIComponent(id);\n                    const response = await fetch(basePath(`/api/service-accounts/${encodedId}`), {\n                        method: 'DELETE'\n                    });\n                    \n                    if (response.ok) {\n                        showSuccessMessage('Service account deleted successfully');\n                        setTimeout(() => window.location.reload(), 1000);\n                    } else {\n                        const error = await response.json();\n                        showErrorMessage('Failed to delete: ' + (error.error || 'Unknown error'));\n                    }\n                } catch (error) {\n                    console.error('Error deleting service account:', error);\n                    showErrorMessage('Failed to delete: ' + error.message);\n                }\n            }, 'Are you sure you want to delete this service account? This action cannot be undone.');\n        }\n\n        async function handleCreateServiceAccount() {\n            const form = document.getElementById('createSAForm');\n            const formData = new FormData(form);\n            \n            const saData = {\n                parent_user: formData.get('parent_user'),\n                description: formData.get('description')\n            };\n            \n            // Handle expiration if set\n            const expiration = formData.get('expiration');\n            if (expiration) {\n                // Validate the date before using it\n                const date = new Date(expiration);\n                const now = new Date();\n                \n                if (isNaN(date.getTime())) {\n                    showErrorMessage('Invalid expiration date format');\n                    return;\n                }\n                \n                // Ensure expiration is in the future\n                if (date <= now) {\n                    showErrorMessage('Expiration date must be in the future');\n                    return;\n                }\n                \n                saData.expiration = date.toISOString();\n            }\n            \n            try {\n                const response = await fetch(basePath('/api/service-accounts'), {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify(saData)\n                });\n                \n                if (response.ok) {\n                    const result = await response.json();\n                    \n                    // Hide create modal\n                    const createModal = bootstrap.Modal.getInstance(document.getElementById('createServiceAccountModal'));\n                    createModal.hide();\n                    form.reset();\n                    \n                    // Show credentials if returned\n                    if (result.service_account && result.service_account.secret_access_key) {\n                        showCredentials(result.service_account);\n                    } else {\n                        showSuccessMessage('Service account created successfully');\n                        setTimeout(() => window.location.reload(), 1000);\n                    }\n                } else {\n                    const error = await response.json();\n                    showErrorMessage('Failed to create service account: ' + (error.error || 'Unknown error'));\n                }\n            } catch (error) {\n                console.error('Error creating service account:', error);\n                showErrorMessage('Failed to create service account: ' + error.message);\n            }\n        }\n\n        function showCredentials(serviceAccount) {\n            // Populate the credentials modal\n            document.getElementById('displayAccessKey').value = serviceAccount.access_key_id;\n            document.getElementById('displaySecretKey').value = serviceAccount.secret_access_key;\n            document.getElementById('exampleAccessKey').textContent = serviceAccount.access_key_id;\n            document.getElementById('exampleSecretKey').textContent = serviceAccount.secret_access_key;\n            \n            // Show the modal\n            const credentialsModal = new bootstrap.Modal(document.getElementById('credentialsModal'));\n            credentialsModal.show();\n        }\n\n        function closeCredentialsModal() {\n            const modal = bootstrap.Modal.getInstance(document.getElementById('credentialsModal'));\n            modal.hide();\n            // Reload to show the new service account in the list\n            setTimeout(() => window.location.reload(), 500);\n        }\n\n        function copyCredentialToClipboard(button, elementId) {\n            const element = document.getElementById(elementId);\n            const textToCopy = element.value;\n            \n            // Use modern Clipboard API if available\n            if (navigator.clipboard && navigator.clipboard.writeText) {\n                 navigator.clipboard.writeText(textToCopy).then(() => {\n                     showSuccessMessage('Copied to clipboard!');\n                 }).catch(err => {\n                     console.warn('Clipboard API failed:', err);\n                     // Fallback\n                     fallbackCopyTextToClipboard(element);\n                 });\n            } else {\n                // Fallback for older browsers or non-secure contexts\n                fallbackCopyTextToClipboard(element);\n            }\n            \n            // Visual feedback\n            const originalHTML = button.innerHTML;\n            \n            button.innerHTML = '<i class=\"bi bi-check\"></i>';\n            button.classList.remove('btn-outline-secondary');\n            button.classList.add('btn-success');\n            \n            setTimeout(() => {\n                button.innerHTML = originalHTML;\n                button.classList.remove('btn-success');\n                button.classList.add('btn-outline-secondary');\n            }, 1000);\n        }\n\n        function fallbackCopyTextToClipboard(element) {\n            element.select();\n            element.setSelectionRange(0, 99999); // For mobile devices\n            \n            try {\n                const successful = document.execCommand('copy');\n                if (successful) {\n                    showSuccessMessage('Copied to clipboard!');\n                } else {\n                    showErrorMessage('Failed to copy to clipboard');\n                }\n            } catch (err) {\n                console.error('Fallback copy failed:', err);\n                showErrorMessage('Failed to copy to clipboard');\n            }\n            \n            // Clear selection\n            window.getSelection().removeAllRanges();\n        }\n\n\n        function createSADetailsContent(sa) {\n            // Create DOM elements safely to prevent XSS\n            const container = document.createElement('div');\n            container.className = 'row';\n            \n            // Basic Information column\n            const col1 = document.createElement('div');\n            col1.className = 'col-md-6';\n            \n            const h6_1 = document.createElement('h6');\n            h6_1.className = 'text-muted';\n            h6_1.textContent = 'Basic Information';\n            col1.appendChild(h6_1);\n            \n            const table1 = document.createElement('table');\n            table1.className = 'table table-sm';\n            \n            // ID row\n            const idRow = document.createElement('tr');\n            idRow.innerHTML = '<td><strong>ID:</strong></td><td><code></code></td>';\n            idRow.querySelector('code').textContent = sa.id || '';\n            table1.appendChild(idRow);\n            \n            // Parent User row\n            const parentRow = document.createElement('tr');\n            parentRow.innerHTML = '<td><strong>Parent User:</strong></td><td></td>';\n            parentRow.querySelectorAll('td')[1].textContent = sa.parent_user || '';\n            table1.appendChild(parentRow);\n            \n            // Access Key row\n            const keyRow = document.createElement('tr');\n            keyRow.innerHTML = '<td><strong>Access Key:</strong></td><td><code></code></td>';\n            keyRow.querySelector('code').textContent = sa.access_key_id || '';\n            table1.appendChild(keyRow);\n            \n            // Status row\n            const statusRow = document.createElement('tr');\n            const statusTd1 = document.createElement('td');\n            statusTd1.innerHTML = '<strong>Status:</strong>';\n            const statusTd2 = document.createElement('td');\n            const statusBadge = document.createElement('span');\n            statusBadge.className = sa.status === 'Active' ? 'badge bg-success' : 'badge bg-secondary';\n            statusBadge.textContent = sa.status || 'Unknown';\n            statusTd2.appendChild(statusBadge);\n            statusRow.appendChild(statusTd1);\n            statusRow.appendChild(statusTd2);\n            table1.appendChild(statusRow);\n            \n            col1.appendChild(table1);\n            container.appendChild(col1);\n            \n            // Details column\n            const col2 = document.createElement('div');\n            col2.className = 'col-md-6';\n            \n            const h6_2 = document.createElement('h6');\n            h6_2.className = 'text-muted';\n            h6_2.textContent = 'Details';\n            col2.appendChild(h6_2);\n            \n            const table2 = document.createElement('table');\n            table2.className = 'table table-sm';\n            \n            // Description row\n            const descRow = document.createElement('tr');\n            descRow.innerHTML = '<td><strong>Description:</strong></td><td></td>';\n            descRow.querySelectorAll('td')[1].textContent = sa.description || 'Not set';\n            table2.appendChild(descRow);\n            \n            // Created row\n            const createdRow = document.createElement('tr');\n            createdRow.innerHTML = '<td><strong>Created:</strong></td><td></td>';\n            try {\n                createdRow.querySelectorAll('td')[1].textContent = new Date(sa.create_date).toLocaleString();\n            } catch (e) {\n                createdRow.querySelectorAll('td')[1].textContent = 'Invalid date';\n            }\n            table2.appendChild(createdRow);\n            \n            // Expiration row\n            const expRow = document.createElement('tr');\n            expRow.innerHTML = '<td><strong>Expires:</strong></td><td></td>';\n            expRow.querySelectorAll('td')[1].textContent = sa.expiration || 'Never';\n            table2.appendChild(expRow);\n            \n            col2.appendChild(table2);\n            container.appendChild(col2);\n            \n            return container.outerHTML;\n        }\n\n\n        function showSuccessMessage(message) {\n            showToast(message, 'success');\n        }\n\n        function showErrorMessage(message) {\n            showToast(message, 'danger');\n        }\n\n        function showToast(message, type) {\n            // Create toast container if it doesn't exist\n            let toastContainer = document.getElementById('toastContainer');\n            if (!toastContainer) {\n                toastContainer = document.createElement('div');\n                toastContainer.id = 'toastContainer';\n                toastContainer.className = 'toast-container position-fixed top-0 end-0 p-3';\n                toastContainer.style.zIndex = '9999';\n                document.body.appendChild(toastContainer);\n            }\n\n            // Create toast element\n            const toastId = 'toast-' + Date.now();\n            const toastHTML = `\n                <div id=\"${toastId}\" class=\"toast align-items-center text-white bg-${type} border-0\" role=\"alert\" aria-live=\"assertive\" aria-atomic=\"true\">\n                    <div class=\"d-flex\">\n                        <div class=\"toast-body\">\n                            ${escapeHtml(message)}\n                        </div>\n                        <button type=\"button\" class=\"btn-close btn-close-white me-2 m-auto\" data-bs-dismiss=\"toast\" aria-label=\"Close\"></button>\n                    </div>\n                </div>\n            `;\n            \n            toastContainer.insertAdjacentHTML('beforeend', toastHTML);\n            const toastElement = document.getElementById(toastId);\n            const toast = new bootstrap.Toast(toastElement, { autohide: true, delay: 5000 });\n            toast.show();\n            \n            // Remove toast element after it's hidden\n            toastElement.addEventListener('hidden.bs.toast', () => {\n                toastElement.remove();\n            });\n        }\n\n        function escapeHtml(text) {\n            const div = document.createElement('div');\n            div.textContent = text;\n            return div.innerHTML;\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/subscribers.templ b/weed/admin/view/app/subscribers.templ
index edcaf8a7bc..d70d8d3972 100644
--- a/weed/admin/view/app/subscribers.templ
+++ b/weed/admin/view/app/subscribers.templ
@@ -46,14 +46,14 @@ templ Subscribers(data dash.SubscribersData) {
                         <h5 class="mb-0">Subscribers</h5>
                         <div>
                             <button class="btn btn-sm btn-outline-secondary" onclick="exportSubscribersCSV()">
-                                <i class="fas fa-download me-1"></i>Export CSV
+                                <i class="bi bi-download me-1"></i>Export CSV
                             </button>
                         </div>
                     </div>
                     <div class="card-body">
                         if len(data.Subscribers) == 0 {
                             <div class="text-center py-4">
-                                <i class="fas fa-user-friends fa-3x text-muted mb-3"></i>
+                                <i class="bi bi-people icon-3x text-muted mb-3"></i>
                                 <h5>No Subscribers Found</h5>
                                 <p class="text-muted">No message queue subscribers are currently active.</p>
                             </div>
diff --git a/weed/admin/view/app/subscribers_templ.go b/weed/admin/view/app/subscribers_templ.go
index 83d97f7657..4fd53eead3 100644
--- a/weed/admin/view/app/subscribers_templ.go
+++ b/weed/admin/view/app/subscribers_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -84,12 +84,12 @@ func Subscribers(data dash.SubscribersData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</h3></div></div></div></div><!-- Subscribers Table --><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\">Subscribers</h5><div><button class=\"btn btn-sm btn-outline-secondary\" onclick=\"exportSubscribersCSV()\"><i class=\"fas fa-download me-1\"></i>Export CSV</button></div></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "</h3></div></div></div></div><!-- Subscribers Table --><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\">Subscribers</h5><div><button class=\"btn btn-sm btn-outline-secondary\" onclick=\"exportSubscribersCSV()\"><i class=\"bi bi-download me-1\"></i>Export CSV</button></div></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Subscribers) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "<div class=\"text-center py-4\"><i class=\"fas fa-user-friends fa-3x text-muted mb-3\"></i><h5>No Subscribers Found</h5><p class=\"text-muted\">No message queue subscribers are currently active.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "<div class=\"text-center py-4\"><i class=\"bi bi-people icon-3x text-muted mb-3\"></i><h5>No Subscribers Found</h5><p class=\"text-muted\">No message queue subscribers are currently active.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
diff --git a/weed/admin/view/app/table_format.go b/weed/admin/view/app/table_format.go
new file mode 100644
index 0000000000..8dfdff0aa3
--- /dev/null
+++ b/weed/admin/view/app/table_format.go
@@ -0,0 +1,63 @@
+package app
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// Shared rendering for the table format a bucket or table carries. A bucket is a
+// catalog and a catalog serves one protocol, so the format decides which
+// endpoint a client uses and which panels on a page mean anything.
+
+// formatLabel is what the badge says. A bucket created before formats were
+// declared has none; that is a fact about its age, not a fault, so it says so
+// plainly rather than claiming a format it never chose.
+func formatLabel(format string) string {
+	if strings.TrimSpace(format) == "" {
+		return "unset"
+	}
+	return strings.ToUpper(format)
+}
+
+// formatBadgeClass keeps the two formats distinguishable at a glance without
+// reaching for a colour that means something else in this UI.
+func formatBadgeClass(format string) string {
+	switch strings.ToUpper(strings.TrimSpace(format)) {
+	case s3tables.FormatIceberg:
+		return "badge bg-primary"
+	case s3tables.FormatLance:
+		return "badge bg-success"
+	default:
+		return "badge bg-light text-muted border"
+	}
+}
+
+// formatBadgeTitle explains the badge on hover, which is the only place there is
+// room to say what an undeclared bucket does.
+func formatBadgeTitle(format string) string {
+	switch strings.ToUpper(strings.TrimSpace(format)) {
+	case s3tables.FormatIceberg:
+		return "Served over the Iceberg REST catalog"
+	case s3tables.FormatLance:
+		return "Served over the Lance Namespace API"
+	default:
+		return "Created before formats were declared; accepts tables of either format"
+	}
+}
+
+// isLanceFormat reports whether this is a format the cluster records but cannot
+// read, which is what decides between the Iceberg panels and the worker's.
+func isLanceFormat(format string) bool {
+	return strings.EqualFold(strings.TrimSpace(format), s3tables.FormatLance)
+}
+
+// bucketCatalogPath is the path a client uses to reach one bucket, which differs
+// per format because the two are different protocols on different ports.
+func bucketCatalogPath(format, bucket string) string {
+	if isLanceFormat(format) {
+		return fmt.Sprintf("/v1/namespace/%s/list", bucket)
+	}
+	return fmt.Sprintf("/v1/%s/namespaces", bucket)
+}
diff --git a/weed/admin/view/app/topic_details.templ b/weed/admin/view/app/topic_details.templ
index ac471c25fc..5364291dce 100644
--- a/weed/admin/view/app/topic_details.templ
+++ b/weed/admin/view/app/topic_details.templ
@@ -112,10 +112,10 @@ templ TopicDetails(data dash.TopicDetailsData) {
                         <div class="card">
                             <div class="card-header d-flex justify-content-between align-items-center">
                                 <h5 class="mb-0">
-                                    <i class="fas fa-clock me-2"></i>Retention Policy
+                                    <i class="bi bi-clock me-2"></i>Retention Policy
                                 </h5>
                                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="showEditRetentionModal()">
-                                    <i class="fas fa-edit me-1"></i>Edit
+                                    <i class="bi bi-pencil-square me-1"></i>Edit
                                 </button>
                             </div>
                             <div class="card-body">
@@ -172,9 +172,9 @@ templ TopicDetails(data dash.TopicDetailsData) {
                                                         <td><span class="badge bg-secondary">{field.Type}</span></td>
                                                         <td>
                                                             if field.Required {
-                                                                <i class="fas fa-check text-success"></i>
+                                                                <i class="bi bi-check text-success"></i>
                                                             } else {
-                                                                <i class="fas fa-times text-muted"></i>
+                                                                <i class="bi bi-x text-muted"></i>
                                                             }
                                                         </td>
                                                         <td><span class="badge bg-primary">Key</span></td>
@@ -186,9 +186,9 @@ templ TopicDetails(data dash.TopicDetailsData) {
                                                         <td><span class="badge bg-secondary">{field.Type}</span></td>
                                                         <td>
                                                             if field.Required {
-                                                                <i class="fas fa-check text-success"></i>
+                                                                <i class="bi bi-check text-success"></i>
                                                             } else {
-                                                                <i class="fas fa-times text-muted"></i>
+                                                                <i class="bi bi-x text-muted"></i>
                                                             }
                                                         </td>
                                                         <td><span class="badge bg-info">Value</span></td>
@@ -209,14 +209,14 @@ templ TopicDetails(data dash.TopicDetailsData) {
                         <h5 class="mb-0">Partitions</h5>
                         <div>
                             <button class="btn btn-sm btn-outline-secondary" onclick="exportPartitionsCSV()">
-                                <i class="fas fa-download me-1"></i>Export CSV
+                                <i class="bi bi-download me-1"></i>Export CSV
                             </button>
                         </div>
                     </div>
                     <div class="card-body">
                         if len(data.Partitions) == 0 {
                             <div class="text-center py-4">
-                                <i class="fas fa-server fa-3x text-muted mb-3"></i>
+                                <i class="bi bi-server icon-3x text-muted mb-3"></i>
                                 <h5>No Partitions Found</h5>
                                 <p class="text-muted">No partitions are configured for this topic.</p>
                             </div>
@@ -281,7 +281,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
                             <div class="card-body">
                                 if len(data.Publishers) == 0 {
                                     <div class="alert alert-info mb-0">
-                                        <i class="fas fa-info-circle"></i> No active publishers found for this topic.
+                                        <i class="bi bi-info-circle"></i> No active publishers found for this topic.
                                     </div>
                                 } else {
                                     <div class="table-responsive">
@@ -351,7 +351,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
                             <div class="card-body">
                                 if len(data.Subscribers) == 0 {
                                     <div class="alert alert-info mb-0">
-                                        <i class="fas fa-info-circle"></i> No active subscribers found for this topic.
+                                        <i class="bi bi-info-circle"></i> No active subscribers found for this topic.
                                     </div>
                                 } else {
                                     <div class="table-responsive">
@@ -424,7 +424,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
                             <div class="card-body">
                                 if len(data.ConsumerGroupOffsets) == 0 {
                                     <div class="alert alert-info mb-0">
-                                        <i class="fas fa-info-circle"></i> No consumer group offsets found for this topic.
+                                        <i class="bi bi-info-circle"></i> No consumer group offsets found for this topic.
                                     </div>
                                 } else {
                                     <div class="table-responsive">
@@ -594,7 +594,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
             // Show loading state
             const updateButton = document.querySelector('#editRetentionModal .btn-primary');
             updateButton.disabled = true;
-            updateButton.innerHTML = '<i class="fas fa-spinner fa-spin me-1"></i>Updating...';
+            updateButton.innerHTML = '<i class="bi bi-arrow-repeat icon-spin me-1"></i>Updating...';
 
             // Send API request
             fetch((window.__BASE_PATH__ || '') + '/api/mq/topics/retention/update', {
@@ -622,7 +622,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
             .finally(() => {
                 // Reset button state
                 updateButton.disabled = false;
-                updateButton.innerHTML = '<i class="fas fa-save me-1"></i>Update Retention';
+                updateButton.innerHTML = '<i class="bi bi-floppy me-1"></i>Update Retention';
             });
         }
     </script>
@@ -633,7 +633,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-edit me-2"></i>Edit Retention Policy
+                        <i class="bi bi-pencil-square me-2"></i>Edit Retention Policy
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -642,7 +642,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
                         <div class="card">
                             <div class="card-header">
                                 <h6 class="mb-0">
-                                    <i class="fas fa-clock me-2"></i>Retention Configuration
+                                    <i class="bi bi-clock me-2"></i>Retention Configuration
                                 </h6>
                             </div>
                             <div class="card-body">
@@ -673,7 +673,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
                                         </div>
                                     </div>
                                     <div class="alert alert-info">
-                                        <i class="fas fa-info-circle me-2"></i>
+                                        <i class="bi bi-info-circle me-2"></i>
                                         Data older than this duration will be automatically purged to save storage space.
                                     </div>
                                 </div>
@@ -684,7 +684,7 @@ templ TopicDetails(data dash.TopicDetailsData) {
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                     <button type="button" class="btn btn-primary" onclick="updateRetention()">
-                        <i class="fas fa-save me-1"></i>Update Retention
+                        <i class="bi bi-floppy me-1"></i>Update Retention
                     </button>
                 </div>
             </div>
diff --git a/weed/admin/view/app/topic_details_templ.go b/weed/admin/view/app/topic_details_templ.go
index e716b9a47e..cc1e5a9b10 100644
--- a/weed/admin/view/app/topic_details_templ.go
+++ b/weed/admin/view/app/topic_details_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -228,7 +228,7 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</dd></dl></div></div></div><div class=\"col-md-6\"><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"fas fa-clock me-2\"></i>Retention Policy</h5><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"showEditRetentionModal()\"><i class=\"fas fa-edit me-1\"></i>Edit</button></div><div class=\"card-body\"><dl class=\"row\"><dt class=\"col-sm-4\">Status:</dt><dd class=\"col-sm-8\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</dd></dl></div></div></div><div class=\"col-md-6\"><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\"><i class=\"bi bi-clock me-2\"></i>Retention Policy</h5><button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"showEditRetentionModal()\"><i class=\"bi bi-pencil-square me-1\"></i>Edit</button></div><div class=\"card-body\"><dl class=\"row\"><dt class=\"col-sm-4\">Status:</dt><dd class=\"col-sm-8\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -330,12 +330,12 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				if field.Required {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"fas fa-check text-success\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<i class=\"bi bi-check text-success\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"fas fa-times text-muted\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<i class=\"bi bi-x text-muted\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -377,12 +377,12 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				if field.Required {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"fas fa-check text-success\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "<i class=\"bi bi-check text-success\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"fas fa-times text-muted\"></i>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<i class=\"bi bi-x text-muted\"></i>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -397,12 +397,12 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "</div></div></div></div><!-- Partitions Table --><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\">Partitions</h5><div><button class=\"btn btn-sm btn-outline-secondary\" onclick=\"exportPartitionsCSV()\"><i class=\"fas fa-download me-1\"></i>Export CSV</button></div></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "</div></div></div></div><!-- Partitions Table --><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\">Partitions</h5><div><button class=\"btn btn-sm btn-outline-secondary\" onclick=\"exportPartitionsCSV()\"><i class=\"bi bi-download me-1\"></i>Export CSV</button></div></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Partitions) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<div class=\"text-center py-4\"><i class=\"fas fa-server fa-3x text-muted mb-3\"></i><h5>No Partitions Found</h5><p class=\"text-muted\">No partitions are configured for this topic.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "<div class=\"text-center py-4\"><i class=\"bi bi-server icon-3x text-muted mb-3\"></i><h5>No Partitions Found</h5><p class=\"text-muted\">No partitions are configured for this topic.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -561,7 +561,7 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Publishers) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "<div class=\"alert alert-info mb-0\"><i class=\"fas fa-info-circle\"></i> No active publishers found for this topic.</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "<div class=\"alert alert-info mb-0\"><i class=\"bi bi-info-circle\"></i> No active publishers found for this topic.</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -737,7 +737,7 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Subscribers) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "<div class=\"alert alert-info mb-0\"><i class=\"fas fa-info-circle\"></i> No active subscribers found for this topic.</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "<div class=\"alert alert-info mb-0\"><i class=\"bi bi-info-circle\"></i> No active subscribers found for this topic.</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -926,7 +926,7 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if len(data.ConsumerGroupOffsets) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, "<div class=\"alert alert-info mb-0\"><i class=\"fas fa-info-circle\"></i> No consumer group offsets found for this topic.</div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 109, "<div class=\"alert alert-info mb-0\"><i class=\"bi bi-info-circle\"></i> No consumer group offsets found for this topic.</div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -998,7 +998,7 @@ func TopicDetails(data dash.TopicDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 117, "</div></div></div></div></div></div></div><script>\n        function exportPartitionsCSV() {\n            const table = document.getElementById('partitionsTable');\n            if (!table) return;\n            \n            let csv = 'Partition ID,Leader Broker,Follower Broker,Messages,Size,Last Data Time,Created\\n';\n            \n            const rows = table.querySelectorAll('tbody tr');\n            rows.forEach(row => {\n                const cells = row.querySelectorAll('td');\n                if (cells.length >= 7) {\n                    const rowData = [\n                        cells[0].querySelector('.badge')?.textContent || '',\n                        cells[1].querySelector('strong')?.textContent || '',\n                        cells[2].textContent || '',\n                        cells[3].textContent || '',\n                        cells[4].textContent || '',\n                        cells[5].querySelector('span')?.textContent || '',\n                        cells[6].querySelector('span')?.textContent || ''\n                    ];\n                    csv += rowData.map(field => `\"${field.replace(/\"/g, '\"\"')}\"`).join(',') + '\\n';\n                }\n            });\n            \n            const blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' });\n            const link = document.createElement('a');\n            const url = URL.createObjectURL(blob);\n            link.setAttribute('href', url);\n            link.setAttribute('download', 'topic_partitions.csv');\n            link.style.visibility = 'hidden';\n            document.body.appendChild(link);\n            link.click();\n            document.body.removeChild(link);\n        }\n\n        // Edit retention functions\n        function showEditRetentionModal() {\n            const modal = new bootstrap.Modal(document.getElementById('editRetentionModal'));\n            \n            // Get current retention values from the page\n            const currentEnabled = document.querySelector('dd .badge.bg-success') !== null;\n            const currentDurationElement = document.querySelector('dd .text-success');\n            \n            let currentValue = 7;\n            let currentUnit = 'days';\n            \n            if (currentEnabled && currentDurationElement) {\n                const durationText = currentDurationElement.textContent.trim();\n                const parts = durationText.split(' ');\n                if (parts.length >= 2) {\n                    currentValue = parseInt(parts[0]) || 7;\n                    currentUnit = parts[1].toLowerCase();\n                    // Handle plural forms\n                    if (currentUnit.endsWith('s')) {\n                        currentUnit = currentUnit.slice(0, -1);\n                    }\n                    // Map to our dropdown values\n                    if (currentUnit === 'hour') {\n                        currentUnit = 'hours';\n                    } else if (currentUnit === 'day') {\n                        currentUnit = 'days';\n                    }\n                }\n            }\n            \n            // Set current values in the modal\n            document.getElementById('editEnableRetention').checked = currentEnabled;\n            document.getElementById('editRetentionValue').value = currentValue;\n            document.getElementById('editRetentionUnit').value = currentUnit;\n            \n            // Show/hide retention fields based on current state\n            toggleEditRetentionFields();\n            \n            modal.show();\n        }\n\n        function toggleEditRetentionFields() {\n            const enableRetention = document.getElementById('editEnableRetention');\n            const retentionFields = document.getElementById('editRetentionFields');\n            \n            if (enableRetention.checked) {\n                retentionFields.style.display = 'block';\n            } else {\n                retentionFields.style.display = 'none';\n            }\n        }\n\n        function updateRetention() {\n            const form = document.getElementById('editRetentionForm');\n            const formData = new FormData(form);\n            \n            // Get topic details from the page\n            const topicName = document.querySelector('h1').textContent.replace('Topic Details: ', '');\n            const parts = topicName.split('.');\n            \n            if (parts.length < 2) {\n                alert('Invalid topic name format');\n                return;\n            }\n            \n            const namespace = parts[0];\n            const name = parts.slice(1).join('.');\n            \n            // Convert form data to JSON\n            const data = {\n                namespace: namespace,\n                name: name,\n                retention: {\n                    enabled: formData.get('editEnableRetention') === 'on',\n                    retention_seconds: 0\n                }\n            };\n\n            // Calculate retention seconds if enabled\n            if (data.retention.enabled) {\n                const retentionValue = parseInt(formData.get('editRetentionValue'));\n                const retentionUnit = formData.get('editRetentionUnit');\n                \n                if (retentionUnit === 'hours') {\n                    data.retention.retention_seconds = retentionValue * 3600;\n                } else if (retentionUnit === 'days') {\n                    data.retention.retention_seconds = retentionValue * 86400;\n                }\n            }\n\n            // Show loading state\n            const updateButton = document.querySelector('#editRetentionModal .btn-primary');\n            updateButton.disabled = true;\n            updateButton.innerHTML = '<i class=\"fas fa-spinner fa-spin me-1\"></i>Updating...';\n\n            // Send API request\n            fetch((window.__BASE_PATH__ || '') + '/api/mq/topics/retention/update', {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(result => {\n                if (result.error) {\n                    alert('Failed to update retention: ' + result.error);\n                } else {\n                    alert('Retention policy updated successfully!');\n                    // Close modal and refresh page\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('editRetentionModal'));\n                    modal.hide();\n                    window.location.reload();\n                }\n            })\n            .catch(error => {\n                alert('Failed to update retention: ' + error.message);\n            })\n            .finally(() => {\n                // Reset button state\n                updateButton.disabled = false;\n                updateButton.innerHTML = '<i class=\"fas fa-save me-1\"></i>Update Retention';\n            });\n        }\n    </script><!-- Edit Retention Modal --><div class=\"modal fade\" id=\"editRetentionModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-edit me-2\"></i>Edit Retention Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"editRetentionForm\"><div class=\"card\"><div class=\"card-header\"><h6 class=\"mb-0\"><i class=\"fas fa-clock me-2\"></i>Retention Configuration</h6></div><div class=\"card-body\"><div class=\"form-check mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"editEnableRetention\" name=\"editEnableRetention\" onchange=\"toggleEditRetentionFields()\"> <label class=\"form-check-label\" for=\"editEnableRetention\">Enable data retention</label></div><div id=\"editRetentionFields\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"editRetentionValue\" class=\"form-label\">Retention Duration</label> <input type=\"number\" class=\"form-control\" id=\"editRetentionValue\" name=\"editRetentionValue\" min=\"1\" value=\"7\"></div></div><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"editRetentionUnit\" class=\"form-label\">Unit</label> <select class=\"form-control\" id=\"editRetentionUnit\" name=\"editRetentionUnit\"><option value=\"hours\">Hours</option> <option value=\"days\" selected>Days</option></select></div></div></div><div class=\"alert alert-info\"><i class=\"fas fa-info-circle me-2\"></i> Data older than this duration will be automatically purged to save storage space.</div></div></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"updateRetention()\"><i class=\"fas fa-save me-1\"></i>Update Retention</button></div></div></div></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 117, "</div></div></div></div></div></div></div><script>\n        function exportPartitionsCSV() {\n            const table = document.getElementById('partitionsTable');\n            if (!table) return;\n            \n            let csv = 'Partition ID,Leader Broker,Follower Broker,Messages,Size,Last Data Time,Created\\n';\n            \n            const rows = table.querySelectorAll('tbody tr');\n            rows.forEach(row => {\n                const cells = row.querySelectorAll('td');\n                if (cells.length >= 7) {\n                    const rowData = [\n                        cells[0].querySelector('.badge')?.textContent || '',\n                        cells[1].querySelector('strong')?.textContent || '',\n                        cells[2].textContent || '',\n                        cells[3].textContent || '',\n                        cells[4].textContent || '',\n                        cells[5].querySelector('span')?.textContent || '',\n                        cells[6].querySelector('span')?.textContent || ''\n                    ];\n                    csv += rowData.map(field => `\"${field.replace(/\"/g, '\"\"')}\"`).join(',') + '\\n';\n                }\n            });\n            \n            const blob = new Blob([csv], { type: 'text/csv;charset=utf-8;' });\n            const link = document.createElement('a');\n            const url = URL.createObjectURL(blob);\n            link.setAttribute('href', url);\n            link.setAttribute('download', 'topic_partitions.csv');\n            link.style.visibility = 'hidden';\n            document.body.appendChild(link);\n            link.click();\n            document.body.removeChild(link);\n        }\n\n        // Edit retention functions\n        function showEditRetentionModal() {\n            const modal = new bootstrap.Modal(document.getElementById('editRetentionModal'));\n            \n            // Get current retention values from the page\n            const currentEnabled = document.querySelector('dd .badge.bg-success') !== null;\n            const currentDurationElement = document.querySelector('dd .text-success');\n            \n            let currentValue = 7;\n            let currentUnit = 'days';\n            \n            if (currentEnabled && currentDurationElement) {\n                const durationText = currentDurationElement.textContent.trim();\n                const parts = durationText.split(' ');\n                if (parts.length >= 2) {\n                    currentValue = parseInt(parts[0]) || 7;\n                    currentUnit = parts[1].toLowerCase();\n                    // Handle plural forms\n                    if (currentUnit.endsWith('s')) {\n                        currentUnit = currentUnit.slice(0, -1);\n                    }\n                    // Map to our dropdown values\n                    if (currentUnit === 'hour') {\n                        currentUnit = 'hours';\n                    } else if (currentUnit === 'day') {\n                        currentUnit = 'days';\n                    }\n                }\n            }\n            \n            // Set current values in the modal\n            document.getElementById('editEnableRetention').checked = currentEnabled;\n            document.getElementById('editRetentionValue').value = currentValue;\n            document.getElementById('editRetentionUnit').value = currentUnit;\n            \n            // Show/hide retention fields based on current state\n            toggleEditRetentionFields();\n            \n            modal.show();\n        }\n\n        function toggleEditRetentionFields() {\n            const enableRetention = document.getElementById('editEnableRetention');\n            const retentionFields = document.getElementById('editRetentionFields');\n            \n            if (enableRetention.checked) {\n                retentionFields.style.display = 'block';\n            } else {\n                retentionFields.style.display = 'none';\n            }\n        }\n\n        function updateRetention() {\n            const form = document.getElementById('editRetentionForm');\n            const formData = new FormData(form);\n            \n            // Get topic details from the page\n            const topicName = document.querySelector('h1').textContent.replace('Topic Details: ', '');\n            const parts = topicName.split('.');\n            \n            if (parts.length < 2) {\n                alert('Invalid topic name format');\n                return;\n            }\n            \n            const namespace = parts[0];\n            const name = parts.slice(1).join('.');\n            \n            // Convert form data to JSON\n            const data = {\n                namespace: namespace,\n                name: name,\n                retention: {\n                    enabled: formData.get('editEnableRetention') === 'on',\n                    retention_seconds: 0\n                }\n            };\n\n            // Calculate retention seconds if enabled\n            if (data.retention.enabled) {\n                const retentionValue = parseInt(formData.get('editRetentionValue'));\n                const retentionUnit = formData.get('editRetentionUnit');\n                \n                if (retentionUnit === 'hours') {\n                    data.retention.retention_seconds = retentionValue * 3600;\n                } else if (retentionUnit === 'days') {\n                    data.retention.retention_seconds = retentionValue * 86400;\n                }\n            }\n\n            // Show loading state\n            const updateButton = document.querySelector('#editRetentionModal .btn-primary');\n            updateButton.disabled = true;\n            updateButton.innerHTML = '<i class=\"bi bi-arrow-repeat icon-spin me-1\"></i>Updating...';\n\n            // Send API request\n            fetch((window.__BASE_PATH__ || '') + '/api/mq/topics/retention/update', {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                },\n                body: JSON.stringify(data)\n            })\n            .then(response => response.json())\n            .then(result => {\n                if (result.error) {\n                    alert('Failed to update retention: ' + result.error);\n                } else {\n                    alert('Retention policy updated successfully!');\n                    // Close modal and refresh page\n                    const modal = bootstrap.Modal.getInstance(document.getElementById('editRetentionModal'));\n                    modal.hide();\n                    window.location.reload();\n                }\n            })\n            .catch(error => {\n                alert('Failed to update retention: ' + error.message);\n            })\n            .finally(() => {\n                // Reset button state\n                updateButton.disabled = false;\n                updateButton.innerHTML = '<i class=\"bi bi-floppy me-1\"></i>Update Retention';\n            });\n        }\n    </script><!-- Edit Retention Modal --><div class=\"modal fade\" id=\"editRetentionModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-pencil-square me-2\"></i>Edit Retention Policy</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"editRetentionForm\"><div class=\"card\"><div class=\"card-header\"><h6 class=\"mb-0\"><i class=\"bi bi-clock me-2\"></i>Retention Configuration</h6></div><div class=\"card-body\"><div class=\"form-check mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"editEnableRetention\" name=\"editEnableRetention\" onchange=\"toggleEditRetentionFields()\"> <label class=\"form-check-label\" for=\"editEnableRetention\">Enable data retention</label></div><div id=\"editRetentionFields\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"editRetentionValue\" class=\"form-label\">Retention Duration</label> <input type=\"number\" class=\"form-control\" id=\"editRetentionValue\" name=\"editRetentionValue\" min=\"1\" value=\"7\"></div></div><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"editRetentionUnit\" class=\"form-label\">Unit</label> <select class=\"form-control\" id=\"editRetentionUnit\" name=\"editRetentionUnit\"><option value=\"hours\">Hours</option> <option value=\"days\" selected>Days</option></select></div></div></div><div class=\"alert alert-info\"><i class=\"bi bi-info-circle me-2\"></i> Data older than this duration will be automatically purged to save storage space.</div></div></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"updateRetention()\"><i class=\"bi bi-floppy me-1\"></i>Update Retention</button></div></div></div></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/topics.templ b/weed/admin/view/app/topics.templ
index 8c916a9728..665b7581fe 100644
--- a/weed/admin/view/app/topics.templ
+++ b/weed/admin/view/app/topics.templ
@@ -39,17 +39,17 @@ templ Topics(data dash.TopicsData) {
                         <h5 class="mb-0">Topics</h5>
                         <div>
                             <button class="btn btn-sm btn-primary me-2" onclick="showCreateTopicModal()">
-                                <i class="fas fa-plus me-1"></i>Create Topic
+                                <i class="bi bi-plus me-1"></i>Create Topic
                             </button>
                             <button class="btn btn-sm btn-outline-secondary" onclick="exportTopicsCSV()">
-                                <i class="fas fa-download me-1"></i>Export CSV
+                                <i class="bi bi-download me-1"></i>Export CSV
                             </button>
                         </div>
                     </div>
                     <div class="card-body">
                         if len(data.Topics) == 0 {
                             <div class="text-center py-4">
-                                <i class="fas fa-list-alt fa-3x text-muted mb-3"></i>
+                                <i class="bi bi-card-list icon-3x text-muted mb-3"></i>
                                 <h5>No Topics Found</h5>
                                 <p class="text-muted">No message queue topics are currently configured.</p>
                             </div>
@@ -92,18 +92,18 @@ templ Topics(data dash.TopicsData) {
                                                 <td>
                                                     if topic.Retention.Enabled {
                                                         <span class="badge bg-success">
-                                                            <i class="fas fa-clock me-1"></i>
+                                                            <i class="bi bi-clock me-1"></i>
                                                             {fmt.Sprintf("%d %s", topic.Retention.DisplayValue, topic.Retention.DisplayUnit)}
                                                         </span>
                                                     } else {
                                                         <span class="badge bg-secondary">
-                                                            <i class="fas fa-times me-1"></i>Disabled
+                                                            <i class="bi bi-x me-1"></i>Disabled
                                                         </span>
                                                     }
                                                 </td>
                                                 <td>
                                                     <button class="btn btn-sm btn-outline-primary" data-action="view-topic-details" data-topic-name={ topic.Name }>
-                                                        <i class="fas fa-eye"></i>
+                                                        <i class="bi bi-eye"></i>
                                                     </button>
                                                 </td>
                                             </tr>
@@ -111,7 +111,7 @@ templ Topics(data dash.TopicsData) {
                                                 <td colspan="5">
                                                     <div class="topic-details-content">
                                                         <div class="text-center py-3">
-                                                            <i class="fas fa-spinner fa-spin"></i> Loading topic details...
+                                                            <i class="bi bi-arrow-repeat icon-spin"></i> Loading topic details...
                                                         </div>
                                                     </div>
                                                 </td>
@@ -133,7 +133,7 @@ templ Topics(data dash.TopicsData) {
             <div class="modal-content">
                 <div class="modal-header">
                     <h5 class="modal-title">
-                        <i class="fas fa-plus me-2"></i>Create New Topic
+                        <i class="bi bi-plus me-2"></i>Create New Topic
                     </h5>
                     <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                 </div>
@@ -169,7 +169,7 @@ templ Topics(data dash.TopicsData) {
                         <div class="card mt-3">
                             <div class="card-header">
                                 <h6 class="mb-0">
-                                    <i class="fas fa-clock me-2"></i>Retention Policy
+                                    <i class="bi bi-clock me-2"></i>Retention Policy
                                 </h6>
                             </div>
                             <div class="card-body">
@@ -200,7 +200,7 @@ templ Topics(data dash.TopicsData) {
                                         </div>
                                     </div>
                                     <div class="alert alert-info">
-                                        <i class="fas fa-info-circle me-2"></i>
+                                        <i class="bi bi-info-circle me-2"></i>
                                         Data older than this duration will be automatically purged to save storage space.
                                     </div>
                                 </div>
@@ -211,7 +211,7 @@ templ Topics(data dash.TopicsData) {
                 <div class="modal-footer">
                     <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
                     <button type="button" class="btn btn-primary" onclick="createTopic()">
-                        <i class="fas fa-plus me-1"></i>Create Topic
+                        <i class="bi bi-plus me-1"></i>Create Topic
                     </button>
                 </div>
             </div>
@@ -338,13 +338,13 @@ templ Topics(data dash.TopicsData) {
                     
                     if (detailsRow.style.display === 'none') {
                         detailsRow.style.display = 'table-row';
-                        this.innerHTML = '<i class="fas fa-eye-slash"></i>';
+                        this.innerHTML = '<i class="bi bi-eye-slash"></i>';
                         
                         // Load topic details
                         loadTopicDetails(topicName);
                     } else {
                         detailsRow.style.display = 'none';
-                        this.innerHTML = '<i class="fas fa-eye"></i>';
+                        this.innerHTML = '<i class="bi bi-eye"></i>';
                     }
                 });
             });
@@ -369,10 +369,10 @@ templ Topics(data dash.TopicsData) {
                     html += '<div class="col-md-6">';
                     html += '<h6>Retention Policy</h6>';
                     if (data.retention && data.retention.enabled) {
-                        html += '<p><i class="fas fa-check-circle text-success"></i> Enabled</p>';
+                        html += '<p><i class="bi bi-check-circle text-success"></i> Enabled</p>';
                         html += '<p><strong>Duration:</strong> ' + data.retention.value + ' ' + data.retention.unit + '</p>';
                     } else {
-                        html += '<p><i class="fas fa-times-circle text-danger"></i> Disabled</p>';
+                        html += '<p><i class="bi bi-x-circle text-danger"></i> Disabled</p>';
                     }
                     html += '</div>';
                     html += '</div>';
diff --git a/weed/admin/view/app/topics_templ.go b/weed/admin/view/app/topics_templ.go
index f7ae680917..3e1eed0ca1 100644
--- a/weed/admin/view/app/topics_templ.go
+++ b/weed/admin/view/app/topics_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -72,12 +72,12 @@ func Topics(data dash.TopicsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</h3></div></div></div></div><!-- Topics Table --><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\">Topics</h5><div><button class=\"btn btn-sm btn-primary me-2\" onclick=\"showCreateTopicModal()\"><i class=\"fas fa-plus me-1\"></i>Create Topic</button> <button class=\"btn btn-sm btn-outline-secondary\" onclick=\"exportTopicsCSV()\"><i class=\"fas fa-download me-1\"></i>Export CSV</button></div></div><div class=\"card-body\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</h3></div></div></div></div><!-- Topics Table --><div class=\"card\"><div class=\"card-header d-flex justify-content-between align-items-center\"><h5 class=\"mb-0\">Topics</h5><div><button class=\"btn btn-sm btn-primary me-2\" onclick=\"showCreateTopicModal()\"><i class=\"bi bi-plus me-1\"></i>Create Topic</button> <button class=\"btn btn-sm btn-outline-secondary\" onclick=\"exportTopicsCSV()\"><i class=\"bi bi-download me-1\"></i>Export CSV</button></div></div><div class=\"card-body\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Topics) == 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<div class=\"text-center py-4\"><i class=\"fas fa-list-alt fa-3x text-muted mb-3\"></i><h5>No Topics Found</h5><p class=\"text-muted\">No message queue topics are currently configured.</p></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<div class=\"text-center py-4\"><i class=\"bi bi-card-list icon-3x text-muted mb-3\"></i><h5>No Topics Found</h5><p class=\"text-muted\">No message queue topics are currently configured.</p></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -92,11 +92,11 @@ func Topics(data dash.TopicsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var5 string
-				templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(topic.Name)
+				templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.ResolveAttributeValue(topic.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/topics.templ`, Line: 70, Col: 93}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var5)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -156,7 +156,7 @@ func Topics(data dash.TopicsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				if topic.Retention.Enabled {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<span class=\"badge bg-success\"><i class=\"fas fa-clock me-1\"></i> ")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<span class=\"badge bg-success\"><i class=\"bi bi-clock me-1\"></i> ")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -174,7 +174,7 @@ func Topics(data dash.TopicsData) templ.Component {
 						return templ_7745c5c3_Err
 					}
 				} else {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<span class=\"badge bg-secondary\"><i class=\"fas fa-times me-1\"></i>Disabled</span>")
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<span class=\"badge bg-secondary\"><i class=\"bi bi-x me-1\"></i>Disabled</span>")
 					if templ_7745c5c3_Err != nil {
 						return templ_7745c5c3_Err
 					}
@@ -184,28 +184,28 @@ func Topics(data dash.TopicsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var10 string
-				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(topic.Name)
+				templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(topic.Name)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/topics.templ`, Line: 105, Col: 160}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "\"><i class=\"fas fa-eye\"></i></button></td></tr><tr class=\"topic-details-row\" id=\"")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "\"><i class=\"bi bi-eye\"></i></button></td></tr><tr class=\"topic-details-row\" id=\"")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var11 string
-				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("details-%s", strings.ReplaceAll(topic.Name, ".", "_")))
+				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("details-%s", strings.ReplaceAll(topic.Name, ".", "_")))
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/topics.templ`, Line: 110, Col: 146}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var11)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\" style=\"display: none;\"><td colspan=\"5\"><div class=\"topic-details-content\"><div class=\"text-center py-3\"><i class=\"fas fa-spinner fa-spin\"></i> Loading topic details...</div></div></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, "\" style=\"display: none;\"><td colspan=\"5\"><div class=\"topic-details-content\"><div class=\"text-center py-3\"><i class=\"bi bi-arrow-repeat icon-spin\"></i> Loading topic details...</div></div></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -215,7 +215,7 @@ func Topics(data dash.TopicsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</div></div></div></div></div><!-- Create Topic Modal --><div class=\"modal fade\" id=\"createTopicModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"fas fa-plus me-2\"></i>Create New Topic</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"createTopicForm\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"topicNamespace\" class=\"form-label\">Namespace *</label> <input type=\"text\" class=\"form-control\" id=\"topicNamespace\" name=\"namespace\" required placeholder=\"e.g., default\"></div></div><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"topicName\" class=\"form-label\">Topic Name *</label> <input type=\"text\" class=\"form-control\" id=\"topicName\" name=\"name\" required placeholder=\"e.g., user-events\"></div></div></div><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"partitionCount\" class=\"form-label\">Partition Count *</label> <input type=\"number\" class=\"form-control\" id=\"partitionCount\" name=\"partitionCount\" required min=\"1\" max=\"100\" value=\"6\"></div></div></div><!-- Retention Configuration --><div class=\"card mt-3\"><div class=\"card-header\"><h6 class=\"mb-0\"><i class=\"fas fa-clock me-2\"></i>Retention Policy</h6></div><div class=\"card-body\"><div class=\"form-check mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableRetention\" name=\"enableRetention\" onchange=\"toggleRetentionFields()\"> <label class=\"form-check-label\" for=\"enableRetention\">Enable data retention</label></div><div id=\"retentionFields\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"retentionValue\" class=\"form-label\">Retention Duration</label> <input type=\"number\" class=\"form-control\" id=\"retentionValue\" name=\"retentionValue\" min=\"1\" value=\"7\"></div></div><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"retentionUnit\" class=\"form-label\">Unit</label> <select class=\"form-control\" id=\"retentionUnit\" name=\"retentionUnit\"><option value=\"hours\">Hours</option> <option value=\"days\" selected>Days</option></select></div></div></div><div class=\"alert alert-info\"><i class=\"fas fa-info-circle me-2\"></i> Data older than this duration will be automatically purged to save storage space.</div></div></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"createTopic()\"><i class=\"fas fa-plus me-1\"></i>Create Topic</button></div></div></div></div><script type=\"text/javascript\">\n        // Topic management functions\n        function showCreateTopicModal() {\n            var modal = new bootstrap.Modal(document.getElementById('createTopicModal'));\n            modal.show();\n        }\n\n        function toggleRetentionFields() {\n            var enableRetention = document.getElementById('enableRetention').checked;\n            var retentionFields = document.getElementById('retentionFields');\n            \n            if (enableRetention) {\n                retentionFields.style.display = 'block';\n            } else {\n                retentionFields.style.display = 'none';\n            }\n        }\n\n        function createTopic() {\n            var form = document.getElementById('createTopicForm');\n            var formData = new FormData(form);\n            \n            if (!form.checkValidity()) {\n                form.classList.add('was-validated');\n                return;\n            }\n            \n            var namespace = formData.get('namespace');\n            var name = formData.get('name');\n            var partitionCount = formData.get('partitionCount');\n            var enableRetention = formData.get('enableRetention');\n            var retentionValue = enableRetention === 'on' ? parseInt(formData.get('retentionValue')) : 0;\n            var retentionUnit = enableRetention === 'on' ? formData.get('retentionUnit') : 'hours';\n            \n            // Convert retention to seconds\n            var retentionSeconds = 0;\n            if (enableRetention === 'on' && retentionValue > 0) {\n                if (retentionUnit === 'hours') {\n                    retentionSeconds = retentionValue * 3600;\n                } else if (retentionUnit === 'days') {\n                    retentionSeconds = retentionValue * 86400;\n                }\n            }\n            \n            var topicData = {\n                namespace: namespace,\n                name: name,\n                partition_count: parseInt(partitionCount),\n                retention: {\n                    enabled: enableRetention === 'on',\n                    retention_seconds: retentionSeconds\n                }\n            };\n            \n            // Create the topic\n            fetch(basePath('/api/mq/topics/create'), {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json'\n                },\n                body: JSON.stringify(topicData)\n            })\n            .then(response => {\n                if (response.ok) {\n                    return response.json();\n                }\n                throw new Error('Failed to create topic');\n            })\n            .then(data => {\n                // Hide modal and refresh page\n                var modal = bootstrap.Modal.getInstance(document.getElementById('createTopicModal'));\n                modal.hide();\n                location.reload();\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error creating topic: ' + error.message);\n            });\n        }\n\n        function exportTopicsCSV() {\n            var csvContent = 'Namespace,Topic Name,Partitions,Retention Enabled,Retention Value,Retention Unit\\n';\n            \n            var rows = document.querySelectorAll('#topicsTable tbody tr.topic-row');\n            rows.forEach(function(row) {\n                var cells = row.querySelectorAll('td');\n                var namespace = cells[0].textContent.trim();\n                var topicName = cells[1].textContent.trim();\n                var partitions = cells[2].textContent.trim();\n                var retention = cells[3].textContent.trim();\n                \n                var retentionEnabled = retention !== 'Disabled';\n                var retentionValue = retentionEnabled ? retention.split(' ')[0] : '';\n                var retentionUnit = retentionEnabled ? retention.split(' ')[1] : '';\n                \n                csvContent += namespace + ',' + topicName + ',' + partitions + ',' + retentionEnabled + ',' + retentionValue + ',' + retentionUnit + '\\n';\n            });\n            \n            var blob = new Blob([csvContent], { type: 'text/csv;charset=utf-8;' });\n            var link = document.createElement('a');\n            var url = URL.createObjectURL(blob);\n            link.setAttribute('href', url);\n            link.setAttribute('download', 'topics_export.csv');\n            link.style.visibility = 'hidden';\n            document.body.appendChild(link);\n            link.click();\n            document.body.removeChild(link);\n        }\n\n        // Topic details functionality\n        document.addEventListener('DOMContentLoaded', function() {\n            // Handle view topic details buttons\n            document.querySelectorAll('[data-action=\"view-topic-details\"]').forEach(function(button) {\n                button.addEventListener('click', function(e) {\n                    e.stopPropagation();\n                    var topicName = this.getAttribute('data-topic-name');\n                    var detailsRow = document.getElementById('details-' + topicName.replace(/\\./g, '_'));\n                    \n                    if (detailsRow.style.display === 'none') {\n                        detailsRow.style.display = 'table-row';\n                        this.innerHTML = '<i class=\"fas fa-eye-slash\"></i>';\n                        \n                        // Load topic details\n                        loadTopicDetails(topicName);\n                    } else {\n                        detailsRow.style.display = 'none';\n                        this.innerHTML = '<i class=\"fas fa-eye\"></i>';\n                    }\n                });\n            });\n        });\n\n        function loadTopicDetails(topicName) {\n            var detailsRow = document.getElementById('details-' + topicName.replace(/\\./g, '_'));\n            var contentDiv = detailsRow.querySelector('.topic-details-content');\n            \n            fetch(basePath('/admin/topics/' + encodeURIComponent(topicName) + '/details'))\n                .then(response => response.json())\n                .then(data => {\n                    var html = '<div class=\"row\">';\n                    html += '<div class=\"col-md-6\">';\n                    html += '<h6>Topic Configuration</h6>';\n                    html += '<ul class=\"list-unstyled\">';\n                    html += '<li><strong>Full Name:</strong> ' + data.name + '</li>';\n                    html += '<li><strong>Partitions:</strong> ' + data.partitions + '</li>';\n                    html += '<li><strong>Created:</strong> ' + (data.created || 'N/A') + '</li>';\n                    html += '</ul>';\n                    html += '</div>';\n                    html += '<div class=\"col-md-6\">';\n                    html += '<h6>Retention Policy</h6>';\n                    if (data.retention && data.retention.enabled) {\n                        html += '<p><i class=\"fas fa-check-circle text-success\"></i> Enabled</p>';\n                        html += '<p><strong>Duration:</strong> ' + data.retention.value + ' ' + data.retention.unit + '</p>';\n                    } else {\n                        html += '<p><i class=\"fas fa-times-circle text-danger\"></i> Disabled</p>';\n                    }\n                    html += '</div>';\n                    html += '</div>';\n                    \n                    contentDiv.innerHTML = html;\n                })\n                .catch(error => {\n                    console.error('Error loading topic details:', error);\n                    contentDiv.innerHTML = '<div class=\"alert alert-danger\">Failed to load topic details</div>';\n                });\n        }\n    </script>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</div></div></div></div></div><!-- Create Topic Modal --><div class=\"modal fade\" id=\"createTopicModal\" tabindex=\"-1\" role=\"dialog\"><div class=\"modal-dialog modal-lg\" role=\"document\"><div class=\"modal-content\"><div class=\"modal-header\"><h5 class=\"modal-title\"><i class=\"bi bi-plus me-2\"></i>Create New Topic</h5><button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"modal\"></button></div><div class=\"modal-body\"><form id=\"createTopicForm\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"topicNamespace\" class=\"form-label\">Namespace *</label> <input type=\"text\" class=\"form-control\" id=\"topicNamespace\" name=\"namespace\" required placeholder=\"e.g., default\"></div></div><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"topicName\" class=\"form-label\">Topic Name *</label> <input type=\"text\" class=\"form-control\" id=\"topicName\" name=\"name\" required placeholder=\"e.g., user-events\"></div></div></div><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"partitionCount\" class=\"form-label\">Partition Count *</label> <input type=\"number\" class=\"form-control\" id=\"partitionCount\" name=\"partitionCount\" required min=\"1\" max=\"100\" value=\"6\"></div></div></div><!-- Retention Configuration --><div class=\"card mt-3\"><div class=\"card-header\"><h6 class=\"mb-0\"><i class=\"bi bi-clock me-2\"></i>Retention Policy</h6></div><div class=\"card-body\"><div class=\"form-check mb-3\"><input class=\"form-check-input\" type=\"checkbox\" id=\"enableRetention\" name=\"enableRetention\" onchange=\"toggleRetentionFields()\"> <label class=\"form-check-label\" for=\"enableRetention\">Enable data retention</label></div><div id=\"retentionFields\" style=\"display: none;\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"retentionValue\" class=\"form-label\">Retention Duration</label> <input type=\"number\" class=\"form-control\" id=\"retentionValue\" name=\"retentionValue\" min=\"1\" value=\"7\"></div></div><div class=\"col-md-6\"><div class=\"mb-3\"><label for=\"retentionUnit\" class=\"form-label\">Unit</label> <select class=\"form-control\" id=\"retentionUnit\" name=\"retentionUnit\"><option value=\"hours\">Hours</option> <option value=\"days\" selected>Days</option></select></div></div></div><div class=\"alert alert-info\"><i class=\"bi bi-info-circle me-2\"></i> Data older than this duration will be automatically purged to save storage space.</div></div></div></div></form></div><div class=\"modal-footer\"><button type=\"button\" class=\"btn btn-secondary\" data-bs-dismiss=\"modal\">Cancel</button> <button type=\"button\" class=\"btn btn-primary\" onclick=\"createTopic()\"><i class=\"bi bi-plus me-1\"></i>Create Topic</button></div></div></div></div><script type=\"text/javascript\">\n        // Topic management functions\n        function showCreateTopicModal() {\n            var modal = new bootstrap.Modal(document.getElementById('createTopicModal'));\n            modal.show();\n        }\n\n        function toggleRetentionFields() {\n            var enableRetention = document.getElementById('enableRetention').checked;\n            var retentionFields = document.getElementById('retentionFields');\n            \n            if (enableRetention) {\n                retentionFields.style.display = 'block';\n            } else {\n                retentionFields.style.display = 'none';\n            }\n        }\n\n        function createTopic() {\n            var form = document.getElementById('createTopicForm');\n            var formData = new FormData(form);\n            \n            if (!form.checkValidity()) {\n                form.classList.add('was-validated');\n                return;\n            }\n            \n            var namespace = formData.get('namespace');\n            var name = formData.get('name');\n            var partitionCount = formData.get('partitionCount');\n            var enableRetention = formData.get('enableRetention');\n            var retentionValue = enableRetention === 'on' ? parseInt(formData.get('retentionValue')) : 0;\n            var retentionUnit = enableRetention === 'on' ? formData.get('retentionUnit') : 'hours';\n            \n            // Convert retention to seconds\n            var retentionSeconds = 0;\n            if (enableRetention === 'on' && retentionValue > 0) {\n                if (retentionUnit === 'hours') {\n                    retentionSeconds = retentionValue * 3600;\n                } else if (retentionUnit === 'days') {\n                    retentionSeconds = retentionValue * 86400;\n                }\n            }\n            \n            var topicData = {\n                namespace: namespace,\n                name: name,\n                partition_count: parseInt(partitionCount),\n                retention: {\n                    enabled: enableRetention === 'on',\n                    retention_seconds: retentionSeconds\n                }\n            };\n            \n            // Create the topic\n            fetch(basePath('/api/mq/topics/create'), {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json'\n                },\n                body: JSON.stringify(topicData)\n            })\n            .then(response => {\n                if (response.ok) {\n                    return response.json();\n                }\n                throw new Error('Failed to create topic');\n            })\n            .then(data => {\n                // Hide modal and refresh page\n                var modal = bootstrap.Modal.getInstance(document.getElementById('createTopicModal'));\n                modal.hide();\n                location.reload();\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                alert('Error creating topic: ' + error.message);\n            });\n        }\n\n        function exportTopicsCSV() {\n            var csvContent = 'Namespace,Topic Name,Partitions,Retention Enabled,Retention Value,Retention Unit\\n';\n            \n            var rows = document.querySelectorAll('#topicsTable tbody tr.topic-row');\n            rows.forEach(function(row) {\n                var cells = row.querySelectorAll('td');\n                var namespace = cells[0].textContent.trim();\n                var topicName = cells[1].textContent.trim();\n                var partitions = cells[2].textContent.trim();\n                var retention = cells[3].textContent.trim();\n                \n                var retentionEnabled = retention !== 'Disabled';\n                var retentionValue = retentionEnabled ? retention.split(' ')[0] : '';\n                var retentionUnit = retentionEnabled ? retention.split(' ')[1] : '';\n                \n                csvContent += namespace + ',' + topicName + ',' + partitions + ',' + retentionEnabled + ',' + retentionValue + ',' + retentionUnit + '\\n';\n            });\n            \n            var blob = new Blob([csvContent], { type: 'text/csv;charset=utf-8;' });\n            var link = document.createElement('a');\n            var url = URL.createObjectURL(blob);\n            link.setAttribute('href', url);\n            link.setAttribute('download', 'topics_export.csv');\n            link.style.visibility = 'hidden';\n            document.body.appendChild(link);\n            link.click();\n            document.body.removeChild(link);\n        }\n\n        // Topic details functionality\n        document.addEventListener('DOMContentLoaded', function() {\n            // Handle view topic details buttons\n            document.querySelectorAll('[data-action=\"view-topic-details\"]').forEach(function(button) {\n                button.addEventListener('click', function(e) {\n                    e.stopPropagation();\n                    var topicName = this.getAttribute('data-topic-name');\n                    var detailsRow = document.getElementById('details-' + topicName.replace(/\\./g, '_'));\n                    \n                    if (detailsRow.style.display === 'none') {\n                        detailsRow.style.display = 'table-row';\n                        this.innerHTML = '<i class=\"bi bi-eye-slash\"></i>';\n                        \n                        // Load topic details\n                        loadTopicDetails(topicName);\n                    } else {\n                        detailsRow.style.display = 'none';\n                        this.innerHTML = '<i class=\"bi bi-eye\"></i>';\n                    }\n                });\n            });\n        });\n\n        function loadTopicDetails(topicName) {\n            var detailsRow = document.getElementById('details-' + topicName.replace(/\\./g, '_'));\n            var contentDiv = detailsRow.querySelector('.topic-details-content');\n            \n            fetch(basePath('/admin/topics/' + encodeURIComponent(topicName) + '/details'))\n                .then(response => response.json())\n                .then(data => {\n                    var html = '<div class=\"row\">';\n                    html += '<div class=\"col-md-6\">';\n                    html += '<h6>Topic Configuration</h6>';\n                    html += '<ul class=\"list-unstyled\">';\n                    html += '<li><strong>Full Name:</strong> ' + data.name + '</li>';\n                    html += '<li><strong>Partitions:</strong> ' + data.partitions + '</li>';\n                    html += '<li><strong>Created:</strong> ' + (data.created || 'N/A') + '</li>';\n                    html += '</ul>';\n                    html += '</div>';\n                    html += '<div class=\"col-md-6\">';\n                    html += '<h6>Retention Policy</h6>';\n                    if (data.retention && data.retention.enabled) {\n                        html += '<p><i class=\"bi bi-check-circle text-success\"></i> Enabled</p>';\n                        html += '<p><strong>Duration:</strong> ' + data.retention.value + ' ' + data.retention.unit + '</p>';\n                    } else {\n                        html += '<p><i class=\"bi bi-x-circle text-danger\"></i> Disabled</p>';\n                    }\n                    html += '</div>';\n                    html += '</div>';\n                    \n                    contentDiv.innerHTML = html;\n                })\n                .catch(error => {\n                    console.error('Error loading topic details:', error);\n                    contentDiv.innerHTML = '<div class=\"alert alert-danger\">Failed to load topic details</div>';\n                });\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/volume_details.templ b/weed/admin/view/app/volume_details.templ
index b4ae7c7bed..097928bdc7 100644
--- a/weed/admin/view/app/volume_details.templ
+++ b/weed/admin/view/app/volume_details.templ
@@ -11,7 +11,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
     <div class="d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom">
         <div>
             <h1 class="h2">
-                <i class="fas fa-database me-2"></i>Volume Details
+                <i class="bi bi-database me-2"></i>Volume Details
             </h1>
             <nav aria-label="breadcrumb">
                 <ol class="breadcrumb">
@@ -24,10 +24,10 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
         <div class="btn-toolbar mb-2 mb-md-0">
             <div class="btn-group me-2">
                 <button type="button" class="btn btn-sm btn-outline-secondary" onclick="history.back()">
-                    <i class="fas fa-arrow-left me-1"></i>Back
+                    <i class="bi bi-arrow-left me-1"></i>Back
                 </button>
                 <button type="button" class="btn btn-sm btn-outline-primary" onclick="window.location.reload()">
-                    <i class="fas fa-refresh me-1"></i>Refresh
+                    <i class="bi bi-arrow-clockwise me-1"></i>Refresh
                 </button>
             </div>
         </div>
@@ -39,7 +39,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
             <div class="card shadow mb-4">
                 <div class="card-header py-3">
                     <h6 class="m-0 font-weight-bold text-primary">
-                        <i class="fas fa-info-circle me-2"></i>Volume Information
+                        <i class="bi bi-info-circle me-2"></i>Volume Information
                     </h6>
                 </div>
                 <div class="card-body">
@@ -54,7 +54,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                                 <div>
                                     <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", data.Volume.Server))} target="_blank" class="text-decoration-none">
                                         {data.Volume.Server}
-                                        <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                        <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                     </a>
                                 </div>
                             </div>
@@ -114,7 +114,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
             <div class="card shadow mb-4">
                 <div class="card-header py-3">
                     <h6 class="m-0 font-weight-bold text-primary">
-                        <i class="fas fa-chart-pie me-2"></i>Volume Statistics & Health
+                        <i class="bi bi-pie-chart me-2"></i>Volume Statistics & Health
                     </h6>
                 </div>
                 <div class="card-body">
@@ -189,7 +189,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                             <div class="text-center mb-2">
                                 if data.Volume.ReadOnly {
                                     <span class="badge bg-warning fs-6 px-3 py-2">
-                                        <i class="fas fa-lock me-1"></i>Read Only
+                                        <i class="bi bi-lock me-1"></i>Read Only
                                     </span>
                                     if data.Volume.Size >= data.VolumeSizeLimit {
                                         <div class="mt-1">
@@ -198,11 +198,11 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                                     }
                                 } else if data.VolumeSizeLimit > data.Volume.Size {
                                     <span class="badge bg-success fs-6 px-3 py-2">
-                                        <i class="fas fa-edit me-1"></i>Read/Write
+                                        <i class="bi bi-pencil-square me-1"></i>Read/Write
                                     </span>
                                 } else {
                                     <span class="badge bg-warning fs-6 px-3 py-2">
-                                        <i class="fas fa-exclamation-triangle me-1"></i>Size Limit Reached
+                                        <i class="bi bi-exclamation-triangle me-1"></i>Size Limit Reached
                                     </span>
                                 }
                             </div>
@@ -237,7 +237,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                     if data.Volume.Ttl > 0 {
                         <div class="mb-3 text-center">
                             <span class="badge bg-info fs-6 px-3 py-2">
-                                <i class="fas fa-clock me-1"></i>{formatTTL(data.Volume.Ttl)}
+                                <i class="bi bi-clock me-1"></i>{formatTTL(data.Volume.Ttl)}
                             </span>
                             <div class="mt-1">
                                 <small class="text-muted">Time To Live</small>
@@ -251,7 +251,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                         <div class="mb-2">
                             <div class="text-center">
                                 <div class="h6 mb-1 font-weight-bold text-info">
-                                    <i class="fas fa-cloud me-1"></i>{data.Volume.RemoteStorageName}
+                                    <i class="bi bi-cloud me-1"></i>{data.Volume.RemoteStorageName}
                                 </div>
                                 <small class="text-muted">Remote Storage</small>
                             </div>
@@ -277,7 +277,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                 <div class="card shadow mb-4">
                     <div class="card-header py-3">
                         <h6 class="m-0 font-weight-bold text-primary">
-                            <i class="fas fa-copy me-2"></i>Replicas ({fmt.Sprintf("%d", data.ReplicationCount)})
+                            <i class="bi bi-copy me-2"></i>Replicas ({fmt.Sprintf("%d", data.ReplicationCount)})
                         </h6>
                     </div>
                     <div class="card-body">
@@ -301,7 +301,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                                             <strong>
                                                 <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", data.Volume.Server))} target="_blank" class="text-decoration-none">
                                                     {data.Volume.Server}
-                                                    <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                    <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                                 </a>
                                             </strong>
                                             <span class="badge bg-success ms-2">Primary</span>
@@ -321,7 +321,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                                             <td>
                                                 <a href={templ.SafeURL(fmt.Sprintf("//%s/ui/index.html", replica.Server))} target="_blank" class="text-decoration-none">
                                                     {replica.Server}
-                                                    <i class="fas fa-external-link-alt ms-1 text-muted"></i>
+                                                    <i class="bi bi-box-arrow-up-right ms-1 text-muted"></i>
                                                 </a>
                                             </td>
                                             <td><span class="badge bg-light text-dark">{replica.DataCenter}</span></td>
@@ -331,7 +331,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                                             <td><span class="badge bg-info">Replica</span></td>
                                             <td>
                                                 <a href={ dash.PUrl(ctx, fmt.Sprintf("/storage/volumes/%d/%s", replica.Id, replica.Server)) } class="btn btn-sm btn-outline-primary">
-                                                    <i class="fas fa-eye me-1"></i>View
+                                                    <i class="bi bi-eye me-1"></i>View
                                                 </a>
                                             </td>
                                         </tr>
@@ -351,21 +351,36 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
             <div class="card shadow mb-4">
                 <div class="card-header py-3">
                     <h6 class="m-0 font-weight-bold text-primary">
-                        <i class="fas fa-tools me-2"></i>Actions
+                        <i class="bi bi-tools me-2"></i>Actions
                     </h6>
                 </div>
                 <div class="card-body">
-                    <div class="btn-group" role="group">
+                    <div class="d-flex flex-wrap gap-2">
                         <button type="button" class="btn btn-outline-danger vacuum-btn" 
                                 title="Vacuum Volume" 
                                 data-volume-id={fmt.Sprintf("%d", data.Volume.Id)} 
                                 data-server={data.Volume.Server}>
-                            <i class="fas fa-compress-alt me-1"></i>Vacuum
+                            <i class="bi bi-arrows-angle-contract me-1"></i>Vacuum
                         </button>
+                        if !dash.IsReadOnlyRole(dash.RoleFromContext(ctx)) {
+                            <button type="button" class="btn btn-outline-warning volume-access-btn"
+                                    data-volume-id={fmt.Sprintf("%d", data.Volume.Id)}
+                                    data-server={data.Volume.Server} data-read-only="true">
+                                <i class="bi bi-lock me-1"></i>Set Read-Only
+                            </button>
+                            <button type="button" class="btn btn-outline-success volume-access-btn"
+                                    data-volume-id={fmt.Sprintf("%d", data.Volume.Id)}
+                                    data-server={data.Volume.Server} data-read-only="false">
+                                <i class="bi bi-unlock me-1"></i>Set Read/Write
+                            </button>
+                        }
                     </div>
+                    if !dash.IsReadOnlyRole(dash.RoleFromContext(ctx)) {
+                        <div class="mt-3"><small class="text-muted">Access mode changes apply only to this replica and persist across restarts. Volume size and disk limits still apply.</small></div>
+                    }
                     <div class="mt-3">
                         <small class="text-muted">
-                            <i class="fas fa-info-circle me-1"></i>
+                            <i class="bi bi-info-circle me-1"></i>
                             Use these actions to perform maintenance operations on the volume.
                         </small>
                     </div>
@@ -378,7 +393,7 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
     <div class="row">
         <div class="col-12">
             <small class="text-muted">
-                <i class="fas fa-clock me-1"></i>
+                <i class="bi bi-clock me-1"></i>
                 Last updated: {data.LastUpdated.Format("2006-01-02 15:04:05")}
             </small>
         </div>
@@ -396,13 +411,43 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
                     performVacuum(volumeId, server, this);
                 });
             }
+            document.querySelectorAll('.volume-access-btn').forEach(button => {
+                button.addEventListener('click', function() {
+                    setVolumeReadOnly(this.dataset.volumeId, this.dataset.server, this.dataset.readOnly === 'true');
+                });
+            });
         });
 
+        async function setVolumeReadOnly(volumeId, server, readOnly) {
+            const mode = readOnly ? 'read-only' : 'read/write';
+            if (!confirm(`Set volume ${volumeId} on ${server} to ${mode}? This applies only to this replica.`)) {
+                return;
+            }
+            const buttons = document.querySelectorAll('.volume-access-btn');
+            buttons.forEach(button => { button.disabled = true; });
+            try {
+                const response = await fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/read-only`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ read_only: readOnly })
+                });
+                const data = await response.json();
+                if (!response.ok || data.error) {
+                    throw new Error(data.error || 'Failed to change volume access mode');
+                }
+                showMessage(data.message, 'success');
+                setTimeout(() => window.location.reload(), 1000);
+            } catch (error) {
+                showMessage(error.message, 'error');
+                buttons.forEach(button => { button.disabled = false; });
+            }
+        }
+
         function performVacuum(volumeId, server, button) {
             // Disable button and show loading state
             const originalText = button.innerHTML;
             button.disabled = true;
-            button.innerHTML = '<i class="fas fa-spinner fa-spin me-1"></i>Vacuuming...';
+            button.innerHTML = '<i class="bi bi-arrow-repeat icon-spin me-1"></i>Vacuuming...';
 
             // Send vacuum request
             fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/vacuum`, {
@@ -443,10 +488,13 @@ templ VolumeDetails(data dash.VolumeDetailsData) {
             toast.style.zIndex = '9999';
             toast.style.minWidth = '300px';
             
-            toast.innerHTML = `
-                ${message}
-                <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
-            `;
+            toast.textContent = message;
+            const closeButton = document.createElement('button');
+            closeButton.type = 'button';
+            closeButton.className = 'btn-close';
+            closeButton.setAttribute('data-bs-dismiss', 'alert');
+            closeButton.setAttribute('aria-label', 'Close');
+            toast.appendChild(closeButton);
             
             document.body.appendChild(toast);
             
diff --git a/weed/admin/view/app/volume_details_templ.go b/weed/admin/view/app/volume_details_templ.go
index 676cf77ebe..d0a922a41d 100644
--- a/weed/admin/view/app/volume_details_templ.go
+++ b/weed/admin/view/app/volume_details_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package app
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -36,7 +36,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 			templ_7745c5c3_Var1 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"fas fa-database me-2\"></i>Volume Details</h1><nav aria-label=\"breadcrumb\"><ol class=\"breadcrumb\"><li class=\"breadcrumb-item\"><a href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<div class=\"d-flex justify-content-between flex-wrap flex-md-nowrap align-items-center pt-3 pb-2 mb-3 border-bottom\"><div><h1 class=\"h2\"><i class=\"bi bi-database me-2\"></i>Volume Details</h1><nav aria-label=\"breadcrumb\"><ol class=\"breadcrumb\"><li class=\"breadcrumb-item\"><a href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -75,7 +75,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</li></ol></nav></div><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"history.back()\"><i class=\"fas fa-arrow-left me-1\"></i>Back</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"fas fa-refresh me-1\"></i>Refresh</button></div></div></div><div class=\"row\"><!-- Volume Information Card --><div class=\"col-lg-8\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-info-circle me-2\"></i>Volume Information</h6></div><div class=\"card-body\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label class=\"form-label\"><strong>Volume ID:</strong></label><div><code class=\"fs-5\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "</li></ol></nav></div><div class=\"btn-toolbar mb-2 mb-md-0\"><div class=\"btn-group me-2\"><button type=\"button\" class=\"btn btn-sm btn-outline-secondary\" onclick=\"history.back()\"><i class=\"bi bi-arrow-left me-1\"></i>Back</button> <button type=\"button\" class=\"btn btn-sm btn-outline-primary\" onclick=\"window.location.reload()\"><i class=\"bi bi-arrow-clockwise me-1\"></i>Refresh</button></div></div></div><div class=\"row\"><!-- Volume Information Card --><div class=\"col-lg-8\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-info-circle me-2\"></i>Volume Information</h6></div><div class=\"card-body\"><div class=\"row\"><div class=\"col-md-6\"><div class=\"mb-3\"><label class=\"form-label\"><strong>Volume ID:</strong></label><div><code class=\"fs-5\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -114,7 +114,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></div></div><div class=\"mb-3\"><label class=\"form-label\"><strong>Data Center:</strong></label><div><span class=\"badge bg-light text-dark\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></div></div><div class=\"mb-3\"><label class=\"form-label\"><strong>Data Center:</strong></label><div><span class=\"badge bg-light text-dark\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -240,7 +240,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</span></div></div></div></div></div></div></div><!-- Statistics Card --><div class=\"col-lg-4\"><!-- Volume Statistics & Health Card --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-chart-pie me-2\"></i>Volume Statistics & Health</h6></div><div class=\"card-body\"><!-- Storage Metrics --><div class=\"row mb-3\"><div class=\"col-6\"><div class=\"text-center\"><div class=\"h4 mb-0 font-weight-bold text-success\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "</span></div></div></div></div></div></div></div><!-- Statistics Card --><div class=\"col-lg-4\"><!-- Volume Statistics & Health Card --><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-pie-chart me-2\"></i>Volume Statistics & Health</h6></div><div class=\"card-body\"><!-- Storage Metrics --><div class=\"row mb-3\"><div class=\"col-6\"><div class=\"text-center\"><div class=\"h4 mb-0 font-weight-bold text-success\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -328,11 +328,11 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var22 string
-			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.1f", float64(data.Volume.Size-data.Volume.DeletedByteCount)/float64(data.Volume.Size)*100))
+			templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%.1f", float64(data.Volume.Size-data.Volume.DeletedByteCount)/float64(data.Volume.Size)*100))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 177, Col: 157}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -346,7 +346,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if data.Volume.ReadOnly {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<span class=\"badge bg-warning fs-6 px-3 py-2\"><i class=\"fas fa-lock me-1\"></i>Read Only</span> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<span class=\"badge bg-warning fs-6 px-3 py-2\"><i class=\"bi bi-lock me-1\"></i>Read Only</span> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -357,12 +357,12 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 				}
 			}
 		} else if data.VolumeSizeLimit > data.Volume.Size {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<span class=\"badge bg-success fs-6 px-3 py-2\"><i class=\"fas fa-edit me-1\"></i>Read/Write</span>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "<span class=\"badge bg-success fs-6 px-3 py-2\"><i class=\"bi bi-pencil-square me-1\"></i>Read/Write</span>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<span class=\"badge bg-warning fs-6 px-3 py-2\"><i class=\"fas fa-exclamation-triangle me-1\"></i>Size Limit Reached</span>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "<span class=\"badge bg-warning fs-6 px-3 py-2\"><i class=\"bi bi-exclamation-triangle me-1\"></i>Size Limit Reached</span>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -405,14 +405,14 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if data.Volume.Ttl > 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<div class=\"mb-3 text-center\"><span class=\"badge bg-info fs-6 px-3 py-2\"><i class=\"fas fa-clock me-1\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<div class=\"mb-3 text-center\"><span class=\"badge bg-info fs-6 px-3 py-2\"><i class=\"bi bi-clock me-1\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var25 string
 			templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(formatTTL(data.Volume.Ttl))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 240, Col: 92}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 240, Col: 91}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
 			if templ_7745c5c3_Err != nil {
@@ -428,14 +428,14 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if data.Volume.RemoteStorageName != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<hr class=\"my-3\"><div class=\"mb-2\"><div class=\"text-center\"><div class=\"h6 mb-1 font-weight-bold text-info\"><i class=\"fas fa-cloud me-1\"></i>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "<hr class=\"my-3\"><div class=\"mb-2\"><div class=\"text-center\"><div class=\"h6 mb-1 font-weight-bold text-info\"><i class=\"bi bi-cloud me-1\"></i>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var26 string
 			templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(data.Volume.RemoteStorageName)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 254, Col: 99}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 254, Col: 98}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
 			if templ_7745c5c3_Err != nil {
@@ -451,11 +451,11 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 					return templ_7745c5c3_Err
 				}
 				var templ_7745c5c3_Var27 string
-				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinStringErrs(data.Volume.RemoteStorageKey)
+				templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Volume.RemoteStorageKey)
 				if templ_7745c5c3_Err != nil {
 					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 261, Col: 138}
 				}
-				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var27)
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -483,14 +483,14 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		if len(data.Replicas) > 0 {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-copy me-2\"></i>Replicas (")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 46, "<div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-copy me-2\"></i>Replicas (")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var29 string
 			templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.ReplicationCount))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 280, Col: 111}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 280, Col: 110}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 			if templ_7745c5c3_Err != nil {
@@ -522,7 +522,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></strong> <span class=\"badge bg-success ms-2\">Primary</span></td><td><span class=\"badge bg-light text-dark\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></strong> <span class=\"badge bg-success ms-2\">Primary</span></td><td><span class=\"badge bg-light text-dark\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -605,7 +605,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, " <i class=\"fas fa-external-link-alt ms-1 text-muted\"></i></a></td><td><span class=\"badge bg-light text-dark\">")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, " <i class=\"bi bi-box-arrow-up-right ms-1 text-muted\"></i></a></td><td><span class=\"badge bg-light text-dark\">")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -670,7 +670,7 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "\" class=\"btn btn-sm btn-outline-primary\"><i class=\"fas fa-eye me-1\"></i>View</a></td></tr>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "\" class=\"btn btn-sm btn-outline-primary\"><i class=\"bi bi-eye me-1\"></i>View</a></td></tr>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -680,16 +680,16 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "<!-- Actions Card --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"fas fa-tools me-2\"></i>Actions</h6></div><div class=\"card-body\"><div class=\"btn-group\" role=\"group\"><button type=\"button\" class=\"btn btn-outline-danger vacuum-btn\" title=\"Vacuum Volume\" data-volume-id=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "<!-- Actions Card --><div class=\"row\"><div class=\"col-12\"><div class=\"card shadow mb-4\"><div class=\"card-header py-3\"><h6 class=\"m-0 font-weight-bold text-primary\"><i class=\"bi bi-tools me-2\"></i>Actions</h6></div><div class=\"card-body\"><div class=\"d-flex flex-wrap gap-2\"><button type=\"button\" class=\"btn btn-outline-danger vacuum-btn\" title=\"Vacuum Volume\" data-volume-id=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var43 string
-		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", data.Volume.Id))
+		templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.Volume.Id))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 361, Col: 81}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var43)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -698,28 +698,100 @@ func VolumeDetails(data dash.VolumeDetailsData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var44 string
-		templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(data.Volume.Server)
+		templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Volume.Server)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 362, Col: 63}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var44)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "\"><i class=\"fas fa-compress-alt me-1\"></i>Vacuum</button></div><div class=\"mt-3\"><small class=\"text-muted\"><i class=\"fas fa-info-circle me-1\"></i> Use these actions to perform maintenance operations on the volume.</small></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"fas fa-clock me-1\"></i> Last updated: ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "\"><i class=\"bi bi-arrows-angle-contract me-1\"></i>Vacuum</button> ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var45 string
-		templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 382, Col: 77}
+		if !dash.IsReadOnlyRole(dash.RoleFromContext(ctx)) {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "<button type=\"button\" class=\"btn btn-outline-warning volume-access-btn\" data-volume-id=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var45 string
+			templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.Volume.Id))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 367, Col: 85}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var45)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 67, "\" data-server=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var46 string
+			templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Volume.Server)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 368, Col: 67}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var46)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\" data-read-only=\"true\"><i class=\"bi bi-lock me-1\"></i>Set Read-Only</button> <button type=\"button\" class=\"btn btn-outline-success volume-access-btn\" data-volume-id=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var47 string
+			templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%d", data.Volume.Id))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 372, Col: 85}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var47)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "\" data-server=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var48 string
+			templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Volume.Server)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 373, Col: 67}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var48)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "\" data-read-only=\"false\"><i class=\"bi bi-unlock me-1\"></i>Set Read/Write</button>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var45))
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "</div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "</small></div></div><!-- JavaScript for volume actions --><script>\n        document.addEventListener('DOMContentLoaded', function() {\n            // Add click handler for vacuum button\n            const vacuumBtn = document.querySelector('.vacuum-btn');\n            if (vacuumBtn) {\n                vacuumBtn.addEventListener('click', function() {\n                    const volumeId = this.getAttribute('data-volume-id');\n                    const server = this.getAttribute('data-server');\n                    performVacuum(volumeId, server, this);\n                });\n            }\n        });\n\n        function performVacuum(volumeId, server, button) {\n            // Disable button and show loading state\n            const originalText = button.innerHTML;\n            button.disabled = true;\n            button.innerHTML = '<i class=\"fas fa-spinner fa-spin me-1\"></i>Vacuuming...';\n\n            // Send vacuum request\n            fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/vacuum`, {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                }\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    showMessage(data.error, 'error');\n                } else {\n                    showMessage(data.message || 'Volume vacuum started successfully', 'success');\n                    // Optionally refresh the page after a delay\n                    setTimeout(() => {\n                        window.location.reload();\n                    }, 2000);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showMessage('Failed to start vacuum operation', 'error');\n            })\n            .finally(() => {\n                // Re-enable button\n                button.disabled = false;\n                button.innerHTML = originalText;\n            });\n        }\n\n        function showMessage(message, type) {\n            // Create toast notification\n            const toast = document.createElement('div');\n            toast.className = `alert alert-${type === 'error' ? 'danger' : 'success'} alert-dismissible fade show position-fixed`;\n            toast.style.top = '20px';\n            toast.style.right = '20px';\n            toast.style.zIndex = '9999';\n            toast.style.minWidth = '300px';\n            \n            toast.innerHTML = `\n                ${message}\n                <button type=\"button\" class=\"btn-close\" data-bs-dismiss=\"alert\"></button>\n            `;\n            \n            document.body.appendChild(toast);\n            \n            // Auto-remove after 5 seconds\n            setTimeout(() => {\n                if (toast.parentNode) {\n                    toast.parentNode.removeChild(toast);\n                }\n            }, 5000);\n        }\n    </script>")
+		if !dash.IsReadOnlyRole(dash.RoleFromContext(ctx)) {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "<div class=\"mt-3\"><small class=\"text-muted\">Access mode changes apply only to this replica and persist across restarts. Volume size and disk limits still apply.</small></div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "<div class=\"mt-3\"><small class=\"text-muted\"><i class=\"bi bi-info-circle me-1\"></i> Use these actions to perform maintenance operations on the volume.</small></div></div></div></div></div><!-- Last Updated --><div class=\"row\"><div class=\"col-12\"><small class=\"text-muted\"><i class=\"bi bi-clock me-1\"></i> Last updated: ")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var49 string
+		templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinStringErrs(data.LastUpdated.Format("2006-01-02 15:04:05"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/app/volume_details.templ`, Line: 397, Col: 77}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var49))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "</small></div></div><!-- JavaScript for volume actions --><script>\n        document.addEventListener('DOMContentLoaded', function() {\n            // Add click handler for vacuum button\n            const vacuumBtn = document.querySelector('.vacuum-btn');\n            if (vacuumBtn) {\n                vacuumBtn.addEventListener('click', function() {\n                    const volumeId = this.getAttribute('data-volume-id');\n                    const server = this.getAttribute('data-server');\n                    performVacuum(volumeId, server, this);\n                });\n            }\n            document.querySelectorAll('.volume-access-btn').forEach(button => {\n                button.addEventListener('click', function() {\n                    setVolumeReadOnly(this.dataset.volumeId, this.dataset.server, this.dataset.readOnly === 'true');\n                });\n            });\n        });\n\n        async function setVolumeReadOnly(volumeId, server, readOnly) {\n            const mode = readOnly ? 'read-only' : 'read/write';\n            if (!confirm(`Set volume ${volumeId} on ${server} to ${mode}? This applies only to this replica.`)) {\n                return;\n            }\n            const buttons = document.querySelectorAll('.volume-access-btn');\n            buttons.forEach(button => { button.disabled = true; });\n            try {\n                const response = await fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/read-only`, {\n                    method: 'POST',\n                    headers: { 'Content-Type': 'application/json' },\n                    body: JSON.stringify({ read_only: readOnly })\n                });\n                const data = await response.json();\n                if (!response.ok || data.error) {\n                    throw new Error(data.error || 'Failed to change volume access mode');\n                }\n                showMessage(data.message, 'success');\n                setTimeout(() => window.location.reload(), 1000);\n            } catch (error) {\n                showMessage(error.message, 'error');\n                buttons.forEach(button => { button.disabled = false; });\n            }\n        }\n\n        function performVacuum(volumeId, server, button) {\n            // Disable button and show loading state\n            const originalText = button.innerHTML;\n            button.disabled = true;\n            button.innerHTML = '<i class=\"bi bi-arrow-repeat icon-spin me-1\"></i>Vacuuming...';\n\n            // Send vacuum request\n            fetch((window.__BASE_PATH__ || '') + `/api/volumes/${volumeId}/${encodeURIComponent(server)}/vacuum`, {\n                method: 'POST',\n                headers: {\n                    'Content-Type': 'application/json',\n                }\n            })\n            .then(response => response.json())\n            .then(data => {\n                if (data.error) {\n                    showMessage(data.error, 'error');\n                } else {\n                    showMessage(data.message || 'Volume vacuum started successfully', 'success');\n                    // Optionally refresh the page after a delay\n                    setTimeout(() => {\n                        window.location.reload();\n                    }, 2000);\n                }\n            })\n            .catch(error => {\n                console.error('Error:', error);\n                showMessage('Failed to start vacuum operation', 'error');\n            })\n            .finally(() => {\n                // Re-enable button\n                button.disabled = false;\n                button.innerHTML = originalText;\n            });\n        }\n\n        function showMessage(message, type) {\n            // Create toast notification\n            const toast = document.createElement('div');\n            toast.className = `alert alert-${type === 'error' ? 'danger' : 'success'} alert-dismissible fade show position-fixed`;\n            toast.style.top = '20px';\n            toast.style.right = '20px';\n            toast.style.zIndex = '9999';\n            toast.style.minWidth = '300px';\n            \n            toast.textContent = message;\n            const closeButton = document.createElement('button');\n            closeButton.type = 'button';\n            closeButton.className = 'btn-close';\n            closeButton.setAttribute('data-bs-dismiss', 'alert');\n            closeButton.setAttribute('aria-label', 'Close');\n            toast.appendChild(closeButton);\n            \n            document.body.appendChild(toast);\n            \n            // Auto-remove after 5 seconds\n            setTimeout(() => {\n                if (toast.parentNode) {\n                    toast.parentNode.removeChild(toast);\n                }\n            }, 5000);\n        }\n    </script>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/app/volume_details_test.go b/weed/admin/view/app/volume_details_test.go
new file mode 100644
index 0000000000..141074bf7d
--- /dev/null
+++ b/weed/admin/view/app/volume_details_test.go
@@ -0,0 +1,47 @@
+package app
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/admin/dash"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/net/html"
+)
+
+func TestVolumeDetailsAccessControls(t *testing.T) {
+	for _, role := range []string{"", "admin", dash.RoleReadOnly} {
+		for _, readOnly := range []bool{false, true} {
+			data := dash.VolumeDetailsData{Volume: dash.VolumeWithTopology{
+				VolumeInformationMessage: &master_pb.VolumeInformationMessage{Id: 7, ReadOnly: readOnly},
+				Server:                   "node-a",
+			}}
+			var rendered bytes.Buffer
+			ctx := dash.WithAuthContext(t.Context(), "", role, "")
+			require.NoError(t, VolumeDetails(data).Render(ctx, &rendered))
+			doc, err := html.Parse(&rendered)
+			require.NoError(t, err)
+			var modes []string
+			var walk func(*html.Node)
+			walk = func(node *html.Node) {
+				if node.Type == html.ElementNode && node.Data == "button" {
+					for _, attr := range node.Attr {
+						if attr.Key == "data-read-only" {
+							modes = append(modes, attr.Val)
+						}
+					}
+				}
+				for child := node.FirstChild; child != nil; child = child.NextSibling {
+					walk(child)
+				}
+			}
+			walk(doc)
+			if role == dash.RoleReadOnly {
+				require.Empty(t, modes)
+			} else {
+				require.Equal(t, []string{"true", "false"}, modes, "both modes must be available even when the displayed state is stale")
+			}
+		}
+	}
+}
diff --git a/weed/admin/view/components/config_sections_templ.go b/weed/admin/view/components/config_sections_templ.go
index c161f9797d..db29380c3e 100644
--- a/weed/admin/view/components/config_sections_templ.go
+++ b/weed/admin/view/components/config_sections_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package components
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -61,11 +61,11 @@ func ConfigSection(data ConfigSectionData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var3 string
-			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var2).String())
+			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var2).String())
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/config_sections.templ`, Line: 1, Col: 0}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var3)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -189,11 +189,11 @@ func InfoSection(data InfoSectionData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var8 string
-			templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var7).String())
+			templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var7).String())
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/config_sections.templ`, Line: 1, Col: 0}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var8)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -225,11 +225,11 @@ func InfoSection(data InfoSectionData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var11 string
-		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var10).String())
+		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var10).String())
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/config_sections.templ`, Line: 1, Col: 0}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var11)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/components/form_fields_templ.go b/weed/admin/view/components/form_fields_templ.go
index a23be36111..51d653f9be 100644
--- a/weed/admin/view/components/form_fields_templ.go
+++ b/weed/admin/view/components/form_fields_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package components
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -92,11 +92,11 @@ func TextField(data TextFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var2 string
-		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 63, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -128,11 +128,11 @@ func TextField(data TextFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var4 string
-		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 72, Col: 26}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var4)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -141,11 +141,11 @@ func TextField(data TextFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var5 string
-		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 73, Col: 28}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var5)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -154,11 +154,11 @@ func TextField(data TextFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var6 string
-		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(data.Value)
+		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Value)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 74, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var6)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -172,11 +172,11 @@ func TextField(data TextFieldData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var7 string
-			templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(data.Placeholder)
+			templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Placeholder)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 76, Col: 46}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var7)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -249,11 +249,11 @@ func NumberField(data NumberFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var10 string
-		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 91, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var10)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -285,11 +285,11 @@ func NumberField(data NumberFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var12 string
-		templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 100, Col: 26}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var12)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -298,11 +298,11 @@ func NumberField(data NumberFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var13 string
-		templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 101, Col: 28}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -311,11 +311,11 @@ func NumberField(data NumberFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var14 string
-		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.6g", data.Value))
+		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%.6g", data.Value))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 102, Col: 51}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -329,11 +329,11 @@ func NumberField(data NumberFieldData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var15 string
-			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.JoinStringErrs(data.Step)
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Step)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 104, Col: 32}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var15))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -353,11 +353,11 @@ func NumberField(data NumberFieldData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var16 string
-			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.6g", *data.Min))
+			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%.6g", *data.Min))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 109, Col: 52}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -372,11 +372,11 @@ func NumberField(data NumberFieldData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var17 string
-			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.6g", *data.Max))
+			templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%.6g", *data.Max))
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 112, Col: 52}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var17)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -449,11 +449,11 @@ func CheckboxField(data CheckboxFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var20 string
-		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 131, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var20)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -462,11 +462,11 @@ func CheckboxField(data CheckboxFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var21 string
-		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 132, Col: 32}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var21)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -485,11 +485,11 @@ func CheckboxField(data CheckboxFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var22 string
-		templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 137, Col: 59}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var22)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -564,11 +564,11 @@ func SelectField(data SelectFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var26 string
-		templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 150, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -600,11 +600,11 @@ func SelectField(data SelectFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var28 string
-		templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 158, Col: 26}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var28)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -613,11 +613,11 @@ func SelectField(data SelectFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var29 string
-		templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 159, Col: 28}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var29)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -641,11 +641,11 @@ func SelectField(data SelectFieldData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var30 string
-			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(option.Value)
+			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.ResolveAttributeValue(option.Value)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 166, Col: 40}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var30)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -735,11 +735,11 @@ func DurationField(data DurationFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var34 string
-		templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 184, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var34)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -771,11 +771,11 @@ func DurationField(data DurationFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var36 string
-		templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 193, Col: 26}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var36)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -784,11 +784,11 @@ func DurationField(data DurationFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var37 string
-		templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 194, Col: 28}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var37)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -797,11 +797,11 @@ func DurationField(data DurationFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var38 string
-		templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinStringErrs(data.Value)
+		templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Value)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 195, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var38)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -815,11 +815,11 @@ func DurationField(data DurationFieldData) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var39 string
-			templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinStringErrs(data.Placeholder)
+			templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Placeholder)
 			if templ_7745c5c3_Err != nil {
 				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 197, Col: 46}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var39)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -897,11 +897,11 @@ func DurationInputField(data DurationInputFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var42 string
-		templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 214, Col: 24}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var42)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -933,11 +933,11 @@ func DurationInputField(data DurationInputFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var44 string
-		templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 224, Col: 18}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var44)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -946,11 +946,11 @@ func DurationInputField(data DurationInputFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var45 string
-		templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 225, Col: 20}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var45))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var45)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -959,11 +959,11 @@ func DurationInputField(data DurationInputFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var46 string
-		templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.0f", convertSecondsToValue(data.Seconds, convertSecondsToUnit(data.Seconds))))
+		templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%.0f", convertSecondsToValue(data.Seconds, convertSecondsToUnit(data.Seconds))))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 226, Col: 104}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var46)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -982,11 +982,11 @@ func DurationInputField(data DurationInputFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var47 string
-		templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name + "_unit")
+		templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name + "_unit")
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 235, Col: 28}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var47))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var47)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -995,11 +995,11 @@ func DurationInputField(data DurationInputFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var48 string
-		templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name + "_unit")
+		templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name + "_unit")
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 236, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var48))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var48)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1205,11 +1205,11 @@ func IntervalField(data IntervalFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var51 string
-		templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name)
+		templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name)
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 386, Col: 24}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var51))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var51)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1241,11 +1241,11 @@ func IntervalField(data IntervalFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var53 string
-		templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name + "_value")
+		templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name + "_value")
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 396, Col: 29}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var53))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var53)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1254,11 +1254,11 @@ func IntervalField(data IntervalFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var54 string
-		templ_7745c5c3_Var54, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name + "_value")
+		templ_7745c5c3_Var54, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name + "_value")
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 397, Col: 31}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var54))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var54)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1267,11 +1267,11 @@ func IntervalField(data IntervalFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var55 string
-		templ_7745c5c3_Var55, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%.0f", convertSecondsToValue(data.Seconds, convertSecondsToUnit(data.Seconds))))
+		templ_7745c5c3_Var55, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%.0f", convertSecondsToValue(data.Seconds, convertSecondsToUnit(data.Seconds))))
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 398, Col: 104}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var55))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var55)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1290,11 +1290,11 @@ func IntervalField(data IntervalFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var56 string
-		templ_7745c5c3_Var56, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name + "_unit")
+		templ_7745c5c3_Var56, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name + "_unit")
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 407, Col: 28}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var56))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var56)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -1303,11 +1303,11 @@ func IntervalField(data IntervalFieldData) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var57 string
-		templ_7745c5c3_Var57, templ_7745c5c3_Err = templ.JoinStringErrs(data.Name + "_unit")
+		templ_7745c5c3_Var57, templ_7745c5c3_Err = templ.ResolveAttributeValue(data.Name + "_unit")
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/components/form_fields.templ`, Line: 408, Col: 30}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var57))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var57)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/admin/view/layout/layout.templ b/weed/admin/view/layout/layout.templ
index 829e73485b..26f228ba4e 100644
--- a/weed/admin/view/layout/layout.templ
+++ b/weed/admin/view/layout/layout.templ
@@ -44,6 +44,7 @@ templ Layout(view ViewContext, content templ.Component) {
     strings.HasPrefix(currentPath, "/plugin/lanes/default/")
   isIcebergWorkerPage := currentPath == "/plugin/lanes/iceberg" || strings.HasPrefix(currentPath, "/plugin/lanes/iceberg/")
   isLifecycleWorkerPage := currentPath == "/plugin/lanes/lifecycle" || strings.HasPrefix(currentPath, "/plugin/lanes/lifecycle/")
+  isLanceWorkerPage := currentPath == "/plugin/lanes/lance" || strings.HasPrefix(currentPath, "/plugin/lanes/lance/")
 }}
 <!DOCTYPE html>
 <html lang="en">
@@ -56,8 +57,8 @@ templ Layout(view ViewContext, content templ.Component) {
 
     <!-- Bootstrap CSS -->
     <link href={ string(view.P("/static/css/bootstrap.min.css")) } rel="stylesheet">
-    <!-- Font Awesome CSS -->
-    <link href={ string(view.P("/static/css/fontawesome.min.css")) } rel="stylesheet">
+    <!-- Bootstrap Icons CSS -->
+    <link href={ string(view.P("/static/css/bootstrap-icons.min.css")) } rel="stylesheet">
     <!-- HTMX -->
     <script src={ string(view.P("/static/js/htmx.min.js")) }></script>
     <!-- Custom CSS -->
@@ -71,7 +72,7 @@ templ Layout(view ViewContext, content templ.Component) {
         <header class="navbar navbar-expand-lg navbar-dark bg-primary sticky-top">
             <div class="container-fluid">
                 <a class="navbar-brand fw-bold" href={ view.P("/admin") }>
-                    <i class="fas fa-server me-2"></i>
+                    <i class="bi bi-server me-2"></i>
                     SeaweedFS Admin
                 </a>
 
@@ -79,18 +80,18 @@ templ Layout(view ViewContext, content templ.Component) {
                     <span class="navbar-toggler-icon"></span>
                 </button>
                 <button class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target="#navbarNav" aria-controls="navbarNav" aria-expanded="false" aria-label="User menu">
-                    <i class="fas fa-user"></i>
+                    <i class="bi bi-person"></i>
                 </button>
 
                 <div class="collapse navbar-collapse" id="navbarNav">
                     <ul class="navbar-nav ms-auto">
                         <li class="nav-item dropdown">
                             <a class="nav-link dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown">
-                                <i class="fas fa-user me-1"></i>{username}
+                                <i class="bi bi-person me-1"></i>{username}
                             </a>
                             <ul class="dropdown-menu">
                                 <li><a class="dropdown-item" href={ view.P("/logout") }>
-                                    <i class="fas fa-sign-out-alt me-2"></i>Logout
+                                    <i class="bi bi-box-arrow-right me-2"></i>Logout
                                 </a></li>
                             </ul>
                         </li>
@@ -109,39 +110,39 @@ templ Layout(view ViewContext, content templ.Component) {
                     <ul class="nav flex-column">
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/admin") }>
-                                <i class="fas fa-tachometer-alt me-2"></i>Dashboard
+                                <i class="bi bi-speedometer2 me-2"></i>Dashboard
                             </a>
                         </li>
                         <li class="nav-item">
                             <a class={ "nav-link", templ.KV("collapsed", !isClusterPage) } href="#" data-bs-toggle="collapse" data-bs-target="#clusterSubmenu" aria-expanded={ fmt.Sprintf("%t", isClusterPage) } aria-controls="clusterSubmenu">
-                                <i class="fas fa-sitemap me-2"></i>Cluster
-                                <i class="fas fa-chevron-down ms-auto"></i>
+                                <i class="bi bi-diagram-3 me-2"></i>Cluster
+                                <i class="bi bi-chevron-down ms-auto"></i>
                             </a>
                             <div class={ "collapse", templ.KV("show", isClusterPage) } id="clusterSubmenu">
                                 <ul class="nav flex-column ms-3">
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/cluster/masters") }>
-                                            <i class="fas fa-crown me-2"></i>Masters
+                                            <i class="bi bi-award me-2"></i>Masters
                                         </a>
                                     </li>
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/cluster/volume-servers") }>
-                                            <i class="fas fa-server me-2"></i>Volume Servers
+                                            <i class="bi bi-server me-2"></i>Volume Servers
                                         </a>
                                     </li>
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/cluster/filers") }>
-                                            <i class="fas fa-folder-open me-2"></i>Filers
+                                            <i class="bi bi-folder2-open me-2"></i>Filers
                                         </a>
                                     </li>
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/cluster/s3") }>
-                                            <i class="fas fa-cloud me-2"></i>S3 Servers
+                                            <i class="bi bi-cloud me-2"></i>S3 Servers
                                         </a>
                                     </li>
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/cluster/mount-clients") }>
-                                            <i class="fas fa-plug me-2"></i>Mount Clients
+                                            <i class="bi bi-plug me-2"></i>Mount Clients
                                         </a>
                                     </li>
                                 </ul>
@@ -149,24 +150,24 @@ templ Layout(view ViewContext, content templ.Component) {
                         </li>
                         <li class="nav-item">
                             <a class={ "nav-link", templ.KV("collapsed", !isStoragePage) } href="#" data-bs-toggle="collapse" data-bs-target="#storageSubmenu" aria-expanded={ fmt.Sprintf("%t", isStoragePage) } aria-controls="storageSubmenu">
-                                <i class="fas fa-hdd me-2"></i>Storage
-                                <i class="fas fa-chevron-down ms-auto"></i>
+                                <i class="bi bi-device-hdd me-2"></i>Storage
+                                <i class="bi bi-chevron-down ms-auto"></i>
                             </a>
                             <div class={ "collapse", templ.KV("show", isStoragePage) } id="storageSubmenu">
                                 <ul class="nav flex-column ms-3">
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/storage/volumes") }>
-                                            <i class="fas fa-database me-2"></i>Volumes
+                                            <i class="bi bi-database me-2"></i>Volumes
                                         </a>
                                     </li>
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/storage/ec-shards") }>
-                                            <i class="fas fa-th-large me-2"></i>EC Volumes
+                                            <i class="bi bi-grid me-2"></i>EC Volumes
                                         </a>
                                     </li>
                                     <li class="nav-item">
                                         <a class="nav-link py-2" href={ view.P("/storage/collections") }>
-                                            <i class="fas fa-layer-group me-2"></i>Collections
+                                            <i class="bi bi-layers me-2"></i>Collections
                                         </a>
                                     </li>
                                 </ul>
@@ -180,32 +181,32 @@ templ Layout(view ViewContext, content templ.Component) {
                     <ul class="nav flex-column">
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/object-store/buckets") }>
-                                <i class="fas fa-cube me-2"></i>Buckets
+                                <i class="bi bi-box me-2"></i>Buckets
                             </a>
                         </li>
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/object-store/s3tables/buckets") }>
-                                <i class="fas fa-table me-2"></i>Table Buckets
+                                <i class="bi bi-table me-2"></i>Table Buckets
                             </a>
                         </li>
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/object-store/users") }>
-                                <i class="fas fa-users me-2"></i>Users
+                                <i class="bi bi-people me-2"></i>Users
                             </a>
                         </li>
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/object-store/groups") }>
-                                <i class="fas fa-users-cog me-2"></i>Groups
+                                <i class="bi bi-people-fill me-2"></i>Groups
                             </a>
                         </li>
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/object-store/service-accounts") }>
-                                <i class="fas fa-robot me-2"></i>Service Accounts
+                                <i class="bi bi-robot me-2"></i>Service Accounts
                             </a>
                         </li>
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/object-store/policies") }>
-                                <i class="fas fa-shield-alt me-2"></i>Policies
+                                <i class="bi bi-shield me-2"></i>Policies
                             </a>
                         </li>
                     </ul>
@@ -216,19 +217,19 @@ templ Layout(view ViewContext, content templ.Component) {
                     <ul class="nav flex-column">
                         <li class="nav-item">
                             <a class="nav-link" href={ view.P("/files") }>
-                                <i class="fas fa-folder me-2"></i>File Browser
+                                <i class="bi bi-folder me-2"></i>File Browser
                             </a>
                         </li>
                         <li class="nav-item">
                             if isMQPage {
                                 <a class="nav-link" href="#" data-bs-toggle="collapse" data-bs-target="#messageQueueSubmenu" aria-expanded="true" aria-controls="messageQueueSubmenu">
-                                    <i class="fas fa-comments me-2"></i>Message Queue
-                                    <i class="fas fa-chevron-down ms-auto"></i>
+                                    <i class="bi bi-chat-dots me-2"></i>Message Queue
+                                    <i class="bi bi-chevron-down ms-auto"></i>
                                 </a>
                             } else {
                                 <a class="nav-link collapsed" href="#" data-bs-toggle="collapse" data-bs-target="#messageQueueSubmenu" aria-expanded="false" aria-controls="messageQueueSubmenu">
-                                    <i class="fas fa-comments me-2"></i>Message Queue
-                                    <i class="fas fa-chevron-down ms-auto"></i>
+                                    <i class="bi bi-chat-dots me-2"></i>Message Queue
+                                    <i class="bi bi-chevron-down ms-auto"></i>
                                 </a>
                             }
                             if isMQPage {
@@ -237,22 +238,22 @@ templ Layout(view ViewContext, content templ.Component) {
                                         <li class="nav-item">
                                             if currentPath == "/mq/brokers" {
                                                 <a class="nav-link py-2 active" href={ view.P("/mq/brokers") }>
-                                                    <i class="fas fa-server me-2"></i>Brokers
+                                                    <i class="bi bi-server me-2"></i>Brokers
                                                 </a>
                                             } else {
                                                 <a class="nav-link py-2" href={ view.P("/mq/brokers") }>
-                                                    <i class="fas fa-server me-2"></i>Brokers
+                                                    <i class="bi bi-server me-2"></i>Brokers
                                                 </a>
                                             }
                                         </li>
                                         <li class="nav-item">
                                             if currentPath == "/mq/topics" {
                                                 <a class="nav-link py-2 active" href={ view.P("/mq/topics") }>
-                                                    <i class="fas fa-list-alt me-2"></i>Topics
+                                                    <i class="bi bi-card-list me-2"></i>Topics
                                                 </a>
                                             } else {
                                                 <a class="nav-link py-2" href={ view.P("/mq/topics") }>
-                                                    <i class="fas fa-list-alt me-2"></i>Topics
+                                                    <i class="bi bi-card-list me-2"></i>Topics
                                                 </a>
                                             }
                                         </li>
@@ -264,12 +265,12 @@ templ Layout(view ViewContext, content templ.Component) {
                                     <ul class="nav flex-column ms-3">
                                         <li class="nav-item">
                                             <a class="nav-link py-2" href={ view.P("/mq/brokers") }>
-                                                <i class="fas fa-server me-2"></i>Brokers
+                                                <i class="bi bi-server me-2"></i>Brokers
                                             </a>
                                         </li>
                                         <li class="nav-item">
                                             <a class="nav-link py-2" href={ view.P("/mq/topics") }>
-                                                <i class="fas fa-list-alt me-2"></i>Topics
+                                                <i class="bi bi-card-list me-2"></i>Topics
                                             </a>
                                         </li>
 
@@ -286,33 +287,44 @@ templ Layout(view ViewContext, content templ.Component) {
                         <li class="nav-item">
                             if isDefaultWorkerPage {
                                 <a class="nav-link active" href={ view.P("/plugin/lanes/default") }>
-                                    <i class="fas fa-server me-2"></i>Default
+                                    <i class="bi bi-server me-2"></i>Default
                                 </a>
                             } else {
                                 <a class="nav-link" href={ view.P("/plugin/lanes/default") }>
-                                    <i class="fas fa-server me-2"></i>Default
-                                </a>
-                            }
-                        </li>
-                        <li class="nav-item">
-                            if isIcebergWorkerPage {
-                                <a class="nav-link active" href={ view.P("/plugin/lanes/iceberg") }>
-                                    <i class="fas fa-snowflake me-2"></i>Iceberg
-                                </a>
-                            } else {
-                                <a class="nav-link" href={ view.P("/plugin/lanes/iceberg") }>
-                                    <i class="fas fa-snowflake me-2"></i>Iceberg
+                                    <i class="bi bi-server me-2"></i>Default
                                 </a>
                             }
                         </li>
                         <li class="nav-item">
                             if isLifecycleWorkerPage {
                                 <a class="nav-link active" href={ view.P("/plugin/lanes/lifecycle") }>
-                                    <i class="fas fa-hourglass-half me-2"></i>Lifecycle
+                                    <i class="bi bi-hourglass-split me-2"></i>Lifecycle
                                 </a>
                             } else {
                                 <a class="nav-link" href={ view.P("/plugin/lanes/lifecycle") }>
-                                    <i class="fas fa-hourglass-half me-2"></i>Lifecycle
+                                    <i class="bi bi-hourglass-split me-2"></i>Lifecycle
+                                </a>
+                            }
+                        </li>
+                        <li class="nav-item">
+                            if isIcebergWorkerPage {
+                                <a class="nav-link active" href={ view.P("/plugin/lanes/iceberg") }>
+                                    <i class="bi bi-snow me-2"></i>Iceberg
+                                </a>
+                            } else {
+                                <a class="nav-link" href={ view.P("/plugin/lanes/iceberg") }>
+                                    <i class="bi bi-snow me-2"></i>Iceberg
+                                </a>
+                            }
+                        </li>
+                        <li class="nav-item">
+                            if isLanceWorkerPage {
+                                <a class="nav-link active" href={ view.P("/plugin/lanes/lance") }>
+                                    <i class="bi bi-bounding-box me-2"></i>Lance
+                                </a>
+                            } else {
+                                <a class="nav-link" href={ view.P("/plugin/lanes/lance") }>
+                                    <i class="bi bi-bounding-box me-2"></i>Lance
                                 </a>
                             }
                         </li>
@@ -343,7 +355,7 @@ templ Layout(view ViewContext, content templ.Component) {
                 if !strings.Contains(version.VERSION, "enterprise") {
                     <span class="mx-2">•</span>
                     <a href="https://seaweedfs.com" target="_blank" class="text-decoration-none">
-                        <i class="fas fa-star me-1"></i>Enterprise Version Available
+                        <i class="bi bi-star me-1"></i>Enterprise Version Available
                     </a>
                 }
             </small>
@@ -358,6 +370,7 @@ templ Layout(view ViewContext, content templ.Component) {
     <script src={ string(view.P("/static/js/admin.js")) }></script>
     <script src={ string(view.P("/static/js/iam-utils.js")) }></script>
     <script src={ string(view.P("/static/js/s3tables.js")) }></script>
+    <script src={ string(view.P("/static/js/policy_editor.js")) }></script>
 </body>
 </html>
 }
@@ -374,7 +387,7 @@ templ LoginForm(title string, errorMessage string, csrfToken string) {
     <link rel="icon" href={ prefix + "/static/favicon.ico" } type="image/x-icon">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <link href={ prefix + "/static/css/bootstrap.min.css" } rel="stylesheet">
-    <link href={ prefix + "/static/css/fontawesome.min.css" } rel="stylesheet">
+        <link href={ prefix + "/static/css/bootstrap-icons.min.css" } rel="stylesheet">
 </head>
 <body class="bg-light">
     <div class="container">
@@ -383,14 +396,14 @@ templ LoginForm(title string, errorMessage string, csrfToken string) {
                 <div class="card shadow">
                     <div class="card-body p-5">
                         <div class="text-center mb-4">
-                            <i class="fas fa-server fa-3x text-primary mb-3"></i>
+                            <i class="bi bi-server icon-3x text-primary mb-3"></i>
                             <h4 class="card-title">{title}</h4>
                             <p class="text-muted">Please sign in to continue</p>
                         </div>
 
                         if errorMessage != "" {
                             <div class="alert alert-danger" role="alert">
-                                <i class="fas fa-exclamation-triangle me-2"></i>
+                                <i class="bi bi-exclamation-triangle me-2"></i>
                                 {errorMessage}
                             </div>
                         }
@@ -401,7 +414,7 @@ templ LoginForm(title string, errorMessage string, csrfToken string) {
                                 <label for="username" class="form-label">Username</label>
                                 <div class="input-group">
                                     <span class="input-group-text">
-                                        <i class="fas fa-user"></i>
+                                        <i class="bi bi-person"></i>
                                     </span>
                                     <input type="text" class="form-control" id="username" name="username" required>
                                 </div>
@@ -411,14 +424,14 @@ templ LoginForm(title string, errorMessage string, csrfToken string) {
                                 <label for="password" class="form-label">Password</label>
                                 <div class="input-group">
                                     <span class="input-group-text">
-                                        <i class="fas fa-lock"></i>
+                                        <i class="bi bi-lock"></i>
                                     </span>
                                     <input type="password" class="form-control" id="password" name="password" required>
                                 </div>
                             </div>
 
                             <button type="submit" class="btn btn-primary w-100">
-                                <i class="fas fa-sign-in-alt me-2"></i>Sign In
+                                <i class="bi bi-box-arrow-in-right me-2"></i>Sign In
                             </button>
                         </form>
                     </div>
diff --git a/weed/admin/view/layout/layout_templ.go b/weed/admin/view/layout/layout_templ.go
index d37f0a4dc9..a2b0d4c304 100644
--- a/weed/admin/view/layout/layout_templ.go
+++ b/weed/admin/view/layout/layout_templ.go
@@ -1,6 +1,6 @@
 // Code generated by templ - DO NOT EDIT.
 
-// templ: version: v0.3.1001
+// templ: version: v0.3.1020
 package layout
 
 //lint:file-ignore SA4006 This context is only used if a nested component is present.
@@ -77,16 +77,17 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			strings.HasPrefix(currentPath, "/plugin/lanes/default/")
 		isIcebergWorkerPage := currentPath == "/plugin/lanes/iceberg" || strings.HasPrefix(currentPath, "/plugin/lanes/iceberg/")
 		isLifecycleWorkerPage := currentPath == "/plugin/lanes/lifecycle" || strings.HasPrefix(currentPath, "/plugin/lanes/lifecycle/")
+		isLanceWorkerPage := currentPath == "/plugin/lanes/lance" || strings.HasPrefix(currentPath, "/plugin/lanes/lance/")
 		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 1, "<!doctype html><html lang=\"en\"><head><meta charset=\"UTF-8\"><title>SeaweedFS Admin</title><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><meta name=\"csrf-token\" content=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var2 string
-		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(csrfToken)
+		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.ResolveAttributeValue(csrfToken)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 54, Col: 47}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 55, Col: 47}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var2)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -97,7 +98,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		var templ_7745c5c3_Var3 templ.SafeURL
 		templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/favicon.ico")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 55, Col: 65}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 56, Col: 65}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
 		if templ_7745c5c3_Err != nil {
@@ -110,20 +111,20 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		var templ_7745c5c3_Var4 templ.SafeURL
 		templ_7745c5c3_Var4, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/css/bootstrap.min.css")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 58, Col: 64}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 59, Col: 64}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var4))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\" rel=\"stylesheet\"><!-- Font Awesome CSS --><link href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\" rel=\"stylesheet\"><!-- Bootstrap Icons CSS --><link href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var5 templ.SafeURL
-		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/css/fontawesome.min.css")))
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/css/bootstrap-icons.min.css")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 60, Col: 66}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 61, Col: 70}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
 		if templ_7745c5c3_Err != nil {
@@ -134,11 +135,11 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var6 string
-		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(string(view.P("/static/js/htmx.min.js")))
+		templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/htmx.min.js")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 62, Col: 58}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 63, Col: 58}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var6)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -149,7 +150,7 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		var templ_7745c5c3_Var7 templ.SafeURL
 		templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinURLErrs(string(view.P("/static/css/admin.css")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 64, Col: 73}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 65, Col: 73}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
 		if templ_7745c5c3_Err != nil {
@@ -170,20 +171,20 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		var templ_7745c5c3_Var8 templ.SafeURL
 		templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/admin"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 73, Col: 71}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 74, Col: 71}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\"><i class=\"fas fa-server me-2\"></i> SeaweedFS Admin</a> <button class=\"navbar-toggler d-md-none me-2\" type=\"button\" data-bs-toggle=\"collapse\" data-bs-target=\"#sidebarMenu\" aria-controls=\"sidebarMenu\" aria-expanded=\"false\" aria-label=\"Toggle navigation menu\"><span class=\"navbar-toggler-icon\"></span></button> <button class=\"navbar-toggler\" type=\"button\" data-bs-toggle=\"collapse\" data-bs-target=\"#navbarNav\" aria-controls=\"navbarNav\" aria-expanded=\"false\" aria-label=\"User menu\"><i class=\"fas fa-user\"></i></button><div class=\"collapse navbar-collapse\" id=\"navbarNav\"><ul class=\"navbar-nav ms-auto\"><li class=\"nav-item dropdown\"><a class=\"nav-link dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"fas fa-user me-1\"></i>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "\"><i class=\"bi bi-server me-2\"></i> SeaweedFS Admin</a> <button class=\"navbar-toggler d-md-none me-2\" type=\"button\" data-bs-toggle=\"collapse\" data-bs-target=\"#sidebarMenu\" aria-controls=\"sidebarMenu\" aria-expanded=\"false\" aria-label=\"Toggle navigation menu\"><span class=\"navbar-toggler-icon\"></span></button> <button class=\"navbar-toggler\" type=\"button\" data-bs-toggle=\"collapse\" data-bs-target=\"#navbarNav\" aria-controls=\"navbarNav\" aria-expanded=\"false\" aria-label=\"User menu\"><i class=\"bi bi-person\"></i></button><div class=\"collapse navbar-collapse\" id=\"navbarNav\"><ul class=\"navbar-nav ms-auto\"><li class=\"nav-item dropdown\"><a class=\"nav-link dropdown-toggle\" href=\"#\" role=\"button\" data-bs-toggle=\"dropdown\"><i class=\"bi bi-person me-1\"></i>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var9 string
 		templ_7745c5c3_Var9, templ_7745c5c3_Err = templ.JoinStringErrs(username)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 89, Col: 73}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 90, Col: 74}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var9))
 		if templ_7745c5c3_Err != nil {
@@ -196,26 +197,26 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		var templ_7745c5c3_Var10 templ.SafeURL
 		templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/logout"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 92, Col: 85}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 93, Col: 85}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\"><i class=\"fas fa-sign-out-alt me-2\"></i>Logout</a></li></ul></li></ul></div></div></header><div class=\"row g-0\"><!-- Sidebar --><div class=\"col-md-3 col-lg-2 d-md-block bg-light sidebar collapse\" id=\"sidebarMenu\"><div class=\"position-sticky pt-3\"><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>MAIN</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "\"><i class=\"bi bi-box-arrow-right me-2\"></i>Logout</a></li></ul></li></ul></div></div></header><div class=\"row g-0\"><!-- Sidebar --><div class=\"col-md-3 col-lg-2 d-md-block bg-light sidebar collapse\" id=\"sidebarMenu\"><div class=\"position-sticky pt-3\"><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>MAIN</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var11 templ.SafeURL
 		templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/admin"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 111, Col: 71}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 112, Col: 71}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"fas fa-tachometer-alt me-2\"></i>Dashboard</a></li><li class=\"nav-item\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "\"><i class=\"bi bi-speedometer2 me-2\"></i>Dashboard</a></li><li class=\"nav-item\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -229,11 +230,11 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var13 string
-		templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var12).String())
+		templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var12).String())
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var13)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -242,15 +243,15 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var14 string
-		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%t", isClusterPage))
+		templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%t", isClusterPage))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 116, Col: 207}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 117, Col: 207}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var14))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\" aria-controls=\"clusterSubmenu\"><i class=\"fas fa-sitemap me-2\"></i>Cluster <i class=\"fas fa-chevron-down ms-auto\"></i></a>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "\" aria-controls=\"clusterSubmenu\"><i class=\"bi bi-diagram-3 me-2\"></i>Cluster <i class=\"bi bi-chevron-down ms-auto\"></i></a>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -264,11 +265,11 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var16 string
-		templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var15).String())
+		templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var15).String())
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var16))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -279,65 +280,65 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		var templ_7745c5c3_Var17 templ.SafeURL
 		templ_7745c5c3_Var17, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/masters"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 123, Col: 98}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 124, Col: 98}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var17))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "\"><i class=\"fas fa-crown me-2\"></i>Masters</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "\"><i class=\"bi bi-award me-2\"></i>Masters</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var18 templ.SafeURL
 		templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/volume-servers"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 128, Col: 105}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 129, Col: 105}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var18))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\"><i class=\"fas fa-server me-2\"></i>Volume Servers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\"><i class=\"bi bi-server me-2\"></i>Volume Servers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var19 templ.SafeURL
 		templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/filers"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 133, Col: 97}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 134, Col: 97}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\"><i class=\"fas fa-folder-open me-2\"></i>Filers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\"><i class=\"bi bi-folder2-open me-2\"></i>Filers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var20 templ.SafeURL
 		templ_7745c5c3_Var20, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/s3"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 138, Col: 93}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 139, Col: 93}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var20))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "\"><i class=\"fas fa-cloud me-2\"></i>S3 Servers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "\"><i class=\"bi bi-cloud me-2\"></i>S3 Servers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var21 templ.SafeURL
 		templ_7745c5c3_Var21, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/cluster/mount-clients"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 143, Col: 104}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 144, Col: 104}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var21))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\"><i class=\"fas fa-plug me-2\"></i>Mount Clients</a></li></ul></div></li><li class=\"nav-item\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "\"><i class=\"bi bi-plug me-2\"></i>Mount Clients</a></li></ul></div></li><li class=\"nav-item\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -351,11 +352,11 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var23 string
-		templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var22).String())
+		templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var22).String())
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var23)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -364,15 +365,15 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var24 string
-		templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%t", isStoragePage))
+		templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.ResolveAttributeValue(fmt.Sprintf("%t", isStoragePage))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 151, Col: 207}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 152, Col: 207}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var24)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "\" aria-controls=\"storageSubmenu\"><i class=\"fas fa-hdd me-2\"></i>Storage <i class=\"fas fa-chevron-down ms-auto\"></i></a>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "\" aria-controls=\"storageSubmenu\"><i class=\"bi bi-device-hdd me-2\"></i>Storage <i class=\"bi bi-chevron-down ms-auto\"></i></a>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -386,11 +387,11 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var26 string
-		templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.JoinStringErrs(templ.CSSClasses(templ_7745c5c3_Var25).String())
+		templ_7745c5c3_Var26, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var25).String())
 		if templ_7745c5c3_Err != nil {
 			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 1, Col: 0}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var26))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var26)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -401,140 +402,140 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		var templ_7745c5c3_Var27 templ.SafeURL
 		templ_7745c5c3_Var27, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/storage/volumes"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 158, Col: 98}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 159, Col: 98}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var27))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "\"><i class=\"fas fa-database me-2\"></i>Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "\"><i class=\"bi bi-database me-2\"></i>Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var28 templ.SafeURL
 		templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/storage/ec-shards"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 163, Col: 100}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 164, Col: 100}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\"><i class=\"fas fa-th-large me-2\"></i>EC Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "\"><i class=\"bi bi-grid me-2\"></i>EC Volumes</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var29 templ.SafeURL
 		templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/storage/collections"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 168, Col: 102}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 169, Col: 102}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\"><i class=\"fas fa-layer-group me-2\"></i>Collections</a></li></ul></div></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>OBJECT STORE</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "\"><i class=\"bi bi-layers me-2\"></i>Collections</a></li></ul></div></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>OBJECT STORE</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var30 templ.SafeURL
 		templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/buckets"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 182, Col: 86}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 183, Col: 86}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\"><i class=\"fas fa-cube me-2\"></i>Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\"><i class=\"bi bi-box me-2\"></i>Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var31 templ.SafeURL
 		templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/s3tables/buckets"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 187, Col: 95}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 188, Col: 95}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "\"><i class=\"fas fa-table me-2\"></i>Table Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "\"><i class=\"bi bi-table me-2\"></i>Table Buckets</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var32 templ.SafeURL
 		templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/users"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 192, Col: 84}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 193, Col: 84}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "\"><i class=\"fas fa-users me-2\"></i>Users</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "\"><i class=\"bi bi-people me-2\"></i>Users</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var33 templ.SafeURL
 		templ_7745c5c3_Var33, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/groups"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 197, Col: 85}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 198, Col: 85}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var33))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\"><i class=\"fas fa-users-cog me-2\"></i>Groups</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "\"><i class=\"bi bi-people-fill me-2\"></i>Groups</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var34 templ.SafeURL
 		templ_7745c5c3_Var34, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/service-accounts"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 202, Col: 95}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 203, Col: 95}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var34))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "\"><i class=\"fas fa-robot me-2\"></i>Service Accounts</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "\"><i class=\"bi bi-robot me-2\"></i>Service Accounts</a></li><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var35 templ.SafeURL
 		templ_7745c5c3_Var35, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/object-store/policies"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 207, Col: 87}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 208, Col: 87}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var35))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "\"><i class=\"fas fa-shield-alt me-2\"></i>Policies</a></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>MANAGEMENT</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "\"><i class=\"bi bi-shield me-2\"></i>Policies</a></li></ul><h6 class=\"sidebar-heading px-3 mt-4 mb-1 text-muted\"><span>MANAGEMENT</span></h6><ul class=\"nav flex-column\"><li class=\"nav-item\"><a class=\"nav-link\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var36 templ.SafeURL
 		templ_7745c5c3_Var36, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/files"))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 218, Col: 71}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 219, Col: 71}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var36))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\"><i class=\"fas fa-folder me-2\"></i>File Browser</a></li><li class=\"nav-item\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "\"><i class=\"bi bi-folder me-2\"></i>File Browser</a></li><li class=\"nav-item\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		if isMQPage {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<a class=\"nav-link\" href=\"#\" data-bs-toggle=\"collapse\" data-bs-target=\"#messageQueueSubmenu\" aria-expanded=\"true\" aria-controls=\"messageQueueSubmenu\"><i class=\"fas fa-comments me-2\"></i>Message Queue <i class=\"fas fa-chevron-down ms-auto\"></i></a> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "<a class=\"nav-link\" href=\"#\" data-bs-toggle=\"collapse\" data-bs-target=\"#messageQueueSubmenu\" aria-expanded=\"true\" aria-controls=\"messageQueueSubmenu\"><i class=\"bi bi-chat-dots me-2\"></i>Message Queue <i class=\"bi bi-chevron-down ms-auto\"></i></a> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<a class=\"nav-link collapsed\" href=\"#\" data-bs-toggle=\"collapse\" data-bs-target=\"#messageQueueSubmenu\" aria-expanded=\"false\" aria-controls=\"messageQueueSubmenu\"><i class=\"fas fa-comments me-2\"></i>Message Queue <i class=\"fas fa-chevron-down ms-auto\"></i></a> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "<a class=\"nav-link collapsed\" href=\"#\" data-bs-toggle=\"collapse\" data-bs-target=\"#messageQueueSubmenu\" aria-expanded=\"false\" aria-controls=\"messageQueueSubmenu\"><i class=\"bi bi-chat-dots me-2\"></i>Message Queue <i class=\"bi bi-chevron-down ms-auto\"></i></a> ")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -552,13 +553,13 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 				var templ_7745c5c3_Var37 templ.SafeURL
 				templ_7745c5c3_Var37, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/brokers"))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 239, Col: 108}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 240, Col: 108}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var37))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "\"><i class=\"fas fa-server me-2\"></i>Brokers</a>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "\"><i class=\"bi bi-server me-2\"></i>Brokers</a>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -570,13 +571,13 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 				var templ_7745c5c3_Var38 templ.SafeURL
 				templ_7745c5c3_Var38, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/brokers"))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 243, Col: 101}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 244, Col: 101}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var38))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "\"><i class=\"fas fa-server me-2\"></i>Brokers</a>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 44, "\"><i class=\"bi bi-server me-2\"></i>Brokers</a>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -593,13 +594,13 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 				var templ_7745c5c3_Var39 templ.SafeURL
 				templ_7745c5c3_Var39, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/topics"))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 250, Col: 107}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 251, Col: 107}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var39))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "\"><i class=\"fas fa-list-alt me-2\"></i>Topics</a>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 47, "\"><i class=\"bi bi-card-list me-2\"></i>Topics</a>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -611,13 +612,13 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 				var templ_7745c5c3_Var40 templ.SafeURL
 				templ_7745c5c3_Var40, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/topics"))
 				if templ_7745c5c3_Err != nil {
-					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 254, Col: 100}
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 255, Col: 100}
 				}
 				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var40))
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "\"><i class=\"fas fa-list-alt me-2\"></i>Topics</a>")
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 49, "\"><i class=\"bi bi-card-list me-2\"></i>Topics</a>")
 				if templ_7745c5c3_Err != nil {
 					return templ_7745c5c3_Err
 				}
@@ -634,26 +635,26 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			var templ_7745c5c3_Var41 templ.SafeURL
 			templ_7745c5c3_Var41, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/brokers"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 266, Col: 97}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 267, Col: 97}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var41))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "\"><i class=\"fas fa-server me-2\"></i>Brokers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 52, "\"><i class=\"bi bi-server me-2\"></i>Brokers</a></li><li class=\"nav-item\"><a class=\"nav-link py-2\" href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var42 templ.SafeURL
 			templ_7745c5c3_Var42, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/mq/topics"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 271, Col: 96}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 272, Col: 96}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var42))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "\"><i class=\"fas fa-list-alt me-2\"></i>Topics</a></li></ul></div>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 53, "\"><i class=\"bi bi-card-list me-2\"></i>Topics</a></li></ul></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -670,13 +671,13 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			var templ_7745c5c3_Var43 templ.SafeURL
 			templ_7745c5c3_Var43, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/default"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 288, Col: 97}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 289, Col: 97}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var43))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "\"><i class=\"fas fa-server me-2\"></i>Default</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 56, "\"><i class=\"bi bi-server me-2\"></i>Default</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -688,13 +689,13 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 			var templ_7745c5c3_Var44 templ.SafeURL
 			templ_7745c5c3_Var44, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/default"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 292, Col: 90}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 293, Col: 90}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var44))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "\"><i class=\"fas fa-server me-2\"></i>Default</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 58, "\"><i class=\"bi bi-server me-2\"></i>Default</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -703,21 +704,21 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if isIcebergWorkerPage {
+		if isLifecycleWorkerPage {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 60, "<a class=\"nav-link active\" href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var45 templ.SafeURL
-			templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/iceberg"))
+			templ_7745c5c3_Var45, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lifecycle"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 299, Col: 97}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 300, Col: 99}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var45))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "\"><i class=\"fas fa-snowflake me-2\"></i>Iceberg</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 61, "\"><i class=\"bi bi-hourglass-split me-2\"></i>Lifecycle</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -727,15 +728,15 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var46 templ.SafeURL
-			templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/iceberg"))
+			templ_7745c5c3_Var46, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lifecycle"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 303, Col: 90}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 304, Col: 92}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var46))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "\"><i class=\"fas fa-snowflake me-2\"></i>Iceberg</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 63, "\"><i class=\"bi bi-hourglass-split me-2\"></i>Lifecycle</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -744,21 +745,21 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if isLifecycleWorkerPage {
+		if isIcebergWorkerPage {
 			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 65, "<a class=\"nav-link active\" href=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var47 templ.SafeURL
-			templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lifecycle"))
+			templ_7745c5c3_Var47, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/iceberg"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 310, Col: 99}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 311, Col: 97}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var47))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "\"><i class=\"fas fa-hourglass-half me-2\"></i>Lifecycle</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 66, "\"><i class=\"bi bi-snow me-2\"></i>Iceberg</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
@@ -768,20 +769,61 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 				return templ_7745c5c3_Err
 			}
 			var templ_7745c5c3_Var48 templ.SafeURL
-			templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lifecycle"))
+			templ_7745c5c3_Var48, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/iceberg"))
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 314, Col: 92}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 315, Col: 90}
 			}
 			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var48))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\"><i class=\"fas fa-hourglass-half me-2\"></i>Lifecycle</a>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 68, "\"><i class=\"bi bi-snow me-2\"></i>Iceberg</a>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "</li></ul></div></div><!-- Sidebar backdrop for mobile --><div class=\"sidebar-backdrop\" id=\"sidebarBackdrop\"></div><!-- Main content --><main class=\"col-md-9 ms-sm-auto col-lg-10 px-3 px-md-4\"><div class=\"pt-3\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 69, "</li><li class=\"nav-item\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if isLanceWorkerPage {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "<a class=\"nav-link active\" href=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var49 templ.SafeURL
+			templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lance"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 322, Col: 95}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var49))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, "\"><i class=\"bi bi-bounding-box me-2\"></i>Lance</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		} else {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, "<a class=\"nav-link\" href=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var50 templ.SafeURL
+			templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.JoinURLErrs(view.P("/plugin/lanes/lance"))
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 326, Col: 88}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var50))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "\"><i class=\"bi bi-bounding-box me-2\"></i>Lance</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, "</li></ul></div></div><!-- Sidebar backdrop for mobile --><div class=\"sidebar-backdrop\" id=\"sidebarBackdrop\"></div><!-- Main content --><main class=\"col-md-9 ms-sm-auto col-lg-10 px-3 px-md-4\"><div class=\"pt-3\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -789,127 +831,140 @@ func Layout(view ViewContext, content templ.Component) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 70, "</div></main></div></div><!-- Footer --><footer class=\"footer mt-auto py-3 bg-light\"><div class=\"container-fluid text-center\"><small class=\"text-muted\">&copy; ")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "</div></main></div></div><!-- Footer --><footer class=\"footer mt-auto py-3 bg-light\"><div class=\"container-fluid text-center\"><small class=\"text-muted\">&copy; ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var49 string
-		templ_7745c5c3_Var49, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", time.Now().Year()))
+		var templ_7745c5c3_Var51 string
+		templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(fmt.Sprintf("%d", time.Now().Year()))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 339, Col: 60}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 351, Col: 60}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var49))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var51))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 71, " SeaweedFS Admin v")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var50 string
-		templ_7745c5c3_Var50, templ_7745c5c3_Err = templ.JoinStringErrs(version.VERSION_NUMBER)
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 339, Col: 102}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var50))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 72, " ")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		if version.COMMIT != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 73, "<span class=\"mx-1\">(")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var51 string
-			templ_7745c5c3_Var51, templ_7745c5c3_Err = templ.JoinStringErrs(version.COMMIT)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 341, Col: 55}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var51))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 74, ")</span> ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		if !strings.Contains(version.VERSION, "enterprise") {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 75, "<span class=\"mx-2\">•</span> <a href=\"https://seaweedfs.com\" target=\"_blank\" class=\"text-decoration-none\"><i class=\"fas fa-star me-1\"></i>Enterprise Version Available</a>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, "</small></div></footer><!-- Bootstrap JS --><script src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 76, " SeaweedFS Admin v")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var52 string
-		templ_7745c5c3_Var52, templ_7745c5c3_Err = templ.JoinStringErrs(string(view.P("/static/js/bootstrap.bundle.min.js")))
+		templ_7745c5c3_Var52, templ_7745c5c3_Err = templ.JoinStringErrs(version.VERSION_NUMBER)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 354, Col: 70}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 351, Col: 102}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var52))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, "\"></script><!-- Modal Alerts JS (replaces native alert/confirm) --><script src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 77, " ")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var53 string
-		templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.JoinStringErrs(string(view.P("/static/js/modal-alerts.js")))
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 356, Col: 62}
+		if version.COMMIT != "" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, "<span class=\"mx-1\">(")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var53 string
+			templ_7745c5c3_Var53, templ_7745c5c3_Err = templ.JoinStringErrs(version.COMMIT)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 353, Col: 55}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var53))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, ")</span> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var53))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
+		if !strings.Contains(version.VERSION, "enterprise") {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "<span class=\"mx-2\">•</span> <a href=\"https://seaweedfs.com\" target=\"_blank\" class=\"text-decoration-none\"><i class=\"bi bi-star me-1\"></i>Enterprise Version Available</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 78, "\"></script><!-- Custom JS --><script src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "</small></div></footer><!-- Bootstrap JS --><script src=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var54 string
-		templ_7745c5c3_Var54, templ_7745c5c3_Err = templ.JoinStringErrs(string(view.P("/static/js/admin.js")))
+		templ_7745c5c3_Var54, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/bootstrap.bundle.min.js")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 358, Col: 55}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 366, Col: 70}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var54))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var54)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 79, "\"></script><script src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "\"></script><!-- Modal Alerts JS (replaces native alert/confirm) --><script src=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var55 string
-		templ_7745c5c3_Var55, templ_7745c5c3_Err = templ.JoinStringErrs(string(view.P("/static/js/iam-utils.js")))
+		templ_7745c5c3_Var55, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/modal-alerts.js")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 359, Col: 59}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 368, Col: 62}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var55))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var55)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 80, "\"></script><script src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, "\"></script><!-- Custom JS --><script src=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var56 string
-		templ_7745c5c3_Var56, templ_7745c5c3_Err = templ.JoinStringErrs(string(view.P("/static/js/s3tables.js")))
+		templ_7745c5c3_Var56, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/admin.js")))
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 360, Col: 58}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 370, Col: 55}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var56))
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var56)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 81, "\"></script></body></html>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "\"></script><script src=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var57 string
+		templ_7745c5c3_Var57, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/iam-utils.js")))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 371, Col: 59}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var57)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "\"></script><script src=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var58 string
+		templ_7745c5c3_Var58, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/s3tables.js")))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 372, Col: 58}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var58)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "\"></script><script src=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var59 string
+		templ_7745c5c3_Var59, templ_7745c5c3_Err = templ.ResolveAttributeValue(string(view.P("/static/js/policy_editor.js")))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 373, Col: 63}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var59)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "\"></script></body></html>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -933,140 +988,140 @@ func LoginForm(title string, errorMessage string, csrfToken string) templ.Compon
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var57 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var57 == nil {
-			templ_7745c5c3_Var57 = templ.NopComponent
+		templ_7745c5c3_Var60 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var60 == nil {
+			templ_7745c5c3_Var60 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
 		prefix := dash.URLPrefixFromContext(ctx)
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 82, "<!doctype html><html lang=\"en\"><head><meta charset=\"UTF-8\"><title>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "<!doctype html><html lang=\"en\"><head><meta charset=\"UTF-8\"><title>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var58 string
-		templ_7745c5c3_Var58, templ_7745c5c3_Err = templ.JoinStringErrs(title)
+		var templ_7745c5c3_Var61 string
+		templ_7745c5c3_Var61, templ_7745c5c3_Err = templ.JoinStringErrs(title)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 373, Col: 17}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var58))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 83, " - Login</title><link rel=\"icon\" href=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var59 templ.SafeURL
-		templ_7745c5c3_Var59, templ_7745c5c3_Err = templ.JoinURLErrs(prefix + "/static/favicon.ico")
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 374, Col: 58}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var59))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 84, "\" type=\"image/x-icon\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><link href=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var60 templ.SafeURL
-		templ_7745c5c3_Var60, templ_7745c5c3_Err = templ.JoinURLErrs(prefix + "/static/css/bootstrap.min.css")
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 376, Col: 57}
-		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var60))
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 85, "\" rel=\"stylesheet\"><link href=\"")
-		if templ_7745c5c3_Err != nil {
-			return templ_7745c5c3_Err
-		}
-		var templ_7745c5c3_Var61 templ.SafeURL
-		templ_7745c5c3_Var61, templ_7745c5c3_Err = templ.JoinURLErrs(prefix + "/static/css/fontawesome.min.css")
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 377, Col: 59}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 386, Col: 17}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var61))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 86, "\" rel=\"stylesheet\"></head><body class=\"bg-light\"><div class=\"container\"><div class=\"row justify-content-center min-vh-100 align-items-center\"><div class=\"col-md-6 col-lg-4\"><div class=\"card shadow\"><div class=\"card-body p-5\"><div class=\"text-center mb-4\"><i class=\"fas fa-server fa-3x text-primary mb-3\"></i><h4 class=\"card-title\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, " - Login</title><link rel=\"icon\" href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var62 string
-		templ_7745c5c3_Var62, templ_7745c5c3_Err = templ.JoinStringErrs(title)
+		var templ_7745c5c3_Var62 templ.SafeURL
+		templ_7745c5c3_Var62, templ_7745c5c3_Err = templ.JoinURLErrs(prefix + "/static/favicon.ico")
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 387, Col: 57}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 387, Col: 58}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var62))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 87, "</h4><p class=\"text-muted\">Please sign in to continue</p></div>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "\" type=\"image/x-icon\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><link href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		if errorMessage != "" {
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 88, "<div class=\"alert alert-danger\" role=\"alert\"><i class=\"fas fa-exclamation-triangle me-2\"></i> ")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			var templ_7745c5c3_Var63 string
-			templ_7745c5c3_Var63, templ_7745c5c3_Err = templ.JoinStringErrs(errorMessage)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 394, Col: 45}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var63))
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 89, "</div>")
-			if templ_7745c5c3_Err != nil {
-				return templ_7745c5c3_Err
-			}
+		var templ_7745c5c3_Var63 templ.SafeURL
+		templ_7745c5c3_Var63, templ_7745c5c3_Err = templ.JoinURLErrs(prefix + "/static/css/bootstrap.min.css")
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 389, Col: 57}
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 90, "<form method=\"POST\" action=\"")
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var63))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\" rel=\"stylesheet\"><link href=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var64 templ.SafeURL
-		templ_7745c5c3_Var64, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(prefix + "/login"))
+		templ_7745c5c3_Var64, templ_7745c5c3_Err = templ.JoinURLErrs(prefix + "/static/css/bootstrap-icons.min.css")
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 398, Col: 85}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 390, Col: 67}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var64))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 91, "\"><input type=\"hidden\" name=\"csrf_token\" value=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "\" rel=\"stylesheet\"></head><body class=\"bg-light\"><div class=\"container\"><div class=\"row justify-content-center min-vh-100 align-items-center\"><div class=\"col-md-6 col-lg-4\"><div class=\"card shadow\"><div class=\"card-body p-5\"><div class=\"text-center mb-4\"><i class=\"bi bi-server icon-3x text-primary mb-3\"></i><h4 class=\"card-title\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
 		var templ_7745c5c3_Var65 string
-		templ_7745c5c3_Var65, templ_7745c5c3_Err = templ.JoinStringErrs(csrfToken)
+		templ_7745c5c3_Var65, templ_7745c5c3_Err = templ.JoinStringErrs(title)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 399, Col: 84}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 400, Col: 57}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var65))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 92, "\"><div class=\"mb-3\"><label for=\"username\" class=\"form-label\">Username</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"fas fa-user\"></i></span> <input type=\"text\" class=\"form-control\" id=\"username\" name=\"username\" required></div></div><div class=\"mb-4\"><label for=\"password\" class=\"form-label\">Password</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"fas fa-lock\"></i></span> <input type=\"password\" class=\"form-control\" id=\"password\" name=\"password\" required></div></div><button type=\"submit\" class=\"btn btn-primary w-100\"><i class=\"fas fa-sign-in-alt me-2\"></i>Sign In</button></form></div></div></div></div></div><script src=\"")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "</h4><p class=\"text-muted\">Please sign in to continue</p></div>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		var templ_7745c5c3_Var66 string
-		templ_7745c5c3_Var66, templ_7745c5c3_Err = templ.JoinStringErrs(prefix + "/static/js/bootstrap.bundle.min.js")
-		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 430, Col: 63}
+		if errorMessage != "" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 94, "<div class=\"alert alert-danger\" role=\"alert\"><i class=\"bi bi-exclamation-triangle me-2\"></i> ")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var66 string
+			templ_7745c5c3_Var66, templ_7745c5c3_Err = templ.JoinStringErrs(errorMessage)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 407, Col: 45}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var66))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 95, "</div>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
 		}
-		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var66))
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 96, "<form method=\"POST\" action=\"")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 93, "\"></script></body></html>")
+		var templ_7745c5c3_Var67 templ.SafeURL
+		templ_7745c5c3_Var67, templ_7745c5c3_Err = templ.JoinURLErrs(templ.SafeURL(prefix + "/login"))
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 411, Col: 85}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var67))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 97, "\"><input type=\"hidden\" name=\"csrf_token\" value=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var68 string
+		templ_7745c5c3_Var68, templ_7745c5c3_Err = templ.ResolveAttributeValue(csrfToken)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 412, Col: 84}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var68)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 98, "\"><div class=\"mb-3\"><label for=\"username\" class=\"form-label\">Username</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"bi bi-person\"></i></span> <input type=\"text\" class=\"form-control\" id=\"username\" name=\"username\" required></div></div><div class=\"mb-4\"><label for=\"password\" class=\"form-label\">Password</label><div class=\"input-group\"><span class=\"input-group-text\"><i class=\"bi bi-lock\"></i></span> <input type=\"password\" class=\"form-control\" id=\"password\" name=\"password\" required></div></div><button type=\"submit\" class=\"btn btn-primary w-100\"><i class=\"bi bi-box-arrow-in-right me-2\"></i>Sign In</button></form></div></div></div></div></div><script src=\"")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var69 string
+		templ_7745c5c3_Var69, templ_7745c5c3_Err = templ.ResolveAttributeValue(prefix + "/static/js/bootstrap.bundle.min.js")
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `view/layout/layout.templ`, Line: 443, Col: 63}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var69)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 99, "\"></script></body></html>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
diff --git a/weed/cluster/lock_client.go b/weed/cluster/lock_client.go
index 44529acb05..9d14f383f2 100644
--- a/weed/cluster/lock_client.go
+++ b/weed/cluster/lock_client.go
@@ -3,6 +3,7 @@ package cluster
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -27,6 +28,7 @@ type LockClient struct {
 	// correct: the filer forwards to the real primary as a fallback.
 	ringMu      sync.RWMutex
 	ring        *lock_manager.HashRing
+	ringServers []pb.ServerAddress
 	ringVersion int64
 
 	// priorRing is the ring before the most recent change, kept for priorWindow so a
@@ -35,15 +37,24 @@ type LockClient struct {
 	priorRing     *lock_manager.HashRing
 	ringChangedAt time.Time
 	priorWindow   time.Duration
+
+	// noLockServerRetryPeriod bounds retries when every filer reports "no
+	// lock server found": an empty lock ring is a systemic fault that waiting
+	// on a lock holder cannot resolve, unlike ordinary contention. The bound
+	// is long enough to ride out a master leader change (ring reset + fresh
+	// snapshot) but short enough that a write fails instead of hanging
+	// forever.
+	noLockServerRetryPeriod time.Duration
 }
 
 func NewLockClient(grpcDialOption grpc.DialOption, seedFiler pb.ServerAddress) *LockClient {
 	return &LockClient{
-		grpcDialOption:  grpcDialOption,
-		maxLockDuration: 5 * time.Second,
-		sleepDuration:   2473 * time.Millisecond,
-		seedFiler:       seedFiler,
-		priorWindow:     5 * time.Second,
+		grpcDialOption:          grpcDialOption,
+		maxLockDuration:         5 * time.Second,
+		sleepDuration:           2473 * time.Millisecond,
+		seedFiler:               seedFiler,
+		priorWindow:             5 * time.Second,
+		noLockServerRetryPeriod: 15 * time.Second,
 	}
 }
 
@@ -58,10 +69,16 @@ func (lc *LockClient) SetRing(servers []pb.ServerAddress, version int64) {
 		return
 	}
 	lc.ringVersion = version
+	sorted := slices.Clone(servers)
+	slices.Sort(sorted)
+	if slices.Equal(sorted, lc.ringServers) {
+		return
+	}
+	lc.ringServers = sorted
 	// Build a fresh ring (not an in-place mutation) so the outgoing ring survives as
 	// priorRing with its own servers for the cooling-off window.
 	newRing := lock_manager.NewHashRing(lock_manager.DefaultVnodeCount)
-	newRing.SetServers(servers)
+	newRing.SetServers(sorted)
 	if lc.ring != nil {
 		lc.priorRing = lc.ring
 		lc.ringChangedAt = time.Now()
@@ -69,6 +86,18 @@ func (lc *LockClient) SetRing(servers []pb.ServerAddress, version int64) {
 	lc.ring = newRing
 }
 
+// ResetRing clears only the version gate so the first update from a
+// different master applies unconditionally: ring versions are per-master
+// monotonic and a high version accepted from a former leader must not
+// reject the new leader's snapshot. The last ring keeps routing during the
+// gap rather than falling back to the seed filer, and the arriving ring
+// becomes the prior ring for the cooling-off window.
+func (lc *LockClient) ResetRing() {
+	lc.ringMu.Lock()
+	defer lc.ringMu.Unlock()
+	lc.ringVersion = 0
+}
+
 // hostForKey returns the filer that should own key per the current ring view,
 // falling back to the seed filer when no view has been received yet.
 func (lc *LockClient) hostForKey(key string) pb.ServerAddress {
@@ -117,6 +146,7 @@ func (lc *LockClient) PriorOwnerForKey(key string) pb.ServerAddress {
 }
 
 type LiveLock struct {
+	generation          int64 // fencing token from the lock server; MUST stay first so the 64-bit atomic ops stay 8-byte aligned on 32-bit ARM
 	key                 string
 	renewToken          string
 	expireAtNs          int64
@@ -129,11 +159,12 @@ type LiveLock struct {
 	lc                  *LockClient
 	owner               string
 	lockTTL             time.Duration
-	consecutiveFailures int   // Track connection failures to trigger fallback
-	generation          int64 // fencing token from the lock server
+	consecutiveFailures int // Track connection failures to trigger fallback
 }
 
-// NewShortLivedLock creates a lock with a 5-second duration
+// NewShortLivedLock creates a lock with a 5-second duration.
+// It returns nil when the lock cannot be acquired because no lock server
+// exists; ordinary contention is still waited out.
 func (lc *LockClient) NewShortLivedLock(key string, owner string) (lock *LiveLock) {
 	lock = &LiveLock{
 		key:            key,
@@ -144,7 +175,10 @@ func (lc *LockClient) NewShortLivedLock(key string, owner string) (lock *LiveLoc
 		self:           owner,
 		lc:             lc,
 	}
-	lock.retryUntilLocked(5 * time.Second)
+	if err := lock.retryUntilLocked(5 * time.Second); err != nil {
+		glog.Warningf("create lock %s: %v", key, err)
+		return nil
+	}
 	return
 }
 
@@ -167,7 +201,10 @@ func (lc *LockClient) NewBlockingLongLivedLock(key, owner string, lockTTL time.D
 		lockTTL:        lockTTL,
 	}
 	// Block until acquired
-	lock.retryUntilLocked(lockTTL)
+	if err := lock.retryUntilLocked(lockTTL); err != nil {
+		glog.Warningf("create lock %s: %v", key, err)
+		return nil
+	}
 	// Start renewal goroutine using a ticker for interruptible sleep
 	lock.renewalDone = make(chan struct{})
 	go func() {
@@ -266,12 +303,31 @@ func (lc *LockClient) StartLongLivedLock(key string, owner string, onLockOwnerCh
 // several seconds): when a holder on another mount releases the lock, the
 // waiter must pick it up promptly, otherwise cross-mount write handoff stalls
 // long enough to time out clients.
-func (lock *LiveLock) retryUntilLocked(lockDuration time.Duration) {
+func (lock *LiveLock) retryUntilLocked(lockDuration time.Duration) error {
+	var unavailableSince time.Time
 	for lock.renewToken == "" {
-		if err := lock.AttemptToLock(lockDuration); err != nil {
-			glog.V(1).Infof("create lock %s: %v", lock.key, err)
+		err := lock.AttemptToLock(lockDuration)
+		if err == nil {
+			unavailableSince = time.Time{}
+			continue
+		}
+		glog.V(1).Infof("create lock %s: %v", lock.key, err)
+		if strings.Contains(err.Error(), "lock already owned") {
+			// Ordinary contention: a reachable server holds the lock, so
+			// waiting is the point and has no bound.
+			unavailableSince = time.Time{}
+			continue
+		}
+		// Anything else — "no lock server found", a dead ring member refusing
+		// connections — is a systemic fault waiting cannot fix; give up once
+		// it persists past the retry period.
+		if unavailableSince.IsZero() {
+			unavailableSince = time.Now()
+		} else if time.Since(unavailableSince) > lock.lc.noLockServerRetryPeriod {
+			return err
 		}
 	}
+	return nil
 }
 
 func (lock *LiveLock) AttemptToLock(lockDuration time.Duration) error {
diff --git a/weed/cluster/lock_client_test.go b/weed/cluster/lock_client_test.go
index 608ddf6da4..7a6a89950f 100644
--- a/weed/cluster/lock_client_test.go
+++ b/weed/cluster/lock_client_test.go
@@ -1,12 +1,18 @@
 package cluster
 
 import (
+	"context"
 	"fmt"
+	"net"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
 )
 
 // The gateway must resolve a lock key to the same primary the filers do,
@@ -150,3 +156,146 @@ func TestLockClientPriorOwnerForKeyExpires(t *testing.T) {
 		}
 	}
 }
+
+// A master change clears the version gate so the new leader's (lower-versioned)
+// snapshot applies — versions are only comparable within one master's stream.
+func TestLockClientResetRing(t *testing.T) {
+	lc := NewLockClient(nil, "seed:8888")
+
+	lc.SetRing([]pb.ServerAddress{"filer-a:8888", "filer-b:8888"}, 100)
+	lc.ResetRing()
+
+	// The last ring keeps routing during the gap; only version acceptance
+	// is reset so the new leader's (lower-versioned) snapshot applies.
+	if got := lc.hostForKey("k"); got == "seed:8888" {
+		t.Fatal("expected the previous ring to keep routing after reset")
+	}
+	lc.SetRing([]pb.ServerAddress{"filer-z:8888"}, 50)
+	if got := lc.hostForKey("k"); got != "filer-z:8888" {
+		t.Fatalf("lower version from new master not applied, got %q", got)
+	}
+}
+
+type noLockServerFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+}
+
+func (s *noLockServerFiler) DistributedLock(ctx context.Context, req *filer_pb.LockRequest) (*filer_pb.LockResponse, error) {
+	return &filer_pb.LockResponse{Error: lock_manager.NoLockServerError.Error()}, nil
+}
+
+// When every filer reports an empty lock ring, lock acquisition must fail
+// after a bounded period instead of hanging the write forever.
+func TestNewShortLivedLockFailsFastOnNoLockServer(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, &noLockServerFiler{})
+	go grpcServer.Serve(listener)
+	defer grpcServer.Stop()
+
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	host, port, err := net.SplitHostPort(listener.Addr().String())
+	if err != nil {
+		t.Fatalf("split host port: %v", err)
+	}
+	// "host:httpPort.grpcPort" dials the fake filer's port directly.
+	lc := NewLockClient(dialOption, pb.ServerAddress(fmt.Sprintf("%s:0.%s", host, port)))
+	lc.noLockServerRetryPeriod = 200 * time.Millisecond
+
+	start := time.Now()
+	lock := lc.NewShortLivedLock("test-key", "test-owner")
+	elapsed := time.Since(start)
+
+	if lock != nil {
+		t.Fatal("expected nil lock when no lock server exists")
+	}
+	if elapsed > 10*time.Second {
+		t.Fatalf("lock acquisition took %v, expected fail-fast", elapsed)
+	}
+}
+
+type contendedLockFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+}
+
+func (s *contendedLockFiler) DistributedLock(ctx context.Context, req *filer_pb.LockRequest) (*filer_pb.LockResponse, error) {
+	return &filer_pb.LockResponse{Error: "lock already owned by someone"}, nil
+}
+
+// A lock held by another owner is ordinary contention: acquisition waits it
+// out rather than failing on the unavailability bound.
+func TestNewShortLivedLockWaitsOutContention(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, &contendedLockFiler{})
+	go grpcServer.Serve(listener)
+	defer grpcServer.Stop()
+
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	host, port, err := net.SplitHostPort(listener.Addr().String())
+	if err != nil {
+		t.Fatalf("split host port: %v", err)
+	}
+	lc := NewLockClient(dialOption, pb.ServerAddress(fmt.Sprintf("%s:0.%s", host, port)))
+	lc.noLockServerRetryPeriod = 200 * time.Millisecond
+
+	done := make(chan *LiveLock, 1)
+	go func() {
+		done <- lc.NewShortLivedLock("test-key", "test-owner")
+	}()
+	select {
+	case <-done:
+		t.Fatal("ordinary lock contention must not hit the unavailability bound")
+	case <-time.After(3 * lc.noLockServerRetryPeriod):
+	}
+}
+
+// A ring member that refuses connections is unavailability, not contention:
+// acquisition fails on the same bound as "no lock server found".
+func TestNewShortLivedLockFailsFastOnUnreachableFiler(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	addr := listener.Addr().String()
+	listener.Close()
+
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	host, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		t.Fatalf("split host port: %v", err)
+	}
+	lc := NewLockClient(dialOption, pb.ServerAddress(fmt.Sprintf("%s:0.%s", host, port)))
+	lc.noLockServerRetryPeriod = 200 * time.Millisecond
+
+	start := time.Now()
+	lock := lc.NewShortLivedLock("test-key", "test-owner")
+	elapsed := time.Since(start)
+
+	if lock != nil {
+		t.Fatal("expected nil lock when the ring member is unreachable")
+	}
+	if elapsed > 10*time.Second {
+		t.Fatalf("lock acquisition took %v, expected fail-fast", elapsed)
+	}
+}
+
+// LiveLock.generation is a fencing token written and read with 64-bit atomic
+// operations. On 32-bit platforms (GOARCH=386 and GOARCH=arm) a 64-bit atomic
+// op requires an 8-byte-aligned address, which Go only guarantees for the
+// first field of an allocated struct. generation must therefore stay first:
+// a misaligned field makes StoreInt64 panic with "unaligned 64-bit atomic
+// operation" the moment this test runs on a 32-bit target.
+func TestLiveLockGenerationIsAligned(t *testing.T) {
+	var lock LiveLock
+	atomic.StoreInt64(&lock.generation, 42)
+	if got := lock.Generation(); got != 42 {
+		t.Fatalf("generation = %d, want 42", got)
+	}
+}
diff --git a/weed/cluster/lock_manager/lock_ring.go b/weed/cluster/lock_manager/lock_ring.go
index 33e96c776d..625b8d2340 100644
--- a/weed/cluster/lock_manager/lock_ring.go
+++ b/weed/cluster/lock_manager/lock_ring.go
@@ -1,6 +1,7 @@
 package lock_manager
 
 import (
+	"slices"
 	"sort"
 	"sync"
 	"time"
@@ -54,6 +55,14 @@ func (r *LockRing) SetSnapshot(servers []pb.ServerAddress, version int64) bool {
 		r.Unlock()
 		return false
 	}
+	// An unchanged member list is only a version refresh: installing it as a
+	// new snapshot would run the topology-change callback and restart the
+	// prior-owner window on every periodic rebroadcast.
+	if len(r.snapshots) > 0 && slices.Equal(servers, r.snapshots[0].servers) {
+		r.version = version
+		r.Unlock()
+		return true
+	}
 	r.version = version
 	// Update the ring while holding the lock so version and ring state
 	// are always consistent — prevents a concurrent SetSnapshot from
@@ -74,6 +83,19 @@ func (r *LockRing) SetSnapshot(servers []pb.ServerAddress, version int64) bool {
 	return true
 }
 
+// Reset clears only the version gate so the first update from a different
+// master always applies: ring versions are per-master monotonic, and a high
+// version accepted from a former leader must not reject the new leader's
+// view. The ring itself stays installed — writes keep routing to the last
+// known owner during the gap instead of every filer treating itself as the
+// owner, and the arriving snapshot transitions off it with the usual
+// prior-owner window.
+func (r *LockRing) Reset() {
+	r.Lock()
+	defer r.Unlock()
+	r.version = 0
+}
+
 // Version returns the current ring version.
 func (r *LockRing) Version() int64 {
 	r.RLock()
@@ -130,6 +152,17 @@ func (r *LockRing) GetSnapshot() (servers []pb.ServerAddress) {
 	return r.snapshots[0].servers
 }
 
+// PriorOwnerWindowEnd is when the latest ring change stops routing moved keys
+// to their prior owner.
+func (r *LockRing) PriorOwnerWindowEnd() time.Time {
+	r.RLock()
+	defer r.RUnlock()
+	if len(r.snapshots) == 0 {
+		return time.Time{}
+	}
+	return r.snapshots[0].ts.Add(r.snapshotInterval)
+}
+
 // WaitForCleanup waits for all pending cleanup operations to complete
 func (r *LockRing) WaitForCleanup() {
 	r.cleanupWg.Wait()
@@ -163,6 +196,24 @@ func (r *LockRing) GetPrimary(key string) pb.ServerAddress {
 func (r *LockRing) PriorOwner(key string) pb.ServerAddress {
 	r.RLock()
 	defer r.RUnlock()
+	return r.priorOwnerLocked(key)
+}
+
+// WriteOwner returns the filer that should serialize writes to key: the prior
+// owner while a ring change is still within the cooling-off window, otherwise
+// the current primary. Both are read under one lock so the pair cannot come
+// from different rings, which could otherwise name the same filer twice.
+func (r *LockRing) WriteOwner(key string) pb.ServerAddress {
+	r.RLock()
+	defer r.RUnlock()
+	if prior := r.priorOwnerLocked(key); prior != "" {
+		return prior
+	}
+	return r.Ring.GetPrimary(key)
+}
+
+// priorOwnerLocked is PriorOwner's body; the caller holds at least RLock.
+func (r *LockRing) priorOwnerLocked(key string) pb.ServerAddress {
 	if len(r.snapshots) < 2 {
 		return ""
 	}
diff --git a/weed/cluster/lock_manager/lock_ring_prior_test.go b/weed/cluster/lock_manager/lock_ring_prior_test.go
index 74bc0c6480..d07661fcc6 100644
--- a/weed/cluster/lock_manager/lock_ring_prior_test.go
+++ b/weed/cluster/lock_manager/lock_ring_prior_test.go
@@ -61,3 +61,42 @@ func TestLockRing_PriorOwnerExpires(t *testing.T) {
 		}
 	}
 }
+
+// WriteOwner resolves prior-else-current under one read lock, so the two views
+// can never come from different rings.
+func TestLockRing_WriteOwner(t *testing.T) {
+	r := NewLockRing(5 * time.Second)
+	t.Cleanup(r.WaitForCleanup)
+
+	setA := []pb.ServerAddress{"s1:1", "s2:1", "s3:1"}
+	r.SetSnapshot(setA, 1)
+
+	// One snapshot: no prior owner, so the primary owns every key.
+	if got, want := r.WriteOwner("any"), r.GetPrimary("any"); got != want {
+		t.Fatalf("WriteOwner=%q, want the primary %q", got, want)
+	}
+
+	r.SetSnapshot([]pb.ServerAddress{"s1:1", "s2:1", "s3:1", "s4:1"}, 2)
+
+	var moved, stable string
+	for i := 0; i < 2000 && (moved == "" || stable == ""); i++ {
+		key := fmt.Sprintf("key-%d", i)
+		if r.PriorOwner(key) != "" {
+			if moved == "" {
+				moved = key
+			}
+		} else if stable == "" {
+			stable = key
+		}
+	}
+	if moved == "" || stable == "" {
+		t.Skip("could not find both a moved and a stable key")
+	}
+
+	if got, want := r.WriteOwner(moved), r.PriorOwner(moved); got != want {
+		t.Fatalf("moved key: WriteOwner=%q, want the prior owner %q", got, want)
+	}
+	if got, want := r.WriteOwner(stable), r.GetPrimary(stable); got != want {
+		t.Fatalf("stable key: WriteOwner=%q, want the primary %q", got, want)
+	}
+}
diff --git a/weed/cluster/lock_manager/lock_ring_test.go b/weed/cluster/lock_manager/lock_ring_test.go
index 39c65c9daf..61da672329 100644
--- a/weed/cluster/lock_manager/lock_ring_test.go
+++ b/weed/cluster/lock_manager/lock_ring_test.go
@@ -96,3 +96,42 @@ func TestLockRing_VersionRejectsStale(t *testing.T) {
 	assert.True(t, ok)
 	assert.Equal(t, 1, len(r.GetSnapshot()))
 }
+
+func TestLockRing_SetSnapshotUnchangedOnlyBumpsVersion(t *testing.T) {
+	r := NewLockRing(100 * time.Millisecond)
+	callbacks := 0
+	r.SetTakeSnapshotCallback(func(snapshot []pb.ServerAddress) { callbacks++ })
+
+	assert.True(t, r.SetSnapshot([]pb.ServerAddress{"a:1", "b:2"}, 100))
+	assert.Equal(t, 1, callbacks)
+
+	// A periodic rebroadcast with the same members refreshes the version
+	// without a new snapshot or another topology-change callback.
+	assert.True(t, r.SetSnapshot([]pb.ServerAddress{"b:2", "a:1"}, 200))
+	assert.Equal(t, int64(200), r.Version())
+	assert.Equal(t, 1, r.GetSnapshotCount())
+	assert.Equal(t, 1, callbacks, "unchanged ring must not fire the topology callback")
+
+	assert.True(t, r.SetSnapshot([]pb.ServerAddress{"a:1", "b:2", "c:3"}, 300))
+	assert.Equal(t, 2, callbacks)
+}
+
+func TestLockRing_Reset(t *testing.T) {
+	r := NewLockRing(100 * time.Millisecond)
+
+	// A high version accepted from a former leader must not reject the new
+	// leader's view once the client has moved masters.
+	ok := r.SetSnapshot([]pb.ServerAddress{"a:1", "b:2"}, 100)
+	assert.True(t, ok)
+
+	r.Reset()
+	assert.Equal(t, int64(0), r.Version())
+	// The operational ring survives the reset: writes keep routing to the
+	// last known owner until the new leader's snapshot arrives.
+	assert.Equal(t, 2, len(r.GetSnapshot()))
+	assert.NotEqual(t, "", string(r.GetPrimary("key")))
+
+	ok = r.SetSnapshot([]pb.ServerAddress{"c:1"}, 50)
+	assert.True(t, ok, "lower version from a different master must apply after reset")
+	assert.Equal(t, 1, len(r.GetSnapshot()))
+}
diff --git a/weed/cluster/lock_ring_manager.go b/weed/cluster/lock_ring_manager.go
index 486e8b07a5..04577ac18b 100644
--- a/weed/cluster/lock_ring_manager.go
+++ b/weed/cluster/lock_ring_manager.go
@@ -7,33 +7,43 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"google.golang.org/protobuf/proto"
 )
 
 const LockRingStabilizationInterval = 1 * time.Second
 
+// LockRingRebroadcastInterval is how often the ring is re-sent even when
+// membership has not changed. Broadcasts are otherwise purely event-driven,
+// so a single lost or poisoned update would be permanent without this.
+const LockRingRebroadcastInterval = 30 * time.Second
+
 // LockRingManager tracks filer membership for the distributed lock ring.
 // It batches rapid topology changes (e.g., node drop + join) with a
 // stabilization timer, then broadcasts the complete member list atomically
 // so filers receive a single consistent ring update instead of multiple
 // intermediate states.
 type LockRingManager struct {
-	mu             sync.Mutex
-	members        map[FilerGroupName]map[pb.ServerAddress]struct{}
-	version        map[FilerGroupName]int64
-	lastBroadcast  map[FilerGroupName]*master_pb.LockRingUpdate
-	pendingTimer   map[FilerGroupName]*time.Timer
-	broadcastFn    func(resp *master_pb.KeepConnectedResponse)
-	stabilizeDelay time.Duration
+	mu                  sync.Mutex
+	members             map[FilerGroupName]map[pb.ServerAddress]struct{}
+	version             map[FilerGroupName]int64
+	lastBroadcast       map[FilerGroupName]*master_pb.LockRingUpdate
+	pendingTimer        map[FilerGroupName]*time.Timer
+	rebroadcastTimer    map[FilerGroupName]*time.Timer
+	broadcastFn         func(resp *master_pb.KeepConnectedResponse)
+	stabilizeDelay      time.Duration
+	rebroadcastInterval time.Duration
 }
 
 func NewLockRingManager(broadcastFn func(resp *master_pb.KeepConnectedResponse)) *LockRingManager {
 	return &LockRingManager{
-		members:        make(map[FilerGroupName]map[pb.ServerAddress]struct{}),
-		version:        make(map[FilerGroupName]int64),
-		lastBroadcast:  make(map[FilerGroupName]*master_pb.LockRingUpdate),
-		pendingTimer:   make(map[FilerGroupName]*time.Timer),
-		broadcastFn:    broadcastFn,
-		stabilizeDelay: LockRingStabilizationInterval,
+		members:             make(map[FilerGroupName]map[pb.ServerAddress]struct{}),
+		version:             make(map[FilerGroupName]int64),
+		lastBroadcast:       make(map[FilerGroupName]*master_pb.LockRingUpdate),
+		pendingTimer:        make(map[FilerGroupName]*time.Timer),
+		rebroadcastTimer:    make(map[FilerGroupName]*time.Timer),
+		broadcastFn:         broadcastFn,
+		stabilizeDelay:      LockRingStabilizationInterval,
+		rebroadcastInterval: LockRingRebroadcastInterval,
 	}
 }
 
@@ -93,9 +103,7 @@ func (lrm *LockRingManager) GetLastUpdate(filerGroup FilerGroupName) *master_pb.
 	if !ok || update == nil {
 		return nil
 	}
-	cp := *update
-	cp.Servers = append([]string(nil), update.Servers...)
-	return &cp
+	return proto.Clone(update).(*master_pb.LockRingUpdate)
 }
 
 // scheduleBroadcast resets the stabilization timer. If another change arrives
@@ -116,16 +124,64 @@ func (lrm *LockRingManager) scheduleBroadcast(filerGroup FilerGroupName) {
 
 func (lrm *LockRingManager) doBroadcast(filerGroup FilerGroupName) {
 	lrm.mu.Lock()
+	delete(lrm.pendingTimer, filerGroup)
+	lrm.mu.Unlock()
+	lrm.emit(filerGroup)
+}
+
+// rebroadcast re-sends the current ring unless a membership broadcast is
+// still stabilizing — emitting mid-window would publish an intermediate
+// topology that the pending timer immediately replaces. The check and the
+// update must sit in one critical section or a membership change can slip
+// a pending timer in between.
+func (lrm *LockRingManager) rebroadcast(filerGroup FilerGroupName) {
+	lrm.mu.Lock()
+	var update *master_pb.LockRingUpdate
+	if _, pending := lrm.pendingTimer[filerGroup]; !pending {
+		update = lrm.nextBroadcastUpdate(filerGroup)
+	}
+	lrm.mu.Unlock()
+	lrm.sendUpdate(filerGroup, update)
+}
+
+func (lrm *LockRingManager) emit(filerGroup FilerGroupName) {
+	lrm.mu.Lock()
+	update := lrm.nextBroadcastUpdate(filerGroup)
+	lrm.mu.Unlock()
+	lrm.sendUpdate(filerGroup, update)
+}
+
+func (lrm *LockRingManager) sendUpdate(filerGroup FilerGroupName, update *master_pb.LockRingUpdate) {
+	if update == nil {
+		return
+	}
+	glog.V(0).Infof("LockRing: broadcasting ring update for group %q version %d: %v", filerGroup, update.Version, update.Servers)
+	if lrm.broadcastFn != nil {
+		lrm.broadcastFn(&master_pb.KeepConnectedResponse{
+			LockRingUpdate: update,
+		})
+	}
+}
+
+// nextBroadcastUpdate stamps the current members into an update and re-arms
+// the periodic rebroadcast. It returns nil for an empty member list: an empty
+// lock ring is never usable, so a late "last member removed" event from a
+// former leader must not propagate and wedge every lock client. The last
+// non-empty broadcast stays in lastBroadcast for reconnecting clients.
+// Caller must hold lrm.mu.
+func (lrm *LockRingManager) nextBroadcastUpdate(filerGroup FilerGroupName) *master_pb.LockRingUpdate {
+	members := lrm.members[filerGroup]
+	if len(members) == 0 {
+		return nil
+	}
 	// Use wall-clock nanoseconds so the version survives master restarts
 	// without persistence — a restarted master produces a version greater
 	// than any pre-restart value (assuming clocks don't jump backward).
 	version := time.Now().UnixNano()
 	lrm.version[filerGroup] = version
-	servers := make([]string, 0)
-	if members, ok := lrm.members[filerGroup]; ok {
-		for addr := range members {
-			servers = append(servers, string(addr))
-		}
+	servers := make([]string, 0, len(members))
+	for addr := range members {
+		servers = append(servers, string(addr))
 	}
 	update := &master_pb.LockRingUpdate{
 		FilerGroup: string(filerGroup),
@@ -133,16 +189,13 @@ func (lrm *LockRingManager) doBroadcast(filerGroup FilerGroupName) {
 		Version:    version,
 	}
 	lrm.lastBroadcast[filerGroup] = update
-	delete(lrm.pendingTimer, filerGroup)
-	lrm.mu.Unlock()
-
-	glog.V(0).Infof("LockRing: broadcasting ring update for group %q version %d: %v", filerGroup, version, servers)
-
-	if lrm.broadcastFn != nil {
-		lrm.broadcastFn(&master_pb.KeepConnectedResponse{
-			LockRingUpdate: update,
-		})
+	if timer, ok := lrm.rebroadcastTimer[filerGroup]; ok {
+		timer.Stop()
 	}
+	lrm.rebroadcastTimer[filerGroup] = time.AfterFunc(lrm.rebroadcastInterval, func() {
+		lrm.rebroadcast(filerGroup)
+	})
+	return update
 }
 
 // FlushPending fires any pending timer immediately (for testing or shutdown).
diff --git a/weed/cluster/lock_ring_manager_test.go b/weed/cluster/lock_ring_manager_test.go
index 981d13d9c8..91fcdb98e4 100644
--- a/weed/cluster/lock_ring_manager_test.go
+++ b/weed/cluster/lock_ring_manager_test.go
@@ -213,6 +213,111 @@ func TestLockRingManager_NoBroadcastWithoutFn(t *testing.T) {
 	time.Sleep(50 * time.Millisecond) // should not panic
 }
 
+func TestLockRingManager_EmptyRingNotBroadcast(t *testing.T) {
+	var mu sync.Mutex
+	var broadcasts []*master_pb.LockRingUpdate
+
+	lrm := NewLockRingManager(func(resp *master_pb.KeepConnectedResponse) {
+		mu.Lock()
+		if resp.LockRingUpdate != nil {
+			broadcasts = append(broadcasts, resp.LockRingUpdate)
+		}
+		mu.Unlock()
+	})
+	lrm.stabilizeDelay = 50 * time.Millisecond
+
+	group := FilerGroupName("default")
+
+	lrm.AddServer(group, "filer1:8888")
+	lrm.FlushPending(group)
+
+	mu.Lock()
+	broadcasts = nil
+	mu.Unlock()
+
+	// Removing the last member must not propagate an empty ring.
+	lrm.RemoveServer(group, "filer1:8888")
+	time.Sleep(100 * time.Millisecond)
+
+	mu.Lock()
+	assert.Equal(t, 0, len(broadcasts), "empty ring must not be broadcast")
+	mu.Unlock()
+
+	// The last non-empty snapshot is still served to reconnecting clients.
+	update := lrm.GetLastUpdate(group)
+	require.NotNil(t, update)
+	assert.Equal(t, []string{"filer1:8888"}, update.Servers)
+}
+
+func TestLockRingManager_PeriodicRebroadcast(t *testing.T) {
+	var mu sync.Mutex
+	var broadcasts []*master_pb.LockRingUpdate
+
+	lrm := NewLockRingManager(func(resp *master_pb.KeepConnectedResponse) {
+		mu.Lock()
+		if resp.LockRingUpdate != nil {
+			broadcasts = append(broadcasts, resp.LockRingUpdate)
+		}
+		mu.Unlock()
+	})
+	lrm.stabilizeDelay = 20 * time.Millisecond
+	lrm.rebroadcastInterval = 60 * time.Millisecond
+
+	group := FilerGroupName("default")
+	lrm.AddServer(group, "filer1:8888")
+
+	// Without any further membership change, the ring keeps being re-sent so
+	// a lost or poisoned update cannot be permanent.
+	time.Sleep(200 * time.Millisecond)
+
+	mu.Lock()
+	require.GreaterOrEqual(t, len(broadcasts), 2, "ring should rebroadcast periodically")
+	for i := 1; i < len(broadcasts); i++ {
+		assert.Greater(t, broadcasts[i].Version, broadcasts[i-1].Version)
+	}
+	mu.Unlock()
+}
+
+func TestLockRingManager_RebroadcastDefersToPendingStabilization(t *testing.T) {
+	var mu sync.Mutex
+	var broadcasts []*master_pb.LockRingUpdate
+
+	lrm := NewLockRingManager(func(resp *master_pb.KeepConnectedResponse) {
+		mu.Lock()
+		if resp.LockRingUpdate != nil {
+			broadcasts = append(broadcasts, resp.LockRingUpdate)
+		}
+		mu.Unlock()
+	})
+	lrm.stabilizeDelay = 100 * time.Millisecond
+	lrm.rebroadcastInterval = 30 * time.Millisecond
+
+	group := FilerGroupName("default")
+	lrm.AddServer(group, "filer1:8888")
+	lrm.FlushPending(group)
+
+	mu.Lock()
+	require.Len(t, broadcasts, 1)
+	mu.Unlock()
+
+	// A membership change just before the periodic tick: the rebroadcast must
+	// not publish the unsettled ring ahead of the stabilization timer.
+	lrm.RemoveServer(group, "filer1:8888")
+	lrm.AddServer(group, "filer2:8888")
+	time.Sleep(2 * lrm.rebroadcastInterval)
+
+	mu.Lock()
+	assert.Len(t, broadcasts, 1, "rebroadcast during stabilization should be deferred")
+	mu.Unlock()
+
+	time.Sleep(2 * lrm.stabilizeDelay)
+
+	mu.Lock()
+	require.GreaterOrEqual(t, len(broadcasts), 2)
+	assert.Equal(t, []string{"filer2:8888"}, broadcasts[1].Servers)
+	mu.Unlock()
+}
+
 func TestLockRingManager_GetLastUpdateReturnsBroadcastState(t *testing.T) {
 	lrm := NewLockRingManager(nil)
 
diff --git a/weed/cluster/master_client.go b/weed/cluster/master_client.go
index ba0ed4f3d1..70a391712b 100644
--- a/weed/cluster/master_client.go
+++ b/weed/cluster/master_client.go
@@ -10,10 +10,13 @@ import (
 	"google.golang.org/grpc"
 )
 
-func ListExistingPeerUpdates(master pb.ServerAddress, grpcDialOption grpc.DialOption, filerGroup string, clientType string) (existingNodes []*master_pb.ClusterNodeUpdate) {
+// ListExistingPeerUpdates lists the cluster nodes one master currently tracks.
+// An empty result is only a successful empty answer; a failed RPC returns the
+// error so callers do not mistake "unknown" for "absent".
+func ListExistingPeerUpdates(ctx context.Context, master pb.ServerAddress, grpcDialOption grpc.DialOption, filerGroup string, clientType string) (existingNodes []*master_pb.ClusterNodeUpdate, err error) {
 
-	if grpcErr := pb.WithMasterClient(context.Background(), false, master, grpcDialOption, false, func(client master_pb.SeaweedClient) error {
-		resp, err := client.ListClusterNodes(context.Background(), &master_pb.ListClusterNodesRequest{
+	err = pb.WithMasterClient(ctx, false, master, grpcDialOption, false, func(client master_pb.SeaweedClient) error {
+		resp, err := client.ListClusterNodes(ctx, &master_pb.ListClusterNodesRequest{
 			ClientType: clientType,
 			FilerGroup: filerGroup,
 		})
@@ -31,8 +34,24 @@ func ListExistingPeerUpdates(master pb.ServerAddress, grpcDialOption grpc.DialOp
 			})
 		}
 		return nil
-	}); grpcErr != nil {
-		glog.V(0).Infof("connect to %s: %v", master, grpcErr)
+	})
+	if err != nil {
+		glog.V(0).Infof("connect to %s: %v", master, err)
 	}
 	return
 }
+
+// LookupClusterLeader asks one master for the raft leader it currently sees.
+// Any reachable master answers, including followers; it returns "" while the
+// cluster is mid-election.
+func LookupClusterLeader(ctx context.Context, master pb.ServerAddress, grpcDialOption grpc.DialOption) (leader pb.ServerAddress, err error) {
+	err = pb.WithMasterClient(ctx, false, master, grpcDialOption, false, func(client master_pb.SeaweedClient) error {
+		resp, err := client.GetMasterConfiguration(ctx, &master_pb.GetMasterConfigurationRequest{})
+		if err != nil {
+			return err
+		}
+		leader = pb.ServerAddress(resp.Leader)
+		return nil
+	})
+	return
+}
diff --git a/weed/command/admin.go b/weed/command/admin.go
index 910848cdd4..a4844f1b8f 100644
--- a/weed/command/admin.go
+++ b/weed/command/admin.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/tls"
+	"errors"
 	"fmt"
 	"log"
 	"net"
@@ -42,6 +43,8 @@ var (
 type AdminOptions struct {
 	port             *int
 	grpcPort         *int
+	legacyPort       *int
+	ip               *string
 	master           *string
 	masters          *string // deprecated, for backward compatibility
 	filerGroup       *string
@@ -49,21 +52,60 @@ type AdminOptions struct {
 	adminPassword    *string
 	readOnlyUser     *string
 	readOnlyPassword *string
-	dataDir          *string
-	icebergPort      *int
-	urlPrefix        *string
-	metricsHttpPort  *int
-	metricsHttpIp    *string
-	debug            *bool
-	debugPort        *int
-	cpuProfile       *string
-	memProfile       *string
+	// nil for callers other than runAdmin (e.g. `weed mini`)
+	allowInsecureBind *bool
+	dataDir           *string
+	icebergPort       *int
+	lancePort         *int
+	urlPrefix         *string
+	metricsHttpPort   *int
+	metricsHttpIp     *string
+	debug             *bool
+	debugPort         *int
+	cpuProfile        *string
+	memProfile        *string
+
+	// workerGrpcListener, when set, is a listener already bound to grpcPort by
+	// the caller. `weed mini` reserves the port this way because the admin
+	// binds it only after every other service is up.
+	workerGrpcListener net.Listener
+
+	// workerGrpcLegacyListener is the same reservation for the legacy
+	// compat gRPC port. Its bind failure is tolerated: the legacy port lives
+	// in the ephemeral range, so best-effort compat must not take startup down.
+	workerGrpcLegacyListener net.Listener
+
+	// workerGrpcLegacySkip disables just the legacy gRPC listener. `weed
+	// mini` sets it when another mini service already owns the legacy gRPC
+	// port, so the compat bind can neither steal the port nor warn about a
+	// failure that is expected.
+	workerGrpcLegacySkip bool
+
+	// adminHttpLegacySkip is the same for the legacy HTTP port. Skipping
+	// matters even when the bind would succeed: a service bound on a
+	// different address family or wildcard can leave loopback free, and the
+	// compat listener would then shadow it for loopback clients.
+	adminHttpLegacySkip bool
+
+	// workerGrpcBindIp, when non-empty, is the address the worker gRPC
+	// listener binds to. It is separate from ip because the worker gRPC has
+	// no password auth (its mTLS comes from grpc.admin, not https.admin), so
+	// it must not follow ip's auto-upgrade to 0.0.0.0 based on adminPassword.
+	// `weed mini` leaves it empty to fall back to ip.
+	workerGrpcBindIp string
+
+	// defaultS3PublicEndpoint, when set, is used for object URLs when
+	// s3.public_endpoint is not configured. `weed mini` sets it to its own
+	// S3 address.
+	defaultS3PublicEndpoint string
 }
 
 func init() {
 	cmdAdmin.Run = runAdmin // break init cycle
-	a.port = cmdAdmin.Flag.Int("port", 23646, "admin server port")
+	a.port = cmdAdmin.Flag.Int("port", defaultAdminHTTPPort, "admin server port")
 	a.grpcPort = cmdAdmin.Flag.Int("port.grpc", 0, "gRPC server port for worker connections (default: http port + 10000)")
+	a.legacyPort = cmdAdmin.Flag.Int("port.legacy", defaultAdminHTTPLegacyPort, "also serve admin http and gRPC (port + 10000) on this port for backward compatibility (0 to disable)")
+	a.ip = cmdAdmin.Flag.String("ip", "127.0.0.1", "ip address to listen on. Defaults to loopback when auth is disabled, or 0.0.0.0 when -adminPassword or [https.admin] mTLS is configured. Set explicitly to override.")
 	a.master = cmdAdmin.Flag.String("master", "localhost:9333", "comma-separated master servers")
 	a.masters = cmdAdmin.Flag.String("masters", "", "comma-separated master servers (deprecated, use -master instead)")
 	a.filerGroup = cmdAdmin.Flag.String("filerGroup", "", "filerGroup for the filers, brokers, and S3 servers")
@@ -73,7 +115,9 @@ func init() {
 	a.adminPassword = cmdAdmin.Flag.String("adminPassword", "", "admin interface password (if empty, auth is disabled)")
 	a.readOnlyUser = cmdAdmin.Flag.String("readOnlyUser", "", "read-only user username (optional, for view-only access)")
 	a.readOnlyPassword = cmdAdmin.Flag.String("readOnlyPassword", "", "read-only user password (optional, for view-only access; requires adminPassword to be set)")
+	a.allowInsecureBind = cmdAdmin.Flag.Bool("allowInsecureBind", false, "INSECURE: allow binding a non-loopback ip without adminPassword or mTLS, exposing the admin API unauthenticated on the network")
 	a.icebergPort = cmdAdmin.Flag.Int("iceberg.port", 8181, "Iceberg REST Catalog port (0 to hide in UI)")
+	a.lancePort = cmdAdmin.Flag.Int("lance.port", 9101, "Lance Namespace port (0 to hide in UI)")
 	a.urlPrefix = cmdAdmin.Flag.String("urlPrefix", "", "URL path prefix when running behind a reverse proxy under a subdirectory (e.g. /seaweedfs)")
 	a.metricsHttpPort = cmdAdmin.Flag.Int("metricsPort", 0, "Prometheus metrics listen port")
 	a.metricsHttpIp = cmdAdmin.Flag.String("metricsIp", "", "metrics listen ip. If empty, listens on all interfaces.")
@@ -84,7 +128,7 @@ func init() {
 }
 
 var cmdAdmin = &Command{
-	UsageLine: "admin -port=23646 -master=localhost:9333 [-filerGroup=group] [-port.grpc=33646] [-dataDir=/path/to/data]",
+	UsageLine: "admin -port=12535 -master=localhost:9333 [-filerGroup=group] [-port.grpc=22535] [-dataDir=/path/to/data]",
 	Short:     "start SeaweedFS web admin interface",
 	Long: `Start a web admin interface for SeaweedFS cluster management.
 
@@ -100,12 +144,12 @@ var cmdAdmin = &Command{
   A gRPC server for worker connections runs on the configured gRPC port (default: HTTP port + 10000).
 
   Example Usage:
-    weed admin -port=23646 -master="master1:9333,master2:9333"
-    weed admin -port=23646 -master="localhost:9333" -filerGroup="tenant-a"
-    weed admin -port=23646 -master="localhost:9333" -dataDir="/var/lib/seaweedfs-admin"
-    weed admin -port=23646 -port.grpc=33646 -master="localhost:9333" -dataDir="~/seaweedfs-admin"
+    weed admin -port=12535 -master="master1:9333,master2:9333"
+    weed admin -port=12535 -master="localhost:9333" -filerGroup="tenant-a"
+    weed admin -port=12535 -master="localhost:9333" -dataDir="/var/lib/seaweedfs-admin"
+    weed admin -port=12535 -port.grpc=22535 -master="localhost:9333" -dataDir="~/seaweedfs-admin"
     weed admin -port=9900 -port.grpc=19900 -master="localhost:9333"
-    weed admin -port=23646 -master="localhost:9333" -urlPrefix="/seaweedfs"
+    weed admin -port=12535 -master="localhost:9333" -urlPrefix="/seaweedfs"
 
   Data Directory:
     - If dataDir is specified, admin configuration and maintenance data is persisted
@@ -125,6 +169,17 @@ var cmdAdmin = &Command{
       WEED_ADMIN_USER, WEED_ADMIN_PASSWORD, WEED_ADMIN_READONLY_USER, WEED_ADMIN_READONLY_PASSWORD
     - Precedence: CLI flag > env var / security.toml > default value
 
+  Network Binding:
+    - When authentication is disabled, the admin server binds to 127.0.0.1
+      (loopback only) so the unauthenticated API is never exposed on the network.
+    - When -adminPassword or [https.admin] mTLS is configured, the default
+      upgrades to 0.0.0.0 (all interfaces) so authenticated deployments stay
+      reachable from the network without an explicit -ip flag.
+    - Set -ip explicitly to override either default.
+    - Binding a non-loopback address with authentication disabled (no
+      -adminPassword and no mTLS) is refused unless -allowInsecureBind is set
+      (INSECURE; only for trusted isolated networks).
+
   Security Configuration:
     - The admin server reads TLS configuration from security.toml
     - Configure [https.admin] section in security.toml for HTTPS support
@@ -175,8 +230,9 @@ var cmdAdmin = &Command{
     - Example: weed admin -metricsPort=9327 -master="localhost:9333"
 
   Maintenance Configuration:
-    - An optional admin.toml declares maintenance task settings
-      ([maintenance.vacuum], [maintenance.balance], [maintenance.erasure_coding])
+    - An optional admin.toml declares maintenance settings ([maintenance]
+      to toggle the whole system, plus per-task [maintenance.vacuum],
+      [maintenance.balance], [maintenance.erasure_coding])
     - Settings in admin.toml are applied at every startup, overriding values
       saved from the admin UI, so they can be managed declaratively
     - Requires -dataDir; values can also be set via WEED_* environment
@@ -259,13 +315,64 @@ func runAdmin(cmd *Command, args []string) bool {
 	if *a.grpcPort == 0 {
 		*a.grpcPort = *a.port + 10000
 	}
+	if *a.grpcPort >= linuxEphemeralPortFloor {
+		glog.Warningf("Admin gRPC port %d is at or above the Linux ephemeral floor %d; an outbound connection may claim it before Admin binds it. Pick a lower -port.", *a.grpcPort, linuxEphemeralPortFloor)
+	}
+
+	hasMTLS := viper.GetString("https.admin.key") != "" && viper.GetString("https.admin.ca") != ""
+
+	// The worker gRPC control plane has no password auth (its mTLS comes from
+	// grpc.admin, separate from https.admin), so its bind address must not
+	// follow the HTTP auto-upgrade below. Capture the raw -ip value first;
+	// the worker gRPC stays on loopback unless the operator sets -ip
+	// explicitly, matching the pre-existing behavior.
+	a.workerGrpcBindIp = *a.ip
+
+	// -ip defaults to loopback so an unauthenticated admin API is never
+	// exposed on the network by accident. An authenticated deployment
+	// (adminPassword or mTLS) is safe to reach from the network, so upgrade
+	// the default to 0.0.0.0 and keep existing deployments reachable after
+	// upgrade without forcing a -ip=0.0.0.0 config change. An operator who
+	// explicitly set -ip is left alone.
+	if !isFlagExplicitlySet(cmd, "ip") && (*a.adminPassword != "" || hasMTLS) {
+		*a.ip = "0.0.0.0"
+	}
+
+	// Security validation: refuse to bind a non-loopback address without
+	// authentication or mTLS. This prevents accidental exposure of the
+	// unauthenticated admin REST API on the network. Server-only TLS
+	// (https.admin.key without ca) encrypts transport but does not authenticate
+	// clients, so it is not sufficient — the operator must also set a password
+	// or configure mTLS (both key and ca).
+	// -allowInsecureBind opts out of this check for operators who knowingly
+	// keep the pre-existing unauthenticated setup.
+	insecureAllowed := a.allowInsecureBind != nil && *a.allowInsecureBind
+	if !isLoopbackIp(*a.ip) && *a.adminPassword == "" && !hasMTLS {
+		if !insecureAllowed {
+			fmt.Printf("Error: the admin server is configured to bind to %s (non-loopback) with\n", *a.ip)
+			fmt.Printf("       authentication disabled. This would expose the admin API unauthenticated\n")
+			fmt.Printf("       on the network.\n")
+			fmt.Printf("       To fix this, either:\n")
+			fmt.Printf("         - set -adminPassword to enable authentication, or\n")
+			fmt.Printf("         - configure [https.admin] key and ca in security.toml for mTLS, or\n")
+			fmt.Printf("         - set -ip=127.0.0.1 to bind to loopback only, or\n")
+			fmt.Printf("         - set -allowInsecureBind to start anyway (INSECURE).\n")
+			return false
+		}
+		fmt.Printf("WARNING: -allowInsecureBind is set: the admin API is exposed on %s without\n", *a.ip)
+		fmt.Printf("         authentication. Anyone who can reach this address has full control\n")
+		fmt.Printf("         of the cluster. Set -adminPassword or configure mTLS instead.\n")
+	}
 
 	// Security warnings
-	if *a.adminPassword == "" {
+	if *a.adminPassword == "" && isLoopbackIp(*a.ip) {
 		fmt.Println("WARNING: Admin interface is running without authentication!")
 		fmt.Println("         Set -adminPassword for production use")
 	}
-	fmt.Printf("Starting SeaweedFS Admin Interface on port %d\n", *a.port)
+	fmt.Printf("Starting SeaweedFS Admin Interface on %s\n", util.JoinHostPort(*a.ip, *a.port))
+	if isLoopbackIp(*a.ip) {
+		fmt.Printf("  (loopback only; not reachable from other hosts. Set -ip=0.0.0.0 with -adminPassword or mTLS to expose.)\n")
+	}
 	fmt.Printf("Worker gRPC server will run on port %d\n", *a.grpcPort)
 	fmt.Printf("Masters: %s\n", *a.master)
 	fmt.Printf("Filers will be discovered automatically from masters\n")
@@ -314,7 +421,7 @@ func runAdmin(cmd *Command, args []string) bool {
 	}
 
 	// Start the admin server with all masters (UI enabled by default)
-	err := startAdminServer(ctx, a, true, *a.icebergPort, urlPrefix)
+	err := startAdminServer(ctx, a, true, *a.icebergPort, *a.lancePort, urlPrefix)
 	if err != nil {
 		fmt.Printf("Admin server error: %v\n", err)
 		return false
@@ -325,7 +432,7 @@ func runAdmin(cmd *Command, args []string) bool {
 }
 
 // startAdminServer starts the actual admin server
-func startAdminServer(ctx context.Context, options AdminOptions, enableUI bool, icebergPort int, urlPrefix string) error {
+func startAdminServer(ctx context.Context, options AdminOptions, enableUI bool, icebergPort, lancePort int, urlPrefix string) error {
 	// Create router
 	r := mux.NewRouter()
 	r.Use(loggingMiddleware)
@@ -388,7 +495,11 @@ func startAdminServer(ctx context.Context, options AdminOptions, enableUI bool,
 	r.PathPrefix("/static/").Handler(http.StripPrefix("/static/", admin.StaticHandler()))
 
 	// Create admin server (plugin is always enabled)
-	adminServer := dash.NewAdminServer(*options.master, *options.filerGroup, nil, dataDir, icebergPort)
+	s3PublicEndpoint := util.GetViper().GetString("s3.public_endpoint")
+	if s3PublicEndpoint == "" {
+		s3PublicEndpoint = options.defaultS3PublicEndpoint
+	}
+	adminServer := dash.NewAdminServer(*options.master, *options.filerGroup, nil, dataDir, icebergPort, lancePort, s3PublicEndpoint)
 
 	if err := adminServer.ApplyPluginConfigFromToml(util.GetViper()); err != nil {
 		return fmt.Errorf("apply admin.toml to plugin config: %w", err)
@@ -402,11 +513,44 @@ func startAdminServer(ctx context.Context, options AdminOptions, enableUI bool,
 		glog.Infof("No filers discovered from masters")
 	}
 
-	// Start worker gRPC server for worker connections
-	err = adminServer.StartWorkerGrpcServer(*options.grpcPort)
+	// Start worker gRPC server for worker connections. The worker gRPC binds
+	// to its own address (workerGrpcBindIp) which, unlike the HTTP ip, does
+	// not auto-upgrade to 0.0.0.0 based on adminPassword, since the worker
+	// gRPC has no password auth.
+	workerGrpcIp := options.workerGrpcBindIp
+	if workerGrpcIp == "" {
+		workerGrpcIp = *options.ip
+	}
+	err = adminServer.StartWorkerGrpcServer(workerGrpcIp, *options.grpcPort, options.workerGrpcListener)
 	if err != nil {
 		return fmt.Errorf("failed to start worker gRPC server: %w", err)
 	}
+	warnInsecureWorkerGrpcBind(workerGrpcIp, *options.grpcPort, adminServer.WorkerGrpcMTLSEnabled())
+
+	// Legacy compat listeners keep the previous default admin port reachable
+	// for old workers, bookmarks and scripts while the deployment moves to the
+	// new default. Best-effort only: the legacy gRPC port sits inside the
+	// Linux ephemeral range, so it may already be taken and must never fail
+	// startup.
+	legacyPort := 0
+	if options.legacyPort != nil && *options.legacyPort > 0 && *options.legacyPort != *options.port {
+		legacyPort = *options.legacyPort
+	}
+	if legacyPort > 0 && !options.workerGrpcLegacySkip {
+		legacyGrpcPort := legacyPort + GrpcPortOffset
+		legacyGrpcListener := options.workerGrpcLegacyListener
+		if legacyGrpcListener == nil {
+			if l, listenErr := net.Listen("tcp", util.JoinHostPort(workerGrpcIp, legacyGrpcPort)); listenErr == nil {
+				legacyGrpcListener = l
+			} else {
+				glog.Warningf("Legacy admin gRPC port %d unavailable, skipping compat listener: %v", legacyGrpcPort, listenErr)
+			}
+		}
+		if legacyGrpcListener != nil {
+			adminServer.ServeWorkerGrpcOn(legacyGrpcListener)
+			glog.Infof("Worker gRPC compat listener on %s", legacyGrpcListener.Addr())
+		}
+	}
 
 	// Set up cleanup for gRPC server
 	defer func() {
@@ -421,7 +565,7 @@ func startAdminServer(ctx context.Context, options AdminOptions, enableUI bool,
 	adminHandlers.SetupRoutes(r, authRequired, *options.adminUser, *options.adminPassword, *options.readOnlyUser, *options.readOnlyPassword, enableUI)
 
 	// Server configuration
-	addr := fmt.Sprintf(":%d", *options.port)
+	addr := util.JoinHostPort(*options.ip, *options.port)
 	var handler http.Handler = r
 	if urlPrefix != "" {
 		stripped := http.StripPrefix(urlPrefix, r)
@@ -482,16 +626,53 @@ func startAdminServer(ctx context.Context, options AdminOptions, enableUI bool,
 		server.TLSConfig.GetCertificate = getCert
 	}
 
+	// Serve the same handler on the legacy port so old clients keep working.
+	// Best-effort like the gRPC compat listener above.
+	var legacyServer *http.Server
+	if legacyPort > 0 && !options.adminHttpLegacySkip {
+		legacyAddr := util.JoinHostPort(*options.ip, legacyPort)
+		if legacyListener, listenErr := net.Listen("tcp", legacyAddr); listenErr != nil {
+			glog.Warningf("Legacy admin HTTP port %d unavailable, skipping compat listener: %v", legacyPort, listenErr)
+		} else {
+			legacyServer = &http.Server{
+				Addr:      legacyAddr,
+				Handler:   server.Handler,
+				TLSConfig: server.TLSConfig,
+			}
+			// Close on every exit path so a failed primary startup cannot
+			// leave the compat port held by a zombie admin. On the normal
+			// path the graceful Shutdown below runs first; this Close then
+			// no-ops. Close the raw listener too: Serve may not have
+			// registered it with legacyServer yet when this runs.
+			defer func() {
+				_ = legacyListener.Close()
+				_ = legacyServer.Close()
+			}()
+			go func() {
+				glog.Infof("Admin compat listener on %s", legacyAddr)
+				var serveErr error
+				if useTLS {
+					serveErr = legacyServer.ServeTLS(legacyListener, "", "")
+				} else {
+					serveErr = legacyServer.Serve(legacyListener)
+				}
+				if serveErr != nil && serveErr != http.ErrServerClosed && !errors.Is(serveErr, net.ErrClosed) {
+					glog.Warningf("Admin compat listener on %s stopped: %v", legacyAddr, serveErr)
+				}
+			}()
+		}
+	}
+
 	// Start server. Surface immediate failures (e.g. bind error) via
 	// serveErrCh so the caller doesn't block on ctx.Done() while no server
 	// is actually listening. http.ErrServerClosed after Shutdown is normal
 	// and not forwarded.
 	serveErrCh := make(chan error, 1)
 	go func() {
-		glog.Infof("Starting SeaweedFS Admin Server on port %d", *options.port)
+		glog.Infof("Starting SeaweedFS Admin Server on %s", addr)
 		var serveErr error
 		if useTLS {
-			glog.Infof("Starting SeaweedFS Admin Server with TLS on port %d", *options.port)
+			glog.Infof("Starting SeaweedFS Admin Server with TLS on %s", addr)
 			serveErr = server.ListenAndServeTLS("", "")
 		} else {
 			serveErr = server.ListenAndServe()
@@ -516,6 +697,9 @@ func startAdminServer(ctx context.Context, options AdminOptions, enableUI bool,
 	if err := server.Shutdown(shutdownCtx); err != nil {
 		return fmt.Errorf("admin server forced to shutdown: %w", err)
 	}
+	if legacyServer != nil {
+		_ = legacyServer.Shutdown(shutdownCtx)
+	}
 
 	adminServer.Shutdown()
 
@@ -670,18 +854,56 @@ func loadOrGenerateSessionKeys(dataDir string) ([]byte, []byte, error) {
 	return key[:keyLen], key[keyLen:], nil
 }
 
+// isFlagExplicitlySet reports whether the named flag was passed on the
+// command line (as opposed to left at its default).
+func isFlagExplicitlySet(cmd *Command, flagName string) bool {
+	set := false
+	cmd.Flag.Visit(func(f *flag.Flag) {
+		if f.Name == flagName {
+			set = true
+		}
+	})
+	return set
+}
+
 // applyViperFallback sets a flag's value from viper (security.toml / env var)
 // when the flag was not explicitly set on the command line.
 func applyViperFallback(cmd *Command, flagPtr *string, flagName, viperKey string) {
-	explicitlySet := false
-	cmd.Flag.Visit(func(f *flag.Flag) {
-		if f.Name == flagName {
-			explicitlySet = true
-		}
-	})
-	if !explicitlySet {
-		if v := util.GetViper().GetString(viperKey); v != "" {
-			*flagPtr = v
-		}
+	if isFlagExplicitlySet(cmd, flagName) {
+		return
+	}
+	if v := util.GetViper().GetString(viperKey); v != "" {
+		*flagPtr = v
 	}
 }
+
+// isLoopbackIp reports whether the given bind address is loopback.
+// An empty string or "0.0.0.0" / "::" is treated as non-loopback (all
+// interfaces), since those expose the server to the network.
+func isLoopbackIp(ip string) bool {
+	if ip == "" {
+		return false
+	}
+	parsed := net.ParseIP(ip)
+	if parsed == nil {
+		// Unresolved hostname — treat as non-loopback to be safe.
+		return false
+	}
+	return parsed.IsLoopback()
+}
+
+// warnInsecureWorkerGrpcBind warns when the worker gRPC control plane is
+// reachable off loopback without grpc.admin mTLS, its only auth once exposed.
+// mtlsEnabled reflects whether the worker gRPC actually loaded mTLS, so a
+// misconfigured cert/key that fails to load still triggers the warning.
+func warnInsecureWorkerGrpcBind(ip string, grpcPort int, mtlsEnabled bool) {
+	if isLoopbackIp(ip) {
+		return
+	}
+	if mtlsEnabled {
+		return
+	}
+	glog.Warningf("Worker gRPC control plane is bound to %s (non-loopback) without grpc.admin mTLS.", ip)
+	glog.Warningf("Anyone who can reach port %d can register a maintenance worker unauthenticated.", grpcPort)
+	glog.Warningf("Enable [grpc.admin] cert/key and [grpc.ca] in security.toml, or bind to loopback.")
+}
diff --git a/weed/command/backup.go b/weed/command/backup.go
index 4778ae961e..cfeabcde28 100644
--- a/weed/command/backup.go
+++ b/weed/command/backup.go
@@ -156,7 +156,7 @@ func backupFromLocation(volumeServer pb.ServerAddress, grpcDialOption grpc.DialO
 
 	// If local volume is larger than remote, recreate it
 	if datSize > stats.TailOffset {
-		if err := v.Destroy(false, false); err != nil {
+		if err := v.Destroy(false, false, false); err != nil {
 			v.Close()
 			return fmt.Errorf("destroying volume: %w", err), false
 		}
diff --git a/weed/command/benchmark.go b/weed/command/benchmark.go
index ad0dbadc4c..0ee3f03136 100644
--- a/weed/command/benchmark.go
+++ b/weed/command/benchmark.go
@@ -238,7 +238,7 @@ func writeFiles(idChan chan int, fileIdLineChan chan string, s *stat) {
 				}
 				var jwtAuthorization security.EncodedJwt
 				if isSecure {
-					jwtAuthorization = operation.LookupJwt(b.masterClient.GetMaster(context.Background()), b.grpcDialOption, df.fp.Fid)
+					jwtAuthorization = operation.LookupJwt(context.Background(), b.masterClient.GetMaster(context.Background()), b.grpcDialOption, df.fp.Fid)
 				}
 				if e := util_http.Delete(fmt.Sprintf("http://%s/%s", df.fp.Server, df.fp.Fid), string(jwtAuthorization)); e == nil {
 					s.completed++
diff --git a/weed/command/command.go b/weed/command/command.go
index daa3823a10..2370ad81af 100644
--- a/weed/command/command.go
+++ b/weed/command/command.go
@@ -32,6 +32,7 @@ var Commands = []*Command{
 	cmdFix,
 	cmdFuse,
 	cmdIam,
+	cmdImage,
 	cmdMaster,
 	cmdMasterFollower,
 	cmdMini,
@@ -97,3 +98,17 @@ func (c *Command) Usage() {
 func (c *Command) Runnable() bool {
 	return c.Run != nil
 }
+
+// Recorded, not os.Exit'ed, so the failure still travels through main's
+// shutdown path. The highest requested status wins.
+var commandExitStatus int
+
+func SetCommandExitStatus(n int) {
+	if n > commandExitStatus {
+		commandExitStatus = n
+	}
+}
+
+func CommandExitStatus() int {
+	return commandExitStatus
+}
diff --git a/weed/command/filer.go b/weed/command/filer.go
index a15075abbd..5be17a26af 100644
--- a/weed/command/filer.go
+++ b/weed/command/filer.go
@@ -5,7 +5,6 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"fmt"
-	"net"
 	"net/http"
 	"os"
 	"runtime"
@@ -23,6 +22,7 @@ import (
 	_ "github.com/seaweedfs/seaweedfs/weed/credential/postgres"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
@@ -46,6 +46,19 @@ var (
 	filerSftpOptions   SftpOptions
 )
 
+// allowUntrustedRemoteEndpointsUsage documents the flag shared by the filer and
+// S3 gateway, whose remote-mount read paths dial the mounted endpoint directly.
+const allowUntrustedRemoteEndpointsUsage = "if true, a read of a remote-only entry accepts arbitrary remote S3 endpoints including loopback / link-local hosts. Default rejects internal / metadata endpoints."
+
+// iamSelfServiceRequiresGrantUsage documents the flag shared by every command
+// that runs the embedded IAM API.
+const iamSelfServiceRequiresGrantUsage = "if true, an identity needs an explicit iam: grant to manage its own access keys (CreateAccessKey, DeleteAccessKey, UpdateAccessKey, ListAccessKeys, GetUser), as on AWS. Default allows it to every authenticated identity."
+
+// allowBackslashInKeyUsage documents the S3 flag keeping '\' a literal
+// object-key character instead of normalizing it to '/'. Repeated '//' in a
+// key still collapses: a filer entry name cannot contain an empty segment.
+const allowBackslashInKeyUsage = "treat backslash as a regular object-key character instead of converting it to '/' (aws-compatible; '//' still collapses)"
+
 type FilerOptions struct {
 	masters                   *pb.ServerDiscovery
 	mastersString             *string
@@ -83,12 +96,15 @@ type FilerOptions struct {
 	tusMaxSizeMB              *int
 	tusSessionExpiry          *time.Duration
 	s3ConfigFile              *string // optional path to static S3 identity config
+
+	allowUntrustedRemoteEndpoints *bool
+	remoteCacheEvictThreshold     *float64
 	// shutdownCtx, when non-nil, tells startFiler to gracefully shut down its
 	// HTTP/gRPC servers once the ctx is cancelled. Used by integration tests
 	// and by weed mini; nil for standalone weed filer.
 	shutdownCtx context.Context
 	// gracefulStopTimeout caps how long startFiler waits for gRPC graceful
-	// stop before forcing the server to stop. Zero means the default of 10s.
+	// stop before forcing the server to stop. Zero means the default of 15s.
 	gracefulStopTimeout time.Duration
 }
 
@@ -127,6 +143,8 @@ func init() {
 	f.tusBasePath = cmdFiler.Flag.String("tusBasePath", "/.tus", "TUS resumable upload endpoint base path (e.g., /.tus)")
 	f.tusMaxSizeMB = cmdFiler.Flag.Int("tusMaxSizeMB", 5*1024, "maximum TUS upload size in MB")
 	f.tusSessionExpiry = cmdFiler.Flag.Duration("tusSessionExpiry", 24*time.Hour, "incomplete TUS upload sessions are cleaned up after this duration, e.g. \"48h\", \"7h30m\"")
+	f.allowUntrustedRemoteEndpoints = cmdFiler.Flag.Bool("allowUntrustedRemoteEndpoints", false, allowUntrustedRemoteEndpointsUsage)
+	f.remoteCacheEvictThreshold = cmdFiler.Flag.Float64("remoteCacheEvictThreshold", 0.9, "evict remote-cached objects (oldest first) when any volume disk exceeds this usage fraction; 0 disables")
 
 	// start s3 on filer
 	filerStartS3 = cmdFiler.Flag.Bool("s3", false, "whether to start S3 gateway")
@@ -144,7 +162,8 @@ func init() {
 	filerS3Options.metricsHttpPort = cmdFiler.Flag.Int("s3.metricsPort", 0, "Prometheus metrics listen port")
 	filerS3Options.metricsHttpIp = cmdFiler.Flag.String("s3.metricsIp", "", "metrics listen ip. If empty, default to same as -s3.ip.bind option.")
 	cmdFiler.Flag.Bool("s3.allowEmptyFolder", true, "deprecated, ignored. Empty folder cleanup is now automatic.")
-	filerS3Options.allowDeleteBucketNotEmpty = cmdFiler.Flag.Bool("s3.allowDeleteBucketNotEmpty", true, "allow recursive deleting all entries along with bucket")
+	filerS3Options.allowDeleteBucketNotEmpty = cmdFiler.Flag.Bool("s3.allowDeleteBucketNotEmpty", false, "allow recursive deleting all entries along with bucket")
+	filerS3Options.autoCreateBucket = cmdFiler.Flag.Bool("s3.autoCreateBucket", true, "create the bucket on upload if it does not exist, for admin identities only")
 	filerS3Options.localSocket = cmdFiler.Flag.String("s3.localSocket", "", "default to /tmp/seaweedfs-s3-<port>.sock")
 	filerS3Options.tlsCACertificate = cmdFiler.Flag.String("s3.cacert.file", "", "path to the TLS CA certificate file")
 	filerS3Options.tlsVerifyClientCert = cmdFiler.Flag.Bool("s3.tlsVerifyClientCert", false, "whether to verify the client's certificate")
@@ -156,9 +175,14 @@ func init() {
 	filerS3Options.cipher = cmdFiler.Flag.Bool("s3.encryptVolumeData", false, "encrypt data on volume servers for S3 uploads")
 	filerS3Options.iamReadOnly = cmdFiler.Flag.Bool("s3.iam.readOnly", true, "disable IAM write operations on this server")
 	filerS3Options.portIceberg = cmdFiler.Flag.Int("s3.port.iceberg", 8181, "Iceberg REST Catalog server listen port (0 to disable)")
-	filerS3Options.externalUrl = cmdFiler.Flag.String("s3.externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Used for S3 signature verification behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
+	filerS3Options.portLance = cmdFiler.Flag.Int("s3.port.lance", 9101, "Lance Namespace server listen port (0 to disable)")
+	filerS3Options.externalUrl = cmdFiler.Flag.String("s3.externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Advertised to Iceberg and Lance clients, and tried first when verifying S3 signatures behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
 	filerS3Options.defaultFileMode = cmdFiler.Flag.String("s3.defaultFileMode", "", "default file mode for S3 uploaded objects, e.g. 0660, 0644, 0666")
 	filerS3Options.cacheSizeMB = cmdFiler.Flag.Int64("s3.cacheCapacityMB", 0, "in-memory chunk cache capacity in MB for S3 GETs shared across requests (0 disables)")
+	filerS3Options.readerCacheSizeMB = cmdFiler.Flag.Int64("s3.readerCacheSizeMB", 0, "memory budget in MiB for downloaded and in-flight reader buffers across all S3 GETs (0 means unlimited)")
+	filerS3Options.allowUntrustedRemoteEndpoints = cmdFiler.Flag.Bool("s3.allowUntrustedRemoteEndpoints", false, allowUntrustedRemoteEndpointsUsage)
+	filerS3Options.allowBackslashInKey = cmdFiler.Flag.Bool("s3.allowBackslashInKey", false, allowBackslashInKeyUsage)
+	filerS3Options.iamSelfServiceRequiresGrant = cmdFiler.Flag.Bool("s3.iam.selfServiceRequiresGrant", false, iamSelfServiceRequiresGrantUsage)
 
 	// start webdav on filer
 	filerStartWebDav = cmdFiler.Flag.Bool("webdav", false, "whether to start webdav gateway")
@@ -177,6 +201,7 @@ func init() {
 	filerStartIam = cmdFiler.Flag.Bool("iam", false, "whether to start IAM service")
 	filerIamOptions.ip = cmdFiler.Flag.String("iam.ip", *f.ip, "iam server http listen ip address")
 	filerIamOptions.port = cmdFiler.Flag.Int("iam.port", 8111, "iam server http listen port")
+	filerIamOptions.selfServiceRequiresGrant = filerS3Options.iamSelfServiceRequiresGrant
 
 	filerStartSftp = cmdFiler.Flag.Bool("sftp", false, "whether to start the SFTP server")
 	filerSftpOptions.port = cmdFiler.Flag.Int("sftp.port", 2022, "SFTP server listen port")
@@ -266,9 +291,6 @@ func runFiler(cmd *Command, args []string) bool {
 			filerS3Options.bindIp = f.bindIp
 		}
 		filerS3Options.localFilerSocket = f.localSocket
-		if *f.dataCenter != "" && *filerS3Options.dataCenter == "" {
-			filerS3Options.dataCenter = f.dataCenter
-		}
 		// Set S3 metrics IP based on bind IP if not explicitly set
 		if *filerS3Options.metricsHttpIp == "" {
 			*filerS3Options.metricsHttpIp = *filerS3Options.bindIp
@@ -310,9 +332,6 @@ func runFiler(cmd *Command, args []string) bool {
 		if *filerSftpOptions.bindIp == "" {
 			filerSftpOptions.bindIp = f.bindIp
 		}
-		if *f.dataCenter != "" && *filerSftpOptions.dataCenter == "" {
-			filerSftpOptions.dataCenter = f.dataCenter
-		}
 		go func(delay time.Duration) {
 			time.Sleep(delay * time.Second)
 			filerSftpOptions.startSftpServer()
@@ -368,8 +387,10 @@ func (fo *FilerOptions) startFiler() {
 		}
 	}
 
+	announce := make(chan struct{})
 	fs, nfs_err := weed_server.NewFilerServer(defaultMux, publicVolumeMux, &weed_server.FilerOption{
 		Masters:                   fo.masters,
+		AnnounceCh:                announce,
 		FilerGroup:                *fo.filerGroup,
 		Collection:                *fo.collection,
 		DefaultReplication:        *fo.defaultReplicaPlacement,
@@ -389,23 +410,25 @@ func (fo *FilerOptions) startFiler() {
 		DownloadMaxBytesPs:        int64(*fo.downloadMaxMBps) * 1024 * 1024,
 		DiskType:                  *fo.diskType,
 		AllowedOrigins:            strings.Split(*fo.allowedOrigins, ","),
+		ExposeDirectoryData:       *fo.exposeDirectoryData,
 		TusBasePath:               *fo.tusBasePath,
 		TusMaxSize:                int64(*fo.tusMaxSizeMB) * 1024 * 1024,
 		TusSessionExpiry:          *fo.tusSessionExpiry,
 		CredentialManager:         credentialManager,
+
+		AllowUntrustedRemoteEndpoints: *fo.allowUntrustedRemoteEndpoints,
+		RemoteCacheEvictThreshold:     *fo.remoteCacheEvictThreshold,
 	})
 	if nfs_err != nil {
 		glog.Fatalf("Filer startup error: %v", nfs_err)
 	}
 
-	// Ensure fs.Shutdown() runs exactly once, whether triggered by a signal hook
-	// or by the main goroutine after Serve() returns (e.g., MiniCluster tests).
-	var shutdownOnce sync.Once
-	shutdownFiler := func() {
-		shutdownOnce.Do(func() {
-			fs.Shutdown()
-		})
-	}
+	// Serve "//" and ".." paths at their cleaned form instead of letting the mux
+	// redirect: its Location is double-escaped, turning non-ASCII names into
+	// percent-encoded directory names when a client follows it (#11125).
+	defaultHandler := weed_server.CleanPathHandler(defaultMux)
+
+	var httpServers []*http.Server
 
 	if *fo.publicPort != 0 {
 		publicListeningAddress := util.JoinHostPort(*fo.bindIp, *fo.publicPort)
@@ -414,14 +437,19 @@ func (fo *FilerOptions) startFiler() {
 		if e != nil {
 			glog.Fatalf("Filer server public listener error on port %d:%v", *fo.publicPort, e)
 		}
+		publicHandler := weed_server.CleanPathHandler(publicVolumeMux)
+		publicServer := newHttpServer(publicHandler, nil)
+		httpServers = append(httpServers, publicServer)
 		go func() {
-			if e := http.Serve(publicListener, publicVolumeMux); e != nil {
+			if e := publicServer.Serve(publicListener); e != nil && e != http.ErrServerClosed {
 				glog.Fatalf("Volume server fail to serve public: %v", e)
 			}
 		}()
 		if localPublicListener != nil {
+			localPublicServer := newHttpServer(publicHandler, nil)
+			httpServers = append(httpServers, localPublicServer)
 			go func() {
-				if e := http.Serve(localPublicListener, publicVolumeMux); e != nil {
+				if e := localPublicServer.Serve(localPublicListener); e != nil && e != http.ErrServerClosed {
 					glog.Errorf("Volume server fail to serve public: %v", e)
 				}
 			}()
@@ -455,9 +483,18 @@ func (fo *FilerOptions) startFiler() {
 	if credentialManager != nil {
 		adminSigningKey := security.SigningKey(util.GetViper().GetString("jwt.filer_signing.key"))
 		iamGrpcServer := weed_server.NewIamGrpcServer(credentialManager, adminSigningKey)
+		// The OIDC provider and role RPCs write where S3 servers configured with
+		// filer-typed "oidcProviderStore" and "roleStore" read: this filer, at
+		// the stores' default base paths.
+		selfAddress := func() string { return string(filerAddress) }
+		if roleStore, err := integration.NewFilerRoleStore(nil, selfAddress); err != nil {
+			glog.Warningf("IAM gRPC: role RPCs disabled: %v", err)
+		} else {
+			iamGrpcServer.SetSTSStores(integration.NewFilerOIDCProviderStore(nil, selfAddress), roleStore)
+		}
 		iam_pb.RegisterSeaweedIdentityAccessManagementServer(grpcS, iamGrpcServer)
 		if len(adminSigningKey) == 0 {
-			glog.V(0).Info("Registered IAM gRPC service on filer (unauthenticated; set jwt.filer_signing.key in security.toml to require admin Bearer token)")
+			glog.Warning("IAM gRPC service on filer is UNAUTHENTICATED: anyone who can reach this port can create users and policies, and its OIDC provider and role RPCs are refused; set jwt.filer_signing.key in security.toml to require an admin Bearer token")
 		} else {
 			glog.V(0).Info("Registered IAM gRPC service on filer (admin Bearer token required)")
 		}
@@ -470,42 +507,31 @@ func (fo *FilerOptions) startFiler() {
 	go grpcS.Serve(grpcL)
 	pb.ServeGrpcOnLocalSocket(grpcS, grpcPort)
 
+	// Membership in the master's filer list routes S3 and peer traffic here;
+	// announce once the gRPC port is serving and the metadata replay has
+	// caught up with the peers found at startup, so the filer does not take
+	// lock-ring ownership while a peer's older events can still land on top
+	// of its fresh writes. A cap bounds the wait.
+	go fs.AnnounceOnceCaughtUp(announce, time.Now())
+
 	// Helper to gracefully stop the gRPC server, waiting for active RPCs.
 	gracefulTimeout := fo.gracefulStopTimeout
 	if gracefulTimeout <= 0 {
-		gracefulTimeout = 10 * time.Second
-	}
-	stopGrpcServer := func() {
-		glog.V(0).Infof("Gracefully stopping gRPC server")
-		stopped := make(chan struct{})
-		go func() {
-			grpcS.GracefulStop()
-			close(stopped)
-		}()
-		select {
-		case <-stopped:
-			glog.V(0).Infof("gRPC server stopped gracefully")
-		case <-time.After(gracefulTimeout):
-			glog.V(0).Infof("gRPC server graceful stop timed out after %s, forcing stop", gracefulTimeout)
-			grpcS.Stop()
-		}
+		gracefulTimeout = 15 * time.Second
 	}
+	stopGrpcServer := func() { gracefulStopGrpc(grpcS, gracefulTimeout) }
 
-	var socketServer *http.Server
 	if runtime.GOOS != "windows" {
 		localSocket := *fo.localSocket
-		if localSocket == "" {
+		explicit := localSocket != ""
+		if !explicit {
 			localSocket = fmt.Sprintf("/tmp/seaweedfs-filer-%d.sock", *fo.port)
 		}
-		if err := os.Remove(localSocket); err != nil && !os.IsNotExist(err) {
-			glog.Fatalf("Failed to remove %s, error: %s", localSocket, err.Error())
+		if filerSocketListener := pb.ListenOnLocalSocket(localSocket); filerSocketListener != nil {
+			socketServer := newHttpServer(defaultHandler, nil)
+			httpServers = append(httpServers, socketServer)
+			go socketServer.Serve(filerSocketListener)
 		}
-		filerSocketListener, err := net.Listen("unix", localSocket)
-		if err != nil {
-			glog.Fatalf("Failed to listen on %s: %v", localSocket, err)
-		}
-		socketServer = newHttpServer(defaultMux, nil)
-		go socketServer.Serve(filerSocketListener)
 	}
 
 	if viper.GetString("https.filer.key") != "" {
@@ -547,98 +573,74 @@ func (fo *FilerOptions) startFiler() {
 
 		var localTLSServer *http.Server
 		if filerLocalListener != nil {
-			localTLSServer = newHttpServer(defaultMux, tlsConfig)
+			localTLSServer = newHttpServer(defaultHandler, tlsConfig)
+			httpServers = append(httpServers, localTLSServer)
 			go func() {
 				if err := localTLSServer.ServeTLS(filerLocalListener, "", ""); err != nil {
 					glog.Errorf("Filer Fail to serve: %v", err)
 				}
 			}()
 		}
-		httpS := newHttpServer(defaultMux, tlsConfig)
+		httpS := newHttpServer(defaultHandler, tlsConfig)
+		httpServers = append(httpServers, httpS)
+		shutdown := newFilerShutdown(fs.LeaveLockRing, fs.StopSubscriptions, stopGrpcServer, fs.Shutdown, httpServers...)
 
-		// Register a single shutdown hook that runs the steps in the correct order:
-		// stop accepting new gRPC/HTTP requests, then close the filer database.
-		// Combining them into one hook keeps ordering intact regardless of how
-		// grace fires interrupt hooks (FIFO vs LIFO).
-		grace.OnInterrupt(func() {
-			stopGrpcServer()
-			glog.V(0).Infof("Gracefully stopping all HTTP servers")
-			shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-			defer cancel()
-			if socketServer != nil {
-				err = socketServer.Shutdown(shutdownCtx)
-				if err != nil {
-					glog.Warningf("socket server shutdown: %v", err)
-				}
-			}
-			if localTLSServer != nil {
-				err = localTLSServer.Shutdown(shutdownCtx)
-				if err != nil {
-					glog.Warningf("local TLS server shutdown: %v", err)
-				}
-			}
-			if err := httpS.Shutdown(shutdownCtx); err != nil {
-				glog.Warningf("HTTPS server shutdown: %v", err)
-			}
-			shutdownFiler()
-		})
+		grace.OnInterrupt(shutdown)
 
 		if fo.shutdownCtx != nil {
 			go func() {
 				<-fo.shutdownCtx.Done()
-				httpS.Shutdown(context.Background())
-				grpcS.Stop()
+				shutdown()
 			}()
 		}
 		if err := httpS.ServeTLS(filerListener, "", ""); err != nil && err != http.ErrServerClosed {
 			glog.Fatalf("Filer Fail to serve: %v", err)
 		}
-		// Close database after servers have stopped to prevent data corruption
-		shutdownFiler()
+		// Serve returns when listeners close, before active requests finish.
+		// Join the same shutdown sequence instead of closing the filer here.
+		shutdown()
 	} else {
 		var localHTTPServer *http.Server
 		if filerLocalListener != nil {
-			localHTTPServer = newHttpServer(defaultMux, nil)
+			localHTTPServer = newHttpServer(defaultHandler, nil)
+			httpServers = append(httpServers, localHTTPServer)
 			go func() {
 				if err := localHTTPServer.Serve(filerLocalListener); err != nil {
 					glog.Errorf("Filer Fail to serve: %v", err)
 				}
 			}()
 		}
-		httpS := newHttpServer(defaultMux, nil)
+		httpS := newHttpServer(defaultHandler, nil)
+		httpServers = append(httpServers, httpS)
+		shutdown := newFilerShutdown(fs.LeaveLockRing, fs.StopSubscriptions, stopGrpcServer, fs.Shutdown, httpServers...)
 
-		// Register a single shutdown hook that runs the steps in the correct order:
-		// stop accepting new gRPC/HTTP requests, then close the filer database.
-		// Combining them into one hook keeps ordering intact regardless of how
-		// grace fires interrupt hooks (FIFO vs LIFO).
-		grace.OnInterrupt(func() {
-			stopGrpcServer()
-			glog.V(0).Infof("Gracefully stopping all HTTP servers")
-			shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-			defer cancel()
-			if socketServer != nil {
-				socketServer.Shutdown(shutdownCtx)
-			}
-			if localHTTPServer != nil {
-				localHTTPServer.Shutdown(shutdownCtx)
-			}
-			if err := httpS.Shutdown(shutdownCtx); err != nil {
-				glog.Warningf("HTTP server shutdown: %v", err)
-			}
-			shutdownFiler()
-		})
+		grace.OnInterrupt(shutdown)
 
 		if fo.shutdownCtx != nil {
 			go func() {
 				<-fo.shutdownCtx.Done()
-				httpS.Shutdown(context.Background())
-				grpcS.Stop()
+				shutdown()
 			}()
 		}
 		if err := httpS.Serve(filerListener); err != nil && err != http.ErrServerClosed {
 			glog.Fatalf("Filer Fail to serve: %v", err)
 		}
-		// Close database after servers have stopped to prevent data corruption
-		shutdownFiler()
+		// Serve returns when listeners close, before active requests finish.
+		// Join the same shutdown sequence instead of closing the filer here.
+		shutdown()
 	}
 }
+
+// newFilerShutdown joins shutdown callers while gRPC and HTTP drain concurrently.
+// The filer leaves the lock ring first: peers and S3 gateways route keys to it
+// until the ring changes, and would hit refused connections once gRPC stops.
+// Then it ends its metadata subscriptions, so gRPC GracefulStop does not wait
+// out its timeout on streams whose subscribers sit in this same process.
+func newFilerShutdown(leaveLockRing, stopSubscriptions, stopGrpc, shutdownFiler func(), httpServers ...*http.Server) func() {
+	drain := newGracefulShutdown(stopGrpc, shutdownFiler, httpServers...)
+	return sync.OnceFunc(func() {
+		leaveLockRing()
+		stopSubscriptions()
+		drain()
+	})
+}
diff --git a/weed/command/filer_backup.go b/weed/command/filer_backup.go
index c5adeed089..f184dd23dc 100644
--- a/weed/command/filer_backup.go
+++ b/weed/command/filer_backup.go
@@ -42,6 +42,7 @@ type FilerBackupOptions struct {
 	timeAgo             *time.Duration
 	retentionDays       *int
 	initialSnapshot     *bool
+	concurrency         *int
 }
 
 var (
@@ -65,6 +66,7 @@ func init() {
 	filerBackupOptions.disableErrorRetry = cmdFilerBackup.Flag.Bool("disableErrorRetry", false, "disables errors retry, only logs will print")
 	filerBackupOptions.ignore404Error = cmdFilerBackup.Flag.Bool("ignore404Error", true, "ignore 404 errors from filer")
 	filerBackupOptions.initialSnapshot = cmdFilerBackup.Flag.Bool("initialSnapshot", false, "before subscribing to metadata updates, walk the live filer tree under -filerPath and seed the destination, then subscribe from the walk-start timestamp so concurrent changes are still captured. Runs on every start when -timeAgo is 0 and overwrites the saved checkpoint, so it also re-seeds a reinitialized destination. Remove it once the backup is caught up, otherwise it re-walks the whole tree on each restart.")
+	filerBackupOptions.concurrency = cmdFilerBackup.Flag.Int("concurrency", DefaultConcurrencyLimit, "the maximum number of files that will be backed up concurrently.")
 }
 
 var cmdFilerBackup = &Command{
@@ -105,10 +107,12 @@ func runFilerBackup(cmd *Command, args []string) bool {
 
 	clientId := util.RandomInt32()
 	var clientEpoch int32
+	var resumeTsNs int64
 
 	for {
 		clientEpoch++
-		err := doFilerBackup(grpcDialOption, &filerBackupOptions, reExcludeFileName, excludeFileNames, excludePathPatterns, clientId, clientEpoch)
+		var err error
+		resumeTsNs, err = doFilerBackup(grpcDialOption, &filerBackupOptions, reExcludeFileName, excludeFileNames, excludePathPatterns, clientId, clientEpoch, resumeTsNs)
 		if err != nil {
 			glog.Errorf("backup from %s: %v", *filerBackupOptions.filer, err)
 			time.Sleep(1747 * time.Millisecond)
@@ -120,12 +124,12 @@ const (
 	BackupKeyPrefix = "backup."
 )
 
-func doFilerBackup(grpcDialOption grpc.DialOption, backupOption *FilerBackupOptions, reExcludeFileName *regexp.Regexp, excludeFileNames []*wildcard.WildcardMatcher, excludePathPatterns []*wildcard.WildcardMatcher, clientId int32, clientEpoch int32) error {
+func doFilerBackup(grpcDialOption grpc.DialOption, backupOption *FilerBackupOptions, reExcludeFileName *regexp.Regexp, excludeFileNames []*wildcard.WildcardMatcher, excludePathPatterns []*wildcard.WildcardMatcher, clientId int32, clientEpoch int32, resumeTsNs int64) (int64, error) {
 
 	// find data sink
 	dataSink := findSink(util.GetViper())
 	if dataSink == nil {
-		return fmt.Errorf("no data sink configured in replication.toml")
+		return 0, fmt.Errorf("no data sink configured in replication.toml")
 	}
 
 	sourceFiler := pb.ServerAddress(*backupOption.filer)
@@ -137,16 +141,22 @@ func doFilerBackup(grpcDialOption grpc.DialOption, backupOption *FilerBackupOpti
 
 	// get start time for the data sink
 	startFrom := time.Unix(0, 0)
-	sinkId := util.HashStringToLong(dataSink.GetName() + dataSink.GetSinkToDirectory())
+	sinkId, legacySinkId := backupCheckpointIds(sourcePath, dataSink)
 	runSnapshot := *backupOption.initialSnapshot && timeAgo == 0
-	if timeAgo == 0 {
+	if resumeTsNs > 0 {
+		// The previous attempt pinned where it stopped — a failed event's
+		// timestamp or the processed watermark — which can sit behind both the
+		// persisted checkpoint and a recomputed -timeAgo window.
+		startFrom = time.Unix(0, resumeTsNs)
+		glog.V(0).Infof("resuming previous attempt at %v", startFrom)
+	} else if timeAgo == 0 {
 		if runSnapshot {
 			// snapshot below sets the start point; no checkpoint read needed
 			glog.V(0).Infof("initialSnapshot requested — walking live tree before subscribing")
 		} else {
-			lastOffsetTsNs, err := getOffset(grpcDialOption, sourceFiler, BackupKeyPrefix, int32(sinkId))
+			lastOffsetTsNs, err := getOffsetWithFallback(grpcDialOption, sourceFiler, BackupKeyPrefix, sinkId, BackupKeyPrefix, legacySinkId)
 			if err != nil {
-				glog.V(0).Infof("starting from %v (offset read failed: %v)", startFrom, err)
+				return 0, fmt.Errorf("read backup offset: %w", err)
 			} else if lastOffsetTsNs > 0 {
 				startFrom = time.Unix(0, lastOffsetTsNs)
 				glog.V(0).Infof("resuming from %v", startFrom)
@@ -166,11 +176,11 @@ func doFilerBackup(grpcDialOption grpc.DialOption, backupOption *FilerBackupOpti
 		sourceFiler.ToGrpcAddress(),
 		sourcePath,
 		*backupOption.proxyByFiler); err != nil {
-		return fmt.Errorf("filersource initialization failed: %v", err)
+		return resumeTsNs, fmt.Errorf("filersource initialization failed: %v", err)
 	}
 
 	if err := repl_util.InitializeSSEForReplication(filerSource); err != nil {
-		return fmt.Errorf("SSE initialization failed: %v", err)
+		return resumeTsNs, fmt.Errorf("SSE initialization failed: %v", err)
 	}
 	dataSink.SetSourceFiler(filerSource)
 
@@ -181,14 +191,14 @@ func doFilerBackup(grpcDialOption grpc.DialOption, backupOption *FilerBackupOpti
 	if runSnapshot {
 		snapshotTsNs, err := runInitialSnapshot(sourceFiler.ToGrpcAddress(), filerSource, sourcePath, targetPath, excludePaths, reExcludeFileName, excludeFileNames, excludePathPatterns, dataSink, *backupOption.ignore404Error)
 		if err != nil {
-			return fmt.Errorf("initial snapshot: %w", err)
+			return 0, fmt.Errorf("initial snapshot: %w", err)
 		}
 		// The walk can take hours on large trees; retry the tiny KV write a
 		// handful of times before giving up so a flaky filer KV doesn't force
 		// the whole walk to repeat on the next retry loop iteration.
-		if err := persistSnapshotOffset(grpcDialOption, sourceFiler, int32(sinkId), snapshotTsNs); err != nil {
+		if err := persistSnapshotOffset(grpcDialOption, sourceFiler, sinkId, snapshotTsNs); err != nil {
 			glog.Errorf("initialSnapshot: FAILED to persist offset %d for sinkId %d after retries: %v — the next retry will redo the full walk", snapshotTsNs, sinkId, err)
-			return fmt.Errorf("persist initial snapshot offset: %w", err)
+			return 0, fmt.Errorf("persist initial snapshot offset: %w", err)
 		}
 		startFrom = time.Unix(0, snapshotTsNs)
 		// walk once per process; retries resume from the persisted checkpoint
@@ -218,9 +228,74 @@ func doFilerBackup(grpcDialOption grpc.DialOption, backupOption *FilerBackupOpti
 		processEventFn = genProcessFunction(sourcePath, targetPath, excludePaths, reExcludeFileName, excludeFileNames, excludePathPatterns, dataSink, *backupOption.doDeleteFiles, debug)
 	}
 
-	processEventFnWithOffset := pb.AddOffsetFunc(processEventFn, 3*time.Second, func(counter int64, lastTsNs int64) error {
-		glog.V(0).Infof("backup %s progressed to %v %0.2f/sec", sourceFiler, time.Unix(0, lastTsNs), float64(counter)/float64(3))
-		return setOffset(grpcDialOption, sourceFiler, BackupKeyPrefix, int32(sinkId), lastTsNs)
+	if *backupOption.disableErrorRetry {
+		// TrivialOnError semantics: log the failure and advance. Left to the
+		// processor a permanent failure would pin the checkpoint and replay
+		// forever, which is the opposite of what this flag asks for.
+		inner := processEventFn
+		processEventFn = func(resp *filer_pb.SubscribeMetadataResponse) error {
+			if err := inner(resp); err != nil {
+				glog.Errorf("process %v: %v", resp, err)
+			}
+			return nil
+		}
+	}
+
+	// Serial event handling caps throughput at one fetch+write at a time, so a
+	// busy source keeps outrunning the backup. The metadata processor fans
+	// events out while serializing same-path and subtree-barrier conflicts,
+	// and the checkpoint only advances on the contiguous processed watermark.
+	concurrency := *backupOption.concurrency
+	if concurrency < 1 || concurrency > 1024 {
+		glog.Warningf("invalid concurrency value %d, using default: %d", concurrency, DefaultConcurrencyLimit)
+		concurrency = DefaultConcurrencyLimit
+	}
+	processor := NewMetadataProcessor(processEventFn, concurrency, startFrom.UnixNano())
+
+	// AddOffsetFunc only checkpoints while events arrive; persist the
+	// completed watermark on a ticker too so work finishing on a quiet
+	// stream does not sit uncheckpointed until the next event.
+	var lastPersistedTsNs atomic.Int64
+	lastPersistedTsNs.Store(-1)
+	stopPersist := make(chan struct{})
+	persistDone := make(chan struct{})
+	go func() {
+		defer close(persistDone)
+		ticker := time.NewTicker(3 * time.Second)
+		defer ticker.Stop()
+		persist := func() {
+			if ts := resumeTsNsFor(processor); ts != lastPersistedTsNs.Load() {
+				if err := setOffset(grpcDialOption, sourceFiler, BackupKeyPrefix, sinkId, ts); err == nil {
+					lastPersistedTsNs.Store(ts)
+				} else {
+					glog.Warningf("persist backup offset: %v", err)
+				}
+			}
+		}
+		for {
+			select {
+			case <-stopPersist:
+				persist()
+				return
+			case <-ticker.C:
+				persist()
+			}
+		}
+	}()
+
+	var lastLogTsNs = time.Now().UnixNano()
+	processEventFnWithOffset := pb.AddOffsetFunc(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		processor.AddSyncJob(resp)
+		return nil
+	}, 3*time.Second, func(counter int64, lastTsNs int64) error {
+		offsetTsNs := processor.processedTsWatermark.Load()
+		if offsetTsNs == 0 {
+			return nil
+		}
+		now := time.Now().UnixNano()
+		glog.V(0).Infof("backup %s received %0.2f events/sec, processed through %v", sourceFiler, float64(counter)/(float64(now-lastLogTsNs)/1e9), time.Unix(0, offsetTsNs))
+		lastLogTsNs = now
+		return nil
 	})
 
 	if dataSink.IsIncremental() && *filerBackupOptions.retentionDays > 0 {
@@ -256,12 +331,50 @@ func doFilerBackup(grpcDialOption grpc.DialOption, backupOption *FilerBackupOpti
 		StartTsNs:              startFrom.UnixNano(),
 		StopTsNs:               0,
 		EventErrorType:         eventErrorType,
+		GetResumeTsNs: func() int64 {
+			return resumeTsNsFor(processor)
+		},
+		Resubscribe: processor.ResubscribeCh(),
 	}
 
-	return pb.FollowMetadata(sourceFiler, grpcDialOption, metadataFollowOption, processEventFnWithOffset)
+	err := pb.FollowMetadata(sourceFiler, grpcDialOption, metadataFollowOption, processEventFnWithOffset)
+	// Jobs admitted before the stream ended keep running; drain them so the
+	// retry loop's replay cannot race an older write past a newer one.
+	processor.Drain()
+	close(stopPersist)
+	// setOffset has no context, so a stalled checkpoint RPC must not hold the
+	// retry loop: bound the wait and let a late write land in the background.
+	select {
+	case <-persistDone:
+	case <-time.After(30 * time.Second):
+		glog.Warningf("backup %s offset checkpoint did not finish in 30s; reconnecting anyway", sourceFiler)
+	}
+	// Resume the next attempt at the floored watermark — never recompute a
+	// position that skips events. The floor sits one tick below the earliest
+	// failure and stays there even when a redelivery clears the pin, so
+	// events dropped while the processor was stopped still replay.
+	return resumeTsNsFor(processor), err
 
 }
 
+// backupCheckpointIds derives the checkpoint key for this backup and the
+// historical key kept for fallback reads. The checkpoint covers everything
+// that defines one backup stream: what is backed up (the source path) and
+// exactly where it lands (the sink's destination identity). The historical
+// key hashed only sink name + directory, so two backups to different buckets
+// or endpoints sharing a directory layout advanced one checkpoint and could
+// silently skip each other's changes. Writes go only to the new key; the
+// historical key is read once when the new key has no value yet, so an
+// existing backup resumes where it left off after an upgrade.
+//
+// NUL joins the fields because it cannot occur in a path or a configuration
+// value, so distinct field tuples cannot concatenate to the same hash input.
+func backupCheckpointIds(sourcePath string, dataSink sink.ReplicationSink) (sinkId, legacySinkId int32) {
+	sinkId = int32(util.HashStringToLong(sourcePath + "\x00" + dataSink.GetName() + "\x00" + dataSink.GetDestinationIdentity()))
+	legacySinkId = int32(util.HashStringToLong(dataSink.GetName() + dataSink.GetSinkToDirectory()))
+	return
+}
+
 func getSourceKey(resp *filer_pb.SubscribeMetadataResponse) string {
 	if resp == nil || resp.EventNotification == nil {
 		return ""
diff --git a/weed/command/filer_backup_offset_test.go b/weed/command/filer_backup_offset_test.go
new file mode 100644
index 0000000000..e42efdaa2b
--- /dev/null
+++ b/weed/command/filer_backup_offset_test.go
@@ -0,0 +1,171 @@
+package command
+
+import (
+	"context"
+	"net"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// kvFilerServer implements just the KV calls of the filer gRPC API over an
+// in-memory map, mirroring the real server's behavior of returning an empty
+// response, not an error, for a missing key.
+type kvFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	mu sync.Mutex
+	kv map[string][]byte
+}
+
+func (s *kvFilerServer) KvGet(_ context.Context, req *filer_pb.KvGetRequest) (*filer_pb.KvGetResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return &filer_pb.KvGetResponse{Value: s.kv[string(req.Key)]}, nil
+}
+
+func (s *kvFilerServer) KvPut(_ context.Context, req *filer_pb.KvPutRequest) (*filer_pb.KvPutResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.kv[string(req.Key)] = req.Value
+	return &filer_pb.KvPutResponse{}, nil
+}
+
+type failingKvFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	calls atomic.Int32
+}
+
+func (s *failingKvFilerServer) KvGet(context.Context, *filer_pb.KvGetRequest) (*filer_pb.KvGetResponse, error) {
+	if s.calls.Add(1) == 1 {
+		return &filer_pb.KvGetResponse{Error: "kv store unavailable"}, nil
+	}
+	return &filer_pb.KvGetResponse{}, nil
+}
+
+// a miss reads as ErrNotFound so the retried attempt skips the KEK retry loop
+func (s *failingKvFilerServer) LookupDirectoryEntry(context.Context, *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	return &filer_pb.LookupDirectoryEntryResponse{}, nil
+}
+
+func startKvFiler(t *testing.T) (pb.ServerAddress, grpc.DialOption) {
+	return startFiler(t, &kvFilerServer{kv: map[string][]byte{}})
+}
+
+func startFiler(t *testing.T, server filer_pb.SeaweedFilerServer) (pb.ServerAddress, grpc.DialOption) {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, server)
+	go func() { _ = grpcServer.Serve(listener) }()
+	t.Cleanup(func() { grpcServer.Stop() })
+	grpcPort := listener.Addr().(*net.TCPAddr).Port
+	return pb.NewServerAddressWithGrpcPort("127.0.0.1:8888", grpcPort),
+		grpc.WithTransportCredentials(insecure.NewCredentials())
+}
+
+// An upgraded backup finds no destination-scoped checkpoint yet and must
+// resume from the historical name+directory key; once its own key holds a
+// value, the historical key — possibly still advanced by another backup that
+// shared it — must no longer influence it.
+func TestBackupOffset_HistoricalFallbackThenIndependence(t *testing.T) {
+	filerAddr, dial := startKvFiler(t)
+
+	s := &stubSink{name: "s3", dir: "/", destination: "endpoint-a|bucket-a|/"}
+	sinkId, legacySinkId := backupCheckpointIds("/", s)
+
+	// pre-upgrade state: only the shared historical checkpoint exists
+	if err := setOffset(dial, filerAddr, BackupKeyPrefix, legacySinkId, 111); err != nil {
+		t.Fatalf("seed historical offset: %v", err)
+	}
+	got, err := getOffsetWithFallback(dial, filerAddr, BackupKeyPrefix, sinkId, BackupKeyPrefix, legacySinkId)
+	if err != nil || got != 111 {
+		t.Fatalf("fallback read = (%d, %v), want (111, nil)", got, err)
+	}
+
+	// the backup checkpoints under its own key and prefers it from then on
+	if err := setOffset(dial, filerAddr, BackupKeyPrefix, sinkId, 222); err != nil {
+		t.Fatalf("write destination-scoped offset: %v", err)
+	}
+	got, err = getOffsetWithFallback(dial, filerAddr, BackupKeyPrefix, sinkId, BackupKeyPrefix, legacySinkId)
+	if err != nil || got != 222 {
+		t.Fatalf("destination-scoped read = (%d, %v), want (222, nil)", got, err)
+	}
+
+	// another backup advancing the historical key no longer moves this one
+	if err := setOffset(dial, filerAddr, BackupKeyPrefix, legacySinkId, 333); err != nil {
+		t.Fatalf("advance historical offset: %v", err)
+	}
+	got, err = getOffsetWithFallback(dial, filerAddr, BackupKeyPrefix, sinkId, BackupKeyPrefix, legacySinkId)
+	if err != nil || got != 222 {
+		t.Fatalf("read after historical advance = (%d, %v), want (222, nil)", got, err)
+	}
+}
+
+// The collision scenario from the report, over the real KV wire path: two
+// backups whose configurations differ only in endpoint and bucket write
+// their checkpoints without disturbing each other's.
+func TestBackupOffset_DistinctDestinationsDoNotShare(t *testing.T) {
+	filerAddr, dial := startKvFiler(t)
+
+	idA, legacyA := backupCheckpointIds("/", &stubSink{name: "s3", dir: "/", destination: "s3.us-west-004.backblazeb2.com|seaweed-backup-a|/"})
+	idB, legacyB := backupCheckpointIds("/", &stubSink{name: "s3", dir: "/", destination: "s3.us-east-005.backblazeb2.com|seaweed-backup-b|/"})
+
+	if err := setOffset(dial, filerAddr, BackupKeyPrefix, idA, 1000); err != nil {
+		t.Fatalf("write A: %v", err)
+	}
+	if err := setOffset(dial, filerAddr, BackupKeyPrefix, idB, 2000); err != nil {
+		t.Fatalf("write B: %v", err)
+	}
+
+	if got, err := getOffsetWithFallback(dial, filerAddr, BackupKeyPrefix, idA, BackupKeyPrefix, legacyA); err != nil || got != 1000 {
+		t.Fatalf("A reads (%d, %v), want (1000, nil)", got, err)
+	}
+	if got, err := getOffsetWithFallback(dial, filerAddr, BackupKeyPrefix, idB, BackupKeyPrefix, legacyB); err != nil || got != 2000 {
+		t.Fatalf("B reads (%d, %v), want (2000, nil)", got, err)
+	}
+}
+
+func TestFilerBackup_OffsetReadFailureFailsAttempt(t *testing.T) {
+	server := &failingKvFilerServer{}
+	filerAddr, dial := startFiler(t, server)
+
+	config := util.GetViper()
+	config.Set("sink.local.enabled", true)
+	config.Set("sink.local.directory", t.TempDir())
+	t.Cleanup(func() {
+		config.Set("sink.local.enabled", false)
+		config.Set("sink.local.directory", "")
+	})
+
+	options := filerBackupOptions
+	address := string(filerAddr)
+	options.filer = &address
+
+	resumeTsNs, err := doFilerBackup(dial, &options, nil, nil, nil, 1, 1, 0)
+	if err == nil || !strings.Contains(err.Error(), "kv store unavailable") {
+		t.Fatalf("doFilerBackup error = %v, want the offset read failure", err)
+	}
+	if resumeTsNs != 0 {
+		t.Fatalf("resume position = %d, want 0", resumeTsNs)
+	}
+
+	// the next attempt re-reads the checkpoint and gets past it once the KV
+	// recovers, so it must fail later, not on the offset read
+	_, err = doFilerBackup(dial, &options, nil, nil, nil, 1, 2, resumeTsNs)
+	if err == nil || strings.Contains(err.Error(), "kv store unavailable") {
+		t.Fatalf("retried doFilerBackup error = %v, want a later-stage failure", err)
+	}
+	if got := server.calls.Load(); got < 2 {
+		t.Fatalf("checkpoint reads across attempts = %d, want a re-read", got)
+	}
+}
diff --git a/weed/command/filer_backup_test.go b/weed/command/filer_backup_test.go
index addd062762..640a678bbe 100644
--- a/weed/command/filer_backup_test.go
+++ b/weed/command/filer_backup_test.go
@@ -213,14 +213,17 @@ func TestEventSourceSuperseded_Guards(t *testing.T) {
 }
 
 // stubSink is a minimal ReplicationSink used to exercise initialSnapshotTargetKey
-// without standing up a real sink. Only the two methods read by the key builder
-// (GetName, IsIncremental) need meaningful behavior; the rest satisfy the interface.
+// and backupCheckpointIds without standing up a real sink; the methods those
+// read (GetName, IsIncremental, GetSinkToDirectory, GetDestinationIdentity)
+// reflect the fields, the rest satisfy the interface.
 type stubSink struct {
 	name          string
+	dir           string
+	destination   string
 	isIncremental bool
 }
 
-func (s *stubSink) GetName() string                           { return s.name }
+func (s *stubSink) GetName() string                             { return s.name }
 func (s *stubSink) Initialize(util.Configuration, string) error { return nil }
 func (s *stubSink) DeleteEntry(string, bool, bool, []int32) error {
 	return nil
@@ -229,9 +232,10 @@ func (s *stubSink) CreateEntry(string, *filer_pb.Entry, []int32) error { return
 func (s *stubSink) UpdateEntry(string, *filer_pb.Entry, string, *filer_pb.Entry, bool, []int32) (bool, error) {
 	return false, nil
 }
-func (s *stubSink) GetSinkToDirectory() string       { return "" }
+func (s *stubSink) GetSinkToDirectory() string         { return s.dir }
+func (s *stubSink) GetDestinationIdentity() string     { return s.destination }
 func (s *stubSink) SetSourceFiler(*source.FilerSource) {}
-func (s *stubSink) IsIncremental() bool              { return s.isIncremental }
+func (s *stubSink) IsIncremental() bool                { return s.isIncremental }
 
 var _ sink.ReplicationSink = (*stubSink)(nil)
 
@@ -274,3 +278,68 @@ func TestInitialSnapshotTargetKey(t *testing.T) {
 		t.Errorf("sourceKey == sourcePath (trailing slash mismatch): got %q, want %q", got, "/backup")
 	}
 }
+
+// The scenario from the collision report: two backups to different S3
+// endpoints/buckets that share the destination directory "/" must not share
+// a checkpoint, or the stopped one resumes from the other's position and
+// skips changes.
+func TestBackupCheckpointIds_DistinctDestinations(t *testing.T) {
+	backupA := &stubSink{name: "s3", dir: "/", destination: "s3.us-west-004.backblazeb2.com|seaweed-backup-a|/"}
+	backupB := &stubSink{name: "s3", dir: "/", destination: "s3.us-east-005.backblazeb2.com|seaweed-backup-b|/"}
+
+	idA, legacyA := backupCheckpointIds("/", backupA)
+	idB, legacyB := backupCheckpointIds("/", backupB)
+
+	if idA == idB {
+		t.Errorf("backups to different destinations share checkpoint id %d", idA)
+	}
+	// Both historically hashed to the same key — that is the bug the
+	// destination-scoped key fixes, and the shared value both fall back to.
+	if legacyA != legacyB {
+		t.Errorf("legacy ids differ: %d vs %d", legacyA, legacyB)
+	}
+}
+
+// Two backups of different source paths to the same destination must not
+// share a checkpoint either: each stream sees a different event subset, so a
+// shared offset lets the faster one push the slower one past unseen events.
+func TestBackupCheckpointIds_DistinctSourcePaths(t *testing.T) {
+	s := &stubSink{name: "s3", dir: "/", destination: "endpoint|bucket|/"}
+	idA, _ := backupCheckpointIds("/buckets/a", s)
+	idB, _ := backupCheckpointIds("/buckets/b", s)
+	if idA == idB {
+		t.Errorf("backups of different source paths share checkpoint id %d", idA)
+	}
+}
+
+// The fallback key must keep the exact historical formula
+// hash(GetName() + GetSinkToDirectory()) truncated to int32, or existing
+// backups lose their checkpoint on upgrade and replay from zero.
+func TestBackupCheckpointIds_LegacyFormulaUnchanged(t *testing.T) {
+	s := &stubSink{name: "s3", dir: "/data", destination: "endpoint|bucket|/data"}
+	_, legacy := backupCheckpointIds("/", s)
+	if want := int32(util.HashStringToLong("s3" + "/data")); legacy != want {
+		t.Errorf("legacy id = %d, want historical formula value %d", legacy, want)
+	}
+}
+
+// The NUL joins keep the hash input injective: field values spelling out
+// other fields' content must not concatenate to the same input.
+func TestBackupCheckpointIds_NoAliasing(t *testing.T) {
+	idA, _ := backupCheckpointIds("/src", &stubSink{name: "s3", dir: "/", destination: "/d=>s3|/other"})
+	idB, _ := backupCheckpointIds("/src=>s3|/d", &stubSink{name: "s3", dir: "/", destination: "/other"})
+	if idA == idB {
+		t.Errorf("field content spelling a separator aliases checkpoint id %d", idA)
+	}
+}
+
+// Restarting the same configuration must derive the same key, or every
+// restart would orphan its checkpoint.
+func TestBackupCheckpointIds_Stable(t *testing.T) {
+	s := &stubSink{name: "s3", dir: "/", destination: "endpoint|bucket|/"}
+	id1, legacy1 := backupCheckpointIds("/buckets/a", s)
+	id2, legacy2 := backupCheckpointIds("/buckets/a", s)
+	if id1 != id2 || legacy1 != legacy2 {
+		t.Errorf("ids not stable: (%d,%d) vs (%d,%d)", id1, legacy1, id2, legacy2)
+	}
+}
diff --git a/weed/command/filer_copy.go b/weed/command/filer_copy.go
index 4b814116d4..5525ebddd4 100644
--- a/weed/command/filer_copy.go
+++ b/weed/command/filer_copy.go
@@ -491,7 +491,22 @@ func (worker *FileCopyWorker) uploadFileInChunks(task FileCopyTask, f *os.File,
 		return uploadError
 	}
 
-	manifestedChunks, manifestErr := filer.MaybeManifestize(worker.saveDataAsChunk, chunks)
+	// A fold that fails midway aborts the copy, so the blobs its earlier
+	// batches wrote go the same way as the chunks of a failed upload.
+	deleteManifestChunks := func(saved []*filer_pb.FileChunk) {
+		if len(worker.options.masters) == 0 {
+			return
+		}
+		var fileIds []string
+		for _, chunk := range saved {
+			fileIds = append(fileIds, chunk.GetFileIdString())
+		}
+		operation.DeleteFileIds(func(_ context.Context) pb.ServerAddress {
+			return pb.ServerAddress(worker.options.masters[0])
+		}, false, worker.options.grpcDialOption, fileIds)
+	}
+
+	manifestedChunks, manifestErr := filer.MaybeManifestize(worker.saveDataAsChunk, deleteManifestChunks, chunks)
 	if manifestErr != nil {
 		return fmt.Errorf("create manifest: %w", manifestErr)
 	}
diff --git a/weed/command/filer_remote_gateway_buckets.go b/weed/command/filer_remote_gateway_buckets.go
index 5d138e4942..7ef16cd284 100644
--- a/weed/command/filer_remote_gateway_buckets.go
+++ b/weed/command/filer_remote_gateway_buckets.go
@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"math"
 	"math/rand"
@@ -47,7 +48,7 @@ func (option *RemoteGatewayOptions) followBucketUpdatesAndUploadToRemote(filerSo
 		now := time.Now().UnixNano()
 		glog.V(0).Infof("remote sync %s progressed to %v %0.2f/sec", *option.filerAddress, time.Unix(0, offsetTsNs), float64(counter)/(float64(now-lastLogTsNs)/1e9))
 		lastLogTsNs = now
-		return remote_storage.SetSyncOffset(option.grpcDialOption, pb.ServerAddress(*option.filerAddress), option.bucketsDir, offsetTsNs)
+		return remote_storage.SetSyncOffset(option.grpcDialOption, pb.ServerAddress(*option.filerAddress), option.bucketsDir, resumeTsNsFor(processor))
 	})
 
 	option.clientEpoch++
@@ -63,6 +64,10 @@ func (option *RemoteGatewayOptions) followBucketUpdatesAndUploadToRemote(filerSo
 		StartTsNs:              lastOffsetTs.UnixNano(),
 		StopTsNs:               0,
 		EventErrorType:         pb.RetryForeverOnError,
+		GetResumeTsNs: func() int64 {
+			return resumeTsNsFor(processor)
+		},
+		Resubscribe: processor.ResubscribeCh(),
 	}
 
 	return pb.FollowMetadata(pb.ServerAddress(*option.filerAddress), option.grpcDialOption, metadataFollowOption, processEventFnWithOffset)
@@ -209,11 +214,17 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 		}
 		if filer_pb.IsCreate(resp) {
 			if message.NewParentPath == option.bucketsDir {
+				if isSystemPath(message.NewParentPath, message.NewEntry.Name) {
+					return nil
+				}
 				return handleCreateBucket(message.NewEntry)
 			}
 			if isMultipartUploadFile(message.NewParentPath, message.NewEntry.Name) {
 				return nil
 			}
+			if isSystemPath(message.NewParentPath, message.NewEntry.Name) {
+				return nil
+			}
 			// Propagate delete markers as deletions on the remote.
 			// Delete markers are zero-content version entries, so they
 			// would be filtered out by the HasData check below.
@@ -263,7 +274,11 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 				return client.WriteDirectory(dest, message.NewEntry)
 			}
 			glog.V(0).Infof("create %s", remote_storage.FormatLocation(dest))
-			remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewEntry, dest)
+			remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewParentPath, message.NewEntry, dest)
+			if errors.Is(writeErr, errSuperseded) {
+				glog.Errorf("skipping %s: %v", remote_storage.FormatLocation(dest), writeErr)
+				return nil
+			}
 			if writeErr != nil {
 				return writeErr
 			}
@@ -278,7 +293,14 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 			return updateLocalEntry(option, message.NewParentPath, message.NewEntry, remoteEntry)
 		}
 		if filer_pb.IsDelete(resp) {
+			if filer.IsMetadataOnlyDelete(message.OldEntry) {
+				glog.V(2).Infof("skipping remote delete of metadata-only delete: %s/%s", resp.Directory, message.OldEntry.Name)
+				return nil
+			}
 			if resp.Directory == option.bucketsDir {
+				if isSystemPath(resp.Directory, message.OldEntry.Name) {
+					return nil
+				}
 				return handleDeleteBucket(message.OldEntry)
 			}
 			// Skip deletion of internal version files; individual version
@@ -287,6 +309,9 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 				glog.V(2).Infof("skipping delete of internal version path: %s/%s", resp.Directory, message.OldEntry.Name)
 				return nil
 			}
+			if isSystemPath(resp.Directory, message.OldEntry.Name) {
+				return nil
+			}
 			bucket, remoteStorageMountLocation, remoteStorage, ok := option.detectBucketInfo(resp.Directory)
 			if !ok {
 				return nil
@@ -310,6 +335,9 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 					if message.OldEntry.Name == message.NewEntry.Name {
 						return nil
 					}
+					if isSystemPath(resp.Directory, message.OldEntry.Name) || isSystemPath(message.NewParentPath, message.NewEntry.Name) {
+						return nil
+					}
 					if err := handleCreateBucket(message.NewEntry); err != nil {
 						return err
 					}
@@ -326,6 +354,9 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 				glog.V(2).Infof("skipping update of internal version path: %s/%s", message.NewParentPath, message.NewEntry.Name)
 				return nil
 			}
+			if isSystemPath(message.NewParentPath, message.NewEntry.Name) {
+				return nil
+			}
 			oldBucket, oldRemoteStorageMountLocation, oldRemoteStorage, oldOk := option.detectBucketInfo(resp.Directory)
 			newBucket, newRemoteStorageMountLocation, newRemoteStorage, newOk := option.detectBucketInfo(message.NewParentPath)
 			if oldOk && newOk {
@@ -346,10 +377,29 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 					if message.OldEntry.RemoteEntry != nil && filer.IsSameData(message.OldEntry, message.NewEntry) {
 						glog.V(2).Infof("update meta: %+v", resp)
 						oldDest := toRemoteStorageLocation(oldBucket, util.NewFullPath(resp.Directory, message.OldEntry.Name), oldRemoteStorageMountLocation)
-						return client.UpdateFileMetadata(oldDest, message.OldEntry, message.NewEntry)
+						updated, err := client.UpdateFileMetadata(oldDest, message.OldEntry, message.NewEntry)
+						if err != nil {
+							return err
+						}
+						remoteEntry := message.NewEntry.RemoteEntry
+						if remoteEntry == nil {
+							remoteEntry = message.OldEntry.RemoteEntry
+						}
+						// the metadata write can rewrite the object (S3 copies
+						// it in place for a Content-Encoding change, minting a
+						// new ETag): restamp from the object the update
+						// produced when the backend reports it
+						if updated != nil {
+							remoteEntry = updated
+						}
+						return updateLocalEntry(option, message.NewParentPath, message.NewEntry, remoteEntry)
 					} else {
 						newDest := toRemoteStorageLocation(newBucket, util.NewFullPath(message.NewParentPath, message.NewEntry.Name), newRemoteStorageMountLocation)
-						remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewEntry, newDest)
+						remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewParentPath, message.NewEntry, newDest)
+						if errors.Is(writeErr, errSuperseded) {
+							glog.Errorf("skipping %s: %v", remote_storage.FormatLocation(newDest), writeErr)
+							return nil
+						}
 						if writeErr != nil {
 							return writeErr
 						}
@@ -386,7 +436,11 @@ func (option *RemoteGatewayOptions) makeBucketedEventProcessor(filerSource *sour
 				if message.NewEntry.IsDirectory {
 					return client.WriteDirectory(newDest, message.NewEntry)
 				}
-				remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewEntry, newDest)
+				remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewParentPath, message.NewEntry, newDest)
+				if errors.Is(writeErr, errSuperseded) {
+					glog.Errorf("skipping %s: %v", remote_storage.FormatLocation(newDest), writeErr)
+					return nil
+				}
 				if writeErr != nil {
 					return writeErr
 				}
diff --git a/weed/command/filer_remote_gateway_buckets_test.go b/weed/command/filer_remote_gateway_buckets_test.go
new file mode 100644
index 0000000000..d36a21865a
--- /dev/null
+++ b/weed/command/filer_remote_gateway_buckets_test.go
@@ -0,0 +1,53 @@
+package command
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+)
+
+type recordingRemoteMaker struct{ client *recordingRemote }
+
+func (m recordingRemoteMaker) Make(*remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
+	return m.client, nil
+}
+func (m recordingRemoteMaker) HasBucket() bool { return true }
+
+func TestGatewayMetadataOnlyDeleteKeepsTheRemoteObject(t *testing.T) {
+	remote := &recordingRemote{}
+	remote_storage.RemoteStorageClientMakers["gatewaytest"] = recordingRemoteMaker{client: remote}
+	t.Cleanup(func() { delete(remote_storage.RemoteStorageClientMakers, "gatewaytest") })
+	option := &RemoteGatewayOptions{
+		bucketsDir:  "/buckets",
+		mappings:    &remote_pb.RemoteStorageMapping{Mappings: map[string]*remote_pb.RemoteStorageLocation{"/buckets/b": {Name: "gatewaytest", Bucket: "b", Path: "/"}}},
+		remoteConfs: map[string]*remote_pb.RemoteConf{"gatewaytest": {Name: "gatewaytest", Type: "gatewaytest"}},
+	}
+	process, err := option.makeBucketedEventProcessor(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	deleteEvent := func(extended map[string][]byte) *filer_pb.SubscribeMetadataResponse {
+		return &filer_pb.SubscribeMetadataResponse{
+			Directory: "/buckets/b/dir",
+			EventNotification: &filer_pb.EventNotification{
+				OldEntry: &filer_pb.Entry{Name: "obj.bin", Attributes: &filer_pb.FuseAttributes{}, Extended: extended},
+			},
+		}
+	}
+
+	if err := process(deleteEvent(map[string][]byte{filer.ExtKeepRemoteObjectKey: []byte("true")})); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.deletes) != 0 {
+		t.Fatalf("deletes = %+v, want none for a metadata-only delete", remote.deletes)
+	}
+	if err := process(deleteEvent(nil)); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.deletes) != 1 {
+		t.Fatalf("deletes = %+v, want the ordinary delete", remote.deletes)
+	}
+}
diff --git a/weed/command/filer_remote_sync_dir.go b/weed/command/filer_remote_sync_dir.go
index 4051f396e8..38261cac68 100644
--- a/weed/command/filer_remote_sync_dir.go
+++ b/weed/command/filer_remote_sync_dir.go
@@ -1,8 +1,11 @@
 package command
 
 import (
+	"bytes"
 	"context"
+	"errors"
 	"fmt"
+	"io"
 	"os"
 	"strings"
 	"time"
@@ -18,6 +21,8 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/replication/source"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -39,14 +44,6 @@ func followUpdatesAndUploadToRemote(option *RemoteSyncOptions, filerSource *sour
 
 	var lastLogTsNs = time.Now().UnixNano()
 	processEventFnWithOffset := pb.AddOffsetFunc(func(resp *filer_pb.SubscribeMetadataResponse) error {
-		if resp.EventNotification.NewEntry != nil {
-			if *option.storageClass == "" {
-				delete(resp.EventNotification.NewEntry.Extended, s3_constants.AmzStorageClass)
-			} else {
-				resp.EventNotification.NewEntry.Extended[s3_constants.AmzStorageClass] = []byte(*option.storageClass)
-			}
-		}
-
 		processor.AddSyncJob(resp)
 		return nil
 	}, 3*time.Second, func(counter int64, lastTsNs int64) error {
@@ -58,7 +55,7 @@ func followUpdatesAndUploadToRemote(option *RemoteSyncOptions, filerSource *sour
 		now := time.Now().UnixNano()
 		glog.V(0).Infof("remote sync %s progressed to %v %0.2f/sec", *option.filerAddress, time.Unix(0, offsetTsNs), float64(counter)/(float64(now-lastLogTsNs)/1e9))
 		lastLogTsNs = now
-		return remote_storage.SetSyncOffset(option.grpcDialOption, pb.ServerAddress(*option.filerAddress), mountedDir, offsetTsNs)
+		return remote_storage.SetSyncOffset(option.grpcDialOption, pb.ServerAddress(*option.filerAddress), mountedDir, resumeTsNsFor(processor))
 	})
 
 	option.clientEpoch++
@@ -79,6 +76,10 @@ func followUpdatesAndUploadToRemote(option *RemoteSyncOptions, filerSource *sour
 		StartTsNs:              lastOffsetTs.UnixNano(),
 		StopTsNs:               0,
 		EventErrorType:         pb.RetryForeverOnError,
+		GetResumeTsNs: func() int64 {
+			return resumeTsNsFor(processor)
+		},
+		Resubscribe: processor.ResubscribeCh(),
 	}
 
 	return pb.FollowMetadata(pb.ServerAddress(*option.filerAddress), option.grpcDialOption, metadataFollowOption, processEventFnWithOffset)
@@ -139,109 +140,30 @@ func (option *RemoteSyncOptions) makeEventProcessor(remoteStorage *remote_pb.Rem
 		if filer_pb.IsEmpty(resp) {
 			return nil
 		}
+		mustSend := false
+		var renameSrc util.FullPath
+		if message.OldEntry != nil && message.NewEntry != nil {
+			reshaped, inMount := reshapeCrossMountRename(mountedDir, resp)
+			if !inMount {
+				return nil
+			}
+			// a create reshaped from a rename into the mount can carry a
+			// RemoteEntry earned at the old path: it stamps the old key, so
+			// it cannot vouch for this destination
+			mustSend = filer_pb.IsCreate(reshaped)
+			if mustSend {
+				renameSrc = util.NewFullPath(resp.Directory, message.OldEntry.Name)
+			}
+			resp, message = reshaped, reshaped.EventNotification
+		}
 		if filer_pb.IsCreate(resp) {
-			if isMultipartUploadFile(message.NewParentPath, message.NewEntry.Name) {
-				return nil
-			}
-			// Propagate delete markers as deletions on the remote.
-			// Delete markers are zero-content version entries, so they
-			// would be filtered out by the HasData check below.
-			if isDeleteMarker(message.NewEntry) {
-				if newParent, newName, ok := rewriteVersionedSourcePath(message.NewParentPath, message.NewEntry.Name); ok {
-					dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(newParent, newName), remoteStorageMountLocation)
-					return syncDeleteMarker(client, option, message, dest)
-				}
-				return nil
-			}
-			if !filer.HasData(message.NewEntry) {
-				return nil
-			}
-			glog.V(2).Infof("create: %+v", resp)
-			if !shouldSendToRemote(message.NewEntry) {
-				glog.V(2).Infof("skipping creating: %+v", resp)
-				return nil
-			}
-			// Rewrite internal versioning paths to the original S3 key
-			// to prevent double-versioning when central also has versioning enabled
-			parentPath, entryName := message.NewParentPath, message.NewEntry.Name
-			isRewrittenVersion := false
-			if newParent, newName, ok := rewriteVersionedSourcePath(parentPath, entryName); ok {
-				glog.V(0).Infof("rewrite versioned path %s/%s -> %s/%s", parentPath, entryName, newParent, newName)
-				parentPath, entryName = newParent, newName
-				isRewrittenVersion = true
-			}
-			dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(parentPath, entryName), remoteStorageMountLocation)
-			if message.NewEntry.IsDirectory {
-				glog.V(0).Infof("mkdir  %s", remote_storage.FormatLocation(dest))
-				return client.WriteDirectory(dest, message.NewEntry)
-			}
-			glog.V(0).Infof("create %s", remote_storage.FormatLocation(dest))
-			remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewEntry, dest)
-			if writeErr != nil {
-				return writeErr
-			}
-			// Skip updateLocalEntry for versioned rewrites: the logical
-			// object (e.g. file.xml) has no filer entry in versioned
-			// buckets, and stamping the internal v_* entry with a
-			// RemoteEntry for the logical key is semantically wrong.
-			// Replay is safe because S3 PutObject is idempotent.
-			if isRewrittenVersion {
-				return nil
-			}
-			return updateLocalEntry(option, message.NewParentPath, message.NewEntry, remoteEntry)
+			return processCreateEvent(option, filerSource, *option.storageClass, client, mountedDir, remoteStorageMountLocation, resp, mustSend, renameSrc)
 		}
 		if filer_pb.IsDelete(resp) {
-			// Skip deletion of internal version files; individual version
-			// deletes should not propagate to the remote object
-			if isVersionedPath(resp.Directory, message.OldEntry.Name, message.OldEntry.IsDirectory) {
-				glog.V(2).Infof("skipping delete of internal version path: %s/%s", resp.Directory, message.OldEntry.Name)
-				return nil
-			}
-			glog.V(2).Infof("delete: %+v", resp)
-			dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(resp.Directory, message.OldEntry.Name), remoteStorageMountLocation)
-			if message.OldEntry.IsDirectory {
-				glog.V(0).Infof("rmdir  %s", remote_storage.FormatLocation(dest))
-				return client.RemoveDirectory(dest)
-			}
-			glog.V(0).Infof("delete %s", remote_storage.FormatLocation(dest))
-			return client.DeleteFile(dest)
+			return processDeleteEvent(filerSource, client, mountedDir, remoteStorageMountLocation, resp)
 		}
 		if message.OldEntry != nil && message.NewEntry != nil {
-			if isMultipartUploadFile(message.NewParentPath, message.NewEntry.Name) {
-				return nil
-			}
-			// Skip updates to internal version paths
-			if isVersionedPath(message.NewParentPath, message.NewEntry.Name, message.NewEntry.IsDirectory) {
-				glog.V(2).Infof("skipping update of internal version path: %s/%s", message.NewParentPath, message.NewEntry.Name)
-				return nil
-			}
-			oldDest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(resp.Directory, message.OldEntry.Name), remoteStorageMountLocation)
-			dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(message.NewParentPath, message.NewEntry.Name), remoteStorageMountLocation)
-			if !shouldSendToRemote(message.NewEntry) {
-				glog.V(2).Infof("skipping updating: %+v", resp)
-				return nil
-			}
-			if message.NewEntry.IsDirectory {
-				return client.WriteDirectory(dest, message.NewEntry)
-			}
-			if resp.Directory == message.NewParentPath && message.OldEntry.Name == message.NewEntry.Name {
-				if filer.IsSameData(message.OldEntry, message.NewEntry) {
-					glog.V(2).Infof("update meta: %+v", resp)
-					return client.UpdateFileMetadata(dest, message.OldEntry, message.NewEntry)
-				}
-			}
-			glog.V(2).Infof("update: %+v", resp)
-			glog.V(0).Infof("delete %s", remote_storage.FormatLocation(oldDest))
-			if err := client.DeleteFile(oldDest); err != nil {
-				if isMultipartUploadFile(resp.Directory, message.OldEntry.Name) {
-					return nil
-				}
-			}
-			remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewEntry, dest)
-			if writeErr != nil {
-				return writeErr
-			}
-			return updateLocalEntry(option, message.NewParentPath, message.NewEntry, remoteEntry)
+			return processUpdateEvent(option, filerSource, *option.storageClass, client, mountedDir, remoteStorageMountLocation, resp)
 		}
 
 		return nil
@@ -249,18 +171,809 @@ func (option *RemoteSyncOptions) makeEventProcessor(remoteStorage *remote_pb.Rem
 	return eachEntryFunc, nil
 }
 
-func retriedWriteFile(client remote_storage.RemoteStorageClient, filerSource *source.FilerSource, newEntry *filer_pb.Entry, dest *remote_pb.RemoteStorageLocation) (remoteEntry *filer_pb.RemoteEntry, err error) {
-	var writeErr error
-	err = util.Retry("writeFile", func() error {
-		reader := filer.NewFileReader(filerSource, newEntry)
-		glog.V(0).Infof("create %s", remote_storage.FormatLocation(dest))
-		remoteEntry, writeErr = client.WriteFile(dest, newEntry, reader)
-		if writeErr != nil {
-			return writeErr
+// reshapeCrossMountRename maps an update event onto the side of it the mount
+// covers. The subscription delivers a rename when either of its paths lies
+// under the mounted directory, and only a path under it maps to a remote
+// key: toRemoteStorageLocation slices the mount prefix off, which panics on
+// a shorter path and names a key in the wrong tree on a longer one. A rename
+// into the mount is the creation of the new entry, a rename out of it the
+// deletion of the old entry's object, unless that entry is remote-only and
+// the object holds its only copy. An update with both paths inside is
+// returned as is; one with neither is not the mount's (false).
+func reshapeCrossMountRename(mountedDir string, resp *filer_pb.SubscribeMetadataResponse) (*filer_pb.SubscribeMetadataResponse, bool) {
+	message := resp.EventNotification
+	oldInMount := isUnderMount(mountedDir, resp.Directory, message.OldEntry.Name)
+	newInMount := isUnderMount(mountedDir, message.NewParentPath, message.NewEntry.Name)
+	switch {
+	case oldInMount && newInMount:
+		return resp, true
+	case newInMount:
+		glog.V(0).Infof("rename into mount %s: %s/%s -> %s/%s, creating", mountedDir, resp.Directory, message.OldEntry.Name, message.NewParentPath, message.NewEntry.Name)
+		return &filer_pb.SubscribeMetadataResponse{
+			Directory:         message.NewParentPath,
+			EventNotification: &filer_pb.EventNotification{NewEntry: message.NewEntry, NewParentPath: message.NewParentPath, Signatures: message.Signatures},
+			TsNs:              resp.TsNs,
+		}, true
+	case oldInMount:
+		if isRemoteOnly(message.OldEntry) {
+			glog.V(0).Infof("rename out of mount %s: %s/%s -> %s/%s, keeping the remote-only object", mountedDir, resp.Directory, message.OldEntry.Name, message.NewParentPath, message.NewEntry.Name)
+			return nil, false
+		}
+		glog.V(0).Infof("rename out of mount %s: %s/%s -> %s/%s, deleting", mountedDir, resp.Directory, message.OldEntry.Name, message.NewParentPath, message.NewEntry.Name)
+		return &filer_pb.SubscribeMetadataResponse{
+			Directory:         resp.Directory,
+			EventNotification: &filer_pb.EventNotification{OldEntry: message.OldEntry, Signatures: message.Signatures},
+			TsNs:              resp.TsNs,
+		}, true
+	default:
+		return nil, false
+	}
+}
+
+// isUnderMount reports whether dir/name is the mounted directory or lies
+// below it; a trailing slash on the mount flag does not change the answer.
+func isUnderMount(mountedDir string, dir string, name string) bool {
+	mount := strings.TrimSuffix(mountedDir, "/")
+	path := string(util.NewFullPath(dir, name))
+	return path == mount || strings.HasPrefix(path, mount+"/")
+}
+
+// processCreateEvent uploads a created entry to the remote key its path maps
+// to. mustSend skips the sync-stamp check: a create reshaped out of a rename
+// into the mount inherits a RemoteEntry stamped at the old path's key, which
+// says nothing about whether this destination holds the content. renameSrc is
+// the path that rename came from, and is empty for a genuine create.
+func processCreateEvent(
+	filerClient filer_pb.FilerClient,
+	filerSource filer_pb.FilerClient,
+	storageClass string,
+	client remote_storage.RemoteStorageClient,
+	mountedDir string,
+	remoteStorageMountLocation *remote_pb.RemoteStorageLocation,
+	resp *filer_pb.SubscribeMetadataResponse,
+	mustSend bool,
+	renameSrc util.FullPath,
+) error {
+	message := resp.EventNotification
+	if isMultipartUploadFile(message.NewParentPath, message.NewEntry.Name) {
+		return nil
+	}
+	if isSystemPath(message.NewParentPath, message.NewEntry.Name) {
+		glog.V(2).Infof("skipping create of system path: %s/%s", message.NewParentPath, message.NewEntry.Name)
+		return nil
+	}
+	// Propagate delete markers as deletions on the remote.
+	// Delete markers are zero-content version entries, so they
+	// would be filtered out by the HasData check below.
+	if isDeleteMarker(message.NewEntry) {
+		if newParent, newName, ok := rewriteVersionedSourcePath(message.NewParentPath, message.NewEntry.Name); ok {
+			dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(newParent, newName), remoteStorageMountLocation)
+			return syncDeleteMarker(client, filerClient, message, dest)
 		}
 		return nil
-	})
+	}
+	// A create reshaped from a rename into the mount (mustSend) writes an empty
+	// entry as a zero-byte object; a dropped local copy still skips since the
+	// rename already copied its object to the new key. A stamped entry whose
+	// size diverged since (a truncate) is not a dropped copy and sends its
+	// new content.
+	if !filer.HasData(message.NewEntry) && !(mustSend && !isDroppedLocalCopy(message.NewEntry)) {
+		return nil
+	}
+	glog.V(2).Infof("create: %+v", resp)
+	if !mustSend && !shouldSendToRemote(message.NewEntry) {
+		glog.V(2).Infof("skipping creating: %+v", resp)
+		return nil
+	}
+	// Rewrite internal versioning paths to the original S3 key
+	// to prevent double-versioning when central also has versioning enabled
+	parentPath, entryName := message.NewParentPath, message.NewEntry.Name
+	isRewrittenVersion := false
+	if newParent, newName, ok := rewriteVersionedSourcePath(parentPath, entryName); ok {
+		glog.V(0).Infof("rewrite versioned path %s/%s -> %s/%s", parentPath, entryName, newParent, newName)
+		parentPath, entryName = newParent, newName
+		isRewrittenVersion = true
+	}
+	dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(parentPath, entryName), remoteStorageMountLocation)
+	if message.NewEntry.IsDirectory {
+		glog.V(0).Infof("mkdir  %s", remote_storage.FormatLocation(dest))
+		return client.WriteDirectory(dest, remoteWriteEntry(message.NewEntry, storageClass))
+	}
+	remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewParentPath, remoteWriteEntry(message.NewEntry, storageClass), dest)
+	if errors.Is(writeErr, errSuperseded) {
+		glog.Errorf("skipping %s: %v", remote_storage.FormatLocation(dest), writeErr)
+		if mustSend {
+			return recoverSupersededCreate(filerClient, filerSource, client, mountedDir, remoteStorageMountLocation, message.NewParentPath, message.NewEntry.Name, renameSrc, dest, storageClass)
+		}
+		return nil
+	}
+	if writeErr != nil {
+		return writeErr
+	}
+	// Skip updateLocalEntry for versioned rewrites: the logical
+	// object (e.g. file.xml) has no filer entry in versioned
+	// buckets, and stamping the internal v_* entry with a
+	// RemoteEntry for the logical key is semantically wrong.
+	// Replay is safe because S3 PutObject is idempotent.
+	if isRewrittenVersion {
+		return nil
+	}
+	return updateLocalEntry(filerClient, message.NewParentPath, message.NewEntry, remoteEntry)
+}
+
+// processDeleteEvent removes the remote object an entry mapped to. A remote
+// object that is already absent counts as deleted: the entry was never
+// uploaded (created and deleted faster than the sync ran, or a replay of an
+// event the inline delete already handled), and GCS reports that case as
+// ErrRemoteObjectNotFound where S3 and Azure answer an idempotent success.
+// Returning the error would pin the sync offset on an event that has nothing
+// left to do. A file whose path a remote-only entry has taken since keeps its
+// object: a rename copied that entry's content to this key, and it exists
+// nowhere else.
+func processDeleteEvent(
+	filerSource filer_pb.FilerClient,
+	client remote_storage.RemoteStorageClient,
+	mountedDir string,
+	remoteStorageMountLocation *remote_pb.RemoteStorageLocation,
+	resp *filer_pb.SubscribeMetadataResponse,
+) error {
+	message := resp.EventNotification
+	// Skip deletion of internal version files; individual version
+	// deletes should not propagate to the remote object
+	if isVersionedPath(resp.Directory, message.OldEntry.Name, message.OldEntry.IsDirectory) {
+		glog.V(2).Infof("skipping delete of internal version path: %s/%s", resp.Directory, message.OldEntry.Name)
+		return nil
+	}
+	if isSystemPath(resp.Directory, message.OldEntry.Name) {
+		glog.V(2).Infof("skipping delete of system path: %s/%s", resp.Directory, message.OldEntry.Name)
+		return nil
+	}
+	if filer.IsMetadataOnlyDelete(message.OldEntry) {
+		glog.V(2).Infof("skipping remote delete of metadata-only delete: %s/%s", resp.Directory, message.OldEntry.Name)
+		return nil
+	}
+	glog.V(2).Infof("delete: %+v", resp)
+	dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(resp.Directory, message.OldEntry.Name), remoteStorageMountLocation)
+	if !message.OldEntry.IsDirectory {
+		// a deleted entry whose rename copy was still pending read its
+		// content from the source its marker names, which nothing else
+		// releases
+		if err := releasePendingSource(filerSource, client, mountedDir, remoteStorageMountLocation, message.OldEntry); err != nil {
+			return err
+		}
+		current, err := currentEntry(filerSource, resp.Directory, message.OldEntry.Name)
+		if err != nil {
+			return err
+		}
+		if isRemoteOnly(current) {
+			glog.V(0).Infof("keep %s: a remote-only entry has taken its path since", remote_storage.FormatLocation(dest))
+			return nil
+		}
+	}
+	if message.OldEntry.IsDirectory {
+		glog.V(0).Infof("rmdir  %s", remote_storage.FormatLocation(dest))
+		return client.RemoveDirectory(dest)
+	}
+	// The object at the key may have been replaced since the delete: a rename
+	// copies another entry's content onto it, a rewrite uploads over it, and a
+	// copy can land before its entry is visible. Delete only an object the
+	// event's stamp still describes.
+	glog.V(0).Infof("delete %s", remote_storage.FormatLocation(dest))
+	return deleteRemoteFileIfUnchanged(client, dest, message.OldEntry.GetRemoteEntry())
+}
+
+// releasePendingSource deletes the source a pending-rename marker on entry
+// names, once nothing needs it. The filer never deletes a marked source: a
+// concurrent rename can copy onto that key before its entry is visible. So
+// the object goes only while it is still the one entry's stamp describes, and
+// no remote-only entry holds its path.
+func releasePendingSource(filerSource filer_pb.FilerClient, client remote_storage.RemoteStorageClient, mountedDir string, remoteStorageMountLocation *remote_pb.RemoteStorageLocation, entry *filer_pb.Entry) error {
+	src := util.FullPath(entry.GetExtended()[filer.ExtRemoteRenameSourceKey])
+	if src == "" || !strings.HasPrefix(string(src), strings.TrimSuffix(mountedDir, "/")+"/") {
+		return nil
+	}
+	srcDest := toRemoteStorageLocation(util.FullPath(mountedDir), src, remoteStorageMountLocation)
+	srcDir, srcName := src.DirAndName()
+	current, err := currentEntry(filerSource, srcDir, srcName)
 	if err != nil {
+		return err
+	}
+	if isRemoteOnly(current) {
+		glog.V(0).Infof("keep %s: a remote-only entry holds the pending rename's source", remote_storage.FormatLocation(srcDest))
+		return nil
+	}
+	glog.V(0).Infof("delete %s, the source of a pending rename", remote_storage.FormatLocation(srcDest))
+	return deleteRemoteFileIfUnchanged(client, srcDest, entry.GetRemoteEntry())
+}
+
+// deleteRemoteFile deletes the object and treats an already-absent object as
+// deleted.
+func deleteRemoteFile(client remote_storage.RemoteStorageClient, dest *remote_pb.RemoteStorageLocation) error {
+	if err := client.DeleteFile(dest); err != nil && !errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return err
+	}
+	return nil
+}
+
+// deleteRemoteFileIfUnchanged deletes the object only while it is still the
+// one stamp describes. Backends offering a conditional delete bind the check
+// and the delete into one preconditioned request; the rest fall back to a
+// guarded stat-then-delete.
+func deleteRemoteFileIfUnchanged(client remote_storage.RemoteStorageClient, dest *remote_pb.RemoteStorageLocation, stamp *filer_pb.RemoteEntry) error {
+	if deleter, ok := client.(remote_storage.RemoteStorageConditionalDeleter); ok {
+		deleted, err := deleter.DeleteFileIfUnchanged(dest, stamp)
+		if err != nil {
+			return err
+		}
+		if !deleted {
+			glog.V(0).Infof("keep %s: the object changed since the delete", remote_storage.FormatLocation(dest))
+		}
+		return nil
+	}
+	live, err := client.StatFile(dest)
+	if err != nil && !errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return err
+	}
+	if err == nil && !remote_storage.StillCurrent(stamp, live) {
+		glog.V(0).Infof("keep %s: the object changed since the delete", remote_storage.FormatLocation(dest))
+		return nil
+	}
+	return deleteRemoteFile(client, dest)
+}
+
+func processUpdateEvent(
+	filerClient filer_pb.FilerClient,
+	filerSource filer_pb.FilerClient,
+	storageClass string,
+	client remote_storage.RemoteStorageClient,
+	mountedDir string,
+	remoteStorageMountLocation *remote_pb.RemoteStorageLocation,
+	resp *filer_pb.SubscribeMetadataResponse,
+) error {
+	message := resp.EventNotification
+	if isMultipartUploadFile(message.NewParentPath, message.NewEntry.Name) {
+		return nil
+	}
+	if isVersionedPath(message.NewParentPath, message.NewEntry.Name, message.NewEntry.IsDirectory) {
+		glog.V(2).Infof("skipping update of internal version path: %s/%s", message.NewParentPath, message.NewEntry.Name)
+		return nil
+	}
+	if isSystemPath(message.NewParentPath, message.NewEntry.Name) {
+		glog.V(2).Infof("skipping update of system path: %s/%s", message.NewParentPath, message.NewEntry.Name)
+		return nil
+	}
+	oldDest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(resp.Directory, message.OldEntry.Name), remoteStorageMountLocation)
+	dest := toRemoteStorageLocation(util.FullPath(mountedDir), util.NewFullPath(message.NewParentPath, message.NewEntry.Name), remoteStorageMountLocation)
+	eventSource := renameSource{path: util.NewFullPath(resp.Directory, message.OldEntry.Name), loc: oldDest, stamp: message.OldEntry.GetRemoteEntry()}
+	// sourceOf is where a remote-only entry's content is: the source its
+	// pending-rename marker names, which may be an earlier rename's old key,
+	// or else the event's old key
+	sourceOf := func(entry *filer_pb.Entry, fallback renameSource) renameSource {
+		if src := string(entry.Extended[filer.ExtRemoteRenameSourceKey]); strings.HasPrefix(src, strings.TrimSuffix(mountedDir, "/")+"/") {
+			// a pending entry carries the stamp of the source it reads
+			return renameSource{path: util.FullPath(src), loc: toRemoteStorageLocation(util.FullPath(mountedDir), util.FullPath(src), remoteStorageMountLocation), stamp: entry.GetRemoteEntry()}
+		}
+		return fallback
+	}
+	if proto.Equal(oldDest, dest) && !shouldSendToRemote(message.NewEntry) {
+		glog.V(2).Infof("skipping updating: %+v", resp)
+		return nil
+	}
+	if message.NewEntry.IsDirectory {
+		return client.WriteDirectory(dest, remoteWriteEntry(message.NewEntry, storageClass))
+	}
+	if isMetadataOnlyUpdate(resp.Directory, message) {
+		remoteEntry, err := liveRemoteEntry(filerClient, message.NewParentPath, message.NewEntry)
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			glog.V(2).Infof("skipping updating deleted entry: %+v", resp)
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if remoteEntry != nil {
+			glog.V(2).Infof("update meta: %+v", resp)
+			updated, err := client.UpdateFileMetadata(dest, message.OldEntry, remoteWriteEntry(message.NewEntry, storageClass))
+			if err != nil {
+				return err
+			}
+			// a metadata write can rewrite the object (S3 copies it in place
+			// for a Content-Encoding change, minting a new ETag): restamp from
+			// the object the update produced when the backend reports it
+			if updated != nil {
+				remoteEntry = updated
+			}
+			return updateLocalEntry(filerClient, message.NewParentPath, message.NewEntry, remoteEntry)
+		}
+		glog.V(0).Infof("never replicated, uploading %s", remote_storage.FormatLocation(dest))
+	}
+	if proto.Equal(oldDest, dest) && isDroppedLocalCopy(message.NewEntry) {
+		// The update dropped the local copy: remote.uncache, eviction under
+		// storage pressure, or remote.meta.sync pulling a newer remote
+		// version. Each clears the sync stamp, so shouldSendToRemote reads
+		// the entry as dirty when the remote mtime shares its second. The
+		// content is the object at this very key, and uploading the chunkless
+		// entry would replace it with zero bytes.
+		glog.V(2).Infof("skipping update of remote-only entry: %+v", resp)
+		return nil
+	}
+	glog.V(2).Infof("update: %+v", resp)
+	if !proto.Equal(oldDest, dest) {
+		// A renamed entry that holds no local data now (the snapshot was
+		// remote-only, or remote.uncache ran since) has its content only as a
+		// remote object. Remote-only reads resolve by the entry's own path, so
+		// the rename completes only once the destination object holds it. The
+		// filer's current state decides, not the snapshot: an entry rewritten
+		// since the event has local data again, and the rewrite's bytes are
+		// what the destination must hold.
+		current, err := currentEntry(filerSource, message.NewParentPath, message.NewEntry.Name)
+		if err != nil {
+			return err
+		}
+		if isRemoteOnly(current) {
+			source := sourceOf(current, eventSource)
+			if err := completeRemoteOnlyRename(filerClient, client, message.NewParentPath, current, source, dest, storageClass); err != nil {
+				return err
+			}
+			// a pending entry the filer copied on this rename leaves the
+			// source its marker named
+			if pending := sourceOf(message.OldEntry, renameSource{}); pending.loc != nil && !proto.Equal(pending.loc, source.loc) {
+				return releasePendingSource(filerSource, client, mountedDir, remoteStorageMountLocation, message.OldEntry)
+			}
+			return nil
+		}
+		if current == nil && len(message.NewEntry.Extended[filer.ExtRemoteRenameSourceKey]) > 0 {
+			// the rename's copy was pending and the entry has moved on: a
+			// later rename carries the source in its own marker and finishes
+			// or releases it, so this one leaves it
+			glog.V(0).Infof("keep %s: the pending rename moved on", remote_storage.FormatLocation(oldDest))
+			return nil
+		}
+		glog.V(0).Infof("delete %s", remote_storage.FormatLocation(oldDest))
+		if err := client.DeleteFile(oldDest); err != nil {
+			if isMultipartUploadFile(resp.Directory, message.OldEntry.Name) || isSystemPath(resp.Directory, message.OldEntry.Name) {
+				return nil
+			}
+			if !errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+				return err
+			}
+		}
+	}
+	remoteEntry, writeErr := retriedWriteFile(client, filerSource, message.NewParentPath, remoteWriteEntry(message.NewEntry, storageClass), dest)
+	if errors.Is(writeErr, errSuperseded) {
+		glog.Errorf("skipping %s: %v", remote_storage.FormatLocation(dest), writeErr)
+		if !proto.Equal(oldDest, dest) {
+			if err := uploadCurrentEntry(filerClient, filerSource, client, message.NewParentPath, message.NewEntry.Name, eventSource, dest, storageClass, sourceOf); err != nil {
+				return err
+			}
+			return releaseRenamedSource(filerSource, client, mountedDir, remoteStorageMountLocation, message)
+		}
+		return nil
+	}
+	if writeErr != nil {
+		return writeErr
+	}
+	if err := updateLocalEntry(filerClient, message.NewParentPath, message.NewEntry, remoteEntry); err != nil {
+		return err
+	}
+	if !proto.Equal(oldDest, dest) {
+		return releaseRenamedSource(filerSource, client, mountedDir, remoteStorageMountLocation, message)
+	}
+	return nil
+}
+
+// releaseRenamedSource releases a pending source the renamed entry's old
+// version read, once the destination holds the content on the remote under
+// its own key: only after the upload and its stamp, which clears the marker,
+// and only if the entry does not read through a marker any more. Released
+// earlier, an upload that fails followed by remote.uncache would leave the
+// entry reading a deleted source.
+func releaseRenamedSource(filerSource filer_pb.FilerClient, client remote_storage.RemoteStorageClient, mountedDir string, remoteStorageMountLocation *remote_pb.RemoteStorageLocation, message *filer_pb.EventNotification) error {
+	if len(message.OldEntry.GetExtended()[filer.ExtRemoteRenameSourceKey]) == 0 {
+		return nil
+	}
+	current, err := currentEntry(filerSource, message.NewParentPath, message.NewEntry.Name)
+	if err != nil {
+		return err
+	}
+	if current != nil && len(current.Extended[filer.ExtRemoteRenameSourceKey]) > 0 {
+		return nil
+	}
+	return releasePendingSource(filerSource, client, mountedDir, remoteStorageMountLocation, message.OldEntry)
+}
+
+// currentEntry returns what the filer holds at dir/name now, nil when the
+// entry is gone.
+func currentEntry(filerSource filer_pb.FilerClient, dir, name string) (*filer_pb.Entry, error) {
+	current, _, _, err := filer_pb.GetEntry(context.Background(), filerSource, util.NewFullPath(dir, name))
+	if errors.Is(err, filer_pb.ErrNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return current, nil
+}
+
+// isRemoteOnly reports an entry whose content exists only as its remote
+// object: no local data, a RemoteEntry with a size.
+func isRemoteOnly(entry *filer_pb.Entry) bool {
+	return entry != nil && !filer.HasData(entry) && entry.IsInRemoteOnly()
+}
+
+// isDroppedLocalCopy reports a remote-only entry whose size is still the
+// remote object's: its local copy was dropped and the object describes it.
+// Uncache and eviction keep the size, and remote.meta.sync sets it from the
+// object. A truncate drops the chunks too but changes the size, and the
+// truncated content has to reach the remote.
+func isDroppedLocalCopy(entry *filer_pb.Entry) bool {
+	return isRemoteOnly(entry) && entry.GetAttributes().GetFileSize() == uint64(entry.RemoteEntry.RemoteSize)
+}
+
+// completeRemoteOnlyRename finishes a rename whose content exists only on the
+// remote. When the destination object already holds what the entry's stamp
+// describes (the rename ran before, its offset was not persisted, and
+// remote.uncache followed), the old key goes. Otherwise the old object is
+// copied over the destination, the entry is stamped with the copy, and the
+// old key goes. With neither object present the content is lost: the event
+// fails and holds the offset for recovery.
+func completeRemoteOnlyRename(filerClient filer_pb.FilerClient, client remote_storage.RemoteStorageClient, dir string, current *filer_pb.Entry, source renameSource, dest *remote_pb.RemoteStorageLocation, storageClass string) error {
+	oldDest := source.loc
+	// the source's recorded stamp; a retry can find the entry already
+	// stamped with the copy, whose ETag a multipart source does not share
+	sourceStamp := source.stamp
+	if sourceStamp == nil {
+		sourceStamp = proto.Clone(current.RemoteEntry).(*filer_pb.RemoteEntry)
+	}
+	if existing, err := client.StatFile(dest); err == nil {
+		if remote_storage.Describes(current.RemoteEntry, existing) {
+			glog.V(0).Infof("%s already holds the renamed content", remote_storage.FormatLocation(dest))
+			if len(current.Extended[filer.ExtRemoteRenameSourceKey]) > 0 {
+				// reads still go to the source until the stamp clears the marker
+				if err := updateLocalEntry(filerClient, dir, current, existing); err != nil {
+					return err
+				}
+			}
+			return deleteRenameSource(filerClient, client, dir, current.Name, source, sourceStamp)
+		}
+		glog.V(0).Infof("%s holds an object the entry does not describe (size %d, want %d); replacing it from %s", remote_storage.FormatLocation(dest), existing.RemoteSize, current.RemoteEntry.RemoteSize, remote_storage.FormatLocation(oldDest))
+	} else if !errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return err
+	}
+	stat, err := client.StatFile(oldDest)
+	if errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return fmt.Errorf("%s: content is on neither %s nor %s", util.NewFullPath(dir, current.Name), remote_storage.FormatLocation(oldDest), remote_storage.FormatLocation(dest))
+	}
+	if err != nil {
+		return err
+	}
+	reader, err := openRemoteObject(client, oldDest, stat.RemoteSize)
+	if err != nil {
+		return err
+	}
+	defer reader.Close()
+	glog.V(0).Infof("copy %s -> %s", remote_storage.FormatLocation(oldDest), remote_storage.FormatLocation(dest))
+	remoteEntry, err := client.WriteFile(dest, remoteWriteEntry(current, storageClass), reader)
+	if err != nil {
+		return err
+	}
+	if err := updateLocalEntry(filerClient, dir, current, remoteEntry); err != nil {
+		return err
+	}
+	return deleteRenameSource(filerClient, client, dir, current.Name, source, sourceStamp)
+}
+
+// renameSource is where a renamed remote-only entry's content was read
+// from: the path, the object it maps to, and the stamp describing it.
+type renameSource struct {
+	path  util.FullPath
+	loc   *remote_pb.RemoteStorageLocation
+	stamp *filer_pb.RemoteEntry
+}
+
+// deleteRenameSource deletes a rename's old key once the renamed entry no
+// longer reads it: an entry still carrying the pending-source marker (its
+// stamp lost a race) keeps the source, and the event is retried. The key is
+// left alone when the object there is no longer the one stamp describes, as
+// when another rename copied onto it, visible yet or not.
+func deleteRenameSource(filerClient filer_pb.FilerClient, client remote_storage.RemoteStorageClient, dir, name string, source renameSource, stamp *filer_pb.RemoteEntry) error {
+	current, err := currentEntry(filerClient, dir, name)
+	if err != nil {
+		return err
+	}
+	if current != nil && len(current.Extended[filer.ExtRemoteRenameSourceKey]) > 0 {
+		return fmt.Errorf("%s still reads %s", util.NewFullPath(dir, name), remote_storage.FormatLocation(source.loc))
+	}
+	if err := deleteRemoteFileIfUnchanged(client, source.loc, stamp); err != nil {
+		return err
+	}
+	return nil
+}
+
+// openRemoteObject streams the object when the client can, and reads it whole
+// otherwise.
+func openRemoteObject(client remote_storage.RemoteStorageClient, loc *remote_pb.RemoteStorageLocation, size int64) (io.ReadCloser, error) {
+	if streamer, ok := client.(remote_storage.RemoteStorageStreamReader); ok {
+		return streamer.ReadFileAsStream(context.Background(), loc, 0, size)
+	}
+	data, err := client.ReadFile(loc, 0, size)
+	if err != nil {
+		return nil, err
+	}
+	return io.NopCloser(bytes.NewReader(data)), nil
+}
+
+// uploadCurrentEntry uploads what the filer holds at dir/name now, when the
+// event that superseded this rename will not. A rename whose snapshot is
+// superseded has already deleted the old key; the rewrite behind it in the
+// log uploads the destination itself unless shouldSendToRemote skips it on
+// the inherited RemoteEntry, whose RemoteMtime can equal the rewrite's mtime
+// within the same second. Only that case uploads here, so the content goes
+// up once. A remote-only entry is finished the way completeRemoteOnlyRename
+// finishes a rename: its stamp can already describe the destination (a sync
+// plus remote.uncache in the meantime), and only then is it complete.
+func uploadCurrentEntry(filerClient filer_pb.FilerClient, filerSource filer_pb.FilerClient, client remote_storage.RemoteStorageClient, dir, name string, oldSource renameSource, dest *remote_pb.RemoteStorageLocation, storageClass string, sourceOf func(*filer_pb.Entry, renameSource) renameSource) error {
+	current, _, _, err := filer_pb.GetEntry(context.Background(), filerSource, util.NewFullPath(dir, name))
+	if errors.Is(err, filer_pb.ErrNotFound) {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if current.IsDirectory {
+		return nil
+	}
+	if isRemoteOnly(current) {
+		return completeRemoteOnlyRename(filerClient, client, dir, current, sourceOf(current, oldSource), dest, storageClass)
+	}
+	if shouldSendToRemote(current) {
+		glog.V(0).Infof("leaving %s to the rewrite that superseded the rename", remote_storage.FormatLocation(dest))
+		return nil
+	}
+	glog.V(0).Infof("uploading the current %s in place of the superseded rename", remote_storage.FormatLocation(dest))
+	remoteEntry, writeErr := retriedWriteFile(client, filerSource, dir, remoteWriteEntry(current, storageClass), dest)
+	if errors.Is(writeErr, errSuperseded) {
+		glog.Errorf("skipping %s: %v", remote_storage.FormatLocation(dest), writeErr)
+		return nil
+	}
+	if writeErr != nil {
+		return writeErr
+	}
+	return updateLocalEntry(filerClient, dir, current, remoteEntry)
+}
+
+// recoverSupersededCreate finishes a create reshaped from a rename into the
+// mount when the filer has moved past the entry the event described. A plain
+// superseded create skips because the superseding event follows in the log; a
+// reshaped one has no later event for this destination. remote.uncache accepts
+// the rename's inherited stamp and drops the chunks, and the update it logs
+// skips the upload through isDroppedLocalCopy, so the content would exist
+// nowhere. What the filer holds now decides: local content uploads here only
+// when the superseding event will not (the stamp-edge case uploadCurrentEntry
+// covers), and remote-only content copies from the object its stamp
+// describes, the way completeRemoteOnlyRename finishes a rename.
+func recoverSupersededCreate(
+	filerClient filer_pb.FilerClient,
+	filerSource filer_pb.FilerClient,
+	client remote_storage.RemoteStorageClient,
+	mountedDir string,
+	remoteStorageMountLocation *remote_pb.RemoteStorageLocation,
+	dir, name string,
+	renameSrc util.FullPath,
+	dest *remote_pb.RemoteStorageLocation,
+	storageClass string,
+) error {
+	current, err := currentEntry(filerSource, dir, name)
+	if err != nil {
+		return err
+	}
+	if current == nil || current.IsDirectory {
+		return nil
+	}
+	if isRemoteOnly(current) {
+		return copyRenameInSource(filerClient, client, mountedDir, remoteStorageMountLocation, dir, current, renameSrc, dest, storageClass)
+	}
+	if shouldSendToRemote(current) {
+		glog.V(0).Infof("leaving %s to the event that superseded the rename", remote_storage.FormatLocation(dest))
+		return nil
+	}
+	glog.V(0).Infof("uploading the current %s in place of the superseded rename", remote_storage.FormatLocation(dest))
+	remoteEntry, writeErr := retriedWriteFile(client, filerSource, dir, remoteWriteEntry(current, storageClass), dest)
+	if errors.Is(writeErr, errSuperseded) {
+		glog.Errorf("skipping %s: %v", remote_storage.FormatLocation(dest), writeErr)
+		return nil
+	}
+	if writeErr != nil {
+		return writeErr
+	}
+	return updateLocalEntry(filerClient, dir, current, remoteEntry)
+}
+
+// copyRenameInSource gives the destination key the content of a remote-only
+// entry a rename carried into the mount. The object sits at the key the
+// renamed-from path maps to on its own mount's remote, or where a
+// pending-rename marker under this mount points. The source object is left
+// alone: the source side removes it through its own delete event. When the
+// destination already holds what the stamp describes (an earlier run copied
+// it), only the stamp is refreshed. With no object on either side the event
+// fails and holds the offset.
+func copyRenameInSource(
+	filerClient filer_pb.FilerClient,
+	client remote_storage.RemoteStorageClient,
+	mountedDir string,
+	remoteStorageMountLocation *remote_pb.RemoteStorageLocation,
+	dir string,
+	current *filer_pb.Entry,
+	renameSrc util.FullPath,
+	dest *remote_pb.RemoteStorageLocation,
+	storageClass string,
+) error {
+	srcClient, srcLoc, err := renameInSource(filerClient, client, mountedDir, remoteStorageMountLocation, current, renameSrc)
+	if err != nil {
+		return err
+	}
+	if existing, err := client.StatFile(dest); err == nil {
+		if remote_storage.Describes(current.RemoteEntry, existing) {
+			glog.V(0).Infof("%s already holds the renamed content", remote_storage.FormatLocation(dest))
+			return updateLocalEntry(filerClient, dir, current, existing)
+		}
+		glog.V(0).Infof("%s holds an object the entry does not describe (size %d, want %d); replacing it from %s", remote_storage.FormatLocation(dest), existing.RemoteSize, current.RemoteEntry.RemoteSize, remote_storage.FormatLocation(srcLoc))
+	} else if !errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return err
+	}
+	stat, err := srcClient.StatFile(srcLoc)
+	if errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return fmt.Errorf("%s: content is on neither %s nor %s", util.NewFullPath(dir, current.Name), remote_storage.FormatLocation(srcLoc), remote_storage.FormatLocation(dest))
+	}
+	if err != nil {
+		return err
+	}
+	reader, err := openRemoteObject(srcClient, srcLoc, stat.RemoteSize)
+	if err != nil {
+		return err
+	}
+	defer reader.Close()
+	glog.V(0).Infof("copy %s -> %s", remote_storage.FormatLocation(srcLoc), remote_storage.FormatLocation(dest))
+	remoteEntry, err := client.WriteFile(dest, remoteWriteEntry(current, storageClass), reader)
+	if err != nil {
+		return err
+	}
+	return updateLocalEntry(filerClient, dir, current, remoteEntry)
+}
+
+// renameInSource locates the object holding a remote-only rename-in entry's
+// content and the client that serves it. A pending-rename marker under this
+// mount names a key on this remote; otherwise the renamed-from path is
+// resolved through the filer's mount mappings to its own mount's remote
+// location, served by this client when the source shares this storage.
+func renameInSource(
+	filerClient filer_pb.FilerClient,
+	client remote_storage.RemoteStorageClient,
+	mountedDir string,
+	remoteStorageMountLocation *remote_pb.RemoteStorageLocation,
+	current *filer_pb.Entry,
+	renameSrc util.FullPath,
+) (remote_storage.RemoteStorageClient, *remote_pb.RemoteStorageLocation, error) {
+	if src := util.FullPath(current.Extended[filer.ExtRemoteRenameSourceKey]); strings.HasPrefix(string(src), strings.TrimSuffix(mountedDir, "/")+"/") {
+		return client, toRemoteStorageLocation(util.FullPath(mountedDir), src, remoteStorageMountLocation), nil
+	}
+	mappings, err := readMountMappings(filerClient)
+	if err != nil {
+		return nil, nil, err
+	}
+	srcMount, srcRemoteLoc, err := filer.FindMountedRemoteMapping(mappings, string(renameSrc))
+	if err != nil {
+		return nil, nil, fmt.Errorf("rename source %s: %w", renameSrc, err)
+	}
+	srcLoc := filer.MapFullPathToRemoteStorageLocation(util.FullPath(srcMount), srcRemoteLoc, renameSrc)
+	if srcRemoteLoc.Name == remoteStorageMountLocation.Name {
+		return client, srcLoc, nil
+	}
+	conf, err := readRemoteStorageConf(filerClient, srcRemoteLoc.Name)
+	if err != nil {
+		return nil, nil, fmt.Errorf("rename source %s: %w", renameSrc, err)
+	}
+	srcClient, err := remote_storage.GetRemoteStorage(conf)
+	if err != nil {
+		return nil, nil, fmt.Errorf("rename source %s: %w", renameSrc, err)
+	}
+	return srcClient, srcLoc, nil
+}
+
+// readMountMappings reads the filer's remote mount table, the file
+// DetectMountInfo reads at startup, through the event's filer client.
+func readMountMappings(filerClient filer_pb.FilerClient) (mappings *remote_pb.RemoteStorageMapping, err error) {
+	var content []byte
+	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		var readErr error
+		content, readErr = filer.ReadInsideFiler(context.Background(), client, filer.DirectoryEtcRemote, filer.REMOTE_STORAGE_MOUNT_FILE)
+		return readErr
+	})
+	if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		return nil, err
+	}
+	return filer.UnmarshalRemoteStorageMappings(content)
+}
+
+// readRemoteStorageConf reads a remote storage's configuration entry.
+func readRemoteStorageConf(filerClient filer_pb.FilerClient, storageName string) (*remote_pb.RemoteConf, error) {
+	var content []byte
+	if err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		var readErr error
+		content, readErr = filer.ReadInsideFiler(context.Background(), client, filer.DirectoryEtcRemote, storageName+filer.REMOTE_STORAGE_CONF_SUFFIX)
+		return readErr
+	}); err != nil {
+		return nil, err
+	}
+	conf := &remote_pb.RemoteConf{}
+	if err := proto.Unmarshal(content, conf); err != nil {
+		return nil, fmt.Errorf("unmarshal %s/%s: %w", filer.DirectoryEtcRemote, storageName+filer.REMOTE_STORAGE_CONF_SUFFIX, err)
+	}
+	return conf, nil
+}
+
+// isSuperseded reports whether the filer has moved past the entry an event
+// described: it is deleted, or it no longer references every chunk the event
+// named. Those are the chunks the filer deletes when an entry is updated, so
+// they are gone from the volume servers, or about to be, and no retry of the
+// upload can succeed. Chunks are compared by file id, not content: a rewrite
+// stores even identical bytes under new ids and drops the old ones. A replay
+// from an earlier offset (-timeAgo) re-emits such events. Failing one holds the
+// sync offset before it, so every restart of the subscription replays it into
+// the same dead chunks, and progress on everything after it in the log is never
+// persisted. Skipping is safe: the event that superseded this one follows in
+// the log, and the delete removes the remote object or the rewrite uploads the
+// current content. A lookup that fails for any other reason keeps the write
+// failure, so the event is retried.
+func isSuperseded(filerClient filer_pb.FilerClient, dir string, entry *filer_pb.Entry) bool {
+	current, _, _, err := filer_pb.GetEntry(context.Background(), filerClient, util.NewFullPath(dir, entry.Name))
+	if errors.Is(err, filer_pb.ErrNotFound) {
+		return true
+	}
+	if err != nil {
+		return false
+	}
+	if !filer.HasData(entry) && filer.HasData(current) {
+		// The event described an entry without data (remote-only, or empty);
+		// the filer has written to it since. Uploading the snapshot would put
+		// an empty object where the write belongs.
+		return true
+	}
+	if len(entry.Content) > 0 || len(current.Content) > 0 {
+		return !bytes.Equal(entry.Content, current.Content)
+	}
+	return len(filer.DoMinusChunks(entry.GetChunks(), current.GetChunks())) > 0
+}
+
+// errSuperseded marks an upload that failed for an entry the filer has since
+// moved past (isSuperseded). The caller skips the event instead of failing it.
+var errSuperseded = errors.New("deleted or rewritten since the event was logged")
+
+// retriedWriteFile uploads the entry, retrying transient failures. The filer is
+// asked whether the entry is superseded before the first attempt and after
+// every failed one, and the upload stops at once when it is. Before: a backlog
+// (a restart resuming from an old offset) carries every intermediate version
+// of a hot file, and uploading each one in turn is wasted bandwidth that can
+// trip the remote's per-object mutation rate limit; only the version the filer
+// still holds is worth sending. After: a dead chunk reads as a transient
+// "RequestError" from the SDK, and waiting out the backoff on it buys nothing.
+func retriedWriteFile(client remote_storage.RemoteStorageClient, filerSource filer_pb.FilerClient, dir string, newEntry *filer_pb.Entry, dest *remote_pb.RemoteStorageLocation) (remoteEntry *filer_pb.RemoteEntry, err error) {
+	if isSuperseded(filerSource, dir, newEntry) {
+		return nil, fmt.Errorf("%s %w", util.NewFullPath(dir, newEntry.Name), errSuperseded)
+	}
+	err = util.RetryOnError("writeFile", func(err error) bool {
+		return !errors.Is(err, errSuperseded) && util.IsTransientError(err)
+	}, func() error {
+		reader := filer.NewFileReader(filerSource, newEntry)
+		glog.V(0).Infof("create %s", remote_storage.FormatLocation(dest))
+		var writeErr error
+		remoteEntry, writeErr = client.WriteFile(dest, newEntry, reader)
+		if writeErr != nil && isSuperseded(filerSource, dir, newEntry) {
+			return fmt.Errorf("%s %w: %w", util.NewFullPath(dir, newEntry.Name), errSuperseded, writeErr)
+		}
+		return writeErr
+	})
+	if err != nil && !errors.Is(err, errSuperseded) {
 		glog.Errorf("write to %s: %v", dest, err)
 	}
 	return
@@ -291,6 +1004,11 @@ func collectLastSyncOffset(filerClient filer_pb.FilerClient, grpcDialOption grpc
 		}
 	} else {
 		lastOffsetTs = time.Now().Add(-timeAgo)
+		if lastOffsetTsNs, err := remote_storage.GetSyncOffset(grpcDialOption, filerAddress, mountedDir); err == nil && lastOffsetTsNs > 0 {
+			if savedOffsetTs := time.Unix(0, lastOffsetTsNs); savedOffsetTs.Before(lastOffsetTs) {
+				lastOffsetTs = savedOffsetTs
+			}
+		}
 	}
 	return lastOffsetTs
 }
@@ -305,26 +1023,126 @@ func toRemoteStorageLocation(mountDir, sourcePath util.FullPath, remoteMountLoca
 	}
 }
 
+// isMetadataOnlyUpdate reports whether an update leaves the entry at the same
+// path with the same content, so the remote object needs at most its metadata
+// rewritten -- provided it is already there, which liveRemoteEntry establishes.
+func isMetadataOnlyUpdate(dir string, message *filer_pb.EventNotification) bool {
+	if dir != message.NewParentPath || message.OldEntry.Name != message.NewEntry.Name {
+		return false
+	}
+	return filer.IsSameData(message.OldEntry, message.NewEntry)
+}
+
+// liveRemoteEntry returns the RemoteEntry showing the entry's object is on the
+// remote, or nil when it never got there. The event's own is not enough: a
+// chmod right after a write is logged before the sync has uploaded the write
+// and stamped the entry, and treating it as unreplicated would upload twice.
+// Returns filer_pb.ErrNotFound when the entry has since been deleted.
+func liveRemoteEntry(filerClient filer_pb.FilerClient, dir string, entry *filer_pb.Entry) (*filer_pb.RemoteEntry, error) {
+	if entry.RemoteEntry != nil {
+		return entry.RemoteEntry, nil
+	}
+	current, _, _, err := filer_pb.GetEntry(context.Background(), filerClient, util.NewFullPath(dir, entry.Name))
+	if err != nil {
+		return nil, err
+	}
+	return current.RemoteEntry, nil
+}
+
 func shouldSendToRemote(entry *filer_pb.Entry) bool {
 	if entry.RemoteEntry == nil {
 		return true
 	}
-	if entry.RemoteEntry.RemoteMtime < entry.Attributes.Mtime {
-		return true
+	if entry.RemoteEntry.RemoteMtime != entry.Attributes.Mtime {
+		return entry.RemoteEntry.RemoteMtime < entry.Attributes.Mtime
 	}
-	return false
+	// Equal seconds cannot tell a rewrite from the version already
+	// uploaded; the sync stamp can, the same check remote.uncache uses.
+	return entry.RemoteEntry.LastLocalSyncTsNs < entry.Attributes.Mtime*1e9+int64(entry.Attributes.MtimeNs)
 }
 
+// remoteWriteEntry returns the entry as remote storage should see it: the
+// storage class attribute is dropped, or overridden by -storageClass. The
+// event entry is left untouched so updateLocalEntry still compares the entry
+// the filer stored.
+func remoteWriteEntry(entry *filer_pb.Entry, storageClass string) *filer_pb.Entry {
+	clone := proto.Clone(entry).(*filer_pb.Entry)
+	if storageClass == "" {
+		delete(clone.Extended, s3_constants.AmzStorageClass)
+	} else {
+		if clone.Extended == nil {
+			clone.Extended = map[string][]byte{}
+		}
+		clone.Extended[s3_constants.AmzStorageClass] = []byte(storageClass)
+	}
+	return clone
+}
+
+// updateLocalEntry stamps the entry an event described with its RemoteEntry.
+// The write carries IF_ENTRY_EQUAL over the event's entry: the filer deletes
+// every stored chunk absent from an updated entry, so a snapshot older than
+// the live entry (the file was rewritten while its upload was in flight, or
+// the event is a replay) would delete the live chunks. A failed precondition
+// means the filer moved past this event; the event that superseded it follows
+// in the log and stamps the current entry, so the stale stamp is skipped the
+// same way a superseded upload is.
 func updateLocalEntry(filerClient filer_pb.FilerClient, dir string, entry *filer_pb.Entry, remoteEntry *filer_pb.RemoteEntry) error {
+	remoteEntry = proto.Clone(remoteEntry).(*filer_pb.RemoteEntry)
 	remoteEntry.LastLocalSyncTsNs = time.Now().UnixNano()
+	expected := proto.Clone(entry).(*filer_pb.Entry)
 	entry.RemoteEntry = remoteEntry
-	return filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	delete(entry.Extended, filer.ExtRemoteRenameSourceKey)
+	err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		_, err := client.UpdateEntry(context.Background(), &filer_pb.UpdateEntryRequest{
 			Directory: dir,
 			Entry:     entry,
+			Condition: ifEntryEqual(expected),
 		})
 		return err
 	})
+	if isFailedPrecondition(err) {
+		glog.Errorf("skipping stale stamp of %s: %v", util.NewFullPath(dir, entry.Name), err)
+		return nil
+	}
+	if isEntryGone(err) {
+		glog.Errorf("skipping stamp of %s: deleted since the event was logged: %v", util.NewFullPath(dir, entry.Name), err)
+		return nil
+	}
+	return err
+}
+
+// isEntryGone reports an UpdateEntry the filer refused because the entry no
+// longer exists: a delete that followed the event superseded the stamp, and
+// the delete's own event follows in the log. A filer with the typed answer
+// returns codes.NotFound; an older filer returns a plain error of the form
+// "not found <path>: <cause>", so the cause (the message's tail, never the
+// path) is matched against filer_pb.ErrNotFound's text.
+func isEntryGone(err error) bool {
+	if err == nil {
+		return false
+	}
+	if st, ok := status.FromError(err); ok && st.Code() == codes.NotFound {
+		return true
+	}
+	return strings.HasSuffix(strings.TrimSpace(err.Error()), filer_pb.ErrNotFound.Error())
+}
+
+// ifEntryEqual builds the precondition that the stored entry still equals the
+// one the event described: chunk fids, inline content, and metadata alike.
+func ifEntryEqual(entry *filer_pb.Entry) *filer_pb.WriteCondition {
+	return &filer_pb.WriteCondition{
+		Clauses: []*filer_pb.WriteCondition_Clause{{Kind: filer_pb.WriteCondition_IF_ENTRY_EQUAL, ExpectedEntry: entry}},
+	}
+}
+
+// isFailedPrecondition reports a write condition the filer refused, through
+// any wrapping WithFilerClient added.
+func isFailedPrecondition(err error) bool {
+	if err == nil {
+		return false
+	}
+	st, ok := status.FromError(err)
+	return ok && st.Code() == codes.FailedPrecondition
 }
 
 func isMultipartUploadFile(dir string, name string) bool {
@@ -336,6 +1154,23 @@ func isMultipartUploadDir(dir string) bool {
 		strings.Contains(dir, "/"+s3_constants.MultipartUploadsFolder+"/")
 }
 
+// isSystemPath returns true if the dir and name refer to the internal .system folder
+// under /buckets (such as the bucket-owner index at /buckets/.system/owners/...)
+// or any entry inside it. These paths are internal to SeaweedFS and must not
+// be synced to remote storage.
+func isSystemPath(dir string, name string) bool {
+	fullPath := string(util.NewFullPath(dir, name))
+	trimmed := strings.Trim(fullPath, "/")
+	parts := strings.Split(trimmed, "/")
+	if len(parts) >= 1 && parts[0] == s3_constants.SystemFolder {
+		return true
+	}
+	if len(parts) >= 2 && parts[1] == s3_constants.SystemFolder {
+		return true
+	}
+	return false
+}
+
 // isDeleteMarker returns true if the entry is an S3 delete marker
 // (a zero-content version entry with ExtDeleteMarkerKey set to "true").
 func isDeleteMarker(entry *filer_pb.Entry) bool {
@@ -354,7 +1189,7 @@ func syncDeleteMarker(
 	dest *remote_pb.RemoteStorageLocation,
 ) error {
 	glog.V(0).Infof("delete (marker) %s", remote_storage.FormatLocation(dest))
-	if err := client.DeleteFile(dest); err != nil {
+	if err := deleteRemoteFile(client, dest); err != nil {
 		return err
 	}
 	return updateLocalEntry(filerClient, message.NewParentPath, message.NewEntry, &filer_pb.RemoteEntry{
diff --git a/weed/command/filer_remote_sync_dir_test.go b/weed/command/filer_remote_sync_dir_test.go
index 7b73038d0c..5b004bd068 100644
--- a/weed/command/filer_remote_sync_dir_test.go
+++ b/weed/command/filer_remote_sync_dir_test.go
@@ -1,14 +1,25 @@
 package command
 
 import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 )
 
 // TestVersionedFilePathRewrittenForRemote verifies that the fix for
@@ -328,3 +339,2103 @@ func TestRewriteVersionedSourcePath(t *testing.T) {
 		})
 	}
 }
+
+func chunkedEntry(name string, remote *filer_pb.RemoteEntry, etags ...string) *filer_pb.Entry {
+	entry := &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}, RemoteEntry: remote}
+	for i, etag := range etags {
+		entry.Chunks = append(entry.Chunks, &filer_pb.FileChunk{FileId: fmt.Sprintf("3,%02x", i), Offset: int64(i) * 1024, Size: 1024, ETag: etag})
+	}
+	return entry
+}
+
+func TestIsMetadataOnlyUpdate(t *testing.T) {
+	const dir = "/buckets/media"
+	replicated := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 2048, RemoteMtime: 1786096669}
+
+	tests := []struct {
+		name     string
+		dir      string
+		oldEntry *filer_pb.Entry
+		newEntry *filer_pb.Entry
+		want     bool
+	}{
+		{
+			name:     "same chunks",
+			dir:      dir,
+			oldEntry: chunkedEntry("output.pdf", replicated, "e1", "e2"),
+			newEntry: chunkedEntry("output.pdf", replicated, "e1", "e2"),
+			want:     true,
+		},
+		{
+			name:     "same chunks, no RemoteEntry",
+			dir:      dir,
+			oldEntry: chunkedEntry("output.pdf", nil, "e1", "e2"),
+			newEntry: chunkedEntry("output.pdf", nil, "e1", "e2"),
+			want:     true,
+		},
+		{
+			name:     "rewritten chunks",
+			dir:      dir,
+			oldEntry: chunkedEntry("output.pdf", replicated, "e1", "e2"),
+			newEntry: chunkedEntry("output.pdf", replicated, "e1", "e3"),
+			want:     false,
+		},
+		{
+			name:     "first write into an empty entry",
+			dir:      dir,
+			oldEntry: chunkedEntry("output.pdf", nil),
+			newEntry: chunkedEntry("output.pdf", nil, "e1"),
+			want:     false,
+		},
+		{
+			name:     "rename",
+			dir:      dir,
+			oldEntry: chunkedEntry("output.pdf", replicated, "e1"),
+			newEntry: chunkedEntry("renamed.pdf", replicated, "e1"),
+			want:     false,
+		},
+		{
+			name:     "move to another directory",
+			dir:      "/buckets/media/inbox",
+			oldEntry: chunkedEntry("output.pdf", replicated, "e1"),
+			newEntry: chunkedEntry("output.pdf", replicated, "e1"),
+			want:     false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			message := &filer_pb.EventNotification{NewParentPath: dir, OldEntry: tt.oldEntry, NewEntry: tt.newEntry}
+			if got := isMetadataOnlyUpdate(tt.dir, message); got != tt.want {
+				t.Errorf("isMetadataOnlyUpdate = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// stubFilerClient serves one entry; nil means not found. A non-nil err fails
+// every lookup instead. entries, when set, answers lookups by "dir/name"
+// before entry is consulted.
+type stubFilerClient struct {
+	filer_pb.SeaweedFilerClient
+	entry     *filer_pb.Entry
+	entries   map[string]*filer_pb.Entry
+	err       error
+	updateErr error
+	lookups   int
+	updates   int
+	updated   *filer_pb.UpdateEntryRequest
+}
+
+func (c *stubFilerClient) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest, _ ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	c.lookups++
+	if c.err != nil {
+		return nil, c.err
+	}
+	if c.entries != nil {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: c.entries[req.Directory+"/"+req.Name]}, nil
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: c.entry}, nil
+}
+
+func (c *stubFilerClient) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest, _ ...grpc.CallOption) (*filer_pb.UpdateEntryResponse, error) {
+	c.updates++
+	c.updated = req
+	if c.updateErr != nil {
+		return &filer_pb.UpdateEntryResponse{}, c.updateErr
+	}
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+func (c *stubFilerClient) WithFilerClient(_ bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return fn(c)
+}
+
+func (c *stubFilerClient) AdjustedUrl(location *filer_pb.Location) string { return location.Url }
+
+func (c *stubFilerClient) GetDataCenter() string { return "" }
+
+// TestLiveRemoteEntry tells apart the two update events that carry no
+// RemoteEntry: a file never replicated (#11139), which must be uploaded, and a
+// chmod logged before the sync finished uploading the preceding write, which
+// must not be uploaded again.
+func TestLiveRemoteEntry(t *testing.T) {
+	const dir = "/buckets/media"
+	stamped := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 2048, RemoteMtime: 1786096669}
+
+	t.Run("event carries the RemoteEntry, no lookup", func(t *testing.T) {
+		filerClient := &stubFilerClient{}
+		got, err := liveRemoteEntry(filerClient, dir, chunkedEntry("output.pdf", stamped, "e1"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got != stamped {
+			t.Errorf("got %+v, want the event's own RemoteEntry", got)
+		}
+		if filerClient.lookups != 0 {
+			t.Errorf("looked up the filer %d times with the answer already in hand", filerClient.lookups)
+		}
+	})
+
+	t.Run("never replicated", func(t *testing.T) {
+		event := chunkedEntry("output.pdf", nil, "e1")
+		if !shouldSendToRemote(event) {
+			t.Fatal("an entry with no RemoteEntry should be eligible for sending")
+		}
+		filerClient := &stubFilerClient{entry: chunkedEntry("output.pdf", nil, "e1")}
+		got, err := liveRemoteEntry(filerClient, dir, event)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got != nil {
+			t.Errorf("got %+v, want nil so the update takes the write path", got)
+		}
+	})
+
+	t.Run("stamped after the event was logged", func(t *testing.T) {
+		filerClient := &stubFilerClient{entry: chunkedEntry("output.pdf", stamped, "e1")}
+		got, err := liveRemoteEntry(filerClient, dir, chunkedEntry("output.pdf", nil, "e1"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got != stamped {
+			t.Errorf("got %+v, want the filer's current RemoteEntry so the update stays on the metadata path", got)
+		}
+		if filerClient.lookups != 1 {
+			t.Errorf("looked up the filer %d times, want 1", filerClient.lookups)
+		}
+	})
+
+	t.Run("deleted since", func(t *testing.T) {
+		_, err := liveRemoteEntry(&stubFilerClient{}, dir, chunkedEntry("output.pdf", nil, "e1"))
+		if !errors.Is(err, filer_pb.ErrNotFound) {
+			t.Errorf("err = %v, want filer_pb.ErrNotFound so the update is skipped rather than uploaded from a deleted entry", err)
+		}
+	})
+}
+
+func chunk(fileId, etag string) *filer_pb.FileChunk {
+	return &filer_pb.FileChunk{FileId: fileId, Size: 1024, ETag: etag}
+}
+
+func entryWith(name string, remote *filer_pb.RemoteEntry, chunks ...*filer_pb.FileChunk) *filer_pb.Entry {
+	return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}, RemoteEntry: remote, Chunks: chunks}
+}
+
+// TestIsSuperseded decides what a failed upload means for its event (#11148).
+// A replay from an earlier offset re-emits creates for entries the filer has
+// since deleted or rewritten; their chunks are gone, so the upload can never
+// succeed, and failing the event pins the offset before it forever. Those are
+// skipped. A failure to upload an entry the filer still holds as described is
+// a real failure and must keep failing the event so the subscription retries.
+//
+// Every write stores its chunks under new file ids, so the entry is compared
+// by chunk identity, the way the filer itself decides which chunks an update
+// leaves for deletion. Content fingerprints would miss a delete-and-recreate
+// of identical bytes and fail the event forever on its dead chunks.
+func TestIsSuperseded(t *testing.T) {
+	const dir = "/buckets/ingest"
+	event := entryWith("tmpjt9req69__Alan_Doe_Resume-1.pdf", nil, chunk("3,01", "e1"), chunk("3,02", "e2"))
+	stamped := &filer_pb.RemoteEntry{StorageName: "b2", RemoteMtime: 1786096669}
+
+	tests := []struct {
+		name  string
+		filer *stubFilerClient
+		want  bool
+	}{
+		{name: "deleted since", filer: &stubFilerClient{}, want: true},
+		{name: "rewritten since", filer: &stubFilerClient{entry: entryWith(event.Name, nil, chunk("3,01", "e1"), chunk("4,07", "e3"))}, want: true},
+		{name: "recreated with identical content", filer: &stubFilerClient{entry: entryWith(event.Name, nil, chunk("5,11", "e1"), chunk("5,12", "e2"))}, want: true},
+		{name: "recreated with other content", filer: &stubFilerClient{entry: entryWith(event.Name, nil, chunk("6,01", "e9"))}, want: true},
+		{name: "truncated since", filer: &stubFilerClient{entry: entryWith(event.Name, nil, chunk("3,01", "e1"))}, want: true},
+		{name: "still as described", filer: &stubFilerClient{entry: entryWith(event.Name, nil, chunk("3,01", "e1"), chunk("3,02", "e2"))}, want: false},
+		{name: "still as described, since replicated", filer: &stubFilerClient{entry: entryWith(event.Name, stamped, chunk("3,01", "e1"), chunk("3,02", "e2"))}, want: false},
+		{name: "appended since, chunks still live", filer: &stubFilerClient{entry: entryWith(event.Name, nil, chunk("3,01", "e1"), chunk("3,02", "e2"), chunk("3,03", "e3"))}, want: false},
+		{name: "filer lookup failed", filer: &stubFilerClient{err: errors.New("rpc error: code = Unavailable")}, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isSuperseded(tt.filer, dir, event); got != tt.want {
+				t.Errorf("isSuperseded = %v, want %v", got, tt.want)
+			}
+			if tt.filer.lookups != 1 {
+				t.Errorf("looked up the filer %d times, want 1", tt.filer.lookups)
+			}
+		})
+	}
+
+	t.Run("written since: the event described an entry without data", func(t *testing.T) {
+		remoteOnly := entryWith("video.mp4", &filer_pb.RemoteEntry{StorageName: "b2", RemoteSize: 20971520, RemoteMtime: 1786096669})
+		if !isSuperseded(&stubFilerClient{entry: entryWith("video.mp4", remoteOnly.RemoteEntry, chunk("3,09", "e9"))}, dir, remoteOnly) {
+			t.Error("isSuperseded = false, want true: the filer wrote local data to a remote-only entry")
+		}
+		if isSuperseded(&stubFilerClient{entry: entryWith("video.mp4", remoteOnly.RemoteEntry)}, dir, remoteOnly) {
+			t.Error("isSuperseded = true, want false: the entry is still remote-only")
+		}
+		empty := &filer_pb.Entry{Name: "touch.txt", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}}
+		if !isSuperseded(&stubFilerClient{entry: &filer_pb.Entry{Name: "touch.txt", Content: []byte("now")}}, dir, empty) {
+			t.Error("isSuperseded = false, want true: the empty file was written to")
+		}
+		if isSuperseded(&stubFilerClient{entry: &filer_pb.Entry{Name: "touch.txt"}}, dir, empty) {
+			t.Error("isSuperseded = true, want false: the file is still empty")
+		}
+	})
+
+	t.Run("inline content rewritten since", func(t *testing.T) {
+		event := &filer_pb.Entry{Name: "note.txt", Content: []byte("v1")}
+		if !isSuperseded(&stubFilerClient{entry: &filer_pb.Entry{Name: "note.txt", Content: []byte("v2")}}, dir, event) {
+			t.Error("isSuperseded = false, want true for an entry whose inline content has changed")
+		}
+		if isSuperseded(&stubFilerClient{entry: &filer_pb.Entry{Name: "note.txt", Content: []byte("v1")}}, dir, event) {
+			t.Error("isSuperseded = true, want false for an entry whose inline content is unchanged")
+		}
+	})
+}
+
+// failingRemote fails every WriteFile with err and counts the attempts.
+type failingRemote struct {
+	remote_storage.RemoteStorageClient
+	err    error
+	writes int
+}
+
+func (r *failingRemote) WriteFile(*remote_pb.RemoteStorageLocation, *filer_pb.Entry, io.Reader) (*filer_pb.RemoteEntry, error) {
+	r.writes++
+	return nil, r.err
+}
+
+// TestRetriedWriteFileStopsWhenSuperseded checks that a failed upload asks the
+// filer at once, and stops retrying when the entry is gone: the ~13s of backoff
+// util.Retry would spend on a dead chunk buys nothing. An upload of an entry the
+// filer still holds keeps the retry policy it had.
+func TestRetriedWriteFileStopsWhenSuperseded(t *testing.T) {
+	const dir = "/buckets/ingest"
+	event := entryWith("tmpjt9req69__Alan_Doe_Resume-1.pdf", nil, chunk("3,01", "e1"))
+	dest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "tier", Path: "/" + event.Name}
+	// What the S3 SDK reports when the volume server no longer has the chunk:
+	// "requesterror" makes IsTransientError retry it to exhaustion.
+	deadChunk := errors.New("RequestError: send request failed\ncaused by: Put \"https://s3.example.com/tier/x\": http://volume:8444/3,01?readDeleted=true: 404 Not Found: not found")
+
+	t.Run("superseded before the first attempt, no write", func(t *testing.T) {
+		remote := &failingRemote{err: deadChunk}
+		filerClient := &stubFilerClient{}
+		start := time.Now()
+		_, err := retriedWriteFile(remote, filerClient, dir, event, dest)
+		if !errors.Is(err, errSuperseded) {
+			t.Errorf("err = %v, want errSuperseded", err)
+		}
+		if remote.writes != 0 {
+			t.Errorf("wrote %d times, want 0: a superseded version is not worth uploading", remote.writes)
+		}
+		if filerClient.lookups != 1 {
+			t.Errorf("looked up the filer %d times, want 1", filerClient.lookups)
+		}
+		if elapsed := time.Since(start); elapsed > 500*time.Millisecond {
+			t.Errorf("took %v, want no backoff", elapsed)
+		}
+	})
+
+	t.Run("superseded during the attempt, one write", func(t *testing.T) {
+		remote := &failingRemote{err: deadChunk}
+		filerClient := &supersedingFilerClient{live: entryWith(event.Name, nil, chunk("3,01", "e1"))}
+		_, err := retriedWriteFile(remote, filerClient, dir, event, dest)
+		if !errors.Is(err, errSuperseded) {
+			t.Errorf("err = %v, want errSuperseded", err)
+		}
+		if !strings.Contains(err.Error(), "404 Not Found") {
+			t.Errorf("err = %v, want it to keep the write failure", err)
+		}
+		if remote.writes != 1 {
+			t.Errorf("wrote %d times, want 1: retrying a dead chunk cannot succeed", remote.writes)
+		}
+		if filerClient.lookups != 2 {
+			t.Errorf("looked up the filer %d times, want one before the attempt and one after it failed", filerClient.lookups)
+		}
+	})
+
+	t.Run("still as described, transient failure keeps retrying", func(t *testing.T) {
+		prev := util.RetryWaitTime
+		util.RetryWaitTime = 1600 * time.Millisecond // two attempts: 1s, then 1.5s
+		t.Cleanup(func() { util.RetryWaitTime = prev })
+		remote := &failingRemote{err: deadChunk}
+		filerClient := &stubFilerClient{entry: entryWith(event.Name, nil, chunk("3,01", "e1"))}
+		_, err := retriedWriteFile(remote, filerClient, dir, event, dest)
+		if errors.Is(err, errSuperseded) {
+			t.Errorf("err = %v, want the write failure itself", err)
+		}
+		if remote.writes != 2 {
+			t.Errorf("wrote %d times, want 2: a transient failure on a live entry is still retried", remote.writes)
+		}
+		if filerClient.lookups != 3 {
+			t.Errorf("looked up the filer %d times, want one before the first attempt and one per failed attempt", filerClient.lookups)
+		}
+	})
+
+	t.Run("still as described, permanent failure not retried", func(t *testing.T) {
+		remote := &failingRemote{err: errors.New("AccessDenied: Access Denied")}
+		filerClient := &stubFilerClient{entry: entryWith(event.Name, nil, chunk("3,01", "e1"))}
+		_, err := retriedWriteFile(remote, filerClient, dir, event, dest)
+		if err == nil || errors.Is(err, errSuperseded) {
+			t.Errorf("err = %v, want the write failure itself", err)
+		}
+		if remote.writes != 1 {
+			t.Errorf("wrote %d times, want 1", remote.writes)
+		}
+	})
+}
+
+type recordingRemote struct {
+	remote_storage.RemoteStorageClient
+	deletes         []*remote_pb.RemoteStorageLocation
+	writes          []*remote_pb.RemoteStorageLocation
+	metadataUpdates []*remote_pb.RemoteStorageLocation
+	written         [][]byte
+	// chunk ids of each written entry: which version of the file went up
+	writtenChunks [][]string
+	deleteErr     error
+	writeErr      error
+	// objects present on the remote, by path: StatFile and ReadFile answer
+	// from it, everything else is ErrRemoteObjectNotFound.
+	objects map[string][]byte
+	// statETag is the ETag StatFile reports for a present object, unless
+	// statETags names one for its path.
+	statETag  string
+	statETags map[string]string
+	statMtime int64
+	// metadataUpdateResult is the RemoteEntry UpdateFileMetadata reports; nil
+	// means the update left the object untouched
+	metadataUpdateResult *filer_pb.RemoteEntry
+}
+
+func (r *recordingRemote) WriteFile(loc *remote_pb.RemoteStorageLocation, entry *filer_pb.Entry, reader io.Reader) (*filer_pb.RemoteEntry, error) {
+	if r.writeErr != nil {
+		return nil, r.writeErr
+	}
+	r.writes = append(r.writes, loc)
+	var ids []string
+	for _, c := range entry.GetChunks() {
+		ids = append(ids, c.GetFileIdString())
+	}
+	r.writtenChunks = append(r.writtenChunks, ids)
+	// A chunked upload's reader walks volume servers the stub filer cannot
+	// name, so it is not read; the copy path hands over the old object's
+	// stream for a chunkless entry, which is drained.
+	var body []byte
+	if rc, ok := reader.(io.ReadCloser); ok && len(entry.GetChunks()) == 0 && r.objects != nil {
+		body, _ = io.ReadAll(rc)
+	}
+	r.written = append(r.written, body)
+	return &filer_pb.RemoteEntry{StorageName: loc.Name, RemoteETag: "etag", RemoteSize: int64(len(entry.Content)), RemoteMtime: entry.Attributes.GetMtime()}, nil
+}
+
+func (r *recordingRemote) StatFile(loc *remote_pb.RemoteStorageLocation) (*filer_pb.RemoteEntry, error) {
+	body, ok := r.objects[loc.Path]
+	if !ok {
+		return nil, remote_storage.ErrRemoteObjectNotFound
+	}
+	etag := r.statETag
+	if e, ok := r.statETags[loc.Path]; ok {
+		etag = e
+	}
+	return &filer_pb.RemoteEntry{StorageName: loc.Name, RemoteSize: int64(len(body)), RemoteETag: etag, RemoteMtime: r.statMtime}, nil
+}
+
+func (r *recordingRemote) ReadFile(loc *remote_pb.RemoteStorageLocation, offset int64, size int64) ([]byte, error) {
+	body, ok := r.objects[loc.Path]
+	if !ok {
+		return nil, remote_storage.ErrRemoteObjectNotFound
+	}
+	return body[offset : offset+size], nil
+}
+
+func (r *recordingRemote) DeleteFile(loc *remote_pb.RemoteStorageLocation) error {
+	r.deletes = append(r.deletes, loc)
+	return r.deleteErr
+}
+
+func (r *recordingRemote) UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry, newEntry *filer_pb.Entry) (*filer_pb.RemoteEntry, error) {
+	r.metadataUpdates = append(r.metadataUpdates, loc)
+	return r.metadataUpdateResult, nil
+}
+
+// TestRenameWithInheritedRemoteEntryWritesNewKey reproduces #11261: a rename
+// arrives as an update whose NewEntry carries the RemoteEntry inherited from
+// the source. shouldSendToRemote returns false for it (the sync stamp covers
+// the entry's mtime), so the old code skipped the event and never wrote the
+// new key, while the filer had already deleted the old object. A path change
+// must always write.
+func TestRenameWithInheritedRemoteEntryWritesNewKey(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/"}
+
+	replicated := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 2048, RemoteMtime: 1786096669, LastLocalSyncTsNs: 1786096669*1e9 + 1}
+	oldEntry := &filer_pb.Entry{Name: "probe.bin", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}, RemoteEntry: replicated}
+	newEntry := &filer_pb.Entry{
+		Name:        "probe.bin",
+		Content:     []byte("payload"),
+		Attributes:  &filer_pb.FuseAttributes{Mtime: 1786096669},
+		RemoteEntry: replicated,
+	}
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/src",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      oldEntry,
+			NewParentPath: "/buckets/b/dst",
+			NewEntry:      newEntry,
+		},
+	}
+
+	if shouldSendToRemote(newEntry) {
+		t.Fatal("precondition: inherited RemoteEntry should make shouldSendToRemote false, the bug's trigger")
+	}
+
+	remote := &recordingRemote{}
+	// the filer still holds the renamed entry as the event described it
+	filerClient := &stubFilerClient{entry: newEntry}
+	if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+		t.Fatal(err)
+	}
+
+	wantDelete := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/src/probe.bin"}
+	if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], wantDelete) {
+		t.Errorf("deletes = %+v, want the old key %s deleted", remote.deletes, remote_storage.FormatLocation(wantDelete))
+	}
+	wantWrite := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/dst/probe.bin"}
+	if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], wantWrite) {
+		t.Errorf("writes = %+v, want the new key %s written", remote.writes, remote_storage.FormatLocation(wantWrite))
+	}
+}
+
+// TestRenameRemoteOnlyEntrySkipsEmptyUpload guards the edge case from the
+// review of #11261: a remote-only entry (no local chunks, content lives only
+// on the remote object the filer already deleted) must not be re-uploaded,
+// since NewFileReader would supply EOF and create a zero-byte object.
+func TestRenameRemoteOnlyEntrySkipsEmptyUpload(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/"}
+
+	remoteOnly := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 20971520, RemoteMtime: 1786096669}
+	oldEntry := &filer_pb.Entry{Name: "video.mp4", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}, RemoteEntry: remoteOnly}
+	newEntry := &filer_pb.Entry{
+		Name:        "video.mp4",
+		Attributes:  &filer_pb.FuseAttributes{Mtime: 1786096669},
+		RemoteEntry: remoteOnly,
+	}
+	if !newEntry.IsInRemoteOnly() {
+		t.Fatal("precondition: entry should be remote-only")
+	}
+	if filer.HasData(newEntry) {
+		t.Fatal("precondition: remote-only entry should have no local data")
+	}
+
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/src",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      oldEntry,
+			NewParentPath: "/buckets/b/dst",
+			NewEntry:      newEntry,
+		},
+	}
+
+	remote := &recordingRemote{}
+	filerClient := &stubFilerClient{}
+	if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.writes) != 0 {
+		t.Errorf("writes = %+v, want none: a remote-only rename must not upload an empty object", remote.writes)
+	}
+}
+
+// TestRenameDeleteOldKeyFailureReturnsError checks that a failed delete of the
+// old key on a rename is returned so MetadataProcessor retries the event,
+// instead of silently continuing and leaving both keys on the remote.
+func TestRenameDeleteOldKeyFailureReturnsError(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/"}
+
+	newEntry := &filer_pb.Entry{
+		Name:       "probe.bin",
+		Content:    []byte("payload"),
+		Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669},
+	}
+	oldEntry := &filer_pb.Entry{Name: "probe.bin", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}}
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/src",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      oldEntry,
+			NewParentPath: "/buckets/b/dst",
+			NewEntry:      newEntry,
+		},
+	}
+
+	deleteErr := errors.New("AccessDenied: Access Denied")
+	remote := &recordingRemote{deleteErr: deleteErr}
+	filerClient := &stubFilerClient{}
+	err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp)
+	if !errors.Is(err, deleteErr) {
+		t.Errorf("err = %v, want the delete failure returned so the event is retried", err)
+	}
+	if len(remote.writes) != 0 {
+		t.Errorf("writes = %+v, want none: must not write the new key when the old key delete failed", remote.writes)
+	}
+}
+
+// TestRenameDeleteOldKeyNotFoundStillWrites checks that an already-deleted old
+// key (the filer deletes the source object synchronously during rename) does
+// not block the destination write. GCS reports a missing object as
+// ErrRemoteObjectNotFound, unlike S3/Azure whose deletes are idempotent, so
+// treating it as a real error would pin the sync offset and never write the
+// new key.
+func TestRenameDeleteOldKeyNotFoundStillWrites(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/"}
+
+	newEntry := &filer_pb.Entry{
+		Name:       "probe.bin",
+		Content:    []byte("payload"),
+		Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669},
+	}
+	oldEntry := &filer_pb.Entry{Name: "probe.bin", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}}
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/src",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      oldEntry,
+			NewParentPath: "/buckets/b/dst",
+			NewEntry:      newEntry,
+		},
+	}
+
+	remote := &recordingRemote{deleteErr: remote_storage.ErrRemoteObjectNotFound}
+	// the filer still holds the renamed entry as the event described it
+	filerClient := &stubFilerClient{entry: newEntry}
+	if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+		t.Fatalf("err = %v, want nil: an already-deleted old key must not block the write", err)
+	}
+	wantWrite := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/b/dst/probe.bin"}
+	if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], wantWrite) {
+		t.Errorf("writes = %+v, want the new key %s written", remote.writes, remote_storage.FormatLocation(wantWrite))
+	}
+}
+
+func TestIfEntryEqualCarriesTheEventEntry(t *testing.T) {
+	entry := &filer_pb.Entry{
+		Name:    "f",
+		Content: []byte("inline"),
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: "3,01a"},
+			{Fid: &filer_pb.FileId{VolumeId: 4, FileKey: 0x2b, Cookie: 0x0c}},
+		},
+	}
+	cond := ifEntryEqual(entry)
+	if len(cond.Clauses) != 1 || cond.Clauses[0].Kind != filer_pb.WriteCondition_IF_ENTRY_EQUAL {
+		t.Fatalf("condition = %v, want one IF_ENTRY_EQUAL clause", cond)
+	}
+	if got := cond.Clauses[0].ExpectedEntry; !proto.Equal(got, entry) {
+		t.Fatalf("expected_entry = %v, want %v", got, entry)
+	}
+}
+
+// The remote-bound entry loses (or gains) the storage class attribute while
+// the event entry keeps it, so IF_ENTRY_EQUAL still sees the entry the filer
+// stored — otherwise every stamp on an S3-written object reads as stale.
+func TestRemoteWriteEntryLeavesEventEntryUntouched(t *testing.T) {
+	entry := &filer_pb.Entry{
+		Name:       "f",
+		Attributes: &filer_pb.FuseAttributes{Mtime: 1},
+		Extended:   map[string][]byte{s3_constants.AmzStorageClass: []byte("STANDARD")},
+	}
+
+	stripped := remoteWriteEntry(entry, "")
+	if _, ok := stripped.Extended[s3_constants.AmzStorageClass]; ok {
+		t.Fatalf("remote entry still carries %s", s3_constants.AmzStorageClass)
+	}
+	if string(entry.Extended[s3_constants.AmzStorageClass]) != "STANDARD" {
+		t.Fatalf("event entry Extended mutated: %v", entry.Extended)
+	}
+
+	overridden := remoteWriteEntry(entry, "GLACIER")
+	if got := string(overridden.Extended[s3_constants.AmzStorageClass]); got != "GLACIER" {
+		t.Fatalf("override = %q, want GLACIER", got)
+	}
+	if string(entry.Extended[s3_constants.AmzStorageClass]) != "STANDARD" {
+		t.Fatalf("event entry Extended mutated: %v", entry.Extended)
+	}
+
+	bare := &filer_pb.Entry{Name: "g", Attributes: &filer_pb.FuseAttributes{Mtime: 1}}
+	if got := string(remoteWriteEntry(bare, "GLACIER").Extended[s3_constants.AmzStorageClass]); got != "GLACIER" {
+		t.Fatalf("override on nil Extended = %q, want GLACIER", got)
+	}
+}
+
+func TestIsFailedPrecondition(t *testing.T) {
+	refused := status.Error(codes.FailedPrecondition, "precondition failed: /buckets/b/f")
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"status", refused, true},
+		{"wrapped status", fmt.Errorf("update entry: %w", refused), true},
+		{"message only", errors.New("rpc error: code = FailedPrecondition desc = precondition failed: /f"), false},
+		{"other", status.Error(codes.Unavailable, "filer down"), false},
+	}
+	for _, c := range cases {
+		if got := isFailedPrecondition(c.err); got != c.want {
+			t.Errorf("%s: isFailedPrecondition = %v, want %v", c.name, got, c.want)
+		}
+	}
+}
+
+// supersedingFilerClient answers the first lookup with the live entry and
+// every later one with "not found": the entry is deleted while the upload is
+// in flight.
+type supersedingFilerClient struct {
+	filer_pb.SeaweedFilerClient
+	live    *filer_pb.Entry
+	lookups int
+}
+
+func (c *supersedingFilerClient) LookupDirectoryEntry(context.Context, *filer_pb.LookupDirectoryEntryRequest, ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	c.lookups++
+	if c.lookups == 1 {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: c.live}, nil
+	}
+	return nil, filer_pb.ErrNotFound
+}
+
+func (c *supersedingFilerClient) WithFilerClient(_ bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return fn(c)
+}
+
+func (c *supersedingFilerClient) AdjustedUrl(location *filer_pb.Location) string { return location.Url }
+
+func (c *supersedingFilerClient) GetDataCenter() string { return "" }
+
+// TestDeleteEventAbsentRemoteObjectIsSuccess: an entry created and deleted
+// before the sync uploaded it has no remote object. GCS reports the delete as
+// ErrRemoteObjectNotFound; the event has nothing left to do, so it must not
+// fail (a failed event pins the sync offset and is replayed on every restart).
+func TestDeleteEventAbsentRemoteObjectIsSuccess(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/"}
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/vol",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "state.db.tmp", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}},
+			DeleteChunks: true,
+		},
+	}
+	wantDelete := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/b/vol/state.db.tmp"}
+
+	t.Run("absent object", func(t *testing.T) {
+		remote := &recordingRemote{deleteErr: remote_storage.ErrRemoteObjectNotFound}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v, want nil: deleting an absent object is complete", err)
+		}
+		if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], wantDelete) {
+			t.Errorf("deletes = %+v, want %s", remote.deletes, remote_storage.FormatLocation(wantDelete))
+		}
+	})
+
+	t.Run("metadata-only delete keeps the remote object", func(t *testing.T) {
+		marked := proto.Clone(resp).(*filer_pb.SubscribeMetadataResponse)
+		marked.EventNotification.OldEntry.Extended = map[string][]byte{filer.ExtKeepRemoteObjectKey: []byte("true")}
+		remote := &recordingRemote{}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, marked); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 0 {
+			t.Errorf("deletes = %+v, want none", remote.deletes)
+		}
+	})
+
+	t.Run("a remote-only entry that took the path keeps the object", func(t *testing.T) {
+		// deleted, then a remote-only file renamed onto the path: the rename
+		// copied its content to this key before the sync got to the delete
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: &filer_pb.Entry{
+			Name:        "state.db.tmp",
+			Attributes:  &filer_pb.FuseAttributes{FileSize: 10},
+			RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 10},
+		}}
+		if err := processDeleteEvent(filerClient, remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 0 {
+			t.Errorf("deletes = %+v, want none", remote.deletes)
+		}
+	})
+
+	t.Run("a replaced object is kept", func(t *testing.T) {
+		// the delete recorded the old object's etag; a rename copied another
+		// entry's content onto the key since, and it must not go with it
+		deleted := proto.Clone(resp).(*filer_pb.SubscribeMetadataResponse)
+		deleted.EventNotification.OldEntry.RemoteEntry = &filer_pb.RemoteEntry{RemoteETag: `"orig"`, RemoteSize: 10}
+		remote := &recordingRemote{objects: map[string][]byte{"/b/vol/state.db.tmp": []byte("copied")}, statETag: `"copy"`}
+		filerClient := &stubFilerClient{entry: &filer_pb.Entry{Name: "state.db.tmp", Content: []byte("copied")}}
+		if err := processDeleteEvent(filerClient, remote, mountedDir, mountLoc, deleted); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 0 {
+			t.Errorf("deletes = %+v, want none", remote.deletes)
+		}
+	})
+
+	t.Run("a changed object with no entry at the path yet is kept", func(t *testing.T) {
+		// a directory rename copies a child onto the key before its new entry
+		// becomes visible; the copy may be the content's only remaining home
+		deleted := proto.Clone(resp).(*filer_pb.SubscribeMetadataResponse)
+		deleted.EventNotification.OldEntry.RemoteEntry = &filer_pb.RemoteEntry{RemoteETag: `"orig"`, RemoteSize: 10}
+		remote := &recordingRemote{objects: map[string][]byte{"/b/vol/state.db.tmp": []byte("copied")}, statETag: `"copy"`}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, deleted); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 0 {
+			t.Errorf("deletes = %+v, want none", remote.deletes)
+		}
+	})
+
+	t.Run("an unchanged object still goes", func(t *testing.T) {
+		deleted := proto.Clone(resp).(*filer_pb.SubscribeMetadataResponse)
+		deleted.EventNotification.OldEntry.RemoteEntry = &filer_pb.RemoteEntry{RemoteETag: `"orig"`, RemoteSize: 3}
+		remote := &recordingRemote{objects: map[string][]byte{"/b/vol/state.db.tmp": []byte("old")}, statETag: `"orig"`}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, deleted); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 1 {
+			t.Errorf("deletes = %+v, want one", remote.deletes)
+		}
+	})
+
+	t.Run("a copy that landed before its entry is kept", func(t *testing.T) {
+		// the deleted entry was never replicated, so its event records no
+		// stamp to match the fresh rename copy waiting for its filer entry
+		remote := &recordingRemote{objects: map[string][]byte{"/b/vol/state.db.tmp": []byte("copied")}, statETag: `"copy"`}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 0 {
+			t.Errorf("deletes = %+v, want none", remote.deletes)
+		}
+	})
+
+	t.Run("an unverifiable object is kept", func(t *testing.T) {
+		// the delete recorded an etag the live stat does not report; the
+		// object cannot be confirmed as the one the delete meant
+		deleted := proto.Clone(resp).(*filer_pb.SubscribeMetadataResponse)
+		deleted.EventNotification.OldEntry.RemoteEntry = &filer_pb.RemoteEntry{RemoteETag: `"orig"`, RemoteSize: 3}
+		remote := &recordingRemote{objects: map[string][]byte{"/b/vol/state.db.tmp": []byte("old")}}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, deleted); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 0 {
+			t.Errorf("deletes = %+v, want none", remote.deletes)
+		}
+	})
+
+	t.Run("an entry with local data at the path does not stop the delete", func(t *testing.T) {
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: &filer_pb.Entry{
+			Name:        "state.db.tmp",
+			Content:     []byte("local"),
+			RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 10},
+		}}
+		if err := processDeleteEvent(filerClient, remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if len(remote.deletes) != 1 {
+			t.Errorf("deletes = %+v, want one", remote.deletes)
+		}
+	})
+
+	t.Run("other failure still fails", func(t *testing.T) {
+		remote := &recordingRemote{deleteErr: errors.New("AccessDenied: Access Denied")}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, resp); err == nil {
+			t.Fatal("err = nil, want the delete failure")
+		}
+	})
+
+	t.Run("delete marker, absent object", func(t *testing.T) {
+		remote := &recordingRemote{deleteErr: remote_storage.ErrRemoteObjectNotFound}
+		filerClient := &stubFilerClient{}
+		markerDelete := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/b/vol/state.db"}
+		message := &filer_pb.EventNotification{
+			NewParentPath: "/buckets/b/vol",
+			NewEntry:      &filer_pb.Entry{Name: "state.db", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}},
+		}
+		if err := syncDeleteMarker(remote, filerClient, message, markerDelete); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], markerDelete) {
+			t.Errorf("deletes = %+v, want %s", remote.deletes, remote_storage.FormatLocation(markerDelete))
+		}
+		if filerClient.updates != 1 {
+			t.Errorf("stamped %d times, want 1: the marker is recorded locally so a replay is a no-op", filerClient.updates)
+		}
+	})
+}
+
+// TestUpdateLocalEntrySkipsDeletedEntry: the stamp that follows an upload lands
+// on an entry a later event already deleted. The filer answers "not found"; the
+// delete's own event follows in the log, so the stamp is skipped rather than
+// failed.
+func TestUpdateLocalEntrySkipsDeletedEntry(t *testing.T) {
+	const dir = "/buckets/b/vol"
+	remoteEntry := &filer_pb.RemoteEntry{StorageName: "gcs", RemoteSize: 7}
+
+	t.Run("plain not found from the filer", func(t *testing.T) {
+		filerClient := &stubFilerClient{updateErr: fmt.Errorf("not found %s: %w", dir+"/state.db", filer_pb.ErrNotFound)}
+		if err := updateLocalEntry(filerClient, dir, entryWith("state.db", nil, chunk("3,01", "e1")), remoteEntry); err != nil {
+			t.Errorf("err = %v, want nil", err)
+		}
+	})
+
+	t.Run("not found over grpc", func(t *testing.T) {
+		filerClient := &stubFilerClient{updateErr: status.Error(codes.Unknown, "not found "+dir+"/state.db: "+filer_pb.ErrNotFound.Error())}
+		if err := updateLocalEntry(filerClient, dir, entryWith("state.db", nil, chunk("3,01", "e1")), remoteEntry); err != nil {
+			t.Errorf("err = %v, want nil", err)
+		}
+	})
+
+	t.Run("typed not found from the filer", func(t *testing.T) {
+		filerClient := &stubFilerClient{updateErr: status.Errorf(codes.NotFound, "not found %s/state.db: %v", dir, filer_pb.ErrNotFound)}
+		if err := updateLocalEntry(filerClient, dir, entryWith("state.db", nil, chunk("3,01", "e1")), remoteEntry); err != nil {
+			t.Errorf("err = %v, want nil", err)
+		}
+	})
+
+	t.Run("the sentinel inside the path is not a missing entry", func(t *testing.T) {
+		name := filer_pb.ErrNotFound.Error()
+		filerClient := &stubFilerClient{updateErr: status.Error(codes.Unknown, "not found "+dir+"/"+name+": database unavailable")}
+		if err := updateLocalEntry(filerClient, dir, entryWith(name, nil, chunk("3,01", "e1")), remoteEntry); err == nil {
+			t.Error("err = nil, want the store failure: the stamp must be retried, not dropped")
+		}
+	})
+
+	t.Run("other failure still fails", func(t *testing.T) {
+		filerClient := &stubFilerClient{updateErr: status.Error(codes.Unavailable, "filer is shutting down")}
+		if err := updateLocalEntry(filerClient, dir, entryWith("state.db", nil, chunk("3,01", "e1")), remoteEntry); err == nil {
+			t.Error("err = nil, want the update failure")
+		}
+	})
+}
+
+// TestSupersededRenameUploadsCurrentEntry: a rename A -> B queued behind a
+// rewrite of B. The rename's snapshot is superseded (B's chunks changed) and
+// the old key A is already deleted. The rewrite's own event uploads B unless
+// the entry already reads synced (the stamp covers its mtime, or the remote
+// is newer); only then does the rename upload what the filer holds now, so
+// the content goes up exactly once.
+func TestSupersededRenameUploadsCurrentEntry(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/"}
+	eventEntry := entryWith("b.txt", nil, chunk("3,01", "e1"))
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/dir",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      entryWith("a.txt", nil, chunk("3,01", "e1")),
+			NewParentPath: "/buckets/b/dir",
+			NewEntry:      eventEntry,
+		},
+	}
+	wantDelete := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/b/dir/a.txt"}
+	wantWrite := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/b/dir/b.txt"}
+
+	t.Run("rewrite already synced: upload once here", func(t *testing.T) {
+		// The stamp covers the rewrite's mtime, so its own event skips.
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 1024, LastLocalSyncTsNs: 1786096669*1e9 + 1}, chunk("3,02", "e2"))
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: current}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], wantDelete) {
+			t.Errorf("deletes = %+v, want the old key %s deleted", remote.deletes, remote_storage.FormatLocation(wantDelete))
+		}
+		if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], wantWrite) {
+			t.Fatalf("writes = %+v, want the new key %s written once with the current entry", remote.writes, remote_storage.FormatLocation(wantWrite))
+		}
+		if filerClient.updates != 1 {
+			t.Errorf("stamped %d times, want 1: the current entry is stamped", filerClient.updates)
+		}
+	})
+
+	t.Run("rewrite newer than the stamp: its own event uploads, not this one", func(t *testing.T) {
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096000, RemoteSize: 1024}, chunk("3,02", "e2"))
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: current}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.deletes) != 1 {
+			t.Errorf("deletes = %+v, want the old key deleted", remote.deletes)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none: the rewrite event behind this one uploads b.txt", remote.writes)
+		}
+	})
+
+	t.Run("deleted meanwhile: nothing to upload", func(t *testing.T) {
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none: the delete event follows", remote.writes)
+		}
+	})
+
+	t.Run("uncached meanwhile, old object present: copied to the destination, stamped, old key deleted", func(t *testing.T) {
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 7})
+		remote := &recordingRemote{objects: map[string][]byte{"/b/dir/a.txt": []byte("payload")}}
+		filerClient := &stubFilerClient{entry: current}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], wantWrite) || string(remote.written[0]) != "payload" {
+			t.Fatalf("writes = %+v (%q), want the old object's bytes written at %s", remote.writes, remote.written, remote_storage.FormatLocation(wantWrite))
+		}
+		if filerClient.updates != 1 {
+			t.Errorf("stamped %d times, want 1: the entry now points at the destination object", filerClient.updates)
+		}
+		if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], wantDelete) {
+			t.Errorf("deletes = %+v, want the old key deleted after the copy", remote.deletes)
+		}
+	})
+
+	t.Run("uncached after an earlier run completed the rename: destination present, old key deleted, nothing written", func(t *testing.T) {
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 7})
+		remote := &recordingRemote{objects: map[string][]byte{"/b/dir/a.txt": []byte("payload"), "/b/dir/b.txt": []byte("payload")}}
+		filerClient := &stubFilerClient{entry: current}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v, want nil: the replayed rename is already complete", err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none", remote.writes)
+		}
+		if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], wantDelete) {
+			t.Errorf("deletes = %+v, want the old key deleted", remote.deletes)
+		}
+	})
+
+	t.Run("uncached and neither object exists: the event fails and holds the offset", func(t *testing.T) {
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 7})
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: current}
+		err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp)
+		if err == nil || !strings.Contains(err.Error(), "neither") {
+			t.Fatalf("err = %v, want the lost-content failure", err)
+		}
+		if len(remote.writes) != 0 || len(remote.deletes) != 0 {
+			t.Errorf("writes = %+v deletes = %+v, want none", remote.writes, remote.deletes)
+		}
+	})
+
+	t.Run("destination holds an object of another size: replaced from the old key", func(t *testing.T) {
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 7})
+		remote := &recordingRemote{objects: map[string][]byte{"/b/dir/a.txt": []byte("payload"), "/b/dir/b.txt": []byte("something else")}}
+		filerClient := &stubFilerClient{entry: current}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.writes) != 1 || string(remote.written[0]) != "payload" {
+			t.Fatalf("writes = %+v (%q), want the old object copied over the destination", remote.writes, remote.written)
+		}
+		if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], wantDelete) {
+			t.Errorf("deletes = %+v, want the old key deleted after the copy", remote.deletes)
+		}
+	})
+
+	t.Run("snapshot remote-only but rewritten since: the rewrite's own event uploads", func(t *testing.T) {
+		remoteOnly := &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 7}
+		snapshot := &filer_pb.SubscribeMetadataResponse{
+			Directory: "/buckets/b/dir",
+			EventNotification: &filer_pb.EventNotification{
+				OldEntry:      entryWith("a.txt", remoteOnly),
+				NewParentPath: "/buckets/b/dir",
+				NewEntry:      entryWith("b.txt", remoteOnly),
+			},
+		}
+		// rewritten since the stamp; its own event uploads, not this one
+		rewritten := proto.Clone(remoteOnly).(*filer_pb.RemoteEntry)
+		rewritten.LastLocalSyncTsNs = 1
+		current := entryWith("b.txt", rewritten, chunk("3,09", "e9"))
+		remote := &recordingRemote{objects: map[string][]byte{"/b/dir/a.txt": []byte("payload")}}
+		filerClient := &stubFilerClient{entry: current}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, snapshot); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none: the rewrite event behind this one uploads b.txt", remote.writes)
+		}
+		if len(remote.deletes) != 1 {
+			t.Errorf("deletes = %+v, want the old key deleted", remote.deletes)
+		}
+	})
+
+	t.Run("snapshot already remote-only: completed the same way", func(t *testing.T) {
+		remoteOnly := &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 7}
+		snapshot := &filer_pb.SubscribeMetadataResponse{
+			Directory: "/buckets/b/dir",
+			EventNotification: &filer_pb.EventNotification{
+				OldEntry:      entryWith("a.txt", remoteOnly),
+				NewParentPath: "/buckets/b/dir",
+				NewEntry:      entryWith("b.txt", remoteOnly),
+			},
+		}
+		remote := &recordingRemote{objects: map[string][]byte{"/b/dir/a.txt": []byte("payload")}}
+		filerClient := &stubFilerClient{entry: entryWith("b.txt", remoteOnly)}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, snapshot); err != nil {
+			t.Fatalf("err = %v, want nil", err)
+		}
+		if len(remote.writes) != 1 || string(remote.written[0]) != "payload" {
+			t.Errorf("writes = %+v (%q), want the old object copied to the destination", remote.writes, remote.written)
+		}
+		if len(remote.deletes) != 1 {
+			t.Errorf("deletes = %+v, want the old key deleted after the copy", remote.deletes)
+		}
+	})
+
+	t.Run("uncached after the old key was deleted: the event fails and holds the offset", func(t *testing.T) {
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 1024})
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: current}
+		err := uploadCurrentEntry(filerClient, filerClient, remote, "/buckets/b/dir", "b.txt", renameSource{loc: wantDelete}, wantWrite, "", eventSource)
+		if err == nil || !strings.Contains(err.Error(), "neither") {
+			t.Errorf("err = %v, want the lost-content failure", err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none", remote.writes)
+		}
+	})
+
+	t.Run("uncached with the destination already synced: complete without a write", func(t *testing.T) {
+		current := entryWith("b.txt", &filer_pb.RemoteEntry{StorageName: "gcs", RemoteMtime: 1786096669, RemoteSize: 7})
+		remote := &recordingRemote{objects: map[string][]byte{"/b/dir/a.txt": []byte("payload"), "/b/dir/b.txt": []byte("payload")}}
+		filerClient := &stubFilerClient{entry: current}
+		if err := uploadCurrentEntry(filerClient, filerClient, remote, "/buckets/b/dir", "b.txt", renameSource{loc: wantDelete}, wantWrite, "", eventSource); err != nil {
+			t.Fatalf("err = %v, want nil: the destination object matches the entry's stamp", err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none", remote.writes)
+		}
+		if len(remote.deletes) != 1 || !proto.Equal(remote.deletes[0], wantDelete) {
+			t.Errorf("deletes = %+v, want the old key deleted", remote.deletes)
+		}
+	})
+}
+
+func TestCompleteRemoteOnlyRenameClearsThePendingSourceFirst(t *testing.T) {
+	oldDest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/src/a.jpg"}
+	dest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/dst/a.jpg"}
+	pending := func() *filer_pb.Entry {
+		return &filer_pb.Entry{
+			Name:        "a.jpg",
+			Attributes:  &filer_pb.FuseAttributes{FileSize: 4},
+			RemoteEntry: &filer_pb.RemoteEntry{RemoteETag: `"copy"`, RemoteSize: 4},
+			Extended:    map[string][]byte{filer.ExtRemoteRenameSourceKey: []byte("/buckets/b/src/a.jpg")},
+		}
+	}
+	objects := func() map[string][]byte {
+		return map[string][]byte{"/b/src/a.jpg": []byte("data"), "/b/dst/a.jpg": []byte("data")}
+	}
+
+	t.Run("stamped, then the source goes", func(t *testing.T) {
+		// the destination already holds the copy; the entry still reads the
+		// source until its stamp clears the marker
+		current := pending()
+		filerClient := &stubFilerClient{entry: current}
+		remote := &recordingRemote{objects: objects(), statETag: `"copy"`}
+		if err := completeRemoteOnlyRename(filerClient, remote, "/buckets/b/dst", current, renameSource{path: "/buckets/b/src/a.jpg", loc: oldDest}, dest, ""); err != nil {
+			t.Fatalf("err = %v", err)
+		}
+		if filerClient.updates != 1 {
+			t.Errorf("updates = %d, want the stamp that clears the marker", filerClient.updates)
+		}
+		if len(remote.deletes) != 1 || remote.deletes[0].Path != "/b/src/a.jpg" {
+			t.Errorf("deletes = %+v, want the source", remote.deletes)
+		}
+	})
+
+	t.Run("a marker still in place keeps the source", func(t *testing.T) {
+		// the stamp did not land: the filer still has the marker
+		filerClient := &stubFilerClient{entry: pending()}
+		remote := &recordingRemote{objects: objects(), statETag: `"copy"`}
+		if err := completeRemoteOnlyRename(filerClient, remote, "/buckets/b/dst", pending(), renameSource{path: "/buckets/b/src/a.jpg", loc: oldDest}, dest, ""); err == nil {
+			t.Fatal("err = nil, want the event retried")
+		}
+		if len(remote.deletes) != 0 {
+			t.Errorf("deletes = %+v, want none while the entry reads the source", remote.deletes)
+		}
+	})
+}
+
+// eventSource resolves a rename's source to the event's old key.
+func eventSource(_ *filer_pb.Entry, source renameSource) renameSource {
+	return source
+}
+
+func TestRenameOfAPendingEntryFollowsItsSource(t *testing.T) {
+	// A was renamed over B and B over C, both copies failing: C reads A's
+	// object through the marker, and B's key holds the old target's bytes
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/"}
+	remoteOnly := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: `"a"`, RemoteSize: 6}
+	pendingC := func() *filer_pb.Entry {
+		return &filer_pb.Entry{
+			Name:        "c.jpg",
+			Attributes:  &filer_pb.FuseAttributes{FileSize: 6},
+			RemoteEntry: remoteOnly,
+			Extended:    map[string][]byte{filer.ExtRemoteRenameSourceKey: []byte("/buckets/b/a.jpg")},
+		}
+	}
+	event := func(oldName, newName string) *filer_pb.SubscribeMetadataResponse {
+		newEntry := pendingC()
+		newEntry.Name = newName
+		return &filer_pb.SubscribeMetadataResponse{
+			Directory: "/buckets/b",
+			EventNotification: &filer_pb.EventNotification{
+				OldEntry:      &filer_pb.Entry{Name: oldName, RemoteEntry: remoteOnly},
+				NewParentPath: "/buckets/b",
+				NewEntry:      newEntry,
+			},
+		}
+	}
+	objects := func() map[string][]byte {
+		return map[string][]byte{"/b/a.jpg": []byte("data-a"), "/b/b.jpg": []byte("old-b"), "/b/c.jpg": []byte("old-c")}
+	}
+
+	t.Run("the first rename leaves the source to the entry that moved on", func(t *testing.T) {
+		remote := &recordingRemote{objects: objects()}
+		filerClient := &stubFilerClient{} // nothing at b.jpg any more
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, event("a.jpg", "b.jpg")); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.deletes) != 0 || len(remote.writes) != 0 {
+			t.Errorf("deletes = %+v, writes = %+v, want neither: c.jpg still reads a.jpg", remote.deletes, remote.writes)
+		}
+	})
+
+	t.Run("the second rename copies from the marker's source", func(t *testing.T) {
+		current := pendingC()
+		remote := &recordingRemote{objects: objects(), statETag: `"a"`}
+		filerClient := &stubFilerClient{entry: current}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, event("b.jpg", "c.jpg")); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.written) != 1 || string(remote.written[0]) != "data-a" {
+			t.Errorf("written = %q, want a.jpg's content", remote.written)
+		}
+		if len(remote.deletes) != 1 || remote.deletes[0].Path != "/b/a.jpg" {
+			t.Errorf("deletes = %+v, want the source once the stamp cleared the marker", remote.deletes)
+		}
+	})
+}
+
+func TestPendingRenameSourceIsReleasedOnlyWhileUnchanged(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/"}
+	// b.jpg's copy failed after it replaced a target: it read a.jpg's object
+	pendingB := func() *filer_pb.Entry {
+		return &filer_pb.Entry{
+			Name:        "b.jpg",
+			RemoteEntry: &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: `"a"`, RemoteSize: 6},
+			Extended:    map[string][]byte{filer.ExtRemoteRenameSourceKey: []byte("/buckets/b/a.jpg")},
+		}
+	}
+	deleted := func() *filer_pb.SubscribeMetadataResponse {
+		return &filer_pb.SubscribeMetadataResponse{Directory: "/buckets/b", EventNotification: &filer_pb.EventNotification{OldEntry: pendingB()}}
+	}
+	deletedPaths := func(r *recordingRemote) (paths []string) {
+		for _, d := range r.deletes {
+			paths = append(paths, d.Path)
+		}
+		return
+	}
+
+	t.Run("deleting the pending entry releases its source", func(t *testing.T) {
+		remote := &recordingRemote{objects: map[string][]byte{"/b/a.jpg": []byte("data-a")}, statETag: `"a"`}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, deleted()); err != nil {
+			t.Fatal(err)
+		}
+		if got := deletedPaths(remote); !slices.Contains(got, "/b/a.jpg") {
+			t.Errorf("deletes = %v, want the source", got)
+		}
+	})
+
+	t.Run("a source replaced since is kept", func(t *testing.T) {
+		// another rename copied onto a.jpg before its entry became visible
+		remote := &recordingRemote{objects: map[string][]byte{"/b/a.jpg": []byte("data-d")}, statETag: `"d"`}
+		if err := processDeleteEvent(&stubFilerClient{}, remote, mountedDir, mountLoc, deleted()); err != nil {
+			t.Fatal(err)
+		}
+		if got := deletedPaths(remote); slices.Contains(got, "/b/a.jpg") {
+			t.Errorf("deletes = %v, want the replaced source kept", got)
+		}
+	})
+
+	t.Run("a destination cached since releases the source too", func(t *testing.T) {
+		// c.jpg was cached before the sync reached the rename: it is no
+		// longer remote-only, and a.jpg is still left over
+		cached := &filer_pb.Entry{Name: "c.jpg", Content: []byte("data-a"), Attributes: &filer_pb.FuseAttributes{FileSize: 6}, RemoteEntry: &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: `"a"`, RemoteSize: 6}}
+		remote := &recordingRemote{objects: map[string][]byte{"/b/a.jpg": []byte("data-a"), "/b/b.jpg": []byte("old-b"), "/b/c.jpg": []byte("data-a")}, statETag: `"a"`}
+		event := &filer_pb.SubscribeMetadataResponse{Directory: "/buckets/b", EventNotification: &filer_pb.EventNotification{
+			OldEntry: pendingB(), NewParentPath: "/buckets/b", NewEntry: cached,
+		}}
+		filerClient := &pathFilerClient{entries: map[string]*filer_pb.Entry{"/buckets/b/c.jpg": cached}}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, event); err != nil {
+			t.Fatal(err)
+		}
+		if got := deletedPaths(remote); !slices.Contains(got, "/b/a.jpg") {
+			t.Errorf("deletes = %v, want the pending source released", got)
+		}
+	})
+
+	t.Run("a cached entry still reading the source keeps it until its upload lands", func(t *testing.T) {
+		// c.jpg was cached through its marker; until the upload is stamped
+		// and the marker cleared, a.jpg is what remote.uncache would fall
+		// back to
+		marked := func() *filer_pb.Entry {
+			return &filer_pb.Entry{Name: "c.jpg", Content: []byte("data-a"), Attributes: &filer_pb.FuseAttributes{FileSize: 6},
+				RemoteEntry: &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: `"a"`, RemoteSize: 6},
+				Extended:    map[string][]byte{filer.ExtRemoteRenameSourceKey: []byte("/buckets/b/a.jpg")}}
+		}
+		for name, writeErr := range map[string]error{"upload fails": errors.New("upload failed"), "stamp does not land": nil} {
+			t.Run(name, func(t *testing.T) {
+				remote := &recordingRemote{objects: map[string][]byte{"/b/a.jpg": []byte("data-a"), "/b/b.jpg": []byte("old-b")}, statETag: `"a"`, writeErr: writeErr}
+				event := &filer_pb.SubscribeMetadataResponse{Directory: "/buckets/b", EventNotification: &filer_pb.EventNotification{
+					OldEntry: pendingB(), NewParentPath: "/buckets/b", NewEntry: marked(),
+				}}
+				// the filer keeps the marker: the stub does not store updates
+				filerClient := &pathFilerClient{entries: map[string]*filer_pb.Entry{"/buckets/b/c.jpg": marked()}}
+				_ = processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, event)
+				if got := deletedPaths(remote); slices.Contains(got, "/b/a.jpg") {
+					t.Errorf("deletes = %v, want the source kept while the entry reads it", got)
+				}
+			})
+		}
+	})
+
+	t.Run("a later rename the filer copied releases the source", func(t *testing.T) {
+		// b.jpg was renamed to c.jpg and the filer copied a.jpg there at once
+		copied := &filer_pb.Entry{Name: "c.jpg", Attributes: &filer_pb.FuseAttributes{FileSize: 6}, RemoteEntry: &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: `"a"`, RemoteSize: 6}}
+		remote := &recordingRemote{objects: map[string][]byte{"/b/a.jpg": []byte("data-a"), "/b/b.jpg": []byte("old-b"), "/b/c.jpg": []byte("data-a")}, statETag: `"a"`}
+		event := &filer_pb.SubscribeMetadataResponse{Directory: "/buckets/b", EventNotification: &filer_pb.EventNotification{
+			OldEntry: pendingB(), NewParentPath: "/buckets/b", NewEntry: copied,
+		}}
+		filerClient := &pathFilerClient{entries: map[string]*filer_pb.Entry{"/buckets/b/c.jpg": copied}}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, event); err != nil {
+			t.Fatal(err)
+		}
+		if got := deletedPaths(remote); !slices.Contains(got, "/b/a.jpg") {
+			t.Errorf("deletes = %v, want the pending source released", got)
+		}
+	})
+}
+
+// pathFilerClient serves entries by path; a path it lacks is not found.
+type pathFilerClient struct {
+	stubFilerClient
+	entries map[string]*filer_pb.Entry
+}
+
+func (c *pathFilerClient) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest, _ ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: c.entries[req.Directory+"/"+req.Name]}, nil
+}
+
+func (c *pathFilerClient) WithFilerClient(_ bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return fn(c)
+}
+
+func TestShouldSendToRemote(t *testing.T) {
+	const mtime = 1786096669
+
+	tests := []struct {
+		name    string
+		mtime   int64
+		mtimeNs int32
+		remote  *filer_pb.RemoteEntry
+		want    bool
+	}{
+		{name: "no RemoteEntry", mtime: mtime, want: true},
+		{name: "remote older", mtime: mtime, remote: &filer_pb.RemoteEntry{RemoteMtime: mtime - 1}, want: true},
+		{name: "remote newer", mtime: mtime, remote: &filer_pb.RemoteEntry{RemoteMtime: mtime + 1}, want: false},
+		{name: "same second, no sync stamp", mtime: mtime, remote: &filer_pb.RemoteEntry{RemoteMtime: mtime}, want: true},
+		{name: "same second, synced at the second", mtime: mtime, remote: &filer_pb.RemoteEntry{RemoteMtime: mtime, LastLocalSyncTsNs: mtime * 1e9}, want: false},
+		{name: "same second, synced after", mtime: mtime, remote: &filer_pb.RemoteEntry{RemoteMtime: mtime, LastLocalSyncTsNs: mtime*1e9 + 1}, want: false},
+		{name: "same second, rewritten after the sync", mtime: mtime, mtimeNs: 337, remote: &filer_pb.RemoteEntry{RemoteMtime: mtime, LastLocalSyncTsNs: mtime*1e9 + 100}, want: true},
+		{name: "same second, rewrite synced", mtime: mtime, mtimeNs: 337, remote: &filer_pb.RemoteEntry{RemoteMtime: mtime, LastLocalSyncTsNs: mtime*1e9 + 400}, want: false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			entry := &filer_pb.Entry{Attributes: &filer_pb.FuseAttributes{Mtime: tt.mtime, MtimeNs: tt.mtimeNs}, RemoteEntry: tt.remote}
+			if got := shouldSendToRemote(entry); got != tt.want {
+				t.Errorf("shouldSendToRemote = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// A metadata-only update pushed to the remote must advance the sync stamp.
+// Without the restamp a same-second edit stays dirty forever and every
+// following event re-sends the metadata update.
+func TestMetadataOnlyUpdateRestampsSyncTs(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/"}
+
+	replicated := &filer_pb.RemoteEntry{StorageName: "gcs", RemoteETag: "abc", RemoteSize: 2048, RemoteMtime: 1786096669, LastLocalSyncTsNs: 1}
+	oldEntry := entryWith("a.txt", replicated, chunk("3,01", "e1"))
+	newEntry := entryWith("a.txt", replicated, chunk("3,01", "e1"))
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/dir",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      oldEntry,
+			NewParentPath: "/buckets/b/dir",
+			NewEntry:      newEntry,
+		},
+	}
+
+	remote := &recordingRemote{}
+	filerClient := &stubFilerClient{entry: newEntry}
+	if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.metadataUpdates) != 1 {
+		t.Fatalf("metadata updates = %+v, want 1", remote.metadataUpdates)
+	}
+	if len(remote.writes) != 0 {
+		t.Errorf("writes = %+v, want none: the content did not change", remote.writes)
+	}
+	if filerClient.updates != 1 {
+		t.Fatalf("stamped %d times, want 1: the entry is restamped after the metadata update", filerClient.updates)
+	}
+	stamp := filerClient.updated.Entry.GetRemoteEntry().GetLastLocalSyncTsNs()
+	if stamp <= 1 {
+		t.Errorf("LastLocalSyncTsNs = %d, want it advanced past the previous stamp", stamp)
+	}
+	expected := filerClient.updated.Condition.Clauses[0].ExpectedEntry
+	if got := expected.GetRemoteEntry().GetLastLocalSyncTsNs(); got != 1 {
+		t.Errorf("precondition stamp = %d, want the stored stamp 1 or IF_ENTRY_EQUAL rejects the write", got)
+	}
+	if got := replicated.GetLastLocalSyncTsNs(); got != 1 {
+		t.Errorf("shared RemoteEntry stamp = %d, want 1: stamping must not mutate the caller's RemoteEntry", got)
+	}
+	if shouldSendToRemote(filerClient.updated.Entry) {
+		t.Error("the restamped entry should read synced")
+	}
+}
+
+// The droppedCopy fixtures are a small synced file under a mount: a Delta log
+// entry whose remote object was written in the second of its mtime, as a quick
+// sync of a small file is.
+const droppedCopyMtime = 1786096669
+
+var (
+	droppedCopyDir    = "/buckets/gold/sales/_delta_log"
+	droppedCopyName   = "00000000000000000007.json"
+	droppedCopyMount  = &remote_pb.RemoteStorageLocation{Name: "s3", Bucket: "gold", Path: "/"}
+	droppedCopyDest   = &remote_pb.RemoteStorageLocation{Name: "s3", Bucket: "gold", Path: "/sales/_delta_log/" + droppedCopyName}
+	droppedCopySynced = &filer_pb.RemoteEntry{StorageName: "s3", RemoteETag: `"abc"`, RemoteSize: 1024, RemoteMtime: droppedCopyMtime, LastLocalSyncTsNs: droppedCopyMtime*1e9 + 500}
+)
+
+// droppedCopyStamp is the synced stamp with LastLocalSyncTsNs cleared, as
+// remote.uncache and the eviction leave it.
+func droppedCopyStamp() *filer_pb.RemoteEntry {
+	stamp := proto.Clone(droppedCopySynced).(*filer_pb.RemoteEntry)
+	stamp.LastLocalSyncTsNs = 0
+	return stamp
+}
+
+// droppedCopyEntry is the fixture file with the given stamp and chunks, sized
+// as its remote object.
+func droppedCopyEntry(stamp *filer_pb.RemoteEntry, chunks ...*filer_pb.FileChunk) *filer_pb.Entry {
+	entry := entryWith(droppedCopyName, stamp, chunks...)
+	entry.Attributes.FileSize = uint64(droppedCopySynced.RemoteSize)
+	return entry
+}
+
+func droppedCopyUpdate(oldEntry, newEntry *filer_pb.Entry) *filer_pb.SubscribeMetadataResponse {
+	return &filer_pb.SubscribeMetadataResponse{
+		Directory:         droppedCopyDir,
+		EventNotification: &filer_pb.EventNotification{OldEntry: oldEntry, NewParentPath: droppedCopyDir, NewEntry: newEntry},
+	}
+}
+
+// TestDroppedLocalCopyIsNotUploaded: remote.uncache and the filer's eviction
+// under storage pressure drop a synced entry's chunks and clear its sync
+// stamp; remote.meta.sync does the same when it pulls a newer remote version.
+// With the remote mtime in the entry's second, shouldSendToRemote falls back
+// to the cleared stamp and reads the entry as dirty. The object at the same
+// key is the entry's only content, so uploading the chunkless entry would
+// replace it with a zero-byte object. The update is skipped, and the stamp
+// stays cleared so remote.cache and eviction still see the entry as uncached.
+func TestDroppedLocalCopyIsNotUploaded(t *testing.T) {
+	// the eviction's entry, built the way uncacheRemoteEntry builds it, and
+	// the event the way the filer's CreateEntry emits it
+	cached := &filer.Entry{
+		FullPath: util.NewFullPath(droppedCopyDir, droppedCopyName),
+		Attr:     filer.Attr{Mtime: time.Unix(droppedCopyMtime, 0), Mode: 0660, FileSize: 1024},
+		Chunks:   []*filer_pb.FileChunk{chunk("3,01", "e1")},
+		Remote:   droppedCopySynced,
+	}
+	evicted := cached.ShallowClone()
+	evicted.Chunks = nil
+	evicted.Remote = proto.Clone(cached.Remote).(*filer_pb.RemoteEntry)
+	evicted.Remote.LastLocalSyncTsNs = 0
+
+	// remote.meta.sync found a newer object: its mtime becomes the entry's
+	newer := &filer_pb.RemoteEntry{StorageName: "s3", RemoteETag: `"def"`, RemoteSize: 4096, RemoteMtime: droppedCopyMtime + 60}
+	pulled := &filer_pb.Entry{Name: droppedCopyName, Attributes: &filer_pb.FuseAttributes{Mtime: droppedCopyMtime + 60, FileSize: 4096}, RemoteEntry: newer}
+
+	tests := []struct {
+		name     string
+		oldEntry *filer_pb.Entry
+		newEntry *filer_pb.Entry
+	}{
+		{name: "remote.uncache", oldEntry: droppedCopyEntry(droppedCopySynced, chunk("3,01", "e1")), newEntry: droppedCopyEntry(droppedCopyStamp())},
+		{name: "eviction under storage pressure", oldEntry: cached.ToProtoEntry(), newEntry: evicted.ToProtoEntry()},
+		{name: "remote.meta.sync pulls a newer version", oldEntry: entryWith(droppedCopyName, droppedCopySynced, chunk("3,01", "e1")), newEntry: pulled},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			resp := droppedCopyUpdate(tt.oldEntry, tt.newEntry)
+			if !shouldSendToRemote(tt.newEntry) {
+				t.Fatal("precondition: the cleared stamp in the remote mtime's second reads as dirty, the bug's trigger")
+			}
+			if isMetadataOnlyUpdate(resp.Directory, resp.EventNotification) {
+				t.Fatal("precondition: the dropped chunks make the update a content change")
+			}
+
+			remote := &recordingRemote{}
+			filerClient := &stubFilerClient{entry: tt.newEntry}
+			if err := processUpdateEvent(filerClient, filerClient, "", remote, "/buckets/gold", droppedCopyMount, resp); err != nil {
+				t.Fatal(err)
+			}
+			if len(remote.writes) != 0 {
+				t.Errorf("writes = %+v, want none: the remote object is the entry's content and an upload would zero it", remote.writes)
+			}
+			if len(remote.deletes) != 0 || len(remote.metadataUpdates) != 0 {
+				t.Errorf("deletes = %+v, metadata updates = %+v, want the remote object left alone", remote.deletes, remote.metadataUpdates)
+			}
+			if filerClient.updates != 0 {
+				t.Errorf("stamped the entry %d times, want 0: a stamp would mark the uncached entry as cached", filerClient.updates)
+			}
+		})
+	}
+
+	t.Run("a metadata edit of a remote-only entry still reaches the remote", func(t *testing.T) {
+		tagged := droppedCopyEntry(droppedCopyStamp())
+		tagged.Extended = map[string][]byte{"X-Amz-Tagging-tier": []byte("gold")}
+		resp := droppedCopyUpdate(droppedCopyEntry(droppedCopyStamp()), tagged)
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: tagged}
+		if err := processUpdateEvent(filerClient, filerClient, "", remote, "/buckets/gold", droppedCopyMount, resp); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.metadataUpdates) != 1 || len(remote.writes) != 0 {
+			t.Errorf("metadata updates = %+v, writes = %+v, want one metadata update and no upload", remote.metadataUpdates, remote.writes)
+		}
+	})
+}
+
+// TestSameSecondRewriteIsStillUploaded: a rewrite that lands in the remote
+// mtime's second holds local data, so the skip for dropped local copies does
+// not apply and it is uploaded and restamped (#11715).
+func TestSameSecondRewriteIsStillUploaded(t *testing.T) {
+	stale := proto.Clone(droppedCopySynced).(*filer_pb.RemoteEntry)
+	stale.LastLocalSyncTsNs = droppedCopyMtime*1e9 + 100
+	rewrite := func(stamp *filer_pb.RemoteEntry) *filer_pb.Entry {
+		entry := entryWith(droppedCopyName, stamp, chunk("4,02", "e2"))
+		entry.Attributes.MtimeNs = 337
+		return entry
+	}
+
+	tests := []struct {
+		name     string
+		oldEntry *filer_pb.Entry
+		newEntry *filer_pb.Entry
+	}{
+		// Filer.UpdateEntry clears the stamp of a content change
+		{name: "synced entry, stamp cleared by the filer", oldEntry: entryWith(droppedCopyName, droppedCopySynced, chunk("3,01", "e1")), newEntry: rewrite(droppedCopyStamp())},
+		{name: "synced entry, stamp older than the rewrite", oldEntry: entryWith(droppedCopyName, stale, chunk("3,01", "e1")), newEntry: rewrite(stale)},
+		{name: "uncached entry", oldEntry: entryWith(droppedCopyName, droppedCopyStamp()), newEntry: rewrite(droppedCopyStamp())},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.newEntry.Attributes.Mtime != tt.newEntry.RemoteEntry.RemoteMtime {
+				t.Fatal("precondition: the rewrite lands in the remote mtime's second")
+			}
+			remote := &recordingRemote{}
+			filerClient := &stubFilerClient{entry: tt.newEntry}
+			if err := processUpdateEvent(filerClient, filerClient, "", remote, "/buckets/gold", droppedCopyMount, droppedCopyUpdate(tt.oldEntry, tt.newEntry)); err != nil {
+				t.Fatal(err)
+			}
+			if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], droppedCopyDest) {
+				t.Fatalf("writes = %+v, want the rewrite uploaded to %s", remote.writes, remote_storage.FormatLocation(droppedCopyDest))
+			}
+			if !slices.Equal(remote.writtenChunks[0], []string{"4,02"}) {
+				t.Errorf("uploaded chunks %v, want the rewrite's [4,02]", remote.writtenChunks[0])
+			}
+			if filerClient.updates != 1 {
+				t.Errorf("stamped the entry %d times, want 1 after the upload", filerClient.updates)
+			}
+		})
+	}
+}
+
+// TestTruncateToZeroIsUploaded: a FUSE truncate of a cached file to zero
+// (truncateEntry, or SetAttr with size 0) drops the chunks and keeps the
+// sized RemoteEntry, so the entry looks remote-only. Its size is no longer
+// the remote object's, and the empty file has to replace the object.
+func TestTruncateToZeroIsUploaded(t *testing.T) {
+	truncated := func(mtime int64, mtimeNs int32) *filer_pb.Entry {
+		// the filer clears the stamp of a content change
+		entry := entryWith(droppedCopyName, droppedCopyStamp())
+		entry.Attributes.Mtime, entry.Attributes.MtimeNs = mtime, mtimeNs
+		return entry
+	}
+	tests := []struct {
+		name     string
+		newEntry *filer_pb.Entry
+	}{
+		{name: "in a later second", newEntry: truncated(droppedCopyMtime+5, 0)},
+		{name: "in the remote mtime's second", newEntry: truncated(droppedCopyMtime, 337)},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if !isRemoteOnly(tt.newEntry) {
+				t.Fatal("precondition: the truncated entry looks remote-only")
+			}
+			remote := &recordingRemote{}
+			filerClient := &stubFilerClient{entry: tt.newEntry}
+			resp := droppedCopyUpdate(droppedCopyEntry(droppedCopySynced, chunk("3,01", "e1")), tt.newEntry)
+			if err := processUpdateEvent(filerClient, filerClient, "", remote, "/buckets/gold", droppedCopyMount, resp); err != nil {
+				t.Fatal(err)
+			}
+			if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], droppedCopyDest) {
+				t.Fatalf("writes = %+v, want the empty file uploaded to %s", remote.writes, remote_storage.FormatLocation(droppedCopyDest))
+			}
+			if len(remote.writtenChunks[0]) != 0 {
+				t.Errorf("uploaded chunks %v, want none: a zero-byte object", remote.writtenChunks[0])
+			}
+			if filerClient.updates != 1 {
+				t.Errorf("stamped the entry %d times, want 1 after the upload", filerClient.updates)
+			}
+		})
+	}
+}
+
+func TestCompleteRemoteOnlyRenameKeepsAReusedOldKey(t *testing.T) {
+	// A was renamed to B, then D to A before the sync got to the first
+	// rename: the object at A is now D's, and the only copy of it
+	oldDest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/a.jpg"}
+	dest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/b.jpg"}
+	current := &filer_pb.Entry{Name: "b.jpg", RemoteEntry: &filer_pb.RemoteEntry{RemoteETag: `"a"`, RemoteSize: 6}}
+	remote := &recordingRemote{objects: map[string][]byte{"/b/a.jpg": []byte("data-d"), "/b/b.jpg": []byte("data-a")}, statETag: `"a"`}
+	remote.statETags = map[string]string{"/b/a.jpg": `"d"`}
+	filerClient := &stubFilerClient{entry: current}
+	if err := completeRemoteOnlyRename(filerClient, remote, "/buckets/b", current, renameSource{path: "/buckets/b/a.jpg", loc: oldDest}, dest, ""); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.deletes) != 0 {
+		t.Errorf("deletes = %+v, want the reused key kept", remote.deletes)
+	}
+}
+
+func TestCompleteRemoteOnlyRenameRetryUsesTheSourceStamp(t *testing.T) {
+	// an earlier run copied a multipart source and stamped the entry with
+	// the copy's ETag, then failed to delete the source
+	oldDest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/a.jpg"}
+	dest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/b/b.jpg"}
+	current := &filer_pb.Entry{Name: "b.jpg", RemoteEntry: &filer_pb.RemoteEntry{RemoteETag: `"copy"`, RemoteSize: 6}}
+	remote := &recordingRemote{objects: map[string][]byte{"/b/a.jpg": []byte("data-a"), "/b/b.jpg": []byte("data-a")},
+		statETags: map[string]string{"/b/a.jpg": `"a-2"`, "/b/b.jpg": `"copy"`}}
+	source := renameSource{path: "/buckets/b/a.jpg", loc: oldDest, stamp: &filer_pb.RemoteEntry{RemoteETag: `"a-2"`, RemoteSize: 6}}
+	if err := completeRemoteOnlyRename(&stubFilerClient{entry: current}, remote, "/buckets/b", current, source, dest, ""); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.deletes) != 1 || remote.deletes[0].Path != "/b/a.jpg" {
+		t.Errorf("deletes = %+v, want the unchanged source deleted on the retry", remote.deletes)
+	}
+}
+
+// TestMetadataUpdateRestampsTheUpdatedObject: a metadata-only update can
+// rewrite the remote object itself (S3 changes Content-Encoding through an
+// in-place copy, minting a new ETag and mtime). The stamp saved back to the
+// filer must be the one the update produced — a stat instead could fail the
+// freshness comparison on the legitimately new ETag and keep the stale
+// stamp, so a later delete would keep the object.
+func TestMetadataUpdateRestampsTheUpdatedObject(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/"}
+	stamp := &filer_pb.RemoteEntry{StorageName: "gcs", RemoteETag: `"orig"`, RemoteSize: 3, RemoteMtime: 100}
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/vol",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      &filer_pb.Entry{Name: "f", Attributes: &filer_pb.FuseAttributes{Mtime: 100}, RemoteEntry: stamp},
+			NewParentPath: "/buckets/b/vol",
+			NewEntry: &filer_pb.Entry{Name: "f", Attributes: &filer_pb.FuseAttributes{Mtime: 100}, RemoteEntry: stamp,
+				Extended: map[string][]byte{"Content-Encoding": []byte("gzip")}},
+		},
+	}
+	remote := &recordingRemote{
+		objects:              map[string][]byte{"/b/vol/f": []byte("old")},
+		metadataUpdateResult: &filer_pb.RemoteEntry{StorageName: "gcs", RemoteETag: `"new"`, RemoteSize: 3, RemoteMtime: 200},
+	}
+	filerClient := &stubFilerClient{}
+	if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.metadataUpdates) != 1 {
+		t.Fatalf("metadataUpdates = %+v, want one", remote.metadataUpdates)
+	}
+	got := filerClient.updated.Entry.RemoteEntry
+	if filerClient.updates != 1 || got.RemoteMtime != 200 || got.RemoteETag != `"new"` {
+		t.Fatalf("stamped RemoteEntry = %+v, want the update's result (mtime 200, etag \"new\")", got)
+	}
+}
+
+// TestMetadataUpdateKeepsTheStoredStampOnNilResult: a backend that did not
+// rewrite the object reports no stamp; the entry keeps its own.
+func TestMetadataUpdateKeepsTheStoredStampOnNilResult(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "gcs", Bucket: "bucket", Path: "/"}
+	stamp := &filer_pb.RemoteEntry{StorageName: "gcs", RemoteETag: `"orig"`, RemoteSize: 3, RemoteMtime: 100}
+	resp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/b/vol",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      &filer_pb.Entry{Name: "f", Attributes: &filer_pb.FuseAttributes{Mtime: 100}, RemoteEntry: stamp},
+			NewParentPath: "/buckets/b/vol",
+			NewEntry: &filer_pb.Entry{Name: "f", Attributes: &filer_pb.FuseAttributes{Mtime: 100}, RemoteEntry: stamp,
+				Extended: map[string][]byte{"Content-Encoding": []byte("gzip")}},
+		},
+	}
+	remote := &recordingRemote{objects: map[string][]byte{"/b/vol/f": []byte("old")}}
+	filerClient := &stubFilerClient{}
+	if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp); err != nil {
+		t.Fatal(err)
+	}
+	if filerClient.updates != 1 || filerClient.updated.Entry.RemoteEntry.RemoteMtime != 100 {
+		t.Fatalf("stamped RemoteEntry = %+v, want the entry's own stamp kept (mtime 100)", filerClient.updated.Entry.RemoteEntry)
+	}
+}
+
+// TestReshapeCrossMountRename covers an update event with a path outside
+// the mount. The subscription delivers a rename when either path is under
+// the mount, and an update of the /etc/remote directory entry itself through
+// the daemon's /etc/remote prefix; processUpdateEvent then sliced the mount
+// prefix off both paths, which panics on a path shorter than the mount (seen
+// on a replay: "slice bounds out of range [20:11]" on the 11-byte
+// /etc/remote, every restart dying on the same event) and names a key in the
+// wrong tree on a longer one.
+func TestReshapeCrossMountRename(t *testing.T) {
+	const mount = "/buckets/mount"
+	chunked := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669, FileSize: 7}, Chunks: []*filer_pb.FileChunk{{FileId: "3,01", Size: 7}}}
+	}
+	event := func(oldDir, oldName, newDir, newName string, oldEntry *filer_pb.Entry) *filer_pb.SubscribeMetadataResponse {
+		if oldEntry == nil {
+			oldEntry = chunked(oldName)
+		}
+		return &filer_pb.SubscribeMetadataResponse{
+			Directory:         oldDir,
+			TsNs:              42,
+			EventNotification: &filer_pb.EventNotification{OldEntry: oldEntry, NewParentPath: newDir, NewEntry: chunked(newName), Signatures: []int32{7}},
+		}
+	}
+
+	t.Run("into the mount from a shorter path is a create of the new entry", func(t *testing.T) {
+		resp := event("/plain", "in.txt", mount+"/lock", "in.txt", nil)
+		got, inMount := reshapeCrossMountRename(mount, resp)
+		if !inMount || !filer_pb.IsCreate(got) {
+			t.Fatalf("got %+v inMount=%v, want a create", got, inMount)
+		}
+		if got.Directory != mount+"/lock" || got.EventNotification.NewParentPath != mount+"/lock" || got.EventNotification.NewEntry.Name != "in.txt" {
+			t.Errorf("create at %s/%s (dir %s), want %s/in.txt", got.EventNotification.NewParentPath, got.EventNotification.NewEntry.Name, got.Directory, mount+"/lock")
+		}
+		if got.TsNs != 42 || len(got.EventNotification.Signatures) != 1 {
+			t.Errorf("timestamp and signatures must carry over: %+v", got)
+		}
+	})
+
+	t.Run("into the mount from a longer path outside it is a create, not a key in the wrong tree", func(t *testing.T) {
+		resp := event("/buckets/other/deeper/tree", "x.txt", mount, "x.txt", nil)
+		got, inMount := reshapeCrossMountRename(mount, resp)
+		if !inMount || !filer_pb.IsCreate(got) || got.EventNotification.NewParentPath != mount {
+			t.Fatalf("got %+v inMount=%v, want a create under %s", got, inMount, mount)
+		}
+	})
+
+	t.Run("out of the mount is a delete of the old entry", func(t *testing.T) {
+		resp := event(mount+"/lock", "out.txt", "/plain", "out.txt", nil)
+		got, inMount := reshapeCrossMountRename(mount, resp)
+		if !inMount || !filer_pb.IsDelete(got) {
+			t.Fatalf("got %+v inMount=%v, want a delete", got, inMount)
+		}
+		if got.Directory != mount+"/lock" || got.EventNotification.OldEntry.Name != "out.txt" {
+			t.Errorf("delete of %s/%s, want %s/out.txt", got.Directory, got.EventNotification.OldEntry.Name, mount+"/lock")
+		}
+	})
+
+	t.Run("out of the mount keeps the object of a remote-only entry", func(t *testing.T) {
+		remoteOnly := &filer_pb.Entry{Name: "out.txt", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669, FileSize: 7}, RemoteEntry: &filer_pb.RemoteEntry{StorageName: "b2", RemoteSize: 7, RemoteMtime: 1786096669}}
+		resp := event(mount+"/lock", "out.txt", "/plain", "out.txt", remoteOnly)
+		if got, inMount := reshapeCrossMountRename(mount, resp); inMount || got != nil {
+			t.Fatalf("got %+v inMount=%v, want the event dropped", got, inMount)
+		}
+	})
+
+	t.Run("both paths inside is the update itself", func(t *testing.T) {
+		resp := event(mount+"/a", "x.txt", mount+"/b", "y.txt", nil)
+		if got, inMount := reshapeCrossMountRename(mount, resp); !inMount || got != resp {
+			t.Fatalf("got %+v inMount=%v, want the same event", got, inMount)
+		}
+	})
+
+	t.Run("an update of the /etc/remote directory entry itself is not the mount's event", func(t *testing.T) {
+		dirEntry := &filer_pb.Entry{Name: "remote", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}}
+		resp := &filer_pb.SubscribeMetadataResponse{
+			Directory:         "/etc",
+			EventNotification: &filer_pb.EventNotification{OldEntry: dirEntry, NewParentPath: "/etc", NewEntry: dirEntry},
+		}
+		if got, inMount := reshapeCrossMountRename("/buckets/c4x-storage", resp); inMount || got != nil {
+			t.Fatalf("got %+v inMount=%v, want the event dropped", got, inMount)
+		}
+	})
+
+	t.Run("neither path inside is not the mount's event", func(t *testing.T) {
+		resp := event("/plain", "x.txt", "/buckets/mounted-not", "x.txt", nil)
+		if got, inMount := reshapeCrossMountRename(mount, resp); inMount || got != nil {
+			t.Fatalf("got %+v inMount=%v, want the event dropped", got, inMount)
+		}
+	})
+
+	t.Run("a trailing slash on the mount flag changes nothing", func(t *testing.T) {
+		resp := event("/plain", "in.txt", mount, "in.txt", nil)
+		if got, inMount := reshapeCrossMountRename(mount+"/", resp); !inMount || !filer_pb.IsCreate(got) {
+			t.Fatalf("got %+v inMount=%v, want a create", got, inMount)
+		}
+	})
+}
+
+// TestRenameIntoMountUploadsDespiteTheOldStamp covers a file synced at a path
+// under the mount, renamed out (which deleted its remote object), and renamed
+// back in: the entry still carries the RemoteEntry the first sync stamped, so
+// shouldSendToRemote would skip the create the reshape made, leaving the new
+// key without an object. A reshaped create must send unconditionally.
+func TestRenameIntoMountUploadsDespiteTheOldStamp(t *testing.T) {
+	const mountedDir = "/buckets/mount"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/"}
+
+	stamp := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 7, RemoteMtime: 1786096669, LastLocalSyncTsNs: 1786096669*1e9 + 1}
+	newEntry := &filer_pb.Entry{
+		Name:        "back.txt",
+		Content:     []byte("payload"),
+		Attributes:  &filer_pb.FuseAttributes{Mtime: 1786096669},
+		RemoteEntry: stamp,
+	}
+	resp, inMount := reshapeCrossMountRename(mountedDir, &filer_pb.SubscribeMetadataResponse{
+		Directory: "/plain",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      &filer_pb.Entry{Name: "back.txt", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}, RemoteEntry: stamp},
+			NewParentPath: mountedDir + "/lock",
+			NewEntry:      newEntry,
+		},
+	})
+	if !inMount || !filer_pb.IsCreate(resp) {
+		t.Fatalf("reshape = %+v inMount=%v, want a create", resp, inMount)
+	}
+	if shouldSendToRemote(resp.EventNotification.NewEntry) {
+		t.Fatal("precondition: the stamp the rename carried should fail shouldSendToRemote")
+	}
+
+	remote := &recordingRemote{}
+	filerClient := &stubFilerClient{entry: newEntry}
+	if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp, true, "/plain/back.txt"); err != nil {
+		t.Fatal(err)
+	}
+	wantWrite := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/lock/back.txt"}
+	if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], wantWrite) {
+		t.Fatalf("writes = %+v, want the new key %s written", remote.writes, remote_storage.FormatLocation(wantWrite))
+	}
+
+	// a plain create keeps trusting the stamp
+	remote = &recordingRemote{}
+	if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, resp, false, ""); err != nil {
+		t.Fatal(err)
+	}
+	if len(remote.writes) != 0 {
+		t.Errorf("writes = %+v, want the stamped create skipped", remote.writes)
+	}
+}
+
+// TestRenameIntoMountWritesAnEmptyFile: a rename into the mount is reshaped
+// to a create with mustSend, and an empty entry has no data for the HasData
+// gate; the new key still takes a zero-byte object. A remote-only entry holds
+// nothing local to send and is skipped as before.
+func TestRenameIntoMountWritesAnEmptyFile(t *testing.T) {
+	const mountedDir = "/buckets/mount"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/"}
+	renameIn := func(entry *filer_pb.Entry) *filer_pb.SubscribeMetadataResponse {
+		resp, inMount := reshapeCrossMountRename(mountedDir, &filer_pb.SubscribeMetadataResponse{
+			Directory:         "/plain",
+			EventNotification: &filer_pb.EventNotification{OldEntry: entry, NewParentPath: mountedDir + "/lock", NewEntry: entry},
+		})
+		if !inMount || !filer_pb.IsCreate(resp) {
+			t.Fatalf("reshape = %+v inMount=%v, want a create", resp, inMount)
+		}
+		return resp
+	}
+	wantWrite := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/lock/empty.txt"}
+
+	t.Run("an empty entry writes a zero-byte object", func(t *testing.T) {
+		entry := &filer_pb.Entry{Name: "empty.txt", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}}
+		if filer.HasData(entry) {
+			t.Fatal("precondition: an empty entry carries no data")
+		}
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: entry}
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn(entry), true, "/plain/empty.txt"); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], wantWrite) {
+			t.Errorf("writes = %+v, want the new key %s written", remote.writes, remote_storage.FormatLocation(wantWrite))
+		}
+	})
+
+	t.Run("a remote-only entry still skips", func(t *testing.T) {
+		stamp := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 7, RemoteMtime: 1786096669, LastLocalSyncTsNs: 1786096669*1e9 + 1}
+		entry := &filer_pb.Entry{Name: "empty.txt", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669, FileSize: 7}, RemoteEntry: stamp}
+		if !isRemoteOnly(entry) {
+			t.Fatal("precondition: the entry should be remote-only")
+		}
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: entry}
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn(entry), true, "/plain/empty.txt"); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none for a remote-only entry", remote.writes)
+		}
+	})
+
+	// a stamped entry truncated to zero is not remote-only content: its stamp
+	// describes bytes the file no longer holds, so the new key takes a
+	// zero-byte object
+	t.Run("a truncated stamped entry writes a zero-byte object", func(t *testing.T) {
+		stamp := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 7, RemoteMtime: 1786096669, LastLocalSyncTsNs: 1786096669*1e9 + 1}
+		entry := &filer_pb.Entry{Name: "empty.txt", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}, RemoteEntry: stamp}
+		if !isRemoteOnly(entry) || isDroppedLocalCopy(entry) {
+			t.Fatal("precondition: a truncated stamped entry reports remote-only but is not a dropped copy")
+		}
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: entry}
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn(entry), true, "/plain/empty.txt"); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], wantWrite) {
+			t.Errorf("writes = %+v, want the new key %s written", remote.writes, remote_storage.FormatLocation(wantWrite))
+		}
+	})
+
+	// an ordinary create of an empty entry is unchanged: no object
+	t.Run("a plain empty create still writes nothing", func(t *testing.T) {
+		entry := &filer_pb.Entry{Name: "empty.txt", Attributes: &filer_pb.FuseAttributes{Mtime: 1786096669}}
+		remote := &recordingRemote{}
+		filerClient := &stubFilerClient{entry: entry}
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn(entry), false, ""); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want the empty create skipped", remote.writes)
+		}
+	})
+}
+
+// TestSupersededRenameInRecoversTheCurrentEntry covers a rename into the
+// mount whose create event the sync reaches only after remote.uncache dropped
+// the moved file's chunks: the upload is superseded, and skipping it leaves
+// the destination object missing once the source side's delete runs.
+func TestSupersededRenameInRecoversTheCurrentEntry(t *testing.T) {
+	const mountedDir = "/buckets/mount"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/mnt"}
+	srcMountLoc := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/plain-remote"}
+
+	stamp := &filer_pb.RemoteEntry{StorageName: "b2", RemoteETag: "abc", RemoteSize: 4, RemoteMtime: 1786096669, LastLocalSyncTsNs: 1786096669*1e9 + 1}
+	// the entry as the rename logged it: local chunks plus the stamp earned
+	// under the source mount
+	eventEntry := &filer_pb.Entry{
+		Name:        "a.txt",
+		Attributes:  &filer_pb.FuseAttributes{Mtime: 1786096669, FileSize: 4},
+		Chunks:      []*filer_pb.FileChunk{{FileId: "1,01111111", Size: 4}},
+		RemoteEntry: stamp,
+	}
+	// the entry as remote.uncache left it: the chunks are gone and the stamp
+	// still describes the source mount's object
+	uncached := &filer_pb.Entry{
+		Name:        "a.txt",
+		Attributes:  &filer_pb.FuseAttributes{Mtime: 1786096669, FileSize: 4},
+		RemoteEntry: stamp,
+	}
+	mappingContent, err := proto.Marshal(&remote_pb.RemoteStorageMapping{Mappings: map[string]*remote_pb.RemoteStorageLocation{
+		mountedDir: mountLoc,
+		"/plain":   srcMountLoc,
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	mappingEntry := &filer_pb.Entry{Name: filer.REMOTE_STORAGE_MOUNT_FILE, Content: mappingContent}
+	renameIn := &filer_pb.SubscribeMetadataResponse{
+		Directory:         mountedDir + "/lock",
+		EventNotification: &filer_pb.EventNotification{NewParentPath: mountedDir + "/lock", NewEntry: eventEntry},
+	}
+	dest := &remote_pb.RemoteStorageLocation{Name: "b2", Bucket: "bucket", Path: "/mnt/lock/a.txt"}
+
+	newFilerClient := func(entry *filer_pb.Entry) *stubFilerClient {
+		return &stubFilerClient{entries: map[string]*filer_pb.Entry{
+			mountedDir + "/lock/a.txt":                                       proto.Clone(entry).(*filer_pb.Entry),
+			filer.DirectoryEtcRemote + "/" + filer.REMOTE_STORAGE_MOUNT_FILE: mappingEntry,
+		}}
+	}
+
+	t.Run("uncached meanwhile: the source object is copied and the entry stamped", func(t *testing.T) {
+		remote := &recordingRemote{objects: map[string][]byte{"/plain-remote/a.txt": []byte("data")}}
+		filerClient := newFilerClient(uncached)
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn, true, "/plain/a.txt"); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], dest) {
+			t.Fatalf("writes = %+v, want the source copied to %s", remote.writes, remote_storage.FormatLocation(dest))
+		}
+		if string(remote.written[0]) != "data" {
+			t.Errorf("written = %q, want the source object's bytes", remote.written[0])
+		}
+		if filerClient.updates != 1 {
+			t.Errorf("updates = %d, want the entry stamped with the copy", filerClient.updates)
+		}
+	})
+
+	t.Run("the destination already holds it: only a stamp", func(t *testing.T) {
+		remote := &recordingRemote{objects: map[string][]byte{"/mnt/lock/a.txt": []byte("data")}, statETags: map[string]string{"/mnt/lock/a.txt": "abc"}}
+		filerClient := newFilerClient(uncached)
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn, true, "/plain/a.txt"); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want none once the destination holds the content", remote.writes)
+		}
+		if filerClient.updates != 1 {
+			t.Errorf("updates = %d, want the entry stamped", filerClient.updates)
+		}
+	})
+
+	t.Run("no object on either side: the event fails", func(t *testing.T) {
+		remote := &recordingRemote{objects: map[string][]byte{}}
+		filerClient := newFilerClient(uncached)
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn, true, "/plain/a.txt"); err == nil {
+			t.Fatal("want the event to fail and hold the offset")
+		}
+	})
+
+	t.Run("a pending marker under the mount names the source", func(t *testing.T) {
+		marked := proto.Clone(uncached).(*filer_pb.Entry)
+		marked.Extended = map[string][]byte{filer.ExtRemoteRenameSourceKey: []byte(mountedDir + "/lock/old.txt")}
+		remote := &recordingRemote{objects: map[string][]byte{"/mnt/lock/old.txt": []byte("data")}}
+		filerClient := newFilerClient(marked)
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn, true, "/plain/a.txt"); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 1 || !proto.Equal(remote.writes[0], dest) {
+			t.Fatalf("writes = %+v, want the marked source copied to %s", remote.writes, remote_storage.FormatLocation(dest))
+		}
+	})
+
+	t.Run("rewritten since: the superseding event uploads", func(t *testing.T) {
+		rewritten := &filer_pb.Entry{
+			Name:        "a.txt",
+			Attributes:  &filer_pb.FuseAttributes{Mtime: 1786096700, FileSize: 4},
+			Chunks:      []*filer_pb.FileChunk{{FileId: "2,02222222", Size: 4}},
+			RemoteEntry: stamp,
+		}
+		remote := &recordingRemote{}
+		filerClient := newFilerClient(rewritten)
+		if err := processCreateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, renameIn, true, "/plain/a.txt"); err != nil {
+			t.Fatal(err)
+		}
+		if len(remote.writes) != 0 {
+			t.Errorf("writes = %+v, want the rewrite's own event to upload", remote.writes)
+		}
+	})
+}
+
+func TestIsSystemPath(t *testing.T) {
+	tests := []struct {
+		dir      string
+		name     string
+		expected bool
+	}{
+		{dir: "/buckets", name: ".system", expected: true},
+		{dir: "/buckets/.system", name: "owners", expected: true},
+		{dir: "/buckets/.system/owners", name: "alice", expected: true},
+		{dir: "/buckets/.system/owners/alice", name: "mybucket", expected: true},
+		{dir: "/", name: ".system", expected: true},
+		{dir: "/.system", name: "config", expected: true},
+		{dir: "/custom-mount", name: ".system", expected: true},
+		{dir: "/custom-mount/.system/owners", name: "alice", expected: true},
+		// Bucket contents should not match
+		{dir: "/buckets/mybucket", name: "file.txt", expected: false},
+		{dir: "/buckets/mybucket", name: ".system", expected: false},
+		{dir: "/buckets/mybucket/.system", name: "data", expected: false},
+		{dir: "/buckets", name: ".system-other", expected: false},
+		{dir: "/buckets/.system-other", name: "sub", expected: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(fmt.Sprintf("%s/%s", tt.dir, tt.name), func(t *testing.T) {
+			got := isSystemPath(tt.dir, tt.name)
+			if got != tt.expected {
+				t.Errorf("isSystemPath(%q, %q) = %v, want %v", tt.dir, tt.name, got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestRemoteSyncSkipsSystemFolder(t *testing.T) {
+	const mountedDir = "/buckets"
+	mountLoc := &remote_pb.RemoteStorageLocation{Name: "azure", Bucket: "project-storage", Path: "/"}
+
+	// Test update event on /buckets/.system/owners/... is skipped
+	updateResp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/.system/owners/structify-api",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      &filer_pb.Entry{Name: "structify-copy-canary"},
+			NewParentPath: "/buckets/.system/owners/structify-api",
+			NewEntry:      &filer_pb.Entry{Name: "structify-copy-canary"},
+		},
+	}
+	remote := &recordingRemote{}
+	filerClient := &stubFilerClient{}
+	if err := processUpdateEvent(filerClient, filerClient, "", remote, mountedDir, mountLoc, updateResp); err != nil {
+		t.Fatalf("processUpdateEvent failed: %v", err)
+	}
+	if len(remote.writes) != 0 || len(remote.metadataUpdates) != 0 {
+		t.Fatalf("expected 0 remote writes or metadata updates for system path, got %d writes and %d metadata updates",
+			len(remote.writes), len(remote.metadataUpdates))
+	}
+
+	// Test delete event on /buckets/.system/owners/... is skipped
+	deleteResp := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/.system/owners/structify-api",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "structify-copy-canary"},
+		},
+	}
+	if err := processDeleteEvent(filerClient, remote, mountedDir, mountLoc, deleteResp); err != nil {
+		t.Fatalf("processDeleteEvent failed: %v", err)
+	}
+	if len(remote.deletes) != 0 {
+		t.Fatalf("expected 0 remote deletes for system path, got %d deletes", len(remote.deletes))
+	}
+}
diff --git a/weed/command/filer_shutdown_test.go b/weed/command/filer_shutdown_test.go
new file mode 100644
index 0000000000..775f6ee84e
--- /dev/null
+++ b/weed/command/filer_shutdown_test.go
@@ -0,0 +1,226 @@
+package command
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestFilerShutdownJoinsServeDuringParallelDrain(t *testing.T) {
+	var servers []*http.Server
+	var releases []func()
+	var completed []chan struct{}
+	var listenersClosing []chan struct{}
+	for range 2 {
+		entered := make(chan struct{})
+		release := make(chan struct{})
+		finish := sync.OnceFunc(func() { close(release) })
+		done := make(chan struct{})
+		closing := make(chan struct{})
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			close(entered)
+			<-release
+			w.WriteHeader(http.StatusNoContent)
+		}))
+		t.Cleanup(server.Close)
+		t.Cleanup(finish)
+		server.Config.RegisterOnShutdown(func() { close(closing) })
+		servers = append(servers, server.Config)
+		releases = append(releases, finish)
+		completed = append(completed, done)
+		listenersClosing = append(listenersClosing, closing)
+		go func() {
+			defer close(done)
+			response, err := server.Client().Get(server.URL)
+			if err != nil {
+				t.Error(err)
+				return
+			}
+			defer response.Body.Close()
+			io.Copy(io.Discard, response.Body)
+			if response.StatusCode != http.StatusNoContent {
+				t.Errorf("active request returned %s", response.Status)
+			}
+		}()
+		<-entered
+	}
+
+	grpcStarted := make(chan struct{})
+	grpcRelease := make(chan struct{})
+	releaseGrpc := sync.OnceFunc(func() { close(grpcRelease) })
+	t.Cleanup(releaseGrpc)
+	grpcStopped := make(chan struct{})
+	filerClosed := make(chan struct{})
+	var closes atomic.Int32
+	shutdown := newFilerShutdown(func() {}, func() {}, func() {
+		close(grpcStarted)
+		<-grpcRelease
+		close(grpcStopped)
+	}, func() {
+		closes.Add(1)
+		close(filerClosed)
+	}, servers...)
+	joined := make(chan struct{})
+	go func() { shutdown(); close(joined) }()
+	deadline := time.After(5 * time.Second)
+	select {
+	case <-grpcStarted:
+	case <-deadline:
+		t.Fatal("gRPC shutdown did not start")
+	}
+	for _, closing := range listenersClosing {
+		select {
+		case <-closing:
+		case <-deadline:
+			t.Fatal("HTTP shutdown did not start while gRPC was draining")
+		}
+	}
+	// Model the main Serve path joining shutdown as soon as listeners close.
+	serveReturned := make(chan struct{})
+	go func() { shutdown(); close(serveReturned) }()
+
+	releases[0]()
+	<-completed[0]
+	select {
+	case <-filerClosed:
+		t.Error("filer closed while another server still had an active request")
+	default:
+	}
+	select {
+	case <-serveReturned:
+		t.Error("Serve exit path returned before request draining completed")
+	default:
+	}
+	releases[1]()
+	<-completed[1]
+	select {
+	case <-filerClosed:
+		t.Error("filer closed while gRPC was still draining")
+	default:
+	}
+	releaseGrpc()
+	<-grpcStopped
+	<-joined
+	<-serveReturned
+	if closes.Load() != 1 {
+		t.Errorf("filer closed %d times, want once", closes.Load())
+	}
+}
+
+func TestFilerShutdownWaitsForHTTPAfterGrpcStops(t *testing.T) {
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	finish := sync.OnceFunc(func() { close(release) })
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		close(entered)
+		<-release
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
+	t.Cleanup(finish)
+	requestDone := make(chan struct{})
+	go func() {
+		defer close(requestDone)
+		response, err := server.Client().Get(server.URL)
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		response.Body.Close()
+	}()
+	<-entered
+
+	httpClosing := make(chan struct{})
+	server.Config.RegisterOnShutdown(func() { close(httpClosing) })
+	grpcStopped := make(chan struct{})
+	filerClosed := make(chan struct{})
+	shutdown := newFilerShutdown(func() {}, func() {}, func() { close(grpcStopped) }, func() { close(filerClosed) }, server.Config)
+	joined := make(chan struct{})
+	go func() { shutdown(); close(joined) }()
+	<-httpClosing
+	<-grpcStopped
+	select {
+	case <-filerClosed:
+		t.Error("filer closed while HTTP request was active")
+	case <-time.After(100 * time.Millisecond):
+	}
+	finish()
+	<-requestDone
+	<-joined
+	select {
+	case <-filerClosed:
+	default:
+		t.Error("filer was not closed after HTTP request completed")
+	}
+}
+
+func TestFilerShutdownLeavesLockRingBeforeDraining(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {}))
+	t.Cleanup(server.Close)
+	httpClosing := make(chan struct{})
+	server.Config.RegisterOnShutdown(func() { close(httpClosing) })
+
+	leaving := make(chan struct{})
+	releaseLeave := make(chan struct{})
+	finishLeave := sync.OnceFunc(func() { close(releaseLeave) })
+	t.Cleanup(finishLeave)
+	grpcStopping := make(chan struct{})
+	shutdown := newFilerShutdown(func() {
+		close(leaving)
+		<-releaseLeave
+	}, func() {}, func() { close(grpcStopping) }, func() {}, server.Config)
+	joined := make(chan struct{})
+	go func() { shutdown(); close(joined) }()
+
+	select {
+	case <-leaving:
+	case <-time.After(5 * time.Second):
+		t.Fatal("shutdown did not leave the lock ring")
+	}
+	select {
+	case <-grpcStopping:
+		t.Fatal("gRPC stopped accepting while the filer was still leaving the lock ring")
+	case <-httpClosing:
+		t.Fatal("HTTP stopped accepting while the filer was still leaving the lock ring")
+	case <-time.After(100 * time.Millisecond):
+	}
+	finishLeave()
+	<-joined
+	select {
+	case <-grpcStopping:
+	default:
+		t.Error("gRPC was not stopped after leaving the lock ring")
+	}
+}
+
+// The filer's own MetaAggregator and an in-process S3 gateway keep metadata
+// subscription streams open until the filer is shut down, which happens after
+// gRPC GracefulStop - so the subscriptions have to end before it, or every
+// shutdown sits out the full graceful-stop timeout.
+func TestFilerShutdownStopsSubscriptionsBeforeGrpc(t *testing.T) {
+	var order []string
+	var mu sync.Mutex
+	record := func(step string) func() {
+		return func() {
+			mu.Lock()
+			defer mu.Unlock()
+			order = append(order, step)
+		}
+	}
+	shutdown := newFilerShutdown(record("leave"), record("subscriptions"), record("grpc"), record("filer"))
+	shutdown()
+
+	want := []string{"leave", "subscriptions", "grpc", "filer"}
+	if len(order) != len(want) {
+		t.Fatalf("shutdown steps %v, want %v", order, want)
+	}
+	for i := range want {
+		if order[i] != want[i] {
+			t.Fatalf("shutdown steps %v, want %v", order, want)
+		}
+	}
+}
diff --git a/weed/command/filer_sync.go b/weed/command/filer_sync.go
index 284e037aad..554f5e3f99 100644
--- a/weed/command/filer_sync.go
+++ b/weed/command/filer_sync.go
@@ -7,9 +7,11 @@ import (
 	"os"
 	"regexp"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
@@ -74,6 +76,7 @@ type syncState struct {
 	grpcDialOption       grpc.DialOption
 	targetFiler          pb.ServerAddress
 	sourcePath           string
+	targetPath           string
 	sourceFilerSignature int32
 }
 
@@ -173,17 +176,24 @@ func runFilerSynchronize(cmd *Command, args []string) bool {
 
 	// per-cluster HTTPS clients for volume server connections
 	var httpClientA, httpClientB *util_http_client.HTTPClient
+	var jwtForFilerA, jwtForFilerB security.FilerJwtProvider
 	if *syncOptions.aSecurity != "" {
 		var err error
 		if httpClientA, err = security.LoadHTTPClientFromFile(*syncOptions.aSecurity); err != nil {
 			glog.Fatalf("load HTTPS client config for filer A: %v", err)
 		}
+		if jwtForFilerA, err = security.LoadFilerJwtFromFile(*syncOptions.aSecurity); err != nil {
+			glog.Fatalf("load filer JWT config for filer A: %v", err)
+		}
 	}
 	if *syncOptions.bSecurity != "" {
 		var err error
 		if httpClientB, err = security.LoadHTTPClientFromFile(*syncOptions.bSecurity); err != nil {
 			glog.Fatalf("load HTTPS client config for filer B: %v", err)
 		}
+		if jwtForFilerB, err = security.LoadFilerJwtFromFile(*syncOptions.bSecurity); err != nil {
+			glog.Fatalf("load filer JWT config for filer B: %v", err)
+		}
 	}
 
 	grace.SetupProfiling(*syncCpuProfile, *syncMemProfile)
@@ -213,11 +223,11 @@ func runFilerSynchronize(cmd *Command, args []string) bool {
 			if state == nil || state.processor == nil {
 				return
 			}
-			offsetTsNs := state.processor.processedTsWatermark.Load()
+			offsetTsNs := resumeTsNsFor(state.processor)
 			if offsetTsNs == 0 {
 				return
 			}
-			if err := setOffset(state.grpcDialOption, state.targetFiler, getSignaturePrefixByPath(state.sourcePath), state.sourceFilerSignature, offsetTsNs); err != nil {
+			if err := setOffset(state.grpcDialOption, state.targetFiler, getSignaturePrefixByPath(state.sourcePath, state.targetPath), state.sourceFilerSignature, offsetTsNs); err != nil {
 				glog.Errorf("failed to save checkpoint for %s on shutdown: %v", name, err)
 			} else {
 				glog.V(0).Infof("saved checkpoint for %s on shutdown: %v", name, time.Unix(0, offsetTsNs))
@@ -231,7 +241,7 @@ func runFilerSynchronize(cmd *Command, args []string) bool {
 	go func() {
 		// a->b
 		// set synchronization start timestamp to offset
-		initOffsetError := initOffsetFromTsMs(grpcDialOptionB, filerB, aFilerSignature, *syncOptions.aFromTsMs, getSignaturePrefixByPath(*syncOptions.aPath))
+		initOffsetError := initOffsetFromTsMs(grpcDialOptionB, filerB, aFilerSignature, *syncOptions.aFromTsMs, getSignaturePrefixByPath(*syncOptions.aPath, *syncOptions.bPath))
 		if initOffsetError != nil {
 			glog.Errorf("init offset from timestamp %d error from %s to %s: %v", *syncOptions.aFromTsMs, *syncOptions.filerA, *syncOptions.filerB, initOffsetError)
 			os.Exit(2)
@@ -262,7 +272,9 @@ func runFilerSynchronize(cmd *Command, args []string) bool {
 				bFilerSignature,
 				&syncStateA2B,
 				httpClientA,
-				httpClientB)
+				httpClientB,
+				jwtForFilerA,
+				jwtForFilerB)
 			if err != nil {
 				glog.Errorf("sync from %s to %s: %v", *syncOptions.filerA, *syncOptions.filerB, err)
 				time.Sleep(1747 * time.Millisecond)
@@ -273,7 +285,7 @@ func runFilerSynchronize(cmd *Command, args []string) bool {
 	if !*syncOptions.isActivePassive {
 		// b->a
 		// set synchronization start timestamp to offset
-		initOffsetError := initOffsetFromTsMs(grpcDialOptionA, filerA, bFilerSignature, *syncOptions.bFromTsMs, getSignaturePrefixByPath(*syncOptions.bPath))
+		initOffsetError := initOffsetFromTsMs(grpcDialOptionA, filerA, bFilerSignature, *syncOptions.bFromTsMs, getSignaturePrefixByPath(*syncOptions.bPath, *syncOptions.aPath))
 		if initOffsetError != nil {
 			glog.Errorf("init offset from timestamp %d error from %s to %s: %v", *syncOptions.bFromTsMs, *syncOptions.filerB, *syncOptions.filerA, initOffsetError)
 			os.Exit(2)
@@ -305,7 +317,9 @@ func runFilerSynchronize(cmd *Command, args []string) bool {
 					aFilerSignature,
 					&syncStateB2A,
 					httpClientB,
-					httpClientA)
+					httpClientA,
+					jwtForFilerB,
+					jwtForFilerA)
 				if err != nil {
 					glog.Errorf("sync from %s to %s: %v", *syncOptions.filerB, *syncOptions.filerA, err)
 					time.Sleep(2147 * time.Millisecond)
@@ -335,11 +349,15 @@ func initOffsetFromTsMs(grpcDialOption grpc.DialOption, targetFiler pb.ServerAdd
 
 func doSubscribeFilerMetaChanges(clientId int32, clientEpoch int32, sourceGrpcDialOption grpc.DialOption, sourceFiler pb.ServerAddress, sourcePath string, sourceExcludePaths []string, sourceReadChunkFromFiler bool, targetGrpcDialOption grpc.DialOption, targetFiler pb.ServerAddress, targetPath string,
 	replicationStr, collection string, ttlSec int, sinkWriteChunkByFiler bool, diskType string, debug bool, concurrency int, chunkConcurrency int, doDeleteFiles bool, sourceFilerSignature int32, targetFilerSignature int32, statePtr *atomic.Pointer[syncState],
-	sourceHttpClient *util_http_client.HTTPClient, sinkHttpClient *util_http_client.HTTPClient) error {
+	sourceHttpClient *util_http_client.HTTPClient, sinkHttpClient *util_http_client.HTTPClient,
+	sourceJwtProvider security.FilerJwtProvider, sinkJwtProvider security.FilerJwtProvider) error {
 
 	// if first time, start from now
 	// if has previously synced, resume from that point of time
-	sourceFilerOffsetTsNs, err := getOffset(targetGrpcDialOption, targetFiler, getSignaturePrefixByPath(sourcePath), sourceFilerSignature)
+	// the historical key ignored the target path; falling back to it lets a
+	// sync that predates target-scoped keys survive the upgrade
+	signaturePrefix := getSignaturePrefixByPath(sourcePath, targetPath)
+	sourceFilerOffsetTsNs, err := getOffsetWithFallback(targetGrpcDialOption, targetFiler, signaturePrefix, sourceFilerSignature, getSignaturePrefixByPath(sourcePath, "/"), sourceFilerSignature)
 	if err != nil {
 		return err
 	}
@@ -353,12 +371,18 @@ func doSubscribeFilerMetaChanges(clientId int32, clientEpoch int32, sourceGrpcDi
 	if sourceHttpClient != nil {
 		filerSource.SetHttpClient(sourceHttpClient)
 	}
+	if sourceJwtProvider != nil {
+		filerSource.SetFilerJwtProvider(sourceJwtProvider)
+	}
 	filerSink := &filersink.FilerSink{}
 	filerSink.DoInitialize(targetFiler.ToHttpAddress(), targetFiler.ToGrpcAddress(), targetPath, replicationStr, collection, ttlSec, diskType, targetGrpcDialOption, sinkWriteChunkByFiler)
 	filerSink.SetChunkConcurrency(chunkConcurrency)
 	if sinkHttpClient != nil {
 		filerSink.SetUploader(operation.NewUploaderWithHttpClient(sinkHttpClient))
 	}
+	if sinkJwtProvider != nil {
+		filerSink.SetFilerJwtProvider(sinkJwtProvider)
+	}
 	filerSink.SetSourceFiler(filerSource)
 
 	persistEventFn := genProcessFunction(sourcePath, targetPath, sourceExcludePaths, nil, nil, nil, filerSink, doDeleteFiles, debug)
@@ -378,7 +402,9 @@ func doSubscribeFilerMetaChanges(clientId int32, clientEpoch int32, sourceGrpcDi
 		glog.Warningf("invalid concurrency value, using default: %d", DefaultConcurrencyLimit)
 		concurrency = DefaultConcurrencyLimit
 	}
+	clientName := fmt.Sprintf("syncFrom_%s_To_%s", string(sourceFiler), string(targetFiler))
 	processor := NewMetadataProcessor(processEventFn, concurrency, sourceFilerOffsetTsNs)
+	processor.SetMetrics(sourceFiler.String(), targetFiler.String(), clientName, sourcePath)
 
 	// update sync state for graceful shutdown checkpoint saving
 	if statePtr != nil {
@@ -387,13 +413,43 @@ func doSubscribeFilerMetaChanges(clientId int32, clientEpoch int32, sourceGrpcDi
 			grpcDialOption:       targetGrpcDialOption,
 			targetFiler:          targetFiler,
 			sourcePath:           sourcePath,
+			targetPath:           targetPath,
 			sourceFilerSignature: sourceFilerSignature,
 		})
 	}
 
+	// The offset callback below only fires while events flow, so it freezes
+	// exactly when the workers are saturated; a ticker keeps lag honest. The
+	// idle heartbeat is folded in because the watermark stops at the last real
+	// event, so a quiet caught-up stream would otherwise show phantom lag.
+	lagGauge := statsCollect.FilerSyncLagSecondsGauge.WithLabelValues(sourceFiler.String(), targetFiler.String(), clientName, sourcePath)
+	var idleHeartbeatTsNs atomic.Int64
+	stopLagTicker := make(chan struct{})
+	defer close(stopLagTicker)
+	go func() {
+		ticker := time.NewTicker(time.Second)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-stopLagTicker:
+				return
+			case <-ticker.C:
+				freshnessTsNs := processor.processedTsWatermark.Load()
+				// a heartbeat means consumed, not replicated: while a failure
+				// pins the watermark it must not mask the growing lag
+				if processor.OldestFailedTsNs() == 0 {
+					freshnessTsNs = max(freshnessTsNs, idleHeartbeatTsNs.Load())
+				}
+				if freshnessTsNs == 0 {
+					continue
+				}
+				lagGauge.Set(max(0, time.Since(time.Unix(0, freshnessTsNs)).Seconds()))
+			}
+		}
+	}()
+
 	var lastLogTsNs = time.Now().UnixNano()
 	var lastProgressedTsNs int64
-	var clientName = fmt.Sprintf("syncFrom_%s_To_%s", string(sourceFiler), string(targetFiler))
 	processEventFnWithOffset := pb.AddOffsetFunc(func(resp *filer_pb.SubscribeMetadataResponse) error {
 		processor.AddSyncJob(resp)
 		return nil
@@ -420,7 +476,7 @@ func doSubscribeFilerMetaChanges(clientId int32, clientEpoch int32, sourceGrpcDi
 		lastProgressedTsNs = offsetTsNs
 		// collect synchronous offset
 		statsCollect.FilerSyncOffsetGauge.WithLabelValues(sourceFiler.String(), targetFiler.String(), clientName, sourcePath).Set(float64(offsetTsNs))
-		return setOffset(targetGrpcDialOption, targetFiler, getSignaturePrefixByPath(sourcePath), sourceFilerSignature, offsetTsNs)
+		return setOffset(targetGrpcDialOption, targetFiler, signaturePrefix, sourceFilerSignature, resumeTsNsFor(processor))
 	})
 
 	prefix := sourcePath
@@ -439,12 +495,22 @@ func doSubscribeFilerMetaChanges(clientId int32, clientEpoch int32, sourceGrpcDi
 		StartTsNs:              sourceFilerOffsetTsNs,
 		StopTsNs:               0,
 		EventErrorType:         pb.RetryForeverOnError,
+		GetResumeTsNs: func() int64 {
+			return resumeTsNsFor(processor)
+		},
+		Resubscribe: processor.ResubscribeCh(),
 		// While the source has only read activity it emits no metadata events, so
 		// the watermark above never advances and sync_offset would look stuck.
 		// The idle heartbeat moves the gauge to the source's current time once we
 		// are caught up, so now-sync_offset reflects real lag and stays alertable.
 		OnIdleHeartbeat: func(tsNs int64) {
+			// same masking concern as the lag ticker: a pinned failure must
+			// keep now-sync_offset growing too
+			if processor.OldestFailedTsNs() != 0 {
+				return
+			}
 			statsCollect.FilerSyncOffsetGauge.WithLabelValues(sourceFiler.String(), targetFiler.String(), clientName, sourcePath).Set(float64(tsNs))
+			idleHeartbeatTsNs.Store(tsNs)
 		},
 	}
 
@@ -452,14 +518,22 @@ func doSubscribeFilerMetaChanges(clientId int32, clientEpoch int32, sourceGrpcDi
 
 }
 
-// When each business is distinguished according to path, and offsets need to be maintained separately.
-func getSignaturePrefixByPath(path string) string {
-	// compatible historical version
-	if path == "/" {
-		return SyncKeyPrefix
-	} else {
-		return SyncKeyPrefix + path
+// Offsets are kept per (source path, target path): two syncs from the same
+// source to different directories on the same target filer see the same events
+// but progress independently, so a shared key would let one push the other
+// past events it never processed. "/" contributes nothing on either side,
+// keeping the historical key form so existing deployments resume unchanged.
+func getSignaturePrefixByPath(sourcePath, targetPath string) string {
+	prefix := SyncKeyPrefix
+	if sourcePath != "/" {
+		prefix += sourcePath
 	}
+	if targetPath != "/" {
+		// NUL cannot occur in a path, so the combined key can alias neither a
+		// source-only key nor another (source, target) pair
+		prefix += "\x00" + targetPath
+	}
+	return prefix
 }
 
 func getOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, signaturePrefix string, signature int32) (lastOffsetTsNs int64, readErr error) {
@@ -489,16 +563,91 @@ func getOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, signature
 
 }
 
-func setOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, signaturePrefix string, signature int32, offsetTsNs int64) error {
-	return pb.WithFilerClient(false, signature, filer, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+// getOffsetWithFallback reads the offset under the current key, falling back
+// to the historical key when the current one has no value yet, so streams
+// created before a checkpoint key-scheme change resume where they left off
+// instead of replaying from zero. Writes must go only to the current key:
+// keeping the historical key warm would re-create the very sharing between
+// streams that a key-scheme change separates.
+func getOffsetWithFallback(grpcDialOption grpc.DialOption, filer pb.ServerAddress, signaturePrefix string, signature int32, legacySignaturePrefix string, legacySignature int32) (int64, error) {
+	lastOffsetTsNs, err := getOffset(grpcDialOption, filer, signaturePrefix, signature)
+	if err == nil && lastOffsetTsNs == 0 {
+		lastOffsetTsNs, err = getOffset(grpcDialOption, filer, legacySignaturePrefix, legacySignature)
+	}
+	return lastOffsetTsNs, err
+}
 
-		syncKey := []byte(signaturePrefix + "____")
-		util.Uint32toBytes(syncKey[len(signaturePrefix):len(signaturePrefix)+4], uint32(signature))
+// A checkpoint write can outlive its caller's wait and land beside the next
+// subscription attempt's writes; issued concurrently they may be applied out
+// of order, moving saved progress backward or forward past events still owed
+// a replay. Writes to the same persisted key are serialized and each is
+// ordered by issuance: a write issued before the last one to land is stale
+// and dropped. Deliberate regressions — resume floors, operator seeds — are
+// issued after the writes they supersede, so they still apply. State is keyed
+// by target filer so unrelated streams — or the two directions of a
+// bidirectional sync — never block or shadow each other.
+var offsetCheckpointWrites = struct {
+	sync.Mutex
+	byKey map[string]*offsetCheckpoint
+}{byKey: map[string]*offsetCheckpoint{}}
+
+type offsetCheckpoint struct {
+	sync.Mutex
+	lastSeq int64
+}
+
+// resumeTsNsFor floors the processed watermark by the earliest failure the
+// processor saw: a redelivery can clear the pin, but events dropped while it
+// was stopped only replay if the resume position stays behind it. It also
+// stays one tick below the newest timestamp seen — a watermark on the
+// frontier can have finished every job it admitted while more events at the
+// same timestamp still sit unread in the log, and an exclusive resume there
+// would skip them.
+func resumeTsNsFor(p *MetadataProcessor) int64 {
+	ts := p.processedTsWatermark.Load()
+	if newestTsNs := p.NewestSeenTsNs(); newestTsNs > 0 && ts >= newestTsNs {
+		ts = newestTsNs - 1
+	}
+	if failedTsNs := p.EarliestFailedTsNs(); failedTsNs > 0 && failedTsNs-1 < ts {
+		ts = failedTsNs - 1
+	}
+	return ts
+}
+
+// offsetWriteSeq numbers checkpoint writes in issuance order so a write that
+// lands late can be told apart from the fresher write it would shadow.
+var offsetWriteSeq atomic.Int64
+
+func setOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, signaturePrefix string, signature int32, offsetTsNs int64) error {
+	syncKey := []byte(signaturePrefix + "____")
+	util.Uint32toBytes(syncKey[len(signaturePrefix):len(signaturePrefix)+4], uint32(signature))
+	key := string(filer) + "\x00" + string(syncKey)
+
+	offsetCheckpointWrites.Lock()
+	checkpoint := offsetCheckpointWrites.byKey[key]
+	if checkpoint == nil {
+		checkpoint = &offsetCheckpoint{}
+		offsetCheckpointWrites.byKey[key] = checkpoint
+	}
+	offsetCheckpointWrites.Unlock()
+
+	seq := offsetWriteSeq.Add(1)
+	checkpoint.Lock()
+	defer checkpoint.Unlock()
+	if seq < checkpoint.lastSeq {
+		return nil
+	}
+	checkpoint.lastSeq = seq
+
+	return pb.WithFilerClient(false, signature, filer, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
 
 		valueBuf := make([]byte, 8)
 		util.Uint64toBytes(valueBuf, uint64(offsetTsNs))
 
-		resp, err := client.KvPut(context.Background(), &filer_pb.KvPutRequest{
+		// a stalled KvPut must not hold a caller's drain or persistence loop
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		resp, err := client.KvPut(ctx, &filer_pb.KvPutRequest{
 			Key:   syncKey,
 			Value: valueBuf,
 		})
@@ -513,7 +662,6 @@ func setOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, signature
 		return nil
 
 	})
-
 }
 
 func genProcessFunction(sourcePath string, targetPath string, excludePaths []string, reExcludeFileName *regexp.Regexp, excludeFileNames []*wildcard.WildcardMatcher, excludePathPatterns []*wildcard.WildcardMatcher, dataSink sink.ReplicationSink, doDeleteFiles bool, debug bool) func(resp *filer_pb.SubscribeMetadataResponse) error {
@@ -585,7 +733,7 @@ func genProcessFunction(sourcePath string, targetPath string, excludePaths []str
 				return nil
 			}
 			key := buildKey(dataSink, message, targetPath, sourceOldKey, sourcePath)
-			return dataSink.DeleteEntry(key, message.OldEntry.IsDirectory, message.DeleteChunks, message.Signatures)
+			return sink.DeleteEntry(dataSink, key, message.OldEntry.IsDirectory, message.DeleteChunks, filer.IsMetadataOnlyDelete(message.OldEntry), message.Signatures)
 		}
 
 		// handle new entries
diff --git a/weed/command/filer_sync_jobs.go b/weed/command/filer_sync_jobs.go
index 396b2af2cb..a791158b40 100644
--- a/weed/command/filer_sync_jobs.go
+++ b/weed/command/filer_sync_jobs.go
@@ -7,12 +7,20 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	statsCollect "github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
+// maxFailedSyncEvents bounds the failedTs ledger. A destination rejecting
+// every event would otherwise add an entry per source event for the life of
+// the processor.
+var maxFailedSyncEvents = 1 << 16
+
 // tsMinHeap implements heap.Interface for int64 timestamps.
 type tsMinHeap []int64
 
@@ -51,18 +59,48 @@ const (
 )
 
 type syncJobPaths struct {
+	path     util.FullPath
+	newPath  util.FullPath // empty for non-renames
+	kind     jobKind
+	dataSize int64
+}
+
+// failedEventKey identifies an event for the failure ledger. A timestamp alone
+// is not unique across events, so a success for one event must not clear an
+// unresolved failure recorded for a different event at the same TsNs.
+type failedEventKey struct {
+	tsNs    int64
 	path    util.FullPath
-	newPath util.FullPath // empty for non-renames
+	newPath util.FullPath
 	kind    jobKind
 }
 
+// syncStreamMetrics holds the metric children for one sync stream, curried
+// once so per-event updates skip the label lookup.
+type syncStreamMetrics struct {
+	received       prometheus.Counter
+	processed      prometheus.Counter
+	failed         prometheus.Counter
+	inFlight       prometheus.Gauge
+	receivedBytes  prometheus.Counter
+	processedBytes prometheus.Counter
+	failedBytes    prometheus.Counter
+	inFlightBytes  prometheus.Gauge
+}
+
 type MetadataProcessor struct {
-	activeJobs           map[int64]*syncJobPaths
+	// activeJobCount is the number of in-flight jobs and activeJobTs counts
+	// them per event timestamp. Several events can share a TsNs — batched
+	// writes log together — so a single slot per TsNs would drain early and
+	// let the resubscribe or the watermark outrun a sibling still running.
+	activeJobCount       int
+	activeJobTs          map[int64]int
 	activeJobsLock       sync.Mutex
 	activeJobsCond       *sync.Cond
 	concurrencyLimit     int
 	fn                   pb.ProcessMetadataFunc
 	processedTsWatermark atomic.Int64
+	filteredTsNs         int64
 
 	// Indexes for O(depth) conflict detection, replacing O(n) linear scan.
 	// activeFilePaths counts active file jobs at each exact path.
@@ -88,28 +126,126 @@ type MetadataProcessor struct {
 	// used for O(log n) amortized watermark tracking.
 	tsHeap tsMinHeap
 
-	// oldestFailedTsNs is the timestamp of the oldest event whose job returned
-	// an error, or 0 when none has. The watermark is never advanced to it or
-	// past it, so the persisted sync offset stays behind the failure and a
-	// restart replays the event instead of skipping it forever.
+	// failedTs records every event whose job returned an error and has not
+	// since completed, and oldestFailedTsNs caches its minimum (0 when empty).
+	// The watermark is never advanced to it or past it, so the persisted sync
+	// offset stays behind the failure and a restart replays the event instead
+	// of skipping it forever. Past maxFailedSyncEvents the set collapses to a
+	// sticky pin at the smallest failure seen: replay from the oldest failure
+	// still works, but individual recoveries no longer unpin until a restart.
+	failedTs         map[failedEventKey]struct{}
+	failedSticky     bool
 	oldestFailedTsNs int64
+
+	// earliestFailedTsNs is the smallest timestamp this processor ever failed
+	// on, latched for its lifetime: a redelivery can clear failedTs, but by
+	// then the processor is stopped and has already dropped unrecorded
+	// events — possibly sharing the failure's timestamp — so a resume
+	// position must still sit behind it.
+	earliestFailedTsNs int64
+
+	// newestSeenTsNs is the largest TsNs the stream has offered, job or
+	// marker. A watermark equal to it is not a safe resume point: more
+	// events at the same timestamp can still sit unread in the log, so the
+	// persisted position has to stay one tick below it.
+	newestSeenTsNs int64
+
+	// resubscribeCh closes once a failure has stopped the processor and all
+	// in-flight jobs have drained, asking the metadata follower to drop the
+	// stream so the caller's reconnect replays the pinned events in order —
+	// and never races the replay against work still running in this abandoned
+	// processor.
+	resubscribeCh   chan struct{}
+	resubscribeOnce sync.Once
+
+	// stopped latches when a job failure pins the watermark. Admission then
+	// drops new events instead of queueing them into a processor that is about
+	// to be abandoned: every skipped event replays from the pinned watermark
+	// after the reconnect, and on a stream that never goes quiet the drain —
+	// and with it the replay — would otherwise never come. The cond broadcast
+	// releases a blocked AddSyncJob. A redelivery of an event still in
+	// failedTs is the one exception: it may run so its success shrinks the
+	// replay.
+	stopped bool
+
+	// metrics is nil for callers that do not report per-event metrics.
+	metrics *syncStreamMetrics
 }
 
 func NewMetadataProcessor(fn pb.ProcessMetadataFunc, concurrency int, offsetTsNs int64) *MetadataProcessor {
 	t := &MetadataProcessor{
 		fn:                       fn,
-		activeJobs:               make(map[int64]*syncJobPaths),
+		activeJobTs:              make(map[int64]int),
 		concurrencyLimit:         concurrency,
 		activeFilePaths:          make(map[util.FullPath]int),
 		activeBarrierDirPaths:    make(map[util.FullPath]int),
 		activeNonBarrierDirPaths: make(map[util.FullPath]int),
 		descendantCount:          make(map[util.FullPath]int),
+		failedTs:                 make(map[failedEventKey]struct{}),
+		resubscribeCh:            make(chan struct{}),
 	}
 	t.processedTsWatermark.Store(offsetTsNs)
 	t.activeJobsCond = sync.NewCond(&t.activeJobsLock)
 	return t
 }
 
+// SetMetrics enables per-event metrics for this stream, labeled the same way
+// as the existing sync_offset gauge.
+func (t *MetadataProcessor) SetMetrics(sourceFiler, targetFiler, clientName, path string) {
+	t.metrics = &syncStreamMetrics{
+		received:       statsCollect.FilerSyncEventsReceivedCounter.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+		processed:      statsCollect.FilerSyncEventsProcessedCounter.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+		failed:         statsCollect.FilerSyncEventsFailedCounter.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+		inFlight:       statsCollect.FilerSyncInFlightJobsGauge.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+		receivedBytes:  statsCollect.FilerSyncReceivedBytesCounter.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+		processedBytes: statsCollect.FilerSyncProcessedBytesCounter.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+		failedBytes:    statsCollect.FilerSyncFailedBytesCounter.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+		inFlightBytes:  statsCollect.FilerSyncInFlightBytesGauge.WithLabelValues(sourceFiler, targetFiler, clientName, path),
+	}
+}
+
+// OldestFailedTsNs returns the timestamp of the oldest permanently failed
+// event, or 0 when none is pinning the watermark.
+func (t *MetadataProcessor) OldestFailedTsNs() int64 {
+	t.activeJobsLock.Lock()
+	defer t.activeJobsLock.Unlock()
+	return t.oldestFailedTsNs
+}
+
+// EarliestFailedTsNs returns the smallest timestamp this processor has ever
+// failed on, including failures later cleared by a redelivery.
+func (t *MetadataProcessor) EarliestFailedTsNs() int64 {
+	t.activeJobsLock.Lock()
+	defer t.activeJobsLock.Unlock()
+	return t.earliestFailedTsNs
+}
+
+// NewestSeenTsNs returns the largest TsNs the stream has offered so far.
+func (t *MetadataProcessor) NewestSeenTsNs() int64 {
+	t.activeJobsLock.Lock()
+	defer t.activeJobsLock.Unlock()
+	return t.newestSeenTsNs
+}
+
+// ResubscribeCh closes once a job failure has stopped the processor and its
+// in-flight jobs have drained, signaling the metadata follower to drop the
+// stream so a reconnect replays what the watermark still covers.
+func (t *MetadataProcessor) ResubscribeCh() <-chan struct{} {
+	return t.resubscribeCh
+}
+
+// Drain blocks until every admitted job has finished. Callers whose stream
+// just ended use it before reconnecting: a replayed event must not race a
+// still-running job for the same path, or the older write could finish last
+// and clobber the newer one.
+func (t *MetadataProcessor) Drain() {
+	t.activeJobsLock.Lock()
+	defer t.activeJobsLock.Unlock()
+	for t.activeJobCount > 0 {
+		t.activeJobsCond.Wait()
+	}
+}
+
 // pathAncestors returns all proper ancestor directories of p.
 // For "/a/b/c", returns ["/a/b", "/a", "/"].
 func pathAncestors(p util.FullPath) []util.FullPath {
@@ -238,24 +374,83 @@ func (t *MetadataProcessor) conflictsWith(resp *filer_pb.SubscribeMetadataRespon
 
 func (t *MetadataProcessor) AddSyncJob(resp *filer_pb.SubscribeMetadataResponse) {
 	if filer_pb.IsEmpty(resp) {
+		// A filtered-progress marker means the source skipped everything below
+		// it for us; once all earlier work has finished, the watermark can move
+		// to it so idle stretches still advance the resume point.
+		t.activeJobsLock.Lock()
+		defer t.activeJobsLock.Unlock()
+		if resp.TsNs > t.newestSeenTsNs {
+			t.newestSeenTsNs = resp.TsNs
+		}
+		if resp.TsNs > t.filteredTsNs {
+			t.filteredTsNs = resp.TsNs
+		}
+		if t.activeJobCount == 0 && resp.TsNs > t.processedTsWatermark.Load() &&
+			(t.oldestFailedTsNs == 0 || resp.TsNs < t.oldestFailedTsNs) {
+			t.processedTsWatermark.Store(resp.TsNs)
+		}
 		return
 	}
 
+	dataSize := eventDataSize(resp)
+
 	t.activeJobsLock.Lock()
 	defer t.activeJobsLock.Unlock()
 
-	for len(t.activeJobs) >= t.concurrencyLimit || t.conflictsWith(resp) {
-		t.activeJobsCond.Wait()
+	if resp.TsNs > t.newestSeenTsNs {
+		t.newestSeenTsNs = resp.TsNs
 	}
 
 	p, newPath, kind := extractJobInfo(resp)
-	jobPaths := &syncJobPaths{path: p, newPath: newPath, kind: kind}
+	eventKey := failedEventKey{tsNs: resp.TsNs, path: p, newPath: newPath, kind: kind}
 
-	t.activeJobs[resp.TsNs] = jobPaths
+	for t.activeJobCount >= t.concurrencyLimit || t.conflictsWith(resp) {
+		// A stopped processor never queues: an event that cannot start drops
+		// and replays in order after the resubscribe.
+		if t.stopped {
+			return
+		}
+		t.activeJobsCond.Wait()
+	}
+	if t.stopped {
+		select {
+		case <-t.resubscribeCh:
+			// Already drained and signaled: nothing may start now, or it would
+			// race the replay the signal just asked for.
+			return
+		default:
+		}
+		// The one event still worth running is a failure still pinning the
+		// watermark, redelivered on this stream: its success clears the ledger
+		// entry and shrinks the replay. Everything else replays anyway.
+		if _, pinned := t.failedTs[eventKey]; !pinned {
+			return
+		}
+	}
+
+	// counted once admitted: received-processed-failed is the number of events
+	// this processor read but has not finished. A dropped event is not counted
+	// here — the replay's own admission counts it.
+	if t.metrics != nil {
+		t.metrics.received.Inc()
+		t.metrics.receivedBytes.Add(float64(dataSize))
+	}
+
+	jobPaths := &syncJobPaths{path: p, newPath: newPath, kind: kind, dataSize: dataSize}
+
+	t.activeJobCount++
+	t.activeJobTs[resp.TsNs]++
 	t.addPathToIndex(p, kind)
 	if newPath != "" {
 		t.addPathToIndex(newPath, kind)
 	}
+	// Inc/Dec rather than Set from local state: after a subscription retry a
+	// new processor shares these children with the old one's still-draining
+	// jobs, and each job accounting for itself keeps the total truthful.
+	if t.metrics != nil {
+		t.metrics.inFlight.Inc()
+		t.metrics.inFlightBytes.Add(float64(dataSize))
+	}
 
 	heap.Push(&t.tsHeap, resp.TsNs)
 
@@ -268,25 +463,78 @@ func (t *MetadataProcessor) AddSyncJob(resp *filer_pb.SubscribeMetadataResponse)
 		t.activeJobsLock.Lock()
 		defer t.activeJobsLock.Unlock()
 
+		failedKey := failedEventKey{tsNs: resp.TsNs, path: jobPaths.path, newPath: jobPaths.newPath, kind: jobPaths.kind}
 		if jobErr != nil {
-			if t.oldestFailedTsNs == 0 || resp.TsNs < t.oldestFailedTsNs {
-				t.oldestFailedTsNs = resp.TsNs
-				glog.Errorf("process %v: %v; holding sync offset at %v so this event is replayed on restart", resp, jobErr, time.Unix(0, resp.TsNs))
-			} else {
+			// Latch the stop the moment a failure lands: events behind the pin
+			// replay after the resubscribe anyway, and a stream that never goes
+			// quiet would otherwise keep the active count above zero so the
+			// failure stays pinned until an unrelated reconnect — the wait this
+			// whole mechanism exists to remove.
+			t.stopped = true
+			t.activeJobsCond.Broadcast()
+			if t.earliestFailedTsNs == 0 || resp.TsNs < t.earliestFailedTsNs {
+				t.earliestFailedTsNs = resp.TsNs
+			}
+			if t.failedSticky {
+				if resp.TsNs < t.oldestFailedTsNs {
+					t.oldestFailedTsNs = resp.TsNs
+				}
 				glog.Errorf("process %v: %v", resp, jobErr)
+			} else if _, recorded := t.failedTs[failedKey]; !recorded {
+				if len(t.failedTs) >= maxFailedSyncEvents {
+					t.failedSticky = true
+					t.failedTs = nil
+					if resp.TsNs < t.oldestFailedTsNs {
+						t.oldestFailedTsNs = resp.TsNs
+					}
+					glog.Warningf("process %v: %v; over %d unresolved failures, pinning sync offset at %v until restart", resp, jobErr, maxFailedSyncEvents, time.Unix(0, t.oldestFailedTsNs))
+				} else {
+					t.failedTs[failedKey] = struct{}{}
+					if t.oldestFailedTsNs == 0 || resp.TsNs < t.oldestFailedTsNs {
+						t.oldestFailedTsNs = resp.TsNs
+						glog.Errorf("process %v: %v; holding sync offset at %v so this event is replayed on restart", resp, jobErr, time.Unix(0, resp.TsNs))
+					} else {
+						glog.Errorf("process %v: %v", resp, jobErr)
+					}
+				}
+			}
+		} else if _, recorded := t.failedTs[failedKey]; recorded {
+			delete(t.failedTs, failedKey)
+			if resp.TsNs == t.oldestFailedTsNs {
+				t.oldestFailedTsNs = 0
+				for k := range t.failedTs {
+					if t.oldestFailedTsNs == 0 || k.tsNs < t.oldestFailedTsNs {
+						t.oldestFailedTsNs = k.tsNs
+					}
+				}
 			}
 		}
 
-		delete(t.activeJobs, resp.TsNs)
+		t.activeJobCount--
+		t.activeJobTs[resp.TsNs]--
+		if t.activeJobTs[resp.TsNs] == 0 {
+			delete(t.activeJobTs, resp.TsNs)
+		}
 		t.removePathFromIndex(jobPaths.path, jobPaths.kind)
 		if jobPaths.newPath != "" {
 			t.removePathFromIndex(jobPaths.newPath, jobPaths.kind)
 		}
+		if t.metrics != nil {
+			if jobErr != nil {
+				t.metrics.failed.Inc()
+				t.metrics.failedBytes.Add(float64(jobPaths.dataSize))
+			} else {
+				t.metrics.processed.Inc()
+				t.metrics.processedBytes.Add(float64(jobPaths.dataSize))
+			}
+			t.metrics.inFlight.Dec()
+			t.metrics.inFlightBytes.Sub(float64(jobPaths.dataSize))
+		}
 
 		// Lazy-clean stale entries from heap top (already-completed jobs).
 		// Each entry is pushed once and popped once: O(log n) amortized.
 		for t.tsHeap.Len() > 0 {
-			if _, active := t.activeJobs[t.tsHeap[0]]; active {
+			if t.activeJobTs[t.tsHeap[0]] > 0 {
 				break
 			}
 			heap.Pop(&t.tsHeap)
@@ -299,10 +547,38 @@ func (t *MetadataProcessor) AddSyncJob(resp *filer_pb.SubscribeMetadataResponse)
 				t.processedTsWatermark.Store(resp.TsNs)
 			}
 		}
+		if t.activeJobCount == 0 && t.filteredTsNs > t.processedTsWatermark.Load() &&
+			(t.oldestFailedTsNs == 0 || t.filteredTsNs < t.oldestFailedTsNs) {
+			t.processedTsWatermark.Store(t.filteredTsNs)
+		}
+		// Signal once the stop has drained: even if a redelivery cleared the
+		// pin, events dropped while stopped still have to replay.
+		if t.stopped && t.activeJobCount == 0 {
+			t.resubscribeOnce.Do(func() { close(t.resubscribeCh) })
+		}
 		t.activeJobsCond.Signal()
 	}()
 }
 
+// eventDataSize is the chunk data this event will copy: chunks on the new
+// entry that the old entry does not already have. Deletes, renames, and
+// attribute-only updates all come out zero, so byte rates reflect data
+// movement rather than metadata churn.
+func eventDataSize(resp *filer_pb.SubscribeMetadataResponse) (size int64) {
+	message := resp.EventNotification
+	if message.NewEntry == nil {
+		return 0
+	}
+	newChunks := message.NewEntry.GetChunks()
+	if message.OldEntry != nil {
+		newChunks = filer.DoMinusChunks(newChunks, message.OldEntry.GetChunks())
+	}
+	for _, chunk := range newChunks {
+		size += int64(chunk.Size)
+	}
+	return size
+}
+
 // extractJobInfo derives the conflict-detection path(s) and job kind for a
 // metadata event. A rename returns both the source and destination paths; all
 // other event shapes return only the primary path.
diff --git a/weed/command/filer_sync_jobs_test.go b/weed/command/filer_sync_jobs_test.go
index 1c6a1f3ce4..20f5ab04da 100644
--- a/weed/command/filer_sync_jobs_test.go
+++ b/weed/command/filer_sync_jobs_test.go
@@ -4,9 +4,11 @@ import (
 	"container/heap"
 	"errors"
 	"fmt"
+	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus/testutil"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
@@ -93,8 +95,8 @@ func TestFileVsFileConflict(t *testing.T) {
 
 	// Add a file job
 	active := makeResp("/dir1", "file.txt", false, 1, true)
-	path, newPath, kind := extractJobInfo(active)
-	p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+	path, _, kind := extractJobInfo(active)
+	p.activeJobTs[active.TsNs] = 1
 	p.addPathToIndex(path, kind)
 
 	// Same file should conflict
@@ -124,8 +126,8 @@ func TestFileUnderActiveDirConflict(t *testing.T) {
 
 	// Add a directory job at /dir1
 	active := makeResp("/", "dir1", true, 1, true)
-	path, newPath, kind := extractJobInfo(active)
-	p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+	path, _, kind := extractJobInfo(active)
+	p.activeJobTs[active.TsNs] = 1
 	p.addPathToIndex(path, kind)
 
 	// File under /dir1 should conflict
@@ -162,8 +164,8 @@ func TestDirWithActiveFileUnder(t *testing.T) {
 
 	// Add file jobs under /dir1
 	f1 := makeResp("/dir1/sub", "file.txt", false, 1, true)
-	path, newPath, kind := extractJobInfo(f1)
-	p.activeJobs[f1.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+	path, _, kind := extractJobInfo(f1)
+	p.activeJobTs[f1.TsNs] = 1
 	p.addPathToIndex(path, kind)
 
 	// Directory /dir1 should conflict (has active file under it)
@@ -186,8 +188,8 @@ func TestDirVsDirConflict(t *testing.T) {
 
 	// Add directory job at /a/b
 	active := makeResp("/a", "b", true, 1, true)
-	path, newPath, kind := extractJobInfo(active)
-	p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+	path, _, kind := extractJobInfo(active)
+	p.activeJobTs[active.TsNs] = 1
 	p.addPathToIndex(path, kind)
 
 	// /a/b/c (descendant) should conflict
@@ -223,8 +225,8 @@ func TestRenameConflict(t *testing.T) {
 
 	// Add file job at /dir1/file.txt
 	f1 := makeResp("/dir1", "file.txt", false, 1, true)
-	path, newPath, kind := extractJobInfo(f1)
-	p.activeJobs[f1.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+	path, _, kind := extractJobInfo(f1)
+	p.activeJobTs[f1.TsNs] = 1
 	p.addPathToIndex(path, kind)
 
 	// Rename from /dir2/a.txt to /dir1/file.txt should conflict (newPath matches)
@@ -254,7 +256,7 @@ func TestActiveRenameConflict(t *testing.T) {
 	// Add active rename job: /dir1/old.txt -> /dir2/new.txt
 	rename := makeRenameResp("/dir1", "old.txt", "/dir2", "new.txt", false, 1)
 	path, newPath, kind := extractJobInfo(rename)
-	p.activeJobs[rename.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+	p.activeJobTs[rename.TsNs] = 1
 	p.addPathToIndex(path, kind)
 	if newPath != "" {
 		p.addPathToIndex(newPath, kind)
@@ -288,8 +290,8 @@ func TestRootDirConflict(t *testing.T) {
 	// Note: a dir entry at "/" would be created as FullPath("/").Child("somedir")
 	// But let's test what happens with an active dir at /some/path and check root
 	active := makeResp("/some", "dir", true, 1, true)
-	path, newPath, kind := extractJobInfo(active)
-	p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+	path, _, kind := extractJobInfo(active)
+	p.activeJobTs[active.TsNs] = 1
 	p.addPathToIndex(path, kind)
 
 	// Root dir should conflict because active dir /some/dir is under /
@@ -333,7 +335,7 @@ func TestWatermarkWithHeap(t *testing.T) {
 	// Simulate adding jobs in order
 	for _, ts := range []int64{10, 20, 30} {
 		jobPath := util.FullPath("/file" + string(rune('0'+ts/10)))
-		p.activeJobs[ts] = &syncJobPaths{path: jobPath, kind: kindFile}
+		p.activeJobTs[ts] = 1
 		p.addPathToIndex(jobPath, kindFile)
 		heap.Push(&p.tsHeap, ts)
 	}
@@ -343,11 +345,11 @@ func TestWatermarkWithHeap(t *testing.T) {
 	}
 
 	// Remove non-oldest (ts=20) — heap top should stay 10
-	delete(p.activeJobs, 20)
+	delete(p.activeJobTs, 20)
 	p.removePathFromIndex("/file2", kindFile)
 	// Lazy clean: top is 10 which is still active, so no pop
 	for p.tsHeap.Len() > 0 {
-		if _, active := p.activeJobs[p.tsHeap[0]]; active {
+		if p.activeJobTs[p.tsHeap[0]] > 0 {
 			break
 		}
 		heap.Pop(&p.tsHeap)
@@ -357,10 +359,10 @@ func TestWatermarkWithHeap(t *testing.T) {
 	}
 
 	// Remove oldest (ts=10) — lazy clean should find 30
-	delete(p.activeJobs, 10)
+	delete(p.activeJobTs, 10)
 	p.removePathFromIndex("/file1", kindFile)
 	for p.tsHeap.Len() > 0 {
-		if _, active := p.activeJobs[p.tsHeap[0]]; active {
+		if p.activeJobTs[p.tsHeap[0]] > 0 {
 			break
 		}
 		heap.Pop(&p.tsHeap)
@@ -382,11 +384,11 @@ func TestNonBarrierDirUpdateDoesNotBlockDescendants(t *testing.T) {
 
 		// Active non-barrier: attribute update on /dir1.
 		active := makeDirUpdateResp("/", "dir1", 1)
-		path, newPath, kind := extractJobInfo(active)
+		path, _, kind := extractJobInfo(active)
 		if kind != kindNonBarrierDir {
 			t.Fatalf("expected kindNonBarrierDir for dir attribute update, got %v", kind)
 		}
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		// File under /dir1 should NOT conflict with the attribute update.
@@ -406,11 +408,11 @@ func TestNonBarrierDirUpdateDoesNotBlockDescendants(t *testing.T) {
 		p := NewMetadataProcessor(noop, 100, 0)
 
 		active := makeResp("/", "dir1", true, 1, true) // create
-		path, newPath, kind := extractJobInfo(active)
+		path, _, kind := extractJobInfo(active)
 		if kind != kindBarrierDir {
 			t.Fatalf("expected kindBarrierDir for dir create, got %v", kind)
 		}
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		under := makeResp("/dir1", "file.txt", false, 2, true)
@@ -424,8 +426,8 @@ func TestNonBarrierDirUpdateDoesNotBlockDescendants(t *testing.T) {
 
 		// Active file under /dir1.
 		f := makeResp("/dir1", "file.txt", false, 1, true)
-		path, newPath, kind := extractJobInfo(f)
-		p.activeJobs[f.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		path, _, kind := extractJobInfo(f)
+		p.activeJobTs[f.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		// Incoming barrier delete on /dir1 should still wait for the
@@ -441,8 +443,8 @@ func TestNonBarrierDirUpdateDoesNotBlockDescendants(t *testing.T) {
 
 		// Active non-barrier dir update at /a/b.
 		upd := makeDirUpdateResp("/a", "b", 1)
-		path, newPath, kind := extractJobInfo(upd)
-		p.activeJobs[upd.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		path, _, kind := extractJobInfo(upd)
+		p.activeJobTs[upd.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		// A barrier delete on /a (the ancestor) should wait for it.
@@ -463,8 +465,8 @@ func TestSamePathBarrierSerialization(t *testing.T) {
 	t.Run("barrier dir at p blocks same-path file", func(t *testing.T) {
 		p := NewMetadataProcessor(noop, 100, 0)
 		active := makeResp("/", "dir1", true, 1, true) // dir create
-		path, newPath, kind := extractJobInfo(active)
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		path, _, kind := extractJobInfo(active)
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		file := makeResp("/", "dir1", false, 2, true)
@@ -476,8 +478,8 @@ func TestSamePathBarrierSerialization(t *testing.T) {
 	t.Run("barrier dir at p blocks another same-path barrier dir", func(t *testing.T) {
 		p := NewMetadataProcessor(noop, 100, 0)
 		active := makeResp("/", "dir1", true, 1, true) // dir create
-		path, newPath, kind := extractJobInfo(active)
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		path, _, kind := extractJobInfo(active)
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		del := makeResp("/", "dir1", true, 2, false) // dir delete, same path
@@ -489,8 +491,8 @@ func TestSamePathBarrierSerialization(t *testing.T) {
 	t.Run("barrier dir at p blocks non-barrier update at same path", func(t *testing.T) {
 		p := NewMetadataProcessor(noop, 100, 0)
 		active := makeResp("/", "dir1", true, 1, true) // dir create
-		path, newPath, kind := extractJobInfo(active)
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		path, _, kind := extractJobInfo(active)
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		upd := makeDirUpdateResp("/", "dir1", 2)
@@ -502,8 +504,8 @@ func TestSamePathBarrierSerialization(t *testing.T) {
 	t.Run("file at p blocks same-path barrier dir", func(t *testing.T) {
 		p := NewMetadataProcessor(noop, 100, 0)
 		active := makeResp("/", "thing", false, 1, true) // file create at /thing
-		path, newPath, kind := extractJobInfo(active)
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		path, _, kind := extractJobInfo(active)
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		// Barrier dir at /thing (e.g. a file→dir promotion) must wait.
@@ -519,11 +521,11 @@ func TestSamePathBarrierSerialization(t *testing.T) {
 		// delete/rename/create on /dir1.
 		p := NewMetadataProcessor(noop, 100, 0)
 		active := makeDirUpdateResp("/", "dir1", 1)
-		path, newPath, kind := extractJobInfo(active)
+		path, _, kind := extractJobInfo(active)
 		if kind != kindNonBarrierDir {
 			t.Fatalf("expected kindNonBarrierDir, got %v", kind)
 		}
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		del := makeResp("/", "dir1", true, 2, false) // dir delete
@@ -540,8 +542,8 @@ func TestSamePathBarrierSerialization(t *testing.T) {
 	t.Run("non-barrier update at p does NOT block same-path non-barrier update", func(t *testing.T) {
 		p := NewMetadataProcessor(noop, 100, 0)
 		active := makeDirUpdateResp("/", "dir1", 1)
-		path, newPath, kind := extractJobInfo(active)
-		p.activeJobs[active.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+		path, _, kind := extractJobInfo(active)
+		p.activeJobTs[active.TsNs] = 1
 		p.addPathToIndex(path, kind)
 
 		// Concurrent attribute bumps are allowed: last writer wins.
@@ -552,6 +554,61 @@ func TestSamePathBarrierSerialization(t *testing.T) {
 	})
 }
 
+// TestConcurrentJobsUpToLimit proves independent-path jobs run in parallel up
+// to the concurrency limit: every admitted job is in flight before any
+// finishes (a serial loop could only have one running), and admissions past
+// the limit wait for a slot rather than running ahead of it.
+func TestConcurrentJobsUpToLimit(t *testing.T) {
+	const limit = 3
+	started := make(chan struct{}, limit)
+	release := make(chan struct{})
+	var inFlight, maxInFlight atomic.Int32
+
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		cur := inFlight.Add(1)
+		for {
+			if old := maxInFlight.Load(); cur <= old || maxInFlight.CompareAndSwap(old, cur) {
+				break
+			}
+		}
+		started <- struct{}{}
+		<-release
+		inFlight.Add(-1)
+		return nil
+	}, limit, 0)
+
+	admitDone := make(chan struct{})
+	go func() {
+		defer close(admitDone)
+		for i := 0; i < limit+1; i++ {
+			p.AddSyncJob(makeResp("/d", fmt.Sprintf("f%d", i), false, int64(i+1), true))
+		}
+	}()
+
+	for i := 0; i < limit; i++ {
+		select {
+		case <-started:
+		case <-time.After(10 * time.Second):
+			t.Fatalf("only %d of %d jobs entered flight", i, limit)
+		}
+	}
+	// The extra admission must still be blocked on a full pool.
+	select {
+	case <-started:
+		t.Fatal("a job started with no free slot")
+	case <-admitDone:
+		t.Fatal("submission returned past the concurrency limit")
+	case <-time.After(200 * time.Millisecond):
+	}
+
+	close(release)
+	<-admitDone
+	p.Drain()
+	if got := maxInFlight.Load(); got != limit {
+		t.Fatalf("peak in-flight = %d, want %d", got, limit)
+	}
+}
+
 // benchResult prevents the compiler from optimizing away the conflict check.
 var benchResult bool
 
@@ -568,8 +625,8 @@ func BenchmarkConflictCheck(b *testing.B) {
 				dir := fmt.Sprintf("/dir%d/sub%d", i/100, i%100)
 				name := fmt.Sprintf("file%d.txt", i)
 				resp := makeResp(dir, name, false, int64(i+1), true)
-				path, newPath, kind := extractJobInfo(resp)
-				p.activeJobs[resp.TsNs] = &syncJobPaths{path: path, newPath: newPath, kind: kind}
+				path, _, kind := extractJobInfo(resp)
+				p.activeJobTs[resp.TsNs] = 1
 				p.addPathToIndex(path, kind)
 			}
 
@@ -585,40 +642,13 @@ func BenchmarkConflictCheck(b *testing.B) {
 	}
 }
 
-// TestMetadataProcessorEmptyMarkerKeepsWatermarkStale: the MaxUnsyncedEvents
-// marker (empty EventNotification, fresh timestamp) is dropped by AddSyncJob and
-// does NOT advance processedTsWatermark, so offsetFunc keeps publishing the stale
-// offset. This is why the client must not drive sync_offset off the watermark
-// for these markers.
-func TestMetadataProcessorEmptyMarkerKeepsWatermarkStale(t *testing.T) {
-	const staleOffset = int64(1_000_000_000)
-	freshTs := staleOffset + int64(time.Hour) // a "now"-ish source timestamp
-
-	p := NewMetadataProcessor(func(*filer_pb.SubscribeMetadataResponse) error { return nil }, 4, staleOffset)
-
-	marker := &filer_pb.SubscribeMetadataResponse{
-		TsNs:              freshTs,
-		EventNotification: &filer_pb.EventNotification{},
-	}
-	if !filer_pb.IsEmpty(marker) {
-		t.Fatal("marker should be IsEmpty")
-	}
-
-	p.AddSyncJob(marker)
-
-	if got := p.processedTsWatermark.Load(); got != staleOffset {
-		t.Fatalf("empty marker advanced watermark to %d; want it to stay stale at %d", got, staleOffset)
-	}
-	t.Logf("marker carried fresh ts %d but watermark stayed stale at %d", freshTs, staleOffset)
-}
-
 // waitForJobsToDrain blocks until every job goroutine has finished bookkeeping.
 func waitForJobsToDrain(t *testing.T, p *MetadataProcessor) {
 	t.Helper()
 	deadline := time.Now().Add(10 * time.Second)
 	for time.Now().Before(deadline) {
 		p.activeJobsLock.Lock()
-		remaining := len(p.activeJobs)
+		remaining := p.activeJobCount
 		p.activeJobsLock.Unlock()
 		if remaining == 0 {
 			return
@@ -650,37 +680,556 @@ func TestFailedJobHoldsWatermark(t *testing.T) {
 		t.Fatalf("watermark = %d after a successful job, want 100", got)
 	}
 
-	p.AddSyncJob(makeResp("/dir", "b.txt", false, failedTsNs, true))
-	waitForJobsToDrain(t, p)
-	if got := p.processedTsWatermark.Load(); got != 100 {
-		t.Fatalf("watermark = %d after a failed job, want it held at 100", got)
+	// a later event still in flight when the failure lands finishes fine, but
+	// the offset stays behind the failure
+	release := make(chan struct{})
+	slowFn := func(resp *filer_pb.SubscribeMetadataResponse) error {
+		if resp.TsNs == 300 {
+			<-release
+		}
+		return fn(resp)
 	}
-
-	// later events keep flowing, but the offset stays behind the failure
-	p.AddSyncJob(makeResp("/dir", "c.txt", false, 300, true))
-	waitForJobsToDrain(t, p)
-	if got := p.processedTsWatermark.Load(); got != 100 {
+	p2 := NewMetadataProcessor(slowFn, 10, 0)
+	// admit the slow job first so it is in flight when the failure lands
+	p2.AddSyncJob(makeResp("/dir", "c.txt", false, 300, true))
+	p2.AddSyncJob(makeResp("/dir", "a.txt", false, 100, true))
+	p2.AddSyncJob(makeResp("/dir", "b.txt", false, failedTsNs, true))
+	deadline := time.Now().Add(10 * time.Second)
+	for p2.OldestFailedTsNs() == 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if p2.OldestFailedTsNs() != failedTsNs {
+		t.Fatalf("oldest failed = %d, want the pin at %d", p2.OldestFailedTsNs(), failedTsNs)
+	}
+	close(release)
+	waitForJobsToDrain(t, p2)
+	if got := p2.processedTsWatermark.Load(); got != 100 {
 		t.Fatalf("watermark = %d after a later success, want it held at 100", got)
 	}
 }
 
 // TestFailedJobHoldsWatermarkAtOldestFailure verifies that the watermark is
-// pinned by the oldest failure, not the most recent one.
+// pinned by the oldest failure, not the most recent one. Once the processor
+// drains it stops accepting events for the resubscribe, so both failures have
+// to be in the same drained batch.
 func TestFailedJobHoldsWatermarkAtOldestFailure(t *testing.T) {
+	release := make(chan struct{})
 	fn := func(resp *filer_pb.SubscribeMetadataResponse) error {
+		<-release
 		if resp.TsNs == 200 || resp.TsNs == 400 {
 			return errors.New("AccessDenied: Access Denied")
 		}
 		return nil
 	}
-	p := NewMetadataProcessor(fn, 1, 0)
+	p := NewMetadataProcessor(fn, 10, 0)
 
 	for _, ts := range []int64{100, 200, 300, 400, 500} {
 		p.AddSyncJob(makeResp("/dir", fmt.Sprintf("f%d.txt", ts), false, ts, true))
-		waitForJobsToDrain(t, p)
 	}
+	close(release)
+	waitForJobsToDrain(t, p)
 
 	if got := p.processedTsWatermark.Load(); got != 100 {
 		t.Fatalf("watermark = %d, want it held at 100 by the failure at 200", got)
 	}
 }
+
+// TestSyncStreamMetrics verifies the per-event and byte counters and the
+// in-flight gauges across success and failure outcomes. Bytes count only the
+// chunk delta: the failing create's 40, the successful create's 100, the
+// update's new 60-byte chunk but not its shared one, and nothing for the
+// delete despite its chunk.
+func TestSyncStreamMetrics(t *testing.T) {
+	release := make(chan struct{})
+	fn := func(resp *filer_pb.SubscribeMetadataResponse) error {
+		<-release
+		if resp.TsNs == 2 {
+			return errors.New("AccessDenied: Access Denied")
+		}
+		return nil
+	}
+	p := NewMetadataProcessor(fn, 100, 0)
+	// the counters are process-global: a unique client name keeps repeated
+	// runs (-count>1) from accumulating into each other
+	p.SetMetrics("srcFiler", "dstFiler", fmt.Sprintf("TestSyncStreamMetrics-%d", time.Now().UnixNano()), "/")
+
+	create := makeResp("/dir1", "a.txt", false, 1, true)
+	create.EventNotification.NewEntry.Chunks = []*filer_pb.FileChunk{{FileId: "1,a0", Size: 100}}
+	failing := makeResp("/dir1", "b.txt", false, 2, true)
+	failing.EventNotification.NewEntry.Chunks = []*filer_pb.FileChunk{{FileId: "2,b0", Size: 40}}
+	shared := &filer_pb.FileChunk{FileId: "3,c0", Size: 30}
+	update := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir1",
+		TsNs:      3,
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      &filer_pb.Entry{Name: "c.txt", Chunks: []*filer_pb.FileChunk{shared}},
+			NewEntry:      &filer_pb.Entry{Name: "c.txt", Chunks: []*filer_pb.FileChunk{shared, {FileId: "3,c1", Size: 60}}},
+			NewParentPath: "/dir1",
+		},
+	}
+	del := makeResp("/dir1", "d.txt", false, 4, false)
+	del.EventNotification.OldEntry.Chunks = []*filer_pb.FileChunk{{FileId: "4,d0", Size: 999}}
+
+	for _, resp := range []*filer_pb.SubscribeMetadataResponse{create, failing, update, del} {
+		p.AddSyncJob(resp)
+	}
+	close(release)
+	waitForJobsToDrain(t, p)
+
+	for _, tc := range []struct {
+		name string
+		got  float64
+		want float64
+	}{
+		{"received", testutil.ToFloat64(p.metrics.received), 4},
+		{"processed", testutil.ToFloat64(p.metrics.processed), 3},
+		{"failed", testutil.ToFloat64(p.metrics.failed), 1},
+		{"in_flight", testutil.ToFloat64(p.metrics.inFlight), 0},
+		{"received_bytes", testutil.ToFloat64(p.metrics.receivedBytes), 200},
+		{"processed_bytes", testutil.ToFloat64(p.metrics.processedBytes), 160},
+		{"failed_bytes", testutil.ToFloat64(p.metrics.failedBytes), 40},
+		{"in_flight_bytes", testutil.ToFloat64(p.metrics.inFlightBytes), 0},
+	} {
+		if tc.got != tc.want {
+			t.Errorf("%s = %v, want %v", tc.name, tc.got, tc.want)
+		}
+	}
+}
+
+// TestFailedJobReplaySuccessClearsPin verifies that when the failed event is
+// redelivered while the processor is still alive and succeeds this time, the
+// failure pin clears and the watermark can move again. It is the one event a
+// stopped processor still runs. The resubscribe still signals once the jobs
+// drain: anything dropped after the stop has to replay too.
+func TestFailedJobReplaySuccessClearsPin(t *testing.T) {
+	failed := true
+	release := make(chan struct{})
+	fn := func(resp *filer_pb.SubscribeMetadataResponse) error {
+		if resp.TsNs == 300 {
+			<-release
+		}
+		if resp.TsNs == 200 && failed {
+			failed = false
+			return errors.New("AccessDenied: Access Denied")
+		}
+		return nil
+	}
+	p := NewMetadataProcessor(fn, 10, 0)
+
+	// the slow job is admitted first so the processor has in-flight work when
+	// the failure lands, keeping the drain — and the resubscribe — open
+	p.AddSyncJob(makeResp("/dir", "c.txt", false, 300, true))
+	p.AddSyncJob(makeResp("/dir", "b.txt", false, 200, true))
+
+	deadline := time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() != 200 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if got := p.OldestFailedTsNs(); got != 200 {
+		t.Fatalf("oldest failed = %d, want 200", got)
+	}
+
+	// once stopped, a new event drops instead of queueing into a processor
+	// that is about to be abandoned — it replays after the resubscribe
+	p.AddSyncJob(makeResp("/dir", "d.txt", false, 400, true))
+	p.activeJobsLock.Lock()
+	dropped := p.activeJobTs[400] == 0
+	p.activeJobsLock.Unlock()
+	if !dropped {
+		t.Fatal("new event admitted after the failure stopped the processor")
+	}
+
+	// the redelivery is the exception: it runs and its success clears the pin
+	p.AddSyncJob(makeResp("/dir", "b.txt", false, 200, true))
+	deadline = time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() != 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if got := p.OldestFailedTsNs(); got != 0 {
+		t.Fatalf("oldest failed = %d after a successful replay, want 0", got)
+	}
+
+	close(release)
+	waitForJobsToDrain(t, p)
+	select {
+	case <-p.ResubscribeCh():
+	case <-time.After(time.Second):
+		t.Fatal("resubscribe never signaled after the stopped processor drained")
+	}
+	if got := p.processedTsWatermark.Load(); got != 300 {
+		t.Fatalf("watermark = %d after recovery, want 300", got)
+	}
+}
+
+// TestFilteredMarkerAdvancesWatermark verifies that a filtered-progress marker
+// (empty event with a timestamp) moves the watermark once all earlier work has
+// finished, but never past an in-flight job or an unresolved failure.
+func TestFilteredMarkerAdvancesWatermark(t *testing.T) {
+	marker := func(ts int64) *filer_pb.SubscribeMetadataResponse {
+		return &filer_pb.SubscribeMetadataResponse{TsNs: ts, EventNotification: &filer_pb.EventNotification{}}
+	}
+
+	t.Run("idle", func(t *testing.T) {
+		p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error { return nil }, 100, 50)
+		p.AddSyncJob(marker(90))
+		if got := p.processedTsWatermark.Load(); got != 90 {
+			t.Fatalf("watermark = %d after marker, want 90", got)
+		}
+	})
+
+	t.Run("behind in-flight job", func(t *testing.T) {
+		release := make(chan struct{})
+		p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+			<-release
+			return nil
+		}, 100, 50)
+		p.AddSyncJob(makeResp("/dir", "f.txt", false, 60, true))
+		p.AddSyncJob(marker(80))
+		if got := p.processedTsWatermark.Load(); got != 50 {
+			t.Fatalf("watermark = %d with a job in flight, want 50", got)
+		}
+		close(release)
+		waitForJobsToDrain(t, p)
+		if got := p.processedTsWatermark.Load(); got != 80 {
+			t.Fatalf("watermark = %d after drain, want the retained marker at 80", got)
+		}
+		p.AddSyncJob(marker(90))
+		if got := p.processedTsWatermark.Load(); got != 90 {
+			t.Fatalf("watermark = %d after drain and marker, want 90", got)
+		}
+	})
+
+	t.Run("behind a failure", func(t *testing.T) {
+		p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+			return errors.New("AccessDenied: Access Denied")
+		}, 100, 50)
+		p.AddSyncJob(makeResp("/dir", "f.txt", false, 100, true))
+		waitForJobsToDrain(t, p)
+		p.AddSyncJob(marker(200))
+		if got := p.processedTsWatermark.Load(); got != 50 {
+			t.Fatalf("watermark = %d past a failure pin, want 50", got)
+		}
+		p.AddSyncJob(marker(70))
+		if got := p.processedTsWatermark.Load(); got != 70 {
+			t.Fatalf("watermark = %d behind the pin, want 70", got)
+		}
+	})
+}
+
+// TestFailedLedgerCapsAndStaysPinned verifies that a sustained run of distinct
+// failures cannot grow failedTs without bound: past maxFailedSyncEvents the
+// ledger collapses to a sticky pin at the oldest failure, so the watermark
+// still replays from it while memory stays bounded.
+func TestFailedLedgerCapsAndStaysPinned(t *testing.T) {
+	defer func(old int) { maxFailedSyncEvents = old }(maxFailedSyncEvents)
+	maxFailedSyncEvents = 4
+
+	fail := true
+	release := make(chan struct{})
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		<-release
+		if fail {
+			return errors.New("AccessDenied: Access Denied")
+		}
+		return nil
+	}, 100, 0)
+	for i := int64(1); i <= 10; i++ {
+		p.AddSyncJob(makeResp("/dir", fmt.Sprintf("f%d.txt", i), false, i*100, true))
+	}
+	close(release)
+	waitForJobsToDrain(t, p)
+
+	if !p.failedSticky {
+		t.Fatal("ledger did not collapse past the cap")
+	}
+	if got := p.OldestFailedTsNs(); got != 100 {
+		t.Fatalf("oldest failed = %d, want the pin at the oldest failure 100", got)
+	}
+	if got := p.processedTsWatermark.Load(); got != 0 {
+		t.Fatalf("watermark = %d, want it pinned at 0", got)
+	}
+
+	fail = false
+	p.AddSyncJob(makeResp("/dir", "f1.txt", false, 100, true))
+	waitForJobsToDrain(t, p)
+	if got := p.OldestFailedTsNs(); got != 100 {
+		t.Fatalf("oldest failed = %d after a collapsed replay, want the pin held at 100", got)
+	}
+	if got := p.processedTsWatermark.Load(); got != 0 {
+		t.Fatalf("watermark = %d after a collapsed replay, want it still pinned at 0", got)
+	}
+}
+
+// TestFailedLedgerDistinguishesEventsAtSameTs verifies that a success for one
+// event does not clear the pin recorded for a different event that happened to
+// share its timestamp — the ledger keys on event identity, not just TsNs. A
+// slow job holds the drain open so the redelivery still lands on this
+// processor generation.
+func TestFailedLedgerDistinguishesEventsAtSameTs(t *testing.T) {
+	fail := true
+	release := make(chan struct{})
+	hold := make(chan struct{})
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		if resp.EventNotification.NewEntry.GetName() == "slow.txt" {
+			<-hold
+		} else {
+			<-release
+		}
+		if resp.EventNotification.NewEntry.GetName() == "bad.txt" && fail {
+			return errors.New("AccessDenied: Access Denied")
+		}
+		return nil
+	}, 100, 0)
+
+	// both same-ts events admit before either resolves, so the success lands
+	// while the failure is already pinned
+	p.AddSyncJob(makeResp("/dir", "slow.txt", false, 900, true))
+	p.AddSyncJob(makeResp("/dir", "bad.txt", false, 200, true))
+	p.AddSyncJob(makeResp("/dir", "good.txt", false, 200, true))
+	close(release)
+
+	deadline := time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() != 200 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if got := p.OldestFailedTsNs(); got != 200 {
+		t.Fatalf("oldest failed = %d, want the other event's pin held at 200", got)
+	}
+	if got := p.processedTsWatermark.Load(); got != 0 {
+		t.Fatalf("watermark = %d, want it still pinned at 0", got)
+	}
+
+	// redelivering the failed event itself is what clears the pin — and it is
+	// the one event a stopped processor still admits
+	fail = false
+	p.AddSyncJob(makeResp("/dir", "bad.txt", false, 200, true))
+	deadline = time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() != 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	close(hold)
+	waitForJobsToDrain(t, p)
+	if got := p.OldestFailedTsNs(); got != 0 {
+		t.Fatalf("oldest failed = %d after the failed event itself recovered, want 0", got)
+	}
+	if got := p.processedTsWatermark.Load(); got != 900 {
+		t.Fatalf("watermark = %d after the pin cleared and the rest drained, want 900", got)
+	}
+}
+
+// TestFailedJobSignalsResubscribe verifies that a job exhausting its retries
+// closes ResubscribeCh so the follower drops the stream and the reconnect
+// replays the pinned event — the path that used to wait for a restart.
+func TestFailedJobSignalsResubscribe(t *testing.T) {
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		return errors.New("AccessDenied: Access Denied")
+	}, 100, 0)
+
+	p.AddSyncJob(makeResp("/dir", "a.txt", false, 100, true))
+	waitForJobsToDrain(t, p)
+
+	select {
+	case <-p.ResubscribeCh():
+	case <-time.After(time.Second):
+		t.Fatal("resubscribe channel never closed after the failure pinned the watermark")
+	}
+	if got := p.OldestFailedTsNs(); got != 100 {
+		t.Fatalf("oldest failed = %d, want 100", got)
+	}
+}
+
+// TestResubscribeWaitsForInFlightJobs verifies the signal stays open while
+// jobs admitted before the failure are still running — replaying behind them
+// could restore older state over their writes — and closes once they drain.
+// An event arriving after the stop drops instead of keeping the drain open,
+// so a busy stream cannot starve the replay.
+func TestResubscribeWaitsForInFlightJobs(t *testing.T) {
+	release := make(chan struct{})
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		if resp.TsNs == 100 {
+			return errors.New("AccessDenied: Access Denied")
+		}
+		<-release
+		return nil
+	}, 100, 0)
+
+	// the slow job admits first so it is in flight when the failure lands
+	p.AddSyncJob(makeResp("/dir", "b.txt", false, 200, true))
+	p.AddSyncJob(makeResp("/dir", "a.txt", false, 100, true))
+
+	deadline := time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() == 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if p.OldestFailedTsNs() != 100 {
+		t.Fatalf("oldest failed = %d, want the pin at 100", p.OldestFailedTsNs())
+	}
+	select {
+	case <-p.ResubscribeCh():
+		t.Fatal("resubscribe signaled while an in-flight job could still race the replay")
+	case <-time.After(50 * time.Millisecond):
+	}
+
+	// the processor stopped on the failure, so this event drops — it replays
+	// after the resubscribe — instead of starving the drain
+	p.AddSyncJob(makeResp("/dir", "c.txt", false, 300, true))
+	p.activeJobsLock.Lock()
+	dropped := p.activeJobTs[300] == 0
+	p.activeJobsLock.Unlock()
+	if !dropped {
+		t.Fatal("event admitted after the processor stopped")
+	}
+
+	close(release)
+	waitForJobsToDrain(t, p)
+	select {
+	case <-p.ResubscribeCh():
+	case <-time.After(time.Second):
+		t.Fatal("resubscribe channel never closed after the in-flight jobs drained")
+	}
+}
+
+// TestResubscribeWaitsForSameTsSibling guards the per-timestamp job
+// counting: events in one batch can share a TsNs, and the failed job must
+// not free the bookkeeping of a sibling still running at that timestamp.
+// Otherwise its completion could report the processor drained and the
+// resubscribe would replay over the sibling's writes.
+func TestResubscribeWaitsForSameTsSibling(t *testing.T) {
+	release := make(chan struct{})
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		if resp.EventNotification.NewEntry.GetName() == "bad.txt" {
+			return errors.New("AccessDenied: Access Denied")
+		}
+		<-release
+		return nil
+	}, 100, 0)
+
+	// the slow job admits first so it is in flight when the same-ts failure lands
+	p.AddSyncJob(makeResp("/dir", "slow.txt", false, 200, true))
+	p.AddSyncJob(makeResp("/dir", "bad.txt", false, 200, true))
+
+	deadline := time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() == 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if p.OldestFailedTsNs() != 200 {
+		t.Fatalf("oldest failed = %d, want the pin at 200", p.OldestFailedTsNs())
+	}
+	select {
+	case <-p.ResubscribeCh():
+		t.Fatal("resubscribe signaled while a same-ts job was still running")
+	case <-time.After(50 * time.Millisecond):
+	}
+
+	close(release)
+	waitForJobsToDrain(t, p)
+	select {
+	case <-p.ResubscribeCh():
+	case <-time.After(time.Second):
+		t.Fatal("resubscribe channel never closed after the same-ts jobs drained")
+	}
+}
+
+// TestResumeStaysBehindClearedPin verifies the resume floor outlives the
+// ledger pin: a redelivery can clear failedTs, but events dropped while the
+// processor was stopped — including ones sharing the failure's timestamp —
+// still have to replay, so the resume position stays one tick below the
+// earliest failure.
+func TestResumeStaysBehindClearedPin(t *testing.T) {
+	fail := true
+	release := make(chan struct{})
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		name := resp.EventNotification.NewEntry.GetName()
+		if name == "slow.txt" {
+			<-release
+		}
+		if name == "bad.txt" && fail {
+			return errors.New("AccessDenied: Access Denied")
+		}
+		return nil
+	}, 10, 0)
+
+	// the slow job holds the drain — and the resubscribe — open so the
+	// redelivery still lands on this processor
+	p.AddSyncJob(makeResp("/dir", "slow.txt", false, 300, true))
+	p.AddSyncJob(makeResp("/dir", "bad.txt", false, 200, true))
+	deadline := time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() != 200 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+
+	// a same-ts sibling arriving after the stop is dropped
+	p.AddSyncJob(makeResp("/dir", "sib.txt", false, 200, true))
+	p.activeJobsLock.Lock()
+	dropped := p.activeJobTs[200] == 0
+	p.activeJobsLock.Unlock()
+	if !dropped {
+		t.Fatal("sibling admitted after the failure stopped the processor")
+	}
+
+	// the redelivery runs and clears the pin
+	fail = false
+	p.AddSyncJob(makeResp("/dir", "bad.txt", false, 200, true))
+	deadline = time.Now().Add(10 * time.Second)
+	for p.OldestFailedTsNs() != 0 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if got := p.OldestFailedTsNs(); got != 0 {
+		t.Fatalf("oldest failed = %d after the redelivery, want 0", got)
+	}
+
+	if got := p.EarliestFailedTsNs(); got != 200 {
+		t.Fatalf("earliest failed = %d, want the floor held at 200", got)
+	}
+	if got := resumeTsNsFor(p); got != 199 {
+		t.Fatalf("resume = %d, want 199 so the dropped sibling replays", got)
+	}
+
+	close(release)
+	waitForJobsToDrain(t, p)
+}
+
+// TestResumeStaysBelowNewestSeen covers the frontier case: when every admitted
+// job has finished, the watermark sits on the newest timestamp seen — but the
+// log can still hold same-timestamp events the stream has not delivered yet.
+// An exclusive resume there would skip them, so the position stays one tick
+// below until a newer timestamp proves the block is closed.
+func TestResumeStaysBelowNewestSeen(t *testing.T) {
+	p := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		return nil
+	}, 10, 0)
+
+	// the event at 100 finishes before a same-timestamp sibling could even be
+	// read; the watermark reaches the frontier but cannot persist there
+	p.AddSyncJob(makeResp("/dir", "a.txt", false, 100, true))
+	waitForJobsToDrain(t, p)
+	if got := resumeTsNsFor(p); got != 99 {
+		t.Fatalf("resume = %d at the frontier, want 99 so an unread same-ts event replays", got)
+	}
+
+	// once a newer timestamp is seen the 100-block is closed: a slow job at
+	// 200 in flight pins nothing below it, so 100 is now a safe position
+	release := make(chan struct{})
+	p2 := NewMetadataProcessor(func(resp *filer_pb.SubscribeMetadataResponse) error {
+		if resp.TsNs == 200 {
+			<-release
+		}
+		return nil
+	}, 10, 0)
+	p2.AddSyncJob(makeResp("/dir", "c.txt", false, 100, true))
+	p2.AddSyncJob(makeResp("/dir", "b.txt", false, 200, true))
+	deadline := time.Now().Add(10 * time.Second)
+	for p2.processedTsWatermark.Load() != 100 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if got := resumeTsNsFor(p2); got != 100 {
+		t.Fatalf("resume = %d below the frontier, want 100", got)
+	}
+
+	// finishing the 200 job lands the watermark back on the frontier
+	close(release)
+	waitForJobsToDrain(t, p2)
+	if got := resumeTsNsFor(p2); got != 199 {
+		t.Fatalf("resume = %d at the frontier, want 199", got)
+	}
+}
diff --git a/weed/command/filer_sync_offset_test.go b/weed/command/filer_sync_offset_test.go
new file mode 100644
index 0000000000..93caf23e5c
--- /dev/null
+++ b/weed/command/filer_sync_offset_test.go
@@ -0,0 +1,127 @@
+package command
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// The offset key is a persistence contract: a changed form orphans saved
+// checkpoints, so the historical forms must survive verbatim and the
+// target-scoped form must stay stable.
+func TestGetSignaturePrefixByPath_KeyForms(t *testing.T) {
+	cases := []struct {
+		sourcePath, targetPath, want string
+	}{
+		// historical forms, kept so existing deployments resume unchanged
+		{"/", "/", "sync."},
+		{"/data", "/", "sync./data"},
+		// the target path participates once it deviates from "/"
+		{"/", "/backup-a", "sync.\x00/backup-a"},
+		{"/data", "/backup-a", "sync./data\x00/backup-a"},
+	}
+	for _, tc := range cases {
+		if got := getSignaturePrefixByPath(tc.sourcePath, tc.targetPath); got != tc.want {
+			t.Errorf("getSignaturePrefixByPath(%q, %q) = %q, want %q", tc.sourcePath, tc.targetPath, got, tc.want)
+		}
+	}
+}
+
+// The NUL separator keeps the key injective: a source directory whose name
+// spells out a separator must not alias a different (source, target) pair.
+func TestGetSignaturePrefixByPath_NoAliasing(t *testing.T) {
+	if a, b := getSignaturePrefixByPath("/archive=>/backup", "/"), getSignaturePrefixByPath("/archive", "/backup"); a == b {
+		t.Errorf("source path spelling a separator aliases key %q", a)
+	}
+}
+
+// Two syncs from the same source filer and path to different directories on
+// the same target filer must keep separate checkpoints, or the running one
+// pushes the shared offset past events the other never processed.
+func TestGetSignaturePrefixByPath_DistinctTargets(t *testing.T) {
+	a := getSignaturePrefixByPath("/", "/backup-a")
+	b := getSignaturePrefixByPath("/", "/backup-b")
+	if a == b {
+		t.Errorf("different target paths share offset key %q", a)
+	}
+	if root := getSignaturePrefixByPath("/", "/"); a == root {
+		t.Errorf("non-root target path shares offset key %q with the root form", a)
+	}
+}
+
+// Over the real KV wire path: a sync that predates target-scoped keys resumes
+// from the historical key, and once each sync checkpoints under its own key
+// they no longer disturb each other.
+func TestSyncOffset_HistoricalFallbackThenIndependence(t *testing.T) {
+	filerAddr, dial := startKvFiler(t)
+	const sourceSig = int32(12345)
+	historical := getSignaturePrefixByPath("/data", "/")
+	prefixA := getSignaturePrefixByPath("/data", "/backup-a")
+	prefixB := getSignaturePrefixByPath("/data", "/backup-b")
+
+	// pre-upgrade state: both syncs shared the historical key
+	if err := setOffset(dial, filerAddr, historical, sourceSig, 111); err != nil {
+		t.Fatalf("seed historical offset: %v", err)
+	}
+	if got, err := getOffsetWithFallback(dial, filerAddr, prefixA, sourceSig, historical, sourceSig); err != nil || got != 111 {
+		t.Fatalf("A fallback read = (%d, %v), want (111, nil)", got, err)
+	}
+
+	// A checkpoints under its own key; B still resumes from the historical one
+	if err := setOffset(dial, filerAddr, prefixA, sourceSig, 222); err != nil {
+		t.Fatalf("write A offset: %v", err)
+	}
+	if got, err := getOffsetWithFallback(dial, filerAddr, prefixA, sourceSig, historical, sourceSig); err != nil || got != 222 {
+		t.Fatalf("A read = (%d, %v), want (222, nil)", got, err)
+	}
+	if got, err := getOffsetWithFallback(dial, filerAddr, prefixB, sourceSig, historical, sourceSig); err != nil || got != 111 {
+		t.Fatalf("B read = (%d, %v), want (111, nil)", got, err)
+	}
+}
+
+// TestSyncOffset_StaleWriteDropped: a checkpoint write issued before a write
+// that already landed under the same key is stale and must not apply, while
+// a deliberately regressed value issued later — a resume floor or an
+// operator seed — still does.
+func TestSyncOffset_StaleWriteDropped(t *testing.T) {
+	filerAddr, dial := startKvFiler(t)
+	prefix := getSignaturePrefixByPath("/data", "/backup-stale")
+	sourceSig := int32(77)
+
+	if err := setOffset(dial, filerAddr, prefix, sourceSig, 300); err != nil {
+		t.Fatalf("seed offset: %v", err)
+	}
+
+	// Pin the checkpoint past the next write's issuance seq, simulating a
+	// write that was issued before a newer one already landed.
+	syncKey := []byte(prefix + "____")
+	util.Uint32toBytes(syncKey[len(prefix):len(prefix)+4], uint32(sourceSig))
+	mapKey := string(filerAddr) + "\x00" + string(syncKey)
+	offsetCheckpointWrites.Lock()
+	checkpoint := offsetCheckpointWrites.byKey[mapKey]
+	offsetCheckpointWrites.Unlock()
+	if checkpoint == nil {
+		t.Fatal("no checkpoint state for the seeded key")
+	}
+	checkpoint.Lock()
+	checkpoint.lastSeq = offsetWriteSeq.Load() + 1000
+	checkpoint.Unlock()
+
+	if err := setOffset(dial, filerAddr, prefix, sourceSig, 100); err != nil {
+		t.Fatalf("stale write: %v", err)
+	}
+	if got, err := getOffset(dial, filerAddr, prefix, sourceSig); err != nil || got != 300 {
+		t.Fatalf("after stale write = (%d, %v), want (300, nil)", got, err)
+	}
+
+	// a later-issued regression is deliberate and must apply
+	checkpoint.Lock()
+	checkpoint.lastSeq = 0
+	checkpoint.Unlock()
+	if err := setOffset(dial, filerAddr, prefix, sourceSig, 199); err != nil {
+		t.Fatalf("floored write: %v", err)
+	}
+	if got, err := getOffset(dial, filerAddr, prefix, sourceSig); err != nil || got != 199 {
+		t.Fatalf("after floored write = (%d, %v), want (199, nil)", got, err)
+	}
+}
diff --git a/weed/command/filer_sync_process_test.go b/weed/command/filer_sync_process_test.go
index 477c223b30..73d760cae8 100644
--- a/weed/command/filer_sync_process_test.go
+++ b/weed/command/filer_sync_process_test.go
@@ -57,6 +57,7 @@ func equalSyncStrings(a, b []string) bool {
 	return true
 }
 func (s *recordingSyncSink) GetSinkToDirectory() string         { return "/dest" }
+func (s *recordingSyncSink) GetDestinationIdentity() string     { return "/dest" }
 func (s *recordingSyncSink) SetSourceFiler(*source.FilerSource) {}
 func (s *recordingSyncSink) IsIncremental() bool                { return s.incremental }
 
diff --git a/weed/command/fix.go b/weed/command/fix.go
index 6c24dd3204..301bfd0903 100644
--- a/weed/command/fix.go
+++ b/weed/command/fix.go
@@ -327,9 +327,15 @@ func doFixEcxFromShards(basePath, baseFileName, collection string, volumeId int6
 	// Priority: explicit flags > existing .vif > defaults (10+4).
 	vifName := base + ".vif"
 	vifExists := util.FileExists(vifName)
+	// Whether the on-disk .vif actually answers the layout question. An empty
+	// stub (MaybeLoadVolumeInfo reads it as absent) or one with no EC config
+	// exists but tells us nothing, and the recovered layout must still be
+	// written back over it.
+	vifUsable := false
 	dataShards := erasure_coding.DataShardsCount
 	parityShards := erasure_coding.ParityShardsCount
 	var datFileSize int64
+	blockSize := int64(-1) // the shard block layout; 0 legacy, >0 uniform, <0 unknown
 	if vifExists {
 		// MaybeLoadVolumeInfo returns a non-nil error when the .vif exists but
 		// cannot be read or unmarshalled; fail loudly rather than silently
@@ -338,13 +344,66 @@ func doFixEcxFromShards(basePath, baseFileName, collection string, volumeId int6
 			fail(fmt.Errorf("volume %d: read %s: %w", volumeId, vifName, loadErr))
 			return
 		} else if found && vi != nil {
-			if cfg := vi.GetEcShardConfig(); cfg != nil && cfg.GetDataShards() > 0 {
+			// A partial config (parity 0, or counts past the shard ceiling)
+			// describes no layout: leave the sentinel unknown and let the
+			// sidecar / dual scan below answer, and rewrite the .vif at the end
+			// rather than trusting it.
+			cfg := vi.GetEcShardConfig()
+			if cfg != nil && erasure_coding.ValidEcShardCounts(cfg.GetDataShards(), cfg.GetParityShards()) {
 				dataShards = int(cfg.GetDataShards())
 				parityShards = int(cfg.GetParityShards())
+				// Only an EC config answers the layout question. Reading 0 off a
+				// vif with no config would assert "legacy" and suppress both the
+				// .ecsum fallback and the dual-layout scan below; leave the
+				// sentinel at -1 (unknown) instead.
+				// A recorded block size no encoder could have produced is not
+				// an answer: a positive one would pin the scan to a geometry
+				// that de-stripes to garbage, and a negative one would leave
+				// the invalid .vif in place after the dual scan recovers the
+				// real layout. Leave the sentinel unknown and rewrite the file
+				// at the end.
+				if bs := cfg.GetBlockSize(); erasure_coding.ValidateBlockSize(bs) == nil {
+					blockSize = bs
+					vifUsable = true
+				} else {
+					glog.Warningf("volume %d: %s records an invalid shard block size %d; recovering the layout by scan and rewriting it",
+						volumeId, vifName, bs)
+				}
 			}
 			datFileSize = vi.GetDatFileSize()
 		}
 	}
+	// The bitrot sidecar records the same EC config at encode time; use it when
+	// the .vif is gone. A uniform-layout volume cannot be de-striped correctly
+	// without its block size.
+	if blockSize < 0 {
+		sidecarPath := erasure_coding.BitrotSidecarPath(base, 0)
+		if prot, serr := erasure_coding.LoadBitrotSidecar(sidecarPath); serr == nil {
+			// The sidecar is about to pin the reconstruction to one geometry
+			// instead of letting the dual scan decide, so every field it
+			// contributes has to hold up: it must describe generation 0 (the
+			// shards being read), a complete in-range ratio, and a block size
+			// an encoder could have produced. Anything less leaves the layout
+			// unknown, which is the answer that still recovers by scanning.
+			cfg := prot.GetEcShardConfig()
+			ds, ps := int(cfg.GetDataShards()), int(cfg.GetParityShards())
+			switch {
+			case prot.GetGeneration() != 0:
+				glog.Warningf("volume %d: %s records generation %d, not the generation-0 shards; ignoring it",
+					volumeId, sidecarPath, prot.GetGeneration())
+			case !erasure_coding.ValidEcShardCounts(cfg.GetDataShards(), cfg.GetParityShards()):
+				glog.Warningf("volume %d: %s records invalid shard counts %d+%d; ignoring it",
+					volumeId, sidecarPath, ds, ps)
+			case erasure_coding.ValidateBlockSize(cfg.GetBlockSize()) != nil:
+				glog.Warningf("volume %d: %s records an invalid shard block size %d; ignoring it",
+					volumeId, sidecarPath, cfg.GetBlockSize())
+			default:
+				dataShards = ds
+				parityShards = ps
+				blockSize = cfg.GetBlockSize()
+			}
+		}
+	}
 	if *fixEcDataShards > 0 {
 		dataShards = *fixEcDataShards
 	}
@@ -381,6 +440,9 @@ func doFixEcxFromShards(basePath, baseFileName, collection string, volumeId int6
 	}
 	if !dataComplete {
 		ctx := &erasure_coding.ECContext{DataShards: dataShards, ParityShards: parityShards}
+		if blockSize > 0 {
+			ctx.BlockSize = blockSize
+		}
 		glog.Infof("volume %d: %d/%d shards present; reconstructing missing shards (%s) before index rebuild", volumeId, presentCount, dataShards+parityShards, ctx.String())
 		if _, err := erasure_coding.RebuildEcFiles(base, ctx, *fixEcUnsafeIgnoreSidecar); err != nil {
 			fail(fmt.Errorf("volume %d: reconstruct missing shards from %d survivors: %w", volumeId, presentCount, err))
@@ -407,37 +469,114 @@ func doFixEcxFromShards(basePath, baseFileName, collection string, volumeId int6
 		glog.V(0).Infof("volume %d: no .dat size in .vif; reconstructing padded .dat (%d bytes) from %d data shards", volumeId, reconstructSize, dataShards)
 	}
 
-	// De-stripe the data shards into a temporary .dat next to the shards.
+	// De-stripe the data shards into a temporary .dat next to the shards and
+	// scan it into a fresh .ecx. With the layout unknown, de-stripe under both
+	// candidate layouts and keep the one whose needle chain scans furthest.
+	type layoutCandidate struct {
+		name         string
+		large, small int64
+	}
+	var candidates []layoutCandidate
+	switch {
+	case blockSize > 0:
+		candidates = []layoutCandidate{{"uniform", blockSize, blockSize}}
+	case blockSize == 0:
+		candidates = []layoutCandidate{{"legacy", erasure_coding.ErasureCodingLargeBlockSize, erasure_coding.ErasureCodingSmallBlockSize}}
+	default:
+		candidates = []layoutCandidate{
+			{"legacy", erasure_coding.ErasureCodingLargeBlockSize, erasure_coding.ErasureCodingSmallBlockSize},
+		}
+		// A uniform-layout shard is exactly one block long, and every block
+		// size an encoder can produce is a whole number of small blocks. An
+		// extent that is not — a truncated or partially copied shard — could
+		// not have come from a uniform encode, and recording it would write a
+		// .vif that ValidateBlockSize refuses on the next mount: the volume
+		// this tool was run to rescue would never open again.
+		if erasure_coding.ValidateBlockSize(shardSize) == nil && shardSize > 0 {
+			candidates = append(candidates, layoutCandidate{"uniform", shardSize, shardSize})
+			glog.Infof("volume %d: no .vif or .ecsum records the shard block layout; trying both", volumeId)
+		} else {
+			glog.Infof("volume %d: no .vif or .ecsum records the shard block layout, and the %d-byte shard extent is not a whole number of %d-byte blocks; trying the legacy layout only",
+				volumeId, shardSize, erasure_coding.ErasureCodingSmallBlockSize)
+		}
+	}
+
 	tmpBase := base + ".ecxrecover"
 	tmpDat := tmpBase + ".dat"
-	if err := erasure_coding.WriteDatFile(tmpBase, reconstructSize, reconstructSize, shardFileNames); err != nil {
-		os.Remove(tmpDat)
-		fail(fmt.Errorf("volume %d: reconstruct .dat from data shards: %w", volumeId, err))
+	defer os.Remove(tmpDat)
+	bestIdx := -1
+	var realDatSize, bestNeedles int64
+	var version needle.Version
+	var candErr error
+	for i, cand := range candidates {
+		if err := erasure_coding.WriteDatFile(tmpBase, reconstructSize, reconstructSize, shardFileNames, cand.large, cand.small); err != nil {
+			candErr = fmt.Errorf("volume %d: reconstruct .dat (%s layout): %w", volumeId, cand.name, err)
+			continue
+		}
+		size, needles, ver, err := writeEcxFromDat(tmpDat, ecxName+"."+cand.name)
+		if err != nil {
+			os.Remove(ecxName + "." + cand.name)
+			candErr = fmt.Errorf("volume %d: build .ecx from reconstructed .dat (%s layout): %w", volumeId, cand.name, err)
+			continue
+		}
+		// The wrong layout de-stripes to garbage past the first block
+		// boundary, so the layout that indexes more valid needles wins.
+		// On a tie — garbage bytes do sometimes parse as plausible sizes — the
+		// layout whose needle chain reached further into the .dat wins, which is
+		// the distance the scan actually validated.
+		if bestIdx < 0 || needles > bestNeedles || (needles == bestNeedles && size > realDatSize) {
+			bestIdx = i
+			bestNeedles = needles
+			realDatSize = size
+			version = ver
+		}
+	}
+	if bestIdx < 0 {
+		fail(candErr)
 		return
 	}
-	defer os.Remove(tmpDat)
-
-	realDatSize, version, err := writeEcxFromDat(tmpDat, ecxName)
-	if err != nil {
-		os.Remove(ecxName)
-		fail(fmt.Errorf("volume %d: build .ecx from reconstructed .dat: %w", volumeId, err))
+	for i := range candidates {
+		if i != bestIdx {
+			os.Remove(ecxName + "." + candidates[i].name)
+		}
+	}
+	if err := os.Rename(ecxName+"."+candidates[bestIdx].name, ecxName); err != nil {
+		fail(fmt.Errorf("volume %d: publish %s: %w", volumeId, ecxName, err))
 		return
 	}
+	if blockSize < 0 {
+		if candidates[bestIdx].name == "uniform" {
+			blockSize = shardSize
+		} else {
+			blockSize = 0
+		}
+		glog.Infof("volume %d: %s layout indexes %d needles over %d bytes; keeping it", volumeId, candidates[bestIdx].name, bestNeedles, realDatSize)
+	}
 	glog.Infof("volume %d: wrote %s from %d data shards", volumeId, ecxName, dataShards)
 
-	// Regenerate the .vif when missing so the volume can mount and future
-	// rebuilds know the EC ratio and original .dat size.
-	if !vifExists {
+	// Regenerate the .vif when it is missing OR unusable (an empty stub, or one
+	// with no EC config): the layout just recovered by the dual scan is the only
+	// record of it, and leaving the stub in place would mount the volume as
+	// legacy on the next start and serve the wrong offsets.
+	if !vifUsable {
 		size := datFileSize
 		if size <= 0 {
 			size = realDatSize
 		}
+		// Never publish a layout the mount path will refuse: NewEcVolume runs
+		// the same check and fails closed, so an unvalidated write here would
+		// trade a recoverable volume for one that can no longer be opened.
+		if bsErr := erasure_coding.ValidateBlockSize(blockSize); bsErr != nil {
+			fail(fmt.Errorf("volume %d: refusing to write %s: %w", volumeId, vifName, bsErr))
+			return
+		}
 		volumeInfo := &volume_server_pb.VolumeInfo{
 			Version:     uint32(version),
 			DatFileSize: size,
 			EcShardConfig: &volume_server_pb.EcShardConfig{
 				DataShards:   uint32(dataShards),
 				ParityShards: uint32(parityShards),
+				BlockSize:    blockSize,
 			},
 		}
 		if err := volume_info.SaveVolumeInfo(vifName, volumeInfo); err != nil {
@@ -451,25 +590,26 @@ func doFixEcxFromShards(basePath, baseFileName, collection string, volumeId int6
 // writeEcxFromDat scans a (reconstructed) .dat and writes an ascending-sorted
 // .ecx containing only live needles — the same on-disk shape
 // WriteSortedFileFromIdx produces when an EC volume is first encoded. It returns
-// the physical .dat size (the offset where the EC zero padding begins) and the
-// volume version read from the superblock.
-func writeEcxFromDat(datPath, ecxPath string) (datFileSize int64, version needle.Version, err error) {
+// the physical .dat size (the offset where the EC zero padding begins), the
+// number of live needles indexed, and the volume version read from the
+// superblock.
+func writeEcxFromDat(datPath, ecxPath string) (datFileSize int64, liveNeedles int64, version needle.Version, err error) {
 	f, err := os.OpenFile(datPath, os.O_RDONLY, 0644)
 	if err != nil {
-		return 0, 0, fmt.Errorf("open %s: %w", datPath, err)
+		return 0, 0, 0, fmt.Errorf("open %s: %w", datPath, err)
 	}
 	datBackend := backend.NewDiskFile(f)
 	defer datBackend.Close()
 
 	superBlock, err := super_block.ReadSuperBlock(datBackend)
 	if err != nil {
-		return 0, 0, fmt.Errorf("read superblock: %w", err)
+		return 0, 0, 0, fmt.Errorf("read superblock: %w", err)
 	}
 	version = superBlock.Version
 
 	fileSize, _, err := datBackend.GetStat()
 	if err != nil {
-		return 0, version, fmt.Errorf("stat %s: %w", datPath, err)
+		return 0, 0, version, fmt.Errorf("stat %s: %w", datPath, err)
 	}
 
 	nm := needle_map.NewMemDb()
@@ -482,7 +622,7 @@ func writeEcxFromDat(datPath, ecxPath string) (datFileSize int64, version needle
 			if readErr == io.EOF {
 				break
 			}
-			return 0, version, fmt.Errorf("read needle header at offset %d: %w", offset, readErr)
+			return 0, 0, version, fmt.Errorf("read needle header at offset %d: %w", offset, readErr)
 		}
 		// EC encoding zero-pads the tail of the last block row. An all-zero
 		// header marks the start of that padding, i.e. the end of real needles.
@@ -491,13 +631,13 @@ func writeEcxFromDat(datPath, ecxPath string) (datFileSize int64, version needle
 		}
 		if n.Size.IsValid() {
 			if pe := nm.Set(n.Id, types.ToOffset(offset), n.Size); pe != nil {
-				return 0, version, fmt.Errorf("set needle %d: %w", n.Id, pe)
+				return 0, 0, version, fmt.Errorf("set needle %d: %w", n.Id, pe)
 			}
 		} else {
 			// Deleted/invalid: drop it so the .ecx carries only live entries,
 			// matching the encode-time WriteSortedFileFromIdx behavior.
 			if pe := nm.Delete(n.Id); pe != nil {
-				return 0, version, fmt.Errorf("delete needle %d: %w", n.Id, pe)
+				return 0, 0, version, fmt.Errorf("delete needle %d: %w", n.Id, pe)
 			}
 		}
 		offset += types.NeedleHeaderSize + rest
@@ -506,16 +646,17 @@ func writeEcxFromDat(datPath, ecxPath string) (datFileSize int64, version needle
 
 	ecxFile, err := os.OpenFile(ecxPath, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0644)
 	if err != nil {
-		return 0, version, fmt.Errorf("open %s: %w", ecxPath, err)
+		return 0, 0, version, fmt.Errorf("open %s: %w", ecxPath, err)
 	}
 	defer ecxFile.Close()
 
 	if err := nm.AscendingVisit(func(value needle_map.NeedleValue) error {
+		liveNeedles++
 		_, writeErr := ecxFile.Write(value.ToBytes())
 		return writeErr
 	}); err != nil {
-		return 0, version, fmt.Errorf("write %s: %w", ecxPath, err)
+		return 0, 0, version, fmt.Errorf("write %s: %w", ecxPath, err)
 	}
 
-	return datFileSize, version, nil
+	return datFileSize, liveNeedles, version, nil
 }
diff --git a/weed/command/fix_ecx_test.go b/weed/command/fix_ecx_test.go
index d99f826945..c9509b0eb1 100644
--- a/weed/command/fix_ecx_test.go
+++ b/weed/command/fix_ecx_test.go
@@ -17,11 +17,12 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
 )
 
-// buildAndEncodeTestEcVolume writes a small volume (.dat + .idx), EC-encodes it
-// into .ec00..ec13, and produces the canonical sorted .ecx. It returns the base
-// path, the canonical .ecx bytes, and the original .dat size. A couple of
-// needles are deleted so the .ecx must exclude them (live entries only).
-func buildAndEncodeTestEcVolume(t *testing.T, dir, baseName string) (base string, canonicalEcx []byte, origDatSize int64) {
+// buildAndEncodeTestEcVolume writes a volume of needleCount needles of about
+// needleSize bytes (.dat + .idx), EC-encodes it into .ec00..ec13, and produces
+// the canonical sorted .ecx. It returns the base path, the canonical .ecx
+// bytes, the original .dat size, and the encode's bitrot protection. A couple
+// of needles are deleted so the .ecx must exclude them (live entries only).
+func buildAndEncodeTestEcVolume(t *testing.T, dir, baseName string, needleCount, needleSize int) (base string, canonicalEcx []byte, origDatSize int64, prot *volume_server_pb.EcBitrotProtection) {
 	t.Helper()
 	base = filepath.Join(dir, baseName)
 	version := needle.GetCurrentVersion()
@@ -41,10 +42,10 @@ func buildAndEncodeTestEcVolume(t *testing.T, dir, baseName string) (base string
 	}
 
 	nm := needle_map.NewMemDb()
-	for i := uint64(1); i <= 12; i++ {
+	for i := uint64(1); i <= uint64(needleCount); i++ {
 		n := new(needle.Needle)
 		n.Id = types.Uint64ToNeedleId(i)
-		n.Data = make([]byte, 200+int(i))
+		n.Data = make([]byte, needleSize+int(i))
 		rand.Read(n.Data)
 		n.Checksum = needle.NewCRC(n.Data)
 		offset, _, _, err := n.Append(datBackend, version)
@@ -92,7 +93,8 @@ func buildAndEncodeTestEcVolume(t *testing.T, dir, baseName string) (base string
 	idxFile.Close()
 	nm.Close()
 
-	if _, err := erasure_coding.WriteEcFiles(base, erasure_coding.BackgroundECContext()); err != nil {
+	prot, err = erasure_coding.WriteEcFiles(base, erasure_coding.BackgroundECContext())
+	if err != nil {
 		t.Fatalf("WriteEcFiles: %v", err)
 	}
 	if err := erasure_coding.WriteSortedFileFromIdx(base, ".ecx"); err != nil {
@@ -105,7 +107,7 @@ func buildAndEncodeTestEcVolume(t *testing.T, dir, baseName string) (base string
 	if len(canonicalEcx) == 0 {
 		t.Fatal("canonical .ecx is empty")
 	}
-	return base, canonicalEcx, origDatSize
+	return base, canonicalEcx, origDatSize, prot
 }
 
 // TestFixEcxFromShards verifies the .ecx and .vif are rebuilt purely from the
@@ -121,7 +123,7 @@ func TestFixEcxFromShards(t *testing.T) {
 
 	dir := t.TempDir()
 	const volumeId = 7
-	base, canonical, origDatSize := buildAndEncodeTestEcVolume(t, dir, "7")
+	base, canonical, origDatSize, _ := buildAndEncodeTestEcVolume(t, dir, "7", 12, 200)
 
 	// Disaster: keep only the shards.
 	for _, ext := range []string{".ecx", ".ecj", ".idx", ".dat", ".vif"} {
@@ -175,7 +177,7 @@ func TestFixEcxFromShardsWithVif(t *testing.T) {
 
 	dir := t.TempDir()
 	const volumeId = 9
-	base, canonical, origDatSize := buildAndEncodeTestEcVolume(t, dir, "9")
+	base, canonical, origDatSize, _ := buildAndEncodeTestEcVolume(t, dir, "9", 12, 200)
 
 	// Write a .vif as the volume server would after encoding.
 	if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
@@ -234,7 +236,7 @@ func TestFixEcxFromShardsMissingShards(t *testing.T) {
 
 	dir := t.TempDir()
 	const volumeId = 11
-	base, canonical, origDatSize := buildAndEncodeTestEcVolume(t, dir, "11")
+	base, canonical, origDatSize, _ := buildAndEncodeTestEcVolume(t, dir, "11", 12, 200)
 
 	// Lose every index/metadata file plus three shards (two data: .ec02, .ec05;
 	// one parity: .ec11), keeping 11 of 14 — enough to reconstruct. The highest
@@ -271,3 +273,60 @@ func TestFixEcxFromShardsMissingShards(t *testing.T) {
 		t.Fatalf("dat size = %d, want %d", vi.GetDatFileSize(), origDatSize)
 	}
 }
+
+// TestFixEcxFromShardsUniformLayout loses the .vif of a volume big enough that
+// the uniform and legacy layouts place bytes differently, and verifies the
+// layout is recovered — from the bitrot sidecar when it survives, and by
+// de-striping under both candidate layouts when it does not.
+func TestFixEcxFromShardsUniformLayout(t *testing.T) {
+	oldData, oldParity := *fixEcDataShards, *fixEcParityShards
+	*fixEcDataShards, *fixEcParityShards = 0, 0
+	*fixIgnoreError = true
+	t.Cleanup(func() {
+		*fixIgnoreError = false
+		*fixEcDataShards, *fixEcParityShards = oldData, oldParity
+	})
+
+	for _, withSidecar := range []bool{true, false} {
+		name := "from-sidecar"
+		if !withSidecar {
+			name = "dual-scan"
+		}
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			const volumeId = 13
+			base, canonical, _, prot := buildAndEncodeTestEcVolume(t, dir, "13", 13, 2*1024*1024)
+			if got := prot.GetEcShardConfig().GetBlockSize(); got <= erasure_coding.ErasureCodingSmallBlockSize {
+				t.Fatalf("fixture block size %d does not diverge from the legacy layout", got)
+			}
+			if withSidecar {
+				if err := erasure_coding.SaveBitrotSidecar(erasure_coding.BitrotSidecarPath(base, 0), prot); err != nil {
+					t.Fatal(err)
+				}
+			}
+
+			for _, ext := range []string{".ecx", ".ecj", ".idx", ".dat", ".vif"} {
+				if err := os.Remove(base + ext); err != nil && !os.IsNotExist(err) {
+					t.Fatalf("remove %s: %v", base+ext, err)
+				}
+			}
+
+			doFixEcxFromShards(dir, "13", "", volumeId)
+
+			recovered, err := os.ReadFile(base + ".ecx")
+			if err != nil {
+				t.Fatalf("recovered .ecx not written: %v", err)
+			}
+			if !bytes.Equal(canonical, recovered) {
+				t.Fatalf(".ecx mismatch: canonical %d bytes, recovered %d bytes", len(canonical), len(recovered))
+			}
+			vi, _, found, err := volume_info.MaybeLoadVolumeInfo(base + ".vif")
+			if err != nil || !found {
+				t.Fatalf(".vif not regenerated: found=%v err=%v", found, err)
+			}
+			if got, want := vi.GetEcShardConfig().GetBlockSize(), prot.GetEcShardConfig().GetBlockSize(); got != want {
+				t.Fatalf("regenerated .vif block size = %d, want %d", got, want)
+			}
+		})
+	}
+}
diff --git a/weed/command/fuse_std.go b/weed/command/fuse_std.go
index 1eb4ee072b..31658ee677 100644
--- a/weed/command/fuse_std.go
+++ b/weed/command/fuse_std.go
@@ -124,6 +124,8 @@ func runFuse(cmd *Command, args []string) bool {
 			mountOptions.filer = &parameter.value
 		case "filer.path":
 			mountOptions.filerMountRootPath = &parameter.value
+		case "volumeName":
+			mountOptions.volumeName = &parameter.value
 		case "dirAutoCreate":
 			if parsed, err := strconv.ParseBool(parameter.value); err == nil {
 				mountOptions.dirAutoCreate = &parsed
diff --git a/weed/command/fuse_std_test.go b/weed/command/fuse_std_test.go
index 64122bb3c6..4026a943ad 100644
--- a/weed/command/fuse_std_test.go
+++ b/weed/command/fuse_std_test.go
@@ -36,3 +36,32 @@ func TestRunFuseDoesNotSkipOptionAfterConcurrentWriters(t *testing.T) {
 		"child=1,concurrentWriters=2,concurrentReaders=bad,umask=bad",
 	})
 }
+
+func TestRunFuseSetsVolumeName(t *testing.T) {
+	oldVolumeName := mountOptions.volumeName
+	oldConcurrentReaders := mountOptions.concurrentReaders
+	oldDir := mountOptions.dir
+	defer func() {
+		gotVolumeName := mountOptions.volumeName
+		mountOptions.volumeName = oldVolumeName
+		mountOptions.concurrentReaders = oldConcurrentReaders
+		mountOptions.dir = oldDir
+
+		recovered := recover()
+		if recovered == nil {
+			t.Fatal("expected invalid concurrentReaders option to be parsed")
+		}
+		if gotVolumeName == nil {
+			t.Fatal("expected -o volumeName=MyDisk to set mountOptions.volumeName, got nil")
+		}
+		if *gotVolumeName != "MyDisk" {
+			t.Fatalf("expected -o volumeName=MyDisk to set mountOptions.volumeName, got %q", *gotVolumeName)
+		}
+	}()
+
+	runFuse(cmdMount, []string{
+		"/mnt",
+		"-o",
+		"volumeName=MyDisk,concurrentReaders=bad",
+	})
+}
diff --git a/weed/command/iam.go b/weed/command/iam.go
index 77f3a9014a..ce11f56ab2 100644
--- a/weed/command/iam.go
+++ b/weed/command/iam.go
@@ -28,10 +28,11 @@ var (
 )
 
 type IamOptions struct {
-	filer   *string
-	masters *string
-	ip      *string
-	port    *int
+	filer                    *string
+	masters                  *string
+	ip                       *string
+	port                     *int
+	selfServiceRequiresGrant *bool
 }
 
 func init() {
@@ -40,6 +41,7 @@ func init() {
 	iamStandaloneOptions.masters = cmdIam.Flag.String("master", "localhost:9333", "comma-separated master servers")
 	iamStandaloneOptions.ip = cmdIam.Flag.String("ip", util.DetectedHostAddress(), "iam server http listen ip address")
 	iamStandaloneOptions.port = cmdIam.Flag.Int("port", 8111, "iam server http listen port")
+	iamStandaloneOptions.selfServiceRequiresGrant = cmdIam.Flag.Bool("selfServiceRequiresGrant", false, iamSelfServiceRequiresGrantUsage)
 }
 
 var cmdIam = &Command{
@@ -101,10 +103,11 @@ func (iamopt *IamOptions) startIamServer() bool {
 	masters := pb.ServerAddresses(*iamopt.masters).ToAddressMap()
 	router := mux.NewRouter().SkipClean(true)
 	iamApiServer, iamApiServer_err := iamapi.NewIamApiServer(router, &iamapi.IamServerOption{
-		Masters:        masters,
-		Filers:         filerAddresses,
-		Port:           *iamopt.port,
-		GrpcDialOption: grpcDialOption,
+		Masters:                     masters,
+		Filers:                      filerAddresses,
+		Port:                        *iamopt.port,
+		GrpcDialOption:              grpcDialOption,
+		IamSelfServiceRequiresGrant: *iamopt.selfServiceRequiresGrant,
 	})
 	glog.V(0).Info("NewIamApiServer created")
 	if iamApiServer_err != nil {
diff --git a/weed/command/image.go b/weed/command/image.go
new file mode 100644
index 0000000000..82f47b7dfa
--- /dev/null
+++ b/weed/command/image.go
@@ -0,0 +1,85 @@
+package command
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"strconv"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/images/gateway"
+)
+
+var cmdImage = &Command{
+	UsageLine: "image -source=http://localhost:8333/public-bucket -imgproxy=http://localhost:8080",
+	Short:     "Start an on-demand gateway for public images",
+	Long: `Run an optional image gateway in front of public S3 objects. x-oss-process
+supports aspect-preserving downscaling, absolute quality,Q_85, and JPEG/PNG/WebP.
+Source access is checked before every cache read. Processed images remain in a
+bounded memory cache and are never written to S3 or the Filer.
+Encoding runs in a separate imgproxy service; configure its pixel, file size,
+and process resource limits. This public endpoint does not accept S3 signatures
+or read private objects.`,
+}
+
+var imageOptions struct {
+	source, imgproxy, bind          *string
+	port, concurrency, maxDimension *int
+	cacheMB, sourceMB, resultMB     *int64
+	timeout                         *time.Duration
+}
+
+// init registers the optional endpoint without changing S3, Filer, or Volume services.
+func init() {
+	cmdImage.Run = runImage
+	imageOptions.source = cmdImage.Flag.String("source", "", "Fixed anonymous S3 HTTP(S) source URL, optionally with a bucket path")
+	imageOptions.imgproxy = cmdImage.Flag.String("imgproxy", "", "Separate imgproxy HTTP(S) service URL")
+	imageOptions.bind = cmdImage.Flag.String("ip.bind", "127.0.0.1", "Listen address")
+	imageOptions.port = cmdImage.Flag.Int("port", 8334, "HTTP port")
+	imageOptions.concurrency = cmdImage.Flag.Int("concurrency", 8, "Maximum concurrent requests and encoding jobs; excess requests return 429")
+	imageOptions.maxDimension = cmdImage.Flag.Int("maxDimension", 4096, "Maximum output dimension")
+	imageOptions.cacheMB = cmdImage.Flag.Int64("cacheCapacityMB", 64, "Processed image memory cache in MiB; 0 disables caching")
+	imageOptions.sourceMB = cmdImage.Flag.Int64("maxSourceMB", 25, "Maximum source image size in MiB")
+	imageOptions.resultMB = cmdImage.Flag.Int64("maxResultMB", 10, "Maximum processed image size in MiB")
+	imageOptions.timeout = cmdImage.Flag.Duration("timeout", 15*time.Second, "Separate timeout budgets for source metadata, shared encoding, and client writes")
+}
+
+// runImage starts the gateway, reading signing material from the environment rather than process arguments.
+func runImage(cmd *Command, args []string) bool {
+	if *imageOptions.cacheMB < 0 || *imageOptions.cacheMB > 1<<20 ||
+		*imageOptions.sourceMB < 1 || *imageOptions.sourceMB > 1024 ||
+		*imageOptions.resultMB < 1 || *imageOptions.resultMB > 1024 {
+		glog.Errorf("Invalid image gateway capacity options")
+		return false
+	}
+	handler, err := gateway.New(gateway.Config{
+		Source: *imageOptions.source, Imgproxy: *imageOptions.imgproxy,
+		Key: os.Getenv("IMGPROXY_KEY"), Salt: os.Getenv("IMGPROXY_SALT"),
+		Concurrency: *imageOptions.concurrency, MaxDimension: *imageOptions.maxDimension,
+		CacheBytes: *imageOptions.cacheMB << 20, MaxSourceBytes: *imageOptions.sourceMB << 20,
+		MaxResultBytes: *imageOptions.resultMB << 20, Timeout: *imageOptions.timeout,
+	})
+	if err != nil {
+		glog.Errorf("Invalid image gateway configuration: %v", err)
+		return false
+	}
+	if *imageOptions.port < 1 || *imageOptions.port > 65535 {
+		glog.Errorf("Invalid image gateway port")
+		return false
+	}
+	// Bound the initial source check, shared encoding, and response write phases.
+	// ReadTimeout also limits draining of ignored request bodies after the handler returns.
+	server := &http.Server{
+		Addr: net.JoinHostPort(*imageOptions.bind, strconv.Itoa(*imageOptions.port)), Handler: handler,
+		ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 10 * time.Second,
+		WriteTimeout: 3 * *imageOptions.timeout,
+		IdleTimeout:  60 * time.Second, MaxHeaderBytes: 16 << 10,
+	}
+	glog.V(0).Infof("Image gateway listening on %s", server.Addr)
+	if err = server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+		glog.Errorf("Image gateway failed: %v", err)
+		return false
+	}
+	return true
+}
diff --git a/weed/command/master.go b/weed/command/master.go
index 450998be4e..64b9883bfa 100644
--- a/weed/command/master.go
+++ b/weed/command/master.go
@@ -46,16 +46,19 @@ const (
 )
 
 type MasterOptions struct {
-	port                       *int
-	portGrpc                   *int
-	ip                         *string
-	ipBind                     *string
-	metaFolder                 *string
-	peers                      *string
-	mastersDeprecated          *string // deprecated, for backward compatibility in master.follower
-	volumeSizeLimitMB          *uint
-	volumePreallocate          *bool
-	maxParallelVacuumPerServer *int
+	port                          *int
+	portGrpc                      *int
+	ip                            *string
+	ipBind                        *string
+	metaFolder                    *string
+	peers                         *string
+	mastersDeprecated             *string // deprecated, for backward compatibility in master.follower
+	volumeSizeLimitMB             *uint
+	fileSizeLimitMB               *int
+	volumePreallocate             *bool
+	maxParallelVacuumPerServer    *int
+	vacuumIntervalSeconds         *int
+	vacuumDeleteEmptyAfterSeconds *int
 	// pulseSeconds       *int
 	defaultReplication *string
 	garbageThreshold   *float64
@@ -88,9 +91,12 @@ func init() {
 	m.ipBind = cmdMaster.Flag.String("ip.bind", "", "ip address to bind to. If empty, default to same as -ip option.")
 	m.metaFolder = cmdMaster.Flag.String("mdir", os.TempDir(), "data directory to store meta data")
 	m.peers = cmdMaster.Flag.String("peers", "", "all master nodes in comma separated ip:port list, example: 127.0.0.1:9093,127.0.0.1:9094,127.0.0.1:9095; use 'none' for single-master mode")
-	m.volumeSizeLimitMB = cmdMaster.Flag.Uint("volumeSizeLimitMB", 30*1000, "Master stops directing writes to oversized volumes.")
+	m.volumeSizeLimitMB = cmdMaster.Flag.Uint("volumeSizeLimitMB", util.DefaultVolumeSizeLimitMB, "Master stops directing writes to oversized volumes.")
+	m.fileSizeLimitMB = cmdMaster.Flag.Int("fileSizeLimitMB", 256, "limit the file size accepted by /submit, should match the volume servers' -fileSizeLimitMB (-volume.fileSizeLimitMB under weed server or weed mini, which set this for you)")
 	m.volumePreallocate = cmdMaster.Flag.Bool("volumePreallocate", false, "Preallocate disk space for volumes.")
-	m.maxParallelVacuumPerServer = cmdMaster.Flag.Int("maxParallelVacuumPerServer", 1, "maximum number of volumes to vacuum in parallel per volume server")
+	m.maxParallelVacuumPerServer = cmdMaster.Flag.Int("maxParallelVacuumPerServer", 1, "maximum number of volumes to vacuum in parallel per volume server; 0 for no limit (deprecated, use master.vacuum.max_parallel_per_server in master.toml)")
+	m.vacuumIntervalSeconds = cmdMaster.Flag.Int("vacuumIntervalSeconds", 840, "seconds between automatic vacuum sweeps")
+	m.vacuumDeleteEmptyAfterSeconds = cmdMaster.Flag.Int("vacuumDeleteEmptyAfterSeconds", 0, "automatic sweep deletes volume copies that stay empty this many seconds; 0 disables")
 	// m.pulseSeconds = cmdMaster.Flag.Int("pulseSeconds", 5, "number of seconds between heartbeats")
 	m.defaultReplication = cmdMaster.Flag.String("defaultReplication", "", "Default replication type if not specified.")
 	m.garbageThreshold = cmdMaster.Flag.Float64("garbageThreshold", 0.3, "threshold to vacuum and reclaim spaces")
@@ -104,7 +110,7 @@ func init() {
 	m.heartbeatInterval = cmdMaster.Flag.Duration("heartbeatInterval", 300*time.Millisecond, "heartbeat interval of master servers, and will be randomly multiplied by [1, 1.25)")
 	m.electionTimeout = cmdMaster.Flag.Duration("electionTimeout", 10*time.Second, "election timeout of master servers")
 	m.raftHashicorp = cmdMaster.Flag.Bool("raftHashicorp", false, "use hashicorp raft")
-	m.raftBootstrap = cmdMaster.Flag.Bool("raftBootstrap", false, "Whether to bootstrap the Raft cluster")
+	m.raftBootstrap = cmdMaster.Flag.Bool("raftBootstrap", false, "deprecated and ignored: the first master in -peers mints the Raft cluster on its own once it sees no leader anywhere")
 	m.telemetryUrl = cmdMaster.Flag.String("telemetry.url", "https://telemetry.seaweedfs.com/api/collect", "telemetry server URL to send usage statistics")
 	m.telemetryEnabled = cmdMaster.Flag.Bool("telemetry", true, "report anonymous cluster statistics to telemetry.url, use -telemetry=false to opt out")
 	m.debug = cmdMaster.Flag.Bool("debug", false, "serves runtime profiling data via pprof on the port specified by -debug.port")
@@ -160,8 +166,8 @@ func runMaster(cmd *Command, args []string) bool {
 	}
 
 	masterWhiteList := util.StringSplit(*m.whiteList, ",")
-	if *m.volumeSizeLimitMB > util.VolumeSizeLimitGB*1000 {
-		glog.Fatalf("volumeSizeLimitMB should be smaller than 30000")
+	if *m.volumeSizeLimitMB > util.MaxVolumeSizeLimitMB {
+		glog.Fatalf("volumeSizeLimitMB should not exceed %d", util.MaxVolumeSizeLimitMB)
 	}
 
 	switch {
@@ -211,6 +217,10 @@ func startMaster(masterOption MasterOptions, masterWhiteList []string) {
 
 	isSingleMaster := isSingleMasterMode(*masterOption.peers)
 
+	if *masterOption.raftBootstrap {
+		glog.V(0).Infof("-raftBootstrap is ignored: masters mint a cluster on their own when no peer has a leader, and never over existing raft state")
+	}
+
 	raftServerOption := &weed_server.RaftServerOption{
 		GrpcDialOption:    security.LoadClientTLS(util.GetViper(), "grpc.master"),
 		Peers:             masterPeers,
@@ -221,7 +231,6 @@ func startMaster(masterOption MasterOptions, masterWhiteList []string) {
 		SingleMaster:      isSingleMaster,
 		HeartbeatInterval: *masterOption.heartbeatInterval,
 		ElectionTimeout:   *masterOption.electionTimeout,
-		RaftBootstrap:     *masterOption.raftBootstrap,
 	}
 	var raftServer *weed_server.RaftServer
 	var err error
@@ -234,15 +243,17 @@ func startMaster(masterOption MasterOptions, masterWhiteList []string) {
 		if raftServer == nil {
 			glog.Fatalf("please verify %s is writable, see https://github.com/seaweedfs/seaweedfs/issues/717: %s", *masterOption.metaFolder, err)
 		}
-		// For single-master mode with a fresh log, initialize cluster immediately.
-		// When resuming with existing state, the server is already a member and
-		// will self-elect via fastResume — sending another JoinCommand would block
-		// because goraft's setCommitIndex returns early on JoinCommand entries,
-		// preventing the new entry's event from being notified when old uncommitted
-		// JoinCommands exist in the log.
-		if isSingleMaster && !raftServer.HasExistingState() {
-			glog.V(0).Infof("Single-master mode: initializing cluster immediately")
-			raftServer.DoJoinCommand()
+	}
+	// For single-master mode with a fresh log, initialize cluster immediately.
+	// When resuming with existing state, the server is already a member and
+	// will self-elect via fastResume — sending another JoinCommand would block
+	// because goraft's setCommitIndex returns early on JoinCommand entries,
+	// preventing the new entry's event from being notified when old uncommitted
+	// JoinCommands exist in the log.
+	if isSingleMaster && !raftServer.HasExistingState() {
+		glog.V(0).Infof("Single-master mode: initializing cluster immediately")
+		if err := raftServer.Bootstrap(); err != nil {
+			glog.Errorf("fail to bootstrap the cluster: %v", err)
 		}
 	}
 	ms.SetRaftServer(raftServer)
@@ -272,8 +283,15 @@ func startMaster(masterOption MasterOptions, masterWhiteList []string) {
 	go grpcS.Serve(grpcL)
 	pb.ServeGrpcOnLocalSocket(grpcS, grpcPort)
 
-	// For multi-master mode with non-Hashicorp raft, wait and check if we should join
-	if !*masterOption.raftHashicorp && !isSingleMaster {
+	// A master that starts with no raft state cannot elect on its own — neither
+	// raft implementation lets a server outside the configuration campaign — so
+	// it has to be pulled in by a leader. Keep asking the peers who the leader is
+	// until we are in: the leader admits us once our master client registers, and
+	// only when nobody has one does the first peer mint a new cluster. Keeping
+	// that one peer the sole authority is what stops a partition from minting
+	// two clusters. Restarting a master alone, or scaling the peer list up,
+	// both land here.
+	if !isSingleMaster {
 		go func() {
 			// Stagger bootstrap by peer index so masters don't all check
 			// simultaneously. Peer 0 waits ~1.5s, peer 1 ~3s, etc.
@@ -282,22 +300,24 @@ func startMaster(masterOption MasterOptions, masterWhiteList []string) {
 			glog.V(0).Infof("bootstrap check in %v (peer index %d of %d)", delay, idx, len(peers))
 			time.Sleep(delay)
 
-			ms.Topo.RaftServerAccessLock.RLock()
-			isEmptyMaster := ms.Topo.RaftServer.Leader() == "" && ms.Topo.RaftServer.IsLogEmpty()
-			isFirst := idx == 0
-			if isEmptyMaster && isFirst {
-				existingLeader := ms.MasterClient.FindLeaderFromOtherPeers(myMasterAddress)
-				if existingLeader == "" {
-					raftServer.DoJoinCommand()
-				} else {
-					glog.V(0).Infof("skip bootstrap: existing leader %s found from peers", existingLeader)
+			for {
+				if raftServer.HasExistingState() {
+					return
 				}
-			} else if !isEmptyMaster {
-				glog.V(0).Infof("skip bootstrap: leader=%q logEmpty=%v", ms.Topo.RaftServer.Leader(), ms.Topo.RaftServer.IsLogEmpty())
-			} else {
-				glog.V(0).Infof("skip bootstrap: %v is not the first master in peers (index %d)", myMasterAddress, idx)
+				if leader, err := ms.Topo.MaybeLeader(); err == nil && leader != "" {
+					return
+				}
+				if existingLeader := ms.MasterClient.FindLeaderFromOtherPeers(myMasterAddress); existingLeader != "" {
+					glog.V(0).Infof("waiting to be admitted by existing leader %s", existingLeader)
+				} else if idx == 0 {
+					if err := raftServer.Bootstrap(); err != nil {
+						glog.Errorf("fail to bootstrap the cluster: %v", err)
+					}
+				} else {
+					glog.V(0).Infof("skip bootstrap: %v is not the first master in peers (index %d)", myMasterAddress, idx)
+				}
+				time.Sleep(raftJoinCheckDelay)
 			}
-			ms.Topo.RaftServerAccessLock.RUnlock()
 		}()
 	}
 
@@ -451,11 +471,14 @@ func peerIndex(self pb.ServerAddress, peers []pb.ServerAddress) int {
 func (m *MasterOptions) toMasterOption(whiteList []string) *weed_server.MasterOption {
 	masterAddress := pb.NewServerAddress(*m.ip, *m.port, *m.portGrpc)
 	return &weed_server.MasterOption{
-		Master:                     masterAddress,
-		MetaFolder:                 *m.metaFolder,
-		VolumeSizeLimitMB:          uint32(*m.volumeSizeLimitMB),
-		VolumePreallocate:          *m.volumePreallocate,
-		MaxParallelVacuumPerServer: *m.maxParallelVacuumPerServer,
+		Master:                        masterAddress,
+		MetaFolder:                    *m.metaFolder,
+		VolumeSizeLimitMB:             uint32(*m.volumeSizeLimitMB),
+		FileSizeLimitMB:               *m.fileSizeLimitMB,
+		VolumePreallocate:             *m.volumePreallocate,
+		MaxParallelVacuumPerServer:    *m.maxParallelVacuumPerServer,
+		VacuumIntervalSeconds:         *m.vacuumIntervalSeconds,
+		VacuumDeleteEmptyAfterSeconds: *m.vacuumDeleteEmptyAfterSeconds,
 		// PulseSeconds:            *m.pulseSeconds,
 		DefaultReplicaPlacement: *m.defaultReplication,
 		GarbageThreshold:        *m.garbageThreshold,
@@ -465,5 +488,6 @@ func (m *MasterOptions) toMasterOption(whiteList []string) *weed_server.MasterOp
 		MetricsIntervalSec:      *m.metricsIntervalSec,
 		TelemetryUrl:            *m.telemetryUrl,
 		TelemetryEnabled:        *m.telemetryEnabled,
+		SingleMaster:            isSingleMasterMode(*m.peers),
 	}
 }
diff --git a/weed/command/master_follower.go b/weed/command/master_follower.go
index 60d6e65eef..4e0983eb96 100644
--- a/weed/command/master_follower.go
+++ b/weed/command/master_follower.go
@@ -29,6 +29,11 @@ func init() {
 	mf.ipBind = cmdMasterFollower.Flag.String("ip.bind", "", "ip address to bind to. Default to localhost.")
 	mf.peers = cmdMasterFollower.Flag.String("master", "localhost:9333", "all master nodes in comma separated ip:port list, example: 127.0.0.1:9093,127.0.0.1:9094,127.0.0.1:9095")
 	mf.mastersDeprecated = cmdMasterFollower.Flag.String("masters", "", "all master nodes in comma separated ip:port list (deprecated, use -master instead)")
+	// A follower serves /submit like the leader does, so it buffers uploads under
+	// the same limit and has to be told the same value. Left fixed at 256, a
+	// cluster raised above that would accept an upload through the leader and
+	// refuse the identical one through a follower.
+	mf.fileSizeLimitMB = cmdMasterFollower.Flag.Int("fileSizeLimitMB", 256, "limit the file size accepted by /submit, should match the leader's -fileSizeLimitMB")
 
 	mf.ip = aws.String(util.DetectedHostAddress())
 	mf.metaFolder = aws.String("")
@@ -42,6 +47,8 @@ func init() {
 	mf.metricsIntervalSec = aws.Int(0)
 	mf.raftResumeState = aws.Bool(false)
 	mf.maxParallelVacuumPerServer = aws.Int(1)
+	mf.vacuumIntervalSeconds = aws.Int(840)
+	mf.vacuumDeleteEmptyAfterSeconds = aws.Int(0)
 	mf.telemetryUrl = aws.String("https://telemetry.seaweedfs.com/api/collect")
 	mf.telemetryEnabled = aws.Bool(false)
 }
diff --git a/weed/command/master_test.go b/weed/command/master_test.go
index e35a9a70b1..5e4cc8ee1e 100644
--- a/weed/command/master_test.go
+++ b/weed/command/master_test.go
@@ -4,8 +4,25 @@ import (
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
+func TestDefaultVolumeSizeLimitAlignsWithErasureCodingRows(t *testing.T) {
+	if got := *m.volumeSizeLimitMB; got != util.DefaultVolumeSizeLimitMB {
+		t.Fatalf("master volume size default = %d MiB, want %d MiB", got, util.DefaultVolumeSizeLimitMB)
+	}
+	if got := *masterOptions.volumeSizeLimitMB; got != util.DefaultVolumeSizeLimitMB {
+		t.Fatalf("server master volume size default = %d MiB, want %d MiB", got, util.DefaultVolumeSizeLimitMB)
+	}
+
+	defaultSize := int64(util.DefaultVolumeSizeLimitMB) * util.MiByte
+	largeRowSize := int64(erasure_coding.DataShardsCount) * erasure_coding.ErasureCodingLargeBlockSize
+	if remainder := defaultSize % largeRowSize; remainder != 0 {
+		t.Fatalf("default volume size leaves %d bytes outside complete EC large-block rows", remainder)
+	}
+}
+
 func TestPeerIndexIgnoresGrpcPort(t *testing.T) {
 	self := pb.ServerAddress("127.0.0.1:9000.19000")
 	peers := []pb.ServerAddress{
diff --git a/weed/command/mini.go b/weed/command/mini.go
index a7a0ba01af..05a2c1f752 100644
--- a/weed/command/mini.go
+++ b/weed/command/mini.go
@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 	"sync"
 	"time"
@@ -48,14 +49,16 @@ type MiniOptions struct {
 }
 
 const (
-	bytesPerMB                    = 1024 * 1024 // Bytes per MB
-	miniVolumeMaxDataVolumeCounts = "0"         // auto-configured based on free disk space
-	miniVolumeMinFreeSpace        = "1"         // 1% minimum free space
-	minVolumeSizeMB               = 64          // Minimum volume size in MB
-	defaultMiniVolumeSizeMB       = 128         // Default volume size for mini mode
-	maxVolumeSizeMB               = 1024        // Maximum volume size in MB (1GB)
-	GrpcPortOffset                = 10000       // Offset used to calculate gRPC port from HTTP port
-	defaultMiniPluginJobTypes     = "all"
+	bytesPerMB                 = 1024 * 1024 // Bytes per MB
+	miniVolumeMinFreeSpace     = "1"         // 1% minimum free space
+	minVolumeSizeMB            = 64          // Minimum volume size in MB
+	defaultMiniVolumeSizeMB    = 128         // Default volume size for mini mode
+	maxVolumeSizeMB            = 1024        // Maximum volume size in MB (1GB)
+	GrpcPortOffset             = 10000       // Offset used to calculate gRPC port from HTTP port
+	linuxEphemeralPortFloor    = 32768       // Default net.ipv4.ip_local_port_range floor on Linux
+	defaultAdminHTTPPort       = 12535       // Keeps the derived admin gRPC port (port+GrpcPortOffset) below linuxEphemeralPortFloor
+	defaultAdminHTTPLegacyPort = 23646       // Pre-12535 default; served alongside the new port for backward compatibility
+	defaultMiniPluginJobTypes  = "all"
 )
 
 var (
@@ -65,12 +68,15 @@ var (
 	miniS3Options     S3Options
 	miniWebDavOptions WebDavOption
 	miniAdminOptions  AdminOptions
-	// Track which port flags were explicitly passed on CLI before config file is applied
-	explicitPortFlags map[string]bool
-	miniEnableWebDAV  *bool
-	miniEnableS3      *bool
-	miniEnableAdminUI *bool
-	miniS3IamReadOnly *bool
+	// Flags explicitly provided on the command line or via WEED_* env vars,
+	// captured before the saved options file is applied
+	explicitFlags                 map[string]bool
+	miniEnableWebDAV              *bool
+	miniEnableS3                  *bool
+	miniEnableAdminUI             *bool
+	miniAdminWorkerBindIP         *string
+	miniS3IamReadOnly             *bool
+	miniVolumeMaxDataVolumeCounts *string
 	// MiniClusterCtx is the context for the mini cluster. If set, the mini cluster will stop when the context is cancelled.
 	MiniClusterCtx context.Context
 
@@ -212,6 +218,9 @@ func miniStartupServices() []string {
 		if miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0 {
 			services = append(services, "Iceberg")
 		}
+		if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 {
+			services = append(services, "Lance")
+		}
 	}
 	services = append(services, "Admin")
 	return services
@@ -340,7 +349,7 @@ S3 gateway, WebDAV gateway, and Admin UI).
 
 All settings are optimized for small/dev use cases:
 - Volume size limit: auto configured based on disk space (64MB-1024MB)
-- Volume max: 0 (auto-configured based on free disk space)
+- Volume max: 0 (auto-configured based on free disk space), see -volume.max
 - Pre-stop seconds: 1 (faster shutdown)
 - Master peers: none (single master mode)
 
@@ -365,12 +374,25 @@ After starting, you can access:
 - S3 Endpoint:     http://localhost:8333
 - Iceberg Catalog: http://localhost:8181
 - WebDAV:          http://localhost:7333
-- Admin UI:        http://localhost:23646
+- Admin UI:        http://localhost:12535
 
 S3 Access:
 The S3 endpoint is available at http://localhost:8333. For client
 configuration and IAM setup, see the project documentation or use the
-Admin UI (http://localhost:23646) to manage users and policies.
+Admin UI (http://localhost:12535) to manage users and policies.
+
+Notes:
+- Values mini computes itself (currently master.volumeSizeLimitMB) are
+  pinned in <dir>/mini.options and applied again on the next start to
+  keep them stable; applied values are printed at startup. Command-line
+  flags are never saved and always win over saved values. Edit or
+  delete mini.options to reset a computed value.
+- The official Docker image ships /etc/seaweedfs/filer.toml, which keeps
+  the filer metadata in /data/filerldb2 regardless of -dir; mini warns
+  at startup when a configured store dir is outside -dir. If you set
+  -dir to another path, keep /data on a persistent volume as well.
+  Otherwise the metadata is lost when the container is recreated, and
+  buckets list no objects although the volume files are still in -dir.
 
 `,
 }
@@ -388,9 +410,10 @@ var (
 	miniMetricsHttpIp               = cmdMini.Flag.String("metricsIp", "", "metrics listen ip. If empty, default to same as -ip.bind option.")
 	miniS3Config                    = cmdMini.Flag.String("s3.config", "", "path to the S3 config file")
 	miniIamConfig                   = cmdMini.Flag.String("s3.iam.config", "", "path to the advanced IAM config file for S3")
-	miniS3AllowDeleteBucketNotEmpty = cmdMini.Flag.Bool("s3.allowDeleteBucketNotEmpty", true, "allow recursive deleting all entries along with bucket")
+	miniS3AllowDeleteBucketNotEmpty = cmdMini.Flag.Bool("s3.allowDeleteBucketNotEmpty", false, "allow recursive deleting all entries along with bucket")
+	miniS3AutoCreateBucket          = cmdMini.Flag.Bool("s3.autoCreateBucket", true, "create the bucket on upload if it does not exist, for admin identities only")
 	miniBucket                      = cmdMini.Flag.String("bucket", "", "comma-separated S3 bucket names to create on startup if they do not already exist; leave empty to skip. Falls back to S3_BUCKET env var.")
-	miniTableBucket                 = cmdMini.Flag.String("tableBucket", "", "comma-separated S3 Tables bucket names to create on startup if they do not already exist; leave empty to skip. Falls back to S3_TABLE_BUCKET env var.")
+	miniTableBucket                 = cmdMini.Flag.String("tableBucket", "", "comma-separated S3 Tables buckets to create on startup if they do not already exist, each name[:FORMAT] with FORMAT one of ICEBERG (default) or LANCE, e.g. warehouse,vectors:LANCE; leave empty to skip. Falls back to S3_TABLE_BUCKET env var.")
 )
 
 // getBindIp determines the bind IP address based on miniIp and miniBindIp flags
@@ -422,7 +445,9 @@ func initMiniMasterFlags() {
 	miniMasterOptions.peers = cmdMini.Flag.String("master.peers", "", "all master nodes in comma separated ip:masterPort list (default: none for single master)")
 	miniMasterOptions.volumeSizeLimitMB = cmdMini.Flag.Uint("master.volumeSizeLimitMB", defaultMiniVolumeSizeMB, "Master stops directing writes to oversized volumes (default: 128MB for mini)")
 	miniMasterOptions.volumePreallocate = cmdMini.Flag.Bool("master.volumePreallocate", false, "Preallocate disk space for volumes.")
-	miniMasterOptions.maxParallelVacuumPerServer = cmdMini.Flag.Int("master.maxParallelVacuumPerServer", 1, "maximum number of volumes to vacuum in parallel on one volume server")
+	miniMasterOptions.maxParallelVacuumPerServer = cmdMini.Flag.Int("master.maxParallelVacuumPerServer", 1, "maximum number of volumes to vacuum in parallel on one volume server; 0 for no limit (deprecated, use master.vacuum.max_parallel_per_server in master.toml)")
+	miniMasterOptions.vacuumIntervalSeconds = cmdMini.Flag.Int("master.vacuumIntervalSeconds", 840, "seconds between automatic vacuum sweeps")
+	miniMasterOptions.vacuumDeleteEmptyAfterSeconds = cmdMini.Flag.Int("master.vacuumDeleteEmptyAfterSeconds", 0, "automatic sweep deletes volume copies that stay empty this many seconds; 0 disables")
 	miniMasterOptions.defaultReplication = cmdMini.Flag.String("master.defaultReplication", "", "Default replication type if not specified.")
 	miniMasterOptions.garbageThreshold = cmdMini.Flag.Float64("master.garbageThreshold", 0.3, "threshold to vacuum and reclaim spaces")
 	miniMasterOptions.metricsAddress = cmdMini.Flag.String("master.metrics.address", "", "Prometheus gateway address")
@@ -460,10 +485,13 @@ func initMiniFilerFlags() {
 	miniFilerOptions.tusBasePath = cmdMini.Flag.String("filer.tusBasePath", "/.tus", "TUS resumable upload endpoint base path")
 	miniFilerOptions.tusMaxSizeMB = cmdMini.Flag.Int("filer.tusMaxSizeMB", 5*1024, "maximum TUS upload size in MB")
 	miniFilerOptions.tusSessionExpiry = cmdMini.Flag.Duration("filer.tusSessionExpiry", 24*time.Hour, "incomplete TUS upload sessions are cleaned up after this duration")
+	miniFilerOptions.allowUntrustedRemoteEndpoints = cmdMini.Flag.Bool("filer.allowUntrustedRemoteEndpoints", false, allowUntrustedRemoteEndpointsUsage)
+	miniFilerOptions.remoteCacheEvictThreshold = cmdMini.Flag.Float64("filer.remoteCacheEvictThreshold", 0.9, "evict remote-cached objects (oldest first) when any volume disk exceeds this usage fraction; 0 disables")
 }
 
 // initMiniVolumeFlags initializes Volume server flag options
 func initMiniVolumeFlags() {
+	miniVolumeMaxDataVolumeCounts = cmdMini.Flag.String("volume.max", "0", "maximum numbers of volumes, count[,count]... If set to zero, the limit will be auto configured as free disk space divided by volume size.")
 	miniOptions.v.port = cmdMini.Flag.Int("volume.port", 9340, "volume server http listen port")
 	miniOptions.v.portGrpc = cmdMini.Flag.Int("volume.port.grpc", 0, "volume server grpc listen port")
 	miniOptions.v.publicPort = cmdMini.Flag.Int("volume.port.public", 0, "volume server public port")
@@ -476,6 +504,7 @@ func initMiniVolumeFlags() {
 	miniOptions.v.readMode = cmdMini.Flag.String("volume.readMode", "proxy", "[local|proxy|redirect] how to deal with non-local volume: 'not found|read in remote node|redirect volume location'.")
 	miniOptions.v.compactionMBPerSecond = cmdMini.Flag.Int("volume.compactionMBps", 0, "limit compaction speed in mega bytes per second")
 	miniOptions.v.maintenanceMBPerSecond = cmdMini.Flag.Int("volume.maintenanceMBps", 0, "limit maintenance IO rate in MB/s")
+	miniOptions.v.maxParallelVacuumCommits = cmdMini.Flag.Int("volume.compactionMaxParallelCommits", 0, "limit how many vacuum commits run at once on this server; queued commits hold no volume lock. 0 means unlimited")
 	miniOptions.v.fileSizeLimitMB = cmdMini.Flag.Int("volume.fileSizeLimitMB", 256, "limit file size to avoid out of memory")
 	miniOptions.v.ldbTimeout = cmdMini.Flag.Int64("volume.index.leveldbTimeout", 0, "alive time for leveldb")
 	miniOptions.v.concurrentUploadLimitMB = cmdMini.Flag.Int("volume.concurrentUploadLimitMB", 0, "limit total concurrent upload size")
@@ -487,6 +516,9 @@ func initMiniVolumeFlags() {
 	miniOptions.v.hasSlowRead = cmdMini.Flag.Bool("volume.hasSlowRead", true, "if true, prevents slow reads from blocking other requests")
 	miniOptions.v.readBufferSizeMB = cmdMini.Flag.Int("volume.readBufferSizeMB", 4, "read buffer size in MB")
 	miniOptions.v.allowUntrustedRemoteEndpoints = cmdMini.Flag.Bool("volume.allowUntrustedRemoteEndpoints", false, "if true, FetchAndWriteNeedle accepts arbitrary remote S3 endpoints including loopback / link-local hosts. Default rejects internal / metadata endpoints.")
+	miniOptions.v.fsyncMinBatchBytes = cmdMini.Flag.Int64("volume.fsyncMinBatchBytes", 1*1024*1024, "minimum bytes an fsync batch gathers before a drained queue flushes without waiting")
+	miniOptions.v.fsyncMinBatchRequests = cmdMini.Flag.Int("volume.fsyncMinBatchRequests", 128, "minimum requests an fsync batch gathers before a drained queue flushes without waiting")
+	miniOptions.v.fsyncBatchWait = cmdMini.Flag.Duration("volume.fsyncBatchWait", 500*time.Microsecond, "how long a below-minimum fsync batch waits for more requests once the queue drains; 0 flushes immediately")
 	miniOptions.v.preStopSeconds = cmdMini.Flag.Int("volume.preStopSeconds", 1, "number of seconds between stop send heartbeats and stop volume server (default: 1 for mini)")
 	miniOptions.v.setDiskIOProbeDefaults()
 }
@@ -497,6 +529,9 @@ func initMiniS3Flags() {
 	miniS3Options.portHttps = cmdMini.Flag.Int("s3.port.https", 0, "s3 server https listen port")
 	miniS3Options.portGrpc = cmdMini.Flag.Int("s3.port.grpc", 0, "s3 server grpc listen port")
 	miniS3Options.portIceberg = cmdMini.Flag.Int("s3.port.iceberg", 8181, "Iceberg REST Catalog server listen port (0 to disable)")
+	miniS3Options.portLance = cmdMini.Flag.Int("s3.port.lance", 9101, "Lance Namespace server listen port (0 to disable)")
+	miniS3Options.icebergCredentialRole = cmdMini.Flag.String("s3.iceberg.credentialRole", "", "IAM role ARN the Iceberg catalog assumes to vend table-scoped credentials (empty disables vending)")
+	miniS3Options.icebergCredentialDuration = cmdMini.Flag.Int("s3.iceberg.credentialDurationSeconds", 3600, "lifetime of credentials vended by the Iceberg catalog")
 	miniS3Options.domainName = cmdMini.Flag.String("s3.domainName", "", "suffix of the host name in comma separated list, {bucket}.{domainName}")
 	miniS3Options.allowedOrigins = cmdMini.Flag.String("s3.allowedOrigins", "*", "comma separated list of allowed origins")
 	miniS3Options.tlsPrivateKey = cmdMini.Flag.String("s3.key.file", "", "path to the TLS private key file")
@@ -518,9 +553,14 @@ func initMiniS3Flags() {
 	miniS3Options.iamConfig = miniIamConfig
 	miniS3Options.auditLogConfig = cmdMini.Flag.String("s3.auditLogConfig", "", "path to the audit log config file")
 	miniS3Options.allowDeleteBucketNotEmpty = miniS3AllowDeleteBucketNotEmpty
-	miniS3Options.externalUrl = cmdMini.Flag.String("s3.externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Used for S3 signature verification behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
+	miniS3Options.autoCreateBucket = miniS3AutoCreateBucket
+	miniS3Options.externalUrl = cmdMini.Flag.String("s3.externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Advertised to Iceberg and Lance clients, and tried first when verifying S3 signatures behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
 	miniS3Options.defaultFileMode = cmdMini.Flag.String("s3.defaultFileMode", "", "default file mode for S3 uploaded objects, e.g. 0660, 0644, 0666")
 	miniS3Options.cacheSizeMB = cmdMini.Flag.Int64("s3.cacheCapacityMB", 0, "in-memory chunk cache capacity in MB for S3 GETs shared across requests (0 disables)")
+	miniS3Options.readerCacheSizeMB = cmdMini.Flag.Int64("s3.readerCacheSizeMB", 0, "memory budget in MiB for downloaded and in-flight reader buffers across all S3 GETs (0 means unlimited)")
+	miniS3Options.allowUntrustedRemoteEndpoints = cmdMini.Flag.Bool("s3.allowUntrustedRemoteEndpoints", false, allowUntrustedRemoteEndpointsUsage)
+	miniS3Options.allowBackslashInKey = cmdMini.Flag.Bool("s3.allowBackslashInKey", false, allowBackslashInKeyUsage)
+	miniS3Options.iamSelfServiceRequiresGrant = cmdMini.Flag.Bool("s3.iam.selfServiceRequiresGrant", false, iamSelfServiceRequiresGrantUsage)
 	// In mini mode, S3 uses the shared debug server started at line 681, not its own separate debug server
 	miniS3Options.debug = new(bool) // explicitly false
 	miniS3Options.debugPort = cmdMini.Flag.Int("s3.debug.port", 6060, "http port for debugging (unused in mini mode)")
@@ -542,8 +582,9 @@ func initMiniWebDAVFlags() {
 
 // initMiniAdminFlags initializes Admin server flag options
 func initMiniAdminFlags() {
-	miniAdminOptions.port = cmdMini.Flag.Int("admin.port", 23646, "admin server http listen port")
+	miniAdminOptions.port = cmdMini.Flag.Int("admin.port", defaultAdminHTTPPort, "admin server http listen port")
 	miniAdminOptions.grpcPort = cmdMini.Flag.Int("admin.port.grpc", 0, "admin server grpc listen port (default: admin http port + GrpcPortOffset)")
+	miniAdminOptions.legacyPort = cmdMini.Flag.Int("admin.port.legacy", defaultAdminHTTPLegacyPort, "also serve admin http and grpc (port + GrpcPortOffset) on this port for backward compatibility (0 to disable)")
 	miniAdminOptions.master = cmdMini.Flag.String("admin.master", "", "master server address (automatically set)")
 	// admin discovery must query the same group the co-located filer registers under
 	miniAdminOptions.filerGroup = miniFilerOptions.filerGroup
@@ -552,6 +593,8 @@ func initMiniAdminFlags() {
 	miniAdminOptions.adminPassword = cmdMini.Flag.String("admin.password", "", "admin interface password (if empty, auth is disabled)")
 	miniAdminOptions.readOnlyUser = cmdMini.Flag.String("admin.readOnlyUser", "", "read-only user username (optional, for view-only access)")
 	miniAdminOptions.readOnlyPassword = cmdMini.Flag.String("admin.readOnlyPassword", "", "read-only user password (optional, for view-only access; requires admin.password to be set)")
+	miniAdminOptions.allowInsecureBind = cmdMini.Flag.Bool("admin.allowInsecureBind", false, "INSECURE: allow the unauthenticated admin interface to bind to -ip.bind instead of loopback")
+	miniAdminWorkerBindIP = cmdMini.Flag.String("admin.worker.ip", "127.0.0.1", "worker gRPC bind address; expose only with grpc.admin mTLS configured")
 	miniAdminOptions.urlPrefix = cmdMini.Flag.String("admin.urlPrefix", "", "URL path prefix when running the admin UI behind a reverse proxy under a subdirectory (e.g. /seaweedfs)")
 }
 
@@ -805,8 +848,8 @@ func findAvailablePortOnIP(ip string, startPort int, maxAttempts int, reservedPo
 // If the port is not available, it finds the next available port and updates the pointer
 // The reservedPorts map contains ports that should not be allocated (for gRPC collision avoidance)
 func ensurePortAvailableOnIP(portPtr *int, serviceName string, ip string, reservedPorts map[int]bool, flagName string) error {
-	// Check if this port was explicitly specified by the user (from CLI, before config file was applied)
-	isExplicitPort := explicitPortFlags[flagName]
+	// Check if this port was explicitly specified by the user (from CLI or env, before the config file was applied)
+	isExplicitPort := explicitFlags[flagName]
 
 	if *portPtr == 0 {
 		return nil
@@ -880,6 +923,14 @@ func ensureAllPortsAvailableOnIP(bindIp string) error {
 				grpcPtr  *int
 			}{miniS3Options.portIceberg, "Iceberg", "s3.port.iceberg", nil})
 		}
+		if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 {
+			portConfigs = append(portConfigs, struct {
+				port     *int
+				name     string
+				flagName string
+				grpcPtr  *int
+			}{miniS3Options.portLance, "Lance", "s3.port.lance", nil})
+		}
 	}
 	portConfigs = append(portConfigs, struct {
 		port     *int
@@ -924,16 +975,65 @@ func ensureAllPortsAvailableOnIP(bindIp string) error {
 	// Initialize all gRPC ports before services start
 	// This ensures they won't be recalculated and cause conflicts
 	// All gRPC port handling (calculation, validation, and assignment) is performed exclusively in initializeGrpcPortsOnIP
-	initializeGrpcPortsOnIP(bindIp)
+	allocatedPorts := initializeGrpcPortsOnIP(bindIp)
+
+	// Every other service binds within a moment of this check, but the admin
+	// waits for all of them first. The admin gRPC port sits inside the Linux
+	// ephemeral range, so during that gap one of the cluster's own outgoing
+	// connections can take it and the admin then dies on bind. Hold a listener
+	// from here and hand it to the admin instead of re-binding later. Clear
+	// first: an in-process rerun would otherwise inherit the closed listener
+	// of the previous run and only find out inside Serve.
+	miniAdminOptions.workerGrpcListener = nil
+	workerGrpcBindIP := miniAdminOptions.workerGrpcBindIp
+	if workerGrpcBindIP == "" {
+		workerGrpcBindIP = "127.0.0.1"
+	}
+	if listener, err := listenMiniAdminWorker(workerGrpcBindIP, *miniAdminOptions.grpcPort); err != nil {
+		glog.Warningf("Could not reserve Admin gRPC port %d: %v", *miniAdminOptions.grpcPort, err)
+	} else {
+		miniAdminOptions.workerGrpcListener = listener
+	}
+
+	// Same early reservation for the legacy compat gRPC port — but never take
+	// a port a mini service already owns: compat is a convenience, not a
+	// startup requirement. Failure is only a warning — the legacy port sits
+	// inside the ephemeral range. Without a reservation the admin's late
+	// best-effort bind simply fails harmlessly if the port is taken by then.
+	miniAdminOptions.workerGrpcLegacyListener = nil
+	miniAdminOptions.workerGrpcLegacySkip = false
+	miniAdminOptions.adminHttpLegacySkip = false
+	if *miniAdminOptions.legacyPort > 0 && *miniAdminOptions.legacyPort != *miniAdminOptions.port {
+		if allocatedPorts[*miniAdminOptions.legacyPort] {
+			glog.Warningf("Legacy Admin HTTP port %d is used by another mini service, skipping compat listener", *miniAdminOptions.legacyPort)
+			miniAdminOptions.adminHttpLegacySkip = true
+		}
+		legacyGrpcPort := *miniAdminOptions.legacyPort + GrpcPortOffset
+		switch {
+		case allocatedPorts[legacyGrpcPort]:
+			glog.Warningf("Legacy Admin gRPC port %d is used by another mini service, skipping compat listener", legacyGrpcPort)
+			miniAdminOptions.workerGrpcLegacySkip = true
+		default:
+			if listener, err := listenMiniAdminWorker(workerGrpcBindIP, legacyGrpcPort); err != nil {
+				glog.Warningf("Could not reserve legacy Admin gRPC port %d: %v", legacyGrpcPort, err)
+			} else {
+				miniAdminOptions.workerGrpcLegacyListener = listener
+			}
+		}
+	}
 
 	// Log the final port configuration
 	icebergPortStr := "disabled"
 	if miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0 {
 		icebergPortStr = fmt.Sprintf("%d", *miniS3Options.portIceberg)
 	}
-	glog.V(1).Infof("Final port configuration - Master: %d, Filer: %d, Volume: %d, S3: %d, Iceberg: %s, WebDAV: %d, Admin: %d",
+	lancePortStr := "disabled"
+	if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 {
+		lancePortStr = fmt.Sprintf("%d", *miniS3Options.portLance)
+	}
+	glog.V(1).Infof("Final port configuration - Master: %d, Filer: %d, Volume: %d, S3: %d, Iceberg: %s, Lance: %s, WebDAV: %d, Admin: %d",
 		*miniMasterOptions.port, *miniFilerOptions.port, *miniOptions.v.port,
-		*miniS3Options.port, icebergPortStr, *miniWebDavOptions.port, *miniAdminOptions.port)
+		*miniS3Options.port, icebergPortStr, lancePortStr, *miniWebDavOptions.port, *miniAdminOptions.port)
 
 	// Log gRPC ports too (now finalized)
 	glog.V(1).Infof("gRPC port configuration - Master: %d, Filer: %d, Volume: %d, S3: %d, Admin: %d",
@@ -943,10 +1043,18 @@ func ensureAllPortsAvailableOnIP(bindIp string) error {
 	return nil
 }
 
+// listenMiniAdminWorker reserves the exact worker gRPC address that the Admin
+// server will later use, preventing another connection from taking the port.
+func listenMiniAdminWorker(bindIP string, port int) (net.Listener, error) {
+	return net.Listen("tcp", util.JoinHostPort(bindIP, port))
+}
+
 // initializeGrpcPortsOnIP initializes all gRPC ports based on their HTTP ports on a specific IP
 // If a gRPC port is 0, it will be set to httpPort + GrpcPortOffset
 // This must be called after HTTP ports are finalized and before services start
-func initializeGrpcPortsOnIP(bindIp string) {
+// Returns the set of ports allocated to mini services, for callers that must
+// keep optional listeners from stealing them.
+func initializeGrpcPortsOnIP(bindIp string) map[int]bool {
 	// Track all ports allocated (both HTTP and gRPC) to prevent collisions.
 	// We must reserve HTTP ports so that gRPC fallback allocation never picks
 	// a port already assigned to an HTTP service (which hasn't bound yet).
@@ -963,6 +1071,9 @@ func initializeGrpcPortsOnIP(bindIp string) {
 		if miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0 {
 			allocatedPorts[*miniS3Options.portIceberg] = true
 		}
+		if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 {
+			allocatedPorts[*miniS3Options.portLance] = true
+		}
 	}
 
 	grpcConfigs := []struct {
@@ -1013,12 +1124,27 @@ func initializeGrpcPortsOnIP(bindIp string) {
 		allocatedPorts[*config.grpcPort] = true
 		glog.V(1).Infof("%s gRPC port set to %d", config.name, *config.grpcPort)
 	}
+
+	// The Linux kernel draws outbound source ports from the ephemeral range.
+	// A gRPC port inside it can be claimed by one of mini's own startup dials
+	// before the service binds it.
+	if *miniAdminOptions.grpcPort >= linuxEphemeralPortFloor {
+		glog.Warningf("Admin gRPC port %d is at or above the Linux ephemeral floor %d; an outbound connection may claim it before Admin binds it. Pick a lower -admin.port.", *miniAdminOptions.grpcPort, linuxEphemeralPortFloor)
+	}
+
+	return allocatedPorts
+}
+
+// miniOptionsFilePath returns the path of the mini.options file under the
+// first -dir folder.
+func miniOptionsFilePath(dataFolder string) string {
+	return filepath.Join(util.ResolvePath(util.StringSplit(dataFolder, ",")[0]), "mini.options")
 }
 
 // loadMiniConfigurationFile reads the mini.options file and returns parsed options
 // File format: one option per line, without leading dash (e.g., "ip=127.0.0.1")
 func loadMiniConfigurationFile(dataFolder string) (map[string]string, error) {
-	configFile := filepath.Join(util.ResolvePath(util.StringSplit(dataFolder, ",")[0]), "mini.options")
+	configFile := miniOptionsFilePath(dataFolder)
 
 	options := make(map[string]string)
 
@@ -1066,31 +1192,112 @@ func loadMiniConfigurationFile(dataFolder string) (map[string]string, error) {
 	return options, nil
 }
 
-// applyConfigFileOptions sets command-line flags from loaded configuration file
-func applyConfigFileOptions(options map[string]string) {
-	for key, value := range options {
-		// Skip port flags that were explicitly passed on CLI
-		if explicitPortFlags[key] {
-			glog.V(2).Infof("Skipping config file option %s=%s (explicitly specified on command line)", key, value)
+// applyConfigFileOptions sets command-line flags from loaded configuration
+// file. Options for flags the user provided explicitly (command line or
+// WEED_* env var) are skipped, so passing a flag always wins over the saved
+// value — including passing it at its default value. Returns a map of the
+// applied keys to their display values (secrets redacted).
+func applyConfigFileOptions(options map[string]string) map[string]string {
+	keys := make([]string, 0, len(options))
+	for key := range options {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+
+	applied := make(map[string]string)
+	for _, key := range keys {
+		value := options[key]
+		// Redact secrets (admin.password, admin.readOnlyPassword, ...) in
+		// logs and the startup message; only flag.Value.Set sees the value.
+		display := value
+		if isSensitiveOption(key) {
+			display = "*****"
+		}
+		if explicitFlags[key] {
+			glog.V(2).Infof("Skipping config file option %s=%s (explicitly specified)", key, display)
 			continue
 		}
-		// Set the flag value if it hasn't been explicitly set on command line
 		flag := cmdMini.Flag.Lookup(key)
-		if flag != nil {
-			// Only set if not already set (by command line)
-			if flag.Value.String() == flag.DefValue {
-				if err := flag.Value.Set(value); err != nil {
-					glog.Warningf("Failed to apply config file option: %s=%s: %v", key, value, err)
-				} else {
-					glog.V(2).Infof("Applied config file option: %s=%s", key, value)
+		if flag == nil {
+			continue
+		}
+		if err := flag.Value.Set(value); err != nil {
+			glog.Warningf("Failed to apply config file option: %s=%s: %v", key, display, err)
+			continue
+		}
+		glog.V(2).Infof("Applied config file option: %s=%s", key, display)
+		applied[key] = display
+	}
+	return applied
+}
+
+// isSensitiveOption reports whether a saved option holds a secret that must
+// not appear in logs or the startup message.
+func isSensitiveOption(key string) bool {
+	k := strings.ToLower(key)
+	return strings.Contains(k, "password") || strings.Contains(k, "secret") || strings.Contains(k, "token")
+}
+
+// warnIfFilerStoreOutsideDir warns when a filer.toml configures a local
+// filer store outside the -dir folders and the master meta folder. When a
+// filer.toml is found the filer skips defaultLevelDbDirectory, so metadata
+// can silently land on a path the volume data doesn't use — in a container
+// that path is lost on recreate unless it is persisted separately.
+func warnIfFilerStoreOutsideDir(dataFolders string, metaFolder string) {
+	if !util.LoadConfiguration("filer", false) {
+		return
+	}
+	v := util.GetViper()
+	folders := append(util.StringSplit(dataFolders, ","), metaFolder)
+	inside := func(storeDir string) bool {
+		// The filer stores open the configured dir verbatim, so absolutize it
+		// the same way (relative to the working directory) rather than
+		// expanding "~", which the store never expands.
+		resolved, err := filepath.Abs(storeDir)
+		if err != nil {
+			return false
+		}
+		for _, folder := range folders {
+			base, err := filepath.Abs(util.ResolvePath(folder))
+			if err != nil {
+				continue
+			}
+			// Resolve symlinks only when both sides exist, so a not-yet-
+			// created store dir under a symlinked -dir still compares
+			// lexically against the same spelling.
+			r, b := resolved, base
+			if er, err := filepath.EvalSymlinks(resolved); err == nil {
+				if eb, err := filepath.EvalSymlinks(base); err == nil {
+					r, b = er, eb
 				}
 			}
+			if rel, err := filepath.Rel(b, r); err == nil && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+				return true
+			}
+		}
+		return false
+	}
+	// Local filer stores keep metadata under a "dir" key; check both the
+	// default store (leveldb2.enabled) and path-specific stores
+	// (leveldb2.<id>.enabled, keyed under <section>.location).
+	localStores := map[string]bool{"leveldb": true, "leveldb2": true, "leveldb3": true}
+	for _, key := range v.AllKeys() {
+		if !strings.HasSuffix(key, ".enabled") || !v.GetBool(key) {
+			continue
+		}
+		section := strings.TrimSuffix(key, ".enabled")
+		if !localStores[strings.Split(section, ".")[0]] {
+			continue
+		}
+		if storeDir := v.GetString(section + ".dir"); storeDir != "" && !inside(storeDir) {
+			glog.Warningf("filer store %s uses dir %s from filer.toml, outside -dir %s; persist that path or filer metadata will be lost when the container is recreated", section, storeDir, dataFolders)
 		}
 	}
 }
 
-// saveMiniConfiguration saves the current mini configuration to a file
-// The file format uses option=value format without leading dashes
+// saveMiniConfiguration writes values mini computed itself to mini.options.
+// Command-line flags are never saved, so a dropped flag cannot resurrect on
+// the next start; the file exists to pin environment-derived values.
 func saveMiniConfiguration(dataFolder string) error {
 	configDir := util.ResolvePath(util.StringSplit(dataFolder, ",")[0])
 	if err := os.MkdirAll(configDir, 0755); err != nil {
@@ -1102,29 +1309,15 @@ func saveMiniConfiguration(dataFolder string) error {
 
 	var sb strings.Builder
 	sb.WriteString("#!/bin/bash\n")
-	sb.WriteString("# Mini server configuration\n")
+	sb.WriteString("# Mini server auto-computed options\n")
 	sb.WriteString("# Format: option=value (no leading dash)\n")
-	sb.WriteString("# This file is loaded on startup if it exists\n\n")
+	sb.WriteString("# This file is loaded on startup if it exists\n")
+	sb.WriteString("# Command-line flags are not saved; only values mini computed itself.\n\n")
 
-	// Collect all flags that were explicitly passed (except "dir")
-	cmdMini.Flag.Visit(func(f *flag.Flag) {
-		// Skip the "dir" option - it's environment-specific
-		if f.Name == "dir" {
-			return
-		}
-		value := f.Value.String()
-		// Quote the value if it contains spaces
-		if strings.Contains(value, " ") {
-			sb.WriteString(fmt.Sprintf("%s=\"%s\"\n", f.Name, value))
-		} else {
-			sb.WriteString(fmt.Sprintf("%s=%s\n", f.Name, value))
-		}
-	})
-
-	// Add auto-calculated volume size if it was computed
+	// Pin the auto-calculated volume size so it stays stable across restarts
+	// even as free disk space changes. Delete this line to force
+	// recalculation on the next startup.
 	if !isFlagPassed("master.volumeSizeLimitMB") && miniMasterOptions.volumeSizeLimitMB != nil {
-		sb.WriteString(fmt.Sprintf("\n# Auto-calculated volume size based on total disk capacity\n"))
-		sb.WriteString(fmt.Sprintf("# Delete this line to force recalculation on next startup\n"))
 		sb.WriteString(fmt.Sprintf("master.volumeSizeLimitMB=%d\n", *miniMasterOptions.volumeSizeLimitMB))
 	}
 
@@ -1146,21 +1339,32 @@ func runMini(cmd *Command, args []string) bool {
 	// can opt back into verbose output.
 	quietMiniLogs()
 
-	// Capture which port flags were explicitly passed on CLI BEFORE config file is applied
-	// This is necessary to distinguish user-specified ports from defaults or config file options
-	explicitPortFlags = make(map[string]bool)
-	portFlagNames := []string{"master.port", "filer.port", "volume.port", "s3.port", "s3.port.iceberg", "webdav.port", "admin.port", "s3.iam.readOnly"}
-	for _, flagName := range portFlagNames {
-		explicitPortFlags[flagName] = isFlagPassed(flagName)
-	}
+	// Capture which flags were explicitly provided on the command line or via
+	// WEED_* env vars BEFORE the saved options file is applied. Saved options
+	// only fill in flags the user did not provide this run, so passing a flag
+	// at its default value also resets a saved value.
+	explicitFlags = make(map[string]bool)
+	cmdMini.Flag.Visit(func(f *flag.Flag) {
+		explicitFlags[f.Name] = true
+	})
 
-	// Load configuration from file if it exists
+	// Load configuration from file if it exists. Capture the path before
+	// applying: a saved "dir" option can change miniDataFolders.
+	optionsFile := miniOptionsFilePath(*miniDataFolders)
 	configOptions, err := loadMiniConfigurationFile(*miniDataFolders)
 	if err != nil {
 		glog.Warningf("Error loading configuration file: %v", err)
 	}
-	// Apply loaded options to flags (CLI flags will override these)
-	applyConfigFileOptions(configOptions)
+	// Apply loaded options to flags (explicitly provided flags win)
+	appliedOptions := applyConfigFileOptions(configOptions)
+	if len(appliedOptions) > 0 {
+		pairs := make([]string, 0, len(appliedOptions))
+		for k, v := range appliedOptions {
+			pairs = append(pairs, k+"="+v)
+		}
+		sort.Strings(pairs)
+		fmt.Printf("  Applying %d saved option(s) from %s: %s\n", len(appliedOptions), optionsFile, strings.Join(pairs, " "))
+	}
 
 	if *miniOptions.debug {
 		grace.StartDebugServer(*miniOptions.debugPort)
@@ -1195,6 +1399,10 @@ func runMini(cmd *Command, args []string) bool {
 
 	// Determine bind IP
 	bindIp := getBindIp()
+	miniAdminOptions.workerGrpcBindIp = *miniAdminWorkerBindIP
+	if miniAdminOptions.workerGrpcBindIp == "" {
+		miniAdminOptions.workerGrpcBindIp = "127.0.0.1"
+	}
 
 	// Ensure all ports are available, find alternatives if needed
 	if err := ensureAllPortsAvailableOnIP(bindIp); err != nil {
@@ -1232,14 +1440,20 @@ func runMini(cmd *Command, args []string) bool {
 	miniOptions.v.bindIp = miniBindIp
 	miniOptions.v.masters = pb.ServerAddresses(actualPeersForComponents).ToAddresses()
 	miniOptions.v.idleConnectionTimeout = miniTimeout
+	// Admin server binds to the same address as the other mini services.
+	// The public-bind-without-auth guard in `weed admin` does not apply here
+	// because mini calls startAdminServer directly, not runAdmin.
+	miniAdminOptions.ip = miniBindIp
 	miniOptions.v.dataCenter = miniDataCenter
 	miniOptions.v.rack = miniRack
 
 	miniMasterOptions.whiteList = miniWhiteListOption
+	// The master's /submit buffers the upload before handing it to the volume
+	// server started here, so it must not reject what that volume server accepts.
+	miniMasterOptions.fileSizeLimitMB = miniOptions.v.fileSizeLimitMB
 
 	miniFilerOptions.dataCenter = miniDataCenter
 	miniFilerOptions.rack = miniRack
-	miniS3Options.dataCenter = miniDataCenter
 	miniFilerOptions.disableHttp = miniDisableHttp
 	miniMasterOptions.disableHttp = miniDisableHttp
 
@@ -1263,8 +1477,8 @@ func runMini(cmd *Command, args []string) bool {
 
 	go stats_collect.StartMetricsServer(*miniMetricsHttpIp, *miniMetricsHttpPort)
 
-	if *miniMasterOptions.volumeSizeLimitMB > util.VolumeSizeLimitGB*1000 {
-		glog.Fatalf("masterVolumeSizeLimitMB should be less than 30000")
+	if *miniMasterOptions.volumeSizeLimitMB > util.MaxVolumeSizeLimitMB {
+		glog.Fatalf("master.volumeSizeLimitMB should not exceed %d", util.MaxVolumeSizeLimitMB)
 	}
 
 	if *miniMasterOptions.metaFolder == "" {
@@ -1278,10 +1492,14 @@ func runMini(cmd *Command, args []string) bool {
 		glog.Fatalf("Check Meta Folder (-dir=\"%s\") Writable: %s", *miniMasterOptions.metaFolder, err)
 	}
 	miniFilerOptions.defaultLevelDbDirectory = miniMasterOptions.metaFolder
+	warnIfFilerStoreOutsideDir(*miniDataFolders, *miniMasterOptions.metaFolder)
 
-	// Calculate and set optimal volume size limit based on available disk space
-	// Only auto-calculate if user didn't explicitly specify a value via -master.volumeSizeLimitMB
-	if !isFlagPassed("master.volumeSizeLimitMB") {
+	// Calculate and set optimal volume size limit based on available disk space.
+	// Skip when the user passed -master.volumeSizeLimitMB explicitly, and when
+	// the value was loaded from mini.options — file-applied flags are not in
+	// Visit, and the saved pin must survive restarts.
+	_, sizeLimitFromFile := appliedOptions["master.volumeSizeLimitMB"]
+	if !isFlagPassed("master.volumeSizeLimitMB") && !sizeLimitFromFile {
 		// User didn't override, use auto-calculated value
 		// The -dir flag can accept comma-separated directories; use the first one for disk space calculation.
 		// miniDataFolders was already tilde-resolved at the top of runMini.
@@ -1345,9 +1563,19 @@ func runMini(cmd *Command, args []string) bool {
 	if tableBucketSpec == "" {
 		tableBucketSpec = os.Getenv("S3_TABLE_BUCKET")
 	}
-	if err := ensureMiniTableBuckets(tableBucketSpec); err != nil {
+	ready, err := ensureMiniTableBuckets(parseTableBucketList(tableBucketSpec))
+	if err != nil {
 		glog.Warningf("failed to ensure table buckets %q: %v", tableBucketSpec, err)
 	}
+	// The Iceberg catalog routes unprefixed requests to the first
+	// S3_TABLE_BUCKET entry and looks the name up as given, so rewrite the
+	// variable whichever way the spec arrived: a Lance entry or a :FORMAT
+	// suffix left in place names a bucket the catalog cannot find.
+	if names := icebergRoutingNames(ready); len(names) > 0 {
+		os.Setenv("S3_TABLE_BUCKET", strings.Join(names, ","))
+	} else {
+		os.Unsetenv("S3_TABLE_BUCKET")
+	}
 
 	// Print welcome message after all services are running
 	printWelcomeMessage()
@@ -1386,7 +1614,7 @@ func startMiniServices(miniWhiteList []string, allServicesReady chan struct{}) {
 		defer reportMiniStopped("Volume")
 		startMiniService("Volume", func() {
 			minFreeSpaces := util.MustParseMinFreeSpace(miniVolumeMinFreeSpace, "")
-			miniOptions.v.startVolumeServer(*miniDataFolders, miniVolumeMaxDataVolumeCounts, *miniWhiteListOption, minFreeSpaces)
+			miniOptions.v.startVolumeServer(*miniDataFolders, *miniVolumeMaxDataVolumeCounts, *miniWhiteListOption, minFreeSpaces)
 		}, *miniOptions.v.port)
 	}()
 
@@ -1413,10 +1641,14 @@ func startMiniServices(miniWhiteList []string, allServicesReady chan struct{}) {
 		go func() {
 			defer done()
 			defer reportMiniStopped("S3")
-			// Iceberg lives inside the S3 server; report it stopped alongside.
+			// Iceberg and Lance live inside the S3 server; report them stopped
+			// alongside it.
 			if miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0 {
 				defer reportMiniStopped("Iceberg")
 			}
+			if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 {
+				defer reportMiniStopped("Lance")
+			}
 			startMiniService("S3", startS3Service, *miniS3Options.port)
 		}()
 	}
@@ -1442,7 +1674,30 @@ func startMiniServices(miniWhiteList []string, allServicesReady chan struct{}) {
 			if miniProgressBoard != nil {
 				miniProgressBoard.starting("Iceberg")
 			}
-			waitForServiceReady("Iceberg", *miniS3Options.portIceberg, bindIp)
+			// Probe only when the catalog listener actually bound; otherwise the
+			// port may answer as an unrelated process and get advertised as the
+			// catalog.
+			if miniS3Options.icebergBound.Load() {
+				waitForServiceReady("Iceberg", *miniS3Options.portIceberg, bindIp)
+			} else {
+				if miniProgressBoard != nil {
+					miniProgressBoard.failed("Iceberg")
+				}
+				glog.Warningf("Iceberg catalog on port %d did not start; see S3 startup log", *miniS3Options.portIceberg)
+			}
+		}
+		if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 {
+			if miniProgressBoard != nil {
+				miniProgressBoard.starting("Lance")
+			}
+			if miniS3Options.lanceBound.Load() {
+				waitForServiceReady("Lance", *miniS3Options.portLance, bindIp)
+			} else {
+				if miniProgressBoard != nil {
+					miniProgressBoard.failed("Lance")
+				}
+				glog.Warningf("Lance namespace server on port %d did not start; see S3 startup log", *miniS3Options.portLance)
+			}
 		}
 	}
 	if *miniEnableWebDAV {
@@ -1465,7 +1720,7 @@ func startMiniService(name string, fn func(), port int) {
 // waitForServiceReady pings the service HTTP endpoint to check if it's ready
 // to accept connections, and reports the transition to the progress board.
 func waitForServiceReady(name string, port int, bindIp string) {
-	address := fmt.Sprintf("http://%s:%d", bindIp, port)
+	address := "http://" + util.JoinHostPort(bindIp, port)
 	healthAddr := getHealthCheckAddr(address)
 	maxAttempts := 30 // 30 * 200ms = 6 seconds max wait
 	attempt := 0
@@ -1512,6 +1767,46 @@ func applyMiniAdminCredentialFallback(options *AdminOptions) {
 	applyViperFallback(cmdMini, options.readOnlyPassword, "admin.readOnlyPassword", "admin.readonly.password")
 }
 
+// miniAdminBindIP selects a loopback HTTP bind unless Admin authentication,
+// mTLS, or an explicit insecure opt-out permits the requested address.
+func miniAdminBindIP(requestedIP string, passwordConfigured, mtlsConfigured, allowInsecure bool) string {
+	if isLoopbackIp(requestedIP) || passwordConfigured || mtlsConfigured || allowInsecure {
+		return requestedIP
+	}
+	return "127.0.0.1"
+}
+
+// miniAdminWorkerAddress encodes the finalized HTTP and gRPC ports in the
+// server-address format understood by pb.ServerToGrpcAddress.
+func miniAdminWorkerAddress(bindIP string, httpPort, grpcPort int) string {
+	return fmt.Sprintf("%s:%d.%d", miniAdminWorkerDialIP(bindIP), httpPort, grpcPort)
+}
+
+// miniAdminWorkerDialIP maps unspecified listener addresses to same-family
+// loopback destinations while preserving specific addresses for local dials.
+func miniAdminWorkerDialIP(bindIP string) string {
+	ip := net.ParseIP(strings.TrimSuffix(strings.TrimPrefix(bindIP, "["), "]"))
+	if ip == nil || !ip.IsUnspecified() {
+		return bindIP
+	}
+	if ip.To4() != nil {
+		return "127.0.0.1"
+	}
+	return "::1"
+}
+
+// miniAdminAdvertisedIP returns a reachable address for URLs in the welcome
+// message while preserving a specifically selected Admin HTTP bind address.
+func miniAdminAdvertisedIP() string {
+	if miniAdminOptions.ip == nil || *miniAdminOptions.ip == "" {
+		return *miniIp
+	}
+	if *miniAdminOptions.ip == "0.0.0.0" || *miniAdminOptions.ip == "::" {
+		return *miniIp
+	}
+	return *miniAdminOptions.ip
+}
+
 // startMiniAdminWithWorker starts the admin server with one worker
 func startMiniAdminWithWorker(allServicesReady chan struct{}) {
 	defer close(allServicesReady) // Ensure channel is always closed on all paths
@@ -1519,19 +1814,52 @@ func startMiniAdminWithWorker(allServicesReady chan struct{}) {
 	// Admin shuts down when mini clients shutdown is triggered.
 	ctx := miniClientsCtx()
 
-	// Determine bind IP for health checks
-	bindIp := getBindIp()
-
 	// Prepare master address with gRPC port
 	masterAddr := string(pb.NewServerAddress(*miniIp, *miniMasterOptions.port, *miniMasterOptions.portGrpc))
 
 	// Set admin options
 	*miniAdminOptions.master = masterAddr
 
+	// Mini knows its own S3 address, so the file browser can offer object
+	// URLs without any configuration. Assigned unconditionally so a value
+	// from a prior in-process run cannot outlive its S3 server.
+	miniAdminOptions.defaultS3PublicEndpoint = ""
+	if *miniEnableS3 {
+		miniAdminOptions.defaultS3PublicEndpoint = "http://" + util.JoinHostPort(*miniIp, *miniS3Options.port)
+	}
+
 	// Resolve admin credentials from security.toml [admin] / WEED_ADMIN_* env
 	// vars, matching the standalone `weed admin` command.
 	applyMiniAdminCredentialFallback(&miniAdminOptions)
 
+	requestedBindIP := getBindIp()
+	hasMTLS := util.GetViper().GetString("https.admin.key") != "" &&
+		util.GetViper().GetString("https.admin.ca") != ""
+	allowInsecure := miniAdminOptions.allowInsecureBind != nil &&
+		*miniAdminOptions.allowInsecureBind
+	bindIP := miniAdminBindIP(
+		requestedBindIP,
+		*miniAdminOptions.adminPassword != "",
+		hasMTLS,
+		allowInsecure,
+	)
+	miniAdminOptions.ip = &bindIP
+	if bindIP != requestedBindIP {
+		glog.Warningf(
+			"Admin authentication is disabled; binding the admin interface to %s instead of %s. "+
+				"Set -admin.password, configure https.admin mTLS, or use "+
+				"-admin.allowInsecureBind to retain the insecure network bind.",
+			bindIP,
+			requestedBindIP,
+		)
+	} else if allowInsecure && !isLoopbackIp(bindIP) &&
+		*miniAdminOptions.adminPassword == "" && !hasMTLS {
+		glog.Warningf(
+			"-admin.allowInsecureBind exposes the unauthenticated admin interface on %s.",
+			bindIP,
+		)
+	}
+
 	// Security validation: prevent empty username when password is set
 	if *miniAdminOptions.adminPassword != "" && *miniAdminOptions.adminUser == "" {
 		glog.Fatalf("Error: -admin.user cannot be empty when -admin.password is set")
@@ -1573,21 +1901,39 @@ func startMiniAdminWithWorker(allServicesReady chan struct{}) {
 	if miniProgressBoard != nil {
 		miniProgressBoard.starting("Admin")
 	}
+	// Snapshot the options, and with them the reserved listener, so a later
+	// in-process run cannot swap either out from under this goroutine.
+	adminOptions := miniAdminOptions
 	done := trackMiniClient()
 	go func() {
 		defer done()
 		defer reportMiniStopped("Admin")
-		var icebergPort int
-		if miniS3Options.portIceberg != nil {
-			icebergPort = *miniS3Options.portIceberg
+		// Only advertise a catalog port when S3 is actually running: with -s3=false
+		// the admin UI would otherwise print an endpoint nothing is listening on.
+		var icebergPort, lancePort int
+		if miniEnableS3 != nil && *miniEnableS3 {
+			if miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0 && miniS3Options.icebergBound.Load() {
+				icebergPort = *miniS3Options.portIceberg
+			}
+			if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 && miniS3Options.lanceBound.Load() {
+				lancePort = *miniS3Options.portLance
+			}
 		}
-		if err := startAdminServer(ctx, miniAdminOptions, *miniEnableAdminUI, icebergPort, urlPrefix); err != nil {
+		if err := startAdminServer(ctx, adminOptions, *miniEnableAdminUI, icebergPort, lancePort, urlPrefix); err != nil {
 			glog.Errorf("Admin server error: %v", err)
 		}
+		// A no-op once the admin took it over and shut it down; it matters when
+		// startAdminServer bailed out before that.
+		if adminOptions.workerGrpcListener != nil {
+			adminOptions.workerGrpcListener.Close()
+		}
+		if adminOptions.workerGrpcLegacyListener != nil {
+			adminOptions.workerGrpcLegacyListener.Close()
+		}
 	}()
 
 	// Wait for admin server's HTTP port to be ready before launching worker
-	adminAddr := fmt.Sprintf("http://%s:%d", bindIp, *miniAdminOptions.port)
+	adminAddr := "http://" + util.JoinHostPort(bindIP, *miniAdminOptions.port)
 	if err := waitForAdminServerReady(ctx, adminAddr); err != nil {
 		// If the parent context was cancelled (e.g. a previous in-process
 		// mini run is being torn down), bail out gracefully instead of
@@ -1611,7 +1957,10 @@ func startMiniAdminWithWorker(allServicesReady chan struct{}) {
 	startMiniPluginWorker(ctx, workerDir)
 
 	// Wait for worker to be ready by polling its gRPC port
-	workerGrpcAddr := fmt.Sprintf("%s:%d", bindIp, *miniAdminOptions.grpcPort)
+	workerGrpcAddr := util.JoinHostPort(
+		miniAdminWorkerDialIP(miniAdminOptions.workerGrpcBindIp),
+		*miniAdminOptions.grpcPort,
+	)
 	waitForWorkerReady(workerGrpcAddr)
 	if miniProgressBoard != nil {
 		miniProgressBoard.ready("Admin")
@@ -1689,7 +2038,11 @@ func waitForWorkerReady(workerGrpcAddr string) {
 func startMiniWorker(workerDir string) {
 	glog.V(1).Infof("Initializing standard worker runtime")
 
-	adminAddr := fmt.Sprintf("%s:%d", *miniIp, *miniAdminOptions.port)
+	adminAddr := miniAdminWorkerAddress(
+		miniAdminOptions.workerGrpcBindIp,
+		*miniAdminOptions.port,
+		*miniAdminOptions.grpcPort,
+	)
 	capabilities := "vacuum,ec,balance"
 
 	// Use common worker directory
@@ -1764,11 +2117,11 @@ func startMiniWorker(workerDir string) {
 func startMiniPluginWorker(ctx context.Context, workerDir string) {
 	glog.V(1).Infof("Starting plugin worker for admin server")
 
-	adminAddr := fmt.Sprintf("%s:%d", *miniIp, *miniAdminOptions.port)
-	resolvedAdminAddr := resolvePluginWorkerAdminServer(adminAddr)
-	if resolvedAdminAddr != adminAddr {
-		glog.V(1).Infof("Resolved mini plugin worker admin endpoint: %s -> %s", adminAddr, resolvedAdminAddr)
-	}
+	adminAddr := miniAdminWorkerAddress(
+		miniAdminOptions.workerGrpcBindIp,
+		*miniAdminOptions.port,
+		*miniAdminOptions.grpcPort,
+	)
 
 	// Use common worker directory
 
@@ -1786,7 +2139,7 @@ func startMiniPluginWorker(ctx context.Context, workerDir string) {
 	}
 
 	pluginRuntime, err := pluginworker.NewWorker(pluginworker.WorkerOptions{
-		AdminServer:             resolvedAdminAddr,
+		AdminServer:             adminAddr,
 		WorkerID:                workerID,
 		WorkerVersion:           version.Version(),
 		WorkerAddress:           *miniIp,
@@ -1825,13 +2178,15 @@ const credentialsInstructionTemplate = `
     Creates initial credentials for the 'mini' user and pre-creates the bucket.
 
   Option 2: Use the Admin UI
-    Open: http://%s:%d
+    Open: http://%s
     Add a new identity to create S3 credentials.
 `
 
 // printWelcomeMessage prints the welcome message after all services are running
 func printWelcomeMessage() {
 	var sb strings.Builder
+	adminIP := miniAdminAdvertisedIP()
+	adminHTTPAddress := util.JoinHostPort(adminIP, *miniAdminOptions.port)
 
 	sb.WriteString("╔═══════════════════════════════════════════════════════════════════════════════╗\n")
 	sb.WriteString("║                      SeaweedFS Mini - All-in-One Mode                         ║\n")
@@ -1848,9 +2203,12 @@ func printWelcomeMessage() {
 		if miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0 {
 			fmt.Fprintf(&sb, "    Iceberg Catalog: http://%s:%d\n", *miniIp, *miniS3Options.portIceberg)
 		}
+		if miniS3Options.portLance != nil && *miniS3Options.portLance > 0 {
+			fmt.Fprintf(&sb, "    Lance Namespace: http://%s:%d\n", *miniIp, *miniS3Options.portLance)
+		}
 	}
 	if *miniEnableAdminUI {
-		fmt.Fprintf(&sb, "    Admin UI:        http://%s:%d\n", *miniIp, *miniAdminOptions.port)
+		fmt.Fprintf(&sb, "    Admin UI:        http://%s\n", adminHTTPAddress)
 	}
 
 	fmt.Fprintf(&sb, "\n  Data Directory:   %s\n", *miniDataFolders)
@@ -1873,7 +2231,7 @@ func printWelcomeMessage() {
 		// run, configured via env vars, static config file, etc.) — no need
 		// to show setup hints.
 	case *miniEnableAdminUI:
-		fmt.Fprintf(&sb, credentialsInstructionTemplate, *miniIp, *miniAdminOptions.port)
+		fmt.Fprintf(&sb, credentialsInstructionTemplate, adminHTTPAddress)
 	default:
 		sb.WriteString("\n  To create S3 credentials, use environment variables:\n\n")
 		sb.WriteString("    export AWS_ACCESS_KEY_ID=your-access-key\n")
@@ -1892,7 +2250,7 @@ func printWelcomeMessage() {
 // Best-effort: any error returns ok=false so the welcome banner simply omits
 // the lines.
 func miniVolumeCounts() (max, free int64, ok bool) {
-	url := getHealthCheckAddr(fmt.Sprintf("http://%s:%d/dir/status", *miniIp, *miniMasterOptions.port))
+	url := getHealthCheckAddr("http://" + util.JoinHostPort(*miniIp, *miniMasterOptions.port) + "/dir/status")
 	client := &http.Client{Timeout: 2 * time.Second}
 	resp, err := client.Get(url)
 	if err != nil {
@@ -1965,42 +2323,157 @@ func ensureMiniBuckets(bucketSpec string) error {
 	})
 }
 
+// tableBucketEntry is one -tableBucket entry: a bucket name and the table
+// format that bucket will hold.
+type tableBucketEntry struct {
+	name   string
+	format string
+}
+
 // ensureMiniTableBuckets creates each named S3 Tables bucket on the embedded
-// filer if it does not already exist. bucketSpec is comma-separated; whitespace
-// is trimmed and duplicates are dropped. Per-bucket failures are logged so one
-// bad name does not block the rest. Buckets are owned by s3tables.DefaultAccountID
+// filer if it does not already exist, and returns the ones that now hold the
+// format that was asked for. Per-bucket failures are logged so one bad name
+// does not block the rest. Buckets are owned by s3tables.DefaultAccountID
 // since mini does not yet model multi-account ownership.
-func ensureMiniTableBuckets(bucketSpec string) error {
-	names := parseBucketList(bucketSpec)
-	if len(names) == 0 {
-		return nil
+func ensureMiniTableBuckets(buckets []tableBucketEntry) ([]tableBucketEntry, error) {
+	// A bucket holds one format, and the format decides which catalog serves
+	// it, so one created in a format this mini does not serve is a bucket no
+	// client can reach.
+	var servable []tableBucketEntry
+	for _, bucket := range buckets {
+		if !miniServesTableFormat(bucket.format) {
+			// An unsuffixed name means Iceberg, so on a Lance-only mini say how to ask.
+			hint := ""
+			if bucket.format == s3tables.FormatIceberg && miniServesTableFormat(s3tables.FormatLance) {
+				hint = fmt.Sprintf("; name it %s:%s for the Lance namespace", bucket.name, s3tables.FormatLance)
+			}
+			glog.Warningf("not creating table bucket %s: no %s endpoint is enabled, so nothing could reach it%s", bucket.name, bucket.format, hint)
+			continue
+		}
+		servable = append(servable, bucket)
+	}
+	if len(servable) == 0 {
+		return nil, nil
 	}
 
 	filerAddress := pb.NewServerAddress(*miniIp, *miniFilerOptions.port, *miniFilerOptions.portGrpc)
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 
-	return pb.WithGrpcFilerClient(false, 0, filerAddress, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+	var ready []tableBucketEntry
+	err := pb.WithGrpcFilerClient(false, 0, filerAddress, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
 		manager := s3tables.NewManager()
 		mgrClient := s3tables.NewManagerClient(client)
-		for _, name := range names {
+		for _, bucket := range servable {
 			ctx, cancel := context.WithTimeout(miniClientsCtx(), 5*time.Second)
-			req := &s3tables.CreateTableBucketRequest{Name: name}
+			req := &s3tables.CreateTableBucketRequest{Name: bucket.name, Format: bucket.format}
 			var resp s3tables.CreateTableBucketResponse
 			err := manager.Execute(ctx, mgrClient, "CreateTableBucket", req, &resp, s3tables.DefaultAccountID)
 			cancel()
 			if err == nil {
-				glog.V(0).Infof("created table bucket %s", name)
+				glog.V(0).Infof("created %s table bucket %s", bucket.format, bucket.name)
+				ready = append(ready, bucket)
 				continue
 			}
 			var s3Err *s3tables.S3TablesError
 			if errors.As(err, &s3Err) && s3Err.Type == s3tables.ErrCodeBucketAlreadyExists {
-				glog.V(0).Infof("table bucket %s already exists", name)
+				// The name being taken says nothing about what holds it: it
+				// may be the other format, or an ordinary S3 bucket, which
+				// answers the same conflict. Only reuse what reads back as
+				// the format asked for, since the rest fails later at the
+				// client instead of here.
+				existing, readErr := existingTableBucketFormat(manager, mgrClient, bucket.name)
+				switch {
+				case readErr != nil:
+					glog.Warningf("%s already exists but does not read back as a table bucket: %v; leaving it alone", bucket.name, readErr)
+				case existing != "" && existing != bucket.format:
+					glog.Warningf("table bucket %s already exists holding %s tables, not %s; leaving it alone", bucket.name, existing, bucket.format)
+				default:
+					glog.V(0).Infof("table bucket %s already exists", bucket.name)
+					ready = append(ready, bucket)
+				}
 				continue
 			}
-			glog.Warningf("create table bucket %s: %v", name, err)
+			glog.Warningf("create table bucket %s: %v", bucket.name, err)
 		}
 		return nil
 	})
+	return ready, err
+}
+
+// icebergRoutingNames is the bare names of the buckets holding Iceberg tables,
+// which are the only ones the Iceberg catalog can take as its default warehouse.
+func icebergRoutingNames(buckets []tableBucketEntry) []string {
+	var names []string
+	for _, bucket := range buckets {
+		if bucket.format == s3tables.FormatIceberg {
+			names = append(names, bucket.name)
+		}
+	}
+	return names
+}
+
+// existingTableBucketFormat is the format the named table bucket holds. An empty
+// format with no error is a bucket predating declared formats, which accepts
+// either; an error means nothing was confirmed, an ordinary S3 bucket wearing
+// the name included.
+func existingTableBucketFormat(manager *s3tables.Manager, client *s3tables.ManagerClient, name string) (string, error) {
+	arn, err := s3tables.BuildBucketARN(s3tables.DefaultRegion, s3tables.DefaultAccountID, name)
+	if err != nil {
+		return "", err
+	}
+	ctx, cancel := context.WithTimeout(miniClientsCtx(), 5*time.Second)
+	defer cancel()
+	var resp s3tables.GetTableBucketResponse
+	if err := manager.Execute(ctx, client, "GetTableBucket", &s3tables.GetTableBucketRequest{TableBucketARN: arn}, &resp, s3tables.DefaultAccountID); err != nil {
+		return "", err
+	}
+	return resp.Format, nil
+}
+
+// miniServesTableFormat reports whether the endpoint that serves format is
+// running here: the Iceberg catalog for ICEBERG, the Lance namespace for LANCE.
+func miniServesTableFormat(format string) bool {
+	if miniEnableS3 == nil || !*miniEnableS3 {
+		return false
+	}
+	switch format {
+	case s3tables.FormatIceberg:
+		return miniS3Options.portIceberg != nil && *miniS3Options.portIceberg > 0
+	case s3tables.FormatLance:
+		return miniS3Options.portLance != nil && *miniS3Options.portLance > 0
+	}
+	return false
+}
+
+// parseTableBucketList splits a comma-separated table bucket spec into
+// deduplicated name[:FORMAT] entries, in the order given. The format is stated
+// rather than read off whichever catalog happens to be listening, so one spec
+// means one thing on every mini.
+func parseTableBucketList(spec string) []tableBucketEntry {
+	if spec == "" {
+		return nil
+	}
+	seen := make(map[string]bool)
+	var buckets []tableBucketEntry
+	for _, raw := range strings.Split(spec, ",") {
+		name, rawFormat, _ := strings.Cut(raw, ":")
+		name = strings.TrimSpace(name)
+		if name == "" || seen[name] {
+			continue
+		}
+		format := s3tables.FormatIceberg
+		if rawFormat = strings.TrimSpace(rawFormat); rawFormat != "" {
+			normalized, ok := s3tables.NormalizeFormat(rawFormat)
+			if !ok {
+				glog.Warningf("not creating table bucket %s: unsupported format %q", name, rawFormat)
+				continue
+			}
+			format = normalized
+		}
+		seen[name] = true
+		buckets = append(buckets, tableBucketEntry{name: name, format: format})
+	}
+	return buckets
 }
 
 // parseBucketList splits a comma-separated bucket spec into a deduplicated list
diff --git a/weed/command/mini_admin_auth_test.go b/weed/command/mini_admin_auth_test.go
index ce487cdd91..7eec8a3914 100644
--- a/weed/command/mini_admin_auth_test.go
+++ b/weed/command/mini_admin_auth_test.go
@@ -1,12 +1,20 @@
 package command
 
-import "testing"
+import (
+	"net"
+	"strconv"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+)
 
 // weed mini must resolve admin credentials from security.toml [admin] /
 // WEED_ADMIN_* env vars the same way the standalone `weed admin` command does.
 // This exercises the production fallback so the flag-name -> viper-key mapping
 // stays correct, in particular the read-only keys where the mini flag
 // (admin.readOnlyUser) and viper key (admin.readonly.user) differ.
+// TestApplyMiniAdminCredentialFallbackFromEnv verifies those environment
+// fallbacks without starting the full mini cluster.
 func TestApplyMiniAdminCredentialFallbackFromEnv(t *testing.T) {
 	adminUser, adminPassword, readOnlyUser, readOnlyPassword := "admin", "", "", ""
 	options := &AdminOptions{
@@ -39,3 +47,240 @@ func TestApplyMiniAdminCredentialFallbackFromEnv(t *testing.T) {
 		}
 	}
 }
+
+// TestMiniAdminBindIP covers the authentication-dependent HTTP bind policy.
+func TestMiniAdminBindIP(t *testing.T) {
+	tests := []struct {
+		name               string
+		requestedIP        string
+		passwordConfigured bool
+		mtlsConfigured     bool
+		allowInsecure      bool
+		want               string
+	}{
+		{
+			name:        "unauthenticated wildcard binds to loopback",
+			requestedIP: "0.0.0.0",
+			want:        "127.0.0.1",
+		},
+		{
+			name:        "unauthenticated IPv6 wildcard binds to loopback",
+			requestedIP: "::",
+			want:        "127.0.0.1",
+		},
+		{
+			name:        "existing loopback bind is preserved",
+			requestedIP: "127.0.0.1",
+			want:        "127.0.0.1",
+		},
+		{
+			name:               "password permits requested bind",
+			requestedIP:        "0.0.0.0",
+			passwordConfigured: true,
+			want:               "0.0.0.0",
+		},
+		{
+			name:           "mTLS permits requested bind",
+			requestedIP:    "0.0.0.0",
+			mtlsConfigured: true,
+			want:           "0.0.0.0",
+		},
+		{
+			name:          "explicit insecure opt-out permits requested bind",
+			requestedIP:   "0.0.0.0",
+			allowInsecure: true,
+			want:          "0.0.0.0",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := miniAdminBindIP(
+				tt.requestedIP,
+				tt.passwordConfigured,
+				tt.mtlsConfigured,
+				tt.allowInsecure,
+			)
+			if got != tt.want {
+				t.Fatalf("miniAdminBindIP() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// TestMiniAdminWorkerBindDefaultsToLoopback protects the worker control-plane default.
+func TestMiniAdminWorkerBindDefaultsToLoopback(t *testing.T) {
+	if miniAdminWorkerBindIP == nil {
+		t.Fatal("mini Admin worker bind flag is not initialized")
+	}
+	if got, want := *miniAdminWorkerBindIP, "127.0.0.1"; got != want {
+		t.Fatalf("default mini Admin worker bind IP = %q, want %q", got, want)
+	}
+}
+
+// TestListenMiniAdminWorkerUsesRequestedAddress verifies the production
+// listener is actually restricted to the configured loopback address.
+func TestListenMiniAdminWorkerUsesRequestedAddress(t *testing.T) {
+	listener, err := listenMiniAdminWorker("127.0.0.1", 0)
+	if err != nil {
+		t.Fatalf("listen for mini Admin worker: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = listener.Close()
+	})
+
+	address, ok := listener.Addr().(*net.TCPAddr)
+	if !ok {
+		t.Fatalf("listener address type = %T, want *net.TCPAddr", listener.Addr())
+	}
+	if !address.IP.IsLoopback() {
+		t.Fatalf("listener IP = %s, want loopback", address.IP)
+	}
+}
+
+// TestMiniAdminWorkerAddressUsesFinalGrpcPort verifies that local workers do
+// not have to discover or infer a custom Admin worker gRPC port.
+func TestMiniAdminWorkerAddressUsesFinalGrpcPort(t *testing.T) {
+	tests := []struct {
+		name     string
+		ip       string
+		want     string
+		wantGrpc string
+	}{
+		{
+			name:     "IPv4",
+			ip:       "127.0.0.1",
+			want:     "127.0.0.1:23646.34567",
+			wantGrpc: "127.0.0.1:34567",
+		},
+		{
+			name:     "IPv6",
+			ip:       "::1",
+			want:     "::1:23646.34567",
+			wantGrpc: "[::1]:34567",
+		},
+		{
+			name:     "IPv4 wildcard dials loopback",
+			ip:       "0.0.0.0",
+			want:     "127.0.0.1:23646.34567",
+			wantGrpc: "127.0.0.1:34567",
+		},
+		{
+			name:     "IPv6 wildcard dials loopback",
+			ip:       "::",
+			want:     "::1:23646.34567",
+			wantGrpc: "[::1]:34567",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			address := miniAdminWorkerAddress(tt.ip, 23646, 34567)
+			if address != tt.want {
+				t.Fatalf("miniAdminWorkerAddress() = %q, want %q", address, tt.want)
+			}
+			if got := pb.ServerToGrpcAddress(address); got != tt.wantGrpc {
+				t.Fatalf("pb.ServerToGrpcAddress() = %q, want %q", got, tt.wantGrpc)
+			}
+		})
+	}
+}
+
+// TestMiniAdminWorkerDialIP verifies wildcard listener addresses are converted
+// into valid same-family destinations without rewriting specific addresses.
+func TestMiniAdminWorkerDialIP(t *testing.T) {
+	tests := []struct {
+		bindIP string
+		want   string
+	}{
+		{bindIP: "0.0.0.0", want: "127.0.0.1"},
+		{bindIP: "::", want: "::1"},
+		{bindIP: "[::]", want: "::1"},
+		{bindIP: "192.0.2.10", want: "192.0.2.10"},
+		{bindIP: "2001:db8::10", want: "2001:db8::10"},
+		{bindIP: "worker.internal", want: "worker.internal"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.bindIP, func(t *testing.T) {
+			if got := miniAdminWorkerDialIP(tt.bindIP); got != tt.want {
+				t.Fatalf("miniAdminWorkerDialIP(%q) = %q, want %q", tt.bindIP, got, tt.want)
+			}
+		})
+	}
+}
+
+// TestMiniAdminAdvertisedIP verifies that the welcome message uses the
+// selected loopback address but replaces wildcard binds with a reachable host.
+func TestMiniAdminAdvertisedIP(t *testing.T) {
+	oldMiniIP := miniIp
+	oldAdminIP := miniAdminOptions.ip
+	t.Cleanup(func() {
+		miniIp = oldMiniIP
+		miniAdminOptions.ip = oldAdminIP
+	})
+
+	detectedIP := "192.0.2.10"
+	miniIp = &detectedIP
+
+	tests := []struct {
+		name     string
+		adminIP  string
+		expected string
+	}{
+		{
+			name:     "selected loopback",
+			adminIP:  "127.0.0.1",
+			expected: "127.0.0.1",
+		},
+		{
+			name:     "IPv4 wildcard",
+			adminIP:  "0.0.0.0",
+			expected: detectedIP,
+		},
+		{
+			name:     "IPv6 wildcard",
+			adminIP:  "::",
+			expected: detectedIP,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			adminIP := tt.adminIP
+			miniAdminOptions.ip = &adminIP
+			if got := miniAdminAdvertisedIP(); got != tt.expected {
+				t.Fatalf("miniAdminAdvertisedIP() = %q, want %q", got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestDefaultAdminGrpcPortBelowEphemeralFloor(t *testing.T) {
+	if grpcPort := defaultAdminHTTPPort + GrpcPortOffset; grpcPort >= linuxEphemeralPortFloor {
+		t.Fatalf("default admin HTTP port %d derives gRPC port %d, which must stay below ephemeral floor %d",
+			defaultAdminHTTPPort, grpcPort, linuxEphemeralPortFloor)
+	}
+	for _, f := range []struct {
+		name     string
+		flagName string
+		def      string
+	}{
+		{"mini", "admin.port", strconv.Itoa(defaultAdminHTTPPort)},
+		{"mini", "admin.port.legacy", strconv.Itoa(defaultAdminHTTPLegacyPort)},
+		{"admin", "port", strconv.Itoa(defaultAdminHTTPPort)},
+		{"admin", "port.legacy", strconv.Itoa(defaultAdminHTTPLegacyPort)},
+	} {
+		cmd := cmdMini
+		if f.name == "admin" {
+			cmd = cmdAdmin
+		}
+		flag := cmd.Flag.Lookup(f.flagName)
+		if flag == nil {
+			t.Fatalf("%s: flag %s not registered", f.name, f.flagName)
+		}
+		if flag.DefValue != f.def {
+			t.Fatalf("%s -%s default = %s, want %s so its gRPC port stays below the ephemeral floor", f.name, f.flagName, flag.DefValue, f.def)
+		}
+	}
+}
diff --git a/weed/command/mini_bucket_test.go b/weed/command/mini_bucket_test.go
index 4a2ac66db4..78cd48aaf1 100644
--- a/weed/command/mini_bucket_test.go
+++ b/weed/command/mini_bucket_test.go
@@ -3,6 +3,8 @@ package command
 import (
 	"reflect"
 	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 )
 
 func TestParseBucketList(t *testing.T) {
@@ -28,3 +30,94 @@ func TestParseBucketList(t *testing.T) {
 		})
 	}
 }
+
+func TestParseTableBucketList(t *testing.T) {
+	tests := []struct {
+		name string
+		in   string
+		want []tableBucketEntry
+	}{
+		{"empty", "", nil},
+		{"defaults to iceberg", "warehouse", []tableBucketEntry{{"warehouse", s3tables.FormatIceberg}}},
+		{"explicit format", "vectors:LANCE", []tableBucketEntry{{"vectors", s3tables.FormatLance}}},
+		{"format is case insensitive", "vectors:lance", []tableBucketEntry{{"vectors", s3tables.FormatLance}}},
+		{"mixed formats", "warehouse,vectors:LANCE", []tableBucketEntry{{"warehouse", s3tables.FormatIceberg}, {"vectors", s3tables.FormatLance}}},
+		{"trims whitespace", " warehouse , vectors : LANCE ", []tableBucketEntry{{"warehouse", s3tables.FormatIceberg}, {"vectors", s3tables.FormatLance}}},
+		{"drops unsupported format", "warehouse,vectors:DELTA", []tableBucketEntry{{"warehouse", s3tables.FormatIceberg}}},
+		{"empty format is the default", "warehouse:", []tableBucketEntry{{"warehouse", s3tables.FormatIceberg}}},
+		{"dedupes by name", "vectors:LANCE,vectors:ICEBERG", []tableBucketEntry{{"vectors", s3tables.FormatLance}}},
+		{"drops empty entries", "one,,two:LANCE,", []tableBucketEntry{{"one", s3tables.FormatIceberg}, {"two", s3tables.FormatLance}}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := parseTableBucketList(tt.in)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("parseTableBucketList(%q) = %v, want %v", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+
+// A bucket's format decides which endpoint has to be up for it, so turning one
+// catalog off must not change what the other format means.
+func TestMiniServesTableFormat(t *testing.T) {
+	icebergPort, lancePort := *miniS3Options.portIceberg, *miniS3Options.portLance
+	t.Cleanup(func() {
+		*miniS3Options.portIceberg, *miniS3Options.portLance = icebergPort, lancePort
+	})
+
+	*miniS3Options.portIceberg, *miniS3Options.portLance = 8181, 9101
+	if !miniServesTableFormat(s3tables.FormatIceberg) || !miniServesTableFormat(s3tables.FormatLance) {
+		t.Errorf("both endpoints up: want both formats served")
+	}
+
+	*miniS3Options.portIceberg = 0
+	if miniServesTableFormat(s3tables.FormatIceberg) {
+		t.Errorf("iceberg port 0: want ICEBERG unserved")
+	}
+	if !miniServesTableFormat(s3tables.FormatLance) {
+		t.Errorf("iceberg port 0: want LANCE still served")
+	}
+
+	*miniS3Options.portLance = 0
+	if miniServesTableFormat(s3tables.FormatLance) {
+		t.Errorf("lance port 0: want LANCE unserved")
+	}
+
+	if miniServesTableFormat("DELTA") {
+		t.Errorf("unknown format: want unserved")
+	}
+}
+
+// The Iceberg catalog looks its default warehouse up by name, so a Lance entry
+// or a leftover :FORMAT suffix in S3_TABLE_BUCKET names a bucket it cannot find.
+func TestIcebergRoutingNames(t *testing.T) {
+	tests := []struct {
+		name string
+		in   []tableBucketEntry
+		want []string
+	}{
+		{"none", nil, nil},
+		{"iceberg only", []tableBucketEntry{{"warehouse", s3tables.FormatIceberg}}, []string{"warehouse"}},
+		{"lance is not routable", []tableBucketEntry{{"vectors", s3tables.FormatLance}}, nil},
+		{"lance first", []tableBucketEntry{{"vectors", s3tables.FormatLance}, {"warehouse", s3tables.FormatIceberg}}, []string{"warehouse"}},
+		{"order preserved", []tableBucketEntry{{"raw", s3tables.FormatIceberg}, {"vectors", s3tables.FormatLance}, {"curated", s3tables.FormatIceberg}}, []string{"raw", "curated"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := icebergRoutingNames(tt.in)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("icebergRoutingNames(%v) = %v, want %v", tt.in, got, tt.want)
+			}
+		})
+	}
+}
+
+// A spec arriving through S3_TABLE_BUCKET carries suffixes too, and the catalog
+// reads that same variable, so parsing and routing have to agree on the name.
+func TestIcebergRoutingNamesFromEnvSpec(t *testing.T) {
+	got := icebergRoutingNames(parseTableBucketList("vectors:LANCE,warehouse"))
+	if want := []string{"warehouse"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("routing names for env spec = %v, want %v", got, want)
+	}
+}
diff --git a/weed/command/mount.go b/weed/command/mount.go
index e8945ddc85..3c81aa8cac 100644
--- a/weed/command/mount.go
+++ b/weed/command/mount.go
@@ -9,6 +9,7 @@ type MountOptions struct {
 	filer                *string
 	filerMountRootPath   *string
 	dir                  *string
+	volumeName           *string
 	dirAutoCreate        *bool
 	collection           *string
 	collectionQuota      *int
@@ -19,6 +20,8 @@ type MountOptions struct {
 	chunkSizeLimitMB     *int
 	concurrentWriters    *int
 	concurrentReaders    *int
+	readerCacheSizeMB    *int64
+	memoryLimitMB        *int64
 	cacheMetaTtlSec      *int
 	cacheDirMaxEntries   *int
 	cacheDirForRead      *string
@@ -48,14 +51,6 @@ type MountOptions struct {
 	// Periodic metadata flush to protect against orphan chunk cleanup
 	metadataFlushSeconds *int
 
-	// RDMA acceleration options
-	rdmaEnabled       *bool
-	rdmaSidecarAddr   *string
-	rdmaFallback      *bool
-	rdmaReadOnly      *bool
-	rdmaMaxConcurrent *int
-	rdmaTimeoutMs     *int
-
 	// Peer chunk sharing options (design-weed-mount-peer-chunk-sharing.md).
 	peerEnabled    *bool
 	peerListen     *string
@@ -100,6 +95,7 @@ func init() {
 	mountOptions.filer = cmdMount.Flag.String("filer", "localhost:8888", "comma-separated weed filer location")
 	mountOptions.filerMountRootPath = cmdMount.Flag.String("filer.path", "/", "mount this remote path from filer server")
 	mountOptions.dir = cmdMount.Flag.String("dir", ".", "mount weed filer to this directory")
+	mountOptions.volumeName = cmdMount.Flag.String("volumeName", "", "name the mount shown by the platform (Finder/Explorer, or \"mount\"/\"df\" on Linux and FreeBSD), overriding the name taken from -filer.path or -dir")
 	mountOptions.dirAutoCreate = cmdMount.Flag.Bool("dirAutoCreate", false, "auto create the directory to mount to")
 	mountOptions.collection = cmdMount.Flag.String("collection", "", "collection to create the files")
 	mountOptions.collectionQuota = cmdMount.Flag.Int("collectionQuotaMB", 0, "quota for the collection")
@@ -110,12 +106,14 @@ func init() {
 	mountOptions.chunkSizeLimitMB = cmdMount.Flag.Int("chunkSizeLimitMB", 2, "local write buffer size, also chunk large files")
 	mountOptions.concurrentWriters = cmdMount.Flag.Int("concurrentWriters", 128, "limit concurrent goroutine writers")
 	mountOptions.concurrentReaders = cmdMount.Flag.Int("concurrentReaders", 128, "limit concurrent chunk fetches for read operations")
+	mountOptions.memoryLimitMB = cmdMount.Flag.Int64("memoryLimitMB", 0, "soft Go runtime memory limit in MiB; 0 preserves GOMEMLIMIT; leave headroom below the container limit")
+	mountOptions.readerCacheSizeMB = cmdMount.Flag.Int64("readerCacheSizeMB", 256, "memory budget in MiB for downloaded and in-flight reader buffers across all files; must fit the largest pooled chunk buffer")
 	mountOptions.cacheDirForRead = cmdMount.Flag.String("cacheDir", os.TempDir(), "local cache directory for file chunks and meta data")
 	mountOptions.cacheSizeMBForRead = cmdMount.Flag.Int64("cacheCapacityMB", 128, "file chunk read cache capacity in MB")
 	mountOptions.cacheDirForWrite = cmdMount.Flag.String("cacheDirWrite", "", "buffer writes mostly for large files")
 	mountOptions.writeBufferSizeMB = cmdMount.Flag.Int64("writeBufferSizeMB", 0, "global cap on the per-mount write buffer (memory + swap) in MB, 0 means unlimited. Bounds /tmp growth when volume uploads stall")
 	mountOptions.cacheMetaTtlSec = cmdMount.Flag.Int("cacheMetaTtlSec", 60, "metadata cache validity seconds")
-	mountOptions.cacheDirMaxEntries = cmdMount.Flag.Int("cacheDirMaxEntries", 10000, "a directory with more children than this is not cached locally but read directly from the filer; 0 caches everything")
+	mountOptions.cacheDirMaxEntries = cmdMount.Flag.Int("cacheDirMaxEntries", 100000, "a directory with more children than this is not cached locally but read directly from the filer; 0 caches everything")
 	mountOptions.dataCenter = cmdMount.Flag.String("dataCenter", "", "prefer to write to the data center")
 	mountOptions.allowOthers = cmdMount.Flag.Bool("allowOthers", true, "allows other users to access the file system")
 	mountOptions.defaultPermissions = cmdMount.Flag.Bool("defaultPermissions", true, "enforce permissions by the operating system")
@@ -139,14 +137,6 @@ func init() {
 	// Periodic metadata flush to protect against orphan chunk cleanup
 	mountOptions.metadataFlushSeconds = cmdMount.Flag.Int("metadataFlushSeconds", 120, "periodically flush file metadata to filer in seconds (0 to disable). This protects chunks from being purged by volume.fsck for long-running writes")
 
-	// RDMA acceleration flags
-	mountOptions.rdmaEnabled = cmdMount.Flag.Bool("rdma.enabled", false, "enable RDMA acceleration for reads")
-	mountOptions.rdmaSidecarAddr = cmdMount.Flag.String("rdma.sidecar", "", "RDMA sidecar address (e.g., localhost:8081)")
-	mountOptions.rdmaFallback = cmdMount.Flag.Bool("rdma.fallback", true, "fallback to HTTP when RDMA fails")
-	mountOptions.rdmaReadOnly = cmdMount.Flag.Bool("rdma.readOnly", false, "use RDMA for reads only (writes use HTTP)")
-	mountOptions.rdmaMaxConcurrent = cmdMount.Flag.Int("rdma.maxConcurrent", 64, "max concurrent RDMA operations")
-	mountOptions.rdmaTimeoutMs = cmdMount.Flag.Int("rdma.timeoutMs", 5000, "RDMA operation timeout in milliseconds")
-
 	// Peer chunk sharing flags.
 	mountOptions.peerEnabled = cmdMount.Flag.Bool("peer.enable", false, "opt in to peer chunk sharing — mount serves its chunk cache to other mounts and fetches from peers instead of volume servers when available")
 	mountOptions.peerListen = cmdMount.Flag.String("peer.listen", ":18080", "bind address for peer gRPC (directory RPCs + FetchChunk streaming)")
@@ -192,18 +182,20 @@ var cmdMount = &Command{
 
   On OS X, it requires OSXFUSE (https://osxfuse.github.io/).
 
-  RDMA Acceleration:
-  For ultra-fast reads, enable RDMA acceleration with an RDMA sidecar:
-    weed mount -filer=localhost:8888 -dir=/mnt/seaweedfs \
-      -rdma.enabled=true -rdma.sidecar=localhost:8081
+  On Windows, it requires WinFsp (https://winfsp.dev/). The mount point can be
+  a drive letter (-dir=S:), a directory that does not exist yet, or a network
+  path (-dir=\\seaweedfs\share). A drive letter belongs to the logon session
+  that created it, so one mounted by a service is usually invisible to users
+  at the desktop; the network path form is reachable from every session, and
+  each user can map their own drive letter to it.
 
-  RDMA Options:
-    -rdma.enabled=false          Enable RDMA acceleration for reads
-    -rdma.sidecar=""             RDMA sidecar address (required if enabled)
-    -rdma.fallback=true          Fallback to HTTP when RDMA fails
-    -rdma.readOnly=false         Use RDMA for reads only (writes use HTTP)
-    -rdma.maxConcurrent=64       Max concurrent RDMA operations
-    -rdma.timeoutMs=5000         RDMA operation timeout in milliseconds
+  Where the platform labels the disk, in Finder and in Explorer, the mounted
+  path names it: -filer.path="/Image Disk" shows up as "Image Disk". Mounting
+  the whole tree takes the name from the mount point instead, so
+  -dir=\\seaweedfs\Images labels the disk "Images" while still mounting
+  everything, and only a bare drive letter falls back to the filer address.
+  -volumeName overrides whatever name either of those would otherwise give it,
+  including what Linux and FreeBSD show for the mount in "mount" and "df".
 
   `,
 }
diff --git a/weed/command/mount_common.go b/weed/command/mount_common.go
index 8b682bf0b8..bbabe56ac8 100644
--- a/weed/command/mount_common.go
+++ b/weed/command/mount_common.go
@@ -5,17 +5,21 @@ package command
 import (
 	"context"
 	"fmt"
+	"math"
 	"net"
 	"net/http"
 	"os"
 	"path"
 	"runtime"
+	"runtime/debug"
 	"strconv"
 	"strings"
 	"time"
 
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/reflection"
+	"google.golang.org/grpc/status"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/mount"
@@ -65,36 +69,46 @@ func ensureBucketAllowEmptyFolders(ctx context.Context, filerClient filer_pb.Fil
 		return nil
 	}
 
-	entry, _, _, err := filer_pb.GetEntry(ctx, filerClient, util.FullPath(bucketPath))
-	if err != nil {
-		return err
-	}
-	if entry == nil {
-		return fmt.Errorf("bucket %s not found", bucketPath)
-	}
-
-	if entry.Extended == nil {
-		entry.Extended = make(map[string][]byte)
-	}
-	if strings.EqualFold(strings.TrimSpace(string(entry.Extended[s3_constants.ExtAllowEmptyFolders])), "true") {
-		return nil
-	}
-
-	entry.Extended[s3_constants.ExtAllowEmptyFolders] = []byte("true")
-
 	bucketFullPath := util.FullPath(bucketPath)
 	parent, _ := bucketFullPath.DirAndName()
-	if err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		return filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
-			Directory: parent,
-			Entry:     entry,
+
+	for attempt := 0; attempt < 5; attempt++ {
+		entry, _, _, err := filer_pb.GetEntry(ctx, filerClient, util.FullPath(bucketPath))
+		if err != nil {
+			return err
+		}
+		if entry == nil {
+			return fmt.Errorf("bucket %s not found", bucketPath)
+		}
+
+		if value := strings.TrimSpace(string(entry.Extended[s3_constants.ExtAllowEmptyFolders])); value != "" {
+			return nil
+		}
+
+		expected := filer_pb.SnapshotExtended(entry.Extended, s3_constants.ExtAllowEmptyFolders)
+		if entry.Extended == nil {
+			entry.Extended = make(map[string][]byte)
+		}
+		entry.Extended[s3_constants.ExtAllowEmptyFolders] = []byte("true")
+
+		err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+			_, err := client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{
+				Directory:        parent,
+				Entry:            entry,
+				ExpectedExtended: expected,
+			})
+			return err
 		})
-	}); err != nil {
-		return err
+		if err == nil {
+			glog.V(3).Infof("RunMount: set bucket %s %s=true", bucketPath, s3_constants.ExtAllowEmptyFolders)
+			return nil
+		}
+		if status.Code(err) != codes.FailedPrecondition {
+			return err
+		}
 	}
 
-	glog.V(3).Infof("RunMount: set bucket %s %s=true", bucketPath, s3_constants.ExtAllowEmptyFolders)
-	return nil
+	return fmt.Errorf("bucket %s attributes keep changing", bucketPath)
 }
 
 func bucketPathForMountRoot(mountRoot, bucketRootPath string) (string, bool) {
@@ -175,9 +189,19 @@ type fileSystemParams struct {
 	chunkSizeLimitMB int
 	cacheDirForRead  string
 	cacheDirForWrite string
+
+	// eagerFilerCreate persists a created file's entry at create time rather
+	// than at flush. A platform sets it when it cannot run the flush before
+	// the application's close returns, so nothing that reads through the
+	// filer can race an unflushed close.
+	eagerFilerCreate bool
 }
 
 func buildSeaweedFileSystem(option *MountOptions, p fileSystemParams) *mount.WFS {
+	readerCacheSizeMB := int64(256)
+	if option.readerCacheSizeMB != nil {
+		readerCacheSizeMB = *option.readerCacheSizeMB
+	}
 	return mount.NewSeaweedFileSystem(&mount.Option{
 		MountDirectory:              p.dir,
 		FilerAddresses:              p.filerAddresses,
@@ -192,6 +216,7 @@ func buildSeaweedFileSystem(option *MountOptions, p fileSystemParams) *mount.WFS
 		ChunkSizeLimit:              int64(p.chunkSizeLimitMB) * 1024 * 1024,
 		ConcurrentWriters:           *option.concurrentWriters,
 		ConcurrentReaders:           *option.concurrentReaders,
+		ReaderCacheSizeMB:           readerCacheSizeMB,
 		CacheDirForRead:             p.cacheDirForRead,
 		CacheSizeMBForRead:          *option.cacheSizeMBForRead,
 		CacheDirForWrite:            p.cacheDirForWrite,
@@ -215,17 +240,11 @@ func buildSeaweedFileSystem(option *MountOptions, p fileSystemParams) *mount.WFS
 		DisableXAttr:                *option.disableXAttr,
 		IsMacOs:                     runtime.GOOS == "darwin",
 		MetadataFlushSeconds:        *option.metadataFlushSeconds,
-		// RDMA acceleration options
-		RdmaEnabled:           *option.rdmaEnabled,
-		RdmaSidecarAddr:       *option.rdmaSidecarAddr,
-		RdmaFallback:          *option.rdmaFallback,
-		RdmaReadOnly:          *option.rdmaReadOnly,
-		RdmaMaxConcurrent:     *option.rdmaMaxConcurrent,
-		RdmaTimeoutMs:         *option.rdmaTimeoutMs,
-		DirIdleEvictSec:       *option.dirIdleEvictSec,
-		EnableDistributedLock: option.distributedLock != nil && *option.distributedLock,
-		WritebackCache:        option.writebackCache != nil && *option.writebackCache,
-		PosixDirNlink:         option.posixDirNlink != nil && *option.posixDirNlink,
+		DirIdleEvictSec:             *option.dirIdleEvictSec,
+		EnableDistributedLock:       option.distributedLock != nil && *option.distributedLock,
+		WritebackCache:              option.writebackCache != nil && *option.writebackCache,
+		EagerFilerCreate:            p.eagerFilerCreate,
+		PosixDirNlink:               option.posixDirNlink != nil && *option.posixDirNlink,
 		// Peer chunk sharing
 		PeerEnabled:    option.peerEnabled != nil && *option.peerEnabled,
 		PeerListen:     peerStringOrEmpty(option.peerListen),
@@ -276,3 +295,46 @@ func resolveCacheDirs(option *MountOptions) (string, string) {
 	}
 	return cacheDirForRead, cacheDirForWrite
 }
+
+// volumeName labels the mount where the platform shows one, in Finder and in
+// Explorer. An explicit override always wins; failing that, the mounted path
+// names the disk, then the mount point; the filer address, which every mount
+// from one filer shares, is the last resort.
+func volumeName(filer, filerMountRootPath, dir, override string) string {
+	name := override
+	if name == "" {
+		name = lastSegment(filerMountRootPath)
+	}
+	if name == "" {
+		name = lastSegment(dir)
+	}
+	if name == "" {
+		name = filer
+	}
+	return strings.ReplaceAll(name, ",", "+")
+}
+
+// lastSegment is the name a path ends with, and "" for the ones that name no
+// disk: the root, "." and a bare Windows drive letter.
+func lastSegment(p string) string {
+	name := path.Base(strings.ReplaceAll(p, `\`, "/"))
+	if name == "/" || name == "." || strings.HasSuffix(name, ":") {
+		return ""
+	}
+	return name
+}
+
+func configureMountMemory(option *MountOptions) error {
+	if option.readerCacheSizeMB != nil && (*option.readerCacheSizeMB <= 0 || *option.readerCacheSizeMB > math.MaxInt64>>20) {
+		return fmt.Errorf("readerCacheSizeMB must be positive and fit in an int64 byte budget")
+	}
+	if option.memoryLimitMB != nil {
+		if *option.memoryLimitMB < 0 || *option.memoryLimitMB > math.MaxInt64>>20 {
+			return fmt.Errorf("memoryLimitMB must be non-negative and fit in an int64 byte limit")
+		}
+		if *option.memoryLimitMB > 0 {
+			debug.SetMemoryLimit(*option.memoryLimitMB << 20)
+		}
+	}
+	return nil
+}
diff --git a/weed/command/mount_common_test.go b/weed/command/mount_common_test.go
new file mode 100644
index 0000000000..48878cca53
--- /dev/null
+++ b/weed/command/mount_common_test.go
@@ -0,0 +1,215 @@
+//go:build linux || darwin || freebsd || windows
+
+package command
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+func Test_volumeName(t *testing.T) {
+	tests := []struct {
+		name               string
+		filer              string
+		filerMountRootPath string
+		dir                string
+		override           string
+		expected           string
+	}{
+		{
+			name:               "an override outranks the mounted path and the mount point",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/buckets/videos",
+			dir:                `\\seaweedfs\Images`,
+			override:           "MyDisk",
+			expected:           "MyDisk",
+		},
+		{
+			name:               "an override still gets commas replaced",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/",
+			override:           "My, Disk",
+			expected:           "My+ Disk",
+		},
+		{
+			name:               "a drive letter leaves only the filer to fall back on",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/",
+			dir:                "S:",
+			expected:           "127.0.0.1:8888",
+		},
+		{
+			name:               "empty path falls back to the filer",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "",
+			expected:           "127.0.0.1:8888",
+		},
+		{
+			name:               "several filers stay parseable as one option",
+			filer:              "127.0.0.1:8888,127.0.0.1:8889",
+			filerMountRootPath: "/",
+			expected:           "127.0.0.1:8888+127.0.0.1:8889",
+		},
+		{
+			name:               "a whole-tree mount takes the name of its network share",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/",
+			dir:                `\\seaweedfs\Images`,
+			expected:           "Images",
+		},
+		{
+			name:               "a whole-tree mount takes the name of its directory",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/",
+			dir:                "/mnt/seaweedfs",
+			expected:           "seaweedfs",
+		},
+		{
+			name:               "the mounted path outranks the mount point",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/buckets/videos",
+			dir:                "/mnt/seaweedfs",
+			expected:           "videos",
+		},
+		{
+			name:               "a relative mount point is not a name",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/",
+			dir:                ".",
+			expected:           "127.0.0.1:8888",
+		},
+		{
+			name:               "mounted directory names the disk",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/buckets/images",
+			expected:           "images",
+		},
+		{
+			name:               "trailing slash is not a name",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/buckets/videos/",
+			expected:           "videos",
+		},
+		{
+			name:               "spaces are kept, commas are not",
+			filer:              "127.0.0.1:8888",
+			filerMountRootPath: "/Image, Disk",
+			expected:           "Image+ Disk",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := volumeName(tt.filer, tt.filerMountRootPath, tt.dir, tt.override); got != tt.expected {
+				t.Errorf("volumeName(%q, %q, %q, %q) = %q, want %q", tt.filer, tt.filerMountRootPath, tt.dir, tt.override, got, tt.expected)
+			}
+		})
+	}
+}
+
+type allowEmptyFoldersInnerClient struct {
+	filer_pb.SeaweedFilerClient
+	entry          *filer_pb.Entry
+	beforeUpdate   func()
+	lookups        int
+	updateAttempts int
+	updates        []*filer_pb.Entry
+}
+
+func (c *allowEmptyFoldersInnerClient) LookupDirectoryEntry(_ context.Context, _ *filer_pb.LookupDirectoryEntryRequest, _ ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	c.lookups++
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: proto.Clone(c.entry).(*filer_pb.Entry)}, nil
+}
+
+func (c *allowEmptyFoldersInnerClient) UpdateEntry(_ context.Context, in *filer_pb.UpdateEntryRequest, _ ...grpc.CallOption) (*filer_pb.UpdateEntryResponse, error) {
+	c.updateAttempts++
+	if c.beforeUpdate != nil {
+		c.beforeUpdate()
+	}
+	for key, expected := range in.ExpectedExtended {
+		actual, found := c.entry.Extended[key]
+		if found && !bytes.Equal(actual, expected) || !found && len(expected) > 0 {
+			return nil, status.Error(codes.FailedPrecondition, "extended attribute changed")
+		}
+	}
+	c.entry = proto.Clone(in.Entry).(*filer_pb.Entry)
+	c.updates = append(c.updates, in.Entry)
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+type allowEmptyFoldersFilerClient struct {
+	inner *allowEmptyFoldersInnerClient
+}
+
+func (c *allowEmptyFoldersFilerClient) WithFilerClient(_ bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return fn(c.inner)
+}
+func (c *allowEmptyFoldersFilerClient) AdjustedUrl(_ *filer_pb.Location) string { return "" }
+func (c *allowEmptyFoldersFilerClient) GetDataCenter() string                   { return "" }
+
+func Test_ensureBucketAllowEmptyFolders(t *testing.T) {
+	bucketEntry := func(attrValue string) *filer_pb.Entry {
+		entry := &filer_pb.Entry{Name: "b1", IsDirectory: true, Extended: map[string][]byte{}}
+		if attrValue != "" {
+			entry.Extended[s3_constants.ExtAllowEmptyFolders] = []byte(attrValue)
+		}
+		return entry
+	}
+
+	tests := []struct {
+		name          string
+		mountRoot     string
+		attrValue     string
+		beforeUpdate  func(inner *allowEmptyFoldersInnerClient)
+		wantLookups   int
+		wantUpdates   int
+		wantAttrValue string
+	}{
+		{name: "no policy allows empty folders", mountRoot: "/buckets/b1", wantLookups: 1, wantUpdates: 1, wantAttrValue: "true"},
+		{name: "explicit true is kept", mountRoot: "/buckets/b1", attrValue: "true", wantLookups: 1, wantUpdates: 0},
+		{name: "explicit false is kept", mountRoot: "/buckets/b1", attrValue: "false", wantLookups: 1, wantUpdates: 0},
+		{name: "subdirectory mount leaves the bucket alone", mountRoot: "/buckets/b1/sub", wantLookups: 0, wantUpdates: 0},
+		{
+			name:      "a concurrent false wins over the mount default",
+			mountRoot: "/buckets/b1",
+			beforeUpdate: func(inner *allowEmptyFoldersInnerClient) {
+				inner.entry.Extended[s3_constants.ExtAllowEmptyFolders] = []byte("false")
+			},
+			wantLookups:   2,
+			wantUpdates:   0,
+			wantAttrValue: "false",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			inner := &allowEmptyFoldersInnerClient{entry: bucketEntry(tt.attrValue)}
+			if tt.beforeUpdate != nil {
+				inner.beforeUpdate = func() { tt.beforeUpdate(inner) }
+			}
+			filerClient := &allowEmptyFoldersFilerClient{inner: inner}
+
+			if err := ensureBucketAllowEmptyFolders(context.Background(), filerClient, tt.mountRoot, "/buckets"); err != nil {
+				t.Fatalf("ensureBucketAllowEmptyFolders: %v", err)
+			}
+			if inner.lookups != tt.wantLookups {
+				t.Errorf("lookups = %d, want %d", inner.lookups, tt.wantLookups)
+			}
+			if len(inner.updates) != tt.wantUpdates {
+				t.Fatalf("updates = %d, want %d", len(inner.updates), tt.wantUpdates)
+			}
+			if tt.wantAttrValue != "" {
+				got := string(inner.entry.Extended[s3_constants.ExtAllowEmptyFolders])
+				if got != tt.wantAttrValue {
+					t.Errorf("%s = %q, want %q", s3_constants.ExtAllowEmptyFolders, got, tt.wantAttrValue)
+				}
+			}
+		})
+	}
+}
diff --git a/weed/command/mount_memory_test.go b/weed/command/mount_memory_test.go
new file mode 100644
index 0000000000..949112da78
--- /dev/null
+++ b/weed/command/mount_memory_test.go
@@ -0,0 +1,39 @@
+//go:build linux || darwin || freebsd || windows
+
+package command
+
+import (
+	"math"
+	"runtime/debug"
+	"testing"
+)
+
+func TestConfigureMountMemory(t *testing.T) {
+	for _, size := range []int64{-1, 0, 1, 256, math.MaxInt64 >> 20, math.MaxInt64} {
+		err := configureMountMemory(&MountOptions{readerCacheSizeMB: &size})
+		valid := size > 0 && size <= math.MaxInt64>>20
+		if (err == nil) != valid {
+			t.Errorf("size=%d: err=%v", size, err)
+		}
+	}
+}
+
+func TestConfigureMountMemoryRuntimeLimit(t *testing.T) {
+	previous := debug.SetMemoryLimit(512 << 20)
+	defer debug.SetMemoryLimit(previous)
+	for _, size := range []int64{0, -1, math.MaxInt64, 768, 0} {
+		before := debug.SetMemoryLimit(-1)
+		err := configureMountMemory(&MountOptions{memoryLimitMB: &size})
+		valid := size >= 0 && size <= math.MaxInt64>>20
+		if (err == nil) != valid {
+			t.Errorf("size=%d: err=%v", size, err)
+		}
+		want := before
+		if valid && size > 0 {
+			want = size << 20
+		}
+		if got := debug.SetMemoryLimit(-1); got != want {
+			t.Errorf("size=%d: runtime limit=%d, want %d", size, got, want)
+		}
+	}
+}
diff --git a/weed/command/mount_std.go b/weed/command/mount_std.go
index b352aea955..b047443c13 100644
--- a/weed/command/mount_std.go
+++ b/weed/command/mount_std.go
@@ -24,6 +24,10 @@ import (
 )
 
 func RunMount(option *MountOptions, umask os.FileMode) bool {
+	if err := configureMountMemory(option); err != nil {
+		fmt.Println(err)
+		return false
+	}
 
 	// basic checks
 	chunkSizeLimitMB := *mountOptions.chunkSizeLimitMB
@@ -118,6 +122,9 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 	// When autofs/systemd-mount is used, FsName must be "fuse" so util-linux/mount can recognize
 	// it as a pseudo filesystem. Otherwise, preserve the descriptive name for mount/df output.
 	fsName := serverFriendlyName + ":" + filerMountRootPath
+	if *option.volumeName != "" {
+		fsName = *option.volumeName
+	}
 	if skipAutofs {
 		fsName = "fuse"
 	}
@@ -134,7 +141,6 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 	// mount fuse
 	fuseMountOptions := &fuse.MountOptions{
 		AllowOther:               *option.allowOthers,
-		Options:                  option.extraOptions,
 		MaxBackground:            maxBackground,
 		CongestionThreshold:      congestionThreshold,
 		MaxWrite:                 1024 * 1024 * 2,
@@ -180,9 +186,12 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 			fuseMountOptions.Options = append(fuseMountOptions.Options, "novncache")
 		}
 		fuseMountOptions.Options = append(fuseMountOptions.Options, "slow_statfs")
-		fuseMountOptions.Options = append(fuseMountOptions.Options, "volname="+serverFriendlyName)
+		fuseMountOptions.Options = append(fuseMountOptions.Options, "volname="+volumeName(*option.filer, filerMountRootPath, dir, *option.volumeName))
 		fuseMountOptions.Options = append(fuseMountOptions.Options, fmt.Sprintf("iosize=%d", ioSizeMB*1024*1024))
 	}
+	// Last, so an option given on the command line wins over the default
+	// this mount picked for it.
+	fuseMountOptions.Options = append(fuseMountOptions.Options, option.extraOptions...)
 
 	if option.writebackCache != nil {
 		fuseMountOptions.EnableWriteback = *option.writebackCache
diff --git a/weed/command/mount_windows.go b/weed/command/mount_windows.go
index 49f78e133a..9cf4d0afff 100644
--- a/weed/command/mount_windows.go
+++ b/weed/command/mount_windows.go
@@ -23,12 +23,18 @@ import (
 // every other client would read the entry as owned by uid 4294967295.
 const ownedByMounter = ^uint32(0)
 
-// windowsAttrTimeoutSec bounds how long WinFsp may serve cached attributes.
-// Nothing invalidates that cache from this side, so it stays short rather than
-// borrowing an unrelated flag's value.
-const windowsAttrTimeoutSec = 1.0
+// windowsCacheTimeout bounds how long the adapter serves cached paths and
+// attributes and WinFsp serves cached directory listings, matching what the
+// kernel caches would be allowed on a unix mount. Metadata events purge
+// entries earlier; this is the backstop for anything an event misses.
+const windowsCacheTimeout = time.Second
 
 func RunMount(option *MountOptions, umask os.FileMode) bool {
+	if err := configureMountMemory(option); err != nil {
+		fmt.Println(err)
+		return false
+	}
+
 	chunkSizeLimitMB := *mountOptions.chunkSizeLimitMB
 	if chunkSizeLimitMB <= 0 {
 		fmt.Printf("Please specify a reasonable buffer size.\n")
@@ -92,6 +98,10 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 		chunkSizeLimitMB: chunkSizeLimitMB,
 		cacheDirForRead:  cacheDirForRead,
 		cacheDirForWrite: cacheDirForWrite,
+		// WinFsp posts the cleanup and close that carry the flush after
+		// CloseHandle has already returned, so entry creation cannot wait
+		// for the flush the way it does when close(2) runs it synchronously.
+		eagerFilerCreate: true,
 	})
 
 	if !createMountRoot(seaweedFileSystem, mountRoot, bucketRootPath, filerAddresses) {
@@ -99,10 +109,10 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 	}
 
 	host := winfsp.New(seaweedFileSystem, winfsp.Options{
-		VolumeName:   strings.ReplaceAll(*option.filer, ",", "+"),
+		VolumeName:   volumeName(*option.filer, *option.filerMountRootPath, dir, *option.volumeName),
 		Uid:          ownedByMounter,
 		Gid:          ownedByMounter,
-		AttrTimeout:  windowsAttrTimeoutSec,
+		CacheTimeout: windowsCacheTimeout,
 		ReadOnly:     *option.readOnly,
 		Debug:        *option.debugFuse,
 		ExtraOptions: option.extraOptions,
@@ -131,6 +141,9 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 	glog.V(0).Infof("mounting %s%s to %v", *option.filer, mountRoot, dir)
 	glog.V(0).Infof("This is SeaweedFS version %s %s %s", version.Version(), runtime.GOOS, runtime.GOARCH)
 	glog.V(0).Infof("Windows mount is beta: hard links are unavailable and byte-range locks are not shared across mounts")
+	if prefix, _ := winfsp.VolumePrefix(dir); prefix != "" {
+		glog.V(0).Infof(`network mount: every session on this machine can open \%s or map a drive letter to it`, prefix)
+	}
 
 	if err := host.Serve(windowsMountPoint(dir)); err != nil {
 		glog.Errorf("%v", err)
@@ -152,6 +165,9 @@ func checkWindowsMountPoint(dir string) error {
 		}
 		return nil
 	}
+	if prefix, err := winfsp.VolumePrefix(dir); err != nil || prefix != "" {
+		return err
+	}
 	if strings.HasPrefix(dir, `\\`) {
 		return nil
 	}
diff --git a/weed/command/s3.go b/weed/command/s3.go
index e57d33de8a..e2d377c64e 100644
--- a/weed/command/s3.go
+++ b/weed/command/s3.go
@@ -6,12 +6,12 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io/ioutil"
-	"net"
 	"net/http"
 	"os"
 	"runtime"
 	"strconv"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/gorilla/mux"
@@ -24,7 +24,9 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/iceberg"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/lance"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/util"
@@ -48,6 +50,9 @@ type S3Options struct {
 	portHttps                 *int
 	portGrpc                  *int
 	portIceberg               *int
+	portLance                 *int
+	icebergCredentialRole     *string
+	icebergCredentialDuration *int
 	config                    *string
 	iamConfig                 *string
 	domainName                *string
@@ -59,6 +64,7 @@ type S3Options struct {
 	metricsHttpPort           *int
 	metricsHttpIp             *string
 	allowDeleteBucketNotEmpty *bool
+	autoCreateBucket          *bool
 	auditLogConfig            *string
 	localFilerSocket          *string
 	dataCenter                *string
@@ -74,11 +80,23 @@ type S3Options struct {
 	externalUrl               *string
 	defaultFileMode           *string
 	cacheSizeMB               *int64
-	// shutdownCtx, when non-nil, tells startS3Server/startIcebergServer to
-	// gracefully shut down their HTTP/gRPC servers once the ctx is cancelled.
-	// Used by weed mini to orchestrate an ordered shutdown; nil for standalone
-	// weed s3.
+	readerCacheSizeMB         *int64
+
+	allowUntrustedRemoteEndpoints *bool
+	allowBackslashInKey           *bool
+	iamSelfServiceRequiresGrant   *bool
+	// shutdownCtx, when non-nil, tells startS3Server to gracefully shut down
+	// its HTTP/gRPC servers once the ctx is cancelled, in addition to on
+	// interrupt. Used by weed mini to orchestrate an ordered shutdown.
 	shutdownCtx context.Context
+
+	// icebergBound/lanceBound record whether the auxiliary catalog listeners
+	// bound their ports. The aux binds happen before the S3 listener serves,
+	// so once the S3 port answers these are final; mini reads them to probe
+	// and advertise only catalogs that are actually running instead of
+	// whatever process may hold the configured port.
+	icebergBound atomic.Bool
+	lanceBound   atomic.Bool
 }
 
 func init() {
@@ -90,6 +108,9 @@ func init() {
 	s3StandaloneOptions.portHttps = cmdS3.Flag.Int("port.https", 0, "s3 server https listen port")
 	s3StandaloneOptions.portGrpc = cmdS3.Flag.Int("port.grpc", 0, "s3 server grpc listen port")
 	s3StandaloneOptions.portIceberg = cmdS3.Flag.Int("port.iceberg", 8181, "Iceberg REST Catalog server listen port (0 to disable)")
+	s3StandaloneOptions.portLance = cmdS3.Flag.Int("port.lance", 9101, "Lance Namespace server listen port (0 to disable); credential vending uses -iceberg.credentialRole")
+	s3StandaloneOptions.icebergCredentialRole = cmdS3.Flag.String("iceberg.credentialRole", "", "IAM role ARN the Iceberg catalog assumes to vend table-scoped credentials (empty disables vending)")
+	s3StandaloneOptions.icebergCredentialDuration = cmdS3.Flag.Int("iceberg.credentialDurationSeconds", 3600, "lifetime of credentials vended by the Iceberg catalog")
 	s3StandaloneOptions.domainName = cmdS3.Flag.String("domainName", "", "suffix of the host name in comma separated list, {bucket}.{domainName}")
 	s3StandaloneOptions.allowedOrigins = cmdS3.Flag.String("allowedOrigins", "*", "comma separated list of allowed origins")
 	s3StandaloneOptions.dataCenter = cmdS3.Flag.String("dataCenter", "", "prefer to read and write to volumes in this data center")
@@ -103,7 +124,8 @@ func init() {
 	s3StandaloneOptions.metricsHttpPort = cmdS3.Flag.Int("metricsPort", 0, "Prometheus metrics listen port")
 	s3StandaloneOptions.metricsHttpIp = cmdS3.Flag.String("metricsIp", "", "metrics listen ip. If empty, default to same as -ip.bind option.")
 	cmdS3.Flag.Bool("allowEmptyFolder", true, "deprecated, ignored. Empty folder cleanup is now automatic.")
-	s3StandaloneOptions.allowDeleteBucketNotEmpty = cmdS3.Flag.Bool("allowDeleteBucketNotEmpty", true, "allow recursive deleting all entries along with bucket")
+	s3StandaloneOptions.allowDeleteBucketNotEmpty = cmdS3.Flag.Bool("allowDeleteBucketNotEmpty", false, "allow recursive deleting all entries along with bucket")
+	s3StandaloneOptions.autoCreateBucket = cmdS3.Flag.Bool("autoCreateBucket", true, "create the bucket on upload if it does not exist, for admin identities only")
 	s3StandaloneOptions.localFilerSocket = cmdS3.Flag.String("localFilerSocket", "", "local filer socket path")
 	s3StandaloneOptions.localSocket = cmdS3.Flag.String("localSocket", "", "default to /tmp/seaweedfs-s3-<port>.sock")
 	s3StandaloneOptions.idleTimeout = cmdS3.Flag.Int("idleTimeout", 120, "connection idle seconds")
@@ -114,9 +136,13 @@ func init() {
 	s3StandaloneOptions.debug = cmdS3.Flag.Bool("debug", false, "serves runtime profiling data via pprof on the port specified by -debug.port")
 	s3StandaloneOptions.debugPort = cmdS3.Flag.Int("debug.port", 6060, "http port for debugging")
 	s3StandaloneOptions.cipher = cmdS3.Flag.Bool("encryptVolumeData", false, "encrypt data on volume servers")
-	s3StandaloneOptions.externalUrl = cmdS3.Flag.String("externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Used for S3 signature verification behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
+	s3StandaloneOptions.externalUrl = cmdS3.Flag.String("externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Advertised to Iceberg and Lance clients, and tried first when verifying S3 signatures behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
 	s3StandaloneOptions.defaultFileMode = cmdS3.Flag.String("defaultFileMode", "", "default file mode for S3 uploaded objects, e.g. 0660, 0644, 0666")
 	s3StandaloneOptions.cacheSizeMB = cmdS3.Flag.Int64("cacheCapacityMB", 0, "in-memory chunk cache capacity in MB for S3 GETs shared across requests (0 disables)")
+	s3StandaloneOptions.readerCacheSizeMB = cmdS3.Flag.Int64("readerCacheSizeMB", 0, "memory budget in MiB for downloaded and in-flight reader buffers across all S3 GETs (0 means unlimited)")
+	s3StandaloneOptions.allowUntrustedRemoteEndpoints = cmdS3.Flag.Bool("allowUntrustedRemoteEndpoints", false, allowUntrustedRemoteEndpointsUsage)
+	s3StandaloneOptions.allowBackslashInKey = cmdS3.Flag.Bool("allowBackslashInKey", false, allowBackslashInKeyUsage)
+	s3StandaloneOptions.iamSelfServiceRequiresGrant = cmdS3.Flag.Bool("iam.selfServiceRequiresGrant", false, iamSelfServiceRequiresGrantUsage)
 }
 
 var cmdS3 = &Command{
@@ -314,7 +340,8 @@ func (s3opt *S3Options) startS3Server() bool {
 
 	router := mux.NewRouter().SkipClean(true)
 	var localFilerSocket string
-	if s3opt.localFilerSocket != nil {
+	// The filer only listens on its local socket outside Windows.
+	if s3opt.localFilerSocket != nil && runtime.GOOS != "windows" {
 		localFilerSocket = *s3opt.localFilerSocket
 	}
 	var s3ApiServer *s3api.S3ApiServer
@@ -341,6 +368,11 @@ func (s3opt *S3Options) startS3Server() bool {
 		glog.Fatalf("S3 API Server startup error: %v", fileModeErr)
 	}
 
+	var readerCacheSizeMB int64
+	if s3opt.readerCacheSizeMB != nil {
+		readerCacheSizeMB = *s3opt.readerCacheSizeMB
+	}
+
 	s3ApiServer, s3ApiServer_err = s3api.NewS3ApiServer(router, &s3api.S3ApiServerOption{
 		Filers:                    filerAddresses,
 		Masters:                   masterAddresses,
@@ -351,6 +383,7 @@ func (s3opt *S3Options) startS3Server() bool {
 		BucketsPath:               filerBucketsPath,
 		GrpcDialOption:            grpcDialOption,
 		AllowDeleteBucketNotEmpty: *s3opt.allowDeleteBucketNotEmpty,
+		AutoCreateBucket:          *s3opt.autoCreateBucket,
 		LocalFilerSocket:          localFilerSocket,
 		DataCenter:                *s3opt.dataCenter,
 		FilerGroup:                filerGroup,
@@ -366,36 +399,48 @@ func (s3opt *S3Options) startS3Server() bool {
 		ExternalUrl:               s3opt.resolveExternalUrl(),
 		DefaultFileMode:           defaultFileMode,
 		CacheSizeMB:               *s3opt.cacheSizeMB,
+		ReaderCacheSizeMB:         readerCacheSizeMB,
 		MaxMB:                     filerMaxMB,
+
+		AllowUntrustedRemoteEndpoints: *s3opt.allowUntrustedRemoteEndpoints,
+		AllowBackslashInKey:           *s3opt.allowBackslashInKey,
+		IamSelfServiceRequiresGrant:   *s3opt.iamSelfServiceRequiresGrant,
 	})
 	if s3ApiServer_err != nil {
 		glog.Fatalf("S3 API Server startup error: %v", s3ApiServer_err)
 	}
-	defer s3ApiServer.Shutdown()
+
+	var httpServers []*http.Server
 
 	// Start Iceberg REST Catalog server if enabled
 	if *s3opt.portIceberg > 0 {
-		go s3opt.startIcebergServer(s3ApiServer)
+		if httpS := s3opt.startIcebergServer(s3ApiServer); httpS != nil {
+			httpServers = append(httpServers, httpS)
+		}
+	}
+
+	// Start Lance Namespace server if enabled
+	if s3opt.portLance != nil && *s3opt.portLance > 0 {
+		if httpS := s3opt.startLanceServer(s3ApiServer); httpS != nil {
+			httpServers = append(httpServers, httpS)
+		}
 	}
 
 	if runtime.GOOS != "windows" {
 		localSocket := *s3opt.localSocket
-		if localSocket == "" {
+		explicit := localSocket != ""
+		if !explicit {
 			localSocket = fmt.Sprintf("/tmp/seaweedfs-s3-%d.sock", *s3opt.port)
 		}
-		if err := os.Remove(localSocket); err != nil && !os.IsNotExist(err) {
-			glog.Fatalf("Failed to remove %s, error: %s", localSocket, err.Error())
+		if s3SocketListener := pb.ListenOnLocalSocket(localSocket); s3SocketListener != nil {
+			socketServer := newHttpServer(router, nil)
+			httpServers = append(httpServers, socketServer)
+			go func() {
+				if err := socketServer.Serve(s3SocketListener); err != nil && err != http.ErrServerClosed {
+					glog.Fatalf("Failed to start S3 http server: %v", err)
+				}
+			}()
 		}
-		go func() {
-			// start on local unix socket
-			s3SocketListener, err := net.Listen("unix", localSocket)
-			if err != nil {
-				glog.Fatalf("Failed to listen on %s: %v", localSocket, err)
-			}
-			if err := newHttpServer(router, nil).Serve(s3SocketListener); err != nil && err != http.ErrServerClosed {
-				glog.Fatalf("Failed to start S3 http server: %v", err)
-			}
-		}()
 	}
 
 	listenAddress := fmt.Sprintf("%s:%d", *s3opt.bindIp, *s3opt.port)
@@ -427,6 +472,7 @@ func (s3opt *S3Options) startS3Server() bool {
 	}
 	go grpcS.Serve(grpcL)
 	pb.ServeGrpcOnLocalSocket(grpcS, grpcPort)
+	stopGrpcServer := func() { gracefulStopGrpc(grpcS, 15*time.Second) }
 
 	if *s3opt.tlsPrivateKey != "" {
 		// Check for port conflict when both HTTP and HTTPS are enabled on the same port
@@ -467,23 +513,22 @@ func (s3opt *S3Options) startS3Server() bool {
 		if *s3opt.portHttps == 0 {
 			glog.V(0).Infof("Start Seaweed S3 API Server %s at https port %d", version.Version(), *s3opt.port)
 			if s3ApiLocalListener != nil {
+				localServer := newHttpServer(router, tlsConfig)
+				httpServers = append(httpServers, localServer)
 				go func() {
-					if err = newHttpServer(router, tlsConfig).ServeTLS(s3ApiLocalListener, "", ""); err != nil {
+					if err := localServer.ServeTLS(s3ApiLocalListener, "", ""); err != nil && err != http.ErrServerClosed {
 						glog.Fatalf("S3 API Server Fail to serve: %v", err)
 					}
 				}()
 			}
 			httpS := newHttpServer(router, tlsConfig)
-			if s3opt.shutdownCtx != nil {
-				go func() {
-					<-s3opt.shutdownCtx.Done()
-					httpS.Shutdown(context.Background())
-					grpcS.Stop()
-				}()
-			}
+			httpServers = append(httpServers, httpS)
+			shutdown := s3opt.newShutdown(stopGrpcServer, s3ApiServer, httpServers)
 			if err = httpS.ServeTLS(s3ApiListener, "", ""); err != nil && err != http.ErrServerClosed {
 				glog.Fatalf("S3 API Server Fail to serve: %v", err)
 			}
+			// Serve returns when listeners close, before active requests finish.
+			shutdown()
 		} else {
 			glog.V(0).Infof("Start Seaweed S3 API Server %s at https port %d", version.Version(), *s3opt.portHttps)
 			s3ApiListenerHttps, s3ApiLocalListenerHttps, err := util.NewIpAndLocalListeners(
@@ -492,14 +537,18 @@ func (s3opt *S3Options) startS3Server() bool {
 				glog.Fatalf("S3 API HTTPS listener on %s:%d error: %v", *s3opt.bindIp, *s3opt.portHttps, err)
 			}
 			if s3ApiLocalListenerHttps != nil {
+				localHttpsServer := newHttpServer(router, tlsConfig)
+				httpServers = append(httpServers, localHttpsServer)
 				go func() {
-					if err = newHttpServer(router, tlsConfig).ServeTLS(s3ApiLocalListenerHttps, "", ""); err != nil {
+					if err := localHttpsServer.ServeTLS(s3ApiLocalListenerHttps, "", ""); err != nil && err != http.ErrServerClosed {
 						glog.Fatalf("S3 API Server Fail to serve: %v", err)
 					}
 				}()
 			}
+			httpsServer := newHttpServer(router, tlsConfig)
+			httpServers = append(httpServers, httpsServer)
 			go func() {
-				if err = newHttpServer(router, tlsConfig).ServeTLS(s3ApiListenerHttps, "", ""); err != nil {
+				if err := httpsServer.ServeTLS(s3ApiListenerHttps, "", ""); err != nil && err != http.ErrServerClosed {
 					glog.Fatalf("S3 API Server Fail to serve: %v", err)
 				}
 			}()
@@ -508,31 +557,42 @@ func (s3opt *S3Options) startS3Server() bool {
 	if *s3opt.tlsPrivateKey == "" || *s3opt.portHttps > 0 {
 		glog.V(0).Infof("Start Seaweed S3 API Server %s at http port %d", version.Version(), *s3opt.port)
 		if s3ApiLocalListener != nil {
+			localServer := newHttpServer(router, nil)
+			httpServers = append(httpServers, localServer)
 			go func() {
-				if err = newHttpServer(router, nil).Serve(s3ApiLocalListener); err != nil {
+				if err := localServer.Serve(s3ApiLocalListener); err != nil && err != http.ErrServerClosed {
 					glog.Fatalf("S3 API Server Fail to serve: %v", err)
 				}
 			}()
 		}
 		httpS := newHttpServer(router, nil)
-		if s3opt.shutdownCtx != nil {
-			go func() {
-				<-s3opt.shutdownCtx.Done()
-				httpS.Shutdown(context.Background())
-				grpcS.Stop()
-			}()
-		}
+		httpServers = append(httpServers, httpS)
+		shutdown := s3opt.newShutdown(stopGrpcServer, s3ApiServer, httpServers)
 		if err = httpS.Serve(s3ApiListener); err != nil && err != http.ErrServerClosed {
 			glog.Fatalf("S3 API Server Fail to serve: %v", err)
 		}
+		// Serve returns when listeners close, before active requests finish.
+		shutdown()
 	}
 
 	return true
 
 }
 
+func (s3opt *S3Options) newShutdown(stopGrpc func(), s3ApiServer *s3api.S3ApiServer, httpServers []*http.Server) func() {
+	shutdown := newGracefulShutdown(stopGrpc, s3ApiServer.Shutdown, httpServers...)
+	grace.OnInterrupt(shutdown)
+	if s3opt.shutdownCtx != nil {
+		go func() {
+			<-s3opt.shutdownCtx.Done()
+			shutdown()
+		}()
+	}
+	return shutdown
+}
+
 // startIcebergServer starts the Iceberg REST Catalog server on a separate port.
-func (s3opt *S3Options) startIcebergServer(s3ApiServer *s3api.S3ApiServer) {
+func (s3opt *S3Options) startIcebergServer(s3ApiServer *s3api.S3ApiServer) *http.Server {
 	icebergRouter := mux.NewRouter().SkipClean(true)
 	// warehouse/parent query values may legally contain ';', which Go's
 	// url.ParseQuery would otherwise drop
@@ -541,6 +601,14 @@ func (s3opt *S3Options) startIcebergServer(s3ApiServer *s3api.S3ApiServer) {
 	// Create Iceberg server using the S3ApiServer as filer client
 	icebergServer := iceberg.NewServer(s3ApiServer, s3ApiServer)
 	icebergServer.SetCredentialValidator(s3ApiServer)
+	if s3opt.icebergCredentialRole != nil && *s3opt.icebergCredentialRole != "" {
+		duration := int64(0)
+		if s3opt.icebergCredentialDuration != nil {
+			duration = int64(*s3opt.icebergCredentialDuration)
+		}
+		s3ApiServer.SetIcebergCredentialRole(*s3opt.icebergCredentialRole, duration)
+		icebergServer.SetCredentialVendor(icebergCredentialVendor{s3ApiServer})
+	}
 	icebergServer.SetS3Endpoint(s3opt.deriveS3AdvertisedEndpoint())
 	icebergServer.RegisterRoutes(icebergRouter)
 
@@ -548,18 +616,16 @@ func (s3opt *S3Options) startIcebergServer(s3ApiServer *s3api.S3ApiServer) {
 	icebergListener, icebergLocalListener, err := util.NewIpAndLocalListeners(
 		*s3opt.bindIp, *s3opt.portIceberg, time.Duration(*s3opt.idleTimeout)*time.Second)
 	if err != nil {
-		glog.Fatalf("Iceberg REST Catalog listener on %s error: %v", listenAddress, err)
+		// The catalog is auxiliary to the S3 gateway; a port conflict must not
+		// take the whole server down.
+		glog.Errorf("Iceberg REST Catalog listener on %s error: %v", listenAddress, err)
+		return nil
 	}
+	s3opt.icebergBound.Store(true)
 
 	glog.V(0).Infof("Start Iceberg REST Catalog Server at http://%s", listenAddress)
 
 	httpS := newHttpServer(icebergRouter, nil)
-	if s3opt.shutdownCtx != nil {
-		go func() {
-			<-s3opt.shutdownCtx.Done()
-			httpS.Shutdown(context.Background())
-		}()
-	}
 	// Serve on localhost as well if we're bound to a different interface
 	if icebergLocalListener != nil {
 		go func() {
@@ -568,9 +634,88 @@ func (s3opt *S3Options) startIcebergServer(s3ApiServer *s3api.S3ApiServer) {
 			}
 		}()
 	}
-	if err = httpS.Serve(icebergListener); err != nil && err != http.ErrServerClosed {
-		glog.Fatalf("Iceberg REST Catalog Server Fail to serve: %v", err)
+	go func() {
+		if err := httpS.Serve(icebergListener); err != nil && err != http.ErrServerClosed {
+			glog.Errorf("Iceberg REST Catalog Server Fail to serve: %v", err)
+		}
+	}()
+	return httpS
+}
+
+// startLanceServer starts the Lance Namespace server on a separate port. It
+// shares the Iceberg catalog's credential role: one deployment vends table
+// credentials one way, whichever catalog the client speaks to.
+func (s3opt *S3Options) startLanceServer(s3ApiServer *s3api.S3ApiServer) *http.Server {
+	lanceRouter := mux.NewRouter().SkipClean(true)
+	lanceRouter.Use(util_http.EscapeSemicolonsInQuery)
+
+	lanceServer := lance.NewServer(s3ApiServer, s3ApiServer)
+	lanceServer.SetCredentialValidator(s3ApiServer)
+	if s3opt.icebergCredentialRole != nil && *s3opt.icebergCredentialRole != "" {
+		lanceServer.SetCredentialVendor(lanceCredentialVendor{s3ApiServer})
 	}
+	lanceServer.SetS3Endpoint(s3opt.deriveLanceStorageEndpoint())
+	lanceServer.SetS3Region(s3tables.DefaultRegion)
+	lanceServer.RegisterRoutes(lanceRouter)
+
+	listenAddress := fmt.Sprintf("%s:%d", *s3opt.bindIp, *s3opt.portLance)
+	lanceListener, lanceLocalListener, err := util.NewIpAndLocalListeners(
+		*s3opt.bindIp, *s3opt.portLance, time.Duration(*s3opt.idleTimeout)*time.Second)
+	if err != nil {
+		glog.Errorf("Lance Namespace listener on %s error: %v", listenAddress, err)
+		return nil
+	}
+	s3opt.lanceBound.Store(true)
+
+	glog.V(0).Infof("Start Lance Namespace Server at http://%s", listenAddress)
+
+	httpS := newHttpServer(lanceRouter, nil)
+	if lanceLocalListener != nil {
+		go func() {
+			if err := httpS.Serve(lanceLocalListener); err != nil && err != http.ErrServerClosed {
+				glog.V(0).Infof("Lance localhost listener error: %v", err)
+			}
+		}()
+	}
+	go func() {
+		if err := httpS.Serve(lanceListener); err != nil && err != http.ErrServerClosed {
+			glog.Errorf("Lance Namespace Server Fail to serve: %v", err)
+		}
+	}()
+	return httpS
+}
+
+// deriveLanceStorageEndpoint picks the endpoint the Lance namespace puts in
+// storage_options. It falls back to the advertised -ip where the Iceberg
+// derivation gives up, because the two clients are not in the same position: a
+// Spark or Trino Iceberg client brings its own s3.endpoint and advertising the
+// wrong one hijacks it, whereas storage_options is the only place a Lance
+// client learns where the store is. Without one, object_store quietly falls
+// back to real AWS S3 and the failure reads like a credentials problem.
+func (s3opt *S3Options) deriveLanceStorageEndpoint() string {
+	if endpoint := s3opt.deriveS3AdvertisedEndpoint(); endpoint != "" {
+		return endpoint
+	}
+	host := ""
+	if s3opt.ip != nil {
+		host = *s3opt.ip
+	}
+	switch host {
+	case "", "0.0.0.0", "::", "[::]":
+		return ""
+	}
+	scheme := "http"
+	port := 0
+	if s3opt.port != nil {
+		port = *s3opt.port
+	}
+	if s3opt.tlsPrivateKey != nil && *s3opt.tlsPrivateKey != "" {
+		scheme = "https"
+		if s3opt.portHttps != nil && *s3opt.portHttps > 0 {
+			port = *s3opt.portHttps
+		}
+	}
+	return fmt.Sprintf("%s://%s", scheme, util.JoinHostPort(host, port))
 }
 
 // deriveS3AdvertisedEndpoint builds the S3 endpoint URL to advertise to
@@ -612,3 +757,41 @@ func (s3opt *S3Options) deriveS3AdvertisedEndpoint() string {
 	}
 	return fmt.Sprintf("%s://%s", scheme, util.JoinHostPort(host, port))
 }
+
+// icebergCredentialVendor adapts the S3 gateway's STS-backed vending to the
+// catalog's interface, keeping the two packages independent of each other.
+type icebergCredentialVendor struct {
+	server *s3api.S3ApiServer
+}
+
+func (v icebergCredentialVendor) VendTableCredentials(ctx context.Context, principal, bucket, prefix string, readOnly bool) (*iceberg.VendedCredentials, error) {
+	credentials, err := v.server.VendTableCredentials(ctx, principal, bucket, prefix, readOnly)
+	if err != nil || credentials == nil {
+		return nil, err
+	}
+	return &iceberg.VendedCredentials{
+		AccessKeyID:     credentials.AccessKeyID,
+		SecretAccessKey: credentials.SecretAccessKey,
+		SessionToken:    credentials.SessionToken,
+		Expiration:      credentials.Expiration,
+	}, nil
+}
+
+// lanceCredentialVendor adapts the S3 gateway's STS-backed vending to the Lance
+// namespace's interface, keeping the two packages independent of each other.
+type lanceCredentialVendor struct {
+	server *s3api.S3ApiServer
+}
+
+func (v lanceCredentialVendor) VendTableCredentials(ctx context.Context, principal, bucket, prefix string, readOnly bool) (*lance.VendedCredentials, error) {
+	credentials, err := v.server.VendTableCredentials(ctx, principal, bucket, prefix, readOnly)
+	if err != nil || credentials == nil {
+		return nil, err
+	}
+	return &lance.VendedCredentials{
+		AccessKeyID:     credentials.AccessKeyID,
+		SecretAccessKey: credentials.SecretAccessKey,
+		SessionToken:    credentials.SessionToken,
+		Expiration:      credentials.Expiration,
+	}, nil
+}
diff --git a/weed/command/s3_aux_listener_test.go b/weed/command/s3_aux_listener_test.go
new file mode 100644
index 0000000000..6ec5fac4b4
--- /dev/null
+++ b/weed/command/s3_aux_listener_test.go
@@ -0,0 +1,59 @@
+package command
+
+import (
+	"net"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api"
+)
+
+func holdPort(t *testing.T) int {
+	t.Helper()
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { l.Close() })
+	return l.Addr().(*net.TCPAddr).Port
+}
+
+// An occupied auxiliary catalog port must not take the S3 gateway down, must
+// return no server for shutdown registration, and must not report the catalog
+// as bound for mini's readiness checks.
+func TestAuxListenerBindFailureIsNonFatal(t *testing.T) {
+	icebergPort := holdPort(t)
+	lancePort := holdPort(t)
+
+	bind := "127.0.0.1"
+	empty := ""
+	zero := 0
+	idle := 10
+	s3opt := &S3Options{
+		bindIp:                &bind,
+		ip:                    &bind,
+		port:                  &zero,
+		portHttps:             &zero,
+		portIceberg:           &icebergPort,
+		portLance:             &lancePort,
+		idleTimeout:           &idle,
+		icebergCredentialRole: &empty,
+		externalUrl:           &empty,
+		tlsPrivateKey:         &empty,
+	}
+	s3a := &s3api.S3ApiServer{}
+
+	if s := s3opt.startIcebergServer(s3a); s != nil {
+		s.Close()
+		t.Error("startIcebergServer on an occupied port should return nil")
+	}
+	if s3opt.icebergBound.Load() {
+		t.Error("icebergBound must stay false when the listener failed to bind")
+	}
+	if s := s3opt.startLanceServer(s3a); s != nil {
+		s.Close()
+		t.Error("startLanceServer on an occupied port should return nil")
+	}
+	if s3opt.lanceBound.Load() {
+		t.Error("lanceBound must stay false when the listener failed to bind")
+	}
+}
diff --git a/weed/command/s3_iceberg_endpoint_test.go b/weed/command/s3_iceberg_endpoint_test.go
index 14608aeb71..337a487b89 100644
--- a/weed/command/s3_iceberg_endpoint_test.go
+++ b/weed/command/s3_iceberg_endpoint_test.go
@@ -92,7 +92,8 @@ func TestDeriveS3AdvertisedEndpoint(t *testing.T) {
 		},
 	}
 
-	for _, tc := range tests {
+	for i := range tests {
+		tc := &tests[i]
 		t.Run(tc.name, func(t *testing.T) {
 			got := tc.opt.deriveS3AdvertisedEndpoint()
 			if got != tc.want {
diff --git a/weed/command/s3_shutdown_test.go b/weed/command/s3_shutdown_test.go
new file mode 100644
index 0000000000..4b3126fd13
--- /dev/null
+++ b/weed/command/s3_shutdown_test.go
@@ -0,0 +1,81 @@
+package command
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api"
+)
+
+func TestS3ShutdownDrainsActiveRequestBeforeServeReturns(t *testing.T) {
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	finish := sync.OnceFunc(func() { close(release) })
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		close(entered)
+		<-release
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
+	t.Cleanup(finish)
+	httpClosing := make(chan struct{})
+	server.Config.RegisterOnShutdown(func() { close(httpClosing) })
+
+	requestDone := make(chan struct{})
+	go func() {
+		defer close(requestDone)
+		response, err := server.Client().Get(server.URL)
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		response.Body.Close()
+		if response.StatusCode != http.StatusNoContent {
+			t.Errorf("active request returned %s", response.Status)
+		}
+	}()
+	select {
+	case <-entered:
+	case <-requestDone:
+		t.Fatal("request ended before reaching the handler")
+	case <-time.After(5 * time.Second):
+		t.Fatal("request did not reach the handler")
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	grpcStopped := make(chan struct{})
+	s3opt := &S3Options{shutdownCtx: ctx}
+	shutdown := s3opt.newShutdown(func() { close(grpcStopped) }, &s3api.S3ApiServer{}, []*http.Server{server.Config})
+
+	cancel()
+	select {
+	case <-httpClosing:
+	case <-time.After(5 * time.Second):
+		t.Fatal("cancelling shutdownCtx did not start the HTTP drain")
+	}
+	<-grpcStopped
+
+	// Model the main Serve path joining shutdown once its listener closes.
+	serveReturned := make(chan struct{})
+	go func() { shutdown(); close(serveReturned) }()
+	select {
+	case <-serveReturned:
+		t.Fatal("Serve exit path returned while a request was still active")
+	case <-requestDone:
+		t.Fatal("active request ended before it was released")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	finish()
+	<-requestDone
+	select {
+	case <-serveReturned:
+	case <-time.After(5 * time.Second):
+		t.Fatal("Serve exit path did not return after the request drained")
+	}
+}
diff --git a/weed/command/scaffold/admin.toml b/weed/command/scaffold/admin.toml
index 3ea6f554be..99709abc03 100644
--- a/weed/command/scaffold/admin.toml
+++ b/weed/command/scaffold/admin.toml
@@ -11,6 +11,16 @@
 # Each value can also be set via environment variable, e.g.
 #    export WEED_MAINTENANCE_VACUUM_GARBAGE_THRESHOLD=0.3
 
+[s3]
+# The address clients reach the S3 gateway at, including the scheme.
+# The file browser uses it to offer copyable object URLs; without it,
+# the copy action is hidden.
+# public_endpoint = "https://s3.example.com"
+
+[maintenance]
+# toggle the entire maintenance system (task detection and execution)
+# enabled = true
+
 [maintenance.vacuum]
 # enabled = true
 # vacuum volumes with more deleted content than this ratio
@@ -47,12 +57,18 @@
 # scan_interval_seconds = 3600
 # max_concurrent = 1
 # min_size_mb = 30
-# only process volumes from this collection ("" = all collections)
+# only process volumes from these collections, comma separated, "*" and "?" wildcards
+# and regex patterns allowed ("" = all collections)
 # collection_filter = ""
 # disk tags preferred for shard placement
 # preferred_tags = ["fast", "ssd"]
 # EC shard placement constraint, e.g. "020"; empty uses the master default replication
 # replica_placement = ""
+# fail planning when the placement constraints cannot be met instead of relaxing them
+# strict_placement = false
+# volume-slot deadband for shard placement: nodes whose free volume slots differ by at
+# most this much tie and fewer live shards wins; applied times data shards (0 = strict)
+# free_slots_deadband = 0
 # max retry attempts for a failed erasure coding job
 # retry_limit = 1
 # seconds to wait between retry attempts
diff --git a/weed/command/scaffold/filer.toml b/weed/command/scaffold/filer.toml
index be7aa07649..8b9552e052 100644
--- a/weed/command/scaffold/filer.toml
+++ b/weed/command/scaffold/filer.toml
@@ -16,6 +16,13 @@ recursive_delete = false
 # for S3: how long to wait before deleting an empty folder.
 # increase this if using tools like Spark that create temporary directories.
 #s3.empty_folder_cleanup_delay = "2m"
+# where the filer's internal system metadata log chunks are stored.
+# By default the log follows the filer's -collection flag; set this to keep
+# the internal log in its own collection, out of the default one.
+# Keep the target stable: log chunks written under an older value are not
+# moved, and old log entries keep referencing that collection's volumes.
+#metaLog.collection = "filer-meta"
+#metaLog.replication = ""
 
 ####################################################
 # The following are filer store options
@@ -26,12 +33,22 @@ recursive_delete = false
 # faster than previous leveldb, recommended.
 enabled = true
 dir = "./filerldb2"                    # directory to store level db files
+# optional tuning, applied to each of the 8 partitioned stores
+# block_cache_size_mb = 32             # sorted-table read cache
+# write_buffer_size_mb = 16            # memtable size before flushing to disk
+# block_size_kb = 4                    # uncompressed block ('page') size inside table files
+# compaction_table_size_mb = 2         # target size of generated table files
 
 [leveldb3]
 # similar to leveldb2.
 # each bucket has its own meta store.
 enabled = false
 dir = "./filerldb3"                    # directory to store level db files
+# optional tuning, applied to the default store and each bucket store
+# block_cache_size_mb = 32             # sorted-table read cache
+# write_buffer_size_mb = 16            # memtable size before flushing to disk
+# block_size_kb = 4                    # uncompressed block ('page') size inside table files
+# compaction_table_size_mb = 2         # target size of generated table files
 
 [rocksdb]
 # local on disk, similar to leveldb
@@ -68,7 +85,7 @@ port = 3306
 username = "root"
 password = ""
 database = ""              # create or use an existing database
-connection_max_idle = 10
+connection_max_idle = 50
 connection_max_open = 50
 connection_max_lifetime_seconds = 300
 interpolateParams = false
@@ -97,7 +114,7 @@ port = 3306
 username = "root"
 password = ""
 database = ""              # create or use an existing database
-connection_max_idle = 10
+connection_max_idle = 50
 connection_max_open = 50
 connection_max_lifetime_seconds = 300
 interpolateParams = false
@@ -106,13 +123,9 @@ enableUpsert = true
 upsertQuery = """INSERT INTO `%s` (`dirhash`,`name`,`directory`,`meta`) VALUES (?,?,?,?) AS `new` ON DUPLICATE KEY UPDATE `meta` = `new`.`meta`"""
 
 [postgres] # or cockroachdb, YugabyteDB
-# CREATE TABLE IF NOT EXISTS filemeta (
-#   dirhash     BIGINT,
-#   name        VARCHAR(65535),
-#   directory   VARCHAR(65535),
-#   meta        bytea,
-#   PRIMARY KEY (dirhash, name)
-# );
+# createTable = true          # auto-create filemeta with the default schema
+# createTable = false         # skip table creation (default; for restricted DB roles)
+# createTable = """CREATE TABLE IF NOT EXISTS "%s" (...)"""  # custom template
 enabled = false
 hostname = "localhost"
 port = 5432
@@ -127,7 +140,7 @@ sslmode = "disable"
 # sslkey = "/path/to/client.key"      # client private key file
 # sslrootcert = "/path/to/ca.crt"     # CA certificate file
 # sslcrl = "/path/to/client.crl"      # Certificate Revocation List (CRL) (optional)
-connection_max_idle = 10
+connection_max_idle = 50
 connection_max_open = 50
 connection_max_lifetime_seconds = 300
 # Set to true when using PgBouncer connection pooler
@@ -166,7 +179,7 @@ sslmode = "disable"
 # sslkey = "/path/to/client.key"      # client private key file
 # sslrootcert = "/path/to/ca.crt"     # CA certificate file
 # sslcrl = "/path/to/client.crl"      # Certificate Revocation List (CRL) (optional)
-connection_max_idle = 10
+connection_max_idle = 50
 connection_max_open = 50
 connection_max_lifetime_seconds = 300
 # Set to true when using PgBouncer connection pooler
@@ -285,7 +298,7 @@ ca_cert_path = ""
 client_cert_path = ""
 client_key_path = ""
 # allows reads from slave servers or the master, but all writes still go to the master
-readOnly = false
+useReadOnly = false
 # automatically use the closest Redis server for reads
 routeByLatency = false
 # This changes the data layout. Only add new directories. Removing/Updating will cause data loss.
diff --git a/weed/command/scaffold/master.toml b/weed/command/scaffold/master.toml
index 38443410b4..dfa8472030 100644
--- a/weed/command/scaffold/master.toml
+++ b/weed/command/scaffold/master.toml
@@ -4,6 +4,13 @@
 #    /etc/seaweedfs/master.toml
 # this file is read by master
 
+[master]
+# cap on writable volumes per volume layout (collection + replica placement +
+# ttl + disk type) that write assignments spread over; fullest picked first.
+# 0 = no limit
+max_writable_volumes_per_layout = 0
+
+
 [master.maintenance]
 # periodically run these scripts are the same as running them from 'weed shell'
 # Scripts are skipped while an admin server is connected.
@@ -11,6 +18,15 @@ scripts = """{{DEFAULT_MAINTENANCE_SCRIPTS}}"""
 sleep_minutes = 17          # sleep minutes between each script execution
 
 
+# vacuum reclaims deleted space by compacting volumes
+[master.vacuum]
+# concurrent volume compactions per volume server; overrides the deprecated
+# -maxParallelVacuumPerServer flag (default 1) when set; 0 = no limit
+# max_parallel_per_server = 1
+# concurrent volume copies compacting within one rack; 0 = no limit
+max_parallel_per_rack = 0
+
+
 [master.sequencer]
 type = "raft"     # Choose [raft|snowflake] type for storing the file id sequence
 # when sequencer.type = snowflake, the snowflake id must be different from other masters
@@ -28,6 +44,10 @@ region = "us-east-2"
 bucket = "your_bucket_name"    # an existing bucket
 endpoint = ""
 storage_class = "STANDARD_IA"
+# optional HTTP client tuning for S3-compatible services:
+# disable_http2 = false                 # true keeps the client on HTTP/1.1, one connection per concurrent request
+# max_connections = 0                   # cap on connections to the endpoint, 0 = no cap
+# idle_connection_timeout_seconds = 0   # close idle connections sooner, 0 = Go default (90s)
 
 # create this number of logical volumes if no more writable volumes
 # count_x means how many copies of data.
@@ -41,6 +61,7 @@ copy_2 = 6                # create 2 x 6 = 12 actual volumes
 copy_3 = 3                # create 3 x 3 = 9 actual volumes
 copy_other = 1            # create n x 1 = n actual volumes
 threshold = 0.9           # create threshold
+reservation_timeout = "5m"# capacity reservation timeout before unreleased reservations expire
 disable = false           # disables volume growth if true
 
 # configuration flags for replication
diff --git a/weed/command/scaffold/notification.toml b/weed/command/scaffold/notification.toml
index ca82f2c1e4..7d327984e4 100644
--- a/weed/command/scaffold/notification.toml
+++ b/weed/command/scaffold/notification.toml
@@ -20,6 +20,7 @@ hosts = [
     "localhost:9092"
 ]
 topic = "seaweedfs_filer"
+# event_types = ["create", "update", "delete", "rename"]  # optional: filter by event types (default: all)
 offsetFile = "./last.offset"
 offsetSaveIntervalSeconds = 10
 # SASL Authentication
@@ -80,3 +81,16 @@ workers = 5                                        # optional: concurrent worker
 buffer_size = 10000                                # optional: event buffer size (default: 10000, range: 100-1000000)
 # event_types = ["create", "update", "delete", "rename"]  # optional: filter by event types (default: all)
 # path_prefixes = ["/important", "/data"]          # optional: filter by path prefixes (default: all)
+#
+# Additional endpoints can be declared as named subsections, each with its own
+# endpoint, filters, retry and worker settings, e.g.:
+# [notification.webhook.file_ingress]
+# enabled = true
+# endpoint = "https://ingress.example.com/hook"
+# event_types = ["create"]
+# path_prefixes = ["/buckets/uploads/data"]
+#
+# [notification.webhook.metadata_extractor]
+# enabled = true
+# endpoint = "https://metadata.example.com/hook"
+# path_prefixes = ["/buckets/repository"]
diff --git a/weed/command/scaffold/security.toml b/weed/command/scaffold/security.toml
index 1d9832bc54..efa49cce02 100644
--- a/weed/command/scaffold/security.toml
+++ b/weed/command/scaffold/security.toml
@@ -77,6 +77,12 @@ expires_after_seconds = 10           # seconds
 # All gRPC TLS authentications are mutual (mTLS)
 # The values for ca, cert, and key are paths to the certificate/key files
 # The host name is not checked, so the certificate files can be shared
+# Each [grpc.<component>] section also accepts optional client_cert/client_key,
+# presented when that component dials other servers. Set them when your CA
+# issues separate serverAuth-only and clientAuth-only certificates; when unset,
+# the component reuses cert/key for both directions.
+# If client and server certificates come from different issuing CAs, put both
+# CA certificates in the ca PEM file.
 [grpc]
 ca = ""
 # Set wildcard domain for enable TLS authentication by common names
@@ -87,6 +93,8 @@ allowed_wildcard_domain = "" # .mycompany.com
 [grpc.volume]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # Master server gRPC options (server-side)
@@ -94,6 +102,8 @@ allowed_commonNames = ""    # comma-separated SSL certificate common names
 [grpc.master]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # Filer server gRPC options (server-side)
@@ -101,6 +111,8 @@ allowed_commonNames = ""    # comma-separated SSL certificate common names
 [grpc.filer]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # S3 server gRPC options (server-side)
@@ -108,31 +120,43 @@ allowed_commonNames = ""    # comma-separated SSL certificate common names
 [grpc.s3]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.msg_broker]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.msg_agent]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.admin]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.worker]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 [grpc.mq]
 cert = ""
 key = ""
+client_cert = ""
+client_key = ""
 allowed_commonNames = ""    # comma-separated SSL certificate common names
 
 # gRPC client configuration for outgoing gRPC connections
@@ -208,6 +232,18 @@ kek = ""
 # Cannot be used while /etc/s3/sse_kek exists on the filer — delete it first.
 key = ""
 
+# Trusted reverse proxies allowed to set forwarding headers on behalf of the
+# real client: X-Forwarded-For / X-Real-Ip for aws:SourceIp condition
+# evaluation in S3 bucket and IAM policies, and X-Forwarded-Prefix for SigV4
+# signature verification of prefix-stripped paths. When the direct TCP peer is
+# in this list, these headers are honored; otherwise they are ignored. A
+# trusted proxy must overwrite or strip client-supplied values of these
+# headers, since honoring them means trusting them. Leave empty to always use
+# the direct peer, which is the safe default.
+# Can also be set via env var: WEED_S3_TRUSTED_PROXIES_WHITE_LIST
+[s3.trusted_proxies]
+white_list = "" # comma separated; bare IPs or CIDRs, e.g. "10.10.10.0/24"
+
 # white list. It's checking request ip address.
 [guard]
 white_list = ""
diff --git a/weed/command/scaffold/volume.toml b/weed/command/scaffold/volume.toml
index 64c350d3a9..4e5f35f91c 100644
--- a/weed/command/scaffold/volume.toml
+++ b/weed/command/scaffold/volume.toml
@@ -21,6 +21,8 @@ percent = 20
 [volume.disk.io.error]
 percent = 10
 
+# slow threshold per disk type, matched against each -dir's -disk tag.
+# a disk whose type is not listed here uses the hdd threshold.
 [volume.disk.io.slow.latency]
 hdd = "500ms"
 ssd = "100ms"
diff --git a/weed/command/server.go b/weed/command/server.go
index e89d26682d..a1d17a5fab 100644
--- a/weed/command/server.go
+++ b/weed/command/server.go
@@ -95,9 +95,11 @@ func init() {
 	masterOptions.portGrpc = cmdServer.Flag.Int("master.port.grpc", 0, "master server grpc listen port")
 	masterOptions.metaFolder = cmdServer.Flag.String("master.dir", "", "data directory to store meta data, default to same as -dir specified")
 	masterOptions.peers = cmdServer.Flag.String("master.peers", "", "all master nodes in comma separated ip:masterPort list")
-	masterOptions.volumeSizeLimitMB = cmdServer.Flag.Uint("master.volumeSizeLimitMB", 30*1000, "Master stops directing writes to oversized volumes.")
+	masterOptions.volumeSizeLimitMB = cmdServer.Flag.Uint("master.volumeSizeLimitMB", util.DefaultVolumeSizeLimitMB, "Master stops directing writes to oversized volumes.")
 	masterOptions.volumePreallocate = cmdServer.Flag.Bool("master.volumePreallocate", false, "Preallocate disk space for volumes.")
-	masterOptions.maxParallelVacuumPerServer = cmdServer.Flag.Int("master.maxParallelVacuumPerServer", 1, "maximum number of volumes to vacuum in parallel on one volume server")
+	masterOptions.maxParallelVacuumPerServer = cmdServer.Flag.Int("master.maxParallelVacuumPerServer", 1, "maximum number of volumes to vacuum in parallel on one volume server; 0 for no limit (deprecated, use master.vacuum.max_parallel_per_server in master.toml)")
+	masterOptions.vacuumIntervalSeconds = cmdServer.Flag.Int("master.vacuumIntervalSeconds", 840, "seconds between automatic vacuum sweeps")
+	masterOptions.vacuumDeleteEmptyAfterSeconds = cmdServer.Flag.Int("master.vacuumDeleteEmptyAfterSeconds", 0, "automatic sweep deletes volume copies that stay empty this many seconds; 0 disables")
 	masterOptions.defaultReplication = cmdServer.Flag.String("master.defaultReplication", "", "Default replication type if not specified.")
 	masterOptions.garbageThreshold = cmdServer.Flag.Float64("master.garbageThreshold", 0.3, "threshold to vacuum and reclaim spaces")
 	masterOptions.metricsAddress = cmdServer.Flag.String("master.metrics.address", "", "Prometheus gateway address")
@@ -115,6 +117,7 @@ func init() {
 	filerOptions.port = cmdServer.Flag.Int("filer.port", 8888, "filer server http listen port")
 	filerOptions.portGrpc = cmdServer.Flag.Int("filer.port.grpc", 0, "filer server grpc listen port")
 	filerOptions.publicPort = cmdServer.Flag.Int("filer.port.public", 0, "filer server public http listen port")
+	filerOptions.disableHttp = cmdServer.Flag.Bool("filer.disableHttp", false, "disable filer HTTP requests, only gRPC operations are allowed")
 	filerOptions.allowedOrigins = cmdServer.Flag.String("filer.allowedOrigins", "*", "comma separated list of allowed origins")
 	filerOptions.defaultReplicaPlacement = cmdServer.Flag.String("filer.defaultReplicaPlacement", "", "default replication type. If not specified, use master setting.")
 	filerOptions.disableDirListing = cmdServer.Flag.Bool("filer.disableDirListing", false, "turn off directory listing")
@@ -132,6 +135,8 @@ func init() {
 	filerOptions.tusBasePath = cmdServer.Flag.String("filer.tusBasePath", "/.tus", "TUS resumable upload endpoint base path (e.g., /.tus)")
 	filerOptions.tusMaxSizeMB = cmdServer.Flag.Int("filer.tusMaxSizeMB", 5*1024, "maximum TUS upload size in MB")
 	filerOptions.tusSessionExpiry = cmdServer.Flag.Duration("filer.tusSessionExpiry", 24*time.Hour, "incomplete TUS upload sessions are cleaned up after this duration, e.g. \"48h\", \"7h30m\"")
+	filerOptions.allowUntrustedRemoteEndpoints = cmdServer.Flag.Bool("filer.allowUntrustedRemoteEndpoints", false, allowUntrustedRemoteEndpointsUsage)
+	filerOptions.remoteCacheEvictThreshold = cmdServer.Flag.Float64("filer.remoteCacheEvictThreshold", 0.9, "evict remote-cached objects (oldest first) when any volume disk exceeds this usage fraction; 0 disables")
 
 	serverOptions.v.port = cmdServer.Flag.Int("volume.port", 8080, "volume server http listen port")
 	serverOptions.v.portGrpc = cmdServer.Flag.Int("volume.port.grpc", 0, "volume server grpc listen port")
@@ -144,6 +149,7 @@ func init() {
 	serverOptions.v.readMode = cmdServer.Flag.String("volume.readMode", "proxy", "[local|proxy|redirect] how to deal with non-local volume: 'not found|read in remote node|redirect volume location'.")
 	serverOptions.v.compactionMBPerSecond = cmdServer.Flag.Int("volume.compactionMBps", 0, "limit compaction speed in mega bytes per second")
 	serverOptions.v.maintenanceMBPerSecond = cmdServer.Flag.Int("volume.maintenanceMBps", 0, "limit maintenance (replication / balance) IO rate in MB/s. Unset is 0, no limitation.")
+	serverOptions.v.maxParallelVacuumCommits = cmdServer.Flag.Int("volume.compactionMaxParallelCommits", 0, "limit how many vacuum commits run at once on this server; queued commits hold no volume lock. 0 means unlimited")
 	serverOptions.v.fileSizeLimitMB = cmdServer.Flag.Int("volume.fileSizeLimitMB", 256, "limit file size to avoid out of memory")
 	serverOptions.v.ldbTimeout = cmdServer.Flag.Int64("volume.index.leveldbTimeout", 0, "alive time for leveldb (default to 0). If leveldb of volume is not accessed in ldbTimeout hours, it will be off loaded to reduce opened files and memory consumption.")
 	serverOptions.v.concurrentUploadLimitMB = cmdServer.Flag.Int("volume.concurrentUploadLimitMB", 0, "limit total concurrent upload size, 0 means unlimited")
@@ -158,14 +164,21 @@ func init() {
 	serverOptions.v.hasSlowRead = cmdServer.Flag.Bool("volume.hasSlowRead", true, "<experimental> if true, this prevents slow reads from blocking other requests, but large file read P99 latency will increase.")
 	serverOptions.v.readBufferSizeMB = cmdServer.Flag.Int("volume.readBufferSizeMB", 4, "<experimental> larger values can optimize query performance but will increase some memory usage,Use with hasSlowRead normally")
 	serverOptions.v.allowUntrustedRemoteEndpoints = cmdServer.Flag.Bool("volume.allowUntrustedRemoteEndpoints", false, "if true, FetchAndWriteNeedle accepts arbitrary remote S3 endpoints including loopback / link-local hosts. Default rejects internal / metadata endpoints.")
+	serverOptions.v.fsyncMinBatchBytes = cmdServer.Flag.Int64("volume.fsyncMinBatchBytes", 1*1024*1024, "minimum bytes an fsync batch gathers before a drained queue flushes without waiting")
+	serverOptions.v.fsyncMinBatchRequests = cmdServer.Flag.Int("volume.fsyncMinBatchRequests", 128, "minimum requests an fsync batch gathers before a drained queue flushes without waiting")
+	serverOptions.v.fsyncBatchWait = cmdServer.Flag.Duration("volume.fsyncBatchWait", 500*time.Microsecond, "how long a below-minimum fsync batch waits for more requests once the queue drains; 0 flushes immediately")
 	serverOptions.v.setDiskIOProbeDefaults()
 
 	s3Options.port = cmdServer.Flag.Int("s3.port", 8333, "s3 server http listen port")
 	s3Options.portHttps = cmdServer.Flag.Int("s3.port.https", 0, "s3 server https listen port")
 	s3Options.portGrpc = cmdServer.Flag.Int("s3.port.grpc", 0, "s3 server grpc listen port")
 	s3Options.portIceberg = cmdServer.Flag.Int("s3.port.iceberg", 8181, "Iceberg REST Catalog server listen port (0 to disable)")
+	s3Options.portLance = cmdServer.Flag.Int("s3.port.lance", 9101, "Lance Namespace server listen port (0 to disable)")
+	s3Options.icebergCredentialRole = cmdServer.Flag.String("s3.iceberg.credentialRole", "", "IAM role ARN the Iceberg catalog assumes to vend table-scoped credentials (empty disables vending)")
+	s3Options.icebergCredentialDuration = cmdServer.Flag.Int("s3.iceberg.credentialDurationSeconds", 3600, "lifetime of credentials vended by the Iceberg catalog")
 	s3Options.domainName = cmdServer.Flag.String("s3.domainName", "", "suffix of the host name in comma separated list, {bucket}.{domainName}")
 	s3Options.allowedOrigins = cmdServer.Flag.String("s3.allowedOrigins", "*", "comma separated list of allowed origins")
+	s3Options.dataCenter = cmdServer.Flag.String("s3.dataCenter", "", "prefer to read and write to volumes in this data center")
 	s3Options.tlsPrivateKey = cmdServer.Flag.String("s3.key.file", "", "path to the TLS private key file")
 	s3Options.tlsCertificate = cmdServer.Flag.String("s3.cert.file", "", "path to the TLS certificate file")
 	s3Options.tlsCACertificate = cmdServer.Flag.String("s3.cacert.file", "", "path to the TLS CA certificate file")
@@ -174,7 +187,8 @@ func init() {
 	s3Options.iamConfig = cmdServer.Flag.String("s3.iam.config", "", "path to the advanced IAM config file for S3. Overrides -iam.config if both are provided.")
 	s3Options.auditLogConfig = cmdServer.Flag.String("s3.auditLogConfig", "", "path to the audit log config file")
 	cmdServer.Flag.Bool("s3.allowEmptyFolder", true, "deprecated, ignored. Empty folder cleanup is now automatic.")
-	s3Options.allowDeleteBucketNotEmpty = cmdServer.Flag.Bool("s3.allowDeleteBucketNotEmpty", true, "allow recursive deleting all entries along with bucket")
+	s3Options.allowDeleteBucketNotEmpty = cmdServer.Flag.Bool("s3.allowDeleteBucketNotEmpty", false, "allow recursive deleting all entries along with bucket")
+	s3Options.autoCreateBucket = cmdServer.Flag.Bool("s3.autoCreateBucket", true, "create the bucket on upload if it does not exist, for admin identities only")
 	s3Options.localSocket = cmdServer.Flag.String("s3.localSocket", "", "default to /tmp/seaweedfs-s3-<port>.sock")
 	s3Options.bindIp = cmdServer.Flag.String("s3.ip.bind", "", "ip address to bind to. If empty, default to same as -ip.bind option.")
 	s3Options.idleTimeout = cmdServer.Flag.Int("s3.idleTimeout", 120, "connection idle seconds")
@@ -183,9 +197,13 @@ func init() {
 	s3Options.enableIam = cmdServer.Flag.Bool("s3.iam", true, "enable embedded IAM API on the same S3 port")
 	s3Options.iamReadOnly = cmdServer.Flag.Bool("s3.iam.readOnly", true, "disable IAM write operations on this server")
 	s3Options.cipher = cmdServer.Flag.Bool("s3.encryptVolumeData", false, "encrypt data on volume servers for S3 uploads")
-	s3Options.externalUrl = cmdServer.Flag.String("s3.externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Used for S3 signature verification behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
+	s3Options.externalUrl = cmdServer.Flag.String("s3.externalUrl", "", "the external URL clients use to connect (e.g. https://api.example.com:9000). Advertised to Iceberg and Lance clients, and tried first when verifying S3 signatures behind a reverse proxy. Falls back to S3_EXTERNAL_URL env var.")
+	s3Options.allowBackslashInKey = cmdServer.Flag.Bool("s3.allowBackslashInKey", false, allowBackslashInKeyUsage)
 	s3Options.defaultFileMode = cmdServer.Flag.String("s3.defaultFileMode", "", "default file mode for S3 uploaded objects, e.g. 0660, 0644, 0666")
 	s3Options.cacheSizeMB = cmdServer.Flag.Int64("s3.cacheCapacityMB", 0, "in-memory chunk cache capacity in MB for S3 GETs shared across requests (0 disables)")
+	s3Options.readerCacheSizeMB = cmdServer.Flag.Int64("s3.readerCacheSizeMB", 0, "memory budget in MiB for downloaded and in-flight reader buffers across all S3 GETs (0 means unlimited)")
+	s3Options.allowUntrustedRemoteEndpoints = cmdServer.Flag.Bool("s3.allowUntrustedRemoteEndpoints", false, allowUntrustedRemoteEndpointsUsage)
+	s3Options.iamSelfServiceRequiresGrant = cmdServer.Flag.Bool("s3.iam.selfServiceRequiresGrant", false, iamSelfServiceRequiresGrantUsage)
 
 	sftpOptions.port = cmdServer.Flag.Int("sftp.port", 2022, "SFTP server listen port")
 	sftpOptions.sshPrivateKey = cmdServer.Flag.String("sftp.sshPrivateKey", "", "path to the SSH private key file for host authentication")
@@ -198,8 +216,10 @@ func init() {
 	sftpOptions.clientAliveCountMax = cmdServer.Flag.Int("sftp.clientAliveCountMax", 3, "maximum number of missed keep-alive messages before disconnecting")
 	sftpOptions.userStoreFile = cmdServer.Flag.String("sftp.userStoreFile", "", "path to JSON file containing user credentials and permissions")
 	sftpOptions.trustedUserCAKeysFile = cmdServer.Flag.String("sftp.trustedUserCAKeysFile", "", "path to a file with trusted user CA public keys (OpenSSH authorized_keys format); required when 'certificate' is in -sftp.authMethods")
+	sftpOptions.dataCenter = cmdServer.Flag.String("sftp.dataCenter", "", "prefer to read and write to volumes in this data center")
 	sftpOptions.localSocket = cmdServer.Flag.String("sftp.localSocket", "", "default to /tmp/seaweedfs-sftp-<port>.sock")
 	iamOptions.port = cmdServer.Flag.Int("iam.port", 8111, "iam server http listen port")
+	iamOptions.selfServiceRequiresGrant = s3Options.iamSelfServiceRequiresGrant
 
 	webdavOptions.port = cmdServer.Flag.Int("webdav.port", 7333, "webdav server http listen port")
 	webdavOptions.collection = cmdServer.Flag.String("webdav.collection", "", "collection to create the files")
@@ -317,14 +337,15 @@ func runServer(cmd *Command, args []string) bool {
 	// masterOptions.pulseSeconds = pulseSeconds
 
 	masterOptions.whiteList = serverWhiteListOption
+	// The master's /submit buffers the upload before handing it to the volume
+	// server started here, so it must not reject what that volume server accepts.
+	masterOptions.fileSizeLimitMB = serverOptions.v.fileSizeLimitMB
 
 	filerOptions.dataCenter = serverDataCenter
 	filerOptions.rack = serverRack
 	mqBrokerOptions.dataCenter = serverDataCenter
 	mqBrokerOptions.rack = serverRack
-	s3Options.dataCenter = serverDataCenter
-	sftpOptions.dataCenter = serverDataCenter
-	filerOptions.disableHttp = serverDisableHttp
+	*filerOptions.disableHttp = *filerOptions.disableHttp || *serverDisableHttp
 	masterOptions.disableHttp = serverDisableHttp
 
 	filerAddress := string(pb.NewServerAddress(*serverIp, *filerOptions.port, *filerOptions.portGrpc))
@@ -339,8 +360,8 @@ func runServer(cmd *Command, args []string) bool {
 	*volumeDataFolders = util.ResolveCommaSeparatedPaths(*volumeDataFolders)
 	folders := strings.Split(*volumeDataFolders, ",")
 
-	if *masterOptions.volumeSizeLimitMB > util.VolumeSizeLimitGB*1000 {
-		glog.Fatalf("masterVolumeSizeLimitMB should be less than 30000")
+	if *masterOptions.volumeSizeLimitMB > util.MaxVolumeSizeLimitMB {
+		glog.Fatalf("master.volumeSizeLimitMB should not exceed %d", util.MaxVolumeSizeLimitMB)
 	}
 
 	if *masterOptions.metaFolder == "" {
@@ -404,7 +425,6 @@ func runServer(cmd *Command, args []string) bool {
 	if *isStartingSftp {
 		go func() {
 			time.Sleep(2 * time.Second)
-			sftpOptions.localSocket = filerOptions.localSocket
 			sftpOptions.startSftpServer()
 		}()
 	}
diff --git a/weed/command/server_test.go b/weed/command/server_test.go
new file mode 100644
index 0000000000..1ad35e1484
--- /dev/null
+++ b/weed/command/server_test.go
@@ -0,0 +1,25 @@
+package command
+
+import "testing"
+
+func TestServerFilerDisableHttpFlag(t *testing.T) {
+	flag := cmdServer.Flag.Lookup("filer.disableHttp")
+	if flag == nil {
+		t.Fatal("weed server does not expose -filer.disableHttp")
+	}
+	if flag.DefValue != "false" {
+		t.Fatalf("-filer.disableHttp default = %q, want false", flag.DefValue)
+	}
+}
+
+func TestServerGatewayDataCenterFlags(t *testing.T) {
+	for _, name := range []string{"s3.dataCenter", "sftp.dataCenter"} {
+		flag := cmdServer.Flag.Lookup(name)
+		if flag == nil {
+			t.Fatalf("weed server does not expose -%s", name)
+		}
+		if flag.DefValue != "" {
+			t.Fatalf("-%s default = %q, want empty", name, flag.DefValue)
+		}
+	}
+}
diff --git a/weed/command/sftp.go b/weed/command/sftp.go
index ed4a28b79c..eb482d018b 100644
--- a/weed/command/sftp.go
+++ b/weed/command/sftp.go
@@ -3,8 +3,6 @@ package command
 import (
 	"context"
 	"fmt"
-	"net"
-	"os"
 	"runtime"
 	"time"
 
@@ -180,22 +178,18 @@ func (sftpOpt *SftpOptions) startSftpServer() bool {
 	// Set up Unix socket if on non-Windows platforms
 	if runtime.GOOS != "windows" {
 		localSocket := *sftpOpt.localSocket
-		if localSocket == "" {
+		explicit := localSocket != ""
+		if !explicit {
 			localSocket = fmt.Sprintf("/tmp/seaweedfs-sftp-%d.sock", *sftpOpt.port)
 		}
-		if err := os.Remove(localSocket); err != nil && !os.IsNotExist(err) {
-			glog.Fatalf("Failed to remove %s, error: %s", localSocket, err.Error())
+		if sftpSocketListener := pb.ListenOnLocalSocket(localSocket); sftpSocketListener != nil {
+			go func() {
+				// start on local unix socket
+				if err := service.Serve(sftpSocketListener); err != nil {
+					glog.Fatalf("Failed to serve SFTP on socket %s: %v", localSocket, err)
+				}
+			}()
 		}
-		go func() {
-			// start on local unix socket
-			sftpSocketListener, err := net.Listen("unix", localSocket)
-			if err != nil {
-				glog.Fatalf("Failed to listen on %s: %v", localSocket, err)
-			}
-			if err := service.Serve(sftpSocketListener); err != nil {
-				glog.Fatalf("Failed to serve SFTP on socket %s: %v", localSocket, err)
-			}
-		}()
 	}
 
 	// Start the SFTP service on TCP
diff --git a/weed/command/shell.go b/weed/command/shell.go
index 2645f49326..f0aa1a30a7 100644
--- a/weed/command/shell.go
+++ b/weed/command/shell.go
@@ -3,6 +3,7 @@ package command
 import (
 	"fmt"
 	"os"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 
@@ -12,10 +13,11 @@ import (
 )
 
 var (
-	shellOptions      shell.ShellOptions
-	shellInitialFiler *string
-	shellCluster      *string
-	shellDebug        *bool
+	shellOptions        shell.ShellOptions
+	shellInitialFiler   *string
+	shellCluster        *string
+	shellDebug          *bool
+	shellConnectTimeout *time.Duration
 )
 
 func init() {
@@ -25,6 +27,7 @@ func init() {
 	shellInitialFiler = cmdShell.Flag.String("filer", "", "filer host and port for initial connection, e.g. localhost:8888")
 	shellCluster = cmdShell.Flag.String("cluster", "", "cluster defined in shell.toml")
 	shellDebug = cmdShell.Flag.Bool("debug", false, "print informational logs to stderr")
+	shellConnectTimeout = cmdShell.Flag.Duration("connectTimeout", 30*time.Second, "timeout for the initial master connection and filer discovery")
 }
 
 var cmdShell = &Command{
@@ -64,11 +67,16 @@ func runShell(command *Command, args []string) bool {
 	}
 	shellOptions.FilerAddress = pb.ServerAddress(filerAddress)
 	shellOptions.Debug = *shellDebug
+	shellOptions.ConnectTimeout = *shellConnectTimeout
 	if shellOptions.Debug {
 		fmt.Fprintf(os.Stderr, "master: %s filer: %s\n", *shellOptions.Masters, shellOptions.FilerAddress)
 	}
 
-	shell.RunShell(shellOptions)
+	if err := shell.RunShell(shellOptions); err != nil {
+		// The command already printed the error; a piped run has to fail the
+		// script wrapping it too.
+		SetCommandExitStatus(1)
+	}
 
 	return true
 
diff --git a/weed/command/shutdown.go b/weed/command/shutdown.go
new file mode 100644
index 0000000000..18a17616ad
--- /dev/null
+++ b/weed/command/shutdown.go
@@ -0,0 +1,53 @@
+package command
+
+import (
+	"context"
+	"net/http"
+	"sync"
+	"time"
+
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+func gracefulStopGrpc(grpcS *grpc.Server, timeout time.Duration) {
+	glog.V(0).Infof("Gracefully stopping gRPC server")
+	stopped := make(chan struct{})
+	go func() {
+		grpcS.GracefulStop()
+		close(stopped)
+	}()
+	select {
+	case <-stopped:
+		glog.V(0).Infof("gRPC server stopped gracefully")
+	case <-time.After(timeout):
+		glog.V(0).Infof("gRPC server graceful stop timed out after %s, forcing stop", timeout)
+		grpcS.Stop()
+	}
+}
+
+// newGracefulShutdown joins shutdown callers while gRPC and HTTP drain concurrently.
+func newGracefulShutdown(stopGrpc, closeServer func(), httpServers ...*http.Server) func() {
+	return sync.OnceFunc(func() {
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		var drained sync.WaitGroup
+		drained.Add(1)
+		go func() {
+			defer drained.Done()
+			stopGrpc()
+		}()
+		for _, server := range httpServers {
+			drained.Add(1)
+			go func() {
+				defer drained.Done()
+				if err := server.Shutdown(shutdownCtx); err != nil {
+					glog.Warningf("HTTP shutdown: %v", err)
+				}
+			}()
+		}
+		drained.Wait()
+		closeServer()
+	})
+}
diff --git a/weed/command/shutdown_test.go b/weed/command/shutdown_test.go
new file mode 100644
index 0000000000..9dd142a778
--- /dev/null
+++ b/weed/command/shutdown_test.go
@@ -0,0 +1,96 @@
+package command
+
+import (
+	"context"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
+)
+
+type blockingIamCache struct {
+	s3_pb.UnimplementedSeaweedS3IamCacheServer
+	entered chan struct{}
+	release chan struct{}
+}
+
+func (b *blockingIamCache) PutIdentity(ctx context.Context, _ *iam_pb.PutIdentityRequest) (*iam_pb.PutIdentityResponse, error) {
+	close(b.entered)
+	// Stop only cancels handler contexts; it cannot interrupt a handler that ignores them.
+	select {
+	case <-b.release:
+		return &iam_pb.PutIdentityResponse{}, nil
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+}
+
+func startBlockingGrpc(t *testing.T) (grpcS *grpc.Server, release func(), rpcErr chan error) {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler := &blockingIamCache{entered: make(chan struct{}), release: make(chan struct{})}
+	grpcS = grpc.NewServer()
+	s3_pb.RegisterSeaweedS3IamCacheServer(grpcS, handler)
+	go grpcS.Serve(listener)
+	t.Cleanup(grpcS.Stop)
+	release = sync.OnceFunc(func() { close(handler.release) })
+	t.Cleanup(release)
+
+	conn, err := grpc.NewClient(listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { conn.Close() })
+	rpcErr = make(chan error, 1)
+	go func() {
+		_, err := s3_pb.NewSeaweedS3IamCacheClient(conn).PutIdentity(context.Background(), &iam_pb.PutIdentityRequest{})
+		rpcErr <- err
+	}()
+	<-handler.entered
+	return grpcS, release, rpcErr
+}
+
+func TestGracefulStopGrpcWaitsForInFlightRPC(t *testing.T) {
+	grpcS, release, rpcErr := startBlockingGrpc(t)
+
+	stopped := make(chan struct{})
+	go func() { gracefulStopGrpc(grpcS, 5*time.Second); close(stopped) }()
+	select {
+	case <-stopped:
+		t.Fatal("gRPC stopped while an RPC was in flight")
+	case <-time.After(100 * time.Millisecond):
+	}
+	release()
+	if err := <-rpcErr; err != nil {
+		t.Errorf("in-flight RPC failed: %v", err)
+	}
+	select {
+	case <-stopped:
+	case <-time.After(5 * time.Second):
+		t.Fatal("gRPC graceful stop did not return after the RPC completed")
+	}
+}
+
+func TestGracefulStopGrpcForcesStopAfterTimeout(t *testing.T) {
+	grpcS, _, rpcErr := startBlockingGrpc(t)
+
+	stopped := make(chan struct{})
+	go func() { gracefulStopGrpc(grpcS, 50*time.Millisecond); close(stopped) }()
+	select {
+	case <-stopped:
+	case <-time.After(5 * time.Second):
+		t.Fatal("gRPC graceful stop did not honour its timeout")
+	}
+	if err := <-rpcErr; err == nil {
+		t.Error("in-flight RPC succeeded although the server was force-stopped")
+	}
+}
diff --git a/weed/command/upload.go b/weed/command/upload.go
index bb542a030c..def64adc77 100644
--- a/weed/command/upload.go
+++ b/weed/command/upload.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"sync"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
@@ -31,6 +32,7 @@ type UploadOptions struct {
 	diskType     *string
 	maxMB        *int
 	usePublicUrl *bool
+	concurrency  *int
 }
 
 func init() {
@@ -46,6 +48,7 @@ func init() {
 	upload.ttl = cmdUpload.Flag.String("ttl", "", "time to live, e.g.: 1m, 1h, 1d, 1M, 1y")
 	upload.maxMB = cmdUpload.Flag.Int("maxMB", 4, "split files larger than the limit")
 	upload.usePublicUrl = cmdUpload.Flag.Bool("usePublicUrl", false, "upload to public url from volume server")
+	upload.concurrency = cmdUpload.Flag.Int("c", 8, "concurrent file upload goroutines when uploading a folder")
 }
 
 var cmdUpload = &Command{
@@ -85,6 +88,7 @@ func runUpload(cmd *Command, args []string) bool {
 		if *upload.dir == "" {
 			return false
 		}
+		var filePaths []string
 		err = filepath.Walk(util.ResolvePath(*upload.dir), func(path string, info os.FileInfo, err error) error {
 			if err == nil {
 				if !info.IsDir() {
@@ -93,23 +97,7 @@ func runUpload(cmd *Command, args []string) bool {
 							return nil
 						}
 					}
-					parts, e := operation.NewFileParts([]string{path})
-					if e != nil {
-						return e
-					}
-					results, e := operation.SubmitFiles(func(_ context.Context) pb.ServerAddress { return pb.ServerAddress(*upload.master) }, grpcDialOption, parts, operation.StoragePreference{
-						Replication: *upload.replication,
-						Collection:  *upload.collection,
-						DataCenter:  *upload.dataCenter,
-						Ttl:         *upload.ttl,
-						DiskType:    *upload.diskType,
-						MaxMB:       *upload.maxMB,
-					}, *upload.usePublicUrl)
-					bytes, _ := json.Marshal(results)
-					fmt.Println(string(bytes))
-					if e != nil {
-						return e
-					}
+					filePaths = append(filePaths, path)
 				}
 			} else {
 				fmt.Println(err)
@@ -118,6 +106,72 @@ func runUpload(cmd *Command, args []string) bool {
 		})
 		if err != nil {
 			fmt.Println(err.Error())
+		}
+
+		concurrency := *upload.concurrency
+		if concurrency < 1 {
+			concurrency = 1
+		}
+		masterFn := func(_ context.Context) pb.ServerAddress { return pb.ServerAddress(*upload.master) }
+		pref := operation.StoragePreference{
+			Replication: *upload.replication,
+			Collection:  *upload.collection,
+			DataCenter:  *upload.dataCenter,
+			Ttl:         *upload.ttl,
+			DiskType:    *upload.diskType,
+			MaxMB:       *upload.maxMB,
+		}
+		results := make([][]operation.SubmitResult, len(filePaths))
+		ready := make([]chan struct{}, len(filePaths))
+		for index := range ready {
+			ready[index] = make(chan struct{})
+		}
+		printDone := make(chan bool, 1)
+		go func() {
+			failed := false
+			for index := range ready {
+				<-ready[index]
+				bytes, _ := json.Marshal(results[index])
+				fmt.Println(string(bytes))
+				for _, r := range results[index] {
+					if r.Error != "" {
+						failed = true
+					}
+				}
+			}
+			printDone <- failed
+		}()
+
+		sem := make(chan struct{}, concurrency)
+		var wg sync.WaitGroup
+		for index, filePath := range filePaths {
+			sem <- struct{}{}
+			wg.Add(1)
+			go func(index int, filePath string) {
+				defer close(ready[index])
+				defer wg.Done()
+				defer func() { <-sem }()
+				parts, e := operation.NewFileParts([]string{filePath})
+				if e != nil {
+					results[index] = []operation.SubmitResult{{FileName: filepath.Base(filePath), Error: e.Error()}}
+					return
+				}
+				fileResults, e := operation.SubmitFiles(masterFn, grpcDialOption, parts, pref, *upload.usePublicUrl)
+				if e != nil {
+					for i := range fileResults {
+						if fileResults[i].Error == "" {
+							fileResults[i].Error = e.Error()
+						}
+					}
+				}
+				results[index] = fileResults
+			}(index, filePath)
+		}
+		wg.Wait()
+		if <-printDone {
+			return false
+		}
+		if err != nil {
 			return false
 		}
 	} else {
@@ -134,12 +188,12 @@ func runUpload(cmd *Command, args []string) bool {
 			DiskType:    *upload.diskType,
 			MaxMB:       *upload.maxMB,
 		}, *upload.usePublicUrl)
+		bytes, _ := json.Marshal(results)
+		fmt.Println(string(bytes))
 		if err != nil {
 			fmt.Println(err.Error())
 			return false
 		}
-		bytes, _ := json.Marshal(results)
-		fmt.Println(string(bytes))
 	}
 	return true
 }
diff --git a/weed/command/volume.go b/weed/command/volume.go
index a2bd91c715..95b76409c1 100644
--- a/weed/command/volume.go
+++ b/weed/command/volume.go
@@ -61,6 +61,7 @@ type VolumeServerOptions struct {
 	memProfile                *string
 	compactionMBPerSecond     *int
 	maintenanceMBPerSecond    *int
+	maxParallelVacuumCommits  *int
 	fileSizeLimitMB           *int
 	concurrentUploadLimitMB   *int
 	concurrentDownloadLimitMB *int
@@ -75,6 +76,9 @@ type VolumeServerOptions struct {
 	readBufferSizeMB              *int
 	ldbTimeout                    *int64
 	allowUntrustedRemoteEndpoints *bool
+	fsyncMinBatchBytes            *int64
+	fsyncMinBatchRequests         *int
+	fsyncBatchWait                *time.Duration
 	debug                         *bool
 	debugPort                     *int
 	diskIOProbe                   *bool
@@ -146,6 +150,22 @@ func (v *VolumeServerOptions) setDiskIOProbeDefaults() {
 	}
 }
 
+// syncBatchOption resolves the fsync batch window, defaulting each field so
+// commands or embedders that leave the option pointers unset still start.
+func (v *VolumeServerOptions) syncBatchOption() storage.SyncBatchOption {
+	option := storage.DefaultSyncBatchOption
+	if v.fsyncMinBatchBytes != nil {
+		option.MinBytes = *v.fsyncMinBatchBytes
+	}
+	if v.fsyncMinBatchRequests != nil {
+		option.MinRequests = *v.fsyncMinBatchRequests
+	}
+	if v.fsyncBatchWait != nil {
+		option.Wait = *v.fsyncBatchWait
+	}
+	return option
+}
+
 func (v *VolumeServerOptions) applyDiskIOProbeConfig() {
 	v.setDiskIOProbeDefaults()
 
@@ -215,6 +235,7 @@ func init() {
 	v.memProfile = cmdVolume.Flag.String("memprofile", "", "memory profile output file")
 	v.compactionMBPerSecond = cmdVolume.Flag.Int("compactionMBps", 0, "limit background compaction or copying speed in mega bytes per second")
 	v.maintenanceMBPerSecond = cmdVolume.Flag.Int("maintenanceMBps", 0, "limit maintenance (replication / balance) IO rate in MB/s. Unset is 0, no limitation.")
+	v.maxParallelVacuumCommits = cmdVolume.Flag.Int("compactionMaxParallelCommits", 0, "limit how many vacuum commits run at once on this server; queued commits hold no volume lock. 0 means unlimited")
 	v.fileSizeLimitMB = cmdVolume.Flag.Int("fileSizeLimitMB", 256, "limit file size to avoid out of memory")
 	v.ldbTimeout = cmdVolume.Flag.Int64("index.leveldbTimeout", 0, "alive time for leveldb (default to 0). If leveldb of volume is not accessed in ldbTimeout hours, it will be off loaded to reduce opened files and memory consumption.")
 	v.concurrentUploadLimitMB = cmdVolume.Flag.Int("concurrentUploadLimitMB", 0, "limit total concurrent upload size, 0 means unlimited")
@@ -228,6 +249,9 @@ func init() {
 	v.hasSlowRead = cmdVolume.Flag.Bool("hasSlowRead", true, "<experimental> if true, this prevents slow reads from blocking other requests, but large file read P99 latency will increase.")
 	v.readBufferSizeMB = cmdVolume.Flag.Int("readBufferSizeMB", 4, "<experimental> larger values can optimize query performance but will increase some memory usage,Use with hasSlowRead normally.")
 	v.allowUntrustedRemoteEndpoints = cmdVolume.Flag.Bool("volume.allowUntrustedRemoteEndpoints", false, "if true, FetchAndWriteNeedle accepts arbitrary remote S3 endpoints including loopback / link-local hosts. Default rejects internal / metadata endpoints.")
+	v.fsyncMinBatchBytes = cmdVolume.Flag.Int64("fsyncMinBatchBytes", 1*1024*1024, "minimum bytes an fsync batch gathers before a drained queue flushes without waiting")
+	v.fsyncMinBatchRequests = cmdVolume.Flag.Int("fsyncMinBatchRequests", 128, "minimum requests an fsync batch gathers before a drained queue flushes without waiting")
+	v.fsyncBatchWait = cmdVolume.Flag.Duration("fsyncBatchWait", 500*time.Microsecond, "how long a below-minimum fsync batch waits for more requests once the queue drains; 0 flushes immediately")
 	v.debug = cmdVolume.Flag.Bool("debug", false, "serves runtime profiling data via pprof on the port specified by -debug.port")
 	v.debugPort = cmdVolume.Flag.Int("debug.port", 6060, "http port for debugging")
 	v.setDiskIOProbeDefaults()
@@ -293,11 +317,29 @@ func (v VolumeServerOptions) startVolumeServer(volumeFolders, maxVolumeCounts, v
 
 	// Set multiple folders and each folder's max volume count limit'
 	v.folders = strings.Split(volumeFolders, ",")
+	// Two locations on one directory would load every volume twice, appending to
+	// the same .dat under two independent locks. Compare identity rather than the
+	// path, so a symlink or bind mount aliasing an earlier -dir is caught too.
+	type seenFolder struct {
+		path string
+		info os.FileInfo
+	}
+	var seenFolders []seenFolder
 	for i, folder := range v.folders {
 		v.folders[i] = util.ResolvePath(folder)
 		if err := util.TestFolderWritable(v.folders[i]); err != nil {
 			glog.Fatalf("Check Data Folder(-dir) Writable %s : %s", v.folders[i], err)
 		}
+		folderInfo, err := os.Stat(v.folders[i])
+		if err != nil {
+			glog.Fatalf("Check Data Folder(-dir) %s : %s", v.folders[i], err)
+		}
+		for _, seen := range seenFolders {
+			if os.SameFile(seen.info, folderInfo) {
+				glog.Fatalf("Data Folder(-dir) %s and %s are the same directory", seen.path, v.folders[i])
+			}
+		}
+		seenFolders = append(seenFolders, seenFolder{v.folders[i], folderInfo})
 	}
 
 	// set max
@@ -396,24 +438,18 @@ func (v VolumeServerOptions) startVolumeServer(volumeFolders, maxVolumeCounts, v
 
 	// Determine volume server ID: if not specified, use ip:port
 	volumeServerId := util.GetVolumeServerId(*v.id, *v.ip, *v.port)
-	var slowLatency time.Duration
 
-	switch *v.diskType {
-	case "hdd":
-		slowLatency = *v.diskHDDIOSlowLatency
-	case "ssd":
-		slowLatency = *v.diskSSDIOSlowLatency
-	case "nvme":
-		slowLatency = *v.diskNVMEIOSlowLatency
-	default:
-		slowLatency = *v.diskHDDIOSlowLatency
-	}
 	diskProbeConfig := stats_collect.DiskIOProbeConfig{
 		Enabled:  *v.diskIOProbe,
 		Timeout:  *v.diskIOTimeout,
 		Interval: *v.diskIOInterval,
 
-		SlowLatency: slowLatency,
+		SlowLatency: *v.diskHDDIOSlowLatency,
+		SlowLatencyByDiskType: map[string]time.Duration{
+			types.HddType:  *v.diskHDDIOSlowLatency,
+			types.SsdType:  *v.diskSSDIOSlowLatency,
+			types.NvmeType: *v.diskNVMEIOSlowLatency,
+		},
 
 		Window:     *v.diskIOWindow,
 		MinSamples: *v.diskIOMinSamples,
@@ -425,10 +461,6 @@ func (v VolumeServerOptions) startVolumeServer(volumeFolders, maxVolumeCounts, v
 
 		RecoveryCoef: *v.diskRecoveryCoef,
 	}
-	if diskProbeConfig.Enabled && len(v.folders) > 1 {
-		glog.Warningf("disk IO probe is disabled for multiple volume directories: %v", v.folders)
-		diskProbeConfig.Enabled = false
-	}
 	volumeServer := weed_server.NewVolumeServer(volumeMux, publicVolumeMux,
 		*v.ip, *v.port, *v.portGrpc, *v.publicUrl, volumeServerId,
 		v.folders, v.folderMaxLimits, minFreeSpaces, diskTypes, folderTags,
@@ -439,6 +471,7 @@ func (v VolumeServerOptions) startVolumeServer(volumeFolders, maxVolumeCounts, v
 		*v.fixJpgOrientation, *v.readMode,
 		*v.compactionMBPerSecond,
 		*v.maintenanceMBPerSecond,
+		*v.maxParallelVacuumCommits,
 		*v.fileSizeLimitMB,
 		int64(*v.concurrentUploadLimitMB)*1024*1024,
 		int64(*v.concurrentDownloadLimitMB)*1024*1024,
@@ -449,6 +482,7 @@ func (v VolumeServerOptions) startVolumeServer(volumeFolders, maxVolumeCounts, v
 		*v.ldbTimeout,
 		*v.allowUntrustedRemoteEndpoints,
 		diskProbeConfig,
+		v.syncBatchOption(),
 	)
 	// starting grpc server
 	grpcS := v.startGrpcService(volumeServer)
@@ -562,15 +596,54 @@ func (v VolumeServerOptions) isSeparatedPublicPort() bool {
 	return *v.publicPort != *v.port
 }
 
+// multiHttpdownServer gracefully stops an http server serving on both the
+// bound ip and the localhost listeners as if it were a single server.
+type multiHttpdownServer []httpdown.Server
+
+// Wait returns the first member's non-nil error as soon as it happens, so a
+// failing localhost listener is reported even while the bound-ip listener
+// keeps serving, and nil once every member has finished cleanly.
+func (m multiHttpdownServer) Wait() error {
+	errs := make(chan error, len(m))
+	for _, s := range m {
+		go func(s httpdown.Server) { errs <- s.Wait() }(s)
+	}
+	for range m {
+		if err := <-errs; err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Stop stops all members concurrently so the localhost listener closes as
+// soon as shutdown begins instead of after the bound-ip listener drains.
+func (m multiHttpdownServer) Stop() error {
+	errs := make(chan error, len(m))
+	for _, s := range m {
+		go func(s httpdown.Server) { errs <- s.Stop() }(s)
+	}
+	var firstErr error
+	for range m {
+		if err := <-errs; err != nil && firstErr == nil {
+			firstErr = err
+		}
+	}
+	return firstErr
+}
+
 func (v VolumeServerOptions) startGrpcService(vs volume_server_pb.VolumeServerServer) *grpc.Server {
 	grpcPort := *v.portGrpc
-	grpcL, err := util.NewListener(util.JoinHostPort(*v.bindIp, grpcPort), 0)
+	grpcL, grpcLocalL, err := util.NewIpAndLocalListeners(*v.bindIp, grpcPort, 0)
 	if err != nil {
 		glog.Fatalf("failed to listen on grpc port %d: %v", grpcPort, err)
 	}
 	grpcS := pb.NewGrpcServer(security.LoadServerTLS(util.GetViper(), "grpc.volume"))
 	volume_server_pb.RegisterVolumeServerServer(grpcS, vs)
 	reflection.Register(grpcS)
+	if grpcLocalL != nil {
+		go grpcS.Serve(grpcLocalL)
+	}
 	go func() {
 		if err := grpcS.Serve(grpcL); err != nil {
 			glog.Fatalf("start gRPC service failed, %s", err)
@@ -583,13 +656,16 @@ func (v VolumeServerOptions) startGrpcService(vs volume_server_pb.VolumeServerSe
 func (v VolumeServerOptions) startPublicHttpService(handler http.Handler) httpdown.Server {
 	publicListeningAddress := util.JoinHostPort(*v.bindIp, *v.publicPort)
 	glog.V(0).Infoln("Start Seaweed volume server", version.Version(), "public at", publicListeningAddress)
-	publicListener, e := util.NewListener(publicListeningAddress, time.Duration(*v.idleConnectionTimeout)*time.Second)
+	publicListener, publicLocalListener, e := util.NewIpAndLocalListeners(*v.bindIp, *v.publicPort, time.Duration(*v.idleConnectionTimeout)*time.Second)
 	if e != nil {
 		glog.Fatalf("Volume server listener error:%v", e)
 	}
 
 	pubHttp := httpdown.HTTP{StopTimeout: 5 * time.Minute, KillTimeout: 5 * time.Minute}
-	publicHttpDown := pubHttp.Serve(&http.Server{Handler: handler}, publicListener)
+	publicHttpDown := multiHttpdownServer{pubHttp.Serve(&http.Server{Handler: handler}, publicListener)}
+	if publicLocalListener != nil {
+		publicHttpDown = append(publicHttpDown, pubHttp.Serve(&http.Server{Handler: handler}, publicLocalListener))
+	}
 	go func() {
 		if err := publicHttpDown.Wait(); err != nil {
 			glog.Errorf("public http down wait failed, %v", err)
@@ -616,7 +692,7 @@ func (v VolumeServerOptions) startClusterHttpService(handler http.Handler) (http
 
 	listeningAddress := util.JoinHostPort(*v.bindIp, *v.port)
 	glog.V(0).Infof("Start Seaweed volume server %s at %s", version.Version(), listeningAddress)
-	listener, e := util.NewListener(listeningAddress, time.Duration(*v.idleConnectionTimeout)*time.Second)
+	listener, localListener, e := util.NewIpAndLocalListeners(*v.bindIp, *v.port, time.Duration(*v.idleConnectionTimeout)*time.Second)
 	if e != nil {
 		glog.Fatalf("Volume server listener error:%v", e)
 	}
@@ -648,11 +724,15 @@ func (v VolumeServerOptions) startClusterHttpService(handler http.Handler) (http
 		httpS.TLSConfig.GetCertificate = getCert
 	}
 
-	clusterHttpServer := httpDown.Serve(httpS, listener)
+	clusterHttpServers := multiHttpdownServer{httpDown.Serve(httpS, listener)}
+	if localListener != nil {
+		localHttpS := &http.Server{Handler: handler, TLSConfig: httpS.TLSConfig}
+		clusterHttpServers = append(clusterHttpServers, httpDown.Serve(localHttpS, localListener))
+	}
 	go func() {
-		if e := clusterHttpServer.Wait(); e != nil {
+		if e := clusterHttpServers.Wait(); e != nil {
 			glog.Fatalf("Volume server fail to serve: %v", e)
 		}
 	}()
-	return clusterHttpServer, closeCert
+	return clusterHttpServers, closeCert
 }
diff --git a/weed/command/worker.go b/weed/command/worker.go
index bddb1c4241..1579c42fe9 100644
--- a/weed/command/worker.go
+++ b/weed/command/worker.go
@@ -1,6 +1,7 @@
 package command
 
 import (
+	"fmt"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/util"
@@ -25,21 +26,21 @@ Behavior:
   - Use -metricsPort/-metricsIp to expose /health, /ready, and /metrics
 
 Examples:
-  weed worker -admin=localhost:23646
-  weed worker -admin=localhost:23646 -jobType=all
-  weed worker -admin=localhost:23646 -jobType=default
-  weed worker -admin=localhost:23646 -jobType=heavy
-  weed worker -admin=localhost:23646 -jobType=default,iceberg
-  weed worker -admin=localhost:23646 -jobType=vacuum,volume_balance
-  weed worker -admin=localhost:23646 -jobType=erasure_coding
-  weed worker -admin=admin.example.com:23646 -id=plugin-vacuum-a -heartbeat=10s
-  weed worker -admin=localhost:23646 -workingDir=/var/lib/seaweedfs-plugin
-  weed worker -admin=localhost:23646 -metricsPort=9327 -metricsIp=0.0.0.0
+  weed worker -admin=localhost:12535
+  weed worker -admin=localhost:12535 -jobType=all
+  weed worker -admin=localhost:12535 -jobType=default
+  weed worker -admin=localhost:12535 -jobType=heavy
+  weed worker -admin=localhost:12535 -jobType=default,iceberg
+  weed worker -admin=localhost:12535 -jobType=vacuum,volume_balance
+  weed worker -admin=localhost:12535 -jobType=erasure_coding
+  weed worker -admin=admin.example.com:12535 -id=plugin-vacuum-a -heartbeat=10s
+  weed worker -admin=localhost:12535 -workingDir=/var/lib/seaweedfs-plugin
+  weed worker -admin=localhost:12535 -metricsPort=9327 -metricsIp=0.0.0.0
 `,
 }
 
 var (
-	workerAdminServer = cmdWorker.Flag.String("admin", "localhost:23646", "admin server address")
+	workerAdminServer = cmdWorker.Flag.String("admin", fmt.Sprintf("localhost:%d", defaultAdminHTTPPort), "admin server address")
 	workerID          = cmdWorker.Flag.String("id", "", "worker ID (auto-generated when empty)")
 	workerWorkingDir  = cmdWorker.Flag.String("workingDir", "", "working directory for persistent worker state")
 	workerJobType     = cmdWorker.Flag.String("jobType", defaultPluginWorkerJobTypes, "job types or categories to serve: all, default, heavy, or explicit names/aliases such as ec, balance, iceberg (comma-separated)")
diff --git a/weed/command/worker_runtime.go b/weed/command/worker_runtime.go
index 894edb5526..ff8d00d94d 100644
--- a/weed/command/worker_runtime.go
+++ b/weed/command/worker_runtime.go
@@ -45,7 +45,7 @@ func runPluginWorkerWithOptions(options pluginWorkerRunOptions) bool {
 
 	options.AdminServer = strings.TrimSpace(options.AdminServer)
 	if options.AdminServer == "" {
-		options.AdminServer = "localhost:23646"
+		options.AdminServer = fmt.Sprintf("localhost:%d", defaultAdminHTTPPort)
 	}
 
 	options.JobTypes = strings.TrimSpace(options.JobTypes)
@@ -82,7 +82,7 @@ func runPluginWorkerWithOptions(options pluginWorkerRunOptions) bool {
 		return false
 	}
 
-	handlers, err := buildPluginWorkerHandlers(options.JobTypes, dialOption, options.MaxExecute, options.WorkingDir)
+	handlers, err := buildPluginWorkerHandlers(options.JobTypes, dialOption, options.MaxExecute, options.WorkingDir, options.Address)
 	if err != nil {
 		glog.Errorf("Failed to build plugin worker handlers: %v", err)
 		return false
@@ -141,7 +141,7 @@ func resolvePluginWorkerID(explicitID string, workingDir string) (string, error)
 // buildPluginWorkerHandlers resolves the comma-separated jobTypes string
 // (which may contain category names like "all", "default", "heavy" and/or
 // explicit job type names/aliases) into a deduplicated slice of JobHandlers.
-func buildPluginWorkerHandlers(jobTypes string, dialOption grpc.DialOption, maxExecute int, workingDir string) ([]pluginworker.JobHandler, error) {
+func buildPluginWorkerHandlers(jobTypes string, dialOption grpc.DialOption, maxExecute int, workingDir string, workerAddress ...string) ([]pluginworker.JobHandler, error) {
 	jobTypes = strings.TrimSpace(jobTypes)
 	if jobTypes == "" {
 		jobTypes = defaultPluginWorkerJobTypes
@@ -152,10 +152,16 @@ func buildPluginWorkerHandlers(jobTypes string, dialOption grpc.DialOption, maxE
 		return nil, err
 	}
 
+	addr := ""
+	if len(workerAddress) > 0 {
+		addr = strings.TrimSpace(workerAddress[0])
+	}
+
 	opts := pluginworker.HandlerBuildOptions{
 		GrpcDialOption: dialOption,
 		MaxExecute:     maxExecute,
 		WorkingDir:     workingDir,
+		WorkerAddress:  addr,
 	}
 
 	handlers := make([]pluginworker.JobHandler, 0, len(factories))
diff --git a/weed/credential/credential_manager.go b/weed/credential/credential_manager.go
index ec37b2a8e0..7bf84c9670 100644
--- a/weed/credential/credential_manager.go
+++ b/weed/credential/credential_manager.go
@@ -15,6 +15,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
 )
 
 // FilerAddressSetter is an interface for credential stores that need a dynamic filer address
@@ -168,15 +169,16 @@ func (cm *CredentialManager) SaveConfiguration(ctx context.Context, config *iam_
 	staticNames := cm.staticNames
 	cm.staticMu.RUnlock()
 	if len(staticNames) > 0 {
-		var dynamicOnly []*iam_pb.Identity
-		for _, ident := range config.Identities {
+		configCopy := proto.Clone(config).(*iam_pb.S3ApiConfiguration)
+		dynamicOnly := configCopy.Identities[:0]
+		for _, ident := range configCopy.Identities {
 			if !staticNames[ident.Name] {
 				dynamicOnly = append(dynamicOnly, ident)
 			}
 		}
-		configCopy := *config
+		clear(configCopy.Identities[len(dynamicOnly):])
 		configCopy.Identities = dynamicOnly
-		return cm.Store.SaveConfiguration(ctx, &configCopy)
+		return cm.Store.SaveConfiguration(ctx, configCopy)
 	}
 	return cm.Store.SaveConfiguration(ctx, config)
 }
diff --git a/weed/credential/credential_manager_snapshot_test.go b/weed/credential/credential_manager_snapshot_test.go
new file mode 100644
index 0000000000..41c6d4628d
--- /dev/null
+++ b/weed/credential/credential_manager_snapshot_test.go
@@ -0,0 +1,46 @@
+package credential
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"google.golang.org/protobuf/proto"
+)
+
+type snapshotConfigurationStore struct {
+	CredentialStore
+	saved *iam_pb.S3ApiConfiguration
+}
+
+func (s *snapshotConfigurationStore) SaveConfiguration(_ context.Context, config *iam_pb.S3ApiConfiguration) error {
+	s.saved = config
+	return nil
+}
+
+func TestSaveConfigurationFiltersStaticIdentitySnapshot(t *testing.T) {
+	t.Parallel()
+	store := &snapshotConfigurationStore{}
+	manager := &CredentialManager{Store: store}
+	manager.SetStaticIdentities([]*iam_pb.Identity{{Name: "static"}})
+	source := &iam_pb.S3ApiConfiguration{Identities: []*iam_pb.Identity{
+		{Name: "alice", Actions: []string{"Read"}},
+		{Name: "static"},
+		{Name: "bob", Actions: []string{"Write"}},
+	}}
+	before := proto.Clone(source)
+	if err := manager.SaveConfiguration(context.Background(), source); err != nil {
+		t.Fatal(err)
+	}
+	if store.saved == nil || len(store.saved.Identities) != 2 || store.saved.Identities[0].Name != "alice" || store.saved.Identities[1].Name != "bob" {
+		t.Fatalf("unexpected saved configuration: %v", store.saved)
+	}
+	if !proto.Equal(source, before) {
+		t.Fatal("filtering mutated the caller's configuration")
+	}
+	store.saved.Identities[0].Actions[0] = "Admin"
+	store.saved.Identities[1].Name = "changed"
+	if !proto.Equal(source, before) {
+		t.Fatal("saved identities alias the caller's configuration")
+	}
+}
diff --git a/weed/credential/filer_etc/filer_etc_group.go b/weed/credential/filer_etc/filer_etc_group.go
index 36a5d4fb40..4d78cd5fe8 100644
--- a/weed/credential/filer_etc/filer_etc_group.go
+++ b/weed/credential/filer_etc/filer_etc_group.go
@@ -30,6 +30,9 @@ func (store *FilerEtcStore) loadGroupsFromMultiFile(ctx context.Context, s3cfg *
 			if entry.IsDirectory {
 				continue
 			}
+			if !strings.HasSuffix(entry.Name, ".json") {
+				continue
+			}
 
 			var content []byte
 			if len(entry.Content) > 0 {
@@ -42,24 +45,28 @@ func (store *FilerEtcStore) loadGroupsFromMultiFile(ctx context.Context, s3cfg *
 				content = c
 			}
 
-			if len(content) > 0 {
-				g := &iam_pb.Group{}
-				if err := json.Unmarshal(content, g); err != nil {
-					return fmt.Errorf("failed to unmarshal group %s: %w", entry.Name, err)
-				}
-				// Merge: overwrite existing group with same name or append
-				found := false
-				for i, existing := range s3cfg.Groups {
-					if existing.Name == g.Name {
-						s3cfg.Groups[i] = g
-						found = true
-						break
-					}
-				}
-				if !found {
-					s3cfg.Groups = append(s3cfg.Groups, g)
+			if len(content) == 0 {
+				return fmt.Errorf("group file %s is empty", entry.Name)
+			}
+			g := &iam_pb.Group{}
+			if err := json.Unmarshal(content, g); err != nil {
+				return fmt.Errorf("failed to unmarshal group %s: %w", entry.Name, err)
+			}
+			if g.Name == "" {
+				return fmt.Errorf("group file %s has empty name", entry.Name)
+			}
+			// Merge: overwrite existing group with same name or append
+			found := false
+			for i, existing := range s3cfg.Groups {
+				if existing.Name == g.Name {
+					s3cfg.Groups[i] = g
+					found = true
+					break
 				}
 			}
+			if !found {
+				s3cfg.Groups = append(s3cfg.Groups, g)
+			}
 		}
 		return nil
 	})
diff --git a/weed/credential/filer_etc/filer_etc_identity.go b/weed/credential/filer_etc/filer_etc_identity.go
index 518b299b54..cdf59ca714 100644
--- a/weed/credential/filer_etc/filer_etc_identity.go
+++ b/weed/credential/filer_etc/filer_etc_identity.go
@@ -92,6 +92,9 @@ func (store *FilerEtcStore) loadFromMultiFile(ctx context.Context, s3cfg *iam_pb
 			if entry.IsDirectory {
 				continue
 			}
+			if !strings.HasSuffix(entry.Name, ".json") {
+				continue
+			}
 			hasIdentities = true
 
 			var content []byte
@@ -100,26 +103,28 @@ func (store *FilerEtcStore) loadFromMultiFile(ctx context.Context, s3cfg *iam_pb
 			} else {
 				c, err := filer.ReadInsideFiler(ctx, client, dir, entry.Name)
 				if err != nil {
-					// fail the snapshot: a skipped identity would read as deleted
 					return fmt.Errorf("failed to read identity file %s: %w", entry.Name, err)
 				}
 				content = c
 			}
 
-			if len(content) > 0 {
-				identity := &iam_pb.Identity{}
-				if err := json.Unmarshal(content, identity); err != nil {
-					glog.Warningf("Failed to unmarshal identity %s: %v", entry.Name, err)
-					continue
-				}
+			if len(content) == 0 {
+				return fmt.Errorf("identity file %s is empty", entry.Name)
+			}
+			identity := &iam_pb.Identity{}
+			if err := json.Unmarshal(content, identity); err != nil {
+				return fmt.Errorf("failed to unmarshal identity %s: %w", entry.Name, err)
+			}
+			if identity.Name == "" {
+				return fmt.Errorf("identity file %s has empty name", entry.Name)
+			}
 
-				// Merge logic: Overwrite existing or Append
-				idx := findIdentity(identity.Name)
-				if idx != -1 {
-					s3cfg.Identities[idx] = identity
-				} else {
-					s3cfg.Identities = append(s3cfg.Identities, identity)
-				}
+			// Merge logic: Overwrite existing or Append
+			idx := findIdentity(identity.Name)
+			if idx != -1 {
+				s3cfg.Identities[idx] = identity
+			} else {
+				s3cfg.Identities = append(s3cfg.Identities, identity)
 			}
 		}
 		return nil
@@ -209,10 +214,7 @@ func (store *FilerEtcStore) SaveConfiguration(ctx context.Context, config *iam_p
 		for _, entry := range entries {
 			if !entry.IsDirectory && !validNames[entry.Name] {
 				// Delete obsolete identity file
-				if _, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-					Directory: dir,
-					Name:      entry.Name,
-				}); err != nil {
+				if err := filer_pb.DoRemove(ctx, client, dir, entry.Name, false, false, false, false, nil); err != nil {
 					glog.Warningf("Failed to delete obsolete identity file %s: %v", entry.Name, err)
 				}
 			}
@@ -240,10 +242,7 @@ func (store *FilerEtcStore) SaveConfiguration(ctx context.Context, config *iam_p
 
 		for _, entry := range entries {
 			if !entry.IsDirectory && !validNames[entry.Name] {
-				if _, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-					Directory: dir,
-					Name:      entry.Name,
-				}); err != nil {
+				if err := filer_pb.DoRemove(ctx, client, dir, entry.Name, false, false, false, false, nil); err != nil {
 					glog.Warningf("Failed to delete obsolete service account file %s: %v", entry.Name, err)
 				}
 			}
@@ -271,14 +270,8 @@ func (store *FilerEtcStore) SaveConfiguration(ctx context.Context, config *iam_p
 
 		for _, entry := range entries {
 			if !entry.IsDirectory && !validNames[entry.Name] {
-				resp, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-					Directory: dir,
-					Name:      entry.Name,
-				})
-				if err != nil {
+				if err := filer_pb.DoRemove(ctx, client, dir, entry.Name, false, false, false, false, nil); err != nil {
 					glog.Warningf("Failed to delete obsolete group file %s: %v", entry.Name, err)
-				} else if resp != nil && resp.Error != "" {
-					glog.Warningf("Failed to delete obsolete group file %s: %s", entry.Name, resp.Error)
 				}
 			}
 		}
@@ -341,7 +334,7 @@ func (store *FilerEtcStore) DeleteUser(ctx context.Context, username string) err
 	}
 
 	return store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		_, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
+		resp, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
 			Directory: filer.IamConfigDirectory + "/" + IamIdentitiesDirectory,
 			Name:      username + ".json",
 		})
@@ -351,6 +344,12 @@ func (store *FilerEtcStore) DeleteUser(ctx context.Context, username string) err
 			}
 			return err
 		}
+		if resp != nil && resp.Error != "" {
+			if strings.Contains(resp.Error, filer_pb.ErrNotFound.Error()) {
+				return credential.ErrUserNotFound
+			}
+			return fmt.Errorf("delete user %s: %s", username, resp.Error)
+		}
 		return nil
 	})
 }
diff --git a/weed/credential/filer_etc/filer_etc_identity_test.go b/weed/credential/filer_etc/filer_etc_identity_test.go
new file mode 100644
index 0000000000..27d182c234
--- /dev/null
+++ b/weed/credential/filer_etc/filer_etc_identity_test.go
@@ -0,0 +1,144 @@
+package filer_etc
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func putEntry(t *testing.T, server *policyTestFilerServer, dir, name string, content []byte) {
+	t.Helper()
+	_, err := server.CreateEntry(context.Background(), &filer_pb.CreateEntryRequest{
+		Directory: dir,
+		Entry:     &filer_pb.Entry{Name: name, Content: content},
+	})
+	require.NoError(t, err)
+}
+
+// A mid-rewrite identity file (empty content, as seen while a secrets tool
+// truncates and rewrites the file) must fail the snapshot instead of being
+// silently dropped. Silently dropping it would make a full reload install an
+// incomplete identity set and deny unrelated clients mid-reload.
+func TestLoadConfigurationFailsOnEmptyIdentityFile(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
+	putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice","credentials":[{"accessKey":"AK","secretKey":"SK"}]}`))
+	putEntry(t, server, identDir, "bob.json", []byte{}) // mid-rewrite: empty
+
+	_, err := store.LoadConfiguration(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "bob.json")
+}
+
+// A malformed identity file (partial JSON from a mid-rewrite) must also fail
+// the snapshot rather than being skipped.
+func TestLoadConfigurationFailsOnMalformedIdentityFile(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
+	putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice"}`))
+	putEntry(t, server, identDir, "bob.json", []byte(`{"name":"bob"`)) // truncated
+
+	_, err := store.LoadConfiguration(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "bob.json")
+}
+
+// A mid-rewrite policy file must fail the snapshot rather than be dropped.
+func TestLoadManagedPoliciesFailsOnEmptyPolicyFile(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	polDir := filer.IamConfigDirectory + "/" + IamPoliciesDirectory
+	putEntry(t, server, polDir, "good.json", []byte(`{"Version":"2012-10-17","Statement":[]}`))
+	putEntry(t, server, polDir, "bad.json", []byte{}) // mid-rewrite: empty
+
+	_, err := store.LoadManagedPolicies(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "bad.json")
+}
+
+// A non-JSON auxiliary file (README, .DS_Store, a migration backup) in an IAM
+// directory must not fail the snapshot: only *.json files are IAM objects.
+func TestLoadConfigurationIgnoresNonJsonAuxiliaryFiles(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
+	putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice","credentials":[{"accessKey":"AK","secretKey":"SK"}]}`))
+	putEntry(t, server, identDir, "README.txt", []byte(`not an identity`))
+	putEntry(t, server, identDir, "alice.json.old", []byte(`{"name":"alice"}`))
+
+	polDir := filer.IamConfigDirectory + "/" + IamPoliciesDirectory
+	putEntry(t, server, polDir, "p.json", []byte(`{"Version":"2012-10-17","Statement":[]}`))
+	putEntry(t, server, polDir, "notes.md", []byte(`# policies`))
+
+	cfg, err := store.LoadConfiguration(ctx)
+	require.NoError(t, err)
+	require.Len(t, cfg.Identities, 1)
+	assert.Equal(t, "alice", cfg.Identities[0].Name)
+}
+
+// A valid JSON file with an empty name (e.g. `{}`) would unmarshal cleanly but
+// install a garbage empty-key record that can displace a real one. Reject it.
+func TestLoadConfigurationFailsOnEmptyIdentityName(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
+	putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice"}`))
+	putEntry(t, server, identDir, "empty.json", []byte(`{}`))
+
+	_, err := store.LoadConfiguration(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "empty.json")
+}
+
+func TestLoadConfigurationFailsOnEmptyGroupName(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	groupDir := filer.IamConfigDirectory + "/" + IamGroupsDirectory
+	putEntry(t, server, groupDir, "empty.json", []byte(`{}`))
+
+	_, err := store.LoadConfiguration(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "empty.json")
+}
+
+func TestLoadConfigurationFailsOnEmptyServiceAccountId(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	saDir := filer.IamConfigDirectory + "/" + IamServiceAccountsDirectory
+	putEntry(t, server, saDir, "empty.json", []byte(`{}`))
+
+	_, err := store.LoadConfiguration(ctx)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "empty.json")
+}
+
+// A valid full snapshot loads without error (regression guard).
+func TestLoadConfigurationSucceedsOnValidFiles(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	identDir := filer.IamConfigDirectory + "/" + IamIdentitiesDirectory
+	putEntry(t, server, identDir, "alice.json", []byte(`{"name":"alice","credentials":[{"accessKey":"AK","secretKey":"SK"}]}`))
+	putEntry(t, server, identDir, "bob.json", []byte(`{"name":"bob","credentials":[{"accessKey":"BK","secretKey":"SK"}]}`))
+
+	cfg, err := store.LoadConfiguration(ctx)
+	require.NoError(t, err)
+	names := make([]string, 0, len(cfg.Identities))
+	for _, id := range cfg.Identities {
+		names = append(names, id.Name)
+	}
+	assert.ElementsMatch(t, []string{"alice", "bob"}, names)
+}
diff --git a/weed/credential/filer_etc/filer_etc_policy.go b/weed/credential/filer_etc/filer_etc_policy.go
index 9bf2e98ff8..d4544b7498 100644
--- a/weed/credential/filer_etc/filer_etc_policy.go
+++ b/weed/credential/filer_etc/filer_etc_policy.go
@@ -181,6 +181,9 @@ func (store *FilerEtcStore) loadPoliciesFromMultiFile(ctx context.Context, polic
 			if entry.IsDirectory {
 				continue
 			}
+			if !strings.HasSuffix(entry.Name, ".json") {
+				continue
+			}
 
 			var content []byte
 			if len(entry.Content) > 0 {
@@ -188,26 +191,21 @@ func (store *FilerEtcStore) loadPoliciesFromMultiFile(ctx context.Context, polic
 			} else {
 				c, err := filer.ReadInsideFiler(ctx, client, dir, entry.Name)
 				if err != nil {
-					// fail the snapshot: a skipped policy would read as deleted
 					return fmt.Errorf("failed to read policy file %s: %w", entry.Name, err)
 				}
 				content = c
 			}
 
-			if len(content) > 0 {
-				var policy policy_engine.PolicyDocument
-				if err := json.Unmarshal(content, &policy); err != nil {
-					glog.Warningf("Failed to unmarshal policy %s: %v", entry.Name, err)
-					continue
-				}
-
-				// The file name is "policyName.json"
-				policyName := entry.Name
-				if strings.HasSuffix(policyName, ".json") {
-					policyName = policyName[:len(policyName)-5]
-					policies[policyName] = policy
-				}
+			if len(content) == 0 {
+				return fmt.Errorf("policy file %s is empty", entry.Name)
 			}
+			var policy policy_engine.PolicyDocument
+			if err := json.Unmarshal(content, &policy); err != nil {
+				return fmt.Errorf("failed to unmarshal policy %s: %w", entry.Name, err)
+			}
+
+			policyName := strings.TrimSuffix(entry.Name, ".json")
+			policies[policyName] = policy
 		}
 		return nil
 	})
@@ -263,14 +261,7 @@ func (store *FilerEtcStore) DeletePolicy(ctx context.Context, name string) error
 	}
 
 	if err := store.withFilerClient(func(client filer_pb.SeaweedFilerClient) error {
-		_, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-			Directory: filer.IamConfigDirectory + "/" + IamPoliciesDirectory,
-			Name:      name + ".json",
-		})
-		if err != nil && !strings.Contains(err.Error(), filer_pb.ErrNotFound.Error()) {
-			return err
-		}
-		return nil
+		return filer_pb.DoRemove(ctx, client, filer.IamConfigDirectory+"/"+IamPoliciesDirectory, name+".json", false, false, false, false, nil)
 	}); err != nil {
 		return err
 	}
@@ -505,10 +496,10 @@ func (store *FilerEtcStore) ListPolicyNames(ctx context.Context) ([]string, erro
 			if entry.IsDirectory {
 				continue
 			}
-			name := entry.Name
-			if strings.HasSuffix(name, ".json") {
-				name = name[:len(name)-5]
+			if !strings.HasSuffix(entry.Name, ".json") {
+				continue
 			}
+			name := entry.Name[:len(entry.Name)-5]
 			if _, found := seenNames[name]; found {
 				continue
 			}
diff --git a/weed/credential/filer_etc/filer_etc_policy_test.go b/weed/credential/filer_etc/filer_etc_policy_test.go
index d64cb5fd5c..47b034ebc9 100644
--- a/weed/credential/filer_etc/filer_etc_policy_test.go
+++ b/weed/credential/filer_etc/filer_etc_policy_test.go
@@ -192,6 +192,22 @@ func TestFilerEtcStoreListPolicyNamesIncludesLegacyPolicies(t *testing.T) {
 	assert.ElementsMatch(t, []string{"legacy-only", "multi-file-only", "shared"}, names)
 }
 
+// A non-JSON auxiliary file in the policies directory must not be listed as a
+// policy name (it cannot be retrieved by GetPolicy either).
+func TestFilerEtcStoreListPolicyNamesSkipsNonJsonAuxiliary(t *testing.T) {
+	ctx := context.Background()
+	store, server := newPolicyTestStoreWithServer(t)
+
+	require.NoError(t, store.savePolicy(ctx, "real", testPolicyDocument("s3:GetObject", "arn:aws:s3:::real/*")))
+
+	polDir := filer.IamConfigDirectory + "/" + IamPoliciesDirectory
+	putEntry(t, server, polDir, "notes.md", []byte(`# not a policy`))
+
+	names, err := store.ListPolicyNames(ctx)
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"real"}, names)
+}
+
 func TestFilerEtcStoreDeletePolicyRemovesLegacyManagedCopy(t *testing.T) {
 	ctx := context.Background()
 	store := newPolicyTestStore(t)
diff --git a/weed/credential/filer_etc/filer_etc_service_account.go b/weed/credential/filer_etc/filer_etc_service_account.go
index 2f8b3a480f..20c6a3843e 100644
--- a/weed/credential/filer_etc/filer_etc_service_account.go
+++ b/weed/credential/filer_etc/filer_etc_service_account.go
@@ -33,6 +33,9 @@ func (store *FilerEtcStore) loadServiceAccountsFromMultiFile(ctx context.Context
 			if entry.IsDirectory {
 				continue
 			}
+			if !strings.HasSuffix(entry.Name, ".json") {
+				continue
+			}
 
 			var content []byte
 			if len(entry.Content) > 0 {
@@ -40,20 +43,22 @@ func (store *FilerEtcStore) loadServiceAccountsFromMultiFile(ctx context.Context
 			} else {
 				c, err := filer.ReadInsideFiler(ctx, client, dir, entry.Name)
 				if err != nil {
-					glog.Warningf("Failed to read service account file %s: %v", entry.Name, err)
-					continue
+					return fmt.Errorf("failed to read service account file %s: %w", entry.Name, err)
 				}
 				content = c
 			}
 
-			if len(content) > 0 {
-				sa := &iam_pb.ServiceAccount{}
-				if err := json.Unmarshal(content, sa); err != nil {
-					glog.Warningf("Failed to unmarshal service account %s: %v", entry.Name, err)
-					continue
-				}
-				s3cfg.ServiceAccounts = append(s3cfg.ServiceAccounts, sa)
+			if len(content) == 0 {
+				return fmt.Errorf("service account file %s is empty", entry.Name)
 			}
+			sa := &iam_pb.ServiceAccount{}
+			if err := json.Unmarshal(content, sa); err != nil {
+				return fmt.Errorf("failed to unmarshal service account %s: %w", entry.Name, err)
+			}
+			if err := validateServiceAccountId(sa.Id); err != nil {
+				return fmt.Errorf("service account file %s: %w", entry.Name, err)
+			}
+			s3cfg.ServiceAccounts = append(s3cfg.ServiceAccounts, sa)
 		}
 		return nil
 	})
diff --git a/weed/credential/grpc/grpc_identity.go b/weed/credential/grpc/grpc_identity.go
index 831bad6175..0acbba550f 100644
--- a/weed/credential/grpc/grpc_identity.go
+++ b/weed/credential/grpc/grpc_identity.go
@@ -120,13 +120,20 @@ func (store *IamGrpcStore) CreateAccessKey(ctx context.Context, username string,
 }
 
 func (store *IamGrpcStore) DeleteAccessKey(ctx context.Context, username string, accessKey string) error {
-	return store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
+	err := store.withIamClient(ctx, func(ctx context.Context, client iam_pb.SeaweedIdentityAccessManagementClient) error {
 		_, err := client.DeleteAccessKey(ctx, &iam_pb.DeleteAccessKeyRequest{
 			Username:  username,
 			AccessKey: accessKey,
 		})
 		return err
 	})
+	// The filer-side handler returns gRPC NotFound when the user or the key is
+	// absent; translate back to the sentinel so callers can use
+	// errors.Is(err, credential.ErrAccessKeyNotFound) uniformly across stores.
+	if err != nil && status.Code(err) == codes.NotFound {
+		return credential.ErrAccessKeyNotFound
+	}
+	return err
 }
 
 // AttachUserPolicy attaches a managed policy to a user by policy name
diff --git a/weed/credential/grpc/grpc_store_test.go b/weed/credential/grpc/grpc_store_test.go
index c157cc1438..ac2d546774 100644
--- a/weed/credential/grpc/grpc_store_test.go
+++ b/weed/credential/grpc/grpc_store_test.go
@@ -2,6 +2,7 @@ package grpc
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"strings"
@@ -106,3 +107,50 @@ func TestIamGrpcStore_AdminBearerToken(t *testing.T) {
 		}
 	})
 }
+
+// TestIamGrpcStore_DeleteAccessKeyNotFound pins the not-found translation:
+// the filer reports a missing user or key as gRPC NotFound, and the store must
+// surface it as credential.ErrAccessKeyNotFound so repeat deletes stay a no-op
+// for IAM dispatchers that tolerate the sentinel.
+func TestIamGrpcStore_DeleteAccessKeyNotFound(t *testing.T) {
+	const goodKey = "iam-admin-itest-key"
+
+	cm, err := credential.NewCredentialManager(credential.StoreTypeMemory, nil, "")
+	if err != nil {
+		t.Fatalf("NewCredentialManager: %v", err)
+	}
+	defer cm.Shutdown()
+
+	iamSrv := weed_server.NewIamGrpcServer(cm, security.SigningKey(goodKey))
+
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcSrv := grpc.NewServer()
+	iam_pb.RegisterSeaweedIdentityAccessManagementServer(grpcSrv, iamSrv)
+	go func() { _ = grpcSrv.Serve(lis) }()
+	t.Cleanup(grpcSrv.Stop)
+
+	_, portStr, err := net.SplitHostPort(lis.Addr().String())
+	if err != nil {
+		t.Fatalf("split listener addr: %v", err)
+	}
+	serverAddr := pb.ServerAddress(fmt.Sprintf("127.0.0.1:0.%s", portStr))
+
+	store := &IamGrpcStore{}
+	store.SetFilerAddressFunc(func() pb.ServerAddress { return serverAddr }, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	store.SetAdminSigning(security.SigningKey(goodKey), 0)
+
+	ctx := context.Background()
+	if err := store.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}); err != nil {
+		t.Fatalf("CreateUser: %v", err)
+	}
+
+	if err := store.DeleteAccessKey(ctx, "alice", "AKIAMISSING0000000001"); !errors.Is(err, credential.ErrAccessKeyNotFound) {
+		t.Fatalf("DeleteAccessKey with missing key: got %v, want ErrAccessKeyNotFound", err)
+	}
+	if err := store.DeleteAccessKey(ctx, "ghost", "AKIAMISSING0000000001"); !errors.Is(err, credential.ErrAccessKeyNotFound) {
+		t.Fatalf("DeleteAccessKey with missing user: got %v, want ErrAccessKeyNotFound", err)
+	}
+}
diff --git a/weed/credential/memory/memory_identity.go b/weed/credential/memory/memory_identity.go
index 9b578b1529..404b879770 100644
--- a/weed/credential/memory/memory_identity.go
+++ b/weed/credential/memory/memory_identity.go
@@ -142,6 +142,14 @@ func (store *MemoryStore) UpdateUser(ctx context.Context, username string, ident
 		return credential.ErrUserNotFound
 	}
 
+	if identity.Name != username {
+		// Rename: the destination name must not already be taken, matching
+		// RenameUser's collision check.
+		if _, clash := store.users[identity.Name]; clash {
+			return credential.ErrUserAlreadyExists
+		}
+	}
+
 	// Remove old access keys from index
 	for _, cred := range existingUser.Credentials {
 		delete(store.accessKeys, cred.AccessKey)
@@ -156,11 +164,15 @@ func (store *MemoryStore) UpdateUser(ctx context.Context, username string, ident
 
 	// Deep copy to avoid mutation issues
 	identityCopy := store.deepCopyIdentity(identity)
-	store.users[username] = identityCopy
+	if identityCopy.Name != username {
+		// Rename: re-key the record, the way filer_etc does (delete old, save new).
+		delete(store.users, username)
+	}
+	store.users[identityCopy.Name] = identityCopy
 
 	// Re-index access keys
 	for _, cred := range identity.Credentials {
-		store.accessKeys[cred.AccessKey] = username
+		store.accessKeys[cred.AccessKey] = identityCopy.Name
 	}
 
 	return nil
diff --git a/weed/credential/memory/memory_store_test.go b/weed/credential/memory/memory_store_test.go
index 2b292fc1b4..52ce01cc7b 100644
--- a/weed/credential/memory/memory_store_test.go
+++ b/weed/credential/memory/memory_store_test.go
@@ -378,3 +378,82 @@ func TestMemoryStoreServiceAccountByAccessKey(t *testing.T) {
 		t.Errorf("Expected ErrAccessKeyNotFound after delete, got %v", err)
 	}
 }
+
+// TestMemoryStoreUpdateUserRename: UpdateUser with an identity whose Name
+// differs from the key must re-key the record, the way filer_etc does
+// (delete old, save new). The IAM rename path relies on this.
+func TestMemoryStoreUpdateUserRename(t *testing.T) {
+	store := &MemoryStore{}
+	if err := store.Initialize(util.GetViper(), "credential."); err != nil {
+		t.Fatalf("Failed to initialize store: %v", err)
+	}
+	ctx := context.Background()
+
+	err := store.CreateUser(ctx, &iam_pb.Identity{
+		Name:        "oldname",
+		Credentials: []*iam_pb.Credential{{AccessKey: "access123", SecretKey: "secret123"}},
+	})
+	if err != nil {
+		t.Fatalf("Failed to create user: %v", err)
+	}
+
+	err = store.UpdateUser(ctx, "oldname", &iam_pb.Identity{
+		Name:        "newname",
+		Credentials: []*iam_pb.Credential{{AccessKey: "access123", SecretKey: "secret123"}},
+	})
+	if err != nil {
+		t.Fatalf("Failed to rename user via UpdateUser: %v", err)
+	}
+
+	if _, err := store.GetUser(ctx, "oldname"); err != credential.ErrUserNotFound {
+		t.Fatalf("Expected ErrUserNotFound for old name, got %v", err)
+	}
+	renamed, err := store.GetUser(ctx, "newname")
+	if err != nil {
+		t.Fatalf("Failed to get renamed user: %v", err)
+	}
+	if renamed.Name != "newname" {
+		t.Errorf("Expected 'newname', got '%s'", renamed.Name)
+	}
+	byKey, err := store.GetUserByAccessKey(ctx, "access123")
+	if err != nil {
+		t.Fatalf("Access key must resolve to the renamed user: %v", err)
+	}
+	if byKey.Name != "newname" {
+		t.Errorf("Expected access key owner 'newname', got '%s'", byKey.Name)
+	}
+}
+
+// TestMemoryStoreUpdateUserRenameCollision: a rename whose destination name is
+// taken must fail rather than overwrite the existing user.
+func TestMemoryStoreUpdateUserRenameCollision(t *testing.T) {
+	store := &MemoryStore{}
+	if err := store.Initialize(util.GetViper(), "credential."); err != nil {
+		t.Fatalf("Failed to initialize store: %v", err)
+	}
+	ctx := context.Background()
+
+	if err := store.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}); err != nil {
+		t.Fatalf("Failed to create alice: %v", err)
+	}
+	if err := store.CreateUser(ctx, &iam_pb.Identity{
+		Name:        "bob",
+		Credentials: []*iam_pb.Credential{{AccessKey: "bobkey123", SecretKey: "secret123"}},
+	}); err != nil {
+		t.Fatalf("Failed to create bob: %v", err)
+	}
+
+	err := store.UpdateUser(ctx, "alice", &iam_pb.Identity{Name: "bob"})
+	if err != credential.ErrUserAlreadyExists {
+		t.Fatalf("Expected ErrUserAlreadyExists, got %v", err)
+	}
+
+	// Both users must be intact.
+	if _, err := store.GetUser(ctx, "alice"); err != nil {
+		t.Fatalf("alice must still exist: %v", err)
+	}
+	bob, err := store.GetUserByAccessKey(ctx, "bobkey123")
+	if err != nil || bob.Name != "bob" {
+		t.Fatalf("bob's access key must still resolve to bob: %v", err)
+	}
+}
diff --git a/weed/credential/propagating_store.go b/weed/credential/propagating_store.go
index f561d2007e..9e2699bd12 100644
--- a/weed/credential/propagating_store.go
+++ b/weed/credential/propagating_store.go
@@ -13,8 +13,11 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
 )
 
 var _ CredentialStore = &PropagatingCredentialStore{}
@@ -48,6 +51,24 @@ func (s *PropagatingCredentialStore) SetFilerAddressFunc(getFiler func() pb.Serv
 	}
 }
 
+// WithS3InternalAdminAuth attaches a Bearer token signed with
+// jwt.filer_signing.key to the outgoing context so the S3 gateway's internal
+// gRPC handlers (IAM cache, lifecycle) accept the call. With no key configured
+// it is a no-op, matching the S3 handler's checkAdminAuth. Returns the token's
+// lifetime (0 = no expiry) so callers can cap any downstream timeout below it.
+func WithS3InternalAdminAuth(ctx context.Context) (context.Context, time.Duration) {
+	signingKey := util.GetViper().GetString("jwt.filer_signing.key")
+	if signingKey == "" {
+		return ctx, 0
+	}
+	expiresAfterSec := util.GetViper().GetInt("jwt.filer_signing.expires_after_seconds")
+	token := security.GenJwtForFilerAdmin(security.SigningKey(signingKey), expiresAfterSec)
+	if token == "" {
+		return ctx, 0
+	}
+	return metadata.AppendToOutgoingContext(ctx, "authorization", security.BearerPrefix+string(token)), time.Duration(expiresAfterSec) * time.Second
+}
+
 func (s *PropagatingCredentialStore) propagateChange(ctx context.Context, fn func(context.Context, s3_pb.SeaweedS3IamCacheClient) error) {
 	if s.masterClient == nil {
 		return
@@ -55,7 +76,7 @@ func (s *PropagatingCredentialStore) propagateChange(ctx context.Context, fn fun
 
 	// List S3 servers
 	var s3Servers []string
-	err := s.masterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err := s.masterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
 		glog.V(4).Infof("IAM: listing S3 servers (FilerGroup: '%s')", s.masterClient.FilerGroup)
 		resp, err := client.ListClusterNodes(ctx, &master_pb.ListClusterNodesRequest{
 			ClientType: cluster.S3Type,
@@ -77,8 +98,16 @@ func (s *PropagatingCredentialStore) propagateChange(ctx context.Context, fn fun
 	}
 	glog.V(1).Infof("IAM: propagating change to %d S3 servers: %v", len(s3Servers), s3Servers)
 
-	// Create context with timeout for the propagation process
-	propagateCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	// Mint the admin token after master discovery so master retries can't burn
+	// through the token lifetime before the peer fan-out begins. Cap the
+	// propagation deadline below the token's expiry so slower peers don't see
+	// an expired token.
+	authedCtx, tokenTTL := WithS3InternalAdminAuth(ctx)
+	propagateTimeout := 10 * time.Second
+	if tokenTTL > 0 && tokenTTL < propagateTimeout {
+		propagateTimeout = tokenTTL
+	}
+	propagateCtx, cancel := context.WithTimeout(authedCtx, propagateTimeout)
 	defer cancel()
 
 	var wg sync.WaitGroup
diff --git a/weed/credential/propagating_store_auth_test.go b/weed/credential/propagating_store_auth_test.go
new file mode 100644
index 0000000000..a200d1fa6e
--- /dev/null
+++ b/weed/credential/propagating_store_auth_test.go
@@ -0,0 +1,64 @@
+package credential
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/metadata"
+)
+
+func TestWithS3InternalAdminAuth_NoKey_NoOp(t *testing.T) {
+	util.GetViper().Set("jwt.filer_signing.key", "")
+	ctx, ttl := WithS3InternalAdminAuth(context.Background())
+	if ttl != 0 {
+		t.Fatalf("expected zero TTL without key, got %v", ttl)
+	}
+	md, ok := metadata.FromOutgoingContext(ctx)
+	if ok && len(md.Get("authorization")) > 0 {
+		t.Fatalf("expected no authorization metadata without key, got %v", md.Get("authorization"))
+	}
+}
+
+func TestWithS3InternalAdminAuth_WithKey_AttachesBearer(t *testing.T) {
+	const k = "propagation-test-signing-key"
+	util.GetViper().Set("jwt.filer_signing.key", k)
+	defer util.GetViper().Set("jwt.filer_signing.key", "")
+	util.GetViper().Set("jwt.filer_signing.expires_after_seconds", 60)
+
+	ctx, ttl := WithS3InternalAdminAuth(context.Background())
+	if ttl != 60*time.Second {
+		t.Fatalf("expected 60s TTL, got %v", ttl)
+	}
+	md, ok := metadata.FromOutgoingContext(ctx)
+	if !ok {
+		t.Fatal("expected outgoing metadata to be set")
+	}
+	headers := md.Get("authorization")
+	if len(headers) != 1 {
+		t.Fatalf("expected one authorization header, got %v", headers)
+	}
+	if !strings.HasPrefix(headers[0], security.BearerPrefix) {
+		t.Fatalf("expected Bearer scheme, got %q", headers[0])
+	}
+	token := strings.TrimPrefix(headers[0], security.BearerPrefix)
+	parsed, err := security.DecodeJwt(security.SigningKey(k), security.EncodedJwt(token), &security.SeaweedFilerAdminClaims{})
+	if err != nil || parsed == nil || !parsed.Valid {
+		t.Fatalf("attached token failed signature validation: %v", err)
+	}
+}
+
+func TestWithS3InternalAdminAuth_ZeroExpiry_ZeroTTL(t *testing.T) {
+	const k = "propagation-test-signing-key"
+	util.GetViper().Set("jwt.filer_signing.key", k)
+	defer util.GetViper().Set("jwt.filer_signing.key", "")
+	util.GetViper().Set("jwt.filer_signing.expires_after_seconds", 0)
+
+	_, ttl := WithS3InternalAdminAuth(context.Background())
+	if ttl != 0 {
+		t.Fatalf("expected zero TTL for no-expiry token, got %v", ttl)
+	}
+}
diff --git a/weed/ec/ec_balance_migrate_test.go b/weed/ec/ec_balance_migrate_test.go
new file mode 100644
index 0000000000..aeeb3835bc
--- /dev/null
+++ b/weed/ec/ec_balance_migrate_test.go
@@ -0,0 +1,63 @@
+package ec
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// TestEcBalanceMigratesCrossDiskTypeShards: a cross-tier encode generates its
+// shards beside the source .dat — in the SOURCE disk-type bucket — while the
+// encode's balance targets -diskType. The balance must still see and spread
+// those shards when the volume is named as migrating; without that, the
+// planner finds nothing in the target bucket, plans no moves, and the encode's
+// spread guard aborts a perfectly good encode.
+func TestEcBalanceMigratesCrossDiskTypeShards(t *testing.T) {
+	allShards := []erasure_coding.ShardId{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}
+
+	build := func() []*EcNode {
+		// Volume 1's fresh shards sit in the default (hdd, "") bucket of dn1;
+		// the balance runs with -diskType=ssd.
+		return []*EcNode{
+			newEcNode("dc1", "rack1", "dn1", 100).addEcVolumeAndShardsForTest(1, "c1", allShards),
+			newEcNode("dc1", "rack2", "dn2", 100),
+			newEcNode("dc1", "rack3", "dn3", 100),
+		}
+	}
+
+	// Without the migrating hint the target-bucket filter hides the shards:
+	// nothing moves. This is the standalone ec.balance semantic — shards of
+	// other tiers stay where they are.
+	ecb := &ecBalancer{
+		ecNodes:        build(),
+		applyBalancing: false,
+		diskType:       types.SsdType,
+	}
+	if err := ecb.balance([]string{"c1"}); err != nil {
+		t.Fatalf("balance without migrating hint: %v", err)
+	}
+	if got := ecb.ecNodes[0].LocalShardIdCount(1); got != len(allShards) {
+		t.Fatalf("without migrating hint, cross-type shards must stay put; dn1 has %d", got)
+	}
+
+	// With the volume named as migrating, the balance ingests the shards from
+	// the source bucket and spreads them.
+	ecb = &ecBalancer{
+		ecNodes:            build(),
+		applyBalancing:     false,
+		diskType:           types.SsdType,
+		migratingVolumeIds: map[uint32]bool{1: true},
+	}
+	if err := ecb.balance([]string{"c1"}); err != nil {
+		t.Fatalf("balance with migrating hint: %v", err)
+	}
+	onDn1 := ecb.ecNodes[0].LocalShardIdCount(1)
+	spread := ecb.ecNodes[1].LocalShardIdCount(1) + ecb.ecNodes[2].LocalShardIdCount(1)
+	if onDn1 == len(allShards) || spread == 0 {
+		t.Fatalf("migrating volume's shards did not spread: dn1=%d others=%d", onDn1, spread)
+	}
+	if onDn1+spread != len(allShards) {
+		t.Fatalf("shards lost or duplicated during dry-run spread: dn1=%d others=%d", onDn1, spread)
+	}
+}
diff --git a/weed/ec/ec_balance_no_space_test.go b/weed/ec/ec_balance_no_space_test.go
new file mode 100644
index 0000000000..1b41cfde9a
--- /dev/null
+++ b/weed/ec/ec_balance_no_space_test.go
@@ -0,0 +1,359 @@
+package ec
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding/ecbalancer"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// ecBalanceFakeServer answers the EC-shard RPC subset a balance run drives:
+// copy (rejected when full), mount, inventory, unmount, delete. The disk state
+// a real server tracks lives in shards; what the planner saw is rebuilt from it
+// through FetchTopology, so a landed move is visible to the next plan.
+type ecBalanceFakeServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+
+	mu        sync.Mutex
+	shards    map[uint32]map[uint32]bool // vid -> shardId -> present
+	full      bool                       // VolumeEcShardsCopy answers "no space left"
+	copyCalls int
+	grpcAddr  string
+	stop      func()
+}
+
+func (f *ecBalanceFakeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_server_pb.VolumeEcShardsCopyRequest) (*volume_server_pb.VolumeEcShardsCopyResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.copyCalls++
+	if f.full {
+		return nil, fmt.Errorf("no space left")
+	}
+	return &volume_server_pb.VolumeEcShardsCopyResponse{}, nil
+}
+
+func (f *ecBalanceFakeServer) VolumeEcShardsMount(ctx context.Context, req *volume_server_pb.VolumeEcShardsMountRequest) (*volume_server_pb.VolumeEcShardsMountResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, sid := range req.ShardIds {
+		f.shards[req.VolumeId][sid] = true
+	}
+	return &volume_server_pb.VolumeEcShardsMountResponse{}, nil
+}
+
+func (f *ecBalanceFakeServer) VolumeEcShardsInfo(ctx context.Context, req *volume_server_pb.VolumeEcShardsInfoRequest) (*volume_server_pb.VolumeEcShardsInfoResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	resp := &volume_server_pb.VolumeEcShardsInfoResponse{}
+	for sid := range f.shards[req.VolumeId] {
+		resp.EcShardInfos = append(resp.EcShardInfos, &volume_server_pb.EcShardInfo{
+			VolumeId: req.VolumeId,
+			ShardId:  sid,
+			Size:     1,
+		})
+	}
+	return resp, nil
+}
+
+func (f *ecBalanceFakeServer) VolumeEcShardsUnmount(ctx context.Context, req *volume_server_pb.VolumeEcShardsUnmountRequest) (*volume_server_pb.VolumeEcShardsUnmountResponse, error) {
+	return &volume_server_pb.VolumeEcShardsUnmountResponse{}, nil
+}
+
+func (f *ecBalanceFakeServer) VolumeEcShardsDelete(ctx context.Context, req *volume_server_pb.VolumeEcShardsDeleteRequest) (*volume_server_pb.VolumeEcShardsDeleteResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, sid := range req.ShardIds {
+		delete(f.shards[req.VolumeId], sid)
+	}
+	return &volume_server_pb.VolumeEcShardsDeleteResponse{}, nil
+}
+
+// nodeId returns the "host:httpPort.grpcPort" node id form the cluster uses, so
+// ToGrpcAddress resolves to this server's listener.
+func (f *ecBalanceFakeServer) nodeId() string {
+	host, port, err := net.SplitHostPort(f.grpcAddr)
+	if err != nil {
+		return f.grpcAddr
+	}
+	return fmt.Sprintf("%s:1.%s", host, port)
+}
+
+func (f *ecBalanceFakeServer) shardCount(vid uint32) int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.shards[vid])
+}
+
+func startEcBalanceFakeServer(t *testing.T, vid uint32, present ...uint32) *ecBalanceFakeServer {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	f := &ecBalanceFakeServer{
+		shards:   map[uint32]map[uint32]bool{vid: {}},
+		grpcAddr: listener.Addr().String(),
+	}
+	for _, sid := range present {
+		f.shards[vid][sid] = true
+	}
+
+	server := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(server, f)
+	go func() { _ = server.Serve(listener) }()
+	f.stop = server.Stop
+	t.Cleanup(server.Stop)
+	return f
+}
+
+// fetchEcBalanceTopology builds a FetchTopology that reports the fake servers'
+// live shard inventory.
+func fetchEcBalanceTopology(servers []*ecBalanceFakeServer) func(delay time.Duration) (*master_pb.TopologyInfo, uint64, error) {
+	return func(delay time.Duration) (*master_pb.TopologyInfo, uint64, error) {
+		var nodes []*master_pb.DataNodeInfo
+		for _, f := range servers {
+			di := &master_pb.DiskInfo{Type: string(types.HardDriveType), MaxVolumeCount: 100}
+			f.mu.Lock()
+			for v, set := range f.shards {
+				if len(set) == 0 {
+					continue
+				}
+				si := erasure_coding.NewShardsInfo()
+				for sid := range set {
+					si.Set(erasure_coding.NewShardInfo(erasure_coding.ShardId(sid), 1))
+				}
+				di.EcShardInfos = append(di.EcShardInfos, &master_pb.VolumeEcShardInformationMessage{
+					Id:          v,
+					Collection:  "c1",
+					EcIndexBits: si.Bitmap(),
+					ShardSizes:  si.SizesInt64(),
+					DiskType:    string(types.HardDriveType),
+				})
+			}
+			f.mu.Unlock()
+			nodes = append(nodes, &master_pb.DataNodeInfo{
+				Id:        f.nodeId(),
+				DiskInfos: map[string]*master_pb.DiskInfo{string(types.HardDriveType): di},
+			})
+		}
+		return &master_pb.TopologyInfo{
+			DataCenterInfos: []*master_pb.DataCenterInfo{{
+				Id: "dc1",
+				RackInfos: []*master_pb.RackInfo{{
+					Id:            "r1",
+					DataNodeInfos: nodes,
+				}},
+			}},
+		}, 0, nil
+	}
+}
+
+// TestEcBalanceReplanAfterNoSpaceLeft reproduces seaweedfs/seaweedfs#11753:
+// the planner works from heartbeat free-slot counts that can disagree with the
+// volume server's own check, so a planned target can reject the copy with
+// "no space left" mid-run. The balance must re-plan without that node as a
+// target rather than fail the whole run.
+func TestEcBalanceReplanAfterNoSpaceLeft(t *testing.T) {
+	const vid = uint32(1)
+	var allShards []uint32
+	for sid := 0; sid < erasure_coding.DataShardsCount+erasure_coding.ParityShardsCount; sid++ {
+		allShards = append(allShards, uint32(sid))
+	}
+
+	full := startEcBalanceFakeServer(t, vid)
+	accept := startEcBalanceFakeServer(t, vid)
+	source := startEcBalanceFakeServer(t, vid, allShards...)
+	full.full = true
+
+	env := &Env{
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		FetchTopology:  fetchEcBalanceTopology([]*ecBalanceFakeServer{source, full, accept}),
+	}
+
+	err := EcBalance(env, []string{"c1"}, "", nil, types.HardDriveType, 3, 0, true, nil, nil, nil)
+	if err != nil {
+		t.Fatalf("balance should re-plan around the full target, got: %v", err)
+	}
+	if full.copyCalls == 0 {
+		t.Fatalf("expected the full server to have rejected at least one copy")
+	}
+	if got := full.shardCount(vid); got != 0 {
+		t.Fatalf("full server should receive no shards, holds %d", got)
+	}
+	total := source.shardCount(vid) + full.shardCount(vid) + accept.shardCount(vid)
+	if total != len(allShards) {
+		t.Fatalf("shards lost or duplicated: total %d, want %d", total, len(allShards))
+	}
+	if source.shardCount(vid) == len(allShards) {
+		t.Fatalf("no shards were moved off the source")
+	}
+}
+
+// TestEcBalanceReplanAfterNoSpaceLeftStaleSnapshot serves the pre-move
+// topology on every collection after the first, simulating a master heartbeat
+// that lags the landed moves. The re-plan must replay its completed moves onto
+// the stale snapshot instead of re-moving shards off the deleted source.
+func TestEcBalanceReplanAfterNoSpaceLeftStaleSnapshot(t *testing.T) {
+	const vid = uint32(1)
+	var allShards []uint32
+	for sid := 0; sid < erasure_coding.DataShardsCount+erasure_coding.ParityShardsCount; sid++ {
+		allShards = append(allShards, uint32(sid))
+	}
+
+	full := startEcBalanceFakeServer(t, vid)
+	accept := startEcBalanceFakeServer(t, vid)
+	source := startEcBalanceFakeServer(t, vid, allShards...)
+	full.full = true
+
+	live := fetchEcBalanceTopology([]*ecBalanceFakeServer{source, full, accept})
+	var stale *master_pb.TopologyInfo
+	calls := 0
+	fetchTopology := func(delay time.Duration) (*master_pb.TopologyInfo, uint64, error) {
+		topo, size, err := live(delay)
+		if err != nil {
+			return nil, 0, err
+		}
+		calls++
+		if stale == nil {
+			stale = topo
+		}
+		if calls > 1 {
+			return stale, size, nil
+		}
+		return topo, size, nil
+	}
+
+	env := &Env{
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		FetchTopology:  fetchTopology,
+	}
+
+	err := EcBalance(env, []string{"c1"}, "", nil, types.HardDriveType, 3, 0, true, nil, nil, nil)
+	if err != nil {
+		t.Fatalf("balance should re-plan around the full target, got: %v", err)
+	}
+	if calls < 2 {
+		t.Fatalf("expected a re-plan, topology collected %d time(s)", calls)
+	}
+	// Each shard lands on the accepting server exactly once; a stale re-plan
+	// would copy already-moved shards again.
+	if got, want := accept.copyCalls, accept.shardCount(vid); got != want {
+		t.Fatalf("accepting server saw %d copies for %d held shards: completed moves were re-planned", got, want)
+	}
+	total := source.shardCount(vid) + full.shardCount(vid) + accept.shardCount(vid)
+	if total != len(allShards) {
+		t.Fatalf("shards lost or duplicated: total %d, want %d", total, len(allShards))
+	}
+}
+
+// TestEcBalanceNoReceivingTargetFails surfaces the refusal when every
+// destination that could take a shard has rejected a copy, rather than
+// reporting success for a plan that moved nothing.
+func TestEcBalanceNoReceivingTargetFails(t *testing.T) {
+	const vid = uint32(1)
+	var allShards []uint32
+	for sid := 0; sid < erasure_coding.DataShardsCount+erasure_coding.ParityShardsCount; sid++ {
+		allShards = append(allShards, uint32(sid))
+	}
+
+	full := startEcBalanceFakeServer(t, vid)
+	source := startEcBalanceFakeServer(t, vid, allShards...)
+	full.full = true
+
+	env := &Env{
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		FetchTopology:  fetchEcBalanceTopology([]*ecBalanceFakeServer{source, full}),
+	}
+
+	err := EcBalance(env, []string{"c1"}, "", nil, types.HardDriveType, 3, 0, true, nil, nil, nil)
+	if err == nil {
+		t.Fatalf("balance with no receiving target should fail")
+	}
+	if !strings.Contains(err.Error(), "no space left") {
+		t.Fatalf("expected the refusal to surface, got: %v", err)
+	}
+}
+
+// TestApplyCompletedMovesReplaysDiskState checks that replaying a landed move
+// onto a stale snapshot carries the shard's disk attribution and the per-disk
+// slot accounting, so a re-plan does not treat the just-filled disk as empty.
+func TestApplyCompletedMovesReplaysDiskState(t *testing.T) {
+	const vid = uint32(1)
+
+	source := newEcNode("dc1", "r1", "dn1", 99)
+	source.Info.DiskInfos["hdd"] = &master_pb.DiskInfo{
+		Type: "hdd",
+		EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{{
+			Id:          vid,
+			Collection:  "c1",
+			DiskId:      1,
+			DiskType:    "hdd",
+			EcIndexBits: uint32(erasure_coding.ShardBits(0).Set(5)),
+		}},
+	}
+	si := erasure_coding.NewShardsInfo()
+	si.Set(erasure_coding.NewShardInfo(5, 1))
+	source.Disks = map[uint32]*EcDisk{
+		1: {DiskId: 1, DiskType: "hdd", FreeEcSlots: 99, EcShardCount: 1, EcShards: map[needle.VolumeId]*erasure_coding.ShardsInfo{1: si}},
+	}
+
+	target := newEcNode("dc1", "r1", "dn2", 100)
+	target.Disks = map[uint32]*EcDisk{
+		1: {DiskId: 1, DiskType: "hdd", FreeEcSlots: 10, EcShardCount: 0, EcShards: map[needle.VolumeId]*erasure_coding.ShardsInfo{}},
+		2: {DiskId: 2, DiskType: "hdd", FreeEcSlots: 10, EcShardCount: 0, EcShards: map[needle.VolumeId]*erasure_coding.ShardsInfo{}},
+	}
+
+	nodes := []*EcNode{source, target}
+	move := ecbalancer.Move{
+		VolumeID:   vid,
+		ShardID:    5,
+		Collection: "c1",
+		SourceNode: "dn1",
+		TargetNode: "dn2",
+		TargetDisk: 2,
+		Phase:      "within_rack",
+	}
+	applyCompletedMoves(nodes, []ecbalancer.Move{move}, types.HardDriveType)
+
+	if ecNodeHasShard(source, needle.VolumeId(vid), 5) {
+		t.Fatalf("source still holds shard 5")
+	}
+	if d := source.Disks[1]; d.EcShardCount != 0 || d.FreeEcSlots != 100 {
+		t.Fatalf("source disk counts not restored: %+v", d)
+	}
+	if !ecNodeHasShard(target, needle.VolumeId(vid), 5) {
+		t.Fatalf("target missing shard 5")
+	}
+	if d := target.Disks[2]; d.EcShardCount != 1 || d.FreeEcSlots != 9 {
+		t.Fatalf("target disk 2 not charged: %+v", d)
+	}
+	if d := target.Disks[1]; d.EcShardCount != 0 {
+		t.Fatalf("shard attributed to wrong disk: %+v", d)
+	}
+	if target.FreeEcSlot != 99 {
+		t.Fatalf("target free slots = %d, want 99", target.FreeEcSlot)
+	}
+
+	// Replaying again (or onto a fresher snapshot) must not double-count.
+	applyCompletedMoves(nodes, []ecbalancer.Move{move}, types.HardDriveType)
+	if d := target.Disks[2]; d.EcShardCount != 1 || d.FreeEcSlots != 9 {
+		t.Fatalf("double-applied move: %+v", d)
+	}
+	if target.FreeEcSlot != 99 {
+		t.Fatalf("target free slots = %d, want 99", target.FreeEcSlot)
+	}
+}
diff --git a/weed/ec/ec_check_replication.go b/weed/ec/ec_check_replication.go
new file mode 100644
index 0000000000..6f445b482f
--- /dev/null
+++ b/weed/ec/ec_check_replication.go
@@ -0,0 +1,211 @@
+package ec
+
+import (
+	"fmt"
+	"io"
+	"slices"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+)
+
+// CheckEcVolumeReplication reports EC volumes with under- or over-replicated
+// shards among the given data nodes. volumeIDs, when non-empty, narrows the
+// check to those volume ids.
+func CheckEcVolumeReplication(writer io.Writer, dataNodes []*master_pb.DataNodeInfo, volumeIDs map[uint32]bool, showDetails bool) error {
+	runner := &ecCheckReplicationRunner{
+		writer:      writer,
+		dataNodes:   dataNodes,
+		volumeIDMap: volumeIDs,
+	}
+	return runner.checkEcVolumes(showDetails)
+}
+
+type ecCheckReplicationRunner struct {
+	writer      io.Writer
+	dataNodes   []*master_pb.DataNodeInfo
+	volumeIDMap map[uint32]bool
+}
+
+func (r *ecCheckReplicationRunner) write(format string, a ...any) {
+	fmt.Fprintf(r.writer, format, a...)
+}
+
+func (r *ecCheckReplicationRunner) isVolumeIDValid(vid uint32) bool {
+	if len(r.volumeIDMap) == 0 {
+		return true
+	}
+	return r.volumeIDMap[vid]
+}
+
+// ecVolumeShardReplication aggregates the observed shards for a single EC volume,
+// together with the data+parity ratio the volume was encoded with. The ratio is
+// taken per volume (via erasure_coding.EcShardsVolume*Shards) so custom EC
+// ratios are checked against their own expected shard count.
+type ecVolumeShardReplication struct {
+	dataShards   int
+	parityShards int
+	// shardAddresses maps a shard id to the sorted node addresses hosting it.
+	shardAddresses map[erasure_coding.ShardId][]string
+}
+
+func (h *ecVolumeShardReplication) totalShards() int {
+	return h.dataShards + h.parityShards
+}
+
+// replicaCount is the total number of shard copies observed, counting each
+// over-replicated shard once per hosting node.
+func (h *ecVolumeShardReplication) replicaCount() int {
+	n := 0
+	for _, addrs := range h.shardAddresses {
+		n += len(addrs)
+	}
+	return n
+}
+
+// unexpectedShardIds returns, in ascending order, any observed shard ids that
+// fall outside the volume's expected data+parity range. These are anomalies
+// (e.g. a stray shard) and are treated as over-replication.
+func (h *ecVolumeShardReplication) unexpectedShardIds() []erasure_coding.ShardId {
+	var ids []erasure_coding.ShardId
+	for sid := range h.shardAddresses {
+		if int(sid) >= h.totalShards() {
+			ids = append(ids, sid)
+		}
+	}
+	slices.Sort(ids)
+	return ids
+}
+
+// TODO: check shard sizes?
+func (r *ecCheckReplicationRunner) checkEcVolumes(showDetails bool) error {
+	// collect EC shard placement, keyed by volume id
+	volumes := map[uint32]*ecVolumeShardReplication{}
+	for _, dni := range r.dataNodes {
+		nodeAddress := dni.GetAddress()
+		for _, di := range dni.GetDiskInfos() {
+			for _, eci := range di.GetEcShardInfos() {
+				vid := eci.GetId()
+				if !r.isVolumeIDValid(vid) {
+					continue
+				}
+
+				h, ok := volumes[vid]
+				if !ok {
+					// all shards of a volume share one ratio; take it from the
+					// first shard message seen for the volume.
+					h = &ecVolumeShardReplication{
+						dataShards:     erasure_coding.EcShardsVolumeDataShards(eci),
+						parityShards:   erasure_coding.EcShardsVolumeParityShards(eci),
+						shardAddresses: map[erasure_coding.ShardId][]string{},
+					}
+					volumes[vid] = h
+				}
+
+				sinfo := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
+				for _, sid := range sinfo.Ids() {
+					h.shardAddresses[sid] = append(h.shardAddresses[sid], nodeAddress)
+				}
+			}
+		}
+	}
+
+	if len(volumes) == 0 {
+		// Asking about specific volume IDs that turn out not to be EC volumes is
+		// an error; an unfiltered run over a cluster with no EC volumes is a
+		// legitimate, healthy state rather than a failure.
+		if len(r.volumeIDMap) > 0 {
+			return fmt.Errorf("no EC volumes found")
+		}
+		r.write("No EC volumes found.\n")
+		return nil
+	}
+
+	// keep the shard address lists nicely sorted, for the sake of readability.
+	for _, h := range volumes {
+		for _, addrs := range h.shardAddresses {
+			slices.Sort(addrs)
+		}
+	}
+
+	// classify each volume against its own expected shard count
+	underreplicatedVolumeIDs := []uint32{}
+	overreplicatedVolumeIDs := []uint32{}
+	for vid, h := range volumes {
+		under := false
+		over := false
+		for sid := 0; sid < h.totalShards(); sid++ {
+			switch len(h.shardAddresses[erasure_coding.ShardId(sid)]) {
+			case 0:
+				under = true
+			case 1:
+			default:
+				over = true
+			}
+		}
+		// shard ids beyond the expected data+parity range are unexpected extras,
+		// i.e. redundant data the ratio doesn't call for.
+		if len(h.unexpectedShardIds()) > 0 {
+			over = true
+		}
+
+		// under- and over-replication are independent problems (missing shards risk
+		// data loss, redundant shards waste space), so a volume exhibiting both is
+		// reported in both lists.
+		if under {
+			underreplicatedVolumeIDs = append(underreplicatedVolumeIDs, vid)
+		}
+		if over {
+			overreplicatedVolumeIDs = append(overreplicatedVolumeIDs, vid)
+		}
+	}
+	slices.Sort(underreplicatedVolumeIDs)
+	slices.Sort(overreplicatedVolumeIDs)
+
+	// ...and display results
+	if len(underreplicatedVolumeIDs) == 0 && len(overreplicatedVolumeIDs) == 0 {
+		r.write("EC volumes are healthy.\n")
+		return nil
+	}
+
+	if len(underreplicatedVolumeIDs) != 0 {
+		r.write("Found %d/%d under-replicated EC volumes: %v\n", len(underreplicatedVolumeIDs), len(volumes), underreplicatedVolumeIDs)
+	}
+	if len(overreplicatedVolumeIDs) != 0 {
+		r.write("Found %d/%d over-replicated EC volumes: %v\n", len(overreplicatedVolumeIDs), len(volumes), overreplicatedVolumeIDs)
+	}
+
+	if showDetails {
+		if len(underreplicatedVolumeIDs) != 0 {
+			r.write("\n")
+			r.writeShardMaps("under-replicated", underreplicatedVolumeIDs, volumes)
+		}
+		if len(overreplicatedVolumeIDs) != 0 {
+			r.write("\n")
+			r.writeShardMaps("over-replicated", overreplicatedVolumeIDs, volumes)
+		}
+	}
+
+	return nil
+}
+
+func (r *ecCheckReplicationRunner) writeShardMaps(kind string, volumeIDs []uint32, volumes map[uint32]*ecVolumeShardReplication) {
+	for _, vid := range volumeIDs {
+		h := volumes[vid]
+		r.write("Shards map for %s EC volume %v (%d/%d shards):\n", kind, vid, h.replicaCount(), h.totalShards())
+		for sid := 0; sid < h.totalShards(); sid++ {
+			shardTypeDesc := ""
+			if sid >= h.dataShards {
+				shardTypeDesc = " (parity)"
+			}
+			if addrs, ok := h.shardAddresses[erasure_coding.ShardId(sid)]; ok {
+				r.write("\t%02d%s => %v\n", sid, shardTypeDesc, addrs)
+			} else {
+				r.write("\t%02d%s is missing\n", sid, shardTypeDesc)
+			}
+		}
+		for _, sid := range h.unexpectedShardIds() {
+			r.write("\t%02d (unexpected) => %v\n", int(sid), h.shardAddresses[sid])
+		}
+	}
+}
diff --git a/weed/shell/command_ec_check_replication_test.go b/weed/ec/ec_check_replication_test.go
similarity index 99%
rename from weed/shell/command_ec_check_replication_test.go
rename to weed/ec/ec_check_replication_test.go
index f7621f76df..3a6b0460f5 100644
--- a/weed/shell/command_ec_check_replication_test.go
+++ b/weed/ec/ec_check_replication_test.go
@@ -1,4 +1,4 @@
-package shell
+package ec
 
 import (
 	"bytes"
diff --git a/weed/ec/ec_common.go b/weed/ec/ec_common.go
new file mode 100644
index 0000000000..8cabfe426a
--- /dev/null
+++ b/weed/ec/ec_common.go
@@ -0,0 +1,1455 @@
+package ec
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding/ecbalancer"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/topology/balancer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type DataCenterId string
+type EcNodeId string
+type RackId string
+
+// EcDisk represents a single disk on a volume server
+type EcDisk struct {
+	DiskId       uint32
+	DiskType     string
+	FreeEcSlots  int
+	EcShardCount int // Total EC shards on this disk
+	// Map of volumeId -> ShardsInfo for shards on this disk
+	EcShards map[needle.VolumeId]*erasure_coding.ShardsInfo
+}
+
+type EcNode struct {
+	Info       *master_pb.DataNodeInfo
+	DC         DataCenterId
+	Rack       RackId
+	FreeEcSlot int
+	// Disks maps diskId -> EcDisk for disk-level balancing
+	Disks map[uint32]*EcDisk
+}
+
+var BalanceAlgorithmDescription = `
+	func EcBalance() {
+		for each collection:
+			balanceEcVolumes(collectionName)
+		for each rack:
+			balanceEcRack(rack)
+	}
+
+	func balanceEcVolumes(collectionName){
+		for each volume:
+			doDeduplicateEcShards(volumeId)
+
+		tracks rack~shardCount mapping
+		for each volume:
+			doBalanceEcShardsAcrossRacks(volumeId)
+
+		for each volume:
+			doBalanceEcShardsWithinRacks(volumeId)
+	}
+
+	// spread ec shards into more racks
+	func doBalanceEcShardsAcrossRacks(volumeId){
+		tracks rack~volumeIdShardCount mapping
+		averageShardsPerEcRack = totalShardNumber / numRacks  // totalShardNumber is 14 for now, later could varies for each dc
+		ecShardsToMove = select overflown ec shards from racks with ec shard counts > averageShardsPerEcRack
+		for each ecShardsToMove {
+			destRack = pickOneRack(rack~shardCount, rack~volumeIdShardCount, ecShardReplicaPlacement)
+			destVolumeServers = volume servers on the destRack
+			pickOneEcNodeAndMoveOneShard(destVolumeServers)
+		}
+	}
+
+	func doBalanceEcShardsWithinRacks(volumeId){
+		racks = collect all racks that the volume id is on
+		for rack, shards := range racks
+			doBalanceEcShardsWithinOneRack(volumeId, shards, rack)
+	}
+
+	// move ec shards
+	func doBalanceEcShardsWithinOneRack(volumeId, shards, rackId){
+		tracks volumeServer~volumeIdShardCount mapping
+		averageShardCount = len(shards) / numVolumeServers
+		volumeServersOverAverage = volume servers with volumeId's ec shard counts > averageShardsPerEcRack
+		ecShardsToMove = select overflown ec shards from volumeServersOverAverage
+		for each ecShardsToMove {
+			destVolumeServer = pickOneVolumeServer(volumeServer~shardCount, volumeServer~volumeIdShardCount, ecShardReplicaPlacement)
+			pickOneEcNodeAndMoveOneShard(destVolumeServers)
+		}
+	}
+
+	// move ec shards while keeping shard distribution for the same volume unchanged or more even
+	func balanceEcRack(rack){
+		averageShardCount = total shards / numVolumeServers
+		for hasMovedOneEcShard {
+			sort all volume servers ordered by the number of local ec shards
+			pick the volume server A with the lowest number of ec shards x
+			pick the volume server B with the highest number of ec shards y
+			if y > averageShardCount and x +1 <= averageShardCount {
+				if B has a ec shard with volume id v that A does not have {
+					move one ec shard v from B to A
+					hasMovedOneEcShard = true
+				}
+			}
+		}
+	}
+	`
+
+func CollectEcNodesForDC(env *Env, selectedDataCenter string, diskType types.DiskType) (ecNodes []*EcNode, totalFreeEcSlots int, err error) {
+	if env == nil || env.FetchTopology == nil {
+		return nil, 0, fmt.Errorf("no topology source configured")
+	}
+	// list all possible locations
+	// collect topology information
+	topologyInfo, _, err := env.FetchTopology(0)
+	if err != nil {
+		return
+	}
+
+	// find out all volume servers with one slot left.
+	ecNodes, totalFreeEcSlots = CollectEcVolumeServersByDc(topologyInfo, selectedDataCenter, diskType)
+
+	SortEcNodesByFreeslotsDescending(ecNodes)
+
+	return
+}
+
+func CollectEcNodes(env *Env, diskType types.DiskType) (ecNodes []*EcNode, totalFreeEcSlots int, err error) {
+	return CollectEcNodesForDC(env, "", diskType)
+}
+
+// AssertEncodableRegularVolumes rejects volume ids that are not encodable
+// regular volumes in the topology snapshot: an already-EC volume (present only
+// as EC shards, with no .dat) or an id absent from the cluster. Encoding an
+// already-EC volume would clear its shards before failing, destroying the only
+// copy. A volume present as BOTH a regular .dat and stale orphan shards (a
+// failed-encode retry) passes, so the retry + orphan sweep still works.
+func AssertEncodableRegularVolumes(t *master_pb.TopologyInfo, vids []needle.VolumeId) error {
+	want := make(map[needle.VolumeId]bool, len(vids))
+	for _, vid := range vids {
+		want[vid] = true
+	}
+	regular := make(map[needle.VolumeId]bool)
+	hasEcShards := make(map[needle.VolumeId]bool)
+	for _, dc := range t.DataCenterInfos {
+		for _, r := range dc.RackInfos {
+			for _, dn := range r.DataNodeInfos {
+				for _, diskInfo := range dn.DiskInfos {
+					if diskInfo == nil {
+						continue
+					}
+					for _, vi := range diskInfo.VolumeInfos {
+						if want[needle.VolumeId(vi.Id)] {
+							regular[needle.VolumeId(vi.Id)] = true
+						}
+					}
+					for _, ecShardInfo := range diskInfo.EcShardInfos {
+						if want[needle.VolumeId(ecShardInfo.Id)] {
+							hasEcShards[needle.VolumeId(ecShardInfo.Id)] = true
+						}
+					}
+				}
+			}
+		}
+	}
+	for _, vid := range vids {
+		if regular[vid] {
+			continue
+		}
+		if hasEcShards[vid] {
+			return fmt.Errorf("volume %d is already EC-encoded (no .dat replica); refusing to re-encode, which would destroy its shards", vid)
+		}
+		return fmt.Errorf("volume %d not found as a regular volume in the cluster; refusing to encode", vid)
+	}
+	return nil
+}
+
+// CollectVolumeIdToCollection returns a map from volume ID to its collection name
+func CollectVolumeIdToCollection(t *master_pb.TopologyInfo, vids []needle.VolumeId) map[needle.VolumeId]string {
+	result := make(map[needle.VolumeId]string)
+	if len(vids) == 0 {
+		return result
+	}
+
+	vidSet := make(map[needle.VolumeId]bool)
+	for _, vid := range vids {
+		vidSet[vid] = true
+	}
+
+	for _, dc := range t.DataCenterInfos {
+		for _, r := range dc.RackInfos {
+			for _, dn := range r.DataNodeInfos {
+				for _, diskInfo := range dn.DiskInfos {
+					if diskInfo == nil {
+						continue
+					}
+					for _, vi := range diskInfo.VolumeInfos {
+						vid := needle.VolumeId(vi.Id)
+						if vidSet[vid] {
+							result[vid] = vi.Collection
+						}
+					}
+				}
+			}
+		}
+	}
+	return result
+}
+
+func CollectCollectionsForVolumeIds(t *master_pb.TopologyInfo, vids []needle.VolumeId) []string {
+	if len(vids) == 0 {
+		return nil
+	}
+
+	found := map[string]bool{}
+	for _, dc := range t.DataCenterInfos {
+		for _, r := range dc.RackInfos {
+			for _, dn := range r.DataNodeInfos {
+				for _, diskInfo := range dn.DiskInfos {
+					for _, vi := range diskInfo.VolumeInfos {
+						for _, vid := range vids {
+							if needle.VolumeId(vi.Id) == vid {
+								found[vi.Collection] = true
+							}
+						}
+					}
+					for _, ecs := range diskInfo.EcShardInfos {
+						for _, vid := range vids {
+							if needle.VolumeId(ecs.Id) == vid {
+								found[ecs.Collection] = true
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	if len(found) == 0 {
+		return nil
+	}
+
+	collections := []string{}
+	for k := range found {
+		collections = append(collections, k)
+	}
+	sort.Strings(collections)
+	return collections
+}
+
+func MoveMountedShardToEcNode(env *Env, existingLocation *EcNode, collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, destinationEcNode *EcNode, destDiskId uint32, applyBalancing bool, diskType types.DiskType) (err error) {
+
+	if !env.isLocked() {
+		return fmt.Errorf("lock is lost")
+	}
+
+	copiedShardIds := []erasure_coding.ShardId{shardId}
+
+	if applyBalancing {
+
+		existingServerAddress := pb.NewServerAddressFromDataNode(existingLocation.Info)
+
+		// ask destination node to copy shard and the ecx file from source node, and mount it
+		copiedShardIds, err = OneServerCopyAndMountEcShardsFromSource(env.GrpcDialOption, destinationEcNode, []erasure_coding.ShardId{shardId}, vid, collection, existingServerAddress, destDiskId)
+		if err != nil {
+			return err
+		}
+
+		// unmount the to be deleted shards
+		err = UnmountEcShards(env.GrpcDialOption, vid, existingServerAddress, copiedShardIds)
+		if err != nil {
+			return err
+		}
+
+		// ask source node to delete the shard, and maybe the ecx file
+		err = SourceServerDeleteEcShards(env.GrpcDialOption, collection, vid, existingServerAddress, copiedShardIds)
+		if err != nil {
+			return err
+		}
+
+		if destDiskId > 0 {
+			fmt.Printf("moved ec shard %d.%d %s => %s (disk %d)\n", vid, shardId, existingLocation.Info.Id, destinationEcNode.Info.Id, destDiskId)
+		} else {
+			fmt.Printf("moved ec shard %d.%d %s => %s\n", vid, shardId, existingLocation.Info.Id, destinationEcNode.Info.Id)
+		}
+
+	}
+
+	destinationEcNode.AddEcVolumeShards(vid, collection, copiedShardIds, diskType)
+	existingLocation.DeleteEcVolumeShards(vid, copiedShardIds)
+
+	return nil
+
+}
+
+func OneServerCopyAndMountEcShardsFromSource(grpcDialOption grpc.DialOption,
+	targetServer *EcNode, shardIdsToCopy []erasure_coding.ShardId,
+	volumeId needle.VolumeId, collection string, existingLocation pb.ServerAddress, destDiskId uint32) (copiedShardIds []erasure_coding.ShardId, err error) {
+
+	fmt.Printf("allocate %d.%v %s => %s\n", volumeId, shardIdsToCopy, existingLocation, targetServer.Info.Id)
+
+	targetAddress := pb.NewServerAddressFromDataNode(targetServer.Info)
+	err = volume_move.NewMover(grpcDialOption).CopyAndMountEcShards(context.Background(), volumeId, collection, shardIdsToCopy, existingLocation, targetAddress, destDiskId, 0, os.Stdout)
+	if err != nil {
+		return
+	}
+
+	// SameServer, not ==: a representation mismatch here would report a
+	// same-server mount-in-place as a copy and have the caller delete the
+	// shards it kept.
+	if !volume_move.SameServer(targetAddress, existingLocation) {
+		copiedShardIds = shardIdsToCopy
+		glog.V(0).Infof("%s ec volume %d deletes shards %+v", existingLocation, volumeId, copiedShardIds)
+	}
+
+	return
+}
+
+func EachDataNode(topo *master_pb.TopologyInfo, fn func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo)) {
+	for _, dc := range topo.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, dn := range rack.DataNodeInfos {
+				fn(DataCenterId(dc.Id), RackId(rack.Id), dn)
+			}
+		}
+	}
+}
+
+func SortEcNodesByFreeslotsDescending(ecNodes []*EcNode) {
+	slices.SortFunc(ecNodes, func(a, b *EcNode) int {
+		return b.FreeEcSlot - a.FreeEcSlot
+	})
+}
+
+func SortEcNodesByFreeslotsAscending(ecNodes []*EcNode) {
+	slices.SortFunc(ecNodes, func(a, b *EcNode) int {
+		return a.FreeEcSlot - b.FreeEcSlot
+	})
+}
+
+func CountShards(ecShardInfos []*master_pb.VolumeEcShardInformationMessage) (count int) {
+	for _, eci := range ecShardInfos {
+		count += erasure_coding.GetShardCount(eci)
+	}
+	return
+}
+
+func CountFreeShardSlots(dn *master_pb.DataNodeInfo, diskType types.DiskType) (count int) {
+	if dn.DiskInfos == nil {
+		return 0
+	}
+	diskInfo := dn.DiskInfos[string(diskType)]
+	if diskInfo == nil {
+		return 0
+	}
+
+	// A physically near-full disk has no room for more EC shards regardless of
+	// slot math (an over-set maxVolumeCount hides real fullness; statfs free bytes
+	// already include EC shard files). No-opinion when the server reports no bytes.
+	if balancer.DiskTooFullAfter(diskInfo.DiskTotalBytes, diskInfo.DiskFreeBytes, 0, balancer.DefaultMaxDiskUsagePercent) {
+		return 0
+	}
+
+	slots := int(diskInfo.MaxVolumeCount-diskInfo.VolumeCount)*erasure_coding.DataShardsCount - CountShards(diskInfo.EcShardInfos)
+	if slots < 0 {
+		return 0
+	}
+
+	return slots
+}
+
+func (ecNode *EcNode) LocalShardIdCount(vid uint32) int {
+	for _, diskInfo := range ecNode.Info.DiskInfos {
+		for _, eci := range diskInfo.EcShardInfos {
+			if vid == eci.Id {
+				return erasure_coding.GetShardCount(eci)
+			}
+		}
+	}
+	return 0
+}
+
+func CollectEcVolumeServersByDc(topo *master_pb.TopologyInfo, selectedDataCenter string, diskType types.DiskType) (ecNodes []*EcNode, totalFreeEcSlots int) {
+	EachDataNode(topo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		if selectedDataCenter != "" && selectedDataCenter != string(dc) {
+			return
+		}
+
+		freeEcSlots := CountFreeShardSlots(dn, diskType)
+		ecNode := &EcNode{
+			Info:       dn,
+			DC:         dc,
+			Rack:       rack,
+			FreeEcSlot: int(freeEcSlots),
+			Disks:      make(map[uint32]*EcDisk),
+		}
+
+		// Build disk-level information from volumes and EC shards
+		// First, discover all unique disk IDs from VolumeInfos (includes empty disks)
+		allDiskIds := make(map[uint32]string) // diskId -> diskType
+		for diskTypeKey, diskInfo := range dn.DiskInfos {
+			if diskInfo == nil {
+				continue
+			}
+			// Get all disk IDs from volumes
+			for _, vi := range diskInfo.VolumeInfos {
+				allDiskIds[vi.DiskId] = diskTypeKey
+			}
+			// Also get disk IDs from EC shards
+			for _, ecShardInfo := range diskInfo.EcShardInfos {
+				allDiskIds[ecShardInfo.DiskId] = diskTypeKey
+			}
+		}
+
+		// Group EC shards by disk_id
+		diskShards := make(map[uint32]map[needle.VolumeId]*erasure_coding.ShardsInfo)
+		for _, diskInfo := range dn.DiskInfos {
+			if diskInfo == nil {
+				continue
+			}
+			for _, eci := range diskInfo.EcShardInfos {
+				diskId := eci.DiskId
+				if diskShards[diskId] == nil {
+					diskShards[diskId] = make(map[needle.VolumeId]*erasure_coding.ShardsInfo)
+				}
+				vid := needle.VolumeId(eci.Id)
+				diskShards[diskId][vid] = erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
+			}
+		}
+
+		// Create EcDisk for each discovered disk
+		diskCount := len(allDiskIds)
+		if diskCount == 0 {
+			diskCount = 1
+		}
+		freePerDisk := int(freeEcSlots) / diskCount
+
+		for diskId, diskTypeStr := range allDiskIds {
+			shards := diskShards[diskId]
+			if shards == nil {
+				shards = make(map[needle.VolumeId]*erasure_coding.ShardsInfo)
+			}
+			totalShardCount := 0
+			for _, shardsInfo := range shards {
+				totalShardCount += shardsInfo.Count()
+			}
+
+			ecNode.Disks[diskId] = &EcDisk{
+				DiskId:       diskId,
+				DiskType:     diskTypeStr,
+				FreeEcSlots:  freePerDisk,
+				EcShardCount: totalShardCount,
+				EcShards:     shards,
+			}
+		}
+
+		ecNodes = append(ecNodes, ecNode)
+		totalFreeEcSlots += freeEcSlots
+	})
+	return
+}
+
+func SourceServerDeleteEcShards(grpcDialOption grpc.DialOption, collection string, volumeId needle.VolumeId, sourceLocation pb.ServerAddress, toBeDeletedShardIds []erasure_coding.ShardId) error {
+
+	fmt.Printf("delete %d.%v from %s\n", volumeId, toBeDeletedShardIds, sourceLocation)
+
+	return volume_move.NewMover(grpcDialOption).DeleteEcShards(context.Background(), volumeId, collection, sourceLocation, toBeDeletedShardIds)
+}
+
+// ErrFullTeardownNotAcked marks a reachable server that completed the delete RPC
+// but did not report full_teardown_done (a pre-upgrade volume server). The orphan
+// sweep must treat this as fatal: the node may still hold an orphan that a later
+// copy would re-stamp into the new generation. Aliased to the shared sentinel so
+// the shell and the plugin-worker EC task agree on the teardown-not-acked signal.
+var ErrFullTeardownNotAcked = erasure_coding.ErrFullTeardownNotAcked
+
+// PingVolumeServer probes node liveness with an empty-target Ping, which is never
+// maintenance-gated, and returns the raw Ping error (nil on success). It lets the
+// orphan sweep disambiguate a delete codes.Unavailable: a Rust volume server in
+// maintenance mode fails the maintenance-gated delete with Unavailable yet answers
+// Ping, whereas a genuinely-down node fails Ping with a transport Unavailable too.
+// A Go server returns Unknown for maintenance, which IsNodeUnreachable already
+// treats as fatal. The caller classifies the result with ClassifyNodeLiveness:
+// only a Ping that itself transport-failed (codes.Unavailable) confirms the node
+// is down; a nil error (reachable) or any other Ping error (inconclusive — e.g. a
+// pre-Ping server returning Unimplemented, which means the node is up) is fatal.
+func PingVolumeServer(grpcDialOption grpc.DialOption, location pb.ServerAddress) error {
+	return operation.WithVolumeServerClient(false, location, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+		_, pingErr := client.Ping(context.Background(), &volume_server_pb.PingRequest{})
+		return pingErr
+	})
+}
+
+// IsNodeUnreachable reports whether err means the volume server could not be
+// reached at all, as opposed to an RPC that reached the node and failed. Only an
+// unreachable node is safe to skip in the orphan sweep. A dead peer surfaces as
+// a gRPC codes.Unavailable from the RPC (the dial is lazy, so it never fails at
+// connect time); any non-status error reached node logic and is treated as
+// reachable, so the sweep stays fatal rather than silently leaving stale state.
+func IsNodeUnreachable(err error) bool {
+	if err == nil {
+		return false
+	}
+	st, ok := status.FromError(err)
+	return ok && st.Code() == codes.Unavailable
+}
+
+// NodeLiveness is the tri-state result of a PingVolumeServer probe.
+type NodeLiveness int
+
+const (
+	// NodeUp: Ping succeeded — the node is reachable (e.g. a Rust volume server
+	// in maintenance mode that fails the delete but answers Ping).
+	NodeUp NodeLiveness = iota
+	// NodeDown: Ping itself transport-failed with codes.Unavailable — the node is
+	// confirmed unreachable. The only state the orphan sweep may skip.
+	NodeDown
+	// NodeLivenessUnknown: Ping reached failing logic with any non-Unavailable
+	// code (Internal, ResourceExhausted, Unimplemented from a pre-Ping server, …)
+	// or a non-status error. This does NOT prove the node is down, so it is fatal.
+	NodeLivenessUnknown
+)
+
+// ClassifyNodeLiveness maps a PingVolumeServer error into the tri-state. A nil
+// error is NodeUp, a transport codes.Unavailable is NodeDown (reusing the same
+// rule as IsNodeUnreachable), and every other Ping failure is NodeLivenessUnknown.
+func ClassifyNodeLiveness(pingErr error) NodeLiveness {
+	if pingErr == nil {
+		return NodeUp
+	}
+	if IsNodeUnreachable(pingErr) {
+		return NodeDown
+	}
+	return NodeLivenessUnknown
+}
+
+// UnmountAndDeleteEcShardsQuiet unmounts then deletes shards on one server in a
+// single connection, without the per-call logging the interactive helpers emit.
+// Used by the orphan sweep, which fans out to every node x volume and would
+// otherwise flood the shell with no-op lines.
+func UnmountAndDeleteEcShardsQuiet(grpcDialOption grpc.DialOption, collection string, volumeId needle.VolumeId, location pb.ServerAddress, shardIds []erasure_coding.ShardId) error {
+	return erasure_coding.UnmountAndDeleteEcShards(context.Background(), grpcDialOption, location, collection,
+		uint32(volumeId), erasure_coding.ShardIdsToUint32(shardIds), 0)
+}
+
+func UnmountEcShards(grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceLocation pb.ServerAddress, toBeUnmountedShardIds []erasure_coding.ShardId) error {
+
+	fmt.Printf("unmount %d.%v from %s\n", volumeId, toBeUnmountedShardIds, sourceLocation)
+
+	return volume_move.NewMover(grpcDialOption).UnmountEcShards(context.Background(), volumeId, sourceLocation, toBeUnmountedShardIds)
+}
+
+func MountEcShards(grpcDialOption grpc.DialOption, collection string, volumeId needle.VolumeId, sourceLocation pb.ServerAddress, toBeMountedShardIds []erasure_coding.ShardId) error {
+
+	fmt.Printf("mount %d.%v on %s\n", volumeId, toBeMountedShardIds, sourceLocation)
+
+	return volume_move.NewMover(grpcDialOption).MountEcShards(context.Background(), volumeId, collection, sourceLocation, toBeMountedShardIds)
+}
+
+func CeilDivide(a, b int) int {
+	var r int
+	if (a % b) != 0 {
+		r = 1
+	}
+	return (a / b) + r
+}
+
+func FindEcVolumeShardsInfo(ecNode *EcNode, vid needle.VolumeId, diskType types.DiskType) *erasure_coding.ShardsInfo {
+	if diskInfo, found := ecNode.Info.DiskInfos[string(diskType)]; found {
+		for _, shardInfo := range diskInfo.EcShardInfos {
+			if needle.VolumeId(shardInfo.Id) == vid {
+				return erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(shardInfo)
+			}
+		}
+	}
+
+	// Returns an empty ShardsInfo struct on failure, to avoid potential nil dereferences.
+	return erasure_coding.NewShardsInfo()
+}
+
+// TODO: simplify me
+func (ecNode *EcNode) AddEcVolumeShards(vid needle.VolumeId, collection string, shardIds []erasure_coding.ShardId, diskType types.DiskType) *EcNode {
+
+	foundVolume := false
+	diskInfo, found := ecNode.Info.DiskInfos[string(diskType)]
+	if found {
+		for _, ecsi := range diskInfo.EcShardInfos {
+			if needle.VolumeId(ecsi.Id) == vid {
+				si := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecsi)
+				oldShardCount := si.Count()
+				for _, shardId := range shardIds {
+					si.Set(erasure_coding.NewShardInfo(shardId, 0))
+				}
+				ecsi.EcIndexBits = si.Bitmap()
+				ecsi.ShardSizes = si.SizesInt64()
+				ecNode.FreeEcSlot -= si.Count() - oldShardCount
+				foundVolume = true
+				break
+			}
+		}
+	} else {
+		diskInfo = &master_pb.DiskInfo{
+			Type: string(diskType),
+		}
+		ecNode.Info.DiskInfos[string(diskType)] = diskInfo
+	}
+
+	if !foundVolume {
+		si := erasure_coding.NewShardsInfo()
+		for _, id := range shardIds {
+			si.Set(erasure_coding.NewShardInfo(id, 0))
+		}
+		diskInfo.EcShardInfos = append(diskInfo.EcShardInfos, &master_pb.VolumeEcShardInformationMessage{
+			Id:          uint32(vid),
+			Collection:  collection,
+			EcIndexBits: si.Bitmap(),
+			ShardSizes:  si.SizesInt64(),
+			DiskType:    string(diskType),
+		})
+		ecNode.FreeEcSlot -= si.Count()
+	}
+
+	return ecNode
+}
+
+// DeleteEcVolumeShards removes the shards from the node model wherever they
+// sit. A node holds a given shard in exactly one disk-type bucket, but which
+// bucket is not the caller's to know: a mid-migration (cross-tier encode)
+// volume keeps its fresh shards in the SOURCE disk's bucket while the balance
+// runs against the target type, so a bucket-scoped delete would miss them and
+// the dry-run model would count a moved shard twice.
+func (ecNode *EcNode) DeleteEcVolumeShards(vid needle.VolumeId, shardIds []erasure_coding.ShardId) *EcNode {
+
+	for _, diskInfo := range ecNode.Info.DiskInfos {
+		if diskInfo == nil {
+			continue
+		}
+		for _, eci := range diskInfo.EcShardInfos {
+			if needle.VolumeId(eci.Id) == vid {
+				si := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
+				oldCount := si.Count()
+				for _, shardId := range shardIds {
+					si.Delete(shardId)
+				}
+				eci.EcIndexBits = si.Bitmap()
+				eci.ShardSizes = si.SizesInt64()
+				ecNode.FreeEcSlot -= si.Count() - oldCount
+			}
+		}
+	}
+
+	return ecNode
+}
+
+// PickBestDiskOnNode selects the best disk on a node for placing a new EC shard
+// It prefers disks of the specified type with fewer shards and more free slots
+// When shardId is provided and dataShardCount > 0, it applies anti-affinity:
+// - For data shards (shardId < dataShardCount): prefer disks without parity shards
+// - For parity shards (shardId >= dataShardCount): prefer disks without data shards
+// If strictDiskType is false, it will fall back to other disk types if no matching disk is found
+func PickBestDiskOnNode(ecNode *EcNode, vid needle.VolumeId, diskType types.DiskType, strictDiskType bool, shardId erasure_coding.ShardId, dataShardCount int) uint32 {
+	if len(ecNode.Disks) == 0 {
+		return 0 // No disk info available, let the server decide
+	}
+
+	var bestDiskId uint32
+	bestScore := -1
+	var fallbackDiskId uint32
+	fallbackScore := -1
+
+	// Determine if we're placing a data or parity shard
+	isDataShard := dataShardCount > 0 && int(shardId) < dataShardCount
+
+	for diskId, disk := range ecNode.Disks {
+		if disk.FreeEcSlots <= 0 {
+			continue
+		}
+
+		// Check existing shards on this disk for this volume
+		existingShards := 0
+		hasDataShards := false
+		hasParityShards := false
+		if si, ok := disk.EcShards[vid]; ok {
+			existingShards = si.Count()
+			// Check what type of shards are on this disk
+			if dataShardCount > 0 {
+				for _, existingShardId := range si.Ids() {
+					if int(existingShardId) < dataShardCount {
+						hasDataShards = true
+					} else {
+						hasParityShards = true
+					}
+				}
+			}
+		}
+
+		// Score: prefer disks with fewer total shards and fewer shards of this volume
+		// Lower score is better
+		score := disk.EcShardCount*10 + existingShards*100
+
+		// Apply anti-affinity penalty if applicable
+		if dataShardCount > 0 {
+			if isDataShard && hasParityShards {
+				// Penalize placing data shard on disk with parity shards
+				score += 1000
+			} else if !isDataShard && hasDataShards {
+				// Penalize placing parity shard on disk with data shards
+				score += 1000
+			}
+		}
+
+		if disk.DiskType == string(diskType) {
+			// Matching disk type - this is preferred
+			if bestScore == -1 || score < bestScore {
+				bestScore = score
+				bestDiskId = diskId
+			}
+		} else if !strictDiskType {
+			// Non-matching disk type - use as fallback if allowed
+			if fallbackScore == -1 || score < fallbackScore {
+				fallbackScore = score
+				fallbackDiskId = diskId
+			}
+		}
+	}
+
+	// Return matching disk type if found, otherwise fallback. Gate on bestScore,
+	// not bestDiskId: physical disk 0 is a valid target and 0 is also the "no
+	// match" zero value, so testing bestDiskId would never select disk 0.
+	if bestScore != -1 {
+		return bestDiskId
+	}
+	return fallbackDiskId
+}
+
+// ecBalancer drives an EC balance run: it collects the cluster's EC nodes, hands
+// them to the shared ecbalancer planner, and executes the planned shard moves.
+// The balancing policy lives in weed/storage/erasure_coding/ecbalancer, shared
+// with the EC balance worker so the two cannot drift.
+type ecBalancer struct {
+	env                *Env
+	ecNodes            []*EcNode
+	replicaPlacement   *super_block.ReplicaPlacement
+	applyBalancing     bool
+	maxParallelization int
+	ioBytePerSecond    int64
+	diskType           types.DiskType
+	// volumeIds narrows the plan to these ec volume ids; nil balances every volume
+	// of the selected collections.
+	volumeIds map[uint32]bool
+	// migratingVolumeIds are mid-encode volumes whose shards are ingested from
+	// every disk-type bucket; see EcBalance.
+	migratingVolumeIds map[uint32]bool
+	// noReceiveTargets are node ids the planner may not pick as destinations;
+	// noReceiveDisks narrows that to individual disks on a node: a server-side
+	// auto-pick refusal means no disk qualifies, but an explicit-disk refusal
+	// only convicts that disk. See EcBalance.
+	noReceiveTargets map[string]bool
+	noReceiveDisks   map[string]map[uint32]bool
+	// mu guards the execution journal written by concurrent move tasks.
+	mu sync.Mutex
+	// rejectedTargets and rejectedDisks collect the destinations that refused a
+	// copy this attempt; completedMoves records applied moves so a retry can
+	// replay them onto a stale-heartbeat snapshot; sawOtherErr marks any
+	// failure that is not a "no space left" refusal and makes the run
+	// non-retryable.
+	rejectedTargets map[string]bool
+	rejectedDisks   map[string]map[uint32]bool
+	completedMoves  []ecbalancer.Move
+	sawOtherErr     bool
+	// plannedMoves is the move count of the last plan, for the empty-replan
+	// check in EcBalance.
+	plannedMoves int
+}
+
+// excludeNodes is a set of server addresses kept out of the balance as copy/move
+// targets and sources. ec.encode passes the nodes its orphan sweep could not
+// reach: such a node may still hold a stale-generation shard orphan, and pairing
+// it with a new-generation shard from a balance copy would mix generations on one
+// node. The standalone ec.balance command passes nil.
+//
+// volumeIds, when non-empty, restricts the plan to those ec volume ids; empty
+// balances every volume of the given collections.
+//
+// migratingVolumeIds names volumes whose shards are ingested from EVERY
+// disk-type bucket, not just the diskType one. ec.encode passes its batch:
+// shard generation writes beside the source .dat, so a cross-tier encode
+// (source on hdd, -diskType=ssd) leaves the fresh shards in the source bucket,
+// where a target-bucket-only balance cannot see them — it plans no moves and
+// the encode's spread guard aborts. Everything else keeps the bucket filter,
+// so a plain ec.balance -diskType=X never drags deliberately tiered shards of
+// other types onto X disks.
+func EcBalance(env *Env, collections []string, dc string, ecReplicaPlacement *super_block.ReplicaPlacement, diskType types.DiskType, maxParallelization int, ioBytePerSecond int64, applyBalancing bool, excludeNodes map[pb.ServerAddress]struct{}, volumeIds []needle.VolumeId, migratingVolumeIds []needle.VolumeId) (err error) {
+
+	var volumeIdFilter map[uint32]bool
+	if len(volumeIds) > 0 {
+		volumeIdFilter = make(map[uint32]bool, len(volumeIds))
+		for _, vid := range volumeIds {
+			volumeIdFilter[uint32(vid)] = true
+		}
+	}
+	var migrating map[uint32]bool
+	if len(migratingVolumeIds) > 0 {
+		migrating = make(map[uint32]bool, len(migratingVolumeIds))
+		for _, vid := range migratingVolumeIds {
+			migrating[uint32(vid)] = true
+		}
+	}
+
+	// The planner's free-slot numbers come from heartbeat snapshots that can lag
+	// the volume server's own accounting, so a planned target can refuse a copy
+	// with "no space left" while shards move concurrently (issue #11753). The
+	// server's refusal is authoritative: re-collect the topology, mark the
+	// refusing targets no-receive, and plan again. They stay usable as sources.
+	noReceiveTargets := make(map[string]bool)
+	noReceiveDisks := make(map[string]map[uint32]bool)
+	var completed []ecbalancer.Move
+	var lastErr error
+	for {
+		// collect all ec nodes
+		allEcNodes, totalFreeEcSlots, err := CollectEcNodesForDC(env, dc, diskType)
+		if err != nil {
+			return err
+		}
+
+		// Drop excluded nodes (and the slots they contribute) before planning so they
+		// can be neither a target nor a source for any move this balance plans.
+		if len(excludeNodes) > 0 {
+			kept := allEcNodes[:0]
+			var excludedFreeSlots int
+			for _, en := range allEcNodes {
+				if _, skip := excludeNodes[pb.NewServerAddressFromDataNode(en.Info)]; skip {
+					excludedFreeSlots += en.FreeEcSlot
+					glog.V(0).Infof("EC balance excluding node %s: skipped as unreachable by the encode orphan sweep", en.Info.Id)
+					continue
+				}
+				kept = append(kept, en)
+			}
+			allEcNodes = kept
+			totalFreeEcSlots -= excludedFreeSlots
+		}
+		// A refused destination's slots cannot take a copy, so they do not
+		// count toward the free-space precheck.
+		for _, en := range allEcNodes {
+			if noReceiveTargets[en.Info.Id] {
+				totalFreeEcSlots -= en.FreeEcSlot
+				continue
+			}
+			for diskId := range noReceiveDisks[en.Info.Id] {
+				if d := en.Disks[diskId]; d != nil {
+					totalFreeEcSlots -= d.FreeEcSlots
+				}
+			}
+		}
+
+		if totalFreeEcSlots < 1 {
+			if lastErr != nil {
+				return fmt.Errorf("no receiving targets remain: %w", lastErr)
+			}
+			return fmt.Errorf("no free ec shard slots. only %d left", totalFreeEcSlots)
+		}
+
+		// A fresh collection can still describe an applied move through a
+		// heartbeat that predates its source delete; replay the journal.
+		applyCompletedMoves(allEcNodes, completed, diskType)
+
+		ecb := &ecBalancer{
+			env:                env,
+			ecNodes:            allEcNodes,
+			replicaPlacement:   ecReplicaPlacement,
+			applyBalancing:     applyBalancing,
+			maxParallelization: maxParallelization,
+			ioBytePerSecond:    ioBytePerSecond,
+			diskType:           diskType,
+			volumeIds:          volumeIdFilter,
+			migratingVolumeIds: migrating,
+			noReceiveTargets:   noReceiveTargets,
+			noReceiveDisks:     noReceiveDisks,
+		}
+
+		if len(collections) == 0 {
+			glog.V(1).Infof("WARNING: No collections to balance EC volumes across.\n")
+		}
+		err = ecb.balance(collections)
+		if !applyBalancing {
+			return err
+		}
+		if err == nil {
+			if lastErr != nil && ecb.plannedMoves == 0 {
+				return fmt.Errorf("no receiving targets remain: %w", lastErr)
+			}
+			return nil
+		}
+
+		// Replan while the failed attempt surfaced newly-refusing targets; a node
+		// once marked can no longer be picked, so the loop terminates. Any other
+		// failure aborts instead of being hidden by the retry.
+		newRejects := ecb.mergeRejectedTargets(noReceiveTargets, noReceiveDisks)
+		if len(newRejects) == 0 || ecb.hasOtherError() {
+			return err
+		}
+		lastErr = err
+		completed = append(completed, ecb.completedMoves...)
+		fmt.Printf("ec.balance: %v reported no space left; re-collecting topology and re-planning without them as targets\n", newRejects)
+	}
+}
+
+// applyCompletedMoves replays already-applied moves onto a freshly collected
+// node list: heartbeats can lag, so the snapshot may still show a moved shard
+// on its deleted source or lack it on its mounted target.
+func applyCompletedMoves(ecNodes []*EcNode, moves []ecbalancer.Move, diskType types.DiskType) {
+	if len(moves) == 0 {
+		return
+	}
+	byID := make(map[string]*EcNode, len(ecNodes))
+	for _, en := range ecNodes {
+		byID[en.Info.Id] = en
+	}
+	for _, m := range moves {
+		vid := needle.VolumeId(m.VolumeID)
+		shardId := erasure_coding.ShardId(m.ShardID)
+		if src := byID[m.SourceNode]; src != nil {
+			removeEcShard(src, vid, shardId)
+		}
+		if m.Phase == "dedup" {
+			continue
+		}
+		if dst := byID[m.TargetNode]; dst != nil && !ecNodeHasShard(dst, vid, shardId) {
+			addEcShard(dst, m.Collection, vid, shardId, m.TargetDisk, diskType)
+		}
+	}
+}
+
+func ecNodeHasShard(ecNode *EcNode, vid needle.VolumeId, shardId erasure_coding.ShardId) bool {
+	for _, diskInfo := range ecNode.Info.DiskInfos {
+		for _, eci := range diskInfo.EcShardInfos {
+			if needle.VolumeId(eci.Id) == vid && erasure_coding.ShardBits(eci.EcIndexBits).Has(shardId) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// removeEcShard drops the shard from the node model, including the per-disk
+// bookkeeping of the disk that reported it.
+func removeEcShard(en *EcNode, vid needle.VolumeId, shardId erasure_coding.ShardId) {
+	for _, diskInfo := range en.Info.DiskInfos {
+		for _, eci := range diskInfo.EcShardInfos {
+			if needle.VolumeId(eci.Id) != vid || !erasure_coding.ShardBits(eci.EcIndexBits).Has(shardId) {
+				continue
+			}
+			if d := en.Disks[eci.DiskId]; d != nil {
+				if si := d.EcShards[vid]; si != nil {
+					si.Delete(shardId)
+				}
+				d.EcShardCount--
+				d.FreeEcSlots++
+			}
+		}
+	}
+	en.DeleteEcVolumeShards(vid, []erasure_coding.ShardId{shardId})
+}
+
+// addEcShard places the shard on the disk the move used when that disk is
+// known; otherwise (TargetDisk 0, server-picked) it falls back to the node's
+// disk-type bucket.
+func addEcShard(en *EcNode, collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, diskId uint32, diskType types.DiskType) {
+	d := en.Disks[diskId]
+	if diskId == 0 || d == nil {
+		en.AddEcVolumeShards(vid, collection, []erasure_coding.ShardId{shardId}, diskType)
+		return
+	}
+	diskInfo := en.Info.DiskInfos[string(diskType)]
+	if diskInfo == nil {
+		diskInfo = &master_pb.DiskInfo{Type: string(diskType)}
+		en.Info.DiskInfos[string(diskType)] = diskInfo
+	}
+	var eci *master_pb.VolumeEcShardInformationMessage
+	for _, e := range diskInfo.EcShardInfos {
+		if needle.VolumeId(e.Id) == vid && e.DiskId == diskId {
+			eci = e
+			break
+		}
+	}
+	if eci == nil {
+		eci = &master_pb.VolumeEcShardInformationMessage{
+			Id:         uint32(vid),
+			Collection: collection,
+			DiskId:     diskId,
+			DiskType:   string(diskType),
+		}
+		diskInfo.EcShardInfos = append(diskInfo.EcShardInfos, eci)
+	}
+	si := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
+	before := si.Count()
+	si.Set(erasure_coding.NewShardInfo(shardId, 0))
+	eci.EcIndexBits = si.Bitmap()
+	eci.ShardSizes = si.SizesInt64()
+	added := si.Count() - before
+
+	en.FreeEcSlot -= added
+	d.EcShardCount += added
+	d.FreeEcSlots -= added
+	if d.EcShards == nil {
+		d.EcShards = make(map[needle.VolumeId]*erasure_coding.ShardsInfo)
+	}
+	if d.EcShards[vid] == nil {
+		d.EcShards[vid] = erasure_coding.NewShardsInfo()
+	}
+	d.EcShards[vid].Set(erasure_coding.NewShardInfo(shardId, 0))
+}
+
+// mergeRejectedTargets folds the destinations this run saw refuse into the
+// no-receive sets and returns the newly added ids; an empty result means no
+// progress is possible.
+func (ecb *ecBalancer) mergeRejectedTargets(noReceiveNodes map[string]bool, noReceiveDisks map[string]map[uint32]bool) (added []string) {
+	ecb.mu.Lock()
+	defer ecb.mu.Unlock()
+	for id := range ecb.rejectedTargets {
+		if !noReceiveNodes[id] {
+			noReceiveNodes[id] = true
+			added = append(added, id)
+		}
+	}
+	for id, disks := range ecb.rejectedDisks {
+		if noReceiveNodes[id] {
+			continue
+		}
+		if noReceiveDisks[id] == nil {
+			noReceiveDisks[id] = make(map[uint32]bool)
+		}
+		for diskId := range disks {
+			if !noReceiveDisks[id][diskId] {
+				noReceiveDisks[id][diskId] = true
+				added = append(added, fmt.Sprintf("%s:disk%d", id, diskId))
+			}
+		}
+	}
+	sort.Strings(added)
+	return
+}
+
+func (ecb *ecBalancer) hasOtherError() bool {
+	ecb.mu.Lock()
+	defer ecb.mu.Unlock()
+	return ecb.sawOtherErr
+}
+
+// recordMoveResult journals an apply-mode move outcome: a success is replayed
+// onto the next attempt's snapshot, a "no space left" marks the target
+// no-receive, and any other failure makes the run non-retryable.
+func (ecb *ecBalancer) recordMoveResult(m ecbalancer.Move, err error) {
+	ecb.mu.Lock()
+	defer ecb.mu.Unlock()
+	switch {
+	case err == nil:
+		ecb.completedMoves = append(ecb.completedMoves, m)
+	case m.TargetNode != "" && volume_move.IsNoSpaceLeftError(err):
+		if m.TargetDisk > 0 {
+			// The refusal convicts only the named disk; the node's other
+			// disks may still have room.
+			if ecb.rejectedDisks == nil {
+				ecb.rejectedDisks = make(map[string]map[uint32]bool)
+			}
+			if ecb.rejectedDisks[m.TargetNode] == nil {
+				ecb.rejectedDisks[m.TargetNode] = make(map[uint32]bool)
+			}
+			ecb.rejectedDisks[m.TargetNode][m.TargetDisk] = true
+		} else {
+			// The server auto-picked and found no usable disk: the whole
+			// node is out.
+			if ecb.rejectedTargets == nil {
+				ecb.rejectedTargets = make(map[string]bool)
+			}
+			ecb.rejectedTargets[m.TargetNode] = true
+		}
+	default:
+		ecb.sawOtherErr = true
+	}
+}
+
+// defaultECRatio resolves a collection's EC data/parity counts, defaulting to
+// the standard scheme. This is the admin-side plug-in point for custom ratios.
+func defaultECRatio(_ string) (int, int) {
+	// Custom EC ratios are an enterprise feature; OSS uses the standard scheme.
+	return erasure_coding.DataShardsCount, erasure_coding.ParityShardsCount
+}
+
+// balance plans EC shard moves with the shared planner and executes them. When
+// collections is empty all collections present are balanced.
+func (ecb *ecBalancer) balance(collections []string) error {
+	topo, volumeRatio, selected := toBalancerTopology(ecb.ecNodes, collections, ecb.diskType, ecb.volumeIds, ecb.migratingVolumeIds, ecb.noReceiveTargets, ecb.noReceiveDisks)
+	if len(ecb.volumeIds) > 0 {
+		requested := make([]uint32, 0, len(ecb.volumeIds))
+		for vid := range ecb.volumeIds {
+			requested = append(requested, vid)
+		}
+		slices.Sort(requested)
+		var missing []uint32
+		for _, vid := range requested {
+			if !selected[vid] {
+				missing = append(missing, vid)
+			}
+		}
+		if len(missing) > 0 {
+			return fmt.Errorf("no ec shards found for volume(s) %v: not an ec volume, or outside the selected collection, dataCenter or diskType", missing)
+		}
+		fmt.Printf("balancing ec volume(s) %v\n", requested)
+	}
+	moves := ecbalancer.Plan(topo, ecbalancer.Options{
+		DiskType:           string(ecb.diskType),
+		ImbalanceThreshold: 0, // the shell balances to an even distribution
+		ReplicaPlacement:   ecb.replicaPlacement,
+		Ratio:              defaultECRatio,
+		// Prefer each volume's own heartbeat-reported ratio over the collection
+		// default so a mixed-ratio collection is spread per volume; 0 defers to
+		// defaultECRatio (and is the always-0 OSS case).
+		VolumeRatio: volumeRatio,
+		// Balance the global phase by fractional fullness so heterogeneous-capacity
+		// nodes fill proportionally (matching the worker). This is identical to raw
+		// shard count when capacities are uniform.
+		GlobalUtilizationBased: true,
+		RackTotalCapRaised: func(collection string, vid uint32, rackCap, evenCap int) {
+			fmt.Printf("ec volume %d (collection %q): rack-total-cap raised to %d shards per rack, above the even %d: the racks lack room for an even spread\n", vid, collection, rackCap, evenCap)
+		},
+	})
+	if len(ecb.volumeIds) > 0 {
+		var deletions int
+		for _, m := range moves {
+			if m.Phase == "dedup" {
+				deletions++
+			}
+		}
+		fmt.Printf("planned %d ec shard move(s) and %d ec shard deletion(s)\n", len(moves)-deletions, deletions)
+	}
+	ecb.plannedMoves = len(moves)
+	return ecb.executeMoves(moves)
+}
+
+// toBalancerTopology builds an ecbalancer.Topology from the EcNode model,
+// including the shards of the requested collections (all collections when empty)
+// and, when volumeIds is non-nil, only those volume ids. Volumes left out here are
+// invisible to the planner, so no phase - dedup included - can plan against them.
+// It also returns a per-volume ratio lookup built from each shard's heartbeat
+// (0,0 when unreported, e.g. always in OSS), which Plan prefers over the
+// collection ratio for mixed-ratio clusters, and the set of volume ids that made
+// it into the topology.
+func toBalancerTopology(ecNodes []*EcNode, collections []string, diskType types.DiskType, volumeIds map[uint32]bool, migratingVolumeIds map[uint32]bool, noReceiveTargets map[string]bool, noReceiveDisks map[string]map[uint32]bool) (*ecbalancer.Topology, func(collection string, vid uint32) (int, int), map[uint32]bool) {
+	allowed := make(map[string]bool, len(collections))
+	for _, c := range collections {
+		allowed[c] = true
+	}
+
+	type volRatioKey struct {
+		collection string
+		vid        uint32
+	}
+	volRatios := make(map[volRatioKey][2]int)
+	selected := make(map[uint32]bool)
+
+	topo := ecbalancer.NewTopology()
+	for _, en := range ecNodes {
+		rackKey := string(en.DC) + ":" + string(en.Rack)
+		node := topo.AddNode(en.Info.Id, string(en.DC), rackKey, en.FreeEcSlot)
+		if noReceiveTargets[en.Info.Id] {
+			node.SetNoReceive()
+		}
+		// Group by physical machine (host) so shards spread across machines, not just
+		// nodes; the id stays the node identity used for moves.
+		node.SetHost(pb.NewServerAddressFromDataNode(en.Info).ToHost())
+		for diskId, d := range en.Disks {
+			node.AddDisk(diskId, d.DiskType, d.FreeEcSlots, d.EcShardCount)
+			if noReceiveDisks[en.Info.Id][diskId] {
+				node.SetDiskNoReceive(diskId)
+			}
+		}
+		for diskTypeKey, diskInfo := range en.Info.DiskInfos {
+			if diskInfo == nil {
+				continue
+			}
+			for _, eci := range diskInfo.EcShardInfos {
+				// A migrating (mid-encode) volume's fresh shards sit beside the
+				// source .dat, in whatever bucket that disk belongs to; ingest
+				// them regardless so the balance can move them onto the target
+				// disk type. All other volumes keep the bucket filter.
+				if diskTypeKey != string(diskType) && !migratingVolumeIds[eci.Id] {
+					continue
+				}
+				if len(allowed) > 0 && !allowed[eci.Collection] {
+					continue
+				}
+				if volumeIds != nil && !volumeIds[eci.Id] {
+					continue
+				}
+				selected[eci.Id] = true
+				node.AddShards(eci.Id, eci.Collection, eci.DiskId, erasure_coding.ShardBits(eci.EcIndexBits))
+				if d, p := ecbalancer.VolumeShardRatio(eci); d > 0 || p > 0 {
+					volRatios[volRatioKey{eci.Collection, eci.Id}] = [2]int{d, p}
+				}
+			}
+		}
+	}
+
+	volumeRatio := func(collection string, vid uint32) (int, int) {
+		r := volRatios[volRatioKey{collection, vid}]
+		return r[0], r[1]
+	}
+	return topo, volumeRatio, selected
+}
+
+// executeMoves carries out the planned moves. Phases run in order (a within-rack
+// move can depend on a cross-rack move's result), and the independent moves
+// within a phase run with up to maxParallelization concurrency. Apply mode does
+// only the RPCs; dry-run mode runs sequentially and mutates the in-memory EcNode
+// model so callers/tests can inspect the planned end state.
+func (ecb *ecBalancer) executeMoves(moves []ecbalancer.Move) error {
+	byID := make(map[string]*EcNode, len(ecb.ecNodes))
+	for _, en := range ecb.ecNodes {
+		byID[en.Info.Id] = en
+	}
+
+	// Plan emits moves grouped by phase; run each contiguous same-phase group
+	// together, waiting before the next so cross-phase dependencies hold.
+	for i := 0; i < len(moves); {
+		j := i
+		for j < len(moves) && moves[j].Phase == moves[i].Phase {
+			j++
+		}
+		if err := ecb.executePhase(byID, moves[i:j]); err != nil {
+			return err
+		}
+		i = j
+	}
+	return nil
+}
+
+func (ecb *ecBalancer) executePhase(byID map[string]*EcNode, moves []ecbalancer.Move) error {
+	if !ecb.applyBalancing {
+		// Dry-run: sequential so the in-memory model updates are race-free and
+		// reflect the full plan for inspection.
+		for _, m := range moves {
+			if err := ecb.executeMove(byID, m); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	// Apply mode: parallelize across volumes, but run one volume's moves within a
+	// phase sequentially. Concurrent moves of the same volume to a node can race
+	// on its shared .ecx/.ecj/.vif sidecar files.
+	var order []uint32
+	byVol := make(map[uint32][]ecbalancer.Move)
+	for _, m := range moves {
+		if _, ok := byVol[m.VolumeID]; !ok {
+			order = append(order, m.VolumeID)
+		}
+		byVol[m.VolumeID] = append(byVol[m.VolumeID], m)
+	}
+	taskGroups := make([][]util.ErrorWaitGroupTask, 0, len(order))
+	for _, vid := range order {
+		movesForVolume := byVol[vid]
+		taskGroup := make([]util.ErrorWaitGroupTask, 0, len(movesForVolume))
+		for _, move := range movesForVolume {
+			move := move
+			taskGroup = append(taskGroup, func() error {
+				return ecb.executeMove(byID, move)
+			})
+		}
+		taskGroups = append(taskGroups, taskGroup)
+	}
+	return util.ExecuteParallelTaskGroups(ecb.maxParallelization, taskGroups)
+}
+
+// verifyEcShardOnKeepNode confirms the node a dedup move chose to keep actually
+// holds the shard, so a duplicate is only removed when a real copy remains. An
+// unreachable keep node is unknown, not confirmed, and blocks the delete — as
+// does one that answers too slowly to be waited on, which is why this is
+// bounded rather than left to hang the whole balance run.
+// ecShardVerifyTimeout bounds the keep-node inventory query. A node that accepts
+// the connection but never answers must not stall the whole balance run.
+const ecShardVerifyTimeout = 30 * time.Second
+
+func verifyEcShardOnKeepNode(grpcDialOption grpc.DialOption, collection string, vid needle.VolumeId, keepNode string, shardId erasure_coding.ShardId) error {
+	if keepNode == "" {
+		return fmt.Errorf("refusing dedup delete of %d.%d: no keep node recorded", vid, shardId)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), ecShardVerifyTimeout)
+	defer cancel()
+	if err := erasure_coding.VerifyShardsOnServer(ctx, collection, uint32(vid), keepNode,
+		[]uint32{uint32(shardId)}, grpcDialOption); err != nil {
+		return fmt.Errorf("refusing dedup delete: %w", err)
+	}
+	return nil
+}
+
+func (ecb *ecBalancer) executeMove(byID map[string]*EcNode, m ecbalancer.Move) error {
+	src := byID[m.SourceNode]
+	if src == nil {
+		return nil
+	}
+	vid := needle.VolumeId(m.VolumeID)
+	shardId := erasure_coding.ShardId(m.ShardID)
+	shardIds := []erasure_coding.ShardId{shardId}
+
+	if m.Phase == "dedup" {
+		fmt.Printf("dedup: delete ec shard %d.%d on %s\n", vid, shardId, m.SourceNode)
+		if !ecb.applyBalancing {
+			src.DeleteEcVolumeShards(vid, shardIds)
+			return nil
+		}
+		grpcDialOption := ecb.env.GrpcDialOption
+		// Nothing is copied first, so the shard surviving elsewhere is the only
+		// thing making this safe -- and the plan saying so is not evidence. A
+		// topology entry can name a location holding nothing, and deleting on
+		// that basis removes the last copy. Confirm the keep node has it.
+		err := verifyEcShardOnKeepNode(grpcDialOption, m.Collection, vid, m.KeepNode, shardId)
+		addr := pb.NewServerAddressFromDataNode(src.Info)
+		if err == nil {
+			err = UnmountEcShards(grpcDialOption, vid, addr, shardIds)
+		}
+		if err == nil {
+			err = SourceServerDeleteEcShards(grpcDialOption, m.Collection, vid, addr, shardIds)
+		}
+		ecb.recordMoveResult(m, err)
+		return err
+	}
+
+	dst := byID[m.TargetNode]
+	if dst == nil {
+		return nil
+	}
+	if m.TargetDisk > 0 {
+		fmt.Printf("%s moves ec shard %d.%d to %s (disk %d)\n", m.SourceNode, vid, shardId, m.TargetNode, m.TargetDisk)
+	} else {
+		fmt.Printf("%s moves ec shard %d.%d to %s\n", m.SourceNode, vid, shardId, m.TargetNode)
+	}
+	if !ecb.applyBalancing {
+		// Dry-run: update the in-memory model only.
+		return MoveMountedShardToEcNode(ecb.env, src, m.Collection, vid, shardId, dst, m.TargetDisk, false, ecb.diskType)
+	}
+	err := ecb.applyShardMoveRPC(src, dst, m.Collection, vid, shardId, m.TargetDisk)
+	ecb.recordMoveResult(m, err)
+	return err
+}
+
+// applyShardMoveRPC copies a shard to the destination disk, verifies the
+// destination registered it, then unmounts and deletes it on the source. It
+// does not touch the in-memory model, so it is safe to run concurrently across
+// the moves of a phase.
+func (ecb *ecBalancer) applyShardMoveRPC(src, dst *EcNode, collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, destDiskId uint32) error {
+	srcAddr := pb.NewServerAddressFromDataNode(src.Info)
+	dstAddr := pb.NewServerAddressFromDataNode(dst.Info)
+	if volume_move.SameServer(srcAddr, dstAddr) {
+		// A same-server (cross-disk) move cannot be expressed with these RPCs;
+		// leave the shard where it is.
+		return nil
+	}
+	return volume_move.NewMover(ecb.env.GrpcDialOption).MoveEcShards(context.Background(), volume_move.EcShardMove{
+		VolumeId:   vid,
+		Collection: collection,
+		ShardIds:   []erasure_coding.ShardId{shardId},
+		Source:     srcAddr,
+		Target:     dstAddr,
+		TargetDisk: destDiskId,
+	}, volume_move.EcMoveOptions{IoBytePerSecond: ecb.ioBytePerSecond, Writer: os.Stdout})
+}
+
+// CountExistingEcShardsForVolume returns the number of distinct EC shard IDs
+// for (volumeID, collection) present in the topology, counting only the single
+// largest encode generation. Shards are grouped by encode_ts_ns (the per-encode
+// identity from .vif), so two interrupted encode runs whose shard sets overlap
+// are never unioned into a false-complete set that would wrongly trigger the
+// orphaned-source delete. Walks every disk's EcIndexBits bitmap rather than
+// trusting len(EcShardInfos), because a single info entry can carry multiple
+// shards. Shards reporting encode_ts_ns==0 (pre-upgrade servers) form their own
+// generation bucket.
+//
+// Limitation: the heartbeat carries one encode_ts_ns per (volume, disk), so this
+// separates generations living on different disks; same-disk mixing is prevented
+// upstream by the pre-encode artifact wipe and the cross-run read guard.
+func CountExistingEcShardsForVolume(topologyInfo *master_pb.TopologyInfo, volumeID uint32, collection string) int {
+	if topologyInfo == nil {
+		return 0
+	}
+	perGeneration := make(map[int64]erasure_coding.ShardBits)
+	for _, dc := range topologyInfo.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, node := range rack.DataNodeInfos {
+				for _, diskInfo := range node.DiskInfos {
+					if diskInfo == nil {
+						continue
+					}
+					for _, ecShardInfo := range diskInfo.EcShardInfos {
+						if ecShardInfo == nil {
+							continue
+						}
+						if ecShardInfo.Id != volumeID || ecShardInfo.Collection != collection {
+							continue
+						}
+						perGeneration[ecShardInfo.EncodeTsNs] |= erasure_coding.ShardBits(ecShardInfo.EcIndexBits)
+					}
+				}
+			}
+		}
+	}
+	best := 0
+	for _, bits := range perGeneration {
+		if c := bits.Count(); c > best {
+			best = c
+		}
+	}
+	return best
+}
+
+// ParseVolumeIdsFlag parses a comma-separated -volumeIds flag value, dropping
+// duplicates and keeping the given order.
+func ParseVolumeIdsFlag(volumeIdsStr string) ([]needle.VolumeId, error) {
+	var volumeIds []needle.VolumeId
+	seen := make(map[needle.VolumeId]bool)
+	for _, part := range strings.Split(volumeIdsStr, ",") {
+		part = strings.TrimSpace(part)
+		if part == "" {
+			continue
+		}
+		vidValue, err := strconv.ParseUint(part, 10, 32)
+		if err != nil || vidValue == 0 {
+			return nil, fmt.Errorf("invalid volume id %q in -volumeIds", part)
+		}
+		// ParseUint with bitSize 32 bounds the value; convert through uint32
+		// (matching the rest of the codebase) so the narrowing is provably safe.
+		vid := needle.VolumeId(uint32(vidValue))
+		if seen[vid] {
+			continue
+		}
+		seen[vid] = true
+		volumeIds = append(volumeIds, vid)
+	}
+	if len(volumeIds) == 0 {
+		return nil, fmt.Errorf("-volumeIds does not contain any valid volume id")
+	}
+	return volumeIds, nil
+}
diff --git a/weed/shell/command_ec_test.go b/weed/ec/ec_common_test.go
similarity index 82%
rename from weed/shell/command_ec_test.go
rename to weed/ec/ec_common_test.go
index 63a3074463..4d6387fd2d 100644
--- a/weed/shell/command_ec_test.go
+++ b/weed/ec/ec_common_test.go
@@ -1,6 +1,7 @@
-package shell
+package ec
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
@@ -14,15 +15,15 @@ import (
 // best-scoring disk 0 (0 is also the zero value) and returned the fallback.
 func TestPickBestDiskOnNodeSelectsPhysicalDiskZero(t *testing.T) {
 	ecNode := &EcNode{
-		disks: map[uint32]*EcDisk{
-			0: {diskId: 0, diskType: string(types.SsdType), freeEcSlots: 10, ecShards: map[needle.VolumeId]*erasure_coding.ShardsInfo{}},
-			5: {diskId: 5, diskType: string(types.HardDriveType), freeEcSlots: 10, ecShards: map[needle.VolumeId]*erasure_coding.ShardsInfo{}},
+		Disks: map[uint32]*EcDisk{
+			0: {DiskId: 0, DiskType: string(types.SsdType), FreeEcSlots: 10, EcShards: map[needle.VolumeId]*erasure_coding.ShardsInfo{}},
+			5: {DiskId: 5, DiskType: string(types.HardDriveType), FreeEcSlots: 10, EcShards: map[needle.VolumeId]*erasure_coding.ShardsInfo{}},
 		},
 	}
 
 	// Disk 0 matches the requested type; it must win over the non-matching
 	// fallback on disk 5 instead of being treated as "no match".
-	if got := pickBestDiskOnNode(ecNode, needle.VolumeId(42), types.SsdType, false, 0, 0); got != 0 {
+	if got := PickBestDiskOnNode(ecNode, needle.VolumeId(42), types.SsdType, false, 0, 0); got != 0 {
 		t.Fatalf("want physical disk 0 (matching type), got %d", got)
 	}
 }
@@ -141,18 +142,18 @@ func TestCommandEcBalanceVolumeEvenButRackUneven(t *testing.T) {
 
 func newEcNode(dc string, rack string, dataNodeId string, freeEcSlot int) *EcNode {
 	return &EcNode{
-		info: &master_pb.DataNodeInfo{
+		Info: &master_pb.DataNodeInfo{
 			Id:        dataNodeId,
 			DiskInfos: make(map[string]*master_pb.DiskInfo),
 		},
-		dc:         DataCenterId(dc),
-		rack:       RackId(rack),
-		freeEcSlot: freeEcSlot,
+		DC:         DataCenterId(dc),
+		Rack:       RackId(rack),
+		FreeEcSlot: freeEcSlot,
 	}
 }
 
 func (ecNode *EcNode) addEcVolumeAndShardsForTest(vid uint32, collection string, shardIds []erasure_coding.ShardId) *EcNode {
-	return ecNode.addEcVolumeShards(needle.VolumeId(vid), collection, shardIds, types.HardDriveType)
+	return ecNode.AddEcVolumeShards(needle.VolumeId(vid), collection, shardIds, types.HardDriveType)
 }
 
 // TestCommandEcBalanceEvenDataAndParityDistribution verifies that after balancing:
@@ -189,8 +190,8 @@ func TestCommandEcBalanceEvenDataAndParityDistribution(t *testing.T) {
 	// With 6 racks:
 	// - Data shards (10): max 2 per rack (ceil(10/6) = 2)
 	// - Parity shards (4): max 1 per rack (ceil(4/6) = 1)
-	maxDataPerRack := ceilDivide(dataShardCount, 6)     // 2
-	maxParityPerRack := ceilDivide(parityShardCount, 6) // 1
+	maxDataPerRack := CeilDivide(dataShardCount, 6)     // 2
+	maxParityPerRack := CeilDivide(parityShardCount, 6) // 1
 
 	// Verify no rack has more than max data shards
 	for rackId, count := range dataPerRack {
@@ -246,9 +247,9 @@ func countDataAndParityShardsPerRack(ecNodes []*EcNode, vid needle.VolumeId, dat
 	parityPerRack = make(map[string]int)
 
 	for _, ecNode := range ecNodes {
-		si := findEcVolumeShardsInfo(ecNode, vid, types.HardDriveType)
+		si := FindEcVolumeShardsInfo(ecNode, vid, types.HardDriveType)
 		for _, shardId := range si.Ids() {
-			rackId := string(ecNode.rack)
+			rackId := string(ecNode.Rack)
 			if int(shardId) < dataShardCount {
 				dataPerRack[rackId]++
 			} else {
@@ -285,8 +286,8 @@ func TestCommandEcBalanceMultipleVolumesEvenDistribution(t *testing.T) {
 	for _, vid := range []needle.VolumeId{1, 2} {
 		dataPerRack, parityPerRack := countDataAndParityShardsPerRack(ecb.ecNodes, vid, erasure_coding.DataShardsCount)
 
-		maxDataPerRack := ceilDivide(erasure_coding.DataShardsCount, 6)
-		maxParityPerRack := ceilDivide(erasure_coding.ParityShardsCount, 6)
+		maxDataPerRack := CeilDivide(erasure_coding.DataShardsCount, 6)
+		maxParityPerRack := CeilDivide(erasure_coding.ParityShardsCount, 6)
 
 		for rackId, count := range dataPerRack {
 			if count > maxDataPerRack {
@@ -338,16 +339,16 @@ func TestCommandEcBalanceAllNodesShareAllVolumes(t *testing.T) {
 	// Count total shards per node after balancing
 	for _, node := range ecb.ecNodes {
 		count := 0
-		if diskInfo, found := node.info.DiskInfos[string(types.HardDriveType)]; found {
+		if diskInfo, found := node.Info.DiskInfos[string(types.HardDriveType)]; found {
 			for _, ecsi := range diskInfo.EcShardInfos {
 				count += erasure_coding.GetShardCount(ecsi)
 			}
 		}
 		// Average is 7, so all nodes should be at 7 (ceil(28/4) = 7)
 		if count > 7 {
-			t.Errorf("node %s has %d shards after balancing, expected at most 7", node.info.Id, count)
+			t.Errorf("node %s has %d shards after balancing, expected at most 7", node.Info.Id, count)
 		}
-		t.Logf("node %s: %d shards", node.info.Id, count)
+		t.Logf("node %s: %d shards", node.Info.Id, count)
 	}
 }
 
@@ -408,12 +409,12 @@ func TestCommandEcBalanceIssue8793Topology(t *testing.T) {
 	// Log initial state
 	for _, node := range ecb.ecNodes {
 		count := 0
-		if diskInfo, found := node.info.DiskInfos[string(types.HardDriveType)]; found {
+		if diskInfo, found := node.Info.DiskInfos[string(types.HardDriveType)]; found {
 			for _, ecsi := range diskInfo.EcShardInfos {
 				count += erasure_coding.GetShardCount(ecsi)
 			}
 		}
-		t.Logf("BEFORE node %s (max %d): %d shards", node.info.Id, node.freeEcSlot+count, count)
+		t.Logf("BEFORE node %s (max %d): %d shards", node.Info.Id, node.FreeEcSlot+count, count)
 	}
 
 	ecb.balance([]string{"cldata"})
@@ -432,14 +433,14 @@ func TestCommandEcBalanceIssue8793Topology(t *testing.T) {
 	shardCounts := make(map[string]int)
 	for _, node := range ecb.ecNodes {
 		count := 0
-		if diskInfo, found := node.info.DiskInfos[string(types.HardDriveType)]; found {
+		if diskInfo, found := node.Info.DiskInfos[string(types.HardDriveType)]; found {
 			for _, ecsi := range diskInfo.EcShardInfos {
 				count += erasure_coding.GetShardCount(ecsi)
 			}
 		}
-		shardCounts[node.info.Id] = count
+		shardCounts[node.Info.Id] = count
 		totalShards += count
-		totalCapacity += capacityByID[node.info.Id]
+		totalCapacity += capacityByID[node.Info.Id]
 	}
 	overallFullness := float64(totalShards) / float64(totalCapacity)
 
@@ -447,14 +448,72 @@ func TestCommandEcBalanceIssue8793Topology(t *testing.T) {
 	// would sit ~38 points above overall), but above integer-rounding skew.
 	const tolerance = 0.05
 	for _, node := range ecb.ecNodes {
-		count := shardCounts[node.info.Id]
-		capacity := capacityByID[node.info.Id]
+		count := shardCounts[node.Info.Id]
+		capacity := capacityByID[node.Info.Id]
 		fullness := float64(count) / float64(capacity)
 		t.Logf("AFTER  node %s: %d/%d shards (%.0f%% full, overall %.0f%%)",
-			node.info.Id, count, capacity, fullness*100, overallFullness*100)
+			node.Info.Id, count, capacity, fullness*100, overallFullness*100)
 		if diff := fullness - overallFullness; diff > tolerance || diff < -tolerance {
 			t.Errorf("node %s fullness %.1f%% deviates from overall %.1f%% by more than %.0f points",
-				node.info.Id, fullness*100, overallFullness*100, tolerance*100)
+				node.Info.Id, fullness*100, overallFullness*100, tolerance*100)
 		}
 	}
 }
+
+// TestCommandEcBalanceVolumeIdsFilter checks that -volumeIds keeps every phase,
+// dedup included, off the volumes that were not asked for.
+func TestCommandEcBalanceVolumeIdsFilter(t *testing.T) {
+	ecb := &ecBalancer{
+		ecNodes: []*EcNode{
+			// Volume 1: all shards on one node, so balancing has plenty to move.
+			newEcNode("dc1", "rack1", "dn1", 100).addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}),
+			// Volume 2 is equally lopsided, and shard 0 is duplicated on dn3.
+			newEcNode("dc1", "rack2", "dn2", 100).addEcVolumeAndShardsForTest(2, "c1", []erasure_coding.ShardId{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}),
+			newEcNode("dc1", "rack3", "dn3", 100).addEcVolumeAndShardsForTest(2, "c1", []erasure_coding.ShardId{0}),
+			newEcNode("dc1", "rack4", "dn4", 100),
+			newEcNode("dc1", "rack5", "dn5", 100),
+			newEcNode("dc1", "rack6", "dn6", 100),
+		},
+		applyBalancing: false,
+		diskType:       types.HardDriveType,
+		volumeIds:      map[uint32]bool{1: true},
+	}
+
+	if err := ecb.balance([]string{"c1"}); err != nil {
+		t.Fatalf("balance: %v", err)
+	}
+
+	// Volume 1 spreads out.
+	if count := ecb.ecNodes[0].LocalShardIdCount(1); count == 14 {
+		t.Errorf("volume 1 was not balanced: dn1 still holds all %d shards", count)
+	}
+
+	// Volume 2 keeps every shard where it was, duplicate included.
+	if count := ecb.ecNodes[1].LocalShardIdCount(2); count != 14 {
+		t.Errorf("dn2 holds %d shards of the unselected volume 2, want 14", count)
+	}
+	if count := ecb.ecNodes[2].LocalShardIdCount(2); count != 1 {
+		t.Errorf("dn3 holds %d shards of the unselected volume 2, want the duplicate to survive", count)
+	}
+}
+
+func TestCommandEcBalanceVolumeIdsNotFound(t *testing.T) {
+	ecb := &ecBalancer{
+		ecNodes: []*EcNode{
+			newEcNode("dc1", "rack1", "dn1", 100).addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13}),
+			newEcNode("dc1", "rack2", "dn2", 100),
+		},
+		applyBalancing: false,
+		diskType:       types.HardDriveType,
+		volumeIds:      map[uint32]bool{1: true, 99: true},
+	}
+
+	err := ecb.balance([]string{"c1"})
+	if err == nil || !strings.Contains(err.Error(), "[99]") {
+		t.Fatalf("want an error naming volume 99, got %v", err)
+	}
+	// The valid id must not be balanced either: the plan is all-or-nothing.
+	if count := ecb.ecNodes[0].LocalShardIdCount(1); count != 14 {
+		t.Errorf("dn1 holds %d shards, want the rejected plan to leave volume 1 untouched", count)
+	}
+}
diff --git a/weed/ec/ec_decode.go b/weed/ec/ec_decode.go
new file mode 100644
index 0000000000..985b522c5d
--- /dev/null
+++ b/weed/ec/ec_decode.go
@@ -0,0 +1,463 @@
+package ec
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func DoEcDecode(env *Env, topoInfo *master_pb.TopologyInfo, collection string, vid needle.VolumeId, diskType types.DiskType, checkMinFreeSpace bool, diskUsageState *DecodeDiskUsageState) (err error) {
+
+	if !env.isLocked() {
+		return fmt.Errorf("lock is lost")
+	}
+
+	// find volume location
+	nodeToEcShardsInfo, dataShards := collectEcNodeShardsInfo(topoInfo, vid)
+
+	fmt.Printf("ec volume %d shard locations: %+v\n", vid, nodeToEcShardsInfo)
+
+	if len(nodeToEcShardsInfo) == 0 {
+		return fmt.Errorf("no EC shards found for volume %d", vid)
+	}
+
+	// A decode interrupted while deleting the shards leaves the regenerated
+	// volume in place with the set half gone, so a re-run finds both and fails
+	// re-collecting the first shard the interrupted run removed.
+	//
+	// Finding a volume beside the shards is not enough to act on: an encode
+	// interrupted before it deleted the original leaves the same shape, as does
+	// a decode killed while generating, whose volume may be half written. Both
+	// of those leave the shard set COMPLETE. Only the deletion phase can remove
+	// a data shard, so require one to be gone -- that is also exactly the state
+	// no decode can recover from, which makes finishing the cleanup the only
+	// move left rather than a choice between two.
+	if _, found := missingDataShard(nodeToEcShardsInfo, dataShards); found {
+		holder, hasVolume := regularVolumeHolder(topoInfo, vid)
+		if !hasVolume {
+			return fmt.Errorf("volume %d cannot be decoded: data shards are missing and no decoded volume exists to finish", vid)
+		}
+		if err := verifyDecodedVolumeBeforeDelete(env.GrpcDialOption, holder, vid); err != nil {
+			return fmt.Errorf("volume %d is already decoded on %s but did not verify, keeping its ec shards: %v", vid, holder, err)
+		}
+		fmt.Printf("volume %d is already decoded on %s; deleting the ec shards the interrupted run left behind\n", vid, holder)
+		return unmountAndDeleteEcShardsWithPrefix("deleteDecodedEcShards", env.GrpcDialOption, collection, nodeToEcShardsInfo, vid)
+	}
+
+	var originalShardCounts map[pb.ServerAddress]int
+	if diskUsageState != nil {
+		originalShardCounts = make(map[pb.ServerAddress]int, len(nodeToEcShardsInfo))
+		for location, si := range nodeToEcShardsInfo {
+			originalShardCounts[location] = si.Count()
+		}
+	}
+
+	var eligibleTargets map[pb.ServerAddress]struct{}
+	if checkMinFreeSpace {
+		if diskUsageState == nil {
+			return fmt.Errorf("min free space checking requires disk usage state")
+		}
+		eligibleTargets = make(map[pb.ServerAddress]struct{})
+		for location := range nodeToEcShardsInfo {
+			if freeCount, found := diskUsageState.freeVolumeCount(location); found && freeCount > 0 {
+				eligibleTargets[location] = struct{}{}
+			}
+		}
+		if len(eligibleTargets) == 0 {
+			return fmt.Errorf("no eligible target datanodes with free volume slots for volume %d (diskType %s); use -checkMinFreeSpace=false to override", vid, diskType.ReadableString())
+		}
+	}
+
+	// collect ec shards to the server with most space
+	targetNodeLocation, err := collectEcShards(env, nodeToEcShardsInfo, collection, vid, eligibleTargets, dataShards)
+	if err != nil {
+		return fmt.Errorf("collectEcShards for volume %d: %v", vid, err)
+	}
+
+	// generate a normal volume
+	err = generateNormalVolume(env.GrpcDialOption, vid, collection, targetNodeLocation)
+	if err != nil {
+		// Special case: if the EC index has no live entries, decoding is a no-op.
+		// Just purge EC shards and return success without generating/mounting an empty volume.
+		if isEcDecodeEmptyVolumeErr(err) {
+			if err := unmountAndDeleteEcShards(env.GrpcDialOption, collection, nodeToEcShardsInfo, vid); err != nil {
+				return err
+			}
+			if diskUsageState != nil {
+				diskUsageState.applyDecode(targetNodeLocation, originalShardCounts, false)
+			}
+			return nil
+		}
+		return fmt.Errorf("generate normal volume %d on %s: %v", vid, targetNodeLocation, err)
+	}
+
+	// mount the decoded volume after server-side offline compaction succeeded
+	err = mountDecodedVolume(env.GrpcDialOption, targetNodeLocation, vid)
+	if err != nil {
+		return fmt.Errorf("mount decoded volume %d on %s: %v", vid, targetNodeLocation, err)
+	}
+
+	// Confirm the regenerated .dat is present and non-empty before destroying
+	// the shards. Without this gate, a silent failure in generate/mount could
+	// leave the cluster with neither shards nor volume.
+	if err := verifyDecodedVolumeBeforeDelete(env.GrpcDialOption, targetNodeLocation, vid); err != nil {
+		return fmt.Errorf("verify decoded volume %d on %s before deleting shards: %w", vid, targetNodeLocation, err)
+	}
+
+	// delete the previous ec shards
+	err = unmountAndDeleteEcShardsWithPrefix("deleteDecodedEcShards", env.GrpcDialOption, collection, nodeToEcShardsInfo, vid)
+	if err != nil {
+		return fmt.Errorf("delete ec shards for volume %d: %v", vid, err)
+	}
+	if diskUsageState != nil {
+		diskUsageState.applyDecode(targetNodeLocation, originalShardCounts, true)
+	}
+
+	return nil
+}
+
+func isEcDecodeEmptyVolumeErr(err error) bool {
+	st, ok := status.FromError(err)
+	if !ok {
+		return false
+	}
+	if st.Code() != codes.FailedPrecondition {
+		return false
+	}
+	// Keep this robust against wording tweaks while still being specific.
+	return strings.Contains(st.Message(), erasure_coding.EcNoLiveEntriesSubstring)
+}
+
+func unmountAndDeleteEcShards(grpcDialOption grpc.DialOption, collection string, nodeToShardsInfo map[pb.ServerAddress]*erasure_coding.ShardsInfo, vid needle.VolumeId) error {
+	return unmountAndDeleteEcShardsWithPrefix("unmountAndDeleteEcShards", grpcDialOption, collection, nodeToShardsInfo, vid)
+}
+
+func unmountAndDeleteEcShardsWithPrefix(prefix string, grpcDialOption grpc.DialOption, collection string, nodeToShardsInfo map[pb.ServerAddress]*erasure_coding.ShardsInfo, vid needle.VolumeId) error {
+	ewg := util.NewErrorWaitGroup(len(nodeToShardsInfo))
+
+	// unmount and delete ec shards in parallel (one goroutine per location)
+	for location, si := range nodeToShardsInfo {
+		location, si := location, si // capture loop variables for goroutine
+		ewg.Add(func() error {
+			fmt.Printf("unmount ec volume %d on %s has shards: %+v\n", vid, location, si.Ids())
+			if err := UnmountEcShards(grpcDialOption, vid, location, si.Ids()); err != nil {
+				return fmt.Errorf("%s unmount ec volume %d on %s: %w", prefix, vid, location, err)
+			}
+
+			fmt.Printf("delete ec volume %d on %s has shards: %+v\n", vid, location, si.Ids())
+			if err := SourceServerDeleteEcShards(grpcDialOption, collection, vid, location, si.Ids()); err != nil {
+				return fmt.Errorf("%s delete ec volume %d on %s: %w", prefix, vid, location, err)
+			}
+			return nil
+		})
+	}
+	return ewg.Wait()
+}
+
+// missingDataShard reports the first data shard absent from every holder.
+// Parity shards are not enough to answer this: the decode rebuilds the volume
+// from the data shards, so one of those going missing is what makes a re-run
+// impossible.
+func missingDataShard(nodeToShardsInfo map[pb.ServerAddress]*erasure_coding.ShardsInfo, dataShards int) (erasure_coding.ShardId, bool) {
+	var present erasure_coding.ShardBits
+	for _, si := range nodeToShardsInfo {
+		for _, id := range si.Ids() {
+			present = present.Set(id)
+		}
+	}
+	for id := 0; id < dataShards; id++ {
+		if !present.Has(erasure_coding.ShardId(id)) {
+			return erasure_coding.ShardId(id), true
+		}
+	}
+	return 0, false
+}
+
+// regularVolumeHolder returns a server already serving vid as a regular
+// volume. A decode only finds one when an earlier run was interrupted between
+// regenerating the volume and deleting the shards it came from.
+func regularVolumeHolder(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId) (pb.ServerAddress, bool) {
+	var holder pb.ServerAddress
+	found := false
+	EachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		if found {
+			return
+		}
+		for _, diskInfo := range dn.DiskInfos {
+			for _, vi := range diskInfo.VolumeInfos {
+				if needle.VolumeId(vi.Id) == vid {
+					holder = pb.NewServerAddressFromDataNode(dn)
+					found = true
+					return
+				}
+			}
+		}
+	})
+	return holder, found
+}
+
+func verifyDecodedVolumeBeforeDelete(grpcDialOption grpc.DialOption, target pb.ServerAddress, vid needle.VolumeId) error {
+	var resp *volume_server_pb.ReadVolumeFileStatusResponse
+	if err := operation.WithVolumeServerClient(false, target, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+		r, e := client.ReadVolumeFileStatus(context.Background(), &volume_server_pb.ReadVolumeFileStatusRequest{
+			VolumeId: uint32(vid),
+		})
+		if e != nil {
+			return e
+		}
+		resp = r
+		return nil
+	}); err != nil {
+		return fmt.Errorf("read volume file status: %w", err)
+	}
+	if resp.DatFileSize == 0 {
+		return fmt.Errorf("decoded .dat is 0 bytes")
+	}
+	if resp.IdxFileSize == 0 {
+		return fmt.Errorf("decoded .idx is 0 bytes")
+	}
+	glog.V(0).Infof("ec decode verification ok for volume %d on %s: dat=%d idx=%d", vid, target, resp.DatFileSize, resp.IdxFileSize)
+	return nil
+}
+
+func mountDecodedVolume(grpcDialOption grpc.DialOption, targetNodeLocation pb.ServerAddress, vid needle.VolumeId) error {
+	return operation.WithVolumeServerClient(false, targetNodeLocation, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+		_, mountErr := volumeServerClient.VolumeMount(context.Background(), &volume_server_pb.VolumeMountRequest{
+			VolumeId: uint32(vid),
+		})
+		return mountErr
+	})
+}
+
+func generateNormalVolume(grpcDialOption grpc.DialOption, vid needle.VolumeId, collection string, sourceVolumeServer pb.ServerAddress) error {
+	fmt.Printf("generateNormalVolume from ec volume %d on %s\n", vid, sourceVolumeServer)
+
+	err := operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+		_, genErr := volumeServerClient.VolumeEcShardsToVolume(context.Background(), &volume_server_pb.VolumeEcShardsToVolumeRequest{
+			VolumeId:   uint32(vid),
+			Collection: collection,
+		})
+		return genErr
+	})
+
+	return err
+
+}
+
+func collectEcShards(env *Env, nodeToShardsInfo map[pb.ServerAddress]*erasure_coding.ShardsInfo, collection string, vid needle.VolumeId, eligibleTargets map[pb.ServerAddress]struct{}, dataShards int) (targetNodeLocation pb.ServerAddress, err error) {
+
+	maxShardCount := -1
+	existingShardsInfo := erasure_coding.NewShardsInfo()
+	for loc, si := range nodeToShardsInfo {
+		if eligibleTargets != nil {
+			if _, ok := eligibleTargets[loc]; !ok {
+				continue
+			}
+		}
+		toBeCopiedShardCount := si.MinusParityShards(dataShards).Count()
+		if toBeCopiedShardCount > maxShardCount {
+			maxShardCount = toBeCopiedShardCount
+			targetNodeLocation = loc
+			existingShardsInfo = si
+		}
+	}
+	if targetNodeLocation == "" {
+		return "", fmt.Errorf("no eligible target datanodes available to decode volume %d", vid)
+	}
+
+	// Trust only shards the target can actually serve: an interrupted earlier
+	// decode or balance can leave the master believing the target holds a
+	// shard whose file never landed. A phantom entry here would exclude the
+	// shard from the copy set and the decode would then fail with "missing
+	// shard"; probing the target's live inventory makes the re-run re-copy it.
+	if present, probeErr := erasure_coding.CollectShardsOnServer(context.Background(), collection, uint32(vid), string(targetNodeLocation), env.GrpcDialOption); probeErr == nil {
+		confirmed := erasure_coding.NewShardsInfo()
+		for _, sid := range existingShardsInfo.Ids() {
+			if present.Has(sid) {
+				confirmed.Set(erasure_coding.NewShardInfo(sid, 0))
+			}
+		}
+		existingShardsInfo = confirmed
+	} else {
+		fmt.Printf("collectEcShards: probe %s inventory for volume %d: %v (keeping the topology's view)\n", targetNodeLocation, vid, probeErr)
+	}
+
+	fmt.Printf("collectEcShards: ec volume %d collect shards to %s from: %+v\n", vid, targetNodeLocation, nodeToShardsInfo)
+
+	copiedShardsInfo := erasure_coding.NewShardsInfo()
+	for loc, si := range nodeToShardsInfo {
+		if loc == targetNodeLocation {
+			continue
+		}
+
+		needToCopyShardsInfo := si.Minus(existingShardsInfo).MinusParityShards(dataShards)
+
+		err = operation.WithVolumeServerClient(false, targetNodeLocation, env.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+
+			// Always collect .ecj from every shard location. Each server's .ecj
+			// only contains deletions for needles whose data resides in shards
+			// held by that server. Without merging all .ecj files, deletions
+			// recorded on other servers would be lost during decode.
+			if needToCopyShardsInfo.Count() > 0 {
+				fmt.Printf("copy %d.%v %s => %s\n", vid, needToCopyShardsInfo.Ids(), loc, targetNodeLocation)
+			} else {
+				fmt.Printf("collect ecj %d %s => %s\n", vid, loc, targetNodeLocation)
+			}
+
+			_, copyErr := volumeServerClient.VolumeEcShardsCopy(context.Background(), &volume_server_pb.VolumeEcShardsCopyRequest{
+				VolumeId:       uint32(vid),
+				Collection:     collection,
+				ShardIds:       needToCopyShardsInfo.IdsUint32(),
+				CopyEcxFile:    false,
+				CopyEcjFile:    true,
+				CopyVifFile:    needToCopyShardsInfo.Count() > 0,
+				SourceDataNode: string(loc),
+			})
+			if copyErr != nil {
+				return fmt.Errorf("copy %d.%v %s => %s: %v", vid, needToCopyShardsInfo.Ids(), loc, targetNodeLocation, copyErr)
+			}
+
+			if needToCopyShardsInfo.Count() > 0 {
+				fmt.Printf("mount %d.%v on %s\n", vid, needToCopyShardsInfo.Ids(), targetNodeLocation)
+				_, mountErr := volumeServerClient.VolumeEcShardsMount(context.Background(), &volume_server_pb.VolumeEcShardsMountRequest{
+					VolumeId:   uint32(vid),
+					Collection: collection,
+					ShardIds:   needToCopyShardsInfo.IdsUint32(),
+				})
+				if mountErr != nil {
+					return fmt.Errorf("mount %d.%v on %s: %v", vid, needToCopyShardsInfo.Ids(), targetNodeLocation, mountErr)
+				}
+			}
+
+			return nil
+		})
+
+		if err != nil {
+			break
+		}
+
+		copiedShardsInfo.Add(needToCopyShardsInfo)
+	}
+
+	nodeToShardsInfo[targetNodeLocation] = existingShardsInfo.Plus(copiedShardsInfo)
+
+	return targetNodeLocation, err
+}
+func CollectEcShardIds(topoInfo *master_pb.TopologyInfo, collectionMatcher *wildcard.CollectionMatcher, diskType types.DiskType) (vids []needle.VolumeId) {
+	vidMap := make(map[uint32]bool)
+	EachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		if diskInfo, found := dn.DiskInfos[string(diskType)]; found {
+			for _, v := range diskInfo.EcShardInfos {
+				if collectionMatcher.Matches(v.Collection) {
+					vidMap[v.Id] = true
+				}
+			}
+		}
+	})
+
+	for vid := range vidMap {
+		vids = append(vids, needle.VolumeId(vid))
+	}
+
+	return
+}
+
+func collectEcNodeShardsInfo(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId) (map[pb.ServerAddress]*erasure_coding.ShardsInfo, int) {
+	res := make(map[pb.ServerAddress]*erasure_coding.ShardsInfo)
+	EachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		// Union across ALL disk-type buckets and, within a node, across its
+		// physical disks. Shards sit wherever encode generation and balance
+		// left them — a cross-tier encode leaves them in the source bucket, a
+		// partial migration straddles buckets — and a decode that only looks
+		// at one bucket reports a decodable volume as having no shards at all.
+		// (Same rationale as the encode's shard verification.)
+		for _, diskInfo := range dn.DiskInfos {
+			if diskInfo == nil {
+				continue
+			}
+			for _, v := range diskInfo.EcShardInfos {
+				if v.Id == uint32(vid) {
+					addr := pb.NewServerAddressFromDataNode(dn)
+					si := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(v)
+					if existing, ok := res[addr]; ok {
+						existing.Add(si)
+					} else {
+						res[addr] = si
+					}
+				}
+			}
+		}
+	})
+
+	// OSS is always 10+4; the per-volume ratio override lives in the enterprise build.
+	return res, erasure_coding.DataShardsCount
+}
+
+type DecodeDiskUsageState struct {
+	byNode map[pb.ServerAddress]*decodeDiskUsageCounts
+}
+
+type decodeDiskUsageCounts struct {
+	maxVolumeCount    int64
+	volumeCount       int64
+	remoteVolumeCount int64
+	ecShardCount      int64
+}
+
+func NewDecodeDiskUsageState(topoInfo *master_pb.TopologyInfo, diskType types.DiskType) *DecodeDiskUsageState {
+	state := &DecodeDiskUsageState{byNode: make(map[pb.ServerAddress]*decodeDiskUsageCounts)}
+	EachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		if diskInfo, found := dn.DiskInfos[string(diskType)]; found {
+			state.byNode[pb.NewServerAddressFromDataNode(dn)] = &decodeDiskUsageCounts{
+				maxVolumeCount:    diskInfo.MaxVolumeCount,
+				volumeCount:       diskInfo.VolumeCount,
+				remoteVolumeCount: diskInfo.RemoteVolumeCount,
+				ecShardCount:      int64(CountShards(diskInfo.EcShardInfos)),
+			}
+		}
+	})
+	return state
+}
+
+func (state *DecodeDiskUsageState) freeVolumeCount(location pb.ServerAddress) (int64, bool) {
+	if state == nil {
+		return 0, false
+	}
+	usage, found := state.byNode[location]
+	if !found {
+		return 0, false
+	}
+	free := usage.maxVolumeCount - (usage.volumeCount - usage.remoteVolumeCount)
+	free -= (usage.ecShardCount + int64(erasure_coding.DataShardsCount) - 1) / int64(erasure_coding.DataShardsCount)
+	return free, true
+}
+
+func (state *DecodeDiskUsageState) applyDecode(targetNodeLocation pb.ServerAddress, shardCounts map[pb.ServerAddress]int, createdVolume bool) {
+	if state == nil {
+		return
+	}
+	for location, shardCount := range shardCounts {
+		if usage, found := state.byNode[location]; found {
+			usage.ecShardCount -= int64(shardCount)
+		}
+	}
+	if createdVolume {
+		if usage, found := state.byNode[targetNodeLocation]; found {
+			usage.volumeCount++
+		}
+	}
+}
diff --git a/weed/ec/ec_decode_test.go b/weed/ec/ec_decode_test.go
new file mode 100644
index 0000000000..bf73126e86
--- /dev/null
+++ b/weed/ec/ec_decode_test.go
@@ -0,0 +1,91 @@
+package ec
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+)
+
+// shardsOn builds one holder's inventory.
+func shardsOn(ids ...int) *erasure_coding.ShardsInfo {
+	si := erasure_coding.NewShardsInfo()
+	for _, id := range ids {
+		si.Set(erasure_coding.NewShardInfo(erasure_coding.ShardId(id), 1024))
+	}
+	return si
+}
+
+// missingDataShard decides whether a decode may delete the shards of a volume
+// that already exists elsewhere. Only the deletion phase of a decode removes a
+// data shard, so the answer separates "an earlier decode was interrupted while
+// cleaning up" from the two states that look the same from the outside: an
+// encode interrupted before it deleted the original, and a decode killed while
+// generating. Both of those leave every shard in place, and the volume beside
+// them may be the untouched original or a half-written one -- neither is safe
+// to trade for the shards.
+func TestMissingDataShard(t *testing.T) {
+	const dataShards = 10
+
+	tests := []struct {
+		name       string
+		holders    map[pb.ServerAddress]*erasure_coding.ShardsInfo
+		wantID     erasure_coding.ShardId
+		wantMissed bool
+	}{
+		{
+			name: "complete set on one holder decodes, so nothing is finished",
+			holders: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": shardsOn(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13),
+			},
+		},
+		{
+			name: "complete set spread across holders is still complete",
+			holders: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": shardsOn(0, 1, 2, 3, 4),
+				"server2:8080": shardsOn(5, 6, 7, 8, 9),
+				"server3:8080": shardsOn(10, 11, 12, 13),
+			},
+		},
+		{
+			name: "parity gone is not the deletion phase: the volume still decodes",
+			holders: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": shardsOn(0, 1, 2, 3, 4, 5, 6, 7, 8, 9),
+			},
+		},
+		{
+			name: "a data shard gone is a decode that was interrupted mid-cleanup",
+			holders: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": shardsOn(0, 1, 2, 3, 4, 5, 7, 8, 9, 10, 11, 12, 13),
+			},
+			wantID:     6,
+			wantMissed: true,
+		},
+		{
+			name: "the first gap is reported, not the last",
+			holders: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": shardsOn(0, 3, 4, 5, 6, 7, 8, 9),
+			},
+			wantID:     1,
+			wantMissed: true,
+		},
+		{
+			name:       "no holders at all leaves every data shard missing",
+			holders:    map[pb.ServerAddress]*erasure_coding.ShardsInfo{},
+			wantID:     0,
+			wantMissed: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			id, missed := missingDataShard(tt.holders, dataShards)
+			if missed != tt.wantMissed {
+				t.Fatalf("missingDataShard = %v, want %v", missed, tt.wantMissed)
+			}
+			if missed && id != tt.wantID {
+				t.Errorf("missing shard id = %d, want %d", id, tt.wantID)
+			}
+		})
+	}
+}
diff --git a/weed/shell/command_ec_destructive_guards_test.go b/weed/ec/ec_destructive_guards_test.go
similarity index 94%
rename from weed/shell/command_ec_destructive_guards_test.go
rename to weed/ec/ec_destructive_guards_test.go
index c3a124c0d1..b084bd9551 100644
--- a/weed/shell/command_ec_destructive_guards_test.go
+++ b/weed/ec/ec_destructive_guards_test.go
@@ -1,4 +1,4 @@
-package shell
+package ec
 
 import (
 	"bytes"
@@ -52,7 +52,7 @@ func TestAssertEncodableRegularVolumes(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			err := assertEncodableRegularVolumes(topoWith(tc.regular, tc.ec), tc.vids)
+			err := AssertEncodableRegularVolumes(topoWith(tc.regular, tc.ec), tc.vids)
 			if tc.wantErrSubstr == "" {
 				if err != nil {
 					t.Fatalf("want nil error, got %v", err)
@@ -68,7 +68,7 @@ func TestAssertEncodableRegularVolumes(t *testing.T) {
 
 func newDryRunRebuilder(log *bytes.Buffer, nodes ...*EcNode) *ecRebuilder {
 	return &ecRebuilder{
-		commandEnv:   &CommandEnv{env: make(map[string]string), noLock: true},
+		env:          &Env{},
 		ecNodes:      nodes,
 		writer:       log,
 		applyChanges: false,
@@ -114,7 +114,7 @@ func TestPrepareDataToRecover_UnionsLocalShardsAcrossDisks(t *testing.T) {
 	var log bytes.Buffer
 	rebuilder := newEcNode("dc1", "rack1", "rebuilder", 100).
 		addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1}).
-		addEcVolumeShards(needle.VolumeId(1), "c1", []erasure_coding.ShardId{5}, types.SsdType)
+		AddEcVolumeShards(needle.VolumeId(1), "c1", []erasure_coding.ShardId{5}, types.SsdType)
 	remote := newEcNode("dc1", "rack1", "remote", 100)
 	erb := newDryRunRebuilder(&log, rebuilder)
 
@@ -151,7 +151,7 @@ func TestCountLocalShards_UnionsAcrossDisks(t *testing.T) {
 	var log bytes.Buffer
 	rebuilder := newEcNode("dc1", "rack1", "rebuilder", 100).
 		addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1}).
-		addEcVolumeShards(needle.VolumeId(1), "c1", []erasure_coding.ShardId{5}, types.SsdType)
+		AddEcVolumeShards(needle.VolumeId(1), "c1", []erasure_coding.ShardId{5}, types.SsdType)
 	erb := newDryRunRebuilder(&log, rebuilder)
 
 	if got := erb.countLocalShards(rebuilder, "c1", needle.VolumeId(1)); got != 3 {
@@ -201,12 +201,8 @@ func TestPrepareDataToRecover_ApplyCopyFailureDoesNotCountAsRecoverable(t *testi
 	remote := newEcNode("dc1", "rack1", "127.0.0.1:2", 100).
 		addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{9})
 	erb := &ecRebuilder{
-		commandEnv: &CommandEnv{
-			env:    make(map[string]string),
-			noLock: true,
-			option: &ShellOptions{
-				GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
-			},
+		env: &Env{
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
 		},
 		ecNodes:      []*EcNode{rebuilder, remote},
 		writer:       &log,
diff --git a/weed/ec/ec_encode.go b/weed/ec/ec_encode.go
new file mode 100644
index 0000000000..8fde7babc0
--- /dev/null
+++ b/weed/ec/ec_encode.go
@@ -0,0 +1,1141 @@
+package ec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_replica"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+)
+
+// markVolumeReplicaWritable marks one replica writable/readonly with a progress
+// line, delegating to the canonical volume_move helper.
+func markVolumeReplicaWritable(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, location wdclient.Location, writable, persist bool) error {
+	if writable {
+		fmt.Printf("markVolumeWritable %d on %s ...\n", volumeId, location.Url)
+	} else {
+		fmt.Printf("markVolumeReadonly %d on %s persist=%v ...\n", volumeId, location.Url, persist)
+	}
+	return volume_move.NewMover(grpcDialOption).MarkVolumeWritable(ctx, volumeId, location.ServerAddress(), writable, persist)
+}
+
+// deleteVolume removes the volume from sourceVolumeServer via the canonical
+// volume_move helper.
+func deleteVolume(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceVolumeServer pb.ServerAddress, onlyEmpty bool, keepRemoteData bool) (err error) {
+	return volume_move.NewMover(grpcDialOption).DeleteVolume(ctx, volumeId, sourceVolumeServer, onlyEmpty, false, keepRemoteData)
+}
+
+func ChunkVolumeIds(volumeIds []needle.VolumeId, batchSize int) [][]needle.VolumeId {
+	if batchSize <= 0 || len(volumeIds) == 0 {
+		return [][]needle.VolumeId{volumeIds}
+	}
+	var batches [][]needle.VolumeId
+	for start := 0; start < len(volumeIds); start += batchSize {
+		end := start + batchSize
+		if end > len(volumeIds) {
+			end = len(volumeIds)
+		}
+		batches = append(batches, volumeIds[start:end])
+	}
+	return batches
+}
+
+func ProcessEcEncodeBatch(env *Env, writer io.Writer, volumeIds []needle.VolumeId, rp *super_block.ReplicaPlacement, diskType types.DiskType, maxParallelization int, applyBalancing bool, collectionForMessage string) (err error) {
+	topologyInfo, _, err := env.FetchTopology(0)
+	if err != nil {
+		return err
+	}
+
+	// Refuse to encode a volume that is already EC (present only as shards):
+	// an EC volume has no .dat, so re-encoding it would tear down its only
+	// copy before failing. A regular volume (with a .dat) passes. This closes
+	// the operator-rerun / script-retry path; a worker racing the snapshot is
+	// handled by encode fencing, not here.
+	if err := AssertEncodableRegularVolumes(topologyInfo, volumeIds); err != nil {
+		return err
+	}
+
+	volumeIdToCollection := CollectVolumeIdToCollection(topologyInfo, volumeIds)
+	balanceCollections := CollectCollectionsForVolumeIds(topologyInfo, volumeIds)
+
+	fmt.Printf("Collecting volume locations for %d volumes before EC encoding...\n", len(volumeIds))
+	volumeLocationsMap, err := volumeLocations(env, volumeIds)
+	if err != nil {
+		return fmt.Errorf("failed to collect volume locations before EC encoding: %w", err)
+	}
+
+	if err := checkEcEncodeCapacity(topologyInfo, len(volumeIds), diskType, collectionForMessage); err != nil {
+		return err
+	}
+
+	// From here doEcEncode marks the volumes readonly and generates EC shards.
+	// If any step before the originals are deleted fails, roll the encode back:
+	// tear down the shards produced this run and restore the sources to writable,
+	// so a failed (and possibly abandoned) ec.encode does not strand volumes
+	// readonly or leave orphan EC shards behind. Once the shards are verified
+	// recoverable we are committed to the EC copy and must not roll back.
+	committed := false
+	defer func() {
+		if err != nil && !committed {
+			rollbackFailedEcEncode(env, writer, volumeIds, volumeIdToCollection, volumeLocationsMap, maxParallelization)
+		}
+	}()
+
+	skippedNodes, err := doEcEncode(env, writer, volumeIdToCollection, volumeIds, maxParallelization, topologyInfo)
+	if err != nil {
+		return fmt.Errorf("ec encode for volumes %v: %w", volumeIds, err)
+	}
+	// Mounting the new shards notifies the master asynchronously, and EcBalance
+	// plans from a fresh topology snapshot: one taken before the mounts land
+	// shows no shards for these volumes, so the balance plans no moves and
+	// silently leaves every shard on the generation host.
+	if err := waitForEcShardsToRegister(env, volumeIds); err != nil {
+		return fmt.Errorf("wait for ec shards to register with the master: %w", err)
+	}
+	// EcBalance works at collection scope. In batch mode this intentionally
+	// rebalances each collection after every batch so source volumes can be
+	// safely verified and deleted without waiting for all batches to finish.
+	// skippedNodes are excluded so a recovered node's stale orphan is never
+	// paired with a new-generation shard.
+	if err := EcBalance(env, balanceCollections, "", rp, diskType, maxParallelization, 0, applyBalancing, skippedNodes, nil, volumeIds); err != nil {
+		return fmt.Errorf("re-balance ec shards for collection(s) %v: %w", balanceCollections, err)
+	}
+	if err := verifyEcShardsBeforeDelete(env, volumeIds, diskType, applyBalancing, rp); err != nil {
+		return fmt.Errorf("verify EC shards before deleting originals: %w", err)
+	}
+	// Past verify the EC copy is recoverable; a delete failure below must not
+	// tear the shards down.
+	committed = true
+	fmt.Printf("Deleting original volumes after EC encoding...\n")
+	if err := doDeleteVolumesWithLocations(env, volumeIds, volumeLocationsMap, maxParallelization); err != nil {
+		return fmt.Errorf("delete original volumes after EC encoding: %w", err)
+	}
+	fmt.Printf("Successfully completed EC encoding for %d volumes\n", len(volumeIds))
+	return nil
+}
+
+// rollbackFailedEcEncode is a best-effort cleanup for an ec.encode that failed
+// after marking volumes readonly / generating shards but before the originals
+// were deleted. It tears down the EC shards this run produced (so they do not
+// survive as orphans until the next encode) and restores the source volumes to
+// writable (so a failed and possibly abandoned encode does not strand them
+// readonly). Errors are logged, not returned — we are already on the failure
+// path. Both operations are idempotent: clearPreexistingEcShards is a no-op when
+// no shards were generated, and marking an already-writable volume is a no-op,
+// so it is safe even for a failure before the volumes were marked readonly.
+func rollbackFailedEcEncode(env *Env, writer io.Writer, volumeIds []needle.VolumeId, volumeIdToCollection map[needle.VolumeId]string, volumeLocationsMap map[needle.VolumeId][]wdclient.Location, maxParallelization int) {
+	fmt.Fprintf(writer, "rolling back failed EC encode for volumes %v...\n", volumeIds)
+
+	// Tear down any EC shards this run produced. A fresh topology snapshot finds
+	// them wherever generate/balance left them; the teardown is blanket.
+	if topologyInfo, _, err := env.FetchTopology(0); err != nil {
+		fmt.Fprintf(writer, "rollback: collect topology to clear ec shards: %v\n", err)
+	} else if _, err := clearPreexistingEcShards(env, topologyInfo, volumeIds, volumeIdToCollection, maxParallelization); err != nil {
+		fmt.Fprintf(writer, "rollback: clear ec shards: %v\n", err)
+	}
+
+	// Restore the source volumes to writable. doEcEncode re-reads the locations
+	// and marks every replica of that later snapshot readonly, so re-read here
+	// too: a replica added or moved between the batch's initial snapshot
+	// (volumeLocationsMap) and doEcEncode's readonly-marking would otherwise be
+	// left readonly. Fall back to the initial snapshot if the re-read fails.
+	locations := volumeLocationsMap
+	if fresh, err := volumeLocations(env, volumeIds); err != nil {
+		fmt.Fprintf(writer, "rollback: re-read volume locations (using pre-encode snapshot): %v\n", err)
+	} else {
+		locations = fresh
+	}
+	ewg := util.NewErrorWaitGroup(maxParallelization)
+	for _, vid := range volumeIds {
+		for _, l := range locations[vid] {
+			ewg.Add(func() error {
+				if err := markVolumeReplicaWritable(context.Background(), env.GrpcDialOption, vid, l, true, false); err != nil {
+					return fmt.Errorf("restore volume %d writable on %s: %w", vid, l.Url, err)
+				}
+				return nil
+			})
+		}
+	}
+	if err := ewg.Wait(); err != nil {
+		fmt.Fprintf(writer, "rollback: %v\n", err)
+	}
+}
+
+func checkEcEncodeCapacity(topologyInfo *master_pb.TopologyInfo, volumeCount int, diskType types.DiskType, collectionForMessage string) error {
+	// Pre-flight check: verify the target disk type has capacity for EC shards.
+	// This prevents encoding shards only to fail during rebalance. Reuse the
+	// caller's topology snapshot instead of issuing another VolumeList to the
+	// master per batch.
+	_, totalFreeEcSlots := CollectEcVolumeServersByDc(topologyInfo, "", diskType)
+
+	// Each volume needs TotalShardsCount (14) shards distributed.
+	requiredSlots := volumeCount * erasure_coding.TotalShardsCount
+	if totalFreeEcSlots < 1 {
+		if diskType != types.HardDriveType {
+			tryDiskTypeMessage := "Try passing -diskType=hdd, or omit -diskType to use the default (hdd)"
+			if collectionForMessage != "" {
+				tryDiskTypeMessage = fmt.Sprintf("Try:\n  ec.encode -collection=%s -diskType=hdd\nOr omit -diskType to use the default (hdd)", collectionForMessage)
+			}
+			return fmt.Errorf("no free ec shard slots on disk type '%s'. The target disk type has no capacity.\n"+
+				"Your volumes are likely on a different disk type. %s", diskType, tryDiskTypeMessage)
+		}
+		return fmt.Errorf("no free ec shard slots. only %d left on disk type '%s'", totalFreeEcSlots, diskType)
+	}
+
+	if totalFreeEcSlots < requiredSlots {
+		fmt.Printf("Warning: limited EC shard capacity. Need %d slots for %d volumes, but only %d slots available on disk type '%s'.\n",
+			requiredSlots, volumeCount, totalFreeEcSlots, diskType)
+		fmt.Printf("Rebalancing may not achieve optimal distribution.\n")
+	}
+	return nil
+}
+
+func volumeLocations(env *Env, volumeIds []needle.VolumeId) (map[needle.VolumeId][]wdclient.Location, error) {
+	res := map[needle.VolumeId][]wdclient.Location{}
+	for _, vid := range volumeIds {
+		ls, ok := env.GetVolumeLocations(uint32(vid))
+		if !ok {
+			return nil, fmt.Errorf("volume %d not found", vid)
+		}
+		res[vid] = ls
+	}
+
+	return res, nil
+}
+
+// collectSourceFreeVolumeCounts maps "volumeId-serverAddress" to the free
+// volume slots on the disk holding that volume, for the source health check.
+// Key by dn.Address so it matches wdclient.Location.Url: in deployments where
+// dn.Id is a short name (e.g. a Kubernetes StatefulSet pod name) while
+// dn.Address is a FQDN:port, keying by dn.Id would never match the location
+// Url during the lookup.
+//
+// The topology snapshot predates clearPreexistingEcShards, so shards of the
+// very volumes being encoded (leftovers of an interrupted run the sweep just
+// removed) may still be charged against a disk's FreeVolumeCount. Refund their
+// slots, or a retried encode fails the health check on capacity the sweep
+// already freed. A node the sweep skipped as unreachable keeps its charge: its
+// leftovers are still there.
+func collectSourceFreeVolumeCounts(topologyInfo *master_pb.TopologyInfo, volumeIds []needle.VolumeId, sweepSkippedNodes map[pb.ServerAddress]struct{}) map[string]int {
+	encoding := make(map[uint32]bool, len(volumeIds))
+	for _, vid := range volumeIds {
+		encoding[uint32(vid)] = true
+	}
+	freeVolumeCountMap := make(map[string]int) // key: volumeId-serverAddress
+	EachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		addr := dn.Address
+		if addr == "" {
+			addr = dn.Id // older nodes use ip:port as id
+		}
+		_, skipped := sweepSkippedNodes[pb.NewServerAddressFromDataNode(dn)]
+		for _, diskInfo := range dn.DiskInfos {
+			free := diskInfo.FreeVolumeCount
+			if !skipped {
+				var total, cleared int64
+				for _, ecInfo := range diskInfo.EcShardInfos {
+					n := int64(erasure_coding.GetShardCount(ecInfo))
+					total += n
+					if encoding[ecInfo.Id] {
+						cleared += n
+					}
+				}
+				if cleared > 0 {
+					free += erasure_coding.VolumeSlots(total) - erasure_coding.VolumeSlots(total-cleared)
+				}
+			}
+			for _, v := range diskInfo.VolumeInfos {
+				key := fmt.Sprintf("%d-%s", v.Id, addr)
+				freeVolumeCountMap[key] = int(free)
+			}
+		}
+	})
+	return freeVolumeCountMap
+}
+
+func doEcEncode(env *Env, writer io.Writer, volumeIdToCollection map[needle.VolumeId]string, volumeIds []needle.VolumeId, maxParallelization int, topologyInfo *master_pb.TopologyInfo) (skippedNodes map[pb.ServerAddress]struct{}, err error) {
+	if !env.isLocked() {
+		return nil, fmt.Errorf("lock is lost")
+	}
+	locations, err := volumeLocations(env, volumeIds)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get volume locations for EC encoding: %w", err)
+	}
+
+	// Clear EC shards left by a previous failed/partial encode so a retry
+	// starts clean and never mixes two encode runs. A node skipped here as
+	// unreachable is excluded from the later balance: it may still hold a stale
+	// orphan that, paired with a new-generation shard from a balance copy, would
+	// mix generations on that node.
+	skippedNodes, err = clearPreexistingEcShards(env, topologyInfo, volumeIds, volumeIdToCollection, maxParallelization)
+	if err != nil {
+		return nil, fmt.Errorf("clear pre-existing ec shards before encoding: %w", err)
+	}
+
+	freeVolumeCountMap := collectSourceFreeVolumeCounts(topologyInfo, volumeIds, skippedNodes)
+
+	// Filter replicas by free capacity BEFORE marking volumes readonly so that
+	// a failed health check does not strand volumes in readonly state.
+	filteredLocations := make(map[needle.VolumeId][]wdclient.Location)
+	for _, vid := range volumeIds {
+		var filteredLocs []wdclient.Location
+		for _, l := range locations[vid] {
+			key := fmt.Sprintf("%d-%s", vid, l.Url)
+			if freeCount, found := freeVolumeCountMap[key]; found && freeCount >= 2 {
+				filteredLocs = append(filteredLocs, l)
+			}
+		}
+		if len(filteredLocs) == 0 {
+			return nil, fmt.Errorf("no healthy replicas (FreeVolumeCount >= 2) found for volume %d to use as source for EC encoding", vid)
+		}
+		filteredLocations[vid] = filteredLocs
+	}
+
+	// mark volumes as readonly
+	ewg := util.NewErrorWaitGroup(maxParallelization)
+	for _, vid := range volumeIds {
+		for _, l := range locations[vid] {
+			ewg.Add(func() error {
+				if err := markVolumeReplicaWritable(context.Background(), env.GrpcDialOption, vid, l, false, false); err != nil {
+					return fmt.Errorf("mark volume %d as readonly on %s: %v", vid, l.Url, err)
+				}
+				return nil
+			})
+		}
+	}
+	if err := ewg.Wait(); err != nil {
+		return nil, err
+	}
+
+	// Compare live .idx sets across all replicas, not only the capacity
+	// subset — a filtered-out replica with a divergent live set still gets
+	// deleted below, so it must refuse encode here. The generation host
+	// must come from filteredLocations.
+	bestReplicas := make(map[needle.VolumeId]wdclient.Location)
+	for _, vid := range volumeIds {
+		collection := volumeIdToCollection[vid]
+		prefer := filteredLocations[vid][0].Url
+		bestLoc, selectErr := volume_replica.SelectSourceIfIndexesMatch(env.GrpcDialOption, vid, collection, locations[vid], prefer, writer)
+		if selectErr != nil {
+			return nil, fmt.Errorf("failed to compare replica indexes for volume %d: %v", vid, selectErr)
+		}
+		bestLoc, capErr := volume_replica.RequireCapacitySource(vid, bestLoc, filteredLocations[vid])
+		if capErr != nil {
+			return nil, capErr
+		}
+		bestReplicas[vid] = bestLoc
+	}
+
+	// Re-attempt the orphan sweep on the nodes skipped as unreachable, now that
+	// any node that recovered during readonly-marking and replica sync answers
+	// again. A node whose teardown now succeeds is clean (and the generation host
+	// re-wipes its own disks regardless), so it leaves the skipped set and can be
+	// a balance source/target — otherwise its shards would never distribute off
+	// it. A node that is still down stays skipped and excluded, preserving the
+	// leniency for a genuinely-down node; such a node also cannot be the
+	// generation host below, since VolumeEcShardsGenerate would fail to read .dat.
+	if err := resweepSkippedNodes(env, skippedNodes, volumeIds, volumeIdToCollection, maxParallelization); err != nil {
+		return nil, err
+	}
+
+	// A selected generation host still in skippedNodes after the re-sweep was
+	// transport-down when we tried to clean it, so its stale orphans were never
+	// removed and EcBalance excludes it as both source and target. If it recovers
+	// just in time for generation, all shards land on a node we can neither clean
+	// nor balance off — a single point of failure that union-only verification
+	// still accepts, after which the originals are deleted. Abort instead.
+	for _, vid := range volumeIds {
+		genHost := bestReplicas[vid].ServerAddress()
+		if _, stillSkipped := skippedNodes[genHost]; stillSkipped {
+			return nil, fmt.Errorf("generate ec shards for volume %d aborted: selected source %s is still skipped after the orphan re-sweep", vid, genHost)
+		}
+	}
+
+	// generate ec shards using the best replica for each volume
+	ewg.Reset()
+	for _, vid := range volumeIds {
+		target := bestReplicas[vid]
+		collection := volumeIdToCollection[vid]
+		ewg.Add(func() error {
+			if err := generateEcShards(env.GrpcDialOption, vid, collection, target.ServerAddress()); err != nil {
+				return fmt.Errorf("generate ec shards for volume %d on %s: %v", vid, target.Url, err)
+			}
+			return nil
+		})
+	}
+	if err := ewg.Wait(); err != nil {
+		return nil, err
+	}
+
+	// mount all ec shards for the converted volume
+	shardIds := erasure_coding.AllShardIds()
+
+	ewg.Reset()
+	for _, vid := range volumeIds {
+		target := bestReplicas[vid]
+		collection := volumeIdToCollection[vid]
+		ewg.Add(func() error {
+			if err := MountEcShards(env.GrpcDialOption, collection, vid, target.ServerAddress(), shardIds); err != nil {
+				return fmt.Errorf("mount ec shards for volume %d on %s: %v", vid, target.Url, err)
+			}
+			return nil
+		})
+	}
+	if err := ewg.Wait(); err != nil {
+		return nil, err
+	}
+
+	return skippedNodes, nil
+}
+
+// clearPreexistingEcShards removes EC shards and index files left over from a
+// previous (failed or partial) encode of the given volume ids, on every node
+// that still reports them, so a fresh encode regenerates from a clean slate.
+// Scans all disk types. The normal .dat/.idx — the source of truth for this
+// encode — is untouched; only orphaned EC artifacts are deleted.
+//
+// Returns the set of nodes skipped as unreachable. A skipped node may still hold
+// an un-deleted orphan from a prior run; if it recovers it must be kept out of
+// this encode's shard distribution, or the balance could install the new
+// generation alongside the stale orphan and mix generations on one node.
+func clearPreexistingEcShards(env *Env, topologyInfo *master_pb.TopologyInfo, volumeIds []needle.VolumeId, volumeIdToCollection map[needle.VolumeId]string, maxParallelization int) (skipped map[pb.ServerAddress]struct{}, err error) {
+	wanted := make(map[uint32]bool, len(volumeIds))
+	for _, vid := range volumeIds {
+		wanted[uint32(vid)] = true
+	}
+
+	// Note which (node, vid) pairs the topology already reports EC shards for:
+	// those are mounted leftovers and cleaning them is required (fatal on
+	// error). Every other (node, vid) is swept best-effort to catch UNMOUNTED
+	// orphans left by a failed copy — invisible to the heartbeat, so absent
+	// here. A node that is down or holds nothing is a harmless no-op; a node
+	// unreachable now also cannot receive this encode's new generation, so a
+	// surviving orphan there keeps its old identity and the read guard rejects
+	// it. Always delete the full shard-id range so a wider custom ratio's
+	// leftovers are covered too.
+	reportedKey := func(addr pb.ServerAddress, vid uint32) string {
+		return string(addr) + "\x00" + strconv.FormatUint(uint64(vid), 10)
+	}
+	reported := make(map[string]struct{})
+	var nodes []pb.ServerAddress
+	EachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		addr := pb.NewServerAddressFromDataNode(dn)
+		nodes = append(nodes, addr)
+		for _, diskInfo := range dn.DiskInfos {
+			for _, ecInfo := range diskInfo.EcShardInfos {
+				if wanted[ecInfo.Id] {
+					reported[reportedKey(addr, ecInfo.Id)] = struct{}{}
+				}
+			}
+		}
+	})
+
+	allShardIds := make([]erasure_coding.ShardId, erasure_coding.MaxShardCount)
+	for i := range allShardIds {
+		allShardIds[i] = erasure_coding.ShardId(i)
+	}
+
+	if len(reported) > 0 {
+		fmt.Printf("clearing stale EC shards reported for %d (node,volume) pair(s) before regenerating...\n", len(reported))
+	}
+	// Nodes skipped as unreachable, accumulated across the concurrent sweep tasks.
+	skipped = make(map[pb.ServerAddress]struct{})
+	var skippedMu sync.Mutex
+	ewg := util.NewErrorWaitGroup(maxParallelization)
+	for _, addr := range nodes {
+		for _, vid := range volumeIds {
+			fatal := false
+			if _, ok := reported[reportedKey(addr, uint32(vid))]; ok {
+				fatal = true
+			}
+			collection := volumeIdToCollection[vid]
+			ewg.Add(func() error {
+				if err := UnmountAndDeleteEcShardsQuiet(env.GrpcDialOption, collection, vid, addr, allShardIds); err != nil {
+					// Surface a reachable node whose delete genuinely failed (its orphan would
+					// be re-stamped by a later copy installing the new .vif). A missing
+					// full_teardown ack from a reachable pre-upgrade node is fatal too: it may
+					// still hold an orphan a later copy would re-stamp into the new generation.
+					// Stay best-effort only for a node that is truly unreachable: codes.Unavailable
+					// alone is ambiguous — a genuinely-down node and a reachable Rust volume
+					// server in maintenance mode both return it (a Go server returns Unknown for
+					// maintenance, already fatal above). Confirm with a non-maintenance-gated Ping
+					// before skipping; skip only when the Ping itself transport-failed (NodeDown).
+					// A reachable maintenance node (nodeUp) CAN receive this generation, and an
+					// inconclusive Ping (nodeLivenessUnknown, e.g. a pre-Ping server returning
+					// Unimplemented — which means the node is up) does not prove the node is down,
+					// so both stay fatal rather than silently leaving a stale EC generation.
+					if fatal || errors.Is(err, ErrFullTeardownNotAcked) || !IsNodeUnreachable(err) ||
+						ClassifyNodeLiveness(PingVolumeServer(env.GrpcDialOption, addr)) != NodeDown {
+						return fmt.Errorf("clear stale ec shards for volume %d on %s: %w", vid, addr, err)
+					}
+					glog.V(1).Infof("orphan sweep: volume %d on %s skipped (unreachable): %v", vid, addr, err)
+					skippedMu.Lock()
+					skipped[addr] = struct{}{}
+					skippedMu.Unlock()
+				}
+				return nil
+			})
+		}
+	}
+	if err := ewg.Wait(); err != nil {
+		return nil, err
+	}
+	return skipped, nil
+}
+
+// resweepSkippedNodes re-attempts the orphan teardown on the nodes that the
+// initial sweep skipped as unreachable, just before shard generation. A node
+// that recovered in the meantime — and is therefore eligible to host this
+// encode's generation — has its teardown retried; if it now fully succeeds it is
+// removed from skipped so the rebalance can use it as a source and move its
+// shards off, instead of stranding all shards on the single generation host and
+// collapsing fault tolerance. A node still transport-down stays skipped (the
+// same leniency the initial sweep grants), and a node that came back reachable
+// but whose delete genuinely failed is fatal, exactly as in the initial sweep,
+// so a stale generation is never silently left behind. Mutates skipped in place.
+func resweepSkippedNodes(env *Env, skipped map[pb.ServerAddress]struct{}, volumeIds []needle.VolumeId, volumeIdToCollection map[needle.VolumeId]string, maxParallelization int) error {
+	if len(skipped) == 0 {
+		return nil
+	}
+
+	allShardIds := make([]erasure_coding.ShardId, erasure_coding.MaxShardCount)
+	for i := range allShardIds {
+		allShardIds[i] = erasure_coding.ShardId(i)
+	}
+
+	addrs := make([]pb.ServerAddress, 0, len(skipped))
+	for addr := range skipped {
+		addrs = append(addrs, addr)
+	}
+
+	fmt.Printf("re-checking %d node(s) skipped by the orphan sweep before generating shards...\n", len(addrs))
+
+	// A node still down on every retried vid stays skipped; one that fully
+	// succeeds is un-skipped. Track per-node whether any retry still failed
+	// (down) so a node whose state is mixed across vids never gets un-skipped.
+	stillDown := make(map[pb.ServerAddress]struct{})
+	var mu sync.Mutex
+	ewg := util.NewErrorWaitGroup(maxParallelization)
+	for _, addr := range addrs {
+		for _, vid := range volumeIds {
+			collection := volumeIdToCollection[vid]
+			ewg.Add(func() error {
+				if err := UnmountAndDeleteEcShardsQuiet(env.GrpcDialOption, collection, vid, addr, allShardIds); err != nil {
+					// Same decision as the initial sweep: a reachable node whose delete
+					// genuinely failed (or did not ack a full teardown, or whose liveness is
+					// inconclusive) is fatal, since it could hold an orphan a later copy
+					// re-stamps into this generation. Only a node still transport-down stays
+					// skipped.
+					if errors.Is(err, ErrFullTeardownNotAcked) || !IsNodeUnreachable(err) ||
+						ClassifyNodeLiveness(PingVolumeServer(env.GrpcDialOption, addr)) != NodeDown {
+						return fmt.Errorf("re-clear stale ec shards for volume %d on %s: %w", vid, addr, err)
+					}
+					glog.V(1).Infof("orphan re-sweep: volume %d on %s still skipped (unreachable): %v", vid, addr, err)
+					mu.Lock()
+					stillDown[addr] = struct{}{}
+					mu.Unlock()
+				}
+				return nil
+			})
+		}
+	}
+	if err := ewg.Wait(); err != nil {
+		return err
+	}
+
+	for _, addr := range addrs {
+		if _, down := stillDown[addr]; !down {
+			delete(skipped, addr)
+			glog.V(0).Infof("orphan re-sweep: node %s recovered and was cleaned; it will participate in the EC rebalance", addr)
+		}
+	}
+	return nil
+}
+
+// collectEcShardBitsByNode returns, for one volume, the EC shard bits each node
+// reports, unioned across all its disk types. Freshly generated shards sit on
+// the disk that held the source .dat, which may differ from the balance target
+// disk type, so visibility questions ("has the master heard about these shards
+// at all?") must not filter by disk type. Only the newest encode generation
+// (largest EncodeTsNs) counts: an orphaned older generation — a failed earlier
+// encode on a node the pre-encode sweep could not reach but the master still
+// hears from — must neither satisfy the registration wait nor pose as a second
+// holder in the clump check. Entries without a timestamp form the legacy
+// generation zero, so they only count when no stamped generation exists;
+// dropping them otherwise errs toward keeping the source volume.
+func CollectEcShardBitsByNode(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId) map[pb.ServerAddress]erasure_coding.ShardBits {
+	type shardEntry struct {
+		addr pb.ServerAddress
+		ts   int64
+		bits erasure_coding.ShardBits
+	}
+	var entries []shardEntry
+	var newestTs int64
+	EachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		for _, diskInfo := range dn.DiskInfos {
+			for _, ecInfo := range diskInfo.EcShardInfos {
+				if ecInfo.Id != uint32(vid) {
+					continue
+				}
+				entries = append(entries, shardEntry{pb.NewServerAddressFromDataNode(dn), ecInfo.EncodeTsNs, erasure_coding.ShardBits(ecInfo.EcIndexBits)})
+				if ecInfo.EncodeTsNs > newestTs {
+					newestTs = ecInfo.EncodeTsNs
+				}
+			}
+		}
+	})
+	res := make(map[pb.ServerAddress]erasure_coding.ShardBits)
+	for _, e := range entries {
+		if e.ts == newestTs {
+			res[e.addr] |= e.bits
+		}
+	}
+	return res
+}
+
+// collectNewestGenerationShardsInfo answers the same question as
+// CollectEcShardBitsByNode -- which shards belong to the newest encode
+// generation -- and keeps the sizes with them.
+//
+// The two have to agree on the generation. A re-encode can change the ratio,
+// so an orphaned older generation's shards are a different length by nature:
+// merging them into the size comparison makes a healthy current set look
+// inconsistent, and since the orphan keeps being reported, every retry fails
+// and the encode is left holding both the volume and its shards forever.
+func collectNewestGenerationShardsInfo(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId) map[pb.ServerAddress]*erasure_coding.ShardsInfo {
+	type shardEntry struct {
+		addr pb.ServerAddress
+		ts   int64
+		info *erasure_coding.ShardsInfo
+	}
+	var entries []shardEntry
+	var newestTs int64
+	EachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		for _, diskInfo := range dn.DiskInfos {
+			if diskInfo == nil {
+				continue
+			}
+			for _, ecInfo := range diskInfo.EcShardInfos {
+				if ecInfo.Id != uint32(vid) {
+					continue
+				}
+				entries = append(entries, shardEntry{
+					addr: pb.NewServerAddressFromDataNode(dn),
+					ts:   ecInfo.EncodeTsNs,
+					info: erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecInfo),
+				})
+				if ecInfo.EncodeTsNs > newestTs {
+					newestTs = ecInfo.EncodeTsNs
+				}
+			}
+		}
+	})
+
+	res := make(map[pb.ServerAddress]*erasure_coding.ShardsInfo)
+	for _, e := range entries {
+		if e.ts != newestTs {
+			continue
+		}
+		if existing, ok := res[e.addr]; ok {
+			existing.Add(e.info)
+		} else {
+			res[e.addr] = e.info
+		}
+	}
+	return res
+}
+
+// waitForEcShardsToRegister polls the master topology until every given volume
+// reports a full EC shard set. Mounting shards notifies the master
+// asynchronously (mount -> NewEcShardsChan -> delta heartbeat), so a topology
+// snapshot taken right after doEcEncode can predate the mounts. Failing after
+// the retries keeps the source volumes, and a re-run of ec.encode starts clean.
+func waitForEcShardsToRegister(env *Env, volumeIds []needle.VolumeId) error {
+	const maxAttempts = 10
+	const retryInterval = 2 * time.Second
+
+	var lastMissing []string
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		if attempt > 0 {
+			time.Sleep(retryInterval)
+		}
+		topoInfo, _, err := env.FetchTopology(0)
+		if err != nil {
+			return fmt.Errorf("fetch topology while waiting for ec shards to register: %w", err)
+		}
+		lastMissing = lastMissing[:0]
+		for _, vid := range volumeIds {
+			var union erasure_coding.ShardBits
+			for _, bits := range CollectEcShardBitsByNode(topoInfo, vid) {
+				union |= bits
+			}
+			if union.Count() < erasure_coding.TotalShardsCount {
+				lastMissing = append(lastMissing, fmt.Sprintf("volume %d: %d/%d shards", vid, union.Count(), erasure_coding.TotalShardsCount))
+			}
+		}
+		if len(lastMissing) == 0 {
+			return nil
+		}
+		glog.V(0).Infof("waiting for newly generated ec shards to register with the master (attempt %d/%d): %v",
+			attempt+1, maxAttempts, lastMissing)
+	}
+	return fmt.Errorf("newly generated ec shards did not register with the master after %d attempts: %v", maxAttempts, lastMissing)
+}
+
+// ecShardsClumpedOnOneNode reports whether every EC shard the master sees for
+// vid sits on a single node while at least one other node has free EC shard
+// slots on the target disk type — i.e. the preceding rebalance could have
+// spread the shards but did not. Zero visible shards is not a clump; the
+// recoverability check owns that case.
+func ecShardsClumpedOnOneNode(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId, diskType types.DiskType) (holder pb.ServerAddress, clumped bool) {
+	byNode := CollectEcShardBitsByNode(topoInfo, vid)
+	if len(byNode) != 1 {
+		return "", false
+	}
+	for addr := range byNode {
+		holder = addr
+	}
+	ecNodes, _ := CollectEcVolumeServersByDc(topoInfo, "", diskType)
+	for _, en := range ecNodes {
+		if pb.NewServerAddressFromDataNode(en.Info) == holder {
+			continue
+		}
+		if en.FreeEcSlot > 0 {
+			return holder, true
+		}
+	}
+	return "", false
+}
+
+// verifyEcShardAttempts and verifyEcShardRetryInterval bound how long
+// verifyEcShardsBeforeDelete waits for post-rebalance shard locations to
+// propagate through volume-server heartbeats before giving up. They are
+// package vars so tests can shrink the wait.
+var verifyEcShardAttempts = 10
+var verifyEcShardRetryInterval = 2 * time.Second
+
+// ecShardRackByNode maps every volume server's address to its "dc:rack"
+// failure-domain key, matching how the balance planner keys racks.
+func ecShardRackByNode(topoInfo *master_pb.TopologyInfo) map[pb.ServerAddress]string {
+	rackOf := make(map[pb.ServerAddress]string)
+	EachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		rackOf[pb.NewServerAddressFromDataNode(dn)] = fmt.Sprintf("%s:%s", dc, rack)
+	})
+	return rackOf
+}
+
+// ecShardPlacementViolations reports where the newest-generation placement of
+// vid breaches the caps the encode asked for: the replica placement's node
+// digit (SameRackCount) bounds the shards of the volume one node may hold and
+// its rack digit (DiffRackCount) the shards one rack may hold. A zero digit
+// leaves that level unbounded; a nil placement binds nothing. byNode counts
+// only the newest encode generation -- a stale orphan's shards do not weaken
+// the fresh set.
+func ecShardPlacementViolations(vid needle.VolumeId, byNode map[pb.ServerAddress]erasure_coding.ShardBits, rackOf map[pb.ServerAddress]string, rp *super_block.ReplicaPlacement) []string {
+	if rp == nil || (rp.SameRackCount <= 0 && rp.DiffRackCount <= 0) {
+		return nil
+	}
+	rackCount := make(map[string]int)
+	var violations []string
+	for addr, bits := range byNode {
+		count := bits.Count()
+		if rp.SameRackCount > 0 && count > rp.SameRackCount {
+			violations = append(violations, fmt.Sprintf("volume %d: %d shards on node %s, over the requested %d per node", vid, count, addr, rp.SameRackCount))
+		}
+		rackCount[rackOf[addr]] += count
+	}
+	if rp.DiffRackCount > 0 {
+		for rack, count := range rackCount {
+			if count > rp.DiffRackCount {
+				violations = append(violations, fmt.Sprintf("volume %d: %d shards on rack %s, over the requested %d per rack", vid, count, rack, rp.DiffRackCount))
+			}
+		}
+	}
+	sort.Strings(violations)
+	return violations
+}
+
+// ecShardSummaryByNode says where a volume's shards are, one entry per node,
+// sorted so the message is stable. It names the ids and not just the count: a
+// set holding shards 0-9 and one holding 4-13 are both "10 shards", and which
+// ones survived is what says whether the set is recoverable and from where.
+// requireUniformShardSizes reports shards whose size disagrees with the rest.
+// Every shard of a volume takes one piece of each block row, so they are all
+// written to the same length -- an odd one out is a shard that was truncated,
+// half copied, or written to a disk that filled up. Counting shards cannot see
+// that, and the encode is about to delete the volume they were made from.
+//
+// Sizes the cluster does not report (zero) are skipped rather than treated as
+// a disagreement: an older volume server, or one that has not yet heartbeated
+// its shard sizes, must not block an encode that is otherwise sound.
+func requireUniformShardSizes(vid needle.VolumeId, byNode map[pb.ServerAddress]*erasure_coding.ShardsInfo) error {
+	type holder struct {
+		server pb.ServerAddress
+		shard  erasure_coding.ShardId
+	}
+	sizes := make(map[int64][]holder)
+	for server, si := range byNode {
+		if si == nil {
+			continue
+		}
+		for _, id := range si.Ids() {
+			size := int64(si.Size(id))
+			if size == 0 {
+				continue
+			}
+			sizes[size] = append(sizes[size], holder{server: server, shard: id})
+		}
+	}
+	if len(sizes) <= 1 {
+		return nil
+	}
+
+	described := make([]string, 0, len(sizes))
+	for size, holders := range sizes {
+		sort.Slice(holders, func(i, j int) bool {
+			if holders[i].server == holders[j].server {
+				return holders[i].shard < holders[j].shard
+			}
+			return holders[i].server < holders[j].server
+		})
+		shards := make([]string, 0, len(holders))
+		for _, h := range holders {
+			shards = append(shards, fmt.Sprintf("%s.%d", h.server, h.shard))
+		}
+		described = append(described, fmt.Sprintf("%d bytes: %s", size, strings.Join(shards, " ")))
+	}
+	sort.Strings(described)
+	return fmt.Errorf("volume %d ec shards disagree on size, so at least one is incomplete (%s)", vid, strings.Join(described, "; "))
+}
+
+func ecShardSummaryByNode(byNode map[pb.ServerAddress]erasure_coding.ShardBits) []string {
+	summary := make([]string, 0, len(byNode))
+	for node, bits := range byNode {
+		summary = append(summary, fmt.Sprintf("%s=%d shards %v", node, bits.Count(), slices.Collect(bits.All())))
+	}
+	sort.Strings(summary)
+	return summary
+}
+
+func verifyEcShardsBeforeDelete(env *Env, volumeIds []needle.VolumeId, diskType types.DiskType, expectSpread bool, rp *super_block.ReplicaPlacement) error {
+	// Shard relocations from the preceding EC balance reach the master via
+	// volume-server heartbeats, so freshly distributed shards may not all be
+	// visible in the master topology immediately. Poll a few times before
+	// concluding the shard set is incomplete, so a heartbeat-propagation lag is
+	// not mistaken for missing data. After the retries: a volume below the
+	// recoverable threshold (dataShards) aborts the deletion; a recoverable
+	// but degraded set proceeds with a warning, since the missing shards can
+	// be rebuilt from the survivors while keeping the source next to live
+	// shards is the more dangerous mixed state. When expectSpread is set (the
+	// rebalance ran in apply mode), a volume whose shards all still sit on one
+	// node while another node has free slots also aborts the deletion: losing
+	// that node would lose the volume, so the original is the safer copy.
+	// The replica-placement caps the encode asked for are requirements, not
+	// preferences: a volume still over the node or rack limit aborts the
+	// deletion the same way.
+	maxAttempts := verifyEcShardAttempts
+	retryInterval := verifyEcShardRetryInterval
+
+	var lastErr error
+	var lastDegraded []string
+	var lastClumped []string
+	var lastPlacement []string
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		topoInfo, _, err := env.FetchTopology(0)
+		if err != nil {
+			return fmt.Errorf("fetch topology for shard verification: %w", err)
+		}
+
+		lastErr = nil
+		lastDegraded = lastDegraded[:0]
+		lastClumped = lastClumped[:0]
+		lastPlacement = lastPlacement[:0]
+		var rackOf map[pb.ServerAddress]string
+		if rp != nil && (rp.SameRackCount > 0 || rp.DiffRackCount > 0) {
+			rackOf = ecShardRackByNode(topoInfo)
+		}
+		for _, vid := range volumeIds {
+			// Count the shards wherever they landed, as waitForEcShardsToRegister
+			// above already does. generateEcShards writes them beside the source
+			// volume, so encoding a volume that lives on a non-default medium
+			// puts them on that medium while -diskType still says hdd. Counting
+			// only the -diskType bucket then reports a complete set as entirely
+			// missing and aborts an encode that in fact succeeded, leaving the
+			// volume as both a .dat and a full set of shards.
+			byNode := CollectEcShardBitsByNode(topoInfo, vid)
+
+			var union erasure_coding.ShardBits
+			for _, bits := range byNode {
+				union |= bits
+			}
+
+			totalShards := erasure_coding.TotalShardsCount
+			degraded, err := erasure_coding.RequireRecoverableShardSet(uint32(vid), union, erasure_coding.DataShardsCount, totalShards)
+			if err != nil {
+				lastErr = fmt.Errorf("volume %d: %w (observed: %v)", vid, err, ecShardSummaryByNode(byNode))
+				break
+			}
+			// Counting the shards says they exist, not that they are whole. The
+			// source volume is about to be deleted on their word, so also require
+			// the sizes to agree -- judging the same generation the count above
+			// judged, or an orphaned older encode would veto a healthy set.
+			if err := requireUniformShardSizes(vid, collectNewestGenerationShardsInfo(topoInfo, vid)); err != nil {
+				lastErr = err
+				break
+			}
+			if expectSpread {
+				if holder, clumped := ecShardsClumpedOnOneNode(topoInfo, vid, diskType); clumped {
+					lastClumped = append(lastClumped, fmt.Sprintf("volume %d: all shards on %s", vid, holder))
+					continue
+				}
+			}
+			if violations := ecShardPlacementViolations(vid, byNode, rackOf, rp); len(violations) > 0 {
+				lastPlacement = append(lastPlacement, violations...)
+				continue
+			}
+			if degraded {
+				lastDegraded = append(lastDegraded, fmt.Sprintf("volume %d: %d/%d shards", vid, union.Count(), totalShards))
+				continue
+			}
+
+			glog.V(0).Infof("EC shard verification ok for volume %d: %d/%d shards present across %d nodes",
+				vid, union.Count(), totalShards, len(byNode))
+		}
+
+		if lastErr == nil && len(lastDegraded) == 0 && len(lastClumped) == 0 && len(lastPlacement) == 0 {
+			return nil
+		}
+		if attempt < maxAttempts-1 {
+			glog.V(0).Infof("EC shard verification incomplete (attempt %d/%d), waiting for shard locations to propagate: %v %v %v %v",
+				attempt+1, maxAttempts, lastErr, lastDegraded, lastClumped, lastPlacement)
+			time.Sleep(retryInterval)
+		}
+	}
+
+	if lastErr != nil {
+		glog.Errorf("EC shard verification failed after %d attempts: %v", maxAttempts, lastErr)
+		return lastErr
+	}
+	if len(lastClumped) > 0 {
+		return fmt.Errorf("EC shards still sit on a single node after rebalance even though other nodes have free slots (%v); keeping the original volumes. Run ec.balance -apply, verify the spread, then delete the originals or re-run ec.encode", lastClumped)
+	}
+	if len(lastPlacement) > 0 {
+		return fmt.Errorf("EC shard placement does not meet the requested replica placement limits (%v); keeping the original volumes. Loosen -shardReplicaPlacement or add capacity, then re-run ec.encode", lastPlacement)
+	}
+	glog.Warningf("EC shard set incomplete but recoverable after %d attempts, proceeding with source deletion (rebuild missing shards with ec.rebuild): %v",
+		maxAttempts, lastDegraded)
+	return nil
+}
+
+// doDeleteVolumesWithLocations deletes volumes using pre-collected location information
+// This avoids race conditions where master metadata is updated after EC encoding
+func doDeleteVolumesWithLocations(env *Env, volumeIds []needle.VolumeId, volumeLocationsMap map[needle.VolumeId][]wdclient.Location, maxParallelization int) error {
+	if !env.isLocked() {
+		return fmt.Errorf("lock is lost")
+	}
+
+	ewg := util.NewErrorWaitGroup(maxParallelization)
+	for _, vid := range volumeIds {
+		locations, found := volumeLocationsMap[vid]
+		if !found {
+			fmt.Printf("warning: no locations found for volume %d, skipping deletion\n", vid)
+			continue
+		}
+
+		for _, l := range locations {
+			ewg.Add(func() error {
+				if err := deleteVolume(context.Background(), env.GrpcDialOption, vid, l.ServerAddress(), false, false); err != nil {
+					return fmt.Errorf("deleteVolume %s volume %d: %v", l.Url, vid, err)
+				}
+				fmt.Printf("deleted volume %d from %s\n", vid, l.Url)
+				return nil
+			})
+		}
+	}
+	if err := ewg.Wait(); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func generateEcShards(grpcDialOption grpc.DialOption, volumeId needle.VolumeId, collection string, sourceVolumeServer pb.ServerAddress) error {
+
+	fmt.Printf("generateEcShards %d (collection %q) on %s ...\n", volumeId, collection, sourceVolumeServer)
+
+	err := operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+		_, genErr := volumeServerClient.VolumeEcShardsGenerate(context.Background(), &volume_server_pb.VolumeEcShardsGenerateRequest{
+			VolumeId:   uint32(volumeId),
+			Collection: collection,
+		})
+		return genErr
+	})
+
+	return err
+
+}
+
+func SelectVolumeIdsFromTopology(topologyInfo *master_pb.TopologyInfo, volumeSizeLimitMb uint64, collectionMatcher *wildcard.CollectionMatcher, sourceDiskType *types.DiskType, quietSeconds int64, nowUnixSeconds int64, fullPercentage float64, verbose bool) (vids []needle.VolumeId, matchedCollections []string) {
+	// Statistics for verbose mode
+	var (
+		totalVolumes    int
+		remoteVolumes   int
+		wrongCollection int
+		wrongDiskType   int
+		tooRecent       int
+		tooSmall        int
+		noFreeDisk      int
+	)
+
+	vidMap := make(map[uint32]bool)
+	collectionSet := make(map[string]bool)
+	EachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		for _, diskInfo := range dn.DiskInfos {
+			for _, v := range diskInfo.VolumeInfos {
+				totalVolumes++
+
+				// ignore remote volumes
+				if v.RemoteStorageName != "" {
+					remoteVolumes++
+					if verbose {
+						fmt.Printf("skip volume %d on %s: remote volume (storage: %s)\n",
+							v.Id, dn.Id, v.RemoteStorageName)
+					}
+					continue
+				}
+
+				// check collection against regex pattern
+				if !collectionMatcher.Matches(v.Collection) {
+					wrongCollection++
+					if verbose {
+						fmt.Printf("skip volume %d on %s: collection doesn't match pattern (pattern: %s, actual: %s)\n",
+							v.Id, dn.Id, collectionMatcher.String(), v.Collection)
+					}
+					continue
+				}
+
+				// track matched collection
+				collectionSet[v.Collection] = true
+
+				// check disk type
+				if sourceDiskType != nil && types.ToDiskType(v.DiskType) != *sourceDiskType {
+					wrongDiskType++
+					if verbose {
+						fmt.Printf("skip volume %d on %s: wrong disk type (expected: %s, actual: %s)\n",
+							v.Id, dn.Id, sourceDiskType.ReadableString(), types.ToDiskType(v.DiskType).ReadableString())
+					}
+					continue
+				}
+
+				// check quiet period
+				if v.ModifiedAtSecond+quietSeconds >= nowUnixSeconds {
+					tooRecent++
+					if verbose {
+						fmt.Printf("skip volume %d on %s: too recently modified (last modified: %d seconds ago, required: %d seconds)\n",
+							v.Id, dn.Id, nowUnixSeconds-v.ModifiedAtSecond, quietSeconds)
+					}
+					continue
+				}
+
+				// check size
+				sizeThreshold := fullPercentage / 100 * float64(volumeSizeLimitMb) * 1024 * 1024
+				if float64(v.Size) <= sizeThreshold {
+					tooSmall++
+					if verbose {
+						fmt.Printf("skip volume %d on %s: too small (size: %.1f MB, threshold: %.1f MB, %.1f%% full)\n",
+							v.Id, dn.Id, float64(v.Size)/(1024*1024), sizeThreshold/(1024*1024),
+							float64(v.Size)*100/(float64(volumeSizeLimitMb)*1024*1024))
+					}
+					continue
+				}
+
+				// check free disk space
+				if diskInfo.FreeVolumeCount < 2 {
+					glog.V(0).Infof("replica %s %d on %s has no free disk", v.Collection, v.Id, dn.Id)
+					if verbose {
+						fmt.Printf("skip replica of volume %d on %s: insufficient free disk space (free volumes: %d, required: 2)\n",
+							v.Id, dn.Id, diskInfo.FreeVolumeCount)
+					}
+					if _, found := vidMap[v.Id]; !found {
+						vidMap[v.Id] = false
+					}
+				} else {
+					if verbose {
+						fmt.Printf("selected volume %d on %s: size %.1f MB (%.1f%% full), last modified %d seconds ago, free volumes: %d\n",
+							v.Id, dn.Id, float64(v.Size)/(1024*1024),
+							float64(v.Size)*100/(float64(volumeSizeLimitMb)*1024*1024),
+							nowUnixSeconds-v.ModifiedAtSecond, diskInfo.FreeVolumeCount)
+					}
+					vidMap[v.Id] = true
+				}
+			}
+		}
+	})
+
+	for vid, good := range vidMap {
+		if good {
+			vids = append(vids, needle.VolumeId(vid))
+		} else {
+			noFreeDisk++
+		}
+	}
+
+	// Convert collection set to slice
+	for collection := range collectionSet {
+		matchedCollections = append(matchedCollections, collection)
+	}
+	sort.Strings(matchedCollections)
+
+	// Print summary statistics in verbose mode or when no volumes selected
+	if verbose || len(vids) == 0 {
+		fmt.Printf("\nVolume selection summary:\n")
+		fmt.Printf("  Total volumes examined: %d\n", totalVolumes)
+		fmt.Printf("  Selected for encoding: %d\n", len(vids))
+		fmt.Printf("  Collections matched: %v\n", matchedCollections)
+
+		if totalVolumes > 0 {
+			fmt.Printf("\nReasons for exclusion:\n")
+			if remoteVolumes > 0 {
+				fmt.Printf("  Remote volumes: %d\n", remoteVolumes)
+			}
+			if wrongCollection > 0 {
+				fmt.Printf("  Collection doesn't match pattern: %d\n", wrongCollection)
+			}
+			if wrongDiskType > 0 {
+				fmt.Printf("  Wrong disk type: %d\n", wrongDiskType)
+			}
+			if tooRecent > 0 {
+				fmt.Printf("  Too recently modified: %d\n", tooRecent)
+			}
+			if tooSmall > 0 {
+				fmt.Printf("  Too small (< %.1f%% full): %d\n", fullPercentage, tooSmall)
+			}
+			if noFreeDisk > 0 {
+				fmt.Printf("  Insufficient free disk space: %d\n", noFreeDisk)
+			}
+		}
+		fmt.Println()
+	}
+
+	return
+}
diff --git a/weed/ec/ec_encode_shard_sizes_test.go b/weed/ec/ec_encode_shard_sizes_test.go
new file mode 100644
index 0000000000..cfe06b1298
--- /dev/null
+++ b/weed/ec/ec_encode_shard_sizes_test.go
@@ -0,0 +1,214 @@
+package ec
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// sizedShards builds one holder's inventory as {shard id: size}.
+func sizedShards(idToSize map[int]int64) *erasure_coding.ShardsInfo {
+	si := erasure_coding.NewShardsInfo()
+	for id, size := range idToSize {
+		si.Set(erasure_coding.NewShardInfo(erasure_coding.ShardId(id), erasure_coding.ShardSize(size)))
+	}
+	return si
+}
+
+// An encode deletes the volume the shards were made from, on the strength of
+// having counted them. Every shard takes one piece of each block row, so they
+// are written to the same length: one that disagrees was truncated or half
+// copied, and counting cannot see it.
+func TestRequireUniformShardSizes(t *testing.T) {
+	tests := []struct {
+		name        string
+		byNode      map[pb.ServerAddress]*erasure_coding.ShardsInfo
+		wantErr     bool
+		errContains []string
+	}{
+		{
+			name: "one holder, all shards the same length",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": sizedShards(map[int]int64{0: 1048576, 1: 1048576, 2: 1048576}),
+			},
+		},
+		{
+			name: "spread across holders, still one length",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": sizedShards(map[int]int64{0: 1048576, 1: 1048576}),
+				"server2:8080": sizedShards(map[int]int64{2: 1048576, 3: 1048576}),
+			},
+		},
+		{
+			name: "a truncated shard is named with its holder",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": sizedShards(map[int]int64{0: 1048576, 1: 1048576}),
+				"server2:8080": sizedShards(map[int]int64{2: 4096}),
+			},
+			wantErr:     true,
+			errContains: []string{"disagree on size", "server2:8080.2", "4096"},
+		},
+		{
+			name: "two copies of one shard that disagree are still a disagreement",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": sizedShards(map[int]int64{5: 1048576}),
+				"server2:8080": sizedShards(map[int]int64{5: 1048570}),
+			},
+			wantErr:     true,
+			errContains: []string{"disagree on size"},
+		},
+
+		// Sizes the cluster does not report must never block an encode: an
+		// older volume server, or one that has not heartbeated its sizes yet,
+		// reports zero, and refusing to delete on that would strand every
+		// encode against such a cluster in the hybrid state this check exists
+		// to avoid.
+		{
+			name: "unreported sizes are skipped, not read as a disagreement",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": sizedShards(map[int]int64{0: 1048576, 1: 0}),
+				"server2:8080": sizedShards(map[int]int64{2: 0}),
+			},
+		},
+		{
+			name: "nothing reported at all verifies vacuously",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": sizedShards(map[int]int64{0: 0, 1: 0}),
+			},
+		},
+		{
+			name:   "no holders is not a size problem",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{},
+		},
+		{
+			name: "a nil inventory is skipped rather than panicking",
+			byNode: map[pb.ServerAddress]*erasure_coding.ShardsInfo{
+				"server1:8080": nil,
+				"server2:8080": sizedShards(map[int]int64{0: 1048576}),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := requireUniformShardSizes(needle.VolumeId(7), tt.byNode)
+			if !tt.wantErr {
+				if err != nil {
+					t.Fatalf("want the encode to proceed, got %v", err)
+				}
+				return
+			}
+			if err == nil {
+				t.Fatal("want the deletion held back, got no error")
+			}
+			for _, want := range tt.errContains {
+				if !strings.Contains(err.Error(), want) {
+					t.Errorf("error %q does not mention %q", err, want)
+				}
+			}
+		})
+	}
+}
+
+// ecShardReport builds one heartbeat entry: a generation stamp and the shards
+// that generation put on this node, all of one size.
+func ecShardReport(vid uint32, encodeTsNs int64, size int64, ids ...int) *master_pb.VolumeEcShardInformationMessage {
+	si := erasure_coding.NewShardsInfo()
+	for _, id := range ids {
+		si.Set(erasure_coding.NewShardInfo(erasure_coding.ShardId(id), erasure_coding.ShardSize(size)))
+	}
+	return &master_pb.VolumeEcShardInformationMessage{
+		Id:          vid,
+		Collection:  "ectest",
+		EcIndexBits: si.Bitmap(),
+		ShardSizes:  si.SizesInt64(),
+		EncodeTsNs:  encodeTsNs,
+	}
+}
+
+func topologyWith(reports map[string][]*master_pb.VolumeEcShardInformationMessage) *master_pb.TopologyInfo {
+	var nodes []*master_pb.DataNodeInfo
+	for addr, shards := range reports {
+		nodes = append(nodes, &master_pb.DataNodeInfo{
+			Id: addr,
+			DiskInfos: map[string]*master_pb.DiskInfo{
+				"hdd": {EcShardInfos: shards},
+			},
+		})
+	}
+	return &master_pb.TopologyInfo{
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id:        "dc1",
+			RackInfos: []*master_pb.RackInfo{{Id: "rack1", DataNodeInfos: nodes}},
+		}},
+	}
+}
+
+// A re-encode can change the ratio, so an older generation's shards are a
+// different length by nature. Recoverability already judges only the newest
+// generation; if the size check did not, an orphaned older encode -- one the
+// pre-encode sweep could not reach, but the master still hears about -- would
+// disagree on size at every retry and strand the volume beside its shards for
+// good.
+func TestShardSizeCheckIgnoresOlderEncodeGenerations(t *testing.T) {
+	const vid = 9
+
+	topo := topologyWith(map[string][]*master_pb.VolumeEcShardInformationMessage{
+		// the current encode: one length, spread over two nodes
+		"server1:8080": {ecShardReport(vid, 2000, 1048576, 0, 1, 2)},
+		"server2:8080": {ecShardReport(vid, 2000, 1048576, 3, 4, 5)},
+		// an orphan from an earlier encode, at a different length
+		"server3:8080": {ecShardReport(vid, 1000, 524288, 0, 1)},
+	})
+
+	byNode := collectNewestGenerationShardsInfo(topo, needle.VolumeId(vid))
+	if _, stale := byNode[pb.ServerAddress("server3:8080")]; stale {
+		t.Error("the older generation's holder must not be collected")
+	}
+	if err := requireUniformShardSizes(needle.VolumeId(vid), byNode); err != nil {
+		t.Fatalf("a healthy current generation must not be vetoed by an orphan: %v", err)
+	}
+}
+
+// Fencing to the newest generation must not blind the check: a short shard
+// inside that generation is exactly what it exists to catch.
+func TestShardSizeCheckStillCatchesShortShardInNewestGeneration(t *testing.T) {
+	const vid = 9
+
+	topo := topologyWith(map[string][]*master_pb.VolumeEcShardInformationMessage{
+		"server1:8080": {ecShardReport(vid, 2000, 1048576, 0, 1)},
+		"server2:8080": {ecShardReport(vid, 2000, 4096, 2)},
+		"server3:8080": {ecShardReport(vid, 1000, 524288, 0)},
+	})
+
+	err := requireUniformShardSizes(needle.VolumeId(vid), collectNewestGenerationShardsInfo(topo, needle.VolumeId(vid)))
+	if err == nil {
+		t.Fatal("a truncated shard in the newest generation must hold the deletion back")
+	}
+	if !strings.Contains(err.Error(), "server2:8080.2") {
+		t.Errorf("error %q does not name the short shard", err)
+	}
+}
+
+// Volumes encoded before generation stamping report zero, which is a single
+// legacy generation rather than an orphan to drop.
+func TestShardSizeCheckHandlesUnstampedGenerations(t *testing.T) {
+	const vid = 9
+
+	topo := topologyWith(map[string][]*master_pb.VolumeEcShardInformationMessage{
+		"server1:8080": {ecShardReport(vid, 0, 1048576, 0, 1)},
+		"server2:8080": {ecShardReport(vid, 0, 4096, 2)},
+	})
+
+	byNode := collectNewestGenerationShardsInfo(topo, needle.VolumeId(vid))
+	if len(byNode) != 2 {
+		t.Fatalf("unstamped shards form one generation, got %d holder(s)", len(byNode))
+	}
+	if err := requireUniformShardSizes(needle.VolumeId(vid), byNode); err == nil {
+		t.Error("a truncated legacy shard must still hold the deletion back")
+	}
+}
diff --git a/weed/shell/command_ec_encode_test.go b/weed/ec/ec_encode_test.go
similarity index 72%
rename from weed/shell/command_ec_encode_test.go
rename to weed/ec/ec_encode_test.go
index ad8abe9e66..2cb0790642 100644
--- a/weed/shell/command_ec_encode_test.go
+++ b/weed/ec/ec_encode_test.go
@@ -1,7 +1,7 @@
-package shell
+package ec
 
 import (
-	"regexp"
+	"fmt"
 	"testing"
 	"time"
 
@@ -9,7 +9,9 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -126,8 +128,7 @@ func TestSelectVolumeIdsFromTopology(t *testing.T) {
 	}
 
 	volumeSizeLimitMb := uint64(1000)
-	collectionPattern := ".*"
-	collectionRegex, _ := regexp.Compile(collectionPattern)
+	collectionMatcher, _ := wildcard.CompileCollectionMatcher(".*")
 
 	// ec.encode -force
 	// force means we ignore the check for 4+ volume servers.
@@ -177,7 +178,7 @@ func TestSelectVolumeIdsFromTopology(t *testing.T) {
 	// In the provided topology, FreeVolumeCount is 1 ("free:1"), so it is < 2.
 	// So ALL volumes should be skipped due to insufficient free disk space.
 
-	vids, _ := selectVolumeIdsFromTopology(topologyInfo, volumeSizeLimitMb, collectionRegex, nil, quietSeconds, nowUnixSeconds, fullPercentage, verbose)
+	vids, _ := SelectVolumeIdsFromTopology(topologyInfo, volumeSizeLimitMb, collectionMatcher, nil, quietSeconds, nowUnixSeconds, fullPercentage, verbose)
 
 	assert.Equal(t, 0, len(vids), "Should select 0 volumes because FreeVolumeCount is 1 (less than 2)")
 
@@ -197,7 +198,7 @@ func TestSelectVolumeIdsFromTopology(t *testing.T) {
 
 	// So expected volumes: 10, 11, 12.
 
-	vids, _ = selectVolumeIdsFromTopology(topologyInfo, volumeSizeLimitMb, collectionRegex, nil, quietSeconds, nowUnixSeconds, fullPercentage, verbose)
+	vids, _ = SelectVolumeIdsFromTopology(topologyInfo, volumeSizeLimitMb, collectionMatcher, nil, quietSeconds, nowUnixSeconds, fullPercentage, verbose)
 
 	expectedVids := []needle.VolumeId{10, 11, 12}
 	assert.Equal(t, len(expectedVids), len(vids), "Should select 3 volumes")
@@ -232,7 +233,7 @@ func TestEcEncodeNodeCountCheck(t *testing.T) {
 	}
 
 	nodeCount := 0
-	eachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+	EachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
 		nodeCount++
 	})
 
@@ -250,18 +251,6 @@ func TestEcEncodeNodeCountCheck(t *testing.T) {
 	assert.True(t, willProceed, "Should proceed with -force even with %d nodes", nodeCount)
 }
 
-func TestParseEcEncodeVolumeIds(t *testing.T) {
-	vids, err := parseEcEncodeVolumeIds("101, 102,101, 103")
-	assert.NoError(t, err)
-	assert.Equal(t, []needle.VolumeId{101, 102, 103}, vids)
-
-	_, err = parseEcEncodeVolumeIds("101,abc")
-	assert.Error(t, err)
-
-	_, err = parseEcEncodeVolumeIds(" , ")
-	assert.Error(t, err)
-}
-
 func TestChunkVolumeIds(t *testing.T) {
 	vids := []needle.VolumeId{101, 102, 103, 104, 105}
 
@@ -269,9 +258,9 @@ func TestChunkVolumeIds(t *testing.T) {
 		{101, 102},
 		{103, 104},
 		{105},
-	}, chunkVolumeIds(vids, 2))
+	}, ChunkVolumeIds(vids, 2))
 
-	assert.Equal(t, [][]needle.VolumeId{vids}, chunkVolumeIds(vids, 0))
+	assert.Equal(t, [][]needle.VolumeId{vids}, ChunkVolumeIds(vids, 0))
 }
 
 func ecShardVisibilityTestTopology(nodes ...*master_pb.DataNodeInfo) *master_pb.TopologyInfo {
@@ -316,11 +305,11 @@ func TestCollectEcShardBitsByNode(t *testing.T) {
 	}
 	topo := ecShardVisibilityTestTopology(node1, node2)
 
-	byNode := collectEcShardBitsByNode(topo, needle.VolumeId(1))
+	byNode := CollectEcShardBitsByNode(topo, needle.VolumeId(1))
 	assert.Len(t, byNode, 1)
 	assert.Equal(t, erasure_coding.ShardBits(allBits), byNode[pb.NewServerAddressFromDataNode(node1)])
 
-	assert.Empty(t, collectEcShardBitsByNode(topo, needle.VolumeId(3)))
+	assert.Empty(t, CollectEcShardBitsByNode(topo, needle.VolumeId(3)))
 }
 
 func TestCollectEcShardBitsByNode_MixedGenerations(t *testing.T) {
@@ -344,18 +333,18 @@ func TestCollectEcShardBitsByNode_MixedGenerations(t *testing.T) {
 	// the registration union nor as a second holder.
 	fresh := nodeWithGeneration("node1:8080", 200)
 	orphan := nodeWithGeneration("node2:8080", 100)
-	byNode := collectEcShardBitsByNode(ecShardVisibilityTestTopology(fresh, orphan), needle.VolumeId(1))
+	byNode := CollectEcShardBitsByNode(ecShardVisibilityTestTopology(fresh, orphan), needle.VolumeId(1))
 	assert.Len(t, byNode, 1)
 	assert.Equal(t, erasure_coding.ShardBits(allBits), byNode[pb.NewServerAddressFromDataNode(fresh)])
 
 	// Un-stamped entries are the legacy generation zero: dropped when a stamped
 	// generation exists, all counted when nothing is stamped.
 	legacy := nodeWithGeneration("node2:8080", 0)
-	byNode = collectEcShardBitsByNode(ecShardVisibilityTestTopology(fresh, legacy), needle.VolumeId(1))
+	byNode = CollectEcShardBitsByNode(ecShardVisibilityTestTopology(fresh, legacy), needle.VolumeId(1))
 	assert.Len(t, byNode, 1)
 	assert.Equal(t, erasure_coding.ShardBits(allBits), byNode[pb.NewServerAddressFromDataNode(fresh)])
 
-	byNode = collectEcShardBitsByNode(
+	byNode = CollectEcShardBitsByNode(
 		ecShardVisibilityTestTopology(nodeWithGeneration("node1:8080", 0), nodeWithGeneration("node2:8080", 0)),
 		needle.VolumeId(1))
 	assert.Len(t, byNode, 2)
@@ -450,7 +439,7 @@ func TestEcShardCountIgnoresDiskTypeOfTheShards(t *testing.T) {
 	topo := ecShardVisibilityTestTopology(node)
 
 	var union erasure_coding.ShardBits
-	for _, bits := range collectEcShardBitsByNode(topo, needle.VolumeId(1)) {
+	for _, bits := range CollectEcShardBitsByNode(topo, needle.VolumeId(1)) {
 		union |= bits
 	}
 	assert.Equal(t, erasure_coding.TotalShardsCount, union.Count(),
@@ -461,10 +450,15 @@ func TestEcShardCountIgnoresDiskTypeOfTheShards(t *testing.T) {
 	assert.NoError(t, err, "a complete shard set must not read as unrecoverable")
 	assert.False(t, degraded)
 
-	// The disk-scoped view is what the check used to consult, and it is blind
-	// to this volume entirely.
-	scoped, _ := collectEcNodeShardsInfo(topo, needle.VolumeId(1), types.ToDiskType(""))
-	assert.Empty(t, scoped, "the hdd-scoped view cannot see ssd shards")
+	// The decode's node view unions across buckets for the same reason: a
+	// decode scoped to the hdd bucket would report this decodable volume as
+	// having no shards at all.
+	byNode, _ := collectEcNodeShardsInfo(topo, needle.VolumeId(1))
+	assert.Len(t, byNode, 1, "decode discovery must see shards on a non-default medium")
+	for _, si := range byNode {
+		assert.Equal(t, erasure_coding.TotalShardsCount, si.Count(),
+			"decode discovery must include every shard on the non-default medium")
+	}
 }
 
 // The message an aborted deletion leaves behind is all the operator has to go
@@ -482,3 +476,180 @@ func TestEcShardSummaryNamesTheShardIds(t *testing.T) {
 		"node2:8080=2 shards [1 2]",
 	}, ecShardSummaryByNode(byNode))
 }
+
+// A retried ec.encode clears the leftover shards of an interrupted run before
+// the source health check, but the topology snapshot predates that sweep: the
+// leftovers still depress FreeVolumeCount on the source disk. The counts must
+// refund those slots, or the retry refuses the very volume it just cleaned up
+// after. Numbers mirror the interruption-matrix failure: 8 slots, 4 volumes,
+// 8 shards of other EC volumes, plus 14 leftover shards of volume 3, so the
+// master charges ceil(22/10)=3 slots and reports free=1.
+func TestCollectSourceFreeVolumeCountsRefundsClearedShards(t *testing.T) {
+	newTopo := func() *master_pb.TopologyInfo {
+		return &master_pb.TopologyInfo{
+			DataCenterInfos: []*master_pb.DataCenterInfo{{
+				Id: "dc1",
+				RackInfos: []*master_pb.RackInfo{{
+					Id: "rack0",
+					DataNodeInfos: []*master_pb.DataNodeInfo{{
+						Id:      "127.0.0.1:8110",
+						Address: "127.0.0.1:8110",
+						DiskInfos: map[string]*master_pb.DiskInfo{
+							"hdd": {
+								Type:            "hdd",
+								MaxVolumeCount:  8,
+								VolumeCount:     4,
+								FreeVolumeCount: 1,
+								VolumeInfos: []*master_pb.VolumeInformationMessage{
+									{Id: 3}, {Id: 6},
+								},
+								EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{
+									{Id: 1, EcIndexBits: 0b00000010001, DiskId: 0}, // shards 0,4
+									{Id: 1, EcIndexBits: 0b10000000100, DiskId: 1}, // shards 2,10
+									{Id: 2, EcIndexBits: 0b00000010001, DiskId: 0},
+									{Id: 2, EcIndexBits: 0b10000000100, DiskId: 1},
+									{Id: 3, EcIndexBits: 0b11111111111111, DiskId: 0}, // interrupted run's leftovers
+								},
+							},
+						},
+					}},
+				}},
+			}},
+		}
+	}
+
+	counts := collectSourceFreeVolumeCounts(newTopo(), []needle.VolumeId{3}, nil)
+	assert.Equal(t, 3, counts["3-127.0.0.1:8110"],
+		"the cleared leftovers' ceil(22/10)-ceil(8/10)=2 slots must be refunded")
+
+	counts = collectSourceFreeVolumeCounts(newTopo(), []needle.VolumeId{6}, nil)
+	assert.Equal(t, 1, counts["6-127.0.0.1:8110"],
+		"no refund when the encoded volume has no leftover shards")
+
+	skipped := map[pb.ServerAddress]struct{}{"127.0.0.1:8110": {}}
+	counts = collectSourceFreeVolumeCounts(newTopo(), []needle.VolumeId{3}, skipped)
+	assert.Equal(t, 1, counts["3-127.0.0.1:8110"],
+		"no refund on a node the sweep skipped as unreachable")
+}
+
+func TestEcShardPlacementViolations(t *testing.T) {
+	node := func(id string, shardBits uint32) *master_pb.DataNodeInfo {
+		return &master_pb.DataNodeInfo{
+			Id: id,
+			DiskInfos: map[string]*master_pb.DiskInfo{
+				"": {
+					MaxVolumeCount: 10,
+					EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{
+						{Id: 1, EcIndexBits: shardBits, DiskId: 0},
+					},
+				},
+			},
+		}
+	}
+	topo := &master_pb.TopologyInfo{
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id: "dc1",
+			RackInfos: []*master_pb.RackInfo{
+				{Id: "rack1", DataNodeInfos: []*master_pb.DataNodeInfo{
+					node("n1:8080", 0b0011), // shards 0,1
+					node("n2:8080", 0b0100), // shard 2
+				}},
+				{Id: "rack2", DataNodeInfos: []*master_pb.DataNodeInfo{
+					node("n3:8080", 0b1000), // shard 3
+				}},
+			},
+		}},
+	}
+	vid := needle.VolumeId(1)
+	violationsOf := func(topo *master_pb.TopologyInfo, rp *super_block.ReplicaPlacement) []string {
+		return ecShardPlacementViolations(vid, CollectEcShardBitsByNode(topo, vid), ecShardRackByNode(topo), rp)
+	}
+
+	// No caps requested: nothing to violate.
+	assert.Empty(t, violationsOf(topo, nil))
+	assert.Empty(t, violationsOf(topo, &super_block.ReplicaPlacement{}))
+
+	// Node cap: n1 holds 2 shards, over the requested 1 per node.
+	violations := violationsOf(topo, &super_block.ReplicaPlacement{SameRackCount: 1})
+	assert.Len(t, violations, 1)
+	assert.Contains(t, violations[0], "per node")
+
+	// Rack cap: rack1 holds 3 shards, over the requested 2 per rack; the
+	// same-named rack in another dc is a different failure domain.
+	topo2 := &master_pb.TopologyInfo{
+		DataCenterInfos: []*master_pb.DataCenterInfo{
+			{Id: "dc1", RackInfos: []*master_pb.RackInfo{
+				{Id: "rack1", DataNodeInfos: []*master_pb.DataNodeInfo{
+					node("n1:8080", 0b0111), // shards 0,1,2
+				}},
+			}},
+			{Id: "dc2", RackInfos: []*master_pb.RackInfo{
+				{Id: "rack1", DataNodeInfos: []*master_pb.DataNodeInfo{
+					node("n9:8080", 0b1000), // shard 3
+				}},
+			}},
+		},
+	}
+	violations = violationsOf(topo2, &super_block.ReplicaPlacement{DiffRackCount: 2})
+	assert.Len(t, violations, 1)
+	assert.Contains(t, violations[0], "dc1:rack1")
+
+	// Caps that fit the layout: no violations.
+	assert.Empty(t, violationsOf(topo, &super_block.ReplicaPlacement{SameRackCount: 2, DiffRackCount: 3}))
+}
+
+func TestVerifyEcShardsBeforeDeletePlacement(t *testing.T) {
+	oldAttempts, oldInterval := verifyEcShardAttempts, verifyEcShardRetryInterval
+	verifyEcShardAttempts, verifyEcShardRetryInterval = 2, time.Millisecond
+	t.Cleanup(func() {
+		verifyEcShardAttempts, verifyEcShardRetryInterval = oldAttempts, oldInterval
+	})
+
+	vid := needle.VolumeId(1)
+	topologyWith := func(nodeShards map[string]uint32) *master_pb.TopologyInfo {
+		var nodes []*master_pb.DataNodeInfo
+		for id, bits := range nodeShards {
+			si := erasure_coding.NewShardsInfo()
+			for sid := 0; sid < erasure_coding.TotalShardsCount; sid++ {
+				if bits&(1<<sid) != 0 {
+					si.Set(erasure_coding.NewShardInfo(erasure_coding.ShardId(sid), 1))
+				}
+			}
+			nodes = append(nodes, &master_pb.DataNodeInfo{
+				Id: id,
+				DiskInfos: map[string]*master_pb.DiskInfo{"": {
+					MaxVolumeCount: 100,
+					EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{{
+						Id:          uint32(vid),
+						EcIndexBits: si.Bitmap(),
+						ShardSizes:  si.SizesInt64(),
+						EncodeTsNs:  1,
+					}},
+				}},
+			})
+		}
+		return &master_pb.TopologyInfo{DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id:        "dc1",
+			RackInfos: []*master_pb.RackInfo{{Id: "rack1", DataNodeInfos: nodes}},
+		}}}
+	}
+	envWith := func(topo *master_pb.TopologyInfo) *Env {
+		return &Env{FetchTopology: func(delay time.Duration) (*master_pb.TopologyInfo, uint64, error) {
+			return topo, 0, nil
+		}}
+	}
+	rp := &super_block.ReplicaPlacement{SameRackCount: 1}
+
+	// One shard per node: the requested cap is met, deletion is allowed.
+	onePerNode := map[string]uint32{}
+	for i := 0; i < erasure_coding.TotalShardsCount; i++ {
+		onePerNode[fmt.Sprintf("n%d:8080", i)] = 1 << i
+	}
+	assert.NoError(t, verifyEcShardsBeforeDelete(envWith(topologyWith(onePerNode)), []needle.VolumeId{vid}, types.HardDriveType, false, rp))
+
+	// All 14 shards on one node: over the cap, so the gate refuses to let the
+	// source volume be deleted.
+	err := verifyEcShardsBeforeDelete(envWith(topologyWith(map[string]uint32{"n1:8080": 0x3FFF})), []needle.VolumeId{vid}, types.HardDriveType, false, rp)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "does not meet the requested replica placement limits")
+}
diff --git a/weed/ec/ec_flags_test.go b/weed/ec/ec_flags_test.go
new file mode 100644
index 0000000000..28943ea3dc
--- /dev/null
+++ b/weed/ec/ec_flags_test.go
@@ -0,0 +1,51 @@
+package ec
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/assert"
+)
+
+// countFreeShardSlots must report zero for a physically near-full disk even
+// though its slot math (MaxVolumeCount - VolumeCount) says it has room, so EC
+// placement never piles shards onto a full disk. Mirrors the volume #10160 gate.
+func TestCountFreeShardSlotsPhysicalDiskGate(t *testing.T) {
+	const gb = uint64(1) << 30
+
+	mk := func(total, free uint64) *master_pb.DataNodeInfo {
+		return &master_pb.DataNodeInfo{
+			Id: "n1",
+			DiskInfos: map[string]*master_pb.DiskInfo{
+				"": {MaxVolumeCount: 100, VolumeCount: 0, DiskTotalBytes: total, DiskFreeBytes: free},
+			},
+		}
+	}
+
+	// Physically empty: slot math applies, positive free slots.
+	if got := CountFreeShardSlots(mk(1000*gb, 900*gb), types.HardDriveType); got <= 0 {
+		t.Errorf("physically empty disk free shard slots = %d, want > 0", got)
+	}
+	// Physically 96% full: gated to zero regardless of slot room.
+	if got := CountFreeShardSlots(mk(1000*gb, 40*gb), types.HardDriveType); got != 0 {
+		t.Errorf("physically full disk free shard slots = %d, want 0", got)
+	}
+	// No byte report (older server): fall back to slot math, positive.
+	if got := CountFreeShardSlots(mk(0, 0), types.HardDriveType); got <= 0 {
+		t.Errorf("unreported-bytes disk free shard slots = %d, want > 0 (slot fallback)", got)
+	}
+}
+
+func TestParseVolumeIdsFlag(t *testing.T) {
+	vids, err := ParseVolumeIdsFlag("101, 102,101, 103")
+	assert.NoError(t, err)
+	assert.Equal(t, []needle.VolumeId{101, 102, 103}, vids)
+
+	_, err = ParseVolumeIdsFlag("101,abc")
+	assert.Error(t, err)
+
+	_, err = ParseVolumeIdsFlag(" , ")
+	assert.Error(t, err)
+}
diff --git a/weed/ec/ec_lifecycle_model_test.go b/weed/ec/ec_lifecycle_model_test.go
new file mode 100644
index 0000000000..27d0d433a9
--- /dev/null
+++ b/weed/ec/ec_lifecycle_model_test.go
@@ -0,0 +1,520 @@
+package ec
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"testing"
+)
+
+// Bounded-exhaustive model check of the EC volume lifecycle.
+//
+// The randomized chaos harness samples the state space; this test enumerates
+// it. The lifecycle of one volume is modeled as a state machine whose
+// transitions mirror, step by step, the real pipelines in this package, and
+// the checker explores EVERY schedule within the bound: every operation, a
+// crash (kill, no cleanup) at every step boundary, an error return (which
+// runs the rollback, itself crashable at every step) at every step boundary,
+// a volume-server restart (running the startup reconciliation rules) in every
+// quiescent state, and every recovery re-run from every crashed state.
+//
+// Two safety invariants are asserted in every reachable state, including
+// mid-operation and post-crash:
+//
+//	I1 durability: the volume's data is always recoverable — the regular
+//	   replica exists, or some single generation holds at least dataShards
+//	   shard files.
+//	I2 single serving generation: at most one generation is ever mounted.
+//	I3 single generation on disk: the sweep-before-generate discipline keeps
+//	   at most one generation's files on disk through every schedule. (An
+//	   externally planted file breaks this by construction; that path is the
+//	   chaos harness's, not the orchestration's.)
+//
+// And one convergence property: from every quiescent state, the prescribed
+// recovery — re-running the interrupted operation, per the restart-not-resume
+// model — terminates in a clean state (a writable regular volume with no EC
+// leftovers, or exactly one complete mounted generation with no source
+// replica and no surplus copies).
+//
+// The model's fidelity contract: each step below names the code it stands
+// for. When the pipeline order changes, this file must change with it.
+//
+//	encode      = ProcessEcEncodeBatch/doEcEncode: markReadonly
+//	              (markVolumeReplicaWritable false) → sweep
+//	              (clearPreexistingEcShards, removes every prior generation) →
+//	              generate (VolumeEcShardsGenerate, a new generation's files) →
+//	              mount (VolumeEcShardsMount, registers it) → balance
+//	              (EcBalance; a crash mid-move leaves a surplus copy, never a
+//	              loss, because moves copy before they delete) → verify
+//	              (verifyEcShardsBeforeDelete) → deleteSource
+//	              (doDeleteVolumesWithLocations, the commit point).
+//	rollback    = rollbackFailedEcEncode, run only on an error return before
+//	              the commit: rollbackSweep (clearPreexistingEcShards again) →
+//	              restoreWritable. A kill runs nothing.
+//	decode      = DoEcDecode: collect (collectEcShards) → generateVolume
+//	              (VolumeEcShardsToVolume) → mountVolume (VolumeMount) →
+//	              verifyDecoded (verifyDecodedVolumeBeforeDelete) → three
+//	              per-location shard deletions (unmountAndDeleteEcShards).
+//	              Forward-only: no rollback.
+//	reconcile   = the volume server startup rules (weed/storage
+//	              disk_location_ec.go): with the source .dat present, a
+//	              partial generation fails validation and is deleted
+//	              (handleFoundEcxFile/validateEcVolume); surviving shard files
+//	              with their sidecars re-register (the #9212 adoption).
+//	dedup       = the balance's dedup phase removing surplus copies
+//	              (ecbalancer "dedup" moves + verifyEcShardOnKeepNode).
+//
+// Deliberately outside the model: multi-replica sources (the pipeline syncs
+// and reduces to one best replica before encoding), per-node shard placement
+// (I1/I2 do not depend on it), and externally planted files (the chaos
+// harness covers adoption of foreign shards).
+
+const (
+	modelDataShards  = 10
+	modelTotalShards = 14
+)
+
+type modelGen struct {
+	files   int  // shard files on disk, whether or not registered
+	mounted bool // registered and serving
+	surplus int  // duplicate copies left by an interrupted balance move
+}
+
+type modelState struct {
+	replica         bool
+	replicaReadonly bool
+	gens            []modelGen // oldest first; a new encode appends
+}
+
+func (s modelState) clone() modelState {
+	c := s
+	c.gens = append([]modelGen(nil), s.gens...)
+	return c
+}
+
+func (s modelState) key() string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "r%v,ro%v", s.replica, s.replicaReadonly)
+	for _, g := range s.gens {
+		fmt.Fprintf(&b, "|f%d,m%v,s%d", g.files, g.mounted, g.surplus)
+	}
+	return b.String()
+}
+
+// dropEmptyGens removes generations with no files left.
+func (s *modelState) dropEmptyGens() {
+	kept := s.gens[:0]
+	for _, g := range s.gens {
+		if g.files > 0 {
+			kept = append(kept, g)
+		}
+	}
+	s.gens = kept
+}
+
+// ── invariants ──────────────────────────────────────────────────────────────
+
+func checkInvariants(s modelState) error {
+	// I1: durability.
+	recoverable := s.replica
+	for _, g := range s.gens {
+		if g.files >= modelDataShards {
+			recoverable = true
+		}
+	}
+	if !recoverable {
+		return fmt.Errorf("I1 violated: no replica and no generation with >= %d shard files", modelDataShards)
+	}
+	// I2: at most one mounted generation.
+	mounted := 0
+	for _, g := range s.gens {
+		if g.mounted {
+			mounted++
+		}
+	}
+	if mounted > 1 {
+		return fmt.Errorf("I2 violated: %d generations mounted", mounted)
+	}
+	// I3: at most one generation's files on disk.
+	withFiles := 0
+	for _, g := range s.gens {
+		if g.files > 0 {
+			withFiles++
+		}
+	}
+	if withFiles > 1 {
+		return fmt.Errorf("I3 violated: %d generations have files on disk", withFiles)
+	}
+	return nil
+}
+
+func isCleanEc(s modelState) bool {
+	if s.replica || len(s.gens) != 1 {
+		return false
+	}
+	g := s.gens[0]
+	return g.files == modelTotalShards && g.mounted && g.surplus == 0
+}
+
+// ── operations as step lists ────────────────────────────────────────────────
+
+// A step mutates the state; ok=false means the step's precondition failed
+// (the real command would return an error at this point).
+type modelStep struct {
+	name  string
+	apply func(*modelState) (ok bool)
+}
+
+func encodeSteps() []modelStep {
+	return []modelStep{
+		{"markReadonly", func(s *modelState) bool {
+			if !s.replica {
+				return false
+			}
+			s.replicaReadonly = true
+			return true
+		}},
+		// The orphan sweep tears down per (node, volume); a crash can land
+		// between nodes, leaving a partially removed generation.
+		{"sweepLoc0", func(s *modelState) bool { sweepLocation(s, 0); return true }},
+		{"sweepLoc1", func(s *modelState) bool { sweepLocation(s, 1); return true }},
+		{"sweepLoc2", func(s *modelState) bool { sweepLocation(s, 2); return true }},
+		// Generation writes the shard files on the generation host; a crash
+		// mid-write leaves a partial, unregistered set beside the .dat, which
+		// the startup validation removes and the next sweep also covers.
+		{"generateHalf", func(s *modelState) bool {
+			if !s.replica {
+				return false
+			}
+			s.gens = append(s.gens, modelGen{files: modelTotalShards / 2})
+			return true
+		}},
+		{"generateRest", func(s *modelState) bool {
+			s.gens[len(s.gens)-1].files = modelTotalShards
+			return true
+		}},
+		{"mount", func(s *modelState) bool {
+			s.gens[len(s.gens)-1].mounted = true
+			return true
+		}},
+		// balance: a completed run changes placement only. Its crash variant
+		// is modeled by crashing between "balanceCopy" and "balanceDelete":
+		// the copy landed, the source deletion did not.
+		{"balanceCopy", func(s *modelState) bool {
+			s.gens[len(s.gens)-1].surplus++
+			return true
+		}},
+		{"balanceDelete", func(s *modelState) bool {
+			s.gens[len(s.gens)-1].surplus--
+			return true
+		}},
+		{"verify", func(s *modelState) bool {
+			return s.gens[len(s.gens)-1].files >= modelDataShards
+		}},
+		{"deleteSource", func(s *modelState) bool {
+			s.replica = false
+			s.replicaReadonly = false
+			return true
+		}},
+	}
+}
+
+// encodeCommitIndex is the index of deleteSource: an error return at or after
+// it must not roll back (the shards are the only copy once it runs).
+func encodeCommitIndex() int { return len(encodeSteps()) - 1 }
+
+// sweepLocation removes one location's share of every generation's files —
+// the per-(node, volume) teardown of clearPreexistingEcShards. The last
+// location clears the remainder, sidecars included.
+func sweepLocation(s *modelState, loc int) {
+	for gi := range s.gens {
+		g := &s.gens[gi]
+		chunk := modelTotalShards / 3
+		if loc == 2 {
+			g.files, g.mounted, g.surplus = 0, false, 0
+		} else if g.files > chunk {
+			g.files -= chunk
+		} else {
+			g.files = 0
+		}
+	}
+	s.dropEmptyGens()
+}
+
+func rollbackSteps() []modelStep {
+	return []modelStep{
+		{"rollbackSweep", func(s *modelState) bool {
+			s.gens = nil
+			return true
+		}},
+		{"restoreWritable", func(s *modelState) bool {
+			if s.replica {
+				s.replicaReadonly = false
+			}
+			return true
+		}},
+	}
+}
+
+func decodeSteps() []modelStep {
+	steps := []modelStep{
+		{"collect", func(s *modelState) bool {
+			for _, g := range s.gens {
+				if g.mounted && g.files >= modelDataShards {
+					return true
+				}
+			}
+			return false
+		}},
+		{"generateVolume", func(s *modelState) bool {
+			s.replica = true
+			return true
+		}},
+		{"mountVolume", func(s *modelState) bool { return true }},
+		{"verifyDecoded", func(s *modelState) bool { return s.replica }},
+	}
+	// Shard deletion is per holder location; three locations model a spread
+	// volume, so a crash can land between any two of them.
+	for i := 0; i < 3; i++ {
+		i := i
+		steps = append(steps, modelStep{fmt.Sprintf("deleteShardsLoc%d", i), func(s *modelState) bool {
+			for gi := range s.gens {
+				g := &s.gens[gi]
+				if !g.mounted && g.files == 0 {
+					continue
+				}
+				// Each location holds roughly a third of the shards; the last
+				// pass clears the remainder and the generation with it.
+				chunk := modelTotalShards / 3
+				if i == 2 {
+					g.files, g.surplus, g.mounted = 0, 0, false
+				} else if g.files > chunk {
+					g.files -= chunk
+				}
+			}
+			s.dropEmptyGens()
+			return true
+		}})
+	}
+	return steps
+}
+
+// reconcile applies the volume-server startup rules after a crash-restart.
+func reconcile(s *modelState) {
+	for gi := range s.gens {
+		g := &s.gens[gi]
+		if s.replica && g.files < modelTotalShards {
+			// .dat present and the local generation is partial: validation
+			// fails and the files are removed (disk_location_ec.go).
+			g.files, g.mounted, g.surplus = 0, false, 0
+			continue
+		}
+		if g.files > 0 {
+			// Surviving files re-register through their sidecars (#9212).
+			g.mounted = true
+		}
+	}
+	s.dropEmptyGens()
+}
+
+// dedupSurplus is the balance dedup phase.
+func dedupSurplus(s *modelState) {
+	for gi := range s.gens {
+		s.gens[gi].surplus = 0
+	}
+}
+
+// ── recovery convergence ────────────────────────────────────────────────────
+
+// runToCompletion applies steps without interruption; false when a
+// precondition fails (the real re-run would error out).
+func runToCompletion(s *modelState, steps []modelStep) bool {
+	for _, st := range steps {
+		if !st.apply(s) {
+			return false
+		}
+	}
+	return true
+}
+
+// recover applies the prescribed recovery for a quiescent state and reports
+// whether it converges to a clean state. Per the restart-not-resume model:
+// a surviving replica means the encode restarts from scratch; no replica
+// means the encode had committed and only surplus cleanup can remain; a
+// mounted generation beside a replica can also be decoded away.
+func recoverModel(s modelState) (modelState, error) {
+	// A crash-restart happens before any operator action; its reconciliation
+	// must itself keep the invariants.
+	reconcile(&s)
+	if err := checkInvariants(s); err != nil {
+		return s, fmt.Errorf("after reconcile: %w", err)
+	}
+
+	if !s.replica {
+		// The encode committed: shards are the volume. Dedup cleans surplus.
+		dedupSurplus(&s)
+		if !isCleanEc(s) {
+			return s, fmt.Errorf("no replica and not clean EC")
+		}
+		return s, nil
+	}
+
+	// Replica survives: re-run the encode from scratch (sweep + regenerate),
+	// then the volume is EC; this is the restart path every interrupted
+	// encode and every leftover-orphan state takes.
+	if !runToCompletion(&s, encodeSteps()) {
+		return s, fmt.Errorf("recovery encode did not complete")
+	}
+	dedupSurplus(&s)
+	if err := checkInvariants(s); err != nil {
+		return s, fmt.Errorf("after recovery encode: %w", err)
+	}
+	if !isCleanEc(s) {
+		return s, fmt.Errorf("recovery encode did not converge to clean EC")
+	}
+	// And a decode must be able to bring it back to a regular volume.
+	if !runToCompletion(&s, decodeSteps()) {
+		return s, fmt.Errorf("decode after recovery did not complete")
+	}
+	if err := checkInvariants(s); err != nil {
+		return s, fmt.Errorf("after decode: %w", err)
+	}
+	if !s.replica || len(s.gens) != 0 {
+		return s, fmt.Errorf("decode after recovery did not converge to a bare regular volume")
+	}
+	return s, nil
+}
+
+// ── exhaustive exploration ──────────────────────────────────────────────────
+
+type trace []string
+
+// explore runs every schedule of one operation from state s: after every
+// step, the schedule may continue, crash (kill: stop, nothing else runs), or
+// error out (rollback runs, itself crashable at every step). Every resulting
+// quiescent state is handed to onQuiescent together with the trace that
+// produced it.
+func exploreOp(t *testing.T, s modelState, opName string, steps []modelStep, commitIndex int, withRollback bool, tr trace, onQuiescent func(modelState, trace)) {
+	t.Helper()
+	// Crash before the first step is the same as never starting.
+	for prefix := 1; prefix <= len(steps); prefix++ {
+		run := s.clone()
+		ok := true
+		for i := 0; i < prefix; i++ {
+			if !steps[i].apply(&run) {
+				ok = false
+				break
+			}
+			if err := checkInvariants(run); err != nil {
+				t.Fatalf("%s after %s: %v\ntrace: %v", opName, steps[i].name, err, append(tr, opName+"/"+steps[i].name))
+			}
+		}
+		if !ok {
+			continue // precondition stopped the op; same as an early error
+		}
+		stepTrace := append(append(trace{}, tr...), fmt.Sprintf("%s..%s", opName, steps[prefix-1].name))
+
+		// Kill here: nothing else runs.
+		onQuiescent(run.clone(), append(append(trace{}, stepTrace...), "KILL"))
+
+		// Error return here: the rollback runs, unless the op has committed;
+		// the rollback itself can be killed at each of its step boundaries.
+		if withRollback && prefix <= commitIndex {
+			rb := rollbackSteps()
+			for rbPrefix := 0; rbPrefix <= len(rb); rbPrefix++ {
+				rbRun := run.clone()
+				for i := 0; i < rbPrefix; i++ {
+					rb[i].apply(&rbRun)
+					if err := checkInvariants(rbRun); err != nil {
+						t.Fatalf("%s rollback after %s: %v\ntrace: %v", opName, rb[i].name, err, stepTrace)
+					}
+				}
+				suffix := "FAIL+rollback-killed"
+				if rbPrefix == len(rb) {
+					suffix = "FAIL+rollback-complete"
+				}
+				onQuiescent(rbRun.clone(), append(append(trace{}, stepTrace...), fmt.Sprintf("%s@%d", suffix, rbPrefix)))
+			}
+		}
+	}
+}
+
+// TestECLifecycleModelExhaustive enumerates every crash and failure schedule
+// of encode and decode up to two chained interrupted operations, checks the
+// safety invariants in every intermediate state, and requires the prescribed
+// recovery to converge from every quiescent state.
+func TestECLifecycleModelExhaustive(t *testing.T) {
+	start := modelState{replica: true}
+
+	visited := map[string]trace{}
+	quiescent := 0
+	schedules := 0
+	var enqueue func(s modelState, depth int, tr trace)
+
+	checkRecovery := func(s modelState, tr trace) {
+		schedules++
+		if _, seen := visited["Q"+s.key()]; seen {
+			return
+		}
+		visited["Q"+s.key()] = tr
+		quiescent++
+		if _, err := recoverModel(s.clone()); err != nil {
+			t.Fatalf("recovery does not converge: %v\nstate: %s\ntrace: %v", err, s.key(), tr)
+		}
+	}
+
+	enqueue = func(s modelState, depth int, tr trace) {
+		checkRecovery(s, tr)
+		if depth == 0 {
+			return
+		}
+		// A crash-restart may happen in any quiescent state before the next
+		// operation; explore both with and without it.
+		restarted := s.clone()
+		reconcile(&restarted)
+		if err := checkInvariants(restarted); err != nil {
+			t.Fatalf("reconcile violated invariants: %v\nstate: %s\ntrace: %v", err, s.key(), tr)
+		}
+		for _, variant := range []struct {
+			st  modelState
+			tag string
+		}{{s, ""}, {restarted, "+restart"}} {
+			st, tag := variant.st, variant.tag
+			if st.replica {
+				exploreOp(t, st, "encode"+tag, encodeSteps(), encodeCommitIndex(), true, tr, func(q modelState, qtr trace) {
+					enqueue(q, depth-1, qtr)
+				})
+			}
+			canDecode := false
+			for _, g := range st.gens {
+				if g.mounted && g.files >= modelDataShards {
+					canDecode = true
+				}
+			}
+			if canDecode {
+				exploreOp(t, st, "decode"+tag, decodeSteps(), len(decodeSteps()), false, tr, func(q modelState, qtr trace) {
+					enqueue(q, depth-1, qtr)
+				})
+			}
+		}
+	}
+
+	// Depth 2: an interrupted operation followed by another interrupted
+	// operation, recovery checked at every quiescent point in between and
+	// after. Deeper chains only revisit already-explored states (the state
+	// space is finite and memoized), which the visited count makes apparent.
+	enqueue(start, 2, trace{"start"})
+
+	// Not spec constants — collapse guards: if a refactor of the model or the
+	// explorer accidentally prunes schedules, these counts crater and this
+	// catches it. Update deliberately when the model changes fidelity.
+	if quiescent < 15 || schedules < 500 {
+		t.Fatalf("suspiciously small exploration: %d distinct quiescent states from %d schedules", quiescent, schedules)
+	}
+	keys := make([]string, 0, len(visited))
+	for k := range visited {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	t.Logf("explored %d schedules reaching %d distinct quiescent states, all recoverable", schedules, quiescent)
+}
diff --git a/weed/shell/ec_rebalance_slots_test.go b/weed/ec/ec_rebalance_slots_test.go
similarity index 94%
rename from weed/shell/ec_rebalance_slots_test.go
rename to weed/ec/ec_rebalance_slots_test.go
index f47ddbb130..a6f15364f0 100644
--- a/weed/shell/ec_rebalance_slots_test.go
+++ b/weed/ec/ec_rebalance_slots_test.go
@@ -1,4 +1,4 @@
-package shell
+package ec
 
 import (
 	"testing"
@@ -33,7 +33,7 @@ func TestECRebalanceWithLimitedSlots(t *testing.T) {
 	topology := buildLimitedSlotsTopology()
 
 	// Collect EC nodes from the topology
-	ecNodes, totalFreeEcSlots := collectEcVolumeServersByDc(topology, "", types.HardDriveType)
+	ecNodes, totalFreeEcSlots := CollectEcVolumeServersByDc(topology, "", types.HardDriveType)
 
 	t.Logf("Topology summary:")
 	t.Logf("  Number of EC nodes: %d", len(ecNodes))
@@ -42,19 +42,19 @@ func TestECRebalanceWithLimitedSlots(t *testing.T) {
 	// Log per-node details
 	for _, node := range ecNodes {
 		shardCount := 0
-		for _, diskInfo := range node.info.DiskInfos {
+		for _, diskInfo := range node.Info.DiskInfos {
 			for _, ecShard := range diskInfo.EcShardInfos {
 				shardCount += erasure_coding.GetShardCount(ecShard)
 			}
 		}
 		t.Logf("  Node %s (rack %s): %d shards, %d free slots",
-			node.info.Id, node.rack, shardCount, node.freeEcSlot)
+			node.Info.Id, node.Rack, shardCount, node.FreeEcSlot)
 	}
 
 	// Calculate total EC shards
 	totalEcShards := 0
 	for _, node := range ecNodes {
-		for _, diskInfo := range node.info.DiskInfos {
+		for _, diskInfo := range node.Info.DiskInfos {
 			for _, ecShard := range diskInfo.EcShardInfos {
 				totalEcShards += erasure_coding.GetShardCount(ecShard)
 			}
@@ -115,20 +115,20 @@ func TestECRebalanceZeroFreeSlots(t *testing.T) {
 	// (VolumeCount still reflects the original volumes)
 	topology := buildZeroFreeSlotTopology()
 
-	ecNodes, totalFreeEcSlots := collectEcVolumeServersByDc(topology, "", types.HardDriveType)
+	ecNodes, totalFreeEcSlots := CollectEcVolumeServersByDc(topology, "", types.HardDriveType)
 
 	t.Logf("Zero free slots scenario:")
 	for _, node := range ecNodes {
 		shardCount := 0
-		for _, diskInfo := range node.info.DiskInfos {
+		for _, diskInfo := range node.Info.DiskInfos {
 			for _, ecShard := range diskInfo.EcShardInfos {
 				shardCount += erasure_coding.GetShardCount(ecShard)
 			}
 		}
 		t.Logf("  Node %s: %d shards, %d free slots, volumeCount=%d, max=%d",
-			node.info.Id, shardCount, node.freeEcSlot,
-			node.info.DiskInfos[string(types.HardDriveType)].VolumeCount,
-			node.info.DiskInfos[string(types.HardDriveType)].MaxVolumeCount)
+			node.Info.Id, shardCount, node.FreeEcSlot,
+			node.Info.DiskInfos[string(types.HardDriveType)].VolumeCount,
+			node.Info.DiskInfos[string(types.HardDriveType)].MaxVolumeCount)
 	}
 	t.Logf("  Total free slots: %d", totalFreeEcSlots)
 
diff --git a/weed/ec/ec_rebuild.go b/weed/ec/ec_rebuild.go
new file mode 100644
index 0000000000..4afdabace2
--- /dev/null
+++ b/weed/ec/ec_rebuild.go
@@ -0,0 +1,435 @@
+package ec
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"slices"
+	"sync"
+
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+type ecRebuilder struct {
+	env          *Env
+	ecNodes      []*EcNode
+	writer       io.Writer
+	applyChanges bool
+	collections  []string
+	volumeIds    []needle.VolumeId
+	diskType     types.DiskType
+
+	ewg       *util.ErrorWaitGroup
+	ecNodesMu sync.Mutex
+}
+
+// RebuildEcVolumes finds and rebuilds missing EC shards for the given
+// collections. Before rebuilding it asks volume servers to recover any shards
+// left unmounted by a missing .ecx index; such shards are invisible to the
+// master, so recovering them first avoids regenerating data that is actually
+// present. volumeIds, when non-empty, restricts the rebuild to those volumes.
+func RebuildEcVolumes(env *Env, ecNodes []*EcNode, writer io.Writer, collections []string, volumeIds []needle.VolumeId, diskType types.DiskType, maxParallelization int, applyChanges bool) error {
+	erb := &ecRebuilder{
+		env:          env,
+		ecNodes:      ecNodes,
+		writer:       writer,
+		applyChanges: applyChanges,
+		collections:  collections,
+		volumeIds:    volumeIds,
+		diskType:     diskType,
+
+		ewg: util.NewErrorWaitGroup(maxParallelization),
+	}
+
+	// Recover shards left unmounted by a missing .ecx index before planning: such
+	// shards never register with the master, so the rebuild below would treat the
+	// volume as short or unrepairable even though its data is intact (issue #10104).
+	erb.recoverMissingIndexes()
+
+	fmt.Printf("rebuildEcVolumes for %d collection(s)\n", len(collections))
+	for _, c := range collections {
+		erb.rebuildEcVolumes(c)
+	}
+
+	return erb.ewg.Wait()
+}
+
+func (erb *ecRebuilder) write(format string, a ...any) {
+	fmt.Fprintf(erb.writer, format, a...)
+}
+
+func (erb *ecRebuilder) isLocked() bool {
+	return erb.env.isLocked()
+}
+
+// matchesVolumeId verifies whether the rebuilder is targeted at a given volume ID.
+func (erb *ecRebuilder) matchesVolumeId(vid needle.VolumeId) bool {
+	if len(erb.volumeIds) == 0 {
+		return true
+	}
+
+	return slices.Contains(erb.volumeIds, vid)
+}
+
+// countLocalShards returns the number of shards already present locally on the node for the given volume.
+// Unions across all of the node's disks, like prepareDataToRecover, so slot
+// accounting matches what the rebuild will actually treat as local.
+func (erb *ecRebuilder) countLocalShards(node *EcNode, collection string, volumeId needle.VolumeId) int {
+	localShardsInfo := erasure_coding.NewShardsInfo()
+	for _, diskInfo := range node.Info.DiskInfos {
+		for _, ecShardInfo := range diskInfo.EcShardInfos {
+			if ecShardInfo.Collection == collection && needle.VolumeId(ecShardInfo.Id) == volumeId {
+				localShardsInfo.Add(erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecShardInfo))
+			}
+		}
+	}
+	return localShardsInfo.Count()
+}
+
+// selectAndReserveRebuilder atomically selects a rebuilder node with sufficient free slots
+// and reserves slots only for the non-local shards that need to be copied/generated.
+func (erb *ecRebuilder) selectAndReserveRebuilder(collection string, volumeId needle.VolumeId) (*EcNode, int, error) {
+	erb.ecNodesMu.Lock()
+	defer erb.ecNodesMu.Unlock()
+
+	if len(erb.ecNodes) == 0 {
+		return nil, 0, fmt.Errorf("no ec nodes available")
+	}
+
+	// Find the node with the most free slots, considering local shards
+	var bestNode *EcNode
+	var bestSlotsNeeded int
+	var maxAvailableSlots int
+	var minSlotsNeeded int = erasure_coding.TotalShardsCount // Start with maximum possible
+	for _, node := range erb.ecNodes {
+		localShards := erb.countLocalShards(node, collection, volumeId)
+		slotsNeeded := erasure_coding.TotalShardsCount - localShards
+		if slotsNeeded < 0 {
+			slotsNeeded = 0
+		}
+
+		if node.FreeEcSlot > maxAvailableSlots {
+			maxAvailableSlots = node.FreeEcSlot
+		}
+
+		if slotsNeeded < minSlotsNeeded {
+			minSlotsNeeded = slotsNeeded
+		}
+
+		if node.FreeEcSlot >= slotsNeeded {
+			if bestNode == nil || node.FreeEcSlot > bestNode.FreeEcSlot {
+				bestNode = node
+				bestSlotsNeeded = slotsNeeded
+			}
+		}
+	}
+
+	if bestNode == nil {
+		return nil, 0, fmt.Errorf("no node has sufficient free slots for volume %d (need at least %d slots, max available: %d)",
+			volumeId, minSlotsNeeded, maxAvailableSlots)
+	}
+
+	// Reserve slots only for non-local shards
+	bestNode.FreeEcSlot -= bestSlotsNeeded
+
+	return bestNode, bestSlotsNeeded, nil
+}
+
+// releaseRebuilder releases the reserved slots back to the rebuilder node.
+func (erb *ecRebuilder) releaseRebuilder(node *EcNode, slotsToRelease int) {
+	erb.ecNodesMu.Lock()
+	defer erb.ecNodesMu.Unlock()
+
+	// Release slots by incrementing the free slot count
+	node.FreeEcSlot += slotsToRelease
+}
+
+func (erb *ecRebuilder) rebuildEcVolumes(collection string) {
+	fmt.Printf("rebuildEcVolumes for %q\n", collection)
+
+	// collect vid => each shard locations, similar to ecShardMap in topology.go
+	ecShardMap := make(EcShardMap)
+	erb.ecNodesMu.Lock()
+	for _, ecNode := range erb.ecNodes {
+		ecShardMap.registerEcNode(ecNode, collection)
+	}
+	erb.ecNodesMu.Unlock()
+
+	for vid, locations := range ecShardMap {
+		if !erb.matchesVolumeId(vid) {
+			continue
+		}
+		shardCount := locations.shardCount()
+		if shardCount == erasure_coding.TotalShardsCount {
+			continue
+		}
+		if shardCount < erasure_coding.DataShardsCount {
+			erb.write("ec volume %d is unrepairable with %d shards (need %d), skipping\n", vid, shardCount, erasure_coding.DataShardsCount)
+			continue
+		}
+
+		// Capture variables for closure
+		vid := vid
+		locations := locations
+
+		erb.ewg.Add(func() error {
+			// Select rebuilder and reserve slots atomically per volume
+			rebuilder, slotsToReserve, err := erb.selectAndReserveRebuilder(collection, vid)
+			if err != nil {
+				return fmt.Errorf("failed to select rebuilder for volume %d: %v", vid, err)
+			}
+			defer erb.releaseRebuilder(rebuilder, slotsToReserve)
+
+			return erb.rebuildOneEcVolume(collection, vid, locations, rebuilder)
+		})
+	}
+}
+
+// recoverMissingIndexes asks every ec node to fetch a missing .ecx index from a
+// peer and mount the on-disk shards it could not load on its own. Shards
+// orphaned this way (index only on another server) are absent from the master
+// topology, so without this pass ec.rebuild would regenerate or give up on
+// shards whose data is actually present — and a volume whose every holder lacks
+// the index would not appear in the topology at all. Each node therefore
+// recovers all of its on-disk orphans (volume_id 0); an explicit -volumeIds
+// list narrows that to the requested volumes. On apply it refreshes the topology
+// so the rebuild planning sees the recovered shards (issue #10104).
+func (erb *ecRebuilder) recoverMissingIndexes() {
+	erb.ecNodesMu.Lock()
+	nodes := append([]*EcNode(nil), erb.ecNodes...)
+	erb.ecNodesMu.Unlock()
+	if len(nodes) == 0 {
+		return
+	}
+
+	// volume_id 0 means "recover every orphan on the node"; a -volumeIds list
+	// narrows recovery to those ids (each scanned across collections server-side).
+	vids := erb.volumeIds
+	if len(vids) == 0 {
+		vids = []needle.VolumeId{0}
+	}
+
+	if !erb.applyChanges {
+		erb.write("would ask %d ec node(s) to recover EC shards left unmounted by a missing .ecx index\n", len(nodes))
+		return
+	}
+
+	for _, node := range nodes {
+		for _, vid := range vids {
+			err := operation.WithVolumeServerClient(false, pb.NewServerAddressFromDataNode(node.Info), erb.env.GrpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+				_, mountErr := client.VolumeEcShardsMount(context.Background(), &volume_server_pb.VolumeEcShardsMountRequest{
+					VolumeId:            uint32(vid),
+					RecoverMissingIndex: true,
+				})
+				return mountErr
+			})
+			if err != nil {
+				erb.write("%s recover missing index (volume %d): %v\n", node.Info.Id, vid, err)
+			}
+		}
+	}
+
+	// Refresh topology so the rebuild planning sees shards the recovery registered.
+	refreshed, _, err := CollectEcNodes(erb.env, erb.diskType)
+	if err != nil {
+		erb.write("failed to refresh ec nodes after index recovery: %v\n", err)
+		return
+	}
+	erb.ecNodesMu.Lock()
+	erb.ecNodes = refreshed
+	erb.ecNodesMu.Unlock()
+}
+
+func (erb *ecRebuilder) rebuildOneEcVolume(collection string, volumeId needle.VolumeId, locations EcShardLocations, rebuilder *EcNode) error {
+	if !erb.isLocked() {
+		return fmt.Errorf("lock is lost")
+	}
+
+	fmt.Printf("rebuildOneEcVolume %s %d\n", collection, volumeId)
+
+	// collect shard files to rebuilder local disk
+	var generatedShardIds []erasure_coding.ShardId
+	copiedShardIds, _, err := erb.prepareDataToRecover(rebuilder, collection, volumeId, locations)
+	defer func() {
+		// Clean up the working copies this run actually made, even when the
+		// recoverability gate failed after some copies already succeeded:
+		// they are temp files on the rebuilder nothing else reclaims. Dry-run
+		// copies nothing (copiedShardIds is empty), so this issues no delete
+		// RPC. Use a local error so a cleanup failure cannot mask the return.
+		if !erb.applyChanges || len(copiedShardIds) == 0 {
+			return
+		}
+		if derr := SourceServerDeleteEcShards(erb.env.GrpcDialOption, collection, volumeId, pb.NewServerAddressFromDataNode(rebuilder.Info), copiedShardIds); derr != nil {
+			erb.write("%s delete copied ec shards %s %d.%v: %v\n", rebuilder.Info.Id, collection, volumeId, copiedShardIds, derr)
+		}
+	}()
+	if err != nil {
+		return err
+	}
+
+	if !erb.applyChanges {
+		return nil
+	}
+
+	// generate ec shards, and maybe ecx file
+	generatedShardIds, err = erb.generateMissingShards(collection, volumeId, pb.NewServerAddressFromDataNode(rebuilder.Info))
+	if err != nil {
+		return err
+	}
+
+	// mount the generated shards
+	err = MountEcShards(erb.env.GrpcDialOption, collection, volumeId, pb.NewServerAddressFromDataNode(rebuilder.Info), generatedShardIds)
+	if err != nil {
+		return err
+	}
+
+	// ensure ECNode updates are atomic
+	erb.ecNodesMu.Lock()
+	defer erb.ecNodesMu.Unlock()
+	rebuilder.AddEcVolumeShards(volumeId, collection, generatedShardIds, erb.diskType)
+
+	return nil
+}
+
+func (erb *ecRebuilder) generateMissingShards(collection string, volumeId needle.VolumeId, sourceLocation pb.ServerAddress) (rebuiltShardIds []erasure_coding.ShardId, err error) {
+
+	err = operation.WithVolumeServerClient(false, sourceLocation, erb.env.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+		resp, rebuildErr := volumeServerClient.VolumeEcShardsRebuild(context.Background(), &volume_server_pb.VolumeEcShardsRebuildRequest{
+			VolumeId:   uint32(volumeId),
+			Collection: collection,
+		})
+		if rebuildErr == nil {
+			rebuiltShardIds = erasure_coding.Uint32ToShardIds(resp.RebuiltShardIds)
+		}
+		return rebuildErr
+	})
+	return
+}
+
+func (erb *ecRebuilder) prepareDataToRecover(rebuilder *EcNode, collection string, volumeId needle.VolumeId, locations EcShardLocations) (copiedShardIds []erasure_coding.ShardId, localShardIds []erasure_coding.ShardId, err error) {
+
+	needEcxFile := true
+	localShardsInfo := erasure_coding.NewShardsInfo()
+	for _, diskInfo := range rebuilder.Info.DiskInfos {
+		for _, ecShardInfo := range diskInfo.EcShardInfos {
+			if ecShardInfo.Collection == collection && needle.VolumeId(ecShardInfo.Id) == volumeId {
+				needEcxFile = false
+				// Union across disks: the rebuilder may hold this volume's
+				// shards on more than one disk. Overwriting per-disk would
+				// make a shard on a non-last disk look remote and get copied
+				// onto itself (O_TRUNC) and then node-wide deleted.
+				localShardsInfo.Add(erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecShardInfo))
+			}
+		}
+	}
+
+	targetShardCount := erasure_coding.TotalShardsCount
+	for i := erasure_coding.TotalShardsCount; i < len(locations); i++ {
+		if len(locations[i]) > 0 {
+			targetShardCount = i + 1
+		}
+	}
+
+	// recoverableRemoteShards counts remote shards that can contribute to the
+	// rebuild. Dry-run counts the plan; apply mode counts only successful copies.
+	recoverableRemoteShards := 0
+	for i := 0; i < targetShardCount; i++ {
+		ecNodes := locations[i]
+		shardId := erasure_coding.ShardId(i)
+		if len(ecNodes) == 0 {
+			erb.write("missing shard %d.%d\n", volumeId, shardId)
+			continue
+		}
+
+		if localShardsInfo.Has(shardId) {
+			localShardIds = append(localShardIds, shardId)
+			erb.write("use existing shard %d.%d\n", volumeId, shardId)
+			continue
+		}
+
+		// The rebuilder is itself the only listed holder: never copy a shard
+		// onto itself (the in-place O_TRUNC would destroy it) nor schedule it
+		// for the post-rebuild delete. Treat it as already local.
+		if ecNodes[0].Info.Id == rebuilder.Info.Id {
+			localShardIds = append(localShardIds, shardId)
+			erb.write("use existing shard %d.%d (already on rebuilder)\n", volumeId, shardId)
+			continue
+		}
+
+		if !erb.applyChanges {
+			recoverableRemoteShards++
+			erb.write("would copy %d.%d from %s\n", volumeId, shardId, ecNodes[0].Info.Id)
+			continue
+		}
+
+		copyErr := operation.WithVolumeServerClient(false, pb.NewServerAddressFromDataNode(rebuilder.Info), erb.env.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+			_, copyErr := volumeServerClient.VolumeEcShardsCopy(context.Background(), &volume_server_pb.VolumeEcShardsCopyRequest{
+				VolumeId:       uint32(volumeId),
+				Collection:     collection,
+				ShardIds:       []uint32{uint32(shardId)},
+				CopyEcxFile:    needEcxFile,
+				CopyEcjFile:    true,
+				CopyVifFile:    needEcxFile,
+				SourceDataNode: string(pb.NewServerAddressFromDataNode(ecNodes[0].Info)),
+			})
+			return copyErr
+		})
+		if copyErr != nil {
+			erb.write("%s failed to copy %d.%d from %s: %v\n", rebuilder.Info.Id, volumeId, shardId, ecNodes[0].Info.Id, copyErr)
+			continue
+		}
+		recoverableRemoteShards++
+		if needEcxFile {
+			needEcxFile = false
+		}
+		erb.write("%s copied %d.%d from %s\n", rebuilder.Info.Id, volumeId, shardId, ecNodes[0].Info.Id)
+		// Only shards this run actually copied are temp working files to be
+		// deleted afterward; never a pre-existing local or remote shard.
+		copiedShardIds = append(copiedShardIds, shardId)
+	}
+
+	if len(localShardIds)+recoverableRemoteShards >= erasure_coding.DataShardsCount {
+		return copiedShardIds, localShardIds, nil
+	}
+
+	// Hand back what was copied so the caller deletes these orphaned working
+	// shards: recovery failed, but the temp files are already on the rebuilder.
+	return copiedShardIds, localShardIds, fmt.Errorf("%d shards are not enough to recover volume %d", len(localShardIds)+recoverableRemoteShards, volumeId)
+
+}
+
+type EcShardMap map[needle.VolumeId]EcShardLocations
+type EcShardLocations [][]*EcNode
+
+func (ecShardMap EcShardMap) registerEcNode(ecNode *EcNode, collection string) {
+	for _, diskInfo := range ecNode.Info.DiskInfos {
+		for _, shardInfo := range diskInfo.EcShardInfos {
+			if shardInfo.Collection == collection {
+				existing, found := ecShardMap[needle.VolumeId(shardInfo.Id)]
+				if !found {
+					// Use MaxShardCount (32) to support custom EC ratios
+					existing = make([][]*EcNode, erasure_coding.MaxShardCount)
+					ecShardMap[needle.VolumeId(shardInfo.Id)] = existing
+				}
+				for _, shardId := range erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(shardInfo).Ids() {
+					existing[shardId] = append(existing[shardId], ecNode)
+				}
+			}
+		}
+	}
+}
+
+func (ecShardLocations EcShardLocations) shardCount() (count int) {
+	for _, locations := range ecShardLocations {
+		if len(locations) > 0 {
+			count++
+		}
+	}
+	return
+}
diff --git a/weed/shell/command_ec_rebuild_test.go b/weed/ec/ec_rebuild_test.go
similarity index 90%
rename from weed/shell/command_ec_rebuild_test.go
rename to weed/ec/ec_rebuild_test.go
index ecc0da31f3..18db79ec19 100644
--- a/weed/shell/command_ec_rebuild_test.go
+++ b/weed/ec/ec_rebuild_test.go
@@ -1,4 +1,4 @@
-package shell
+package ec
 
 import (
 	"bytes"
@@ -8,6 +8,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 // TestEcShardMapRegister tests that EC shards are properly registered
@@ -37,12 +38,12 @@ func TestEcShardMapRegister(t *testing.T) {
 
 	// Verify shard distribution
 	for i := 0; i < 7; i++ {
-		if len(locations[i]) != 1 || locations[i][0].info.Id != "node1" {
+		if len(locations[i]) != 1 || locations[i][0].Info.Id != "node1" {
 			t.Errorf("Shard %d should be on node1", i)
 		}
 	}
 	for i := 7; i < erasure_coding.TotalShardsCount; i++ {
-		if len(locations[i]) != 1 || locations[i][0].info.Id != "node2" {
+		if len(locations[i]) != 1 || locations[i][0].Info.Id != "node2" {
 			t.Errorf("Shard %d should be on node2", i)
 		}
 	}
@@ -89,11 +90,8 @@ func TestRebuildEcVolumesInsufficientShards(t *testing.T) {
 		addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1, 2, 3, 4}) // Only 5 shards
 
 	erb := &ecRebuilder{
-		commandEnv: &CommandEnv{
-			env:    make(map[string]string),
-			noLock: true, // Bypass lock check for unit test
-		},
-		ewg:     NewErrorWaitGroup(DefaultMaxParallelization),
+		env:     &Env{},
+		ewg:     util.NewErrorWaitGroup(10),
 		ecNodes: []*EcNode{node1},
 		writer:  &logBuffer,
 	}
@@ -120,11 +118,8 @@ func TestRebuildEcVolumesCompleteVolume(t *testing.T) {
 		addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13})
 
 	erb := &ecRebuilder{
-		commandEnv: &CommandEnv{
-			env:    make(map[string]string),
-			noLock: true, // Bypass lock check for unit test
-		},
-		ewg:          NewErrorWaitGroup(DefaultMaxParallelization),
+		env:          &Env{},
+		ewg:          util.NewErrorWaitGroup(10),
 		ecNodes:      []*EcNode{node1},
 		writer:       &logBuffer,
 		applyChanges: false,
@@ -152,11 +147,8 @@ func TestRebuildEcVolumesInsufficientSpace(t *testing.T) {
 							addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1, 2, 3, 4, 5, 6, 7, 8, 9})
 
 	erb := &ecRebuilder{
-		commandEnv: &CommandEnv{
-			env:    make(map[string]string),
-			noLock: true, // Bypass lock check for unit test
-		},
-		ewg:          NewErrorWaitGroup(DefaultMaxParallelization),
+		env:          &Env{},
+		ewg:          util.NewErrorWaitGroup(10),
 		ecNodes:      []*EcNode{node1},
 		writer:       &logBuffer,
 		applyChanges: false,
@@ -203,17 +195,17 @@ func TestMultipleNodesWithShards(t *testing.T) {
 
 	// Verify each shard is on the correct node
 	for i := 0; i < 4; i++ {
-		if len(locations[i]) != 1 || locations[i][0].info.Id != "node1" {
+		if len(locations[i]) != 1 || locations[i][0].Info.Id != "node1" {
 			t.Errorf("Shard %d should be on node1", i)
 		}
 	}
 	for i := 4; i < 8; i++ {
-		if len(locations[i]) != 1 || locations[i][0].info.Id != "node2" {
+		if len(locations[i]) != 1 || locations[i][0].Info.Id != "node2" {
 			t.Errorf("Shard %d should be on node2", i)
 		}
 	}
 	for i := 8; i < 10; i++ {
-		if len(locations[i]) != 1 || locations[i][0].info.Id != "node3" {
+		if len(locations[i]) != 1 || locations[i][0].Info.Id != "node3" {
 			t.Errorf("Shard %d should be on node3", i)
 		}
 	}
@@ -243,10 +235,10 @@ func TestDuplicateShards(t *testing.T) {
 	foundNode1 := false
 	foundNode2 := false
 	for _, node := range locations[0] {
-		if node.info.Id == "node1" {
+		if node.Info.Id == "node1" {
 			foundNode1 = true
 		}
-		if node.info.Id == "node2" {
+		if node.Info.Id == "node2" {
 			foundNode2 = true
 		}
 	}
@@ -270,10 +262,7 @@ func TestPrepareDataToRecoverTargetShardCount(t *testing.T) {
 		addEcVolumeAndShardsForTest(1, "c1", []erasure_coding.ShardId{0, 1, 2, 3, 4, 5, 6, 7, 8, 9})
 
 	erb := &ecRebuilder{
-		commandEnv: &CommandEnv{
-			env:    make(map[string]string),
-			noLock: true,
-		},
+		env:     &Env{},
 		ecNodes: []*EcNode{node1},
 		writer:  &logBuffer,
 	}
diff --git a/weed/ec/ec_scrub.go b/weed/ec/ec_scrub.go
new file mode 100644
index 0000000000..e108db16b0
--- /dev/null
+++ b/weed/ec/ec_scrub.go
@@ -0,0 +1,81 @@
+package ec
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// ScrubEcVolumes asks each volume server to scrub its EC volumes (optionally
+// narrowed to volumeIds) in the given mode, aggregating and reporting results.
+func ScrubEcVolumes(env *Env, writer io.Writer, volumeServerAddrs []pb.ServerAddress, volumeIds []uint32, mode volume_server_pb.VolumeScrubMode, forceDeletedNeedlesCheck bool, maxParallelization int, showDetails bool) error {
+	var brokenVolumesStr, brokenShardsStr []string
+	var details []string
+	var totalVolumes, brokenVolumes, brokenShards, totalFiles uint64
+	var mu sync.Mutex
+
+	ewg := util.NewErrorWaitGroup(maxParallelization)
+	count := 0
+	for _, addr := range volumeServerAddrs {
+		ewg.Add(func() error {
+			mu.Lock()
+			count++
+			fmt.Fprintf(writer, "Scrubbing %s (%d/%d)...\n", addr.String(), count, len(volumeServerAddrs))
+			mu.Unlock()
+
+			err := operation.WithVolumeServerClient(false, addr, env.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+				res, err := volumeServerClient.ScrubEcVolume(context.Background(), &volume_server_pb.ScrubEcVolumeRequest{
+					Mode:                     mode,
+					VolumeIds:                volumeIds,
+					ForceDeletedNeedlesCheck: forceDeletedNeedlesCheck,
+				})
+				if err != nil {
+					return err
+				}
+
+				mu.Lock()
+				defer mu.Unlock()
+
+				totalVolumes += res.GetTotalVolumes()
+				totalFiles += res.GetTotalFiles()
+				brokenVolumes += uint64(len(res.GetBrokenVolumeIds()))
+				brokenShards += uint64(len(res.GetBrokenShardInfos()))
+				for _, d := range res.GetDetails() {
+					details = append(details, fmt.Sprintf("[%s] %s", addr, d))
+				}
+				for _, vid := range res.GetBrokenVolumeIds() {
+					brokenVolumesStr = append(brokenVolumesStr, fmt.Sprintf("%s:%v", addr, vid))
+				}
+				for _, si := range res.GetBrokenShardInfos() {
+					brokenShardsStr = append(brokenShardsStr, fmt.Sprintf("%s:%v:%v", addr, si.VolumeId, si.ShardId))
+				}
+
+				return nil
+			})
+			return err
+		})
+	}
+	if err := ewg.Wait(); err != nil {
+		return err
+	}
+
+	fmt.Fprintf(writer, "Scrubbed %d EC files and %d volumes on %d nodes\n", totalFiles, totalVolumes, len(volumeServerAddrs))
+	if brokenVolumes != 0 {
+		fmt.Fprintf(writer, "\nGot scrub failures on %d EC volumes and %d EC shards :(\n", brokenVolumes, brokenShards)
+		fmt.Fprintf(writer, "Affected volumes: %s\n", strings.Join(brokenVolumesStr, ", "))
+		if len(brokenShardsStr) != 0 {
+			fmt.Fprintf(writer, "Affected shards:  %s\n", strings.Join(brokenShardsStr, ", "))
+		}
+		if showDetails && len(details) != 0 {
+			fmt.Fprintf(writer, "Details:\n\t%s\n", strings.Join(details, "\n\t"))
+		}
+	}
+	return nil
+}
diff --git a/weed/ec/ec_shard_unmount.go b/weed/ec/ec_shard_unmount.go
new file mode 100644
index 0000000000..791762a55f
--- /dev/null
+++ b/weed/ec/ec_shard_unmount.go
@@ -0,0 +1,213 @@
+package ec
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+)
+
+const (
+	ecShardActionTimeout = 1 * time.Minute
+)
+
+// ShardRef names one EC shard copy, optionally pinned to a node address.
+type ShardRef struct {
+	ShardID     uint32
+	Collection  string
+	NodeAddress string
+}
+
+func (s *ShardRef) String() string {
+	if s.NodeAddress == "" {
+		return fmt.Sprintf("%d", s.ShardID)
+	}
+	return fmt.Sprintf("%d@%s", s.ShardID, s.NodeAddress)
+}
+
+// ShardRefsFromString parses a comma-separated list of shard IDs, each either a
+// bare numeric ID or <shard_id>@<node_address> to pick one copy.
+func ShardRefsFromString(shards string) ([]*ShardRef, error) {
+	res := []*ShardRef{}
+
+	for _, s := range strings.Split(shards, ",") {
+		s = strings.TrimSpace(s)
+		if s == "" {
+			return nil, fmt.Errorf("empty shard ID in %q", shards)
+		}
+
+		// optional <shard ID>@<node address> to pick one copy
+		idStr, addr, _ := strings.Cut(s, "@")
+
+		id, err := strconv.Atoi(idStr)
+		if err != nil || id < 0 || id >= erasure_coding.MaxShardCount {
+			return nil, fmt.Errorf("invalid shard ID %q", s)
+		}
+
+		res = append(res, &ShardRef{ShardID: uint32(id), NodeAddress: addr})
+	}
+
+	return res, nil
+}
+
+// ShardUnmountRequest describes one ec.shard.unmount run.
+type ShardUnmountRequest struct {
+	Topology      *master_pb.TopologyInfo
+	VolumeID      uint32
+	Shards        []*ShardRef
+	Delete        bool
+	IgnoreInvalid bool
+	Apply         bool
+}
+
+type ecShardUnmounter struct {
+	env    *Env
+	writer io.Writer
+	req    ShardUnmountRequest
+}
+
+// UnmountShards unmounts, and optionally deletes, the requested EC shard
+// copies, resolving them against the live topology first. Dry-run unless
+// req.Apply is set.
+func UnmountShards(env *Env, writer io.Writer, req ShardUnmountRequest) error {
+	c := &ecShardUnmounter{env: env, writer: writer, req: req}
+	return c.doShardsUnmount()
+}
+
+func (c *ecShardUnmounter) write(format string, a ...any) {
+	fmt.Fprintf(c.writer, format, a...)
+}
+
+func (c *ecShardUnmounter) liveShardsForVolume() []*ShardRef {
+	shards := []*ShardRef{}
+
+	for _, dci := range c.req.Topology.GetDataCenterInfos() {
+		for _, ri := range dci.GetRackInfos() {
+			for _, dni := range ri.GetDataNodeInfos() {
+				nodeAddress := dni.GetAddress()
+				for _, di := range dni.GetDiskInfos() {
+					for _, eci := range di.GetEcShardInfos() {
+						if eci.GetId() == c.req.VolumeID {
+							sinfo := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
+							for _, sid := range sinfo.Ids() {
+								shards = append(shards, &ShardRef{
+									ShardID:     uint32(sid),
+									Collection:  eci.GetCollection(),
+									NodeAddress: nodeAddress,
+								})
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+
+	sort.SliceStable(shards, func(i, j int) bool { return shards[i].ShardID < shards[j].ShardID })
+	return shards
+}
+
+func (c *ecShardUnmounter) printShards(ss []*ShardRef) {
+	for _, s := range ss {
+		c.write("\t%v\n", s)
+	}
+	c.write("\n")
+}
+
+func (c *ecShardUnmounter) doShardsUnmount() error {
+	liveShards := c.liveShardsForVolume()
+	c.write("Live shard topology for volume ID %d (%d shards):\n", c.req.VolumeID, len(liveShards))
+	c.printShards(liveShards)
+
+	// resolve target shards against the live topology
+	targetShards := []*ShardRef{}
+	for _, ps := range c.req.Shards {
+		var result *ShardRef
+		for _, ts := range liveShards {
+			if ts.ShardID == ps.ShardID {
+				if ps.NodeAddress == "" || ps.NodeAddress == ts.NodeAddress {
+					// One node is one unmount target no matter how many of
+					// its disks hold the shard; ambiguity means the shard
+					// lives on more than one node.
+					if result != nil && result.NodeAddress != ts.NodeAddress {
+						return fmt.Errorf("shard %v is ambiguous", ps)
+					}
+					result = ts
+				}
+			}
+		}
+		if result == nil {
+			if !c.req.IgnoreInvalid {
+				return fmt.Errorf("shard %v is invalid", ps)
+			}
+			c.write("!!! ignoring invalid shard %v\n", ps)
+		} else {
+			targetShards = append(targetShards, result)
+		}
+	}
+	if len(targetShards) == 0 {
+		return fmt.Errorf("got no shards to process")
+	}
+
+	mode := "unmount"
+	if c.req.Delete {
+		mode = "unmount + delete"
+	}
+	c.write("Will %s %d shard(s):\n", mode, len(targetShards))
+	c.printShards(targetShards)
+
+	if !c.req.Apply {
+		c.write("Not proceeding in dry-run mode\n")
+		return nil
+	}
+
+	if !c.env.isLocked() {
+		return fmt.Errorf("lock is lost")
+	}
+
+	for _, s := range targetShards {
+		if err := c.unmountShard(s); err != nil {
+			return err
+		}
+	}
+
+	c.write("\nAll done!\n")
+	return nil
+}
+
+func (c *ecShardUnmounter) unmountShard(s *ShardRef) error {
+	ctx, cancel := context.WithTimeout(context.Background(), ecShardActionTimeout)
+	defer cancel()
+
+	return operation.WithVolumeServerClient(false, pb.ServerAddress(s.NodeAddress), c.env.GrpcDialOption, func(vsc volume_server_pb.VolumeServerClient) error {
+		c.write("Unmounting shard %v for volume ID %d...\n", s, c.req.VolumeID)
+		if _, err := vsc.VolumeEcShardsUnmount(ctx, &volume_server_pb.VolumeEcShardsUnmountRequest{
+			VolumeId: c.req.VolumeID,
+			ShardIds: []uint32{s.ShardID},
+		}); err != nil {
+			return err
+		}
+
+		if c.req.Delete {
+			c.write("Deleting shard %v for volume ID %d...\n", s, c.req.VolumeID)
+			if _, err := vsc.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
+				VolumeId:   c.req.VolumeID,
+				Collection: s.Collection,
+				ShardIds:   []uint32{s.ShardID},
+			}); err != nil {
+				return err
+			}
+		}
+
+		return nil
+	})
+}
diff --git a/weed/ec/ec_shard_unmount_test.go b/weed/ec/ec_shard_unmount_test.go
new file mode 100644
index 0000000000..a35e5cb1c2
--- /dev/null
+++ b/weed/ec/ec_shard_unmount_test.go
@@ -0,0 +1,183 @@
+package ec
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEcShardsFromString(t *testing.T) {
+	tests := []struct {
+		name    string
+		in      string
+		want    []*ShardRef
+		wantErr bool
+	}{
+		{
+			name: "single id",
+			in:   "2",
+			want: []*ShardRef{{ShardID: 2}},
+		},
+		{
+			name: "list of ids",
+			in:   "0, 3 ,5",
+			want: []*ShardRef{{ShardID: 0}, {ShardID: 3}, {ShardID: 5}},
+		},
+		{
+			name: "qualified keeps host:port",
+			in:   "3@10.200.18.88:9007",
+			want: []*ShardRef{{ShardID: 3, NodeAddress: "10.200.18.88:9007"}},
+		},
+		{
+			name: "mixed bare and qualified",
+			in:   "2,3@10.200.18.88:9007",
+			want: []*ShardRef{{ShardID: 2}, {ShardID: 3, NodeAddress: "10.200.18.88:9007"}},
+		},
+		{
+			name:    "colon without node marker is not a shard ID",
+			in:      "3:10.200.18.88:9007",
+			wantErr: true,
+		},
+		{
+			// shard IDs beyond the default 10+4 total are valid on custom-ratio volumes.
+			name: "shard id within MaxShardCount",
+			in:   "20",
+			want: []*ShardRef{{ShardID: 20}},
+		},
+		{
+			name:    "shard id at MaxShardCount is rejected",
+			in:      "32",
+			wantErr: true,
+		},
+		{
+			name:    "negative shard id",
+			in:      "-1",
+			wantErr: true,
+		},
+		{
+			// must not wrap through uint32 into a valid-looking shard ID (4294967301 -> 5)
+			name:    "out-of-range shard id does not wrap",
+			in:      "4294967301",
+			wantErr: true,
+		},
+		{
+			name:    "non-numeric shard id",
+			in:      "abc",
+			wantErr: true,
+		},
+		{
+			name:    "empty element",
+			in:      "1,,2",
+			wantErr: true,
+		},
+	}
+
+	// guard the assumption the bound test relies on
+	assert.Equal(t, uint32(32), uint32(erasure_coding.MaxShardCount))
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := ShardRefsFromString(tt.in)
+			if tt.wantErr {
+				assert.Error(t, err)
+				return
+			}
+			assert.NoError(t, err)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+// the printed topology form must parse back, so entries can be copied verbatim.
+func TestEcShardStringRoundTrips(t *testing.T) {
+	for _, s := range []*ShardRef{
+		{ShardID: 2},
+		{ShardID: 3, NodeAddress: "10.200.18.88:9007"},
+	} {
+		got, err := ShardRefsFromString(s.String())
+		assert.NoError(t, err)
+		assert.Equal(t, []*ShardRef{s}, got)
+	}
+}
+
+func unmountTestTopology(nodes map[string]map[string][]uint32) *master_pb.TopologyInfo {
+	var dataNodes []*master_pb.DataNodeInfo
+	for addr, disks := range nodes {
+		diskInfos := map[string]*master_pb.DiskInfo{}
+		for disk, shardIds := range disks {
+			si := erasure_coding.NewShardsInfo()
+			for _, sid := range shardIds {
+				si.Set(erasure_coding.NewShardInfo(erasure_coding.ShardId(sid), 1))
+			}
+			diskInfos[disk] = &master_pb.DiskInfo{
+				Type:           "hdd",
+				MaxVolumeCount: 100,
+				EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{{
+					Id:          100,
+					Collection:  "c1",
+					EcIndexBits: si.Bitmap(),
+					ShardSizes:  si.SizesInt64(),
+					DiskType:    "hdd",
+				}},
+			}
+		}
+		dataNodes = append(dataNodes, &master_pb.DataNodeInfo{
+			Id:        addr,
+			Address:   addr,
+			DiskInfos: diskInfos,
+		})
+	}
+	return &master_pb.TopologyInfo{DataCenterInfos: []*master_pb.DataCenterInfo{{
+		Id:        "dc1",
+		RackInfos: []*master_pb.RackInfo{{Id: "r1", DataNodeInfos: dataNodes}},
+	}}}
+}
+
+// A shard held on two disks of one node is a single unmount target: the
+// unmount RPC addresses the node, not the disk.
+func TestUnmountResolvesShardDuplicatedOnOneNode(t *testing.T) {
+	topo := unmountTestTopology(map[string]map[string][]uint32{
+		"vs3:8080": {"hdd:0": {12}, "hdd:1": {12}},
+		"vs4:8080": {"hdd:0": {13}},
+	})
+
+	for _, shards := range [][]*ShardRef{
+		{{ShardID: 12}},
+		{{ShardID: 12, NodeAddress: "vs3:8080"}},
+	} {
+		var out bytes.Buffer
+		err := UnmountShards(&Env{}, &out, ShardUnmountRequest{
+			Topology: topo,
+			VolumeID: 100,
+			Shards:   shards,
+		})
+		assert.NoError(t, err, "shard %+v", shards)
+		assert.Contains(t, out.String(), "Will unmount 1 shard(s)")
+	}
+}
+
+func TestUnmountStillRejectsShardOnTwoNodes(t *testing.T) {
+	topo := unmountTestTopology(map[string]map[string][]uint32{
+		"vs3:8080": {"hdd:0": {12}},
+		"vs4:8080": {"hdd:0": {12}},
+	})
+
+	var out bytes.Buffer
+	err := UnmountShards(&Env{}, &out, ShardUnmountRequest{
+		Topology: topo,
+		VolumeID: 100,
+		Shards:   []*ShardRef{{ShardID: 12}},
+	})
+	assert.ErrorContains(t, err, "ambiguous")
+
+	out.Reset()
+	err = UnmountShards(&Env{}, &out, ShardUnmountRequest{
+		Topology: topo,
+		VolumeID: 100,
+		Shards:   []*ShardRef{{ShardID: 12, NodeAddress: "vs3:8080"}},
+	})
+	assert.NoError(t, err)
+}
diff --git a/weed/ec/env.go b/weed/ec/env.go
new file mode 100644
index 0000000000..748e5de9d9
--- /dev/null
+++ b/weed/ec/env.go
@@ -0,0 +1,39 @@
+// Package ec holds the EC (erasure coding) cluster orchestration logic shared
+// by the weed shell commands and the maintenance workers: topology analysis of
+// EC shards, the encode/balance pipelines, and the volume-server RPC wrappers
+// they drive. The placement policy itself lives in
+// weed/storage/erasure_coding/ecbalancer; low-level shard mechanics live in
+// weed/storage/erasure_coding.
+package ec
+
+import (
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+)
+
+// Env carries the cluster access hooks EC operations need, decoupled from any
+// particular caller (shell CommandEnv, worker task, admin server).
+type Env struct {
+	GrpcDialOption grpc.DialOption
+	// FetchTopology returns a fresh master topology snapshot (and the master's
+	// volume size limit in MB) after an optional delay.
+	FetchTopology func(delay time.Duration) (*master_pb.TopologyInfo, uint64, error)
+	// GetVolumeLocations returns the current replica locations for a volume id,
+	// or false if the volume is unknown.
+	GetVolumeLocations func(vid uint32) ([]wdclient.Location, bool)
+	// IsLocked reports whether the caller still holds the cluster admin lock.
+	// Callers without a lock concept return true.
+	IsLocked func() bool
+}
+
+// isLocked treats a nil Env or nil hook as locked, matching the shell's
+// nil-receiver behavior so dry-run paths work without a cluster connection.
+func (env *Env) isLocked() bool {
+	if env == nil || env.IsLocked == nil {
+		return true
+	}
+	return env.IsLocked()
+}
diff --git a/weed/filer/abstract_sql/abstract_sql_store.go b/weed/filer/abstract_sql/abstract_sql_store.go
index 9d01bdbbae..52f959d80a 100644
--- a/weed/filer/abstract_sql/abstract_sql_store.go
+++ b/weed/filer/abstract_sql/abstract_sql_store.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -22,14 +23,22 @@ type SqlGenerator interface {
 	GetSqlDeleteFolderChildren(tableName string) string
 	GetSqlListExclusive(tableName string) string
 	GetSqlListInclusive(tableName string) string
+	// GetSqlScanPage returns the query and arguments selecting dirhash, name,
+	// directory and meta of up to limit rows after the (dirhash, name) cursor.
+	GetSqlScanPage(tableName string, dirhash int64, name string, limit int) (string, []interface{})
 	GetSqlCreateTable(tableName string) string
 	GetSqlDropTable(tableName string) string
 }
 
 type AbstractSqlStore struct {
 	SqlGenerator
-	DB                     *sql.DB
+	DB   *sql.DB
+	KvDB *sql.DB
+	// ScanDB, when set, is the pool snapshot scans run on (SQLite's main pool
+	// is a single connection that a long scan must not hold).
+	ScanDB                 *sql.DB
 	SupportBucketTable     bool
+	SkipDDL                bool
 	dbs                    map[string]bool
 	dbsLock                sync.Mutex
 	RetryableErrorCallback func(err error) bool
@@ -38,7 +47,7 @@ type AbstractSqlStore struct {
 var _ filer.BucketAware = (*AbstractSqlStore)(nil)
 
 func (store *AbstractSqlStore) CanDropWholeBucket() bool {
-	return store.SupportBucketTable
+	return store.SupportBucketTable && !store.SkipDDL
 }
 func (store *AbstractSqlStore) OnBucketCreation(bucket string) {
 	store.dbsLock.Lock()
@@ -97,6 +106,49 @@ func (store *AbstractSqlStore) RollbackTransaction(ctx context.Context) error {
 	return nil
 }
 
+// A listing holds its connection for the whole row iteration while its callback
+// reads a hard link through KvGet, so both cannot come out of one bounded pool:
+// the listings fill it and then wait for a connection none of them will release.
+// Give the key-value reads their own slice of connection_max_open. A cap of 1 is
+// the exception -- it has to become 2, or a single listing cannot finish.
+func splitPoolForKv(maxOpen int) (mainOpen, kvOpen int) {
+	if maxOpen <= 0 {
+		return maxOpen, 0
+	}
+	kvOpen = min(max(maxOpen/4, 1), maxKvPoolSize)
+	return max(maxOpen-kvOpen, 1), kvOpen
+}
+
+const maxKvPoolSize = 8
+
+// UseConnectionPools sizes the store's pool and, when it is bounded, opens the
+// separate pool the key-value reads run on.
+func (store *AbstractSqlStore) UseConnectionPools(db *sql.DB, openKv func() (*sql.DB, error), maxIdle, maxOpen, maxLifetimeSeconds int) error {
+
+	lifetime := time.Duration(maxLifetimeSeconds) * time.Second
+	mainOpen, kvOpen := splitPoolForKv(maxOpen)
+
+	db.SetMaxIdleConns(maxIdle)
+	db.SetMaxOpenConns(mainOpen)
+	db.SetConnMaxLifetime(lifetime)
+	store.DB = db
+
+	if kvOpen == 0 {
+		return nil
+	}
+
+	kvDB, err := openKv()
+	if err != nil {
+		return err
+	}
+	kvDB.SetMaxIdleConns(kvOpen)
+	kvDB.SetMaxOpenConns(kvOpen)
+	kvDB.SetConnMaxLifetime(lifetime)
+	store.KvDB = kvDB
+
+	return nil
+}
+
 func (store *AbstractSqlStore) getTxOrDB(ctx context.Context, fullpath util.FullPath, isForChildren bool) (txOrDB TxOrDB, bucket string, shortPath util.FullPath, err error) {
 
 	shortPath = fullpath
@@ -311,7 +363,7 @@ func (store *AbstractSqlStore) DeleteFolderChildren(ctx context.Context, fullpat
 			return fmt.Errorf("findDB %s : %w", fullpath, err)
 		}
 
-		if isValidBucket(bucket) && shortPath == "/" {
+		if isValidBucket(bucket) && shortPath == "/" && store.CanDropWholeBucket() {
 			if err = store.deleteTable(ctx, bucket); err == nil {
 				store.dbsLock.Lock()
 				delete(store.dbs, bucket)
@@ -344,6 +396,14 @@ func (store *AbstractSqlStore) DeleteFolderChildren(ctx context.Context, fullpat
 	return doDeleteFolderChildren()
 }
 
+var likeEscaper = strings.NewReplacer("!", "!!", "%", "!%", "_", "!_")
+
+// LikePattern escapes LIKE wildcards so the prefix matches literally;
+// '!' pairs with the ESCAPE '!' clause emitted by the SqlGenerators.
+func LikePattern(prefix string) string {
+	return likeEscaper.Replace(prefix) + "%"
+}
+
 func (store *AbstractSqlStore) ListDirectoryPrefixedEntries(ctx context.Context, dirPath util.FullPath, startFileName string, includeStartFile bool, limit int64, prefix string, eachEntryFunc filer.ListEachEntryFunc) (lastFileName string, err error) {
 
 	db, bucket, shortPath, err := store.getTxOrDB(ctx, dirPath, true)
@@ -356,7 +416,7 @@ func (store *AbstractSqlStore) ListDirectoryPrefixedEntries(ctx context.Context,
 		sqlText = store.GetSqlListInclusive(bucket)
 	}
 
-	rows, err := db.QueryContext(ctx, sqlText, util.HashStringToLong(string(shortPath)), startFileName, string(shortPath), prefix+"%", limit+1)
+	rows, err := db.QueryContext(ctx, sqlText, util.HashStringToLong(string(shortPath)), startFileName, string(shortPath), LikePattern(prefix), limit+1)
 	if err != nil {
 		return lastFileName, fmt.Errorf("list %s : %v", dirPath, err)
 	}
@@ -400,6 +460,12 @@ func (store *AbstractSqlStore) ListDirectoryEntries(ctx context.Context, dirPath
 
 func (store *AbstractSqlStore) Shutdown() {
 	store.DB.Close()
+	if store.KvDB != nil {
+		store.KvDB.Close()
+	}
+	if store.ScanDB != nil {
+		store.ScanDB.Close()
+	}
 }
 
 func isValidBucket(bucket string) bool {
@@ -410,15 +476,19 @@ func isValidBucket(bucket string) bool {
 }
 
 func (store *AbstractSqlStore) CreateTable(ctx context.Context, bucket string) error {
-	if !store.SupportBucketTable {
+	if !store.SupportBucketTable || store.SkipDDL {
 		return nil
 	}
-	_, err := store.DB.ExecContext(ctx, store.SqlGenerator.GetSqlCreateTable(bucket))
+	sql := store.SqlGenerator.GetSqlCreateTable(bucket)
+	if sql == "" {
+		return nil
+	}
+	_, err := store.DB.ExecContext(ctx, sql)
 	return err
 }
 
 func (store *AbstractSqlStore) deleteTable(ctx context.Context, bucket string) error {
-	if !store.SupportBucketTable {
+	if !store.SupportBucketTable || store.SkipDDL {
 		return nil
 	}
 	_, err := store.DB.ExecContext(ctx, store.SqlGenerator.GetSqlDropTable(bucket))
diff --git a/weed/filer/abstract_sql/abstract_sql_store_kv.go b/weed/filer/abstract_sql/abstract_sql_store_kv.go
index ca89503813..fd5ba3566b 100644
--- a/weed/filer/abstract_sql/abstract_sql_store_kv.go
+++ b/weed/filer/abstract_sql/abstract_sql_store_kv.go
@@ -12,12 +12,21 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
+// Key-value reads run outside the listing pool: a listing calls KvGet from
+// inside its own callback, still holding the connection its rows are on.
+func (store *AbstractSqlStore) kvDB(ctx context.Context) TxOrDB {
+	if tx, ok := ctx.Value("tx").(*sql.Tx); ok {
+		return tx
+	}
+	if store.KvDB != nil {
+		return store.KvDB
+	}
+	return store.DB
+}
+
 func (store *AbstractSqlStore) KvPut(ctx context.Context, key []byte, value []byte) (err error) {
 
-	db, _, _, err := store.getTxOrDB(ctx, "", false)
-	if err != nil {
-		return fmt.Errorf("findDB: %w", err)
-	}
+	db := store.kvDB(ctx)
 
 	dirStr, dirHash, name := GenDirAndName(key)
 
@@ -49,10 +58,7 @@ func (store *AbstractSqlStore) KvPut(ctx context.Context, key []byte, value []by
 
 func (store *AbstractSqlStore) KvGet(ctx context.Context, key []byte) (value []byte, err error) {
 
-	db, _, _, err := store.getTxOrDB(ctx, "", false)
-	if err != nil {
-		return nil, fmt.Errorf("findDB: %w", err)
-	}
+	db := store.kvDB(ctx)
 
 	dirStr, dirHash, name := GenDirAndName(key)
 	row := db.QueryRowContext(ctx, store.GetSqlFind(DEFAULT_TABLE), dirHash, name, dirStr)
@@ -72,10 +78,7 @@ func (store *AbstractSqlStore) KvGet(ctx context.Context, key []byte) (value []b
 
 func (store *AbstractSqlStore) KvDelete(ctx context.Context, key []byte) (err error) {
 
-	db, _, _, err := store.getTxOrDB(ctx, "", false)
-	if err != nil {
-		return fmt.Errorf("findDB: %w", err)
-	}
+	db := store.kvDB(ctx)
 
 	dirStr, dirHash, name := GenDirAndName(key)
 
diff --git a/weed/filer/abstract_sql/abstract_sql_store_scan.go b/weed/filer/abstract_sql/abstract_sql_store_scan.go
new file mode 100644
index 0000000000..2028643755
--- /dev/null
+++ b/weed/filer/abstract_sql/abstract_sql_store_scan.go
@@ -0,0 +1,368 @@
+package abstract_sql
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"math"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+var _ filer.EntryScanner = (*AbstractSqlStore)(nil)
+
+// scanTable is one table to read during a scan together with the path its
+// directory column is relative to: "" for the default table, whose rows hold
+// full directories, and "/buckets/<bucket>" for a per-bucket table.
+type scanTable struct {
+	table string
+	base  string
+	// cachedOnly marks a table that only a stale bucket cache remembers: its
+	// bucket directory was already gone from the snapshot, so a missing table
+	// means it was dropped meanwhile, not that rows are absent.
+	cachedOnly bool
+}
+
+// scanPageSize is how many rows one keyset page of a scan fetches.
+var scanPageSize = 1000
+
+// SetScanPageSizeForTest lets tests drive the keyset cursor across pages. It
+// returns the previous size.
+func SetScanPageSizeForTest(n int) int {
+	prev := scanPageSize
+	scanPageSize = n
+	return prev
+}
+
+// ScanEntries implements filer.EntryScanner: every table that can hold an
+// entry below dirPath is read inside one REPEATABLE READ, read-only
+// transaction, in primary-key pages. All rows are seen as of one instant; a
+// rename committed meanwhile shows up under exactly one of its names. The
+// transaction takes no row locks and does not block writers; it does hold the
+// tables it has read against DDL, so a bucket deleted while the scan runs
+// drops its table once the scan ends. A page's cursor is closed before its
+// entries go to fn, so fn may read the store through the context it receives
+// (which carries the transaction) on the same connection.
+func (store *AbstractSqlStore) ScanEntries(ctx context.Context, dirPath util.FullPath, fn func(ctx context.Context, entry *filer.Entry) error) error {
+	// Read before the transaction holds a connection: OnBucketCreation keeps
+	// dbsLock while it waits for a connection of its own, so taking the lock
+	// while holding a connection could deadlock on an exhausted pool.
+	cachedBuckets := store.cachedBucketNames()
+
+	tx, err := store.beginSnapshotTx(ctx)
+	if err != nil {
+		return err
+	}
+	// Read-only: nothing to commit, and a rollback releases the snapshot.
+	defer tx.Rollback()
+
+	tables, err := store.scanTables(ctx, tx, dirPath, cachedBuckets)
+	if err != nil {
+		return err
+	}
+	// Reads made through this context (getTxOrDB, kvDB) use the transaction
+	// and therefore the snapshot.
+	txCtx := context.WithValue(ctx, "tx", tx)
+	// The root's own row may live in a table the scan does not read (a
+	// bucket directory is in the default table, its contents in the bucket's).
+	if root, err := store.readRowInSnapshot(txCtx, tx, dirPath); err != nil {
+		return err
+	} else if root != nil {
+		if err := fn(txCtx, root); err != nil {
+			return err
+		}
+	}
+	for _, t := range tables {
+		if err := store.scanOneTable(txCtx, tx, t, dirPath, fn); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// readRowInSnapshot reads one entry's row inside the transaction, routing to
+// the table getTxOrDB would use but without its bucket-table creation. A
+// missing row is nil.
+func (store *AbstractSqlStore) readRowInSnapshot(ctx context.Context, tx *sql.Tx, p util.FullPath) (*filer.Entry, error) {
+	if p == "/" {
+		return nil, nil
+	}
+	parent, name := p.DirAndName()
+	table, shortDir := DEFAULT_TABLE, parent
+	if store.SupportBucketTable {
+		if bucket := bucketTableFor(util.FullPath(parent)); bucket != "" {
+			table = bucket
+			if shortDir = strings.TrimPrefix(parent, bucketBase(bucket)); shortDir == "" {
+				shortDir = "/"
+			}
+		}
+	}
+	var data []byte
+	err := tx.QueryRowContext(ctx, store.GetSqlFind(table), util.HashStringToLong(shortDir), name, shortDir).Scan(&data)
+	if err == sql.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, missingTableOr(err, table, fmt.Sprintf("read %s", p))
+	}
+	entry := &filer.Entry{FullPath: p}
+	if err := entry.DecodeAttributesAndChunks(util.MaybeDecompressData(data)); err != nil {
+		return nil, fmt.Errorf("decode %s: %v", p, err)
+	}
+	return entry, nil
+}
+
+// beginSnapshotTx starts the read-only REPEATABLE READ transaction that gives
+// one snapshot across statements. Nothing weaker is tried: under READ
+// COMMITTED each page would see a different snapshot, and the stream would
+// still be advertised as one.
+func (store *AbstractSqlStore) beginSnapshotTx(ctx context.Context) (*sql.Tx, error) {
+	db := store.DB
+	if store.ScanDB != nil {
+		db = store.ScanDB
+	} else if db.Stats().MaxOpenConnections == 1 {
+		// The scan would hold the filer's only connection for its whole run.
+		return nil, fmt.Errorf("%w: the store's single connection cannot be held for a scan", filer.ErrUnsupportedEntryScan)
+	}
+	// A BeginTx failure (a down database) must fail the traversal, not route it
+	// to the walk: a recovered database lets the walk read renamed-away entries
+	// as absent, the very loss this scan exists to prevent.
+	tx, err := db.BeginTx(ctx, &sql.TxOptions{Isolation: sql.LevelRepeatableRead, ReadOnly: true})
+	if err != nil {
+		return nil, fmt.Errorf("begin snapshot: %v", err)
+	}
+	return tx, nil
+}
+
+func (store *AbstractSqlStore) cachedBucketNames() []string {
+	store.dbsLock.Lock()
+	defer store.dbsLock.Unlock()
+	names := make([]string, 0, len(store.dbs))
+	for name := range store.dbs {
+		names = append(names, name)
+	}
+	return names
+}
+
+// scanTables picks the tables to read for dirPath: the default table alone,
+// one bucket's table for a path inside that bucket, or the default table plus
+// every bucket table (enumerated from /buckets inside the snapshot).
+func (store *AbstractSqlStore) scanTables(ctx context.Context, tx *sql.Tx, dirPath util.FullPath, cachedBuckets []string) ([]scanTable, error) {
+	if !store.SupportBucketTable {
+		return []scanTable{{table: DEFAULT_TABLE}}, nil
+	}
+	if bucket := bucketTableFor(dirPath); bucket != "" {
+		return []scanTable{{table: bucket, base: bucketBase(bucket)}}, nil
+	}
+	tables := []scanTable{{table: DEFAULT_TABLE}}
+	if dirPath != "/" && string(dirPath) != bucketsRoot {
+		// Outside every bucket (e.g. /topics, or an internal /buckets/.system
+		// folder): everything below dirPath is in the default table.
+		return tables, nil
+	}
+	buckets, err := store.listBucketNames(ctx, tx, cachedBuckets)
+	if err != nil {
+		return nil, err
+	}
+	for _, bucket := range buckets.names {
+		tables = append(tables, scanTable{table: bucket, base: bucketBase(bucket), cachedOnly: !buckets.seen[bucket]})
+	}
+	return tables, nil
+}
+
+const bucketsRoot = "/buckets"
+
+func bucketBase(bucket string) string {
+	return bucketsRoot + "/" + bucket
+}
+
+// bucketTableFor returns the bucket whose table alone holds everything below
+// dirPath, or "" when dirPath is not inside a real bucket (as getTxOrDB routes).
+func bucketTableFor(dirPath util.FullPath) string {
+	p := string(dirPath)
+	if !strings.HasPrefix(p, bucketsRoot+"/") {
+		return ""
+	}
+	rest := p[len(bucketsRoot)+1:]
+	bucket := rest
+	if i := strings.Index(rest, "/"); i >= 0 {
+		bucket = rest[:i]
+	}
+	if bucket == "" || strings.HasPrefix(bucket, ".") || !isValidBucket(bucket) {
+		return ""
+	}
+	return bucket
+}
+
+// bucketNames is the snapshot-listed and cached-only buckets whose tables a
+// scan may read.
+type bucketNames struct {
+	names []string
+	seen  map[string]bool // listed under /buckets inside the snapshot
+}
+
+// listBucketNames reads the directories under /buckets within the snapshot
+// and keeps those that route to their own table, plus the buckets this
+// process has already seen (their directory entry may be gone, their rows not).
+func (store *AbstractSqlStore) listBucketNames(ctx context.Context, tx *sql.Tx, cachedBuckets []string) (bucketNames, error) {
+	var names bucketNames
+	names.seen = make(map[string]bool)
+	added := make(map[string]bool)
+	add := func(name string) {
+		if added[name] || strings.HasPrefix(name, ".") || !isValidBucket(name) {
+			return
+		}
+		added[name] = true
+		names.names = append(names.names, name)
+	}
+
+	const page = 1000
+	startFrom := ""
+	for {
+		type row struct {
+			name string
+			data []byte
+		}
+		var rows []row
+		if err := func() error {
+			res, err := tx.QueryContext(ctx, store.GetSqlListExclusive(DEFAULT_TABLE), util.HashStringToLong(bucketsRoot), startFrom, bucketsRoot, "%", page)
+			if err != nil {
+				return fmt.Errorf("list %s: %v", bucketsRoot, err)
+			}
+			defer res.Close()
+			for res.Next() {
+				var r row
+				if err := res.Scan(&r.name, &r.data); err != nil {
+					return fmt.Errorf("scan %s: %v", bucketsRoot, err)
+				}
+				rows = append(rows, r)
+			}
+			return res.Err()
+		}(); err != nil {
+			return bucketNames{}, err
+		}
+		for _, r := range rows {
+			startFrom = r.name
+			entry := &filer.Entry{FullPath: util.NewFullPath(bucketsRoot, r.name)}
+			if err := entry.DecodeAttributesAndChunks(util.MaybeDecompressData(r.data)); err != nil {
+				return bucketNames{}, fmt.Errorf("scan decode %s: %v", entry.FullPath, err)
+			}
+			if entry.IsDirectory() {
+				names.seen[r.name] = true
+				add(r.name)
+			}
+		}
+		if len(rows) < page {
+			break
+		}
+	}
+
+	for _, name := range cachedBuckets {
+		add(name)
+	}
+	return names, nil
+}
+
+// scanOneTable reads one table in primary-key pages and hands the entries
+// strictly below dirPath to fn (the root itself is read separately). Key-value
+// records share the default table; GenDirAndName stores the raw key bytes as
+// their dirhash while entry rows hash the directory, so the mismatch
+// identifies them exactly.
+func (store *AbstractSqlStore) scanOneTable(ctx context.Context, tx *sql.Tx, t scanTable, dirPath util.FullPath, fn func(ctx context.Context, entry *filer.Entry) error) error {
+	type row struct {
+		dirHash   int64
+		name, dir string
+		data      []byte
+	}
+	cursorHash, cursorName := int64(math.MinInt64), ""
+	firstPage := true
+	for {
+		var page []row
+		if t.cachedOnly && firstPage {
+			// A missing table can only be met by the first page read: once a
+			// row came back the tx holds the table against a drop. On
+			// PostgreSQL the failed query aborts the transaction, so the skip
+			// needs a savepoint to roll back to before the next table's read.
+			if _, err := tx.ExecContext(ctx, "SAVEPOINT seaweed_scan_bucket"); err != nil {
+				return fmt.Errorf("scan table %s: %v", t.table, err)
+			}
+		}
+		sqlText, args := store.GetSqlScanPage(t.table, cursorHash, cursorName, scanPageSize)
+		rows, err := tx.QueryContext(ctx, sqlText, args...)
+		if err != nil {
+			if t.cachedOnly && isMissingTableError(err) {
+				tx.ExecContext(ctx, "ROLLBACK TO SAVEPOINT seaweed_scan_bucket")
+				return nil // a cached-only name whose table was dropped meanwhile
+			}
+			return missingTableOr(err, t.table, fmt.Sprintf("scan table %s", t.table))
+		}
+		firstPage = false
+		if err := func() error {
+			defer rows.Close()
+			for rows.Next() {
+				var r row
+				if err := rows.Scan(&r.dirHash, &r.name, &r.dir, &r.data); err != nil {
+					return fmt.Errorf("scan table %s: %v", t.table, err)
+				}
+				page = append(page, r)
+			}
+			return rows.Err()
+		}(); err != nil {
+			return err
+		}
+
+		for _, r := range page {
+			cursorHash, cursorName = r.dirHash, r.name
+			if r.dirHash != util.HashStringToLong(r.dir) {
+				continue // a key-value record, see GenDirAndName
+			}
+			fullPath := util.NewFullPath(t.base+r.dir, r.name)
+			if !isStrictlyBelow(fullPath, dirPath) {
+				continue
+			}
+			entry := &filer.Entry{FullPath: fullPath}
+			if err := entry.DecodeAttributesAndChunks(util.MaybeDecompressData(r.data)); err != nil {
+				return fmt.Errorf("scan decode %s: %v", fullPath, err)
+			}
+			if err := fn(ctx, entry); err != nil {
+				return err
+			}
+		}
+		if len(page) < scanPageSize {
+			return nil
+		}
+	}
+}
+
+// missingTableOr names the condition when a bucket's table is not there. The
+// scan fails closed: from inside the snapshot a table that was never created
+// cannot be told from one dropped a moment ago, whose rows the snapshot still
+// counts, and treating either as empty would let fsck purge referenced chunks.
+func missingTableOr(err error, table, what string) error {
+	if table != DEFAULT_TABLE && isMissingTableError(err) {
+		return fmt.Errorf("bucket %s has a directory entry but no table (never created, or dropped during the scan): %v", table, err)
+	}
+	return fmt.Errorf("%s: %v", what, err)
+}
+
+// isMissingTableError recognizes a missing table by message, as InsertEntry
+// recognizes duplicates: PostgreSQL `relation "x" does not exist` (SQLSTATE
+// 42P01), MySQL error 1146 (SQLSTATE 42S02), SQLite "no such table".
+func isMissingTableError(err error) bool {
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "42p01") ||
+		(strings.Contains(msg, "relation \"") && strings.Contains(msg, "does not exist")) ||
+		strings.Contains(msg, "42s02") ||
+		strings.Contains(msg, "error 1146") ||
+		strings.Contains(msg, "no such table")
+}
+
+// isStrictlyBelow reports whether p is a descendant of dir (not dir itself).
+func isStrictlyBelow(p, dir util.FullPath) bool {
+	if dir == "/" {
+		return p != "/"
+	}
+	return strings.HasPrefix(string(p), string(dir)+"/")
+}
diff --git a/weed/filer/abstract_sql/abstract_sql_store_scan_test.go b/weed/filer/abstract_sql/abstract_sql_store_scan_test.go
new file mode 100644
index 0000000000..e9c7cde6b0
--- /dev/null
+++ b/weed/filer/abstract_sql/abstract_sql_store_scan_test.go
@@ -0,0 +1,51 @@
+package abstract_sql
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestBucketTableFor(t *testing.T) {
+	cases := map[string]string{
+		"/":                         "",
+		"/buckets":                  "",
+		"/buckets/":                 "",
+		"/buckets/mybucket":         "mybucket",
+		"/buckets/mybucket/a/b":     "mybucket",
+		"/buckets/.system/owners":   "",
+		"/buckets/Invalid_Bucket/x": "",
+		"/topics/.system/log":       "",
+		"/bucketsfoo/mybucket":      "",
+	}
+	for path, want := range cases {
+		if got := bucketTableFor(util.FullPath(path)); got != want {
+			t.Errorf("bucketTableFor(%s) = %q, want %q", path, got, want)
+		}
+	}
+}
+
+// Only a missing table may be skipped; any other schema error must fail the
+// scan, or a bucket's live chunks would be reported as orphans.
+func TestIsMissingTableError(t *testing.T) {
+	for _, msg := range []string{
+		`ERROR: relation "ghost" does not exist (SQLSTATE 42P01)`,
+		`Error 1146 (42S02): Table 'seaweedfs.ghost' doesn't exist`,
+		`SQL logic error: no such table: ghost (1)`,
+	} {
+		if !isMissingTableError(errors.New(msg)) {
+			t.Errorf("not recognized as a missing table: %s", msg)
+		}
+	}
+	for _, msg := range []string{
+		`ERROR: column "directory" does not exist (SQLSTATE 42703)`,
+		`Error 1054 (42S22): Unknown column 'directory' in 'field list'`,
+		`SQL logic error: no such column: directory (1)`,
+		"connection refused",
+	} {
+		if isMissingTableError(errors.New(msg)) {
+			t.Errorf("wrongly taken for a missing table: %s", msg)
+		}
+	}
+}
diff --git a/weed/filer/abstract_sql/abstract_sql_store_test.go b/weed/filer/abstract_sql/abstract_sql_store_test.go
index 156b84c85c..818360327c 100644
--- a/weed/filer/abstract_sql/abstract_sql_store_test.go
+++ b/weed/filer/abstract_sql/abstract_sql_store_test.go
@@ -51,3 +51,41 @@ func TestGetTxOrDBRealBucket(t *testing.T) {
 		t.Errorf("shortPath = %q, want /dir/file.txt", shortPath)
 	}
 }
+
+func TestLikePattern(t *testing.T) {
+	cases := []struct {
+		prefix, want string
+	}{
+		{"", "%"},
+		{"plain", "plain%"},
+		{"call_03_KNl", "call!_03!_KNl%"},
+		{"100%", "100!%%"},
+		{"a!b", "a!!b%"},
+		{`a\b`, `a\b%`},
+	}
+	for _, c := range cases {
+		if got := LikePattern(c.prefix); got != c.want {
+			t.Errorf("LikePattern(%q) = %q, want %q", c.prefix, got, c.want)
+		}
+	}
+}
+
+func TestSplitPoolForKv(t *testing.T) {
+	cases := []struct {
+		maxOpen, mainOpen, kvOpen int
+	}{
+		{0, 0, 0},   // unbounded: nothing waits, one pool is enough
+		{-1, -1, 0}, // same, however the operator spelled it
+		{50, 42, 8},
+		{16, 12, 4},
+		{4, 3, 1},
+		{2, 1, 1},
+		{1, 1, 1}, // a listing needs two, so a cap of 1 has to become 2
+	}
+	for _, c := range cases {
+		mainOpen, kvOpen := splitPoolForKv(c.maxOpen)
+		if mainOpen != c.mainOpen || kvOpen != c.kvOpen {
+			t.Errorf("splitPoolForKv(%d) = %d, %d, want %d, %d", c.maxOpen, mainOpen, kvOpen, c.mainOpen, c.kvOpen)
+		}
+	}
+}
diff --git a/weed/filer/arangodb/arangodb_store.go b/weed/filer/arangodb/arangodb_store.go
index 7b2184c62d..dbeb9568b7 100644
--- a/weed/filer/arangodb/arangodb_store.go
+++ b/weed/filer/arangodb/arangodb_store.go
@@ -5,7 +5,6 @@ import (
 	"crypto/tls"
 	"fmt"
 	"strconv"
-	"strings"
 	"sync"
 	"time"
 
@@ -265,21 +264,19 @@ func (store *ArangodbStore) DeleteEntry(ctx context.Context, fullpath util.FullP
 
 // this runs in log time
 func (store *ArangodbStore) DeleteFolderChildren(ctx context.Context, fullpath util.FullPath) (err error) {
-	var query string
 	targetCollection, err := store.extractBucketCollection(ctx, fullpath)
 	if err != nil {
 		return err
 	}
-	query = query + fmt.Sprintf(`
-	for d in %s
-	filter starts_with(d.directory, "%s/")  || d.directory == "%s"
-	remove d._key in %s`,
-		"`"+targetCollection.Name()+"`",
-		strings.Join(strings.Split(string(fullpath), "/"), ","),
-		string(fullpath),
-		"`"+targetCollection.Name()+"`",
-	)
-	cur, err := store.database.Query(ctx, query, nil)
+	query := `
+	for d in @@collection
+	filter starts_with(d.directory, @dirPrefix)  || d.directory == @dir
+	remove d._key in @@collection`
+	cur, err := store.database.Query(ctx, query, map[string]interface{}{
+		"@collection": targetCollection.Name(),
+		"dirPrefix":   string(fullpath) + "/",
+		"dir":         string(fullpath),
+	})
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
 	}
@@ -296,14 +293,20 @@ func (store *ArangodbStore) ListDirectoryPrefixedEntries(ctx context.Context, di
 	if err != nil {
 		return lastFileName, err
 	}
-	query := "for d in " + "`" + targetCollection.Name() + "`"
+	bindVars := map[string]interface{}{
+		"@collection": targetCollection.Name(),
+		"dir":         dirPath,
+		"startFile":   startFileName,
+	}
+	query := "for d in @@collection"
 	if includeStartFile {
-		query = query + " filter d.name >= \"" + startFileName + "\" "
+		query = query + " filter d.name >= @startFile "
 	} else {
-		query = query + " filter d.name > \"" + startFileName + "\" "
+		query = query + " filter d.name > @startFile "
 	}
 	if prefix != "" {
-		query = query + fmt.Sprintf(`&& starts_with(d.name, "%s")`, prefix)
+		query = query + "&& starts_with(d.name, @prefix)"
+		bindVars["prefix"] = prefix
 	}
 	query = query + `
 filter d.directory == @dir
@@ -313,7 +316,7 @@ sort d.name asc
 		query = query + "limit " + strconv.Itoa(int(limit))
 	}
 	query = query + "\n return d"
-	cur, err := store.database.Query(ctx, query, map[string]interface{}{"dir": dirPath})
+	cur, err := store.database.Query(ctx, query, bindVars)
 	if err != nil {
 		return lastFileName, fmt.Errorf("failed to list directory entries: find error: %w", err)
 	}
diff --git a/weed/filer/arangodb/arangodb_store_kv.go b/weed/filer/arangodb/arangodb_store_kv.go
index ae768c7fb8..e9add46446 100644
--- a/weed/filer/arangodb/arangodb_store_kv.go
+++ b/weed/filer/arangodb/arangodb_store_kv.go
@@ -39,7 +39,7 @@ func (store *ArangodbStore) KvGet(ctx context.Context, key []byte) (value []byte
 	}
 	if err != nil {
 		glog.ErrorfCtx(ctx, "kv get: %s %v", string(key), err)
-		return nil, filer.ErrKvNotFound
+		return nil, err
 	}
 	return arrayToBytes(model.Meta), nil
 }
diff --git a/weed/filer/arangodb/arangodb_store_test.go b/weed/filer/arangodb/arangodb_store_test.go
new file mode 100644
index 0000000000..de74fd6bce
--- /dev/null
+++ b/weed/filer/arangodb/arangodb_store_test.go
@@ -0,0 +1,195 @@
+package arangodb
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/arangodb/go-driver"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func newTestStore(t *testing.T) *ArangodbStore {
+	t.Helper()
+
+	if os.Getenv("RUN_ARANGODB_TESTS") != "1" {
+		t.Skip("arangodb tests are disabled. Start an arangodb server and set RUN_ARANGODB_TESTS=1 to enable, ARANGODB_ADDR defaults to http://127.0.0.1:8529.")
+	}
+
+	addr := os.Getenv("ARANGODB_ADDR")
+	if addr == "" {
+		addr = "http://127.0.0.1:8529"
+	}
+	user := os.Getenv("ARANGODB_USER")
+	if user == "" {
+		user = "root"
+	}
+
+	store := &ArangodbStore{databaseName: fmt.Sprintf("seaweed_test_%d", time.Now().UnixNano())}
+	store.buckets = make(map[string]driver.Collection, 3)
+	if err := store.connection([]string{addr}, user, os.Getenv("ARANGODB_PASSWORD"), true); err != nil {
+		t.Fatalf("connect to arangodb at %s: %v", addr, err)
+	}
+	t.Cleanup(func() {
+		if err := store.database.Remove(context.Background()); err != nil {
+			t.Errorf("drop test database: %v", err)
+		}
+	})
+	return store
+}
+
+func insertTestEntry(t *testing.T, store *ArangodbStore, path string) {
+	t.Helper()
+	if err := store.InsertEntry(context.Background(), &filer.Entry{FullPath: util.FullPath(path)}); err != nil {
+		t.Fatalf("insert %s: %v", path, err)
+	}
+}
+
+func countDocuments(t *testing.T, store *ArangodbStore, bucket string) int64 {
+	t.Helper()
+	collection, err := store.ensureBucket(context.Background(), bucket)
+	if err != nil {
+		t.Fatalf("ensure bucket %s: %v", bucket, err)
+	}
+	count, err := collection.Count(context.Background())
+	if err != nil {
+		t.Fatalf("count %s: %v", bucket, err)
+	}
+	return count
+}
+
+func listNames(t *testing.T, store *ArangodbStore, dir util.FullPath, prefix string) []string {
+	t.Helper()
+	var names []string
+	_, err := store.ListDirectoryPrefixedEntries(context.Background(), dir, "", true, 100, prefix,
+		func(entry *filer.Entry) (bool, error) {
+			names = append(names, entry.Name())
+			return true, nil
+		})
+	if err != nil {
+		t.Fatalf("list %s prefix %q: %v", dir, prefix, err)
+	}
+	return names
+}
+
+// AQL operators in a list prefix must be matched literally, never executed.
+func TestListDirectoryPrefixedEntriesAqlInjection(t *testing.T) {
+	store := newTestStore(t)
+
+	insertTestEntry(t, store, "/buckets/victim/secret")
+	insertTestEntry(t, store, "/buckets/tenant/regular")
+
+	injection := "x\" && false || (FOR q IN `victim` LIMIT 1 UPDATE q WITH {injected:\"yes\"} IN `victim` RETURN \"\") || \""
+	if names := listNames(t, store, util.FullPath("/buckets/tenant"), injection); len(names) != 0 {
+		t.Errorf("expected no match for injected prefix, got %v", names)
+	}
+
+	var victim Model
+	collection, err := store.ensureBucket(context.Background(), "victim")
+	if err != nil {
+		t.Fatalf("ensure bucket victim: %v", err)
+	}
+	if _, err := collection.ReadDocument(context.Background(), hashString("/buckets/victim/secret"), &victim); err != nil {
+		t.Fatalf("read victim document: %v", err)
+	}
+	if victim.Name != "secret" {
+		t.Errorf("victim document was modified across buckets: %+v", victim)
+	}
+}
+
+// A prefix full of AQL operators must not be evaluated as a query.
+func TestListDirectoryPrefixedEntriesPrefixNotEvaluated(t *testing.T) {
+	store := newTestStore(t)
+
+	insertTestEntry(t, store, "/buckets/tenant/a")
+	insertTestEntry(t, store, "/buckets/tenant/b")
+	insertTestEntry(t, store, "/buckets/tenant/c")
+
+	start := time.Now()
+	if names := listNames(t, store, util.FullPath("/buckets/tenant"), "x\" && false || TO_STRING(SLEEP(1)) && false || \""); len(names) != 0 {
+		t.Errorf("expected no match for injected prefix, got %v", names)
+	}
+	if elapsed := time.Since(start); elapsed > time.Second {
+		t.Errorf("SLEEP() in prefix was executed, listing took %v", elapsed)
+	}
+}
+
+// Quotes and newlines are ordinary object-name characters and must round-trip.
+func TestListDirectoryPrefixedEntriesQuotedNames(t *testing.T) {
+	store := newTestStore(t)
+
+	names := []string{"plain", "quo\"te", "new\nline", "back\\slash"}
+	for _, name := range names {
+		insertTestEntry(t, store, "/buckets/tenant/"+name)
+	}
+
+	for _, name := range names {
+		if got := listNames(t, store, util.FullPath("/buckets/tenant"), name); len(got) != 1 || got[0] != name {
+			t.Errorf("prefix %q listed %v, want exactly [%q]", name, got, name)
+		}
+	}
+
+	if got := listNames(t, store, util.FullPath("/buckets/tenant"), ""); len(got) != len(names) {
+		t.Errorf("empty prefix listed %v, want %d entries", got, len(names))
+	}
+}
+
+// A directory name full of AQL operators must only drop that directory's own children.
+func TestDeleteFolderChildrenAqlInjection(t *testing.T) {
+	store := newTestStore(t)
+
+	for i := 0; i < 5; i++ {
+		insertTestEntry(t, store, fmt.Sprintf("/buckets/tenant/keep%d", i))
+	}
+	injection := "x\" || true || \""
+	insertTestEntry(t, store, "/buckets/tenant/"+injection+"/child")
+
+	if err := store.DeleteFolderChildren(context.Background(), util.FullPath("/buckets/tenant/"+injection)); err != nil {
+		t.Fatalf("delete folder children: %v", err)
+	}
+
+	if got := countDocuments(t, store, "tenant"); got != 5 {
+		t.Errorf("tenant collection holds %d documents, want the 5 unrelated ones", got)
+	}
+}
+
+func TestDeleteFolderChildrenRemovesSubtree(t *testing.T) {
+	store := newTestStore(t)
+
+	insertTestEntry(t, store, "/buckets/tenant/dir/file")
+	insertTestEntry(t, store, "/buckets/tenant/dir/sub/deep")
+	insertTestEntry(t, store, "/buckets/tenant/dirX/sibling")
+	insertTestEntry(t, store, "/buckets/tenant/other")
+
+	if err := store.DeleteFolderChildren(context.Background(), util.FullPath("/buckets/tenant/dir")); err != nil {
+		t.Fatalf("delete folder children: %v", err)
+	}
+
+	if got := countDocuments(t, store, "tenant"); got != 2 {
+		t.Errorf("tenant collection holds %d documents, want /buckets/tenant/dirX/sibling and /buckets/tenant/other", got)
+	}
+}
+
+// startFileName is request-controlled too and must not break out of the filter.
+func TestListDirectoryEntriesQuotedStartFileName(t *testing.T) {
+	store := newTestStore(t)
+
+	insertTestEntry(t, store, "/buckets/tenant/a")
+	insertTestEntry(t, store, "/buckets/tenant/z")
+
+	var names []string
+	_, err := store.ListDirectoryEntries(context.Background(), util.FullPath("/buckets/tenant"), "z\" || true || \"", false, 100,
+		func(entry *filer.Entry) (bool, error) {
+			names = append(names, entry.Name())
+			return true, nil
+		})
+	if err != nil {
+		t.Fatalf("list with quoted start file: %v", err)
+	}
+	if len(names) != 0 {
+		t.Errorf("listed %v, want nothing sorted after the literal start name", names)
+	}
+}
diff --git a/weed/filer/elastic/v7/elastic_store_kv.go b/weed/filer/elastic/v7/elastic_store_kv.go
index f662639ff9..d6b9c844a4 100644
--- a/weed/filer/elastic/v7/elastic_store_kv.go
+++ b/weed/filer/elastic/v7/elastic_store_kv.go
@@ -37,13 +37,16 @@ func (store *ElasticStore) KvGet(ctx context.Context, key []byte) (value []byte,
 	if elastic.IsNotFound(err) {
 		return value, filer.ErrKvNotFound
 	}
+	if err != nil {
+		glog.ErrorfCtx(ctx, "find key(%s),%v.", string(key), err)
+		return value, err
+	}
 	if searchResult != nil && searchResult.Found {
 		esEntry := &ESKVEntry{}
 		if err := jsoniter.Unmarshal(searchResult.Source, esEntry); err == nil {
 			return esEntry.Value, nil
 		}
 	}
-	glog.ErrorfCtx(ctx, "find key(%s),%v.", string(key), err)
 	return value, filer.ErrKvNotFound
 }
 
diff --git a/weed/filer/empty_folder_cleanup/empty_folder_cleaner.go b/weed/filer/empty_folder_cleanup/empty_folder_cleaner.go
index 82213fce81..b85b94d20f 100644
--- a/weed/filer/empty_folder_cleanup/empty_folder_cleaner.go
+++ b/weed/filer/empty_folder_cleanup/empty_folder_cleaner.go
@@ -2,6 +2,9 @@ package empty_folder_cleanup
 
 import (
 	"context"
+	"fmt"
+	"os"
+	"sort"
 	"strings"
 	"sync"
 	"time"
@@ -15,27 +18,60 @@ import (
 )
 
 const (
-	DefaultMaxCountCheck  = 1000
-	DefaultCacheExpiry    = 5 * time.Minute
-	DefaultQueueMaxSize   = 1000
-	DefaultQueueMaxAge    = 2 * time.Minute
-	DefaultProcessorSleep = 30 * time.Second // How often to check queue
+	DefaultMaxCountCheck     = 1000
+	DefaultCacheExpiry       = 5 * time.Minute
+	DefaultQueueMaxSize      = 1000
+	DefaultQueueMaxAge       = 2 * time.Minute
+	DefaultProcessorSleep    = 30 * time.Second // How often to check queue
+	DefaultMaxDeletedKept    = 10000            // Deleted folders remembered for the restore check
+	DefaultMaxPolicyFailures = 3                // Consecutive policy-load failures before a folder is dropped
+	// How long a deleted folder is kept so that a create event arriving for it can
+	// still put it back. It bounds how far behind the event stream may run, not how
+	// long the race window is.
+	DefaultObservationWindow = 2 * time.Minute
 )
 
+// DirectoryAttributes is what a restored directory needs to come back as it was.
+type DirectoryAttributes struct {
+	Mode       os.FileMode
+	Uid        uint32
+	Gid        uint32
+	UserName   string
+	GroupNames []string
+}
+
+// deletedFolder is a folder under observation for entries that landed while it was
+// being deleted. writtenTo is set by the create event for such an entry.
+type deletedFolder struct {
+	path      string
+	attrs     DirectoryAttributes
+	deletedAt time.Time
+	writtenTo bool
+}
+
 // FilerOperations defines the filer operations needed by EmptyFolderCleaner
 type FilerOperations interface {
 	CountDirectoryEntries(ctx context.Context, dirPath util.FullPath, limit int) (count int, err error)
 	DeleteEntryMetaAndData(ctx context.Context, p util.FullPath, isRecursive, ignoreRecursiveError, shouldDeleteChunks, isFromOtherCluster bool, signatures []int32, ifNotModifiedAfter int64) error
 	GetEntryAttributes(ctx context.Context, p util.FullPath) (attributes map[string][]byte, err error)
 	IsDirectoryKeyObject(ctx context.Context, p util.FullPath) (bool, error)
+	DirectoryAttributes(ctx context.Context, p util.FullPath) (DirectoryAttributes, error)
+	EnsureDirectoryEntry(ctx context.Context, p util.FullPath, attrs DirectoryAttributes) error
 }
 
 // folderState tracks the state of a folder for empty folder cleanup
 type folderState struct {
-	roughCount  int       // Cached rough count (up to maxCountCheck)
-	lastAddTime time.Time // Last time an item was added
-	lastDelTime time.Time // Last time an item was deleted
-	lastCheck   time.Time // Last time we checked the actual count
+	roughCount     int       // Cached rough count (up to maxCountCheck)
+	lastAddTime    time.Time // Last time an item was added
+	lastDelTime    time.Time // Last time an item was deleted
+	lastCheck      time.Time // Last time we checked the actual count
+	policyFailures int       // Consecutive bucket policy load failures
+}
+
+type bucketPolicyGen struct {
+	gen      uint64
+	lastBump time.Time
+	inflight int
 }
 
 type bucketCleanupPolicyState struct {
@@ -55,6 +91,12 @@ type EmptyFolderCleaner struct {
 	mu                    sync.RWMutex
 	folderCounts          map[string]*folderState              // Rough count cache
 	bucketCleanupPolicies map[string]*bucketCleanupPolicyState // bucket path -> cleanup policy cache
+	policyGen             map[string]*bucketPolicyGen          // bucket path -> generation, bumped on bucket entry updates to invalidate in-flight policy loads
+
+	// Folders deleted recently, kept so that a create event arriving for one of them
+	// can put it back
+	deleted        map[string]*deletedFolder
+	deletedDropped int
 
 	// Cleanup queue (thread-safe, has its own lock)
 	cleanupQueue *CleanupQueue
@@ -83,6 +125,8 @@ func NewEmptyFolderCleaner(filer FilerOperations, lockRing *lock_manager.LockRin
 		host:                  host,
 		folderCounts:          make(map[string]*folderState),
 		bucketCleanupPolicies: make(map[string]*bucketCleanupPolicyState),
+		policyGen:             make(map[string]*bucketPolicyGen),
+		deleted:               make(map[string]*deletedFolder),
 		cleanupQueue:          NewCleanupQueue(DefaultQueueMaxSize, cleanupDelay),
 		maxCountCheck:         DefaultMaxCountCheck,
 		cacheExpiry:           DefaultCacheExpiry,
@@ -194,10 +238,55 @@ func (efc *EmptyFolderCleaner) OnCreateEvent(directory string, entryName string,
 		state.lastAddTime = time.Now()
 	}
 
+	// An entry landing in a folder we just deleted is the race this cleaner cannot
+	// exclude: the folder was empty when checked and is gone now, so the entry has
+	// nothing holding it. The event says so outright, which beats going back to look.
+	if folder, found := efc.deleted[directory]; found {
+		folder.writtenTo = true
+		glog.V(2).Infof("EmptyFolderCleaner: %s was written to while being deleted, restoring it", directory)
+	}
+
 	// Remove from cleanup queue (cancel pending cleanup)
 	if efc.cleanupQueue.Remove(directory) {
 		glog.V(3).Infof("EmptyFolderCleaner: cancelled cleanup for %s due to new entry", directory)
 	}
+
+	// A directory that has just been created is a new incarnation, so a cleanup
+	// queued against the one it replaces would delete it rather than the folder
+	// that was found empty.
+	if isDirectory {
+		recreated := string(util.NewFullPath(directory, entryName))
+		if efc.cleanupQueue.Remove(recreated) {
+			glog.V(3).Infof("EmptyFolderCleaner: cancelled cleanup for %s, recreated", recreated)
+		}
+	}
+}
+
+// InvalidateBucketPolicy drops the cached cleanup policy when a bucket entry changes
+func (efc *EmptyFolderCleaner) InvalidateBucketPolicy(directory string, entryName string, isDirectory bool) {
+	if !isDirectory || directory != efc.bucketPath {
+		return
+	}
+
+	efc.mu.Lock()
+	defer efc.mu.Unlock()
+
+	if !efc.enabled {
+		return
+	}
+
+	if efc.policyGen == nil {
+		efc.policyGen = make(map[string]*bucketPolicyGen)
+	}
+	path := string(util.NewFullPath(directory, entryName))
+	gen := efc.policyGen[path]
+	if gen == nil {
+		gen = &bucketPolicyGen{}
+		efc.policyGen[path] = gen
+	}
+	gen.gen++
+	gen.lastBump = time.Now()
+	delete(efc.bucketCleanupPolicies, path)
 }
 
 // cleanupProcessor runs in background and processes the cleanup queue
@@ -217,6 +306,8 @@ func (efc *EmptyFolderCleaner) cleanupProcessor() {
 
 // processCleanupQueue processes items from the cleanup queue
 func (efc *EmptyFolderCleaner) processCleanupQueue() {
+	efc.restoreFoldersWrittenDuringDelete()
+
 	if efc.cleanupQueue.Len() == 0 {
 		return
 	}
@@ -242,6 +333,160 @@ func (efc *EmptyFolderCleaner) processCleanupQueue() {
 	}
 }
 
+// restoreFoldersWrittenDuringDelete puts back folders that received an entry between
+// the emptiness check and the delete, which leaves that entry with no directory
+// holding it: reachable by its own path, but absent from any listing.
+//
+// A folder stays under observation for DefaultRestoreCheckWindow rather than being
+// checked once. A writer looks up the parent before inserting the child, so a check
+// can land in that gap and see nothing; ticks also coalesce when a pass runs long, so
+// "next pass" is not a delay at all. Re-checking for a bounded wall-clock window
+// covers both. This narrows the exposure rather than closing it - only making the
+// emptiness check and the delete atomic would do that.
+func (efc *EmptyFolderCleaner) restoreFoldersWrittenDuringDelete() {
+	efc.mu.Lock()
+	dropped := efc.deletedDropped
+	efc.deletedDropped = 0
+	var restore []*deletedFolder
+	for path, folder := range efc.deleted {
+		// The window applies whatever the folder's state is. Checking writtenTo first
+		// would keep a folder whose restore keeps failing forever, re-counting it on
+		// every pass.
+		if time.Since(folder.deletedAt) >= DefaultObservationWindow {
+			delete(efc.deleted, path)
+			continue
+		}
+		if folder.writtenTo {
+			restore = append(restore, folder)
+			delete(efc.deleted, path)
+		}
+	}
+	// A cascade takes ancestors along with the folder. Rebuild those from what they
+	// were too: leaving them to the descendant's restore would mint them from the
+	// descendant's own attributes, handing back access the ancestor did not grant.
+	for i := 0; i < len(restore); i++ {
+		ancestor, _ := util.FullPath(restore[i].path).DirAndName()
+		for ancestor != "" && ancestor != "/" {
+			if folder, found := efc.deleted[ancestor]; found {
+				restore = append(restore, folder)
+				delete(efc.deleted, ancestor)
+			}
+			ancestor, _ = util.FullPath(ancestor).DirAndName()
+		}
+	}
+	efc.mu.Unlock()
+
+	if dropped > 0 {
+		glog.V(1).Infof("EmptyFolderCleaner: %d deleted folders left unobserved, past the %d kept", dropped, DefaultMaxDeletedKept)
+	}
+	if len(restore) == 0 {
+		return
+	}
+
+	// Restore shallowest first, so a folder taken by the parent cascade is rebuilt
+	// with its own attributes before anything below it needs it as a parent.
+	sort.Slice(restore, func(i, j int) bool {
+		return strings.Count(restore[i].path, "/") < strings.Count(restore[j].path, "/")
+	})
+
+	ctx := context.Background()
+	var retry []*deletedFolder
+	for i, folder := range restore {
+		if !efc.IsEnabled() {
+			retry = append(retry, restore[i:]...)
+			break
+		}
+		// An event named this folder, but the entry may have been removed again since,
+		// in which case there is nothing to hold and it can stay gone. Ancestors pulled
+		// in above carry no event and are rebuilt regardless, since the folder below
+		// them needs them.
+		if folder.writtenTo {
+			count, err := efc.countItems(ctx, folder.path)
+			if err != nil {
+				glog.V(2).Infof("EmptyFolderCleaner: cannot count %s before restoring it: %v", folder.path, err)
+				retry = append(retry, folder)
+				continue
+			}
+			if count == 0 {
+				continue
+			}
+		}
+		glog.V(1).Infof("EmptyFolderCleaner: restoring %s, written to while it was being deleted", folder.path)
+		if err := efc.filer.EnsureDirectoryEntry(ctx, util.FullPath(folder.path), folder.attrs); err != nil {
+			glog.V(2).Infof("EmptyFolderCleaner: failed to restore %s: %v", folder.path, err)
+			retry = append(retry, folder)
+		}
+	}
+
+	if len(retry) == 0 {
+		return
+	}
+	efc.mu.Lock()
+	for _, folder := range retry {
+		if _, found := efc.deleted[folder.path]; !found {
+			efc.makeRoomForDeletedLocked()
+		}
+		efc.deleted[folder.path] = folder
+	}
+	efc.mu.Unlock()
+}
+
+// restoreIfWrittenTo puts folder back when an entry landed in it while it was being
+// deleted. True means the parent is no longer empty, so the caller must not cascade.
+func (efc *EmptyFolderCleaner) restoreIfWrittenTo(ctx context.Context, folder string, attrs DirectoryAttributes) bool {
+	count, err := efc.countItems(ctx, folder)
+	if err != nil || count > 0 {
+		// Ask for the retry here rather than leaving it to a create event that may
+		// already have gone by: this pass can be the only sight of the entry.
+		efc.mu.Lock()
+		if observed, found := efc.deleted[folder]; found {
+			observed.writtenTo = true
+		}
+		efc.mu.Unlock()
+	}
+	if err != nil {
+		glog.V(2).Infof("EmptyFolderCleaner: cannot re-check %s after deleting it: %v", folder, err)
+		return false
+	}
+	if count == 0 {
+		return false
+	}
+
+	glog.V(1).Infof("EmptyFolderCleaner: restoring %s, written to while it was being deleted", folder)
+	if err := efc.filer.EnsureDirectoryEntry(ctx, util.FullPath(folder), attrs); err != nil {
+		glog.V(2).Infof("EmptyFolderCleaner: failed to restore %s: %v", folder, err)
+		return false
+	}
+
+	efc.mu.Lock()
+	delete(efc.deleted, folder)
+	efc.mu.Unlock()
+	return true
+}
+
+// makeRoomForDeletedLocked drops the oldest of a small sample when the set is full.
+// The newest folders are the ones whose race is still live, so they must not be the
+// ones given up; sampling keeps this cheap under heavy deletion rates.
+func (efc *EmptyFolderCleaner) makeRoomForDeletedLocked() {
+	if len(efc.deleted) < DefaultMaxDeletedKept {
+		return
+	}
+	const sampleSize = 32
+	oldestPath, seen := "", 0
+	for path, folder := range efc.deleted {
+		if oldestPath == "" || folder.deletedAt.Before(efc.deleted[oldestPath].deletedAt) {
+			oldestPath = path
+		}
+		if seen++; seen >= sampleSize {
+			break
+		}
+	}
+	if oldestPath != "" {
+		delete(efc.deleted, oldestPath)
+		efc.deletedDropped++
+	}
+}
+
 // executeCleanup performs the actual cleanup of an empty folder
 func (efc *EmptyFolderCleaner) executeCleanup(folder string, triggeredBy string) {
 	// The bucket-shared .uploads staging tree holds in-progress multipart uploads.
@@ -284,9 +529,28 @@ func (efc *EmptyFolderCleaner) executeCleanup(folder string, triggeredBy string)
 			return
 		}
 		glog.V(2).Infof("EmptyFolderCleaner: failed to load bucket cleanup policy for folder %s (triggered by %s): %v", folder, triggeredBy, err)
+		efc.mu.Lock()
+		if efc.enabled {
+			state, exists := efc.folderCounts[folder]
+			if !exists {
+				state = &folderState{}
+				efc.folderCounts[folder] = state
+			}
+			state.policyFailures++
+			if state.policyFailures <= DefaultMaxPolicyFailures {
+				efc.cleanupQueue.Add(folder, triggeredBy, time.Now())
+			}
+		}
+		efc.mu.Unlock()
 		return
 	}
 
+	efc.mu.Lock()
+	if state, exists := efc.folderCounts[folder]; exists {
+		state.policyFailures = 0
+	}
+	efc.mu.Unlock()
+
 	if !autoRemove {
 		glog.V(3).Infof("EmptyFolderCleaner: skipping folder %s (triggered by %s), bucket %s auto-remove-empty-folders disabled (source=%s attr=%s)",
 			folder, triggeredBy, bucketPath, source, attrValue)
@@ -324,7 +588,36 @@ func (efc *EmptyFolderCleaner) executeCleanup(folder string, triggeredBy string)
 		return
 	}
 
-	// Delete the empty folder
+	// Read what it would take to put this folder back before removing it; without
+	// that a restore would have to invent attributes for it.
+	attrs, err := efc.filer.DirectoryAttributes(ctx, util.FullPath(folder))
+	if err != nil {
+		glog.V(2).Infof("EmptyFolderCleaner: cannot read %s before deleting it: %v", folder, err)
+		return
+	}
+
+	// An S3 Tables catalog entry - a namespace, a table whose files a rename left
+	// behind at the old path, a view that never had any - is the directory itself,
+	// so its being empty says nothing about whether the catalog still names it.
+	if extended, err := efc.filer.GetEntryAttributes(ctx, util.FullPath(folder)); err != nil {
+		glog.V(2).Infof("EmptyFolderCleaner: error reading attributes of %s: %v", folder, err)
+		return
+	} else if isCatalogEntry(extended) {
+		glog.V(3).Infof("EmptyFolderCleaner: skipping %s (triggered by %s), s3tables catalog entry", folder, triggeredBy)
+		return
+	}
+
+	// Observe it before the delete rather than after. A delete can fail partway and
+	// still leave the folder gone - the redis stores remove the folder before their
+	// parent-list member - so a failure return is not proof that it is still there.
+	efc.mu.Lock()
+	if efc.deleted == nil {
+		efc.deleted = make(map[string]*deletedFolder)
+	}
+	efc.makeRoomForDeletedLocked()
+	efc.deleted[folder] = &deletedFolder{path: folder, attrs: attrs, deletedAt: time.Now()}
+	efc.mu.Unlock()
+
 	glog.Infof("EmptyFolderCleaner: deleting empty folder %s (triggered by %s)", folder, triggeredBy)
 	if err := efc.deleteFolder(ctx, folder); err != nil {
 		glog.V(2).Infof("EmptyFolderCleaner: failed to delete empty folder %s (triggered by %s): %v", folder, triggeredBy, err)
@@ -336,6 +629,12 @@ func (efc *EmptyFolderCleaner) executeCleanup(folder string, triggeredBy string)
 	delete(efc.folderCounts, folder)
 	efc.mu.Unlock()
 
+	// The delete's own emptiness check and the entry removal are not atomic either.
+	// Paired with parents being created after the insert, whoever acts second sees it.
+	if efc.restoreIfWrittenTo(ctx, folder, attrs) {
+		return
+	}
+
 	// After deleting this folder, immediately try to clean the parent.
 	// Relying solely on cascading metadata events would re-enter the full
 	// delay queue for each ancestor level, causing multi-minute cascading
@@ -375,25 +674,57 @@ func (efc *EmptyFolderCleaner) getBucketCleanupPolicy(ctx context.Context, folde
 	}
 	efc.mu.RUnlock()
 
-	attrs, err := efc.filer.GetEntryAttributes(ctx, util.FullPath(bucketPath))
-	if err != nil {
-		return "", true, "", "", err
+	for attempt := 0; attempt < 3; attempt++ {
+		efc.mu.Lock()
+		if efc.policyGen == nil {
+			efc.policyGen = make(map[string]*bucketPolicyGen)
+		}
+		state := efc.policyGen[bucketPath]
+		if state == nil {
+			state = &bucketPolicyGen{}
+			efc.policyGen[bucketPath] = state
+		}
+		state.inflight++
+		gen := state.gen
+		efc.mu.Unlock()
+
+		attrs, err := efc.filer.GetEntryAttributes(ctx, util.FullPath(bucketPath))
+
+		efc.mu.Lock()
+		state.inflight--
+		if err != nil {
+			efc.mu.Unlock()
+			return "", true, "", "", err
+		}
+		autoRemove, attrValue = autoRemoveEmptyFoldersEnabled(attrs)
+		if gen != state.gen {
+			efc.mu.Unlock()
+			continue
+		}
+		if efc.bucketCleanupPolicies == nil {
+			efc.bucketCleanupPolicies = make(map[string]*bucketCleanupPolicyState)
+		}
+		efc.bucketCleanupPolicies[bucketPath] = &bucketCleanupPolicyState{
+			autoRemove: autoRemove,
+			attrValue:  attrValue,
+			lastCheck:  now,
+		}
+		efc.mu.Unlock()
+
+		return bucketPath, autoRemove, "filer", attrValue, nil
 	}
 
-	autoRemove, attrValue = autoRemoveEmptyFoldersEnabled(attrs)
+	return "", false, "", "", fmt.Errorf("bucket cleanup policy changed during read: %s", bucketPath)
+}
 
-	efc.mu.Lock()
-	if efc.bucketCleanupPolicies == nil {
-		efc.bucketCleanupPolicies = make(map[string]*bucketCleanupPolicyState)
+// isCatalogEntry reports whether the directory is an s3tables catalog record.
+func isCatalogEntry(attrs map[string][]byte) bool {
+	for key := range attrs {
+		if strings.HasPrefix(key, s3_constants.ExtS3TablesPrefix) {
+			return true
+		}
 	}
-	efc.bucketCleanupPolicies[bucketPath] = &bucketCleanupPolicyState{
-		autoRemove: autoRemove,
-		attrValue:  attrValue,
-		lastCheck:  now,
-	}
-	efc.mu.Unlock()
-
-	return bucketPath, autoRemove, "filer", attrValue, nil
+	return false
 }
 
 func autoRemoveEmptyFoldersEnabled(attrs map[string][]byte) (bool, string) {
@@ -523,6 +854,14 @@ func (efc *EmptyFolderCleaner) evictStaleCacheEntries() {
 		}
 	}
 
+	// A generation stays while a read that captured it can still return; an idle
+	// one drops after the expiry so bucket churn cannot grow the map forever.
+	for bucketPath, gen := range efc.policyGen {
+		if gen.inflight == 0 && now.Sub(gen.lastBump) > efc.cacheExpiry {
+			delete(efc.policyGen, bucketPath)
+		}
+	}
+
 	if expiredCount > 0 {
 		glog.V(3).Infof("EmptyFolderCleaner: evicted %d stale cache entries", expiredCount)
 	}
@@ -539,6 +878,8 @@ func (efc *EmptyFolderCleaner) Stop() {
 	efc.cleanupQueue.Clear()
 	efc.folderCounts = make(map[string]*folderState) // Clear cache on stop
 	efc.bucketCleanupPolicies = make(map[string]*bucketCleanupPolicyState)
+	efc.policyGen = make(map[string]*bucketPolicyGen)
+	efc.deleted, efc.deletedDropped = make(map[string]*deletedFolder), 0
 }
 
 // GetPendingCleanupCount returns the number of pending cleanup tasks (for testing)
diff --git a/weed/filer/empty_folder_cleanup/empty_folder_cleaner_test.go b/weed/filer/empty_folder_cleanup/empty_folder_cleaner_test.go
index 58e6d50e7f..bf673b630e 100644
--- a/weed/filer/empty_folder_cleanup/empty_folder_cleaner_test.go
+++ b/weed/filer/empty_folder_cleanup/empty_folder_cleaner_test.go
@@ -2,6 +2,7 @@ package empty_folder_cleanup
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
@@ -16,6 +17,22 @@ type mockFilerOps struct {
 	deleteFn      func(path util.FullPath) error
 	attrsFn       func(path util.FullPath) (map[string][]byte, error)
 	isDirKeyObjFn func(path util.FullPath) (bool, error)
+	ensureDirFn   func(path util.FullPath, attrs DirectoryAttributes) error
+	dirAttrsFn    func(path util.FullPath) (DirectoryAttributes, error)
+}
+
+func (m *mockFilerOps) EnsureDirectoryEntry(_ context.Context, p util.FullPath, attrs DirectoryAttributes) error {
+	if m.ensureDirFn == nil {
+		return nil
+	}
+	return m.ensureDirFn(p, attrs)
+}
+
+func (m *mockFilerOps) DirectoryAttributes(_ context.Context, p util.FullPath) (DirectoryAttributes, error) {
+	if m.dirAttrsFn == nil {
+		return DirectoryAttributes{Mode: 0755}, nil
+	}
+	return m.dirAttrsFn(p)
 }
 
 func (m *mockFilerOps) CountDirectoryEntries(_ context.Context, dirPath util.FullPath, _ int) (int, error) {
@@ -200,6 +217,222 @@ func TestEmptyFolderCleaner_executeCleanup_skipsMultipartUploads(t *testing.T) {
 	}
 }
 
+func TestEmptyFolderCleaner_restoreFoldersWrittenDuringDelete(t *testing.T) {
+	lockRing := lock_manager.NewLockRing(5 * time.Second)
+	lockRing.SetSnapshot([]pb.ServerAddress{"filer1:8888"}, 0)
+
+	newCleaner := func(mock *mockFilerOps) *EmptyFolderCleaner {
+		return &EmptyFolderCleaner{
+			filer:                 mock,
+			lockRing:              lockRing,
+			host:                  "filer1:8888",
+			bucketPath:            "/buckets",
+			enabled:               true,
+			maxCountCheck:         DefaultMaxCountCheck,
+			cacheExpiry:           DefaultCacheExpiry,
+			folderCounts:          make(map[string]*folderState),
+			bucketCleanupPolicies: make(map[string]*bucketCleanupPolicyState),
+			deleted:               make(map[string]*deletedFolder),
+			cleanupQueue:          NewCleanupQueue(1000, 10*time.Minute),
+			stopCh:                make(chan struct{}),
+		}
+	}
+
+	const folder = "/buckets/mybucket/folder"
+
+	t.Run("a create event for the deleted folder puts it back", func(t *testing.T) {
+		var restored []string
+		mock := &mockFilerOps{
+			countFn:     func(util.FullPath) (int, error) { return 0, nil },
+			ensureDirFn: func(p util.FullPath, _ DirectoryAttributes) error { restored = append(restored, string(p)); return nil },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "file.txt")
+
+		// nothing has been written to it, so it is only observed
+		cleaner.processCleanupQueue()
+		if len(restored) != 0 {
+			t.Fatalf("a folder nothing was written to should not be restored, got %v", restored)
+		}
+		if len(cleaner.deleted) != 1 {
+			t.Fatalf("folder should still be observed, got %d", len(cleaner.deleted))
+		}
+
+		// the write that raced the delete arrives as a create event
+		mock.countFn = func(util.FullPath) (int, error) { return 1, nil }
+		cleaner.OnCreateEvent(folder, "obj", false)
+		cleaner.processCleanupQueue()
+		if len(restored) != 1 || restored[0] != folder {
+			t.Fatalf("a folder written to while being deleted should be restored, got %v", restored)
+		}
+		if len(cleaner.deleted) != 0 {
+			t.Fatalf("a restored folder should stop being observed, got %d", len(cleaner.deleted))
+		}
+	})
+
+	t.Run("a create event elsewhere is ignored", func(t *testing.T) {
+		var restored []string
+		mock := &mockFilerOps{
+			countFn:     func(util.FullPath) (int, error) { return 0, nil },
+			ensureDirFn: func(p util.FullPath, _ DirectoryAttributes) error { restored = append(restored, string(p)); return nil },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "file.txt")
+		cleaner.OnCreateEvent("/buckets/mybucket/other", "obj", false)
+		cleaner.processCleanupQueue()
+		if len(restored) != 0 {
+			t.Fatalf("only the folder written to should be restored, got %v", restored)
+		}
+	})
+
+	t.Run("an entry that went away again is not restored", func(t *testing.T) {
+		var restored []string
+		mock := &mockFilerOps{
+			countFn:     func(util.FullPath) (int, error) { return 0, nil },
+			ensureDirFn: func(p util.FullPath, _ DirectoryAttributes) error { restored = append(restored, string(p)); return nil },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "file.txt")
+		cleaner.OnCreateEvent(folder, "obj", false)
+		cleaner.processCleanupQueue()
+		if len(restored) != 0 {
+			t.Fatalf("an empty folder should not be restored, got %v", restored)
+		}
+	})
+
+	t.Run("observation expires", func(t *testing.T) {
+		mock := &mockFilerOps{countFn: func(util.FullPath) (int, error) { return 0, nil }}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "file.txt")
+		cleaner.processCleanupQueue()
+		if len(cleaner.deleted) != 1 {
+			t.Fatalf("folder should still be observed inside the window, got %d", len(cleaner.deleted))
+		}
+
+		cleaner.deleted[folder].deletedAt = time.Now().Add(-DefaultObservationWindow - time.Second)
+		cleaner.processCleanupQueue()
+		if len(cleaner.deleted) != 0 {
+			t.Fatalf("folder should stop being observed once the window has passed, got %d", len(cleaner.deleted))
+		}
+	})
+
+	t.Run("a failed restore is retried", func(t *testing.T) {
+		attempts := 0
+		mock := &mockFilerOps{
+			countFn: func(util.FullPath) (int, error) { return 1, nil },
+			ensureDirFn: func(p util.FullPath, _ DirectoryAttributes) error {
+				attempts++
+				if attempts == 1 {
+					return errors.New("store unavailable")
+				}
+				return nil
+			},
+		}
+
+		cleaner := newCleaner(mock)
+		// deleted while empty, then written to
+		mock.countFn = func(util.FullPath) (int, error) { return 0, nil }
+		cleaner.executeCleanup(folder, "file.txt")
+		mock.countFn = func(util.FullPath) (int, error) { return 1, nil }
+		cleaner.OnCreateEvent(folder, "obj", false)
+
+		cleaner.processCleanupQueue()
+		if len(cleaner.deleted) != 1 {
+			t.Fatalf("a folder whose restore failed should be kept, got %d", len(cleaner.deleted))
+		}
+
+		cleaner.processCleanupQueue()
+		if attempts != 2 {
+			t.Fatalf("a failed restore should be retried, got %d attempts", attempts)
+		}
+		if len(cleaner.deleted) != 0 {
+			t.Fatalf("a restored folder should stop being observed, got %d", len(cleaner.deleted))
+		}
+	})
+
+	t.Run("a folder whose restore keeps failing stops being observed", func(t *testing.T) {
+		mock := &mockFilerOps{
+			countFn:     func(util.FullPath) (int, error) { return 0, nil },
+			ensureDirFn: func(util.FullPath, DirectoryAttributes) error { return errors.New("store unavailable") },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "file.txt")
+		mock.countFn = func(util.FullPath) (int, error) { return 1, nil }
+		cleaner.OnCreateEvent(folder, "obj", false)
+
+		cleaner.processCleanupQueue()
+		if len(cleaner.deleted) != 1 {
+			t.Fatalf("a folder whose restore failed should be kept, got %d", len(cleaner.deleted))
+		}
+
+		// otherwise it would be retried on every pass for the rest of the process
+		cleaner.deleted[folder].deletedAt = time.Now().Add(-DefaultObservationWindow - time.Second)
+		cleaner.processCleanupQueue()
+		if len(cleaner.deleted) != 0 {
+			t.Fatalf("the window should apply to a failing folder too, got %d", len(cleaner.deleted))
+		}
+	})
+
+	t.Run("an ancestor taken by the cascade is restored with its own attributes", func(t *testing.T) {
+		const ancestor = "/buckets/mybucket/data"
+		const nested = ancestor + "/abc"
+
+		restored := map[string]DirectoryAttributes{}
+		var order []string
+		mock := &mockFilerOps{
+			countFn: func(util.FullPath) (int, error) { return 0, nil },
+			dirAttrsFn: func(p util.FullPath) (DirectoryAttributes, error) {
+				if string(p) == ancestor {
+					return DirectoryAttributes{Mode: 0700, Uid: 4242}, nil
+				}
+				return DirectoryAttributes{Mode: 0755, Uid: 7}, nil
+			},
+			ensureDirFn: func(p util.FullPath, attrs DirectoryAttributes) error {
+				restored[string(p)] = attrs
+				order = append(order, string(p))
+				return nil
+			},
+		}
+
+		cleaner := newCleaner(mock)
+		// the cascade takes the nested folder and then its parent
+		cleaner.executeCleanup(nested, "file.txt")
+		cleaner.executeCleanup(ancestor, "abc")
+
+		// only the nested folder is written to
+		mock.countFn = func(util.FullPath) (int, error) { return 1, nil }
+		cleaner.OnCreateEvent(nested, "obj", false)
+		cleaner.processCleanupQueue()
+
+		if len(order) != 2 || order[0] != ancestor {
+			t.Fatalf("the ancestor should be rebuilt first, got %v", order)
+		}
+		if got := restored[ancestor]; got.Mode != 0700 || got.Uid != 4242 {
+			t.Errorf("ancestor should keep its own attributes, got mode %o uid %d", got.Mode, got.Uid)
+		}
+	})
+
+	t.Run("a delete that reports failure is still observed", func(t *testing.T) {
+		// the redis stores drop the folder before its parent-list member, so a failure
+		// return is not proof that the folder survived
+		mock := &mockFilerOps{
+			countFn:  func(util.FullPath) (int, error) { return 0, nil },
+			deleteFn: func(util.FullPath) error { return errors.New("partial delete") },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "file.txt")
+		if len(cleaner.deleted) != 1 {
+			t.Fatalf("a failed delete should still leave the folder observed, got %d", len(cleaner.deleted))
+		}
+	})
+}
+
 func Test_autoRemoveEmptyFoldersEnabled(t *testing.T) {
 	tests := []struct {
 		name      string
@@ -841,6 +1074,156 @@ func TestEmptyFolderCleaner_executeCleanup_bucketPolicyDisabledSkips(t *testing.
 	}
 }
 
+func TestEmptyFolderCleaner_InvalidateBucketPolicy(t *testing.T) {
+	cleaner := &EmptyFolderCleaner{
+		bucketPath: "/buckets",
+		enabled:    true,
+		bucketCleanupPolicies: map[string]*bucketCleanupPolicyState{
+			"/buckets/test": {},
+		},
+	}
+
+	cleaner.InvalidateBucketPolicy("/buckets", "test", true)
+	if _, found := cleaner.bucketCleanupPolicies["/buckets/test"]; found {
+		t.Fatal("expected cached bucket policy to be evicted")
+	}
+
+	cleaner.bucketCleanupPolicies["/buckets/test"] = &bucketCleanupPolicyState{}
+	cleaner.InvalidateBucketPolicy("/buckets/test", "dir", true)
+	cleaner.InvalidateBucketPolicy("/buckets", "test", false)
+	if _, found := cleaner.bucketCleanupPolicies["/buckets/test"]; !found {
+		t.Fatal("expected unrelated updates to keep the cached policy")
+	}
+}
+
+func TestEmptyFolderCleaner_getBucketCleanupPolicy_concurrentUpdate(t *testing.T) {
+	var cleaner *EmptyFolderCleaner
+	calls := 0
+	mock := &mockFilerOps{
+		attrsFn: func(_ util.FullPath) (map[string][]byte, error) {
+			calls++
+			if calls == 1 {
+				// a toggle lands while the stale read is in flight
+				cleaner.InvalidateBucketPolicy("/buckets", "test", true)
+				return map[string][]byte{s3_constants.ExtAllowEmptyFolders: []byte("true")}, nil
+			}
+			return map[string][]byte{s3_constants.ExtAllowEmptyFolders: []byte("false")}, nil
+		},
+	}
+
+	cleaner = &EmptyFolderCleaner{
+		filer:                 mock,
+		bucketPath:            "/buckets",
+		enabled:               true,
+		bucketCleanupPolicies: make(map[string]*bucketCleanupPolicyState),
+	}
+
+	_, autoRemove, _, attrValue, err := cleaner.getBucketCleanupPolicy(context.Background(), "/buckets/test/folder")
+	if err != nil {
+		t.Fatalf("getBucketCleanupPolicy: %v", err)
+	}
+	if !autoRemove || attrValue != "false" {
+		t.Fatalf("expected the post-update policy autoRemove=true attr=false, got autoRemove=%v attr=%q", autoRemove, attrValue)
+	}
+	if calls < 2 {
+		t.Fatalf("expected the stale load to be retried, got %d attribute reads", calls)
+	}
+	if cached := cleaner.bucketCleanupPolicies["/buckets/test"]; cached == nil || cached.attrValue != "false" {
+		t.Fatalf("expected the fresh policy to be cached, got %+v", cached)
+	}
+}
+
+func TestEmptyFolderCleaner_getBucketCleanupPolicy_evictionKeepsInflightRead(t *testing.T) {
+	var cleaner *EmptyFolderCleaner
+	started := make(chan struct{})
+	release := make(chan struct{})
+	calls := 0
+	mock := &mockFilerOps{
+		attrsFn: func(_ util.FullPath) (map[string][]byte, error) {
+			calls++
+			if calls == 1 {
+				close(started)
+				<-release
+				return map[string][]byte{s3_constants.ExtAllowEmptyFolders: []byte("true")}, nil
+			}
+			return map[string][]byte{s3_constants.ExtAllowEmptyFolders: []byte("false")}, nil
+		},
+	}
+
+	cleaner = &EmptyFolderCleaner{
+		filer:                 mock,
+		bucketPath:            "/buckets",
+		enabled:               true,
+		cacheExpiry:           time.Minute,
+		folderCounts:          make(map[string]*folderState),
+		bucketCleanupPolicies: make(map[string]*bucketCleanupPolicyState),
+		policyGen:             make(map[string]*bucketPolicyGen),
+		cleanupQueue:          NewCleanupQueue(1000, time.Minute),
+	}
+
+	go func() {
+		<-started
+		cleaner.InvalidateBucketPolicy("/buckets", "test", true)
+		cleaner.mu.Lock()
+		cleaner.policyGen["/buckets/test"].lastBump = time.Now().Add(-time.Hour)
+		cleaner.mu.Unlock()
+		cleaner.evictStaleCacheEntries()
+		close(release)
+	}()
+
+	_, autoRemove, _, attrValue, err := cleaner.getBucketCleanupPolicy(context.Background(), "/buckets/test/folder")
+	if err != nil {
+		t.Fatalf("getBucketCleanupPolicy: %v", err)
+	}
+	if !autoRemove || attrValue != "false" {
+		t.Fatalf("expected the stalled read to be discarded, got autoRemove=%v attr=%q", autoRemove, attrValue)
+	}
+	if calls < 2 {
+		t.Fatalf("expected the stale load to be retried, got %d attribute reads", calls)
+	}
+}
+
+func TestEmptyFolderCleaner_executeCleanup_policyFailureRequeues(t *testing.T) {
+	lockRing := lock_manager.NewLockRing(5 * time.Second)
+	lockRing.SetSnapshot([]pb.ServerAddress{"filer1:8888"}, 0)
+
+	mock := &mockFilerOps{
+		attrsFn: func(_ util.FullPath) (map[string][]byte, error) {
+			return nil, errors.New("attrs unavailable")
+		},
+	}
+
+	cleaner := &EmptyFolderCleaner{
+		filer:                 mock,
+		lockRing:              lockRing,
+		host:                  "filer1:8888",
+		bucketPath:            "/buckets",
+		enabled:               true,
+		folderCounts:          make(map[string]*folderState),
+		bucketCleanupPolicies: make(map[string]*bucketCleanupPolicyState),
+		cleanupQueue:          NewCleanupQueue(1000, time.Millisecond),
+		stopCh:                make(chan struct{}),
+	}
+
+	folder := "/buckets/test/folder"
+	for i := 0; i < DefaultMaxPolicyFailures; i++ {
+		cleaner.executeCleanup(folder, "triggered_item")
+		popped, _, ok := cleaner.cleanupQueue.Pop()
+		if !ok || popped != folder {
+			t.Fatalf("failure %d of %d should requeue the folder", i+1, DefaultMaxPolicyFailures)
+		}
+	}
+
+	cleaner.executeCleanup(folder, "triggered_item")
+
+	if got := cleaner.folderCounts[folder].policyFailures; got != DefaultMaxPolicyFailures+1 {
+		t.Fatalf("policyFailures = %d, want %d", got, DefaultMaxPolicyFailures+1)
+	}
+	if got := cleaner.cleanupQueue.Len(); got != 0 {
+		t.Fatalf("expected retries to stop after %d failures, got %d queued", DefaultMaxPolicyFailures, got)
+	}
+}
+
 func TestEmptyFolderCleaner_executeCleanup_directoryMarker(t *testing.T) {
 	testCases := []struct {
 		name           string
@@ -907,3 +1290,207 @@ func TestEmptyFolderCleaner_executeCleanup_directoryMarker(t *testing.T) {
 		})
 	}
 }
+
+func TestEmptyFolderCleaner_OnCreateEvent_cancelsCleanupForRecreatedDirectory(t *testing.T) {
+	lockRing := lock_manager.NewLockRing(5 * time.Second)
+	lockRing.SetSnapshot([]pb.ServerAddress{"filer1:8888"}, 0)
+
+	cleaner := &EmptyFolderCleaner{
+		filer:          &mockFilerOps{},
+		lockRing:       lockRing,
+		host:           "filer1:8888",
+		bucketPath:     "/buckets",
+		enabled:        true,
+		folderCounts:   make(map[string]*folderState),
+		deleted:        make(map[string]*deletedFolder),
+		cleanupQueue:   NewCleanupQueue(1000, time.Minute),
+		maxCountCheck:  1000,
+		cacheExpiry:    time.Minute,
+		processorSleep: time.Second,
+		stopCh:         make(chan struct{}),
+	}
+
+	// Dropping the table queues the folder its children were removed from, then a
+	// rename puts a new table back under the same name.
+	cleaner.OnDeleteEvent("/buckets/warehouse/pedsnet/person", "metadata", true, time.Now())
+	if cleaner.GetPendingCleanupCount() != 1 {
+		t.Fatalf("expected the emptied folder to be queued, got %d", cleaner.GetPendingCleanupCount())
+	}
+
+	cleaner.OnCreateEvent("/buckets/warehouse/pedsnet", "person", true)
+	if cleaner.GetPendingCleanupCount() != 0 {
+		t.Fatalf("expected the recreated folder to leave the queue, got %d", cleaner.GetPendingCleanupCount())
+	}
+}
+
+func TestEmptyFolderCleaner_executeCleanup_skipsCatalogEntry(t *testing.T) {
+	lockRing := lock_manager.NewLockRing(5 * time.Second)
+	lockRing.SetSnapshot([]pb.ServerAddress{"filer1:8888"}, 0)
+
+	const namespace = "/buckets/warehouse/pedsnet"
+	const table = namespace + "/person"
+
+	var deleted []string
+	mock := &mockFilerOps{
+		countFn: func(_ util.FullPath) (int, error) {
+			return 0, nil
+		},
+		deleteFn: func(path util.FullPath) error {
+			deleted = append(deleted, string(path))
+			return nil
+		},
+		attrsFn: func(path util.FullPath) (map[string][]byte, error) {
+			if path == namespace || path == table {
+				return map[string][]byte{s3_constants.ExtS3TablesPrefix + "metadata": []byte("{}")}, nil
+			}
+			return nil, nil
+		},
+	}
+
+	cleaner := &EmptyFolderCleaner{
+		filer:          mock,
+		lockRing:       lockRing,
+		host:           "filer1:8888",
+		bucketPath:     "/buckets",
+		enabled:        true,
+		folderCounts:   make(map[string]*folderState),
+		cleanupQueue:   NewCleanupQueue(1000, time.Minute),
+		maxCountCheck:  1000,
+		cacheExpiry:    time.Minute,
+		processorSleep: time.Second,
+		stopCh:         make(chan struct{}),
+	}
+
+	// The dropped table left its metadata folder empty; the cascade up from it must
+	// stop at the table the rename put back, and at the namespace above it.
+	cleaner.executeCleanup(table+"/metadata", "v2.metadata.json")
+
+	if len(deleted) != 1 || deleted[0] != table+"/metadata" {
+		t.Fatalf("expected only %s to be deleted, got %v", table+"/metadata", deleted)
+	}
+}
+
+func TestEmptyFolderCleaner_restoreIfWrittenTo(t *testing.T) {
+	lockRing := lock_manager.NewLockRing(5 * time.Second)
+	lockRing.SetSnapshot([]pb.ServerAddress{"filer1:8888"}, 0)
+
+	newCleaner := func(mock *mockFilerOps) *EmptyFolderCleaner {
+		return &EmptyFolderCleaner{
+			filer:                 mock,
+			lockRing:              lockRing,
+			host:                  "filer1:8888",
+			bucketPath:            "/buckets",
+			enabled:               true,
+			maxCountCheck:         DefaultMaxCountCheck,
+			cacheExpiry:           DefaultCacheExpiry,
+			folderCounts:          make(map[string]*folderState),
+			bucketCleanupPolicies: make(map[string]*bucketCleanupPolicyState),
+			deleted:               make(map[string]*deletedFolder),
+			cleanupQueue:          NewCleanupQueue(1000, 10*time.Minute),
+			stopCh:                make(chan struct{}),
+		}
+	}
+
+	const folder = "/buckets/mybucket/a/b"
+	const parent = "/buckets/mybucket/a"
+
+	t.Run("an entry that landed during the delete is restored without waiting for its event", func(t *testing.T) {
+		counts := map[string]int{}
+		var deleted, restored []string
+		mock := &mockFilerOps{
+			countFn: func(p util.FullPath) (int, error) { return counts[string(p)], nil },
+			deleteFn: func(p util.FullPath) error {
+				deleted = append(deleted, string(p))
+				if string(p) == folder {
+					// the racing write lands between the delete's own emptiness
+					// check and the removal of the folder entry
+					counts[folder] = 1
+				}
+				return nil
+			},
+			ensureDirFn: func(p util.FullPath, _ DirectoryAttributes) error { restored = append(restored, string(p)); return nil },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "obj")
+
+		if len(restored) != 1 || restored[0] != folder {
+			t.Fatalf("folder written to during the delete should be restored, got %v", restored)
+		}
+		if len(deleted) != 1 || deleted[0] != folder {
+			t.Fatalf("a restored folder leaves the parent non-empty, so it must not cascade, got %v", deleted)
+		}
+		if len(cleaner.deleted) != 0 {
+			t.Fatalf("a restored folder should stop being observed, got %d", len(cleaner.deleted))
+		}
+	})
+
+	t.Run("a folder still empty after the delete is not restored and the parent is cascaded", func(t *testing.T) {
+		var deleted, restored []string
+		mock := &mockFilerOps{
+			countFn:     func(util.FullPath) (int, error) { return 0, nil },
+			deleteFn:    func(p util.FullPath) error { deleted = append(deleted, string(p)); return nil },
+			ensureDirFn: func(p util.FullPath, _ DirectoryAttributes) error { restored = append(restored, string(p)); return nil },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "obj")
+
+		if len(restored) != 0 {
+			t.Fatalf("an empty folder should not be restored, got %v", restored)
+		}
+		if len(deleted) != 2 || deleted[0] != folder || deleted[1] != parent {
+			t.Fatalf("the parent should still be cascaded, got %v", deleted)
+		}
+	})
+
+	t.Run("a restore that fails is left marked for the deferred pass", func(t *testing.T) {
+		counts := map[string]int{}
+		mock := &mockFilerOps{
+			countFn: func(p util.FullPath) (int, error) { return counts[string(p)], nil },
+			deleteFn: func(p util.FullPath) error {
+				if string(p) == folder {
+					counts[folder] = 1
+				}
+				return nil
+			},
+			ensureDirFn: func(util.FullPath, DirectoryAttributes) error { return errors.New("store unavailable") },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "obj")
+
+		observed, found := cleaner.deleted[folder]
+		if !found {
+			t.Fatal("a folder whose restore failed must stay under observation")
+		}
+		if !observed.writtenTo {
+			t.Fatal("a folder seen to hold an entry must be marked, or the deferred pass skips it")
+		}
+	})
+
+	t.Run("a re-check that fails leaves the folder to the event path", func(t *testing.T) {
+		var restored []string
+		deletedFolder := false
+		mock := &mockFilerOps{
+			countFn: func(util.FullPath) (int, error) {
+				if deletedFolder {
+					return 0, errors.New("store unavailable")
+				}
+				return 0, nil
+			},
+			deleteFn:    func(p util.FullPath) error { deletedFolder = string(p) == folder; return nil },
+			ensureDirFn: func(p util.FullPath, _ DirectoryAttributes) error { restored = append(restored, string(p)); return nil },
+		}
+
+		cleaner := newCleaner(mock)
+		cleaner.executeCleanup(folder, "obj")
+
+		if len(restored) != 0 {
+			t.Fatalf("a failed re-check should not restore, got %v", restored)
+		}
+		if _, found := cleaner.deleted[folder]; !found {
+			t.Fatal("a folder whose re-check failed must stay under observation")
+		}
+	})
+}
diff --git a/weed/filer/entry.go b/weed/filer/entry.go
index 8a80c74625..796674e062 100644
--- a/weed/filer/entry.go
+++ b/weed/filer/entry.go
@@ -181,6 +181,16 @@ func (entry *Entry) isS3Entry() bool {
 	return false
 }
 
+// ApplyStorageTtl stamps the TTL the entry's data was placed with. Remote
+// entries never expire locally; the remote storage owns their lifecycle.
+func (entry *Entry) ApplyStorageTtl(ttlSec int32) {
+	if entry.Remote != nil {
+		ttlSec = 0
+	}
+	entry.TtlSec = ttlSec
+	entry.ApplyS3ExpiryMetadata()
+}
+
 func (entry *Entry) ApplyS3ExpiryMetadata() {
 	if entry.TtlSec == 0 {
 		return
diff --git a/weed/filer/filechunk_group.go b/weed/filer/filechunk_group.go
index 55a4ab4eb9..0c6f943742 100644
--- a/weed/filer/filechunk_group.go
+++ b/weed/filer/filechunk_group.go
@@ -18,6 +18,13 @@ type ChunkGroup struct {
 	sectionsLock      sync.RWMutex
 	readerCache       *ReaderCache
 	concurrentReaders int
+	// cacheInvalidator lets manifest resolution drop stale volume locations, as ReaderCache does for chunk reads
+	cacheInvalidator CacheInvalidator
+	// manifestCache caches resolved chunk manifest bytes across repeated opens
+	// for the same mount. nil for non-mount callers (no caching).
+	manifestCache *ChunkManifestCache
+	// resolveErr records a manifest resolution failure, guarded by sectionsLock
+	resolveErr error
 }
 
 // NewChunkGroup creates a ChunkGroup with configurable concurrency.
@@ -26,7 +33,7 @@ type ChunkGroup struct {
 // - Read-ahead prefetch parallelism
 // - Number of concurrent section reads for large files
 // If concurrentReaders <= 0, defaults to 16.
-func NewChunkGroup(lookupFn wdclient.LookupFileIdFunctionType, chunkCache chunk_cache.ChunkCache, chunks []*filer_pb.FileChunk, concurrentReaders int) (*ChunkGroup, error) {
+func NewChunkGroup(lookupFn wdclient.LookupFileIdFunctionType, chunkCache chunk_cache.ChunkCache, chunks []*filer_pb.FileChunk, concurrentReaders int, cacheInvalidator CacheInvalidator, manifestCache *ChunkManifestCache, budgets ...*ReaderCacheBudget) (*ChunkGroup, error) {
 	if concurrentReaders <= 0 {
 		concurrentReaders = 16
 	}
@@ -41,8 +48,10 @@ func NewChunkGroup(lookupFn wdclient.LookupFileIdFunctionType, chunkCache chunk_
 	group := &ChunkGroup{
 		lookupFn:          lookupFn,
 		sections:          make(map[SectionIndex]*FileChunkSection),
-		readerCache:       NewReaderCache(readerCacheLimit, chunkCache, lookupFn, nil),
+		readerCache:       NewReaderCache(readerCacheLimit, chunkCache, lookupFn, cacheInvalidator, budgets...),
 		concurrentReaders: concurrentReaders,
+		cacheInvalidator:  cacheInvalidator,
+		manifestCache:     manifestCache,
 	}
 
 	err := group.SetChunks(chunks)
@@ -88,6 +97,10 @@ func (group *ChunkGroup) ReadDataAt(ctx context.Context, fileSize int64, buff []
 	group.sectionsLock.RLock()
 	defer group.sectionsLock.RUnlock()
 
+	if group.resolveErr != nil {
+		return 0, 0, group.resolveErr
+	}
+
 	sectionIndexStart, sectionIndexStop := SectionIndex(offset/SectionSize), SectionIndex((offset+int64(len(buff)))/SectionSize)
 	numSections := int(sectionIndexStop - sectionIndexStart + 1)
 
@@ -227,8 +240,9 @@ func (group *ChunkGroup) SetChunks(chunks []*filer_pb.FileChunk) error {
 			continue
 		}
 
-		resolvedChunks, err := ResolveOneChunkManifest(context.Background(), group.lookupFn, chunk)
+		resolvedChunks, err := resolveOneChunkManifest(context.Background(), group.lookupFn, chunk, group.cacheInvalidator, group.manifestCache, nil)
 		if err != nil {
+			group.resolveErr = err
 			return err
 		}
 
@@ -250,6 +264,7 @@ func (group *ChunkGroup) SetChunks(chunks []*filer_pb.FileChunk) error {
 	}
 
 	group.sections = sections
+	group.resolveErr = nil
 	return nil
 }
 
@@ -259,43 +274,58 @@ const (
 	// SEEK_HOLE uint32 = 4 // seek to next hole after the offset
 )
 
-// FIXME: needa tests
-func (group *ChunkGroup) SearchChunks(ctx context.Context, offset, fileSize int64, whence uint32) (found bool, out int64) {
+func (group *ChunkGroup) SearchChunks(ctx context.Context, offset, fileSize int64, whence uint32) (found bool, out int64, err error) {
 	group.sectionsLock.RLock()
 	defer group.sectionsLock.RUnlock()
 
-	return group.doSearchChunks(ctx, offset, fileSize, whence)
+	// the section map is unreliable after a failed manifest resolution
+	if group.resolveErr != nil {
+		return false, 0, group.resolveErr
+	}
+
+	found, out = group.doSearchChunks(ctx, offset, fileSize, whence)
+	return found, out, nil
 }
 
 func (group *ChunkGroup) doSearchChunks(ctx context.Context, offset, fileSize int64, whence uint32) (found bool, out int64) {
 
 	sectionIndex, maxSectionIndex := SectionIndex(offset/SectionSize), SectionIndex(fileSize/SectionSize)
-	if whence == SEEK_DATA {
-		for si := sectionIndex; si < maxSectionIndex+1; si++ {
-			section, foundSection := group.sections[si]
+	for si := sectionIndex; si <= maxSectionIndex; si++ {
+		sectionStart, sectionStop := sectionBounds(si, fileSize)
+		sectionStart = max(offset, sectionStart)
+		if sectionStart >= sectionStop {
+			continue
+		}
+
+		section, foundSection := group.sections[si]
+		if whence == SEEK_DATA {
 			if !foundSection {
 				continue
 			}
-			sectionStart := section.DataStartOffset(ctx, group, offset, fileSize)
-			if sectionStart == -1 {
-				continue
+			dataStart := section.DataStartOffset(ctx, group, sectionStart, fileSize)
+			if dataStart >= sectionStart && dataStart < sectionStop {
+				return true, dataStart
 			}
+			continue
+		}
+
+		// whence == SEEK_HOLE
+		if !foundSection {
 			return true, sectionStart
 		}
-		return false, 0
-	} else {
-		// whence == SEEK_HOLE
-		for si := sectionIndex; si < maxSectionIndex; si++ {
-			section, foundSection := group.sections[si]
-			if !foundSection {
-				return true, offset
-			}
-			holeStart := section.NextStopOffset(ctx, group, offset, fileSize)
-			if holeStart%SectionSize == 0 {
-				continue
-			}
+		holeStart := section.NextStopOffset(ctx, group, sectionStart, fileSize)
+		if holeStart < sectionStop {
 			return true, holeStart
 		}
-		return true, fileSize
 	}
+
+	if whence == SEEK_DATA {
+		return false, 0
+	}
+	return true, fileSize
+}
+
+func (group *ChunkGroup) Close() error {
+	group.readerCache.destroy()
+	return nil
 }
diff --git a/weed/filer/filechunk_group_test.go b/weed/filer/filechunk_group_test.go
index a7103ce2ed..396f52a60a 100644
--- a/weed/filer/filechunk_group_test.go
+++ b/weed/filer/filechunk_group_test.go
@@ -4,9 +4,11 @@ import (
 	"context"
 	"errors"
 	"io"
+	"math"
 	"testing"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -194,7 +196,7 @@ func TestChunkGroup_SearchChunks_Cancellation(t *testing.T) {
 		whence := uint32(3) // SEEK_DATA
 
 		// Call SearchChunks with cancelled context
-		found, resultOffset := group.SearchChunks(ctx, offset, fileSize, whence)
+		found, resultOffset, _ := group.SearchChunks(ctx, offset, fileSize, whence)
 
 		// For an empty ChunkGroup, SearchChunks should complete quickly
 		// The main goal is to verify the context parameter is properly threaded through
@@ -223,7 +225,7 @@ func TestChunkGroup_SearchChunks_Cancellation(t *testing.T) {
 		whence := uint32(3) // SEEK_DATA
 
 		// Call SearchChunks - should complete quickly for empty group
-		found, resultOffset := group.SearchChunks(ctx, offset, fileSize, whence)
+		found, resultOffset, _ := group.SearchChunks(ctx, offset, fileSize, whence)
 
 		// Verify reasonable behavior
 		assert.False(t, found, "should not find data in empty chunk group")
@@ -231,32 +233,235 @@ func TestChunkGroup_SearchChunks_Cancellation(t *testing.T) {
 	})
 }
 
-func TestChunkGroup_doSearchChunks(t *testing.T) {
-	type fields struct {
-		sections map[SectionIndex]*FileChunkSection
-	}
+func TestChunkGroup_SearchChunks(t *testing.T) {
+	const seekHole uint32 = 4
+
 	type args struct {
 		offset   int64
 		fileSize int64
 		whence   uint32
 	}
 	tests := []struct {
-		name      string
-		fields    fields
-		args      args
-		wantFound bool
-		wantOut   int64
+		name       string
+		chunks     []*filer_pb.FileChunk
+		args       args
+		wantFound  bool
+		wantOffset int64
 	}{
-		// TODO: Add test cases.
+		{
+			name: "SEEK_DATA starts at the first data range after a hole",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 0, fileSize: 500, whence: SEEK_DATA},
+			wantFound:  true,
+			wantOffset: 100,
+		},
+		{
+			name: "SEEK_DATA preserves an offset inside a data range",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 150, fileSize: 500, whence: SEEK_DATA},
+			wantFound:  true,
+			wantOffset: 150,
+		},
+		{
+			name: "SEEK_DATA crosses a hole between data ranges",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 200, fileSize: 500, whence: SEEK_DATA},
+			wantFound:  true,
+			wantOffset: 300,
+		},
+		{
+			name: "SEEK_DATA returns no match after the final data range",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 400, fileSize: 500, whence: SEEK_DATA},
+			wantFound:  false,
+			wantOffset: 0,
+		},
+		{
+			name: "SEEK_HOLE starts at the sparse prefix",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 0, fileSize: 500, whence: seekHole},
+			wantFound:  true,
+			wantOffset: 0,
+		},
+		{
+			name: "SEEK_HOLE finds the transition after data",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 150, fileSize: 500, whence: seekHole},
+			wantFound:  true,
+			wantOffset: 200,
+		},
+		{
+			name: "SEEK_HOLE preserves an offset inside a hole",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 250, fileSize: 500, whence: seekHole},
+			wantFound:  true,
+			wantOffset: 250,
+		},
+		{
+			name: "SEEK_HOLE returns the implicit trailing hole",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-1", Offset: 100, Size: 100},
+				{FileId: "data-2", Offset: 300, Size: 100},
+			},
+			args:       args{offset: 400, fileSize: 500, whence: seekHole},
+			wantFound:  true,
+			wantOffset: 400,
+		},
+		{
+			name:       "SEEK_DATA at EOF has no match",
+			chunks:     []*filer_pb.FileChunk{{FileId: "data", Offset: 0, Size: 500}},
+			args:       args{offset: 500, fileSize: 500, whence: SEEK_DATA},
+			wantFound:  false,
+			wantOffset: 0,
+		},
+		{
+			name:       "SEEK_HOLE at EOF returns EOF",
+			chunks:     []*filer_pb.FileChunk{{FileId: "data", Offset: 0, Size: 500}},
+			args:       args{offset: 500, fileSize: 500, whence: seekHole},
+			wantFound:  true,
+			wantOffset: 500,
+		},
+		{
+			name:       "empty file has neither data nor a non-EOF hole",
+			chunks:     nil,
+			args:       args{offset: 0, fileSize: 0, whence: SEEK_DATA},
+			wantFound:  false,
+			wantOffset: 0,
+		},
+		{
+			name:       "empty file reports EOF for SEEK_HOLE",
+			chunks:     nil,
+			args:       args{offset: 0, fileSize: 0, whence: seekHole},
+			wantFound:  true,
+			wantOffset: 0,
+		},
+		{
+			name: "SEEK_DATA crosses a section boundary",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-0", Offset: 0, Size: 16},
+				{FileId: "data-0-tail", Offset: SectionSize - 16, Size: 16},
+				{FileId: "data-1", Offset: SectionSize + 16, Size: 16},
+			},
+			args:       args{offset: 16, fileSize: 2*SectionSize + 32, whence: SEEK_DATA},
+			wantFound:  true,
+			wantOffset: SectionSize - 16,
+		},
+		{
+			name: "SEEK_DATA finds data after a section boundary hole",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-0", Offset: 0, Size: 16},
+				{FileId: "data-0-tail", Offset: SectionSize - 16, Size: 16},
+				{FileId: "data-1", Offset: SectionSize + 16, Size: 16},
+			},
+			args:       args{offset: SectionSize, fileSize: 2*SectionSize + 32, whence: SEEK_DATA},
+			wantFound:  true,
+			wantOffset: SectionSize + 16,
+		},
+		{
+			name: "SEEK_HOLE finds a hole at a section boundary",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-0", Offset: 0, Size: 16},
+				{FileId: "data-0-tail", Offset: SectionSize - 16, Size: 16},
+				{FileId: "data-1", Offset: SectionSize + 16, Size: 16},
+			},
+			args:       args{offset: SectionSize - 16, fileSize: 2*SectionSize + 32, whence: seekHole},
+			wantFound:  true,
+			wantOffset: SectionSize,
+		},
+		{
+			name: "SEEK_HOLE finds a missing section",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "data-0", Offset: 0, Size: 16},
+				{FileId: "data-0-tail", Offset: SectionSize - 16, Size: 16},
+				{FileId: "data-1", Offset: SectionSize + 16, Size: 16},
+			},
+			args:       args{offset: 2 * SectionSize, fileSize: 2*SectionSize + 32, whence: seekHole},
+			wantFound:  true,
+			wantOffset: 2 * SectionSize,
+		},
+		{
+			name: "SEEK_DATA finds data in the final section at MaxInt64 file size",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "final-data", Offset: math.MaxInt64 - 1, Size: 1},
+			},
+			args:       args{offset: math.MaxInt64 - 1, fileSize: math.MaxInt64, whence: SEEK_DATA},
+			wantFound:  true,
+			wantOffset: math.MaxInt64 - 1,
+		},
+		{
+			name: "SEEK_HOLE finds the final section hole at MaxInt64 file size",
+			chunks: []*filer_pb.FileChunk{
+				{FileId: "final-data", Offset: math.MaxInt64 - 2, Size: 1},
+			},
+			args:       args{offset: math.MaxInt64 - 2, fileSize: math.MaxInt64, whence: seekHole},
+			wantFound:  true,
+			wantOffset: math.MaxInt64 - 1,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			group := &ChunkGroup{
-				sections: tt.fields.sections,
+			group, err := NewChunkGroup(nil, nil, tt.chunks, 1, nil, nil)
+			if !assert.NoError(t, err) {
+				return
 			}
-			gotFound, gotOut := group.doSearchChunks(context.Background(), tt.args.offset, tt.args.fileSize, tt.args.whence)
-			assert.Equalf(t, tt.wantFound, gotFound, "doSearchChunks(%v, %v, %v)", tt.args.offset, tt.args.fileSize, tt.args.whence)
-			assert.Equalf(t, tt.wantOut, gotOut, "doSearchChunks(%v, %v, %v)", tt.args.offset, tt.args.fileSize, tt.args.whence)
+
+			gotFound, gotOffset, err := group.SearchChunks(context.Background(), tt.args.offset, tt.args.fileSize, tt.args.whence)
+			assert.NoError(t, err)
+			assert.Equalf(t, tt.wantFound, gotFound, "SearchChunks(%v, %v, %v) found", tt.args.offset, tt.args.fileSize, tt.args.whence)
+			assert.Equalf(t, tt.wantOffset, gotOffset, "SearchChunks(%v, %v, %v) offset", tt.args.offset, tt.args.fileSize, tt.args.whence)
 		})
 	}
 }
+
+// ReadDataAt must return an error when chunk manifest resolution fails, instead of zero-filling.
+func TestChunkGroup_ReadDataAt_ManifestResolveFailure(t *testing.T) {
+	lookupErr := errors.New("lookup failed")
+	lookupFn := func(ctx context.Context, fileId string) ([]string, error) {
+		return nil, lookupErr
+	}
+
+	chunks := []*filer_pb.FileChunk{
+		{FileId: "1,1679011dc64abd40", IsChunkManifest: true, Offset: 0, Size: 1 << 20},
+	}
+
+	group, err := NewChunkGroup(lookupFn, nil, chunks, 1, nil, nil)
+	assert.Error(t, err, "manifest resolution should fail")
+
+	buff := make([]byte, 16)
+	n, _, readErr := group.ReadDataAt(context.Background(), 1<<20, buff, 0)
+	assert.ErrorIs(t, readErr, lookupErr)
+	assert.Equal(t, 0, n)
+
+	for _, whence := range []uint32{SEEK_DATA, 4 /* SEEK_HOLE */} {
+		found, _, seekErr := group.SearchChunks(context.Background(), 0, 1<<20, whence)
+		assert.ErrorIs(t, seekErr, lookupErr, "whence %d", whence)
+		assert.False(t, found, "whence %d", whence)
+	}
+
+	err = group.SetChunks([]*filer_pb.FileChunk{
+		{FileId: "2,data", Offset: 0, Size: 16},
+	})
+	assert.NoError(t, err)
+	assert.NoError(t, group.resolveErr)
+}
diff --git a/weed/filer/filechunk_manifest.go b/weed/filer/filechunk_manifest.go
index 0b4c5fc6ec..3eacae5cdf 100644
--- a/weed/filer/filechunk_manifest.go
+++ b/weed/filer/filechunk_manifest.go
@@ -3,6 +3,7 @@ package filer
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -15,20 +16,25 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
-const (
-	ManifestBatch = 10000
-)
-
 var bytesBufferPool = sync.Pool{
 	New: func() interface{} {
 		return new(bytes.Buffer)
 	},
 }
 
+// Keep Manifest reads bounded across all recursion levels of one resolution.
+const maxChunkManifestResolveWorkers = 4
+
+// Size of the job queue buffer. Large enough that submission does not block
+// under normal chunk counts, so a promptly-failing manifest is always queued
+// and can cancel stalled sibling reads once a worker picks it up.
+const chunkManifestResolveJobBufferSize = 128
+
 func HasChunkManifest(chunks []*filer_pb.FileChunk) bool {
 	for _, chunk := range chunks {
 		if chunk.IsChunkManifest {
@@ -49,27 +55,241 @@ func SeparateManifestChunks(chunks []*filer_pb.FileChunk) (manifestChunks, nonMa
 	return
 }
 
-func ResolveChunkManifest(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk, startOffset, stopOffset int64) (dataChunks, manifestChunks []*filer_pb.FileChunk, manifestResolveErr error) {
-	// TODO maybe parallel this
-	for _, chunk := range chunks {
+func ResolveChunkManifest(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk, startOffset, stopOffset int64, invalidator CacheInvalidator) (dataChunks, manifestChunks []*filer_pb.FileChunk, manifestResolveErr error) {
+	resolver := newChunkManifestResolver(ctx, lookupFileIdFn, invalidator, nil)
+	defer resolver.close()
+	return resolver.resolve(chunks, startOffset, stopOffset)
+}
 
+// ResolveChunkManifestWithFilerJwt is ResolveChunkManifest that signs proxied
+// manifest downloads with filerJwtFn instead of the process-wide filer read
+// key, for readers carrying per-source credentials.
+func ResolveChunkManifestWithFilerJwt(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, filerJwtFn security.FilerJwtProvider, chunks []*filer_pb.FileChunk, startOffset, stopOffset int64, invalidator CacheInvalidator) (dataChunks, manifestChunks []*filer_pb.FileChunk, manifestResolveErr error) {
+	resolver := newChunkManifestResolver(ctx, lookupFileIdFn, invalidator, filerJwtFn)
+	defer resolver.close()
+	return resolver.resolve(chunks, startOffset, stopOffset)
+}
+
+type chunkManifestResolveJob struct {
+	chunk       *filer_pb.FileChunk
+	result      *chunkManifestResolveResult
+	done        *sync.WaitGroup
+	batchCtx    context.Context
+	batchCancel context.CancelFunc
+	batchOnce   *sync.Once
+}
+
+type chunkManifestResolveResult struct {
+	chunks         []*filer_pb.FileChunk
+	err            error
+	internalCancel bool
+}
+
+type chunkManifestResolver struct {
+	ctx            context.Context
+	parentCtx      context.Context
+	cancel         context.CancelFunc
+	lookupFileIdFn wdclient.LookupFileIdFunctionType
+	invalidator    CacheInvalidator
+	filerJwtFn     security.FilerJwtProvider
+	jobs           chan chunkManifestResolveJob
+	overflowSem    chan struct{}
+	workers        sync.WaitGroup
+	startOnce      sync.Once
+	started        bool
+}
+
+func newChunkManifestResolver(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, invalidator CacheInvalidator, filerJwtFn security.FilerJwtProvider) *chunkManifestResolver {
+	workCtx, cancel := context.WithCancel(ctx)
+	resolver := &chunkManifestResolver{
+		ctx:            workCtx,
+		parentCtx:      ctx,
+		cancel:         cancel,
+		lookupFileIdFn: lookupFileIdFn,
+		invalidator:    invalidator,
+		filerJwtFn:     filerJwtFn,
+		jobs:           make(chan chunkManifestResolveJob, chunkManifestResolveJobBufferSize),
+		overflowSem:    make(chan struct{}, maxChunkManifestResolveWorkers),
+	}
+	return resolver
+}
+
+func (r *chunkManifestResolver) executeJob(job chunkManifestResolveJob) {
+	job.result.chunks, job.result.err = resolveOneChunkManifest(job.batchCtx, r.lookupFileIdFn, job.chunk, r.invalidator, nil, r.filerJwtFn)
+	if job.result.err != nil && r.parentCtx.Err() == nil {
+		if job.batchCtx.Err() != nil && errors.Is(job.result.err, context.Canceled) {
+			job.result.internalCancel = true
+		} else if job.batchCtx.Err() == nil {
+			job.batchOnce.Do(job.batchCancel)
+		}
+	}
+	job.done.Done()
+}
+
+func (r *chunkManifestResolver) executeOverflowJob(job chunkManifestResolveJob) {
+	select {
+	case r.overflowSem <- struct{}{}:
+		defer func() { <-r.overflowSem }()
+		r.executeJob(job)
+	case <-job.batchCtx.Done():
+		if job.result.err == nil {
+			job.result.err = job.batchCtx.Err()
+			job.result.internalCancel = r.parentCtx.Err() == nil && job.result.err != nil
+		}
+		job.done.Done()
+	case <-r.ctx.Done():
+		if job.result.err == nil {
+			job.result.err = r.ctx.Err()
+			job.result.internalCancel = r.parentCtx.Err() == nil && job.result.err != nil
+		}
+		job.done.Done()
+	}
+}
+
+func (r *chunkManifestResolver) worker() {
+	defer r.workers.Done()
+	for job := range r.jobs {
+		r.executeJob(job)
+	}
+}
+
+func (r *chunkManifestResolver) close() {
+	r.cancel()
+	close(r.jobs)
+	if r.started {
+		r.workers.Wait()
+	}
+}
+
+func (r *chunkManifestResolver) submit(job chunkManifestResolveJob) bool {
+	r.startOnce.Do(func() {
+		r.workers.Add(maxChunkManifestResolveWorkers)
+		for i := 0; i < maxChunkManifestResolveWorkers; i++ {
+			go r.worker()
+		}
+		r.started = true
+	})
+	select {
+	case r.jobs <- job:
+		return true
+	case <-r.ctx.Done():
+		return false
+	case <-job.batchCtx.Done():
+		// Batch was cancelled by a sibling failure; don't queue this job.
+		// Set the result so the caller doesn't overwrite it; the caller
+		// owns the WaitGroup decrement.
+		job.result.err = job.batchCtx.Err()
+		job.result.internalCancel = r.parentCtx.Err() == nil && job.result.err != nil
+		return false
+	default:
+		// Buffer is full (exceedingly rare: more than chunkManifestResolveJobBufferSize
+		// in-range manifests at one level). Run the job in a bounded overflow goroutine
+		// so a promptly-failing manifest can still cancel the batch without waiting for
+		// a worker slot, while keeping total concurrency bounded.
+		go r.executeOverflowJob(job)
+		return true
+	}
+}
+
+func (r *chunkManifestResolver) resolve(chunks []*filer_pb.FileChunk, startOffset, stopOffset int64) (dataChunks, manifestChunks []*filer_pb.FileChunk, manifestResolveErr error) {
+	type resolveSlot struct {
+		chunk  *filer_pb.FileChunk
+		result chunkManifestResolveResult
+	}
+
+	// Cancellation is scoped to this parallel read batch so a failure in a
+	// later manifest does not cancel recursive work for an earlier manifest
+	// that already completed. Recursion creates its own batch context derived
+	// from the still-alive resolver context.
+	batchCtx, batchCancel := context.WithCancel(r.ctx)
+	defer batchCancel()
+	var batchOnce sync.Once
+
+	slots := make([]resolveSlot, len(chunks))
+	var reads sync.WaitGroup
+	for i, chunk := range chunks {
 		if max(chunk.Offset, startOffset) >= min(chunk.Offset+int64(chunk.Size), stopOffset) {
 			continue
 		}
 
+		slots[i].chunk = chunk
 		if !chunk.IsChunkManifest {
-			dataChunks = append(dataChunks, chunk)
 			continue
 		}
 
-		resolvedChunks, err := ResolveOneChunkManifest(ctx, lookupFileIdFn, chunk)
-		if err != nil {
-			return dataChunks, nil, err
+		reads.Add(1)
+		if !r.submit(chunkManifestResolveJob{
+			chunk:       chunk,
+			result:      &slots[i].result,
+			done:        &reads,
+			batchCtx:    batchCtx,
+			batchCancel: batchCancel,
+			batchOnce:   &batchOnce,
+		}) {
+			// submit may have already set the result (batch cancellation).
+			// Only set it here for the resolver-cancellation case.
+			if slots[i].result.err == nil {
+				slots[i].result.err = r.ctx.Err()
+				slots[i].result.internalCancel = r.parentCtx.Err() == nil && slots[i].result.err != nil
+			}
+			reads.Done()
+		}
+	}
+	reads.Wait()
+	if err := r.parentCtx.Err(); err != nil {
+		return dataChunks, nil, err
+	}
+
+	// Recurse only after this level's reads release their worker slots. A
+	// worker must never wait for a child manifest while holding a slot.
+	//
+	// Pre-scan for the first real (non-internal-cancel) error before
+	// recursing. If a later manifest already failed, return its error
+	// promptly with data chunks that are already in hand, instead of
+	// blocking on recursive reads of earlier manifests' children.
+	for i, slot := range slots {
+		if slot.chunk == nil {
+			continue
+		}
+		if slot.result.err != nil {
+			if slot.result.internalCancel {
+				continue
+			}
+			for j := 0; j < i; j++ {
+				if slots[j].chunk == nil {
+					continue
+				}
+				if !slots[j].chunk.IsChunkManifest {
+					dataChunks = append(dataChunks, slots[j].chunk)
+					continue
+				}
+				for _, c := range slots[j].result.chunks {
+					if !c.IsChunkManifest && max(c.Offset, startOffset) < min(c.Offset+int64(c.Size), stopOffset) {
+						dataChunks = append(dataChunks, c)
+					}
+				}
+			}
+			return dataChunks, nil, slot.result.err
+		}
+	}
+
+	for _, slot := range slots {
+		if slot.chunk == nil {
+			continue
+		}
+		if slot.result.err != nil {
+			if slot.result.internalCancel {
+				continue
+			}
+			return dataChunks, nil, slot.result.err
+		}
+		if !slot.chunk.IsChunkManifest {
+			dataChunks = append(dataChunks, slot.chunk)
+			continue
 		}
 
-		manifestChunks = append(manifestChunks, chunk)
-		// recursive
-		subDataChunks, subManifestChunks, subErr := ResolveChunkManifest(ctx, lookupFileIdFn, resolvedChunks, startOffset, stopOffset)
+		manifestChunks = append(manifestChunks, slot.chunk)
+		subDataChunks, subManifestChunks, subErr := r.resolve(slot.result.chunks, startOffset, stopOffset)
 		if subErr != nil {
 			return dataChunks, nil, subErr
 		}
@@ -79,22 +299,78 @@ func ResolveChunkManifest(ctx context.Context, lookupFileIdFn wdclient.LookupFil
 	return
 }
 
-func ResolveOneChunkManifest(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunk *filer_pb.FileChunk) (dataChunks []*filer_pb.FileChunk, manifestResolveErr error) {
+// ResolveOneChunkManifest fetches and decodes a single manifest chunk. It is
+// the uncached, exported path used by every non-Mount caller; the Mount path
+// routes through resolveOneChunkManifest so it can share a per-mount cache.
+// Keeping this signature stable preserves the existing four-argument contract
+// for external callers.
+func ResolveOneChunkManifest(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunk *filer_pb.FileChunk, invalidator CacheInvalidator) (dataChunks []*filer_pb.FileChunk, manifestResolveErr error) {
+	return resolveOneChunkManifest(ctx, lookupFileIdFn, chunk, invalidator, nil, nil)
+}
+
+// ResolveOneChunkManifestWithFilerJwt is ResolveOneChunkManifest that signs
+// proxied manifest downloads with filerJwtFn instead of the process-wide
+// filer read key, for readers carrying per-source credentials.
+func ResolveOneChunkManifestWithFilerJwt(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, filerJwtFn security.FilerJwtProvider, chunk *filer_pb.FileChunk, invalidator CacheInvalidator) (dataChunks []*filer_pb.FileChunk, manifestResolveErr error) {
+	return resolveOneChunkManifest(ctx, lookupFileIdFn, chunk, invalidator, nil, filerJwtFn)
+}
+
+// resolveOneChunkManifest is the cache-aware implementation. cache may be nil,
+// in which case the manifest is fetched and validated on every call, matching
+// the historical uncached behavior. A non-nil cache is owned by a single mount
+// (WFS) and coalesces concurrent cold misses via singleflight. filerJwtFn
+// overrides the filer read credential for proxied downloads; nil means the
+// process-wide key.
+func resolveOneChunkManifest(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunk *filer_pb.FileChunk, invalidator CacheInvalidator, cache *ChunkManifestCache, filerJwtFn security.FilerJwtProvider) (dataChunks []*filer_pb.FileChunk, manifestResolveErr error) {
 	if !chunk.IsChunkManifest {
 		return
 	}
-
-	// IsChunkManifest
-	bytesBuffer := bytesBufferPool.Get().(*bytes.Buffer)
-	bytesBuffer.Reset()
-	defer bytesBufferPool.Put(bytesBuffer)
-	err := fetchWholeChunk(ctx, bytesBuffer, lookupFileIdFn, chunk.GetFileIdString(), chunk.CipherKey, chunk.IsCompressed)
-	if err != nil {
-		return nil, fmt.Errorf("fail to read manifest %s: %v", chunk.GetFileIdString(), err)
+	if err := ctx.Err(); err != nil {
+		return nil, err
 	}
+
+	key := chunkManifestCacheKey{
+		fileID:       chunk.GetFileIdString(),
+		cipherKey:    string(chunk.CipherKey),
+		isCompressed: chunk.IsCompressed,
+	}
+
+	fetch := func() ([]byte, error) {
+		bytesBuffer := bytesBufferPool.Get().(*bytes.Buffer)
+		bytesBuffer.Reset()
+		defer bytesBufferPool.Put(bytesBuffer)
+		if err := fetchWholeChunk(ctx, bytesBuffer, lookupFileIdFn, key.fileID, chunk.CipherKey, chunk.IsCompressed, invalidator, filerJwtFn); err != nil {
+			return nil, fmt.Errorf("fail to read manifest %s: %w", key.fileID, err)
+		}
+		// Copy before the buffer returns to the pool so concurrent callers
+		// cannot overwrite the slice before it is cached.
+		data := append([]byte(nil), bytesBuffer.Bytes()...)
+		// Validate before returning so fetchOrLoad only caches well-formed
+		// manifests. A malformed manifest must not poison the cache.
+		if err := proto.Unmarshal(data, &filer_pb.FileChunkManifest{}); err != nil {
+			return nil, fmt.Errorf("fail to unmarshal manifest %s: %w", key.fileID, err)
+		}
+		return data, nil
+	}
+
+	var manifestBytes []byte
+	if cache != nil {
+		data, err := cache.fetchOrLoad(ctx, key, fetch)
+		if err != nil {
+			return nil, err
+		}
+		manifestBytes = data
+	} else {
+		data, err := fetch()
+		if err != nil {
+			return nil, err
+		}
+		manifestBytes = data
+	}
+
 	m := &filer_pb.FileChunkManifest{}
-	if err := proto.Unmarshal(bytesBuffer.Bytes(), m); err != nil {
-		return nil, fmt.Errorf("fail to unmarshal manifest %s: %v", chunk.GetFileIdString(), err)
+	if err := proto.Unmarshal(manifestBytes, m); err != nil {
+		return nil, fmt.Errorf("fail to unmarshal manifest %s: %w", key.fileID, err)
 	}
 
 	// recursive
@@ -102,31 +378,38 @@ func ResolveOneChunkManifest(ctx context.Context, lookupFileIdFn wdclient.Lookup
 	return m.Chunks, nil
 }
 
-// TODO fetch from cache for weed mount?
-func fetchWholeChunk(ctx context.Context, bytesBuffer *bytes.Buffer, lookupFileIdFn wdclient.LookupFileIdFunctionType, fileId string, cipherKey []byte, isGzipped bool) error {
+func fetchWholeChunk(ctx context.Context, bytesBuffer *bytes.Buffer, lookupFileIdFn wdclient.LookupFileIdFunctionType, fileId string, cipherKey []byte, isGzipped bool, invalidator CacheInvalidator, filerJwtFn security.FilerJwtProvider) error {
 	urlStrings, err := lookupFileIdFn(ctx, fileId)
 	if err != nil {
 		glog.ErrorfCtx(ctx, "operation LookupFileId %s failed, err: %v", fileId, err)
 		return err
 	}
-	jwt := JwtForVolumeServer(fileId)
-	_, err = retriedStreamFetchChunkData(ctx, bytesBuffer, urlStrings, jwt, cipherKey, isGzipped, true, 0, 0)
-	if err != nil {
-		return err
+	var jwt string
+	if filerJwtFn != nil && len(urlStrings) > 0 && util_http.IsProxyChunkUrl(urlStrings[0]) {
+		jwt = string(filerJwtFn(false))
+	} else {
+		jwt = ChunkReadJwt(urlStrings, fileId)
 	}
-	return nil
+	if _, err = retriedStreamFetchChunkData(ctx, bytesBuffer, urlStrings, jwt, cipherKey, isGzipped, true, 0, 0, refreshUrls(ctx, invalidator, lookupFileIdFn, fileId)); err == nil {
+		return nil
+	}
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		// a cancelled read says nothing about where the volume lives, and the
+		// stream error it provoked is a symptom, not the cause
+		return ctxErr
+	}
+	return retryFetchWithFreshLocations(ctx, invalidator, lookupFileIdFn, fileId, urlStrings, err, func(newUrls []string) error {
+		// the failed attempt may have streamed a partial prefix into the buffer
+		bytesBuffer.Reset()
+		_, retryErr := retriedStreamFetchChunkData(ctx, bytesBuffer, newUrls, jwt, cipherKey, isGzipped, true, 0, 0, nil)
+		return retryErr
+	})
 }
 
-func fetchChunkRange(ctx context.Context, buffer []byte, lookupFileIdFn wdclient.LookupFileIdFunctionType, fileId string, cipherKey []byte, isGzipped bool, offset int64) (int, error) {
-	urlStrings, err := lookupFileIdFn(ctx, fileId)
-	if err != nil {
-		glog.ErrorfCtx(ctx, "operation LookupFileId %s failed, err: %v", fileId, err)
-		return 0, err
-	}
-	return util_http.RetriedFetchChunkData(ctx, buffer, urlStrings, cipherKey, isGzipped, false, offset, fileId)
-}
-
-func retriedStreamFetchChunkData(ctx context.Context, writer io.Writer, urlStrings []string, jwt string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, size int) (written int64, err error) {
+// retriedStreamFetchChunkData streams a chunk from the first location that
+// answers. refreshUrls may be nil; when a location failed and a later one
+// answered, it is called so the reads that follow start from a fresh list.
+func retriedStreamFetchChunkData(ctx context.Context, writer io.Writer, urlStrings []string, jwt string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, size int, refreshUrls util_http.RefreshUrlsFunc) (written int64, err error) {
 
 	var shouldRetry bool
 	var totalWritten int
@@ -140,7 +423,8 @@ func retriedStreamFetchChunkData(ctx context.Context, writer io.Writer, urlStrin
 		}
 
 		retriedCnt := 0
-		for _, urlString := range urlStrings {
+		var failed bool
+		for _, urlString := range util_http.ReachableFirst(urlStrings) {
 			// Check for context cancellation before each volume server request
 			select {
 			case <-ctx.Done():
@@ -174,19 +458,23 @@ func retriedStreamFetchChunkData(ctx context.Context, writer io.Writer, urlStrin
 				localProcessed += writtenCount
 				totalWritten += writtenCount
 			})
-			if !shouldRetry {
-				break
-			}
 			if writeErr != nil {
 				err = writeErr
 				break
 			}
+			if !shouldRetry {
+				break
+			}
 			if err != nil {
+				failed = true
 				glog.V(0).InfofCtx(ctx, "read %s failed, err: %v", urlString, err)
 			} else {
 				break
 			}
 		}
+		if err == nil && failed && refreshUrls != nil {
+			refreshUrls()
+		}
 		// all nodes have tried it
 		if retriedCnt == len(urlStrings) {
 			break
@@ -211,14 +499,35 @@ func retriedStreamFetchChunkData(ctx context.Context, writer io.Writer, urlStrin
 
 }
 
-func MaybeManifestize(saveFunc SaveDataAsChunkFunctionType, inputChunks []*filer_pb.FileChunk) (chunks []*filer_pb.FileChunk, err error) {
-	// Don't manifestize SSE-encrypted chunks to preserve per-chunk metadata
-	for _, chunk := range inputChunks {
-		if chunk.GetSseType() != 0 { // Any SSE type (SSE-C or SSE-KMS)
-			return inputChunks, nil
+// MaybeManifestize folds a flat chunk list into manifest chunks once it passes
+// ManifestBatch, so an entry's chunk list stays within what the metadata store
+// will hold. A fold that fails partway returns inputChunks unchanged -- never
+// the half-folded list, which drops the manifests the caller came in with --
+// and hands the blobs it had already saved to deleteChunks, since the flat list
+// it returns references none of them. deleteChunks may be nil where the caller
+// has no deleter to offer; then the blobs are only named in the log.
+func MaybeManifestize(saveFunc SaveDataAsChunkFunctionType, deleteChunks func([]*filer_pb.FileChunk), inputChunks []*filer_pb.FileChunk) (chunks []*filer_pb.FileChunk, err error) {
+	var saved []*filer_pb.FileChunk
+	record := func(reader io.Reader, name string, offset int64, tsNs int64, expectedDataSize uint64) (*filer_pb.FileChunk, error) {
+		chunk, saveErr := saveFunc(reader, name, offset, tsNs, expectedDataSize)
+		if saveErr == nil {
+			saved = append(saved, chunk)
+		}
+		return chunk, saveErr
+	}
+
+	chunks, err = doMaybeManifestize(record, inputChunks, ManifestBatch, mergeIntoManifest)
+	if err == nil {
+		return chunks, nil
+	}
+	if len(saved) > 0 {
+		if deleteChunks != nil {
+			deleteChunks(saved)
+		} else {
+			glog.V(0).Infof("manifestize failed, %d manifest blobs left unreferenced: %v", len(saved), err)
 		}
 	}
-	return doMaybeManifestize(saveFunc, inputChunks, ManifestBatch, mergeIntoManifest)
+	return inputChunks, err
 }
 
 func doMaybeManifestize(saveFunc SaveDataAsChunkFunctionType, inputChunks []*filer_pb.FileChunk, mergeFactor int, mergefn func(saveFunc SaveDataAsChunkFunctionType, dataChunks []*filer_pb.FileChunk) (manifestChunk *filer_pb.FileChunk, err error)) (chunks []*filer_pb.FileChunk, err error) {
@@ -236,10 +545,9 @@ func doMaybeManifestize(saveFunc SaveDataAsChunkFunctionType, inputChunks []*fil
 	for i := 0; i+mergeFactor <= len(dataChunks); i += mergeFactor {
 		chunk, err := mergefn(saveFunc, dataChunks[i:i+mergeFactor])
 		if err != nil {
-			// Return the manifests already written plus the chunks not yet
-			// wrapped: a complete, deletable representation of every byte, so
-			// callers can clean up or keep a usable chunk list.
-			return append(chunks, dataChunks[i:]...), err
+			// dataChunks is what is left after the manifests the caller
+			// already had were separated out; returning it would drop them
+			return inputChunks, err
 		}
 		chunks = append(chunks, chunk)
 		remaining -= mergeFactor
diff --git a/weed/filer/filechunk_manifest_cache.go b/weed/filer/filechunk_manifest_cache.go
new file mode 100644
index 0000000000..3fc7430d97
--- /dev/null
+++ b/weed/filer/filechunk_manifest_cache.go
@@ -0,0 +1,146 @@
+package filer
+
+import (
+	"container/list"
+	"context"
+	"fmt"
+	"sync"
+
+	"golang.org/x/sync/singleflight"
+)
+
+const (
+	MaxMountChunkManifestCacheEntries = 256
+	MaxMountChunkManifestCacheBytes   = 64 << 20
+)
+
+type chunkManifestCacheKey struct {
+	fileID       string
+	cipherKey    string
+	isCompressed bool
+}
+
+func (k chunkManifestCacheKey) flightKey() string {
+	return fmt.Sprintf("%s\x00%s\x00%t", k.fileID, k.cipherKey, k.isCompressed)
+}
+
+type chunkManifestCacheEntry struct {
+	key  chunkManifestCacheKey
+	data []byte
+}
+
+// ChunkManifestCache is a bounded, thread-safe LRU cache for chunk manifest
+// bytes. Each mount (WFS) owns its own instance so manifests fetched through
+// one filer backend are never served to another. Concurrent cold misses for
+// the same key are coalesced via singleflight so only one fetch runs.
+type ChunkManifestCache struct {
+	mu         sync.Mutex
+	maxEntries int
+	maxBytes   int64
+	bytes      int64
+	entries    map[chunkManifestCacheKey]*list.Element
+	lru        *list.List
+	flight     singleflight.Group
+}
+
+// NewChunkManifestCache creates a bounded LRU cache for chunk manifest bytes.
+func NewChunkManifestCache(maxEntries int, maxBytes int64) *ChunkManifestCache {
+	return &ChunkManifestCache{
+		maxEntries: maxEntries,
+		maxBytes:   maxBytes,
+		entries:    make(map[chunkManifestCacheKey]*list.Element),
+		lru:        list.New(),
+	}
+}
+
+func (c *ChunkManifestCache) get(key chunkManifestCacheKey) ([]byte, bool) {
+	c.mu.Lock()
+	element, found := c.entries[key]
+	if !found {
+		c.mu.Unlock()
+		return nil, false
+	}
+	c.lru.MoveToFront(element)
+	// entry.data is immutable after insertion; copy outside the lock so a
+	// large copy does not block concurrent hits, inserts, and evictions.
+	data := element.Value.(*chunkManifestCacheEntry).data
+	c.mu.Unlock()
+	return append([]byte(nil), data...), true
+}
+
+func (c *ChunkManifestCache) put(key chunkManifestCacheKey, data []byte) {
+	if c.maxEntries <= 0 || int64(len(data)) > c.maxBytes {
+		return
+	}
+
+	entry := &chunkManifestCacheEntry{
+		key:  key,
+		data: append([]byte(nil), data...),
+	}
+
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if old, found := c.entries[key]; found {
+		c.removeElement(old)
+	}
+
+	element := c.lru.PushFront(entry)
+	c.entries[key] = element
+	c.bytes += int64(len(entry.data))
+
+	for len(c.entries) > c.maxEntries || c.bytes > c.maxBytes {
+		c.removeElement(c.lru.Back())
+	}
+}
+
+// fetchOrLoad returns cached manifest bytes for key, or invokes fetch and
+// caches the result. Concurrent calls for the same key are coalesced via
+// singleflight so only one fetch runs during a cold burst. A caller whose
+// context is canceled while waiting for the in-flight fetch returns
+// ctx.Err() immediately rather than blocking for the leader's result.
+func (c *ChunkManifestCache) fetchOrLoad(ctx context.Context, key chunkManifestCacheKey, fetch func() ([]byte, error)) ([]byte, error) {
+	if data, ok := c.get(key); ok {
+		return data, nil
+	}
+	ch := c.flight.DoChan(key.flightKey(), func() (interface{}, error) {
+		// Re-check under the flight: another flight may have just populated
+		// the cache for this key.
+		if data, ok := c.get(key); ok {
+			return data, nil
+		}
+		data, err := fetch()
+		if err != nil {
+			return nil, err
+		}
+		c.put(key, data)
+		return data, nil
+	})
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case res := <-ch:
+		if res.Err != nil {
+			return nil, res.Err
+		}
+		return res.Val.([]byte), nil
+	}
+}
+
+func (c *ChunkManifestCache) clear() {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.entries = make(map[chunkManifestCacheKey]*list.Element)
+	c.lru.Init()
+	c.bytes = 0
+}
+
+func (c *ChunkManifestCache) removeElement(element *list.Element) {
+	if element == nil {
+		return
+	}
+	c.lru.Remove(element)
+	entry := element.Value.(*chunkManifestCacheEntry)
+	delete(c.entries, entry.key)
+	c.bytes -= int64(len(entry.data))
+}
diff --git a/weed/filer/filechunk_manifest_cache_benchmark_test.go b/weed/filer/filechunk_manifest_cache_benchmark_test.go
new file mode 100644
index 0000000000..75b6a14490
--- /dev/null
+++ b/weed/filer/filechunk_manifest_cache_benchmark_test.go
@@ -0,0 +1,72 @@
+package filer
+
+import (
+	"context"
+	"fmt"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+func BenchmarkManifestResolutionRepeatedOpen(b *testing.B) {
+	for _, delay := range []time.Duration{0, 5 * time.Millisecond, 20 * time.Millisecond} {
+		b.Run(fmt.Sprintf("latency=%s", delay), func(b *testing.B) {
+			fixture := newManifestReadFixture(b, map[string][]*filer_pb.FileChunk{
+				"benchmark-cached": {resolveTestData("benchmark-data", 0)},
+			}, map[string]time.Duration{"benchmark-cached": delay})
+			var lookups atomic.Int32
+			lookup := func(ctx context.Context, fileID string) ([]string, error) {
+				lookups.Add(1)
+				return fixture.lookup(ctx, fileID)
+			}
+			chunk := newManifestCacheTestChunk("benchmark-cached")
+			cache := NewChunkManifestCache(MaxMountChunkManifestCacheEntries, MaxMountChunkManifestCacheBytes)
+			_, err := resolveOneChunkManifest(context.Background(), lookup, chunk, nil, cache, nil)
+			if err != nil {
+				b.Fatal(err)
+			}
+			fixture.loads.Store(0)
+			lookups.Store(0)
+
+			b.ReportAllocs()
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				if _, err := resolveOneChunkManifest(context.Background(), lookup, chunk, nil, cache, nil); err != nil {
+					b.Fatal(err)
+				}
+			}
+			b.StopTimer()
+			b.ReportMetric(float64(fixture.loads.Load())/float64(b.N), "fetches/op")
+			b.ReportMetric(float64(lookups.Load())/float64(b.N), "lookups/op")
+		})
+	}
+}
+
+func BenchmarkManifestResolutionWithoutCache(b *testing.B) {
+	for _, delay := range []time.Duration{0, 5 * time.Millisecond, 20 * time.Millisecond} {
+		b.Run(fmt.Sprintf("latency=%s", delay), func(b *testing.B) {
+			fixture := newManifestReadFixture(b, map[string][]*filer_pb.FileChunk{
+				"benchmark-uncached": {resolveTestData("benchmark-data", 0)},
+			}, map[string]time.Duration{"benchmark-uncached": delay})
+			var lookups atomic.Int32
+			lookup := func(ctx context.Context, fileID string) ([]string, error) {
+				lookups.Add(1)
+				return fixture.lookup(ctx, fileID)
+			}
+			chunk := newManifestCacheTestChunk("benchmark-uncached")
+
+			b.ReportAllocs()
+			b.ResetTimer()
+			for i := 0; i < b.N; i++ {
+				if _, err := ResolveOneChunkManifest(context.Background(), lookup, chunk, nil); err != nil {
+					b.Fatal(err)
+				}
+			}
+			b.StopTimer()
+			b.ReportMetric(float64(fixture.loads.Load())/float64(b.N), "fetches/op")
+			b.ReportMetric(float64(lookups.Load())/float64(b.N), "lookups/op")
+		})
+	}
+}
diff --git a/weed/filer/filechunk_manifest_cache_test.go b/weed/filer/filechunk_manifest_cache_test.go
new file mode 100644
index 0000000000..21644ce763
--- /dev/null
+++ b/weed/filer/filechunk_manifest_cache_test.go
@@ -0,0 +1,305 @@
+package filer
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+func newManifestCacheTestChunk(fileID string) *filer_pb.FileChunk {
+	return resolveTestManifest(fileID, 0)
+}
+
+func newTestManifestCache(t testing.TB) *ChunkManifestCache {
+	t.Helper()
+	cache := NewChunkManifestCache(MaxMountChunkManifestCacheEntries, MaxMountChunkManifestCacheBytes)
+	t.Cleanup(cache.clear)
+	return cache
+}
+
+func TestChunkGroupManifestResolutionCachesRepeatedOpens(t *testing.T) {
+	cache := newTestManifestCache(t)
+	const manifestID = "cache-repeated-open"
+	fixture := newManifestReadFixture(t, map[string][]*filer_pb.FileChunk{
+		manifestID: {resolveTestData("cached-data", 0)},
+	}, nil)
+	var lookups atomic.Int32
+	lookup := func(ctx context.Context, fileID string) ([]string, error) {
+		lookups.Add(1)
+		return fixture.lookup(ctx, fileID)
+	}
+
+	for i := 0; i < 3; i++ {
+		_, err := NewChunkGroup(lookup, nil, []*filer_pb.FileChunk{
+			newManifestCacheTestChunk(manifestID),
+		}, 1, nil, cache)
+		require.NoError(t, err)
+	}
+
+	require.Equal(t, int32(1), lookups.Load(), "repeated Mount opens should reuse the Manifest lookup")
+	require.Equal(t, int32(1), fixture.loads.Load(), "repeated Mount opens should reuse the Manifest fetch")
+}
+
+func TestChunkGroupManifestResolutionDoesNotCacheFailedReads(t *testing.T) {
+	cache := newTestManifestCache(t)
+	const manifestID = "cache-failed-read"
+	fixture := newManifestReadFixture(t, nil, nil)
+	var lookups atomic.Int32
+	lookup := func(ctx context.Context, fileID string) ([]string, error) {
+		lookups.Add(1)
+		return fixture.lookup(ctx, fileID)
+	}
+	chunk := newManifestCacheTestChunk(manifestID)
+
+	_, err := NewChunkGroup(lookup, nil, []*filer_pb.FileChunk{chunk}, 1, nil, cache)
+	require.Error(t, err)
+
+	fixture.manifests[manifestID] = manifestBytes(t, resolveTestData("retried-data", 0))
+	_, err = NewChunkGroup(lookup, nil, []*filer_pb.FileChunk{chunk}, 1, nil, cache)
+	require.NoError(t, err)
+
+	require.Equal(t, int32(2), lookups.Load(), "a failed lookup must not poison later Mount opens")
+	require.Equal(t, int32(2), fixture.loads.Load(), "a failed fetch must not poison later Mount opens")
+}
+
+func TestChunkGroupManifestResolutionConcurrentWarmOpensReuseFetch(t *testing.T) {
+	cache := newTestManifestCache(t)
+	const manifestID = "cache-concurrent-warm-open"
+	fixture := newManifestReadFixture(t, map[string][]*filer_pb.FileChunk{
+		manifestID: {resolveTestData("concurrent-data", 0)},
+	}, nil)
+	var lookups atomic.Int32
+	lookup := func(ctx context.Context, fileID string) ([]string, error) {
+		lookups.Add(1)
+		return fixture.lookup(ctx, fileID)
+	}
+
+	_, err := NewChunkGroup(lookup, nil, []*filer_pb.FileChunk{
+		newManifestCacheTestChunk(manifestID),
+	}, 1, nil, cache)
+	require.NoError(t, err)
+
+	const concurrentOpens = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, concurrentOpens)
+	for i := 0; i < concurrentOpens; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, openErr := NewChunkGroup(lookup, nil, []*filer_pb.FileChunk{
+				newManifestCacheTestChunk(manifestID),
+			}, 1, nil, cache)
+			errs <- openErr
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for openErr := range errs {
+		require.NoError(t, openErr)
+	}
+
+	require.Equal(t, int32(1), lookups.Load(), "warm concurrent Mount opens should not repeat the lookup")
+	require.Equal(t, int32(1), fixture.loads.Load(), "warm concurrent Mount opens should not repeat the fetch")
+}
+
+func TestChunkGroupManifestResolutionCoalescesColdMisses(t *testing.T) {
+	cache := newTestManifestCache(t)
+	const manifestID = "cache-cold-miss"
+	// Delay the manifest response so the leader's fetch is still in flight
+	// when the other concurrent opens arrive and join the singleflight.
+	fixture := newManifestReadFixture(t, map[string][]*filer_pb.FileChunk{
+		manifestID: {resolveTestData("cold-data", 0)},
+	}, map[string]time.Duration{manifestID: 50 * time.Millisecond})
+	var lookups atomic.Int32
+	lookup := func(ctx context.Context, fileID string) ([]string, error) {
+		lookups.Add(1)
+		return fixture.lookup(ctx, fileID)
+	}
+
+	const concurrentOpens = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, concurrentOpens)
+	for i := 0; i < concurrentOpens; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, openErr := NewChunkGroup(lookup, nil, []*filer_pb.FileChunk{
+				newManifestCacheTestChunk(manifestID),
+			}, 1, nil, cache)
+			errs <- openErr
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for openErr := range errs {
+		require.NoError(t, openErr)
+	}
+
+	require.Equal(t, int32(1), lookups.Load(), "concurrent cold opens should coalesce into a single lookup")
+	require.Equal(t, int32(1), fixture.loads.Load(), "concurrent cold opens should coalesce into a single fetch")
+}
+
+func TestResolveOneChunkManifestDoesNotUseMountCache(t *testing.T) {
+	cache := newTestManifestCache(t)
+	const manifestID = "cache-public-resolver"
+	fixture := newManifestReadFixture(t, map[string][]*filer_pb.FileChunk{
+		manifestID: {resolveTestData("public-resolver-data", 0)},
+	}, nil)
+	var lookups atomic.Int32
+	lookup := func(ctx context.Context, fileID string) ([]string, error) {
+		lookups.Add(1)
+		return fixture.lookup(ctx, fileID)
+	}
+	chunk := newManifestCacheTestChunk(manifestID)
+
+	for i := 0; i < 2; i++ {
+		_, err := ResolveOneChunkManifest(context.Background(), lookup, chunk, nil)
+		require.NoError(t, err)
+	}
+
+	require.Equal(t, int32(2), lookups.Load(), "the general resolver must retain its uncached behavior")
+	require.Equal(t, int32(2), fixture.loads.Load(), "the general resolver must not use the Mount cache")
+
+	// The shared cache must remain empty: a nil-cache caller must not pollute
+	// a mount-owned cache, and vice versa.
+	_, found := cache.get(chunkManifestCacheKey{fileID: manifestID})
+	require.False(t, found, "a nil-cache resolve must not populate an unrelated cache")
+}
+
+func TestChunkGroupManifestResolutionDoesNotCacheMalformedManifest(t *testing.T) {
+	cache := newTestManifestCache(t)
+	const manifestID = "cache-malformed-manifest"
+	fixture := newManifestReadFixture(t, map[string][]*filer_pb.FileChunk{
+		manifestID: nil,
+	}, nil)
+	fixture.manifests[manifestID] = []byte("malformed manifest")
+	chunk := newManifestCacheTestChunk(manifestID)
+
+	_, err := NewChunkGroup(fixture.lookup, nil, []*filer_pb.FileChunk{chunk}, 1, nil, cache)
+	require.Error(t, err)
+
+	fixture.manifests[manifestID] = manifestBytes(t, resolveTestData("after-malformed-data", 0))
+	_, err = NewChunkGroup(fixture.lookup, nil, []*filer_pb.FileChunk{chunk}, 1, nil, cache)
+	require.NoError(t, err)
+	require.Equal(t, int32(2), fixture.loads.Load(), "a malformed manifest must not poison later Mount opens")
+}
+
+func TestChunkManifestCacheSeparatesReadParameters(t *testing.T) {
+	cache := NewChunkManifestCache(4, 1024)
+	base := chunkManifestCacheKey{fileID: "same-file"}
+	cache.put(base, []byte("manifest"))
+
+	_, found := cache.get(chunkManifestCacheKey{fileID: "same-file", cipherKey: "key"})
+	require.False(t, found, "cipher keys must be part of the cache key")
+	_, found = cache.get(chunkManifestCacheKey{fileID: "same-file", isCompressed: true})
+	require.False(t, found, "compression settings must be part of the cache key")
+	_, found = cache.get(chunkManifestCacheKey{fileID: "different-file"})
+	require.False(t, found, "FileIds must be part of the cache key")
+}
+
+func TestChunkManifestCacheCopiesData(t *testing.T) {
+	cache := NewChunkManifestCache(1, 1024)
+	key := chunkManifestCacheKey{fileID: "copy-data"}
+	original := []byte("manifest")
+	cache.put(key, original)
+	original[0] = 'X'
+
+	data, found := cache.get(key)
+	require.True(t, found)
+	require.Equal(t, []byte("manifest"), data)
+	data[0] = 'Y'
+
+	data, found = cache.get(key)
+	require.True(t, found)
+	require.Equal(t, []byte("manifest"), data)
+}
+
+func TestChunkManifestCacheEvictsLeastRecentlyUsedAndOversizedEntries(t *testing.T) {
+	cache := NewChunkManifestCache(2, 6)
+	first := chunkManifestCacheKey{fileID: "first"}
+	second := chunkManifestCacheKey{fileID: "second"}
+	third := chunkManifestCacheKey{fileID: "third"}
+	oversized := chunkManifestCacheKey{fileID: "oversized"}
+
+	cache.put(first, []byte("one"))
+	cache.put(second, []byte("two"))
+	_, found := cache.get(first)
+	require.True(t, found, "the first entry should be present before eviction")
+	cache.put(third, []byte("tri"))
+
+	_, found = cache.get(first)
+	require.True(t, found, "a recent entry should survive LRU eviction")
+	_, found = cache.get(second)
+	require.False(t, found, "the least recently used entry should be evicted")
+	_, found = cache.get(third)
+	require.True(t, found)
+
+	cache.put(oversized, []byte("too large"))
+	_, found = cache.get(oversized)
+	require.False(t, found, "an entry over the byte limit must not be cached")
+}
+
+func TestResolveOneChunkManifestHonorsCanceledContextOnCacheHit(t *testing.T) {
+	cache := NewChunkManifestCache(1, 1024)
+	chunk := newManifestCacheTestChunk("cache-canceled-hit")
+	cache.put(chunkManifestCacheKey{fileID: chunk.GetFileIdString()}, manifestBytes(t, resolveTestData("canceled-data", 0)))
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	lookupCalled := false
+	lookup := func(context.Context, string) ([]string, error) {
+		lookupCalled = true
+		return nil, errors.New("lookup should not be called")
+	}
+
+	_, err := resolveOneChunkManifest(ctx, lookup, chunk, nil, cache, nil)
+	require.ErrorIs(t, err, context.Canceled)
+	require.False(t, lookupCalled, "a canceled cache hit must not issue a lookup")
+}
+
+func TestResolveOneChunkManifestCanceledWaiterReturnsDuringCoalescedMiss(t *testing.T) {
+	cache := newTestManifestCache(t)
+	const manifestID = "cache-canceled-waiter"
+	// Delay the manifest response so the leader's fetch is still in flight
+	// when the waiter arrives and cancels.
+	fixture := newManifestReadFixture(t, map[string][]*filer_pb.FileChunk{
+		manifestID: {resolveTestData("canceled-waiter-data", 0)},
+	}, map[string]time.Duration{manifestID: 100 * time.Millisecond})
+	chunk := newManifestCacheTestChunk(manifestID)
+
+	// Leader starts the fetch with a live context.
+	leaderCtx, leaderCancel := context.WithCancel(context.Background())
+	defer leaderCancel()
+	leaderDone := make(chan error, 1)
+	go func() {
+		_, err := resolveOneChunkManifest(leaderCtx, fixture.lookup, chunk, nil, cache, nil)
+		leaderDone <- err
+	}()
+
+	// Waiter cancels its own context while the leader's fetch is still in
+	// flight; it must return context.Canceled promptly instead of blocking
+	// for the leader's result.
+	waiterCtx, waiterCancel := context.WithCancel(context.Background())
+	waiterCancel()
+	_, err := resolveOneChunkManifest(waiterCtx, fixture.lookup, chunk, nil, cache, nil)
+	require.ErrorIs(t, err, context.Canceled)
+
+	// The leader must still complete successfully and populate the cache.
+	require.NoError(t, <-leaderDone)
+	data, found := cache.get(chunkManifestCacheKey{fileID: manifestID})
+	require.True(t, found, "the leader's successful fetch must populate the cache")
+	require.NotEmpty(t, data)
+}
+
+func manifestBytes(t testing.TB, chunks ...*filer_pb.FileChunk) []byte {
+	t.Helper()
+	data, err := proto.Marshal(&filer_pb.FileChunkManifest{Chunks: chunks})
+	require.NoError(t, err)
+	return data
+}
diff --git a/weed/filer/filechunk_manifest_resolve_test.go b/weed/filer/filechunk_manifest_resolve_test.go
new file mode 100644
index 0000000000..8b1902f8b6
--- /dev/null
+++ b/weed/filer/filechunk_manifest_resolve_test.go
@@ -0,0 +1,600 @@
+package filer
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+type manifestReadFixture struct {
+	server    *httptest.Server
+	mu        sync.Mutex
+	started   []string
+	completed []string
+	active    atomic.Int32
+	maxActive atomic.Int32
+	loads     atomic.Int32
+	manifests map[string][]byte
+	delays    map[string]time.Duration
+	stopReads chan struct{}
+}
+
+func newManifestReadFixture(t testing.TB, manifests map[string][]*filer_pb.FileChunk, delays map[string]time.Duration) *manifestReadFixture {
+	t.Helper()
+	encoded := make(map[string][]byte, len(manifests))
+	for id, chunks := range manifests {
+		data, err := proto.Marshal(&filer_pb.FileChunkManifest{Chunks: chunks})
+		require.NoError(t, err)
+		encoded[id] = data
+	}
+
+	fixture := &manifestReadFixture{manifests: encoded, delays: delays, stopReads: make(chan struct{})}
+	listener, err := (&net.ListenConfig{}).Listen(context.Background(), "tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	fixture.server = httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		id := strings.TrimPrefix(r.URL.Path, "/")
+		fixture.loads.Add(1)
+		fixture.active.Add(1)
+		fixture.updateMaxActive()
+		fixture.mu.Lock()
+		fixture.started = append(fixture.started, id)
+		fixture.mu.Unlock()
+		finishRead := func() {
+			fixture.active.Add(-1)
+			fixture.mu.Lock()
+			fixture.completed = append(fixture.completed, id)
+			fixture.mu.Unlock()
+		}
+
+		if delay := fixture.delays[id]; delay > 0 {
+			timer := time.NewTimer(delay)
+			select {
+			case <-r.Context().Done():
+				timer.Stop()
+				finishRead()
+				return
+			case <-fixture.stopReads:
+				timer.Stop()
+				finishRead()
+				return
+			case <-timer.C:
+			}
+		}
+		data, ok := fixture.manifests[id]
+		if !ok {
+			http.NotFound(w, r)
+			finishRead()
+			return
+		}
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", len(data)))
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write(data)
+		finishRead()
+	}))
+	fixture.server.Listener = listener
+	fixture.server.Start()
+	t.Cleanup(fixture.server.Close)
+	return fixture
+}
+
+func (f *manifestReadFixture) updateMaxActive() {
+	for {
+		current := f.active.Load()
+		maximum := f.maxActive.Load()
+		if current <= maximum || f.maxActive.CompareAndSwap(maximum, current) {
+			return
+		}
+	}
+}
+
+func (f *manifestReadFixture) lookup(ctx context.Context, fileID string) ([]string, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	return []string{f.server.URL + "/" + fileID}, nil
+}
+
+func (f *manifestReadFixture) completionOrder() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]string(nil), f.completed...)
+}
+
+func resolveTestManifest(id string, offset int64) *filer_pb.FileChunk {
+	return &filer_pb.FileChunk{FileId: id, IsChunkManifest: true, Offset: offset, Size: 100}
+}
+
+func resolveTestData(id string, offset int64) *filer_pb.FileChunk {
+	return &filer_pb.FileChunk{FileId: id, Offset: offset, Size: 10}
+}
+
+func TestResolveChunkManifestParallelReadsAreBounded(t *testing.T) {
+	manifests := make(map[string][]*filer_pb.FileChunk)
+	inputs := make([]*filer_pb.FileChunk, 0, 8)
+	delays := make(map[string]time.Duration)
+	for i := 0; i < 8; i++ {
+		id := fmt.Sprintf("m%d", i)
+		manifests[id] = []*filer_pb.FileChunk{resolveTestData(fmt.Sprintf("d%d", i), int64(i*10))}
+		inputs = append(inputs, resolveTestManifest(id, int64(i*100)))
+		delays[id] = 50 * time.Millisecond
+	}
+	fixture := newManifestReadFixture(t, manifests, delays)
+
+	data, meta, err := ResolveChunkManifest(context.Background(), fixture.lookup, inputs, 0, 1000, nil)
+	require.NoError(t, err)
+	require.Len(t, data, len(inputs))
+	require.Len(t, meta, len(inputs))
+	require.GreaterOrEqual(t, fixture.maxActive.Load(), int32(2), "independent manifests should overlap")
+	require.LessOrEqual(t, fixture.maxActive.Load(), int32(4), "manifest reads must be bounded")
+}
+
+func TestResolveChunkManifestPreservesInputOrderWhenReadsCompleteOutOfOrder(t *testing.T) {
+	fixture := newManifestReadFixture(t,
+		map[string][]*filer_pb.FileChunk{
+			"slow": {resolveTestData("slow-data", 0)},
+			"fast": {resolveTestData("fast-data", 100)},
+		},
+		map[string]time.Duration{"slow": 80 * time.Millisecond, "fast": 5 * time.Millisecond},
+	)
+
+	data, meta, err := ResolveChunkManifest(context.Background(), fixture.lookup, []*filer_pb.FileChunk{
+		resolveTestManifest("slow", 0),
+		resolveTestManifest("fast", 100),
+	}, 0, 200, nil)
+	require.NoError(t, err)
+	require.Equal(t, []string{"slow-data", "fast-data"}, fileIDs(data))
+	require.Equal(t, []string{"slow", "fast"}, fileIDs(meta))
+	require.Equal(t, []string{"fast", "slow"}, fixture.completionOrder())
+}
+
+func TestResolveChunkManifestNestedManifestsKeepDepthFirstOrder(t *testing.T) {
+	fixture := newManifestReadFixture(t,
+		map[string][]*filer_pb.FileChunk{
+			"parent":  {resolveTestData("parent-data", 0), resolveTestManifest("nested", 10)},
+			"sibling": {resolveTestData("sibling-data", 20)},
+			"nested":  {resolveTestData("nested-data", 10)},
+		},
+		map[string]time.Duration{"parent": 60 * time.Millisecond, "sibling": 5 * time.Millisecond},
+	)
+
+	data, meta, err := ResolveChunkManifest(context.Background(), fixture.lookup, []*filer_pb.FileChunk{
+		resolveTestManifest("parent", 0),
+		resolveTestManifest("sibling", 20),
+	}, 0, 100, nil)
+	require.NoError(t, err)
+	require.Equal(t, []string{"parent-data", "nested-data", "sibling-data"}, fileIDs(data))
+	require.Equal(t, []string{"parent", "nested", "sibling"}, fileIDs(meta))
+	require.Equal(t, []string{"sibling", "parent", "nested"}, fixture.completionOrder())
+}
+
+func TestResolveChunkManifestFiltersBeforeReadingAndRecursively(t *testing.T) {
+	fixture := newManifestReadFixture(t,
+		map[string][]*filer_pb.FileChunk{
+			"outside": {resolveTestData("never-read", 0)},
+			"inside":  {resolveTestData("before", 0), resolveTestData("selected", 100), resolveTestData("after", 200)},
+		}, nil)
+
+	data, meta, err := ResolveChunkManifest(context.Background(), fixture.lookup, []*filer_pb.FileChunk{
+		resolveTestManifest("outside", 0),
+		resolveTestManifest("inside", 90),
+	}, 100, 200, nil)
+	require.NoError(t, err)
+	require.Equal(t, []string{"selected"}, fileIDs(data))
+	require.Equal(t, []string{"inside"}, fileIDs(meta))
+	require.Equal(t, int32(1), fixture.loads.Load(), "the non-overlapping parent manifest must not be read")
+}
+
+func TestResolveChunkManifestPropagatesReadAndFormatErrorsInInputOrder(t *testing.T) {
+	fixture := newManifestReadFixture(t,
+		map[string][]*filer_pb.FileChunk{
+			"valid":  {resolveTestData("valid-data", 0)},
+			"broken": nil,
+		}, map[string]time.Duration{"broken": 50 * time.Millisecond})
+	fixture.manifests["broken"] = []byte("not a protobuf manifest")
+
+	data, meta, err := ResolveChunkManifest(context.Background(), fixture.lookup, []*filer_pb.FileChunk{
+		resolveTestData("plain", 0),
+		resolveTestManifest("valid", 10),
+		resolveTestManifest("broken", 20),
+	}, 0, 100, nil)
+	require.Error(t, err)
+	require.Nil(t, meta)
+	require.Equal(t, []string{"plain", "valid-data"}, fileIDs(data))
+	require.Contains(t, err.Error(), "fail to unmarshal manifest broken")
+
+	lookupErr := errors.New("lookup failed")
+	lookup := func(context.Context, string) ([]string, error) { return nil, lookupErr }
+	_, _, err = ResolveChunkManifest(context.Background(), lookup, []*filer_pb.FileChunk{resolveTestManifest("lookup-error", 0)}, 0, 100, nil)
+	require.ErrorIs(t, err, lookupErr)
+}
+
+func TestResolveChunkManifestCancellationStopsAllReads(t *testing.T) {
+	fixture := newManifestReadFixture(t,
+		map[string][]*filer_pb.FileChunk{
+			"one": {resolveTestData("one-data", 0)},
+			"two": {resolveTestData("two-data", 10)},
+		},
+		map[string]time.Duration{"one": time.Second, "two": time.Second},
+	)
+	ctx, cancel := context.WithCancel(context.Background())
+	result := make(chan error, 1)
+	go func() {
+		_, _, err := ResolveChunkManifest(ctx, fixture.lookup, []*filer_pb.FileChunk{
+			resolveTestManifest("one", 0),
+			resolveTestManifest("two", 10),
+		}, 0, 100, nil)
+		result <- err
+	}()
+
+	deadline := time.Now().Add(time.Second)
+	for fixture.loads.Load() < 1 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	close(fixture.stopReads)
+	cancel()
+	err := <-result
+	require.ErrorIs(t, err, context.Canceled)
+	require.Eventually(t, func() bool {
+		return fixture.active.Load() == 0
+	}, time.Second, time.Millisecond, "all manifest readers must exit after ResolveChunkManifest returns")
+}
+
+type manifestFailureReadFixture struct {
+	server       *httptest.Server
+	fastRelease  chan struct{}
+	slowStarted  chan struct{}
+	fastStarted  chan struct{}
+	slowCanceled chan struct{}
+}
+
+func newManifestFailureReadFixture(t testing.TB) *manifestFailureReadFixture {
+	t.Helper()
+	fixture := &manifestFailureReadFixture{
+		fastRelease:  make(chan struct{}),
+		slowStarted:  make(chan struct{}),
+		fastStarted:  make(chan struct{}),
+		slowCanceled: make(chan struct{}),
+	}
+	fixture.server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch strings.TrimPrefix(r.URL.Path, "/") {
+		case "fast":
+			close(fixture.fastStarted)
+			<-fixture.fastRelease
+			w.Header().Set("Content-Length", "7")
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte("invalid"))
+		case "slow":
+			close(fixture.slowStarted)
+			<-r.Context().Done()
+			close(fixture.slowCanceled)
+		}
+	}))
+	t.Cleanup(fixture.server.Close)
+	return fixture
+}
+
+func (f *manifestFailureReadFixture) lookup(ctx context.Context, fileID string) ([]string, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	return []string{f.server.URL + "/" + fileID}, nil
+}
+
+func waitForManifestFailureSignal(t *testing.T, signal <-chan struct{}) {
+	t.Helper()
+	select {
+	case <-signal:
+	case <-time.After(time.Second):
+		t.Fatal("timed out waiting for manifest request")
+	}
+}
+
+func TestResolveChunkManifestFastFailureCancelsSlowSibling(t *testing.T) {
+	testCases := []struct {
+		name       string
+		inputIDs   []string
+		expectedID string
+	}{
+		{name: "fast then slow returns quickly", inputIDs: []string{"fast", "slow"}, expectedID: "fast"},
+		{name: "slow then fast keeps real error", inputIDs: []string{"slow", "fast"}, expectedID: "fast"},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			fixture := newManifestFailureReadFixture(t)
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+
+			chunks := make([]*filer_pb.FileChunk, 0, len(testCase.inputIDs))
+			for i, id := range testCase.inputIDs {
+				chunks = append(chunks, resolveTestManifest(id, int64(i*100)))
+			}
+			result := make(chan error, 1)
+			go func() {
+				_, _, err := ResolveChunkManifest(ctx, fixture.lookup, chunks, 0, 200, nil)
+				result <- err
+			}()
+
+			waitForManifestFailureSignal(t, fixture.fastStarted)
+			waitForManifestFailureSignal(t, fixture.slowStarted)
+			close(fixture.fastRelease)
+
+			var err error
+			select {
+			case err = <-result:
+			case <-time.After(time.Second):
+				cancel()
+				select {
+				case <-result:
+				case <-time.After(time.Second):
+					t.Fatal("ResolveChunkManifest did not finish after caller cancellation")
+				}
+				t.Fatal("fast manifest failure waited for the slow sibling")
+			}
+			require.Error(t, err)
+			require.Contains(t, err.Error(), "fail to unmarshal manifest "+testCase.expectedID)
+			require.NotErrorIs(t, err, context.Canceled)
+			waitForManifestFailureSignal(t, fixture.slowCanceled)
+		})
+	}
+}
+
+func TestResolveChunkManifestFastFailureCancelsEncryptedSibling(t *testing.T) {
+	fixture := newManifestFailureReadFixture(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	slowChunk := resolveTestManifest("slow", 0)
+	slowChunk.CipherKey = []byte("0123456789abcdef")
+	chunks := []*filer_pb.FileChunk{
+		slowChunk,
+		resolveTestManifest("fast", 100),
+	}
+	result := make(chan error, 1)
+	go func() {
+		_, _, err := ResolveChunkManifest(ctx, fixture.lookup, chunks, 0, 200, nil)
+		result <- err
+	}()
+
+	waitForManifestFailureSignal(t, fixture.fastStarted)
+	waitForManifestFailureSignal(t, fixture.slowStarted)
+	close(fixture.fastRelease)
+
+	var err error
+	select {
+	case err = <-result:
+	case <-time.After(time.Second):
+		cancel()
+		select {
+		case <-result:
+		case <-time.After(time.Second):
+			t.Fatal("ResolveChunkManifest did not finish after caller cancellation")
+		}
+		t.Fatal("fast manifest failure waited for the encrypted slow sibling")
+	}
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "fail to unmarshal manifest fast")
+	require.NotErrorIs(t, err, context.Canceled)
+	waitForManifestFailureSignal(t, fixture.slowCanceled)
+}
+
+func TestResolveChunkManifestKeepsRealErrorAfterInternalCancellation(t *testing.T) {
+	earlyStarted := make(chan struct{})
+	lateStarted := make(chan struct{})
+	earlyErr := errors.New("early lookup failed")
+	lateErr := errors.New("late lookup failed")
+	lookup := func(ctx context.Context, fileID string) ([]string, error) {
+		switch fileID {
+		case "early":
+			close(earlyStarted)
+			<-ctx.Done()
+			return nil, earlyErr
+		case "late":
+			// The assertion is specifically about preserving the earlier input's
+			// real error after a later input cancels the batch. Do not let the
+			// later lookup cancel the batch before the earlier lookup has entered;
+			// that scheduling race is especially visible on slower 32-bit CI.
+			<-earlyStarted
+			close(lateStarted)
+			return nil, lateErr
+		default:
+			return nil, fmt.Errorf("unexpected manifest %s", fileID)
+		}
+	}
+
+	result := make(chan error, 1)
+	go func() {
+		_, _, err := ResolveChunkManifest(context.Background(), lookup, []*filer_pb.FileChunk{
+			resolveTestManifest("early", 0),
+			resolveTestManifest("late", 100),
+		}, 0, 200, nil)
+		result <- err
+	}()
+	waitForManifestFailureSignal(t, earlyStarted)
+	waitForManifestFailureSignal(t, lateStarted)
+
+	select {
+	case err := <-result:
+		require.ErrorIs(t, err, earlyErr)
+		require.NotErrorIs(t, err, lateErr)
+	case <-time.After(time.Second):
+		t.Fatal("ResolveChunkManifest did not return the input-order error")
+	}
+}
+
+func TestResolveChunkManifestReturnsLaterFailureWithoutRecursingEarlierChildren(t *testing.T) {
+	fixture := newManifestReadFixture(t,
+		map[string][]*filer_pb.FileChunk{
+			"a":       {resolveTestManifest("a-child", 0)},
+			"a-child": {resolveTestData("a-child-data", 0)},
+			"b":       nil,
+		},
+		map[string]time.Duration{"a": 5 * time.Millisecond, "b": 50 * time.Millisecond, "a-child": 2 * time.Second},
+	)
+	fixture.manifests["b"] = []byte("not a protobuf manifest")
+
+	start := time.Now()
+	data, meta, err := ResolveChunkManifest(context.Background(), fixture.lookup, []*filer_pb.FileChunk{
+		resolveTestManifest("a", 0),
+		resolveTestManifest("b", 100),
+	}, 0, 200, nil)
+	elapsed := time.Since(start)
+
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "fail to unmarshal manifest b")
+	require.Empty(t, data, "earlier manifest's children must not be recursed when a later manifest already failed")
+	require.Nil(t, meta)
+	require.Equal(t, int32(2), fixture.loads.Load(), "only the two top-level manifests must be read, not a-child")
+	require.Less(t, elapsed, time.Second, "must return promptly without waiting for a-child's slow read")
+}
+
+func TestResolveChunkManifestExcludesOutOfRangeChildrenOnLaterFailure(t *testing.T) {
+	fixture := newManifestReadFixture(t,
+		map[string][]*filer_pb.FileChunk{
+			"a": {
+				resolveTestData("a-in-range", 0),
+				resolveTestData("a-out-of-range", 500),
+			},
+			"b": nil,
+		},
+		map[string]time.Duration{"b": 50 * time.Millisecond},
+	)
+	fixture.manifests["b"] = []byte("not a protobuf manifest")
+
+	data, _, err := ResolveChunkManifest(context.Background(), fixture.lookup, []*filer_pb.FileChunk{
+		resolveTestManifest("a", 0),
+		resolveTestManifest("b", 100),
+	}, 0, 200, nil)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "fail to unmarshal manifest b")
+	require.Equal(t, []string{"a-in-range"}, fileIDs(data), "out-of-range child chunks must be excluded from partial results")
+}
+
+func TestResolveChunkManifestQueuesJobsBeyondWorkerCount(t *testing.T) {
+	// More manifests than workers. The first four stall; the fifth fails
+	// promptly. With a buffered job channel, the fifth job is queued without
+	// blocking submission. When a stalled read is released, a worker picks up
+	// the failing job, which cancels the batch and unblocks the rest.
+	stallRelease := make(chan struct{})
+	stallStarted := make(chan struct{}, 4)
+	lookup := func(ctx context.Context, fileID string) ([]string, error) {
+		switch fileID {
+		case "stall-0", "stall-1", "stall-2", "stall-3":
+			stallStarted <- struct{}{}
+			select {
+			case <-stallRelease:
+				return nil, nil
+			case <-ctx.Done():
+				return nil, ctx.Err()
+			}
+		case "fail":
+			return nil, errors.New("prompt lookup failure")
+		default:
+			return nil, fmt.Errorf("unexpected manifest %s", fileID)
+		}
+	}
+
+	result := make(chan error, 1)
+	go func() {
+		_, _, err := ResolveChunkManifest(context.Background(), lookup, []*filer_pb.FileChunk{
+			resolveTestManifest("stall-0", 0),
+			resolveTestManifest("stall-1", 100),
+			resolveTestManifest("stall-2", 200),
+			resolveTestManifest("stall-3", 300),
+			resolveTestManifest("fail", 400),
+		}, 0, 500, nil)
+		result <- err
+	}()
+
+	// Wait until all 4 workers are stalled.
+	for i := 0; i < 4; i++ {
+		waitForManifestFailureSignal(t, stallStarted)
+	}
+
+	// Release the stalled reads so workers can pick up the queued failing job.
+	close(stallRelease)
+
+	select {
+	case err := <-result:
+		require.Error(t, err)
+		require.Contains(t, err.Error(), "fail to read manifest fail")
+	case <-time.After(2 * time.Second):
+		t.Fatal("failing job was not picked up after releasing stalled workers")
+	}
+}
+
+func fileIDs(chunks []*filer_pb.FileChunk) []string {
+	ids := make([]string, 0, len(chunks))
+	for _, chunk := range chunks {
+		ids = append(ids, chunk.GetFileIdString())
+	}
+	return ids
+}
+
+func resolveChunkManifestSerialForBenchmark(ctx context.Context, lookupFileIdFn func(context.Context, string) ([]string, error), chunks []*filer_pb.FileChunk, startOffset, stopOffset int64) (dataChunks, manifestChunks []*filer_pb.FileChunk, err error) {
+	for _, chunk := range chunks {
+		if max(chunk.Offset, startOffset) >= min(chunk.Offset+int64(chunk.Size), stopOffset) {
+			continue
+		}
+		if !chunk.IsChunkManifest {
+			dataChunks = append(dataChunks, chunk)
+			continue
+		}
+
+		resolvedChunks, resolveErr := ResolveOneChunkManifest(ctx, lookupFileIdFn, chunk, nil)
+		if resolveErr != nil {
+			return dataChunks, nil, resolveErr
+		}
+		manifestChunks = append(manifestChunks, chunk)
+		subDataChunks, subManifestChunks, subErr := resolveChunkManifestSerialForBenchmark(ctx, lookupFileIdFn, resolvedChunks, startOffset, stopOffset)
+		if subErr != nil {
+			return dataChunks, nil, subErr
+		}
+		dataChunks = append(dataChunks, subDataChunks...)
+		manifestChunks = append(manifestChunks, subManifestChunks...)
+	}
+	return dataChunks, manifestChunks, nil
+}
+
+func BenchmarkResolveChunkManifestSerialVsParallel(b *testing.B) {
+	manifests := make(map[string][]*filer_pb.FileChunk)
+	inputs := make([]*filer_pb.FileChunk, 0, 8)
+	delays := make(map[string]time.Duration)
+	for i := 0; i < 8; i++ {
+		id := fmt.Sprintf("m%d", i)
+		manifests[id] = []*filer_pb.FileChunk{resolveTestData(fmt.Sprintf("d%d", i), int64(i*10))}
+		inputs = append(inputs, resolveTestManifest(id, int64(i*10)))
+		delays[id] = time.Millisecond
+	}
+	fixture := newManifestReadFixture(b, manifests, delays)
+	b.ReportAllocs()
+
+	b.Run("serial", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_, _, err := resolveChunkManifestSerialForBenchmark(context.Background(), fixture.lookup, inputs, 0, 1000)
+			if err != nil {
+				b.Fatal(err)
+			}
+		}
+	})
+	b.Run("parallel", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			_, _, err := ResolveChunkManifest(context.Background(), fixture.lookup, inputs, 0, 1000, nil)
+			if err != nil {
+				b.Fatal(err)
+			}
+		}
+	})
+}
diff --git a/weed/filer/filechunk_manifest_rollback_test.go b/weed/filer/filechunk_manifest_rollback_test.go
new file mode 100644
index 0000000000..7dcf072170
--- /dev/null
+++ b/weed/filer/filechunk_manifest_rollback_test.go
@@ -0,0 +1,133 @@
+package filer
+
+import (
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+func flatTestChunks(n int) []*filer_pb.FileChunk {
+	chunks := make([]*filer_pb.FileChunk, n)
+	for i := range chunks {
+		chunks[i] = &filer_pb.FileChunk{
+			FileId: fmt.Sprintf("1,%x", i+1),
+			Offset: int64(i) * 8,
+			Size:   8,
+		}
+	}
+	return chunks
+}
+
+type fakeManifestStore struct {
+	saves   int
+	failOn  int // 1-based save call to fail on; 0 = never
+	deleted []*filer_pb.FileChunk
+}
+
+func (s *fakeManifestStore) save(reader io.Reader, name string, offset int64, tsNs int64, expectedDataSize uint64) (*filer_pb.FileChunk, error) {
+	s.saves++
+	if s.saves == s.failOn {
+		return nil, fmt.Errorf("save %d failed", s.saves)
+	}
+	if _, err := io.Copy(io.Discard, reader); err != nil {
+		return nil, err
+	}
+	return &filer_pb.FileChunk{FileId: fmt.Sprintf("2,%x", s.saves), Offset: offset}, nil
+}
+
+func (s *fakeManifestStore) delete(chunks []*filer_pb.FileChunk) {
+	s.deleted = append(s.deleted, chunks...)
+}
+
+func TestMaybeManifestizeFolds(t *testing.T) {
+	store := &fakeManifestStore{}
+	chunks := flatTestChunks(ManifestBatch + 50)
+
+	result, err := MaybeManifestize(store.save, store.delete, chunks)
+	if err != nil {
+		t.Fatalf("MaybeManifestize: %v", err)
+	}
+
+	manifests, data := SeparateManifestChunks(result)
+	if len(manifests) != 1 || len(data) != 50 {
+		t.Fatalf("expected 1 manifest + 50 flat chunks, got %d + %d", len(manifests), len(data))
+	}
+	if store.saves != 1 || len(store.deleted) != 0 {
+		t.Errorf("expected 1 save and no deletes, got %d saves, %d deleted", store.saves, len(store.deleted))
+	}
+	if manifests[0].Offset != 0 || manifests[0].Size != uint64(ManifestBatch*8) {
+		t.Errorf("manifest span [%d,%d) wrong", manifests[0].Offset, manifests[0].Size)
+	}
+}
+
+func TestMaybeManifestizeBelowThreshold(t *testing.T) {
+	store := &fakeManifestStore{}
+	chunks := flatTestChunks(ManifestBatch - 1)
+
+	result, err := MaybeManifestize(store.save, store.delete, chunks)
+	if err != nil {
+		t.Fatalf("MaybeManifestize: %v", err)
+	}
+	if len(result) != len(chunks) || store.saves != 0 {
+		t.Fatalf("expected untouched flat list, got %d chunks, %d saves", len(result), store.saves)
+	}
+}
+
+// A fold that fails midway must hand back the caller's own list and delete the
+// manifest blobs its earlier batches already uploaded.
+func TestMaybeManifestizeRollsBackPartialFold(t *testing.T) {
+	store := &fakeManifestStore{failOn: 2}
+	chunks := flatTestChunks(2*ManifestBatch + 50)
+
+	result, err := MaybeManifestize(store.save, store.delete, chunks)
+	if err == nil {
+		t.Fatal("expected the failed save to be reported")
+	}
+	if len(result) != len(chunks) {
+		t.Fatalf("expected fallback to %d flat chunks, got %d", len(chunks), len(result))
+	}
+	if HasChunkManifest(result) {
+		t.Error("fallback list must not contain manifest chunks")
+	}
+	if len(store.deleted) != 1 || store.deleted[0].FileId != "2,1" {
+		t.Fatalf("expected the first saved blob deleted, got %+v", store.deleted)
+	}
+}
+
+// The manifests a caller came in with are not re-folded, and must survive a
+// fold that fails on the flat remainder: returning only the data chunks would
+// lose everything they cover.
+func TestMaybeManifestizeKeepsExistingManifestsOnFailure(t *testing.T) {
+	store := &fakeManifestStore{failOn: 2}
+	existing := &filer_pb.FileChunk{FileId: "m,1", IsChunkManifest: true, Offset: 0, Size: 24}
+	chunks := append([]*filer_pb.FileChunk{existing}, flatTestChunks(2*ManifestBatch+50)...)
+
+	result, _ := MaybeManifestize(store.save, store.delete, chunks)
+
+	if len(result) != len(chunks) {
+		t.Fatalf("expected original %d chunks, got %d", len(chunks), len(result))
+	}
+	if result[0].FileId != "m,1" || !result[0].IsChunkManifest {
+		t.Fatalf("existing manifest dropped: %+v", result[0])
+	}
+	if len(store.deleted) != 1 || store.deleted[0].FileId != "2,1" {
+		t.Fatalf("expected the first saved blob deleted, got %+v", store.deleted)
+	}
+}
+
+// Without a deleter the fold still falls back to the caller's list; the blobs
+// it saved are only reported.
+func TestMaybeManifestizeRollbackWithoutDeleter(t *testing.T) {
+	store := &fakeManifestStore{failOn: 2}
+	chunks := flatTestChunks(2*ManifestBatch + 50)
+
+	result, err := MaybeManifestize(store.save, nil, chunks)
+	if err == nil {
+		t.Fatal("expected the failed save to be reported")
+	}
+	if len(result) != len(chunks) || HasChunkManifest(result) {
+		t.Fatalf("expected fallback to %d flat chunks, got %d", len(chunks), len(result))
+	}
+}
diff --git a/weed/filer/filechunk_manifest_test.go b/weed/filer/filechunk_manifest_test.go
index 70bdb253de..63f333266d 100644
--- a/weed/filer/filechunk_manifest_test.go
+++ b/weed/filer/filechunk_manifest_test.go
@@ -6,12 +6,19 @@ import (
 	"fmt"
 	"io"
 	"math"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"sync/atomic"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/proto"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
 func TestDoMaybeManifestize(t *testing.T) {
@@ -79,9 +86,9 @@ func TestDoMaybeManifestize(t *testing.T) {
 	}
 }
 
-// A mid-run merge failure must still return every chunk that exists: the
-// manifests already written plus the chunks not yet wrapped, so callers can
-// delete or keep a complete set.
+// A mid-run merge failure returns the caller's list untouched: never a
+// half-folded list, which would drop manifests the caller came in with. The
+// MaybeManifestize wrapper deletes the manifest blobs already saved.
 func TestDoMaybeManifestizePartialFailure(t *testing.T) {
 	inputs := []*filer_pb.FileChunk{
 		{FileId: "0", IsChunkManifest: true},
@@ -102,13 +109,7 @@ func TestDoMaybeManifestizePartialFailure(t *testing.T) {
 	if err == nil {
 		t.Fatalf("doMaybeManifestize() expected an error")
 	}
-	expected := []*filer_pb.FileChunk{
-		{FileId: "0", IsChunkManifest: true},
-		{FileId: "12", IsChunkManifest: true},
-		{FileId: "3", IsChunkManifest: false},
-		{FileId: "4", IsChunkManifest: false},
-	}
-	assertEqualChunks(t, expected, actual)
+	assertEqualChunks(t, inputs, actual)
 
 }
 
@@ -271,6 +272,47 @@ func TestManifestRoundTripPreservesChunks(t *testing.T) {
 	}
 }
 
+func TestMaybeManifestizePreservesSSEMetadata(t *testing.T) {
+	for _, sseType := range []filer_pb.SSEType{
+		filer_pb.SSEType_SSE_C,
+		filer_pb.SSEType_SSE_KMS,
+		filer_pb.SSEType_SSE_S3,
+	} {
+		t.Run(sseType.String(), func(t *testing.T) {
+			store := newTestManifestStore()
+			chunks := make([]*filer_pb.FileChunk, ManifestBatch+1)
+			for i := range chunks {
+				chunks[i] = testChunk(1, uint64(i+1), uint32(i+1), int64(i*8), 8, int64(i+1))
+				chunks[i].SseType = sseType
+				chunks[i].SseMetadata = []byte(fmt.Sprintf("metadata-%d", i))
+			}
+
+			packed, err := MaybeManifestize(store.saveFunc(), nil, chunks)
+			if err != nil {
+				t.Fatal(err)
+			}
+			manifests, remainder := SeparateManifestChunks(packed)
+			if len(manifests) != 1 || len(remainder) != 1 {
+				t.Fatalf("got %d manifests and %d remaining chunks", len(manifests), len(remainder))
+			}
+
+			resolved, err := store.resolve(manifests[0])
+			if err != nil {
+				t.Fatal(err)
+			}
+			for i, chunk := range resolved {
+				if chunk.GetSseType() != sseType {
+					t.Fatalf("chunk %d SSE type = %s, want %s", i, chunk.GetSseType(), sseType)
+				}
+				wantMetadata := fmt.Sprintf("metadata-%d", i)
+				if string(chunk.GetSseMetadata()) != wantMetadata {
+					t.Fatalf("chunk %d SSE metadata = %q, want %q", i, chunk.GetSseMetadata(), wantMetadata)
+				}
+			}
+		})
+	}
+}
+
 // ---------------------------------------------------------------------------
 // Compact resolved overlapping manifests: older sub-chunks become garbage
 // ---------------------------------------------------------------------------
@@ -322,7 +364,10 @@ func TestCompactResolvedOverlappingManifests(t *testing.T) {
 	}
 
 	// CompactFileChunks on resolved sub-chunks (nil lookupFn is fine for non-manifest chunks)
-	compacted, garbage := CompactFileChunks(context.Background(), nil, dataChunks)
+	compacted, garbage, err := CompactFileChunks(context.Background(), nil, dataChunks)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if len(compacted) != 3 {
 		t.Fatalf("expected 3 compacted chunks, got %d", len(compacted))
@@ -471,7 +516,10 @@ func TestCompactMultipleOverlappingManifestGenerations(t *testing.T) {
 	}
 
 	// Compact: only generation 5 (the newest 3 chunks) should survive
-	compacted, garbage := CompactFileChunks(context.Background(), nil, dataChunks)
+	compacted, garbage, err := CompactFileChunks(context.Background(), nil, dataChunks)
+	if err != nil {
+		t.Fatal(err)
+	}
 	if len(compacted) != 3 {
 		t.Errorf("expected 3 compacted (gen 5), got %d", len(compacted))
 	}
@@ -536,3 +584,252 @@ func TestManifestBloatDetection(t *testing.T) {
 		}
 	}
 }
+
+// countingInvalidator stands in for the vidMap cache a mount or filer hands to
+// manifest resolution, recording how often the locations were dropped.
+type countingInvalidator struct {
+	invalidations atomic.Int32
+}
+
+func (inv *countingInvalidator) InvalidateCache(fileId string) {
+	inv.invalidations.Add(1)
+}
+
+// stagedLookup returns staleUrls once and freshUrls afterwards, the way a
+// vidMapClient re-reads the master once InvalidateCache has dropped the entry.
+type stagedLookup struct {
+	staleUrls []string
+	freshUrls []string
+	calls     atomic.Int32
+}
+
+func (l *stagedLookup) lookup(ctx context.Context, fileId string) ([]string, error) {
+	if l.calls.Add(1) == 1 {
+		return l.staleUrls, nil
+	}
+	return l.freshUrls, nil
+}
+
+func manifestServer(t *testing.T, manifestBytes []byte) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Length", strconv.Itoa(len(manifestBytes)))
+		w.Write(manifestBytes)
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func fetchManifestBuffer(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	bytesBuffer := bytesBufferPool.Get().(*bytes.Buffer)
+	bytesBuffer.Reset()
+	t.Cleanup(func() { bytesBufferPool.Put(bytesBuffer) })
+	return bytesBuffer
+}
+
+// TestFetchWholeChunkRetriesFreshLocations covers the mount reading a multipart
+// file whose manifest volume has moved: the cached location is dead, so the
+// fetch has to drop it and come back with what the master knows now. The stale
+// server streams a prefix before dying, which the retry must not keep.
+func TestFetchWholeChunkRetriesFreshLocations(t *testing.T) {
+	manifestBytes, err := proto.Marshal(&filer_pb.FileChunkManifest{
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: "100,abc", Offset: 0, Size: 8},
+			{FileId: "101,def", Offset: 8, Size: 8},
+		},
+	})
+	assert.NoError(t, err)
+
+	staleSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Length", strconv.Itoa(len(manifestBytes)+64))
+		w.Write([]byte("garbage-from-stale-server"))
+		w.(http.Flusher).Flush()
+		panic(http.ErrAbortHandler)
+	}))
+	defer staleSrv.Close()
+
+	lookup := &stagedLookup{
+		staleUrls: []string{staleSrv.URL + "/5,stale"},
+		freshUrls: []string{manifestServer(t, manifestBytes).URL + "/5,stale"},
+	}
+	inv := &countingInvalidator{}
+	bytesBuffer := fetchManifestBuffer(t)
+
+	assert.NoError(t, fetchWholeChunk(context.Background(), bytesBuffer, lookup.lookup, "5,stale", nil, false, inv, nil))
+	assert.Equal(t, int32(1), inv.invalidations.Load())
+	assert.Equal(t, int32(2), lookup.calls.Load())
+
+	// the buffer must hold the fresh manifest alone, not the stale prefix ahead of it
+	decoded := &filer_pb.FileChunkManifest{}
+	assert.NoError(t, proto.Unmarshal(bytesBuffer.Bytes(), decoded))
+	assertEqualChunks(t, []*filer_pb.FileChunk{
+		{FileId: "100,abc", Offset: 0, Size: 8},
+		{FileId: "101,def", Offset: 8, Size: 8},
+	}, decoded.Chunks)
+}
+
+// TestFetchWholeChunkRefreshesLocationsAfterPartialFailure is the manifest read
+// whose cached list still names a dead replica ahead of a live one: the read
+// succeeds, and the cached entry must still be dropped and looked up again.
+func TestFetchWholeChunkRefreshesLocationsAfterPartialFailure(t *testing.T) {
+	manifestBytes, err := proto.Marshal(&filer_pb.FileChunkManifest{
+		Chunks: []*filer_pb.FileChunk{{FileId: "100,abc", Offset: 0, Size: 8}},
+	})
+	assert.NoError(t, err)
+
+	liveURL := manifestServer(t, manifestBytes).URL + "/5,abc"
+	dead := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	deadURL := dead.URL
+	dead.Close()
+
+	lookup := &stagedLookup{
+		staleUrls: []string{deadURL + "/5,abc", liveURL},
+		freshUrls: []string{liveURL},
+	}
+	inv := &countingInvalidator{}
+	bytesBuffer := fetchManifestBuffer(t)
+
+	assert.NoError(t, fetchWholeChunk(context.Background(), bytesBuffer, lookup.lookup, "5,abc", nil, false, inv, nil))
+	assert.Equal(t, int32(1), inv.invalidations.Load())
+	assert.Equal(t, int32(2), lookup.calls.Load())
+	decoded := &filer_pb.FileChunkManifest{}
+	assert.NoError(t, proto.Unmarshal(bytesBuffer.Bytes(), decoded))
+	assertEqualChunks(t, []*filer_pb.FileChunk{{FileId: "100,abc", Offset: 0, Size: 8}}, decoded.Chunks)
+}
+
+// TestFetchWholeChunkWithoutInvalidator keeps the old behavior for callers whose
+// lookup function has no cache to drop: the fetch error surfaces as it is.
+func TestFetchWholeChunkWithoutInvalidator(t *testing.T) {
+	failSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer failSrv.Close()
+
+	lookup := &stagedLookup{
+		staleUrls: []string{failSrv.URL + "/5,abc"},
+		freshUrls: []string{"http://unused:8080/5,abc"},
+	}
+
+	assert.Error(t, fetchWholeChunk(context.Background(), fetchManifestBuffer(t), lookup.lookup, "5,abc", nil, false, nil, nil))
+	assert.Equal(t, int32(1), lookup.calls.Load())
+}
+
+// TestFetchWholeChunkUnchangedLocations guards against looping: when the master
+// still reports the servers that just failed, there is nothing new to try.
+func TestFetchWholeChunkUnchangedLocations(t *testing.T) {
+	failSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer failSrv.Close()
+
+	lookup := &stagedLookup{
+		staleUrls: []string{failSrv.URL + "/5,abc"},
+		freshUrls: []string{failSrv.URL + "/5,abc"},
+	}
+	inv := &countingInvalidator{}
+
+	assert.Error(t, fetchWholeChunk(context.Background(), fetchManifestBuffer(t), lookup.lookup, "5,abc", nil, false, inv, nil))
+	assert.Equal(t, int32(2), lookup.calls.Load())
+	assert.Equal(t, int32(1), inv.invalidations.Load())
+}
+
+// TestFetchWholeChunkCancelledKeepsLocations checks that a caller walking away
+// mid-read does not cost every other reader a master round trip.
+func TestFetchWholeChunkCancelledKeepsLocations(t *testing.T) {
+	lookup := &stagedLookup{
+		staleUrls: []string{"http://unused:8080/5,abc"},
+		freshUrls: []string{"http://elsewhere:8080/5,abc"},
+	}
+	inv := &countingInvalidator{}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	err := fetchWholeChunk(ctx, fetchManifestBuffer(t), lookup.lookup, "5,abc", nil, false, inv, nil)
+	assert.ErrorIs(t, err, context.Canceled)
+	assert.Equal(t, int32(0), inv.invalidations.Load())
+	assert.Equal(t, int32(1), lookup.calls.Load())
+
+	// the cancellation must survive the wrapping ResolveOneChunkManifest does,
+	// or callers cannot tell a dead volume server from their own abort
+	manifestChunk := &filer_pb.FileChunk{FileId: "5,abc", IsChunkManifest: true}
+	_, resolveErr := ResolveOneChunkManifest(ctx, lookup.lookup, manifestChunk, inv)
+	assert.ErrorIs(t, resolveErr, context.Canceled)
+
+	// volume.fsck resolves manifests with no invalidator and still has to tell
+	// its own abort from a corrupt manifest, so the nil path keeps the identity
+	noInvalidator := retryFetchWithFreshLocations(ctx, nil, lookup.lookup, "5,abc", nil, fmt.Errorf("stale server said no"), func([]string) error {
+		t.Fatal("refetch must not run on a cancelled read")
+		return nil
+	})
+	assert.ErrorIs(t, noInvalidator, context.Canceled)
+}
+
+// TestFetchWholeChunkUsesProvidedFilerJwt covers a replicating reader whose
+// source filer authenticates proxied downloads with its own read key: the
+// supplied provider's token must reach the server, not the process-wide one.
+func TestFetchWholeChunkUsesProvidedFilerJwt(t *testing.T) {
+	manifestBytes, err := proto.Marshal(&filer_pb.FileChunkManifest{
+		Chunks: []*filer_pb.FileChunk{{FileId: "100,abc", Offset: 0, Size: 8}},
+	})
+	assert.NoError(t, err)
+
+	gotAuth := make(chan string, 1)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case gotAuth <- r.Header.Get("Authorization"):
+		default:
+		}
+		w.Header().Set("Content-Length", strconv.Itoa(len(manifestBytes)))
+		w.Write(manifestBytes)
+	}))
+	t.Cleanup(srv.Close)
+
+	lookup := func(ctx context.Context, fileId string) ([]string, error) {
+		return []string{srv.URL + "/?" + util_http.ProxyChunkIdParam + "=" + fileId}, nil
+	}
+	jwtFn := func(isWrite bool) security.EncodedJwt {
+		assert.False(t, isWrite)
+		return "side-read-jwt"
+	}
+	bytesBuffer := fetchManifestBuffer(t)
+	require.NoError(t, fetchWholeChunk(context.Background(), bytesBuffer, lookup, "5,abc", nil, false, nil, jwtFn))
+	select {
+	case auth := <-gotAuth:
+		assert.Equal(t, security.BearerPrefix+"side-read-jwt", auth)
+	default:
+		t.Fatal("the proxied fetch never reached the handler")
+	}
+
+	// non-proxy URLs keep the volume-server credential and never call the provider
+	volumeURL := manifestServer(t, manifestBytes).URL + "/5,abc"
+	volumeLookup := func(ctx context.Context, fileId string) ([]string, error) {
+		return []string{volumeURL}, nil
+	}
+	bytesBuffer.Reset()
+	assert.NoError(t, fetchWholeChunk(context.Background(), bytesBuffer, volumeLookup, "5,abc", nil, false, nil, func(bool) security.EncodedJwt {
+		t.Fatal("provider must not be consulted for a volume url")
+		return ""
+	}))
+}
+
+// A completed fetch whose destination write failed is a failed copy, not a
+// short success: the caller must see the write error, or a temp disk filling
+// mid-copy would still upload the truncated file.
+func TestRetriedStreamFetchChunkDataReportsWriteError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("0123456789"))
+	}))
+	t.Cleanup(srv.Close)
+
+	written, err := retriedStreamFetchChunkData(context.Background(), &failOnWrite{}, []string{srv.URL + "/5,abc"}, "", nil, false, true, 0, 0, nil)
+	assert.Error(t, err)
+	assert.Zero(t, written)
+}
+
+type failOnWrite struct{}
+
+func (w *failOnWrite) Write(p []byte) (int, error) {
+	return 0, fmt.Errorf("no space left")
+}
diff --git a/weed/filer/filechunk_section.go b/weed/filer/filechunk_section.go
index dd7c2ea48c..204a5badd7 100644
--- a/weed/filer/filechunk_section.go
+++ b/weed/filer/filechunk_section.go
@@ -19,6 +19,15 @@ type FileChunkSection struct {
 	isPrepared       bool
 }
 
+func sectionBounds(sectionIndex SectionIndex, fileSize int64) (start, stop int64) {
+	start = int64(sectionIndex) * SectionSize
+	stop = fileSize
+	if sectionIndex < SectionIndex(fileSize/SectionSize) {
+		stop = start + SectionSize
+	}
+	return
+}
+
 func NewFileChunkSection(si SectionIndex) *FileChunkSection {
 	return &FileChunkSection{
 		sectionIndex: si,
@@ -67,13 +76,15 @@ func (section *FileChunkSection) setupForRead(ctx context.Context, group *ChunkG
 	section.lock.Lock()
 	defer section.lock.Unlock()
 
+	sectionStart, sectionStop := sectionBounds(section.sectionIndex, fileSize)
+
 	if section.isPrepared {
 		section.reader.fileSize = fileSize
 		return
 	}
 
 	if section.visibleIntervals == nil {
-		section.visibleIntervals = readResolvedChunks(section.chunks, int64(section.sectionIndex)*SectionSize, (int64(section.sectionIndex)+1)*SectionSize)
+		section.visibleIntervals = readResolvedChunks(section.chunks, sectionStart, sectionStop)
 		section.chunks, _ = SeparateGarbageChunks(section.visibleIntervals, section.chunks)
 		if section.reader != nil {
 			_ = section.reader.Close()
@@ -81,11 +92,11 @@ func (section *FileChunkSection) setupForRead(ctx context.Context, group *ChunkG
 		}
 	}
 	if section.chunkViews == nil {
-		section.chunkViews = ViewFromVisibleIntervals(section.visibleIntervals, int64(section.sectionIndex)*SectionSize, (int64(section.sectionIndex)+1)*SectionSize)
+		section.chunkViews = ViewFromVisibleIntervals(section.visibleIntervals, sectionStart, sectionStop)
 	}
 
 	if section.reader == nil {
-		section.reader = NewChunkReaderAtFromClient(ctx, group.readerCache, section.chunkViews, min(int64(section.sectionIndex+1)*SectionSize, fileSize), group.GetPrefetchCount())
+		section.reader = NewChunkReaderAtFromClient(ctx, group.readerCache, section.chunkViews, sectionStop, group.GetPrefetchCount())
 	}
 
 	section.isPrepared = true
@@ -113,7 +124,7 @@ func (section *FileChunkSection) DataStartOffset(ctx context.Context, group *Chu
 			continue
 		}
 		if offset < visible.start {
-			return offset
+			return visible.start
 		}
 		return offset
 	}
diff --git a/weed/filer/filechunks.go b/weed/filer/filechunks.go
index 6e9ec3f218..835c717f6c 100644
--- a/weed/filer/filechunks.go
+++ b/weed/filer/filechunks.go
@@ -63,9 +63,15 @@ func ETagChunks(chunks []*filer_pb.FileChunk) (etag string) {
 	return finalETag
 }
 
-func CompactFileChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk) (compacted, garbage []*filer_pb.FileChunk) {
+// CompactFileChunks splits chunks into those still visible and those fully
+// covered by newer writes. It fails if the chunk manifests cannot be resolved,
+// including when ctx is cancelled.
+func CompactFileChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk) (compacted, garbage []*filer_pb.FileChunk, err error) {
 
-	visibles, _ := NonOverlappingVisibleIntervals(ctx, lookupFileIdFn, chunks, 0, math.MaxInt64)
+	visibles, err := NonOverlappingVisibleIntervals(ctx, lookupFileIdFn, chunks, 0, math.MaxInt64)
+	if err != nil {
+		return nil, nil, err
+	}
 
 	compacted, garbage = SeparateGarbageChunks(visibles, chunks)
 
@@ -73,6 +79,9 @@ func CompactFileChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileId
 }
 
 func SeparateGarbageChunks(visibles *IntervalList[*VisibleInterval], chunks []*filer_pb.FileChunk) (compacted []*filer_pb.FileChunk, garbage []*filer_pb.FileChunk) {
+	if visibles == nil {
+		return chunks, nil
+	}
 	fileIds := make(map[string]bool)
 	for x := visibles.Front(); x != nil; x = x.Next {
 		interval := x.Value
@@ -100,13 +109,13 @@ func FindGarbageChunks(visibles *IntervalList[*VisibleInterval], start int64, st
 	return
 }
 
-func MinusChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, as, bs []*filer_pb.FileChunk) (delta []*filer_pb.FileChunk, err error) {
+func MinusChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, as, bs []*filer_pb.FileChunk, invalidator CacheInvalidator) (delta []*filer_pb.FileChunk, err error) {
 
-	aData, aMeta, aErr := ResolveChunkManifest(ctx, lookupFileIdFn, as, 0, math.MaxInt64)
+	aData, aMeta, aErr := ResolveChunkManifest(ctx, lookupFileIdFn, as, 0, math.MaxInt64, invalidator)
 	if aErr != nil {
 		return nil, aErr
 	}
-	bData, bMeta, bErr := ResolveChunkManifest(ctx, lookupFileIdFn, bs, 0, math.MaxInt64)
+	bData, bMeta, bErr := ResolveChunkManifest(ctx, lookupFileIdFn, bs, 0, math.MaxInt64, invalidator)
 	if bErr != nil {
 		return nil, bErr
 	}
@@ -185,11 +194,26 @@ func (cv *ChunkView) IsFullChunk() bool {
 	return cv.OffsetInChunk == 0 && cv.ViewSize == cv.ChunkSize
 }
 
-func ViewFromChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk, offset int64, size int64) (chunkViews *IntervalList[*ChunkView]) {
+// CanRangeFetch reports whether fetching just the view's byte range avoids
+// reading more than the view needs. Ciphered and compressed chunks are
+// stored and served whole — a range on either still costs a full read plus
+// decrypt or decompress on the volume server — so partial views of them
+// take the shared whole-chunk path instead.
+func (cv *ChunkView) CanRangeFetch() bool {
+	return cv.CipherKey == nil && !cv.IsGzipped
+}
 
-	visibles, _ := NonOverlappingVisibleIntervals(ctx, lookupFileIdFn, chunks, offset, offset+size)
+// ViewFromChunks returns the views of chunks that cover [offset, offset+size).
+// It fails if the chunk manifests cannot be resolved, including when ctx is
+// cancelled.
+func ViewFromChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk, offset int64, size int64) (chunkViews *IntervalList[*ChunkView], err error) {
 
-	return ViewFromVisibleIntervals(visibles, offset, size)
+	visibles, err := NonOverlappingVisibleIntervals(ctx, lookupFileIdFn, chunks, offset, offset+size)
+	if err != nil {
+		return nil, err
+	}
+
+	return ViewFromVisibleIntervals(visibles, offset, size), nil
 
 }
 
@@ -204,6 +228,9 @@ func ViewFromVisibleIntervals(visibles *IntervalList[*VisibleInterval], offset i
 	}
 
 	chunkViews = NewIntervalList[*ChunkView]()
+	if visibles == nil {
+		return chunkViews
+	}
 	for x := visibles.Front(); x != nil; x = x.Next {
 		chunk := x.Value
 
@@ -271,7 +298,7 @@ func MergeIntoChunkViews(chunkViews *IntervalList[*ChunkView], start int64, stop
 // If the file chunk content is a chunk manifest
 func NonOverlappingVisibleIntervals(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk, startOffset int64, stopOffset int64) (visibles *IntervalList[*VisibleInterval], err error) {
 
-	chunks, _, err = ResolveChunkManifest(ctx, lookupFileIdFn, chunks, startOffset, stopOffset)
+	chunks, _, err = ResolveChunkManifest(ctx, lookupFileIdFn, chunks, startOffset, stopOffset, nil)
 	if err != nil {
 		return
 	}
diff --git a/weed/filer/filechunks2_test.go b/weed/filer/filechunks2_test.go
index 9c8a916e6a..e8b1f39d2d 100644
--- a/weed/filer/filechunks2_test.go
+++ b/weed/filer/filechunks2_test.go
@@ -66,7 +66,10 @@ func TestCompactFileChunksRealCase(t *testing.T) {
 
 	printChunks("before", chunks)
 
-	compacted, garbage := CompactFileChunks(context.Background(), nil, chunks)
+	compacted, garbage, err := CompactFileChunks(context.Background(), nil, chunks)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	printChunks("compacted", compacted)
 	printChunks("garbage", garbage)
diff --git a/weed/filer/filechunks_cancel_test.go b/weed/filer/filechunks_cancel_test.go
new file mode 100644
index 0000000000..689f9478d6
--- /dev/null
+++ b/weed/filer/filechunks_cancel_test.go
@@ -0,0 +1,58 @@
+package filer
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+// cancelledChunks returns a cancelled context and plain data chunks. Resolving
+// chunks under a cancelled context fails even without manifests, so these
+// exercise the error path with no lookup function.
+func cancelledChunks() (context.Context, []*filer_pb.FileChunk) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	return ctx, []*filer_pb.FileChunk{
+		{FileId: "1,01", Offset: 0, Size: 100, ModifiedTsNs: 1},
+		{FileId: "1,02", Offset: 0, Size: 100, ModifiedTsNs: 2},
+	}
+}
+
+func TestCompactFileChunksCancelledContext(t *testing.T) {
+	ctx, chunks := cancelledChunks()
+
+	compacted, garbage, err := CompactFileChunks(ctx, nil, chunks)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("err = %v, want context.Canceled", err)
+	}
+	if compacted != nil || garbage != nil {
+		t.Fatalf("compacted = %v, garbage = %v, want both nil on error", compacted, garbage)
+	}
+}
+
+func TestViewFromChunksCancelledContext(t *testing.T) {
+	ctx, chunks := cancelledChunks()
+
+	views, err := ViewFromChunks(ctx, nil, chunks, 0, 100)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("err = %v, want context.Canceled", err)
+	}
+	if views != nil {
+		t.Fatalf("views = %v, want nil on error", views)
+	}
+}
+
+func TestChunkStreamReaderCancelledContext(t *testing.T) {
+	ctx, chunks := cancelledChunks()
+
+	reader := NewChunkStreamReaderFromLookup(ctx, nil, chunks)
+	n, err := reader.Read(make([]byte, 10))
+	if n != 0 || !errors.Is(err, context.Canceled) {
+		t.Fatalf("Read = %d, %v, want 0, context.Canceled", n, err)
+	}
+	if !errors.Is(reader.SourceError(), context.Canceled) {
+		t.Fatalf("SourceError = %v, want context.Canceled", reader.SourceError())
+	}
+}
diff --git a/weed/filer/filechunks_test.go b/weed/filer/filechunks_test.go
index 4ae7d61334..81eed9607a 100644
--- a/weed/filer/filechunks_test.go
+++ b/weed/filer/filechunks_test.go
@@ -22,7 +22,10 @@ func TestCompactFileChunks(t *testing.T) {
 		{Offset: 110, Size: 200, FileId: "jkl", ModifiedTsNs: 300},
 	}
 
-	compacted, garbage := CompactFileChunks(context.Background(), nil, chunks)
+	compacted, garbage, err := CompactFileChunks(context.Background(), nil, chunks)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if len(compacted) != 3 {
 		t.Fatalf("unexpected compacted: %d", len(compacted))
@@ -55,7 +58,10 @@ func TestCompactFileChunks2(t *testing.T) {
 		})
 	}
 
-	compacted, garbage := CompactFileChunks(context.Background(), nil, chunks)
+	compacted, garbage, err := CompactFileChunks(context.Background(), nil, chunks)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if len(compacted) != 4 {
 		t.Fatalf("unexpected compacted: %d", len(compacted))
@@ -427,7 +433,10 @@ func TestChunksReading(t *testing.T) {
 			// continue
 		}
 		log.Printf("++++++++++ read test case %d ++++++++++++++++++++", i)
-		chunks := ViewFromChunks(context.Background(), nil, testcase.Chunks, testcase.Offset, testcase.Size)
+		chunks, err := ViewFromChunks(context.Background(), nil, testcase.Chunks, testcase.Offset, testcase.Size)
+		if err != nil {
+			t.Fatal(err)
+		}
 		x := -1
 		for c := chunks.Front(); c != nil; c = c.Next {
 			x++
@@ -474,7 +483,9 @@ func BenchmarkCompactFileChunks(b *testing.B) {
 	}
 
 	for n := 0; n < b.N; n++ {
-		CompactFileChunks(context.Background(), nil, chunks)
+		if _, _, err := CompactFileChunks(context.Background(), nil, chunks); err != nil {
+			b.Fatal(err)
+		}
 	}
 }
 
@@ -563,9 +574,45 @@ func TestCompactFileChunks3(t *testing.T) {
 		{Offset: 300, Size: 100, FileId: "def", ModifiedTsNs: 200},
 	}
 
-	compacted, _ := CompactFileChunks(context.Background(), nil, chunks)
+	compacted, _, err := CompactFileChunks(context.Background(), nil, chunks)
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	if len(compacted) != 4 {
 		t.Fatalf("unexpected compacted: %d", len(compacted))
 	}
 }
+
+func TestSeparateGarbageChunksNilVisibles(t *testing.T) {
+	chunks := []*filer_pb.FileChunk{
+		{Offset: 10, Size: 100, FileId: "abc", ModifiedTsNs: 50},
+	}
+	compacted, garbage := SeparateGarbageChunks(nil, chunks)
+	if len(compacted) != 1 || len(garbage) != 0 {
+		t.Fatalf("expected fallback to original chunks with nil garbage")
+	}
+}
+
+func TestViewFromVisibleIntervalsNilVisibles(t *testing.T) {
+	views := ViewFromVisibleIntervals(nil, 0, 100)
+	if views == nil || views.Front() != nil {
+		t.Fatalf("expected empty interval list")
+	}
+}
+
+func TestViewFromChunksPropagatesError(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	chunks := []*filer_pb.FileChunk{
+		{Offset: 0, Size: 100, FileId: "abc", ModifiedTsNs: 50, IsChunkManifest: true},
+	}
+	views, err := ViewFromChunks(ctx, nil, chunks, 0, math.MaxInt64)
+	if err == nil {
+		t.Fatal("expected error on cancelled context")
+	}
+	if views != nil {
+		t.Fatalf("expected nil views on error, got %v", views)
+	}
+}
diff --git a/weed/filer/filer.go b/weed/filer/filer.go
index bd349af670..59e9bfc714 100644
--- a/weed/filer/filer.go
+++ b/weed/filer/filer.go
@@ -7,8 +7,12 @@ import (
 	"os"
 	"sort"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3bucket"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
@@ -17,8 +21,10 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 
 	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -41,38 +47,92 @@ var (
 )
 
 type Filer struct {
-	UniqueFilerId           int32
-	UniqueFilerEpoch        int32
-	Store                   VirtualFilerStore
-	MasterClient            *wdclient.MasterClient
-	fileIdDeletionQueue     *util.UnboundedQueue
-	GrpcDialOption          grpc.DialOption
-	DirBucketsPath          string
-	Cipher                  bool
-	LocalMetaLogBuffer      *log_buffer.LogBuffer
-	metaLogCollection       string
-	metaLogReplication      string
-	DefaultDiskType         string
-	MetaAggregator          *MetaAggregator
-	Signature               int32
-	FilerConf               *FilerConf
-	placementOverlay        PlacementOverlay
-	RemoteStorage           *FilerRemoteStorage
-	lazyFetchGroup          singleflight.Group
-	lazyListGroup           singleflight.Group
-	Dlm                     *lock_manager.DistributedLockManager
-	MaxFilenameLength       uint32
-	deletionQuit            chan struct{}
-	DeletionRetryQueue      *DeletionRetryQueue
-	EmptyFolderCleaner      *empty_folder_cleanup.EmptyFolderCleaner
-	EmptyFolderCleanupDelay time.Duration
-	persistedLogCache       *persistedLogCache
+	UniqueFilerId       int32
+	UniqueFilerEpoch    int32
+	Store               VirtualFilerStore
+	MasterClient        *wdclient.MasterClient
+	FileIdDeletionQueue *util.UnboundedQueue
+	GrpcDialOption      grpc.DialOption
+	DirBucketsPath      string
+	Cipher              bool
+	LocalMetaLogBuffer  *log_buffer.LogBuffer
+	metaLogCollection   string
+	metaLogReplication  string
+	// Override where system metadata-log chunks are assigned, keeping the
+	// internal log out of the default collection; empty keeps today's
+	// behaviour. Set via viper: filer.options.metaLog.collection / .replication.
+	metaLogTargetCollection       string
+	metaLogTargetReplication      string
+	DefaultDiskType               string
+	MetaAggregator                *MetaAggregator
+	Signature                     int32
+	FilerConf                     *FilerConf
+	placementOverlay              PlacementOverlay
+	RemoteStorage                 *FilerRemoteStorage
+	BuildGuardedRemoteClient      RemoteStorageClientBuilder
+	AllowUntrustedRemoteEndpoints bool
+	lazyFetchGroup                singleflight.Group
+	lazyListGroup                 singleflight.Group
+	Dlm                           *lock_manager.DistributedLockManager
+	MaxFilenameLength             uint32
+	deletionQuit                  chan struct{}
+	DeletionRetryQueue            *DeletionRetryQueue
+	EmptyFolderCleaner            *empty_folder_cleanup.EmptyFolderCleaner
+	EmptyFolderCleanupDelay       time.Duration
+	persistedLogCache             *persistedLogCache
+	metaLogInflight               metaLogInflight
+	remoteTombstones              *remoteDeletionTombstones
+	// EntryLockTable serializes mutations per entry path. The filer server
+	// holds it across local read-modify-write mutations and the meta
+	// aggregator across a replayed peer change's check-and-apply, so the two
+	// cannot interleave on the same path.
+	EntryLockTable *util.LockTable[util.FullPath]
+	// remoteTombstonesDone, when non-nil, is closed once the startup tombstone
+	// rebuild finishes; lazy remote reads wait on it so a pending delete
+	// cannot resurrect in the gap.
+	remoteTombstonesDone atomic.Pointer[chan struct{}]
+
+	// Durable deletion ledger (see filer_deletion_persist.go). The set of
+	// fileIds that still need deleting but are not yet confirmed gone, mirrored
+	// to the store so a restart does not leak chunks. Guarded by
+	// deletionLedgerLock; nil-safe for Filer literals in tests.
+	// pendingDeletions maps each id to its enqueue epoch so an expiry-forget
+	// cannot erase a re-queued id.
+	deletionLedgerLock  sync.Mutex
+	pendingDeletions    map[string]uint64
+	deletionSeq         uint64
+	deletionLedgerDirty bool
+	deletionLedgerParts int
+	deletionLedgerGen   int
+	// deletionLedgerStale holds orphan part keys from abandoned multipart
+	// writes, retried on the next snapshot.
+	deletionLedgerStale []string
+	// deletionSnapshotLock serializes ledger writes in copy order so an
+	// in-flight timer snapshot cannot overwrite a newer shutdown snapshot.
+	deletionSnapshotLock sync.Mutex
+	// deletionLedgerBlocked is set when the startup ledger read fails: the
+	// persisted set is then unknown, so snapshots retry the read instead of
+	// overwriting the unread ledger with a partial set.
+	deletionLedgerBlocked atomic.Bool
+	deletionLedgerFlush   chan struct{}
+	// metaTsPending holds per-path commit records whose KV write failed,
+	// keyed by path; ordering reads consult it until the retry lands them
+	// (see meta_path_ts.go). metaTsRepairing marks paths with a live
+	// repair goroutine so failures neither strand a record nor pile on.
+	metaTsPending   sync.Map
+	metaTsRepairing sync.Map
+	// flushCtx is the context metadata-log flushes append under. It stays
+	// live for the process lifetime and is cancelled once during Shutdown,
+	// bounding every retry - in-flight and queued alike - to one deadline.
+	// Nil for Filer literals built without NewFiler.
+	flushCtx    context.Context
+	flushCancel context.CancelFunc
 }
 
 func NewFiler(masters pb.ServerDiscovery, grpcDialOption grpc.DialOption, filerHost pb.ServerAddress, filerGroup string, collection string, replication string, dataCenter string, maxFilenameLength uint32, notifyFn func()) *Filer {
 	f := &Filer{
 		MasterClient:        wdclient.NewMasterClient(grpcDialOption, filerGroup, cluster.FilerType, filerHost, dataCenter, "", masters),
-		fileIdDeletionQueue: util.NewUnboundedQueue(),
+		FileIdDeletionQueue: util.NewUnboundedQueue(),
 		GrpcDialOption:      grpcDialOption,
 		FilerConf:           NewFilerConf(),
 		RemoteStorage:       NewFilerRemoteStorage(),
@@ -80,9 +140,13 @@ func NewFiler(masters pb.ServerDiscovery, grpcDialOption grpc.DialOption, filerH
 		Dlm:                 lock_manager.NewDistributedLockManager(filerHost),
 		MaxFilenameLength:   maxFilenameLength,
 		deletionQuit:        make(chan struct{}),
+		deletionLedgerFlush: make(chan struct{}, 1),
 		DeletionRetryQueue:  NewDeletionRetryQueue(),
 		persistedLogCache:   newPersistedLogCache(persistedLogCacheMaxBytes),
+		remoteTombstones:    newRemoteDeletionTombstones(),
+		EntryLockTable:      util.NewLockTable[util.FullPath](),
 	}
+	f.flushCtx, f.flushCancel = context.WithCancel(context.Background())
 	if f.UniqueFilerId < 0 {
 		f.UniqueFilerId = -f.UniqueFilerId
 	}
@@ -97,6 +161,19 @@ func NewFiler(masters pb.ServerDiscovery, grpcDialOption grpc.DialOption, filerH
 	f.metaLogCollection = collection
 	f.metaLogReplication = replication
 
+	// Optional override for where the system metadata-log chunks land, so
+	// operators can keep internal log volumes out of the default collection.
+	// Unset (""), this changes nothing: meta logs keep following the filer
+	// default exactly as before.
+	v := util.GetViper()
+	v.SetDefault("filer.options.metaLog.collection", "")
+	v.SetDefault("filer.options.metaLog.replication", "")
+	f.metaLogTargetCollection = v.GetString("filer.options.metaLog.collection")
+	f.metaLogTargetReplication = v.GetString("filer.options.metaLog.replication")
+	if f.metaLogTargetCollection != "" {
+		glog.V(0).Infof("system metadata logs will be stored in collection %q", f.metaLogTargetCollection)
+	}
+
 	if newPlacementOverlay != nil {
 		f.placementOverlay = newPlacementOverlay(f)
 	}
@@ -106,7 +183,14 @@ func NewFiler(masters pb.ServerDiscovery, grpcDialOption grpc.DialOption, filerH
 	return f
 }
 
-func (f *Filer) MaybeBootstrapFromOnePeer(self pb.ServerAddress, existingNodes []*master_pb.ClusterNodeUpdate, snapshotTime time.Time) (err error) {
+func (f *Filer) buildRemoteStorageClient(ctx context.Context, remoteConf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
+	if f.BuildGuardedRemoteClient != nil {
+		return f.BuildGuardedRemoteClient(ctx, remoteConf, f.AllowUntrustedRemoteEndpoints)
+	}
+	return remote_storage.GetRemoteStorage(remoteConf)
+}
+
+func (f *Filer) MaybeBootstrapFromOnePeer(ctx context.Context, self pb.ServerAddress, existingNodes []*master_pb.ClusterNodeUpdate, snapshotTime time.Time) (err error) {
 	if len(existingNodes) == 0 {
 		return
 	}
@@ -121,8 +205,13 @@ func (f *Filer) MaybeBootstrapFromOnePeer(self pb.ServerAddress, existingNodes [
 	glog.V(0).Infof("bootstrap from %v clientId:%d", earliestNode.Address, f.UniqueFilerId)
 
 	return pb.WithFilerClient(false, f.UniqueFilerId, pb.ServerAddress(earliestNode.Address), f.GrpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
-		return filer_pb.StreamBfs(client, "/", snapshotTime.UnixNano(), func(parentPath util.FullPath, entry *filer_pb.Entry) error {
-			return f.Store.InsertEntry(context.Background(), FromPbEntry(string(parentPath), entry))
+		return filer_pb.StreamBfs(ctx, client, "/", snapshotTime.UnixNano(), func(parentPath util.FullPath, pbEntry *filer_pb.Entry, entryTsNs int64) error {
+			entry := FromPbEntry(string(parentPath), pbEntry)
+			peerTsNs := entryTsNs
+			if peerTsNs == 0 {
+				peerTsNs = entry.Attr.Mtime.UnixNano()
+			}
+			return f.applyTraversedEntry(ctx, entry, peerTsNs)
 		})
 	})
 
@@ -142,6 +231,9 @@ func (f *Filer) AggregateFromPeers(self pb.ServerAddress, existingNodes []*maste
 	f.EmptyFolderCleaner = empty_folder_cleanup.NewEmptyFolderCleaner(f, f.Dlm.LockRing, self, f.DirBucketsPath, f.EmptyFolderCleanupDelay)
 
 	f.MetaAggregator = NewMetaAggregator(f, self, f.GrpcDialOption)
+	// The ring starts empty while peer history sits on disk: mark the pre-startFrom
+	// range evicted so a cursor there reads disk, not the ring's earliest entry.
+	f.MetaAggregator.MetaLogBuffer.MarkEvictedThrough(startFrom.UnixNano())
 	f.MasterClient.SetOnPeerUpdateFn(func(update *master_pb.ClusterNodeUpdate, startFrom time.Time) {
 		if update.NodeType != cluster.FilerType {
 			return
@@ -158,21 +250,132 @@ func (f *Filer) AggregateFromPeers(self pb.ServerAddress, existingNodes []*maste
 		glog.V(0).Infof("LockRing: applying master ring update v%d: %v", update.Version, servers)
 		f.Dlm.LockRing.SetSnapshot(servers, update.Version)
 	})
+	f.MasterClient.SetOnMasterChangeFn(func(previous, current pb.ServerAddress) {
+		glog.V(0).Infof("LockRing: master changed %s -> %s, resetting ring", previous, current)
+		f.Dlm.LockRing.Reset()
+	})
 
+	// Subscribe to the local filer first: its events reach the aggregated
+	// buffer only through this subscription, and the peer watermarks must
+	// account for it before any remote peer - a remotes-only watermark set
+	// would claim completeness without self. existingNodes can omit self
+	// (master registration races this bootstrap); duplicate adds are no-ops.
+	f.MetaAggregator.OnPeerUpdate(&master_pb.ClusterNodeUpdate{
+		NodeType: cluster.FilerType,
+		Address:  string(self),
+		IsAdd:    true,
+	}, startFrom)
 	for _, peerUpdate := range existingNodes {
 		f.MetaAggregator.OnPeerUpdate(peerUpdate, startFrom)
 	}
 
 }
 
-func (f *Filer) ListExistingPeerUpdates(ctx context.Context) (existingNodes []*master_pb.ClusterNodeUpdate) {
-	return cluster.ListExistingPeerUpdates(f.GetMaster(ctx), f.GrpcDialOption, f.MasterClient.FilerGroup, cluster.FilerType)
+// peerLookupTimeout bounds each master query so one unresponsive master
+// cannot stall the peer scan.
+const peerLookupTimeout = 10 * time.Second
+
+// leaderSettleTimeout bounds how long an empty peer list from the leader is
+// re-polled: a freshly elected leader may not yet have the filers' reconnects,
+// so an immediate empty answer can just mean membership has not migrated yet.
+// It must stay below the health window a fresh filer gets to start serving
+// (weed mini allows 6s) — a filerless cluster pays the whole window per start.
+const leaderSettleTimeout = 3 * time.Second
+const leaderSettleInterval = time.Second
+
+// ListExistingPeerUpdates returns the peer list to bootstrap from. The
+// leader's list is authoritative: after a leader change an old master keeps
+// its registrations until its streams end, so the longest answer is not
+// necessarily the current one. A non-empty answer from the leader wins; a
+// leader that is unreachable or reports an empty list falls back to the
+// fullest answer from the other masters. It returns an error when
+// no master answers, so a failed lookup is not mistaken for an empty cluster.
+func (f *Filer) ListExistingPeerUpdates(ctx context.Context) (existingNodes []*master_pb.ClusterNodeUpdate, err error) {
+	masters := f.MasterClient.ListMasters()
+	var queryErrs []error
+
+	var leader pb.ServerAddress
+	for _, master := range masters {
+		if ctx.Err() != nil {
+			break
+		}
+		lookupCtx, cancel := context.WithTimeout(ctx, peerLookupTimeout)
+		l, lookErr := cluster.LookupClusterLeader(lookupCtx, master, f.GrpcDialOption)
+		cancel()
+		if lookErr != nil {
+			queryErrs = append(queryErrs, lookErr)
+			continue
+		}
+		if l != "" {
+			leader = l
+			break
+		}
+	}
+	if leader != "" {
+		settleDeadline := time.Now().Add(leaderSettleTimeout)
+		for {
+			lookupCtx, cancel := context.WithTimeout(ctx, peerLookupTimeout)
+			nodes, listErr := cluster.ListExistingPeerUpdates(lookupCtx, leader, f.GrpcDialOption, f.MasterClient.FilerGroup, cluster.FilerType)
+			cancel()
+			if listErr != nil {
+				queryErrs = append(queryErrs, fmt.Errorf("list peers from leader %s: %w", leader, listErr))
+				break
+			}
+			if len(nodes) > 0 {
+				return nodes, nil
+			}
+			if ctx.Err() != nil || !time.Now().Before(settleDeadline) {
+				break
+			}
+			select {
+			case <-ctx.Done():
+			case <-time.After(leaderSettleInterval):
+			}
+		}
+	}
+
+	answered := false
+	for _, master := range masters {
+		if ctx.Err() != nil {
+			break
+		}
+		lookupCtx, cancel := context.WithTimeout(ctx, peerLookupTimeout)
+		nodes, listErr := cluster.ListExistingPeerUpdates(lookupCtx, master, f.GrpcDialOption, f.MasterClient.FilerGroup, cluster.FilerType)
+		cancel()
+		if listErr != nil {
+			queryErrs = append(queryErrs, listErr)
+			continue
+		}
+		answered = true
+		if len(nodes) > len(existingNodes) {
+			existingNodes = nodes
+		}
+	}
+	if !answered {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, ctxErr
+		}
+		if err = errors.Join(queryErrs...); err == nil {
+			err = fmt.Errorf("no masters configured")
+		}
+		return nil, fmt.Errorf("list existing peers: %w", err)
+	}
+	return existingNodes, nil
 }
 
 func (f *Filer) SetStore(store FilerStore) (isFresh bool) {
 	f.Store = NewFilerStoreWrapper(store)
 
-	return f.setOrLoadFilerStoreSignature(store)
+	isFresh = f.setOrLoadFilerStoreSignature(store)
+
+	// Recover deletions that were pending when a previous process died, and keep
+	// the durable ledger snapshotted while running (see filer_deletion_persist.go).
+	// A failed ledger read leaves writes blocked until a snapshot retries and
+	// the read succeeds, so the unread ledger is never overwritten.
+	f.reloadDeletionLedger()
+	f.startDeletionLedgerSnapshotter()
+
+	return isFresh
 }
 
 func (f *Filer) setOrLoadFilerStoreSignature(store FilerStore) (isFresh bool) {
@@ -215,6 +418,28 @@ func (f *Filer) RollbackTransaction(ctx context.Context) error {
 	return f.Store.RollbackTransaction(ctx)
 }
 
+type syncWriteKey struct{}
+
+// WithSyncWrite marks the entry writes under ctx durable-on-ack: a store that
+// buffers writes by default must flush them before returning.
+func WithSyncWrite(ctx context.Context) context.Context {
+	return context.WithValue(ctx, syncWriteKey{}, true)
+}
+
+// SyncWrite reports whether ctx carries a durability request for entry writes.
+func SyncWrite(ctx context.Context) bool {
+	return ctx.Value(syncWriteKey{}) != nil
+}
+
+// syncWriteContext flags ctx when the storage rule on p asks for fsync, so the
+// store write is held to the same durability as the data path.
+func (f *Filer) syncWriteContext(ctx context.Context, p util.FullPath) context.Context {
+	if f.FilerConf != nil && f.FilerConf.MatchStorageRule(string(p)).GetFsync() {
+		return WithSyncWrite(ctx)
+	}
+	return ctx
+}
+
 // CreateEntry creates or replaces an entry. When existing is non-nil the caller
 // has already fetched the current entry at this path under a path lock, and it
 // is reused instead of looking the store up again; pass nil to have CreateEntry
@@ -225,6 +450,8 @@ func (f *Filer) CreateEntry(ctx context.Context, entry *Entry, existing *Entry,
 		return nil
 	}
 
+	ctx = f.syncWriteContext(ctx, entry.FullPath)
+
 	if entry.FullPath.IsLongerFileName(maxFilenameLength) {
 		return filer_pb.ErrEntryNameTooLong
 	}
@@ -239,7 +466,13 @@ func (f *Filer) CreateEntry(ctx context.Context, entry *Entry, existing *Entry,
 
 	oldEntry := existing
 	if oldEntry == nil {
-		oldEntry, _ = f.FindEntry(ctx, entry.FullPath)
+		var findErr error
+		oldEntry, findErr = f.FindEntry(ctx, entry.FullPath)
+		if findErr != nil && !errors.Is(findErr, filer_pb.ErrNotFound) {
+			// A create cannot decide whether the path exists when the lookup
+			// itself failed; proceeding would upsert over it.
+			return fmt.Errorf("find entry %s: %w", entry.FullPath, findErr)
+		}
 	}
 
 	/*
@@ -253,18 +486,28 @@ func (f *Filer) CreateEntry(ctx context.Context, entry *Entry, existing *Entry,
 	if oldEntry == nil {
 		f.ensureEntryInode(entry)
 
-		if !skipCreateParentDir {
-			dirParts := strings.Split(string(entry.FullPath), "/")
-			if err := f.ensureParentDirectoryEntry(ctx, entry, dirParts, len(dirParts)-1, isFromOtherCluster); err != nil {
-				return err
-			}
-		}
-
 		glog.V(4).InfofCtx(ctx, "InsertEntry %s: new entry: %v", entry.FullPath, entry.Name())
 		if err := f.Store.InsertEntry(ctx, entry); err != nil {
 			glog.ErrorfCtx(ctx, "insert entry %s: %v", entry.FullPath, err)
 			return fmt.Errorf("insert entry %s: %v", entry.FullPath, err)
 		}
+
+		// Parents go after the entry: one checked first can be taken by the
+		// empty-folder cleaner before the entry lands, and nothing would look again.
+		if !skipCreateParentDir {
+			dirParts := strings.Split(string(entry.FullPath), "/")
+			if err := f.ensureParentDirectoryEntry(ctx, entry, dirParts, len(dirParts)-1, isFromOtherCluster); err != nil {
+				// The entry stays: deleting by path would destroy a concurrent create
+				// that already succeeded through the update branch, and the update keeps
+				// the inode and crtime while mtime only survives the store to the second.
+				// It is not announced - the aggregator replicates creates into peer
+				// stores, so a failed write would land on all of them rather than on the
+				// one filer whose next write into that folder repairs it.
+				glog.ErrorfCtx(ctx, "create parent directories of %s: %v", entry.FullPath, err)
+				return err
+			}
+		}
+
 		if !entry.IsDirectory() {
 			stats.FilerObjectSizeBytesHistogram.Observe(float64(entry.Size()))
 		}
@@ -274,9 +517,13 @@ func (f *Filer) CreateEntry(ctx context.Context, entry *Entry, existing *Entry,
 			return fmt.Errorf("%s: %w", entry.FullPath, filer_pb.ErrEntryAlreadyExists)
 		}
 		glog.V(4).InfofCtx(ctx, "UpdateEntry %s: old entry: %v", entry.FullPath, oldEntry.Name())
-		if err := f.UpdateEntry(ctx, oldEntry, entry); err != nil {
-			glog.ErrorfCtx(ctx, "update entry %s: %v", entry.FullPath, err)
-			return fmt.Errorf("update entry %s: %v", entry.FullPath, err)
+		if err := f.UpdateEntry(ctx, oldEntry, entry, isFromOtherCluster); err != nil {
+			if errors.Is(err, filer_pb.ErrExistingIsDirectory) || errors.Is(err, filer_pb.ErrExistingIsFile) {
+				glog.V(2).InfofCtx(ctx, "update entry %s: %v", entry.FullPath, err)
+			} else {
+				glog.ErrorfCtx(ctx, "update entry %s: %v", entry.FullPath, err)
+			}
+			return fmt.Errorf("update entry %s: %w", entry.FullPath, err)
 		}
 	}
 
@@ -364,6 +611,16 @@ func (f *Filer) ensureParentDirectoryEntry(ctx context.Context, entry *Entry, di
 		// the original object data remains accessible.
 		glog.V(2).InfofCtx(ctx, "promoting %s from file to directory for %s", dirPath, entry.FullPath)
 		dirEntry.Attr.Mode |= os.ModeDir | 0111
+		// Expiring the entry now deletes the directory row and strands the keys under
+		// it, so the prefix object gives up its lazy TTL. The lifecycle worker still
+		// expires it, through the delete that leaves the directory behind.
+		dirEntry.Attr.TtlSec = 0
+		// An empty object leaves no chunks, content or mime behind, so without the
+		// mark the promotion would hide it.
+		if dirEntry.Extended == nil {
+			dirEntry.Extended = make(map[string][]byte)
+		}
+		dirEntry.Extended[s3_constants.SeaweedFSPrefixObject] = []byte("true")
 		if updateErr := f.Store.UpdateEntry(ctx, dirEntry); updateErr != nil {
 			return fmt.Errorf("promote %s to directory: %v", dirPath, updateErr)
 		}
@@ -373,7 +630,84 @@ func (f *Filer) ensureParentDirectoryEntry(ctx context.Context, entry *Entry, di
 	return nil
 }
 
-func (f *Filer) UpdateEntry(ctx context.Context, oldEntry, entry *Entry) (err error) {
+// restorableModeBits is everything but the type bits: ModePerm alone would drop
+// setgid, setuid and sticky, quietly changing group inheritance and delete semantics.
+const restorableModeBits = os.ModePerm | os.ModeSetuid | os.ModeSetgid | os.ModeSticky
+
+// DirectoryAttributes reads what a directory would need to be recreated as it is.
+func (f *Filer) DirectoryAttributes(ctx context.Context, dirPath util.FullPath) (attrs empty_folder_cleanup.DirectoryAttributes, err error) {
+	entry, err := f.FindEntry(ctx, dirPath)
+	if err != nil {
+		return attrs, err
+	}
+	if entry == nil {
+		return attrs, filer_pb.ErrNotFound
+	}
+	return empty_folder_cleanup.DirectoryAttributes{
+		Mode:       entry.Mode & restorableModeBits,
+		Uid:        entry.Uid,
+		Gid:        entry.Gid,
+		UserName:   entry.UserName,
+		GroupNames: entry.GroupNames,
+	}, nil
+}
+
+// EnsureDirectoryEntry recreates dirPath, and any missing ancestor, for entries that
+// outlived the directory holding them. dirPath comes back with the attributes it was
+// deleted with, so a restore cannot hand back a directory more permissive than the one
+// it replaces - including when someone else already put it back with wider ones.
+func (f *Filer) EnsureDirectoryEntry(ctx context.Context, dirPath util.FullPath, attrs empty_folder_cleanup.DirectoryAttributes) error {
+	ctx = f.syncWriteContext(ctx, dirPath)
+	existing, err := f.FindEntry(ctx, dirPath)
+	if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		return err
+	}
+	if existing != nil {
+		// A writer recreating its own missing parent infers the mode from the entry it
+		// is inserting, so it can come back wider. Intersect rather than replace, or a
+		// mode holding a bit the saved one lacks would be granted the ones it lacks.
+		kept := existing.Mode & attrs.Mode & restorableModeBits
+		if existing.Mode&restorableModeBits == kept {
+			return nil
+		}
+		narrowed := existing.ShallowClone()
+		narrowed.Mode = existing.Mode&^restorableModeBits | kept
+		glog.V(1).InfofCtx(ctx, "restore directory %s: narrowing %v to %v", dirPath, existing.Mode, narrowed.Mode)
+		if err := f.UpdateEntry(ctx, existing, narrowed, false); err != nil {
+			return err
+		}
+		f.NotifyUpdateEvent(ctx, existing, narrowed, false, false, nil)
+		return nil
+	}
+
+	holder := &Entry{FullPath: dirPath, Attr: Attr{
+		Mode: attrs.Mode, Uid: attrs.Uid, Gid: attrs.Gid,
+		UserName: attrs.UserName, GroupNames: attrs.GroupNames,
+	}}
+	dirParts := strings.Split(string(dirPath), "/")
+	if err := f.ensureParentDirectoryEntry(ctx, holder, dirParts, len(dirParts)-1, false); err != nil {
+		return err
+	}
+
+	now := time.Now()
+	dirEntry := &Entry{FullPath: dirPath, Attr: Attr{
+		Mtime: now, Crtime: now,
+		Mode:     os.ModeDir | attrs.Mode,
+		Uid:      attrs.Uid,
+		Gid:      attrs.Gid,
+		UserName: attrs.UserName, GroupNames: attrs.GroupNames,
+	}}
+	f.ensureEntryInode(dirEntry)
+	if err := f.Store.InsertEntry(ctx, dirEntry); err != nil {
+		return fmt.Errorf("restore directory %s: %v", dirPath, err)
+	}
+	f.NotifyUpdateEvent(ctx, nil, dirEntry, false, false, nil)
+
+	return nil
+}
+
+func (f *Filer) UpdateEntry(ctx context.Context, oldEntry, entry *Entry, isFromOtherCluster bool) (err error) {
+	ctx = f.syncWriteContext(ctx, entry.FullPath)
 	if oldEntry != nil {
 		entry.Attr.Crtime = oldEntry.Attr.Crtime
 		if oldEntry.Attr.Inode != 0 {
@@ -382,14 +716,28 @@ func (f *Filer) UpdateEntry(ctx context.Context, oldEntry, entry *Entry) (err er
 		} else {
 			f.ensureEntryInode(entry)
 		}
+		// A type conflict is reported through the sentinel, and callers act on it -
+		// an S3 write of a key other keys are nested under retries as a prefix object -
+		// so it is the caller's outcome that decides whether anything went wrong.
 		if oldEntry.IsDirectory() && !entry.IsDirectory() {
-			glog.ErrorfCtx(ctx, "existing %s is a directory", oldEntry.FullPath)
+			glog.V(2).InfofCtx(ctx, "existing %s is a directory", oldEntry.FullPath)
 			return fmt.Errorf("%s: %w", oldEntry.FullPath, filer_pb.ErrExistingIsDirectory)
 		}
 		if !oldEntry.IsDirectory() && entry.IsDirectory() {
-			glog.ErrorfCtx(ctx, "existing %s is a file", oldEntry.FullPath)
+			glog.V(2).InfofCtx(ctx, "existing %s is a file", oldEntry.FullPath)
 			return fmt.Errorf("%s: %w", oldEntry.FullPath, filer_pb.ErrExistingIsFile)
 		}
+		// A local write to a remote-backed entry leaves the copy on remote
+		// stale until a sync re-uploads it. Content changes that arrive
+		// without a fresh sync stamp are unsynced; clear the stamp so nothing
+		// mistakes the still-local chunks for a re-fetchable cache copy.
+		// Replicated updates carry the writer's authoritative stamp.
+		if !isFromOtherCluster && oldEntry.Remote != nil && entry.Remote != nil &&
+			oldEntry.Remote.LastLocalSyncTsNs == entry.Remote.LastLocalSyncTsNs &&
+			!chunksEqual(oldEntry.Chunks, entry.Chunks) {
+			entry.Remote = proto.Clone(entry.Remote).(*filer_pb.RemoteEntry)
+			entry.Remote.LastLocalSyncTsNs = 0
+		}
 	}
 	if entry.Attr.Atime.IsZero() {
 		entry.Attr.Atime = entryInitialAtime(entry.Attr)
@@ -423,7 +771,9 @@ func (f *Filer) FindEntry(ctx context.Context, p util.FullPath) (entry *Entry, e
 		return Root, nil
 	}
 	entry, err = f.Store.FindEntry(ctx, p)
-	if entry != nil && entry.TtlSec > 0 {
+	// A directory is deleted here one row at a time, which would strand whatever is
+	// under it, so a TTL an older build left on one is not acted on.
+	if entry != nil && entry.TtlSec > 0 && !entry.IsDirectory() {
 		if entry.IsExpireS3Enabled() {
 			if entry.GetS3ExpireTime().Before(time.Now()) && !entry.IsS3Versioning() {
 				if delErr := f.doDeleteEntryMetaAndData(ctx, entry, true, false, nil); delErr != nil {
@@ -459,10 +809,10 @@ func (f *Filer) doListDirectoryEntries(ctx context.Context, p util.FullPath, sta
 	lastFileName, err = f.Store.ListDirectoryPrefixedEntries(ctx, p, startFileName, inclusive, limit, prefix, func(entry *Entry) (bool, error) {
 		select {
 		case <-ctx.Done():
-			glog.Errorf("Context is done.")
+			glog.V(1).InfofCtx(ctx, "listing %q canceled: %v", p, ctx.Err())
 			return false, fmt.Errorf("context canceled: %w", ctx.Err())
 		default:
-			if entry.TtlSec > 0 {
+			if entry.TtlSec > 0 && !entry.IsDirectory() {
 				if entry.IsExpireS3Enabled() {
 					if entry.GetS3ExpireTime().Before(time.Now()) && !entry.IsS3Versioning() {
 						// Collect for deletion after iteration completes to avoid DB deadlock
@@ -571,7 +921,7 @@ func (f *Filer) DeleteEmptyParentDirectories(ctx context.Context, dirPath util.F
 	glog.V(2).InfofCtx(ctx, "DeleteEmptyParentDirectories: deleting empty directory %s", dirPath)
 	parentDir, _ := dirPath.DirAndName()
 	if dirEntry, findErr := f.FindEntry(ctx, dirPath); findErr == nil {
-		if delErr := f.doDeleteEntryMetaAndData(ctx, dirEntry, false, false, nil); delErr == nil {
+		if delErr := f.doDeleteEntryMetaAndData(f.emptyFolderDeleteContext(ctx, dirPath), dirEntry, false, false, nil); delErr == nil {
 			// Successfully deleted, continue checking upwards
 			f.DeleteEmptyParentDirectories(ctx, util.FullPath(parentDir), stopAtPath)
 		} else {
@@ -596,7 +946,25 @@ func (f *Filer) Shutdown() {
 	if f.EmptyFolderCleaner != nil {
 		f.EmptyFolderCleaner.Stop()
 	}
+	// Bound the remaining flush retries: with the cluster already gone each
+	// append keeps failing, and an unbounded retry would hold the shutdown
+	// drain open indefinitely. One shared deadline covers every in-flight and
+	// queued window; the flush loop drops what it cannot write.
+	if f.flushCancel != nil {
+		time.AfterFunc(shutdownMetadataLogFlushBudget, f.flushCancel)
+	}
 	f.LocalMetaLogBuffer.ShutdownLogBuffer()
+	// The final metadata-log flush still needs the store to append its entry.
+	f.LocalMetaLogBuffer.WaitForShutdown()
+	// Stop peer subscriptions and let each persist its last applied offset;
+	// the replay on the next start otherwise resumes from a stale offset and
+	// applies those old events over newer local state.
+	if f.MetaAggregator != nil {
+		f.MetaAggregator.Shutdown()
+	}
+	// Persist the deletion ledger one last time before the store closes, so a
+	// clean shutdown leaves the recovery set exactly consistent with reality.
+	f.snapshotDeletionLedger()
 	f.Store.Shutdown()
 }
 
@@ -623,5 +991,6 @@ func (f *Filer) IsDirectoryKeyObject(ctx context.Context, p util.FullPath) (bool
 		return false, nil
 	}
 	// Mirror filer_pb.Entry.IsDirectoryKeyObject so the cleaner keeps a promoted file's data.
-	return entry.IsDirectory() && (entry.Mime != "" || len(entry.GetChunks()) > 0 || len(entry.Content) > 0 || entry.IsInRemoteOnly()), nil
+	_, isPrefixObject := entry.Extended[s3_constants.SeaweedFSPrefixObject]
+	return entry.IsDirectory() && (entry.Mime != "" || len(entry.GetChunks()) > 0 || len(entry.Content) > 0 || entry.IsInRemoteOnly() || isPrefixObject), nil
 }
diff --git a/weed/filer/filer_conf.go b/weed/filer/filer_conf.go
index 6fc33a3b74..e38235be41 100644
--- a/weed/filer/filer_conf.go
+++ b/weed/filer/filer_conf.go
@@ -3,8 +3,12 @@ package filer
 import (
 	"bytes"
 	"context"
+	"crypto/md5"
+	"errors"
 	"fmt"
 	"io"
+	"strings"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
@@ -29,10 +33,11 @@ const (
 )
 
 // FilerConfVersion is stamped into every configuration this build writes.
-// Version 0 predates worm presence: it was written with EmitUnpopulated, so every
-// rule carries an explicit "worm": false that meant nothing. Reading one back as an
-// override would silently lift worm off nested paths, so it is dropped to unset.
-const FilerConfVersion = 1
+// Version 0 predates worm presence and version 1 predates fsync presence: both
+// were written with EmitUnpopulated, so every rule carries an explicit false
+// that meant nothing. Reading one back as an override would silently lift the
+// setting off nested paths, so a false from an older version is dropped to unset.
+const FilerConfVersion = 2
 
 type FilerConf struct {
 	rules ptrie.Trie[*filer_pb.FilerConf_PathConf]
@@ -122,9 +127,12 @@ func (fc *FilerConf) LoadFromBytes(data []byte) (err error) {
 
 func (fc *FilerConf) doLoadConf(conf *filer_pb.FilerConf) (err error) {
 	for _, location := range conf.Locations {
-		if conf.Version < FilerConfVersion && location.Worm != nil && !*location.Worm {
+		if conf.Version < 1 && location.Worm != nil && !*location.Worm {
 			location.Worm = nil
 		}
+		if conf.Version < 2 && location.Fsync != nil && !*location.Fsync {
+			location.Fsync = nil
+		}
 		err = fc.SetLocationConf(location)
 		if err != nil {
 			// this is not recoverable
@@ -223,7 +231,10 @@ func ClonePathConf(src *filer_pb.FilerConf_PathConf) *filer_pb.FilerConf_PathCon
 	if src == nil {
 		return &filer_pb.FilerConf_PathConf{}
 	}
-	var worm *bool
+	var fsync, worm *bool
+	if src.Fsync != nil {
+		fsync = proto.Bool(*src.Fsync)
+	}
 	if src.Worm != nil {
 		worm = proto.Bool(*src.Worm)
 	}
@@ -233,7 +244,7 @@ func ClonePathConf(src *filer_pb.FilerConf_PathConf) *filer_pb.FilerConf_PathCon
 		Replication:              src.Replication,
 		Ttl:                      src.Ttl,
 		DiskType:                 src.DiskType,
-		Fsync:                    src.Fsync,
+		Fsync:                    fsync,
 		VolumeGrowthCount:        src.VolumeGrowthCount,
 		ReadOnly:                 src.ReadOnly,
 		MaxFileNameLength:        src.MaxFileNameLength,
@@ -319,6 +330,173 @@ func ClearBucketReadOnly(ctx context.Context, client filer_pb.SeaweedFilerClient
 	return true, nil
 }
 
+// filerConfSnapshot is a read of filer.conf plus enough of the entry (or its
+// absence) to make a follow-up write conditional via
+// saveFilerConfConditionally, instead of blindly overwriting whatever is
+// there by the time the write happens.
+type filerConfSnapshot struct {
+	fc    *FilerConf
+	entry *filer_pb.Entry // nil if filer.conf did not exist at read time
+}
+
+func readFilerConfSnapshot(ctx context.Context, client filer_pb.SeaweedFilerClient) (*filerConfSnapshot, error) {
+	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
+		Directory: DirectoryEtcSeaweedFS,
+		Name:      FilerConfName,
+	})
+	fc := NewFilerConf()
+	if errors.Is(err, filer_pb.ErrNotFound) {
+		return &filerConfSnapshot{fc: fc}, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("read %s/%s: %v", DirectoryEtcSeaweedFS, FilerConfName, err)
+	}
+	if len(resp.Entry.Content) > 0 {
+		if err := fc.LoadFromBytes(resp.Entry.Content); err != nil {
+			return nil, fmt.Errorf("parse %s/%s: %v", DirectoryEtcSeaweedFS, FilerConfName, err)
+		}
+	}
+	return &filerConfSnapshot{fc: fc, entry: resp.Entry}, nil
+}
+
+// saveFilerConfConditionally writes snap.fc back to filer.conf, conditioned
+// on nothing having created or modified the file since snap was read. The
+// filer evaluates the condition under its per-path lock, so a racing writer
+// fails the precondition instead of silently losing its change.
+//
+// The condition is an exact content check (IF_ETAG_MATCH against the MD5
+// every writer stamps, see SaveInsideFiler), which mtime's one-second
+// resolution cannot match. A filer.conf written before that stamp existed
+// carries no hash, so that one write falls back to IF_UNMODIFIED_SINCE and
+// self-heals from the next write on.
+func saveFilerConfConditionally(ctx context.Context, client filer_pb.SeaweedFilerClient, snap *filerConfSnapshot) error {
+	var buf bytes.Buffer
+	if err := snap.fc.ToText(&buf); err != nil {
+		return err
+	}
+	content := buf.Bytes()
+	contentMd5 := md5.Sum(content)
+
+	if snap.entry == nil {
+		err := filer_pb.CreateEntry(ctx, client, &filer_pb.CreateEntryRequest{
+			Directory: DirectoryEtcSeaweedFS,
+			Entry: &filer_pb.Entry{
+				Name:        FilerConfName,
+				IsDirectory: false,
+				Attributes: &filer_pb.FuseAttributes{
+					Mtime:    time.Now().Unix(),
+					Crtime:   time.Now().Unix(),
+					FileMode: uint32(0644),
+					FileSize: uint64(len(content)),
+					Md5:      contentMd5[:],
+				},
+				Content: content,
+			},
+			Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{
+				{Kind: filer_pb.WriteCondition_IF_NOT_EXISTS},
+			}},
+		})
+		if err != nil {
+			return fmt.Errorf("create %s/%s: %w", DirectoryEtcSeaweedFS, FilerConfName, err)
+		}
+		return nil
+	}
+
+	entry := snap.entry
+	var condition *filer_pb.WriteCondition
+	if entry.Attributes != nil && len(entry.Attributes.Md5) > 0 {
+		condition = &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{
+			{Kind: filer_pb.WriteCondition_IF_ETAG_MATCH, Etags: []string{fmt.Sprintf("%x", entry.Attributes.Md5)}},
+		}}
+	} else {
+		var unmodifiedSince int64
+		if entry.Attributes != nil {
+			unmodifiedSince = entry.Attributes.Mtime
+		} else {
+			entry.Attributes = &filer_pb.FuseAttributes{}
+		}
+		condition = &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{
+			{Kind: filer_pb.WriteCondition_IF_UNMODIFIED_SINCE, UnixTime: unmodifiedSince},
+		}}
+	}
+
+	entry.Content = content
+	entry.Attributes.Mtime = time.Now().Unix()
+	entry.Attributes.FileSize = uint64(len(content))
+	entry.Attributes.Md5 = contentMd5[:]
+	err := filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
+		Directory: DirectoryEtcSeaweedFS,
+		Entry:     entry,
+		Condition: condition,
+	})
+	if err != nil {
+		return fmt.Errorf("update %s/%s: %w", DirectoryEtcSeaweedFS, FilerConfName, err)
+	}
+	return nil
+}
+
+// ClearBucketLifecycleDayTTLs removes any day-TTL filer.conf rules a legacy
+// PutBucketLifecycleConfiguration handler installed under the bucket's path.
+// Per-write TTL is now driven by the LifecycleTTLResolver built off the
+// stored lifecycle XML, so a lingering day-TTL rule would double-stamp
+// expiration (volume server expires under the old rule) or contradict a
+// newly saved XML. The write is conditioned on filer.conf being unchanged
+// since it was read here, so a concurrent writer fails this call rather than
+// silently losing one side's change.
+func ClearBucketLifecycleDayTTLs(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketsPath, bucketName, collection string) error {
+	snap, err := readFilerConfSnapshot(ctx, client)
+	if err != nil {
+		return err
+	}
+	if snap.entry == nil {
+		return nil
+	}
+
+	changed := false
+	bucketPrefix := fmt.Sprintf("%s/%s/", bucketsPath, bucketName)
+	for prefix, ttl := range snap.fc.GetCollectionTtls(collection) {
+		if !strings.HasPrefix(prefix, bucketPrefix) || !strings.HasSuffix(ttl, "d") {
+			continue
+		}
+		locConf, found := snap.fc.GetLocationConf(prefix)
+		if !found {
+			continue
+		}
+		// Logged either way: this is a one-way migration, and the prefix and
+		// TTL are all an operator needs to put a rule back by hand.
+		if isLifecycleOwnedPathConf(locConf) {
+			glog.V(0).Infof("lifecycle migration: dropping legacy day-TTL rule %s ttl=%s", prefix, ttl)
+			snap.fc.DeleteLocationConf(prefix)
+		} else {
+			glog.V(0).Infof("lifecycle migration: clearing legacy day-TTL %s on operator rule %s", ttl, prefix)
+			updated := ClonePathConf(locConf)
+			updated.Ttl = ""
+			if err := snap.fc.SetLocationConf(updated); err != nil {
+				return err
+			}
+		}
+		changed = true
+	}
+	if !changed {
+		return nil
+	}
+
+	return saveFilerConfConditionally(ctx, client, snap)
+}
+
+// isLifecycleOwnedPathConf reports whether a rule looks like one the removed
+// PutBucketLifecycleConfiguration add path created, which set only the
+// routing and TTL fields. That path merged onto whatever already sat at the
+// prefix, so anything else here - a disk type, WORM settings, a read-only
+// flag, a placement pin - is an operator's, and deleting the whole rule to
+// retire its TTL would take their configuration with it.
+func isLifecycleOwnedPathConf(c *filer_pb.FilerConf_PathConf) bool {
+	return c.GetDiskType() == "" && c.Fsync == nil && !c.GetReadOnly() &&
+		c.GetDataCenter() == "" && c.GetRack() == "" && c.GetDataNode() == "" &&
+		c.GetMaxFileNameLength() == 0 && !c.GetDisableChunkDeletion() &&
+		c.Worm == nil && c.GetWormGracePeriodSeconds() == 0 && c.GetWormRetentionTimeSeconds() == 0
+}
+
 func (fc *FilerConf) GetCollectionTtls(collection string) (ttls map[string]string) {
 	ttls = make(map[string]string)
 	fc.rules.Walk(func(key []byte, value *filer_pb.FilerConf_PathConf) bool {
@@ -336,7 +514,12 @@ func mergePathConf(a, b *filer_pb.FilerConf_PathConf) {
 	a.Replication = util.Nvl(b.Replication, a.Replication)
 	a.Ttl = util.Nvl(b.Ttl, a.Ttl)
 	a.DiskType = util.Nvl(b.DiskType, a.DiskType)
-	a.Fsync = b.Fsync || a.Fsync
+	// fsync and worm merge on presence, so a nested rule can turn them off.
+	// readOnly and disableChunkDeletion stay OR'ed on purpose: a nested rule
+	// must not be able to lift a lock the bucket set.
+	if b.Fsync != nil {
+		a.Fsync = proto.Bool(*b.Fsync)
+	}
 	if b.VolumeGrowthCount > 0 {
 		a.VolumeGrowthCount = b.VolumeGrowthCount
 	}
@@ -348,9 +531,6 @@ func mergePathConf(a, b *filer_pb.FilerConf_PathConf) {
 	a.Rack = util.Nvl(b.Rack, a.Rack)
 	a.DataNode = util.Nvl(b.DataNode, a.DataNode)
 	a.DisableChunkDeletion = b.DisableChunkDeletion || a.DisableChunkDeletion
-	// worm merges on presence, so a nested rule can turn it off. readOnly, fsync and
-	// disableChunkDeletion stay OR'ed on purpose: a nested rule must not be able to
-	// lift a lock the bucket set.
 	if b.Worm != nil {
 		// copy the value: a is often a scratch conf while b is a live trie entry
 		a.Worm = proto.Bool(*b.Worm)
diff --git a/weed/filer/filer_conf_test.go b/weed/filer/filer_conf_test.go
index 7b935e64c1..24f2ca591b 100644
--- a/weed/filer/filer_conf_test.go
+++ b/weed/filer/filer_conf_test.go
@@ -2,11 +2,17 @@ package filer
 
 import (
 	"bytes"
+	"context"
+	"errors"
+	"fmt"
 	"reflect"
+	"sync"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -96,6 +102,54 @@ func TestWormLegacyFalseIsNotAnOverride(t *testing.T) {
 	assert.False(t, fc.MatchStorageRule("/buckets/b/sub/x").GetWorm())
 }
 
+func TestFsyncInheritance(t *testing.T) {
+	fc := NewFilerConf()
+	fc.doLoadConf(&filer_pb.FilerConf{
+		Version: FilerConfVersion,
+		Locations: []*filer_pb.FilerConf_PathConf{
+			{LocationPrefix: "/buckets/b/", Fsync: proto.Bool(true), Ttl: "7d"},
+			{LocationPrefix: "/buckets/b/quiet/", Collection: "quiet"},
+			{LocationPrefix: "/buckets/b/scratch/", Fsync: proto.Bool(false)},
+			{LocationPrefix: "/buckets/b/scratch/keep/", Fsync: proto.Bool(true)},
+		},
+	})
+
+	// a rule that says nothing about fsync keeps inheriting it, along with the ttl
+	rule := fc.MatchStorageRule("/buckets/b/quiet/x")
+	assert.True(t, rule.GetFsync())
+	assert.Equal(t, "7d", rule.Ttl)
+
+	// an explicit false turns it off, and a deeper rule turns it back on
+	assert.False(t, fc.MatchStorageRule("/buckets/b/scratch/x").GetFsync())
+	assert.True(t, fc.MatchStorageRule("/buckets/b/scratch/keep/x").GetFsync())
+
+	// paths with no rule at all are unaffected
+	assert.False(t, fc.MatchStorageRule("/buckets/other/x").GetFsync())
+}
+
+// TestFsyncLegacyFalseIsNotAnOverride pins that the explicit "fsync": false
+// every pre-version-2 configuration carries does not read as a per-path
+// opt-out.
+func TestFsyncLegacyFalseIsNotAnOverride(t *testing.T) {
+	const conf = `{
+	  "locations": [
+	    {"locationPrefix": "/buckets/b/", "fsync": true},
+	    {"locationPrefix": "/buckets/b/sub/", "collection": "sub", "fsync": false}
+	  ]
+	}`
+
+	for _, version := range []string{"", `"version": 0,`, `"version": 1,`} {
+		fc := NewFilerConf()
+		assert.NoError(t, fc.LoadFromBytes([]byte(`{`+version+conf[1:])))
+		assert.True(t, fc.MatchStorageRule("/buckets/b/sub/x").GetFsync(), version)
+	}
+
+	// the same file at the current version means what it says
+	fc := NewFilerConf()
+	assert.NoError(t, fc.LoadFromBytes([]byte(`{"version": 2,`+conf[1:])))
+	assert.False(t, fc.MatchStorageRule("/buckets/b/sub/x").GetFsync())
+}
+
 // TestWormSurvivesRoundTrip guards the write side: an explicit false has to be
 // stamped along with a version that says to honor it.
 func TestWormSurvivesRoundTrip(t *testing.T) {
@@ -113,6 +167,23 @@ func TestWormSurvivesRoundTrip(t *testing.T) {
 	assert.True(t, reloaded.MatchStorageRule("/buckets/b/other/x").GetWorm())
 }
 
+// TestFsyncSurvivesRoundTrip guards the write side: an explicit false has to be
+// stamped along with a version that says to honor it.
+func TestFsyncSurvivesRoundTrip(t *testing.T) {
+	fc := NewFilerConf()
+	fc.SetLocationConf(&filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/b/", Fsync: proto.Bool(true)})
+	fc.SetLocationConf(&filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/b/sub/", Fsync: proto.Bool(false)})
+	fc.SetLocationConf(&filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/b/other/", Ttl: "7d"})
+
+	var buf bytes.Buffer
+	assert.NoError(t, fc.ToText(&buf))
+
+	reloaded := NewFilerConf()
+	assert.NoError(t, reloaded.LoadFromBytes(buf.Bytes()))
+	assert.False(t, reloaded.MatchStorageRule("/buckets/b/sub/x").GetFsync())
+	assert.True(t, reloaded.MatchStorageRule("/buckets/b/other/x").GetFsync())
+}
+
 // TestClonePathConf verifies that ClonePathConf copies all exported fields.
 // Uses reflection to automatically detect new fields added to the protobuf,
 // ensuring the test fails if ClonePathConf is not updated for new fields.
@@ -124,7 +195,7 @@ func TestClonePathConf(t *testing.T) {
 		Replication:              "001",
 		Ttl:                      "7d",
 		DiskType:                 "ssd",
-		Fsync:                    true,
+		Fsync:                    proto.Bool(true),
 		VolumeGrowthCount:        5,
 		ReadOnly:                 true,
 		MaxFileNameLength:        255,
@@ -183,9 +254,11 @@ func TestClonePathConf(t *testing.T) {
 	// Verify mutation of clone doesn't affect source
 	clone.Collection = "modified"
 	clone.ReadOnly = false
+	*clone.Fsync = false
 	*clone.Worm = false
 	assert.Equal(t, "test_collection", src.Collection, "Modifying clone should not affect source Collection")
 	assert.Equal(t, true, src.ReadOnly, "Modifying clone should not affect source ReadOnly")
+	assert.Equal(t, true, src.GetFsync(), "Modifying clone should not affect source Fsync")
 	assert.Equal(t, true, src.GetWorm(), "Modifying clone should not affect source Worm")
 }
 
@@ -248,3 +321,340 @@ func TestClearReadOnly(t *testing.T) {
 	assert.False(t, rule.ReadOnly)
 	assert.Equal(t, "7d", rule.Ttl)
 }
+
+// fakeFilerConfClient is a minimal in-memory filer_pb.SeaweedFilerClient that
+// only supports the single-file round trip ReadInsideFiler/SaveInsideFiler
+// need: lookup, create-if-absent, update. Embedding the interface satisfies
+// the rest of it; calling any other method panics on the nil embedded value.
+type fakeFilerConfClient struct {
+	filer_pb.SeaweedFilerClient
+
+	mu          sync.Mutex
+	entries     map[string]*filer_pb.Entry // key: dir+"/"+name
+	updateCalls int
+}
+
+func newFakeFilerConfClient() *fakeFilerConfClient {
+	return &fakeFilerConfClient{entries: make(map[string]*filer_pb.Entry)}
+}
+
+func (c *fakeFilerConfClient) key(dir, name string) string { return dir + "/" + name }
+
+func (c *fakeFilerConfClient) LookupDirectoryEntry(_ context.Context, in *filer_pb.LookupDirectoryEntryRequest, _ ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	e, ok := c.entries[c.key(in.Directory, in.Name)]
+	if !ok {
+		return nil, filer_pb.ErrNotFound
+	}
+	// A real gRPC round trip always hands back an independent copy (proto
+	// marshal/unmarshal), so mutating what the caller gets back (as
+	// saveFilerConfConditionally does before re-sending it) must not affect
+	// what conditionHoldsLocked below compares against.
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: cloneFakeEntry(e)}, nil
+}
+
+func cloneFakeEntry(e *filer_pb.Entry) *filer_pb.Entry {
+	if e == nil {
+		return nil
+	}
+	// proto.Clone rather than a struct copy: filer_pb.Entry embeds
+	// protoimpl.MessageState (a sync.Mutex), which a plain `*e` copy would
+	// duplicate by value — exactly what go vet's copylocks check flags.
+	return proto.Clone(e).(*filer_pb.Entry)
+}
+
+func (c *fakeFilerConfClient) CreateEntry(_ context.Context, in *filer_pb.CreateEntryRequest, _ ...grpc.CallOption) (*filer_pb.CreateEntryResponse, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	key := c.key(in.Directory, in.Entry.Name)
+	if !conditionHoldsLocked(in.Condition, c.entries[key]) {
+		return nil, errors.New("precondition failed")
+	}
+	c.entries[key] = in.Entry
+	return &filer_pb.CreateEntryResponse{}, nil
+}
+
+func (c *fakeFilerConfClient) UpdateEntry(_ context.Context, in *filer_pb.UpdateEntryRequest, _ ...grpc.CallOption) (*filer_pb.UpdateEntryResponse, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.updateCalls++
+	key := c.key(in.Directory, in.Entry.Name)
+	if !conditionHoldsLocked(in.Condition, c.entries[key]) {
+		return nil, errors.New("precondition failed")
+	}
+	c.entries[key] = in.Entry
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+// conditionHoldsLocked is a minimal stand-in for the filer server's
+// writeConditionSatisfied (weed/server/filer_grpc_server_condition.go),
+// covering just the clause kinds saveFilerConfConditionally uses, so tests
+// can exercise the CAS path without a real filer server.
+func conditionHoldsLocked(cond *filer_pb.WriteCondition, current *filer_pb.Entry) bool {
+	if cond == nil {
+		return true
+	}
+	for _, clause := range cond.Clauses {
+		switch clause.Kind {
+		case filer_pb.WriteCondition_IF_NOT_EXISTS:
+			if current != nil {
+				return false
+			}
+		case filer_pb.WriteCondition_IF_UNMODIFIED_SINCE:
+			if current != nil && current.Attributes != nil && current.Attributes.Mtime > clause.UnixTime {
+				return false
+			}
+		case filer_pb.WriteCondition_IF_ETAG_MATCH:
+			if current == nil {
+				return false
+			}
+			stored := ""
+			if current.Attributes != nil {
+				stored = fmt.Sprintf("%x", current.Attributes.Md5)
+			}
+			matched := false
+			for _, want := range clause.Etags {
+				if want == stored {
+					matched = true
+					break
+				}
+			}
+			if !matched {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+// putFilerConf seeds the fake client's filer.conf with the given rules.
+func putFilerConf(t *testing.T, client *fakeFilerConfClient, rules ...*filer_pb.FilerConf_PathConf) {
+	t.Helper()
+	fc := NewFilerConf()
+	for _, r := range rules {
+		require.NoError(t, fc.SetLocationConf(r))
+	}
+	var buf bytes.Buffer
+	require.NoError(t, fc.ToText(&buf))
+	client.entries[client.key(DirectoryEtcSeaweedFS, FilerConfName)] = &filer_pb.Entry{
+		Name:       FilerConfName,
+		Content:    buf.Bytes(),
+		Attributes: &filer_pb.FuseAttributes{},
+	}
+}
+
+// readFilerConfText returns the current filer.conf content stored in the fake
+// client, or "" if none exists yet.
+func readFilerConfText(client *fakeFilerConfClient) string {
+	e, ok := client.entries[client.key(DirectoryEtcSeaweedFS, FilerConfName)]
+	if !ok {
+		return ""
+	}
+	return string(e.Content)
+}
+
+func TestClearBucketLifecycleDayTTLs_NoFilerConf(t *testing.T) {
+	client := newFakeFilerConfClient()
+
+	require.NoError(t, ClearBucketLifecycleDayTTLs(context.Background(), client, "/buckets", "mybucket", "mybucket"))
+	assert.Empty(t, readFilerConfText(client))
+}
+
+func TestClearBucketLifecycleDayTTLs_NoMatchingRule(t *testing.T) {
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/other/",
+		Collection:     "other",
+		Ttl:            "7d",
+	})
+
+	require.NoError(t, ClearBucketLifecycleDayTTLs(context.Background(), client, "/buckets", "mybucket", "mybucket"))
+	assert.Contains(t, readFilerConfText(client), "other")
+}
+
+func TestClearBucketLifecycleDayTTLs_RemovesDayTTLUnderBucket(t *testing.T) {
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/mybucket/",
+		Collection:     "mybucket",
+		Ttl:            "7d",
+	})
+
+	require.NoError(t, ClearBucketLifecycleDayTTLs(context.Background(), client, "/buckets", "mybucket", "mybucket"))
+
+	reloaded := NewFilerConf()
+	require.NoError(t, reloaded.LoadFromBytes([]byte(readFilerConfText(client))))
+	_, found := reloaded.GetLocationConf("/buckets/mybucket/")
+	assert.False(t, found, "day-TTL rule should have been removed")
+}
+
+func TestClearBucketLifecycleDayTTLs_KeepsNonDayTTL(t *testing.T) {
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/mybucket/",
+		Collection:     "mybucket",
+		Ttl:            "7m", // minutes, not days: not a legacy lifecycle TTL rule
+	})
+
+	require.NoError(t, ClearBucketLifecycleDayTTLs(context.Background(), client, "/buckets", "mybucket", "mybucket"))
+
+	reloaded := NewFilerConf()
+	require.NoError(t, reloaded.LoadFromBytes([]byte(readFilerConfText(client))))
+	_, found := reloaded.GetLocationConf("/buckets/mybucket/")
+	assert.True(t, found, "non-day TTL rule should be left alone")
+}
+
+func TestClearBucketLifecycleDayTTLs_KeepsOperatorSettingsAndClearsOnlyTheTTL(t *testing.T) {
+	// The removed add path merged its TTL onto whatever already sat at the
+	// prefix, so a rule carrying operator settings must survive with only its
+	// TTL retired - deleting it outright would drop the disk type and the
+	// read-only flag with it.
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/mybucket/logs/",
+		Collection:     "mybucket",
+		Ttl:            "30d",
+		DiskType:       "hdd",
+		ReadOnly:       true,
+	})
+
+	require.NoError(t, ClearBucketLifecycleDayTTLs(context.Background(), client, "/buckets", "mybucket", "mybucket"))
+
+	reloaded := NewFilerConf()
+	require.NoError(t, reloaded.LoadFromBytes([]byte(readFilerConfText(client))))
+	rule, found := reloaded.GetLocationConf("/buckets/mybucket/logs/")
+	require.True(t, found, "a rule carrying operator settings must not be deleted")
+	assert.Equal(t, "", rule.Ttl, "the legacy day TTL should be gone")
+	assert.Equal(t, "hdd", rule.DiskType, "the operator's disk type must survive")
+	assert.True(t, rule.ReadOnly, "the operator's read-only flag must survive")
+}
+
+func TestClearBucketLifecycleDayTTLs_KeepsWormSettings(t *testing.T) {
+	worm := true
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{
+		LocationPrefix:           "/buckets/mybucket/locked/",
+		Collection:               "mybucket",
+		Ttl:                      "7d",
+		Worm:                     &worm,
+		WormRetentionTimeSeconds: 3600,
+	})
+
+	require.NoError(t, ClearBucketLifecycleDayTTLs(context.Background(), client, "/buckets", "mybucket", "mybucket"))
+
+	reloaded := NewFilerConf()
+	require.NoError(t, reloaded.LoadFromBytes([]byte(readFilerConfText(client))))
+	rule, found := reloaded.GetLocationConf("/buckets/mybucket/locked/")
+	require.True(t, found, "a WORM rule must not be deleted to retire a TTL")
+	assert.Equal(t, "", rule.Ttl)
+	assert.True(t, rule.GetWorm())
+	assert.Equal(t, uint64(3600), rule.WormRetentionTimeSeconds)
+}
+
+func TestClearBucketLifecycleDayTTLs_KeepsOtherBucketsAndCollections(t *testing.T) {
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client,
+		&filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/mybucket/", Collection: "mybucket", Ttl: "7d"},
+		&filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/other/", Collection: "other", Ttl: "7d"},
+		// nested under the target bucket's path but tagged to a different
+		// collection (e.g. a filer-group-prefixed name): must not be swept up
+		// by this bucket's cleanup, since GetCollectionTtls filters by collection.
+		&filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/mybucket/nested/", Collection: "group_mybucket", Ttl: "7d"},
+	)
+
+	require.NoError(t, ClearBucketLifecycleDayTTLs(context.Background(), client, "/buckets", "mybucket", "mybucket"))
+
+	reloaded := NewFilerConf()
+	require.NoError(t, reloaded.LoadFromBytes([]byte(readFilerConfText(client))))
+	_, found := reloaded.GetLocationConf("/buckets/mybucket/")
+	assert.False(t, found, "the target bucket's day-TTL rule should be gone")
+
+	text := readFilerConfText(client)
+	assert.Contains(t, text, "other")
+	assert.Contains(t, text, "group_mybucket")
+}
+
+// bumpMtime models a writer that landed after unmodifiedSince, so an
+// IF_UNMODIFIED_SINCE precondition built on that timestamp no longer holds.
+func bumpMtime(client *fakeFilerConfClient, unmodifiedSince int64) {
+	client.mu.Lock()
+	defer client.mu.Unlock()
+	e := client.entries[client.key(DirectoryEtcSeaweedFS, FilerConfName)]
+	if e == nil {
+		return
+	}
+	if e.Attributes == nil {
+		e.Attributes = &filer_pb.FuseAttributes{}
+	}
+	e.Attributes.Mtime = unmodifiedSince + 1
+}
+
+func TestSaveFilerConfConditionally_RejectsUpdateModifiedConcurrently(t *testing.T) {
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/a/", Collection: "a", Ttl: "7d"})
+
+	snap, err := readFilerConfSnapshot(context.Background(), client)
+	require.NoError(t, err)
+	require.NotNil(t, snap.entry)
+	require.Empty(t, snap.entry.Attributes.Md5, "test setup should model a pre-existing filer.conf with no stamped Md5")
+
+	// Someone else writes filer.conf after our read but before our write.
+	bumpMtime(client, snap.entry.Attributes.Mtime)
+
+	err = saveFilerConfConditionally(context.Background(), client, snap)
+	assert.Error(t, err, "expected a concurrent modification to fail the conditional write")
+}
+
+// TestSaveFilerConfConditionally_ExactContentCheckRejectsConcurrentModification
+// exercises the primary path: once an entry has been written through this
+// function (so it carries a content Md5), a later write with a stale
+// snapshot is rejected by the exact IF_ETAG_MATCH check even when the
+// concurrent writer happened to leave mtime unchanged — something a
+// mtime-only precondition would have missed.
+func TestSaveFilerConfConditionally_ExactContentCheckRejectsConcurrentModification(t *testing.T) {
+	client := newFakeFilerConfClient()
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/a/", Collection: "a", Ttl: "7d"})
+
+	// First write through saveFilerConfConditionally stamps Md5, moving
+	// subsequent reads onto the exact-content check.
+	snap, err := readFilerConfSnapshot(context.Background(), client)
+	require.NoError(t, err)
+	require.NoError(t, saveFilerConfConditionally(context.Background(), client, snap))
+
+	snap2, err := readFilerConfSnapshot(context.Background(), client)
+	require.NoError(t, err)
+	require.NotEmpty(t, snap2.entry.Attributes.Md5, "expected Md5 to have been stamped by the prior write")
+
+	// A concurrent writer goes through SaveInsideFiler, the path every
+	// other filer.conf writer uses. It lands in the same wall-clock second,
+	// so only the content hash can catch it.
+	concurrentFc := NewFilerConf()
+	require.NoError(t, concurrentFc.LoadFromBytes([]byte(readFilerConfText(client))))
+	require.NoError(t, concurrentFc.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/other/", Collection: "other", Ttl: "3d",
+	}))
+	var buf bytes.Buffer
+	require.NoError(t, concurrentFc.ToText(&buf))
+	require.NoError(t, SaveInsideFiler(context.Background(), client, DirectoryEtcSeaweedFS, FilerConfName, buf.Bytes()))
+	client.entries[client.key(DirectoryEtcSeaweedFS, FilerConfName)].Attributes.Mtime = snap2.entry.Attributes.Mtime
+
+	err = saveFilerConfConditionally(context.Background(), client, snap2)
+	assert.Error(t, err, "expected the exact-content check to reject a write whose baseline content hash no longer matches")
+	assert.Contains(t, readFilerConfText(client), "/buckets/other/", "the concurrent writer's content must survive")
+}
+
+func TestSaveFilerConfConditionally_RejectsCreateWhenCreatedConcurrently(t *testing.T) {
+	client := newFakeFilerConfClient()
+
+	snap, err := readFilerConfSnapshot(context.Background(), client)
+	require.NoError(t, err)
+	require.Nil(t, snap.entry, "filer.conf should not exist yet")
+
+	// Someone else creates filer.conf after our read but before our write.
+	putFilerConf(t, client, &filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/b/", Collection: "b", Ttl: "3d"})
+
+	err = saveFilerConfConditionally(context.Background(), client, snap)
+	assert.Error(t, err, "expected a concurrent create to fail the conditional write")
+	assert.Contains(t, readFilerConfText(client), "/buckets/b/", "the concurrent writer's content must survive")
+}
diff --git a/weed/filer/filer_delete_collection_test.go b/weed/filer/filer_delete_collection_test.go
new file mode 100644
index 0000000000..9701f38710
--- /dev/null
+++ b/weed/filer/filer_delete_collection_test.go
@@ -0,0 +1,387 @@
+package filer
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+)
+
+// collectionDeleteMaster is just enough of a master for a MasterClient to
+// consider itself connected, and records every CollectionDelete it is asked for.
+type collectionDeleteMaster struct {
+	master_pb.UnimplementedSeaweedServer
+	calls chan collectionDeleteCall
+}
+
+type collectionDeleteCall struct {
+	name string
+	// budget is the time the RPC arrived with, or 0 when it carried no deadline.
+	budget time.Duration
+}
+
+// KeepConnected is what MasterClient waits on before it reports a master: one
+// response is enough, then the stream idles until the server is torn down.
+func (m *collectionDeleteMaster) KeepConnected(stream master_pb.Seaweed_KeepConnectedServer) error {
+	if _, err := stream.Recv(); err != nil {
+		return err
+	}
+	if err := stream.Send(&master_pb.KeepConnectedResponse{}); err != nil {
+		return err
+	}
+	<-stream.Context().Done()
+	return nil
+}
+
+func (m *collectionDeleteMaster) CollectionDelete(ctx context.Context, req *master_pb.CollectionDeleteRequest) (*master_pb.CollectionDeleteResponse, error) {
+	call := collectionDeleteCall{name: req.Name}
+	if deadline, ok := ctx.Deadline(); ok {
+		call.budget = time.Until(deadline)
+	}
+	m.calls <- call
+	return &master_pb.CollectionDeleteResponse{}, nil
+}
+
+// hookedStore is the stub store with one extra seam: a callback that runs once
+// an entry has actually been removed, so a test can interleave an event -- a
+// client hanging up, say -- between the store write and whatever follows it.
+type hookedStore struct {
+	*stubFilerStore
+	onDeleteEntry func(util.FullPath)
+}
+
+func (s *hookedStore) DeleteEntry(ctx context.Context, p util.FullPath) error {
+	if err := s.stubFilerStore.DeleteEntry(ctx, p); err != nil {
+		return err
+	}
+	if s.onDeleteEntry != nil {
+		s.onDeleteEntry(p)
+	}
+	return nil
+}
+
+// newFilerWithFakeMaster builds a filer backed by the stub store, with its
+// MasterClient connected to a fake master the test can observe.
+func newFilerWithFakeMaster(t *testing.T) (*Filer, *hookedStore, *collectionDeleteMaster) {
+	t.Helper()
+
+	master := &collectionDeleteMaster{calls: make(chan collectionDeleteCall, 4)}
+
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcServer := grpc.NewServer()
+	master_pb.RegisterSeaweedServer(grpcServer, master)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, err := net.SplitHostPort(lis.Addr().String())
+	if err != nil {
+		t.Fatalf("split listener address: %v", err)
+	}
+	masterAddress := pb.ServerAddress(fmt.Sprintf("127.0.0.1:0.%s", port))
+
+	mc := wdclient.NewMasterClient(
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		"", cluster.FilerType, pb.ServerAddress("localhost:0"), "", "",
+		*pb.NewServiceDiscoveryFromMap(map[string]pb.ServerAddress{"m": masterAddress}),
+	)
+
+	connecting, stopConnecting := context.WithCancel(context.Background())
+	t.Cleanup(stopConnecting)
+	go mc.KeepConnectedToMaster(connecting)
+
+	waiting, cancelWaiting := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancelWaiting()
+	mc.WaitUntilConnected(waiting)
+	if waiting.Err() != nil {
+		t.Fatal("the master client never connected to the fake master")
+	}
+
+	store := &hookedStore{stubFilerStore: newStubFilerStore()}
+	f := &Filer{
+		DirBucketsPath:      "/buckets",
+		RemoteStorage:       NewFilerRemoteStorage(),
+		Store:               NewFilerStoreWrapper(store),
+		FilerConf:           NewFilerConf(),
+		MaxFilenameLength:   255,
+		MasterClient:        mc,
+		FileIdDeletionQueue: util.NewUnboundedQueue(),
+		deletionQuit:        make(chan struct{}),
+		LocalMetaLogBuffer: log_buffer.NewLogBuffer("test", time.Minute,
+			func(*log_buffer.LogBuffer, time.Time, time.Time, []byte, int64, int64) {}, nil, func() {}),
+	}
+	return f, store, master
+}
+
+// Deleting a bucket entry deletes its collection, and the request hanging up
+// partway must not stop that: the bucket's metadata is already gone, so skipping
+// it strands the bucket's volumes with nothing left to come back for them. The
+// cleanup still has to carry a deadline of its own, or a master that is down
+// parks this handler and every client retry behind it parks another.
+//
+// The cancellation lands between the store removing the entry and the collection
+// delete, which is where a client disconnect actually bites: FilerStoreWrapper
+// refuses a context that is already dead on entry, so an up-front cancellation
+// fails the delete long before this point instead.
+func TestDeleteEntryMetaAndDataDeletesCollectionWhenTheRequestIsCancelledMidDelete(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+
+	const bucket = "bucket-a"
+	bucketPath := util.FullPath(f.DirBucketsPath + "/" + bucket)
+	if err := store.InsertEntry(context.Background(), &Entry{
+		FullPath: bucketPath,
+		Attr:     Attr{Mode: os.ModeDir | 0755},
+	}); err != nil {
+		t.Fatalf("seed the bucket entry: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	// The client hangs up just as the bucket entry comes out of the store.
+	store.onDeleteEntry = func(util.FullPath) { cancel() }
+
+	if err := f.DeleteEntryMetaAndData(ctx, bucketPath, true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+	if ctx.Err() == nil {
+		t.Fatal("test setup: the request was never cancelled, so nothing was exercised")
+	}
+
+	var call collectionDeleteCall
+	select {
+	case call = <-master.calls:
+	case <-time.After(20 * time.Second):
+		t.Fatal("CollectionDelete never reached the master")
+	}
+	if call.name != bucket {
+		t.Errorf("master was asked to delete collection %q, want %q", call.name, bucket)
+	}
+	if call.budget <= 0 {
+		t.Error("CollectionDelete arrived with no deadline; a master that stops answering would hold this handler open")
+	}
+	if call.budget > collectionDeleteTimeout {
+		t.Errorf("CollectionDelete budget = %v, want at most collectionDeleteTimeout %v", call.budget, collectionDeleteTimeout)
+	}
+
+	if store.getEntry(string(bucketPath)) != nil {
+		t.Error("the bucket entry survived the delete")
+	}
+}
+
+func seedBucket(t *testing.T, store *hookedStore, path util.FullPath) {
+	t.Helper()
+	if err := store.InsertEntry(context.Background(), &Entry{
+		FullPath: path,
+		Attr:     Attr{Mode: os.ModeDir | 0755},
+	}); err != nil {
+		t.Fatalf("seed bucket %s: %v", path, err)
+	}
+}
+
+// Two buckets resolving to one collection: deleting either must leave the
+// collection for the other. Previously the delete dropped the collection
+// named after the bucket regardless of where its data actually lived.
+func TestDeleteBucketKeepsSharedCollection(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets",
+		Collection:     "shared",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/a"))
+	seedBucket(t, store, util.FullPath("/buckets/b"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/a", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		t.Fatalf("shared collection was deleted: %q", call.name)
+	default:
+	}
+	if store.getEntry("/buckets/b") == nil {
+		t.Error("the surviving bucket's entry is gone")
+	}
+}
+
+// A bucket named after a collection other buckets resolve to is still just a
+// bucket: deleting it must not take the shared collection down with it.
+func TestDeleteBucketNamedAfterSharedCollection(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets",
+		Collection:     "shared",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/shared"))
+	seedBucket(t, store, util.FullPath("/buckets/other"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/shared", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		t.Fatalf("collection backing other buckets was deleted: %q", call.name)
+	default:
+	}
+}
+
+// A rule pointing a non-bucket path at the same collection keeps it: the
+// collection serves files the bucket delete must not orphan.
+func TestDeleteBucketKeepsCollectionUsedByNonBucketPath(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/a",
+		Collection:     "cold",
+	})
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/archives",
+		Collection:     "cold",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/a"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/a", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		t.Fatalf("collection used by /archives was deleted: %q", call.name)
+	default:
+	}
+}
+
+// A broad prefix rule covering the whole tree keeps the collection even for a
+// lone bucket: the same collection backs non-bucket paths too.
+func TestDeleteBucketKeepsCollectionFromBroadRule(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/",
+		Collection:     "everything",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/a"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/a", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		t.Fatalf("collection from a / rule was deleted: %q", call.name)
+	default:
+	}
+}
+
+// A bucket resolving to the filer's default collection keeps it: rule-less
+// writes outside buckets land there too, so it is never one bucket's alone.
+func TestDeleteBucketKeepsDefaultCollection(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.metaLogCollection = "everything"
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/a",
+		Collection:     "everything",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/a"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/a", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		t.Fatalf("the filer's default collection was deleted: %q", call.name)
+	default:
+	}
+}
+
+// A rule nested under a surviving bucket keeps the collection: the other
+// bucket resolves elsewhere at its root, but objects deeper inside it still
+// land in the shared collection.
+func TestDeleteBucketKeepsCollectionFromNestedSiblingRule(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/a",
+		Collection:     "shared",
+	})
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/b/deep",
+		Collection:     "shared",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/a"))
+	seedBucket(t, store, util.FullPath("/buckets/b"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/a", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		t.Fatalf("collection used under /buckets/b/deep was deleted: %q", call.name)
+	default:
+	}
+}
+
+// A grouped gateway writes to <group>_<bucket> regardless of the storage
+// rules, so that is the collection the delete must drop -- and a rule-named
+// collection the bucket never used must survive.
+func TestDeleteBucketUnderFilerGroup(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.MasterClient.FilerGroup = "tenant1"
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/photos",
+		Collection:     "archive",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/photos"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/photos", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		if call.name != "tenant1_photos" {
+			t.Fatalf("CollectionDelete = %q, want %q", call.name, "tenant1_photos")
+		}
+	case <-time.After(20 * time.Second):
+		t.Fatal("CollectionDelete never reached the master")
+	}
+}
+
+// A collection only the deleted bucket resolves to is dropped under its real
+// name, so a dedicated custom collection does not leak its volumes.
+func TestDeleteBucketDeletesResolvedCollection(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/only",
+		Collection:     "custom",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/only"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/only", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		if call.name != "custom" {
+			t.Fatalf("CollectionDelete = %q, want %q", call.name, "custom")
+		}
+	case <-time.After(20 * time.Second):
+		t.Fatal("CollectionDelete never reached the master")
+	}
+}
diff --git a/weed/filer/filer_delete_entry.go b/weed/filer/filer_delete_entry.go
index 646caf5c94..899d337c05 100644
--- a/weed/filer/filer_delete_entry.go
+++ b/weed/filer/filer_delete_entry.go
@@ -2,7 +2,11 @@ package filer
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"maps"
+	"strings"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -15,6 +19,101 @@ const (
 	MsgFailDelNonEmptyFolder = "fail to delete non-empty folder"
 )
 
+// ErrNonEmptyFolder is a non-recursive delete refused because the folder still
+// has children. The marker leads the message the filer builds for it and is
+// never wrapped on the way out, so the path that follows it, which the client
+// chose, cannot forge one.
+var ErrNonEmptyFolder = errors.New(MsgFailDelNonEmptyFolder)
+
+// DeleteEntryError turns the text of DeleteEntryResponse.Error back into an
+// error carrying the condition the filer reported. Call it on the response
+// field, before formatting a path around it.
+func DeleteEntryError(msg string) error {
+	if strings.HasPrefix(msg, MsgFailDelNonEmptyFolder) {
+		return &deleteEntryError{msg: msg, cause: ErrNonEmptyFolder}
+	}
+	return errors.New(msg)
+}
+
+// IsNonEmptyFolderError is for callers holding a delete failure that has not
+// been wrapped yet: the sentinel when it survived, the leading marker when the
+// error only crossed the wire as text.
+func IsNonEmptyFolderError(err error) bool {
+	if err == nil {
+		return false
+	}
+	return errors.Is(err, ErrNonEmptyFolder) || strings.HasPrefix(err.Error(), MsgFailDelNonEmptyFolder)
+}
+
+type deleteEntryError struct {
+	msg   string
+	cause error
+}
+
+func (e *deleteEntryError) Error() string { return e.msg }
+func (e *deleteEntryError) Unwrap() error { return e.cause }
+
+// ExtKeepRemoteObjectKey marks the entry in the event of a metadata-only
+// delete, so the remote write-back daemons leave the remote object alone too.
+// It is set on the event only; the store drops it from every write, so a
+// client cannot plant it on an entry.
+const ExtKeepRemoteObjectKey = "Seaweed-X-Keep-Remote-Object"
+
+// IsMetadataOnlyDelete reports a delete event's entry marked by
+// WithKeepRemoteObject.
+func IsMetadataOnlyDelete(oldEntry *filer_pb.Entry) bool {
+	_, marked := oldEntry.GetExtended()[ExtKeepRemoteObjectKey]
+	return marked
+}
+
+type keepRemoteObjectKey struct{}
+
+// WithKeepRemoteObject marks a delete as metadata-only: neither the filer nor
+// filer.remote.sync deletes the entry's object on the mounted remote storage.
+// Unlike isFromOtherCluster, the metadata event stays an ordinary local
+// delete, so replication still carries it.
+func WithKeepRemoteObject(ctx context.Context) context.Context {
+	return context.WithValue(ctx, keepRemoteObjectKey{}, true)
+}
+
+func keepsRemoteObject(ctx context.Context) bool {
+	return ctx.Value(keepRemoteObjectKey{}) != nil
+}
+
+// emptyFolderDeleteContext makes deleting a folder that is empty in the filer
+// metadata-only when it is under a remote mount. A mount is populated lazily,
+// so the folder can still hold remote objects never read, and removing its
+// remote directory deletes every object under that prefix.
+func (f *Filer) emptyFolderDeleteContext(ctx context.Context, dirPath util.FullPath) context.Context {
+	if f.IsUnderRemoteMount(dirPath) {
+		return WithKeepRemoteObject(ctx)
+	}
+	return ctx
+}
+
+// IsUnderRemoteMount reports whether p is a remote mount directory or lies under one.
+func (f *Filer) IsUnderRemoteMount(p util.FullPath) bool {
+	if f.RemoteStorage == nil {
+		return false
+	}
+	// Mount rules are keyed with a trailing slash, so this also matches the mount directory itself.
+	_, remoteLoc := f.RemoteStorage.FindMountDirectory(util.FullPath(string(p) + "/"))
+	return remoteLoc != nil
+}
+
+func deleteEventEntry(ctx context.Context, entry *Entry) *Entry {
+	if !keepsRemoteObject(ctx) {
+		return entry
+	}
+	marked := entry.ShallowClone()
+	marked.Extended = maps.Clone(entry.Extended)
+	if marked.Extended == nil {
+		marked.Extended = map[string][]byte{}
+	}
+	marked.Extended[ExtKeepRemoteObjectKey] = []byte("true")
+	return marked
+}
+
 type OnChunksFunc func([]*filer_pb.FileChunk) error
 type OnHardLinkIdsFunc func([]HardLinkId) error
 
@@ -23,6 +122,8 @@ func (f *Filer) DeleteEntryMetaAndData(ctx context.Context, p util.FullPath, isR
 		return nil
 	}
 
+	ctx = f.syncWriteContext(ctx, p)
+
 	entry, findErr := f.FindEntry(ctx, p)
 	if findErr != nil {
 		return findErr
@@ -30,10 +131,20 @@ func (f *Filer) DeleteEntryMetaAndData(ctx context.Context, p util.FullPath, isR
 	if ifNotModifiedAfter > 0 && entry.Attr.Mtime.Unix() > ifNotModifiedAfter {
 		return nil
 	}
+	if !isRecursive && entry.IsDirectory() {
+		ctx = f.emptyFolderDeleteContext(ctx, p)
+	}
 	isDeleteCollection := f.IsBucket(entry)
+	collectionName := ""
+	if isDeleteCollection {
+		collectionName = f.bucketCollection(ctx, entry.Name())
+	}
+	// A preserved collection outlives the bucket, so its chunks are collected
+	// per entry rather than dropped wholesale with it.
+	dropsCollection := isDeleteCollection && collectionName != ""
 	if entry.IsDirectory() {
 		// delete the folder children, not including the folder itself
-		err = f.doBatchDeleteFolderMetaAndData(ctx, entry, isRecursive, ignoreRecursiveError, shouldDeleteChunks && !isDeleteCollection, isDeleteCollection, isFromOtherCluster, signatures, func(hardLinkIds []HardLinkId) error {
+		err = f.doBatchDeleteFolderMetaAndData(ctx, entry, isRecursive, ignoreRecursiveError, shouldDeleteChunks && !dropsCollection, isDeleteCollection && (dropsCollection || !shouldDeleteChunks), isFromOtherCluster, signatures, func(hardLinkIds []HardLinkId) error {
 			// A case not handled:
 			// what if the chunk is in a different collection?
 			if shouldDeleteChunks {
@@ -43,6 +154,9 @@ func (f *Filer) DeleteEntryMetaAndData(ctx context.Context, p util.FullPath, isR
 		})
 		if err != nil {
 			glog.V(2).InfofCtx(ctx, "delete directory %s: %v", p, err)
+			if errors.Is(err, ErrNonEmptyFolder) {
+				return err
+			}
 			return fmt.Errorf("delete directory %s: %v", p, err)
 		}
 	}
@@ -53,7 +167,7 @@ func (f *Filer) DeleteEntryMetaAndData(ctx context.Context, p util.FullPath, isR
 		return fmt.Errorf("delete file %s: %v", p, err)
 	}
 
-	if shouldDeleteChunks && !isDeleteCollection {
+	if shouldDeleteChunks && !dropsCollection {
 		if len(entry.HardLinkId) != 0 && entry.HardLinkCounter > 1 {
 			// if the file is a hard link and there are other hard links, do not delete the chunks
 		} else {
@@ -62,11 +176,18 @@ func (f *Filer) DeleteEntryMetaAndData(ctx context.Context, p util.FullPath, isR
 	}
 
 	if isDeleteCollection {
-		collectionName := entry.Name()
-		f.DoDeleteCollection(collectionName)
+		if collectionName != "" {
+			// the entry is already gone: a caller that hung up must not leave the
+			// collection behind, so this cleanup outlives the request -- bounded all
+			// the same, or a master that is down parks this handler indefinitely and
+			// every client retry behind it parks another
+			collectionCtx, cancelCollection := context.WithTimeout(context.WithoutCancel(ctx), collectionDeleteTimeout)
+			f.DoDeleteCollection(collectionCtx, collectionName)
+			cancelCollection()
+		}
 		// drop bucket-labeled series held by this process; the S3 gateway
 		// only cleans its own registry
-		stats.DeleteBucketMetrics(collectionName)
+		stats.DeleteBucketMetrics(entry.Name())
 	}
 
 	return nil
@@ -74,30 +195,46 @@ func (f *Filer) DeleteEntryMetaAndData(ctx context.Context, p util.FullPath, isR
 
 func (f *Filer) doBatchDeleteFolderMetaAndData(ctx context.Context, entry *Entry, isRecursive, ignoreRecursiveError, shouldDeleteChunks, isDeletingBucket, isFromOtherCluster bool, signatures []int32, onHardLinkIdsFn OnHardLinkIdsFunc) (err error) {
 
+	var dirTombstoneTs int64
+	if isRecursive && !keepsRemoteObject(ctx) {
+		// Tombstone the directory before its children: when the store drops
+		// the subtree without listing it, or a child error aborts the walk,
+		// the ancestor tombstone still covers every descendant.
+		dirTombstoneTs = time.Now().UnixNano()
+		f.noteRemoteDeletion(entry.FullPath, true, dirTombstoneTs)
+	}
+
 	//collect all the chunks of this layer and delete them together at the end
 	var chunksToDelete []*filer_pb.FileChunk
 	lastFileName := ""
 	includeLastFile := false
-	if !isDeletingBucket || !f.Store.CanDropWholeBucket() {
+	listedChildren := !isDeletingBucket || !f.Store.CanDropWholeBucket()
+	if listedChildren {
 		for {
 			entries, _, err := f.ListDirectoryEntries(ctx, entry.FullPath, lastFileName, includeLastFile, PaginationSize, "", "", "")
 			if err != nil {
+				// nothing was deleted; a leftover tombstone would hide the
+				// still-existing remote children
+				f.unnoteRemoteDeletion(entry.FullPath, dirTombstoneTs)
 				glog.ErrorfCtx(ctx, "list folder %s: %v", entry.FullPath, err)
 				return fmt.Errorf("list folder %s: %v", entry.FullPath, err)
 			}
 			if lastFileName == "" && !isRecursive && len(entries) > 0 {
 				// only for first iteration in the loop
 				glog.V(2).InfofCtx(ctx, "deleting a folder %s has children: %+v ...", entry.FullPath, entries[0].Name())
-				return fmt.Errorf("%s: %s", MsgFailDelNonEmptyFolder, entry.FullPath)
+				return fmt.Errorf("%w: %s", ErrNonEmptyFolder, entry.FullPath)
 			}
 
 			for _, sub := range entries {
 				lastFileName = sub.Name()
+				if !keepsRemoteObject(ctx) {
+					f.noteRemoteDeletion(sub.FullPath, sub.IsDirectory(), time.Now().UnixNano())
+				}
 				if sub.IsDirectory() {
 					subIsDeletingBucket := f.IsBucket(sub)
 					err = f.doBatchDeleteFolderMetaAndData(ctx, sub, isRecursive, ignoreRecursiveError, shouldDeleteChunks, subIsDeletingBucket, isFromOtherCluster, nil, onHardLinkIdsFn)
 				} else {
-					if !isFromOtherCluster {
+					if !isFromOtherCluster && !keepsRemoteObject(ctx) {
 						if _, remoteErr := f.maybeDeleteFromRemote(ctx, sub); remoteErr != nil {
 							glog.Warningf("remote delete child %s: %v", sub.FullPath, remoteErr)
 							if !ignoreRecursiveError {
@@ -108,10 +245,13 @@ func (f *Filer) doBatchDeleteFolderMetaAndData(ctx context.Context, entry *Entry
 					if err != nil && !ignoreRecursiveError {
 						break
 					}
-					f.NotifyUpdateEvent(ctx, sub, nil, shouldDeleteChunks, isFromOtherCluster, nil)
+					f.NotifyUpdateEvent(ctx, deleteEventEntry(ctx, sub), nil, shouldDeleteChunks, isFromOtherCluster, nil)
 					if len(sub.HardLinkId) != 0 {
 						// hard link chunk data are deleted separately
 						err = onHardLinkIdsFn([]HardLinkId{sub.HardLinkId})
+						if shouldDeleteChunks && f.hardLinkIsOrphaned(ctx, sub.HardLinkId) {
+							chunksToDelete = append(chunksToDelete, sub.GetChunks()...)
+						}
 					} else {
 						if shouldDeleteChunks {
 							chunksToDelete = append(chunksToDelete, sub.GetChunks()...)
@@ -131,11 +271,15 @@ func (f *Filer) doBatchDeleteFolderMetaAndData(ctx context.Context, entry *Entry
 
 	glog.V(3).InfofCtx(ctx, "deleting directory %v delete chunks: %v", entry.FullPath, shouldDeleteChunks)
 
-	if storeDeletionErr := f.Store.DeleteFolderChildren(ctx, entry.FullPath); storeDeletionErr != nil {
-		return fmt.Errorf("filer store delete: %w", storeDeletionErr)
+	// a non-recursive delete already proved the folder empty above, so sweeping the
+	// children now can only remove entries that raced in after that listing
+	if isRecursive || !listedChildren {
+		if storeDeletionErr := f.Store.DeleteFolderChildren(ctx, entry.FullPath); storeDeletionErr != nil {
+			return fmt.Errorf("filer store delete: %w", storeDeletionErr)
+		}
 	}
 
-	f.NotifyUpdateEvent(ctx, entry, nil, shouldDeleteChunks, isFromOtherCluster, signatures)
+	f.NotifyUpdateEvent(ctx, deleteEventEntry(ctx, entry), nil, shouldDeleteChunks, isFromOtherCluster, signatures)
 	f.DeleteChunks(ctx, entry.FullPath, chunksToDelete)
 
 	return nil
@@ -145,27 +289,116 @@ func (f *Filer) doDeleteEntryMetaAndData(ctx context.Context, entry *Entry, shou
 
 	glog.V(3).InfofCtx(ctx, "deleting entry %v, delete chunks: %v", entry.FullPath, shouldDeleteChunks)
 
-	if !isFromOtherCluster {
+	if !isFromOtherCluster && !keepsRemoteObject(ctx) {
 		if _, remoteDeletionErr := f.maybeDeleteFromRemote(ctx, entry); remoteDeletionErr != nil {
 			return remoteDeletionErr
 		}
 	}
 
+	// A metadata-only delete owes the remote nothing, so lazy reads stay open.
+	if !keepsRemoteObject(ctx) {
+		f.noteRemoteDeletion(entry.FullPath, entry.IsDirectory(), time.Now().UnixNano())
+	}
+
 	if storeDeletionErr := f.Store.DeleteOneEntry(ctx, entry); storeDeletionErr != nil {
 		return fmt.Errorf("filer store delete: %w", storeDeletionErr)
 	}
 
 	if !entry.IsDirectory() {
-		f.NotifyUpdateEvent(ctx, entry, nil, shouldDeleteChunks, isFromOtherCluster, signatures)
+		f.NotifyUpdateEvent(ctx, deleteEventEntry(ctx, entry), nil, shouldDeleteChunks, isFromOtherCluster, signatures)
 	}
 
 	return nil
 }
 
-func (f *Filer) DoDeleteCollection(collectionName string) (err error) {
+// collectionDeleteTimeout bounds the collection delete a bucket entry's own
+// delete leaves behind, which carries no deadline of its own. It bounds the wait
+// and not the work: the master keeps deleting on its own fan-out once asked, so
+// giving up costs the confirmation. Short enough that the S3 client waiting on
+// the bucket delete, which pays this and then the gateway's own follow-up
+// DeleteCollection, still has retry budget left.
+const collectionDeleteTimeout = 15 * time.Second
 
-	return f.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-		_, err := client.CollectionDelete(context.Background(), &master_pb.CollectionDeleteRequest{
+// bucketCollection resolves the collection a bucket's objects land in
+// through the same chain the write path uses -- a grouped gateway's explicit
+// collection, then the storage rules, then the bucket name -- and reports it
+// only when nothing outside the bucket can still route into it. A shared
+// collection must survive the bucket delete: dropping it removes volumes
+// other paths still write to. A listing failure keeps the collection, the
+// safe side of an unknown.
+func (f *Filer) bucketCollection(ctx context.Context, bucket string) (collection string) {
+	bucketDir := f.DirBucketsPath + "/" + bucket + "/"
+	resolve := func(dir, name string) string {
+		if f.MasterClient != nil {
+			if group := f.MasterClient.FilerGroup; group != "" {
+				return group + "_" + name
+			}
+		}
+		return util.Nvl(f.FilerConf.MatchStorageRule(dir).Collection, name)
+	}
+	collection = resolve(bucketDir, bucket)
+
+	// Rule-less writes outside buckets fall back to the filer's default
+	// collection, so a bucket resolving there shares it with them. The
+	// system metadata-log collection (when explicitly redirected via
+	// filer.options.metaLog.collection) is in the same boat: it backs internal
+	// log volumes, so a bucket that resolves there must never drop it
+	// either.
+	if collection == f.metaLogCollection {
+		return ""
+	}
+	if f.metaLogTargetCollection != "" && collection == f.metaLogTargetCollection {
+		return ""
+	}
+
+	// A rule whose prefix escapes the bucket can route other paths into the
+	// same collection, including prefixes nested under surviving buckets.
+	for _, rule := range f.FilerConf.ToProto().Locations {
+		prefix := strings.TrimSuffix(rule.LocationPrefix, "/") + "/"
+		if strings.HasPrefix(prefix, bucketDir) {
+			continue
+		}
+		if f.FilerConf.MatchStorageRule(prefix).Collection == collection {
+			return ""
+		}
+	}
+
+	siblings, err := f.listBuckets(ctx)
+	if err != nil {
+		glog.ErrorfCtx(ctx, "list buckets for collection check: %v", err)
+		return ""
+	}
+	for _, sibling := range siblings {
+		if sibling != bucket && resolve(f.DirBucketsPath+"/"+sibling+"/", sibling) == collection {
+			return ""
+		}
+	}
+	return collection
+}
+
+func (f *Filer) listBuckets(ctx context.Context) (buckets []string, err error) {
+	lastFileName := ""
+	for {
+		entries, _, listErr := f.ListDirectoryEntries(ctx, util.FullPath(f.DirBucketsPath), lastFileName, false, PaginationSize, "", "", "")
+		if listErr != nil {
+			return nil, listErr
+		}
+		for _, entry := range entries {
+			lastFileName = entry.Name()
+			if f.IsBucket(entry) {
+				buckets = append(buckets, entry.Name())
+			}
+		}
+		if len(entries) < PaginationSize {
+			return buckets, nil
+		}
+	}
+}
+
+func (f *Filer) DoDeleteCollection(ctx context.Context, collectionName string) (err error) {
+
+	return f.MasterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+		_, err := client.CollectionDelete(ctx, &master_pb.CollectionDeleteRequest{
 			Name: collectionName,
 		})
 		if err != nil {
@@ -183,3 +416,10 @@ func (f *Filer) maybeDeleteHardLinks(ctx context.Context, hardLinkIds []HardLink
 		}
 	}
 }
+
+// hardLinkIsOrphaned reports whether the shared inode record for hardLinkId
+// is gone, meaning the removed link was the last owner of its chunks.
+func (f *Filer) hardLinkIsOrphaned(ctx context.Context, hardLinkId HardLinkId) bool {
+	_, err := f.Store.KvGet(ctx, hardLinkId)
+	return errors.Is(err, ErrKvNotFound)
+}
diff --git a/weed/filer/filer_delete_entry_test.go b/weed/filer/filer_delete_entry_test.go
new file mode 100644
index 0000000000..7a049fade4
--- /dev/null
+++ b/weed/filer/filer_delete_entry_test.go
@@ -0,0 +1,119 @@
+package filer
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/require"
+)
+
+// The path in a non-empty-folder failure is the client's, so the marker has to
+// lead the message for a caller reading it off the wire to trust it.
+func TestNonEmptyFolderClassification(t *testing.T) {
+	err := fmt.Errorf("%w: %s", ErrNonEmptyFolder, "/buckets/b/photos")
+	if !IsNonEmptyFolderError(err) {
+		t.Errorf("expected the sentinel to be recognized: %v", err)
+	}
+	if !errors.Is(DeleteEntryError(err.Error()), ErrNonEmptyFolder) {
+		t.Errorf("expected the wire text to classify: %v", err)
+	}
+
+	// an entry named after the marker cannot forge one: every other delete
+	// failure the filer builds leads with its own wrapper
+	spoofed := "delete file /buckets/b/" + MsgFailDelNonEmptyFolder + ": filer store delete: disk full"
+	if errors.Is(DeleteEntryError(spoofed), ErrNonEmptyFolder) {
+		t.Errorf("expected no forgery from the entry name: %v", spoofed)
+	}
+	if IsNonEmptyFolderError(errors.New(spoofed)) {
+		t.Errorf("expected no forgery from the entry name: %v", spoofed)
+	}
+}
+
+func TestKeepRemoteObjectMarkerOnlyLivesOnDeleteEvents(t *testing.T) {
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, NewFilerRemoteStorage())
+	ctx := context.Background()
+	planted := func() map[string][]byte {
+		return map[string][]byte{ExtKeepRemoteObjectKey: []byte("true"), "Seaweed-Other": []byte("kept")}
+	}
+	dir := &Entry{FullPath: "/buckets/b/dir", Attr: Attr{Mode: os.ModeDir | 0755}}
+	file := &Entry{FullPath: "/buckets/b/dir/obj.bin", Attr: Attr{Mode: 0644}, Extended: planted()}
+	require.NoError(t, f.CreateEntry(ctx, dir, nil, false, false, nil, true, 255))
+	require.NoError(t, f.CreateEntry(ctx, file, nil, false, false, nil, true, 255))
+	updated := file.ShallowClone()
+	updated.Extended = planted()
+	require.NoError(t, f.UpdateEntry(ctx, file, updated, false))
+
+	stored := store.entries[string(file.FullPath)]
+	require.NotContains(t, stored.Extended, ExtKeepRemoteObjectKey, "a client must not be able to store the marker")
+	require.Contains(t, stored.Extended, "Seaweed-Other")
+
+	ordinaryCtx, ordinary := WithMetadataEventSink(ctx)
+	require.NoError(t, f.DeleteEntryMetaAndData(ordinaryCtx, file.FullPath, false, false, false, false, nil, 0))
+	require.False(t, IsMetadataOnlyDelete(ordinary.Last().EventNotification.OldEntry))
+
+	require.NoError(t, f.CreateEntry(ctx, &Entry{FullPath: file.FullPath, Attr: Attr{Mode: 0644}}, nil, false, false, nil, true, 255))
+	keepCtx, keep := WithMetadataEventSink(WithKeepRemoteObject(ctx))
+	require.NoError(t, f.DeleteEntryMetaAndData(keepCtx, dir.FullPath, true, false, false, false, nil, 0))
+	require.Equal(t, "dir", keep.Last().EventNotification.OldEntry.Name)
+	require.True(t, IsMetadataOnlyDelete(keep.Last().EventNotification.OldEntry))
+}
+
+// A recursive delete that removes the last link to an inode must free the
+// shared chunks: the record that owned them is gone, so nothing else will.
+func TestDeleteFolderFreesLastHardLinkChunks(t *testing.T) {
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, NewFilerRemoteStorage())
+	ctx := context.Background()
+
+	hardLinkId := NewHardLinkId()
+	require.NoError(t, f.CreateEntry(ctx, &Entry{FullPath: "/d", Attr: Attr{Mode: os.ModeDir | 0755}}, nil, false, false, nil, true, 255))
+	linkEntry := &Entry{
+		FullPath:        "/d/a.txt",
+		Attr:            Attr{Mode: 0644, Mtime: time.Now()},
+		HardLinkId:      hardLinkId,
+		HardLinkCounter: 1,
+		Chunks:          []*filer_pb.FileChunk{{FileId: "3,01637037d6"}},
+	}
+	require.NoError(t, f.CreateEntry(ctx, linkEntry, nil, false, false, nil, true, 255))
+
+	require.NoError(t, f.DeleteEntryMetaAndData(ctx, "/d", true, false, true, false, nil, 0))
+
+	_, err := store.KvGet(ctx, hardLinkId)
+	require.ErrorIs(t, err, ErrKvNotFound)
+	require.Equal(t, 1, f.pendingDeletionCount())
+}
+
+// The same delete keeps the shared chunks while another link outside the
+// folder still owns them.
+func TestDeleteFolderKeepsSharedHardLinkChunks(t *testing.T) {
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, NewFilerRemoteStorage())
+	ctx := context.Background()
+
+	hardLinkId := NewHardLinkId()
+	for _, dir := range []string{"/d", "/keep"} {
+		require.NoError(t, f.CreateEntry(ctx, &Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir | 0755}}, nil, false, false, nil, true, 255))
+	}
+	for _, path := range []string{"/d/a.txt", "/keep/b.txt"} {
+		require.NoError(t, f.CreateEntry(ctx, &Entry{
+			FullPath:        util.FullPath(path),
+			Attr:            Attr{Mode: 0644, Mtime: time.Now()},
+			HardLinkId:      hardLinkId,
+			HardLinkCounter: 2,
+			Chunks:          []*filer_pb.FileChunk{{FileId: "3,01637037d6"}},
+		}, nil, false, false, nil, true, 255))
+	}
+
+	require.NoError(t, f.DeleteEntryMetaAndData(ctx, "/d", true, false, true, false, nil, 0))
+
+	_, err := store.KvGet(ctx, hardLinkId)
+	require.NoError(t, err, "surviving link must keep the inode record")
+	require.Equal(t, 0, f.pendingDeletionCount())
+}
diff --git a/weed/filer/filer_deletion.go b/weed/filer/filer_deletion.go
index 6d472d0a7b..ba65a325f2 100644
--- a/weed/filer/filer_deletion.go
+++ b/weed/filer/filer_deletion.go
@@ -66,8 +66,9 @@ type DeletionRetryItem struct {
 	RetryCount  int
 	NextRetryAt time.Time
 	LastError   string
-	heapIndex   int  // index in the heap (for heap.Interface)
-	inFlight    bool // true when item is being processed, prevents duplicate additions
+	ledgerEpoch uint64 // pendingDeletions epoch when the item was queued; expiry forgets only a matching epoch
+	heapIndex   int    // index in the heap (for heap.Interface)
+	inFlight    bool   // true when item is being processed, prevents duplicate additions
 }
 
 // retryHeap implements heap.Interface for DeletionRetryItem
@@ -163,7 +164,7 @@ func calculateBackoff(retryCount int) time.Duration {
 
 // AddOrUpdate adds a new failed deletion or updates an existing one
 // Time complexity: O(log N) for insertion/update
-func (q *DeletionRetryQueue) AddOrUpdate(fileId string, errorMsg string) {
+func (q *DeletionRetryQueue) AddOrUpdate(fileId string, errorMsg string, ledgerEpoch uint64) {
 	q.lock.Lock()
 	defer q.lock.Unlock()
 
@@ -173,6 +174,13 @@ func (q *DeletionRetryQueue) AddOrUpdate(fileId string, errorMsg string) {
 		// The existing retry schedule should proceed.
 		// RetryCount is only incremented in RequeueForRetry when an actual retry is performed.
 		item.LastError = errorMsg
+		// Keep the recorded epoch while the item is in flight: an expiry or
+		// permanent outcome from that attempt must forget only the record it
+		// started with, not a newer enqueue for the same id. This also keeps
+		// the field immutable once the worker can read it without the lock.
+		if !item.inFlight {
+			item.ledgerEpoch = ledgerEpoch
+		}
 		if item.inFlight {
 			glog.V(2).Infof("retry for %s in-flight: attempt %d, will preserve retry state", fileId, item.RetryCount)
 		} else {
@@ -188,6 +196,7 @@ func (q *DeletionRetryQueue) AddOrUpdate(fileId string, errorMsg string) {
 		RetryCount:  1,
 		NextRetryAt: time.Now().Add(delay),
 		LastError:   errorMsg,
+		ledgerEpoch: ledgerEpoch,
 		inFlight:    false,
 	}
 	heap.Push(&q.heap, item)
@@ -216,18 +225,19 @@ func (q *DeletionRetryQueue) RequeueForRetry(item *DeletionRetryItem, errorMsg s
 	heap.Push(&q.heap, item)
 }
 
-// GetReadyItems returns items that are ready to be retried and marks them as in-flight
+// GetReadyItems returns items that are ready to be retried and marks them as in-flight.
+// Expired reports fileIds dropped for exceeding MaxRetryAttempts — permanent
+// dropouts the caller must also forget in the durable deletion ledger.
 // Time complexity: O(K log N) where K is the number of ready items
 // Items are processed in order of NextRetryAt (earliest first)
-func (q *DeletionRetryQueue) GetReadyItems(maxItems int) []*DeletionRetryItem {
+func (q *DeletionRetryQueue) GetReadyItems(maxItems int) (ready []*DeletionRetryItem, expired []*DeletionRetryItem) {
 	q.lock.Lock()
 	defer q.lock.Unlock()
 
 	now := time.Now()
-	var readyItems []*DeletionRetryItem
 
 	// Peek at items from the top of the heap (earliest NextRetryAt)
-	for len(q.heap) > 0 && len(readyItems) < maxItems {
+	for len(q.heap) > 0 && len(ready) < maxItems {
 		item := q.heap[0]
 
 		// If the earliest item is not ready yet, no other items are ready either
@@ -240,15 +250,16 @@ func (q *DeletionRetryQueue) GetReadyItems(maxItems int) []*DeletionRetryItem {
 
 		if item.RetryCount <= MaxRetryAttempts {
 			item.inFlight = true // Mark as being processed
-			readyItems = append(readyItems, item)
+			ready = append(ready, item)
 		} else {
 			// Max attempts reached, log and discard completely
 			delete(q.itemIndex, item.FileId)
+			expired = append(expired, item)
 			glog.Warningf("max retry attempts (%d) reached for %s, last error: %s", MaxRetryAttempts, item.FileId, item.LastError)
 		}
 	}
 
-	return readyItems
+	return ready, expired
 }
 
 // Remove removes an item from the queue (called when deletion succeeds or fails permanently)
@@ -306,24 +317,29 @@ func (f *Filer) loopProcessingDeletion() {
 			glog.V(0).Infof("deletion processor shutting down")
 			return
 		case <-ticker.C:
-			f.fileIdDeletionQueue.Consume(func(fileIds []string) {
-				for i := 0; i < len(fileIds); i += DeletionBatchSize {
-					end := i + DeletionBatchSize
-					if end > len(fileIds) {
-						end = len(fileIds)
-					}
-					toDeleteFileIds := fileIds[i:end]
-					f.processDeletionBatch(toDeleteFileIds, lookupFunc)
-				}
-			})
+			f.FlushFileIdDeletionQueue(context.Background(), lookupFunc)
 		}
 	}
 }
 
+func (f *Filer) FlushFileIdDeletionQueue(ctx context.Context, lookupFunc func([]string) (map[string]*operation.LookupResult, error)) (consumed []string) {
+	f.FileIdDeletionQueue.Consume(func(fileIds []string) {
+		consumed = fileIds
+		for i := 0; i < len(fileIds); i += DeletionBatchSize {
+			end := i + DeletionBatchSize
+			if end > len(fileIds) {
+				end = len(fileIds)
+			}
+			f.processDeletionBatch(ctx, fileIds[i:end], lookupFunc)
+		}
+	})
+	return consumed
+}
+
 // processDeletionBatch handles deletion of a batch of file IDs and processes results.
 // It classifies errors into retryable and permanent categories, adds retryable failures
 // to the retry queue, and logs appropriate messages.
-func (f *Filer) processDeletionBatch(toDeleteFileIds []string, lookupFunc func([]string) (map[string]*operation.LookupResult, error)) {
+func (f *Filer) processDeletionBatch(ctx context.Context, toDeleteFileIds []string, lookupFunc func([]string) (map[string]*operation.LookupResult, error)) {
 	// Deduplicate file IDs to prevent incorrect retry count increments for the same file ID within a single batch.
 	uniqueFileIdsSlice := make([]string, 0, len(toDeleteFileIds))
 	processed := make(map[string]struct{}, len(toDeleteFileIds))
@@ -338,8 +354,15 @@ func (f *Filer) processDeletionBatch(toDeleteFileIds []string, lookupFunc func([
 		return
 	}
 
+	// Remember each id's ledger epoch before the remote deletes run: a
+	// permanent outcome below must not erase a record re-queued mid-flight.
+	epochs := make(map[string]uint64, len(uniqueFileIdsSlice))
+	for _, fileId := range uniqueFileIdsSlice {
+		epochs[fileId] = f.deletionEpoch(fileId)
+	}
+
 	// Delete files and classify outcomes
-	outcomes := deleteFilesAndClassify(f.GrpcDialOption, uniqueFileIdsSlice, lookupFunc)
+	outcomes := deleteFilesAndClassify(ctx, f.GrpcDialOption, uniqueFileIdsSlice, lookupFunc)
 
 	// Process outcomes
 	var successCount, notFoundCount, retryableErrorCount, permanentErrorCount int
@@ -351,16 +374,21 @@ func (f *Filer) processDeletionBatch(toDeleteFileIds []string, lookupFunc func([
 		switch outcome.status {
 		case deletionOutcomeSuccess:
 			successCount++
+			f.forgetDeletion(fileId) // confirmed gone: drop from durable ledger
 		case deletionOutcomeNotFound:
 			notFoundCount++
+			f.forgetDeletion(fileId) // already gone: drop from durable ledger
 		case deletionOutcomeRetryable, deletionOutcomeNoResult:
 			retryableErrorCount++
-			f.DeletionRetryQueue.AddOrUpdate(fileId, outcome.errorMsg)
+			// Keep in the durable ledger: not confirmed, must survive restarts.
+			f.DeletionRetryQueue.AddOrUpdate(fileId, outcome.errorMsg, f.deletionEpoch(fileId))
 			if len(errorDetails) < MaxLoggedErrorDetails {
 				errorDetails = append(errorDetails, fileId+": "+outcome.errorMsg+" (will retry)")
 			}
 		case deletionOutcomePermanent:
 			permanentErrorCount++
+			// gave up: drop the record, unless the id was re-queued meanwhile
+			f.forgetDeletionEpoch(fileId, epochs[fileId])
 			if len(errorDetails) < MaxLoggedErrorDetails {
 				errorDetails = append(errorDetails, fileId+": "+outcome.errorMsg+" (permanent)")
 			}
@@ -405,9 +433,9 @@ type deletionOutcome struct {
 }
 
 // deleteFilesAndClassify performs deletion and classifies outcomes for a list of file IDs
-func deleteFilesAndClassify(grpcDialOption grpc.DialOption, fileIds []string, lookupFunc func([]string) (map[string]*operation.LookupResult, error)) map[string]deletionOutcome {
+func deleteFilesAndClassify(ctx context.Context, grpcDialOption grpc.DialOption, fileIds []string, lookupFunc func([]string) (map[string]*operation.LookupResult, error)) map[string]deletionOutcome {
 	// Perform deletion
-	results := operation.DeleteFileIdsWithLookupVolumeId(grpcDialOption, fileIds, lookupFunc)
+	results := operation.DeleteFileIdsWithLookupVolumeId(ctx, grpcDialOption, fileIds, lookupFunc)
 
 	// Group results by file ID to handle multiple results for replicated volumes
 	resultsByFileId := make(map[string][]*volume_server_pb.DeleteResult)
@@ -518,7 +546,16 @@ func (f *Filer) loopProcessingDeletionRetry(lookupFunc func([]string) (map[strin
 			// Process all ready items in batches until queue is empty
 			totalProcessed := 0
 			for {
-				readyItems := f.DeletionRetryQueue.GetReadyItems(DeletionRetryBatchSize)
+				readyItems, expired := f.DeletionRetryQueue.GetReadyItems(DeletionRetryBatchSize)
+				for _, item := range expired {
+					// Permanently discarded — drop the ledger record, but only
+					// if the id was not re-queued after this retry item was
+					// recorded. A surviving newer record still needs work, so
+					// it goes back through the hot queue.
+					if !f.forgetDeletionEpoch(item.FileId, item.ledgerEpoch) {
+						f.queueDeletions(item.FileId)
+					}
+				}
 				if len(readyItems) == 0 {
 					break
 				}
@@ -545,7 +582,7 @@ func (f *Filer) processRetryBatch(readyItems []*DeletionRetryItem, lookupFunc fu
 	}
 
 	// Delete files and classify outcomes
-	outcomes := deleteFilesAndClassify(f.GrpcDialOption, fileIds, lookupFunc)
+	outcomes := deleteFilesAndClassify(context.Background(), f.GrpcDialOption, fileIds, lookupFunc)
 
 	// Process outcomes - iterate over readyItems to ensure all items are accounted for
 	var successCount, notFoundCount, retryCount, permanentErrorCount int
@@ -556,19 +593,27 @@ func (f *Filer) processRetryBatch(readyItems []*DeletionRetryItem, lookupFunc fu
 		case deletionOutcomeSuccess:
 			successCount++
 			f.DeletionRetryQueue.Remove(item) // Remove from queue (success)
+			f.forgetDeletion(item.FileId)     // confirmed gone: drop from durable ledger
 			glog.V(2).Infof("retry successful for %s after %d attempts", item.FileId, item.RetryCount)
 		case deletionOutcomeNotFound:
 			notFoundCount++
 			f.DeletionRetryQueue.Remove(item) // Remove from queue (already deleted)
+			f.forgetDeletion(item.FileId)     // already gone: drop from durable ledger
 		case deletionOutcomeRetryable, deletionOutcomeNoResult:
 			retryCount++
 			if outcome.status == deletionOutcomeNoResult {
 				glog.Warningf("no deletion result for retried file %s, re-queuing to avoid loss", item.FileId)
 			}
+			// Keep in the durable ledger: still not confirmed.
 			f.DeletionRetryQueue.RequeueForRetry(item, outcome.errorMsg)
 		case deletionOutcomePermanent:
 			permanentErrorCount++
 			f.DeletionRetryQueue.Remove(item) // Remove from queue (permanent failure)
+			// gave up: drop the record, unless the id was re-queued meanwhile
+			// — a surviving newer record goes back through the hot queue.
+			if !f.forgetDeletionEpoch(item.FileId, item.ledgerEpoch) {
+				f.queueDeletions(item.FileId)
+			}
 			glog.Warningf("permanent error on retry for %s after %d attempts: %s", item.FileId, item.RetryCount, outcome.errorMsg)
 		}
 	}
@@ -599,23 +644,23 @@ func (f *Filer) DeleteChunks(ctx context.Context, fullpath util.FullPath, chunks
 func (f *Filer) doDeleteChunks(ctx context.Context, chunks []*filer_pb.FileChunk) {
 	for _, chunk := range chunks {
 		if !chunk.IsChunkManifest {
-			f.fileIdDeletionQueue.EnQueue(chunk.GetFileIdString())
+			f.queueDeletions(chunk.GetFileIdString())
 			continue
 		}
-		dataChunks, manifestResolveErr := ResolveOneChunkManifest(ctx, f.MasterClient.LookupFileId, chunk)
+		dataChunks, manifestResolveErr := ResolveOneChunkManifest(ctx, f.MasterClient.LookupFileId, chunk, f.MasterClient)
 		if manifestResolveErr != nil {
 			glog.V(0).InfofCtx(ctx, "failed to resolve manifest %s: %v", chunk.FileId, manifestResolveErr)
 		}
 		for _, dChunk := range dataChunks {
-			f.fileIdDeletionQueue.EnQueue(dChunk.GetFileIdString())
+			f.queueDeletions(dChunk.GetFileIdString())
 		}
-		f.fileIdDeletionQueue.EnQueue(chunk.GetFileIdString())
+		f.queueDeletions(chunk.GetFileIdString())
 	}
 }
 
 func (f *Filer) DeleteChunksNotRecursive(chunks []*filer_pb.FileChunk) {
 	for _, chunk := range chunks {
-		f.fileIdDeletionQueue.EnQueue(chunk.GetFileIdString())
+		f.queueDeletions(chunk.GetFileIdString())
 	}
 }
 
@@ -628,7 +673,7 @@ func (f *Filer) deleteChunksIfNotNew(ctx context.Context, oldEntry, newEntry *En
 		newChunks = newEntry.GetChunks()
 	}
 
-	toDelete, err := MinusChunks(ctx, f.MasterClient.GetLookupFileIdFunction(), oldChunks, newChunks)
+	toDelete, err := MinusChunks(ctx, f.MasterClient.GetLookupFileIdFunction(), oldChunks, newChunks, f.MasterClient)
 	if err != nil {
 		glog.ErrorfCtx(ctx, "Failed to resolve old entry chunks when delete old entry chunks. new: %s, old: %s", newChunks, oldChunks)
 		return
diff --git a/weed/filer/filer_deletion_persist.go b/weed/filer/filer_deletion_persist.go
new file mode 100644
index 0000000000..33b2371cf4
--- /dev/null
+++ b/weed/filer/filer_deletion_persist.go
@@ -0,0 +1,758 @@
+package filer
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// Persistent deletion ledger.
+//
+// Background: the in-memory FileIdDeletionQueue and DeletionRetryQueue lose every
+// queued-but-unconfirmed deletion when the filer process restarts (the upstream
+// TODO in filer_deletion.go notes this and proposes exactly the "periodic snapshot
+// with recovery on startup" strategy implemented here). Because a delete only ever
+// enters the pipeline through the queue, a crash between enqueue and the volume
+// actually confirming the delete leaks the chunk: nothing remembers it, so it
+// becomes an orphan the next fsck sees as 100% orphaned and a later
+// meta-replay from a lagging peer can "resurrect" as if it were live data.
+//
+// The ledger is a KV entry per filer (KvKeyDeletionLedger suffixed with this
+// filer's address, so filers sharing one store never overwrite each other's
+// pending sets) holding the fileIds that still need to be deleted but have not
+// yet been confirmed gone. It is:
+//   - additive: every EnQueue also records the fileId here,
+//   - subtractive: only terminal outcomes (success / not-found / permanent)
+//     remove it; retryable failures keep it,
+//   - snapshotted when it changes, on a timer, and on Shutdown, so a crash
+//     loses only ids queued in the last in-flight write — recovery re-enqueues
+//     the whole pending set and the idempotent volume delete absorbs anything
+//     that actually completed before the crash.
+//
+// Stores that cap value size (FoundationDB at 100KB) get the set split into
+// part keys when one value would exceed deletionLedgerPartSize. Multipart
+// snapshots write each generation under generation-scoped part keys and
+// publish only the manifest last, so a crash mid-write leaves the previous
+// generation intact; orphaned parts from abandoned generations are tracked in
+// deletionLedgerStale and retried on the next write.
+//
+// Safety on a lagging peer (the resurrection case): recovered entries are replayed
+// into the queue only after a grace window (DeletionRecoveryGrace), long enough for
+// the initial peer meta-aggregation to settle so we don't purge a chunk that a
+// peer is about to re-reference as live. New live deletes are never gated.
+const (
+	// KvKeyDeletionLedger is the reserved store key prefix for the persisted
+	// ledger, namespaced next to FilerStoreId so it never collides with user
+	// data. The full key is this prefix plus the filer's own address.
+	KvKeyDeletionLedger = "filer.deleteQueue.ledger.v1"
+
+	// KvKeyDeletionLedgerIndex lists the scoped ledger keys in the store so a
+	// filer that restarts under a different advertised address can still find
+	// and claim the ledger it left behind.
+	KvKeyDeletionLedgerIndex = KvKeyDeletionLedger + ".index"
+
+	// deletionLedgerPartSize bounds one ledger value; stores with a value cap
+	// reject anything larger, which would strand a big backlog in memory only.
+	deletionLedgerPartSize = 64 * 1024
+
+	// Defaults; all three overridable via viper (filer.deleteQueue.*).
+	defaultDeletionPersistInterval = 10 * time.Second
+	defaultDeletionRecoveryGrace   = 30 * time.Second
+)
+
+// deletionPersistEnabled reports whether ledger persistence is on.
+// Read from viper with a default of true so a plain `weed filer` gets the
+// durability guarantee without extra flags.
+func deletionPersistEnabled() bool {
+	v := util.GetViper()
+	v.SetDefault("filer.deleteQueue.persist", true)
+	return v.GetBool("filer.deleteQueue.persist")
+}
+
+func deletionPersistInterval() time.Duration {
+	v := util.GetViper()
+	v.SetDefault("filer.deleteQueue.persistInterval", defaultDeletionPersistInterval)
+	d := v.GetDuration("filer.deleteQueue.persistInterval")
+	if d <= 0 {
+		return defaultDeletionPersistInterval
+	}
+	return d
+}
+
+func deletionRecoveryGrace() time.Duration {
+	v := util.GetViper()
+	v.SetDefault("filer.deleteQueue.recoveryGrace", defaultDeletionRecoveryGrace)
+	d := v.GetDuration("filer.deleteQueue.recoveryGrace")
+	if d < 0 {
+		return 0
+	}
+	return d
+}
+
+// deletionLedgerKey scopes the ledger to this filer so several filers sharing
+// one metadata store do not overwrite each other's pending sets. A filer
+// literal without an advertised address (tests) falls back to the base key.
+func (f *Filer) deletionLedgerKey() string {
+	if f.Dlm != nil && f.Dlm.Host != "" {
+		return KvKeyDeletionLedger + "." + f.Dlm.Host.ToHttpAddress()
+	}
+	return KvKeyDeletionLedger
+}
+
+func deletionLedgerPartKey(key string, part int) []byte {
+	return []byte(fmt.Sprintf("%s.part.%05d", key, part))
+}
+
+// deletionLedgerGenPartKey returns the part key for one generation. Generation
+// 0 keeps the original format so ledgers written before generation publishing
+// still decode.
+func deletionLedgerGenPartKey(key string, gen, part int) []byte {
+	if gen == 0 {
+		return deletionLedgerPartKey(key, part)
+	}
+	return []byte(fmt.Sprintf("%s.g%06d.part.%05d", key, gen, part))
+}
+
+// startDeletionLedgerSnapshotter periodically flushes the pending deletion set
+// to durable storage. It also wakes on deletionLedgerFlush so a queued id is
+// persisted within milliseconds instead of a full interval. Started from
+// SetStore only after the ledger read succeeded.
+func (f *Filer) startDeletionLedgerSnapshotter() {
+	go func() {
+		ticker := time.NewTicker(deletionPersistInterval())
+		defer ticker.Stop()
+		for {
+			select {
+			case <-f.deletionQuit:
+				return
+			case <-ticker.C:
+			case <-f.deletionLedgerFlush:
+			}
+			// A close of deletionQuit may be concurrent with this wake; the
+			// final snapshot in Shutdown covers whatever the loop left dirty.
+			select {
+			case <-f.deletionQuit:
+				return
+			default:
+			}
+			f.snapshotDeletionLedger()
+		}
+	}()
+}
+
+// signalLedgerFlush wakes the snapshotter without blocking the caller.
+func (f *Filer) signalLedgerFlush() {
+	f.deletionLedgerLock.Lock()
+	if f.deletionLedgerFlush == nil {
+		f.deletionLedgerFlush = make(chan struct{}, 1)
+	}
+	ch := f.deletionLedgerFlush
+	f.deletionLedgerLock.Unlock()
+	select {
+	case ch <- struct{}{}:
+	default:
+	}
+}
+
+// queueDeletions is the single entry point for adding fileIds to the deletion
+// pipeline. It keeps the in-memory hot queue AND the durable ledger in sync.
+// Safe on a zero-value Filer (tests build struct literals without NewFiler):
+// the map is lazily created and the mutex is zero-value friendly.
+func (f *Filer) queueDeletions(fileIds ...string) {
+	if len(fileIds) == 0 {
+		return
+	}
+	// Hot path: existing in-memory queue, unchanged.
+	f.FileIdDeletionQueue.EnQueue(fileIds...)
+
+	// Durable ledger: record what still needs deleting. Every enqueue bumps the
+	// id's epoch so an expiry-forget carrying an older epoch cannot erase the
+	// re-queued intent.
+	f.deletionLedgerLock.Lock()
+	if f.pendingDeletions == nil {
+		f.pendingDeletions = make(map[string]uint64, len(fileIds))
+	}
+	for _, id := range fileIds {
+		if id == "" {
+			continue
+		}
+		_, exists := f.pendingDeletions[id]
+		f.deletionSeq++
+		f.pendingDeletions[id] = f.deletionSeq
+		if !exists {
+			f.deletionLedgerDirty = true
+		}
+	}
+	f.deletionLedgerLock.Unlock()
+	f.signalLedgerFlush()
+}
+
+// pendingDeletionCount returns the number of fileIds still tracked as needing
+// deletion in the durable ledger. Handy for diagnostics and tests; 0 when the
+// map was never initialised.
+func (f *Filer) pendingDeletionCount() int {
+	f.deletionLedgerLock.Lock()
+	defer f.deletionLedgerLock.Unlock()
+	return len(f.pendingDeletions)
+}
+
+// deletionEpoch returns the pending record's current epoch for fileId.
+func (f *Filer) deletionEpoch(fileId string) uint64 {
+	f.deletionLedgerLock.Lock()
+	defer f.deletionLedgerLock.Unlock()
+	return f.pendingDeletions[fileId]
+}
+
+// forgetDeletion removes a fileId from the ledger once its deletion is terminal
+// (deleted or already absent: the chunks are gone, so any pending record — even
+// a re-queued one — refers to work that no longer exists). Non-terminal
+// outcomes must NOT call this so the entry survives until confirmed.
+func (f *Filer) forgetDeletion(fileId string) {
+	if fileId == "" {
+		return
+	}
+	f.deletionLedgerLock.Lock()
+	if _, exists := f.pendingDeletions[fileId]; exists {
+		delete(f.pendingDeletions, fileId)
+		f.deletionLedgerDirty = true
+	}
+	f.deletionLedgerLock.Unlock()
+	f.signalLedgerFlush()
+}
+
+// forgetDeletionEpoch removes the ledger record only when its epoch still
+// matches the one captured when the deletion attempt began. A mismatch means
+// the id was re-queued meanwhile, so the newer record wins. Reports whether
+// the record was removed.
+func (f *Filer) forgetDeletionEpoch(fileId string, epoch uint64) bool {
+	if fileId == "" {
+		return false
+	}
+	removed := false
+	f.deletionLedgerLock.Lock()
+	if cur, exists := f.pendingDeletions[fileId]; exists && cur == epoch {
+		delete(f.pendingDeletions, fileId)
+		f.deletionLedgerDirty = true
+		removed = true
+	}
+	f.deletionLedgerLock.Unlock()
+	if removed {
+		f.signalLedgerFlush()
+	}
+	return removed
+}
+
+// snapshotDeletionLedger serialises the current pending set to the store.
+// Only writes when something changed since the last snapshot to keep KV churn low.
+// Writes serialize on deletionSnapshotLock so a snapshot in flight when Shutdown
+// starts cannot overwrite the final one with an older copy.
+func (f *Filer) snapshotDeletionLedger() {
+	if !deletionPersistEnabled() || f.Store == nil {
+		return
+	}
+	f.deletionSnapshotLock.Lock()
+	defer f.deletionSnapshotLock.Unlock()
+
+	if f.deletionLedgerBlocked.Load() && !f.tryUnblockDeletionLedger() {
+		return
+	}
+
+	f.deletionLedgerLock.Lock()
+	if !f.deletionLedgerDirty {
+		hasStale := len(f.deletionLedgerStale) > 0
+		f.deletionLedgerLock.Unlock()
+		if !hasStale {
+			return
+		}
+		// Nothing to republish, but orphaned part keys still need cleanup.
+		ctx := context.Background()
+		f.flushStaleLedgerParts(ctx)
+		f.persistStaleLedgerParts(ctx, f.deletionLedgerKey())
+		return
+	}
+	// Take a stable copy under lock; marshal + KV write happen outside it.
+	ids := make([]string, 0, len(f.pendingDeletions))
+	for id := range f.pendingDeletions {
+		ids = append(ids, id)
+	}
+	f.deletionLedgerDirty = false
+	f.deletionLedgerLock.Unlock()
+
+	if err := f.writeDeletionLedger(ids); err != nil {
+		glog.Warningf("failed to persist deletion ledger (%d ids): %v", len(ids), err)
+		f.deletionLedgerLock.Lock()
+		f.deletionLedgerDirty = true
+		f.deletionLedgerLock.Unlock()
+		return
+	}
+	glog.V(3).Infof("persisted deletion ledger: %d pending deletions", len(ids))
+}
+
+// tryUnblockDeletionLedger retries the ledger reload that originally failed.
+// Once the read succeeds the persisted ids merge back into the pending set and
+// snapshots resume; until then nothing is written so the unread ledger cannot
+// be overwritten.
+func (f *Filer) tryUnblockDeletionLedger() bool {
+	f.reloadDeletionLedger()
+	return !f.deletionLedgerBlocked.Load()
+}
+
+// writeDeletionLedger persists the id set. A single value is published
+// atomically; a multipart set writes a new generation's part keys first and
+// only then the manifest, so a crash or failed write leaves the previously
+// published generation readable. Orphaned parts are retried on the next write.
+func (f *Filer) writeDeletionLedger(ids []string) error {
+	ctx := context.Background()
+	key := f.deletionLedgerKey()
+
+	f.deletionLedgerLock.Lock()
+	prevGen, prevParts := f.deletionLedgerGen, f.deletionLedgerParts
+	f.deletionLedgerLock.Unlock()
+
+	f.flushStaleLedgerParts(ctx)
+
+	var parts [][]byte
+	var batch []string
+	size := 2 // "[]"
+	flush := func() error {
+		if batch == nil {
+			batch = []string{}
+		}
+		payload, err := json.Marshal(batch)
+		if err != nil {
+			return err
+		}
+		parts = append(parts, payload)
+		batch = nil
+		size = 2
+		return nil
+	}
+	for _, id := range ids {
+		if need := len(id) + 3; len(batch) > 0 && size+need > deletionLedgerPartSize {
+			if err := flush(); err != nil {
+				return err
+			}
+		}
+		batch = append(batch, id)
+		size += len(id) + 3
+	}
+	if len(batch) > 0 || len(parts) == 0 {
+		if err := flush(); err != nil {
+			return err
+		}
+	}
+
+	if len(parts) == 1 {
+		if err := f.Store.KvPut(ctx, []byte(key), parts[0]); err != nil {
+			return err
+		}
+		f.deleteLedgerParts(ctx, key, prevGen, prevParts)
+		f.deletionLedgerLock.Lock()
+		f.deletionLedgerGen, f.deletionLedgerParts = 0, 0
+		f.deletionLedgerLock.Unlock()
+	} else {
+		gen := prevGen + 1
+		wrote := 0
+		for i, payload := range parts {
+			if err := f.Store.KvPut(ctx, deletionLedgerGenPartKey(key, gen, i), payload); err != nil {
+				f.markStaleLedgerParts(key, gen, wrote)
+				return err
+			}
+			wrote++
+		}
+		manifest, _ := json.Marshal(struct {
+			Parts int `json:"parts"`
+			Gen   int `json:"gen,omitempty"`
+		}{len(parts), gen})
+		if err := f.Store.KvPut(ctx, []byte(key), manifest); err != nil {
+			f.markStaleLedgerParts(key, gen, wrote)
+			return err
+		}
+		f.deleteLedgerParts(ctx, key, prevGen, prevParts)
+		f.deletionLedgerLock.Lock()
+		f.deletionLedgerGen, f.deletionLedgerParts = gen, len(parts)
+		f.deletionLedgerLock.Unlock()
+	}
+	f.persistStaleLedgerParts(ctx, key)
+	f.touchLedgerIndex(ctx, key)
+	return nil
+}
+
+// deleteLedgerParts removes a published generation's part keys; failures are
+// tracked as stale so the next snapshot retries them.
+func (f *Filer) deleteLedgerParts(ctx context.Context, key string, gen, parts int) {
+	for i := 0; i < parts; i++ {
+		if err := f.Store.KvDelete(ctx, deletionLedgerGenPartKey(key, gen, i)); err != nil {
+			f.deletionLedgerLock.Lock()
+			f.deletionLedgerStale = append(f.deletionLedgerStale, string(deletionLedgerGenPartKey(key, gen, i)))
+			f.deletionLedgerLock.Unlock()
+		}
+	}
+}
+
+// markStaleLedgerParts remembers parts of an abandoned generation so they are
+// deleted by a later snapshot instead of leaking store space.
+func (f *Filer) markStaleLedgerParts(key string, gen, wrote int) {
+	if wrote == 0 {
+		return
+	}
+	f.deletionLedgerLock.Lock()
+	for i := 0; i < wrote; i++ {
+		f.deletionLedgerStale = append(f.deletionLedgerStale, string(deletionLedgerGenPartKey(key, gen, i)))
+	}
+	f.deletionLedgerLock.Unlock()
+}
+
+func (f *Filer) flushStaleLedgerParts(ctx context.Context) {
+	f.deletionLedgerLock.Lock()
+	stale := f.deletionLedgerStale
+	f.deletionLedgerStale = nil
+	f.deletionLedgerLock.Unlock()
+
+	var keep []string
+	for _, k := range stale {
+		if err := f.Store.KvDelete(ctx, []byte(k)); err != nil {
+			keep = append(keep, k)
+		}
+	}
+	if len(keep) > 0 {
+		f.deletionLedgerLock.Lock()
+		f.deletionLedgerStale = append(keep, f.deletionLedgerStale...)
+		f.deletionLedgerLock.Unlock()
+	}
+}
+
+// persistStaleLedgerParts mirrors the stale-part list under a sidecar key so a
+// crash between manifest publication and part cleanup can retry after restart
+// instead of orphaning the part keys.
+func (f *Filer) persistStaleLedgerParts(ctx context.Context, key string) {
+	f.deletionLedgerLock.Lock()
+	stale := append([]string(nil), f.deletionLedgerStale...)
+	f.deletionLedgerLock.Unlock()
+	staleKey := []byte(key + ".stale")
+	if len(stale) == 0 {
+		_ = f.Store.KvDelete(ctx, staleKey)
+		return
+	}
+	payload, _ := json.Marshal(stale)
+	_ = f.Store.KvPut(ctx, staleKey, payload)
+}
+
+// loadStaleLedgerParts seeds the stale-part list left by a previous run.
+func (f *Filer) loadStaleLedgerParts(ctx context.Context, key string) {
+	payload, err := f.Store.KvGet(ctx, []byte(key+".stale"))
+	if err != nil {
+		return
+	}
+	var stale []string
+	if json.Unmarshal(payload, &stale) != nil {
+		return
+	}
+	f.deletionLedgerLock.Lock()
+	f.deletionLedgerStale = append(f.deletionLedgerStale, stale...)
+	f.deletionLedgerLock.Unlock()
+}
+
+// touchLedgerIndex records this filer's scoped key in the shared index so the
+// ledger remains discoverable if the filer restarts under a new address. The
+// index is a read-modify-write list with no CAS, so the write is verified and
+// retried: a peer's concurrent update must not drop this key.
+func (f *Filer) touchLedgerIndex(ctx context.Context, key string) {
+	if key == KvKeyDeletionLedger {
+		return
+	}
+	for attempt := 0; attempt < 3; attempt++ {
+		keys, err := f.readLedgerIndex(ctx)
+		if err != nil {
+			// Only a genuinely absent index means "empty"; a store error must
+			// not let us write a one-key list that drops every peer entry.
+			if err != ErrKvNotFound {
+				glog.V(1).Infof("deletion ledger index unreadable, skipping update: %v", err)
+				return
+			}
+			keys = nil
+		}
+		found := false
+		for _, k := range keys {
+			if k == key {
+				found = true
+				break
+			}
+		}
+		if found {
+			return
+		}
+		payload, _ := json.Marshal(append(keys, key))
+		if err := f.Store.KvPut(ctx, []byte(KvKeyDeletionLedgerIndex), payload); err != nil {
+			glog.V(1).Infof("failed to update deletion ledger index: %v", err)
+			return
+		}
+	}
+	glog.V(1).Infof("deletion ledger index lost %q to a concurrent update; retrying on the next snapshot", key)
+}
+
+func (f *Filer) readLedgerIndex(ctx context.Context) ([]string, error) {
+	payload, err := f.Store.KvGet(ctx, []byte(KvKeyDeletionLedgerIndex))
+	if err != nil {
+		return nil, err
+	}
+	var keys []string
+	if err := json.Unmarshal(payload, &keys); err != nil {
+		return nil, err
+	}
+	return keys, nil
+}
+
+func (f *Filer) pruneLedgerIndex(ctx context.Context, key string) {
+	keys, err := f.readLedgerIndex(ctx)
+	if err != nil {
+		return
+	}
+	kept := keys[:0]
+	for _, k := range keys {
+		if k != key {
+			kept = append(kept, k)
+		}
+	}
+	payload, _ := json.Marshal(kept)
+	_ = f.Store.KvPut(ctx, []byte(KvKeyDeletionLedgerIndex), payload)
+}
+
+// readDeletionLedger reads the manifest key: a JSON array is the whole set; a
+// {"parts":N,"gen":G} manifest points at that generation's part keys. A part
+// the manifest references but the store lacks is corruption, not absence, so
+// it surfaces as a wrapped error rather than ErrKvNotFound.
+func (f *Filer) readDeletionLedger(key string) (ids []string, gen, parts int, err error) {
+	ctx := context.Background()
+
+	payload, err := f.Store.KvGet(ctx, []byte(key))
+	if err != nil {
+		return nil, 0, 0, err
+	}
+	if !bytes.HasPrefix(bytes.TrimSpace(payload), []byte("{")) {
+		if err := json.Unmarshal(payload, &ids); err != nil {
+			return nil, 0, 0, err
+		}
+		return ids, 0, 0, nil
+	}
+	var manifest struct {
+		Parts int `json:"parts"`
+		Gen   int `json:"gen,omitempty"`
+	}
+	if err := json.Unmarshal(payload, &manifest); err != nil {
+		return nil, 0, 0, err
+	}
+	for i := 0; i < manifest.Parts; i++ {
+		partPayload, err := f.Store.KvGet(ctx, deletionLedgerGenPartKey(key, manifest.Gen, i))
+		if err != nil {
+			return nil, 0, 0, fmt.Errorf("deletion ledger part %d of %s unreadable: %w", i, key, err)
+		}
+		var part []string
+		if err := json.Unmarshal(partPayload, &part); err != nil {
+			return nil, 0, 0, fmt.Errorf("deletion ledger part %d of %s corrupt: %w", i, key, err)
+		}
+		ids = append(ids, part...)
+	}
+	return ids, manifest.Gen, manifest.Parts, nil
+}
+
+// recoverForeignDeletionLedgers runs when the scoped key is absent: the ledger
+// may sit under the pre-scoping base key, or under a scoped key belonging to an
+// earlier incarnation of this filer whose advertised address changed. Every
+// discovered set is published under this filer's key first and the source keys
+// deleted only after that write succeeds. A live peer's ledger claimed here is
+// rewritten by the peer's next snapshot, so the ids only get processed twice —
+// deletions are not owner-specific.
+func (f *Filer) recoverForeignDeletionLedgers(key string) (ids []string, err error) {
+	ctx := context.Background()
+
+	claimed := map[string]ledgerClaim{} // source key -> what was read
+	lIds, lGen, lParts, lErr := f.readDeletionLedger(KvKeyDeletionLedger)
+	switch {
+	case lErr == nil:
+		ids = append(ids, lIds...)
+		claimed[KvKeyDeletionLedger] = ledgerClaim{lIds, lGen, lParts}
+		f.loadStaleLedgerParts(ctx, KvKeyDeletionLedger)
+	case lErr != ErrKvNotFound:
+		return nil, lErr
+	}
+
+	// Any read failure aborts the whole claim so reload retries: skipping an
+	// unreadable source would strand it, since a successful claim here means
+	// the index is never searched again.
+	indexKeys, idxErr := f.readLedgerIndex(ctx)
+	if idxErr != nil && idxErr != ErrKvNotFound {
+		return nil, idxErr
+	}
+	for _, other := range indexKeys {
+		if other == key {
+			continue
+		}
+		oIds, oGen, oParts, oErr := f.readDeletionLedger(other)
+		if oErr == ErrKvNotFound {
+			f.pruneLedgerIndex(ctx, other)
+			continue
+		}
+		if oErr != nil {
+			return nil, fmt.Errorf("deletion ledger %s unreadable: %w", other, oErr)
+		}
+		ids = append(ids, oIds...)
+		claimed[other] = ledgerClaim{oIds, oGen, oParts}
+		f.loadStaleLedgerParts(ctx, other)
+	}
+
+	if len(claimed) == 0 {
+		return nil, ErrKvNotFound
+	}
+	if err := f.writeDeletionLedger(ids); err != nil {
+		return nil, err
+	}
+	mergedMore := false
+	for src, claim := range claimed {
+		// A source republished since we read it belongs to a live filer
+		// (or a racing claimer): merge the newer ids and leave it in place.
+		curIds, curGen, curParts, rerr := f.readDeletionLedger(src)
+		if rerr != nil || curGen != claim.gen || curParts != claim.parts || !sameStringSet(curIds, claim.ids) {
+			if rerr == nil {
+				for _, id := range curIds {
+					if !containsId(ids, id) {
+						ids = append(ids, id)
+						mergedMore = true
+					}
+				}
+			}
+			glog.V(0).Infof("deletion ledger %s changed while claiming; leaving it for its owner", src)
+			continue
+		}
+		f.deleteLedgerParts(ctx, src, claim.gen, claim.parts)
+		_ = f.Store.KvDelete(ctx, []byte(src))
+		_ = f.Store.KvDelete(ctx, []byte(src+".stale"))
+		f.pruneLedgerIndex(ctx, src)
+	}
+	if mergedMore {
+		// Ids from a changed source are durable only under that source's key;
+		// rewrite our ledger so they survive under ours too.
+		if err := f.writeDeletionLedger(ids); err != nil {
+			return nil, err
+		}
+	}
+	return ids, nil
+}
+
+func containsId(ids []string, id string) bool {
+	for _, s := range ids {
+		if s == id {
+			return true
+		}
+	}
+	return false
+}
+
+type ledgerClaim struct {
+	ids   []string
+	gen   int
+	parts int
+}
+
+func sameStringSet(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	seen := make(map[string]struct{}, len(a))
+	for _, s := range a {
+		seen[s] = struct{}{}
+	}
+	for _, s := range b {
+		if _, ok := seen[s]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
+// reloadDeletionLedger re-enqueues any pending deletions found in the store after
+// a restart, so a crash that killed the in-memory queues does not leak chunks.
+// Recovered ids join the pending set immediately so snapshots rewrite the full
+// ledger; only the re-queue waits out DeletionRecoveryGrace.
+//
+// It reports whether the ledger is usable. A read error or an unparseable
+// payload leaves the persisted set unknown, so snapshots retry the read rather
+// than overwrite the unread ledger with a partial set.
+//
+// Safe to call on a Filer with a nil Store (no-op). Idempotent for the volume
+// side: a chunk that was actually deleted before the crash re-deletes as not-found.
+func (f *Filer) reloadDeletionLedger() bool {
+	if !deletionPersistEnabled() || f.Store == nil {
+		return false
+	}
+
+	key := f.deletionLedgerKey()
+	ids, gen, parts, err := f.readDeletionLedger(key)
+	stateWritten := false
+	if err == ErrKvNotFound && key != KvKeyDeletionLedger {
+		ids, err = f.recoverForeignDeletionLedgers(key)
+		stateWritten = err == nil
+	}
+	if err != nil {
+		if err == ErrKvNotFound {
+			f.deletionLedgerBlocked.Store(false)
+			return true
+		}
+		f.deletionLedgerBlocked.Store(true)
+		glog.Warningf("failed to read persisted deletion ledger; persistence disabled until it reads: %v", err)
+		return false
+	}
+	f.deletionLedgerBlocked.Store(false)
+	f.loadStaleLedgerParts(context.Background(), key)
+
+	// Merge into the pending set now so an early snapshot rewrites the
+	// recovered ids instead of overwriting the ledger with only new ones.
+	f.deletionLedgerLock.Lock()
+	if len(ids) > 0 {
+		if f.pendingDeletions == nil {
+			f.pendingDeletions = make(map[string]uint64, len(ids))
+		}
+		for _, id := range ids {
+			if id != "" {
+				if _, exists := f.pendingDeletions[id]; !exists {
+					f.deletionSeq++
+					f.pendingDeletions[id] = f.deletionSeq
+				}
+			}
+		}
+	}
+	if !stateWritten {
+		f.deletionLedgerGen = gen
+		f.deletionLedgerParts = parts
+	}
+	f.deletionLedgerLock.Unlock()
+
+	if len(ids) == 0 {
+		return true
+	}
+
+	grace := deletionRecoveryGrace()
+	glog.V(0).Infof("recovered %d pending deletions from ledger, applying in %v", len(ids), grace)
+
+	go func() {
+		timer := time.NewTimer(grace)
+		defer timer.Stop()
+		select {
+		case <-f.deletionQuit:
+			return
+		case <-timer.C:
+		}
+		// The ids are already in the pending set; only the queue push waits
+		// for peer meta-aggregation to settle. The ledger is deliberately NOT
+		// cleared here: it shrinks only as the delete pipeline confirms each
+		// id terminal, so a second crash mid-recovery replays everything.
+		f.queueDeletions(ids...)
+		glog.V(0).Infof("re-queued %d recovered pending deletions", len(ids))
+	}()
+	return true
+}
diff --git a/weed/filer/filer_deletion_persist_test.go b/weed/filer/filer_deletion_persist_test.go
new file mode 100644
index 0000000000..d9f82f54b7
--- /dev/null
+++ b/weed/filer/filer_deletion_persist_test.go
@@ -0,0 +1,584 @@
+package filer
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// readPersistedLedger pulls the persisted ledger payload straight from the store
+// the filer is wired to, the same way a restarting filer would.
+func readPersistedLedger(t *testing.T, f *Filer) ([]string, bool) {
+	t.Helper()
+	raw, err := f.Store.KvGet(context.Background(), []byte(f.deletionLedgerKey()))
+	if err != nil {
+		if err == ErrKvNotFound {
+			return nil, false
+		}
+		t.Fatalf("unexpected error reading ledger: %v", err)
+	}
+	var ids []string
+	if err := json.Unmarshal(raw, &ids); err != nil {
+		t.Fatalf("persisted payload not valid JSON: %v", err)
+	}
+	return ids, true
+}
+
+// withPersistedConfig pins the ledger knobs at viper's override tier so the test
+// sees deterministic semantics regardless of global SetDefault ordering (the
+// production getters SetDefault(true), which would otherwise win the tier race).
+// The overrides are restored on cleanup so later tests see production defaults.
+func withPersistedConfig(t *testing.T, enabled bool) {
+	t.Helper()
+	v := util.GetViper()
+	v.Set("filer.deleteQueue.persist", enabled)
+	v.Set("filer.deleteQueue.recoveryGrace", defaultDeletionRecoveryGrace)
+	t.Cleanup(func() {
+		v.Set("filer.deleteQueue.persist", true)
+		v.Set("filer.deleteQueue.recoveryGrace", defaultDeletionRecoveryGrace)
+	})
+}
+
+// newLedgerTestFiler builds a Filer with the pieces the ledger touches, backed by
+// a real (stub) store, bypassing NewFiler's master/aggregator wiring.
+func newLedgerTestFiler(store FilerStore) *Filer {
+	return &Filer{
+		FileIdDeletionQueue: util.NewUnboundedQueue(),
+		DeletionRetryQueue:  NewDeletionRetryQueue(),
+		deletionQuit:        make(chan struct{}),
+		Store:               NewFilerStoreWrapper(store),
+	}
+}
+
+// TestDeletionLedgerSnapshotAndRecover is the core guarantee: enqueued-but-
+// unconfirmed deletions survive a simulated process restart and land back in the
+// hot queue (minus whatever was confirmed terminal in the meantime).
+func TestDeletionLedgerSnapshotAndRecover(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+
+	f.queueDeletions("1,01", "1,02", "1,03")
+	f.snapshotDeletionLedger()
+
+	persisted, ok := readPersistedLedger(t, f)
+	if !ok {
+		t.Fatalf("expected persisted ledger under %q", KvKeyDeletionLedger)
+	}
+	if len(persisted) != 3 {
+		t.Fatalf("expected 3 persisted ids, got %d: %v", len(persisted), persisted)
+	}
+	for _, want := range []string{"1,01", "1,02", "1,03"} {
+		if !contains(persisted, want) {
+			t.Errorf("expected %q in persisted ledger, got %v", want, persisted)
+		}
+	}
+
+	// Confirmed-gone for one id, then snapshot again.
+	f.forgetDeletion("1,02")
+	f.snapshotDeletionLedger()
+	persisted, _ = readPersistedLedger(t, f)
+	if len(persisted) != 2 {
+		t.Fatalf("expected 2 persisted ids after forget, got %d: %v", len(persisted), persisted)
+	}
+	if contains(persisted, "1,02") {
+		t.Errorf("forgotten id still in persisted ledger: %v", persisted)
+	}
+
+	// --- simulated restart: a fresh Filer with NO ledger in memory must
+	// recover the still-pending ids from the store and re-queue them. ---
+	f2 := newLedgerTestFiler(store)
+	// recoveryGrace 0 so the background re-enqueue is near-instant.
+	util.GetViper().Set("filer.deleteQueue.recoveryGrace", time.Duration(0))
+	f2.reloadDeletionLedger()
+
+	// Wait for the async recovery goroutine to drain into the hot queue.
+	seen := make(map[string]bool)
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		f2.FileIdDeletionQueue.Consume(func(ids []string) {
+			for _, id := range ids {
+				seen[id] = true
+			}
+		})
+		if len(seen) >= 2 {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	if !seen["1,01"] || !seen["1,03"] {
+		t.Fatalf("expected recovered ids 1,01 and 1,03 back in hot queue, got %v", seen)
+	}
+	if seen["1,02"] {
+		t.Errorf("forgotten id 1,02 must NOT come back: %v", seen)
+	}
+}
+
+// TestDeletionLedgerRetryKeepsEntry pins the key semantic: a non-terminal
+// (retryable) failure must keep the entry persisted, so a crash mid-retry does
+// not orphan the chunk. This is the whole reason forgetDeletion is only called on
+// success / not-found / permanent.
+func TestDeletionLedgerRetryKeepsEntry(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+
+	f.queueDeletions("9,01")
+	f.snapshotDeletionLedger()
+
+	// A retryable outcome deliberately does NOT call forgetDeletion, so the id
+	// must still be in the durable ledger.
+	persisted, ok := readPersistedLedger(t, f)
+	if !ok {
+		t.Fatalf("ledger missing — retryable ids must remain persisted")
+	}
+	if len(persisted) != 1 || persisted[0] != "9,01" {
+		t.Fatalf("retryable id must stay in ledger, got %v", persisted)
+	}
+}
+
+// TestDeletionLedgerDisabled verifies the kill switch: with persist off, nothing
+// reaches KV, and reload refuses to recover even if a ledger exists in the store
+// (so an operator turning the feature off never resurrects a stale ledger).
+func TestDeletionLedgerDisabled(t *testing.T) {
+	// First, with persistence ON, put a real ledger into the store.
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	fOn := newLedgerTestFiler(store)
+	fOn.queueDeletions("5,01")
+	fOn.snapshotDeletionLedger()
+	if _, ok := readPersistedLedger(t, fOn); !ok {
+		t.Fatalf("setup: expected a persisted ledger with persist enabled")
+	}
+
+	// Now flip the switch OFF and check the contract.
+	withPersistedConfig(t, false)
+
+	// 1. Snapshot does not touch KV (no new writes, no clear).
+	f := newLedgerTestFiler(store)
+	f.queueDeletions("6,01") // in-memory only
+	f.snapshotDeletionLedger()
+	persisted, ok := readPersistedLedger(t, f)
+	if !ok {
+		t.Fatalf("setup: ledger should still exist from the enabled phase")
+	}
+	// The enabled-phase ledger had "5,01"; disabled phase must not have added "6,01".
+	if contains(persisted, "6,01") {
+		t.Errorf("persist disabled but snapshot wrote 6,01: %v", persisted)
+	}
+
+	// 2. Reload with the switch off must NOT recover, even though a ledger exists.
+	f2 := newLedgerTestFiler(store)
+	f2.reloadDeletionLedger()
+	if f2.pendingDeletionCount() != 0 {
+		t.Fatalf("reload must be a no-op when disabled, got %d pending", f2.pendingDeletionCount())
+	}
+}
+
+// Filers sharing one metadata store must not overwrite each other's ledgers:
+// each filer keys its ledger by its own address.
+func TestDeletionLedgerScopedPerFiler(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	fA := newLedgerTestFiler(store)
+	fA.Dlm = lock_manager.NewDistributedLockManager("filer-a:8888")
+	fB := newLedgerTestFiler(store)
+	fB.Dlm = lock_manager.NewDistributedLockManager("filer-b:8888")
+
+	fA.queueDeletions("1,01")
+	fB.queueDeletions("2,02")
+	fA.snapshotDeletionLedger()
+	fB.snapshotDeletionLedger()
+
+	idsA, okA := readPersistedLedger(t, fA)
+	idsB, okB := readPersistedLedger(t, fB)
+	if !okA || !okB {
+		t.Fatalf("both filers must have their own ledger, got %v %v", idsA, idsB)
+	}
+	if !contains(idsA, "1,01") || contains(idsA, "2,02") {
+		t.Fatalf("filer A ledger wrong: %v", idsA)
+	}
+	if !contains(idsB, "2,02") || contains(idsB, "1,01") {
+		t.Fatalf("filer B ledger wrong: %v", idsB)
+	}
+
+	// A restarted filer on B's address recovers only B's pending deletions.
+	fB2 := newLedgerTestFiler(store)
+	fB2.Dlm = lock_manager.NewDistributedLockManager("filer-b:8888")
+	if !fB2.reloadDeletionLedger() {
+		t.Fatalf("reload should succeed")
+	}
+	if fB2.pendingDeletionCount() != 1 {
+		t.Fatalf("B's restart should recover exactly its own id, got %d", fB2.pendingDeletionCount())
+	}
+}
+
+// A ledger bigger than one store value must still persist: it splits into part
+// keys under a manifest, and shrinking below the part size removes the parts.
+func TestDeletionLedgerChunked(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+
+	var ids []string
+	for i := 0; i < 4000; i++ {
+		ids = append(ids, fmt.Sprintf("7,%08xbeefcafe", i))
+	}
+	f.queueDeletions(ids...)
+	f.snapshotDeletionLedger()
+
+	raw, err := f.Store.KvGet(context.Background(), []byte(f.deletionLedgerKey()))
+	if err != nil || len(raw) == 0 || raw[0] != '{' {
+		t.Fatalf("expected a chunked manifest, got %v %q", err, raw)
+	}
+
+	f2 := newLedgerTestFiler(store)
+	if !f2.reloadDeletionLedger() {
+		t.Fatalf("chunked ledger should reload")
+	}
+	if got := f2.pendingDeletionCount(); got != len(ids) {
+		t.Fatalf("recovered %d ids, want %d", got, len(ids))
+	}
+
+	// Forget everything; the next snapshot is a single value again and the
+	// part keys are removed.
+	for _, id := range ids {
+		f2.forgetDeletion(id)
+	}
+	f2.snapshotDeletionLedger()
+	raw, err = f.Store.KvGet(context.Background(), []byte(f2.deletionLedgerKey()))
+	if err != nil || len(raw) == 0 || raw[0] != '[' {
+		t.Fatalf("expected single-value ledger after shrink, got %v %q", err, raw)
+	}
+	if _, err := f.Store.KvGet(context.Background(), deletionLedgerPartKey(f2.deletionLedgerKey(), 0)); err != ErrKvNotFound {
+		t.Fatalf("stale part key must be removed, got %v", err)
+	}
+}
+
+// A startup ledger read that fails for a reason other than not-found must not
+// let snapshots overwrite the unread ledger with a partial set.
+func TestDeletionLedgerReadFailureBlocksPersistence(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+	store.kvGetErr = errors.New("kv read down")
+
+	if f.reloadDeletionLedger() {
+		t.Fatalf("reload should report the ledger as unusable")
+	}
+
+	f.queueDeletions("1,01")
+	f.snapshotDeletionLedger()
+	if len(store.kv) != 0 {
+		t.Fatalf("snapshot must not overwrite a ledger that was never read, wrote %v", store.kv)
+	}
+
+	// The block is not permanent: once the store reads again, persistence
+	// resumes — a transient failure must not disable the ledger for the life
+	// of the process.
+	store.kvGetErr = nil
+	f.snapshotDeletionLedger()
+	persisted, ok := readPersistedLedger(t, f)
+	if !ok || len(persisted) != 1 || persisted[0] != "1,01" {
+		t.Fatalf("persistence should resume once the ledger reads, got %v", persisted)
+	}
+}
+
+// Recovered ids join the pending set immediately — before the grace delay — so
+// an early snapshot rewrites the recovered ids instead of dropping them.
+func TestDeletionLedgerRecoveryKeepsIdsPending(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+	f.queueDeletions("1,01", "1,02")
+	f.snapshotDeletionLedger()
+
+	util.GetViper().Set("filer.deleteQueue.recoveryGrace", time.Hour)
+	f2 := newLedgerTestFiler(store)
+	if !f2.reloadDeletionLedger() {
+		t.Fatalf("reload should succeed")
+	}
+	// Still inside the grace window, but the ids are already pending.
+	if f2.pendingDeletionCount() != 2 {
+		t.Fatalf("recovered ids must be pending immediately, got %d", f2.pendingDeletionCount())
+	}
+	// And an early shutdown snapshot keeps them.
+	f2.snapshotDeletionLedger()
+	persisted, ok := readPersistedLedger(t, f2)
+	if !ok || len(persisted) != 2 {
+		t.Fatalf("snapshot during grace must carry recovered ids, got %v", persisted)
+	}
+}
+
+// TestDeletionLedgerZeroValueFiler proves nil-map safety for the struct literals
+// used across the test suite (they never call NewFiler).
+func TestDeletionLedgerZeroValueFiler(t *testing.T) {
+	withPersistedConfig(t, true)
+	f := &Filer{
+		FileIdDeletionQueue: util.NewUnboundedQueue(),
+		DeletionRetryQueue:  NewDeletionRetryQueue(),
+		deletionQuit:        make(chan struct{}),
+	}
+	f.queueDeletions("0,01")
+	if f.pendingDeletionCount() != 1 {
+		t.Fatalf("zero-value filer should lazily init the ledger, got %d", f.pendingDeletionCount())
+	}
+	f.forgetDeletion("0,01")
+	if f.pendingDeletionCount() != 0 {
+		t.Fatalf("forget on zero-value filer failed, got %d", f.pendingDeletionCount())
+	}
+}
+
+// A manifest that references a part the store cannot return is corruption, not
+// absence: reload must report failure and nothing may overwrite the surviving
+// manifest with only the in-memory set.
+func TestDeletionLedgerMissingPartBlocks(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+
+	key := f.deletionLedgerKey()
+	store.kv[key] = []byte(`{"parts":2,"gen":4}`)
+	store.kv[string(deletionLedgerGenPartKey(key, 4, 0))] = []byte(`["1,01"]`)
+	// Part 1 of generation 4 is missing.
+
+	if f.reloadDeletionLedger() {
+		t.Fatalf("a manifest referencing a missing part is corrupt, not absent")
+	}
+	f.queueDeletions("9,99")
+	f.snapshotDeletionLedger()
+	if got := string(store.kv[key]); got != `{"parts":2,"gen":4}` {
+		t.Fatalf("unread ledger must not be overwritten, got %q", got)
+	}
+}
+
+// A filer restarting under a new advertised address must still find its
+// previous ledger: the index lists scoped keys, the ids are published under
+// the new key first, and only then is the stranded key removed.
+func TestDeletionLedgerAddressChangeClaim(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	fOld := newLedgerTestFiler(store)
+	fOld.Dlm = lock_manager.NewDistributedLockManager("filer-old:8888")
+	fOld.queueDeletions("1,01", "1,02")
+	fOld.snapshotDeletionLedger()
+
+	fNew := newLedgerTestFiler(store)
+	fNew.Dlm = lock_manager.NewDistributedLockManager("filer-new:9999")
+	if !fNew.reloadDeletionLedger() {
+		t.Fatalf("reload should claim the stranded ledger")
+	}
+	if fNew.pendingDeletionCount() != 2 {
+		t.Fatalf("expected 2 claimed ids, got %d", fNew.pendingDeletionCount())
+	}
+	if _, err := store.KvGet(context.Background(), []byte(fOld.deletionLedgerKey())); err != ErrKvNotFound {
+		t.Fatalf("stranded ledger must be removed after claim, got %v", err)
+	}
+	persisted, ok := readPersistedLedger(t, fNew)
+	if !ok || len(persisted) != 2 {
+		t.Fatalf("claimed ids must be durably stored under the new key, got %v", persisted)
+	}
+	indexKeys, _ := fNew.readLedgerIndex(context.Background())
+	if contains(indexKeys, fOld.deletionLedgerKey()) {
+		t.Fatalf("claimed key must leave the index, got %v", indexKeys)
+	}
+}
+
+// Every multipart snapshot writes a fresh generation's part keys and publishes
+// the manifest only after all parts land, so the committed generation is never
+// overwritten. The previous generation is removed after publication.
+func TestDeletionLedgerGenerationPublish(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+
+	var ids []string
+	for i := 0; i < 4000; i++ {
+		ids = append(ids, fmt.Sprintf("7,%08xbeefcafe", i))
+	}
+	f.queueDeletions(ids...)
+	f.snapshotDeletionLedger()
+	key := f.deletionLedgerKey()
+	if _, err := store.KvGet(context.Background(), deletionLedgerGenPartKey(key, 1, 0)); err != nil {
+		t.Fatalf("generation 1 part must exist, got %v", err)
+	}
+
+	f.queueDeletions("8,08")
+	f.snapshotDeletionLedger()
+	if _, err := store.KvGet(context.Background(), deletionLedgerGenPartKey(key, 2, 0)); err != nil {
+		t.Fatalf("generation 2 part must exist, got %v", err)
+	}
+	if _, err := store.KvGet(context.Background(), deletionLedgerGenPartKey(key, 1, 0)); err != ErrKvNotFound {
+		t.Fatalf("generation 1 part must be cleaned after publication, got %v", err)
+	}
+	var manifest struct {
+		Parts int `json:"parts"`
+		Gen   int `json:"gen"`
+	}
+	raw, _ := store.KvGet(context.Background(), []byte(key))
+	if err := json.Unmarshal(raw, &manifest); err != nil || manifest.Gen != 2 {
+		t.Fatalf("manifest must publish generation 2, got %q", raw)
+	}
+}
+
+// A failed cleanup of a superseded generation is retried by the next snapshot
+// instead of leaking the part keys.
+func TestDeletionLedgerStalePartsRetried(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	f := newLedgerTestFiler(store)
+
+	var ids []string
+	for i := 0; i < 4000; i++ {
+		ids = append(ids, fmt.Sprintf("7,%08xbeefcafe", i))
+	}
+	f.queueDeletions(ids...)
+	f.snapshotDeletionLedger()
+	key := f.deletionLedgerKey()
+
+	store.kvDeleteErr = errors.New("delete down")
+	f.queueDeletions("8,08")
+	f.snapshotDeletionLedger()
+	if len(f.deletionLedgerStale) == 0 {
+		t.Fatalf("failed part deletes must be tracked for retry")
+	}
+	store.kvDeleteErr = nil
+	f.queueDeletions("8,09")
+	f.snapshotDeletionLedger()
+	if len(f.deletionLedgerStale) != 0 {
+		t.Fatalf("stale parts must flush once deletes work, got %v", f.deletionLedgerStale)
+	}
+	if _, err := store.KvGet(context.Background(), deletionLedgerGenPartKey(key, 1, 0)); err != ErrKvNotFound {
+		t.Fatalf("stale generation part must be deleted, got %v", err)
+	}
+}
+
+// A pre-scoping ledger under the base key must migrate only after the scoped
+// copy is durable: the recovered ids are written under the scoped key first,
+// then the base key is removed.
+func TestDeletionLedgerLegacyMigrationDurable(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	store.kv[KvKeyDeletionLedger] = []byte(`["1,01","1,02"]`)
+
+	f := newLedgerTestFiler(store)
+	f.Dlm = lock_manager.NewDistributedLockManager("filer-new:9999")
+	if !f.reloadDeletionLedger() {
+		t.Fatalf("reload should migrate the legacy ledger")
+	}
+	persisted, ok := readPersistedLedger(t, f)
+	if !ok || len(persisted) != 2 {
+		t.Fatalf("legacy ids must land under the scoped key first, got %v", persisted)
+	}
+	if _, err := store.KvGet(context.Background(), []byte(KvKeyDeletionLedger)); err != ErrKvNotFound {
+		t.Fatalf("legacy key must be removed once the scoped write is durable, got %v", err)
+	}
+	if f.pendingDeletionCount() != 2 {
+		t.Fatalf("migrated ids must join the pending set, got %d", f.pendingDeletionCount())
+	}
+}
+
+// An indexed ledger that cannot be read must not be skipped: claiming the
+// readable ones and leaving the unreadable one behind would strand it, since
+// the index is only searched while the filer's own key is absent. The claim
+// aborts so the reload is retried.
+func TestDeletionLedgerUnreadableForeignBlocks(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	stranded := KvKeyDeletionLedger + ".filer-old:8888"
+	store.kv[stranded] = []byte(`{"parts":2,"gen":1}`) // manifest without parts = corrupt
+	index, _ := json.Marshal([]string{stranded})
+	store.kv[KvKeyDeletionLedgerIndex] = index
+
+	f := newLedgerTestFiler(store)
+	f.Dlm = lock_manager.NewDistributedLockManager("filer-new:9999")
+	if f.reloadDeletionLedger() {
+		t.Fatalf("an unreadable indexed ledger must fail the reload")
+	}
+	if _, err := store.KvGet(context.Background(), []byte(stranded)); err != nil {
+		t.Fatalf("unreadable ledger must be left untouched, got %v", err)
+	}
+	if _, ok := readPersistedLedger(t, f); ok {
+		t.Fatalf("no scoped ledger may be written while a claim source is unreadable")
+	}
+}
+
+// A live filer's ledger is not deleted when it republished between the claim's
+// read and cleanup: the source stays and its newer ids merge into the claim.
+// The hook swaps the source content on its second read — the claim's first
+// read sees the old set, the verification read sees the republished one,
+// exactly like a peer snapshot landing mid-claim.
+func TestDeletionLedgerClaimKeepsChangedSource(t *testing.T) {
+	withPersistedConfig(t, true)
+	store := newStubFilerStore()
+	srcKey := KvKeyDeletionLedger + ".filer-old:8888"
+	store.kv[srcKey] = []byte(`["1,01","1,02"]`)
+	index, _ := json.Marshal([]string{srcKey})
+	store.kv[KvKeyDeletionLedgerIndex] = index
+
+	srcReads := 0
+	store.kvGetHook = func(key []byte) {
+		if string(key) == srcKey {
+			srcReads++
+			if srcReads == 2 {
+				store.kv[srcKey] = []byte(`["1,01","1,02","1,03"]`)
+			}
+		}
+	}
+
+	f := newLedgerTestFiler(store)
+	f.Dlm = lock_manager.NewDistributedLockManager("filer-new:9999")
+	if !f.reloadDeletionLedger() {
+		t.Fatalf("claim should succeed")
+	}
+	if got := string(store.kv[srcKey]); got != `["1,01","1,02","1,03"]` {
+		t.Fatalf("republished source must be left intact, got %q", got)
+	}
+	if f.pendingDeletionCount() != 3 {
+		t.Fatalf("republished ids must merge into the pending set, got %d", f.pendingDeletionCount())
+	}
+	persisted, ok := readPersistedLedger(t, f)
+	if !ok || len(persisted) != 3 {
+		t.Fatalf("merged ids must be durable under our key, got %v", persisted)
+	}
+}
+
+// An expired retry item must not erase a newer enqueue for the same file id:
+// expiry forgets only the epoch the retry item recorded.
+func TestForgetDeletionEpochSkipsNewer(t *testing.T) {
+	withPersistedConfig(t, true)
+	f := newLedgerTestFiler(newStubFilerStore())
+
+	f.queueDeletions("1,01")
+	oldEpoch := f.deletionEpoch("1,01")
+	f.queueDeletions("1,01") // re-enqueue bumps the epoch
+	newEpoch := f.deletionEpoch("1,01")
+	if oldEpoch == newEpoch {
+		t.Fatalf("re-enqueue must bump the epoch")
+	}
+
+	f.forgetDeletionEpoch("1,01", oldEpoch)
+	if f.pendingDeletionCount() != 1 {
+		t.Fatalf("stale expiry must not erase a newer enqueue")
+	}
+	f.forgetDeletionEpoch("1,01", newEpoch)
+	if f.pendingDeletionCount() != 0 {
+		t.Fatalf("matching expiry must forget the id")
+	}
+}
+
+func contains(haystack []string, needle string) bool {
+	for _, s := range haystack {
+		if s == needle {
+			return true
+		}
+	}
+	return false
+}
diff --git a/weed/filer/filer_deletion_test.go b/weed/filer/filer_deletion_test.go
index 77ac2310f0..f1ac3343d2 100644
--- a/weed/filer/filer_deletion_test.go
+++ b/weed/filer/filer_deletion_test.go
@@ -10,15 +10,15 @@ func TestDeletionRetryQueue_AddAndRetrieve(t *testing.T) {
 	queue := NewDeletionRetryQueue()
 
 	// Add items
-	queue.AddOrUpdate("file1", "is read only")
-	queue.AddOrUpdate("file2", "connection reset")
+	queue.AddOrUpdate("file1", "is read only", 0)
+	queue.AddOrUpdate("file2", "connection reset", 0)
 
 	if queue.Size() != 2 {
 		t.Errorf("Expected queue size 2, got %d", queue.Size())
 	}
 
 	// Items not ready yet (initial delay is 5 minutes)
-	readyItems := queue.GetReadyItems(10)
+	readyItems, _ := queue.GetReadyItems(10)
 	if len(readyItems) != 0 {
 		t.Errorf("Expected 0 ready items, got %d", len(readyItems))
 	}
@@ -104,7 +104,7 @@ func TestDeletionRetryQueue_MaxAttemptsReached(t *testing.T) {
 	queue := NewDeletionRetryQueue()
 
 	// Add item
-	queue.AddOrUpdate("file1", "error")
+	queue.AddOrUpdate("file1", "error", 0)
 
 	// Manually set retry count to max
 	queue.lock.Lock()
@@ -119,7 +119,7 @@ func TestDeletionRetryQueue_MaxAttemptsReached(t *testing.T) {
 	queue.lock.Unlock()
 
 	// Try to get ready items - should be returned for the last retry (attempt #10)
-	readyItems := queue.GetReadyItems(10)
+	readyItems, _ := queue.GetReadyItems(10)
 	if len(readyItems) != 1 {
 		t.Fatalf("Expected 1 item for last retry, got %d", len(readyItems))
 	}
@@ -139,7 +139,7 @@ func TestDeletionRetryQueue_MaxAttemptsReached(t *testing.T) {
 	queue.lock.Unlock()
 
 	// Now it should be discarded (retry count is 11, exceeds max of 10)
-	readyItems = queue.GetReadyItems(10)
+	readyItems, _ = queue.GetReadyItems(10)
 	if len(readyItems) != 0 {
 		t.Errorf("Expected 0 items (max attempts exceeded), got %d", len(readyItems))
 	}
@@ -248,7 +248,7 @@ func TestDeletionRetryQueue_HeapOrdering(t *testing.T) {
 	queue.lock.Unlock()
 
 	// GetReadyItems should return in NextRetryAt order
-	readyItems := queue.GetReadyItems(10)
+	readyItems, _ := queue.GetReadyItems(10)
 	expectedOrder := []string{"file1", "file2", "file3"}
 
 	if len(readyItems) != 3 {
@@ -266,7 +266,7 @@ func TestDeletionRetryQueue_DuplicateFileIds(t *testing.T) {
 	queue := NewDeletionRetryQueue()
 
 	// Add same file ID twice with retryable error - simulates duplicate in batch
-	queue.AddOrUpdate("file1", "timeout error")
+	queue.AddOrUpdate("file1", "timeout error", 0)
 
 	// Verify only one item exists in queue
 	if queue.Size() != 1 {
@@ -284,7 +284,7 @@ func TestDeletionRetryQueue_DuplicateFileIds(t *testing.T) {
 	queue.lock.Unlock()
 
 	// Add same file ID again - should NOT increment retry count (just update error)
-	queue.AddOrUpdate("file1", "timeout error again")
+	queue.AddOrUpdate("file1", "timeout error again", 0)
 
 	// Verify still only one item exists in queue (not duplicated)
 	if queue.Size() != 1 {
@@ -306,3 +306,27 @@ func TestDeletionRetryQueue_DuplicateFileIds(t *testing.T) {
 		t.Errorf("Expected LastError to be updated to 'timeout error again', got %q", item2.LastError)
 	}
 }
+
+// AddOrUpdate must not overwrite the ledger epoch on an in-flight item: the
+// worker that popped it reads that field without the queue lock, and its
+// expiry/permanent-forget must only match the record the attempt started with.
+func TestDeletionRetryQueue_InFlightKeepsEpoch(t *testing.T) {
+	queue := NewDeletionRetryQueue()
+	queue.AddOrUpdate("file1", "timeout", 7)
+
+	queue.lock.Lock()
+	item := queue.itemIndex["file1"]
+	item.NextRetryAt = time.Now().Add(-time.Second)
+	heap.Init(&queue.heap)
+	queue.lock.Unlock()
+
+	ready, _ := queue.GetReadyItems(1)
+	if len(ready) != 1 {
+		t.Fatalf("expected the item ready, got %d", len(ready))
+	}
+
+	queue.AddOrUpdate("file1", "newer error", 42)
+	if got := ready[0].ledgerEpoch; got != 7 {
+		t.Fatalf("in-flight epoch must stay 7, got %d", got)
+	}
+}
diff --git a/weed/filer/filer_inode.go b/weed/filer/filer_inode.go
index e5c4c5e26d..d1a2eea814 100644
--- a/weed/filer/filer_inode.go
+++ b/weed/filer/filer_inode.go
@@ -19,7 +19,7 @@ func (f *Filer) ensureEntryInode(entry *Entry) {
 		entry.Attr.Crtime = time.Now()
 	}
 	if len(entry.HardLinkId) > 0 {
-		entry.Attr.Inode = uint64(util.HashStringToLong(string(entry.HardLinkId)))
+		entry.Attr.Inode = util.NormalizeInode(uint64(util.HashStringToLong(string(entry.HardLinkId))))
 		return
 	}
 	entry.Attr.Inode = entry.FullPath.AsInode(entry.Attr.Crtime.Unix())
diff --git a/weed/filer/filer_inode_test.go b/weed/filer/filer_inode_test.go
index 41c8883a97..b00c1ec7e2 100644
--- a/weed/filer/filer_inode_test.go
+++ b/weed/filer/filer_inode_test.go
@@ -2,11 +2,15 @@ package filer
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"math"
 	"os"
 	"testing"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -49,10 +53,56 @@ func TestEnsureEntryInodeSharesAcrossHardLinks(t *testing.T) {
 
 	// Every link to the same target resolves to one inode, independent of path
 	// or creation time.
-	assert.Equal(t, uint64(util.HashStringToLong(string(hardLinkId))), a.Attr.Inode)
+	assert.Equal(t, util.NormalizeInode(uint64(util.HashStringToLong(string(hardLinkId)))), a.Attr.Inode)
 	assert.Equal(t, a.Attr.Inode, b.Attr.Inode)
 }
 
+// TestEnsureEntryInodeFitsSignedLong pins the invariant that every generated
+// inode is storable: the filer hands Attr.Inode to the backing store verbatim,
+// and the Elasticsearch store indexes it as a signed `long`. Roughly half of
+// the unsigned hash space sits above math.MaxInt64, so a store that rejects
+// those values used to fail the metadata write for half of all entries.
+func TestEnsureEntryInodeFitsSignedLong(t *testing.T) {
+	f := &Filer{}
+	crtime := time.Unix(1700000000, 0)
+
+	seen := make(map[uint64]string)
+	for i := 0; i < 5000; i++ {
+		fullPath := util.FullPath(fmt.Sprintf("/topics/.system/log/2026-10-02/entry-%d", i))
+		entry := &Entry{FullPath: fullPath, Attr: Attr{Crtime: crtime}}
+		f.ensureEntryInode(entry)
+
+		if entry.Attr.Inode > math.MaxInt64 {
+			t.Fatalf("ensureEntryInode(%q) = %d, above math.MaxInt64", fullPath, entry.Attr.Inode)
+		}
+		// Folding must not collapse distinct paths onto one inode.
+		if other, ok := seen[entry.Attr.Inode]; ok {
+			t.Fatalf("ensureEntryInode(%q) collided with %q on inode %d", fullPath, other, entry.Attr.Inode)
+		}
+		seen[entry.Attr.Inode] = string(fullPath)
+	}
+}
+
+// TestEnsureEntryInodeHardLinkFitsSignedLong covers the hard-link branch, which
+// hashes HardLinkId instead of the path and so has no path-derived crtime term.
+func TestEnsureEntryInodeHardLinkFitsSignedLong(t *testing.T) {
+	f := &Filer{}
+	crtime := time.Unix(1700000000, 0)
+
+	for i := 0; i < 5000; i++ {
+		entry := &Entry{
+			FullPath:   util.FullPath(fmt.Sprintf("/links/target-%d.txt", i)),
+			Attr:       Attr{Crtime: crtime},
+			HardLinkId: NewHardLinkId(),
+		}
+		f.ensureEntryInode(entry)
+
+		if entry.Attr.Inode > math.MaxInt64 {
+			t.Fatalf("ensureEntryInode(%q) = %d, above math.MaxInt64", entry.FullPath, entry.Attr.Inode)
+		}
+	}
+}
+
 func newTestFilerWithStubStore() (*Filer, *stubFilerStore) {
 	store := newStubFilerStore()
 	f := NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
@@ -101,6 +151,57 @@ func TestCreateEntryAssignsInodesToAutoCreatedParents(t *testing.T) {
 	}
 }
 
+func TestCreateEntryOExclPreservesExistingEntry(t *testing.T) {
+	f, store := newTestFilerWithStubStore()
+
+	original := &Entry{
+		FullPath: util.FullPath("/buckets/my-bucket"),
+		Attr:     Attr{Mode: os.ModeDir | 0o777},
+		Extended: map[string][]byte{
+			"lifecycle": []byte(`<LifecycleConfiguration/>`),
+			"owner":     []byte("alice"),
+		},
+	}
+	require.NoError(t, store.InsertEntry(context.Background(), original))
+
+	replacement := &Entry{
+		FullPath: util.FullPath("/buckets/my-bucket"),
+		Attr:     Attr{Mode: os.ModeDir | 0o777},
+	}
+	err := f.CreateEntry(context.Background(), replacement, original, true, false, nil, false, f.MaxFilenameLength)
+	require.ErrorIs(t, err, filer_pb.ErrEntryAlreadyExists)
+
+	stored, findErr := store.FindEntry(context.Background(), original.FullPath)
+	require.NoError(t, findErr)
+	assert.Equal(t, original.Extended, stored.Extended)
+}
+
+func TestCreateEntryOExclFailsOnLookupError(t *testing.T) {
+	f, store := newTestFilerWithStubStore()
+
+	original := &Entry{
+		FullPath: util.FullPath("/buckets/my-bucket"),
+		Attr:     Attr{Mode: os.ModeDir | 0o777},
+		Extended: map[string][]byte{"owner": []byte("alice")},
+	}
+	require.NoError(t, store.InsertEntry(context.Background(), original))
+
+	// a failed lookup must not masquerade as "not found": without the check
+	// the insert path would upsert over the stored bucket entry
+	store.findErr = errors.New("transient store failure")
+	err := f.CreateEntry(context.Background(), &Entry{
+		FullPath: util.FullPath("/buckets/my-bucket"),
+		Attr:     Attr{Mode: os.ModeDir | 0o777},
+	}, nil, true, false, nil, false, f.MaxFilenameLength)
+	require.Error(t, err)
+	assert.NotErrorIs(t, err, filer_pb.ErrEntryAlreadyExists)
+
+	store.findErr = nil
+	stored, findErr := store.FindEntry(context.Background(), original.FullPath)
+	require.NoError(t, findErr)
+	assert.Equal(t, original.Extended, stored.Extended)
+}
+
 func TestUpdateEntryPreservesExistingInode(t *testing.T) {
 	f, store := newTestFilerWithStubStore()
 
@@ -120,7 +221,7 @@ func TestUpdateEntryPreservesExistingInode(t *testing.T) {
 		},
 	}
 
-	err := f.UpdateEntry(context.Background(), original, updated)
+	err := f.UpdateEntry(context.Background(), original, updated, false)
 	require.Error(t, err)
 
 	updated = &Entry{
@@ -129,7 +230,7 @@ func TestUpdateEntryPreservesExistingInode(t *testing.T) {
 			Mode: 0o600,
 		},
 	}
-	err = f.UpdateEntry(context.Background(), original, updated)
+	err = f.UpdateEntry(context.Background(), original, updated, false)
 	require.NoError(t, err)
 
 	stored, findErr := store.FindEntry(context.Background(), original.FullPath)
@@ -155,7 +256,7 @@ func TestUpdateEntryBackfillsMissingLegacyInode(t *testing.T) {
 			Mode: 0o640,
 		},
 	}
-	err := f.UpdateEntry(context.Background(), original, updated)
+	err := f.UpdateEntry(context.Background(), original, updated, false)
 	require.NoError(t, err)
 
 	stored, findErr := store.FindEntry(context.Background(), original.FullPath)
@@ -164,3 +265,28 @@ func TestUpdateEntryBackfillsMissingLegacyInode(t *testing.T) {
 	assert.NotZero(t, stored.Attr.Inode)
 	assert.NotEqual(t, uint64(1), stored.Attr.Inode)
 }
+
+// A transient store error must fail the write instead of being mistaken for a
+// missing entry: on upsert stores proceeding would replace the entry without
+// loading the old chunks, orphaning them from cleanup.
+func TestCreateEntryFailsWhenLookupErrors(t *testing.T) {
+	f, store := newTestFilerWithStubStore()
+	path := util.FullPath("/dir/file.txt")
+	require.NoError(t, store.InsertEntry(context.Background(), &Entry{
+		FullPath: path,
+		Content:  []byte("existing"),
+	}))
+	store.findErr = errors.New("transient store failure")
+
+	entry := &Entry{
+		FullPath: path,
+		Attr:     Attr{Mode: 0o644},
+		Content:  []byte("overwrite"),
+	}
+	require.Error(t, f.CreateEntry(context.Background(), entry, nil, false, false, nil, false, f.MaxFilenameLength))
+
+	store.findErr = nil
+	stored, findErr := store.FindEntry(context.Background(), path)
+	require.NoError(t, findErr)
+	assert.Equal(t, "existing", string(stored.Content))
+}
diff --git a/weed/filer/filer_lazy_remote.go b/weed/filer/filer_lazy_remote.go
index 801a3eac01..81d4e3996a 100644
--- a/weed/filer/filer_lazy_remote.go
+++ b/weed/filer/filer_lazy_remote.go
@@ -7,7 +7,10 @@ import (
 	"strings"
 	"time"
 
+	"google.golang.org/protobuf/proto"
+
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
 	"github.com/seaweedfs/seaweedfs/weed/util"
@@ -15,11 +18,15 @@ import (
 
 type lazyFetchContextKey struct{}
 
+// lazyParentsContextKey marks a FindEntry issued while materializing missing
+// parents: that fetch's own parent walk would only re-stat the same gaps.
+type lazyParentsContextKey struct{}
+
 // maybeLazyFetchFromRemote is called by FindEntry when the store returns no
 // entry for p. If p is under a remote-storage mount, it stats the remote
 // object, builds a filer Entry from the result, and persists it via
-// CreateEntry with SkipCheckParentDirectory so phantom parent directories
-// under the mount are not required.
+// CreateEntry together with its missing parent directories: remote.uncache
+// and cache eviction find entries by walking down from the mount directory.
 //
 // On a CreateEntry failure after a successful StatFile the in-memory entry is
 // still returned (availability over consistency); the singleflight key is
@@ -43,7 +50,22 @@ func (f *Filer) maybeLazyFetchFromRemote(ctx context.Context, p util.FullPath) (
 		return nil, nil
 	}
 
-	client, _, found := f.RemoteStorage.FindRemoteStorageClient(p)
+	// A startup tombstone rebuild may still be replaying the meta log; wait
+	// for it so a pending delete cannot resurrect here.
+	if done := f.remoteTombstonesDone.Load(); done != nil {
+		select {
+		case <-*done:
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+
+	if f.isRemoteDeletionPending(ctx, p, mountDir) {
+		glog.V(2).InfofCtx(ctx, "maybeLazyFetchFromRemote: %s deleted locally, remote delete pending", p)
+		return nil, nil
+	}
+
+	remoteConf, found := f.RemoteStorage.FindRemoteStorageConf(p)
 	if !found {
 		return nil, nil
 	}
@@ -67,6 +89,12 @@ func (f *Filer) maybeLazyFetchFromRemote(ctx context.Context, p util.FullPath) (
 
 	key := string(p)
 	val, err, _ := f.lazyFetchGroup.Do(key, func() (interface{}, error) {
+		buildCtx := context.WithoutCancel(ctx)
+		client, clientErr := f.buildRemoteStorageClient(buildCtx, remoteConf)
+		if clientErr != nil {
+			glog.V(1).InfofCtx(ctx, "maybeLazyFetchFromRemote: reject %s: %v", p, clientErr)
+			return lazyFetchResult{nil}, nil
+		}
 		remoteEntry, statErr := client.StatFile(objectLoc)
 		if statErr != nil {
 			if errors.Is(statErr, remote_storage.ErrRemoteObjectNotFound) {
@@ -97,10 +125,30 @@ func (f *Filer) maybeLazyFetchFromRemote(ctx context.Context, p util.FullPath) (
 		persistBaseCtx, cancelPersist := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancelPersist()
 		persistCtx := context.WithValue(persistBaseCtx, lazyFetchContextKey{}, true)
-		saveErr := f.CreateEntry(persistCtx, entry, nil, false, false, nil, true, f.MaxFilenameLength)
+		// A delete may have landed while StatFile was in flight; re-check so
+		// the fetched object cannot resurrect a path whose delete is pending.
+		if f.isRemoteDeletionPending(persistCtx, p, mountDir) {
+			glog.V(2).InfofCtx(ctx, "maybeLazyFetchFromRemote: %s deleted during remote stat", p)
+			return lazyFetchResult{nil}, nil
+		}
+		if ctx.Value(lazyParentsContextKey{}) == nil {
+			f.fetchMissingRemoteParents(persistBaseCtx, mountDir, p)
+		}
+		saveErr := f.CreateEntry(persistCtx, entry, nil, false, false, nil, false, f.MaxFilenameLength)
 		if saveErr != nil {
 			glog.Warningf("maybeLazyFetchFromRemote: failed to persist filer entry for %s: %v", p, saveErr)
 			f.lazyFetchGroup.Forget(key)
+			return lazyFetchResult{entry}, nil
+		}
+
+		// A delete records its tombstone before removing the entry, so a
+		// tombstone visible now means the insert raced a delete that already
+		// ran: retract the persisted entry so the path stays deleted.
+		if f.isRemoteDeletionPending(persistCtx, p, mountDir) {
+			glog.V(2).InfofCtx(ctx, "maybeLazyFetchFromRemote: %s deleted while persisting", p)
+			f.lazyFetchGroup.Forget(key)
+			f.retractLazyRemoteEntry(persistCtx, entry)
+			return lazyFetchResult{nil}, nil
 		}
 
 		return lazyFetchResult{entry}, nil
@@ -116,25 +164,80 @@ func (f *Filer) maybeLazyFetchFromRemote(ctx context.Context, p util.FullPath) (
 	return result.entry, nil
 }
 
+// fetchMissingRemoteParents looks up p's missing parents under mountDir, top
+// down, through lazy fetch. A remote object stored at a parent's key is then
+// materialized first, so creating p promotes it to a prefix object instead of
+// hiding it behind a plain directory. Each missing parent costs one remote
+// stat, once per directory.
+func (f *Filer) fetchMissingRemoteParents(ctx context.Context, mountDir, p util.FullPath) {
+	var missing []util.FullPath
+	for dir, _ := p.DirAndName(); len(dir) > len(mountDir); dir, _ = util.FullPath(dir).DirAndName() {
+		if _, err := f.Store.FindEntry(ctx, util.FullPath(dir)); !errors.Is(err, filer_pb.ErrNotFound) {
+			break
+		}
+		missing = append(missing, util.FullPath(dir))
+	}
+	parentCtx := context.WithValue(ctx, lazyParentsContextKey{}, true)
+	for i := len(missing) - 1; i >= 0; i-- {
+		f.FindEntry(parentCtx, missing[i])
+	}
+}
+
+// retractLazyRemoteEntry deletes the entry at entry.FullPath only when it is
+// still the entry a lazy remote read just materialized — a concurrent write
+// may have replaced it, and deleting by path alone would take that write down.
+func (f *Filer) retractLazyRemoteEntry(ctx context.Context, entry *Entry) {
+	existing, findErr := f.FindEntry(ctx, entry.FullPath)
+	if findErr != nil || existing == nil {
+		return
+	}
+	// The stored entry must still be exactly what this read materialized —
+	// an intervening write (appended chunks, touched attributes) means a
+	// real update owns the path now.
+	if !proto.Equal(existing.ToProtoEntry(), entry.ToProtoEntry()) {
+		return
+	}
+	if err := f.doDeleteEntryMetaAndData(ctx, existing, false, false, nil); err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		glog.Warningf("retractLazyRemoteEntry %s: %v", entry.FullPath, err)
+	}
+}
+
+// remoteStorageObject resolves the client and object location entry maps to
+// on its mounted remote storage; a nil client means the path is not mounted.
+func (f *Filer) remoteStorageObject(ctx context.Context, entry *Entry) (remote_storage.RemoteStorageClient, *remote_pb.RemoteStorageLocation, error) {
+	mountDir, remoteLoc := f.RemoteStorage.FindMountDirectory(entry.FullPath)
+	if remoteLoc == nil {
+		return nil, nil, nil
+	}
+
+	remoteConf, found := f.RemoteStorage.GetRemoteStorageConf(remoteLoc.Name)
+	if !found {
+		return nil, nil, fmt.Errorf("resolve remote storage client for %s: not found", entry.FullPath)
+	}
+	client, clientErr := f.buildRemoteStorageClient(ctx, remoteConf)
+	if clientErr != nil {
+		return nil, nil, fmt.Errorf("resolve remote storage client for %s: %w", entry.FullPath, clientErr)
+	}
+	if client == nil {
+		return nil, nil, fmt.Errorf("resolve remote storage client for %s: initialization failed", entry.FullPath)
+	}
+
+	return client, MapFullPathToRemoteStorageLocation(mountDir, remoteLoc, entry.FullPath), nil
+}
+
 func (f *Filer) maybeDeleteFromRemote(ctx context.Context, entry *Entry) (bool, error) {
 	if entry == nil || f.RemoteStorage == nil {
 		return false, nil
 	}
 
-	mountDir, remoteLoc := f.RemoteStorage.FindMountDirectory(entry.FullPath)
-	if remoteLoc == nil {
+	if !entry.IsDirectory() && entry.Remote == nil {
 		return false, nil
 	}
 
-	client, _, found := f.RemoteStorage.GetRemoteStorageClient(remoteLoc.Name)
-	if !found {
-		return false, fmt.Errorf("resolve remote storage client for %s: not found", entry.FullPath)
+	client, objectLoc, err := f.remoteStorageObject(ctx, entry)
+	if err != nil || client == nil {
+		return false, err
 	}
-	if client == nil {
-		return false, fmt.Errorf("resolve remote storage client for %s: initialization failed", entry.FullPath)
-	}
-
-	objectLoc := MapFullPathToRemoteStorageLocation(mountDir, remoteLoc, entry.FullPath)
 
 	if entry.IsDirectory() {
 		if err := client.RemoveDirectory(objectLoc); err != nil {
@@ -147,10 +250,6 @@ func (f *Filer) maybeDeleteFromRemote(ctx context.Context, entry *Entry) (bool,
 		return true, nil
 	}
 
-	if entry.Remote == nil {
-		return false, nil
-	}
-
 	if err := client.DeleteFile(objectLoc); err != nil {
 		if errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
 			return true, nil
@@ -161,3 +260,175 @@ func (f *Filer) maybeDeleteFromRemote(ctx context.Context, entry *Entry) (bool,
 	glog.V(3).InfofCtx(ctx, "maybeDeleteFromRemote: deleted %s from remote", entry.FullPath)
 	return true, nil
 }
+
+// deleteSweptEntryRemote frees the remote objects a swept entry still owns,
+// mirroring the write-back daemon's delete guards (processDeleteEvent): the
+// source a pending rename marker still reads goes first — nothing else
+// releases it — then the object at the entry's own key, each only while it
+// is still the object the entry's stamp describes.
+func (f *Filer) deleteSweptEntryRemote(ctx context.Context, entry *Entry) error {
+	if entry == nil || f.RemoteStorage == nil || entry.Remote == nil {
+		return nil
+	}
+	client, objectLoc, err := f.remoteStorageObject(ctx, entry)
+	if err != nil || client == nil {
+		return err
+	}
+	if err := f.releasePendingRenameSource(ctx, client, entry); err != nil {
+		return err
+	}
+	return deleteRemoteFileIfUnchanged(ctx, client, objectLoc, entry.Remote)
+}
+
+// releasePendingRenameSource deletes the object a pending-rename marker on
+// entry still reads: the destination copy never landed, so the source key is
+// the content's only location and dropping the entry would orphan it. The
+// source survives while a remote-only entry occupies its path — that entry's
+// content is the same object. The delete binds to entry's stamp, which is
+// the stamp of the source the marker reads. Mirrors the write-back daemon's
+// releasePendingSource.
+func (f *Filer) releasePendingRenameSource(ctx context.Context, client remote_storage.RemoteStorageClient, entry *Entry) error {
+	src := f.RemoteSourcePath(entry, entry.FullPath)
+	if src == entry.FullPath {
+		return nil
+	}
+	srcEntry, err := f.Store.FindEntry(ctx, src)
+	if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		return fmt.Errorf("find rename source %s: %w", src, err)
+	}
+	if srcEntry != nil && len(srcEntry.Content) == 0 && srcEntry.IsInRemoteOnly() {
+		glog.V(0).InfofCtx(ctx, "keep remote source %s of pending rename of %s: a remote-only entry holds its path", src, entry.FullPath)
+		return nil
+	}
+	mountDir, remoteLoc := f.RemoteStorage.FindMountDirectory(src)
+	if remoteLoc == nil {
+		return nil
+	}
+	return deleteRemoteFileIfUnchanged(ctx, client, MapFullPathToRemoteStorageLocation(mountDir, remoteLoc, src), entry.Remote)
+}
+
+// deleteRemoteFileIfUnchanged deletes the remote object only while it is
+// still the one stamp describes. Backends offering a conditional delete bind
+// the check and the delete into one preconditioned request; the rest fall
+// back to a guarded stat-then-delete.
+func deleteRemoteFileIfUnchanged(ctx context.Context, client remote_storage.RemoteStorageClient, objectLoc *remote_pb.RemoteStorageLocation, stamp *filer_pb.RemoteEntry) error {
+	if deleter, ok := client.(remote_storage.RemoteStorageConditionalDeleter); ok {
+		deleted, delErr := deleter.DeleteFileIfUnchanged(objectLoc, stamp)
+		if delErr != nil {
+			return fmt.Errorf("delete remote file %s: %w", remote_storage.FormatLocation(objectLoc), delErr)
+		}
+		if !deleted {
+			glog.V(0).InfofCtx(ctx, "keep %s: the remote object changed since the delete", remote_storage.FormatLocation(objectLoc))
+		}
+		return nil
+	}
+	live, statErr := client.StatFile(objectLoc)
+	if statErr != nil {
+		if errors.Is(statErr, remote_storage.ErrRemoteObjectNotFound) {
+			return nil
+		}
+		return fmt.Errorf("stat remote file %s: %w", remote_storage.FormatLocation(objectLoc), statErr)
+	}
+	if !remote_storage.StillCurrent(stamp, live) {
+		glog.V(0).InfofCtx(ctx, "keep %s: the remote object changed since the delete", remote_storage.FormatLocation(objectLoc))
+		return nil
+	}
+	if err := client.DeleteFile(objectLoc); err != nil && !errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return fmt.Errorf("delete remote file %s: %w", remote_storage.FormatLocation(objectLoc), err)
+	}
+	return nil
+}
+
+// DeleteFromRemote deletes the object, or for a directory every object, the
+// entry maps to on its mounted remote storage.
+func (f *Filer) DeleteFromRemote(ctx context.Context, entry *Entry) error {
+	_, err := f.maybeDeleteFromRemote(ctx, entry)
+	return err
+}
+
+// ExtRemoteRenameSourceKey marks a remote-only entry whose rename committed
+// while its copy to the new key was still pending: it holds the path whose
+// object remote-only reads must serve until the copy stamps the entry.
+const ExtRemoteRenameSourceKey = "Seaweed-X-Remote-Rename-Source"
+
+// RemoteSourcePath returns the path whose remote object holds the content of
+// the remote-only entry at p: the renamed-from path a pending deferred copy
+// still reads, or p itself. A marker leading out of p's mount is ignored, so
+// whoever can set extended attributes cannot point reads at another mount.
+func (f *Filer) RemoteSourcePath(entry *Entry, p util.FullPath) util.FullPath {
+	src := util.FullPath(entry.Extended[ExtRemoteRenameSourceKey])
+	if src == "" || f.RemoteStorage == nil {
+		return p
+	}
+	mountDir, remoteLoc := f.RemoteStorage.FindMountDirectory(p)
+	if remoteLoc == nil {
+		return p
+	}
+	if srcMountDir, _ := f.RemoteStorage.FindMountDirectory(src); srcMountDir != mountDir {
+		return p
+	}
+	return src
+}
+
+// RemoteReadPath returns the dir and name whose object a remote-only read of
+// the entry at dir/name serves.
+func (f *Filer) RemoteReadPath(entry *Entry, dir, name string) (string, string) {
+	return f.RemoteSourcePath(entry, util.NewFullPath(dir, name)).DirAndName()
+}
+
+// CopyRemoteOnlyEntry copies the remote object of a renamed entry whose
+// content exists only on the remote to the key of newPath, and returns the
+// RemoteEntry of the copy. The rename deletes the old key along with the old
+// entry, and with no local data nothing would write the new key. It returns
+// nil when no copy is needed: the entry has local data, which the remote sync
+// uploads to the new key, it is empty, which the sync writes as an empty
+// object, or it is not under a remote mount. A rename that
+// moves such an entry out of its mount, or onto a remote that cannot copy, is
+// refused, since it would delete the only copy of the content.
+func (f *Filer) CopyRemoteOnlyEntry(ctx context.Context, entry *Entry, oldPath, newPath util.FullPath) (*filer_pb.RemoteEntry, error) {
+	src, dst, copier, err := f.RemoteCopyLocations(ctx, entry, oldPath, newPath)
+	if err != nil || copier == nil {
+		return nil, err
+	}
+	remoteEntry, err := copier.CopyFile(src, dst)
+	if err != nil {
+		return nil, fmt.Errorf("copy remote %s to %s: %w", remote_storage.FormatLocation(src), remote_storage.FormatLocation(dst), err)
+	}
+	glog.V(3).InfofCtx(ctx, "CopyRemoteOnlyEntry: copied %s to %s", remote_storage.FormatLocation(src), remote_storage.FormatLocation(dst))
+	return remoteEntry, nil
+}
+
+// RemoteCopyLocations resolves the object locations a remote-only rename copy
+// of entry between oldPath and newPath would use, and the client able to copy
+// it. A nil copier means the entry needs no copy; an error means it needs one
+// that cannot be served, which a rename must refuse before committing.
+func (f *Filer) RemoteCopyLocations(ctx context.Context, entry *Entry, oldPath, newPath util.FullPath) (src, dst *remote_pb.RemoteStorageLocation, copier remote_storage.RemoteStorageObjectCopier, err error) {
+	if f.RemoteStorage == nil || entry.IsDirectory() || !entry.IsInRemoteOnly() || len(entry.Content) > 0 {
+		return nil, nil, nil, nil
+	}
+
+	mountDir, remoteLoc := f.RemoteStorage.FindMountDirectory(oldPath)
+	if remoteLoc == nil {
+		return nil, nil, nil, nil
+	}
+	if newMountDir, _ := f.RemoteStorage.FindMountDirectory(newPath); newMountDir != mountDir {
+		return nil, nil, nil, fmt.Errorf("%s exists only on the remote of mount %s and cannot be renamed out of it; cache it first", oldPath, mountDir)
+	}
+
+	remoteConf, found := f.RemoteStorage.GetRemoteStorageConf(remoteLoc.Name)
+	if !found {
+		return nil, nil, nil, fmt.Errorf("resolve remote storage client for %s: not found", oldPath)
+	}
+	client, clientErr := f.buildRemoteStorageClient(ctx, remoteConf)
+	if clientErr != nil {
+		return nil, nil, nil, fmt.Errorf("resolve remote storage client for %s: %w", oldPath, clientErr)
+	}
+	copier, ok := client.(remote_storage.RemoteStorageObjectCopier)
+	if !ok {
+		return nil, nil, nil, fmt.Errorf("%s exists only on the remote and remote storage type %s cannot copy it to the new name; cache it first", oldPath, remoteConf.Type)
+	}
+
+	src = MapFullPathToRemoteStorageLocation(mountDir, remoteLoc, f.RemoteSourcePath(entry, oldPath))
+	dst = MapFullPathToRemoteStorageLocation(mountDir, remoteLoc, newPath)
+	return src, dst, copier, nil
+}
diff --git a/weed/filer/filer_lazy_remote_listing.go b/weed/filer/filer_lazy_remote_listing.go
index 4965589d77..52b43981fe 100644
--- a/weed/filer/filer_lazy_remote_listing.go
+++ b/weed/filer/filer_lazy_remote_listing.go
@@ -56,6 +56,14 @@ func (f *Filer) maybeLazyListFromRemote(ctx context.Context, p util.FullPath) {
 		}
 	}
 
+	if done := f.remoteTombstonesDone.Load(); done != nil {
+		select {
+		case <-*done:
+		case <-ctx.Done():
+			return
+		}
+	}
+
 	// Lazy listing is opt-in: disabled when TTL is 0
 	if remoteLoc.ListingCacheTtlSeconds <= 0 {
 		return
@@ -75,13 +83,18 @@ func (f *Filer) maybeLazyListFromRemote(ctx context.Context, p util.FullPath) {
 		}
 	}
 
-	client, _, found := f.RemoteStorage.FindRemoteStorageClient(lookupPath)
+	remoteConf, found := f.RemoteStorage.FindRemoteStorageConf(lookupPath)
 	if !found {
 		return
 	}
 
 	key := "list:" + string(p)
 	f.lazyListGroup.Do(key, func() (interface{}, error) {
+		client, clientErr := f.buildRemoteStorageClient(context.WithoutCancel(ctx), remoteConf)
+		if clientErr != nil {
+			glog.V(1).InfofCtx(ctx, "maybeLazyListFromRemote: reject %s: %v", p, clientErr)
+			return nil, nil
+		}
 		startTime := time.Now()
 		objectLoc := MapFullPathToRemoteStorageLocation(mountDir, remoteLoc, p)
 
@@ -90,6 +103,10 @@ func (f *Filer) maybeLazyListFromRemote(ctx context.Context, p util.FullPath) {
 		persistCtx := context.WithValue(context.WithoutCancel(ctx), lazyListContextKey{}, true)
 		persistCtx = context.WithValue(persistCtx, lazyFetchContextKey{}, true)
 
+		// Entries listed under p must stay reachable by a walk from the mount
+		// directory, the same reason the lazy fetch fills in missing parents.
+		f.fetchMissingRemoteParents(context.WithoutCancel(ctx), mountDir, p)
+
 		listErr := client.ListDirectory(persistCtx, objectLoc, func(dir string, name string, isDirectory bool, remoteEntry *filer_pb.RemoteEntry) error {
 			childPath := p.Child(name)
 
@@ -104,6 +121,10 @@ func (f *Filer) maybeLazyListFromRemote(ctx context.Context, p util.FullPath) {
 				return nil
 			}
 
+			if existingEntry == nil && f.isRemoteDeletionPending(persistCtx, childPath, mountDir) {
+				return nil
+			}
+
 			if existingEntry != nil {
 				// Merge: update remote metadata while preserving local state
 				// (Chunks, Extended, Uid/Gid/Mode, etc.)
@@ -156,6 +177,9 @@ func (f *Filer) maybeLazyListFromRemote(ctx context.Context, p util.FullPath) {
 				}
 				if saveErr := f.CreateEntry(persistCtx, entry, nil, false, false, nil, true, f.MaxFilenameLength); saveErr != nil {
 					glog.Warningf("maybeLazyListFromRemote: persist %s: %v", childPath, saveErr)
+				} else if f.isRemoteDeletionPending(persistCtx, childPath, mountDir) {
+					// a delete landed between the check above and the insert
+					f.retractLazyRemoteEntry(persistCtx, entry)
 				}
 			}
 			return nil
@@ -195,7 +219,7 @@ func (f *Filer) updateDirectoryListingSyncedAt(ctx context.Context, p util.FullP
 			dirEntry.Extended = make(map[string][]byte)
 		}
 		dirEntry.Extended[xattrRemoteListingSyncedAt] = []byte(fmt.Sprintf("%d", syncTime.Unix()))
-		if saveErr := f.CreateEntry(ctx, dirEntry, nil, false, false, nil, true, f.MaxFilenameLength); saveErr != nil {
+		if saveErr := f.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, f.MaxFilenameLength); saveErr != nil {
 			glog.Warningf("maybeLazyListFromRemote: create dir synced_at for %s: %v", p, saveErr)
 		}
 		return
diff --git a/weed/filer/filer_lazy_remote_test.go b/weed/filer/filer_lazy_remote_test.go
index 33e0197f68..f463bb618c 100644
--- a/weed/filer/filer_lazy_remote_test.go
+++ b/weed/filer/filer_lazy_remote_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
@@ -34,6 +35,12 @@ type stubFilerStore struct {
 	entries         map[string]*Entry
 	kv              map[string][]byte
 	insertErr       error
+	findErr         error
+	findErrByPath   map[string]error
+	kvPutErr        error
+	kvGetErr        error
+	kvDeleteErr     error
+	kvGetHook       func(key []byte)
 	deleteErrByPath map[string]error
 }
 
@@ -45,6 +52,12 @@ func newStubFilerStore() *stubFilerStore {
 	}
 }
 
+func (s *stubFilerStore) setKvPutErr(err error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.kvPutErr = err
+}
+
 func (s *stubFilerStore) GetName() string                             { return "stub" }
 func (s *stubFilerStore) Initialize(util.Configuration, string) error { return nil }
 func (s *stubFilerStore) Shutdown()                                   {}
@@ -56,12 +69,21 @@ func (s *stubFilerStore) RollbackTransaction(context.Context) error { return nil
 func (s *stubFilerStore) KvPut(_ context.Context, key []byte, value []byte) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if s.kvPutErr != nil {
+		return s.kvPutErr
+	}
 	s.kv[string(key)] = append([]byte(nil), value...)
 	return nil
 }
 func (s *stubFilerStore) KvGet(_ context.Context, key []byte) ([]byte, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if s.kvGetHook != nil {
+		s.kvGetHook(key)
+	}
+	if s.kvGetErr != nil {
+		return nil, s.kvGetErr
+	}
 	value, found := s.kv[string(key)]
 	if !found {
 		return nil, ErrKvNotFound
@@ -71,6 +93,9 @@ func (s *stubFilerStore) KvGet(_ context.Context, key []byte) ([]byte, error) {
 func (s *stubFilerStore) KvDelete(_ context.Context, key []byte) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if s.kvDeleteErr != nil {
+		return s.kvDeleteErr
+	}
 	delete(s.kv, string(key))
 	return nil
 }
@@ -174,6 +199,12 @@ func (s *stubFilerStore) UpdateEntry(_ context.Context, entry *Entry) error {
 func (s *stubFilerStore) FindEntry(_ context.Context, p util.FullPath) (*Entry, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if s.findErr != nil {
+		return nil, s.findErr
+	}
+	if err := s.findErrByPath[string(p)]; err != nil {
+		return nil, err
+	}
 	if e, ok := s.entries[string(p)]; ok {
 		return e, nil
 	}
@@ -228,8 +259,8 @@ func (c *stubRemoteClient) RemoveDirectory(loc *remote_pb.RemoteStorageLocation)
 func (c *stubRemoteClient) WriteFile(*remote_pb.RemoteStorageLocation, *filer_pb.Entry, io.Reader) (*filer_pb.RemoteEntry, error) {
 	return nil, nil
 }
-func (c *stubRemoteClient) UpdateFileMetadata(*remote_pb.RemoteStorageLocation, *filer_pb.Entry, *filer_pb.Entry) error {
-	return nil
+func (c *stubRemoteClient) UpdateFileMetadata(*remote_pb.RemoteStorageLocation, *filer_pb.Entry, *filer_pb.Entry) (*filer_pb.RemoteEntry, error) {
+	return nil, nil
 }
 func (c *stubRemoteClient) DeleteFile(loc *remote_pb.RemoteStorageLocation) error {
 	c.deleteCalls = append(c.deleteCalls, &remote_pb.RemoteStorageLocation{
@@ -250,6 +281,21 @@ func (c *stubRemoteClient) ListBuckets() ([]*remote_storage.Bucket, error) { ret
 func (c *stubRemoteClient) CreateBucket(string) error                      { return nil }
 func (c *stubRemoteClient) DeleteBucket(string) error                      { return nil }
 
+// stubConditionalRemoteClient adds the optional conditional-delete interface:
+// callers binding stat and delete into one preconditioned request never reach
+// StatFile or DeleteFile.
+type stubConditionalRemoteClient struct {
+	stubRemoteClient
+	conditionalResult bool
+	conditionalErr    error
+	conditionalCalls  []*remote_pb.RemoteStorageLocation
+}
+
+func (c *stubConditionalRemoteClient) DeleteFileIfUnchanged(loc *remote_pb.RemoteStorageLocation, _ *filer_pb.RemoteEntry) (bool, error) {
+	c.conditionalCalls = append(c.conditionalCalls, loc)
+	return c.conditionalResult, c.conditionalErr
+}
+
 // --- stub RemoteStorageClientMaker ---
 
 type stubClientMaker struct {
@@ -277,8 +323,9 @@ func newTestFiler(t *testing.T, store *stubFilerStore, rs *FilerRemoteStorage) *
 		FilerConf:           NewFilerConf(),
 		MaxFilenameLength:   255,
 		MasterClient:        mc,
-		fileIdDeletionQueue: util.NewUnboundedQueue(),
+		FileIdDeletionQueue: util.NewUnboundedQueue(),
 		deletionQuit:        make(chan struct{}),
+		remoteTombstones:    newRemoteDeletionTombstones(),
 		LocalMetaLogBuffer: log_buffer.NewLogBuffer("test", time.Minute,
 			func(*log_buffer.LogBuffer, time.Time, time.Time, []byte, int64, int64) {}, nil, func() {}),
 	}
@@ -300,6 +347,24 @@ func registerStubMaker(t *testing.T, storageType string, client remote_storage.R
 	}
 }
 
+// putConfigEntry stores a filer entry whose content is a serialized configuration.
+func putConfigEntry(store *stubFilerStore, path string, content []byte) {
+	store.entries[path] = &Entry{
+		FullPath: util.FullPath(path),
+		Attr: Attr{
+			Mtime:  time.Unix(1700000000, 0),
+			Crtime: time.Unix(1700000000, 0),
+			Mode:   0644,
+		},
+		Content: content,
+	}
+}
+
+// putDirEntry stores a plain directory entry, so a lazy fetch below it finds its parent in place.
+func putDirEntry(store *stubFilerStore, path string) {
+	store.entries[path] = &Entry{FullPath: util.FullPath(path), Attr: Attr{Mode: os.ModeDir | 0755}}
+}
+
 // --- tests ---
 
 func TestMaybeLazyFetchFromRemote_HitsRemoteAndPersists(t *testing.T) {
@@ -335,6 +400,199 @@ func TestMaybeLazyFetchFromRemote_HitsRemoteAndPersists(t *testing.T) {
 	assert.Equal(t, []byte("zstd"), stored.Extended["Content-Encoding"])
 }
 
+// pathStatRemoteClient stats only the objects it holds, keyed by remote path.
+type pathStatRemoteClient struct {
+	stubRemoteClient
+	objects   map[string]*filer_pb.RemoteEntry
+	statCalls []string
+}
+
+func (c *pathStatRemoteClient) StatFile(loc *remote_pb.RemoteStorageLocation) (*filer_pb.RemoteEntry, error) {
+	c.statCalls = append(c.statCalls, loc.Path)
+	if remoteEntry, found := c.objects[loc.Path]; found {
+		return remoteEntry, nil
+	}
+	return nil, remote_storage.ErrRemoteObjectNotFound
+}
+
+func newPathStatFiler(t *testing.T, storageType string, client remote_storage.RemoteStorageClient) (*Filer, *stubFilerStore) {
+	t.Helper()
+	t.Cleanup(registerStubMaker(t, storageType, client))
+	conf := &remote_pb.RemoteConf{Name: "mystore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "mystore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+	store := newStubFilerStore()
+	return newTestFiler(t, store, rs), store
+}
+
+func TestMaybeLazyFetchFromRemote_PersistsParentDirectories(t *testing.T) {
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/a/b/file.bin":  {RemoteMtime: 1700000000, RemoteSize: 1234},
+		"/a/b/other.bin": {RemoteMtime: 1700000000, RemoteSize: 5678},
+	}}
+	f, store := newPathStatFiler(t, "stub_lazy_parents", stub)
+
+	const filePath = "/buckets/mybucket/a/b/file.bin"
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), filePath)
+	require.NoError(t, err)
+	require.NotNil(t, entry)
+	assert.Equal(t, []string{"/a/b/file.bin", "/a", "/a/b"}, stub.statCalls, "each missing parent is stat'ed once")
+
+	for _, dir := range []string{"/buckets/mybucket/a", "/buckets/mybucket/a/b"} {
+		dirEntry := store.getEntry(dir)
+		require.NotNil(t, dirEntry, "parent %s not persisted", dir)
+		assert.True(t, dirEntry.IsDirectory(), "%s should be a directory", dir)
+		assert.Nil(t, dirEntry.Remote, "%s holds no remote object", dir)
+	}
+
+	// A sibling finds its parents in place and stats only itself.
+	stub.statCalls = nil
+	_, err = f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/a/b/other.bin")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"/a/b/other.bin"}, stub.statCalls)
+
+	// Once the content is cached, eviction walks down from the mount and must reach it.
+	stored := store.getEntry(filePath)
+	require.NotNil(t, stored)
+	stored.Chunks = []*filer_pb.FileChunk{{FileId: "1,01637037d6", Size: 1234}}
+	stored.Remote.LastLocalSyncTsNs = time.Now().UnixNano()
+	require.NoError(t, store.UpdateEntry(context.Background(), stored))
+
+	evictable := f.ListEvictableRemoteEntries(context.Background(), []util.FullPath{"/buckets/mybucket"}, 0)
+	require.Len(t, evictable, 1)
+	assert.Equal(t, util.FullPath(filePath), evictable[0].FullPath)
+}
+
+func TestMaybeLazyFetchFromRemote_ParentLookupStopsAtStoreError(t *testing.T) {
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/a/b/file.bin": {RemoteMtime: 1700000000, RemoteSize: 1234},
+	}}
+	f, store := newPathStatFiler(t, "stub_lazy_parent_store_error", stub)
+	store.findErrByPath = map[string]error{"/buckets/mybucket/a/b": errors.New("store unavailable")}
+
+	_, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/a/b/file.bin")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"/a/b/file.bin"}, stub.statCalls, "a parent the store cannot read is not treated as missing")
+}
+
+func TestMaybeLazyFetchFromRemote_PromotesRemoteObjectAtParentKey(t *testing.T) {
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/reports":          {RemoteMtime: 1700000000, RemoteSize: 10},
+		"/reports/2026.csv": {RemoteMtime: 1700000000, RemoteSize: 20},
+	}}
+	f, store := newPathStatFiler(t, "stub_lazy_prefix_object", stub)
+
+	_, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/reports/2026.csv")
+	require.NoError(t, err)
+
+	parent := store.getEntry("/buckets/mybucket/reports")
+	require.NotNil(t, parent)
+	assert.True(t, parent.IsDirectory())
+	assert.Equal(t, []byte("true"), parent.Extended[s3_constants.SeaweedFSPrefixObject], "the remote object at the parent key must stay readable")
+	require.NotNil(t, parent.Remote)
+	assert.Equal(t, int64(10), parent.Remote.RemoteSize)
+}
+
+func TestMaybeLazyFetchFromRemote_StatsEachParentOnce(t *testing.T) {
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/a/b/c/file.bin": {RemoteMtime: 1700000000, RemoteSize: 1234},
+	}}
+	f, _ := newPathStatFiler(t, "stub_lazy_parent_stats", stub)
+
+	_, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/a/b/c/file.bin")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"/a/b/c/file.bin", "/a", "/a/b", "/a/b/c"}, stub.statCalls,
+		"a parent still missing after its own stat must not be re-stat'ed by the next lookup")
+}
+
+func TestMaybeLazyListFromRemote_PersistsParentDirectories(t *testing.T) {
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{}}
+	stub.listDirFn = func(loc *remote_pb.RemoteStorageLocation, visitFn remote_storage.VisitFunc) error {
+		return visitFn("/", "file.bin", false, &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 1234})
+	}
+	f, store := newPathStatFiler(t, "stub_lazy_list_parents", stub)
+	f.RemoteStorage.mapDirectoryToRemoteStorage("/buckets/listmount", &remote_pb.RemoteStorageLocation{
+		Name:                   "mystore",
+		Bucket:                 "listmount",
+		Path:                   "/",
+		ListingCacheTtlSeconds: 300,
+	})
+
+	f.maybeLazyListFromRemote(context.Background(), util.FullPath("/buckets/listmount/a/b"))
+
+	assert.Equal(t, []string{"/a"}, stub.statCalls, "each missing parent is stat'ed once")
+	for _, dir := range []string{"/buckets/listmount", "/buckets/listmount/a", "/buckets/listmount/a/b"} {
+		dirEntry := store.getEntry(dir)
+		require.NotNil(t, dirEntry, "%s not persisted", dir)
+		assert.True(t, dirEntry.IsDirectory(), "%s should be a directory", dir)
+	}
+
+	child := store.getEntry("/buckets/listmount/a/b/file.bin")
+	require.NotNil(t, child)
+	child.Chunks = []*filer_pb.FileChunk{{FileId: "1,01637037d6", Size: 1234}}
+	child.Remote.LastLocalSyncTsNs = time.Now().UnixNano()
+	require.NoError(t, store.UpdateEntry(context.Background(), child))
+
+	evictable := f.ListEvictableRemoteEntries(context.Background(), []util.FullPath{"/buckets/listmount"}, 0)
+	require.Len(t, evictable, 1)
+	assert.Equal(t, util.FullPath("/buckets/listmount/a/b/file.bin"), evictable[0].FullPath)
+}
+
+func TestDeleteEntryMetaAndData_EmptyFolderUnderMountKeepsRemotePrefix(t *testing.T) {
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/dir/unread.bin": {RemoteMtime: 1700000000, RemoteSize: 1},
+	}}
+	f, store := newPathStatFiler(t, "stub_lazy_empty_folder", stub)
+	dirPath := util.FullPath("/buckets/mybucket/dir")
+	putDirEntry(store, string(dirPath))
+
+	require.NoError(t, f.DeleteEntryMetaAndData(context.Background(), dirPath, false, false, false, false, nil, 0))
+
+	assert.Empty(t, stub.removeCalls, "an empty local folder must not remove its remote prefix")
+	assert.Nil(t, store.getEntry(string(dirPath)))
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/dir/unread.bin")
+	require.NoError(t, err)
+	assert.NotNil(t, entry, "a metadata-only delete must not block lazy reads under the folder")
+}
+
+func TestDeleteEmptyParentDirectories_UnderMountKeepsRemotePrefix(t *testing.T) {
+	stub := &pathStatRemoteClient{}
+	f, store := newPathStatFiler(t, "stub_lazy_expired_parents", stub)
+	f.DirBucketsPath = "/buckets"
+	putDirEntry(store, "/buckets/mybucket/a")
+	putDirEntry(store, "/buckets/mybucket/a/b")
+
+	f.DeleteEmptyParentDirectories(context.Background(), "/buckets/mybucket/a/b", "/buckets")
+
+	assert.Empty(t, stub.removeCalls, "an empty local folder must not remove its remote prefix")
+	assert.Nil(t, store.getEntry("/buckets/mybucket/a/b"))
+	assert.Nil(t, store.getEntry("/buckets/mybucket/a"))
+}
+
+func TestIsUnderRemoteMount(t *testing.T) {
+	rs := NewFilerRemoteStorage()
+	rs.mapDirectoryToRemoteStorage("/buckets/mirror", &remote_pb.RemoteStorageLocation{
+		Name:   "mystore",
+		Bucket: "mirror",
+		Path:   "/",
+	})
+	f := newTestFiler(t, newStubFilerStore(), rs)
+
+	for path, want := range map[util.FullPath]bool{
+		"/buckets/mirror":     true,
+		"/buckets/mirror/a/b": true,
+		"/buckets/mirror2/a":  false,
+		"/buckets/local/a":    false,
+	} {
+		assert.Equal(t, want, f.IsUnderRemoteMount(path), path)
+	}
+}
+
 func TestMaybeLazyFetchFromRemote_NotUnderMount(t *testing.T) {
 	rs := NewFilerRemoteStorage()
 	store := newStubFilerStore()
@@ -470,6 +728,139 @@ func TestMaybeLazyFetchFromRemote_ContextGuardPreventsRecursion(t *testing.T) {
 	assert.Equal(t, 0, countingStub.statCalls, "guard should prevent StatFile from being called")
 }
 
+func TestMaybeLazyFetchFromRemote_GuardedClientRejectsEndpoint(t *testing.T) {
+	const storageType = "stub_lazy_guarded"
+	countingStub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1, RemoteSize: 1},
+		},
+	}
+	defer registerStubMaker(t, storageType, countingStub)()
+
+	conf := &remote_pb.RemoteConf{Name: "guardedstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "guardedstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	f.BuildGuardedRemoteClient = func(ctx context.Context, _ *remote_pb.RemoteConf, _ bool) (remote_storage.RemoteStorageClient, error) {
+		return nil, fmt.Errorf("reject remote endpoint")
+	}
+
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/file.txt")
+	require.NoError(t, err)
+	assert.Nil(t, entry, "guarded rejection should yield no entry")
+	assert.Equal(t, 0, countingStub.statCalls, "guarded rejection should not reach the remote")
+}
+
+func TestMaybeLazyListFromRemote_GuardedClientRejectsEndpoint(t *testing.T) {
+	const storageType = "stub_lazy_list_guarded"
+	stub := &stubRemoteClient{
+		listDirFn: func(loc *remote_pb.RemoteStorageLocation, visitFn remote_storage.VisitFunc) error {
+			return visitFn("/", "file.txt", false, &filer_pb.RemoteEntry{RemoteSize: 1})
+		},
+	}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "listguardedstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:                   "listguardedstore",
+		Bucket:                 "mybucket",
+		Path:                   "/",
+		ListingCacheTtlSeconds: 300,
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	f.BuildGuardedRemoteClient = func(ctx context.Context, _ *remote_pb.RemoteConf, _ bool) (remote_storage.RemoteStorageClient, error) {
+		return nil, fmt.Errorf("reject remote endpoint")
+	}
+
+	f.maybeLazyListFromRemote(context.Background(), util.FullPath("/buckets/mybucket"))
+	assert.Equal(t, 0, stub.listDirCalls, "guarded rejection should not reach the remote")
+}
+
+func TestDeleteEntryMetaAndData_GuardedClientRejectsRemoteBackedFile(t *testing.T) {
+	const storageType = "stub_lazy_delete_guarded"
+	stub := &stubRemoteClient{}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "deleteguardedstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "deleteguardedstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	filePath := util.FullPath("/buckets/mybucket/file.txt")
+	store.entries[string(filePath)] = &Entry{
+		FullPath: filePath,
+		Attr: Attr{
+			Mtime:    time.Unix(1700000000, 0),
+			Crtime:   time.Unix(1700000000, 0),
+			Mode:     0644,
+			FileSize: 64,
+		},
+		Remote: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 64},
+	}
+	f := newTestFiler(t, store, rs)
+	f.BuildGuardedRemoteClient = func(ctx context.Context, _ *remote_pb.RemoteConf, _ bool) (remote_storage.RemoteStorageClient, error) {
+		return nil, fmt.Errorf("reject remote endpoint")
+	}
+
+	err := f.DeleteEntryMetaAndData(context.Background(), filePath, false, false, false, false, nil, 0)
+	require.Error(t, err, "guarded rejection should block the remote-backed delete")
+	assert.Len(t, stub.deleteCalls, 0, "guarded rejection should not reach the remote")
+}
+
+func TestDeleteEntryMetaAndData_GuardedClientAllowsLocalOnlyFile(t *testing.T) {
+	const storageType = "stub_lazy_delete_local_only"
+	stub := &stubRemoteClient{}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "localonlystore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "localonlystore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	filePath := util.FullPath("/buckets/mybucket/file.txt")
+	store.entries[string(filePath)] = &Entry{
+		FullPath: filePath,
+		Attr: Attr{
+			Mtime:    time.Unix(1700000000, 0),
+			Crtime:   time.Unix(1700000000, 0),
+			Mode:     0644,
+			FileSize: 64,
+		},
+		// no Remote: a local-only file under the mount needs no remote delete
+	}
+	f := newTestFiler(t, store, rs)
+	f.BuildGuardedRemoteClient = func(ctx context.Context, _ *remote_pb.RemoteConf, _ bool) (remote_storage.RemoteStorageClient, error) {
+		return nil, fmt.Errorf("reject remote endpoint")
+	}
+
+	err := f.DeleteEntryMetaAndData(context.Background(), filePath, false, false, false, false, nil, 0)
+	require.NoError(t, err, "local-only file should delete despite a rejected mount endpoint")
+	_, findErr := store.FindEntry(context.Background(), filePath)
+	require.ErrorIs(t, findErr, filer_pb.ErrNotFound, "local metadata should be deleted")
+	assert.Len(t, stub.deleteCalls, 0, "local-only file should not reach the remote")
+}
+
 func TestFindEntry_LazyFetchOnMiss(t *testing.T) {
 	const storageType = "stub_lazy_findentry"
 	stub := &stubRemoteClient{
@@ -581,6 +972,57 @@ func TestDeleteEntryMetaAndData_IsFromOtherClusterSkipsRemoteDelete(t *testing.T
 	require.Len(t, stub.removeCalls, 0)
 }
 
+func TestDeleteEntryMetaAndData_UnmountedDirectorySkipsRemoteDelete(t *testing.T) {
+	const storageType = "stub_lazy_unmounted"
+	stub := &stubRemoteClient{}
+	defer registerStubMaker(t, storageType, stub)()
+
+	store := newStubFilerStore()
+	confContent, err := proto.Marshal(&remote_pb.RemoteConf{Name: "cloud1", Type: storageType})
+	require.NoError(t, err)
+	putConfigEntry(store, DirectoryEtcRemote+"/cloud1"+REMOTE_STORAGE_CONF_SUFFIX, confContent)
+	mountedContent, err := proto.Marshal(&remote_pb.RemoteStorageMapping{
+		Mappings: map[string]*remote_pb.RemoteStorageLocation{
+			"/buckets/mybucket": {Name: "cloud1", Bucket: "mybucket", Path: "/"},
+		},
+	})
+	require.NoError(t, err)
+	putConfigEntry(store, DirectoryEtcRemote+"/"+REMOTE_STORAGE_MOUNT_FILE, mountedContent)
+
+	filePath := util.FullPath("/buckets/mybucket/cached.txt")
+	store.entries[string(filePath)] = &Entry{
+		FullPath: filePath,
+		Attr: Attr{
+			Mtime:    time.Unix(1700000000, 0),
+			Crtime:   time.Unix(1700000000, 0),
+			Mode:     0644,
+			FileSize: 64,
+		},
+		Remote: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 64},
+	}
+
+	f := newTestFiler(t, store, NewFilerRemoteStorage())
+	f.LoadRemoteStorageConfAndMapping()
+	_, remoteLoc := f.RemoteStorage.FindMountDirectory(filePath)
+	require.NotNil(t, remoteLoc)
+
+	unmountedContent, err := proto.Marshal(&remote_pb.RemoteStorageMapping{})
+	require.NoError(t, err)
+	putConfigEntry(store, DirectoryEtcRemote+"/"+REMOTE_STORAGE_MOUNT_FILE, unmountedContent)
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: DirectoryEtcRemote,
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: REMOTE_STORAGE_MOUNT_FILE, Content: unmountedContent},
+		},
+	})
+	_, remoteLoc = f.RemoteStorage.FindMountDirectory(filePath)
+	require.Nil(t, remoteLoc)
+
+	require.NoError(t, f.DeleteEntryMetaAndData(context.Background(), filePath, false, false, true, false, nil, 0))
+	require.Len(t, stub.deleteCalls, 0)
+	require.Len(t, stub.removeCalls, 0)
+}
+
 func TestDeleteEntryMetaAndData_RemoteOnlyFileNotUnderMountSkipsRemoteDelete(t *testing.T) {
 	const storageType = "stub_lazy_delete_not_under_mount"
 	stub := &stubRemoteClient{}
diff --git a/weed/filer/filer_notify.go b/weed/filer/filer_notify.go
index 25430b9010..8e23cef44a 100644
--- a/weed/filer/filer_notify.go
+++ b/weed/filer/filer_notify.go
@@ -9,6 +9,7 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
@@ -56,6 +57,9 @@ func (f *Filer) notifyUpdateEvent(ctx context.Context, oldEntry, newEntry *Entry
 	}
 
 	event := f.newMetadataEvent(oldEntry, newEntry, deleteChunks, isFromOtherCluster, signatures)
+	// Clear the stamp after the buffer append below - deliberately also on
+	// append failure (see the metaLogInflight comment).
+	defer f.metaLogInflight.done(event.TsNs)
 	eventNotification := event.EventNotification
 
 	if notification.Queue != nil {
@@ -67,6 +71,10 @@ func (f *Filer) notifyUpdateEvent(ctx context.Context, oldEntry, newEntry *Entry
 	}
 
 	f.logMetaEvent(ctx, event)
+	// Record the commit timestamp so a peer replay ordered by the entry lock
+	// this mutation may still be under sees the local change, including as a
+	// tombstone after the entry itself is gone.
+	f.noteCommittedEvent(event)
 	if sink := metadataEventSinkFromContext(ctx); sink != nil {
 		sink.Record(event)
 	}
@@ -76,6 +84,119 @@ func (f *Filer) notifyUpdateEvent(ctx context.Context, oldEntry, newEntry *Entry
 	return event
 }
 
+// metaLogInflight tracks events stamped but not yet appended to the local
+// log buffer - the two are separated by notification work that can block,
+// and a claim ignoring that window would assert durability or delivery for
+// timestamps still on their way in. Stamping shares the reader's lock, so an
+// event is always visible here or (bumped monotonically) in the buffer.
+//
+// An event whose append fails also clears its stamp: it is dropped from the
+// change stream entirely (loudly logged there), and a watermark waiting for
+// it would pin this filer's claims forever.
+type metaLogInflight struct {
+	sync.Mutex
+	stamped     map[int64]int
+	lastStampNs int64
+	lastClaimNs int64
+}
+
+// stamp assigns the event timestamp and registers it as in flight. Stamps
+// are monotonic against the registry's own history and every issued claim,
+// so a wall-clock step backwards cannot slip a new stamp under a floor or
+// watermark already handed out.
+func (t *metaLogInflight) stamp() int64 {
+	t.Lock()
+	defer t.Unlock()
+	floor := t.lastStampNs
+	if t.lastClaimNs > floor {
+		floor = t.lastClaimNs
+	}
+	tsNs := time.Now().UnixNano()
+	if tsNs <= floor {
+		tsNs = floor + 1
+	}
+	t.lastStampNs = tsNs
+	if t.stamped == nil {
+		t.stamped = make(map[int64]int)
+	}
+	t.stamped[tsNs]++
+	return tsNs
+}
+
+// done removes a stamp once the event has been appended to the buffer.
+func (t *metaLogInflight) done(tsNs int64) {
+	t.Lock()
+	defer t.Unlock()
+	if t.stamped[tsNs] <= 1 {
+		delete(t.stamped, tsNs)
+	} else {
+		t.stamped[tsNs]--
+	}
+}
+
+// minTsNs returns the oldest in-flight stamp, or 0 when nothing is in flight.
+func (t *metaLogInflight) minTsNs() int64 {
+	t.Lock()
+	defer t.Unlock()
+	var min int64
+	for tsNs := range t.stamped {
+		if min == 0 || tsNs < min {
+			min = tsNs
+		}
+	}
+	return min
+}
+
+// claimThrough caps a completeness claim by the oldest in-flight stamp and
+// fences it: later stamps always land above the returned claim, so a wall
+// clock stepping backwards cannot slide a new event under a watermark a
+// peer has already advanced to.
+func (t *metaLogInflight) claimThrough(nowNs int64) int64 {
+	t.Lock()
+	defer t.Unlock()
+	claim := nowNs
+	for tsNs := range t.stamped {
+		if tsNs-1 < claim {
+			claim = tsNs - 1
+		}
+	}
+	if claim > t.lastClaimNs {
+		t.lastClaimNs = claim
+	}
+	return claim
+}
+
+// LocalFlushedThroughTsNs reports the timestamp through which the local meta
+// log is durably on disk: everything at or below it is appended and flushed,
+// and nothing can land at or below it later. The registry is consulted before
+// the buffer: an event already appended is visible to the buffer claim, one
+// still in flight caps the claim, and one stamped later is fenced above it.
+func (f *Filer) LocalFlushedThroughTsNs(nowNs int64) int64 {
+	claim := f.metaLogInflight.claimThrough(nowNs)
+	if buffered := f.LocalMetaLogBuffer.FlushedThroughTsNs(nowNs); buffered < claim {
+		claim = buffered
+	}
+	return claim
+}
+
+// LocalDeliveredThroughTsNs caps a delivery-freshness claim (an idle
+// heartbeat's timestamp) by the oldest in-flight stamp: a stamped-but-
+// unappended event has not been streamed to anyone, and a peer aggregator
+// turns the claim into its delivery low-watermark.
+func (f *Filer) LocalDeliveredThroughTsNs(nowNs int64) int64 {
+	return f.metaLogInflight.claimThrough(nowNs)
+}
+
+// StampMetaLogInflightForTest and DoneMetaLogInflightForTest let tests in
+// other packages exercise the claim caps. Not for production use.
+func (f *Filer) StampMetaLogInflightForTest() int64 {
+	return f.metaLogInflight.stamp()
+}
+
+func (f *Filer) DoneMetaLogInflightForTest(tsNs int64) {
+	f.metaLogInflight.done(tsNs)
+}
+
 func (f *Filer) newMetadataEvent(oldEntry, newEntry *Entry, deleteChunks, isFromOtherCluster bool, signatures []int32) *filer_pb.SubscribeMetadataResponse {
 	if oldEntry == nil && newEntry == nil {
 		return nil
@@ -102,7 +223,8 @@ func (f *Filer) newMetadataEvent(oldEntry, newEntry *Entry, deleteChunks, isFrom
 			IsFromOtherCluster: isFromOtherCluster,
 			Signatures:         signatures,
 		},
-		TsNs: time.Now().UnixNano(),
+		// In flight until appended to the local log buffer (see metaLogInflight).
+		TsNs: f.metaLogInflight.stamp(),
 	}
 }
 
@@ -129,6 +251,11 @@ func (f *Filer) logMetaEvent(ctx context.Context, event *filer_pb.SubscribeMetad
 // in the rejection and volumeFileSizeLimit picks the real limit up from there.
 const metadataLogUploadLimit = log_buffer.BufferSize
 
+// shutdownMetadataLogFlushBudget bounds how long metadata-log flushes may keep
+// retrying once the filer is shutting down; Shutdown cancels the shared flush
+// context when it expires.
+const shutdownMetadataLogFlushBudget = 15 * time.Second
+
 var fileSizeLimitPattern = regexp.MustCompile(`file over the limited (\d+) bytes`)
 
 // volumeFileSizeLimit reads the byte limit back out of a volume server's size
@@ -160,17 +287,30 @@ func (f *Filer) logFlushFunc(logBuffer *log_buffer.LogBuffer, startTime, stopTim
 
 	// One piece at a time, each retried on its own so a partial success is not
 	// replayed, and the piece size follows the limit the volume servers report.
+	// While the filer keeps running the retry is unbounded so no metadata is
+	// dropped; once Shutdown arms the flush deadline the shared context cancels
+	// and the flush drops what is left instead of holding shutdown open.
 	limit := metadataLogUploadLimit
+	ctx := f.flushCtx
+	if ctx == nil {
+		ctx = context.Background()
+	}
 	for len(buf) > 0 {
 		piece := nextLogPiece(buf, limit)
-		if err := f.appendToFile(targetFile, piece); err != nil {
+		if err := f.appendToFile(ctx, targetFile, piece); err != nil {
 			glog.V(0).Infof("metadata log write failed %s: %v", targetFile, err)
 			if reported := volumeFileSizeLimit(err); reported > 0 && reported < limit {
 				glog.V(0).Infof("metadata log upload limit lowered to %d bytes", reported)
 				limit = reported
 				continue
 			}
-			time.Sleep(737 * time.Millisecond)
+			select {
+			case <-ctx.Done():
+				logBuffer.NoteFlushDropped(len(buf))
+				glog.V(0).Infof("metadata log flush abandoned during shutdown, %d bytes left for %s: %v", len(buf), targetFile, ctx.Err())
+				return
+			case <-time.After(737 * time.Millisecond):
+			}
 			continue
 		}
 		buf = buf[len(piece):]
@@ -257,7 +397,7 @@ func (f *Filer) ReadPersistedLogBuffer(ctx context.Context, startPosition log_bu
 
 	// Readahead: run the visitor in a background goroutine so volume server I/O
 	// for the next log file overlaps with event processing and gRPC delivery.
-	const readaheadSize = 1024
+	const readaheadSize = 8192
 	type entryOrErr struct {
 		entry *filer_pb.LogEntry
 		err   error
diff --git a/weed/filer/filer_notify_append.go b/weed/filer/filer_notify_append.go
index 9c5269dd12..24f4e733b9 100644
--- a/weed/filer/filer_notify_append.go
+++ b/weed/filer/filer_notify_append.go
@@ -11,16 +11,20 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
-func (f *Filer) appendToFile(targetFile string, data []byte) error {
+func (f *Filer) appendToFile(ctx context.Context, targetFile string, data []byte) error {
 
-	assignResult, uploadResult, err2 := f.assignAndUpload(targetFile, data)
+	assignResult, uploadResult, err2 := f.assignAndUpload(ctx, targetFile, data)
 	if err2 != nil {
 		return err2
 	}
 
+	// The piece is already uploaded; commit it on a detached context so an
+	// expired shutdown deadline does not strand the chunk.
+	ctx = context.WithoutCancel(ctx)
+
 	// find out existing entry
 	fullpath := util.FullPath(targetFile)
-	entry, err := f.FindEntry(context.Background(), fullpath)
+	entry, err := f.FindEntry(ctx, fullpath)
 	var offset int64 = 0
 	if err == filer_pb.ErrNotFound {
 		entry = &Entry{
@@ -43,7 +47,7 @@ func (f *Filer) appendToFile(targetFile string, data []byte) error {
 	entry.Chunks = append(entry.GetChunks(), uploadResult.ToPbFileChunk(assignResult.Fid, offset, time.Now().UnixNano()))
 
 	// update the entry
-	err = f.CreateEntry(context.Background(), entry, nil, false, false, nil, false, f.MaxFilenameLength)
+	err = f.CreateEntry(ctx, entry, nil, false, false, nil, false, f.MaxFilenameLength)
 
 	return err
 }
@@ -59,19 +63,30 @@ func (f *Filer) resolveMetadataLogAssignDiskType(targetFile string) (string, *fi
 	return util.Nvl(rule.DiskType, f.DefaultDiskType), rule
 }
 
-func (f *Filer) assignAndUpload(targetFile string, data []byte) (*operation.AssignResult, *operation.UploadResult, error) {
+// metaLogCollectionFor resolves the system metadata log's collection: the
+// filer.options.metaLog.collection override, then the filer default, then the
+// matched storage rule.
+func (f *Filer) metaLogCollectionFor(ruleCollection string) string {
+	return util.Nvl(f.metaLogTargetCollection, f.metaLogCollection, ruleCollection)
+}
+
+func (f *Filer) metaLogReplicationFor(ruleReplication string) string {
+	return util.Nvl(f.metaLogTargetReplication, f.metaLogReplication, ruleReplication)
+}
+
+func (f *Filer) assignAndUpload(ctx context.Context, targetFile string, data []byte) (*operation.AssignResult, *operation.UploadResult, error) {
 	// assign a volume location
 	diskType, rule := f.resolveMetadataLogAssignDiskType(targetFile)
 	assignRequest := &operation.VolumeAssignRequest{
 		Count:               1,
-		Collection:          util.Nvl(f.metaLogCollection, rule.Collection),
-		Replication:         util.Nvl(f.metaLogReplication, rule.Replication),
+		Collection:          f.metaLogCollectionFor(rule.Collection),
+		Replication:         f.metaLogReplicationFor(rule.Replication),
 		DiskType:            diskType,
 		WritableVolumeCount: rule.VolumeGrowthCount,
 		ExpectedDataSize:    uint64(len(data)),
 	}
 
-	assignResult, err := operation.Assign(context.Background(), f.GetMaster, f.GrpcDialOption, assignRequest)
+	assignResult, err := operation.Assign(ctx, f.GetMaster, f.GrpcDialOption, assignRequest)
 	if err != nil {
 		return nil, nil, fmt.Errorf("AssignVolume: %w", err)
 	}
@@ -96,7 +111,7 @@ func (f *Filer) assignAndUpload(targetFile string, data []byte) (*operation.Assi
 		return nil, nil, fmt.Errorf("upload data %s: %v", targetUrl, err)
 	}
 
-	uploadResult, err := uploader.UploadData(context.Background(), data, uploadOption)
+	uploadResult, err := uploader.UploadData(ctx, data, uploadOption)
 	if err != nil {
 		return nil, nil, fmt.Errorf("upload data %s: %v", targetUrl, err)
 	}
diff --git a/weed/filer/filer_notify_inflight_test.go b/weed/filer/filer_notify_inflight_test.go
new file mode 100644
index 0000000000..91c2f34ac2
--- /dev/null
+++ b/weed/filer/filer_notify_inflight_test.go
@@ -0,0 +1,134 @@
+package filer
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
+)
+
+// TestMetaLogInflightFloor pins the in-flight stamp bookkeeping backing
+// Filer.LocalFlushedThroughTsNs: the floor is the oldest outstanding stamp,
+// duplicate stamps are reference-counted, and a cleared registry reports zero.
+func TestMetaLogInflightFloor(t *testing.T) {
+	var inflight metaLogInflight
+	if got := inflight.minTsNs(); got != 0 {
+		t.Fatalf("empty registry: floor=%d want 0", got)
+	}
+	ts1 := inflight.stamp()
+	ts2 := inflight.stamp()
+	if ts2 < ts1 {
+		t.Fatalf("stamps not monotonic: %d then %d", ts1, ts2)
+	}
+	if got := inflight.minTsNs(); got != ts1 {
+		t.Fatalf("floor=%d want oldest stamp %d", got, ts1)
+	}
+	inflight.done(ts1)
+	if got := inflight.minTsNs(); got != ts2 {
+		t.Fatalf("after done(ts1): floor=%d want %d", got, ts2)
+	}
+	inflight.done(ts2)
+	if got := inflight.minTsNs(); got != 0 {
+		t.Fatalf("cleared registry: floor=%d want 0", got)
+	}
+}
+
+// TestLocalFlushedThroughTsNsBoundsInflight pins the flush-watermark claim: a
+// drained buffer claims "now", but an event stamped and not yet appended caps
+// the claim just below its timestamp - a peer bounding disk reads by the
+// claim must not advance past an event still on its way into the buffer.
+func TestLocalFlushedThroughTsNsBoundsInflight(t *testing.T) {
+	f := &Filer{
+		LocalMetaLogBuffer: log_buffer.NewLogBuffer("inflight-test", time.Minute, nil, nil, nil),
+	}
+	defer f.LocalMetaLogBuffer.ShutdownLogBuffer()
+
+	now := time.Now().UnixNano()
+	if got := f.LocalFlushedThroughTsNs(now); got != now {
+		t.Fatalf("drained, nothing in flight: claim=%d want now=%d", got, now)
+	}
+
+	ts := f.metaLogInflight.stamp()
+	if got := f.LocalFlushedThroughTsNs(time.Now().UnixNano()); got != ts-1 {
+		t.Fatalf("with in-flight stamp %d: claim=%d want %d", ts, got, ts-1)
+	}
+
+	f.metaLogInflight.done(ts)
+	now = time.Now().UnixNano()
+	if got := f.LocalFlushedThroughTsNs(now); got != now {
+		t.Fatalf("stamp cleared: claim=%d want now=%d", got, now)
+	}
+}
+
+// TestLocalDeliveredThroughTsNsBoundsInflight pins the delivery-freshness
+// cap: an idle heartbeat must not claim delivery-completeness past an event
+// that is stamped but not yet appended - the peer aggregator turns that claim
+// into its delivery low-watermark.
+func TestLocalDeliveredThroughTsNsBoundsInflight(t *testing.T) {
+	f := &Filer{
+		LocalMetaLogBuffer: log_buffer.NewLogBuffer("delivered-test", time.Minute, nil, nil, nil),
+	}
+	defer f.LocalMetaLogBuffer.ShutdownLogBuffer()
+
+	now := time.Now().UnixNano()
+	if got := f.LocalDeliveredThroughTsNs(now); got != now {
+		t.Fatalf("nothing in flight: claim=%d want now=%d", got, now)
+	}
+	ts := f.metaLogInflight.stamp()
+	if got := f.LocalDeliveredThroughTsNs(time.Now().UnixNano()); got != ts-1 {
+		t.Fatalf("with in-flight stamp %d: claim=%d want %d", ts, got, ts-1)
+	}
+	f.metaLogInflight.done(ts)
+}
+
+// TestClaimFencesFutureStamps pins the claim fence: once a claim is issued, a
+// wall-clock step backwards must not let a later stamp land at or below it -
+// the peer has already advanced its watermark to the claim.
+func TestClaimFencesFutureStamps(t *testing.T) {
+	f := &Filer{
+		LocalMetaLogBuffer: log_buffer.NewLogBuffer("claim-fence-test", time.Minute, nil, nil, nil),
+	}
+	defer f.LocalMetaLogBuffer.ShutdownLogBuffer()
+
+	// Claim with a sampled clock one hour ahead: to a stamp taken at the real
+	// wall clock this is exactly a backward step after the claim was issued.
+	aheadNs := time.Now().Add(time.Hour).UnixNano()
+	if got := f.LocalDeliveredThroughTsNs(aheadNs); got != aheadNs {
+		t.Fatalf("nothing in flight: claim=%d want %d", got, aheadNs)
+	}
+	ts := f.metaLogInflight.stamp()
+	if ts <= aheadNs {
+		t.Fatalf("stamp %d not fenced above issued delivery claim %d", ts, aheadNs)
+	}
+	f.metaLogInflight.done(ts)
+
+	// The flush claim fences the same way.
+	aheadNs += int64(time.Hour)
+	if got := f.LocalFlushedThroughTsNs(aheadNs); got != aheadNs {
+		t.Fatalf("drained buffer: claim=%d want %d", got, aheadNs)
+	}
+	ts = f.metaLogInflight.stamp()
+	if ts <= aheadNs {
+		t.Fatalf("stamp %d not fenced above issued flush claim %d", ts, aheadNs)
+	}
+	f.metaLogInflight.done(ts)
+}
+
+// TestMetaLogInflightStampMonotonic pins the registry-local monotonicity: a
+// wall clock stepping backwards must not let a new stamp slip under an
+// already-sampled floor.
+func TestMetaLogInflightStampMonotonic(t *testing.T) {
+	var inflight metaLogInflight
+	ts1 := inflight.stamp()
+	// Simulate a wall-clock step backwards: force the registry's history
+	// ahead of the clock; the next stamp must still move forward.
+	inflight.Lock()
+	inflight.lastStampNs = ts1 + int64(time.Hour)
+	inflight.Unlock()
+	ts2 := inflight.stamp()
+	if ts2 <= ts1+int64(time.Hour) {
+		t.Fatalf("stamp regressed: %d after forcing history to %d", ts2, ts1+int64(time.Hour))
+	}
+	inflight.done(ts1)
+	inflight.done(ts2)
+}
diff --git a/weed/filer/filer_on_meta_event.go b/weed/filer/filer_on_meta_event.go
index 5644e632b6..33acc5b2d7 100644
--- a/weed/filer/filer_on_meta_event.go
+++ b/weed/filer/filer_on_meta_event.go
@@ -15,6 +15,7 @@ func (f *Filer) onMetadataChangeEvent(event *filer_pb.SubscribeMetadataResponse)
 	f.maybeReloadRemoteStorageConfigurationAndMapping(event)
 	f.onBucketEvents(event)
 	f.onEmptyFolderCleanupEvents(event)
+	f.onRemoteDeletionEvents(event)
 }
 
 func (f *Filer) onBucketEvents(event *filer_pb.SubscribeMetadataResponse) {
@@ -55,11 +56,18 @@ func (f *Filer) onEmptyFolderCleanupEvents(event *filer_pb.SubscribeMetadataResp
 	// Handle delete events - trigger folder cleanup check
 	if filer_pb.IsDelete(event) && message.OldEntry != nil {
 		f.EmptyFolderCleaner.OnDeleteEvent(directory, message.OldEntry.Name, message.OldEntry.IsDirectory, eventTime)
+		f.EmptyFolderCleaner.InvalidateBucketPolicy(directory, message.OldEntry.Name, message.OldEntry.IsDirectory)
 	}
 
 	// Handle create events - cancel pending cleanup for the folder
 	if filer_pb.IsCreate(event) && message.NewEntry != nil {
 		f.EmptyFolderCleaner.OnCreateEvent(directory, message.NewEntry.Name, message.NewEntry.IsDirectory)
+		f.EmptyFolderCleaner.InvalidateBucketPolicy(directory, message.NewEntry.Name, message.NewEntry.IsDirectory)
+	}
+
+	// Handle update events - drop the cached bucket cleanup policy
+	if filer_pb.IsUpdate(event) && message.NewEntry != nil {
+		f.EmptyFolderCleaner.InvalidateBucketPolicy(directory, message.NewEntry.Name, message.NewEntry.IsDirectory)
 	}
 
 	// Handle rename/move events
@@ -67,6 +75,7 @@ func (f *Filer) onEmptyFolderCleanupEvents(event *filer_pb.SubscribeMetadataResp
 		// Treat the old location as a delete
 		if message.OldEntry != nil {
 			f.EmptyFolderCleaner.OnDeleteEvent(directory, message.OldEntry.Name, message.OldEntry.IsDirectory, eventTime)
+			f.EmptyFolderCleaner.InvalidateBucketPolicy(directory, message.OldEntry.Name, message.OldEntry.IsDirectory)
 		}
 		// Treat the new location as a create
 		if message.NewEntry != nil {
@@ -75,6 +84,7 @@ func (f *Filer) onEmptyFolderCleanupEvents(event *filer_pb.SubscribeMetadataResp
 				newDir = directory
 			}
 			f.EmptyFolderCleaner.OnCreateEvent(newDir, message.NewEntry.Name, message.NewEntry.IsDirectory)
+			f.EmptyFolderCleaner.InvalidateBucketPolicy(newDir, message.NewEntry.Name, message.NewEntry.IsDirectory)
 		}
 	}
 }
@@ -136,5 +146,11 @@ func (f *Filer) LoadRemoteStorageConfAndMapping() {
 	}
 }
 func (f *Filer) maybeReloadRemoteStorageConfigurationAndMapping(event *filer_pb.SubscribeMetadataResponse) {
-	// FIXME add reloading
+	if !filer_pb.MetadataEventTouchesDirectory(event, DirectoryEtcRemote) {
+		return
+	}
+
+	// a mount left behind after remote.unmount would still send deletes to a
+	// remote the filer no longer owns
+	f.LoadRemoteStorageConfAndMapping()
 }
diff --git a/weed/filer/filer_prefix_object_test.go b/weed/filer/filer_prefix_object_test.go
new file mode 100644
index 0000000000..42f9ba480c
--- /dev/null
+++ b/weed/filer/filer_prefix_object_test.go
@@ -0,0 +1,126 @@
+package filer
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestPromoteToPrefixObject covers a key written before the keys nested under it:
+// the file becomes the directory they live in, and has to stay an object of its own.
+func TestPromoteToPrefixObject(t *testing.T) {
+	f, store := newTestFilerWithStubStore()
+	ctx := context.Background()
+
+	object := &Entry{
+		FullPath: util.FullPath("/buckets/bkt/a/foo"),
+		Attr: Attr{
+			Mode:   0o644,
+			Mime:   "text/plain",
+			TtlSec: 3600,
+		},
+		Chunks:   []*filer_pb.FileChunk{{FileId: "1,01", Size: 4}},
+		Extended: map[string][]byte{s3_constants.SeaweedFSExpiresS3: []byte("true")},
+	}
+	require.NoError(t, f.CreateEntry(ctx, object, nil, false, false, nil, false, f.MaxFilenameLength))
+
+	nested := &Entry{FullPath: util.FullPath("/buckets/bkt/a/foo/bar"), Attr: Attr{Mode: 0o644}}
+	require.NoError(t, f.CreateEntry(ctx, nested, nil, false, false, nil, false, f.MaxFilenameLength))
+
+	promoted, err := store.FindEntry(ctx, object.FullPath)
+	require.NoError(t, err)
+	require.NotNil(t, promoted)
+
+	assert.True(t, promoted.IsDirectory(), "the nested key needs a directory here")
+	assert.Equal(t, object.Chunks, promoted.Chunks, "the object's data stays on it")
+	assert.Contains(t, promoted.Extended, s3_constants.SeaweedFSPrefixObject)
+	// Expiring the entry deletes the directory row on its own and strands the keys
+	// under it, so the promotion gives up the lazy TTL.
+	assert.Zero(t, promoted.Attr.TtlSec)
+}
+
+// TestExpiredDirectoryIsNotDeletedOnRead pins the other half: a TTL an older build
+// left on a promoted directory must not take the keys under it with it.
+func TestExpiredDirectoryIsNotDeletedOnRead(t *testing.T) {
+	f, store := newTestFilerWithStubStore()
+	ctx := context.Background()
+
+	dirPath := util.FullPath("/buckets/bkt/a/foo")
+	expired := time.Now().Add(-2 * time.Hour)
+	require.NoError(t, store.InsertEntry(ctx, &Entry{
+		FullPath: dirPath,
+		Attr: Attr{
+			Mode:   os.ModeDir | 0o755,
+			Crtime: expired,
+			Mtime:  expired,
+			TtlSec: 60,
+		},
+		Extended: map[string][]byte{s3_constants.SeaweedFSExpiresS3: []byte("true")},
+	}))
+	nested := &Entry{FullPath: dirPath + "/bar", Attr: Attr{Mode: 0o644}}
+	require.NoError(t, store.InsertEntry(ctx, nested))
+
+	found, err := f.FindEntry(ctx, dirPath)
+	require.NoError(t, err)
+	require.NotNil(t, found, "deleting it here would leave the nested key unreachable")
+
+	stillThere, err := store.FindEntry(ctx, nested.FullPath)
+	require.NoError(t, err)
+	require.NotNil(t, stillThere)
+}
+
+// TestExpiredFileIsDeletedOnRead pins the native cache-TTL path: regular
+// entries become invisible and their metadata row is removed without a
+// cache-specific transaction or reverse Volume index.
+func TestExpiredFileIsDeletedOnRead(t *testing.T) {
+	f, store := newTestFilerWithStubStore()
+	ctx := context.Background()
+
+	filePath := util.FullPath("/buckets/lmcache/expired")
+	expired := time.Now().Add(-2 * time.Hour)
+	require.NoError(t, store.InsertEntry(ctx, &Entry{
+		FullPath: filePath,
+		Attr: Attr{
+			Mode:   0o644,
+			Crtime: expired,
+			Mtime:  expired,
+			TtlSec: 60,
+		},
+		Chunks: []*filer_pb.FileChunk{{FileId: "7,01", Size: 4}},
+	}))
+
+	found, err := f.FindEntry(ctx, filePath)
+	require.ErrorIs(t, err, filer_pb.ErrNotFound)
+	require.Nil(t, found)
+
+	_, err = store.FindEntry(ctx, filePath)
+	require.ErrorIs(t, err, filer_pb.ErrNotFound,
+		"native TTL lookup should remove the expired metadata row")
+}
+
+func TestListDirectoryEntriesContextCanceled(t *testing.T) {
+	f, store := newTestFilerWithStubStore()
+	ctx := context.Background()
+
+	require.NoError(t, store.InsertEntry(ctx, &Entry{
+		FullPath: util.FullPath("/dir/file1.txt"),
+		Attr:     Attr{Mode: 0o644},
+	}))
+
+	canceledCtx, cancel := context.WithCancel(ctx)
+	cancel()
+
+	_, _, err := f.doListDirectoryEntries(canceledCtx, util.FullPath("/dir"), "", false, 10, "", func(entry *Entry) (bool, error) {
+		return true, nil
+	})
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "context canceled")
+}
+
diff --git a/weed/filer/filer_remote_evict.go b/weed/filer/filer_remote_evict.go
new file mode 100644
index 0000000000..e29548bfb3
--- /dev/null
+++ b/weed/filer/filer_remote_evict.go
@@ -0,0 +1,89 @@
+package filer
+
+import (
+	"context"
+	"sort"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func chunksEqual(a, b []*filer_pb.FileChunk) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i].GetFileIdString() != b[i].GetFileIdString() ||
+			a[i].Size != b[i].Size ||
+			a[i].Offset != b[i].Offset ||
+			a[i].ModifiedTsNs != b[i].ModifiedTsNs {
+			return false
+		}
+	}
+	return true
+}
+
+// IsEvictableRemoteEntry reports whether an entry's local chunks are backed by
+// a synchronized remote copy, mirroring the checks remote.uncache applies:
+// remote-backed, chunks present, and not ahead of the remote version.
+func IsEvictableRemoteEntry(entry *Entry) bool {
+	if entry.IsDirectory() || entry.Remote == nil {
+		return false
+	}
+	if entry.Remote.LastLocalSyncTsNs <= 0 || len(entry.GetChunks()) == 0 {
+		return false
+	}
+	if entry.Remote.LastLocalSyncTsNs < entry.Mtime.UnixNano() {
+		return false
+	}
+	return true
+}
+
+// ListEvictableRemoteEntries walks every mounted directory and returns
+// synchronized remote entries holding local chunks, oldest cached first.
+func (f *Filer) ListEvictableRemoteEntries(ctx context.Context, mounts []util.FullPath, minCacheAge time.Duration) (out []*Entry) {
+	cutoffNs := time.Now().UnixNano() - minCacheAge.Nanoseconds()
+	for _, dir := range mounts {
+		if err := f.collectEvictableRemoteEntries(ctx, dir, cutoffNs, &out); err != nil {
+			glog.WarningfCtx(ctx, "list evictable remote entries under %s: %v", dir, err)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool {
+		return out[i].Remote.LastLocalSyncTsNs < out[j].Remote.LastLocalSyncTsNs
+	})
+	return out
+}
+
+func (f *Filer) collectEvictableRemoteEntries(ctx context.Context, dir util.FullPath, cutoffNs int64, out *[]*Entry) error {
+	startFileName := ""
+	for {
+		var subDirs []util.FullPath
+		lastFileName, err := f.Store.ListDirectoryEntries(ctx, dir, startFileName, false, 1024, func(entry *Entry) (bool, error) {
+			if err := ctx.Err(); err != nil {
+				return false, err
+			}
+			if entry.IsDirectory() {
+				subDirs = append(subDirs, entry.FullPath)
+				return true, nil
+			}
+			if entry.Remote != nil && entry.Remote.LastLocalSyncTsNs > 0 && entry.Remote.LastLocalSyncTsNs <= cutoffNs && IsEvictableRemoteEntry(entry) {
+				*out = append(*out, entry)
+			}
+			return true, nil
+		})
+		if err != nil {
+			return err
+		}
+		for _, subDir := range subDirs {
+			if err := f.collectEvictableRemoteEntries(ctx, subDir, cutoffNs, out); err != nil {
+				return err
+			}
+		}
+		if lastFileName == "" {
+			return nil
+		}
+		startFileName = lastFileName
+	}
+}
diff --git a/weed/filer/filer_remote_evict_test.go b/weed/filer/filer_remote_evict_test.go
new file mode 100644
index 0000000000..a1c8717ccf
--- /dev/null
+++ b/weed/filer/filer_remote_evict_test.go
@@ -0,0 +1,164 @@
+package filer
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func remoteCachedEntry(path string, syncTsNs int64, mtime time.Time, chunks int) *Entry {
+	entry := &Entry{
+		FullPath: util.FullPath(path),
+		Attr: Attr{
+			Mtime:    mtime,
+			Crtime:   mtime,
+			Mode:     0644,
+			Uid:      1,
+			Gid:      1,
+			Mime:     "application/octet-stream",
+			Md5:      nil,
+			FileSize: 0,
+		},
+		Remote: &filer_pb.RemoteEntry{
+			RemoteMtime:       mtime.Unix(),
+			LastLocalSyncTsNs: syncTsNs,
+			RemoteETag:        "etag",
+			RemoteSize:        100,
+		},
+	}
+	for i := 0; i < chunks; i++ {
+		entry.Chunks = append(entry.Chunks, &filer_pb.FileChunk{FileId: "1,01637037d6", Size: 100})
+	}
+	return entry
+}
+
+func TestIsEvictableRemoteEntry(t *testing.T) {
+	now := time.Now()
+	synced := now.Add(-time.Hour).UnixNano()
+	mtime := now.Add(-time.Hour)
+
+	tests := []struct {
+		name     string
+		entry    *Entry
+		expected bool
+	}{
+		{"directory", &Entry{FullPath: "/d", Attr: Attr{Mode: os.ModeDir | 0755}}, false},
+		{"local only, no remote", &Entry{FullPath: "/f", Attr: Attr{Mtime: mtime, Mode: 0644}}, false},
+		{"remote only, never cached", remoteCachedEntry("/f", 0, mtime, 0), false},
+		{"remote, chunks cleared", remoteCachedEntry("/f", synced, mtime, 0), false},
+		{"dirty, newer than remote", remoteCachedEntry("/f", synced, now, 1), false},
+		{"same-second write after sync", remoteCachedEntry("/f",
+			now.Truncate(time.Second).Add(100*time.Millisecond).UnixNano(),
+			now.Truncate(time.Second).Add(900*time.Millisecond), 1), false},
+		{"same-second sync after write", remoteCachedEntry("/f",
+			now.Truncate(time.Second).Add(900*time.Millisecond).UnixNano(),
+			now.Truncate(time.Second).Add(100*time.Millisecond), 1), true},
+		{"synced and cached", remoteCachedEntry("/f", synced, mtime, 1), true},
+	}
+	for _, tt := range tests {
+		assert.Equal(t, tt.expected, IsEvictableRemoteEntry(tt.entry), tt.name)
+	}
+}
+
+func TestListEvictableRemoteEntries(t *testing.T) {
+	now := time.Now()
+	mtime := now.Add(-2 * time.Hour)
+	oldSync := now.Add(-time.Hour).UnixNano()
+	newSync := now.Add(-time.Second).UnixNano()
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, NewFilerRemoteStorage())
+	mounts := []util.FullPath{"/buckets/mybucket"}
+
+	seed := func(e *Entry) {
+		require.NoError(t, f.CreateEntry(context.Background(), e, nil, false, false, nil, false, 255))
+	}
+	seed(remoteCachedEntry("/buckets/mybucket/old.bin", oldSync, mtime, 1))
+	seed(remoteCachedEntry("/buckets/mybucket/fresh.bin", newSync, mtime, 1))
+	seed(remoteCachedEntry("/buckets/mybucket/remoteonly.bin", 0, mtime, 0))
+	seed(remoteCachedEntry("/buckets/mybucket/dirty.bin", oldSync, now, 1))
+	seed(&Entry{FullPath: "/buckets/mybucket/plain.bin", Attr: Attr{Mtime: mtime, Mode: 0644}})
+
+	store.entries["/buckets/mybucket/sub"] = &Entry{
+		FullPath: "/buckets/mybucket/sub",
+		Attr:     Attr{Mode: os.ModeDir | 0755, Mtime: mtime},
+	}
+	seed(remoteCachedEntry("/buckets/mybucket/sub/nested.bin", oldSync-1000, mtime, 1))
+
+	got := f.ListEvictableRemoteEntries(context.Background(), mounts, 0)
+	var paths []string
+	for _, e := range got {
+		paths = append(paths, string(e.FullPath))
+	}
+	assert.Equal(t, []string{
+		"/buckets/mybucket/sub/nested.bin",
+		"/buckets/mybucket/old.bin",
+		"/buckets/mybucket/fresh.bin",
+	}, paths, "oldest LastLocalSyncTsNs first; remote-only, dirty, local entries skipped")
+
+	got = f.ListEvictableRemoteEntries(context.Background(), mounts, 30*time.Second)
+	paths = paths[:0]
+	for _, e := range got {
+		paths = append(paths, string(e.FullPath))
+	}
+	assert.Equal(t, []string{
+		"/buckets/mybucket/sub/nested.bin",
+		"/buckets/mybucket/old.bin",
+	}, paths, "minCacheAge excludes freshly cached entries")
+}
+
+func TestUpdateEntryInvalidatesStaleSyncStamp(t *testing.T) {
+	now := time.Now()
+	synced := now.Add(-time.Hour).UnixNano()
+	mtime := now.Add(-time.Hour)
+	path := "/buckets/mybucket/a.bin"
+
+	newFiler := func() *Filer {
+		f := newTestFiler(t, newStubFilerStore(), NewFilerRemoteStorage())
+		require.NoError(t, f.CreateEntry(context.Background(), remoteCachedEntry(path, synced, mtime, 1), nil, false, false, nil, false, 255))
+		return f
+	}
+	syncStamp := func(f *Filer) int64 {
+		entry, err := f.FindEntry(context.Background(), util.FullPath(path))
+		require.NoError(t, err)
+		return entry.Remote.LastLocalSyncTsNs
+	}
+
+	t.Run("local chunk change clears stamp", func(t *testing.T) {
+		f := newFiler()
+		update := remoteCachedEntry(path, synced, mtime, 1)
+		update.Chunks[0].FileId = "2,01637037d6"
+		require.NoError(t, f.CreateEntry(context.Background(), update, nil, false, false, nil, false, 255))
+		assert.Zero(t, syncStamp(f))
+	})
+
+	t.Run("metadata-only update keeps stamp", func(t *testing.T) {
+		f := newFiler()
+		update := remoteCachedEntry(path, synced, mtime, 1)
+		update.Attr.Mime = "text/plain"
+		require.NoError(t, f.CreateEntry(context.Background(), update, nil, false, false, nil, false, 255))
+		assert.Equal(t, synced, syncStamp(f))
+	})
+
+	t.Run("fresh sync stamp survives chunk change", func(t *testing.T) {
+		f := newFiler()
+		update := remoteCachedEntry(path, now.UnixNano(), mtime, 1)
+		update.Chunks[0].FileId = "2,01637037d6"
+		require.NoError(t, f.CreateEntry(context.Background(), update, nil, false, false, nil, false, 255))
+		assert.Equal(t, now.UnixNano(), syncStamp(f))
+	})
+
+	t.Run("replicated update keeps authoritative stamp", func(t *testing.T) {
+		f := newFiler()
+		update := remoteCachedEntry(path, synced, mtime, 1)
+		update.Chunks[0].FileId = "2,01637037d6"
+		require.NoError(t, f.CreateEntry(context.Background(), update, nil, false, true, nil, false, 255))
+		assert.Equal(t, synced, syncStamp(f))
+	})
+}
diff --git a/weed/filer/filer_remote_tombstone.go b/weed/filer/filer_remote_tombstone.go
new file mode 100644
index 0000000000..2f4c7764d8
--- /dev/null
+++ b/weed/filer/filer_remote_tombstone.go
@@ -0,0 +1,423 @@
+package filer
+
+import (
+	"context"
+	"math"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
+	"google.golang.org/protobuf/proto"
+)
+
+const (
+	// remoteDeletionTombstoneTTL bounds a tombstone when no write-back sync
+	// offset ever confirms the remote delete. A remote object re-created
+	// outside the filer at a deleted path stays hidden for this long.
+	remoteDeletionTombstoneTTL = 24 * time.Hour
+	// remoteDeletionTombstoneLimit bounds tracked paths; past it new
+	// tombstones are dropped after an expired sweep still leaves no room.
+	remoteDeletionTombstoneLimit = 1 << 16
+)
+
+// remoteDeletionTombstones tracks paths deleted under a remote mount whose
+// remote object may still exist because the write-back daemon has not
+// consumed the delete event yet. A lazy remote fetch or listing must not
+// resurrect them. A tombstone lifts when the path is written again, when the
+// mount's persisted sync offset passes the delete event, or on TTL.
+//
+// Tombstones recorded before their metadata event lands (the synchronous
+// delete path) are marked pending: the sync offset orders against event
+// timestamps, which only the event itself knows, so a pending tombstone can
+// only be lifted by the event confirming it or by TTL. Once the event stamps
+// the real timestamp the tombstone is releasable by the offset.
+type remoteDeletionTombstones struct {
+	mu      sync.Mutex
+	files   map[string]int64 // file path -> delete event TsNs
+	dirs    map[string]int64 // deleted directory path -> event TsNs; covers its subtree
+	pending map[string]bool  // tombstone path recorded ahead of its event
+}
+
+func newRemoteDeletionTombstones() *remoteDeletionTombstones {
+	return &remoteDeletionTombstones{
+		files:   make(map[string]int64),
+		dirs:    make(map[string]int64),
+		pending: make(map[string]bool),
+	}
+}
+
+// add records a tombstone ahead of its metadata event — the timestamp is the
+// local delete time, a lower bound the sync offset cannot order against.
+func (t *remoteDeletionTombstones) add(path string, isDir bool, tsNs int64) {
+	t.upsert(path, isDir, tsNs, false)
+}
+
+// addFromEvent records a tombstone stamped by the delete event itself, so the
+// mount's sync offset can release it once the daemon passes that event.
+func (t *remoteDeletionTombstones) addFromEvent(path string, isDir bool, tsNs int64) {
+	t.upsert(path, isDir, tsNs, true)
+}
+
+func (t *remoteDeletionTombstones) upsert(path string, isDir bool, tsNs int64, fromEvent bool) {
+	if t == nil {
+		return
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	// An ancestor directory tombstone at least as new already covers the
+	// path; recording it again only spends capacity.
+	for p := path; ; {
+		i := strings.LastIndexByte(p, '/')
+		if i <= 0 {
+			break
+		}
+		p = p[:i]
+		if ancestorTs, ok := t.dirs[p]; ok && ancestorTs >= tsNs {
+			return
+		}
+	}
+	m := t.files
+	if isDir {
+		m = t.dirs
+	}
+	if cur, ok := m[path]; ok {
+		if tsNs > cur {
+			m[path] = tsNs
+			if !fromEvent {
+				// a newer local delete restamps the tombstone ahead of its
+				// event — the offset cannot vouch for it until the event lands
+				t.pending[path] = true
+			}
+		}
+		if fromEvent && m[path] == tsNs {
+			delete(t.pending, path)
+		}
+		return
+	}
+	if len(t.files)+len(t.dirs) >= remoteDeletionTombstoneLimit {
+		t.evictExpiredLocked(time.Now().UnixNano())
+		if len(t.files)+len(t.dirs) >= remoteDeletionTombstoneLimit {
+			glog.V(0).Infof("remote deletion tombstones full (%d), skipping %s", remoteDeletionTombstoneLimit, path)
+			return
+		}
+	}
+	m[path] = tsNs
+	if fromEvent {
+		delete(t.pending, path)
+	} else {
+		t.pending[path] = true
+	}
+	if isDir {
+		t.dropCoveredLocked(path, tsNs)
+	}
+}
+
+// dropCoveredLocked removes descendant tombstones a new directory tombstone
+// subsumes: their deletes predate it, so the ancestor already hides those
+// remote objects. Descendants deleted later keep their own tombstone.
+// Caller must hold t.mu.
+func (t *remoteDeletionTombstones) dropCoveredLocked(dirPath string, tsNs int64) {
+	prefix := dirPath + "/"
+	for p, ts := range t.files {
+		if ts <= tsNs && strings.HasPrefix(p, prefix) {
+			delete(t.files, p)
+			delete(t.pending, p)
+		}
+	}
+	for p, ts := range t.dirs {
+		if ts <= tsNs && strings.HasPrefix(p, prefix) {
+			delete(t.dirs, p)
+			delete(t.pending, p)
+		}
+	}
+}
+
+// drop removes the exact tombstone recorded for path, e.g. when the delete
+// that recorded it fails before touching anything.
+func (t *remoteDeletionTombstones) drop(path string, tsNs int64) {
+	if t == nil {
+		return
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if cur, ok := t.dirs[path]; ok && cur <= tsNs {
+		delete(t.dirs, path)
+		delete(t.pending, path)
+	}
+	if cur, ok := t.files[path]; ok && cur <= tsNs {
+		delete(t.files, path)
+		delete(t.pending, path)
+	}
+}
+
+// clear drops a file tombstone when a write at the path is at least as new as
+// the delete; a replayed older create must not lift a newer delete.
+func (t *remoteDeletionTombstones) clear(path string, tsNs int64) {
+	if t == nil {
+		return
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if cur, ok := t.files[path]; ok && tsNs >= cur {
+		delete(t.files, path)
+		delete(t.pending, path)
+	}
+}
+
+// blockedSince returns the newest delete timestamp governing path — its own
+// file tombstone or one from a deleted ancestor directory — and whether that
+// tombstone is still waiting for its event. 0 means clear.
+func (t *remoteDeletionTombstones) blockedSince(path string) (tsNs int64, pending bool) {
+	if t == nil {
+		return 0, false
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if ts, ok := t.files[path]; ok {
+		tsNs = ts
+		pending = t.pending[path]
+	}
+	for p := path; ; {
+		if ts, ok := t.dirs[p]; ok && ts > tsNs {
+			tsNs = ts
+			pending = t.pending[p]
+		}
+		i := strings.LastIndexByte(p, '/')
+		if i <= 0 {
+			break
+		}
+		p = p[:i]
+	}
+	return tsNs, pending
+}
+
+// releaseThrough drops the tombstones governing path that are no newer than
+// tsNs, once their remote deletes are confirmed consumed.
+func (t *remoteDeletionTombstones) releaseThrough(path string, tsNs int64) {
+	if t == nil {
+		return
+	}
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if cur, ok := t.files[path]; ok && cur <= tsNs {
+		delete(t.files, path)
+		delete(t.pending, path)
+	}
+	for p := path; ; {
+		if cur, ok := t.dirs[p]; ok && cur <= tsNs {
+			delete(t.dirs, p)
+			delete(t.pending, p)
+		}
+		i := strings.LastIndexByte(p, '/')
+		if i <= 0 {
+			break
+		}
+		p = p[:i]
+	}
+}
+
+func (t *remoteDeletionTombstones) evictExpiredLocked(nowNs int64) {
+	for p, ts := range t.files {
+		if nowNs-ts >= int64(remoteDeletionTombstoneTTL) {
+			delete(t.files, p)
+			delete(t.pending, p)
+		}
+	}
+	for p, ts := range t.dirs {
+		if nowNs-ts >= int64(remoteDeletionTombstoneTTL) {
+			delete(t.dirs, p)
+			delete(t.pending, p)
+		}
+	}
+}
+
+// noteRemoteDeletion records a delete of path under a remote mount so lazy
+// remote reads skip it until the remote delete is confirmed.
+func (f *Filer) noteRemoteDeletion(p util.FullPath, isDir bool, tsNs int64) {
+	if f.RemoteStorage == nil || f.remoteTombstones == nil {
+		return
+	}
+	if _, remoteLoc := f.RemoteStorage.FindMountDirectory(p); remoteLoc == nil {
+		return
+	}
+	f.remoteTombstones.add(string(p), isDir, tsNs)
+}
+
+// unnoteRemoteDeletion retracts a tombstone when the delete that recorded it
+// fails before touching anything under path.
+func (f *Filer) unnoteRemoteDeletion(p util.FullPath, tsNs int64) {
+	if f.remoteTombstones == nil {
+		return
+	}
+	f.remoteTombstones.drop(string(p), tsNs)
+}
+
+// isRemoteDeletionPending reports whether a remote write-back delete for p is
+// still owed: p was deleted under mountDir and neither a rewrite, the mount's
+// sync offset, nor the TTL has lifted the tombstone.
+func (f *Filer) isRemoteDeletionPending(ctx context.Context, p util.FullPath, mountDir util.FullPath) bool {
+	if f.remoteTombstones == nil {
+		return false
+	}
+	tsNs, pending := f.remoteTombstones.blockedSince(string(p))
+	if tsNs == 0 {
+		return false
+	}
+	if pending {
+		// Recorded ahead of its delete event — the write-back offset cannot
+		// vouch for it yet; only the TTL lifts it.
+		if f.remoteDeletionExpired(tsNs) {
+			f.remoteTombstones.releaseThrough(string(p), tsNs)
+			return false
+		}
+		return true
+	}
+	if f.remoteDeletionConsumed(ctx, mountDir, tsNs) {
+		f.remoteTombstones.releaseThrough(string(p), tsNs)
+		return false
+	}
+	return true
+}
+
+func (f *Filer) remoteDeletionExpired(tsNs int64) bool {
+	return time.Now().UnixNano()-tsNs >= int64(remoteDeletionTombstoneTTL)
+}
+
+func (f *Filer) remoteDeletionConsumed(ctx context.Context, mountDir util.FullPath, tsNs int64) bool {
+	if f.remoteDeletionExpired(tsNs) {
+		return true
+	}
+	offset, err := f.readRemoteSyncOffset(ctx, mountDir)
+	return err == nil && offset >= tsNs
+}
+
+// readRemoteSyncOffset reads the write-back daemon's persisted watermark for
+// mountDir straight from the local store: every event at or below it has been
+// applied to the remote.
+func (f *Filer) readRemoteSyncOffset(ctx context.Context, mountDir util.FullPath) (int64, error) {
+	value, err := f.Store.KvGet(ctx, remote_storage.SyncOffsetKey(string(mountDir)))
+	if err != nil {
+		return 0, err
+	}
+	if len(value) < 8 {
+		return 0, nil
+	}
+	return int64(util.BytesToUint64(value)), nil
+}
+
+// RebuildRemoteDeletionTombstones gates lazy remote reads and replays the
+// persisted metadata log from the oldest write-back offset across mounts,
+// restoring tombstones for deletes committed before a restart but not yet
+// applied to the remote. Every filer writes its log files under the same
+// directory, so pending peer deletes replay too; only events still inside
+// the unflushed buffer tail are missed. The gate is set synchronously so no
+// lazy read can slip in before replay starts, and it stays closed until a
+// replay succeeds.
+func (f *Filer) RebuildRemoteDeletionTombstones(ctx context.Context) {
+	if f.RemoteStorage == nil || f.remoteTombstones == nil {
+		return
+	}
+	mounts := f.RemoteStorage.MountedDirectories()
+	if len(mounts) == 0 {
+		return
+	}
+	done := make(chan struct{})
+	f.remoteTombstonesDone.Store(&done)
+	go f.rebuildRemoteDeletionTombstones(ctx, mounts, done)
+}
+
+func (f *Filer) rebuildRemoteDeletionTombstones(ctx context.Context, mounts []util.FullPath, done chan struct{}) {
+	// the replay itself lists directories; do not let it wait on its own gate
+	ctx = context.WithValue(ctx, lazyFetchContextKey{}, true)
+	startTsNs := f.remoteDeletionRebuildStartTsNs(ctx, mounts)
+	openGate := func() {
+		close(done)
+		f.remoteTombstonesDone.Store(nil)
+	}
+	// Deletes made after startup are recorded through the live delete and
+	// event paths, so replay can only be missing deletes committed before
+	// the restart — and those have all crossed the tombstone TTL once this
+	// deadline passes. Holding the gate longer protects nothing.
+	replayDeadline := time.Now().Add(remoteDeletionTombstoneTTL)
+	backoff := 2 * time.Second
+	for {
+		_, _, err := f.ReadPersistedLogBuffer(ctx, log_buffer.NewMessagePosition(startTsNs, 0), 0,
+			func(logEntry *filer_pb.LogEntry) (bool, error) {
+				event := &filer_pb.SubscribeMetadataResponse{}
+				if err := proto.Unmarshal(logEntry.Data, event); err != nil {
+					return false, nil
+				}
+				f.onRemoteDeletionEvents(event)
+				return false, nil
+			})
+		if err == nil {
+			openGate()
+			return
+		}
+		glog.WarningfCtx(ctx, "rebuild remote deletion tombstones: %v", err)
+		if !time.Now().Before(replayDeadline) {
+			glog.ErrorfCtx(ctx, "rebuild remote deletion tombstones: giving up after %v", remoteDeletionTombstoneTTL)
+			openGate()
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(backoff):
+		}
+		if backoff < time.Minute {
+			backoff *= 2
+		}
+	}
+}
+
+// remoteDeletionRebuildStartTsNs returns the oldest write-back offset across
+// mounts — the earliest event the daemon may not have applied. Mounts without
+// a recorded offset replay from the TTL floor: events older than it would
+// build tombstones that are already expired.
+func (f *Filer) remoteDeletionRebuildStartTsNs(ctx context.Context, mounts []util.FullPath) int64 {
+	startTsNs := int64(math.MaxInt64)
+	for _, dir := range mounts {
+		offset, err := f.readRemoteSyncOffset(ctx, dir)
+		if err != nil {
+			glog.WarningfCtx(ctx, "read remote sync offset for %s: %v", dir, err)
+			offset = 0
+		}
+		if offset < startTsNs {
+			startTsNs = offset
+		}
+	}
+	ttlFloor := time.Now().Add(-remoteDeletionTombstoneTTL).UnixNano()
+	if startTsNs == int64(math.MaxInt64) || startTsNs < ttlFloor {
+		return ttlFloor
+	}
+	return startTsNs
+}
+
+// onRemoteDeletionEvents folds peer and local metadata events into the
+// tombstone set: a delete or rename source is tombstoned at the event
+// timestamp, a create/update/rename target lifts a file tombstone.
+func (f *Filer) onRemoteDeletionEvents(event *filer_pb.SubscribeMetadataResponse) {
+	message := event.EventNotification
+	if message == nil {
+		return
+	}
+	if message.OldEntry != nil && !IsMetadataOnlyDelete(message.OldEntry) {
+		sourcePath := filer_pb.MetadataEventSourceFullPath(event)
+		if message.NewEntry == nil || sourcePath != filer_pb.MetadataEventTargetFullPath(event) {
+			if f.RemoteStorage != nil && f.remoteTombstones != nil {
+				if _, remoteLoc := f.RemoteStorage.FindMountDirectory(util.FullPath(sourcePath)); remoteLoc != nil {
+					f.remoteTombstones.addFromEvent(sourcePath, message.OldEntry.IsDirectory, event.TsNs)
+				}
+			}
+		}
+	}
+	if message.NewEntry != nil {
+		f.remoteTombstones.clear(filer_pb.MetadataEventTargetFullPath(event), event.TsNs)
+	}
+}
diff --git a/weed/filer/filer_remote_tombstone_test.go b/weed/filer/filer_remote_tombstone_test.go
new file mode 100644
index 0000000000..6048ae9575
--- /dev/null
+++ b/weed/filer/filer_remote_tombstone_test.go
@@ -0,0 +1,468 @@
+package filer
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newMountedTestFiler(t *testing.T, storageType string, stub remote_storage.RemoteStorageClient, listingTtlSeconds int32) (*Filer, *stubFilerStore) {
+	t.Helper()
+	if stub != nil {
+		t.Cleanup(registerStubMaker(t, storageType, stub))
+	}
+	conf := &remote_pb.RemoteConf{Name: "tombstonestore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:                   "tombstonestore",
+		Bucket:                 "mybucket",
+		Path:                   "/",
+		ListingCacheTtlSeconds: listingTtlSeconds,
+	})
+	store := newStubFilerStore()
+	return newTestFiler(t, store, rs), store
+}
+
+func putRemoteSyncOffset(t *testing.T, store *stubFilerStore, dir string, offsetTsNs int64) {
+	t.Helper()
+	buf := make([]byte, 8)
+	util.Uint64toBytes(buf, uint64(offsetTsNs))
+	require.NoError(t, store.KvPut(context.Background(), remote_storage.SyncOffsetKey(dir), buf))
+}
+
+func TestRemoteDeletionTombstones_BlocksAndReleases(t *testing.T) {
+	tombs := newRemoteDeletionTombstones()
+
+	tombs.addFromEvent("/m/a.txt", false, 100)
+	ts, _ := tombs.blockedSince("/m/a.txt")
+	assert.Equal(t, int64(100), ts)
+	ts, _ = tombs.blockedSince("/m/b.txt")
+	assert.Zero(t, ts)
+
+	// a delete of a directory blocks its whole subtree
+	tombs.addFromEvent("/m/dir", true, 200)
+	ts, _ = tombs.blockedSince("/m/dir")
+	assert.Equal(t, int64(200), ts)
+	ts, _ = tombs.blockedSince("/m/dir/deep/x.txt")
+	assert.Equal(t, int64(200), ts)
+	ts, _ = tombs.blockedSince("/m/dirx/y.txt")
+	assert.Zero(t, ts)
+
+	// a rewrite at or after the delete lifts only that file's tombstone
+	tombs.clear("/m/a.txt", 100)
+	ts, _ = tombs.blockedSince("/m/a.txt")
+	assert.Zero(t, ts)
+	tombs.addFromEvent("/m/a.txt", false, 300)
+	tombs.clear("/m/a.txt", 250)
+	ts, _ = tombs.blockedSince("/m/a.txt")
+	assert.Equal(t, int64(300), ts, "older create must not lift newer delete")
+
+	tombs.releaseThrough("/m/dir/deep/x.txt", 200)
+	ts, _ = tombs.blockedSince("/m/dir/deep/x.txt")
+	assert.Zero(t, ts)
+	ts, _ = tombs.blockedSince("/m/dir")
+	assert.Zero(t, ts)
+}
+
+func TestRemoteDeletionTombstones_AncestorSubsumesAndCovers(t *testing.T) {
+	tombs := newRemoteDeletionTombstones()
+
+	// a child tombstone recorded before its ancestor is dropped once the
+	// ancestor's newer delete covers the whole subtree
+	tombs.addFromEvent("/m/dir/a.txt", false, 100)
+	tombs.addFromEvent("/m/dir", true, 200)
+	ts, _ := tombs.blockedSince("/m/dir")
+	assert.Equal(t, int64(200), ts)
+	ts, _ = tombs.blockedSince("/m/dir/a.txt")
+	assert.Equal(t, int64(200), ts)
+	_, exists := tombs.files["/m/dir/a.txt"]
+	assert.False(t, exists, "descendant tombstone is subsumed by the ancestor")
+
+	// adds under the covered subtree are skipped while the ancestor stands
+	tombs.addFromEvent("/m/dir/b.txt", false, 150)
+	_, exists = tombs.files["/m/dir/b.txt"]
+	assert.False(t, exists)
+	// ...but a child deleted after the ancestor still records its own tombstone
+	tombs.addFromEvent("/m/dir/c.txt", false, 300)
+	ts, _ = tombs.blockedSince("/m/dir/c.txt")
+	assert.Equal(t, int64(300), ts)
+}
+
+func TestRemoteDeletionTombstones_PendingIgnoresOffset(t *testing.T) {
+	f, store := newMountedTestFiler(t, "stub_tomb_pending_offset", nil, 0)
+
+	// recorded before its event lands: a later event may already have moved
+	// the mount's watermark past the local timestamp, so the offset cannot
+	// vouch for this delete yet
+	filePath := "/buckets/mybucket/dir/a.txt"
+	now := time.Now().UnixNano()
+	f.noteRemoteDeletion(util.FullPath(filePath), false, now)
+	putRemoteSyncOffset(t, store, "/buckets/mybucket", now+100)
+	assert.True(t, f.isRemoteDeletionPending(context.Background(), util.FullPath(filePath), "/buckets/mybucket"))
+
+	// once the delete event stamps the real timestamp, the watermark releases it
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket/dir",
+		TsNs:      now + 50,
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "a.txt"},
+		},
+	})
+	assert.False(t, f.isRemoteDeletionPending(context.Background(), util.FullPath(filePath), "/buckets/mybucket"))
+}
+
+func TestRemoteDeletionTombstones_RaisedLocalTombstoneIsPendingAgain(t *testing.T) {
+	tombs := newRemoteDeletionTombstones()
+
+	tombs.addFromEvent("/m/a.txt", false, 100)
+	_, pending := tombs.blockedSince("/m/a.txt")
+	assert.False(t, pending)
+
+	// a newer local delete restamps the tombstone before its own event
+	// lands, so the write-back offset cannot vouch for it yet
+	tombs.add("/m/a.txt", false, 200)
+	_, pending = tombs.blockedSince("/m/a.txt")
+	assert.True(t, pending)
+
+	// once that delete's event confirms the new timestamp it releases normally
+	tombs.addFromEvent("/m/a.txt", false, 200)
+	_, pending = tombs.blockedSince("/m/a.txt")
+	assert.False(t, pending)
+}
+
+func TestMaybeLazyFetchFromRemote_SkipsTombstonedPath(t *testing.T) {
+	const storageType = "stub_tomb_fetch"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 11},
+		},
+	}
+	f, _ := newMountedTestFiler(t, storageType, stub, 0)
+
+	// a delete under the mount tombstones the path; the remote object is
+	// still there until the write-back daemon consumes the delete event
+	filePath := util.FullPath("/buckets/mybucket/dir/a.txt")
+	f.noteRemoteDeletion(filePath, false, time.Now().UnixNano())
+
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), filePath)
+	require.NoError(t, err)
+	assert.Nil(t, entry)
+	assert.Equal(t, 0, stub.statCalls, "the remote object must not even be consulted")
+}
+
+func TestMaybeLazyFetchFromRemote_NewerRemoteMtimeStillBlocked(t *testing.T) {
+	const storageType = "stub_tomb_regen"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: time.Now().Unix() + 60, RemoteSize: 11},
+		},
+	}
+	f, _ := newMountedTestFiler(t, storageType, stub, 0)
+
+	// a remote object whose mtime postdates the delete is still hidden: the
+	// remote clock cannot distinguish a new generation from the pending
+	// delete's target
+	filePath := util.FullPath("/buckets/mybucket/dir/a.txt")
+	f.noteRemoteDeletion(filePath, false, time.Now().UnixNano())
+
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), filePath)
+	require.NoError(t, err)
+	assert.Nil(t, entry)
+	assert.Equal(t, 0, stub.statCalls)
+}
+
+func TestMaybeLazyFetchFromRemote_SyncOffsetReleasesTombstone(t *testing.T) {
+	const storageType = "stub_tomb_release"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 11},
+		},
+	}
+	f, store := newMountedTestFiler(t, storageType, stub, 0)
+	putDirEntry(store, "/buckets/mybucket/dir")
+
+	filePath := util.FullPath("/buckets/mybucket/dir/a.txt")
+	deleteTsNs := time.Now().UnixNano()
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket/dir",
+		TsNs:      deleteTsNs,
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "a.txt"},
+		},
+	})
+
+	// the daemon's persisted watermark is behind the delete: still blocked
+	putRemoteSyncOffset(t, store, "/buckets/mybucket", deleteTsNs-1)
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), filePath)
+	require.NoError(t, err)
+	assert.Nil(t, entry)
+	assert.Equal(t, 0, stub.statCalls)
+
+	// once the watermark reaches the delete event's own timestamp, the
+	// remote delete has landed and the lookup may consult the remote again
+	putRemoteSyncOffset(t, store, "/buckets/mybucket", deleteTsNs)
+	entry, err = f.maybeLazyFetchFromRemote(context.Background(), filePath)
+	require.NoError(t, err)
+	require.NotNil(t, entry)
+	assert.Equal(t, 1, stub.statCalls)
+}
+
+func TestDeleteEntryMetaAndData_TombstonesPath(t *testing.T) {
+	const storageType = "stub_tomb_delete"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 11},
+		},
+	}
+	f, store := newMountedTestFiler(t, storageType, stub, 0)
+	putDirEntry(store, "/buckets/mybucket/dir")
+
+	filePath := util.FullPath("/buckets/mybucket/dir/a.txt")
+	store.entries[string(filePath)] = &Entry{
+		FullPath: filePath,
+		Attr: Attr{
+			Mtime:    time.Unix(1700000000, 0),
+			Crtime:   time.Unix(1700000000, 0),
+			Mode:     0644,
+			FileSize: 11,
+		},
+	}
+
+	require.NoError(t, f.DeleteEntryMetaAndData(context.Background(), filePath, false, false, false, false, nil, 0))
+
+	// the deleted path must not resurrect through the lazy fetch even while
+	// the remote object is still present
+	entry, err := f.FindEntry(context.Background(), filePath)
+	assert.ErrorIs(t, err, filer_pb.ErrNotFound)
+	assert.Nil(t, entry)
+	assert.Equal(t, 0, stub.statCalls)
+
+	// a peer-observed create at the path lifts the tombstone
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket/dir",
+		TsNs:      time.Now().UnixNano(),
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "a.txt"},
+		},
+	})
+	entry, err = f.maybeLazyFetchFromRemote(context.Background(), filePath)
+	require.NoError(t, err)
+	require.NotNil(t, entry)
+	assert.Equal(t, 1, stub.statCalls)
+}
+
+func TestOnMetadataChangeEvent_MetadataOnlyDeleteSkipsTombstone(t *testing.T) {
+	const storageType = "stub_tomb_metadata_only"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 11},
+		},
+	}
+	f, store := newMountedTestFiler(t, storageType, stub, 0)
+	putDirEntry(store, "/buckets/mybucket/dir")
+
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		TsNs:      time.Now().UnixNano(),
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{
+				Name:        "dir",
+				IsDirectory: true,
+				Extended:    map[string][]byte{ExtKeepRemoteObjectKey: []byte("true")},
+			},
+		},
+	})
+
+	// nothing is owed to the remote, so objects under the folder stay readable
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/dir/a.txt")
+	require.NoError(t, err)
+	require.NotNil(t, entry)
+	assert.Equal(t, 1, stub.statCalls)
+}
+
+func TestOnMetadataChangeEvent_PeerDeleteTombstones(t *testing.T) {
+	const storageType = "stub_tomb_peer"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 11},
+		},
+	}
+	f, _ := newMountedTestFiler(t, storageType, stub, 0)
+
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket/dir",
+		TsNs:      time.Now().UnixNano(),
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "a.txt"},
+		},
+	})
+
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/dir/a.txt")
+	require.NoError(t, err)
+	assert.Nil(t, entry)
+	assert.Equal(t, 0, stub.statCalls)
+}
+
+func TestOnMetadataChangeEvent_PeerDirDeleteTombstonesSubtree(t *testing.T) {
+	const storageType = "stub_tomb_peer_dir"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 11},
+		},
+	}
+	f, _ := newMountedTestFiler(t, storageType, stub, 0)
+
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		TsNs:      time.Now().UnixNano(),
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "dir", IsDirectory: true},
+		},
+	})
+
+	entry, err := f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/dir/deep/a.txt")
+	require.NoError(t, err)
+	assert.Nil(t, entry)
+	assert.Equal(t, 0, stub.statCalls)
+}
+
+func TestMaybeLazyListFromRemote_SkipsTombstonedChild(t *testing.T) {
+	const storageType = "stub_tomb_list"
+	stub := &stubRemoteClient{
+		listDirFn: func(loc *remote_pb.RemoteStorageLocation, visitFn remote_storage.VisitFunc) error {
+			if err := visitFn("/", "deleted.txt", false, &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10}); err != nil {
+				return err
+			}
+			return visitFn("/", "fresh.txt", false, &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 20})
+		},
+	}
+	f, store := newMountedTestFiler(t, storageType, stub, 300)
+
+	f.noteRemoteDeletion("/buckets/mybucket/deleted.txt", false, time.Now().UnixNano())
+
+	f.maybeLazyListFromRemote(context.Background(), util.FullPath("/buckets/mybucket"))
+	assert.Equal(t, 1, stub.listDirCalls)
+
+	assert.Nil(t, store.getEntry("/buckets/mybucket/deleted.txt"), "deleted child must not resurrect through a listing")
+	require.NotNil(t, store.getEntry("/buckets/mybucket/fresh.txt"), "other remote objects still list")
+}
+
+func TestMaybeLazyListFromRemote_RecreatedDirStillHidesChildren(t *testing.T) {
+	const storageType = "stub_tomb_recreate"
+	deleteTs := time.Now().UnixNano()
+	stub := &stubRemoteClient{
+		listDirFn: func(loc *remote_pb.RemoteStorageLocation, visitFn remote_storage.VisitFunc) error {
+			if err := visitFn("/", "stale.txt", false, &filer_pb.RemoteEntry{RemoteMtime: deleteTs/int64(time.Second) - 10, RemoteSize: 10}); err != nil {
+				return err
+			}
+			return visitFn("/", "fresh.txt", false, &filer_pb.RemoteEntry{RemoteMtime: deleteTs/int64(time.Second) + 10, RemoteSize: 20})
+		},
+	}
+	f, store := newMountedTestFiler(t, storageType, stub, 300)
+
+	// the directory is deleted then recreated; its remote children stay
+	// hidden — old or new mtime alike — until the remote delete lands
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		TsNs:      deleteTs,
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "dir", IsDirectory: true},
+		},
+	})
+	f.onMetadataChangeEvent(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		TsNs:      deleteTs + 1,
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "dir", IsDirectory: true},
+		},
+	})
+
+	f.maybeLazyListFromRemote(context.Background(), util.FullPath("/buckets/mybucket/dir"))
+
+	assert.Nil(t, store.getEntry("/buckets/mybucket/dir/stale.txt"))
+	assert.Nil(t, store.getEntry("/buckets/mybucket/dir/fresh.txt"))
+
+	// after the write-back daemon confirms the remote delete, listing merges again
+	f.remoteTombstones.releaseThrough("/buckets/mybucket/dir/stale.txt", deleteTs)
+	delete(store.getEntry("/buckets/mybucket/dir").Extended, xattrRemoteListingSyncedAt)
+	f.maybeLazyListFromRemote(context.Background(), util.FullPath("/buckets/mybucket/dir"))
+	assert.NotNil(t, store.getEntry("/buckets/mybucket/dir/stale.txt"))
+	assert.NotNil(t, store.getEntry("/buckets/mybucket/dir/fresh.txt"))
+}
+
+func TestRemoteDeletionRebuildStartTsNs_UsesOldestMountOffset(t *testing.T) {
+	f, store := newMountedTestFiler(t, "stub_rebuild", nil, 0)
+	f.RemoteStorage.mapDirectoryToRemoteStorage("/buckets/other", &remote_pb.RemoteStorageLocation{
+		Name: "tombstonestore", Bucket: "other", Path: "/",
+	})
+	mounts := f.RemoteStorage.MountedDirectories()
+	require.Len(t, mounts, 2)
+
+	now := time.Now().UnixNano()
+	putRemoteSyncOffset(t, store, "/buckets/mybucket", now-200)
+	putRemoteSyncOffset(t, store, "/buckets/other", now-300)
+	assert.Equal(t, now-300, f.remoteDeletionRebuildStartTsNs(context.Background(), mounts),
+		"rebuild must replay from the least-synced mount")
+
+	// a mount whose offset was never written replays only within the TTL
+	require.NoError(t, store.KvDelete(context.Background(), remote_storage.SyncOffsetKey("/buckets/other")))
+	floor := f.remoteDeletionRebuildStartTsNs(context.Background(), mounts)
+	assert.GreaterOrEqual(t, floor, time.Now().Add(-remoteDeletionTombstoneTTL-time.Second).UnixNano())
+
+	// an offset older than the TTL floor is raised to it
+	putRemoteSyncOffset(t, store, "/buckets/other", time.Now().Add(-remoteDeletionTombstoneTTL-time.Hour).UnixNano())
+	assert.Greater(t, f.remoteDeletionRebuildStartTsNs(context.Background(), mounts),
+		time.Now().Add(-remoteDeletionTombstoneTTL-time.Hour).UnixNano())
+}
+
+func TestRebuildRemoteDeletionTombstones_EmptyLogReleasesGate(t *testing.T) {
+	f, _ := newMountedTestFiler(t, "stub_rebuild_empty", nil, 0)
+
+	f.RebuildRemoteDeletionTombstones(context.Background())
+	done := f.remoteTombstonesDone.Load()
+	require.NotNil(t, done, "the gate must be set synchronously")
+
+	select {
+	case <-*done:
+	case <-time.After(10 * time.Second):
+		t.Fatal("rebuild never released the gate")
+	}
+	assert.Nil(t, f.remoteTombstonesDone.Load())
+	ts, _ := f.remoteTombstones.blockedSince("/buckets/mybucket/a.txt")
+	assert.Zero(t, ts)
+}
+
+func TestMaybeLazyFetchFromRemote_WaitsForRebuild(t *testing.T) {
+	const storageType = "stub_tomb_pending"
+	stub := &countingRemoteClient{
+		stubRemoteClient: stubRemoteClient{
+			statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+		},
+	}
+	f, _ := newMountedTestFiler(t, storageType, stub, 0)
+
+	// an unfinished rebuild blocks the fetch until the context gives up
+	gate := make(chan struct{})
+	f.remoteTombstonesDone.Store(&gate)
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+	entry, err := f.maybeLazyFetchFromRemote(ctx, "/buckets/mybucket/a.txt")
+	assert.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Nil(t, entry)
+	assert.Equal(t, 0, stub.statCalls)
+
+	// once the rebuild finishes, the fetch proceeds
+	close(gate)
+	entry, err = f.maybeLazyFetchFromRemote(context.Background(), "/buckets/mybucket/a.txt")
+	require.NoError(t, err)
+	require.NotNil(t, entry)
+	assert.Equal(t, 1, stub.statCalls)
+}
diff --git a/weed/filer/filer_shutdown_test.go b/weed/filer/filer_shutdown_test.go
new file mode 100644
index 0000000000..8383086d00
--- /dev/null
+++ b/weed/filer/filer_shutdown_test.go
@@ -0,0 +1,107 @@
+package filer
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
+)
+
+type shutdownStore struct {
+	VirtualFilerStore
+	closed chan struct{}
+}
+
+func (s *shutdownStore) Shutdown() {
+	close(s.closed)
+}
+
+func TestShutdownKeepsStoreOpenUntilMetadataIsFlushed(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		store := &shutdownStore{closed: make(chan struct{})}
+		releaseFlush := make(chan struct{})
+		flushed := false
+		lb := log_buffer.NewLogBuffer("filer shutdown", time.Hour,
+			func(_ *log_buffer.LogBuffer, _, _ time.Time, _ []byte, _, _ int64) {
+				<-releaseFlush
+				select {
+				case <-store.closed:
+					t.Error("metadata store closed before the pending log write")
+				default:
+					flushed = true
+				}
+			}, nil, nil)
+		f := &Filer{Store: store, LocalMetaLogBuffer: lb, deletionQuit: make(chan struct{})}
+		if err := lb.AddDataToBuffer(nil, []byte("last metadata event"), 0); err != nil {
+			t.Fatal(err)
+		}
+
+		done := make(chan struct{})
+		go func() {
+			f.Shutdown()
+			close(done)
+		}()
+		synctest.Wait()
+		select {
+		case <-store.closed:
+			t.Error("metadata store closed while the log write was blocked")
+		default:
+		}
+
+		close(releaseFlush)
+		<-done
+		lb.WaitForShutdown()
+		if !flushed {
+			t.Error("shutdown returned without persisting the pending metadata")
+		}
+		select {
+		case <-store.closed:
+		default:
+			t.Error("metadata store was not closed after the log write finished")
+		}
+	})
+}
+
+func TestShutdownBoundsBlockedMetadataFlush(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		store := &shutdownStore{closed: make(chan struct{})}
+		f := &Filer{Store: store, deletionQuit: make(chan struct{})}
+		f.flushCtx, f.flushCancel = context.WithCancel(context.Background())
+
+		var flushStarted atomic.Bool
+		lb := log_buffer.NewLogBuffer("blocked flush", time.Hour,
+			func(lb *log_buffer.LogBuffer, _, _ time.Time, buf []byte, _, _ int64) {
+				flushStarted.Store(true)
+				// A dead cluster makes append retries hang here; the shutdown
+				// deadline cancels the shared flush context to unblock it.
+				<-f.flushCtx.Done()
+				lb.NoteFlushDropped(len(buf))
+			}, nil, nil)
+		f.LocalMetaLogBuffer = lb
+		if err := lb.AddDataToBuffer(nil, []byte("last metadata event"), 0); err != nil {
+			t.Fatal(err)
+		}
+
+		done := make(chan struct{})
+		go func() {
+			f.Shutdown()
+			close(done)
+		}()
+
+		<-done
+		if !flushStarted.Load() {
+			t.Error("shutdown finished without running the pending flush")
+		}
+		if ts := lb.GetLastFlushTsNs(); ts != 0 {
+			t.Errorf("dropped flush advanced the flushed watermark to %d", ts)
+		}
+		select {
+		case <-store.closed:
+		default:
+			t.Error("metadata store was not closed after the bounded wait")
+		}
+	})
+}
diff --git a/weed/filer/filerstore.go b/weed/filer/filerstore.go
index 9689436081..277903249a 100644
--- a/weed/filer/filerstore.go
+++ b/weed/filer/filerstore.go
@@ -44,6 +44,22 @@ type FilerStore interface {
 	Shutdown()
 }
 
+// ErrUnsupportedEntryScan is returned by EntryScanner.ScanEntries, before
+// any entry is visited, when the store cannot serve the scan.
+var ErrUnsupportedEntryScan = errors.New("entry scan not supported by this filer store")
+
+// EntryScanner is an optional FilerStore capability: visit every entry at and
+// below dirPath, in any order, from one consistent snapshot of the store.
+//
+// A directory walk sees each directory at a different time, so an entry
+// renamed from a directory not yet listed into one already listed is never
+// seen; volume.fsck then purges its chunks as orphans. A snapshot sees it
+// exactly once. The context handed to fn carries the snapshot, so store reads
+// made with it (hard-link records) see the same instant.
+type EntryScanner interface {
+	ScanEntries(ctx context.Context, dirPath util.FullPath, fn func(ctx context.Context, entry *Entry) error) error
+}
+
 type BucketAware interface {
 	OnBucketCreation(bucket string)
 	OnBucketDeletion(bucket string)
diff --git a/weed/filer/filerstore_wrapper.go b/weed/filer/filerstore_wrapper.go
index d742380ae5..1a17e22cf6 100644
--- a/weed/filer/filerstore_wrapper.go
+++ b/weed/filer/filerstore_wrapper.go
@@ -2,6 +2,7 @@ package filer
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -19,6 +20,7 @@ import (
 var (
 	_ = VirtualFilerStore(&FilerStoreWrapper{})
 	_ = Debuggable(&FilerStoreWrapper{})
+	_ = EntryScanner(&FilerStoreWrapper{})
 )
 
 type VirtualFilerStore interface {
@@ -141,6 +143,7 @@ func (fsw *FilerStoreWrapper) InsertEntry(ctx context.Context, entry *Entry) err
 
 	filer_pb.BeforeEntrySerialization(entry.GetChunks())
 	normalizeEntryMimeForStore(entry)
+	delete(entry.Extended, ExtKeepRemoteObjectKey)
 
 	if len(entry.HardLinkId) > 0 {
 		glog.V(4).InfofCtx(ctx, "InsertEntry %s has HardLinkId %x counter=%d",
@@ -170,6 +173,7 @@ func (fsw *FilerStoreWrapper) InsertEntryKnownAbsent(ctx context.Context, entry
 
 	filer_pb.BeforeEntrySerialization(entry.GetChunks())
 	normalizeEntryMimeForStore(entry)
+	delete(entry.Extended, ExtKeepRemoteObjectKey)
 
 	if len(entry.HardLinkId) > 0 {
 		glog.V(4).InfofCtx(ctx, "InsertEntryKnownAbsent %s has HardLinkId %x counter=%d",
@@ -196,6 +200,7 @@ func (fsw *FilerStoreWrapper) UpdateEntry(ctx context.Context, entry *Entry) err
 
 	filer_pb.BeforeEntrySerialization(entry.GetChunks())
 	normalizeEntryMimeForStore(entry)
+	delete(entry.Extended, ExtKeepRemoteObjectKey)
 
 	if len(entry.HardLinkId) > 0 {
 		glog.V(4).InfofCtx(ctx, "UpdateEntry %s has HardLinkId %x counter=%d",
@@ -361,6 +366,33 @@ func (fsw *FilerStoreWrapper) ListDirectoryPrefixedEntries(ctx context.Context,
 	return lastFileName, err
 }
 
+// ScanEntries delegates to the default store. With path-specific stores
+// configured, entries below dirPath could live in several stores and one
+// snapshot per store is not one snapshot, so the scan is declined. Hard links
+// are resolved inside the snapshot; a store error fails the scan (the per-path
+// copy can be stale), a missing record falls back to it as listings do.
+func (fsw *FilerStoreWrapper) ScanEntries(ctx context.Context, dirPath util.FullPath, fn func(ctx context.Context, entry *Entry) error) error {
+	if fsw.hasPathSpecificStore {
+		return ErrUnsupportedEntryScan
+	}
+	scanner, ok := fsw.defaultStore.(EntryScanner)
+	if !ok {
+		return ErrUnsupportedEntryScan
+	}
+	stats.FilerStoreCounter.WithLabelValues(fsw.defaultStore.GetName(), "scan").Inc()
+	start := time.Now()
+	defer func() {
+		stats.FilerStoreHistogram.WithLabelValues(fsw.defaultStore.GetName(), "scan").Observe(time.Since(start).Seconds())
+	}()
+	return scanner.ScanEntries(ctx, dirPath, func(scanCtx context.Context, entry *Entry) error {
+		if err := fsw.maybeReadHardLink(scanCtx, entry); err != nil && !errors.Is(err, ErrKvNotFound) {
+			return fmt.Errorf("resolve hard link of %s: %w", entry.FullPath, err)
+		}
+		filer_pb.AfterEntryDeserialization(entry.GetChunks())
+		return fn(scanCtx, entry)
+	})
+}
+
 func (fsw *FilerStoreWrapper) prefixFilterEntries(ctx context.Context, dirPath util.FullPath, startFileName string, includeStartFile bool, limit int64, prefix string, eachEntryFunc ListEachEntryFunc) (lastFileName string, err error) {
 	actualStore := fsw.getActualStore(dirPath + "/")
 
diff --git a/weed/filer/foundationdb/foundationdb_store.go b/weed/filer/foundationdb/foundationdb_store.go
index b413d260f6..52c74677a9 100644
--- a/weed/filer/foundationdb/foundationdb_store.go
+++ b/weed/filer/foundationdb/foundationdb_store.go
@@ -35,8 +35,6 @@ import (
 )
 
 const (
-	// FoundationDB transaction size limit is 10MB
-	FDB_TRANSACTION_SIZE_LIMIT = 10 * 1024 * 1024
 	// Safe limit for batch size (leave margin for FDB overhead)
 	FDB_BATCH_SIZE_LIMIT = 8 * 1024 * 1024
 	// Maximum number of entries to return in a single directory listing
@@ -396,10 +394,8 @@ func (store *FoundationDBStore) UpdateEntry(ctx context.Context, entry *filer.En
 		value = util.MaybeGzipData(value)
 	}
 
-	// Check transaction size limit
-	if len(value) > FDB_TRANSACTION_SIZE_LIMIT {
-		return fmt.Errorf("entry %s exceeds FoundationDB transaction size limit (%d > %d bytes)",
-			entry.FullPath, len(value), FDB_TRANSACTION_SIZE_LIMIT)
+	if err := errIfValueTooLarge(string(entry.FullPath), value); err != nil {
+		return err
 	}
 
 	// Check if there's a transaction in context
@@ -696,6 +692,10 @@ func (store *FoundationDBStore) ListDirectoryPrefixedEntries(ctx context.Context
 func (store *FoundationDBStore) KvPut(ctx context.Context, key []byte, value []byte) error {
 	fdbKey := store.kvDir.Pack(tuple.Tuple{key})
 
+	if err := errIfValueTooLarge(string(key), value); err != nil {
+		return err
+	}
+
 	// Check if there's a transaction in context
 	if tx, exists := store.getTransactionFromContext(ctx); exists {
 		tx.Set(fdbKey, value)
diff --git a/weed/filer/foundationdb/value_size.go b/weed/filer/foundationdb/value_size.go
new file mode 100644
index 0000000000..7e07234d6e
--- /dev/null
+++ b/weed/filer/foundationdb/value_size.go
@@ -0,0 +1,16 @@
+package foundationdb
+
+import "fmt"
+
+// FDB_VALUE_SIZE_LIMIT is Apple's documented maximum value size: 100,000
+// bytes, not 100 KiB. A value over it is rejected by FoundationDB itself with
+// error 2103, so the store checks it and names it.
+const FDB_VALUE_SIZE_LIMIT = 100 * 1000
+
+func errIfValueTooLarge(name string, value []byte) error {
+	if len(value) > FDB_VALUE_SIZE_LIMIT {
+		return fmt.Errorf("entry %s exceeds FoundationDB value size limit (%d > %d bytes)",
+			name, len(value), FDB_VALUE_SIZE_LIMIT)
+	}
+	return nil
+}
diff --git a/weed/filer/foundationdb/value_size_test.go b/weed/filer/foundationdb/value_size_test.go
new file mode 100644
index 0000000000..27256cf387
--- /dev/null
+++ b/weed/filer/foundationdb/value_size_test.go
@@ -0,0 +1,32 @@
+package foundationdb
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestFDBValueSizeLimitConstant(t *testing.T) {
+	if FDB_VALUE_SIZE_LIMIT != 100*1000 {
+		t.Fatalf("FDB_VALUE_SIZE_LIMIT = %d, want 100000", FDB_VALUE_SIZE_LIMIT)
+	}
+}
+
+func TestErrIfValueTooLarge(t *testing.T) {
+	if err := errIfValueTooLarge("/p", make([]byte, FDB_VALUE_SIZE_LIMIT)); err != nil {
+		t.Fatalf("100000-byte value should pass, got %v", err)
+	}
+	err := errIfValueTooLarge("/buckets/b/o", make([]byte, FDB_VALUE_SIZE_LIMIT+1))
+	if err == nil {
+		t.Fatal("100001-byte value should fail")
+	}
+	msg := err.Error()
+	if !strings.Contains(msg, "value size limit") {
+		t.Fatalf("error should name value size limit, got %q", msg)
+	}
+	if strings.Contains(msg, "transaction size limit") {
+		t.Fatalf("error must not mention transaction size limit, got %q", msg)
+	}
+	if !strings.Contains(msg, "100001") || !strings.Contains(msg, "100000") {
+		t.Fatalf("error should include both sizes, got %q", msg)
+	}
+}
diff --git a/weed/filer/leveldb/leveldb_store.go b/weed/filer/leveldb/leveldb_store.go
index a6d699d8be..606166da90 100644
--- a/weed/filer/leveldb/leveldb_store.go
+++ b/weed/filer/leveldb/leveldb_store.go
@@ -79,6 +79,15 @@ func (store *LevelDBStore) RollbackTransaction(ctx context.Context) error {
 	return nil
 }
 
+var syncWriteOptions = &opt.WriteOptions{Sync: true}
+
+func writeOptions(ctx context.Context) *opt.WriteOptions {
+	if filer.SyncWrite(ctx) {
+		return syncWriteOptions
+	}
+	return nil
+}
+
 func (store *LevelDBStore) InsertEntry(ctx context.Context, entry *filer.Entry) (err error) {
 	key := genKey(entry.DirAndName())
 
@@ -91,7 +100,7 @@ func (store *LevelDBStore) InsertEntry(ctx context.Context, entry *filer.Entry)
 		value = weed_util.MaybeGzipData(value)
 	}
 
-	err = store.db.Put(key, value, nil)
+	err = store.db.Put(key, value, writeOptions(ctx))
 
 	if err != nil {
 		return fmt.Errorf("persisting %s : %v", entry.FullPath, err)
@@ -168,7 +177,7 @@ func (store *LevelDBStore) FindEntry(ctx context.Context, fullpath weed_util.Ful
 func (store *LevelDBStore) DeleteEntry(ctx context.Context, fullpath weed_util.FullPath) (err error) {
 	key := genKey(fullpath.DirAndName())
 
-	err = store.db.Delete(key, nil)
+	err = store.db.Delete(key, writeOptions(ctx))
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
 	}
@@ -195,7 +204,7 @@ func (store *LevelDBStore) DeleteFolderChildren(ctx context.Context, fullpath we
 	}
 	iter.Release()
 
-	err = store.db.Write(batch, nil)
+	err = store.db.Write(batch, writeOptions(ctx))
 
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
diff --git a/weed/filer/leveldb/object_size_metric_test.go b/weed/filer/leveldb/object_size_metric_test.go
index 4e4d2c5258..3400fdb849 100644
--- a/weed/filer/leveldb/object_size_metric_test.go
+++ b/weed/filer/leveldb/object_size_metric_test.go
@@ -34,7 +34,7 @@ func TestCreateEntryRecordsObjectSize(t *testing.T) {
 	}
 	testFiler.SetStore(store)
 	defer testFiler.Shutdown()
-	ctx := context.Background()
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
 
 	file := func(path string, size uint64) *filer.Entry {
 		return &filer.Entry{
diff --git a/weed/filer/leveldb2/empty_folder_race_test.go b/weed/filer/leveldb2/empty_folder_race_test.go
new file mode 100644
index 0000000000..a872676039
--- /dev/null
+++ b/weed/filer/leveldb2/empty_folder_race_test.go
@@ -0,0 +1,424 @@
+package leveldb
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/filer/empty_folder_cleanup"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// hookStore runs a hook once, right after the store call it is attached to returns,
+// so a test can act inside a window that is otherwise not reachable.
+type hookStore struct {
+	filer.FilerStore
+	afterList   func()
+	listFired   bool
+	afterInsert func(entry *filer.Entry)
+	insertFired bool
+}
+
+func (s *hookStore) ListDirectoryPrefixedEntries(ctx context.Context, dirPath util.FullPath, startFileName string, includeStartFile bool, limit int64, prefix string, eachEntryFunc filer.ListEachEntryFunc) (string, error) {
+	lastFileName, err := s.FilerStore.ListDirectoryPrefixedEntries(ctx, dirPath, startFileName, includeStartFile, limit, prefix, eachEntryFunc)
+	if s.afterList != nil && !s.listFired {
+		s.listFired = true
+		s.afterList()
+	}
+	return lastFileName, err
+}
+
+func (s *hookStore) InsertEntry(ctx context.Context, entry *filer.Entry) error {
+	err := s.FilerStore.InsertEntry(ctx, entry)
+	if s.afterInsert != nil && !s.insertFired {
+		s.insertFired = true
+		s.afterInsert(entry)
+	}
+	return err
+}
+
+// TestNonRecursiveFolderDeleteKeepsRacingChild covers the S3 empty-folder
+// cleanup path: the delete lists a folder, finds it empty, and must not then
+// bulk-delete its children, because an object written in between would be
+// destroyed after the write was already acknowledged.
+func TestNonRecursiveFolderDeleteKeepsRacingChild(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	hooked := &hookStore{FilerStore: store}
+	testFiler.SetStore(hooked)
+
+	// the test has no metadata log consumer
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	dir := util.FullPath("/buckets/testbucket/data/abc")
+	child := dir.Child("obj")
+
+	dirEntry := &filer.Entry{FullPath: dir, Attr: filer.Attr{Mode: os.ModeDir | 0755}}
+	if err := testFiler.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create folder: %v", err)
+	}
+
+	hooked.afterList = func() {
+		entry := &filer.Entry{FullPath: child, Attr: filer.Attr{Mode: 0640}}
+		if err := testFiler.CreateEntry(ctx, entry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+			t.Errorf("create entry racing the folder delete: %v", err)
+		}
+	}
+
+	if err := testFiler.DeleteEntryMetaAndData(ctx, dir, false, false, false, false, nil, 0); err != nil {
+		t.Fatalf("delete empty folder: %v", err)
+	}
+
+	if _, err := testFiler.FindEntry(ctx, child); err != nil {
+		t.Errorf("entry created during the folder delete was removed: %v", err)
+	}
+
+	// The folder entry itself still goes, so the surviving entry is reachable by
+	// path but absent from listings until the folder comes back. Pinning that here
+	// keeps the remaining exposure visible; tighten it if the two steps ever become
+	// atomic.
+	if _, err := testFiler.FindEntry(ctx, dir); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Errorf("folder entry should still be removed, got %v", err)
+	}
+}
+
+// TestEnsureDirectoryEntryRestoresRacingParent covers the leftover of the same
+// race: the entry survives the folder delete but its directory does not, so the
+// entry drops out of listings until the directory is put back.
+func TestEnsureDirectoryEntryRestoresRacingParent(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	hooked := &hookStore{FilerStore: store}
+	testFiler.SetStore(hooked)
+
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	parent := util.FullPath("/buckets/testbucket/data")
+	dir := parent.Child("abc")
+	child := dir.Child("obj")
+
+	dirEntry := &filer.Entry{FullPath: dir, Attr: filer.Attr{Mode: os.ModeDir | 0755}}
+	if err := testFiler.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create folder: %v", err)
+	}
+
+	// the cleaner reads these before deleting, so a restore does not have to guess
+	attrs, err := testFiler.DirectoryAttributes(ctx, dir)
+	if err != nil {
+		t.Fatalf("read folder attributes: %v", err)
+	}
+
+	hooked.afterList = func() {
+		entry := &filer.Entry{FullPath: child, Attr: filer.Attr{Mode: 0640}}
+		if err := testFiler.CreateEntry(ctx, entry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+			t.Errorf("create entry racing the folder delete: %v", err)
+		}
+	}
+
+	if err := testFiler.DeleteEntryMetaAndData(ctx, dir, false, false, false, false, nil, 0); err != nil {
+		t.Fatalf("delete empty folder: %v", err)
+	}
+
+	if names := listNames(ctx, t, testFiler, parent); len(names) != 0 {
+		t.Fatalf("folder should be gone from its parent before the restore, got %v", names)
+	}
+
+	if err := testFiler.EnsureDirectoryEntry(ctx, dir, attrs); err != nil {
+		t.Fatalf("restore folder: %v", err)
+	}
+
+	restored, err := testFiler.FindEntry(ctx, dir)
+	if err != nil {
+		t.Fatalf("find restored folder: %v", err)
+	}
+	if !restored.IsDirectory() {
+		t.Errorf("restored %s is not a directory", dir)
+	}
+	if names := listNames(ctx, t, testFiler, parent); len(names) != 1 || names[0] != "abc" {
+		t.Errorf("restored folder should be listed under its parent, got %v", names)
+	}
+}
+
+// TestEnsureDirectoryEntryRestoresExactAttributes checks that a restored directory
+// comes back exactly as it was. Guessing from an ancestor, or forcing traversal bits,
+// would hand back a directory that grants access the original one denied.
+func TestEnsureDirectoryEntryRestoresExactAttributes(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	testFiler.SetStore(store)
+
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	// a private directory under a world-traversable parent
+	dir := util.FullPath("/buckets/testbucket/data").Child("private")
+	dirEntry := &filer.Entry{FullPath: dir, Attr: filer.Attr{Mode: os.ModeDir | 0700, Uid: 4242, Gid: 4343}}
+	if err := testFiler.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create folder: %v", err)
+	}
+
+	attrs, err := testFiler.DirectoryAttributes(ctx, dir)
+	if err != nil {
+		t.Fatalf("read folder attributes: %v", err)
+	}
+	if err := testFiler.DeleteEntryMetaAndData(ctx, dir, false, false, false, false, nil, 0); err != nil {
+		t.Fatalf("delete folder: %v", err)
+	}
+
+	if err := testFiler.EnsureDirectoryEntry(ctx, dir, attrs); err != nil {
+		t.Fatalf("restore folder: %v", err)
+	}
+
+	restored, err := testFiler.FindEntry(ctx, dir)
+	if err != nil {
+		t.Fatalf("find restored folder: %v", err)
+	}
+	if !restored.IsDirectory() {
+		t.Errorf("restored %s is not a directory", dir)
+	}
+	if restored.Mode.Perm() != 0700 {
+		t.Errorf("restored folder should keep mode 0700, got %o", restored.Mode.Perm())
+	}
+	if restored.Uid != 4242 || restored.Gid != 4343 {
+		t.Errorf("restored folder should keep its owner, got uid=%d gid=%d", restored.Uid, restored.Gid)
+	}
+}
+
+// TestCreateEntryCreatesParentAfterTheEntry covers the writer's half of the pair: the
+// folder is taken while the entry is landing, which used to orphan it.
+func TestCreateEntryCreatesParentAfterTheEntry(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	hooked := &hookStore{FilerStore: store}
+	testFiler.SetStore(hooked)
+
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	parent := util.FullPath("/buckets/testbucket/data")
+	dir := parent.Child("abc")
+	child := dir.Child("obj")
+
+	dirEntry := &filer.Entry{FullPath: dir, Attr: filer.Attr{Mode: os.ModeDir | 0755}}
+	if err := testFiler.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create folder: %v", err)
+	}
+
+	// the cleaner found the folder empty a moment ago and removes it now
+	hooked.afterInsert = func(entry *filer.Entry) {
+		if entry.FullPath != child {
+			return
+		}
+		if err := store.DeleteEntry(ctx, dir); err != nil {
+			t.Errorf("delete folder racing the insert: %v", err)
+		}
+	}
+
+	entry := &filer.Entry{FullPath: child, Attr: filer.Attr{Mode: 0640}}
+	if err := testFiler.CreateEntry(ctx, entry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create entry racing the folder delete: %v", err)
+	}
+
+	if _, err := testFiler.FindEntry(ctx, child); err != nil {
+		t.Fatalf("entry created during the folder delete is gone: %v", err)
+	}
+	restored, err := testFiler.FindEntry(ctx, dir)
+	if err != nil {
+		t.Fatalf("parent taken during the insert should be created after it: %v", err)
+	}
+	if !restored.IsDirectory() {
+		t.Errorf("recreated %s is not a directory", dir)
+	}
+	if names := listNames(ctx, t, testFiler, parent); len(names) != 1 || names[0] != "abc" {
+		t.Errorf("entry should be reachable by listing again, got %v", names)
+	}
+}
+
+// TestCreateEntryKeepsTheEntryWhenTheParentCannotBeCreated pins the cost of going
+// second: the entry is already stored when the parent fails, and it is left there,
+// since nothing can tell it apart from a concurrent create that has succeeded.
+func TestCreateEntryKeepsTheEntryWhenTheParentCannotBeCreated(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	testFiler.SetStore(store)
+
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	// an invalid bucket name is rejected while the parents are being created
+	child := util.FullPath("/buckets/Not_A_Valid_Bucket/obj")
+
+	entry := &filer.Entry{FullPath: child, Attr: filer.Attr{Mode: 0640}}
+	if err := testFiler.CreateEntry(ctx, entry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err == nil {
+		t.Fatal("an invalid bucket name should still fail the create")
+	}
+
+	if _, err := testFiler.FindEntry(ctx, child); err != nil {
+		t.Errorf("the entry is kept rather than risking a concurrent create: %v", err)
+	}
+}
+
+// TestCreateEntryDoesNotAnnounceAnEntryWhoseParentFailed pins the other half of keeping
+// the entry: it stays off the log. The aggregator replicates creates into peer stores,
+// so announcing a create that failed would put the parentless row on every filer.
+func TestCreateEntryDoesNotAnnounceAnEntryWhoseParentFailed(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	testFiler.SetStore(store)
+
+	ctx, sink := filer.WithMetadataEventSink(context.Background())
+	child := util.FullPath("/buckets/Not_A_Valid_Bucket/obj")
+
+	entry := &filer.Entry{FullPath: child, Attr: filer.Attr{Mode: 0640}}
+	if err := testFiler.CreateEntry(ctx, entry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err == nil {
+		t.Fatal("an invalid bucket name should still fail the create")
+	}
+
+	if event := sink.Last(); event != nil {
+		t.Errorf("a create that failed must not be announced, got %+v", event.EventNotification)
+	}
+	if _, err := testFiler.FindEntry(ctx, child); err != nil {
+		t.Errorf("the entry itself is still kept: %v", err)
+	}
+}
+
+// TestEnsureDirectoryEntryNarrowsAWiderRestore covers a writer getting to the missing
+// parent first and minting it wider than the one that was deleted.
+func TestEnsureDirectoryEntryNarrowsAWiderRestore(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	testFiler.SetStore(store)
+
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	dir := util.FullPath("/buckets/testbucket/data").Child("private")
+	dirEntry := &filer.Entry{FullPath: dir, Attr: filer.Attr{Mode: os.ModeDir | 0700, Uid: 4242, Gid: 4343}}
+	if err := testFiler.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create folder: %v", err)
+	}
+	attrs, err := testFiler.DirectoryAttributes(ctx, dir)
+	if err != nil {
+		t.Fatalf("read folder attributes: %v", err)
+	}
+	if err := testFiler.DeleteEntryMetaAndData(ctx, dir, false, false, false, false, nil, 0); err != nil {
+		t.Fatalf("delete folder: %v", err)
+	}
+
+	// the writer's own entry is 0640, so the parent it mints comes back 0751
+	entry := &filer.Entry{FullPath: dir.Child("obj"), Attr: filer.Attr{Mode: 0640}}
+	if err := testFiler.CreateEntry(ctx, entry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create entry: %v", err)
+	}
+	widened, err := testFiler.FindEntry(ctx, dir)
+	if err != nil {
+		t.Fatalf("find minted folder: %v", err)
+	}
+	if widened.Mode.Perm() == 0700 {
+		t.Skip("the writer no longer widens the parent, nothing left to narrow")
+	}
+
+	if err := testFiler.EnsureDirectoryEntry(ctx, dir, attrs); err != nil {
+		t.Fatalf("restore folder: %v", err)
+	}
+	restored, err := testFiler.FindEntry(ctx, dir)
+	if err != nil {
+		t.Fatalf("find restored folder: %v", err)
+	}
+	if !restored.IsDirectory() {
+		t.Errorf("restored %s is not a directory", dir)
+	}
+	if restored.Mode.Perm() != 0700 {
+		t.Errorf("restore should hand back mode 0700, got %o", restored.Mode.Perm())
+	}
+	if _, err := testFiler.FindEntry(ctx, entry.FullPath); err != nil {
+		t.Errorf("narrowing the folder should not disturb what it holds: %v", err)
+	}
+}
+
+// TestEnsureDirectoryEntryKeepsATightenedDirectory checks the other direction: a
+// restore only ever narrows, so a deliberate tightening is left alone.
+func TestEnsureDirectoryEntryKeepsATightenedDirectory(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	testFiler.SetStore(store)
+
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	dir := util.FullPath("/buckets/testbucket/data").Child("tightened")
+	dirEntry := &filer.Entry{FullPath: dir, Attr: filer.Attr{Mode: os.ModeDir | 0700}}
+	if err := testFiler.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create folder: %v", err)
+	}
+
+	if err := testFiler.EnsureDirectoryEntry(ctx, dir, empty_folder_cleanup.DirectoryAttributes{Mode: 0755}); err != nil {
+		t.Fatalf("restore folder: %v", err)
+	}
+	kept, err := testFiler.FindEntry(ctx, dir)
+	if err != nil {
+		t.Fatalf("find folder: %v", err)
+	}
+	if kept.Mode.Perm() != 0700 {
+		t.Errorf("a directory tightened since should keep mode 0700, got %o", kept.Mode.Perm())
+	}
+}
+
+// TestEnsureDirectoryEntryIntersectsMixedModes covers modes that are not nested, where
+// replacing rather than intersecting would grant a bit the directory denied.
+func TestEnsureDirectoryEntryIntersectsMixedModes(t *testing.T) {
+	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	store := &LevelDB2Store{}
+	if err := store.initialize(t.TempDir(), 2); err != nil {
+		t.Fatal(err)
+	}
+	testFiler.SetStore(store)
+
+	ctx := filer.WithSuppressedMetadataEvents(context.Background())
+	dir := util.FullPath("/buckets/testbucket/data").Child("mixed")
+	dirEntry := &filer.Entry{FullPath: dir, Attr: filer.Attr{Mode: os.ModeDir | 0705}}
+	if err := testFiler.CreateEntry(ctx, dirEntry, nil, false, false, nil, false, testFiler.MaxFilenameLength); err != nil {
+		t.Fatalf("create folder: %v", err)
+	}
+
+	// 0750 grants group access that 0705 denies, and denies the other access it grants
+	if err := testFiler.EnsureDirectoryEntry(ctx, dir, empty_folder_cleanup.DirectoryAttributes{Mode: 0750}); err != nil {
+		t.Fatalf("restore folder: %v", err)
+	}
+	restored, err := testFiler.FindEntry(ctx, dir)
+	if err != nil {
+		t.Fatalf("find folder: %v", err)
+	}
+	if restored.Mode.Perm() != 0700 {
+		t.Errorf("restore should grant only what both modes allow, got %o", restored.Mode.Perm())
+	}
+}
+
+func listNames(ctx context.Context, t *testing.T, f *filer.Filer, dir util.FullPath) []string {
+	t.Helper()
+	entries, _, err := f.ListDirectoryEntries(ctx, dir, "", false, 100, "", "", "")
+	if err != nil {
+		t.Fatalf("list %s: %v", dir, err)
+	}
+	var names []string
+	for _, entry := range entries {
+		names = append(names, entry.Name())
+	}
+	return names
+}
diff --git a/weed/filer/leveldb2/leveldb2_store.go b/weed/filer/leveldb2/leveldb2_store.go
index c3bb2ac55b..5c05033b99 100644
--- a/weed/filer/leveldb2/leveldb2_store.go
+++ b/weed/filer/leveldb2/leveldb2_store.go
@@ -6,6 +6,7 @@ import (
 	"crypto/md5"
 	"fmt"
 	"io"
+	"math"
 	"os"
 
 	"github.com/syndtr/goleveldb/leveldb"
@@ -28,6 +29,11 @@ type LevelDB2Store struct {
 	dbs      []*leveldb.DB
 	dbCount  int
 	ReadOnly bool
+
+	blockCacheSizeMB      int
+	writeBufferSizeMB     int
+	blockSizeKB           int
+	compactionTableSizeMB int
 }
 
 func (store *LevelDB2Store) GetName() string {
@@ -36,9 +42,54 @@ func (store *LevelDB2Store) GetName() string {
 
 func (store *LevelDB2Store) Initialize(configuration weed_util.Configuration, prefix string) (err error) {
 	dir := configuration.GetString(prefix + "dir")
+	store.blockCacheSizeMB = configuration.GetInt(prefix + "block_cache_size_mb")
+	store.writeBufferSizeMB = configuration.GetInt(prefix + "write_buffer_size_mb")
+	store.blockSizeKB = configuration.GetInt(prefix + "block_size_kb")
+	store.compactionTableSizeMB = configuration.GetInt(prefix + "compaction_table_size_mb")
+	if err := store.validateSizeOptions(); err != nil {
+		return err
+	}
 	return store.initialize(dir, 8)
 }
 
+// validateSizeOptions rejects sizes too large to convert to bytes without
+// overflowing int on this platform.
+func (store *LevelDB2Store) validateSizeOptions() error {
+	for name, kv := range map[string][2]int{
+		"block_cache_size_mb":      {store.blockCacheSizeMB, 1 << 20},
+		"write_buffer_size_mb":     {store.writeBufferSizeMB, 1 << 20},
+		"block_size_kb":            {store.blockSizeKB, 1 << 10},
+		"compaction_table_size_mb": {store.compactionTableSizeMB, 1 << 20},
+	} {
+		if kv[0] > math.MaxInt/kv[1] {
+			return fmt.Errorf("leveldb2 option %s=%d overflows int", name, kv[0])
+		}
+	}
+	return nil
+}
+
+func (store *LevelDB2Store) buildOptions() *opt.Options {
+	opts := &opt.Options{
+		BlockCacheCapacity: 32 * 1024 * 1024,         // default value is 8MiB
+		WriteBuffer:        16 * 1024 * 1024,         // default value is 4MiB
+		Filter:             filter.NewBloomFilter(8), // false positive rate 0.02
+		ReadOnly:           store.ReadOnly,
+	}
+	if store.blockCacheSizeMB > 0 {
+		opts.BlockCacheCapacity = store.blockCacheSizeMB * 1024 * 1024
+	}
+	if store.writeBufferSizeMB > 0 {
+		opts.WriteBuffer = store.writeBufferSizeMB * 1024 * 1024
+	}
+	if store.blockSizeKB > 0 {
+		opts.BlockSize = store.blockSizeKB * 1024
+	}
+	if store.compactionTableSizeMB > 0 {
+		opts.CompactionTableSize = store.compactionTableSizeMB * 1024 * 1024
+	}
+	return opts
+}
+
 func (store *LevelDB2Store) initialize(dir string, dbCount int) (err error) {
 	glog.Infof("filer store leveldb2 dir: %s", dir)
 	os.MkdirAll(dir, 0755)
@@ -46,12 +97,7 @@ func (store *LevelDB2Store) initialize(dir string, dbCount int) (err error) {
 		return fmt.Errorf("Check Level Folder %s Writable: %s", dir, err)
 	}
 
-	opts := &opt.Options{
-		BlockCacheCapacity: 32 * 1024 * 1024,         // default value is 8MiB
-		WriteBuffer:        16 * 1024 * 1024,         // default value is 4MiB
-		Filter:             filter.NewBloomFilter(8), // false positive rate 0.02
-		ReadOnly:           store.ReadOnly,
-	}
+	opts := store.buildOptions()
 
 	for d := 0; d < dbCount; d++ {
 		dbFolder := fmt.Sprintf("%s/%02d", dir, d)
@@ -81,6 +127,15 @@ func (store *LevelDB2Store) RollbackTransaction(ctx context.Context) error {
 	return nil
 }
 
+var syncWriteOptions = &opt.WriteOptions{Sync: true}
+
+func writeOptions(ctx context.Context) *opt.WriteOptions {
+	if filer.SyncWrite(ctx) {
+		return syncWriteOptions
+	}
+	return nil
+}
+
 func (store *LevelDB2Store) InsertEntry(ctx context.Context, entry *filer.Entry) (err error) {
 	dir, name := entry.DirAndName()
 	key, partitionId := genKey(dir, name, store.dbCount)
@@ -94,7 +149,7 @@ func (store *LevelDB2Store) InsertEntry(ctx context.Context, entry *filer.Entry)
 		value = weed_util.MaybeGzipData(value)
 	}
 
-	err = store.dbs[partitionId].Put(key, value, nil)
+	err = store.dbs[partitionId].Put(key, value, writeOptions(ctx))
 
 	if err != nil {
 		return fmt.Errorf("persisting %s : %v", entry.FullPath, err)
@@ -140,7 +195,7 @@ func (store *LevelDB2Store) DeleteEntry(ctx context.Context, fullpath weed_util.
 	dir, name := fullpath.DirAndName()
 	key, partitionId := genKey(dir, name, store.dbCount)
 
-	err = store.dbs[partitionId].Delete(key, nil)
+	err = store.dbs[partitionId].Delete(key, writeOptions(ctx))
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
 	}
@@ -167,7 +222,7 @@ func (store *LevelDB2Store) DeleteFolderChildren(ctx context.Context, fullpath w
 	}
 	iter.Release()
 
-	err = store.dbs[partitionId].Write(batch, nil)
+	err = store.dbs[partitionId].Write(batch, writeOptions(ctx))
 
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
diff --git a/weed/filer/leveldb2/leveldb2_store_test.go b/weed/filer/leveldb2/leveldb2_store_test.go
index 5c6a3a4d71..9651711d92 100644
--- a/weed/filer/leveldb2/leveldb2_store_test.go
+++ b/weed/filer/leveldb2/leveldb2_store_test.go
@@ -2,6 +2,8 @@ package leveldb
 
 import (
 	"context"
+	"math"
+	"strings"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -62,6 +64,93 @@ func TestCreateAndFind(t *testing.T) {
 
 }
 
+type fakeConfiguration map[string]interface{}
+
+func (c fakeConfiguration) GetString(key string) string {
+	value, _ := c[key].(string)
+	return value
+}
+
+func (c fakeConfiguration) GetBool(key string) bool {
+	value, _ := c[key].(bool)
+	return value
+}
+
+func (c fakeConfiguration) GetInt(key string) int {
+	value, _ := c[key].(int)
+	return value
+}
+
+func (c fakeConfiguration) GetStringSlice(key string) []string {
+	value, _ := c[key].([]string)
+	return value
+}
+
+func (c fakeConfiguration) SetDefault(key string, value interface{}) {
+	if _, found := c[key]; !found {
+		c[key] = value
+	}
+}
+
+func TestInitializeOptions(t *testing.T) {
+	store := &LevelDB2Store{}
+	if err := store.Initialize(fakeConfiguration{
+		"leveldb2.dir":                      t.TempDir(),
+		"leveldb2.block_cache_size_mb":      64,
+		"leveldb2.write_buffer_size_mb":     32,
+		"leveldb2.block_size_kb":            16,
+		"leveldb2.compaction_table_size_mb": 8,
+	}, "leveldb2."); err != nil {
+		t.Fatalf("initialize: %v", err)
+	}
+	defer store.Shutdown()
+
+	opts := store.buildOptions()
+	if opts.BlockCacheCapacity != 64*1024*1024 {
+		t.Errorf("block cache %d, want 64MiB", opts.BlockCacheCapacity)
+	}
+	if opts.WriteBuffer != 32*1024*1024 {
+		t.Errorf("write buffer %d, want 32MiB", opts.WriteBuffer)
+	}
+	if opts.BlockSize != 16*1024 {
+		t.Errorf("block size %d, want 16KiB", opts.BlockSize)
+	}
+	if opts.CompactionTableSize != 8*1024*1024 {
+		t.Errorf("compaction table size %d, want 8MiB", opts.CompactionTableSize)
+	}
+}
+
+func TestInitializeDefaultOptions(t *testing.T) {
+	store := &LevelDB2Store{}
+	if err := store.Initialize(fakeConfiguration{
+		"leveldb2.dir":                  t.TempDir(),
+		"leveldb2.block_cache_size_mb":  -1,
+		"leveldb2.write_buffer_size_mb": 0,
+	}, "leveldb2."); err != nil {
+		t.Fatalf("initialize: %v", err)
+	}
+	defer store.Shutdown()
+
+	opts := store.buildOptions()
+	if opts.BlockCacheCapacity != 32*1024*1024 {
+		t.Errorf("block cache %d, want the 32MiB default", opts.BlockCacheCapacity)
+	}
+	if opts.WriteBuffer != 16*1024*1024 {
+		t.Errorf("write buffer %d, want the 16MiB default", opts.WriteBuffer)
+	}
+}
+
+func TestInitializeRejectsOversizedOption(t *testing.T) {
+	store := &LevelDB2Store{}
+	err := store.Initialize(fakeConfiguration{
+		"leveldb2.dir":                  t.TempDir(),
+		"leveldb2.write_buffer_size_mb": math.MaxInt/(1<<20) + 1,
+	}, "leveldb2.")
+	if err == nil || !strings.Contains(err.Error(), "write_buffer_size_mb") {
+		t.Fatalf("expected overflow rejection, got %v", err)
+	}
+}
+
 func TestEmptyRoot(t *testing.T) {
 	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
 	dir := t.TempDir()
diff --git a/weed/filer/leveldb3/leveldb3_store.go b/weed/filer/leveldb3/leveldb3_store.go
index 564d6eaddd..029d902715 100644
--- a/weed/filer/leveldb3/leveldb3_store.go
+++ b/weed/filer/leveldb3/leveldb3_store.go
@@ -6,6 +6,7 @@ import (
 	"crypto/md5"
 	"fmt"
 	"io"
+	"math"
 	"os"
 	"strings"
 	"sync"
@@ -35,6 +36,11 @@ type LevelDB3Store struct {
 	dbs      map[string]*leveldb.DB
 	dbsLock  sync.RWMutex
 	ReadOnly bool
+
+	blockCacheSizeMB      int
+	writeBufferSizeMB     int
+	blockSizeKB           int
+	compactionTableSizeMB int
 }
 
 func (store *LevelDB3Store) GetName() string {
@@ -43,9 +49,58 @@ func (store *LevelDB3Store) GetName() string {
 
 func (store *LevelDB3Store) Initialize(configuration weed_util.Configuration, prefix string) (err error) {
 	dir := configuration.GetString(prefix + "dir")
+	store.blockCacheSizeMB = configuration.GetInt(prefix + "block_cache_size_mb")
+	store.writeBufferSizeMB = configuration.GetInt(prefix + "write_buffer_size_mb")
+	store.blockSizeKB = configuration.GetInt(prefix + "block_size_kb")
+	store.compactionTableSizeMB = configuration.GetInt(prefix + "compaction_table_size_mb")
+	if err := store.validateSizeOptions(); err != nil {
+		return err
+	}
 	return store.initialize(dir)
 }
 
+// validateSizeOptions rejects sizes too large to convert to bytes without
+// overflowing int on this platform.
+func (store *LevelDB3Store) validateSizeOptions() error {
+	for name, kv := range map[string][2]int{
+		"block_cache_size_mb":      {store.blockCacheSizeMB, 1 << 20},
+		"write_buffer_size_mb":     {store.writeBufferSizeMB, 1 << 20},
+		"block_size_kb":            {store.blockSizeKB, 1 << 10},
+		"compaction_table_size_mb": {store.compactionTableSizeMB, 1 << 20},
+	} {
+		if kv[0] > math.MaxInt/kv[1] {
+			return fmt.Errorf("leveldb3 option %s=%d overflows int", name, kv[0])
+		}
+	}
+	return nil
+}
+
+func (store *LevelDB3Store) buildOptions(name string) *opt.Options {
+	opts := &opt.Options{
+		BlockCacheCapacity: 32 * 1024 * 1024, // default value is 8MiB
+		WriteBuffer:        16 * 1024 * 1024, // default value is 4MiB
+		Filter:             filter.NewBloomFilter(8),
+		ReadOnly:           store.ReadOnly,
+	}
+	if name != DEFAULT {
+		opts.BlockCacheCapacity = 16 * 1024 * 1024 // default value is 8MiB
+		opts.WriteBuffer = 8 * 1024 * 1024         // default value is 4MiB
+	}
+	if store.blockCacheSizeMB > 0 {
+		opts.BlockCacheCapacity = store.blockCacheSizeMB * 1024 * 1024
+	}
+	if store.writeBufferSizeMB > 0 {
+		opts.WriteBuffer = store.writeBufferSizeMB * 1024 * 1024
+	}
+	if store.blockSizeKB > 0 {
+		opts.BlockSize = store.blockSizeKB * 1024
+	}
+	if store.compactionTableSizeMB > 0 {
+		opts.CompactionTableSize = store.compactionTableSizeMB * 1024 * 1024
+	}
+	return opts
+}
+
 func (store *LevelDB3Store) initialize(dir string) (err error) {
 	glog.Infof("filer store leveldb3 dir: %s", dir)
 	os.MkdirAll(dir, 0755)
@@ -65,21 +120,7 @@ func (store *LevelDB3Store) initialize(dir string) (err error) {
 }
 
 func (store *LevelDB3Store) loadDB(name string) (*leveldb.DB, error) {
-	bloom := filter.NewBloomFilter(8) // false positive rate 0.02
-	opts := &opt.Options{
-		BlockCacheCapacity: 32 * 1024 * 1024, // default value is 8MiB
-		WriteBuffer:        16 * 1024 * 1024, // default value is 4MiB
-		Filter:             bloom,
-		ReadOnly:           store.ReadOnly,
-	}
-	if name != DEFAULT {
-		opts = &opt.Options{
-			BlockCacheCapacity: 16 * 1024 * 1024, // default value is 8MiB
-			WriteBuffer:        8 * 1024 * 1024,  // default value is 4MiB
-			Filter:             bloom,
-			ReadOnly:           store.ReadOnly,
-		}
-	}
+	opts := store.buildOptions(name)
 
 	dbFolder := fmt.Sprintf("%s/%s", store.dir, name)
 	os.MkdirAll(dbFolder, 0755)
@@ -180,6 +221,15 @@ func (store *LevelDB3Store) RollbackTransaction(ctx context.Context) error {
 	return nil
 }
 
+var syncWriteOptions = &opt.WriteOptions{Sync: true}
+
+func writeOptions(ctx context.Context) *opt.WriteOptions {
+	if filer.SyncWrite(ctx) {
+		return syncWriteOptions
+	}
+	return nil
+}
+
 func (store *LevelDB3Store) InsertEntry(ctx context.Context, entry *filer.Entry) (err error) {
 
 	db, _, shortPath, err := store.findDB(entry.FullPath, false)
@@ -199,7 +249,7 @@ func (store *LevelDB3Store) InsertEntry(ctx context.Context, entry *filer.Entry)
 		value = weed_util.MaybeGzipData(value)
 	}
 
-	err = db.Put(key, value, nil)
+	err = db.Put(key, value, writeOptions(ctx))
 
 	if err != nil {
 		return fmt.Errorf("persisting %s : %v", entry.FullPath, err)
@@ -257,7 +307,7 @@ func (store *LevelDB3Store) DeleteEntry(ctx context.Context, fullpath weed_util.
 	dir, name := shortPath.DirAndName()
 	key := genKey(dir, name)
 
-	err = db.Delete(key, nil)
+	err = db.Delete(key, writeOptions(ctx))
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
 	}
@@ -298,7 +348,7 @@ func (store *LevelDB3Store) DeleteFolderChildren(ctx context.Context, fullpath w
 	}
 	iter.Release()
 
-	err = db.Write(batch, nil)
+	err = db.Write(batch, writeOptions(ctx))
 
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
diff --git a/weed/filer/leveldb3/leveldb3_store_test.go b/weed/filer/leveldb3/leveldb3_store_test.go
index 8a3cd2d82e..62896a299f 100644
--- a/weed/filer/leveldb3/leveldb3_store_test.go
+++ b/weed/filer/leveldb3/leveldb3_store_test.go
@@ -2,6 +2,8 @@ package leveldb
 
 import (
 	"context"
+	"math"
+	"strings"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -62,6 +64,103 @@ func TestCreateAndFind(t *testing.T) {
 
 }
 
+type fakeConfiguration map[string]interface{}
+
+func (c fakeConfiguration) GetString(key string) string {
+	value, _ := c[key].(string)
+	return value
+}
+
+func (c fakeConfiguration) GetBool(key string) bool {
+	value, _ := c[key].(bool)
+	return value
+}
+
+func (c fakeConfiguration) GetInt(key string) int {
+	value, _ := c[key].(int)
+	return value
+}
+
+func (c fakeConfiguration) GetStringSlice(key string) []string {
+	value, _ := c[key].([]string)
+	return value
+}
+
+func (c fakeConfiguration) SetDefault(key string, value interface{}) {
+	if _, found := c[key]; !found {
+		c[key] = value
+	}
+}
+
+func TestInitializeOptions(t *testing.T) {
+	store := &LevelDB3Store{}
+	if err := store.Initialize(fakeConfiguration{
+		"leveldb3.dir":                      t.TempDir(),
+		"leveldb3.block_cache_size_mb":      64,
+		"leveldb3.write_buffer_size_mb":     32,
+		"leveldb3.block_size_kb":            16,
+		"leveldb3.compaction_table_size_mb": 8,
+	}, "leveldb3."); err != nil {
+		t.Fatalf("initialize: %v", err)
+	}
+	defer store.Shutdown()
+
+	for _, name := range []string{DEFAULT, "bucket-a"} {
+		opts := store.buildOptions(name)
+		if opts.BlockCacheCapacity != 64*1024*1024 {
+			t.Errorf("%s block cache %d, want 64MiB", name, opts.BlockCacheCapacity)
+		}
+		if opts.WriteBuffer != 32*1024*1024 {
+			t.Errorf("%s write buffer %d, want 32MiB", name, opts.WriteBuffer)
+		}
+		if opts.BlockSize != 16*1024 {
+			t.Errorf("%s block size %d, want 16KiB", name, opts.BlockSize)
+		}
+		if opts.CompactionTableSize != 8*1024*1024 {
+			t.Errorf("%s compaction table size %d, want 8MiB", name, opts.CompactionTableSize)
+		}
+	}
+}
+
+func TestInitializeDefaultOptions(t *testing.T) {
+	store := &LevelDB3Store{}
+	if err := store.Initialize(fakeConfiguration{
+		"leveldb3.dir":                  t.TempDir(),
+		"leveldb3.block_cache_size_mb":  -1,
+		"leveldb3.write_buffer_size_mb": 0,
+	}, "leveldb3."); err != nil {
+		t.Fatalf("initialize: %v", err)
+	}
+	defer store.Shutdown()
+
+	opts := store.buildOptions(DEFAULT)
+	if opts.BlockCacheCapacity != 32*1024*1024 {
+		t.Errorf("block cache %d, want the 32MiB default", opts.BlockCacheCapacity)
+	}
+	if opts.WriteBuffer != 16*1024*1024 {
+		t.Errorf("write buffer %d, want the 16MiB default", opts.WriteBuffer)
+	}
+
+	bucketOpts := store.buildOptions("bucket-a")
+	if bucketOpts.BlockCacheCapacity != 16*1024*1024 {
+		t.Errorf("bucket block cache %d, want the 16MiB default", bucketOpts.BlockCacheCapacity)
+	}
+	if bucketOpts.WriteBuffer != 8*1024*1024 {
+		t.Errorf("bucket write buffer %d, want the 8MiB default", bucketOpts.WriteBuffer)
+	}
+}
+
+func TestInitializeRejectsOversizedOption(t *testing.T) {
+	store := &LevelDB3Store{}
+	err := store.Initialize(fakeConfiguration{
+		"leveldb3.dir":                  t.TempDir(),
+		"leveldb3.write_buffer_size_mb": math.MaxInt/(1<<20) + 1,
+	}, "leveldb3.")
+	if err == nil || !strings.Contains(err.Error(), "write_buffer_size_mb") {
+		t.Fatalf("expected overflow rejection, got %v", err)
+	}
+}
+
 func TestEmptyRoot(t *testing.T) {
 	testFiler := filer.NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
 	dir := t.TempDir()
diff --git a/weed/filer/manifest_batch.go b/weed/filer/manifest_batch.go
new file mode 100644
index 0000000000..95c36aba3b
--- /dev/null
+++ b/weed/filer/manifest_batch.go
@@ -0,0 +1,10 @@
+//go:build !foundationdb
+
+package filer
+
+// ManifestBatch is how many data chunks are folded into one manifest chunk, so
+// that an entry's chunk list stays within the largest value its metadata store
+// will accept. Stores reached by this build hold values far larger than the
+// list 10000 chunks encode to; see manifest_batch_foundationdb.go for the
+// FoundationDB build, whose values stop at 100,000 bytes.
+const ManifestBatch = 10000
diff --git a/weed/filer/manifest_batch_foundationdb.go b/weed/filer/manifest_batch_foundationdb.go
new file mode 100644
index 0000000000..7b39795dc2
--- /dev/null
+++ b/weed/filer/manifest_batch_foundationdb.go
@@ -0,0 +1,24 @@
+//go:build foundationdb
+
+package filer
+
+// ManifestBatch is how many data chunks are folded into one manifest chunk. A
+// FoundationDB value stops at 100,000 bytes (foundationdb.FDB_VALUE_SIZE_LIMIT)
+// and an entry's whole chunk list is one value, which at ~100 bytes per chunk
+// record is about 1000 chunks -- so folding at 10000 never ran before the write
+// was already too large to store.
+//
+// A single fold level leaves (chunks/batch) manifest pointers plus up to
+// (batch-1) unfolded chunks in the entry, so the reachable chunk count is
+// highest when the two terms are near equal. 500 is that optimum for a
+// 100,000-byte budget: it keeps an entry inside the limit up to ~250,000
+// chunks, ~1 TB at the default -maxMB=4, against ~4 GB before. Larger files
+// need nested packing, which no batch size substitutes for.
+//
+// This is a property of the build rather than of the configured store: the
+// FoundationDB image builds one binary for the filer and for every client that
+// folds (S3, mount, WebDAV, weed shell, filer.copy), and each of them has to
+// agree on a list the filer's store can hold. A binary built with this tag but
+// pointed at another store folds earlier than that store requires, which costs
+// one manifest blob per 500 chunks and one read to resolve it.
+const ManifestBatch = 500
diff --git a/weed/filer/meta_aggregator.go b/weed/filer/meta_aggregator.go
index 1635bb91a1..310874a2e2 100644
--- a/weed/filer/meta_aggregator.go
+++ b/weed/filer/meta_aggregator.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -19,6 +20,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
 )
 
@@ -30,16 +32,55 @@ type MetaAggregator struct {
 	MetaLogBuffer  *log_buffer.LogBuffer
 	peerChans      map[pb.ServerAddress]chan struct{}
 	peerChansLock  sync.Mutex
+	// peerWatermarks tracks, per subscribed peer (self included), the newest
+	// timestamp received on that peer's stream (event or idle heartbeat).
+	// The minimum is a delivery low-watermark: MetaLogBuffer is complete up
+	// to it, so a subscriber held at or below it cannot miss a late-merged
+	// peer event. An unsignalled peer pins it at zero.
+	peerWatermarks map[pb.ServerAddress]int64
+	// peerFlushWatermarks tracks each peer's reported flush watermark:
+	// everything at or below it is on that peer's disk. The minimum bounds
+	// persisted-log reads — beyond it a peer may still land a log file (or
+	// chunk) whose events a passed cursor would skip.
+	peerFlushWatermarks map[pb.ServerAddress]int64
+	// peerRemovedAtNs marks peers the master removed, with the removal time.
+	// A removed peer keeps participating in the low-watermarks for a grace
+	// period: removal usually means a flap (frozen or partitioned filer)
+	// whose unflushed events still exist, and de-accounting it at once would
+	// let subscribers advance past them. A re-add clears the mark; a peer
+	// gone past the grace is dropped so it cannot pin the low-watermarks.
+	peerRemovedAtNs map[pb.ServerAddress]int64
+	// lowWatermarkTsNs and lowFlushWatermarkTsNs are the last minima signalled
+	// on deliveryAdvanced and flushAdvanced, each closed and replaced when its
+	// own minimum rises. Held readers park on the one that bounds them:
+	// arriving data cannot release a watermark hold, only a peer reporting
+	// the progress that hold waits on. The two are kept apart because a
+	// delivery advance - one per event a peer streams - cannot release a read
+	// held at the flush watermark, and waking it costs a whole pass.
+	lowWatermarkTsNs      int64
+	lowFlushWatermarkTsNs int64
+	deliveryAdvanced      chan struct{}
+	flushAdvanced         chan struct{}
+	remotePeerArrived     chan struct{}
+	peerWatermarksLock    sync.Mutex
+	peerWg                sync.WaitGroup
+	// stopped is set under peerChansLock by Shutdown; OnPeerUpdate then
+	// rejects adds so no subscription can outlive the shutdown wait and run
+	// against a store Filer.Shutdown has already closed.
+	stopped bool
 }
 
 // MetaAggregator only aggregates data "on the fly". The logs are not re-persisted to disk.
 // The old data comes from what each LocalMetadata persisted on disk.
 func NewMetaAggregator(filer *Filer, self pb.ServerAddress, grpcDialOption grpc.DialOption) *MetaAggregator {
 	t := &MetaAggregator{
-		filer:          filer,
-		self:           self,
-		grpcDialOption: grpcDialOption,
-		peerChans:      make(map[pb.ServerAddress]chan struct{}),
+		filer:               filer,
+		self:                self,
+		grpcDialOption:      grpcDialOption,
+		peerChans:           make(map[pb.ServerAddress]chan struct{}),
+		peerWatermarks:      make(map[pb.ServerAddress]int64),
+		peerFlushWatermarks: make(map[pb.ServerAddress]int64),
+		peerRemovedAtNs:     make(map[pb.ServerAddress]int64),
 	}
 	// nil notifyFn: aggregated subscribers wake through the buffer's
 	// subscriber channels, not a cond.
@@ -51,6 +92,13 @@ func (ma *MetaAggregator) OnPeerUpdate(update *master_pb.ClusterNodeUpdate, star
 	ma.peerChansLock.Lock()
 	defer ma.peerChansLock.Unlock()
 
+	// After Shutdown the master connection may still deliver an update; a
+	// subscription started now would have no stop signal and could run past
+	// the store close.
+	if ma.stopped {
+		return
+	}
+
 	address := pb.ServerAddress(update.Address)
 	if update.IsAdd {
 		// the peer is already followed, restarting would only lose the events
@@ -60,19 +108,209 @@ func (ma *MetaAggregator) OnPeerUpdate(update *master_pb.ClusterNodeUpdate, star
 		}
 		stopChan := make(chan struct{})
 		ma.peerChans[address] = stopChan
-		go ma.loopSubscribeToOneFiler(ma.filer, ma.self, address, startFrom, stopChan)
+		if address != ma.self {
+			ma.noteRemotePeerArrivalLocked()
+		}
+		// Account for the peer before its stream signals; keep prior values
+		// on reconnect.
+		ma.initPeerWatermark(address)
+		ma.peerWg.Add(1)
+		go func() {
+			defer ma.peerWg.Done()
+			ma.loopSubscribeToOneFiler(ma.filer, ma.self, address, startFrom, stopChan)
+		}()
 	} else {
 		if prevChan, found := ma.peerChans[address]; found {
 			close(prevChan)
 			delete(ma.peerChans, address)
 		}
+		// Only mark: dropping the watermarks at once would let subscribers
+		// advance past a flapping peer's unflushed events (see peerRemovedAtNs).
+		ma.markPeerWatermarkRemoved(address)
 	}
 }
 
+// peerWatermarkRemovalGrace is how long a removed peer keeps participating
+// in the low-watermarks. Matches the subscribe loops' settled horizon, which
+// already bounds a stale watermark's influence within it.
+const peerWatermarkRemovalGrace = 2 * LogFlushInterval
+
+// initPeerWatermark adds the peer with a zero (unknown) watermark; a re-added
+// peer keeps its prior values and stops being considered removed.
+func (ma *MetaAggregator) initPeerWatermark(peer pb.ServerAddress) {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	if _, found := ma.peerWatermarks[peer]; !found {
+		ma.peerWatermarks[peer] = 0
+	}
+	if _, found := ma.peerFlushWatermarks[peer]; !found {
+		ma.peerFlushWatermarks[peer] = 0
+	}
+	delete(ma.peerRemovedAtNs, peer)
+	ma.noteLowWatermarksLocked()
+}
+
+func (ma *MetaAggregator) markPeerWatermarkRemoved(peer pb.ServerAddress) {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	if _, found := ma.peerWatermarks[peer]; !found {
+		return
+	}
+	// First removal time wins: duplicate removals must not refresh the grace.
+	if _, marked := ma.peerRemovedAtNs[peer]; !marked {
+		ma.peerRemovedAtNs[peer] = time.Now().UnixNano()
+	}
+}
+
+// dropExpiredRemovedPeersLocked drops peers whose removal outlived the grace.
+// Caller must hold peerWatermarksLock.
+func (ma *MetaAggregator) dropExpiredRemovedPeersLocked() {
+	if len(ma.peerRemovedAtNs) == 0 {
+		return
+	}
+	cutoff := time.Now().UnixNano() - int64(peerWatermarkRemovalGrace)
+	for peer, removedAt := range ma.peerRemovedAtNs {
+		if removedAt < cutoff {
+			delete(ma.peerRemovedAtNs, peer)
+			delete(ma.peerWatermarks, peer)
+			delete(ma.peerFlushWatermarks, peer)
+		}
+	}
+	// Dropping the peer that pinned a minimum raises it, same as it reporting.
+	ma.noteLowWatermarksLocked()
+}
+
+// advancePeerWatermark records the peer as received-through tsNs. Monotonic,
+// and only for tracked peers: a dropped peer's straggler must not recreate
+// its entry and pin the low-watermark.
+func (ma *MetaAggregator) advancePeerWatermark(peer pb.ServerAddress, tsNs int64) {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	if cur, found := ma.peerWatermarks[peer]; found && tsNs > cur {
+		ma.peerWatermarks[peer] = tsNs
+		ma.noteLowWatermarksLocked()
+	}
+}
+
+// advancePeerFlushWatermark records the peer's reported flush watermark.
+// Monotonic, and only for tracked peers (see advancePeerWatermark).
+func (ma *MetaAggregator) advancePeerFlushWatermark(peer pb.ServerAddress, tsNs int64) {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	if cur, found := ma.peerFlushWatermarks[peer]; found && tsNs > cur {
+		ma.peerFlushWatermarks[peer] = tsNs
+		ma.noteLowWatermarksLocked()
+	}
+}
+
+// PeerLowFlushWatermarkTsNs returns the minimum reported flush watermark
+// across all current peers: every peer's events at or below this time are on
+// disk. Returns 0 when any peer has not reported yet (completeness unknown).
+func (ma *MetaAggregator) PeerLowFlushWatermarkTsNs() int64 {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	ma.dropExpiredRemovedPeersLocked()
+	return lowWatermarkOf(ma.peerFlushWatermarks)
+}
+
+// PeerLowWatermarkTsNs returns the minimum received-through timestamp across
+// all current peers (self included): MetaLogBuffer is complete up to this
+// time. Returns 0 when any peer has not signalled yet (or none are tracked),
+// i.e. completeness is unknown.
+func (ma *MetaAggregator) PeerLowWatermarkTsNs() int64 {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	ma.dropExpiredRemovedPeersLocked()
+	return lowWatermarkOf(ma.peerWatermarks)
+}
+
+// DeliveryWatermarkAdvancedChan returns a channel closed the next time the
+// delivery low-watermark rises, which is what releases an in-memory read held
+// at it. PeerLowFlushWatermarkTsNs has FlushWatermarkAdvancedChan. Callers
+// must take the channel before reading the watermark they hold at, so a rise
+// in between wakes them instead of being missed.
+func (ma *MetaAggregator) DeliveryWatermarkAdvancedChan() <-chan struct{} {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	if ma.deliveryAdvanced == nil {
+		ma.deliveryAdvanced = make(chan struct{})
+	}
+	return ma.deliveryAdvanced
+}
+
+// FlushWatermarkAdvancedChan returns a channel closed the next time the flush
+// low-watermark rises, which is what releases a persisted-log read held at it.
+func (ma *MetaAggregator) FlushWatermarkAdvancedChan() <-chan struct{} {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	if ma.flushAdvanced == nil {
+		ma.flushAdvanced = make(chan struct{})
+	}
+	return ma.flushAdvanced
+}
+
+// noteLowWatermarksLocked recomputes both minima and wakes the readers parked
+// on each one that rose. Caller must hold peerWatermarksLock.
+func (ma *MetaAggregator) noteLowWatermarksLocked() {
+	low, flushLow := lowWatermarkOf(ma.peerWatermarks), lowWatermarkOf(ma.peerFlushWatermarks)
+	// Falls are recorded too (a joining peer sits at 0 until it signals), so
+	// the climb back out of one is seen as a rise.
+	if low > ma.lowWatermarkTsNs {
+		ma.deliveryAdvanced = closeWatermarkChan(ma.deliveryAdvanced)
+	}
+	if flushLow > ma.lowFlushWatermarkTsNs {
+		ma.flushAdvanced = closeWatermarkChan(ma.flushAdvanced)
+	}
+	ma.lowWatermarkTsNs, ma.lowFlushWatermarkTsNs = low, flushLow
+}
+
+// closeWatermarkChan wakes everyone parked on ch and clears it, so the next
+// caller parks on a fresh one.
+func closeWatermarkChan(ch chan struct{}) chan struct{} {
+	if ch != nil {
+		close(ch)
+	}
+	return nil
+}
+
+// lowWatermarkOf returns the minimum across the tracked peers, or 0 when none
+// are tracked: a peer that has not signalled sits at 0 and pins the minimum
+// there, which is what makes completeness unknown.
+func lowWatermarkOf(watermarks map[pb.ServerAddress]int64) int64 {
+	if len(watermarks) == 0 {
+		return 0
+	}
+	var low int64 = math.MaxInt64
+	for _, tsNs := range watermarks {
+		if tsNs < low {
+			low = tsNs
+		}
+	}
+	return low
+}
+
+// PeersCaughtUpTo reports whether every listed peer's stream has delivered
+// an event or idle heartbeat at or past tsNs, i.e. no pre-tsNs backlog can
+// still arrive from it. A peer no longer tracked counts as caught up: it
+// cannot deliver a backlog anymore.
+func (ma *MetaAggregator) PeersCaughtUpTo(peers []pb.ServerAddress, tsNs int64) bool {
+	ma.peerWatermarksLock.Lock()
+	defer ma.peerWatermarksLock.Unlock()
+	for _, peer := range peers {
+		if ts, found := ma.peerWatermarks[peer]; found && ts < tsNs {
+			return false
+		}
+	}
+	return true
+}
+
 func (ma *MetaAggregator) HasRemotePeers() bool {
 	ma.peerChansLock.Lock()
 	defer ma.peerChansLock.Unlock()
+	return ma.hasRemotePeersLocked()
+}
 
+func (ma *MetaAggregator) hasRemotePeersLocked() bool {
 	for address := range ma.peerChans {
 		if address != ma.self {
 			return true
@@ -81,6 +319,30 @@ func (ma *MetaAggregator) HasRemotePeers() bool {
 	return false
 }
 
+// RemotePeerArrivedChan returns a channel closed when the aggregator learns
+// its first remote peer, or nil if one is already known.
+func (ma *MetaAggregator) RemotePeerArrivedChan() <-chan struct{} {
+	ma.peerChansLock.Lock()
+	defer ma.peerChansLock.Unlock()
+	if ma.hasRemotePeersLocked() {
+		return nil
+	}
+	return ma.remotePeerArrivedChanLocked()
+}
+
+// remotePeerArrivedChanLocked arms and returns the arrival channel. Caller must hold peerChansLock.
+func (ma *MetaAggregator) remotePeerArrivedChanLocked() <-chan struct{} {
+	if ma.remotePeerArrived == nil {
+		ma.remotePeerArrived = make(chan struct{})
+	}
+	return ma.remotePeerArrived
+}
+
+// noteRemotePeerArrivalLocked closes the arrival channel when a remote peer is added. Caller must hold peerChansLock.
+func (ma *MetaAggregator) noteRemotePeerArrivalLocked() {
+	ma.remotePeerArrived = closeWatermarkChan(ma.remotePeerArrived)
+}
+
 // HasPeer reports whether address is currently a tracked filer peer (or this
 // filer's own address). Callers use this to gate operations on known cluster
 // members.
@@ -98,11 +360,47 @@ func (ma *MetaAggregator) HasPeer(address pb.ServerAddress) bool {
 	return false
 }
 
+// Shutdown stops every peer subscription and waits for each to return,
+// letting the deferred offset save persist the last applied position before
+// the store closes. Without it a graceful restart resumes from the last
+// periodically-saved offset — up to a minute stale — and replays those
+// events over newer local state.
+func (ma *MetaAggregator) Shutdown() {
+	ma.peerChansLock.Lock()
+	ma.stopped = true
+	chans := ma.peerChans
+	ma.peerChans = make(map[pb.ServerAddress]chan struct{})
+	for _, stopChan := range chans {
+		close(stopChan)
+	}
+	ma.peerChansLock.Unlock()
+
+	// Wait without a cap: every blocking point in the subscribe loop is
+	// stop-aware, so a peer still running here is genuinely wedged and
+	// returning anyway would let Filer.Shutdown close the store under it and
+	// skip its deferred offset save.
+	done := make(chan struct{})
+	go func() {
+		ma.peerWg.Wait()
+		close(done)
+	}()
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-done:
+			return
+		case <-ticker.C:
+			glog.Warningf("meta aggregator shutdown: peer subscriptions still stopping")
+		}
+	}
+}
+
 func (ma *MetaAggregator) loopSubscribeToOneFiler(f *Filer, self pb.ServerAddress, peer pb.ServerAddress, startFrom time.Time, stopChan chan struct{}) {
 	lastTsNs := startFrom.UnixNano()
 	for {
 		glog.V(0).Infof("loopSubscribeToOneFiler read %s start from %v %d", peer, time.Unix(0, lastTsNs), lastTsNs)
-		nextLastTsNs, err := ma.doSubscribeToOneFiler(f, self, peer, lastTsNs)
+		nextLastTsNs, err := ma.doSubscribeToOneFiler(f, self, peer, lastTsNs, stopChan)
 
 		// check stopChan to see if we should stop
 		select {
@@ -122,11 +420,16 @@ func (ma *MetaAggregator) loopSubscribeToOneFiler(f *Filer, self pb.ServerAddres
 		if lastTsNs < nextLastTsNs {
 			lastTsNs = nextLastTsNs
 		}
-		time.Sleep(1733 * time.Millisecond)
+		select {
+		case <-stopChan:
+			glog.V(0).Infof("stop subscribing peer %s meta change", peer)
+			return
+		case <-time.After(1733 * time.Millisecond):
+		}
 	}
 }
 
-func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress, peer pb.ServerAddress, startFrom int64) (int64, error) {
+func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress, peer pb.ServerAddress, startFrom int64, stopChan <-chan struct{}) (int64, error) {
 
 	/*
 		Each filer reads the "filer.store.id", which is the store's signature when filer starts.
@@ -138,11 +441,34 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 
 	*/
 
-	var maybeReplicateMetadataChange func(*filer_pb.SubscribeMetadataResponse)
+	var maybeReplicateMetadataChange func(*filer_pb.SubscribeMetadataResponse) error
 	lastPersistTime := time.Now()
 	lastTsNs := startFrom
+	// replayFloorTsNs is the earliest event this session gave up replaying.
+	// The persisted offset and the reconnect resume point must stay behind
+	// it so the event is redelivered on the next subscribe instead of being
+	// skipped forever.
+	var replayFloorTsNs int64
+	persistableTsNs := func(tsNs int64) int64 {
+		if replayFloorTsNs > 0 && replayFloorTsNs-1 < tsNs {
+			return replayFloorTsNs - 1
+		}
+		return tsNs
+	}
 
-	peerSignature, err := ma.readFilerStoreSignature(peer)
+	// Everything below derives from ctx, cancelled when the peer is removed
+	// or the aggregator shuts down, so no stage can block past its stop.
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() {
+		select {
+		case <-stopChan:
+			cancel()
+		case <-ctx.Done():
+		}
+	}()
+
+	peerSignature, err := ma.readFilerStoreSignature(ctx, peer)
 	if err != nil {
 		return lastTsNs, fmt.Errorf("connecting to peer filer %s: %v", peer, err)
 	}
@@ -162,7 +488,7 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 			// different concept and can be set to arbitrary values.
 			preTraverseTime := time.Now()
 			glog.V(0).Infof("no previous offset for peer %s, starting full metadata sync", peer)
-			if traverseErr := ma.traversePeerMetadata(f, peer); traverseErr != nil {
+			if traverseErr := ma.traversePeerMetadata(ctx, f, peer); traverseErr != nil {
 				return lastTsNs, fmt.Errorf("initial metadata sync from %s: %v", peer, traverseErr)
 			}
 			lastTsNs = preTraverseTime.Add(-time.Minute).UnixNano()
@@ -174,11 +500,12 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 			return lastTsNs, fmt.Errorf("read offset for peer %s: %w", peer, err)
 		}
 		defer func(prevTsNs int64) {
-			if lastTsNs != prevTsNs && lastTsNs != lastPersistTime.UnixNano() {
-				if err := ma.updateOffset(f, peer, peerSignature, lastTsNs); err == nil {
-					glog.V(0).Infof("last sync time with %s at %v (%d)", peer, time.Unix(0, lastTsNs), lastTsNs)
+			saveTsNs := persistableTsNs(lastTsNs)
+			if saveTsNs != prevTsNs && lastTsNs != lastPersistTime.UnixNano() {
+				if err := ma.updateOffset(f, peer, peerSignature, saveTsNs); err == nil {
+					glog.V(0).Infof("last sync time with %s at %v (%d)", peer, time.Unix(0, saveTsNs), saveTsNs)
 				} else {
-					glog.Errorf("failed to save last sync time with %s at %v (%d)", peer, time.Unix(0, lastTsNs), lastTsNs)
+					glog.Errorf("failed to save last sync time with %s at %v (%d)", peer, time.Unix(0, saveTsNs), saveTsNs)
 				}
 			}
 		}(lastTsNs)
@@ -186,14 +513,23 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 		glog.V(0).Infof("follow peer: %v, last %v (%d)", peer, time.Unix(0, lastTsNs), lastTsNs)
 		var counter int64
 		var synced bool
-		maybeReplicateMetadataChange = func(event *filer_pb.SubscribeMetadataResponse) {
-			if err := Replay(f.Store, event); err != nil {
-				glog.Errorf("failed to reply metadata change from %v: %v", peer, err)
-				return
+		maybeReplicateMetadataChange = func(event *filer_pb.SubscribeMetadataResponse) error {
+			if err := replicateMetadataChange(f, peer, event, stopChan); err != nil {
+				if errors.Is(err, errPeerSubscriptionStopped) {
+					return err
+				}
+				// A failed event becomes a barrier the persisted offset and
+				// the reconnect resume point cannot pass, while the stream
+				// keeps flowing: blocking on an event that can never replay
+				// would stall every later event from this peer.
+				if replayFloorTsNs == 0 || event.TsNs < replayFloorTsNs {
+					replayFloorTsNs = event.TsNs
+				}
+				return nil
 			}
 			counter++
 			if lastPersistTime.Add(time.Minute).Before(time.Now()) {
-				if err := ma.updateOffset(f, peer, peerSignature, event.TsNs); err == nil {
+				if err := ma.updateOffset(f, peer, peerSignature, persistableTsNs(event.TsNs)); err == nil {
 					if event.TsNs < time.Now().Add(-2*time.Minute).UnixNano() {
 						glog.V(0).Infof("sync with %s progressed to: %v %0.2f/sec", peer, time.Unix(0, event.TsNs), float64(counter)/60.0)
 					} else if !synced {
@@ -206,6 +542,7 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 					glog.V(0).Infof("failed to update offset for %v: %v", peer, err)
 				}
 			}
+			return nil
 		}
 	}
 
@@ -222,15 +559,21 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 			return err
 		}
 		if maybeReplicateMetadataChange != nil {
-			maybeReplicateMetadataChange(event)
+			if err := maybeReplicateMetadataChange(event); err != nil {
+				return err
+			}
 		}
 		return nil
 	}
 
+	// The stream will deliver everything after lastTsNs, so the aggregated
+	// buffer is (still) complete for this peer up to that point.
+	ma.advancePeerWatermark(peer, lastTsNs)
+
 	glog.V(0).Infof("subscribing remote %s meta change: %v, clientId:%d", peer, time.Unix(0, lastTsNs), ma.filer.UniqueFilerId)
 	err = pb.WithFilerClient(true, 0, peer, ma.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
+		// ctx is cancelled on stopChan by the watch above; the blocking Recv
+		// below stops promptly on removal or shutdown.
 		atomic.AddInt32(&ma.filer.UniqueFilerEpoch, 1)
 		// Construct a log file reader that reads chunks via the peer filer's LookupVolume.
 		lookupFn := LookupFn(filerClient{client})
@@ -246,6 +589,8 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 			ClientEpoch:                  atomic.LoadInt32(&ma.filer.UniqueFilerEpoch),
 			ClientSupportsBatching:       true,
 			ClientSupportsMetadataChunks: true,
+			// Idle heartbeats keep a quiet peer from freezing the low-watermark.
+			ClientSupportsIdleHeartbeat: true,
 		})
 		if err != nil {
 			glog.V(0).Infof("SubscribeLocalMetadata %v: %v", peer, err)
@@ -253,12 +598,21 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 		}
 
 		processOne := func(event *filer_pb.SubscribeMetadataResponse) error {
+			// Bail promptly on stop; a cancelled stream may still deliver
+			// queued events while unwinding, and replaying them now only
+			// delays the offset save the shutdown is waiting on.
+			select {
+			case <-stopChan:
+				return errPeerSubscriptionStopped
+			default:
+			}
 			if err := processEventFn(event); err != nil {
 				glog.V(0).Infof("SubscribeLocalMetadata process %v: %v", event, err)
 				return fmt.Errorf("process %v: %w", event, err)
 			}
 			f.onMetadataChangeEvent(event)
 			lastTsNs = event.TsNs
+			ma.advancePeerWatermark(peer, event.TsNs)
 			return nil
 		}
 
@@ -288,7 +642,7 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 						return processOne(event)
 					})
 				if readErr != nil {
-					return fmt.Errorf("read log file refs from %s: %w", peer, readErr)
+					return fmt.Errorf("%w from %s: %w", pb.ErrLogFileRead, peer, readErr)
 				}
 				if lastTs > 0 {
 					lastTsNs = lastTs
@@ -301,29 +655,85 @@ func (ma *MetaAggregator) doSubscribeToOneFiler(f *Filer, self pb.ServerAddress,
 					return err
 				}
 			}
-			// Process any additional batched events. Mirror the envelope's nil
-			// guard: the server can fold a freshness signal (nil EventNotification)
-			// into the batched tail, and processOne dereferences it.
+			// Batched events, with the envelope's nil guard mirrored. A nested
+			// control message still carries watermark state - dropping it
+			// would make healthy flush progress look stalled.
 			for _, batchedEvent := range resp.Events {
+				if batchedEvent.FlushedTsNs > 0 {
+					ma.advancePeerFlushWatermark(peer, batchedEvent.FlushedTsNs)
+				}
 				if batchedEvent.EventNotification == nil {
+					if batchedEvent.TsNs > 0 {
+						ma.advancePeerWatermark(peer, batchedEvent.TsNs)
+					}
 					continue
 				}
 				if err := processOne(batchedEvent); err != nil {
 					return err
 				}
 			}
+			// Idle heartbeat: advance only the watermark, not lastTsNs, so a
+			// reconnect still resumes from the last real event.
+			if resp.EventNotification == nil && len(resp.Events) == 0 && resp.TsNs > 0 {
+				ma.advancePeerWatermark(peer, resp.TsNs)
+			}
+			if resp.FlushedTsNs > 0 {
+				ma.advancePeerFlushWatermark(peer, resp.FlushedTsNs)
+			}
 		}
 	})
-	return lastTsNs, err
+	return persistableTsNs(lastTsNs), err
 }
 
+// replicateMetadataChange retries transient Replay failures with bounded
+// backoff and reports the outcome. errPeerSubscriptionStopped is returned
+// when the subscription stops mid-retry so the caller aborts and the offset
+// save keeps the last completed event. A failure that outlives the retry
+// budget is counted and logged, then returned: the caller pins the peer's
+// offset at the event so a restart replays it rather than skipping it.
+func replicateMetadataChange(f *Filer, peer pb.ServerAddress, event *filer_pb.SubscribeMetadataResponse, stopChan <-chan struct{}) error {
+	waitTime := time.Second
+	var err error
+	for waitTime < util.RetryWaitTime {
+		select {
+		case <-stopChan:
+			return errPeerSubscriptionStopped
+		default:
+		}
+		if err = f.Replay(event); err == nil {
+			return nil
+		}
+		if !util.IsTransientError(err) {
+			break
+		}
+		glog.V(0).Infof("retry replicate metadata change from %s: %v", peer, err)
+		select {
+		case <-stopChan:
+			return errPeerSubscriptionStopped
+		case <-time.After(waitTime):
+		}
+		waitTime += waitTime / 2
+	}
+	stats.FilerMetaAggregatorReplayFailures.WithLabelValues(string(peer)).Inc()
+	name := event.GetEventNotification().GetNewEntry().GetName()
+	if name == "" {
+		name = event.GetEventNotification().GetOldEntry().GetName()
+	}
+	glog.Errorf("giving up replicating metadata change from %s for %s/%s (ts=%d): %v", peer, event.Directory, name, event.TsNs, err)
+	return err
+}
+
+// errPeerSubscriptionStopped ends event processing once the subscription's
+// stop channel closed.
+var errPeerSubscriptionStopped = errors.New("peer subscription stopped")
+
 // traversePeerMetadata does a full BFS traversal of a peer filer's metadata
 // and inserts all entries into the local store. This is used when a filer
 // connects to a peer for the first time and needs to bootstrap pre-existing data.
-func (ma *MetaAggregator) traversePeerMetadata(f *Filer, peer pb.ServerAddress) error {
+// The ctx cancels on the peer's stop channel so a shutdown does not have to
+// out-wait a long traversal.
+func (ma *MetaAggregator) traversePeerMetadata(ctx context.Context, f *Filer, peer pb.ServerAddress) error {
 	return pb.WithFilerClient(true, 0, peer, ma.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
-		ctx, cancel := context.WithCancel(context.Background())
-		defer cancel()
 		stream, err := client.TraverseBfsMetadata(ctx, &filer_pb.TraverseBfsMetadataRequest{
 			Directory:        "/",
 			ExcludedPrefixes: []string{SystemLogDir},
@@ -343,22 +753,17 @@ func (ma *MetaAggregator) traversePeerMetadata(f *Filer, peer pb.ServerAddress)
 			if resp.Entry == nil {
 				continue
 			}
-			fullpath := util.Join(resp.Directory, resp.Entry.Name)
 			entry := FromPbEntry(resp.Directory, resp.Entry)
-			if insertErr := f.Store.InsertEntry(context.Background(), entry); insertErr != nil {
-				// Entry may already exist (root dir, or partial previous bootstrap).
-				existing, findErr := f.Store.FindEntry(context.Background(), entry.FullPath)
-				if findErr != nil {
-					return fmt.Errorf("insert entry %s: %w", fullpath, insertErr)
-				}
-				// Only overwrite if the peer's entry is newer.
-				if entry.Attr.Mtime.After(existing.Attr.Mtime) {
-					if updateErr := f.Store.UpdateEntry(context.Background(), entry); updateErr != nil {
-						return fmt.Errorf("update entry %s: %w", fullpath, updateErr)
-					}
-				} else {
-					glog.V(1).Infof("skip older peer entry %s (peer mtime %v <= local mtime %v)", fullpath, entry.Attr.Mtime, existing.Attr.Mtime)
-				}
+			// Order on the sender's per-path commit timestamp, not the
+			// entry's mtime — mtime is client-settable and does not track
+			// when the peer committed the change. Peers that predate the
+			// field send 0 and fall back to mtime.
+			peerTsNs := resp.EntryTsNs
+			if peerTsNs == 0 {
+				peerTsNs = entry.Attr.Mtime.UnixNano()
+			}
+			if applyErr := f.applyTraversedEntry(ctx, entry, peerTsNs); applyErr != nil {
+				return applyErr
 			}
 			count++
 			if count%10000 == 0 {
@@ -370,9 +775,53 @@ func (ma *MetaAggregator) traversePeerMetadata(f *Filer, peer pb.ServerAddress)
 	})
 }
 
-func (ma *MetaAggregator) readFilerStoreSignature(peer pb.ServerAddress) (sig int32, err error) {
+// applyTraversedEntry merges one bootstrap entry under the path's replay
+// locks, keeping local state when its commit is newer than the sender's —
+// most importantly a delete, whose tombstone must not let the bootstrap
+// resurrect the path. An applied entry records the sender's commit time so a
+// later peer replay orders against it rather than the entry's mtime.
+func (f *Filer) applyTraversedEntry(ctx context.Context, entry *Entry, peerTsNs int64) error {
+	unlock := f.lockReplayPaths(entry.FullPath, "")
+	defer unlock()
+	localTsNs, err := f.localCommitTsNs(ctx, entry.FullPath)
+	if err != nil {
+		return fmt.Errorf("check local state for %s: %w", entry.FullPath, err)
+	}
+	if localTsNs >= peerTsNs {
+		if localTsNs != 0 {
+			return nil
+		}
+		// Zero timestamps carry no order: keep the path only when an entry
+		// exists locally — a missing one takes the peer's copy, or an
+		// epoch-dated entry from a peer reporting no commit time is dropped.
+		if f.Store == nil {
+			return nil
+		}
+		local, findErr := f.Store.FindEntry(ctx, entry.FullPath)
+		if findErr != nil && !errors.Is(findErr, filer_pb.ErrNotFound) {
+			return fmt.Errorf("check local state for %s: %w", entry.FullPath, findErr)
+		}
+		if local != nil {
+			return nil
+		}
+	}
+	if insertErr := f.Store.InsertEntry(ctx, entry); insertErr != nil {
+		// Entry already exists (root dir, or partial previous bootstrap);
+		// the lock kept the check above current, so the peer commit is newer.
+		if _, findErr := f.Store.FindEntry(ctx, entry.FullPath); findErr != nil {
+			return fmt.Errorf("insert entry %s: %w", entry.FullPath, insertErr)
+		}
+		if updateErr := f.Store.UpdateEntry(ctx, entry); updateErr != nil {
+			return fmt.Errorf("update entry %s: %w", entry.FullPath, updateErr)
+		}
+	}
+	f.notePathChange(entry.FullPath, peerTsNs, false)
+	return nil
+}
+
+func (ma *MetaAggregator) readFilerStoreSignature(ctx context.Context, peer pb.ServerAddress) (sig int32, err error) {
 	err = pb.WithFilerClient(false, 0, peer, ma.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
-		resp, err := client.GetFilerConfiguration(context.Background(), &filer_pb.GetFilerConfigurationRequest{})
+		resp, err := client.GetFilerConfiguration(ctx, &filer_pb.GetFilerConfigurationRequest{})
 		if err != nil {
 			return err
 		}
diff --git a/weed/filer/meta_aggregator_replay_test.go b/weed/filer/meta_aggregator_replay_test.go
new file mode 100644
index 0000000000..efbc9968f2
--- /dev/null
+++ b/weed/filer/meta_aggregator_replay_test.go
@@ -0,0 +1,1571 @@
+package filer
+
+import (
+	"context"
+	"errors"
+	"os"
+	"sync"
+	"testing"
+	"time"
+
+	dto "github.com/prometheus/client_model/go"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// newReplayTestFiler builds the minimum Filer Replay needs over a stub store.
+func newReplayTestFiler(store FilerStore) *Filer {
+	return &Filer{
+		Store:          NewFilerStoreWrapper(store),
+		EntryLockTable: util.NewLockTable[util.FullPath](),
+	}
+}
+
+// flakyReplayStore fails InsertEntry for its first failUntil calls, then
+// delegates to the embedded stubFilerStore.
+type flakyReplayStore struct {
+	*stubFilerStore
+	countMu   sync.Mutex
+	failUntil int
+	err       error
+	attempts  int
+}
+
+func (s *flakyReplayStore) InsertEntry(ctx context.Context, entry *Entry) error {
+	s.countMu.Lock()
+	s.attempts++
+	fail := s.attempts <= s.failUntil
+	s.countMu.Unlock()
+	if fail {
+		return s.err
+	}
+	return s.stubFilerStore.InsertEntry(ctx, entry)
+}
+
+func (s *flakyReplayStore) attemptCount() int {
+	s.countMu.Lock()
+	defer s.countMu.Unlock()
+	return s.attempts
+}
+
+func replayFailureCount(t *testing.T, peer pb.ServerAddress) float64 {
+	t.Helper()
+	var m dto.Metric
+	if err := stats.FilerMetaAggregatorReplayFailures.WithLabelValues(string(peer)).Write(&m); err != nil {
+		t.Fatalf("read counter: %v", err)
+	}
+	return m.GetCounter().GetValue()
+}
+
+func quotaChangeEvent(bucket string, quota int64) *filer_pb.SubscribeMetadataResponse {
+	return &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: bucket, IsDirectory: true, Quota: quota},
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+}
+
+// The old body logged a Replay error and returned, so one transient failure
+// permanently diverged the entry from the peer.
+func TestReplicateMetadataChangeRetriesTransientFailure(t *testing.T) {
+	// int64: untyped, the value defaults to int and overflows a 32-bit build
+	const wantQuota int64 = 131072 << 20
+
+	store := &flakyReplayStore{
+		stubFilerStore: newStubFilerStore(),
+		failUntil:      1,
+		err:            errors.New("i/o timeout talking to store"),
+	}
+	peer := pb.ServerAddress("peer-transient:1")
+	f := newReplayTestFiler(store)
+
+	if err := replicateMetadataChange(f, peer, quotaChangeEvent("my-bucket", wantQuota), nil); err != nil {
+		t.Fatalf("replicateMetadataChange: %v", err)
+	}
+
+	inserted, err := store.FindEntry(context.Background(), util.NewFullPath("/buckets", "my-bucket"))
+	if err != nil {
+		t.Fatal("expected the entry to be inserted once the transient failure is retried past")
+	}
+	if inserted.Quota != wantQuota {
+		t.Fatalf("quota = %d, want %d", inserted.Quota, wantQuota)
+	}
+	if got := store.attemptCount(); got < 2 {
+		t.Fatalf("attempts = %d, want at least 2", got)
+	}
+}
+
+// An event that can never replay must fail fast instead of blocking the
+// subscribe stream, and must be counted so the divergence is not silent.
+func TestReplicateMetadataChangeGivesUpLoudlyOnPermanentFailure(t *testing.T) {
+	store := &flakyReplayStore{
+		stubFilerStore: newStubFilerStore(),
+		failUntil:      1 << 30,
+		err:            errors.New("entry checksum mismatch"),
+	}
+	peer := pb.ServerAddress("peer-permanent:1")
+	f := newReplayTestFiler(store)
+
+	before := replayFailureCount(t, peer)
+
+	err := replicateMetadataChange(f, peer, quotaChangeEvent("poison-bucket", 65536<<20), nil)
+	if err == nil {
+		t.Fatal("expected the exhausted replay error so the caller can pin the peer offset at the failed event")
+	}
+
+	if got := store.attemptCount(); got != 1 {
+		t.Fatalf("attempts = %d, want exactly 1: a non-transient error must fail fast, not retry", got)
+	}
+	if got := replayFailureCount(t, peer); got != before+1 {
+		t.Fatalf("FilerMetaAggregatorReplayFailures[%s] = %v, want %v", peer, got, before+1)
+	}
+}
+
+func overwriteEvent(dir, name string, tsNs int64, content string) *filer_pb.SubscribeMetadataResponse {
+	return &filer_pb.SubscribeMetadataResponse{
+		Directory: dir,
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: name},
+			NewEntry: &filer_pb.Entry{Name: name, Content: []byte(content)},
+		},
+		TsNs: tsNs,
+	}
+}
+
+func deleteEvent(dir, name string, tsNs int64) *filer_pb.SubscribeMetadataResponse {
+	return &filer_pb.SubscribeMetadataResponse{
+		Directory: dir,
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: name},
+		},
+		TsNs: tsNs,
+	}
+}
+
+func TestReplaySkipsEventOlderThanLocalEntry(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+	store.entries[string(path)] = &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now},
+		Content:  []byte("newer local write"),
+	}
+
+	if err := f.Replay(overwriteEvent("/dir", "file", now.Add(-time.Minute).UnixNano(), "old replayed version")); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	entry, err := store.FindEntry(context.Background(), path)
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if string(entry.Content) != "newer local write" {
+		t.Fatalf("content = %q, want local write kept", entry.Content)
+	}
+}
+
+func TestReplayAppliesEventNewerThanLocalEntry(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+	store.entries[string(path)] = &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now.Add(-time.Minute)},
+		Content:  []byte("old local write"),
+	}
+
+	if err := f.Replay(overwriteEvent("/dir", "file", now.UnixNano(), "newer peer write")); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	entry, err := store.FindEntry(context.Background(), path)
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if string(entry.Content) != "newer peer write" {
+		t.Fatalf("content = %q, want peer write applied", entry.Content)
+	}
+}
+
+func TestReplaySkipsDeleteOlderThanLocalEntry(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+	store.entries[string(path)] = &Entry{FullPath: path, Attr: Attr{Mtime: now}}
+
+	if err := f.Replay(deleteEvent("/dir", "file", now.Add(-time.Minute).UnixNano())); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), path); err != nil {
+		t.Fatalf("newer local entry must survive a stale delete: %v", err)
+	}
+}
+
+func TestReplayAppliesNewerDelete(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+	store.entries[string(path)] = &Entry{FullPath: path, Attr: Attr{Mtime: now.Add(-time.Minute)}}
+
+	if err := f.Replay(deleteEvent("/dir", "file", now.UnixNano())); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), path); err == nil {
+		t.Fatal("newer delete must remove the local entry")
+	}
+}
+
+// A move event touches two paths; the local check applies to each side
+// independently, so a newer destination is kept while the source is removed.
+func TestReplayMoveChecksEachPathSeparately(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	oldPath := util.NewFullPath("/a", "file")
+	newPath := util.NewFullPath("/b", "file")
+	store.entries[string(oldPath)] = &Entry{FullPath: oldPath, Attr: Attr{Mtime: now.Add(-time.Minute)}}
+	store.entries[string(newPath)] = &Entry{FullPath: newPath, Attr: Attr{Mtime: now}, Content: []byte("kept")}
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/a",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      &filer_pb.Entry{Name: "file"},
+			NewEntry:      &filer_pb.Entry{Name: "file"},
+			NewParentPath: "/b",
+		},
+		TsNs: now.Add(-time.Minute).UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), oldPath); err == nil {
+		t.Fatal("old source entry should be deleted")
+	}
+	entry, err := store.FindEntry(context.Background(), newPath)
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if string(entry.Content) != "kept" {
+		t.Fatalf("content = %q, want newer destination kept", entry.Content)
+	}
+}
+
+// A local delete leaves a recorded tombstone, so a replayed create older than
+// the delete must not resurrect the path even though no entry remains to
+// compare against.
+func TestReplaySkipsCreateOlderThanLocalDelete(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+
+	// The delete removed the entry; its commit record survives.
+	f.notePathChange(path, now.UnixNano(), true)
+
+	createEvent := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "file", Content: []byte("stale resurrect")},
+		},
+		TsNs: now.Add(-time.Minute).UnixNano(),
+	}
+	if err := f.Replay(createEvent); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), path); err == nil {
+		t.Fatal("stale replayed create resurrected a locally deleted entry")
+	}
+}
+
+// A deleted directory covers its children: a bulk drop emits no per-child
+// events, so the tombstone on the ancestor is what a replayed child create
+// must check.
+func TestReplaySkipsCreateUnderDeletedAncestor(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+
+	f.notePathChange("/dir", now.UnixNano(), true)
+
+	createEvent := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "child", Content: []byte("stale")},
+		},
+		TsNs: now.Add(-time.Minute).UnixNano(),
+	}
+	if err := f.Replay(createEvent); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), "/dir/child"); err == nil {
+		t.Fatal("stale replayed create resurrected a child of a deleted directory")
+	}
+}
+
+// A recorded commit timestamp orders replay, not the entry's mtime: a rename
+// keeps the source's mtime on the destination, and a mounted client can set
+// mtime arbitrarily, so an entry whose mtime postdates the event must still
+// be overwritten when its commit record is older.
+func TestReplayAppliesWhenCommitRecordIsOlderThanFutureMtime(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/b", "x")
+	store.entries[string(path)] = &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now.Add(time.Hour)}, // future mtime, e.g. client-set or kept from a rename source
+		Content:  []byte("old destination"),
+	}
+	// The last committed change predates the event.
+	f.notePathChange(path, now.Add(-time.Minute).UnixNano(), false)
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/a",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:      &filer_pb.Entry{Name: "x"},
+			NewEntry:      &filer_pb.Entry{Name: "x", Content: []byte("renamed in")},
+			NewParentPath: "/b",
+		},
+		TsNs: now.UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	entry, err := store.FindEntry(context.Background(), path)
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if string(entry.Content) != "renamed in" {
+		t.Fatalf("content = %q, want the rename destination applied", entry.Content)
+	}
+}
+
+// A store read failure is not a not-found: the replayed change must not be
+// applied on the guess that no newer local entry exists.
+func TestReplayPropagatesLookupError(t *testing.T) {
+	store := newStubFilerStore()
+	store.findErr = errors.New("store read failed")
+	f := newReplayTestFiler(store)
+
+	err := f.Replay(overwriteEvent("/dir", "file", time.Now().UnixNano(), "v"))
+	if err == nil {
+		t.Fatal("expected Replay to propagate the FindEntry failure")
+	}
+}
+
+// The check and the mutation share the per-path entry lock, so a local write
+// holding that lock cannot be split by a replayed change.
+func TestReplaySerializesWithEntryLock(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+	store.entries[string(path)] = &Entry{FullPath: path, Attr: Attr{Mtime: now}}
+
+	// A local mutation holding the path lock; a replay started behind it
+	// sees the recorded commit and skips.
+	held := f.EntryLockTable.AcquireLock("test local write", path, util.ExclusiveLock)
+	f.notePathChange(path, now.UnixNano(), false)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- f.Replay(overwriteEvent("/dir", "file", now.Add(-time.Minute).UnixNano(), "stale"))
+	}()
+	select {
+	case <-done:
+		t.Fatal("replay finished while the path lock was still held")
+	case <-time.After(50 * time.Millisecond):
+	}
+	f.EntryLockTable.ReleaseLock(path, held)
+	if err := <-done; err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	entry, err := store.FindEntry(context.Background(), path)
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if entry.Content != nil {
+		t.Fatalf("content = %q, want local entry kept", entry.Content)
+	}
+}
+
+// A closed stop channel must abort the retry loop with
+// errPeerSubscriptionStopped so the subscription tears down and the offset
+// save keeps the last completed event instead of skipping this one.
+func TestReplicateMetadataChangeAbortsOnStop(t *testing.T) {
+	store := &flakyReplayStore{
+		stubFilerStore: newStubFilerStore(),
+		failUntil:      1 << 30,
+		err:            errors.New("i/o timeout talking to store"),
+	}
+	peer := pb.ServerAddress("peer-stopped:1")
+	f := newReplayTestFiler(store)
+
+	stopChan := make(chan struct{})
+	close(stopChan)
+	err := replicateMetadataChange(f, peer, quotaChangeEvent("stuck-bucket", 1<<20), stopChan)
+	if !errors.Is(err, errPeerSubscriptionStopped) {
+		t.Fatalf("err = %v, want errPeerSubscriptionStopped", err)
+	}
+	if got := store.attemptCount(); got != 0 {
+		t.Fatalf("attempts = %d, want 0: a stopped subscription must not replay", got)
+	}
+}
+
+// Commit-record keys must stay small: SQL KV stores keep the key suffix in a
+// VARCHAR(766) column, so a raw path over ~578 bytes silently drops the
+// record (the insert fails and the fallback update touches no row).
+func TestMetaPathKeyFixedSizeForLongPaths(t *testing.T) {
+	path := util.NewFullPath("/", string(make([]rune, 600)))
+	for _, p := range []util.FullPath{"/a", path} {
+		if got := len(metaPathKey(metaPathTsPrefix, p)); got != len(metaPathTsPrefix)+16 {
+			t.Fatalf("metaPathKey(%d-byte path) = %d bytes, want %d", len(p), got, len(metaPathTsPrefix)+16)
+		}
+	}
+}
+
+// Exact-path locking alone lets a replayed child create slip between a local
+// ancestor delete's tombstone check and the sweep: replay locks every
+// ancestor too, so it waits for the delete's lock and then sees the
+// tombstone.
+func TestReplaySerializesWithAncestorLock(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+
+	now := time.Now()
+	child := util.NewFullPath("/dir", "file")
+	held := f.EntryLockTable.AcquireLock("test local delete", "/dir", util.ExclusiveLock)
+	f.notePathChange("/dir", now.UnixNano(), true)
+
+	createEvent := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "file", Content: []byte("stale resurrect")},
+		},
+		TsNs: now.Add(-time.Minute).UnixNano(),
+	}
+	done := make(chan error, 1)
+	go func() {
+		done <- f.Replay(createEvent)
+	}()
+	select {
+	case <-done:
+		t.Fatal("replay finished while the ancestor lock was still held")
+	case <-time.After(50 * time.Millisecond):
+	}
+	f.EntryLockTable.ReleaseLock("/dir", held)
+	if err := <-done; err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), child); err == nil {
+		t.Fatal("stale replayed create resurrected a child of a locally deleted directory")
+	}
+}
+
+// Bootstrap ordering uses the sender's commit timestamp: a local commit
+// newer than the traversed entry keeps its state even when the peer entry's
+// mtime is far in the future.
+func TestBootstrapSkipsPeerEntryBehindLocalDelete(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+
+	f.notePathChange(path, now.UnixNano(), true)
+
+	entry := &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now.Add(time.Hour)}, // client-settable, must not win
+		Content:  []byte("stale peer entry"),
+	}
+	if err := f.applyTraversedEntry(context.Background(), entry, now.Add(-time.Minute).UnixNano()); err != nil {
+		t.Fatalf("applyTraversedEntry: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), path); err == nil {
+		t.Fatal("bootstrap resurrected a path newer local delete covered")
+	}
+}
+
+// The bug this guards: a peer entry committed recently but stamped with an
+// old client mtime must still apply over an absent-or-older local commit.
+func TestBootstrapAppliesPeerCommitNewerThanLocal(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+
+	entry := &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now.Add(-time.Hour)}, // old client-set mtime
+		Content:  []byte("fresh peer write"),
+	}
+	if err := f.applyTraversedEntry(context.Background(), entry, now.UnixNano()); err != nil {
+		t.Fatalf("applyTraversedEntry: %v", err)
+	}
+	got, err := store.FindEntry(context.Background(), path)
+	if err != nil {
+		t.Fatalf("peer entry with newer commit must bootstrap: %v", err)
+	}
+	if string(got.Content) != "fresh peer write" {
+		t.Fatalf("content = %q, want peer entry applied", got.Content)
+	}
+}
+
+// A bootstrap-applied entry records the sender's commit timestamp, so a
+// replayed event older than it — but newer than the entry's mtime — is
+// still skipped.
+func TestBootstrapAppliedCommitBlocksStaleReplay(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+
+	entry := &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now.Add(-time.Hour)},
+		Content:  []byte("fresh peer write"),
+	}
+	if err := f.applyTraversedEntry(context.Background(), entry, now.UnixNano()); err != nil {
+		t.Fatalf("applyTraversedEntry: %v", err)
+	}
+	if err := f.Replay(overwriteEvent("/dir", "file", now.Add(-time.Minute).UnixNano(), "stale replay")); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	got, _ := store.FindEntry(context.Background(), path)
+	if string(got.Content) != "fresh peer write" {
+		t.Fatalf("content = %q, stale replay must not overwrite the bootstrap entry", got.Content)
+	}
+}
+
+// An existing local entry is replaced only when the peer commit is newer —
+// not when its mtime happens to be.
+func TestBootstrapUpdatesExistingByCommitTime(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+
+	store.entries[string(path)] = &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now.Add(time.Hour)}, // future mtime, e.g. client-set
+		Content:  []byte("old local write"),
+	}
+	f.notePathChange(path, now.Add(-time.Minute).UnixNano(), false)
+
+	entry := &Entry{
+		FullPath: path,
+		Attr:     Attr{Mtime: now.Add(-time.Hour)},
+		Content:  []byte("newer peer commit"),
+	}
+	if err := f.applyTraversedEntry(context.Background(), entry, now.UnixNano()); err != nil {
+		t.Fatalf("applyTraversedEntry: %v", err)
+	}
+	got, _ := store.FindEntry(context.Background(), path)
+	if string(got.Content) != "newer peer commit" {
+		t.Fatalf("content = %q, newer peer commit must update despite the future local mtime", got.Content)
+	}
+}
+
+// A missing local entry has no commit time to order against: the peer copy
+// must apply even when both sides are timestamp-less — an epoch-dated entry
+// from a peer that predates EntryTsNs is still bootstrapped, while an
+// existing zero-mtime local entry keeps its place.
+func TestBootstrapCopiesMissingEntryWithoutCommitTime(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	missing := util.NewFullPath("/dir", "missing")
+	existing := util.NewFullPath("/dir", "existing")
+
+	store.entries[string(existing)] = &Entry{
+		FullPath: existing,
+		Attr:     Attr{Mtime: time.Unix(0, 0)},
+		Content:  []byte("zero-mtime local entry"),
+	}
+	for _, path := range []util.FullPath{missing, existing} {
+		entry := &Entry{
+			FullPath: path,
+			Attr:     Attr{Mtime: time.Unix(0, 0)},
+			Content:  []byte("epoch-dated peer entry"),
+		}
+		if err := f.applyTraversedEntry(context.Background(), entry, 0); err != nil {
+			t.Fatalf("applyTraversedEntry %s: %v", path, err)
+		}
+	}
+	got, err := store.FindEntry(context.Background(), missing)
+	if err != nil {
+		t.Fatalf("missing local entry must take the peer copy: %v", err)
+	}
+	if string(got.Content) != "epoch-dated peer entry" {
+		t.Fatalf("content = %q, want peer entry applied", got.Content)
+	}
+	if got, _ := store.FindEntry(context.Background(), existing); string(got.Content) != "zero-mtime local entry" {
+		t.Fatalf("content = %q, existing local entry must be kept", got.Content)
+	}
+}
+
+// A delete whose commit record failed to persist still blocks a stale
+// replayed create: the pending record stands in until the retry lands it.
+func TestPendingDeleteRecordBlocksStaleReplay(t *testing.T) {
+	store := newStubFilerStore()
+	store.setKvPutErr(errors.New("kv store unreachable"))
+	f := newReplayTestFiler(store)
+	f.flushCtx, f.flushCancel = context.WithCancel(context.Background())
+	defer f.flushCancel()
+	now := time.Now()
+	path := util.NewFullPath("/dir", "file")
+
+	// The delete already committed; only its ordering record failed.
+	f.notePathChange(path, now.UnixNano(), true)
+
+	createEvent := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "file", Content: []byte("stale resurrect")},
+		},
+		TsNs: now.Add(-time.Minute).UnixNano(),
+	}
+	if err := f.Replay(createEvent); err != nil {
+		t.Fatalf("Replay: %v", err)
+	}
+	if _, err := store.FindEntry(context.Background(), path); err == nil {
+		t.Fatal("stale create resurrected a path whose delete record is still pending")
+	}
+}
+
+// The failed record write retries until it lands, then leaves the pending set.
+func TestPendingCommitRecordRepairs(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	f.flushCtx, f.flushCancel = context.WithCancel(context.Background())
+	defer f.flushCancel()
+	path := util.NewFullPath("/dir", "file")
+
+	store.setKvPutErr(errors.New("kv store unreachable"))
+	f.notePathChange(path, 100, true)
+	if _, loaded := f.metaTsPending.Load(string(path)); !loaded {
+		t.Fatal("failed record write must stay pending")
+	}
+	store.setKvPutErr(nil)
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, loaded := f.metaTsPending.Load(string(path)); !loaded {
+			ts, found, err := f.kvReadTsNs(context.Background(), metaPathKey(metaPathDelPrefix, path))
+			if err != nil || !found || ts != 100 {
+				t.Fatalf("delete record after repair: ts=%v found=%v err=%v", ts, found, err)
+			}
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatal("pending record was not repaired")
+}
+
+// CommitTsNs reports the recorded commit time over the entry mtime, and a
+// still-pending record over both.
+func TestCommitTsNsPrefersRecordAndPending(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	path := util.NewFullPath("/dir", "file")
+
+	if got, err := f.CommitTsNs(context.Background(), path, 7); err != nil || got != 7 {
+		t.Fatalf("no record: CommitTsNs = %d, %v; want fallback 7", got, err)
+	}
+	f.notePathChange(path, 50, false)
+	if got, err := f.CommitTsNs(context.Background(), path, 7); err != nil || got != 50 {
+		t.Fatalf("recorded: CommitTsNs = %d, %v; want 50", got, err)
+	}
+	pending := &metaTsPendingRec{}
+	pending.changeTsNs.Store(80)
+	f.metaTsPending.Store(string(path), pending)
+	if got, err := f.CommitTsNs(context.Background(), path, 7); err != nil || got != 80 {
+		t.Fatalf("pending: CommitTsNs = %d, %v; want 80", got, err)
+	}
+}
+
+// A successful write discharges what the pending record owed before it, so a
+// repair pass can never put an older timestamp back over it.
+func TestPendingCommitRecordDischargedByNewerWrite(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	f.flushCtx, f.flushCancel = context.WithCancel(context.Background())
+	defer f.flushCancel()
+	path := util.NewFullPath("/dir", "file")
+
+	store.setKvPutErr(errors.New("kv store unreachable"))
+	f.notePathChange(path, 100, false)
+	store.setKvPutErr(nil)
+	f.notePathChange(path, 200, false)
+
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, loaded := f.metaTsPending.Load(string(path)); !loaded {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	ts, found, err := f.kvReadTsNs(context.Background(), metaPathKey(metaPathTsPrefix, path))
+	if err != nil || !found || ts != 200 {
+		t.Fatalf("MpTs after repair = %v, %v, %v; want 200", ts, found, err)
+	}
+}
+
+// A failed delete record keeps its own time even when a later failed change
+// merges into the pending record: the repair must not stamp the delete at
+// the newer change's time.
+func TestPendingDeleteRecordKeepsItsTime(t *testing.T) {
+	store := newStubFilerStore()
+	store.setKvPutErr(errors.New("kv store unreachable"))
+	f := newReplayTestFiler(store)
+	f.flushCtx, f.flushCancel = context.WithCancel(context.Background())
+	defer f.flushCancel()
+	path := util.NewFullPath("/dir", "file")
+
+	f.notePathChange(path, 100, true)
+	f.notePathChange(path, 200, false)
+	store.setKvPutErr(nil)
+
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if _, loaded := f.metaTsPending.Load(string(path)); !loaded {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	if ts, found, err := f.kvReadTsNs(context.Background(), metaPathKey(metaPathTsPrefix, path)); err != nil || !found || ts != 200 {
+		t.Fatalf("MpTs = %v, %v, %v; want 200", ts, found, err)
+	}
+	if ts, found, err := f.kvReadTsNs(context.Background(), metaPathKey(metaPathDelPrefix, path)); err != nil || !found || ts != 100 {
+		t.Fatalf("MpDl = %v, %v, %v; want 100", ts, found, err)
+	}
+}
+
+// A replayed directory delete must remove the local subtree too: the origin
+// only emits the directory's own key, and children the peer holds that the
+// origin never listed would orphan under the missing parent.
+func TestReplayDirectoryDeleteSweepsLocalChildren(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	ctx := context.Background()
+
+	put := func(path string, isDir bool) {
+		e := &Entry{FullPath: util.FullPath(path)}
+		if isDir {
+			e.Attr.Mode = os.ModeDir
+		}
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatalf("insert %s: %v", path, err)
+		}
+	}
+	put("/d", true)
+	put("/d/a.txt", false)
+	put("/d/sub", true)
+	put("/d/sub/nested.txt", false)
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+
+	for _, path := range []string{"/d", "/d/a.txt", "/d/sub", "/d/sub/nested.txt"} {
+		if _, err := store.FindEntry(ctx, util.FullPath(path)); !errors.Is(err, filer_pb.ErrNotFound) {
+			t.Fatalf("expected %s gone after replayed directory delete, got %v", path, err)
+		}
+	}
+}
+
+// The sweep locks each child under locks Replay already holds, so it cannot
+// wait on a child a local write holds — a rename could hold the child while
+// waiting on one of the replayed paths. Contention fails the replay instead,
+// and a retry after the local write sweeps normally.
+func TestReplaySweepFailsOnChildLockContention(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	ctx := context.Background()
+
+	if err := store.InsertEntry(ctx, &Entry{FullPath: "/d", Attr: Attr{Mode: os.ModeDir}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := store.InsertEntry(ctx, &Entry{FullPath: "/d/a.txt"}); err != nil {
+		t.Fatal(err)
+	}
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "d", IsDirectory: true},
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+
+	held := f.EntryLockTable.AcquireLock("test local write", "/d/a.txt", util.ExclusiveLock)
+	if err := f.Replay(event); err == nil {
+		f.EntryLockTable.ReleaseLock("/d/a.txt", held)
+		t.Fatal("replay succeeded while a child lock was held by a local write")
+	}
+	f.EntryLockTable.ReleaseLock("/d/a.txt", held)
+
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay after the local write: %v", err)
+	}
+	for _, path := range []string{"/d", "/d/a.txt"} {
+		if _, err := store.FindEntry(ctx, util.FullPath(path)); !errors.Is(err, filer_pb.ErrNotFound) {
+			t.Fatalf("expected %s gone after the retried delete, got %v", path, err)
+		}
+	}
+}
+
+func TestReplayFileDeleteKeepsSiblingEntries(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	ctx := context.Background()
+
+	dir := &Entry{FullPath: "/d", Attr: Attr{Mode: os.ModeDir}}
+	if err := store.InsertEntry(ctx, dir); err != nil {
+		t.Fatal(err)
+	}
+	for _, name := range []string{"gone.txt", "kept.txt"} {
+		if err := store.InsertEntry(ctx, &Entry{FullPath: util.NewFullPath("/d", name)}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/d",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "gone.txt"},
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+	if _, err := store.FindEntry(ctx, "/d/gone.txt"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("expected deleted file gone, got %v", err)
+	}
+	if _, err := store.FindEntry(ctx, "/d/kept.txt"); err != nil {
+		t.Fatalf("expected sibling kept, got %v", err)
+	}
+}
+
+func TestReplayDirectoryDeleteKeepsNewerChildren(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	ctx := context.Background()
+
+	eventTs := time.Now().UnixNano()
+	put := func(path string, isDir bool, mtime time.Time) {
+		e := &Entry{FullPath: util.FullPath(path), Attr: Attr{Mtime: mtime}}
+		if isDir {
+			e.Attr.Mode = os.ModeDir
+		}
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatalf("insert %s: %v", path, err)
+		}
+	}
+	old := time.Unix(1600000000, 0)
+	newer := time.Unix(0, eventTs).Add(time.Second)
+	put("/d", true, old)
+	put("/d/old.txt", false, old)
+	put("/d/sub", true, old)
+	put("/d/sub/newer.txt", false, newer)
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: eventTs,
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+
+	if _, err := store.FindEntry(ctx, "/d/old.txt"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("older child should be swept, got %v", err)
+	}
+	for _, path := range []string{"/d", "/d/sub", "/d/sub/newer.txt"} {
+		if _, err := store.FindEntry(ctx, util.FullPath(path)); err != nil {
+			t.Fatalf("newer child and its ancestors should survive: %s: %v", path, err)
+		}
+	}
+}
+
+// A directory kept for newer descendants still records the delete: a stale
+// create replayed later for another child must be fenced by it.
+func TestReplayKeptDirectoryDeleteFencesStaleCreates(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	ctx := context.Background()
+
+	eventTs := time.Now().UnixNano()
+	old := time.Unix(1600000000, 0)
+	newer := time.Unix(0, eventTs).Add(time.Second)
+	put := func(path string, isDir bool, mtime time.Time) {
+		e := &Entry{FullPath: util.FullPath(path), Attr: Attr{Mtime: mtime}}
+		if isDir {
+			e.Attr.Mode = os.ModeDir
+		}
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatalf("insert %s: %v", path, err)
+		}
+	}
+	put("/d", true, old)
+	put("/d/newer.txt", false, newer)
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "d", IsDirectory: true},
+		},
+		TsNs: eventTs,
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+	if _, err := store.FindEntry(ctx, "/d"); err != nil {
+		t.Fatalf("newer child should keep the directory: %v", err)
+	}
+
+	stale := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/d",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "late.txt"},
+		},
+		TsNs: eventTs - int64(time.Minute),
+	}
+	if err := f.Replay(stale); err != nil {
+		t.Fatalf("replay stale create: %v", err)
+	}
+	if _, err := store.FindEntry(ctx, "/d/late.txt"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatal("stale create resurrected a child under a directory the origin deleted")
+	}
+}
+
+// A swept hard link drops the shared inode record with the entry. When the
+// record is gone the sweep must free the chunks no sibling link can reach.
+func TestReplayDirectoryDeleteFreesOrphanedHardLinkChunks(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	f.FilerConf = NewFilerConf()
+	f.FileIdDeletionQueue = util.NewUnboundedQueue()
+	ctx := context.Background()
+
+	hardLinkId := NewHardLinkId()
+	inode := &Entry{
+		FullPath:        "/d/a.txt",
+		Attr:            Attr{Mtime: time.Now()},
+		HardLinkId:      hardLinkId,
+		HardLinkCounter: 1,
+		Chunks:          []*filer_pb.FileChunk{{FileId: "3,01637037d6"}},
+	}
+	blob, err := inode.EncodeAttributesAndChunks()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.KvPut(ctx, hardLinkId, blob); err != nil {
+		t.Fatal(err)
+	}
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	put(&Entry{FullPath: "/d", Attr: Attr{Mode: os.ModeDir}})
+	put(&Entry{FullPath: "/d/a.txt", Attr: Attr{Mtime: time.Now()}, HardLinkId: hardLinkId, HardLinkCounter: 1})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: true,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+
+	if _, err := store.KvGet(ctx, hardLinkId); !errors.Is(err, ErrKvNotFound) {
+		t.Fatalf("hard link record should be gone, got %v", err)
+	}
+	if got := f.pendingDeletionCount(); got != 1 {
+		t.Fatalf("pending deletions = %d, want the orphaned shared chunks queued", got)
+	}
+}
+
+// A sibling link outside the swept tree keeps the inode record, so the shared
+// chunks stay owned and must not be deleted.
+func TestReplayDirectoryDeleteKeepsSharedHardLinkChunks(t *testing.T) {
+	store := newStubFilerStore()
+	f := newReplayTestFiler(store)
+	f.FilerConf = NewFilerConf()
+	f.FileIdDeletionQueue = util.NewUnboundedQueue()
+	ctx := context.Background()
+
+	hardLinkId := NewHardLinkId()
+	inode := &Entry{
+		FullPath:        "/d/a.txt",
+		Attr:            Attr{Mtime: time.Now()},
+		HardLinkId:      hardLinkId,
+		HardLinkCounter: 2,
+		Chunks:          []*filer_pb.FileChunk{{FileId: "3,01637037d6"}},
+	}
+	blob, err := inode.EncodeAttributesAndChunks()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.KvPut(ctx, hardLinkId, blob); err != nil {
+		t.Fatal(err)
+	}
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	put(&Entry{FullPath: "/d", Attr: Attr{Mode: os.ModeDir}})
+	put(&Entry{FullPath: "/d/a.txt", Attr: Attr{Mtime: time.Now()}, HardLinkId: hardLinkId, HardLinkCounter: 2})
+	put(&Entry{FullPath: "/keep", Attr: Attr{Mode: os.ModeDir}})
+	put(&Entry{FullPath: "/keep/b.txt", Attr: Attr{Mtime: time.Now()}, HardLinkId: hardLinkId, HardLinkCounter: 2})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: true,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+
+	if _, err := store.KvGet(ctx, hardLinkId); err != nil {
+		t.Fatalf("surviving link must keep the inode record: %v", err)
+	}
+	if got := f.pendingDeletionCount(); got != 0 {
+		t.Fatalf("pending deletions = %d, want 0 while a sibling link owns the chunks", got)
+	}
+}
+
+// A replayed directory delete must mirror the origin's remote cleanup: entries
+// the lagging peer alone still holds lose their remote objects too, and record
+// tombstones so lazy remote fetches cannot resurrect them.
+func TestReplayDirectoryDeleteSweepsRemoteObjects(t *testing.T) {
+	const storageType = "stub_replay_remote"
+	stub := &stubRemoteClient{
+		statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "replaystore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "replaystore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+	f.onMetadataChangeEvent(event)
+
+	if _, err := store.FindEntry(ctx, "/buckets/mybucket/d/f.txt"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("swept child should be gone, got %v", err)
+	}
+	if len(stub.deleteCalls) != 1 || stub.deleteCalls[0].Path != "/d/f.txt" {
+		t.Fatalf("expected one remote delete of /d/f.txt, got %v", stub.deleteCalls)
+	}
+	if got := f.remoteTombstones.dirs["/buckets/mybucket/d"]; got != event.TsNs {
+		t.Fatalf("dir tombstone stamped %d, want the event ts %d", got, event.TsNs)
+	}
+}
+
+// A metadata-only delete keeps remote objects: the event's marker means the
+// remote tree stays authoritative, so the sweep must not touch it.
+func TestReplayDirectoryDeleteKeepRemoteObjects(t *testing.T) {
+	const storageType = "stub_replay_remote_keep"
+	stub := &stubRemoteClient{}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "keepstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "keepstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{
+				Name:        "d",
+				IsDirectory: true,
+				Extended:    map[string][]byte{ExtKeepRemoteObjectKey: []byte("true")},
+			},
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+	f.onMetadataChangeEvent(event)
+
+	if len(stub.deleteCalls) != 0 {
+		t.Fatalf("metadata-only delete must not touch remote objects, got %v", stub.deleteCalls)
+	}
+	if len(f.remoteTombstones.files)+len(f.remoteTombstones.dirs) != 0 {
+		t.Fatalf("metadata-only delete must not record tombstones, got %v", f.remoteTombstones.dirs)
+	}
+}
+
+// A delayed sweep must not erase an object another writer replaced since the
+// entry's stamp was recorded — the same guard the write-back daemon applies.
+func TestReplayDirectoryDeleteKeepsReplacedRemoteObject(t *testing.T) {
+	const storageType = "stub_replay_remote_replaced"
+	stub := &stubRemoteClient{
+		statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000099, RemoteSize: 10},
+	}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "replacestore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "replacestore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+
+	if len(stub.deleteCalls) != 0 {
+		t.Fatalf("a replaced remote object must be kept, got %v", stub.deleteCalls)
+	}
+}
+
+// A backend offering a conditional delete must serve the sweep: the check and
+// the delete bind into one preconditioned request, so a replacement landing
+// between them cannot be deleted.
+func TestReplayDirectoryDeleteUsesConditionalRemoteDelete(t *testing.T) {
+	const storageType = "stub_replay_remote_cond"
+	stub := &stubConditionalRemoteClient{conditionalResult: true}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "condstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "condstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+
+	if len(stub.conditionalCalls) != 1 || stub.conditionalCalls[0].Path != "/d/f.txt" {
+		t.Fatalf("expected one conditional delete of /d/f.txt, got %v", stub.conditionalCalls)
+	}
+	if len(stub.deleteCalls) != 0 {
+		t.Fatalf("an unconditional delete must not run beside the conditional one, got %v", stub.deleteCalls)
+	}
+}
+
+// A conditional delete reporting the object changed keeps the remote object
+// but still sweeps the local metadata: the entry the peer held is gone either
+// way.
+func TestReplayDirectoryDeleteKeepsChangedRemoteObject(t *testing.T) {
+	const storageType = "stub_replay_remote_cond_keep"
+	stub := &stubConditionalRemoteClient{conditionalResult: false}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "condkeepstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "condkeepstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+	if _, err := store.FindEntry(ctx, "/buckets/mybucket/d/f.txt"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("swept child should be gone, got %v", err)
+	}
+	if len(stub.deleteCalls) != 0 {
+		t.Fatalf("a changed remote object must be kept, got %v", stub.deleteCalls)
+	}
+}
+
+// A failed remote delete aborts the sweep so the replication stream retries
+// instead of orphaning the object no other event will ever name.
+func TestReplayDirectoryDeleteFailsOnRemoteDeleteError(t *testing.T) {
+	const storageType = "stub_replay_remote_err"
+	stub := &stubRemoteClient{
+		statResult: &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+		deleteErr:  errors.New("remote unavailable"),
+	}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "errstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "errstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err == nil {
+		t.Fatal("a failed remote delete must fail the replay for retry")
+	}
+	if _, err := store.FindEntry(ctx, "/buckets/mybucket/d/f.txt"); err != nil {
+		t.Fatalf("the child must survive for the retry, got %v", err)
+	}
+}
+
+// A swept entry deleted while its rename copy was still pending reads its
+// content from the source the marker names: removing the entry must release
+// that object too, or it is orphaned — the destination key may hold nothing.
+func TestReplayDirectoryDeleteReleasesPendingRenameSource(t *testing.T) {
+	const storageType = "stub_replay_remote_rename_src"
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/d/src.txt": {RemoteMtime: 1700000000, RemoteSize: 10},
+	}}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "srcstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "srcstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/dst.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+		Extended: map[string][]byte{ExtRemoteRenameSourceKey: []byte("/buckets/mybucket/d/src.txt")},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+	if _, err := store.FindEntry(ctx, "/buckets/mybucket/d/dst.txt"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("swept child should be gone, got %v", err)
+	}
+	if len(stub.deleteCalls) != 1 || stub.deleteCalls[0].Path != "/d/src.txt" {
+		t.Fatalf("expected one remote delete of the pending rename's source /d/src.txt, got %v", stub.deleteCalls)
+	}
+}
+
+// The source survives while a remote-only entry holds its path: that entry's
+// content is the same object. The swept destination entry's own object still
+// goes while its stamp describes it.
+func TestReplayDirectoryDeleteKeepsPendingRenameSourceOwnedByRemoteOnly(t *testing.T) {
+	const storageType = "stub_replay_remote_rename_owned"
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/d/dst.txt":     {RemoteMtime: 1700000000, RemoteSize: 10},
+		"/other/src.txt": {RemoteMtime: 1700000000, RemoteSize: 10},
+	}}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "ownstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "ownstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	put := func(e *Entry) {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, dir := range []string{"/buckets", "/buckets/mybucket", "/buckets/mybucket/d", "/buckets/mybucket/other"} {
+		put(&Entry{FullPath: util.FullPath(dir), Attr: Attr{Mode: os.ModeDir}})
+	}
+	put(&Entry{
+		FullPath: "/buckets/mybucket/d/dst.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+		Extended: map[string][]byte{ExtRemoteRenameSourceKey: []byte("/buckets/mybucket/other/src.txt")},
+	})
+	put(&Entry{
+		FullPath: "/buckets/mybucket/other/src.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	})
+
+	event := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/buckets/mybucket",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry:     &filer_pb.Entry{Name: "d", IsDirectory: true},
+			DeleteChunks: false,
+		},
+		TsNs: time.Now().UnixNano(),
+	}
+	if err := f.Replay(event); err != nil {
+		t.Fatalf("replay: %v", err)
+	}
+	if len(stub.deleteCalls) != 1 || stub.deleteCalls[0].Path != "/d/dst.txt" {
+		t.Fatalf("expected one remote delete of /d/dst.txt, got %v", stub.deleteCalls)
+	}
+	if _, err := store.FindEntry(ctx, "/buckets/mybucket/other/src.txt"); err != nil {
+		t.Fatalf("the remote-only source holder must survive, got %v", err)
+	}
+}
+
+// A remote-only entry that took the path since the listing reads the object
+// at the key as its only copy — the sweep must keep both.
+func TestReplaySweepKeepsRemoteOnlyOwnerOfPath(t *testing.T) {
+	const storageType = "stub_replay_remote_owner"
+	stub := &pathStatRemoteClient{objects: map[string]*filer_pb.RemoteEntry{
+		"/d/f.txt": {RemoteMtime: 1700000099, RemoteSize: 20},
+	}}
+	defer registerStubMaker(t, storageType, stub)()
+
+	conf := &remote_pb.RemoteConf{Name: "ownerstore", Type: storageType}
+	rs := NewFilerRemoteStorage()
+	rs.storageNameToConf[conf.Name] = conf
+	rs.mapDirectoryToRemoteStorage("/buckets/mybucket", &remote_pb.RemoteStorageLocation{
+		Name:   "ownerstore",
+		Bucket: "mybucket",
+		Path:   "/",
+	})
+
+	store := newStubFilerStore()
+	f := newTestFiler(t, store, rs)
+	ctx := context.Background()
+
+	owner := &Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000099, RemoteSize: 20},
+	}
+	if err := store.InsertEntry(ctx, owner); err != nil {
+		t.Fatal(err)
+	}
+
+	stale := &Entry{
+		FullPath: "/buckets/mybucket/d/f.txt",
+		Attr:     Attr{Mtime: time.Now(), Mode: 0644},
+		Remote:   &filer_pb.RemoteEntry{RemoteMtime: 1700000000, RemoteSize: 10},
+	}
+	sweep := &folderSweep{chunksByPath: make(map[util.FullPath][]*filer_pb.FileChunk)}
+	message := &filer_pb.EventNotification{OldEntry: &filer_pb.Entry{Name: "d", IsDirectory: true}}
+	kept, err := f.deleteSweptChild(ctx, stale, message, 0, sweep, false, true)
+	if err != nil {
+		t.Fatalf("deleteSweptChild: %v", err)
+	}
+	if !kept {
+		t.Fatal("a remote-only entry that took the path must be kept")
+	}
+	if _, err := store.FindEntry(ctx, "/buckets/mybucket/d/f.txt"); err != nil {
+		t.Fatalf("the remote-only owner must survive, got %v", err)
+	}
+	if len(stub.deleteCalls) != 0 {
+		t.Fatalf("the owned remote object must be kept, got %v", stub.deleteCalls)
+	}
+}
diff --git a/weed/filer/meta_aggregator_test.go b/weed/filer/meta_aggregator_test.go
index 70adae3878..82e8abd1a1 100644
--- a/weed/filer/meta_aggregator_test.go
+++ b/weed/filer/meta_aggregator_test.go
@@ -34,3 +34,55 @@ func TestOnPeerUpdateRepeatedAdd(t *testing.T) {
 		t.Fatal("expecting the subscription to be removed")
 	}
 }
+
+// Shutdown must close every peer's stopChan and wait for the loops, which is
+// what lets each loop's deferred offset save run before the store closes.
+func TestMetaAggregatorShutdownStopsPeerLoops(t *testing.T) {
+	ma := NewMetaAggregator(nil, pb.ServerAddress("127.0.0.1:2"), nil)
+
+	stopChan := make(chan struct{})
+	peer := pb.ServerAddress("127.0.0.1:1")
+	ma.peerChans[peer] = stopChan
+	ma.peerWg.Add(1)
+	exited := make(chan struct{})
+	go func() {
+		defer ma.peerWg.Done()
+		<-stopChan
+		close(exited)
+	}()
+
+	done := make(chan struct{})
+	go func() {
+		ma.Shutdown()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(3 * time.Second):
+		t.Fatal("Shutdown did not return")
+	}
+	select {
+	case <-exited:
+	default:
+		t.Fatal("peer loop was not stopped")
+	}
+}
+
+// After Shutdown begins, a peer-add update arriving on the still-connected
+// master watch must not start a subscription: it would have no stop signal
+// and could run past the store close.
+func TestOnPeerUpdateAfterShutdownRejected(t *testing.T) {
+	ma := NewMetaAggregator(nil, pb.ServerAddress("127.0.0.1:2"), nil)
+	ma.Shutdown()
+
+	peer := pb.ServerAddress("127.0.0.1:1")
+	ma.OnPeerUpdate(&master_pb.ClusterNodeUpdate{Address: string(peer), IsAdd: true}, time.Now())
+
+	ma.peerChansLock.Lock()
+	_, found := ma.peerChans[peer]
+	ma.peerChansLock.Unlock()
+	if found {
+		t.Fatal("peer subscription started after shutdown")
+	}
+}
diff --git a/weed/filer/meta_aggregator_testing.go b/weed/filer/meta_aggregator_testing.go
new file mode 100644
index 0000000000..1c805f5840
--- /dev/null
+++ b/weed/filer/meta_aggregator_testing.go
@@ -0,0 +1,26 @@
+package filer
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+)
+
+// TrackPeerForTesting registers a peer as if the master had announced it, but
+// without starting its subscription goroutine, so loop tests can drive the
+// low-watermarks by hand. Test support only.
+func (ma *MetaAggregator) TrackPeerForTesting(peer pb.ServerAddress) {
+	ma.peerChansLock.Lock()
+	ma.peerChans[peer] = make(chan struct{})
+	if peer != ma.self {
+		ma.noteRemotePeerArrivalLocked()
+	}
+	ma.peerChansLock.Unlock()
+	ma.initPeerWatermark(peer)
+}
+
+// ReportPeerWatermarksForTesting stands in for what a peer's stream reports:
+// its delivery watermark (events and idle heartbeats) and its flush
+// watermark. Test support only.
+func (ma *MetaAggregator) ReportPeerWatermarksForTesting(peer pb.ServerAddress, deliveredTsNs, flushedTsNs int64) {
+	ma.advancePeerWatermark(peer, deliveredTsNs)
+	ma.advancePeerFlushWatermark(peer, flushedTsNs)
+}
diff --git a/weed/filer/meta_aggregator_watermark_test.go b/weed/filer/meta_aggregator_watermark_test.go
new file mode 100644
index 0000000000..f81722adf3
--- /dev/null
+++ b/weed/filer/meta_aggregator_watermark_test.go
@@ -0,0 +1,213 @@
+package filer
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+)
+
+func newTestAggregator() *MetaAggregator {
+	return &MetaAggregator{
+		peerWatermarks:      make(map[pb.ServerAddress]int64),
+		peerFlushWatermarks: make(map[pb.ServerAddress]int64),
+		peerRemovedAtNs:     make(map[pb.ServerAddress]int64),
+	}
+}
+
+// TestPeerWatermarkBookkeeping pins the per-peer delivery watermark semantics
+// backing MetaAggregator.PeerLowWatermarkTsNs: the low-watermark is the minimum
+// received-through timestamp across tracked peers, a peer that has not
+// signalled yet holds it at zero (completeness unknown), advances are
+// monotonic, and removed peers stop participating only after the grace.
+func TestPeerWatermarkBookkeeping(t *testing.T) {
+	ma := newTestAggregator()
+	a, b := pb.ServerAddress("filer-a:8888"), pb.ServerAddress("filer-b:8888")
+
+	if got := ma.PeerLowWatermarkTsNs(); got != 0 {
+		t.Fatalf("no peers: low=%d want 0", got)
+	}
+
+	// A tracked-but-silent peer pins the low-watermark at zero.
+	ma.initPeerWatermark(a)
+	ma.initPeerWatermark(b)
+	ma.advancePeerWatermark(a, 100)
+	if got := ma.PeerLowWatermarkTsNs(); got != 0 {
+		t.Fatalf("silent peer: low=%d want 0", got)
+	}
+
+	// Both signalled: low is the minimum.
+	ma.advancePeerWatermark(b, 50)
+	if got := ma.PeerLowWatermarkTsNs(); got != 50 {
+		t.Fatalf("low=%d want 50", got)
+	}
+
+	// Advances are monotonic: a stale (lower) signal cannot regress.
+	ma.advancePeerWatermark(b, 40)
+	if got := ma.PeerLowWatermarkTsNs(); got != 50 {
+		t.Fatalf("after stale signal: low=%d want 50", got)
+	}
+
+	// Reconnect keeps the prior value (init does not reset).
+	ma.initPeerWatermark(b)
+	if got := ma.PeerLowWatermarkTsNs(); got != 50 {
+		t.Fatalf("after re-init: low=%d want 50", got)
+	}
+}
+
+// TestPeerWatermarkRemovalGrace pins the removal semantics: a removed peer is
+// usually a flap (frozen or partitioned filer), so its watermarks keep
+// holding the low-watermarks for the grace period - de-accounting it at once
+// would let subscribers advance past its still-unflushed events. A re-add
+// within the grace continues the values; a peer gone past the grace is
+// dropped, so a decommission cannot pin the low-watermark, and its straggling
+// signals cannot resurrect the entry.
+func TestPeerWatermarkRemovalGrace(t *testing.T) {
+	ma := newTestAggregator()
+	a, b := pb.ServerAddress("filer-a:8888"), pb.ServerAddress("filer-b:8888")
+	ma.initPeerWatermark(a)
+	ma.initPeerWatermark(b)
+	ma.advancePeerWatermark(a, 100)
+	ma.advancePeerWatermark(b, 50)
+	ma.advancePeerFlushWatermark(a, 100)
+	ma.advancePeerFlushWatermark(b, 50)
+
+	// Freshly removed: still participates (the flap case that loses data if
+	// dropped at once).
+	ma.markPeerWatermarkRemoved(b)
+	if got := ma.PeerLowWatermarkTsNs(); got != 50 {
+		t.Fatalf("within grace: low=%d want 50", got)
+	}
+	if got := ma.PeerLowFlushWatermarkTsNs(); got != 50 {
+		t.Fatalf("within grace: flush low=%d want 50", got)
+	}
+	// Its draining stream may still advance it while marked.
+	ma.advancePeerWatermark(b, 60)
+	if got := ma.PeerLowWatermarkTsNs(); got != 60 {
+		t.Fatalf("marked peer advance: low=%d want 60", got)
+	}
+
+	// Re-add within the grace: mark cleared, values continue.
+	ma.initPeerWatermark(b)
+	if _, marked := ma.peerRemovedAtNs[b]; marked {
+		t.Fatalf("re-added peer still marked removed")
+	}
+	if got := ma.PeerLowWatermarkTsNs(); got != 60 {
+		t.Fatalf("after re-add: low=%d want 60", got)
+	}
+
+	// Removal past the grace: dropped from both watermark sets. A duplicate
+	// removal notification must not refresh the deadline (first mark wins).
+	ma.markPeerWatermarkRemoved(b)
+	ma.peerWatermarksLock.Lock()
+	ma.peerRemovedAtNs[b] = time.Now().UnixNano() - int64(peerWatermarkRemovalGrace) - int64(time.Second)
+	ma.peerWatermarksLock.Unlock()
+	ma.markPeerWatermarkRemoved(b) // duplicate removal: must not reset the clock
+	if got := ma.PeerLowWatermarkTsNs(); got != 100 {
+		t.Fatalf("past grace: low=%d want 100", got)
+	}
+	if got := ma.PeerLowFlushWatermarkTsNs(); got != 100 {
+		t.Fatalf("past grace: flush low=%d want 100", got)
+	}
+
+	// A straggling signal after the drop must not resurrect the entry.
+	ma.advancePeerWatermark(b, 999)
+	ma.advancePeerFlushWatermark(b, 999)
+	if got := ma.PeerLowWatermarkTsNs(); got != 100 {
+		t.Fatalf("after straggler: low=%d want 100", got)
+	}
+	if _, found := ma.peerWatermarks[b]; found {
+		t.Fatalf("dropped peer resurrected in delivery watermark set")
+	}
+	if _, found := ma.peerFlushWatermarks[b]; found {
+		t.Fatalf("dropped peer resurrected in flush watermark set")
+	}
+}
+
+// TestPeerFlushWatermarkBookkeeping mirrors the delivery-watermark semantics
+// for the flush watermark that bounds persisted-log reads: min across peers,
+// zero until every peer has reported, monotonic advances.
+func TestPeerFlushWatermarkBookkeeping(t *testing.T) {
+	ma := newTestAggregator()
+	a, b := pb.ServerAddress("filer-a:8888"), pb.ServerAddress("filer-b:8888")
+
+	ma.initPeerWatermark(a)
+	ma.initPeerWatermark(b)
+	ma.advancePeerFlushWatermark(a, 200)
+	if got := ma.PeerLowFlushWatermarkTsNs(); got != 0 {
+		t.Fatalf("unreported peer: low=%d want 0", got)
+	}
+	ma.advancePeerFlushWatermark(b, 150)
+	if got := ma.PeerLowFlushWatermarkTsNs(); got != 150 {
+		t.Fatalf("low=%d want 150", got)
+	}
+	ma.advancePeerFlushWatermark(b, 120) // stale report cannot regress
+	if got := ma.PeerLowFlushWatermarkTsNs(); got != 150 {
+		t.Fatalf("after stale: low=%d want 150", got)
+	}
+	_ = a
+}
+
+// closed reports whether ch has been signalled, without blocking.
+func closed(ch <-chan struct{}) bool {
+	select {
+	case <-ch:
+		return true
+	default:
+		return false
+	}
+}
+
+// TestWatermarkAdvancedChansAreScoped pins what each wake channel promises. A
+// held read re-runs a whole pass - a persisted-log listing in it - so waking
+// one whose bound did not move is pure waste, and peers advance their delivery
+// watermark on every event they stream.
+func TestWatermarkAdvancedChansAreScoped(t *testing.T) {
+	ma := newTestAggregator()
+	a, b := pb.ServerAddress("filer-a:8888"), pb.ServerAddress("filer-b:8888")
+	ma.initPeerWatermark(a)
+	ma.initPeerWatermark(b)
+
+	delivery, flush := ma.DeliveryWatermarkAdvancedChan(), ma.FlushWatermarkAdvancedChan()
+
+	// One peer alone does not move either minimum: the other still pins both.
+	ma.advancePeerWatermark(a, 100)
+	ma.advancePeerFlushWatermark(a, 100)
+	if closed(delivery) || closed(flush) {
+		t.Fatalf("a single peer moved a minimum: delivery=%v flush=%v", closed(delivery), closed(flush))
+	}
+
+	// Delivery progress on every peer wakes the in-memory holds only.
+	ma.advancePeerWatermark(b, 50)
+	if !closed(delivery) {
+		t.Fatal("delivery low-watermark rose without waking the in-memory holds")
+	}
+	if closed(flush) {
+		t.Fatal("delivery progress woke the persisted-log holds, which it cannot release")
+	}
+
+	// And flush progress the persisted-log holds only.
+	delivery = ma.DeliveryWatermarkAdvancedChan()
+	ma.advancePeerFlushWatermark(b, 50)
+	if !closed(flush) {
+		t.Fatal("flush low-watermark rose without waking the persisted-log holds")
+	}
+	if closed(delivery) {
+		t.Fatal("flush progress woke the in-memory holds, which it cannot release")
+	}
+
+	// A fresh channel is handed out after each signal, so the next park is on
+	// the next rise rather than on one already consumed.
+	flush = ma.FlushWatermarkAdvancedChan()
+	if closed(flush) {
+		t.Fatal("re-handed a signalled channel")
+	}
+	ma.advancePeerFlushWatermark(a, 200)
+	if closed(flush) {
+		t.Fatal("one peer above the minimum signalled a rise")
+	}
+	ma.advancePeerFlushWatermark(b, 200)
+	if !closed(flush) {
+		t.Fatal("the trailing peer catching up did not signal a rise")
+	}
+}
diff --git a/weed/filer/meta_log_collection_test.go b/weed/filer/meta_log_collection_test.go
new file mode 100644
index 0000000000..aa18d4064e
--- /dev/null
+++ b/weed/filer/meta_log_collection_test.go
@@ -0,0 +1,137 @@
+package filer
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// The metadata log's collection resolution must let operators redirect the
+// internal /topics/.system/log chunks into their own collection without
+// touching where user data goes, and must be strictly backward compatible
+// when the override is unset.
+
+func TestMetaLogCollectionResolution(t *testing.T) {
+	tests := []struct {
+		name           string
+		target         string // filer.options.metaLog.collection override
+		filerDefault   string // -collection flag value
+		ruleCollection string // storage rule matched on the log path
+		want           string
+	}{
+		{
+			name:           "no override: filer default wins (today's behaviour)",
+			target:         "",
+			filerDefault:   "mydata",
+			ruleCollection: "",
+			want:           "mydata",
+		},
+		{
+			name:           "no override anywhere: still empty (default collection)",
+			target:         "",
+			filerDefault:   "",
+			ruleCollection: "",
+			want:           "",
+		},
+		{
+			name:           "override wins over filer default",
+			target:         "filer-meta",
+			filerDefault:   "mydata",
+			ruleCollection: "",
+			want:           "filer-meta",
+		},
+		{
+			name:           "override wins over matched rule",
+			target:         "filer-meta",
+			filerDefault:   "",
+			ruleCollection: "rulecol",
+			want:           "filer-meta",
+		},
+		{
+			name:           "no override but rule set: rule used (unchanged fallback chain)",
+			target:         "",
+			filerDefault:   "",
+			ruleCollection: "rulecol",
+			want:           "rulecol",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			// Drive the same setter a running filer would use post-construction.
+			f := &Filer{}
+			f.metaLogTargetCollection = tc.target
+			f.metaLogCollection = tc.filerDefault
+			if got := f.metaLogCollectionFor(tc.ruleCollection); got != tc.want {
+				t.Errorf("metaLogCollectionFor(%q) = %q, want %q", tc.ruleCollection, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestMetaLogReplicationResolution(t *testing.T) {
+	f := &Filer{}
+	f.metaLogTargetReplication = "110"
+	f.metaLogReplication = "010"
+	if got := f.metaLogReplicationFor("001"); got != "110" {
+		t.Errorf("override must win, got %q", got)
+	}
+	f.metaLogTargetReplication = ""
+	if got := f.metaLogReplicationFor("001"); got != "010" {
+		t.Errorf("filer replication must win when no override, got %q", got)
+	}
+	f.metaLogReplication = ""
+	if got := f.metaLogReplicationFor("001"); got != "001" {
+		t.Errorf("rule replication must be used last, got %q", got)
+	}
+}
+
+// TestViperReadsMetaLogOverrides proves the exact viper keys the docs promise
+// are read into the fields a running filer uses.
+func TestViperReadsMetaLogOverrides(t *testing.T) {
+	v := util.GetViper()
+	v.Set("filer.options.metaLog.collection", "filer-meta")
+	v.Set("filer.options.metaLog.replication", "100")
+	defer func() {
+		// Reset so other tests see the unset default.
+		v.Set("filer.options.metaLog.collection", "")
+		v.Set("filer.options.metaLog.replication", "")
+	}()
+
+	f := NewFiler(pb.ServerDiscovery{}, nil, "", "", "", "", "", 255, nil)
+	if got := f.metaLogTargetCollection; got != "filer-meta" {
+		t.Fatalf("NewFiler did not read the collection override: %q", got)
+	}
+	if got := f.metaLogTargetReplication; got != "100" {
+		t.Fatalf("NewFiler did not read the replication override: %q", got)
+	}
+}
+
+// TestBucketCollectionKeepsMetaLogTargetCollection mirrors the guarantee that
+// protects the filer's default collection: when a bucket resolves to the
+// collection the system metadata log was redirected to, deleting the bucket
+// must not drop that collection (it backs internal log volumes).
+func TestBucketCollectionKeepsMetaLogTargetCollection(t *testing.T) {
+	f, store, master := newFilerWithFakeMaster(t)
+	// Operator redirected the meta log to its own collection...
+	f.metaLogTargetCollection = "filer-meta"
+	// ...and a bucket happens to resolve to that very collection.
+	f.FilerConf.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/a",
+		Collection:     "filer-meta",
+	})
+	seedBucket(t, store, util.FullPath("/buckets/a"))
+
+	if err := f.DeleteEntryMetaAndData(context.Background(), "/buckets/a", true, false, true, false, nil, 0); err != nil {
+		t.Fatalf("DeleteEntryMetaAndData: %v", err)
+	}
+
+	select {
+	case call := <-master.calls:
+		t.Fatalf("the meta-log target collection was deleted by a bucket delete: %q", call.name)
+	default:
+	}
+}
diff --git a/weed/filer/meta_path_ts.go b/weed/filer/meta_path_ts.go
new file mode 100644
index 0000000000..844f744d3a
--- /dev/null
+++ b/weed/filer/meta_path_ts.go
@@ -0,0 +1,324 @@
+package filer
+
+import (
+	"context"
+	"crypto/sha256"
+	"errors"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+const (
+	// metaPathTsPrefix keys per-path commit timestamps in the filer store KV:
+	// the newest event timestamp this filer committed or applied for the
+	// path. Written for every emitted mutation event and kept after the entry
+	// is deleted, so a replayed peer event can still be ordered against a
+	// change that left no entry behind.
+	metaPathTsPrefix = "MpTs"
+	// metaPathDelPrefix keys delete-only timestamps. A replayed event checks
+	// the path's ancestors too, so a directory delete also covers children
+	// swept without per-child events (a dropped bucket's whole-store delete,
+	// or a walk aborted partway).
+	metaPathDelPrefix = "MpDl"
+)
+
+// metaPathKey hashes the path into a fixed-size key. SQL-backed KV stores
+// split the key at byte 8 and store the remainder base64-encoded in a
+// VARCHAR(766) name column: a raw path over ~578 bytes overflows it, the
+// KvPut insert fails, and the fallback update touches no row yet returns no
+// error — the commit record would never land and stale replay could restore
+// the path.
+func metaPathKey(prefix string, path util.FullPath) []byte {
+	sum := sha256.Sum256([]byte(path))
+	key := make([]byte, len(prefix)+16)
+	copy(key, prefix)
+	copy(key[len(prefix):], sum[:16])
+	return key
+}
+
+// kvReadTsNs returns the timestamp recorded for key, or found=false when the
+// key is absent or malformed. Any other store read failure is an error: a
+// caller deciding whether a replayed change is stale must not guess.
+func (f *Filer) kvReadTsNs(ctx context.Context, key []byte) (tsNs int64, found bool, err error) {
+	value, err := f.Store.KvGet(ctx, key)
+	if err != nil {
+		if errors.Is(err, ErrKvNotFound) {
+			return 0, false, nil
+		}
+		return 0, false, err
+	}
+	if len(value) < 8 {
+		return 0, false, nil
+	}
+	return int64(util.BytesToUint64(value)), true, nil
+}
+
+// notePathChange persists tsNs as path's newest committed change. Local event
+// timestamps are stamped monotonically (metaLogInflight.stamp), so a plain
+// put cannot regress an earlier local record; a higher peer record it may
+// overwrite was already newer under last-writer-wins ordering anyway. A
+// delete additionally writes a delete record the ancestor lookup consults.
+//
+// The write uses a fresh context: callers notify after CommitTransaction,
+// and SQL stores keep the already-committed *sql.Tx in the request context —
+// a record written through it would fail and the path would lose ordering.
+//
+// A failed write is kept in metaTsPending and retried in the background: the
+// mutation the record orders has already committed, so dropping it would let
+// a stale replayed change overwrite or resurrect the path while the store is
+// unreachable. Ordering reads consult the pending record until the retry
+// lands it.
+func (f *Filer) notePathChange(path util.FullPath, tsNs int64, deleted bool) {
+	if f.Store == nil {
+		return
+	}
+	ctx := context.Background()
+	key := string(path)
+	rec := f.pendingRec(key)
+	defer rec.mu.Unlock()
+
+	value := make([]byte, 8)
+	util.Uint64toBytes(value, uint64(tsNs))
+	if err := f.Store.KvPut(ctx, metaPathKey(metaPathTsPrefix, path), value); err != nil {
+		glog.WarningfCtx(ctx, "record meta change time %s: %v", path, err)
+		if tsNs > rec.changeTsNs.Load() {
+			rec.changeTsNs.Store(tsNs)
+		}
+	} else if rec.changeTsNs.Load() <= tsNs {
+		// This write covers every change record owed so far.
+		rec.changeTsNs.Store(0)
+	}
+	if deleted {
+		if err := f.Store.KvPut(ctx, metaPathKey(metaPathDelPrefix, path), value); err != nil {
+			glog.WarningfCtx(ctx, "record meta delete time %s: %v", path, err)
+			if tsNs > rec.deleteTsNs.Load() {
+				rec.deleteTsNs.Store(tsNs)
+			}
+		} else if rec.deleteTsNs.Load() <= tsNs {
+			rec.deleteTsNs.Store(0)
+		}
+	}
+	if rec.changeTsNs.Load() == 0 && rec.deleteTsNs.Load() == 0 {
+		f.metaTsPending.CompareAndDelete(key, rec)
+		return
+	}
+	if _, running := f.metaTsRepairing.LoadOrStore(key, struct{}{}); !running {
+		go f.repairMetaPathTs(path)
+	}
+}
+
+// metaTsPendingRec is a commit record still on its way to the store, holding
+// only work not yet written: changeTsNs is the newest committed change the
+// MpTs record lacks and deleteTsNs the newest delete the MpDl record lacks —
+// the two keep their own times so a later update cannot masquerade as the
+// delete. Store writes and the bookkeeping they discharge share mu, so a
+// repair pass can never write an older record over a newer one that already
+// landed; readers take the atomic fields directly.
+type metaTsPendingRec struct {
+	mu         sync.Mutex
+	changeTsNs atomic.Int64
+	deleteTsNs atomic.Int64
+}
+
+// pendingRec returns the live pending record for key, locked for mutation,
+// recreating it when a repair already dropped the previous one.
+func (f *Filer) pendingRec(key string) *metaTsPendingRec {
+	for {
+		cur, _ := f.metaTsPending.LoadOrStore(key, &metaTsPendingRec{})
+		rec := cur.(*metaTsPendingRec)
+		rec.mu.Lock()
+		if live, ok := f.metaTsPending.Load(key); ok && live == cur {
+			return rec
+		}
+		rec.mu.Unlock()
+	}
+}
+
+// repairMetaPathTs retries a pending commit record until it lands. Each pass
+// writes only what the record still owes, so a merge by a later failure is
+// picked up without another goroutine and a landed write is never rewritten.
+// The retry is unbounded — the mutation is already committed and only the
+// record preserves its ordering.
+func (f *Filer) repairMetaPathTs(path util.FullPath) {
+	key := string(path)
+	ctx := f.flushCtx
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	defer func() {
+		f.metaTsRepairing.Delete(key)
+		// A failure landing between the last pass and the flag release
+		// still needs a repair pass — unless the retry context is done.
+		if ctx.Err() != nil {
+			return
+		}
+		if _, ok := f.metaTsPending.Load(key); ok {
+			if _, running := f.metaTsRepairing.LoadOrStore(key, struct{}{}); !running {
+				go f.repairMetaPathTs(path)
+			}
+		}
+	}()
+	for {
+		if _, ok := f.metaTsPending.Load(key); !ok {
+			return
+		}
+		rec := f.pendingRec(key)
+		var tsErr, delErr error
+		if tsNs := rec.changeTsNs.Load(); tsNs > 0 {
+			value := make([]byte, 8)
+			util.Uint64toBytes(value, uint64(tsNs))
+			if tsErr = f.Store.KvPut(ctx, metaPathKey(metaPathTsPrefix, path), value); tsErr == nil {
+				rec.changeTsNs.Store(0)
+			}
+		}
+		if tsNs := rec.deleteTsNs.Load(); tsNs > 0 {
+			value := make([]byte, 8)
+			util.Uint64toBytes(value, uint64(tsNs))
+			if delErr = f.Store.KvPut(ctx, metaPathKey(metaPathDelPrefix, path), value); delErr == nil {
+				rec.deleteTsNs.Store(0)
+			}
+		}
+		done := rec.changeTsNs.Load() == 0 && rec.deleteTsNs.Load() == 0
+		if done {
+			f.metaTsPending.CompareAndDelete(key, rec)
+		}
+		rec.mu.Unlock()
+		if !done {
+			glog.V(0).InfofCtx(ctx, "retry record meta change time %s: %v %v", path, tsErr, delErr)
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(time.Second):
+			}
+		}
+	}
+}
+
+// pendingPathTsNs returns the newest pending commit timestamp for path and
+// the newest pending delete timestamp.
+func (f *Filer) pendingPathTsNs(path util.FullPath) (changeTsNs, deleteTsNs int64) {
+	cur, ok := f.metaTsPending.Load(string(path))
+	if !ok {
+		return 0, 0
+	}
+	rec := cur.(*metaTsPendingRec)
+	return rec.changeTsNs.Load(), rec.deleteTsNs.Load()
+}
+
+// CommitTsNs returns the newest commit timestamp known for path — the
+// recorded event time, or a still-pending one — and fallbackTsNs when none
+// exists. Peers stamp traversal entries with it so a bootstrap subscriber
+// orders each entry on the sender's commit clock rather than the entry's
+// client-settable mtime. A store read failure is an error, not a fallback:
+// the mtime it would mint could outdate real commits.
+func (f *Filer) CommitTsNs(ctx context.Context, path util.FullPath, fallbackTsNs int64) (int64, error) {
+	if f.Store == nil {
+		return fallbackTsNs, nil
+	}
+	tsNs := fallbackTsNs
+	recTs, found, err := f.kvReadTsNs(ctx, metaPathKey(metaPathTsPrefix, path))
+	if err != nil {
+		return 0, err
+	}
+	if found {
+		tsNs = recTs
+	}
+	if pendTs, _ := f.pendingPathTsNs(path); pendTs > tsNs {
+		tsNs = pendTs
+	}
+	return tsNs, nil
+}
+
+// noteCommittedEvent records the event's commit timestamp for every path it
+// touches: the source of a delete or rename, and the target of a create,
+// update, or rename. It runs after the local mutation commits while the
+// caller still holds the path's entry lock (for filer-server mutations), so
+// a peer replay ordered by the same lock sees either the whole local change
+// or none of it.
+func (f *Filer) noteCommittedEvent(event *filer_pb.SubscribeMetadataResponse) {
+	message := event.EventNotification
+	if message == nil {
+		return
+	}
+	var source, target util.FullPath
+	if message.OldEntry != nil {
+		source = util.FullPath(filer_pb.MetadataEventSourceFullPath(event))
+	}
+	if message.NewEntry != nil {
+		target = util.FullPath(filer_pb.MetadataEventTargetFullPath(event))
+	}
+	// A delete or a rename removes the source path; an update reports the
+	// same path on both sides and counts once.
+	if source != "" && source != target {
+		f.notePathChange(source, event.TsNs, true)
+	}
+	if target != "" {
+		f.notePathChange(target, event.TsNs, false)
+	}
+}
+
+// deletedAfterTsNs returns the newest recorded delete timestamp among path
+// and its ancestors.
+func (f *Filer) deletedAfterTsNs(ctx context.Context, path util.FullPath) (int64, error) {
+	var tsNs int64
+	for p := string(path); p != "" && p != "/"; {
+		ts, found, err := f.kvReadTsNs(ctx, metaPathKey(metaPathDelPrefix, util.FullPath(p)))
+		if err != nil {
+			return 0, err
+		}
+		if found && ts > tsNs {
+			tsNs = ts
+		}
+		if _, pendDel := f.pendingPathTsNs(util.FullPath(p)); pendDel > tsNs {
+			tsNs = pendDel
+		}
+		i := strings.LastIndexByte(p, '/')
+		if i <= 0 {
+			break
+		}
+		p = p[:i]
+	}
+	return tsNs, nil
+}
+
+// localCommitTsNs returns the newest timestamp this filer is known to have
+// committed for path: the recorded event time when one exists — it is not
+// client-controllable the way an entry's mtime is — else the entry's mtime
+// for entries written before recording existed, plus any recorded delete of
+// the path or an ancestor.
+func (f *Filer) localCommitTsNs(ctx context.Context, path util.FullPath) (int64, error) {
+	if f.Store == nil {
+		return 0, nil
+	}
+	var tsNs int64
+	recTs, found, err := f.kvReadTsNs(ctx, metaPathKey(metaPathTsPrefix, path))
+	if err != nil {
+		return 0, err
+	}
+	if found {
+		tsNs = recTs
+	} else if entry, findErr := f.Store.FindEntry(ctx, path); findErr != nil {
+		if !errors.Is(findErr, filer_pb.ErrNotFound) {
+			return 0, findErr
+		}
+	} else if entry != nil {
+		tsNs = entry.Mtime.UnixNano()
+	}
+	if pendTs, _ := f.pendingPathTsNs(path); pendTs > tsNs {
+		tsNs = pendTs
+	}
+	delTs, err := f.deletedAfterTsNs(ctx, path)
+	if err != nil {
+		return 0, err
+	}
+	if delTs > tsNs {
+		tsNs = delTs
+	}
+	return tsNs, nil
+}
diff --git a/weed/filer/meta_replay.go b/weed/filer/meta_replay.go
index 51c4e69877..ca517f8659 100644
--- a/weed/filer/meta_replay.go
+++ b/weed/filer/meta_replay.go
@@ -2,36 +2,349 @@ package filer
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/protobuf/proto"
 )
 
-func Replay(filerStore FilerStore, resp *filer_pb.SubscribeMetadataResponse) error {
+// Replay applies the delete and the insert as separate, non-transactional
+// store calls, so retrying it after a partial failure is not atomic; both
+// operations are idempotent and the timestamp check tolerates re-delivery.
+//
+// A replayed event can be older than local state: a peer resuming from a
+// stale offset replays everything since the offset, and two writes through
+// different filers race within the replication lag. Apply each path's change
+// only when no newer local change is recorded, so a late event cannot revert
+// or resurrect entries.
+//
+// Ordering uses the per-path commit timestamp recorded for every emitted
+// mutation (meta_path_ts.go), which survives deletes as a tombstone and is
+// not client-controllable the way entry mtime is — a mounted client can set
+// mtime into the future, and a rename keeps the source file's mtime on the
+// destination entry. Entries written before recording existed fall back to
+// their mtime.
+//
+// The check and the mutation run under the same per-path entry lock the
+// filer server's local writes hold, so they cannot be split by a concurrent
+// local update or by another peer's replay.
+func (f *Filer) Replay(resp *filer_pb.SubscribeMetadataResponse) error {
 	message := resp.EventNotification
-	var oldPath util.FullPath
-	var newEntry *Entry
+	dir := resp.Directory
+	if message.NewParentPath != "" {
+		dir = message.NewParentPath
+	}
+	var oldPath, newPath util.FullPath
 	if message.OldEntry != nil {
 		oldPath = util.NewFullPath(resp.Directory, message.OldEntry.Name)
-		glog.V(4).Infof("deleting %v", oldPath)
-		if err := filerStore.DeleteEntry(context.Background(), oldPath); err != nil {
+	}
+	if message.NewEntry != nil {
+		newPath = util.NewFullPath(dir, message.NewEntry.Name)
+	}
+	ctx := context.Background()
+
+	unlock := f.lockReplayPaths(oldPath, newPath)
+	defer unlock()
+
+	samePath := oldPath != "" && oldPath == newPath
+	if samePath {
+		newer, err := f.replayBlockedByLocal(ctx, oldPath, resp.TsNs)
+		if err != nil || newer {
 			return err
 		}
+		glog.V(4).Infof("deleting %v", oldPath)
+		if err := f.Store.DeleteEntry(ctx, oldPath); err != nil {
+			return err
+		}
+		// Record the commit before the insert too: if the insert fails and
+		// the event is retried later, the path sits deleted in between —
+		// without the record a stale peer create could resurrect it in the
+		// gap. The entry still exists afterward, so no delete record.
+		f.notePathChange(oldPath, resp.TsNs, false)
+		glog.V(4).Infof("creating %v", newPath)
+		newEntry := FromPbEntry(dir, message.NewEntry)
+		if err := f.Store.InsertEntry(ctx, newEntry); err != nil {
+			return err
+		}
+		f.notePathChange(oldPath, resp.TsNs, false)
+		return nil
+	}
+
+	if message.OldEntry != nil {
+		newer, err := f.replayBlockedByLocal(ctx, oldPath, resp.TsNs)
+		if err != nil {
+			return err
+		}
+		if !newer {
+			// A directory delete on the origin removed the whole subtree, but
+			// only the directory's own key replicates. Sweep local children the
+			// origin never listed, or they orphan under a missing parent.
+			keepDir := false
+			if message.OldEntry.IsDirectory {
+				var err error
+				keepDir, err = f.deleteReplayedFolderChildren(ctx, oldPath, message, resp.TsNs)
+				if err != nil {
+					return err
+				}
+			}
+			if !keepDir {
+				glog.V(4).Infof("deleting %v", oldPath)
+				if err := f.Store.DeleteEntry(ctx, oldPath); err != nil {
+					return err
+				}
+			}
+			// The origin deleted the directory even when a newer descendant
+			// keeps its entry here — recording the delete fences stale child
+			// creates that would otherwise resurrect under it.
+			f.notePathChange(oldPath, resp.TsNs, true)
+		}
 	}
 
 	if message.NewEntry != nil {
-		dir := resp.Directory
-		if message.NewParentPath != "" {
-			dir = message.NewParentPath
-		}
-		key := util.NewFullPath(dir, message.NewEntry.Name)
-		glog.V(4).Infof("creating %v", key)
-		newEntry = FromPbEntry(dir, message.NewEntry)
-		if err := filerStore.InsertEntry(context.Background(), newEntry); err != nil {
+		newer, err := f.replayBlockedByLocal(ctx, newPath, resp.TsNs)
+		if err != nil {
 			return err
 		}
+		if !newer {
+			glog.V(4).Infof("creating %v", newPath)
+			newEntry := FromPbEntry(dir, message.NewEntry)
+			if err := f.Store.InsertEntry(ctx, newEntry); err != nil {
+				return err
+			}
+			f.notePathChange(newPath, resp.TsNs, false)
+		}
 	}
 
 	return nil
 }
+
+// deleteReplayedFolderChildren removes local entries under dir, and queues
+// the chunks of removed files for deletion. Children this filer committed
+// after the event stay — a newer local write wins over a delayed delete —
+// along with the directories that hold them.
+func (f *Filer) deleteReplayedFolderChildren(ctx context.Context, dir util.FullPath, message *filer_pb.EventNotification, tsNs int64) (bool, error) {
+	sweep := &folderSweep{chunksByPath: make(map[util.FullPath][]*filer_pb.FileChunk)}
+	kept, err := f.sweepReplayedFolder(ctx, dir, message, tsNs, sweep)
+	// Flush what was collected even on error: the entries already deleted
+	// cannot be listed again on retry, so their chunks must be queued now.
+	sweep.flush(ctx, f)
+	if err != nil {
+		return false, err
+	}
+	return kept, nil
+}
+
+// folderSweep accumulates the chunks of removed children for deletion. It
+// flushes in batches so a large subtree cannot hold every chunk reference in
+// memory at once, and so chunk queueing overlaps the listing work.
+type folderSweep struct {
+	chunksByPath map[util.FullPath][]*filer_pb.FileChunk
+	count        int
+}
+
+const folderSweepChunkBatch = 4096
+
+func (s *folderSweep) add(path util.FullPath, chunks []*filer_pb.FileChunk) {
+	s.chunksByPath[path] = append(s.chunksByPath[path], chunks...)
+	s.count += len(chunks)
+}
+
+func (s *folderSweep) flush(ctx context.Context, f *Filer) {
+	for path, chunks := range s.chunksByPath {
+		f.DeleteChunks(ctx, path, chunks)
+	}
+	s.chunksByPath = make(map[util.FullPath][]*filer_pb.FileChunk)
+	s.count = 0
+}
+
+// sweepReplayedFolder deletes every child of dir whose local commit is not
+// newer than the event, working subtree-first so nested entries go too.
+// It reports whether a newer descendant keeps dir alive — the caller then
+// keeps the dir entry itself.
+func (f *Filer) sweepReplayedFolder(ctx context.Context, dir util.FullPath, message *filer_pb.EventNotification, tsNs int64, sweep *folderSweep) (kept bool, err error) {
+	keepRemote := IsMetadataOnlyDelete(message.OldEntry)
+	deleteRemote := !keepRemote && !message.GetIsFromOtherCluster()
+	lastFileName := ""
+	for {
+		entries, _, lerr := f.ListDirectoryEntries(ctx, dir, lastFileName, false, PaginationSize, "", "", "")
+		if lerr != nil {
+			return false, fmt.Errorf("list folder %s: %w", dir, lerr)
+		}
+		for _, sub := range entries {
+			lastFileName = sub.Name()
+			childKept := false
+			if tsNs > 0 {
+				localTsNs, tsErr := f.localCommitTsNs(ctx, sub.FullPath)
+				if tsErr != nil {
+					return false, tsErr
+				}
+				childKept = localTsNs > tsNs
+			}
+			if !childKept && sub.IsDirectory() {
+				childKept, err = f.sweepReplayedFolder(ctx, sub.FullPath, message, tsNs, sweep)
+				if err != nil {
+					return false, err
+				}
+			}
+			if childKept {
+				kept = true
+				continue
+			}
+			childKept, err = f.deleteSweptChild(ctx, sub, message, tsNs, sweep, keepRemote, deleteRemote)
+			if err != nil {
+				return false, err
+			}
+			if childKept {
+				kept = true
+			}
+		}
+		if len(entries) < PaginationSize {
+			break
+		}
+	}
+	return kept, nil
+}
+
+// deleteSweptChild removes sub under its entry lock and reports whether the
+// child was kept instead. The listing and the first commit-time check run
+// without the lock, so a local write can land in between: the check runs
+// again under the lock before anything is removed. A remote-only entry that
+// has taken the path since — one the commit record may not cover, such as a
+// lazy fetch materialized from the remote — reads the object at the key as
+// its only copy: the write-back daemon's processDeleteEvent keeps such an
+// object, and the sweep does too.
+func (f *Filer) deleteSweptChild(ctx context.Context, sub *Entry, message *filer_pb.EventNotification, tsNs int64, sweep *folderSweep, keepRemote, deleteRemote bool) (bool, error) {
+	var childLock *util.ActiveLock
+	if lt := f.EntryLockTable; lt != nil {
+		// The sweep already holds locks on the event's paths; waiting for a
+		// descendant here can deadlock against a local rename that holds the
+		// child and waits for one of them. ErrLockContended is transient, so
+		// the replication retry picks the event up once the write settles.
+		var acquired bool
+		childLock, acquired = lt.TryAcquireLock("MetaReplay", sub.FullPath, util.ExclusiveLock)
+		if !acquired {
+			return false, fmt.Errorf("sweep %s: %w", sub.FullPath, util.ErrLockContended)
+		}
+		defer lt.ReleaseLock(sub.FullPath, childLock)
+	}
+	if tsNs > 0 {
+		localTsNs, tsErr := f.localCommitTsNs(ctx, sub.FullPath)
+		if tsErr != nil {
+			return false, tsErr
+		}
+		if localTsNs > tsNs {
+			return true, nil
+		}
+	}
+	current, findErr := f.Store.FindEntry(ctx, sub.FullPath)
+	if findErr != nil && !errors.Is(findErr, filer_pb.ErrNotFound) {
+		return false, fmt.Errorf("find %s: %w", sub.FullPath, findErr)
+	}
+	if current != nil && len(current.Content) == 0 && current.IsInRemoteOnly() &&
+		!proto.Equal(current.ToProtoEntry(), sub.ToProtoEntry()) {
+		glog.V(0).InfofCtx(ctx, "keep %s: a remote-only entry has taken the path since the listing", sub.FullPath)
+		return true, nil
+	}
+	if !keepRemote && f.RemoteStorage != nil && f.remoteTombstones != nil {
+		if _, remoteLoc := f.RemoteStorage.FindMountDirectory(sub.FullPath); remoteLoc != nil {
+			f.remoteTombstones.addFromEvent(string(sub.FullPath), sub.IsDirectory(), tsNs)
+		}
+	}
+	if deleteRemote && !sub.IsDirectory() {
+		if remoteErr := f.deleteSweptEntryRemote(ctx, sub); remoteErr != nil {
+			return false, fmt.Errorf("remote delete %s: %w", sub.FullPath, remoteErr)
+		}
+	}
+	if derr := f.Store.DeleteEntry(ctx, sub.FullPath); derr != nil {
+		return false, fmt.Errorf("delete %s: %w", sub.FullPath, derr)
+	}
+	f.notePathChange(sub.FullPath, tsNs, true)
+	// chunks of a hard-linked child belong to the shared inode record; free
+	// them only once that record is gone. A directory entry can still carry
+	// chunks of its own — an S3 child promotes an existing file to a
+	// directory without dropping them — so the entry's chunks are keyed to
+	// its own path whatever it is.
+	if message.DeleteChunks && len(sub.GetChunks()) > 0 && (len(sub.HardLinkId) == 0 || f.hardLinkIsOrphaned(ctx, sub.HardLinkId)) {
+		sweep.add(sub.FullPath, sub.GetChunks())
+		if sweep.count >= folderSweepChunkBatch {
+			sweep.flush(ctx, f)
+		}
+	}
+	return false, nil
+}
+
+// replayBlockedByLocal reports whether the local store already holds a
+// version of path committed after the event's timestamp. Lookup failures are
+// propagated: a replayed change must not be applied on the guess that the
+// path was simply absent, or a transient read error could let a stale event
+// overwrite a newer entry past the point of no return.
+func (f *Filer) replayBlockedByLocal(ctx context.Context, path util.FullPath, tsNs int64) (bool, error) {
+	if tsNs <= 0 {
+		return false, nil
+	}
+	localTsNs, err := f.localCommitTsNs(ctx, path)
+	if err != nil {
+		return false, err
+	}
+	return localTsNs > tsNs, nil
+}
+
+// lockReplayPaths holds the shared entry locks for every path the event
+// touches, in the same sorted order the rename handler takes them.
+// lockReplayPaths takes the per-path entry locks for the event's paths and
+// every ancestor of them, in lexicographic order — parents sort before
+// children, the same ordering the local rename handler's two-path lock uses,
+// so lock acquisition is deadlock-free across operations. Ancestors are
+// included because the replay check consults ancestor delete records: a
+// local recursive delete or directory rename holds only the ancestor's lock,
+// and without contending on it a replay could reinsert a stale child after
+// its check. Ancestors are locked shared — they only need to exclude an
+// exclusive holder, not each other, or every replay under a busy parent
+// would serialize — while a path the event actually changes stays exclusive
+// even when it is also the other path's ancestor. The root is never locked:
+// it cannot be deleted, and a shared root lock would still be excluded by
+// every top-level delete.
+func (f *Filer) lockReplayPaths(oldPath, newPath util.FullPath) func() {
+	lt := f.EntryLockTable
+	if lt == nil {
+		return func() {}
+	}
+	var paths []util.FullPath
+	addAncestors := func(p util.FullPath) {
+		for i := strings.LastIndexByte(string(p), '/'); i > 0; i = strings.LastIndexByte(string(p), '/') {
+			p = p[:i]
+			paths = append(paths, p)
+		}
+	}
+	addAncestors(oldPath)
+	addAncestors(newPath)
+	if oldPath != "" {
+		paths = append(paths, oldPath)
+	}
+	if newPath != "" {
+		paths = append(paths, newPath)
+	}
+	if len(paths) == 0 {
+		return func() {}
+	}
+	slices.Sort(paths)
+	paths = slices.Compact(paths)
+	locks := make([]*util.ActiveLock, len(paths))
+	for i, p := range paths {
+		lockType := util.SharedLock
+		if p == oldPath || p == newPath {
+			lockType = util.ExclusiveLock
+		}
+		locks[i] = lt.AcquireLock("MetaReplay", p, lockType)
+	}
+	return func() {
+		for i := len(paths) - 1; i >= 0; i-- {
+			lt.ReleaseLock(paths[i], locks[i])
+		}
+	}
+}
diff --git a/weed/filer/mongodb/mongodb_store_kv.go b/weed/filer/mongodb/mongodb_store_kv.go
index 193bb247b5..ce7ac8fedd 100644
--- a/weed/filer/mongodb/mongodb_store_kv.go
+++ b/weed/filer/mongodb/mongodb_store_kv.go
@@ -46,7 +46,7 @@ func (store *MongodbStore) KvGet(ctx context.Context, key []byte) (value []byte,
 	err = store.connect.Database(store.database).Collection(store.collectionName).FindOne(ctx, where).Decode(&data)
 	if err != mongo.ErrNoDocuments && err != nil {
 		glog.ErrorfCtx(ctx, "kv get: %v", err)
-		return nil, filer.ErrKvNotFound
+		return nil, err
 	}
 
 	if len(data.Meta) == 0 {
diff --git a/weed/filer/mysql/mysql_sql_gen.go b/weed/filer/mysql/mysql_sql_gen.go
index 610235f7c2..3566e4e99c 100644
--- a/weed/filer/mysql/mysql_sql_gen.go
+++ b/weed/filer/mysql/mysql_sql_gen.go
@@ -62,17 +62,29 @@ func (gen *SqlGenMysql) nameExpr() string {
 	return "`name`"
 }
 
+// GetSqlScanPage spells the cursor as two primary-key ranges: MySQL 5.7 does
+// not turn a row-value comparison into a range seek. The name keeps the
+// column's own collation (BINARY would filesort every page); the scan promises
+// no lexical order. SQLite overrides this method.
+func (gen *SqlGenMysql) GetSqlScanPage(tableName string, dirhash int64, name string, limit int) (string, []interface{}) {
+	return fmt.Sprintf("SELECT `dirhash`, `name`, `directory`, `meta` FROM `%s` WHERE `dirhash` > ? OR (`dirhash` = ? AND `name` > ?) ORDER BY `dirhash` ASC, `name` ASC LIMIT ?", tableName),
+		[]interface{}{dirhash, dirhash, name, limit}
+}
+
 func (gen *SqlGenMysql) GetSqlListExclusive(tableName string) string {
 	name := gen.nameExpr()
-	return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND %s > ? AND `directory` = ? AND %s LIKE ? ORDER BY %s ASC LIMIT ?", tableName, name, name, name)
+	return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND %s > ? AND `directory` = ? AND %s LIKE ? ESCAPE '!' ORDER BY %s ASC LIMIT ?", tableName, name, name, name)
 }
 
 func (gen *SqlGenMysql) GetSqlListInclusive(tableName string) string {
 	name := gen.nameExpr()
-	return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND %s >= ? AND `directory` = ? AND %s LIKE ? ORDER BY %s ASC LIMIT ?", tableName, name, name, name)
+	return fmt.Sprintf("SELECT `name`, `meta` FROM `%s` WHERE `dirhash` = ? AND %s >= ? AND `directory` = ? AND %s LIKE ? ESCAPE '!' ORDER BY %s ASC LIMIT ?", tableName, name, name, name)
 }
 
 func (gen *SqlGenMysql) GetSqlCreateTable(tableName string) string {
+	if gen.CreateTableSqlTemplate == "" {
+		return ""
+	}
 	return fmt.Sprintf(gen.CreateTableSqlTemplate, tableName)
 }
 
diff --git a/weed/filer/mysql/mysql_sql_gen_test.go b/weed/filer/mysql/mysql_sql_gen_test.go
index 3f01965f39..d032fc7b74 100644
--- a/weed/filer/mysql/mysql_sql_gen_test.go
+++ b/weed/filer/mysql/mysql_sql_gen_test.go
@@ -65,6 +65,15 @@ func TestListSqlBinaryOrderingOnNonBinaryColumn(t *testing.T) {
 	}
 }
 
+func TestListSqlEscapesLikeWildcards(t *testing.T) {
+	gen := &SqlGenMysql{}
+	for _, got := range []string{gen.GetSqlListExclusive("filemeta"), gen.GetSqlListInclusive("filemeta")} {
+		if !strings.Contains(got, "LIKE ? ESCAPE '!'") {
+			t.Fatalf("list query must declare the escape char matching LikePattern, got: %s", got)
+		}
+	}
+}
+
 func TestIsBinaryCollation(t *testing.T) {
 	binary := []string{"", "binary", "utf8mb4_bin", "utf8mb3_bin", "latin1_bin", "UTF8MB4_BIN"}
 	for _, c := range binary {
diff --git a/weed/filer/mysql/mysql_store.go b/weed/filer/mysql/mysql_store.go
index abcef6fe6e..1da17fd209 100644
--- a/weed/filer/mysql/mysql_store.go
+++ b/weed/filer/mysql/mysql_store.go
@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"os"
 	"strings"
-	"time"
 
 	"github.com/go-sql-driver/mysql"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -33,8 +32,12 @@ func (store *MysqlStore) GetName() string {
 }
 
 func (store *MysqlStore) Initialize(configuration util.Configuration, prefix string) (err error) {
-	// Absent key keeps a pooled default; an explicit 0 disables the idle pool.
-	configuration.SetDefault(prefix+"connection_max_idle", 2)
+	// Fewer idle slots than concurrent operations means a fresh connection per
+	// operation, until the filer runs out of ephemeral ports. connection_max_open
+	// stays unset: a listing runs a second query from its own callback, so a
+	// bounded pool deadlocks once the concurrency reaches it.
+	configuration.SetDefault(prefix+"connection_max_idle", 50)
+	configuration.SetDefault(prefix+"connection_max_lifetime_seconds", 300)
 	// Default on so minimal configs avoid the duplicate-key roundtrip the
 	// inode-index KvPut would otherwise emit on every write.
 	configuration.SetDefault(prefix+"enableUpsert", true)
@@ -147,10 +150,11 @@ func (store *MysqlStore) initialize(dsn string, upsertQuery string, enableUpsert
 		return fmt.Errorf("can not create mysql connector for %s error:%w", maskedDSN(cfg), err)
 	}
 
-	store.DB = sql.OpenDB(connector)
-	store.DB.SetMaxIdleConns(maxIdle)
-	store.DB.SetMaxOpenConns(maxOpen)
-	store.DB.SetConnMaxLifetime(time.Duration(maxLifetimeSeconds) * time.Second)
+	if err = store.UseConnectionPools(sql.OpenDB(connector), func() (*sql.DB, error) {
+		return sql.OpenDB(connector), nil
+	}, maxIdle, maxOpen, maxLifetimeSeconds); err != nil {
+		return err
+	}
 
 	if err = store.DB.Ping(); err != nil {
 		return fmt.Errorf("connect to %s error:%v", maskedDSN(cfg), err)
diff --git a/weed/filer/mysql2/mysql2_store.go b/weed/filer/mysql2/mysql2_store.go
index 0783398a3c..87269376eb 100644
--- a/weed/filer/mysql2/mysql2_store.go
+++ b/weed/filer/mysql2/mysql2_store.go
@@ -5,7 +5,6 @@ import (
 	"database/sql"
 	"fmt"
 	"strings"
-	"time"
 
 	_ "github.com/go-sql-driver/mysql"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -33,8 +32,12 @@ func (store *MysqlStore2) GetName() string {
 }
 
 func (store *MysqlStore2) Initialize(configuration util.Configuration, prefix string) (err error) {
-	// Absent key keeps a pooled default; an explicit 0 disables the idle pool.
-	configuration.SetDefault(prefix+"connection_max_idle", 2)
+	// Fewer idle slots than concurrent operations means a fresh connection per
+	// operation, until the filer runs out of ephemeral ports. connection_max_open
+	// stays unset: a listing runs a second query from its own callback, so a
+	// bounded pool deadlocks once the concurrency reaches it.
+	configuration.SetDefault(prefix+"connection_max_idle", 50)
+	configuration.SetDefault(prefix+"connection_max_lifetime_seconds", 300)
 	// Default on so minimal configs avoid the duplicate-key roundtrip the
 	// inode-index KvPut would otherwise emit on every write.
 	configuration.SetDefault(prefix+"enableUpsert", true)
@@ -80,19 +83,19 @@ func (store *MysqlStore2) initialize(createTable, upsertQuery string, enableUpse
 		adaptedSqlUrl += "&interpolateParams=true"
 	}
 
-	var dbErr error
-	store.DB, dbErr = sql.Open("mysql", sqlUrl)
+	db, dbErr := sql.Open("mysql", sqlUrl)
 	if dbErr != nil {
-		if store.DB != nil {
-			store.DB.Close()
+		if db != nil {
+			db.Close()
 		}
-		store.DB = nil
 		return fmt.Errorf("can not connect to %s error:%w", adaptedSqlUrl, dbErr)
 	}
 
-	store.DB.SetMaxIdleConns(maxIdle)
-	store.DB.SetMaxOpenConns(maxOpen)
-	store.DB.SetConnMaxLifetime(time.Duration(maxLifetimeSeconds) * time.Second)
+	if err = store.UseConnectionPools(db, func() (*sql.DB, error) {
+		return sql.Open("mysql", sqlUrl)
+	}, maxIdle, maxOpen, maxLifetimeSeconds); err != nil {
+		return err
+	}
 
 	if err = store.DB.Ping(); err != nil {
 		return fmt.Errorf("connect to %s error:%v", adaptedSqlUrl, err)
diff --git a/weed/filer/persisted_log_cache.go b/weed/filer/persisted_log_cache.go
index 6f33a8c444..0250c8c00b 100644
--- a/weed/filer/persisted_log_cache.go
+++ b/weed/filer/persisted_log_cache.go
@@ -190,7 +190,7 @@ func loadLogFileEntries(masterClient *wdclient.MasterClient, chunk *filer_pb.Fil
 	lookupFileIdFn := func(ctx context.Context, fileId string) (targetUrls []string, err error) {
 		return masterClient.LookupFileId(ctx, fileId)
 	}
-	if fetchErr := fetchWholeChunk(context.Background(), bytesBuffer, lookupFileIdFn, chunk.GetFileIdString(), chunk.CipherKey, chunk.IsCompressed); fetchErr != nil {
+	if fetchErr := fetchWholeChunk(context.Background(), bytesBuffer, lookupFileIdFn, chunk.GetFileIdString(), chunk.CipherKey, chunk.IsCompressed, masterClient, nil); fetchErr != nil {
 		return nil, false, fetchErr
 	}
 	return decodeLogRecords(bytesBuffer.Bytes())
diff --git a/weed/filer/postgres/postgres_sql_gen.go b/weed/filer/postgres/postgres_sql_gen.go
index e308e26915..4ba99354cf 100644
--- a/weed/filer/postgres/postgres_sql_gen.go
+++ b/weed/filer/postgres/postgres_sql_gen.go
@@ -28,6 +28,21 @@ var (
 	_ = abstract_sql.SqlGenerator(&SqlGenPostgres{})
 )
 
+// ResolveCreateTableQuery normalizes the createTable config value. A boolean
+// true (read by viper as the string "true") selects the default template.
+// An empty or false value returns an empty string so the caller can skip
+// table creation. Any other value is treated as a custom SQL template.
+func ResolveCreateTableQuery(createTable string) string {
+	switch createTable {
+	case "true":
+		return DefaultCreateTableQuery
+	case "false", "":
+		return ""
+	default:
+		return createTable
+	}
+}
+
 func (gen *SqlGenPostgres) GetSqlInsert(tableName string) string {
 	if gen.UpsertQueryTemplate != "" {
 		return fmt.Sprintf(gen.UpsertQueryTemplate, tableName)
@@ -60,17 +75,28 @@ func (gen *SqlGenPostgres) nameExpr() string {
 	return "name"
 }
 
+// GetSqlScanPage uses a row-value comparison, one primary-key range seek on
+// PostgreSQL. The name keeps the column's own collation (COLLATE "C" would
+// sort every page); the scan promises no lexical order.
+func (gen *SqlGenPostgres) GetSqlScanPage(tableName string, dirhash int64, name string, limit int) (string, []interface{}) {
+	return fmt.Sprintf(`SELECT dirhash, name, directory, meta FROM "%s" WHERE (dirhash, name) > ($1, $2) ORDER BY dirhash ASC, name ASC LIMIT $3`, tableName),
+		[]interface{}{dirhash, name, limit}
+}
+
 func (gen *SqlGenPostgres) GetSqlListExclusive(tableName string) string {
 	name := gen.nameExpr()
-	return fmt.Sprintf(`SELECT NAME, meta FROM "%s" WHERE dirhash=$1 AND %s>$2 AND directory=$3 AND %s like $4 ORDER BY %s ASC LIMIT $5`, tableName, name, name, name)
+	return fmt.Sprintf(`SELECT NAME, meta FROM "%s" WHERE dirhash=$1 AND %s>$2 AND directory=$3 AND %s like $4 ESCAPE '!' ORDER BY %s ASC LIMIT $5`, tableName, name, name, name)
 }
 
 func (gen *SqlGenPostgres) GetSqlListInclusive(tableName string) string {
 	name := gen.nameExpr()
-	return fmt.Sprintf(`SELECT NAME, meta FROM "%s" WHERE dirhash=$1 AND %s>=$2 AND directory=$3 AND %s like $4 ORDER BY %s ASC LIMIT $5`, tableName, name, name, name)
+	return fmt.Sprintf(`SELECT NAME, meta FROM "%s" WHERE dirhash=$1 AND %s>=$2 AND directory=$3 AND %s like $4 ESCAPE '!' ORDER BY %s ASC LIMIT $5`, tableName, name, name, name)
 }
 
 func (gen *SqlGenPostgres) GetSqlCreateTable(tableName string) string {
+	if gen.CreateTableSqlTemplate == "" {
+		return ""
+	}
 	return fmt.Sprintf(gen.CreateTableSqlTemplate, tableName)
 }
 
diff --git a/weed/filer/postgres/postgres_sql_gen_test.go b/weed/filer/postgres/postgres_sql_gen_test.go
index 72b11e6577..1cb947bd77 100644
--- a/weed/filer/postgres/postgres_sql_gen_test.go
+++ b/weed/filer/postgres/postgres_sql_gen_test.go
@@ -62,6 +62,15 @@ func TestListSqlBinaryOrderingOnNonBinaryColumn(t *testing.T) {
 	}
 }
 
+func TestListSqlEscapesLikeWildcards(t *testing.T) {
+	gen := &SqlGenPostgres{}
+	for _, got := range []string{gen.GetSqlListExclusive("filemeta"), gen.GetSqlListInclusive("filemeta")} {
+		if !strings.Contains(got, "like $4 ESCAPE '!'") {
+			t.Fatalf("list query must declare the escape char matching LikePattern, got: %s", got)
+		}
+	}
+}
+
 func TestIsByteOrderedCollation(t *testing.T) {
 	byteOrdered := []string{"C", "POSIX", "c", "C.UTF-8", "C.utf8"}
 	for _, c := range byteOrdered {
@@ -76,3 +85,19 @@ func TestIsByteOrderedCollation(t *testing.T) {
 		}
 	}
 }
+
+func TestResolveCreateTableQuery(t *testing.T) {
+	cases := []struct {
+		in, want string
+	}{
+		{"", ""},
+		{"true", DefaultCreateTableQuery},
+		{"false", ""},
+		{"CREATE TABLE custom", "CREATE TABLE custom"},
+	}
+	for _, c := range cases {
+		if got := ResolveCreateTableQuery(c.in); got != c.want {
+			t.Fatalf("ResolveCreateTableQuery(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
diff --git a/weed/filer/postgres/postgres_store.go b/weed/filer/postgres/postgres_store.go
index c694f77c39..fe1e574788 100644
--- a/weed/filer/postgres/postgres_store.go
+++ b/weed/filer/postgres/postgres_store.go
@@ -8,6 +8,9 @@
 package postgres
 
 import (
+	"context"
+	"database/sql"
+	"fmt"
 	"strconv"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -28,12 +31,17 @@ func (store *PostgresStore) GetName() string {
 }
 
 func (store *PostgresStore) Initialize(configuration util.Configuration, prefix string) (err error) {
-	// Absent key keeps a pooled default; an explicit 0 disables the idle pool.
-	configuration.SetDefault(prefix+"connection_max_idle", 2)
+	// Fewer idle slots than concurrent operations means a fresh connection per
+	// operation, until the filer runs out of ephemeral ports. connection_max_open
+	// stays unset: a listing runs a second query from its own callback, so a
+	// bounded pool deadlocks once the concurrency reaches it.
+	configuration.SetDefault(prefix+"connection_max_idle", 50)
+	configuration.SetDefault(prefix+"connection_max_lifetime_seconds", 300)
 	// Default on so minimal configs are not exposed to duplicate-key tx
 	// poisoning on Postgres; an explicit false still disables it.
 	configuration.SetDefault(prefix+"enableUpsert", true)
 	return store.initialize(
+		configuration.GetString(prefix+"createTable"),
 		configuration.GetString(prefix+"upsertQuery"),
 		configuration.GetBool(prefix+"enableUpsert"),
 		configuration.GetString(prefix+"username"),
@@ -54,16 +62,17 @@ func (store *PostgresStore) Initialize(configuration util.Configuration, prefix
 	)
 }
 
-func (store *PostgresStore) initialize(upsertQuery string, enableUpsert bool, user, password, hostname string, port int, database, schema, sslmode, sslcert, sslkey, sslrootcert, sslcrl string, pgbouncerCompatible bool, maxIdle, maxOpen, maxLifetimeSeconds int) (err error) {
+func (store *PostgresStore) initialize(createTable, upsertQuery string, enableUpsert bool, user, password, hostname string, port int, database, schema, sslmode, sslcert, sslkey, sslrootcert, sslcrl string, pgbouncerCompatible bool, maxIdle, maxOpen, maxLifetimeSeconds int) (err error) {
 
 	store.SupportBucketTable = false
+	createTable = ResolveCreateTableQuery(createTable)
 	if !enableUpsert {
 		upsertQuery = ""
 	} else if upsertQuery == "" {
 		upsertQuery = DefaultUpsertQuery
 	}
 	gen := &SqlGenPostgres{
-		CreateTableSqlTemplate: "",
+		CreateTableSqlTemplate: createTable,
 		DropTableSqlTemplate:   `drop table if exists "%s"`,
 		UpsertQueryTemplate:    upsertQuery,
 	}
@@ -115,7 +124,17 @@ func (store *PostgresStore) initialize(upsertQuery string, enableUpsert bool, us
 	if openErr != nil {
 		return openErr
 	}
-	store.DB = db
+	if err = store.UseConnectionPools(db, func() (*sql.DB, error) {
+		return OpenPGXDB(sqlUrl, adaptedSqlUrl, pgbouncerCompatible, maxIdle, maxOpen, maxLifetimeSeconds)
+	}, maxIdle, maxOpen, maxLifetimeSeconds); err != nil {
+		return err
+	}
+
+	if createTable != "" {
+		if _, err = store.DB.ExecContext(context.Background(), gen.GetSqlCreateTable(abstract_sql.DEFAULT_TABLE)); err != nil {
+			return fmt.Errorf("init table %s: %v", abstract_sql.DEFAULT_TABLE, err)
+		}
+	}
 
 	ConfigureListOrdering(store.DB, gen)
 
diff --git a/weed/filer/postgres2/postgres2_store.go b/weed/filer/postgres2/postgres2_store.go
index e846bdf9fe..d523a2abbc 100644
--- a/weed/filer/postgres2/postgres2_store.go
+++ b/weed/filer/postgres2/postgres2_store.go
@@ -9,6 +9,7 @@ package postgres2
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
 	"strconv"
 
@@ -33,8 +34,12 @@ func (store *PostgresStore2) GetName() string {
 }
 
 func (store *PostgresStore2) Initialize(configuration util.Configuration, prefix string) (err error) {
-	// Absent key keeps a pooled default; an explicit 0 disables the idle pool.
-	configuration.SetDefault(prefix+"connection_max_idle", 2)
+	// Fewer idle slots than concurrent operations means a fresh connection per
+	// operation, until the filer runs out of ephemeral ports. connection_max_open
+	// stays unset: a listing runs a second query from its own callback, so a
+	// bounded pool deadlocks once the concurrency reaches it.
+	configuration.SetDefault(prefix+"connection_max_idle", 50)
+	configuration.SetDefault(prefix+"connection_max_lifetime_seconds", 300)
 	// Default on so minimal configs are not exposed to duplicate-key tx
 	// poisoning on Postgres; an explicit false still disables it.
 	configuration.SetDefault(prefix+"enableUpsert", true)
@@ -63,7 +68,9 @@ func (store *PostgresStore2) Initialize(configuration util.Configuration, prefix
 func (store *PostgresStore2) initialize(createTable, upsertQuery string, enableUpsert bool, user, password, hostname string, port int, database, schema, sslmode, sslcert, sslkey, sslrootcert, sslcrl string, pgbouncerCompatible bool, maxIdle, maxOpen, maxLifetimeSeconds int) (err error) {
 
 	store.SupportBucketTable = true
-	if createTable == "" {
+	store.SkipDDL = createTable == "false"
+	createTable = postgres.ResolveCreateTableQuery(createTable)
+	if createTable == "" && !store.SkipDDL {
 		createTable = postgres.DefaultCreateTableQuery
 	}
 	if !enableUpsert {
@@ -124,10 +131,16 @@ func (store *PostgresStore2) initialize(createTable, upsertQuery string, enableU
 	if openErr != nil {
 		return openErr
 	}
-	store.DB = db
+	if err = store.UseConnectionPools(db, func() (*sql.DB, error) {
+		return postgres.OpenPGXDB(sqlUrl, adaptedSqlUrl, pgbouncerCompatible, maxIdle, maxOpen, maxLifetimeSeconds)
+	}, maxIdle, maxOpen, maxLifetimeSeconds); err != nil {
+		return err
+	}
 
-	if err = store.CreateTable(context.Background(), abstract_sql.DEFAULT_TABLE); err != nil {
-		return fmt.Errorf("init table %s: %v", abstract_sql.DEFAULT_TABLE, err)
+	if !store.SkipDDL {
+		if err = store.CreateTable(context.Background(), abstract_sql.DEFAULT_TABLE); err != nil {
+			return fmt.Errorf("init table %s: %v", abstract_sql.DEFAULT_TABLE, err)
+		}
 	}
 
 	postgres.ConfigureListOrdering(store.DB, gen)
diff --git a/weed/filer/read_write.go b/weed/filer/read_write.go
index 1288e06494..7fa572fd95 100644
--- a/weed/filer/read_write.go
+++ b/weed/filer/read_write.go
@@ -3,6 +3,7 @@ package filer
 import (
 	"bytes"
 	"context"
+	"crypto/md5"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -41,6 +42,11 @@ func ReadInsideFiler(ctx context.Context, filerClient filer_pb.SeaweedFilerClien
 	return
 }
 
+// SaveInsideFiler writes content into the entry's inline Content. The content
+// MD5 is stamped on every write so the entry's ETag always describes what is
+// actually stored: conditional writers key IF_ETAG_MATCH off it, and a hash
+// left behind by an earlier write would make that condition pass against
+// content that has since changed.
 func SaveInsideFiler(ctx context.Context, client filer_pb.SeaweedFilerClient, dir, name string, content []byte) error {
 
 	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
@@ -48,6 +54,8 @@ func SaveInsideFiler(ctx context.Context, client filer_pb.SeaweedFilerClient, di
 		Name:      name,
 	})
 
+	contentMd5 := md5.Sum(content)
+
 	if err == filer_pb.ErrNotFound {
 		err = filer_pb.CreateEntry(ctx, client, &filer_pb.CreateEntryRequest{
 			Directory: dir,
@@ -59,6 +67,7 @@ func SaveInsideFiler(ctx context.Context, client filer_pb.SeaweedFilerClient, di
 					Crtime:   time.Now().Unix(),
 					FileMode: uint32(0644),
 					FileSize: uint64(len(content)),
+					Md5:      contentMd5[:],
 				},
 				Content: content,
 			},
@@ -66,9 +75,13 @@ func SaveInsideFiler(ctx context.Context, client filer_pb.SeaweedFilerClient, di
 		})
 	} else if err == nil {
 		entry := resp.Entry
+		if bytes.Equal(entry.Content, content) && bytes.Equal(entry.GetAttributes().GetMd5(), contentMd5[:]) {
+			return nil
+		}
 		entry.Content = content
 		entry.Attributes.Mtime = time.Now().Unix()
 		entry.Attributes.FileSize = uint64(len(content))
+		entry.Attributes.Md5 = contentMd5[:]
 		err = filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
 			Directory: dir,
 			Entry:     entry,
diff --git a/weed/filer/read_write_test.go b/weed/filer/read_write_test.go
new file mode 100644
index 0000000000..59cec8c6cf
--- /dev/null
+++ b/weed/filer/read_write_test.go
@@ -0,0 +1,51 @@
+package filer
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Rewriting identical inline content must not issue UpdateEntry: each one is a
+// metadata event the local meta log persists to /topics/.system/log, and a
+// client that rewrites the same config on a timer (e.g. the operator's 5-minute
+// resync) keeps the volumes growing on an otherwise idle cluster.
+func TestSaveInsideFilerSkipsIdenticalContent(t *testing.T) {
+	ctx := context.Background()
+	client := newFakeFilerConfClient()
+
+	require.NoError(t, SaveInsideFiler(ctx, client, DirectoryEtcSeaweedFS, "a.json", []byte("v1")))
+	require.Equal(t, 0, client.updateCalls)
+
+	require.NoError(t, SaveInsideFiler(ctx, client, DirectoryEtcSeaweedFS, "a.json", []byte("v1")))
+	assert.Equal(t, 0, client.updateCalls)
+
+	require.NoError(t, SaveInsideFiler(ctx, client, DirectoryEtcSeaweedFS, "a.json", []byte("v2")))
+	assert.Equal(t, 1, client.updateCalls)
+
+	content, err := ReadInsideFiler(ctx, client, DirectoryEtcSeaweedFS, "a.json")
+	require.NoError(t, err)
+	assert.Equal(t, []byte("v2"), content)
+}
+
+// A legacy entry holding identical bytes but no Md5 still gets one write to
+// stamp the hash that IF_ETAG_MATCH conditional writes key off; later
+// identical writes skip.
+func TestSaveInsideFilerStampsMd5OnLegacyEntry(t *testing.T) {
+	ctx := context.Background()
+	client := newFakeFilerConfClient()
+	client.entries[client.key(DirectoryEtcSeaweedFS, "b.json")] = &filer_pb.Entry{
+		Name:       "b.json",
+		Content:    []byte("v1"),
+		Attributes: &filer_pb.FuseAttributes{},
+	}
+
+	require.NoError(t, SaveInsideFiler(ctx, client, DirectoryEtcSeaweedFS, "b.json", []byte("v1")))
+	assert.Equal(t, 1, client.updateCalls)
+
+	require.NoError(t, SaveInsideFiler(ctx, client, DirectoryEtcSeaweedFS, "b.json", []byte("v1")))
+	assert.Equal(t, 1, client.updateCalls)
+}
diff --git a/weed/filer/reader_at.go b/weed/filer/reader_at.go
index 5e8fd61545..c8c1f78de3 100644
--- a/weed/filer/reader_at.go
+++ b/weed/filer/reader_at.go
@@ -32,7 +32,9 @@ type ChunkReadAt struct {
 	fileSize      int64
 	readerCache   *ReaderCache
 	readerPattern *ReaderPattern
+	lastChunkMu   sync.Mutex // guards lastChunkFid; mount issues concurrent ReadAt calls
 	lastChunkFid  string
+	stream        chunkStream     // chunk this reader is positioned in, pinned in the shared readerCache
 	prefetchCount int             // Number of chunks to prefetch ahead during sequential reads
 	ctx           context.Context // Context used for cancellation during chunk read operations
 }
@@ -117,9 +119,15 @@ func LookupFn(filerClient filer_pb.FilerClient) wdclient.LookupFileIdFunctionTyp
 
 		fcDataCenter := filerClient.GetDataCenter()
 		var sameDcTargetUrls, otherTargetUrls []string
+		localUrls := make(map[string]bool)
 		for _, loc := range locations.Locations {
 			volumeServerAddress := filerClient.AdjustedUrl(loc)
 			targetUrl := fmt.Sprintf("http://%s/%s", volumeServerAddress, fileId)
+			glog.V(4).Infof("lookup %s => %s, data in remote storage tier: %v", fileId, targetUrl, loc.DataInRemote)
+
+			if !loc.DataInRemote {
+				localUrls[targetUrl] = true
+			}
 			if fcDataCenter == "" || fcDataCenter != loc.DataCenter {
 				otherTargetUrls = append(otherTargetUrls, targetUrl)
 			} else {
@@ -132,7 +140,13 @@ func LookupFn(filerClient filer_pb.FilerClient) wdclient.LookupFileIdFunctionTyp
 		rand.Shuffle(len(otherTargetUrls), func(i, j int) {
 			otherTargetUrls[i], otherTargetUrls[j] = otherTargetUrls[j], otherTargetUrls[i]
 		})
-		// Prefer same data center
+		// Local replicas go first inside each data center, but never ahead of
+		// the data-center preference itself. Matches the wdclient lookup paths
+		// so deprecated callers pick cheap reads first too.
+		if len(localUrls) > 0 {
+			sameDcTargetUrls = util.ReorderToFront(localUrls, sameDcTargetUrls)
+			otherTargetUrls = util.ReorderToFront(localUrls, otherTargetUrls)
+		}
 		targetUrls = append(sameDcTargetUrls, otherTargetUrls...)
 		return
 	}
@@ -155,10 +169,17 @@ func (c *ChunkReadAt) Size() int64 {
 }
 
 func (c *ChunkReadAt) Close() error {
+	c.ReleaseStream()
 	c.readerCache.destroy()
 	return nil
 }
 
+// ReleaseStream drops this reader's hold on the chunk it is positioned in.
+// Unlike Close it leaves the (possibly shared) ReaderCache intact.
+func (c *ChunkReadAt) ReleaseStream() {
+	c.readerCache.releaseStream(&c.stream)
+}
+
 func (c *ChunkReadAt) ReadAt(p []byte, offset int64) (n int, err error) {
 
 	c.readerPattern.MonitorReadAt(offset, len(p))
@@ -288,6 +309,15 @@ func (c *ChunkReadAt) doReadAt(ctx context.Context, p []byte, offset int64) (n i
 		}
 
 		if err != nil {
+			// a failed chunk leaves its window untouched while the tasks after it
+			// may well have filled theirs, so only the prefix up to the hole is
+			// data the caller may use
+			for _, task := range tasks {
+				if int64(task.bytesRead) != task.bufferEnd-task.bufferStart {
+					n = int(task.bufferStart) + task.bytesRead
+					break
+				}
+			}
 			return n, ts, err
 		}
 	}
@@ -319,35 +349,53 @@ func (c *ChunkReadAt) doReadAt(ctx context.Context, p []byte, offset int64) (n i
 
 func (c *ChunkReadAt) readChunkSliceAt(ctx context.Context, buffer []byte, chunkView *ChunkView, nextChunkViews *Interval[*ChunkView], offset uint64) (n int, err error) {
 
-	if c.readerPattern.IsRandomMode() {
+	// A view clipped to part of its chunk (e.g. the edge of a ranged GET,
+	// whose views ViewFromVisibleIntervals clips to the request) only ever
+	// needs that part: fetch it as a range no matter the detected pattern.
+	// Fetching the chunk whole would multiply volume-server reads. Ciphered
+	// and compressed chunks are the exception: the volume server reads the
+	// whole blob to serve a range, so they take the shared whole-chunk path
+	// where one download serves every buffer — unless the whole chunk cannot
+	// even fit the reader budget, in which case a range fetch is the only
+	// way to serve the request.
+	rangeFetch := chunkView.CanRangeFetch() || !c.readerCache.budget.canFit(int(chunkView.ChunkSize))
+	if rangeFetch && (!chunkView.IsFullChunk() || c.readerPattern.IsRandomMode()) {
+		c.readerCache.releaseStream(&c.stream)
 		n, err := c.readerCache.chunkCache.ReadChunkAt(buffer, chunkView.FileId, offset)
 		if n > 0 {
 			return n, err
 		}
-		return fetchChunkRange(ctx, buffer, c.readerCache.lookupFileIdFn, chunkView.FileId, chunkView.CipherKey, chunkView.IsGzipped, int64(offset))
+		return c.readerCache.fetchChunkRange(ctx, buffer, chunkView, int64(offset))
 	}
 
 	shouldCache := (uint64(chunkView.ViewOffset) + chunkView.ChunkSize) <= c.readerCache.chunkCache.GetMaxFilePartSizeInCache()
-	n, err = c.readerCache.ReadChunkAt(ctx, buffer, chunkView.FileId, chunkView.CipherKey, chunkView.IsGzipped, int64(offset), int(chunkView.ChunkSize), shouldCache)
-	if c.lastChunkFid != chunkView.FileId {
-		if chunkView.OffsetInChunk == 0 { // start of a new chunk
-			if c.lastChunkFid != "" {
-				c.readerCache.UnCache(c.lastChunkFid)
-			}
-			if nextChunkViews != nil && c.prefetchCount > 0 {
-				// Prefetch multiple chunks ahead for better sequential read throughput
-				// This keeps the network pipeline full with parallel chunk fetches
-				c.readerCache.MaybeCache(nextChunkViews, c.prefetchCount)
-			}
+	// The previous chunk is released through the stream pin rather than
+	// UnCache: the buffer is shared, and other streams may still be reading it.
+	n, err = c.readerCache.readChunkAt(ctx, &c.stream, buffer, chunkView.FileId, chunkView.CipherKey, chunkView.IsGzipped, int64(offset), int(chunkView.ChunkSize), shouldCache)
+	c.lastChunkMu.Lock()
+	enteredChunk := c.lastChunkFid != chunkView.FileId
+	c.lastChunkFid = chunkView.FileId
+	c.lastChunkMu.Unlock()
+	if enteredChunk && chunkView.OffsetInChunk == 0 { // start of a new chunk
+		if nextChunkViews != nil && c.prefetchCount > 0 {
+			// Prefetch multiple chunks ahead for better sequential read throughput
+			// This keeps the network pipeline full with parallel chunk fetches
+			c.readerCache.MaybeCache(nextChunkViews, c.prefetchCount)
 		}
 	}
-	c.lastChunkFid = chunkView.FileId
 	return
 }
 
 // readChunkSliceAtForParallel is a simplified version for parallel chunk fetching
 // It doesn't update lastChunkFid or trigger prefetch (handled by the caller)
 func (c *ChunkReadAt) readChunkSliceAtForParallel(ctx context.Context, buffer []byte, chunkView *ChunkView, offset uint64) (n int, err error) {
+	if (chunkView.CanRangeFetch() || !c.readerCache.budget.canFit(int(chunkView.ChunkSize))) && !chunkView.IsFullChunk() {
+		n, err = c.readerCache.chunkCache.ReadChunkAt(buffer, chunkView.FileId, offset)
+		if n > 0 {
+			return n, err
+		}
+		return c.readerCache.fetchChunkRange(ctx, buffer, chunkView, int64(offset))
+	}
 	shouldCache := (uint64(chunkView.ViewOffset) + chunkView.ChunkSize) <= c.readerCache.chunkCache.GetMaxFilePartSizeInCache()
 	return c.readerCache.ReadChunkAt(ctx, buffer, chunkView.FileId, chunkView.CipherKey, chunkView.IsGzipped, int64(offset), int(chunkView.ChunkSize), shouldCache)
 }
diff --git a/weed/filer/reader_at_prefetch_window_test.go b/weed/filer/reader_at_prefetch_window_test.go
new file mode 100644
index 0000000000..982bc40cb7
--- /dev/null
+++ b/weed/filer/reader_at_prefetch_window_test.go
@@ -0,0 +1,74 @@
+package filer
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/util/chunk_cache"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
+)
+
+// A sequential reader that consumes a chunk in several small ReadAt calls, as
+// the S3 GET path does with its 256 KiB copy buffer over 4 MiB chunks, must
+// keep its read-ahead at prefetchCount chunks. Each ReadAt triggers a
+// prefetch; if chunks already being fetched are not counted toward the
+// window, every call starts prefetchCount more downloads and the read-ahead
+// runs to the ReaderCache downloader limit, buffering most of the object.
+func TestChunkReadAtSequentialPrefetchStaysWithinWindow(t *testing.T) {
+	const chunkSize = 64 << 10
+	const chunkCount = 64
+	const sliceSize = 16 << 10
+
+	var readerChunk atomic.Int64
+	var maxLead atomic.Int64
+	rc := NewReaderCache(256, (*chunk_cache.TieredChunkCache)(nil), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, fileId string, _ util_http.RefreshUrlsFunc) (int, error) {
+		idx, err := strconv.Atoi(strings.TrimPrefix(fileId, "chunk"))
+		if err != nil {
+			return 0, err
+		}
+		lead := int64(idx) - readerChunk.Load()
+		for {
+			cur := maxLead.Load()
+			if lead <= cur || maxLead.CompareAndSwap(cur, lead) {
+				break
+			}
+		}
+		return len(buffer), nil
+	}
+
+	views := NewIntervalList[*ChunkView]()
+	for i := 0; i < chunkCount; i++ {
+		views.AppendInterval(&Interval[*ChunkView]{
+			StartOffset: int64(i * chunkSize),
+			StopOffset:  int64((i + 1) * chunkSize),
+			Value: &ChunkView{
+				FileId:     fmt.Sprintf("chunk%d", i),
+				ViewSize:   chunkSize,
+				ViewOffset: int64(i * chunkSize),
+				ChunkSize:  chunkSize,
+			},
+		})
+	}
+	reader := NewChunkReaderAtFromClient(context.Background(), rc, views, chunkSize*chunkCount, DefaultPrefetchCount)
+	defer reader.ReleaseStream()
+
+	buf := make([]byte, sliceSize)
+	for off := int64(0); off < chunkSize*chunkCount; off += sliceSize {
+		readerChunk.Store(off / chunkSize)
+		if _, err := reader.ReadAt(buf, off); err != nil && off+sliceSize < chunkSize*chunkCount {
+			t.Fatalf("ReadAt(%d): %v", off, err)
+		}
+	}
+
+	if got := maxLead.Load(); got > DefaultPrefetchCount {
+		t.Fatalf("read-ahead reached %d chunks past the reader, want at most %d", got, DefaultPrefetchCount)
+	}
+}
diff --git a/weed/filer/reader_at_shared_test.go b/weed/filer/reader_at_shared_test.go
new file mode 100644
index 0000000000..a293163900
--- /dev/null
+++ b/weed/filer/reader_at_shared_test.go
@@ -0,0 +1,478 @@
+package filer
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/util/chunk_cache"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
+)
+
+// Two streams (e.g. two S3 GETs) reading the same object through one shared
+// ReaderCache, interleaved in small slices, must share each chunk download:
+// one stream finishing a chunk, or moving on to the next one, must not drop a
+// buffer the other stream is still reading.
+func TestChunkReadAtConcurrentStreamsShareChunks(t *testing.T) {
+	const chunkSize = 64 << 10
+	const chunkCount = 3
+	const sliceSize = 16 << 10
+
+	var mu sync.Mutex
+	fetches := map[string]int{}
+	rc := NewReaderCache(64, (*chunk_cache.TieredChunkCache)(nil), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, fileId string, _ util_http.RefreshUrlsFunc) (int, error) {
+		mu.Lock()
+		fetches[fileId]++
+		mu.Unlock()
+		for i := range buffer {
+			buffer[i] = fileId[len(fileId)-1]
+		}
+		return len(buffer), nil
+	}
+
+	newStream := func() *ChunkReadAt {
+		views := NewIntervalList[*ChunkView]()
+		for i := 0; i < chunkCount; i++ {
+			views.AppendInterval(&Interval[*ChunkView]{
+				StartOffset: int64(i * chunkSize),
+				StopOffset:  int64((i + 1) * chunkSize),
+				Value: &ChunkView{
+					FileId:     fmt.Sprintf("chunk%d", i),
+					ViewSize:   chunkSize,
+					ViewOffset: int64(i * chunkSize),
+					ChunkSize:  chunkSize,
+				},
+			})
+		}
+		return NewChunkReaderAtFromClient(context.Background(), rc, views, chunkSize*chunkCount, 0)
+	}
+	streams := []*ChunkReadAt{newStream(), newStream()}
+
+	// The streams alternate slice by slice, the second one lagging one slice
+	// behind, so the leader always finishes a chunk while the follower is
+	// still inside it.
+	offsets := make([]int64, len(streams))
+	offsets[1] = -sliceSize
+	for offsets[1] < chunkSize*chunkCount {
+		for i, stream := range streams {
+			if offsets[i] < 0 || offsets[i] >= chunkSize*chunkCount {
+				offsets[i] += sliceSize
+				continue
+			}
+			buf := make([]byte, sliceSize)
+			n, err := stream.ReadAt(buf, offsets[i])
+			if (err != nil && err != io.EOF) || n != sliceSize {
+				t.Fatalf("stream %d at %d: n=%d err=%v", i, offsets[i], n, err)
+			}
+			if want := byte('0' + offsets[i]/chunkSize); buf[0] != want || buf[n-1] != want {
+				t.Fatalf("stream %d at %d: got %q, want %q", i, offsets[i], buf[0], want)
+			}
+			offsets[i] += sliceSize
+		}
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+	for i := 0; i < chunkCount; i++ {
+		fileId := fmt.Sprintf("chunk%d", i)
+		if fetches[fileId] != 1 {
+			t.Errorf("%s fetched %d times for two concurrent streams, want 1", fileId, fetches[fileId])
+		}
+	}
+}
+
+func newStreamTestReaderCache(chunkCache chunk_cache.ChunkCache) *ReaderCache {
+	rc := NewReaderCache(64, chunkCache, func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		return len(buffer), nil
+	}
+	return rc
+}
+
+func isRetained(rc *ReaderCache, fileId string) bool {
+	rc.Lock()
+	defer rc.Unlock()
+	_, found := rc.downloaders[fileId]
+	return found
+}
+
+// A stream moving on to a chunk served from the chunk cache must still
+// release the chunk it was positioned in before.
+func TestChunkStreamReleasesPreviousChunkOnCacheHit(t *testing.T) {
+	cache := newMockChunkCacheForReaderCache()
+	cache.SetChunk("chunk1", make([]byte, 4<<10))
+	rc := newStreamTestReaderCache(cache)
+	defer rc.destroy()
+
+	stream := &chunkStream{}
+	if _, err := rc.readChunkAt(context.Background(), stream, make([]byte, 1<<10), "chunk0", nil, false, 0, 4<<10, false); err != nil {
+		t.Fatal(err)
+	}
+	if n, err := rc.readChunkAt(context.Background(), stream, make([]byte, 1<<10), "chunk1", nil, false, 0, 4<<10, true); err != nil || n == 0 {
+		t.Fatalf("cache hit read: n=%d err=%v", n, err)
+	}
+	if isRetained(rc, "chunk0") {
+		t.Fatal("chunk0 still retained after the stream moved on to a cached chunk")
+	}
+}
+
+// A chunk the stream leaves while another read is in flight must be dropped
+// once that read ends, even if it did not read the chunk to the end.
+func TestChunkStreamDropsLeftChunkAfterInFlightRead(t *testing.T) {
+	rc := newStreamTestReaderCache(newMockChunkCacheForReaderCache())
+	defer rc.destroy()
+
+	stream := &chunkStream{}
+	if _, err := rc.readChunkAt(context.Background(), stream, make([]byte, 1<<10), "chunk0", nil, false, 0, 4<<10, false); err != nil {
+		t.Fatal(err)
+	}
+	// Another reader is in the middle of a partial read of chunk0.
+	rc.Lock()
+	other := rc.downloaders["chunk0"]
+	other.wg.Add(1)
+	atomic.AddInt32(&other.readers, 1)
+	rc.Unlock()
+
+	if _, err := rc.readChunkAt(context.Background(), stream, make([]byte, 1<<10), "chunk1", nil, false, 0, 4<<10, false); err != nil {
+		t.Fatal(err)
+	}
+	if !isRetained(rc, "chunk0") {
+		t.Fatal("chunk0 dropped while a read was still in flight")
+	}
+
+	// The in-flight read ends without reaching the end of the chunk.
+	other.wg.Done()
+	atomic.AddInt32(&other.readers, -1)
+	rc.removeConsumed(other)
+	if isRetained(rc, "chunk0") {
+		t.Fatal("chunk0 retained after the stream left it and the last read ended")
+	}
+}
+
+// Concurrent ReadAt calls on one ChunkReadAt (as mount does) share its stream
+// pin; they must neither race on it nor leak or double-release pins.
+func TestChunkStreamConcurrentReadsOnOneReader(t *testing.T) {
+	const chunkSize = 16 << 10
+	const chunkCount = 4
+	const sliceSize = 4 << 10
+	rc := newStreamTestReaderCache((*chunk_cache.TieredChunkCache)(nil))
+	defer rc.destroy()
+
+	views := NewIntervalList[*ChunkView]()
+	for i := 0; i < chunkCount; i++ {
+		views.AppendInterval(&Interval[*ChunkView]{
+			StartOffset: int64(i * chunkSize),
+			StopOffset:  int64((i + 1) * chunkSize),
+			Value: &ChunkView{
+				FileId:     fmt.Sprintf("chunk%d", i),
+				ViewSize:   chunkSize,
+				ViewOffset: int64(i * chunkSize),
+				ChunkSize:  chunkSize,
+			},
+		})
+	}
+	reader := NewChunkReaderAtFromClient(context.Background(), rc, views, chunkSize*chunkCount, 0)
+
+	var wg sync.WaitGroup
+	for g := 0; g < 8; g++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for offset := int64(0); offset < chunkSize*chunkCount; offset += sliceSize {
+				if _, err := reader.ReadAt(make([]byte, sliceSize), offset); err != nil && err != io.EOF {
+					t.Error(err)
+					return
+				}
+			}
+		}()
+	}
+	wg.Wait()
+
+	// Finishing the last chunk releases the stream's final pin.
+	if _, err := reader.ReadAt(make([]byte, sliceSize), chunkSize*chunkCount-sliceSize); err != nil && err != io.EOF {
+		t.Fatal(err)
+	}
+	rc.Lock()
+	defer rc.Unlock()
+	for fileId, cacher := range rc.downloaders {
+		t.Errorf("%s retained after all reads finished: pins=%d readers=%d", fileId, atomic.LoadInt32(&cacher.pins), atomic.LoadInt32(&cacher.readers))
+	}
+}
+
+type recordedFetch struct {
+	fileId      string
+	isFullChunk bool
+	offset      int64
+	size        int
+}
+
+// fetchRecorder stubs the volume fetch and records how each chunk was
+// requested: isFullChunk=false is a range fetch of just the view's slice,
+// isFullChunk=true is a whole-chunk download into the shared cache.
+func fetchRecorder(rc *ReaderCache) (fetches *[]recordedFetch) {
+	var mu sync.Mutex
+	recorded := &[]recordedFetch{}
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, isFullChunk bool, offset int64, fileId string, _ util_http.RefreshUrlsFunc) (int, error) {
+		mu.Lock()
+		*recorded = append(*recorded, recordedFetch{fileId, isFullChunk, offset, len(buffer)})
+		mu.Unlock()
+		for i := range buffer {
+			buffer[i] = fileId[len(fileId)-1]
+		}
+		return len(buffer), nil
+	}
+	return recorded
+}
+
+// A reader whose views are clipped to a request window — how the S3 gateway
+// builds a ranged GET — must fetch only the covered part of each chunk:
+// clipped edge views take range fetches, a fully covered chunk keeps the
+// shared whole-chunk path. This is what keeps a ranged GET larger than a
+// buffer from multiplying volume-server reads (issue #11564), without giving
+// up whole-chunk caching where the whole chunk is actually wanted.
+func TestChunkReadAtClippedViewsFetchOnlyCoveredParts(t *testing.T) {
+	const chunkSize = 64 << 10
+
+	rc := NewReaderCache(64, (*chunk_cache.TieredChunkCache)(nil), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	fetches := fetchRecorder(rc)
+
+	// Window [56KiB, 152KiB): tail of chunk0, all of chunk1, head of
+	// chunk2, head of ciphered chunk3, head of compressed chunk4 (file
+	// chunks need not be aligned).
+	views := NewIntervalList[*ChunkView]()
+	views.AppendInterval(&Interval[*ChunkView]{
+		StartOffset: chunkSize - 8<<10,
+		StopOffset:  chunkSize,
+		Value:       &ChunkView{FileId: "chunk0", OffsetInChunk: chunkSize - 8<<10, ViewSize: 8 << 10, ViewOffset: chunkSize - 8<<10, ChunkSize: chunkSize},
+	})
+	views.AppendInterval(&Interval[*ChunkView]{
+		StartOffset: chunkSize,
+		StopOffset:  2 * chunkSize,
+		Value:       &ChunkView{FileId: "chunk1", ViewSize: chunkSize, ViewOffset: chunkSize, ChunkSize: chunkSize},
+	})
+	views.AppendInterval(&Interval[*ChunkView]{
+		StartOffset: 2 * chunkSize,
+		StopOffset:  2*chunkSize + 8<<10,
+		Value:       &ChunkView{FileId: "chunk2", ViewSize: 8 << 10, ViewOffset: 2 * chunkSize, ChunkSize: chunkSize},
+	})
+	views.AppendInterval(&Interval[*ChunkView]{
+		StartOffset: 2*chunkSize + 8<<10,
+		StopOffset:  2*chunkSize + 16<<10,
+		Value:       &ChunkView{FileId: "chunk3", ViewSize: 8 << 10, ViewOffset: 2*chunkSize + 8<<10, ChunkSize: chunkSize, CipherKey: []byte("key")},
+	})
+	views.AppendInterval(&Interval[*ChunkView]{
+		StartOffset: 2*chunkSize + 16<<10,
+		StopOffset:  2*chunkSize + 24<<10,
+		Value:       &ChunkView{FileId: "chunk4", ViewSize: 8 << 10, ViewOffset: 2*chunkSize + 16<<10, ChunkSize: chunkSize, IsGzipped: true},
+	})
+
+	reader := NewChunkReaderAtFromClient(context.Background(), rc, views, 4*chunkSize, 0)
+	buf := make([]byte, chunkSize+32<<10)
+	if n, err := reader.ReadAt(buf, chunkSize-8<<10); err != nil || n != len(buf) {
+		t.Fatalf("window read: n=%d err=%v", n, err)
+	}
+	// buf holds [56KiB, 152KiB): chunk0's tail, chunk1, and the heads of
+	// chunk2, chunk3 and chunk4.
+	for i, b := range buf {
+		want := byte('1')
+		if i < 8<<10 {
+			want = '0'
+		} else if i >= 24<<10+chunkSize {
+			want = '4'
+		} else if i >= 16<<10+chunkSize {
+			want = '3'
+		} else if i >= 8<<10+chunkSize {
+			want = '2'
+		}
+		if b != want {
+			t.Fatalf("buf[%d]=%q, want %q", i, b, want)
+		}
+	}
+
+	want := []recordedFetch{
+		{fileId: "chunk0", isFullChunk: false, offset: chunkSize - 8<<10, size: 8 << 10},
+		{fileId: "chunk1", isFullChunk: true, offset: 0, size: chunkSize},
+		{fileId: "chunk2", isFullChunk: false, offset: 0, size: 8 << 10},
+		// partial views, but ciphered and compressed chunks download whole
+		// either way and the shared path decrypts/decompresses once for
+		// every buffer
+		{fileId: "chunk3", isFullChunk: true, offset: 0, size: chunkSize},
+		{fileId: "chunk4", isFullChunk: true, offset: 0, size: chunkSize},
+	}
+	got := map[string]recordedFetch{}
+	for _, f := range *fetches {
+		if _, dup := got[f.fileId]; dup {
+			t.Fatalf("chunk %s fetched more than once: %+v", f.fileId, *fetches)
+		}
+		got[f.fileId] = f
+	}
+	for _, w := range want {
+		if g, ok := got[w.fileId]; !ok {
+			t.Fatalf("chunk %s never fetched: %+v", w.fileId, *fetches)
+		} else if g != w {
+			t.Fatalf("chunk %s fetched as %+v, want %+v", w.fileId, g, w)
+		}
+	}
+}
+
+// The regression from issue #11564: a ranged GET sitting inside one big
+// chunk. Every buffer of the request must stay a range fetch — none may
+// escalate into a whole-chunk download once the reads look sequential.
+func TestChunkReadAtRangeInsideOneChunkStaysRangeFetch(t *testing.T) {
+	const chunkSize = 1 << 20
+	const sliceSize = 16 << 10
+
+	rc := NewReaderCache(64, (*chunk_cache.TieredChunkCache)(nil), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	fetches := fetchRecorder(rc)
+
+	// Range [32KiB, 96KiB) inside one 1MiB chunk: a single clipped view.
+	views := NewIntervalList[*ChunkView]()
+	views.AppendInterval(&Interval[*ChunkView]{
+		StartOffset: 32 << 10,
+		StopOffset:  96 << 10,
+		Value:       &ChunkView{FileId: "chunk0", OffsetInChunk: 32 << 10, ViewSize: 64 << 10, ViewOffset: 32 << 10, ChunkSize: chunkSize},
+	})
+
+	reader := NewChunkReaderAtFromClient(context.Background(), rc, views, chunkSize, 0)
+	for offset := int64(32 << 10); offset < 96<<10; offset += sliceSize {
+		buf := make([]byte, sliceSize)
+		if n, err := reader.ReadAt(buf, offset); err != nil || n != sliceSize {
+			t.Fatalf("read at %d: n=%d err=%v", offset, n, err)
+		}
+	}
+
+	if len(*fetches) != 4 {
+		t.Fatalf("got %d fetches, want 4 range fetches: %+v", len(*fetches), *fetches)
+	}
+	for i, f := range *fetches {
+		wantOffset := int64(32<<10) + int64(i)*sliceSize
+		if f.isFullChunk || f.offset != wantOffset || f.size != sliceSize {
+			t.Fatalf("fetch %d = %+v, want range fetch offset=%d size=%d", i, f, wantOffset, sliceSize)
+		}
+	}
+}
+
+// A compressed chunk larger than the reader cache budget can never be
+// downloaded whole — the budget rejects the buffer — so its partial view
+// must fall back to a range fetch even though each range costs a full
+// decompress server-side. The alternative is a failed GET.
+func TestChunkReadAtOversizedCompressedChunkFallsBackToRange(t *testing.T) {
+	const chunkSize = 1 << 20
+	const sliceSize = 16 << 10
+
+	budget := NewReaderCacheBudget(64 << 10) // smaller than the chunk
+	rc := NewReaderCache(64, (*chunk_cache.TieredChunkCache)(nil), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil, budget)
+	defer rc.destroy()
+	fetches := fetchRecorder(rc)
+
+	views := NewIntervalList[*ChunkView]()
+	views.AppendInterval(&Interval[*ChunkView]{
+		StartOffset: 32 << 10,
+		StopOffset:  64 << 10,
+		Value:       &ChunkView{FileId: "chunk0", OffsetInChunk: 32 << 10, ViewSize: 32 << 10, ViewOffset: 32 << 10, ChunkSize: chunkSize, IsGzipped: true},
+	})
+
+	reader := NewChunkReaderAtFromClient(context.Background(), rc, views, chunkSize, 0)
+	buf := make([]byte, 32<<10)
+	if n, err := reader.ReadAt(buf, 32<<10); err != nil || n != len(buf) {
+		t.Fatalf("read: n=%d err=%v", n, err)
+	}
+
+	if len(*fetches) != 1 {
+		t.Fatalf("got %d fetches, want 1 range fetch: %+v", len(*fetches), *fetches)
+	}
+	if f := (*fetches)[0]; f.isFullChunk || f.offset != 32<<10 || f.size != 32<<10 {
+		t.Fatalf("fetch = %+v, want range fetch offset=%d size=%d", f, 32<<10, 32<<10)
+	}
+}
+
+// A chunk a stream is positioned in must outlast downloader-limit eviction:
+// otherwise a busy cache drops the buffer mid-stream and forces a refetch.
+func TestChunkReadAtPinnedChunkSurvivesEviction(t *testing.T) {
+	const chunkSize = 64 << 10
+
+	var fetches int32
+	rc := NewReaderCache(2, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, fileId string, _ util_http.RefreshUrlsFunc) (int, error) {
+		if fileId == "chunk0" {
+			atomic.AddInt32(&fetches, 1)
+		}
+		return len(buffer), nil
+	}
+
+	stream := &chunkStream{}
+	buf := make([]byte, 16<<10)
+	// One slice in: the stream is positioned in chunk0 but has not left it.
+	if _, err := rc.readChunkAt(context.Background(), stream, buf, "chunk0", nil, false, 0, chunkSize, false); err != nil {
+		t.Fatal(err)
+	}
+
+	// Fill the downloader map past its limit with unpinned chunks.
+	for _, fileId := range []string{"chunk1", "chunk2", "chunk3"} {
+		if _, err := rc.ReadChunkAt(context.Background(), buf, fileId, nil, false, 0, chunkSize, true); err != nil {
+			t.Fatalf("read %s: %v", fileId, err)
+		}
+	}
+
+	// The stream's next slice must come from the still-pinned buffer.
+	if _, err := rc.readChunkAt(context.Background(), stream, buf, "chunk0", nil, false, 16<<10, chunkSize, false); err != nil {
+		t.Fatal(err)
+	}
+	if got := atomic.LoadInt32(&fetches); got != 1 {
+		t.Errorf("chunk0 fetched %d times, want 1", got)
+	}
+}
+
+// When every downloader is pinned the limit still applies: the oldest pinned
+// buffer is evicted so abandoned streams cannot grow memory past the limit.
+func TestChunkReadAtPinnedEvictionFallsBackWhenAllPinned(t *testing.T) {
+	const chunkSize = 64 << 10
+	rc := NewReaderCache(2, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		return len(buffer), nil
+	}
+
+	buf := make([]byte, 16<<10)
+	streamA := &chunkStream{}
+	streamB := &chunkStream{}
+	if _, err := rc.readChunkAt(context.Background(), streamA, buf, "chunk0", nil, false, 0, chunkSize, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := rc.readChunkAt(context.Background(), streamB, buf, "chunk1", nil, false, 0, chunkSize, false); err != nil {
+		t.Fatal(err)
+	}
+
+	// Every downloader is now pinned; the next chunk must still get in.
+	if _, err := rc.readChunkAt(context.Background(), &chunkStream{}, buf, "chunk2", nil, false, 0, chunkSize, false); err != nil {
+		t.Fatal(err)
+	}
+	if isRetained(rc, "chunk0") {
+		t.Fatal("oldest pinned downloader was not evicted past the limit")
+	}
+	if !isRetained(rc, "chunk2") {
+		t.Fatal("new downloader missing after pinned fallback eviction")
+	}
+}
diff --git a/weed/filer/reader_at_test.go b/weed/filer/reader_at_test.go
index 782e4b3423..fde3fc0e36 100644
--- a/weed/filer/reader_at_test.go
+++ b/weed/filer/reader_at_test.go
@@ -3,10 +3,14 @@ package filer
 import (
 	"bytes"
 	"context"
+	"errors"
 	"io"
 	"math"
 	"strconv"
 	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 type mockChunkCache struct {
@@ -202,3 +206,54 @@ func TestReaderAtSparseFileDoesNotLeak(t *testing.T) {
 	testReadAt(t, readerAt, 0, 3, 3, io.EOF, []byte{2, 2, 2}, []byte{0, 0, 0})
 	testReadAt(t, readerAt, 1, 2, 2, io.EOF, []byte{2, 2}, []byte{0, 0})
 }
+
+// holeChunkCache serves every chunk but one, so that chunk falls through to a
+// lookup that fails.
+type holeChunkCache struct {
+	mockChunkCache
+	missingFileId string
+}
+
+func (c *holeChunkCache) ReadChunkAt(data []byte, fileId string, offset uint64) (int, error) {
+	if fileId == c.missingFileId {
+		return 0, nil
+	}
+	return c.mockChunkCache.ReadChunkAt(data, fileId, offset)
+}
+
+func (c *holeChunkCache) GetMaxFilePartSizeInCache() uint64 {
+	return math.MaxUint64
+}
+
+// The parallel reads place their bytes directly in the output buffer, so a
+// failing middle chunk leaves a hole with valid data after it. Reporting that
+// length would hand the caller bytes it never read.
+func TestReaderAtParallelFailureReturnsContiguousPrefix(t *testing.T) {
+	visibles := NewIntervalList[*VisibleInterval]()
+	for i, fileId := range []string{"1", "2", "3"} {
+		addVisibleInterval(visibles, &VisibleInterval{
+			start:     int64(i) * 4,
+			stop:      int64(i)*4 + 4,
+			fileId:    fileId,
+			chunkSize: 4,
+		})
+	}
+
+	readerAt := &ChunkReadAt{
+		ctx:        context.Background(),
+		chunkViews: ViewFromVisibleIntervals(visibles, 0, math.MaxInt64),
+		fileSize:   12,
+		readerCache: NewReaderCache(3, &holeChunkCache{missingFileId: "2"}, func(ctx context.Context, fileId string) ([]string, error) {
+			return nil, errors.New("volume down")
+		}, nil),
+		readerPattern: NewReaderPattern(),
+		prefetchCount: 3,
+	}
+
+	buf := make([]byte, 12)
+	n, err := readerAt.ReadAt(buf, 0)
+
+	require.Error(t, err)
+	assert.Equal(t, 4, n, "only the bytes before the failed chunk are readable")
+	assert.Equal(t, []byte{1, 1, 1, 1}, buf[:n])
+}
diff --git a/weed/filer/reader_cache.go b/weed/filer/reader_cache.go
index 055666fd81..cd6049beea 100644
--- a/weed/filer/reader_cache.go
+++ b/weed/filer/reader_cache.go
@@ -18,20 +18,25 @@ type CacheInvalidator interface {
 	InvalidateCache(fileId string)
 }
 
-type fetchChunkDataFnType func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, fileId string) (n int, err error)
+type fetchChunkDataFnType func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, fileId string, refreshUrls util_http.RefreshUrlsFunc) (n int, err error)
 
 type ReaderCache struct {
 	chunkCache       chunk_cache.ChunkCache
 	lookupFileIdFn   wdclient.LookupFileIdFunctionType
 	cacheInvalidator CacheInvalidator
 	fetchChunkDataFn fetchChunkDataFnType
-	sync.Mutex
+	sync.RWMutex
 	downloaders map[string]*SingleChunkCacher
 	limit       int
+	budget      *ReaderCacheBudget
 }
 
 type SingleChunkCacher struct {
 	completedTimeNew int64
+	readers          int32
+	consumed         int32
+	pins             int32 // streams currently positioned inside this chunk
+	left             int32 // set once the last pinning stream moved on
 	sync.Mutex
 	parent         *ReaderCache
 	chunkFileId    string
@@ -46,9 +51,14 @@ type SingleChunkCacher struct {
 	done           chan struct{} // signals when download is complete
 }
 
-func NewReaderCache(limit int, chunkCache chunk_cache.ChunkCache, lookupFileIdFn wdclient.LookupFileIdFunctionType, cacheInvalidator CacheInvalidator) *ReaderCache {
+func NewReaderCache(limit int, chunkCache chunk_cache.ChunkCache, lookupFileIdFn wdclient.LookupFileIdFunctionType, cacheInvalidator CacheInvalidator, budgets ...*ReaderCacheBudget) *ReaderCache {
+	var budget *ReaderCacheBudget
+	if len(budgets) > 0 {
+		budget = budgets[0]
+	}
 	return &ReaderCache{
 		limit:            limit,
+		budget:           budget,
 		chunkCache:       chunkCache,
 		lookupFileIdFn:   lookupFileIdFn,
 		cacheInvalidator: cacheInvalidator,
@@ -68,6 +78,13 @@ func (rc *ReaderCache) MaybeCache(chunkViews *Interval[*ChunkView], count int) {
 		count = 1
 	}
 
+	var started []*SingleChunkCacher
+	defer func() {
+		for _, cacher := range started {
+			<-cacher.cacheStartedCh
+		}
+	}()
+
 	rc.Lock()
 	defer rc.Unlock()
 
@@ -75,8 +92,10 @@ func (rc *ReaderCache) MaybeCache(chunkViews *Interval[*ChunkView], count int) {
 		return
 	}
 
-	cached := 0
-	for x := chunkViews; x != nil && cached < count; x = x.Next {
+	// The window is the next count chunks, whether or not a download for them
+	// is already running: counting only newly started downloads would push the
+	// window count chunks further on every call.
+	for x, i := chunkViews, 0; x != nil && i < count; x, i = x.Next, i+1 {
 		chunkView := x.Value
 		if _, found := rc.downloaders[chunkView.FileId]; found {
 			continue
@@ -90,101 +109,305 @@ func (rc *ReaderCache) MaybeCache(chunkViews *Interval[*ChunkView], count int) {
 			// abort when slots are filled
 			return
 		}
+		if (chunkView.CanRangeFetch() || !rc.budget.canFit(int(chunkView.ChunkSize))) && !chunkView.IsFullChunk() {
+			// the view is clipped to part of the chunk and will be
+			// range-fetched, so prefetching it whole would download bytes
+			// nobody needs; a ciphered or compressed partial view needs
+			// the whole blob anyway and is worth prefetching, but not when
+			// it cannot fit the budget at all
+			continue
+		}
 
 		// glog.V(4).Infof("prefetch %s offset %d", chunkView.FileId, chunkView.ViewOffset)
 		// cache this chunk if not yet
 		shouldCache := (uint64(chunkView.ViewOffset) + chunkView.ChunkSize) <= rc.chunkCache.GetMaxFilePartSizeInCache()
 		cacher := newSingleChunkCacher(rc, chunkView.FileId, chunkView.CipherKey, chunkView.IsGzipped, int(chunkView.ChunkSize), shouldCache)
-		go cacher.startCaching()
-		<-cacher.cacheStartedCh
+		cacher.wg.Add(1) // the fetch, so destroy() waits even before the goroutine runs
 		rc.downloaders[chunkView.FileId] = cacher
-		cached++
+		go cacher.startCaching()
+		started = append(started, cacher)
 	}
 
 	return
 }
 
-func (rc *ReaderCache) ReadChunkAt(ctx context.Context, buffer []byte, fileId string, cipherKey []byte, isGzipped bool, offset int64, chunkSize int, shouldCache bool) (int, error) {
-	rc.Lock()
-
-	for {
-		if cacher, found := rc.downloaders[fileId]; found {
-			if cacher.hasCompletedError() {
-				delete(rc.downloaders, fileId)
-				rc.Unlock()
-				cacher.destroy()
-				rc.Lock()
-				continue
-			}
-			// Count this read on the cacher before releasing the map lock, so a
-			// concurrent destroy() (error eviction here, LRU, or UnCache) cannot
-			// start wg.Wait() on a zero counter while this read is about to register.
-			cacher.wg.Add(1)
-			rc.Unlock()
-			n, err := cacher.readChunkAt(ctx, buffer, offset)
-			if n > 0 || err != nil {
-				return n, err
-			}
-			// If n=0 and err=nil, the cacher couldn't provide data for this offset.
-			// Fall through to try chunkCache.
-			rc.Lock()
-		}
-		break
+// fetchChunkRange downloads only [offset, offset+len(buffer)) of a chunk,
+// for views clipped to part of their chunk and for random-mode reads. It
+// goes through fetchChunkDataFn so tests observe range fetches the same way
+// they observe whole-chunk downloads.
+func (rc *ReaderCache) fetchChunkRange(ctx context.Context, buffer []byte, chunkView *ChunkView, offset int64) (int, error) {
+	urlStrings, err := rc.lookupFileIdFn(ctx, chunkView.FileId)
+	if err != nil {
+		glog.ErrorfCtx(ctx, "operation LookupFileId %s failed, err: %v", chunkView.FileId, err)
+		return 0, err
 	}
+	return rc.fetchChunkDataFn(ctx, buffer, urlStrings, chunkView.CipherKey, chunkView.IsGzipped, false, offset, chunkView.FileId,
+		refreshUrls(ctx, rc.cacheInvalidator, rc.lookupFileIdFn, chunkView.FileId))
+}
+
+// chunkStream is one sequential reader's position in a shared ReaderCache.
+// The chunk it is reading stays pinned until the stream reads it to the end or
+// moves elsewhere, so another stream finishing or leaving the same chunk does
+// not drop the buffer from under it.
+type chunkStream struct {
+	mu     sync.Mutex // guards cacher; concurrent ReadAt calls on one ChunkReadAt share the stream
+	cacher *SingleChunkCacher
+}
+
+func (rc *ReaderCache) ReadChunkAt(ctx context.Context, buffer []byte, fileId string, cipherKey []byte, isGzipped bool, offset int64, chunkSize int, shouldCache bool) (int, error) {
+	return rc.readChunkAt(ctx, nil, buffer, fileId, cipherKey, isGzipped, offset, chunkSize, shouldCache)
+}
+
+func (rc *ReaderCache) readChunkAt(ctx context.Context, stream *chunkStream, buffer []byte, fileId string, cipherKey []byte, isGzipped bool, offset int64, chunkSize int, shouldCache bool) (int, error) {
+retry:
+	rc.RLock()
+	if cacher, found := rc.downloaders[fileId]; found {
+		if cacher.hasCompletedError() {
+			rc.RUnlock()
+			rc.remove(cacher)
+			goto retry
+		}
+		// Count this read on the cacher before releasing the map lock, so a
+		// concurrent destroy() (error eviction here, LRU, or UnCache) cannot
+		// start wg.Wait() on a zero counter while this read is about to register.
+		cacher.wg.Add(1)
+		atomic.AddInt32(&cacher.readers, 1)
+		previous := stream.pin(cacher)
+		rc.RUnlock()
+		n, err := rc.readFromCacher(ctx, stream, cacher, previous, buffer, offset, chunkSize)
+		if n > 0 || err != nil {
+			return n, err
+		}
+		// If n=0 and err=nil, the cacher couldn't provide data for this offset.
+		// Fall through to try chunkCache.
+	} else {
+		rc.RUnlock()
+	}
+
 	if shouldCache || rc.lookupFileIdFn == nil {
 		n, err := rc.chunkCache.ReadChunkAt(buffer, fileId, uint64(offset))
 		if n > 0 {
-			rc.Unlock()
+			// Served from the chunk cache: the stream has left its pinned chunk.
+			rc.unpin(stream.detach(nil))
 			return n, err
 		}
 	}
 
-	// clean up old downloaders
+	rc.Lock()
+	// A downloader may have registered between the read lock and this one.
+	if cacher, found := rc.downloaders[fileId]; found {
+		if cacher.hasCompletedError() {
+			delete(rc.downloaders, fileId)
+			rc.Unlock()
+			cacher.destroy()
+			goto retry
+		}
+		cacher.wg.Add(1)
+		atomic.AddInt32(&cacher.readers, 1)
+		previous := stream.pin(cacher)
+		rc.Unlock()
+		n, err := rc.readFromCacher(ctx, stream, cacher, previous, buffer, offset, chunkSize)
+		return n, err
+	}
+
+	// clean up old downloaders; prefer one no stream is positioned in, but
+	// fall back to a pinned one so abandoned pins cannot bypass the limit
 	if len(rc.downloaders) >= rc.limit {
 		oldestFid, oldestTime := "", time.Now().UnixNano()
+		pinnedFid, pinnedTime := "", int64(0)
 		for fid, downloader := range rc.downloaders {
 			completedTime := atomic.LoadInt64(&downloader.completedTimeNew)
-			if completedTime > 0 && completedTime < oldestTime {
-				oldestFid, oldestTime = fid, completedTime
+			if completedTime <= 0 {
+				continue
 			}
+			if atomic.LoadInt32(&downloader.pins) == 0 {
+				if completedTime < oldestTime {
+					oldestFid, oldestTime = fid, completedTime
+				}
+			} else if pinnedFid == "" || completedTime < pinnedTime {
+				pinnedFid, pinnedTime = fid, completedTime
+			}
+		}
+		if oldestFid == "" {
+			oldestFid = pinnedFid
 		}
 		if oldestFid != "" {
 			oldDownloader := rc.downloaders[oldestFid]
 			delete(rc.downloaders, oldestFid)
+			rc.Unlock()
 			oldDownloader.destroy()
+			goto retry
 		}
 	}
 
 	// glog.V(4).Infof("cache1 %s", fileId)
 
 	cacher := newSingleChunkCacher(rc, fileId, cipherKey, isGzipped, chunkSize, shouldCache)
+	cacher.wg.Add(2) // the fetch plus this read, so destroy() waits even before the goroutine runs
+	atomic.AddInt32(&cacher.readers, 1)
+	rc.downloaders[fileId] = cacher
+	previous := stream.pin(cacher)
+	rc.Unlock()
 	go cacher.startCaching()
 	<-cacher.cacheStartedCh
-	rc.downloaders[fileId] = cacher
-	cacher.wg.Add(1)
-	rc.Unlock()
+	n, err := rc.readFromCacher(ctx, stream, cacher, previous, buffer, offset, chunkSize)
+	return n, err
+}
 
-	return cacher.readChunkAt(ctx, buffer, offset)
+// readFromCacher serves the read and releases the pin if the stream finished
+// the chunk. The caller must have registered the read (wg + readers) and
+// pinned the stream under the map lock; previous is the chunk the stream left
+// when it pinned.
+func (rc *ReaderCache) readFromCacher(ctx context.Context, stream *chunkStream, cacher *SingleChunkCacher, previous *SingleChunkCacher, buffer []byte, offset int64, chunkSize int) (n int, err error) {
+	rc.unpin(previous)
+	n, err = cacher.readChunkAt(ctx, buffer, offset)
+	rc.releaseIfFinished(stream, cacher, offset, n, err, chunkSize)
+	return
+}
+
+// pin makes cacher the stream's current chunk and returns the chunk it was
+// pinned to before, which the caller unpins.
+func (stream *chunkStream) pin(cacher *SingleChunkCacher) (previous *SingleChunkCacher) {
+	if stream == nil {
+		return nil
+	}
+	stream.mu.Lock()
+	defer stream.mu.Unlock()
+	if stream.cacher == cacher {
+		return nil
+	}
+	atomic.AddInt32(&cacher.pins, 1)
+	previous = stream.cacher
+	stream.cacher = cacher
+	return previous
+}
+
+// detach unpins the stream from its chunk and returns that chunk for the
+// caller to unpin. A non-nil expected cacher makes the detach conditional on
+// the stream still being positioned in it.
+func (stream *chunkStream) detach(expected *SingleChunkCacher) (previous *SingleChunkCacher) {
+	if stream == nil {
+		return nil
+	}
+	stream.mu.Lock()
+	defer stream.mu.Unlock()
+	if expected != nil && stream.cacher != expected {
+		return nil
+	}
+	previous = stream.cacher
+	stream.cacher = nil
+	return previous
+}
+
+// releaseIfFinished unpins the stream's chunk once the stream has read it to
+// the end, since the stream will not come back to it.
+func (rc *ReaderCache) releaseIfFinished(stream *chunkStream, cacher *SingleChunkCacher, offset int64, n int, err error, chunkSize int) {
+	if stream == nil || err != nil || offset+int64(n) < int64(chunkSize) {
+		return
+	}
+	rc.unpin(stream.detach(cacher))
+}
+
+// releaseStream unpins whatever chunk the stream is positioned in.
+func (rc *ReaderCache) releaseStream(stream *chunkStream) {
+	rc.unpin(stream.detach(nil))
+}
+
+// unpin drops one stream's pin. Once no stream is positioned in the chunk it
+// is dropped like UnCache would, as soon as no read is in progress either:
+// here if none is, otherwise by the last read's removeConsumed.
+func (rc *ReaderCache) unpin(downloader *SingleChunkCacher) {
+	if downloader == nil {
+		return
+	}
+	if atomic.AddInt32(&downloader.pins, -1) == 0 {
+		atomic.StoreInt32(&downloader.left, 1)
+	}
+	rc.removeConsumed(downloader)
 }
 
 func (rc *ReaderCache) UnCache(fileId string) {
 	rc.Lock()
-	defer rc.Unlock()
-	// glog.V(4).Infof("uncache %s", fileId)
-	if downloader, found := rc.downloaders[fileId]; found {
+	downloader := rc.downloaders[fileId]
+	delete(rc.downloaders, fileId)
+	rc.Unlock()
+	if downloader != nil {
 		downloader.destroy()
-		delete(rc.downloaders, fileId)
 	}
 }
 
+func (rc *ReaderCache) remove(downloader *SingleChunkCacher) {
+	rc.Lock()
+	removed := rc.downloaders[downloader.chunkFileId] == downloader
+	if removed {
+		delete(rc.downloaders, downloader.chunkFileId)
+	}
+	rc.Unlock()
+	if removed {
+		downloader.destroy()
+	}
+}
+
+// removeUnpinned drops a cacher only while no stream is positioned in it.
+// Budget eviction picks its victim under the budget lock, so the pin check
+// and the map removal must happen together under the ReaderCache lock.
+func (rc *ReaderCache) removeUnpinned(downloader *SingleChunkCacher) (removed bool) {
+	rc.Lock()
+	removed = rc.downloaders[downloader.chunkFileId] == downloader &&
+		atomic.LoadInt32(&downloader.pins) == 0
+	if removed {
+		delete(rc.downloaders, downloader.chunkFileId)
+	}
+	rc.Unlock()
+	if removed {
+		downloader.destroy()
+	}
+	return
+}
+
+// consumable reports whether the cacher could be dropped: its buffer was
+// fully read or every stream positioned in it has left, and no reader is
+// attached or pinned. All fields are atomics, so callers can skip the
+// ReaderCache lock whenever removal is impossible.
+func (s *SingleChunkCacher) consumable() bool {
+	return atomic.LoadInt32(&s.readers) == 0 &&
+		atomic.LoadInt32(&s.pins) == 0 &&
+		(atomic.LoadInt32(&s.consumed) != 0 || atomic.LoadInt32(&s.left) != 0)
+}
+
+// removeConsumed drops a cacher once its buffer was fully read, or the
+// streams positioned in it have left, and no readers remain attached or
+// pinned. The checks run under the ReaderCache lock so a reader attaching
+// at the same time either wins (the cacher stays and that reader's detach
+// retries the removal) or misses the map and refetches.
+func (rc *ReaderCache) removeConsumed(downloader *SingleChunkCacher) {
+	if !downloader.consumable() {
+		return
+	}
+	rc.Lock()
+	removed := rc.removeConsumedLocked(downloader)
+	rc.Unlock()
+	if removed {
+		downloader.destroy()
+	}
+}
+
+func (rc *ReaderCache) removeConsumedLocked(downloader *SingleChunkCacher) (removed bool) {
+	if rc.downloaders[downloader.chunkFileId] == downloader && downloader.consumable() {
+		delete(rc.downloaders, downloader.chunkFileId)
+		return true
+	}
+	return false
+}
+
 func (rc *ReaderCache) destroy() {
 	rc.Lock()
-	defer rc.Unlock()
-
-	for _, downloader := range rc.downloaders {
+	downloaders := rc.downloaders
+	rc.downloaders = make(map[string]*SingleChunkCacher)
+	rc.Unlock()
+	for _, downloader := range downloaders {
 		downloader.destroy()
 	}
-
 }
 
 func newSingleChunkCacher(parent *ReaderCache, fileId string, cipherKey []byte, isGzipped bool, chunkSize int, shouldCache bool) *SingleChunkCacher {
@@ -200,27 +423,32 @@ func newSingleChunkCacher(parent *ReaderCache, fileId string, cipherKey []byte,
 	}
 }
 
-// startCaching downloads the chunk data in the background.
-// It does NOT hold the lock during the HTTP download to allow concurrent readers
-// to wait efficiently using the done channel.
-//
-// Concurrent downloads of the same chunk are already deduplicated by the
-// ReaderCache.downloaders map (guarded by the ReaderCache mutex). Each fileId
-// has at most one active SingleChunkCacher at any time.
+// startCaching downloads a chunk shared by concurrent readers.
+// The caller must s.wg.Add(1) before publishing the cacher in the
+// downloaders map, so a removal can never observe the fetch as absent.
 func (s *SingleChunkCacher) startCaching() {
-	s.wg.Add(1)
-	defer s.wg.Done()
-	defer close(s.done) // guarantee completion signal even on panic
+	defer func() {
+		close(s.done)
+		s.wg.Done()
+		if s.hasCompletedError() {
+			s.parent.remove(s)
+		} else {
+			s.parent.budget.complete(s)
+		}
+	}()
 
-	s.cacheStartedCh <- struct{}{} // signal that we've started
+	s.cacheStartedCh <- struct{}{}
+	if err := s.parent.budget.reserve(s); err != nil {
+		s.setError(err)
+		return
+	}
 
-	// Note: We intentionally use context.Background() here, NOT a request-specific context.
-	// The downloaded chunk is a shared resource - multiple concurrent readers may be waiting
-	// for this same download to complete. If we used a request context and that request was
-	// cancelled, it would abort the download and cause errors for all other waiting readers.
-	// The download should always complete once started to serve all potential consumers.
-
-	// Lookup file ID without holding the lock
+	// Intentionally use context.Background(), not a request-specific context.
+	// The downloaded chunk is a shared resource: multiple concurrent readers may
+	// wait on this same download via s.done. A request-scoped context that got
+	// cancelled would abort the download and error every other waiting reader.
+	// The download always runs to completion once started; readers that cancel
+	// individually drop out via readChunkAt's select on ctx.Done().
 	urlStrings, err := s.parent.lookupFileIdFn(context.Background(), s.chunkFileId)
 	if err != nil {
 		s.setError(fmt.Errorf("operation LookupFileId %s failed, err: %v", s.chunkFileId, err))
@@ -270,7 +498,7 @@ func (s *SingleChunkCacher) fetchChunkData(ctx context.Context, urlStrings []str
 	// Allocate buffer and download without holding the lock.
 	// This allows multiple downloads to proceed in parallel.
 	data := mem.Allocate(s.chunkSize)
-	_, fetchErr := s.parent.fetchChunkDataFn(ctx, data, urlStrings, s.cipherKey, s.isGzipped, true, 0, s.chunkFileId)
+	_, fetchErr := s.parent.fetchChunkDataFn(ctx, data, urlStrings, s.cipherKey, s.isGzipped, true, 0, s.chunkFileId, refreshUrls(ctx, s.parent.cacheInvalidator, s.parent.lookupFileIdFn, s.chunkFileId))
 	if fetchErr != nil {
 		mem.Free(data)
 		return nil, fetchErr
@@ -295,12 +523,12 @@ func (s *SingleChunkCacher) destroy() {
 	// wait for all reads to finish before destroying the data
 	s.wg.Wait()
 	s.Lock()
-	defer s.Unlock()
-
 	if s.data != nil {
 		mem.Free(s.data)
 		s.data = nil
 	}
+	s.Unlock()
+	s.parent.budget.release(s)
 }
 
 // readChunkAt reads data from the cached chunk.
@@ -308,8 +536,12 @@ func (s *SingleChunkCacher) destroy() {
 // The ctx parameter allows the reader to cancel its wait (but the download continues
 // for other readers - see comment in startCaching about shared resource semantics).
 // The caller must s.wg.Add(1) under the ReaderCache lock before calling; this only releases it.
-func (s *SingleChunkCacher) readChunkAt(ctx context.Context, buf []byte, offset int64) (int, error) {
-	defer s.wg.Done()
+func (s *SingleChunkCacher) readChunkAt(ctx context.Context, buf []byte, offset int64) (n int, err error) {
+	defer func() {
+		s.wg.Done()
+		atomic.AddInt32(&s.readers, -1)
+		s.parent.removeConsumed(s)
+	}()
 
 	// Wait for download to complete, but allow reader cancellation.
 	// Prioritize checking done first - if data is already available,
@@ -339,5 +571,9 @@ func (s *SingleChunkCacher) readChunkAt(ctx context.Context, buf []byte, offset
 		return 0, nil
 	}
 
-	return copy(buf, s.data[offset:]), nil
+	n = copy(buf, s.data[offset:])
+	if offset+int64(n) == int64(len(s.data)) {
+		atomic.StoreInt32(&s.consumed, 1)
+	}
+	return n, nil
 }
diff --git a/weed/filer/reader_cache_budget.go b/weed/filer/reader_cache_budget.go
new file mode 100644
index 0000000000..b048e26d99
--- /dev/null
+++ b/weed/filer/reader_cache_budget.go
@@ -0,0 +1,132 @@
+package filer
+
+import (
+	"container/list"
+	"fmt"
+	"sync"
+	"sync/atomic"
+
+	"github.com/seaweedfs/seaweedfs/weed/util/mem"
+)
+
+const DefaultReaderCacheMemoryLimit = 256 << 20
+
+type ReaderCacheBudget struct {
+	sync.Mutex
+	limit        int64
+	used         int64
+	reservations map[*SingleChunkCacher]int64
+	idle         list.List
+	idleEntries  map[*SingleChunkCacher]*list.Element
+	changed      chan struct{}
+}
+
+func NewReaderCacheBudget(limit int64) *ReaderCacheBudget {
+	if limit <= 0 {
+		limit = DefaultReaderCacheMemoryLimit
+	}
+	return &ReaderCacheBudget{
+		limit:        limit,
+		reservations: make(map[*SingleChunkCacher]int64),
+		idleEntries:  make(map[*SingleChunkCacher]*list.Element),
+		changed:      make(chan struct{}),
+	}
+}
+
+func (b *ReaderCacheBudget) reserve(s *SingleChunkCacher) error {
+	if s.chunkSize < 0 {
+		return fmt.Errorf("invalid chunk size %d", s.chunkSize)
+	}
+	if b == nil {
+		return nil
+	}
+	size := int64(mem.AllocationSize(s.chunkSize))
+	if size > b.limit {
+		return fmt.Errorf("chunk buffer needs %d bytes, exceeding reader cache budget %d; increase the readerCacheSizeMB budget", size, b.limit)
+	}
+	for {
+		b.Lock()
+		if size <= b.limit-b.used {
+			b.used += size
+			b.reservations[s] = size
+			b.Unlock()
+			return nil
+		}
+		// Prefer evicting an idle chunk no stream is positioned in; fall back
+		// to the oldest pinned one so abandoned pins cannot block the budget.
+		var victim *SingleChunkCacher
+		var entry *list.Element
+		pinnedVictim := false
+		for e := b.idle.Front(); e != nil; e = e.Next() {
+			c := e.Value.(*SingleChunkCacher)
+			if atomic.LoadInt32(&c.pins) == 0 {
+				victim, entry = c, e
+				pinnedVictim = false
+				break
+			}
+			if victim == nil {
+				victim, entry = c, e
+				pinnedVictim = true
+			}
+		}
+		if entry != nil {
+			b.idle.Remove(entry)
+			delete(b.idleEntries, victim)
+			b.Unlock()
+			if pinnedVictim {
+				victim.parent.remove(victim)
+			} else if !victim.parent.removeUnpinned(victim) {
+				// The victim was pinned between selection and removal: keep it
+				// evictable so a pin abandoned in that gap cannot wedge the
+				// budget, then retry the selection.
+				b.Lock()
+				if _, ok := b.reservations[victim]; ok && b.idleEntries[victim] == nil {
+					b.idleEntries[victim] = b.idle.PushBack(victim)
+				}
+				b.Unlock()
+			}
+			continue
+		}
+		changed := b.changed
+		b.Unlock()
+		<-changed
+	}
+}
+
+// canFit reports whether a whole-chunk buffer of this size can ever be
+// reserved. A chunk bigger than the budget cannot be read through the
+// whole-chunk path at all, so callers must fall back to range fetches.
+func (b *ReaderCacheBudget) canFit(size int) bool {
+	return b == nil || int64(mem.AllocationSize(size)) <= b.limit
+}
+
+func (b *ReaderCacheBudget) complete(s *SingleChunkCacher) {
+	if b == nil {
+		return
+	}
+	b.Lock()
+	defer b.Unlock()
+	if _, found := b.reservations[s]; found && b.idleEntries[s] == nil {
+		b.idleEntries[s] = b.idle.PushBack(s)
+		close(b.changed)
+		b.changed = make(chan struct{})
+	}
+}
+
+func (b *ReaderCacheBudget) release(s *SingleChunkCacher) {
+	if b == nil {
+		return
+	}
+	b.Lock()
+	defer b.Unlock()
+	if size, found := b.reservations[s]; found {
+		b.used -= size
+		delete(b.reservations, s)
+		if entry := b.idleEntries[s]; entry != nil {
+			b.idle.Remove(entry)
+			delete(b.idleEntries, s)
+		}
+		close(b.changed)
+		b.changed = make(chan struct{})
+	}
+}
diff --git a/weed/filer/reader_cache_memory_test.go b/weed/filer/reader_cache_memory_test.go
new file mode 100644
index 0000000000..da73c7a2ea
--- /dev/null
+++ b/weed/filer/reader_cache_memory_test.go
@@ -0,0 +1,430 @@
+package filer
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
+)
+
+func TestChunkGroupReaderCacheMemory(t *testing.T) {
+	budget := NewReaderCacheBudget(8 << 10)
+	groups := make([]*ChunkGroup, 32)
+	for i := range groups {
+		group, err := NewChunkGroup(func(context.Context, string) ([]string, error) { return []string{"unused"}, nil }, newMockChunkCacheForReaderCache(), nil, 128, nil, nil, budget)
+		if err != nil {
+			t.Fatal(err)
+		}
+		groups[i] = group
+		defer group.Close()
+		group.readerCache.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+			buffer[0] = 42
+			return len(buffer), nil
+		}
+		buffer := make([]byte, 1)
+		n, err := group.readerCache.ReadChunkAt(context.Background(), buffer, fmt.Sprint(i), nil, false, 0, 3<<10, false)
+		if err != nil || n != 1 || buffer[0] != 42 {
+			t.Fatalf("read %d: n=%d data=%v err=%v", i, n, buffer, err)
+		}
+		budget.Lock()
+		used := budget.used
+		budget.Unlock()
+		if used > 8<<10 {
+			t.Fatalf("shared budget used %d bytes", used)
+		}
+	}
+	groups[0].readerCache.Lock()
+	retained := len(groups[0].readerCache.downloaders)
+	groups[0].readerCache.Unlock()
+	if retained != 0 {
+		t.Fatalf("first file still retains %d downloaders", retained)
+	}
+	for _, group := range groups {
+		_ = group.Close()
+	}
+	budget.Lock()
+	defer budget.Unlock()
+	if budget.used != 0 {
+		t.Fatalf("closed files still reserve %d bytes", budget.used)
+	}
+}
+
+func TestReaderCacheBudgetInFlight(t *testing.T) {
+	for _, prefetch := range []bool{false, true} {
+		t.Run(fmt.Sprintf("prefetch=%t", prefetch), func(t *testing.T) {
+			budget := NewReaderCacheBudget(8 << 10)
+			started := make(chan struct{}, 4)
+			gate := make(chan struct{})
+			var readers sync.WaitGroup
+			var caches []*ReaderCache
+			for i := 0; i < 4; i++ {
+				rc := NewReaderCache(256, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) { return []string{"unused"}, nil }, nil, budget)
+				caches = append(caches, rc)
+				defer rc.destroy()
+				rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+					started <- struct{}{}
+					<-gate
+					buffer[0] = 42
+					return len(buffer), nil
+				}
+				if prefetch {
+					rc.MaybeCache(&Interval[*ChunkView]{Value: &ChunkView{FileId: "chunk", ViewSize: 3 << 10, ChunkSize: 3 << 10}}, 1)
+				} else {
+					readers.Add(1)
+					go func() {
+						defer readers.Done()
+						buffer := make([]byte, 1)
+						n, err := rc.ReadChunkAt(context.Background(), buffer, "chunk", nil, false, 0, 3<<10, false)
+						if err != nil || n != 1 || buffer[0] != 42 {
+							t.Errorf("read: n=%d data=%v err=%v", n, buffer, err)
+						}
+					}()
+				}
+			}
+			for i := 0; i < 2; i++ {
+				<-started
+			}
+			select {
+			case <-started:
+				t.Error("third download allocated before budget was released")
+			case <-time.After(50 * time.Millisecond):
+			}
+			budget.Lock()
+			used := budget.used
+			budget.Unlock()
+			if used != 8<<10 {
+				t.Errorf("in-flight reservations = %d, want 8192", used)
+			}
+			close(gate)
+			readers.Wait()
+			for i := 0; i < 2; i++ {
+				select {
+				case <-started:
+				case <-time.After(5 * time.Second):
+					t.Fatal("download did not resume after eviction")
+				}
+			}
+			for _, rc := range caches {
+				rc.destroy()
+			}
+			budget.Lock()
+			defer budget.Unlock()
+			if budget.used != 0 {
+				t.Errorf("reservations leaked: %d", budget.used)
+			}
+		})
+	}
+}
+
+func TestReaderCacheBudgetOversizedChunk(t *testing.T) {
+	rc := NewReaderCache(256, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		t.Error("oversized chunk performed lookup")
+		return nil, nil
+	}, nil, NewReaderCacheBudget(3<<10))
+	defer rc.destroy()
+	_, err := rc.ReadChunkAt(context.Background(), make([]byte, 1), "chunk", nil, false, 0, 3<<10, false)
+	if err == nil {
+		t.Fatal("expected pooled buffer larger than budget to be rejected")
+	}
+}
+
+func TestReaderCacheEvictionDoesNotHoldCacheLock(t *testing.T) {
+	rc := NewReaderCache(2, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) { return []string{"unused"}, nil }, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		return len(buffer), nil
+	}
+	if _, err := rc.ReadChunkAt(context.Background(), make([]byte, 1), "chunk", nil, false, 0, 1024, false); err != nil {
+		t.Fatal(err)
+	}
+	rc.Lock()
+	downloader := rc.downloaders["chunk"]
+	downloader.wg.Add(1)
+	rc.Unlock()
+	evicted := make(chan struct{})
+	go func() { rc.UnCache("chunk"); close(evicted) }()
+	deadline := time.Now().Add(5 * time.Second)
+	available := false
+	for time.Now().Before(deadline) {
+		if rc.TryLock() {
+			available = rc.downloaders["chunk"] == nil
+			rc.Unlock()
+			if available {
+				break
+			}
+		}
+		time.Sleep(time.Millisecond)
+	}
+	downloader.wg.Done()
+	<-evicted
+	if !available {
+		t.Fatal("cache lock held while eviction waited for a reader")
+	}
+}
+
+func TestReaderCacheFailedPrefetchReleasesBudget(t *testing.T) {
+	for _, lookupFailure := range []bool{false, true} {
+		t.Run(fmt.Sprintf("lookupFailure=%t", lookupFailure), func(t *testing.T) {
+			budget := NewReaderCacheBudget(1024)
+			rc := NewReaderCache(1, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+				if lookupFailure {
+					return nil, fmt.Errorf("lookup failed")
+				}
+				return []string{"unused"}, nil
+			}, nil, budget)
+			defer rc.destroy()
+			rc.fetchChunkDataFn = func(_ context.Context, _ []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+				return 0, fmt.Errorf("fetch failed")
+			}
+			rc.MaybeCache(&Interval[*ChunkView]{Value: &ChunkView{FileId: "failed", ViewSize: 1024, ChunkSize: 1024}}, 1)
+			deadline := time.Now().Add(5 * time.Second)
+			for {
+				rc.Lock()
+				count := len(rc.downloaders)
+				rc.Unlock()
+				budget.Lock()
+				used := budget.used
+				budget.Unlock()
+				if count == 0 && used == 0 {
+					break
+				}
+				if time.Now().After(deadline) {
+					t.Fatalf("failed prefetch retains %d slots and %d bytes", count, used)
+				}
+				time.Sleep(time.Millisecond)
+			}
+		})
+	}
+}
+
+func TestReaderCacheUnboundedWithoutBudget(t *testing.T) {
+	if strconv.IntSize == 32 {
+		// Proving the cache has no implicit memory budget needs more than 64
+		// in-flight 4 MiB buffers (>256 MiB) at once; the weed/filer test binary
+		// already runs near the 4 GiB address-space limit on 32-bit.
+		t.Skip("requires >256MiB of in-flight buffers; skipped on 32-bit")
+	}
+	const readers = 96 // more than 256MiB / 4MiB = 64 buffers
+	started := make(chan struct{}, readers)
+	gate := make(chan struct{})
+	rc := NewReaderCache(256, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		started <- struct{}{}
+		<-gate
+		buffer[0] = 42
+		return len(buffer), nil
+	}
+	var readersWg sync.WaitGroup
+	for i := 0; i < readers; i++ {
+		readersWg.Add(1)
+		go func(i int) {
+			defer readersWg.Done()
+			rc.ReadChunkAt(context.Background(), make([]byte, 1), fmt.Sprint(i), nil, false, 0, 4<<20, false)
+		}(i)
+	}
+	for i := 0; i < readers; i++ {
+		select {
+		case <-started:
+		case <-time.After(5 * time.Second):
+			close(gate)
+			readersWg.Wait()
+			t.Fatalf("only %d of %d downloads started; an implicit memory budget throttled the reader cache", i, readers)
+		}
+	}
+	close(gate)
+	readersWg.Wait()
+}
+
+func TestReaderCacheDropsConsumedChunks(t *testing.T) {
+	var fetchCount int32
+	rc := NewReaderCache(10, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		atomic.AddInt32(&fetchCount, 1)
+		return len(buffer), nil
+	}
+	buf := make([]byte, 4<<10)
+	if _, err := rc.ReadChunkAt(context.Background(), buf, "chunk", nil, false, 0, 4<<10, false); err != nil {
+		t.Fatal(err)
+	}
+	rc.Lock()
+	_, retained := rc.downloaders["chunk"]
+	rc.Unlock()
+	if retained {
+		t.Fatal("fully consumed chunk buffer still retained")
+	}
+	if _, err := rc.ReadChunkAt(context.Background(), buf, "chunk", nil, false, 0, 4<<10, false); err != nil {
+		t.Fatal(err)
+	}
+	if got := atomic.LoadInt32(&fetchCount); got != 2 {
+		t.Fatalf("consumed chunk was not refetched, fetchCount=%d", got)
+	}
+}
+
+// A prefetched chunk must survive until its reader arrives, then be dropped
+// once consumed: the read hits the prefetched buffer (no second fetch) and a
+// later read fetches again.
+func TestReaderCachePrefetchBufferDroppedAfterRead(t *testing.T) {
+	var fetchCount int32
+	rc := NewReaderCache(10, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		atomic.AddInt32(&fetchCount, 1)
+		buffer[0] = 42
+		return len(buffer), nil
+	}
+	rc.MaybeCache(&Interval[*ChunkView]{Value: &ChunkView{FileId: "chunk", ViewSize: 4 << 10, ChunkSize: 4 << 10}}, 1)
+
+	buf := make([]byte, 4<<10)
+	n, err := rc.ReadChunkAt(context.Background(), buf, "chunk", nil, false, 0, 4<<10, false)
+	if err != nil || n != len(buf) || buf[0] != 42 {
+		t.Fatalf("read of prefetched chunk: n=%d data=%d err=%v", n, buf[0], err)
+	}
+	if got := atomic.LoadInt32(&fetchCount); got != 1 {
+		t.Fatalf("read did not hit the prefetched buffer, fetchCount=%d", got)
+	}
+	rc.Lock()
+	_, retained := rc.downloaders["chunk"]
+	rc.Unlock()
+	if retained {
+		t.Fatal("consumed prefetch buffer still retained")
+	}
+	if _, err := rc.ReadChunkAt(context.Background(), buf, "chunk", nil, false, 0, 4<<10, false); err != nil {
+		t.Fatal(err)
+	}
+	if got := atomic.LoadInt32(&fetchCount); got != 2 {
+		t.Fatalf("consumed chunk was not refetched, fetchCount=%d", got)
+	}
+}
+
+// A consumed chunk survives while another reader is still attached; it is
+// dropped once no readers remain, regardless of which reader reached the end.
+func TestReaderCacheConsumedBufferSurvivesAttachedReader(t *testing.T) {
+	var fetchCount int32
+	rc := NewReaderCache(10, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		atomic.AddInt32(&fetchCount, 1)
+		buffer[0] = 42
+		return len(buffer), nil
+	}
+
+	// A partial read primes the cacher, then a second reader attaches.
+	rc.ReadChunkAt(context.Background(), make([]byte, 1), "chunk", nil, false, 0, 4<<10, false)
+	rc.Lock()
+	downloader := rc.downloaders["chunk"]
+	if downloader == nil {
+		rc.Unlock()
+		t.Fatal("cacher missing before attach")
+	}
+	downloader.wg.Add(1)
+	atomic.AddInt32(&downloader.readers, 1)
+	rc.Unlock()
+
+	buf := make([]byte, 4<<10)
+	if n, err := rc.ReadChunkAt(context.Background(), buf, "chunk", nil, false, 0, 4<<10, false); err != nil || n != len(buf) {
+		t.Fatalf("full read: n=%d err=%v", n, err)
+	}
+	rc.Lock()
+	_, retained := rc.downloaders["chunk"]
+	rc.Unlock()
+	if !retained {
+		t.Fatal("consumed chunk dropped while a reader was still attached")
+	}
+
+	// The attached reader detaches without reading: since the buffer was
+	// already consumed, the last detach drops it.
+	downloader.wg.Done()
+	atomic.AddInt32(&downloader.readers, -1)
+	rc.removeConsumed(downloader)
+	rc.Lock()
+	_, retained = rc.downloaders["chunk"]
+	rc.Unlock()
+	if retained {
+		t.Fatal("consumed chunk retained after last reader detached")
+	}
+	if got := atomic.LoadInt32(&fetchCount); got != 1 {
+		t.Fatalf("attached readers fetched more than once, fetchCount=%d", got)
+	}
+}
+
+func TestReaderCacheConsumedChunkReleasesBudget(t *testing.T) {
+	budget := NewReaderCacheBudget(4 << 10)
+	rc := NewReaderCache(10, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil, budget)
+	defer rc.destroy()
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		return len(buffer), nil
+	}
+	if _, err := rc.ReadChunkAt(context.Background(), make([]byte, 4<<10), "chunk", nil, false, 0, 4<<10, false); err != nil {
+		t.Fatal(err)
+	}
+	budget.Lock()
+	used := budget.used
+	budget.Unlock()
+	if used != 0 {
+		t.Fatalf("consumed chunk still reserves %d bytes", used)
+	}
+}
+
+// TestReaderCacheReReadAfterEviction verifies that a chunk evicted by budget
+// pressure is transparently re-downloaded on the next read and returns the
+// correct data. This is the core correctness property of eviction: a reader
+// must never observe missing or stale data after a chunk has been evicted.
+func TestReaderCacheReReadAfterEviction(t *testing.T) {
+	budget := NewReaderCacheBudget(4 << 10) // fits exactly one 4 KiB pooled chunk
+	rc := NewReaderCache(256, newMockChunkCacheForReaderCache(), func(context.Context, string) ([]string, error) {
+		return []string{"unused"}, nil
+	}, nil, budget)
+	defer rc.destroy()
+
+	var fetchCount int32
+	rc.fetchChunkDataFn = func(_ context.Context, buffer []byte, _ []string, _ []byte, _ bool, _ bool, _ int64, _ string, _ util_http.RefreshUrlsFunc) (int, error) {
+		n := atomic.AddInt32(&fetchCount, 1)
+		buffer[0] = byte(n) // each download writes a distinct value
+		return len(buffer), nil
+	}
+
+	// Read chunk "a": triggers download #1, fills the budget.
+	buf := make([]byte, 1)
+	if n, err := rc.ReadChunkAt(context.Background(), buf, "a", nil, false, 0, 4<<10, false); err != nil || n != 1 || buf[0] != 1 {
+		t.Fatalf("first read of 'a': n=%d data=%d err=%v", n, buf[0], err)
+	}
+
+	// Read chunk "b": budget only fits one chunk, so "a" is evicted to make room.
+	if n, err := rc.ReadChunkAt(context.Background(), buf, "b", nil, false, 0, 4<<10, false); err != nil || n != 1 || buf[0] != 2 {
+		t.Fatalf("read of 'b': n=%d data=%d err=%v", n, buf[0], err)
+	}
+
+	// "a" should no longer be in the cache.
+	rc.Lock()
+	_, stillCached := rc.downloaders["a"]
+	rc.Unlock()
+	if stillCached {
+		t.Fatal("chunk 'a' was not evicted by budget pressure")
+	}
+
+	// Re-read "a": must trigger download #3 and return the fresh value.
+	if n, err := rc.ReadChunkAt(context.Background(), buf, "a", nil, false, 0, 4<<10, false); err != nil || n != 1 || buf[0] != 3 {
+		t.Fatalf("re-read of 'a': n=%d data=%d err=%v (expected re-download with value 3)", n, buf[0], err)
+	}
+
+	if got := atomic.LoadInt32(&fetchCount); got != 3 {
+		t.Fatalf("fetchCount=%d, want 3 (a, b, a-re-read)", got)
+	}
+}
diff --git a/weed/filer/reader_cache_test.go b/weed/filer/reader_cache_test.go
index a6771246cd..16c3531f50 100644
--- a/weed/filer/reader_cache_test.go
+++ b/weed/filer/reader_cache_test.go
@@ -3,10 +3,14 @@ package filer
 import (
 	"context"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
+
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
 // mockChunkCacheForReaderCache implements chunk cache for testing
@@ -100,7 +104,7 @@ func TestReaderCacheRetryAfterCacheInvalidation(t *testing.T) {
 	}
 
 	var fetchCount int32
-	fetchFn := func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, requestedFileId string) (int, error) {
+	fetchFn := func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, requestedFileId string, _ util_http.RefreshUrlsFunc) (int, error) {
 		if requestedFileId != fileId {
 			return 0, fmt.Errorf("unexpected fetch file id %s", requestedFileId)
 		}
@@ -146,6 +150,47 @@ func TestReaderCacheRetryAfterCacheInvalidation(t *testing.T) {
 	}
 }
 
+// TestReaderCacheRefreshesLocationsAfterPartialFailure is the mount reading
+// through a cached location list that still names a replica the master has
+// dropped: the read succeeds on the other replica, and the cached entry must
+// be dropped and looked up again so the next read starts without the dead one.
+func TestReaderCacheRefreshesLocationsAfterPartialFailure(t *testing.T) {
+	payload := []byte("chunk contents")
+	live := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write(payload)
+	}))
+	defer live.Close()
+	dead := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	deadURL := dead.URL
+	dead.Close()
+
+	fileId := "3,abc"
+	invalidator := &mockCacheInvalidatorForReaderCache{}
+	var lookupCount int32
+	lookupFn := func(ctx context.Context, requestedFileId string) ([]string, error) {
+		atomic.AddInt32(&lookupCount, 1)
+		if atomic.LoadInt32(&invalidator.calls) == 0 {
+			return []string{deadURL + "/" + fileId, live.URL + "/" + fileId}, nil
+		}
+		return []string{live.URL + "/" + fileId}, nil
+	}
+
+	rc := NewReaderCache(10, newMockChunkCacheForReaderCache(), lookupFn, invalidator)
+	defer rc.destroy()
+
+	buffer := make([]byte, len(payload))
+	n, err := rc.ReadChunkAt(context.Background(), buffer, fileId, nil, false, 0, len(payload), false)
+	if err != nil || string(buffer[:n]) != string(payload) {
+		t.Fatalf("got %q, %v; want %q", buffer[:n], err, payload)
+	}
+	if got := atomic.LoadInt32(&invalidator.calls); got != 1 {
+		t.Fatalf("expected the stale entry to be invalidated once, got %d", got)
+	}
+	if got := atomic.LoadInt32(&lookupCount); got != 2 {
+		t.Fatalf("expected a lookup before the read and one after invalidation, got %d", got)
+	}
+}
+
 func TestReaderCacheRemovesFailedDownloader(t *testing.T) {
 	cache := newMockChunkCacheForReaderCache()
 	fileId := "425141,failed"
@@ -161,7 +206,7 @@ func TestReaderCacheRemovesFailedDownloader(t *testing.T) {
 	}
 
 	var fetchCount int32
-	fetchFn := func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, requestedFileId string) (int, error) {
+	fetchFn := func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, requestedFileId string, _ util_http.RefreshUrlsFunc) (int, error) {
 		atomic.AddInt32(&fetchCount, 1)
 		return 0, fmt.Errorf("fetch failed")
 	}
@@ -575,7 +620,7 @@ func TestReaderCacheDownloaderDedup(t *testing.T) {
 		return []string{"http://volume/" + fileId}, nil
 	}
 
-	fetchFn := func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, fileId string) (int, error) {
+	fetchFn := func(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, fileId string, _ util_http.RefreshUrlsFunc) (int, error) {
 		atomic.AddInt32(&fetchCount, 1)
 		<-fetchGate
 		return copy(buffer, testData), nil
@@ -592,7 +637,7 @@ func TestReaderCacheDownloaderDedup(t *testing.T) {
 	for i := 0; i < numReaders; i++ {
 		go func() {
 			defer wg.Done()
-			buffer := make([]byte, 100)
+			buffer := make([]byte, 50)
 			rc.ReadChunkAt(context.Background(), buffer, "dedup-file", nil, false, 0, 100, false)
 		}()
 	}
@@ -679,3 +724,34 @@ func TestSingleChunkCacherOneReaderCancelsOthersContinue(t *testing.T) {
 		t.Error("Other reader did not complete")
 	}
 }
+
+// TestReaderCacheBookkeepingOffCacheLock guards the contention fix: pin
+// lifecycle calls that cannot remove a cacher must not block on the
+// ReaderCache lock.
+func TestReaderCacheBookkeepingOffCacheLock(t *testing.T) {
+	cache := newMockChunkCacheForReaderCache()
+	rc := NewReaderCache(10, cache, nil, nil)
+	defer rc.destroy()
+
+	cacher := &SingleChunkCacher{parent: rc, chunkFileId: "pinned-chunk"}
+	atomic.StoreInt32(&cacher.readers, 1) // a read in flight: not consumable
+
+	rc.Lock()
+	started := make(chan struct{})
+	done := make(chan struct{})
+	go func() {
+		close(started)
+		defer close(done)
+		var stream chunkStream
+		stream.pin(cacher)
+		rc.releaseStream(&stream)
+	}()
+	<-started
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		rc.Unlock()
+		t.Fatal("stream pin lifecycle blocked on the cache lock")
+	}
+	rc.Unlock()
+}
diff --git a/weed/filer/reader_pattern.go b/weed/filer/reader_pattern.go
index 6a9a95f837..65184722fc 100644
--- a/weed/filer/reader_pattern.go
+++ b/weed/filer/reader_pattern.go
@@ -54,10 +54,13 @@ func (rp *ReaderPattern) MonitorReadAt(offset int64, size int) {
 		if counter < ModeChangeLimit {
 			atomic.AddInt64(&rp.isSequentialCounter, 1)
 		}
+	} else if counter <= 0 {
+		// Entering random mode is a strong verdict: drop to the bottom of
+		// the window so the contiguous tail of one ranged request cannot
+		// flip it back on the next buffer read and pay a whole-chunk fetch.
+		atomic.StoreInt64(&rp.isSequentialCounter, -ModeChangeLimit)
 	} else {
-		if counter > -ModeChangeLimit {
-			atomic.AddInt64(&rp.isSequentialCounter, -1)
-		}
+		atomic.AddInt64(&rp.isSequentialCounter, -1)
 	}
 }
 
diff --git a/weed/filer/reader_pattern_test.go b/weed/filer/reader_pattern_test.go
index 54b896ab4e..147d70cfdb 100644
--- a/weed/filer/reader_pattern_test.go
+++ b/weed/filer/reader_pattern_test.go
@@ -102,3 +102,23 @@ func TestReaderPatternRecoversFromRandom(t *testing.T) {
 		t.Fatal("sustained near reads must recover sequential mode")
 	}
 }
+
+// A ranged request's first read lands far from the frontier, but its
+// remaining buffer reads are contiguous. The random verdict must stick for
+// them — otherwise the tail of every range >256KiB pays a whole-chunk fetch.
+func TestReaderPatternRangedReadStaysRandom(t *testing.T) {
+	rp := NewReaderPattern()
+	rp.MonitorReadAt(500*mb, 256*1024) // far first read -> -ModeChangeLimit
+	for i := 1; i <= 2; i++ {
+		rp.MonitorReadAt(500*mb+int64(i)*256*1024, 256*1024)
+		if !rp.IsRandomMode() {
+			t.Fatalf("contiguous read %d of a ranged request flipped back to sequential", i+1)
+		}
+	}
+	for i := 3; i < 10; i++ {
+		rp.MonitorReadAt(500*mb+int64(i)*256*1024, 256*1024)
+	}
+	if rp.IsRandomMode() {
+		t.Fatal("sustained sequential reads should restore sequential mode")
+	}
+}
diff --git a/weed/filer/redis/universal_redis_store.go b/weed/filer/redis/universal_redis_store.go
index 4e599fe6f1..bec4294af7 100644
--- a/weed/filer/redis/universal_redis_store.go
+++ b/weed/filer/redis/universal_redis_store.go
@@ -116,7 +116,8 @@ func (store *UniversalRedisStore) DeleteEntry(ctx context.Context, fullpath util
 
 func (store *UniversalRedisStore) DeleteFolderChildren(ctx context.Context, fullpath util.FullPath) (err error) {
 
-	members, err := store.Client.SMembers(ctx, genDirectoryListKey(string(fullpath))).Result()
+	dirListKey := genDirectoryListKey(string(fullpath))
+	members, err := store.Client.SMembers(ctx, dirListKey).Result()
 	if err != nil {
 		return fmt.Errorf("delete folder %s : %v", fullpath, err)
 	}
@@ -131,6 +132,10 @@ func (store *UniversalRedisStore) DeleteFolderChildren(ctx context.Context, full
 		store.Client.Del(ctx, genDirectoryListKey(string(path)))
 	}
 
+	if _, err = store.Client.Del(ctx, dirListKey).Result(); err != nil {
+		return fmt.Errorf("delete folder %s list: %v", fullpath, err)
+	}
+
 	return nil
 }
 
@@ -182,6 +187,7 @@ func (store *UniversalRedisStore) ListDirectoryEntries(ctx context.Context, dirP
 		if err != nil {
 			glog.V(0).InfofCtx(ctx, "list %s : %v", path, err)
 			if err == filer_pb.ErrNotFound {
+				store.removeOrphanedDirectoryListMember(ctx, dirPath, fileName)
 				err = nil
 				continue
 			}
@@ -209,6 +215,32 @@ func (store *UniversalRedisStore) ListDirectoryEntries(ctx context.Context, dirP
 	return lastFileName, err
 }
 
+func (store *UniversalRedisStore) removeOrphanedDirectoryListMember(ctx context.Context, dirPath util.FullPath, fileName string) {
+	// survive the listing request being canceled mid-repair
+	ctx = context.WithoutCancel(ctx)
+
+	dirListKey := genDirectoryListKey(string(dirPath))
+	path := util.NewFullPath(string(dirPath), fileName)
+
+	if _, err := store.Client.SRem(ctx, dirListKey, fileName).Result(); err != nil {
+		return
+	}
+
+	// a value present again here belongs to a concurrent recreate whose SAdd raced our SRem
+	exists, err := store.Client.Exists(ctx, string(path)).Result()
+	if err == nil && exists == 0 {
+		// empty sets self-delete, so a present child index holds children a recursive delete still needs to reach
+		children, childrenErr := store.Client.Exists(ctx, genDirectoryListKey(string(path))).Result()
+		if childrenErr == nil && children == 0 {
+			return
+		}
+	}
+
+	if err := store.Client.SAdd(ctx, dirListKey, fileName).Err(); err != nil {
+		glog.V(0).InfofCtx(ctx, "restore %s in %s: %v", fileName, dirPath, err)
+	}
+}
+
 func genDirectoryListKey(dir string) (dirList string) {
 	return dir + DIR_LIST_MARKER
 }
diff --git a/weed/filer/redis/universal_redis_store_test.go b/weed/filer/redis/universal_redis_store_test.go
new file mode 100644
index 0000000000..7f5f7d98d9
--- /dev/null
+++ b/weed/filer/redis/universal_redis_store_test.go
@@ -0,0 +1,181 @@
+package redis
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func newTestStore(t *testing.T) (*UniversalRedisStore, util.FullPath) {
+	t.Helper()
+
+	if os.Getenv("RUN_REDIS_TESTS") != "1" {
+		t.Skip("redis tests are disabled. Start a redis-server and set RUN_REDIS_TESTS=1 to enable, REDIS_ADDR defaults to 127.0.0.1:6379.")
+	}
+
+	addr := os.Getenv("REDIS_ADDR")
+	if addr == "" {
+		addr = "127.0.0.1:6379"
+	}
+
+	ctx := context.Background()
+	client := redis.NewClient(&redis.Options{Addr: addr})
+	t.Cleanup(func() {
+		if err := client.Close(); err != nil {
+			t.Errorf("close redis client: %v", err)
+		}
+	})
+	if err := client.Ping(ctx).Err(); err != nil {
+		t.Fatalf("connect to redis at %s: %v", addr, err)
+	}
+
+	store := &UniversalRedisStore{Client: client}
+
+	dir := util.FullPath(fmt.Sprintf("/redis_test_%d", time.Now().UnixNano()))
+	t.Cleanup(func() {
+		if err := store.DeleteFolderChildren(ctx, dir); err != nil {
+			t.Errorf("cleanup %s children: %v", dir, err)
+		}
+		if err := store.DeleteEntry(ctx, dir); err != nil {
+			t.Errorf("cleanup %s: %v", dir, err)
+		}
+	})
+
+	return store, dir
+}
+
+func insertTestEntry(t *testing.T, store *UniversalRedisStore, path util.FullPath) {
+	t.Helper()
+
+	now := time.Now()
+	if err := store.InsertEntry(context.Background(), &filer.Entry{
+		FullPath: path,
+		Attr:     filer.Attr{Crtime: now, Mtime: now, Mode: 0644},
+	}); err != nil {
+		t.Fatalf("InsertEntry %s: %v", path, err)
+	}
+}
+
+func listNames(t *testing.T, store *UniversalRedisStore, dir util.FullPath) []string {
+	t.Helper()
+
+	names := []string{}
+	if _, err := store.ListDirectoryEntries(context.Background(), dir, "", true, 100, func(entry *filer.Entry) (bool, error) {
+		_, name := entry.DirAndName()
+		names = append(names, name)
+		return true, nil
+	}); err != nil {
+		t.Fatalf("ListDirectoryEntries %s: %v", dir, err)
+	}
+	return names
+}
+
+func indexMembers(t *testing.T, store *UniversalRedisStore, dir util.FullPath) []string {
+	t.Helper()
+
+	members, err := store.Client.SMembers(context.Background(), genDirectoryListKey(string(dir))).Result()
+	if err != nil {
+		t.Fatalf("read directory index of %s: %v", dir, err)
+	}
+	slices.Sort(members)
+	return members
+}
+
+func TestListDirectoryEntriesRemovesOrphanedIndexMembers(t *testing.T) {
+	store, dir := newTestStore(t)
+
+	insertTestEntry(t, store, dir.Child("alive"))
+	insertTestEntry(t, store, dir.Child("orphan"))
+
+	if err := store.Client.Del(context.Background(), string(dir.Child("orphan"))).Err(); err != nil {
+		t.Fatalf("drop value key: %v", err)
+	}
+
+	if names := listNames(t, store, dir); len(names) != 1 || names[0] != "alive" {
+		t.Fatalf("listed %v, want [alive]", names)
+	}
+
+	if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "alive" {
+		t.Fatalf("directory index holds %v, want [alive]", members)
+	}
+}
+
+func TestRemoveOrphanedDirectoryListMemberKeepsRecreatedEntry(t *testing.T) {
+	store, dir := newTestStore(t)
+
+	insertTestEntry(t, store, dir.Child("recreated"))
+
+	store.removeOrphanedDirectoryListMember(context.Background(), dir, "recreated")
+
+	if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "recreated" {
+		t.Fatalf("directory index holds %v, want [recreated]", members)
+	}
+
+	if names := listNames(t, store, dir); len(names) != 1 || names[0] != "recreated" {
+		t.Fatalf("listed %v, want [recreated]", names)
+	}
+}
+
+func TestRemoveOrphanedDirectoryListMemberKeepsDirectoryWithChildren(t *testing.T) {
+	store, dir := newTestStore(t)
+
+	sub := dir.Child("sub")
+	insertTestEntry(t, store, sub)
+	insertTestEntry(t, store, sub.Child("kid"))
+	defer func() {
+		if err := store.DeleteFolderChildren(context.Background(), sub); err != nil {
+			t.Errorf("cleanup %s children: %v", sub, err)
+		}
+	}()
+
+	// evict the directory's own value while its child index is live
+	if err := store.Client.Del(context.Background(), string(sub)).Err(); err != nil {
+		t.Fatalf("drop value key: %v", err)
+	}
+
+	if names := listNames(t, store, dir); len(names) != 0 {
+		t.Fatalf("listed %v, want none", names)
+	}
+
+	if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "sub" {
+		t.Fatalf("directory index holds %v, want [sub]", members)
+	}
+
+	if exists, err := store.Client.Exists(context.Background(), string(sub.Child("kid"))).Result(); err != nil || exists != 1 {
+		t.Fatalf("child value key exists=%d err=%v, want it kept", exists, err)
+	}
+}
+
+func TestDeleteFolderChildrenRemovesTheListing(t *testing.T) {
+	store, dir := newTestStore(t)
+	ctx := context.Background()
+
+	insertTestEntry(t, store, dir.Child("obj"))
+
+	// The directory entry going away must not take the listing with it; nothing
+	// else records that the child is under this directory.
+	if err := store.DeleteEntry(ctx, dir); err != nil {
+		t.Fatalf("DeleteEntry %s: %v", dir, err)
+	}
+	if names := listNames(t, store, dir); len(names) != 1 || names[0] != "obj" {
+		t.Errorf("child should still be listed after the directory entry is deleted, got %v", names)
+	}
+
+	// Deleting the children takes the listing with them, rather than leaving it behind.
+	if err := store.DeleteFolderChildren(ctx, dir); err != nil {
+		t.Fatalf("DeleteFolderChildren %s: %v", dir, err)
+	}
+	if n, err := store.Client.Exists(ctx, genDirectoryListKey(string(dir))).Result(); err != nil {
+		t.Fatalf("exists %s: %v", dir, err)
+	} else if n != 0 {
+		t.Errorf("listing key should be removed with the children, still present")
+	}
+}
diff --git a/weed/filer/redis2/universal_redis_store.go b/weed/filer/redis2/universal_redis_store.go
index 776952fc4d..1320495583 100644
--- a/weed/filer/redis2/universal_redis_store.go
+++ b/weed/filer/redis2/universal_redis_store.go
@@ -118,11 +118,10 @@ func (store *UniversalRedis2Store) FindEntry(ctx context.Context, fullpath util.
 
 func (store *UniversalRedis2Store) DeleteEntry(ctx context.Context, fullpath util.FullPath) (err error) {
 
-	_, err = store.Client.Del(ctx, store.getKey(genDirectoryListKey(string(fullpath)))).Result()
-	if err != nil {
-		return fmt.Errorf("delete dir list %s : %v", fullpath, err)
-	}
-
+	// The child listing is dropped by DeleteFolderChildren, together with the
+	// children it describes. Dropping it here would also discard an entry that
+	// arrived after the caller judged this directory empty, and nothing else
+	// records that the entry is there.
 	_, err = store.Client.Del(ctx, store.getKey(string(fullpath))).Result()
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
@@ -148,7 +147,8 @@ func (store *UniversalRedis2Store) DeleteFolderChildren(ctx context.Context, ful
 		return nil
 	}
 
-	members, err := store.Client.ZRangeByLex(ctx, store.getKey(genDirectoryListKey(string(fullpath))), &redis.ZRangeBy{
+	dirListKey := store.getKey(genDirectoryListKey(string(fullpath)))
+	members, err := store.Client.ZRangeByLex(ctx, dirListKey, &redis.ZRangeBy{
 		Min: "-",
 		Max: "+",
 	}).Result()
@@ -166,6 +166,10 @@ func (store *UniversalRedis2Store) DeleteFolderChildren(ctx context.Context, ful
 		store.Client.Del(ctx, store.getKey(genDirectoryListKey(string(path))))
 	}
 
+	if _, err = store.Client.Del(ctx, dirListKey).Result(); err != nil {
+		return fmt.Errorf("DeleteFolderChildren %s list: %v", fullpath, err)
+	}
+
 	return nil
 }
 
@@ -205,17 +209,15 @@ func (store *UniversalRedis2Store) ListDirectoryEntries(ctx context.Context, dir
 		if err != nil {
 			glog.V(0).InfofCtx(ctx, "list %s : %v", path, err)
 			if err == filer_pb.ErrNotFound {
+				store.removeOrphanedDirectoryListMember(ctx, dirPath, fileName)
 				err = nil
 				continue
 			}
 			break
 		} else {
-			if entry.TtlSec > 0 {
-				if entry.Attr.Crtime.Add(time.Duration(entry.TtlSec) * time.Second).Before(time.Now()) {
-					store.Client.Del(ctx, store.getKey(string(path))).Result()
-					store.Client.ZRem(ctx, dirListKey, fileName).Result()
-					continue
-				}
+			if isLogicallyExpired(entry) {
+				store.deleteExpiredEntry(ctx, dirPath, path, fileName)
+				continue
 			}
 
 			resEachEntryFunc, resEachEntryFuncErr := eachEntryFunc(entry)
@@ -233,6 +235,99 @@ func (store *UniversalRedis2Store) ListDirectoryEntries(ctx context.Context, dir
 	return lastFileName, err
 }
 
+func (store *UniversalRedis2Store) removeOrphanedDirectoryListMember(ctx context.Context, dirPath util.FullPath, fileName string) {
+	// a directory converted to super large after accumulating members still has a legacy index
+	if store.isSuperLargeDirectory(string(dirPath)) {
+		return
+	}
+
+	// survive the listing request being canceled mid-repair
+	ctx = context.WithoutCancel(ctx)
+
+	dirListKey := store.getKey(genDirectoryListKey(string(dirPath)))
+	path := util.NewFullPath(string(dirPath), fileName)
+
+	if err := store.Client.ZRem(ctx, dirListKey, fileName).Err(); err != nil {
+		return
+	}
+
+	// InsertEntry writes the value before adding the member, so a value present
+	// again here may belong to an insert that found the member still in place
+	// and whose ZAddNX was therefore a no-op.
+	exists, err := store.existsOnMaster(ctx, store.getKey(string(path)))
+	if err == nil && exists == 0 {
+		// an evicted directory may still have a live child index; empty zsets self-delete,
+		// so a present index holds children a recursive delete still needs to reach
+		children, childrenErr := store.existsOnMaster(ctx, store.getKey(genDirectoryListKey(string(path))))
+		if childrenErr == nil && children == 0 {
+			return
+		}
+	}
+
+	if err := store.Client.ZAddNX(ctx, dirListKey, redis.Z{Score: 0, Member: fileName}).Err(); err != nil {
+		glog.V(0).InfofCtx(ctx, "restore %s in %s: %v", fileName, dirPath, err)
+	}
+}
+
+var existsScript = redis.NewScript(`return redis.call('EXISTS', KEYS[1])`)
+
+// replica-routed clients (useReadOnly, routeByLatency) would run a plain EXISTS on a lagging
+// replica and misread a live value as absent, turning the repair destructive; a script always
+// runs on the key's master
+func (store *UniversalRedis2Store) existsOnMaster(ctx context.Context, key string) (int64, error) {
+	return existsScript.Run(ctx, store.Client, []string{key}).Int64()
+}
+
+func isLogicallyExpired(entry *filer.Entry) bool {
+	return entry.TtlSec > 0 && entry.Attr.Crtime.Add(time.Duration(entry.TtlSec)*time.Second).Before(time.Now())
+}
+
+// deletes the value only when it still holds exactly the bytes the expiry decision was made on;
+// single-key, so it runs on all transports where a multi-key script would be CROSSSLOT.
+// -1: already gone, 0: changed under us, 1: deleted
+var deleteIfUnchangedScript = redis.NewScript(`
+local v = redis.call('GET', KEYS[1])
+if v == false then
+	return -1
+end
+if v == ARGV[1] then
+	return redis.call('DEL', KEYS[1])
+end
+return 0`)
+
+func (store *UniversalRedis2Store) deleteExpiredEntry(ctx context.Context, dirPath util.FullPath, path util.FullPath, fileName string) {
+	// survive the listing request being canceled mid-delete
+	ctx = context.WithoutCancel(ctx)
+	valueKey := store.getKey(string(path))
+
+	// re-read so the delete can be conditioned on exactly the bytes checked
+	data, err := store.Client.Get(ctx, valueKey).Bytes()
+	if err == redis.Nil {
+		store.removeOrphanedDirectoryListMember(ctx, dirPath, fileName)
+		return
+	}
+	if err != nil {
+		return
+	}
+
+	entry := &filer.Entry{FullPath: path}
+	if err := entry.DecodeAttributesAndChunks(util.MaybeDecompressData(data)); err != nil {
+		return
+	}
+	if !isLogicallyExpired(entry) {
+		// a concurrent insert recreated it
+		return
+	}
+
+	// 0 means a concurrent recreate changed the value: keep it. -1 means the redis
+	// TTL won after the re-read: the member still needs the not-found repair.
+	deleted, err := deleteIfUnchangedScript.Run(ctx, store.Client, []string{valueKey}, data).Int()
+	if err != nil || deleted == 0 {
+		return
+	}
+	store.removeOrphanedDirectoryListMember(ctx, dirPath, fileName)
+}
+
 func genDirectoryListKey(dir string) (dirList string) {
 	return dir + DIR_LIST_MARKER
 }
diff --git a/weed/filer/redis2/universal_redis_store_test.go b/weed/filer/redis2/universal_redis_store_test.go
new file mode 100644
index 0000000000..1558538dad
--- /dev/null
+++ b/weed/filer/redis2/universal_redis_store_test.go
@@ -0,0 +1,331 @@
+package redis2
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func newTestStore(t *testing.T, keyPrefix string) (*UniversalRedis2Store, util.FullPath) {
+	t.Helper()
+
+	if os.Getenv("RUN_REDIS_TESTS") != "1" {
+		t.Skip("redis2 tests are disabled. Start a redis-server and set RUN_REDIS_TESTS=1 to enable, REDIS_ADDR defaults to 127.0.0.1:6379.")
+	}
+
+	addr := os.Getenv("REDIS_ADDR")
+	if addr == "" {
+		addr = "127.0.0.1:6379"
+	}
+
+	ctx := context.Background()
+	client := redis.NewClient(&redis.Options{Addr: addr})
+	t.Cleanup(func() {
+		if err := client.Close(); err != nil {
+			t.Errorf("close redis client: %v", err)
+		}
+	})
+	if err := client.Ping(ctx).Err(); err != nil {
+		t.Fatalf("connect to redis at %s: %v", addr, err)
+	}
+
+	store := &UniversalRedis2Store{Client: client, keyPrefix: keyPrefix}
+
+	dir := util.FullPath(fmt.Sprintf("/redis2_test_%d", time.Now().UnixNano()))
+	t.Cleanup(func() {
+		if err := store.DeleteFolderChildren(ctx, dir); err != nil {
+			t.Errorf("cleanup %s children: %v", dir, err)
+		}
+		if err := store.DeleteEntry(ctx, dir); err != nil {
+			t.Errorf("cleanup %s: %v", dir, err)
+		}
+	})
+
+	return store, dir
+}
+
+func insertTestEntry(t *testing.T, store *UniversalRedis2Store, path util.FullPath, ttlSec int32) {
+	t.Helper()
+
+	now := time.Now()
+	if err := store.InsertEntry(context.Background(), &filer.Entry{
+		FullPath: path,
+		Attr:     filer.Attr{Crtime: now, Mtime: now, Mode: 0644, TtlSec: ttlSec},
+	}); err != nil {
+		t.Fatalf("InsertEntry %s: %v", path, err)
+	}
+}
+
+func listNames(t *testing.T, store *UniversalRedis2Store, dir util.FullPath) []string {
+	t.Helper()
+
+	names := []string{}
+	if _, err := store.ListDirectoryEntries(context.Background(), dir, "", true, 100, func(entry *filer.Entry) (bool, error) {
+		_, name := entry.DirAndName()
+		names = append(names, name)
+		return true, nil
+	}); err != nil {
+		t.Fatalf("ListDirectoryEntries %s: %v", dir, err)
+	}
+	return names
+}
+
+func indexMembers(t *testing.T, store *UniversalRedis2Store, dir util.FullPath) []string {
+	t.Helper()
+
+	members, err := store.Client.ZRangeByLex(context.Background(), store.getKey(genDirectoryListKey(string(dir))), &redis.ZRangeBy{Min: "-", Max: "+"}).Result()
+	if err != nil {
+		t.Fatalf("read directory index of %s: %v", dir, err)
+	}
+	return members
+}
+
+func TestListDirectoryEntriesRemovesOrphanedIndexMembers(t *testing.T) {
+	for _, keyPrefix := range []string{"", "sw:"} {
+		t.Run("keyPrefix="+keyPrefix, func(t *testing.T) {
+			store, dir := newTestStore(t, keyPrefix)
+
+			insertTestEntry(t, store, dir.Child("alive"), 0)
+			insertTestEntry(t, store, dir.Child("orphan"), 0)
+
+			if err := store.Client.Del(context.Background(), store.getKey(string(dir.Child("orphan")))).Err(); err != nil {
+				t.Fatalf("drop value key: %v", err)
+			}
+
+			if names := listNames(t, store, dir); len(names) != 1 || names[0] != "alive" {
+				t.Fatalf("listed %v, want [alive]", names)
+			}
+
+			if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "alive" {
+				t.Fatalf("directory index holds %v, want [alive]", members)
+			}
+		})
+	}
+}
+
+func TestRemoveOrphanedDirectoryListMemberKeepsRecreatedEntry(t *testing.T) {
+	for _, keyPrefix := range []string{"", "sw:"} {
+		t.Run("keyPrefix="+keyPrefix, func(t *testing.T) {
+			store, dir := newTestStore(t, keyPrefix)
+
+			path := dir.Child("recreated")
+			insertTestEntry(t, store, path, 0)
+
+			store.removeOrphanedDirectoryListMember(context.Background(), dir, "recreated")
+
+			if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "recreated" {
+				t.Fatalf("directory index holds %v, want [recreated]", members)
+			}
+
+			if names := listNames(t, store, dir); len(names) != 1 || names[0] != "recreated" {
+				t.Fatalf("listed %v, want [recreated]", names)
+			}
+		})
+	}
+}
+
+func TestRemoveOrphanedDirectoryListMemberKeepsDirectoryWithChildren(t *testing.T) {
+	for _, keyPrefix := range []string{"", "sw:"} {
+		t.Run("keyPrefix="+keyPrefix, func(t *testing.T) {
+			store, dir := newTestStore(t, keyPrefix)
+
+			sub := dir.Child("sub")
+			insertTestEntry(t, store, sub, 0)
+			insertTestEntry(t, store, sub.Child("kid"), 0)
+			defer func() {
+				if err := store.DeleteFolderChildren(context.Background(), sub); err != nil {
+					t.Errorf("cleanup %s children: %v", sub, err)
+				}
+			}()
+
+			// evict the directory's own value while its child index is live
+			if err := store.Client.Del(context.Background(), store.getKey(string(sub))).Err(); err != nil {
+				t.Fatalf("drop value key: %v", err)
+			}
+
+			if names := listNames(t, store, dir); len(names) != 0 {
+				t.Fatalf("listed %v, want none", names)
+			}
+
+			if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "sub" {
+				t.Fatalf("directory index holds %v, want [sub]", members)
+			}
+
+			if exists, err := store.Client.Exists(context.Background(), store.getKey(string(sub.Child("kid")))).Result(); err != nil || exists != 1 {
+				t.Fatalf("child value key exists=%d err=%v, want it kept", exists, err)
+			}
+		})
+	}
+}
+
+func TestRemoveOrphanedDirectoryListMemberSkipsSuperLargeDirectory(t *testing.T) {
+	store, dir := newTestStore(t, "")
+	store.loadSuperLargeDirectories([]string{string(dir)})
+
+	// a member left from before the directory became super large
+	if err := store.Client.ZAdd(context.Background(), store.getKey(genDirectoryListKey(string(dir))), redis.Z{Score: 0, Member: "legacy"}).Err(); err != nil {
+		t.Fatalf("plant legacy member: %v", err)
+	}
+
+	store.removeOrphanedDirectoryListMember(context.Background(), dir, "legacy")
+
+	if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "legacy" {
+		t.Fatalf("directory index holds %v, want [legacy] untouched", members)
+	}
+}
+
+func requireValueKey(t *testing.T, store *UniversalRedis2Store, path util.FullPath) {
+	t.Helper()
+
+	if exists, err := store.Client.Exists(context.Background(), store.getKey(string(path))).Result(); err != nil || exists != 1 {
+		t.Fatalf("value key %s exists=%d err=%v, want it present", path, exists, err)
+	}
+}
+
+func TestListDirectoryEntriesRemovesIndexMembersExpiredByRedis(t *testing.T) {
+	store, dir := newTestStore(t, "")
+
+	insertTestEntry(t, store, dir.Child("ttl"), 1)
+	requireValueKey(t, store, dir.Child("ttl"))
+
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		exists, err := store.Client.Exists(context.Background(), store.getKey(string(dir.Child("ttl")))).Result()
+		if err != nil {
+			t.Fatalf("check value key: %v", err)
+		}
+		if exists == 0 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("redis did not expire the value key, the logical expiry path is not being bypassed")
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+
+	if names := listNames(t, store, dir); len(names) != 0 {
+		t.Fatalf("listed %v, want none", names)
+	}
+
+	if members := indexMembers(t, store, dir); len(members) != 0 {
+		t.Fatalf("directory index holds %v, want none", members)
+	}
+}
+
+// logically expired (Crtime + TtlSec long past) while the physical key survives,
+// because the redis TTL re-arms from the SET time
+func insertLogicallyExpiredTestEntry(t *testing.T, store *UniversalRedis2Store, path util.FullPath) {
+	t.Helper()
+
+	created := time.Now().Add(-time.Hour)
+	if err := store.InsertEntry(context.Background(), &filer.Entry{
+		FullPath: path,
+		Attr:     filer.Attr{Crtime: created, Mtime: created, Mode: 0644, TtlSec: 60},
+	}); err != nil {
+		t.Fatalf("InsertEntry %s: %v", path, err)
+	}
+}
+
+func TestListDirectoryEntriesDeletesLogicallyExpiredEntries(t *testing.T) {
+	for _, keyPrefix := range []string{"", "sw:"} {
+		t.Run("keyPrefix="+keyPrefix, func(t *testing.T) {
+			store, dir := newTestStore(t, keyPrefix)
+
+			insertLogicallyExpiredTestEntry(t, store, dir.Child("stale"))
+			requireValueKey(t, store, dir.Child("stale"))
+
+			if names := listNames(t, store, dir); len(names) != 0 {
+				t.Fatalf("listed %v, want none", names)
+			}
+
+			if exists, err := store.Client.Exists(context.Background(), store.getKey(string(dir.Child("stale")))).Result(); err != nil || exists != 0 {
+				t.Fatalf("value key exists=%d err=%v, want it deleted", exists, err)
+			}
+
+			if members := indexMembers(t, store, dir); len(members) != 0 {
+				t.Fatalf("directory index holds %v, want none", members)
+			}
+		})
+	}
+}
+
+func TestDeleteExpiredEntryKeepsRecreatedValue(t *testing.T) {
+	store, dir := newTestStore(t, "")
+
+	path := dir.Child("phoenix")
+	insertLogicallyExpiredTestEntry(t, store, path)
+	// a recreate lands after the lister decided to expire the old value
+	insertTestEntry(t, store, path, 0)
+
+	store.deleteExpiredEntry(context.Background(), dir, path, "phoenix")
+
+	if names := listNames(t, store, dir); len(names) != 1 || names[0] != "phoenix" {
+		t.Fatalf("listed %v, want [phoenix]", names)
+	}
+
+	if members := indexMembers(t, store, dir); len(members) != 1 || members[0] != "phoenix" {
+		t.Fatalf("directory index holds %v, want [phoenix]", members)
+	}
+}
+
+func TestDeleteIfUnchangedScriptOnlyDeletesSameBytes(t *testing.T) {
+	store, dir := newTestStore(t, "")
+
+	key := store.getKey(string(dir.Child("guarded")))
+	if err := store.Client.Set(context.Background(), key, "v1", 0).Err(); err != nil {
+		t.Fatalf("set: %v", err)
+	}
+
+	if deleted, err := deleteIfUnchangedScript.Run(context.Background(), store.Client, []string{key}, []byte("v2")).Int(); err != nil || deleted != 0 {
+		t.Fatalf("deleted=%d err=%v, want no delete on changed bytes", deleted, err)
+	}
+
+	if deleted, err := deleteIfUnchangedScript.Run(context.Background(), store.Client, []string{key}, []byte("v1")).Int(); err != nil || deleted != 1 {
+		t.Fatalf("deleted=%d err=%v, want delete on matching bytes", deleted, err)
+	}
+
+	if exists, err := store.Client.Exists(context.Background(), key).Result(); err != nil || exists != 0 {
+		t.Fatalf("exists=%d err=%v, want key gone", exists, err)
+	}
+
+	if deleted, err := deleteIfUnchangedScript.Run(context.Background(), store.Client, []string{key}, []byte("v1")).Int(); err != nil || deleted != -1 {
+		t.Fatalf("deleted=%d err=%v, want -1 on a missing key", deleted, err)
+	}
+}
+
+func TestDeleteEntryKeepsChildListing(t *testing.T) {
+	store, dir := newTestStore(t, "")
+	ctx := context.Background()
+
+	insertTestEntry(t, store, dir.Child("obj"), 0)
+
+	// The listing is the only record that the child sits under this directory, so
+	// removing the directory entry must leave it alone. An entry that arrived after
+	// the caller judged the directory empty would otherwise become unreachable.
+	if err := store.DeleteEntry(ctx, dir); err != nil {
+		t.Fatalf("DeleteEntry %s: %v", dir, err)
+	}
+	if names := listNames(t, store, dir); len(names) != 1 || names[0] != "obj" {
+		t.Errorf("child should still be listed after the directory entry is deleted, got %v", names)
+	}
+
+	// DeleteFolderChildren owns that cleanup, and takes the listing with it
+	if err := store.DeleteFolderChildren(ctx, dir); err != nil {
+		t.Fatalf("DeleteFolderChildren %s: %v", dir, err)
+	}
+	if names := listNames(t, store, dir); len(names) != 0 {
+		t.Errorf("listing should be empty once the children are deleted, got %v", names)
+	}
+	if n, err := store.Client.Exists(ctx, store.getKey(genDirectoryListKey(string(dir)))).Result(); err != nil {
+		t.Fatalf("exists %s: %v", dir, err)
+	} else if n != 0 {
+		t.Errorf("listing key should be removed with the children, still present")
+	}
+}
diff --git a/weed/filer/redis3/ItemList.go b/weed/filer/redis3/ItemList.go
index 7a700f4354..5da7350969 100644
--- a/weed/filer/redis3/ItemList.go
+++ b/weed/filer/redis3/ItemList.go
@@ -342,6 +342,10 @@ func (nl *ItemList) ListNames(startFrom string, visitNamesFn func(name string) b
 	return nil
 }
 
+func (nl *ItemList) IsEmpty() bool {
+	return nl.skipList.StartLevels[0] == nil
+}
+
 func (nl *ItemList) RemoteAllListElement() error {
 
 	t := nl.skipList
diff --git a/weed/filer/redis3/kv_directory_children.go b/weed/filer/redis3/kv_directory_children.go
index 281b011952..e1b080b412 100644
--- a/weed/filer/redis3/kv_directory_children.go
+++ b/weed/filer/redis3/kv_directory_children.go
@@ -70,9 +70,21 @@ func removeChild(ctx context.Context, redisStore *UniversalRedis3Store, key stri
 		return err
 	}
 	if !nameList.HasChanges() {
+		// Nothing to remove. If the list is empty anyway, its header outlived the
+		// removal of the last name - a delete that failed here before - so take it
+		// now rather than leaving the key behind for good.
+		if nameList.IsEmpty() {
+			return client.Del(ctx, key).Err()
+		}
 		return nil
 	}
 
+	// An emptied list reads the same as no list at all, and keeping the header would
+	// leave a key behind for every directory that is emptied.
+	if nameList.IsEmpty() {
+		return client.Del(ctx, key).Err()
+	}
+
 	if err := client.Set(ctx, key, nameList.ToBytes(), 0).Err(); err != nil {
 		return err
 	}
diff --git a/weed/filer/redis3/universal_redis_store.go b/weed/filer/redis3/universal_redis_store.go
index 84cd429083..abaf7e698f 100644
--- a/weed/filer/redis3/universal_redis_store.go
+++ b/weed/filer/redis3/universal_redis_store.go
@@ -95,11 +95,10 @@ func (store *UniversalRedis3Store) FindEntry(ctx context.Context, fullpath util.
 
 func (store *UniversalRedis3Store) DeleteEntry(ctx context.Context, fullpath util.FullPath) (err error) {
 
-	_, err = store.Client.Del(ctx, genDirectoryListKey(string(fullpath))).Result()
-	if err != nil {
-		return fmt.Errorf("delete dir list %s : %v", fullpath, err)
-	}
-
+	// The child listing is dropped by DeleteFolderChildren, together with the
+	// children it describes. Dropping it here would also discard an entry that
+	// arrived after the caller judged this directory empty, and nothing else
+	// records that the entry is there.
 	_, err = store.Client.Del(ctx, string(fullpath)).Result()
 	if err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
@@ -118,7 +117,8 @@ func (store *UniversalRedis3Store) DeleteEntry(ctx context.Context, fullpath uti
 
 func (store *UniversalRedis3Store) DeleteFolderChildren(ctx context.Context, fullpath util.FullPath) (err error) {
 
-	return removeChildren(ctx, store, genDirectoryListKey(string(fullpath)), func(name string) error {
+	dirListKey := genDirectoryListKey(string(fullpath))
+	if err = removeChildren(ctx, store, dirListKey, func(name string) error {
 		path := util.NewFullPath(string(fullpath), name)
 		_, err = store.Client.Del(ctx, string(path)).Result()
 		if err != nil {
@@ -127,8 +127,16 @@ func (store *UniversalRedis3Store) DeleteFolderChildren(ctx context.Context, ful
 		// not efficient, but need to remove if it is a directory
 		store.Client.Del(ctx, genDirectoryListKey(string(path)))
 		return nil
-	})
+	}); err != nil {
+		return err
+	}
 
+	// removeChildren clears the skip list nodes but leaves the list itself behind
+	if _, err = store.Client.Del(ctx, dirListKey).Result(); err != nil {
+		return fmt.Errorf("DeleteFolderChildren %s list: %v", fullpath, err)
+	}
+
+	return nil
 }
 
 func (store *UniversalRedis3Store) ListDirectoryPrefixedEntries(ctx context.Context, dirPath util.FullPath, startFileName string, includeStartFile bool, limit int64, prefix string, eachEntryFunc filer.ListEachEntryFunc) (lastFileName string, err error) {
diff --git a/weed/filer/redis3/universal_redis_store_test.go b/weed/filer/redis3/universal_redis_store_test.go
new file mode 100644
index 0000000000..895fc26099
--- /dev/null
+++ b/weed/filer/redis3/universal_redis_store_test.go
@@ -0,0 +1,129 @@
+package redis3
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/go-redsync/redsync/v4"
+	goredis "github.com/go-redsync/redsync/v4/redis/goredis/v9"
+	"github.com/redis/go-redis/v9"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func newTestStore(t *testing.T) (*UniversalRedis3Store, util.FullPath) {
+	t.Helper()
+
+	if os.Getenv("RUN_REDIS_TESTS") != "1" {
+		t.Skip("redis3 tests are disabled. Start a redis-server and set RUN_REDIS_TESTS=1 to enable, REDIS_ADDR defaults to 127.0.0.1:6379.")
+	}
+
+	addr := os.Getenv("REDIS_ADDR")
+	if addr == "" {
+		addr = "127.0.0.1:6379"
+	}
+
+	ctx := context.Background()
+	client := redis.NewClient(&redis.Options{Addr: addr})
+	t.Cleanup(func() {
+		if err := client.Close(); err != nil {
+			t.Errorf("close redis client: %v", err)
+		}
+	})
+	if err := client.Ping(ctx).Err(); err != nil {
+		t.Fatalf("connect to redis at %s: %v", addr, err)
+	}
+
+	store := &UniversalRedis3Store{Client: client, redsync: redsync.New(goredis.NewPool(client))}
+
+	dir := util.FullPath(fmt.Sprintf("/redis3_test_%d", time.Now().UnixNano()))
+	t.Cleanup(func() {
+		if err := store.DeleteFolderChildren(ctx, dir); err != nil {
+			t.Errorf("cleanup %s children: %v", dir, err)
+		}
+		if err := store.DeleteEntry(ctx, dir); err != nil {
+			t.Errorf("cleanup %s: %v", dir, err)
+		}
+	})
+
+	return store, dir
+}
+
+func listNames(t *testing.T, store *UniversalRedis3Store, dir util.FullPath) []string {
+	t.Helper()
+
+	names := []string{}
+	if _, err := store.ListDirectoryEntries(context.Background(), dir, "", true, 100, func(entry *filer.Entry) (bool, error) {
+		names = append(names, entry.Name())
+		return true, nil
+	}); err != nil {
+		t.Fatalf("list %s: %v", dir, err)
+	}
+	return names
+}
+
+func TestDeleteEntryKeepsChildListing(t *testing.T) {
+	store, dir := newTestStore(t)
+	ctx := context.Background()
+
+	now := time.Now()
+	child := dir.Child("obj")
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: child,
+		Attr:     filer.Attr{Crtime: now, Mtime: now, Mode: 0644},
+	}); err != nil {
+		t.Fatalf("InsertEntry %s: %v", child, err)
+	}
+
+	// The listing is the only record that the child sits under this directory, so
+	// removing the directory entry must leave it alone. An entry that arrived after
+	// the caller judged the directory empty would otherwise become unreachable.
+	if err := store.DeleteEntry(ctx, dir); err != nil {
+		t.Fatalf("DeleteEntry %s: %v", dir, err)
+	}
+	if names := listNames(t, store, dir); len(names) != 1 || names[0] != "obj" {
+		t.Errorf("child should still be listed after the directory entry is deleted, got %v", names)
+	}
+
+	// DeleteFolderChildren owns that cleanup, and takes the listing with it
+	if err := store.DeleteFolderChildren(ctx, dir); err != nil {
+		t.Fatalf("DeleteFolderChildren %s: %v", dir, err)
+	}
+	if names := listNames(t, store, dir); len(names) != 0 {
+		t.Errorf("listing should be empty once the children are deleted, got %v", names)
+	}
+	if n, err := store.Client.Exists(ctx, genDirectoryListKey(string(dir))).Result(); err != nil {
+		t.Fatalf("exists %s: %v", dir, err)
+	} else if n != 0 {
+		t.Errorf("listing key should be removed with the children, still present")
+	}
+}
+
+func TestRemovingTheLastChildDropsTheListing(t *testing.T) {
+	store, dir := newTestStore(t)
+	ctx := context.Background()
+
+	now := time.Now()
+	child := dir.Child("obj")
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: child,
+		Attr:     filer.Attr{Crtime: now, Mtime: now, Mode: 0644},
+	}); err != nil {
+		t.Fatalf("InsertEntry %s: %v", child, err)
+	}
+
+	// An emptied listing must not leave its header behind: cleanup deletes such a
+	// folder without touching the listing, so the key would never be collected.
+	if err := store.DeleteEntry(ctx, child); err != nil {
+		t.Fatalf("DeleteEntry %s: %v", child, err)
+	}
+	if n, err := store.Client.Exists(ctx, genDirectoryListKey(string(dir))).Result(); err != nil {
+		t.Fatalf("exists %s: %v", dir, err)
+	} else if n != 0 {
+		t.Errorf("listing key should be gone once the last child is removed, still present")
+	}
+}
diff --git a/weed/filer/redis_conf/redis_conf_test.go b/weed/filer/redis_conf/redis_conf_test.go
index a4a84d31a8..6bc21717b5 100644
--- a/weed/filer/redis_conf/redis_conf_test.go
+++ b/weed/filer/redis_conf/redis_conf_test.go
@@ -47,8 +47,8 @@ func TestUnsetKeepsGoRedisDefaults(t *testing.T) {
 	client := redis.NewFailoverClient(options)
 	defer client.Close()
 
-	if got := client.Options().ReadTimeout; got != 3*time.Second {
-		t.Fatalf("read timeout %v, want the go-redis default of 3s", got)
+	if got := client.Options().ReadTimeout; got != 5*time.Second {
+		t.Fatalf("read timeout %v, want the go-redis default of 5s", got)
 	}
 	if got := client.Options().MaxRetries; got != 3 {
 		t.Fatalf("max retries %d, want the go-redis default of 3", got)
diff --git a/weed/filer/remote_mapping.go b/weed/filer/remote_mapping.go
index 9c488d92e9..359fc44637 100644
--- a/weed/filer/remote_mapping.go
+++ b/weed/filer/remote_mapping.go
@@ -3,6 +3,7 @@ package filer
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -11,6 +12,21 @@ import (
 	"google.golang.org/protobuf/proto"
 )
 
+// FindMountedRemoteMapping returns the mount point covering dir and its remote
+// location. Matches on path components so a sibling name sharing a prefix does
+// not collide, and the longest mount wins when mounts nest.
+func FindMountedRemoteMapping(mappings *remote_pb.RemoteStorageMapping, dir string) (localMountedDir string, remoteStorageMountedLocation *remote_pb.RemoteStorageLocation, err error) {
+	for k, loc := range mappings.Mappings {
+		if (dir == k || strings.HasPrefix(dir, strings.TrimSuffix(k, "/")+"/")) && len(k) > len(localMountedDir) {
+			localMountedDir, remoteStorageMountedLocation = k, loc
+		}
+	}
+	if localMountedDir == "" {
+		return "", nil, fmt.Errorf("%s is not mounted", dir)
+	}
+	return
+}
+
 func ReadMountMappings(grpcDialOption grpc.DialOption, filerAddress pb.ServerAddress) (mappings *remote_pb.RemoteStorageMapping, readErr error) {
 	var oldContent []byte
 	if readErr = pb.WithFilerClient(false, 0, filerAddress, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
diff --git a/weed/filer/remote_mapping_test.go b/weed/filer/remote_mapping_test.go
new file mode 100644
index 0000000000..15fdce1ce4
--- /dev/null
+++ b/weed/filer/remote_mapping_test.go
@@ -0,0 +1,48 @@
+package filer
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestFindMountedRemoteMapping(t *testing.T) {
+	mappings := &remote_pb.RemoteStorageMapping{
+		Mappings: map[string]*remote_pb.RemoteStorageLocation{
+			"/buckets/b":     {Name: "outer"},
+			"/buckets/b/sub": {Name: "inner"},
+			"/buckets/foo":   {Name: "foo"},
+		},
+	}
+
+	tests := []struct {
+		dir       string
+		wantMount string
+		wantName  string
+		wantErr   bool
+	}{
+		{dir: "/buckets/b", wantMount: "/buckets/b", wantName: "outer"},
+		{dir: "/buckets/b/other", wantMount: "/buckets/b", wantName: "outer"},
+		{dir: "/buckets/b/sub", wantMount: "/buckets/b/sub", wantName: "inner"},
+		{dir: "/buckets/b/sub/deep", wantMount: "/buckets/b/sub", wantName: "inner"},
+		{dir: "/buckets/foo/x", wantMount: "/buckets/foo", wantName: "foo"},
+		// a sibling sharing a name prefix is not under the mount
+		{dir: "/buckets/foobar", wantErr: true},
+		{dir: "/buckets/other", wantErr: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.dir, func(t *testing.T) {
+			mount, loc, err := FindMountedRemoteMapping(mappings, tt.dir)
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantMount, mount)
+			assert.Equal(t, tt.wantName, loc.Name)
+		})
+	}
+}
diff --git a/weed/filer/remote_storage.go b/weed/filer/remote_storage.go
index de33c8d209..e1733ce777 100644
--- a/weed/filer/remote_storage.go
+++ b/weed/filer/remote_storage.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"math"
 	"strings"
+	"sync"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
@@ -21,11 +22,38 @@ import (
 const REMOTE_STORAGE_CONF_SUFFIX = ".conf"
 const REMOTE_STORAGE_MOUNT_FILE = "mount.mapping"
 
+// RemoteStorageConfValidator rejects a RemoteConf whose endpoint resolves to
+// an address the filer must not dial (loopback / link-local / private / IMDS).
+// The filer server injects the volume server's SSRF deny-list validator so the
+// filer package — which cannot import the server package — applies the same
+// check the volume server's BuildGuardedRemoteStorageClient does. A nil
+// validator leaves the historical unguarded behavior for unit tests that
+// never dial.
+type RemoteStorageConfValidator func(ctx context.Context, conf *remote_pb.RemoteConf) error
+
 type FilerRemoteStorage struct {
+	// guards rules and storageNameToConf, which are replaced wholesale
+	// whenever /etc/remote changes
+	mu                sync.RWMutex
 	rules             ptrie.Trie[*remote_pb.RemoteStorageLocation]
+	mountDirs         []util.FullPath
 	storageNameToConf map[string]*remote_pb.RemoteConf
+	// confValidator, when set, is applied to every RemoteConf as it is loaded
+	// from /etc/remote. A conf that fails is dropped from storageNameToConf so
+	// the lazy-fetch, lazy-list, and remote-delete paths (which resolve clients
+	// by name) can never dial its endpoint. This closes the unauthenticated-plant
+	// SSRF: a conf written to /etc/remote with a loopback S3 endpoint is rejected
+	// at reload instead of being dialed on the next cache miss.
+	confValidator RemoteStorageConfValidator
 }
 
+// RemoteStorageClientBuilder builds a remote-storage client for a conf. The
+// filer server sets it to the guarded builder (endpoint deny-list + DNS
+// rebinding-safe dialer) so the lazy-remote paths apply the same SSRF checks
+// as the volume and streaming read paths. When nil the lazy paths fall back to
+// the shared unguarded cache.
+type RemoteStorageClientBuilder func(ctx context.Context, remoteConf *remote_pb.RemoteConf, allowUntrusted bool) (remote_storage.RemoteStorageClient, error)
+
 func NewFilerRemoteStorage() (rs *FilerRemoteStorage) {
 	rs = &FilerRemoteStorage{
 		rules:             ptrie.New[*remote_pb.RemoteStorageLocation](),
@@ -34,6 +62,15 @@ func NewFilerRemoteStorage() (rs *FilerRemoteStorage) {
 	return rs
 }
 
+// SetConfValidator installs the SSRF deny-list validator applied to every
+// RemoteConf loaded from /etc/remote. It is called once by the filer server
+// after construction.
+func (rs *FilerRemoteStorage) SetConfValidator(v RemoteStorageConfValidator) {
+	rs.mu.Lock()
+	rs.confValidator = v
+	rs.mu.Unlock()
+}
+
 func (rs *FilerRemoteStorage) LoadRemoteStorageConfigurationsAndMapping(filer *Filer) (err error) {
 	// execute this on filer
 
@@ -48,44 +85,93 @@ func (rs *FilerRemoteStorage) LoadRemoteStorageConfigurationsAndMapping(filer *F
 		return
 	}
 
+	// build into fresh containers so an unmounted directory disappears instead
+	// of lingering in the trie, which has no way to drop a key
+	rules := ptrie.New[*remote_pb.RemoteStorageLocation]()
+	var mountDirs []util.FullPath
+	storageNameToConf := make(map[string]*remote_pb.RemoteConf)
+
 	for _, entry := range entries {
 		if entry.Name() == REMOTE_STORAGE_MOUNT_FILE {
-			if err := rs.loadRemoteStorageMountMapping(entry.Content); err != nil {
+			mountDirs, err = loadRemoteStorageMountMapping(rules, entry.Content)
+			if err != nil {
 				return err
 			}
 			continue
 		}
 		if !strings.HasSuffix(entry.Name(), REMOTE_STORAGE_CONF_SUFFIX) {
-			return nil
+			continue
 		}
 		conf := &remote_pb.RemoteConf{}
 		if err := proto.Unmarshal(entry.Content, conf); err != nil {
 			return fmt.Errorf("unmarshal %s/%s: %v", DirectoryEtcRemote, entry.Name(), err)
 		}
-		rs.storageNameToConf[conf.Name] = conf
+		if rs.confValidator != nil {
+			if vErr := rs.confValidator(context.Background(), conf); vErr != nil {
+				// Drop the conf rather than fail the whole load: a single bad conf
+				// must not evict the rest of /etc/remote, and the mount mapping that
+				// references it resolves to "no client" on the lazy paths instead
+				// of dialing the blocked endpoint.
+				glog.Warningf("reject remote storage conf %s/%s: %v", DirectoryEtcRemote, entry.Name(), vErr)
+				continue
+			}
+		}
+		storageNameToConf[conf.Name] = conf
 	}
+
+	rs.mu.Lock()
+	rs.rules, rs.mountDirs, rs.storageNameToConf = rules, mountDirs, storageNameToConf
+	rs.mu.Unlock()
+
 	return nil
 }
 
-func (rs *FilerRemoteStorage) loadRemoteStorageMountMapping(data []byte) (err error) {
+func loadRemoteStorageMountMapping(rules ptrie.Trie[*remote_pb.RemoteStorageLocation], data []byte) (mountDirs []util.FullPath, err error) {
 	mappings := &remote_pb.RemoteStorageMapping{}
 	if err := proto.Unmarshal(data, mappings); err != nil {
-		return fmt.Errorf("unmarshal %s/%s: %v", DirectoryEtcRemote, REMOTE_STORAGE_MOUNT_FILE, err)
+		return nil, fmt.Errorf("unmarshal %s/%s: %v", DirectoryEtcRemote, REMOTE_STORAGE_MOUNT_FILE, err)
 	}
 	for dir, storageLocation := range mappings.Mappings {
-		rs.mapDirectoryToRemoteStorage(util.FullPath(dir), storageLocation)
+		putDirectoryToRemoteStorage(rules, util.FullPath(dir), storageLocation)
+		mountDirs = append(mountDirs, util.FullPath(dir))
 	}
-	return nil
+	return mountDirs, nil
 }
 
 func (rs *FilerRemoteStorage) mapDirectoryToRemoteStorage(dir util.FullPath, loc *remote_pb.RemoteStorageLocation) {
-	rs.rules.Put([]byte(dir+"/"), loc)
+	rs.mu.Lock()
+	defer rs.mu.Unlock()
+	putDirectoryToRemoteStorage(rs.rules, dir, loc)
+	found := false
+	for _, d := range rs.mountDirs {
+		if d == dir {
+			found = true
+			break
+		}
+	}
+	if !found {
+		rs.mountDirs = append(rs.mountDirs, dir)
+	}
+}
+
+// MountedDirectories returns the directories currently mapped to remote
+// storage, for callers that must reason about every mount rather than one path.
+func (rs *FilerRemoteStorage) MountedDirectories() []util.FullPath {
+	rs.mu.RLock()
+	defer rs.mu.RUnlock()
+	return append([]util.FullPath(nil), rs.mountDirs...)
+}
+
+func putDirectoryToRemoteStorage(rules ptrie.Trie[*remote_pb.RemoteStorageLocation], dir util.FullPath, loc *remote_pb.RemoteStorageLocation) {
+	rules.Put([]byte(dir+"/"), loc)
 }
 
 // FindMountDirectory returns the mount directory and location for p. When multiple
 // mounts match (e.g. /buckets/b and /buckets/b/prefix), ptrie MatchPrefix visits
 // shorter prefixes first, so the last match is the longest prefix.
 func (rs *FilerRemoteStorage) FindMountDirectory(p util.FullPath) (mountDir util.FullPath, remoteLocation *remote_pb.RemoteStorageLocation) {
+	rs.mu.RLock()
+	defer rs.mu.RUnlock()
 	rs.rules.MatchPrefix([]byte(p), func(key []byte, value *remote_pb.RemoteStorageLocation) bool {
 		mountDir = util.FullPath(string(key[:len(key)-1]))
 		remoteLocation = value
@@ -95,22 +181,18 @@ func (rs *FilerRemoteStorage) FindMountDirectory(p util.FullPath) (mountDir util
 }
 
 func (rs *FilerRemoteStorage) FindRemoteStorageClient(p util.FullPath) (client remote_storage.RemoteStorageClient, remoteConf *remote_pb.RemoteConf, found bool) {
-	var storageLocation *remote_pb.RemoteStorageLocation
-	rs.rules.MatchPrefix([]byte(p), func(key []byte, value *remote_pb.RemoteStorageLocation) bool {
-		storageLocation = value
-		return true
-	})
-
+	_, storageLocation := rs.FindMountDirectory(p)
 	if storageLocation == nil {
-		found = false
-		return
+		return nil, nil, false
 	}
 
 	return rs.GetRemoteStorageClient(storageLocation.Name)
 }
 
 func (rs *FilerRemoteStorage) GetRemoteStorageClient(storageName string) (client remote_storage.RemoteStorageClient, remoteConf *remote_pb.RemoteConf, found bool) {
+	rs.mu.RLock()
 	remoteConf, found = rs.storageNameToConf[storageName]
+	rs.mu.RUnlock()
 	if !found {
 		return
 	}
@@ -123,6 +205,21 @@ func (rs *FilerRemoteStorage) GetRemoteStorageClient(storageName string) (client
 	return
 }
 
+func (rs *FilerRemoteStorage) FindRemoteStorageConf(p util.FullPath) (*remote_pb.RemoteConf, bool) {
+	_, storageLocation := rs.FindMountDirectory(p)
+	if storageLocation == nil {
+		return nil, false
+	}
+	return rs.GetRemoteStorageConf(storageLocation.Name)
+}
+
+func (rs *FilerRemoteStorage) GetRemoteStorageConf(storageName string) (*remote_pb.RemoteConf, bool) {
+	rs.mu.RLock()
+	defer rs.mu.RUnlock()
+	conf, found := rs.storageNameToConf[storageName]
+	return conf, found
+}
+
 func UnmarshalRemoteStorageMappings(oldContent []byte) (mappings *remote_pb.RemoteStorageMapping, err error) {
 	mappings = &remote_pb.RemoteStorageMapping{
 		Mappings: make(map[string]*remote_pb.RemoteStorageLocation),
@@ -164,15 +261,9 @@ func DetectMountInfo(grpcDialOption grpc.DialOption, filerAddress pb.ServerAddre
 		return mappings, "", nil, nil, fmt.Errorf("need to specify '-dir' option")
 	}
 
-	var localMountedDir string
-	var remoteStorageMountedLocation *remote_pb.RemoteStorageLocation
-	for k, loc := range mappings.Mappings {
-		if strings.HasPrefix(dir, k) {
-			localMountedDir, remoteStorageMountedLocation = k, loc
-		}
-	}
-	if localMountedDir == "" {
-		return mappings, localMountedDir, remoteStorageMountedLocation, nil, fmt.Errorf("%s is not mounted", dir)
+	localMountedDir, remoteStorageMountedLocation, findErr := FindMountedRemoteMapping(mappings, dir)
+	if findErr != nil {
+		return mappings, localMountedDir, remoteStorageMountedLocation, nil, findErr
 	}
 
 	// find remote storage configuration
diff --git a/weed/filer/remote_storage_test.go b/weed/filer/remote_storage_test.go
index 04f12c7422..9ef2dd5e83 100644
--- a/weed/filer/remote_storage_test.go
+++ b/weed/filer/remote_storage_test.go
@@ -1,11 +1,14 @@
 package filer
 
 import (
+	"context"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 )
 
 func TestFilerRemoteStorage_FindRemoteStorageClient(t *testing.T) {
@@ -68,3 +71,61 @@ func TestFilerRemoteStorage_FindMountDirectory_LongestPrefixWins(t *testing.T) {
 		}
 	}
 }
+
+// TestLoadRemoteStorageConfigurationsAndMapping_RejectsBlockedEndpoint
+// reproduces the unauthenticated-plant SSRF: a RemoteConf whose S3 endpoint is
+// a loopback address is written under /etc/remote. With the SSRF deny-list
+// validator injected (as the filer server does), the conf is dropped at load
+// so the lazy-fetch path can never resolve a client for it; a conf whose
+// endpoint passes validation is loaded as before.
+func TestLoadRemoteStorageConfigurationsAndMapping_RejectsBlockedEndpoint(t *testing.T) {
+	loopbackConf := &remote_pb.RemoteConf{
+		Name:       "evil",
+		Type:       "s3",
+		S3Endpoint: "http://127.0.0.1:8000",
+		S3Region:   "us-east-1",
+	}
+	okConf := &remote_pb.RemoteConf{
+		Name:       "good",
+		Type:       "s3",
+		S3Endpoint: "https://s3.example.com",
+		S3Region:   "us-east-1",
+	}
+	loopbackBytes, _ := proto.Marshal(loopbackConf)
+	okBytes, _ := proto.Marshal(okConf)
+
+	store := newStubFilerStore()
+	store.entries[string(DirectoryEtcRemote)+"/evil.conf"] = &Entry{
+		FullPath: util.FullPath(string(DirectoryEtcRemote) + "/evil.conf"),
+		Attr:     Attr{Mode: 0644},
+		Content:  loopbackBytes,
+	}
+	store.entries[string(DirectoryEtcRemote)+"/good.conf"] = &Entry{
+		FullPath: util.FullPath(string(DirectoryEtcRemote) + "/good.conf"),
+		Attr:     Attr{Mode: 0644},
+		Content:  okBytes,
+	}
+
+	rs := NewFilerRemoteStorage()
+	// Validator mirrors the filer server injection: reject loopback endpoints.
+	rs.SetConfValidator(func(_ context.Context, conf *remote_pb.RemoteConf) error {
+		if conf.GetS3Endpoint() == "http://127.0.0.1:8000" {
+			return assertError("reject remote endpoint: loopback")
+		}
+		return nil
+	})
+	f := newTestFiler(t, store, rs)
+
+	require.NoError(t, f.RemoteStorage.LoadRemoteStorageConfigurationsAndMapping(f))
+
+	_, _, foundEvil := f.RemoteStorage.GetRemoteStorageClient("evil")
+	assert.False(t, foundEvil, "loopback-endpoint conf must be dropped at load")
+	_, _, foundGood := f.RemoteStorage.GetRemoteStorageClient("good")
+	assert.True(t, foundGood, "valid-endpoint conf must still be loaded")
+}
+
+// assertError is a tiny error type so the test validator can return a sentinel
+// without importing fmt.
+type assertError string
+
+func (e assertError) Error() string { return string(e) }
diff --git a/weed/filer/sqlite/sqlite_like_escape_test.go b/weed/filer/sqlite/sqlite_like_escape_test.go
new file mode 100644
index 0000000000..d2d39bf3ca
--- /dev/null
+++ b/weed/filer/sqlite/sqlite_like_escape_test.go
@@ -0,0 +1,75 @@
+//go:build sqlite
+
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/filer/mysql"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	_ "modernc.org/sqlite"
+)
+
+func TestListDirectoryPrefixedEntriesEscapesLikeWildcards(t *testing.T) {
+	db, err := sql.Open("sqlite", "file::memory:?cache=shared")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	_, err = db.Exec(`CREATE TABLE filemeta (dirhash BIGINT, name VARCHAR(1000), directory TEXT, meta BLOB, PRIMARY KEY (dirhash, name))`)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	store := &SqliteStore{}
+	store.SqlGenerator = &mysql.SqlGenMysql{}
+	store.DB = db
+
+	ctx := context.Background()
+	names := []string{
+		"call_03_KNlHPt6grkZMe4WZVwQi9710", // target: literal _ prefix
+		"callX03XKNlZZZ",                   // would match if _ were a wildcard
+		"call_99_other",
+		"100%_done", // % and _ in the name
+		"100aXdone", // would match prefix "100%_" if unescaped
+		"bang!file",
+	}
+	for _, n := range names {
+		entry := &filer.Entry{FullPath: util.FullPath("/dir/" + n)}
+		if err := store.InsertEntry(ctx, entry); err != nil {
+			t.Fatalf("insert %s: %v", n, err)
+		}
+	}
+
+	list := func(prefix string) []string {
+		var got []string
+		_, err := store.ListDirectoryPrefixedEntries(ctx, "/dir", "", false, 100, prefix, func(e *filer.Entry) (bool, error) {
+			got = append(got, e.Name())
+			return true, nil
+		})
+		if err != nil {
+			t.Fatalf("list %q: %v", prefix, err)
+		}
+		return got
+	}
+
+	if got := list("call_03_"); len(got) != 1 || got[0] != "call_03_KNlHPt6grkZMe4WZVwQi9710" {
+		t.Fatalf("prefix with _: got %v", got)
+	}
+	if got := list("call_"); len(got) != 2 {
+		t.Fatalf("prefix call_: got %v", got)
+	}
+	if got := list("100%_"); len(got) != 1 || got[0] != "100%_done" {
+		t.Fatalf("prefix with %%: got %v", got)
+	}
+	if got := list("bang!"); len(got) != 1 || got[0] != "bang!file" {
+		t.Fatalf("prefix with !: got %v", got)
+	}
+	if got := list(""); len(got) != len(names) {
+		t.Fatalf("empty prefix: got %v", got)
+	}
+}
diff --git a/weed/filer/sqlite/sqlite_store.go b/weed/filer/sqlite/sqlite_store.go
index 0e9fb73962..7a45ef83ca 100644
--- a/weed/filer/sqlite/sqlite_store.go
+++ b/weed/filer/sqlite/sqlite_store.go
@@ -8,6 +8,8 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"strings"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/filer/abstract_sql"
@@ -28,6 +30,31 @@ func (store *SqliteStore) GetName() string {
 	return "sqlite"
 }
 
+// sqliteSqlGen is the MySQL generator with SQLite's own page cursor: SQLite
+// seeks a row-value comparison on the primary key but scans the OR form.
+type sqliteSqlGen struct {
+	*mysql.SqlGenMysql
+}
+
+func (gen sqliteSqlGen) GetSqlScanPage(tableName string, dirhash int64, name string, limit int) (string, []interface{}) {
+	return fmt.Sprintf("SELECT `dirhash`, `name`, `directory`, `meta` FROM `%s` WHERE (`dirhash`, `name`) > (?, ?) ORDER BY `dirhash` ASC, `name` ASC LIMIT ?", tableName),
+		[]interface{}{dirhash, name, limit}
+}
+
+// ScanEntries offers the snapshot scan only in WAL mode: with a rollback
+// journal a long read transaction holds a shared lock and writers fail after
+// the busy timeout.
+func (store *SqliteStore) ScanEntries(ctx context.Context, dirPath util.FullPath, fn func(ctx context.Context, entry *filer.Entry) error) error {
+	var mode string
+	if err := store.DB.QueryRowContext(ctx, "PRAGMA journal_mode").Scan(&mode); err != nil {
+		return fmt.Errorf("%w: journal_mode: %v", filer.ErrUnsupportedEntryScan, err)
+	}
+	if !strings.EqualFold(mode, "wal") {
+		return fmt.Errorf("%w: sqlite journal_mode is %q, the scan needs wal", filer.ErrUnsupportedEntryScan, mode)
+	}
+	return store.AbstractSqlStore.ScanEntries(ctx, dirPath, fn)
+}
+
 func (store *SqliteStore) Initialize(configuration util.Configuration, prefix string) (err error) {
 	dbFile := configuration.GetString(prefix + "dbFile")
 	createTable := `CREATE TABLE IF NOT EXISTS "%s" (
@@ -49,30 +76,54 @@ func (store *SqliteStore) Initialize(configuration util.Configuration, prefix st
 	)
 }
 
+// sqliteDSN keeps the store's two pools on one database and lets a writer that
+// meets the other pool's reader wait for it instead of failing outright. A bare
+// :memory: is private to each connection, so it has to be named and shared.
+func sqliteDSN(dbFile string) string {
+	dsn := dbFile
+	if dsn == ":memory:" {
+		dsn = fmt.Sprintf("file:seaweedfs%d?mode=memory&cache=shared", time.Now().UnixNano())
+	}
+	separator := "?"
+	if strings.Contains(dsn, "?") {
+		separator = "&"
+	}
+	return dsn + separator + "_pragma=busy_timeout(10000)"
+}
+
 func (store *SqliteStore) initialize(dbFile, createTable, upsertQuery string) (err error) {
 
 	store.SupportBucketTable = true
-	store.SqlGenerator = &mysql.SqlGenMysql{
+	store.SqlGenerator = sqliteSqlGen{&mysql.SqlGenMysql{
 		CreateTableSqlTemplate: createTable,
 		DropTableSqlTemplate:   "drop table if exists `%s`",
 		UpsertQueryTemplate:    upsertQuery,
-	}
+	}}
 
-	var dbErr error
-	store.DB, dbErr = sql.Open("sqlite", dbFile)
+	dsn := sqliteDSN(dbFile)
+
+	db, dbErr := sql.Open("sqlite", dsn)
 	if dbErr != nil {
-		if store.DB != nil {
-			store.DB.Close()
-			store.DB = nil
+		if db != nil {
+			db.Close()
 		}
 		return fmt.Errorf("can not connect to %s error:%v", dbFile, dbErr)
 	}
 
-	if err = store.DB.Ping(); err != nil {
+	if err = db.Ping(); err != nil {
 		return fmt.Errorf("connect to %s error:%v", dbFile, err)
 	}
 
-	store.DB.SetMaxOpenConns(1)
+	if err = store.UseConnectionPools(db, func() (*sql.DB, error) {
+		return sql.Open("sqlite", dsn)
+	}, 1, 1, 0); err != nil {
+		return err
+	}
+	// The main pool is one connection, which a long scan must not hold.
+	if store.ScanDB, err = sql.Open("sqlite", dsn); err != nil {
+		return fmt.Errorf("open scan connection to %s: %v", dbFile, err)
+	}
+	store.ScanDB.SetMaxOpenConns(1)
 
 	if err = store.CreateTable(context.Background(), abstract_sql.DEFAULT_TABLE); err != nil {
 		return fmt.Errorf("init table %s: %v", abstract_sql.DEFAULT_TABLE, err)
diff --git a/weed/filer/sqlite/sqlite_store_scan_test.go b/weed/filer/sqlite/sqlite_store_scan_test.go
new file mode 100644
index 0000000000..b859229171
--- /dev/null
+++ b/weed/filer/sqlite/sqlite_store_scan_test.go
@@ -0,0 +1,288 @@
+//go:build (linux || darwin || windows) && sqlite
+
+package sqlite
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/filer/abstract_sql"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A rename committed while a scan is running is seen under exactly one of its
+// names. The scan reads from one snapshot, so unlike a directory walk it can
+// neither miss the entry when it moves into a directory already listed, nor
+// count it twice when it moves into one not listed yet.
+func TestScanEntriesSeesConcurrentRenameExactlyOnce(t *testing.T) {
+	dbFile := filepath.Join(t.TempDir(), "filer.db")
+	reader := &SqliteStore{}
+	if err := reader.initialize(dbFile, createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer reader.Shutdown()
+	// WAL lets the writer commit while the scan's read transaction is open.
+	if _, err := reader.DB.Exec("PRAGMA journal_mode=WAL"); err != nil {
+		t.Fatal(err)
+	}
+	writer := &SqliteStore{}
+	if err := writer.initialize(dbFile, createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer writer.Shutdown()
+
+	ctx := context.Background()
+	mk := func(p string) *filer.Entry {
+		return &filer.Entry{FullPath: util.FullPath(p), Attr: filer.Attr{Mode: 0644, Mtime: time.Now(), Crtime: time.Now()}}
+	}
+	for _, p := range []string{"/ckpt/a", "/ckpt/b", "/ckpt/tmp/x"} {
+		if err := reader.InsertEntry(ctx, mk(p)); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	defer func(n int) { abstract_sql.SetScanPageSizeForTest(n) }(abstract_sql.SetScanPageSizeForTest(2))
+
+	seen := map[string]int{}
+	renamed := false
+	err := reader.ScanEntries(ctx, "/", func(_ context.Context, e *filer.Entry) error {
+		seen[string(e.FullPath)]++
+		if renamed {
+			return nil
+		}
+		renamed = true
+		// /ckpt/tmp/x -> /ckpt/x, committed by another connection mid-scan.
+		if err := writer.InsertEntry(ctx, mk("/ckpt/x")); err != nil {
+			return err
+		}
+		return writer.DeleteEntry(ctx, util.FullPath("/ckpt/tmp/x"))
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !renamed {
+		t.Fatal("scan yielded nothing")
+	}
+	if seen["/ckpt/a"] != 1 || seen["/ckpt/b"] != 1 {
+		t.Errorf("untouched entries seen %d and %d times, want once each", seen["/ckpt/a"], seen["/ckpt/b"])
+	}
+	if old, new := seen["/ckpt/tmp/x"], seen["/ckpt/x"]; old+new != 1 {
+		t.Errorf("renamed entry seen %d time(s) under the old name and %d under the new, want exactly one in total", old, new)
+	} else if old != 1 {
+		t.Errorf("the rename committed after the snapshot was taken, so the scan must show the old name")
+	}
+	if _, err := reader.FindEntry(ctx, util.FullPath("/ckpt/x")); err != nil {
+		t.Errorf("once the scan is over the new name must be visible: %v", err)
+	}
+}
+
+// Rows that are not entries, key-value records and a regular file under
+// /buckets with a bucket-like name, are stepped over; a scan rooted at a bucket
+// yields the bucket's own row (default table) and its contents (bucket table).
+func TestScanEntriesRowsAndBucketTables(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(filepath.Join(t.TempDir(), "filer.db"), createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+	if _, err := store.DB.Exec("PRAGMA journal_mode=WAL"); err != nil {
+		t.Fatal(err)
+	}
+
+	ctx := context.Background()
+	now := time.Now()
+	// The filer creates bucket tables on bucket creation; the store layer alone does not.
+	if err := store.CreateTable(ctx, "realbucket"); err != nil {
+		t.Fatal(err)
+	}
+	for _, e := range []*filer.Entry{
+		{FullPath: "/buckets", Attr: filer.Attr{Mode: 0755 | os.ModeDir, Mtime: now, Crtime: now}},
+		{FullPath: "/buckets/realbucket", Attr: filer.Attr{Mode: 0755 | os.ModeDir, Mtime: now, Crtime: now}},
+		{FullPath: "/buckets/realbucket/f1", Attr: filer.Attr{Mode: 0644, Mtime: now, Crtime: now}},
+		{FullPath: "/buckets/readme", Attr: filer.Attr{Mode: 0644, Mtime: now, Crtime: now}},
+		{FullPath: "/topics/t1", Attr: filer.Attr{Mode: 0644, Mtime: now, Crtime: now}},
+	} {
+		if err := store.InsertEntry(ctx, e); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, key := range []string{"filer.store.id", "/looks/like/a/path", "x"} {
+		if err := store.KvPut(ctx, []byte(key), []byte("opaque value, not an Entry")); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	collect := func(root string) []string {
+		var got []string
+		if err := store.ScanEntries(ctx, util.FullPath(root), func(_ context.Context, e *filer.Entry) error {
+			got = append(got, string(e.FullPath))
+			return nil
+		}); err != nil {
+			t.Fatalf("scan %s: %v", root, err)
+		}
+		sort.Strings(got)
+		return got
+	}
+	if got, want := collect("/"), []string{"/buckets", "/buckets/readme", "/buckets/realbucket", "/buckets/realbucket/f1", "/topics/t1"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("scan /: got %v, want %v", got, want)
+	}
+	if got, want := collect("/buckets/realbucket"), []string{"/buckets/realbucket", "/buckets/realbucket/f1"}; !reflect.DeepEqual(got, want) {
+		t.Errorf("scan /buckets/realbucket: got %v, want %v", got, want)
+	}
+
+	// A bucket directory whose table does not exist fails the scan: from the
+	// snapshot it cannot be told from a table dropped a moment ago.
+	if err := store.InsertEntry(ctx, &filer.Entry{FullPath: "/buckets/ghostbucket", Attr: filer.Attr{Mode: 0755 | os.ModeDir, Mtime: now, Crtime: now}}); err != nil {
+		t.Fatal(err)
+	}
+	err := store.ScanEntries(ctx, "/", func(context.Context, *filer.Entry) error { return nil })
+	if err == nil || !strings.Contains(err.Error(), "ghostbucket") {
+		t.Fatalf("scan over a bucket without a table must fail naming it, got %v", err)
+	}
+}
+
+// Without WAL the store declines the scan rather than block writers for its
+// whole duration.
+func TestScanEntriesDeclinedWithoutWAL(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(filepath.Join(t.TempDir(), "filer.db"), createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+	err := store.ScanEntries(context.Background(), "/", func(context.Context, *filer.Entry) error { return nil })
+	if !errors.Is(err, filer.ErrUnsupportedEntryScan) {
+		t.Fatalf("err = %v, want ErrUnsupportedEntryScan", err)
+	}
+}
+
+// A store whose pool is one connection, and no scan connection of its own,
+// declines rather than hold that connection for the whole scan.
+func TestScanEntriesDeclinedOnSingleConnectionPool(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(filepath.Join(t.TempDir(), "filer.db"), createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+	if _, err := store.DB.Exec("PRAGMA journal_mode=WAL"); err != nil {
+		t.Fatal(err)
+	}
+	store.ScanDB.Close()
+	store.ScanDB = nil
+	err := store.ScanEntries(context.Background(), "/", func(context.Context, *filer.Entry) error { return nil })
+	if !errors.Is(err, filer.ErrUnsupportedEntryScan) {
+		t.Fatalf("err = %v, want ErrUnsupportedEntryScan", err)
+	}
+}
+
+// A hard-linked entry's chunks live in the shared key-value record, not in
+// its path row; the wrapper resolves them from inside the snapshot, on the
+// single connection the scan holds.
+func TestScanEntriesResolvesHardLinks(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(filepath.Join(t.TempDir(), "filer.db"), createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+	if _, err := store.DB.Exec("PRAGMA journal_mode=WAL"); err != nil {
+		t.Fatal(err)
+	}
+	wrapper := filer.NewFilerStoreWrapper(store)
+	ctx := context.Background()
+	now := time.Now()
+	linked := &filer.Entry{
+		FullPath:        "/buckets/hlbucket/f0001",
+		Attr:            filer.Attr{Mode: 0644, Mtime: now, Crtime: now},
+		HardLinkId:      filer.HardLinkId("hardlink-00000001"),
+		HardLinkCounter: 2,
+		Chunks:          []*filer_pb.FileChunk{{FileId: "3,01637037d6", Size: 4096}},
+	}
+	if err := wrapper.InsertEntry(ctx, linked); err != nil {
+		t.Fatal(err)
+	}
+
+	var got *filer.Entry
+	if err := wrapper.ScanEntries(ctx, "/", func(_ context.Context, e *filer.Entry) error {
+		if e.FullPath == linked.FullPath {
+			got = e
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if got == nil || len(got.GetChunks()) != 1 || got.GetChunks()[0].FileId != "3,01637037d6" || got.HardLinkCounter != 2 {
+		t.Fatalf("hard-linked entry not resolved from its key-value record: %+v", got)
+	}
+
+	// Once the record is gone the path row is all there is; the scan hands it
+	// over instead of failing on that entry every time it runs.
+	if err := store.KvDelete(ctx, []byte(linked.HardLinkId)); err != nil {
+		t.Fatal(err)
+	}
+	got = nil
+	if err := wrapper.ScanEntries(ctx, "/", func(_ context.Context, e *filer.Entry) error {
+		if e.FullPath == linked.FullPath {
+			got = e
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("a missing hard-link record must not fail the scan: %v", err)
+	}
+	if got == nil {
+		t.Fatal("entry with a missing hard-link record not handed over")
+	}
+}
+
+// The keyset page must be a primary-key seek; an OR-shaped cursor predicate
+// makes SQLite scan the table from the start for every page.
+func TestScanPageQuerySeeksPrimaryKey(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(filepath.Join(t.TempDir(), "filer.db"), createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+	sqlText, args := store.GetSqlScanPage("filemeta", int64(-1), "", 10)
+	rows, err := store.DB.Query("EXPLAIN QUERY PLAN "+sqlText, args...)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	var plan []string
+	for rows.Next() {
+		var id, parent, notused int
+		var detail string
+		if err := rows.Scan(&id, &parent, &notused, &detail); err != nil {
+			t.Fatal(err)
+		}
+		plan = append(plan, detail)
+	}
+	joined := strings.Join(plan, " | ")
+	if !strings.Contains(joined, "SEARCH") || strings.Contains(joined, "SCAN") {
+		t.Fatalf("page query does not seek the primary key: %s", joined)
+	}
+}
+
+// A bucket name only the process cache remembers may have its table dropped
+// meanwhile; the scan skips it instead of failing.
+func TestScanEntriesSkipsCachedOnlyBucketTable(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(filepath.Join(t.TempDir(), "filer.db"), createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+	if _, err := store.DB.Exec("PRAGMA journal_mode=WAL"); err != nil {
+		t.Fatal(err)
+	}
+	store.OnBucketCreation("gonebucket") // the table is never created
+	if err := store.ScanEntries(context.Background(), "/", func(context.Context, *filer.Entry) error { return nil }); err != nil {
+		t.Fatalf("cached-only bucket with a dropped table must not fail the scan: %v", err)
+	}
+}
diff --git a/weed/filer/sqlite/sqlite_store_test.go b/weed/filer/sqlite/sqlite_store_test.go
new file mode 100644
index 0000000000..2ada1e5bc4
--- /dev/null
+++ b/weed/filer/sqlite/sqlite_store_test.go
@@ -0,0 +1,92 @@
+//go:build (linux || darwin || windows) && sqlite
+
+package sqlite
+
+import (
+	"context"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+const (
+	createTableSql = `CREATE TABLE IF NOT EXISTS "%s" (dirhash BIGINT, name VARCHAR(1000), directory TEXT, meta BLOB, PRIMARY KEY (dirhash, name)) WITHOUT ROWID;`
+	upsertQuerySql = `INSERT INTO "%s"(dirhash,name,directory,meta)VALUES(?,?,?,?) ON CONFLICT(dirhash,name) DO UPDATE SET directory=excluded.directory, meta=excluded.meta;`
+)
+
+// A listing whose callback reads a hard link needs a second connection while it
+// still holds the one its rows are on, and the store allows exactly one.
+func TestListDirectoryOverHardLinkDoesNotDeadlock(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(filepath.Join(t.TempDir(), "filer.db"), createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+
+	wrapper := filer.NewFilerStoreWrapper(store)
+	ctx := context.Background()
+	entry := &filer.Entry{
+		FullPath:   util.FullPath("/buckets/hlbucket/f0001"),
+		Attr:       filer.Attr{Mode: 0644, Mtime: time.Now(), Crtime: time.Now()},
+		HardLinkId: filer.HardLinkId("hardlink-00000001"),
+	}
+	if err := wrapper.InsertEntry(ctx, entry); err != nil {
+		t.Fatal(err)
+	}
+
+	done := make(chan error, 1)
+	go func() {
+		_, err := wrapper.ListDirectoryEntries(ctx, util.FullPath("/buckets/hlbucket"), "", true, 10,
+			func(*filer.Entry) (bool, error) { return true, nil })
+		done <- err
+	}()
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Errorf("list: %v", err)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatalf("one listing over one hard-linked entry never returned: %+v", store.DB.Stats())
+	}
+}
+
+func TestSqliteDSN(t *testing.T) {
+	if got, want := sqliteDSN("/data/filer.db"), "/data/filer.db?_pragma=busy_timeout(10000)"; got != want {
+		t.Errorf("sqliteDSN = %q, want %q", got, want)
+	}
+	if got, want := sqliteDSN("file:/data/filer.db?cache=shared"), "file:/data/filer.db?cache=shared&_pragma=busy_timeout(10000)"; got != want {
+		t.Errorf("sqliteDSN with options = %q, want %q", got, want)
+	}
+	memory := sqliteDSN(":memory:")
+	if !strings.HasPrefix(memory, "file:seaweedfs") || !strings.Contains(memory, "mode=memory&cache=shared") ||
+		!strings.HasSuffix(memory, "&_pragma=busy_timeout(10000)") {
+		t.Errorf("sqliteDSN(:memory:) = %q, want a named shared-memory URI carrying the busy timeout", memory)
+	}
+}
+
+// Both pools have to open the same database: the table is created on one and
+// the key-value operations run on the other.
+func TestInMemoryStoreSharesOneDatabase(t *testing.T) {
+	store := &SqliteStore{}
+	if err := store.initialize(":memory:", createTableSql, upsertQuerySql); err != nil {
+		t.Fatal(err)
+	}
+	defer store.Shutdown()
+
+	ctx := context.Background()
+	key := []byte("hardlink-00000001")
+	if err := store.KvPut(ctx, key, []byte("value")); err != nil {
+		t.Fatalf("KvPut: %v", err)
+	}
+	value, err := store.KvGet(ctx, key)
+	if err != nil {
+		t.Fatalf("KvGet: %v", err)
+	}
+	if string(value) != "value" {
+		t.Errorf("KvGet = %q, want value", value)
+	}
+}
diff --git a/weed/filer/stream.go b/weed/filer/stream.go
index ec855be0b6..260c6f5c24 100644
--- a/weed/filer/stream.go
+++ b/weed/filer/stream.go
@@ -51,6 +51,18 @@ func JwtForVolumeServer(fileId string) string {
 	return string(security.GenJwtForVolumeServer(jwtSigningReadKey, jwtSigningReadKeyExpires, fileId))
 }
 
+// ChunkReadJwt returns the credential for reading fileId from urlStrings. A
+// lookup answers with the volume servers holding the needle or with a filer
+// proxying it, never a mix. A proxied chunk is a request to the filer, which
+// authorizes it and attaches the volume credential itself, so the token there
+// is a filer one.
+func ChunkReadJwt(urlStrings []string, fileId string) string {
+	if len(urlStrings) > 0 && util_http.IsProxyChunkUrl(urlStrings[0]) {
+		return util_http.JwtForFilerServer(false)
+	}
+	return JwtForVolumeServer(fileId)
+}
+
 func HasData(entry *filer_pb.Entry) bool {
 
 	if len(entry.Content) > 0 {
@@ -73,14 +85,16 @@ func isSameChunks(a, b []*filer_pb.FileChunk) bool {
 	if len(a) != len(b) {
 		return false
 	}
-	slices.SortFunc(a, func(i, j *filer_pb.FileChunk) int {
+	sortedA := slices.Clone(a)
+	sortedB := slices.Clone(b)
+	slices.SortFunc(sortedA, func(i, j *filer_pb.FileChunk) int {
 		return strings.Compare(i.ETag, j.ETag)
 	})
-	slices.SortFunc(b, func(i, j *filer_pb.FileChunk) int {
+	slices.SortFunc(sortedB, func(i, j *filer_pb.FileChunk) int {
 		return strings.Compare(i.ETag, j.ETag)
 	})
-	for i := 0; i < len(a); i++ {
-		if a[i].ETag != b[i].ETag {
+	for i := 0; i < len(sortedA); i++ {
+		if sortedA[i].ETag != sortedB[i].ETag {
 			return false
 		}
 	}
@@ -102,24 +116,23 @@ func PrepareStreamContent(masterClient wdclient.HasLookupFileIdFunction, jwtFunc
 
 type VolumeServerJwtFunction func(fileId string) string
 
-// urlSlicesEqual checks if two URL slices contain the same URLs (order-independent)
-func urlSlicesEqual(a, b []string) bool {
-	if len(a) != len(b) {
-		return false
+// refreshUrls lets a fetch loop relearn a chunk's locations inside a single
+// read: drop the cached entry and look it up again, whether every location
+// failed or one did while another answered. Nil when there is nothing to
+// invalidate against.
+func refreshUrls(ctx context.Context, invalidator CacheInvalidator, lookupFn wdclient.LookupFileIdFunctionType, fileId string) util_http.RefreshUrlsFunc {
+	if invalidator == nil || lookupFn == nil {
+		return nil
 	}
-	// Create a map to count occurrences in first slice
-	counts := make(map[string]int)
-	for _, url := range a {
-		counts[url]++
-	}
-	// Verify all URLs in second slice match
-	for _, url := range b {
-		if counts[url] == 0 {
-			return false
+	return func() []string {
+		invalidator.InvalidateCache(fileId)
+		urls, err := lookupFn(ctx, fileId)
+		if err != nil {
+			glog.V(0).InfofCtx(ctx, "re-lookup chunk %s: %v", fileId, err)
+			return nil
 		}
-		counts[url]--
+		return urls
 	}
-	return true
 }
 
 // retryFetchWithFreshLocations is the shared self-heal for the read paths: when a chunk fetch
@@ -127,6 +140,12 @@ func urlSlicesEqual(a, b []string) bool {
 // resolved locations actually changed (so we never retry against the same servers). originalErr
 // is returned unchanged when no retry is attempted, so callers surface the real fetch failure.
 func retryFetchWithFreshLocations(ctx context.Context, invalidator CacheInvalidator, lookupFn wdclient.LookupFileIdFunctionType, fileId string, oldUrls []string, originalErr error, refetch func(newUrls []string) error) error {
+	// the caller may have gone away between its own check and this one; a
+	// cancelled read is no evidence the locations are wrong, and callers such
+	// as volume.fsck tell an abort from real corruption with errors.Is
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		return ctxErr
+	}
 	if invalidator == nil {
 		return originalErr
 	}
@@ -143,7 +162,7 @@ func retryFetchWithFreshLocations(ctx context.Context, invalidator CacheInvalida
 		glog.WarningfCtx(ctx, "re-lookup for chunk %s returned no locations, skipping retry", fileId)
 		return fmt.Errorf("re-lookup chunk %s returned no locations", fileId)
 	}
-	if urlSlicesEqual(oldUrls, newUrls) {
+	if util_http.SameUrls(oldUrls, newUrls) {
 		glog.V(0).InfofCtx(ctx, "re-lookup returned same locations for chunk %s, skipping retry", fileId)
 		return originalErr
 	}
@@ -154,7 +173,11 @@ func retryFetchWithFreshLocations(ctx context.Context, invalidator CacheInvalida
 
 func PrepareStreamContentWithThrottler(ctx context.Context, masterClient wdclient.HasLookupFileIdFunction, jwtFunc VolumeServerJwtFunction, chunks []*filer_pb.FileChunk, offset int64, size int64, downloadMaxBytesPs int64) (DoStreamContent, error) {
 	glog.V(4).InfofCtx(ctx, "prepare to stream content for chunks: %d", len(chunks))
-	chunkViews := ViewFromChunks(ctx, masterClient.GetLookupFileIdFunction(), chunks, offset, size)
+	visibles, err := NonOverlappingVisibleIntervals(ctx, masterClient.GetLookupFileIdFunction(), chunks, offset, offset+size)
+	if err != nil {
+		return nil, err
+	}
+	chunkViews := ViewFromVisibleIntervals(visibles, offset, size)
 
 	fileId2Url := make(map[string][]string)
 
@@ -213,7 +236,8 @@ func PrepareStreamContentWithThrottler(ctx context.Context, masterClient wdclien
 			urlStrings := fileId2Url[chunkView.FileId]
 			start := time.Now()
 			jwt := jwtFunc(chunkView.FileId)
-			written, err := retriedStreamFetchChunkData(ctx, writer, urlStrings, jwt, chunkView.CipherKey, chunkView.IsGzipped, chunkView.IsFullChunk(), chunkView.OffsetInChunk, int(chunkView.ViewSize))
+			invalidator, _ := masterClient.(CacheInvalidator)
+			written, err := retriedStreamFetchChunkData(ctx, writer, urlStrings, jwt, chunkView.CipherKey, chunkView.IsGzipped, chunkView.IsFullChunk(), chunkView.OffsetInChunk, int(chunkView.ViewSize), refreshUrls(ctx, invalidator, masterClient.GetLookupFileIdFunction(), chunkView.FileId))
 
 			if err != nil && ctx.Err() != nil {
 				return ctx.Err()
@@ -221,9 +245,8 @@ func PrepareStreamContentWithThrottler(ctx context.Context, masterClient wdclien
 
 			// If read failed, try to invalidate cache and re-lookup
 			if err != nil && written == 0 {
-				invalidator, _ := masterClient.(CacheInvalidator)
 				err = retryFetchWithFreshLocations(ctx, invalidator, masterClient.GetLookupFileIdFunction(), chunkView.FileId, urlStrings, err, func(newUrls []string) error {
-					_, refetchErr := retriedStreamFetchChunkData(ctx, writer, newUrls, jwt, chunkView.CipherKey, chunkView.IsGzipped, chunkView.IsFullChunk(), chunkView.OffsetInChunk, int(chunkView.ViewSize))
+					_, refetchErr := retriedStreamFetchChunkData(ctx, writer, newUrls, jwt, chunkView.CipherKey, chunkView.IsGzipped, chunkView.IsFullChunk(), chunkView.OffsetInChunk, int(chunkView.ViewSize), nil)
 					if refetchErr == nil {
 						// Update the map so subsequent references use fresh URLs
 						fileId2Url[chunkView.FileId] = newUrls
@@ -268,7 +291,11 @@ func PrepareStreamContentWithPrefetch(ctx context.Context, masterClient wdclient
 	}
 
 	glog.V(4).InfofCtx(ctx, "prepare to stream content with prefetch=%d for chunks: %d", prefetchAhead, len(chunks))
-	chunkViews := ViewFromChunks(ctx, masterClient.GetLookupFileIdFunction(), chunks, offset, size)
+	visibles, err := NonOverlappingVisibleIntervals(ctx, masterClient.GetLookupFileIdFunction(), chunks, offset, offset+size)
+	if err != nil {
+		return nil, err
+	}
+	chunkViews := ViewFromVisibleIntervals(visibles, offset, size)
 
 	fileId2Url := make(map[string][]string)
 
@@ -352,15 +379,25 @@ type ChunkStreamReader struct {
 	bufferLock   sync.Mutex
 	chunk        string
 	lookupFileId wdclient.LookupFileIdFunctionType
+	sourceErr    error
 }
 
 var _ = io.ReadSeeker(&ChunkStreamReader{})
 var _ = io.ReaderAt(&ChunkStreamReader{})
 var _ = io.Closer(&ChunkStreamReader{})
 
+// doNewChunkStreamReader builds a reader over chunks. If their manifests cannot
+// be resolved, the reader fails every read with that error and reports it as its
+// SourceError.
 func doNewChunkStreamReader(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, chunks []*filer_pb.FileChunk) *ChunkStreamReader {
 
-	chunkViews := ViewFromChunks(ctx, lookupFileIdFn, chunks, 0, math.MaxInt64)
+	chunkViews, err := ViewFromChunks(ctx, lookupFileIdFn, chunks, 0, math.MaxInt64)
+	if err != nil {
+		return &ChunkStreamReader{
+			lookupFileId: lookupFileIdFn,
+			sourceErr:    err,
+		}
+	}
 
 	var totalSize int64
 	for x := chunkViews.Front(); x != nil; x = x.Next {
@@ -378,11 +415,7 @@ func doNewChunkStreamReader(ctx context.Context, lookupFileIdFn wdclient.LookupF
 
 func NewChunkStreamReaderFromFiler(ctx context.Context, masterClient *wdclient.MasterClient, chunks []*filer_pb.FileChunk) *ChunkStreamReader {
 
-	lookupFileIdFn := func(ctx context.Context, fileId string) (targetUrl []string, err error) {
-		return masterClient.LookupFileId(ctx, fileId)
-	}
-
-	return doNewChunkStreamReader(ctx, lookupFileIdFn, chunks)
+	return doNewChunkStreamReader(ctx, masterClient.GetLookupFileIdFunction(), chunks)
 }
 
 // NewChunkStreamReaderFromLookup creates a ChunkStreamReader from a lookup function.
@@ -459,6 +492,10 @@ func insideChunk(offset int64, chunk *ChunkView) bool {
 }
 
 func (c *ChunkStreamReader) prepareBufferFor(offset int64) (err error) {
+	// a reader without chunk views has a source error only if ViewFromChunks failed
+	if c.head == nil && c.sourceErr != nil {
+		return c.sourceErr
+	}
 	// stay in the same chunk
 	if c.bufferOffset <= offset && offset < c.bufferOffset+int64(len(c.buffer)) {
 		return nil
@@ -490,13 +527,13 @@ func (c *ChunkStreamReader) fetchChunkToBuffer(chunkView *ChunkView) error {
 	urlStrings, err := c.lookupFileId(context.Background(), chunkView.FileId)
 	if err != nil {
 		glog.V(1).Infof("operation LookupFileId %s failed, err: %v", chunkView.FileId, err)
-		return err
+		return c.rememberSourceError(err)
 	}
 	var buffer bytes.Buffer
 	// pre-size to the known chunk size; avoids bytes.Buffer's doubling regrowth
 	buffer.Grow(int(chunkView.ViewSize))
 	var shouldRetry bool
-	jwt := JwtForVolumeServer(chunkView.FileId)
+	jwt := ChunkReadJwt(urlStrings, chunkView.FileId)
 	for _, urlString := range urlStrings {
 		shouldRetry, err = util_http.ReadUrlAsStream(context.Background(), util_http.AppendQueryParameter(urlString, "readDeleted", "true"), jwt, chunkView.CipherKey, chunkView.IsGzipped, chunkView.IsFullChunk(), chunkView.OffsetInChunk, int(chunkView.ViewSize), func(data []byte) {
 			buffer.Write(data)
@@ -512,7 +549,7 @@ func (c *ChunkStreamReader) fetchChunkToBuffer(chunkView *ChunkView) error {
 		}
 	}
 	if err != nil {
-		return err
+		return c.rememberSourceError(err)
 	}
 	c.buffer = buffer.Bytes()
 	c.bufferOffset = chunkView.ViewOffset
@@ -523,6 +560,28 @@ func (c *ChunkStreamReader) fetchChunkToBuffer(chunkView *ChunkView) error {
 	return nil
 }
 
+func (c *ChunkStreamReader) rememberSourceError(err error) error {
+	if c.sourceErr == nil {
+		c.sourceErr = err
+	}
+	return err
+}
+
+// SourceError returns the first lookup or chunk read failure, or nil.
+func (c *ChunkStreamReader) SourceError() error {
+	c.bufferLock.Lock()
+	defer c.bufferLock.Unlock()
+	return c.sourceErr
+}
+
+// ReaderSourceError returns the SourceError of a reader from NewFileReader, or nil.
+func ReaderSourceError(r io.Reader) error {
+	if csr, ok := r.(*ChunkStreamReader); ok {
+		return csr.SourceError()
+	}
+	return nil
+}
+
 func (c *ChunkStreamReader) Close() error {
 	c.bufferLock.Lock()
 	defer c.bufferLock.Unlock()
diff --git a/weed/filer/stream_from_filer_lookup_test.go b/weed/filer/stream_from_filer_lookup_test.go
new file mode 100644
index 0000000000..51d604a4a6
--- /dev/null
+++ b/weed/filer/stream_from_filer_lookup_test.go
@@ -0,0 +1,101 @@
+package filer
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+)
+
+// lookupOnlyMaster announces no volumes on KeepConnected, so the client's
+// cache stays empty, but answers LookupVolume with the one volume server.
+type lookupOnlyMaster struct {
+	master_pb.UnimplementedSeaweedServer
+	volumeUrl string
+}
+
+func (m *lookupOnlyMaster) KeepConnected(stream master_pb.Seaweed_KeepConnectedServer) error {
+	if _, err := stream.Recv(); err != nil {
+		return err
+	}
+	if err := stream.Send(&master_pb.KeepConnectedResponse{}); err != nil {
+		return err
+	}
+	<-stream.Context().Done()
+	return nil
+}
+
+func (m *lookupOnlyMaster) LookupVolume(ctx context.Context, req *master_pb.LookupVolumeRequest) (*master_pb.LookupVolumeResponse, error) {
+	resp := &master_pb.LookupVolumeResponse{}
+	for _, id := range req.VolumeOrFileIds {
+		resp.VolumeIdLocations = append(resp.VolumeIdLocations, &master_pb.LookupVolumeResponse_VolumeIdLocation{
+			VolumeOrFileId: id,
+			Locations:      []*master_pb.Location{{Url: m.volumeUrl, PublicUrl: m.volumeUrl}},
+		})
+	}
+	return resp, nil
+}
+
+// A filer's cached volume map can lose a volume that still exists: a failed
+// read invalidates every cached location of it, and the master only announces
+// changes. Readers built from the filer's MasterClient must then ask the master
+// instead of failing until the process restarts.
+func TestChunkStreamReaderFromFilerAsksMasterOnCacheMiss(t *testing.T) {
+	content := []byte("metadata log chunk")
+	volume := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write(content)
+	}))
+	t.Cleanup(volume.Close)
+
+	master := &lookupOnlyMaster{volumeUrl: strings.TrimPrefix(volume.URL, "http://")}
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcServer := grpc.NewServer()
+	master_pb.RegisterSeaweedServer(grpcServer, master)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+	_, port, err := net.SplitHostPort(lis.Addr().String())
+	if err != nil {
+		t.Fatalf("split listener address: %v", err)
+	}
+
+	mc := wdclient.NewMasterClient(
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		"", cluster.FilerType, pb.ServerAddress("localhost:0"), "", "",
+		*pb.NewServiceDiscoveryFromMap(map[string]pb.ServerAddress{"m": pb.ServerAddress(fmt.Sprintf("127.0.0.1:0.%s", port))}),
+	)
+	connecting, stopConnecting := context.WithCancel(context.Background())
+	t.Cleanup(stopConnecting)
+	go mc.KeepConnectedToMaster(connecting)
+	waiting, cancelWaiting := context.WithTimeout(context.Background(), 20*time.Second)
+	defer cancelWaiting()
+	mc.WaitUntilConnected(waiting)
+	if waiting.Err() != nil {
+		t.Fatal("the master client never connected to the fake master")
+	}
+
+	chunks := []*filer_pb.FileChunk{{FileId: "1,0123456789", Offset: 0, Size: uint64(len(content))}}
+	got, err := io.ReadAll(NewChunkStreamReaderFromFiler(context.Background(), mc, chunks))
+	if err != nil {
+		t.Fatalf("read with volume 1 missing from the cache: %v", err)
+	}
+	if string(got) != string(content) {
+		t.Fatalf("read %q, want %q", got, content)
+	}
+}
diff --git a/weed/filer/stream_jwt_test.go b/weed/filer/stream_jwt_test.go
new file mode 100644
index 0000000000..0b09eb2a11
--- /dev/null
+++ b/weed/filer/stream_jwt_test.go
@@ -0,0 +1,43 @@
+package filer
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A chunk read through a filer is a request to the filer, so it carries a filer
+// token; a read straight from the volume server holding the needle carries a
+// volume token scoped to that file id. Sending the wrong one is not a
+// degradation but a 401, so the two must not be confused.
+func TestChunkReadJwt(t *testing.T) {
+	const (
+		volumeReadKey = "volume-read-key"
+		filerReadKey  = "filer-read-key"
+		fileId        = "3,01637037d6"
+	)
+	util.GetViper().Set("jwt.filer_signing.read.key", filerReadKey)
+	loadJwtConfigOnce.Do(func() {})
+	previousKey, previousExpires := jwtSigningReadKey, jwtSigningReadKeyExpires
+	t.Cleanup(func() { jwtSigningReadKey, jwtSigningReadKeyExpires = previousKey, previousExpires })
+	jwtSigningReadKey, jwtSigningReadKeyExpires = security.SigningKey(volumeReadKey), 60
+
+	t.Run("through a filer", func(t *testing.T) {
+		token := security.EncodedJwt(ChunkReadJwt([]string{"http://filer:8888/?proxyChunkId=" + fileId}, fileId))
+		if _, err := security.DecodeJwt(security.SigningKey(filerReadKey), token, &security.SeaweedFilerClaims{}); err != nil {
+			t.Fatalf("token does not validate against the filer read key: %v", err)
+		}
+	})
+
+	t.Run("straight to a volume server", func(t *testing.T) {
+		token := security.EncodedJwt(ChunkReadJwt([]string{"http://volume:8080/" + fileId}, fileId))
+		claims := &security.SeaweedFileIdClaims{}
+		if _, err := security.DecodeJwt(security.SigningKey(volumeReadKey), token, claims); err != nil {
+			t.Fatalf("token does not validate against the volume read key: %v", err)
+		}
+		if claims.Fid != fileId {
+			t.Fatalf("token authorizes file %q, want %q", claims.Fid, fileId)
+		}
+	})
+}
diff --git a/weed/filer/stream_manifest_error_test.go b/weed/filer/stream_manifest_error_test.go
new file mode 100644
index 0000000000..2a2e5e5172
--- /dev/null
+++ b/weed/filer/stream_manifest_error_test.go
@@ -0,0 +1,26 @@
+package filer
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+)
+
+// Stream preparation must fail when chunk manifest resolution fails, instead of serving a zero-filled stream.
+func TestPrepareStreamContent_ManifestResolveFailure(t *testing.T) {
+	master := &testMasterClient{}
+
+	chunks := []*filer_pb.FileChunk{
+		{FileId: "1,1879011dc64abd40", IsChunkManifest: true, Offset: 0, Size: 1 << 20},
+	}
+
+	_, err := PrepareStreamContentWithThrottler(context.Background(), master, noopJwt, chunks, 0, 1<<20, 0)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "fail to read manifest")
+
+	_, err = PrepareStreamContentWithPrefetch(context.Background(), master, noopJwt, chunks, 0, 1<<20, 0, 4)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "fail to read manifest")
+}
diff --git a/weed/filer/stream_prefetch.go b/weed/filer/stream_prefetch.go
index 33d01be25c..3d6bed09f9 100644
--- a/weed/filer/stream_prefetch.go
+++ b/weed/filer/stream_prefetch.go
@@ -10,6 +10,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 	"github.com/seaweedfs/seaweedfs/weed/util/mem"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 )
@@ -46,6 +47,7 @@ func streamChunksPrefetched(
 	prefetchAhead int,
 ) error {
 	downloadThrottler := util.NewWriteThrottler(downloadMaxBytesPs)
+	invalidator, _ := masterClient.(CacheInvalidator)
 
 	// Create a local cancellable context so the consumer can stop the producer
 	// and all in-flight fetch goroutines on error (e.g., client disconnect).
@@ -98,14 +100,14 @@ func streamChunksPrefetched(
 			}
 
 			// Launch fetch goroutine
-			go func(cv *ChunkView, urls []string, jwt string, pw *io.PipeWriter, res *chunkPipeResult) {
+			go func(cv *ChunkView, urls []string, jwt string, pw *io.PipeWriter, res *chunkPipeResult, refresh util_http.RefreshUrlsFunc) {
 				defer func() { <-sem }() // release semaphore
 				defer close(res.done)
 
 				written, err := retriedStreamFetchChunkData(
 					localCtx, pw, urls, jwt,
 					cv.CipherKey, cv.IsGzipped, cv.IsFullChunk(),
-					cv.OffsetInChunk, int(cv.ViewSize),
+					cv.OffsetInChunk, int(cv.ViewSize), refresh,
 				)
 				res.written = written
 				res.fetchErr = err
@@ -115,7 +117,7 @@ func streamChunksPrefetched(
 				} else {
 					pw.Close()
 				}
-			}(chunkView, urlStrings, jwt, pw, result)
+			}(chunkView, urlStrings, jwt, pw, result, refreshUrls(localCtx, invalidator, masterClient.GetLookupFileIdFunction(), chunkView.FileId))
 
 			// Send result to consumer (blocks if channel full, back-pressuring producer)
 			select {
@@ -247,7 +249,7 @@ func retryWithCacheInvalidation(
 		_, err := retriedStreamFetchChunkData(
 			ctx, writer, newUrls, jwt,
 			chunkView.CipherKey, chunkView.IsGzipped, chunkView.IsFullChunk(),
-			chunkView.OffsetInChunk, int(chunkView.ViewSize),
+			chunkView.OffsetInChunk, int(chunkView.ViewSize), nil,
 		)
 		return err
 	})
diff --git a/weed/filer/stream_source_error_test.go b/weed/filer/stream_source_error_test.go
new file mode 100644
index 0000000000..cf6cb98be9
--- /dev/null
+++ b/weed/filer/stream_source_error_test.go
@@ -0,0 +1,55 @@
+package filer
+
+import (
+	"context"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+func TestChunkStreamReaderSourceError(t *testing.T) {
+	server := createTestServer(map[string][]byte{})
+	defer server.Close()
+
+	lookup := func(ctx context.Context, fileId string) ([]string, error) {
+		return []string{server.URL + "/" + fileId}, nil
+	}
+	reader := NewChunkStreamReaderFromLookup(context.Background(), lookup,
+		[]*filer_pb.FileChunk{{FileId: "7,01637037d6", Size: 8}})
+
+	if _, err := io.ReadAll(reader); err == nil {
+		t.Fatal("reading a gone chunk succeeded")
+	}
+	sourceErr := reader.SourceError()
+	if sourceErr == nil {
+		t.Fatal("reader kept no source error")
+	}
+	if !strings.Contains(sourceErr.Error(), "404") {
+		t.Fatalf("source error does not name the volume answer: %v", sourceErr)
+	}
+	if ReaderSourceError(reader) != sourceErr {
+		t.Fatal("ReaderSourceError does not return the kept error")
+	}
+}
+
+func TestChunkStreamReaderSourceErrorOnLookup(t *testing.T) {
+	master := &testMasterClient{urls: map[string][]string{}}
+	reader := NewChunkStreamReaderFromLookup(context.Background(), master.GetLookupFileIdFunction(),
+		[]*filer_pb.FileChunk{{FileId: "7,01637037d6", Size: 8}})
+
+	if _, err := io.ReadAll(reader); err == nil {
+		t.Fatal("reading a chunk with no location succeeded")
+	}
+	if reader.SourceError() == nil {
+		t.Fatal("reader kept no source error")
+	}
+}
+
+func TestReaderSourceErrorInlineEntry(t *testing.T) {
+	reader := NewFileReader(nil, &filer_pb.Entry{Content: []byte("inline")})
+	if err := ReaderSourceError(reader); err != nil {
+		t.Fatalf("inline content reported a source error: %v", err)
+	}
+}
diff --git a/weed/filer/stream_test.go b/weed/filer/stream_test.go
new file mode 100644
index 0000000000..ec3aba337e
--- /dev/null
+++ b/weed/filer/stream_test.go
@@ -0,0 +1,28 @@
+package filer
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+)
+
+// IsSameData must not reorder the caller's chunk slices: filer.remote.sync
+// stamps the filer entry an event described under an IF_ENTRY_EQUAL guard,
+// and an in-place sort leaves the event entry ordered differently from the
+// stored one, so the stamp never matches.
+func TestIsSameDataLeavesChunkOrderAlone(t *testing.T) {
+	chunkA := &filer_pb.FileChunk{FileId: "1,aaa", ETag: "zzzz", Size: 4}
+	chunkB := &filer_pb.FileChunk{FileId: "2,bbb", ETag: "aaaa", Size: 2}
+	a := &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{chunkA, chunkB}}
+	b := &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+		{FileId: "3,ccc", ETag: "zzzz", Size: 4},
+		{FileId: "4,ddd", ETag: "aaaa", Size: 2},
+	}}
+
+	assert.True(t, IsSameData(a, b))
+	assert.Equal(t, "1,aaa", a.Chunks[0].FileId)
+	assert.Equal(t, "2,bbb", a.Chunks[1].FileId)
+	assert.Equal(t, "3,ccc", b.Chunks[0].FileId)
+	assert.Equal(t, "4,ddd", b.Chunks[1].FileId)
+}
diff --git a/weed/filer/tarantool/tarantool_store.go b/weed/filer/tarantool/tarantool_store.go
index 5094c8e242..54a6647b2d 100644
--- a/weed/filer/tarantool/tarantool_store.go
+++ b/weed/filer/tarantool/tarantool_store.go
@@ -143,7 +143,7 @@ func (store *TarantoolStore) InsertEntry(ctx context.Context, entry *filer.Entry
 
 	var operations = []crud.Operation{
 		{
-			Operator: crud.Insert,
+			Operator: crud.Assign,
 			Field:    "data",
 			Value:    string(meta),
 		},
@@ -151,7 +151,8 @@ func (store *TarantoolStore) InsertEntry(ctx context.Context, entry *filer.Entry
 
 	req := crud.NewUpsertRequest(tarantoolSpaceName).
 		Tuple([]interface{}{dir, nil, name, ttl, string(meta)}).
-		Operations(operations)
+		Operations(operations).
+		Context(ctx)
 
 	ret := crud.Result{}
 
@@ -178,7 +179,8 @@ func (store *TarantoolStore) FindEntry(ctx context.Context, fullpath weed_util.F
 
 	req := crud.NewGetRequest(tarantoolSpaceName).
 		Key([]interface{}{dir, name}).
-		Opts(findEntryGetOpts)
+		Opts(findEntryGetOpts).
+		Context(ctx)
 
 	resp := crud.Result{}
 
@@ -223,7 +225,8 @@ func (store *TarantoolStore) DeleteEntry(ctx context.Context, fullpath weed_util
 
 	req := crud.NewDeleteRequest(tarantoolSpaceName).
 		Key([]interface{}{dir, name}).
-		Opts(delOpts)
+		Opts(delOpts).
+		Context(ctx)
 
 	if _, err := store.pool.Do(req, pool.ModeRW).Get(); err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
@@ -234,7 +237,8 @@ func (store *TarantoolStore) DeleteEntry(ctx context.Context, fullpath weed_util
 
 func (store *TarantoolStore) DeleteFolderChildren(ctx context.Context, fullpath weed_util.FullPath) (err error) {
 	req := tarantool.NewCallRequest("filer_metadata.delete_by_directory_idx").
-		Args([]interface{}{fullpath})
+		Args([]interface{}{fullpath}).
+		Context(ctx)
 
 	if _, err := store.pool.Do(req, pool.ModeRW).Get(); err != nil {
 		return fmt.Errorf("delete %s : %v", fullpath, err)
@@ -250,7 +254,8 @@ func (store *TarantoolStore) ListDirectoryPrefixedEntries(ctx context.Context, d
 func (store *TarantoolStore) ListDirectoryEntries(ctx context.Context, dirPath weed_util.FullPath, startFileName string, includeStartFile bool, limit int64, eachEntryFunc filer.ListEachEntryFunc) (lastFileName string, err error) {
 
 	req := tarantool.NewCallRequest("filer_metadata.find_by_directory_idx_and_name").
-		Args([]interface{}{string(dirPath), startFileName, includeStartFile, limit})
+		Args([]interface{}{string(dirPath), startFileName, includeStartFile, limit}).
+		Context(ctx)
 
 	results, err := store.pool.Do(req, pool.ModePreferRO).Get()
 	if err != nil {
diff --git a/weed/filer/tarantool/tarantool_store_kv.go b/weed/filer/tarantool/tarantool_store_kv.go
index 4123cb2ab8..6819360baf 100644
--- a/weed/filer/tarantool/tarantool_store_kv.go
+++ b/weed/filer/tarantool/tarantool_store_kv.go
@@ -21,7 +21,7 @@ func (store *TarantoolStore) KvPut(ctx context.Context, key []byte, value []byte
 
 	var operations = []crud.Operation{
 		{
-			Operator: crud.Insert,
+			Operator: crud.Assign,
 			Field:    "value",
 			Value:    string(value),
 		},
@@ -29,7 +29,8 @@ func (store *TarantoolStore) KvPut(ctx context.Context, key []byte, value []byte
 
 	req := crud.NewUpsertRequest(tarantoolKVSpaceName).
 		Tuple([]interface{}{string(key), nil, string(value)}).
-		Operations(operations)
+		Operations(operations).
+		Context(ctx)
 
 	ret := crud.Result{}
 	if err := store.pool.Do(req, pool.ModeRW).GetTyped(&ret); err != nil {
@@ -50,7 +51,8 @@ func (store *TarantoolStore) KvGet(ctx context.Context, key []byte) (value []byt
 
 	req := crud.NewGetRequest(tarantoolKVSpaceName).
 		Key([]interface{}{string(key)}).
-		Opts(getOpts)
+		Opts(getOpts).
+		Context(ctx)
 
 	resp := crud.Result{}
 
@@ -85,7 +87,8 @@ func (store *TarantoolStore) KvDelete(ctx context.Context, key []byte) (err erro
 
 	req := crud.NewDeleteRequest(tarantoolKVSpaceName).
 		Key([]interface{}{string(key)}).
-		Opts(delOpts)
+		Opts(delOpts).
+		Context(ctx)
 
 	if _, err := store.pool.Do(req, pool.ModeRW).Get(); err != nil {
 		return fmt.Errorf("kv delete: %w", err)
diff --git a/weed/filer/ydb/ydb_queries.go b/weed/filer/ydb/ydb_queries.go
index 1118cceb64..2b57a069cc 100644
--- a/weed/filer/ydb/ydb_queries.go
+++ b/weed/filer/ydb/ydb_queries.go
@@ -55,7 +55,7 @@ const (
 		
 		SELECT name, meta
 		FROM ` + asql.DEFAULT_TABLE + `
-		WHERE dir_hash = $dir_hash AND directory = $directory and name > $start_name and name LIKE $prefix
+		WHERE dir_hash = $dir_hash AND directory = $directory and name > $start_name and name LIKE $prefix ESCAPE '!'
 		ORDER BY name ASC LIMIT $limit;`
 
 	listInclusiveDirectoryQuery = `
@@ -68,6 +68,6 @@ const (
 		
 		SELECT name, meta
 		FROM ` + asql.DEFAULT_TABLE + `
-		WHERE dir_hash = $dir_hash AND directory = $directory and name >= $start_name and name LIKE $prefix
+		WHERE dir_hash = $dir_hash AND directory = $directory and name >= $start_name and name LIKE $prefix ESCAPE '!'
 		ORDER BY name ASC LIMIT $limit;`
 )
diff --git a/weed/filer/ydb/ydb_store.go b/weed/filer/ydb/ydb_store.go
index e5d14b5ff4..459c6d2b72 100644
--- a/weed/filer/ydb/ydb_store.go
+++ b/weed/filer/ydb/ydb_store.go
@@ -288,7 +288,7 @@ func (store *YdbStore) ListDirectoryPrefixedEntries(ctx context.Context, dirPath
 			table.ValueParam("$dir_hash", types.Int64Value(util.HashStringToLong(*shortDir))),
 			table.ValueParam("$directory", types.UTF8Value(*shortDir)),
 			table.ValueParam("$start_name", types.UTF8Value(startFileName)),
-			table.ValueParam("$prefix", types.UTF8Value(prefix+"%")),
+			table.ValueParam("$prefix", types.UTF8Value(abstract_sql.LikePattern(prefix))),
 			table.ValueParam("$limit", types.Uint64Value(uint64(chunkLimit))),
 		)
 
diff --git a/weed/filer/zip_extract.go b/weed/filer/zip_extract.go
new file mode 100644
index 0000000000..28096884be
--- /dev/null
+++ b/weed/filer/zip_extract.go
@@ -0,0 +1,123 @@
+package filer
+
+import (
+	"archive/zip"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const (
+	// ZipExtractMaxMembers bounds how many members one archive write fans out to.
+	ZipExtractMaxMembers = 100000
+	// ZipExtractMaxBytes bounds the total uncompressed bytes one archive may declare.
+	ZipExtractMaxBytes = int64(1) << 40 // 1 TiB
+
+	// ZipExtractMaxArchiveBytes bounds the compressed bytes one archive may
+	// spool to local disk when the caller passes no tighter limit. It matches
+	// the TUS default max upload size.
+	ZipExtractMaxArchiveBytes = int64(5) << 30 // 5 GiB
+
+)
+
+// zipSpoolMemoryLimit caps how much of one archive is buffered in memory
+// before the spool falls through to a temp file. It is a var rather than a
+// const so tests can shrink it: exercising the temp-file path with the real
+// 32 MiB threshold allocates hundreds of MiB, which tips the 32-bit test
+// binary over its 4 GiB address space.
+var zipSpoolMemoryLimit int64 = 32 << 20 // 32 MiB
+
+// ErrZipTooLarge marks a spool failure caused by the archive exceeding the
+// caller's size limit, so handlers can answer 4xx instead of 5xx.
+var ErrZipTooLarge = errors.New("zip archive too large")
+
+// SpoolZipReader buffers r into a seekable source for zip.NewReader: memory for
+// small archives, a temp file otherwise. At most maxArchiveBytes are buffered;
+// a non-positive limit falls back to ZipExtractMaxArchiveBytes. The returned
+// cleanup releases the spool.
+func SpoolZipReader(r io.Reader, maxArchiveBytes int64) (ra io.ReaderAt, n int64, cleanup func(), err error) {
+	nop := func() {}
+	if maxArchiveBytes <= 0 {
+		maxArchiveBytes = ZipExtractMaxArchiveBytes
+	}
+	head, err := io.ReadAll(io.LimitReader(r, zipSpoolMemoryLimit+1))
+	if err != nil {
+		return nil, 0, nop, err
+	}
+	if int64(len(head)) > maxArchiveBytes {
+		return nil, 0, nop, fmt.Errorf("%w: exceeds %d bytes", ErrZipTooLarge, maxArchiveBytes)
+	}
+	if int64(len(head)) <= zipSpoolMemoryLimit {
+		return bytes.NewReader(head), int64(len(head)), nop, nil
+	}
+	f, err := os.CreateTemp("", "seaweedfs-extract-*.zip")
+	if err != nil {
+		return nil, 0, nop, err
+	}
+	cleanup = func() {
+		name := f.Name()
+		f.Close()
+		os.Remove(name)
+	}
+	if _, err = f.Write(head); err == nil {
+		var rest int64
+		// One byte past the limit so an oversized archive errors out instead
+		// of being silently truncated.
+		if rest, err = io.Copy(f, io.LimitReader(r, maxArchiveBytes+1-int64(len(head)))); err == nil {
+			n = int64(len(head)) + rest
+		}
+	}
+	if err == nil && n > maxArchiveBytes {
+		err = fmt.Errorf("%w: exceeds %d bytes", ErrZipTooLarge, maxArchiveBytes)
+	}
+	if err != nil {
+		cleanup()
+		return nil, 0, nop, err
+	}
+	return f, n, cleanup, nil
+}
+
+// CheckZipLimits enforces the member-count and total-size caps on an opened archive.
+func CheckZipLimits(zr *zip.Reader) error {
+	if len(zr.File) > ZipExtractMaxMembers {
+		return fmt.Errorf("zip archive has %d members, limit %d", len(zr.File), ZipExtractMaxMembers)
+	}
+	var total uint64
+	for _, f := range zr.File {
+		if f.UncompressedSize64 > uint64(ZipExtractMaxBytes)-total {
+			return fmt.Errorf("zip archive uncompressed size exceeds %d bytes", ZipExtractMaxBytes)
+		}
+		total += f.UncompressedSize64
+	}
+	return nil
+}
+
+// SanitizeZipMemberName converts a zip member name into a relative filer path.
+// ok=false means the member must be skipped: absolute or escaping paths,
+// non-regular files such as symlinks and devices.
+func SanitizeZipMemberName(f *zip.File) (name string, ok bool) {
+	mode := f.FileInfo().Mode()
+	if mode&(os.ModeSymlink|os.ModeDevice|os.ModeNamedPipe|os.ModeSocket) != 0 {
+		return "", false
+	}
+	name = strings.TrimSuffix(strings.ReplaceAll(f.Name, "\\", "/"), "/")
+	if name == "" || strings.HasPrefix(name, "/") {
+		return "", false
+	}
+	for _, seg := range strings.Split(name, "/") {
+		if seg == "" || seg == "." || seg == ".." || strings.ContainsRune(seg, '\x00') {
+			return "", false
+		}
+	}
+	// filepath.IsLocal is the check static analysis recognizes: no element may
+	// be "." or "..", the path may not be absolute or empty, and on Windows it
+	// may not be a reserved name.
+	if !filepath.IsLocal(name) {
+		return "", false
+	}
+	return name, true
+}
diff --git a/weed/filer/zip_extract_test.go b/weed/filer/zip_extract_test.go
new file mode 100644
index 0000000000..89fd273cc6
--- /dev/null
+++ b/weed/filer/zip_extract_test.go
@@ -0,0 +1,166 @@
+package filer
+
+import (
+	"archive/zip"
+	"bytes"
+	"io"
+	"math"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+func zipFile(t *testing.T, name string, mode os.FileMode) *zip.File {
+	t.Helper()
+	h := &zip.FileHeader{Name: name, Method: zip.Store, Modified: time.Unix(1700000000, 0)}
+	h.SetMode(mode)
+	return &zip.File{FileHeader: *h}
+}
+
+func TestSanitizeZipMemberName(t *testing.T) {
+	tests := []struct {
+		name string
+		mode os.FileMode
+		want string
+		ok   bool
+	}{
+		{"a.png", 0644, "a.png", true},
+		{"dir/b.txt", 0644, "dir/b.txt", true},
+		{"dir\\b.txt", 0644, "dir/b.txt", true},
+		{"dir/", os.ModeDir | 0755, "dir", true},
+		{"../escape.txt", 0644, "", false},
+		{"a/../b.txt", 0644, "", false},
+		{"./dot.txt", 0644, "", false},
+		{"/abs.txt", 0644, "", false},
+		{"a//b.txt", 0644, "", false},
+		{"", 0644, "", false},
+		{"link.txt", os.ModeSymlink | 0777, "", false},
+		{"dev", os.ModeDevice | 0666, "", false},
+	}
+	for _, tt := range tests {
+		got, ok := SanitizeZipMemberName(zipFile(t, tt.name, tt.mode))
+		if ok != tt.ok || got != tt.want {
+			t.Errorf("SanitizeZipMemberName(%q, %v) = (%q, %v), want (%q, %v)", tt.name, tt.mode, got, ok, tt.want, tt.ok)
+		}
+	}
+}
+
+// smallZipSpoolLimit drops the in-memory spool threshold to 1 KiB for the
+// duration of a test. Crossing the real 32 MiB threshold needs buffers that
+// are too large for the 32-bit test binary's address space.
+func smallZipSpoolLimit(t *testing.T) {
+	t.Helper()
+	old := zipSpoolMemoryLimit
+	zipSpoolMemoryLimit = 1024
+	t.Cleanup(func() { zipSpoolMemoryLimit = old })
+}
+
+func TestSpoolZipReaderMemory(t *testing.T) {
+	data := []byte(strings.Repeat("x", 1024))
+	ra, n, cleanup, err := SpoolZipReader(bytes.NewReader(data), 0)
+	if err != nil {
+		t.Fatalf("spool: %v", err)
+	}
+	defer cleanup()
+	if n != int64(len(data)) {
+		t.Fatalf("size = %d, want %d", n, len(data))
+	}
+	if _, isFile := ra.(*os.File); isFile {
+		t.Fatal("small archive should spool to memory")
+	}
+	buf := make([]byte, 4)
+	if _, err := ra.ReadAt(buf, 0); err != nil || string(buf) != "xxxx" {
+		t.Fatalf("ReadAt = %q, %v", buf, err)
+	}
+}
+
+func TestSpoolZipReaderTempFile(t *testing.T) {
+	smallZipSpoolLimit(t)
+	data := bytes.Repeat([]byte("y"), int(zipSpoolMemoryLimit)+1)
+	ra, n, cleanup, err := SpoolZipReader(bytes.NewReader(data), 0)
+	if err != nil {
+		t.Fatalf("spool: %v", err)
+	}
+	f, isFile := ra.(*os.File)
+	if !isFile {
+		cleanup()
+		t.Fatal("large archive should spool to a temp file")
+	}
+	name := f.Name()
+	cleanup()
+	if _, err := os.Stat(name); !os.IsNotExist(err) {
+		t.Fatalf("temp file %s still exists after cleanup: %v", name, err)
+	}
+	if n != int64(len(data)) {
+		t.Fatalf("size = %d, want %d", n, len(data))
+	}
+}
+
+func TestSpoolZipReaderLimit(t *testing.T) {
+	smallZipSpoolLimit(t)
+	data := []byte(strings.Repeat("x", 2048))
+	if _, _, _, err := SpoolZipReader(bytes.NewReader(data), 1024); err == nil {
+		t.Fatal("expected limit error for in-memory archive")
+	}
+	if _, _, cleanup, err := SpoolZipReader(bytes.NewReader(bytes.Repeat([]byte("y"), int(zipSpoolMemoryLimit)+1024)), zipSpoolMemoryLimit+512); err == nil {
+		t.Fatal("expected limit error for spooled archive")
+	} else {
+		cleanup()
+	}
+}
+
+func TestCheckZipLimits(t *testing.T) {
+	over := &zip.Reader{File: make([]*zip.File, ZipExtractMaxMembers+1)}
+	for i := range over.File {
+		over.File[i] = &zip.File{}
+	}
+	if err := CheckZipLimits(over); err == nil {
+		t.Fatal("expected member count limit error")
+	}
+
+	big := &zip.Reader{File: []*zip.File{{}}}
+	big.File[0].UncompressedSize64 = uint64(ZipExtractMaxBytes) + 1
+	if err := CheckZipLimits(big); err == nil {
+		t.Fatal("expected total size limit error")
+	}
+
+	overflow := &zip.Reader{File: []*zip.File{{}, {}}}
+	overflow.File[0].UncompressedSize64 = math.MaxUint64
+	overflow.File[1].UncompressedSize64 = math.MaxUint64
+	if err := CheckZipLimits(overflow); err == nil {
+		t.Fatal("expected total size overflow error")
+	}
+
+	ok := &zip.Reader{File: []*zip.File{{}, {}}}
+	if err := CheckZipLimits(ok); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestSpoolZipReaderRoundTrip(t *testing.T) {
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	w, _ := zw.Create("a/b.txt")
+	w.Write([]byte("hello"))
+	zw.Close()
+
+	ra, n, cleanup, err := SpoolZipReader(bytes.NewReader(buf.Bytes()), 0)
+	if err != nil {
+		t.Fatalf("spool: %v", err)
+	}
+	defer cleanup()
+	zr, err := zip.NewReader(ra, n)
+	if err != nil {
+		t.Fatalf("open zip: %v", err)
+	}
+	rc, err := zr.File[0].Open()
+	if err != nil {
+		t.Fatalf("open member: %v", err)
+	}
+	defer rc.Close()
+	data, _ := io.ReadAll(rc)
+	if string(data) != "hello" {
+		t.Fatalf("member content = %q", data)
+	}
+}
diff --git a/weed/iam/helpers.go b/weed/iam/helpers.go
index c335f87597..6d006478bb 100644
--- a/weed/iam/helpers.go
+++ b/weed/iam/helpers.go
@@ -98,21 +98,26 @@ var fineGrainedActionMap = map[string]string{
 // prefixed (s3:Action) and unprefixed (Action) variants in init().
 var baseS3ActionMap = map[string]string{
 	// Object operations
-	"DeleteObject":        s3_constants.ACTION_WRITE,
-	"PutObject":           s3_constants.ACTION_WRITE,
-	"GetObject":           s3_constants.ACTION_READ,
-	"DeleteObjectVersion": s3_constants.ACTION_WRITE,
-	"GetObjectVersion":    s3_constants.ACTION_READ,
+	"DeleteObject":               s3_constants.ACTION_WRITE,
+	"PutObject":                  s3_constants.ACTION_WRITE,
+	"GetObject":                  s3_constants.ACTION_READ,
+	"DeleteObjectVersion":        s3_constants.ACTION_WRITE,
+	"GetObjectVersion":           s3_constants.ACTION_READ,
+	"GetObjectAttributes":        s3_constants.ACTION_READ,
+	"GetObjectVersionAttributes": s3_constants.ACTION_READ,
 	// Tagging operations
-	"GetObjectTagging":        s3_constants.ACTION_TAGGING,
-	"GetObjectVersionTagging": s3_constants.ACTION_TAGGING,
-	"PutObjectTagging":        s3_constants.ACTION_TAGGING,
-	"DeleteObjectTagging":     s3_constants.ACTION_TAGGING,
-	"GetBucketTagging":        s3_constants.ACTION_TAGGING,
-	"PutBucketTagging":        s3_constants.ACTION_TAGGING,
-	"DeleteBucketTagging":     s3_constants.ACTION_TAGGING,
+	"GetObjectTagging":           s3_constants.ACTION_TAGGING,
+	"GetObjectVersionTagging":    s3_constants.ACTION_TAGGING,
+	"PutObjectTagging":           s3_constants.ACTION_TAGGING,
+	"PutObjectVersionTagging":    s3_constants.ACTION_TAGGING,
+	"DeleteObjectTagging":        s3_constants.ACTION_TAGGING,
+	"DeleteObjectVersionTagging": s3_constants.ACTION_TAGGING,
+	"GetBucketTagging":           s3_constants.ACTION_TAGGING,
+	"PutBucketTagging":           s3_constants.ACTION_TAGGING,
+	"DeleteBucketTagging":        s3_constants.ACTION_TAGGING,
 	// ACL operations
 	"PutObjectAcl":        s3_constants.ACTION_WRITE_ACP,
+	"PutObjectVersionAcl": s3_constants.ACTION_WRITE_ACP,
 	"GetObjectAcl":        s3_constants.ACTION_READ_ACP,
 	"GetObjectVersionAcl": s3_constants.ACTION_READ_ACP,
 	"PutBucketAcl":        s3_constants.ACTION_WRITE_ACP,
@@ -136,21 +141,27 @@ var baseS3ActionMap = map[string]string{
 	"DeleteBucketCors":                 s3_constants.ACTION_WRITE,
 	"GetBucketNotification":            s3_constants.ACTION_READ,
 	"PutBucketNotification":            s3_constants.ACTION_WRITE,
-	"GetBucketObjectLockConfiguration": s3_constants.ACTION_READ,
-	"PutBucketObjectLockConfiguration": s3_constants.ACTION_WRITE,
+	"GetBucketObjectLockConfiguration": s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG,
+	"PutBucketObjectLockConfiguration": s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG,
 	// Multipart upload operations
 	"CreateMultipartUpload":   s3_constants.ACTION_WRITE,
 	"UploadPart":              s3_constants.ACTION_WRITE,
 	"CompleteMultipartUpload": s3_constants.ACTION_WRITE,
 	"AbortMultipartUpload":    s3_constants.ACTION_WRITE,
-	"ListMultipartUploads":    s3_constants.ACTION_WRITE,
-	"ListParts":               s3_constants.ACTION_WRITE,
+	"ListMultipartUploads":    s3_constants.ACTION_LIST_MULTIPART_UPLOADS,
+	"ListParts":               s3_constants.ACTION_LIST_PARTS,
+	// AWS IAM names for the multipart listing operations get their own
+	// action names so a policy grant cannot widen into a general Read
+	// or Write grant; VerifyActionPermission matches them against the
+	// resolved request action.
+	"ListBucketMultipartUploads": s3_constants.ACTION_LIST_MULTIPART_UPLOADS,
+	"ListMultipartUploadParts":   s3_constants.ACTION_LIST_PARTS,
 	// Retention and legal hold operations
-	"GetObjectRetention":        s3_constants.ACTION_READ,
-	"PutObjectRetention":        s3_constants.ACTION_WRITE,
-	"GetObjectLegalHold":        s3_constants.ACTION_READ,
-	"PutObjectLegalHold":        s3_constants.ACTION_WRITE,
-	"BypassGovernanceRetention": s3_constants.ACTION_WRITE,
+	"GetObjectRetention":        s3_constants.ACTION_GET_OBJECT_RETENTION,
+	"PutObjectRetention":        s3_constants.ACTION_PUT_OBJECT_RETENTION,
+	"GetObjectLegalHold":        s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD,
+	"PutObjectLegalHold":        s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD,
+	"BypassGovernanceRetention": s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION,
 }
 
 func init() {
@@ -191,10 +202,28 @@ func MapToIdentitiesAction(action string) string {
 		return StatementActionTagging
 	case s3_constants.ACTION_DELETE_BUCKET:
 		return StatementActionDelete
+	case s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION:
+		return "BypassGovernanceRetention"
+	case s3_constants.ACTION_GET_OBJECT_RETENTION:
+		return "GetObjectRetention"
+	case s3_constants.ACTION_PUT_OBJECT_RETENTION:
+		return "PutObjectRetention"
+	case s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD:
+		return "GetObjectLegalHold"
+	case s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD:
+		return "PutObjectLegalHold"
+	case s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG:
+		return "GetBucketObjectLockConfiguration"
+	case s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG:
+		return "PutBucketObjectLockConfiguration"
 	case s3_constants.ACTION_PUT_BUCKET_POLICY:
 		return "PutBucketPolicy"
 	case s3_constants.ACTION_DELETE_BUCKET_POLICY:
 		return "DeleteBucketPolicy"
+	case s3_constants.ACTION_LIST_MULTIPART_UPLOADS:
+		return "ListBucketMultipartUploads"
+	case s3_constants.ACTION_LIST_PARTS:
+		return "ListMultipartUploadParts"
 	default:
 		return ""
 	}
diff --git a/weed/iam/integration/cached_role_store_generic.go b/weed/iam/integration/cached_role_store_generic.go
index 510fc147f3..23f64fe3ce 100644
--- a/weed/iam/integration/cached_role_store_generic.go
+++ b/weed/iam/integration/cached_role_store_generic.go
@@ -116,6 +116,14 @@ func (c *GenericCachedRoleStore) DeleteRole(ctx context.Context, filerAddress st
 	return c.Delete(ctx, filerAddress, roleName)
 }
 
+// UpdateRole implements RoleStore interface. The update reads the filer, not
+// the cache, and the cache is dropped afterwards whatever the outcome: a
+// refused write may mean the cached role is stale.
+func (c *GenericCachedRoleStore) UpdateRole(ctx context.Context, filerAddress string, roleName string, update RoleUpdate) error {
+	defer c.ClearCache()
+	return c.adapter.store.UpdateRole(ctx, filerAddress, roleName, update)
+}
+
 // genericCopyRoleDefinition creates a deep copy of a RoleDefinition for the generic cache
 func genericCopyRoleDefinition(role *RoleDefinition) *RoleDefinition {
 	if role == nil {
@@ -123,9 +131,13 @@ func genericCopyRoleDefinition(role *RoleDefinition) *RoleDefinition {
 	}
 
 	result := &RoleDefinition{
-		RoleName:    role.RoleName,
-		RoleArn:     role.RoleArn,
-		Description: role.Description,
+		RoleName:           role.RoleName,
+		RoleArn:            role.RoleArn,
+		Description:        role.Description,
+		MaxSessionDuration: role.MaxSessionDuration,
+		Source:             role.Source,
+		CreatedAt:          role.CreatedAt,
+		RoleId:             role.RoleId,
 	}
 
 	// Deep copy trust policy if it exists
diff --git a/weed/iam/integration/iam_integration_test.go b/weed/iam/integration/iam_integration_test.go
index bb696597e5..30b477187a 100644
--- a/weed/iam/integration/iam_integration_test.go
+++ b/weed/iam/integration/iam_integration_test.go
@@ -429,6 +429,39 @@ func TestSessionExpiration(t *testing.T) {
 	assert.True(t, allowed, "Access should still be allowed since token hasn't naturally expired")
 }
 
+// TestSessionOutlivesShortLivedToken verifies the session lifetime is not
+// clamped to the web identity token's exp: IdPs like GitLab issue ~2-minute
+// id_tokens, and the session should still run the configured duration.
+func TestSessionOutlivesShortLivedToken(t *testing.T) {
+	iamManager := setupIntegratedIAMSystem(t)
+	ctx := context.Background()
+
+	shortLivedJWT := createTestJWT(t, "https://test-issuer.com", "test-user-123", "test-signing-key",
+		time.Now().Add(3*time.Minute))
+
+	tests := []struct {
+		name            string
+		durationSeconds *int64
+		wantDuration    time.Duration
+	}{
+		{"default duration ignores token exp", nil, time.Hour},
+		{"explicit DurationSeconds ignores token exp", int64Ptr(3600), time.Hour},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			response, err := iamManager.AssumeRoleWithWebIdentity(ctx, &sts.AssumeRoleWithWebIdentityRequest{
+				RoleArn:          "arn:aws:iam::role/S3ReadOnlyRole",
+				WebIdentityToken: shortLivedJWT,
+				RoleSessionName:  "short-lived-token-test",
+				DurationSeconds:  tc.durationSeconds,
+			})
+			require.NoError(t, err)
+			assert.WithinDuration(t, time.Now().Add(tc.wantDuration), response.Credentials.Expiration, time.Minute)
+		})
+	}
+}
+
 // TestTrustPolicyValidation tests role trust policy validation
 func TestTrustPolicyValidation(t *testing.T) {
 	iamManager := setupIntegratedIAMSystem(t)
@@ -717,12 +750,16 @@ func TestOIDCClaimsTrustPolicy(t *testing.T) {
 // Helper functions and test setup
 
 // createTestJWT creates a test JWT token with the specified issuer, subject and signing key
-func createTestJWT(t *testing.T, issuer, subject, signingKey string) string {
+func createTestJWT(t *testing.T, issuer, subject, signingKey string, exp ...time.Time) string {
+	expiresAt := time.Now().Add(time.Hour)
+	if len(exp) > 0 {
+		expiresAt = exp[0]
+	}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
 		"iss": issuer,
 		"sub": subject,
 		"aud": "test-client-id",
-		"exp": time.Now().Add(time.Hour).Unix(),
+		"exp": expiresAt.Unix(),
 		"iat": time.Now().Unix(),
 		// Add claims that trust policy validation expects
 		"idp": "test-oidc", // Identity provider claim for trust policy matching
diff --git a/weed/iam/integration/iam_manager.go b/weed/iam/integration/iam_manager.go
index 6a04e09f99..ece1a54927 100644
--- a/weed/iam/integration/iam_manager.go
+++ b/weed/iam/integration/iam_manager.go
@@ -2,7 +2,10 @@ package integration
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/sha256"
 	"encoding/base64"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -27,11 +30,36 @@ const maxPoliciesForEvaluation = 1024
 
 // IAMManager orchestrates all IAM components
 type IAMManager struct {
-	stsService           *sts.STSService
-	policyEngine         *policy.PolicyEngine
-	roleStore            RoleStore
-	userStore            UserStore
-	oidcProviderStore    OIDCProviderStore
+	stsService        *sts.STSService
+	policyEngine      *policy.PolicyEngine
+	roleStore         RoleStore
+	userStore         UserStore
+	oidcProviderStore OIDCProviderStore
+	// staticOIDCProviders are the OIDC providers of this server's IAM config
+	// file, by ARN. With an in-memory store they are also written to the
+	// store; a persistent store never holds them (see installOIDCProviderStore).
+	staticOIDCProviders map[string]*OIDCProviderRecord
+	// staticRoles are the roles of this server's IAM config file, by name, once
+	// LoadStaticRoles has run (see installRoleStore).
+	staticRoles map[string]*RoleDefinition
+	// oidcRetryMu guards the background refresh retry and which store is
+	// current: cancelOIDCLoad stops the retry, oidcRetryGen names the one
+	// running (0 when none) so at most one runs, and oidcRetryAgain records a
+	// refresh that failed while it ran, so the retry runs once more.
+	oidcRetryMu    sync.Mutex
+	cancelOIDCLoad context.CancelFunc
+	oidcRetryGen   uint64
+	oidcRetrySeq   uint64
+	oidcRetryAgain bool
+	// oidcRefreshMu serializes refreshes from reading the store to handing
+	// STS the result, so an older snapshot cannot replace a newer one.
+	oidcRefreshMu sync.Mutex
+	// oidcManagedProviders caches providers refreshOIDCProvidersFrom built,
+	// keyed by record identity, so an unchanged record reuses its provider:
+	// rebuilding would drop the provider's consumed-token (jti) replay cache
+	// and let an already-used token be presented again. Guarded by
+	// oidcRefreshMu.
+	oidcManagedProviders map[string]*oidcManagedProvider
 	oidcAuditSink        OIDCProviderAuditSink
 	revocationStore      SessionRevocationStore
 	filerAddressProvider func() string // Function to get current filer address
@@ -108,12 +136,13 @@ func (m *IAMManager) PurgeRevokedSessions(ctx context.Context) (int, error) {
 }
 
 // SetOIDCProviderStore configures the IAM-managed OIDC provider store. When
-// nil, OIDC provider IAM actions return ServiceNotReady. The store is the
-// source of truth for AssumeRoleWithWebIdentity provider resolution once
-// Phase 2b lands; in Phase 2a it is read-only and populated from static
-// configuration at boot.
+// nil, OIDC provider IAM actions return ServiceNotReady.
 func (m *IAMManager) SetOIDCProviderStore(store OIDCProviderStore) {
-	m.oidcProviderStore = store
+	var stsConfig *sts.STSConfig
+	if m.stsService != nil {
+		stsConfig = m.stsService.Config
+	}
+	m.installOIDCProviderStore(store, stsConfig)
 }
 
 // GetOIDCProviderStore returns the configured store (may be nil).
@@ -121,13 +150,33 @@ func (m *IAMManager) GetOIDCProviderStore() OIDCProviderStore {
 	return m.oidcProviderStore
 }
 
+// GetRoleStore returns the configured role store.
+func (m *IAMManager) GetRoleStore() RoleStore {
+	return m.roleStore
+}
+
+// SetRoleStore replaces the role store. An S3 server builds the list of
+// directories it watches for peers' changes once, at startup, from the store
+// installed then (RoleStoreDirectory): a filer-backed store installed later
+// with a different basePath is not watched, so peers' changes to it reach this
+// server's cached roles only when the cache expires.
+func (m *IAMManager) SetRoleStore(store RoleStore) {
+	m.installRoleStore(context.Background(), store)
+}
+
 // GetOIDCProvider returns the record for the given ARN, or an error if the
 // store is not configured or the record is missing.
 func (m *IAMManager) GetOIDCProvider(ctx context.Context, arn string) (*OIDCProviderRecord, error) {
 	if m.oidcProviderStore == nil {
 		return nil, fmt.Errorf("OIDC provider store not configured")
 	}
-	return m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	rec, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	if errors.Is(err, ErrOIDCProviderNotFound) {
+		if static, ok := m.staticOIDCProviders[arn]; ok {
+			return copyOIDCProviderRecord(static), nil
+		}
+	}
+	return rec, err
 }
 
 // ListOIDCProviders enumerates all configured OIDC providers.
@@ -135,7 +184,33 @@ func (m *IAMManager) ListOIDCProviders(ctx context.Context) ([]*OIDCProviderReco
 	if m.oidcProviderStore == nil {
 		return nil, fmt.Errorf("OIDC provider store not configured")
 	}
-	return m.oidcProviderStore.ListProviders(ctx, m.getFilerAddress())
+	records, err := m.oidcProviderStore.ListProviders(ctx, m.getFilerAddress())
+	if err != nil {
+		return nil, err
+	}
+	// A persistent store does not hold the config file's providers.
+	seen := make(map[string]bool, len(records))
+	for _, rec := range records {
+		seen[rec.ARN] = true
+	}
+	for arn, static := range m.staticOIDCProviders {
+		if !seen[arn] {
+			records = append(records, copyOIDCProviderRecord(static))
+		}
+	}
+	return records, nil
+}
+
+// mutableOIDCProvider loads a stored provider for a change. A provider only
+// the IAM config file defines is refused with ErrOIDCProviderStatic.
+func (m *IAMManager) mutableOIDCProvider(ctx context.Context, arn string) (*OIDCProviderRecord, error) {
+	rec, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	if errors.Is(err, ErrOIDCProviderNotFound) {
+		if _, ok := m.staticOIDCProviders[arn]; ok {
+			return nil, fmt.Errorf("%w: %s", ErrOIDCProviderStatic, arn)
+		}
+	}
+	return rec, err
 }
 
 // CreateOIDCProvider persists a new IAM-managed OIDC provider record. Refuses
@@ -150,6 +225,9 @@ func (m *IAMManager) CreateOIDCProvider(ctx context.Context, rec *OIDCProviderRe
 	if err := validateOIDCProviderRecord(rec); err != nil {
 		return err
 	}
+	if _, static := m.staticOIDCProviders[rec.ARN]; static {
+		return fmt.Errorf("%w: %s", ErrOIDCProviderAlreadyExists, rec.ARN)
+	}
 	existing, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), rec.ARN)
 	if err == nil && existing != nil {
 		return fmt.Errorf("%w: %s", ErrOIDCProviderAlreadyExists, rec.ARN)
@@ -173,6 +251,9 @@ func (m *IAMManager) DeleteOIDCProvider(ctx context.Context, arn string) error {
 	if m.oidcProviderStore == nil {
 		return fmt.Errorf("OIDC provider store not configured")
 	}
+	if _, err := m.mutableOIDCProvider(ctx, arn); errors.Is(err, ErrOIDCProviderStatic) {
+		return err
+	}
 	if err := m.oidcProviderStore.DeleteProvider(ctx, m.getFilerAddress(), arn); err != nil {
 		return err
 	}
@@ -190,7 +271,7 @@ func (m *IAMManager) AddClientIDToOIDCProvider(ctx context.Context, arn, clientI
 	if clientID == "" {
 		return fmt.Errorf("ClientID cannot be empty")
 	}
-	rec, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	rec, err := m.mutableOIDCProvider(ctx, arn)
 	if err != nil {
 		return err
 	}
@@ -218,7 +299,7 @@ func (m *IAMManager) RemoveClientIDFromOIDCProvider(ctx context.Context, arn, cl
 	if m.oidcProviderStore == nil {
 		return fmt.Errorf("OIDC provider store not configured")
 	}
-	rec, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	rec, err := m.mutableOIDCProvider(ctx, arn)
 	if err != nil {
 		return err
 	}
@@ -255,7 +336,7 @@ func (m *IAMManager) UpdateOIDCProviderThumbprints(ctx context.Context, arn stri
 			return fmt.Errorf("invalid thumbprint %q: must be 40-character SHA-1 hex", tp)
 		}
 	}
-	rec, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	rec, err := m.mutableOIDCProvider(ctx, arn)
 	if err != nil {
 		return err
 	}
@@ -274,7 +355,7 @@ func (m *IAMManager) TagOIDCProvider(ctx context.Context, arn string, tags map[s
 	if m.oidcProviderStore == nil {
 		return fmt.Errorf("OIDC provider store not configured")
 	}
-	rec, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	rec, err := m.mutableOIDCProvider(ctx, arn)
 	if err != nil {
 		return err
 	}
@@ -297,7 +378,7 @@ func (m *IAMManager) UntagOIDCProvider(ctx context.Context, arn string, keys []s
 	if m.oidcProviderStore == nil {
 		return fmt.Errorf("OIDC provider store not configured")
 	}
-	rec, err := m.oidcProviderStore.GetProviderByARN(ctx, m.getFilerAddress(), arn)
+	rec, err := m.mutableOIDCProvider(ctx, arn)
 	if err != nil {
 		return err
 	}
@@ -415,6 +496,88 @@ type RoleDefinition struct {
 	// set it must satisfy AWS bounds: 3600 ≤ MaxSessionDuration ≤ 43200.
 	// Honoured by AssumeRole, AssumeRoleWithWebIdentity, AssumeRoleWithCredentials.
 	MaxSessionDuration int64 `json:"maxSessionDuration,omitempty"`
+
+	// Source records where the role came from. RoleSourceStaticConfig marks a
+	// role loaded from the IAM config file; empty means it was created at
+	// runtime. Only static-config roles are pruned when they leave the file.
+	Source string `json:"source,omitempty"`
+
+	// CreatedAt is when the role was created through the IAM API. Zero for
+	// roles loaded from the config file.
+	CreatedAt time.Time `json:"createdAt,omitempty"`
+
+	// RoleId uniquely identifies this role, as AWS's RoleId does. A role
+	// deleted and created again under the same name gets a new ID, and a
+	// session is honoured only while the role it was issued for still has
+	// the ID the session carries — so a session outlives neither the role's
+	// deletion nor a later role that reuses its name.
+	RoleId string `json:"roleId,omitempty"`
+}
+
+// NewRoleID returns a fresh, random role ID in AWS's AROA form.
+func NewRoleID() string {
+	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567"
+	b := make([]byte, 17)
+	if _, err := rand.Read(b); err != nil {
+		panic(fmt.Sprintf("read random role id: %v", err))
+	}
+	for i := range b {
+		b[i] = alphabet[int(b[i])%len(alphabet)]
+	}
+	return "AROA" + string(b)
+}
+
+// StaticRoleID is the ID of a role defined in the IAM config file. Such a
+// role is created again at every start, so its ID is derived rather than
+// random, to keep sessions valid across restarts. It is derived from the name
+// and the trust policy together: a role removed from the file and replaced by
+// a different one under the same name trusts different principals, and must
+// not inherit the old role's sessions. Restoring the same role restores its ID.
+func StaticRoleID(role *RoleDefinition) string {
+	h := sha256.New()
+	h.Write([]byte("static-role:" + role.RoleName + "\x00"))
+	if role.TrustPolicy != nil {
+		trust, err := json.Marshal(role.TrustPolicy)
+		if err != nil {
+			// A trust policy that cannot be encoded cannot be matched on
+			// either; give the role an ID no session can carry.
+			return NewRoleID()
+		}
+		h.Write(trust)
+	}
+	return "AROA" + strings.ToUpper(hex.EncodeToString(h.Sum(nil)))[:17]
+}
+
+// RoleSourceStaticConfig is the Source of a role loaded from the IAM config
+// file.
+const RoleSourceStaticConfig = "static-config"
+
+// checkSessionRoleBinding refuses a session issued for a role that has since
+// been deleted, or replaced by a role reusing its name: the role's current ID
+// must be the one the session carries. It runs for every session carrying a
+// role ID, whatever policies the session embeds — the policies a session
+// embeds are the ones its role had, and outlive the role otherwise. A session
+// issued before role IDs were recorded carries none and is not bound. It
+// returns the role it checked, nil for an unbound session.
+func (m *IAMManager) checkSessionRoleBinding(ctx context.Context, sessionInfo *sts.SessionInfo) (*RoleDefinition, error) {
+	if sessionInfo == nil || sessionInfo.RoleId == "" {
+		return nil, nil
+	}
+	roleName := utils.ExtractRoleNameFromArn(sessionInfo.RoleArn)
+	if roleName == "" {
+		return nil, nil
+	}
+	role, err := m.roleStore.GetRole(ctx, m.getFilerAddress(), roleName)
+	if errors.Is(err, ErrRoleNotFound) {
+		return nil, fmt.Errorf("session was issued for role %s, which no longer exists", roleName)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("resolve role %s for session: %w", roleName, err)
+	}
+	if role.RoleId != sessionInfo.RoleId {
+		return nil, fmt.Errorf("session was issued for an earlier role named %s", roleName)
+	}
+	return role, nil
 }
 
 // ActionRequest represents a request to perform an action
@@ -557,55 +720,174 @@ func (m *IAMManager) initOIDCProviderStore(config *IAMConfig) error {
 	if err != nil {
 		return err
 	}
-	m.oidcProviderStore = store
+	m.installOIDCProviderStore(store, config.STS)
+	return nil
+}
 
-	if config.STS == nil {
-		return nil
+// installOIDCProviderStore makes store the manager's OIDC provider store.
+//
+// The IAM config file's providers are reported by the IAM API alongside the
+// stored ones. An in-memory store holds them as records, as it always has. A
+// persistent store never does: it outlives this process and may be shared by
+// S3 servers with different config files, so a record written from one file
+// would outlive its removal from that file and be trusted by every server.
+// Those providers stay in memory (staticOIDCProviders) and STS keeps serving
+// them from its static configuration; the store holds only providers created
+// through the IAM API, and those are loaded into STS here.
+//
+// A provider stored under the same ARN as a config-file provider takes
+// precedence, in the IAM API as in STS, which already prefers IAM-managed
+// providers so that an API call can shadow a bootstrap entry. Deleting the
+// stored provider brings the config-file one back.
+func (m *IAMManager) installOIDCProviderStore(store OIDCProviderStore, stsConfig *sts.STSConfig) {
+	// Cancel the old store's retry and switch stores in one step, so a failed
+	// refresh of the old store cannot start a retry after the cancel.
+	m.oidcRetryMu.Lock()
+	m.stopOIDCRetryLocked()
+	m.oidcProviderStore = store
+	m.oidcRetryMu.Unlock()
+	m.staticOIDCProviders = staticOIDCProviderRecords(stsConfig)
+	if _, inMemory := store.(*MemoryOIDCProviderStore); inMemory {
+		ctx := context.Background()
+		now := time.Now().UTC()
+		for _, rec := range m.staticOIDCProviders {
+			mirrored := copyOIDCProviderRecord(rec)
+			mirrored.CreatedAt, mirrored.UpdatedAt = now, now
+			if err := store.StoreProvider(ctx, m.getFilerAddress(), mirrored); err != nil {
+				glog.Warningf("mirror static OIDC provider %s into store: %v", rec.ARN, err)
+			}
+		}
+		// The store now holds them and the API may change them, as before;
+		// the overlay is only for stores that must not hold them.
+		m.staticOIDCProviders = nil
+		return
 	}
-	for _, pc := range config.STS.Providers {
+	// The metadata subscription only reports changes made from now on, so
+	// providers already in the store would stay unknown until one changes; a
+	// failed load is retried (RefreshOIDCProvidersFromStore).
+	if err := m.RefreshOIDCProvidersFromStore(context.Background()); err != nil {
+		glog.Warningf("load OIDC providers from the store at startup: %v; retrying in the background", err)
+	}
+}
+
+// startOIDCRetry retries loading store in the background until it succeeds.
+// A store that is no longer current gets no retry: nothing would cancel it,
+// and its eventual success would replace the current store's providers. When
+// a retry is already running, it is asked to run once more instead, because
+// it may already have listed a snapshot older than this failure.
+func (m *IAMManager) startOIDCRetry(store OIDCProviderStore) {
+	m.oidcRetryMu.Lock()
+	defer m.oidcRetryMu.Unlock()
+	if store != m.oidcProviderStore {
+		return
+	}
+	if m.oidcRetryGen != 0 {
+		m.oidcRetryAgain = true
+		return
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	m.oidcRetrySeq++
+	gen := m.oidcRetrySeq
+	m.cancelOIDCLoad, m.oidcRetryGen = cancel, gen
+	bounds := oidcHydrateRetry // read here, not in the goroutine: it outlives its caller
+	go func() {
+		defer cancel()
+		for {
+			m.retryOIDCProviderLoad(ctx, store, bounds)
+			m.oidcRetryMu.Lock()
+			if m.oidcRetryGen != gen {
+				m.oidcRetryMu.Unlock()
+				return // cancelled: another store was installed
+			}
+			if m.oidcRetryAgain && ctx.Err() == nil {
+				m.oidcRetryAgain = false
+				m.oidcRetryMu.Unlock()
+				continue
+			}
+			m.cancelOIDCLoad, m.oidcRetryGen, m.oidcRetryAgain = nil, 0, false
+			m.oidcRetryMu.Unlock()
+			return
+		}
+	}()
+}
+
+// stopOIDCRetryLocked cancels a running retry, as installing another store
+// must. The caller holds oidcRetryMu.
+func (m *IAMManager) stopOIDCRetryLocked() {
+	if m.cancelOIDCLoad != nil {
+		m.cancelOIDCLoad()
+	}
+	m.cancelOIDCLoad, m.oidcRetryGen, m.oidcRetryAgain = nil, 0, false
+}
+
+// currentOIDCProviderStore is the installed store, read under oidcRetryMu.
+func (m *IAMManager) currentOIDCProviderStore() OIDCProviderStore {
+	m.oidcRetryMu.Lock()
+	defer m.oidcRetryMu.Unlock()
+	return m.oidcProviderStore
+}
+
+// staticOIDCProviderRecords describes the enabled OIDC providers of the IAM
+// config file as provider records.
+func staticOIDCProviderRecords(stsConfig *sts.STSConfig) map[string]*OIDCProviderRecord {
+	out := map[string]*OIDCProviderRecord{}
+	if stsConfig == nil {
+		return out
+	}
+	for _, pc := range stsConfig.Providers {
 		if pc == nil || !pc.Enabled || pc.Type != sts.ProviderTypeOIDC {
 			continue
 		}
 		issuer, _ := pc.Config["issuer"].(string)
 		if issuer == "" {
-			glog.Warningf("OIDC provider %s in static config has empty issuer; skipping mirror to store", pc.Name)
+			glog.Warningf("OIDC provider %s in static config has empty issuer; skipping", pc.Name)
 			continue
 		}
-		accountID := ""
-		if config.STS != nil {
-			accountID = config.STS.AccountId
-		}
-		arn, err := DeriveOIDCProviderARN(accountID, issuer)
+		arn, err := DeriveOIDCProviderARN(stsConfig.AccountId, issuer)
 		if err != nil {
 			glog.Warningf("derive ARN for static OIDC provider %s: %v", pc.Name, err)
 			continue
 		}
-		clientIDs := extractClientIDs(pc.Config)
-		ctx := context.Background()
-		// Preserve CreatedAt across reboots when a persistent store already
-		// has this provider — IAM's GetOpenIDConnectProvider response
-		// shouldn't shift its CreateDate every time the server restarts.
-		now := time.Now().UTC()
-		createdAt := now
-		if existing, err := store.GetProviderByARN(ctx, m.getFilerAddress(), arn); err == nil && existing != nil && !existing.CreatedAt.IsZero() {
-			createdAt = existing.CreatedAt
-		}
-		rec := &OIDCProviderRecord{
-			AccountID:               accountID,
+		out[arn] = &OIDCProviderRecord{
+			AccountID:               stsConfig.AccountId,
 			ARN:                     arn,
 			URL:                     issuer,
-			ClientIDs:               clientIDs,
+			ClientIDs:               extractClientIDs(pc.Config),
 			Thumbprints:             extractStringList(pc.Config, "thumbprints"),
 			AllowedPrincipalTagKeys: extractStringList(pc.Config, "allowedPrincipalTagKeys"),
 			PolicyClaim:             extractString(pc.Config, "policyClaim"),
-			CreatedAt:               createdAt,
-			UpdatedAt:               now,
+			// No CreatedAt: a config-file provider has no creation time the
+			// server could report consistently across restarts.
 		}
-		if err := store.StoreProvider(ctx, m.getFilerAddress(), rec); err != nil {
-			glog.Warningf("mirror static OIDC provider %s into store: %v", pc.Name, err)
+	}
+	return out
+}
+
+// oidcHydrateRetry bounds the backoff between startup load attempts.
+var oidcHydrateRetry = struct{ initial, max time.Duration }{initial: time.Second, max: 30 * time.Second}
+
+// retryOIDCProviderLoad retries loading store, the store it was started for,
+// until it succeeds or ctx is cancelled because another store was installed.
+// It calls refreshOIDCProvidersFrom, not RefreshOIDCProvidersFromStore, so it
+// never schedules a retry of its own.
+func (m *IAMManager) retryOIDCProviderLoad(ctx context.Context, store OIDCProviderStore, bounds struct{ initial, max time.Duration }) {
+	delay := bounds.initial
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(delay):
+		}
+		err := m.refreshOIDCProvidersFrom(ctx, store)
+		if err == nil {
+			glog.V(0).Infof("loaded OIDC providers from the store after retrying")
+			return
+		}
+		glog.V(1).Infof("load OIDC providers from the store: %v; retrying in %v", err, delay)
+		if delay *= 2; delay > bounds.max {
+			delay = bounds.max
 		}
 	}
-	return nil
 }
 
 // refreshOIDCProvidersBestEffort calls RefreshOIDCProvidersFromStore and
@@ -626,23 +908,106 @@ func (m *IAMManager) refreshOIDCProvidersBestEffort(ctx context.Context, op, arn
 // the store is empty (clears the IAM-managed map). Records with empty URLs
 // or invalid configuration are logged and skipped so a single bad entry
 // does not stop the rest from refreshing.
+//
+// A refresh that fails keeps retrying in the background until the store
+// answers. Every caller needs that: a metadata-subscription event reports each
+// change ONCE, so a refresh that found the filer unreachable on it would leave
+// a peer's new provider untrusted, or a deleted one trusted, until an unrelated
+// later change; the refresh after a local IAM API mutation and the startup load
+// have the same shape. At most one retry runs.
 func (m *IAMManager) RefreshOIDCProvidersFromStore(ctx context.Context) error {
-	if m.oidcProviderStore == nil || m.stsService == nil {
+	store := m.currentOIDCProviderStore()
+	err := m.refreshOIDCProvidersFrom(ctx, store)
+	if err != nil && store != nil {
+		m.startOIDCRetry(store)
+	}
+	return err
+}
+
+// refreshOIDCProvidersFrom is RefreshOIDCProvidersFromStore for a given store.
+func (m *IAMManager) refreshOIDCProvidersFrom(ctx context.Context, store OIDCProviderStore) error {
+	if store == nil || m.stsService == nil {
 		return nil
 	}
-	records, err := m.oidcProviderStore.ListProviders(ctx, m.getFilerAddress())
+	// Refreshes run concurrently: after an IAM API change, on a peer's change
+	// and in the startup retry. Unserialized, a refresh that read the store
+	// before a DeleteOIDCProvider could finish after that call's own refresh
+	// and keep the deleted provider trusted.
+	m.oidcRefreshMu.Lock()
+	defer m.oidcRefreshMu.Unlock()
+	records, err := store.ListProviders(ctx, m.getFilerAddress())
 	if err != nil {
 		return fmt.Errorf("list OIDC providers: %w", err)
 	}
+	// A snapshot of a store that has since been replaced must not replace the
+	// current store's providers: a retry is cancelled when another store is
+	// installed, and a refresh may have listed the old store just before.
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	if store != m.currentOIDCProviderStore() {
+		return fmt.Errorf("list OIDC providers: the store was replaced during the refresh")
+	}
 	byIssuer := make(map[string][]sts.ScopedOIDCProvider, len(records))
+	if m.oidcManagedProviders == nil {
+		m.oidcManagedProviders = make(map[string]*oidcManagedProvider)
+	}
+	seen := make(map[string]struct{}, len(records))
+	// Records for one issuer with identical validation settings share a single
+	// provider — and with it the consumed-token (jti) replay store — so a token
+	// spent through one account's record stays spent through the other's too.
+	sharedProviders := make(map[string]*oidc.OIDCProvider)
 	for _, rec := range records {
 		if rec == nil || rec.URL == "" {
 			continue
 		}
-		provider, err := buildOIDCProviderFromRecord(rec)
-		if err != nil {
-			glog.Warningf("skip refreshing OIDC provider %s: %v", rec.ARN, err)
-			continue
+		key := rec.ARN
+		if key == "" {
+			key = rec.URL + "\x00" + rec.AccountID
+		}
+		seen[key] = struct{}{}
+		fingerprint := oidcProviderFingerprint(rec)
+		configFingerprint := oidcProviderConfigFingerprint(rec)
+		var provider *oidc.OIDCProvider
+		cached := m.oidcManagedProviders[key]
+		if shared, ok := sharedProviders[configFingerprint]; ok {
+			provider = shared
+			if cached != nil && cached.provider != nil && cached.provider != shared {
+				// The record's own provider is superseded; its consumed
+				// tokens move to the shared store so none reopen for replay.
+				shared.MergeReplayStateFrom(cached.provider)
+			}
+			m.oidcManagedProviders[key] = &oidcManagedProvider{fingerprint: fingerprint, provider: provider}
+			if cached != nil && cached.provider != nil && cached.provider != shared && !m.oidcProviderStillReferenced(cached.provider) {
+				if err := cached.provider.Shutdown(ctx); err != nil {
+					glog.Warningf("shutdown superseded OIDC provider %s: %v", rec.ARN, err)
+				}
+			}
+		} else if cached != nil && cached.fingerprint == fingerprint {
+			provider = cached.provider
+			sharedProviders[configFingerprint] = provider
+		} else {
+			var err error
+			provider, err = buildOIDCProviderFromRecord(rec)
+			if err != nil {
+				delete(m.oidcManagedProviders, key)
+				glog.Warningf("skip refreshing OIDC provider %s: %v", rec.ARN, err)
+				continue
+			}
+			if cached != nil && cached.provider != nil {
+				// The rebuild must keep rejecting tokens the replaced
+				// provider consumed; carry its replay store over, then stop
+				// its cleanup worker so only the new one sweeps the store —
+				// unless another record still references that provider.
+				provider.AdoptReplayStateFrom(cached.provider)
+			}
+			sharedProviders[configFingerprint] = provider
+			m.oidcManagedProviders[key] = &oidcManagedProvider{fingerprint: fingerprint, provider: provider}
+			if cached != nil && cached.provider != nil && !m.oidcProviderStillReferenced(cached.provider) {
+				if err := cached.provider.Shutdown(ctx); err != nil {
+					glog.Warningf("shutdown replaced OIDC provider %s: %v", rec.ARN, err)
+				}
+			}
 		}
 		// Multiple records may share an issuer when each is scoped to a
 		// different account; STS picks the right one at validation time
@@ -652,10 +1017,71 @@ func (m *IAMManager) RefreshOIDCProvidersFromStore(ctx context.Context) error {
 			Provider:  provider,
 		})
 	}
+	for key, managed := range m.oidcManagedProviders {
+		if _, ok := seen[key]; !ok {
+			delete(m.oidcManagedProviders, key)
+			// A removed record's provider may be shared by records that are
+			// still present; shut it down only when nothing references it.
+			if managed.provider != nil && !m.oidcProviderStillReferenced(managed.provider) {
+				if err := managed.provider.Shutdown(ctx); err != nil {
+					glog.Warningf("shutdown removed OIDC provider %s: %v", key, err)
+				}
+			}
+		}
+	}
 	m.stsService.SetIAMManagedOIDCProviders(byIssuer)
 	return nil
 }
 
+// oidcManagedProvider is a runtime provider together with the fingerprint of
+// the record it was built from.
+type oidcManagedProvider struct {
+	fingerprint string
+	provider    *oidc.OIDCProvider
+}
+
+// oidcProviderStillReferenced reports whether any managed record still points
+// at the provider, so a shared provider is not shut down with a removed record.
+func (m *IAMManager) oidcProviderStillReferenced(provider *oidc.OIDCProvider) bool {
+	for _, managed := range m.oidcManagedProviders {
+		if managed.provider == provider {
+			return true
+		}
+	}
+	return false
+}
+
+// oidcProviderFingerprint identifies the record content a provider was built
+// from, so a refresh rebuilds the provider only when that content changed.
+func oidcProviderFingerprint(rec *OIDCProviderRecord) string {
+	key, _ := json.Marshal(struct {
+		ARN                     string
+		AccountID               string
+		URL                     string
+		ClientIDs               []string
+		Thumbprints             []string
+		AllowedPrincipalTagKeys []string
+		PolicyClaim             string
+	}{rec.ARN, rec.AccountID, rec.URL, rec.ClientIDs, rec.Thumbprints, rec.AllowedPrincipalTagKeys, rec.PolicyClaim})
+	sum := sha256.Sum256(key)
+	return hex.EncodeToString(sum[:])
+}
+
+// oidcProviderConfigFingerprint identifies the validation settings a provider
+// is built from — everything buildOIDCProviderFromRecord consumes except the
+// record's name — so records that differ only in identity reuse one provider.
+func oidcProviderConfigFingerprint(rec *OIDCProviderRecord) string {
+	key, _ := json.Marshal(&oidc.OIDCConfig{
+		Issuer:                  rec.URL,
+		ClientIDs:               rec.ClientIDs,
+		Thumbprints:             rec.Thumbprints,
+		AllowedPrincipalTagKeys: rec.AllowedPrincipalTagKeys,
+		PolicyClaim:             rec.PolicyClaim,
+	})
+	sum := sha256.Sum256(key)
+	return hex.EncodeToString(sum[:])
+}
+
 // buildOIDCProviderFromRecord turns a stored record into a runtime
 // OIDCProvider. The provider name is the ARN so re-registration is
 // idempotent and never collides with static-config entries.
@@ -664,9 +1090,11 @@ func buildOIDCProviderFromRecord(rec *OIDCProviderRecord) (*oidc.OIDCProvider, e
 		return nil, fmt.Errorf("record cannot be nil")
 	}
 	cfg := &oidc.OIDCConfig{
-		Issuer:      rec.URL,
-		ClientIDs:   append([]string(nil), rec.ClientIDs...),
-		Thumbprints: append([]string(nil), rec.Thumbprints...),
+		Issuer:                  rec.URL,
+		ClientIDs:               append([]string(nil), rec.ClientIDs...),
+		Thumbprints:             append([]string(nil), rec.Thumbprints...),
+		AllowedPrincipalTagKeys: append([]string(nil), rec.AllowedPrincipalTagKeys...),
+		PolicyClaim:             rec.PolicyClaim,
 	}
 	provider := oidc.NewOIDCProvider(rec.ARN)
 	if err := provider.Initialize(cfg); err != nil {
@@ -800,14 +1228,51 @@ func (m *IAMManager) CreateRole(ctx context.Context, filerAddress string, roleNa
 	if !m.initialized {
 		return fmt.Errorf("IAM manager not initialized")
 	}
+	if err := PrepareRoleDefinition(roleName, roleDef); err != nil {
+		return err
+	}
+	if roleDef.RoleId == "" {
+		roleDef.RoleId = NewRoleID()
+	}
 
+	// Store role definition
+	return m.roleStore.StoreRole(ctx, "", roleName, roleDef)
+}
+
+// UpdateRole changes a role atomically in the role store (see
+// RoleStore.UpdateRole). update receives the role's current definition, nil
+// when it does not exist, and its result is validated like CreateRole's; a
+// nil result deletes the role.
+// The IAM API's role actions use it, so a change made on one S3 server is
+// neither lost to a concurrent change on another nor written over a delete.
+func (m *IAMManager) UpdateRole(ctx context.Context, roleName string, update RoleUpdate) error {
+	if !m.initialized {
+		return fmt.Errorf("IAM manager not initialized")
+	}
+	return m.roleStore.UpdateRole(ctx, "", roleName, func(current *RoleDefinition) (*RoleDefinition, error) {
+		next, err := update(current)
+		if err != nil || next == nil {
+			return next, err
+		}
+		if err := PrepareRoleDefinition(roleName, next); err != nil {
+			return nil, err
+		}
+		return next, nil
+	})
+}
+
+// PrepareRoleDefinition applies CreateRole's defaults and validation to a role
+// about to be stored or loaded.
+func PrepareRoleDefinition(roleName string, roleDef *RoleDefinition) error {
 	if roleName == "" {
 		return fmt.Errorf("role name cannot be empty")
 	}
-
 	if roleDef == nil {
 		return fmt.Errorf("role definition cannot be nil")
 	}
+	if roleDef.RoleName == "" {
+		roleDef.RoleName = roleName
+	}
 
 	// Set role ARN if not provided
 	if roleDef.RoleArn == "" {
@@ -827,12 +1292,122 @@ func (m *IAMManager) CreateRole(ctx context.Context, filerAddress string, roleNa
 			return fmt.Errorf("MaxSessionDuration must be between 3600 and 43200 seconds, got %d", roleDef.MaxSessionDuration)
 		}
 	}
+	return nil
+}
 
-	// Store role definition
-	return m.roleStore.StoreRole(ctx, "", roleName, roleDef)
+// LoadStaticRoles installs the roles of the IAM config file.
+//
+// An in-memory store holds them as records, as it always has. A persistent
+// store never does: it outlives this process and may be shared by S3 servers
+// with different config files, so a record written from one file would
+// outlive its removal from that file and be honoured by every server. Those
+// roles are served from memory instead, ahead of the store, and cannot be
+// changed or deleted through the store (ErrRoleStatic). A role stored under
+// the same name takes precedence. They report no creation time.
+func (m *IAMManager) LoadStaticRoles(ctx context.Context, roles []*RoleDefinition) {
+	defs := make(map[string]*RoleDefinition, len(roles))
+	for _, role := range roles {
+		if role == nil {
+			continue
+		}
+		role.Source = RoleSourceStaticConfig
+		if role.RoleId == "" {
+			role.RoleId = StaticRoleID(role)
+		}
+		if err := PrepareRoleDefinition(role.RoleName, role); err != nil {
+			glog.Warningf("Failed to load role %s: %v", role.RoleName, err)
+			continue
+		}
+		defs[role.RoleName] = role
+	}
+	m.staticRoles = defs
+	m.installRoleStore(ctx, m.roleStore)
+}
+
+// installRoleStore makes store the role store, with the config-file roles
+// installed in it as LoadStaticRoles describes, so a store set after startup
+// behaves like the one set at startup.
+func (m *IAMManager) installRoleStore(ctx context.Context, store RoleStore) {
+	if overlay, ok := store.(*staticRoleOverlay); ok {
+		store = overlay.inner
+	}
+	if store == nil || m.staticRoles == nil {
+		m.roleStore = store
+		return
+	}
+	if _, inMemory := store.(*MemoryRoleStore); inMemory {
+		for name, role := range m.staticRoles {
+			if err := store.StoreRole(ctx, "", name, role); err != nil {
+				glog.Warningf("Failed to create role %s: %v", name, err)
+			}
+		}
+		m.roleStore = store
+		return
+	}
+	m.roleStore = &staticRoleOverlay{static: m.staticRoles, inner: store}
 }
 
 // GetRole retrieves a role definition by name.
+// ListRoles returns every stored role definition.
+func (m *IAMManager) ListRoles(ctx context.Context) ([]*RoleDefinition, error) {
+	if !m.initialized {
+		return nil, fmt.Errorf("IAM manager not initialized")
+	}
+	names, err := m.roleStore.ListRoles(ctx, m.getFilerAddress())
+	if err != nil {
+		return nil, fmt.Errorf("list roles: %w", err)
+	}
+	roles := make([]*RoleDefinition, 0, len(names))
+	for _, name := range names {
+		role, err := m.roleStore.GetRole(ctx, m.getFilerAddress(), name)
+		if errors.Is(err, ErrRoleNotFound) {
+			continue // deleted between list and read
+		}
+		if err != nil {
+			return nil, fmt.Errorf("get role %s: %w", name, err)
+		}
+		roles = append(roles, role)
+	}
+	return roles, nil
+}
+
+// DeleteRole removes a role definition.
+func (m *IAMManager) DeleteRole(ctx context.Context, roleName string) error {
+	if !m.initialized {
+		return fmt.Errorf("IAM manager not initialized")
+	}
+	if roleName == "" {
+		return fmt.Errorf("role name cannot be empty")
+	}
+	return m.roleStore.DeleteRole(ctx, m.getFilerAddress(), roleName)
+}
+
+// InvalidateRoleCache drops any cached role definitions, so a change written
+// to the store by a peer is seen on the next lookup rather than after the
+// cache TTL.
+func (m *IAMManager) InvalidateRoleCache() {
+	if cached, ok := m.roleStore.(interface{ ClearCache() }); ok {
+		cached.ClearCache()
+	}
+}
+
+// RoleStoreDirectory is the filer directory the role store keeps roles in,
+// its configured basePath; empty when the store is not filer-backed. S3
+// servers watch it to drop cached roles when a peer changes one.
+func (m *IAMManager) RoleStoreDirectory() string {
+	store := m.roleStore
+	if overlay, ok := store.(*staticRoleOverlay); ok {
+		store = overlay.inner
+	}
+	if cached, ok := store.(*GenericCachedRoleStore); ok {
+		store = cached.adapter.store
+	}
+	if filerStore, ok := store.(*FilerRoleStore); ok {
+		return filerStore.basePath
+	}
+	return ""
+}
+
 func (m *IAMManager) GetRole(ctx context.Context, roleName string) (*RoleDefinition, error) {
 	if !m.initialized {
 		return nil, fmt.Errorf("IAM manager not initialized")
@@ -865,6 +1440,44 @@ func (m *IAMManager) UpdateBucketPolicy(ctx context.Context, bucketName string,
 	return m.policyEngine.AddPolicy(m.getFilerAddress(), policyName, &policyDoc)
 }
 
+// EnsureBucketPolicy stores the policy for a bucket only when no mirror is
+// stored yet, backfilling policies that predate the IAM integration (the
+// metadata subscription only sees changes). A present mirror is left alone,
+// so repeat calls cost one cached read. Returns whether a write happened,
+// so the caller can reconcile a write that raced a concurrent change.
+func (m *IAMManager) EnsureBucketPolicy(ctx context.Context, bucketName string, policyJSON []byte) (bool, error) {
+	if !m.initialized {
+		return false, fmt.Errorf("IAM manager not initialized")
+	}
+
+	if bucketName == "" {
+		return false, fmt.Errorf("bucket name cannot be empty")
+	}
+
+	if existing, err := m.policyEngine.GetPolicy(ctx, m.getFilerAddress(), "bucket-policy:"+bucketName); err == nil && existing != nil {
+		return false, nil
+	}
+
+	if err := m.UpdateBucketPolicy(ctx, bucketName, policyJSON); err != nil {
+		return false, err
+	}
+	return true, nil
+}
+
+// RemoveBucketPolicy deletes the stored policy for a bucket. Removing a
+// policy that was never stored is a success.
+func (m *IAMManager) RemoveBucketPolicy(ctx context.Context, bucketName string) error {
+	if !m.initialized {
+		return fmt.Errorf("IAM manager not initialized")
+	}
+
+	if bucketName == "" {
+		return fmt.Errorf("bucket name cannot be empty")
+	}
+
+	return m.policyEngine.DeletePolicy(ctx, m.getFilerAddress(), "bucket-policy:"+bucketName)
+}
+
 // AssumeRoleWithWebIdentity assumes a role using web identity (OIDC)
 func (m *IAMManager) AssumeRoleWithWebIdentity(ctx context.Context, request *sts.AssumeRoleWithWebIdentityRequest) (*sts.AssumeRoleResponse, error) {
 	if !m.initialized {
@@ -904,7 +1517,8 @@ func (m *IAMManager) AssumeRoleWithWebIdentity(ctx context.Context, request *sts
 	// Apply role-level MaxSessionDuration cap. The STS service still applies
 	// the global MaxSessionLength and the source-token-expiry cap on top of
 	// this; per-role takes precedence whenever it is the tightest bound.
-	request.DurationSeconds = capDurationByRole(request.DurationSeconds, roleDef.MaxSessionDuration)
+	request.DurationSeconds = capDurationByRole(request.DurationSeconds, roleDef.MaxSessionDuration, m.defaultTokenDurationSeconds(), m.maxSessionLengthSeconds())
+	request.RoleId = roleDef.RoleId
 
 	// Use STS service to assume the role
 	return m.stsService.AssumeRoleWithWebIdentity(ctx, request)
@@ -967,22 +1581,54 @@ func extractIssuerFromJWT(token string) (string, error) {
 	return iss, nil
 }
 
-// capDurationByRole returns the requested duration clamped to the role's
-// MaxSessionDuration. A nil requested duration is left nil so the STS
-// service's calculateSessionDuration applies the global default (typically
-// 1 hour) — substituting the role's max here would silently mint a 12h
-// session for any caller who omitted DurationSeconds, which AWS does not
-// do. The role-max upper bound still applies in the downstream cap chain
-// once the request has a concrete duration.
-func capDurationByRole(requested *int64, roleMax int64) *int64 {
-	if roleMax <= 0 || requested == nil {
-		return requested
+// capDurationByRole returns the session duration clamped to the role's
+// MaxSessionDuration. An omitted DurationSeconds resolves to the configured
+// default first, so the role bound caps defaults and explicit values alike.
+// A nil request is only materialized when something tightened the default
+// and the explicit value still passes the service's own input validation —
+// everything else is left nil so the service resolves the default and its
+// MaxSessionLength cap itself.
+func capDurationByRole(requested *int64, roleMax, defaultSec, serviceMaxSec int64) *int64 {
+	if requested != nil {
+		d := *requested
+		if roleMax > 0 && d > roleMax {
+			d = roleMax
+		}
+		return &d
 	}
-	if *requested > roleMax {
-		v := roleMax
-		return &v
+	d := defaultSec
+	if roleMax > 0 && d > roleMax {
+		d = roleMax
 	}
-	return requested
+	if d > serviceMaxSec {
+		d = serviceMaxSec
+	}
+	if d < 900 && roleMax > 0 {
+		d = 900
+	}
+	if d >= defaultSec || d < 900 {
+		return nil
+	}
+	return &d
+}
+
+func (m *IAMManager) defaultTokenDurationSeconds() int64 {
+	if m.stsService == nil || m.stsService.Config == nil {
+		return sts.DefaultTokenDuration
+	}
+	return int64(m.stsService.Config.TokenDuration.Duration / time.Second)
+}
+
+// maxSessionLengthSeconds mirrors validateSessionDurationSeconds so a
+// materialized default stays inside the bound the service will enforce.
+func (m *IAMManager) maxSessionLengthSeconds() int64 {
+	maxSec := int64(sts.DefaultMaxSessionLength)
+	if m.stsService != nil && m.stsService.Config != nil && m.stsService.Config.MaxSessionLength.Duration > 0 {
+		if configured := int64(m.stsService.Config.MaxSessionLength.Duration / time.Second); configured >= 900 {
+			maxSec = configured
+		}
+	}
+	return maxSec
 }
 
 // AssumeRoleWithCredentials assumes a role using credentials (LDAP)
@@ -1006,9 +1652,10 @@ func (m *IAMManager) AssumeRoleWithCredentials(ctx context.Context, request *sts
 	}
 
 	// Apply role-level MaxSessionDuration cap.
-	request.DurationSeconds = capDurationByRole(request.DurationSeconds, roleDef.MaxSessionDuration)
+	request.DurationSeconds = capDurationByRole(request.DurationSeconds, roleDef.MaxSessionDuration, m.defaultTokenDurationSeconds(), m.maxSessionLengthSeconds())
 
 	// Use STS service to assume the role
+	request.RoleId = roleDef.RoleId
 	return m.stsService.AssumeRoleWithCredentials(ctx, request)
 }
 
@@ -1022,6 +1669,10 @@ func (m *IAMManager) IsActionAllowed(ctx context.Context, request *ActionRequest
 	// We always try to validate with the internal STS service first if it's a SeaweedFS token.
 	// This ensures that session policies embedded in the token are correctly extracted and enforced.
 	var sessionInfo *sts.SessionInfo
+	// boundRole is the role a session carrying a role ID was checked against;
+	// its policies are the ones evaluated, so the check and the evaluation
+	// see one definition even if the role is replaced in between.
+	var boundRole *RoleDefinition
 	if request.SessionToken != "" {
 		// Parse unverified to check issuer
 		parsed, _, err := new(jwt.Parser).ParseUnverified(request.SessionToken, jwt.MapClaims{})
@@ -1054,6 +1705,9 @@ func (m *IAMManager) IsActionAllowed(ctx context.Context, request *ActionRequest
 					return false, fmt.Errorf("session has been revoked")
 				}
 			}
+			if boundRole, err = m.checkSessionRoleBinding(ctx, sessionInfo); err != nil {
+				return false, err
+			}
 		}
 	}
 
@@ -1150,9 +1804,12 @@ func (m *IAMManager) IsActionAllowed(ctx context.Context, request *ActionRequest
 				policies = user.GetPolicyNames()
 			} else {
 				// Get role definition
-				roleDef, err := m.roleStore.GetRole(ctx, m.getFilerAddress(), roleName)
-				if err != nil {
-					return false, fmt.Errorf("role not found: %s", roleName)
+				roleDef := boundRole
+				if roleDef == nil || roleDef.RoleName != roleName {
+					roleDef, err = m.roleStore.GetRole(ctx, m.getFilerAddress(), roleName)
+					if err != nil {
+						return false, fmt.Errorf("role not found: %s", roleName)
+					}
 				}
 
 				hasManagedSubject = true
@@ -1616,3 +2273,24 @@ func (m *IAMManager) ValidateTrustPolicyForCredentials(ctx context.Context, role
 	// Use existing trust policy validation logic
 	return m.validateTrustPolicyForCredentials(ctx, roleDef, mockRequest)
 }
+
+// PrepareOIDCProviderRecord builds and validates the record that
+// CreateOpenIDConnectProvider stores for an issuer, deriving its ARN from the
+// account ID and issuer URL.
+func PrepareOIDCProviderRecord(accountID, issuerURL string, clientIDs, thumbprints []string) (*OIDCProviderRecord, error) {
+	arn, err := DeriveOIDCProviderARN(accountID, issuerURL)
+	if err != nil {
+		return nil, err
+	}
+	rec := &OIDCProviderRecord{
+		AccountID:   accountID,
+		ARN:         arn,
+		URL:         issuerURL,
+		ClientIDs:   append([]string(nil), clientIDs...),
+		Thumbprints: append([]string(nil), thumbprints...),
+	}
+	if err := validateOIDCProviderRecord(rec); err != nil {
+		return nil, err
+	}
+	return rec, nil
+}
diff --git a/weed/iam/integration/iam_manager_trust.go b/weed/iam/integration/iam_manager_trust.go
index 462ec14a76..896ef0a1ff 100644
--- a/weed/iam/integration/iam_manager_trust.go
+++ b/weed/iam/integration/iam_manager_trust.go
@@ -2,16 +2,30 @@ package integration
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
 	"github.com/seaweedfs/seaweedfs/weed/iam/utils"
 )
 
+// ErrTrustPolicyDenied is wrapped when a role's trust policy does not admit
+// the principal.
+var ErrTrustPolicyDenied = errors.New("trust policy denies access to principal")
+
 // ValidateTrustPolicyForPrincipal validates if a principal is allowed to assume a role
 func (m *IAMManager) ValidateTrustPolicyForPrincipal(ctx context.Context, roleArn, principalArn string) error {
+	_, err := m.ResolveRoleForPrincipal(ctx, roleArn, principalArn)
+	return err
+}
+
+// ResolveRoleForPrincipal returns the role roleArn names if its trust policy
+// admits principalArn. Issuing a session from the definition returned binds
+// the session to the role whose trust was evaluated, not to a role that
+// replaced it under the same name in between.
+func (m *IAMManager) ResolveRoleForPrincipal(ctx context.Context, roleArn, principalArn string) (*RoleDefinition, error) {
 	if !m.initialized {
-		return fmt.Errorf("IAM manager not initialized")
+		return nil, fmt.Errorf("IAM manager not initialized")
 	}
 
 	// Extract role name from ARN
@@ -20,11 +34,11 @@ func (m *IAMManager) ValidateTrustPolicyForPrincipal(ctx context.Context, roleAr
 	// Get role definition
 	roleDef, err := m.roleStore.GetRole(ctx, m.getFilerAddress(), roleName)
 	if err != nil {
-		return fmt.Errorf("failed to get role %s: %w", roleName, err)
+		return nil, fmt.Errorf("failed to get role %s: %w", roleName, err)
 	}
 
 	if roleDef.TrustPolicy == nil {
-		return fmt.Errorf("role has no trust policy")
+		return nil, fmt.Errorf("%w: role has no trust policy", ErrTrustPolicyDenied)
 	}
 
 	// Create evaluation context with RequestContext populated so that
@@ -43,8 +57,8 @@ func (m *IAMManager) ValidateTrustPolicyForPrincipal(ctx context.Context, roleAr
 
 	// Evaluate the trust policy
 	if !m.evaluateTrustPolicy(roleDef.TrustPolicy, evalCtx) {
-		return fmt.Errorf("trust policy denies access to principal: %s", principalArn)
+		return nil, fmt.Errorf("%w: %s", ErrTrustPolicyDenied, principalArn)
 	}
 
-	return nil
+	return roleDef, nil
 }
diff --git a/weed/iam/integration/oidc_provider_persist_test.go b/weed/iam/integration/oidc_provider_persist_test.go
new file mode 100644
index 0000000000..26a6f81250
--- /dev/null
+++ b/weed/iam/integration/oidc_provider_persist_test.go
@@ -0,0 +1,651 @@
+package integration
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// persistentTestStore stands in for a store that outlives the process and may
+// be shared (the filer store): anything but *MemoryOIDCProviderStore is
+// treated as persistent.
+type persistentTestStore struct{ *MemoryOIDCProviderStore }
+
+const (
+	persistTestStaticIssuer = "https://static.example"
+	persistTestAPIIssuer    = "https://api.example"
+)
+
+// persistTestConfig is an IAM config whose file defines the given OIDC
+// issuers.
+func persistTestConfig(issuers ...string) *IAMConfig {
+	var providers []*sts.ProviderConfig
+	for i, issuer := range issuers {
+		providers = append(providers, &sts.ProviderConfig{
+			Name:    "static-" + string(rune('a'+i)),
+			Type:    sts.ProviderTypeOIDC,
+			Enabled: true,
+			Config:  map[string]interface{}{"issuer": issuer, "clientId": "aud"},
+		})
+	}
+	return &IAMConfig{
+		STS: &sts.STSConfig{
+			TokenDuration:    sts.FlexibleDuration{Duration: time.Hour},
+			MaxSessionLength: sts.FlexibleDuration{Duration: 12 * time.Hour},
+			Issuer:           "test-sts",
+			SigningKey:       []byte("test-signing-key-32-characters-long"),
+			Providers:        providers,
+		},
+		Policy: &policy.PolicyEngineConfig{DefaultEffect: "Deny", StoreType: "memory"},
+		Roles:  &RoleStoreConfig{StoreType: "memory"},
+	}
+}
+
+// startServer initializes a manager as an S3 server would at boot, with the
+// given config file providers and OIDC provider store.
+func startServer(t *testing.T, store OIDCProviderStore, issuers ...string) *IAMManager {
+	t.Helper()
+	cfg := persistTestConfig(issuers...)
+	mgr := NewIAMManager()
+	require.NoError(t, mgr.Initialize(cfg, func() string { return "localhost:8888" }))
+	mgr.installOIDCProviderStore(store, cfg.STS)
+	return mgr
+}
+
+func arnOf(t *testing.T, issuer string) string {
+	t.Helper()
+	arn, err := DeriveOIDCProviderARN("", issuer)
+	require.NoError(t, err)
+	return arn
+}
+
+func listedARNs(t *testing.T, mgr *IAMManager) map[string]bool {
+	t.Helper()
+	recs, err := mgr.ListOIDCProviders(context.Background())
+	require.NoError(t, err)
+	out := map[string]bool{}
+	for _, r := range recs {
+		out[r.ARN] = true
+	}
+	return out
+}
+
+func storedARNs(t *testing.T, store OIDCProviderStore) map[string]bool {
+	t.Helper()
+	recs, err := store.ListProviders(context.Background(), "")
+	require.NoError(t, err)
+	out := map[string]bool{}
+	for _, r := range recs {
+		out[r.ARN] = true
+	}
+	return out
+}
+
+func createAPIProvider(t *testing.T, mgr *IAMManager, issuer string) {
+	t.Helper()
+	require.NoError(t, mgr.CreateOIDCProvider(context.Background(), &OIDCProviderRecord{
+		ARN: arnOf(t, issuer), URL: issuer, ClientIDs: []string{"aud"},
+	}))
+}
+
+// stsKnowsIssuer reports whether STS resolves a provider for the issuer. The
+// token is not validly signed; the only question is which error comes back.
+func stsKnowsIssuer(t *testing.T, mgr *IAMManager, issuer string) bool {
+	t.Helper()
+	tok, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"iss": issuer, "sub": "probe", "aud": "aud", "exp": time.Now().Add(time.Hour).Unix(),
+	}).SignedString([]byte("not-the-providers-key"))
+	require.NoError(t, err)
+	_, _, err = mgr.GetSTSService().ValidateWebIdentityToken(context.Background(), tok)
+	require.Error(t, err, "an unsigned-by-provider token for %s was accepted", issuer)
+	return !strings.Contains(err.Error(), "no identity provider registered")
+}
+
+// A persistent store never receives the config file's providers: it outlives
+// the file and may be shared with servers whose files differ.
+func TestPersistentStoreNeverHoldsConfigFileProviders(t *testing.T) {
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, store, persistTestStaticIssuer)
+
+	assert.Empty(t, storedARNs(t, store), "a config-file provider was written to the persistent store")
+	assert.True(t, listedARNs(t, mgr)[arnOf(t, persistTestStaticIssuer)], "the IAM API no longer lists the config-file provider")
+	rec, err := mgr.GetOIDCProvider(context.Background(), arnOf(t, persistTestStaticIssuer))
+	require.NoError(t, err)
+	assert.Equal(t, persistTestStaticIssuer, rec.URL)
+	assert.True(t, stsKnowsIssuer(t, mgr, persistTestStaticIssuer), "STS stopped trusting the config-file provider")
+}
+
+// Servers sharing a store, with different config files, must not remove or
+// replace each other's providers — including a zero-config server.
+func TestServersSharingAStoreKeepEachOthersProviders(t *testing.T) {
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	configured := startServer(t, store, persistTestStaticIssuer)
+	createAPIProvider(t, configured, persistTestAPIIssuer)
+
+	zeroConfig := startServer(t, store)
+
+	assert.True(t, storedARNs(t, store)[arnOf(t, persistTestAPIIssuer)], "a peer's start removed an API-created provider")
+	assert.True(t, listedARNs(t, configured)[arnOf(t, persistTestStaticIssuer)], "the configured server lost its config-file provider")
+	assert.False(t, listedARNs(t, zeroConfig)[arnOf(t, persistTestStaticIssuer)], "a server lists a provider only its peer's config file defines")
+	assert.True(t, stsKnowsIssuer(t, zeroConfig, persistTestAPIIssuer), "the peer does not trust the shared API-created provider")
+	assert.False(t, stsKnowsIssuer(t, zeroConfig, persistTestStaticIssuer), "the peer trusts a provider only another server's config file defines")
+}
+
+// Removing a provider from the config file revokes it at the next start.
+func TestRemovingAProviderFromTheConfigFileRevokesIt(t *testing.T) {
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	startServer(t, store, persistTestStaticIssuer)
+
+	restarted := startServer(t, store) // the file no longer lists it
+
+	assert.False(t, listedARNs(t, restarted)[arnOf(t, persistTestStaticIssuer)])
+	assert.False(t, stsKnowsIssuer(t, restarted, persistTestStaticIssuer), "a provider removed from the config file is still trusted")
+}
+
+// The API cannot change a provider the config file defines, nor create one
+// with its ARN; the file is where it changes.
+func TestConfigFileProvidersCannotBeChangedThroughTheAPI(t *testing.T) {
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, store, persistTestStaticIssuer)
+	ctx := context.Background()
+	arn := arnOf(t, persistTestStaticIssuer)
+
+	for name, err := range map[string]error{
+		"add client ID":     mgr.AddClientIDToOIDCProvider(ctx, arn, "other"),
+		"remove client ID":  mgr.RemoveClientIDFromOIDCProvider(ctx, arn, "aud"),
+		"update thumbprint": mgr.UpdateOIDCProviderThumbprints(ctx, arn, []string{"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"}),
+		"tag":               mgr.TagOIDCProvider(ctx, arn, map[string]string{"k": "v"}),
+		"untag":             mgr.UntagOIDCProvider(ctx, arn, []string{"k"}),
+		"delete":            mgr.DeleteOIDCProvider(ctx, arn),
+	} {
+		assert.ErrorIs(t, err, ErrOIDCProviderStatic, name)
+	}
+	err := mgr.CreateOIDCProvider(ctx, &OIDCProviderRecord{ARN: arn, URL: persistTestStaticIssuer, ClientIDs: []string{"aud"}})
+	assert.ErrorIs(t, err, ErrOIDCProviderAlreadyExists)
+	assert.Empty(t, storedARNs(t, store), "a refused change still wrote to the store")
+}
+
+// Providers created through the API on an earlier boot, or on a peer, are
+// trusted at startup rather than after the next change.
+func TestStartupLoadsStoredProvidersIntoSTS(t *testing.T) {
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	createAPIProvider(t, startServer(t, store), persistTestAPIIssuer)
+
+	restarted := startServer(t, store)
+	assert.True(t, stsKnowsIssuer(t, restarted, persistTestAPIIssuer))
+}
+
+// An in-memory store keeps its behaviour: the config file's providers are
+// records in it, as before.
+func TestInMemoryStoreStillHoldsConfigFileProviders(t *testing.T) {
+	store := NewMemoryOIDCProviderStore()
+	startServer(t, store, persistTestStaticIssuer)
+	assert.True(t, storedARNs(t, store)[arnOf(t, persistTestStaticIssuer)])
+}
+
+// unreachableThenReadyStore fails its first reads, as a filer that is not up
+// yet when the S3 server starts.
+type unreachableThenReadyStore struct {
+	*MemoryOIDCProviderStore
+	mu        sync.Mutex
+	failsLeft int
+}
+
+func (s *unreachableThenReadyStore) ListProviders(ctx context.Context, addr string) ([]*OIDCProviderRecord, error) {
+	s.mu.Lock()
+	if s.failsLeft > 0 {
+		s.failsLeft--
+		s.mu.Unlock()
+		return nil, errors.New("filer unavailable")
+	}
+	s.mu.Unlock()
+	return s.MemoryOIDCProviderStore.ListProviders(ctx, addr)
+}
+
+// A store that cannot be read at startup is retried: the metadata
+// subscription only reports later changes, so without a retry the providers
+// already stored would stay unknown to STS.
+func TestStartupLoadRetriesUntilTheStoreIsReadable(t *testing.T) {
+	saved := oidcHydrateRetry
+	oidcHydrateRetry.initial, oidcHydrateRetry.max = time.Millisecond, 5*time.Millisecond
+	t.Cleanup(func() { oidcHydrateRetry = saved })
+
+	seeded := NewMemoryOIDCProviderStore()
+	require.NoError(t, seeded.StoreProvider(context.Background(), "", &OIDCProviderRecord{
+		ARN: arnOf(t, persistTestAPIIssuer), URL: persistTestAPIIssuer, ClientIDs: []string{"aud"},
+	}))
+	mgr := startServer(t, &unreachableThenReadyStore{MemoryOIDCProviderStore: seeded, failsLeft: 3})
+
+	deadline := time.Now().Add(2 * time.Second)
+	for !stsKnowsIssuer(t, mgr, persistTestAPIIssuer) {
+		if time.Now().After(deadline) {
+			t.Fatal("STS never learned the stored provider after the store became readable")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// A provider stored under a config-file provider's ARN takes precedence, as it
+// does in STS; the API then changes the stored one, and deleting it brings the
+// config-file provider back.
+func TestStoredProviderTakesPrecedenceOverTheConfigFileOne(t *testing.T) {
+	ctx := context.Background()
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	configured := startServer(t, store, persistTestStaticIssuer)
+	peer := startServer(t, store)
+	arn := arnOf(t, persistTestStaticIssuer)
+	require.NoError(t, peer.CreateOIDCProvider(ctx, &OIDCProviderRecord{ARN: arn, URL: persistTestStaticIssuer, ClientIDs: []string{"stored"}}))
+
+	rec, err := configured.GetOIDCProvider(ctx, arn)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"stored"}, rec.ClientIDs, "the config-file provider hides the stored one")
+	assert.NoError(t, configured.AddClientIDToOIDCProvider(ctx, arn, "more"), "the stored provider cannot be changed")
+
+	require.NoError(t, configured.DeleteOIDCProvider(ctx, arn))
+	rec, err = configured.GetOIDCProvider(ctx, arn)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"aud"}, rec.ClientIDs, "deleting the stored provider did not bring the config-file one back")
+}
+
+// A store installed through SetOIDCProviderStore behaves like one installed
+// at startup: stored providers load into STS and config-file providers stay
+// visible to the IAM API.
+func TestSetOIDCProviderStoreInstallsLikeStartup(t *testing.T) {
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	require.NoError(t, store.StoreProvider(context.Background(), "", &OIDCProviderRecord{
+		ARN: arnOf(t, persistTestAPIIssuer), URL: persistTestAPIIssuer, ClientIDs: []string{"aud"},
+	}))
+
+	cfg := persistTestConfig(persistTestStaticIssuer)
+	mgr := NewIAMManager()
+	require.NoError(t, mgr.Initialize(cfg, func() string { return "localhost:8888" }))
+	mgr.SetOIDCProviderStore(store)
+
+	assert.True(t, stsKnowsIssuer(t, mgr, persistTestAPIIssuer), "a stored provider was not trusted after install")
+	assert.True(t, listedARNs(t, mgr)[arnOf(t, persistTestStaticIssuer)], "the IAM API no longer lists the config-file provider")
+	assert.ErrorIs(t, mgr.DeleteOIDCProvider(context.Background(), arnOf(t, persistTestStaticIssuer)), ErrOIDCProviderStatic)
+}
+
+// A config-file provider reports no creation time: a time taken at startup
+// would change with every restart.
+func TestConfigFileProvidersReportNoCreationTime(t *testing.T) {
+	store := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, store, persistTestStaticIssuer)
+	rec, err := mgr.GetOIDCProvider(context.Background(), arnOf(t, persistTestStaticIssuer))
+	require.NoError(t, err)
+	assert.True(t, rec.CreatedAt.IsZero())
+}
+
+// countingUnreadableStore never becomes readable and counts the attempts.
+type countingUnreadableStore struct {
+	*MemoryOIDCProviderStore
+	mu    sync.Mutex
+	reads int
+}
+
+func (s *countingUnreadableStore) ListProviders(context.Context, string) ([]*OIDCProviderRecord, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.reads++
+	return nil, errors.New("filer unavailable")
+}
+
+func (s *countingUnreadableStore) readCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.reads
+}
+
+// Installing another store stops the previous one's startup retry.
+func TestInstallingAnotherStoreStopsThePreviousRetry(t *testing.T) {
+	saved := oidcHydrateRetry
+	oidcHydrateRetry.initial, oidcHydrateRetry.max = time.Millisecond, time.Millisecond
+	t.Cleanup(func() { oidcHydrateRetry = saved })
+
+	first := &countingUnreadableStore{MemoryOIDCProviderStore: NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, first)
+	deadline := time.Now().Add(2 * time.Second)
+	for first.readCount() <= 1 {
+		if time.Now().After(deadline) {
+			t.Fatal("precondition: the first store is never retried")
+		}
+		time.Sleep(time.Millisecond)
+	}
+
+	mgr.installOIDCProviderStore(&persistentTestStore{NewMemoryOIDCProviderStore()}, persistTestConfig().STS)
+	time.Sleep(10 * time.Millisecond) // let an in-flight attempt finish
+	settled := first.readCount()
+	time.Sleep(30 * time.Millisecond)
+	assert.Equal(t, settled, first.readCount(), "the superseded store is still being retried")
+}
+
+// blockingListStore blocks the first ListProviders call after arm, having
+// already read its snapshot, until release is closed.
+type blockingListStore struct {
+	*MemoryOIDCProviderStore
+	mu      sync.Mutex
+	armed   bool
+	entered chan struct{}
+	release chan struct{}
+}
+
+func (s *blockingListStore) arm() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.armed, s.entered, s.release = true, make(chan struct{}), make(chan struct{})
+}
+
+func (s *blockingListStore) ListProviders(ctx context.Context, addr string) ([]*OIDCProviderRecord, error) {
+	records, err := s.MemoryOIDCProviderStore.ListProviders(ctx, addr)
+	s.mu.Lock()
+	block := s.armed
+	s.armed = false
+	s.mu.Unlock()
+	if block {
+		close(s.entered)
+		<-s.release
+	}
+	return records, err
+}
+
+// A refresh that read the store before a provider was deleted cannot leave the
+// deleted provider trusted by finishing after the deletion's own refresh.
+func TestAnOlderRefreshCannotRestoreADeletedProvider(t *testing.T) {
+	store := &blockingListStore{MemoryOIDCProviderStore: NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, store)
+	createAPIProvider(t, mgr, persistTestAPIIssuer)
+	require.True(t, stsKnowsIssuer(t, mgr, persistTestAPIIssuer), "precondition: the provider is trusted")
+
+	store.arm()
+	stale := make(chan struct{})
+	go func() {
+		defer close(stale)
+		_ = mgr.RefreshOIDCProvidersFromStore(context.Background())
+	}()
+	<-store.entered // the stale refresh holds a snapshot with the provider
+
+	deleted := make(chan error, 1)
+	go func() { deleted <- mgr.DeleteOIDCProvider(context.Background(), arnOf(t, persistTestAPIIssuer)) }()
+	// Serialized, the deletion's refresh waits for the stale one; otherwise
+	// let it finish first, which is the ordering that went wrong.
+	var deleteErr error
+	select {
+	case deleteErr = <-deleted:
+		deleted = nil
+	case <-time.After(200 * time.Millisecond):
+	}
+	close(store.release)
+	<-stale
+	if deleted != nil {
+		deleteErr = <-deleted
+	}
+	require.NoError(t, deleteErr)
+	assert.False(t, stsKnowsIssuer(t, mgr, persistTestAPIIssuer), "a refresh older than the deletion left the deleted provider trusted")
+}
+
+// A refresh that fails is retried until the store answers. A change event reports each mutation once, so
+// a subscription refresh that found the filer unreachable — mid-restart, say — left the provider set stale
+// until some unrelated later change; a peer's new provider stayed untrusted and a deleted one trusted.
+func TestAFailedRefreshIsRetriedUntilTheStoreAnswers(t *testing.T) {
+	saved := oidcHydrateRetry
+	oidcHydrateRetry.initial, oidcHydrateRetry.max = time.Millisecond, 5*time.Millisecond
+	t.Cleanup(func() { oidcHydrateRetry = saved })
+
+	store := &unreachableThenReadyStore{MemoryOIDCProviderStore: NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, store)
+	require.NoError(t, store.StoreProvider(context.Background(), "", &OIDCProviderRecord{
+		ARN: arnOf(t, persistTestAPIIssuer), URL: persistTestAPIIssuer, ClientIDs: []string{"aud"},
+	}))
+	store.mu.Lock()
+	store.failsLeft = 3
+	store.mu.Unlock()
+	require.Error(t, mgr.RefreshOIDCProvidersFromStore(context.Background()), "precondition: the refresh fails")
+
+	deadline := time.Now().Add(2 * time.Second)
+	for !stsKnowsIssuer(t, mgr, persistTestAPIIssuer) {
+		if time.Now().After(deadline) {
+			t.Fatal("a failed refresh was never retried: the stored provider stays untrusted until an unrelated change")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// Failures during an outage start ONE retry, not one per event: a filer that is down for a while produces a
+// change event per mutation, and each would otherwise add a goroutine polling the same store. Once the store
+// answers and the retry ends, a later failure starts a new one.
+func TestFailedRefreshesShareOneRetry(t *testing.T) {
+	saved := oidcHydrateRetry
+	oidcHydrateRetry.initial, oidcHydrateRetry.max = time.Millisecond, time.Millisecond
+	t.Cleanup(func() { oidcHydrateRetry = saved })
+
+	store := &unreachableThenReadyStore{MemoryOIDCProviderStore: NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, store)
+	store.mu.Lock()
+	store.failsLeft = 1 << 30
+	store.mu.Unlock()
+	for range 20 {
+		require.Error(t, mgr.RefreshOIDCProvidersFromStore(context.Background()))
+	}
+	mgr.oidcRetryMu.Lock()
+	started := mgr.oidcRetrySeq
+	mgr.oidcRetryMu.Unlock()
+	assert.Equal(t, uint64(1), started, "twenty failed refreshes started more than one retry")
+
+	store.mu.Lock()
+	store.failsLeft = 0
+	store.mu.Unlock()
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		mgr.oidcRetryMu.Lock()
+		running := mgr.oidcRetryGen != 0
+		mgr.oidcRetryMu.Unlock()
+		if !running {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the retry never ended after the store answered")
+		}
+		time.Sleep(time.Millisecond)
+	}
+	store.mu.Lock()
+	store.failsLeft = 1
+	store.mu.Unlock()
+	require.Error(t, mgr.RefreshOIDCProvidersFromStore(context.Background()))
+	mgr.oidcRetryMu.Lock()
+	assert.Equal(t, uint64(2), mgr.oidcRetrySeq, "a failure after the retry ended starts a new one")
+	mgr.oidcRetryMu.Unlock()
+}
+
+// flakyCountingStore fails while fail is set and counts the lists that succeed.
+type flakyCountingStore struct {
+	*MemoryOIDCProviderStore
+	mu   sync.Mutex
+	fail bool
+	ok   int
+}
+
+func (s *flakyCountingStore) ListProviders(ctx context.Context, addr string) ([]*OIDCProviderRecord, error) {
+	s.mu.Lock()
+	if s.fail {
+		s.mu.Unlock()
+		return nil, errors.New("filer unavailable")
+	}
+	s.ok++
+	s.mu.Unlock()
+	return s.MemoryOIDCProviderStore.ListProviders(ctx, addr)
+}
+
+func (s *flakyCountingStore) set(fail bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.fail = fail
+}
+
+func (s *flakyCountingStore) successes() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.ok
+}
+
+// A refresh of store A that fails as store B is installed must not start a retry for A: nothing would cancel
+// it, and when A answered it would replace B's providers (a removed one trusted again, B's own untrusted).
+func TestAFailedRefreshOfASupersededStoreStartsNoRetry(t *testing.T) {
+	a := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	mgr := startServer(t, a)
+	mgr.SetOIDCProviderStore(&persistentTestStore{NewMemoryOIDCProviderStore()})
+	mgr.oidcRetryMu.Lock()
+	before := mgr.oidcRetrySeq
+	mgr.oidcRetryMu.Unlock()
+
+	mgr.startOIDCRetry(a) // the late call of A's failed refresh, after B's install
+
+	mgr.oidcRetryMu.Lock()
+	defer mgr.oidcRetryMu.Unlock()
+	assert.Equal(t, before, mgr.oidcRetrySeq, "a retry was started for the store that was replaced")
+	assert.Zero(t, mgr.oidcRetryGen)
+}
+
+// A refresh that listed store A before B was installed must not hand STS A's providers afterwards.
+func TestASupersededSnapshotIsNotApplied(t *testing.T) {
+	a := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	require.NoError(t, a.StoreProvider(context.Background(), "", &OIDCProviderRecord{
+		ARN: arnOf(t, persistTestAPIIssuer), URL: persistTestAPIIssuer, ClientIDs: []string{"aud"},
+	}))
+	b := &persistentTestStore{NewMemoryOIDCProviderStore()}
+	require.NoError(t, b.StoreProvider(context.Background(), "", &OIDCProviderRecord{
+		ARN: arnOf(t, persistTestStaticIssuer), URL: persistTestStaticIssuer, ClientIDs: []string{"aud"},
+	}))
+	mgr := startServer(t, a)
+	mgr.SetOIDCProviderStore(b)
+
+	assert.Error(t, mgr.refreshOIDCProvidersFrom(context.Background(), a), "a snapshot of the replaced store was applied")
+	assert.False(t, stsKnowsIssuer(t, mgr, persistTestAPIIssuer), "the replaced store's provider is trusted")
+	assert.True(t, stsKnowsIssuer(t, mgr, persistTestStaticIssuer), "the current store's provider is not")
+}
+
+// A refresh that fails while a retry runs is not dropped: the retry may already have listed an older snapshot,
+// so after its success it runs once more and picks up whatever the failed refresh would have seen.
+func TestAFailureDuringARetryIsNotDropped(t *testing.T) {
+	saved := oidcHydrateRetry
+	oidcHydrateRetry.initial, oidcHydrateRetry.max = time.Millisecond, 2*time.Millisecond
+	t.Cleanup(func() { oidcHydrateRetry = saved })
+
+	store := &flakyCountingStore{MemoryOIDCProviderStore: NewMemoryOIDCProviderStore(), fail: true}
+	mgr := startServer(t, store) // the startup load fails: a retry is running
+	require.Error(t, mgr.RefreshOIDCProvidersFromStore(context.Background()), "a later refresh fails while it runs")
+	store.set(false)
+
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		mgr.oidcRetryMu.Lock()
+		running := mgr.oidcRetryGen != 0
+		mgr.oidcRetryMu.Unlock()
+		if !running {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the retry never ended")
+		}
+		time.Sleep(time.Millisecond)
+	}
+	assert.GreaterOrEqual(t, store.successes(), 2, "the retry ended on its first success, dropping the refresh that failed while it ran")
+}
+
+// A refresh must not rebuild a provider whose record is unchanged: rebuilding
+// would drop the provider's consumed-token (jti) replay cache and let an
+// already-used token be presented again.
+func TestRefreshReusesProviderWhileRecordIsUnchanged(t *testing.T) {
+	ctx := context.Background()
+	store := NewMemoryOIDCProviderStore()
+	mgr := startServer(t, store)
+
+	arn := arnOf(t, persistTestAPIIssuer)
+	require.NoError(t, store.StoreProvider(ctx, "", &OIDCProviderRecord{
+		ARN: arn, URL: persistTestAPIIssuer, ClientIDs: []string{"aud"},
+	}))
+	require.NoError(t, mgr.refreshOIDCProvidersFrom(ctx, store))
+	first := mgr.oidcManagedProviders[arn].provider
+	require.NotNil(t, first)
+
+	require.NoError(t, mgr.refreshOIDCProvidersFrom(ctx, store))
+	assert.Same(t, first, mgr.oidcManagedProviders[arn].provider,
+		"an unchanged record was rebuilt, dropping its replay cache")
+
+	// A changed record must rebuild so the new configuration applies.
+	require.NoError(t, store.StoreProvider(ctx, "", &OIDCProviderRecord{
+		ARN: arn, URL: persistTestAPIIssuer, ClientIDs: []string{"aud", "aud2"},
+	}))
+	require.NoError(t, mgr.refreshOIDCProvidersFrom(ctx, store))
+	rebuilt := mgr.oidcManagedProviders[arn].provider
+	require.NotNil(t, rebuilt)
+	assert.NotSame(t, first, rebuilt, "a changed record kept the old provider")
+
+	// Deleting the record drops the provider from the cache and the STS map.
+	require.NoError(t, store.DeleteProvider(ctx, "", arn))
+	require.NoError(t, mgr.refreshOIDCProvidersFrom(ctx, store))
+	assert.NotContains(t, mgr.oidcManagedProviders, arn)
+	assert.False(t, stsKnowsIssuer(t, mgr, persistTestAPIIssuer))
+}
+
+// stsKnowsIssuerForAccount is stsKnowsIssuer through the account-scoped
+// lookup used for providers that have no global record.
+func stsKnowsIssuerForAccount(t *testing.T, mgr *IAMManager, issuer, accountID string) bool {
+	t.Helper()
+	tok, err := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
+		"iss": issuer, "sub": "probe", "aud": "aud", "exp": time.Now().Add(time.Hour).Unix(),
+	}).SignedString([]byte("not-the-providers-key"))
+	require.NoError(t, err)
+	_, _, err = mgr.GetSTSService().ValidateWebIdentityTokenForAccount(context.Background(), tok, accountID)
+	require.Error(t, err, "an unsigned-by-provider token for %s was accepted", issuer)
+	return !strings.Contains(err.Error(), "no identity provider registered")
+}
+
+// Two records for one issuer with identical validation settings share a
+// single provider — and with it the consumed-token (jti) replay store — so a
+// token spent through one account's record stays spent through the other's.
+// Removing one record of the pair must not shut the shared provider down.
+func TestSameIssuerRecordsShareOneProvider(t *testing.T) {
+	ctx := context.Background()
+	store := NewMemoryOIDCProviderStore()
+	mgr := startServer(t, store)
+
+	arnA := arnOf(t, persistTestAPIIssuer) + "-account-a"
+	arnB := arnOf(t, persistTestAPIIssuer) + "-account-b"
+	for _, rec := range []*OIDCProviderRecord{
+		{ARN: arnA, URL: persistTestAPIIssuer, AccountID: "111111111111", ClientIDs: []string{"aud"}},
+		{ARN: arnB, URL: persistTestAPIIssuer, AccountID: "222222222222", ClientIDs: []string{"aud"}},
+	} {
+		require.NoError(t, store.StoreProvider(ctx, "", rec))
+	}
+	require.NoError(t, mgr.refreshOIDCProvidersFrom(ctx, store))
+
+	shared := mgr.oidcManagedProviders[arnA].provider
+	require.NotNil(t, shared)
+	assert.Same(t, shared, mgr.oidcManagedProviders[arnB].provider,
+		"identical records for one issuer built separate replay stores")
+
+	// Removing one record of the pair keeps the shared provider alive.
+	require.NoError(t, store.DeleteProvider(ctx, "", arnA))
+	require.NoError(t, mgr.refreshOIDCProvidersFrom(ctx, store))
+	assert.Same(t, shared, mgr.oidcManagedProviders[arnB].provider,
+		"a removed sibling record shut down the shared provider")
+	assert.True(t, stsKnowsIssuerForAccount(t, mgr, persistTestAPIIssuer, "222222222222"))
+
+	// The remaining record diverging rebuilds its own provider.
+	require.NoError(t, store.StoreProvider(ctx, "", &OIDCProviderRecord{
+		ARN: arnB, URL: persistTestAPIIssuer, AccountID: "222222222222", ClientIDs: []string{"b-aud"},
+	}))
+	require.NoError(t, mgr.refreshOIDCProvidersFrom(ctx, store))
+	assert.NotSame(t, shared, mgr.oidcManagedProviders[arnB].provider,
+		"a changed record kept the shared provider")
+	assert.True(t, stsKnowsIssuerForAccount(t, mgr, persistTestAPIIssuer, "222222222222"))
+}
diff --git a/weed/iam/integration/oidc_provider_store.go b/weed/iam/integration/oidc_provider_store.go
index 1a139d78f9..76ac002d04 100644
--- a/weed/iam/integration/oidc_provider_store.go
+++ b/weed/iam/integration/oidc_provider_store.go
@@ -14,10 +14,14 @@ import (
 	"sync"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 // Sentinel errors returned by the IAM manager and OIDCProviderStore. Callers
@@ -27,6 +31,9 @@ import (
 var (
 	ErrOIDCProviderNotFound      = errors.New("OIDC provider not found")
 	ErrOIDCProviderAlreadyExists = errors.New("OIDC provider already exists")
+	// ErrOIDCProviderStatic refuses a change to a provider defined in the
+	// server's IAM config file: change it there instead.
+	ErrOIDCProviderStatic = errors.New("OIDC provider is defined in the IAM config file")
 )
 
 // OIDCProviderRecord is the persisted, IAM-managed view of an OIDC identity
@@ -84,8 +91,27 @@ type OIDCProviderStore interface {
 	GetProviderByIssuerAndAccount(ctx context.Context, filerAddress string, issuer, accountID string) (*OIDCProviderRecord, error)
 	ListProviders(ctx context.Context, filerAddress string) ([]*OIDCProviderRecord, error)
 	DeleteProvider(ctx context.Context, filerAddress string, arn string) error
+	// UpdateProvider replaces a provider's record with update's result,
+	// atomically: the write or delete happens only against the record update
+	// saw, so a change in between applies update again to what the other
+	// writer left.
+	UpdateProvider(ctx context.Context, filerAddress string, arn string, update OIDCProviderUpdate) error
 }
 
+// OIDCProviderUpdate computes a provider's new record from its current one,
+// nil when the provider does not exist. It returns nil to delete the
+// provider, and an error to leave it unchanged. It may run more than once: it
+// is called again with the fresh record when another writer changed the
+// provider in between.
+type OIDCProviderUpdate func(current *OIDCProviderRecord) (*OIDCProviderRecord, error)
+
+// maxProviderUpdateAttempts bounds UpdateProvider's retries under contention.
+const maxProviderUpdateAttempts = 10
+
+// errProviderUpdateContended is returned when the provider kept changing
+// under UpdateProvider for maxProviderUpdateAttempts reads.
+var errProviderUpdateContended = errors.New("OIDC provider changed concurrently; retry")
+
 // MemoryOIDCProviderStore is a process-local store, suitable for tests and
 // single-node deployments. It also acts as the in-memory cache hydrated from
 // static config at boot.
@@ -181,6 +207,27 @@ func (m *MemoryOIDCProviderStore) DeleteProvider(ctx context.Context, _ string,
 	return nil
 }
 
+// UpdateProvider applies update under the store's lock (filerAddress ignored
+// for the memory store).
+func (m *MemoryOIDCProviderStore) UpdateProvider(ctx context.Context, _ string, arn string, update OIDCProviderUpdate) error {
+	if arn == "" {
+		return fmt.Errorf("ARN is required")
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	next, err := update(copyOIDCProviderRecord(m.providers[arn]))
+	if err != nil {
+		return err
+	}
+	if next == nil {
+		delete(m.providers, arn)
+		return nil
+	}
+	next.ARN = arn
+	m.providers[arn] = copyOIDCProviderRecord(next)
+	return nil
+}
+
 // FilerOIDCProviderStore persists records as JSON files in a filer directory,
 // mirroring FilerRoleStore.
 type FilerOIDCProviderStore struct {
@@ -267,15 +314,20 @@ func (f *FilerOIDCProviderStore) GetProviderByARN(ctx context.Context, filerAddr
 
 	var data []byte
 	err := f.withFilerClient(filerAddress, func(client filer_pb.SeaweedFilerClient) error {
-		resp, err := client.LookupDirectoryEntry(ctx, &filer_pb.LookupDirectoryEntryRequest{
+		resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
 			Directory: f.basePath,
 			Name:      f.fileName(arn),
 		})
+		// Only a confirmed absence is ErrOIDCProviderNotFound: callers create
+		// on it, so an unreachable filer must not read as "no such provider".
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			return fmt.Errorf("%w: %s", ErrOIDCProviderNotFound, arn)
+		}
 		if err != nil {
-			return fmt.Errorf("%w: %v", ErrOIDCProviderNotFound, err)
+			return fmt.Errorf("lookup OIDC provider %s: %w", arn, err)
 		}
 		if resp.Entry == nil {
-			return fmt.Errorf("OIDC provider not found: %s", arn)
+			return fmt.Errorf("%w: %s", ErrOIDCProviderNotFound, arn)
 		}
 		data = resp.Entry.Content
 		return nil
@@ -413,6 +465,130 @@ func (f *FilerOIDCProviderStore) DeleteProvider(ctx context.Context, filerAddres
 	})
 }
 
+// UpdateProvider reads the provider's entry, applies update, and writes the
+// result on the condition that the entry is unchanged since the read —
+// absent, when the provider did not exist — so the filer refuses a write
+// racing another writer's change or delete, and update is applied again to
+// what that writer left. A delete is made on the same condition, so it
+// removes the record update saw and not one written after it.
+func (f *FilerOIDCProviderStore) UpdateProvider(ctx context.Context, filerAddress string, arn string, update OIDCProviderUpdate) error {
+	filerAddress = f.resolveFilerAddress(filerAddress)
+	if filerAddress == "" {
+		return fmt.Errorf("filer address is required")
+	}
+	if arn == "" {
+		return fmt.Errorf("ARN is required")
+	}
+	return f.withFilerClient(filerAddress, func(client filer_pb.SeaweedFilerClient) error {
+		for attempt := 0; attempt < maxProviderUpdateAttempts; attempt++ {
+			var entry *filer_pb.Entry
+			var current *OIDCProviderRecord
+			resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
+				Directory: f.basePath,
+				Name:      f.fileName(arn),
+			})
+			switch {
+			case errors.Is(err, filer_pb.ErrNotFound):
+			case err != nil:
+				return fmt.Errorf("lookup OIDC provider %s: %w", arn, err)
+			case resp.Entry != nil:
+				entry = resp.Entry
+				current = &OIDCProviderRecord{}
+				if err := json.Unmarshal(entry.Content, current); err != nil {
+					return fmt.Errorf("failed to deserialize OIDC provider %s: %v", arn, err)
+				}
+			}
+
+			next, err := update(current)
+			if err != nil {
+				return err
+			}
+			if next == nil {
+				if entry == nil {
+					return nil
+				}
+				deleted, err := f.deleteProviderEntryIfUnchanged(ctx, client, entry)
+				if err != nil {
+					return fmt.Errorf("failed to delete OIDC provider %s: %w", arn, err)
+				}
+				if !deleted {
+					glog.V(3).Infof("OIDC provider %s changed before its delete; retrying", arn)
+					continue
+				}
+				return nil
+			}
+			next.ARN = arn
+			data, err := json.MarshalIndent(next, "", "  ")
+			if err != nil {
+				return fmt.Errorf("failed to serialize OIDC provider %s: %v", arn, err)
+			}
+
+			clause := &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_NOT_EXISTS}
+			if entry != nil {
+				clause = &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_ENTRY_EQUAL, ExpectedEntry: entry}
+			}
+			now := time.Now().Unix()
+			created, err := client.CreateEntry(ctx, &filer_pb.CreateEntryRequest{
+				Directory: f.basePath,
+				Entry: &filer_pb.Entry{
+					Name: f.fileName(arn),
+					Attributes: &filer_pb.FuseAttributes{
+						Mtime:    now,
+						Crtime:   now,
+						FileMode: uint32(0600),
+					},
+					Content: data,
+				},
+				Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{clause}},
+			})
+			if isEntryWriteConflict(created, err) {
+				glog.V(3).Infof("OIDC provider %s changed during update; retrying", arn)
+				continue
+			}
+			if err != nil {
+				return fmt.Errorf("failed to store OIDC provider %s: %v", arn, err)
+			}
+			if created.Error != "" {
+				return fmt.Errorf("failed to store OIDC provider %s: %s", arn, created.Error)
+			}
+			return nil
+		}
+		return fmt.Errorf("update OIDC provider %s: %w", arn, errProviderUpdateContended)
+	})
+}
+
+// deleteProviderEntryIfUnchanged deletes the provider's entry if it still
+// equals entry, reporting false when it changed. The delete is routed and
+// locked as the conditional CreateEntry of the same path is, so the two
+// serialize.
+func (f *FilerOIDCProviderStore) deleteProviderEntryIfUnchanged(ctx context.Context, client filer_pb.SeaweedFilerClient, entry *filer_pb.Entry) (bool, error) {
+	fullPath := f.basePath + "/" + entry.Name
+	resp, err := client.ObjectTransaction(ctx, &filer_pb.ObjectTransactionRequest{
+		LockKey:   fullPath,
+		RequestId: uuid.NewString(),
+		RouteKey:  s3_constants.ObjectWriteRouteKeyPrefix + fullPath,
+		Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{{
+			Kind: filer_pb.WriteCondition_IF_ENTRY_EQUAL, ExpectedEntry: entry,
+		}}},
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type: filer_pb.ObjectMutation_DELETE, Directory: f.basePath, Name: entry.Name, IsDeleteData: true,
+		}},
+	})
+	if err != nil {
+		if status.Code(err) == codes.FailedPrecondition {
+			return false, nil
+		}
+		return false, err
+	}
+	if resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED {
+		return false, nil
+	}
+	if resp.Error != "" {
+		return false, errors.New(resp.Error)
+	}
+	return true, nil
+}
+
 func (f *FilerOIDCProviderStore) withFilerClient(filerAddress string, fn func(filer_pb.SeaweedFilerClient) error) error {
 	return pb.WithGrpcFilerClient(false, 0, pb.ServerAddress(filerAddress), f.grpcDialOption, fn)
 }
diff --git a/weed/iam/integration/role_id_session_binding_test.go b/weed/iam/integration/role_id_session_binding_test.go
new file mode 100644
index 0000000000..8ff209d589
--- /dev/null
+++ b/weed/iam/integration/role_id_session_binding_test.go
@@ -0,0 +1,165 @@
+package integration
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A session is bound to the role it was issued for, not to the role's name:
+// deleting the role ends it, and a role created later under the same name —
+// by whoever may create roles — must not inherit it.
+func TestSessionIsBoundToTheRoleNotItsName(t *testing.T) {
+	ctx := context.Background()
+	m := setupIntegratedIAMSystem(t)
+
+	assume := func() (token, principal string) {
+		resp, err := m.AssumeRoleWithWebIdentity(ctx, &sts.AssumeRoleWithWebIdentityRequest{
+			RoleArn:          "arn:aws:iam::role/S3ReadOnlyRole",
+			WebIdentityToken: createTestJWT(t, "https://test-issuer.com", "test-user-123", "test-signing-key"),
+			RoleSessionName:  "binding-test",
+		})
+		require.NoError(t, err)
+		return resp.Credentials.SessionToken, resp.AssumedRoleUser.Arn
+	}
+	allowed := func(token, principal string) bool {
+		ok, _ := m.IsActionAllowed(ctx, &ActionRequest{
+			Principal:    principal,
+			Action:       "s3:GetObject",
+			Resource:     "arn:aws:s3:::test-bucket/file.txt",
+			SessionToken: token,
+		})
+		return ok
+	}
+
+	original, err := m.GetRole(ctx, "S3ReadOnlyRole")
+	require.NoError(t, err)
+	require.NotEmpty(t, original.RoleId, "a created role has an ID")
+
+	token, principal := assume()
+	require.True(t, allowed(token, principal), "precondition: the session works")
+
+	require.NoError(t, m.DeleteRole(ctx, "S3ReadOnlyRole"))
+	assert.False(t, allowed(token, principal), "the session outlived its role's deletion")
+
+	recreated := *original
+	recreated.RoleId = ""
+	require.NoError(t, m.CreateRole(ctx, "", "S3ReadOnlyRole", &recreated))
+	assert.NotEqual(t, original.RoleId, recreated.RoleId, "a role created again under the same name got the same ID")
+	assert.False(t, allowed(token, principal), "a session of the deleted role works again under a new role of the same name")
+
+	fresh, freshPrincipal := assume()
+	assert.True(t, allowed(fresh, freshPrincipal), "a session issued for the new role is refused")
+}
+
+// A session carries its role's attached policies, and S3 evaluates those
+// rather than looking the role up; the binding must hold on that path too.
+func TestASessionCarryingItsPoliciesIsStillBoundToItsRole(t *testing.T) {
+	ctx := context.Background()
+	m := setupIntegratedIAMSystem(t)
+
+	original, err := m.GetRole(ctx, "S3ReadOnlyRole")
+	require.NoError(t, err)
+	require.NotEmpty(t, original.AttachedPolicies, "precondition: the role attaches a policy")
+	resp, err := m.AssumeRoleWithWebIdentity(ctx, &sts.AssumeRoleWithWebIdentityRequest{
+		RoleArn:          "arn:aws:iam::role/S3ReadOnlyRole",
+		WebIdentityToken: createTestJWT(t, "https://test-issuer.com", "test-user-123", "test-signing-key"),
+		RoleSessionName:  "binding-test",
+	})
+	require.NoError(t, err)
+	allowed := func() bool {
+		ok, _ := m.IsActionAllowed(ctx, &ActionRequest{
+			Principal:    resp.AssumedRoleUser.Arn,
+			Action:       "s3:GetObject",
+			Resource:     "arn:aws:s3:::test-bucket/file.txt",
+			SessionToken: resp.Credentials.SessionToken,
+			PolicyNames:  original.AttachedPolicies,
+		})
+		return ok
+	}
+	require.True(t, allowed(), "precondition: the session works")
+
+	require.NoError(t, m.DeleteRole(ctx, "S3ReadOnlyRole"))
+	assert.False(t, allowed(), "the session's embedded policies outlived its role's deletion")
+
+	recreated := *original
+	recreated.RoleId = ""
+	require.NoError(t, m.CreateRole(ctx, "", "S3ReadOnlyRole", &recreated))
+	assert.False(t, allowed(), "the session's embedded policies work again under a new role of the same name")
+}
+
+func TestStaticRoleIDIsStableAndRuntimeIDsAreUnique(t *testing.T) {
+	trusting := func(principal string) *policy.PolicyDocument {
+		return &policy.PolicyDocument{Version: "2012-10-17", Statement: []policy.Statement{{
+			Effect: "Allow", Action: []string{"sts:AssumeRoleWithWebIdentity"},
+			Principal: map[string]interface{}{"Federated": principal},
+		}}}
+	}
+	app := &RoleDefinition{RoleName: "app", TrustPolicy: trusting("https://a.example")}
+	restarted := &RoleDefinition{RoleName: "app", TrustPolicy: trusting("https://a.example")}
+	replaced := &RoleDefinition{RoleName: "app", TrustPolicy: trusting("https://b.example")}
+
+	assert.Equal(t, StaticRoleID(app), StaticRoleID(restarted), "a config-file role must keep its ID across restarts")
+	assert.NotEqual(t, StaticRoleID(app), StaticRoleID(replaced), "a different role under the same name inherits the old one's ID")
+	assert.NotEqual(t, StaticRoleID(app), StaticRoleID(&RoleDefinition{RoleName: "other", TrustPolicy: trusting("https://a.example")}))
+	assert.Regexp(t, `^AROA[A-Z0-9]{17}$`, StaticRoleID(app))
+	assert.NotEqual(t, NewRoleID(), NewRoleID())
+	assert.Regexp(t, `^AROA[A-Z2-7]{17}$`, NewRoleID())
+}
+
+// replacedAfterFirstReadStore serves the stored role on its first read and a
+// replacement of the same name afterwards: a role replaced while a request
+// is being authorized.
+type replacedAfterFirstReadStore struct {
+	RoleStore
+	reads       int
+	replacement *RoleDefinition
+}
+
+func (s *replacedAfterFirstReadStore) GetRole(ctx context.Context, addr, name string) (*RoleDefinition, error) {
+	s.reads++
+	if s.reads > 1 && name == s.replacement.RoleName {
+		return copyRoleDefinition(s.replacement), nil
+	}
+	return s.RoleStore.GetRole(ctx, addr, name)
+}
+
+// The session's binding is checked against one definition of its role, and
+// that definition's policies are the ones evaluated: a replacement read in
+// between must not lend the session its permissions.
+func TestAuthorizationEvaluatesTheRoleTheBindingCheckSaw(t *testing.T) {
+	ctx := context.Background()
+	m := setupIntegratedIAMSystem(t)
+	require.NoError(t, m.CreatePolicy(ctx, "", "S3WritePolicy", &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{{
+			Effect: "Allow", Action: []string{"s3:PutObject"},
+			Resource: []string{"arn:aws:s3:::test-bucket/*"},
+		}},
+	}))
+	resp, err := m.AssumeRoleWithWebIdentity(ctx, &sts.AssumeRoleWithWebIdentityRequest{
+		RoleArn:          "arn:aws:iam::role/S3ReadOnlyRole",
+		WebIdentityToken: createTestJWT(t, "https://test-issuer.com", "test-user-123", "test-signing-key"),
+		RoleSessionName:  "snapshot-test",
+	})
+	require.NoError(t, err)
+
+	original, err := m.GetRole(ctx, "S3ReadOnlyRole")
+	require.NoError(t, err)
+	replacement := *original
+	replacement.RoleId = NewRoleID()
+	replacement.AttachedPolicies = []string{"S3WritePolicy"}
+	m.roleStore = &replacedAfterFirstReadStore{RoleStore: m.roleStore, replacement: &replacement}
+
+	allowed, _ := m.IsActionAllowed(ctx, &ActionRequest{
+		Principal:    resp.AssumedRoleUser.Arn,
+		Action:       "s3:PutObject",
+		Resource:     "arn:aws:s3:::test-bucket/file.txt",
+		SessionToken: resp.Credentials.SessionToken,
+	})
+	assert.False(t, allowed, "the session was authorized by the replacement role's policies")
+}
diff --git a/weed/iam/integration/role_max_session_test.go b/weed/iam/integration/role_max_session_test.go
index 9f011c71f1..c25d86f22b 100644
--- a/weed/iam/integration/role_max_session_test.go
+++ b/weed/iam/integration/role_max_session_test.go
@@ -6,21 +6,27 @@ func intPtr(v int64) *int64 { return &v }
 
 func TestCapDurationByRole(t *testing.T) {
 	cases := []struct {
-		name      string
-		requested *int64
-		roleMax   int64
-		want      *int64
+		name          string
+		requested     *int64
+		roleMax       int64
+		defaultSec    int64
+		serviceMaxSec int64
+		want          *int64
 	}{
-		{"no cap, no request", nil, 0, nil},
-		{"no cap, with request", intPtr(7200), 0, intPtr(7200)},
-		{"cap only, no request -> nil so STS default applies", nil, 3600, nil},
-		{"request below cap -> request", intPtr(1800), 3600, intPtr(1800)},
-		{"request equal cap -> request", intPtr(3600), 3600, intPtr(3600)},
-		{"request above cap -> cap", intPtr(43200), 3600, intPtr(3600)},
+		{"no cap, no request -> nil keeps service default", nil, 0, 3600, 43200, nil},
+		{"no cap, with request", intPtr(7200), 0, 3600, 43200, intPtr(7200)},
+		{"cap below default, no request -> cap", nil, 1800, 3600, 43200, intPtr(1800)},
+		{"cap above default, no request -> nil", nil, 43200, 3600, 43200, nil},
+		{"request below cap -> request", intPtr(1800), 3600, 900, 43200, intPtr(1800)},
+		{"request equal cap -> request", intPtr(3600), 3600, 900, 43200, intPtr(3600)},
+		{"request above cap -> cap", intPtr(43200), 3600, 900, 43200, intPtr(3600)},
+		{"default above service max -> service cap materialized", nil, 0, 7200, 3600, intPtr(3600)},
+		{"role bound above service max -> service cap still applies", nil, 40000, 43200, 3600, intPtr(3600)},
+		{"role bound below service floor -> tightest issuable", nil, 500, 3600, 43200, intPtr(900)},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			got := capDurationByRole(tc.requested, tc.roleMax)
+			got := capDurationByRole(tc.requested, tc.roleMax, tc.defaultSec, tc.serviceMaxSec)
 			switch {
 			case got == nil && tc.want == nil:
 				return
diff --git a/weed/iam/integration/role_store.go b/weed/iam/integration/role_store.go
index 11fbbb44ed..f418b46dcb 100644
--- a/weed/iam/integration/role_store.go
+++ b/weed/iam/integration/role_store.go
@@ -3,19 +3,52 @@ package integration
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/karlseguin/ccache/v2"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
+// ErrRoleNotFound is wrapped by every RoleStore's GetRole when the role does
+// not exist, so callers can tell a missing role from a store that could not
+// be read.
+var ErrRoleNotFound = errors.New("role not found")
+
+// ErrRoleStatic refuses a change to a role defined in the server's IAM config
+// file: change it there instead.
+var ErrRoleStatic = errors.New("role is defined in the IAM config file")
+
+// ErrRoleExists is returned by an UpdateRole whose update refuses a role that
+// already exists (CreateRole).
+var ErrRoleExists = errors.New("role already exists")
+
+// RoleUpdate computes a role's new definition from its current one, nil when
+// the role does not exist. It returns nil to delete the role, and an error to
+// leave it unchanged. It may run more than once: it is called again with the
+// fresh definition when another writer changed the role in between.
+type RoleUpdate func(current *RoleDefinition) (*RoleDefinition, error)
+
+// maxRoleUpdateAttempts bounds UpdateRole's retries under contention.
+const maxRoleUpdateAttempts = 10
+
+// errRoleUpdateContended is returned when the role kept changing under
+// UpdateRole for maxRoleUpdateAttempts reads.
+var errRoleUpdateContended = errors.New("role changed concurrently; retry")
+
 // RoleStore defines the interface for storing IAM role definitions
 type RoleStore interface {
 	// StoreRole stores a role definition (filerAddress ignored for memory stores)
@@ -29,6 +62,14 @@ type RoleStore interface {
 
 	// DeleteRole deletes a role definition (filerAddress ignored for memory stores)
 	DeleteRole(ctx context.Context, filerAddress string, roleName string) error
+
+	// UpdateRole replaces a role with update's result, atomically: the write
+	// lands only if the role is still as update saw it, absent included, and
+	// update is retried against the current role otherwise. Every change the
+	// IAM API and the filer IAM service make to a role goes through it, so
+	// writers on different servers neither lose each other's changes nor bring
+	// back a role deleted in between.
+	UpdateRole(ctx context.Context, filerAddress string, roleName string, update RoleUpdate) error
 }
 
 // MemoryRoleStore implements RoleStore using in-memory storage
@@ -72,7 +113,7 @@ func (m *MemoryRoleStore) GetRole(ctx context.Context, filerAddress string, role
 
 	role, exists := m.roles[roleName]
 	if !exists {
-		return nil, fmt.Errorf("role not found: %s", roleName)
+		return nil, fmt.Errorf("%w: %s", ErrRoleNotFound, roleName)
 	}
 
 	// Return a copy to prevent external modifications
@@ -105,6 +146,26 @@ func (m *MemoryRoleStore) DeleteRole(ctx context.Context, filerAddress string, r
 	return nil
 }
 
+// UpdateRole applies update under the store's lock (filerAddress ignored for
+// memory store).
+func (m *MemoryRoleStore) UpdateRole(ctx context.Context, filerAddress string, roleName string, update RoleUpdate) error {
+	if roleName == "" {
+		return fmt.Errorf("role name cannot be empty")
+	}
+	m.mutex.Lock()
+	defer m.mutex.Unlock()
+	next, err := update(copyRoleDefinition(m.roles[roleName]))
+	if err != nil {
+		return err
+	}
+	if next == nil {
+		delete(m.roles, roleName)
+		return nil
+	}
+	m.roles[roleName] = copyRoleDefinition(next)
+	return nil
+}
+
 // copyRoleDefinition creates a deep copy of a role definition
 func copyRoleDefinition(original *RoleDefinition) *RoleDefinition {
 	if original == nil {
@@ -112,9 +173,13 @@ func copyRoleDefinition(original *RoleDefinition) *RoleDefinition {
 	}
 
 	copied := &RoleDefinition{
-		RoleName:    original.RoleName,
-		RoleArn:     original.RoleArn,
-		Description: original.Description,
+		RoleName:           original.RoleName,
+		RoleArn:            original.RoleArn,
+		Description:        original.Description,
+		MaxSessionDuration: original.MaxSessionDuration,
+		Source:             original.Source,
+		CreatedAt:          original.CreatedAt,
+		RoleId:             original.RoleId,
 	}
 
 	// Deep copy trust policy if it exists
@@ -135,6 +200,10 @@ func copyRoleDefinition(original *RoleDefinition) *RoleDefinition {
 	return copied
 }
 
+// roleListPageSize is the number of entries FilerRoleStore.ListRoles asks the
+// filer for per page.
+const roleListPageSize = 1000
+
 // FilerRoleStore implements RoleStore using SeaweedFS filer
 type FilerRoleStore struct {
 	grpcDialOption       grpc.DialOption
@@ -213,6 +282,140 @@ func (f *FilerRoleStore) StoreRole(ctx context.Context, filerAddress string, rol
 	})
 }
 
+// UpdateRole reads the role's entry, applies update, and writes the result on
+// the condition that the entry is unchanged since the read — absent, when the
+// role did not exist — so the filer refuses a write racing another writer's
+// change or delete, and update is applied again to what that writer left. A
+// delete is made on the same condition, so it removes the role update saw and
+// not one written after it.
+func (f *FilerRoleStore) UpdateRole(ctx context.Context, filerAddress string, roleName string, update RoleUpdate) error {
+	if filerAddress == "" && f.filerAddressProvider != nil {
+		filerAddress = f.filerAddressProvider()
+	}
+	if filerAddress == "" {
+		return fmt.Errorf("filer address is required for FilerRoleStore")
+	}
+	if roleName == "" {
+		return fmt.Errorf("role name cannot be empty")
+	}
+	return f.withFilerClient(filerAddress, func(client filer_pb.SeaweedFilerClient) error {
+		for attempt := 0; attempt < maxRoleUpdateAttempts; attempt++ {
+			var entry *filer_pb.Entry
+			var current *RoleDefinition
+			resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
+				Directory: f.basePath,
+				Name:      f.getRoleFileName(roleName),
+			})
+			switch {
+			case errors.Is(err, filer_pb.ErrNotFound):
+			case err != nil:
+				return fmt.Errorf("lookup role %s: %w", roleName, err)
+			case resp.Entry != nil:
+				entry = resp.Entry
+				current = &RoleDefinition{}
+				if err := json.Unmarshal(entry.Content, current); err != nil {
+					return fmt.Errorf("failed to deserialize role %s: %v", roleName, err)
+				}
+			}
+
+			next, err := update(current)
+			if err != nil {
+				return err
+			}
+			if next == nil {
+				if entry == nil {
+					return nil
+				}
+				deleted, err := f.deleteRoleEntryIfUnchanged(ctx, client, entry)
+				if err != nil {
+					return fmt.Errorf("failed to delete role %s: %w", roleName, err)
+				}
+				if !deleted {
+					glog.V(3).Infof("Role %s changed before its delete; retrying", roleName)
+					continue
+				}
+				return nil
+			}
+			roleData, err := json.MarshalIndent(next, "", "  ")
+			if err != nil {
+				return fmt.Errorf("failed to serialize role: %v", err)
+			}
+
+			clause := &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_NOT_EXISTS}
+			if entry != nil {
+				clause = &filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_ENTRY_EQUAL, ExpectedEntry: entry}
+			}
+			now := time.Now().Unix()
+			created, err := client.CreateEntry(ctx, &filer_pb.CreateEntryRequest{
+				Directory: f.basePath,
+				Entry: &filer_pb.Entry{
+					Name: f.getRoleFileName(roleName),
+					Attributes: &filer_pb.FuseAttributes{
+						Mtime:    now,
+						Crtime:   now,
+						FileMode: uint32(0600),
+					},
+					Content: roleData,
+				},
+				Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{clause}},
+			})
+			if isEntryWriteConflict(created, err) {
+				glog.V(3).Infof("Role %s changed during update; retrying", roleName)
+				continue
+			}
+			if err != nil {
+				return fmt.Errorf("failed to store role %s: %v", roleName, err)
+			}
+			if created.Error != "" {
+				return fmt.Errorf("failed to store role %s: %s", roleName, created.Error)
+			}
+			return nil
+		}
+		return fmt.Errorf("update role %s: %w", roleName, errRoleUpdateContended)
+	})
+}
+
+// deleteRoleEntryIfUnchanged deletes the role's entry if it still equals
+// entry, reporting false when it changed. The delete is routed and locked as
+// the conditional CreateEntry of the same path is, so the two serialize.
+func (f *FilerRoleStore) deleteRoleEntryIfUnchanged(ctx context.Context, client filer_pb.SeaweedFilerClient, entry *filer_pb.Entry) (bool, error) {
+	fullPath := f.basePath + "/" + entry.Name
+	resp, err := client.ObjectTransaction(ctx, &filer_pb.ObjectTransactionRequest{
+		LockKey:   fullPath,
+		RequestId: uuid.NewString(),
+		RouteKey:  s3_constants.ObjectWriteRouteKeyPrefix + fullPath,
+		Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{{
+			Kind: filer_pb.WriteCondition_IF_ENTRY_EQUAL, ExpectedEntry: entry,
+		}}},
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type: filer_pb.ObjectMutation_DELETE, Directory: f.basePath, Name: entry.Name, IsDeleteData: true,
+		}},
+	})
+	if err != nil {
+		if status.Code(err) == codes.FailedPrecondition {
+			return false, nil
+		}
+		return false, err
+	}
+	if resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED {
+		return false, nil
+	}
+	if resp.Error != "" {
+		return false, errors.New(resp.Error)
+	}
+	return true, nil
+}
+
+// isEntryWriteConflict reports a write the filer refused because its condition
+// no longer held: in the response, or as FailedPrecondition when the write
+// was forwarded to the entry's owner filer.
+func isEntryWriteConflict(resp *filer_pb.CreateEntryResponse, err error) bool {
+	if err != nil {
+		return status.Code(err) == codes.FailedPrecondition
+	}
+	return resp != nil && resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED
+}
+
 // GetRole retrieves a role definition from filer
 func (f *FilerRoleStore) GetRole(ctx context.Context, filerAddress string, roleName string) (*RoleDefinition, error) {
 	// Use provider function if filerAddress is not provided
@@ -234,13 +437,16 @@ func (f *FilerRoleStore) GetRole(ctx context.Context, filerAddress string, roleN
 		}
 
 		glog.V(3).Infof("Looking up role %s", roleName)
-		response, err := client.LookupDirectoryEntry(ctx, request)
+		response, err := filer_pb.LookupEntry(ctx, client, request)
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			return fmt.Errorf("%w: %s", ErrRoleNotFound, roleName)
+		}
 		if err != nil {
-			return fmt.Errorf("role not found: %v", err)
+			return fmt.Errorf("lookup role %s: %w", roleName, err)
 		}
 
 		if response.Entry == nil {
-			return fmt.Errorf("role not found")
+			return fmt.Errorf("%w: %s", ErrRoleNotFound, roleName)
 		}
 
 		roleData = response.Entry.Content
@@ -270,46 +476,50 @@ func (f *FilerRoleStore) ListRoles(ctx context.Context, filerAddress string) ([]
 		return nil, fmt.Errorf("filer address is required for FilerRoleStore")
 	}
 
+	// Page through the directory, and fail on a broken stream rather than
+	// return what arrived: a truncated list would let DeletePolicy miss a role
+	// that still attaches the policy (RolesAttachingPolicy).
 	var roleNames []string
-
 	err := f.withFilerClient(filerAddress, func(client filer_pb.SeaweedFilerClient) error {
-		request := &filer_pb.ListEntriesRequest{
-			Directory:          f.basePath,
-			Prefix:             "",
-			StartFromFileName:  "",
-			InclusiveStartFrom: false,
-			Limit:              1000, // Process in batches of 1000
-		}
-
 		glog.V(3).Infof("Listing roles in %s", f.basePath)
-		stream, err := client.ListEntries(ctx, request)
-		if err != nil {
-			return fmt.Errorf("failed to list roles: %v", err)
-		}
-
+		startFrom := ""
 		for {
-			resp, err := stream.Recv()
+			stream, err := client.ListEntries(ctx, &filer_pb.ListEntriesRequest{
+				Directory:         f.basePath,
+				StartFromFileName: startFrom,
+				Limit:             roleListPageSize,
+			})
 			if err != nil {
-				break // End of stream or error
+				return err
 			}
-
-			if resp.Entry == nil || resp.Entry.IsDirectory {
-				continue
+			received := 0
+			for {
+				resp, err := stream.Recv()
+				if errors.Is(err, io.EOF) {
+					break
+				}
+				if err != nil {
+					return err
+				}
+				if resp.Entry == nil {
+					continue
+				}
+				received++
+				startFrom = resp.Entry.Name
+				if resp.Entry.IsDirectory {
+					continue
+				}
+				if name, ok := strings.CutSuffix(resp.Entry.Name, ".json"); ok {
+					roleNames = append(roleNames, name)
+				}
 			}
-
-			// Extract role name from filename
-			filename := resp.Entry.Name
-			if strings.HasSuffix(filename, ".json") {
-				roleName := strings.TrimSuffix(filename, ".json")
-				roleNames = append(roleNames, roleName)
+			if received < roleListPageSize {
+				return nil
 			}
 		}
-
-		return nil
 	})
-
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("failed to list roles: %w", err)
 	}
 
 	return roleNames, nil
@@ -388,3 +598,146 @@ type CachedFilerRoleStoreConfig struct {
 	ListTTL      string `json:"listTtl,omitempty"`      // e.g., "1m", "30s"
 	MaxCacheSize int    `json:"maxCacheSize,omitempty"` // Maximum number of cached roles
 }
+
+// RolesAttachingPolicy returns the names of the roles that attach the policy.
+// A policy is attached to a role by name, so deleting it while attached would
+// let a policy created later under the same name take effect on the role;
+// callers refuse the delete instead, as AWS does (DeleteConflict).
+//
+// It sees the stored roles, which every server sharing the store sees, and
+// this server's config-file roles. A role defined only in another server's
+// config file is invisible here: servers sharing a role store may have
+// different config files, but a config-file role that attaches a managed
+// (API-created) policy is protected only on the servers whose file defines it.
+// Keep such roles in every server's file, or attach only config-file policies
+// to config-file roles.
+func RolesAttachingPolicy(ctx context.Context, store RoleStore, policyName string) ([]string, error) {
+	names, err := store.ListRoles(ctx, "")
+	if err != nil {
+		return nil, fmt.Errorf("list roles: %w", err)
+	}
+	var attaching []string
+	for _, name := range names {
+		role, err := store.GetRole(ctx, "", name)
+		if errors.Is(err, ErrRoleNotFound) {
+			continue // deleted between list and read
+		}
+		if err != nil {
+			return nil, fmt.Errorf("get role %s: %w", name, err)
+		}
+		for _, attached := range role.AttachedPolicies {
+			if attached == policyName {
+				attaching = append(attaching, name)
+				break
+			}
+		}
+	}
+	return attaching, nil
+}
+
+// MaxManagedPoliciesPerRole caps the managed policies attached to one role,
+// as AWS's default quota does (and as MaxManagedPoliciesPerUser does for users).
+const MaxManagedPoliciesPerRole = 10
+
+var roleNamePattern = regexp.MustCompile(`^[\w+=,.@-]{1,64}$`)
+
+// ValidateRoleName checks a role name against AWS's rules. A role is stored as
+// <name>.json in the filer, so the rules also keep a name from leaving the
+// role store's directory.
+func ValidateRoleName(name string) error {
+	if !roleNamePattern.MatchString(name) {
+		return fmt.Errorf("invalid role name %q: must be 1-64 characters of letters, digits and +=,.@_-", name)
+	}
+	return nil
+}
+
+// staticRoleOverlay serves the IAM config file's roles from memory beside a
+// persistent store, which never holds them (see IAMManager.LoadStaticRoles).
+// A role stored under the same name takes precedence, as a stored OIDC
+// provider does over a config-file one; deleting it brings the config-file
+// role back. A config-file role itself cannot be stored over or deleted.
+type staticRoleOverlay struct {
+	static map[string]*RoleDefinition
+	inner  RoleStore
+}
+
+// storedRoleExists reports whether the store itself holds the role.
+func (o *staticRoleOverlay) storedRoleExists(ctx context.Context, filerAddress, roleName string) (bool, error) {
+	_, err := o.inner.GetRole(ctx, filerAddress, roleName)
+	if errors.Is(err, ErrRoleNotFound) {
+		return false, nil
+	}
+	return err == nil, err
+}
+
+func (o *staticRoleOverlay) StoreRole(ctx context.Context, filerAddress string, roleName string, role *RoleDefinition) error {
+	if _, ok := o.static[roleName]; ok {
+		stored, err := o.storedRoleExists(ctx, filerAddress, roleName)
+		if err != nil {
+			return err
+		}
+		if !stored {
+			return fmt.Errorf("%w: %s", ErrRoleStatic, roleName)
+		}
+	}
+	return o.inner.StoreRole(ctx, filerAddress, roleName, role)
+}
+
+// UpdateRole refuses to create a stored role over a config-file role, as
+// StoreRole does; a stored role of that name may be changed.
+func (o *staticRoleOverlay) UpdateRole(ctx context.Context, filerAddress string, roleName string, update RoleUpdate) error {
+	_, static := o.static[roleName]
+	return o.inner.UpdateRole(ctx, filerAddress, roleName, func(current *RoleDefinition) (*RoleDefinition, error) {
+		if current == nil && static {
+			return nil, fmt.Errorf("%w: %s", ErrRoleStatic, roleName)
+		}
+		return update(current)
+	})
+}
+
+func (o *staticRoleOverlay) GetRole(ctx context.Context, filerAddress string, roleName string) (*RoleDefinition, error) {
+	role, err := o.inner.GetRole(ctx, filerAddress, roleName)
+	if errors.Is(err, ErrRoleNotFound) {
+		if static, ok := o.static[roleName]; ok {
+			return copyRoleDefinition(static), nil
+		}
+	}
+	return role, err
+}
+
+func (o *staticRoleOverlay) ListRoles(ctx context.Context, filerAddress string) ([]string, error) {
+	names, err := o.inner.ListRoles(ctx, filerAddress)
+	if err != nil {
+		return nil, err
+	}
+	seen := make(map[string]bool, len(names))
+	for _, name := range names {
+		seen[name] = true
+	}
+	for name := range o.static {
+		if !seen[name] {
+			names = append(names, name)
+		}
+	}
+	return names, nil
+}
+
+func (o *staticRoleOverlay) DeleteRole(ctx context.Context, filerAddress string, roleName string) error {
+	if _, ok := o.static[roleName]; ok {
+		stored, err := o.storedRoleExists(ctx, filerAddress, roleName)
+		if err != nil {
+			return err
+		}
+		if !stored {
+			return fmt.Errorf("%w: %s", ErrRoleStatic, roleName)
+		}
+	}
+	return o.inner.DeleteRole(ctx, filerAddress, roleName)
+}
+
+// ClearCache forwards cache invalidation to the store underneath.
+func (o *staticRoleOverlay) ClearCache() {
+	if cached, ok := o.inner.(interface{ ClearCache() }); ok {
+		cached.ClearCache()
+	}
+}
diff --git a/weed/iam/integration/role_store_filer_test.go b/weed/iam/integration/role_store_filer_test.go
new file mode 100644
index 0000000000..193b52eddc
--- /dev/null
+++ b/weed/iam/integration/role_store_filer_test.go
@@ -0,0 +1,286 @@
+package integration
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"slices"
+	"sort"
+	"strconv"
+	"sync"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// roleStoreTestFiler is a filer holding one directory. It evaluates the write
+// conditions FilerRoleStore sends as the filer does, and can run another
+// writer between a role's read and its write (afterLookup) or break a listing
+// stream partway (failListAfter).
+type roleStoreTestFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	mu            sync.Mutex
+	entries       map[string]*filer_pb.Entry
+	afterLookup   func()
+	failListAfter int
+}
+
+func (s *roleStoreTestFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	s.mu.Lock()
+	entry, found := s.entries[req.Name]
+	hook := s.afterLookup
+	s.afterLookup = nil
+	s.mu.Unlock()
+	if hook != nil {
+		defer hook()
+	}
+	if !found {
+		return nil, status.Error(codes.NotFound, filer_pb.ErrNotFound.Error())
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: proto.Clone(entry).(*filer_pb.Entry)}, nil
+}
+
+func (s *roleStoreTestFiler) CreateEntry(_ context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	current, exists := s.entries[req.Entry.Name]
+	for _, c := range req.GetCondition().GetClauses() {
+		var ok bool
+		switch c.Kind {
+		case filer_pb.WriteCondition_IF_NOT_EXISTS:
+			ok = !exists
+		case filer_pb.WriteCondition_IF_ENTRY_EQUAL:
+			ok = exists && proto.Equal(current, c.ExpectedEntry)
+		default:
+			return nil, fmt.Errorf("unexpected condition %v", c.Kind)
+		}
+		if !ok {
+			return &filer_pb.CreateEntryResponse{Error: "precondition failed", ErrorCode: filer_pb.FilerError_PRECONDITION_FAILED}, nil
+		}
+	}
+	s.entries[req.Entry.Name] = proto.Clone(req.Entry).(*filer_pb.Entry)
+	return &filer_pb.CreateEntryResponse{}, nil
+}
+
+// ObjectTransaction applies the conditional delete FilerRoleStore sends.
+func (s *roleStoreTestFiler) ObjectTransaction(_ context.Context, req *filer_pb.ObjectTransactionRequest) (*filer_pb.ObjectTransactionResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if len(req.Mutations) != 1 || req.Mutations[0].Type != filer_pb.ObjectMutation_DELETE {
+		return nil, fmt.Errorf("unexpected mutations %v", req.Mutations)
+	}
+	name := req.Mutations[0].Name
+	current, exists := s.entries[name]
+	for _, c := range req.GetCondition().GetClauses() {
+		if c.Kind != filer_pb.WriteCondition_IF_ENTRY_EQUAL {
+			return nil, fmt.Errorf("unexpected condition %v", c.Kind)
+		}
+		if !exists || !proto.Equal(current, c.ExpectedEntry) {
+			return &filer_pb.ObjectTransactionResponse{Error: "precondition failed", ErrorCode: filer_pb.FilerError_PRECONDITION_FAILED}, nil
+		}
+	}
+	delete(s.entries, name)
+	return &filer_pb.ObjectTransactionResponse{}, nil
+}
+
+func (s *roleStoreTestFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream grpc.ServerStreamingServer[filer_pb.ListEntriesResponse]) error {
+	s.mu.Lock()
+	var names []string
+	for name := range s.entries {
+		if name > req.StartFromFileName {
+			names = append(names, name)
+		}
+	}
+	sort.Strings(names)
+	if req.Limit > 0 && len(names) > int(req.Limit) {
+		names = names[:req.Limit]
+	}
+	page := make([]*filer_pb.Entry, 0, len(names))
+	for _, name := range names {
+		page = append(page, proto.Clone(s.entries[name]).(*filer_pb.Entry))
+	}
+	failAfter := s.failListAfter
+	s.mu.Unlock()
+	for i, entry := range page {
+		if failAfter > 0 && i == failAfter {
+			return status.Error(codes.Unavailable, "filer went away")
+		}
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: entry}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (s *roleStoreTestFiler) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.entries, req.Name)
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+func newTestFilerRoleStore(t *testing.T) (*FilerRoleStore, *roleStoreTestFiler) {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	filer := &roleStoreTestFiler{entries: map[string]*filer_pb.Entry{}}
+	server := pb.NewGrpcServer()
+	filer_pb.RegisterSeaweedFilerServer(server, filer)
+	go func() { _ = server.Serve(lis) }()
+	t.Cleanup(func() {
+		server.Stop()
+		_ = lis.Close()
+	})
+	host, port, err := net.SplitHostPort(lis.Addr().String())
+	require.NoError(t, err)
+	grpcPort, err := strconv.Atoi(port)
+	require.NoError(t, err)
+	store, err := NewFilerRoleStore(nil, func() string { return string(pb.NewServerAddress(host, 1, grpcPort)) })
+	require.NoError(t, err)
+	store.grpcDialOption = grpc.WithTransportCredentials(insecure.NewCredentials())
+	return store, filer
+}
+
+func attachPolicy(policyName string) RoleUpdate {
+	return func(current *RoleDefinition) (*RoleDefinition, error) {
+		if current == nil {
+			return nil, ErrRoleNotFound
+		}
+		current.AttachedPolicies = append(current.AttachedPolicies, policyName)
+		return current, nil
+	}
+}
+
+func createRole(roleID string) RoleUpdate {
+	return func(current *RoleDefinition) (*RoleDefinition, error) {
+		if current != nil {
+			return nil, ErrRoleExists
+		}
+		return &RoleDefinition{RoleName: "app", RoleId: roleID}, nil
+	}
+}
+
+// Two servers changing one role: the change written second is applied to
+// what the first left, not to the role as it read it.
+func TestFilerRoleUpdateIsNotLostToAConcurrentChange(t *testing.T) {
+	ctx := context.Background()
+	store, filer := newTestFilerRoleStore(t)
+	require.NoError(t, store.UpdateRole(ctx, "", "app", createRole("AROA1")))
+
+	filer.afterLookup = func() { assert.NoError(t, store.UpdateRole(ctx, "", "app", attachPolicy("peer"))) }
+	require.NoError(t, store.UpdateRole(ctx, "", "app", attachPolicy("mine")))
+
+	role, err := store.GetRole(ctx, "", "app")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"peer", "mine"}, role.AttachedPolicies, "one server's change was lost")
+}
+
+// A change racing a delete must not write the role back.
+func TestFilerRoleUpdateDoesNotReviveADeletedRole(t *testing.T) {
+	ctx := context.Background()
+	store, filer := newTestFilerRoleStore(t)
+	require.NoError(t, store.UpdateRole(ctx, "", "app", createRole("AROA1")))
+
+	filer.afterLookup = func() { assert.NoError(t, store.DeleteRole(ctx, "", "app")) }
+	err := store.UpdateRole(ctx, "", "app", attachPolicy("mine"))
+	assert.ErrorIs(t, err, ErrRoleNotFound)
+
+	_, err = store.GetRole(ctx, "", "app")
+	assert.ErrorIs(t, err, ErrRoleNotFound, "the deleted role was written back")
+}
+
+// Of two creates of one name, the second sees the first's role.
+func TestFilerRoleCreateRefusesARoleCreatedConcurrently(t *testing.T) {
+	ctx := context.Background()
+	store, filer := newTestFilerRoleStore(t)
+
+	filer.afterLookup = func() { assert.NoError(t, store.UpdateRole(ctx, "", "app", createRole("AROA-FIRST"))) }
+	err := store.UpdateRole(ctx, "", "app", createRole("AROA-SECOND"))
+	assert.ErrorIs(t, err, ErrRoleExists)
+
+	role, err := store.GetRole(ctx, "", "app")
+	require.NoError(t, err)
+	assert.Equal(t, "AROA-FIRST", role.RoleId, "the second create replaced the first role")
+}
+
+var errRoleHasPolicies = errors.New("role has attached policies")
+
+// deleteUnattached deletes the role only if it attaches no policy, as
+// DeleteRole requires.
+func deleteUnattached(current *RoleDefinition) (*RoleDefinition, error) {
+	if current == nil {
+		return nil, ErrRoleNotFound
+	}
+	if len(current.AttachedPolicies) > 0 {
+		return nil, errRoleHasPolicies
+	}
+	return nil, nil
+}
+
+func TestFilerRoleUpdateCanDeleteTheRole(t *testing.T) {
+	ctx := context.Background()
+	store, _ := newTestFilerRoleStore(t)
+	require.NoError(t, store.UpdateRole(ctx, "", "app", createRole("AROA1")))
+
+	require.NoError(t, store.UpdateRole(ctx, "", "app", deleteUnattached))
+	_, err := store.GetRole(ctx, "", "app")
+	assert.ErrorIs(t, err, ErrRoleNotFound)
+}
+
+// A delete is decided against the role it removes: a policy attached between
+// the check and the delete makes it refuse, not delete the role anyway.
+func TestFilerRoleDeleteIsDecidedAgainstTheRoleItRemoves(t *testing.T) {
+	ctx := context.Background()
+	store, filer := newTestFilerRoleStore(t)
+	require.NoError(t, store.UpdateRole(ctx, "", "app", createRole("AROA1")))
+
+	filer.afterLookup = func() { assert.NoError(t, store.UpdateRole(ctx, "", "app", attachPolicy("peer"))) }
+	err := store.UpdateRole(ctx, "", "app", deleteUnattached)
+	assert.ErrorIs(t, err, errRoleHasPolicies)
+
+	role, err := store.GetRole(ctx, "", "app")
+	require.NoError(t, err, "the role was deleted although a policy was attached to it")
+	assert.Equal(t, []string{"peer"}, role.AttachedPolicies)
+}
+
+func TestFilerRoleListingPagesPastTheFirstThousand(t *testing.T) {
+	store, filer := newTestFilerRoleStore(t)
+	for i := range roleListPageSize + 1 {
+		name := fmt.Sprintf("role-%04d.json", i)
+		filer.entries[name] = &filer_pb.Entry{Name: name}
+	}
+	filer.entries["role-0500"] = &filer_pb.Entry{Name: "role-0500", IsDirectory: true}
+
+	names, err := store.ListRoles(context.Background(), "")
+	require.NoError(t, err)
+	assert.Len(t, names, roleListPageSize+1)
+	assert.True(t, slices.Contains(names, fmt.Sprintf("role-%04d", roleListPageSize)), "the role past the first page is missing")
+}
+
+// A listing cut short must fail: DeletePolicy decides from it whether any
+// role still attaches the policy.
+func TestFilerRoleListingFailsOnABrokenStream(t *testing.T) {
+	store, filer := newTestFilerRoleStore(t)
+	for i := range 5 {
+		name := fmt.Sprintf("role-%d.json", i)
+		filer.entries[name] = &filer_pb.Entry{Name: name}
+	}
+	filer.failListAfter = 3
+
+	_, err := store.ListRoles(context.Background(), "")
+	require.Error(t, err, "a partial listing was returned as complete")
+
+	attaching, err := RolesAttachingPolicy(context.Background(), store, "read")
+	assert.Error(t, err)
+	assert.Nil(t, attaching)
+	assert.False(t, errors.Is(err, ErrRoleNotFound))
+}
diff --git a/weed/iam/integration/role_store_notfound_test.go b/weed/iam/integration/role_store_notfound_test.go
new file mode 100644
index 0000000000..02bf02beda
--- /dev/null
+++ b/weed/iam/integration/role_store_notfound_test.go
@@ -0,0 +1,14 @@
+package integration
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+func TestMemoryRoleStoreWrapsErrRoleNotFound(t *testing.T) {
+	_, err := NewMemoryRoleStore().GetRole(context.Background(), "", "missing")
+	if !errors.Is(err, ErrRoleNotFound) {
+		t.Fatalf("missing role error does not wrap ErrRoleNotFound: %v", err)
+	}
+}
diff --git a/weed/iam/integration/role_store_persist_test.go b/weed/iam/integration/role_store_persist_test.go
new file mode 100644
index 0000000000..8293dfc3e6
--- /dev/null
+++ b/weed/iam/integration/role_store_persist_test.go
@@ -0,0 +1,196 @@
+package integration
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// persistentTestRoleStore stands in for a role store that outlives the process
+// and may be shared (the filer store): anything but *MemoryRoleStore is
+// treated as persistent.
+type persistentTestRoleStore struct {
+	*MemoryRoleStore
+	cleared int
+}
+
+func (s *persistentTestRoleStore) ClearCache() { s.cleared++ }
+
+// startRoleServer initializes a manager as an S3 server would at boot, with the
+// given role store and config file roles.
+func startRoleServer(t *testing.T, store RoleStore, staticRoles ...string) *IAMManager {
+	t.Helper()
+	mgr := NewIAMManager()
+	require.NoError(t, mgr.Initialize(persistTestConfig(), func() string { return "localhost:8888" }))
+	mgr.roleStore = store
+	var defs []*RoleDefinition
+	for _, name := range staticRoles {
+		defs = append(defs, &RoleDefinition{RoleName: name})
+	}
+	mgr.LoadStaticRoles(context.Background(), defs)
+	return mgr
+}
+
+func roleNames(t *testing.T, store RoleStore) map[string]bool {
+	t.Helper()
+	names, err := store.ListRoles(context.Background(), "")
+	require.NoError(t, err)
+	out := map[string]bool{}
+	for _, n := range names {
+		out[n] = true
+	}
+	return out
+}
+
+// A persistent store never receives the config file's roles: it outlives the
+// file and may be shared with servers whose files differ.
+func TestPersistentRoleStoreNeverHoldsConfigFileRoles(t *testing.T) {
+	store := &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}
+	mgr := startRoleServer(t, store, "from-file")
+
+	assert.Empty(t, roleNames(t, store), "a config-file role was written to the persistent store")
+	assert.True(t, roleNames(t, mgr.GetRoleStore())["from-file"], "the config-file role is not listed")
+	role, err := mgr.GetRole(context.Background(), "from-file")
+	require.NoError(t, err)
+	assert.Equal(t, RoleSourceStaticConfig, role.Source)
+	assert.Equal(t, StaticRoleID(&RoleDefinition{RoleName: "from-file"}), role.RoleId)
+}
+
+// Servers sharing a store, with different config files, must not remove or
+// replace each other's roles — including a zero-config server.
+func TestServersSharingARoleStoreKeepEachOthersRoles(t *testing.T) {
+	store := &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}
+	configured := startRoleServer(t, store, "from-file")
+	require.NoError(t, configured.CreateRole(context.Background(), "", "created-at-runtime", &RoleDefinition{}))
+
+	zeroConfig := startRoleServer(t, store)
+
+	assert.True(t, roleNames(t, store)["created-at-runtime"], "a peer's start removed a role created at runtime")
+	assert.True(t, roleNames(t, configured.GetRoleStore())["from-file"], "the configured server lost its config-file role")
+	_, err := zeroConfig.GetRole(context.Background(), "from-file")
+	assert.ErrorIs(t, err, ErrRoleNotFound, "a server sees a role only its peer's config file defines")
+	_, err = zeroConfig.GetRole(context.Background(), "created-at-runtime")
+	assert.NoError(t, err, "the peer does not see the shared role created at runtime")
+}
+
+// Removing a role from the config file removes it at the next start.
+func TestRemovingARoleFromTheConfigFileRemovesIt(t *testing.T) {
+	store := &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}
+	startRoleServer(t, store, "from-file")
+
+	restarted := startRoleServer(t, store) // the file no longer lists it
+
+	_, err := restarted.GetRole(context.Background(), "from-file")
+	assert.ErrorIs(t, err, ErrRoleNotFound, "a role removed from the config file is still served")
+}
+
+// The store refuses to replace or delete a role the config file defines; the
+// file is where it changes.
+func TestConfigFileRolesCannotBeReplacedOrDeletedThroughTheStore(t *testing.T) {
+	store := &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}
+	mgr := startRoleServer(t, store, "from-file")
+
+	err := mgr.CreateRole(context.Background(), "", "from-file", &RoleDefinition{})
+	assert.ErrorIs(t, err, ErrRoleStatic)
+	assert.ErrorIs(t, mgr.DeleteRole(context.Background(), "from-file"), ErrRoleStatic)
+	assert.Empty(t, roleNames(t, store), "a refused change still wrote to the store")
+}
+
+// An in-memory store keeps its behaviour: the config file's roles are records
+// in it.
+func TestInMemoryRoleStoreStillHoldsConfigFileRoles(t *testing.T) {
+	store := NewMemoryRoleStore()
+	startRoleServer(t, store, "from-file")
+	assert.True(t, roleNames(t, store)["from-file"])
+}
+
+// Invalidating the role cache reaches the store beneath the config-file roles.
+func TestRoleCacheInvalidationReachesTheStoreBeneathTheOverlay(t *testing.T) {
+	store := &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}
+	mgr := startRoleServer(t, store, "from-file")
+	mgr.InvalidateRoleCache()
+	assert.Equal(t, 1, store.cleared)
+}
+
+func TestRoleCopiesKeepSource(t *testing.T) {
+	role := &RoleDefinition{RoleName: "r", Source: RoleSourceStaticConfig}
+	assert.Equal(t, RoleSourceStaticConfig, copyRoleDefinition(role).Source)
+	assert.Equal(t, RoleSourceStaticConfig, genericCopyRoleDefinition(role).Source)
+}
+
+// Config-file roles report no creation time: a time taken at load would
+// change with every restart.
+func TestConfigFileRolesReportNoCreationTime(t *testing.T) {
+	for name, store := range map[string]RoleStore{
+		"persistent": &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()},
+		"in-memory":  NewMemoryRoleStore(),
+	} {
+		t.Run(name, func(t *testing.T) {
+			mgr := startRoleServer(t, store, "from-file")
+			role, err := mgr.GetRole(context.Background(), "from-file")
+			require.NoError(t, err)
+			assert.True(t, role.CreatedAt.IsZero())
+		})
+	}
+}
+
+// A role stored under a config-file role's name takes precedence, as a stored
+// OIDC provider does; it can be changed, and deleting it brings the
+// config-file role back.
+func TestStoredRoleTakesPrecedenceOverTheConfigFileOne(t *testing.T) {
+	ctx := context.Background()
+	store := &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}
+	configured := startRoleServer(t, store, "shared-name")
+	peer := startRoleServer(t, store)
+	require.NoError(t, peer.CreateRole(ctx, "", "shared-name", &RoleDefinition{Description: "stored"}))
+
+	role, err := configured.GetRole(ctx, "shared-name")
+	require.NoError(t, err)
+	assert.Equal(t, "stored", role.Description, "the config-file role hides the stored one")
+
+	role.Description = "changed"
+	assert.NoError(t, configured.CreateRole(ctx, "", "shared-name", role), "the stored role cannot be changed")
+
+	require.NoError(t, configured.DeleteRole(ctx, "shared-name"))
+	role, err = configured.GetRole(ctx, "shared-name")
+	require.NoError(t, err)
+	assert.Equal(t, RoleSourceStaticConfig, role.Source, "deleting the stored role did not bring the config-file one back")
+}
+
+// A store installed through SetRoleStore behaves like one installed at
+// startup: the config-file roles stay visible and protected, and it serves
+// the roles it holds.
+func TestSetRoleStoreInstallsLikeStartup(t *testing.T) {
+	mgr := startRoleServer(t, &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}, "from-file")
+
+	store := &persistentTestRoleStore{MemoryRoleStore: NewMemoryRoleStore()}
+	require.NoError(t, store.StoreRole(context.Background(), "", "stored", &RoleDefinition{RoleName: "stored"}))
+	mgr.SetRoleStore(store)
+
+	names := roleNames(t, mgr.GetRoleStore())
+	assert.True(t, names["from-file"], "the config-file role is no longer listed")
+	assert.True(t, names["stored"], "the new store's role is not listed")
+	assert.ErrorIs(t, mgr.GetRoleStore().DeleteRole(context.Background(), "", "from-file"), ErrRoleStatic)
+	assert.False(t, roleNames(t, store)["from-file"], "the config-file role was written into the new store")
+}
+
+// S3 servers watch the directory a filer-backed role store keeps roles in, so
+// a store configured with its own basePath must report it, through the
+// cache and the config-file overlay alike.
+func TestRoleStoreDirectoryIsTheConfiguredBasePath(t *testing.T) {
+	provider := func() string { return "localhost:8888" }
+	cached, err := NewGenericCachedRoleStore(map[string]interface{}{"basePath": "/custom/roles"}, provider)
+	require.NoError(t, err)
+	mgr := startRoleServer(t, cached, "from-file")
+	assert.Equal(t, "/custom/roles", mgr.RoleStoreDirectory())
+
+	uncached, err := NewFilerRoleStore(nil, provider)
+	require.NoError(t, err)
+	mgr.SetRoleStore(uncached)
+	assert.Equal(t, "/etc/iam/roles", mgr.RoleStoreDirectory())
+
+	mgr.SetRoleStore(NewMemoryRoleStore())
+	assert.Empty(t, mgr.RoleStoreDirectory(), "a memory store has no directory")
+}
diff --git a/weed/iam/integration/session_revocation.go b/weed/iam/integration/session_revocation.go
index 4b584de9a4..5faffefa58 100644
--- a/weed/iam/integration/session_revocation.go
+++ b/weed/iam/integration/session_revocation.go
@@ -235,11 +235,7 @@ func (f *FilerSessionRevocationStore) Purge(ctx context.Context, filerAddress st
 				if entry.ExpiresAt.IsZero() || entry.ExpiresAt.After(before) {
 					continue
 				}
-				if _, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-					Directory:    f.basePath,
-					Name:         resp.Entry.Name,
-					IsDeleteData: true,
-				}); err == nil {
+				if err := filer_pb.DoRemove(ctx, client, f.basePath, resp.Entry.Name, true, false, false, false, nil); err == nil {
 					count++
 				}
 			}
diff --git a/weed/iam/oidc/jti_cache.go b/weed/iam/oidc/jti_cache.go
new file mode 100644
index 0000000000..77dab0d044
--- /dev/null
+++ b/weed/iam/oidc/jti_cache.go
@@ -0,0 +1,410 @@
+package oidc
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/iam/providers"
+)
+
+const (
+	// clockSkewTolerance matches the typical JWT library clock skew allowance (RFC 7519)
+	clockSkewTolerance = 5 * time.Minute
+	// defaultJTICacheSize is the default maximum number of JTI entries to cache
+	defaultJTICacheSize = 10000
+	// defaultCleanupInterval is how often to scan for expired JTI entries
+	defaultCleanupInterval = 5 * time.Minute
+	// eagerCleanupMinInterval rate limits opportunistic sweeps near capacity
+	eagerCleanupMinInterval = 5 * time.Second
+	// tokenFingerprintPrefix marks replay-cache keys derived from the token's
+	// own fingerprint, used when the token carries no usable jti claim
+	tokenFingerprintPrefix = "fp:"
+)
+
+// jtiEntry represents a cached JTI with metadata
+type jtiEntry struct {
+	subject   string
+	expiresAt time.Time
+	// uncounted marks an entry merged in past the capacity bound: it keeps
+	// rejecting replays but does not charge the count, so merged excess can
+	// neither reject new exchanges nor be double-counted when swept.
+	uncounted bool
+}
+
+// jtiReplayCache wraps the consumed-token store that backs JTI replay
+// protection. Each consumed token identifier is held until the token's exp
+// plus clock skew, and a second presentation of the same identifier is
+// rejected with ErrProviderTokenReplayed.
+//
+// The cache is bounded by maxSize and uses automatic TTL-based expiration:
+// a background worker sweeps expired entries, an eager sweep runs when the
+// cache nears capacity, and the consume path reclaims expired slots before
+// rejecting a fresh token for capacity.
+//
+// Thread Safety:
+// All methods are safe for concurrent use. The consume path uses atomic
+// LoadOrStore to prevent TOCTOU races.
+type jtiReplayCache struct {
+	name string // owning provider name, for log messages
+
+	enabled   atomic.Bool
+	maxSize   atomic.Int64
+	lastSweep atomic.Int64 // unix nano of the last sweep; rate limits eager cleanups
+
+	// storeMu guards the store/count pair: replay-state handoffs (adoptFrom,
+	// mergeFrom) repoint them under the write lock while the consume path
+	// holds a read lock, so a consume can never land in a store the handoff
+	// already drained and abandoned.
+	// It is always acquired before sweepMu, never while holding it.
+	storeMu sync.RWMutex
+	store   *sync.Map     // map[string]*jtiEntry - atomic storage for consumed token keys
+	count   *atomic.Int64 // entries in store; shared with the store
+
+	// mu guards the lifecycle of the cleanup worker: cleanupCancel and
+	// cleanupDone. The worker itself only touches store/count, so holding
+	// mu while waiting for it is safe.
+	mu            sync.Mutex
+	cleanupCancel context.CancelFunc
+	cleanupDone   chan struct{} // Closed when cleanup goroutine exits
+
+	// sweepMu serializes cache sweeps so at most one scan runs at a time.
+	sweepMu sync.Mutex
+}
+
+func newJTIReplayCache(name string) *jtiReplayCache {
+	return &jtiReplayCache{
+		name:  name,
+		store: &sync.Map{},
+		count: &atomic.Int64{},
+	}
+}
+
+// configure applies the replay-protection settings: a previous worker is
+// always stopped, whether the new configuration enables protection or
+// disables it. The consumed-token store survives re-configuration: resetting
+// it would let already-seen tokens be replayed against the refreshed provider.
+func (c *jtiReplayCache) configure(enabled bool, maxSize int64) {
+	c.mu.Lock()
+	c.stopWorkerLocked()
+	if enabled {
+		if maxSize <= 0 {
+			maxSize = defaultJTICacheSize
+		}
+		// the bound must land before the flag: a consume that sees enabled
+		// with a zero bound would reject the first token it registers
+		c.maxSize.Store(maxSize)
+		ctx, cancel := context.WithCancel(context.Background())
+		done := make(chan struct{})
+		c.cleanupCancel = cancel
+		c.cleanupDone = done
+		c.enabled.Store(true)
+		c.mu.Unlock()
+
+		go c.cleanupLoop(ctx, done, defaultCleanupInterval)
+		glog.V(2).Infof("OIDC provider %q: JTI replay protection enabled (max size: %d)", c.name, maxSize)
+	} else {
+		c.enabled.Store(false)
+		c.mu.Unlock()
+		glog.Warningf("OIDC provider %q: JTI replay protection is DISABLED", c.name)
+	}
+}
+
+// stopWorkerLocked cancels the current cleanup goroutine and waits briefly
+// for it to exit. Caller must hold mu.
+func (c *jtiReplayCache) stopWorkerLocked() {
+	if c.cleanupCancel == nil {
+		return
+	}
+	c.cleanupCancel()
+	select {
+	case <-c.cleanupDone:
+		glog.V(3).Infof("OIDC provider %q: JTI cleanup goroutine exited", c.name)
+	case <-time.After(2 * time.Second):
+		glog.Warningf("OIDC provider %q: Timeout waiting for JTI cleanup goroutine", c.name)
+	}
+	c.cleanupCancel = nil
+	c.cleanupDone = nil
+}
+
+// consume marks a token as used and rejects a second presentation of it.
+// jti is the token's jti claim (may be empty); tokenExpiresAt is its exp.
+// A no-op while protection is disabled.
+func (c *jtiReplayCache) consume(token, jti, subject string, tokenExpiresAt time.Time) error {
+	if !c.enabled.Load() {
+		return nil
+	}
+
+	key := jti
+	if key == "" {
+		// Providers that issue no jti cannot be tracked by claim, so the
+		// signed input keys the entry: a repeated presentation of the same
+		// claims is a replay even when the signature bytes differ (e.g.
+		// ECDSA s/N-s malleability).
+		signingInput := token
+		if i := strings.LastIndexByte(token, '.'); i > 0 {
+			signingInput = token[:i]
+		}
+		sum := sha256.Sum256([]byte(signingInput))
+		key = tokenFingerprintPrefix + hex.EncodeToString(sum[:])
+	}
+
+	if tokenExpiresAt.IsZero() {
+		// a cache slot is freed only by expiry, so a token without exp
+		// would hold it forever and eventually exhaust the bound
+		return fmt.Errorf("%w: missing exp claim", providers.ErrProviderMissingClaims)
+	}
+	expiresAt := tokenExpiresAt.Add(clockSkewTolerance)
+	if !time.Now().Before(expiresAt) {
+		return fmt.Errorf("%w: token expired", providers.ErrProviderTokenExpired)
+	}
+
+	entry := &jtiEntry{
+		subject:   subject,
+		expiresAt: expiresAt,
+	}
+
+	// The read lock pins the store/count pair for the whole test-and-set
+	// so a replay-state handoff cannot repoint them mid-check and strand
+	// this consume in an abandoned store.
+	c.storeMu.RLock()
+	store, count := c.store, c.count
+
+	// Atomic test-and-set detects replays before any capacity work runs,
+	// so a replayed token cannot trigger cleanup scans.
+	if _, loaded := store.LoadOrStore(key, entry); loaded {
+		c.storeMu.RUnlock()
+		glog.Warningf("OIDC provider %q: Token replay detected (jti: %s)",
+			c.name, jtiLogKey(key))
+		return fmt.Errorf("%w: jti %s has already been used",
+			providers.ErrProviderTokenReplayed, jtiLogKey(key))
+	}
+
+	// The count is incremented as part of the insert, so concurrent
+	// validations cannot all slip under the limit: whoever pushes the
+	// count over evicts their own entry and is rejected.
+	newCount := count.Add(1)
+	maxSize := c.maxSize.Load()
+	if newCount > maxSize {
+		// Over the bound: expired entries may still occupy slots, so
+		// reclaim them with a synchronized sweep before rejecting.
+		c.sweepStore(store, count)
+		if count.Load() > maxSize {
+			if _, loaded := store.LoadAndDelete(key); loaded {
+				count.Add(-1)
+			}
+			c.storeMu.RUnlock()
+			glog.Errorf("OIDC provider %q: JTI cache FULL (%d entries) - rejecting token. "+
+				"This may indicate a DoS attack or insufficient cache size. Consider increasing JTICacheMaxSize.",
+				c.name, maxSize)
+			return fmt.Errorf("JTI cache capacity exceeded")
+		}
+	} else if newCount >= maxSize*9/10 {
+		glog.Warningf("OIDC provider %q: JTI cache at %d%% capacity (%d/%d), triggering eager cleanup",
+			c.name, (newCount*100)/maxSize, newCount, maxSize)
+		go c.performEagerCleanup()
+	}
+	c.storeMu.RUnlock()
+
+	glog.V(4).Infof("OIDC provider %q: Registered JTI %s (expires at %v, cache size: %d)",
+		c.name, jtiLogKey(key), expiresAt, newCount)
+	return nil
+}
+
+// evictExpired removes entries whose expiry has passed and returns how
+// many it deleted. Caller must hold sweepMu.
+func (c *jtiReplayCache) evictExpired(now time.Time, store *sync.Map, count *atomic.Int64) int {
+	removed := 0
+	store.Range(func(key, value interface{}) bool {
+		expiresAt := value.(*jtiEntry).expiresAt
+		if !expiresAt.IsZero() && now.After(expiresAt) {
+			// LoadAndDelete reports whether this call actually removed the
+			// entry, so concurrent deletes cannot decrement the count twice.
+			if v, loaded := store.LoadAndDelete(key); loaded {
+				if !v.(*jtiEntry).uncounted {
+					count.Add(-1)
+				}
+				removed++
+			}
+		}
+		return true
+	})
+	return removed
+}
+
+// state returns the cache's current store/count pair.
+func (c *jtiReplayCache) state() (*sync.Map, *atomic.Int64) {
+	c.storeMu.RLock()
+	defer c.storeMu.RUnlock()
+	return c.store, c.count
+}
+
+// sweepStore runs one serialized expiry scan over the given store. It only
+// takes sweepMu, so callers already holding storeMu may use it.
+func (c *jtiReplayCache) sweepStore(store *sync.Map, count *atomic.Int64) {
+	c.sweepMu.Lock()
+	defer c.sweepMu.Unlock()
+	c.lastSweep.Store(time.Now().UnixNano())
+	if removed := c.evictExpired(time.Now(), store, count); removed > 0 {
+		glog.V(4).Infof("OIDC provider %q: Cleaned up %d expired JTI entries (remaining: %d)",
+			c.name, removed, count.Load())
+	}
+}
+
+// sweepExpired runs a scan that is guaranteed to complete before the
+// caller proceeds; the periodic worker uses it so the scan always covers
+// the store currently in effect, not one captured earlier.
+func (c *jtiReplayCache) sweepExpired() {
+	store, count := c.state()
+	c.sweepStore(store, count)
+}
+
+// performEagerCleanup performs an opportunistic cleanup of expired JTI
+// entries when the cache approaches capacity. At most one sweep runs at a
+// time and no more often than eagerCleanupMinInterval, so a burst of
+// requests near the limit cannot each turn into a full-cache scan.
+func (c *jtiReplayCache) performEagerCleanup() {
+	if !c.enabled.Load() {
+		return
+	}
+	if time.Since(time.Unix(0, c.lastSweep.Load())) < eagerCleanupMinInterval {
+		return
+	}
+	store, count := c.state()
+	if !c.sweepMu.TryLock() {
+		return
+	}
+	defer c.sweepMu.Unlock()
+	c.lastSweep.Store(time.Now().UnixNano())
+
+	beforeCount := count.Load()
+	if removed := c.evictExpired(time.Now(), store, count); removed > 0 {
+		glog.Infof("OIDC provider %q: Eager cleanup removed %d expired JTI entries (%d -> %d)",
+			c.name, removed, beforeCount, count.Load())
+	} else {
+		glog.Warningf("OIDC provider %q: Eager cleanup found no expired entries to remove. "+
+			"Cache may be filled with valid long-lived tokens. Consider increasing JTICacheMaxSize.",
+			c.name)
+	}
+}
+
+// cleanupLoop periodically removes expired JTI entries from the cache.
+// This prevents memory growth by removing JTIs after their tokens have
+// expired. Runs until ctx is cancelled; done is closed on exit.
+func (c *jtiReplayCache) cleanupLoop(ctx context.Context, done chan struct{}, interval time.Duration) {
+	defer close(done)
+
+	ticker := time.NewTicker(interval)
+	defer ticker.Stop()
+
+	glog.V(3).Infof("OIDC provider %q: JTI cleanup goroutine started (interval: %v)", c.name, interval)
+
+	for {
+		select {
+		case <-ctx.Done():
+			glog.V(3).Infof("OIDC provider %q: JTI cleanup goroutine stopping", c.name)
+			return
+		case <-ticker.C:
+			c.sweepExpired()
+		}
+	}
+}
+
+// stop gracefully stops the cleanup worker.
+// Should be called when the provider is being shut down to prevent goroutine
+// leaks.
+func (c *jtiReplayCache) stop(ctx context.Context) error {
+	c.mu.Lock()
+	cancel, done := c.cleanupCancel, c.cleanupDone
+	c.mu.Unlock()
+
+	if cancel == nil {
+		return nil
+	}
+	cancel()
+
+	select {
+	case <-done:
+		glog.V(2).Infof("OIDC provider %q: Cleanup goroutine shutdown complete", c.name)
+	case <-ctx.Done():
+		glog.Warningf("OIDC provider %q: Shutdown timeout waiting for cleanup goroutine: %v", c.name, ctx.Err())
+		return ctx.Err()
+	}
+
+	c.mu.Lock()
+	if c.cleanupDone == done {
+		c.cleanupCancel = nil
+		c.cleanupDone = nil
+	}
+	c.mu.Unlock()
+	return nil
+}
+
+// adoptFrom takes over the consumed-token store of another cache, so tokens
+// it already saw stay rejected across the rebuild. The caller must shut down
+// the replaced provider; only one cleanup worker may sweep the shared store
+// at a time. Call before the new provider serves validators; sweepMu
+// excludes its own cleanup worker during the swap.
+func (c *jtiReplayCache) adoptFrom(old *jtiReplayCache) {
+	if old == nil || old == c {
+		return
+	}
+	c.storeMu.Lock()
+	c.sweepMu.Lock()
+	c.store, c.count = old.store, old.count
+	c.sweepMu.Unlock()
+	c.storeMu.Unlock()
+}
+
+// mergeFrom hands this cache's store to another cache and then folds the
+// other's consumed-token entries in, so rejections the other recorded keep
+// holding when its records move to a shared provider. Repointing first means
+// tokens the other still consumes — in-flight exchanges or ones routed to it
+// before the provider map updates — land in the shared store instead of a
+// store this merge already drained. Unlike adoptFrom it swaps nothing of its
+// own, so it is safe on a cache that is already serving validators.
+func (c *jtiReplayCache) mergeFrom(other *jtiReplayCache) {
+	if other == nil || other == c {
+		return
+	}
+	c.storeMu.RLock()
+	defer c.storeMu.RUnlock()
+	store, count := c.store, c.count
+
+	other.storeMu.Lock()
+	oldStore := other.store
+	if oldStore == store {
+		other.storeMu.Unlock()
+		return
+	}
+	other.store, other.count = store, count
+	other.storeMu.Unlock()
+
+	c.sweepMu.Lock()
+	defer c.sweepMu.Unlock()
+	now := time.Now()
+	oldStore.Range(func(key, value interface{}) bool {
+		entry := value.(*jtiEntry)
+		if expiresAt := entry.expiresAt; !expiresAt.IsZero() && now.After(expiresAt) {
+			return true
+		}
+		// A consumed token is never dropped to fit the bound: merged entries
+		// stay but do not charge the count, so a store filled past the bound
+		// by the merge cannot reject new exchanges while it drains by expiry.
+		store.LoadOrStore(key, &jtiEntry{subject: entry.subject, expiresAt: entry.expiresAt, uncounted: true})
+		return true
+	})
+}
+
+// jtiLogKey redacts a token identifier for logs and error strings: a stable
+// fingerprint that still lets operators correlate repeated presentations.
+func jtiLogKey(jti string) string {
+	sum := sha256.Sum256([]byte(jti))
+	return hex.EncodeToString(sum[:8])
+}
diff --git a/weed/iam/oidc/mock_provider.go b/weed/iam/oidc/mock_provider.go
index 3d5f0edab4..5b840eafa7 100644
--- a/weed/iam/oidc/mock_provider.go
+++ b/weed/iam/oidc/mock_provider.go
@@ -61,14 +61,29 @@ func (m *MockOIDCProvider) Authenticate(ctx context.Context, token string) (*pro
 	groups, _ := claims.GetClaimStringSlice("groups")
 	rawRoles, _ := claims.GetClaimStringSlice("roles")
 
-	return &providers.ExternalIdentity{
+	identity := &providers.ExternalIdentity{
 		UserID:      claims.Subject,
 		Email:       email,
 		DisplayName: displayName,
 		Groups:      groups,
 		Roles:       rawRoles,
 		Provider:    m.name,
-	}, nil
+	}
+	if !claims.ExpiresAt.IsZero() {
+		identity.TokenExpiration = &claims.ExpiresAt
+	}
+	return identity, nil
+}
+
+// AuthenticateSingleUse stays on the mock path: the embedded provider's
+// method would bypass the mock's test data and demand a real JWKS.
+func (m *MockOIDCProvider) AuthenticateSingleUse(ctx context.Context, token string) (*providers.ExternalIdentity, error) {
+	return m.Authenticate(ctx, token)
+}
+
+// ValidateTokenSingleUse stays on the mock path; see AuthenticateSingleUse.
+func (m *MockOIDCProvider) ValidateTokenSingleUse(ctx context.Context, token string) (*providers.TokenClaims, error) {
+	return m.ValidateToken(ctx, token)
 }
 
 // ValidateToken validates tokens using test data
diff --git a/weed/iam/oidc/oidc_https_keys_test.go b/weed/iam/oidc/oidc_https_keys_test.go
new file mode 100644
index 0000000000..d1e19f8573
--- /dev/null
+++ b/weed/iam/oidc/oidc_https_keys_test.go
@@ -0,0 +1,81 @@
+package oidc
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+)
+
+// plainKeyServer serves a JWKS over plain http and counts the fetches: an
+// https issuer's keys must never be read from it.
+func plainKeyServer(t *testing.T) (*httptest.Server, *atomic.Int32) {
+	t.Helper()
+	var hits atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		_ = json.NewEncoder(w).Encode(JWKS{Keys: []JWK{{Kty: "RSA", Kid: "attacker", Use: "sig", Alg: "RS256", N: "AQAB", E: "AQAB"}}})
+	}))
+	t.Cleanup(server.Close)
+	return server, &hits
+}
+
+// httpsIssuer starts a TLS issuer whose handlers the test supplies, and a
+// provider for it.
+func httpsIssuer(t *testing.T, mux *http.ServeMux) (*httptest.Server, *OIDCProvider) {
+	t.Helper()
+	server := httptest.NewTLSServer(mux)
+	t.Cleanup(server.Close)
+	p := NewOIDCProvider("https-keys")
+	if err := p.Initialize(&OIDCConfig{Issuer: server.URL, ClientID: "c", TLSInsecureSkipVerify: true}); err != nil {
+		t.Fatalf("Initialize: %v", err)
+	}
+	return server, p
+}
+
+// Discovery naming a plain-http jwks_uri for an https issuer is refused; the
+// keys come from the issuer's own https host instead.
+func TestAnHTTPSIssuersDiscoveredKeysMustBeHTTPS(t *testing.T) {
+	plain, plainHits := plainKeyServer(t)
+	var server *httptest.Server
+	var ownKeyHits atomic.Int32
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]string{"issuer": server.URL, "jwks_uri": plain.URL + "/jwks"})
+	})
+	mux.HandleFunc("/.well-known/jwks.json", func(w http.ResponseWriter, r *http.Request) {
+		ownKeyHits.Add(1)
+		_ = json.NewEncoder(w).Encode(JWKS{Keys: []JWK{{Kty: "RSA", Kid: "k1", Use: "sig", Alg: "RS256", N: "AQAB", E: "AQAB"}}})
+	})
+	server, p := httpsIssuer(t, mux)
+
+	if err := p.fetchJWKS(context.Background()); err != nil {
+		t.Fatalf("fetchJWKS: %v", err)
+	}
+	if got := plainHits.Load(); got != 0 {
+		t.Fatalf("keys were fetched over http %d time(s)", got)
+	}
+	if got := ownKeyHits.Load(); got != 1 {
+		t.Fatalf("expected the issuer's own https jwks to be used, got %d hits", got)
+	}
+}
+
+// An https key fetch redirected to plain http fails rather than follow it.
+func TestAnHTTPSKeyFetchIsNotRedirectedToHTTP(t *testing.T) {
+	plain, plainHits := plainKeyServer(t)
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/openid-configuration", http.NotFound)
+	mux.HandleFunc("/.well-known/jwks.json", func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, plain.URL+"/jwks", http.StatusFound)
+	})
+	_, p := httpsIssuer(t, mux)
+
+	if err := p.fetchJWKS(context.Background()); err == nil {
+		t.Fatal("fetchJWKS followed a redirect to http")
+	}
+	if got := plainHits.Load(); got != 0 {
+		t.Fatalf("keys were fetched over http %d time(s)", got)
+	}
+}
diff --git a/weed/iam/oidc/oidc_provider.go b/weed/iam/oidc/oidc_provider.go
index fddd3ddd32..6b115041d5 100644
--- a/weed/iam/oidc/oidc_provider.go
+++ b/weed/iam/oidc/oidc_provider.go
@@ -27,7 +27,20 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/security"
 )
 
-// OIDCProvider implements OpenID Connect authentication
+// OIDCProvider implements OpenID Connect authentication with JTI replay protection.
+//
+// Replay Protection:
+// The provider validates the 'jti' (JWT ID) claim to prevent token replay attacks.
+// Each JTI is stored in memory until the token expires. If a token with a duplicate
+// JTI is presented, it is rejected with ErrProviderTokenReplayed.
+//
+// The JTI cache is bounded by JTICacheMaxSize and uses automatic TTL-based expiration.
+// A token without a usable jti claim is tracked by the token's own fingerprint
+// instead, so a repeated presentation is still detected as a replay.
+//
+// Thread Safety:
+// All methods are safe for concurrent use. The JTI cache uses atomic LoadOrStore
+// operations to prevent TOCTOU race conditions.
 type OIDCProvider struct {
 	name        string
 	config      *OIDCConfig
@@ -44,6 +57,25 @@ type OIDCProvider struct {
 	jwksFetchedAt   time.Time
 	resolvedJWKSUri string
 	discoveryFailed bool
+
+	// jti wraps the consumed-token cache behind the replay protection. It is
+	// allocated by NewOIDCProvider or lazily by replayCache, and survives
+	// re-initialization, so a config refresh cannot reopen already-consumed
+	// tokens for replay. jtiOnce makes a zero-value OIDCProvider safe.
+	jti     *jtiReplayCache
+	jtiOnce sync.Once
+}
+
+// replayCache returns the consumed-token cache, allocating it for providers
+// built without NewOIDCProvider so the delegated operations never panic on a
+// nil cache.
+func (p *OIDCProvider) replayCache() *jtiReplayCache {
+	p.jtiOnce.Do(func() {
+		if p.jti == nil {
+			p.jti = newJTIReplayCache(p.name)
+		}
+	})
+	return p.jti
 }
 
 // OIDCConfig holds OIDC provider configuration
@@ -107,6 +139,13 @@ type OIDCConfig struct {
 	// TLSInsecureSkipVerify controls whether to skip TLS verification.
 	// WARNING: Should only be used in development/testing environments. Never use in production.
 	TLSInsecureSkipVerify bool `json:"tlsInsecureSkipVerify,omitempty"`
+
+	// JTIReplayProtectionEnabled enables token replay protection via JTI tracking (default: true)
+	// Use pointer to distinguish between "not set" (nil = default true) and "explicitly false"
+	JTIReplayProtectionEnabled *bool `json:"jtiReplayProtectionEnabled,omitempty"`
+
+	// JTICacheMaxSize sets maximum number of JTI entries to cache (default: 10000)
+	JTICacheMaxSize int `json:"jtiCacheMaxSize,omitempty"`
 }
 
 // PrincipalTagsClaim is the AWS-defined namespace claim that carries
@@ -318,10 +357,26 @@ type JWK struct {
 func NewOIDCProvider(name string) *OIDCProvider {
 	return &OIDCProvider{
 		name:       name,
-		httpClient: &http.Client{Timeout: 30 * time.Second},
+		httpClient: &http.Client{Timeout: 30 * time.Second, CheckRedirect: refuseDowngradeRedirect},
+		jti:        newJTIReplayCache(name),
 	}
 }
 
+// refuseDowngradeRedirect is the redirect policy of the client that fetches
+// discovery documents and signing keys: a request that began over https may
+// not be redirected to plain http, where anyone on the network path could
+// substitute the keys and mint tokens STS accepts. It otherwise keeps
+// net/http's default limit of 10 redirects.
+func refuseDowngradeRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return errors.New("stopped after 10 redirects")
+	}
+	if via[0].URL.Scheme == "https" && req.URL.Scheme != "https" {
+		return fmt.Errorf("refusing redirect from %s to non-https %s", via[0].URL.Redacted(), req.URL.Redacted())
+	}
+	return nil
+}
+
 // Name returns the provider name
 func (p *OIDCProvider) Name() string {
 	return p.name
@@ -409,10 +464,22 @@ func (p *OIDCProvider) Initialize(config interface{}) error {
 		TLSClientConfig: tlsConfig,
 	}
 	p.httpClient = &http.Client{
-		Timeout:   30 * time.Second,
-		Transport: transport,
+		Timeout:       30 * time.Second,
+		Transport:     transport,
+		CheckRedirect: refuseDowngradeRedirect,
 	}
 
+	// Configure JTI replay protection last, so a config failure above cannot
+	// leave a running worker behind. A previous worker is always stopped,
+	// whether the new configuration enables protection or disables it.
+	// The consumed-token store survives re-initialization: resetting it would
+	// let already-seen tokens be replayed against the refreshed provider.
+	jtiEnabled := true
+	if oidcConfig.JTIReplayProtectionEnabled != nil {
+		jtiEnabled = *oidcConfig.JTIReplayProtectionEnabled
+	}
+	p.replayCache().configure(jtiEnabled, int64(oidcConfig.JTICacheMaxSize))
+
 	// For testing, we'll skip the actual OIDC client initialization
 	return nil
 }
@@ -463,6 +530,18 @@ func (p *OIDCProvider) allowedAudiences() []string {
 
 // Authenticate authenticates a user with an OIDC token
 func (p *OIDCProvider) Authenticate(ctx context.Context, token string) (*providers.ExternalIdentity, error) {
+	return p.authenticate(ctx, token, false)
+}
+
+// AuthenticateSingleUse authenticates and consumes the token so a second
+// presentation is rejected as a replay. The web-identity exchange uses it,
+// where a token buys a session exactly once; callers that validate the same
+// token on every request use Authenticate.
+func (p *OIDCProvider) AuthenticateSingleUse(ctx context.Context, token string) (*providers.ExternalIdentity, error) {
+	return p.authenticate(ctx, token, true)
+}
+
+func (p *OIDCProvider) authenticate(ctx context.Context, token string, singleUse bool) (*providers.ExternalIdentity, error) {
 	if !p.initialized {
 		return nil, fmt.Errorf("provider not initialized")
 	}
@@ -472,7 +551,7 @@ func (p *OIDCProvider) Authenticate(ctx context.Context, token string) (*provide
 	}
 
 	// Validate token and get claims
-	claims, err := p.ValidateToken(ctx, token)
+	claims, err := p.validateToken(ctx, token, singleUse)
 	if err != nil {
 		return nil, err
 	}
@@ -639,6 +718,16 @@ func (p *OIDCProvider) getUserInfoWithToken(ctx context.Context, userID, accessT
 
 // ValidateToken validates an OIDC JWT token
 func (p *OIDCProvider) ValidateToken(ctx context.Context, token string) (*providers.TokenClaims, error) {
+	return p.validateToken(ctx, token, false)
+}
+
+// ValidateTokenSingleUse validates and consumes the token: a second
+// presentation of it is rejected as a replay. See AuthenticateSingleUse.
+func (p *OIDCProvider) ValidateTokenSingleUse(ctx context.Context, token string) (*providers.TokenClaims, error) {
+	return p.validateToken(ctx, token, true)
+}
+
+func (p *OIDCProvider) validateToken(ctx context.Context, token string, singleUse bool) (*providers.TokenClaims, error) {
 	if !p.initialized {
 		return nil, fmt.Errorf("provider not initialized")
 	}
@@ -771,6 +860,16 @@ func (p *OIDCProvider) ValidateToken(ctx context.Context, token string) (*provid
 		tokenClaims.Claims[key] = value
 	}
 
+	// Consume the token for replay protection. The check runs only for
+	// single-use callers: a bearer token is meant to be presented on every
+	// request, so validating it must not consume it.
+	if singleUse {
+		jti, _ := claims["jti"].(string)
+		if err := p.replayCache().consume(token, jti, subject, tokenClaims.ExpiresAt); err != nil {
+			return nil, err
+		}
+	}
+
 	return tokenClaims, nil
 }
 
@@ -971,6 +1070,13 @@ func (p *OIDCProvider) fetchDiscoveryJWKSUri(ctx context.Context, discoveryURL s
 		return "", fmt.Errorf("discovery issuer %q does not match configured issuer %q", doc.Issuer, p.config.Issuer)
 	}
 
+	// An https issuer's keys must come over https too; otherwise the issuer's
+	// TLS protects nothing. Refused here, discovery falls back to the
+	// issuer's own /.well-known/jwks.json.
+	if strings.HasPrefix(p.config.Issuer, "https://") && !strings.HasPrefix(doc.JWKSUri, "https://") {
+		return "", fmt.Errorf("discovery jwks_uri %q is not https for https issuer %q", doc.JWKSUri, p.config.Issuer)
+	}
+
 	return doc.JWKSUri, nil
 }
 
@@ -1192,3 +1298,36 @@ func (p *OIDCProvider) mapUserInfoToIdentity(userInfo map[string]interface{}) *p
 
 	return identity
 }
+
+// Shutdown gracefully stops the JTI cleanup goroutine.
+// Should be called when the provider is being shut down to prevent goroutine leaks.
+func (p *OIDCProvider) Shutdown(ctx context.Context) error {
+	return p.replayCache().stop(ctx)
+}
+
+// AdoptReplayStateFrom takes over the consumed-token store of the provider it
+// replaces, so tokens it already saw stay rejected across the rebuild. The
+// caller must shut down the replaced provider; only one cleanup worker may
+// sweep the shared store at a time. Call before the new provider serves
+// validators.
+func (p *OIDCProvider) AdoptReplayStateFrom(old *OIDCProvider) {
+	if old == nil || old == p || old.jti == nil {
+		return
+	}
+	p.replayCache().adoptFrom(old.jti)
+}
+
+// MergeReplayStateFrom hands this provider's store to another provider and
+// then folds the other's consumed-token entries in, so rejections the other
+// recorded keep holding when its records move to a shared provider. Repointing
+// first means tokens the other still consumes — in-flight exchanges or ones
+// routed to it before the provider map updates — land in the shared store
+// instead of a store this merge already drained. Unlike AdoptReplayStateFrom
+// it swaps nothing of its own, so it is safe on a provider that is already
+// serving validators.
+func (p *OIDCProvider) MergeReplayStateFrom(other *OIDCProvider) {
+	if other == nil || other == p {
+		return
+	}
+	p.replayCache().mergeFrom(other.replayCache())
+}
diff --git a/weed/iam/oidc/oidc_provider_test.go b/weed/iam/oidc/oidc_provider_test.go
index b226929d2f..29f7e3e656 100644
--- a/weed/iam/oidc/oidc_provider_test.go
+++ b/weed/iam/oidc/oidc_provider_test.go
@@ -8,9 +8,14 @@ import (
 	"crypto/rsa"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
+	"fmt"
+	"math/big"
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -547,42 +552,42 @@ func TestOIDCProviderUserInfo(t *testing.T) {
 
 // Helper functions for testing
 
-func generateTestKeys(t *testing.T) (*rsa.PrivateKey, *rsa.PublicKey) {
+func generateTestKeys(tb testing.TB) (*rsa.PrivateKey, *rsa.PublicKey) {
 	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
-	require.NoError(t, err)
+	require.NoError(tb, err)
 	return privateKey, &privateKey.PublicKey
 }
 
-func generateTestECKeys(t *testing.T) (*ecdsa.PrivateKey, *ecdsa.PublicKey) {
+func generateTestECKeys(tb testing.TB) (*ecdsa.PrivateKey, *ecdsa.PublicKey) {
 	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	require.NoError(t, err)
+	require.NoError(tb, err)
 	return privateKey, &privateKey.PublicKey
 }
 
-func createTestJWT(t *testing.T, privateKey *rsa.PrivateKey, claims jwt.MapClaims) string {
+func createTestJWT(tb testing.TB, privateKey *rsa.PrivateKey, claims jwt.MapClaims) string {
 	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
 	token.Header["kid"] = "test-key-id"
 
 	tokenString, err := token.SignedString(privateKey)
-	require.NoError(t, err)
+	require.NoError(tb, err)
 	return tokenString
 }
 
-func createTestECDSAJWT(t *testing.T, privateKey *ecdsa.PrivateKey, claims jwt.MapClaims) string {
+func createTestECDSAJWT(tb testing.TB, privateKey *ecdsa.PrivateKey, claims jwt.MapClaims) string {
 	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)
 	token.Header["kid"] = "test-ec-key-id"
 
 	tokenString, err := token.SignedString(privateKey)
-	require.NoError(t, err)
+	require.NoError(tb, err)
 	return tokenString
 }
 
-func encodePublicKey(t *testing.T, publicKey *rsa.PublicKey) string {
+func encodePublicKey(tb testing.TB, publicKey *rsa.PublicKey) string {
 	// Properly encode the RSA modulus (N) as base64url
 	return base64.RawURLEncoding.EncodeToString(publicKey.N.Bytes())
 }
 
-func encodeECPublicKey(t *testing.T, publicKey *ecdsa.PublicKey) (string, string) {
+func encodeECPublicKey(tb testing.TB, publicKey *ecdsa.PublicKey) (string, string) {
 	// RFC 7518 §6.2.1.2 requires EC coordinates to be zero-padded to the full field size
 	curveParams := publicKey.Curve.Params()
 	size := (curveParams.BitSize + 7) / 8
@@ -597,7 +602,7 @@ func encodeECPublicKey(t *testing.T, publicKey *ecdsa.PublicKey) (string, string
 		base64.RawURLEncoding.EncodeToString(yPadded)
 }
 
-func setupOIDCTestServer(t *testing.T, publicKey *rsa.PublicKey) *httptest.Server {
+func setupOIDCTestServer(tb testing.TB, publicKey *rsa.PublicKey) *httptest.Server {
 	jwks := map[string]interface{}{
 		"keys": []map[string]interface{}{
 			{
@@ -605,7 +610,7 @@ func setupOIDCTestServer(t *testing.T, publicKey *rsa.PublicKey) *httptest.Serve
 				"kid": "test-key-id",
 				"use": "sig",
 				"alg": "RS256",
-				"n":   encodePublicKey(t, publicKey),
+				"n":   encodePublicKey(tb, publicKey),
 				"e":   "AQAB",
 			},
 		},
@@ -660,3 +665,1066 @@ func setupOIDCTestServer(t *testing.T, publicKey *rsa.PublicKey) *httptest.Serve
 		}
 	}))
 }
+
+func TestOIDCProviderJTIReplayProtection(t *testing.T) {
+	// Setup mock OIDC provider with JTI protection enabled
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+		JTICacheMaxSize:            100,
+	}
+
+	err := provider.Initialize(config)
+	require.NoError(t, err)
+
+	// Test 1: First use of token with JTI should succeed
+	jti := "unique-token-id-12345"
+	token1 := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": jti,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	claims1, err := provider.ValidateTokenSingleUse(context.Background(), token1)
+	require.NoError(t, err)
+	assert.Equal(t, "user123", claims1.Subject)
+	assert.Equal(t, jti, claims1.Claims["jti"])
+
+	// Test 2: Replay of same token should be rejected
+	claims2, err := provider.ValidateTokenSingleUse(context.Background(), token1)
+	assert.Error(t, err)
+	assert.Nil(t, claims2)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed))
+	assert.NotContains(t, err.Error(), jti, "error should not expose the raw token identifier")
+
+	// Test 3: Different token with different JTI should succeed
+	jti2 := "different-token-id-67890"
+	token2 := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user456",
+		"jti": jti2,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	claims3, err := provider.ValidateTokenSingleUse(context.Background(), token2)
+	require.NoError(t, err)
+	assert.Equal(t, "user456", claims3.Subject)
+
+	// Test 4: Token without JTI is tracked by the token's own fingerprint,
+	// so presenting the same token again is still a replay
+	tokenNoJTI := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user789",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	claims4, err := provider.ValidateTokenSingleUse(context.Background(), tokenNoJTI)
+	require.NoError(t, err)
+	assert.Equal(t, "user789", claims4.Subject)
+
+	_, err = provider.ValidateTokenSingleUse(context.Background(), tokenNoJTI)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed),
+		"a jti-less token must not stay reusable while protection is enabled")
+
+	// Test 5: Token with a JTI but no exp is rejected — a cache slot frees
+	// only by expiry, so an expiry-less entry would hold it forever and a
+	// burst of distinct tokens could exhaust the bound permanently.
+	tokenNoExp := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "userNoExp",
+		"jti": "no-exp-jti",
+		"iat": time.Now().Unix(),
+	})
+
+	claims5, err := provider.ValidateTokenSingleUse(context.Background(), tokenNoExp)
+	assert.Nil(t, claims5)
+	assert.True(t, errors.Is(err, providers.ErrProviderMissingClaims))
+}
+
+func TestOIDCProviderJTIFallbackResistsSignatureMalleability(t *testing.T) {
+	privateKey, publicKey := generateTestECKeys(t)
+	x, y := encodeECPublicKey(t, publicKey)
+
+	jwks := map[string]interface{}{
+		"keys": []map[string]interface{}{
+			{
+				"kty": "EC",
+				"kid": "test-ec-key-id",
+				"use": "sig",
+				"alg": "ES256",
+				"crv": "P-256",
+				"x":   x,
+				"y":   y,
+			},
+		},
+	}
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/.well-known/openid_configuration" {
+			json.NewEncoder(w).Encode(map[string]interface{}{
+				"issuer":   "http://" + r.Host,
+				"jwks_uri": "http://" + r.Host + "/jwks",
+			})
+		} else if r.URL.Path == "/jwks" {
+			json.NewEncoder(w).Encode(jwks)
+		}
+	}))
+	defer server.Close()
+
+	provider := NewOIDCProvider("test-oidc-ecdsa-malleable")
+	err := provider.Initialize(&OIDCConfig{
+		Issuer:   server.URL,
+		ClientID: "test-client",
+		JWKSUri:  server.URL + "/jwks",
+	})
+	require.NoError(t, err)
+
+	token := createTestECDSAJWT(t, privateKey, jwt.MapClaims{
+		"iss": server.URL,
+		"aud": "test-client",
+		"sub": "user-malleable",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+
+	// The same signed claims under a malleated ECDSA signature (s -> N-s)
+	// must still be a replay, not a fresh exchange.
+	malleated := malleateECDSAJWTSignature(t, token)
+	require.NotEqual(t, token, malleated)
+
+	_, err = provider.ValidateTokenSingleUse(context.Background(), malleated)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed),
+		"a signature-malleated jti-less token must not bypass replay detection")
+}
+
+func malleateECDSAJWTSignature(tb testing.TB, tokenString string) string {
+	parts := strings.Split(tokenString, ".")
+	require.Len(tb, parts, 3)
+	sig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	require.NoError(tb, err)
+	half := len(sig) / 2
+	r := new(big.Int).SetBytes(sig[:half])
+	s := new(big.Int).SetBytes(sig[half:])
+	s.Sub(elliptic.P256().Params().N, s)
+	malleated := make([]byte, len(sig))
+	r.FillBytes(malleated[:half])
+	s.FillBytes(malleated[half:])
+	parts[2] = base64.RawURLEncoding.EncodeToString(malleated)
+	return strings.Join(parts, ".")
+}
+
+func TestOIDCProviderJTIReplayProtectionDisabled(t *testing.T) {
+	// Setup provider with JTI protection DISABLED
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-no-jti")
+	jtiDisabled := false
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiDisabled, // Explicitly disabled
+	}
+
+	err := provider.Initialize(config)
+	require.NoError(t, err)
+
+	// Token with JTI can be used multiple times when protection is disabled
+	jti := "reusable-token-id"
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": jti,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	// First use - should succeed
+	claims1, err := provider.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+	assert.Equal(t, "user123", claims1.Subject)
+
+	// Second use - should ALSO succeed (no replay protection)
+	claims2, err := provider.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+	assert.Equal(t, "user123", claims2.Subject)
+}
+
+func TestOIDCProviderJTIExpiration(t *testing.T) {
+	// Test that JTI cache entries expire with token
+	// This test also verifies default behavior (JTIReplayProtectionEnabled not set = enabled by default)
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc")
+	config := &OIDCConfig{
+		Issuer:   jwksServer.URL,
+		ClientID: "test-client",
+		JWKSUri:  jwksServer.URL + "/jwks",
+		// JTIReplayProtectionEnabled not set - should default to true (secure by default)
+	}
+
+	err := provider.Initialize(config)
+	require.NoError(t, err)
+
+	// Create token that expires in 2 seconds
+	jti := "short-lived-token"
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": jti,
+		"exp": time.Now().Add(2 * time.Second).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	// First use - should succeed
+	claims1, err := provider.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+	assert.Equal(t, "user123", claims1.Subject)
+
+	// Immediate replay - should be rejected
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token)
+	assert.Error(t, err)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed))
+
+	// Wait for token AND cache entry to expire
+	time.Sleep(3 * time.Second)
+
+	// Now validation should fail due to EXPIRATION (not replay)
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token)
+	assert.Error(t, err)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenExpired))
+}
+
+func TestOIDCProviderJTIReplayProtectionConcurrent(t *testing.T) {
+	// Test concurrent validation to ensure no TOCTOU race conditions
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-concurrent")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+		JTICacheMaxSize:            1000,
+	}
+	require.NoError(t, provider.Initialize(config))
+
+	jti := "concurrent-test-jti"
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": jti,
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	// Launch 100 concurrent validations with the same token
+	const numGoroutines = 100
+	var successCount, replayCount, otherErrorCount atomic.Int32
+
+	var wg sync.WaitGroup
+	wg.Add(numGoroutines)
+
+	// All goroutines start at roughly the same time
+	startBarrier := make(chan struct{})
+
+	for i := 0; i < numGoroutines; i++ {
+		go func() {
+			defer wg.Done()
+			<-startBarrier // Wait for start signal
+
+			_, err := provider.ValidateTokenSingleUse(context.Background(), token)
+			if err == nil {
+				successCount.Add(1)
+			} else if errors.Is(err, providers.ErrProviderTokenReplayed) {
+				replayCount.Add(1)
+			} else {
+				otherErrorCount.Add(1)
+				t.Logf("Unexpected error: %v", err)
+			}
+		}()
+	}
+
+	close(startBarrier) // Start all goroutines
+	wg.Wait()
+
+	// Exactly one should succeed, all others should be replay errors
+	assert.Equal(t, int32(1), successCount.Load(),
+		"Exactly one validation should succeed (atomic test-and-set)")
+	assert.Equal(t, int32(numGoroutines-1), replayCount.Load(),
+		"All other validations should be replay errors")
+	assert.Equal(t, int32(0), otherErrorCount.Load(),
+		"No other errors should occur")
+}
+
+func TestOIDCProviderJTICacheMaxSize(t *testing.T) {
+	// Test that cache respects max size limit
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-maxsize")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+		JTICacheMaxSize:            10, // Small cache for testing
+	}
+	require.NoError(t, provider.Initialize(config))
+
+	// Add tokens up to the limit
+	for i := 0; i < 10; i++ {
+		token := createTestJWT(t, privateKey, jwt.MapClaims{
+			"iss": jwksServer.URL,
+			"aud": "test-client",
+			"sub": "user123",
+			"jti": fmt.Sprintf("jti-%d", i),
+			"exp": time.Now().Add(time.Hour).Unix(),
+			"iat": time.Now().Unix(),
+		})
+
+		_, err := provider.ValidateTokenSingleUse(context.Background(), token)
+		require.NoError(t, err, "Should accept token %d", i)
+	}
+
+	// Next token should be rejected due to cache full
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "jti-overflow",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	_, err := provider.ValidateTokenSingleUse(context.Background(), token)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "cache capacity exceeded")
+}
+
+func TestOIDCProviderJTICleanup(t *testing.T) {
+	// Test that cleanup goroutine logic correctly identifies expired entries
+	// NOTE: JWT library allows clock skew, so tokens can't be truly expired
+	// We test the cleanup logic without actually waiting for expiration
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-cleanup")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+	}
+	require.NoError(t, provider.Initialize(config))
+	defer provider.Shutdown(context.Background())
+
+	// Create token that expires in 1 hour
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "cleanup-test-jti",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	// Validation should succeed
+	_, err := provider.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+
+	// Check cache size is 1
+	assert.Equal(t, int64(1), provider.jti.count.Load())
+
+	// Verify entry exists and check its expiration includes clock skew
+	val, ok := provider.jti.store.Load("cleanup-test-jti")
+	require.True(t, ok, "JTI entry should exist")
+	entry := val.(*jtiEntry)
+
+	// Entry should expire around exp + clock skew tolerance (1 hour + 5 minutes)
+	expectedExpiry := time.Now().Add(time.Hour + 5*time.Minute)
+	assert.WithinDuration(t, expectedExpiry, entry.expiresAt, 10*time.Second,
+		"Entry expiry should be token exp + clock skew tolerance")
+
+	// Verify entry is not yet expired (cleanup shouldn't remove it)
+	now := time.Now()
+	assert.True(t, now.Before(entry.expiresAt),
+		"Entry should not be expired yet")
+
+	// Run the periodic cleanup with a short interval and an expired entry:
+	// both the entry and the count must actually be cleared
+	cleanupCtx, cleanupCancel := context.WithCancel(context.Background())
+	cleanupDone := make(chan struct{})
+	go provider.jti.cleanupLoop(cleanupCtx, cleanupDone, 20*time.Millisecond)
+	defer func() {
+		cleanupCancel()
+		<-cleanupDone
+	}()
+
+	provider.jti.store.Store("expired-cleanup-jti", &jtiEntry{
+		subject:   "expired-user",
+		expiresAt: time.Now().Add(-time.Minute),
+	})
+	provider.jti.count.Add(1)
+
+	require.Eventually(t, func() bool {
+		_, stillThere := provider.jti.store.Load("expired-cleanup-jti")
+		return !stillThere && provider.jti.count.Load() == 1 // only the valid entry remains
+	}, 2*time.Second, 10*time.Millisecond, "periodic cleanup should evict the expired entry")
+}
+
+func TestOIDCProviderReinitialization(t *testing.T) {
+	// Test that re-initialization properly cancels the old cleanup goroutine
+	// to prevent goroutine leaks
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-reinit")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+	}
+
+	// First initialization
+	require.NoError(t, provider.Initialize(config))
+	require.NotNil(t, provider.jti.cleanupCancel, "First cleanup cancel should be set")
+
+	// Create and validate a token to ensure JTI protection is working
+	token1 := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user1",
+		"jti": "token-1",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+	_, err := provider.ValidateTokenSingleUse(context.Background(), token1)
+	require.NoError(t, err, "First token should validate successfully")
+
+	// Second initialization should not cause errors
+	require.NoError(t, provider.Initialize(config))
+	require.NotNil(t, provider.jti.cleanupCancel, "Second cleanup cancel should be set")
+
+	// The JTI cache survives re-initialization, so the consumed token is
+	// still detected as a replay rather than being usable again
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token1)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed),
+		"Re-initialization must not reopen a consumed token for replay")
+
+	// Third initialization to ensure it works multiple times
+	require.NoError(t, provider.Initialize(config))
+	require.NotNil(t, provider.jti.cleanupCancel, "Third cleanup cancel should be set")
+
+	// Verify JTI replay protection still works after re-initialization
+	token2 := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user2",
+		"jti": "token-2",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token2)
+	require.NoError(t, err, "New token should validate")
+
+	// Replay should still be detected
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token2)
+	assert.Error(t, err, "Replay should be detected")
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed), "Should be a replay error")
+
+	// Final cleanup
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	err = provider.Shutdown(ctx)
+	assert.NoError(t, err)
+}
+
+func TestOIDCProviderJTIEagerCleanup(t *testing.T) {
+	// Test the eager cleanup mechanism when cache approaches capacity
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-eager-cleanup")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+		JTICacheMaxSize:            10, // Small cache for testing
+	}
+	require.NoError(t, provider.Initialize(config))
+	defer provider.Shutdown(context.Background())
+
+	// Manually add expired entries to the cache
+	for i := 0; i < 5; i++ {
+		jti := fmt.Sprintf("expired-jti-%d", i)
+		entry := &jtiEntry{
+			subject:   fmt.Sprintf("expired-user-%d", i),
+			expiresAt: time.Now().Add(-time.Hour), // Already expired
+		}
+		provider.jti.store.Store(jti, entry)
+		provider.jti.count.Add(1)
+	}
+
+	assert.Equal(t, int64(5), provider.jti.count.Load(), "Should have 5 expired entries")
+
+	// Perform eager cleanup - should remove all expired entries
+	provider.jti.performEagerCleanup()
+
+	assert.Equal(t, int64(0), provider.jti.count.Load(),
+		"All expired entries should be removed by eager cleanup")
+
+	// Now test that adding valid tokens works after cleanup
+	for i := 0; i < 9; i++ {
+		token := createTestJWT(t, privateKey, jwt.MapClaims{
+			"iss": jwksServer.URL,
+			"aud": "test-client",
+			"sub": fmt.Sprintf("user-%d", i),
+			"jti": fmt.Sprintf("valid-jti-%d", i),
+			"exp": time.Now().Add(time.Hour).Unix(),
+			"iat": time.Now().Unix(),
+		})
+		_, err := provider.ValidateTokenSingleUse(context.Background(), token)
+		require.NoError(t, err)
+	}
+
+	// Should have 9 valid entries now (90% of capacity, triggers eager cleanup warning)
+	assert.Equal(t, int64(9), provider.jti.count.Load(), "Should have 9 valid entries")
+
+	// 10th token should succeed (at capacity but not over)
+	token10 := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user-10",
+		"jti": "valid-jti-10",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+	_, err := provider.ValidateTokenSingleUse(context.Background(), token10)
+	require.NoError(t, err, "10th token should validate (at capacity)")
+
+	// 11th token should fail (over capacity)
+	token11 := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user-11",
+		"jti": "valid-jti-11",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token11)
+	assert.Error(t, err, "11th token should fail (over capacity)")
+	assert.Contains(t, err.Error(), "capacity exceeded", "Should indicate capacity exceeded")
+}
+
+func TestOIDCProviderConcurrentCleanupNoNegativeCount(t *testing.T) {
+	// Test that concurrent cleanups don't cause jtiCount to go negative
+	// due to double-decrement of the same entry
+	_, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-cleanup-race")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+		JTICacheMaxSize:            100,
+	}
+	require.NoError(t, provider.Initialize(config))
+	defer provider.Shutdown(context.Background())
+
+	// Manually add expired entries to the cache
+	for i := 0; i < 50; i++ {
+		jti := fmt.Sprintf("expired-jti-%d", i)
+		entry := &jtiEntry{
+			subject:   fmt.Sprintf("user-%d", i),
+			expiresAt: time.Now().Add(-time.Hour), // Already expired
+		}
+		provider.jti.store.Store(jti, entry)
+		provider.jti.count.Add(1)
+	}
+
+	initialCount := provider.jti.count.Load()
+	assert.Equal(t, int64(50), initialCount, "Should have 50 expired entries")
+
+	// Run multiple concurrent cleanups
+	var wg sync.WaitGroup
+	numCleanups := 10
+
+	for i := 0; i < numCleanups; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			provider.jti.performEagerCleanup()
+		}()
+	}
+
+	wg.Wait()
+
+	// Counter should be 0 (all entries removed), never negative
+	finalCount := provider.jti.count.Load()
+	assert.Equal(t, int64(0), finalCount,
+		"Counter should be 0 after concurrent cleanups, got %d", finalCount)
+	assert.GreaterOrEqual(t, finalCount, int64(0),
+		"Counter should never go negative, got %d", finalCount)
+
+	// Verify store is actually empty
+	storeCount := 0
+	provider.jti.store.Range(func(key, value interface{}) bool {
+		storeCount++
+		return true
+	})
+	assert.Equal(t, 0, storeCount, "Store should be empty")
+}
+
+func TestOIDCProviderShutdown(t *testing.T) {
+	// Test graceful shutdown
+	_, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-shutdown")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+	}
+	require.NoError(t, provider.Initialize(config))
+
+	// Shutdown should complete without error
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	// Measure shutdown time to ensure it doesn't block unnecessarily
+	start := time.Now()
+	err := provider.Shutdown(ctx)
+	duration := time.Since(start)
+
+	assert.NoError(t, err)
+	// Shutdown should be quick (goroutine exits immediately on cancel)
+	// Allow 1 second for goroutine scheduling overhead
+	assert.Less(t, duration, 1*time.Second,
+		"Shutdown should not block for fixed timeout, took %v", duration)
+
+	// Second shutdown should be idempotent
+	err = provider.Shutdown(ctx)
+	assert.NoError(t, err)
+}
+
+func TestOIDCProviderShutdownTimeout(t *testing.T) {
+	// Test that shutdown respects caller's context timeout
+	_, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-shutdown-timeout")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+	}
+	require.NoError(t, provider.Initialize(config))
+
+	// Use a very short timeout to test timeout handling
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Millisecond)
+	defer cancel()
+
+	// Wait a bit to ensure context expires
+	time.Sleep(10 * time.Millisecond)
+
+	err := provider.Shutdown(ctx)
+	// Should return context error if timeout occurs
+	if err != nil {
+		assert.ErrorIs(t, err, context.DeadlineExceeded,
+			"Should return deadline exceeded error when context times out")
+	}
+	// Note: goroutine may exit before timeout, so error is optional
+}
+
+// Benchmark tests
+
+func BenchmarkJTIValidation(b *testing.B) {
+	// Benchmark JTI validation performance with unique tokens
+	privateKey, publicKey := generateTestKeys(b)
+	jwksServer := setupOIDCTestServer(b, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("bench-oidc")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+		JTICacheMaxSize:            b.N + 1024,
+	}
+	require.NoError(b, provider.Initialize(config))
+	defer provider.Shutdown(context.Background())
+
+	// Pre-generate unique tokens
+	tokens := make([]string, b.N)
+	for i := 0; i < b.N; i++ {
+		tokens[i] = createTestJWT(b, privateKey, jwt.MapClaims{
+			"iss": jwksServer.URL,
+			"aud": "test-client",
+			"sub": "user123",
+			"jti": fmt.Sprintf("jti-%d", i),
+			"exp": time.Now().Add(time.Hour).Unix(),
+			"iat": time.Now().Unix(),
+		})
+	}
+
+	// Parallel workers draw distinct token indices so each iteration
+	// validates a new token rather than a replay or capacity rejection.
+	var tokenIndex atomic.Int64
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			i := int(tokenIndex.Add(1)-1) % len(tokens)
+			if _, err := provider.ValidateTokenSingleUse(context.Background(), tokens[i]); err != nil {
+				b.Errorf("unexpected validation error: %v", err)
+			}
+		}
+	})
+}
+
+func BenchmarkJTIValidationWithReplay(b *testing.B) {
+	// Benchmark replay detection performance
+	privateKey, publicKey := generateTestKeys(b)
+	jwksServer := setupOIDCTestServer(b, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("bench-oidc-replay")
+	jtiEnabled := true
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+		JTICacheMaxSize:            100000,
+	}
+	require.NoError(b, provider.Initialize(config))
+	defer provider.Shutdown(context.Background())
+
+	// Create one token that will be replayed
+	token := createTestJWT(b, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "replay-jti",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	// First validation to store the JTI
+	_, err := provider.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(b, err)
+
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			// All subsequent validations should be fast replay rejections
+			provider.ValidateTokenSingleUse(context.Background(), token)
+		}
+	})
+}
+
+func BenchmarkJTIValidationNoProtection(b *testing.B) {
+	// Benchmark validation without JTI protection (baseline)
+	privateKey, publicKey := generateTestKeys(b)
+	jwksServer := setupOIDCTestServer(b, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("bench-oidc-no-jti")
+	jtiDisabled := false
+	config := &OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiDisabled,
+	}
+	require.NoError(b, provider.Initialize(config))
+
+	token := createTestJWT(b, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "no-protection-jti",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	b.ResetTimer()
+	b.RunParallel(func(pb *testing.PB) {
+		for pb.Next() {
+			provider.ValidateTokenSingleUse(context.Background(), token)
+		}
+	})
+}
+
+func TestOIDCProviderBearerValidationDoesNotConsume(t *testing.T) {
+	// Bearer authentication validates the same token on every request, so it
+	// must not consume it; only the single-use exchange rejects a repeat.
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	provider := NewOIDCProvider("test-oidc-bearer")
+	jtiEnabled := true
+	require.NoError(t, provider.Initialize(&OIDCConfig{
+		Issuer:                     jwksServer.URL,
+		ClientID:                   "test-client",
+		JWKSUri:                    jwksServer.URL + "/jwks",
+		JTIReplayProtectionEnabled: &jtiEnabled,
+	}))
+	defer provider.Shutdown(context.Background())
+
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "bearer-jti",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+
+	for i := 0; i < 3; i++ {
+		_, err := provider.ValidateToken(context.Background(), token)
+		require.NoError(t, err, "bearer validation must not consume the token")
+	}
+
+	_, err := provider.Authenticate(context.Background(), token)
+	require.NoError(t, err, "bearer authentication must not consume the token")
+
+	// The same token then exchanged single-use is tracked and a repeat rejected.
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+	_, err = provider.ValidateTokenSingleUse(context.Background(), token)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed))
+
+	// Even after the exchange consumed it, bearer validation still accepts:
+	// the token itself remains valid until it expires.
+	_, err = provider.ValidateToken(context.Background(), token)
+	require.NoError(t, err)
+}
+
+func TestAdoptReplayStateFromKeepsConsumedTokensRejected(t *testing.T) {
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	newConfig := func() *OIDCConfig {
+		return &OIDCConfig{
+			Issuer:   jwksServer.URL,
+			ClientID: "test-client",
+			JWKSUri:  jwksServer.URL + "/jwks",
+		}
+	}
+
+	old := NewOIDCProvider("test-oidc-old")
+	require.NoError(t, old.Initialize(newConfig()))
+
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "consumed-jti",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+	_, err := old.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+
+	rebuilt := NewOIDCProvider("test-oidc-new")
+	require.NoError(t, rebuilt.Initialize(newConfig()))
+	defer rebuilt.Shutdown(context.Background())
+
+	rebuilt.AdoptReplayStateFrom(old)
+	require.NoError(t, old.Shutdown(context.Background()))
+
+	_, err = rebuilt.ValidateTokenSingleUse(context.Background(), token)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed),
+		"a token consumed before the rebuild must stay rejected")
+}
+
+// A token consumed by one provider must stay rejected by another provider for
+// the same issuer once the consumed entries merge over: pooling a record onto
+// a shared provider cannot reopen the replay window.
+func TestMergeReplayStateFromKeepsConsumedTokensRejected(t *testing.T) {
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	newConfig := func() *OIDCConfig {
+		return &OIDCConfig{
+			Issuer:   jwksServer.URL,
+			ClientID: "test-client",
+			JWKSUri:  jwksServer.URL + "/jwks",
+		}
+	}
+
+	first := NewOIDCProvider("test-oidc-first")
+	require.NoError(t, first.Initialize(newConfig()))
+	defer first.Shutdown(context.Background())
+
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "consumed-elsewhere-jti",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+	_, err := first.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err)
+
+	second := NewOIDCProvider("test-oidc-second")
+	require.NoError(t, second.Initialize(newConfig()))
+	defer second.Shutdown(context.Background())
+
+	second.MergeReplayStateFrom(first)
+	_, err = second.ValidateTokenSingleUse(context.Background(), token)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed),
+		"a token the superseded provider consumed must stay rejected after the merge")
+}
+
+// The superseded provider may keep serving exchanges while the provider map
+// updates; tokens it consumes after the handoff must land in the shared store
+// or they would reopen for replay.
+func TestMergeReplayStateFromSharesLiveStore(t *testing.T) {
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	newConfig := func() *OIDCConfig {
+		return &OIDCConfig{
+			Issuer:   jwksServer.URL,
+			ClientID: "test-client",
+			JWKSUri:  jwksServer.URL + "/jwks",
+		}
+	}
+
+	first := NewOIDCProvider("test-oidc-first")
+	require.NoError(t, first.Initialize(newConfig()))
+	defer first.Shutdown(context.Background())
+
+	second := NewOIDCProvider("test-oidc-second")
+	require.NoError(t, second.Initialize(newConfig()))
+	defer second.Shutdown(context.Background())
+
+	second.MergeReplayStateFrom(first)
+
+	token := createTestJWT(t, privateKey, jwt.MapClaims{
+		"iss": jwksServer.URL,
+		"aud": "test-client",
+		"sub": "user123",
+		"jti": "late-consume-jti",
+		"exp": time.Now().Add(time.Hour).Unix(),
+		"iat": time.Now().Unix(),
+	})
+	_, err := first.ValidateTokenSingleUse(context.Background(), token)
+	require.NoError(t, err, "the superseded provider still accepts a fresh token")
+
+	_, err = second.ValidateTokenSingleUse(context.Background(), token)
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed),
+		"a token consumed through the superseded provider after the handoff must stay rejected")
+}
+
+// Merging two stores that are each near the bound must not reject new
+// exchanges: consumed tokens are carried over without charging the bound,
+// which still applies to tokens consumed through the live path.
+func TestMergeReplayStateFromOverflowStillAdmits(t *testing.T) {
+	privateKey, publicKey := generateTestKeys(t)
+	jwksServer := setupOIDCTestServer(t, publicKey)
+	defer jwksServer.Close()
+
+	newConfig := func() *OIDCConfig {
+		return &OIDCConfig{
+			Issuer:          jwksServer.URL,
+			ClientID:        "test-client",
+			JWKSUri:         jwksServer.URL + "/jwks",
+			JTICacheMaxSize: 4,
+		}
+	}
+	newToken := func(jti string) string {
+		return createTestJWT(t, privateKey, jwt.MapClaims{
+			"iss": jwksServer.URL,
+			"aud": "test-client",
+			"sub": "user123",
+			"jti": jti,
+			"exp": time.Now().Add(time.Hour).Unix(),
+			"iat": time.Now().Unix(),
+		})
+	}
+
+	first := NewOIDCProvider("test-oidc-first")
+	require.NoError(t, first.Initialize(newConfig()))
+	defer first.Shutdown(context.Background())
+	for _, jti := range []string{"first-a", "first-b", "first-c"} {
+		_, err := first.ValidateTokenSingleUse(context.Background(), newToken(jti))
+		require.NoError(t, err)
+	}
+
+	second := NewOIDCProvider("test-oidc-second")
+	require.NoError(t, second.Initialize(newConfig()))
+	defer second.Shutdown(context.Background())
+	for _, jti := range []string{"second-a", "second-b", "second-c"} {
+		_, err := second.ValidateTokenSingleUse(context.Background(), newToken(jti))
+		require.NoError(t, err)
+	}
+
+	second.MergeReplayStateFrom(first)
+
+	_, err := second.ValidateTokenSingleUse(context.Background(), newToken("first-a"))
+	assert.True(t, errors.Is(err, providers.ErrProviderTokenReplayed),
+		"merged consumed tokens must stay rejected")
+
+	_, err = second.ValidateTokenSingleUse(context.Background(), newToken("fresh-jti"))
+	assert.NoError(t, err, "merged excess must not reject a new exchange")
+}
diff --git a/weed/iam/policy/policy_engine.go b/weed/iam/policy/policy_engine.go
index acd7c0a2fc..a109d20f02 100644
--- a/weed/iam/policy/policy_engine.go
+++ b/weed/iam/policy/policy_engine.go
@@ -357,6 +357,20 @@ func (e *PolicyEngine) AddPolicy(filerAddress string, name string, policy *Polic
 	return e.store.StorePolicy(context.Background(), filerAddress, name, policy)
 }
 
+// GetPolicy returns a stored policy document, or an error when it does not
+// exist in the configured store.
+func (e *PolicyEngine) GetPolicy(ctx context.Context, filerAddress string, name string) (*PolicyDocument, error) {
+	if !e.initialized {
+		return nil, fmt.Errorf("policy engine not initialized")
+	}
+
+	if name == "" {
+		return nil, fmt.Errorf("policy name cannot be empty")
+	}
+
+	return e.store.GetPolicy(ctx, filerAddress, name)
+}
+
 // DeletePolicy removes a policy from the configured store.
 func (e *PolicyEngine) DeletePolicy(ctx context.Context, filerAddress string, name string) error {
 	if !e.initialized {
@@ -459,8 +473,11 @@ func (e *PolicyEngine) EvaluateTrustPolicy(ctx context.Context, trustPolicy *Pol
 		return nil, fmt.Errorf("trust policy cannot be nil")
 	}
 
+	// A trust policy is deny-by-default, whatever the engine's DefaultEffect:
+	// a role may be assumed only by a principal a trust statement explicitly
+	// allows.
 	result := &EvaluationResult{
-		Effect: Effect(e.config.DefaultEffect),
+		Effect: EffectDeny,
 		EvaluationDetails: &EvaluationDetails{
 			Principal:         evalCtx.Principal,
 			Action:            evalCtx.Action,
@@ -497,7 +514,7 @@ func (e *PolicyEngine) EvaluateTrustPolicy(ctx context.Context, trustPolicy *Pol
 	// AWS IAM evaluation logic:
 	// 1. If there's an explicit Deny, the result is Deny
 	// 2. If there's an Allow and no Deny, the result is Allow
-	// 3. Otherwise, use the default effect
+	// 3. Otherwise, the implicit deny stands
 	if explicitDeny {
 		result.Effect = EffectDeny
 	} else if hasAllow {
@@ -1223,6 +1240,18 @@ func awsIAMMatch(pattern, value string, evalCtx *EvaluationContext) bool {
 		return true // Universal wildcard
 	}
 
+	// IAM identity ARNs match case-sensitively: identity lookup is
+	// case-sensitive, so a case-variant names a different identity.
+	if strings.HasPrefix(value, "arn:aws:iam::") {
+		if expandedPattern == value {
+			return true
+		}
+		if strings.Contains(expandedPattern, "*") || strings.Contains(expandedPattern, "?") {
+			return wildcard.MatchesWildcard(expandedPattern, value)
+		}
+		return false
+	}
+
 	// Step 3: Case-insensitive exact match
 	if strings.EqualFold(expandedPattern, value) {
 		return true
diff --git a/weed/iam/policy/trust_policy_implicit_deny_test.go b/weed/iam/policy/trust_policy_implicit_deny_test.go
new file mode 100644
index 0000000000..2058bcf7c9
--- /dev/null
+++ b/weed/iam/policy/trust_policy_implicit_deny_test.go
@@ -0,0 +1,80 @@
+package policy
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+const subjectBoundTrustPolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow",
+	"Principal":{"Federated":"https://oidc.example"},"Action":["sts:AssumeRoleWithWebIdentity"],
+	"Condition":{"StringEquals":{"oidc:sub":"spiffe://example.org/ns/app/sa/app"}}}]}`
+
+func webIdentityContext(sub string) *EvaluationContext {
+	return &EvaluationContext{
+		Principal: "web-identity-user",
+		Action:    "sts:AssumeRoleWithWebIdentity",
+		Resource:  "arn:aws:iam::role/app",
+		RequestContext: map[string]interface{}{
+			"aws:FederatedProvider": "https://oidc.example",
+			"oidc:iss":              "https://oidc.example",
+			"oidc:sub":              sub,
+		},
+	}
+}
+
+// A trust policy is deny-by-default. The engine's DefaultEffect decides
+// requests no identity policy speaks to; it must not let a principal the trust
+// policy does not allow assume the role.
+func TestEvaluateTrustPolicyIsImplicitDenyWhateverTheDefaultEffect(t *testing.T) {
+	var trust PolicyDocument
+	if err := json.Unmarshal([]byte(subjectBoundTrustPolicy), &trust); err != nil {
+		t.Fatalf("parse test trust policy: %v", err)
+	}
+	for _, defaultEffect := range []string{"Allow", "Deny"} {
+		t.Run("defaultEffect="+defaultEffect, func(t *testing.T) {
+			engine := NewPolicyEngine()
+			if err := engine.Initialize(&PolicyEngineConfig{DefaultEffect: defaultEffect, StoreType: "memory"}); err != nil {
+				t.Fatalf("initialize policy engine: %v", err)
+			}
+
+			res, err := engine.EvaluateTrustPolicy(context.Background(), &trust, webIdentityContext("spiffe://example.org/ns/other/sa/x"))
+			if err != nil {
+				t.Fatalf("evaluate trust policy: %v", err)
+			}
+			if res.Effect != EffectDeny {
+				t.Errorf("a subject the trust policy does not allow got %s", res.Effect)
+			}
+
+			res, err = engine.EvaluateTrustPolicy(context.Background(), &trust, webIdentityContext("spiffe://example.org/ns/app/sa/app"))
+			if err != nil {
+				t.Fatalf("evaluate trust policy: %v", err)
+			}
+			if res.Effect != EffectAllow {
+				t.Errorf("the subject the trust policy allows got %s", res.Effect)
+			}
+		})
+	}
+}
+
+func TestEvaluateTrustPolicyExplicitDenyWins(t *testing.T) {
+	var trust PolicyDocument
+	doc := `{"Version":"2012-10-17","Statement":[
+		{"Effect":"Allow","Principal":{"Federated":"https://oidc.example"},"Action":["sts:AssumeRoleWithWebIdentity"]},
+		{"Effect":"Deny","Principal":{"Federated":"https://oidc.example"},"Action":["sts:AssumeRoleWithWebIdentity"],
+		 "Condition":{"StringEquals":{"oidc:sub":"spiffe://example.org/ns/app/sa/app"}}}]}`
+	if err := json.Unmarshal([]byte(doc), &trust); err != nil {
+		t.Fatalf("parse test trust policy: %v", err)
+	}
+	engine := NewPolicyEngine()
+	if err := engine.Initialize(&PolicyEngineConfig{DefaultEffect: "Allow", StoreType: "memory"}); err != nil {
+		t.Fatalf("initialize policy engine: %v", err)
+	}
+	res, err := engine.EvaluateTrustPolicy(context.Background(), &trust, webIdentityContext("spiffe://example.org/ns/app/sa/app"))
+	if err != nil {
+		t.Fatalf("evaluate trust policy: %v", err)
+	}
+	if res.Effect != EffectDeny {
+		t.Errorf("explicit Deny did not win: %s", res.Effect)
+	}
+}
diff --git a/weed/iam/providers/errors.go b/weed/iam/providers/errors.go
index eeac47c521..02ae7df532 100644
--- a/weed/iam/providers/errors.go
+++ b/weed/iam/providers/errors.go
@@ -19,4 +19,7 @@ var (
 
 	// ErrProviderMissingClaims indicates that required claims are missing from the token
 	ErrProviderMissingClaims = errors.New("provider: missing required claims")
+
+	// ErrProviderTokenReplayed is returned when a token with duplicate JTI is detected
+	ErrProviderTokenReplayed = errors.New("provider: token has been replayed")
 )
diff --git a/weed/iam/responses.go b/weed/iam/responses.go
index 45813f4026..0bd0660c0b 100644
--- a/weed/iam/responses.go
+++ b/weed/iam/responses.go
@@ -532,3 +532,83 @@ type ListUserTagsResponse struct {
 	} `xml:"ListUserTagsResult"`
 	CommonResponse
 }
+
+// IAMRole is the Role element returned by the role actions.
+type IAMRole struct {
+	Path                     string `xml:"Path"`
+	RoleName                 string `xml:"RoleName"`
+	RoleId                   string `xml:"RoleId"`
+	Arn                      string `xml:"Arn"`
+	CreateDate               string `xml:"CreateDate,omitempty"`
+	AssumeRolePolicyDocument string `xml:"AssumeRolePolicyDocument,omitempty"`
+	Description              string `xml:"Description,omitempty"`
+	MaxSessionDuration       int64  `xml:"MaxSessionDuration,omitempty"`
+}
+
+// IAMAttachedPolicy is one element of ListAttachedRolePolicies.
+type IAMAttachedPolicy struct {
+	PolicyName string `xml:"PolicyName"`
+	PolicyArn  string `xml:"PolicyArn"`
+}
+
+// CreateRoleResponse is the response for CreateRole.
+type CreateRoleResponse struct {
+	XMLName          xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ CreateRoleResponse"`
+	CreateRoleResult struct {
+		Role IAMRole `xml:"Role"`
+	} `xml:"CreateRoleResult"`
+	CommonResponse
+}
+
+// GetRoleResponse is the response for GetRole.
+type GetRoleResponse struct {
+	XMLName       xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ GetRoleResponse"`
+	GetRoleResult struct {
+		Role IAMRole `xml:"Role"`
+	} `xml:"GetRoleResult"`
+	CommonResponse
+}
+
+// ListRolesResponse is the response for ListRoles.
+type ListRolesResponse struct {
+	XMLName         xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ ListRolesResponse"`
+	ListRolesResult struct {
+		Roles       []*IAMRole `xml:"Roles>member"`
+		IsTruncated bool       `xml:"IsTruncated"`
+	} `xml:"ListRolesResult"`
+	CommonResponse
+}
+
+// DeleteRoleResponse is the response for DeleteRole.
+type DeleteRoleResponse struct {
+	XMLName xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ DeleteRoleResponse"`
+	CommonResponse
+}
+
+// UpdateAssumeRolePolicyResponse is the response for UpdateAssumeRolePolicy.
+type UpdateAssumeRolePolicyResponse struct {
+	XMLName xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ UpdateAssumeRolePolicyResponse"`
+	CommonResponse
+}
+
+// AttachRolePolicyResponse is the response for AttachRolePolicy.
+type AttachRolePolicyResponse struct {
+	XMLName xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ AttachRolePolicyResponse"`
+	CommonResponse
+}
+
+// DetachRolePolicyResponse is the response for DetachRolePolicy.
+type DetachRolePolicyResponse struct {
+	XMLName xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ DetachRolePolicyResponse"`
+	CommonResponse
+}
+
+// ListAttachedRolePoliciesResponse is the response for ListAttachedRolePolicies.
+type ListAttachedRolePoliciesResponse struct {
+	XMLName                        xml.Name `xml:"https://iam.amazonaws.com/doc/2010-05-08/ ListAttachedRolePoliciesResponse"`
+	ListAttachedRolePoliciesResult struct {
+		AttachedPolicies []*IAMAttachedPolicy `xml:"AttachedPolicies>member"`
+		IsTruncated      bool                 `xml:"IsTruncated"`
+	} `xml:"ListAttachedRolePoliciesResult"`
+	CommonResponse
+}
diff --git a/weed/iam/sts/constants.go b/weed/iam/sts/constants.go
index 9a4876069e..3e6e24df39 100644
--- a/weed/iam/sts/constants.go
+++ b/weed/iam/sts/constants.go
@@ -42,21 +42,23 @@ const (
 
 // Configuration Field Names
 const (
-	ConfigFieldFilerAddress          = "filerAddress"
-	ConfigFieldBasePath              = "basePath"
-	ConfigFieldIssuer                = "issuer"
-	ConfigFieldClientID              = "clientId"
-	ConfigFieldClientIDs             = "clientIds"
-	ConfigFieldThumbprints           = "thumbprints"
-	ConfigFieldAllowedPrincipalTagKeys = "allowedPrincipalTagKeys"
-	ConfigFieldPolicyClaim             = "policyClaim"
-	ConfigFieldClientSecret          = "clientSecret"
-	ConfigFieldJWKSUri               = "jwksUri"
-	ConfigFieldScopes                = "scopes"
-	ConfigFieldUserInfoUri           = "userInfoUri"
-	ConfigFieldRedirectUri           = "redirectUri"
-	ConfigFieldTLSCACert             = "tlsCaCert"
-	ConfigFieldTLSInsecureSkipVerify = "tlsInsecureSkipVerify"
+	ConfigFieldFilerAddress               = "filerAddress"
+	ConfigFieldBasePath                   = "basePath"
+	ConfigFieldIssuer                     = "issuer"
+	ConfigFieldClientID                   = "clientId"
+	ConfigFieldClientIDs                  = "clientIds"
+	ConfigFieldThumbprints                = "thumbprints"
+	ConfigFieldAllowedPrincipalTagKeys    = "allowedPrincipalTagKeys"
+	ConfigFieldPolicyClaim                = "policyClaim"
+	ConfigFieldClientSecret               = "clientSecret"
+	ConfigFieldJWKSUri                    = "jwksUri"
+	ConfigFieldScopes                     = "scopes"
+	ConfigFieldUserInfoUri                = "userInfoUri"
+	ConfigFieldRedirectUri                = "redirectUri"
+	ConfigFieldTLSCACert                  = "tlsCaCert"
+	ConfigFieldTLSInsecureSkipVerify      = "tlsInsecureSkipVerify"
+	ConfigFieldJTIReplayProtectionEnabled = "jtiReplayProtectionEnabled"
+	ConfigFieldJTICacheMaxSize            = "jtiCacheMaxSize"
 )
 
 // Error Messages
diff --git a/weed/iam/sts/credential_prefix_test.go b/weed/iam/sts/credential_prefix_test.go
index b3bd0d331f..b7f3758f16 100644
--- a/weed/iam/sts/credential_prefix_test.go
+++ b/weed/iam/sts/credential_prefix_test.go
@@ -1,6 +1,7 @@
 package sts
 
 import (
+	"context"
 	"encoding/base64"
 	"encoding/hex"
 	"strings"
@@ -16,7 +17,7 @@ func TestTemporaryCredentialPrefix(t *testing.T) {
 	sessionId := "test-session-for-prefix"
 	expiration := time.Now().Add(time.Hour)
 
-	credGen := NewCredentialGenerator()
+	credGen := testCredGen
 	cred, err := credGen.GenerateTemporaryCredentials(sessionId, expiration)
 
 	assert.NoError(t, err)
@@ -36,7 +37,7 @@ func TestTemporaryCredentialFormat(t *testing.T) {
 	sessionId := "format-test-session"
 	expiration := time.Now().Add(time.Hour)
 
-	credGen := NewCredentialGenerator()
+	credGen := testCredGen
 	cred, err := credGen.GenerateTemporaryCredentials(sessionId, expiration)
 
 	assert.NoError(t, err)
@@ -66,3 +67,34 @@ func TestTemporaryCredentialFormat(t *testing.T) {
 	// Verify session token is not empty
 	assert.NotEmpty(t, cred.SessionToken)
 }
+
+// A duration that came from configuration is bounded the same as one from a
+// request: the catalog passes -s3.iceberg.credentialDurationSeconds straight
+// through.
+func TestAssumeRoleForPrincipalValidatesDuration(t *testing.T) {
+	svc := NewSTSService()
+	err := svc.Initialize(&STSConfig{
+		TokenDuration:    FlexibleDuration{time.Hour},
+		MaxSessionLength: FlexibleDuration{12 * time.Hour},
+		Issuer:           "test-issuer",
+		SigningKey:       []byte("test-signing-key-at-least-32-bytes-long"),
+	})
+	if err != nil {
+		t.Fatalf("Initialize() error = %v", err)
+	}
+
+	for _, seconds := range []int64{60, 100000} {
+		duration := seconds
+		_, err := svc.AssumeRoleForPrincipal(context.Background(), &AssumeRoleForPrincipalRequest{
+			RoleArn:         "arn:aws:iam::role/IcebergTableAccess",
+			Principal:       "admin",
+			DurationSeconds: &duration,
+		})
+		if err == nil {
+			t.Fatalf("AssumeRoleForPrincipal(%ds) error = nil, want a validation error", seconds)
+		}
+		if !strings.Contains(err.Error(), "DurationSeconds") {
+			t.Errorf("AssumeRoleForPrincipal(%ds) error = %v, want it to name DurationSeconds", seconds, err)
+		}
+	}
+}
diff --git a/weed/iam/sts/oidc_provider_lookup_test.go b/weed/iam/sts/oidc_provider_lookup_test.go
index 0281e65b33..aba144be2b 100644
--- a/weed/iam/sts/oidc_provider_lookup_test.go
+++ b/weed/iam/sts/oidc_provider_lookup_test.go
@@ -11,8 +11,8 @@ import (
 // lookupOIDCProviderForAccount; the lookup never calls Authenticate.
 type stubIdentityProvider struct{ name string }
 
-func (s *stubIdentityProvider) Name() string                       { return s.name }
-func (s *stubIdentityProvider) Initialize(interface{}) error       { return nil }
+func (s *stubIdentityProvider) Name() string                 { return s.name }
+func (s *stubIdentityProvider) Initialize(interface{}) error { return nil }
 func (s *stubIdentityProvider) Authenticate(context.Context, string) (*providers.ExternalIdentity, error) {
 	return nil, nil
 }
@@ -103,3 +103,51 @@ func TestLookupOIDCProviderForAccountFallsBackToStatic(t *testing.T) {
 		t.Fatalf("expected static-config provider as last resort, got %v ok=%v", got, ok)
 	}
 }
+
+// shutdownTrackingProvider records Shutdown calls so tests can observe which
+// replaced providers the swap released.
+type shutdownTrackingProvider struct {
+	stubIdentityProvider
+	shutdownCalls int32
+}
+
+func (s *shutdownTrackingProvider) Shutdown(context.Context) error {
+	s.shutdownCalls++
+	return nil
+}
+
+// A provider dropped from the managed map owns a background JTI cleanup
+// worker; replacing the map must shut it down, while providers that stay in
+// the map keep running.
+func TestSetIAMManagedOIDCProvidersShutsDownDroppedProviders(t *testing.T) {
+	dropped := &shutdownTrackingProvider{stubIdentityProvider{name: "dropped"}, 0}
+	kept := &shutdownTrackingProvider{stubIdentityProvider{name: "kept"}, 0}
+	added := &shutdownTrackingProvider{stubIdentityProvider{name: "added"}, 0}
+
+	s := &STSService{issuerToProvider: map[string]providers.IdentityProvider{}}
+	s.SetIAMManagedOIDCProviders(map[string][]ScopedOIDCProvider{
+		"https://a.example.com": {{Provider: dropped}},
+		"https://b.example.com": {{Provider: kept}, {AccountID: "111111111111", Provider: kept}},
+	})
+
+	s.SetIAMManagedOIDCProviders(map[string][]ScopedOIDCProvider{
+		"https://b.example.com": {{Provider: kept}},
+		"https://c.example.com": {{Provider: added}},
+	})
+
+	if dropped.shutdownCalls != 1 {
+		t.Fatalf("dropped provider was shut down %d times, want 1", dropped.shutdownCalls)
+	}
+	if kept.shutdownCalls != 0 {
+		t.Fatalf("kept provider was shut down %d times, want 0", kept.shutdownCalls)
+	}
+	if added.shutdownCalls != 0 {
+		t.Fatalf("newly added provider was shut down %d times, want 0", added.shutdownCalls)
+	}
+
+	// Clearing the map releases the remaining providers.
+	s.SetIAMManagedOIDCProviders(nil)
+	if kept.shutdownCalls != 1 || added.shutdownCalls != 1 {
+		t.Fatalf("clearing the map shut down kept=%d added=%d, want 1 each", kept.shutdownCalls, added.shutdownCalls)
+	}
+}
diff --git a/weed/iam/sts/parent_user_test.go b/weed/iam/sts/parent_user_test.go
index 0059dda9c5..bae1258783 100644
--- a/weed/iam/sts/parent_user_test.go
+++ b/weed/iam/sts/parent_user_test.go
@@ -60,14 +60,84 @@ func TestComputeParentUserEncoding(t *testing.T) {
 	}
 }
 
+func TestIsParentUserID(t *testing.T) {
+	if !IsParentUserID(ComputeParentUser("alice", "https://idp.example/")) {
+		t.Fatal("a ComputeParentUser result must be recognized")
+	}
+	for _, s := range []string{"", "alice", "admin", "arn:aws:iam::123:user/admin", "dGVzdA=="} {
+		if IsParentUserID(s) {
+			t.Fatalf("%q is not a scoped parent user id", s)
+		}
+	}
+}
+
 func TestSessionClaimsRoundTripParentUser(t *testing.T) {
 	parent := ComputeParentUser("alice", "https://idp.example/")
 	claims := NewSTSSessionClaims("sid-1", "issuer", time.Now().Add(time.Hour)).
 		WithRoleInfo("arn:aws:iam::123:role/r", "arn:aws:sts::123:assumed-role/r/s", "arn:aws:sts::123:assumed-role/r/s").
 		WithParentUser(parent)
 
-	info := claims.ToSessionInfo()
+	info := claims.ToSessionInfo(testCredGen)
 	if info.ParentUser != parent {
 		t.Fatalf("ParentUser lost on round-trip: got %q want %q", info.ParentUser, parent)
 	}
 }
+
+func TestResolveIdentityClaimPrefersPreferredUsername(t *testing.T) {
+	ctx := map[string]interface{}{
+		"preferred_username": "grant.west",
+		"email":              "grant.west@example.com",
+		"sub":                "alice-sub",
+	}
+	if got := ResolveIdentityClaim(ctx); got != "grant.west" {
+		t.Fatalf("expected preferred_username, got %q", got)
+	}
+}
+
+func TestResolveIdentityClaimFallsBackThroughPriority(t *testing.T) {
+	if got := ResolveIdentityClaim(map[string]interface{}{"email": "g@example.com", "sub": "s"}); got != "g@example.com" {
+		t.Fatalf("expected email fallback, got %q", got)
+	}
+	if got := ResolveIdentityClaim(map[string]interface{}{"sub": "s"}); got != "s" {
+		t.Fatalf("expected sub fallback, got %q", got)
+	}
+}
+
+func TestResolveIdentityClaimEmpty(t *testing.T) {
+	if got := ResolveIdentityClaim(nil); got != "" {
+		t.Fatalf("expected empty for nil ctx, got %q", got)
+	}
+	if got := ResolveIdentityClaim(map[string]interface{}{}); got != "" {
+		t.Fatalf("expected empty for empty ctx, got %q", got)
+	}
+}
+
+func TestResolveIdentityClaimSkipsNonString(t *testing.T) {
+	ctx := map[string]interface{}{
+		"preferred_username": []string{"no"},
+		"sub":                "real-sub",
+	}
+	if got := ResolveIdentityClaim(ctx); got != "real-sub" {
+		t.Fatalf("expected sub after skipping non-string claim, got %q", got)
+	}
+}
+
+func TestResolveIdentityClaimTrimsWhitespace(t *testing.T) {
+	ctx := map[string]interface{}{
+		"preferred_username": "  grant.west  ",
+		"email":              "grant.west@example.com",
+	}
+	if got := ResolveIdentityClaim(ctx); got != "grant.west" {
+		t.Fatalf("expected trimmed preferred_username, got %q", got)
+	}
+}
+
+func TestResolveIdentityClaimSkipsWhitespaceOnly(t *testing.T) {
+	ctx := map[string]interface{}{
+		"preferred_username": "   ",
+		"email":              "grant.west@example.com",
+	}
+	if got := ResolveIdentityClaim(ctx); got != "grant.west@example.com" {
+		t.Fatalf("expected email after skipping whitespace-only preferred_username, got %q", got)
+	}
+}
diff --git a/weed/iam/sts/provider_factory.go b/weed/iam/sts/provider_factory.go
index 63e27e8124..b68894eb58 100644
--- a/weed/iam/sts/provider_factory.go
+++ b/weed/iam/sts/provider_factory.go
@@ -1,6 +1,7 @@
 package sts
 
 import (
+	"encoding/json"
 	"fmt"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -154,6 +155,21 @@ func (f *ProviderFactory) convertToOIDCConfig(configMap map[string]interface{})
 		config.TLSInsecureSkipVerify = tlsInsecureSkipVerify
 	}
 
+	if enabled, ok := configMap[ConfigFieldJTIReplayProtectionEnabled].(bool); ok {
+		config.JTIReplayProtectionEnabled = &enabled
+	}
+
+	switch maxSize := configMap[ConfigFieldJTICacheMaxSize].(type) {
+	case float64:
+		config.JTICacheMaxSize = int(maxSize)
+	case int:
+		config.JTICacheMaxSize = maxSize
+	case json.Number:
+		if n, err := maxSize.Int64(); err == nil {
+			config.JTICacheMaxSize = int(n)
+		}
+	}
+
 	// Convert claims mapping
 	if claimsMapInterface, ok := configMap["claimsMapping"]; ok {
 		claimsMap, err := f.convertToStringMap(claimsMapInterface)
diff --git a/weed/iam/sts/provider_factory_jti_test.go b/weed/iam/sts/provider_factory_jti_test.go
new file mode 100644
index 0000000000..93800113ff
--- /dev/null
+++ b/weed/iam/sts/provider_factory_jti_test.go
@@ -0,0 +1,31 @@
+package sts
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestConvertToOIDCConfigCarriesJTISettings(t *testing.T) {
+	factory := NewProviderFactory()
+
+	config, err := factory.convertToOIDCConfig(map[string]interface{}{
+		"issuer":                     "https://issuer.example",
+		"clientId":                   "client",
+		"jtiReplayProtectionEnabled": false,
+		"jtiCacheMaxSize":            float64(42),
+	})
+	require.NoError(t, err)
+	require.NotNil(t, config.JTIReplayProtectionEnabled)
+	assert.False(t, *config.JTIReplayProtectionEnabled)
+	assert.Equal(t, 42, config.JTICacheMaxSize)
+
+	config, err = factory.convertToOIDCConfig(map[string]interface{}{
+		"issuer":   "https://issuer.example",
+		"clientId": "client",
+	})
+	require.NoError(t, err)
+	assert.Nil(t, config.JTIReplayProtectionEnabled)
+	assert.Zero(t, config.JTICacheMaxSize)
+}
diff --git a/weed/iam/sts/session_claims.go b/weed/iam/sts/session_claims.go
index ede04b2a3a..0dd0361718 100644
--- a/weed/iam/sts/session_claims.go
+++ b/weed/iam/sts/session_claims.go
@@ -3,7 +3,7 @@ package sts
 import (
 	"crypto/sha256"
 	"encoding/base64"
-	"fmt"
+	"strings"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
@@ -24,10 +24,42 @@ func ComputeParentUser(sub, iss string) string {
 	return base64.RawURLEncoding.EncodeToString(h[:])
 }
 
-// defaultCredentialGenerator is a reusable instance for generating temporary credentials
-// Reusing a single instance across all calls to ToSessionInfo() reduces allocation overhead
-// since this method may be called frequently during signature verification
-var defaultCredentialGenerator = NewCredentialGenerator()
+// IsParentUserID reports whether s has the shape ComputeParentUser produces —
+// a base64url-encoded SHA-256 — i.e. an already issuer-scoped id rather than a
+// bare subject string.
+func IsParentUserID(s string) bool {
+	b, err := base64.RawURLEncoding.DecodeString(s)
+	return err == nil && len(b) == sha256.Size
+}
+
+// identityClaimPriority is the order in which ResolveIdentityClaim looks for a
+// human-readable, authoritative identity attribute in an STS request context.
+// The context is populated at federation time from the validated OIDC token
+// (see AssumeRoleWithWebIdentity), so every entry here is server-asserted and
+// not client-supplied. preferred_username/email/name are conventional OIDC
+// user claims; sub is the always-present stable subject identifier and the
+// final fallback so a federated session never audits as fully anonymous.
+var identityClaimPriority = []string{"preferred_username", "email", "name", "sub"}
+
+// ResolveIdentityClaim returns the most human-readable authoritative identity
+// claim available in ctx, or "" when none is present. ctx is the STS request
+// context (sessionInfo.RequestContext) populated from the validated OIDC token
+// at federation time. Non-string values are skipped so a structured claim
+// never leaks into an audit-facing field. Whitespace-only values are treated
+// as absent so a blank preferred claim does not mask a usable email or sub.
+func ResolveIdentityClaim(ctx map[string]interface{}) string {
+	if len(ctx) == 0 {
+		return ""
+	}
+	for _, key := range identityClaimPriority {
+		if v, ok := ctx[key].(string); ok {
+			if trimmed := strings.TrimSpace(v); trimmed != "" {
+				return trimmed
+			}
+		}
+	}
+	return ""
+}
 
 // STSSessionClaims represents comprehensive session information embedded in JWT tokens
 // This eliminates the need for separate session storage by embedding all session
@@ -41,9 +73,10 @@ type STSSessionClaims struct {
 	TokenType   string `json:"typ"`  // token_type
 
 	// Role information
-	RoleArn     string `json:"role"`      // role_arn
-	AssumedRole string `json:"assumed"`   // assumed_role_user
-	Principal   string `json:"principal"` // principal_arn
+	RoleArn     string `json:"role"`          // role_arn
+	RoleId      string `json:"rid,omitempty"` // unique ID of the assumed role
+	AssumedRole string `json:"assumed"`       // assumed_role_user
+	Principal   string `json:"principal"`     // principal_arn
 
 	// Authorization data
 	Policies []string `json:"pol,omitempty"` // policies (abbreviated)
@@ -67,6 +100,18 @@ type STSSessionClaims struct {
 	// guaranteed stable per OpenID Connect Core 1.0. Empty for non-federated
 	// session types.
 	ParentUser string `json:"puid,omitempty"`
+
+	// SourceAccessKeyId is the access key the caller authenticated with when
+	// a SeaweedFS service minted the session for it (AssumeRoleForPrincipal);
+	// empty for every other session type.
+	SourceAccessKeyId string `json:"src_ak,omitempty"`
+
+	// BoundAccessKeyId is the stored credential the session is bound to: the
+	// session ends when that key is gone. It is a claim of its own because
+	// tokens minted before the binding existed carry SourceAccessKeyId as an
+	// audit field, never a binding — enforcing those would break them.
+	BoundAccessKeyId          string `json:"bind_ak,omitempty"`
+	BoundAccessKeyFingerprint string `json:"bind_fp,omitempty"`
 }
 
 // NewSTSSessionClaims creates new STS session claims with all required information
@@ -92,27 +137,27 @@ func NewSTSSessionClaims(sessionId, issuer string, expiresAt time.Time) *STSSess
 
 // ToSessionInfo converts JWT claims back to SessionInfo structure
 // This enables seamless integration with existing code expecting SessionInfo
-func (c *STSSessionClaims) ToSessionInfo() *SessionInfo {
+func (c *STSSessionClaims) ToSessionInfo(credGen *CredentialGenerator) *SessionInfo {
 	var expiresAt time.Time
 	if c.ExpiresAt != nil {
 		expiresAt = c.ExpiresAt.Time
 	}
 
-	// Generate temporary credentials from the session ID
-	// This is deterministic based on the session ID, so the same credentials are regenerated
-	credentials, err := defaultCredentialGenerator.GenerateTemporaryCredentials(c.SessionId, expiresAt)
-	if err != nil {
-		// Log the error with context - credential generation failure is important for debugging
-		errMsg := fmt.Errorf("generate temporary credentials for session %s: %w", c.SessionId, err)
-		glog.Warningf("Failed to generate credentials for STS session: %v", errMsg)
-		// Return session info without credentials - validation will catch this as invalid
-		credentials = nil
+	var credentials *Credentials
+	if credGen != nil {
+		creds, err := credGen.GenerateTemporaryCredentials(c.SessionId, expiresAt)
+		if err != nil {
+			glog.Warningf("Failed to generate credentials for STS session %s: %v", c.SessionId, err)
+		} else {
+			credentials = creds
+		}
 	}
 
 	return &SessionInfo{
 		SessionId:        c.SessionId,
 		SessionName:      c.SessionName,
 		RoleArn:          c.RoleArn,
+		RoleId:           c.RoleId,
 		AssumedRoleUser:  c.AssumedRole,
 		Principal:        c.Principal,
 		Policies:         c.Policies,
@@ -123,6 +168,11 @@ func (c *STSSessionClaims) ToSessionInfo() *SessionInfo {
 		ProviderIssuer:   c.ProviderIssuer,
 		RequestContext:   c.RequestContext,
 		ParentUser:       c.ParentUser,
+		// The access key the session was minted for, if recorded
+		SourceAccessKeyId: c.SourceAccessKeyId,
+		// The stored credential the session is bound to, if any
+		BoundAccessKeyId:          c.BoundAccessKeyId,
+		BoundAccessKeyFingerprint: c.BoundAccessKeyFingerprint,
 		// Provide the Subject (sub) from registered claims
 		Subject:     c.Subject,
 		Credentials: credentials,
@@ -173,6 +223,13 @@ func (c *STSSessionClaims) WithRoleInfo(roleArn, assumedRole, principal string)
 }
 
 // WithPolicies sets the policies associated with this session
+// WithRoleId binds the session to the assumed role's unique ID. An empty ID
+// leaves the session unbound (roles that predate role IDs).
+func (c *STSSessionClaims) WithRoleId(roleId string) *STSSessionClaims {
+	c.RoleId = roleId
+	return c
+}
+
 func (c *STSSessionClaims) WithPolicies(policies []string) *STSSessionClaims {
 	c.Policies = policies
 	return c
@@ -210,6 +267,20 @@ func (c *STSSessionClaims) WithSessionName(sessionName string) *STSSessionClaims
 	return c
 }
 
+// WithSourceAccessKeyId records the access key the session was minted for.
+func (c *STSSessionClaims) WithSourceAccessKeyId(accessKeyId string) *STSSessionClaims {
+	c.SourceAccessKeyId = accessKeyId
+	return c
+}
+
+// WithBoundAccessKey binds the session to a stored credential: the key id it
+// was vended for and a fingerprint of its secret at mint time.
+func (c *STSSessionClaims) WithBoundAccessKey(accessKeyId, fingerprint string) *STSSessionClaims {
+	c.BoundAccessKeyId = accessKeyId
+	c.BoundAccessKeyFingerprint = fingerprint
+	return c
+}
+
 // WithParentUser sets the stable per-identity hash for the session. See
 // ComputeParentUser for the derivation rule.
 func (c *STSSessionClaims) WithParentUser(parentUser string) *STSSessionClaims {
diff --git a/weed/iam/sts/session_claims_test.go b/weed/iam/sts/session_claims_test.go
index 007f2404b3..aa4da831e6 100644
--- a/weed/iam/sts/session_claims_test.go
+++ b/weed/iam/sts/session_claims_test.go
@@ -8,6 +8,8 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+var testCredGen = NewCredentialGenerator([]byte("test-signing-key"))
+
 // TestSTSSessionClaimsToSessionInfo tests the ToSessionInfo conversion
 func TestSTSSessionClaimsToSessionInfo(t *testing.T) {
 	sessionId := "test-session-123"
@@ -24,7 +26,7 @@ func TestSTSSessionClaimsToSessionInfo(t *testing.T) {
 		WithIdentityProvider("oidc", "user-123", "https://issuer.example.com").
 		WithMaxDuration(time.Hour)
 
-	sessionInfo := claims.ToSessionInfo()
+	sessionInfo := claims.ToSessionInfo(testCredGen)
 
 	// Verify basic claims are converted
 	assert.Equal(t, sessionId, sessionInfo.SessionId)
@@ -52,11 +54,11 @@ func TestSTSSessionClaimsToSessionInfoCredentialGeneration(t *testing.T) {
 	expiresAt := time.Now().Add(time.Hour).Truncate(time.Second)
 
 	claims1 := NewSTSSessionClaims(sessionId, issuer, expiresAt)
-	sessionInfo1 := claims1.ToSessionInfo()
+	sessionInfo1 := claims1.ToSessionInfo(testCredGen)
 
 	// Create another claims object with the same session ID and expiration
 	claims2 := NewSTSSessionClaims(sessionId, issuer, expiresAt)
-	sessionInfo2 := claims2.ToSessionInfo()
+	sessionInfo2 := claims2.ToSessionInfo(testCredGen)
 
 	// Verify that both have valid credentials
 	assert.NotNil(t, sessionInfo1.Credentials, "credentials should be populated")
@@ -104,7 +106,7 @@ func TestSTSSessionClaimsToSessionInfoPreservesAllFields(t *testing.T) {
 		WithRequestContext(requestContext).
 		WithMaxDuration(2 * time.Hour)
 
-	sessionInfo := claims.ToSessionInfo()
+	sessionInfo := claims.ToSessionInfo(testCredGen)
 
 	// Verify all fields are preserved
 	assert.Equal(t, sessionId, sessionInfo.SessionId)
@@ -130,7 +132,7 @@ func TestSTSSessionClaimsToSessionInfoEmptyFields(t *testing.T) {
 	// Create claims with minimal fields
 	claims := NewSTSSessionClaims(sessionId, issuer, expiresAt)
 
-	sessionInfo := claims.ToSessionInfo()
+	sessionInfo := claims.ToSessionInfo(testCredGen)
 
 	// Verify basic fields are preserved
 	assert.Equal(t, sessionId, sessionInfo.SessionId)
@@ -177,7 +179,7 @@ func TestSTSSessionClaimsToSessionInfoCredentialExpiration(t *testing.T) {
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			claims := NewSTSSessionClaims(sessionId, issuer, tc.expiresAt)
-			sessionInfo := claims.ToSessionInfo()
+			sessionInfo := claims.ToSessionInfo(testCredGen)
 
 			assert.NotNil(t, sessionInfo.Credentials)
 			// Check expiration within 1 second due to timing precision (symmetric tolerance)
@@ -211,7 +213,7 @@ func TestSessionInfoIntegration(t *testing.T) {
 		WithIdentityProvider("test-provider", "user-id", "https://test.example.com")
 
 	// Convert to SessionInfo
-	sessionInfo := claims.ToSessionInfo()
+	sessionInfo := claims.ToSessionInfo(testCredGen)
 
 	// Verify the session info has valid credentials
 	assert.NotNil(t, sessionInfo.Credentials)
@@ -238,7 +240,7 @@ func TestSecretAccessKeyDeterminism(t *testing.T) {
 	expiration := time.Now().Add(time.Hour)
 
 	// Generate credentials multiple times with the same session ID
-	credGen := NewCredentialGenerator()
+	credGen := testCredGen
 
 	cred1, err := credGen.GenerateTemporaryCredentials(sessionId, expiration)
 	assert.NoError(t, err)
diff --git a/weed/iam/sts/source_access_key_test.go b/weed/iam/sts/source_access_key_test.go
new file mode 100644
index 0000000000..137c045376
--- /dev/null
+++ b/weed/iam/sts/source_access_key_test.go
@@ -0,0 +1,42 @@
+package sts
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newSourceKeyTestSTS(t *testing.T) *STSService {
+	t.Helper()
+	s := NewSTSService()
+	require.NoError(t, s.Initialize(&STSConfig{
+		TokenDuration:    FlexibleDuration{Duration: time.Hour},
+		MaxSessionLength: FlexibleDuration{Duration: 12 * time.Hour},
+		Issuer:           "test-issuer",
+		SigningKey:       []byte("test-signing-key-at-least-32-bytes-long-for-security"),
+	}))
+	return s
+}
+
+// A session minted for a caller's access key carries that key back out of its
+// token; a session minted without one carries none.
+func TestSessionCarriesItsSourceAccessKey(t *testing.T) {
+	s := newSourceKeyTestSTS(t)
+	resp, err := s.issueSession("arn:aws:iam::role/IcebergTableAccess", "", "iceberg-alice-ns-t-kabc", "", nil,
+		"iceberg-catalog", "alice", func(c *STSSessionClaims) { c.WithSourceAccessKeyId("AKIASOURCE") })
+	require.NoError(t, err)
+	info, err := s.ValidateSessionToken(context.Background(), resp.Credentials.SessionToken)
+	require.NoError(t, err)
+	assert.Equal(t, "AKIASOURCE", info.SourceAccessKeyId)
+	assert.Equal(t, "alice", info.ExternalUserId)
+	assert.Equal(t, "iceberg-catalog", info.IdentityProvider)
+
+	resp, err = s.issueSession("arn:aws:iam::role/IcebergTableAccess", "", "iceberg-alice-ns-t", "", nil, "iceberg-catalog", "alice")
+	require.NoError(t, err)
+	info, err = s.ValidateSessionToken(context.Background(), resp.Credentials.SessionToken)
+	require.NoError(t, err)
+	assert.Equal(t, "", info.SourceAccessKeyId)
+}
diff --git a/weed/iam/sts/sts_service.go b/weed/iam/sts/sts_service.go
index e7ca172621..99f48dc14d 100644
--- a/weed/iam/sts/sts_service.go
+++ b/weed/iam/sts/sts_service.go
@@ -94,6 +94,7 @@ type STSService struct {
 	providers            map[string]providers.IdentityProvider
 	issuerToProvider     map[string]providers.IdentityProvider // Efficient issuer-based provider lookup
 	tokenGenerator       *TokenGenerator
+	credGenerator        *CredentialGenerator
 	trustPolicyValidator TrustPolicyValidator // Interface for trust policy validation
 
 	// iamManagedOIDCMu guards iamManagedOIDCByIssuer. The map is the live view
@@ -128,6 +129,11 @@ func (s *STSService) GetTokenGenerator() *TokenGenerator {
 	return s.tokenGenerator
 }
 
+// GetCredentialGenerator returns the credential generator used by the STS service.
+func (s *STSService) GetCredentialGenerator() *CredentialGenerator {
+	return s.credGenerator
+}
+
 // STSConfig holds STS service configuration
 type STSConfig struct {
 	// TokenDuration is the default duration for issued tokens
@@ -181,6 +187,11 @@ type AssumeRoleWithWebIdentityRequest struct {
 
 	// Policy is an optional session policy (optional)
 	Policy *string `json:"Policy,omitempty"`
+
+	// RoleId is the assumed role's unique ID, set by the IAM manager after it
+	// resolves the role. It is embedded in the session so the session is bound
+	// to this role and not to whatever role later holds the same name.
+	RoleId string `json:"-"`
 }
 
 // AssumeRoleWithCredentialsRequest represents a request to assume role with username/password
@@ -205,6 +216,9 @@ type AssumeRoleWithCredentialsRequest struct {
 
 	// Policy is an optional session policy (optional)
 	Policy *string `json:"Policy,omitempty"`
+
+	// RoleId is set by the IAM manager; see AssumeRoleWithWebIdentityRequest.
+	RoleId string `json:"-"`
 }
 
 // AssumeRoleResponse represents the response from assume role operations
@@ -298,6 +312,24 @@ type SessionInfo struct {
 
 	// ParentUser is the stable hashed identity (sub+iss) derived at federation time.
 	ParentUser string `json:"parentUser,omitempty"`
+
+	// RoleId is the unique ID of the role the session was issued for; empty
+	// for sessions issued before role IDs were recorded.
+	RoleId string `json:"roleId,omitempty"`
+
+	// SourceAccessKeyId is the access key the session was minted for, when the
+	// minting service recorded it (AssumeRoleForPrincipal).
+	SourceAccessKeyId string `json:"sourceAccessKeyId,omitempty"`
+
+	// BoundAccessKeyId is the stored credential the session is bound to, when
+	// the minting service recorded one (AssumeRoleForPrincipal). A legacy
+	// SourceAccessKeyId is never treated as a binding.
+	BoundAccessKeyId string `json:"boundAccessKeyId,omitempty"`
+
+	// BoundAccessKeyFingerprint identifies the credential instance the
+	// session is bound to, so a key re-created under the same id does not
+	// match.
+	BoundAccessKeyFingerprint string `json:"boundAccessKeyFingerprint,omitempty"`
 }
 
 // NewSTSService creates a new STS service
@@ -325,6 +357,7 @@ func (s *STSService) Initialize(config *STSConfig) error {
 
 	// Initialize token generator for stateless JWT operations
 	s.tokenGenerator = NewTokenGenerator(config.SigningKey, config.Issuer)
+	s.credGenerator = NewCredentialGenerator(config.SigningKey)
 
 	// Load identity providers from configuration
 	if err := s.loadProvidersFromConfig(config); err != nil {
@@ -489,8 +522,35 @@ func (s *STSService) SetIAMManagedOIDCProviders(byIssuer map[string][]ScopedOIDC
 		}
 	}
 	s.iamManagedOIDCMu.Lock()
+	old := s.iamManagedOIDCByIssuer
 	s.iamManagedOIDCByIssuer = cp
 	s.iamManagedOIDCMu.Unlock()
+
+	// Providers dropped by the swap may own background workers (the JTI
+	// cleanup goroutine); stop them so a replaced provider does not leak.
+	kept := make(map[providers.IdentityProvider]struct{})
+	for _, scoped := range cp {
+		for _, sp := range scoped {
+			kept[sp.Provider] = struct{}{}
+		}
+	}
+	stopped := make(map[providers.IdentityProvider]struct{})
+	for _, scoped := range old {
+		for _, sp := range scoped {
+			if _, ok := kept[sp.Provider]; ok {
+				continue
+			}
+			if _, ok := stopped[sp.Provider]; ok {
+				continue
+			}
+			stopped[sp.Provider] = struct{}{}
+			if sd, ok := sp.Provider.(interface{ Shutdown(context.Context) error }); ok {
+				if err := sd.Shutdown(context.Background()); err != nil {
+					glog.Warningf("OIDC provider %q shutdown after replacement: %v", sp.Provider.Name(), err)
+				}
+			}
+		}
+	}
 }
 
 // lookupOIDCProviderForAccount returns the provider that should validate
@@ -564,7 +624,7 @@ func (s *STSService) AssumeRoleWithWebIdentity(ctx context.Context, request *Ass
 	// caller passed a legacy or claim-based ARN, in which case lookup falls
 	// back to a global (account-less) record only.
 	roleAccountID := utils.ParseRoleARN(request.RoleArn).AccountID
-	externalIdentity, provider, err := s.validateWebIdentityToken(ctx, request.WebIdentityToken, roleAccountID)
+	externalIdentity, provider, err := s.validateWebIdentityToken(ctx, request.WebIdentityToken, roleAccountID, true)
 	if err != nil {
 		return nil, fmt.Errorf("failed to validate web identity token: %w", err)
 	}
@@ -596,9 +656,8 @@ func (s *STSService) AssumeRoleWithWebIdentity(ctx context.Context, request *Ass
 		}
 	}
 
-	// 4. Calculate session duration, capping at the source token's expiration
-	// This ensures sessions from short-lived tokens (e.g., GitLab CI job tokens) don't outlive their source
-	sessionDuration := s.calculateSessionDuration(request.DurationSeconds, externalIdentity.TokenExpiration)
+	// 4. Calculate session duration
+	sessionDuration := s.CalculateSessionDuration(request.DurationSeconds)
 	expiresAt := time.Now().Add(sessionDuration)
 
 	// 5. Generate session ID and credentials
@@ -607,8 +666,7 @@ func (s *STSService) AssumeRoleWithWebIdentity(ctx context.Context, request *Ass
 		return nil, fmt.Errorf("failed to generate session ID: %w", err)
 	}
 
-	credGenerator := NewCredentialGenerator()
-	credentials, err := credGenerator.GenerateTemporaryCredentials(sessionId, expiresAt)
+	credentials, err := s.credGenerator.GenerateTemporaryCredentials(sessionId, expiresAt)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate credentials: %w", err)
 	}
@@ -683,6 +741,7 @@ func (s *STSService) AssumeRoleWithWebIdentity(ctx context.Context, request *Ass
 	sessionClaims := NewSTSSessionClaims(sessionId, s.Config.Issuer, expiresAt).
 		WithSessionName(request.RoleSessionName).
 		WithRoleInfo(effectiveRoleArn, assumedRoleUser.Arn, assumedRoleUser.Arn).
+		WithRoleId(request.RoleId).
 		WithIdentityProvider(provider.Name(), externalIdentity.UserID, externalIdentity.Issuer).
 		WithMaxDuration(sessionDuration).
 		WithRequestContext(requestContext)
@@ -754,55 +813,164 @@ func (s *STSService) AssumeRoleWithCredentials(ctx context.Context, request *Ass
 		return nil, fmt.Errorf("role assumption denied: %w", err)
 	}
 
-	// 4. Calculate session duration
-	// For credential-based auth, there's no source token with expiration to cap against
-	sessionDuration := s.calculateSessionDuration(request.DurationSeconds, nil)
+	// 4-7. Mint the session
+	return s.issueSession(request.RoleArn, request.RoleId, request.RoleSessionName, sessionPolicy,
+		request.DurationSeconds, provider.Name(), externalIdentity.UserID)
+}
+
+// issueSession mints temporary credentials and the self-contained JWT that
+// carries the whole session, shared by every assume-role entry point.
+func (s *STSService) issueSession(roleArn, roleId, roleSessionName, sessionPolicy string,
+	durationSeconds *int64, providerName, subject string, options ...func(*STSSessionClaims)) (*AssumeRoleResponse, error) {
+
+	sessionDuration := s.CalculateSessionDuration(durationSeconds)
 	expiresAt := time.Now().Add(sessionDuration)
 
-	// 5. Generate session ID and temporary credentials
 	sessionId, err := GenerateSessionId()
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate session ID: %w", err)
 	}
 
-	credGenerator := NewCredentialGenerator()
-	tempCredentials, err := credGenerator.GenerateTemporaryCredentials(sessionId, expiresAt)
+	tempCredentials, err := s.credGenerator.GenerateTemporaryCredentials(sessionId, expiresAt)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate credentials: %w", err)
 	}
 
-	// 6. Create comprehensive JWT session token with all session information embedded
 	assumedRoleUser := &AssumedRoleUser{
-		AssumedRoleId: request.RoleArn,
-		Arn:           GenerateAssumedRoleArn(request.RoleArn, request.RoleSessionName),
-		Subject:       externalIdentity.UserID,
+		AssumedRoleId: roleArn,
+		Arn:           GenerateAssumedRoleArn(roleArn, roleSessionName),
+		Subject:       subject,
 	}
 
-	// Create rich JWT claims with all session information
 	sessionClaims := NewSTSSessionClaims(sessionId, s.Config.Issuer, expiresAt).
-		WithSessionName(request.RoleSessionName).
-		WithRoleInfo(request.RoleArn, assumedRoleUser.Arn, assumedRoleUser.Arn).
-		WithIdentityProvider(provider.Name(), externalIdentity.UserID, "").
+		WithSessionName(roleSessionName).
+		WithRoleInfo(roleArn, assumedRoleUser.Arn, assumedRoleUser.Arn).
+		WithRoleId(roleId).
+		WithIdentityProvider(providerName, subject, "").
 		WithMaxDuration(sessionDuration)
 	if sessionPolicy != "" {
 		sessionClaims.WithSessionPolicy(sessionPolicy)
 	}
+	for _, option := range options {
+		option(sessionClaims)
+	}
 
-	// Generate self-contained JWT token with all session information
 	jwtToken, err := s.tokenGenerator.GenerateJWTWithClaims(sessionClaims)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate JWT session token: %w", err)
 	}
 	tempCredentials.SessionToken = jwtToken
 
-	// 7. Build and return response (no session storage needed!)
-
 	return &AssumeRoleResponse{
 		Credentials:     tempCredentials,
 		AssumedRoleUser: assumedRoleUser,
 	}, nil
 }
 
+// validateSessionDurationSeconds bounds a requested session lifetime the way
+// AWS STS does. Every assume-role entry point runs it, so a duration that came
+// from configuration is checked the same as one from a request.
+func (s *STSService) validateSessionDurationSeconds(durationSeconds *int64) error {
+	if durationSeconds == nil {
+		return nil
+	}
+	maxSec := int64(DefaultMaxSessionLength)
+	if s.Config != nil && s.Config.MaxSessionLength.Duration > 0 {
+		configuredMax := int64(s.Config.MaxSessionLength.Duration / time.Second)
+		if configuredMax >= 900 {
+			maxSec = configuredMax
+		}
+	}
+	if *durationSeconds < 900 || *durationSeconds > maxSec {
+		return fmt.Errorf("DurationSeconds must be between 900 and %d seconds", maxSec)
+	}
+	return nil
+}
+
+// AssumeRoleForPrincipalRequest asks for a session on behalf of a principal the
+// calling service has already authenticated.
+type AssumeRoleForPrincipalRequest struct {
+	// RoleArn is the ARN of the role to assume.
+	RoleArn string
+
+	// Principal identifies the already-authenticated caller.
+	Principal string
+
+	// RoleSessionName names the session.
+	RoleSessionName string
+
+	// ProviderName records how the caller was authenticated.
+	ProviderName string
+
+	// Policy optionally narrows the session below the role's own permissions.
+	Policy *string
+
+	// DurationSeconds requests a session lifetime.
+	DurationSeconds *int64
+
+	// SourceAccessKeyId optionally records the access key the caller
+	// authenticated with, so the session can be tied to that key.
+	SourceAccessKeyId string
+
+	// BoundAccessKeyId binds the session to a stored credential: the session
+	// ends when that key is gone. Distinct from SourceAccessKeyId, which is
+	// audit-only on sessions minted before the binding existed.
+	BoundAccessKeyId string
+
+	// BoundAccessKeyFingerprint identifies the bound credential instance.
+	BoundAccessKeyFingerprint string
+}
+
+// AssumeRoleForPrincipal issues session credentials for a caller that a
+// SeaweedFS service authenticated itself, such as the Iceberg catalog vending
+// scoped credentials for a table it has already authorized. There is no
+// external token left to verify at this point, so the role's trust policy is
+// the control point and is still enforced.
+func (s *STSService) AssumeRoleForPrincipal(ctx context.Context, request *AssumeRoleForPrincipalRequest) (*AssumeRoleResponse, error) {
+	if !s.initialized {
+		return nil, fmt.Errorf(ErrSTSServiceNotInitialized)
+	}
+	if request == nil {
+		return nil, fmt.Errorf("request cannot be nil")
+	}
+	if request.RoleArn == "" {
+		return nil, fmt.Errorf("role ARN cannot be empty")
+	}
+	if request.Principal == "" {
+		return nil, fmt.Errorf("principal cannot be empty")
+	}
+	if err := s.validateSessionDurationSeconds(request.DurationSeconds); err != nil {
+		return nil, fmt.Errorf("invalid request: %w", err)
+	}
+
+	sessionPolicy := ""
+	if request.Policy != nil {
+		normalized, err := NormalizeSessionPolicy(*request.Policy)
+		if err != nil {
+			return nil, fmt.Errorf("invalid session policy: %w", err)
+		}
+		sessionPolicy = normalized
+	}
+
+	identity := &providers.ExternalIdentity{
+		UserID:      request.Principal,
+		DisplayName: request.Principal,
+		Provider:    request.ProviderName,
+	}
+	if err := s.validateRoleAssumptionForCredentials(ctx, request.RoleArn, identity); err != nil {
+		return nil, fmt.Errorf("role assumption denied: %w", err)
+	}
+
+	// Iceberg credential vending resolves no role definition, so its sessions
+	// carry no role ID and stay bound by name.
+	return s.issueSession(request.RoleArn, "", request.RoleSessionName, sessionPolicy,
+		request.DurationSeconds, request.ProviderName, request.Principal,
+		func(c *STSSessionClaims) {
+			c.WithSourceAccessKeyId(request.SourceAccessKeyId)
+			c.WithBoundAccessKey(request.BoundAccessKeyId, request.BoundAccessKeyFingerprint)
+		})
+}
+
 // ValidateSessionToken validates a session token and returns session information
 // This method is now completely stateless - all session information is extracted from the JWT token
 func (s *STSService) ValidateSessionToken(ctx context.Context, sessionToken string) (*SessionInfo, error) {
@@ -822,7 +990,7 @@ func (s *STSService) ValidateSessionToken(ctx context.Context, sessionToken stri
 
 	// Convert JWT claims back to SessionInfo
 	// All session information is embedded in the JWT token itself
-	return claims.ToSessionInfo(), nil
+	return claims.ToSessionInfo(s.credGenerator), nil
 }
 
 // NOTE: Session revocation is not supported in the stateless JWT design.
@@ -855,20 +1023,13 @@ func (s *STSService) validateAssumeRoleWithWebIdentityRequest(request *AssumeRol
 		return fmt.Errorf("RoleSessionName is required")
 	}
 
-	// Validate session duration if provided
-	if request.DurationSeconds != nil {
-		if *request.DurationSeconds < 900 || *request.DurationSeconds > 43200 { // 15min to 12 hours
-			return fmt.Errorf("DurationSeconds must be between 900 and 43200 seconds")
-		}
-	}
-
-	return nil
+	return s.validateSessionDurationSeconds(request.DurationSeconds)
 }
 
 // validateWebIdentityToken validates the web identity token with strict issuer-to-provider mapping
 // SECURITY: JWT tokens with a specific issuer claim MUST only be validated by the provider for that issuer
 // SECURITY: This method only accepts JWT tokens. Non-JWT authentication must use AssumeRoleWithCredentials with explicit ProviderName.
-func (s *STSService) validateWebIdentityToken(ctx context.Context, token, roleAccountID string) (*providers.ExternalIdentity, providers.IdentityProvider, error) {
+func (s *STSService) validateWebIdentityToken(ctx context.Context, token, roleAccountID string, singleUse bool) (*providers.ExternalIdentity, providers.IdentityProvider, error) {
 	// Try to extract issuer from JWT token for strict validation
 	issuer, err := s.extractIssuerFromJWT(token)
 	if err != nil {
@@ -891,8 +1052,10 @@ func (s *STSService) validateWebIdentityToken(ctx context.Context, token, roleAc
 		return nil, nil, fmt.Errorf("no identity provider registered for issuer: %s", issuer)
 	}
 
-	// Authenticate with the correct provider for this issuer
-	identity, err := provider.Authenticate(ctx, token)
+	// Authenticate with the correct provider for this issuer. Only the STS
+	// exchange authenticates single-use: a bearer token is presented on every
+	// request, so consuming it here would reject all but the first one.
+	identity, err := authenticateOIDCProvider(ctx, provider, token, singleUse)
 	if err != nil {
 		// Map provider errors to STS errors using errors.Is() for robust error checking
 		// This eliminates fragile string matching and provides reliable error classification
@@ -924,14 +1087,29 @@ func (s *STSService) validateWebIdentityToken(ctx context.Context, token, roleAc
 // only, then static-config); call ValidateWebIdentityTokenForAccount when the assumed-role account
 // is known.
 func (s *STSService) ValidateWebIdentityToken(ctx context.Context, token string) (*providers.ExternalIdentity, providers.IdentityProvider, error) {
-	return s.validateWebIdentityToken(ctx, token, "")
+	return s.validateWebIdentityToken(ctx, token, "", false)
 }
 
 // ValidateWebIdentityTokenForAccount mirrors ValidateWebIdentityToken but
 // scopes the IAM-managed provider lookup to roleAccountID. Pass "" for
 // callers that don't yet know the account (e.g. claim-based mode).
 func (s *STSService) ValidateWebIdentityTokenForAccount(ctx context.Context, token, roleAccountID string) (*providers.ExternalIdentity, providers.IdentityProvider, error) {
-	return s.validateWebIdentityToken(ctx, token, roleAccountID)
+	return s.validateWebIdentityToken(ctx, token, roleAccountID, false)
+}
+
+// authenticateOIDCProvider authenticates the token, consuming it for replay
+// protection when the caller is the single-use STS exchange and the provider
+// supports it. Other providers and non-exchange callers authenticate without
+// consuming.
+func authenticateOIDCProvider(ctx context.Context, provider providers.IdentityProvider, token string, singleUse bool) (*providers.ExternalIdentity, error) {
+	if singleUse {
+		if su, ok := provider.(interface {
+			AuthenticateSingleUse(context.Context, string) (*providers.ExternalIdentity, error)
+		}); ok {
+			return su.AuthenticateSingleUse(ctx, token)
+		}
+	}
+	return provider.Authenticate(ctx, token)
 }
 
 // extractIssuerFromJWT extracts the issuer (iss) claim from a JWT token without verification
@@ -1035,34 +1213,18 @@ func (s *STSService) validateRoleAssumptionForCredentials(ctx context.Context, r
 	return nil
 }
 
-// calculateSessionDuration calculates the session duration, respecting the source token's expiration
-// If the incoming web identity token has an exp claim, the session duration is capped to not exceed it
-// This ensures that sessions from short-lived tokens (e.g., GitLab CI job tokens) don't outlive their source
-func (s *STSService) calculateSessionDuration(durationSeconds *int64, tokenExpiration *time.Time) time.Duration {
+// CalculateSessionDuration returns the requested DurationSeconds, or the
+// configured TokenDuration default, capped at MaxSessionLength. The source
+// token's exp deliberately plays no part: per AWS semantics the session
+// outlives the (already verified) web identity token.
+func (s *STSService) CalculateSessionDuration(durationSeconds *int64) time.Duration {
 	var duration time.Duration
 	if durationSeconds != nil {
 		duration = time.Duration(*durationSeconds) * time.Second
 	} else {
-		// Use default from config
 		duration = s.Config.TokenDuration.Duration
 	}
 
-	// If the source token has an expiration, cap the session duration to not exceed it
-	// This follows the principle: "if calculated exp > incoming exp claim, then limit outgoing exp to incoming exp"
-	if tokenExpiration != nil && !tokenExpiration.IsZero() {
-		timeUntilTokenExpiry := time.Until(*tokenExpiration)
-		if timeUntilTokenExpiry <= 0 {
-			// Token already expired - use minimal duration as defense-in-depth
-			// The token should have been rejected during validation, but we handle this defensively
-			glog.V(2).Infof("Source token already expired, using minimal session duration")
-			duration = time.Minute
-		} else if timeUntilTokenExpiry < duration {
-			glog.V(2).Infof("Limiting session duration from %v to %v based on source token expiration",
-				duration, timeUntilTokenExpiry)
-			duration = timeUntilTokenExpiry
-		}
-	}
-
 	// Cap at MaxSessionLength if configured
 	if s.Config.MaxSessionLength.Duration > 0 && duration > s.Config.MaxSessionLength.Duration {
 		glog.V(2).Infof("Limiting session duration from %v to %v based on MaxSessionLength config",
@@ -1095,14 +1257,7 @@ func (s *STSService) validateAssumeRoleWithCredentialsRequest(request *AssumeRol
 		return fmt.Errorf("ProviderName is required")
 	}
 
-	// Validate session duration if provided
-	if request.DurationSeconds != nil {
-		if *request.DurationSeconds < 900 || *request.DurationSeconds > 43200 { // 15min to 12 hours
-			return fmt.Errorf("DurationSeconds must be between 900 and 43200 seconds")
-		}
-	}
-
-	return nil
+	return s.validateSessionDurationSeconds(request.DurationSeconds)
 }
 
 // ExpireSessionForTesting manually expires a session for testing purposes
diff --git a/weed/iam/sts/sts_service_duration_test.go b/weed/iam/sts/sts_service_duration_test.go
new file mode 100644
index 0000000000..30b5e52983
--- /dev/null
+++ b/weed/iam/sts/sts_service_duration_test.go
@@ -0,0 +1,57 @@
+package sts
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func newSTSServiceWithMaxSession(t *testing.T, maxSession time.Duration) *STSService {
+	t.Helper()
+	s := NewSTSService()
+	assert.NoError(t, s.Initialize(&STSConfig{
+		Issuer:           "test-issuer",
+		SigningKey:       []byte("test-signing-key-at-least-32-bytes-long"),
+		TokenDuration:    FlexibleDuration{Duration: time.Hour},
+		MaxSessionLength: FlexibleDuration{Duration: maxSession},
+	}))
+	return s
+}
+
+func secondsPtr(v int64) *int64 { return &v }
+
+func TestValidateSessionDurationSeconds_RespectsConfiguredMaxSessionLength(t *testing.T) {
+	s := newSTSServiceWithMaxSession(t, 168*time.Hour)
+	assert.NoError(t, s.validateSessionDurationSeconds(secondsPtr(604800)))
+}
+
+func TestValidateSessionDurationSeconds_RejectsAboveConfiguredMaxSessionLength(t *testing.T) {
+	s := newSTSServiceWithMaxSession(t, 24*time.Hour)
+	err := s.validateSessionDurationSeconds(secondsPtr(90000))
+	assert.Error(t, err)
+}
+
+func TestValidateSessionDurationSeconds_FallsBackToDefaultWhenUnset(t *testing.T) {
+	s := &STSService{}
+	assert.NoError(t, s.validateSessionDurationSeconds(secondsPtr(43200)))
+	err := s.validateSessionDurationSeconds(secondsPtr(43201))
+	assert.Error(t, err)
+}
+
+func TestValidateSessionDurationSeconds_EnforcesMinimum(t *testing.T) {
+	s := newSTSServiceWithMaxSession(t, 168*time.Hour)
+	assert.Error(t, s.validateSessionDurationSeconds(secondsPtr(899)))
+}
+
+func TestValidateSessionDurationSeconds_NilReturnsNil(t *testing.T) {
+	s := newSTSServiceWithMaxSession(t, 168*time.Hour)
+	assert.NoError(t, s.validateSessionDurationSeconds(nil))
+}
+
+func TestValidateSessionDurationSeconds_SubMinimumMaxSessionLengthKeepsCapping(t *testing.T) {
+	s := newSTSServiceWithMaxSession(t, 5*time.Minute)
+	assert.NoError(t, s.validateSessionDurationSeconds(secondsPtr(900)))
+	assert.NoError(t, s.validateSessionDurationSeconds(secondsPtr(43200)))
+	assert.Error(t, s.validateSessionDurationSeconds(secondsPtr(43201)))
+}
diff --git a/weed/iam/sts/sts_service_test.go b/weed/iam/sts/sts_service_test.go
new file mode 100644
index 0000000000..1fbc1c32d2
--- /dev/null
+++ b/weed/iam/sts/sts_service_test.go
@@ -0,0 +1,38 @@
+package sts
+
+import (
+	"testing"
+	"time"
+)
+
+func TestCalculateSessionDuration(t *testing.T) {
+	svc := NewSTSService()
+	if err := svc.Initialize(&STSConfig{
+		TokenDuration:    FlexibleDuration{time.Hour},
+		MaxSessionLength: FlexibleDuration{12 * time.Hour},
+		Issuer:           "test-issuer",
+		SigningKey:       []byte("test-signing-key-at-least-32-bytes-long"),
+	}); err != nil {
+		t.Fatalf("Initialize() error = %v", err)
+	}
+
+	seconds := func(v int64) *int64 { return &v }
+
+	tests := []struct {
+		name            string
+		durationSeconds *int64
+		want            time.Duration
+	}{
+		{"default from config", nil, time.Hour},
+		{"explicit request", seconds(1800), 30 * time.Minute},
+		{"capped at MaxSessionLength", seconds(86400), 12 * time.Hour},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := svc.CalculateSessionDuration(tc.durationSeconds); got != tc.want {
+				t.Errorf("CalculateSessionDuration(%v) = %v, want %v", tc.durationSeconds, got, tc.want)
+			}
+		})
+	}
+}
diff --git a/weed/iam/sts/token_utils.go b/weed/iam/sts/token_utils.go
index b7a51cdf34..ace7302712 100644
--- a/weed/iam/sts/token_utils.go
+++ b/weed/iam/sts/token_utils.go
@@ -1,6 +1,7 @@
 package sts
 
 import (
+	"crypto/hmac"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
@@ -163,11 +164,15 @@ type SessionTokenClaims struct {
 }
 
 // CredentialGenerator generates AWS-compatible temporary credentials
-type CredentialGenerator struct{}
+type CredentialGenerator struct {
+	signingKey []byte
+}
 
-// NewCredentialGenerator creates a new credential generator
-func NewCredentialGenerator() *CredentialGenerator {
-	return &CredentialGenerator{}
+// NewCredentialGenerator creates a new credential generator. The signing key
+// keys the secret access key derivation so it cannot be recomputed from the
+// session id embedded in the session token.
+func NewCredentialGenerator(signingKey []byte) *CredentialGenerator {
+	return &CredentialGenerator{signingKey: signingKey}
 }
 
 // GenerateTemporaryCredentials creates temporary AWS credentials
@@ -203,16 +208,13 @@ func (c *CredentialGenerator) generateTemporaryAccessKeyId(sessionId string) (st
 	return "ASIA" + hex.EncodeToString(hash[:8]), nil // AWS format: ASIA + 16 chars
 }
 
-// generateSecretAccessKey generates a deterministic secret access key based on sessionId
-// This ensures the same secret key is regenerated from the JWT claims during signature verification
+// generateSecretAccessKey derives the secret access key from the session id
+// keyed on the STS signing key. Issuance and the regeneration in ToSessionInfo
+// agree on the value, but it cannot be recomputed from the token alone.
 func (c *CredentialGenerator) generateSecretAccessKey(sessionId string) (string, error) {
-	// Create deterministic secret key based on session ID (not random!)
-	// This is critical for STS because:
-	// 1. AssumeRoleWithWebIdentity generates the secret key once
-	// 2. During signature verification, ToSessionInfo() regenerates credentials from JWT
-	// 3. Both must generate the same secret key for signature verification to succeed
-	hash := sha256.Sum256([]byte("secret-key:" + sessionId))
-	return base64.StdEncoding.EncodeToString(hash[:]), nil
+	mac := hmac.New(sha256.New, c.signingKey)
+	mac.Write([]byte("secret-key:" + sessionId))
+	return base64.StdEncoding.EncodeToString(mac.Sum(nil)), nil
 }
 
 // generateSessionTokenId generates a session token identifier
diff --git a/weed/iamapi/iamapi_authz_test.go b/weed/iamapi/iamapi_authz_test.go
index 5684a163b7..c4d4db0a34 100644
--- a/weed/iamapi/iamapi_authz_test.go
+++ b/weed/iamapi/iamapi_authz_test.go
@@ -2,10 +2,16 @@ package iamapi
 
 import (
 	"context"
+	"crypto/hmac"
+	"crypto/sha1"
 	"crypto/sha256"
+	"encoding/base64"
 	"fmt"
+	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -141,3 +147,69 @@ func TestIamManagementAllowedForAdmin(t *testing.T) {
 		"", "Action=CreateUser&UserName=new-user&Version=2010-05-08")
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 }
+
+// The implicit UserName must come from the identity authentication verified,
+// never from re-parsing the Authorization header: a request can carry presigned
+// credentials for one user alongside a junk SigV4 header naming another.
+func TestImplicitUserNameUsesVerifiedIdentity(t *testing.T) {
+	server := newAuthzTestServer(t)
+	expires := strconv.FormatInt(time.Now().Add(10*time.Minute).Unix(), 10)
+	sts := "POST\n\napplication/x-www-form-urlencoded\n" + expires + "\n/"
+	mac := hmac.New(sha1.New, []byte("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"))
+	mac.Write([]byte(sts))
+	sig := base64.StdEncoding.EncodeToString(mac.Sum(nil))
+	q := url.Values{"AWSAccessKeyId": {"AKIAIOSFODNN7EXAMPLE"}, "Expires": {expires}, "Signature": {sig}}
+
+	post := func(t *testing.T, body string) (int, string) {
+		t.Helper()
+		req, err := http.NewRequest(http.MethodPost, server.URL+"/?"+q.Encode(), strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential=AKIATESTFAKEADMIN0001/20261021/us-east-1/iam/aws4_request, SignedHeaders=host, Signature=00")
+		resp, err := http.DefaultClient.Do(req)
+		require.NoError(t, err)
+		defer resp.Body.Close()
+		b, err := io.ReadAll(resp.Body)
+		require.NoError(t, err)
+		t.Logf("%d %s", resp.StatusCode, b)
+		return resp.StatusCode, string(b)
+	}
+
+	for _, action := range []string{"ListAccessKeys", "CreateAccessKey", "GetUser"} {
+		t.Run(action, func(t *testing.T) {
+			code, body := post(t, "Action="+action+"&Version=2010-05-08")
+			assert.Equal(t, http.StatusOK, code)
+			assert.NotContains(t, body, "iam_admin")
+			assert.Contains(t, body, "power_user")
+		})
+	}
+
+	// ListUserPolicies is not self-service: a caller without IAM rights is
+	// denied whichever name the implicit resolution lands on.
+	t.Run("ListUserPolicies", func(t *testing.T) {
+		code, body := post(t, "Action=ListUserPolicies&Version=2010-05-08")
+		assert.Equal(t, http.StatusForbidden, code)
+		assert.NotContains(t, body, "iam_admin")
+	})
+
+	// A write aimed at the header-named admin's key resolves to the verified
+	// caller instead: the key is not power_user's, so it is not found.
+	t.Run("UpdateAccessKey", func(t *testing.T) {
+		code, body := post(t, "Action=UpdateAccessKey&AccessKeyId=AKIATESTFAKEADMIN0001&Status=Inactive&Version=2010-05-08")
+		assert.Equal(t, http.StatusNotFound, code)
+		assert.Contains(t, body, "NoSuchEntity")
+	})
+
+	t.Run("DeleteAccessKey", func(t *testing.T) {
+		code, _ := post(t, "Action=DeleteAccessKey&AccessKeyId=AKIATESTFAKEADMIN0001&Version=2010-05-08")
+		assert.Equal(t, http.StatusOK, code)
+	})
+
+	// The admin key the junk header named is untouched: still present and active.
+	resp := postSignedIamAction(t, server.URL, "AKIATESTFAKEADMIN0001", "testAdminSecretFake0000000000000000000000",
+		"", "Action=ListAccessKeys&Version=2010-05-08")
+	body, err := io.ReadAll(resp.Body)
+	require.NoError(t, err)
+	assert.Contains(t, string(body), "AKIATESTFAKEADMIN0001")
+	assert.Contains(t, string(body), "<Status>Active</Status>")
+}
diff --git a/weed/iamapi/iamapi_handlers.go b/weed/iamapi/iamapi_handlers.go
index 695ce293d7..54c15ef2aa 100644
--- a/weed/iamapi/iamapi_handlers.go
+++ b/weed/iamapi/iamapi_handlers.go
@@ -31,6 +31,7 @@ func writeIamErrorResponse(w http.ResponseWriter, r *http.Request, reqID string,
 
 	errorResp := newErrorResponse(errCode, errMsg, reqID)
 	internalErrorResponse := newErrorResponse(iam.ErrCodeServiceFailureException, "Internal server error", reqID)
+	internalErrorResponse.Error.Type = "Receiver"
 
 	switch errCode {
 	case iam.ErrCodeNoSuchEntityException:
diff --git a/weed/iamapi/iamapi_management_handlers.go b/weed/iamapi/iamapi_management_handlers.go
index f81a8d76c3..85381e2696 100644
--- a/weed/iamapi/iamapi_management_handlers.go
+++ b/weed/iamapi/iamapi_management_handlers.go
@@ -4,6 +4,7 @@ package iamapi
 // Common IAM types and helpers are imported from the shared weed/iam package.
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -14,12 +15,14 @@ import (
 	"sync"
 
 	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/seaweedfs/seaweedfs/weed/util/request_id"
 )
@@ -228,6 +231,19 @@ func (iama *IamApiServer) DeleteUser(s3cfg *iam_pb.S3ApiConfiguration, userName
 	resp = &DeleteUserResponse{}
 	for i, ident := range s3cfg.Identities {
 		if userName == ident.Name {
+			// AWS IAM behavior: prevent deletion if user has dependent resources.
+			if len(ident.ServiceAccountIds) > 0 {
+				return resp, &IamError{
+					Code:  iam.ErrCodeDeleteConflictException,
+					Error: fmt.Errorf("cannot delete user %s: user has %d service account(s). Delete service accounts first", userName, len(ident.ServiceAccountIds)),
+				}
+			}
+			if len(ident.Credentials) > 0 {
+				return resp, &IamError{
+					Code:  iam.ErrCodeDeleteConflictException,
+					Error: fmt.Errorf("cannot delete user %s: user has %d access key(s). Delete access keys first", userName, len(ident.Credentials)),
+				}
+			}
 			// Clean up any inline policies stored for this user
 			policies := Policies{}
 			if pErr := iama.s3ApiConfig.GetPolicies(&policies); pErr != nil && !errors.Is(pErr, filer_pb.ErrNotFound) {
@@ -1250,53 +1266,128 @@ func (iama *IamApiServer) DeleteAccessKey(s3cfg *iam_pb.S3ApiConfiguration, valu
 	return resp
 }
 
-// handleImplicitUsername adds username who signs the request to values if 'username' is not specified.
-// According to AWS documentation: "If you do not specify a user name, IAM determines the user name
-// implicitly based on the Amazon Web Services access key ID signing the request."
-// This function extracts the AccessKeyId from the SigV4 credential and looks up the corresponding
-// identity name in the credential store.
+// handleImplicitUsername adds the name of the authenticated caller to values
+// when 'UserName' is not specified, per AWS: "If you do not specify a user name,
+// IAM determines the user name implicitly based on the Amazon Web Services
+// access key ID signing the request." The name comes from the identity the
+// authentication middleware verified, which the request context carries; the
+// Authorization header itself is attacker-controlled and is never re-parsed.
 func (iama *IamApiServer) handleImplicitUsername(r *http.Request, values url.Values) {
-	if len(r.Header["Authorization"]) == 0 || values.Get("UserName") != "" {
+	if values.Get("UserName") != "" {
 		return
 	}
-	// Log presence of auth header without exposing sensitive signature material
-	glog.V(4).Infof("Authorization header present, extracting access key")
-	// Parse AWS SigV4 Authorization header format:
-	// "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/iam/aws4_request, ..."
-	s := strings.Split(r.Header["Authorization"][0], "Credential=")
-	if len(s) < 2 {
-		return
+	if name := s3_constants.GetIdentityNameFromContext(r); name != "" {
+		values.Set("UserName", name)
 	}
-	s = strings.Split(s[1], ",")
-	if len(s) < 1 {
-		return
-	}
-	s = strings.Split(s[0], "/")
-	if len(s) < 1 {
-		return
-	}
-	// s[0] is the AccessKeyId
-	accessKeyId := s[0]
-	if accessKeyId == "" {
-		return
-	}
-	// Nil-guard: ensure iam is initialized before lookup
+}
+
+// targetedCredentialManager returns the credential manager through which a change to the named
+// identity is written on its own instead of via SaveConfiguration, or nil when this server has
+// none, or the identity is static: static identities live outside the store and keep the
+// full-save path.
+func (iama *IamApiServer) targetedCredentialManager(userName string) *credential.CredentialManager {
 	if iama.iam == nil {
-		glog.V(4).Infof("IAM not initialized, cannot look up access key")
-		return
+		return nil
 	}
-	// Look up the identity by access key to get the username
-	identity, _, found := iama.iam.LookupByAccessKey(accessKeyId)
-	if !found {
-		// Mask access key in logs - show only first 4 chars
-		maskedKey := accessKeyId
-		if len(accessKeyId) > 4 {
-			maskedKey = accessKeyId[:4] + "***"
+	cm := iama.iam.GetCredentialManager()
+	if cm == nil || cm.IsStaticIdentity(userName) {
+		return nil
+	}
+	return cm
+}
+
+// findIdentityByName returns the identity named userName in s3cfg, or nil.
+func findIdentityByName(s3cfg *iam_pb.S3ApiConfiguration, userName string) *iam_pb.Identity {
+	for _, ident := range s3cfg.Identities {
+		if ident.Name == userName {
+			return ident
 		}
-		glog.V(4).Infof("Access key %s not found in credential store", maskedKey)
-		return
 	}
-	values.Set("UserName", identity.Name)
+	return nil
+}
+
+// groupsWithMember returns the groups in s3cfg that list userName as a member. Taken before a
+// handler renames or removes the user, it names the group records that handler will change.
+func groupsWithMember(s3cfg *iam_pb.S3ApiConfiguration, userName string) []*iam_pb.Group {
+	var groups []*iam_pb.Group
+	for _, g := range s3cfg.Groups {
+		for _, m := range g.Members {
+			if m == userName {
+				groups = append(groups, g)
+				break
+			}
+		}
+	}
+	return groups
+}
+
+// serviceAccountsOf returns the service accounts in s3cfg whose parent is userName.
+func serviceAccountsOf(s3cfg *iam_pb.S3ApiConfiguration, userName string) []*iam_pb.ServiceAccount {
+	var accounts []*iam_pb.ServiceAccount
+	for _, sa := range s3cfg.ServiceAccounts {
+		if sa.ParentUser == userName {
+			accounts = append(accounts, sa)
+		}
+	}
+	return accounts
+}
+
+// persistIdentity writes the one identity a handler changed in s3cfg through the credential
+// manager. The store writes that identity's record and propagates it alone; the other
+// identities are not rewritten.
+func persistIdentity(ctx context.Context, cm *credential.CredentialManager, s3cfg *iam_pb.S3ApiConfiguration, userName string) error {
+	ident := findIdentityByName(s3cfg, userName)
+	if ident == nil {
+		return credential.ErrUserNotFound
+	}
+	return cm.UpdateUser(ctx, userName, ident)
+}
+
+// persistRenamedIdentity writes a user renamed from oldName to newName by UpdateUser through the
+// credential manager: the identity, the groups that listed the old name and the service accounts
+// it parented. UpdateUser under the old name moves the record in stores that treat a changed Name
+// as a rename (filer_etc, memory), and the propagating store propagates the new identity and the
+// old name's removal; UpdateUser already moved the inline policies through PutPolicies. A store
+// that did not move the record still holds the user under the old name; the caller is told so
+// (false) and keeps the full save, which is what renames such a store today.
+func persistRenamedIdentity(ctx context.Context, cm *credential.CredentialManager, s3cfg *iam_pb.S3ApiConfiguration, oldName, newName string, groups []*iam_pb.Group, accounts []*iam_pb.ServiceAccount) (bool, error) {
+	ident := findIdentityByName(s3cfg, newName)
+	if ident == nil {
+		return false, credential.ErrUserNotFound
+	}
+	if err := cm.UpdateUser(ctx, oldName, ident); err != nil {
+		return false, err
+	}
+	if _, err := cm.GetUser(ctx, newName); err != nil {
+		return false, nil
+	}
+	for _, g := range groups {
+		if err := cm.UpdateGroup(ctx, g); err != nil {
+			return false, fmt.Errorf("update group %s: %w", g.Name, err)
+		}
+	}
+	for _, sa := range accounts {
+		if err := cm.UpdateServiceAccount(ctx, sa.Id, sa); err != nil {
+			return false, fmt.Errorf("update service account %s: %w", sa.Id, err)
+		}
+	}
+	return true, nil
+}
+
+// deleteIdentity removes a user deleted by DeleteUser through the credential manager: its record
+// (the store propagates the one removal) and the groups that listed it, whose membership
+// DeleteUser already changed in s3cfg. DeleteUser already removed the inline policies through
+// PutPolicies.
+func deleteIdentity(ctx context.Context, cm *credential.CredentialManager, userName string, groups []*iam_pb.Group) error {
+	if err := cm.DeleteUser(ctx, userName); err != nil {
+		return err
+	}
+	for _, g := range groups {
+		if err := cm.UpdateGroup(ctx, g); err != nil {
+			return fmt.Errorf("update group %s: %w", g.Name, err)
+		}
+	}
+	return nil
 }
 
 func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
@@ -1320,6 +1411,9 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 	glog.V(4).Infof("DoActions: %+v", iamlib.RedactSensitiveFormValues(values))
 	var response iamlib.RequestIDSetter
 	changed := true
+	// persisted is set by the actions that wrote one identity through the credential manager
+	// instead of SaveConfiguration; the in-memory identity maps are reloaded after them too.
+	persisted := false
 	switch r.Form.Get("Action") {
 	case "ListUsers":
 		response = iama.ListUsers(s3cfg, values)
@@ -1343,6 +1437,7 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	case "GetUser":
+		iama.handleImplicitUsername(r, values)
 		userName := values.Get("UserName")
 		var err *IamError
 		response, err = iama.GetUser(s3cfg, userName)
@@ -1352,40 +1447,107 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 		}
 		changed = false
 	case "UpdateUser":
+		userName, newUserName := values.Get("UserName"), values.Get("NewUserName")
+		// Taken before the rename: the records the handler changes besides the identity.
+		groups := groupsWithMember(s3cfg, userName)
+		accounts := serviceAccountsOf(s3cfg, userName)
 		var err *IamError
 		response, err = iama.UpdateUser(s3cfg, values)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		// Write the renamed identity, its groups and service accounts through the credential
+		// manager instead of rewriting every identity via SaveConfiguration. A request that
+		// renames nothing changed nothing, so there is nothing to write either way.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			renamed := true
+			if newUserName != "" && newUserName != userName {
+				var err error
+				renamed, err = persistRenamedIdentity(r.Context(), cm, s3cfg, userName, newUserName, groups, accounts)
+				if err != nil {
+					writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+					return
+				}
+			}
+			changed, persisted = !renamed, renamed
+		}
 	case "DeleteUser":
 		userName := values.Get("UserName")
+		groups := groupsWithMember(s3cfg, userName)
 		var err *IamError
 		response, err = iama.DeleteUser(s3cfg, userName)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		// Targeted delete: one record removed and one removal propagated, plus the groups whose
+		// membership changed, instead of rewriting every remaining identity.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := deleteIdentity(r.Context(), cm, userName, groups); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "CreateAccessKey":
 		iama.handleImplicitUsername(r, values)
-		var err *IamError
-		response, err = iama.CreateAccessKey(s3cfg, values)
+		userName := values.Get("UserName")
+		resp, err := iama.CreateAccessKey(s3cfg, values)
 		if err != nil {
 			glog.Errorf("CreateAccessKey: %+v", err.Error)
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		response = resp
+		// Targeted write: credentialManager.CreateAccessKey adds the key to the one identity and
+		// propagates that identity alone. The handler creates the identity for a user it does
+		// not know; that case still needs the full save.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if _, known := cm.GetUser(r.Context(), userName); known == nil {
+				cred := &iam_pb.Credential{
+					AccessKey: *resp.CreateAccessKeyResult.AccessKey.AccessKeyId,
+					SecretKey: *resp.CreateAccessKeyResult.AccessKey.SecretAccessKey,
+					Status:    accessKeyStatusActive,
+				}
+				if err := cm.CreateAccessKey(r.Context(), userName, cred); err != nil {
+					writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+					return
+				}
+				changed, persisted = false, true
+			}
+		}
 	case "DeleteAccessKey":
 		iama.handleImplicitUsername(r, values)
+		userName, accessKeyId := values.Get("UserName"), values.Get("AccessKeyId")
 		response = iama.DeleteAccessKey(s3cfg, values)
+		// Targeted write: credentialManager.DeleteAccessKey removes the key from the one identity
+		// and propagates that identity alone. The handler answers 200 for a key or user it does
+		// not know, so a not-found from the store is the same no-op it always was.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			err := cm.DeleteAccessKey(r.Context(), userName, accessKeyId)
+			if err != nil && !errors.Is(err, credential.ErrAccessKeyNotFound) && !errors.Is(err, credential.ErrUserNotFound) {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "UpdateAccessKey":
 		iama.handleImplicitUsername(r, values)
+		userName := values.Get("UserName")
 		var err *IamError
 		response, err = iama.UpdateAccessKey(s3cfg, values)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := persistIdentity(r.Context(), cm, s3cfg, userName); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "CreatePolicy":
 		var err *IamError
 		response, err = iama.CreatePolicy(s3cfg, values)
@@ -1397,6 +1559,7 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 		// The `changed` flag is false because this does not modify the main s3cfg.Identities configuration.
 		changed = false
 	case "PutUserPolicy":
+		userName := values.Get("UserName")
 		var err *IamError
 		response, err = iama.PutUserPolicy(s3cfg, values)
 		if err != nil {
@@ -1404,6 +1567,15 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		// The policy document is already stored through PutPolicies; what remains is the
+		// identity's recomputed Actions, written and propagated for that identity alone.
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := persistIdentity(r.Context(), cm, s3cfg, userName); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "GetUserPolicy":
 		var err *IamError
 		response, err = iama.GetUserPolicy(s3cfg, values)
@@ -1413,12 +1585,20 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 		}
 		changed = false
 	case "DeleteUserPolicy":
+		userName := values.Get("UserName")
 		var err *IamError
 		response, err = iama.DeleteUserPolicy(s3cfg, values)
 		if err != nil {
 			writeIamErrorResponse(w, r, reqID, err)
 			return
 		}
+		if cm := iama.targetedCredentialManager(userName); cm != nil {
+			if err := persistIdentity(r.Context(), cm, s3cfg, userName); err != nil {
+				writeIamErrorResponse(w, r, reqID, &IamError{Code: s3api.CredentialErrToIamErrCode(err), Error: err})
+				return
+			}
+			changed, persisted = false, true
+		}
 	case "ListUserPolicies":
 		iama.handleImplicitUsername(r, values)
 		var err *IamError
@@ -1618,9 +1798,8 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 		}
 		changed = false
 	default:
-		errNotImplemented := s3err.GetAPIError(s3err.ErrNotImplemented)
-		errorResponse := newErrorResponse(errNotImplemented.Code, errNotImplemented.Description, reqID)
-		s3err.WriteXMLResponse(w, r, errNotImplemented.HTTPStatusCode, errorResponse)
+		errorResponse := newErrorResponse("InvalidAction", fmt.Sprintf("The action %s is not valid for this endpoint", values.Get("Action")), reqID)
+		s3err.WriteXMLResponse(w, r, http.StatusNotFound, errorResponse)
 		return
 	}
 	if changed {
@@ -1630,6 +1809,8 @@ func (iama *IamApiServer) DoActions(w http.ResponseWriter, r *http.Request) {
 			writeIamErrorResponse(w, r, reqID, &iamError)
 			return
 		}
+	}
+	if changed || persisted {
 		// Reload in-memory identity maps so subsequent LookupByAccessKey calls
 		// can see newly created or deleted keys immediately
 		if iama.iam != nil {
diff --git a/weed/iamapi/iamapi_server.go b/weed/iamapi/iamapi_server.go
index 26b2d9c606..63f85623f2 100644
--- a/weed/iamapi/iamapi_server.go
+++ b/weed/iamapi/iamapi_server.go
@@ -42,10 +42,11 @@ type IamS3ApiConfigure struct {
 }
 
 type IamServerOption struct {
-	Masters        map[string]pb.ServerAddress
-	Filers         []pb.ServerAddress
-	Port           int
-	GrpcDialOption grpc.DialOption
+	Masters                     map[string]pb.ServerAddress
+	Filers                      []pb.ServerAddress
+	Port                        int
+	GrpcDialOption              grpc.DialOption
+	IamSelfServiceRequiresGrant bool
 }
 
 type IamApiServer struct {
@@ -87,8 +88,9 @@ func NewIamApiServerWithStore(router *mux.Router, option *IamServerOption, expli
 	s3ApiConfigure = configure
 
 	s3Option := s3api.S3ApiServerOption{
-		Filers:         option.Filers,
-		GrpcDialOption: option.GrpcDialOption,
+		Filers:                      option.Filers,
+		GrpcDialOption:              option.GrpcDialOption,
+		IamSelfServiceRequiresGrant: option.IamSelfServiceRequiresGrant,
 	}
 
 	// Initialize FilerClient for IAM - explicit filers only (no discovery as FilerGroup unspecified)
diff --git a/weed/iamapi/iamapi_targeted_writes_test.go b/weed/iamapi/iamapi_targeted_writes_test.go
new file mode 100644
index 0000000000..a22b56033b
--- /dev/null
+++ b/weed/iamapi/iamapi_targeted_writes_test.go
@@ -0,0 +1,302 @@
+package iamapi
+
+// Targeted-write regression tests: single-identity IAM actions must write only
+// the identity they changed through the credential manager, not every identity
+// via PutS3ApiConfiguration/SaveConfiguration.
+// See https://github.com/seaweedfs/seaweedfs/issues/11865.
+
+import (
+	"context"
+	"net/http"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// targetedRecordingStore wraps a memory store and counts the write methods
+// the dispatcher used, so a test can assert the single-identity path was
+// taken. It embeds the concrete store (rather than the CredentialStore
+// interface) so optional interfaces like InlinePolicyStore stay visible
+// through the wrapper.
+type targetedRecordingStore struct {
+	*memory.MemoryStore
+	saves            int
+	createAccessKeys int
+	deleteAccessKeys int
+	updateUsers      int
+	deleteUsers      int
+	updateGroups     int
+}
+
+func (r *targetedRecordingStore) SaveConfiguration(ctx context.Context, config *iam_pb.S3ApiConfiguration) error {
+	r.saves++
+	return r.MemoryStore.SaveConfiguration(ctx, config)
+}
+
+func (r *targetedRecordingStore) CreateAccessKey(ctx context.Context, username string, cred *iam_pb.Credential) error {
+	r.createAccessKeys++
+	return r.MemoryStore.CreateAccessKey(ctx, username, cred)
+}
+
+func (r *targetedRecordingStore) DeleteAccessKey(ctx context.Context, username string, accessKey string) error {
+	r.deleteAccessKeys++
+	return r.MemoryStore.DeleteAccessKey(ctx, username, accessKey)
+}
+
+func (r *targetedRecordingStore) UpdateUser(ctx context.Context, username string, identity *iam_pb.Identity) error {
+	r.updateUsers++
+	return r.MemoryStore.UpdateUser(ctx, username, identity)
+}
+
+func (r *targetedRecordingStore) DeleteUser(ctx context.Context, username string) error {
+	r.deleteUsers++
+	return r.MemoryStore.DeleteUser(ctx, username)
+}
+
+func (r *targetedRecordingStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
+	r.updateGroups++
+	return r.MemoryStore.UpdateGroup(ctx, group)
+}
+
+func targetedIamApiServer() (*IamApiServer, *credential.CredentialManager, *countingConfigSaver, *targetedRecordingStore) {
+	srv, cm, counter := iamApiServerWithCredentialManager()
+	rec := &targetedRecordingStore{MemoryStore: cm.Store.(*memory.MemoryStore)}
+	cm.Store = rec
+	return srv, cm, counter, rec
+}
+
+const targetedTestPolicy = `{
+	"Version": "2012-10-17",
+	"Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::bench/*"]}]
+}`
+
+func TestIamApiCreateAccessKeyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+
+	req, _ := iam.New(session.New()).CreateAccessKeyRequest(&iam.CreateAccessKeyInput{UserName: aws.String("alice")})
+	_ = req.Build()
+	out := CreateAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "CreateAccessKey must not PutS3ApiConfiguration")
+	assert.Equal(t, 0, rec.saves)
+	assert.Equal(t, 1, rec.createAccessKeys)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	require.Len(t, ident.Credentials, 1)
+	assert.Equal(t, *out.CreateAccessKeyResult.AccessKey.AccessKeyId, ident.Credentials[0].AccessKey)
+}
+
+// CreateAccessKey for a user the store does not know still needs the full save:
+// the handler creates the identity in the config, so there is no existing
+// record to write a key into.
+func TestIamApiCreateAccessKeyUnknownUserFallsBack(t *testing.T) {
+	srv, cm, counter, _ := targetedIamApiServer()
+	ctx := context.Background()
+
+	req, _ := iam.New(session.New()).CreateAccessKeyRequest(&iam.CreateAccessKeyInput{UserName: aws.String("ghost")})
+	_ = req.Build()
+	out := CreateAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 1, counter.putCalled)
+	ident, err := cm.GetUser(ctx, "ghost")
+	require.NoError(t, err)
+	assert.Len(t, ident.Credentials, 1)
+}
+
+func TestIamApiDeleteAccessKeyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{
+		Name:        "alice",
+		Credentials: []*iam_pb.Credential{{AccessKey: "AKIATESTFAKEKEY00001", SecretKey: "testsecretfake"}},
+	}))
+
+	req, _ := iam.New(session.New()).DeleteAccessKeyRequest(&iam.DeleteAccessKeyInput{
+		UserName:    aws.String("alice"),
+		AccessKeyId: aws.String("AKIATESTFAKEKEY00001"),
+	})
+	_ = req.Build()
+	out := DeleteAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "DeleteAccessKey must not PutS3ApiConfiguration")
+	assert.Equal(t, 1, rec.deleteAccessKeys)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.Empty(t, ident.Credentials)
+
+	// Deleting a key that does not exist still answers 200 and stays targeted.
+	req, _ = iam.New(session.New()).DeleteAccessKeyRequest(&iam.DeleteAccessKeyInput{
+		UserName:    aws.String("alice"),
+		AccessKeyId: aws.String("AKIATESTFAKEKEY99999"),
+	})
+	_ = req.Build()
+	resp, err = executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+	assert.Equal(t, 0, counter.putCalled)
+}
+
+func TestIamApiUpdateAccessKeyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{
+		Name:        "alice",
+		Credentials: []*iam_pb.Credential{{AccessKey: "AKIATESTFAKEKEY00001", SecretKey: "testsecretfake", Status: "Active"}},
+	}))
+
+	req, _ := iam.New(session.New()).UpdateAccessKeyRequest(&iam.UpdateAccessKeyInput{
+		UserName:    aws.String("alice"),
+		AccessKeyId: aws.String("AKIATESTFAKEKEY00001"),
+		Status:      aws.String(iam.StatusTypeInactive),
+	})
+	_ = req.Build()
+	out := UpdateAccessKeyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "UpdateAccessKey must not PutS3ApiConfiguration")
+	assert.Equal(t, 1, rec.updateUsers)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	require.Len(t, ident.Credentials, 1)
+	assert.Equal(t, iam.StatusTypeInactive, ident.Credentials[0].Status)
+}
+
+func TestIamApiPutUserPolicyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+
+	req, _ := iam.New(session.New()).PutUserPolicyRequest(&iam.PutUserPolicyInput{
+		UserName:       aws.String("alice"),
+		PolicyName:     aws.String("read-bench"),
+		PolicyDocument: aws.String(targetedTestPolicy),
+	})
+	_ = req.Build()
+	out := PutUserPolicyResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "PutUserPolicy must not PutS3ApiConfiguration")
+	assert.Equal(t, 0, rec.saves)
+	assert.Equal(t, 1, rec.updateUsers)
+
+	ident, err := cm.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.NotEmpty(t, ident.Actions, "recomputed Actions must be persisted for the one identity")
+}
+
+func TestIamApiDeleteUserPolicyTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+
+	putReq, _ := iam.New(session.New()).PutUserPolicyRequest(&iam.PutUserPolicyInput{
+		UserName:       aws.String("alice"),
+		PolicyName:     aws.String("read-bench"),
+		PolicyDocument: aws.String(targetedTestPolicy),
+	})
+	_ = putReq.Build()
+	putOut := PutUserPolicyResponse{}
+	resp, err := executeRequestWith(srv, putReq.HTTPRequest, &putOut)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	delReq, _ := iam.New(session.New()).DeleteUserPolicyRequest(&iam.DeleteUserPolicyInput{
+		UserName:   aws.String("alice"),
+		PolicyName: aws.String("read-bench"),
+	})
+	_ = delReq.Build()
+	delOut := DeleteUserPolicyResponse{}
+	resp, err = executeRequestWith(srv, delReq.HTTPRequest, &delOut)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "DeleteUserPolicy must not PutS3ApiConfiguration")
+	assert.Equal(t, 2, rec.updateUsers)
+
+	policies := Policies{}
+	require.NoError(t, srv.s3ApiConfig.GetPolicies(&policies))
+	assert.Empty(t, policies.InlinePolicies["alice"])
+}
+
+func TestIamApiUpdateUserRenameTargeted(t *testing.T) {
+	srv, cm, counter, _ := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+	require.NoError(t, cm.CreateGroup(ctx, &iam_pb.Group{Name: "devs", Members: []string{"alice", "bob"}}))
+
+	req, _ := iam.New(session.New()).UpdateUserRequest(&iam.UpdateUserInput{
+		UserName:    aws.String("alice"),
+		NewUserName: aws.String("alice-renamed"),
+	})
+	_ = req.Build()
+	out := UpdateUserResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "UpdateUser rename must not PutS3ApiConfiguration")
+
+	_, err = cm.GetUser(ctx, "alice")
+	require.ErrorIs(t, err, credential.ErrUserNotFound)
+	_, err = cm.GetUser(ctx, "alice-renamed")
+	require.NoError(t, err)
+
+	g, err := cm.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"alice-renamed", "bob"}, g.Members)
+}
+
+func TestIamApiDeleteUserTargeted(t *testing.T) {
+	srv, cm, counter, rec := targetedIamApiServer()
+	ctx := context.Background()
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "alice"}))
+	require.NoError(t, cm.CreateUser(ctx, &iam_pb.Identity{Name: "bob"}))
+	require.NoError(t, cm.CreateGroup(ctx, &iam_pb.Group{Name: "devs", Members: []string{"alice", "bob"}}))
+
+	req, _ := iam.New(session.New()).DeleteUserRequest(&iam.DeleteUserInput{UserName: aws.String("alice")})
+	_ = req.Build()
+	out := DeleteUserResponse{}
+	resp, err := executeRequestWith(srv, req.HTTPRequest, &out)
+	require.NoError(t, err)
+	require.Equal(t, http.StatusOK, resp.Code)
+
+	assert.Equal(t, 0, counter.putCalled, "DeleteUser must not PutS3ApiConfiguration")
+	assert.Equal(t, 1, rec.deleteUsers)
+	assert.Equal(t, 1, rec.updateGroups)
+
+	_, err = cm.GetUser(ctx, "alice")
+	require.ErrorIs(t, err, credential.ErrUserNotFound)
+	g, err := cm.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"bob"}, g.Members)
+	_, err = cm.GetUser(ctx, "bob")
+	require.NoError(t, err, "other identities must be untouched")
+}
diff --git a/weed/iamapi/iamapi_test.go b/weed/iamapi/iamapi_test.go
index 6268e448be..6000aff6a3 100644
--- a/weed/iamapi/iamapi_test.go
+++ b/weed/iamapi/iamapi_test.go
@@ -17,9 +17,11 @@ import (
 	"github.com/jinzhu/copier"
 	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/util/request_id"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -488,6 +490,29 @@ func TestDeleteUser(t *testing.T) {
 	out := DeleteUserResponse{}
 	response, err := executeRequest(req.HTTPRequest, out)
 	assert.Equal(t, nil, err)
+	assert.Equal(t, http.StatusConflict, response.Code)
+
+	listReq, _ := iam.New(session.New()).ListAccessKeysRequest(&iam.ListAccessKeysInput{UserName: userName})
+	_ = listReq.Build()
+	listOut := ListAccessKeysResponse{}
+	listResp, err := executeRequest(listReq.HTTPRequest, listOut)
+	assert.Equal(t, nil, err)
+	var listResult ListAccessKeysResponse
+	assert.Equal(t, nil, xml.Unmarshal(listResp.Body.Bytes(), &listResult))
+	for _, key := range listResult.ListAccessKeysResult.AccessKeyMetadata {
+		delKeyReq, _ := iam.New(session.New()).DeleteAccessKeyRequest(&iam.DeleteAccessKeyInput{
+			UserName:    userName,
+			AccessKeyId: key.AccessKeyId,
+		})
+		_ = delKeyReq.Build()
+		_, err := executeRequest(delKeyReq.HTTPRequest, out)
+		assert.Equal(t, nil, err)
+	}
+
+	req, _ = iam.New(session.New()).DeleteUserRequest(params)
+	_ = req.Build()
+	response, err = executeRequest(req.HTTPRequest, out)
+	assert.Equal(t, nil, err)
 	assert.Equal(t, http.StatusOK, response.Code)
 }
 
@@ -500,32 +525,13 @@ func executeRequest(req *http.Request, v interface{}) (*httptest.ResponseRecorde
 }
 
 func TestHandleImplicitUsername(t *testing.T) {
-	// Create a mock IamApiServer with credential store
-	// The handleImplicitUsername function now looks up the username from the
-	// credential store based on AccessKeyId, not from the region field in the auth header.
-	// Note: Using obviously fake access keys to avoid CI secret scanner false positives
+	// The implicit name is the authenticated identity recorded in the request
+	// context by the auth middleware; request headers are never re-parsed.
+	iama := &IamApiServer{}
 
-	// Create IAM directly as struct literal (same pattern as other tests)
-	iam := &s3api.IdentityAccessManagement{}
-
-	// Load test credentials - map access key to identity name
-	testConfig := &iam_pb.S3ApiConfiguration{
-		Identities: []*iam_pb.Identity{
-			{
-				Name: "testuser1",
-				Credentials: []*iam_pb.Credential{
-					{AccessKey: "AKIATESTFAKEKEY000001", SecretKey: "testsecretfake"},
-				},
-			},
-		},
-	}
-	err := iam.LoadS3ApiConfigurationFromBytes(mustMarshalJSON(t, testConfig))
-	if err != nil {
-		t.Fatalf("Failed to load test config: %v", err)
-	}
-
-	iama := &IamApiServer{
-		iam: iam,
+	withIdentity := func(name string) *http.Request {
+		r := &http.Request{Header: http.Header{}}
+		return r.WithContext(s3_constants.SetIdentityNameInContext(r.Context(), name))
 	}
 
 	var tests = []struct {
@@ -533,14 +539,14 @@ func TestHandleImplicitUsername(t *testing.T) {
 		values   url.Values
 		userName string
 	}{
-		// No authorization header - should not set username
+		// No authenticated identity - should not set username
 		{&http.Request{}, url.Values{}, ""},
-		// Valid auth header with known access key - should look up and find "testuser1"
-		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIATESTFAKEKEY000001/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, "testuser1"},
-		// Malformed auth header (no Credential=) - should not set username
-		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 =AKIATESTFAKEKEY000001/20220420/test1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
-		// Unknown access key - should not set username
-		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIATESTUNKNOWN000000/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
+		// Authenticated identity in context - sets its name
+		{withIdentity("testuser1"), url.Values{}, "testuser1"},
+		// A client-controlled Authorization header naming another user is ignored
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=AKIATESTFAKEKEY000001/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
+		// An explicit UserName is left alone
+		{withIdentity("testuser1"), url.Values{"UserName": {"other"}}, "other"},
 	}
 
 	for i, test := range tests {
@@ -584,6 +590,7 @@ func iamApiServerWithCredentialManager() (*IamApiServer, *credential.CredentialM
 type countingConfigSaver struct {
 	cm        *credential.CredentialManager
 	putCalled int
+	policies  Policies
 }
 
 func (c *countingConfigSaver) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfiguration) error {
@@ -593,6 +600,8 @@ func (c *countingConfigSaver) GetS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfigura
 	}
 	s3cfg.Identities = config.Identities
 	s3cfg.Policies = config.Policies
+	s3cfg.Groups = config.Groups
+	s3cfg.ServiceAccounts = config.ServiceAccounts
 	return nil
 }
 
@@ -602,10 +611,15 @@ func (c *countingConfigSaver) PutS3ApiConfiguration(s3cfg *iam_pb.S3ApiConfigura
 }
 
 func (c *countingConfigSaver) GetPolicies(policies *Policies) error {
+	*policies = c.policies
+	if c.policies.Policies == nil && c.policies.InlinePolicies == nil {
+		return filer_pb.ErrNotFound
+	}
 	return nil
 }
 
 func (c *countingConfigSaver) PutPolicies(policies *Policies) error {
+	c.policies = *policies
 	return nil
 }
 
diff --git a/weed/images/gateway/README.md b/weed/images/gateway/README.md
new file mode 100644
index 0000000000..1a6f417635
--- /dev/null
+++ b/weed/images/gateway/README.md
@@ -0,0 +1,159 @@
+# On-demand image gateway
+
+`weed image` is an optional public image endpoint. Original images remain in
+SeaweedFS. On a cache miss, a separate imgproxy service resizes and encodes the
+image; results enter a bounded in-process cache. Subsequent requests recheck
+anonymous source access before reusing results. Cache eviction and process
+restarts do not affect stored objects. No S3 objects, Filer entries, or application
+file records are created for processed images.
+
+```mermaid
+flowchart LR
+  Browser --> CDN
+  CDN --> Gateway[weed image]
+  Gateway -->|Check source access and revision on every request| S3[SeaweedFS S3]
+  Gateway -->|Cache miss| imgproxy
+  imgproxy -->|Anonymous source read| S3
+  Gateway --> Cache[Bounded memory cache]
+```
+
+## Request interface
+
+```text
+/image.png?x-oss-process=image/resize,w_640/quality,Q_85/format,webp
+/image.png?x-oss-process=image/resize,w_240,h_240,m_lfit,limit_1/format,webp
+/image.png?x-oss-process=image/format,jpg/quality,Q_85
+```
+
+- `resize` accepts `w`, `h`, `m_lfit`, and `limit_1`. It preserves aspect ratio
+  and never enlarges the source. One dimension determines the other; two
+  dimensions specify a bounding box. Any unspecified axis uses `maxDimension`
+  as its bound, including format-only requests; neither output axis can exceed it.
+- `quality,Q_1` through `quality,Q_100` specify absolute quality, defaulting to 85.
+  Aliyun's relative quality `q` has no equivalent here and returns 400.
+- `format` accepts `jpg`, `jpeg`, `png`, and `webp`, defaulting to WebP.
+- The default maximum output dimension is 4096. Repeated parameters, unknown
+  operations, cropping, watermarks, animation processing, automatic format
+  negotiation, and other OSS operations are unsupported. PNG output is lossless;
+  quality mainly affects JPEG/WebP. Animated sources use imgproxy's default
+  first-frame behavior.
+- A single `versionId` may select a specific source version. Other query
+  parameters are rejected.
+- GET, HEAD, Range, and conditional requests apply to the returned representation.
+  Processed images have independent SHA-256 ETags and byte lengths. Derived
+  responses use ETag validators rather than the source modification date, which
+  cannot distinguish overwrites within the same second. Without a processing
+  parameter the gateway reads the original image, including single byte ranges.
+- Original GET and HEAD responses reject unsupported or malformed media types,
+  including HTML and all `image/*+xml` subtypes. Non-XML image types and octet-stream
+  objects retain their original `Content-Type`, including parameters. This prevents
+  uploaded executable documents from being served under the gateway's origin.
+  A 304 may omit `Content-Type`; an explicit unsupported type is still rejected
+  so conditional responses cannot reclassify previously cached bytes.
+
+This implements a limited subset of OSS image processing parameters, rather than
+full Aliyun OSS compatibility. It runs on a separate port and does not change
+existing `weed s3`, Filer, or Volume services.
+
+## Running the gateway
+
+Start a separate imgproxy service, then run:
+
+```sh
+weed image \
+  -source=http://s3:8333/public-bucket \
+  -imgproxy=http://imgproxy:8080 \
+  -ip.bind=0.0.0.0 -port=8334 \
+  -cacheCapacityMB=64 -concurrency=8 \
+  -maxSourceMB=25 -maxResultMB=10 -maxDimension=4096 -timeout=15s
+```
+
+`source` fixes the source HTTP(S) URL, optionally including a bucket path or a
+bucket domain pointing to S3. With `http://s3:8333/public-bucket`, a client request
+for `/a/b.png` reads `http://s3:8333/public-bucket/a/b.png`. Both backend URLs must
+omit credentials, queries, and fragments. The imgproxy URL must be a root URL
+without a path prefix; prefixed URLs are rejected at startup. Dot segments and backslashes, including
+repeatedly escaped forms, are rejected to prevent backend path normalization from
+escaping a fixed bucket prefix. The gateway and imgproxy must reach the same source.
+
+Configure imgproxy limits and isolate the encoder with container or process
+resource limits. Suggested imgproxy settings:
+
+```text
+IMGPROXY_WORKERS=2
+IMGPROXY_REQUESTS_QUEUE_SIZE=8
+IMGPROXY_MAX_SRC_FILE_SIZE=26214400
+IMGPROXY_MAX_SRC_RESOLUTION=25
+IMGPROXY_MAX_RESULT_DIMENSION=4096
+IMGPROXY_MAX_ANIMATION_FRAMES=1
+IMGPROXY_MAX_REDIRECTS=0
+IMGPROXY_ALLOWED_PROCESSING_OPTIONS=rs,q,f
+IMGPROXY_ALLOWED_SOURCES=http://s3:8333/public-bucket/
+```
+
+These variables apply to imgproxy 3.x. In imgproxy 4.x, some source security limits
+move to separate source configuration; configure equivalent restrictions according
+to that version's documentation. File size limits do not replace pixel and memory
+limits. The gateway does not decode images and cannot enforce encoder-side limits.
+
+Set hexadecimal `IMGPROXY_KEY` and `IMGPROXY_SALT` in both services to sign backend
+requests. The gateway supports one key/salt pair with full SHA-256 signatures;
+imgproxy must use the default 32-byte signature length. Unsigned requests are only
+appropriate on an isolated trusted network. Keep signing material out of command
+lines, public configuration, and logs.
+
+## Access and caching
+
+The endpoint only accepts anonymous public reads. It rejects client Authorization,
+S3 signature parameters, and `x-amz-*` request headers. Browser cookies are ignored
+and never forwarded to backends. The gateway does not create administrative
+credentials or signed source URLs for private objects. Use the existing S3 endpoint
+for private images.
+
+Every derived request performs an anonymous source HEAD, including cache hits,
+HEAD, and 304 requests. The encoder uses anonymous GET, so the source must apply
+the same public-read policy to HEAD and GET; SeaweedFS S3 authorizes both as object
+reads. A source 403 or 404 rejects derived requests even if cached bytes remain.
+Source URL, ETag, modification time, length, version ID, and canonical processing
+options form the cache key. Sources without ETags are not cached. A revision
+change detected during encoding returns 409, allowing a client retry. Use immutable
+object names for unversioned sources to avoid races between metadata checks and
+frequent source overwrites.
+
+Concurrent misses for the same result share one encoding job. A cancelled waiter
+does not cancel work needed by other waiters. If all waiters leave, the job may run
+until its independent processing timeout; separate work tokens still bound such
+background jobs. Source metadata checks, shared encoding (including its final
+source recheck), and client writes each receive a full timeout budget. A slow
+initial HEAD does not shorten the caller's wait for shared encoding. The HTTP
+server also bounds request body reads to 10 seconds. Requests, result sizes,
+duration, and concurrency are bounded. Original
+single-range responses are limited by the complete object's size, not just the
+selected range. Excess concurrency returns 429; errors are never cached. The cache
+is limited by bytes and 1024 entries, defaults to 64 MiB, and can be disabled with
+`-cacheCapacityMB=0`. Each instance has its own cache, empty after restart.
+
+Responses default to `Cache-Control: no-cache`, allowing downstream storage with
+mandatory revalidation so source access is checked on every request. A CDN must
+preserve `x-oss-process` and `versionId` and include the complete query in its cache
+key. If you explicitly set a CDN TTL for permanently public immutable objects,
+CDN hits bypass the gateway. Revocation or deletion then requires a CDN purge,
+otherwise access changes only take effect after TTL expiry. Errors use `no-store`.
+
+Configure HTTPS, CORS, and external rate limits in the existing reverse proxy or
+CDN. Route only public image GET/HEAD requests to this gateway. Uploads, listings,
+signed reads, and other S3 operations continue using the existing S3 endpoint.
+
+## Validation
+
+```sh
+go test -race ./weed/images/gateway
+go vet ./weed/images/gateway
+CGO_ENABLED=0 go build ./weed
+```
+
+Tests cover revocation and deletion, overwrite invalidation, explicit versions,
+shared work and cancellation, resource limits, backend failures, signatures and
+path escaping, and HEAD/ETag/Range semantics. Before deployment, also test real
+SeaweedFS and imgproxy for dimensions, media types, transparency, and regeneration
+after clearing the cache.
diff --git a/weed/images/gateway/cache.go b/weed/images/gateway/cache.go
new file mode 100644
index 0000000000..96e8c54353
--- /dev/null
+++ b/weed/images/gateway/cache.go
@@ -0,0 +1,65 @@
+package gateway
+
+import (
+	"container/list"
+	"sync"
+)
+
+type result struct {
+	data              []byte
+	contentType, etag string
+}
+
+type cacheEntry struct {
+	key   string
+	value *result
+	size  int64
+}
+
+// cache is a byte-bounded LRU with an entry limit to bound metadata for small objects.
+type cache struct {
+	mu             sync.Mutex
+	entries        map[string]*list.Element
+	order          *list.List
+	capacity, used int64
+}
+
+// newCache creates a disposable in-process cache without creating storage objects.
+func newCache(capacity int64) *cache {
+	return &cache{entries: make(map[string]*list.Element), order: list.New(), capacity: capacity}
+}
+
+// get returns immutable results and updates recency.
+func (c *cache) get(key string) *result {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if e := c.entries[key]; e != nil {
+		c.order.MoveToFront(e)
+		return e.Value.(*cacheEntry).value
+	}
+	return nil
+}
+
+// put accounts for data and index overhead, skipping results larger than capacity.
+func (c *cache) put(key string, value *result) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	size := int64(len(key) + len(value.data) + len(value.contentType) + len(value.etag) + 128)
+	if c.capacity == 0 || size > c.capacity {
+		return
+	}
+	if old := c.entries[key]; old != nil {
+		c.used -= old.Value.(*cacheEntry).size
+		c.order.Remove(old)
+		delete(c.entries, key)
+	}
+	for c.used+size > c.capacity || len(c.entries) >= 1024 {
+		old := c.order.Back()
+		entry := old.Value.(*cacheEntry)
+		delete(c.entries, entry.key)
+		c.used -= entry.size
+		c.order.Remove(old)
+	}
+	c.entries[key] = c.order.PushFront(&cacheEntry{key: key, value: value, size: size})
+	c.used += size
+}
diff --git a/weed/images/gateway/gateway.go b/weed/images/gateway/gateway.go
new file mode 100644
index 0000000000..b6f7cb4c6d
--- /dev/null
+++ b/weed/images/gateway/gateway.go
@@ -0,0 +1,457 @@
+// Package gateway provides an optional on-demand gateway for public S3 images.
+package gateway
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"golang.org/x/sync/singleflight"
+)
+
+type Config struct {
+	Source, Imgproxy, Key, Salt                string
+	Concurrency, MaxDimension                  int
+	CacheBytes, MaxSourceBytes, MaxResultBytes int64
+	Timeout                                    time.Duration
+}
+
+type Gateway struct {
+	source, processor *url.URL
+	key, salt         []byte
+	config            Config
+	client            *http.Client
+	requests          chan struct{}
+	work              chan struct{}
+	cache             *cache
+	flights           singleflight.Group
+}
+
+type failure struct {
+	status  int
+	message string
+}
+
+type responseWriter struct {
+	http.ResponseWriter
+	timeout time.Duration
+	started bool
+}
+
+// beginWrite starts a separate client write budget after backend processing.
+func (w *responseWriter) beginWrite() {
+	if !w.started {
+		w.started = true
+		_ = http.NewResponseController(w.ResponseWriter).SetWriteDeadline(time.Now().Add(w.timeout))
+	}
+}
+
+// WriteHeader starts the write budget and prevents caching protocol errors, including 412 and 416.
+// Every response path commits its status before writing bytes through the embedded writer.
+func (w *responseWriter) WriteHeader(status int) {
+	w.beginWrite()
+	if status >= 400 {
+		w.Header().Set("Cache-Control", "no-store")
+	}
+	w.ResponseWriter.WriteHeader(status)
+}
+
+// Error returns a fixed message without source URLs or signing material.
+func (f *failure) Error() string { return f.message }
+
+// New validates fixed backends and resource limits; redirects are disabled.
+func New(c Config) (*Gateway, error) {
+	if c.Concurrency < 1 || c.Concurrency > 1024 || c.MaxDimension < 1 || c.MaxDimension > 16384 ||
+		c.CacheBytes < 0 || c.CacheBytes > 1<<40 || c.MaxSourceBytes < 1 || c.MaxSourceBytes > 1<<30 ||
+		c.MaxResultBytes < 1 || c.MaxResultBytes > 1<<30 || c.Timeout <= 0 {
+		return nil, fmt.Errorf("invalid resource limits")
+	}
+	parse := func(value string) (*url.URL, error) {
+		u, err := url.Parse(value)
+		if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" ||
+			u.User != nil || u.RawQuery != "" || u.ForceQuery || u.Fragment != "" {
+			return nil, fmt.Errorf("backends must be HTTP(S) URLs without credentials, queries, or fragments")
+		}
+		return u, nil
+	}
+	source, err := parse(c.Source)
+	if err != nil {
+		return nil, err
+	}
+	processor, err := parse(c.Imgproxy)
+	if err != nil {
+		return nil, err
+	}
+	// imgproxy signs its root-relative processing path; reject ambiguous proxy prefixes.
+	if processor.Path != "" && processor.Path != "/" || processor.RawPath != "" {
+		return nil, fmt.Errorf("imgproxy URL must not contain a path prefix")
+	}
+	key, keyErr := hex.DecodeString(c.Key)
+	salt, saltErr := hex.DecodeString(c.Salt)
+	if keyErr != nil || saltErr != nil || (len(key) == 0) != (len(salt) == 0) {
+		return nil, fmt.Errorf("imgproxy key and salt must both be provided as hexadecimal values")
+	}
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.DisableCompression = true
+	return &Gateway{
+		source: source, processor: processor, key: key, salt: salt, config: c,
+		client:   &http.Client{Transport: transport, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }},
+		requests: make(chan struct{}, c.Concurrency), cache: newCache(c.CacheBytes),
+		work: make(chan struct{}, c.Concurrency),
+	}, nil
+}
+
+// sourceURL joins the fixed source and object path, ignoring client hosts and credentials.
+func (g *Gateway) sourceURL(r *http.Request, query url.Values) *url.URL {
+	u := *g.source
+	u.Path = strings.TrimSuffix(u.Path, "/") + r.URL.Path
+	u.RawPath = strings.TrimSuffix(g.source.EscapedPath(), "/") + r.URL.EscapedPath()
+	if id := query.Get("versionId"); id != "" {
+		u.RawQuery = url.Values{"versionId": {id}}.Encode()
+	}
+	return &u
+}
+
+// ServeHTTP checks anonymous source access before cached or conditional responses.
+func (g *Gateway) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	wrapped := &responseWriter{ResponseWriter: w, timeout: g.config.Timeout}
+	w = wrapped
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	if r.Method != http.MethodGet && r.Method != http.MethodHead {
+		w.Header().Set("Allow", "GET, HEAD")
+		g.writeError(w, r, &failure{405, "only GET and HEAD are allowed"})
+		return
+	}
+	if !safeObjectPath(r.URL.Path) {
+		g.writeError(w, r, &failure{400, "object path contains unsafe normalization segments"})
+		return
+	}
+	query, err := url.ParseQuery(r.URL.RawQuery)
+	if err != nil {
+		g.writeError(w, r, &failure{400, "invalid query parameters"})
+		return
+	}
+	for name, values := range query {
+		if (name != "x-oss-process" && name != "versionId") || len(values) != 1 || len(values[0]) > 1024 {
+			g.writeError(w, r, &failure{400, "unsupported or repeated query parameters"})
+			return
+		}
+	}
+	if r.Header.Get("Authorization") != "" {
+		g.writeError(w, r, &failure{403, "this endpoint only serves anonymously readable public images"})
+		return
+	}
+	for name := range r.Header {
+		if strings.HasPrefix(strings.ToLower(name), "x-amz-") {
+			g.writeError(w, r, &failure{403, "this endpoint does not accept S3 credentials or encryption headers"})
+			return
+		}
+	}
+	var o options
+	_, processing := query["x-oss-process"]
+	if processing {
+		o, err = parseOptions(query.Get("x-oss-process"), g.config.MaxDimension)
+		if err != nil {
+			g.writeError(w, r, &failure{400, err.Error()})
+			return
+		}
+	}
+	select {
+	case g.requests <- struct{}{}:
+		defer func() { <-g.requests }()
+	default:
+		g.writeError(w, r, &failure{429, "image request concurrency limit reached"})
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), g.config.Timeout)
+	defer cancel()
+	source := g.sourceURL(r, query)
+	if !processing {
+		g.serveOriginal(wrapped, r.WithContext(ctx), source)
+		return
+	}
+	metadata, err := g.head(ctx, source)
+	if err != nil {
+		g.writeError(w, r, err)
+		return
+	}
+	// Only sources with validators can reuse results; access is still checked on every request.
+	cacheKey := source.String() + "\n" + revision(metadata) + "\n" + o.path()
+	cacheable := metadata.Get("ETag") != ""
+	var image *result
+	if cacheable {
+		image = g.cache.get(cacheKey)
+	}
+	if image == nil {
+		// Source metadata and shared work each have their own bounded phase.
+		// A slow HEAD must not consume the time needed to await a valid encoding job.
+		waitCtx, waitCancel := context.WithTimeout(r.Context(), g.config.Timeout)
+		defer waitCancel()
+		cancel()
+		flight := g.flights.DoChan(cacheKey, func() (interface{}, error) {
+			if cacheable {
+				if hit := g.cache.get(cacheKey); hit != nil {
+					return hit, nil
+				}
+			}
+			// Shared work is independent of any waiter and remains bounded by its own timeout.
+			// Separate tokens prevent cancelled requests from bypassing the work concurrency limit.
+			select {
+			case g.work <- struct{}{}:
+				defer func() { <-g.work }()
+			default:
+				return nil, &failure{429, "image encoding concurrency limit reached"}
+			}
+			workCtx, workCancel := context.WithTimeout(context.Background(), g.config.Timeout)
+			defer workCancel()
+			processed, processErr := g.process(workCtx, source, o)
+			if processErr != nil {
+				return nil, processErr
+			}
+			// Recheck access and revision before caching results from an in-flight encoding.
+			current, checkErr := g.head(workCtx, source)
+			if checkErr != nil {
+				return nil, checkErr
+			}
+			if revision(current) != revision(metadata) {
+				return nil, &failure{409, "source changed during processing; retry the request"}
+			}
+			if cacheable {
+				g.cache.put(cacheKey, processed)
+			}
+			return processed, nil
+		})
+		select {
+		case outcome := <-flight:
+			if outcome.Err != nil {
+				g.writeError(w, r, outcome.Err)
+				return
+			}
+			image = outcome.Val.(*result)
+		case <-waitCtx.Done():
+			g.writeError(w, r, &failure{504, "image processing timed out or request was cancelled"})
+			return
+		}
+	}
+	// Keep the status hook for protocol errors; body writes use the embedded writer directly.
+	// Attach output metadata to that same writer before ServeContent sends the response.
+	rw := wrapped
+	rw.Header().Set("Content-Type", image.contentType)
+	rw.Header().Set("ETag", image.etag)
+	wrapped.beginWrite()
+	// A second-resolution source date cannot distinguish overwrites; use the output ETag only.
+	http.ServeContent(rw, r, "", time.Time{}, bytes.NewReader(image.data))
+}
+
+// safeObjectPath rejects paths that a backend proxy could normalize outside the fixed bucket prefix.
+// Check repeatedly escaped dot segments and backslashes while preserving ordinary object escaping.
+func safeObjectPath(value string) bool {
+	for i := 0; i < 4; i++ {
+		if strings.Contains(value, "\\") {
+			return false
+		}
+		for _, part := range strings.Split(value, "/") {
+			if part == "." || part == ".." {
+				return false
+			}
+		}
+		next, err := url.PathUnescape(value)
+		if err != nil || next == value {
+			return true
+		}
+		value = next
+	}
+	return false
+}
+
+// allowedSourceType excludes XML documents, including custom image subtypes that can contain scripts.
+func allowedSourceType(mediaType string) bool {
+	if strings.HasSuffix(mediaType, "+xml") {
+		return false
+	}
+	return strings.HasPrefix(mediaType, "image/") || mediaType == "application/octet-stream" || mediaType == "binary/octet-stream"
+}
+
+// revision includes S3 version and content validators in the cache key.
+func revision(h http.Header) string {
+	return h.Get("ETag") + "\n" + h.Get("Last-Modified") + "\n" + h.Get("Content-Length") + "\n" + h.Get("x-amz-version-id")
+}
+
+// read makes credential-free requests with the supplied timeout and cancellation context.
+func (g *Gateway) read(ctx context.Context, method string, u *url.URL, headers http.Header) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, method, u.String(), nil)
+	if err != nil {
+		return nil, &failure{502, "could not create backend request"}
+	}
+	if headers != nil {
+		req.Header = headers.Clone()
+	}
+	resp, err := g.client.Do(req)
+	if err != nil {
+		if errors.Is(err, context.DeadlineExceeded) {
+			return nil, &failure{504, "image backend request timed out"}
+		}
+		return nil, &failure{502, "image backend request failed"}
+	}
+	return resp, nil
+}
+
+// head checks anonymous access and source size without forwarding client conditions.
+func (g *Gateway) head(ctx context.Context, source *url.URL) (http.Header, error) {
+	resp, err := g.read(ctx, http.MethodHead, source, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == 403 || resp.StatusCode == 404 {
+		return nil, &failure{resp.StatusCode, "source image is not accessible"}
+	}
+	if resp.StatusCode != 200 {
+		return nil, &failure{502, "source image check failed"}
+	}
+	if resp.ContentLength < 0 || resp.ContentLength > g.config.MaxSourceBytes {
+		return nil, &failure{413, "source image exceeds size limit or lacks a content length"}
+	}
+	return resp.Header, nil
+}
+
+// processorURL builds a fixed-operation imgproxy URL, optionally signed with its key and salt.
+func (g *Gateway) processorURL(source *url.URL, o options) *url.URL {
+	path := o.path() + "/" + base64.RawURLEncoding.EncodeToString([]byte(source.String())) + "." + o.format
+	signature := "insecure"
+	if len(g.key) != 0 {
+		mac := hmac.New(sha256.New, g.key)
+		mac.Write(g.salt)
+		mac.Write([]byte(path))
+		signature = base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+	}
+	u := *g.processor
+	u.Path = strings.TrimSuffix(u.Path, "/") + "/" + signature + path
+	u.RawPath = ""
+	return &u
+}
+
+// process reads bounded results, rejecting incorrect media types and unsuccessful responses.
+func (g *Gateway) process(ctx context.Context, source *url.URL, o options) (*result, error) {
+	resp, err := g.read(ctx, http.MethodGet, g.processorURL(source, o), nil)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return nil, &failure{502, "image encoder returned an error"}
+	}
+	contentType, _, err := mime.ParseMediaType(resp.Header.Get("Content-Type"))
+	expected := map[string]string{"jpg": "image/jpeg", "png": "image/png", "webp": "image/webp"}[o.format]
+	if err != nil || contentType != expected {
+		return nil, &failure{502, "image encoder returned an unexpected media type"}
+	}
+	data, err := io.ReadAll(io.LimitReader(resp.Body, g.config.MaxResultBytes+1))
+	if err != nil {
+		return nil, &failure{502, "could not read processed image"}
+	}
+	if len(data) == 0 || int64(len(data)) > g.config.MaxResultBytes {
+		return nil, &failure{413, "processed image is empty or exceeds size limit"}
+	}
+	digest := sha256.Sum256(data)
+	return &result{data: data, contentType: contentType, etag: fmt.Sprintf("\"%x\"", digest)}, nil
+}
+
+// serveOriginal preserves public source conditions and ranges without forwarding credentials.
+func (g *Gateway) serveOriginal(w *responseWriter, r *http.Request, source *url.URL) {
+	headers := make(http.Header)
+	for _, key := range []string{"Range", "If-Range", "If-Match", "If-None-Match", "If-Modified-Since", "If-Unmodified-Since"} {
+		if value := r.Header.Get(key); value != "" {
+			headers.Set(key, value)
+		}
+	}
+	resp, err := g.read(r.Context(), r.Method, source, headers)
+	if err != nil {
+		g.writeError(w, r, err)
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 && resp.StatusCode != 206 && resp.StatusCode != 304 {
+		status := resp.StatusCode
+		if status < 400 || status >= 500 {
+			status = 502
+		}
+		if status == 416 {
+			w.Header().Set("Content-Range", resp.Header.Get("Content-Range"))
+		}
+		g.writeError(w, r, &failure{status, "source image read failed"})
+		return
+	}
+	sourceSize := resp.ContentLength
+	if resp.StatusCode == 206 {
+		// A 206 length describes only the selected range; enforce limits against the complete object.
+		rangeValue := resp.Header.Get("Content-Range")
+		_, total, ok := strings.Cut(rangeValue, "/")
+		sourceSize, err = strconv.ParseInt(total, 10, 64)
+		if !ok || !strings.HasPrefix(rangeValue, "bytes ") || err != nil || sourceSize < 1 {
+			g.writeError(w, r, &failure{502, "source range response lacks a valid complete length"})
+			return
+		}
+	}
+	if sourceSize > g.config.MaxSourceBytes || resp.ContentLength > g.config.MaxSourceBytes {
+		g.writeError(w, r, &failure{413, "source image exceeds size limit"})
+		return
+	}
+	// Serving executable documents under this origin allows cross-site scripting.
+	contentType := resp.Header.Get("Content-Type")
+	mediaType, _, mediaErr := mime.ParseMediaType(contentType)
+	// A 304 may omit this header, but must not replace cached metadata with an executable type.
+	if (resp.StatusCode != 304 || contentType != "") && (mediaErr != nil || !allowedSourceType(mediaType)) {
+		g.writeError(w, r, &failure{502, "source image has an unsupported media type"})
+		return
+	}
+	var data []byte
+	if r.Method != http.MethodHead && resp.StatusCode != 304 {
+		data, err = io.ReadAll(io.LimitReader(resp.Body, g.config.MaxSourceBytes+1))
+		if err != nil || int64(len(data)) > g.config.MaxSourceBytes {
+			g.writeError(w, r, &failure{502, "source read failed or exceeded size limit"})
+			return
+		}
+	}
+	// Write through the inner ResponseWriter so the validated content type is
+	// visibly attached to the writer that receives the body.
+	rw := w.ResponseWriter
+	if contentType != "" {
+		rw.Header().Set("Content-Type", contentType)
+	}
+	for _, key := range []string{"Content-Encoding", "Content-Length", "ETag", "Last-Modified", "Accept-Ranges", "Content-Range", "x-amz-version-id"} {
+		if value := resp.Header.Get(key); value != "" {
+			rw.Header().Set(key, value)
+		}
+	}
+	w.beginWrite()
+	rw.WriteHeader(resp.StatusCode)
+	if len(data) != 0 {
+		_, _ = io.Copy(rw, bytes.NewReader(data))
+	}
+}
+
+// writeError prevents downstream caching of access and transient errors.
+func (g *Gateway) writeError(w http.ResponseWriter, r *http.Request, err error) {
+	f, ok := err.(*failure)
+	if !ok {
+		f = &failure{502, "image processing failed"}
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Del("ETag")
+	w.Header().Del("Content-Length")
+	http.Error(w, f.message, f.status)
+}
diff --git a/weed/images/gateway/gateway_test.go b/weed/images/gateway/gateway_test.go
new file mode 100644
index 0000000000..5d59d79de7
--- /dev/null
+++ b/weed/images/gateway/gateway_test.go
@@ -0,0 +1,803 @@
+package gateway
+
+import (
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+const transform = "image/resize,w_640/quality,Q_85/format,webp"
+
+// fixture models S3 access, revisions, and an external encoder for HTTP-level tests.
+type fixture struct {
+	origin, processor        *httptest.Server
+	gateway                  *Gateway
+	mu                       sync.Mutex
+	status                   int
+	etag, version            string
+	contentType              string
+	sourceBytes              int64
+	processStatus            int
+	processType              string
+	data                     []byte
+	original                 []byte
+	sources                  []string
+	heads                    atomic.Int32
+	encodes                  atomic.Int32
+	started, release         chan struct{}
+	headStarted, headRelease chan struct{}
+	headPaused               atomic.Bool
+}
+
+// newFixture creates HTTP backends that fail tests if credentials are forwarded.
+func newFixture(t *testing.T) *fixture {
+	t.Helper()
+	f := &fixture{status: 200, etag: "\"source-v1\"", sourceBytes: 100, contentType: "image/png", processStatus: 200,
+		processType: "image/webp", data: []byte("RIFF transformed webp bytes"), original: []byte("original-image")}
+	f.origin = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Pause only the initial source check; the post-encoding recheck remains fast.
+		if r.Method == http.MethodHead && f.headRelease != nil && f.headPaused.CompareAndSwap(false, true) {
+			close(f.headStarted)
+			select {
+			case <-f.headRelease:
+			case <-r.Context().Done():
+				return
+			}
+		}
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		if r.Header.Get("Authorization") != "" || r.Header.Get("Cookie") != "" || r.URL.Query().Get("x-oss-process") != "" {
+			t.Error("source request contained credentials or processing parameters")
+		}
+		if r.Method == http.MethodHead {
+			f.heads.Add(1)
+			w.Header().Set("Content-Type", f.contentType)
+			w.Header().Set("ETag", f.etag)
+			w.Header().Set("Content-Length", fmt.Sprint(f.sourceBytes))
+			w.Header().Set("Last-Modified", "Sun, 04 Oct 2026 10:00:00 GMT")
+			if f.version != "" {
+				w.Header().Set("x-amz-version-id", f.version)
+			}
+			w.WriteHeader(f.status)
+			return
+		}
+		if f.status != 200 {
+			w.WriteHeader(f.status)
+			return
+		}
+		w.Header().Set("Content-Type", f.contentType)
+		w.Header().Set("ETag", f.etag)
+		http.ServeContent(w, r, "", time.Time{}, bytes.NewReader(f.original))
+	}))
+	f.processor = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		f.encodes.Add(1)
+		encoded := strings.TrimSuffix(r.URL.Path[strings.LastIndex(r.URL.Path, "/")+1:], ".webp")
+		source, err := base64.RawURLEncoding.DecodeString(encoded)
+		if err != nil {
+			t.Errorf("encoder received an invalid source URL: %v", err)
+		}
+		f.mu.Lock()
+		f.sources = append(f.sources, string(source))
+		status, contentType, data := f.processStatus, f.processType, append([]byte(nil), f.data...)
+		f.mu.Unlock()
+		if f.started != nil {
+			select {
+			case f.started <- struct{}{}:
+			default:
+			}
+		}
+		if f.release != nil {
+			select {
+			case <-f.release:
+			case <-r.Context().Done():
+				return
+			}
+		}
+		w.Header().Set("Content-Type", contentType)
+		w.WriteHeader(status)
+		_, _ = w.Write(data)
+	}))
+	var err error
+	f.gateway, err = New(Config{Source: f.origin.URL + "/bucket", Imgproxy: f.processor.URL,
+		Concurrency: 16, MaxDimension: 4096, CacheBytes: 4096, MaxSourceBytes: 1024, MaxResultBytes: 1024, Timeout: 2 * time.Second})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { f.origin.Close(); f.processor.Close(); f.gateway.client.CloseIdleConnections() })
+	return f
+}
+
+// request sends conditional or range requests to the gateway handler.
+func (f *fixture) request(method, path string, headers http.Header) *httptest.ResponseRecorder {
+	r := httptest.NewRequest(method, "http://untrusted-host"+path, nil)
+	if headers != nil {
+		r.Header = headers
+	}
+	w := httptest.NewRecorder()
+	f.gateway.ServeHTTP(w, r)
+	return w
+}
+
+// imagePath escapes the processing query while preserving its slash-separated semantics.
+func imagePath() string { return "/image.png?x-oss-process=" + url.QueryEscape(transform) }
+
+// TestCacheRechecksAccess checks cache hits, revocation of public access, and source deletion.
+func TestCacheRechecksAccess(t *testing.T) {
+	f := newFixture(t)
+	first := f.request("GET", imagePath(), nil)
+	if first.Code != 200 || first.Header().Get("ETag") == "\"source-v1\"" || first.Header().Get("Content-Type") != "image/webp" {
+		t.Fatalf("unexpected first processed response: %d %v", first.Code, first.Header())
+	}
+	second := f.request("GET", imagePath(), nil)
+	if !bytes.Equal(first.Body.Bytes(), second.Body.Bytes()) || f.encodes.Load() != 1 || f.heads.Load() != 3 {
+		t.Fatal("cache hits must recheck access without re-encoding")
+	}
+	f.mu.Lock()
+	f.status = 403
+	f.mu.Unlock()
+	denied := f.request("GET", imagePath(), http.Header{"If-None-Match": {first.Header().Get("ETag")}})
+	if denied.Code != 403 || denied.Header().Get("Cache-Control") != "no-store" {
+		t.Fatal("conditional request bypassed revoked access")
+	}
+	f.mu.Lock()
+	f.status = 404
+	f.mu.Unlock()
+	if f.request("HEAD", imagePath(), nil).Code != 404 {
+		t.Fatal("deleted source still served a cached result")
+	}
+}
+
+// TestRepresentationHeaders checks HEAD, 304, and Range semantics for processed bytes.
+func TestRepresentationHeaders(t *testing.T) {
+	f := newFixture(t)
+	full := f.request("GET", imagePath(), nil)
+	etag := full.Header().Get("ETag")
+	head := f.request("HEAD", imagePath(), nil)
+	if head.Code != 200 || head.Body.Len() != 0 || head.Header().Get("Content-Length") != fmt.Sprint(len(f.data)) {
+		t.Fatal("HEAD used the source length or returned a body")
+	}
+	conditional := f.request("GET", imagePath(), http.Header{"If-None-Match": {etag}})
+	if conditional.Code != 304 || conditional.Body.Len() != 0 {
+		t.Fatal("output ETag did not produce 304")
+	}
+	if f.request("GET", imagePath(), http.Header{"If-None-Match": {"\"source-v1\""}}).Code != 200 {
+		t.Fatal("source ETag was incorrectly used")
+	}
+	ranged := f.request("GET", imagePath(), http.Header{"Range": {"bytes=0-3"}})
+	if ranged.Code != 206 || ranged.Body.String() != "RIFF" || ranged.Header().Get("Content-Range") != fmt.Sprintf("bytes 0-3/%d", len(f.data)) {
+		t.Fatal("Range did not apply to processed bytes")
+	}
+	invalid := f.request("GET", imagePath(), http.Header{"Range": {"bytes=999-"}})
+	if invalid.Code != 416 || invalid.Header().Get("Cache-Control") != "no-store" {
+		t.Fatal("unsatisfiable output range was not rejected")
+	}
+	failed := f.request("GET", imagePath(), http.Header{"If-Match": {"\"wrong\""}})
+	if failed.Code != 412 || failed.Header().Get("Cache-Control") != "no-store" {
+		t.Fatal("failed precondition response was cacheable")
+	}
+}
+
+// TestChangedSource checks invalidation after overwrites and explicit version reads.
+func TestChangedSource(t *testing.T) {
+	f := newFixture(t)
+	f.request("GET", imagePath(), nil)
+	f.mu.Lock()
+	f.etag = "\"source-v2\""
+	f.data = []byte("new result")
+	f.mu.Unlock()
+	if f.request("GET", imagePath(), nil).Body.String() != "new result" || f.encodes.Load() != 2 {
+		t.Fatal("source overwrite returned stale cache")
+	}
+	if f.request("GET", imagePath()+"&versionId=v1", nil).Code != 200 {
+		t.Fatal("explicit version read failed")
+	}
+	f.mu.Lock()
+	last := f.sources[len(f.sources)-1]
+	f.mu.Unlock()
+	if last != f.origin.URL+"/bucket/image.png?versionId=v1" {
+		t.Fatalf("version was not forwarded to the source: %s", last)
+	}
+}
+
+// TestSourceChangesDuringEncoding checks that changing sources do not populate stale cache entries.
+func TestSourceChangesDuringEncoding(t *testing.T) {
+	f := newFixture(t)
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	done := make(chan *httptest.ResponseRecorder, 1)
+	go func() { done <- f.request("GET", imagePath(), nil) }()
+	<-f.started
+	f.mu.Lock()
+	f.etag = "\"replaced\""
+	f.mu.Unlock()
+	close(f.release)
+	if (<-done).Code != 409 {
+		t.Fatal("source replacement still cached a processed result")
+	}
+	if f.request("GET", imagePath(), nil).Code != 200 || f.encodes.Load() != 2 {
+		t.Fatal("retry did not re-encode")
+	}
+}
+
+// TestRejectUnsafeRequests checks that credentials, arbitrary URLs, duplicate queries, and writes do not reach backends.
+func TestRejectUnsafeRequests(t *testing.T) {
+	f := newFixture(t)
+	tests := []struct {
+		method, path string
+		header       http.Header
+		status       int
+	}{
+		{"PUT", imagePath(), nil, 405},
+		{"GET", imagePath(), http.Header{"Authorization": {"AWS4-HMAC-SHA256 secret"}}, 403},
+		{"GET", imagePath(), http.Header{"X-Amz-Security-Token": {"secret"}}, 403},
+		{"GET", imagePath() + "&X-Amz-Signature=secret", nil, 400},
+		{"GET", imagePath() + "&source=http://private-target", nil, 400},
+		{"GET", imagePath() + "&x-oss-process=image", nil, 400},
+		{"GET", "/image.png?x-oss-process=%", nil, 400},
+		{"GET", "/image.png?x-oss-process=", nil, 400},
+	}
+	for _, test := range tests {
+		if response := f.request(test.method, test.path, test.header); response.Code != test.status {
+			t.Errorf("request %s returned %d; expected %d", test.path, response.Code, test.status)
+		}
+	}
+	if f.encodes.Load() != 0 || f.heads.Load() != 0 {
+		t.Fatal("invalid request reached a backend")
+	}
+}
+
+// TestLimitsAndBackendFailures checks resource limits, media types, missing sources, and encoder errors.
+func TestLimitsAndBackendFailures(t *testing.T) {
+	tests := []struct {
+		name   string
+		change func(*fixture)
+		status int
+	}{
+		{"oversized source", func(f *fixture) { f.sourceBytes = 1025 }, 413},
+		{"oversized result", func(f *fixture) { f.data = make([]byte, 1025) }, 413},
+		{"empty result", func(f *fixture) { f.data = nil }, 413},
+		{"incorrect media type", func(f *fixture) { f.processType = "text/html" }, 502},
+		{"encoder failure", func(f *fixture) { f.processStatus = 500 }, 502},
+		{"source denied", func(f *fixture) { f.status = 403 }, 403},
+		{"source missing", func(f *fixture) { f.status = 404 }, 404},
+		{"source failure", func(f *fixture) { f.status = 500 }, 502},
+		{"redirect", func(f *fixture) { f.status = 302 }, 502},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			f := newFixture(t)
+			test.change(f)
+			for i := 0; i < 2; i++ {
+				w := f.request("GET", imagePath(), nil)
+				if w.Code != test.status || w.Header().Get("Cache-Control") != "no-store" {
+					t.Fatalf("unexpected error response: %d %v", w.Code, w.Header())
+				}
+			}
+			if f.gateway.cache.order.Len() != 0 {
+				t.Fatal("failed result entered the cache")
+			}
+		})
+	}
+}
+
+// TestConcurrentMisses checks that concurrent misses for the same image encode only once.
+func TestConcurrentMisses(t *testing.T) {
+	f := newFixture(t)
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	var wg sync.WaitGroup
+	wg.Add(8)
+	for i := 0; i < 8; i++ {
+		go func() {
+			defer wg.Done()
+			if w := f.request("GET", imagePath(), nil); w.Code != 200 {
+				t.Errorf("concurrent request failed: %d", w.Code)
+			}
+		}()
+	}
+	<-f.started
+	close(f.release)
+	wg.Wait()
+	if f.encodes.Load() != 1 {
+		t.Fatalf("encoder calls for concurrent misses: %d", f.encodes.Load())
+	}
+}
+
+// TestConcurrencyAndCancellation checks immediate overload rejection and prompt cancellation of waiting requests.
+func TestConcurrencyAndCancellation(t *testing.T) {
+	f := newFixture(t)
+	f.gateway.requests = make(chan struct{}, 1)
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	ctx, cancel := context.WithCancel(context.Background())
+	r := httptest.NewRequest("GET", imagePath(), nil).WithContext(ctx)
+	done := make(chan struct{})
+	go func() { f.gateway.ServeHTTP(httptest.NewRecorder(), r); close(done) }()
+	<-f.started
+	if f.request("GET", imagePath(), nil).Code != 429 {
+		t.Fatal("overload did not return 429")
+	}
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("cancelled request continued waiting for encoding")
+	}
+	close(f.release)
+}
+
+// TestOriginalRead checks source ETag, HEAD, and Range without processing.
+func TestOriginalRead(t *testing.T) {
+	f := newFixture(t)
+	get := f.request("GET", "/image.png", nil)
+	if get.Code != 200 || get.Body.String() != "original-image" || get.Header().Get("Content-Type") != "image/png" {
+		t.Fatal("unexpected source read")
+	}
+	ranged := f.request("GET", "/image.png", http.Header{"Range": {"bytes=0-2"}})
+	if ranged.Code != 206 || ranged.Body.String() != "ori" {
+		t.Fatal("unexpected source range read")
+	}
+	if f.request("GET", "/image.png", http.Header{"If-None-Match": {"\"source-v1\""}}).Code != 304 {
+		t.Fatal("unexpected source conditional read")
+	}
+	if f.request("HEAD", "/image.png", nil).Body.Len() != 0 || f.encodes.Load() != 0 {
+		t.Fatal("source request unexpectedly encoded an image")
+	}
+}
+
+// TestBrowserCookiesAreNotForwarded checks anonymous reads when browsers send site cookies.
+func TestBrowserCookiesAreNotForwarded(t *testing.T) {
+	f := newFixture(t)
+	if f.request("GET", imagePath(), http.Header{"Cookie": {"session=secret"}}).Code != 200 {
+		t.Fatal("site cookie interfered with a public image read")
+	}
+	f.mu.Lock()
+	f.status = 403
+	f.mu.Unlock()
+	if f.request("GET", imagePath(), http.Header{"Cookie": {"session=secret"}}).Code != 403 {
+		t.Fatal("cookie elevated source read permissions")
+	}
+}
+
+// TestNoETagDisablesCache checks that sources without validators are processed on each request.
+func TestNoETagDisablesCache(t *testing.T) {
+	f := newFixture(t)
+	f.etag = ""
+	f.request("GET", imagePath(), nil)
+	f.request("GET", imagePath(), nil)
+	if f.encodes.Load() != 2 {
+		t.Fatal("result was reused without a source ETag")
+	}
+}
+
+// TestFixedSourceAndSigning checks path escaping, fixed hosts, and imgproxy HMAC signatures.
+func TestFixedSourceAndSigning(t *testing.T) {
+	f := newFixture(t)
+	f.gateway.key, f.gateway.salt = []byte("secret"), []byte("salt")
+	r := httptest.NewRequest("GET", "http://attacker/a%20b/%23.png?versionId=v%2B1", nil)
+	source := f.gateway.sourceURL(r, r.URL.Query())
+	if source.String() != f.origin.URL+"/bucket/a%20b/%23.png?versionId=v%2B1" {
+		t.Fatal("fixed source or object escaping changed")
+	}
+	u := f.gateway.processorURL(source, options{width: 640, quality: 85, format: "webp"})
+	parts := strings.SplitN(strings.TrimPrefix(u.Path, "/"), "/", 2)
+	mac := hmac.New(sha256.New, []byte("secret"))
+	mac.Write([]byte("salt/" + parts[1]))
+	if parts[0] != base64.RawURLEncoding.EncodeToString(mac.Sum(nil)) {
+		t.Fatal("imgproxy signature did not match the protocol")
+	}
+}
+
+// TestRealHTTPHead checks output length and body suppression for real HTTP HEAD responses.
+func TestRealHTTPHead(t *testing.T) {
+	f := newFixture(t)
+	s := httptest.NewServer(f.gateway)
+	defer s.Close()
+	resp, err := http.Head(s.URL + imagePath())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != 200 || resp.ContentLength != int64(len(f.data)) || len(body) != 0 {
+		t.Fatal("real HEAD response violated HTTP semantics")
+	}
+}
+
+// waitUntil bounds synchronization waits so a regression fails rather than hanging.
+func waitUntil(t *testing.T, ready func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(time.Second)
+	for !ready() {
+		if time.Now().After(deadline) {
+			t.Fatal("timed out waiting for test synchronization")
+		}
+		time.Sleep(time.Millisecond)
+	}
+}
+
+// TestCancelledLeaderDoesNotFailWaiter checks that shared work outlives its first caller.
+func TestCancelledLeaderDoesNotFailWaiter(t *testing.T) {
+	f := newFixture(t)
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	leader := make(chan *httptest.ResponseRecorder, 1)
+	go func() {
+		w := httptest.NewRecorder()
+		f.gateway.ServeHTTP(w, httptest.NewRequest("GET", imagePath(), nil).WithContext(ctx))
+		leader <- w
+	}()
+	<-f.started
+	waiter := make(chan *httptest.ResponseRecorder, 1)
+	go func() { waiter <- f.request("GET", imagePath(), nil) }()
+	waitUntil(t, func() bool { return f.heads.Load() >= 2 })
+	cancel()
+	if (<-leader).Code != 504 {
+		t.Fatal("cancelled leader did not leave promptly")
+	}
+	close(f.release)
+	response := <-waiter
+	if response.Code != 200 || response.Body.String() != string(f.data) || f.encodes.Load() != 1 {
+		t.Fatalf("leader cancellation failed shared work: status=%d encodes=%d", response.Code, f.encodes.Load())
+	}
+}
+
+// TestCancelledWorkRemainsBounded checks that cancellation cannot free an active encoding slot.
+func TestCancelledWorkRemainsBounded(t *testing.T) {
+	f := newFixture(t)
+	f.gateway.requests, f.gateway.work = make(chan struct{}, 1), make(chan struct{}, 1)
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	done := make(chan struct{})
+	go func() {
+		f.gateway.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest("GET", imagePath(), nil).WithContext(ctx))
+		close(done)
+	}()
+	<-f.started
+	cancel()
+	<-done
+	other := strings.Replace(imagePath(), "image.png", "other.png", 1)
+	if response := f.request("GET", other, nil); response.Code != 429 || f.encodes.Load() != 1 {
+		t.Fatal("cancelled request bypassed active encoding concurrency limit")
+	}
+	close(f.release)
+	waitUntil(t, func() bool { return len(f.gateway.work) == 0 })
+	if f.request("GET", other, nil).Code != 200 {
+		t.Fatal("completed work did not release its concurrency slot")
+	}
+}
+
+// TestAbandonedWorkTimesOut checks that a job with no remaining callers releases its slot.
+func TestAbandonedWorkTimesOut(t *testing.T) {
+	f := newFixture(t)
+	f.gateway.config.Timeout = 50 * time.Millisecond
+	f.gateway.work = make(chan struct{}, 1)
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		f.gateway.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest("GET", imagePath(), nil).WithContext(ctx))
+		close(done)
+	}()
+	<-f.started
+	cancel()
+	<-done
+	waitUntil(t, func() bool { return len(f.gateway.work) == 0 })
+	close(f.release)
+	if f.request("GET", imagePath(), nil).Code != 200 || f.encodes.Load() != 2 {
+		t.Fatal("abandoned encoding did not time out and permit a new job")
+	}
+}
+
+// TestSameSecondOverwriteDoesNotReturn304 checks that source dates cannot validate output bytes.
+func TestSameSecondOverwriteDoesNotReturn304(t *testing.T) {
+	f := newFixture(t)
+	first := f.request("GET", imagePath(), nil)
+	f.mu.Lock()
+	f.etag, f.data = "\"source-v2\"", []byte("replacement bytes")
+	f.mu.Unlock()
+	headers := http.Header{"If-Modified-Since": {"Sun, 04 Oct 2026 10:00:00 GMT"}}
+	response := f.request("GET", imagePath(), headers)
+	if response.Code != 200 || response.Body.String() != "replacement bytes" || response.Header().Get("Last-Modified") != "" {
+		t.Fatal("same-second overwrite incorrectly used the source modification date")
+	}
+	if response.Header().Get("ETag") == first.Header().Get("ETag") {
+		t.Fatal("changed output reused the old validator")
+	}
+	if f.request("GET", imagePath(), http.Header{"If-None-Match": {response.Header().Get("ETag")}}).Code != 304 {
+		t.Fatal("output ETag stopped validating unchanged output")
+	}
+}
+
+// TestOriginalRangeLimitsAndErrors checks complete-object limits and unsatisfied range metadata.
+func TestOriginalRangeLimitsAndErrors(t *testing.T) {
+	f := newFixture(t)
+	f.original = make([]byte, 2048)
+	if response := f.request("GET", "/image.png", http.Header{"Range": {"bytes=0-0"}}); response.Code != 413 {
+		t.Fatalf("small range bypassed the complete source size limit: %d", response.Code)
+	}
+	f.original = []byte("original-image")
+	response := f.request("GET", "/image.png", http.Header{"Range": {"bytes=999-"}})
+	if response.Code != 416 || response.Header().Get("Content-Range") != "bytes */14" || response.Header().Get("Cache-Control") != "no-store" {
+		t.Fatalf("unsatisfied source range lost its complete length: %d %v", response.Code, response.Header())
+	}
+}
+
+// TestOriginalRangeRequiresCompleteLength rejects unknown or invalid source range totals.
+func TestOriginalRangeRequiresCompleteLength(t *testing.T) {
+	for _, contentRange := range []string{"", "bytes 0-0/*", "bytes 0-0/no-number", "items 0-0/100", "bytes 0-0/0"} {
+		t.Run(contentRange, func(t *testing.T) {
+			f := newFixture(t)
+			s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Range", contentRange)
+				w.WriteHeader(206)
+				_, _ = w.Write([]byte("x"))
+			}))
+			defer s.Close()
+			f.gateway.source, _ = url.Parse(s.URL)
+			if f.request("GET", "/image.png", http.Header{"Range": {"bytes=0-0"}}).Code != 502 {
+				t.Fatal("source range without a valid complete length was accepted")
+			}
+		})
+	}
+}
+
+// TestRejectNormalizedTraversal protects a configured bucket prefix, including escaped paths.
+func TestRejectNormalizedTraversal(t *testing.T) {
+	f := newFixture(t)
+	for _, path := range []string{"/../other/image.png", "/./image.png", "/%2e%2e/other.png", "/%252e%252e/other.png", "/%25252e%25252e/other.png", "/x%2f..%2fother.png", "/x%252f..%252fother.png", "/x%5c..%5cother.png", "/x%255c..%255cother.png"} {
+		for _, query := range []string{"", "?x-oss-process=" + url.QueryEscape(transform)} {
+			if response := f.request("GET", path+query, nil); response.Code != 400 {
+				t.Errorf("unsafe path accepted: %s status=%d", path, response.Code)
+			}
+		}
+	}
+	if f.heads.Load() != 0 || f.encodes.Load() != 0 {
+		t.Fatal("unsafe path reached a backend")
+	}
+	if f.request("GET", "/a%20b/%23%25.png?x-oss-process="+url.QueryEscape(transform), nil).Code != 200 {
+		t.Fatal("ordinary escaped object name was rejected")
+	}
+}
+
+// deadlineRecorder exposes the HTTP server deadline hook without relying on timing-sensitive sockets.
+type deadlineRecorder struct {
+	*httptest.ResponseRecorder
+	deadline time.Time
+	calls    int
+}
+
+// SetWriteDeadline records when the gateway allocates its client write budget.
+func (w *deadlineRecorder) SetWriteDeadline(deadline time.Time) error {
+	w.deadline, w.calls = deadline, w.calls+1
+	return nil
+}
+
+// TestWriteBudgetStartsAfterProcessing checks that slow backends do not consume the write budget.
+func TestWriteBudgetStartsAfterProcessing(t *testing.T) {
+	f := newFixture(t)
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
+	done := make(chan struct{})
+	go func() { f.gateway.ServeHTTP(w, httptest.NewRequest("GET", imagePath(), nil)); close(done) }()
+	<-f.started
+	if w.calls != 0 {
+		t.Fatal("write budget started while backend processing was blocked")
+	}
+	released := time.Now()
+	close(f.release)
+	<-done
+	if w.calls != 1 || w.deadline.Before(released.Add(f.gateway.config.Timeout)) || w.Code != 200 {
+		t.Fatal("response did not receive a separate full write timeout")
+	}
+}
+
+// TestSlowMetadataDoesNotConsumeEncodingWait checks independent source and work budgets.
+func TestSlowMetadataDoesNotConsumeEncodingWait(t *testing.T) {
+	f := newFixture(t)
+	f.gateway.config.Timeout = 300 * time.Millisecond
+	f.headStarted, f.headRelease = make(chan struct{}), make(chan struct{})
+	f.started, f.release = make(chan struct{}, 1), make(chan struct{})
+	done := make(chan *httptest.ResponseRecorder, 1)
+	go func() { done <- f.request("GET", imagePath(), nil) }()
+	<-f.headStarted
+	time.Sleep(200 * time.Millisecond)
+	close(f.headRelease)
+	<-f.started
+	time.Sleep(200 * time.Millisecond)
+	close(f.release)
+	response := <-done
+	if response.Code != 200 || response.Body.String() != string(f.data) {
+		t.Fatalf("initial metadata consumed the encoding wait budget: %d", response.Code)
+	}
+}
+
+// TestOriginalContentEncoding checks original encoded bytes, HEAD, ranges, and real client decoding.
+func TestOriginalContentEncoding(t *testing.T) {
+	f := newFixture(t)
+	var compressed bytes.Buffer
+	writer := gzip.NewWriter(&compressed)
+	_, _ = writer.Write(f.original)
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "image/png")
+		w.Header().Set("Content-Encoding", "gzip")
+		w.Header().Set("Content-Length", fmt.Sprint(compressed.Len()))
+		http.ServeContent(w, r, "", time.Time{}, bytes.NewReader(compressed.Bytes()))
+	}))
+	defer source.Close()
+	f.gateway.source, _ = url.Parse(source.URL)
+	get := f.request("GET", "/encoded.png", nil)
+	if get.Code != 200 || get.Header().Get("Content-Encoding") != "gzip" || !bytes.Equal(get.Body.Bytes(), compressed.Bytes()) {
+		t.Fatal("original response lost its content encoding or changed stored bytes")
+	}
+	head := f.request("HEAD", "/encoded.png", nil)
+	if head.Header().Get("Content-Encoding") != "gzip" || head.Header().Get("Content-Length") != fmt.Sprint(compressed.Len()) || head.Body.Len() != 0 {
+		t.Fatal("encoded original HEAD lost representation metadata")
+	}
+	ranged := f.request("GET", "/encoded.png", http.Header{"Range": {"bytes=0-2"}})
+	if ranged.Code != 206 || ranged.Header().Get("Content-Encoding") != "gzip" || !bytes.Equal(ranged.Body.Bytes(), compressed.Bytes()[:3]) {
+		t.Fatal("encoded original range did not preserve stored representation")
+	}
+	server := httptest.NewServer(f.gateway)
+	defer server.Close()
+	response, err := http.Get(server.URL + "/encoded.png")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer response.Body.Close()
+	decoded, err := io.ReadAll(response.Body)
+	if err != nil || !bytes.Equal(decoded, f.original) {
+		t.Fatal("real client could not decode the original representation")
+	}
+}
+
+// TestRepeatedSlashesPreserveBucketPrefix checks actual forwarded URLs rather than assuming traversal.
+func TestRepeatedSlashesPreserveBucketPrefix(t *testing.T) {
+	f := newFixture(t)
+	for _, path := range []string{"//other-bucket/image.png", "/nested//image.png", "/%2fother-bucket/image.png"} {
+		if response := f.request("GET", path+"?x-oss-process="+url.QueryEscape(transform), nil); response.Code != 200 {
+			t.Fatalf("valid repeated-slash key was not served: %s %d", path, response.Code)
+		}
+		f.mu.Lock()
+		encodedSource := f.sources[len(f.sources)-1]
+		f.mu.Unlock()
+		source, err := url.Parse(encodedSource)
+		if err != nil || source.Host != strings.TrimPrefix(f.origin.URL, "http://") || !strings.HasPrefix(source.Path, "/bucket/") {
+			t.Fatalf("repeated slashes escaped the fixed source: %s", encodedSource)
+		}
+	}
+}
+
+// TestOriginalMediaType checks executable documents cannot be served under this origin.
+func TestOriginalMediaType(t *testing.T) {
+	f := newFixture(t)
+	for _, mediaType := range []string{"text/html", "image/svg+xml", "image/svg+xml; bad", "image/x-example+xml", "image/x-example+xml; charset=utf-8", "IMAGE/X-EXAMPLE+XML", "application/xhtml+xml", "text/xml", ""} {
+		f.contentType = mediaType
+		for _, request := range []struct {
+			method  string
+			headers http.Header
+		}{{"GET", nil}, {"HEAD", nil}, {"GET", http.Header{"Range": {"bytes=0-0"}}}} {
+			if response := f.request(request.method, "/page", request.headers); response.Code != 502 {
+				t.Fatalf("executable source type %q was served for %s: %d", mediaType, request.method, response.Code)
+			}
+		}
+	}
+	for _, mediaType := range []string{"image/avif; codecs=\"av01.0.08M.08\"", "image/webp", "image/vnd.microsoft.icon", "application/octet-stream", "binary/octet-stream"} {
+		f.contentType = mediaType
+		response := f.request("GET", "/image.png", nil)
+		if response.Code != 200 || response.Body.String() != "original-image" {
+			t.Fatalf("safe source type %q was rejected: %d", mediaType, response.Code)
+		}
+		if got := response.Header().Get("Content-Type"); got != mediaType {
+			t.Fatalf("source content type %q forwarded as %q", mediaType, got)
+		}
+	}
+}
+
+// TestWriteBudgetsForOriginalAndErrors checks that status commits cover all non-encoding body paths.
+func TestWriteBudgetsForOriginalAndErrors(t *testing.T) {
+	f := newFixture(t)
+	for _, request := range []struct {
+		name, method string
+		headers      http.Header
+		status       int
+	}{
+		{"original", "GET", nil, 200},
+		{"head", "HEAD", nil, 200},
+		{"conditional", "GET", http.Header{"If-None-Match": {f.etag}}, 304},
+		{"range", "GET", http.Header{"Range": {"bytes=0-0"}}, 206},
+		{"invalid-range", "GET", http.Header{"Range": {"bytes=999-"}}, 416},
+		{"unsupported-method", "POST", nil, 405},
+	} {
+		t.Run(request.name, func(t *testing.T) {
+			w := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
+			r := httptest.NewRequest(request.method, "http://untrusted-host/image.png", nil)
+			if request.headers != nil {
+				r.Header = request.headers.Clone()
+			}
+			started := time.Now()
+			f.gateway.ServeHTTP(w, r)
+			if w.Code != request.status || w.calls != 1 || w.deadline.Before(started.Add(f.gateway.config.Timeout)) {
+				t.Fatalf("response lost its full write budget: status=%d calls=%d deadline=%v", w.Code, w.calls, w.deadline)
+			}
+		})
+	}
+}
+
+// TestOriginalConditionalMediaType prevents 304 metadata from reclassifying cached bytes as executable.
+func TestOriginalConditionalMediaType(t *testing.T) {
+	f := newFixture(t)
+	var contentType atomic.Value
+	contentType.Store("")
+	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// net/http strips Content-Type from 304 server responses; preserve explicit backend metadata on the wire.
+		connection, buffer, err := w.(http.Hijacker).Hijack()
+		if err != nil {
+			t.Errorf("could not write conditional backend response: %v", err)
+			return
+		}
+		defer connection.Close()
+		_, _ = fmt.Fprint(buffer, "HTTP/1.1 304 Not Modified\r\nETag: \"source-v1\"\r\nConnection: close\r\n")
+		if value := contentType.Load().(string); value != "" {
+			_, _ = fmt.Fprintf(buffer, "Content-Type: %s\r\n", value)
+		}
+		_, _ = fmt.Fprint(buffer, "\r\n")
+		if err := buffer.Flush(); err != nil {
+			t.Errorf("could not flush conditional backend response: %v", err)
+		}
+	}))
+	defer origin.Close()
+	f.gateway.source, _ = url.Parse(origin.URL)
+	for _, check := range []struct {
+		mediaType string
+		status    int
+	}{
+		{"", 304},
+		{"image/png", 304},
+		{"image/avif; codecs=\"av01.0.08M.08\"", 304},
+		{"text/html", 502},
+		{"image/x-example+xml", 502},
+		{"image/svg+xml; bad", 502},
+	} {
+		contentType.Store(check.mediaType)
+		response := f.request("GET", "/image.png", http.Header{"If-None-Match": {f.etag}})
+		if response.Code != check.status {
+			t.Fatalf("conditional type %q returned %d instead of %d", check.mediaType, response.Code, check.status)
+		}
+		if check.status == 304 && (response.Body.Len() != 0 || response.Header().Get("Content-Type") != check.mediaType) {
+			t.Fatal("safe conditional response changed its body or media type")
+		}
+	}
+}
+
+// TestProcessedErrorsDisableCaching checks standard-library precondition and range failures.
+func TestProcessedErrorsDisableCaching(t *testing.T) {
+	f := newFixture(t)
+	for _, check := range []struct {
+		headers http.Header
+		status  int
+	}{
+		{http.Header{"If-Match": {"\"other-output\""}}, 412},
+		{http.Header{"Range": {"bytes=999-"}}, 416},
+	} {
+		response := f.request("GET", imagePath(), check.headers)
+		if response.Code != check.status || response.Header().Get("Cache-Control") != "no-store" {
+			t.Fatalf("processed protocol error lost no-store: status=%d cache=%q", response.Code, response.Header().Get("Cache-Control"))
+		}
+	}
+}
diff --git a/weed/images/gateway/options.go b/weed/images/gateway/options.go
new file mode 100644
index 0000000000..0d66136d40
--- /dev/null
+++ b/weed/images/gateway/options.go
@@ -0,0 +1,104 @@
+package gateway
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+type options struct {
+	width, height, quality int
+	format                 string
+}
+
+// parseOptions accepts the supported OSS subset and rejects duplicates and unknown operations.
+// quality,Q is absolute quality; relative quality q has no equivalent in imgproxy.
+func parseOptions(value string, maxDimension int) (options, error) {
+	o := options{quality: 85, format: "webp"}
+	parts := strings.Split(value, "/")
+	if len(value) > 256 || len(parts) < 2 || parts[0] != "image" {
+		return o, fmt.Errorf("expected image/processing-operation")
+	}
+	seen := make(map[string]bool)
+	for _, part := range parts[1:] {
+		fields := strings.Split(part, ",")
+		if seen[fields[0]] {
+			return o, fmt.Errorf("repeated processing operation")
+		}
+		seen[fields[0]] = true
+		switch fields[0] {
+		case "resize":
+			if len(fields) < 2 {
+				return o, fmt.Errorf("missing resize dimensions")
+			}
+			keys := make(map[string]bool)
+			for _, f := range fields[1:] {
+				kv := strings.SplitN(f, "_", 2)
+				if len(kv) != 2 || keys[kv[0]] {
+					return o, fmt.Errorf("invalid or repeated resize parameter")
+				}
+				keys[kv[0]] = true
+				switch kv[0] {
+				case "w", "h":
+					n, err := strconv.Atoi(kv[1])
+					if err != nil || n < 1 || n > maxDimension {
+						return o, fmt.Errorf("dimension exceeds allowed range")
+					}
+					if kv[0] == "w" {
+						o.width = n
+					} else {
+						o.height = n
+					}
+				case "m":
+					if kv[1] != "lfit" {
+						return o, fmt.Errorf("only aspect-preserving lfit is supported")
+					}
+				case "limit":
+					if kv[1] != "1" {
+						return o, fmt.Errorf("image enlargement is not allowed")
+					}
+				default:
+					return o, fmt.Errorf("unsupported resize parameter")
+				}
+			}
+			if o.width == 0 && o.height == 0 {
+				return o, fmt.Errorf("missing resize dimensions")
+			}
+		case "quality":
+			if len(fields) != 2 || !strings.HasPrefix(fields[1], "Q_") {
+				return o, fmt.Errorf("only absolute quality Q is supported")
+			}
+			q, err := strconv.Atoi(strings.TrimPrefix(fields[1], "Q_"))
+			if err != nil || q < 1 || q > 100 {
+				return o, fmt.Errorf("quality must be between 1 and 100")
+			}
+			o.quality = q
+		case "format":
+			if len(fields) != 2 {
+				return o, fmt.Errorf("invalid format parameter")
+			}
+			o.format = fields[1]
+			if o.format == "jpeg" {
+				o.format = "jpg"
+			}
+			if o.format != "jpg" && o.format != "png" && o.format != "webp" {
+				return o, fmt.Errorf("only JPEG, PNG, and WebP are supported")
+			}
+		default:
+			return o, fmt.Errorf("unsupported image processing operation")
+		}
+	}
+	// Bound both output axes, including format-only and single-dimension requests.
+	if o.width == 0 {
+		o.width = maxDimension
+	}
+	if o.height == 0 {
+		o.height = maxDimension
+	}
+	return o, nil
+}
+
+// path canonicalizes imgproxy operations so equivalent URLs share cached results.
+func (o options) path() string {
+	return fmt.Sprintf("/rs:fit:%d:%d:0:0/q:%d/f:%s", o.width, o.height, o.quality, o.format)
+}
diff --git a/weed/images/gateway/options_test.go b/weed/images/gateway/options_test.go
new file mode 100644
index 0000000000..d4a16a1bec
--- /dev/null
+++ b/weed/images/gateway/options_test.go
@@ -0,0 +1,121 @@
+package gateway
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// TestOptionsCoverage checks the supported OSS subset and rejected operations.
+func TestOptionsCoverage(t *testing.T) {
+	valid := []string{transform, "image/resize,w_240,h_640,m_lfit,limit_1/format,webp", "image/format,jpeg/quality,Q_100", "image/format,png", "image/resize,h_640"}
+	for _, value := range valid {
+		if _, err := parseOptions(value, 4096); err != nil {
+			t.Errorf("valid operation rejected %s: %v", value, err)
+		}
+	}
+	invalid := []string{"", "image", "image/", "image/resize", "image/resize,w_0", "image/resize,w_-1", "image/resize,w_4097", "image/resize,w_1,w_2", "image/resize,m_lfit", "image/resize,w_640,m_fill", "image/resize,w_1,limit_0", "image/quality,q_85", "image/quality,Q_0", "image/quality,Q_101", "image/quality,Q_85,Q_90", "image/format,svg", "image/format,webp/format,png", "image/watermark,x", "image/resize,w_1/resize,w_2", strings.Repeat("x", 257)}
+	for _, value := range invalid {
+		if _, err := parseOptions(value, 4096); err == nil {
+			t.Errorf("invalid operation accepted: %s", value)
+		}
+	}
+	a, _ := parseOptions(transform, 4096)
+	b, _ := parseOptions("image/format,webp/quality,Q_85/resize,w_640", 4096)
+	if a.path() != b.path() {
+		t.Fatal("equivalent operations were not canonicalized")
+	}
+}
+
+// TestByteLimitedCache checks byte eviction, replacement, disabled caching, and oversized entries.
+func TestByteLimitedCache(t *testing.T) {
+	c := newCache(400)
+	value := &result{data: make([]byte, 100)}
+	c.put("a", value)
+	c.put("b", value)
+	if c.get("a") != nil || c.get("b") == nil {
+		t.Fatal("cache did not evict by byte usage")
+	}
+	c.put("b", &result{data: []byte("updated")})
+	if c.get("b").data[0] != 'u' {
+		t.Fatal("cache replacement failed")
+	}
+	c.put("large", &result{data: make([]byte, 401)})
+	if c.get("large") != nil || c.used > c.capacity {
+		t.Fatal("oversized result exceeded cache capacity")
+	}
+	disabled := newCache(0)
+	disabled.put("a", value)
+	if disabled.get("a") != nil {
+		t.Fatal("cache disabling failed")
+	}
+	large := newCache(1 << 20)
+	for i := 0; i < 2048; i++ {
+		large.put(string(rune(i)), value)
+	}
+	if len(large.entries) != 1024 {
+		t.Fatal("small object entry count was not bounded")
+	}
+}
+
+// TestConfigurationRejectsUnsafeBackends checks explicitly configured backends without embedded credentials.
+func TestConfigurationRejectsUnsafeBackends(t *testing.T) {
+	base := Config{Source: "http://localhost:8333/bucket", Imgproxy: "http://localhost:8080", Concurrency: 1, MaxDimension: 4096, CacheBytes: 0, MaxSourceBytes: 1024, MaxResultBytes: 1024, Timeout: time.Second}
+	for _, source := range []string{"", "file:///etc/passwd", "http://secret:password@localhost", "http://localhost?signature=secret", "http://localhost#fragment"} {
+		c := base
+		c.Source = source
+		if _, err := New(c); err == nil {
+			t.Errorf("invalid backend accepted: %s", source)
+		}
+	}
+	for _, mutate := range []func(*Config){
+		func(c *Config) { c.Key = "zz"; c.Salt = "aa" }, func(c *Config) { c.Key = "aa" },
+		func(c *Config) { c.Concurrency = 0 }, func(c *Config) { c.CacheBytes = -1 },
+		func(c *Config) { c.MaxSourceBytes = 0 }, func(c *Config) { c.Timeout = 0 },
+	} {
+		c := base
+		mutate(&c)
+		if _, err := New(c); err == nil {
+			t.Fatal("invalid resource or signing configuration accepted")
+		}
+	}
+}
+
+// TestOutputBounds covers width-only, height-only, and format-only output limits.
+func TestOutputBounds(t *testing.T) {
+	for _, test := range []struct {
+		value         string
+		width, height int
+	}{
+		{"image/resize,w_640", 640, 4096},
+		{"image/resize,h_640", 4096, 640},
+		{"image/format,png", 4096, 4096},
+		{"image/resize,w_240,h_640", 240, 640},
+	} {
+		o, err := parseOptions(test.value, 4096)
+		if err != nil || o.width != test.width || o.height != test.height {
+			t.Fatalf("missing output axis bound for %s: %+v %v", test.value, o, err)
+		}
+	}
+}
+
+// TestProcessorRootURL rejects ambiguous path prefixes while allowing root URLs.
+func TestProcessorRootURL(t *testing.T) {
+	base := Config{Source: "http://localhost:8333/bucket", Concurrency: 1, MaxDimension: 4096, MaxSourceBytes: 1024, MaxResultBytes: 1024, Timeout: time.Second}
+	for _, address := range []string{"http://localhost:8080/imgproxy", "http://localhost:8080/prefix/", "http://localhost:8080/%2f"} {
+		c := base
+		c.Imgproxy = address
+		if _, err := New(c); err == nil {
+			t.Fatalf("prefixed imgproxy URL accepted: %s", address)
+		}
+	}
+	for _, address := range []string{"http://localhost:8080", "http://localhost:8080/"} {
+		c := base
+		c.Imgproxy = address
+		g, err := New(c)
+		if err != nil {
+			t.Fatalf("root imgproxy URL rejected: %s %v", address, err)
+		}
+		g.client.CloseIdleConnections()
+	}
+}
diff --git a/weed/kms/azure/azure_kms.go b/weed/kms/azure/azure_kms.go
index 490e09848a..667235f299 100644
--- a/weed/kms/azure/azure_kms.go
+++ b/weed/kms/azure/azure_kms.go
@@ -5,9 +5,12 @@ package azure
 import (
 	"context"
 	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"net/url"
 	"strings"
 	"time"
 
@@ -26,6 +29,93 @@ func init() {
 	seaweedkms.RegisterProvider("azure", NewAzureKMSProvider)
 }
 
+// vaultHost returns the host of a configured Key Vault URL, or "" when the URL
+// carries none. Hosts are compared case-insensitively, without a trailing dot,
+// and without an explicit :443, which names the same vault as no port.
+func vaultHost(vaultURL string) string {
+	parsed, err := url.Parse(vaultURL)
+	if err != nil {
+		return ""
+	}
+	host := strings.TrimSuffix(strings.ToLower(parsed.Host), ":443")
+	return strings.TrimSuffix(host, ".")
+}
+
+// splitKeyID turns a Key Vault key identifier into the (name, version) pair the
+// azkeys client expects. A plain key name, or anything that is not a URL, is
+// returned unchanged together with an empty version, which the client resolves
+// to the latest version.
+//
+// A URL naming a different vault than the one this provider is configured for
+// is rejected: the client addresses only its own vault, so dropping the host
+// would silently encrypt under this vault's same-named key. A URL for this
+// vault that does not name a key under /keys/ is rejected too: passing the URL
+// on as a key name would only surface as a confusing vault-side 404.
+func (p *AzureKMSProvider) splitKeyID(keyID string) (string, string, error) {
+	parsed, err := url.Parse(keyID)
+	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
+		return keyID, "", nil
+	}
+	if host := vaultHost(p.vaultURL); host != "" && vaultHost(keyID) != host {
+		return "", "", fmt.Errorf("key ID %q names vault %q, but this provider is configured for %q", keyID, parsed.Host, host)
+	}
+	parts := strings.Split(strings.Trim(parsed.Path, "/"), "/")
+	if len(parts) < 2 || parts[0] != "keys" || parts[1] == "" {
+		return "", "", fmt.Errorf("key ID %q is a Key Vault URL but does not name a key", keyID)
+	}
+	if len(parts) == 2 {
+		return parts[1], "", nil
+	}
+	if len(parts) == 3 {
+		return parts[1], parts[2], nil
+	}
+	return "", "", fmt.Errorf("key ID %q has too many path segments for a key URL", keyID)
+}
+
+// encodeCiphertext stores the wrapped data key in the JSON envelope as base64.
+// The envelope is JSON, so raw binary would be replaced by U+FFFD on the way in.
+func encodeCiphertext(ciphertext []byte) string {
+	return base64.StdEncoding.EncodeToString(ciphertext)
+}
+
+// contextDigest digests the encryption context for storage in the envelope.
+// RSA-OAEP takes no AAD, so the context is bound to the wrapped key by
+// recording its hash and checking it on decrypt instead. Unlike KMS-checked
+// AAD this is a client-side mismatch check only — it is not authenticated by
+// the vault, and an actor who can rewrite an object's envelope could swap in
+// a ciphertext and digest from another object.
+func contextDigest(context map[string]string) string {
+	encoded, _ := json.Marshal(context) // map keys marshal in sorted order
+	sum := sha256.Sum256(encoded)
+	return base64.StdEncoding.EncodeToString(sum[:])
+}
+
+// checkContext verifies the request's encryption context matches the context
+// recorded when the key was wrapped.
+func checkContext(envelope *seaweedkms.CiphertextEnvelope, context map[string]string) error {
+	recorded, _ := envelope.ProviderSpecific["encryption_context_sha256"].(string)
+	if recorded == "" {
+		if len(context) == 0 {
+			return nil
+		}
+	} else if recorded == contextDigest(context) {
+		return nil
+	}
+	return fmt.Errorf("encryption context does not match the wrapped key")
+}
+
+// decodeCiphertext reads back what encodeCiphertext wrote.
+func decodeCiphertext(ciphertext string) ([]byte, error) {
+	decoded, err := base64.StdEncoding.Strict().DecodeString(ciphertext)
+	if err != nil {
+		return nil, fmt.Errorf("wrapped data key is not valid base64: %w", err)
+	}
+	if len(decoded) == 0 {
+		return nil, fmt.Errorf("wrapped data key is empty")
+	}
+	return decoded, nil
+}
+
 // AzureKMSProvider implements the KMSProvider interface using Azure Key Vault
 type AzureKMSProvider struct {
 	client       *azkeys.Client
@@ -155,19 +245,23 @@ func (p *AzureKMSProvider) GenerateDataKey(ctx context.Context, req *seaweedkms.
 		Value:     dataKey,
 	}
 
-	// Add encryption context as Additional Authenticated Data (AAD) if provided
+	// RSA-OAEP takes no additional authenticated data: Key Vault rejects the
+	// request with BadParameter when AAD is set on an RSA-OAEP key. The
+	// context is bound to the wrapped key via a digest in the envelope
+	// instead, which Decrypt verifies.
+	var providerSpecific map[string]interface{}
 	if len(req.EncryptionContext) > 0 {
-		// Marshal encryption context to JSON for deterministic AAD
-		aadBytes, err := json.Marshal(req.EncryptionContext)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal encryption context: %w", err)
+		providerSpecific = map[string]interface{}{
+			"encryption_context_sha256": contextDigest(req.EncryptionContext),
 		}
-		encryptParams.AAD = aadBytes
-		glog.V(4).Infof("Azure KMS: Using encryption context as AAD for key %s", req.KeyID)
 	}
 
 	// Call Azure Key Vault to encrypt the data key
-	encryptResult, err := p.client.Encrypt(ctx, req.KeyID, "", encryptParams, nil)
+	keyName, keyVersion, err := p.splitKeyID(req.KeyID)
+	if err != nil {
+		return nil, err
+	}
+	encryptResult, err := p.client.Encrypt(ctx, keyName, keyVersion, encryptParams, nil)
 	if err != nil {
 		return nil, p.convertAzureError(err, req.KeyID)
 	}
@@ -179,7 +273,7 @@ func (p *AzureKMSProvider) GenerateDataKey(ctx context.Context, req *seaweedkms.
 	}
 
 	// Create standardized envelope format for consistent API behavior
-	envelopeBlob, err := seaweedkms.CreateEnvelope("azure", actualKeyID, string(encryptResult.Result), nil)
+	envelopeBlob, err := seaweedkms.CreateEnvelope("azure", actualKeyID, encodeCiphertext(encryptResult.Result), providerSpecific)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create ciphertext envelope: %w", err)
 	}
@@ -215,8 +309,11 @@ func (p *AzureKMSProvider) Decrypt(ctx context.Context, req *seaweedkms.DecryptR
 		return nil, fmt.Errorf("envelope missing key ID")
 	}
 
-	// Convert string back to bytes
-	ciphertext := []byte(envelope.Ciphertext)
+	// Convert the base64 envelope field back to the raw wrapped key
+	ciphertext, err := decodeCiphertext(envelope.Ciphertext)
+	if err != nil {
+		return nil, fmt.Errorf("invalid Azure ciphertext envelope: %w", err)
+	}
 
 	// Prepare decryption parameters
 	decryptAlgorithm := azkeys.JSONWebKeyEncryptionAlgorithmRSAOAEP256
@@ -225,20 +322,19 @@ func (p *AzureKMSProvider) Decrypt(ctx context.Context, req *seaweedkms.DecryptR
 		Value:     ciphertext,
 	}
 
-	// Add encryption context as Additional Authenticated Data (AAD) if provided
-	if len(req.EncryptionContext) > 0 {
-		// Marshal encryption context to JSON for deterministic AAD (must match encryption)
-		aadBytes, err := json.Marshal(req.EncryptionContext)
-		if err != nil {
-			return nil, fmt.Errorf("failed to marshal encryption context: %w", err)
-		}
-		decryptParams.AAD = aadBytes
-		glog.V(4).Infof("Azure KMS: Using encryption context as AAD for decryption of key %s", keyID)
+	// RSA-OAEP takes no AAD, so the encryption context is bound via a digest
+	// recorded in the envelope rather than authenticated by the vault.
+	if err := checkContext(envelope, req.EncryptionContext); err != nil {
+		return nil, err
 	}
 
 	// Call Azure Key Vault to decrypt the data key
 	glog.V(4).Infof("Azure KMS: Decrypting data key using key %s", keyID)
-	decryptResult, err := p.client.Decrypt(ctx, keyID, "", decryptParams, nil)
+	decryptName, decryptVersion, err := p.splitKeyID(keyID)
+	if err != nil {
+		return nil, err
+	}
+	decryptResult, err := p.client.Decrypt(ctx, decryptName, decryptVersion, decryptParams, nil)
 	if err != nil {
 		return nil, p.convertAzureError(err, keyID)
 	}
@@ -270,7 +366,11 @@ func (p *AzureKMSProvider) DescribeKey(ctx context.Context, req *seaweedkms.Desc
 
 	// Get key from Azure Key Vault
 	glog.V(4).Infof("Azure KMS: Describing key %s", req.KeyID)
-	result, err := p.client.GetKey(ctx, req.KeyID, "", nil)
+	describeName, describeVersion, err := p.splitKeyID(req.KeyID)
+	if err != nil {
+		return nil, err
+	}
+	result, err := p.client.GetKey(ctx, describeName, describeVersion, nil)
 	if err != nil {
 		return nil, p.convertAzureError(err, req.KeyID)
 	}
diff --git a/weed/kms/azure/azure_kms_test.go b/weed/kms/azure/azure_kms_test.go
new file mode 100644
index 0000000000..33b2fefeed
--- /dev/null
+++ b/weed/kms/azure/azure_kms_test.go
@@ -0,0 +1,363 @@
+//go:build azurekms
+
+package azure
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore"
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
+	"github.com/Azure/azure-sdk-for-go/sdk/keyvault/azkeys"
+
+	seaweedkms "github.com/seaweedfs/seaweedfs/weed/kms"
+)
+
+func TestSplitKeyID(t *testing.T) {
+	provider := &AzureKMSProvider{vaultURL: "https://myvault.vault.azure.net"}
+
+	tests := []struct {
+		name        string
+		keyID       string
+		wantName    string
+		wantVersion string
+		wantErr     bool
+	}{
+		{
+			name:     "plain key name",
+			keyID:    "my-key",
+			wantName: "my-key",
+		},
+		{
+			name:     "key url without version",
+			keyID:    "https://myvault.vault.azure.net/keys/my-key",
+			wantName: "my-key",
+		},
+		{
+			name:        "key url with version",
+			keyID:       "https://myvault.vault.azure.net/keys/my-key/abc123",
+			wantName:    "my-key",
+			wantVersion: "abc123",
+		},
+		{
+			name:     "key url with trailing slash",
+			keyID:    "https://myvault.vault.azure.net/keys/my-key/",
+			wantName: "my-key",
+		},
+		{
+			name:     "key url with a mixed case host",
+			keyID:    "https://MyVault.vault.azure.net/keys/my-key",
+			wantName: "my-key",
+		},
+		{
+			name:    "key url with a non keys path",
+			keyID:   "https://myvault.vault.azure.net/secrets/my-secret",
+			wantErr: true,
+		},
+		{
+			name:    "key url with extra path segments",
+			keyID:   "https://myvault.vault.azure.net/keys/my-key/abc123/extra",
+			wantErr: true,
+		},
+		{
+			name:    "key url with an empty key name",
+			keyID:   "https://myvault.vault.azure.net/keys//abc123",
+			wantErr: true,
+		},
+		{
+			name:     "name that only looks like a url",
+			keyID:    "my-key:abc123",
+			wantName: "my-key:abc123",
+		},
+		{
+			name:     "key url with explicit default port",
+			keyID:    "https://myvault.vault.azure.net:443/keys/my-key",
+			wantName: "my-key",
+		},
+		{
+			name:    "key url with non-default port",
+			keyID:   "https://myvault.vault.azure.net:8443/keys/my-key",
+			wantErr: true,
+		},
+		{
+			name:    "key url from another vault",
+			keyID:   "https://othervault.vault.azure.net/keys/my-key",
+			wantErr: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			name, version, err := provider.splitKeyID(test.keyID)
+			if test.wantErr {
+				if err == nil {
+					t.Fatalf("splitKeyID(%q) succeeded, want error", test.keyID)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("splitKeyID(%q): %v", test.keyID, err)
+			}
+			if name != test.wantName {
+				t.Fatalf("name = %q, want %q", name, test.wantName)
+			}
+			if version != test.wantVersion {
+				t.Fatalf("version = %q, want %q", version, test.wantVersion)
+			}
+		})
+	}
+}
+
+// The client addresses only the vault it was built for, so a key URL naming a
+// different vault must not resolve to this vault's same-named key.
+func TestSplitKeyIDExplicitDefaultPort(t *testing.T) {
+	provider := &AzureKMSProvider{vaultURL: "https://myvault.vault.azure.net:443"}
+	name, _, err := provider.splitKeyID("https://myvault.vault.azure.net/keys/my-key")
+	if err != nil || name != "my-key" {
+		t.Fatalf("splitKeyID = %q, %v; want my-key, nil", name, err)
+	}
+}
+
+func TestSplitKeyIDRejectsForeignVault(t *testing.T) {
+	provider := &AzureKMSProvider{vaultURL: "https://myvault.vault.azure.net/"}
+
+	if _, _, err := provider.splitKeyID("https://evil.vault.azure.net/keys/my-key/abc123"); err == nil {
+		t.Fatal("splitKeyID accepted a key URL from another vault")
+	}
+}
+
+// A trailing DNS dot names the same vault, so both sides of the comparison are
+// normalized the same way.
+func TestSplitKeyIDTrailingDot(t *testing.T) {
+	tests := []struct {
+		name     string
+		vaultURL string
+		keyID    string
+	}{
+		{
+			name:     "trailing dot on the key url",
+			vaultURL: "https://myvault.vault.azure.net",
+			keyID:    "https://myvault.vault.azure.net./keys/my-key/abc123",
+		},
+		{
+			name:     "trailing dot on the configured vault",
+			vaultURL: "https://myvault.vault.azure.net./",
+			keyID:    "https://myvault.vault.azure.net/keys/my-key/abc123",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			provider := &AzureKMSProvider{vaultURL: tt.vaultURL}
+			name, version, err := provider.splitKeyID(tt.keyID)
+			if err != nil || name != "my-key" || version != "abc123" {
+				t.Fatalf("splitKeyID = %q, %q, %v; want my-key, abc123, nil", name, version, err)
+			}
+		})
+	}
+}
+
+// The envelope is JSON, so a raw binary wrapped key would be replaced by
+// U+FFFD on the way in and could never be decrypted.
+func TestCiphertextEnvelopeRoundTrip(t *testing.T) {
+	wrapped := make([]byte, 256)
+	if _, err := rand.Read(wrapped); err != nil {
+		t.Fatalf("generate wrapped key: %v", err)
+	}
+
+	keyID := "https://myvault.vault.azure.net/keys/my-key/abc123"
+	envelopeBlob, err := seaweedkms.CreateEnvelope("azure", keyID, encodeCiphertext(wrapped), nil)
+	if err != nil {
+		t.Fatalf("create envelope: %v", err)
+	}
+
+	envelope, err := seaweedkms.ParseEnvelope(envelopeBlob)
+	if err != nil {
+		t.Fatalf("parse envelope: %v", err)
+	}
+	if envelope.KeyID != keyID {
+		t.Fatalf("key id = %q, want %q", envelope.KeyID, keyID)
+	}
+
+	decoded, err := decodeCiphertext(envelope.Ciphertext)
+	if err != nil {
+		t.Fatalf("decode ciphertext: %v", err)
+	}
+	if !bytes.Equal(decoded, wrapped) {
+		t.Fatal("decoded wrapped key differs from the encrypted one")
+	}
+}
+
+func TestDecodeCiphertextRejectsInvalidInput(t *testing.T) {
+	for _, ciphertext := range []string{"", "not base64!!", "a"} {
+		if _, err := decodeCiphertext(ciphertext); err == nil {
+			t.Fatalf("decodeCiphertext(%q) succeeded, want error", ciphertext)
+		}
+	}
+}
+
+// RSA-OAEP cannot authenticate the encryption context, so the context is
+// bound to the wrapped key via a digest in the envelope.
+func TestEncryptionContextBinding(t *testing.T) {
+	context := map[string]string{"aws:s3:bucket": "bucket", "aws:s3:object": "key"}
+	envelopeBlob, err := seaweedkms.CreateEnvelope("azure", "my-key", "d3JhcHBlZA==", map[string]interface{}{
+		"encryption_context_sha256": contextDigest(context),
+	})
+	if err != nil {
+		t.Fatalf("create envelope: %v", err)
+	}
+	envelope, err := seaweedkms.ParseEnvelope(envelopeBlob)
+	if err != nil {
+		t.Fatalf("parse envelope: %v", err)
+	}
+
+	if err := checkContext(envelope, context); err != nil {
+		t.Fatalf("matching context rejected: %v", err)
+	}
+	if err := checkContext(envelope, map[string]string{"aws:s3:object": "other"}); err == nil {
+		t.Fatal("mismatched context accepted")
+	}
+	if err := checkContext(envelope, nil); err == nil {
+		t.Fatal("missing context accepted for a context-bound key")
+	}
+}
+
+type fakeCredential struct{}
+
+func (fakeCredential) GetToken(_ context.Context, _ policy.TokenRequestOptions) (azcore.AccessToken, error) {
+	return azcore.AccessToken{Token: "token", ExpiresOn: time.Now().Add(time.Hour)}, nil
+}
+
+type fakeTransport struct {
+	do func(*http.Request) (*http.Response, error)
+}
+
+func (t fakeTransport) Do(req *http.Request) (*http.Response, error) {
+	return t.do(req)
+}
+
+func jsonResponse(status int, body string) *http.Response {
+	return &http.Response{
+		StatusCode: status,
+		Header:     http.Header{"Content-Type": []string{"application/json"}},
+		Body:       io.NopCloser(strings.NewReader(body)),
+	}
+}
+
+// Drive GenerateDataKey and Decrypt through a fake Key Vault transport so the
+// whole path — key ID split, request body shape, envelope encoding — is
+// exercised, not just the helpers.
+func TestGenerateDataKeyDecryptRoundTrip(t *testing.T) {
+	vaultURL := "https://myvault.vault.azure.net"
+	var wrapped []byte
+	var sawAAD bool
+
+	client, err := azkeys.NewClient(vaultURL, fakeCredential{}, &azkeys.ClientOptions{
+		ClientOptions: azcore.ClientOptions{
+			Transport: fakeTransport{do: func(req *http.Request) (*http.Response, error) {
+				if req.Header.Get("Authorization") == "" {
+					// Key Vault answers an unauthenticated request with the
+					// challenge the client then satisfies.
+					resp := jsonResponse(401, `{"error":{"code":"Unauthorized"}}`)
+					resp.Header.Set("WWW-Authenticate", `Bearer authorization="https://login.windows.net/tenant", resource="https://vault.azure.net"`)
+					return resp, nil
+				}
+				var body []byte
+				if rc, err := req.GetBody(); err == nil {
+					body, _ = io.ReadAll(rc)
+					rc.Close()
+				} else if req.Body != nil {
+					body, _ = io.ReadAll(req.Body)
+				}
+				sawAAD = bytes.Contains(body, []byte(`"aad"`))
+				var params struct {
+					Value string `json:"value"`
+				}
+				if err := json.Unmarshal(body, &params); err != nil {
+					return nil, err
+				}
+				value, err := base64.RawURLEncoding.DecodeString(params.Value)
+				if err != nil {
+					return nil, err
+				}
+				switch {
+				case strings.HasSuffix(req.URL.Path, "/encrypt"):
+					wrapped = value
+					return jsonResponse(200, `{"kid":"`+vaultURL+`/keys/my-key/abc123","value":"`+base64.RawURLEncoding.EncodeToString(wrapped)+`"}`), nil
+				case strings.HasSuffix(req.URL.Path, "/decrypt"):
+					if !bytes.Equal(value, wrapped) {
+						return jsonResponse(400, `{"error":{"code":"BadParameter"}}`), nil
+					}
+					return jsonResponse(200, `{"kid":"`+vaultURL+`/keys/my-key/abc123","value":"`+params.Value+`"}`), nil
+				default:
+					return jsonResponse(404, `{"error":{"code":"NotFound"}}`), nil
+				}
+			}},
+		},
+	})
+	if err != nil {
+		t.Fatalf("new client: %v", err)
+	}
+
+	provider := &AzureKMSProvider{client: client, vaultURL: vaultURL}
+	contextMap := map[string]string{"aws:s3:bucket": "bucket"}
+
+	resp, err := provider.GenerateDataKey(context.Background(), &seaweedkms.GenerateDataKeyRequest{
+		KeyID:             vaultURL + "/keys/my-key",
+		KeySpec:           seaweedkms.KeySpecAES256,
+		EncryptionContext: contextMap,
+	})
+	if err != nil {
+		t.Fatalf("GenerateDataKey: %v", err)
+	}
+	if sawAAD {
+		t.Fatal("encrypt request carried AAD")
+	}
+
+	decrypted, err := provider.Decrypt(context.Background(), &seaweedkms.DecryptRequest{
+		CiphertextBlob:    resp.CiphertextBlob,
+		EncryptionContext: contextMap,
+	})
+	if err != nil {
+		t.Fatalf("Decrypt: %v", err)
+	}
+	if !bytes.Equal(decrypted.Plaintext, resp.Plaintext) {
+		t.Fatal("decrypted key differs from generated key")
+	}
+
+	if _, err := provider.Decrypt(context.Background(), &seaweedkms.DecryptRequest{
+		CiphertextBlob:    resp.CiphertextBlob,
+		EncryptionContext: map[string]string{"aws:s3:bucket": "other"},
+	}); err == nil {
+		t.Fatal("Decrypt succeeded with a different encryption context")
+	}
+}
+
+func TestCheckContextEmpty(t *testing.T) {
+	// Keys wrapped without a context carry no digest; decrypting them with
+	// no context must succeed, and with a context must fail.
+	blob, err := seaweedkms.CreateEnvelope("azure", "my-key", "d3JhcHBlZA==", nil)
+	if err != nil {
+		t.Fatalf("create envelope: %v", err)
+	}
+	envelope, err := seaweedkms.ParseEnvelope(blob)
+	if err != nil {
+		t.Fatalf("parse envelope: %v", err)
+	}
+	for _, context := range []map[string]string{nil, {}} {
+		if err := checkContext(envelope, context); err != nil {
+			t.Fatalf("empty context rejected for an unbound key: %v", err)
+		}
+	}
+	if err := checkContext(envelope, map[string]string{"k": "v"}); err == nil {
+		t.Fatal("context accepted for an unbound key")
+	}
+}
diff --git a/weed/mount/dir_sink.go b/weed/mount/dir_sink.go
index 1299e4f351..de73f7dd70 100644
--- a/weed/mount/dir_sink.go
+++ b/weed/mount/dir_sink.go
@@ -1,6 +1,8 @@
 package mount
 
 import (
+	"context"
+
 	"github.com/seaweedfs/go-fuse/v2/fuse"
 )
 
@@ -39,5 +41,5 @@ func (l fuseDirEntryList) TakesLookupRef() bool { return true }
 // ReadDirectoryInto runs a readdir against sink. ReadDir and ReadDirPlus are
 // this with the kernel reply buffer as the sink.
 func (wfs *WFS) ReadDirectoryInto(input *fuse.ReadIn, sink DirEntrySink, isPlusMode bool) fuse.Status {
-	return wfs.doReadDirectory(input, sink, isPlusMode)
+	return wfs.doReadDirectory(context.Background(), input, sink, isPlusMode)
 }
diff --git a/weed/mount/dirty_pages_chunked.go b/weed/mount/dirty_pages_chunked.go
index 29ff24b3e2..469eb170b8 100644
--- a/weed/mount/dirty_pages_chunked.go
+++ b/weed/mount/dirty_pages_chunked.go
@@ -55,6 +55,10 @@ func (pages *ChunkedDirtyPages) AddPage(offset int64, data []byte, isSequential
 	return err
 }
 
+func (pages *ChunkedDirtyPages) HasWrites() bool {
+	return pages.hasWrites
+}
+
 func (pages *ChunkedDirtyPages) FlushData() error {
 	if !pages.hasWrites {
 		return nil
diff --git a/weed/mount/filehandle.go b/weed/mount/filehandle.go
index 5b956aeb75..d40d7c035a 100644
--- a/weed/mount/filehandle.go
+++ b/weed/mount/filehandle.go
@@ -40,7 +40,11 @@ type FileHandle struct {
 	savedName         string // last known file name if inode-to-path state is forgotten
 
 	isDeleted bool
-	isRenamed bool // set by Rename before waiting for async flush; skips old-path metadata flush
+	// deleteEpoch counts the times isDeleted was raised, all of them under the
+	// handle's flush lock. A caller that raised it and then found it had
+	// nothing to delete after all can tell its own mark from a later one.
+	deleteEpoch uint64
+	isRenamed   bool // set by Rename before waiting for async flush; skips old-path metadata flush
 
 	// entryVersionTsNs is the filer log position the handle's entry reflects.
 	// State at or below it must not replace the entry — that rolls it back.
@@ -67,11 +71,6 @@ type FileHandle struct {
 	// only the handle's shared lock and so races a second concurrent read.
 	remoteInstallMu sync.Mutex
 
-	// RDMA chunk offset cache for performance optimization
-	chunkOffsetCache []int64
-	chunkCacheValid  bool
-	chunkCacheLock   sync.RWMutex
-
 	// for debugging
 	mirrorFile *os.File
 }
@@ -129,8 +128,11 @@ func (fh *FileHandle) SetEntry(entry *filer_pb.Entry) {
 	if entry != nil {
 		fileSize := filer.FileSize(entry)
 		entry.Attributes.FileSize = fileSize
+		if fh.entryChunkGroup != nil {
+			_ = fh.entryChunkGroup.Close()
+		}
 		var resolveManifestErr error
-		fh.entryChunkGroup, resolveManifestErr = filer.NewChunkGroup(fh.wfs.LookupFn(), fh.wfs.chunkCache, entry.Chunks, fh.wfs.option.ConcurrentReaders)
+		fh.entryChunkGroup, resolveManifestErr = filer.NewChunkGroup(fh.wfs.LookupFn(), fh.wfs.chunkCache, entry.Chunks, fh.wfs.option.ConcurrentReaders, fh.wfs.CacheInvalidator(), fh.wfs.manifestCache, fh.wfs.readerCacheBudget)
 		if resolveManifestErr != nil {
 			glog.Warningf("failed to resolve manifest chunks in %+v", entry)
 		}
@@ -138,9 +140,6 @@ func (fh *FileHandle) SetEntry(entry *filer_pb.Entry) {
 		glog.Fatalf("setting file handle entry to nil")
 	}
 	fh.entry.SetEntry(entry)
-
-	// Invalidate chunk offset cache since chunks may have changed
-	fh.invalidateChunkCache()
 }
 
 // installAckedEntry installs filer-acknowledged state under the handle lock
@@ -204,20 +203,17 @@ func (fh *FileHandle) ResetDirtyPages() {
 func (fh *FileHandle) UpdateEntry(fn func(entry *filer_pb.Entry)) *filer_pb.Entry {
 	result := fh.entry.UpdateEntry(fn)
 
-	// Invalidate chunk offset cache since entry may have been modified
-	fh.invalidateChunkCache()
-
 	return result
 }
 
 func (fh *FileHandle) AddChunks(chunks []*filer_pb.FileChunk) {
 	fh.entry.AppendChunks(chunks)
-
-	// Invalidate chunk offset cache since new chunks were added
-	fh.invalidateChunkCache()
 }
 
 func (fh *FileHandle) ReleaseHandle() {
+	fhActiveLock := fh.wfs.fhLockTable.AcquireLock("ReleaseHandle", fh.fh, util.ExclusiveLock)
+	defer fh.wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
+
 	// Release distributed lock before cleaning up, so other mounts can
 	// proceed as soon as this handle is done flushing.
 	if fh.dlmLock != nil {
@@ -226,56 +222,11 @@ func (fh *FileHandle) ReleaseHandle() {
 		glog.V(1).Infof("DLM lock released for inode %d", fh.inode)
 	}
 
-	fhActiveLock := fh.wfs.fhLockTable.AcquireLock("ReleaseHandle", fh.fh, util.ExclusiveLock)
-	defer fh.wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
-
+	if fh.entryChunkGroup != nil {
+		_ = fh.entryChunkGroup.Close()
+	}
 	fh.dirtyPages.Destroy()
 	if IsDebugFileReadWrite {
 		fh.mirrorFile.Close()
 	}
 }
-
-// getCumulativeOffsets returns cached cumulative offsets for chunks, computing them if necessary
-func (fh *FileHandle) getCumulativeOffsets(chunks []*filer_pb.FileChunk) []int64 {
-	fh.chunkCacheLock.RLock()
-	if fh.chunkCacheValid && len(fh.chunkOffsetCache) == len(chunks)+1 {
-		// Cache is valid and matches current chunk count
-		result := make([]int64, len(fh.chunkOffsetCache))
-		copy(result, fh.chunkOffsetCache)
-		fh.chunkCacheLock.RUnlock()
-		return result
-	}
-	fh.chunkCacheLock.RUnlock()
-
-	// Need to compute/recompute cache
-	fh.chunkCacheLock.Lock()
-	defer fh.chunkCacheLock.Unlock()
-
-	// Double-check in case another goroutine computed it while we waited for the lock
-	if fh.chunkCacheValid && len(fh.chunkOffsetCache) == len(chunks)+1 {
-		result := make([]int64, len(fh.chunkOffsetCache))
-		copy(result, fh.chunkOffsetCache)
-		return result
-	}
-
-	// Compute cumulative offsets
-	cumulativeOffsets := make([]int64, len(chunks)+1)
-	for i, chunk := range chunks {
-		cumulativeOffsets[i+1] = cumulativeOffsets[i] + int64(chunk.Size)
-	}
-
-	// Cache the result
-	fh.chunkOffsetCache = make([]int64, len(cumulativeOffsets))
-	copy(fh.chunkOffsetCache, cumulativeOffsets)
-	fh.chunkCacheValid = true
-
-	return cumulativeOffsets
-}
-
-// invalidateChunkCache invalidates the chunk offset cache when chunks are modified
-func (fh *FileHandle) invalidateChunkCache() {
-	fh.chunkCacheLock.Lock()
-	fh.chunkCacheValid = false
-	fh.chunkOffsetCache = nil
-	fh.chunkCacheLock.Unlock()
-}
diff --git a/weed/mount/filehandle_read.go b/weed/mount/filehandle_read.go
index b804dab224..862a6e63de 100644
--- a/weed/mount/filehandle_read.go
+++ b/weed/mount/filehandle_read.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"sort"
 
 	"google.golang.org/protobuf/proto"
 
@@ -44,7 +43,7 @@ func (fh *FileHandle) readFromChunksWithContext(ctx context.Context, buff []byte
 	entry.RUnlock()
 	if remoteOnly {
 		glog.V(4).Infof("download remote entry %s", fileFullPath)
-		err := fh.downloadRemoteEntry(entry)
+		err := fh.downloadRemoteEntry(ctx, entry)
 		if err != nil {
 			glog.V(1).Infof("download remote entry %s: %v", fileFullPath, err)
 			return 0, 0, err
@@ -83,16 +82,6 @@ func (fh *FileHandle) readFromChunksWithContext(ctx context.Context, buff []byte
 		return int64(totalRead), 0, nil
 	}
 
-	// Try RDMA acceleration first if available
-	if fh.wfs.rdmaClient != nil && fh.wfs.option.RdmaEnabled {
-		totalRead, ts, err := fh.tryRDMARead(ctx, fileSize, buff, offset, chunks)
-		if err == nil {
-			glog.V(4).Infof("RDMA read successful for %s [%d,%d] %d", fileFullPath, offset, offset+int64(totalRead), totalRead)
-			return int64(totalRead), ts, nil
-		}
-		glog.V(4).Infof("RDMA read failed for %s, falling back to HTTP: %v", fileFullPath, err)
-	}
-
 	// Peer chunk sharing: try a peer mount's cache before the volume tier.
 	// Any failure falls through transparently. See design-weed-mount-
 	// peer-chunk-sharing.md §4.3.
@@ -122,67 +111,15 @@ func (fh *FileHandle) readFromChunksWithContext(ctx context.Context, buff []byte
 	return int64(totalRead), ts, err
 }
 
-// tryRDMARead attempts to read file data using RDMA acceleration. chunks is a
-// snapshot captured under the LockedEntry lock by the caller.
-func (fh *FileHandle) tryRDMARead(ctx context.Context, fileSize int64, buff []byte, offset int64, chunks []*filer_pb.FileChunk) (int64, int64, error) {
-	// For now, we'll try to read the chunks directly using RDMA
-	// This is a simplified approach - in a full implementation, we'd need to
-	// handle chunk boundaries, multiple chunks, etc.
-
-	if len(chunks) == 0 {
-		return 0, 0, fmt.Errorf("no chunks available for RDMA read")
-	}
-
-	// Find the chunk that contains our offset using binary search
-	var targetChunk *filer_pb.FileChunk
-	var chunkOffset int64
-
-	// Get cached cumulative offsets for efficient binary search
-	cumulativeOffsets := fh.getCumulativeOffsets(chunks)
-
-	// Use binary search to find the chunk containing the offset
-	chunkIndex := sort.Search(len(chunks), func(i int) bool {
-		return offset < cumulativeOffsets[i+1]
-	})
-
-	// Verify the chunk actually contains our offset
-	if chunkIndex < len(chunks) && offset >= cumulativeOffsets[chunkIndex] {
-		targetChunk = chunks[chunkIndex]
-		chunkOffset = offset - cumulativeOffsets[chunkIndex]
-	}
-
-	if targetChunk == nil {
-		return 0, 0, fmt.Errorf("no chunk found for offset %d", offset)
-	}
-
-	// Calculate how much to read from this chunk
-	remainingInChunk := int64(targetChunk.Size) - chunkOffset
-	readSize := min(int64(len(buff)), remainingInChunk)
-
-	glog.V(4).Infof("RDMA read attempt: chunk=%s (fileId=%s), chunkOffset=%d, readSize=%d",
-		targetChunk.FileId, targetChunk.FileId, chunkOffset, readSize)
-
-	// Try RDMA read using file ID directly (more efficient)
-	data, isRDMA, err := fh.wfs.rdmaClient.ReadNeedle(ctx, targetChunk.FileId, uint64(chunkOffset), uint64(readSize))
-	if err != nil {
-		return 0, 0, fmt.Errorf("RDMA read failed: %w", err)
-	}
-
-	if !isRDMA {
-		return 0, 0, fmt.Errorf("RDMA not available for chunk")
-	}
-
-	// Copy data to buffer
-	copied := copy(buff, data)
-	return int64(copied), targetChunk.ModifiedTsNs, nil
-}
-
-func (fh *FileHandle) downloadRemoteEntry(entry *LockedEntry) error {
+func (fh *FileHandle) downloadRemoteEntry(ctx context.Context, entry *LockedEntry) error {
 
 	fileFullPath := fh.FullPath()
 	dir, _ := fileFullPath.DirAndName()
 
-	err := fh.wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	// callWait 0: this RPC streams a whole remote object filer-side, so a
+	// healthy download can legitimately outlast any metadata-call bound. The
+	// attempt stays bound to the caller's context instead.
+	err := fh.wfs.withFilerClient(ctx, false, 0, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 
 		request := &filer_pb.CacheRemoteObjectToLocalClusterRequest{
 			Directory: string(dir),
@@ -190,7 +127,7 @@ func (fh *FileHandle) downloadRemoteEntry(entry *LockedEntry) error {
 		}
 
 		glog.V(4).Infof("download entry: %v", request)
-		resp, err := client.CacheRemoteObjectToLocalCluster(context.Background(), request)
+		resp, err := client.CacheRemoteObjectToLocalCluster(ctx, request)
 		if err != nil {
 			return fmt.Errorf("CacheRemoteObjectToLocalCluster file %s: %v", fileFullPath, err)
 		}
diff --git a/weed/mount/filer_conf.go b/weed/mount/filer_conf.go
index fde7dc2150..c35bdde244 100644
--- a/weed/mount/filer_conf.go
+++ b/weed/mount/filer_conf.go
@@ -20,8 +20,8 @@ func (wfs *WFS) subscribeFilerConfEvents() (*meta_cache.MetadataFollower, error)
 	confFullName := filepath.Join(filer.DirectoryEtcSeaweedFS, filer.FilerConfName)
 
 	// read current conf
-	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		content, err := filer.ReadInsideFiler(context.Background(), client, confDir, confName)
+	err := wfs.withFilerClient(context.Background(), false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
+		content, err := filer.ReadInsideFiler(ctx, client, confDir, confName)
 		if err != nil {
 			return err
 		}
diff --git a/weed/mount/inode_to_path.go b/weed/mount/inode_to_path.go
index 295b1a804c..6a837872c4 100644
--- a/weed/mount/inode_to_path.go
+++ b/weed/mount/inode_to_path.go
@@ -18,54 +18,113 @@ type InodeToPath struct {
 	// dirStates holds directory-only readdir-cache state, keyed by inode. An
 	// inode is a directory iff it has an entry here, registered at creation.
 	dirStates map[uint64]*dirState
+	// dirPaths indexes the same states by path, so a directory lookup never
+	// goes through the map that holds one full path per inode.
+	dirPaths map[util.FullPath]*dirState
 }
 
 // InodeEntry exists per inode the kernel references. Directory cache state is
 // kept out in dirStates so a file entry stays in the 32-byte size class — the
-// dominant cost on a mount with millions of files.
+// dominant cost on a mount with millions of files. A hard link's extra paths
+// hang off a pointer for the same reason.
 type InodeEntry struct {
-	paths   []util.FullPath
-	nlookup uint64
+	path       util.FullPath
+	nlookup    uint64
+	extraPaths *[]util.FullPath
 }
 
 type dirState struct {
-	isChildrenCached  bool
-	readDirDirect     bool
-	cachedExpiresTime time.Time
-	lastAccess        time.Time
-	lastRefresh       time.Time
-	updateWindowStart time.Time
-	updateCount       int
-	subdirCount       int32 // tracked in-memory for POSIX directory nlink
+	path               util.FullPath
+	isChildrenCached   bool
+	readDirDirect      bool
+	cachedExpiresTime  time.Time
+	lastAccess         time.Time
+	lastRefresh        time.Time
+	lastRebuildAttempt time.Time
+	subdirCount        int32 // tracked in-memory for POSIX directory nlink
 }
 
 func (d *dirState) resetCacheState() {
 	d.isChildrenCached = false
 	d.readDirDirect = false
 	d.cachedExpiresTime = time.Time{}
-	d.updateCount = 0
-	d.updateWindowStart = time.Time{}
+	d.lastRebuildAttempt = time.Time{}
 }
 
-func (ie *InodeEntry) removeOnePath(p util.FullPath) bool {
-	if len(ie.paths) == 0 {
-		return false
+// appendPaths appends every path the inode is reachable by, primary first.
+func (ie *InodeEntry) appendPaths(dst []util.FullPath) []util.FullPath {
+	if ie.path == "" {
+		return dst
 	}
-	idx := -1
-	for i, x := range ie.paths {
-		if x == p {
-			idx = i
-			break
+	dst = append(dst, ie.path)
+	if ie.extraPaths != nil {
+		dst = append(dst, *ie.extraPaths...)
+	}
+	return dst
+}
+
+func (ie *InodeEntry) addPath(p util.FullPath) {
+	if ie.path == "" {
+		ie.path = p
+		return
+	}
+	if ie.extraPaths == nil {
+		ie.extraPaths = &[]util.FullPath{p}
+		return
+	}
+	*ie.extraPaths = append(*ie.extraPaths, p)
+}
+
+func (ie *InodeEntry) replacePath(from, to util.FullPath) {
+	if ie.path == from {
+		ie.path = to
+	}
+	if ie.extraPaths == nil {
+		return
+	}
+	for i, p := range *ie.extraPaths {
+		if p == from {
+			(*ie.extraPaths)[i] = to
 		}
 	}
-	if idx < 0 {
+}
+
+func (ie *InodeEntry) setExtraPaths(extra []util.FullPath) {
+	if len(extra) == 0 {
+		ie.extraPaths = nil
+		return
+	}
+	ie.extraPaths = &extra
+}
+
+// removeOnePath promotes an extra path when the primary is the one going away,
+// so an entry that still has a path always has a primary one.
+func (ie *InodeEntry) removeOnePath(p util.FullPath) bool {
+	if ie.path == "" {
 		return false
 	}
-	for x := idx; x < len(ie.paths)-1; x++ {
-		ie.paths[x] = ie.paths[x+1]
+	if ie.path == p {
+		if ie.extraPaths == nil {
+			ie.path = ""
+			return true
+		}
+		extra := *ie.extraPaths
+		ie.path = extra[0]
+		ie.setExtraPaths(extra[1:])
+		return true
 	}
-	ie.paths = ie.paths[0 : len(ie.paths)-1]
-	return true
+	if ie.extraPaths == nil {
+		return false
+	}
+	extra := *ie.extraPaths
+	for i, x := range extra {
+		if x != p {
+			continue
+		}
+		ie.setExtraPaths(append(extra[:i], extra[i+1:]...))
+		return true
+	}
+	return false
 }
 
 func NewInodeToPath(root util.FullPath, ttlSec int) *InodeToPath {
@@ -73,13 +132,14 @@ func NewInodeToPath(root util.FullPath, ttlSec int) *InodeToPath {
 		inode2path:      make(map[uint64]*InodeEntry),
 		path2inode:      make(map[util.FullPath]uint64),
 		dirStates:       make(map[uint64]*dirState),
+		dirPaths:        make(map[util.FullPath]*dirState),
 		cacheMetaTtlSec: time.Second * time.Duration(ttlSec),
 	}
 	t.inode2path[1] = &InodeEntry{
-		paths:   []util.FullPath{root},
+		path:    root,
 		nlookup: 1,
 	}
-	t.dirStates[1] = &dirState{lastAccess: time.Now()}
+	t.setDirState(1, &dirState{path: root, lastAccess: time.Now()})
 	t.path2inode[root] = 1
 
 	return t
@@ -126,11 +186,11 @@ func (i *InodeToPath) Lookup(path util.FullPath, unixTime int64, isDirectory boo
 			nlookup = 1
 		}
 		i.inode2path[inode] = &InodeEntry{
-			paths:   []util.FullPath{path},
+			path:    path,
 			nlookup: nlookup,
 		}
 		if isDirectory {
-			i.dirStates[inode] = &dirState{}
+			i.setDirState(inode, &dirState{path: path})
 		}
 	}
 
@@ -197,10 +257,10 @@ func (i *InodeToPath) GetPath(inode uint64) (util.FullPath, fuse.Status) {
 	i.RLock()
 	defer i.RUnlock()
 	path, found := i.inode2path[inode]
-	if !found || len(path.paths) == 0 {
+	if !found || path.path == "" {
 		return "", fuse.ENOENT
 	}
-	return path.paths[0], fuse.OK
+	return path.path, fuse.OK
 }
 
 // GetAllPaths returns a copy of all paths associated with an inode. For a
@@ -210,12 +270,29 @@ func (i *InodeToPath) GetAllPaths(inode uint64) []util.FullPath {
 	i.RLock()
 	defer i.RUnlock()
 	ie, found := i.inode2path[inode]
-	if !found || len(ie.paths) == 0 {
+	if !found {
 		return nil
 	}
-	out := make([]util.FullPath, len(ie.paths))
-	copy(out, ie.paths)
-	return out
+	return ie.appendPaths(nil)
+}
+
+func (i *InodeToPath) setDirState(inode uint64, d *dirState) {
+	i.dirStates[inode] = d
+	i.dirPaths[d.path] = d
+}
+
+// dropDirPath drops the path index only; Forget releases the state itself. A
+// released directory's state keeps the path it had, so drop the index only
+// while it is still the one that path resolves to: a new directory may have
+// taken the name in the meantime.
+func (i *InodeToPath) dropDirPath(inode uint64) {
+	if d := i.dirStates[inode]; d != nil && i.dirPaths[d.path] == d {
+		delete(i.dirPaths, d.path)
+	}
+}
+
+func (i *InodeToPath) dirStateOf(fullpath util.FullPath) *dirState {
+	return i.dirPaths[fullpath]
 }
 
 func (i *InodeToPath) HasPath(path util.FullPath) bool {
@@ -228,16 +305,11 @@ func (i *InodeToPath) HasPath(path util.FullPath) bool {
 func (i *InodeToPath) MarkChildrenCached(fullpath util.FullPath) {
 	i.Lock()
 	defer i.Unlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
+	d := i.dirStateOf(fullpath)
+	if d == nil {
 		// https://github.com/seaweedfs/seaweedfs/issues/4968
 		// glog.Fatalf("MarkChildrenCached not found inode %v", fullpath)
-		glog.Warningf("MarkChildrenCached not found inode %v", fullpath)
-		return
-	}
-	d, found := i.dirStates[inode]
-	if !found {
-		glog.Warningf("MarkChildrenCached inode %d not a tracked directory for %v", inode, fullpath)
+		glog.Warningf("MarkChildrenCached not a tracked directory: %v", fullpath)
 		return
 	}
 	d.isChildrenCached = true
@@ -245,8 +317,7 @@ func (i *InodeToPath) MarkChildrenCached(fullpath util.FullPath) {
 	now := time.Now()
 	d.lastAccess = now
 	d.lastRefresh = now
-	d.updateCount = 0
-	d.updateWindowStart = time.Time{}
+	d.lastRebuildAttempt = time.Time{}
 	if i.cacheMetaTtlSec > 0 {
 		d.cachedExpiresTime = now.Add(i.cacheMetaTtlSec)
 	}
@@ -255,11 +326,7 @@ func (i *InodeToPath) MarkChildrenCached(fullpath util.FullPath) {
 func (i *InodeToPath) IsChildrenCached(fullpath util.FullPath) bool {
 	i.RLock()
 	defer i.RUnlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
-		return false
-	}
-	d := i.dirStates[inode]
+	d := i.dirStateOf(fullpath)
 	if d == nil {
 		return false
 	}
@@ -269,6 +336,34 @@ func (i *InodeToPath) IsChildrenCached(fullpath util.FullPath) bool {
 	return false
 }
 
+// ShouldRebuildExpiredDir reports whether a directory was fully cached, its
+// TTL has elapsed, and enough time has passed since the last failed rebuild
+// attempt to retry. Distinct from IsChildrenCached returning false for a
+// never-cached, invalidated, evicted, or read-through directory: those leave
+// isChildrenCached clear, while a plain TTL expiry keeps it set.
+func (i *InodeToPath) ShouldRebuildExpiredDir(fullpath util.FullPath, cooldown time.Duration) bool {
+	i.RLock()
+	defer i.RUnlock()
+	d := i.dirStateOf(fullpath)
+	if d == nil || !d.isChildrenCached {
+		return false
+	}
+	if d.cachedExpiresTime.IsZero() || time.Now().Before(d.cachedExpiresTime) {
+		return false
+	}
+	return d.lastRebuildAttempt.IsZero() || time.Since(d.lastRebuildAttempt) >= cooldown
+}
+
+// MarkRebuildAttempt records that a rebuild was attempted at now, so
+// ShouldRebuildExpiredDir backs off for the cooldown before retrying.
+func (i *InodeToPath) MarkRebuildAttempt(fullpath util.FullPath, now time.Time) {
+	i.Lock()
+	defer i.Unlock()
+	if d := i.dirStateOf(fullpath); d != nil {
+		d.lastRebuildAttempt = now
+	}
+}
+
 func (i *InodeToPath) HasInode(inode uint64) bool {
 	if inode == 1 {
 		return true
@@ -292,11 +387,7 @@ func (i *InodeToPath) InvalidateAllChildrenCache() {
 func (i *InodeToPath) InvalidateChildrenCache(fullpath util.FullPath) {
 	i.Lock()
 	defer i.Unlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
-		return
-	}
-	if d := i.dirStates[inode]; d != nil {
+	if d := i.dirStateOf(fullpath); d != nil {
 		d.resetCacheState()
 	}
 }
@@ -306,11 +397,7 @@ func (i *InodeToPath) InvalidateChildrenCache(fullpath util.FullPath) {
 func (i *InodeToPath) AdjustSubdirCount(dirPath util.FullPath, delta int32) {
 	i.Lock()
 	defer i.Unlock()
-	inode, found := i.path2inode[dirPath]
-	if !found {
-		return
-	}
-	d := i.dirStates[inode]
+	d := i.dirStateOf(dirPath)
 	if d == nil {
 		return
 	}
@@ -324,11 +411,7 @@ func (i *InodeToPath) AdjustSubdirCount(dirPath util.FullPath, delta int32) {
 func (i *InodeToPath) GetSubdirCount(dirPath util.FullPath) int32 {
 	i.RLock()
 	defer i.RUnlock()
-	inode, found := i.path2inode[dirPath]
-	if !found {
-		return 0
-	}
-	d := i.dirStates[inode]
+	d := i.dirStateOf(dirPath)
 	if d == nil {
 		return 0
 	}
@@ -339,11 +422,7 @@ func (i *InodeToPath) GetSubdirCount(dirPath util.FullPath) int32 {
 func (i *InodeToPath) SetSubdirCount(dirPath util.FullPath, count int32) {
 	i.Lock()
 	defer i.Unlock()
-	inode, found := i.path2inode[dirPath]
-	if !found {
-		return
-	}
-	if d := i.dirStates[inode]; d != nil {
+	if d := i.dirStateOf(dirPath); d != nil {
 		d.subdirCount = count
 	}
 }
@@ -351,11 +430,7 @@ func (i *InodeToPath) SetSubdirCount(dirPath util.FullPath, count int32) {
 func (i *InodeToPath) TouchDirectory(fullpath util.FullPath) {
 	i.Lock()
 	defer i.Unlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
-		return
-	}
-	if d := i.dirStates[inode]; d != nil {
+	if d := i.dirStateOf(fullpath); d != nil {
 		d.lastAccess = time.Now()
 	}
 }
@@ -363,11 +438,7 @@ func (i *InodeToPath) TouchDirectory(fullpath util.FullPath) {
 func (i *InodeToPath) MarkDirectoryReadThrough(fullpath util.FullPath, now time.Time) bool {
 	i.Lock()
 	defer i.Unlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
-		return false
-	}
-	d := i.dirStates[inode]
+	d := i.dirStateOf(fullpath)
 	if d == nil {
 		return false
 	}
@@ -376,51 +447,13 @@ func (i *InodeToPath) MarkDirectoryReadThrough(fullpath util.FullPath, now time.
 	d.cachedExpiresTime = time.Time{}
 	d.lastAccess = now
 	d.lastRefresh = time.Time{}
-	d.updateCount = 0
-	d.updateWindowStart = time.Time{}
 	return true
 }
 
-func (i *InodeToPath) RecordDirectoryUpdate(fullpath util.FullPath, now time.Time, window time.Duration, threshold int) bool {
-	if threshold <= 0 || window <= 0 {
-		return false
-	}
-	i.Lock()
-	defer i.Unlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
-		return false
-	}
-	d := i.dirStates[inode]
-	if d == nil || !d.isChildrenCached {
-		return false
-	}
-	if d.updateWindowStart.IsZero() || now.Sub(d.updateWindowStart) > window {
-		d.updateWindowStart = now
-		d.updateCount = 0
-	}
-	d.updateCount++
-	if d.updateCount >= threshold {
-		d.isChildrenCached = false
-		d.readDirDirect = true
-		d.cachedExpiresTime = time.Time{}
-		d.lastAccess = now
-		d.lastRefresh = time.Time{}
-		d.updateCount = 0
-		d.updateWindowStart = time.Time{}
-		return true
-	}
-	return false
-}
-
 func (i *InodeToPath) ShouldReadDirectoryDirect(fullpath util.FullPath) bool {
 	i.RLock()
 	defer i.RUnlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
-		return false
-	}
-	d := i.dirStates[inode]
+	d := i.dirStateOf(fullpath)
 	if d == nil {
 		return false
 	}
@@ -430,19 +463,13 @@ func (i *InodeToPath) ShouldReadDirectoryDirect(fullpath util.FullPath) bool {
 func (i *InodeToPath) MarkDirectoryRefreshed(fullpath util.FullPath, now time.Time) {
 	i.Lock()
 	defer i.Unlock()
-	inode, found := i.path2inode[fullpath]
-	if !found {
-		return
-	}
-	d := i.dirStates[inode]
+	d := i.dirStateOf(fullpath)
 	if d == nil {
 		return
 	}
 	d.lastRefresh = now
 	d.lastAccess = now
 	d.readDirDirect = false
-	d.updateCount = 0
-	d.updateWindowStart = time.Time{}
 	if i.cacheMetaTtlSec > 0 {
 		d.cachedExpiresTime = now.Add(i.cacheMetaTtlSec)
 	}
@@ -464,7 +491,7 @@ func (i *InodeToPath) CollectEvictableDirs(now time.Time, idle time.Duration) []
 		}
 		d.resetCacheState()
 		if entry, ok := i.inode2path[inode]; ok {
-			dirs = append(dirs, entry.paths...)
+			dirs = entry.appendPaths(dirs)
 		}
 	}
 	return dirs
@@ -477,23 +504,32 @@ func (i *InodeToPath) AddPath(inode uint64, path util.FullPath) {
 
 	ie, found := i.inode2path[inode]
 	if found {
-		ie.paths = append(ie.paths, path)
+		ie.addPath(path)
 		ie.nlookup++
 	} else {
 		i.inode2path[inode] = &InodeEntry{
-			paths:   []util.FullPath{path},
+			path:    path,
 			nlookup: 1,
 		}
 	}
 }
 
-func (i *InodeToPath) RemovePath(path util.FullPath) {
+// RemovePath drops the name. onStillReferenced, if given, runs under the
+// table's lock when the kernel still holds lookup references to the inode:
+// such an inode keeps receiving requests until the final forget, and holding
+// the lock is what keeps that forget from racing whatever per-inode state the
+// callback installs — Forget releases under the same lock.
+func (i *InodeToPath) RemovePath(path util.FullPath, onStillReferenced func(inode uint64)) {
 	i.Lock()
 	defer i.Unlock()
 	inode, found := i.path2inode[path]
 	if found {
 		delete(i.path2inode, path)
+		i.dropDirPath(inode)
 		i.removePathFromInode2Path(inode, path)
+		if ie := i.inode2path[inode]; ie != nil && ie.nlookup > 0 && onStillReferenced != nil {
+			onStillReferenced(inode)
+		}
 	}
 }
 
@@ -511,26 +547,27 @@ func (i *InodeToPath) MovePath(sourcePath, targetPath util.FullPath) (sourceInod
 	i.Lock()
 	defer i.Unlock()
 	sourceInode, sourceFound := i.path2inode[sourcePath]
+	if !sourceFound {
+		// Nothing of ours to move: the source was never visited here, or a
+		// redelivery already moved it. Whatever sits at the target is not ours
+		// to take apart on the strength of an absent source, and deciding that
+		// outside this lock would race a concurrent move to the same target.
+		return 0, 0
+	}
 	targetInode, targetFound := i.path2inode[targetPath]
 	if targetFound {
 		i.removePathFromInode2Path(targetInode, targetPath)
 		delete(i.path2inode, targetPath)
+		i.dropDirPath(targetInode)
 	}
-	if sourceFound {
-		delete(i.path2inode, sourcePath)
-		i.path2inode[targetPath] = sourceInode
-	} else {
-		// it is possible some source folder items has not been visited before
-		// so no need to worry about their source inodes
-		return
-	}
+	delete(i.path2inode, sourcePath)
+	i.path2inode[targetPath] = sourceInode
 	if entry, entryFound := i.inode2path[sourceInode]; entryFound {
-		for i, p := range entry.paths {
-			if p == sourcePath {
-				entry.paths[i] = targetPath
-			}
-		}
+		entry.replacePath(sourcePath, targetPath)
 		if d := i.dirStates[sourceInode]; d != nil {
+			i.dropDirPath(sourceInode)
+			d.path = targetPath
+			i.dirPaths[targetPath] = d
 			d.resetCacheState()
 		}
 	} else {
@@ -551,27 +588,31 @@ func (i *InodeToPath) Forget(inode, nlookup uint64, onRelease func(inode uint64)
 	path, found := i.inode2path[inode]
 	if found {
 		if nlookup > path.nlookup {
-			glog.Errorf("kernel forget over-decrement: inode %d paths %v current %d forget %d", inode, path.paths, path.nlookup, nlookup)
+			glog.Errorf("kernel forget over-decrement: inode %d path %v current %d forget %d", inode, path.path, path.nlookup, nlookup)
 			path.nlookup = 0
 		} else {
 			path.nlookup -= nlookup
 		}
-		glog.V(4).Infof("kernel forget: inode %d paths %v nlookup %d", inode, path.paths, path.nlookup)
+		glog.V(4).Infof("kernel forget: inode %d path %v nlookup %d", inode, path.path, path.nlookup)
 		if path.nlookup == 0 {
 			if onRelease != nil {
 				onRelease(inode)
 			}
 			if _, isDir := i.dirStates[inode]; isDir && onForgetDir != nil {
-				dirPaths = append([]util.FullPath(nil), path.paths...)
+				dirPaths = path.appendPaths(nil)
 				callOnForgetDir = true
 			}
-			for _, p := range path.paths {
-				delete(i.path2inode, p)
+			delete(i.path2inode, path.path)
+			if path.extraPaths != nil {
+				for _, p := range *path.extraPaths {
+					delete(i.path2inode, p)
+				}
 			}
 			delete(i.inode2path, inode)
+			i.dropDirPath(inode)
 			delete(i.dirStates, inode)
 		} else {
-			glog.V(4).Infof("kernel forget but nlookup not zero: inode %d paths %v nlookup %d", inode, path.paths, path.nlookup)
+			glog.V(4).Infof("kernel forget but nlookup not zero: inode %d path %v nlookup %d", inode, path.path, path.nlookup)
 		}
 	} else {
 		glog.Warningf("kernel forget but inode not found: inode %d", inode)
diff --git a/weed/mount/inode_to_path_dirstate_test.go b/weed/mount/inode_to_path_dirstate_test.go
new file mode 100644
index 0000000000..66c63016a2
--- /dev/null
+++ b/weed/mount/inode_to_path_dirstate_test.go
@@ -0,0 +1,92 @@
+package mount
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// The two indexes hold the same states, at the path the inode entry carries.
+func checkDirIndexes(t *testing.T, itp *InodeToPath) {
+	t.Helper()
+	itp.RLock()
+	defer itp.RUnlock()
+	for path, d := range itp.dirPaths {
+		if d.path != path {
+			t.Errorf("dirPaths[%s] holds a state for %s", path, d.path)
+		}
+	}
+	for inode, d := range itp.dirStates {
+		e := itp.inode2path[inode]
+		if e == nil || e.path == "" {
+			continue
+		}
+		if e.path != d.path {
+			t.Errorf("inode %d: entry at %s, directory state at %s", inode, e.path, d.path)
+		}
+		if itp.dirPaths[d.path] != d {
+			t.Errorf("inode %d: directory state at %s is missing from dirPaths", inode, d.path)
+		}
+	}
+}
+
+func TestDirStateIndexesStayInStep(t *testing.T) {
+	itp := NewInodeToPath(util.FullPath("/"), 0)
+	now := time.Now().Unix()
+
+	dirInode := itp.Lookup("/a", now, true, false, 0, true)
+	subInode := itp.Lookup("/a/sub", now, true, false, 0, true)
+	itp.Lookup("/a/sub/f.txt", now, false, false, 0, true)
+	checkDirIndexes(t, itp)
+
+	if itp.dirStateOf("/a/sub") == nil {
+		t.Fatal("/a/sub not indexed as a directory")
+	}
+	if itp.dirStateOf("/a/sub/f.txt") != nil {
+		t.Error("a file landed in the directory index")
+	}
+
+	itp.MovePath("/a/sub", "/a/moved")
+	checkDirIndexes(t, itp)
+	if itp.dirStateOf("/a/sub") != nil {
+		t.Error("pre-rename directory still indexed")
+	}
+	if itp.dirStateOf("/a/moved") == nil {
+		t.Error("renamed directory not indexed")
+	}
+
+	itp.RemovePath("/a/moved", nil)
+	if itp.dirStateOf("/a/moved") != nil {
+		t.Error("removed directory still indexed")
+	}
+	checkDirIndexes(t, itp)
+
+	itp.Forget(subInode, 1, nil, nil)
+	itp.Forget(dirInode, 1, nil, nil)
+	checkDirIndexes(t, itp)
+	if itp.dirStateOf("/a") != nil {
+		t.Error("forgotten directory still indexed")
+	}
+}
+
+// A released directory's state keeps its old path. Forgetting it must not take
+// the index entry of whatever holds that name now.
+func TestForgetDoesNotDropAReusedDirPath(t *testing.T) {
+	itp := NewInodeToPath(util.FullPath("/"), 0)
+	now := time.Now().Unix()
+
+	oldInode := itp.Lookup("/a", now, true, false, 0, true)
+	itp.RemovePath("/a", nil)
+	newInode := itp.Lookup("/a", now+1, true, false, 0, true)
+	if newInode == oldInode {
+		t.Fatalf("recreated directory reused inode %d", newInode)
+	}
+
+	itp.Forget(oldInode, 1, nil, nil)
+
+	if itp.dirStateOf("/a") == nil {
+		t.Error("live directory lost its index when the released one was forgotten")
+	}
+	checkDirIndexes(t, itp)
+}
diff --git a/weed/mount/inode_to_path_test.go b/weed/mount/inode_to_path_test.go
index 3699653a30..2625ed20aa 100644
--- a/weed/mount/inode_to_path_test.go
+++ b/weed/mount/inode_to_path_test.go
@@ -3,10 +3,30 @@ package mount
 import (
 	"testing"
 	"time"
+	"unsafe"
 
+	"github.com/seaweedfs/go-fuse/v2/fuse"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
+// A mount with millions of files is mostly these, so guard the size class.
+func TestInodeEntryStaysInSizeClass(t *testing.T) {
+	if unsafe.Sizeof(uintptr(0)) != 8 {
+		t.Skip("size classes are 64-bit specific")
+	}
+	if got := unsafe.Sizeof(InodeEntry{}); got != 32 {
+		t.Errorf("sizeof(InodeEntry) = %d, want 32", got)
+	}
+}
+
+func inodeEntryWith(paths ...util.FullPath) InodeEntry {
+	var ie InodeEntry
+	for _, p := range paths {
+		ie.addPath(p)
+	}
+	return ie
+}
+
 func TestInodeEntry_removeOnePath(t *testing.T) {
 	tests := []struct {
 		name  string
@@ -16,10 +36,8 @@ func TestInodeEntry_removeOnePath(t *testing.T) {
 		count int
 	}{
 		{
-			name: "actual case",
-			entry: InodeEntry{
-				paths: []util.FullPath{"/pjd/nx", "/pjd/n0"},
-			},
+			name:  "actual case",
+			entry: inodeEntryWith("/pjd/nx", "/pjd/n0"),
 			p:     "/pjd/nx",
 			want:  true,
 			count: 1,
@@ -32,46 +50,36 @@ func TestInodeEntry_removeOnePath(t *testing.T) {
 			count: 0,
 		},
 		{
-			name: "single",
-			entry: InodeEntry{
-				paths: []util.FullPath{"/x"},
-			},
+			name:  "single",
+			entry: inodeEntryWith("/x"),
 			p:     "/x",
 			want:  true,
 			count: 0,
 		},
 		{
-			name: "first",
-			entry: InodeEntry{
-				paths: []util.FullPath{"/x", "/y", "/z"},
-			},
+			name:  "first",
+			entry: inodeEntryWith("/x", "/y", "/z"),
 			p:     "/x",
 			want:  true,
 			count: 2,
 		},
 		{
-			name: "middle",
-			entry: InodeEntry{
-				paths: []util.FullPath{"/x", "/y", "/z"},
-			},
+			name:  "middle",
+			entry: inodeEntryWith("/x", "/y", "/z"),
 			p:     "/y",
 			want:  true,
 			count: 2,
 		},
 		{
-			name: "last",
-			entry: InodeEntry{
-				paths: []util.FullPath{"/x", "/y", "/z"},
-			},
+			name:  "last",
+			entry: inodeEntryWith("/x", "/y", "/z"),
 			p:     "/z",
 			want:  true,
 			count: 2,
 		},
 		{
-			name: "not found",
-			entry: InodeEntry{
-				paths: []util.FullPath{"/x", "/y", "/z"},
-			},
+			name:  "not found",
+			entry: inodeEntryWith("/x", "/y", "/z"),
 			p:     "/t",
 			want:  false,
 			count: 3,
@@ -82,10 +90,11 @@ func TestInodeEntry_removeOnePath(t *testing.T) {
 			if got := tt.entry.removeOnePath(tt.p); got != tt.want {
 				t.Errorf("removeOnePath() = %v, want %v", got, tt.want)
 			}
-			if tt.count != len(tt.entry.paths) {
-				t.Errorf("removeOnePath path count = %v, want %v", len(tt.entry.paths), tt.count)
+			left := tt.entry.appendPaths(nil)
+			if tt.count != len(left) {
+				t.Errorf("removeOnePath path count = %v, want %v", len(left), tt.count)
 			}
-			for i, p := range tt.entry.paths {
+			for i, p := range left {
 				if p == tt.p {
 					t.Errorf("removeOnePath found path still exists at %v, %v", i, p)
 				}
@@ -126,26 +135,6 @@ func TestOnlyDirectoriesGetDirState(t *testing.T) {
 	}
 }
 
-func TestRecordDirectoryUpdateSwitchesDirectoryToReadThrough(t *testing.T) {
-	root := util.FullPath("/")
-	dir := util.FullPath("/data")
-
-	inodeToPath := NewInodeToPath(root, 60)
-	inodeToPath.Lookup(dir, time.Now().Unix(), true, false, 0, true)
-	inodeToPath.MarkChildrenCached(dir)
-
-	now := time.Now()
-	if !inodeToPath.RecordDirectoryUpdate(dir, now, time.Second, 1) {
-		t.Fatal("expected directory to switch to read-through mode")
-	}
-	if inodeToPath.IsChildrenCached(dir) {
-		t.Fatal("directory should no longer be marked cached")
-	}
-	if !inodeToPath.ShouldReadDirectoryDirect(dir) {
-		t.Fatal("directory should be served via direct reads after hot invalidation")
-	}
-}
-
 func TestMarkChildrenCachedClearsReadThroughMode(t *testing.T) {
 	root := util.FullPath("/")
 	dir := util.FullPath("/data")
@@ -199,3 +188,23 @@ func TestForgetOnReleaseRunsUnderLock(t *testing.T) {
 		t.Fatalf("onRelease called %d times, want 1", calls)
 	}
 }
+
+// A move with no source is not a move. Deciding that inside the lock is what
+// keeps two invalidations racing on the same rename from unlinking each other's
+// work.
+func TestMovePathWithNoSourceLeavesTheTarget(t *testing.T) {
+	itp := NewInodeToPath(util.FullPath("/"), 0)
+	inode := itp.Lookup("/a/f.txt", time.Now().Unix(), false, false, 0, true)
+
+	itp.MovePath("/a/f.txt", "/a/g.txt")
+	if sourceInode, targetInode := itp.MovePath("/a/f.txt", "/a/g.txt"); sourceInode != 0 || targetInode != 0 {
+		t.Errorf("repeat move reported %d -> %d, want nothing moved", sourceInode, targetInode)
+	}
+
+	if got, status := itp.GetPath(inode); status != fuse.OK || got != "/a/g.txt" {
+		t.Errorf("inode resolves to %q (%v), want /a/g.txt", got, status)
+	}
+	if got, found := itp.GetInode("/a/g.txt"); !found || got != inode {
+		t.Errorf("/a/g.txt resolves to %d (found %v), want %d", got, found, inode)
+	}
+}
diff --git a/weed/mount/meta_cache/meta_cache.go b/weed/mount/meta_cache/meta_cache.go
index 6ffa31cac7..1b33d8417e 100644
--- a/weed/mount/meta_cache/meta_cache.go
+++ b/weed/mount/meta_cache/meta_cache.go
@@ -54,6 +54,11 @@ type MetaCache struct {
 	// instead of a record per child.
 	dirVersionFloors map[util.FullPath]int64
 
+	// dirSections is each cached directory's listing split into name-range
+	// sections, so a churn burst invalidates one section instead of the
+	// whole listing. See meta_cache_sections.go.
+	dirSections map[util.FullPath]*sectionList
+
 	// Entry invalidations run on a worker, not inline on the apply loop:
 	// invalidateFunc takes the fh lock, which a flush can hold while waiting on
 	// the apply loop (flushMetadataToFiler -> applyLocalMetadataEvent), so inline
@@ -92,6 +97,7 @@ const (
 	metadataCompleteBuild
 	metadataAbortBuild
 	metadataPurgeDir
+	metadataSectionRefresh
 	metadataShutdown
 )
 
@@ -102,6 +108,8 @@ type metadataApplyRequest struct {
 	options      MetadataResponseApplyOptions
 	buildPath    util.FullPath
 	snapshotTsNs int64
+	sections     *sectionList    // the completed build's section table
+	refresh      *sectionRefresh // one section re-listing to reconcile
 	resetFn      func()
 	done         chan error
 }
@@ -124,6 +132,7 @@ func NewMetaCache(dbFolder string, uidGidMapper *UidGidMapper, root util.FullPat
 		buildingDirs:         make(map[util.FullPath]*directoryBuildState),
 		dedupRing:            newDedupRingBuffer(),
 		dirVersionFloors:     make(map[util.FullPath]int64),
+		dirSections:          make(map[util.FullPath]*sectionList),
 		oversizedDirs:        make(map[util.FullPath]struct{}),
 	}
 	mc.invalidateWorker = util.NewAsyncBatchWorker(func(batch []EntryInvalidation) {
@@ -316,11 +325,12 @@ func (mc *MetaCache) BeginDirectoryBuild(ctx context.Context, dirPath util.FullP
 	})
 }
 
-func (mc *MetaCache) CompleteDirectoryBuild(ctx context.Context, dirPath util.FullPath, snapshotTsNs int64) error {
+func (mc *MetaCache) CompleteDirectoryBuild(ctx context.Context, dirPath util.FullPath, snapshotTsNs int64, sectionBounds []string) error {
 	return mc.enqueueAndWait(ctx, metadataApplyRequest{
 		kind:         metadataCompleteBuild,
 		buildPath:    dirPath,
 		snapshotTsNs: snapshotTsNs,
+		sections:     newSectionTable(sectionBounds),
 	})
 }
 
@@ -487,26 +497,33 @@ func (mc *MetaCache) entryVersionRecordLocked(ctx context.Context, fp util.FullP
 	return int64(util.BytesToUint64(value[:8])), tombstone, unversioned
 }
 
-// entryVersionBlocksLocked reports whether a write at tsNs is already
-// reflected at fp. A tombstone fences with no entry present. Otherwise the
-// path's version is its own record or, lacking one, its directory's listing
-// floor — which covers children the listing saw present and absent alike.
-// A plain record only counts while its entry exists: records linger after a
+// entryVersionBlocksLocked reports whether a change at tsNs is already
+// reflected at fp. The path's version is its own record or, lacking one, the
+// listing floors — which cover names a listing saw present and absent alike.
+// A tombstone fences with no entry present, and a later floor outranks it; a
+// plain record only counts while its entry exists: records linger after a
 // bulk folder wipe and must not fence a recreate.
-func (mc *MetaCache) entryVersionBlocksLocked(ctx context.Context, fp util.FullPath, tsNs int64) bool {
+//
+// removal asks a different question from a write. An entry still present at
+// exactly tsNs has the write at that version reflected but not its removal --
+// a rename stamps the source and takes the name away at the same version --
+// so only a strictly newer record fences one out. A tombstone is the removal
+// already reflected, and fences at tsNs like any other write.
+func (mc *MetaCache) entryVersionBlocksLocked(ctx context.Context, fp util.FullPath, tsNs int64, removal bool) bool {
 	recordTsNs, tombstone, unversioned := mc.entryVersionRecordLocked(ctx, fp)
-	if tombstone {
-		return recordTsNs >= tsNs
-	}
 	if unversioned {
 		// Local content no log position describes: fence nothing, so any
 		// event can correct it.
 		return false
 	}
-	if !mc.entryExistsLocked(ctx, fp) {
+	if !tombstone && !mc.entryExistsLocked(ctx, fp) {
 		recordTsNs = 0
 	}
-	return mc.entryVersionFloorLocked(fp, recordTsNs) >= tsNs
+	floorTsNs := mc.entryVersionFloorLocked(fp, recordTsNs)
+	if removal && !tombstone {
+		return floorTsNs > tsNs
+	}
+	return floorTsNs >= tsNs
 }
 
 // entryExistsLocked reports whether fp has a live entry, applying the same TTL
@@ -520,12 +537,18 @@ func (mc *MetaCache) entryExistsLocked(ctx context.Context, fp util.FullPath) bo
 }
 
 // entryVersionFloorLocked raises a path's own version record to its
-// directory's listing floor: the listing covered every child at its snapshot,
-// so a child without a later record of its own is versioned at the snapshot.
+// directory's listing floor or its section's refresh floor: each listing
+// covered every name in its range at its snapshot, so a name without a later
+// record of its own is versioned at the snapshot.
 func (mc *MetaCache) entryVersionFloorLocked(fp util.FullPath, recordTsNs int64) int64 {
-	dir, _ := fp.DirAndName()
+	dir, name := fp.DirAndName()
 	if floor := mc.dirVersionFloors[util.FullPath(dir)]; floor > recordTsNs {
-		return floor
+		recordTsNs = floor
+	}
+	if sl := mc.dirSections[util.FullPath(dir)]; sl != nil {
+		if floor := sl.floorOf(name); floor > recordTsNs {
+			recordTsNs = floor
+		}
 	}
 	return recordTsNs
 }
@@ -592,6 +615,7 @@ func (mc *MetaCache) DeleteFolderChildren(ctx context.Context, fp util.FullPath)
 	mc.Lock()
 	defer mc.Unlock()
 	delete(mc.dirVersionFloors, fp)
+	delete(mc.dirSections, fp)
 	mc.deleteChildVersionRecordsLocked(ctx, fp)
 	return mc.localStore.DeleteFolderChildren(ctx, fp)
 }
@@ -790,11 +814,13 @@ func (mc *MetaCache) handleApplyRequest(req metadataApplyRequest) error {
 	case metadataBeginBuild:
 		return mc.beginDirectoryBuildNow(req.buildPath)
 	case metadataCompleteBuild:
-		return mc.completeDirectoryBuildNow(req.ctx, req.buildPath, req.snapshotTsNs)
+		return mc.completeDirectoryBuildNow(req.ctx, req.buildPath, req.snapshotTsNs, req.sections)
 	case metadataAbortBuild:
 		return mc.abortDirectoryBuildNow(req.buildPath)
 	case metadataPurgeDir:
 		return mc.purgeDirectoryChildrenNow(req.ctx, req.buildPath, req.resetFn)
+	case metadataSectionRefresh:
+		return mc.applySectionRefreshNow(req.ctx, req.buildPath, req.refresh)
 	case metadataShutdown:
 		return nil
 	default:
@@ -935,13 +961,24 @@ func (mc *MetaCache) applyMetadataResponseLocked(ctx context.Context, resp *file
 	// already reflected in it, and applying it would roll the entry back while
 	// the version keeps the newer claim. Each half is gated independently.
 	if resp.TsNs != 0 {
-		if oldPath != "" && mc.entryVersionBlocksLocked(ctx, oldPath, resp.TsNs) {
+		if oldPath != "" && mc.entryVersionBlocksLocked(ctx, oldPath, resp.TsNs, true) {
 			oldPath = ""
 		}
-		if newEntry != nil && mc.entryVersionBlocksLocked(ctx, newEntry.FullPath, resp.TsNs) {
+		if newEntry != nil && mc.entryVersionBlocksLocked(ctx, newEntry.FullPath, resp.TsNs, false) {
 			newEntry = nil
 		}
 	}
+	// Only foreign churn counts toward section invalidation: this mount's own
+	// writes are ground truth for its cache.
+	if options.InvalidateEntries {
+		now := time.Now()
+		if oldPath != "" {
+			mc.noteSectionChangeLocked(oldPath, now)
+		}
+		if newEntry != nil && newEntry.FullPath != oldPath {
+			mc.noteSectionChangeLocked(newEntry.FullPath, now)
+		}
+	}
 	err := mc.atomicUpdateEntryFromFilerLocked(ctx, oldPath, newEntry, allowUncachedInsert, resp.TsNs)
 	if err == nil && hideNewPath {
 		if purgeErr := mc.purgeEntryLocked(ctx, newPath, message.NewEntry.IsDirectory); purgeErr != nil {
@@ -954,6 +991,8 @@ func (mc *MetaCache) applyMetadataResponseLocked(ctx context.Context, resp *file
 		isDelete := message.NewEntry == nil
 		isMove := message.NewEntry != nil && (message.NewParentPath != resp.Directory || message.NewEntry.Name != message.OldEntry.Name)
 		if isDelete || isMove {
+			delete(mc.dirVersionFloors, oldPath)
+			delete(mc.dirSections, oldPath)
 			if deleteErr := mc.localStore.DeleteFolderChildren(ctx, oldPath); deleteErr != nil {
 				glog.V(2).Infof("delete descendants of %s: %v", oldPath, deleteErr)
 			}
@@ -995,11 +1034,12 @@ func (mc *MetaCache) purgeDirectoryChildrenNow(ctx context.Context, dirPath util
 	mc.Lock()
 	defer mc.Unlock()
 	delete(mc.dirVersionFloors, dirPath)
+	delete(mc.dirSections, dirPath)
 	mc.deleteChildVersionRecordsLocked(ctx, dirPath)
 	return mc.localStore.DeleteFolderChildren(ctx, dirPath)
 }
 
-func (mc *MetaCache) completeDirectoryBuildNow(ctx context.Context, dirPath util.FullPath, snapshotTsNs int64) error {
+func (mc *MetaCache) completeDirectoryBuildNow(ctx context.Context, dirPath util.FullPath, snapshotTsNs int64, sections *sectionList) error {
 	state := mc.buildingDirs[dirPath]
 	delete(mc.buildingDirs, dirPath)
 
@@ -1012,6 +1052,7 @@ func (mc *MetaCache) completeDirectoryBuildNow(ctx context.Context, dirPath util
 	// touches it. An unversioned listing (pre-upgrade filer) instead clears the
 	// children's records, or a re-inserted entry would inherit a stale one.
 	mc.Lock()
+	mc.dirSections[dirPath] = sections
 	if snapshotTsNs != 0 {
 		mc.dirVersionFloors[dirPath] = snapshotTsNs
 		mc.pruneSupersededTombstonesLocked(ctx, dirPath, snapshotTsNs)
diff --git a/weed/mount/meta_cache/meta_cache_apply_test.go b/weed/mount/meta_cache/meta_cache_apply_test.go
index 9d830d8811..13f688270b 100644
--- a/weed/mount/meta_cache/meta_cache_apply_test.go
+++ b/weed/mount/meta_cache/meta_cache_apply_test.go
@@ -621,7 +621,7 @@ func TestUnversionedRebuildClearsStaleVersions(t *testing.T) {
 	}}); err != nil {
 		t.Fatalf("batch insert: %v", err)
 	}
-	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 0); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 0, nil); err != nil {
 		t.Fatalf("complete unversioned build: %v", err)
 	}
 
@@ -717,7 +717,7 @@ func TestBuildCompletionPrunesSupersededTombstones(t *testing.T) {
 	if err := mc.BeginDirectoryBuild(context.Background(), util.FullPath("/dir")); err != nil {
 		t.Fatalf("begin build: %v", err)
 	}
-	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 3000); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 3000, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -806,7 +806,7 @@ func TestBuildFloorVersionsChildrenWithoutPerChildRecords(t *testing.T) {
 	}}); err != nil {
 		t.Fatalf("batch insert: %v", err)
 	}
-	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -868,7 +868,7 @@ func TestExpiredEntryIsJudgedByDirectoryFloor(t *testing.T) {
 	// is the accurate answer, and an event above the floor must apply.
 	mc.setEntryVersionLocked(context.Background(), util.FullPath("/dir/file"), 5000)
 	mc.dirVersionFloors[util.FullPath("/dir")] = 3000
-	blocks := mc.entryVersionBlocksLocked(context.Background(), util.FullPath("/dir/file"), 4000)
+	blocks := mc.entryVersionBlocksLocked(context.Background(), util.FullPath("/dir/file"), 4000, false)
 	mc.Unlock()
 
 	if blocks {
@@ -889,7 +889,7 @@ func TestUnversionedWriteDoesNotInheritDirectoryFloor(t *testing.T) {
 	if err := mc.BeginDirectoryBuild(context.Background(), util.FullPath("/dir")); err != nil {
 		t.Fatalf("begin build: %v", err)
 	}
-	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
diff --git a/weed/mount/meta_cache/meta_cache_build_test.go b/weed/mount/meta_cache/meta_cache_build_test.go
index 458111cca6..f2fa4e2d1a 100644
--- a/weed/mount/meta_cache/meta_cache_build_test.go
+++ b/weed/mount/meta_cache/meta_cache_build_test.go
@@ -110,7 +110,7 @@ func TestEnsureVisitedReplaysBufferedEventsAfterSnapshot(t *testing.T) {
 		},
 	}
 
-	if err := EnsureVisited(mc, accessor, util.FullPath("/dir"), 0); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/dir"), 0); err != nil {
 		t.Fatalf("ensure visited: %v", err)
 	}
 	if applyErr != nil {
@@ -208,7 +208,7 @@ func TestDirectoryNotificationsSuppressedDuringBuild(t *testing.T) {
 	}
 
 	// Complete the build — buffered events should be replayed
-	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 150); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 150, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -274,7 +274,7 @@ func TestEmptyDirectoryBuildReplaysAllBufferedEvents(t *testing.T) {
 	}
 
 	// Complete with snapshotTsNs=0 — simulates empty directory listing
-	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/empty"), 0); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/empty"), 0, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -350,7 +350,7 @@ func TestBuildCompletionSurvivesCallerCancellation(t *testing.T) {
 	// ctx.Done() first, but the operation itself still completes in the
 	// apply loop. Poll for the observable side effect instead of using
 	// a fixed sleep.
-	_ = mc.CompleteDirectoryBuild(cancelledCtx, util.FullPath("/dir"), 100)
+	_ = mc.CompleteDirectoryBuild(cancelledCtx, util.FullPath("/dir"), 100, nil)
 
 	// Poll until the build completes or a deadline elapses.
 	deadline := time.After(2 * time.Second)
@@ -445,7 +445,7 @@ func TestBufferedRenameUpdatesOtherDirectoryBeforeBuildCompletes(t *testing.T) {
 		t.Fatalf("new path should stay hidden until build completes: %+v", newEntry)
 	}
 
-	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dst"), 100); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), util.FullPath("/dst"), 100, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -504,7 +504,7 @@ func TestEnsureVisitedPreservesLocalOnlyEntry(t *testing.T) {
 		}},
 	}}
 
-	if err := EnsureVisited(mc, accessor, util.FullPath("/dir"), 0); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/dir"), 0); err != nil {
 		t.Fatalf("ensure visited: %v", err)
 	}
 	if !mc.IsDirectoryCached(util.FullPath("/dir")) {
@@ -550,7 +550,7 @@ func TestEnsureVisitedDropsUnpinnedStaleEntry(t *testing.T) {
 		}},
 	}}
 
-	if err := EnsureVisited(mc, accessor, util.FullPath("/dir"), 0); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/dir"), 0); err != nil {
 		t.Fatalf("ensure visited: %v", err)
 	}
 	if entry, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/stale.txt")); err != filer_pb.ErrNotFound || entry != nil {
@@ -597,7 +597,7 @@ func TestEnsureVisitedConfirmsTransientEmptyListing(t *testing.T) {
 		},
 	}}
 
-	if err := EnsureVisited(mc, accessor, util.FullPath("/dir"), 0); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/dir"), 0); err != nil {
 		t.Fatalf("ensure visited: %v", err)
 	}
 	if !mc.IsDirectoryCached(util.FullPath("/dir")) {
@@ -619,7 +619,7 @@ func TestEnsureVisitedCachesGenuinelyEmptyDirectory(t *testing.T) {
 	}
 	accessor := &buildFilerAccessor{client: client}
 
-	if err := EnsureVisited(mc, accessor, util.FullPath("/empty"), 0); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/empty"), 0); err != nil {
 		t.Fatalf("ensure visited: %v", err)
 	}
 	if !mc.IsDirectoryCached(util.FullPath("/empty")) {
diff --git a/weed/mount/meta_cache/meta_cache_init.go b/weed/mount/meta_cache/meta_cache_init.go
index 3f7c6d902e..f4bdf9b216 100644
--- a/weed/mount/meta_cache/meta_cache_init.go
+++ b/weed/mount/meta_cache/meta_cache_init.go
@@ -26,7 +26,7 @@ func (e *DirectoryTooLargeError) Error() string {
 
 // maxCacheableEntries is the directory size above which a build gives up, or 0
 // to cache everything.
-func EnsureVisited(mc *MetaCache, client filer_pb.FilerClient, dirPath util.FullPath, maxCacheableEntries int) error {
+func EnsureVisited(ctx context.Context, mc *MetaCache, client filer_pb.FilerClient, dirPath util.FullPath, maxCacheableEntries int) error {
 	// Collect all uncached paths from target directory up to root
 	var uncachedPaths []util.FullPath
 	currentPath := dirPath
@@ -61,7 +61,7 @@ func EnsureVisited(mc *MetaCache, client filer_pb.FilerClient, dirPath util.Full
 
 	// Fetch all uncached directories in parallel with context for cancellation
 	// If one fetch fails, cancel the others to avoid unnecessary work
-	g, ctx := errgroup.WithContext(context.Background())
+	g, ctx := errgroup.WithContext(ctx)
 	for _, p := range uncachedPaths {
 		path := p // capture for closure
 		g.Go(func() error {
@@ -91,8 +91,10 @@ const (
 )
 
 func doEnsureVisited(ctx context.Context, mc *MetaCache, client filer_pb.FilerClient, path util.FullPath, maxCacheableEntries int) error {
-	// Use singleflight to deduplicate concurrent requests for the same path
-	_, err, _ := mc.visitGroup.Do(string(path), func() (interface{}, error) {
+	// Use singleflight to deduplicate concurrent requests for the same path.
+	// DoChan so a canceled request stops waiting even when another request
+	// owns the in-flight build.
+	resultCh := mc.visitGroup.DoChan(string(path), func() (interface{}, error) {
 		// Check for cancellation before starting
 		if ctx.Err() != nil {
 			return nil, ctx.Err()
@@ -132,9 +134,10 @@ func doEnsureVisited(ctx context.Context, mc *MetaCache, client filer_pb.FilerCl
 		}()
 
 		// reloadFromFiler wipes the cached children and reloads them from the filer.
-		reloadFromFiler := func() (entryCount int, snapshotTsNs int64, err error) {
+		reloadFromFiler := func() (entryCount int, snapshotTsNs int64, sections sectionBoundsCollector, err error) {
 			err = util.Retry("ReadDirAllEntries", func() error {
 				entryCount = 0
+				sections = sectionBoundsCollector{}
 				var batch []*filer.Entry // reset on retry, allow GC of previous entries
 				if err := mc.deleteFolderChildrenForRebuild(ctx, path); err != nil {
 					return fmt.Errorf("clear existing entries for %s: %w", path, err)
@@ -149,6 +152,7 @@ func doEnsureVisited(ctx context.Context, mc *MetaCache, client filer_pb.FilerCl
 					if maxCacheableEntries > 0 && entryCount >= maxCacheableEntries {
 						return &DirectoryTooLargeError{Path: path}
 					}
+					sections.note(entry.Name())
 					batch = append(batch, entry)
 					entryCount++
 
@@ -171,10 +175,10 @@ func doEnsureVisited(ctx context.Context, mc *MetaCache, client filer_pb.FilerCl
 				}
 				return nil
 			})
-			return entryCount, snapshotTsNs, err
+			return entryCount, snapshotTsNs, sections, err
 		}
 
-		entryCount, snapshotTsNs, fetchErr := reloadFromFiler()
+		entryCount, snapshotTsNs, sections, fetchErr := reloadFromFiler()
 		if fetchErr != nil {
 			var tooLarge *DirectoryTooLargeError
 			if errors.As(fetchErr, &tooLarge) {
@@ -204,7 +208,7 @@ func doEnsureVisited(ctx context.Context, mc *MetaCache, client filer_pb.FilerCl
 					return nil, ctx.Err()
 				}
 			}
-			if entryCount, snapshotTsNs, fetchErr = reloadFromFiler(); fetchErr != nil {
+			if entryCount, snapshotTsNs, sections, fetchErr = reloadFromFiler(); fetchErr != nil {
 				cleanupBuild("failed")
 				return nil, fmt.Errorf("confirm empty list %s: %w", path, fetchErr)
 			}
@@ -213,14 +217,19 @@ func doEnsureVisited(ctx context.Context, mc *MetaCache, client filer_pb.FilerCl
 			}
 		}
 
-		if err := mc.CompleteDirectoryBuild(context.Background(), path, snapshotTsNs); err != nil {
+		if err := mc.CompleteDirectoryBuild(context.Background(), path, snapshotTsNs, sections.bounds); err != nil {
 			cleanupBuild("unreplayed")
 			return nil, fmt.Errorf("complete build for %s: %w", path, err)
 		}
 		cleanupDone = true // Prevent deferred cleanup after successful publish
 		return nil, nil
 	})
-	return err
+	select {
+	case result := <-resultCh:
+		return result.Err
+	case <-ctx.Done():
+		return ctx.Err()
+	}
 }
 
 func IsHiddenSystemEntry(dir, name string) bool {
diff --git a/weed/mount/meta_cache/meta_cache_purge_test.go b/weed/mount/meta_cache/meta_cache_purge_test.go
index ef6b885ee4..c7833c12a4 100644
--- a/weed/mount/meta_cache/meta_cache_purge_test.go
+++ b/weed/mount/meta_cache/meta_cache_purge_test.go
@@ -58,7 +58,7 @@ func TestPurgeSkippedWhileDirectoryBuilding(t *testing.T) {
 	var resetCalls int32
 	mc.PurgeDirectoryChildren(dir, func() { atomic.AddInt32(&resetCalls, 1) })
 
-	if err := mc.CompleteDirectoryBuild(context.Background(), dir, 0); err != nil {
+	if err := mc.CompleteDirectoryBuild(context.Background(), dir, 0, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
diff --git a/weed/mount/meta_cache/meta_cache_rename_gate_test.go b/weed/mount/meta_cache/meta_cache_rename_gate_test.go
new file mode 100644
index 0000000000..e665983b0b
--- /dev/null
+++ b/weed/mount/meta_cache/meta_cache_rename_gate_test.go
@@ -0,0 +1,95 @@
+package meta_cache
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A rename stamps its source and takes the name away at the same log position,
+// so the removal arrives at exactly the version the source already records.
+// Read as a write that is already reflected, it was dropped and the source
+// stayed visible next to the destination.
+func TestRenameRemovesSourceAtItsOwnVersion(t *testing.T) {
+	const version = 1787761708173717200
+
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{"/": true, "/dir": true})
+	defer mc.Shutdown()
+	ctx := context.Background()
+
+	write := func(name string, tsNs int64) *filer_pb.SubscribeMetadataResponse {
+		return &filer_pb.SubscribeMetadataResponse{
+			Directory: "/dir",
+			EventNotification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{
+					Name:       name,
+					Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 3},
+				},
+			},
+			TsNs: tsNs,
+		}
+	}
+	for _, event := range []*filer_pb.SubscribeMetadataResponse{write("src", version), write("dst", version-1000)} {
+		if err := mc.ApplyMetadataResponseOwned(ctx, event, LocalMetadataResponseApplyOptions); err != nil {
+			t.Fatalf("seed %s: %v", event.EventNotification.NewEntry.Name, err)
+		}
+	}
+
+	rename := &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			OldEntry: &filer_pb.Entry{Name: "src"},
+			NewEntry: &filer_pb.Entry{
+				Name:       "dst",
+				Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 3},
+			},
+			NewParentPath: "/dir",
+		},
+		TsNs: version,
+	}
+	if err := mc.ApplyMetadataResponseOwned(ctx, rename, LocalMetadataResponseApplyOptions); err != nil {
+		t.Fatalf("rename: %v", err)
+	}
+
+	if entry, _, err := mc.FindEntry(ctx, "/dir/src"); err == nil && entry != nil {
+		t.Error("the renamed-away source is still cached")
+	}
+	if entry, _, err := mc.FindEntry(ctx, "/dir/dst"); err != nil || entry == nil {
+		t.Errorf("the rename destination is missing: %v", err)
+	}
+}
+
+// A removal older than the entry's record is still stale and must not apply:
+// the record describes a write the removal never saw.
+func TestRemovalOlderThanTheRecordStillFences(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{"/": true, "/dir": true})
+	defer mc.Shutdown()
+	ctx := context.Background()
+
+	if err := mc.ApplyMetadataResponseOwned(ctx, &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{
+				Name:       "file",
+				Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 3},
+			},
+		},
+		TsNs: 2000,
+	}, LocalMetadataResponseApplyOptions); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+
+	if err := mc.ApplyMetadataResponseOwned(ctx, &filer_pb.SubscribeMetadataResponse{
+		Directory:         "/dir",
+		EventNotification: &filer_pb.EventNotification{OldEntry: &filer_pb.Entry{Name: "file"}},
+		TsNs:              1000,
+	}, LocalMetadataResponseApplyOptions); err != nil {
+		t.Fatalf("stale removal: %v", err)
+	}
+
+	if entry, _, err := mc.FindEntry(ctx, "/dir/file"); err != nil || entry == nil {
+		t.Errorf("a removal older than the entry's record deleted it: %v", err)
+	}
+}
diff --git a/weed/mount/meta_cache/meta_cache_sections.go b/weed/mount/meta_cache/meta_cache_sections.go
new file mode 100644
index 0000000000..a244027811
--- /dev/null
+++ b/weed/mount/meta_cache/meta_cache_sections.go
@@ -0,0 +1,422 @@
+package meta_cache
+
+import (
+	"context"
+	"errors"
+	"math"
+	"sort"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A cached directory's listing is split into contiguous name-range sections so
+// a burst of remote changes invalidates one section, not the whole listing.
+// Events keep applying to a stale section; staleness only means the next
+// listing re-validates that range against the filer before serving it, and
+// lookups in it read through until then.
+const (
+	// dirSectionSize is the target entries per section, fixed when a listing
+	// is built and re-derived when a re-listed section has outgrown it.
+	dirSectionSize = 1024
+	// sectionHotThreshold remote changes within sectionHotWindow invalidate
+	// the section they land in.
+	sectionHotThreshold = 64
+	sectionHotWindow    = 2 * time.Second
+	// sectionRefreshTimeout bounds how long a readdir waits on re-validating
+	// a section before serving the maintained-but-unverified cache instead.
+	sectionRefreshTimeout = 5 * time.Second
+	// sectionRefreshMaxEntries is the most one refresh will carry; a section
+	// grown past it is cheaper to re-tile with a full directory rebuild.
+	sectionRefreshMaxEntries = 4 * dirSectionSize
+)
+
+// ErrRefreshRangeTooLarge reports a section that outgrew one refresh; the
+// caller should drop the directory cache so a full rebuild re-tiles it.
+var ErrRefreshRangeTooLarge = errors.New("section outgrew one refresh")
+
+// sectionList: bounds[i] is the first name of section i+1; section 0 starts at
+// the beginning of the namespace, the last section runs to the end. It is a
+// plain state machine — no locking, no store; MetaCache drives it under its
+// own mutex.
+type sectionList struct {
+	bounds   []string
+	sections []sectionState
+}
+
+type sectionState struct {
+	stale       bool
+	updateCount int
+	windowStart time.Time
+	// unverifiable marks a stale section whose filer stamps no listing
+	// snapshots: re-listing it can never vouch for it, so stop trying and
+	// leave its lookups reading through.
+	unverifiable bool
+	// floorTsNs is the section's own listing snapshot: a refresh at it covered
+	// every name in the range, present or absent, so it fences like the
+	// directory floor but for this range alone.
+	floorTsNs int64
+}
+
+func newSectionTable(bounds []string) *sectionList {
+	return &sectionList{bounds: bounds, sections: make([]sectionState, len(bounds)+1)}
+}
+
+// sectionBoundsCollector derives section boundaries from an ordered listing:
+// every dirSectionSize-th name starts a new section.
+type sectionBoundsCollector struct {
+	count  int
+	bounds []string
+}
+
+func (c *sectionBoundsCollector) note(name string) {
+	if c.count > 0 && c.count%dirSectionSize == 0 {
+		c.bounds = append(c.bounds, name)
+	}
+	c.count++
+}
+
+// sectionRefresh carries one section's re-listing to the apply loop.
+type sectionRefresh struct {
+	lo, hi       string
+	entries      []*filer.Entry
+	snapshotTsNs int64
+}
+
+func (sl *sectionList) sectionOf(name string) int {
+	idx := sort.SearchStrings(sl.bounds, name)
+	if idx < len(sl.bounds) && sl.bounds[idx] == name {
+		idx++
+	}
+	return idx
+}
+
+// sectionRange returns the [lo, hi) name range of section idx; "" is unbounded.
+func (sl *sectionList) sectionRange(idx int) (lo, hi string) {
+	if idx > 0 {
+		lo = sl.bounds[idx-1]
+	}
+	if idx < len(sl.bounds) {
+		hi = sl.bounds[idx]
+	}
+	return
+}
+
+// noteChange counts one change against the section it lands in, marking the
+// section stale when a burst crosses the threshold.
+func (sl *sectionList) noteChange(name string, now time.Time) {
+	s := &sl.sections[sl.sectionOf(name)]
+	if s.stale {
+		return
+	}
+	if s.windowStart.IsZero() || now.Sub(s.windowStart) > sectionHotWindow {
+		s.windowStart = now
+		s.updateCount = 0
+	}
+	s.updateCount++
+	if s.updateCount >= sectionHotThreshold {
+		s.stale = true
+	}
+}
+
+func (sl *sectionList) isFresh(name string) bool {
+	return !sl.sections[sl.sectionOf(name)].stale
+}
+
+// floorOf returns the refresh snapshot covering this name, or zero when its
+// section has never been re-listed. A stale section keeps fencing: what its
+// last listing established stays established.
+func (sl *sectionList) floorOf(name string) int64 {
+	return sl.sections[sl.sectionOf(name)].floorTsNs
+}
+
+type nameRange struct {
+	lo, hi string
+}
+
+// staleRangesAhead returns the invalidated ranges worth re-listing from the
+// section holding startName to the end of the directory.
+func (sl *sectionList) staleRangesAhead(startName string) (ranges []nameRange) {
+	for i := sl.sectionOf(startName); i < len(sl.sections); i++ {
+		if sl.sections[i].stale && !sl.sections[i].unverifiable {
+			lo, hi := sl.sectionRange(i)
+			ranges = append(ranges, nameRange{lo: lo, hi: hi})
+		}
+	}
+	return
+}
+
+// hasRange reports whether the table still has a section covering exactly
+// [lo, hi); a rebuild or re-split since a listing was taken retires the range
+// it described.
+func (sl *sectionList) hasRange(lo, hi string) bool {
+	curLo, curHi := sl.sectionRange(sl.sectionOf(lo))
+	return curLo == lo && curHi == hi
+}
+
+// completeRefresh marks the section covering exactly [lo, hi) fresh after a
+// re-listing that fetched names at snapshotTsNs, re-splitting a section that
+// outgrew twice its target size. The snapshot becomes the section's floor. A
+// range the table no longer has is ignored — splicing bounds from a stale
+// range could leave the table unsorted — and an unversioned listing vouches
+// for nothing: the section stays stale, remembered as not worth re-listing.
+func (sl *sectionList) completeRefresh(lo, hi string, names []string, snapshotTsNs int64) bool {
+	idx := sl.sectionOf(lo)
+	if curLo, curHi := sl.sectionRange(idx); curLo != lo || curHi != hi {
+		return false
+	}
+	if snapshotTsNs == 0 {
+		sl.sections[idx].unverifiable = true
+		return false
+	}
+	if len(names) > 2*dirSectionSize {
+		var newBounds []string
+		for i := dirSectionSize; i < len(names); i += dirSectionSize {
+			newBounds = append(newBounds, names[i])
+		}
+		bounds := make([]string, 0, len(sl.bounds)+len(newBounds))
+		bounds = append(bounds, sl.bounds[:idx]...)
+		bounds = append(bounds, newBounds...)
+		bounds = append(bounds, sl.bounds[idx:]...)
+		sections := make([]sectionState, 0, len(bounds)+1)
+		sections = append(sections, sl.sections[:idx]...)
+		for i := 0; i <= len(newBounds); i++ {
+			sections = append(sections, sectionState{floorTsNs: snapshotTsNs})
+		}
+		sections = append(sections, sl.sections[idx+1:]...)
+		sl.bounds, sl.sections = bounds, sections
+	} else {
+		sl.sections[idx] = sectionState{floorTsNs: snapshotTsNs}
+	}
+	return true
+}
+
+// noteSectionChangeLocked counts one remote change against the section of the
+// directory it lands in.
+func (mc *MetaCache) noteSectionChangeLocked(fp util.FullPath, now time.Time) {
+	dir, name := fp.DirAndName()
+	if sl := mc.dirSections[util.FullPath(dir)]; sl != nil {
+		sl.noteChange(name, now)
+	}
+}
+
+// IsNameFresh reports whether the cached listing still vouches for this name.
+// A directory without section state vouches for all of it.
+func (mc *MetaCache) IsNameFresh(fp util.FullPath) bool {
+	dir, name := fp.DirAndName()
+	mc.RLock()
+	defer mc.RUnlock()
+	sl := mc.dirSections[util.FullPath(dir)]
+	return sl == nil || sl.isFresh(name)
+}
+
+func (mc *MetaCache) staleRangesAhead(dirPath util.FullPath, startName string) []nameRange {
+	mc.RLock()
+	defer mc.RUnlock()
+	sl := mc.dirSections[dirPath]
+	if sl == nil {
+		return nil
+	}
+	return sl.staleRangesAhead(startName)
+}
+
+func (mc *MetaCache) rangeStale(dirPath util.FullPath, lo string) bool {
+	mc.RLock()
+	defer mc.RUnlock()
+	sl := mc.dirSections[dirPath]
+	return sl != nil && !sl.isFresh(lo)
+}
+
+// EnsureListingFresh re-validates every invalidated section from startName to
+// the end of the directory before a listing pages through them. A listing's
+// reach is unknowable up front — a resumed handle can skip far ahead, and
+// shrunken sections let one batch span many — so all of them are covered.
+func EnsureListingFresh(ctx context.Context, mc *MetaCache, client filer_pb.FilerClient, dirPath util.FullPath, startName string) error {
+	ranges := mc.staleRangesAhead(dirPath, startName)
+	if len(ranges) == 0 {
+		return nil
+	}
+	ctx, cancel := context.WithTimeout(ctx, sectionRefreshTimeout)
+	defer cancel()
+	for _, r := range ranges {
+		if err := mc.refreshSection(ctx, client, dirPath, r.lo, r.hi); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (mc *MetaCache) refreshSection(ctx context.Context, client filer_pb.FilerClient, dirPath util.FullPath, lo, hi string) error {
+	_, err, _ := mc.visitGroup.Do(string(dirPath)+"\x00section\x00"+lo, func() (interface{}, error) {
+		if !mc.rangeStale(dirPath, lo) {
+			return nil, nil
+		}
+		entries, snapshotTsNs, err := mc.listFilerRange(ctx, client, dirPath, lo, hi)
+		if err != nil {
+			return nil, err
+		}
+		return nil, mc.enqueueAndWait(ctx, metadataApplyRequest{
+			kind:      metadataSectionRefresh,
+			buildPath: dirPath,
+			refresh:   &sectionRefresh{lo: lo, hi: hi, entries: entries, snapshotTsNs: snapshotTsNs},
+		})
+	})
+	return err
+}
+
+// listFilerRange reads [lo, hi) from the filer at one snapshot, paging by
+// section-sized batches.
+func (mc *MetaCache) listFilerRange(ctx context.Context, client filer_pb.FilerClient, dirPath util.FullPath, lo, hi string) (entries []*filer.Entry, snapshotTsNs int64, err error) {
+	startFrom, includeStart := lo, lo != ""
+	for {
+		var page []*filer.Entry
+		var pageCount int
+		var last string
+		done := false
+		err = client.WithFilerClient(false, func(sc filer_pb.SeaweedFilerClient) error {
+			// reset in case a failover retry re-runs a partly streamed page
+			page, pageCount, last, done = nil, 0, "", false
+			ts, listErr := filer_pb.DoSeaweedListWithSnapshot(ctx, sc, dirPath, "", func(pbEntry *filer_pb.Entry, isLast bool) error {
+				pageCount++
+				last = pbEntry.Name
+				if hi != "" && pbEntry.Name >= hi {
+					done = true
+				}
+				if done {
+					return nil
+				}
+				if !mc.includeSystemEntries && IsHiddenSystemEntry(string(dirPath), pbEntry.Name) {
+					return nil
+				}
+				page = append(page, filer.FromPbEntry(string(dirPath), pbEntry))
+				return nil
+			}, startFrom, includeStart, dirSectionSize, snapshotTsNs)
+			if listErr != nil {
+				return listErr
+			}
+			if snapshotTsNs == 0 {
+				snapshotTsNs = ts
+			}
+			return nil
+		})
+		if err != nil {
+			return nil, 0, err
+		}
+		entries = append(entries, page...)
+		if len(entries) > sectionRefreshMaxEntries {
+			return nil, 0, ErrRefreshRangeTooLarge
+		}
+		if done || pageCount < dirSectionSize {
+			return entries, snapshotTsNs, nil
+		}
+		startFrom, includeStart = last, false
+	}
+}
+
+// applySectionRefreshNow reconciles one section against a filer listing of its
+// range, then marks it fresh. Runs on the apply loop; mutations go through the
+// version gate so the listing cannot roll back a newer applied event, and
+// pinned local-only entries (deferred creates not yet on the filer) survive.
+func (mc *MetaCache) applySectionRefreshNow(ctx context.Context, dirPath util.FullPath, r *sectionRefresh) error {
+	lo, hi, snapshotTsNs := r.lo, r.hi, r.snapshotTsNs
+
+	// A build wipes and repopulates the store off-loop; reconciling against
+	// it would sweep children the build already inserted and publish the
+	// directory incomplete. The staleness dies with the build's fresh table.
+	if mc.isBuildingDir(dirPath) {
+		return nil
+	}
+
+	mc.Lock()
+	defer mc.Unlock()
+
+	// With no per-entry versions, only the section floor fences this work; a
+	// range the rebuilt or re-split table no longer has gets no floor, so it
+	// must not touch the store either. The lock is held through the floor
+	// install below, so the check cannot go stale.
+	sl := mc.dirSections[dirPath]
+	if sl == nil || !sl.hasRange(lo, hi) {
+		return nil
+	}
+
+	fetchedNames := make([]string, 0, len(r.entries))
+	fetched := make(map[string]struct{}, len(r.entries))
+	for _, entry := range r.entries {
+		fetchedNames = append(fetchedNames, entry.Name())
+		fetched[entry.Name()] = struct{}{}
+		if snapshotTsNs == 0 {
+			// A pre-upgrade filer stamps no snapshot, leaving nothing to
+			// order against: only fill gaps, so a concurrently applied event
+			// can never be rolled back.
+			if mc.entryExistsLocked(ctx, entry.FullPath) {
+				continue
+			}
+			if _, tombstone := mc.getEntryVersionRecordLocked(ctx, entry.FullPath); tombstone {
+				continue
+			}
+			if err := mc.localStore.InsertEntry(ctx, entry); err != nil {
+				return err
+			}
+			mc.setEntryVersionLocked(ctx, entry.FullPath, 0)
+			continue
+		}
+		if mc.entryVersionBlocksLocked(ctx, entry.FullPath, snapshotTsNs, false) {
+			continue
+		}
+		// An unversioned marker would bypass the section floor, so it cannot
+		// outlive the snapshot write that replaces its content — but pinned
+		// local-only state stays authoritative and is not replaced at all.
+		_, _, unversioned := mc.entryVersionRecordLocked(ctx, entry.FullPath)
+		if unversioned {
+			if existing, findErr := mc.localStore.FindEntry(ctx, entry.FullPath); findErr == nil && existing != nil && mc.pinnedChildFn != nil && mc.pinnedChildFn(existing) {
+				continue
+			}
+		}
+		// no per-entry version: the section floor set below covers the range
+		if err := mc.localStore.InsertEntry(ctx, entry); err != nil {
+			return err
+		}
+		if unversioned {
+			// only once the write landed: if it fails, the old content keeps
+			// the marker, and with it the right to be corrected by any event
+			mc.clearEntryVersionLocked(ctx, entry.FullPath)
+		}
+	}
+
+	// Deletions need the snapshot as an ordering reference; without one a
+	// name created after the listing would be swept away.
+	if snapshotTsNs != 0 {
+		var vanished []*filer.Entry
+		if _, err := mc.localStore.ListDirectoryEntries(ctx, dirPath, lo, true, math.MaxInt64, func(entry *filer.Entry) (bool, error) {
+			if hi != "" && entry.Name() >= hi {
+				return false, nil
+			}
+			if _, found := fetched[entry.Name()]; !found {
+				vanished = append(vanished, entry)
+			}
+			return true, nil
+		}); err != nil {
+			return err
+		}
+		for _, entry := range vanished {
+			if mc.pinnedChildFn != nil && mc.pinnedChildFn(entry) {
+				continue
+			}
+			if mc.entryVersionBlocksLocked(ctx, entry.FullPath, snapshotTsNs, true) {
+				continue
+			}
+			if err := mc.localStore.DeleteEntry(ctx, entry.FullPath); err != nil {
+				return err
+			}
+			mc.clearEntryVersionLocked(ctx, entry.FullPath)
+		}
+	}
+
+	// The floor fences the whole range, absent names included; an unversioned
+	// listing sets none and the section stays stale, its lookups reading
+	// through, with no further re-listing attempts.
+	sl.completeRefresh(lo, hi, fetchedNames, snapshotTsNs)
+	return nil
+}
diff --git a/weed/mount/meta_cache/meta_cache_sections_test.go b/weed/mount/meta_cache/meta_cache_sections_test.go
new file mode 100644
index 0000000000..6199951064
--- /dev/null
+++ b/weed/mount/meta_cache/meta_cache_sections_test.go
@@ -0,0 +1,974 @@
+package meta_cache
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestSectionOf(t *testing.T) {
+	sl := newSectionTable([]string{"g", "p"})
+	for name, want := range map[string]int{
+		"a": 0, "f": 0,
+		"g": 1, "h": 1, "o": 1,
+		"p": 2, "z": 2,
+	} {
+		if got := sl.sectionOf(name); got != want {
+			t.Errorf("sectionOf(%q) = %d, want %d", name, got, want)
+		}
+	}
+	if lo, hi := sl.sectionRange(0); lo != "" || hi != "g" {
+		t.Errorf("sectionRange(0) = %q..%q, want ..g", lo, hi)
+	}
+	if lo, hi := sl.sectionRange(1); lo != "g" || hi != "p" {
+		t.Errorf("sectionRange(1) = %q..%q, want g..p", lo, hi)
+	}
+	if lo, hi := sl.sectionRange(2); lo != "p" || hi != "" {
+		t.Errorf("sectionRange(2) = %q..%q, want p..", lo, hi)
+	}
+}
+
+func buildSectionedDir(t *testing.T, mc *MetaCache, dir util.FullPath, snapshotTsNs int64, bounds []string) {
+	t.Helper()
+	if err := mc.BeginDirectoryBuild(context.Background(), dir); err != nil {
+		t.Fatalf("begin build: %v", err)
+	}
+	if err := mc.CompleteDirectoryBuild(context.Background(), dir, snapshotTsNs, bounds); err != nil {
+		t.Fatalf("complete build: %v", err)
+	}
+}
+
+func applyChurn(t *testing.T, mc *MetaCache, dir, prefix string, n int, baseTsNs int64, options MetadataResponseApplyOptions) {
+	t.Helper()
+	for i := 0; i < n; i++ {
+		resp := &filer_pb.SubscribeMetadataResponse{
+			Directory: dir,
+			EventNotification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{
+					Name: fmt.Sprintf("%s%03d", prefix, i),
+					Attributes: &filer_pb.FuseAttributes{
+						Crtime:   1,
+						Mtime:    1,
+						FileMode: 0100644,
+						FileSize: 1,
+					},
+				},
+			},
+			TsNs: baseTsNs + int64(i),
+		}
+		if err := mc.ApplyMetadataResponse(context.Background(), resp, options); err != nil {
+			t.Fatalf("apply churn %d: %v", i, err)
+		}
+	}
+}
+
+func TestSectionBurstInvalidatesOnlyItsSection(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	if mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("burst section should be invalidated")
+	}
+	if !mc.IsNameFresh(util.FullPath("/dir/zzz")) {
+		t.Fatal("the other section must stay fresh")
+	}
+}
+
+func TestLocalChangesDoNotInvalidateSections(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, nil)
+
+	applyChurn(t, mc, "/dir", "a-", 2*sectionHotThreshold, 2000, LocalMetadataResponseApplyOptions)
+
+	if !mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("this mount's own writes must not invalidate its cache")
+	}
+}
+
+func TestSectionRefreshReconciles(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+	mc.SetPinnedChildFn(func(entry *filer.Entry) bool {
+		return entry.Name() == "b-pinned"
+	})
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+
+	for _, name := range []string{"b-keep", "b-vanish", "b-pinned"} {
+		if err := mc.InsertEntry(context.Background(), &filer.Entry{
+			FullPath: util.FullPath("/dir/" + name),
+			Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(1, 0), Mode: 0100644, FileSize: 1},
+		}, 0); err != nil {
+			t.Fatalf("seed %s: %v", name, err)
+		}
+	}
+	// applied ahead of the refresh snapshot; the listing must not roll it back
+	if err := mc.ApplyMetadataResponse(context.Background(), &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{
+				Name:       "b-newer",
+				Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 9, FileMode: 0100644, FileSize: 9},
+			},
+		},
+		TsNs: 9000,
+	}, SubscriberMetadataResponseApplyOptions); err != nil {
+		t.Fatalf("apply newer event: %v", err)
+	}
+
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+	if mc.IsNameFresh(util.FullPath("/dir/b-keep")) {
+		t.Fatal("section should be stale before the refresh")
+	}
+
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh: &sectionRefresh{
+			hi: "m",
+			entries: []*filer.Entry{
+				{
+					FullPath: util.FullPath("/dir/b-keep"),
+					Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(2, 0), Mode: 0100644, FileSize: 7},
+				},
+				{
+					FullPath: util.FullPath("/dir/b-new"),
+					Attr:     filer.Attr{Crtime: time.Unix(2, 0), Mtime: time.Unix(2, 0), Mode: 0100644, FileSize: 3},
+				},
+			},
+			snapshotTsNs: 5000,
+		},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	if !mc.IsNameFresh(util.FullPath("/dir/b-keep")) {
+		t.Fatal("section should be fresh after the refresh")
+	}
+	entry, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-keep"))
+	if err != nil || entry.FileSize != 7 {
+		t.Fatalf("b-keep = %+v, %v; want size 7", entry, err)
+	}
+	if entry, _, err = mc.FindEntry(context.Background(), util.FullPath("/dir/b-new")); err != nil || entry.FileSize != 3 {
+		t.Fatalf("b-new = %+v, %v; want size 3", entry, err)
+	}
+	if _, _, err = mc.FindEntry(context.Background(), util.FullPath("/dir/b-vanish")); err != filer_pb.ErrNotFound {
+		t.Fatalf("b-vanish error = %v, want not found", err)
+	}
+	if _, _, err = mc.FindEntry(context.Background(), util.FullPath("/dir/a-000")); err != filer_pb.ErrNotFound {
+		t.Fatalf("churned a-000 error = %v, want not found", err)
+	}
+	if entry, _, err = mc.FindEntry(context.Background(), util.FullPath("/dir/b-newer")); err != nil || entry.FileSize != 9 {
+		t.Fatalf("b-newer = %+v, %v; want size 9 kept", entry, err)
+	}
+	if entry, _, err = mc.FindEntry(context.Background(), util.FullPath("/dir/b-pinned")); err != nil || entry == nil {
+		t.Fatalf("pinned local-only entry must survive a refresh: %v", err)
+	}
+
+	// a redelivered create older than the snapshot must not resurrect b-vanish
+	if err := mc.ApplyMetadataResponse(context.Background(), &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{
+				Name:       "b-vanish",
+				Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 1},
+			},
+		},
+		TsNs: 4000,
+	}, SubscriberMetadataResponseApplyOptions); err != nil {
+		t.Fatalf("apply stale event: %v", err)
+	}
+	if _, _, err = mc.FindEntry(context.Background(), util.FullPath("/dir/b-vanish")); err != filer_pb.ErrNotFound {
+		t.Fatalf("b-vanish resurrected by a pre-snapshot event: %v", err)
+	}
+}
+
+func TestSectionRefreshSplitsOvergrownSection(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, nil)
+
+	count := 2*dirSectionSize + 1
+	entries := make([]*filer.Entry, 0, count)
+	for i := 0; i < count; i++ {
+		entries = append(entries, &filer.Entry{
+			FullPath: util.FullPath(fmt.Sprintf("/dir/f-%05d", i)),
+			Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(1, 0), Mode: 0100644, FileSize: 1},
+		})
+	}
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh:   &sectionRefresh{entries: entries, snapshotTsNs: 5000},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	mc.RLock()
+	sl := mc.dirSections[util.FullPath("/dir")]
+	bounds := append([]string(nil), sl.bounds...)
+	sections := len(sl.sections)
+	mc.RUnlock()
+	want := []string{fmt.Sprintf("f-%05d", dirSectionSize), fmt.Sprintf("f-%05d", 2*dirSectionSize)}
+	if len(bounds) != len(want) || bounds[0] != want[0] || bounds[1] != want[1] {
+		t.Fatalf("bounds = %v, want %v", bounds, want)
+	}
+	if sections != len(bounds)+1 {
+		t.Fatalf("sections = %d, want %d", sections, len(bounds)+1)
+	}
+}
+
+type sectionFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	mu       sync.Mutex
+	names    []string // sorted; all under one directory
+	snapshot int64
+	requests []*filer_pb.ListEntriesRequest
+}
+
+func (s *sectionFilerServer) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	s.mu.Lock()
+	s.requests = append(s.requests, req)
+	names := s.names
+	snapshot := s.snapshot
+	s.mu.Unlock()
+
+	sent := uint32(0)
+	first := true
+	for _, name := range names {
+		if name < req.StartFromFileName || (name == req.StartFromFileName && !req.InclusiveStartFrom) {
+			continue
+		}
+		resp := &filer_pb.ListEntriesResponse{Entry: &filer_pb.Entry{
+			Name:       name,
+			Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 1},
+		}}
+		if first {
+			resp.SnapshotTsNs = snapshot
+			first = false
+		}
+		if err := stream.Send(resp); err != nil {
+			return err
+		}
+		sent++
+		if req.Limit > 0 && sent >= req.Limit {
+			break
+		}
+	}
+	return nil
+}
+
+func (s *sectionFilerServer) listRequests() []*filer_pb.ListEntriesRequest {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]*filer_pb.ListEntriesRequest(nil), s.requests...)
+}
+
+type sectionTestFilerClient struct {
+	addr string
+}
+
+func (c *sectionTestFilerClient) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	conn, err := grpc.NewClient(c.addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return err
+	}
+	defer conn.Close()
+	return fn(filer_pb.NewSeaweedFilerClient(conn))
+}
+
+func (c *sectionTestFilerClient) AdjustedUrl(location *filer_pb.Location) string { return location.Url }
+
+func (c *sectionTestFilerClient) GetDataCenter() string { return "" }
+
+func startSectionFilerServer(t *testing.T, s *sectionFilerServer) filer_pb.FilerClient {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(srv, s)
+	go srv.Serve(listener)
+	t.Cleanup(srv.Stop)
+	return &sectionTestFilerClient{addr: listener.Addr().String()}
+}
+
+func TestEnsureListingFreshRefreshesFromFiler(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	server := &sectionFilerServer{snapshot: 5000}
+	for i := 0; i < 1500; i++ {
+		server.names = append(server.names, fmt.Sprintf("b-%04d", i))
+	}
+	// at and beyond the section's end, must not be applied
+	server.names = append(server.names, "m", "z-1")
+	client := startSectionFilerServer(t, server)
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+	if mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("section should be stale before the refresh")
+	}
+
+	if err := EnsureListingFresh(context.Background(), mc, client, util.FullPath("/dir"), ""); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	if !mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("section should be fresh after the refresh")
+	}
+	for _, name := range []string{"b-0000", "b-1499"} {
+		if entry, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/"+name)); err != nil || entry == nil {
+			t.Fatalf("%s missing after refresh: %v", name, err)
+		}
+	}
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/a-000")); err != filer_pb.ErrNotFound {
+		t.Fatalf("churned a-000 error = %v, want not found", err)
+	}
+	for _, name := range []string{"m", "z-1"} {
+		if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/"+name)); err != filer_pb.ErrNotFound {
+			t.Fatalf("%s at or beyond the section's end was applied: %v", name, err)
+		}
+	}
+
+	requests := server.listRequests()
+	if len(requests) < 2 {
+		t.Fatalf("multi-page refresh made %d requests, want at least 2", len(requests))
+	}
+	if requests[0].SnapshotTsNs != 0 || requests[1].SnapshotTsNs != 5000 {
+		t.Fatalf("snapshot not pinned across pages: %d then %d", requests[0].SnapshotTsNs, requests[1].SnapshotTsNs)
+	}
+
+	// a fresh section costs no filer calls
+	if err := EnsureListingFresh(context.Background(), mc, client, util.FullPath("/dir"), ""); err != nil {
+		t.Fatalf("second refresh: %v", err)
+	}
+	if got := len(server.listRequests()); got != len(requests) {
+		t.Fatalf("fresh section still listed the filer: %d requests, was %d", got, len(requests))
+	}
+}
+
+func TestEnsureListingFreshGivesUpOnOvergrownRange(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	server := &sectionFilerServer{snapshot: 5000}
+	for i := 0; i <= sectionRefreshMaxEntries; i++ {
+		server.names = append(server.names, fmt.Sprintf("c-%05d", i))
+	}
+	client := startSectionFilerServer(t, server)
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, nil)
+	applyChurn(t, mc, "/dir", "x-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	err := EnsureListingFresh(context.Background(), mc, client, util.FullPath("/dir"), "")
+	if !errors.Is(err, ErrRefreshRangeTooLarge) {
+		t.Fatalf("refresh error = %v, want ErrRefreshRangeTooLarge", err)
+	}
+	if mc.IsNameFresh(util.FullPath("/dir/x-000")) {
+		t.Fatal("an aborted refresh must leave the section stale")
+	}
+}
+
+func TestSectionNoteChangeWindowExpiry(t *testing.T) {
+	sl := newSectionTable(nil)
+	t0 := time.Unix(100, 0)
+	for i := 0; i < sectionHotThreshold-1; i++ {
+		sl.noteChange(fmt.Sprintf("f-%03d", i), t0)
+	}
+	if !sl.isFresh("f-000") {
+		t.Fatal("below the threshold the section must stay fresh")
+	}
+
+	// the burst never completed inside one window, so the count restarts
+	t1 := t0.Add(sectionHotWindow + time.Second)
+	for i := 0; i < sectionHotThreshold-1; i++ {
+		sl.noteChange(fmt.Sprintf("f-%03d", i), t1)
+	}
+	if !sl.isFresh("f-000") {
+		t.Fatal("an expired window must not carry its count forward")
+	}
+
+	sl.noteChange("f-999", t1)
+	if sl.isFresh("f-000") {
+		t.Fatal("a full burst within one window must invalidate the section")
+	}
+}
+
+func TestSectionCompleteRefreshGuardsChangedTable(t *testing.T) {
+	sl := newSectionTable([]string{"g", "p"})
+	sl.sections[1].stale = true
+
+	if sl.completeRefresh("g", "q", []string{"h"}, 5000) {
+		t.Fatal("a range the table no longer has must be ignored")
+	}
+	if sl.isFresh("h") {
+		t.Fatal("an ignored refresh must not mark anything fresh")
+	}
+	if !sl.completeRefresh("g", "p", []string{"h"}, 5000) {
+		t.Fatal("the matching range must be accepted")
+	}
+	if !sl.isFresh("h") {
+		t.Fatal("section should be fresh after the refresh")
+	}
+}
+
+func TestSectionCompleteRefreshSplitsMiddleSection(t *testing.T) {
+	sl := newSectionTable([]string{"g", "p"})
+	sl.sections[1].stale = true
+
+	names := make([]string, 0, 2*dirSectionSize+1)
+	for i := 0; i <= 2*dirSectionSize; i++ {
+		names = append(names, fmt.Sprintf("g-%05d", i))
+	}
+	if !sl.completeRefresh("g", "p", names, 5000) {
+		t.Fatal("refresh of the middle section must be accepted")
+	}
+
+	wantBounds := []string{"g", names[dirSectionSize], names[2*dirSectionSize], "p"}
+	if len(sl.bounds) != len(wantBounds) {
+		t.Fatalf("bounds = %v, want %v", sl.bounds, wantBounds)
+	}
+	for i, b := range wantBounds {
+		if sl.bounds[i] != b {
+			t.Fatalf("bounds = %v, want %v", sl.bounds, wantBounds)
+		}
+	}
+	if len(sl.sections) != len(sl.bounds)+1 {
+		t.Fatalf("sections = %d, want %d", len(sl.sections), len(sl.bounds)+1)
+	}
+	for _, name := range []string{"a", "g-00000", names[dirSectionSize], "z"} {
+		if !sl.isFresh(name) {
+			t.Fatalf("%q should be fresh after the split", name)
+		}
+	}
+	if got := sl.sectionOf(names[dirSectionSize+1]); got != 2 {
+		t.Fatalf("sectionOf(%q) = %d, want 2", names[dirSectionSize+1], got)
+	}
+}
+
+func TestSectionFloorFencesAbsentNames(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh:   &sectionRefresh{hi: "m", snapshotTsNs: 5000},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	// a delayed create between the directory floor and the refresh snapshot,
+	// for a name neither the cache nor the listing ever held
+	ghost := func(tsNs int64) {
+		t.Helper()
+		if err := mc.ApplyMetadataResponse(context.Background(), &filer_pb.SubscribeMetadataResponse{
+			Directory: "/dir",
+			EventNotification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{
+					Name:       "b-ghost",
+					Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 1},
+				},
+			},
+			TsNs: tsNs,
+		}, SubscriberMetadataResponseApplyOptions); err != nil {
+			t.Fatalf("apply ghost event: %v", err)
+		}
+	}
+	ghost(4500)
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-ghost")); err != filer_pb.ErrNotFound {
+		t.Fatalf("pre-snapshot event resurrected an absent name: %v", err)
+	}
+	ghost(6000)
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-ghost")); err != nil {
+		t.Fatalf("post-snapshot event must apply: %v", err)
+	}
+}
+
+func TestUnversionedRefreshStaysStale(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, nil)
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh: &sectionRefresh{entries: []*filer.Entry{{
+			FullPath: util.FullPath("/dir/b-gap"),
+			Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(1, 0), Mode: 0100644, FileSize: 1},
+		}}},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	if mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("an unversioned refresh vouches for nothing and must stay stale")
+	}
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-gap")); err != nil {
+		t.Fatalf("gap fill should still land: %v", err)
+	}
+	if ranges := mc.staleRangesAhead(util.FullPath("/dir"), ""); len(ranges) != 0 {
+		t.Fatalf("an unverifiable section must not be re-listed, got %d ranges", len(ranges))
+	}
+}
+
+func TestEnsureListingFreshCoversAllStaleSectionsAhead(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	server := &sectionFilerServer{snapshot: 5000, names: []string{"b-1", "n-1"}}
+	client := startSectionFilerServer(t, server)
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+	applyChurn(t, mc, "/dir", "n-", sectionHotThreshold, 3000, SubscriberMetadataResponseApplyOptions)
+
+	if err := EnsureListingFresh(context.Background(), mc, client, util.FullPath("/dir"), ""); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+	if !mc.IsNameFresh(util.FullPath("/dir/a-000")) || !mc.IsNameFresh(util.FullPath("/dir/n-000")) {
+		t.Fatal("one call must re-validate every stale section ahead of the start")
+	}
+}
+
+func TestSectionCompleteRefreshSetsFloors(t *testing.T) {
+	sl := newSectionTable([]string{"g", "p"})
+	sl.sections[1].stale = true
+
+	names := make([]string, 0, 2*dirSectionSize+1)
+	for i := 0; i <= 2*dirSectionSize; i++ {
+		names = append(names, fmt.Sprintf("g-%05d", i))
+	}
+	if !sl.completeRefresh("g", "p", names, 7000) {
+		t.Fatal("refresh must be accepted")
+	}
+	for _, name := range []string{"g", "g-99999", names[dirSectionSize+1]} {
+		if got := sl.floorOf(name); got != 7000 {
+			t.Fatalf("floorOf(%q) = %d, want 7000", name, got)
+		}
+	}
+	if got := sl.floorOf("a"); got != 0 {
+		t.Fatalf("floorOf(a) = %d, want 0 for a never-refreshed section", got)
+	}
+}
+
+func TestSectionFloorOutranksOlderTombstone(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, nil)
+
+	event := func(tsNs int64, oldEntry, newEntry *filer_pb.Entry) {
+		t.Helper()
+		if err := mc.ApplyMetadataResponse(context.Background(), &filer_pb.SubscribeMetadataResponse{
+			Directory:         "/dir",
+			EventNotification: &filer_pb.EventNotification{OldEntry: oldEntry, NewEntry: newEntry},
+			TsNs:              tsNs,
+		}, SubscriberMetadataResponseApplyOptions); err != nil {
+			t.Fatalf("apply event at %d: %v", tsNs, err)
+		}
+	}
+	pbFile := &filer_pb.Entry{
+		Name:       "b-x",
+		Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 1},
+	}
+	event(1500, nil, pbFile)                       // create
+	event(2000, &filer_pb.Entry{Name: "b-x"}, nil) // delete, leaves a tombstone at 2000
+
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2500, SubscriberMetadataResponseApplyOptions)
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh:   &sectionRefresh{snapshotTsNs: 5000},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	// the floor at 5000 outranks the tombstone at 2000
+	event(4000, nil, pbFile)
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-x")); err != filer_pb.ErrNotFound {
+		t.Fatalf("pre-floor event applied over an older tombstone: %v", err)
+	}
+	event(6000, nil, pbFile)
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-x")); err != nil {
+		t.Fatalf("post-floor event must apply: %v", err)
+	}
+}
+
+func TestMismatchedRefreshLeavesStoreAlone(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+	if err := mc.InsertEntry(context.Background(), &filer.Entry{
+		FullPath: util.FullPath("/dir/b-keep"),
+		Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(1, 0), Mode: 0100644, FileSize: 1},
+	}, 0); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	// a range the table does not have: the reconcile must not touch the store
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh: &sectionRefresh{hi: "q", snapshotTsNs: 5000, entries: []*filer.Entry{{
+			FullPath: util.FullPath("/dir/b-new"),
+			Attr:     filer.Attr{Crtime: time.Unix(2, 0), Mtime: time.Unix(2, 0), Mode: 0100644, FileSize: 3},
+		}}},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-new")); err != filer_pb.ErrNotFound {
+		t.Fatalf("mismatched refresh inserted an entry: %v", err)
+	}
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-keep")); err != nil {
+		t.Fatalf("mismatched refresh swept an entry: %v", err)
+	}
+	if mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("mismatched refresh must not mark anything fresh")
+	}
+}
+
+func TestRefreshClearsUnversionedMarker(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+	mc.SetPinnedChildFn(func(entry *filer.Entry) bool {
+		return entry.Name() == "b-pin"
+	})
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, nil)
+	for _, name := range []string{"b-local", "b-pin"} {
+		if err := mc.InsertEntry(context.Background(), &filer.Entry{
+			FullPath: util.FullPath("/dir/" + name),
+			Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(1, 0), Mode: 0100644, FileSize: 1},
+		}, 0); err != nil { // versionTsNs 0 leaves the unversioned marker
+			t.Fatalf("seed %s: %v", name, err)
+		}
+	}
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	refreshed := func(name string) *filer.Entry {
+		return &filer.Entry{
+			FullPath: util.FullPath("/dir/" + name),
+			Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(2, 0), Mode: 0100644, FileSize: 7},
+		}
+	}
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh:   &sectionRefresh{snapshotTsNs: 5000, entries: []*filer.Entry{refreshed("b-local"), refreshed("b-pin")}},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	entry, versionTsNs, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-local"))
+	if err != nil || entry.FileSize != 7 {
+		t.Fatalf("b-local = %+v, %v; want the snapshot's size 7", entry, err)
+	}
+	if versionTsNs != 5000 {
+		t.Fatalf("b-local version = %d, want the floor 5000 once the marker is cleared", versionTsNs)
+	}
+
+	// a delayed event below the floor must not roll the snapshot write back
+	if err := mc.ApplyMetadataResponse(context.Background(), &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{
+				Name:       "b-local",
+				Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 3, FileMode: 0100644, FileSize: 9},
+			},
+		},
+		TsNs: 4000,
+	}, SubscriberMetadataResponseApplyOptions); err != nil {
+		t.Fatalf("apply delayed event: %v", err)
+	}
+	if entry, _, err = mc.FindEntry(context.Background(), util.FullPath("/dir/b-local")); err != nil || entry.FileSize != 7 {
+		t.Fatalf("b-local rolled back to %+v, %v", entry, err)
+	}
+
+	// pinned local-only state is neither replaced nor unmarked
+	entry, versionTsNs, err = mc.FindEntry(context.Background(), util.FullPath("/dir/b-pin"))
+	if err != nil || entry.FileSize != 1 {
+		t.Fatalf("b-pin = %+v, %v; want local size 1 kept", entry, err)
+	}
+	if versionTsNs != 0 {
+		t.Fatalf("b-pin version = %d, want 0 while pinned", versionTsNs)
+	}
+}
+
+func TestRefreshSkipsBuildingDirectory(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, nil)
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	// a rebuild is streaming: its inserts must survive a refresh's sweep
+	if err := mc.BeginDirectoryBuild(context.Background(), util.FullPath("/dir")); err != nil {
+		t.Fatalf("begin build: %v", err)
+	}
+	if err := mc.InsertEntry(context.Background(), &filer.Entry{
+		FullPath: util.FullPath("/dir/b-built"),
+		Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(1, 0), Mode: 0100644, FileSize: 1},
+	}, 0); err != nil {
+		t.Fatalf("insert mid-build: %v", err)
+	}
+
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh:   &sectionRefresh{snapshotTsNs: 5000},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-built")); err != nil {
+		t.Fatalf("refresh swept a mid-build insert: %v", err)
+	}
+	if mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("a skipped refresh must not mark the section fresh")
+	}
+	if err := mc.AbortDirectoryBuild(context.Background(), util.FullPath("/dir")); err != nil {
+		t.Fatalf("abort build: %v", err)
+	}
+}
+
+// TestSectionBorderEntries pins the border semantics: a bound-named entry
+// belongs to the section starting at the bound, a refresh sweeps [lo, hi)
+// inclusive of lo and exclusive of hi, and the neighboring sections' entries
+// come through untouched.
+func TestSectionBorderEntries(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"g", "p"})
+	for _, name := range []string{"g", "h", "p"} {
+		if err := mc.InsertEntry(context.Background(), &filer.Entry{
+			FullPath: util.FullPath("/dir/" + name),
+			Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(1, 0), Mode: 0100644, FileSize: 1},
+		}, 0); err != nil {
+			t.Fatalf("seed %s: %v", name, err)
+		}
+	}
+	applyChurn(t, mc, "/dir", "a-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+	applyChurn(t, mc, "/dir", "h-", sectionHotThreshold, 3000, SubscriberMetadataResponseApplyOptions)
+
+	// the bound name is part of the section starting at it
+	if mc.IsNameFresh(util.FullPath("/dir/a-000")) || mc.IsNameFresh(util.FullPath("/dir/g")) {
+		t.Fatal("both churned sections should be stale")
+	}
+
+	// refreshing [ , g) sweeps its churn but must not reach the bound entry
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh:   &sectionRefresh{hi: "g", snapshotTsNs: 5000},
+	}); err != nil {
+		t.Fatalf("refresh section 0: %v", err)
+	}
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/a-000")); err != filer_pb.ErrNotFound {
+		t.Fatalf("churned a-000 should be swept: %v", err)
+	}
+	for _, name := range []string{"g", "h", "p"} {
+		if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/"+name)); err != nil {
+			t.Fatalf("%s swept by the neighboring refresh: %v", name, err)
+		}
+	}
+	if !mc.IsNameFresh(util.FullPath("/dir/a-000")) || mc.IsNameFresh(util.FullPath("/dir/g")) {
+		t.Fatal("only the refreshed section should be fresh")
+	}
+
+	// refreshing [g, p) covers the bound entry itself and stops before p
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh: &sectionRefresh{lo: "g", hi: "p", snapshotTsNs: 5001, entries: []*filer.Entry{{
+			FullPath: util.FullPath("/dir/h"),
+			Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(2, 0), Mode: 0100644, FileSize: 7},
+		}}},
+	}); err != nil {
+		t.Fatalf("refresh section 1: %v", err)
+	}
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/g")); err != filer_pb.ErrNotFound {
+		t.Fatalf("vanished bound entry should be swept by its own section: %v", err)
+	}
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/h-000")); err != filer_pb.ErrNotFound {
+		t.Fatalf("churned h-000 should be swept: %v", err)
+	}
+	if entry, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/h")); err != nil || entry.FileSize != 7 {
+		t.Fatalf("h = %+v, %v; want size 7", entry, err)
+	}
+	if _, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/p")); err != nil {
+		t.Fatalf("the next bound's entry is outside the range and must survive: %v", err)
+	}
+}
+
+func TestChurnBeyondBuiltEntriesLandsInEdgeSection(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+
+	// names sorting past everything the build saw land in the last section
+	applyChurn(t, mc, "/dir", "z-", sectionHotThreshold, 2000, SubscriberMetadataResponseApplyOptions)
+
+	if mc.IsNameFresh(util.FullPath("/dir/z-000")) {
+		t.Fatal("the tail section should be invalidated")
+	}
+	if !mc.IsNameFresh(util.FullPath("/dir/a")) {
+		t.Fatal("the head section must stay fresh")
+	}
+}
+
+func TestRenameAcrossSectionsCountsBoth(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{
+		"/":    true,
+		"/dir": true,
+	})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+
+	for i := 0; i < sectionHotThreshold; i++ {
+		resp := &filer_pb.SubscribeMetadataResponse{
+			Directory: "/dir",
+			EventNotification: &filer_pb.EventNotification{
+				OldEntry: &filer_pb.Entry{Name: fmt.Sprintf("a-%03d", i)},
+				NewEntry: &filer_pb.Entry{
+					Name:       fmt.Sprintf("n-%03d", i),
+					Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 1},
+				},
+				NewParentPath: "/dir",
+			},
+			TsNs: 2000 + int64(i),
+		}
+		if err := mc.ApplyMetadataResponse(context.Background(), resp, SubscriberMetadataResponseApplyOptions); err != nil {
+			t.Fatalf("apply rename %d: %v", i, err)
+		}
+	}
+
+	if mc.IsNameFresh(util.FullPath("/dir/a-000")) {
+		t.Fatal("the vacated side's section should be invalidated")
+	}
+	if mc.IsNameFresh(util.FullPath("/dir/n-000")) {
+		t.Fatal("the landing side's section should be invalidated")
+	}
+}
+
+// A refresh sweeps the names its listing did not return. One recorded at
+// exactly the snapshot has its write reflected but not its removal, so reading
+// the gate as a write left it cached for good.
+func TestSectionRefreshSweepsANameRecordedAtTheSnapshot(t *testing.T) {
+	mc, _, _, _ := newTestMetaCache(t, map[util.FullPath]bool{"/": true, "/dir": true})
+	defer mc.Shutdown()
+
+	buildSectionedDir(t, mc, util.FullPath("/dir"), 1000, []string{"m"})
+
+	const snapshotTsNs = 5000
+	if err := mc.ApplyMetadataResponse(context.Background(), &filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{
+				Name:       "b-vanish",
+				Attributes: &filer_pb.FuseAttributes{Crtime: 1, Mtime: 1, FileMode: 0100644, FileSize: 3},
+			},
+		},
+		TsNs: snapshotTsNs,
+	}, SubscriberMetadataResponseApplyOptions); err != nil {
+		t.Fatalf("seed at the snapshot version: %v", err)
+	}
+
+	if err := mc.enqueueAndWait(context.Background(), metadataApplyRequest{
+		kind:      metadataSectionRefresh,
+		buildPath: util.FullPath("/dir"),
+		refresh: &sectionRefresh{
+			hi: "m",
+			entries: []*filer.Entry{
+				{
+					FullPath: util.FullPath("/dir/b-keep"),
+					Attr:     filer.Attr{Crtime: time.Unix(1, 0), Mtime: time.Unix(2, 0), Mode: 0100644, FileSize: 7},
+				},
+			},
+			snapshotTsNs: snapshotTsNs,
+		},
+	}); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	if entry, _, err := mc.FindEntry(context.Background(), util.FullPath("/dir/b-vanish")); err == nil && entry != nil {
+		t.Error("a name the refresh did not list is still cached")
+	}
+}
diff --git a/weed/mount/meta_cache/meta_cache_subscribe.go b/weed/mount/meta_cache/meta_cache_subscribe.go
index 18b35446ce..added6f46f 100644
--- a/weed/mount/meta_cache/meta_cache_subscribe.go
+++ b/weed/mount/meta_cache/meta_cache_subscribe.go
@@ -10,6 +10,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 )
 
 type MetadataFollower struct {
@@ -44,7 +45,7 @@ func mergeProcessors(mainProcessor func(resp *filer_pb.SubscribeMetadataResponse
 	}
 }
 
-func SubscribeMetaEvents(mc *MetaCache, selfSignature int32, client filer_pb.FilerClient, dir string, lastTsNs int64, skipSelfEvents bool, onRetry func(lastTsNs int64, err error), followers ...*MetadataFollower) error {
+func SubscribeMetaEvents(mc *MetaCache, selfSignature int32, client filer_pb.FilerClient, lookupFn wdclient.LookupFileIdFunctionType, dir string, lastTsNs int64, skipSelfEvents bool, onRetry func(lastTsNs int64, err error), followers ...*MetadataFollower) error {
 
 	var prefixes []string
 	for _, follower := range followers {
@@ -68,9 +69,9 @@ func SubscribeMetaEvents(mc *MetaCache, selfSignature int32, client filer_pb.Fil
 		prefix = prefix + "/"
 	}
 
-	// Read persisted log chunks directly from volume servers, keeping the replay
-	// cost off the filer's heap (see LogFileReaderFn below).
-	lookupFn := filer.LookupFn(client)
+	// Replaying the persisted log chunks here keeps the cost off the filer's heap.
+	// The caller's lookup says where to read them from, so a mount that cannot
+	// reach volume servers directly still replays through its filer.
 	metadataFollowOption := &pb.MetadataFollowOption{
 		ClientName:             "mount",
 		ClientId:               selfSignature,
diff --git a/weed/mount/meta_cache/oversized_dir_test.go b/weed/mount/meta_cache/oversized_dir_test.go
index 4edb87ba07..2c3ed5048b 100644
--- a/weed/mount/meta_cache/oversized_dir_test.go
+++ b/weed/mount/meta_cache/oversized_dir_test.go
@@ -37,7 +37,7 @@ func TestEnsureVisitedRefusesOversizedDirectory(t *testing.T) {
 
 	accessor := &buildFilerAccessor{client: &buildListClient{responses: listResponses(10)}}
 
-	err := EnsureVisited(mc, accessor, util.FullPath("/dir"), 5)
+	err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/dir"), 5)
 	var tooLarge *DirectoryTooLargeError
 	if !errors.As(err, &tooLarge) {
 		t.Fatalf("EnsureVisited = %v, want DirectoryTooLargeError", err)
@@ -61,7 +61,7 @@ func TestEnsureVisitedRefusesOversizedDirectory(t *testing.T) {
 	}
 
 	// A second visit fails fast without streaming to the limit again.
-	if err := EnsureVisited(mc, accessor, util.FullPath("/dir"), 5); !errors.As(err, &tooLarge) {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/dir"), 5); !errors.As(err, &tooLarge) {
 		t.Fatalf("second EnsureVisited = %v, want DirectoryTooLargeError", err)
 	}
 }
@@ -74,7 +74,7 @@ func TestEnsureVisitedStepsOverOversizedAncestor(t *testing.T) {
 	mc.markOversized(util.FullPath("/huge"))
 
 	accessor := &buildFilerAccessor{client: &buildListClient{responses: listResponses(3)}}
-	if err := EnsureVisited(mc, accessor, util.FullPath("/huge/sub"), 5); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/huge/sub"), 5); err != nil {
 		t.Fatalf("EnsureVisited under an oversized ancestor: %v", err)
 	}
 	if !mc.IsDirectoryCached(util.FullPath("/huge/sub")) {
@@ -92,7 +92,7 @@ func TestEnsureVisitedUnderTheLimitStillCaches(t *testing.T) {
 	defer mc.Shutdown()
 
 	accessor := &buildFilerAccessor{client: &buildListClient{responses: listResponses(5)}}
-	if err := EnsureVisited(mc, accessor, util.FullPath("/dir"), 5); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/dir"), 5); err != nil {
 		t.Fatalf("EnsureVisited: %v", err)
 	}
 	if !mc.IsDirectoryCached(util.FullPath("/dir")) {
@@ -123,7 +123,7 @@ func TestEnsureVisitedAncestorFoundOversizedMidVisit(t *testing.T) {
 		"/huge/sub": listResponses(3),
 	}}}
 
-	if err := EnsureVisited(mc, accessor, util.FullPath("/huge/sub"), 5); err != nil {
+	if err := EnsureVisited(context.Background(), mc, accessor, util.FullPath("/huge/sub"), 5); err != nil {
 		t.Fatalf("EnsureVisited: %v", err)
 	}
 	if !mc.IsDirectoryCached(util.FullPath("/huge/sub")) {
diff --git a/weed/mount/page_writer.go b/weed/mount/page_writer.go
index 4fb1d773b9..81f197c737 100644
--- a/weed/mount/page_writer.go
+++ b/weed/mount/page_writer.go
@@ -53,6 +53,10 @@ func (pw *PageWriter) FlushData() error {
 	return pw.randomWriter.FlushData()
 }
 
+func (pw *PageWriter) HasWrites() bool {
+	return pw.randomWriter.HasWrites()
+}
+
 func (pw *PageWriter) ReadDirtyDataAt(data []byte, offset int64, tsNs int64) (maxStop int64) {
 	glog.V(4).Infof("ReadDirtyDataAt %v [%d, %d)", pw.fh.inode, offset, offset+int64(len(data)))
 
diff --git a/weed/mount/page_writer/dirty_pages.go b/weed/mount/page_writer/dirty_pages.go
index 04a5f4dc05..33ec7adb83 100644
--- a/weed/mount/page_writer/dirty_pages.go
+++ b/weed/mount/page_writer/dirty_pages.go
@@ -3,6 +3,7 @@ package page_writer
 type DirtyPages interface {
 	AddPage(offset int64, data []byte, isSequential bool, tsNs int64) error
 	FlushData() error
+	HasWrites() bool
 	ReadDirtyDataAt(data []byte, startOffset int64, tsNs int64) (maxStop int64)
 	Destroy()
 	LockForRead(startOffset, stopOffset int64)
diff --git a/weed/mount/peer_fetcher.go b/weed/mount/peer_fetcher.go
index 87d816c1fd..ad95e42fa1 100644
--- a/weed/mount/peer_fetcher.go
+++ b/weed/mount/peer_fetcher.go
@@ -65,7 +65,7 @@ func (fh *FileHandle) tryPeerRead(ctx context.Context, fileSize int64, buff []by
 	if readStop > fileSize {
 		readStop = fileSize
 	}
-	dataChunks, _, err := filer.ResolveChunkManifest(ctx, fh.wfs.LookupFn(), chunks, offset, readStop)
+	dataChunks, _, err := filer.ResolveChunkManifest(ctx, fh.wfs.LookupFn(), chunks, offset, readStop, fh.wfs.CacheInvalidator())
 	if err != nil {
 		return 0, 0, fmt.Errorf("resolve manifest: %w", err)
 	}
diff --git a/weed/mount/peer_registrar_test.go b/weed/mount/peer_registrar_test.go
index 7fee73d9bd..21cb7ac7f2 100644
--- a/weed/mount/peer_registrar_test.go
+++ b/weed/mount/peer_registrar_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
 )
 
 // fakeFilerClient captures MountRegister/MountList calls and lets the test
@@ -17,22 +18,21 @@ type fakeFilerClient struct {
 	filer_pb.SeaweedFilerClient // embed for methods we don't need
 
 	mu            sync.Mutex
-	registerCalls []filer_pb.MountRegisterRequest
+	registerCalls []*filer_pb.MountRegisterRequest
 	listResponse  filer_pb.MountListResponse
 }
 
 func (f *fakeFilerClient) MountRegister(ctx context.Context, req *filer_pb.MountRegisterRequest, opts ...grpc.CallOption) (*filer_pb.MountRegisterResponse, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
-	f.registerCalls = append(f.registerCalls, *req)
+	f.registerCalls = append(f.registerCalls, proto.Clone(req).(*filer_pb.MountRegisterRequest))
 	return &filer_pb.MountRegisterResponse{}, nil
 }
 
 func (f *fakeFilerClient) MountList(ctx context.Context, req *filer_pb.MountListRequest, opts ...grpc.CallOption) (*filer_pb.MountListResponse, error) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
-	resp := f.listResponse // value copy
-	return &resp, nil
+	return proto.Clone(&f.listResponse).(*filer_pb.MountListResponse), nil
 }
 
 // fakeFilerFleet maps each addr to its own fakeFilerClient so a test can
diff --git a/weed/mount/rdma_client.go b/weed/mount/rdma_client.go
deleted file mode 100644
index 6a77f8f52e..0000000000
--- a/weed/mount/rdma_client.go
+++ /dev/null
@@ -1,373 +0,0 @@
-package mount
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"strings"
-	"sync/atomic"
-	"time"
-
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/wdclient"
-)
-
-// RDMAMountClient provides RDMA acceleration for SeaweedFS mount operations
-type RDMAMountClient struct {
-	sidecarAddr   string
-	httpClient    *http.Client
-	maxConcurrent int
-	timeout       time.Duration
-	semaphore     chan struct{}
-
-	// Volume lookup
-	lookupFileIdFn wdclient.LookupFileIdFunctionType
-
-	// Statistics
-	totalRequests   atomic.Int64
-	successfulReads atomic.Int64
-	failedReads     atomic.Int64
-	totalBytesRead  atomic.Int64
-	totalLatencyNs  atomic.Int64
-}
-
-// RDMAReadRequest represents a request to read data via RDMA
-type RDMAReadRequest struct {
-	VolumeID uint32 `json:"volume_id"`
-	NeedleID uint64 `json:"needle_id"`
-	Cookie   uint32 `json:"cookie"`
-	Offset   uint64 `json:"offset"`
-	Size     uint64 `json:"size"`
-}
-
-// RDMAReadResponse represents the response from an RDMA read operation
-type RDMAReadResponse struct {
-	Success   bool   `json:"success"`
-	IsRDMA    bool   `json:"is_rdma"`
-	Source    string `json:"source"`
-	Duration  string `json:"duration"`
-	DataSize  int    `json:"data_size"`
-	SessionID string `json:"session_id,omitempty"`
-	ErrorMsg  string `json:"error,omitempty"`
-
-	// Zero-copy optimization fields
-	UseTempFile bool   `json:"use_temp_file"`
-	TempFile    string `json:"temp_file"`
-}
-
-// RDMAHealthResponse represents the health status of the RDMA sidecar
-type RDMAHealthResponse struct {
-	Status string `json:"status"`
-	RDMA   struct {
-		Enabled   bool `json:"enabled"`
-		Connected bool `json:"connected"`
-	} `json:"rdma"`
-	Timestamp string `json:"timestamp"`
-}
-
-// NewRDMAMountClient creates a new RDMA client for mount operations
-func NewRDMAMountClient(sidecarAddr string, lookupFileIdFn wdclient.LookupFileIdFunctionType, maxConcurrent int, timeoutMs int) (*RDMAMountClient, error) {
-	client := &RDMAMountClient{
-		sidecarAddr:   sidecarAddr,
-		maxConcurrent: maxConcurrent,
-		timeout:       time.Duration(timeoutMs) * time.Millisecond,
-		httpClient: &http.Client{
-			Timeout: time.Duration(timeoutMs) * time.Millisecond,
-		},
-		semaphore:      make(chan struct{}, maxConcurrent),
-		lookupFileIdFn: lookupFileIdFn,
-	}
-
-	// Test connectivity and RDMA availability
-	if err := client.healthCheck(); err != nil {
-		return nil, fmt.Errorf("RDMA sidecar health check failed: %w", err)
-	}
-
-	glog.Infof("RDMA mount client initialized: sidecar=%s, maxConcurrent=%d, timeout=%v",
-		sidecarAddr, maxConcurrent, client.timeout)
-
-	return client, nil
-}
-
-// lookupVolumeLocationByFileID finds the best volume server for a given file ID
-func (c *RDMAMountClient) lookupVolumeLocationByFileID(ctx context.Context, fileID string) (string, error) {
-	glog.V(4).Infof("Looking up volume location for file ID %s", fileID)
-
-	targetUrls, err := c.lookupFileIdFn(ctx, fileID)
-	if err != nil {
-		return "", fmt.Errorf("failed to lookup volume for file %s: %w", fileID, err)
-	}
-
-	if len(targetUrls) == 0 {
-		return "", fmt.Errorf("no locations found for file %s", fileID)
-	}
-
-	// Choose the first URL and extract the server address
-	targetUrl := targetUrls[0]
-	// Extract server address from URL like "http://server:port/fileId"
-	parts := strings.Split(targetUrl, "/")
-	if len(parts) < 3 {
-		return "", fmt.Errorf("invalid target URL format: %s", targetUrl)
-	}
-	bestAddress := fmt.Sprintf("http://%s", parts[2])
-
-	glog.V(4).Infof("File %s located at %s", fileID, bestAddress)
-	return bestAddress, nil
-}
-
-// healthCheck verifies that the RDMA sidecar is available and functioning
-func (c *RDMAMountClient) healthCheck() error {
-	ctx, cancel := context.WithTimeout(context.Background(), c.timeout)
-	defer cancel()
-
-	req, err := http.NewRequestWithContext(ctx, "GET",
-		fmt.Sprintf("http://%s/health", c.sidecarAddr), nil)
-	if err != nil {
-		return fmt.Errorf("failed to create health check request: %w", err)
-	}
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("health check request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("health check failed with status: %s", resp.Status)
-	}
-
-	// Parse health response
-	var health RDMAHealthResponse
-	if err := json.NewDecoder(resp.Body).Decode(&health); err != nil {
-		return fmt.Errorf("failed to parse health response: %w", err)
-	}
-
-	if health.Status != "healthy" {
-		return fmt.Errorf("sidecar reports unhealthy status: %s", health.Status)
-	}
-
-	if !health.RDMA.Enabled {
-		return fmt.Errorf("RDMA is not enabled on sidecar")
-	}
-
-	if !health.RDMA.Connected {
-		glog.Warningf("RDMA sidecar is healthy but not connected to RDMA engine")
-	}
-
-	return nil
-}
-
-// ReadNeedle reads data from a specific needle using RDMA acceleration
-func (c *RDMAMountClient) ReadNeedle(ctx context.Context, fileID string, offset, size uint64) ([]byte, bool, error) {
-	// Acquire semaphore for concurrency control
-	select {
-	case c.semaphore <- struct{}{}:
-		defer func() { <-c.semaphore }()
-	case <-ctx.Done():
-		return nil, false, ctx.Err()
-	}
-
-	c.totalRequests.Add(1)
-	startTime := time.Now()
-
-	// Lookup volume location using file ID directly
-	volumeServer, err := c.lookupVolumeLocationByFileID(ctx, fileID)
-	if err != nil {
-		c.failedReads.Add(1)
-		return nil, false, fmt.Errorf("failed to lookup volume for file %s: %w", fileID, err)
-	}
-
-	// Prepare request URL with file_id parameter (simpler than individual components)
-	reqURL := fmt.Sprintf("http://%s/read?file_id=%s&offset=%d&size=%d&volume_server=%s",
-		c.sidecarAddr, fileID, offset, size, volumeServer)
-
-	req, err := http.NewRequestWithContext(ctx, "GET", reqURL, nil)
-	if err != nil {
-		c.failedReads.Add(1)
-		return nil, false, fmt.Errorf("failed to create RDMA request: %w", err)
-	}
-
-	// Execute request
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		c.failedReads.Add(1)
-		return nil, false, fmt.Errorf("RDMA request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	duration := time.Since(startTime)
-	c.totalLatencyNs.Add(duration.Nanoseconds())
-
-	if resp.StatusCode != http.StatusOK {
-		c.failedReads.Add(1)
-		body, _ := io.ReadAll(resp.Body)
-		return nil, false, fmt.Errorf("RDMA read failed with status %s: %s", resp.Status, string(body))
-	}
-
-	// Check if response indicates RDMA was used
-	contentType := resp.Header.Get("Content-Type")
-	isRDMA := strings.Contains(resp.Header.Get("X-Source"), "rdma") ||
-		resp.Header.Get("X-RDMA-Used") == "true"
-
-	// Check for zero-copy temp file optimization
-	tempFilePath := resp.Header.Get("X-Temp-File")
-	useTempFile := resp.Header.Get("X-Use-Temp-File") == "true"
-
-	var data []byte
-
-	var n int
-	if useTempFile && tempFilePath != "" {
-		// Zero-copy path: read from temp file (page cache)
-		glog.V(4).Infof("🔥 Using zero-copy temp file: %s", tempFilePath)
-
-		// Allocate buffer for temp file read
-		var bufferSize uint64 = 1024 * 1024 // Default 1MB
-		if size > 0 {
-			bufferSize = size
-		}
-		buffer := make([]byte, bufferSize)
-
-		n, err = c.readFromTempFile(tempFilePath, buffer)
-		if err != nil {
-			glog.V(2).Infof("Zero-copy failed, falling back to HTTP body: %v", err)
-			// Fall back to reading HTTP body
-			data, err = io.ReadAll(resp.Body)
-		} else {
-			data = buffer[:n]
-			glog.V(4).Infof("🔥 Zero-copy successful: %d bytes from page cache", n)
-		}
-
-		// Important: Cleanup temp file after reading (consumer responsibility)
-		// This prevents accumulation of temp files in /tmp/rdma-cache
-		go c.cleanupTempFile(tempFilePath)
-	} else {
-		// Regular path: read from HTTP response body
-		data, err = io.ReadAll(resp.Body)
-	}
-
-	if err != nil {
-		c.failedReads.Add(1)
-		return nil, false, fmt.Errorf("failed to read RDMA response: %w", err)
-	}
-
-	c.successfulReads.Add(1)
-	c.totalBytesRead.Add(int64(len(data)))
-
-	// Log successful operation
-	glog.V(4).Infof("RDMA read completed: fileID=%s, size=%d, duration=%v, rdma=%v, contentType=%s",
-		fileID, size, duration, isRDMA, contentType)
-
-	return data, isRDMA, nil
-}
-
-// cleanupTempFile requests cleanup of a temp file from the sidecar
-func (c *RDMAMountClient) cleanupTempFile(tempFilePath string) {
-	if tempFilePath == "" {
-		return
-	}
-
-	// Give the page cache a brief moment to be utilized before cleanup
-	// This preserves the zero-copy performance window
-	time.Sleep(100 * time.Millisecond)
-
-	// Call sidecar cleanup endpoint
-	cleanupURL := fmt.Sprintf("http://%s/cleanup?temp_file=%s", c.sidecarAddr, url.QueryEscape(tempFilePath))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	req, err := http.NewRequestWithContext(ctx, "DELETE", cleanupURL, nil)
-	if err != nil {
-		glog.V(2).Infof("Failed to create cleanup request for %s: %v", tempFilePath, err)
-		return
-	}
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		glog.V(2).Infof("Failed to cleanup temp file %s: %v", tempFilePath, err)
-		return
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode == http.StatusOK {
-		glog.V(4).Infof("🧹 Temp file cleaned up: %s", tempFilePath)
-	} else {
-		glog.V(2).Infof("Cleanup failed for %s: status %s", tempFilePath, resp.Status)
-	}
-}
-
-// GetStats returns current RDMA client statistics
-func (c *RDMAMountClient) GetStats() map[string]interface{} {
-	totalRequests := c.totalRequests.Load()
-	successfulReads := c.successfulReads.Load()
-	failedReads := c.failedReads.Load()
-	totalBytesRead := c.totalBytesRead.Load()
-	totalLatencyNs := c.totalLatencyNs.Load()
-
-	successRate := float64(0)
-	avgLatencyNs := int64(0)
-
-	if totalRequests > 0 {
-		successRate = float64(successfulReads) / float64(totalRequests) * 100
-		avgLatencyNs = totalLatencyNs / totalRequests
-	}
-
-	return map[string]interface{}{
-		"sidecar_addr":     c.sidecarAddr,
-		"max_concurrent":   c.maxConcurrent,
-		"timeout_ms":       int(c.timeout / time.Millisecond),
-		"total_requests":   totalRequests,
-		"successful_reads": successfulReads,
-		"failed_reads":     failedReads,
-		"success_rate_pct": fmt.Sprintf("%.1f", successRate),
-		"total_bytes_read": totalBytesRead,
-		"avg_latency_ns":   avgLatencyNs,
-		"avg_latency_ms":   fmt.Sprintf("%.3f", float64(avgLatencyNs)/1000000),
-	}
-}
-
-// Close shuts down the RDMA client and releases resources
-func (c *RDMAMountClient) Close() error {
-	// No need to close semaphore channel; closing it may cause panics if goroutines are still using it.
-	// The semaphore will be garbage collected when the client is no longer referenced.
-
-	// Log final statistics
-	stats := c.GetStats()
-	glog.Infof("RDMA mount client closing: %+v", stats)
-
-	return nil
-}
-
-// IsHealthy checks if the RDMA sidecar is currently healthy
-func (c *RDMAMountClient) IsHealthy() bool {
-	err := c.healthCheck()
-	return err == nil
-}
-
-// readFromTempFile performs zero-copy read from temp file using page cache
-func (c *RDMAMountClient) readFromTempFile(tempFilePath string, buffer []byte) (int, error) {
-	if tempFilePath == "" {
-		return 0, fmt.Errorf("empty temp file path")
-	}
-
-	// Open temp file for reading
-	file, err := os.Open(tempFilePath)
-	if err != nil {
-		return 0, fmt.Errorf("failed to open temp file %s: %w", tempFilePath, err)
-	}
-	defer file.Close()
-
-	// Read from temp file (this should be served from page cache)
-	n, err := file.Read(buffer)
-	if err != nil && err != io.EOF {
-		return n, fmt.Errorf("failed to read from temp file: %w", err)
-	}
-
-	glog.V(4).Infof("🔥 Zero-copy read: %d bytes from temp file %s", n, tempFilePath)
-
-	return n, nil
-}
diff --git a/weed/mount/weedfs.go b/weed/mount/weedfs.go
index 4cb68706e4..7ee15a2eed 100644
--- a/weed/mount/weedfs.go
+++ b/weed/mount/weedfs.go
@@ -3,6 +3,7 @@ package mount
 import (
 	"bytes"
 	"context"
+	"errors"
 	"math/rand/v2"
 	"os"
 	"path"
@@ -29,6 +30,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/chunk_cache"
 	"github.com/seaweedfs/seaweedfs/weed/util/grace"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 	"github.com/seaweedfs/seaweedfs/weed/util/version"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 )
@@ -48,6 +50,7 @@ type Option struct {
 	ChunkSizeLimit              int64
 	ConcurrentWriters           int
 	ConcurrentReaders           int
+	ReaderCacheSizeMB           int64
 	CacheDirForRead             string
 	CacheSizeMBForRead          int64
 	CacheDirForWrite            string
@@ -87,14 +90,6 @@ type Option struct {
 	// This protects chunks from being purged by volume.fsck for long-running writes
 	MetadataFlushSeconds int
 
-	// RDMA acceleration options
-	RdmaEnabled       bool
-	RdmaSidecarAddr   string
-	RdmaFallback      bool
-	RdmaReadOnly      bool
-	RdmaMaxConcurrent int
-	RdmaTimeoutMs     int
-
 	// Peer chunk sharing options (design-weed-mount-peer-chunk-sharing.md).
 	// When PeerEnabled is false (default), the mount runs exactly as today.
 	// One gRPC port carries everything: directory RPCs (ChunkAnnounce /
@@ -120,6 +115,13 @@ type Option struct {
 	// When true, Flush() returns immediately and data upload + metadata flush happen in background.
 	WritebackCache bool
 
+	// EagerFilerCreate persists a created file's entry at create time instead
+	// of deferring it to flush. Deferring is only safe when the flush runs
+	// before the application's close returns; a platform that cannot
+	// guarantee that sets this so listings and reopens through the filer
+	// cannot race an unflushed close.
+	EagerFilerCreate bool
+
 	// PosixDirNlink enables POSIX-compliant directory nlink counting
 	// (nlink = 2 + number_of_subdirectories). This requires listing
 	// cached directory entries on every stat, which has a performance cost.
@@ -139,8 +141,11 @@ type WFS struct {
 	metaCache             *meta_cache.MetaCache
 	stats                 statsCache
 	chunkCache            *chunk_cache.TieredChunkCache
+	readerCacheBudget     *filer.ReaderCacheBudget
+	manifestCache         *filer.ChunkManifestCache
 	writeBufferAccountant *page_writer.WriteBufferAccountant
 	signature             int32
+	filerCallTimeout      time.Duration // bounds one filer call; tests only, 0 = filerRPCTimeout
 	concurrentWriters     *util.LimitedConcurrentExecutor
 	copyBufferPool        sync.Pool
 	concurrentCopiersSem  chan struct{}
@@ -155,7 +160,6 @@ type WFS struct {
 	posixSid              uint64             // this mount's session id, for routed-lock owner identity
 	posixHint             *posixLockHint     // local fcntl-lock hint for routed mode
 	posixOwn              *posixlock.Manager // mirror of locks this mount holds, re-asserted via keepalive
-	rdmaClient            *RDMAMountClient
 	peerRegistrar         *PeerRegistrar
 	peerDirectory         *PeerDirectory
 	peerGrpcServer        *PeerGrpcServer
@@ -170,10 +174,10 @@ type WFS struct {
 	atimeMap              map[uint64]time.Time // inode -> atime, in-memory only, bounded
 	dirMtimeMu            sync.Mutex
 	dirMtimeMap           map[uint64]time.Time // inode -> mtime/ctime, in-memory overlay for dirs
-	entryValidSec         uint64               // kernel FUSE entry cache TTL in seconds
-	attrValidSec          uint64               // kernel FUSE attr cache TTL in seconds
-	dirHotWindow          time.Duration
-	dirHotThreshold       int
+	removedDirMu          sync.Mutex
+	removedDirs           map[uint64]*filer_pb.Entry // inode -> last-known entry of a directory removed while still referenced
+	entryValidSec         uint64                     // kernel FUSE entry cache TTL in seconds
+	attrValidSec          uint64                     // kernel FUSE attr cache TTL in seconds
 	dirIdleEvict          time.Duration
 
 	// openMtimeCache maps inode -> [mtime_sec, mtime_ns] from the last Open.
@@ -215,11 +219,7 @@ type WFS struct {
 	lockClient *cluster.LockClient
 }
 
-const (
-	defaultDirHotWindow    = 2 * time.Second
-	defaultDirHotThreshold = 64
-	defaultDirIdleEvict    = 10 * time.Minute
-)
+const defaultDirIdleEvict = 10 * time.Minute
 
 func NewSeaweedFileSystem(option *Option) *WFS {
 	// Only create FilerClient for direct volume access modes
@@ -244,8 +244,6 @@ func NewSeaweedFileSystem(option *Option) *WFS {
 		)
 	}
 
-	dirHotWindow := defaultDirHotWindow
-	dirHotThreshold := defaultDirHotThreshold
 	dirIdleEvict := defaultDirIdleEvict
 	if option.DirIdleEvictSec != 0 {
 		dirIdleEvict = time.Duration(option.DirIdleEvictSec) * time.Second
@@ -256,6 +254,8 @@ func NewSeaweedFileSystem(option *Option) *WFS {
 	wfs := &WFS{
 		RawFileSystem:     fuse.NewDefaultRawFileSystem(),
 		option:            option,
+		readerCacheBudget: filer.NewReaderCacheBudget(option.ReaderCacheSizeMB << 20),
+		manifestCache:     filer.NewChunkManifestCache(filer.MaxMountChunkManifestCacheEntries, filer.MaxMountChunkManifestCacheBytes),
 		signature:         util.RandomInt32(),
 		inodeToPath:       NewInodeToPath(util.FullPath(option.FilerMountRootPath), option.CacheMetaTTlSec),
 		fhMap:             NewFileHandleToInode(),
@@ -274,8 +274,6 @@ func NewSeaweedFileSystem(option *Option) *WFS {
 		dirMtimeMap:       make(map[uint64]time.Time, 1024),
 		entryValidSec:     1,
 		attrValidSec:      1,
-		dirHotWindow:      dirHotWindow,
-		dirHotThreshold:   dirHotThreshold,
 		dirIdleEvict:      dirIdleEvict,
 	}
 
@@ -311,11 +309,7 @@ func NewSeaweedFileSystem(option *Option) *WFS {
 			wfs.inodeToPath.MarkChildrenCached(path)
 		}, func(path util.FullPath) bool {
 			return wfs.inodeToPath.IsChildrenCached(path)
-		}, wfs.onEntryInvalidation, func(dirPath util.FullPath) {
-			if wfs.inodeToPath.RecordDirectoryUpdate(dirPath, time.Now(), wfs.dirHotWindow, wfs.dirHotThreshold) {
-				wfs.markDirectoryReadThrough(dirPath)
-			}
-		})
+		}, wfs.onEntryInvalidation, nil)
 	wfs.metaCache.SetPinnedChildFn(wfs.isLocalOnlyEntry)
 	grace.OnInterrupt(func() {
 		// grace calls os.Exit(0) after all hooks, so WaitForAsyncFlush
@@ -345,9 +339,6 @@ func NewSeaweedFileSystem(option *Option) *WFS {
 			os.RemoveAll(option.getUniqueCacheDirForWrite())
 		}
 		os.RemoveAll(option.getUniqueCacheDirForRead())
-		if wfs.rdmaClient != nil {
-			wfs.rdmaClient.Close()
-		}
 		if wfs.peerAnnouncer != nil {
 			wfs.peerAnnouncer.Stop()
 		}
@@ -370,23 +361,6 @@ func NewSeaweedFileSystem(option *Option) *WFS {
 		}
 	})
 
-	// Initialize RDMA client if enabled
-	if option.RdmaEnabled && option.RdmaSidecarAddr != "" {
-		rdmaClient, err := NewRDMAMountClient(
-			option.RdmaSidecarAddr,
-			wfs.LookupFn(),
-			option.RdmaMaxConcurrent,
-			option.RdmaTimeoutMs,
-		)
-		if err != nil {
-			glog.Warningf("Failed to initialize RDMA client: %v", err)
-		} else {
-			wfs.rdmaClient = rdmaClient
-			glog.Infof("RDMA acceleration enabled: sidecar=%s, maxConcurrent=%d, timeout=%dms",
-				option.RdmaSidecarAddr, option.RdmaMaxConcurrent, option.RdmaTimeoutMs)
-		}
-	}
-
 	// Peer chunk sharing: register with every configured filer's mount
 	// registry + start the single gRPC server that handles ChunkAnnounce /
 	// ChunkLookup / FetchChunk. Broadcasting registration to the full
@@ -500,7 +474,7 @@ func (wfs *WFS) StartBackgroundTasks() error {
 	}
 
 	startTime := time.Now()
-	go meta_cache.SubscribeMetaEvents(wfs.metaCache, wfs.signature, wfs, wfs.option.FilerMountRootPath, startTime.UnixNano(), wfs.option.WritebackCache, func(lastTsNs int64, err error) {
+	go meta_cache.SubscribeMetaEvents(wfs.metaCache, wfs.signature, wfs, wfs.LookupFn(), wfs.option.FilerMountRootPath, startTime.UnixNano(), wfs.option.WritebackCache, func(lastTsNs int64, err error) {
 		glog.Warningf("meta events follow retry from %v: %v", time.Unix(0, lastTsNs), err)
 		// A subscription gap may have dropped events, so distrust every cached
 		// listing. Reset the flags first (safe — it never deletes entries), then
@@ -528,21 +502,48 @@ func (wfs *WFS) Init(server *fuse.Server) {
 	wfs.fuseServer = server
 }
 
-func (wfs *WFS) maybeReadEntry(inode uint64) (path util.FullPath, fh *FileHandle, entry *filer_pb.Entry, status fuse.Status) {
-	path, status = wfs.inodeToPath.GetPath(inode)
-	if status != fuse.OK {
-		return
+// ctxFromCancel bridges a FUSE request's interrupt channel into a context so
+// metadata lookups can abandon a stalled filer call when the kernel has given
+// up on the operation.
+func ctxFromCancel(cancel <-chan struct{}) (context.Context, context.CancelFunc) {
+	ctx, cancelFunc := context.WithCancel(context.Background())
+	if cancel == nil {
+		return ctx, cancelFunc
 	}
+	go func() {
+		select {
+		case <-cancel:
+			cancelFunc()
+		case <-ctx.Done():
+		}
+	}()
+	return ctx, cancelFunc
+}
+
+// maybeReadEntry resolves an inode to the entry metadata operations act on. An
+// open handle answers ahead of the path: unlink drops the name while the
+// descriptor stays valid, so an unlinked-but-open file returns its handle's
+// entry with an empty path instead of ENOENT. A removed directory has no
+// handle; its remembered entry answers the same way.
+func (wfs *WFS) maybeReadEntry(ctx context.Context, inode uint64) (path util.FullPath, fh *FileHandle, entry *filer_pb.Entry, status fuse.Status) {
 	var found bool
 	if fh, found = wfs.fhMap.FindFileHandle(inode); found {
+		path, _ = wfs.inodeToPath.GetPath(inode)
 		entry = fh.UpdateEntry(func(entry *filer_pb.Entry) {
 			if entry != nil && fh.entry.Attributes == nil {
 				entry.Attributes = &filer_pb.FuseAttributes{}
 			}
 		})
-	} else {
-		entry, _, status = wfs.maybeLoadEntry(path)
+		return path, fh, entry, fuse.OK
 	}
+	path, status = wfs.inodeToPath.GetPath(inode)
+	if status != fuse.OK {
+		if entry = wfs.removedDirEntry(inode); entry != nil {
+			return "", nil, entry, fuse.OK
+		}
+		return
+	}
+	entry, _, status = wfs.maybeLoadEntry(ctx, path)
 	return
 }
 
@@ -571,7 +572,7 @@ func (wfs *WFS) isLocalOnlyEntry(entry *filer.Entry) bool {
 
 // maybeLoadEntry returns the entry and the log position it reflects, or a zero
 // position when unknown.
-func (wfs *WFS) maybeLoadEntry(fullpath util.FullPath) (*filer_pb.Entry, entryVersion, fuse.Status) {
+func (wfs *WFS) maybeLoadEntry(ctx context.Context, fullpath util.FullPath) (*filer_pb.Entry, entryVersion, fuse.Status) {
 	// glog.V(3).Infof("read entry cache miss %s", fullpath)
 	_, name := fullpath.DirAndName()
 
@@ -590,25 +591,55 @@ func (wfs *WFS) maybeLoadEntry(fullpath util.FullPath) (*filer_pb.Entry, entryVe
 		}, entryVersion{}, fuse.OK
 	}
 
-	entry, version, status := wfs.lookupEntry(fullpath)
+	entry, version, status := wfs.lookupEntry(ctx, fullpath)
 	if status != fuse.OK {
 		return nil, entryVersion{}, status
 	}
 	return entry.ToProtoEntry(), version, fuse.OK
 }
 
+// expiredDirRebuildCooldown limits how often a lookup re-attempts a failed
+// rebuild of an expired directory, so a transient listing failure does not
+// trigger a full rebuild (with backoff retries) on every later lookup while
+// still allowing recovery once the filer is healthy again.
+const expiredDirRebuildCooldown = 30 * time.Second
+
 // lookupEntry looks up an entry by path, checking the local cache first.
 // Cached metadata is only authoritative when the parent directory itself is cached.
 // For uncached/read-through directories, always consult the filer directly so stale
 // local entries do not leak back into lookup results.
 // It also returns the log position the entry reflects: the entry's stored
 // version, the lookup response's, or zero if unknown.
-func (wfs *WFS) lookupEntry(fullpath util.FullPath) (*filer.Entry, entryVersion, fuse.Status) {
+func (wfs *WFS) lookupEntry(ctx context.Context, fullpath util.FullPath) (*filer.Entry, entryVersion, fuse.Status) {
 	dir, _ := fullpath.DirAndName()
 	dirPath := util.FullPath(dir)
 
-	if wfs.metaCache.IsDirectoryCached(dirPath) {
-		cachedEntry, cachedVersionTsNs, cacheErr := wfs.metaCache.FindEntry(context.Background(), fullpath)
+	// The kernel can serve a directory listing from its page cache past
+	// cacheMetaTtlSec, so ReadDir never runs and EnsureVisited is not called.
+	// Rebuild the expired directory once here so the cache hit below serves
+	// metadata lookups instead of issuing one LookupEntry RPC per entry.
+	if !wfs.metaCache.IsDirectoryCached(dirPath) && wfs.inodeToPath.ShouldRebuildExpiredDir(dirPath, expiredDirRebuildCooldown) {
+		// The rebuild lists the parent from the filer; let any pending async
+		// flush of the target entry land first so the rebuilt cache does not
+		// capture pre-flush metadata and bypass the wait below.
+		if inode, found := wfs.inodeToPath.GetInode(fullpath); found {
+			if !wfs.waitForPendingAsyncFlush(ctx, inode) {
+				return nil, entryVersion{}, fuse.EINTR
+			}
+		}
+		if err := wfs.ensureDirectoryVisited(ctx, dirPath); err != nil {
+			// Record the attempt so the cooldown suppresses repeated rebuilds
+			// while the listing keeps failing; once it elapses a later lookup
+			// retries. Oversized dirs are already marked read-through.
+			var tooLarge *meta_cache.DirectoryTooLargeError
+			if !errors.As(err, &tooLarge) {
+				wfs.inodeToPath.MarkRebuildAttempt(dirPath, time.Now())
+			}
+		}
+	}
+
+	if wfs.metaCache.IsDirectoryCached(dirPath) && wfs.metaCache.IsNameFresh(fullpath) {
+		cachedEntry, cachedVersionTsNs, cacheErr := wfs.metaCache.FindEntry(ctx, fullpath)
 		if cacheErr != nil && cacheErr != filer_pb.ErrNotFound {
 			glog.Errorf("lookupEntry: cache lookup for %s failed: %v", fullpath, cacheErr)
 			return nil, entryVersion{}, fuse.EIO
@@ -619,9 +650,9 @@ func (wfs *WFS) lookupEntry(fullpath util.FullPath) (*filer.Entry, entryVersion,
 			return cachedEntry, entryVersion{tsNs: cachedVersionTsNs}, fuse.OK
 		}
 		// Re-check: the directory may have been evicted from cache between
-		// our IsDirectoryCached check and FindEntry (e.g. markDirectoryReadThrough).
+		// our IsDirectoryCached check and FindEntry.
 		// If it's no longer cached, fall through to the filer lookup below.
-		if wfs.metaCache.IsDirectoryCached(dirPath) {
+		if wfs.metaCache.IsDirectoryCached(dirPath) && wfs.metaCache.IsNameFresh(fullpath) {
 			// Authoritative ENOENT only if inodeToPath also has no record.
 			// If the kernel still tracks this inode, the three layers
 			// disagree; trust the filer over the local cache (the
@@ -639,7 +670,9 @@ func (wfs *WFS) lookupEntry(fullpath util.FullPath) (*filer.Entry, entryVersion,
 	// truncate's old size or a write's old chunks. The cache paths above are
 	// already consistent and must not pay this wait.
 	if inode, found := wfs.inodeToPath.GetInode(fullpath); found {
-		wfs.waitForPendingAsyncFlush(inode)
+		if !wfs.waitForPendingAsyncFlush(ctx, inode) {
+			return nil, entryVersion{}, fuse.EINTR
+		}
 	}
 
 	// Directory not cached - fetch directly from filer without caching the entire directory.
@@ -647,8 +680,8 @@ func (wfs *WFS) lookupEntry(fullpath util.FullPath) (*filer.Entry, entryVersion,
 	var entry *filer_pb.Entry
 	var lookupVersion entryVersion
 	lookupDir, lookupName := fullpath.DirAndName()
-	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		resp, lookupErr := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+	err := wfs.withFilerClient(ctx, false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
+		resp, lookupErr := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
 			Directory: lookupDir,
 			Name:      lookupName,
 		})
@@ -660,6 +693,9 @@ func (wfs *WFS) lookupEntry(fullpath util.FullPath) (*filer.Entry, entryVersion,
 		return nil
 	})
 	if err != nil {
+		if ctx.Err() != nil {
+			return nil, entryVersion{}, fuse.EINTR
+		}
 		if err == filer_pb.ErrNotFound {
 			// The entry may exist in the local store from a deferred create
 			// (deferFilerCreate=true) that hasn't been flushed yet. Only trust
@@ -678,12 +714,11 @@ func (wfs *WFS) lookupEntry(fullpath util.FullPath) (*filer.Entry, entryVersion,
 				wfs.pendingAsyncFlushMu.Unlock()
 
 				if hasDirtyHandle || hasPendingFlush {
-					if localEntry, localVersionTsNs, localErr := wfs.metaCache.FindEntry(context.Background(), fullpath); localErr == nil && localEntry != nil {
+					if localEntry, localVersionTsNs, localErr := wfs.metaCache.FindEntry(ctx, fullpath); localErr == nil && localEntry != nil {
 						glog.V(4).Infof("lookupEntry found deferred entry in local cache %s", fullpath)
 						return localEntry, entryVersion{tsNs: localVersionTsNs}, fuse.OK
 					}
-					// Creating many files at once can push the directory past
-					// the hot threshold and evict it, which drops the local
+					// Cache eviction (idle, kernel Forget) can drop the local
 					// placeholder a deferred create left behind. The handle
 					// still holding the unflushed entry is authoritative for
 					// it, so read it from there rather than reporting a file
@@ -713,7 +748,7 @@ func (wfs *WFS) lookupEntry(fullpath util.FullPath) (*filer.Entry, entryVersion,
 				// up without -v=4 — and include layer-by-layer state so the
 				// next failed run pinpoints which layer dropped the entry.
 				localPresent := false
-				if localEntry, _, localErr := wfs.metaCache.FindEntry(context.Background(), fullpath); localErr == nil && localEntry != nil {
+				if localEntry, _, localErr := wfs.metaCache.FindEntry(ctx, fullpath); localErr == nil && localEntry != nil {
 					localPresent = true
 				}
 				glog.Warningf("lookupEntry: filer ErrNotFound for tracked path %s (inode=%d dirtyHandle=%v pendingFlush=%v localCache=%v dirCached=%v) — possible coherence bug",
@@ -784,6 +819,22 @@ func sameEntryContent(a, b *filer_pb.Entry) bool {
 // subscription event. No filer lookup here: it can fail transiently, and with
 // the subscription cursor already past the event, nothing would retry.
 
+// IsFileOpen reports whether any open file handle refers to the inode, which
+// tells a caching front end that the handle's view of the file, not its own
+// cached copy, is current.
+func (wfs *WFS) IsFileOpen(inode uint64) bool {
+	_, found := wfs.fhMap.FindFileHandle(inode)
+	return found
+}
+
+// PathForInode reports the path the mount currently tracks for the inode, so
+// a caching front end can tell whether a path it resolved earlier still names
+// the same file. An unlinked file has no path while its handles drain.
+func (wfs *WFS) PathForInode(inode uint64) (util.FullPath, bool) {
+	path, status := wfs.inodeToPath.GetPath(inode)
+	return path, status == fuse.OK
+}
+
 // SetEntryChangeListener registers a callback for every metadata event this
 // mount applies. A front end whose client caches entries on its own side, and
 // which the mount cannot invalidate directly, uses it to push the change out.
@@ -803,7 +854,20 @@ func (wfs *WFS) onEntryInvalidation(invalidation meta_cache.EntryInvalidation) {
 		listener(invalidation)
 	}
 	wfs.invalidateKernelDirListing(invalidation.Path)
-	wfs.invalidateOpenFileHandle(invalidation)
+	// An inode with an open handle has its rename applied above, together with
+	// the handle's own path bookkeeping. This is for the rest: the kernel goes
+	// on addressing a moved inode by nodeid whether or not anything holds it
+	// open.
+	handled, replacedInode := wfs.invalidateOpenFileHandle(invalidation)
+	if !handled && invalidation.RenamedTo != "" {
+		_, replacedInode = wfs.inodeToPath.MovePath(invalidation.Path, invalidation.RenamedTo)
+	}
+	// A rename over an existing file destroys it, so its handle must not flush
+	// the old content back over what took the name. Marked from here, holding
+	// no other handle's lock.
+	if replacedInode != 0 {
+		wfs.markHandleDeleted(replacedInode)
+	}
 }
 
 // invalidateKernelDirListing drops the kernel's cached listing of the directory
@@ -836,7 +900,12 @@ func (wfs *WFS) MountRoot() util.FullPath {
 	return util.FullPath(wfs.option.FilerMountRootPath)
 }
 
-func (wfs *WFS) invalidateOpenFileHandle(invalidation meta_cache.EntryInvalidation) {
+// invalidateOpenFileHandle applies one event to the handle that has the entry
+// open, reporting whether it found one: a handle owns its inode's rename
+// bookkeeping, and the caller moves the table only for inodes without one. Any
+// inode a rename destroyed comes back for the caller to mark, since marking it
+// here would hold two handle locks at once.
+func (wfs *WFS) invalidateOpenFileHandle(invalidation meta_cache.EntryInvalidation) (handled bool, replacedInode uint64) {
 	filePath, eventEntry, eventTsNs := invalidation.Path, invalidation.Entry, invalidation.TsNs
 	inode, inodeFound := wfs.inodeToPath.GetInode(filePath)
 	if !inodeFound {
@@ -846,9 +915,31 @@ func (wfs *WFS) invalidateOpenFileHandle(invalidation meta_cache.EntryInvalidati
 	if !fhFound {
 		return
 	}
+	handled = true
 	fhActiveLock := wfs.fhLockTable.AcquireLock("invalidateFunc", fh.fh, util.ExclusiveLock)
 	defer wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
 
+	// A rename changes which name the inode answers to, not which version of
+	// its content the handle holds, so it is applied ahead of the version fence
+	// below - a fence that skipped it would strand the inode and the handle on
+	// a name the filer has vacated. MovePath reports whether the source was
+	// still ours to move, which is what makes a replayed rename a no-op here.
+	if invalidation.RenamedTo != "" {
+		if sourceInode, replaced := wfs.inodeToPath.MovePath(filePath, invalidation.RenamedTo); sourceInode != 0 {
+			if replaced != inode {
+				replacedInode = replaced
+			}
+			fh.RememberPath(invalidation.RenamedTo)
+			if _, newName := invalidation.RenamedTo.DirAndName(); newName != "" {
+				fh.UpdateEntry(func(entry *filer_pb.Entry) {
+					if entry != nil {
+						entry.Name = newName
+					}
+				})
+			}
+		}
+	}
+
 	// Invalidations apply asynchronously: the handle may already reflect this
 	// event or newer state, and rolling it back would never be corrected.
 	// Only skip within one clock domain — the handle's position may have been
@@ -888,27 +979,9 @@ func (wfs *WFS) invalidateOpenFileHandle(invalidation meta_cache.EntryInvalidati
 		// updating the renamed file. An actual delete instead marks the handle
 		// so no flush recreates the unlinked name. Either way the entry and
 		// dirty pages stay, so the open fd still reads its buffered writes.
-		if invalidation.RenamedTo != "" {
-			_, replacedInode := wfs.inodeToPath.MovePath(filePath, invalidation.RenamedTo)
-			// A rename over an existing file destroys that file. Mark its
-			// handle deleted so its flush cannot resurrect it on top of the
-			// renamed source now occupying the name.
-			if replacedInode != 0 && replacedInode != inode {
-				if replacedFh, found := wfs.fhMap.FindFileHandle(replacedInode); found {
-					replacedFh.isDeleted = true
-				}
-			}
-			fh.RememberPath(invalidation.RenamedTo)
-			if _, newName := invalidation.RenamedTo.DirAndName(); newName != "" {
-				fh.UpdateEntry(func(entry *filer_pb.Entry) {
-					if entry != nil {
-						entry.Name = newName
-					}
-				})
-			}
-		}
 		if invalidation.Deleted {
 			fh.isDeleted = true
+			fh.deleteEpoch++
 		}
 		if !fh.dirtyMetadata {
 			fh.dirtyPages.Destroy()
@@ -942,18 +1015,30 @@ func (wfs *WFS) invalidateOpenFileHandle(invalidation meta_cache.EntryInvalidati
 	}
 	fh.baseEntry.Store(proto.Clone(candidate).(*filer_pb.Entry))
 	fh.advanceEntryVersion(candidateTsNs, 0)
+	return
 }
 
 func (wfs *WFS) LookupFn() wdclient.LookupFileIdFunctionType {
 	if wfs.option.VolumeServerAccess == "filerProxy" {
 		return func(ctx context.Context, fileId string) (targetUrls []string, err error) {
-			return []string{"http://" + wfs.getCurrentFiler().ToHttpAddress() + "/?proxyChunkId=" + fileId}, nil
+			return []string{util_http.ProxyChunkUrl(string(wfs.getCurrentFiler().ToHttpAddress()), fileId)}, nil
 		}
 	}
 	// Use the cached FilerClient for efficient lookups with singleflight and cache history
 	return wfs.filerClient.GetLookupFileIdFunction()
 }
 
+// CacheInvalidator lets a chunk read that failed against every cached location
+// drop that entry and look the volume up again, so a mount does not keep
+// hammering a volume server that has since moved or died. Nil under filerProxy,
+// where there is no filerClient and LookupFn never consults a location cache.
+func (wfs *WFS) CacheInvalidator() filer.CacheInvalidator {
+	if wfs.filerClient == nil {
+		return nil
+	}
+	return wfs.filerClient
+}
+
 func (wfs *WFS) getCurrentFiler() pb.ServerAddress {
 	i := atomic.LoadInt32(&wfs.option.filerIndex)
 	return wfs.option.FilerAddresses[i]
@@ -965,18 +1050,6 @@ func (wfs *WFS) ClearCacheDir() {
 	os.RemoveAll(wfs.option.getUniqueCacheDirForRead())
 }
 
-// markDirectoryReadThrough drops a hot directory's cached listing. Only safe
-// from the apply loop (onDirectoryUpdate), where it serializes with a build's
-// markCachedFn; off-loop callers must use purgeDirectoryCache.
-func (wfs *WFS) markDirectoryReadThrough(dirPath util.FullPath) {
-	if !wfs.inodeToPath.MarkDirectoryReadThrough(dirPath, time.Now()) {
-		return
-	}
-	if err := wfs.metaCache.DeleteFolderChildren(context.Background(), dirPath); err != nil {
-		glog.V(2).Infof("clear dir cache %s: %v", dirPath, err)
-	}
-}
-
 // purgeDirectoryCache drops a directory's cached listing from off the apply loop
 // (idle eviction, kernel Forget, copy-range fallback), routing through it so a
 // stale wipe can't strand a concurrently-rebuilt directory cached-but-empty.
diff --git a/weed/mount/weedfs_access.go b/weed/mount/weedfs_access.go
index 27fa83132d..8eb402b69e 100644
--- a/weed/mount/weedfs_access.go
+++ b/weed/mount/weedfs_access.go
@@ -82,7 +82,9 @@ func clearSupplementaryGroupCache() {
  * This method is not called under Linux kernel versions 2.4.x
  */
 func (wfs *WFS) Access(cancel <-chan struct{}, input *fuse.AccessIn) (code fuse.Status) {
-	_, _, entry, code := wfs.maybeReadEntry(input.NodeId)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	_, _, entry, code := wfs.maybeReadEntry(ctx, input.NodeId)
 	if code != fuse.OK {
 		return code
 	}
diff --git a/weed/mount/weedfs_attr.go b/weed/mount/weedfs_attr.go
index 9b42ceb51d..b592ad921d 100644
--- a/weed/mount/weedfs_attr.go
+++ b/weed/mount/weedfs_attr.go
@@ -1,11 +1,14 @@
 package mount
 
 import (
+	"context"
 	"os"
 	"syscall"
 	"time"
 
 	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"google.golang.org/protobuf/proto"
+
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -23,44 +26,37 @@ func (wfs *WFS) GetAttr(cancel <-chan struct{}, input *fuse.GetAttrIn, out *fuse
 	}
 
 	inode := input.NodeId
-	path, fh, entry, status := wfs.maybeReadEntry(inode)
-	if status == fuse.OK {
-		out.AttrValid = wfs.attrValidSec
-		// When an open handle owns the entry, async upload workers append
-		// chunks under the LockedEntry lock; take it for reading so FileSize
-		// does not iterate the chunk slice mid-reallocation. Re-read under the
-		// lock in case SetEntry swapped the pointer since maybeReadEntry.
-		if fh != nil {
-			fh.entry.RLock()
-			entry = fh.entry.Entry
-		}
-		wfs.setAttrByPbEntry(&out.Attr, inode, entry, true)
-		if fh != nil {
-			fh.entry.RUnlock()
-		}
-		wfs.applyInMemoryAtime(&out.Attr, inode)
-		if entry.IsDirectory {
-			wfs.applyInMemoryDirMtime(&out.Attr, inode)
-			if wfs.option.PosixDirNlink {
-				wfs.applyDirNlink(&out.Attr, path)
-			}
-		}
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	path, fh, entry, status := wfs.maybeReadEntry(ctx, inode)
+	if status != fuse.OK {
 		return status
+	}
+	out.AttrValid = wfs.attrValidSec
+	// An open handle's entry has two sets of writers: async upload workers
+	// append chunks under the LockedEntry lock, while Write and the metadata
+	// flush rewrite size, times and the whole chunk slice under the handle
+	// lock. Hold both for reading, in that order, so FileSize never iterates a
+	// slice mid-reallocation. Re-read the entry under them in case SetEntry
+	// swapped the pointer since maybeReadEntry.
+	if fh != nil {
+		fhActiveLock := wfs.fhLockTable.AcquireLock("GetAttr", fh.fh, util.SharedLock)
+		fh.entry.RLock()
+		entry = fh.entry.Entry
+		wfs.setAttrByPbEntry(&out.Attr, inode, entry, true)
+		fh.entry.RUnlock()
+		wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
 	} else {
-		if fh, found := wfs.fhMap.FindFileHandle(inode); found {
-			out.AttrValid = wfs.attrValidSec
-			// Use shared lock to prevent race with Write operations
-			fhActiveLock := wfs.fhLockTable.AcquireLock("GetAttr", fh.fh, util.SharedLock)
-			fh.entry.RLock()
-			wfs.setAttrByPbEntry(&out.Attr, inode, fh.entry.Entry, true)
-			fh.entry.RUnlock()
-			wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
-			wfs.applyInMemoryAtime(&out.Attr, inode)
-			out.Nlink = 0
-			return fuse.OK
+		wfs.setAttrByPbEntry(&out.Attr, inode, entry, true)
+	}
+	wfs.applyInMemoryAtime(&out.Attr, inode)
+	applyUnlinkedNlink(&out.Attr, path)
+	if entry.GetIsDirectory() {
+		wfs.applyInMemoryDirMtime(&out.Attr, inode)
+		if wfs.option.PosixDirNlink {
+			wfs.applyDirNlink(&out.Attr, path)
 		}
 	}
-
 	return status
 }
 
@@ -71,10 +67,24 @@ func (wfs *WFS) SetAttr(cancel <-chan struct{}, input *fuse.SetAttrIn, out *fuse
 		return fuse.Status(syscall.ENOSPC)
 	}
 
-	path, fh, entry, status := wfs.maybeReadEntry(input.NodeId)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	path, fh, entry, status := wfs.maybeReadEntry(ctx, input.NodeId)
 	if status != fuse.OK || entry == nil {
 		return status
 	}
+	if size, ok := input.GetSize(); ok && fh != nil && fh.dirtyPages.HasWrites() && size < filer.FileSize(entry) {
+		// The truncation below trims chunks; dirty pages it cannot see. Left
+		// alone, pages beyond the new size come back with the next flush and
+		// grow the file again, so turn them into chunks first. Runs before
+		// the entry locks below: the flush takes its own.
+		ctx, cancelFunc := context.WithTimeout(context.Background(), metadataFlushTimeout)
+		flushStatus := wfs.doFlush(ctx, fh, input.Uid, input.Gid, false)
+		cancelFunc()
+		if flushStatus != fuse.OK {
+			return flushStatus
+		}
+	}
 	if fh != nil {
 		fh.entryLock.Lock()
 		defer fh.entryLock.Unlock()
@@ -99,7 +109,8 @@ func (wfs *WFS) SetAttr(cancel <-chan struct{}, input *fuse.SetAttrIn, out *fuse
 		// Invalidate the open-mtime cache so the next Open does not set
 		// FOPEN_KEEP_CACHE with stale kernel page cache data.
 		wfs.invalidateOpenMtimeCache(input.NodeId)
-		if size < filer.FileSize(entry) {
+		oldFileSize := filer.FileSize(entry)
+		if size < oldFileSize {
 			// fmt.Printf("truncate %v \n", fullPath)
 			var chunks []*filer_pb.FileChunk
 			var truncatedChunks []*filer_pb.FileChunk
@@ -130,6 +141,12 @@ func (wfs *WFS) SetAttr(cancel <-chan struct{}, input *fuse.SetAttrIn, out *fuse
 		entry.Attributes.Mtime = truncNow.Unix()
 		entry.Attributes.MtimeNs = int32(truncNow.Nanosecond())
 		entry.Attributes.FileSize = size
+		if size > oldFileSize {
+			// The writes that fill the range will not grow the file, so they
+			// charge nothing; the growth is counted here or the quota never
+			// sees it. Matches Write and Fallocate.
+			wfs.AddUncommittedBytes(int64(size - oldFileSize))
+		}
 
 	}
 
@@ -189,11 +206,17 @@ func (wfs *WFS) SetAttr(cancel <-chan struct{}, input *fuse.SetAttrIn, out *fuse
 	}
 	wfs.setAttrByPbEntry(&out.Attr, input.NodeId, entry, !includeSize)
 	wfs.applyInMemoryAtime(&out.Attr, input.NodeId)
+	applyUnlinkedNlink(&out.Attr, path)
 
 	if fh != nil {
 		fh.dirtyMetadata = true
 		return fuse.OK
 	}
+	if path == "" {
+		// removed while open: the remembered entry is all there is to update
+		wfs.rememberRemovedDir(input.NodeId, entry)
+		return fuse.OK
+	}
 
 	return wfs.saveEntry(path, entry)
 
@@ -317,7 +340,7 @@ func (wfs *WFS) touchDirMtimeCtimeBest(dirPath util.FullPath) {
 // touchDirMtimeCtime updates a directory's mtime and ctime on the filer.
 // POSIX requires this when entries are created or removed in the directory.
 func (wfs *WFS) touchDirMtimeCtime(dirPath util.FullPath) {
-	dirEntry, _, code := wfs.maybeLoadEntry(dirPath)
+	dirEntry, _, code := wfs.maybeLoadEntry(context.Background(), dirPath)
 	if code != fuse.OK || dirEntry == nil || dirEntry.Attributes == nil {
 		return
 	}
@@ -387,10 +410,10 @@ func (wfs *WFS) setAtime(inode uint64, t time.Time) {
 }
 
 // applyInMemoryAtime overlays the in-memory atime onto a fuse.Attr if present.
-// forgetInMemoryTimes drops the overlays for an inode. Both maps are keyed by
-// inode and inodes are derived from the path, so a delete and recreate can
+// forgetInMemoryTimes drops the overlays for an inode. All these maps are keyed
+// by inode and inodes are derived from the path, so a delete and recreate can
 // hand the same number to a different file — which would then inherit the
-// previous one's access or modification time.
+// previous one's access or modification time, or a removed directory's entry.
 func (wfs *WFS) forgetInMemoryTimes(inode uint64) {
 	wfs.atimeMu.Lock()
 	delete(wfs.atimeMap, inode)
@@ -399,6 +422,41 @@ func (wfs *WFS) forgetInMemoryTimes(inode uint64) {
 	wfs.dirMtimeMu.Lock()
 	delete(wfs.dirMtimeMap, inode)
 	wfs.dirMtimeMu.Unlock()
+
+	wfs.removedDirMu.Lock()
+	delete(wfs.removedDirs, inode)
+	wfs.removedDirMu.Unlock()
+}
+
+// rememberRemovedDir keeps the last-known entry of a directory removed while
+// the kernel still references its inode. A directory has no file handle to
+// live on through, so this is what serves fstat/fchmod/f*xattr on a still-open
+// descriptor until the final forget. Mutations publish through here as well,
+// replacing the stored entry wholesale.
+//
+// The final forget's cleanup cannot miss an insert: Rmdir inserts inside
+// RemovePath's callback, under the same inode table lock the forget releases
+// under, and a publish runs inside a request whose open descriptor keeps the
+// kernel from issuing that forget at all.
+func (wfs *WFS) rememberRemovedDir(inode uint64, entry *filer_pb.Entry) {
+	wfs.removedDirMu.Lock()
+	if wfs.removedDirs == nil {
+		wfs.removedDirs = make(map[uint64]*filer_pb.Entry)
+	}
+	wfs.removedDirs[inode] = entry
+	wfs.removedDirMu.Unlock()
+}
+
+// removedDirEntry hands out a private copy: stored entries are never mutated
+// in place, so concurrent readers cannot see a half-applied change.
+func (wfs *WFS) removedDirEntry(inode uint64) *filer_pb.Entry {
+	wfs.removedDirMu.Lock()
+	entry := wfs.removedDirs[inode]
+	wfs.removedDirMu.Unlock()
+	if entry == nil {
+		return nil
+	}
+	return proto.Clone(entry).(*filer_pb.Entry)
 }
 
 func (wfs *WFS) applyInMemoryAtime(out *fuse.Attr, inode uint64) {
@@ -410,6 +468,15 @@ func (wfs *WFS) applyInMemoryAtime(out *fuse.Attr, inode uint64) {
 	wfs.atimeMu.Unlock()
 }
 
+// applyUnlinkedNlink zeroes nlink for an inode no name points at any more: the
+// file was unlinked while open and lives on only through its handle. Every
+// reply carrying attributes must say so, or the kernel caches a live nlink.
+func applyUnlinkedNlink(out *fuse.Attr, path util.FullPath) {
+	if path == "" {
+		out.Nlink = 0
+	}
+}
+
 // applyDirNlink sets nlink = 2 + number_of_subdirectories for a directory.
 // Uses the in-memory subdirectory count tracked by mkdir/rmdir/rename.
 func (wfs *WFS) applyDirNlink(out *fuse.Attr, dirPath util.FullPath) {
diff --git a/weed/mount/weedfs_attr_quota_test.go b/weed/mount/weedfs_attr_quota_test.go
new file mode 100644
index 0000000000..53d9649622
--- /dev/null
+++ b/weed/mount/weedfs_attr_quota_test.go
@@ -0,0 +1,38 @@
+package mount
+
+import (
+	"sync/atomic"
+	"testing"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+)
+
+// TestSetAttrChargesTheGrowth pins the quota accounting for a truncate up: the
+// writes that fill the range do not grow the file, so they charge nothing and
+// the growth has to be counted where it happens, as Write and Fallocate do.
+func TestSetAttrChargesTheGrowth(t *testing.T) {
+	atomic.StoreInt64(&uncommittedBytes, 0)
+	wfs, fh := newOpenFileHandle(t, 10)
+	wfs.option.Quota = 100 << 20
+
+	in := &fuse.SetAttrIn{}
+	in.NodeId = fh.inode
+	in.Valid = fuse.FATTR_SIZE
+	in.Size = 8192
+	var out fuse.AttrOut
+	if status := wfs.SetAttr(nil, in, &out); status != fuse.OK {
+		t.Fatalf("SetAttr size up: got %v, want OK", status)
+	}
+	if got := wfs.GetUncommittedBytes(); got != 8192-10 {
+		t.Fatalf("uncommitted bytes: got %d, want %d", got, 8192-10)
+	}
+
+	// Truncating back down frees space rather than consuming it.
+	in.Size = 0
+	if status := wfs.SetAttr(nil, in, &out); status != fuse.OK {
+		t.Fatalf("SetAttr size down: got %v, want OK", status)
+	}
+	if got := wfs.GetUncommittedBytes(); got != 8192-10 {
+		t.Fatalf("uncommitted bytes after a shrink: got %d, want %d", got, 8192-10)
+	}
+}
diff --git a/weed/mount/weedfs_attr_race_test.go b/weed/mount/weedfs_attr_race_test.go
index 0fd3861214..805e4261b3 100644
--- a/weed/mount/weedfs_attr_race_test.go
+++ b/weed/mount/weedfs_attr_race_test.go
@@ -23,6 +23,7 @@ func TestAttrChunkRace(t *testing.T) {
 		option:         &Option{},
 		inodeToPath:    NewInodeToPath(util.FullPath("/"), 0),
 		fhMap:          NewFileHandleToInode(),
+		fhLockTable:    util.NewLockTable[FileHandleId](),
 		openMtimeCache: make(map[uint64][2]int64, 8),
 	}
 
@@ -34,7 +35,7 @@ func TestAttrChunkRace(t *testing.T) {
 		Name:       "sample.txt",
 		Attributes: &filer_pb.FuseAttributes{FileMode: 0644},
 	}
-	chunkGroup, err := filer.NewChunkGroup(nil, nil, nil, 1)
+	chunkGroup, err := filer.NewChunkGroup(nil, nil, nil, 1, nil, nil)
 	if err != nil {
 		t.Fatalf("NewChunkGroup: %v", err)
 	}
@@ -45,6 +46,7 @@ func TestAttrChunkRace(t *testing.T) {
 		entry:           &LockedEntry{Entry: entry},
 		entryChunkGroup: chunkGroup,
 	}
+	fh.dirtyPages = newPageWriter(fh, 1<<20)
 	wfs.fhMap.inode2fh[inode] = fh
 	wfs.fhMap.fh2inode[fh.fh] = inode
 
@@ -113,7 +115,7 @@ func TestReadFromChunksRace(t *testing.T) {
 		Name:       "sample.txt",
 		Attributes: &filer_pb.FuseAttributes{FileMode: 0644},
 	}
-	chunkGroup, err := filer.NewChunkGroup(nil, nil, nil, 1)
+	chunkGroup, err := filer.NewChunkGroup(nil, nil, nil, 1, nil, nil)
 	if err != nil {
 		t.Fatalf("NewChunkGroup: %v", err)
 	}
@@ -124,6 +126,7 @@ func TestReadFromChunksRace(t *testing.T) {
 		entry:           &LockedEntry{Entry: entry},
 		entryChunkGroup: chunkGroup,
 	}
+	fh.dirtyPages = newPageWriter(fh, 1<<20)
 	wfs.fhMap.inode2fh[inode] = fh
 	wfs.fhMap.fh2inode[fh.fh] = inode
 
diff --git a/weed/mount/weedfs_attr_unlinked_test.go b/weed/mount/weedfs_attr_unlinked_test.go
new file mode 100644
index 0000000000..97920e58fb
--- /dev/null
+++ b/weed/mount/weedfs_attr_unlinked_test.go
@@ -0,0 +1,292 @@
+package mount
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// newUnlinkedOpenFile builds a WFS holding one open handle whose name has
+// already been removed, the state a file is in between unlink() and the last
+// close() of a descriptor still pointing at it.
+func newUnlinkedOpenFile(t *testing.T) (*WFS, uint64, *FileHandle) {
+	t.Helper()
+
+	wfs := &WFS{
+		option:         &Option{ChunkSizeLimit: 1024, ConcurrentReaders: 1},
+		inodeToPath:    NewInodeToPath(util.FullPath("/"), 0),
+		fhMap:          NewFileHandleToInode(),
+		fhLockTable:    util.NewLockTable[FileHandleId](),
+		openMtimeCache: make(map[uint64][2]int64, 8),
+	}
+
+	const inode = uint64(42)
+	fullPath := util.FullPath("/dir/file")
+	wfs.inodeToPath.Lookup(fullPath, 1, false, false, inode, true)
+
+	entry := &filer_pb.Entry{
+		Name:       "file",
+		Attributes: &filer_pb.FuseAttributes{FileMode: 0644},
+	}
+	chunkGroup, err := filer.NewChunkGroup(nil, nil, nil, 1, nil, nil)
+	if err != nil {
+		t.Fatalf("NewChunkGroup: %v", err)
+	}
+	fh := &FileHandle{
+		fh:              FileHandleId(1),
+		inode:           inode,
+		wfs:             wfs,
+		entry:           &LockedEntry{Entry: entry},
+		entryChunkGroup: chunkGroup,
+	}
+	fh.dirtyPages = newPageWriter(fh, 1<<20)
+	fh.RememberPath(fullPath)
+	wfs.fhMap.inode2fh[inode] = fh
+	wfs.fhMap.fh2inode[fh.fh] = inode
+
+	wfs.inodeToPath.RemovePath(fullPath, nil)
+	fh.isDeleted = true
+
+	return wfs, inode, fh
+}
+
+// TestSetAttrOnUnlinkedOpenFile covers ftruncate/fchmod on a descriptor whose
+// file has been unlinked: POSIX keeps the open file alive, so these must not
+// fail with ENOENT.
+func TestSetAttrOnUnlinkedOpenFile(t *testing.T) {
+	wfs, inode, fh := newUnlinkedOpenFile(t)
+
+	in := &fuse.SetAttrIn{}
+	in.NodeId = inode
+	in.Valid = fuse.FATTR_SIZE
+	in.Size = 128
+	var out fuse.AttrOut
+	if status := wfs.SetAttr(nil, in, &out); status != fuse.OK {
+		t.Fatalf("SetAttr size on unlinked open file: got %v, want OK", status)
+	}
+	if out.Attr.Size != 128 {
+		t.Fatalf("SetAttr size: got %d, want 128", out.Attr.Size)
+	}
+	if got := fh.GetEntry().GetEntry().Attributes.FileSize; got != 128 {
+		t.Fatalf("handle entry FileSize: got %d, want 128", got)
+	}
+	if !fh.dirtyMetadata {
+		t.Fatal("SetAttr did not mark the handle dirty")
+	}
+	// The kernel caches what this reply carries, so it has to agree with fstat.
+	if out.Attr.Nlink != 0 {
+		t.Fatalf("SetAttr nlink: got %d, want 0", out.Attr.Nlink)
+	}
+
+	in = &fuse.SetAttrIn{}
+	in.NodeId = inode
+	in.Valid = fuse.FATTR_MODE
+	in.Mode = 0600
+	if status := wfs.SetAttr(nil, in, &out); status != fuse.OK {
+		t.Fatalf("SetAttr mode on unlinked open file: got %v, want OK", status)
+	}
+	if got := fh.GetEntry().GetEntry().Attributes.FileMode & 0777; got != 0600 {
+		t.Fatalf("handle entry FileMode: got %o, want 600", got)
+	}
+}
+
+// TestGetAttrOnUnlinkedOpenFile pins fstat on an unlinked descriptor: the size
+// stays visible and nlink drops to zero.
+func TestGetAttrOnUnlinkedOpenFile(t *testing.T) {
+	wfs, inode, fh := newUnlinkedOpenFile(t)
+	fh.GetEntry().GetEntry().Attributes.FileSize = 128
+
+	in := &fuse.GetAttrIn{}
+	in.NodeId = inode
+	var out fuse.AttrOut
+	if status := wfs.GetAttr(nil, in, &out); status != fuse.OK {
+		t.Fatalf("GetAttr on unlinked open file: got %v, want OK", status)
+	}
+	if out.Attr.Size != 128 {
+		t.Fatalf("GetAttr size: got %d, want 128", out.Attr.Size)
+	}
+	if out.Attr.Nlink != 0 {
+		t.Fatalf("GetAttr nlink: got %d, want 0", out.Attr.Nlink)
+	}
+}
+
+// TestXAttrOnUnlinkedOpenFile covers fsetxattr/fgetxattr/fremovexattr on a
+// descriptor whose file has been unlinked.
+func TestXAttrOnUnlinkedOpenFile(t *testing.T) {
+	wfs, inode, _ := newUnlinkedOpenFile(t)
+
+	setIn := &fuse.SetXAttrIn{}
+	setIn.NodeId = inode
+	if status := wfs.SetXAttr(nil, setIn, "user.k", []byte("v")); status != fuse.OK {
+		t.Fatalf("SetXAttr on unlinked open file: got %v, want OK", status)
+	}
+
+	header := &fuse.InHeader{NodeId: inode}
+	dest := make([]byte, 8)
+	n, status := wfs.GetXAttr(nil, header, "user.k", dest)
+	if status != fuse.OK {
+		t.Fatalf("GetXAttr on unlinked open file: got %v, want OK", status)
+	}
+	if string(dest[:n]) != "v" {
+		t.Fatalf("GetXAttr value: got %q, want %q", dest[:n], "v")
+	}
+
+	if status := wfs.RemoveXAttr(nil, header, "user.k"); status != fuse.OK {
+		t.Fatalf("RemoveXAttr on unlinked open file: got %v, want OK", status)
+	}
+}
+
+// newRemovedOpenDir builds a WFS holding one kernel-referenced directory whose
+// name rmdir has already dropped, the state between rmdir() and releasedir().
+func newRemovedOpenDir(t *testing.T) (*WFS, uint64) {
+	t.Helper()
+
+	wfs := &WFS{
+		option:      &Option{},
+		inodeToPath: NewInodeToPath(util.FullPath("/"), 0),
+		fhMap:       NewFileHandleToInode(),
+		fhLockTable: util.NewLockTable[FileHandleId](),
+		atimeMap:    make(map[uint64]time.Time, 8),
+		dirMtimeMap: make(map[uint64]time.Time, 8),
+	}
+
+	const inode = uint64(7)
+	fullPath := util.FullPath("/dir")
+	wfs.inodeToPath.Lookup(fullPath, 1, true, false, inode, true)
+
+	kept := false
+	wfs.inodeToPath.RemovePath(fullPath, func(removedInode uint64) {
+		kept = true
+		wfs.rememberRemovedDir(removedInode, &filer_pb.Entry{
+			Name:        "dir",
+			IsDirectory: true,
+			Attributes:  &filer_pb.FuseAttributes{FileMode: uint32(os.ModeDir | 0755), Uid: 1, Gid: 2},
+		})
+	})
+	if !kept {
+		t.Fatal("RemovePath did not report the inode as still referenced")
+	}
+
+	return wfs, inode
+}
+
+// TestSetAttrOnRemovedOpenDir covers fchmod/futimens on a descriptor whose
+// directory has been removed: the inode lives on until the final forget, so
+// these must not fail with ENOENT, and the change must be visible to a
+// following fstat.
+func TestSetAttrOnRemovedOpenDir(t *testing.T) {
+	wfs, inode := newRemovedOpenDir(t)
+
+	in := &fuse.SetAttrIn{}
+	in.NodeId = inode
+	in.Valid = fuse.FATTR_MODE
+	in.Mode = 0770
+	var out fuse.AttrOut
+	if status := wfs.SetAttr(nil, in, &out); status != fuse.OK {
+		t.Fatalf("SetAttr mode on removed open dir: got %v, want OK", status)
+	}
+	if out.Attr.Mode&0777 != 0770 {
+		t.Fatalf("SetAttr mode: got %o, want 770", out.Attr.Mode&0777)
+	}
+	if out.Attr.Nlink != 0 {
+		t.Fatalf("SetAttr nlink: got %d, want 0", out.Attr.Nlink)
+	}
+
+	in = &fuse.SetAttrIn{}
+	in.NodeId = inode
+	in.Valid = fuse.FATTR_MTIME
+	in.Mtime = 12345
+	if status := wfs.SetAttr(nil, in, &out); status != fuse.OK {
+		t.Fatalf("SetAttr mtime on removed open dir: got %v, want OK", status)
+	}
+
+	gin := &fuse.GetAttrIn{}
+	gin.NodeId = inode
+	if status := wfs.GetAttr(nil, gin, &out); status != fuse.OK {
+		t.Fatalf("GetAttr on removed open dir: got %v, want OK", status)
+	}
+	if out.Attr.Mode&0777 != 0770 {
+		t.Fatalf("GetAttr mode after chmod: got %o, want 770", out.Attr.Mode&0777)
+	}
+	if out.Attr.Mode&fuse.S_IFDIR == 0 {
+		t.Fatalf("GetAttr lost the directory type: %o", out.Attr.Mode)
+	}
+	if out.Attr.Mtime != 12345 {
+		t.Fatalf("GetAttr mtime after utimens: got %d, want 12345", out.Attr.Mtime)
+	}
+	if out.Attr.Uid != 1 || out.Attr.Gid != 2 {
+		t.Fatalf("GetAttr uid/gid: got %d/%d, want 1/2", out.Attr.Uid, out.Attr.Gid)
+	}
+	if out.Attr.Nlink != 0 {
+		t.Fatalf("GetAttr nlink: got %d, want 0", out.Attr.Nlink)
+	}
+}
+
+// TestXAttrOnRemovedOpenDir covers fsetxattr/fgetxattr/fremovexattr on a
+// descriptor whose directory has been removed.
+func TestXAttrOnRemovedOpenDir(t *testing.T) {
+	wfs, inode := newRemovedOpenDir(t)
+
+	setIn := &fuse.SetXAttrIn{}
+	setIn.NodeId = inode
+	if status := wfs.SetXAttr(nil, setIn, "user.k", []byte("v")); status != fuse.OK {
+		t.Fatalf("SetXAttr on removed open dir: got %v, want OK", status)
+	}
+
+	header := &fuse.InHeader{NodeId: inode}
+	dest := make([]byte, 8)
+	n, status := wfs.GetXAttr(nil, header, "user.k", dest)
+	if status != fuse.OK {
+		t.Fatalf("GetXAttr on removed open dir: got %v, want OK", status)
+	}
+	if string(dest[:n]) != "v" {
+		t.Fatalf("GetXAttr value: got %q, want %q", dest[:n], "v")
+	}
+
+	if status := wfs.RemoveXAttr(nil, header, "user.k"); status != fuse.OK {
+		t.Fatalf("RemoveXAttr on removed open dir: got %v, want OK", status)
+	}
+	if _, status := wfs.GetXAttr(nil, header, "user.k", dest); status != fuse.ENOATTR {
+		t.Fatalf("GetXAttr after remove: got %v, want ENOATTR", status)
+	}
+}
+
+// TestForgetReleasesRemovedOpenDir pins the cleanup: once the kernel drops its
+// last reference, the remembered entry goes with it.
+func TestForgetReleasesRemovedOpenDir(t *testing.T) {
+	wfs, inode := newRemovedOpenDir(t)
+
+	wfs.Forget(inode, 1)
+
+	in := &fuse.SetAttrIn{}
+	in.NodeId = inode
+	in.Valid = fuse.FATTR_MODE
+	in.Mode = 0700
+	var out fuse.AttrOut
+	if status := wfs.SetAttr(nil, in, &out); status != fuse.ENOENT {
+		t.Fatalf("SetAttr after forget: got %v, want ENOENT", status)
+	}
+	if len(wfs.removedDirs) != 0 {
+		t.Fatalf("removedDirs not cleaned up: %d entries", len(wfs.removedDirs))
+	}
+}
+
+// TestRemovePathSkipsUnreferencedInode pins the insert-forget ordering: once
+// the kernel's references are gone, RemovePath must not offer the inode for
+// retention, so nothing can be inserted that the forget's cleanup missed.
+func TestRemovePathSkipsUnreferencedInode(t *testing.T) {
+	itp := NewInodeToPath(util.FullPath("/"), 0)
+	fullPath := util.FullPath("/dir")
+	itp.Lookup(fullPath, 1, true, false, 7, true)
+	itp.Forget(7, 1, nil, nil)
+
+	itp.Lookup(fullPath, 1, true, false, 7, false)
+	itp.RemovePath(fullPath, func(inode uint64) {
+		t.Fatalf("RemovePath offered unreferenced inode %d for retention", inode)
+	})
+}
diff --git a/weed/mount/weedfs_dir_lookup.go b/weed/mount/weedfs_dir_lookup.go
index 24e39f6846..60bd56e901 100644
--- a/weed/mount/weedfs_dir_lookup.go
+++ b/weed/mount/weedfs_dir_lookup.go
@@ -27,7 +27,9 @@ func (wfs *WFS) Lookup(cancel <-chan struct{}, header *fuse.InHeader, name strin
 	fullFilePath := dirPath.Child(name)
 
 	// Use shared lookup logic that checks cache first, then filer if needed
-	localEntry, _, status := wfs.lookupEntry(fullFilePath)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	localEntry, _, status := wfs.lookupEntry(ctx, fullFilePath)
 	if status != fuse.OK {
 		return status
 	}
diff --git a/weed/mount/weedfs_dir_lookup_cache_test.go b/weed/mount/weedfs_dir_lookup_cache_test.go
new file mode 100644
index 0000000000..f1f3635cda
--- /dev/null
+++ b/weed/mount/weedfs_dir_lookup_cache_test.go
@@ -0,0 +1,333 @@
+package mount
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+
+	"github.com/seaweedfs/seaweedfs/weed/mount/meta_cache"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func newLookupCacheTestWFS(t *testing.T, ttlSec int) *WFS {
+	t.Helper()
+	uidGidMapper, err := meta_cache.NewUidGidMapper("", "")
+	if err != nil {
+		t.Fatalf("create uid/gid mapper: %v", err)
+	}
+	root := util.FullPath("/")
+	wfs := &WFS{
+		signature:         1,
+		inodeToPath:       NewInodeToPath(root, ttlSec),
+		fhMap:             NewFileHandleToInode(),
+		fhLockTable:       util.NewLockTable[FileHandleId](),
+		hardLinkLockTable: util.NewLockTable[string](),
+		option: &Option{
+			ChunkSizeLimit:     1024,
+			ConcurrentReaders:  1,
+			VolumeServerAccess: "filerProxy",
+			FilerAddresses: []pb.ServerAddress{
+				pb.NewServerAddressWithGrpcPort("127.0.0.1:1", 1),
+			},
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+			UidGidMapper:   uidGidMapper,
+		},
+	}
+	wfs.metaCache = meta_cache.NewMetaCache(
+		filepath.Join(t.TempDir(), "meta"),
+		uidGidMapper, root, false,
+		func(path util.FullPath) { wfs.inodeToPath.MarkChildrenCached(path) },
+		func(path util.FullPath) bool { return wfs.inodeToPath.IsChildrenCached(path) },
+		wfs.onEntryInvalidation, nil,
+	)
+	t.Cleanup(wfs.metaCache.Shutdown)
+	return wfs
+}
+
+type lookupCacheTestFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entries      []*filer_pb.Entry
+	snapshotTsNs int64
+	listErr      error
+	listCalls    atomic.Int32
+	lookupCalls  atomic.Int32
+	mu           sync.Mutex
+	listGate     chan struct{}
+	startedCh    chan struct{}
+	startedOnce  sync.Once
+}
+
+func (s *lookupCacheTestFiler) setListGate(gate, started chan struct{}) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.listGate = gate
+	s.startedCh = started
+	s.startedOnce = sync.Once{}
+}
+
+func (s *lookupCacheTestFiler) signalStarted() {
+	s.startedOnce.Do(func() {
+		if s.startedCh != nil {
+			close(s.startedCh)
+		}
+	})
+}
+
+func (s *lookupCacheTestFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	s.lookupCalls.Add(1)
+	return &filer_pb.LookupDirectoryEntryResponse{
+		Entry: &filer_pb.Entry{
+			Name:       req.Name,
+			Attributes: &filer_pb.FuseAttributes{FileSize: 123, FileMode: 0100644},
+		},
+	}, nil
+}
+
+func (s *lookupCacheTestFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	s.listCalls.Add(1)
+	s.mu.Lock()
+	gate := s.listGate
+	s.mu.Unlock()
+	if gate != nil {
+		s.signalStarted()
+		<-gate
+	}
+	if s.listErr != nil {
+		return s.listErr
+	}
+	for _, e := range s.entries {
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: e}); err != nil {
+			return err
+		}
+	}
+	if s.snapshotTsNs != 0 {
+		stream.SetTrailer(metadata.Pairs(filer_pb.ListSnapshotTsNsTrailerKey, strconv.FormatInt(s.snapshotTsNs, 10)))
+	}
+	return nil
+}
+
+// expireDirCache marks a cached directory's TTL as elapsed without invalidating
+// it, reproducing the state the kernel leaves the mount in when it still holds
+// the directory listing (FOPEN_CACHE_DIR | FOPEN_KEEP_CACHE) past cacheMetaTtlSec.
+func expireDirCache(t *testing.T, itp *InodeToPath, dir util.FullPath) {
+	t.Helper()
+	itp.Lock()
+	defer itp.Unlock()
+	d := itp.dirStateOf(dir)
+	if d == nil {
+		t.Fatalf("expireDirCache: no dirState for %s", dir)
+	}
+	if !d.isChildrenCached {
+		t.Fatalf("expireDirCache: %s not cached", dir)
+	}
+	d.cachedExpiresTime = time.Now().Add(-time.Second)
+}
+
+// TestLookupRebuildsExpiredDirectoryCache reproduces issue #11262: after the
+// metadata cache TTL elapses the kernel can still serve directory listings
+// from its page cache, so ReadDir never runs and EnsureVisited is not called.
+// Metadata-heavy listings (e.g. `ls --color`) then reach Lookup, which must
+// rebuild the directory cache once instead of issuing one LookupEntry RPC
+// per entry.
+func TestLookupRebuildsExpiredDirectoryCache(t *testing.T) {
+	wfs := newLookupCacheTestWFS(t, 60)
+	dir := util.FullPath("/dir")
+	wfs.inodeToPath.Lookup(dir, time.Now().Unix(), true, false, 0, true)
+
+	fake := &lookupCacheTestFiler{
+		entries: []*filer_pb.Entry{
+			{Name: "a", Attributes: &filer_pb.FuseAttributes{FileSize: 1, FileMode: 0100644}},
+			{Name: "b", Attributes: &filer_pb.FuseAttributes{FileSize: 2, FileMode: 0100644}},
+			{Name: "c", Attributes: &filer_pb.FuseAttributes{FileSize: 3, FileMode: 0100644}},
+		},
+		snapshotTsNs: 5000,
+	}
+	startFakeFiler(t, wfs, fake)
+
+	if err := meta_cache.EnsureVisited(context.Background(), wfs.metaCache, wfs, dir, 0); err != nil {
+		t.Fatalf("EnsureVisited: %v", err)
+	}
+	if !wfs.inodeToPath.IsChildrenCached(dir) {
+		t.Fatal("directory should be cached after EnsureVisited")
+	}
+
+	expireDirCache(t, wfs.inodeToPath, dir)
+	if wfs.inodeToPath.IsChildrenCached(dir) {
+		t.Fatal("directory cache should be expired")
+	}
+
+	listCallsBefore := fake.listCalls.Load()
+	lookupCallsBefore := fake.lookupCalls.Load()
+
+	for _, name := range []string{"a", "b", "c"} {
+		entry, _, status := wfs.lookupEntry(context.Background(), dir.Child(name))
+		if status != fuse.OK {
+			t.Fatalf("lookupEntry %s: %v", name, status)
+		}
+		if entry == nil || entry.Name() != name {
+			t.Fatalf("lookupEntry %s: got %v", name, entry)
+		}
+	}
+
+	listCalls := fake.listCalls.Load() - listCallsBefore
+	lookupCalls := fake.lookupCalls.Load() - lookupCallsBefore
+	if lookupCalls != 0 {
+		t.Errorf("LookupDirectoryEntry RPCs = %d, want 0 (expired dir cache should be rebuilt, not read per-entry)", lookupCalls)
+	}
+	if listCalls != 1 {
+		t.Errorf("ListEntries RPCs = %d, want 1 (expired dir cache should be rebuilt once)", listCalls)
+	}
+}
+
+// TestLookupRebuildDeduplicatesConcurrentRebuilds exercises the singleflight in
+// EnsureVisited: concurrent lookups into the same expired directory share one
+// rebuild rather than each issuing its own ListEntries.
+func TestLookupRebuildDeduplicatesConcurrentRebuilds(t *testing.T) {
+	wfs := newLookupCacheTestWFS(t, 60)
+	dir := util.FullPath("/dir")
+	wfs.inodeToPath.Lookup(dir, time.Now().Unix(), true, false, 0, true)
+
+	fake := &lookupCacheTestFiler{
+		entries: []*filer_pb.Entry{
+			{Name: "a", Attributes: &filer_pb.FuseAttributes{FileSize: 1, FileMode: 0100644}},
+			{Name: "b", Attributes: &filer_pb.FuseAttributes{FileSize: 2, FileMode: 0100644}},
+			{Name: "c", Attributes: &filer_pb.FuseAttributes{FileSize: 3, FileMode: 0100644}},
+		},
+		snapshotTsNs: 5000,
+	}
+	startFakeFiler(t, wfs, fake)
+
+	if err := meta_cache.EnsureVisited(context.Background(), wfs.metaCache, wfs, dir, 0); err != nil {
+		t.Fatalf("EnsureVisited: %v", err)
+	}
+	expireDirCache(t, wfs.inodeToPath, dir)
+
+	started := make(chan struct{})
+	gate := make(chan struct{})
+	fake.setListGate(gate, started)
+
+	listCallsBefore := fake.listCalls.Load()
+	names := []string{"a", "b", "c"}
+	var wg sync.WaitGroup
+	errs := make([]error, len(names))
+	for i, name := range names {
+		wg.Add(1)
+		go func(i int, name string) {
+			defer wg.Done()
+			if _, _, status := wfs.lookupEntry(context.Background(), dir.Child(name)); status != fuse.OK {
+				errs[i] = fmt.Errorf("lookupEntry %s: %v", name, status)
+			}
+		}(i, name)
+	}
+
+	<-started
+	// Hold the rebuild so the other lookups reach the singleflight while it
+	// is in flight, exercising the deduplication rather than serializing.
+	time.Sleep(50 * time.Millisecond)
+	close(gate)
+	wg.Wait()
+
+	for _, err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	if got := fake.listCalls.Load() - listCallsBefore; got != 1 {
+		t.Errorf("rebuild ListEntries RPCs = %d, want 1 (concurrent lookups should share one rebuild)", got)
+	}
+	if got := fake.lookupCalls.Load(); got != 0 {
+		t.Errorf("LookupDirectoryEntry RPCs = %d, want 0", got)
+	}
+}
+
+// TestLookupRebuildCooldownAfterFailure guards the failure path: a failed
+// rebuild records the attempt so an immediate retry is suppressed (per-entry
+// RPC fallback), and once the cooldown elapses and the filer recovers a later
+// lookup rebuilds the cache again.
+func TestLookupRebuildCooldownAfterFailure(t *testing.T) {
+	wfs := newLookupCacheTestWFS(t, 60)
+	dir := util.FullPath("/dir")
+	wfs.inodeToPath.Lookup(dir, time.Now().Unix(), true, false, 0, true)
+
+	fake := &lookupCacheTestFiler{
+		entries: []*filer_pb.Entry{
+			{Name: "a", Attributes: &filer_pb.FuseAttributes{FileSize: 1, FileMode: 0100644}},
+		},
+		snapshotTsNs: 5000,
+	}
+	startFakeFiler(t, wfs, fake)
+
+	if err := meta_cache.EnsureVisited(context.Background(), wfs.metaCache, wfs, dir, 0); err != nil {
+		t.Fatalf("EnsureVisited: %v", err)
+	}
+	expireDirCache(t, wfs.inodeToPath, dir)
+
+	// First lookup: rebuild fails, falls through to the per-entry RPC.
+	fake.listErr = errors.New("persistent listing failure")
+	listCallsBefore := fake.listCalls.Load()
+	lookupCallsBefore := fake.lookupCalls.Load()
+	if entry, _, status := wfs.lookupEntry(context.Background(), dir.Child("a")); status != fuse.OK || entry == nil || entry.Name() != "a" {
+		t.Fatalf("lookupEntry a after failed rebuild: status=%v entry=%v", status, entry)
+	}
+	if got := fake.lookupCalls.Load() - lookupCallsBefore; got != 1 {
+		t.Errorf("first lookup LookupDirectoryEntry RPCs = %d, want 1 (fall through to per-entry RPC)", got)
+	}
+	if got := fake.listCalls.Load() - listCallsBefore; got == 0 {
+		t.Error("first lookup should have attempted a rebuild")
+	}
+
+	// Immediate retry: cooldown suppresses the rebuild, falls through again.
+	listCallsBefore = fake.listCalls.Load()
+	lookupCallsBefore = fake.lookupCalls.Load()
+	if _, _, status := wfs.lookupEntry(context.Background(), dir.Child("a")); status != fuse.OK {
+		t.Fatalf("second lookupEntry a: %v", status)
+	}
+	if got := fake.listCalls.Load() - listCallsBefore; got != 0 {
+		t.Errorf("second lookup ListEntries RPCs = %d, want 0 (cooldown suppresses rebuild)", got)
+	}
+	if got := fake.lookupCalls.Load() - lookupCallsBefore; got != 1 {
+		t.Errorf("second lookup LookupDirectoryEntry RPCs = %d, want 1", got)
+	}
+
+	// Filer recovers and the cooldown elapses: the next lookup rebuilds.
+	fake.listErr = nil
+	advanceRebuildAttempt(t, wfs.inodeToPath, dir, expiredDirRebuildCooldown+time.Second)
+	listCallsBefore = fake.listCalls.Load()
+	lookupCallsBefore = fake.lookupCalls.Load()
+	if _, _, status := wfs.lookupEntry(context.Background(), dir.Child("a")); status != fuse.OK {
+		t.Fatalf("third lookupEntry a: %v", status)
+	}
+	if got := fake.listCalls.Load() - listCallsBefore; got != 1 {
+		t.Errorf("third lookup ListEntries RPCs = %d, want 1 (rebuild after cooldown)", got)
+	}
+	if got := fake.lookupCalls.Load() - lookupCallsBefore; got != 0 {
+		t.Errorf("third lookup LookupDirectoryEntry RPCs = %d, want 0 (served from rebuilt cache)", got)
+	}
+}
+
+// advanceRebuildAttempt moves a directory's last rebuild attempt back by d,
+// simulating the cooldown having elapsed without sleeping.
+func advanceRebuildAttempt(t *testing.T, itp *InodeToPath, dir util.FullPath, d time.Duration) {
+	t.Helper()
+	itp.Lock()
+	defer itp.Unlock()
+	state := itp.dirStateOf(dir)
+	if state == nil {
+		t.Fatalf("advanceRebuildAttempt: no dirState for %s", dir)
+	}
+	state.lastRebuildAttempt = time.Now().Add(-d)
+}
diff --git a/weed/mount/weedfs_dir_mkrm.go b/weed/mount/weedfs_dir_mkrm.go
index 1989bb3096..61317b1368 100644
--- a/weed/mount/weedfs_dir_mkrm.go
+++ b/weed/mount/weedfs_dir_mkrm.go
@@ -2,12 +2,13 @@ package mount
 
 import (
 	"context"
+	"errors"
 	"os"
-	"strings"
 	"syscall"
 	"time"
 
 	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"google.golang.org/protobuf/proto"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -75,6 +76,14 @@ func (wfs *WFS) Mkdir(cancel <-chan struct{}, in *fuse.MkdirIn, name string, out
 		Entry:                    newEntry,
 		Signatures:               []int32{wfs.signature},
 		SkipCheckParentDirectory: true,
+		// mkdir(2) is exclusive by contract: creating an existing path must
+		// fail with EEXIST. Without OExcl the filer treats a concurrent
+		// duplicate as an update and reports success to both callers; the
+		// kernel's pre-mkdir lookup only catches the duplicate when the
+		// winner's create is already visible, which a cross-node race defeats.
+		// The filer routes an OExcl create to the entry's ring owner, so its
+		// per-path lock arbitrates every creator in the cluster.
+		OExcl: true,
 	}
 
 	glog.V(1).Infof("mkdir: %v", request)
@@ -99,6 +108,14 @@ func (wfs *WFS) Mkdir(cancel <-chan struct{}, in *fuse.MkdirIn, name string, out
 
 	if err != nil {
 		wfs.mapPbIdFromFilerToLocal(newEntry)
+		if errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+			// Lost a create race: the path exists on the filer but not yet in
+			// this mount's cache. Drop the parent's children cache so the next
+			// lookup fetches the winner's entry instead of waiting for the
+			// metadata subscription to deliver it.
+			wfs.inodeToPath.InvalidateChildrenCache(dirFullPath)
+			return fuse.Status(syscall.EEXIST)
+		}
 		return fuse.EIO
 	}
 
@@ -139,10 +156,22 @@ func (wfs *WFS) Rmdir(cancel <-chan struct{}, header *fuse.InHeader, name string
 	}
 	entryFullPath := dirFullPath.Child(name)
 
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	targetEntry, _, targetCode := wfs.maybeLoadEntry(ctx, entryFullPath)
+	if targetCode == fuse.EINTR {
+		return targetCode
+	}
+	if targetCode != fuse.OK {
+		targetEntry = nil
+	}
+
 	// POSIX: enforce sticky bit on the parent directory.
-	if dirEntry, _, dirCode := wfs.maybeLoadEntry(dirFullPath); dirCode == fuse.OK && dirEntry != nil && dirEntry.Attributes != nil {
+	if dirEntry, _, dirCode := wfs.maybeLoadEntry(ctx, dirFullPath); dirCode != fuse.OK {
+		return dirCode
+	} else if dirEntry != nil && dirEntry.Attributes != nil {
 		targetUid := uint32(0)
-		if targetEntry, _, targetCode := wfs.maybeLoadEntry(entryFullPath); targetCode == fuse.OK && targetEntry != nil && targetEntry.Attributes != nil {
+		if targetEntry != nil && targetEntry.Attributes != nil {
 			targetUid = targetEntry.Attributes.Uid
 		}
 		if code := checkStickyBit(dirEntry.Attributes.FileMode, dirEntry.Attributes.Uid, targetUid, header.Uid); code != fuse.OK {
@@ -161,7 +190,7 @@ func (wfs *WFS) Rmdir(cancel <-chan struct{}, header *fuse.InHeader, name string
 	resp, err := wfs.streamDeleteEntry(context.Background(), deleteReq)
 	if err != nil {
 		glog.V(1).Infof("remove %s: %v", entryFullPath, err)
-		if strings.Contains(err.Error(), filer.MsgFailDelNonEmptyFolder) {
+		if filer.IsNonEmptyFolderError(err) {
 			return fuse.Status(syscall.ENOTEMPTY)
 		}
 		return fuse.ENOENT
@@ -175,7 +204,17 @@ func (wfs *WFS) Rmdir(cancel <-chan struct{}, header *fuse.InHeader, name string
 		glog.Warningf("rmdir %s: best-effort metadata apply failed: %v", entryFullPath, applyErr)
 		wfs.inodeToPath.InvalidateChildrenCache(dirFullPath)
 	}
-	wfs.inodeToPath.RemovePath(entryFullPath)
+	// The filer serialized the delete against concurrent updates and returned
+	// the entry as it stood; the snapshot loaded above may predate one.
+	if oldEntry := resp.GetMetadataEvent().GetEventNotification().GetOldEntry(); oldEntry.GetAttributes() != nil {
+		targetEntry = proto.Clone(oldEntry).(*filer_pb.Entry)
+		wfs.mapPbIdFromFilerToLocal(targetEntry)
+	}
+	wfs.inodeToPath.RemovePath(entryFullPath, func(inode uint64) {
+		if targetEntry != nil {
+			wfs.rememberRemovedDir(inode, targetEntry)
+		}
+	})
 	wfs.inodeToPath.TouchDirectory(dirFullPath)
 	wfs.touchDirMtimeCtimeBest(dirFullPath)
 	wfs.inodeToPath.AdjustSubdirCount(dirFullPath, -1)
diff --git a/weed/mount/weedfs_dir_read.go b/weed/mount/weedfs_dir_read.go
index 428d25ebcb..6e7a391592 100644
--- a/weed/mount/weedfs_dir_read.go
+++ b/weed/mount/weedfs_dir_read.go
@@ -3,6 +3,7 @@ package mount
 import (
 	"context"
 	"errors"
+	"strings"
 	"sync"
 	"time"
 
@@ -53,6 +54,26 @@ func (dh *DirectoryHandle) reset() {
 	dh.entryStreamOffset = directoryStreamBaseOffset
 }
 
+// dropConsumed releases the entries the client has already walked past.
+// Offsets are indexes into the stream from entryStreamOffset, so advancing the
+// two together keeps them lined up; one entry is kept back because the next
+// batch resumes from the name immediately before the offset.
+func (dh *DirectoryHandle) dropConsumed(offset uint64) {
+	if offset < dh.entryStreamOffset {
+		return
+	}
+	trim := int(offset-dh.entryStreamOffset) - 1
+	if trim <= 0 || trim > len(dh.entryStream) {
+		return
+	}
+	copy(dh.entryStream, dh.entryStream[trim:])
+	for i := len(dh.entryStream) - trim; i < len(dh.entryStream); i++ {
+		dh.entryStream[i] = nil
+	}
+	dh.entryStream = dh.entryStream[:len(dh.entryStream)-trim]
+	dh.entryStreamOffset += uint64(trim)
+}
+
 type DirectoryHandleToInode struct {
 	sync.Mutex
 	dir2inode map[DirectoryHandleId]*DirectoryHandle
@@ -155,14 +176,20 @@ func (wfs *WFS) FsyncDir(cancel <-chan struct{}, input *fuse.FsyncIn) (code fuse
  * '1'.
  */
 func (wfs *WFS) ReadDir(cancel <-chan struct{}, input *fuse.ReadIn, out *fuse.DirEntryList) (code fuse.Status) {
-	return wfs.doReadDirectory(input, fuseDirEntryList{out}, false)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	return wfs.doReadDirectory(ctx, input, fuseDirEntryList{out}, false)
 }
 
 func (wfs *WFS) ReadDirPlus(cancel <-chan struct{}, input *fuse.ReadIn, out *fuse.DirEntryList) (code fuse.Status) {
-	return wfs.doReadDirectory(input, fuseDirEntryList{out}, true)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	return wfs.doReadDirectory(ctx, input, fuseDirEntryList{out}, true)
 }
 
-func (wfs *WFS) doReadDirectory(input *fuse.ReadIn, out DirEntrySink, isPlusMode bool) fuse.Status {
+func (wfs *WFS) doReadDirectory(ctx context.Context, input *fuse.ReadIn, out DirEntrySink, isPlusMode bool) fuse.Status {
+	listingCtx := filer_pb.WithChunksOmitted(ctx)
+
 	// Get the directory handle and lock it for the duration of this operation.
 	// This serializes concurrent readdir calls on the same handle, fixing the
 	// race condition that caused hangs with NFS-Ganesha.
@@ -199,7 +226,11 @@ func (wfs *WFS) doReadDirectory(input *fuse.ReadIn, out DirEntrySink, isPlusMode
 	processEachEntryFn := func(entry *filer.Entry, index int64) bool {
 		dirEntry.Name = entry.Name()
 		dirEntry.Mode = toSyscallMode(entry.Mode)
-		childPath := dirPath.Child(dirEntry.Name)
+		// Rebuild only for a sanitized name: that is the one a LOOKUP carries.
+		childPath := entry.FullPath
+		if !strings.HasSuffix(string(childPath), dirEntry.Name) {
+			childPath = dirPath.Child(dirEntry.Name)
+		}
 		var inode uint64
 		if takesLookupRef {
 			inode = wfs.inodeToPath.Lookup(childPath, entry.Crtime.Unix(), entry.IsDirectory(), len(entry.HardLinkId) > 0, entry.Inode, false)
@@ -251,46 +282,54 @@ func (wfs *WFS) doReadDirectory(input *fuse.ReadIn, out DirEntrySink, isPlusMode
 
 	var lastEntryName string
 
+	// Both the cached and the direct walk page through the same stream, and a
+	// directory read through is precisely one too big to hold, so drop the
+	// consumed head before either of them appends to it.
+	dh.dropConsumed(input.Offset)
+
 	if wfs.inodeToPath.ShouldReadDirectoryDirect(dirPath) {
-		return wfs.readDirectoryDirect(input, out, dh, dirPath, processEachEntryFn)
+		return wfs.readDirectoryDirect(ctx, input, out, dh, dirPath, processEachEntryFn)
 	}
 
 	// Read from cache first, then load next batch if needed
 	if input.Offset >= dh.entryStreamOffset {
-		// Drop what the client has walked past. Offsets are indexes into the
-		// stream from entryStreamOffset, so advancing the two together keeps
-		// them lined up; one entry is kept back because the next batch resumes
-		// from the name immediately before the offset.
-		if trim := int(input.Offset-dh.entryStreamOffset) - 1; trim > 0 && trim <= len(dh.entryStream) {
-			copy(dh.entryStream, dh.entryStream[trim:])
-			for i := len(dh.entryStream) - trim; i < len(dh.entryStream); i++ {
-				dh.entryStream[i] = nil
-			}
-			dh.entryStream = dh.entryStream[:len(dh.entryStream)-trim]
-			dh.entryStreamOffset += uint64(trim)
-		}
-
 		// Handle case: new handle with non-zero offset but empty cache
 		// This happens when NFS-Ganesha opens multiple directory handles
 		if len(dh.entryStream) == 0 && input.Offset > dh.entryStreamOffset {
 			skipCount := int64(input.Offset - dh.entryStreamOffset)
 
-			if err := wfs.ensureDirectoryVisited(dirPath); err != nil {
+			if err := wfs.ensureDirectoryVisited(ctx, dirPath); err != nil {
 				var tooLarge *meta_cache.DirectoryTooLargeError
 				if errors.As(err, &tooLarge) {
-					return wfs.readDirectoryDirect(input, out, dh, dirPath, processEachEntryFn)
+					return wfs.readDirectoryDirect(ctx, input, out, dh, dirPath, processEachEntryFn)
+				}
+				if ctx.Err() != nil {
+					return fuse.EINTR
 				}
 				glog.Errorf("dir ReadDirAll %s: %v", dirPath, err)
 				return fuse.EIO
 			}
 
+			// Serve the maintained-but-unverified cache if the filer is unreachable.
+			if err := meta_cache.EnsureListingFresh(ctx, wfs.metaCache, wfs, dirPath, ""); err != nil {
+				if errors.Is(err, meta_cache.ErrRefreshRangeTooLarge) {
+					// re-tile with a full rebuild; serve this request direct
+					wfs.purgeDirectoryCache(dirPath)
+					return wfs.readDirectoryDirect(ctx, input, out, dh, dirPath, processEachEntryFn)
+				}
+				glog.V(1).Infof("refresh %s sections: %v", dirPath, err)
+			}
+
 			// Load entries from beginning to fill cache up to the requested offset
-			storeLastName, loadErr := wfs.metaCache.ListDirectoryEntries(readdirContext, dirPath, "", false, skipCount+int64(batchSize), func(entry *filer.Entry) (bool, error) {
+			storeLastName, loadErr := wfs.metaCache.ListDirectoryEntries(listingCtx, dirPath, "", false, skipCount+int64(batchSize), func(entry *filer.Entry) (bool, error) {
 				dh.entryStream = append(dh.entryStream, entry)
 				return true, nil
 			})
 			dh.lastListedName = storeLastName
 			if loadErr != nil {
+				if ctx.Err() != nil {
+					return fuse.EINTR
+				}
 				glog.Errorf("list meta cache: %v", loadErr)
 				return fuse.EIO
 			}
@@ -322,12 +361,15 @@ func (wfs *WFS) doReadDirectory(input *fuse.ReadIn, out DirEntrySink, isPlusMode
 		}
 
 		// Cache exhausted, load next batch
-		if err := wfs.ensureDirectoryVisited(dirPath); err != nil {
+		if err := wfs.ensureDirectoryVisited(ctx, dirPath); err != nil {
 			var tooLarge *meta_cache.DirectoryTooLargeError
 			if errors.As(err, &tooLarge) {
 				// The direct path keeps the same pagination state on dh, so it
 				// carries on from wherever the cached walk reached.
-				return wfs.readDirectoryDirect(input, out, dh, dirPath, processEachEntryFn)
+				return wfs.readDirectoryDirect(ctx, input, out, dh, dirPath, processEachEntryFn)
+			}
+			if ctx.Err() != nil {
+				return fuse.EINTR
 			}
 			glog.Errorf("dir ReadDirAll %s: %v", dirPath, err)
 			return fuse.EIO
@@ -341,8 +383,18 @@ func (wfs *WFS) doReadDirectory(input *fuse.ReadIn, out DirEntrySink, isPlusMode
 			lastEntryName = dh.lastListedName
 		}
 
+		// Serve the maintained-but-unverified cache if the filer is unreachable.
+		if err := meta_cache.EnsureListingFresh(ctx, wfs.metaCache, wfs, dirPath, lastEntryName); err != nil {
+			if errors.Is(err, meta_cache.ErrRefreshRangeTooLarge) {
+				// re-tile with a full rebuild; serve this request direct
+				wfs.purgeDirectoryCache(dirPath)
+				return wfs.readDirectoryDirect(ctx, input, out, dh, dirPath, processEachEntryFn)
+			}
+			glog.V(1).Infof("refresh %s sections: %v", dirPath, err)
+		}
+
 		bufferFull := false
-		storeLastName, loadErr := wfs.metaCache.ListDirectoryEntries(readdirContext, dirPath, lastEntryName, false, int64(batchSize), func(entry *filer.Entry) (bool, error) {
+		storeLastName, loadErr := wfs.metaCache.ListDirectoryEntries(listingCtx, dirPath, lastEntryName, false, int64(batchSize), func(entry *filer.Entry) (bool, error) {
 			currentIndex := int64(len(dh.entryStream))
 			dh.entryStream = append(dh.entryStream, entry)
 			if !processEachEntryFn(entry, currentIndex) {
@@ -352,6 +404,9 @@ func (wfs *WFS) doReadDirectory(input *fuse.ReadIn, out DirEntrySink, isPlusMode
 			return true, nil
 		})
 		if loadErr != nil {
+			if ctx.Err() != nil {
+				return fuse.EINTR
+			}
 			glog.Errorf("list meta cache: %v", loadErr)
 			return fuse.EIO
 		}
@@ -371,8 +426,8 @@ func (wfs *WFS) doReadDirectory(input *fuse.ReadIn, out DirEntrySink, isPlusMode
 // ensureDirectoryVisited pulls the directory into the local cache, unless it is
 // too large to cache: then the directory is marked read-through, so later
 // listings go straight to the filer without re-asking.
-func (wfs *WFS) ensureDirectoryVisited(dirPath util.FullPath) error {
-	err := meta_cache.EnsureVisited(wfs.metaCache, wfs, dirPath, wfs.option.CacheDirMaxEntries)
+func (wfs *WFS) ensureDirectoryVisited(ctx context.Context, dirPath util.FullPath) error {
+	err := meta_cache.EnsureVisited(ctx, wfs.metaCache, wfs, dirPath, wfs.option.CacheDirMaxEntries)
 	var tooLarge *meta_cache.DirectoryTooLargeError
 	if errors.As(err, &tooLarge) {
 		wfs.inodeToPath.MarkDirectoryReadThrough(dirPath, time.Now())
@@ -380,14 +435,18 @@ func (wfs *WFS) ensureDirectoryVisited(dirPath util.FullPath) error {
 	return err
 }
 
-func (wfs *WFS) readDirectoryDirect(input *fuse.ReadIn, out DirEntrySink, dh *DirectoryHandle, dirPath util.FullPath, processEachEntryFn func(entry *filer.Entry, index int64) bool) fuse.Status {
+func (wfs *WFS) readDirectoryDirect(ctx context.Context, input *fuse.ReadIn, out DirEntrySink, dh *DirectoryHandle, dirPath util.FullPath, processEachEntryFn func(entry *filer.Entry, index int64) bool) fuse.Status {
+	listingCtx := filer_pb.WithChunksOmitted(ctx)
 	var lastEntryName string
 
 	if input.Offset >= dh.entryStreamOffset {
 		if len(dh.entryStream) == 0 && input.Offset > dh.entryStreamOffset {
 			skipCount := uint32(input.Offset-dh.entryStreamOffset) + batchSize
-			entries, snapshotTs, err := loadDirectoryEntriesDirect(readdirContext, wfs, wfs.option.UidGidMapper, dirPath, "", false, skipCount, dh.snapshotTsNs, wfs.option.IncludeSystemEntries)
+			entries, snapshotTs, err := loadDirectoryEntriesDirect(listingCtx, wfs, wfs.option.UidGidMapper, dirPath, "", false, skipCount, dh.snapshotTsNs, wfs.option.IncludeSystemEntries)
 			if err != nil {
+				if ctx.Err() != nil {
+					return fuse.EINTR
+				}
 				glog.Errorf("list filer directory: %v", err)
 				return fuse.EIO
 			}
@@ -420,8 +479,11 @@ func (wfs *WFS) readDirectoryDirect(input *fuse.ReadIn, out DirEntrySink, dh *Di
 			}
 		}
 
-		entries, snapshotTs, err := loadDirectoryEntriesDirect(readdirContext, wfs, wfs.option.UidGidMapper, dirPath, lastEntryName, false, batchSize, dh.snapshotTsNs, wfs.option.IncludeSystemEntries)
+		entries, snapshotTs, err := loadDirectoryEntriesDirect(listingCtx, wfs, wfs.option.UidGidMapper, dirPath, lastEntryName, false, batchSize, dh.snapshotTsNs, wfs.option.IncludeSystemEntries)
 		if err != nil {
+			if ctx.Err() != nil {
+				return fuse.EINTR
+			}
 			glog.Errorf("list filer directory: %v", err)
 			return fuse.EIO
 		}
diff --git a/weed/mount/weedfs_dir_read_bench_test.go b/weed/mount/weedfs_dir_read_bench_test.go
index a78da820d9..e8c48ad83c 100644
--- a/weed/mount/weedfs_dir_read_bench_test.go
+++ b/weed/mount/weedfs_dir_read_bench_test.go
@@ -163,7 +163,7 @@ func walkOnce(tb testing.TB, wfs *WFS, dirInode uint64, sink *benchSink, forgets
 	offset := uint64(0)
 	for {
 		sink.reset()
-		status := wfs.doReadDirectory(&fuse.ReadIn{
+		status := wfs.doReadDirectory(context.Background(), &fuse.ReadIn{
 			InHeader: fuse.InHeader{NodeId: dirInode},
 			Fh:       uint64(dhid),
 			Offset:   offset,
diff --git a/weed/mount/weedfs_dir_read_pagination_test.go b/weed/mount/weedfs_dir_read_pagination_test.go
index 00e07d7e1a..63b979c182 100644
--- a/weed/mount/weedfs_dir_read_pagination_test.go
+++ b/weed/mount/weedfs_dir_read_pagination_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/mount/meta_cache"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -110,7 +111,7 @@ func TestReadDirResumePastShrunkDirectory(t *testing.T) {
 	defer wfs.ReleaseDirectoryHandle(dhid)
 
 	sink := &pagingSink{limit: 4096}
-	status := wfs.doReadDirectory(&fuse.ReadIn{
+	status := wfs.doReadDirectory(context.Background(), &fuse.ReadIn{
 		InHeader: fuse.InHeader{NodeId: dirInode},
 		Fh:       uint64(dhid),
 		Offset:   152, // past the end of a directory that now holds 100
@@ -157,7 +158,7 @@ func TestReadDirWithExpiredEntries(t *testing.T) {
 	var offset uint64
 	for round := 0; round < 20; round++ {
 		sink.round = 0
-		status := wfs.doReadDirectory(&fuse.ReadIn{
+		status := wfs.doReadDirectory(context.Background(), &fuse.ReadIn{
 			InHeader: fuse.InHeader{NodeId: dirInode},
 			Fh:       uint64(dhid),
 			Offset:   offset,
@@ -208,7 +209,7 @@ func TestReadDirTrimsConsumedEntries(t *testing.T) {
 	for round := 0; round < 500; round++ {
 		sink.round = 0
 		before := len(sink.names)
-		status := wfs.doReadDirectory(&fuse.ReadIn{
+		status := wfs.doReadDirectory(context.Background(), &fuse.ReadIn{
 			InHeader: fuse.InHeader{NodeId: dirInode},
 			Fh:       uint64(dhid),
 			Offset:   offset,
@@ -244,3 +245,115 @@ func TestReadDirTrimsConsumedEntries(t *testing.T) {
 		t.Errorf("handle held %d entries at peak, want well under the %d in the directory", peak, total)
 	}
 }
+
+// listingFilerServer serves a fixed, sorted child list the way the filer
+// paginates one.
+type listingFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	names []string
+}
+
+func (s *listingFilerServer) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	var sent uint32
+	for _, name := range s.names {
+		if name < req.StartFromFileName || (name == req.StartFromFileName && !req.InclusiveStartFrom) {
+			continue
+		}
+		if req.Limit > 0 && sent >= req.Limit {
+			break
+		}
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: &filer_pb.Entry{
+			Name:       name,
+			Attributes: &filer_pb.FuseAttributes{FileMode: 0o644, FileSize: 1},
+		}}); err != nil {
+			return err
+		}
+		sent++
+	}
+	return nil
+}
+
+// TestReadDirDirectTrimsConsumedEntries is the same check for a directory read
+// through to the filer. That path is taken precisely for directories too big to
+// cache, so holding the whole walk in the handle is where a listing turns into
+// gigabytes of resident memory.
+func TestReadDirDirectTrimsConsumedEntries(t *testing.T) {
+	dir := util.FullPath("/d")
+	const total = 5000
+	var names []string
+	for i := 0; i < total; i++ {
+		names = append(names, fmt.Sprintf("f%05d", i))
+	}
+	wfs := newPagingWFS(t, dir, nil, 0)
+	startFakeFiler(t, wfs, &listingFilerServer{names: names})
+	dirInode, _ := wfs.inodeToPath.GetInode(dir)
+	if !wfs.inodeToPath.MarkDirectoryReadThrough(dir, time.Now()) {
+		t.Fatal("directory did not enter read-through mode")
+	}
+
+	dhid, dh := wfs.AcquireDirectoryHandle()
+	defer wfs.ReleaseDirectoryHandle(dhid)
+
+	sink := &pagingSink{limit: 64}
+	var offset uint64
+	var seen []string
+	peak := 0
+	for round := 0; round < 500; round++ {
+		sink.round = 0
+		before := len(sink.names)
+		status := wfs.doReadDirectory(context.Background(), &fuse.ReadIn{
+			InHeader: fuse.InHeader{NodeId: dirInode},
+			Fh:       uint64(dhid),
+			Offset:   offset,
+			Size:     1 << 20,
+		}, sink, false)
+		if status != fuse.OK {
+			t.Fatalf("readdir: %v", status)
+		}
+		if n := len(dh.entryStream); n > peak {
+			peak = n
+		}
+		if len(sink.names) == before || sink.lastOff <= offset {
+			break
+		}
+		offset = sink.lastOff
+	}
+	for _, n := range sink.names {
+		if n != "." && n != ".." {
+			seen = append(seen, n)
+		}
+	}
+
+	if len(seen) != total {
+		t.Fatalf("listed %d entries, want %d", len(seen), total)
+	}
+	for i, name := range seen {
+		if want := fmt.Sprintf("f%05d", i); name != want {
+			t.Fatalf("entry %d is %q, want %q -- trimming misaligned the offsets", i, name, want)
+		}
+	}
+	if peak >= total {
+		t.Errorf("handle held %d entries at peak, want well under the %d in the directory", peak, total)
+	}
+}
+
+// The table has to key on the sanitized name, not the stored bytes.
+func TestReadDirPlusSanitizedName(t *testing.T) {
+	dir := util.FullPath("/images")
+	const rawName = "bad\xffname.jpg"
+	wfs := newPagingWFS(t, dir, []string{"good.jpg", rawName}, 0)
+	dirInode, _ := wfs.inodeToPath.GetInode(dir)
+
+	sink := &benchSink{plus: true, takesRef: true, sinkLimit: 16}
+	if got := walkOnce(t, wfs, dirInode, sink, false); got != 4 {
+		t.Fatalf("listed %d entries, want 4 (. .. and two children)", got)
+	}
+
+	sanitized := dir.Child(util.SanitizeUTF8Name(rawName))
+	if !wfs.inodeToPath.HasPath(sanitized) {
+		t.Errorf("%s not in the inode table", sanitized)
+	}
+	if wfs.inodeToPath.HasPath(dir.Child(rawName)) {
+		t.Errorf("%s keyed on the unsanitized name", dir.Child(rawName))
+	}
+}
diff --git a/weed/mount/weedfs_file_fallocate.go b/weed/mount/weedfs_file_fallocate.go
new file mode 100644
index 0000000000..755ca11a30
--- /dev/null
+++ b/weed/mount/weedfs_file_fallocate.go
@@ -0,0 +1,72 @@
+package mount
+
+import (
+	"syscall"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// See https://man7.org/linux/man-pages/man2/fallocate.2.html
+const FALLOC_FL_KEEP_SIZE uint32 = 0x01
+
+// Fallocate allocates space for an open file. Volume space is assigned when a
+// write is flushed, so nothing can be reserved up front; only a range past the
+// end of the file has an effect, growing it the way a truncate would.
+func (wfs *WFS) Fallocate(cancel <-chan struct{}, in *fuse.FallocateIn) (code fuse.Status) {
+
+	// ENOSYS makes the kernel stop sending FUSE_FALLOCATE for every mode, so a
+	// mode we cannot honor has to be refused on its own.
+	if in.Mode&^FALLOC_FL_KEEP_SIZE != 0 {
+		return fuse.ENOTSUP
+	}
+
+	fh := wfs.GetHandle(FileHandleId(in.Fh))
+	if fh == nil {
+		return fuse.EBADF
+	}
+
+	fhActiveLock := fh.wfs.fhLockTable.AcquireLock("Fallocate", fh.fh, util.ExclusiveLock)
+	defer fh.wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
+
+	entry := fh.GetEntry().GetEntry()
+	if entry == nil {
+		return fuse.ENOENT
+	}
+
+	oldFileSize := filer.FileSize(entry)
+	newFileSize := in.Offset + in.Length
+	if in.Mode&FALLOC_FL_KEEP_SIZE != 0 || newFileSize <= oldFileSize {
+		return fuse.OK
+	}
+
+	if wfs.IsOverQuotaWithUncommitted() {
+		return fuse.Status(syscall.ENOSPC)
+	}
+
+	if wormEnforced, _ := wfs.wormEnforcedForEntry(fh.FullPath(), entry); wormEnforced {
+		return fuse.EPERM
+	}
+
+	glog.V(4).Infof("Fallocate %s fh %d grow to %d", fh.FullPath(), fh.fh, newFileSize)
+
+	entry.Attributes.FileSize = newFileSize
+	// The writes that fill the range will not grow the file, so they charge
+	// nothing; the growth is counted here or the quota never sees it.
+	wfs.AddUncommittedBytes(int64(newFileSize - oldFileSize))
+
+	now := time.Now()
+	entry.Attributes.Mtime = now.Unix()
+	entry.Attributes.MtimeNs = int32(now.Nanosecond())
+	entry.Attributes.Ctime = now.Unix()
+	entry.Attributes.CtimeNs = int32(now.Nanosecond())
+
+	fh.dirtyMetadata = true
+	wfs.invalidateOpenMtimeCache(in.NodeId)
+
+	return fuse.OK
+}
diff --git a/weed/mount/weedfs_file_fallocate_test.go b/weed/mount/weedfs_file_fallocate_test.go
new file mode 100644
index 0000000000..a0e8c934f1
--- /dev/null
+++ b/weed/mount/weedfs_file_fallocate_test.go
@@ -0,0 +1,159 @@
+package mount
+
+import (
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// newOpenFileHandle builds a WFS holding one open handle on a file of the given
+// size, the state a descriptor is in after an open and before any write.
+func newOpenFileHandle(t *testing.T, fileSize uint64) (*WFS, *FileHandle) {
+	t.Helper()
+
+	wfs := newCopyRangeTestWFS()
+	path := util.FullPath("/file.txt")
+	inode := wfs.inodeToPath.Lookup(path, 1, false, false, 0, true)
+	fh, _ := wfs.fhMap.AcquireFileHandle(wfs, inode, &filer_pb.Entry{
+		Name: "file.txt",
+		Attributes: &filer_pb.FuseAttributes{
+			FileMode: 0100644,
+			FileSize: fileSize,
+			Inode:    inode,
+		},
+	}, 0, 0)
+	fh.RememberPath(path)
+
+	return wfs, fh
+}
+
+// TestFallocateWithinFile covers the posix_fallocate() case that used to fall
+// back to a glibc emulation reading through a write-only descriptor: the range
+// is already inside the file, so the file must be left alone and answered OK.
+func TestFallocateWithinFile(t *testing.T) {
+	wfs, fh := newOpenFileHandle(t, 10)
+
+	in := &fuse.FallocateIn{Fh: uint64(fh.fh), Offset: 0, Length: 1}
+	if status := wfs.Fallocate(nil, in); status != fuse.OK {
+		t.Fatalf("Fallocate inside the file: got %v, want OK", status)
+	}
+	if got := fh.GetEntry().GetEntry().GetAttributes().GetFileSize(); got != 10 {
+		t.Fatalf("file size: got %d, want 10", got)
+	}
+	if fh.dirtyMetadata {
+		t.Fatal("Fallocate inside the file marked the handle dirty")
+	}
+}
+
+func TestFallocateGrowsFile(t *testing.T) {
+	wfs, fh := newOpenFileHandle(t, 10)
+
+	in := &fuse.FallocateIn{Fh: uint64(fh.fh), Offset: 4096, Length: 4096}
+	if status := wfs.Fallocate(nil, in); status != fuse.OK {
+		t.Fatalf("Fallocate past the end: got %v, want OK", status)
+	}
+	if got := fh.GetEntry().GetEntry().GetAttributes().GetFileSize(); got != 8192 {
+		t.Fatalf("file size: got %d, want 8192", got)
+	}
+	if !fh.dirtyMetadata {
+		t.Fatal("Fallocate past the end did not mark the handle dirty")
+	}
+}
+
+func TestFallocateKeepSize(t *testing.T) {
+	wfs, fh := newOpenFileHandle(t, 10)
+
+	in := &fuse.FallocateIn{Fh: uint64(fh.fh), Offset: 0, Length: 4096, Mode: FALLOC_FL_KEEP_SIZE}
+	if status := wfs.Fallocate(nil, in); status != fuse.OK {
+		t.Fatalf("Fallocate with FALLOC_FL_KEEP_SIZE: got %v, want OK", status)
+	}
+	if got := fh.GetEntry().GetEntry().GetAttributes().GetFileSize(); got != 10 {
+		t.Fatalf("file size: got %d, want 10", got)
+	}
+}
+
+// TestFallocateUnsupportedMode pins the status for a mode we cannot honor:
+// ENOSYS would make the kernel stop sending FUSE_FALLOCATE altogether.
+func TestFallocateUnsupportedMode(t *testing.T) {
+	wfs, fh := newOpenFileHandle(t, 10)
+
+	const punchHole = 0x02
+	in := &fuse.FallocateIn{Fh: uint64(fh.fh), Offset: 0, Length: 4, Mode: punchHole | FALLOC_FL_KEEP_SIZE}
+	if status := wfs.Fallocate(nil, in); status != fuse.ENOTSUP {
+		t.Fatalf("Fallocate with FALLOC_FL_PUNCH_HOLE: got %v, want ENOTSUP", status)
+	}
+}
+
+func TestFallocateUnknownHandle(t *testing.T) {
+	wfs, _ := newOpenFileHandle(t, 10)
+
+	in := &fuse.FallocateIn{Fh: 12345, Offset: 0, Length: 1}
+	if status := wfs.Fallocate(nil, in); status != fuse.EBADF {
+		t.Fatalf("Fallocate on an unknown handle: got %v, want EBADF", status)
+	}
+}
+
+// TestFallocateNoOpIgnoresQuotaAndWorm covers the two guards a request that
+// allocates nothing must not trip: it reserves no space and rewrites no entry.
+func TestFallocateNoOpIgnoresQuotaAndWorm(t *testing.T) {
+	wfs, fh := newOpenFileHandle(t, 10)
+	wfs.option.Quota = 1
+	wfs.IsOverQuota = true
+	wfs.FilerConf = filer.NewFilerConf()
+	if err := wfs.FilerConf.AddLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/",
+		Worm:           proto.Bool(true),
+	}); err != nil {
+		t.Fatalf("AddLocationConf: %v", err)
+	}
+	fh.GetEntry().GetEntry().WormEnforcedAtTsNs = time.Now().UnixNano()
+
+	in := &fuse.FallocateIn{Fh: uint64(fh.fh), Offset: 0, Length: 1}
+	if status := wfs.Fallocate(nil, in); status != fuse.OK {
+		t.Fatalf("Fallocate inside the file: got %v, want OK", status)
+	}
+
+	in = &fuse.FallocateIn{Fh: uint64(fh.fh), Offset: 0, Length: 4096}
+	if status := wfs.Fallocate(nil, in); status != fuse.Status(syscall.ENOSPC) {
+		t.Fatalf("Fallocate past the end over quota: got %v, want ENOSPC", status)
+	}
+
+	wfs.option.Quota = 0
+	wfs.IsOverQuota = false
+	if status := wfs.Fallocate(nil, in); status != fuse.EPERM {
+		t.Fatalf("Fallocate past the end under worm: got %v, want EPERM", status)
+	}
+}
+
+// TestFallocateChargesTheGrowth pins the quota accounting: the writes that fill
+// a pre-extended range do not grow the file, so they charge nothing and the
+// growth has to be counted where it happens.
+func TestFallocateChargesTheGrowth(t *testing.T) {
+	atomic.StoreInt64(&uncommittedBytes, 0)
+	wfs, fh := newOpenFileHandle(t, 10)
+	wfs.option.Quota = 100 << 20
+
+	in := &fuse.FallocateIn{Fh: uint64(fh.fh), Offset: 0, Length: 8192}
+	if status := wfs.Fallocate(nil, in); status != fuse.OK {
+		t.Fatalf("Fallocate past the end: got %v, want OK", status)
+	}
+	if got := wfs.GetUncommittedBytes(); got != 8192-10 {
+		t.Fatalf("uncommitted bytes: got %d, want %d", got, 8192-10)
+	}
+
+	// A second request inside the now-larger file allocates nothing more.
+	if status := wfs.Fallocate(nil, in); status != fuse.OK {
+		t.Fatalf("Fallocate inside the file: got %v, want OK", status)
+	}
+	if got := wfs.GetUncommittedBytes(); got != 8192-10 {
+		t.Fatalf("uncommitted bytes after a no-op: got %d, want %d", got, 8192-10)
+	}
+}
diff --git a/weed/mount/weedfs_file_io.go b/weed/mount/weedfs_file_io.go
index b40a489a48..e38d894b2e 100644
--- a/weed/mount/weedfs_file_io.go
+++ b/weed/mount/weedfs_file_io.go
@@ -65,7 +65,9 @@ import (
 */
 func (wfs *WFS) Open(cancel <-chan struct{}, in *fuse.OpenIn, out *fuse.OpenOut) (status fuse.Status) {
 	var fileHandle *FileHandle
-	fileHandle, status = wfs.AcquireHandle(in.NodeId, in.Flags, in.Uid, in.Gid)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	fileHandle, status = wfs.AcquireHandle(ctx, in.NodeId, in.Flags, in.Uid, in.Gid)
 	if status == fuse.OK {
 		out.Fh = uint64(fileHandle.fh)
 		out.OpenFlags = 0
@@ -138,6 +140,12 @@ func (wfs *WFS) invalidateOpenMtimeCache(inode uint64) {
 }
 
 func (wfs *WFS) Release(cancel <-chan struct{}, in *fuse.ReleaseIn) {
+	// Drop the file description's flock locks first: close() frees them
+	// regardless of how writeback fares, and a flush stuck on an unreachable
+	// filer must not pin a dead holder's lock in the table.
+	if in.ReleaseFlags&fuse.FUSE_RELEASE_FLOCK_UNLOCK != 0 {
+		wfs.releaseFlockOwner(in.NodeId, in.LockOwner)
+	}
 	// Flush is usually sent before Release, but the FUSE protocol does not
 	// guarantee it. Route every Release through doFlush so a dirty handle
 	// (e.g. a deferred create with no intervening Flush) is not dropped.
@@ -151,8 +159,5 @@ func (wfs *WFS) Release(cancel <-chan struct{}, in *fuse.ReleaseIn) {
 			glog.Warningf("release fh %d inode %d: fallback flush failed: %v", in.Fh, in.NodeId, status)
 		}
 	}
-	if in.ReleaseFlags&fuse.FUSE_RELEASE_FLOCK_UNLOCK != 0 {
-		wfs.releaseFlockOwner(in.NodeId, in.LockOwner)
-	}
 	wfs.ReleaseHandle(FileHandleId(in.Fh))
 }
diff --git a/weed/mount/weedfs_file_lseek.go b/weed/mount/weedfs_file_lseek.go
index 9a1d1d2d76..06ebfc1446 100644
--- a/weed/mount/weedfs_file_lseek.go
+++ b/weed/mount/weedfs_file_lseek.go
@@ -70,19 +70,22 @@ func (wfs *WFS) Lseek(cancel <-chan struct{}, in *fuse.LseekIn, out *fuse.LseekO
 	}()
 
 	// search chunks for the offset
-	found, offset := fh.entryChunkGroup.SearchChunks(ctx, offset, fileSize, in.Whence)
+	found, offset, err := fh.entryChunkGroup.SearchChunks(ctx, offset, fileSize, in.Whence)
+	if err != nil {
+		glog.Errorf("Lseek %s: %v", fh.FullPath(), err)
+		return fuse.EIO
+	}
 	if found {
 		out.Offset = uint64(offset)
 		return fuse.OK
 	}
 
-	// in case we found no exact matches, we return the recommended fallbacks, that is:
-	// original offset for SEEK_DATA or end of file for an implicit hole
 	if in.Whence == SEEK_DATA {
-		out.Offset = in.Offset
-	} else {
-		out.Offset = uint64(fileSize)
+		return ENXIO
 	}
 
+	// If no explicit hole was found, the hole after the final data range is
+	// implicit and starts at the end of the file.
+	out.Offset = uint64(fileSize)
 	return fuse.OK
 }
diff --git a/weed/mount/weedfs_file_lseek_test.go b/weed/mount/weedfs_file_lseek_test.go
new file mode 100644
index 0000000000..144cb28da1
--- /dev/null
+++ b/weed/mount/weedfs_file_lseek_test.go
@@ -0,0 +1,34 @@
+package mount
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+func TestLseekReturnsENXIOWhenNoDataFollowsOffset(t *testing.T) {
+	wfs, fh := newOpenFileHandle(t, 1000)
+	fh.SetEntry(&filer_pb.Entry{
+		Name: "file.txt",
+		Attributes: &filer_pb.FuseAttributes{
+			FileMode: 0100644,
+			FileSize: 1000,
+			Inode:    fh.inode,
+		},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: "data", Offset: 0, Size: 100},
+		},
+	})
+
+	in := &fuse.LseekIn{
+		Fh:     uint64(fh.fh),
+		Offset: 100,
+		Whence: SEEK_DATA,
+	}
+	var out fuse.LseekOut
+
+	if status := wfs.Lseek(nil, in, &out); status != ENXIO {
+		t.Fatalf("Lseek(SEEK_DATA) status = %v, want ENXIO", status)
+	}
+}
diff --git a/weed/mount/weedfs_file_mkrm.go b/weed/mount/weedfs_file_mkrm.go
index a7090b403b..62aa7116e0 100644
--- a/weed/mount/weedfs_file_mkrm.go
+++ b/weed/mount/weedfs_file_mkrm.go
@@ -9,6 +9,7 @@ import (
 	"github.com/seaweedfs/go-fuse/v2/fuse"
 	"google.golang.org/protobuf/proto"
 
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -40,7 +41,9 @@ func (wfs *WFS) Create(cancel <-chan struct{}, in *fuse.CreateIn, name string, o
 	entryFullPath := dirFullPath.Child(name)
 	var inode uint64
 
-	newEntry, _, code := wfs.maybeLoadEntry(entryFullPath)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	newEntry, _, code := wfs.maybeLoadEntry(ctx, entryFullPath)
 	if code == fuse.OK {
 		if newEntry == nil || newEntry.Attributes == nil {
 			return fuse.EIO
@@ -51,7 +54,7 @@ func (wfs *WFS) Create(cancel <-chan struct{}, in *fuse.CreateIn, name string, o
 			return fuse.Status(syscall.EEXIST)
 		}
 		inode = wfs.inodeToPath.Lookup(entryFullPath, newEntry.Attributes.Crtime, false, len(newEntry.HardLinkId) > 0, newEntry.Attributes.Inode, true)
-		fileHandle, status := wfs.AcquireHandle(inode, in.Flags, in.Uid, in.Gid)
+		fileHandle, status := wfs.AcquireHandle(ctx, inode, in.Flags, in.Uid, in.Gid)
 		if status != fuse.OK {
 			return status
 		}
@@ -72,11 +75,27 @@ func (wfs *WFS) Create(cancel <-chan struct{}, in *fuse.CreateIn, name string, o
 		return code
 	}
 
-	inode, newEntry, code = wfs.createRegularFile(dirFullPath, name, in.Mode, in.Uid, in.Gid, 0, true, true)
+	// Acquire the DLM lock before the filer create: a lock failure after an
+	// eager create would return EAGAIN while the file stays persisted.
+	var dlmLock *cluster.LiveLock
+	if wfs.lockClient != nil {
+		owner := fmt.Sprintf("mount-%d", wfs.signature)
+		dlmLock = wfs.lockClient.NewBlockingLongLivedLock(
+			string(entryFullPath), owner, lock_manager.LiveLockTTL,
+		)
+		if dlmLock == nil {
+			return fuse.Status(syscall.EAGAIN)
+		}
+	}
+
+	inode, newEntry, code = wfs.createRegularFile(ctx, dirFullPath, name, in.Mode, in.Uid, in.Gid, 0, !wfs.option.EagerFilerCreate, true)
 	if code == fuse.Status(syscall.EEXIST) && in.Flags&syscall.O_EXCL == 0 {
 		// Race: another process created the file between our check and create.
-		// Reopen the winner's entry.
-		newEntry, _, code = wfs.maybeLoadEntry(entryFullPath)
+		// Reopen the winner's entry; AcquireHandle takes its own lock.
+		if dlmLock != nil {
+			dlmLock.Stop()
+		}
+		newEntry, _, code = wfs.maybeLoadEntry(ctx, entryFullPath)
 		if code != fuse.OK {
 			return code
 		}
@@ -84,7 +103,7 @@ func (wfs *WFS) Create(cancel <-chan struct{}, in *fuse.CreateIn, name string, o
 			return fuse.EIO
 		}
 		inode = wfs.inodeToPath.Lookup(entryFullPath, newEntry.Attributes.Crtime, false, len(newEntry.HardLinkId) > 0, newEntry.Attributes.Inode, true)
-		fileHandle, status := wfs.AcquireHandle(inode, in.Flags, in.Uid, in.Gid)
+		fileHandle, status := wfs.AcquireHandle(ctx, inode, in.Flags, in.Uid, in.Gid)
 		if status != fuse.OK {
 			return status
 		}
@@ -100,6 +119,9 @@ func (wfs *WFS) Create(cancel <-chan struct{}, in *fuse.CreateIn, name string, o
 		out.OpenFlags = 0
 		return fuse.OK
 	} else if code != fuse.OK {
+		if dlmLock != nil {
+			dlmLock.Stop()
+		}
 		return code
 	} else {
 		inode = wfs.inodeToPath.Lookup(entryFullPath, newEntry.Attributes.Crtime, false, false, inode, true)
@@ -117,19 +139,20 @@ func (wfs *WFS) Create(cancel <-chan struct{}, in *fuse.CreateIn, name string, o
 		fileHandle.SetEntry(newEntry)
 	}
 	fileHandle.RememberPath(entryFullPath)
-	// Mark dirty so the deferred filer create happens on Flush,
-	// even if the file is closed without any writes.
-	fileHandle.dirtyMetadata = true
+	// Mark dirty so the deferred filer create happens on Flush, even if the
+	// file is closed without any writes. An eager create has already
+	// persisted the entry, so its handle starts clean.
+	fileHandle.dirtyMetadata = !wfs.option.EagerFilerCreate
 
-	// Acquire DLM lock for new file creation (Create bypasses AcquireHandle
-	// so we must acquire the lock here). Always lock on Create since file
-	// creation is inherently a write operation.
-	if wfs.lockClient != nil && fileHandle.dlmLock == nil {
-		owner := fmt.Sprintf("mount-%d", wfs.signature)
-		fileHandle.dlmLock = wfs.lockClient.NewBlockingLongLivedLock(
-			string(entryFullPath), owner, lock_manager.LiveLockTTL,
-		)
-		glog.V(1).Infof("DLM lock acquired for new file %s", entryFullPath)
+	// Create bypasses AcquireHandle, so attach the lock acquired above.
+	// A surviving handle may already hold one; ours is redundant then.
+	if dlmLock != nil {
+		if fileHandle.dlmLock == nil {
+			fileHandle.dlmLock = dlmLock
+			glog.V(1).Infof("DLM lock acquired for new file %s", entryFullPath)
+		} else {
+			dlmLock.Stop()
+		}
 	}
 
 	out.Fh = uint64(fileHandle.fh)
@@ -156,7 +179,9 @@ func (wfs *WFS) Mknod(cancel <-chan struct{}, in *fuse.MknodIn, name string, out
 		return
 	}
 
-	inode, newEntry, code := wfs.createRegularFile(dirFullPath, name, in.Mode, in.Uid, in.Gid, in.Rdev, false, false)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	inode, newEntry, code := wfs.createRegularFile(ctx, dirFullPath, name, in.Mode, in.Uid, in.Gid, in.Rdev, false, false)
 	if code != fuse.OK {
 		return code
 	}
@@ -186,7 +211,9 @@ func (wfs *WFS) Unlink(cancel <-chan struct{}, header *fuse.InHeader, name strin
 	}
 	entryFullPath := dirFullPath.Child(name)
 
-	entry, _, code := wfs.maybeLoadEntry(entryFullPath)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	entry, _, code := wfs.maybeLoadEntry(ctx, entryFullPath)
 	if code != fuse.OK {
 		if code == fuse.ENOENT {
 			return fuse.OK
@@ -215,7 +242,7 @@ func (wfs *WFS) Unlink(cancel <-chan struct{}, header *fuse.InHeader, name strin
 		// maybeLoadEntry path above. Do not fall back to the stale
 		// pre-lock snapshot: proceeding with its HardLinkCounter would
 		// reintroduce the stale-base update the lock is meant to prevent.
-		fresh, _, freshCode := wfs.maybeLoadEntry(entryFullPath)
+		fresh, _, freshCode := wfs.maybeLoadEntry(ctx, entryFullPath)
 		if freshCode == fuse.ENOENT {
 			return fuse.OK
 		}
@@ -226,7 +253,9 @@ func (wfs *WFS) Unlink(cancel <-chan struct{}, header *fuse.InHeader, name strin
 	}
 
 	// POSIX: enforce sticky bit on the parent directory.
-	if dirEntry, _, dirCode := wfs.maybeLoadEntry(dirFullPath); dirCode == fuse.OK && dirEntry != nil && dirEntry.Attributes != nil {
+	if dirEntry, _, dirCode := wfs.maybeLoadEntry(ctx, dirFullPath); dirCode != fuse.OK {
+		return dirCode
+	} else if dirEntry != nil && dirEntry.Attributes != nil {
 		targetUid := uint32(0)
 		if entry != nil && entry.Attributes != nil {
 			targetUid = entry.Attributes.Uid
@@ -244,16 +273,12 @@ func (wfs *WFS) Unlink(cancel <-chan struct{}, header *fuse.InHeader, name strin
 	// finishes first; even if it recreated the entry, the filer delete below
 	// will remove it again.
 	if inode, found := wfs.inodeToPath.GetInode(entryFullPath); found {
-		if fh, fhFound := wfs.fhMap.FindFileHandle(inode); fhFound {
-			fh.isDeleted = true
-		}
-		wfs.waitForPendingAsyncFlush(inode)
+		wfs.markHandleDeleted(inode)
+		wfs.waitForPendingAsyncFlush(context.Background(), inode)
 	} else if entry != nil && entry.Attributes != nil && entry.Attributes.Inode != 0 {
 		inodeFromEntry := entry.Attributes.Inode
-		if fh, fhFound := wfs.fhMap.FindFileHandle(inodeFromEntry); fhFound {
-			fh.isDeleted = true
-		}
-		wfs.waitForPendingAsyncFlush(inodeFromEntry)
+		wfs.markHandleDeleted(inodeFromEntry)
+		wfs.waitForPendingAsyncFlush(context.Background(), inodeFromEntry)
 	}
 
 	// first, ensure the filer store can correctly delete
@@ -305,7 +330,7 @@ func (wfs *WFS) Unlink(cancel <-chan struct{}, header *fuse.InHeader, name strin
 		}
 	}
 
-	wfs.inodeToPath.RemovePath(entryFullPath)
+	wfs.inodeToPath.RemovePath(entryFullPath, nil)
 
 	if isHardLink && sharedInode != 0 {
 		decremented := proto.Clone(entry).(*filer_pb.Entry)
@@ -320,7 +345,7 @@ func (wfs *WFS) Unlink(cancel <-chan struct{}, header *fuse.InHeader, name strin
 
 }
 
-func (wfs *WFS) createRegularFile(dirFullPath util.FullPath, name string, mode uint32, uid, gid, rdev uint32, deferFilerCreate bool, skipExistenceCheck bool) (inode uint64, newEntry *filer_pb.Entry, code fuse.Status) {
+func (wfs *WFS) createRegularFile(ctx context.Context, dirFullPath util.FullPath, name string, mode uint32, uid, gid, rdev uint32, deferFilerCreate bool, skipExistenceCheck bool) (inode uint64, newEntry *filer_pb.Entry, code fuse.Status) {
 	if wfs.IsOverQuotaWithUncommitted() {
 		return 0, nil, fuse.Status(syscall.ENOSPC)
 	}
@@ -329,7 +354,7 @@ func (wfs *WFS) createRegularFile(dirFullPath util.FullPath, name string, mode u
 	// SkipCheckParentDirectory, so this is the only parent check). With
 	// default_permissions the kernel already verified write+search on it before
 	// Create/Mknod, so skip only the mode-bit check and its group lookup.
-	parentEntry, _, parentStatus := wfs.maybeLoadEntry(dirFullPath)
+	parentEntry, _, parentStatus := wfs.maybeLoadEntry(ctx, dirFullPath)
 	if parentStatus != fuse.OK {
 		return 0, nil, parentStatus
 	}
@@ -350,7 +375,7 @@ func (wfs *WFS) createRegularFile(dirFullPath util.FullPath, name string, mode u
 
 	entryFullPath := dirFullPath.Child(name)
 	if !skipExistenceCheck {
-		if _, _, status := wfs.maybeLoadEntry(entryFullPath); status == fuse.OK {
+		if _, _, status := wfs.maybeLoadEntry(ctx, entryFullPath); status == fuse.OK {
 			return 0, nil, fuse.Status(syscall.EEXIST)
 		} else if status != fuse.ENOENT {
 			return 0, nil, status
@@ -438,6 +463,43 @@ func (wfs *WFS) createRegularFile(dirFullPath util.FullPath, name string, mode u
 	return inode, newEntry, fuse.OK
 }
 
+// markHandleDeleted flags the inode's open handle so its flushes stop writing
+// the entry back, and reports which mark this was. Taken and released under
+// the handle's flush lock: a flush already holding it finishes before the
+// caller's delete runs, and any later flush sees the flag; setting the flag
+// bare raced the flush's own check and resurrected the entry right after the
+// delete.
+func (wfs *WFS) markHandleDeleted(inode uint64) uint64 {
+	fh, found := wfs.fhMap.FindFileHandle(inode)
+	if !found {
+		return 0
+	}
+	fhActiveLock := wfs.fhLockTable.AcquireLock("markHandleDeleted", fh.fh, util.ExclusiveLock)
+	fh.isDeleted = true
+	fh.deleteEpoch++
+	epoch := fh.deleteEpoch
+	wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
+	return epoch
+}
+
+// clearHandleDeleted lifts a mark whose delete did not go through. Only the
+// mark epoch names: an unlink that raised the flag after it owns the entry's
+// fate and keeps it.
+func (wfs *WFS) clearHandleDeleted(inode uint64, epoch uint64) {
+	if epoch == 0 {
+		return
+	}
+	fh, found := wfs.fhMap.FindFileHandle(inode)
+	if !found {
+		return
+	}
+	fhActiveLock := wfs.fhLockTable.AcquireLock("clearHandleDeleted", fh.fh, util.ExclusiveLock)
+	if fh.deleteEpoch == epoch {
+		fh.isDeleted = false
+	}
+	wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
+}
+
 // asyncCreateEntry sends a CreateEntry RPC to the filer in the background.
 // The entry is already in the local meta cache; this persists it to the filer.
 // Used by Mknod with writeback caching — the node is visible locally right away.
diff --git a/weed/mount/weedfs_file_mkrm_test.go b/weed/mount/weedfs_file_mkrm_test.go
index 6a8b34312c..6ed637f608 100644
--- a/weed/mount/weedfs_file_mkrm_test.go
+++ b/weed/mount/weedfs_file_mkrm_test.go
@@ -528,7 +528,7 @@ func TestAcquireHandleHonorsDefaultPermissions(t *testing.T) {
 			}
 			inode := wfs.inodeToPath.Lookup(util.FullPath("/secret.txt"), entry.Attributes.Crtime, false, false, entry.Attributes.Inode, true)
 
-			fh, status := wfs.AcquireHandle(inode, syscall.O_RDONLY, 999, 999)
+			fh, status := wfs.AcquireHandle(context.Background(), inode, syscall.O_RDONLY, 999, 999)
 			if status != tc.want {
 				t.Fatalf("AcquireHandle status = %v, want %v", status, tc.want)
 			}
@@ -549,7 +549,7 @@ func TestCreateRegularFileValidatesParentUnderDefaultPermissions(t *testing.T) {
 	wfs, _ := newCreateTestWFS(t)
 	wfs.option.DefaultPermissions = true
 
-	if _, _, code := wfs.createRegularFile(util.FullPath("/ghost"), "f.txt", 0o644, 99, 100, 0, false, false); code == fuse.OK {
+	if _, _, code := wfs.createRegularFile(context.Background(), util.FullPath("/ghost"), "f.txt", 0o644, 99, 100, 0, false, false); code == fuse.OK {
 		t.Fatal("createRegularFile returned OK for a missing parent directory")
 	}
 }
diff --git a/weed/mount/weedfs_file_read.go b/weed/mount/weedfs_file_read.go
index 3044c3a76b..33f5b6bb09 100644
--- a/weed/mount/weedfs_file_read.go
+++ b/weed/mount/weedfs_file_read.go
@@ -47,17 +47,8 @@ func (wfs *WFS) Read(cancel <-chan struct{}, in *fuse.ReadIn, buff []byte) (fuse
 	fhActiveLock := fh.wfs.fhLockTable.AcquireLock("Read", fh.fh, util.SharedLock)
 	defer fh.wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
 
-	// Create a context that will be cancelled when the cancel channel receives a signal
-	ctx, cancelFunc := context.WithCancel(context.Background())
-	defer cancelFunc() // Ensure cleanup
-
-	go func() {
-		select {
-		case <-cancel:
-			cancelFunc()
-		case <-ctx.Done():
-		}
-	}()
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
 
 	offset := int64(in.Offset)
 	totalRead, err := readDataByFileHandleWithContext(ctx, buff, fh, offset)
diff --git a/weed/mount/weedfs_file_sync.go b/weed/mount/weedfs_file_sync.go
index 3764260500..8c7d852422 100644
--- a/weed/mount/weedfs_file_sync.go
+++ b/weed/mount/weedfs_file_sync.go
@@ -210,6 +210,14 @@ func (wfs *WFS) flushMetadataToFiler(ctx context.Context, fh *FileHandle, dir, n
 	fhActiveLock := fh.wfs.fhLockTable.AcquireLock("doFlush", fh.fh, util.ExclusiveLock)
 	defer fh.wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
 
+	// Re-check under the lock: Unlink sets the flag under it, so a flush that
+	// was already past the earlier check cannot write the entry back after
+	// the delete removed it.
+	if fh.isDeleted {
+		glog.V(3).Infof("flushMetadataToFiler %s fh %d: file was unlinked, skipping", fileFullPath, fh.fh)
+		return nil
+	}
+
 	entry := fh.GetEntry()
 	entry.Name = name // this flush may be just after a rename operation
 
@@ -230,7 +238,10 @@ func (wfs *WFS) flushMetadataToFiler(ctx context.Context, fh *FileHandle, dir, n
 
 	manifestChunks, nonManifestChunks := filer.SeparateManifestChunks(entry.GetChunks())
 
-	chunks, _ := filer.CompactFileChunks(context.Background(), wfs.LookupFn(), nonManifestChunks)
+	chunks, _, err := filer.CompactFileChunks(context.Background(), wfs.LookupFn(), nonManifestChunks)
+	if err != nil {
+		return fmt.Errorf("compact chunks of %s: %w", fileFullPath, err)
+	}
 
 	if mergedChunks, mergeErr := wfs.maybeMergeChunks(fileFullPath, chunks, manifestChunks); mergeErr != nil {
 		glog.V(0).Infof("maybeMergeChunks %s: %v", fileFullPath, mergeErr)
@@ -239,7 +250,8 @@ func (wfs *WFS) flushMetadataToFiler(ctx context.Context, fh *FileHandle, dir, n
 		manifestChunks = nil
 	}
 
-	chunks, manifestErr := filer.MaybeManifestize(wfs.saveDataAsChunk(fileFullPath), chunks)
+	// no chunk deleter here: a failed fold reports the blobs it saved
+	chunks, manifestErr := filer.MaybeManifestize(wfs.saveDataAsChunk(fileFullPath), nil, chunks)
 	if manifestErr != nil {
 		// not good, but should be ok
 		glog.V(0).Infof("MaybeManifestize: %v", manifestErr)
diff --git a/weed/mount/weedfs_file_sync_test.go b/weed/mount/weedfs_file_sync_test.go
index ac8c518721..ed1ce122ae 100644
--- a/weed/mount/weedfs_file_sync_test.go
+++ b/weed/mount/weedfs_file_sync_test.go
@@ -245,7 +245,10 @@ func TestCompactThenMergeCondition(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			compacted, _ := filer.CompactFileChunks(context.Background(), nil, tt.chunks)
+			compacted, _, err := filer.CompactFileChunks(context.Background(), nil, tt.chunks)
+			if err != nil {
+				t.Fatal(err)
+			}
 			_, _, merge := shouldMergeChunks(compacted, nil)
 			if merge != tt.wantMerge {
 				var total uint64
@@ -294,7 +297,10 @@ func TestRandomWritesBloatDetection(t *testing.T) {
 			}
 		}
 
-		compacted, _ := filer.CompactFileChunks(context.Background(), nil, chunks)
+		compacted, _, err := filer.CompactFileChunks(context.Background(), nil, chunks)
+		if err != nil {
+			t.Fatal(err)
+		}
 		totalCompacted, reportedFileSize, merge := shouldMergeChunks(compacted, nil)
 
 		// Sanity: condition must be consistent with its own inputs.
@@ -337,7 +343,10 @@ func TestFlushCycleManifestAccumulation(t *testing.T) {
 
 		// --- flush pipeline (mirrors flushMetadataToFiler) ---
 		manifestChunks, nonManifestChunks := filer.SeparateManifestChunks(entryChunks)
-		compacted, _ := filer.CompactFileChunks(context.Background(), nil, nonManifestChunks)
+		compacted, _, err := filer.CompactFileChunks(context.Background(), nil, nonManifestChunks)
+		if err != nil {
+			t.Fatal(err)
+		}
 
 		_, _, merge := shouldMergeChunks(compacted, manifestChunks)
 		if merge {
@@ -406,9 +415,18 @@ func TestVisibleContentPreservedAfterCompact(t *testing.T) {
 			})
 		}
 
-		origViews := filer.ViewFromChunks(context.Background(), nil, chunks, 0, math.MaxInt64)
-		compacted, _ := filer.CompactFileChunks(context.Background(), nil, chunks)
-		compViews := filer.ViewFromChunks(context.Background(), nil, compacted, 0, math.MaxInt64)
+		origViews, err := filer.ViewFromChunks(context.Background(), nil, chunks, 0, math.MaxInt64)
+		if err != nil {
+			t.Fatal(err)
+		}
+		compacted, _, err := filer.CompactFileChunks(context.Background(), nil, chunks)
+		if err != nil {
+			t.Fatal(err)
+		}
+		compViews, err := filer.ViewFromChunks(context.Background(), nil, compacted, 0, math.MaxInt64)
+		if err != nil {
+			t.Fatal(err)
+		}
 
 		// Collect all (offset, size) pairs from views.
 		type viewKey struct {
diff --git a/weed/mount/weedfs_filehandle.go b/weed/mount/weedfs_filehandle.go
index 7009d982d1..c5d25e1cbf 100644
--- a/weed/mount/weedfs_filehandle.go
+++ b/weed/mount/weedfs_filehandle.go
@@ -1,7 +1,9 @@
 package mount
 
 import (
+	"context"
 	"fmt"
+	"syscall"
 
 	"github.com/seaweedfs/go-fuse/v2/fuse"
 	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
@@ -9,12 +11,14 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 )
 
-func (wfs *WFS) AcquireHandle(inode uint64, flags, uid, gid uint32) (fileHandle *FileHandle, status fuse.Status) {
+func (wfs *WFS) AcquireHandle(ctx context.Context, inode uint64, flags, uid, gid uint32) (fileHandle *FileHandle, status fuse.Status) {
 	// If there is an in-flight async flush for this inode, wait for it to
 	// complete before reopening.  Otherwise the new handle would be built
 	// from pre-close filer metadata and its next flush could overwrite the
 	// data that was just written asynchronously.
-	wfs.waitForPendingAsyncFlush(inode)
+	if !wfs.waitForPendingAsyncFlush(ctx, inode) {
+		return nil, fuse.EINTR
+	}
 
 	path, pathStatus := wfs.inodeToPath.GetPath(inode)
 	if pathStatus != fuse.OK {
@@ -37,7 +41,7 @@ func (wfs *WFS) AcquireHandle(inode uint64, flags, uid, gid uint32) (fileHandle
 		})
 		entryVersionTsNs = entryVersion{tsNs: existingFh.entryVersionTsNs.Load(), signature: existingFh.entryVersionSignature.Load()}
 	} else {
-		entry, entryVersionTsNs, status = wfs.maybeLoadEntry(path)
+		entry, entryVersionTsNs, status = wfs.maybeLoadEntry(ctx, path)
 		if status != fuse.OK {
 			return nil, status
 		}
@@ -77,6 +81,12 @@ func (wfs *WFS) AcquireHandle(inode uint64, flags, uid, gid uint32) (fileHandle
 		fileHandle.dlmLock = wfs.lockClient.NewBlockingLongLivedLock(
 			string(path), owner, lock_manager.LiveLockTTL,
 		)
+		if fileHandle.dlmLock == nil {
+			// No lock server is reachable: proceeding would silently drop
+			// cross-mount write serialization, so fail the open instead.
+			wfs.fhMap.ReleaseByHandle(fileHandle.fh)
+			return nil, fuse.Status(syscall.EAGAIN)
+		}
 		glog.V(1).Infof("DLM lock acquired for %s", path)
 	}
 	return fileHandle, fuse.OK
@@ -118,14 +128,20 @@ func (wfs *WFS) ReleaseHandle(handleId FileHandleId) {
 // waitForPendingAsyncFlush blocks until any in-flight async flush for
 // the given inode completes.  Called from AcquireHandle before building
 // new handle state, so the filer metadata reflects the flushed data.
-func (wfs *WFS) waitForPendingAsyncFlush(inode uint64) {
+func (wfs *WFS) waitForPendingAsyncFlush(ctx context.Context, inode uint64) bool {
 	wfs.pendingAsyncFlushMu.Lock()
 	done, found := wfs.pendingAsyncFlush[inode]
 	wfs.pendingAsyncFlushMu.Unlock()
 
-	if found {
-		glog.V(3).Infof("waitForPendingAsyncFlush: waiting for inode %d", inode)
-		<-done
+	if !found {
+		return true
+	}
+	glog.V(3).Infof("waitForPendingAsyncFlush: waiting for inode %d", inode)
+	select {
+	case <-done:
+		return true
+	case <-ctx.Done():
+		return false
 	}
 }
 
diff --git a/weed/mount/weedfs_invalidate_open_handle_test.go b/weed/mount/weedfs_invalidate_open_handle_test.go
index eec95ded64..d652023684 100644
--- a/weed/mount/weedfs_invalidate_open_handle_test.go
+++ b/weed/mount/weedfs_invalidate_open_handle_test.go
@@ -60,7 +60,7 @@ func newInvalidateTestWFS(t *testing.T) *WFS {
 		false,
 		func(path util.FullPath) { wfs.inodeToPath.MarkChildrenCached(path) },
 		func(path util.FullPath) bool { return wfs.inodeToPath.IsChildrenCached(path) },
-		wfs.invalidateOpenFileHandle,
+		wfs.onEntryInvalidation,
 		nil,
 	)
 	t.Cleanup(wfs.metaCache.Shutdown)
@@ -156,7 +156,7 @@ func (s *fakeFilerServer) UpdateEntry(ctx context.Context, req *filer_pb.UpdateE
 }
 
 // startFakeFiler serves fake on a local port and points wfs at it.
-func startFakeFiler(t *testing.T, wfs *WFS, fake *fakeFilerServer) {
+func startFakeFiler(t *testing.T, wfs *WFS, fake filer_pb.SeaweedFilerServer) {
 	t.Helper()
 	listener, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
@@ -336,7 +336,7 @@ func TestBufferedBuildEventReinvalidatesOnCompletion(t *testing.T) {
 		t.Fatalf("insert listing entry: %v", err)
 	}
 
-	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 1000); err != nil {
+	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 1000, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 	wfs.metaCache.WaitForEntryInvalidations()
@@ -499,7 +499,7 @@ func TestQueuedEventDoesNotRollBackHandleOpenedAfterEnqueue(t *testing.T) {
 	// Open now: the lookup reaches the filer, which serves the newer
 	// size-200 state versioned at log position 2000.
 	inode := wfs.inodeToPath.Lookup(util.FullPath("/dir/file"), time.Now().Unix(), false, false, 0, false)
-	fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+	fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 	if status != fuse.OK {
 		t.Fatalf("AcquireHandle status = %v, want OK", status)
 	}
@@ -563,7 +563,7 @@ func TestAbortedBuildEventDoesNotRollBackLaterOpen(t *testing.T) {
 	}
 
 	inode := wfs.inodeToPath.Lookup(util.FullPath("/dir/file"), time.Now().Unix(), false, false, 0, false)
-	fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+	fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 	if status != fuse.OK {
 		t.Fatalf("AcquireHandle status = %v, want OK", status)
 	}
@@ -626,7 +626,7 @@ func TestEventDuringOpenLookupIsFenced(t *testing.T) {
 	}
 	opened := make(chan openResult, 1)
 	go func() {
-		fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+		fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 		opened <- openResult{fh, status}
 	}()
 
@@ -672,7 +672,7 @@ func TestRemoteCacheResponseVersionFencesUndeliveredEvents(t *testing.T) {
 		Attributes: &filer_pb.FuseAttributes{FileSize: 88},
 	}, 0, 0)
 
-	if err := fh.downloadRemoteEntry(fh.GetEntry()); err != nil {
+	if err := fh.downloadRemoteEntry(context.Background(), fh.GetEntry()); err != nil {
 		t.Fatalf("downloadRemoteEntry: %v", err)
 	}
 	if size := fh.GetEntry().GetEntry().Attributes.FileSize; size != 200 {
@@ -755,7 +755,7 @@ func TestLocalAckDoesNotFenceUnrelatedDelayedEvents(t *testing.T) {
 	// Open the file: the cached-store read must not claim position 2000 —
 	// the local ack versioned only its own path.
 	inode := wfs.inodeToPath.Lookup(util.FullPath("/dir/file"), time.Now().Unix(), false, false, 0, false)
-	fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+	fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 	if status != fuse.OK {
 		t.Fatalf("AcquireHandle status = %v, want OK", status)
 	}
@@ -794,14 +794,14 @@ func TestSlowerConcurrentOpenDoesNotOverwriteNewerHandle(t *testing.T) {
 	}
 	slow := make(chan openResult, 1)
 	go func() {
-		fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+		fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 		slow <- openResult{fh, status}
 	}()
 	<-fake.lookupStarted
 
 	// The faster opener completes with newer state while the slow lookup is
 	// still in flight.
-	fastFh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+	fastFh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 	if status != fuse.OK {
 		t.Fatalf("fast AcquireHandle status = %v, want OK", status)
 	}
@@ -846,7 +846,7 @@ func TestFloorProtectsSnapshotStateFromDelayedEvents(t *testing.T) {
 	}, 2000); err != nil {
 		t.Fatalf("insert listing entry: %v", err)
 	}
-	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000); err != nil {
+	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -925,12 +925,12 @@ func TestSlowerOpenRejectedWhenHandleDirtyOrLookupUnversioned(t *testing.T) {
 	}
 	slow := make(chan openResult, 1)
 	go func() {
-		fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+		fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 		slow <- openResult{fh, status}
 	}()
 	<-fake.lookupStarted
 
-	fastFh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+	fastFh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 	if status != fuse.OK {
 		t.Fatalf("fast AcquireHandle status = %v, want OK", status)
 	}
@@ -969,12 +969,12 @@ func TestUnversionedSlowerOpenDoesNotOverwrite(t *testing.T) {
 	}
 	slow := make(chan openResult, 1)
 	go func() {
-		fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+		fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 		slow <- openResult{fh, status}
 	}()
 	<-fake.lookupStarted
 
-	fastFh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+	fastFh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 	if status != fuse.OK {
 		t.Fatalf("fast AcquireHandle status = %v, want OK", status)
 	}
@@ -1131,7 +1131,7 @@ func TestAbsenceFloorBlocksGhostCreate(t *testing.T) {
 	}, 0); err != nil {
 		t.Fatalf("insert listing entry: %v", err)
 	}
-	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000); err != nil {
+	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 2000, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -1281,7 +1281,7 @@ func TestNewerAbsenceFloorOverridesOlderTombstone(t *testing.T) {
 	if err := wfs.metaCache.BeginDirectoryBuild(context.Background(), util.FullPath("/dir")); err != nil {
 		t.Fatalf("begin build: %v", err)
 	}
-	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 3000); err != nil {
+	if err := wfs.metaCache.CompleteDirectoryBuild(context.Background(), util.FullPath("/dir"), 3000, nil); err != nil {
 		t.Fatalf("complete build: %v", err)
 	}
 
@@ -1405,7 +1405,7 @@ func TestEmptyListingTrailerSnapshotSetsAbsenceFloor(t *testing.T) {
 	startFakeFiler(t, wfs, &fakeFilerServer{listSnapshotTrailerTsNs: 4000})
 
 	wfs.inodeToPath.Lookup(util.FullPath("/dir"), time.Now().Unix(), true, false, 0, false)
-	if err := meta_cache.EnsureVisited(wfs.metaCache, wfs, util.FullPath("/dir"), 0); err != nil {
+	if err := meta_cache.EnsureVisited(context.Background(), wfs.metaCache, wfs, util.FullPath("/dir"), 0); err != nil {
 		t.Fatalf("EnsureVisited: %v", err)
 	}
 
@@ -1506,7 +1506,7 @@ func TestRemoteDownloadBaseMappedToLocal(t *testing.T) {
 		RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 200},
 	}, 0, 0)
 
-	if err := fh.downloadRemoteEntry(fh.GetEntry()); err != nil {
+	if err := fh.downloadRemoteEntry(context.Background(), fh.GetEntry()); err != nil {
 		t.Fatalf("downloadRemoteEntry: %v", err)
 	}
 	// The base — and the live entry — must be in local uid form.
@@ -1617,7 +1617,7 @@ func TestStaleRemoteDownloadDoesNotRollBack(t *testing.T) {
 	})
 	fh.advanceEntryVersion(3000, 0)
 
-	if err := fh.downloadRemoteEntry(fh.GetEntry()); err != nil {
+	if err := fh.downloadRemoteEntry(context.Background(), fh.GetEntry()); err != nil {
 		t.Fatalf("downloadRemoteEntry: %v", err)
 	}
 
@@ -1644,7 +1644,7 @@ func TestRemoteOnlyHandleTakesUnversionedDownload(t *testing.T) {
 	}, 0, 0)
 	fh.advanceEntryVersion(3000, 0)
 
-	if err := fh.downloadRemoteEntry(fh.GetEntry()); err != nil {
+	if err := fh.downloadRemoteEntry(context.Background(), fh.GetEntry()); err != nil {
 		t.Fatalf("downloadRemoteEntry: %v", err)
 	}
 
@@ -1801,7 +1801,7 @@ func TestUnversionedRemoteDownloadDoesNotOverwriteVersioned(t *testing.T) {
 	})
 	fh.advanceEntryVersion(3000, 0)
 
-	if err := fh.downloadRemoteEntry(fh.GetEntry()); err != nil {
+	if err := fh.downloadRemoteEntry(context.Background(), fh.GetEntry()); err != nil {
 		t.Fatalf("downloadRemoteEntry: %v", err)
 	}
 
@@ -1820,7 +1820,7 @@ func TestEventFromAnotherFilerIsNotFencedByForeignClock(t *testing.T) {
 	startFakeFiler(t, wfs, &fakeFilerServer{lookupSize: 200, lookupLogTsNs: 5000, lookupSignature: 11})
 
 	inode := wfs.inodeToPath.Lookup(util.FullPath("/dir/file"), time.Now().Unix(), false, false, 0, false)
-	fh, status := wfs.AcquireHandle(inode, 0, 0, 0)
+	fh, status := wfs.AcquireHandle(context.Background(), inode, 0, 0, 0)
 	if status != fuse.OK {
 		t.Fatalf("AcquireHandle status = %v, want OK", status)
 	}
@@ -1931,7 +1931,7 @@ func TestRejectedDownloadDoesNotRollBackCache(t *testing.T) {
 	}, 0, 0)
 	fh.advanceEntryVersion(3000, 0)
 
-	if err := fh.downloadRemoteEntry(fh.GetEntry()); err != nil {
+	if err := fh.downloadRemoteEntry(context.Background(), fh.GetEntry()); err != nil {
 		t.Fatalf("downloadRemoteEntry: %v", err)
 	}
 	// The download publishes asynchronously; a synchronous apply behind it
@@ -1966,7 +1966,7 @@ func TestRemoteOnlyHandleRefusesKnownOlderDownload(t *testing.T) {
 	}, 0, 0)
 	fh.advanceEntryVersion(3000, 0)
 
-	if err := fh.downloadRemoteEntry(fh.GetEntry()); err != nil {
+	if err := fh.downloadRemoteEntry(context.Background(), fh.GetEntry()); err != nil {
 		t.Fatalf("downloadRemoteEntry: %v", err)
 	}
 
diff --git a/weed/mount/weedfs_link.go b/weed/mount/weedfs_link.go
index a41f314903..1797627ca4 100644
--- a/weed/mount/weedfs_link.go
+++ b/weed/mount/weedfs_link.go
@@ -46,7 +46,20 @@ func (wfs *WFS) Link(cancel <-chan struct{}, in *fuse.LinkIn, name string, out *
 	}
 	oldParentPath, _ := oldEntryPath.DirAndName()
 
-	oldEntry, _, status := wfs.maybeLoadEntry(oldEntryPath)
+	// The new link has to be reported with the node id the kernel already holds
+	// for the source, which is what makes the two names share one file.
+	// oldEntry.Attributes.Inode is not a substitute. It is a mount-runtime
+	// number that only entries created through a mount carry: entries written
+	// by the S3 API, WebDAV or a direct filer call persist inode 0, and the
+	// kernel rejects a LINK reply with NodeId 0 as EIO (invalid_nodeid). It is
+	// also the wrong key for inodeToPath, which is keyed by the numbers handed
+	// to the kernel rather than by the persisted attribute; Lookup's collision
+	// probe can move the two apart even for an entry that does carry one.
+	sourceInode := in.Oldnodeid
+
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	oldEntry, _, status := wfs.maybeLoadEntry(ctx, oldEntryPath)
 	if status != fuse.OK {
 		return status
 	}
@@ -78,7 +91,7 @@ func (wfs *WFS) Link(cancel <-chan struct{}, in *fuse.LinkIn, name string, out *
 		// Do not fall back to the pre-lock snapshot: if every alias
 		// was deleted while we waited, abort instead of deriving the
 		// next counter from a stale entry.
-		fresh, _, freshStatus := wfs.maybeLoadEntry(oldEntryPath)
+		fresh, _, freshStatus := wfs.maybeLoadEntry(ctx, oldEntryPath)
 		if freshStatus != fuse.OK {
 			return freshStatus
 		}
@@ -126,21 +139,20 @@ func (wfs *WFS) Link(cancel <-chan struct{}, in *fuse.LinkIn, name string, out *
 	// apply changes to the filer, and also apply to local metaCache
 	wfs.mapPbIdFromLocalToFiler(request.Entry)
 
-	ctx := context.Background()
-	updateResp, err := wfs.streamUpdateEntry(ctx, updateOldEntryRequest)
+	updateResp, err := wfs.streamUpdateEntry(context.Background(), updateOldEntryRequest)
 	if err == nil {
 		updateEvent := updateResp.GetMetadataEvent()
 		if updateEvent == nil {
 			updateEvent = metadataUpdateEvent(oldParentPath, updateOldEntryRequest.Entry)
 		}
-		if applyErr := wfs.applyLocalMetadataEvent(ctx, updateEvent); applyErr != nil {
+		if applyErr := wfs.applyLocalMetadataEvent(context.Background(), updateEvent); applyErr != nil {
 			glog.Warningf("link %s: best-effort metadata apply failed: %v", oldEntryPath, applyErr)
 			wfs.inodeToPath.InvalidateChildrenCache(util.FullPath(oldParentPath))
 		}
 	}
 	if err == nil {
 		var createResp *filer_pb.CreateEntryResponse
-		createResp, err = wfs.streamCreateEntry(ctx, request)
+		createResp, err = wfs.streamCreateEntry(context.Background(), request)
 		if err != nil {
 			// Rollback: restore original HardLinkId/Counter on the source entry
 			oldEntry.HardLinkId = origHardLinkId
@@ -150,7 +162,7 @@ func (wfs *WFS) Link(cancel <-chan struct{}, in *fuse.LinkIn, name string, out *
 				Entry:      oldEntry,
 				Signatures: []int32{wfs.signature},
 			}
-			if _, rollbackErr := wfs.streamUpdateEntry(ctx, rollbackReq); rollbackErr != nil {
+			if _, rollbackErr := wfs.streamUpdateEntry(context.Background(), rollbackReq); rollbackErr != nil {
 				glog.Warningf("link rollback %s: %v", oldEntryPath, rollbackErr)
 			}
 		} else {
@@ -158,7 +170,7 @@ func (wfs *WFS) Link(cancel <-chan struct{}, in *fuse.LinkIn, name string, out *
 			if createEvent == nil {
 				createEvent = metadataCreateEvent(string(newParentPath), request.Entry)
 			}
-			if applyErr := wfs.applyLocalMetadataEvent(ctx, createEvent); applyErr != nil {
+			if applyErr := wfs.applyLocalMetadataEvent(context.Background(), createEvent); applyErr != nil {
 				glog.Warningf("link %s: best-effort metadata apply failed: %v", newParentPath.Child(name), applyErr)
 				wfs.inodeToPath.InvalidateChildrenCache(newParentPath)
 			}
@@ -176,16 +188,16 @@ func (wfs *WFS) Link(cancel <-chan struct{}, in *fuse.LinkIn, name string, out *
 		return fuse.EIO
 	}
 
-	wfs.inodeToPath.AddPath(oldEntry.Attributes.Inode, newEntryPath)
+	wfs.inodeToPath.AddPath(sourceInode, newEntryPath)
 
 	// Propagate the new HardLinkCounter to sibling cache entries and
 	// invalidate the kernel's inode attr cache. Without this, `stat` on any
 	// existing sibling link (other than the source we just wrote) returns
 	// the old nlink from the local metacache — pjdfstest link/00.t catches
 	// this after `link n1 n2` when it stats n0.
-	wfs.syncHardLinkSiblings(oldEntry.Attributes.Inode, oldEntry, oldEntryPath, newEntryPath)
+	wfs.syncHardLinkSiblings(sourceInode, oldEntry, oldEntryPath, newEntryPath)
 
-	wfs.outputPbEntry(out, oldEntry.Attributes.Inode, request.Entry)
+	wfs.outputPbEntry(out, sourceInode, request.Entry)
 
 	return fuse.OK
 }
diff --git a/weed/mount/weedfs_link_test.go b/weed/mount/weedfs_link_test.go
new file mode 100644
index 0000000000..e81bb59576
--- /dev/null
+++ b/weed/mount/weedfs_link_test.go
@@ -0,0 +1,256 @@
+package mount
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// linkTestSource seeds the meta cache with an entry and registers it with
+// inodeToPath the way a kernel Lookup would, returning the node id the kernel
+// would then use as LinkIn.Oldnodeid.
+func linkTestSource(t *testing.T, wfs *WFS, name string, persistedInode uint64) (util.FullPath, uint64) {
+	t.Helper()
+
+	entry := &filer_pb.Entry{
+		Name: name,
+		Attributes: &filer_pb.FuseAttributes{
+			FileMode: 0o644,
+			FileSize: 12,
+			Inode:    persistedInode,
+			Crtime:   1,
+			Mtime:    1,
+			Uid:      99,
+			Gid:      100,
+		},
+	}
+	if err := wfs.metaCache.InsertEntry(context.Background(), filer.FromPbEntry("/", entry), 0); err != nil {
+		t.Fatalf("InsertEntry: %v", err)
+	}
+
+	fullPath := util.FullPath("/").Child(name)
+	inode := wfs.inodeToPath.Lookup(fullPath, entry.Attributes.Crtime, false, false, persistedInode, true)
+	if inode == 0 {
+		t.Fatal("Lookup handed out node id 0")
+	}
+	return fullPath, inode
+}
+
+func doLink(t *testing.T, wfs *WFS, oldNodeId uint64, name string) *fuse.EntryOut {
+	t.Helper()
+
+	out := &fuse.EntryOut{}
+	status := wfs.Link(make(chan struct{}), &fuse.LinkIn{
+		InHeader: fuse.InHeader{
+			NodeId: 1,
+			Caller: fuse.Caller{Owner: fuse.Owner{Uid: 99, Gid: 100}},
+		},
+		Oldnodeid: oldNodeId,
+	}, name, out)
+	if status != fuse.OK {
+		t.Fatalf("Link status = %v, want OK", status)
+	}
+	return out
+}
+
+// Entries written outside a mount (S3 API, WebDAV, a direct filer call) persist
+// Attributes.Inode == 0, because the inode is a mount-runtime number that only
+// lives in inodeToPath. Replying to LINK with NodeId 0 makes the kernel fail the
+// call with EIO (invalid_nodeid), which is what
+// https://github.com/seaweedfs/seaweedfs/issues/8404 reports. The reply has to
+// name the node id the kernel already holds for the source.
+func TestLinkReportsKernelNodeIdWhenEntryHasNoPersistedInode(t *testing.T) {
+	wfs, _ := newCreateTestWFS(t)
+
+	sourcePath, sourceInode := linkTestSource(t, wfs, "s3-uploaded.txt", 0)
+
+	out := doLink(t, wfs, sourceInode, "hardlink.txt")
+
+	if out.NodeId == 0 {
+		t.Fatal("Link replied with NodeId 0; the kernel rejects that with EIO")
+	}
+	if out.NodeId != sourceInode {
+		t.Fatalf("Link NodeId = %d, want the source node id %d", out.NodeId, sourceInode)
+	}
+	if out.Attr.Ino != sourceInode {
+		t.Fatalf("Link Attr.Ino = %d, want %d", out.Attr.Ino, sourceInode)
+	}
+	if out.Attr.Nlink != 2 {
+		t.Fatalf("Link Attr.Nlink = %d, want 2", out.Attr.Nlink)
+	}
+
+	// The new name must resolve to the same inode, or a later Lookup on it
+	// hands the kernel node id 0 and the link reads back as missing.
+	linkPath := util.FullPath("/hardlink.txt")
+	linkInode, found := wfs.inodeToPath.GetInode(linkPath)
+	if !found {
+		t.Fatal("new link was not registered in inodeToPath")
+	}
+	if linkInode != sourceInode {
+		t.Fatalf("new link inode = %d, want the source inode %d", linkInode, sourceInode)
+	}
+	if wfs.inodeToPath.HasInode(0) {
+		t.Fatal("inode 0 was registered in inodeToPath")
+	}
+
+	paths := wfs.inodeToPath.GetAllPaths(sourceInode)
+	if len(paths) != 2 {
+		t.Fatalf("inode %d has paths %v, want both %s and %s", sourceInode, paths, sourcePath, linkPath)
+	}
+
+	// The source still resolves, and it now carries a hard link id.
+	if _, status := wfs.inodeToPath.GetPath(sourceInode); status != fuse.OK {
+		t.Fatalf("GetPath(%d) = %v, want OK", sourceInode, status)
+	}
+	linked, _, status := wfs.maybeLoadEntry(context.Background(), sourcePath)
+	if status != fuse.OK {
+		t.Fatalf("reload source: %v", status)
+	}
+	if len(linked.HardLinkId) == 0 {
+		t.Fatal("source entry was not converted to hard link mode")
+	}
+	if linked.HardLinkCounter != 2 {
+		t.Fatalf("source HardLinkCounter = %d, want 2", linked.HardLinkCounter)
+	}
+}
+
+// A source created through the mount does carry a persisted inode. The reply
+// must keep naming the node id the kernel holds, which for this case is the
+// same number.
+func TestLinkReportsKernelNodeIdWhenEntryHasPersistedInode(t *testing.T) {
+	wfs, _ := newCreateTestWFS(t)
+
+	_, sourceInode := linkTestSource(t, wfs, "mount-created.txt", 8404)
+	if sourceInode != 8404 {
+		t.Fatalf("source node id = %d, want the persisted inode 8404", sourceInode)
+	}
+
+	out := doLink(t, wfs, sourceInode, "hardlink.txt")
+
+	if out.NodeId != sourceInode {
+		t.Fatalf("Link NodeId = %d, want %d", out.NodeId, sourceInode)
+	}
+	if out.Attr.Ino != sourceInode {
+		t.Fatalf("Link Attr.Ino = %d, want %d", out.Attr.Ino, sourceInode)
+	}
+	if linkInode, found := wfs.inodeToPath.GetInode(util.FullPath("/hardlink.txt")); !found || linkInode != sourceInode {
+		t.Fatalf("new link inode = %d (found=%v), want %d", linkInode, found, sourceInode)
+	}
+}
+
+// cachedLink returns what the mount would serve for path out of its own meta
+// cache, which is what a stat on that name reads before the kernel's attr
+// cache expires.
+func cachedLink(t *testing.T, wfs *WFS, path util.FullPath) *filer.Entry {
+	t.Helper()
+
+	entry, _, err := wfs.metaCache.FindEntry(context.Background(), path)
+	if err != nil {
+		t.Fatalf("FindEntry(%s): %v", path, err)
+	}
+	if entry == nil {
+		t.Fatalf("FindEntry(%s): not cached", path)
+	}
+	return entry
+}
+
+// A third link is the first case that reaches the body of
+// syncHardLinkSiblings: with two links the source alias and the name just
+// created are both in skipPaths, so the loop iterates over nothing. Three
+// links leave one name that no other part of Link() writes and that only the
+// sibling sync visits.
+//
+// The source is written outside a mount, so it persists Attributes.Inode 0,
+// the number Link() used to key the sync by. GetAllPaths(0) yields nothing,
+// which is what the second half of this test pins down: the sync has to be
+// keyed by the kernel node id, the number inodeToPath is indexed by.
+func TestLinkSyncsHardLinkSiblingsOnThirdLink(t *testing.T) {
+	wfs, _ := newCreateTestWFS(t)
+
+	sourcePath, sourceInode := linkTestSource(t, wfs, "s3-uploaded.txt", 0)
+
+	firstLinkPath := util.FullPath("/hardlink-1.txt")
+	doLink(t, wfs, sourceInode, "hardlink-1.txt")
+
+	// Two links so far: nothing has exercised the sibling loop yet, Link()
+	// wrote both of these names itself.
+	if counter := cachedLink(t, wfs, firstLinkPath).HardLinkCounter; counter != 2 {
+		t.Fatalf("after the first link, %s HardLinkCounter = %d, want 2", firstLinkPath, counter)
+	}
+
+	// Link() resolves its source through GetPath and skips that path plus the
+	// name it is about to create. Whatever is left over is the sibling loop's
+	// work.
+	skippedSource, status := wfs.inodeToPath.GetPath(sourceInode)
+	if status != fuse.OK {
+		t.Fatalf("GetPath(%d) = %v, want OK", sourceInode, status)
+	}
+	secondLinkPath := util.FullPath("/hardlink-2.txt")
+
+	doLink(t, wfs, sourceInode, "hardlink-2.txt")
+
+	paths := wfs.inodeToPath.GetAllPaths(sourceInode)
+	if len(paths) != 3 {
+		t.Fatalf("inode %d has paths %v, want %s, %s and %s",
+			sourceInode, paths, sourcePath, firstLinkPath, secondLinkPath)
+	}
+
+	// Guard against this test covering nothing: at least one name has to fall
+	// outside skipPaths, or the sibling loop is a no-op again and everything
+	// below only re-checks Link()'s own two writes.
+	var siblings []util.FullPath
+	for _, p := range paths {
+		if p == skippedSource || p == secondLinkPath {
+			continue
+		}
+		siblings = append(siblings, p)
+	}
+	if len(siblings) == 0 {
+		t.Fatalf("every path in %v is a skipPath (%s, %s); the sibling loop has no work to do",
+			paths, skippedSource, secondLinkPath)
+	}
+
+	// Every name of the file reports three links, the sibling included. A stale
+	// counter here is the pjdfstest link/00.t failure: stat on an older link
+	// still says nlink 2.
+	for _, p := range paths {
+		if counter := cachedLink(t, wfs, p).HardLinkCounter; counter != 3 {
+			t.Errorf("%s HardLinkCounter = %d, want 3", p, counter)
+		}
+	}
+
+	// Which inode the sync is keyed by, driven directly. Going through Link()
+	// cannot tell the two keys apart: the meta cache keeps one blob per hard
+	// link id (FilerStoreWrapper.setHardLink/maybeReadHardLink), so a read of
+	// any sibling returns the attributes of the last write to any of them,
+	// synced or not. Feeding the loop an authoritative counter that no other
+	// write has stored is what makes its work visible.
+	authoritative, _, status := wfs.maybeLoadEntry(context.Background(), sourcePath)
+	if status != fuse.OK {
+		t.Fatalf("reload source: %v", status)
+	}
+	if authoritative.Attributes.Inode != 0 {
+		t.Fatalf("source Attributes.Inode = %d, want 0: an entry written outside a mount carries no inode",
+			authoritative.Attributes.Inode)
+	}
+	authoritative.HardLinkCounter = 4
+
+	wfs.syncHardLinkSiblings(authoritative.Attributes.Inode, authoritative, skippedSource, secondLinkPath)
+	for _, p := range siblings {
+		if counter := cachedLink(t, wfs, p).HardLinkCounter; counter != 3 {
+			t.Errorf("keyed by the persisted inode the sync reached %s (counter %d), which it cannot: "+
+				"GetAllPaths(%d) has no paths", p, counter, authoritative.Attributes.Inode)
+		}
+	}
+
+	wfs.syncHardLinkSiblings(sourceInode, authoritative, skippedSource, secondLinkPath)
+	for _, p := range siblings {
+		if counter := cachedLink(t, wfs, p).HardLinkCounter; counter != 4 {
+			t.Errorf("%s HardLinkCounter = %d after the sibling sync, want 4", p, counter)
+		}
+	}
+}
diff --git a/weed/mount/weedfs_meta_subscribe_test.go b/weed/mount/weedfs_meta_subscribe_test.go
new file mode 100644
index 0000000000..241d98df1b
--- /dev/null
+++ b/weed/mount/weedfs_meta_subscribe_test.go
@@ -0,0 +1,184 @@
+package mount
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/seaweedfs/seaweedfs/weed/mount/meta_cache"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// proxyFilerServer replays the previous minute's metadata as a persisted log
+// chunk, the way a filer answers every fresh subscription, and points volume
+// lookups at an address nothing listens on: the mount host's view of a volume
+// server it is meant to reach only through -volumeServerAccess=filerProxy.
+type proxyFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	chunk         *filer_pb.FileChunk
+	subscriptions atomic.Int32
+	volumeLookups atomic.Int32
+	stop          chan struct{}
+}
+
+func (s *proxyFilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest, stream filer_pb.SeaweedFiler_SubscribeMetadataServer) error {
+	if s.subscriptions.Add(1) > 1 {
+		<-s.stop
+		return nil
+	}
+	return stream.Send(&filer_pb.SubscribeMetadataResponse{
+		LogFileRefs: []*filer_pb.LogFileChunkRef{{
+			FilerId:  "5319c0e8",
+			FileTsNs: time.Now().UnixNano(),
+			Chunks:   []*filer_pb.FileChunk{s.chunk},
+		}},
+	})
+}
+
+func (s *proxyFilerServer) LookupVolume(ctx context.Context, req *filer_pb.LookupVolumeRequest) (*filer_pb.LookupVolumeResponse, error) {
+	s.volumeLookups.Add(1)
+	locations := make(map[string]*filer_pb.Locations)
+	for _, vid := range req.VolumeIds {
+		locations[vid] = &filer_pb.Locations{Locations: []*filer_pb.Location{{Url: "127.0.0.1:1", PublicUrl: "127.0.0.1:1"}}}
+	}
+	return &filer_pb.LookupVolumeResponse{LocationsMap: locations}, nil
+}
+
+// buildLogFileData writes the on-disk log format: [4-byte size | LogEntry].
+func buildLogFileData(events ...*filer_pb.SubscribeMetadataResponse) []byte {
+	var buf bytes.Buffer
+	for _, event := range events {
+		eventData, _ := proto.Marshal(event)
+		entryData, _ := proto.Marshal(&filer_pb.LogEntry{TsNs: event.TsNs, Data: eventData, Key: []byte(event.Directory)})
+		sizeBuf := make([]byte, 4)
+		util.Uint32toBytes(sizeBuf, uint32(len(entryData)))
+		buf.Write(sizeBuf)
+		buf.Write(entryData)
+	}
+	return buf.Bytes()
+}
+
+// TestSubscribeMetaEventsReplaysThroughFilerProxy pins the replay to the lookup
+// the mount was given: resolving volume servers here fails every subscription
+// of a filerProxy mount, which then resubscribes a second later, forever.
+func TestSubscribeMetaEventsReplaysThroughFilerProxy(t *testing.T) {
+	logData := buildLogFileData(&filer_pb.SubscribeMetadataResponse{
+		Directory: "/dir",
+		TsNs:      time.Now().UnixNano(),
+		EventNotification: &filer_pb.EventNotification{
+			NewEntry: &filer_pb.Entry{Name: "file", Attributes: &filer_pb.FuseAttributes{FileSize: 7}},
+		},
+	})
+
+	var proxiedChunkIds atomic.Value
+	proxy := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fileId := r.URL.Query().Get("proxyChunkId")
+		if fileId == "" {
+			http.Error(w, "not a filer proxy read", http.StatusBadRequest)
+			return
+		}
+		proxiedChunkIds.Store(fileId)
+		w.Write(logData)
+	}))
+	t.Cleanup(proxy.Close)
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { _ = listener.Close() })
+
+	testServer := &proxyFilerServer{
+		chunk: &filer_pb.FileChunk{FileId: "4471,ce598bfff8416e", Size: uint64(len(logData))},
+		stop:  make(chan struct{}),
+	}
+	server := pb.NewGrpcServer()
+	filer_pb.RegisterSeaweedFilerServer(server, testServer)
+	go server.Serve(listener)
+	t.Cleanup(func() {
+		close(testServer.stop)
+		server.Stop()
+	})
+
+	proxyUrl, err := url.Parse(proxy.URL)
+	if err != nil {
+		t.Fatalf("parse proxy url: %v", err)
+	}
+
+	uidGidMapper, err := meta_cache.NewUidGidMapper("", "")
+	if err != nil {
+		t.Fatalf("create uid/gid mapper: %v", err)
+	}
+	root := util.FullPath("/")
+	wfs := &WFS{
+		signature:         1,
+		inodeToPath:       NewInodeToPath(root, 0),
+		fhMap:             NewFileHandleToInode(),
+		fhLockTable:       util.NewLockTable[FileHandleId](),
+		hardLinkLockTable: util.NewLockTable[string](),
+		option: &Option{
+			ChunkSizeLimit:     1024,
+			ConcurrentReaders:  1,
+			VolumeServerAccess: "filerProxy",
+			FilerMountRootPath: "/",
+			FilerAddresses: []pb.ServerAddress{
+				pb.NewServerAddressWithGrpcPort(proxyUrl.Host, listener.Addr().(*net.TCPAddr).Port),
+			},
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		},
+	}
+	wfs.metaCache = meta_cache.NewMetaCache(
+		filepath.Join(t.TempDir(), "meta"),
+		uidGidMapper,
+		root,
+		false,
+		func(path util.FullPath) { wfs.inodeToPath.MarkChildrenCached(path) },
+		func(path util.FullPath) bool { return wfs.inodeToPath.IsChildrenCached(path) },
+		func(meta_cache.EntryInvalidation) {},
+		nil,
+	)
+	t.Cleanup(wfs.metaCache.Shutdown)
+	wfs.inodeToPath.MarkChildrenCached(root)
+	wfs.inodeToPath.Lookup(util.FullPath("/dir"), time.Now().Unix(), true, false, 0, false)
+	wfs.inodeToPath.MarkChildrenCached(util.FullPath("/dir"))
+
+	followed := make(chan struct{})
+	go func() {
+		defer close(followed)
+		meta_cache.SubscribeMetaEvents(wfs.metaCache, wfs.signature, wfs, wfs.LookupFn(), wfs.option.FilerMountRootPath, 0, false, nil)
+	}()
+
+	select {
+	case <-followed:
+	case <-time.After(20 * time.Second):
+		t.Fatal("the log chunk replay never succeeded")
+	}
+
+	if got := testServer.volumeLookups.Load(); got != 0 {
+		t.Errorf("filerProxy mount resolved %d volume locations, want 0", got)
+	}
+	if got, _ := proxiedChunkIds.Load().(string); got != testServer.chunk.FileId {
+		t.Errorf("filer proxy served chunk %q, want %q", got, testServer.chunk.FileId)
+	}
+
+	entry, _, err := wfs.metaCache.FindEntry(context.Background(), util.FullPath("/dir/file"))
+	if err != nil {
+		t.Fatalf("replayed entry: %v", err)
+	}
+	if entry.Attr.FileSize != 7 {
+		t.Errorf("replayed file size %d, want 7", entry.Attr.FileSize)
+	}
+}
diff --git a/weed/mount/weedfs_metadata_flush.go b/weed/mount/weedfs_metadata_flush.go
index 3ff2fa9f73..bce2e9e8d9 100644
--- a/weed/mount/weedfs_metadata_flush.go
+++ b/weed/mount/weedfs_metadata_flush.go
@@ -2,6 +2,7 @@ package mount
 
 import (
 	"context"
+	"fmt"
 	"sync"
 	"time"
 
@@ -136,10 +137,14 @@ func (wfs *WFS) flushFileMetadata(fh *FileHandle) error {
 	manifestChunks, nonManifestChunks := filer.SeparateManifestChunks(snapshotChunks)
 
 	// Compact chunks to remove fully overlapped ones
-	compactedChunks, _ := filer.CompactFileChunks(context.Background(), wfs.LookupFn(), nonManifestChunks)
+	compactedChunks, _, err := filer.CompactFileChunks(context.Background(), wfs.LookupFn(), nonManifestChunks)
+	if err != nil {
+		return fmt.Errorf("compact chunks of %s: %w", fileFullPath, err)
+	}
 
 	// Try to create manifest chunks for large files
-	compactedChunks, manifestErr := filer.MaybeManifestize(wfs.saveDataAsChunk(fileFullPath), compactedChunks)
+	// no chunk deleter here: a failed fold reports the blobs it saved
+	compactedChunks, manifestErr := filer.MaybeManifestize(wfs.saveDataAsChunk(fileFullPath), nil, compactedChunks)
 	if manifestErr != nil {
 		glog.V(0).Infof("flushFileMetadata MaybeManifestize: %v", manifestErr)
 	}
diff --git a/weed/mount/weedfs_posix_lock_routed.go b/weed/mount/weedfs_posix_lock_routed.go
index 17c47b4b32..ae7a48ce84 100644
--- a/weed/mount/weedfs_posix_lock_routed.go
+++ b/weed/mount/weedfs_posix_lock_routed.go
@@ -94,7 +94,7 @@ func (wfs *WFS) posixLockKeyForInode(inode uint64) (string, bool) {
 	if status != fuse.OK {
 		return "", false
 	}
-	if entry, _, st := wfs.maybeLoadEntry(path); st == fuse.OK && entry != nil && len(entry.HardLinkId) > 0 {
+	if entry, _, st := wfs.maybeLoadEntry(context.Background(), path); st == fuse.OK && entry != nil && len(entry.HardLinkId) > 0 {
 		return posixLockKeyPrefix + "hl:" + hex.EncodeToString(entry.HardLinkId), true
 	}
 	return posixLockKeyPrefix + string(path), true
@@ -153,7 +153,7 @@ func posixLockContext(cancel <-chan struct{}) (context.Context, context.CancelFu
 
 func (wfs *WFS) callPosixLock(ctx context.Context, key string, op filer_pb.PosixLockOp, lk posixlock.Range) (*filer_pb.PosixLockResponse, error) {
 	var resp *filer_pb.PosixLockResponse
-	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	err := wfs.withFilerClient(ctx, false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 		var e error
 		resp, e = client.PosixLock(ctx, &filer_pb.PosixLockRequest{
 			Key: key,
@@ -377,7 +377,7 @@ func (wfs *WFS) callPosixReassert(ctx context.Context, key string, locks []posix
 			Sid: l.Sid, Owner: l.Owner, Pid: l.Pid, IsFlock: l.IsFlock,
 		})
 	}
-	return wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	return wfs.withFilerClient(ctx, false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 		_, e := client.PosixLock(ctx, &filer_pb.PosixLockRequest{
 			Key:   key,
 			Op:    filer_pb.PosixLockOp_KEEP_ALIVE,
diff --git a/weed/mount/weedfs_quota.go b/weed/mount/weedfs_quota.go
index c09ddbaf23..96cee6fabf 100644
--- a/weed/mount/weedfs_quota.go
+++ b/weed/mount/weedfs_quota.go
@@ -110,7 +110,7 @@ func (wfs *WFS) getQuotaCheckInterval() time.Duration {
 }
 
 func (wfs *WFS) checkQuotaOnce() {
-	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	err := wfs.withFilerClient(context.Background(), false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 
 		request := &filer_pb.StatisticsRequest{
 			Collection:  wfs.option.Collection,
@@ -119,7 +119,7 @@ func (wfs *WFS) checkQuotaOnce() {
 			DiskType:    string(wfs.option.DiskType),
 		}
 
-		resp, err := client.Statistics(context.Background(), request)
+		resp, err := client.Statistics(ctx, request)
 		if err != nil {
 			glog.V(0).Infof("reading quota usage %v: %v", request, err)
 			return err
diff --git a/weed/mount/weedfs_release_flock_test.go b/weed/mount/weedfs_release_flock_test.go
new file mode 100644
index 0000000000..17c487c994
--- /dev/null
+++ b/weed/mount/weedfs_release_flock_test.go
@@ -0,0 +1,77 @@
+package mount
+
+import (
+	"math"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A close() frees the file description's flock locks even when the handle
+// flush is stuck — e.g. a filer that stopped answering. If the locks outlive
+// the blocked flush, a restarted process taking the same file's flock sees
+// "file already locked" until the mount restarts.
+func TestReleaseDropsFlockWhileFlushBlocked(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	wfs.posixLocks = NewPosixLockTable()
+	startFakeFiler(t, wfs, &fakeFilerServer{})
+
+	inode := wfs.inodeToPath.Lookup(util.FullPath("/dir/f"), time.Now().Unix(), false, false, 0, false)
+	fh, _ := wfs.fhMap.AcquireFileHandle(wfs, inode, &filer_pb.Entry{
+		Name:       "f",
+		Attributes: &filer_pb.FuseAttributes{},
+	}, 0, 0)
+	fh.dirtyMetadata = true
+
+	const owner = uint64(42)
+	if st := wfs.posixLocks.SetLk(inode, lockRange{Start: 0, End: math.MaxUint64, Typ: f_WRLCK, Owner: owner, IsFlock: true}); st != fuse.OK {
+		t.Fatalf("take flock: %v", st)
+	}
+
+	// Stall the release flush at the handle lock flushMetadataToFiler waits on.
+	active := wfs.fhLockTable.AcquireLock("test", fh.fh, util.ExclusiveLock)
+	released := false
+	releaseLock := func() {
+		if !released {
+			wfs.fhLockTable.ReleaseLock(fh.fh, active)
+			released = true
+		}
+	}
+	defer releaseLock()
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		wfs.Release(nil, &fuse.ReleaseIn{
+			InHeader:     fuse.InHeader{NodeId: inode},
+			Fh:           uint64(fh.fh),
+			LockOwner:    owner,
+			ReleaseFlags: fuse.FUSE_RELEASE_FLOCK_UNLOCK,
+		})
+	}()
+
+	// The dead holder's flock must be gone while the flush is still parked.
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		var out fuse.LkOut
+		wfs.posixLocks.GetLk(inode, lockRange{Start: 0, End: math.MaxUint64, Typ: f_WRLCK, Owner: 7, IsFlock: true}, &out)
+		if out.Lk.Typ == f_UNLCK {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("flock still held while the release flush is blocked")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	// Let the parked flush through: the live filer answers the metadata update.
+	releaseLock()
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Fatal("release never completed after the flush unblocked")
+	}
+}
diff --git a/weed/mount/weedfs_remote_rename_test.go b/weed/mount/weedfs_remote_rename_test.go
new file mode 100644
index 0000000000..ba04f0500c
--- /dev/null
+++ b/weed/mount/weedfs_remote_rename_test.go
@@ -0,0 +1,122 @@
+package mount
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"github.com/seaweedfs/seaweedfs/weed/mount/meta_cache"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// The filer sends one event per moved entry, so children follow their parent.
+func TestRemoteRenameMovesInodePaths(t *testing.T) {
+	dir := util.FullPath("/images")
+	wfs := newPagingWFS(t, dir, []string{"f.jpg"}, 0)
+
+	now := time.Now().Unix()
+	subInode := wfs.inodeToPath.Lookup(dir.Child("sub"), now, true, false, 0, true)
+	childInode := wfs.inodeToPath.Lookup(dir.Child("sub").Child("f.jpg"), now, false, false, 0, true)
+
+	wfs.onEntryInvalidation(meta_cache.EntryInvalidation{
+		Path:         dir.Child("sub"),
+		RenamedTo:    dir.Child("moved"),
+		WasDirectory: true,
+	})
+	wfs.onEntryInvalidation(meta_cache.EntryInvalidation{
+		Path:      dir.Child("sub").Child("f.jpg"),
+		RenamedTo: dir.Child("moved").Child("f.jpg"),
+	})
+
+	if got, _ := wfs.inodeToPath.GetPath(subInode); got != dir.Child("moved") {
+		t.Errorf("renamed directory resolves to %s, want %s", got, dir.Child("moved"))
+	}
+	if got, _ := wfs.inodeToPath.GetPath(childInode); got != dir.Child("moved").Child("f.jpg") {
+		t.Errorf("child resolves to %s, want %s", got, dir.Child("moved").Child("f.jpg"))
+	}
+	if wfs.inodeToPath.HasPath(dir.Child("sub")) {
+		t.Error("pre-rename directory path still in the table")
+	}
+}
+
+// The handle path and the table move are two halves of one rename. Doing the
+// move twice would unlink what the first one just put at the target, leaving
+// the renamed inode with no path at all.
+func TestRemoteRenameMovesOnceWithAnOpenHandle(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	oldPath, newPath := util.FullPath("/dir/file"), util.FullPath("/dir/renamed")
+
+	inode := wfs.inodeToPath.Lookup(oldPath, time.Now().Unix(), false, false, 0, true)
+	wfs.fhMap.AcquireFileHandle(wfs, inode, &filer_pb.Entry{
+		Name:       "file",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 88},
+	}, 0, 0)
+
+	wfs.onEntryInvalidation(meta_cache.EntryInvalidation{Path: oldPath, RenamedTo: newPath, TsNs: 1000})
+
+	if got, status := wfs.inodeToPath.GetPath(inode); status != fuse.OK || got != newPath {
+		t.Errorf("inode resolves to %q (%v), want %s", got, status, newPath)
+	}
+	if got, found := wfs.inodeToPath.GetInode(newPath); !found || got != inode {
+		t.Errorf("%s resolves to %d (found %v), want %d", newPath, got, found, inode)
+	}
+}
+
+// The subscription can redeliver a rename once it falls out of the dedup ring.
+// Replaying one must not unlink what the first delivery put at the target, nor
+// mark the moved file's handle deleted.
+func TestRemoteRenameReplayLeavesTheTargetAlone(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	oldPath, newPath := util.FullPath("/dir/file"), util.FullPath("/dir/renamed")
+
+	inode := wfs.inodeToPath.Lookup(oldPath, time.Now().Unix(), false, false, 0, true)
+	fh, _ := wfs.fhMap.AcquireFileHandle(wfs, inode, &filer_pb.Entry{
+		Name:       "file",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 88},
+	}, 0, 0)
+
+	rename := meta_cache.EntryInvalidation{Path: oldPath, RenamedTo: newPath, TsNs: 1000}
+	wfs.onEntryInvalidation(rename)
+	wfs.onEntryInvalidation(rename)
+
+	if got, status := wfs.inodeToPath.GetPath(inode); status != fuse.OK || got != newPath {
+		t.Errorf("inode resolves to %q (%v), want %s", got, status, newPath)
+	}
+	if got, found := wfs.inodeToPath.GetInode(newPath); !found || got != inode {
+		t.Errorf("%s resolves to %d (found %v), want %d", newPath, got, found, inode)
+	}
+	if fh.isDeleted {
+		t.Error("the moved file's handle was marked deleted by the replay")
+	}
+}
+
+// A rename event older than the handle's version fence is still a rename. The
+// fence is about which version of the content the handle holds, and skipping
+// the move would leave both the inode and the handle on a name the filer has
+// vacated.
+func TestRenameBelowTheVersionFenceStillMoves(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	oldPath, newPath := util.FullPath("/dir/file"), util.FullPath("/dir/renamed")
+
+	inode := wfs.inodeToPath.Lookup(oldPath, time.Now().Unix(), false, false, 0, true)
+	fh, _ := wfs.fhMap.AcquireFileHandle(wfs, inode, &filer_pb.Entry{
+		Name:       "file",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 88},
+	}, 0, 0)
+	// The handle already reflects a later position in the same clock domain, so
+	// the fence would drop this event.
+	fh.advanceEntryVersion(5000, wfs.signature)
+
+	wfs.onEntryInvalidation(meta_cache.EntryInvalidation{
+		Path: oldPath, RenamedTo: newPath, TsNs: 1000,
+		Signatures: []int32{wfs.signature},
+	})
+
+	if got, status := wfs.inodeToPath.GetPath(inode); status != fuse.OK || got != newPath {
+		t.Errorf("inode resolves to %q (%v), want %s", got, status, newPath)
+	}
+	if dir, name := fh.savedDir, fh.savedName; util.FullPath(dir).Child(name) != newPath {
+		t.Errorf("handle remembers %s/%s, want %s", dir, name, newPath)
+	}
+}
diff --git a/weed/mount/weedfs_rename.go b/weed/mount/weedfs_rename.go
index 995d34417a..369314edfa 100644
--- a/weed/mount/weedfs_rename.go
+++ b/weed/mount/weedfs_rename.go
@@ -6,9 +6,12 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"sync/atomic"
 	"syscall"
+	"time"
 
 	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -16,10 +19,10 @@ import (
 )
 
 // doRename tries the streaming mux first, falling back to unary on transport errors.
-func (wfs *WFS) doRename(ctx context.Context, request *filer_pb.StreamRenameEntryRequest, oldPath, newPath util.FullPath) error {
+func (wfs *WFS) doRename(ctx context.Context, request *filer_pb.StreamRenameEntryRequest, oldPath, newPath util.FullPath, newPathLock **cluster.LiveLock) error {
 	if wfs.streamMutate != nil && wfs.streamMutate.IsAvailable() {
 		err := wfs.streamMutate.Rename(ctx, request, func(resp *filer_pb.StreamRenameEntryResponse) error {
-			return wfs.handleRenameResponse(ctx, resp)
+			return wfs.handleRenameResponse(ctx, resp, newPath, newPathLock)
 		})
 		if err == nil || !errors.Is(err, ErrStreamTransport) {
 			return err // success or application error
@@ -27,7 +30,28 @@ func (wfs *WFS) doRename(ctx context.Context, request *filer_pb.StreamRenameEntr
 		glog.V(1).Infof("Rename %s => %s: stream failed, falling back to unary: %v", oldPath, newPath, err)
 	}
 	return wfs.WithFilerClient(true, func(client filer_pb.SeaweedFilerClient) error {
-		stream, streamErr := client.StreamRenameEntry(ctx, request)
+		// The stream is dedicated to this attempt, so cancelling its context
+		// abandons just this rename. Bound the silence between events the way
+		// the mutation mux does: a filer that accepts the stream then stalls
+		// must not hold the failover walk hostage, but a long rename that
+		// keeps sending events may take as long as it needs. Local event
+		// work is not wire silence — a directory rename can spend longer
+		// than the bound migrating a child's DLM lock — so the timer defers
+		// while the handler runs instead of cancelling a healthy stream.
+		streamCtx, cancel := context.WithCancel(ctx)
+		defer cancel()
+		var inHandler atomic.Bool
+		var silence *time.Timer
+		silence = time.AfterFunc(wfs.filerRPCWait(), func() {
+			if inHandler.Load() {
+				silence.Reset(wfs.filerRPCWait())
+				return
+			}
+			cancel()
+		})
+		defer silence.Stop()
+
+		stream, streamErr := client.StreamRenameEntry(streamCtx, request)
 		if streamErr != nil {
 			return fmt.Errorf("dir AtomicRenameEntry %s => %s : %v", oldPath, newPath, streamErr)
 		}
@@ -37,11 +61,20 @@ func (wfs *WFS) doRename(ctx context.Context, request *filer_pb.StreamRenameEntr
 				if recvErr == io.EOF {
 					break
 				}
+				if ctx.Err() == nil && streamCtx.Err() != nil {
+					return fmt.Errorf("dir Rename %s => %s: no event for %s", oldPath, newPath, wfs.filerRPCWait())
+				}
 				return fmt.Errorf("dir Rename %s => %s receive: %v", oldPath, newPath, recvErr)
 			}
-			if err := wfs.handleRenameResponse(ctx, resp); err != nil {
+			inHandler.Store(true)
+			err := wfs.handleRenameResponse(ctx, resp, newPath, newPathLock)
+			inHandler.Store(false)
+			if err != nil {
 				return err
 			}
+			// The event just proved the filer alive; the bound covers the
+			// wait for the next one, not the whole rename.
+			silence.Reset(wfs.filerRPCWait())
 		}
 		return nil
 	})
@@ -198,13 +231,17 @@ func (wfs *WFS) Rename(cancel <-chan struct{}, in *fuse.RenameIn, oldName string
 	}
 	newPath := newDir.Child(newName)
 
-	oldEntry, _, status := wfs.maybeLoadEntry(oldPath)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	oldEntry, _, status := wfs.maybeLoadEntry(ctx, oldPath)
 	if status != fuse.OK {
 		return status
 	}
 
 	// POSIX: enforce sticky bit on the source directory.
-	if oldDirEntry, _, dirCode := wfs.maybeLoadEntry(oldDir); dirCode == fuse.OK && oldDirEntry != nil && oldDirEntry.Attributes != nil {
+	if oldDirEntry, _, dirCode := wfs.maybeLoadEntry(ctx, oldDir); dirCode != fuse.OK {
+		return dirCode
+	} else if oldDirEntry != nil && oldDirEntry.Attributes != nil {
 		targetUid := uint32(0)
 		if oldEntry != nil && oldEntry.Attributes != nil {
 			targetUid = oldEntry.Attributes.Uid
@@ -214,17 +251,26 @@ func (wfs *WFS) Rename(cancel <-chan struct{}, in *fuse.RenameIn, oldName string
 		}
 	}
 
-	// POSIX: enforce sticky bit on the destination directory when replacing an existing entry.
+	var newEntry *filer_pb.Entry
 	if in.Flags != RenameNoReplace {
-		if newEntry, _, newStatus := wfs.maybeLoadEntry(newPath); newStatus == fuse.OK && newEntry != nil {
-			if newDirEntry, _, dirCode := wfs.maybeLoadEntry(newDir); dirCode == fuse.OK && newDirEntry != nil && newDirEntry.Attributes != nil {
-				targetUid := uint32(0)
-				if newEntry.Attributes != nil {
-					targetUid = newEntry.Attributes.Uid
-				}
-				if code := checkStickyBit(newDirEntry.Attributes.FileMode, newDirEntry.Attributes.Uid, targetUid, in.Uid); code != fuse.OK {
-					return code
-				}
+		if loaded, _, newStatus := wfs.maybeLoadEntry(ctx, newPath); newStatus == fuse.OK {
+			newEntry = loaded
+		} else if newStatus != fuse.ENOENT {
+			return newStatus
+		}
+	}
+
+	// POSIX: enforce sticky bit on the destination directory when replacing an existing entry.
+	if newEntry != nil {
+		if newDirEntry, _, dirCode := wfs.maybeLoadEntry(ctx, newDir); dirCode != fuse.OK {
+			return dirCode
+		} else if newDirEntry != nil && newDirEntry.Attributes != nil {
+			targetUid := uint32(0)
+			if newEntry.Attributes != nil {
+				targetUid = newEntry.Attributes.Uid
+			}
+			if code := checkStickyBit(newDirEntry.Attributes.FileMode, newDirEntry.Attributes.Uid, targetUid, in.Uid); code != fuse.OK {
+				return code
 			}
 		}
 	}
@@ -235,15 +281,112 @@ func (wfs *WFS) Rename(cancel <-chan struct{}, in *fuse.RenameIn, oldName string
 
 	glog.V(4).Infof("dir Rename %s => %s", oldPath, newPath)
 
+	// Acquire DLM locks on both old and new paths to prevent another mount
+	// from opening either path for writing during the rename. Lock in
+	// sorted order to prevent deadlocks when two mounts rename in opposite
+	// directions (A→B vs B→A).
+	//
+	// Skip the old-path lock if this mount already holds it via an open
+	// file handle (otherwise we'd deadlock trying to re-acquire our own lock).
+	// Acquiring before the handle marks below keeps a lock failure from
+	// leaving source handles flagged for a rename that never happened.
+	var heldLocks []*cluster.LiveLock
+	var newPathLock *cluster.LiveLock
+	if wfs.lockClient != nil {
+		// A handle open on the target holds its lock; claiming it up front
+		// keeps the path locked through the rename (its close would otherwise
+		// release it mid-flight) without waiting on our own ownership.
+		var newPathLockFh *FileHandle
+		defer func() {
+			for _, l := range heldLocks {
+				l.Stop()
+			}
+			if newPathLock != nil {
+				// Never adopted by a migrated handle — return it to the
+				// handle it came from if that is still open.
+				if newPathLockFh != nil {
+					if cur, ok := wfs.fhMap.FindFileHandle(newPathLockFh.inode); ok && cur == newPathLockFh {
+						lk := wfs.fhLockTable.AcquireLock("renameDLM", cur.fh, util.ExclusiveLock)
+						if cur.dlmLock == nil {
+							cur.dlmLock = newPathLock
+							newPathLock = nil
+						}
+						wfs.fhLockTable.ReleaseLock(cur.fh, lk)
+					}
+				}
+				if newPathLock != nil {
+					newPathLock.Stop()
+				}
+			}
+		}()
+		owner := fmt.Sprintf("mount-%d", wfs.signature)
+
+		// Check if the source file handle already holds a DLM lock on oldPath
+		oldPathAlreadyLocked := false
+		sourceInode, sourceMapped := wfs.inodeToPath.GetInode(oldPath)
+		if !sourceMapped && oldEntry != nil && oldEntry.Attributes != nil {
+			sourceInode = oldEntry.Attributes.Inode
+		}
+		if sourceInode != 0 {
+			if fh, ok := wfs.fhMap.FindFileHandle(sourceInode); ok {
+				lk := wfs.fhLockTable.AcquireLock("renameDLM", fh.fh, util.ExclusiveLock)
+				oldPathAlreadyLocked = fh.dlmLock != nil
+				wfs.fhLockTable.ReleaseLock(fh.fh, lk)
+			}
+		}
+		targetInode, targetMapped := wfs.inodeToPath.GetInode(newPath)
+		if !targetMapped && newEntry != nil && newEntry.Attributes != nil {
+			targetInode = newEntry.Attributes.Inode
+		}
+		if targetInode != 0 && targetInode != sourceInode {
+			if targetFh, ok := wfs.fhMap.FindFileHandle(targetInode); ok {
+				targetFhLock := wfs.fhLockTable.AcquireLock("renameDLM", targetFh.fh, util.ExclusiveLock)
+				if targetFh.dlmLock != nil {
+					newPathLock = targetFh.dlmLock
+					targetFh.dlmLock = nil
+					newPathLockFh = targetFh
+				}
+				wfs.fhLockTable.ReleaseLock(targetFh.fh, targetFhLock)
+			}
+		}
+
+		// Determine which paths need new DLM locks
+		pathsToLock := []string{}
+		if newPathLock == nil {
+			pathsToLock = append(pathsToLock, string(newPath))
+		}
+		if !oldPathAlreadyLocked && string(oldPath) != string(newPath) {
+			pathsToLock = append(pathsToLock, string(oldPath))
+		}
+		// Sort for consistent lock ordering
+		if len(pathsToLock) == 2 && pathsToLock[0] > pathsToLock[1] {
+			pathsToLock[0], pathsToLock[1] = pathsToLock[1], pathsToLock[0]
+		}
+
+		for _, p := range pathsToLock {
+			dlmLock := wfs.lockClient.NewBlockingLongLivedLock(p, owner, lock_manager.LiveLockTTL)
+			if dlmLock == nil {
+				return fuse.Status(syscall.EAGAIN)
+			}
+			if p == string(newPath) {
+				newPathLock = dlmLock
+			} else {
+				heldLocks = append(heldLocks, dlmLock)
+			}
+		}
+		glog.V(1).Infof("DLM locks acquired for rename %s => %s (oldPathAlreadyLocked=%v)", oldPath, newPath, oldPathAlreadyLocked)
+	}
+
 	// Ensure the source file's metadata exists on the filer before renaming.
 	// Two cases can leave the entry only in the local cache:
 	//   1. deferFilerCreate=true — file handle still open, dirtyMetadata set.
 	//   2. writebackCache — close() triggered async flush, handle released.
 	// The filer rename will fail with ENOENT unless we flush/wait first.
-	if inode, found := wfs.inodeToPath.GetInode(oldPath); found {
+	sourceInode, sourceMapped := wfs.inodeToPath.GetInode(oldPath)
+	if sourceMapped {
 		// Case 1: handle still open with deferred metadata — flush synchronously
 		// BEFORE any async flush interference.
-		if fh, ok := wfs.fhMap.FindFileHandle(inode); ok && fh.dirtyMetadata {
+		if fh, ok := wfs.fhMap.FindFileHandle(sourceInode); ok && fh.dirtyMetadata {
 			glog.V(4).Infof("dir Rename %s: flushing deferred metadata before rename", oldPath)
 			// Prerequisite for the rename, so it must complete: non-cancellable context.
 			if flushStatus := wfs.doFlush(context.Background(), fh, oldEntry.Attributes.Uid, oldEntry.Attributes.Gid, false); flushStatus != fuse.OK {
@@ -255,49 +398,43 @@ func (wfs *WFS) Rename(cancel <-chan struct{}, in *fuse.RenameIn, oldName string
 		// Mark ALL handles for this inode as renamed so the async flush
 		// skips old-path metadata creation (which would re-insert the
 		// renamed entry into the meta cache after rename events clean it up).
-		wfs.fhMap.MarkInodeRenamed(inode)
-		wfs.waitForPendingAsyncFlush(inode)
+		wfs.fhMap.MarkInodeRenamed(sourceInode)
+		wfs.waitForPendingAsyncFlush(context.Background(), sourceInode)
 	} else if oldEntry != nil && oldEntry.Attributes != nil && oldEntry.Attributes.Inode != 0 {
 		// GetInode failed (Forget already removed the mapping), but the
 		// entry's stored inode can still identify pending async flushes.
-		inode = oldEntry.Attributes.Inode
-		wfs.fhMap.MarkInodeRenamed(inode)
-		wfs.waitForPendingAsyncFlush(inode)
+		sourceInode = oldEntry.Attributes.Inode
+		wfs.fhMap.MarkInodeRenamed(sourceInode)
+		wfs.waitForPendingAsyncFlush(context.Background(), sourceInode)
 	}
 
-	// Acquire DLM locks on both old and new paths to prevent another mount
-	// from opening either path for writing during the rename. Lock in
-	// sorted order to prevent deadlocks when two mounts rename in opposite
-	// directions (A→B vs B→A).
-	//
-	// Skip the old-path lock if this mount already holds it via an open
-	// file handle (otherwise we'd deadlock trying to re-acquire our own lock).
-	if wfs.lockClient != nil {
-		owner := fmt.Sprintf("mount-%d", wfs.signature)
-
-		// Check if the source file handle already holds a DLM lock on oldPath
-		oldPathAlreadyLocked := false
-		if sourceInode, found := wfs.inodeToPath.GetInode(oldPath); found {
-			if fh, ok := wfs.fhMap.FindFileHandle(sourceInode); ok && fh.dlmLock != nil {
-				oldPathAlreadyLocked = true
-			}
+	// Replacing the destination deletes what it held, so a handle still open
+	// on that entry has to stop writing the name back, exactly as an unlink
+	// makes it. Windows is where this bites: the close carrying the flush runs
+	// after the application's CloseHandle returned, so the flush can land on
+	// top of what the rename just put there.
+	if in.Flags == RenameEmptyFlag {
+		targetInode, targetMapped := wfs.inodeToPath.GetInode(newPath)
+		if !targetMapped && newEntry != nil && newEntry.Attributes != nil {
+			// Forget dropped the mapping, but the entry's stored inode still
+			// names the handle, the way the source side falls back.
+			targetInode = newEntry.Attributes.Inode
 		}
-
-		// Determine which paths need new DLM locks
-		pathsToLock := []string{string(newPath)}
-		if !oldPathAlreadyLocked {
-			pathsToLock = append(pathsToLock, string(oldPath))
+		if targetInode != 0 && targetInode != sourceInode {
+			// Drained before the mark, not after: a flush already queued
+			// belongs to the destination as it stands, and one that runs
+			// marked is skipped and takes its handle with it, past the reach
+			// of the restore below.
+			wfs.waitForPendingAsyncFlush(context.Background(), targetInode)
+			epoch := wfs.markHandleDeleted(targetInode)
+			// A rename that does not happen leaves the destination where it
+			// was, so its handle has to go back to writing that name.
+			defer func() {
+				if code != fuse.OK {
+					wfs.clearHandleDeleted(targetInode, epoch)
+				}
+			}()
 		}
-		// Sort for consistent lock ordering
-		if len(pathsToLock) == 2 && pathsToLock[0] > pathsToLock[1] {
-			pathsToLock[0], pathsToLock[1] = pathsToLock[1], pathsToLock[0]
-		}
-
-		for _, p := range pathsToLock {
-			dlmLock := wfs.lockClient.NewBlockingLongLivedLock(p, owner, lock_manager.LiveLockTTL)
-			defer dlmLock.Stop()
-		}
-		glog.V(1).Infof("DLM locks acquired for rename %s => %s (oldPathAlreadyLocked=%v)", oldPath, newPath, oldPathAlreadyLocked)
 	}
 
 	// update remote filer
@@ -309,8 +446,7 @@ func (wfs *WFS) Rename(cancel <-chan struct{}, in *fuse.RenameIn, oldName string
 		Signatures:   []int32{wfs.signature},
 	}
 
-	ctx := context.Background()
-	err := wfs.doRename(ctx, request, oldPath, newPath)
+	err := wfs.doRename(context.Background(), request, oldPath, newPath, &newPathLock)
 	if err != nil {
 		glog.V(0).Infof("Rename %s => %s: %v", oldPath, newPath, err)
 		// Map error strings to FUSE status codes. String matching is used
@@ -342,7 +478,7 @@ func (wfs *WFS) Rename(cancel <-chan struct{}, in *fuse.RenameIn, oldName string
 
 }
 
-func (wfs *WFS) handleRenameResponse(ctx context.Context, resp *filer_pb.StreamRenameEntryResponse) error {
+func (wfs *WFS) handleRenameResponse(ctx context.Context, resp *filer_pb.StreamRenameEntryResponse, renameNewPath util.FullPath, renameNewPathLock **cluster.LiveLock) error {
 	// comes from filer StreamRenameEntry, can only be create or delete entry
 
 	glog.V(4).Infof("dir Rename %+v", resp.EventNotification)
@@ -376,16 +512,32 @@ func (wfs *WFS) handleRenameResponse(ctx context.Context, resp *filer_pb.StreamR
 				// Migrate the DLM lock from old path to new path so the
 				// lock key matches the current file location. Hold the
 				// fhLockTable to prevent ReleaseHandle from concurrently
-				// stopping the lock during migration.
-				if wfs.lockClient != nil {
+				// stopping the lock during migration. Acquire before
+				// releasing: a failed migration keeps the old lock rather
+				// than leaving the handle unlocked.
+				if wfs.lockClient != nil && oldPath != newPath {
 					fhActiveLock := wfs.fhLockTable.AcquireLock("renameDLM", fh.fh, util.ExclusiveLock)
 					if fh.dlmLock != nil {
-						owner := fmt.Sprintf("mount-%d", wfs.signature)
-						fh.dlmLock.Stop()
-						fh.dlmLock = wfs.lockClient.NewBlockingLongLivedLock(
-							string(newPath), owner, lock_manager.LiveLockTTL,
-						)
-						glog.V(1).Infof("DLM lock migrated from %s to %s", oldPath, newPath)
+						var newLock *cluster.LiveLock
+						if newPath == renameNewPath && renameNewPathLock != nil && *renameNewPathLock != nil {
+							// The rename already holds a lock on the target;
+							// adopt it — re-acquiring our own lock would block
+							// until this handle is released.
+							newLock = *renameNewPathLock
+							*renameNewPathLock = nil
+						} else {
+							owner := fmt.Sprintf("mount-%d", wfs.signature)
+							newLock = wfs.lockClient.NewBlockingLongLivedLock(
+								string(newPath), owner, lock_manager.LiveLockTTL,
+							)
+						}
+						if newLock != nil {
+							fh.dlmLock.Stop()
+							fh.dlmLock = newLock
+							glog.V(1).Infof("DLM lock migrated from %s to %s", oldPath, newPath)
+						} else {
+							glog.Warningf("DLM lock migration to %s failed; keeping lock on %s", newPath, oldPath)
+						}
 					}
 					wfs.fhLockTable.ReleaseLock(fh.fh, fhActiveLock)
 				}
diff --git a/weed/mount/weedfs_rename_test.go b/weed/mount/weedfs_rename_test.go
index 406a093c35..6eb47ca8ad 100644
--- a/weed/mount/weedfs_rename_test.go
+++ b/weed/mount/weedfs_rename_test.go
@@ -69,7 +69,7 @@ func TestHandleRenameResponseLeavesUncachedTargetOutOfCache(t *testing.T) {
 		},
 	}
 
-	if err := wfs.handleRenameResponse(context.Background(), resp); err != nil {
+	if err := wfs.handleRenameResponse(context.Background(), resp, targetPath, nil); err != nil {
 		t.Fatalf("handle rename response: %v", err)
 	}
 
diff --git a/weed/mount/weedfs_stats.go b/weed/mount/weedfs_stats.go
index 152e0b1e8c..be2c01ce81 100644
--- a/weed/mount/weedfs_stats.go
+++ b/weed/mount/weedfs_stats.go
@@ -37,7 +37,7 @@ func (wfs *WFS) StatFs(cancel <-chan struct{}, in *fuse.InHeader, out *fuse.Stat
 
 	if wfs.stats.lastChecked < time.Now().Unix()-20 {
 
-		err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		err := wfs.withFilerClient(context.Background(), false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 
 			request := &filer_pb.StatisticsRequest{
 				Collection:  wfs.option.Collection,
@@ -47,7 +47,7 @@ func (wfs *WFS) StatFs(cancel <-chan struct{}, in *fuse.InHeader, out *fuse.Stat
 			}
 
 			glog.V(4).Infof("reading filer stats: %+v", request)
-			resp, err := client.Statistics(context.Background(), request)
+			resp, err := client.Statistics(ctx, request)
 			if err != nil {
 				glog.V(0).Infof("reading filer stats %v: %v", request, err)
 				return err
@@ -64,8 +64,8 @@ func (wfs *WFS) StatFs(cancel <-chan struct{}, in *fuse.InHeader, out *fuse.Stat
 			return nil
 		})
 		if err != nil {
+			// the last known sizes beat the empty filesystem a bare return reports
 			glog.V(0).Infof("filer Statistics: %v", err)
-			return fuse.OK
 		}
 	}
 
diff --git a/weed/mount/weedfs_stream_helpers.go b/weed/mount/weedfs_stream_helpers.go
index ae4b25c48e..2a1858b63f 100644
--- a/weed/mount/weedfs_stream_helpers.go
+++ b/weed/mount/weedfs_stream_helpers.go
@@ -3,6 +3,7 @@ package mount
 import (
 	"context"
 	"errors"
+	"syscall"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -19,7 +20,7 @@ func (wfs *WFS) streamCreateEntry(ctx context.Context, req *filer_pb.CreateEntry
 		glog.V(1).Infof("streamCreateEntry %s/%s: stream failed, falling back to unary: %v", req.Directory, req.Entry.Name, err)
 	}
 	var resp *filer_pb.CreateEntryResponse
-	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	err := wfs.withFilerClient(ctx, false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 		var err error
 		resp, err = filer_pb.CreateEntryWithResponse(ctx, client, req)
 		return err
@@ -38,7 +39,7 @@ func (wfs *WFS) streamUpdateEntry(ctx context.Context, req *filer_pb.UpdateEntry
 		glog.V(1).Infof("streamUpdateEntry %s/%s: stream failed, falling back to unary: %v", req.Directory, req.Entry.Name, err)
 	}
 	var resp *filer_pb.UpdateEntryResponse
-	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	err := wfs.withFilerClient(ctx, false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 		var err error
 		resp, err = client.UpdateEntry(ctx, req)
 		return err
@@ -57,10 +58,20 @@ func (wfs *WFS) streamDeleteEntry(ctx context.Context, req *filer_pb.DeleteEntry
 		glog.V(1).Infof("streamDeleteEntry %s/%s: stream failed, falling back to unary: %v", req.Directory, req.Name, err)
 	}
 	var resp *filer_pb.DeleteEntryResponse
-	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	err := wfs.withFilerClient(ctx, false, wfs.filerRPCWait(), func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 		var err error
 		resp, err = client.DeleteEntry(ctx, req)
-		return err
+		if err != nil {
+			return err
+		}
+		// A refused delete arrives in the response, as the stream branch above.
+		if resp.Error != "" {
+			return &streamMutateError{msg: resp.Error, errno: syscall.EIO}
+		}
+		return nil
 	})
-	return resp, err
+	if err != nil {
+		return nil, err
+	}
+	return resp, nil
 }
diff --git a/weed/mount/weedfs_stream_mutate.go b/weed/mount/weedfs_stream_mutate.go
index b4b3298fa2..87d9ac811d 100644
--- a/weed/mount/weedfs_stream_mutate.go
+++ b/weed/mount/weedfs_stream_mutate.go
@@ -8,6 +8,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"syscall"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
@@ -29,6 +30,14 @@ type streamMutateError struct {
 func (e *streamMutateError) Error() string        { return e.msg }
 func (e *streamMutateError) Errno() syscall.Errno { return e.errno }
 
+// hasCreateResponse reports whether resp carries a nested CreateEntryResponse to
+// unwrap. A create wrapper without one has no structured code to recover, and
+// CreateEntry would dereference the nil.
+func hasCreateResponse(resp *filer_pb.StreamMutateEntryResponse) bool {
+	cr, ok := resp.Response.(*filer_pb.StreamMutateEntryResponse_CreateResponse)
+	return ok && cr.CreateResponse != nil
+}
+
 // ErrStreamTransport is a sentinel error type for transport-level stream
 // failures (disconnects, send errors). Callers use errors.Is to decide
 // whether to fall back to unary RPCs.
@@ -45,6 +54,7 @@ type streamMutateMux struct {
 	stream     filer_pb.SeaweedFiler_StreamMutateEntryClient
 	cancel     context.CancelFunc
 	grpcConn   *grpc.ClientConn // dedicated connection, closed on stream teardown
+	filerIdx   int32            // FilerAddresses index the current stream dialed
 	closed     bool
 	disabled   bool          // permanently disabled if filer doesn't support the RPC
 	stopSend   chan struct{} // closed to signal the current sendLoop to exit
@@ -82,12 +92,21 @@ func (m *streamMutateMux) CreateEntry(ctx context.Context, req *filer_pb.CreateE
 	if err != nil {
 		return nil, err
 	}
+	return createEntryFromResponse(resp, req)
+}
+
+// createEntryFromResponse unwraps a create's nested response, mapping its
+// structured code back to the sentinel callers match on (same logic as
+// CreateEntryWithResponse).
+func createEntryFromResponse(resp *filer_pb.StreamMutateEntryResponse, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
 	r, ok := resp.Response.(*filer_pb.StreamMutateEntryResponse_CreateResponse)
 	if !ok {
 		return nil, fmt.Errorf("unexpected response type %T", resp.Response)
 	}
-	// Check nested error fields (same logic as CreateEntryWithResponse).
 	cr := r.CreateResponse
+	if cr == nil {
+		return nil, &streamMutateError{msg: "create response missing", errno: syscall.EIO}
+	}
 	if cr.ErrorCode != filer_pb.FilerError_OK {
 		if sentinel := filer_pb.FilerErrorToSentinel(cr.ErrorCode); sentinel != nil {
 			return nil, fmt.Errorf("CreateEntry %s/%s: %w", req.Directory, req.Entry.Name, sentinel)
@@ -97,6 +116,11 @@ func (m *streamMutateMux) CreateEntry(ctx context.Context, req *filer_pb.CreateE
 	if cr.Error != "" {
 		return nil, &streamMutateError{msg: cr.Error, errno: syscall.EIO}
 	}
+	if resp.Error != "" {
+		// The nested response explained nothing, so the top-level failure is all
+		// there is: reporting success here would lose the create's error entirely.
+		return nil, &streamMutateError{msg: resp.Error, errno: syscall.Errno(resp.Errno)}
+	}
 	return cr, nil
 }
 
@@ -160,22 +184,41 @@ func (m *streamMutateMux) Rename(ctx context.Context, req *filer_pb.StreamRename
 	case <-ctx.Done():
 		return ctx.Err()
 	}
+	sendTimer := time.NewTimer(m.wfs.filerRPCWait())
 	select {
 	case err := <-sendReq.errCh:
+		sendTimer.Stop()
 		if err != nil {
 			return fmt.Errorf("rename send: %w: %v", ErrStreamTransport, err)
 		}
+	case <-sendTimer.C:
+		m.teardownStream(gen)
+		return fmt.Errorf("rename send: %w: timed out", ErrStreamTransport)
 	case <-ctx.Done():
+		sendTimer.Stop()
 		return ctx.Err()
 	}
 
-	// Collect rename events until is_last=true.
+	// Collect rename events until is_last=true. The timer bounds silence
+	// between events, not the whole rename.
+	respTimer := time.NewTimer(m.wfs.filerRPCWait())
+	defer respTimer.Stop()
 	for {
 		select {
 		case resp, ok := <-ch:
 			if !ok {
 				return fmt.Errorf("rename recv: %w: stream closed", ErrStreamTransport)
 			}
+			// Applying an event can legitimately outlast the silence bound —
+			// a directory rename migrates an open child's DLM lock under
+			// another writer. The timer bounds wire silence only, so stop it
+			// for the local work and re-arm it before the next wait.
+			if !respTimer.Stop() {
+				select {
+				case <-respTimer.C:
+				default:
+				}
+			}
 			if r, ok := resp.Response.(*filer_pb.StreamMutateEntryResponse_RenameResponse); ok {
 				if r.RenameResponse != nil && r.RenameResponse.EventNotification != nil {
 					if err := onEvent(r.RenameResponse); err != nil {
@@ -192,6 +235,10 @@ func (m *streamMutateMux) Rename(ctx context.Context, req *filer_pb.StreamRename
 				}
 				return nil
 			}
+			respTimer.Reset(m.wfs.filerRPCWait())
+		case <-respTimer.C:
+			m.teardownStream(gen)
+			return fmt.Errorf("rename recv: %w: timed out", ErrStreamTransport)
 		case <-ctx.Done():
 			return ctx.Err()
 		}
@@ -221,28 +268,48 @@ func (m *streamMutateMux) doUnary(ctx context.Context, req *filer_pb.StreamMutat
 	case <-ctx.Done():
 		return nil, ctx.Err()
 	}
+	// Most callers pass context.Background(), so a stream blocked on Send or
+	// Recv over a dead transport would never surface an error here. Bound the
+	// wait and tear the stream down so the call can fall back to a unary RPC
+	// on another filer.
+	sendTimer := time.NewTimer(m.wfs.filerRPCWait())
 	select {
 	case err := <-sendReq.errCh:
+		sendTimer.Stop()
 		if err != nil {
 			return nil, fmt.Errorf("%w: %v", ErrStreamTransport, err)
 		}
+	case <-sendTimer.C:
+		m.teardownStream(gen)
+		return nil, fmt.Errorf("%w: send timed out", ErrStreamTransport)
 	case <-ctx.Done():
+		sendTimer.Stop()
 		return nil, ctx.Err()
 	}
 
+	respTimer := time.NewTimer(m.wfs.filerRPCWait())
 	select {
 	case resp, ok := <-ch:
+		respTimer.Stop()
 		if !ok {
 			return nil, fmt.Errorf("%w: stream closed", ErrStreamTransport)
 		}
-		if resp.Error != "" {
+		// A failed create still carries a structured error code in its nested
+		// CreateEntryResponse, so hand that back for CreateEntry to unwrap and
+		// the sentinel (entry-already-exists → EEXIST) survives instead of
+		// collapsing into the top-level generic errno.
+		if resp.Error != "" && !hasCreateResponse(resp) {
 			return nil, &streamMutateError{
 				msg:   resp.Error,
 				errno: syscall.Errno(resp.Errno),
 			}
 		}
 		return resp, nil
+	case <-respTimer.C:
+		m.teardownStream(gen)
+		return nil, fmt.Errorf("%w: response timed out", ErrStreamTransport)
 	case <-ctx.Done():
+		respTimer.Stop()
 		return nil, ctx.Err()
 	}
 }
@@ -338,6 +405,7 @@ func (m *streamMutateMux) openStream(out *filer_pb.SeaweedFiler_StreamMutateEntr
 		}
 
 		atomic.StoreInt32(&m.wfs.option.filerIndex, idx)
+		m.filerIdx = idx
 		m.cancel = cancel
 		m.grpcConn = grpcConn
 		*out = stream
@@ -402,6 +470,7 @@ func (m *streamMutateMux) teardownStream(gen uint64) {
 		m.mu.Unlock()
 		return
 	}
+	filerIdx := m.filerIdx
 	m.stream = nil
 	if m.stopSend != nil {
 		close(m.stopSend)
@@ -413,6 +482,13 @@ func (m *streamMutateMux) teardownStream(gen uint64) {
 	}
 	conn := m.grpcConn
 	m.grpcConn = nil
+	// Rotate while still holding mu: a new generation cannot open until
+	// teardown releases the lock, so the index advanced here always belongs
+	// to the stream that just died — never to a successor ensureStream may
+	// have opened in between.
+	if n := int32(len(m.wfs.option.FilerAddresses)); n > 0 {
+		atomic.CompareAndSwapInt32(&m.wfs.option.filerIndex, filerIdx, (filerIdx+1)%n)
+	}
 	m.mu.Unlock()
 
 	// Do NOT call failAllPending here — recvLoop is the sole owner of
diff --git a/weed/mount/weedfs_stream_mutate_error_test.go b/weed/mount/weedfs_stream_mutate_error_test.go
new file mode 100644
index 0000000000..2db4f7371c
--- /dev/null
+++ b/weed/mount/weedfs_stream_mutate_error_test.go
@@ -0,0 +1,136 @@
+package mount
+
+import (
+	"errors"
+	"syscall"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+// The filer reports a failed create twice: a generic errno at the top level and
+// a structured code in the nested CreateEntryResponse. doUnary must not consume
+// the response on the generic one, or the sentinel never reaches Mkdir and a
+// lost create race surfaces as EIO instead of EEXIST.
+func TestHasCreateResponse(t *testing.T) {
+	cases := []struct {
+		name string
+		resp *filer_pb.StreamMutateEntryResponse
+		want bool
+	}{
+		{
+			name: "create carrying a nested response",
+			resp: &filer_pb.StreamMutateEntryResponse{
+				Response: &filer_pb.StreamMutateEntryResponse_CreateResponse{
+					CreateResponse: &filer_pb.CreateEntryResponse{
+						Error:     "entry already exists",
+						ErrorCode: filer_pb.FilerError_ENTRY_ALREADY_EXISTS,
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "create wrapper with no nested response",
+			resp: &filer_pb.StreamMutateEntryResponse{
+				Response: &filer_pb.StreamMutateEntryResponse_CreateResponse{},
+			},
+			want: false,
+		},
+		{
+			name: "a different mutation",
+			resp: &filer_pb.StreamMutateEntryResponse{
+				Response: &filer_pb.StreamMutateEntryResponse_DeleteResponse{
+					DeleteResponse: &filer_pb.DeleteEntryResponse{Error: "boom"},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "no response at all",
+			resp: &filer_pb.StreamMutateEntryResponse{},
+			want: false,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := hasCreateResponse(tc.resp); got != tc.want {
+				t.Fatalf("hasCreateResponse = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// CreateEntry turns the nested code into the sentinel Mkdir matches on.
+func TestStreamMutateCreateEntryUnwrapsAlreadyExists(t *testing.T) {
+	resp := &filer_pb.StreamMutateEntryResponse{
+		Response: &filer_pb.StreamMutateEntryResponse_CreateResponse{
+			CreateResponse: &filer_pb.CreateEntryResponse{
+				Error:     "/dir/name: entry already exists",
+				ErrorCode: filer_pb.FilerError_ENTRY_ALREADY_EXISTS,
+			},
+		},
+	}
+	_, err := createEntryFromResponse(resp, &filer_pb.CreateEntryRequest{
+		Directory: "/dir",
+		Entry:     &filer_pb.Entry{Name: "name"},
+	})
+	if !errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+		t.Fatalf("err = %v, want it to wrap ErrEntryAlreadyExists", err)
+	}
+}
+
+// Any other create failure keeps the generic errno rather than inventing one.
+func TestStreamMutateCreateEntryKeepsGenericFailure(t *testing.T) {
+	resp := &filer_pb.StreamMutateEntryResponse{
+		Response: &filer_pb.StreamMutateEntryResponse_CreateResponse{
+			CreateResponse: &filer_pb.CreateEntryResponse{Error: "store unavailable"},
+		},
+	}
+	_, err := createEntryFromResponse(resp, &filer_pb.CreateEntryRequest{
+		Directory: "/dir",
+		Entry:     &filer_pb.Entry{Name: "name"},
+	})
+	var sme *streamMutateError
+	if !errors.As(err, &sme) || sme.Errno() != syscall.EIO {
+		t.Fatalf("err = %v, want a streamMutateError with EIO", err)
+	}
+}
+
+// A create wrapper whose nested response is missing must be reported, not
+// dereferenced. Nothing our filer sends looks like this, but the mount is
+// reading off the wire and a panic here takes the whole mount down.
+func TestStreamMutateCreateEntryRejectsMissingNestedResponse(t *testing.T) {
+	_, err := createEntryFromResponse(&filer_pb.StreamMutateEntryResponse{
+		Response: &filer_pb.StreamMutateEntryResponse_CreateResponse{},
+	}, &filer_pb.CreateEntryRequest{
+		Directory: "/dir",
+		Entry:     &filer_pb.Entry{Name: "name"},
+	})
+	var sme *streamMutateError
+	if !errors.As(err, &sme) || sme.Errno() != syscall.EIO {
+		t.Fatalf("err = %v, want a streamMutateError with EIO", err)
+	}
+}
+
+// A top-level failure the nested response does not explain must not read as
+// success just because the nested fields happen to be empty.
+func TestStreamMutateCreateEntryKeepsUnexplainedTopLevelError(t *testing.T) {
+	_, err := createEntryFromResponse(&filer_pb.StreamMutateEntryResponse{
+		Error: "filer went away mid-create",
+		Errno: int32(syscall.EAGAIN),
+		Response: &filer_pb.StreamMutateEntryResponse_CreateResponse{
+			CreateResponse: &filer_pb.CreateEntryResponse{},
+		},
+	}, &filer_pb.CreateEntryRequest{
+		Directory: "/dir",
+		Entry:     &filer_pb.Entry{Name: "name"},
+	})
+	var sme *streamMutateError
+	if !errors.As(err, &sme) {
+		t.Fatalf("err = %v, want a streamMutateError", err)
+	}
+	if sme.Errno() != syscall.EAGAIN {
+		t.Fatalf("errno = %v, want the top-level EAGAIN", sme.Errno())
+	}
+}
diff --git a/weed/mount/weedfs_symlink.go b/weed/mount/weedfs_symlink.go
index d9a413d4f3..bea946a3b7 100644
--- a/weed/mount/weedfs_symlink.go
+++ b/weed/mount/weedfs_symlink.go
@@ -91,7 +91,9 @@ func (wfs *WFS) Readlink(cancel <-chan struct{}, header *fuse.InHeader) (out []b
 		return
 	}
 
-	entry, _, status := wfs.maybeLoadEntry(entryFullPath)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	entry, _, status := wfs.maybeLoadEntry(ctx, entryFullPath)
 	if status != fuse.OK {
 		return nil, status
 	}
diff --git a/weed/mount/weedfs_unsupported.go b/weed/mount/weedfs_unsupported.go
deleted file mode 100644
index 7a8c0af37c..0000000000
--- a/weed/mount/weedfs_unsupported.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package mount
-
-import "github.com/seaweedfs/go-fuse/v2/fuse"
-
-// https://github.com/libfuse/libfuse/blob/48ae2e72b39b6a31cb2194f6f11786b7ca06aac6/include/fuse.h#L778
-
-/**
- * Allocates space for an open file
- *
- * This function ensures that required space is allocated for specified
- * file.  If this function returns success then any subsequent write
- * request to specified range is guaranteed not to fail because of lack
- * of space on the file system media.
- */
-func (wfs *WFS) Fallocate(cancel <-chan struct{}, in *fuse.FallocateIn) (code fuse.Status) {
-	return fuse.ENOSYS
-}
diff --git a/weed/mount/weedfs_write.go b/weed/mount/weedfs_write.go
index 8bb6a41572..26c4b50a18 100644
--- a/weed/mount/weedfs_write.go
+++ b/weed/mount/weedfs_write.go
@@ -9,6 +9,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
 func (wfs *WFS) saveDataAsChunk(fullPath util.FullPath) filer.SaveDataAsChunkFunctionType {
@@ -38,7 +39,7 @@ func (wfs *WFS) saveDataAsChunk(fullPath util.FullPath) filer.SaveDataAsChunkFun
 		if wfs.option.VolumeServerAccess == "filerProxy" {
 			// getCurrentFiler() can change on failover, so read it per attempt.
 			uploadOption.GenUploadUrl = func(host, fileId string) string {
-				return fmt.Sprintf("http://%s/?proxyChunkId=%s", wfs.getCurrentFiler(), fileId)
+				return util_http.ProxyChunkUrl(string(wfs.getCurrentFiler()), fileId)
 			}
 		}
 
diff --git a/weed/mount/weedfs_xattr.go b/weed/mount/weedfs_xattr.go
index a042c0e000..da3815ccbd 100644
--- a/weed/mount/weedfs_xattr.go
+++ b/weed/mount/weedfs_xattr.go
@@ -38,7 +38,9 @@ func (wfs *WFS) GetXAttr(cancel <-chan struct{}, header *fuse.InHeader, attr str
 		return 0, fuse.EINVAL
 	}
 
-	_, _, entry, status := wfs.maybeReadEntry(header.NodeId)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	_, _, entry, status := wfs.maybeReadEntry(ctx, header.NodeId)
 	if status != fuse.OK {
 		return 0, status
 	}
@@ -105,7 +107,9 @@ func (wfs *WFS) SetXAttr(cancel <-chan struct{}, input *fuse.SetXAttrIn, attr st
 		}
 	}
 
-	path, fh, entry, status := wfs.maybeReadEntry(input.NodeId)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	path, fh, entry, status := wfs.maybeReadEntry(ctx, input.NodeId)
 	if status != fuse.OK {
 		return status
 	}
@@ -141,6 +145,11 @@ func (wfs *WFS) SetXAttr(cancel <-chan struct{}, input *fuse.SetXAttrIn, attr st
 		fh.dirtyMetadata = true
 		return fuse.OK
 	}
+	if path == "" {
+		// removed while open: the remembered entry is all there is to update
+		wfs.rememberRemovedDir(input.NodeId, entry)
+		return fuse.OK
+	}
 
 	return wfs.saveEntry(path, entry)
 
@@ -155,7 +164,9 @@ func (wfs *WFS) ListXAttr(cancel <-chan struct{}, header *fuse.InHeader, dest []
 		return 0, fuse.Status(syscall.ENOTSUP)
 	}
 
-	_, _, entry, status := wfs.maybeReadEntry(header.NodeId)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	_, _, entry, status := wfs.maybeReadEntry(ctx, header.NodeId)
 	if status != fuse.OK {
 		return 0, status
 	}
@@ -192,7 +203,9 @@ func (wfs *WFS) RemoveXAttr(cancel <-chan struct{}, header *fuse.InHeader, attr
 	if len(attr) == 0 {
 		return fuse.EINVAL
 	}
-	path, fh, entry, status := wfs.maybeReadEntry(header.NodeId)
+	ctx, cancelFunc := ctxFromCancel(cancel)
+	defer cancelFunc()
+	path, fh, entry, status := wfs.maybeReadEntry(ctx, header.NodeId)
 	if status != fuse.OK {
 		return status
 	}
@@ -219,6 +232,11 @@ func (wfs *WFS) RemoveXAttr(cancel <-chan struct{}, header *fuse.InHeader, attr
 		fh.dirtyMetadata = true
 		return fuse.OK
 	}
+	if path == "" {
+		// removed while open: the remembered entry is all there is to update
+		wfs.rememberRemovedDir(header.NodeId, entry)
+		return fuse.OK
+	}
 
 	return wfs.saveEntry(path, entry)
 }
diff --git a/weed/mount/weedfs_xattr_cancel_test.go b/weed/mount/weedfs_xattr_cancel_test.go
new file mode 100644
index 0000000000..1a7c1b835b
--- /dev/null
+++ b/weed/mount/weedfs_xattr_cancel_test.go
@@ -0,0 +1,96 @@
+package mount
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// stalledLookupFiler parks every LookupDirectoryEntry until the caller's
+// context ends, the way a wedged filer holds an RPC forever.
+type stalledLookupFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	lookupStarted chan struct{}
+}
+
+func (s *stalledLookupFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	select {
+	case <-s.lookupStarted:
+	default:
+		close(s.lookupStarted)
+	}
+	<-ctx.Done()
+	return nil, status.Error(codes.Canceled, ctx.Err().Error())
+}
+
+// A FUSE interrupt must unwind a metadata lookup stuck on the filer; without
+// it the op waits on the RPC forever and the caller — Samba issuing
+// listxattr — never sees an answer.
+func TestListXAttrCanceledWhileFilerStalled(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	fake := &stalledLookupFiler{lookupStarted: make(chan struct{})}
+	startFakeFiler(t, wfs, fake)
+
+	wfs.inodeToPath.EnsurePath(util.FullPath("/dir"), true)
+	filePath := util.FullPath("/dir/f")
+	inode := wfs.inodeToPath.AllocateInode(filePath, time.Now().Unix())
+	wfs.inodeToPath.AddPath(inode, filePath)
+
+	cancel := make(chan struct{})
+	done := make(chan fuse.Status, 1)
+	go func() {
+		_, code := wfs.ListXAttr(cancel, &fuse.InHeader{NodeId: inode}, nil)
+		done <- code
+	}()
+
+	select {
+	case <-fake.lookupStarted:
+	case <-time.After(10 * time.Second):
+		t.Fatal("lookup never reached the filer")
+	}
+	close(cancel)
+
+	select {
+	case code := <-done:
+		if code != fuse.EINTR {
+			t.Fatalf("interrupted lookup returned %v, want EINTR", code)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("ListXAttr still blocked after the FUSE request was interrupted")
+	}
+}
+
+// Even without an interrupt the filer lookup has a deadline, so a hung RPC
+// returns a filesystem error instead of parking the caller indefinitely.
+func TestListXAttrTimesOutWhileFilerStalled(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	wfs.filerCallTimeout = 50 * time.Millisecond
+	fake := &stalledLookupFiler{lookupStarted: make(chan struct{})}
+	startFakeFiler(t, wfs, fake)
+
+	wfs.inodeToPath.EnsurePath(util.FullPath("/dir"), true)
+	filePath := util.FullPath("/dir/f")
+	inode := wfs.inodeToPath.AllocateInode(filePath, time.Now().Unix())
+	wfs.inodeToPath.AddPath(inode, filePath)
+
+	done := make(chan fuse.Status, 1)
+	go func() {
+		_, code := wfs.ListXAttr(nil, &fuse.InHeader{NodeId: inode}, nil)
+		done <- code
+	}()
+
+	select {
+	case code := <-done:
+		if code != fuse.EIO {
+			t.Fatalf("stalled filer lookup returned %v, want EIO", code)
+		}
+	case <-time.After(30 * time.Second):
+		t.Fatal("ListXAttr still blocked after the filer lookup deadline")
+	}
+}
diff --git a/weed/mount/wfs_filer_client.go b/weed/mount/wfs_filer_client.go
index d3e8da5465..4f5bf0e668 100644
--- a/weed/mount/wfs_filer_client.go
+++ b/weed/mount/wfs_filer_client.go
@@ -2,9 +2,13 @@ package mount
 
 import (
 	"context"
+	"fmt"
 	"sync/atomic"
+	"time"
 
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -14,6 +18,20 @@ import (
 var _ = filer_pb.FilerClient(&WFS{})
 
 func (wfs *WFS) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) (err error) {
+	return wfs.withFilerClient(context.Background(), streamingMode, wfs.filerRPCWait(), func(_ context.Context, client filer_pb.SeaweedFilerClient) error {
+		return fn(client)
+	})
+}
+
+// withFilerClient walks the filer addresses until one answers fn. callWait
+// bounds one attempt; callWait <= 0 leaves the attempt to ctx alone, for
+// calls whose duration the metadata bound cannot anticipate (a whole-file
+// remote download). Streaming calls ignore callWait — their callbacks bound
+// themselves (the rename fallback arms its own silence timer). The callback
+// must run its RPCs under the supplied context: that is what lets a
+// timed-out attempt be cancelled without disturbing the shared cached
+// channel's other callers.
+func (wfs *WFS) withFilerClient(ctx context.Context, streamingMode bool, callWait time.Duration, fn func(ctx context.Context, client filer_pb.SeaweedFilerClient) error) (err error) {
 
 	return util.Retry("filer grpc", func() error {
 
@@ -22,10 +40,7 @@ func (wfs *WFS) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFile
 		for x := 0; x < n; x++ {
 
 			filerGrpcAddress := wfs.option.FilerAddresses[i].ToGrpcAddress()
-			err = pb.WithGrpcClient(context.Background(), streamingMode, wfs.signature, func(grpcConnection *grpc.ClientConn) error {
-				client := filer_pb.NewSeaweedFilerClient(grpcConnection)
-				return fn(client)
-			}, filerGrpcAddress, false, wfs.option.GrpcDialOption)
+			err = wfs.callFiler(ctx, streamingMode, callWait, filerGrpcAddress, fn)
 
 			if err != nil {
 				// glog.V(0).Infof("WithFilerClient %d %v: %v", x, filerGrpcAddress, err)
@@ -45,6 +60,74 @@ func (wfs *WFS) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFile
 
 }
 
+// filerRPCWait bounds one filer call when the callers' RPCs carry no deadline
+// of their own. filerCallTimeout is only settable on the WFS for tests.
+func (wfs *WFS) filerRPCWait() time.Duration {
+	if wfs.filerCallTimeout > 0 {
+		return wfs.filerCallTimeout
+	}
+	return filerRPCTimeout
+}
+
+// callFiler runs fn against one filer under a per-attempt context derived
+// from ctx, so a filer whose transport silently stalls (stopped peer,
+// black-holed connection) cannot block forever and keep the walk from
+// reaching the remaining filer addresses. Cancelling the attempt aborts its
+// RPCs on the shared cached channel without tearing that channel down.
+//
+// On timeout the call waits for the attempt's callback to unwind before
+// returning: a slow attempt must not overlap the next filer's run of the
+// same closure and clobber the caller's shared result variables. A callback
+// that ignored the attempt context is forced out by dropping the channel.
+func (wfs *WFS) callFiler(ctx context.Context, streamingMode bool, callWait time.Duration, filerGrpcAddress string, fn func(ctx context.Context, client filer_pb.SeaweedFilerClient) error) error {
+	if streamingMode {
+		return pb.WithGrpcClient(ctx, streamingMode, wfs.signature, func(grpcConnection *grpc.ClientConn) error {
+			return fn(ctx, filer_pb.NewSeaweedFilerClient(grpcConnection))
+		}, filerGrpcAddress, false, wfs.option.GrpcDialOption)
+	}
+
+	attemptCtx, cancel := context.WithCancel(ctx)
+	if callWait > 0 {
+		attemptCtx, cancel = context.WithTimeout(ctx, callWait)
+	}
+	defer cancel()
+
+	done := make(chan error, 1)
+	go func() {
+		done <- pb.WithGrpcClient(attemptCtx, streamingMode, wfs.signature, func(grpcConnection *grpc.ClientConn) error {
+			return fn(attemptCtx, filer_pb.NewSeaweedFilerClient(grpcConnection))
+		}, filerGrpcAddress, false, wfs.option.GrpcDialOption)
+	}()
+
+	select {
+	case err := <-done:
+		if err != nil && ctx.Err() == nil && attemptCtx.Err() == context.DeadlineExceeded {
+			// fn surfaced the attempt deadline itself; report it like the
+			// timer path so the failure reads as a filer timeout, not as a
+			// caller cancellation (which IsTransientError would not retry).
+			return status.Error(codes.Unavailable, fmt.Sprintf("filer %s: call timed out", filerGrpcAddress))
+		}
+		return err
+	case <-attemptCtx.Done():
+		// Give the callback one RPC's grace to unwind on its own; only if it
+		// ignored the attempt context does the cached channel get dropped —
+		// the collateral is borne by calls to the same unresponsive filer,
+		// which the walk is abandoning anyway.
+		drain := time.NewTimer(wfs.filerRPCWait())
+		defer drain.Stop()
+		select {
+		case <-done:
+		case <-drain.C:
+			pb.InvalidateGrpcConnection(filerGrpcAddress)
+			<-done
+		}
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		return status.Error(codes.Unavailable, fmt.Sprintf("filer %s: call timed out", filerGrpcAddress))
+	}
+}
+
 func (wfs *WFS) AdjustedUrl(location *filer_pb.Location) string {
 	if wfs.option.VolumeServerAccess == "publicUrl" {
 		return location.PublicUrl
diff --git a/weed/mount/wfs_filer_failover_test.go b/weed/mount/wfs_filer_failover_test.go
new file mode 100644
index 0000000000..e5b05ddaf7
--- /dev/null
+++ b/weed/mount/wfs_filer_failover_test.go
@@ -0,0 +1,212 @@
+package mount
+
+import (
+	"context"
+	"errors"
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// wedgedFiler accepts connections but never answers: LookupDirectoryEntry and
+// StreamMutateEntry block until the transport dies. It stands in for a filer
+// whose TCP connection black-holes instead of refusing.
+type wedgedFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+}
+
+func (s *wedgedFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	<-ctx.Done()
+	return nil, ctx.Err()
+}
+
+func (s *wedgedFiler) StreamMutateEntry(stream filer_pb.SeaweedFiler_StreamMutateEntryServer) error {
+	<-stream.Context().Done()
+	return stream.Context().Err()
+}
+
+func (s *wedgedFiler) StreamRenameEntry(req *filer_pb.StreamRenameEntryRequest, stream filer_pb.SeaweedFiler_StreamRenameEntryServer) error {
+	<-stream.Context().Done()
+	return stream.Context().Err()
+}
+
+// StreamRenameEntry ends cleanly with no events: enough for a failover test
+// to confirm the walk reached this filer.
+func (s *fakeFilerServer) StreamRenameEntry(req *filer_pb.StreamRenameEntryRequest, stream filer_pb.SeaweedFiler_StreamRenameEntryServer) error {
+	return nil
+}
+
+func listenFiler(t *testing.T, fake filer_pb.SeaweedFilerServer) pb.ServerAddress {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { _ = listener.Close() })
+	server := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(server, fake)
+	go server.Serve(listener)
+	t.Cleanup(server.Stop)
+	return pb.NewServerAddressWithGrpcPort("127.0.0.1:1", listener.Addr().(*net.TCPAddr).Port)
+}
+
+// A wedged filer must not hold the walk hostage: the call is bounded and the
+// walk reaches the next address.
+func TestWithFilerClientFailsOverPastWedgedFiler(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	wfs.filerCallTimeout = 200 * time.Millisecond
+
+	wedged := listenFiler(t, &wedgedFiler{})
+	live := listenFiler(t, &fakeFilerServer{lookupSize: 42, lookupLogTsNs: 1000})
+	wfs.option.FilerAddresses = []pb.ServerAddress{wedged, live}
+	atomic.StoreInt32(&wfs.option.filerIndex, 0)
+
+	var entry *filer_pb.Entry
+	err := wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: "/dir",
+			Name:      "file",
+		})
+		if err != nil {
+			return err
+		}
+		entry = resp.Entry
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("WithFilerClient: %v", err)
+	}
+	if entry == nil || entry.Attributes.FileSize != 42 {
+		t.Fatalf("entry = %+v, want lookup served by the live filer", entry)
+	}
+	if got := atomic.LoadInt32(&wfs.option.filerIndex); got != 1 {
+		t.Fatalf("filerIndex = %d, want 1 (the live filer)", got)
+	}
+}
+
+// A mutation stream whose peer never answers must surface as a transport
+// error instead of hanging, and the sticky index must move off the dead filer
+// so the next stream opens elsewhere.
+func TestStreamMutateTimesOutAndRotatesFiler(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	wfs.filerCallTimeout = 200 * time.Millisecond
+
+	wedged := listenFiler(t, &wedgedFiler{})
+	wfs.option.FilerAddresses = []pb.ServerAddress{
+		wedged,
+		pb.NewServerAddressWithGrpcPort("127.0.0.1:1", 1),
+	}
+	atomic.StoreInt32(&wfs.option.filerIndex, 0)
+
+	mux := newStreamMutateMux(wfs)
+	defer mux.Close()
+
+	_, err := mux.CreateEntry(context.Background(), &filer_pb.CreateEntryRequest{
+		Directory: "/dir",
+		Entry:     &filer_pb.Entry{Name: "file"},
+	})
+	if !errors.Is(err, ErrStreamTransport) {
+		t.Fatalf("err = %v, want ErrStreamTransport", err)
+	}
+	if got := atomic.LoadInt32(&wfs.option.filerIndex); got != 1 {
+		t.Fatalf("filerIndex = %d, want 1 after teardown of the wedged stream", got)
+	}
+}
+
+// A timed-out attempt must unwind before the walk runs the next filer's
+// attempt: every attempt runs the same closure, so two in flight at once
+// race on the caller's captured result variables.
+func TestWithFilerClientDoesNotOverlapAttempts(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	wfs.filerCallTimeout = 200 * time.Millisecond
+
+	wedged := listenFiler(t, &wedgedFiler{})
+	live := listenFiler(t, &fakeFilerServer{lookupSize: 42})
+	wfs.option.FilerAddresses = []pb.ServerAddress{wedged, live}
+	atomic.StoreInt32(&wfs.option.filerIndex, 0)
+
+	var attempts, inside, overlap atomic.Int32
+	release := make(chan struct{})
+
+	done := make(chan error, 1)
+	go func() {
+		done <- wfs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+			n := attempts.Add(1)
+			if !inside.CompareAndSwap(0, 1) {
+				overlap.Add(1)
+			}
+			defer inside.Store(0)
+			if n == 1 {
+				// Outlive the attempt deadline on purpose: the walk must
+				// wait for this callback instead of racing ahead.
+				<-release
+				return errors.New("first attempt released")
+			}
+			return nil
+		})
+	}()
+
+	deadline := time.Now().Add(10 * wfs.filerCallTimeout)
+	for attempts.Load() == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	if attempts.Load() == 0 {
+		t.Fatal("first attempt never started")
+	}
+
+	// Past the deadline plus its unwind grace, the blocked callback must
+	// still be the only attempt: no second run may start alongside it.
+	time.Sleep(3 * wfs.filerCallTimeout)
+	if got := attempts.Load(); got != 1 {
+		t.Fatalf("attempts = %d, want 1 while the timed-out attempt is still unwinding", got)
+	}
+
+	close(release)
+	if err := <-done; err != nil {
+		t.Fatalf("WithFilerClient: %v", err)
+	}
+	if got := overlap.Load(); got != 0 {
+		t.Fatalf("attempts overlapped %d times", got)
+	}
+	if got := attempts.Load(); got != 2 {
+		t.Fatalf("attempts = %d, want 2", got)
+	}
+}
+
+// The unary fallback for a streamed rename must bound silence too: a filer
+// that accepts StreamRenameEntry then never answers cannot hold the walk.
+func TestDoRenameFailsOverPastWedgedFiler(t *testing.T) {
+	wfs := newInvalidateTestWFS(t)
+	wfs.filerCallTimeout = 200 * time.Millisecond
+
+	wedged := listenFiler(t, &wedgedFiler{})
+	live := listenFiler(t, &fakeFilerServer{})
+	wfs.option.FilerAddresses = []pb.ServerAddress{wedged, live}
+	atomic.StoreInt32(&wfs.option.filerIndex, 0)
+
+	var newPathLock *cluster.LiveLock
+	start := time.Now()
+	err := wfs.doRename(context.Background(), &filer_pb.StreamRenameEntryRequest{
+		OldDirectory: "/a",
+		OldName:      "f",
+		NewDirectory: "/b",
+		NewName:      "f",
+	}, util.FullPath("/a/f"), util.FullPath("/b/f"), &newPathLock)
+	if err != nil {
+		t.Fatalf("doRename: %v", err)
+	}
+	if elapsed := time.Since(start); elapsed > 10*wfs.filerCallTimeout {
+		t.Fatalf("doRename took %v, wedged fallback stream was not bounded", elapsed)
+	}
+	if got := atomic.LoadInt32(&wfs.option.filerIndex); got != 1 {
+		t.Fatalf("filerIndex = %d, want 1 (the live filer)", got)
+	}
+}
diff --git a/weed/mount/winfsp/fs_windows.go b/weed/mount/winfsp/fs_windows.go
index 1c18537aee..b5220c8de1 100644
--- a/weed/mount/winfsp/fs_windows.go
+++ b/weed/mount/winfsp/fs_windows.go
@@ -1,14 +1,17 @@
 package winfsp
 
 import (
+	"strings"
 	"sync"
 	"syscall"
+	"time"
 
 	cgofuse "github.com/winfsp/cgofuse/fuse"
 
 	"github.com/seaweedfs/go-fuse/v2/fuse"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/mount"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 const (
@@ -39,12 +42,17 @@ var never chan struct{}
 type WinFS struct {
 	cgofuse.FileSystemBase
 
-	wfs      *mount.WFS
-	uid      uint32
-	gid      uint32
-	readOnly bool
+	wfs       *mount.WFS
+	mountRoot util.FullPath
+	uid       uint32
+	gid       uint32
+	readOnly  bool
 
-	// An open handle holds the lookup reference for its inode until Release,
+	// paths holds the lookup references for resolved paths, standing in for
+	// the kernel caches of the unix mounts.
+	paths *pathCache
+
+	// An open handle holds a lookup reference for its inode until Release,
 	// the way the kernel keeps one for an open file. WinFsp hands back only
 	// the handle, and the raw filesystem reuses one handle for repeated opens
 	// of the same inode, so the references are counted.
@@ -53,15 +61,37 @@ type WinFS struct {
 	dirInodes  map[uint64]*handleRef
 }
 
-func NewWinFS(wfs *mount.WFS, uid, gid uint32, readOnly bool) *WinFS {
-	return &WinFS{
+func NewWinFS(wfs *mount.WFS, uid, gid uint32, readOnly bool, cacheTimeout time.Duration) *WinFS {
+	w := &WinFS{
 		wfs:        wfs,
+		mountRoot:  wfs.MountRoot(),
 		uid:        uid,
 		gid:        gid,
 		readOnly:   readOnly,
 		fileInodes: make(map[uint64]*handleRef),
 		dirInodes:  make(map[uint64]*handleRef),
 	}
+	w.paths = newPathCache(cacheTimeout, w.forget)
+	return w
+}
+
+// stillNames reports whether the mount still tracks inode at the mount-relative
+// key, which a delete-on-close or a rename while the handle was open has
+// changed.
+func (w *WinFS) stillNames(key string, inode uint64) bool {
+	current, ok := w.wfs.PathForInode(inode)
+	if !ok {
+		return false
+	}
+	rel, ok := relativeToMount(w.mountRoot, current)
+	return ok && cacheKey(rel) == key
+}
+
+// invalidatePath is what the notifier calls when a metadata event arrives:
+// whatever is cached for that path is out of date. Directories take their
+// subtree with them, since the children's cached paths point through them.
+func (w *WinFS) invalidatePath(path string, isDirectory bool) {
+	w.paths.purge(cacheKey(path), isDirectory)
 }
 
 // handleRef is the lookup references an open handle is holding, one per open
@@ -142,36 +172,6 @@ func (w *WinFS) caller(inode uint64) fuse.InHeader {
 	}
 }
 
-// lookupRef collects the references a resolution took. Every operation that
-// hands back an EntryOut grants the caller one, which the Linux kernel returns
-// with FORGET. WinFsp has no FORGET, so anything the adapter looks up it has
-// to release itself or the mount's inode table grows for the life of the
-// process.
-type lookupRef struct {
-	w      *WinFS
-	inodes []uint64
-}
-
-// release returns every reference still held.
-func (r *lookupRef) release() {
-	if r == nil {
-		return
-	}
-	for _, inode := range r.inodes {
-		r.w.forget(inode)
-	}
-	r.inodes = nil
-}
-
-// keepLast hands the reference on the final component to the caller, which
-// becomes responsible for releasing it. An open handle takes it this way and
-// gives it back on Release.
-func (r *lookupRef) keepLast() {
-	if r != nil && len(r.inodes) > 0 {
-		r.inodes = r.inodes[:len(r.inodes)-1]
-	}
-}
-
 // forget returns one reference. The root is never looked up, so it never holds
 // one to give back.
 func (w *WinFS) forget(inode uint64) {
@@ -181,42 +181,75 @@ func (w *WinFS) forget(inode uint64) {
 	w.wfs.Forget(inode, 1)
 }
 
-// walk resolves a path one component at a time. Lookup does more than find an
-// inode: it refreshes what the mount knows about the entry, so the result of a
-// preceding truncate or write is visible to the caller.
-func (w *WinFS) walk(parts []string) (uint64, *lookupRef, fuse.Status) {
-	ref := &lookupRef{w: w}
+// walk resolves a path one component at a time, filling the path cache as it
+// goes. Every reference a lookup grants is owned by the cache, which keeps the
+// returned inode alive for at least one cache sweep; an operation that needs
+// to hold the inode longer steals the reference from the cache.
+func (w *WinFS) walk(parts []string) (uint64, fuse.Status) {
 	inode := uint64(rootInode)
-	for _, name := range parts {
+	// Taken before the lookups: a purge racing this walk - a rename or unlink
+	// landing between a Lookup and its insert - makes what was just resolved
+	// the very thing the purge removed.
+	gen := w.paths.snapshot()
+	for i, name := range parts {
+		key := strings.Join(parts[:i+1], "/")
+		if cached, _, ok := w.paths.lookup(key); ok {
+			inode = cached
+			continue
+		}
 		var out fuse.EntryOut
 		if status := w.wfs.Lookup(never, ptr(w.caller(inode)), name, &out); status != fuse.OK {
-			ref.release()
-			return 0, nil, status
+			return 0, status
 		}
+		w.paths.insert(key, out.NodeId, out.Attr, gen)
 		inode = out.NodeId
-		ref.inodes = append(ref.inodes, inode)
 	}
-	return inode, ref, fuse.OK
+	return inode, fuse.OK
 }
 
-// resolve walks a WinFsp path down to an inode. The caller must release the
-// returned reference.
-func (w *WinFS) resolve(path string) (uint64, *lookupRef, fuse.Status) {
+// resolve walks a WinFsp path down to an inode, valid at least until the next
+// cache sweep.
+func (w *WinFS) resolve(path string) (uint64, fuse.Status) {
 	return w.walk(splitPath(path))
 }
 
 // resolveParent resolves everything but the last component, which the create
-// and delete operations need separately. The caller must release the reference.
-func (w *WinFS) resolveParent(path string) (uint64, string, *lookupRef, fuse.Status) {
+// and delete operations need separately.
+func (w *WinFS) resolveParent(path string) (uint64, string, fuse.Status) {
 	parentParts, name, ok := splitParent(path)
 	if !ok {
-		return 0, "", nil, fuse.EINVAL
+		return 0, "", fuse.EINVAL
 	}
-	parent, ref, status := w.walk(parentParts)
+	parent, status := w.walk(parentParts)
 	if status != fuse.OK {
-		return 0, "", nil, status
+		return 0, "", status
 	}
-	return parent, name, ref, fuse.OK
+	return parent, name, fuse.OK
+}
+
+// resolveAndSteal resolves path to an inode reference the caller owns, for
+// the open paths that hold it for the life of a handle: a cached entry is
+// stolen, anything else is looked up directly so the reference never passes
+// through the cache - an open must not depend on an insert surviving the
+// purges racing it. The root is handed out without a reference; it does not
+// need one.
+func (w *WinFS) resolveAndSteal(path string) (uint64, fuse.Status) {
+	key := cacheKey(path)
+	if key == "" {
+		return rootInode, fuse.OK
+	}
+	if stolen, ok := w.paths.steal(key); ok {
+		return stolen, fuse.OK
+	}
+	parent, name, status := w.resolveParent(path)
+	if status != fuse.OK {
+		return 0, status
+	}
+	var out fuse.EntryOut
+	if status := w.wfs.Lookup(never, ptr(w.caller(parent)), name, &out); status != fuse.OK {
+		return 0, status
+	}
+	return out.NodeId, fuse.OK
 }
 
 func (w *WinFS) attrToStat(attr *fuse.Attr, stat *cgofuse.Stat_t) {
@@ -292,17 +325,39 @@ func (w *WinFS) Statfs(path string, stat *cgofuse.Statfs_t) int {
 	return 0
 }
 
+// getattrFromCache serves attributes the way the kernel would from its
+// attribute cache. A file with an open handle is excluded: its live size is
+// on the handle, not in the cache.
+func (w *WinFS) getattrFromCache(key string, stat *cgofuse.Stat_t) bool {
+	if key == "" {
+		return false
+	}
+	inode, attr, ok := w.paths.lookup(key)
+	if !ok || w.wfs.IsFileOpen(inode) {
+		return false
+	}
+	w.attrToStat(&attr, stat)
+	return true
+}
+
 func (w *WinFS) Getattr(path string, stat *cgofuse.Stat_t, fh uint64) int {
 	inode := w.inodeForHandle(w.fileInodes, fh)
 	if inode == 0 {
-		var ref *lookupRef
+		key := cacheKey(path)
+		if fh == noHandle && w.getattrFromCache(key, stat) {
+			return 0
+		}
 		var status fuse.Status
-		inode, ref, status = w.resolve(path)
+		inode, status = w.resolve(path)
 		if status != fuse.OK {
 			logResolveFailure("getattr", path, status)
 			return toErrno(status)
 		}
-		defer ref.release()
+		// The walk just refreshed the cache, so this hits unless the file is
+		// open or is the root, and saves the second load of the same entry.
+		if fh == noHandle && w.getattrFromCache(key, stat) {
+			return 0
+		}
 	}
 	in := &fuse.GetAttrIn{InHeader: w.caller(inode)}
 	if fh != noHandle {
@@ -317,21 +372,31 @@ func (w *WinFS) Getattr(path string, stat *cgofuse.Stat_t, fh uint64) int {
 	return 0
 }
 
+// purgeWithParent drops a mutated path from the cache along with its parent,
+// whose cached mtime the mutation just outdated.
+func (w *WinFS) purgeWithParent(path string, prefix bool) {
+	key := cacheKey(path)
+	w.paths.purge(key, prefix)
+	if i := strings.LastIndexByte(key, '/'); i > 0 {
+		w.paths.purge(key[:i], false)
+	}
+}
+
 func (w *WinFS) Mkdir(path string, mode uint32) int {
 	if w.denied() {
 		return -eROFS
 	}
-	parent, name, ref, status := w.resolveParent(path)
+	parent, name, status := w.resolveParent(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
 	in := &fuse.MkdirIn{InHeader: w.caller(parent), Mode: mode}
 	var out fuse.EntryOut
 	status = w.wfs.Mkdir(never, in, name, &out)
 	if status == fuse.OK {
-		// Mkdir hands back an EntryOut, and nothing on this side will forget it.
-		w.forget(out.NodeId)
+		w.purgeWithParent(path, false)
+		// The new directory is about to be filled; cache it, reference and all.
+		w.paths.insert(cacheKey(path), out.NodeId, out.Attr, w.paths.snapshot())
 	}
 	return toErrno(status)
 }
@@ -340,60 +405,72 @@ func (w *WinFS) Rmdir(path string) int {
 	if w.denied() {
 		return -eROFS
 	}
-	parent, name, ref, status := w.resolveParent(path)
+	parent, name, status := w.resolveParent(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
-	return toErrno(w.wfs.Rmdir(never, ptr(w.caller(parent)), name))
+	status = w.wfs.Rmdir(never, ptr(w.caller(parent)), name)
+	if status == fuse.OK {
+		w.purgeWithParent(path, true)
+	}
+	return toErrno(status)
 }
 
 func (w *WinFS) Unlink(path string) int {
 	if w.denied() {
 		return -eROFS
 	}
-	parent, name, ref, status := w.resolveParent(path)
+	parent, name, status := w.resolveParent(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
-	return toErrno(w.wfs.Unlink(never, ptr(w.caller(parent)), name))
+	status = w.wfs.Unlink(never, ptr(w.caller(parent)), name)
+	if status == fuse.OK {
+		w.purgeWithParent(path, false)
+	}
+	return toErrno(status)
 }
 
 func (w *WinFS) Rename(oldpath string, newpath string) int {
 	if w.denied() {
 		return -eROFS
 	}
-	oldParent, oldName, oldRef, status := w.resolveParent(oldpath)
+	oldParent, oldName, status := w.resolveParent(oldpath)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer oldRef.release()
-	newParent, newName, newRef, status := w.resolveParent(newpath)
+	newParent, newName, status := w.resolveParent(newpath)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer newRef.release()
 	in := &fuse.RenameIn{InHeader: w.caller(oldParent), Newdir: newParent}
-	return toErrno(w.wfs.Rename(never, in, oldName, newName))
+	status = w.wfs.Rename(never, in, oldName, newName)
+	if status == fuse.OK {
+		// Directories carry their subtree's cached paths with them, and the
+		// rename may have replaced an entry at the destination.
+		w.purgeWithParent(oldpath, true)
+		w.purgeWithParent(newpath, true)
+	}
+	return toErrno(status)
 }
 
 func (w *WinFS) Create(path string, flags int, mode uint32) (int, uint64) {
 	if w.denied() {
 		return -eROFS, noHandle
 	}
-	parent, name, ref, status := w.resolveParent(path)
+	parent, name, status := w.resolveParent(path)
 	if status != fuse.OK {
 		glog.Errorf("create %s: resolving the parent directory: %v", path, status)
 		return toErrno(status), noHandle
 	}
-	defer ref.release()
 	in := &fuse.CreateIn{InHeader: w.caller(parent), Flags: translateOpenFlags(flags), Mode: mode}
 	var out fuse.CreateOut
 	if status := w.wfs.Create(never, in, name, &out); status != fuse.OK {
 		glog.Errorf("create %s in inode %d: %v", name, parent, status)
 		return toErrno(status), noHandle
 	}
+	// Whatever the cache held for this path was replaced by the create.
+	w.purgeWithParent(path, false)
 	// Create grants a reference on the new inode; hold it for as long as the
 	// handle lives and give it back in Release.
 	w.retain(w.fileInodes, out.Fh, out.NodeId)
@@ -401,19 +478,18 @@ func (w *WinFS) Create(path string, flags int, mode uint32) (int, uint64) {
 }
 
 func (w *WinFS) Open(path string, flags int) (int, uint64) {
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolveAndSteal(path)
 	if status != fuse.OK {
 		logResolveFailure("open", path, status)
 		return toErrno(status), noHandle
 	}
-	defer ref.release()
 	in := &fuse.OpenIn{InHeader: w.caller(inode), Flags: translateOpenFlags(flags)}
 	var out fuse.OpenOut
 	if status := w.wfs.Open(never, in, &out); status != fuse.OK {
 		glog.Errorf("open %s inode %d: %v", path, inode, status)
+		w.forget(inode)
 		return toErrno(status), noHandle
 	}
-	ref.keepLast()
 	w.retain(w.fileInodes, out.Fh, inode)
 	return 0, out.Fh
 }
@@ -469,13 +545,11 @@ func (w *WinFS) Truncate(path string, size int64, fh uint64) int {
 	}
 	inode := w.inodeForHandle(w.fileInodes, fh)
 	if inode == 0 {
-		var ref *lookupRef
 		var status fuse.Status
-		inode, ref, status = w.resolve(path)
+		inode, status = w.resolve(path)
 		if status != fuse.OK {
 			return toErrno(status)
 		}
-		defer ref.release()
 	}
 	in := &fuse.SetAttrIn{}
 	in.NodeId = inode
@@ -486,35 +560,41 @@ func (w *WinFS) Truncate(path string, size int64, fh uint64) int {
 		in.Fh = fh
 	}
 	var out fuse.AttrOut
-	return toErrno(w.wfs.SetAttr(never, in, &out))
+	status := w.wfs.SetAttr(never, in, &out)
+	if status == fuse.OK {
+		w.paths.purge(cacheKey(path), false)
+	}
+	return toErrno(status)
 }
 
 func (w *WinFS) Chmod(path string, mode uint32) int {
 	if w.denied() {
 		return -eROFS
 	}
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolve(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
 	in := &fuse.SetAttrIn{}
 	in.NodeId = inode
 	in.Valid = fuse.FATTR_MODE
 	in.Mode = mode
 	var out fuse.AttrOut
-	return toErrno(w.wfs.SetAttr(never, in, &out))
+	status = w.wfs.SetAttr(never, in, &out)
+	if status == fuse.OK {
+		w.paths.purge(cacheKey(path), false)
+	}
+	return toErrno(status)
 }
 
 func (w *WinFS) Utimens(path string, tmsp []cgofuse.Timespec) int {
 	if w.denied() {
 		return -eROFS
 	}
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolve(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
 	in := &fuse.SetAttrIn{}
 	in.NodeId = inode
 	if len(tmsp) < 2 {
@@ -536,7 +616,11 @@ func (w *WinFS) Utimens(path string, tmsp []cgofuse.Timespec) int {
 		}
 	}
 	var out fuse.AttrOut
-	return toErrno(w.wfs.SetAttr(never, in, &out))
+	status = w.wfs.SetAttr(never, in, &out)
+	if status == fuse.OK {
+		w.paths.purge(cacheKey(path), false)
+	}
+	return toErrno(status)
 }
 
 // applyTimespec reports whether a timestamp should be written. UTIME_OMIT asks
@@ -574,22 +658,45 @@ func (w *WinFS) Release(path string, fh uint64) int {
 	if fh == noHandle {
 		return 0
 	}
+	// The handle's view of the file is the freshest there is, and the close
+	// has flushed by now, so read it before the handle goes away: the next
+	// operation on the path — a stat right after a copy, most often — is then
+	// served from the cache instead of walking to the filer again.
+	var attr *fuse.Attr
+	if inode := w.inodeForHandle(w.fileInodes, fh); inode != 0 {
+		in := &fuse.GetAttrIn{InHeader: w.caller(inode)}
+		in.Fh_ = fh
+		in.Flags_ = fuse.FUSE_GETATTR_FH
+		var out fuse.AttrOut
+		if w.wfs.GetAttr(never, in, &out) == fuse.OK {
+			attr = &out.Attr
+		}
+	}
 	w.wfs.Release(never, &fuse.ReleaseIn{Fh: fh})
-	w.forget(w.releaseRetained(w.fileInodes, fh))
+	if inode := w.releaseRetained(w.fileInodes, fh); inode != 0 {
+		// The reference moves from the handle to the cache — but only if the
+		// path still names this inode: WinFsp reports the path the handle
+		// opened with, and after a delete-on-close or a rename caching it
+		// would resurrect an entry that is gone.
+		if key, gen := cacheKey(path), w.paths.snapshot(); attr != nil && w.stillNames(key, inode) {
+			w.paths.insert(key, inode, *attr, gen)
+		} else {
+			w.forget(inode)
+		}
+	}
 	return 0
 }
 
 func (w *WinFS) Opendir(path string) (int, uint64) {
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolveAndSteal(path)
 	if status != fuse.OK {
 		return toErrno(status), noHandle
 	}
-	defer ref.release()
 	var out fuse.OpenOut
 	if status := w.wfs.OpenDir(never, &fuse.OpenIn{InHeader: w.caller(inode)}, &out); status != fuse.OK {
+		w.forget(inode)
 		return toErrno(status), noHandle
 	}
-	ref.keepLast()
 	w.retain(w.dirInodes, out.Fh, inode)
 	return 0, out.Fh
 }
@@ -657,13 +764,11 @@ func (s *readdirSink) TakesLookupRef() bool { return false }
 func (w *WinFS) Readdir(path string, fill func(name string, stat *cgofuse.Stat_t, ofst int64) bool, ofst int64, fh uint64) int {
 	inode := w.inodeForHandle(w.dirInodes, fh)
 	if inode == 0 {
-		var ref *lookupRef
 		var status fuse.Status
-		inode, ref, status = w.resolve(path)
+		inode, status = w.resolve(path)
 		if status != fuse.OK {
 			return toErrno(status)
 		}
-		defer ref.release()
 	}
 	offset := uint64(ofst)
 	for {
@@ -719,11 +824,10 @@ func (w *WinFS) Readlink(path string) (int, string) {
 	if len(splitPath(path)) == 0 {
 		return -eNOSYS, ""
 	}
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolve(path)
 	if status != fuse.OK {
 		return toErrno(status), ""
 	}
-	defer ref.release()
 	target, status := w.wfs.Readlink(never, ptr(w.caller(inode)))
 	if status != fuse.OK {
 		return toErrno(status), ""
diff --git a/weed/mount/winfsp/host_windows.go b/weed/mount/winfsp/host_windows.go
index dfefb90ad7..9f1a9a4218 100644
--- a/weed/mount/winfsp/host_windows.go
+++ b/weed/mount/winfsp/host_windows.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+	"time"
 
 	cgofuse "github.com/winfsp/cgofuse/fuse"
 
@@ -21,9 +22,11 @@ type Options struct {
 	Uid uint32
 	Gid uint32
 
-	// AttrTimeout bounds how long WinFsp caches attributes, in seconds.
-	// Nothing invalidates its cache, so this is the only coherence knob.
-	AttrTimeout float64
+	// CacheTimeout bounds how long resolved paths and attributes may be
+	// served from the adapter's cache, and how long WinFsp may serve cached
+	// directory listings. Metadata events shorten it by purging; nothing
+	// else invalidates these caches.
+	CacheTimeout time.Duration
 
 	// ReadOnly rejects every modification. WinFsp has no "ro" option — it
 	// discards the flag and leaves the volume writable — so the refusal has
@@ -33,43 +36,79 @@ type Options struct {
 	// Debug turns on cgofuse's operation trace.
 	Debug bool
 
-	// ExtraOptions are passed through to WinFsp as -o arguments.
+	// ExtraOptions are passed through to WinFsp as -o arguments, after the
+	// defaults, so they win when they name the same option.
 	ExtraOptions []string
 }
 
 // Host is a WinFsp mount that has not been started yet.
 type Host struct {
 	host    *cgofuse.FileSystemHost
+	fs      *WinFS
 	options Options
 }
 
 // New wires wfs up to WinFsp. Nothing is mounted until Serve.
 func New(wfs *mount.WFS, options Options) *Host {
-	host := cgofuse.NewFileSystemHost(NewWinFS(wfs, options.Uid, options.Gid, options.ReadOnly))
+	fs := NewWinFS(wfs, options.Uid, options.Gid, options.ReadOnly, options.CacheTimeout)
+	host := cgofuse.NewFileSystemHost(fs)
 	host.SetCapReaddirPlus(true)
 	host.SetUseIno(true)
-	return &Host{host: host, options: options}
+	return &Host{host: host, fs: fs, options: options}
 }
 
 // Notify wires the mount's metadata events to Windows. Called once before
 // Serve; the host has to exist first, which is why it is not done in New.
 func (h *Host) Notify(wfs *mount.WFS) {
-	n := &notifier{host: h.host, mountRoot: wfs.MountRoot()}
+	n := &notifier{host: h.host, fs: h.fs, mountRoot: wfs.MountRoot()}
 	wfs.SetEntryChangeListener(n.notify)
 }
 
 // Serve attaches the filesystem at mountPoint, which is a drive letter ("S:"),
-// a directory that does not yet exist, or a UNC path. It blocks until the
-// filesystem is unmounted.
+// a directory that does not yet exist, or a \\server\share UNC path. It blocks
+// until the filesystem is unmounted.
 func (h *Host) Serve(mountPoint string) error {
+	prefix, err := VolumePrefix(mountPoint)
+	if err != nil {
+		return err
+	}
 	opts := []string{
 		"-o", "volname=" + h.volumeName(),
 		"-o", "uid=-1",
 		"-o", "gid=-1",
+		// Only an infinite FileInfoTimeout lets the Windows cache manager
+		// cache file data; at any finite value every application read and
+		// write is a synchronous trip into this process at whatever size the
+		// application issued. Remote changes stay visible because every
+		// applied metadata event goes through Notify, which purges the file's
+		// cached pages along with its attributes.
+		//
+		// KeepFileCache is deliberately absent: it would keep the cache alive
+		// past cleanup, deferring the close — and with it the flush that
+		// persists a written file — until Windows reclaims the memory.
+		"-o", "FileInfoTimeout=-1",
+		// FlushOnCleanup is absent for the same reason: it makes every
+		// handle's cleanup flush, and those flushes race the unlinks of
+		// delete-on-close. The flush stays at close, which WinFsp runs after
+		// CloseHandle has returned; the mount persists entries eagerly at
+		// create instead, so nothing that reads through the filer depends on
+		// when the flush runs.
 	}
-	if h.options.AttrTimeout > 0 {
-		timeout := strconv.FormatFloat(h.options.AttrTimeout, 'f', -1, 64)
-		opts = append(opts, "-o", "attr_timeout="+timeout, "-o", "entry_timeout="+timeout)
+	if h.options.CacheTimeout > 0 {
+		ms := strconv.FormatInt(h.options.CacheTimeout.Milliseconds(), 10)
+		// These would silently inherit the infinite FileInfoTimeout.
+		opts = append(opts,
+			"-o", "DirInfoTimeout="+ms,
+			"-o", "VolumeInfoTimeout="+ms,
+			"-o", "EaTimeout="+ms,
+		)
+	}
+	if prefix != "" {
+		// The mount point itself becomes the network prefix; what WinFsp
+		// still wants a mount point for is the drive letter it gives the
+		// mounting session, and "*" lets it pick a free one.
+		opts = append(opts, "-o", "VolumePrefix="+prefix)
+		mountPoint = "*"
 	}
 	if h.options.Debug {
 		opts = append(opts, "-d")
diff --git a/weed/mount/winfsp/mountpoint.go b/weed/mount/winfsp/mountpoint.go
new file mode 100644
index 0000000000..29adf8da7c
--- /dev/null
+++ b/weed/mount/winfsp/mountpoint.go
@@ -0,0 +1,32 @@
+package winfsp
+
+import (
+	"fmt"
+	"strings"
+)
+
+// VolumePrefix converts a \\server\share mount point into WinFsp's
+// VolumePrefix option, which registers the mount as a network file system.
+// That registration is what makes the mount reachable from every logon
+// session by its UNC path — a drive letter lives inside the session that
+// created it, which is why a service mount is invisible to the users logged
+// on at the desktop. Handed through as a plain mount point instead, the UNC
+// path would be taken for a directory on an actual remote server and the
+// mount would fail.
+//
+// Mount points that are not UNC paths return "", including the \\?\ and \\.\
+// device forms, which WinFsp interprets itself.
+func VolumePrefix(mountPoint string) (string, error) {
+	normalized := strings.ReplaceAll(mountPoint, "/", `\`)
+	if !strings.HasPrefix(normalized, `\\`) {
+		return "", nil
+	}
+	if strings.HasPrefix(normalized, `\\?\`) || strings.HasPrefix(normalized, `\\.\`) {
+		return "", nil
+	}
+	parts := strings.Split(strings.TrimRight(normalized[2:], `\`), `\`)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return "", fmt.Errorf(`a network mount point must be \\server\share, got %s`, mountPoint)
+	}
+	return `\` + parts[0] + `\` + parts[1], nil
+}
diff --git a/weed/mount/winfsp/mountpoint_test.go b/weed/mount/winfsp/mountpoint_test.go
new file mode 100644
index 0000000000..9551713594
--- /dev/null
+++ b/weed/mount/winfsp/mountpoint_test.go
@@ -0,0 +1,37 @@
+package winfsp
+
+import "testing"
+
+func TestVolumePrefix(t *testing.T) {
+	tests := []struct {
+		name       string
+		mountPoint string
+		prefix     string
+		wantErr    bool
+	}{
+		{name: "drive letter", mountPoint: `S:`, prefix: ""},
+		{name: "directory", mountPoint: `C:\mnt\weed`, prefix: ""},
+		{name: "relative directory", mountPoint: `mnt\weed`, prefix: ""},
+		{name: "unc", mountPoint: `\\seaweedfs\share`, prefix: `\seaweedfs\share`},
+		{name: "unc trailing separator", mountPoint: `\\seaweedfs\share\`, prefix: `\seaweedfs\share`},
+		{name: "unc forward slashes", mountPoint: `//seaweedfs/share`, prefix: `\seaweedfs\share`},
+		{name: "unc dotted server", mountPoint: `\\fs.example.com\share`, prefix: `\fs.example.com\share`},
+		{name: "mountmgr drive", mountPoint: `\\.\S:`, prefix: ""},
+		{name: "extended drive", mountPoint: `\\?\S:`, prefix: ""},
+		{name: "server only", mountPoint: `\\seaweedfs`, wantErr: true},
+		{name: "too deep", mountPoint: `\\seaweedfs\share\dir`, wantErr: true},
+		{name: "empty server", mountPoint: `\\\share`, wantErr: true},
+		{name: "empty share", mountPoint: `\\seaweedfs\\`, wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prefix, err := VolumePrefix(tt.mountPoint)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("VolumePrefix(%q) error = %v, wantErr %v", tt.mountPoint, err, tt.wantErr)
+			}
+			if prefix != tt.prefix {
+				t.Fatalf("VolumePrefix(%q) = %q, want %q", tt.mountPoint, prefix, tt.prefix)
+			}
+		})
+	}
+}
diff --git a/weed/mount/winfsp/notify_windows.go b/weed/mount/winfsp/notify_windows.go
index 5be83c373b..eab22fff05 100644
--- a/weed/mount/winfsp/notify_windows.go
+++ b/weed/mount/winfsp/notify_windows.go
@@ -14,11 +14,13 @@ import (
 // stays invisible until the user refreshes by hand.
 type notifier struct {
 	host      *cgofuse.FileSystemHost
+	fs        *WinFS
 	mountRoot util.FullPath
 }
 
 // notify reports one applied event. Windows wants the path relative to the
-// mount, and an action describing what happened to it.
+// mount, and an action describing what happened to it; the adapter's own path
+// cache is out of date for the same path.
 func (n *notifier) notify(invalidation meta_cache.EntryInvalidation) {
 	if n.host == nil {
 		return
@@ -27,6 +29,8 @@ func (n *notifier) notify(invalidation meta_cache.EntryInvalidation) {
 	// describing the new, so reporting RenamedTo here as well would send the
 	// destination twice — and as a create even when a directory moved.
 	if path, ok := relativeToMount(n.mountRoot, invalidation.Path); ok {
+		isDirectory := invalidation.WasDirectory || invalidation.Entry.GetIsDirectory()
+		n.fs.invalidatePath(path, isDirectory)
 		n.send(path, n.action(invalidation))
 	}
 }
diff --git a/weed/mount/winfsp/pathcache.go b/weed/mount/winfsp/pathcache.go
new file mode 100644
index 0000000000..5c1771c142
--- /dev/null
+++ b/weed/mount/winfsp/pathcache.go
@@ -0,0 +1,233 @@
+package winfsp
+
+import (
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+)
+
+// pathCache stands in for the dentry and attribute caches the kernel provides
+// on the unix mounts. WinFsp addresses every operation by path, so without it
+// each operation walks the whole path through Lookup again, and in a directory
+// the filer has not listed yet every one of those lookups is a filer round
+// trip.
+//
+// The cache owns one lookup reference per entry, the way the kernel holds one
+// until it sends FORGET. An evicted reference sits out one sweep in the
+// graveyard before it is returned, so an operation that resolved just before
+// the eviction is not left holding a reclaimed inode.
+type pathCache struct {
+	ttl    time.Duration
+	forget func(inode uint64)
+
+	mu      sync.Mutex
+	entries map[string]*pathCacheEntry
+	// Two graveyard generations: an appended reference always survives the
+	// sweep of the call that appended it, so a caller still using the inode -
+	// a walk mid-resolution, an operation that looked it up just before - is
+	// never holding a reference the same call just returned.
+	graveyard     []uint64
+	prevGraveyard []uint64
+	lastSweep     time.Time
+	// gen counts purges. A resolve holds no lock across its Lookup RPC, so a
+	// purge can run between the RPC and the insert; the insert then carries
+	// exactly the name the purge removed and has to be discarded. The recent
+	// purges are kept by key so only a purge that covers the inserted name
+	// discards it: unrelated churn must not starve resolveAndSteal into EIO.
+	gen          uint64
+	recentPurges []purgeRecord
+}
+
+type purgeRecord struct {
+	key    string
+	prefix bool
+}
+
+// maxRecentPurges bounds the purges remembered for the covers check. A resolve
+// older than the window is discarded without one, which only costs a retry.
+const maxRecentPurges = 128
+
+func (r purgeRecord) covers(key string) bool {
+	if r.key == key {
+		return true
+	}
+	if !r.prefix {
+		return false
+	}
+	// An empty key with prefix is the whole cache: purge clears every entry
+	// for it, so it has to cover every in-flight insert too.
+	return r.key == "" || strings.HasPrefix(key, r.key+"/")
+}
+
+// purgedSince reports whether any purge after gen covers key.
+func (c *pathCache) purgedSince(gen uint64, key string) bool {
+	dropped := c.gen - gen
+	if dropped == 0 {
+		return false
+	}
+	if dropped > uint64(len(c.recentPurges)) {
+		return true
+	}
+	for _, r := range c.recentPurges[uint64(len(c.recentPurges))-dropped:] {
+		if r.covers(key) {
+			return true
+		}
+	}
+	return false
+}
+
+type pathCacheEntry struct {
+	inode   uint64
+	attr    fuse.Attr
+	expires time.Time
+}
+
+// maxCachedPaths bounds the references parked here. Overflow clears the whole
+// cache rather than tracking recency: entries expire within ttl anyway, so
+// exact eviction order buys nothing.
+const maxCachedPaths = 64 << 10
+
+func newPathCache(ttl time.Duration, forget func(inode uint64)) *pathCache {
+	return &pathCache{
+		ttl:       ttl,
+		forget:    forget,
+		entries:   map[string]*pathCacheEntry{},
+		lastSweep: time.Now(),
+	}
+}
+
+// cacheKey canonicalises a WinFsp path. The root maps to "", which is never
+// cached: its inode is fixed and holds no reference.
+func cacheKey(path string) string {
+	return strings.Join(splitPath(path), "/")
+}
+
+// lookup reports the cached inode and attributes for key. The entry stays in
+// the cache; the inode remains valid at least one sweep past its expiry.
+func (c *pathCache) lookup(key string) (inode uint64, attr fuse.Attr, ok bool) {
+	if key == "" {
+		return 0, fuse.Attr{}, false
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	entry, found := c.entries[key]
+	if !found || time.Now().After(entry.expires) {
+		return 0, fuse.Attr{}, false
+	}
+	return entry.inode, entry.attr, true
+}
+
+// snapshot returns the purge generation. A caller about to resolve outside
+// the lock passes it back to insert, which discards the entry if any purge ran
+// in between.
+func (c *pathCache) snapshot() uint64 {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.gen
+}
+
+// insert takes ownership of one lookup reference on inode, in every outcome:
+// an entry a covering purge outdated goes to the graveyard instead of the map,
+// so the caller may keep using the inode for at least one sweep either way.
+func (c *pathCache) insert(key string, inode uint64, attr fuse.Attr, gen uint64) {
+	if key == "" {
+		c.forget(inode)
+		return
+	}
+	var pending []uint64
+	c.mu.Lock()
+	if c.purgedSince(gen, key) {
+		c.graveyard = append(c.graveyard, inode)
+		pending = c.sweepLocked()
+		c.mu.Unlock()
+		c.forgetAll(pending)
+		return
+	}
+	if existing, found := c.entries[key]; found {
+		c.graveyard = append(c.graveyard, existing.inode)
+	} else if len(c.entries) >= maxCachedPaths {
+		for _, entry := range c.entries {
+			c.graveyard = append(c.graveyard, entry.inode)
+		}
+		c.entries = map[string]*pathCacheEntry{}
+	}
+	c.entries[key] = &pathCacheEntry{inode: inode, attr: attr, expires: time.Now().Add(c.ttl)}
+	pending = c.sweepLocked()
+	c.mu.Unlock()
+	c.forgetAll(pending)
+}
+
+// steal removes key and hands its reference to the caller.
+func (c *pathCache) steal(key string) (inode uint64, ok bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	entry, found := c.entries[key]
+	if !found {
+		return 0, false
+	}
+	delete(c.entries, key)
+	return entry.inode, true
+}
+
+// purge drops key, and everything under it when prefix is set, which a rename
+// or removal of a directory needs: the children's cached paths name entries
+// that are no longer there.
+func (c *pathCache) purge(key string, prefix bool) {
+	var pending []uint64
+	c.mu.Lock()
+	// Recorded even when the map holds nothing: the point is as much the
+	// in-flight resolve about to insert this very name.
+	c.gen++
+	c.recentPurges = append(c.recentPurges, purgeRecord{key: key, prefix: prefix})
+	if len(c.recentPurges) > maxRecentPurges {
+		c.recentPurges = append(c.recentPurges[:0], c.recentPurges[len(c.recentPurges)-maxRecentPurges:]...)
+	}
+	if entry, found := c.entries[key]; found {
+		c.graveyard = append(c.graveyard, entry.inode)
+		delete(c.entries, key)
+	}
+	if prefix {
+		under := key + "/"
+		for k, entry := range c.entries {
+			if key == "" || strings.HasPrefix(k, under) {
+				c.graveyard = append(c.graveyard, entry.inode)
+				delete(c.entries, k)
+			}
+		}
+	}
+	pending = c.sweepLocked()
+	c.mu.Unlock()
+	c.forgetAll(pending)
+}
+
+// sweepLocked returns the generation before last for the caller to forget
+// outside the lock, and retires the current one. Sweeps run at most once per
+// ttl and an appended reference sits out the sweep of its own call, so every
+// reference rests for at least one full ttl after its last possible use.
+func (c *pathCache) sweepLocked() []uint64 {
+	now := time.Now()
+	if now.Sub(c.lastSweep) < c.ttl {
+		return nil
+	}
+	c.lastSweep = now
+	pending := c.prevGraveyard
+	c.prevGraveyard = c.graveyard
+	c.graveyard = nil
+	for key, entry := range c.entries {
+		if now.After(entry.expires) {
+			// Returned by the next sweep, a full ttl away: served from the map
+			// until a moment ago, so someone may still be holding it.
+			c.prevGraveyard = append(c.prevGraveyard, entry.inode)
+			delete(c.entries, key)
+		}
+	}
+	return pending
+}
+
+func (c *pathCache) forgetAll(inodes []uint64) {
+	for _, inode := range inodes {
+		c.forget(inode)
+	}
+}
diff --git a/weed/mount/winfsp/pathcache_test.go b/weed/mount/winfsp/pathcache_test.go
new file mode 100644
index 0000000000..e911228350
--- /dev/null
+++ b/weed/mount/winfsp/pathcache_test.go
@@ -0,0 +1,269 @@
+package winfsp
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/go-fuse/v2/fuse"
+)
+
+type forgetRecorder struct {
+	mu     sync.Mutex
+	inodes []uint64
+}
+
+func (r *forgetRecorder) forget(inode uint64) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.inodes = append(r.inodes, inode)
+}
+
+func (r *forgetRecorder) forgotten() []uint64 {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return append([]uint64(nil), r.inodes...)
+}
+
+func TestPathCacheLookupAndExpiry(t *testing.T) {
+	rec := &forgetRecorder{}
+	c := newPathCache(20*time.Millisecond, rec.forget)
+
+	c.insert("a/b", 7, fuse.Attr{Ino: 7, Size: 42}, c.snapshot())
+	inode, attr, ok := c.lookup("a/b")
+	if !ok || inode != 7 || attr.Size != 42 {
+		t.Fatalf("lookup = %d %v %v, want 7 size 42 true", inode, attr.Size, ok)
+	}
+
+	time.Sleep(30 * time.Millisecond)
+	if _, _, ok := c.lookup("a/b"); ok {
+		t.Fatal("expired entry still served")
+	}
+	// The reference survives at least one sweep past expiry before it is
+	// forgotten: one insert moves it to the graveyard, the next returns it.
+	c.insert("x", 8, fuse.Attr{}, c.snapshot())
+	time.Sleep(30 * time.Millisecond)
+	c.insert("y", 9, fuse.Attr{}, c.snapshot())
+	found := false
+	for _, inode := range rec.forgotten() {
+		if inode == 7 {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expired reference never forgotten; forgot %v", rec.forgotten())
+	}
+}
+
+func TestPathCacheStealTransfersOwnership(t *testing.T) {
+	rec := &forgetRecorder{}
+	c := newPathCache(20*time.Millisecond, rec.forget)
+
+	c.insert("a", 5, fuse.Attr{}, c.snapshot())
+	inode, ok := c.steal("a")
+	if !ok || inode != 5 {
+		t.Fatalf("steal = %d %v, want 5 true", inode, ok)
+	}
+	if _, ok := c.steal("a"); ok {
+		t.Fatal("second steal succeeded")
+	}
+	// Drive several sweeps; the stolen reference must never be forgotten.
+	for i := 0; i < 4; i++ {
+		time.Sleep(25 * time.Millisecond)
+		c.insert("churn", uint64(100+i), fuse.Attr{}, c.snapshot())
+	}
+	for _, inode := range rec.forgotten() {
+		if inode == 5 {
+			t.Fatal("stolen reference was forgotten by the cache")
+		}
+	}
+}
+
+func TestPathCacheReplaceReturnsOldReference(t *testing.T) {
+	rec := &forgetRecorder{}
+	c := newPathCache(20*time.Millisecond, rec.forget)
+
+	c.insert("a", 5, fuse.Attr{}, c.snapshot())
+	c.insert("a", 6, fuse.Attr{}, c.snapshot())
+	if inode, _, ok := c.lookup("a"); !ok || inode != 6 {
+		t.Fatalf("lookup after replace = %d %v, want 6 true", inode, ok)
+	}
+	for i := 0; i < 3; i++ {
+		time.Sleep(25 * time.Millisecond)
+		c.insert("churn", uint64(100+i), fuse.Attr{}, c.snapshot())
+	}
+	found := false
+	for _, inode := range rec.forgotten() {
+		if inode == 5 {
+			found = true
+		}
+		if inode == 6 && !found {
+			t.Fatal("live reference forgotten before the replaced one")
+		}
+	}
+	if !found {
+		t.Fatalf("replaced reference never forgotten; forgot %v", rec.forgotten())
+	}
+}
+
+func TestPathCachePurgePrefix(t *testing.T) {
+	rec := &forgetRecorder{}
+	c := newPathCache(time.Minute, rec.forget)
+
+	c.insert("dir", 2, fuse.Attr{}, c.snapshot())
+	c.insert("dir/a", 3, fuse.Attr{}, c.snapshot())
+	c.insert("dir/a/b", 4, fuse.Attr{}, c.snapshot())
+	c.insert("dirt", 5, fuse.Attr{}, c.snapshot())
+
+	c.purge("dir", true)
+	if _, _, ok := c.lookup("dir"); ok {
+		t.Fatal("purged key still cached")
+	}
+	if _, _, ok := c.lookup("dir/a/b"); ok {
+		t.Fatal("purged subtree still cached")
+	}
+	// A sibling that only shares the name as a string prefix stays.
+	if _, _, ok := c.lookup("dirt"); !ok {
+		t.Fatal("sibling was purged with the subtree")
+	}
+}
+
+func TestPathCacheRootNeverCached(t *testing.T) {
+	rec := &forgetRecorder{}
+	c := newPathCache(time.Minute, rec.forget)
+
+	c.insert("", 9, fuse.Attr{}, c.snapshot())
+	if _, _, ok := c.lookup(""); ok {
+		t.Fatal("root was cached")
+	}
+	if got := rec.forgotten(); len(got) != 1 || got[0] != 9 {
+		t.Fatalf("root reference not returned immediately: %v", got)
+	}
+}
+
+func TestCacheKey(t *testing.T) {
+	for path, want := range map[string]string{
+		`/a/b`:   "a/b",
+		`\a\b`:   "a/b",
+		`a//b/`:  "a/b",
+		`/`:      "",
+		``:       "",
+		`/a/./b`: "a/b",
+	} {
+		if got := cacheKey(path); got != want {
+			t.Errorf("cacheKey(%q) = %q, want %q", path, got, want)
+		}
+	}
+}
+
+// A resolve runs its Lookup outside the cache lock, so a purge can land
+// between the RPC and the insert. An insert a purge covered must then be
+// discarded: it carries exactly the name the purge removed, and caching it
+// would serve a deleted entry for a full ttl. This is how a rename's source
+// briefly came back from the dead on the Windows mount.
+func TestPathCacheInsertAfterCoveringPurgeIsDiscarded(t *testing.T) {
+	c := newPathCache(time.Minute, func(uint64) {})
+
+	gen := c.snapshot()
+	c.purge("dir/src", false)
+	c.insert("dir/src", 42, fuse.Attr{}, gen)
+
+	if _, _, ok := c.lookup("dir/src"); ok {
+		t.Fatal("purged name served from an insert that started before the purge")
+	}
+}
+
+// A purge of a directory covers the resolves in flight under it.
+func TestPathCacheInsertUnderPurgedPrefixIsDiscarded(t *testing.T) {
+	c := newPathCache(time.Minute, func(uint64) {})
+
+	gen := c.snapshot()
+	c.purge("dir", true)
+	c.insert("dir/child", 7, fuse.Attr{}, gen)
+
+	if _, _, ok := c.lookup("dir/child"); ok {
+		t.Fatal("purged prefix served a child from a stale insert")
+	}
+}
+
+// A purge of something else entirely must not discard the insert: an open
+// retries resolve-then-steal only a few times before giving up with EIO, so
+// unrelated churn starving every insert would fail opens of untouched paths.
+func TestPathCacheUnrelatedPurgeDoesNotDiscard(t *testing.T) {
+	c := newPathCache(time.Minute, func(uint64) {})
+
+	gen := c.snapshot()
+	c.purge("elsewhere", true)
+	c.purge("dir/srcling", false)
+	c.insert("dir/src", 9, fuse.Attr{Size: 11}, gen)
+
+	inode, attr, ok := c.lookup("dir/src")
+	if !ok || inode != 9 || attr.Size != 11 {
+		t.Fatalf("lookup = %d,%d,%v, want the inserted entry", inode, attr.Size, ok)
+	}
+}
+
+// Purges beyond the remembered window cannot be checked by key, so the insert
+// is discarded rather than trusted.
+func TestPathCacheInsertOlderThanPurgeWindowIsDiscarded(t *testing.T) {
+	c := newPathCache(time.Minute, func(uint64) {})
+
+	gen := c.snapshot()
+	for i := 0; i <= maxRecentPurges; i++ {
+		c.purge(fmt.Sprintf("unrelated/%d", i), false)
+	}
+	c.insert("dir/src", 3, fuse.Attr{}, gen)
+
+	if _, _, ok := c.lookup("dir/src"); ok {
+		t.Fatal("insert older than the purge window was trusted")
+	}
+}
+
+// The discarded insert still owns a lookup reference, which has to come back
+// through the graveyard rather than leak - and not in the same call: the
+// walker is still using the inode.
+func TestPathCacheDiscardedInsertRestsBeforeForget(t *testing.T) {
+	rec := &forgetRecorder{}
+	c := newPathCache(10*time.Millisecond, rec.forget)
+
+	gen := c.snapshot()
+	c.purge("dir/src", false)
+	// Make a sweep due, so the discarding insert itself sweeps: the reference
+	// it just parked must not come back out of that same call.
+	time.Sleep(15 * time.Millisecond)
+	c.insert("dir/src", 42, fuse.Attr{}, gen)
+	for _, inode := range rec.forgotten() {
+		if inode == 42 {
+			t.Fatal("discarded insert forgotten in the same call; the walker still holds it")
+		}
+	}
+
+	for i := 0; i < 3; i++ {
+		time.Sleep(15 * time.Millisecond)
+		c.purge("churn", false)
+	}
+	found := false
+	for _, inode := range rec.forgotten() {
+		if inode == 42 {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("discarded insert leaked its lookup reference; forgot %v", rec.forgotten())
+	}
+}
+
+// A purge of the whole cache - the root, prefix set - covers every in-flight
+// insert, exactly as it removed every entry.
+func TestPathCacheRootPurgeCoversEveryInsert(t *testing.T) {
+	c := newPathCache(time.Minute, func(uint64) {})
+
+	gen := c.snapshot()
+	c.purge("", true)
+	c.insert("dir/src", 42, fuse.Attr{}, gen)
+
+	if _, _, ok := c.lookup("dir/src"); ok {
+		t.Fatal("root purge did not cover an in-flight insert")
+	}
+}
diff --git a/weed/mount/winfsp/xattr_windows.go b/weed/mount/winfsp/xattr_windows.go
index f25043844b..2bdd54fb48 100644
--- a/weed/mount/winfsp/xattr_windows.go
+++ b/weed/mount/winfsp/xattr_windows.go
@@ -12,11 +12,10 @@ import (
 const xattrBufferSize = 64 * 1024
 
 func (w *WinFS) Getxattr(path string, name string) (int, []byte) {
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolve(path)
 	if status != fuse.OK {
 		return toErrno(status), nil
 	}
-	defer ref.release()
 
 	dest := make([]byte, xattrBufferSize)
 	size, status := w.wfs.GetXAttr(never, ptr(w.caller(inode)), name, dest)
@@ -30,11 +29,10 @@ func (w *WinFS) Setxattr(path string, name string, value []byte, flags int) int
 	if w.denied() {
 		return -eROFS
 	}
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolve(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
 
 	// cgofuse and the raw filesystem number XATTR_CREATE and XATTR_REPLACE the
 	// same, so the flags pass straight through; TestXattrFlagValues pins that.
@@ -48,20 +46,18 @@ func (w *WinFS) Removexattr(path string, name string) int {
 	if w.denied() {
 		return -eROFS
 	}
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolve(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
 	return toErrno(w.wfs.RemoveXAttr(never, ptr(w.caller(inode)), name))
 }
 
 func (w *WinFS) Listxattr(path string, fill func(name string) bool) int {
-	inode, ref, status := w.resolve(path)
+	inode, status := w.resolve(path)
 	if status != fuse.OK {
 		return toErrno(status)
 	}
-	defer ref.release()
 
 	dest := make([]byte, xattrBufferSize)
 	size, status := w.wfs.ListXAttr(never, ptr(w.caller(inode)), dest)
diff --git a/weed/mq/broker/broker_server.go b/weed/mq/broker/broker_server.go
index a3e658c35e..e9b3676172 100644
--- a/weed/mq/broker/broker_server.go
+++ b/weed/mq/broker/broker_server.go
@@ -125,7 +125,10 @@ func NewMessageBroker(option *MessageQueueBrokerOption, grpcDialOption grpc.Dial
 	)
 	glog.V(0).Info("Started idle partition cleanup task (check: 1m, timeout: 5m)")
 
-	existingNodes := cluster.ListExistingPeerUpdates(mqBroker.MasterClient.GetMaster(context.Background()), grpcDialOption, option.FilerGroup, cluster.FilerType)
+	existingNodes, listErr := cluster.ListExistingPeerUpdates(context.Background(), mqBroker.MasterClient.GetMaster(context.Background()), grpcDialOption, option.FilerGroup, cluster.FilerType)
+	if listErr != nil {
+		glog.Warningf("broker failed to list existing peers: %v", listErr)
+	}
 	for _, newNode := range existingNodes {
 		mqBroker.OnBrokerUpdate(newNode, time.Now())
 	}
diff --git a/weed/mq/broker/broker_write.go b/weed/mq/broker/broker_write.go
index 8c4b42daed..9fd8019b50 100644
--- a/weed/mq/broker/broker_write.go
+++ b/weed/mq/broker/broker_write.go
@@ -13,6 +13,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
 func (b *MessageQueueBroker) appendToFile(targetFile string, data []byte) error {
@@ -167,7 +168,7 @@ func (b *MessageQueueBroker) assignAndUpload(targetFile string, data []byte) (fi
 	if b.option.VolumeServerAccess == "filerProxy" {
 		// b.currentFiler can change on failover, so read it per attempt.
 		uploadOption.GenUploadUrl = func(host, fileId string) string {
-			return fmt.Sprintf("http://%s/?proxyChunkId=%s", b.currentFiler, fileId)
+			return util_http.ProxyChunkUrl(string(b.currentFiler), fileId)
 		}
 	}
 
diff --git a/weed/mq/kafka/consumer_offset/filer_storage.go b/weed/mq/kafka/consumer_offset/filer_storage.go
index 9679826834..19735d0f46 100644
--- a/weed/mq/kafka/consumer_offset/filer_storage.go
+++ b/weed/mq/kafka/consumer_offset/filer_storage.go
@@ -296,13 +296,6 @@ func (f *FilerStorage) deleteDirectory(path string) error {
 	dir, name := fullPath.DirAndName()
 
 	return f.fca.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		_, err := client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
-			Directory:            dir,
-			Name:                 name,
-			IsDeleteData:         true,
-			IsRecursive:          true,
-			IgnoreRecursiveError: true,
-		})
-		return err
+		return filer_pb.DoRemove(context.Background(), client, dir, name, true, true, true, false, nil)
 	})
 }
diff --git a/weed/mq/kafka/gateway/coordinator_registry.go b/weed/mq/kafka/gateway/coordinator_registry.go
index 152157463a..278279b70d 100644
--- a/weed/mq/kafka/gateway/coordinator_registry.go
+++ b/weed/mq/kafka/gateway/coordinator_registry.go
@@ -751,12 +751,7 @@ func (cr *CoordinatorRegistry) deleteCoordinatorAssignment(consumerGroup string)
 		fileName := fmt.Sprintf("%s_assignments.json", consumerGroup)
 		filePath := fmt.Sprintf("%s/%s", CoordinatorAssignmentsDir, fileName)
 
-		_, err := client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
-			Directory: CoordinatorAssignmentsDir,
-			Name:      fileName,
-		})
-
-		if err != nil {
+		if err := filer_pb.DoRemove(context.Background(), client, CoordinatorAssignmentsDir, fileName, false, false, false, false, nil); err != nil {
 			return fmt.Errorf("failed to delete assignment file %s: %w", filePath, err)
 		}
 
diff --git a/weed/mq/kafka/integration/broker_client.go b/weed/mq/kafka/integration/broker_client.go
index 3c3482c86e..428cfdffef 100644
--- a/weed/mq/kafka/integration/broker_client.go
+++ b/weed/mq/kafka/integration/broker_client.go
@@ -22,9 +22,8 @@ import (
 )
 
 const (
-	brokerHealthCheckTimeout  = 5 * time.Second
-	brokerHealthCheckAttempts = 3
-	brokerHealthCheckBackoff  = 250 * time.Millisecond
+	brokerHealthCheckTimeout = 5 * time.Second
+	brokerHealthCheckBackoff = 250 * time.Millisecond
 )
 
 // NewBrokerClientWithFilerAccessor creates a client with a shared filer accessor
@@ -102,14 +101,17 @@ func (bc *BrokerClient) Close() error {
 	return bc.conn.Close()
 }
 
-// HealthCheck verifies the broker connection is working
+// HealthCheck verifies the broker connection is working. A freshly announced
+// broker may still be acquiring its balancer lock, so keep retrying for the
+// same window cluster discovery waits out.
 func (bc *BrokerClient) HealthCheck() error {
 	if bc.client == nil {
 		return fmt.Errorf("broker client not connected")
 	}
 
+	deadline := time.Now().Add(clusterNodeDiscoveryTimeout)
 	var lastErr error
-	for attempt := 1; attempt <= brokerHealthCheckAttempts; attempt++ {
+	for attempt := 1; ; attempt++ {
 		ctx, cancel := context.WithTimeout(bc.ctx, brokerHealthCheckTimeout)
 		_, err := bc.client.FindBrokerLeader(ctx, &mq_pb.FindBrokerLeaderRequest{})
 		cancel()
@@ -117,17 +119,18 @@ func (bc *BrokerClient) HealthCheck() error {
 			return nil
 		}
 		lastErr = err
-		if attempt == brokerHealthCheckAttempts {
+		if !time.Now().Before(deadline) {
 			break
 		}
+		backoff := min(time.Duration(attempt)*brokerHealthCheckBackoff, time.Second)
 		select {
 		case <-bc.ctx.Done():
 			return bc.ctx.Err()
-		case <-time.After(time.Duration(attempt) * brokerHealthCheckBackoff):
+		case <-time.After(backoff):
 		}
 	}
 
-	return fmt.Errorf("broker health check failed after %d attempts: %v", brokerHealthCheckAttempts, lastErr)
+	return fmt.Errorf("broker health check failed after %v: %v", clusterNodeDiscoveryTimeout, lastErr)
 }
 
 // GetPartitionRangeInfo gets comprehensive range information from SeaweedMQ broker's native range manager
diff --git a/weed/mq/kafka/integration/broker_client_test.go b/weed/mq/kafka/integration/broker_client_test.go
new file mode 100644
index 0000000000..efcb8c9153
--- /dev/null
+++ b/weed/mq/kafka/integration/broker_client_test.go
@@ -0,0 +1,46 @@
+package integration
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/mq_pb"
+)
+
+type stubMessagingClient struct {
+	mq_pb.SeaweedMessagingClient
+	calls   int
+	failFor int
+	err     error
+}
+
+func (s *stubMessagingClient) FindBrokerLeader(ctx context.Context, in *mq_pb.FindBrokerLeaderRequest, opts ...grpc.CallOption) (*mq_pb.FindBrokerLeaderResponse, error) {
+	s.calls++
+	if s.calls <= s.failFor {
+		return nil, s.err
+	}
+	return &mq_pb.FindBrokerLeaderResponse{}, nil
+}
+
+func TestHealthCheckRetriesPastTransientBrokerErrors(t *testing.T) {
+	stub := &stubMessagingClient{failFor: 2, err: errors.New("lock broker_balancer not found")}
+	bc := &BrokerClient{ctx: context.Background(), client: stub}
+	if err := bc.HealthCheck(); err != nil || stub.calls != 3 {
+		t.Fatalf("err %v after %d calls, want success on the 3rd", err, stub.calls)
+	}
+}
+
+func TestHealthCheckGivesUpAtDeadline(t *testing.T) {
+	defer func(orig time.Duration) { clusterNodeDiscoveryTimeout = orig }(clusterNodeDiscoveryTimeout)
+	clusterNodeDiscoveryTimeout = 300 * time.Millisecond
+
+	stub := &stubMessagingClient{failFor: 1 << 30, err: errors.New("lock broker_balancer not found")}
+	bc := &BrokerClient{ctx: context.Background(), client: stub}
+	if err := bc.HealthCheck(); err == nil || stub.calls < 2 {
+		t.Fatalf("err %v after %d calls, want repeated retries then an error", err, stub.calls)
+	}
+}
diff --git a/weed/mq/kafka/integration/seaweedmq_handler_utils.go b/weed/mq/kafka/integration/seaweedmq_handler_utils.go
index 843b722803..e17cf4eb69 100644
--- a/weed/mq/kafka/integration/seaweedmq_handler_utils.go
+++ b/weed/mq/kafka/integration/seaweedmq_handler_utils.go
@@ -52,21 +52,23 @@ func NewSeaweedMQBrokerHandler(masters string, filerGroup string, clientHost str
 	time.Sleep(2 * time.Second)
 	glog.V(1).Infof("Initial connection delay completed")
 
-	// Discover brokers from masters using master client
+	// Discover brokers and filers from masters using master client. A fresh
+	// node registers only after its announce delay (a filer also waits out its
+	// empty-membership confirm window), so an empty list right after startup
+	// is normal: wait rather than fail fast.
 	glog.V(1).Infof("About to call discoverBrokersWithMasterClient...")
-	brokerAddresses, err := discoverBrokersWithMasterClient(masterClient, filerGroup)
+	brokerAddresses, err := waitForClusterNodes(ctx, "brokers", clusterNodeDiscoveryTimeout, func() ([]string, error) {
+		return discoverBrokersWithMasterClient(ctx, masterClient, filerGroup)
+	})
 	if err != nil {
 		glog.Errorf("Broker discovery failed: %v", err)
 		return nil, fmt.Errorf("failed to discover brokers: %v", err)
 	}
 	glog.V(1).Infof("Broker discovery returned: %v", brokerAddresses)
 
-	if len(brokerAddresses) == 0 {
-		return nil, fmt.Errorf("no brokers discovered from masters")
-	}
-
-	// Discover filers from masters using master client
-	filerAddresses, err := discoverFilersWithMasterClient(masterClient, filerGroup)
+	filerAddresses, err := waitForClusterNodes(ctx, "filers", clusterNodeDiscoveryTimeout, func() ([]pb.ServerAddress, error) {
+		return discoverFilersWithMasterClient(ctx, masterClient, filerGroup)
+	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to discover filers: %v", err)
 	}
@@ -107,12 +109,12 @@ func NewSeaweedMQBrokerHandler(masters string, filerGroup string, clientHost str
 }
 
 // discoverBrokersWithMasterClient queries masters for available brokers using reusable master client
-func discoverBrokersWithMasterClient(masterClient *wdclient.MasterClient, filerGroup string) ([]string, error) {
+func discoverBrokersWithMasterClient(ctx context.Context, masterClient *wdclient.MasterClient, filerGroup string) ([]string, error) {
 	var brokers []string
 
-	err := masterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err := masterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
 		glog.V(1).Infof("Inside MasterClient.WithClient callback - client obtained successfully")
-		resp, err := client.ListClusterNodes(context.Background(), &master_pb.ListClusterNodesRequest{
+		resp, err := client.ListClusterNodes(ctx, &master_pb.ListClusterNodesRequest{
 			ClientType: cluster.BrokerType,
 			FilerGroup: filerGroup,
 			Limit:      1000,
@@ -143,12 +145,36 @@ func discoverBrokersWithMasterClient(masterClient *wdclient.MasterClient, filerG
 	return brokers, err
 }
 
-// discoverFilersWithMasterClient queries masters for available filers using reusable master client
-func discoverFilersWithMasterClient(masterClient *wdclient.MasterClient, filerGroup string) ([]pb.ServerAddress, error) {
+// clusterNodeDiscoveryTimeout bounds how long the gateway waits for the
+// masters to list a node; well above a fresh node's announce delay.
+var clusterNodeDiscoveryTimeout = 60 * time.Second
+
+// waitForClusterNodes calls discover until it returns at least one node, an
+// error, or timeout passes, retrying once a second while the list is empty.
+func waitForClusterNodes[T any](ctx context.Context, nodeType string, timeout time.Duration, discover func() ([]T, error)) ([]T, error) {
+	deadline := time.Now().Add(timeout)
+	for {
+		nodes, err := discover()
+		if err != nil || len(nodes) > 0 {
+			return nodes, err
+		}
+		if !time.Now().Before(deadline) {
+			return nil, fmt.Errorf("no %s registered with the masters after %v", nodeType, timeout)
+		}
+		glog.V(1).Infof("no %s registered with the masters yet; retrying", nodeType)
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-time.After(time.Second):
+		}
+	}
+}
+
+func discoverFilersWithMasterClient(ctx context.Context, masterClient *wdclient.MasterClient, filerGroup string) ([]pb.ServerAddress, error) {
 	var filers []pb.ServerAddress
 
-	err := masterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-		resp, err := client.ListClusterNodes(context.Background(), &master_pb.ListClusterNodesRequest{
+	err := masterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+		resp, err := client.ListClusterNodes(ctx, &master_pb.ListClusterNodesRequest{
 			ClientType: cluster.FilerType,
 			FilerGroup: filerGroup,
 			Limit:      1000,
diff --git a/weed/mq/kafka/integration/seaweedmq_handler_utils_wait_test.go b/weed/mq/kafka/integration/seaweedmq_handler_utils_wait_test.go
new file mode 100644
index 0000000000..ac3c03115c
--- /dev/null
+++ b/weed/mq/kafka/integration/seaweedmq_handler_utils_wait_test.go
@@ -0,0 +1,38 @@
+package integration
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+)
+
+// A fresh filer is listed by the masters only after its announce delay, so an
+// empty list must be waited out, not handed to the filer client accessor
+// (which panics on it).
+func TestWaitForFilersWaitsOutEmptyListing(t *testing.T) {
+	calls := 0
+	filers, err := waitForClusterNodes(context.Background(), "filers", 10*time.Second, func() ([]pb.ServerAddress, error) {
+		calls++
+		if calls < 3 {
+			return nil, nil
+		}
+		return []pb.ServerAddress{"filer:8888"}, nil
+	})
+	if err != nil || len(filers) != 1 || calls != 3 {
+		t.Fatalf("filers %v err %v after %d calls, want 1 filer after 3", filers, err, calls)
+	}
+}
+
+func TestWaitForFilersGivesUpWithAnError(t *testing.T) {
+	filers, err := waitForClusterNodes(context.Background(), "filers", 1500*time.Millisecond, func() ([]pb.ServerAddress, error) { return nil, nil })
+	if err == nil || len(filers) != 0 {
+		t.Fatalf("still empty: filers %v err %v, want an error", filers, err)
+	}
+	boom := errors.New("master down")
+	if _, err := waitForClusterNodes(context.Background(), "filers", time.Minute, func() ([]pb.ServerAddress, error) { return nil, boom }); !errors.Is(err, boom) {
+		t.Fatalf("discovery error: got %v, want it returned at once", err)
+	}
+}
diff --git a/weed/mq/logstore/read_parquet_to_log.go b/weed/mq/logstore/read_parquet_to_log.go
index 87366d4649..68d654112b 100644
--- a/weed/mq/logstore/read_parquet_to_log.go
+++ b/weed/mq/logstore/read_parquet_to_log.go
@@ -98,7 +98,10 @@ func GenParquetReadFunc(filerClient filer_pb.FilerClient, t topic.Topic, p topic
 	eachFileFn := func(entry *filer_pb.Entry, eachLogEntryFn log_buffer.EachLogEntryFuncType, starTsNs, stopTsNs int64) (processedTsNs int64, err error) {
 		// create readerAt for the parquet file
 		fileSize := filer.FileSize(entry)
-		visibleIntervals, _ := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, entry.Chunks, 0, int64(fileSize))
+		visibleIntervals, err := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, entry.Chunks, 0, int64(fileSize))
+		if err != nil {
+			return 0, fmt.Errorf("resolve chunks of %s: %w", entry.Name, err)
+		}
 		chunkViews := filer.ViewFromVisibleIntervals(visibleIntervals, 0, int64(fileSize))
 		readerCache := filer.NewReaderCache(32, chunkCache, lookupFileIdFn, nil)
 		readerAt := filer.NewChunkReaderAtFromClient(context.Background(), readerCache, chunkViews, int64(fileSize), filer.DefaultPrefetchCount)
diff --git a/weed/mq/topic/local_manager.go b/weed/mq/topic/local_manager.go
index bc33fdab07..89a2ac8c14 100644
--- a/weed/mq/topic/local_manager.go
+++ b/weed/mq/topic/local_manager.go
@@ -52,6 +52,7 @@ func (manager *LocalTopicManager) StartIdlePartitionCleanup(ctx context.Context,
 // cleanupIdlePartitions removes idle partitions from memory
 func (manager *LocalTopicManager) cleanupIdlePartitions(idleTimeout time.Duration) {
 	cleanedCount := 0
+	var emptyTopics []string
 
 	// Iterate through all topics
 	manager.topics.IterCb(func(topicKey string, localTopic *LocalTopic) {
@@ -78,13 +79,33 @@ func (manager *LocalTopicManager) cleanupIdlePartitions(idleTimeout time.Duratio
 			}
 		}
 
-		// If topic has no partitions left, remove it
 		if len(localTopic.Partitions) == 0 {
-			glog.V(1).Infof("Removing empty topic %s", topicKey)
-			manager.topics.Remove(topicKey)
+			emptyTopics = append(emptyTopics, topicKey)
 		}
 	})
 
+	// Remove emptied topics only after the iteration: IterCb holds the shard's
+	// read lock while running the callback, so calling Remove (which takes the
+	// same shard's write lock) inside it self-deadlocks and permanently wedges
+	// the shard — every later reader of that shard blocks behind the stuck
+	// writer, hanging ListTopicsInMemory/TopicExistsInMemory forever.
+	for _, topicKey := range emptyTopics {
+		manager.topics.RemoveCb(topicKey, func(key string, localTopic *LocalTopic, exists bool) bool {
+			if !exists || localTopic == nil {
+				return false
+			}
+			// Re-check emptiness under the shard's write lock: a publisher or
+			// subscriber may have added a partition since the scan above.
+			localTopic.partitionLock.RLock()
+			defer localTopic.partitionLock.RUnlock()
+			if len(localTopic.Partitions) > 0 {
+				return false
+			}
+			glog.V(1).Infof("Removing empty topic %s", key)
+			return true
+		})
+	}
+
 	if cleanedCount > 0 {
 		glog.V(0).Infof("Cleaned up %d idle partition(s)", cleanedCount)
 	}
diff --git a/weed/mq/topic/local_manager_test.go b/weed/mq/topic/local_manager_test.go
new file mode 100644
index 0000000000..4d0e320913
--- /dev/null
+++ b/weed/mq/topic/local_manager_test.go
@@ -0,0 +1,75 @@
+package topic
+
+import (
+	"testing"
+	"time"
+)
+
+// cleanupIdlePartitions used to call manager.topics.Remove from inside
+// manager.topics.IterCb. IterCb holds the shard's read lock while running the
+// callback, and Remove takes the same shard's write lock, so removing an
+// emptied topic deadlocked the cleanup goroutine and permanently wedged the
+// shard: every later ListTopicsInMemory / TopicExistsInMemory blocked behind
+// the stuck writer. Observed in CI as the Kafka gateway's Metadata requests
+// timing out forever once any topic went idle mid-test.
+func TestCleanupIdlePartitionsRemovesEmptyTopicWithoutDeadlock(t *testing.T) {
+	manager := NewLocalTopicManager()
+
+	tp := NewTopic("test", "idle-topic")
+	localTopic := NewLocalTopic(tp)
+	localPartition := NewLocalPartition(Partition{RingSize: 2520, RangeStart: 0, RangeStop: 2520}, 1, nil, nil)
+	localTopic.Partitions = append(localTopic.Partitions, localPartition)
+	manager.topics.Set(tp.String(), localTopic)
+
+	// Make the partition idle beyond any timeout.
+	localPartition.lastActivityTime.Store(time.Now().Add(-time.Hour).UnixNano())
+
+	done := make(chan struct{})
+	go func() {
+		manager.cleanupIdlePartitions(time.Minute)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(10 * time.Second):
+		t.Fatal("cleanupIdlePartitions deadlocked while removing an emptied topic")
+	}
+
+	if manager.topics.Has(tp.String()) {
+		t.Errorf("emptied topic %s should have been removed", tp.String())
+	}
+
+	// The map must still be fully usable afterwards — with the deadlock the
+	// wedged shard made this call block forever.
+	listed := make(chan []Topic, 1)
+	go func() { listed <- manager.ListTopicsInMemory() }()
+	select {
+	case topics := <-listed:
+		if len(topics) != 0 {
+			t.Errorf("expected no topics in memory, got %v", topics)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("ListTopicsInMemory blocked after cleanup — shard still wedged")
+	}
+}
+
+// A topic that gains a partition between the cleanup scan and the removal must
+// be kept: removal re-checks emptiness under the shard write lock.
+func TestCleanupIdlePartitionsKeepsActiveTopic(t *testing.T) {
+	manager := NewLocalTopicManager()
+
+	tp := NewTopic("test", "active-topic")
+	localPartition := NewLocalPartition(Partition{RingSize: 2520, RangeStart: 0, RangeStop: 2520}, 1, nil, nil)
+	manager.AddLocalPartition(tp, localPartition)
+
+	// Fresh activity: nothing should be cleaned up.
+	manager.cleanupIdlePartitions(time.Minute)
+
+	if !manager.topics.Has(tp.String()) {
+		t.Errorf("active topic %s should not have been removed", tp.String())
+	}
+	if manager.GetLocalPartition(tp, localPartition.Partition) == nil {
+		t.Errorf("active partition should still be registered")
+	}
+}
diff --git a/weed/notification/configuration.go b/weed/notification/configuration.go
index 1c620f2e6a..d271323149 100644
--- a/weed/notification/configuration.go
+++ b/weed/notification/configuration.go
@@ -26,10 +26,10 @@ func LoadConfiguration(config *util.ViperProxy, prefix string) {
 		return
 	}
 
-	validateOneEnabledQueue(config)
+	validateOneEnabledQueue(config, prefix)
 
 	for _, queue := range MessageQueues {
-		if config.GetBool(prefix + queue.GetName() + ".enabled") {
+		if queueEnabled(config, prefix, queue) {
 			if err := queue.Initialize(config, prefix+queue.GetName()+"."); err != nil {
 				glog.Fatalf("Failed to initialize notification for %s: %+v",
 					queue.GetName(), err)
@@ -42,10 +42,26 @@ func LoadConfiguration(config *util.ViperProxy, prefix string) {
 
 }
 
-func validateOneEnabledQueue(config *util.ViperProxy) {
+// queueEnabled reports whether a queue is switched on — by the flat
+// "<prefix><name>.enabled" flag or, for queues accepting named sub-instances
+// ([notification.<queue>.<target>]), by any enabled subconfig.
+func queueEnabled(config util.Configuration, prefix string, queue MessageQueue) bool {
+	key := prefix + queue.GetName() + "."
+	if config.GetBool(key + "enabled") {
+		return true
+	}
+	if q, ok := queue.(interface {
+		HasEnabledSubconfig(util.Configuration, string) bool
+	}); ok {
+		return q.HasEnabledSubconfig(config, key)
+	}
+	return false
+}
+
+func validateOneEnabledQueue(config *util.ViperProxy, prefix string) {
 	enabledQueue := ""
 	for _, queue := range MessageQueues {
-		if config.GetBool(queue.GetName() + ".enabled") {
+		if queueEnabled(config, prefix, queue) {
 			if enabledQueue == "" {
 				enabledQueue = queue.GetName()
 			} else {
diff --git a/weed/notification/event_type.go b/weed/notification/event_type.go
new file mode 100644
index 0000000000..c322bd5dd3
--- /dev/null
+++ b/weed/notification/event_type.go
@@ -0,0 +1,53 @@
+package notification
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+const (
+	EventTypeCreate = "create"
+	EventTypeDelete = "delete"
+	EventTypeUpdate = "update"
+	EventTypeRename = "rename"
+)
+
+// ValidEventType reports whether t is an event type a queue can filter on.
+func ValidEventType(t string) bool {
+	switch t {
+	case EventTypeCreate, EventTypeDelete, EventTypeUpdate, EventTypeRename:
+		return true
+	default:
+		return false
+	}
+}
+
+// DetectEventType classifies an entry-change notification. key is the old
+// entry's path when one exists.
+func DetectEventType(key string, notification *filer_pb.EventNotification) string {
+	hasOldEntry := notification.OldEntry != nil
+	hasNewEntry := notification.NewEntry != nil
+
+	if !hasOldEntry && hasNewEntry {
+		return EventTypeCreate
+	}
+
+	if hasOldEntry && !hasNewEntry {
+		return EventTypeDelete
+	}
+
+	if hasOldEntry && hasNewEntry {
+		oldDir, _ := util.FullPath(key).DirAndName()
+		newDir := notification.NewParentPath
+		if newDir == "" {
+			newDir = oldDir
+		}
+		if oldDir != newDir || notification.OldEntry.Name != notification.NewEntry.Name {
+			return EventTypeRename
+		}
+
+		return EventTypeUpdate
+	}
+
+	return EventTypeUpdate
+}
diff --git a/weed/notification/kafka/event_filter.go b/weed/notification/kafka/event_filter.go
new file mode 100644
index 0000000000..45766ad99c
--- /dev/null
+++ b/weed/notification/kafka/event_filter.go
@@ -0,0 +1,40 @@
+package kafka
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/notification"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"google.golang.org/protobuf/proto"
+)
+
+// Empty eventTypes means publish every event. A non-nil map publishes only those types.
+// The names and classification match the webhook notifier.
+func (k *KafkaQueue) setEventTypes(types []string) {
+	if len(types) == 0 {
+		k.eventTypes = nil
+		return
+	}
+
+	allowed := make(map[string]struct{}, len(types))
+	for _, et := range types {
+		if !notification.ValidEventType(et) {
+			glog.Warningf("invalid event type: %v", et)
+			continue
+		}
+		allowed[et] = struct{}{}
+	}
+	k.eventTypes = allowed
+}
+
+func (k *KafkaQueue) allowsEvent(key string, message proto.Message) bool {
+	if k.eventTypes == nil {
+		return true
+	}
+
+	n, ok := message.(*filer_pb.EventNotification)
+	if !ok || n == nil {
+		return false
+	}
+	_, allowed := k.eventTypes[notification.DetectEventType(key, n)]
+	return allowed
+}
diff --git a/weed/notification/kafka/event_filter_test.go b/weed/notification/kafka/event_filter_test.go
new file mode 100644
index 0000000000..025f6ff378
--- /dev/null
+++ b/weed/notification/kafka/event_filter_test.go
@@ -0,0 +1,160 @@
+package kafka
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/notification"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestKafkaEventTypes(t *testing.T) {
+	tests := []struct {
+		name         string
+		key          string
+		eventTypes   []string
+		notification *filer_pb.EventNotification
+		wantType     string
+		wantAllow    bool
+	}{
+		{
+			name:       "create event allowed",
+			key:        "/test/test.txt",
+			eventTypes: []string{"create", "delete"},
+			notification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "test.txt"},
+			},
+			wantType:  "create",
+			wantAllow: true,
+		},
+		{
+			name:       "create event filtered out",
+			key:        "/test/test.txt",
+			eventTypes: []string{"delete", "update"},
+			notification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "test.txt"},
+			},
+			wantType:  "create",
+			wantAllow: false,
+		},
+		{
+			name:       "delete event allowed",
+			key:        "/test/test.txt",
+			eventTypes: []string{"create", "delete"},
+			notification: &filer_pb.EventNotification{
+				OldEntry: &filer_pb.Entry{Name: "test.txt"},
+			},
+			wantType:  "delete",
+			wantAllow: true,
+		},
+		{
+			name:       "update event allowed",
+			key:        "/test/test.txt",
+			eventTypes: []string{"update"},
+			notification: &filer_pb.EventNotification{
+				OldEntry:      &filer_pb.Entry{Name: "test.txt"},
+				NewEntry:      &filer_pb.Entry{Name: "test.txt"},
+				NewParentPath: "/test",
+			},
+			wantType:  "update",
+			wantAllow: true,
+		},
+		{
+			name:       "rename event allowed",
+			key:        "/old/path/old.txt",
+			eventTypes: []string{"rename"},
+			notification: &filer_pb.EventNotification{
+				OldEntry:      &filer_pb.Entry{Name: "old.txt"},
+				NewEntry:      &filer_pb.Entry{Name: "new.txt"},
+				NewParentPath: "/new/path",
+			},
+			wantType:  "rename",
+			wantAllow: true,
+		},
+		{
+			name:       "rename across directories allowed",
+			key:        "/old/path/file.txt",
+			eventTypes: []string{"rename"},
+			notification: &filer_pb.EventNotification{
+				OldEntry:      &filer_pb.Entry{Name: "file.txt"},
+				NewEntry:      &filer_pb.Entry{Name: "file.txt"},
+				NewParentPath: "/new/path",
+			},
+			wantType:  "rename",
+			wantAllow: true,
+		},
+		{
+			name:       "rename event filtered out",
+			key:        "/old/path/old.txt",
+			eventTypes: []string{"create", "delete", "update"},
+			notification: &filer_pb.EventNotification{
+				OldEntry:      &filer_pb.Entry{Name: "old.txt"},
+				NewEntry:      &filer_pb.Entry{Name: "new.txt"},
+				NewParentPath: "/new/path",
+			},
+			wantType:  "rename",
+			wantAllow: false,
+		},
+		{
+			name:       "empty filter publishes every event",
+			key:        "/test/test.txt",
+			eventTypes: []string{},
+			notification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "test.txt"},
+			},
+			wantType:  "create",
+			wantAllow: true,
+		},
+		{
+			name:       "invalid type does not remove a valid one",
+			key:        "/test/test.txt",
+			eventTypes: []string{"create", "bogus"},
+			notification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "test.txt"},
+			},
+			wantType:  "create",
+			wantAllow: true,
+		},
+		{
+			name:       "only invalid types publish nothing",
+			key:        "/test/test.txt",
+			eventTypes: []string{"bogus"},
+			notification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "test.txt"},
+			},
+			wantType:  "create",
+			wantAllow: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotType := notification.DetectEventType(tt.key, tt.notification)
+			if gotType != tt.wantType {
+				t.Errorf("DetectEventType() = %v, want %v", gotType, tt.wantType)
+			}
+
+			q := &KafkaQueue{}
+			q.setEventTypes(tt.eventTypes)
+			if got := q.allowsEvent(tt.key, tt.notification); got != tt.wantAllow {
+				t.Errorf("allowsEvent() = %v, want %v", got, tt.wantAllow)
+			}
+		})
+	}
+}
+
+func TestKafkaEventFilterUnsetPublishesOtherMessages(t *testing.T) {
+	q := &KafkaQueue{}
+	if !q.allowsEvent("/test/test.txt", &filer_pb.Entry{Name: "test.txt"}) {
+		t.Fatal("unset filter dropped a message")
+	}
+}
+
+func TestKafkaEventFilterDropsUnclassifiedMessages(t *testing.T) {
+	q := &KafkaQueue{}
+	q.setEventTypes([]string{"create"})
+	var message proto.Message = &filer_pb.Entry{Name: "test.txt"}
+	if q.allowsEvent("/test/test.txt", message) {
+		t.Fatal("filtered queue published a message that is not an event notification")
+	}
+}
diff --git a/weed/notification/kafka/kafka_queue.go b/weed/notification/kafka/kafka_queue.go
index 53f0802f6a..b0922d5ed7 100644
--- a/weed/notification/kafka/kafka_queue.go
+++ b/weed/notification/kafka/kafka_queue.go
@@ -15,8 +15,9 @@ func init() {
 }
 
 type KafkaQueue struct {
-	topic    string
-	producer sarama.AsyncProducer
+	topic      string
+	producer   sarama.AsyncProducer
+	eventTypes map[string]struct{}
 }
 
 func (k *KafkaQueue) GetName() string {
@@ -26,6 +27,9 @@ func (k *KafkaQueue) GetName() string {
 func (k *KafkaQueue) Initialize(configuration util.Configuration, prefix string) (err error) {
 	glog.V(0).Infof("filer.notification.kafka.hosts: %v\n", configuration.GetStringSlice(prefix+"hosts"))
 	glog.V(0).Infof("filer.notification.kafka.topic: %v\n", configuration.GetString(prefix+"topic"))
+	eventTypes := configuration.GetStringSlice(prefix + "event_types")
+	glog.V(0).Infof("filer.notification.kafka.event_types: %v\n", eventTypes)
+	k.setEventTypes(eventTypes)
 	return k.initialize(
 		configuration.GetStringSlice(prefix+"hosts"),
 		configuration.GetString(prefix+"topic"),
@@ -63,6 +67,10 @@ func (k *KafkaQueue) initialize(hosts []string, topic string, saslTLS SASLTLSCon
 }
 
 func (k *KafkaQueue) SendMessage(key string, message proto.Message) (err error) {
+	if !k.allowsEvent(key, message) {
+		return nil
+	}
+
 	bytes, err := proto.Marshal(message)
 	if err != nil {
 		return
diff --git a/weed/notification/webhook/types.go b/weed/notification/webhook/types.go
index af1fb02422..1567e832f2 100644
--- a/weed/notification/webhook/types.go
+++ b/weed/notification/webhook/types.go
@@ -3,9 +3,8 @@ package webhook
 import (
 	"fmt"
 	"net/url"
-	"slices"
-	"strconv"
 
+	"github.com/seaweedfs/seaweedfs/weed/notification"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/protobuf/proto"
@@ -20,29 +19,16 @@ const (
 type eventType string
 
 const (
-	eventTypeCreate eventType = "create"
-	eventTypeDelete eventType = "delete"
-	eventTypeUpdate eventType = "update"
-	eventTypeRename eventType = "rename"
+	eventTypeCreate = eventType(notification.EventTypeCreate)
+	eventTypeDelete = eventType(notification.EventTypeDelete)
+	eventTypeUpdate = eventType(notification.EventTypeUpdate)
+	eventTypeRename = eventType(notification.EventTypeRename)
 )
 
 func (e eventType) valid() bool {
-	return slices.Contains([]eventType{
-		eventTypeCreate,
-		eventTypeDelete,
-		eventTypeUpdate,
-		eventTypeRename,
-	},
-		e,
-	)
+	return notification.ValidEventType(string(e))
 }
 
-var (
-	pubSubHandlerNameTemplate = func(n int) string {
-		return "webhook_handler_" + strconv.Itoa(n)
-	}
-)
-
 type client interface {
 	sendMessage(message *webhookMessage) error
 }
@@ -157,30 +143,6 @@ func (c *config) validate() error {
 	return nil
 }
 
-func detectEventType(key string, notification *filer_pb.EventNotification) eventType {
-	hasOldEntry := notification.OldEntry != nil
-	hasNewEntry := notification.NewEntry != nil
-
-	if !hasOldEntry && hasNewEntry {
-		return eventTypeCreate
-	}
-
-	if hasOldEntry && !hasNewEntry {
-		return eventTypeDelete
-	}
-
-	if hasOldEntry && hasNewEntry {
-		oldDir, _ := util.FullPath(key).DirAndName()
-		newDir := notification.NewParentPath
-		if newDir == "" {
-			newDir = oldDir
-		}
-		if oldDir != newDir || notification.OldEntry.Name != notification.NewEntry.Name {
-			return eventTypeRename
-		}
-
-		return eventTypeUpdate
-	}
-
-	return eventTypeUpdate
+func detectEventType(key string, n *filer_pb.EventNotification) eventType {
+	return eventType(notification.DetectEventType(key, n))
 }
diff --git a/weed/notification/webhook/webhook_queue.go b/weed/notification/webhook/webhook_queue.go
index 2ac9db3ebb..afaa326245 100644
--- a/weed/notification/webhook/webhook_queue.go
+++ b/weed/notification/webhook/webhook_queue.go
@@ -4,6 +4,9 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"sort"
+	"strings"
+	"sync"
 	"time"
 
 	"github.com/ThreeDotsLabs/watermill"
@@ -22,45 +25,176 @@ func init() {
 	notification.MessageQueues = append(notification.MessageQueues, &Queue{})
 }
 
+// target is one webhook endpoint with its own filter, http client and
+// concurrency budget. The flat [notification.webhook] section is the unnamed
+// target; each enabled [notification.webhook.<name>] subsection adds another.
+type target struct {
+	name    string
+	config  *config
+	filter  *filter
+	client  client
+	sem     chan struct{}
+	inbox   chan *message.Message
+	pending chan struct{}
+}
+
+func newTarget(name string, cfg *config) (*target, error) {
+	t := &target{
+		name:   name,
+		config: cfg,
+		filter: newFilter(cfg),
+		sem:     make(chan struct{}, cfg.nWorkers),
+		inbox:   make(chan *message.Message, cfg.bufferSize),
+		pending: make(chan struct{}, cfg.bufferSize),
+	}
+	hClient, err := newHTTPClient(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create webhook http client: %w", err)
+	}
+	t.client = hClient
+	return t, nil
+}
+
+func (t *target) topic() string {
+	if t.name == "" {
+		return pubSubTopicName
+	}
+	return pubSubTopicName + "_" + t.name
+}
+
+func (t *target) handlerName() string {
+	if t.name == "" {
+		return "webhook_handler"
+	}
+	return "webhook_handler_" + t.name
+}
+
 type Queue struct {
-	router       *message.Router
+	routers      []*message.Router
 	queueChannel *gochannel.GoChannel
-	config       *config
-	client       client
-	filter       *filter
+	targets      []*target
 
 	ctx    context.Context
 	cancel context.CancelFunc
-
-	// Semaphore for controlling concurrent webhook requests
-	sem chan struct{}
 }
 
 func (w *Queue) GetName() string {
 	return queueName
 }
 
+// HasEnabledSubconfig reports whether any [notification.webhook.<name>]
+// subsection is enabled, so the queue activates on named targets even when the
+// flat [notification.webhook] section is absent.
+func (w *Queue) HasEnabledSubconfig(configuration util.Configuration, prefix string) bool {
+	return len(namedTargetPrefixes(configuration, prefix)) > 0
+}
+
+// stringMapConfig is implemented by *util.ViperProxy; anything narrower simply
+// gets no named-target discovery.
+type stringMapConfig interface {
+	GetStringMap(key string) map[string]interface{}
+}
+
+func namedTargetPrefixes(configuration util.Configuration, prefix string) []string {
+	mg, ok := configuration.(stringMapConfig)
+	if !ok {
+		return nil
+	}
+	var prefixes []string
+	for k, v := range mg.GetStringMap(strings.TrimSuffix(prefix, ".")) {
+		if _, ok := v.(map[string]interface{}); !ok {
+			continue
+		}
+		p := prefix + k + "."
+		if !configuration.GetBool(p + "enabled") {
+			continue
+		}
+		prefixes = append(prefixes, p)
+	}
+	sort.Strings(prefixes)
+	return prefixes
+}
+
+func buildTargets(configuration util.Configuration, prefix string) ([]*target, error) {
+	var prefixes []string
+	if configuration.GetBool(prefix + "enabled") {
+		prefixes = append(prefixes, prefix)
+	}
+	prefixes = append(prefixes, namedTargetPrefixes(configuration, prefix)...)
+
+	var targets []*target
+	for _, p := range prefixes {
+		cfg := newConfigWithDefaults(configuration, p)
+		if err := cfg.validate(); err != nil {
+			return nil, err
+		}
+		t, err := newTarget(strings.TrimSuffix(strings.TrimPrefix(p, prefix), "."), cfg)
+		if err != nil {
+			return nil, err
+		}
+		targets = append(targets, t)
+	}
+	return targets, nil
+}
+
 func (w *Queue) SendMessage(key string, msg proto.Message) error {
 	eventNotification, ok := msg.(*filer_pb.EventNotification)
 	if !ok {
 		return nil
 	}
 
-	if w.filter != nil && !w.filter.shouldPublish(key, eventNotification) {
+	var deferred []routedMessage
+	for _, t := range w.targets {
+		if t.filter != nil && !t.filter.shouldPublish(key, eventNotification) {
+			continue
+		}
+		m := newWebhookMessage(key, msg)
+		if m == nil {
+			continue
+		}
+		wMsg, err := m.toWaterMillMessage()
+		if err != nil {
+			return err
+		}
+		wMsg.Metadata.Set("target", t.name)
+		// a free reservation routes the event without waiting on slower
+		// targets; a saturated target defers to the blocking pass below so
+		// it applies backpressure instead of dropping or starving the rest
+		select {
+		case t.pending <- struct{}{}:
+			if err := t.enqueue(w.ctx, wMsg); err != nil {
+				return err
+			}
+		default:
+			deferred = append(deferred, routedMessage{t, wMsg})
+		}
+	}
+	for _, r := range deferred {
+		select {
+		case r.target.pending <- struct{}{}:
+		case <-w.ctx.Done():
+			return w.ctx.Err()
+		}
+		if err := r.target.enqueue(w.ctx, r.msg); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+type routedMessage struct {
+	target *target
+	msg    *message.Message
+}
+
+func (t *target) enqueue(ctx context.Context, wMsg *message.Message) error {
+	select {
+	case t.inbox <- wMsg:
 		return nil
+	case <-ctx.Done():
+		t.releasePending()
+		return ctx.Err()
 	}
-
-	m := newWebhookMessage(key, msg)
-	if m == nil {
-		return nil
-	}
-
-	wMsg, err := m.toWaterMillMessage()
-	if err != nil {
-		return err
-	}
-
-	return w.queueChannel.Publish(pubSubTopicName, wMsg)
 }
 
 func (w *webhookMessage) toWaterMillMessage() (*message.Message, error) {
@@ -78,105 +212,158 @@ func (w *webhookMessage) toWaterMillMessage() (*message.Message, error) {
 }
 
 func (w *Queue) Initialize(configuration util.Configuration, prefix string) error {
-	c := newConfigWithDefaults(configuration, prefix)
-
-	if err := c.validate(); err != nil {
+	targets, err := buildTargets(configuration, prefix)
+	if err != nil {
 		return err
 	}
+	if len(targets) == 0 {
+		return fmt.Errorf("webhook endpoint is required")
+	}
 
-	return w.initialize(c)
+	return w.initialize(targets)
 }
 
-func (w *Queue) initialize(cfg *config) error {
+func (w *Queue) initialize(targets []*target) error {
 	w.ctx, w.cancel = context.WithCancel(context.Background())
-	w.config = cfg
-	w.filter = newFilter(cfg)
+	w.targets = targets
 
-	// Initialize semaphore for controlling concurrent webhook requests
-	w.sem = make(chan struct{}, cfg.nWorkers)
-
-	hClient, err := newHTTPClient(cfg)
-	if err != nil {
-		return fmt.Errorf("failed to create webhook http client: %w", err)
-	}
-	w.client = hClient
-
-	if err = w.setupWatermillQueue(cfg); err != nil {
+	if err := w.setupWatermillQueue(targets); err != nil {
 		return fmt.Errorf("failed to setup watermill queue: %w", err)
 	}
-	if err = w.logDeadLetterMessages(); err != nil {
+	if err := w.logDeadLetterMessages(); err != nil {
 		return err
 	}
 
 	return nil
 }
 
-func (w *Queue) setupWatermillQueue(cfg *config) error {
+func (w *Queue) setupWatermillQueue(targets []*target) error {
 	logger := watermill.NewStdLogger(false, false)
+	bufferSize := 0
+	for _, t := range targets {
+		if t.config.bufferSize > bufferSize {
+			bufferSize = t.config.bufferSize
+		}
+	}
 	pubSubConfig := gochannel.Config{
-		OutputChannelBuffer: int64(cfg.bufferSize),
+		OutputChannelBuffer: int64(bufferSize),
 		Persistent:          false,
 	}
 	w.queueChannel = gochannel.NewGoChannel(pubSubConfig, logger)
 
-	router, err := message.NewRouter(
-		message.RouterConfig{
-			CloseTimeout: 60 * time.Second,
-		},
-		logger,
-	)
-	if err != nil {
-		return fmt.Errorf("failed to create router: %w", err)
-	}
-	w.router = router
+	var wg sync.WaitGroup
+	for _, t := range targets {
+		// One router per target so each keeps its own retry/backoff settings.
+		// Handlers subscribe to the target's own topic, so a message is
+		// delivered to an endpoint exactly once per matching target.
+		router, err := message.NewRouter(
+			message.RouterConfig{
+				CloseTimeout: 60 * time.Second,
+			},
+			logger,
+		)
+		if err != nil {
+			return fmt.Errorf("failed to create router: %w", err)
+		}
+		w.routers = append(w.routers, router)
 
-	retryMiddleware := middleware.Retry{
-		MaxRetries:          cfg.maxRetries,
-		InitialInterval:     time.Duration(cfg.backoffSeconds) * time.Second,
-		MaxInterval:         time.Duration(cfg.maxBackoffSeconds) * time.Second,
-		Multiplier:          2.0,
-		RandomizationFactor: 0.3,
-		Logger:              logger,
-	}.Middleware
+		retryMiddleware := middleware.Retry{
+			MaxRetries:          t.config.maxRetries,
+			InitialInterval:     time.Duration(t.config.backoffSeconds) * time.Second,
+			MaxInterval:         time.Duration(t.config.maxBackoffSeconds) * time.Second,
+			Multiplier:          2.0,
+			RandomizationFactor: 0.3,
+			Logger:              logger,
+		}.Middleware
 
-	poisonQueue, err := middleware.PoisonQueue(w.queueChannel, deadLetterTopic)
-	if err != nil {
-		return fmt.Errorf("failed to create poison queue: %w", err)
-	}
-
-	router.AddPlugin(plugin.SignalsHandler)
-	router.AddMiddleware(retryMiddleware, poisonQueue)
-
-	// Add a single handler to avoid duplicate message delivery.
-	// With gochannel's default behavior, each handler call creates
-	// a separate subscription, and all subscriptions receive their own copy of each message.
-	// Using a single handler ensures each webhook is sent only once.
-	// Concurrency is controlled via semaphore in handleWebhook based on nWorkers config.
-	router.AddConsumerHandler(
-		"webhook_handler",
-		pubSubTopicName,
-		w.queueChannel,
-		w.handleWebhook,
-	)
-
-	go func() {
-		// cancels the queue context so the dead letter logger exists in case context not canceled by the shutdown signal already
-		defer w.cancel()
-
-		if err := router.Run(w.ctx); err != nil && !errors.Is(err, context.Canceled) {
-			glog.Errorf("webhook pubsub worker stopped with error: %v", err)
+		poisonQueue, err := middleware.PoisonQueue(w.queueChannel, deadLetterTopic)
+		if err != nil {
+			return fmt.Errorf("failed to create poison queue: %w", err)
 		}
 
-		glog.Info("webhook pubsub worker stopped")
+		router.AddPlugin(plugin.SignalsHandler)
+		// outermost: the reservation SendMessage took releases once the whole
+		// chain (retries, dead letter) is done, bounding in-flight deliveries.
+		// poison wraps retry so the delivery is retried before dead-lettering.
+		releasePending := func(h message.HandlerFunc) message.HandlerFunc {
+			return func(msg *message.Message) ([]*message.Message, error) {
+				defer t.releasePending()
+				return h(msg)
+			}
+		}
+		router.AddMiddleware(releasePending, poisonQueue, retryMiddleware)
+
+		t := t
+		router.AddConsumerHandler(
+			t.handlerName(),
+			t.topic(),
+			w.queueChannel,
+			t.handleWebhook,
+		)
+
+		routerStopped := make(chan struct{})
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			defer close(routerStopped)
+			if err := router.Run(w.ctx); err != nil && !errors.Is(err, context.Canceled) {
+				glog.Errorf("webhook pubsub worker stopped with error: %v", err)
+			}
+			glog.Info("webhook pubsub worker stopped")
+		}()
+
+		go w.forwardTargetMessages(t)
+
+		// without a subscriber GoChannel drops the publish as undeliverable
+		select {
+		case <-router.Running():
+		case <-routerStopped:
+			return fmt.Errorf("webhook router for target %q stopped before it started", t.name)
+		case <-w.ctx.Done():
+			return w.ctx.Err()
+		}
+	}
+
+	// the queue context lives until every target's worker has stopped so the
+	// dead letter logger keeps running while any of them is still up
+	go func() {
+		wg.Wait()
+		w.cancel()
 	}()
 
 	return nil
 }
 
-func (w *Queue) handleWebhook(msg *message.Message) error {
+// forwardTargetMessages publishes each queued event to the target's topic in
+// order. Publish detaches its delivery, so the pending reservation is what
+// keeps a saturated target from queuing without bound.
+func (w *Queue) forwardTargetMessages(t *target) {
+	for {
+		select {
+		case msg := <-t.inbox:
+			if err := w.queueChannel.Publish(t.topic(), msg); err != nil {
+				glog.Errorf("webhook target %q failed to publish message: %v", t.name, err)
+				t.releasePending()
+			}
+		case <-w.ctx.Done():
+			return
+		}
+	}
+}
+
+// releasePending frees one delivery reservation. It never blocks: a nacked
+// message GoChannel resends reaches the release again after its token is gone.
+func (t *target) releasePending() {
+	select {
+	case <-t.pending:
+	default:
+	}
+}
+
+func (t *target) handleWebhook(msg *message.Message) error {
 	// Acquire semaphore slot (blocks if at capacity)
-	w.sem <- struct{}{}
-	defer func() { <-w.sem }()
+	t.sem <- struct{}{}
+	defer func() { <-t.sem }()
 
 	var n filer_pb.EventNotification
 	if err := proto.Unmarshal(msg.Payload, &n); err != nil {
@@ -191,8 +378,8 @@ func (w *Queue) handleWebhook(msg *message.Message) error {
 		Notification: &n,
 	}
 
-	if err := w.client.sendMessage(webhookMsg); err != nil {
-		glog.Errorf("failed to send message to webhook %s: %v", webhookMsg.Key, err)
+	if err := t.client.sendMessage(webhookMsg); err != nil {
+		glog.Errorf("webhook target %q failed to send message for %s: %v", t.name, webhookMsg.Key, err)
 		return err
 	}
 
@@ -218,10 +405,12 @@ func (w *Queue) logDeadLetterMessages() error {
 					continue
 				}
 				key := "unknown"
+				targetName := ""
 				if msg.Metadata != nil {
 					if keyValue, exists := msg.Metadata["key"]; exists {
 						key = keyValue
 					}
+					targetName = msg.Metadata["target"]
 				}
 				payload := ""
 				if msg.Payload != nil {
@@ -232,7 +421,7 @@ func (w *Queue) logDeadLetterMessages() error {
 						payload = n.String()
 					}
 				}
-				glog.Errorf("received dead letter message: %s, key: %s", payload, key)
+				glog.Errorf("received dead letter message: %s, key: %s, target: %s", payload, key, targetName)
 			case <-w.ctx.Done():
 				return
 			}
diff --git a/weed/notification/webhook/webhook_queue_test.go b/weed/notification/webhook/webhook_queue_test.go
index a084ef975b..ba75ecb147 100644
--- a/weed/notification/webhook/webhook_queue_test.go
+++ b/weed/notification/webhook/webhook_queue_test.go
@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -170,6 +171,29 @@ func TestWebhookMessageSerialization(t *testing.T) {
 	}
 }
 
+func newQueueForTest(t *testing.T, cfg *config) *Queue {
+	t.Helper()
+	tgt, err := newTarget("", cfg)
+	if err != nil {
+		t.Fatalf("newTarget() error = %v", err)
+	}
+	q := &Queue{}
+	if err := q.initialize([]*target{tgt}); err != nil {
+		t.Fatalf("initialize() error = %v", err)
+	}
+	return q
+}
+
+func closeQueueForTest(q *Queue) {
+	if q.cancel != nil {
+		q.cancel()
+	}
+	time.Sleep(100 * time.Millisecond)
+	for _, r := range q.routers {
+		r.Close()
+	}
+}
+
 func TestQueueInitialize(t *testing.T) {
 	cfg := &config{
 		endpoint:          "https://example.com/webhook",
@@ -182,32 +206,19 @@ func TestQueueInitialize(t *testing.T) {
 		bufferSize:        100,
 	}
 
-	q := &Queue{}
-	err := q.initialize(cfg)
-	if err != nil {
-		t.Errorf("Initialize() error = %v", err)
-	}
+	q := newQueueForTest(t, cfg)
+	defer closeQueueForTest(q)
 
-	defer func() {
-		if q.cancel != nil {
-			q.cancel()
-		}
-		time.Sleep(100 * time.Millisecond)
-		if q.router != nil {
-			q.router.Close()
-		}
-	}()
-
-	if q.router == nil {
+	if len(q.routers) != 1 {
 		t.Error("Expected router to be initialized")
 	}
 	if q.queueChannel == nil {
 		t.Error("Expected queueChannel to be initialized")
 	}
-	if q.client == nil {
+	if q.targets[0].client == nil {
 		t.Error("Expected client to be initialized")
 	}
-	if q.config == nil {
+	if q.targets[0].config == nil {
 		t.Error("Expected config to be initialized")
 	}
 }
@@ -225,21 +236,8 @@ func TestQueueSendMessage(t *testing.T) {
 		bufferSize:        10,
 	}
 
-	q := &Queue{}
-	err := q.initialize(cfg)
-	if err != nil {
-		t.Fatalf("Failed to initialize queue: %v", err)
-	}
-
-	defer func() {
-		if q.cancel != nil {
-			q.cancel()
-		}
-		time.Sleep(100 * time.Millisecond)
-		if q.router != nil {
-			q.router.Close()
-		}
-	}()
+	q := newQueueForTest(t, cfg)
+	defer closeQueueForTest(q)
 
 	msg := &filer_pb.EventNotification{
 		NewEntry: &filer_pb.Entry{
@@ -247,8 +245,7 @@ func TestQueueSendMessage(t *testing.T) {
 		},
 	}
 
-	err = q.SendMessage("/test/path", msg)
-	if err != nil {
+	if err := q.SendMessage("/test/path", msg); err != nil {
 		t.Errorf("SendMessage() error = %v", err)
 	}
 }
@@ -271,7 +268,7 @@ func TestQueueHandleWebhook(t *testing.T) {
 	}
 
 	client, _ := newHTTPClient(cfg)
-	q := &Queue{
+	tgt := &target{
 		client: client,
 		sem:    make(chan struct{}, cfg.nWorkers),
 	}
@@ -287,8 +284,7 @@ func TestQueueHandleWebhook(t *testing.T) {
 		t.Fatalf("Failed to create watermill message: %v", err)
 	}
 
-	err = q.handleWebhook(wmMsg)
-	if err != nil {
+	if err := tgt.handleWebhook(wmMsg); err != nil {
 		t.Errorf("handleWebhook() error = %v", err)
 	}
 }
@@ -307,21 +303,8 @@ func TestQueueEndToEnd(t *testing.T) {
 		bufferSize:        10,
 	}
 
-	q := &Queue{}
-	err := q.initialize(cfg)
-	if err != nil {
-		t.Fatalf("Failed to initialize queue: %v", err)
-	}
-
-	defer func() {
-		if q.cancel != nil {
-			q.cancel()
-		}
-		time.Sleep(100 * time.Millisecond)
-		if q.router != nil {
-			q.router.Close()
-		}
-	}()
+	q := newQueueForTest(t, cfg)
+	defer closeQueueForTest(q)
 
 	msg := &filer_pb.EventNotification{
 		NewEntry: &filer_pb.Entry{
@@ -329,8 +312,7 @@ func TestQueueEndToEnd(t *testing.T) {
 		},
 	}
 
-	err = q.SendMessage("/test/path", msg)
-	if err != nil {
+	if err := q.SendMessage("/test/path", msg); err != nil {
 		t.Errorf("SendMessage() error = %v", err)
 	}
 }
@@ -347,33 +329,20 @@ func TestQueueRetryMechanism(t *testing.T) {
 		bufferSize:        10,
 	}
 
-	q := &Queue{}
-	err := q.initialize(cfg)
-	if err != nil {
-		t.Fatalf("Failed to initialize queue: %v", err)
-	}
-
-	defer func() {
-		if q.cancel != nil {
-			q.cancel()
-		}
-		time.Sleep(100 * time.Millisecond)
-		if q.router != nil {
-			q.router.Close()
-		}
-	}()
+	q := newQueueForTest(t, cfg)
+	defer closeQueueForTest(q)
 
 	// Verify that the queue is properly configured for retries
-	if q.config.maxRetries != 3 {
-		t.Errorf("Expected maxRetries=3, got %d", q.config.maxRetries)
+	if q.targets[0].config.maxRetries != 3 {
+		t.Errorf("Expected maxRetries=3, got %d", q.targets[0].config.maxRetries)
 	}
 
-	if q.config.backoffSeconds != 2 {
-		t.Errorf("Expected backoffSeconds=2, got %d", q.config.backoffSeconds)
+	if q.targets[0].config.backoffSeconds != 2 {
+		t.Errorf("Expected backoffSeconds=2, got %d", q.targets[0].config.backoffSeconds)
 	}
 
-	if q.config.maxBackoffSeconds != 10 {
-		t.Errorf("Expected maxBackoffSeconds=10, got %d", q.config.maxBackoffSeconds)
+	if q.targets[0].config.maxBackoffSeconds != 10 {
+		t.Errorf("Expected maxBackoffSeconds=10, got %d", q.targets[0].config.maxBackoffSeconds)
 	}
 
 	// Test that we can send a message (retry behavior is handled by Watermill middleware)
@@ -381,8 +350,7 @@ func TestQueueRetryMechanism(t *testing.T) {
 		NewEntry: &filer_pb.Entry{Name: "test.txt"},
 	}
 
-	err = q.SendMessage("/test/retry", msg)
-	if err != nil {
+	if err := q.SendMessage("/test/retry", msg); err != nil {
 		t.Errorf("SendMessage() error = %v", err)
 	}
 }
@@ -419,21 +387,8 @@ func TestQueueNoDuplicateWebhooks(t *testing.T) {
 				bufferSize:        10,
 			}
 
-			q := &Queue{}
-			err := q.initialize(cfg)
-			if err != nil {
-				t.Fatalf("Failed to initialize queue: %v", err)
-			}
-
-			defer func() {
-				if q.cancel != nil {
-					q.cancel()
-				}
-				time.Sleep(100 * time.Millisecond)
-				if q.router != nil {
-					q.router.Close()
-				}
-			}()
+			q := newQueueForTest(t, cfg)
+			defer closeQueueForTest(q)
 
 			// Wait for router and subscriber to be fully ready
 			time.Sleep(200 * time.Millisecond)
@@ -444,8 +399,7 @@ func TestQueueNoDuplicateWebhooks(t *testing.T) {
 				},
 			}
 
-			err = q.SendMessage("/test/path", msg)
-			if err != nil {
+			if err := q.SendMessage("/test/path", msg); err != nil {
 				t.Errorf("SendMessage() error = %v", err)
 			}
 
@@ -607,3 +561,298 @@ func TestQueueSendMessageWithFilter(t *testing.T) {
 		})
 	}
 }
+
+type mapConfig struct {
+	values map[string]interface{}
+}
+
+func (m *mapConfig) GetString(key string) string {
+	v, _ := m.values[key].(string)
+	return v
+}
+
+func (m *mapConfig) GetBool(key string) bool {
+	v, _ := m.values[key].(bool)
+	return v
+}
+
+func (m *mapConfig) GetInt(key string) int {
+	v, _ := m.values[key].(int)
+	return v
+}
+
+func (m *mapConfig) GetStringSlice(key string) []string {
+	v, _ := m.values[key].([]string)
+	return v
+}
+
+func (m *mapConfig) SetDefault(key string, value interface{}) {}
+
+func (m *mapConfig) GetStringMap(key string) map[string]interface{} {
+	v, _ := m.values[key].(map[string]interface{})
+	return v
+}
+
+func TestNamedTargets(t *testing.T) {
+	var hitsA, hitsB atomic.Int32
+	serverA := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hitsA.Add(1)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer serverA.Close()
+	serverB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hitsB.Add(1)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer serverB.Close()
+
+	cfg := &mapConfig{values: map[string]interface{}{
+		"notification.webhook": map[string]interface{}{
+			"file_ingress": map[string]interface{}{
+				"enabled":       true,
+				"endpoint":      serverA.URL,
+				"path_prefixes": []string{"/data/"},
+			},
+			"metadata_extractor": map[string]interface{}{
+				"enabled":       true,
+				"endpoint":      serverB.URL,
+				"path_prefixes": []string{"/repository/"},
+			},
+			"disabled_one": map[string]interface{}{
+				"enabled":  false,
+				"endpoint": "https://example.com/never",
+			},
+		},
+		"notification.webhook.file_ingress.enabled":             true,
+		"notification.webhook.file_ingress.endpoint":            serverA.URL,
+		"notification.webhook.file_ingress.path_prefixes":       []string{"/data/"},
+		"notification.webhook.metadata_extractor.enabled":       true,
+		"notification.webhook.metadata_extractor.endpoint":      serverB.URL,
+		"notification.webhook.metadata_extractor.path_prefixes": []string{"/repository/"},
+	}}
+
+	q := &Queue{}
+	if !q.HasEnabledSubconfig(cfg, "notification.webhook.") {
+		t.Fatal("expected named subconfig to be detected as enabled")
+	}
+
+	targets, err := buildTargets(cfg, "notification.webhook.")
+	if err != nil {
+		t.Fatalf("buildTargets() error = %v", err)
+	}
+	if len(targets) != 2 {
+		t.Fatalf("expected 2 targets, got %d", len(targets))
+	}
+	if targets[0].name != "file_ingress" || targets[1].name != "metadata_extractor" {
+		t.Fatalf("unexpected target names: %s, %s", targets[0].name, targets[1].name)
+	}
+
+	if err := q.initialize(targets); err != nil {
+		t.Fatalf("initialize() error = %v", err)
+	}
+	defer closeQueueForTest(q)
+
+	time.Sleep(200 * time.Millisecond)
+
+	msg := &filer_pb.EventNotification{
+		NewEntry: &filer_pb.Entry{Name: "f.txt"},
+	}
+	for _, key := range []string{"/data/f.txt", "/repository/f.txt", "/elsewhere/f.txt"} {
+		if err := q.SendMessage(key, msg); err != nil {
+			t.Errorf("SendMessage(%q) error = %v", key, err)
+		}
+	}
+
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) && (hitsA.Load() == 0 || hitsB.Load() == 0) {
+		time.Sleep(50 * time.Millisecond)
+	}
+	time.Sleep(200 * time.Millisecond)
+
+	if got := hitsA.Load(); got != 1 {
+		t.Errorf("expected file_ingress to receive 1 event, got %d", got)
+	}
+	if got := hitsB.Load(); got != 1 {
+		t.Errorf("expected metadata_extractor to receive 1 event, got %d", got)
+	}
+}
+
+func TestQueueBurstKeepsPendingEvents(t *testing.T) {
+	var hits atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		time.Sleep(20 * time.Millisecond)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	cfg := &config{
+		endpoint:          server.URL,
+		timeoutSeconds:    5,
+		maxRetries:        0,
+		backoffSeconds:    1,
+		maxBackoffSeconds: 1,
+		nWorkers:          1,
+		bufferSize:        2,
+	}
+	q := newQueueForTest(t, cfg)
+	defer closeQueueForTest(q)
+
+	const total = 6
+	msg := &filer_pb.EventNotification{NewEntry: &filer_pb.Entry{Name: "f.txt"}}
+	for i := 0; i < total; i++ {
+		if err := q.SendMessage("/test/path", msg); err != nil {
+			t.Fatalf("SendMessage() error = %v", err)
+		}
+	}
+
+	deadline := time.Now().Add(10 * time.Second)
+	for time.Now().Before(deadline) && hits.Load() < total {
+		time.Sleep(50 * time.Millisecond)
+	}
+	if got := hits.Load(); got != total {
+		t.Errorf("expected %d deliveries, got %d", total, got)
+	}
+}
+
+// A saturated target still applies backpressure to the sender, but it must
+// not starve the targets after it: the event reaches a healthy endpoint
+// while the slow one is still out of pending slots.
+func TestSaturatedTargetDoesNotStarveOthers(t *testing.T) {
+	var hitsA, hitsB atomic.Int32
+	serverA := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hitsA.Add(1)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer serverA.Close()
+	serverB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hitsB.Add(1)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer serverB.Close()
+
+	newTestTarget := func(name, endpoint string) *target {
+		tgt, err := newTarget(name, &config{
+			endpoint:          endpoint,
+			timeoutSeconds:    5,
+			maxRetries:        0,
+			backoffSeconds:    1,
+			maxBackoffSeconds: 1,
+			nWorkers:          1,
+			bufferSize:        2,
+		})
+		if err != nil {
+			t.Fatalf("newTarget() error = %v", err)
+		}
+		return tgt
+	}
+	slow := newTestTarget("slow", serverA.URL)
+	fast := newTestTarget("fast", serverB.URL)
+
+	q := &Queue{}
+	if err := q.initialize([]*target{slow, fast}); err != nil {
+		t.Fatalf("initialize() error = %v", err)
+	}
+	defer closeQueueForTest(q)
+
+	for i := 0; i < cap(slow.pending); i++ {
+		slow.pending <- struct{}{}
+	}
+
+	done := make(chan error, 1)
+	go func() {
+		done <- q.SendMessage("/test/path", &filer_pb.EventNotification{NewEntry: &filer_pb.Entry{Name: "f.txt"}})
+	}()
+
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) && hitsB.Load() == 0 {
+		time.Sleep(20 * time.Millisecond)
+	}
+	if got := hitsB.Load(); got != 1 {
+		t.Fatalf("expected fast target to receive the event while slow is saturated, got %d", got)
+	}
+	select {
+	case err := <-done:
+		t.Fatalf("SendMessage() returned %v while the saturated target had no free slot", err)
+	default:
+	}
+
+	<-slow.pending
+	if err := <-done; err != nil {
+		t.Fatalf("SendMessage() error = %v", err)
+	}
+
+	deadline = time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) && hitsA.Load() == 0 {
+		time.Sleep(20 * time.Millisecond)
+	}
+	if got := hitsA.Load(); got != 1 {
+		t.Errorf("expected the saturated target to deliver once a slot freed, got %d", got)
+	}
+}
+
+// A disabled flat section keeps no target even when an endpoint is set —
+// the scaffold ships exactly that combination, and a named target must not
+// reactivate it.
+func TestBuildTargetsDisabledFlat(t *testing.T) {
+	cfg := &mapConfig{values: map[string]interface{}{
+		"notification.webhook": map[string]interface{}{
+			"enabled":  false,
+			"endpoint": "https://your-server.com/webhook",
+			"named": map[string]interface{}{
+				"enabled":  true,
+				"endpoint": "https://example.com/hook",
+			},
+		},
+		"notification.webhook.enabled":        false,
+		"notification.webhook.endpoint":       "https://your-server.com/webhook",
+		"notification.webhook.named.enabled":  true,
+		"notification.webhook.named.endpoint": "https://example.com/hook",
+	}}
+
+	targets, err := buildTargets(cfg, "notification.webhook.")
+	if err != nil {
+		t.Fatalf("buildTargets() error = %v", err)
+	}
+	if len(targets) != 1 || targets[0].name != "named" {
+		t.Fatalf("expected only the named target, got %v", targets)
+	}
+}
+
+// A failing endpoint must be retried maxRetries times before the event is
+// dead-lettered — the poison middleware has to sit outside the retry chain
+// or it swallows the first error and retries never run.
+func TestQueueRetriesBeforeDeadLetter(t *testing.T) {
+	var hits atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	cfg := &config{
+		endpoint:          server.URL,
+		timeoutSeconds:    5,
+		maxRetries:        2,
+		backoffSeconds:    1,
+		maxBackoffSeconds: 1,
+		nWorkers:          1,
+		bufferSize:        10,
+	}
+	q := newQueueForTest(t, cfg)
+	defer closeQueueForTest(q)
+
+	msg := &filer_pb.EventNotification{NewEntry: &filer_pb.Entry{Name: "f.txt"}}
+	if err := q.SendMessage("/test/path", msg); err != nil {
+		t.Fatalf("SendMessage() error = %v", err)
+	}
+
+	want := int32(cfg.maxRetries + 1)
+	deadline := time.Now().Add(15 * time.Second)
+	for time.Now().Before(deadline) && hits.Load() < want {
+		time.Sleep(50 * time.Millisecond)
+	}
+	if got := hits.Load(); got != want {
+		t.Errorf("expected %d delivery attempts (1 + %d retries), got %d", want, cfg.maxRetries, got)
+	}
+}
diff --git a/weed/operation/assign_file_id.go b/weed/operation/assign_file_id.go
index 8ae2049b38..3e9c29f813 100644
--- a/weed/operation/assign_file_id.go
+++ b/weed/operation/assign_file_id.go
@@ -38,6 +38,9 @@ type AssignResult struct {
 	Error     string              `json:"error,omitempty"`
 	Auth      security.EncodedJwt `json:"auth,omitempty"`
 	Replicas  []Location          `json:"replicas,omitempty"`
+	// Fsync carries the storage rule's fsync decision for the assigned path,
+	// so the upload request to the volume server can set ?fsync=true.
+	Fsync bool `json:"fsync,omitempty"`
 }
 
 func Assign(ctx context.Context, masterFn GetMasterFn, grpcDialOption grpc.DialOption, primaryRequest *VolumeAssignRequest, alternativeRequests ...*VolumeAssignRequest) (*AssignResult, error) {
@@ -154,11 +157,11 @@ func Assign(ctx context.Context, masterFn GetMasterFn, grpcDialOption grpc.DialO
 	return ret, lastError
 }
 
-func LookupJwt(master pb.ServerAddress, grpcDialOption grpc.DialOption, fileId string) (token security.EncodedJwt) {
+func LookupJwt(ctx context.Context, master pb.ServerAddress, grpcDialOption grpc.DialOption, fileId string) (token security.EncodedJwt) {
 
-	WithMasterServerClient(context.Background(), false, master, grpcDialOption, func(masterClient master_pb.SeaweedClient) error {
+	WithMasterServerClient(ctx, false, master, grpcDialOption, func(masterClient master_pb.SeaweedClient) error {
 
-		resp, grpcErr := masterClient.LookupVolume(context.Background(), &master_pb.LookupVolumeRequest{
+		resp, grpcErr := masterClient.LookupVolume(ctx, &master_pb.LookupVolumeRequest{
 			VolumeOrFileIds: []string{fileId},
 		})
 		if grpcErr != nil {
@@ -190,12 +193,20 @@ type StorageOption struct {
 	MaxFileNameLength uint32
 	Fsync             bool
 	SaveInside        bool
+	// EnforceLocation marks a location that came from a placement rule or an
+	// explicit request rather than a filer-level default: it must fail the
+	// assign when unsatisfiable instead of widening to anywhere.
+	EnforceLocation bool
 }
 
 func (so *StorageOption) TtlString() string {
 	return needle.SecondsToTTL(so.TtlSeconds)
 }
 
+// ToAssignRequests builds the assign request for this storage option. When the
+// location came from a filer-level default rather than a placement rule or an
+// explicit request, it also returns a location-stripped fallback for the case
+// where the preferred location cannot serve the write at all.
 func (so *StorageOption) ToAssignRequests(count int) (ar *VolumeAssignRequest, altRequest *VolumeAssignRequest) {
 	ar = &VolumeAssignRequest{
 		Count:               uint64(count),
@@ -208,16 +219,13 @@ func (so *StorageOption) ToAssignRequests(count int) (ar *VolumeAssignRequest, a
 		DataNode:            so.DataNode,
 		WritableVolumeCount: so.VolumeGrowthCount,
 	}
-	if so.DataCenter != "" || so.Rack != "" || so.DataNode != "" {
+	if !so.EnforceLocation && (so.DataCenter != "" || so.Rack != "" || so.DataNode != "") {
 		altRequest = &VolumeAssignRequest{
 			Count:               uint64(count),
 			Replication:         so.Replication,
 			Collection:          so.Collection,
 			Ttl:                 so.TtlString(),
 			DiskType:            so.DiskType,
-			DataCenter:          "",
-			Rack:                "",
-			DataNode:            "",
 			WritableVolumeCount: so.VolumeGrowthCount,
 		}
 	}
diff --git a/weed/operation/assign_file_id_test.go b/weed/operation/assign_file_id_test.go
new file mode 100644
index 0000000000..e14327d8e6
--- /dev/null
+++ b/weed/operation/assign_file_id_test.go
@@ -0,0 +1,42 @@
+package operation
+
+import "testing"
+
+// An enforced location on a storage option is a placement contract: the assign
+// request must carry it, and no widened fallback may follow it.
+func TestToAssignRequestsKeepsEnforcedLocation(t *testing.T) {
+	so := &StorageOption{
+		Collection:      "dump",
+		Rack:            "l1000",
+		DataCenter:      "dc1",
+		EnforceLocation: true,
+	}
+	ar, alt := so.ToAssignRequests(1)
+	if ar.DataCenter != "dc1" || ar.Rack != "l1000" {
+		t.Fatalf("expected the rule's location, got dc=%q rack=%q", ar.DataCenter, ar.Rack)
+	}
+	if alt != nil {
+		t.Fatalf("enforced location must not be widened, got alt dc=%q rack=%q", alt.DataCenter, alt.Rack)
+	}
+}
+
+// A filer-level default location is a preference: the request still carries
+// it, and a location-stripped fallback follows so a preferred but unservable
+// location does not fail the write.
+func TestToAssignRequestsWidensDefaultLocation(t *testing.T) {
+	so := &StorageOption{
+		Collection: "dump",
+		Rack:       "l1000",
+		DataCenter: "dc1",
+	}
+	ar, alt := so.ToAssignRequests(1)
+	if ar.DataCenter != "dc1" || ar.Rack != "l1000" {
+		t.Fatalf("expected the preferred location, got dc=%q rack=%q", ar.DataCenter, ar.Rack)
+	}
+	if alt == nil || alt.DataCenter != "" || alt.Rack != "" {
+		t.Fatalf("default location should keep a widened fallback, got %+v", alt)
+	}
+	if alt.Collection != "dump" || alt.Replication != ar.Replication {
+		t.Fatalf("fallback must preserve the rest of the option, got %+v", alt)
+	}
+}
diff --git a/weed/operation/chunked_file.go b/weed/operation/chunked_file.go
index 1fedb74bc4..a5746c8462 100644
--- a/weed/operation/chunked_file.go
+++ b/weed/operation/chunked_file.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
@@ -101,6 +102,9 @@ func readChunkNeedle(fileUrl string, w io.Writer, offset int64, jwt string) (wri
 	if offset > 0 {
 		req.Header.Set("Range", fmt.Sprintf("bytes=%d-", offset))
 	}
+	if jwt != "" {
+		req.Header.Set("Authorization", security.BearerPrefix+jwt)
+	}
 
 	resp, err := util_http.Do(req)
 	if err != nil {
@@ -118,7 +122,7 @@ func readChunkNeedle(fileUrl string, w io.Writer, offset int64, jwt string) (wri
 	case http.StatusPartialContent:
 		break
 	default:
-		return written, fmt.Errorf("Read chunk needle error: [%d] %s", resp.StatusCode, fileUrl)
+		return written, util_http.StatusError(fileUrl, resp)
 
 	}
 	return io.Copy(w, resp.Body)
diff --git a/weed/operation/delete_content.go b/weed/operation/delete_content.go
index 5028fbf488..297f665150 100644
--- a/weed/operation/delete_content.go
+++ b/weed/operation/delete_content.go
@@ -45,11 +45,11 @@ func DeleteFileIds(masterFn GetMasterFn, usePublicUrl bool, grpcDialOption grpc.
 		return
 	}
 
-	return DeleteFileIdsWithLookupVolumeId(grpcDialOption, fileIds, lookupFunc)
+	return DeleteFileIdsWithLookupVolumeId(context.Background(), grpcDialOption, fileIds, lookupFunc)
 
 }
 
-func DeleteFileIdsWithLookupVolumeId(grpcDialOption grpc.DialOption, fileIds []string, lookupFunc func(vid []string) (map[string]*LookupResult, error)) []*volume_server_pb.DeleteResult {
+func DeleteFileIdsWithLookupVolumeId(ctx context.Context, grpcDialOption grpc.DialOption, fileIds []string, lookupFunc func(vid []string) (map[string]*LookupResult, error)) []*volume_server_pb.DeleteResult {
 
 	var ret []*volume_server_pb.DeleteResult
 
@@ -117,7 +117,7 @@ func DeleteFileIdsWithLookupVolumeId(grpcDialOption grpc.DialOption, fileIds []s
 		go func(server pb.ServerAddress, fidList []string) {
 			defer wg.Done()
 
-			resultChan <- DeleteFileIdsAtOneVolumeServer(server, grpcDialOption, fidList, false)
+			resultChan <- DeleteFileIdsAtOneVolumeServer(ctx, server, grpcDialOption, fidList, false)
 
 		}(server, fidList)
 	}
@@ -133,7 +133,7 @@ func DeleteFileIdsWithLookupVolumeId(grpcDialOption grpc.DialOption, fileIds []s
 
 // DeleteFileIdsAtOneVolumeServer deletes a list of files that is on one volume server via gRpc
 // Returns individual results for each file ID. Check result.Error for per-file failures.
-func DeleteFileIdsAtOneVolumeServer(volumeServer pb.ServerAddress, grpcDialOption grpc.DialOption, fileIds []string, includeCookie bool) []*volume_server_pb.DeleteResult {
+func DeleteFileIdsAtOneVolumeServer(ctx context.Context, volumeServer pb.ServerAddress, grpcDialOption grpc.DialOption, fileIds []string, includeCookie bool) []*volume_server_pb.DeleteResult {
 
 	var ret []*volume_server_pb.DeleteResult
 
@@ -144,7 +144,7 @@ func DeleteFileIdsAtOneVolumeServer(volumeServer pb.ServerAddress, grpcDialOptio
 			SkipCookieCheck: !includeCookie,
 		}
 
-		resp, err := volumeServerClient.BatchDelete(context.Background(), req)
+		resp, err := volumeServerClient.BatchDelete(ctx, req)
 
 		// fmt.Printf("deleted %v %v: %v\n", fileIds, err, resp)
 
diff --git a/weed/operation/grpc_client.go b/weed/operation/grpc_client.go
index 9e15ba1159..e9063e4b3a 100644
--- a/weed/operation/grpc_client.go
+++ b/weed/operation/grpc_client.go
@@ -11,11 +11,18 @@ import (
 )
 
 func WithVolumeServerClient(streamingMode bool, volumeServer pb.ServerAddress, grpcDialOption grpc.DialOption, fn func(volume_server_pb.VolumeServerClient) error) error {
+	return WithVolumeServerClientOptions(streamingMode, volumeServer, fn, grpcDialOption)
+}
+
+// WithVolumeServerClientOptions is WithVolumeServerClient with extra dial
+// options appended after the TLS option, so a caller dialing an untrusted
+// source address can pin the validated endpoint at connect time.
+func WithVolumeServerClientOptions(streamingMode bool, volumeServer pb.ServerAddress, fn func(volume_server_pb.VolumeServerClient) error, grpcDialOptions ...grpc.DialOption) error {
 
 	return pb.WithGrpcClient(context.Background(), streamingMode, 0, func(grpcConnection *grpc.ClientConn) error {
 		client := volume_server_pb.NewVolumeServerClient(grpcConnection)
 		return fn(client)
-	}, volumeServer.ToGrpcAddress(), false, grpcDialOption)
+	}, volumeServer.ToGrpcAddress(), false, grpcDialOptions...)
 
 }
 
diff --git a/weed/operation/lookup.go b/weed/operation/lookup.go
index eabea475ef..6719f289b0 100644
--- a/weed/operation/lookup.go
+++ b/weed/operation/lookup.go
@@ -15,10 +15,13 @@ import (
 )
 
 type Location struct {
-	Url        string `json:"url,omitempty"`
-	PublicUrl  string `json:"publicUrl,omitempty"`
-	DataCenter string `json:"dataCenter,omitempty"`
-	GrpcPort   int    `json:"grpcPort,omitempty"`
+	Url               string `json:"url,omitempty"`
+	PublicUrl         string `json:"publicUrl,omitempty"`
+	DataCenter        string `json:"dataCenter,omitempty"`
+	GrpcPort          int    `json:"grpcPort,omitempty"`
+	DataInRemote      bool   `json:"dataInRemote,omitempty"`
+	ReadOnly          bool   `json:"readOnly,omitempty"`
+	ReadOnlyCanDelete bool   `json:"readOnlyCanDelete,omitempty"`
 }
 
 func (l *Location) ServerAddress() pb.ServerAddress {
@@ -41,6 +44,12 @@ var (
 	vc VidCache // caching of volume locations, re-check if after 10 minutes
 )
 
+// LookupFileId resolves a "<vid>,<cookie>" file id to one HTTP read URL,
+// preferring a volume server whose replica holds the data locally over one
+// backed by remote-tier storage. If no local replica is known the function
+// falls back to a random remote replica. The returned jwt is the read
+// authorization the master stamped on the volume; pass it through to the
+// volume server on the read request.
 func LookupFileId(masterFn GetMasterFn, grpcDialOption grpc.DialOption, fileId string) (fullUrl string, jwt string, err error) {
 	parts := strings.Split(fileId, ",")
 	if len(parts) != 2 {
@@ -53,7 +62,20 @@ func LookupFileId(masterFn GetMasterFn, grpcDialOption grpc.DialOption, fileId s
 	if len(lookup.Locations) == 0 {
 		return "", jwt, errors.New("File Not Found")
 	}
-	return "http://" + lookup.Locations[rand.IntN(len(lookup.Locations))].Url + "/" + fileId, lookup.Jwt, nil
+
+	localUrls := make([]string, 0, len(lookup.Locations))
+	for _, loc := range lookup.Locations {
+		if !loc.DataInRemote {
+			localUrls = append(localUrls, loc.Url)
+		}
+	}
+	if len(localUrls) == 0 {
+		for _, loc := range lookup.Locations {
+			localUrls = append(localUrls, loc.Url)
+		}
+	}
+
+	return "http://" + localUrls[rand.IntN(len(localUrls))] + "/" + fileId, lookup.Jwt, nil
 }
 
 func LookupVolumeId(masterFn GetMasterFn, grpcDialOption grpc.DialOption, vid string) (*LookupResult, error) {
@@ -67,18 +89,21 @@ func InvalidateVolumeIdLocationCache(vid string) {
 }
 
 // LookupVolumeIds find volume locations by cache and actual lookup
-func LookupVolumeIds(masterFn GetMasterFn, grpcDialOption grpc.DialOption, vids []string) (map[string]*LookupResult, error) {
+func LookupVolumeIds(masterFn GetMasterFn, grpcDialOption grpc.DialOption, vids []string, useCache ...bool) (map[string]*LookupResult, error) {
 	ret := make(map[string]*LookupResult)
 	var unknown_vids []string
+	cacheLocations := len(useCache) == 0 || useCache[0]
 
 	//check vid cache first
 	for _, vid := range vids {
-		locations, cacheErr := vc.Get(vid)
-		if cacheErr == nil {
-			ret[vid] = &LookupResult{VolumeOrFileId: vid, Locations: locations}
-		} else {
-			unknown_vids = append(unknown_vids, vid)
+		if cacheLocations {
+			locations, cacheErr := vc.Get(vid)
+			if cacheErr == nil {
+				ret[vid] = &LookupResult{VolumeOrFileId: vid, Locations: locations}
+				continue
+			}
 		}
+		unknown_vids = append(unknown_vids, vid)
 	}
 	//return success if all volume ids are known
 	if len(unknown_vids) == 0 {
@@ -102,13 +127,16 @@ func LookupVolumeIds(masterFn GetMasterFn, grpcDialOption grpc.DialOption, vids
 			var locations []Location
 			for _, loc := range vidLocations.Locations {
 				locations = append(locations, Location{
-					Url:        loc.Url,
-					PublicUrl:  loc.PublicUrl,
-					DataCenter: loc.DataCenter,
-					GrpcPort:   int(loc.GrpcPort),
+					Url:               loc.Url,
+					PublicUrl:         loc.PublicUrl,
+					DataCenter:        loc.DataCenter,
+					GrpcPort:          int(loc.GrpcPort),
+					DataInRemote:      loc.DataInRemote,
+					ReadOnly:          loc.ReadOnly,
+					ReadOnlyCanDelete: loc.ReadOnlyCanDelete,
 				})
 			}
-			if vidLocations.Error == "" {
+			if cacheLocations && vidLocations.Error == "" {
 				vc.Set(vidLocations.VolumeOrFileId, locations, 10*time.Minute)
 			}
 			ret[vidLocations.VolumeOrFileId] = &LookupResult{
diff --git a/weed/operation/submit.go b/weed/operation/submit.go
index 1d94f5bab3..347b1647fd 100644
--- a/weed/operation/submit.go
+++ b/weed/operation/submit.go
@@ -10,6 +10,7 @@ import (
 	"path"
 	"strconv"
 	"strings"
+	"sync"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 
@@ -50,6 +51,10 @@ type StoragePreference struct {
 
 type GetMasterFn func(ctx context.Context) pb.ServerAddress
 
+// submitUploadWorkers bounds how many files one SubmitFiles call uploads at
+// once; the batch assign above already fetched all their file ids.
+const submitUploadWorkers = 4
+
 func SubmitFiles(masterFn GetMasterFn, grpcDialOption grpc.DialOption, files []*FilePart, pref StoragePreference, usePublicUrl bool) ([]SubmitResult, error) {
 	results := make([]SubmitResult, len(files))
 	var totalBytes int64
@@ -72,8 +77,11 @@ func SubmitFiles(masterFn GetMasterFn, grpcDialOption grpc.DialOption, files []*
 	}
 	ret, err := Assign(context.Background(), masterFn, grpcDialOption, ar)
 	if err != nil {
-		for index := range files {
+		for index, file := range files {
 			results[index].Error = err.Error()
+			if closer, ok := file.Reader.(io.Closer); ok {
+				closer.Close()
+			}
 		}
 		return results, err
 	}
@@ -87,14 +95,35 @@ func SubmitFiles(masterFn GetMasterFn, grpcDialOption grpc.DialOption, files []*
 			file.Server = ret.PublicUrl
 		}
 		file.Pref = pref
-		results[index].Size, err = file.Upload(pref.MaxMB, masterFn, usePublicUrl, ret.Auth, grpcDialOption)
-		if err != nil {
-			results[index].Error = err.Error()
-		}
 		results[index].Fid = file.Fid
 		results[index].FileUrl = ret.PublicUrl + "/" + file.Fid
 	}
-	return results, nil
+
+	var wg sync.WaitGroup
+	var lastErrLock sync.Mutex
+	jobs := make(chan int)
+	for w := 0; w < min(submitUploadWorkers, len(files)); w++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for index := range jobs {
+				size, uploadErr := files[index].Upload(pref.MaxMB, masterFn, usePublicUrl, ret.Auth, grpcDialOption)
+				results[index].Size = size
+				if uploadErr != nil {
+					results[index].Error = uploadErr.Error()
+					lastErrLock.Lock()
+					err = uploadErr
+					lastErrLock.Unlock()
+				}
+			}
+		}()
+	}
+	for index := range files {
+		jobs <- index
+	}
+	close(jobs)
+	wg.Wait()
+	return results, err
 }
 
 func NewFileParts(fullPathFilenames []string) (ret []*FilePart, err error) {
@@ -118,6 +147,8 @@ func newFilePart(fullPathFilename string) (ret *FilePart, err error) {
 	fi, fiErr := fh.Stat()
 	if fiErr != nil {
 		glog.V(0).Info("Failed to stat file:", fullPathFilename)
+		fh.Close()
+		ret.Reader = nil
 		return ret, fiErr
 	}
 	ret.ModTime = fi.ModTime().UTC().Unix()
diff --git a/weed/operation/tail_volume.go b/weed/operation/tail_volume.go
index 8decc2df9f..5538701ed4 100644
--- a/weed/operation/tail_volume.go
+++ b/weed/operation/tail_volume.go
@@ -25,11 +25,11 @@ func TailVolume(masterFn GetMasterFn, grpcDialOption grpc.DialOption, vid needle
 
 	volumeServer := lookup.Locations[0].ServerAddress()
 
-	return TailVolumeFromSource(volumeServer, grpcDialOption, vid, sinceNs, timeoutSeconds, fn)
+	return TailVolumeFromSource(volumeServer, vid, sinceNs, timeoutSeconds, fn, grpcDialOption)
 }
 
-func TailVolumeFromSource(volumeServer pb.ServerAddress, grpcDialOption grpc.DialOption, vid needle.VolumeId, sinceNs uint64, idleTimeoutSeconds int, fn func(n *needle.Needle) error) error {
-	return WithVolumeServerClient(true, volumeServer, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+func TailVolumeFromSource(volumeServer pb.ServerAddress, vid needle.VolumeId, sinceNs uint64, idleTimeoutSeconds int, fn func(n *needle.Needle) error, grpcDialOptions ...grpc.DialOption) error {
+	return WithVolumeServerClientOptions(true, volumeServer, func(client volume_server_pb.VolumeServerClient) error {
 		ctx, cancel := context.WithCancel(context.Background())
 		defer cancel()
 
@@ -90,5 +90,5 @@ func TailVolumeFromSource(volumeServer pb.ServerAddress, grpcDialOption grpc.Dia
 
 		}
 		return nil
-	})
+	}, grpcDialOptions...)
 }
diff --git a/weed/operation/upload_chunked.go b/weed/operation/upload_chunked.go
index db8dec89cc..8124500dfa 100644
--- a/weed/operation/upload_chunked.go
+++ b/weed/operation/upload_chunked.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"hash"
 	"io"
+	"net/http"
 	"sort"
 	"sync"
 	"time"
@@ -45,6 +46,7 @@ type ChunkedUploadOption struct {
 	Cipher          bool // encrypt data on volume servers
 	AssignFunc      func(ctx context.Context, count int, expectedDataSize uint64) (*VolumeAssignRequest, *AssignResult, error)
 	UploadFunc      func(ctx context.Context, data []byte, option *UploadOption) (*UploadResult, error) // Optional: for testing
+	LookupJwtFunc   func(ctx context.Context, fileId string) security.EncodedJwt                        // Optional: renews the volume JWT for a cleanup delete
 }
 
 var chunkBufferPool = sync.Pool{
@@ -213,8 +215,8 @@ uploadLoop:
 				// failed write can still leave a copy behind. No chunk will name
 				// this fid whether we retry or give up here, and an unreferenced
 				// needle is not garbage vacuum can find, so drop it either way.
-				deleteChunkFromHolders(chunkHolders(assignResult), assignResult.Fid, jwt)
-				if attempt == chunkAssignAttempts || !shouldReassignUpload(uploadResultErr) || objectFailed() {
+				deleteChunkFromHolders(chunkHolders(assignResult), assignResult.Fid, jwt, opt)
+				if attempt == chunkAssignAttempts || !ShouldReassignUpload(uploadResultErr) || objectFailed() {
 					break
 				}
 				glog.V(2).Infof("re-assigning chunk at offset %d after attempt %d/%d: %v", offset, attempt, chunkAssignAttempts, uploadResultErr)
@@ -306,7 +308,7 @@ const chunkAssignAttempts = 3
 func uploadChunk(ctx context.Context, assignResult *AssignResult, data []byte, jwt security.EncodedJwt, md5b64 string, opt *ChunkedUploadOption) (*UploadResult, error) {
 	holders := chunkHolders(assignResult)
 	if opt.UploadFunc == nil && !opt.Cipher && len(holders) > 1 {
-		return uploadChunkToHolders(ctx, holders, assignResult.Fid, data, jwt, md5b64, opt)
+		return uploadChunkToHolders(ctx, holders, assignResult.Fid, data, jwt, md5b64, assignResult.Fsync, opt)
 	}
 	uploadOption := &UploadOption{
 		UploadUrl:         fmt.Sprintf("http://%s/%s", assignResult.Url, assignResult.Fid),
@@ -325,6 +327,9 @@ func uploadChunk(ctx context.Context, assignResult *AssignResult, data []byte, j
 		// every holder and re-uploading the chunk.
 		MaxAttempts: 1,
 	}
+	if assignResult.Fsync {
+		uploadOption.UploadUrl += "?fsync=true"
+	}
 	// Use mock upload function if provided (for testing), otherwise use real uploader
 	if opt.UploadFunc != nil {
 		return opt.UploadFunc(ctx, data, uploadOption)
@@ -351,7 +356,7 @@ func chunkHolders(assignResult *AssignResult) []string {
 // type=replicate). On the first failure it cancels the remaining uploads and
 // deletes any copies that already landed, so a partial fan-out leaves no
 // orphaned needle the caller cannot see.
-func uploadChunkToHolders(ctx context.Context, hosts []string, fid string, data []byte, jwt security.EncodedJwt, md5b64 string, opt *ChunkedUploadOption) (*UploadResult, error) {
+func uploadChunkToHolders(ctx context.Context, hosts []string, fid string, data []byte, jwt security.EncodedJwt, md5b64 string, fsync bool, opt *ChunkedUploadOption) (*UploadResult, error) {
 	uploader, err := NewUploader()
 	if err != nil {
 		return nil, fmt.Errorf("create uploader: %w", err)
@@ -367,8 +372,12 @@ func uploadChunkToHolders(ctx context.Context, hosts []string, fid string, data
 	outcomes := make(chan outcome, len(hosts))
 	for _, host := range hosts {
 		go func(host string) {
+			uploadUrl := fmt.Sprintf("http://%s/%s?type=replicate", host, fid)
+			if fsync {
+				uploadUrl += "&fsync=true"
+			}
 			uploadOption := &UploadOption{
-				UploadUrl:         fmt.Sprintf("http://%s/%s?type=replicate", host, fid),
+				UploadUrl:         uploadUrl,
 				Cipher:            false,
 				IsInputCompressed: false,
 				MimeType:          opt.MimeType,
@@ -393,7 +402,7 @@ func uploadChunkToHolders(ctx context.Context, hosts []string, fid string, data
 			if firstErr == nil {
 				firstErr = o.err
 				cancel()
-			} else if !shouldReassignUpload(firstErr) && shouldReassignUpload(o.err) {
+			} else if !ShouldReassignUpload(firstErr) && ShouldReassignUpload(o.err) {
 				firstErr = o.err
 			}
 		} else {
@@ -406,19 +415,46 @@ func uploadChunkToHolders(ctx context.Context, hosts []string, fid string, data
 	if firstErr != nil {
 		// A failed fan-out records no chunk, so roll back the copies that landed
 		// before the cancel rather than leaking them as orphans.
-		deleteChunkFromHolders(succeeded, fid, jwt)
+		deleteChunkFromHolders(succeeded, fid, jwt, opt)
 		return nil, firstErr
 	}
 	return first, nil
 }
 
+// cleanupJwtLookupTimeout bounds a cleanup-token renewal, covering the wait
+// for a master plus the lookup RPC, so a master outage cannot stall the
+// rollback of a failed fan-out.
+const cleanupJwtLookupTimeout = 10 * time.Second
+
 // deleteChunkFromHolders best-effort removes a needle from each holder it landed
 // on, using type=replicate so the volume drops only its local copy. A failed
 // delete falls back to vacuum reclaiming the orphan.
-func deleteChunkFromHolders(hosts []string, fid string, jwt security.EncodedJwt) {
+func deleteChunkFromHolders(hosts []string, fid string, jwt security.EncodedJwt, opt *ChunkedUploadOption) {
+	// An unresponsive holder can stall the upload past the write JWT's expiry,
+	// so renew the token whenever a holder rejects the delete as unauthorized.
+	// Each holder's delete is retried at most once, and a slow holder that
+	// outlives the renewed token can still trigger another renewal.
+	deleteJwt := jwt
 	for _, host := range hosts {
-		if err := util_http.Delete(fmt.Sprintf("http://%s/%s?type=replicate", host, fid), string(jwt)); err != nil {
+		deleteUrl := fmt.Sprintf("http://%s/%s?type=replicate", host, fid)
+		body, status, err := util_http.DeleteProxied(deleteUrl, string(deleteJwt))
+		if status == http.StatusUnauthorized && opt.LookupJwtFunc != nil {
+			lookupCtx, cancel := context.WithTimeout(context.Background(), cleanupJwtLookupTimeout)
+			token := opt.LookupJwtFunc(lookupCtx, fid)
+			cancel()
+			if token != "" {
+				deleteJwt = token
+				body, status, err = util_http.DeleteProxied(deleteUrl, string(deleteJwt))
+			}
+		}
+		if err != nil {
 			glog.Warningf("replica fan-out cleanup: delete %s from %s: %v", fid, host, err)
+			continue
+		}
+		switch status {
+		case http.StatusNotFound, http.StatusNoContent, http.StatusAccepted, http.StatusOK:
+		default:
+			glog.Warningf("replica fan-out cleanup: delete %s from %s: status %d: %s", fid, host, status, body)
 		}
 	}
 }
diff --git a/weed/operation/upload_chunked_test.go b/weed/operation/upload_chunked_test.go
index 1f26256a1e..87ab218ebc 100644
--- a/weed/operation/upload_chunked_test.go
+++ b/weed/operation/upload_chunked_test.go
@@ -26,13 +26,11 @@ func TestUploadReaderInChunksReturnsPartialResultsOnError(t *testing.T) {
 	testData := bytes.Repeat([]byte("test data for chunk upload failure testing"), 1000) // ~40KB
 	reader := bytes.NewReader(testData)
 
-	uploadAttempts := 0
+	var uploadAttempts int32
 
 	// Create a mock assign function that succeeds for first chunk, then fails
 	assignFunc := func(ctx context.Context, count int, expectedDataSize uint64) (*VolumeAssignRequest, *AssignResult, error) {
-		uploadAttempts++
-
-		if uploadAttempts == 1 {
+		if atomic.AddInt32(&uploadAttempts, 1) == 1 {
 			// First chunk succeeds
 			return nil, &AssignResult{
 				Fid:       "test-fid-1,1234",
@@ -280,7 +278,7 @@ func TestUploadChunkToHoldersRollsBackOnPartialFailure(t *testing.T) {
 	defer bad.Close()
 
 	hosts := []string{strings.TrimPrefix(good.URL, "http://"), strings.TrimPrefix(bad.URL, "http://")}
-	_, err := uploadChunkToHolders(context.Background(), hosts, fid, []byte("hello world"), "", "", &ChunkedUploadOption{})
+	_, err := uploadChunkToHolders(context.Background(), hosts, fid, []byte("hello world"), "", "", false, &ChunkedUploadOption{})
 
 	if err == nil {
 		t.Fatal("expected error from a partial fan-out")
@@ -639,3 +637,130 @@ func TestUploadReaderInChunksDoesNotMultiplyRelayAttempts(t *testing.T) {
 		t.Errorf("expected every abandoned fid to be rolled back, got %d deletes", got)
 	}
 }
+
+// TestUploadReaderInChunksAppendsFsyncWhenAssigned verifies that a chunk
+// assignment carrying the storage rule's fsync decision lands as ?fsync=true
+// on the volume server upload URL.
+func TestUploadReaderInChunksAppendsFsyncWhenAssigned(t *testing.T) {
+	testData := []byte("data needing fsync")
+	reader := bytes.NewReader(testData)
+
+	assignFunc := func(ctx context.Context, count int, expectedDataSize uint64) (*VolumeAssignRequest, *AssignResult, error) {
+		return nil, &AssignResult{
+			Fid:       "test-fid,1234",
+			Url:       "http://test-volume:8080",
+			PublicUrl: "http://test-volume:8080",
+			Count:     1,
+			Fsync:     true,
+		}, nil
+	}
+
+	var gotUploadUrl string
+	uploadFunc := func(ctx context.Context, data []byte, option *UploadOption) (*UploadResult, error) {
+		gotUploadUrl = option.UploadUrl
+		return &UploadResult{
+			Size:       uint32(len(data)),
+			ContentMd5: "mock-md5-hash",
+		}, nil
+	}
+
+	if _, err := UploadReaderInChunks(context.Background(), reader, &ChunkedUploadOption{
+		ChunkSize:       8 * 1024,
+		SmallFileLimit:  256,
+		SaveSmallInline: false,
+		AssignFunc:      assignFunc,
+		UploadFunc:      uploadFunc,
+	}); err != nil {
+		t.Fatalf("Expected successful upload, got error: %v", err)
+	}
+	if !strings.Contains(gotUploadUrl, "?fsync=true") {
+		t.Errorf("Expected the upload URL to carry ?fsync=true when the assignment says fsync, got %q", gotUploadUrl)
+	}
+}
+
+// A holder that stalls past the assignment JWT's expiry answers the rollback
+// delete with 401; the cleanup renews the token instead of leaking the copy.
+func TestDeleteChunkFromHoldersRenewsExpiredJwt(t *testing.T) {
+	var staleDeletes, freshDeletes int32
+	holder := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodDelete {
+			w.WriteHeader(http.StatusCreated)
+			return
+		}
+		switch r.Header.Get("Authorization") {
+		case "Bearer fresh-jwt":
+			atomic.AddInt32(&freshDeletes, 1)
+			w.WriteHeader(http.StatusAccepted)
+		default:
+			atomic.AddInt32(&staleDeletes, 1)
+			w.WriteHeader(http.StatusUnauthorized)
+			fmt.Fprint(w, `{"error":"wrong jwt"}`)
+		}
+	}))
+	defer holder.Close()
+
+	lookups := 0
+	deleteChunkFromHolders(
+		[]string{strings.TrimPrefix(holder.URL, "http://")},
+		"1,0a0b0c0d",
+		"stale-jwt",
+		&ChunkedUploadOption{
+			LookupJwtFunc: func(ctx context.Context, fileId string) security.EncodedJwt {
+				lookups++
+				return "fresh-jwt"
+			},
+		},
+	)
+
+	if lookups != 1 {
+		t.Fatalf("expected one jwt renewal, got %d", lookups)
+	}
+	if atomic.LoadInt32(&freshDeletes) != 1 {
+		t.Fatalf("expected the delete retried with the fresh jwt, got %d fresh deletes", freshDeletes)
+	}
+}
+
+// A later holder that rejects the renewed token can trigger another renewal:
+// the one-retry limit is per holder, not per cleanup pass.
+func TestDeleteChunkFromHoldersRenewsPerHolder(t *testing.T) {
+	var acceptedDeletes int32
+	holder := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodDelete {
+			w.WriteHeader(http.StatusCreated)
+			return
+		}
+		if r.Header.Get("Authorization") == "Bearer jwt-2" {
+			atomic.AddInt32(&acceptedDeletes, 1)
+			w.WriteHeader(http.StatusAccepted)
+			return
+		}
+		w.WriteHeader(http.StatusUnauthorized)
+		fmt.Fprint(w, `{"error":"wrong jwt"}`)
+	}))
+	defer holder.Close()
+
+	tokens := []security.EncodedJwt{"jwt-1", "jwt-2"}
+	lookups := 0
+	deleteChunkFromHolders(
+		[]string{
+			strings.TrimPrefix(holder.URL, "http://"),
+			strings.TrimPrefix(holder.URL, "http://"),
+		},
+		"1,0a0b0c0d",
+		"stale-jwt",
+		&ChunkedUploadOption{
+			LookupJwtFunc: func(ctx context.Context, fileId string) security.EncodedJwt {
+				token := tokens[lookups]
+				lookups++
+				return token
+			},
+		},
+	)
+
+	if lookups != 2 {
+		t.Fatalf("expected a renewal per rejecting holder, got %d", lookups)
+	}
+	if atomic.LoadInt32(&acceptedDeletes) != 1 {
+		t.Fatalf("expected the second holder's retried delete to land, got %d", acceptedDeletes)
+	}
+}
diff --git a/weed/operation/upload_content.go b/weed/operation/upload_content.go
index d65fbbb863..081d295e66 100644
--- a/weed/operation/upload_content.go
+++ b/weed/operation/upload_content.go
@@ -17,6 +17,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/util/request_id"
@@ -42,7 +43,7 @@ func GenUploadUrlProxy(filerAddress string) func(host, fileId string) string {
 		if filerAddress == "" {
 			return fmt.Sprintf("http://%s/%s", host, fileId)
 		}
-		return fmt.Sprintf("http://%s/?proxyChunkId=%s", filerAddress, fileId)
+		return util_http.ProxyChunkUrl(filerAddress, fileId)
 	}
 }
 
@@ -62,6 +63,11 @@ type UploadOption struct {
 	SourceUrl         string                           // optional: for logging when reading from a remote source
 	MaxAttempts       int                              // <=0 uses the default
 	GenUploadUrl      func(host, fileId string) string // if nil → fallback "http://{host}/{fileId}"
+	FilerJwt          security.FilerJwtProvider        // credential for proxy chunk URLs; nil → process-wide jwt.filer_signing
+
+	// stallWatchdogDisarmed turns the watchdog off for this upload's later
+	// attempts once it fired: a re-arm could burn every retry.
+	stallWatchdogDisarmed bool
 }
 
 type UploadResult struct {
@@ -124,13 +130,14 @@ var (
 // StatusCode 0 means the request never got a response — a transport failure.
 type uploadStatusError struct {
 	StatusCode int
+	stalled    bool // the stall watchdog cancelled this attempt's request
 	err        error
 }
 
 func (e *uploadStatusError) Error() string { return e.err.Error() }
 func (e *uploadStatusError) Unwrap() error { return e.err }
 
-// shouldReassignUpload reports whether an upload error means the client should
+// ShouldReassignUpload reports whether an upload error means the client should
 // ask for a fresh volume assignment and retry on another volume.
 //
 // On the write path a volume server only 5xxs on a ReplicatedWrite failure
@@ -139,7 +146,7 @@ func (e *uploadStatusError) Unwrap() error { return e.err }
 // assigned target never answered (down/unreachable), also reassignable. A 4xx
 // is a genuine client error and is surfaced. Errors without a status come from
 // the AssignVolume RPC or request setup; retry only transient transport ones.
-func shouldReassignUpload(err error) bool {
+func ShouldReassignUpload(err error) bool {
 	if err == nil {
 		return false
 	}
@@ -162,6 +169,11 @@ type HTTPClient interface {
 // Uploader
 type Uploader struct {
 	httpClient HTTPClient
+	// fastUploadHosts records the wire rate of the last sizeable upload to
+	// each host, so a later upload stalling far below it can be blamed on
+	// that one connection rather than the link and get cancelled for a retry
+	// on a fresh conn.
+	fastUploadHosts sync.Map // host:port → fastHostMark
 }
 
 func NewUploader() (*Uploader, error) {
@@ -194,11 +206,12 @@ func NewUploaderWithHttpClient(httpClient HTTPClient) *Uploader {
 	}
 }
 
-func (uploader *Uploader) uploadWithRetryData(assignFn func() (fileId string, host string, auth security.EncodedJwt, err error), uploadOption *UploadOption, data []byte) (fileId string, uploadResult *UploadResult, err error) {
+func (uploader *Uploader) uploadWithRetryData(assignFn func() (fileId string, host string, auth security.EncodedJwt, fsync bool, err error), uploadOption *UploadOption, data []byte) (fileId string, uploadResult *UploadResult, err error) {
 	doUploadFunc := func() error {
 		var host string
 		var auth security.EncodedJwt
-		fileId, host, auth, err = assignFn()
+		var fsync bool
+		fileId, host, auth, fsync, err = assignFn()
 		if err != nil {
 			return err
 		}
@@ -208,7 +221,20 @@ func (uploader *Uploader) uploadWithRetryData(assignFn func() (fileId string, ho
 			genUrl = func(host, fileId string) string { return fmt.Sprintf("http://%s/%s", host, fileId) }
 		}
 		uploadOption.UploadUrl = genUrl(host, fileId)
+		if fsync {
+			uploadOption.UploadUrl = util_http.AppendQueryParameter(uploadOption.UploadUrl, "fsync", "true")
+		}
 		uploadOption.Jwt = auth
+		if util_http.IsProxyChunkUrl(uploadOption.UploadUrl) {
+			// The request addresses the filer, which authorizes it and mints the
+			// volume credential itself. The AssignVolume token is not a filer
+			// credential and gets the caller nowhere here.
+			if uploadOption.FilerJwt != nil {
+				uploadOption.Jwt = uploadOption.FilerJwt(true)
+			} else {
+				uploadOption.Jwt = security.EncodedJwt(util_http.JwtForFilerServer(true))
+			}
+		}
 
 		uploadResult, err = uploader.retriedUploadData(context.Background(), data, uploadOption)
 		return err
@@ -220,7 +246,7 @@ func (uploader *Uploader) uploadWithRetryData(assignFn func() (fileId string, ho
 			return true
 		})
 	} else {
-		err = util.RetryOnError("uploadWithRetry", shouldReassignUpload, doUploadFunc)
+		err = util.RetryOnError("uploadWithRetry", ShouldReassignUpload, doUploadFunc)
 	}
 
 	return
@@ -250,13 +276,14 @@ func (uploader *Uploader) UploadWithRetry(filerClient filer_pb.FilerClient, assi
 
 	// Hash the buffer we already hold so the server echoes Content-MD5 back as
 	// the chunk ETag (std-base64 of the raw digest, the form ParseUpload
-	// verifies). Never under cipher: the server sees only ciphertext.
-	if uploadOption.WantMd5 && uploadOption.Md5 == "" && !uploadOption.Cipher {
+	// verifies). Under cipher the server never sees the header, but the digest
+	// still becomes the chunk ETag.
+	if uploadOption.WantMd5 && uploadOption.Md5 == "" {
 		digest := md5.Sum(data)
 		uploadOption.Md5 = base64.StdEncoding.EncodeToString(digest[:])
 	}
 
-	fileId, uploadResult, err = uploader.uploadWithRetryData(func() (fileId string, host string, auth security.EncodedJwt, err error) {
+	fileId, uploadResult, err = uploader.uploadWithRetryData(func() (fileId string, host string, auth security.EncodedJwt, fsync bool, err error) {
 		// grpc assign volume
 		if grpcAssignErr := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 			assignCtx, assignCancel := context.WithTimeout(context.Background(), assignVolumeTimeout)
@@ -271,6 +298,7 @@ func (uploader *Uploader) UploadWithRetry(filerClient filer_pb.FilerClient, assi
 			}
 
 			fileId, auth = resp.FileId, security.EncodedJwt(resp.Auth)
+			fsync = resp.Fsync
 			loc := resp.Location
 			host = filerClient.AdjustedUrl(loc)
 
@@ -311,6 +339,11 @@ func (uploader *Uploader) doUpload(ctx context.Context, reader io.Reader, option
 }
 
 func (uploader *Uploader) retriedUploadData(ctx context.Context, data []byte, option *UploadOption) (uploadResult *UploadResult, err error) {
+	// A stall disarms the watchdog for this upload's remaining attempts only;
+	// keep that on a per-call option so a caller reusing UploadOption starts
+	// the next upload armed.
+	localOption := *option
+	option = &localOption
 	maxAttempts := option.MaxAttempts
 	if maxAttempts <= 0 {
 		maxAttempts = 3
@@ -331,6 +364,10 @@ func (uploader *Uploader) retriedUploadData(ctx context.Context, data []byte, op
 		if ctx.Err() != nil {
 			return nil, ctx.Err()
 		}
+		var statusErr *uploadStatusError
+		if errors.As(err, &statusErr) && statusErr.stalled {
+			option.stallWatchdogDisarmed = true
+		}
 		glog.WarningfCtx(ctx, "uploading %d to %s: %v", i, option.UploadUrl, err)
 	}
 	return
@@ -398,13 +435,15 @@ func (uploader *Uploader) doUploadData(ctx context.Context, data []byte, option
 			_, err = w.Write(encryptedData)
 			return
 		}, len(encryptedData), &UploadOption{
-			UploadUrl:         option.UploadUrl,
-			Filename:          "",
-			Cipher:            false,
-			IsInputCompressed: false,
-			MimeType:          "",
-			PairMap:           nil,
-			Jwt:               option.Jwt,
+			UploadUrl:             option.UploadUrl,
+			Filename:              "",
+			Cipher:                false,
+			IsInputCompressed:     false,
+			MimeType:              "",
+			PairMap:               nil,
+			Jwt:                   option.Jwt,
+			BytesBuffer:           option.BytesBuffer,
+			stallWatchdogDisarmed: option.stallWatchdogDisarmed,
 		})
 		if uploadResult == nil {
 			return
@@ -412,6 +451,9 @@ func (uploader *Uploader) doUploadData(ctx context.Context, data []byte, option
 		uploadResult.Name = option.Filename
 		uploadResult.Mime = option.MimeType
 		uploadResult.CipherKey = cipherKey
+		// The volume server only ever hashes the ciphertext it stored, so the
+		// chunk ETag has to come from the caller's plaintext digest.
+		uploadResult.ContentMd5 = option.Md5
 		uploadResult.Size = uint32(clearDataLen)
 		if contentIsGzipped {
 			uploadResult.Gzip = 1
@@ -422,15 +464,16 @@ func (uploader *Uploader) doUploadData(ctx context.Context, data []byte, option
 			_, err = w.Write(data)
 			return
 		}, len(data), &UploadOption{
-			UploadUrl:         option.UploadUrl,
-			Filename:          option.Filename,
-			Cipher:            false,
-			IsInputCompressed: contentIsGzipped,
-			MimeType:          option.MimeType,
-			PairMap:           option.PairMap,
-			Jwt:               option.Jwt,
-			Md5:               option.Md5,
-			BytesBuffer:       option.BytesBuffer,
+			UploadUrl:             option.UploadUrl,
+			Filename:              option.Filename,
+			Cipher:                false,
+			IsInputCompressed:     contentIsGzipped,
+			MimeType:              option.MimeType,
+			PairMap:               option.PairMap,
+			Jwt:                   option.Jwt,
+			Md5:                   option.Md5,
+			BytesBuffer:           option.BytesBuffer,
+			stallWatchdogDisarmed: option.stallWatchdogDisarmed,
 		})
 		if uploadResult == nil {
 			return
@@ -493,7 +536,14 @@ func (uploader *Uploader) upload_content(ctx context.Context, fillBufferFunction
 	} else {
 		reqReader = bytes.NewReader(option.BytesBuffer.Bytes())
 	}
-	req, postErr := http.NewRequestWithContext(ctx, http.MethodPost, option.UploadUrl, reqReader)
+	// bodySize is what the conn must move: originalDataSize counts bytes
+	// before compression, which would inflate both the recorded rate and the
+	// stall budget for a pre-compressed body.
+	bodySize := int64(reqReader.Len())
+	reqCtx, cancelUpload := context.WithCancel(ctx)
+	defer cancelUpload()
+
+	req, postErr := http.NewRequestWithContext(reqCtx, http.MethodPost, option.UploadUrl, reqReader)
 	if postErr != nil {
 		glog.V(1).InfofCtx(ctx, "create upload request %s: %v", option.UploadUrl, postErr)
 		return nil, fmt.Errorf("create upload request %s: %v", option.UploadUrl, postErr)
@@ -508,7 +558,46 @@ func (uploader *Uploader) upload_content(ctx context.Context, fillBufferFunction
 
 	request_id.InjectToRequest(ctx, req)
 
+	var uploadDone atomic.Bool
+	defer uploadDone.Store(true)
+	// bodySentAt marks when the transport finished draining the request body;
+	// past it the wait is server-side commit, which the transport's response
+	// header timeout already bounds — the stall watchdog only blames a conn
+	// that is still trickling the body.
+	var curBodySentAt atomic.Pointer[atomic.Int64]
+	bodySentAt := &atomic.Int64{}
+	curBodySentAt.Store(bodySentAt)
+	req.Body = &watchdogBody{ReadCloser: req.Body, sentAt: bodySentAt}
+	mark, hostWasFast := uploader.fastUploadHosts.Load(req.URL.Host)
+	hostWasFast = hostWasFast && !option.stallWatchdogDisarmed && time.Since(time.Unix(0, mark.(fastHostMark).at)) < fastUploadHostMemory
+	stallFired := func() {
+		if !uploadDone.CompareAndSwap(false, true) {
+			return
+		}
+		// The host was moving bodies at full rate a moment ago, so an
+		// upload still trickling far below that rate rides a wedged pooled
+		// conn; cancel drops the conn so the retry dials a fresh one.
+		// CompareAndDelete leaves a newer mark a concurrent success stored.
+		uploader.fastUploadHosts.CompareAndDelete(req.URL.Host, mark)
+		glog.WarningfCtx(ctx, "upload %d bytes to %s stalled on a pooled connection, retrying on a fresh one", originalDataSize, option.UploadUrl)
+		cancelUpload()
+	}
+	var stallTimer *time.Timer
+	if hostWasFast {
+		defer func() {
+			if stallTimer != nil {
+				stallTimer.Stop()
+			}
+		}()
+		stallTimer = time.AfterFunc(uploadStallTimeout(bodySize, mark.(fastHostMark).bps), func() {
+			if curBodySentAt.Load().Load() == 0 {
+				stallFired()
+			}
+		})
+	}
+
 	// print("+")
+	started := time.Now()
 	resp, post_err := uploader.httpClient.Do(req)
 	defer util_http.CloseResponse(resp)
 	if post_err != nil {
@@ -527,7 +616,13 @@ func (uploader *Uploader) upload_content(ctx context.Context, fillBufferFunction
 			// "connection reset" error with a misleading "Body length 0".
 			if req.GetBody != nil {
 				if newBody, gbErr := req.GetBody(); gbErr == nil {
-					req.Body = newBody
+					bodySentAt = &atomic.Int64{}
+					curBodySentAt.Store(bodySentAt)
+					started = time.Now()
+					if stallTimer != nil && !uploadDone.Load() {
+						stallTimer.Reset(uploadStallTimeout(bodySize, mark.(fastHostMark).bps))
+					}
+					req.Body = &watchdogBody{ReadCloser: newBody, sentAt: bodySentAt}
 					resp, post_err = uploader.httpClient.Do(req)
 					defer util_http.CloseResponse(resp)
 				} else {
@@ -540,22 +635,40 @@ func (uploader *Uploader) upload_content(ctx context.Context, fillBufferFunction
 	}
 	if post_err != nil {
 		stats.UploadErrorCounter.WithLabelValues("0").Inc()
-		return nil, &uploadStatusError{StatusCode: 0, err: fmt.Errorf("upload %s %d bytes to %v: %v", option.Filename, originalDataSize, option.UploadUrl, post_err)}
+		return nil, &uploadStatusError{StatusCode: 0, stalled: reqCtx.Err() != nil && ctx.Err() == nil, err: fmt.Errorf("upload %s %d bytes to %v: %v", option.Filename, originalDataSize, option.UploadUrl, post_err)}
 	}
+	// Rate is bounded by elapsed-to-response: the server cannot answer before
+	// the body lands, so this can only understate link speed — a drain-time
+	// reading mistakes kernel-buffer absorption for wire speed and would mark
+	// a slow link fast. The mark still only lands on a verified upload: a
+	// fast rejection says nothing about how the conn drains.
+	movedIn := time.Since(started)
+
 	// print("-")
 
 	var ret UploadResult
 	etag := getEtag(resp)
 	if resp.StatusCode == http.StatusNoContent {
+		if bps := uploadObservedBps(bodySize, movedIn); bps > 0 {
+			uploader.fastUploadHosts.Store(req.URL.Host, fastHostMark{at: time.Now().UnixNano(), bps: bps})
+		}
 		ret.ETag = etag
 		ret.ContentMd5 = resp.Header.Get("Content-MD5")
 		return &ret, nil
 	}
 
+	if stallTimer != nil {
+		// The header timeout does not cover the response body: keep the
+		// watchdog armed for the read so a conn that wedges mid-reply gets
+		// cancelled for a fresh retry.
+		respStallTimer := time.AfterFunc(uploadStallMinWait, stallFired)
+		defer respStallTimer.Stop()
+	}
 	resp_body, ra_err := io.ReadAll(resp.Body)
+	uploadDone.Store(true)
 	if ra_err != nil {
 		stats.UploadErrorCounter.WithLabelValues(strconv.Itoa(resp.StatusCode)).Inc()
-		return nil, &uploadStatusError{StatusCode: resp.StatusCode, err: fmt.Errorf("read response body %v: %w", option.UploadUrl, ra_err)}
+		return nil, &uploadStatusError{StatusCode: resp.StatusCode, stalled: reqCtx.Err() != nil && ctx.Err() == nil, err: fmt.Errorf("read response body %v: %w", option.UploadUrl, ra_err)}
 	}
 
 	unmarshal_err := json.Unmarshal(resp_body, &ret)
@@ -568,6 +681,9 @@ func (uploader *Uploader) upload_content(ctx context.Context, fillBufferFunction
 		stats.UploadErrorCounter.WithLabelValues(strconv.Itoa(resp.StatusCode)).Inc()
 		return nil, &uploadStatusError{StatusCode: resp.StatusCode, err: fmt.Errorf("unmarshalled error %v: %v", option.UploadUrl, ret.Error)}
 	}
+	if bps := uploadObservedBps(bodySize, movedIn); bps > 0 {
+		uploader.fastUploadHosts.Store(req.URL.Host, fastHostMark{at: time.Now().UnixNano(), bps: bps})
+	}
 	ret.ETag = etag
 	ret.ContentMd5 = resp.Header.Get("Content-MD5")
 	return &ret, nil
@@ -580,3 +696,68 @@ func getEtag(r *http.Response) (etag string) {
 	}
 	return
 }
+
+// uploadRateMinBytes is the smallest body whose measured rate can mark a
+// host: smaller uploads are dominated by round-trip and commit overhead, not
+// wire speed.
+const uploadRateMinBytes = int64(256 << 10)
+
+var (
+	// uploadStallSlowFactor is how far below the host's last observed rate an
+	// upload may run before its conn is presumed wedged: at 8, a host that
+	// just moved a body at 8MiB/s tolerates down to 1MiB/s.
+	uploadStallSlowFactor = int64(8)
+	uploadStallMinWait    = 10 * time.Second
+	fastUploadHostMemory  = time.Minute
+)
+
+// fastHostMark remembers the wire rate of a host's last sizeable upload, so a
+// later upload running far below it blames the pooled conn rather than the
+// link — no fixed rate fits every deployment's links.
+type fastHostMark struct {
+	at  int64 // UnixNano
+	bps int64 // wire bytes/sec measured elapsed-to-response
+}
+
+// uploadStallTimeout is the most an upload may take on a conn whose host last
+// proved bps: the time the body needs at an uploadStallSlowFactor of that
+// rate, with a floor so a fast conn is not raced on small bodies.
+func uploadStallTimeout(size, bps int64) time.Duration {
+	if bps > 0 {
+		if d := time.Duration(size/bps) * time.Duration(uploadStallSlowFactor) * time.Second; d > uploadStallMinWait {
+			return d
+		}
+	}
+	return uploadStallMinWait
+}
+
+// uploadObservedBps returns the wire rate a completed upload proved on its
+// host, or 0 when the body was too small to measure. Elapsed-to-response can
+// only understate the link's speed, which keeps the mark — and the stall
+// budget derived from it — conservative.
+func uploadObservedBps(size int64, elapsed time.Duration) int64 {
+	if size < uploadRateMinBytes || elapsed <= 0 {
+		return 0
+	}
+	return int64(float64(size) / elapsed.Seconds())
+}
+
+// watchdogBody records when the transport drains the request body: before that
+// a stuck send blames the conn; after it the wait is the server's.
+type watchdogBody struct {
+	io.ReadCloser
+	sentAt *atomic.Int64
+}
+
+func (b *watchdogBody) Read(p []byte) (int, error) {
+	n, err := b.ReadCloser.Read(p)
+	if err == io.EOF {
+		b.sentAt.Store(time.Now().UnixNano())
+	}
+	return n, err
+}
+
+func (b *watchdogBody) Close() error {
+	b.sentAt.Store(time.Now().UnixNano())
+	return b.ReadCloser.Close()
+}
diff --git a/weed/operation/upload_content_test.go b/weed/operation/upload_content_test.go
index 6a65668f7f..d80c8cd591 100644
--- a/weed/operation/upload_content_test.go
+++ b/weed/operation/upload_content_test.go
@@ -3,19 +3,24 @@ package operation
 import (
 	"bytes"
 	"context"
+	"crypto/md5"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc"
 )
 
@@ -69,8 +74,8 @@ func TestShouldReassignUpload(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			if got := shouldReassignUpload(tc.err); got != tc.want {
-				t.Fatalf("shouldReassignUpload(%v) = %v, want %v", tc.err, got, tc.want)
+			if got := ShouldReassignUpload(tc.err); got != tc.want {
+				t.Fatalf("ShouldReassignUpload(%v) = %v, want %v", tc.err, got, tc.want)
 			}
 		})
 	}
@@ -92,12 +97,12 @@ func TestUploadWithRetryDataReassignsOnVolumeSizeExceeded(t *testing.T) {
 	uploader := newUploader(httpClient)
 
 	assignCalls := 0
-	fileID, uploadResult, err := uploader.uploadWithRetryData(func() (string, string, security.EncodedJwt, error) {
+	fileID, uploadResult, err := uploader.uploadWithRetryData(func() (string, string, security.EncodedJwt, bool, error) {
 		assignCalls++
 		if assignCalls == 1 {
-			return "1,first", "volume-a", "", nil
+			return "1,first", "volume-a", "", false, nil
 		}
-		return "2,second", "volume-b", "", nil
+		return "2,second", "volume-b", "", false, nil
 	}, &UploadOption{Filename: "test.bin"}, []byte("abc"))
 
 	if err != nil {
@@ -140,12 +145,12 @@ func TestUploadWithRetryDataReassignsOnReplicaWriteFailure(t *testing.T) {
 	uploader := newUploader(httpClient)
 
 	assignCalls := 0
-	fileID, uploadResult, err := uploader.uploadWithRetryData(func() (string, string, security.EncodedJwt, error) {
+	fileID, uploadResult, err := uploader.uploadWithRetryData(func() (string, string, security.EncodedJwt, bool, error) {
 		assignCalls++
 		if assignCalls == 1 {
-			return "1,first", "volume-a", "", nil
+			return "1,first", "volume-a", "", false, nil
 		}
-		return "2,second", "volume-b", "", nil
+		return "2,second", "volume-b", "", false, nil
 	}, &UploadOption{Filename: "test.bin"}, []byte("abc"))
 
 	if err != nil {
@@ -196,6 +201,430 @@ func (c *bodyCapturingHTTPClient) Do(req *http.Request) (*http.Response, error)
 	}, nil
 }
 
+// stallingHTTPClient parks the first stalls calls without draining the request
+// body (a conn that never drains) until the request ctx is cancelled, and
+// delays the rest by slowFor after draining.
+type stallingHTTPClient struct {
+	mu          sync.Mutex
+	stalls      int
+	slowFor     time.Duration
+	requestCtxs []context.Context
+}
+
+func (c *stallingHTTPClient) Do(req *http.Request) (*http.Response, error) {
+	c.mu.Lock()
+	c.requestCtxs = append(c.requestCtxs, req.Context())
+	stall := c.stalls > 0
+	if stall {
+		c.stalls--
+	}
+	c.mu.Unlock()
+
+	if stall {
+		<-req.Context().Done()
+		return nil, req.Context().Err()
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	if c.slowFor > 0 {
+		time.Sleep(c.slowFor)
+	}
+	return &http.Response{
+		StatusCode: http.StatusCreated,
+		Header:     make(http.Header),
+		Body:       io.NopCloser(strings.NewReader(`{"size":1}`)),
+	}, nil
+}
+
+// markHostFast arms the stall watchdog the way a recent fast upload would:
+// the recorded rate is high enough that the adaptive budget lands on
+// uploadStallMinWait for test-sized bodies.
+func markHostFast(u *Uploader, host string) {
+	u.fastUploadHosts.Store(host, fastHostMark{at: time.Now().UnixNano(), bps: 1 << 30})
+}
+
+// A host that just served a fast upload arms the stall watchdog: a request
+// parked well past the floor is riding a wedged conn, so it is cancelled and
+// the retry runs on a fresh conn without the watchdog.
+func TestUploadStallWatchdogRetriesOnFreshConn(t *testing.T) {
+	defer func(orig time.Duration) { uploadStallMinWait = orig }(uploadStallMinWait)
+	uploadStallMinWait = 50 * time.Millisecond
+
+	client := &stallingHTTPClient{stalls: 1}
+	uploader := newUploader(client)
+	markHostFast(uploader, "test-host:8080")
+
+	result, err := uploader.UploadData(context.Background(), make([]byte, 300*1024), &UploadOption{
+		UploadUrl:   "http://test-host:8080/1,deadbeef",
+		MaxAttempts: 2,
+	})
+	if err != nil {
+		t.Fatalf("upload should have retried on a fresh conn: %v", err)
+	}
+	if result.RetryCount != 1 || len(client.requestCtxs) != 2 {
+		t.Fatalf("got retries=%d calls=%d, want one retry on a fresh conn", result.RetryCount, len(client.requestCtxs))
+	}
+	if err := client.requestCtxs[0].Err(); err == nil {
+		t.Fatalf("first attempt context was not cancelled")
+	}
+}
+
+// readStallHTTPClient answers with a response body that never delivers until
+// the request ctx is cancelled — the conn that took the request then wedged on
+// the read side.
+type readStallHTTPClient struct {
+	mu    sync.Mutex
+	stall bool
+}
+
+func (c *readStallHTTPClient) Do(req *http.Request) (*http.Response, error) {
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	c.mu.Lock()
+	stall := c.stall
+	c.stall = false
+	c.mu.Unlock()
+	var body io.ReadCloser = io.NopCloser(strings.NewReader(`{"size":1}`))
+	if stall {
+		body = &ctxBlockedBody{ctx: req.Context()}
+	}
+	return &http.Response{
+		StatusCode: http.StatusCreated,
+		Header:     make(http.Header),
+		Body:       body,
+	}, nil
+}
+
+type ctxBlockedBody struct{ ctx context.Context }
+
+func (b *ctxBlockedBody) Read([]byte) (int, error) {
+	<-b.ctx.Done()
+	return 0, b.ctx.Err()
+}
+
+func (b *ctxBlockedBody) Close() error { return nil }
+
+// The watchdog stays armed through the response read: a conn that accepts the
+// body then wedges on the reply is as wedged as one that never drains.
+func TestUploadStallWatchdogCoversResponseRead(t *testing.T) {
+	defer func(orig time.Duration) { uploadStallMinWait = orig }(uploadStallMinWait)
+	uploadStallMinWait = 50 * time.Millisecond
+
+	client := &readStallHTTPClient{stall: true}
+	uploader := newUploader(client)
+	markHostFast(uploader, "test-host:8080")
+
+	result, err := uploader.UploadData(context.Background(), make([]byte, 300*1024), &UploadOption{
+		UploadUrl:   "http://test-host:8080/1,deadbeef",
+		MaxAttempts: 2,
+	})
+	if err != nil {
+		t.Fatalf("upload should have retried past the stalled read: %v", err)
+	}
+	if result.RetryCount != 1 {
+		t.Fatalf("got retries=%d, want one retry on a fresh conn", result.RetryCount)
+	}
+}
+
+// rearmHTTPClient parks the first attempt on a conn that never drains and
+// re-marks the host fast as it fails — a concurrent healthy upload can restore
+// the mark while this upload is between attempts. The retry drains slowly, so
+// a re-armed watchdog would cancel it too.
+type rearmHTTPClient struct {
+	uploader *Uploader
+	calls    int32
+	slowFor  time.Duration
+}
+
+func (c *rearmHTTPClient) Do(req *http.Request) (*http.Response, error) {
+	if atomic.AddInt32(&c.calls, 1) == 1 {
+		<-req.Context().Done()
+		markHostFast(c.uploader, req.URL.Host)
+		return nil, req.Context().Err()
+	}
+	// Park past the watchdog floor like a real wedged conn: a re-armed
+	// watchdog must cancel this attempt instead of the sleep masking it.
+	select {
+	case <-req.Context().Done():
+		return nil, req.Context().Err()
+	case <-time.After(c.slowFor):
+	}
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	return &http.Response{
+		StatusCode: http.StatusCreated,
+		Header:     make(http.Header),
+		Body:       io.NopCloser(strings.NewReader(`{"size":1}`)),
+	}, nil
+}
+
+// A re-proven host must not re-arm the watchdog for the retry: the conn it
+// cancelled says nothing about the next conn, and re-arming could burn every
+// remaining attempt.
+func TestUploadStallWatchdogStaysDisarmedOnRetry(t *testing.T) {
+	defer func(orig time.Duration) { uploadStallMinWait = orig }(uploadStallMinWait)
+	uploadStallMinWait = 40 * time.Millisecond
+
+	uploader := newUploader(nil)
+	uploader.httpClient = &rearmHTTPClient{uploader: uploader, slowFor: 60 * time.Millisecond}
+	markHostFast(uploader, "test-host:8080")
+
+	result, err := uploader.UploadData(context.Background(), make([]byte, 300*1024), &UploadOption{
+		UploadUrl:   "http://test-host:8080/1,deadbeef",
+		MaxAttempts: 2,
+	})
+	if err != nil {
+		t.Fatalf("retry should run unbounded once the watchdog has fired: %v", err)
+	}
+	if result.RetryCount != 1 {
+		t.Fatalf("got retries=%d, want one retry", result.RetryCount)
+	}
+}
+
+// The disarm is per upload: a caller reusing its UploadOption still gets an
+// armed watchdog on the next call — a second stalled conn must cancel too.
+func TestUploadStallWatchdogRearmsForNextUpload(t *testing.T) {
+	defer func(orig time.Duration) { uploadStallMinWait = orig }(uploadStallMinWait)
+	uploadStallMinWait = 40 * time.Millisecond
+
+	client := &stallingHTTPClient{}
+	uploader := newUploader(client)
+	markHostFast(uploader, "test-host:8080")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	// IsInputCompressed keeps the body large enough to re-prove the host:
+	// compressed near-zeros would send too few bytes to re-mark it.
+	option := &UploadOption{UploadUrl: "http://test-host:8080/1,deadbeef", MaxAttempts: 2, IsInputCompressed: true}
+	for i := 0; i < 2; i++ {
+		client.mu.Lock()
+		client.stalls = 1
+		client.mu.Unlock()
+		result, err := uploader.UploadData(ctx, make([]byte, 300*1024), option)
+		if err != nil {
+			t.Fatalf("upload %d should have retried on a fresh conn: %v", i, err)
+		}
+		if result.RetryCount != 1 {
+			t.Fatalf("upload %d got retries=%d, want its own stall caught", i, result.RetryCount)
+		}
+	}
+	if option.stallWatchdogDisarmed {
+		t.Fatalf("a stall must not disarm the watchdog on the caller's option")
+	}
+}
+
+// A real transport must drop the conn a cancelled request was riding: the
+// retry has to dial again rather than land back on the parked conn. The first
+// conn here wedges mid-reply — headers flush, then the body never arrives.
+func TestUploadStallWatchdogDialsFreshConn(t *testing.T) {
+	defer func(orig time.Duration) { uploadStallMinWait = orig }(uploadStallMinWait)
+	uploadStallMinWait = 50 * time.Millisecond
+
+	var requests, dials int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		if atomic.AddInt32(&requests, 1) == 1 {
+			w.WriteHeader(http.StatusCreated)
+			w.(http.Flusher).Flush()
+			<-r.Context().Done()
+			return
+		}
+		w.WriteHeader(http.StatusCreated)
+		_, _ = w.Write([]byte(`{"size":1}`))
+	}))
+	defer srv.Close()
+
+	tr := &http.Transport{
+		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			atomic.AddInt32(&dials, 1)
+			return new(net.Dialer).DialContext(ctx, network, addr)
+		},
+	}
+	defer tr.CloseIdleConnections()
+	uploader := newUploader(&http.Client{Transport: tr})
+
+	host := strings.TrimPrefix(srv.URL, "http://")
+	markHostFast(uploader, host)
+
+	result, err := uploader.UploadData(context.Background(), make([]byte, 300*1024), &UploadOption{
+		UploadUrl:   srv.URL + "/1,deadbeef",
+		MaxAttempts: 2,
+	})
+	if err != nil {
+		t.Fatalf("upload should have retried on a fresh conn: %v", err)
+	}
+	if result.RetryCount != 1 || atomic.LoadInt32(&dials) != 2 {
+		t.Fatalf("got retries=%d dials=%d, want one retry on a fresh conn", result.RetryCount, dials)
+	}
+}
+
+// Once the body drains the wait is the server's commit: a write that takes
+// longer than the stall floor to acknowledge must not be cancelled — the conn
+// is healthy, the server is just busy.
+func TestUploadStallWatchdogAllowsSlowCommit(t *testing.T) {
+	defer func(orig time.Duration) { uploadStallMinWait = orig }(uploadStallMinWait)
+	uploadStallMinWait = 30 * time.Millisecond
+
+	client := &stallingHTTPClient{slowFor: 80 * time.Millisecond}
+	uploader := newUploader(client)
+	markHostFast(uploader, "test-host:8080")
+
+	result, err := uploader.UploadData(context.Background(), make([]byte, 300*1024), &UploadOption{
+		UploadUrl:   "http://test-host:8080/1,deadbeef",
+		MaxAttempts: 1,
+	})
+	if err != nil || result.RetryCount != 0 {
+		t.Fatalf("a slow commit must not be cancelled: result=%+v err=%v", result, err)
+	}
+}
+
+// A fast rejection proves nothing about how the conn drains, so it must not
+// mark the host fast and arm the watchdog for the next upload.
+func TestUploadStallWatchdogIgnoresFailedWrites(t *testing.T) {
+	uploader := newUploader(&rejectHTTPClient{})
+	_, err := uploader.UploadData(context.Background(), make([]byte, 300*1024), &UploadOption{
+		UploadUrl:   "http://test-host:8080/1,deadbeef",
+		MaxAttempts: 1,
+	})
+	if err == nil {
+		t.Fatalf("rejected upload should fail")
+	}
+	if _, ok := uploader.fastUploadHosts.Load("test-host:8080"); ok {
+		t.Fatalf("a failed upload must not mark the host fast")
+	}
+}
+
+type rejectHTTPClient struct{}
+
+func (c *rejectHTTPClient) Do(req *http.Request) (*http.Response, error) {
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+	}
+	return &http.Response{
+		StatusCode: http.StatusInternalServerError,
+		Header:     make(http.Header),
+		Body:       io.NopCloser(strings.NewReader(`{"error":"volume is read only"}`)),
+	}, nil
+}
+
+// Without a recent fast upload the watchdog stays off: a chronically slow link
+// is the link, not a conn, and must not get its uploads cancelled.
+func TestUploadStallWatchdogKeepsUnprovenHost(t *testing.T) {
+	defer func(orig time.Duration) { uploadStallMinWait = orig }(uploadStallMinWait)
+	uploadStallMinWait = 20 * time.Millisecond
+
+	client := &stallingHTTPClient{slowFor: 60 * time.Millisecond}
+	uploader := newUploader(client)
+
+	result, err := uploader.UploadData(context.Background(), make([]byte, 300*1024), &UploadOption{
+		UploadUrl:   "http://slow-host:8080/1,deadbeef",
+		MaxAttempts: 1,
+	})
+	if err != nil {
+		t.Fatalf("unproven host upload should not be cancelled: %v", err)
+	}
+	if result.RetryCount != 0 || len(client.requestCtxs) != 1 {
+		t.Fatalf("got retries=%d calls=%d, want a single unbounded attempt", result.RetryCount, len(client.requestCtxs))
+	}
+}
+
+// Any sizeable completed upload marks its host at the rate it proved — slow
+// or fast — because the stall budget scales off that rate. Only a too-small
+// body fails to measure.
+func TestUploadObservedBps(t *testing.T) {
+	if bps := uploadObservedBps(4<<20, 4*time.Second); bps != 1<<20 {
+		t.Fatalf("4MiB in 4s observed %d B/s, want 1MiB/s", bps)
+	}
+	if bps := uploadObservedBps(4<<20, 3*time.Hour); bps <= 0 {
+		t.Fatalf("a slow upload still proves the rate it moved at")
+	}
+	if bps := uploadObservedBps(64*1024, time.Millisecond); bps != 0 {
+		t.Fatalf("a small upload says nothing about host speed")
+	}
+	if bps := uploadObservedBps(4<<20, 0); bps != 0 {
+		t.Fatalf("a zero-duration sample is not a measurement")
+	}
+}
+
+// The stall budget scales with the rate the host last proved, so the same
+// body gets little slack on a fast link and plenty on a slow one — no fixed
+// floor fits both.
+func TestUploadStallTimeoutScalesWithMeasuredRate(t *testing.T) {
+	// 8MiB/s observed → a 64MiB body gets 8x the time it needs at that rate.
+	if d := uploadStallTimeout(64<<20, 8<<20); d != 64*time.Second {
+		t.Fatalf("stall budget = %v, want 64s", d)
+	}
+	// The same body on a 64MiB/s host gets 8s — under the floor, so clamped.
+	if d := uploadStallTimeout(64<<20, 64<<20); d != uploadStallMinWait {
+		t.Fatalf("stall budget = %v, want the min wait %v", d, uploadStallMinWait)
+	}
+	// A tiny body on a fast host cannot race its own conn.
+	if d := uploadStallTimeout(1, 1<<30); d != uploadStallMinWait {
+		t.Fatalf("stall budget = %v, want the min wait %v", d, uploadStallMinWait)
+	}
+}
+
+type fsyncAssignClient struct {
+	filer_pb.SeaweedFilerClient
+	response *filer_pb.AssignVolumeResponse
+}
+
+func (c *fsyncAssignClient) AssignVolume(context.Context, *filer_pb.AssignVolumeRequest, ...grpc.CallOption) (*filer_pb.AssignVolumeResponse, error) {
+	return c.response, nil
+}
+
+func (c *fsyncAssignClient) WithFilerClient(_ bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return fn(c)
+}
+func (c *fsyncAssignClient) AdjustedUrl(loc *filer_pb.Location) string { return loc.GetUrl() }
+func (c *fsyncAssignClient) GetDataCenter() string                     { return "" }
+
+func TestUploadWithRetryAppendsFsyncWhenAssigned(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		proxy bool
+	}{
+		{name: "direct"},
+		{name: "filer proxy", proxy: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			const fileID = "1,0123456789"
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if gotFsync := r.URL.Query().Get("fsync"); gotFsync != "true" {
+					t.Errorf("upload fsync = %q, want true when assignment requires fsync", gotFsync)
+				}
+				if tc.proxy {
+					if got := r.URL.Query().Get("proxyChunkId"); got != fileID {
+						t.Errorf("proxyChunkId = %q, want %q", got, fileID)
+					}
+				}
+				w.WriteHeader(http.StatusCreated)
+				_, _ = io.WriteString(w, `{"size":3}`)
+			}))
+			defer server.Close()
+
+			host := strings.TrimPrefix(server.URL, "http://")
+			client := &fsyncAssignClient{response: &filer_pb.AssignVolumeResponse{
+				FileId:   fileID,
+				Location: &filer_pb.Location{Url: host},
+				Fsync:    true,
+			}}
+			option := &UploadOption{}
+			if tc.proxy {
+				option.GenUploadUrl = GenUploadUrlProxy(host)
+			}
+			_, _, err, _ := newUploader(server.Client()).UploadWithRetry(client,
+				&filer_pb.AssignVolumeRequest{Path: "/bucket/object"}, option, strings.NewReader("abc"))
+			if err != nil {
+				t.Fatalf("upload failed: %v", err)
+			}
+		})
+	}
+}
+
 // hangingAssignSeaweedClient is a SeaweedFilerClient whose AssignVolume blocks
 // until its context is done, so a test can prove UploadWithRetry bounds the RPC.
 type hangingAssignSeaweedClient struct {
@@ -455,3 +884,60 @@ func TestUploadRetryStopsOnContextCancel(t *testing.T) {
 		t.Fatalf("dial attempts = %d, want at most 1 after cancellation", got)
 	}
 }
+
+// A ciphered upload hands the volume server ciphertext, so it cannot echo a
+// Content-MD5 back; without the caller's plaintext digest the chunk lands with
+// no ETag and every ETag computed from those chunks comes out empty
+// (issue #10968).
+func TestCipherUploadKeepsPlaintextETag(t *testing.T) {
+	payload := bytes.Repeat([]byte("encrypt me\n"), 4096)
+	digest := md5.Sum(payload)
+	wantMd5 := base64.StdEncoding.EncodeToString(digest[:])
+
+	var storedNeedle *needle.Needle
+	var sentContentMd5 string
+	var parseErr error
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		sentContentMd5 = r.Header.Get("Content-MD5")
+		storedNeedle, _, _, parseErr = needle.CreateNeedleFromRequest(r, false, 1024*1024, &bytes.Buffer{})
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusCreated)
+		_, _ = io.WriteString(w, `{"name":"payload","size":45056}`)
+	}))
+	defer server.Close()
+
+	uploader := newUploader(server.Client())
+	result, err := uploader.UploadData(context.Background(), payload, &UploadOption{
+		UploadUrl:   server.URL + "/3,01637037d6",
+		Cipher:      true,
+		Md5:         wantMd5,
+		MaxAttempts: 1,
+	})
+	if err != nil {
+		t.Fatalf("cipher upload failed: %v", err)
+	}
+	if parseErr != nil {
+		t.Fatalf("parse ciphered upload: %v", parseErr)
+	}
+	if sentContentMd5 != "" {
+		t.Fatalf("Content-MD5 %q sent to the volume server, which only sees ciphertext", sentContentMd5)
+	}
+	if result.ContentMd5 != wantMd5 {
+		t.Fatalf("chunk ETag = %q, want the plaintext digest %q", result.ContentMd5, wantMd5)
+	}
+	if bytes.Equal(storedNeedle.Data, payload) {
+		t.Fatal("volume server stored plaintext for a ciphered upload")
+	}
+	decrypted, err := util.Decrypt(storedNeedle.Data, util.CipherKey(result.CipherKey))
+	if err != nil {
+		t.Fatalf("decrypt stored needle: %v", err)
+	}
+	if result.Gzip > 0 {
+		if decrypted, err = util.DecompressData(decrypted); err != nil {
+			t.Fatalf("decompress stored needle: %v", err)
+		}
+	}
+	if !bytes.Equal(decrypted, payload) {
+		t.Fatalf("decrypted %d bytes, want %d", len(decrypted), len(payload))
+	}
+}
diff --git a/weed/operation/volume_move/ec_move.go b/weed/operation/volume_move/ec_move.go
new file mode 100644
index 0000000000..7ad0d11975
--- /dev/null
+++ b/weed/operation/volume_move/ec_move.go
@@ -0,0 +1,224 @@
+package volume_move
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// EcShardMove is one planned relocation of mounted shards to another server.
+type EcShardMove struct {
+	VolumeId   needle.VolumeId
+	Collection string
+	ShardIds   []erasure_coding.ShardId
+	Source     pb.ServerAddress
+	Target     pb.ServerAddress
+	// TargetDisk picks the destination disk (0 lets the server pick).
+	TargetDisk uint32
+}
+
+// EcMoveOptions control MoveEcShards.
+type EcMoveOptions struct {
+	// IoBytePerSecond limits the shard copy rate; 0 falls back to the volume
+	// server's maintenance rate.
+	IoBytePerSecond int64
+	// Writer receives human-readable progress lines (nil discards them).
+	Writer io.Writer
+	// Progress, when set, receives percent/stage callbacks as the move advances.
+	Progress func(percent float64, stage string)
+}
+
+// MoveEcShards relocates mounted shards: copy+mount on the target, verify the
+// target registered them, then unmount+delete on the source. The verification
+// gates the destructive half — a copy/mount RPC can return OK while the shard
+// is not loadable on the target, and deleting the source then would lose it;
+// on a mismatch the source is kept so the caller can retry.
+func (m *Mover) MoveEcShards(ctx context.Context, move EcShardMove, opts EcMoveOptions) error {
+	writer := opts.Writer
+	if writer == nil {
+		writer = io.Discard
+	}
+	progress := opts.Progress
+	if progress == nil {
+		progress = func(float64, string) {}
+	}
+
+	// A same-server "move" cannot be expressed with these RPCs: the source
+	// delete is server-wide, so it would erase the just-copied shard. Removing
+	// a duplicate shard in place is RemoveEcShards. SameServer, not ==:
+	// "node:8080" and "node:8080.18080" are one server.
+	if SameServer(move.Source, move.Target) {
+		return fmt.Errorf("refusing EC shard move of volume %d shard(s) %v onto its own server %s: the source delete is server-wide", move.VolumeId, move.ShardIds, move.Source)
+	}
+
+	progress(10, fmt.Sprintf("copying EC shard(s) %d.%v from %s to %s", move.VolumeId, move.ShardIds, move.Source, move.Target))
+	if err := m.CopyAndMountEcShards(ctx, move.VolumeId, move.Collection, move.ShardIds, move.Source, move.Target, move.TargetDisk, opts.IoBytePerSecond, writer); err != nil {
+		return err
+	}
+
+	progress(40, fmt.Sprintf("verifying EC shard(s) %d.%v on %s", move.VolumeId, move.ShardIds, move.Target))
+	if err := m.VerifyEcShards(ctx, move.VolumeId, move.Target, move.ShardIds); err != nil {
+		return err
+	}
+
+	progress(50, fmt.Sprintf("unmounting EC shard(s) %d.%v from %s", move.VolumeId, move.ShardIds, move.Source))
+	fmt.Fprintf(writer, "unmount %d.%v from %s\n", move.VolumeId, move.ShardIds, move.Source)
+	if err := m.UnmountEcShards(ctx, move.VolumeId, move.Source, move.ShardIds); err != nil {
+		return fmt.Errorf("unmount %d.%v from %s: %v", move.VolumeId, move.ShardIds, move.Source, err)
+	}
+
+	progress(75, fmt.Sprintf("deleting EC shard(s) %d.%v from %s", move.VolumeId, move.ShardIds, move.Source))
+	fmt.Fprintf(writer, "delete %d.%v from %s\n", move.VolumeId, move.ShardIds, move.Source)
+	if err := m.DeleteEcShards(ctx, move.VolumeId, move.Collection, move.Source, move.ShardIds); err != nil {
+		return fmt.Errorf("delete %d.%v from %s: %v", move.VolumeId, move.ShardIds, move.Source, err)
+	}
+
+	progress(100, fmt.Sprintf("moved EC shard(s) %d.%v from %s to %s", move.VolumeId, move.ShardIds, move.Source, move.Target))
+	return nil
+}
+
+// CopyAndMountEcShards has the target copy the shards (with their .ecx/.ecj/
+// .vif/.ecsum sidecars) from source and mount them. A same-address call skips
+// the copy and just mounts — ec.encode uses that to bring freshly generated
+// shards online in place.
+func (m *Mover) CopyAndMountEcShards(ctx context.Context, volumeId needle.VolumeId, collection string, shardIds []erasure_coding.ShardId, source, target pb.ServerAddress, targetDisk uint32, ioBytePerSecond int64, writer io.Writer) error {
+	if writer == nil {
+		writer = io.Discard
+	}
+	// The target dials the embedded source itself; a malformed one would
+	// abort the target server, not this client.
+	if !SameServer(target, source) {
+		if err := checkDialable(source); err != nil {
+			return err
+		}
+	}
+	return m.withClient(false, target, func(client volume_server_pb.VolumeServerClient) error {
+		if !SameServer(target, source) {
+			fmt.Fprintf(writer, "copy %d.%v %s => %s\n", volumeId, shardIds, source, target)
+			_, copyErr := client.VolumeEcShardsCopy(ctx, &volume_server_pb.VolumeEcShardsCopyRequest{
+				VolumeId:        uint32(volumeId),
+				Collection:      collection,
+				ShardIds:        erasure_coding.ShardIdsToUint32(shardIds),
+				CopyEcxFile:     true,
+				CopyEcjFile:     true,
+				CopyVifFile:     true,
+				CopyEcsumFile:   true, // propagate the bitrot sidecar with the shards (no-op if the source has none)
+				SourceDataNode:  string(source),
+				DiskId:          targetDisk,
+				IoBytePerSecond: ioBytePerSecond,
+			})
+			if copyErr != nil {
+				return fmt.Errorf("copy %d.%v %s => %s: %v", volumeId, shardIds, source, target, copyErr)
+			}
+		}
+		fmt.Fprintf(writer, "mount %d.%v on %s\n", volumeId, shardIds, target)
+		_, mountErr := client.VolumeEcShardsMount(ctx, &volume_server_pb.VolumeEcShardsMountRequest{
+			VolumeId:   uint32(volumeId),
+			Collection: collection,
+			ShardIds:   erasure_coding.ShardIdsToUint32(shardIds),
+		})
+		if mountErr != nil {
+			return fmt.Errorf("mount %d.%v on %s: %v", volumeId, shardIds, target, mountErr)
+		}
+		return nil
+	})
+}
+
+// VerifyEcShards confirms server has every shard in shardIds registered for
+// the volume.
+func (m *Mover) VerifyEcShards(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress, shardIds []erasure_coding.ShardId) error {
+	return m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		resp, err := client.VolumeEcShardsInfo(ctx, &volume_server_pb.VolumeEcShardsInfoRequest{
+			VolumeId: uint32(volumeId),
+		})
+		if err != nil {
+			return fmt.Errorf("verify EC shard(s) on %s for volume %d: %v", server, volumeId, err)
+		}
+		var bits, zeroSized erasure_coding.ShardBits
+		for _, s := range resp.EcShardInfos {
+			if s.VolumeId != uint32(volumeId) || s.ShardId >= erasure_coding.MaxShardCount {
+				continue
+			}
+			// A zero-sized shard is residue of a failed operation, not a
+			// shard; counting it as present would let a broken copy pass
+			// verification and the source be deleted behind it.
+			if s.Size <= 0 {
+				zeroSized = zeroSized.Set(erasure_coding.ShardId(s.ShardId))
+				continue
+			}
+			bits = bits.Set(erasure_coding.ShardId(s.ShardId))
+		}
+		for _, sid := range shardIds {
+			if bits.Has(sid) {
+				continue
+			}
+			if zeroSized.Has(sid) {
+				return fmt.Errorf("%s has a zero-sized EC shard %d.%d after copy/mount; keeping source", server, volumeId, sid)
+			}
+			return fmt.Errorf("%s missing EC shard %d.%d after copy/mount; keeping source", server, volumeId, sid)
+		}
+		return nil
+	})
+}
+
+// MountEcShards mounts shards already on server.
+func (m *Mover) MountEcShards(ctx context.Context, volumeId needle.VolumeId, collection string, server pb.ServerAddress, shardIds []erasure_coding.ShardId) error {
+	return m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		_, mountErr := client.VolumeEcShardsMount(ctx, &volume_server_pb.VolumeEcShardsMountRequest{
+			VolumeId:   uint32(volumeId),
+			Collection: collection,
+			ShardIds:   erasure_coding.ShardIdsToUint32(shardIds),
+		})
+		return mountErr
+	})
+}
+
+// UnmountEcShards unmounts shards on server.
+func (m *Mover) UnmountEcShards(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress, shardIds []erasure_coding.ShardId) error {
+	return m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		_, unmountErr := client.VolumeEcShardsUnmount(ctx, &volume_server_pb.VolumeEcShardsUnmountRequest{
+			VolumeId: uint32(volumeId),
+			ShardIds: erasure_coding.ShardIdsToUint32(shardIds),
+		})
+		return unmountErr
+	})
+}
+
+// DeleteEcShards deletes shards on server. The delete is server-wide: it
+// removes the shards from every disk of the server.
+func (m *Mover) DeleteEcShards(ctx context.Context, volumeId needle.VolumeId, collection string, server pb.ServerAddress, shardIds []erasure_coding.ShardId) error {
+	return m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		_, deleteErr := client.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
+			VolumeId:   uint32(volumeId),
+			Collection: collection,
+			ShardIds:   erasure_coding.ShardIdsToUint32(shardIds),
+		})
+		return deleteErr
+	})
+}
+
+// IsNoSpaceLeftError matches the volume server's refusal when no local disk
+// can take the copied shard ("no space left" from FindEcShardTargetLocation,
+// an ENOSPC writing to a caller-pinned disk, and the Rust server's same
+// reply), however the move chain wraps it.
+func IsNoSpaceLeftError(err error) bool {
+	return err != nil && strings.Contains(err.Error(), "no space left")
+}
+
+// RemoveEcShards unmounts then deletes shards in place — the dedup path for a
+// shard that already has a copy elsewhere.
+func (m *Mover) RemoveEcShards(ctx context.Context, volumeId needle.VolumeId, collection string, server pb.ServerAddress, shardIds []erasure_coding.ShardId) error {
+	if err := m.UnmountEcShards(ctx, volumeId, server, shardIds); err != nil {
+		return fmt.Errorf("unmount %d.%v from %s: %v", volumeId, shardIds, server, err)
+	}
+	if err := m.DeleteEcShards(ctx, volumeId, collection, server, shardIds); err != nil {
+		return fmt.Errorf("delete %d.%v from %s: %v", volumeId, shardIds, server, err)
+	}
+	return nil
+}
diff --git a/weed/operation/volume_move/ec_move_test.go b/weed/operation/volume_move/ec_move_test.go
new file mode 100644
index 0000000000..2e4756ff62
--- /dev/null
+++ b/weed/operation/volume_move/ec_move_test.go
@@ -0,0 +1,137 @@
+package volume_move
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+)
+
+func ecMove(shardIds ...erasure_coding.ShardId) EcShardMove {
+	return EcShardMove{
+		VolumeId:   7,
+		Collection: "c1",
+		ShardIds:   shardIds,
+		Source:     srcAddr,
+		Target:     dstAddr,
+		TargetDisk: 2,
+	}
+}
+
+func dstShards(shardIds ...uint32) []*volume_server_pb.EcShardInfo {
+	var infos []*volume_server_pb.EcShardInfo
+	for _, sid := range shardIds {
+		infos = append(infos, &volume_server_pb.EcShardInfo{VolumeId: 7, ShardId: sid, Size: 1024})
+	}
+	return infos
+}
+
+func TestMoveEcShardsSequence(t *testing.T) {
+	cluster := newFakeCluster()
+	cluster.ecShards[string(dstAddr)] = dstShards(3, 4)
+
+	err := cluster.mover().MoveEcShards(context.Background(), ecMove(3, 4), EcMoveOptions{IoBytePerSecond: 77})
+	if err != nil {
+		t.Fatalf("MoveEcShards: %v", err)
+	}
+
+	assertCalls(t, cluster.callList(), []string{
+		"dst:8080 VolumeEcShardsCopy",
+		"dst:8080 VolumeEcShardsMount",
+		"dst:8080 VolumeEcShardsInfo",
+		"src:8080 VolumeEcShardsUnmount",
+		"src:8080 VolumeEcShardsDelete",
+	})
+
+	copyReq := cluster.ecCopyReqs[0]
+	if !copyReq.CopyEcxFile || !copyReq.CopyEcjFile || !copyReq.CopyVifFile || !copyReq.CopyEcsumFile {
+		t.Errorf("shard sidecars not all copied: %+v", copyReq)
+	}
+	if copyReq.DiskId != 2 || copyReq.SourceDataNode != string(srcAddr) || copyReq.Collection != "c1" || copyReq.IoBytePerSecond != 77 {
+		t.Errorf("copy request not propagated: %+v", copyReq)
+	}
+}
+
+func TestMoveEcShardsVerifyFailureKeepsSource(t *testing.T) {
+	cluster := newFakeCluster()
+	cluster.ecShards[string(dstAddr)] = dstShards(3) // shard 4 didn't register
+
+	err := cluster.mover().MoveEcShards(context.Background(), ecMove(3, 4), EcMoveOptions{})
+	if err == nil || !strings.Contains(err.Error(), "missing EC shard 7.4") {
+		t.Fatalf("expected missing-shard error, got: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "src:8080 VolumeEcShardsUnmount" || call == "src:8080 VolumeEcShardsDelete" {
+			t.Fatalf("source touched despite verification failure: %v", cluster.callList())
+		}
+	}
+}
+
+func TestMoveEcShardsZeroSizedDestinationKeepsSource(t *testing.T) {
+	// A zero-sized shard on the destination is residue of a failed operation
+	// (seaweedfs issue 10730); verification must not count it as a delivered
+	// shard, or the source is deleted behind a broken copy.
+	cluster := newFakeCluster()
+	cluster.ecShards[string(dstAddr)] = dstShards(3, 4)
+	cluster.ecShards[string(dstAddr)][1].Size = 0 // shard 4 landed as an empty file
+
+	err := cluster.mover().MoveEcShards(context.Background(), ecMove(3, 4), EcMoveOptions{})
+	if err == nil || !strings.Contains(err.Error(), "zero-sized EC shard 7.4") {
+		t.Fatalf("expected zero-sized-shard rejection, got: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "src:8080 VolumeEcShardsUnmount" || call == "src:8080 VolumeEcShardsDelete" {
+			t.Fatalf("source touched despite zero-sized destination shard: %v", cluster.callList())
+		}
+	}
+}
+
+func TestMoveEcShardsRejectsSameServer(t *testing.T) {
+	// The second target is the same server written with an explicit grpc port;
+	// the guard must see through the representation difference.
+	for _, target := range []pb.ServerAddress{srcAddr, pb.ServerAddress("src:8080.18080")} {
+		cluster := newFakeCluster()
+		move := ecMove(3)
+		move.Target = target
+
+		err := cluster.mover().MoveEcShards(context.Background(), move, EcMoveOptions{})
+		if err == nil || !strings.Contains(err.Error(), "its own server") {
+			t.Fatalf("target %q: expected same-server rejection, got: %v", target, err)
+		}
+		if len(cluster.callList()) != 0 {
+			t.Fatalf("target %q: RPCs issued for a rejected move: %v", target, cluster.callList())
+		}
+	}
+}
+
+func TestRemoveEcShards(t *testing.T) {
+	cluster := newFakeCluster()
+
+	err := cluster.mover().RemoveEcShards(context.Background(), 7, "c1", srcAddr, []erasure_coding.ShardId{3})
+	if err != nil {
+		t.Fatalf("RemoveEcShards: %v", err)
+	}
+
+	assertCalls(t, cluster.callList(), []string{
+		"src:8080 VolumeEcShardsUnmount",
+		"src:8080 VolumeEcShardsDelete",
+	})
+}
+
+func TestCopyAndMountEcShardsSameAddressMountsOnly(t *testing.T) {
+	cluster := newFakeCluster()
+
+	err := cluster.mover().CopyAndMountEcShards(context.Background(), 7, "c1", []erasure_coding.ShardId{3}, srcAddr, srcAddr, 0, 0, nil)
+	if err != nil {
+		t.Fatalf("CopyAndMountEcShards: %v", err)
+	}
+
+	assertCalls(t, cluster.callList(), []string{
+		"src:8080 VolumeEcShardsMount",
+	})
+}
diff --git a/weed/operation/volume_move/fake_client_test.go b/weed/operation/volume_move/fake_client_test.go
new file mode 100644
index 0000000000..7d1ba5c6fa
--- /dev/null
+++ b/weed/operation/volume_move/fake_client_test.go
@@ -0,0 +1,230 @@
+package volume_move
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// fakeCluster fakes the volume servers a move touches. It records every RPC as
+// "<server> <method>" so tests can assert the exact sequence, and lets tests
+// inject per-RPC errors and per-server state.
+type fakeCluster struct {
+	mu    sync.Mutex
+	calls []string
+
+	// errs fails an RPC, keyed "<server> <method>".
+	errs map[string]error
+	// readonly is each server's VolumeStatus.IsReadOnly answer.
+	readonly map[string]bool
+	// status is each server's ReadVolumeFileStatus answer.
+	status map[string]*volume_server_pb.ReadVolumeFileStatusResponse
+	// statusFailures fails a server's next N ReadVolumeFileStatus calls, e.g.
+	// to model a target that has no volume before the copy but one after. The
+	// failures use statusFailureErr, defaulting to a server-side (gRPC code
+	// Unknown) volume-not-found error.
+	statusFailures   map[string]int
+	statusFailureErr error
+	// statusSeq overrides a server's next ReadVolumeFileStatus answers in
+	// order, e.g. to model a source that changes between two reads.
+	statusSeq map[string][]*volume_server_pb.ReadVolumeFileStatusResponse
+	// ecShards is each server's VolumeEcShardsInfo answer.
+	ecShards map[string][]*volume_server_pb.EcShardInfo
+
+	lastAppendAtNs uint64
+
+	copyReqs   []*volume_server_pb.VolumeCopyRequest
+	deleteReqs []*volume_server_pb.VolumeDeleteRequest
+	ecCopyReqs []*volume_server_pb.VolumeEcShardsCopyRequest
+}
+
+func newFakeCluster() *fakeCluster {
+	return &fakeCluster{
+		errs:           make(map[string]error),
+		readonly:       make(map[string]bool),
+		status:         make(map[string]*volume_server_pb.ReadVolumeFileStatusResponse),
+		statusFailures: make(map[string]int),
+		statusSeq:      make(map[string][]*volume_server_pb.ReadVolumeFileStatusResponse),
+		ecShards:       make(map[string][]*volume_server_pb.EcShardInfo),
+	}
+}
+
+func (c *fakeCluster) mover() *Mover {
+	return NewMoverWithClientFunc(func(streamingMode bool, addr pb.ServerAddress, fn func(client volume_server_pb.VolumeServerClient) error) error {
+		return fn(&fakeClient{cluster: c, addr: string(addr)})
+	})
+}
+
+func (c *fakeCluster) record(addr, method string) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.calls = append(c.calls, addr+" "+method)
+	return c.errs[addr+" "+method]
+}
+
+func (c *fakeCluster) callList() []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return append([]string(nil), c.calls...)
+}
+
+// fakeClient answers as the volume server at addr. Unused VolumeServerClient
+// methods panic via the embedded nil interface.
+type fakeClient struct {
+	volume_server_pb.VolumeServerClient
+	cluster *fakeCluster
+	addr    string
+}
+
+func (f *fakeClient) VolumeStatus(ctx context.Context, req *volume_server_pb.VolumeStatusRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeStatusResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeStatus"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeStatusResponse{IsReadOnly: f.cluster.readonly[f.addr]}, nil
+}
+
+func (f *fakeClient) VolumeMarkReadonly(ctx context.Context, req *volume_server_pb.VolumeMarkReadonlyRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeMarkReadonlyResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeMarkReadonly"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeMarkReadonlyResponse{}, nil
+}
+
+func (f *fakeClient) VolumeMarkWritable(ctx context.Context, req *volume_server_pb.VolumeMarkWritableRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeMarkWritableResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeMarkWritable"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeMarkWritableResponse{}, nil
+}
+
+func (f *fakeClient) ReadVolumeFileStatus(ctx context.Context, req *volume_server_pb.ReadVolumeFileStatusRequest, opts ...grpc.CallOption) (*volume_server_pb.ReadVolumeFileStatusResponse, error) {
+	if err := f.cluster.record(f.addr, "ReadVolumeFileStatus"); err != nil {
+		return nil, err
+	}
+	f.cluster.mu.Lock()
+	failures := f.cluster.statusFailures[f.addr]
+	if failures > 0 {
+		f.cluster.statusFailures[f.addr] = failures - 1
+	}
+	failureErr := f.cluster.statusFailureErr
+	var seqResp *volume_server_pb.ReadVolumeFileStatusResponse
+	if failures == 0 {
+		if seq := f.cluster.statusSeq[f.addr]; len(seq) > 0 {
+			seqResp = seq[0]
+			f.cluster.statusSeq[f.addr] = seq[1:]
+		}
+	}
+	resp := f.cluster.status[f.addr]
+	f.cluster.mu.Unlock()
+	if failures > 0 {
+		if failureErr != nil {
+			return nil, failureErr
+		}
+		return nil, status.Error(codes.Unknown, fmt.Sprintf("not found volume id %d", req.VolumeId))
+	}
+	if seqResp != nil {
+		return seqResp, nil
+	}
+	if resp == nil {
+		return nil, status.Error(codes.Unknown, fmt.Sprintf("not found volume id %d", req.VolumeId))
+	}
+	return resp, nil
+}
+
+func (f *fakeClient) VolumeCopy(ctx context.Context, req *volume_server_pb.VolumeCopyRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[volume_server_pb.VolumeCopyResponse], error) {
+	if err := f.cluster.record(f.addr, "VolumeCopy"); err != nil {
+		return nil, err
+	}
+	f.cluster.mu.Lock()
+	f.cluster.copyReqs = append(f.cluster.copyReqs, req)
+	lastAppendAtNs := f.cluster.lastAppendAtNs
+	f.cluster.mu.Unlock()
+	return &fakeCopyStream{resps: []*volume_server_pb.VolumeCopyResponse{
+		{ProcessedBytes: 1024},
+		{LastAppendAtNs: lastAppendAtNs},
+	}}, nil
+}
+
+func (f *fakeClient) VolumeTailReceiver(ctx context.Context, req *volume_server_pb.VolumeTailReceiverRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeTailReceiverResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeTailReceiver"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeTailReceiverResponse{}, nil
+}
+
+func (f *fakeClient) VolumeDelete(ctx context.Context, req *volume_server_pb.VolumeDeleteRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeDeleteResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeDelete"); err != nil {
+		return nil, err
+	}
+	f.cluster.mu.Lock()
+	f.cluster.deleteReqs = append(f.cluster.deleteReqs, req)
+	f.cluster.mu.Unlock()
+	return &volume_server_pb.VolumeDeleteResponse{}, nil
+}
+
+func (f *fakeClient) VolumeConfigure(ctx context.Context, req *volume_server_pb.VolumeConfigureRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeConfigureResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeConfigure"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeConfigureResponse{}, nil
+}
+
+func (f *fakeClient) VolumeEcShardsCopy(ctx context.Context, req *volume_server_pb.VolumeEcShardsCopyRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeEcShardsCopyResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeEcShardsCopy"); err != nil {
+		return nil, err
+	}
+	f.cluster.mu.Lock()
+	f.cluster.ecCopyReqs = append(f.cluster.ecCopyReqs, req)
+	f.cluster.mu.Unlock()
+	return &volume_server_pb.VolumeEcShardsCopyResponse{}, nil
+}
+
+func (f *fakeClient) VolumeEcShardsMount(ctx context.Context, req *volume_server_pb.VolumeEcShardsMountRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeEcShardsMountResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeEcShardsMount"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeEcShardsMountResponse{}, nil
+}
+
+func (f *fakeClient) VolumeEcShardsUnmount(ctx context.Context, req *volume_server_pb.VolumeEcShardsUnmountRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeEcShardsUnmountResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeEcShardsUnmount"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeEcShardsUnmountResponse{}, nil
+}
+
+func (f *fakeClient) VolumeEcShardsDelete(ctx context.Context, req *volume_server_pb.VolumeEcShardsDeleteRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeEcShardsDeleteResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeEcShardsDelete"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeEcShardsDeleteResponse{}, nil
+}
+
+func (f *fakeClient) VolumeEcShardsInfo(ctx context.Context, req *volume_server_pb.VolumeEcShardsInfoRequest, opts ...grpc.CallOption) (*volume_server_pb.VolumeEcShardsInfoResponse, error) {
+	if err := f.cluster.record(f.addr, "VolumeEcShardsInfo"); err != nil {
+		return nil, err
+	}
+	return &volume_server_pb.VolumeEcShardsInfoResponse{EcShardInfos: f.cluster.ecShards[f.addr]}, nil
+}
+
+// fakeCopyStream feeds the canned VolumeCopy responses, then io.EOF.
+type fakeCopyStream struct {
+	grpc.ClientStream
+	resps []*volume_server_pb.VolumeCopyResponse
+}
+
+func (s *fakeCopyStream) Recv() (*volume_server_pb.VolumeCopyResponse, error) {
+	if len(s.resps) == 0 {
+		return nil, io.EOF
+	}
+	resp := s.resps[0]
+	s.resps = s.resps[1:]
+	return resp, nil
+}
diff --git a/weed/operation/volume_move/mover.go b/weed/operation/volume_move/mover.go
new file mode 100644
index 0000000000..c68b075ae4
--- /dev/null
+++ b/weed/operation/volume_move/mover.go
@@ -0,0 +1,113 @@
+// Package volume_move implements the volume and EC shard move sequences shared
+// by the interactive shell commands (volume.move, volume.balance, ec.balance,
+// volume.tier.move, ...) and the maintenance workers (balance, ec_balance,
+// volume_tiering). The RPCs go through an injectable ClientFunc so every
+// sequence can be unit tested against a fake volume server client.
+package volume_move
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+)
+
+// ClientFunc runs fn with a client for the volume server at addr. It matches
+// operation.WithVolumeServerClient, which production movers use to dial real
+// servers; tests substitute a fake client.
+type ClientFunc func(streamingMode bool, addr pb.ServerAddress, fn func(client volume_server_pb.VolumeServerClient) error) error
+
+// Mover executes volume and EC shard moves against volume servers.
+type Mover struct {
+	withClient ClientFunc
+}
+
+func NewMover(grpcDialOption grpc.DialOption) *Mover {
+	return &Mover{withClient: func(streamingMode bool, addr pb.ServerAddress, fn func(client volume_server_pb.VolumeServerClient) error) error {
+		// Validated here, the single point every mover RPC dials through:
+		// handing a malformed address (an unvalidated -source/-target flag)
+		// to the dialer would abort the whole process instead of failing the
+		// move.
+		if err := checkDialable(addr); err != nil {
+			return err
+		}
+		return operation.WithVolumeServerClient(streamingMode, addr, grpcDialOption, fn)
+	}}
+}
+
+// checkDialable rejects an address whose grpc normalization would abort the
+// process: for the "host:port" form, ServerAddress.ToGrpcAddress falls back
+// to a parser that calls glog.Fatalf when the port is not numeric. Everything
+// else either normalizes cleanly or fails at dial time as an ordinary error.
+// It also guards the source addresses embedded in copy/tail requests: the
+// receiving volume server dials those through the same fatal parser, so an
+// unchecked malformed source would terminate the destination server.
+func checkDialable(addr pb.ServerAddress) error {
+	s := string(addr)
+	colon := strings.LastIndex(s, ":")
+	if colon < 0 || colon+1 >= len(s) {
+		return nil // no port part; handed to the dialer untouched
+	}
+	ports := s[colon+1:]
+	if dot := strings.LastIndex(ports, "."); dot >= 0 {
+		// "port.grpcPort": different dial paths canonicalize a half-malformed
+		// form differently (the method splices the grpc part in unparsed; the
+		// string helper falls back to the http part + 10000), so a bad
+		// component could dial an unintended server or reach the fatal
+		// parser. Require both components numeric.
+		if _, err := strconv.ParseUint(ports[:dot], 10, 64); err != nil {
+			return fmt.Errorf("invalid volume server address %q: port %q is not a number", s, ports[:dot])
+		}
+		if _, err := strconv.ParseUint(ports[dot+1:], 10, 64); err != nil {
+			return fmt.Errorf("invalid volume server address %q: grpc port %q is not a number", s, ports[dot+1:])
+		}
+		return nil
+	}
+	if _, err := strconv.ParseUint(ports, 10, 64); err != nil {
+		return fmt.Errorf("invalid volume server address %q: port %q is not a number", s, ports)
+	}
+	return nil
+}
+
+// NewMoverWithClientFunc builds a Mover on a custom transport.
+func NewMoverWithClientFunc(withClient ClientFunc) *Mover {
+	return &Mover{withClient: withClient}
+}
+
+// SameServer reports whether two addresses name the same volume server. The
+// gRPC endpoint identifies the server process — each has exactly one — so
+// "node:8080" and "node:8080.18080" compare equal, while two servers sharing
+// a degenerate HTTP address (e.g. port 0 in test harnesses) stay distinct.
+// The normalization is non-fatal, unlike ServerAddress.ToGrpcAddress, whose
+// parser exits the process on a malformed port; anything unparsable compares
+// as its literal self.
+func SameServer(a, b pb.ServerAddress) bool {
+	return grpcEndpoint(string(a)) == grpcEndpoint(string(b))
+}
+
+// grpcEndpoint mirrors ServerAddress.ToGrpcAddress ("host:port" gets the
+// +10000 grpc port; "host:port.grpcPort" names it explicitly) but returns a
+// malformed address unchanged instead of exiting.
+func grpcEndpoint(addr string) string {
+	colon := strings.LastIndex(addr, ":")
+	if colon < 0 || colon+1 >= len(addr) {
+		return addr
+	}
+	host, ports := addr[:colon], addr[colon+1:]
+	if dot := strings.LastIndex(ports, "."); dot >= 0 {
+		if grpcPort, err := strconv.Atoi(ports[dot+1:]); err == nil {
+			return util.JoinHostPort(host, grpcPort)
+		}
+		return addr
+	}
+	httpPort, err := strconv.Atoi(ports)
+	if err != nil {
+		return addr
+	}
+	return util.JoinHostPort(host, httpPort+10000)
+}
diff --git a/weed/operation/volume_move/volume_move.go b/weed/operation/volume_move/volume_move.go
new file mode 100644
index 0000000000..e195a0f845
--- /dev/null
+++ b/weed/operation/volume_move/volume_move.go
@@ -0,0 +1,504 @@
+package volume_move
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// ErrSourceKeptReadonly marks a move failure whose recovery deliberately keeps
+// the source volume readonly — the target copy may hold data the source lacks
+// (an ambiguous source delete, or an undeletable stale copy). Callers that
+// froze the source themselves must not thaw it on this error.
+var ErrSourceKeptReadonly = errors.New("the source volume is deliberately kept readonly")
+
+// VolumeMoveOptions control LiveMoveVolume.
+type VolumeMoveOptions struct {
+	// DiskType changes the volume's disk type on the target ("" keeps it).
+	DiskType string
+	// IoBytePerSecond throttles the copy (0 = unlimited).
+	IoBytePerSecond int64
+	// IdleTimeout is how long the tail phase waits for in-flight requests to
+	// drain (default 5s).
+	IdleTimeout time.Duration
+	// Writer receives human-readable progress lines (nil discards them).
+	Writer io.Writer
+	// Progress, when set, receives percent/stage callbacks as the move advances.
+	Progress func(percent float64, stage string)
+}
+
+func (o *VolumeMoveOptions) fillDefaults() {
+	if o.IdleTimeout <= 0 {
+		o.IdleTimeout = 5 * time.Second
+	}
+	if o.Writer == nil {
+		o.Writer = io.Discard
+	}
+	if o.Progress == nil {
+		o.Progress = func(float64, string) {}
+	}
+}
+
+// LiveMoveVolume moves one volume between volume servers while it keeps serving
+// reads: freeze the source (readonly), copy, tail to drain in-flight requests,
+// verify the target matches the source, then delete the source. A failure
+// before the source delete restores the source's writability if this move is
+// what froze it.
+func (m *Mover) LiveMoveVolume(ctx context.Context, volumeId needle.VolumeId, source, target pb.ServerAddress, opts VolumeMoveOptions) (err error) {
+	opts.fillDefaults()
+
+	// VolumeCopy tears down any existing copy on the target first, so a
+	// same-server "move" would delete the volume and then fail to read it.
+	// SameServer, not ==: "node:8080" and "node:8080.18080" are one server.
+	if SameServer(source, target) {
+		return fmt.Errorf("refusing to move volume %d onto its own server %s", volumeId, source)
+	}
+
+	opts.Progress(10, fmt.Sprintf("marking volume %d readonly on %s", volumeId, source))
+	sourceWasWritable, err := m.ensureVolumeReadonly(ctx, volumeId, source, true)
+	// The source stays authoritative until its delete succeeds; on any earlier
+	// failure undo the freeze this move added and clean up the target copy.
+	// Installed before the error check: the marking RPC itself can fail after
+	// the server applied the mark (e.g. its master notification failed).
+	var copyStarted, copyCompleted, sourceDeleteStarted bool
+	var targetHadVolume, targetStateKnown bool
+	defer func() {
+		if err != nil {
+			if sourceDeleteStarted {
+				// Past verification: the target is complete and may already hold
+				// new writes, and the delete may or may not have reached the
+				// source. Deleting the target or reopening the source could fork
+				// the volume; keep the source readonly.
+				fmt.Fprintf(opts.Writer, "volume %d is left readonly on %s: the source delete failed with the verified copy on %s mounted\n", volumeId, source, target)
+				glog.Warningf("volume %d is left readonly on %s: the source delete failed with the verified copy on %s mounted", volumeId, source, target)
+				err = fmt.Errorf("%w: %w", ErrSourceKeptReadonly, err)
+				return
+			}
+			// The cleanup runs on its own deadline so an abort via cancelled
+			// context still cleans up.
+			cleanupCtx, cleanupCancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
+			defer cleanupCancel()
+			cleanupTarget := copyCompleted
+			if copyStarted && !copyCompleted {
+				// The server can finish the copy and mount the target even when
+				// the client loses the stream, so probe rather than assume.
+				exists, known := m.probeVolume(cleanupCtx, volumeId, target)
+				switch {
+				case known && !exists:
+					// nothing mounted on the target; just undo the freeze below
+				case known && exists && targetStateKnown && !targetHadVolume:
+					// the failed copy created it; remove it so the source stays
+					// the only replica
+					cleanupTarget = true
+				default:
+					// A copy may sit mounted on the target and its provenance
+					// cannot be proven: the prior state is unknown, the target
+					// held a replica before the move, or the probe failed.
+					// Deleting it risks someone else's replica; reopening the
+					// source beside it risks two writable replicas taking
+					// divergent writes. Keep the source readonly.
+					fmt.Fprintf(opts.Writer, "volume %d is left readonly on %s: a copy may exist on %s but its origin cannot be determined; delete one side explicitly, then re-run the move\n", volumeId, source, target)
+					glog.Warningf("volume %d is left readonly on %s: a copy may exist on %s but its origin cannot be determined; delete one side explicitly, then re-run the move", volumeId, source, target)
+					err = fmt.Errorf("%w: %w", ErrSourceKeptReadonly, err)
+					return
+				}
+			}
+			if cleanupTarget {
+				// The target copy may be missing tailed entries; remove it so
+				// the source stays the only replica.
+				if dErr := m.DeleteVolume(cleanupCtx, volumeId, target, false, false, true); dErr != nil {
+					// Restoring the source while the stale target stays mounted
+					// risks divergent replicas; keep the source readonly. A
+					// re-run refuses while the copy exists, so name the fix.
+					fmt.Fprintf(opts.Writer, "volume %d is left readonly on %s: failed to delete the incomplete copy on %s: %v; delete that copy, then re-run the move\n", volumeId, source, target, dErr)
+					glog.Warningf("volume %d is left readonly on %s: failed to delete the incomplete copy on %s: %v; delete that copy, then re-run the move", volumeId, source, target, dErr)
+					err = fmt.Errorf("%w: %w", ErrSourceKeptReadonly, err)
+					return
+				}
+			}
+			if sourceWasWritable {
+				m.restoreVolumeWritable(volumeId, source)
+			} else {
+				// The hard freeze added on top of a readonly-reporting status is
+				// kept: it is indistinguishable from an operator's mark. It is
+				// not persisted, so a volume server restart clears it.
+				fmt.Fprintf(opts.Writer, "volume %d on %s keeps the readonly mark the move added; volume.mark -writable clears it if the prior readonly state was transient\n", volumeId, source)
+			}
+		}
+	}()
+	if err != nil {
+		return fmt.Errorf("mark volume %d readonly on %s: %v", volumeId, source, err)
+	}
+
+	targetHadVolume, targetStateKnown = m.probeVolume(ctx, volumeId, target)
+	if !sourceWasWritable {
+		// A readonly source next to an existing copy is the signature of a
+		// previous move whose source delete failed — that copy may be the
+		// authoritative one, serving writes the source never saw, and the
+		// copy below would tear it down. No client-side observation proves
+		// otherwise: compaction revision is shared by ordinary replicas,
+		// aggregate sizes shrink under compaction, and any snapshot can be
+		// invalidated by a write right after it. Fail closed on any existing
+		// copy or unknown state; the operator deletes one side explicitly.
+		if !targetStateKnown {
+			err = fmt.Errorf("%w: cannot determine whether %s already holds a copy of volume %d; refusing to overwrite it while the source is readonly", ErrSourceKeptReadonly, target, volumeId)
+			return err
+		}
+		if targetHadVolume {
+			err = fmt.Errorf("%w: volume %d already has a copy on %s while the source on %s is readonly — likely a previous move that did not finish; delete the source to keep that copy, or delete the copy before re-running the move", ErrSourceKeptReadonly, volumeId, target, source)
+			return err
+		}
+	}
+
+	opts.Progress(20, fmt.Sprintf("copying volume %d from %s to %s", volumeId, source, target))
+	fmt.Fprintf(opts.Writer, "copying volume %d from %s to %s\n", volumeId, source, target)
+	copyStarted = true
+	lastAppendAtNs, err := m.copyVolumeData(ctx, volumeId, source, target, opts.DiskType, opts.IoBytePerSecond, opts.Writer)
+	if err != nil {
+		return fmt.Errorf("copy volume %d from %s to %s: %v", volumeId, source, target, err)
+	}
+	copyCompleted = true
+
+	opts.Progress(70, fmt.Sprintf("tailing volume %d from %s to %s", volumeId, source, target))
+	fmt.Fprintf(opts.Writer, "tailing volume %d from %s to %s\n", volumeId, source, target)
+	tailFailed := false
+	if tailErr := m.TailVolume(ctx, volumeId, source, target, lastAppendAtNs, opts.IdleTimeout); tailErr != nil {
+		// A tail failure is tolerable only when the volume was already readonly
+		// before this move began: frozen for the whole copy, it should have no
+		// in-flight writes for the tail to drain — and the stability check
+		// below still proves it. A volume this move froze can have stragglers
+		// admitted just before the freeze that only the tail delivers, so
+		// losing the tail there must abort the move.
+		if sourceWasWritable {
+			return fmt.Errorf("tail volume %d from %s to %s: %v", volumeId, source, target, tailErr)
+		}
+		tailFailed = true
+		fmt.Fprintf(opts.Writer, "tail volume %d from %s to %s: %v\n", volumeId, source, target, tailErr)
+		glog.Warningf("tail volume %d from %s to %s: %v", volumeId, source, target, tailErr)
+	}
+
+	// Verify before the point of no return: the source is deleted only when the
+	// target holds at least everything the source does. The source status is
+	// read here, after the tail — a write in flight when the source was frozen
+	// can still land after an earlier read, and a stale snapshot would wave
+	// through an incomplete target.
+	opts.Progress(85, fmt.Sprintf("verifying volume %d on %s", volumeId, target))
+	sourceStatus, err := m.ReadVolumeFileStatus(ctx, volumeId, source)
+	if err != nil {
+		return fmt.Errorf("read volume %d status on %s: %v", volumeId, source, err)
+	}
+	if tailFailed {
+		// A successful tail proves the source held still for the idle window; a
+		// tolerated tail failure proved nothing, so substitute the same drain
+		// barrier here: the source status must not change across the window.
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(opts.IdleTimeout):
+		}
+		secondStatus, statusErr := m.ReadVolumeFileStatus(ctx, volumeId, source)
+		if statusErr != nil {
+			return fmt.Errorf("re-read volume %d status on %s: %v", volumeId, source, statusErr)
+		}
+		if secondStatus.DatFileSize != sourceStatus.DatFileSize || secondStatus.IdxFileSize != sourceStatus.IdxFileSize || secondStatus.FileCount != sourceStatus.FileCount {
+			return fmt.Errorf("volume %d on %s is still changing after a failed tail; aborting the move", volumeId, source)
+		}
+		sourceStatus = secondStatus
+	}
+	targetStatus, err := m.ReadVolumeFileStatus(ctx, volumeId, target)
+	if err != nil {
+		return fmt.Errorf("verify volume %d on target %s before deleting source: %v", volumeId, target, err)
+	}
+	if err = verifyTargetNotBehind(volumeId, sourceStatus, targetStatus); err != nil {
+		return err
+	}
+	if targetStatus.DatFileSize > sourceStatus.DatFileSize || targetStatus.IdxFileSize > sourceStatus.IdxFileSize || targetStatus.FileCount > sourceStatus.FileCount {
+		// The target announced itself writable when the copy mounted it, so
+		// clients may have written to it during the tail. Those writes live on
+		// the surviving copy; committing keeps them.
+		fmt.Fprintf(opts.Writer, "volume %d on %s has writes beyond the source; they stay with the moved volume\n", volumeId, target)
+	}
+
+	opts.Progress(90, fmt.Sprintf("deleting volume %d from %s", volumeId, source))
+	fmt.Fprintf(opts.Writer, "deleting volume %d from %s\n", volumeId, source)
+	sourceDeleteStarted = true
+	if err = m.DeleteVolume(ctx, volumeId, source, false, false, true); err != nil {
+		return fmt.Errorf("delete volume %d from %s: %v", volumeId, source, err)
+	}
+
+	opts.Progress(100, fmt.Sprintf("moved volume %d from %s to %s", volumeId, source, target))
+	fmt.Fprintf(opts.Writer, "moved volume %d from %s to %s\n", volumeId, source, target)
+	return nil
+}
+
+// verifyTargetNotBehind fails when the target holds less than the (frozen)
+// source — the copy or tail missed data and deleting the source would lose it.
+// A target that is ahead is not an error: the target serves writes during the
+// tail, and those belong to the copy that survives the move.
+func verifyTargetNotBehind(volumeId needle.VolumeId, source, target *volume_server_pb.ReadVolumeFileStatusResponse) error {
+	if target.DatFileSize < source.DatFileSize {
+		return fmt.Errorf("volume %d target is behind the source: .dat %d < %d bytes", volumeId, target.DatFileSize, source.DatFileSize)
+	}
+	if target.IdxFileSize < source.IdxFileSize {
+		return fmt.Errorf("volume %d target is behind the source: .idx %d < %d bytes", volumeId, target.IdxFileSize, source.IdxFileSize)
+	}
+	if target.FileCount < source.FileCount {
+		return fmt.Errorf("volume %d target is behind the source: %d < %d files", volumeId, target.FileCount, source.FileCount)
+	}
+	return nil
+}
+
+// CopyVolume freezes the volume on source, copies it to target, and reports the
+// stamp of the last entry copied. restoreWritable also restores the source's
+// writability on success, for copies that leave the source serving; a failed
+// copy always undoes the freeze this call added.
+func (m *Mover) CopyVolume(ctx context.Context, volumeId needle.VolumeId, source, target pb.ServerAddress, diskType string, ioBytePerSecond int64, restoreWritable bool, writer io.Writer) (lastAppendAtNs uint64, err error) {
+	if writer == nil {
+		writer = io.Discard
+	}
+	if SameServer(source, target) {
+		return 0, fmt.Errorf("refusing to copy volume %d onto its own server %s", volumeId, source)
+	}
+	// The copy is non-destructive, so a readonly-reporting source is taken as
+	// is (force=false): missed concurrent deletes only make the new replica
+	// trivially stale, and hard-marking here could pin a transiently readonly
+	// (e.g. low-disk) source readonly with nothing to gate on it.
+	sourceWasWritable, err := m.ensureVolumeReadonly(ctx, volumeId, source, false)
+	defer func() {
+		if sourceWasWritable && (err != nil || restoreWritable) {
+			m.restoreVolumeWritable(volumeId, source)
+		}
+	}()
+	if err != nil {
+		return 0, err
+	}
+	return m.copyVolumeData(ctx, volumeId, source, target, diskType, ioBytePerSecond, writer)
+}
+
+// ensureVolumeReadonly freezes the volume on server and reports whether it was
+// writable beforehand — only then may a failure path undo the freeze, since a
+// volume that was already readonly (e.g. full, or operator-set) must stay so.
+// With force, the mark is issued even when the status already reports
+// readonly: that answer also covers transient low-disk state and the
+// readonly-but-can-delete flag, and neither blocks needle deletes, so only the
+// hard mark makes the volume immutable — required before deleting the source
+// of a move. Without force, a readonly-reporting volume is left untouched.
+func (m *Mover) ensureVolumeReadonly(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress, force bool) (wasWritable bool, err error) {
+	err = m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		resp, statusErr := client.VolumeStatus(ctx, &volume_server_pb.VolumeStatusRequest{
+			VolumeId: uint32(volumeId),
+		})
+		if statusErr != nil {
+			return statusErr
+		}
+		wasWritable = !resp.IsReadOnly
+		if !wasWritable && !force {
+			return nil
+		}
+		_, readonlyErr := client.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{
+			VolumeId: uint32(volumeId),
+			Persist:  false,
+		})
+		return readonlyErr
+	})
+	return
+}
+
+// probeVolume reports whether server currently has the volume, and whether the
+// answer is trustworthy. The Go server answers a missing volume with a plain
+// error (gRPC code Unknown — the only way this RPC fails there); the Rust
+// server answers with codes.NotFound. Both mean the server responded and the
+// volume is absent. A transport-level failure means the state is unknown, and
+// callers deciding to delete must treat unknown as hands-off.
+func (m *Mover) probeVolume(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress) (exists bool, known bool) {
+	_, err := m.ReadVolumeFileStatus(ctx, volumeId, server)
+	if err == nil {
+		return true, true
+	}
+	if s, ok := status.FromError(err); ok && (s.Code() == codes.Unknown || s.Code() == codes.NotFound) {
+		return false, true
+	}
+	return false, false
+}
+
+// restoreVolumeWritable undoes a readonly mark after a failed move. It runs on
+// its own deadline so an abort via cancelled context still restores the source,
+// and only logs a failure — the caller is already returning the move error.
+func (m *Mover) restoreVolumeWritable(volumeId needle.VolumeId, server pb.ServerAddress) {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	if err := m.MarkVolumeWritable(ctx, volumeId, server, true, false); err != nil {
+		glog.Warningf("restore volume %d writable on %s: %v", volumeId, server, err)
+	}
+}
+
+// copyVolumeData streams a VolumeCopy on the target, which pulls the volume
+// from source and mounts it, and returns the stamp of the last entry copied
+// for the tail phase.
+func (m *Mover) copyVolumeData(ctx context.Context, volumeId needle.VolumeId, source, target pb.ServerAddress, diskType string, ioBytePerSecond int64, writer io.Writer) (lastAppendAtNs uint64, err error) {
+	// The target dials the embedded source itself; a malformed one would
+	// abort the target server, not this client.
+	if err = checkDialable(source); err != nil {
+		return 0, err
+	}
+	err = m.withClient(true, target, func(client volume_server_pb.VolumeServerClient) error {
+		stream, replicateErr := client.VolumeCopy(ctx, &volume_server_pb.VolumeCopyRequest{
+			VolumeId:        uint32(volumeId),
+			SourceDataNode:  string(source),
+			DiskType:        diskType,
+			IoBytePerSecond: ioBytePerSecond,
+		})
+		if replicateErr != nil {
+			return replicateErr
+		}
+		for {
+			resp, recvErr := stream.Recv()
+			if recvErr != nil {
+				if recvErr == io.EOF {
+					break
+				}
+				return recvErr
+			}
+			if resp.LastAppendAtNs != 0 {
+				lastAppendAtNs = resp.LastAppendAtNs
+			} else {
+				fmt.Fprintf(writer, "%s => %s volume %d processed %s\n", source, target, volumeId, util.BytesToHumanReadable(uint64(resp.ProcessedBytes)))
+			}
+		}
+		return nil
+	})
+	return
+}
+
+// TailVolume has the target follow the source's appends since sinceNs until the
+// source stays idle for idleTimeout, draining requests in flight when the move
+// froze the source.
+func (m *Mover) TailVolume(ctx context.Context, volumeId needle.VolumeId, source, target pb.ServerAddress, sinceNs uint64, idleTimeout time.Duration) error {
+	// The target dials the embedded source itself; a malformed one would
+	// abort the target server, not this client.
+	if err := checkDialable(source); err != nil {
+		return err
+	}
+	return m.withClient(true, target, func(client volume_server_pb.VolumeServerClient) error {
+		_, replicateErr := client.VolumeTailReceiver(ctx, &volume_server_pb.VolumeTailReceiverRequest{
+			VolumeId:           uint32(volumeId),
+			SinceNs:            sinceNs,
+			IdleTimeoutSeconds: uint32(idleTimeout.Seconds()),
+			SourceVolumeServer: string(source),
+		})
+		return replicateErr
+	})
+}
+
+// ReadVolumeFileStatus reads the volume's file sizes and needle count on server.
+func (m *Mover) ReadVolumeFileStatus(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress) (resp *volume_server_pb.ReadVolumeFileStatusResponse, err error) {
+	err = m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		var statusErr error
+		resp, statusErr = client.ReadVolumeFileStatus(ctx, &volume_server_pb.ReadVolumeFileStatusRequest{
+			VolumeId: uint32(volumeId),
+		})
+		return statusErr
+	})
+	return
+}
+
+// DeleteVolume removes the volume from server. When keepRemoteData is true, the
+// cloud-tier object backing the volume is left intact — used on the source side
+// of a move where another server is taking over the same .vif.
+func (m *Mover) DeleteVolume(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress, onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) error {
+	return m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		_, deleteErr := client.VolumeDelete(ctx, &volume_server_pb.VolumeDeleteRequest{
+			VolumeId:       uint32(volumeId),
+			OnlyEmpty:      onlyEmpty,
+			OnlyGarbage:    onlyGarbage,
+			KeepRemoteData: keepRemoteData,
+		})
+		return deleteErr
+	})
+}
+
+// MarkVolumeWritable marks the volume writable (or readonly when writable is
+// false, persisted per persist) on server.
+func (m *Mover) MarkVolumeWritable(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress, writable, persist bool) (err error) {
+	return m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		if writable {
+			_, err = client.VolumeMarkWritable(ctx, &volume_server_pb.VolumeMarkWritableRequest{
+				VolumeId: uint32(volumeId),
+			})
+		} else {
+			_, err = client.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{
+				VolumeId: uint32(volumeId),
+				Persist:  persist,
+			})
+		}
+		return err
+	})
+}
+
+// ReplicateVolume copies a volume from source to target without touching the
+// source — the replica-creation half of a move. ioBytePerSecond limits the
+// copy rate; 0 falls back to the volume server's maintenance rate.
+func (m *Mover) ReplicateVolume(ctx context.Context, volumeId needle.VolumeId, source, target pb.ServerAddress, diskType string, ioBytePerSecond int64, writer io.Writer) error {
+	if writer == nil {
+		writer = io.Discard
+	}
+	if SameServer(source, target) {
+		return fmt.Errorf("refusing to replicate volume %d onto its own server %s", volumeId, source)
+	}
+	// The target dials the embedded source itself; a malformed one would
+	// abort the target server, not this client.
+	if err := checkDialable(source); err != nil {
+		return err
+	}
+	return m.withClient(false, target, func(client volume_server_pb.VolumeServerClient) error {
+		stream, replicateErr := client.VolumeCopy(ctx, &volume_server_pb.VolumeCopyRequest{
+			VolumeId:        uint32(volumeId),
+			SourceDataNode:  string(source),
+			DiskType:        diskType,
+			IoBytePerSecond: ioBytePerSecond,
+		})
+		if replicateErr != nil {
+			return replicateErr
+		}
+		for {
+			resp, recvErr := stream.Recv()
+			if recvErr != nil {
+				if recvErr == io.EOF {
+					break
+				}
+				return recvErr
+			}
+			if resp.ProcessedBytes > 0 {
+				fmt.Fprintf(writer, "volume %d processed %s bytes\n", volumeId, util.BytesToHumanReadable(uint64(resp.ProcessedBytes)))
+			}
+		}
+		return nil
+	})
+}
+
+// ConfigureVolumeReplication sets the replication setting on the volume at server.
+func (m *Mover) ConfigureVolumeReplication(ctx context.Context, volumeId needle.VolumeId, server pb.ServerAddress, replication string) error {
+	return m.withClient(false, server, func(client volume_server_pb.VolumeServerClient) error {
+		resp, configureErr := client.VolumeConfigure(ctx, &volume_server_pb.VolumeConfigureRequest{
+			VolumeId:    uint32(volumeId),
+			Replication: replication,
+		})
+		if configureErr != nil {
+			return configureErr
+		}
+		if resp.Error != "" {
+			return errors.New(resp.Error)
+		}
+		return nil
+	})
+}
diff --git a/weed/operation/volume_move/volume_move_test.go b/weed/operation/volume_move/volume_move_test.go
new file mode 100644
index 0000000000..0b41fcbe77
--- /dev/null
+++ b/weed/operation/volume_move/volume_move_test.go
@@ -0,0 +1,633 @@
+package volume_move
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+const (
+	srcAddr = pb.ServerAddress("src:8080")
+	dstAddr = pb.ServerAddress("dst:8080")
+)
+
+func volumeStatus(datSize, idxSize, fileCount uint64) *volume_server_pb.ReadVolumeFileStatusResponse {
+	return &volume_server_pb.ReadVolumeFileStatusResponse{
+		DatFileSize: datSize,
+		IdxFileSize: idxSize,
+		FileCount:   fileCount,
+	}
+}
+
+func TestSameServer(t *testing.T) {
+	if !SameServer("node:8080", "node:8080.18080") {
+		t.Error("one server written with and without an explicit grpc port compared unequal")
+	}
+	// Test harnesses run several servers on HTTP port 0 with distinct grpc
+	// ports; the grpc endpoint is the server's identity.
+	if SameServer("127.0.0.1:0.36825", "127.0.0.1:0.38609") {
+		t.Error("two servers sharing a degenerate HTTP address compared equal")
+	}
+	// Malformed addresses (an unvalidated -source/-target flag) must compare
+	// without touching the fatal ToGrpcAddress parser.
+	if !SameServer("node:abc", "node:abc") {
+		t.Error("identical malformed addresses compared unequal")
+	}
+	if SameServer("node:abc", "node:8080") {
+		t.Error("malformed and well-formed addresses compared equal")
+	}
+	if SameServer("", "node:8080") {
+		t.Error("empty and well-formed addresses compared equal")
+	}
+}
+
+func TestCheckDialable(t *testing.T) {
+	// Rejected: the class the fatal parser aborts on, plus dotted forms with
+	// a non-numeric component — those canonicalize differently across dial
+	// paths ("node:8080.bad" dials as node:bad on one and node:18080 on the
+	// other, silently aliasing another server).
+	for _, addr := range []pb.ServerAddress{"node:abc", "host.domain.com:x8080", "[::1]:abc",
+		"node:8080.bad", "node:bad.8080", "node:.bad", "node:8080."} {
+		if err := checkDialable(addr); err == nil {
+			t.Errorf("%q accepted although it is unsafe to dial", addr)
+		}
+	}
+	// Accepted: normalized cleanly, or handed to the dialer untouched where
+	// a bad address fails as an ordinary error.
+	for _, addr := range []pb.ServerAddress{"node:8080", "node:8080.18080", "127.0.0.1:0.36825", "", "node", "node:"} {
+		if err := checkDialable(addr); err != nil {
+			t.Errorf("%q rejected: %v", addr, err)
+		}
+	}
+}
+
+func TestEmbeddedSourceAddressValidated(t *testing.T) {
+	// The target dials the source embedded in copy/tail requests through the
+	// same fatal parser; the client must reject a malformed source before
+	// issuing any RPC.
+	bad := pb.ServerAddress("node:abc")
+
+	ops := map[string]func(m *Mover) error{
+		"ReplicateVolume": func(m *Mover) error {
+			return m.ReplicateVolume(context.Background(), 7, bad, dstAddr, "", 0, nil)
+		},
+		"TailVolume": func(m *Mover) error {
+			return m.TailVolume(context.Background(), 7, bad, dstAddr, 0, time.Second)
+		},
+		"CopyAndMountEcShards": func(m *Mover) error {
+			return m.CopyAndMountEcShards(context.Background(), 7, "c1", []erasure_coding.ShardId{3}, bad, dstAddr, 0, 0, nil)
+		},
+		"MoveEcShards": func(m *Mover) error {
+			move := ecMove(3)
+			move.Source = bad
+			return m.MoveEcShards(context.Background(), move, EcMoveOptions{})
+		},
+	}
+	for name, op := range ops {
+		cluster := newFakeCluster()
+		err := op(cluster.mover())
+		if err == nil || !strings.Contains(err.Error(), "invalid volume server address") {
+			t.Errorf("%s: expected invalid-address error, got: %v", name, err)
+		}
+		if len(cluster.callList()) != 0 {
+			t.Errorf("%s: RPCs issued with a malformed embedded source: %v", name, cluster.callList())
+		}
+	}
+}
+
+func TestNewMoverRejectsMalformedAddressWithoutDialing(t *testing.T) {
+	// The production dial path must fail the move, not the process, when a
+	// caller passes an unvalidated malformed address.
+	mover := NewMover(grpc.WithTransportCredentials(insecure.NewCredentials()))
+	err := mover.LiveMoveVolume(context.Background(), 7, "node:abc", "node:8080", VolumeMoveOptions{})
+	if err == nil || !strings.Contains(err.Error(), "invalid volume server address") {
+		t.Fatalf("expected invalid-address error, got: %v", err)
+	}
+}
+
+func assertCalls(t *testing.T, got, want []string) {
+	t.Helper()
+	if fmt.Sprint(got) != fmt.Sprint(want) {
+		t.Fatalf("RPC sequence mismatch:\n got:  %v\n want: %v", got, want)
+	}
+}
+
+func TestLiveMoveVolumeSequence(t *testing.T) {
+	cluster := newFakeCluster()
+	cluster.lastAppendAtNs = 12345
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{
+		DiskType:        "ssd",
+		IoBytePerSecond: 42,
+	})
+	if err != nil {
+		t.Fatalf("LiveMoveVolume: %v", err)
+	}
+
+	// The source status read must come after the tail: a write in flight when
+	// the source was frozen can land after an earlier read, and verifying
+	// against that stale snapshot would miss a missed tail. The first target
+	// status read probes whether the target already held the volume, so a
+	// failed copy never cleans up someone else's replica.
+	assertCalls(t, cluster.callList(), []string{
+		"src:8080 VolumeStatus",
+		"src:8080 VolumeMarkReadonly",
+		"dst:8080 ReadVolumeFileStatus",
+		"dst:8080 VolumeCopy",
+		"dst:8080 VolumeTailReceiver",
+		"src:8080 ReadVolumeFileStatus",
+		"dst:8080 ReadVolumeFileStatus",
+		"src:8080 VolumeDelete",
+	})
+
+	copyReq := cluster.copyReqs[0]
+	if copyReq.DiskType != "ssd" || copyReq.IoBytePerSecond != 42 || copyReq.SourceDataNode != string(srcAddr) {
+		t.Errorf("copy request not propagated: %+v", copyReq)
+	}
+	deleteReq := cluster.deleteReqs[0]
+	if deleteReq.OnlyEmpty || !deleteReq.KeepRemoteData {
+		t.Errorf("source delete must keep remote data and not be only-empty: %+v", deleteReq)
+	}
+}
+
+func TestLiveMoveVolumeVerifyMismatchKeepsSource(t *testing.T) {
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(900, 100, 10)
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !strings.Contains(err.Error(), "behind the source") {
+		t.Fatalf("expected target-behind error, got: %v", err)
+	}
+
+	calls := cluster.callList()
+	for _, call := range calls {
+		if call == "src:8080 VolumeDelete" {
+			t.Fatalf("source deleted despite verification failure: %v", calls)
+		}
+	}
+	// The incomplete target copy is removed so the restored source stays the
+	// only replica, then the source is made writable again.
+	if fmt.Sprint(calls[len(calls)-2:]) != fmt.Sprint([]string{"dst:8080 VolumeDelete", "src:8080 VolumeMarkWritable"}) {
+		t.Fatalf("expected target cleanup then source restore, got: %v", calls)
+	}
+}
+
+func TestLiveMoveVolumeAbortKeepsSourceReadonlyWhenTargetCleanupFails(t *testing.T) {
+	// Restoring the source while the stale target stays mounted risks
+	// divergent replicas; the source stays readonly until a re-run recovers.
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(900, 100, 10)
+	cluster.errs["dst:8080 VolumeDelete"] = errors.New("target unreachable")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil {
+		t.Fatal("expected verification failure")
+	}
+	if !errors.Is(err, ErrSourceKeptReadonly) {
+		t.Fatalf("error does not mark the source as deliberately kept readonly: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "src:8080 VolumeMarkWritable" {
+			t.Fatalf("source made writable with the stale target still mounted: %v", cluster.callList())
+		}
+	}
+}
+
+func TestLiveMoveVolumeAlreadyReadonlyStaysReadonly(t *testing.T) {
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.errs["dst:8080 VolumeCopy"] = errors.New("copy failed")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil {
+		t.Fatal("expected copy failure")
+	}
+
+	// The hard mark is issued even for a readonly-reporting volume: that
+	// status also covers low-disk and readonly-but-can-delete states, which
+	// still accept needle deletes.
+	marked := false
+	for _, call := range cluster.callList() {
+		if call == "src:8080 VolumeMarkReadonly" {
+			marked = true
+		}
+		// A volume that was readonly before the move (e.g. full) must stay so.
+		if call == "src:8080 VolumeMarkWritable" {
+			t.Fatal("made an already-readonly volume writable after a failed move")
+		}
+	}
+	if !marked {
+		t.Fatalf("readonly-reporting source not hard-frozen: %v", cluster.callList())
+	}
+}
+
+func TestLiveMoveVolumePreFrozenAbortCleansTarget(t *testing.T) {
+	// tiering.run freezes replicas itself and thaws them after a failed move,
+	// so even a move that did not do the freezing must remove its target copy
+	// on abort — a stale mounted target plus a thawed source is divergence.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(900, 100, 10)
+	cluster.statusFailures[string(dstAddr)] = 1 // no volume on the target before the copy
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil {
+		t.Fatal("expected verification failure")
+	}
+
+	cleaned := false
+	for _, call := range cluster.callList() {
+		if call == "dst:8080 VolumeDelete" {
+			cleaned = true
+		}
+		if call == "src:8080 VolumeMarkWritable" {
+			t.Fatalf("thawed a source this move did not freeze: %v", cluster.callList())
+		}
+	}
+	if !cleaned {
+		t.Fatalf("incomplete target copy not cleaned up: %v", cluster.callList())
+	}
+}
+
+func TestLiveMoveVolumeCopyErrorCleansMountedTarget(t *testing.T) {
+	// The server can finish the copy and mount the target even when the client
+	// loses the stream; the abort probes the target and cleans up the copy.
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.statusFailures[string(dstAddr)] = 1 // no volume on the target before the copy
+	cluster.errs["dst:8080 VolumeCopy"] = errors.New("stream lost")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil {
+		t.Fatal("expected copy failure")
+	}
+
+	calls := cluster.callList()
+	if fmt.Sprint(calls[len(calls)-2:]) != fmt.Sprint([]string{"dst:8080 VolumeDelete", "src:8080 VolumeMarkWritable"}) {
+		t.Fatalf("expected target cleanup then source restore, got: %v", calls)
+	}
+}
+
+func TestLiveMoveVolumeCopyErrorUnknownTargetKeepsSourceReadonly(t *testing.T) {
+	// The pre-copy probe failed at the transport level, so whether the target
+	// held a replica before the move is unknown; the failed copy may still
+	// have mounted a complete copy there (the server can finish after the
+	// client loses the stream). Deleting it risks a healthy pre-existing
+	// replica, and reopening the source beside it risks two writable replicas
+	// taking divergent writes — so the source stays readonly.
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.statusFailures[string(dstAddr)] = 1
+	cluster.statusFailureErr = status.Error(codes.Unavailable, "connection refused")
+	cluster.errs["dst:8080 VolumeCopy"] = errors.New("stream lost")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !errors.Is(err, ErrSourceKeptReadonly) {
+		t.Fatalf("expected kept-readonly failure, got: %v", err)
+	}
+
+	calls := cluster.callList()
+	for _, call := range calls {
+		if call == "dst:8080 VolumeDelete" {
+			t.Fatalf("deleted the target with its prior state unknown: %v", calls)
+		}
+		if call == "src:8080 VolumeMarkWritable" {
+			t.Fatalf("reopened the source beside a possibly-mounted copy: %v", calls)
+		}
+	}
+}
+
+func TestLiveMoveVolumeCopyErrorLeavesPreexistingTarget(t *testing.T) {
+	// A target that held the volume before the move is someone else's replica;
+	// a failed copy must not delete it.
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.errs["dst:8080 VolumeCopy"] = errors.New("copy failed")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !errors.Is(err, ErrSourceKeptReadonly) {
+		t.Fatalf("expected kept-readonly failure, got: %v", err)
+	}
+
+	calls := cluster.callList()
+	for _, call := range calls {
+		if call == "dst:8080 VolumeDelete" {
+			t.Fatalf("deleted a pre-existing target replica after a failed copy: %v", calls)
+		}
+		if call == "src:8080 VolumeMarkWritable" {
+			t.Fatalf("reopened the source with a copy of unprovable origin on the target: %v", calls)
+		}
+	}
+}
+
+func TestLiveMoveVolumeTailErrorAborts(t *testing.T) {
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.errs["dst:8080 VolumeTailReceiver"] = errors.New("tail failed")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !strings.Contains(err.Error(), "tail volume") {
+		t.Fatalf("expected tail error, got: %v", err)
+	}
+
+	calls := cluster.callList()
+	for _, call := range calls {
+		if call == "src:8080 VolumeDelete" {
+			t.Fatalf("source deleted despite tail failure: %v", calls)
+		}
+	}
+	if fmt.Sprint(calls[len(calls)-2:]) != fmt.Sprint([]string{"dst:8080 VolumeDelete", "src:8080 VolumeMarkWritable"}) {
+		t.Fatalf("expected target cleanup then source restore, got: %v", calls)
+	}
+}
+
+func TestLiveMoveVolumeTailErrorToleratedForReadonlySource(t *testing.T) {
+	// A volume that was already readonly before the move was frozen for the
+	// whole copy, so a failed tail has nothing to deliver.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.statusFailures[string(dstAddr)] = 1 // no volume on the target before the copy
+	cluster.errs["dst:8080 VolumeTailReceiver"] = errors.New("tail failed")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{IdleTimeout: time.Millisecond})
+	if err != nil {
+		t.Fatalf("LiveMoveVolume on readonly source with failed tail: %v", err)
+	}
+
+	calls := cluster.callList()
+	if calls[len(calls)-1] != "src:8080 VolumeDelete" {
+		t.Fatalf("move did not complete with source delete: %v", calls)
+	}
+}
+
+func TestLiveMoveVolumeTailFailureAbortsWhenSourceStillChanging(t *testing.T) {
+	// A tolerated tail failure substitutes a drain barrier: the source status
+	// must hold still across the idle window, or the move aborts.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.statusFailures[string(dstAddr)] = 1 // no volume on the target before the copy
+	cluster.statusSeq[string(srcAddr)] = []*volume_server_pb.ReadVolumeFileStatusResponse{
+		volumeStatus(1000, 100, 10),
+		volumeStatus(1024, 116, 11), // a straggler landed between the two reads
+	}
+	cluster.errs["dst:8080 VolumeTailReceiver"] = errors.New("tail failed")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{IdleTimeout: time.Millisecond})
+	if err == nil || !strings.Contains(err.Error(), "still changing") {
+		t.Fatalf("expected still-changing abort, got: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "src:8080 VolumeDelete" {
+			t.Fatalf("source deleted while still changing: %v", cluster.callList())
+		}
+	}
+}
+
+func TestLiveMoveVolumeSourceDeleteFailureKeepsBothReadonly(t *testing.T) {
+	// Past verification the target is complete and may hold new writes, and
+	// the failed delete may or may not have reached the source. Deleting the
+	// target or reopening the source could fork the volume; keep everything
+	// readonly for a re-run.
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.errs["src:8080 VolumeDelete"] = errors.New("delete timed out")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil {
+		t.Fatal("expected source delete failure")
+	}
+	if !errors.Is(err, ErrSourceKeptReadonly) {
+		t.Fatalf("error does not mark the source as deliberately kept readonly: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "dst:8080 VolumeDelete" {
+			t.Fatalf("deleted the verified target copy after a failed source delete: %v", cluster.callList())
+		}
+		if call == "src:8080 VolumeMarkWritable" {
+			t.Fatalf("restored source writability next to a mounted verified copy: %v", cluster.callList())
+		}
+	}
+}
+
+func TestLiveMoveVolumeRefusesRecopyOverCompleteTarget(t *testing.T) {
+	// A readonly source next to a target already holding a copy that is not
+	// behind it is the signature of a previous move whose source delete
+	// failed; recopying would tear down the possibly-authoritative target.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !strings.Contains(err.Error(), "already has a copy") {
+		t.Fatalf("expected recopy refusal, got: %v", err)
+	}
+	if !errors.Is(err, ErrSourceKeptReadonly) {
+		t.Fatalf("refusal does not mark the source as deliberately kept readonly: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "dst:8080 VolumeCopy" || call == "dst:8080 VolumeDelete" {
+			t.Fatalf("touched the possibly-authoritative target: %v", cluster.callList())
+		}
+	}
+}
+
+func TestLiveMoveVolumeReadonlySourceUnknownTargetRefused(t *testing.T) {
+	// With a readonly source, an unreachable target probe must fail closed:
+	// the target could hold the authoritative copy of a previous move.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.statusFailures[string(dstAddr)] = 1
+	cluster.statusFailureErr = status.Error(codes.Unavailable, "connection refused")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !errors.Is(err, ErrSourceKeptReadonly) {
+		t.Fatalf("expected fail-closed refusal, got: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "dst:8080 VolumeCopy" {
+			t.Fatalf("copied over a target in unknown state: %v", cluster.callList())
+		}
+	}
+}
+
+func TestLiveMoveVolumePreFrozenSourceMissingRustTargetProceeds(t *testing.T) {
+	// The Rust volume server answers a missing volume with codes.NotFound
+	// (the Go server uses a plain error, code Unknown). Both are definitive
+	// absence: with a pre-frozen source (tiering freezes before moving), a
+	// NotFound misclassified as "unknown" would refuse the move with
+	// ErrSourceKeptReadonly — and tiering callers then deliberately skip
+	// thawing, stranding every replica readonly after an ordinary move.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1000, 100, 10)
+	cluster.statusFailures[string(dstAddr)] = 1
+	cluster.statusFailureErr = status.Error(codes.NotFound, "not found volume id 7")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err != nil {
+		t.Fatalf("LiveMoveVolume to an empty Rust target: %v", err)
+	}
+
+	calls := cluster.callList()
+	if calls[len(calls)-1] != "src:8080 VolumeDelete" {
+		t.Fatalf("move did not complete with source delete: %v", calls)
+	}
+}
+
+func TestLiveMoveVolumeReadonlySourceExistingTargetRefused(t *testing.T) {
+	// No client-side observation can prove an existing copy is a stale
+	// remnant rather than the authoritative copy of an unfinished move —
+	// compaction shrinks the authoritative copy below the stale source, and
+	// any snapshot can be invalidated by a write right after it. Even a
+	// target that reads as behind is refused.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(900, 90, 9)
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !errors.Is(err, ErrSourceKeptReadonly) {
+		t.Fatalf("expected fail-closed refusal, got: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "dst:8080 VolumeCopy" || call == "dst:8080 VolumeDelete" {
+			t.Fatalf("touched a possibly-authoritative target: %v", cluster.callList())
+		}
+	}
+}
+
+func TestCopyVolumeLeavesReadonlySourceUntouched(t *testing.T) {
+	// The copy is non-destructive, so a readonly-reporting source (possibly
+	// only transiently, e.g. low disk) is not hard-marked.
+	cluster := newFakeCluster()
+	cluster.readonly[string(srcAddr)] = true
+
+	_, err := cluster.mover().CopyVolume(context.Background(), 7, srcAddr, dstAddr, "", 0, true, nil)
+	if err != nil {
+		t.Fatalf("CopyVolume: %v", err)
+	}
+
+	for _, call := range cluster.callList() {
+		if call == "src:8080 VolumeMarkReadonly" || call == "src:8080 VolumeMarkWritable" {
+			t.Fatalf("readonly source touched by a non-destructive copy: %v", cluster.callList())
+		}
+	}
+}
+
+func TestLiveMoveVolumeTargetAheadCommits(t *testing.T) {
+	// The target serves writes while the move tails; a target that got ahead
+	// holds those acknowledged writes, and the move must commit so they stay
+	// on the surviving copy.
+	cluster := newFakeCluster()
+	cluster.status[string(srcAddr)] = volumeStatus(1000, 100, 10)
+	cluster.status[string(dstAddr)] = volumeStatus(1100, 110, 11)
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err != nil {
+		t.Fatalf("LiveMoveVolume with target ahead: %v", err)
+	}
+
+	calls := cluster.callList()
+	if calls[len(calls)-1] != "src:8080 VolumeDelete" {
+		t.Fatalf("move did not commit with source delete: %v", calls)
+	}
+}
+
+func TestLiveMoveVolumeRejectsSameServer(t *testing.T) {
+	// The second target is the same server written with an explicit grpc port;
+	// the guard must see through the representation difference.
+	for _, target := range []pb.ServerAddress{srcAddr, pb.ServerAddress("src:8080.18080")} {
+		cluster := newFakeCluster()
+
+		err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, target, VolumeMoveOptions{})
+		if err == nil || !strings.Contains(err.Error(), "its own server") {
+			t.Fatalf("target %q: expected same-server rejection, got: %v", target, err)
+		}
+		if len(cluster.callList()) != 0 {
+			t.Fatalf("target %q: RPCs issued for a rejected move: %v", target, cluster.callList())
+		}
+	}
+}
+
+func TestLiveMoveVolumeReadonlyMarkFailureRestores(t *testing.T) {
+	// The marking RPC can fail after the server applied the mark (e.g. its
+	// master notification failed), so a mark error must still restore.
+	cluster := newFakeCluster()
+	cluster.errs["src:8080 VolumeMarkReadonly"] = errors.New("master notification failed")
+
+	err := cluster.mover().LiveMoveVolume(context.Background(), 7, srcAddr, dstAddr, VolumeMoveOptions{})
+	if err == nil || !strings.Contains(err.Error(), "mark volume") {
+		t.Fatalf("expected mark-readonly error, got: %v", err)
+	}
+
+	calls := cluster.callList()
+	if calls[len(calls)-1] != "src:8080 VolumeMarkWritable" {
+		t.Fatalf("source writability not restored after failed readonly mark: %v", calls)
+	}
+}
+
+func TestReplicateVolumePropagatesThroughput(t *testing.T) {
+	cluster := newFakeCluster()
+
+	if err := cluster.mover().ReplicateVolume(context.Background(), 7, srcAddr, dstAddr, "ssd", 55, nil); err != nil {
+		t.Fatalf("ReplicateVolume: %v", err)
+	}
+	copyReq := cluster.copyReqs[0]
+	if copyReq.IoBytePerSecond != 55 || copyReq.DiskType != "ssd" {
+		t.Errorf("replicate request not propagated: %+v", copyReq)
+	}
+}
+
+func TestCopyVolumeRestoreWritable(t *testing.T) {
+	for _, restoreWritable := range []bool{true, false} {
+		cluster := newFakeCluster()
+		_, err := cluster.mover().CopyVolume(context.Background(), 7, srcAddr, dstAddr, "", 0, restoreWritable, nil)
+		if err != nil {
+			t.Fatalf("CopyVolume(restoreWritable=%v): %v", restoreWritable, err)
+		}
+		restored := false
+		for _, call := range cluster.callList() {
+			if call == "src:8080 VolumeMarkWritable" {
+				restored = true
+			}
+		}
+		if restored != restoreWritable {
+			t.Errorf("restoreWritable=%v but writability restored=%v", restoreWritable, restored)
+		}
+	}
+}
diff --git a/weed/pb/filer.proto b/weed/pb/filer.proto
index b8beefd71e..1919108fcd 100644
--- a/weed/pb/filer.proto
+++ b/weed/pb/filer.proto
@@ -13,6 +13,9 @@ service SeaweedFiler {
     rpc LookupDirectoryEntry (LookupDirectoryEntryRequest) returns (LookupDirectoryEntryResponse) {
     }
 
+    rpc LookupDirectoryEntries (LookupDirectoryEntriesRequest) returns (LookupDirectoryEntriesResponse) {
+    }
+
     rpc ListEntries (ListEntriesRequest) returns (stream ListEntriesResponse) {
     }
 
@@ -250,9 +253,11 @@ message CreateEntryRequest {
     repeated int32 signatures = 5;
     bool skip_check_parent_directory = 6;
     // Optional precondition evaluated against the current entry atomically with
-    // the write, under the filer's per-path lock. The caller must route the
-    // key's writes to this entry's owner filer for the check to be authoritative.
+    // the write, under the filer's per-path lock.
     WriteCondition condition = 7;
+    // Set on a create a filer forwarded to the entry's ring owner, so the owner
+    // applies it locally instead of forwarding again. Clients leave it unset.
+    bool is_moved = 8;
 }
 
 // WriteCondition is the precondition the filer evaluates against the existing
@@ -276,6 +281,7 @@ message WriteCondition {
         IF_EXTENDED_NOT_EQUAL = 7; // fail if present and extended[ext_key] == ext_value
         IF_EXTENDED_TIME_ELAPSED = 8; // fail if present and extended[ext_key] (unix seconds) is in the future
         IF_CHUNKS_EQUAL       = 9; // fail unless the stored chunk fid multiset equals fids (absent entry = no chunks)
+        IF_ENTRY_EQUAL        = 10; // fail unless the stored entry equals expected_entry
     }
     // Clause is one primitive comparison. IF_ETAG_MATCH holds when the current
     // entry's ETag equals any value in etags; IF_ETAG_NOT_MATCH holds when it
@@ -304,6 +310,7 @@ message WriteCondition {
         string gate_key = 7;       // IF_EXTENDED_TIME_ELAPSED: only enforce when extended[gate_key] == gate_value
         string gate_value = 8;     // gate value (e.g. retention mode COMPLIANCE for governance bypass)
         repeated string fids = 9;  // chunk fid strings for IF_CHUNKS_EQUAL
+        Entry expected_entry = 10; // whole-entry comparison for IF_ENTRY_EQUAL
     }
     repeated Clause clauses = 1;   // all must hold (logical AND)
 }
@@ -318,6 +325,7 @@ enum FilerError {
     EXISTING_IS_FILE      = 4; // cannot overwrite file with directory
     ENTRY_ALREADY_EXISTS  = 5; // O_EXCL and entry already exists
     PRECONDITION_FAILED   = 6; // WriteCondition not satisfied
+    READ_ONLY             = 7; // path matches a read-only storage rule (e.g. bucket over quota)
 }
 
 // ObjectMutation is one entry-level change applied by ObjectTransaction. All
@@ -346,6 +354,7 @@ message ObjectMutation {
     bytes content = 11;                    // PATCH_EXTENDED: new Entry.content when set_content
     bool touch_mtime = 12;                 // PATCH_EXTENDED: set the entry's Mtime to now (e.g. a metadata-replace copy)
     bool remove_empty_parent = 13;         // DELETE: also remove the parent directory when the delete leaves it empty (best-effort)
+    bool keep_remote_object = 14;          // DELETE: leave the object on the mounted remote storage
 }
 
 // Recompute re-derives a pointer entry (directory/name on the mutation) from the
@@ -383,6 +392,8 @@ message ObjectTransactionRequest {
     string condition_key = 6;          // if set, evaluate the condition against this entry instead of lock_key (still locking lock_key)
     string route_key = 7;              // ring key identifying the owner filer; a non-owner forwards the whole transaction to it
     bool is_moved = 8;                 // set on a forwarded transaction so the receiver applies it locally instead of forwarding again
+    string request_id = 9;             // idempotency token: the owner records the outcome and replays it on a retried request instead of re-applying
+    string condition_alt_key = 10;     // if the condition's entry is absent, evaluate it against this entry instead (e.g. null slot, else latest version)
 }
 
 message ObjectTransactionResponse {
@@ -472,6 +483,7 @@ message UpdateEntryRequest {
     // the write, under the filer's per-path lock. The caller must route the
     // key's writes to this entry's owner filer for the check to be authoritative.
     WriteCondition condition = 6;
+    bool is_moved = 7;             // set on a forwarded request so the owner applies it locally
 }
 message UpdateEntryResponse {
     SubscribeMetadataResponse metadata_event = 1;
@@ -509,6 +521,7 @@ message DeleteEntryRequest {
     bool is_from_other_cluster = 7;
     repeated int32 signatures = 8;
     int64 if_not_modified_after = 9;
+    bool keep_remote_object = 10;
 }
 
 message DeleteEntryResponse {
@@ -522,6 +535,10 @@ message AtomicRenameEntryRequest {
     string new_directory = 3;
     string new_name = 4;
     repeated int32 signatures = 5;
+    // When true, the rename fails with ErrEntryAlreadyExists if the target
+    // already exists. Lets a caller that authorized the rename without delete
+    // access on an absent target stay safe if one is created concurrently.
+    bool fail_if_target_exists = 6;
 }
 
 message AtomicRenameEntryResponse {
@@ -561,6 +578,12 @@ message AssignVolumeResponse {
     string error = 8;
     Location location = 9;
     repeated Location replicas = 10;
+    // fsync is the storage rule's fsync decision for the assigned path, so the
+    // client can carry it onto the volume server upload request.
+    bool fsync = 11;
+    // error_code classifies error for callers that must branch on it; error
+    // keeps the human-readable text for clients that predate the field.
+    FilerError error_code = 12;
 }
 
 message LookupVolumeRequest {
@@ -576,6 +599,7 @@ message Location {
     string public_url = 2;
     uint32 grpc_port = 3;
     string data_center = 4;
+    bool data_in_remote = 5;
 }
 message LookupVolumeResponse {
     map<string, Locations> locations_map = 1;
@@ -662,6 +686,7 @@ message SubscribeMetadataResponse {
     int64 ts_ns = 3;
     repeated SubscribeMetadataResponse events = 4; // batch of additional events (backlog catch-up)
     repeated LogFileChunkRef log_file_refs = 5;    // log file chunk refs for client direct-read
+    int64 flushed_ts_ns = 6; // local log-buffer flush watermark: everything at or below it is on disk
 }
 message ListMetadataSubscribersRequest {
     repeated string client_types = 1; // optional filter by client type, e.g. "mount"; empty = all
@@ -695,6 +720,10 @@ message TraverseBfsMetadataRequest {
 message TraverseBfsMetadataResponse {
     string directory = 1;
     Entry entry = 2;
+    // The sender's per-path commit timestamp (see meta_path_ts.go): the newest
+    // event time this filer committed for the path, 0 when unrecorded so
+    // subscribers fall back to the entry's mtime.
+    int64 entry_ts_ns = 3;
 }
 
 message LogEntry {
@@ -757,7 +786,8 @@ message FilerConf {
         string replication = 3;
         string ttl = 4;
         string disk_type = 5;
-        bool fsync = 6;
+        // unset inherits from the enclosing path rule, set overrides it
+        optional bool fsync = 6;
         uint32 volume_growth_count = 7;
         bool read_only = 8;
         string data_center = 9;
@@ -906,3 +936,40 @@ message MountInfo {
     int64 last_seen_ns = 3;
     string data_center = 4;
 }
+
+// LookupDirectoryEntriesRequest batches independent exact-path lookups into
+// one bounded RPC. Results preserve this order. Empty batches and batches over
+// 4096 requests are rejected. Declared last to keep generated message indices
+// stable.
+message LookupDirectoryEntriesRequest {
+    repeated LookupDirectoryEntryRequest requests = 1;
+    // Cache callers may treat an Entry whose Volume the master no longer
+    // reports as a miss. A lookup the filer could not complete still marks the
+    // Entry with an error. Ordinary filesystem callers keep the fail-closed
+    // error in both cases.
+    bool unavailable_volume_is_miss = 2;
+}
+
+message LookupDirectoryEntryResult {
+    // found reports metadata presence. An error makes this item unusable even
+    // when entry is present, for example when a chunk volume cannot be located.
+    bool found = 1;
+    Entry entry = 2;
+    string error = 3;
+    // Per-entry read fence. Every filer event at or below this position is
+    // reflected in found/entry/error for this item.
+    int64 log_ts_ns = 4;
+    int32 log_signature = 5;
+}
+
+message LookupDirectoryEntriesResponse {
+    repeated LookupDirectoryEntryResult results = 1;
+    // One deduplicated location set for every volume referenced by returned
+    // Entry.chunks. A missing/unavailable volume has an empty Locations value
+    // and marks each affected result with an error.
+    map<string, Locations> locations_map = 2;
+    // Short-lived, exact-FID read capabilities. Direct data-plane clients must
+    // present the matching token to a Volume instead of treating a shared
+    // service credential as authority to read arbitrary needles.
+    map<string, string> read_auth = 3;
+}
diff --git a/weed/pb/filer_pb/filer.pb.go b/weed/pb/filer_pb/filer.pb.go
index a00719891f..f00ed17771 100644
--- a/weed/pb/filer_pb/filer.pb.go
+++ b/weed/pb/filer_pb/filer.pb.go
@@ -85,6 +85,7 @@ const (
 	FilerError_EXISTING_IS_FILE      FilerError = 4 // cannot overwrite file with directory
 	FilerError_ENTRY_ALREADY_EXISTS  FilerError = 5 // O_EXCL and entry already exists
 	FilerError_PRECONDITION_FAILED   FilerError = 6 // WriteCondition not satisfied
+	FilerError_READ_ONLY             FilerError = 7 // path matches a read-only storage rule (e.g. bucket over quota)
 )
 
 // Enum value maps for FilerError.
@@ -97,6 +98,7 @@ var (
 		4: "EXISTING_IS_FILE",
 		5: "ENTRY_ALREADY_EXISTS",
 		6: "PRECONDITION_FAILED",
+		7: "READ_ONLY",
 	}
 	FilerError_value = map[string]int32{
 		"OK":                    0,
@@ -106,6 +108,7 @@ var (
 		"EXISTING_IS_FILE":      4,
 		"ENTRY_ALREADY_EXISTS":  5,
 		"PRECONDITION_FAILED":   6,
+		"READ_ONLY":             7,
 	}
 )
 
@@ -197,31 +200,33 @@ func (PosixLockOp) EnumDescriptor() ([]byte, []int) {
 type WriteCondition_Kind int32
 
 const (
-	WriteCondition_NONE                     WriteCondition_Kind = 0 // unconditional
-	WriteCondition_IF_NOT_EXISTS            WriteCondition_Kind = 1 // fail if the entry exists (If-None-Match: *)
-	WriteCondition_IF_EXISTS                WriteCondition_Kind = 2 // fail if the entry is absent (If-Match: *)
-	WriteCondition_IF_ETAG_MATCH            WriteCondition_Kind = 3 // fail if absent or etag matches none of the set (If-Match)
-	WriteCondition_IF_ETAG_NOT_MATCH        WriteCondition_Kind = 4 // fail if present and etag matches any of the set (If-None-Match)
-	WriteCondition_IF_UNMODIFIED_SINCE      WriteCondition_Kind = 5 // fail if present and mtime > unix_time
-	WriteCondition_IF_MODIFIED_SINCE        WriteCondition_Kind = 6 // fail if present and mtime <= unix_time
-	WriteCondition_IF_EXTENDED_NOT_EQUAL    WriteCondition_Kind = 7 // fail if present and extended[ext_key] == ext_value
-	WriteCondition_IF_EXTENDED_TIME_ELAPSED WriteCondition_Kind = 8 // fail if present and extended[ext_key] (unix seconds) is in the future
-	WriteCondition_IF_CHUNKS_EQUAL          WriteCondition_Kind = 9 // fail unless the stored chunk fid multiset equals fids (absent entry = no chunks)
+	WriteCondition_NONE                     WriteCondition_Kind = 0  // unconditional
+	WriteCondition_IF_NOT_EXISTS            WriteCondition_Kind = 1  // fail if the entry exists (If-None-Match: *)
+	WriteCondition_IF_EXISTS                WriteCondition_Kind = 2  // fail if the entry is absent (If-Match: *)
+	WriteCondition_IF_ETAG_MATCH            WriteCondition_Kind = 3  // fail if absent or etag matches none of the set (If-Match)
+	WriteCondition_IF_ETAG_NOT_MATCH        WriteCondition_Kind = 4  // fail if present and etag matches any of the set (If-None-Match)
+	WriteCondition_IF_UNMODIFIED_SINCE      WriteCondition_Kind = 5  // fail if present and mtime > unix_time
+	WriteCondition_IF_MODIFIED_SINCE        WriteCondition_Kind = 6  // fail if present and mtime <= unix_time
+	WriteCondition_IF_EXTENDED_NOT_EQUAL    WriteCondition_Kind = 7  // fail if present and extended[ext_key] == ext_value
+	WriteCondition_IF_EXTENDED_TIME_ELAPSED WriteCondition_Kind = 8  // fail if present and extended[ext_key] (unix seconds) is in the future
+	WriteCondition_IF_CHUNKS_EQUAL          WriteCondition_Kind = 9  // fail unless the stored chunk fid multiset equals fids (absent entry = no chunks)
+	WriteCondition_IF_ENTRY_EQUAL           WriteCondition_Kind = 10 // fail unless the stored entry equals expected_entry
 )
 
 // Enum value maps for WriteCondition_Kind.
 var (
 	WriteCondition_Kind_name = map[int32]string{
-		0: "NONE",
-		1: "IF_NOT_EXISTS",
-		2: "IF_EXISTS",
-		3: "IF_ETAG_MATCH",
-		4: "IF_ETAG_NOT_MATCH",
-		5: "IF_UNMODIFIED_SINCE",
-		6: "IF_MODIFIED_SINCE",
-		7: "IF_EXTENDED_NOT_EQUAL",
-		8: "IF_EXTENDED_TIME_ELAPSED",
-		9: "IF_CHUNKS_EQUAL",
+		0:  "NONE",
+		1:  "IF_NOT_EXISTS",
+		2:  "IF_EXISTS",
+		3:  "IF_ETAG_MATCH",
+		4:  "IF_ETAG_NOT_MATCH",
+		5:  "IF_UNMODIFIED_SINCE",
+		6:  "IF_MODIFIED_SINCE",
+		7:  "IF_EXTENDED_NOT_EQUAL",
+		8:  "IF_EXTENDED_TIME_ELAPSED",
+		9:  "IF_CHUNKS_EQUAL",
+		10: "IF_ENTRY_EQUAL",
 	}
 	WriteCondition_Kind_value = map[string]int32{
 		"NONE":                     0,
@@ -234,6 +239,7 @@ var (
 		"IF_EXTENDED_NOT_EQUAL":    7,
 		"IF_EXTENDED_TIME_ELAPSED": 8,
 		"IF_CHUNKS_EQUAL":          9,
+		"IF_ENTRY_EQUAL":           10,
 	}
 )
 
@@ -1374,9 +1380,11 @@ type CreateEntryRequest struct {
 	Signatures               []int32                `protobuf:"varint,5,rep,packed,name=signatures,proto3" json:"signatures,omitempty"`
 	SkipCheckParentDirectory bool                   `protobuf:"varint,6,opt,name=skip_check_parent_directory,json=skipCheckParentDirectory,proto3" json:"skip_check_parent_directory,omitempty"`
 	// Optional precondition evaluated against the current entry atomically with
-	// the write, under the filer's per-path lock. The caller must route the
-	// key's writes to this entry's owner filer for the check to be authoritative.
-	Condition     *WriteCondition `protobuf:"bytes,7,opt,name=condition,proto3" json:"condition,omitempty"`
+	// the write, under the filer's per-path lock.
+	Condition *WriteCondition `protobuf:"bytes,7,opt,name=condition,proto3" json:"condition,omitempty"`
+	// Set on a create a filer forwarded to the entry's ring owner, so the owner
+	// applies it locally instead of forwarding again. Clients leave it unset.
+	IsMoved       bool `protobuf:"varint,8,opt,name=is_moved,json=isMoved,proto3" json:"is_moved,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1460,6 +1468,13 @@ func (x *CreateEntryRequest) GetCondition() *WriteCondition {
 	return nil
 }
 
+func (x *CreateEntryRequest) GetIsMoved() bool {
+	if x != nil {
+		return x.IsMoved
+	}
+	return false
+}
+
 // WriteCondition is the precondition the filer evaluates against the existing
 // entry before writing, under the per-path lock. A failed condition returns
 // FilerError PRECONDITION_FAILED. The client maps request semantics (e.g. RFC
@@ -1534,6 +1549,7 @@ type ObjectMutation struct {
 	Content           []byte                 `protobuf:"bytes,11,opt,name=content,proto3" json:"content,omitempty"`                                                                                                     // PATCH_EXTENDED: new Entry.content when set_content
 	TouchMtime        bool                   `protobuf:"varint,12,opt,name=touch_mtime,json=touchMtime,proto3" json:"touch_mtime,omitempty"`                                                                            // PATCH_EXTENDED: set the entry's Mtime to now (e.g. a metadata-replace copy)
 	RemoveEmptyParent bool                   `protobuf:"varint,13,opt,name=remove_empty_parent,json=removeEmptyParent,proto3" json:"remove_empty_parent,omitempty"`                                                     // DELETE: also remove the parent directory when the delete leaves it empty (best-effort)
+	KeepRemoteObject  bool                   `protobuf:"varint,14,opt,name=keep_remote_object,json=keepRemoteObject,proto3" json:"keep_remote_object,omitempty"`                                                        // DELETE: leave the object on the mounted remote storage
 	unknownFields     protoimpl.UnknownFields
 	sizeCache         protoimpl.SizeCache
 }
@@ -1659,6 +1675,13 @@ func (x *ObjectMutation) GetRemoveEmptyParent() bool {
 	return false
 }
 
+func (x *ObjectMutation) GetKeepRemoteObject() bool {
+	if x != nil {
+		return x.KeepRemoteObject
+	}
+	return false
+}
+
 // Recompute re-derives a pointer entry (directory/name on the mutation) from the
 // current contents of a scanned directory, atomically under the transaction's
 // lock. It is mechanical: the filer picks the child that sorts first or last by
@@ -1788,9 +1811,11 @@ type ObjectTransactionRequest struct {
 	Mutations          []*ObjectMutation      `protobuf:"bytes,3,rep,name=mutations,proto3" json:"mutations,omitempty"`
 	IsFromOtherCluster bool                   `protobuf:"varint,4,opt,name=is_from_other_cluster,json=isFromOtherCluster,proto3" json:"is_from_other_cluster,omitempty"`
 	Signatures         []int32                `protobuf:"varint,5,rep,packed,name=signatures,proto3" json:"signatures,omitempty"`
-	ConditionKey       string                 `protobuf:"bytes,6,opt,name=condition_key,json=conditionKey,proto3" json:"condition_key,omitempty"` // if set, evaluate the condition against this entry instead of lock_key (still locking lock_key)
-	RouteKey           string                 `protobuf:"bytes,7,opt,name=route_key,json=routeKey,proto3" json:"route_key,omitempty"`             // ring key identifying the owner filer; a non-owner forwards the whole transaction to it
-	IsMoved            bool                   `protobuf:"varint,8,opt,name=is_moved,json=isMoved,proto3" json:"is_moved,omitempty"`               // set on a forwarded transaction so the receiver applies it locally instead of forwarding again
+	ConditionKey       string                 `protobuf:"bytes,6,opt,name=condition_key,json=conditionKey,proto3" json:"condition_key,omitempty"`             // if set, evaluate the condition against this entry instead of lock_key (still locking lock_key)
+	RouteKey           string                 `protobuf:"bytes,7,opt,name=route_key,json=routeKey,proto3" json:"route_key,omitempty"`                         // ring key identifying the owner filer; a non-owner forwards the whole transaction to it
+	IsMoved            bool                   `protobuf:"varint,8,opt,name=is_moved,json=isMoved,proto3" json:"is_moved,omitempty"`                           // set on a forwarded transaction so the receiver applies it locally instead of forwarding again
+	RequestId          string                 `protobuf:"bytes,9,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`                      // idempotency token: the owner records the outcome and replays it on a retried request instead of re-applying
+	ConditionAltKey    string                 `protobuf:"bytes,10,opt,name=condition_alt_key,json=conditionAltKey,proto3" json:"condition_alt_key,omitempty"` // if the condition's entry is absent, evaluate it against this entry instead (e.g. null slot, else latest version)
 	unknownFields      protoimpl.UnknownFields
 	sizeCache          protoimpl.SizeCache
 }
@@ -1881,6 +1906,20 @@ func (x *ObjectTransactionRequest) GetIsMoved() bool {
 	return false
 }
 
+func (x *ObjectTransactionRequest) GetRequestId() string {
+	if x != nil {
+		return x.RequestId
+	}
+	return ""
+}
+
+func (x *ObjectTransactionRequest) GetConditionAltKey() string {
+	if x != nil {
+		return x.ConditionAltKey
+	}
+	return ""
+}
+
 type ObjectTransactionResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Error         string                 `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
@@ -2366,6 +2405,7 @@ type UpdateEntryRequest struct {
 	// the write, under the filer's per-path lock. The caller must route the
 	// key's writes to this entry's owner filer for the check to be authoritative.
 	Condition     *WriteCondition `protobuf:"bytes,6,opt,name=condition,proto3" json:"condition,omitempty"`
+	IsMoved       bool            `protobuf:"varint,7,opt,name=is_moved,json=isMoved,proto3" json:"is_moved,omitempty"` // set on a forwarded request so the owner applies it locally
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -2442,6 +2482,13 @@ func (x *UpdateEntryRequest) GetCondition() *WriteCondition {
 	return nil
 }
 
+func (x *UpdateEntryRequest) GetIsMoved() bool {
+	if x != nil {
+		return x.IsMoved
+	}
+	return false
+}
+
 type UpdateEntryResponse struct {
 	state         protoimpl.MessageState     `protogen:"open.v1"`
 	MetadataEvent *SubscribeMetadataResponse `protobuf:"bytes,1,opt,name=metadata_event,json=metadataEvent,proto3" json:"metadata_event,omitempty"`
@@ -2723,6 +2770,7 @@ type DeleteEntryRequest struct {
 	IsFromOtherCluster   bool    `protobuf:"varint,7,opt,name=is_from_other_cluster,json=isFromOtherCluster,proto3" json:"is_from_other_cluster,omitempty"`
 	Signatures           []int32 `protobuf:"varint,8,rep,packed,name=signatures,proto3" json:"signatures,omitempty"`
 	IfNotModifiedAfter   int64   `protobuf:"varint,9,opt,name=if_not_modified_after,json=ifNotModifiedAfter,proto3" json:"if_not_modified_after,omitempty"`
+	KeepRemoteObject     bool    `protobuf:"varint,10,opt,name=keep_remote_object,json=keepRemoteObject,proto3" json:"keep_remote_object,omitempty"`
 	unknownFields        protoimpl.UnknownFields
 	sizeCache            protoimpl.SizeCache
 }
@@ -2813,6 +2861,13 @@ func (x *DeleteEntryRequest) GetIfNotModifiedAfter() int64 {
 	return 0
 }
 
+func (x *DeleteEntryRequest) GetKeepRemoteObject() bool {
+	if x != nil {
+		return x.KeepRemoteObject
+	}
+	return false
+}
+
 type DeleteEntryResponse struct {
 	state         protoimpl.MessageState     `protogen:"open.v1"`
 	Error         string                     `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
@@ -2866,14 +2921,18 @@ func (x *DeleteEntryResponse) GetMetadataEvent() *SubscribeMetadataResponse {
 }
 
 type AtomicRenameEntryRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	OldDirectory  string                 `protobuf:"bytes,1,opt,name=old_directory,json=oldDirectory,proto3" json:"old_directory,omitempty"`
-	OldName       string                 `protobuf:"bytes,2,opt,name=old_name,json=oldName,proto3" json:"old_name,omitempty"`
-	NewDirectory  string                 `protobuf:"bytes,3,opt,name=new_directory,json=newDirectory,proto3" json:"new_directory,omitempty"`
-	NewName       string                 `protobuf:"bytes,4,opt,name=new_name,json=newName,proto3" json:"new_name,omitempty"`
-	Signatures    []int32                `protobuf:"varint,5,rep,packed,name=signatures,proto3" json:"signatures,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state        protoimpl.MessageState `protogen:"open.v1"`
+	OldDirectory string                 `protobuf:"bytes,1,opt,name=old_directory,json=oldDirectory,proto3" json:"old_directory,omitempty"`
+	OldName      string                 `protobuf:"bytes,2,opt,name=old_name,json=oldName,proto3" json:"old_name,omitempty"`
+	NewDirectory string                 `protobuf:"bytes,3,opt,name=new_directory,json=newDirectory,proto3" json:"new_directory,omitempty"`
+	NewName      string                 `protobuf:"bytes,4,opt,name=new_name,json=newName,proto3" json:"new_name,omitempty"`
+	Signatures   []int32                `protobuf:"varint,5,rep,packed,name=signatures,proto3" json:"signatures,omitempty"`
+	// When true, the rename fails with ErrEntryAlreadyExists if the target
+	// already exists. Lets a caller that authorized the rename without delete
+	// access on an absent target stay safe if one is created concurrently.
+	FailIfTargetExists bool `protobuf:"varint,6,opt,name=fail_if_target_exists,json=failIfTargetExists,proto3" json:"fail_if_target_exists,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *AtomicRenameEntryRequest) Reset() {
@@ -2941,6 +3000,13 @@ func (x *AtomicRenameEntryRequest) GetSignatures() []int32 {
 	return nil
 }
 
+func (x *AtomicRenameEntryRequest) GetFailIfTargetExists() bool {
+	if x != nil {
+		return x.FailIfTargetExists
+	}
+	return false
+}
+
 type AtomicRenameEntryResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -3230,15 +3296,21 @@ func (x *AssignVolumeRequest) GetExpectedDataSize() uint64 {
 }
 
 type AssignVolumeResponse struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	FileId        string                 `protobuf:"bytes,1,opt,name=file_id,json=fileId,proto3" json:"file_id,omitempty"`
-	Count         int32                  `protobuf:"varint,4,opt,name=count,proto3" json:"count,omitempty"`
-	Auth          string                 `protobuf:"bytes,5,opt,name=auth,proto3" json:"auth,omitempty"`
-	Collection    string                 `protobuf:"bytes,6,opt,name=collection,proto3" json:"collection,omitempty"`
-	Replication   string                 `protobuf:"bytes,7,opt,name=replication,proto3" json:"replication,omitempty"`
-	Error         string                 `protobuf:"bytes,8,opt,name=error,proto3" json:"error,omitempty"`
-	Location      *Location              `protobuf:"bytes,9,opt,name=location,proto3" json:"location,omitempty"`
-	Replicas      []*Location            `protobuf:"bytes,10,rep,name=replicas,proto3" json:"replicas,omitempty"`
+	state       protoimpl.MessageState `protogen:"open.v1"`
+	FileId      string                 `protobuf:"bytes,1,opt,name=file_id,json=fileId,proto3" json:"file_id,omitempty"`
+	Count       int32                  `protobuf:"varint,4,opt,name=count,proto3" json:"count,omitempty"`
+	Auth        string                 `protobuf:"bytes,5,opt,name=auth,proto3" json:"auth,omitempty"`
+	Collection  string                 `protobuf:"bytes,6,opt,name=collection,proto3" json:"collection,omitempty"`
+	Replication string                 `protobuf:"bytes,7,opt,name=replication,proto3" json:"replication,omitempty"`
+	Error       string                 `protobuf:"bytes,8,opt,name=error,proto3" json:"error,omitempty"`
+	Location    *Location              `protobuf:"bytes,9,opt,name=location,proto3" json:"location,omitempty"`
+	Replicas    []*Location            `protobuf:"bytes,10,rep,name=replicas,proto3" json:"replicas,omitempty"`
+	// fsync is the storage rule's fsync decision for the assigned path, so the
+	// client can carry it onto the volume server upload request.
+	Fsync bool `protobuf:"varint,11,opt,name=fsync,proto3" json:"fsync,omitempty"`
+	// error_code classifies error for callers that must branch on it; error
+	// keeps the human-readable text for clients that predate the field.
+	ErrorCode     FilerError `protobuf:"varint,12,opt,name=error_code,json=errorCode,proto3,enum=filer_pb.FilerError" json:"error_code,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -3329,6 +3401,20 @@ func (x *AssignVolumeResponse) GetReplicas() []*Location {
 	return nil
 }
 
+func (x *AssignVolumeResponse) GetFsync() bool {
+	if x != nil {
+		return x.Fsync
+	}
+	return false
+}
+
+func (x *AssignVolumeResponse) GetErrorCode() FilerError {
+	if x != nil {
+		return x.ErrorCode
+	}
+	return FilerError_OK
+}
+
 type LookupVolumeRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	VolumeIds     []string               `protobuf:"bytes,1,rep,name=volume_ids,json=volumeIds,proto3" json:"volume_ids,omitempty"`
@@ -3423,6 +3509,7 @@ type Location struct {
 	PublicUrl     string                 `protobuf:"bytes,2,opt,name=public_url,json=publicUrl,proto3" json:"public_url,omitempty"`
 	GrpcPort      uint32                 `protobuf:"varint,3,opt,name=grpc_port,json=grpcPort,proto3" json:"grpc_port,omitempty"`
 	DataCenter    string                 `protobuf:"bytes,4,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"`
+	DataInRemote  bool                   `protobuf:"varint,5,opt,name=data_in_remote,json=dataInRemote,proto3" json:"data_in_remote,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -3485,6 +3572,13 @@ func (x *Location) GetDataCenter() string {
 	return ""
 }
 
+func (x *Location) GetDataInRemote() bool {
+	if x != nil {
+		return x.DataInRemote
+	}
+	return false
+}
+
 type LookupVolumeResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	LocationsMap  map[string]*Locations  `protobuf:"bytes,1,rep,name=locations_map,json=locationsMap,proto3" json:"locations_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
@@ -4327,8 +4421,9 @@ type SubscribeMetadataResponse struct {
 	Directory         string                       `protobuf:"bytes,1,opt,name=directory,proto3" json:"directory,omitempty"`
 	EventNotification *EventNotification           `protobuf:"bytes,2,opt,name=event_notification,json=eventNotification,proto3" json:"event_notification,omitempty"`
 	TsNs              int64                        `protobuf:"varint,3,opt,name=ts_ns,json=tsNs,proto3" json:"ts_ns,omitempty"`
-	Events            []*SubscribeMetadataResponse `protobuf:"bytes,4,rep,name=events,proto3" json:"events,omitempty"`                                // batch of additional events (backlog catch-up)
-	LogFileRefs       []*LogFileChunkRef           `protobuf:"bytes,5,rep,name=log_file_refs,json=logFileRefs,proto3" json:"log_file_refs,omitempty"` // log file chunk refs for client direct-read
+	Events            []*SubscribeMetadataResponse `protobuf:"bytes,4,rep,name=events,proto3" json:"events,omitempty"`                                 // batch of additional events (backlog catch-up)
+	LogFileRefs       []*LogFileChunkRef           `protobuf:"bytes,5,rep,name=log_file_refs,json=logFileRefs,proto3" json:"log_file_refs,omitempty"`  // log file chunk refs for client direct-read
+	FlushedTsNs       int64                        `protobuf:"varint,6,opt,name=flushed_ts_ns,json=flushedTsNs,proto3" json:"flushed_ts_ns,omitempty"` // local log-buffer flush watermark: everything at or below it is on disk
 	unknownFields     protoimpl.UnknownFields
 	sizeCache         protoimpl.SizeCache
 }
@@ -4398,6 +4493,13 @@ func (x *SubscribeMetadataResponse) GetLogFileRefs() []*LogFileChunkRef {
 	return nil
 }
 
+func (x *SubscribeMetadataResponse) GetFlushedTsNs() int64 {
+	if x != nil {
+		return x.FlushedTsNs
+	}
+	return 0
+}
+
 type ListMetadataSubscribersRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	ClientTypes   []string               `protobuf:"bytes,1,rep,name=client_types,json=clientTypes,proto3" json:"client_types,omitempty"` // optional filter by client type, e.g. "mount"; empty = all
@@ -4702,9 +4804,13 @@ func (x *TraverseBfsMetadataRequest) GetExcludedPrefixes() []string {
 }
 
 type TraverseBfsMetadataResponse struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Directory     string                 `protobuf:"bytes,1,opt,name=directory,proto3" json:"directory,omitempty"`
-	Entry         *Entry                 `protobuf:"bytes,2,opt,name=entry,proto3" json:"entry,omitempty"`
+	state     protoimpl.MessageState `protogen:"open.v1"`
+	Directory string                 `protobuf:"bytes,1,opt,name=directory,proto3" json:"directory,omitempty"`
+	Entry     *Entry                 `protobuf:"bytes,2,opt,name=entry,proto3" json:"entry,omitempty"`
+	// The sender's per-path commit timestamp (see meta_path_ts.go): the newest
+	// event time this filer committed for the path, 0 when unrecorded so
+	// subscribers fall back to the entry's mtime.
+	EntryTsNs     int64 `protobuf:"varint,3,opt,name=entry_ts_ns,json=entryTsNs,proto3" json:"entry_ts_ns,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -4753,6 +4859,13 @@ func (x *TraverseBfsMetadataResponse) GetEntry() *Entry {
 	return nil
 }
 
+func (x *TraverseBfsMetadataResponse) GetEntryTsNs() int64 {
+	if x != nil {
+		return x.EntryTsNs
+	}
+	return 0
+}
+
 type LogEntry struct {
 	state            protoimpl.MessageState `protogen:"open.v1"`
 	TsNs             int64                  `protobuf:"varint,1,opt,name=ts_ns,json=tsNs,proto3" json:"ts_ns,omitempty"`
@@ -6595,6 +6708,212 @@ func (x *MountInfo) GetDataCenter() string {
 	return ""
 }
 
+// LookupDirectoryEntriesRequest batches independent exact-path lookups into
+// one bounded RPC. Results preserve this order. Empty batches and batches over
+// 4096 requests are rejected. Declared last to keep generated message indices
+// stable.
+type LookupDirectoryEntriesRequest struct {
+	state    protoimpl.MessageState         `protogen:"open.v1"`
+	Requests []*LookupDirectoryEntryRequest `protobuf:"bytes,1,rep,name=requests,proto3" json:"requests,omitempty"`
+	// Cache callers may treat an Entry whose Volume the master no longer
+	// reports as a miss. A lookup the filer could not complete still marks the
+	// Entry with an error. Ordinary filesystem callers keep the fail-closed
+	// error in both cases.
+	UnavailableVolumeIsMiss bool `protobuf:"varint,2,opt,name=unavailable_volume_is_miss,json=unavailableVolumeIsMiss,proto3" json:"unavailable_volume_is_miss,omitempty"`
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
+}
+
+func (x *LookupDirectoryEntriesRequest) Reset() {
+	*x = LookupDirectoryEntriesRequest{}
+	mi := &file_filer_proto_msgTypes[91]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LookupDirectoryEntriesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LookupDirectoryEntriesRequest) ProtoMessage() {}
+
+func (x *LookupDirectoryEntriesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_filer_proto_msgTypes[91]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LookupDirectoryEntriesRequest.ProtoReflect.Descriptor instead.
+func (*LookupDirectoryEntriesRequest) Descriptor() ([]byte, []int) {
+	return file_filer_proto_rawDescGZIP(), []int{91}
+}
+
+func (x *LookupDirectoryEntriesRequest) GetRequests() []*LookupDirectoryEntryRequest {
+	if x != nil {
+		return x.Requests
+	}
+	return nil
+}
+
+func (x *LookupDirectoryEntriesRequest) GetUnavailableVolumeIsMiss() bool {
+	if x != nil {
+		return x.UnavailableVolumeIsMiss
+	}
+	return false
+}
+
+type LookupDirectoryEntryResult struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// found reports metadata presence. An error makes this item unusable even
+	// when entry is present, for example when a chunk volume cannot be located.
+	Found bool   `protobuf:"varint,1,opt,name=found,proto3" json:"found,omitempty"`
+	Entry *Entry `protobuf:"bytes,2,opt,name=entry,proto3" json:"entry,omitempty"`
+	Error string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
+	// Per-entry read fence. Every filer event at or below this position is
+	// reflected in found/entry/error for this item.
+	LogTsNs       int64 `protobuf:"varint,4,opt,name=log_ts_ns,json=logTsNs,proto3" json:"log_ts_ns,omitempty"`
+	LogSignature  int32 `protobuf:"varint,5,opt,name=log_signature,json=logSignature,proto3" json:"log_signature,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LookupDirectoryEntryResult) Reset() {
+	*x = LookupDirectoryEntryResult{}
+	mi := &file_filer_proto_msgTypes[92]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LookupDirectoryEntryResult) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LookupDirectoryEntryResult) ProtoMessage() {}
+
+func (x *LookupDirectoryEntryResult) ProtoReflect() protoreflect.Message {
+	mi := &file_filer_proto_msgTypes[92]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LookupDirectoryEntryResult.ProtoReflect.Descriptor instead.
+func (*LookupDirectoryEntryResult) Descriptor() ([]byte, []int) {
+	return file_filer_proto_rawDescGZIP(), []int{92}
+}
+
+func (x *LookupDirectoryEntryResult) GetFound() bool {
+	if x != nil {
+		return x.Found
+	}
+	return false
+}
+
+func (x *LookupDirectoryEntryResult) GetEntry() *Entry {
+	if x != nil {
+		return x.Entry
+	}
+	return nil
+}
+
+func (x *LookupDirectoryEntryResult) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *LookupDirectoryEntryResult) GetLogTsNs() int64 {
+	if x != nil {
+		return x.LogTsNs
+	}
+	return 0
+}
+
+func (x *LookupDirectoryEntryResult) GetLogSignature() int32 {
+	if x != nil {
+		return x.LogSignature
+	}
+	return 0
+}
+
+type LookupDirectoryEntriesResponse struct {
+	state   protoimpl.MessageState        `protogen:"open.v1"`
+	Results []*LookupDirectoryEntryResult `protobuf:"bytes,1,rep,name=results,proto3" json:"results,omitempty"`
+	// One deduplicated location set for every volume referenced by returned
+	// Entry.chunks. A missing/unavailable volume has an empty Locations value
+	// and marks each affected result with an error.
+	LocationsMap map[string]*Locations `protobuf:"bytes,2,rep,name=locations_map,json=locationsMap,proto3" json:"locations_map,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Short-lived, exact-FID read capabilities. Direct data-plane clients must
+	// present the matching token to a Volume instead of treating a shared
+	// service credential as authority to read arbitrary needles.
+	ReadAuth      map[string]string `protobuf:"bytes,3,rep,name=read_auth,json=readAuth,proto3" json:"read_auth,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LookupDirectoryEntriesResponse) Reset() {
+	*x = LookupDirectoryEntriesResponse{}
+	mi := &file_filer_proto_msgTypes[93]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LookupDirectoryEntriesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LookupDirectoryEntriesResponse) ProtoMessage() {}
+
+func (x *LookupDirectoryEntriesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_filer_proto_msgTypes[93]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LookupDirectoryEntriesResponse.ProtoReflect.Descriptor instead.
+func (*LookupDirectoryEntriesResponse) Descriptor() ([]byte, []int) {
+	return file_filer_proto_rawDescGZIP(), []int{93}
+}
+
+func (x *LookupDirectoryEntriesResponse) GetResults() []*LookupDirectoryEntryResult {
+	if x != nil {
+		return x.Results
+	}
+	return nil
+}
+
+func (x *LookupDirectoryEntriesResponse) GetLocationsMap() map[string]*Locations {
+	if x != nil {
+		return x.LocationsMap
+	}
+	return nil
+}
+
+func (x *LookupDirectoryEntriesResponse) GetReadAuth() map[string]string {
+	if x != nil {
+		return x.ReadAuth
+	}
+	return nil
+}
+
 // Clause is one primitive comparison. IF_ETAG_MATCH holds when the current
 // entry's ETag equals any value in etags; IF_ETAG_NOT_MATCH holds when it
 // equals none. allow_weak permits weak-comparison (ignoring the W/ prefix).
@@ -6615,21 +6934,22 @@ func (x *MountInfo) GetDataCenter() string {
 type WriteCondition_Clause struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Kind          WriteCondition_Kind    `protobuf:"varint,1,opt,name=kind,proto3,enum=filer_pb.WriteCondition_Kind" json:"kind,omitempty"`
-	Etags         []string               `protobuf:"bytes,2,rep,name=etags,proto3" json:"etags,omitempty"`                           // ETag set for IF_ETAG_* kinds
-	UnixTime      int64                  `protobuf:"varint,3,opt,name=unix_time,json=unixTime,proto3" json:"unix_time,omitempty"`    // bound (unix seconds) for IF_*_SINCE kinds
-	AllowWeak     bool                   `protobuf:"varint,4,opt,name=allow_weak,json=allowWeak,proto3" json:"allow_weak,omitempty"` // compare ETags ignoring the weak (W/) marker
-	ExtKey        string                 `protobuf:"bytes,5,opt,name=ext_key,json=extKey,proto3" json:"ext_key,omitempty"`           // extended attribute name for IF_EXTENDED_* kinds
-	ExtValue      string                 `protobuf:"bytes,6,opt,name=ext_value,json=extValue,proto3" json:"ext_value,omitempty"`     // blocking value for IF_EXTENDED_NOT_EQUAL
-	GateKey       string                 `protobuf:"bytes,7,opt,name=gate_key,json=gateKey,proto3" json:"gate_key,omitempty"`        // IF_EXTENDED_TIME_ELAPSED: only enforce when extended[gate_key] == gate_value
-	GateValue     string                 `protobuf:"bytes,8,opt,name=gate_value,json=gateValue,proto3" json:"gate_value,omitempty"`  // gate value (e.g. retention mode COMPLIANCE for governance bypass)
-	Fids          []string               `protobuf:"bytes,9,rep,name=fids,proto3" json:"fids,omitempty"`                             // chunk fid strings for IF_CHUNKS_EQUAL
+	Etags         []string               `protobuf:"bytes,2,rep,name=etags,proto3" json:"etags,omitempty"`                                       // ETag set for IF_ETAG_* kinds
+	UnixTime      int64                  `protobuf:"varint,3,opt,name=unix_time,json=unixTime,proto3" json:"unix_time,omitempty"`                // bound (unix seconds) for IF_*_SINCE kinds
+	AllowWeak     bool                   `protobuf:"varint,4,opt,name=allow_weak,json=allowWeak,proto3" json:"allow_weak,omitempty"`             // compare ETags ignoring the weak (W/) marker
+	ExtKey        string                 `protobuf:"bytes,5,opt,name=ext_key,json=extKey,proto3" json:"ext_key,omitempty"`                       // extended attribute name for IF_EXTENDED_* kinds
+	ExtValue      string                 `protobuf:"bytes,6,opt,name=ext_value,json=extValue,proto3" json:"ext_value,omitempty"`                 // blocking value for IF_EXTENDED_NOT_EQUAL
+	GateKey       string                 `protobuf:"bytes,7,opt,name=gate_key,json=gateKey,proto3" json:"gate_key,omitempty"`                    // IF_EXTENDED_TIME_ELAPSED: only enforce when extended[gate_key] == gate_value
+	GateValue     string                 `protobuf:"bytes,8,opt,name=gate_value,json=gateValue,proto3" json:"gate_value,omitempty"`              // gate value (e.g. retention mode COMPLIANCE for governance bypass)
+	Fids          []string               `protobuf:"bytes,9,rep,name=fids,proto3" json:"fids,omitempty"`                                         // chunk fid strings for IF_CHUNKS_EQUAL
+	ExpectedEntry *Entry                 `protobuf:"bytes,10,opt,name=expected_entry,json=expectedEntry,proto3" json:"expected_entry,omitempty"` // whole-entry comparison for IF_ENTRY_EQUAL
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *WriteCondition_Clause) Reset() {
 	*x = WriteCondition_Clause{}
-	mi := &file_filer_proto_msgTypes[92]
+	mi := &file_filer_proto_msgTypes[95]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6641,7 +6961,7 @@ func (x *WriteCondition_Clause) String() string {
 func (*WriteCondition_Clause) ProtoMessage() {}
 
 func (x *WriteCondition_Clause) ProtoReflect() protoreflect.Message {
-	mi := &file_filer_proto_msgTypes[92]
+	mi := &file_filer_proto_msgTypes[95]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6720,6 +7040,13 @@ func (x *WriteCondition_Clause) GetFids() []string {
 	return nil
 }
 
+func (x *WriteCondition_Clause) GetExpectedEntry() *Entry {
+	if x != nil {
+		return x.ExpectedEntry
+	}
+	return nil
+}
+
 // if found, send the exact address
 // if not found, send the full list of existing brokers
 type LocateBrokerResponse_Resource struct {
@@ -6732,7 +7059,7 @@ type LocateBrokerResponse_Resource struct {
 
 func (x *LocateBrokerResponse_Resource) Reset() {
 	*x = LocateBrokerResponse_Resource{}
-	mi := &file_filer_proto_msgTypes[97]
+	mi := &file_filer_proto_msgTypes[100]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6744,7 +7071,7 @@ func (x *LocateBrokerResponse_Resource) String() string {
 func (*LocateBrokerResponse_Resource) ProtoMessage() {}
 
 func (x *LocateBrokerResponse_Resource) ProtoReflect() protoreflect.Message {
-	mi := &file_filer_proto_msgTypes[97]
+	mi := &file_filer_proto_msgTypes[100]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6775,20 +7102,21 @@ func (x *LocateBrokerResponse_Resource) GetResourceCount() int32 {
 }
 
 type FilerConf_PathConf struct {
-	state                protoimpl.MessageState `protogen:"open.v1"`
-	LocationPrefix       string                 `protobuf:"bytes,1,opt,name=location_prefix,json=locationPrefix,proto3" json:"location_prefix,omitempty"`
-	Collection           string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
-	Replication          string                 `protobuf:"bytes,3,opt,name=replication,proto3" json:"replication,omitempty"`
-	Ttl                  string                 `protobuf:"bytes,4,opt,name=ttl,proto3" json:"ttl,omitempty"`
-	DiskType             string                 `protobuf:"bytes,5,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`
-	Fsync                bool                   `protobuf:"varint,6,opt,name=fsync,proto3" json:"fsync,omitempty"`
-	VolumeGrowthCount    uint32                 `protobuf:"varint,7,opt,name=volume_growth_count,json=volumeGrowthCount,proto3" json:"volume_growth_count,omitempty"`
-	ReadOnly             bool                   `protobuf:"varint,8,opt,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
-	DataCenter           string                 `protobuf:"bytes,9,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"`
-	Rack                 string                 `protobuf:"bytes,10,opt,name=rack,proto3" json:"rack,omitempty"`
-	DataNode             string                 `protobuf:"bytes,11,opt,name=data_node,json=dataNode,proto3" json:"data_node,omitempty"`
-	MaxFileNameLength    uint32                 `protobuf:"varint,12,opt,name=max_file_name_length,json=maxFileNameLength,proto3" json:"max_file_name_length,omitempty"`
-	DisableChunkDeletion bool                   `protobuf:"varint,13,opt,name=disable_chunk_deletion,json=disableChunkDeletion,proto3" json:"disable_chunk_deletion,omitempty"`
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	LocationPrefix string                 `protobuf:"bytes,1,opt,name=location_prefix,json=locationPrefix,proto3" json:"location_prefix,omitempty"`
+	Collection     string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
+	Replication    string                 `protobuf:"bytes,3,opt,name=replication,proto3" json:"replication,omitempty"`
+	Ttl            string                 `protobuf:"bytes,4,opt,name=ttl,proto3" json:"ttl,omitempty"`
+	DiskType       string                 `protobuf:"bytes,5,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`
+	// unset inherits from the enclosing path rule, set overrides it
+	Fsync                *bool  `protobuf:"varint,6,opt,name=fsync,proto3,oneof" json:"fsync,omitempty"`
+	VolumeGrowthCount    uint32 `protobuf:"varint,7,opt,name=volume_growth_count,json=volumeGrowthCount,proto3" json:"volume_growth_count,omitempty"`
+	ReadOnly             bool   `protobuf:"varint,8,opt,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
+	DataCenter           string `protobuf:"bytes,9,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"`
+	Rack                 string `protobuf:"bytes,10,opt,name=rack,proto3" json:"rack,omitempty"`
+	DataNode             string `protobuf:"bytes,11,opt,name=data_node,json=dataNode,proto3" json:"data_node,omitempty"`
+	MaxFileNameLength    uint32 `protobuf:"varint,12,opt,name=max_file_name_length,json=maxFileNameLength,proto3" json:"max_file_name_length,omitempty"`
+	DisableChunkDeletion bool   `protobuf:"varint,13,opt,name=disable_chunk_deletion,json=disableChunkDeletion,proto3" json:"disable_chunk_deletion,omitempty"`
 	// unset inherits from the enclosing path rule, set overrides it
 	Worm                     *bool  `protobuf:"varint,14,opt,name=worm,proto3,oneof" json:"worm,omitempty"`
 	WormGracePeriodSeconds   uint64 `protobuf:"varint,15,opt,name=worm_grace_period_seconds,json=wormGracePeriodSeconds,proto3" json:"worm_grace_period_seconds,omitempty"`
@@ -6799,7 +7127,7 @@ type FilerConf_PathConf struct {
 
 func (x *FilerConf_PathConf) Reset() {
 	*x = FilerConf_PathConf{}
-	mi := &file_filer_proto_msgTypes[98]
+	mi := &file_filer_proto_msgTypes[101]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -6811,7 +7139,7 @@ func (x *FilerConf_PathConf) String() string {
 func (*FilerConf_PathConf) ProtoMessage() {}
 
 func (x *FilerConf_PathConf) ProtoReflect() protoreflect.Message {
-	mi := &file_filer_proto_msgTypes[98]
+	mi := &file_filer_proto_msgTypes[101]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -6863,8 +7191,8 @@ func (x *FilerConf_PathConf) GetDiskType() string {
 }
 
 func (x *FilerConf_PathConf) GetFsync() bool {
-	if x != nil {
-		return x.Fsync
+	if x != nil && x.Fsync != nil {
+		return *x.Fsync
 	}
 	return false
 }
@@ -7049,7 +7377,7 @@ const file_filer_proto_rawDesc = "" +
 	"\bctime_ns\x18\x14 \x01(\x05R\actimeNs\x12\x1b\n" +
 	"\tcrtime_ns\x18\x15 \x01(\x05R\bcrtimeNs\x12\x14\n" +
 	"\x05atime\x18\x16 \x01(\x03R\x05atime\x12\x19\n" +
-	"\batime_ns\x18\x17 \x01(\x05R\aatimeNs\"\xba\x02\n" +
+	"\batime_ns\x18\x17 \x01(\x05R\aatimeNs\"\xd5\x02\n" +
 	"\x12CreateEntryRequest\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12%\n" +
 	"\x05entry\x18\x02 \x01(\v2\x0f.filer_pb.EntryR\x05entry\x12\x15\n" +
@@ -7059,9 +7387,10 @@ const file_filer_proto_rawDesc = "" +
 	"signatures\x18\x05 \x03(\x05R\n" +
 	"signatures\x12=\n" +
 	"\x1bskip_check_parent_directory\x18\x06 \x01(\bR\x18skipCheckParentDirectory\x126\n" +
-	"\tcondition\x18\a \x01(\v2\x18.filer_pb.WriteConditionR\tcondition\"\xbc\x04\n" +
+	"\tcondition\x18\a \x01(\v2\x18.filer_pb.WriteConditionR\tcondition\x12\x19\n" +
+	"\bis_moved\x18\b \x01(\bR\aisMoved\"\x88\x05\n" +
 	"\x0eWriteCondition\x129\n" +
-	"\aclauses\x18\x01 \x03(\v2\x1f.filer_pb.WriteCondition.ClauseR\aclauses\x1a\x91\x02\n" +
+	"\aclauses\x18\x01 \x03(\v2\x1f.filer_pb.WriteCondition.ClauseR\aclauses\x1a\xc9\x02\n" +
 	"\x06Clause\x121\n" +
 	"\x04kind\x18\x01 \x01(\x0e2\x1d.filer_pb.WriteCondition.KindR\x04kind\x12\x14\n" +
 	"\x05etags\x18\x02 \x03(\tR\x05etags\x12\x1b\n" +
@@ -7073,7 +7402,9 @@ const file_filer_proto_rawDesc = "" +
 	"\bgate_key\x18\a \x01(\tR\agateKey\x12\x1d\n" +
 	"\n" +
 	"gate_value\x18\b \x01(\tR\tgateValue\x12\x12\n" +
-	"\x04fids\x18\t \x03(\tR\x04fids\"\xda\x01\n" +
+	"\x04fids\x18\t \x03(\tR\x04fids\x126\n" +
+	"\x0eexpected_entry\x18\n" +
+	" \x01(\v2\x0f.filer_pb.EntryR\rexpectedEntry\"\xee\x01\n" +
 	"\x04Kind\x12\b\n" +
 	"\x04NONE\x10\x00\x12\x11\n" +
 	"\rIF_NOT_EXISTS\x10\x01\x12\r\n" +
@@ -7084,7 +7415,9 @@ const file_filer_proto_rawDesc = "" +
 	"\x11IF_MODIFIED_SINCE\x10\x06\x12\x19\n" +
 	"\x15IF_EXTENDED_NOT_EQUAL\x10\a\x12\x1c\n" +
 	"\x18IF_EXTENDED_TIME_ELAPSED\x10\b\x12\x13\n" +
-	"\x0fIF_CHUNKS_EQUAL\x10\t\"\xa2\x05\n" +
+	"\x0fIF_CHUNKS_EQUAL\x10\t\x12\x12\n" +
+	"\x0eIF_ENTRY_EQUAL\x10\n" +
+	"\"\xd0\x05\n" +
 	"\x0eObjectMutation\x121\n" +
 	"\x04type\x18\x01 \x01(\x0e2\x1d.filer_pb.ObjectMutation.TypeR\x04type\x12\x1c\n" +
 	"\tdirectory\x18\x02 \x01(\tR\tdirectory\x12\x12\n" +
@@ -7101,7 +7434,8 @@ const file_filer_proto_rawDesc = "" +
 	"\acontent\x18\v \x01(\fR\acontent\x12\x1f\n" +
 	"\vtouch_mtime\x18\f \x01(\bR\n" +
 	"touchMtime\x12.\n" +
-	"\x13remove_empty_parent\x18\r \x01(\bR\x11removeEmptyParent\x1a>\n" +
+	"\x13remove_empty_parent\x18\r \x01(\bR\x11removeEmptyParent\x12,\n" +
+	"\x12keep_remote_object\x18\x0e \x01(\bR\x10keepRemoteObject\x1a>\n" +
 	"\x10SetExtendedEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\fR\x05value:\x028\x01\"E\n" +
@@ -7127,7 +7461,7 @@ const file_filer_proto_rawDesc = "" +
 	"\fexclude_name\x18\t \x01(\tR\vexcludeName\x1a?\n" +
 	"\x11CopyExtendedEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xd5\x02\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xa0\x03\n" +
 	"\x18ObjectTransactionRequest\x12\x19\n" +
 	"\block_key\x18\x01 \x01(\tR\alockKey\x126\n" +
 	"\tcondition\x18\x02 \x01(\v2\x18.filer_pb.WriteConditionR\tcondition\x126\n" +
@@ -7138,7 +7472,11 @@ const file_filer_proto_rawDesc = "" +
 	"signatures\x12#\n" +
 	"\rcondition_key\x18\x06 \x01(\tR\fconditionKey\x12\x1b\n" +
 	"\troute_key\x18\a \x01(\tR\brouteKey\x12\x19\n" +
-	"\bis_moved\x18\b \x01(\bR\aisMoved\"f\n" +
+	"\bis_moved\x18\b \x01(\bR\aisMoved\x12\x1d\n" +
+	"\n" +
+	"request_id\x18\t \x01(\tR\trequestId\x12*\n" +
+	"\x11condition_alt_key\x18\n" +
+	" \x01(\tR\x0fconditionAltKey\"f\n" +
 	"\x19ObjectTransactionResponse\x12\x14\n" +
 	"\x05error\x18\x01 \x01(\tR\x05error\x123\n" +
 	"\n" +
@@ -7172,7 +7510,7 @@ const file_filer_proto_rawDesc = "" +
 	"\n" +
 	"error_code\x18\x03 \x01(\x0e2\x14.filer_pb.FilerErrorR\terrorCode\x12\x1a\n" +
 	"\tlog_ts_ns\x18\x04 \x01(\x03R\alogTsNs\x12#\n" +
-	"\rlog_signature\x18\x05 \x01(\x05R\flogSignature\"\x8a\x03\n" +
+	"\rlog_signature\x18\x05 \x01(\x05R\flogSignature\"\xa5\x03\n" +
 	"\x12UpdateEntryRequest\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12%\n" +
 	"\x05entry\x18\x02 \x01(\v2\x0f.filer_pb.EntryR\x05entry\x121\n" +
@@ -7181,7 +7519,8 @@ const file_filer_proto_rawDesc = "" +
 	"signatures\x18\x04 \x03(\x05R\n" +
 	"signatures\x12_\n" +
 	"\x11expected_extended\x18\x05 \x03(\v22.filer_pb.UpdateEntryRequest.ExpectedExtendedEntryR\x10expectedExtended\x126\n" +
-	"\tcondition\x18\x06 \x01(\v2\x18.filer_pb.WriteConditionR\tcondition\x1aC\n" +
+	"\tcondition\x18\x06 \x01(\v2\x18.filer_pb.WriteConditionR\tcondition\x12\x19\n" +
+	"\bis_moved\x18\a \x01(\bR\aisMoved\x1aC\n" +
 	"\x15ExpectedExtendedEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\fR\x05value:\x028\x01\"\xa2\x01\n" +
@@ -7201,7 +7540,7 @@ const file_filer_proto_rawDesc = "" +
 	"\n" +
 	"entry_name\x18\x02 \x01(\tR\tentryName\x12+\n" +
 	"\x06chunks\x18\x03 \x03(\v2\x13.filer_pb.FileChunkR\x06chunks\"\x17\n" +
-	"\x15AppendToEntryResponse\"\xcb\x02\n" +
+	"\x15AppendToEntryResponse\"\xf9\x02\n" +
 	"\x12DeleteEntryRequest\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12\x12\n" +
 	"\x04name\x18\x02 \x01(\tR\x04name\x12$\n" +
@@ -7212,10 +7551,12 @@ const file_filer_proto_rawDesc = "" +
 	"\n" +
 	"signatures\x18\b \x03(\x05R\n" +
 	"signatures\x121\n" +
-	"\x15if_not_modified_after\x18\t \x01(\x03R\x12ifNotModifiedAfter\"w\n" +
+	"\x15if_not_modified_after\x18\t \x01(\x03R\x12ifNotModifiedAfter\x12,\n" +
+	"\x12keep_remote_object\x18\n" +
+	" \x01(\bR\x10keepRemoteObject\"w\n" +
 	"\x13DeleteEntryResponse\x12\x14\n" +
 	"\x05error\x18\x01 \x01(\tR\x05error\x12J\n" +
-	"\x0emetadata_event\x18\x02 \x01(\v2#.filer_pb.SubscribeMetadataResponseR\rmetadataEvent\"\xba\x01\n" +
+	"\x0emetadata_event\x18\x02 \x01(\v2#.filer_pb.SubscribeMetadataResponseR\rmetadataEvent\"\xed\x01\n" +
 	"\x18AtomicRenameEntryRequest\x12#\n" +
 	"\rold_directory\x18\x01 \x01(\tR\foldDirectory\x12\x19\n" +
 	"\bold_name\x18\x02 \x01(\tR\aoldName\x12#\n" +
@@ -7223,7 +7564,8 @@ const file_filer_proto_rawDesc = "" +
 	"\bnew_name\x18\x04 \x01(\tR\anewName\x12\x1e\n" +
 	"\n" +
 	"signatures\x18\x05 \x03(\x05R\n" +
-	"signatures\"\x1b\n" +
+	"signatures\x121\n" +
+	"\x15fail_if_target_exists\x18\x06 \x01(\bR\x12failIfTargetExists\"\x1b\n" +
 	"\x19AtomicRenameEntryResponse\"\xba\x01\n" +
 	"\x18StreamRenameEntryRequest\x12#\n" +
 	"\rold_directory\x18\x01 \x01(\tR\foldDirectory\x12\x19\n" +
@@ -7251,7 +7593,7 @@ const file_filer_proto_rawDesc = "" +
 	"\tdata_node\x18\t \x01(\tR\bdataNode\x12\x1b\n" +
 	"\tdisk_type\x18\b \x01(\tR\bdiskType\x12,\n" +
 	"\x12expected_data_size\x18\n" +
-	" \x01(\x04R\x10expectedDataSize\"\x91\x02\n" +
+	" \x01(\x04R\x10expectedDataSize\"\xdc\x02\n" +
 	"\x14AssignVolumeResponse\x12\x17\n" +
 	"\afile_id\x18\x01 \x01(\tR\x06fileId\x12\x14\n" +
 	"\x05count\x18\x04 \x01(\x05R\x05count\x12\x12\n" +
@@ -7263,19 +7605,23 @@ const file_filer_proto_rawDesc = "" +
 	"\x05error\x18\b \x01(\tR\x05error\x12.\n" +
 	"\blocation\x18\t \x01(\v2\x12.filer_pb.LocationR\blocation\x12.\n" +
 	"\breplicas\x18\n" +
-	" \x03(\v2\x12.filer_pb.LocationR\breplicas\"4\n" +
+	" \x03(\v2\x12.filer_pb.LocationR\breplicas\x12\x14\n" +
+	"\x05fsync\x18\v \x01(\bR\x05fsync\x123\n" +
+	"\n" +
+	"error_code\x18\f \x01(\x0e2\x14.filer_pb.FilerErrorR\terrorCode\"4\n" +
 	"\x13LookupVolumeRequest\x12\x1d\n" +
 	"\n" +
 	"volume_ids\x18\x01 \x03(\tR\tvolumeIds\"=\n" +
 	"\tLocations\x120\n" +
-	"\tlocations\x18\x01 \x03(\v2\x12.filer_pb.LocationR\tlocations\"y\n" +
+	"\tlocations\x18\x01 \x03(\v2\x12.filer_pb.LocationR\tlocations\"\x9f\x01\n" +
 	"\bLocation\x12\x10\n" +
 	"\x03url\x18\x01 \x01(\tR\x03url\x12\x1d\n" +
 	"\n" +
 	"public_url\x18\x02 \x01(\tR\tpublicUrl\x12\x1b\n" +
 	"\tgrpc_port\x18\x03 \x01(\rR\bgrpcPort\x12\x1f\n" +
 	"\vdata_center\x18\x04 \x01(\tR\n" +
-	"dataCenter\"\xc3\x01\n" +
+	"dataCenter\x12$\n" +
+	"\x0edata_in_remote\x18\x05 \x01(\bR\fdataInRemote\"\xc3\x01\n" +
 	"\x14LookupVolumeResponse\x12U\n" +
 	"\rlocations_map\x18\x01 \x03(\v20.filer_pb.LookupVolumeResponse.LocationsMapEntryR\flocationsMap\x1aT\n" +
 	"\x11LocationsMapEntry\x12\x10\n" +
@@ -7355,13 +7701,14 @@ const file_filer_proto_rawDesc = "" +
 	" \x03(\tR\vdirectories\x128\n" +
 	"\x18client_supports_batching\x18\v \x01(\bR\x16clientSupportsBatching\x12E\n" +
 	"\x1fclient_supports_metadata_chunks\x18\f \x01(\bR\x1cclientSupportsMetadataChunks\x12C\n" +
-	"\x1eclient_supports_idle_heartbeat\x18\r \x01(\bR\x1bclientSupportsIdleHeartbeat\"\x96\x02\n" +
+	"\x1eclient_supports_idle_heartbeat\x18\r \x01(\bR\x1bclientSupportsIdleHeartbeat\"\xba\x02\n" +
 	"\x19SubscribeMetadataResponse\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12J\n" +
 	"\x12event_notification\x18\x02 \x01(\v2\x1b.filer_pb.EventNotificationR\x11eventNotification\x12\x13\n" +
 	"\x05ts_ns\x18\x03 \x01(\x03R\x04tsNs\x12;\n" +
 	"\x06events\x18\x04 \x03(\v2#.filer_pb.SubscribeMetadataResponseR\x06events\x12=\n" +
-	"\rlog_file_refs\x18\x05 \x03(\v2\x19.filer_pb.LogFileChunkRefR\vlogFileRefs\"C\n" +
+	"\rlog_file_refs\x18\x05 \x03(\v2\x19.filer_pb.LogFileChunkRefR\vlogFileRefs\x12\"\n" +
+	"\rflushed_ts_ns\x18\x06 \x01(\x03R\vflushedTsNs\"C\n" +
 	"\x1eListMetadataSubscribersRequest\x12!\n" +
 	"\fclient_types\x18\x01 \x03(\tR\vclientTypes\"a\n" +
 	"\x1fListMetadataSubscribersResponse\x12>\n" +
@@ -7385,10 +7732,11 @@ const file_filer_proto_rawDesc = "" +
 	"\bfiler_id\x18\x03 \x01(\tR\afilerId\"g\n" +
 	"\x1aTraverseBfsMetadataRequest\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12+\n" +
-	"\x11excluded_prefixes\x18\x02 \x03(\tR\x10excludedPrefixes\"b\n" +
+	"\x11excluded_prefixes\x18\x02 \x03(\tR\x10excludedPrefixes\"\x82\x01\n" +
 	"\x1bTraverseBfsMetadataResponse\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12%\n" +
-	"\x05entry\x18\x02 \x01(\v2\x0f.filer_pb.EntryR\x05entry\"\x8b\x01\n" +
+	"\x05entry\x18\x02 \x01(\v2\x0f.filer_pb.EntryR\x05entry\x12\x1e\n" +
+	"\ventry_ts_ns\x18\x03 \x01(\x03R\tentryTsNs\"\x8b\x01\n" +
 	"\bLogEntry\x12\x13\n" +
 	"\x05ts_ns\x18\x01 \x01(\x03R\x04tsNs\x12,\n" +
 	"\x12partition_key_hash\x18\x02 \x01(\x05R\x10partitionKeyHash\x12\x12\n" +
@@ -7417,10 +7765,10 @@ const file_filer_proto_rawDesc = "" +
 	"\x03key\x18\x01 \x01(\fR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\fR\x05value\"%\n" +
 	"\rKvPutResponse\x12\x14\n" +
-	"\x05error\x18\x01 \x01(\tR\x05error\"\xc0\x05\n" +
+	"\x05error\x18\x01 \x01(\tR\x05error\"\xcf\x05\n" +
 	"\tFilerConf\x12\x18\n" +
 	"\aversion\x18\x01 \x01(\x05R\aversion\x12:\n" +
-	"\tlocations\x18\x02 \x03(\v2\x1c.filer_pb.FilerConf.PathConfR\tlocations\x1a\xdc\x04\n" +
+	"\tlocations\x18\x02 \x03(\v2\x1c.filer_pb.FilerConf.PathConfR\tlocations\x1a\xeb\x04\n" +
 	"\bPathConf\x12'\n" +
 	"\x0flocation_prefix\x18\x01 \x01(\tR\x0elocationPrefix\x12\x1e\n" +
 	"\n" +
@@ -7428,8 +7776,8 @@ const file_filer_proto_rawDesc = "" +
 	"collection\x12 \n" +
 	"\vreplication\x18\x03 \x01(\tR\vreplication\x12\x10\n" +
 	"\x03ttl\x18\x04 \x01(\tR\x03ttl\x12\x1b\n" +
-	"\tdisk_type\x18\x05 \x01(\tR\bdiskType\x12\x14\n" +
-	"\x05fsync\x18\x06 \x01(\bR\x05fsync\x12.\n" +
+	"\tdisk_type\x18\x05 \x01(\tR\bdiskType\x12\x19\n" +
+	"\x05fsync\x18\x06 \x01(\bH\x00R\x05fsync\x88\x01\x01\x12.\n" +
 	"\x13volume_growth_count\x18\a \x01(\rR\x11volumeGrowthCount\x12\x1b\n" +
 	"\tread_only\x18\b \x01(\bR\breadOnly\x12\x1f\n" +
 	"\vdata_center\x18\t \x01(\tR\n" +
@@ -7439,9 +7787,10 @@ const file_filer_proto_rawDesc = "" +
 	"\tdata_node\x18\v \x01(\tR\bdataNode\x12/\n" +
 	"\x14max_file_name_length\x18\f \x01(\rR\x11maxFileNameLength\x124\n" +
 	"\x16disable_chunk_deletion\x18\r \x01(\bR\x14disableChunkDeletion\x12\x17\n" +
-	"\x04worm\x18\x0e \x01(\bH\x00R\x04worm\x88\x01\x01\x129\n" +
+	"\x04worm\x18\x0e \x01(\bH\x01R\x04worm\x88\x01\x01\x129\n" +
 	"\x19worm_grace_period_seconds\x18\x0f \x01(\x04R\x16wormGracePeriodSeconds\x12=\n" +
-	"\x1bworm_retention_time_seconds\x18\x10 \x01(\x04R\x18wormRetentionTimeSecondsB\a\n" +
+	"\x1bworm_retention_time_seconds\x18\x10 \x01(\x04R\x18wormRetentionTimeSecondsB\b\n" +
+	"\x06_fsyncB\a\n" +
 	"\x05_worm\"\xba\x01\n" +
 	"&CacheRemoteObjectToLocalClusterRequest\x12\x1c\n" +
 	"\tdirectory\x18\x01 \x01(\tR\tdirectory\x12\x12\n" +
@@ -7546,13 +7895,32 @@ const file_filer_proto_rawDesc = "" +
 	"\flast_seen_ns\x18\x03 \x01(\x03R\n" +
 	"lastSeenNs\x12\x1f\n" +
 	"\vdata_center\x18\x04 \x01(\tR\n" +
-	"dataCenter*7\n" +
+	"dataCenter\"\x9f\x01\n" +
+	"\x1dLookupDirectoryEntriesRequest\x12A\n" +
+	"\brequests\x18\x01 \x03(\v2%.filer_pb.LookupDirectoryEntryRequestR\brequests\x12;\n" +
+	"\x1aunavailable_volume_is_miss\x18\x02 \x01(\bR\x17unavailableVolumeIsMiss\"\xb0\x01\n" +
+	"\x1aLookupDirectoryEntryResult\x12\x14\n" +
+	"\x05found\x18\x01 \x01(\bR\x05found\x12%\n" +
+	"\x05entry\x18\x02 \x01(\v2\x0f.filer_pb.EntryR\x05entry\x12\x14\n" +
+	"\x05error\x18\x03 \x01(\tR\x05error\x12\x1a\n" +
+	"\tlog_ts_ns\x18\x04 \x01(\x03R\alogTsNs\x12#\n" +
+	"\rlog_signature\x18\x05 \x01(\x05R\flogSignature\"\xa9\x03\n" +
+	"\x1eLookupDirectoryEntriesResponse\x12>\n" +
+	"\aresults\x18\x01 \x03(\v2$.filer_pb.LookupDirectoryEntryResultR\aresults\x12_\n" +
+	"\rlocations_map\x18\x02 \x03(\v2:.filer_pb.LookupDirectoryEntriesResponse.LocationsMapEntryR\flocationsMap\x12S\n" +
+	"\tread_auth\x18\x03 \x03(\v26.filer_pb.LookupDirectoryEntriesResponse.ReadAuthEntryR\breadAuth\x1aT\n" +
+	"\x11LocationsMapEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12)\n" +
+	"\x05value\x18\x02 \x01(\v2\x13.filer_pb.LocationsR\x05value:\x028\x01\x1a;\n" +
+	"\rReadAuthEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01*7\n" +
 	"\aSSEType\x12\b\n" +
 	"\x04NONE\x10\x00\x12\t\n" +
 	"\x05SSE_C\x10\x01\x12\v\n" +
 	"\aSSE_KMS\x10\x02\x12\n" +
 	"\n" +
-	"\x06SSE_S3\x10\x03*\xa5\x01\n" +
+	"\x06SSE_S3\x10\x03*\xb4\x01\n" +
 	"\n" +
 	"FilerError\x12\x06\n" +
 	"\x02OK\x10\x00\x12\x17\n" +
@@ -7561,7 +7929,8 @@ const file_filer_proto_rawDesc = "" +
 	"\x15EXISTING_IS_DIRECTORY\x10\x03\x12\x14\n" +
 	"\x10EXISTING_IS_FILE\x10\x04\x12\x18\n" +
 	"\x14ENTRY_ALREADY_EXISTS\x10\x05\x12\x17\n" +
-	"\x13PRECONDITION_FAILED\x10\x06*u\n" +
+	"\x13PRECONDITION_FAILED\x10\x06\x12\r\n" +
+	"\tREAD_ONLY\x10\a*u\n" +
 	"\vPosixLockOp\x12\f\n" +
 	"\bTRY_LOCK\x10\x00\x12\n" +
 	"\n" +
@@ -7571,9 +7940,10 @@ const file_filer_proto_rawDesc = "" +
 	"\x13RELEASE_POSIX_OWNER\x10\x03\x12\x17\n" +
 	"\x13RELEASE_FLOCK_OWNER\x10\x04\x12\x0e\n" +
 	"\n" +
-	"KEEP_ALIVE\x10\x052\xae\x17\n" +
+	"KEEP_ALIVE\x10\x052\x9d\x18\n" +
 	"\fSeaweedFiler\x12g\n" +
-	"\x14LookupDirectoryEntry\x12%.filer_pb.LookupDirectoryEntryRequest\x1a&.filer_pb.LookupDirectoryEntryResponse\"\x00\x12N\n" +
+	"\x14LookupDirectoryEntry\x12%.filer_pb.LookupDirectoryEntryRequest\x1a&.filer_pb.LookupDirectoryEntryResponse\"\x00\x12m\n" +
+	"\x16LookupDirectoryEntries\x12'.filer_pb.LookupDirectoryEntriesRequest\x1a(.filer_pb.LookupDirectoryEntriesResponse\"\x00\x12N\n" +
 	"\vListEntries\x12\x1c.filer_pb.ListEntriesRequest\x1a\x1d.filer_pb.ListEntriesResponse\"\x000\x01\x12L\n" +
 	"\vCreateEntry\x12\x1c.filer_pb.CreateEntryRequest\x1a\x1d.filer_pb.CreateEntryResponse\"\x00\x12L\n" +
 	"\vUpdateEntry\x12\x1c.filer_pb.UpdateEntryRequest\x1a\x1d.filer_pb.UpdateEntryResponse\"\x00\x12X\n" +
@@ -7624,7 +7994,7 @@ func file_filer_proto_rawDescGZIP() []byte {
 }
 
 var file_filer_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
-var file_filer_proto_msgTypes = make([]protoimpl.MessageInfo, 99)
+var file_filer_proto_msgTypes = make([]protoimpl.MessageInfo, 104)
 var file_filer_proto_goTypes = []any{
 	(SSEType)(0),                                    // 0: filer_pb.SSEType
 	(FilerError)(0),                                 // 1: filer_pb.FilerError
@@ -7722,21 +8092,26 @@ var file_filer_proto_goTypes = []any{
 	(*MountListRequest)(nil),                        // 93: filer_pb.MountListRequest
 	(*MountListResponse)(nil),                       // 94: filer_pb.MountListResponse
 	(*MountInfo)(nil),                               // 95: filer_pb.MountInfo
-	nil,                                             // 96: filer_pb.Entry.ExtendedEntry
-	(*WriteCondition_Clause)(nil),                   // 97: filer_pb.WriteCondition.Clause
-	nil,                                             // 98: filer_pb.ObjectMutation.SetExtendedEntry
-	nil,                                             // 99: filer_pb.Recompute.CopyExtendedEntry
-	nil,                                             // 100: filer_pb.UpdateEntryRequest.ExpectedExtendedEntry
-	nil,                                             // 101: filer_pb.LookupVolumeResponse.LocationsMapEntry
-	(*LocateBrokerResponse_Resource)(nil),           // 102: filer_pb.LocateBrokerResponse.Resource
-	(*FilerConf_PathConf)(nil),                      // 103: filer_pb.FilerConf.PathConf
+	(*LookupDirectoryEntriesRequest)(nil),           // 96: filer_pb.LookupDirectoryEntriesRequest
+	(*LookupDirectoryEntryResult)(nil),              // 97: filer_pb.LookupDirectoryEntryResult
+	(*LookupDirectoryEntriesResponse)(nil),          // 98: filer_pb.LookupDirectoryEntriesResponse
+	nil,                                             // 99: filer_pb.Entry.ExtendedEntry
+	(*WriteCondition_Clause)(nil),                   // 100: filer_pb.WriteCondition.Clause
+	nil,                                             // 101: filer_pb.ObjectMutation.SetExtendedEntry
+	nil,                                             // 102: filer_pb.Recompute.CopyExtendedEntry
+	nil,                                             // 103: filer_pb.UpdateEntryRequest.ExpectedExtendedEntry
+	nil,                                             // 104: filer_pb.LookupVolumeResponse.LocationsMapEntry
+	(*LocateBrokerResponse_Resource)(nil),           // 105: filer_pb.LocateBrokerResponse.Resource
+	(*FilerConf_PathConf)(nil),                      // 106: filer_pb.FilerConf.PathConf
+	nil,                                             // 107: filer_pb.LookupDirectoryEntriesResponse.LocationsMapEntry
+	nil,                                             // 108: filer_pb.LookupDirectoryEntriesResponse.ReadAuthEntry
 }
 var file_filer_proto_depIdxs = []int32{
 	10,  // 0: filer_pb.LookupDirectoryEntryResponse.entry:type_name -> filer_pb.Entry
 	10,  // 1: filer_pb.ListEntriesResponse.entry:type_name -> filer_pb.Entry
 	13,  // 2: filer_pb.Entry.chunks:type_name -> filer_pb.FileChunk
 	16,  // 3: filer_pb.Entry.attributes:type_name -> filer_pb.FuseAttributes
-	96,  // 4: filer_pb.Entry.extended:type_name -> filer_pb.Entry.ExtendedEntry
+	99,  // 4: filer_pb.Entry.extended:type_name -> filer_pb.Entry.ExtendedEntry
 	9,   // 5: filer_pb.Entry.remote_entry:type_name -> filer_pb.RemoteEntry
 	10,  // 6: filer_pb.FullEntry.entry:type_name -> filer_pb.Entry
 	10,  // 7: filer_pb.EventNotification.old_entry:type_name -> filer_pb.Entry
@@ -7747,12 +8122,12 @@ var file_filer_proto_depIdxs = []int32{
 	13,  // 12: filer_pb.FileChunkManifest.chunks:type_name -> filer_pb.FileChunk
 	10,  // 13: filer_pb.CreateEntryRequest.entry:type_name -> filer_pb.Entry
 	18,  // 14: filer_pb.CreateEntryRequest.condition:type_name -> filer_pb.WriteCondition
-	97,  // 15: filer_pb.WriteCondition.clauses:type_name -> filer_pb.WriteCondition.Clause
+	100, // 15: filer_pb.WriteCondition.clauses:type_name -> filer_pb.WriteCondition.Clause
 	4,   // 16: filer_pb.ObjectMutation.type:type_name -> filer_pb.ObjectMutation.Type
 	10,  // 17: filer_pb.ObjectMutation.entry:type_name -> filer_pb.Entry
-	98,  // 18: filer_pb.ObjectMutation.set_extended:type_name -> filer_pb.ObjectMutation.SetExtendedEntry
+	101, // 18: filer_pb.ObjectMutation.set_extended:type_name -> filer_pb.ObjectMutation.SetExtendedEntry
 	20,  // 19: filer_pb.ObjectMutation.recompute:type_name -> filer_pb.Recompute
-	99,  // 20: filer_pb.Recompute.copy_extended:type_name -> filer_pb.Recompute.CopyExtendedEntry
+	102, // 20: filer_pb.Recompute.copy_extended:type_name -> filer_pb.Recompute.CopyExtendedEntry
 	18,  // 21: filer_pb.ObjectTransactionRequest.condition:type_name -> filer_pb.WriteCondition
 	19,  // 22: filer_pb.ObjectTransactionRequest.mutations:type_name -> filer_pb.ObjectMutation
 	1,   // 23: filer_pb.ObjectTransactionResponse.error_code:type_name -> filer_pb.FilerError
@@ -7765,7 +8140,7 @@ var file_filer_proto_depIdxs = []int32{
 	59,  // 30: filer_pb.CreateEntryResponse.metadata_event:type_name -> filer_pb.SubscribeMetadataResponse
 	1,   // 31: filer_pb.CreateEntryResponse.error_code:type_name -> filer_pb.FilerError
 	10,  // 32: filer_pb.UpdateEntryRequest.entry:type_name -> filer_pb.Entry
-	100, // 33: filer_pb.UpdateEntryRequest.expected_extended:type_name -> filer_pb.UpdateEntryRequest.ExpectedExtendedEntry
+	103, // 33: filer_pb.UpdateEntryRequest.expected_extended:type_name -> filer_pb.UpdateEntryRequest.ExpectedExtendedEntry
 	18,  // 34: filer_pb.UpdateEntryRequest.condition:type_name -> filer_pb.WriteCondition
 	59,  // 35: filer_pb.UpdateEntryResponse.metadata_event:type_name -> filer_pb.SubscribeMetadataResponse
 	13,  // 36: filer_pb.AppendToEntryRequest.chunks:type_name -> filer_pb.FileChunk
@@ -7773,104 +8148,114 @@ var file_filer_proto_depIdxs = []int32{
 	12,  // 38: filer_pb.StreamRenameEntryResponse.event_notification:type_name -> filer_pb.EventNotification
 	45,  // 39: filer_pb.AssignVolumeResponse.location:type_name -> filer_pb.Location
 	45,  // 40: filer_pb.AssignVolumeResponse.replicas:type_name -> filer_pb.Location
-	45,  // 41: filer_pb.Locations.locations:type_name -> filer_pb.Location
-	101, // 42: filer_pb.LookupVolumeResponse.locations_map:type_name -> filer_pb.LookupVolumeResponse.LocationsMapEntry
-	47,  // 43: filer_pb.CollectionListResponse.collections:type_name -> filer_pb.Collection
-	12,  // 44: filer_pb.SubscribeMetadataResponse.event_notification:type_name -> filer_pb.EventNotification
-	59,  // 45: filer_pb.SubscribeMetadataResponse.events:type_name -> filer_pb.SubscribeMetadataResponse
-	63,  // 46: filer_pb.SubscribeMetadataResponse.log_file_refs:type_name -> filer_pb.LogFileChunkRef
-	62,  // 47: filer_pb.ListMetadataSubscribersResponse.subscribers:type_name -> filer_pb.MetadataSubscriber
-	13,  // 48: filer_pb.LogFileChunkRef.chunks:type_name -> filer_pb.FileChunk
-	10,  // 49: filer_pb.TraverseBfsMetadataResponse.entry:type_name -> filer_pb.Entry
-	102, // 50: filer_pb.LocateBrokerResponse.resources:type_name -> filer_pb.LocateBrokerResponse.Resource
-	103, // 51: filer_pb.FilerConf.locations:type_name -> filer_pb.FilerConf.PathConf
-	10,  // 52: filer_pb.CacheRemoteObjectToLocalClusterResponse.entry:type_name -> filer_pb.Entry
-	59,  // 53: filer_pb.CacheRemoteObjectToLocalClusterResponse.metadata_event:type_name -> filer_pb.SubscribeMetadataResponse
-	84,  // 54: filer_pb.TransferLocksRequest.locks:type_name -> filer_pb.Lock
-	17,  // 55: filer_pb.StreamMutateEntryRequest.create_request:type_name -> filer_pb.CreateEntryRequest
-	29,  // 56: filer_pb.StreamMutateEntryRequest.update_request:type_name -> filer_pb.UpdateEntryRequest
-	35,  // 57: filer_pb.StreamMutateEntryRequest.delete_request:type_name -> filer_pb.DeleteEntryRequest
-	39,  // 58: filer_pb.StreamMutateEntryRequest.rename_request:type_name -> filer_pb.StreamRenameEntryRequest
-	28,  // 59: filer_pb.StreamMutateEntryResponse.create_response:type_name -> filer_pb.CreateEntryResponse
-	30,  // 60: filer_pb.StreamMutateEntryResponse.update_response:type_name -> filer_pb.UpdateEntryResponse
-	36,  // 61: filer_pb.StreamMutateEntryResponse.delete_response:type_name -> filer_pb.DeleteEntryResponse
-	40,  // 62: filer_pb.StreamMutateEntryResponse.rename_response:type_name -> filer_pb.StreamRenameEntryResponse
-	95,  // 63: filer_pb.MountListResponse.mounts:type_name -> filer_pb.MountInfo
-	3,   // 64: filer_pb.WriteCondition.Clause.kind:type_name -> filer_pb.WriteCondition.Kind
-	44,  // 65: filer_pb.LookupVolumeResponse.LocationsMapEntry.value:type_name -> filer_pb.Locations
-	5,   // 66: filer_pb.SeaweedFiler.LookupDirectoryEntry:input_type -> filer_pb.LookupDirectoryEntryRequest
-	7,   // 67: filer_pb.SeaweedFiler.ListEntries:input_type -> filer_pb.ListEntriesRequest
-	17,  // 68: filer_pb.SeaweedFiler.CreateEntry:input_type -> filer_pb.CreateEntryRequest
-	29,  // 69: filer_pb.SeaweedFiler.UpdateEntry:input_type -> filer_pb.UpdateEntryRequest
-	31,  // 70: filer_pb.SeaweedFiler.TouchAccessTime:input_type -> filer_pb.TouchAccessTimeRequest
-	33,  // 71: filer_pb.SeaweedFiler.AppendToEntry:input_type -> filer_pb.AppendToEntryRequest
-	35,  // 72: filer_pb.SeaweedFiler.DeleteEntry:input_type -> filer_pb.DeleteEntryRequest
-	21,  // 73: filer_pb.SeaweedFiler.ObjectTransaction:input_type -> filer_pb.ObjectTransactionRequest
-	26,  // 74: filer_pb.SeaweedFiler.ObjectTransactionBatch:input_type -> filer_pb.ObjectTransactionBatchRequest
-	24,  // 75: filer_pb.SeaweedFiler.PosixLock:input_type -> filer_pb.PosixLockRequest
-	37,  // 76: filer_pb.SeaweedFiler.AtomicRenameEntry:input_type -> filer_pb.AtomicRenameEntryRequest
-	39,  // 77: filer_pb.SeaweedFiler.StreamRenameEntry:input_type -> filer_pb.StreamRenameEntryRequest
-	89,  // 78: filer_pb.SeaweedFiler.StreamMutateEntry:input_type -> filer_pb.StreamMutateEntryRequest
-	41,  // 79: filer_pb.SeaweedFiler.AssignVolume:input_type -> filer_pb.AssignVolumeRequest
-	43,  // 80: filer_pb.SeaweedFiler.LookupVolume:input_type -> filer_pb.LookupVolumeRequest
-	48,  // 81: filer_pb.SeaweedFiler.CollectionList:input_type -> filer_pb.CollectionListRequest
-	50,  // 82: filer_pb.SeaweedFiler.DeleteCollection:input_type -> filer_pb.DeleteCollectionRequest
-	52,  // 83: filer_pb.SeaweedFiler.Statistics:input_type -> filer_pb.StatisticsRequest
-	54,  // 84: filer_pb.SeaweedFiler.Ping:input_type -> filer_pb.PingRequest
-	56,  // 85: filer_pb.SeaweedFiler.GetFilerConfiguration:input_type -> filer_pb.GetFilerConfigurationRequest
-	64,  // 86: filer_pb.SeaweedFiler.TraverseBfsMetadata:input_type -> filer_pb.TraverseBfsMetadataRequest
-	58,  // 87: filer_pb.SeaweedFiler.SubscribeMetadata:input_type -> filer_pb.SubscribeMetadataRequest
-	58,  // 88: filer_pb.SeaweedFiler.SubscribeLocalMetadata:input_type -> filer_pb.SubscribeMetadataRequest
-	60,  // 89: filer_pb.SeaweedFiler.ListMetadataSubscribers:input_type -> filer_pb.ListMetadataSubscribersRequest
-	71,  // 90: filer_pb.SeaweedFiler.KvGet:input_type -> filer_pb.KvGetRequest
-	73,  // 91: filer_pb.SeaweedFiler.KvPut:input_type -> filer_pb.KvPutRequest
-	76,  // 92: filer_pb.SeaweedFiler.CacheRemoteObjectToLocalCluster:input_type -> filer_pb.CacheRemoteObjectToLocalClusterRequest
-	78,  // 93: filer_pb.SeaweedFiler.DistributedLock:input_type -> filer_pb.LockRequest
-	80,  // 94: filer_pb.SeaweedFiler.DistributedUnlock:input_type -> filer_pb.UnlockRequest
-	82,  // 95: filer_pb.SeaweedFiler.FindLockOwner:input_type -> filer_pb.FindLockOwnerRequest
-	85,  // 96: filer_pb.SeaweedFiler.TransferLocks:input_type -> filer_pb.TransferLocksRequest
-	87,  // 97: filer_pb.SeaweedFiler.ReplicateLock:input_type -> filer_pb.ReplicateLockRequest
-	91,  // 98: filer_pb.SeaweedFiler.MountRegister:input_type -> filer_pb.MountRegisterRequest
-	93,  // 99: filer_pb.SeaweedFiler.MountList:input_type -> filer_pb.MountListRequest
-	6,   // 100: filer_pb.SeaweedFiler.LookupDirectoryEntry:output_type -> filer_pb.LookupDirectoryEntryResponse
-	8,   // 101: filer_pb.SeaweedFiler.ListEntries:output_type -> filer_pb.ListEntriesResponse
-	28,  // 102: filer_pb.SeaweedFiler.CreateEntry:output_type -> filer_pb.CreateEntryResponse
-	30,  // 103: filer_pb.SeaweedFiler.UpdateEntry:output_type -> filer_pb.UpdateEntryResponse
-	32,  // 104: filer_pb.SeaweedFiler.TouchAccessTime:output_type -> filer_pb.TouchAccessTimeResponse
-	34,  // 105: filer_pb.SeaweedFiler.AppendToEntry:output_type -> filer_pb.AppendToEntryResponse
-	36,  // 106: filer_pb.SeaweedFiler.DeleteEntry:output_type -> filer_pb.DeleteEntryResponse
-	22,  // 107: filer_pb.SeaweedFiler.ObjectTransaction:output_type -> filer_pb.ObjectTransactionResponse
-	27,  // 108: filer_pb.SeaweedFiler.ObjectTransactionBatch:output_type -> filer_pb.ObjectTransactionBatchResponse
-	25,  // 109: filer_pb.SeaweedFiler.PosixLock:output_type -> filer_pb.PosixLockResponse
-	38,  // 110: filer_pb.SeaweedFiler.AtomicRenameEntry:output_type -> filer_pb.AtomicRenameEntryResponse
-	40,  // 111: filer_pb.SeaweedFiler.StreamRenameEntry:output_type -> filer_pb.StreamRenameEntryResponse
-	90,  // 112: filer_pb.SeaweedFiler.StreamMutateEntry:output_type -> filer_pb.StreamMutateEntryResponse
-	42,  // 113: filer_pb.SeaweedFiler.AssignVolume:output_type -> filer_pb.AssignVolumeResponse
-	46,  // 114: filer_pb.SeaweedFiler.LookupVolume:output_type -> filer_pb.LookupVolumeResponse
-	49,  // 115: filer_pb.SeaweedFiler.CollectionList:output_type -> filer_pb.CollectionListResponse
-	51,  // 116: filer_pb.SeaweedFiler.DeleteCollection:output_type -> filer_pb.DeleteCollectionResponse
-	53,  // 117: filer_pb.SeaweedFiler.Statistics:output_type -> filer_pb.StatisticsResponse
-	55,  // 118: filer_pb.SeaweedFiler.Ping:output_type -> filer_pb.PingResponse
-	57,  // 119: filer_pb.SeaweedFiler.GetFilerConfiguration:output_type -> filer_pb.GetFilerConfigurationResponse
-	65,  // 120: filer_pb.SeaweedFiler.TraverseBfsMetadata:output_type -> filer_pb.TraverseBfsMetadataResponse
-	59,  // 121: filer_pb.SeaweedFiler.SubscribeMetadata:output_type -> filer_pb.SubscribeMetadataResponse
-	59,  // 122: filer_pb.SeaweedFiler.SubscribeLocalMetadata:output_type -> filer_pb.SubscribeMetadataResponse
-	61,  // 123: filer_pb.SeaweedFiler.ListMetadataSubscribers:output_type -> filer_pb.ListMetadataSubscribersResponse
-	72,  // 124: filer_pb.SeaweedFiler.KvGet:output_type -> filer_pb.KvGetResponse
-	74,  // 125: filer_pb.SeaweedFiler.KvPut:output_type -> filer_pb.KvPutResponse
-	77,  // 126: filer_pb.SeaweedFiler.CacheRemoteObjectToLocalCluster:output_type -> filer_pb.CacheRemoteObjectToLocalClusterResponse
-	79,  // 127: filer_pb.SeaweedFiler.DistributedLock:output_type -> filer_pb.LockResponse
-	81,  // 128: filer_pb.SeaweedFiler.DistributedUnlock:output_type -> filer_pb.UnlockResponse
-	83,  // 129: filer_pb.SeaweedFiler.FindLockOwner:output_type -> filer_pb.FindLockOwnerResponse
-	86,  // 130: filer_pb.SeaweedFiler.TransferLocks:output_type -> filer_pb.TransferLocksResponse
-	88,  // 131: filer_pb.SeaweedFiler.ReplicateLock:output_type -> filer_pb.ReplicateLockResponse
-	92,  // 132: filer_pb.SeaweedFiler.MountRegister:output_type -> filer_pb.MountRegisterResponse
-	94,  // 133: filer_pb.SeaweedFiler.MountList:output_type -> filer_pb.MountListResponse
-	100, // [100:134] is the sub-list for method output_type
-	66,  // [66:100] is the sub-list for method input_type
-	66,  // [66:66] is the sub-list for extension type_name
-	66,  // [66:66] is the sub-list for extension extendee
-	0,   // [0:66] is the sub-list for field type_name
+	1,   // 41: filer_pb.AssignVolumeResponse.error_code:type_name -> filer_pb.FilerError
+	45,  // 42: filer_pb.Locations.locations:type_name -> filer_pb.Location
+	104, // 43: filer_pb.LookupVolumeResponse.locations_map:type_name -> filer_pb.LookupVolumeResponse.LocationsMapEntry
+	47,  // 44: filer_pb.CollectionListResponse.collections:type_name -> filer_pb.Collection
+	12,  // 45: filer_pb.SubscribeMetadataResponse.event_notification:type_name -> filer_pb.EventNotification
+	59,  // 46: filer_pb.SubscribeMetadataResponse.events:type_name -> filer_pb.SubscribeMetadataResponse
+	63,  // 47: filer_pb.SubscribeMetadataResponse.log_file_refs:type_name -> filer_pb.LogFileChunkRef
+	62,  // 48: filer_pb.ListMetadataSubscribersResponse.subscribers:type_name -> filer_pb.MetadataSubscriber
+	13,  // 49: filer_pb.LogFileChunkRef.chunks:type_name -> filer_pb.FileChunk
+	10,  // 50: filer_pb.TraverseBfsMetadataResponse.entry:type_name -> filer_pb.Entry
+	105, // 51: filer_pb.LocateBrokerResponse.resources:type_name -> filer_pb.LocateBrokerResponse.Resource
+	106, // 52: filer_pb.FilerConf.locations:type_name -> filer_pb.FilerConf.PathConf
+	10,  // 53: filer_pb.CacheRemoteObjectToLocalClusterResponse.entry:type_name -> filer_pb.Entry
+	59,  // 54: filer_pb.CacheRemoteObjectToLocalClusterResponse.metadata_event:type_name -> filer_pb.SubscribeMetadataResponse
+	84,  // 55: filer_pb.TransferLocksRequest.locks:type_name -> filer_pb.Lock
+	17,  // 56: filer_pb.StreamMutateEntryRequest.create_request:type_name -> filer_pb.CreateEntryRequest
+	29,  // 57: filer_pb.StreamMutateEntryRequest.update_request:type_name -> filer_pb.UpdateEntryRequest
+	35,  // 58: filer_pb.StreamMutateEntryRequest.delete_request:type_name -> filer_pb.DeleteEntryRequest
+	39,  // 59: filer_pb.StreamMutateEntryRequest.rename_request:type_name -> filer_pb.StreamRenameEntryRequest
+	28,  // 60: filer_pb.StreamMutateEntryResponse.create_response:type_name -> filer_pb.CreateEntryResponse
+	30,  // 61: filer_pb.StreamMutateEntryResponse.update_response:type_name -> filer_pb.UpdateEntryResponse
+	36,  // 62: filer_pb.StreamMutateEntryResponse.delete_response:type_name -> filer_pb.DeleteEntryResponse
+	40,  // 63: filer_pb.StreamMutateEntryResponse.rename_response:type_name -> filer_pb.StreamRenameEntryResponse
+	95,  // 64: filer_pb.MountListResponse.mounts:type_name -> filer_pb.MountInfo
+	5,   // 65: filer_pb.LookupDirectoryEntriesRequest.requests:type_name -> filer_pb.LookupDirectoryEntryRequest
+	10,  // 66: filer_pb.LookupDirectoryEntryResult.entry:type_name -> filer_pb.Entry
+	97,  // 67: filer_pb.LookupDirectoryEntriesResponse.results:type_name -> filer_pb.LookupDirectoryEntryResult
+	107, // 68: filer_pb.LookupDirectoryEntriesResponse.locations_map:type_name -> filer_pb.LookupDirectoryEntriesResponse.LocationsMapEntry
+	108, // 69: filer_pb.LookupDirectoryEntriesResponse.read_auth:type_name -> filer_pb.LookupDirectoryEntriesResponse.ReadAuthEntry
+	3,   // 70: filer_pb.WriteCondition.Clause.kind:type_name -> filer_pb.WriteCondition.Kind
+	10,  // 71: filer_pb.WriteCondition.Clause.expected_entry:type_name -> filer_pb.Entry
+	44,  // 72: filer_pb.LookupVolumeResponse.LocationsMapEntry.value:type_name -> filer_pb.Locations
+	44,  // 73: filer_pb.LookupDirectoryEntriesResponse.LocationsMapEntry.value:type_name -> filer_pb.Locations
+	5,   // 74: filer_pb.SeaweedFiler.LookupDirectoryEntry:input_type -> filer_pb.LookupDirectoryEntryRequest
+	96,  // 75: filer_pb.SeaweedFiler.LookupDirectoryEntries:input_type -> filer_pb.LookupDirectoryEntriesRequest
+	7,   // 76: filer_pb.SeaweedFiler.ListEntries:input_type -> filer_pb.ListEntriesRequest
+	17,  // 77: filer_pb.SeaweedFiler.CreateEntry:input_type -> filer_pb.CreateEntryRequest
+	29,  // 78: filer_pb.SeaweedFiler.UpdateEntry:input_type -> filer_pb.UpdateEntryRequest
+	31,  // 79: filer_pb.SeaweedFiler.TouchAccessTime:input_type -> filer_pb.TouchAccessTimeRequest
+	33,  // 80: filer_pb.SeaweedFiler.AppendToEntry:input_type -> filer_pb.AppendToEntryRequest
+	35,  // 81: filer_pb.SeaweedFiler.DeleteEntry:input_type -> filer_pb.DeleteEntryRequest
+	21,  // 82: filer_pb.SeaweedFiler.ObjectTransaction:input_type -> filer_pb.ObjectTransactionRequest
+	26,  // 83: filer_pb.SeaweedFiler.ObjectTransactionBatch:input_type -> filer_pb.ObjectTransactionBatchRequest
+	24,  // 84: filer_pb.SeaweedFiler.PosixLock:input_type -> filer_pb.PosixLockRequest
+	37,  // 85: filer_pb.SeaweedFiler.AtomicRenameEntry:input_type -> filer_pb.AtomicRenameEntryRequest
+	39,  // 86: filer_pb.SeaweedFiler.StreamRenameEntry:input_type -> filer_pb.StreamRenameEntryRequest
+	89,  // 87: filer_pb.SeaweedFiler.StreamMutateEntry:input_type -> filer_pb.StreamMutateEntryRequest
+	41,  // 88: filer_pb.SeaweedFiler.AssignVolume:input_type -> filer_pb.AssignVolumeRequest
+	43,  // 89: filer_pb.SeaweedFiler.LookupVolume:input_type -> filer_pb.LookupVolumeRequest
+	48,  // 90: filer_pb.SeaweedFiler.CollectionList:input_type -> filer_pb.CollectionListRequest
+	50,  // 91: filer_pb.SeaweedFiler.DeleteCollection:input_type -> filer_pb.DeleteCollectionRequest
+	52,  // 92: filer_pb.SeaweedFiler.Statistics:input_type -> filer_pb.StatisticsRequest
+	54,  // 93: filer_pb.SeaweedFiler.Ping:input_type -> filer_pb.PingRequest
+	56,  // 94: filer_pb.SeaweedFiler.GetFilerConfiguration:input_type -> filer_pb.GetFilerConfigurationRequest
+	64,  // 95: filer_pb.SeaweedFiler.TraverseBfsMetadata:input_type -> filer_pb.TraverseBfsMetadataRequest
+	58,  // 96: filer_pb.SeaweedFiler.SubscribeMetadata:input_type -> filer_pb.SubscribeMetadataRequest
+	58,  // 97: filer_pb.SeaweedFiler.SubscribeLocalMetadata:input_type -> filer_pb.SubscribeMetadataRequest
+	60,  // 98: filer_pb.SeaweedFiler.ListMetadataSubscribers:input_type -> filer_pb.ListMetadataSubscribersRequest
+	71,  // 99: filer_pb.SeaweedFiler.KvGet:input_type -> filer_pb.KvGetRequest
+	73,  // 100: filer_pb.SeaweedFiler.KvPut:input_type -> filer_pb.KvPutRequest
+	76,  // 101: filer_pb.SeaweedFiler.CacheRemoteObjectToLocalCluster:input_type -> filer_pb.CacheRemoteObjectToLocalClusterRequest
+	78,  // 102: filer_pb.SeaweedFiler.DistributedLock:input_type -> filer_pb.LockRequest
+	80,  // 103: filer_pb.SeaweedFiler.DistributedUnlock:input_type -> filer_pb.UnlockRequest
+	82,  // 104: filer_pb.SeaweedFiler.FindLockOwner:input_type -> filer_pb.FindLockOwnerRequest
+	85,  // 105: filer_pb.SeaweedFiler.TransferLocks:input_type -> filer_pb.TransferLocksRequest
+	87,  // 106: filer_pb.SeaweedFiler.ReplicateLock:input_type -> filer_pb.ReplicateLockRequest
+	91,  // 107: filer_pb.SeaweedFiler.MountRegister:input_type -> filer_pb.MountRegisterRequest
+	93,  // 108: filer_pb.SeaweedFiler.MountList:input_type -> filer_pb.MountListRequest
+	6,   // 109: filer_pb.SeaweedFiler.LookupDirectoryEntry:output_type -> filer_pb.LookupDirectoryEntryResponse
+	98,  // 110: filer_pb.SeaweedFiler.LookupDirectoryEntries:output_type -> filer_pb.LookupDirectoryEntriesResponse
+	8,   // 111: filer_pb.SeaweedFiler.ListEntries:output_type -> filer_pb.ListEntriesResponse
+	28,  // 112: filer_pb.SeaweedFiler.CreateEntry:output_type -> filer_pb.CreateEntryResponse
+	30,  // 113: filer_pb.SeaweedFiler.UpdateEntry:output_type -> filer_pb.UpdateEntryResponse
+	32,  // 114: filer_pb.SeaweedFiler.TouchAccessTime:output_type -> filer_pb.TouchAccessTimeResponse
+	34,  // 115: filer_pb.SeaweedFiler.AppendToEntry:output_type -> filer_pb.AppendToEntryResponse
+	36,  // 116: filer_pb.SeaweedFiler.DeleteEntry:output_type -> filer_pb.DeleteEntryResponse
+	22,  // 117: filer_pb.SeaweedFiler.ObjectTransaction:output_type -> filer_pb.ObjectTransactionResponse
+	27,  // 118: filer_pb.SeaweedFiler.ObjectTransactionBatch:output_type -> filer_pb.ObjectTransactionBatchResponse
+	25,  // 119: filer_pb.SeaweedFiler.PosixLock:output_type -> filer_pb.PosixLockResponse
+	38,  // 120: filer_pb.SeaweedFiler.AtomicRenameEntry:output_type -> filer_pb.AtomicRenameEntryResponse
+	40,  // 121: filer_pb.SeaweedFiler.StreamRenameEntry:output_type -> filer_pb.StreamRenameEntryResponse
+	90,  // 122: filer_pb.SeaweedFiler.StreamMutateEntry:output_type -> filer_pb.StreamMutateEntryResponse
+	42,  // 123: filer_pb.SeaweedFiler.AssignVolume:output_type -> filer_pb.AssignVolumeResponse
+	46,  // 124: filer_pb.SeaweedFiler.LookupVolume:output_type -> filer_pb.LookupVolumeResponse
+	49,  // 125: filer_pb.SeaweedFiler.CollectionList:output_type -> filer_pb.CollectionListResponse
+	51,  // 126: filer_pb.SeaweedFiler.DeleteCollection:output_type -> filer_pb.DeleteCollectionResponse
+	53,  // 127: filer_pb.SeaweedFiler.Statistics:output_type -> filer_pb.StatisticsResponse
+	55,  // 128: filer_pb.SeaweedFiler.Ping:output_type -> filer_pb.PingResponse
+	57,  // 129: filer_pb.SeaweedFiler.GetFilerConfiguration:output_type -> filer_pb.GetFilerConfigurationResponse
+	65,  // 130: filer_pb.SeaweedFiler.TraverseBfsMetadata:output_type -> filer_pb.TraverseBfsMetadataResponse
+	59,  // 131: filer_pb.SeaweedFiler.SubscribeMetadata:output_type -> filer_pb.SubscribeMetadataResponse
+	59,  // 132: filer_pb.SeaweedFiler.SubscribeLocalMetadata:output_type -> filer_pb.SubscribeMetadataResponse
+	61,  // 133: filer_pb.SeaweedFiler.ListMetadataSubscribers:output_type -> filer_pb.ListMetadataSubscribersResponse
+	72,  // 134: filer_pb.SeaweedFiler.KvGet:output_type -> filer_pb.KvGetResponse
+	74,  // 135: filer_pb.SeaweedFiler.KvPut:output_type -> filer_pb.KvPutResponse
+	77,  // 136: filer_pb.SeaweedFiler.CacheRemoteObjectToLocalCluster:output_type -> filer_pb.CacheRemoteObjectToLocalClusterResponse
+	79,  // 137: filer_pb.SeaweedFiler.DistributedLock:output_type -> filer_pb.LockResponse
+	81,  // 138: filer_pb.SeaweedFiler.DistributedUnlock:output_type -> filer_pb.UnlockResponse
+	83,  // 139: filer_pb.SeaweedFiler.FindLockOwner:output_type -> filer_pb.FindLockOwnerResponse
+	86,  // 140: filer_pb.SeaweedFiler.TransferLocks:output_type -> filer_pb.TransferLocksResponse
+	88,  // 141: filer_pb.SeaweedFiler.ReplicateLock:output_type -> filer_pb.ReplicateLockResponse
+	92,  // 142: filer_pb.SeaweedFiler.MountRegister:output_type -> filer_pb.MountRegisterResponse
+	94,  // 143: filer_pb.SeaweedFiler.MountList:output_type -> filer_pb.MountListResponse
+	109, // [109:144] is the sub-list for method output_type
+	74,  // [74:109] is the sub-list for method input_type
+	74,  // [74:74] is the sub-list for extension type_name
+	74,  // [74:74] is the sub-list for extension extendee
+	0,   // [0:74] is the sub-list for field type_name
 }
 
 func init() { file_filer_proto_init() }
@@ -7891,14 +8276,14 @@ func file_filer_proto_init() {
 		(*StreamMutateEntryResponse_DeleteResponse)(nil),
 		(*StreamMutateEntryResponse_RenameResponse)(nil),
 	}
-	file_filer_proto_msgTypes[98].OneofWrappers = []any{}
+	file_filer_proto_msgTypes[101].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_filer_proto_rawDesc), len(file_filer_proto_rawDesc)),
 			NumEnums:      5,
-			NumMessages:   99,
+			NumMessages:   104,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/weed/pb/filer_pb/filer_client.go b/weed/pb/filer_pb/filer_client.go
index 839c8099ac..257349b021 100644
--- a/weed/pb/filer_pb/filer_client.go
+++ b/weed/pb/filer_pb/filer_client.go
@@ -67,6 +67,16 @@ func GetEntry(ctx context.Context, filerClient FilerClient, fullFilePath util.Fu
 // consumers would mistake for an entry.
 const ListSnapshotTsNsTrailerKey = "sw-list-snapshot-ts-ns"
 
+// TraverseModeHeaderKey is gRPC metadata on a TraverseBfsMetadata stream. As
+// request metadata, TraverseModeSnapshot asks for the entries from one store
+// snapshot (any order, entry_ts_ns left 0) instead of a breadth-first walk; as
+// a response header it says what the filer did. An older filer sends none.
+const (
+	TraverseModeHeaderKey = "sw-traverse-mode"
+	TraverseModeSnapshot  = "snapshot"
+	TraverseModeBfs       = "bfs"
+)
+
 type EachEntryFunction func(entry *Entry, isLast bool) error
 
 func ReadDirAllEntries(ctx context.Context, filerClient FilerClient, fullDirPath util.FullPath, prefix string, fn EachEntryFunction) (err error) {
@@ -91,9 +101,15 @@ func ReadDirAllEntriesWithSnapshot(ctx context.Context, filerClient FilerClient,
 
 	for counter == paginationLimit {
 		counter = 0
+		lastStartFrom := startFrom
 		if _, err = doListWithSnapshot(ctx, filerClient, fullDirPath, prefix, counterFunc, startFrom, false, paginationLimit, snapshotTsNs); err != nil {
 			return snapshotTsNs, err
 		}
+		// A full page that ends on the name it started from would loop forever;
+		// a store whose ordering does not advance past the cursor causes this.
+		if counter == paginationLimit && startFrom == lastStartFrom {
+			return snapshotTsNs, fmt.Errorf("list %s: pagination stuck at %q", fullDirPath, startFrom)
+		}
 	}
 
 	return snapshotTsNs, nil
@@ -155,7 +171,9 @@ func DoSeaweedListWithSnapshot(ctx context.Context, client SeaweedFilerClient, f
 	defer cancel()
 	stream, err := client.ListEntries(ctx, request)
 	if err != nil {
-		return actualSnapshotTsNs, fmt.Errorf("list %s: %v", fullDirPath, err)
+		// fullDirPath is the caller's bucket and prefix; keep the status the filer
+		// sent so a retry is decided on that rather than on this message
+		return actualSnapshotTsNs, fmt.Errorf("list %s: %w", fullDirPath, err)
 	}
 
 	var prevEntry *Entry
@@ -194,7 +212,7 @@ func DoSeaweedListWithSnapshot(ctx context.Context, client SeaweedFilerClient, f
 		}
 		prevEntry = resp.Entry
 		count++
-		if count > int(limit) && limit != 0 {
+		if limit != 0 && uint64(count) > uint64(limit) {
 			prevEntry = nil
 		}
 	}
@@ -236,7 +254,31 @@ func Mkdir(ctx context.Context, filerClient FilerClient, parentDirectoryPath str
 	})
 }
 
+// MkdirExclusive is Mkdir that never replaces an entry already at the path:
+// the create is O_EXCL and a taken name answers ErrEntryAlreadyExists. The
+// taken name leaves the callback as a result, not an error: failover counts a
+// callback error against the filer and retries on the next one.
+func MkdirExclusive(ctx context.Context, filerClient FilerClient, parentDirectoryPath string, dirName string, fn func(entry *Entry)) error {
+	var taken error
+	err := filerClient.WithFilerClient(false, func(client SeaweedFilerClient) error {
+		err := doMkdir(ctx, client, parentDirectoryPath, dirName, true, fn)
+		if errors.Is(err, ErrEntryAlreadyExists) {
+			taken = err
+			return nil
+		}
+		return err
+	})
+	if err == nil {
+		err = taken
+	}
+	return err
+}
+
 func DoMkdir(ctx context.Context, client SeaweedFilerClient, parentDirectoryPath string, dirName string, fn func(entry *Entry)) error {
+	return doMkdir(ctx, client, parentDirectoryPath, dirName, false, fn)
+}
+
+func doMkdir(ctx context.Context, client SeaweedFilerClient, parentDirectoryPath string, dirName string, exclusive bool, fn func(entry *Entry)) error {
 	entry := &Entry{
 		Name:        dirName,
 		IsDirectory: true,
@@ -256,12 +298,13 @@ func DoMkdir(ctx context.Context, client SeaweedFilerClient, parentDirectoryPath
 	request := &CreateEntryRequest{
 		Directory: parentDirectoryPath,
 		Entry:     entry,
+		OExcl:     exclusive,
 	}
 
 	glog.V(1).InfofCtx(ctx, "mkdir: %v", request)
 	if err := CreateEntry(ctx, client, request); err != nil {
 		glog.V(0).InfofCtx(ctx, "mkdir %v: %v", request, err)
-		return fmt.Errorf("mkdir %s/%s: %v", parentDirectoryPath, dirName, err)
+		return fmt.Errorf("mkdir %s/%s: %w", parentDirectoryPath, dirName, err)
 	}
 
 	return nil
@@ -295,7 +338,7 @@ func MkFile(ctx context.Context, filerClient FilerClient, parentDirectoryPath st
 		glog.V(1).InfofCtx(ctx, "create file: %s/%s", parentDirectoryPath, fileName)
 		if err := CreateEntry(ctx, client, request); err != nil {
 			glog.V(0).InfofCtx(ctx, "create file %v:%v", request, err)
-			return fmt.Errorf("create file %s/%s: %v", parentDirectoryPath, fileName, err)
+			return fmt.Errorf("create file %s/%s: %w", parentDirectoryPath, fileName, err)
 		}
 
 		return nil
@@ -332,6 +375,10 @@ func DoRemoveWithResponse(ctx context.Context, client SeaweedFilerClient, parent
 		IsFromOtherCluster:   isFromOtherCluster,
 		Signatures:           signatures,
 	}
+	return DoRemoveRequest(ctx, client, deleteEntryRequest)
+}
+
+func DoRemoveRequest(ctx context.Context, client SeaweedFilerClient, deleteEntryRequest *DeleteEntryRequest) (*DeleteEntryResponse, error) {
 	if resp, err := client.DeleteEntry(ctx, deleteEntryRequest); err != nil {
 		if strings.Contains(err.Error(), ErrNotFound.Error()) {
 			return nil, nil
diff --git a/weed/pb/filer_pb/filer_client_bfs.go b/weed/pb/filer_pb/filer_client_bfs.go
index f6dcdf8803..05c2a4387b 100644
--- a/weed/pb/filer_pb/filer_client_bfs.go
+++ b/weed/pb/filer_pb/filer_client_bfs.go
@@ -15,6 +15,10 @@ import (
 func TraverseBfs(ctx context.Context, filerClient FilerClient, parentPath util.FullPath, fn func(parentPath util.FullPath, entry *Entry) error) (err error) {
 	K := 5
 
+	// callers hand in user-typed paths, and every entry is reported relative
+	// to this one, so a trailing slash must not reach the callback
+	parentPath = util.NormalizePath(string(parentPath))
+
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
@@ -26,11 +30,21 @@ func TraverseBfs(ctx context.Context, filerClient FilerClient, parentPath util.F
 	var once sync.Once
 	var firstErr error
 
+	// A directory delivered twice (a page-boundary race with concurrent
+	// renames, or a store whose listing order misbehaves) must not be walked
+	// twice: the second walk re-lists the same subtree and can keep the
+	// traversal from ever terminating.
+	var visited sync.Map
+	visited.Store(string(parentPath), struct{}{})
+
 	enqueue := func(p util.FullPath) bool {
 		// Stop expanding traversal once canceled (e.g. first error encountered).
 		if ctx.Err() != nil {
 			return false
 		}
+		if _, seen := visited.LoadOrStore(string(p), struct{}{}); seen {
+			return true
+		}
 		pending.Add(1)
 		queue.Enqueue(p)
 		return true
@@ -92,11 +106,7 @@ func processOneDirectory(ctx context.Context, filerClient FilerClient, parentPat
 		}
 
 		if entry.IsDirectory {
-			subDir := fmt.Sprintf("%s/%s", parentPath, entry.Name)
-			if parentPath == "/" {
-				subDir = "/" + entry.Name
-			}
-			if !enqueue(util.FullPath(subDir)) {
+			if !enqueue(parentPath.Child(entry.Name)) {
 				return ctx.Err()
 			}
 		}
@@ -105,9 +115,9 @@ func processOneDirectory(ctx context.Context, filerClient FilerClient, parentPat
 
 }
 
-func StreamBfs(client SeaweedFilerClient, dir util.FullPath, olderThanTsNs int64, fn func(parentPath util.FullPath, entry *Entry) error) (err error) {
+func StreamBfs(ctx context.Context, client SeaweedFilerClient, dir util.FullPath, olderThanTsNs int64, fn func(parentPath util.FullPath, entry *Entry, entryTsNs int64) error) (err error) {
 	glog.V(0).Infof("TraverseBfsMetadata %v if before %v", dir, time.Unix(0, olderThanTsNs))
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 	stream, err := client.TraverseBfsMetadata(ctx, &TraverseBfsMetadataRequest{
 		Directory: string(dir),
@@ -123,7 +133,7 @@ func StreamBfs(client SeaweedFilerClient, dir util.FullPath, olderThanTsNs int64
 			}
 			return fmt.Errorf("traverse bfs metadata: %w", err)
 		}
-		if err := fn(util.FullPath(resp.Directory), resp.Entry); err != nil {
+		if err := fn(util.FullPath(resp.Directory), resp.Entry, resp.EntryTsNs); err != nil {
 			return err
 		}
 	}
diff --git a/weed/pb/filer_pb/filer_client_bfs_test.go b/weed/pb/filer_pb/filer_client_bfs_test.go
new file mode 100644
index 0000000000..2395623df0
--- /dev/null
+++ b/weed/pb/filer_pb/filer_client_bfs_test.go
@@ -0,0 +1,191 @@
+package filer_pb
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"reflect"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// stubFiler serves canned listings and counts how often each directory is listed.
+type stubFiler struct {
+	UnimplementedSeaweedFilerServer
+	mu       sync.Mutex
+	listed   map[string]int
+	listings func(req *ListEntriesRequest, send func(*Entry) error) error
+}
+
+func (s *stubFiler) ListEntries(req *ListEntriesRequest, stream SeaweedFiler_ListEntriesServer) error {
+	s.mu.Lock()
+	if s.listed == nil {
+		s.listed = make(map[string]int)
+	}
+	s.listed[req.Directory]++
+	s.mu.Unlock()
+	return s.listings(req, func(entry *Entry) error {
+		return stream.Send(&ListEntriesResponse{Entry: entry})
+	})
+}
+
+func (s *stubFiler) listedCount(dir string) int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.listed[dir]
+}
+
+type stubFilerClient struct {
+	conn *grpc.ClientConn
+}
+
+func (c *stubFilerClient) WithFilerClient(streamingMode bool, fn func(SeaweedFilerClient) error) error {
+	return fn(NewSeaweedFilerClient(c.conn))
+}
+
+func (c *stubFilerClient) AdjustedUrl(location *Location) string { return location.Url }
+
+func (c *stubFilerClient) GetDataCenter() string { return "" }
+
+func startStubFiler(t *testing.T, s *stubFiler) *stubFilerClient {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	grpcServer := grpc.NewServer()
+	RegisterSeaweedFilerServer(grpcServer, s)
+	go grpcServer.Serve(listener)
+	t.Cleanup(grpcServer.Stop)
+	conn, err := grpc.NewClient(listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { conn.Close() })
+	return &stubFilerClient{conn: conn}
+}
+
+// A directory delivered twice by a misbehaving listing must still be walked once.
+func TestTraverseBfsVisitsDuplicateDirectoryOnce(t *testing.T) {
+	server := &stubFiler{}
+	server.listings = func(req *ListEntriesRequest, send func(*Entry) error) error {
+		switch req.Directory {
+		case "/":
+			if req.StartFromFileName != "" {
+				return nil
+			}
+			for _, name := range []string{"dup", "dup"} {
+				if err := send(&Entry{Name: name, IsDirectory: true}); err != nil {
+					return err
+				}
+			}
+		case "/dup":
+			if req.StartFromFileName != "" {
+				return nil
+			}
+			for _, name := range []string{"a.txt", "b.txt"} {
+				if err := send(&Entry{Name: name}); err != nil {
+					return err
+				}
+			}
+		}
+		return nil
+	}
+	filerClient := startStubFiler(t, server)
+
+	var mu sync.Mutex
+	seen := make(map[string]int)
+	err := TraverseBfs(context.Background(), filerClient, "/", func(parentPath util.FullPath, entry *Entry) error {
+		mu.Lock()
+		seen[string(parentPath.Child(entry.Name))]++
+		mu.Unlock()
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if got := server.listedCount("/dup"); got != 1 {
+		t.Fatalf("listed /dup %d times, want 1", got)
+	}
+	for _, path := range []string{"/dup/a.txt", "/dup/b.txt"} {
+		if seen[path] != 1 {
+			t.Fatalf("visited %s %d times, want 1", path, seen[path])
+		}
+	}
+}
+
+// A store whose pagination never advances past the cursor must error out
+// instead of re-listing the same page forever.
+func TestReadDirAllEntriesStuckPagination(t *testing.T) {
+	server := &stubFiler{}
+	server.listings = func(req *ListEntriesRequest, send func(*Entry) error) error {
+		for i := uint32(0); i < req.Limit; i++ {
+			if err := send(&Entry{Name: fmt.Sprintf("f%05d", i)}); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+	filerClient := startStubFiler(t, server)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- ReadDirAllEntries(context.Background(), filerClient, "/", "", func(entry *Entry, isLast bool) error {
+			return nil
+		})
+	}()
+
+	select {
+	case err := <-done:
+		if err == nil || !strings.Contains(err.Error(), "pagination stuck") {
+			t.Fatalf("want pagination stuck error, got %v", err)
+		}
+	case <-time.After(30 * time.Second):
+		t.Fatal("listing loops forever on a non-advancing store")
+	}
+}
+
+// A start path with a trailing slash must still descend into subdirectories.
+func TestTraverseBfsTrailingSlashRoot(t *testing.T) {
+	server := &stubFiler{}
+	server.listings = func(req *ListEntriesRequest, send func(*Entry) error) error {
+		if req.StartFromFileName != "" {
+			return nil
+		}
+		// the filer trims a single trailing slash, nothing more
+		switch strings.TrimSuffix(req.Directory, "/") {
+		case "/buckets/data":
+			return send(&Entry{Name: "sub", IsDirectory: true})
+		case "/buckets/data/sub":
+			return send(&Entry{Name: "a.txt"})
+		}
+		return nil
+	}
+	filerClient := startStubFiler(t, server)
+
+	var mu sync.Mutex
+	var seen []string
+	err := TraverseBfs(context.Background(), filerClient, "/buckets/data/", func(parentPath util.FullPath, entry *Entry) error {
+		mu.Lock()
+		seen = append(seen, fmt.Sprintf("%s -> %s", parentPath, entry.Name))
+		mu.Unlock()
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sort.Strings(seen)
+	want := []string{"/buckets/data -> sub", "/buckets/data/sub -> a.txt"}
+	if !reflect.DeepEqual(seen, want) {
+		t.Fatalf("visited %v, want %v", seen, want)
+	}
+}
diff --git a/weed/pb/filer_pb/filer_grpc.pb.go b/weed/pb/filer_pb/filer_grpc.pb.go
index 0d103b4c5a..6a2b494a39 100644
--- a/weed/pb/filer_pb/filer_grpc.pb.go
+++ b/weed/pb/filer_pb/filer_grpc.pb.go
@@ -20,6 +20,7 @@ const _ = grpc.SupportPackageIsVersion9
 
 const (
 	SeaweedFiler_LookupDirectoryEntry_FullMethodName            = "/filer_pb.SeaweedFiler/LookupDirectoryEntry"
+	SeaweedFiler_LookupDirectoryEntries_FullMethodName          = "/filer_pb.SeaweedFiler/LookupDirectoryEntries"
 	SeaweedFiler_ListEntries_FullMethodName                     = "/filer_pb.SeaweedFiler/ListEntries"
 	SeaweedFiler_CreateEntry_FullMethodName                     = "/filer_pb.SeaweedFiler/CreateEntry"
 	SeaweedFiler_UpdateEntry_FullMethodName                     = "/filer_pb.SeaweedFiler/UpdateEntry"
@@ -60,6 +61,7 @@ const (
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type SeaweedFilerClient interface {
 	LookupDirectoryEntry(ctx context.Context, in *LookupDirectoryEntryRequest, opts ...grpc.CallOption) (*LookupDirectoryEntryResponse, error)
+	LookupDirectoryEntries(ctx context.Context, in *LookupDirectoryEntriesRequest, opts ...grpc.CallOption) (*LookupDirectoryEntriesResponse, error)
 	ListEntries(ctx context.Context, in *ListEntriesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ListEntriesResponse], error)
 	CreateEntry(ctx context.Context, in *CreateEntryRequest, opts ...grpc.CallOption) (*CreateEntryResponse, error)
 	UpdateEntry(ctx context.Context, in *UpdateEntryRequest, opts ...grpc.CallOption) (*UpdateEntryResponse, error)
@@ -118,6 +120,16 @@ func (c *seaweedFilerClient) LookupDirectoryEntry(ctx context.Context, in *Looku
 	return out, nil
 }
 
+func (c *seaweedFilerClient) LookupDirectoryEntries(ctx context.Context, in *LookupDirectoryEntriesRequest, opts ...grpc.CallOption) (*LookupDirectoryEntriesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(LookupDirectoryEntriesResponse)
+	err := c.cc.Invoke(ctx, SeaweedFiler_LookupDirectoryEntries_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *seaweedFilerClient) ListEntries(ctx context.Context, in *ListEntriesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ListEntriesResponse], error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	stream, err := c.cc.NewStream(ctx, &SeaweedFiler_ServiceDesc.Streams[0], SeaweedFiler_ListEntries_FullMethodName, cOpts...)
@@ -501,6 +513,7 @@ func (c *seaweedFilerClient) MountList(ctx context.Context, in *MountListRequest
 // for forward compatibility.
 type SeaweedFilerServer interface {
 	LookupDirectoryEntry(context.Context, *LookupDirectoryEntryRequest) (*LookupDirectoryEntryResponse, error)
+	LookupDirectoryEntries(context.Context, *LookupDirectoryEntriesRequest) (*LookupDirectoryEntriesResponse, error)
 	ListEntries(*ListEntriesRequest, grpc.ServerStreamingServer[ListEntriesResponse]) error
 	CreateEntry(context.Context, *CreateEntryRequest) (*CreateEntryResponse, error)
 	UpdateEntry(context.Context, *UpdateEntryRequest) (*UpdateEntryResponse, error)
@@ -552,6 +565,9 @@ type UnimplementedSeaweedFilerServer struct{}
 func (UnimplementedSeaweedFilerServer) LookupDirectoryEntry(context.Context, *LookupDirectoryEntryRequest) (*LookupDirectoryEntryResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method LookupDirectoryEntry not implemented")
 }
+func (UnimplementedSeaweedFilerServer) LookupDirectoryEntries(context.Context, *LookupDirectoryEntriesRequest) (*LookupDirectoryEntriesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method LookupDirectoryEntries not implemented")
+}
 func (UnimplementedSeaweedFilerServer) ListEntries(*ListEntriesRequest, grpc.ServerStreamingServer[ListEntriesResponse]) error {
 	return status.Error(codes.Unimplemented, "method ListEntries not implemented")
 }
@@ -690,6 +706,24 @@ func _SeaweedFiler_LookupDirectoryEntry_Handler(srv interface{}, ctx context.Con
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SeaweedFiler_LookupDirectoryEntries_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(LookupDirectoryEntriesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedFilerServer).LookupDirectoryEntries(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedFiler_LookupDirectoryEntries_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedFilerServer).LookupDirectoryEntries(ctx, req.(*LookupDirectoryEntriesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _SeaweedFiler_ListEntries_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(ListEntriesRequest)
 	if err := stream.RecvMsg(m); err != nil {
@@ -1249,6 +1283,10 @@ var SeaweedFiler_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "LookupDirectoryEntry",
 			Handler:    _SeaweedFiler_LookupDirectoryEntry_Handler,
 		},
+		{
+			MethodName: "LookupDirectoryEntries",
+			Handler:    _SeaweedFiler_LookupDirectoryEntries_Handler,
+		},
 		{
 			MethodName: "CreateEntry",
 			Handler:    _SeaweedFiler_CreateEntry_Handler,
diff --git a/weed/pb/filer_pb/filer_pb_helper.go b/weed/pb/filer_pb/filer_pb_helper.go
index bc8a18ab70..390747919e 100644
--- a/weed/pb/filer_pb/filer_pb_helper.go
+++ b/weed/pb/filer_pb/filer_pb_helper.go
@@ -26,7 +26,30 @@ func (entry *Entry) IsDirectoryKeyObject() bool {
 	// Also true for a file promoted to a directory by a child write, which keeps its
 	// chunks/content, or its remote entry when the file was tiered to remote storage.
 	return entry.IsDirectory &&
-		((entry.Attributes != nil && entry.Attributes.Mime != "") || len(entry.GetChunks()) > 0 || len(entry.GetContent()) > 0 || entry.IsInRemoteOnly())
+		((entry.Attributes != nil && entry.Attributes.Mime != "") || len(entry.GetChunks()) > 0 || len(entry.GetContent()) > 0 || entry.IsInRemoteOnly() || entry.IsPrefixObject())
+}
+
+// IsPrefixObject reports whether the directory entry also holds the object named by its
+// path without a trailing slash, which an empty object leaves no other trace of.
+func (entry *Entry) IsPrefixObject() bool {
+	if entry == nil || !entry.IsDirectory {
+		return false
+	}
+	_, marked := entry.Extended[s3_constants.SeaweedFSPrefixObject]
+	return marked
+}
+
+// MarkPrefixObject turns a file entry into the directory entry that stores it, so keys
+// nested under its key can be created beside it.
+func (entry *Entry) MarkPrefixObject() {
+	entry.IsDirectory = true
+	if entry.Attributes != nil {
+		entry.Attributes.FileMode |= uint32(os.ModeDir) | 0111
+	}
+	if entry.Extended == nil {
+		entry.Extended = make(map[string][]byte)
+	}
+	entry.Extended[s3_constants.SeaweedFSPrefixObject] = []byte("true")
 }
 
 func (entry *Entry) GetExpiryTime() (expiryTime int64) {
@@ -154,6 +177,22 @@ func CreateEntryWithResponse(ctx context.Context, client SeaweedFilerClient, req
 	return resp, nil
 }
 
+// SnapshotExtended clones extended attributes for use as an UpdateEntry
+// ExpectedExtended precondition. Listed keys are asserted even when absent,
+// so a concurrent add still fails the precondition.
+func SnapshotExtended(extended map[string][]byte, keys ...string) map[string][]byte {
+	expected := make(map[string][]byte, len(extended)+len(keys))
+	for k, v := range extended {
+		expected[k] = v
+	}
+	for _, k := range keys {
+		if _, ok := expected[k]; !ok {
+			expected[k] = nil
+		}
+	}
+	return expected
+}
+
 func UpdateEntry(ctx context.Context, client SeaweedFilerClient, request *UpdateEntryRequest) error {
 	_, err := UpdateEntryWithResponse(ctx, client, request)
 	return err
@@ -195,6 +234,8 @@ var (
 	ErrExistingIsDirectory = errors.New("existing entry is a directory")
 	ErrExistingIsFile      = errors.New("existing entry is a file")
 	ErrEntryAlreadyExists  = errors.New("entry already exists")
+	ErrReadOnly            = errors.New("read only")
+	ErrPreconditionFailed  = errors.New("precondition failed")
 )
 
 // FilerErrorToSentinel maps a proto FilerError code to its sentinel error.
@@ -211,11 +252,35 @@ func FilerErrorToSentinel(code FilerError) error {
 		return ErrExistingIsFile
 	case FilerError_ENTRY_ALREADY_EXISTS:
 		return ErrEntryAlreadyExists
+	case FilerError_READ_ONLY:
+		return ErrReadOnly
+	case FilerError_PRECONDITION_FAILED:
+		return ErrPreconditionFailed
 	default:
 		return nil
 	}
 }
 
+// AssignVolumeResponseError returns the failure resp reports, or nil. The error
+// keeps the filer's text and, when error_code is set, unwraps to its sentinel so
+// callers can match it with errors.Is.
+func AssignVolumeResponseError(resp *AssignVolumeResponse) error {
+	if resp.Error == "" && resp.ErrorCode == FilerError_OK {
+		return nil
+	}
+	return &codedError{msg: resp.Error, sentinel: FilerErrorToSentinel(resp.ErrorCode)}
+}
+
+// codedError is a filer error message paired with the sentinel of the code
+// sent alongside it (nil for OK or an unknown code).
+type codedError struct {
+	msg      string
+	sentinel error
+}
+
+func (e *codedError) Error() string { return e.msg }
+func (e *codedError) Unwrap() error { return e.sentinel }
+
 func IsEmpty(event *SubscribeMetadataResponse) bool {
 	return event.EventNotification.NewEntry == nil && event.EventNotification.OldEntry == nil
 }
diff --git a/weed/pb/filer_pb/filer_pb_helper_test.go b/weed/pb/filer_pb/filer_pb_helper_test.go
index 92b3eac482..077e00e4ff 100644
--- a/weed/pb/filer_pb/filer_pb_helper_test.go
+++ b/weed/pb/filer_pb/filer_pb_helper_test.go
@@ -1,9 +1,37 @@
 package filer_pb
 
 import (
+	"errors"
+	"os"
 	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 )
 
+func TestAssignVolumeResponseError(t *testing.T) {
+	if err := AssignVolumeResponseError(&AssignVolumeResponse{FileId: "3,01"}); err != nil {
+		t.Fatalf("success response: err = %v, want nil", err)
+	}
+
+	// A filer that predates error_code: the text survives, no sentinel is implied.
+	err := AssignVolumeResponseError(&AssignVolumeResponse{Error: "assign volume: no free volumes"})
+	if err == nil || err.Error() != "assign volume: no free volumes" {
+		t.Fatalf("uncoded response: err = %v, want the filer's text", err)
+	}
+	if errors.Is(err, ErrReadOnly) {
+		t.Fatal("uncoded response must not match ErrReadOnly")
+	}
+
+	msg := "assign volume: read only: /buckets/b (e.g. bucket over quota)"
+	err = AssignVolumeResponseError(&AssignVolumeResponse{Error: msg, ErrorCode: FilerError_READ_ONLY})
+	if !errors.Is(err, ErrReadOnly) {
+		t.Fatalf("READ_ONLY response: err = %v, want ErrReadOnly", err)
+	}
+	if err.Error() != msg {
+		t.Fatalf("READ_ONLY response: message = %q, want %q", err.Error(), msg)
+	}
+}
+
 func TestIsDirectoryKeyObject(t *testing.T) {
 	chunk := []*FileChunk{{FileId: "1,01", Size: 75}}
 
@@ -20,6 +48,7 @@ func TestIsDirectoryKeyObject(t *testing.T) {
 		{"directory with chunks and nil attributes", &Entry{IsDirectory: true, Chunks: chunk}, true},
 		{"regular file with chunks", &Entry{IsDirectory: false, Attributes: &FuseAttributes{}, Chunks: chunk}, false},
 		{"remote mount directory has no remote size", &Entry{IsDirectory: true, Attributes: &FuseAttributes{}, RemoteEntry: &RemoteEntry{StorageName: "s3"}}, false},
+		{"empty prefix object has only the mark", &Entry{IsDirectory: true, Attributes: &FuseAttributes{}, Extended: map[string][]byte{s3_constants.SeaweedFSPrefixObject: []byte("true")}}, true},
 	}
 
 	for _, c := range cases {
@@ -30,3 +59,28 @@ func TestIsDirectoryKeyObject(t *testing.T) {
 		})
 	}
 }
+
+func TestMarkPrefixObject(t *testing.T) {
+	entry := &Entry{Name: "foo", Attributes: &FuseAttributes{FileMode: 0644}}
+
+	if entry.IsPrefixObject() {
+		t.Fatal("a file is not a prefix object")
+	}
+
+	entry.MarkPrefixObject()
+
+	if !entry.IsDirectory || !entry.IsPrefixObject() {
+		t.Errorf("MarkPrefixObject() left %+v", entry)
+	}
+	// The filer derives the entry type from the mode, so the directory bit has to be
+	// on it for the store to keep this as a directory.
+	if mode := os.FileMode(entry.Attributes.FileMode); mode&os.ModeDir == 0 || mode.Perm()&0111 != 0111 {
+		t.Errorf("FileMode = %v, want a traversable directory", mode)
+	}
+
+	// A directory the mark was stripped from is a plain directory again.
+	delete(entry.Extended, s3_constants.SeaweedFSPrefixObject)
+	if entry.IsPrefixObject() || entry.IsDirectoryKeyObject() {
+		t.Error("a demoted directory names no key")
+	}
+}
diff --git a/weed/pb/filer_pb/filer_vtproto.pb.go b/weed/pb/filer_pb/filer_vtproto.pb.go
index efcfa0819d..e86380465e 100644
--- a/weed/pb/filer_pb/filer_vtproto.pb.go
+++ b/weed/pb/filer_pb/filer_vtproto.pb.go
@@ -1014,6 +1014,16 @@ func (m *CreateEntryRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.IsMoved {
+		i--
+		if m.IsMoved {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x40
+	}
 	if m.Condition != nil {
 		size, err := m.Condition.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -1125,6 +1135,16 @@ func (m *WriteCondition_Clause) MarshalToSizedBufferVT(dAtA []byte) (int, error)
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.ExpectedEntry != nil {
+		size, err := m.ExpectedEntry.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x52
+	}
 	if len(m.Fids) > 0 {
 		for iNdEx := len(m.Fids) - 1; iNdEx >= 0; iNdEx-- {
 			i -= len(m.Fids[iNdEx])
@@ -1269,6 +1289,16 @@ func (m *ObjectMutation) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.KeepRemoteObject {
+		i--
+		if m.KeepRemoteObject {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x70
+	}
 	if m.RemoveEmptyParent {
 		i--
 		if m.RemoveEmptyParent {
@@ -1537,6 +1567,20 @@ func (m *ObjectTransactionRequest) MarshalToSizedBufferVT(dAtA []byte) (int, err
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if len(m.ConditionAltKey) > 0 {
+		i -= len(m.ConditionAltKey)
+		copy(dAtA[i:], m.ConditionAltKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ConditionAltKey)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if len(m.RequestId) > 0 {
+		i -= len(m.RequestId)
+		copy(dAtA[i:], m.RequestId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.RequestId)))
+		i--
+		dAtA[i] = 0x4a
+	}
 	if m.IsMoved {
 		i--
 		if m.IsMoved {
@@ -2077,6 +2121,16 @@ func (m *UpdateEntryRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.IsMoved {
+		i--
+		if m.IsMoved {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
 	if m.Condition != nil {
 		size, err := m.Condition.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -2432,6 +2486,16 @@ func (m *DeleteEntryRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.KeepRemoteObject {
+		i--
+		if m.KeepRemoteObject {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x50
+	}
 	if m.IfNotModifiedAfter != 0 {
 		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.IfNotModifiedAfter))
 		i--
@@ -2595,6 +2659,16 @@ func (m *AtomicRenameEntryRequest) MarshalToSizedBufferVT(dAtA []byte) (int, err
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.FailIfTargetExists {
+		i--
+		if m.FailIfTargetExists {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
 	if len(m.Signatures) > 0 {
 		var pksize2 int
 		for _, num := range m.Signatures {
@@ -2944,6 +3018,21 @@ func (m *AssignVolumeResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error)
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.ErrorCode != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.ErrorCode))
+		i--
+		dAtA[i] = 0x60
+	}
+	if m.Fsync {
+		i--
+		if m.Fsync {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
 	if len(m.Replicas) > 0 {
 		for iNdEx := len(m.Replicas) - 1; iNdEx >= 0; iNdEx-- {
 			size, err := m.Replicas[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
@@ -3126,6 +3215,16 @@ func (m *Location) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.DataInRemote {
+		i--
+		if m.DataInRemote {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
 	if len(m.DataCenter) > 0 {
 		i -= len(m.DataCenter)
 		copy(dAtA[i:], m.DataCenter)
@@ -3944,6 +4043,11 @@ func (m *SubscribeMetadataResponse) MarshalToSizedBufferVT(dAtA []byte) (int, er
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.FlushedTsNs != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.FlushedTsNs))
+		i--
+		dAtA[i] = 0x30
+	}
 	if len(m.LogFileRefs) > 0 {
 		for iNdEx := len(m.LogFileRefs) - 1; iNdEx >= 0; iNdEx-- {
 			size, err := m.LogFileRefs[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
@@ -4299,6 +4403,11 @@ func (m *TraverseBfsMetadataResponse) MarshalToSizedBufferVT(dAtA []byte) (int,
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.EntryTsNs != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.EntryTsNs))
+		i--
+		dAtA[i] = 0x18
+	}
 	if m.Entry != nil {
 		size, err := m.Entry.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -4885,9 +4994,9 @@ func (m *FilerConf_PathConf) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i--
 		dAtA[i] = 0x38
 	}
-	if m.Fsync {
+	if m.Fsync != nil {
 		i--
-		if m.Fsync {
+		if *m.Fsync {
 			dAtA[i] = 1
 		} else {
 			dAtA[i] = 0
@@ -6230,6 +6339,217 @@ func (m *MountInfo) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 	return len(dAtA) - i, nil
 }
 
+func (m *LookupDirectoryEntriesRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LookupDirectoryEntriesRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *LookupDirectoryEntriesRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.UnavailableVolumeIsMiss {
+		i--
+		if m.UnavailableVolumeIsMiss {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Requests) > 0 {
+		for iNdEx := len(m.Requests) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Requests[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LookupDirectoryEntryResult) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LookupDirectoryEntryResult) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *LookupDirectoryEntryResult) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.LogSignature != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.LogSignature))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.LogTsNs != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.LogTsNs))
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Entry != nil {
+		size, err := m.Entry.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Found {
+		i--
+		if m.Found {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LookupDirectoryEntriesResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LookupDirectoryEntriesResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *LookupDirectoryEntriesResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.ReadAuth) > 0 {
+		for k := range m.ReadAuth {
+			v := m.ReadAuth[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.LocationsMap) > 0 {
+		for k := range m.LocationsMap {
+			v := m.LocationsMap[k]
+			baseI := i
+			size, err := v.MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Results) > 0 {
+		for iNdEx := len(m.Results) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Results[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *LookupDirectoryEntryRequest) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -6662,6 +6982,9 @@ func (m *CreateEntryRequest) SizeVT() (n int) {
 		l = m.Condition.SizeVT()
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.IsMoved {
+		n += 2
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -6709,6 +7032,10 @@ func (m *WriteCondition_Clause) SizeVT() (n int) {
 			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 		}
 	}
+	if m.ExpectedEntry != nil {
+		l = m.ExpectedEntry.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -6788,6 +7115,9 @@ func (m *ObjectMutation) SizeVT() (n int) {
 	if m.RemoveEmptyParent {
 		n += 2
 	}
+	if m.KeepRemoteObject {
+		n += 2
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -6882,6 +7212,14 @@ func (m *ObjectTransactionRequest) SizeVT() (n int) {
 	if m.IsMoved {
 		n += 2
 	}
+	l = len(m.RequestId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ConditionAltKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7083,6 +7421,9 @@ func (m *UpdateEntryRequest) SizeVT() (n int) {
 		l = m.Condition.SizeVT()
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.IsMoved {
+		n += 2
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7214,6 +7555,9 @@ func (m *DeleteEntryRequest) SizeVT() (n int) {
 	if m.IfNotModifiedAfter != 0 {
 		n += 1 + protohelpers.SizeOfVarint(uint64(m.IfNotModifiedAfter))
 	}
+	if m.KeepRemoteObject {
+		n += 2
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7265,6 +7609,9 @@ func (m *AtomicRenameEntryRequest) SizeVT() (n int) {
 		}
 		n += 1 + protohelpers.SizeOfVarint(uint64(l)) + l
 	}
+	if m.FailIfTargetExists {
+		n += 2
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7419,6 +7766,12 @@ func (m *AssignVolumeResponse) SizeVT() (n int) {
 			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 		}
 	}
+	if m.Fsync {
+		n += 2
+	}
+	if m.ErrorCode != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.ErrorCode))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7476,6 +7829,9 @@ func (m *Location) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.DataInRemote {
+		n += 2
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7816,6 +8172,9 @@ func (m *SubscribeMetadataResponse) SizeVT() (n int) {
 			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 		}
 	}
+	if m.FlushedTsNs != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.FlushedTsNs))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7948,6 +8307,9 @@ func (m *TraverseBfsMetadataResponse) SizeVT() (n int) {
 		l = m.Entry.SizeVT()
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.EntryTsNs != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.EntryTsNs))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -8152,7 +8514,7 @@ func (m *FilerConf_PathConf) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
-	if m.Fsync {
+	if m.Fsync != nil {
 		n += 2
 	}
 	if m.VolumeGrowthCount != 0 {
@@ -8730,6 +9092,89 @@ func (m *MountInfo) SizeVT() (n int) {
 	return n
 }
 
+func (m *LookupDirectoryEntriesRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Requests) > 0 {
+		for _, e := range m.Requests {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.UnavailableVolumeIsMiss {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *LookupDirectoryEntryResult) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Found {
+		n += 2
+	}
+	if m.Entry != nil {
+		l = m.Entry.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.LogTsNs != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.LogTsNs))
+	}
+	if m.LogSignature != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.LogSignature))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *LookupDirectoryEntriesResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Results) > 0 {
+		for _, e := range m.Results {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.LocationsMap) > 0 {
+		for k, v := range m.LocationsMap {
+			_ = k
+			_ = v
+			l = 0
+			if v != nil {
+				l = v.SizeVT()
+			}
+			l += 1 + protohelpers.SizeOfVarint(uint64(l))
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + l
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	if len(m.ReadAuth) > 0 {
+		for k, v := range m.ReadAuth {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + 1 + len(v) + protohelpers.SizeOfVarint(uint64(len(v)))
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
 func (m *LookupDirectoryEntryRequest) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -11712,6 +12157,26 @@ func (m *CreateEntryRequest) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IsMoved", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IsMoved = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -12013,6 +12478,42 @@ func (m *WriteCondition_Clause) UnmarshalVT(dAtA []byte) error {
 			}
 			m.Fids = append(m.Fids, string(dAtA[iNdEx:postIndex]))
 			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExpectedEntry", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ExpectedEntry == nil {
+				m.ExpectedEntry = &Entry{}
+			}
+			if err := m.ExpectedEntry.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -12598,6 +13099,26 @@ func (m *ObjectMutation) UnmarshalVT(dAtA []byte) error {
 				}
 			}
 			m.RemoveEmptyParent = bool(v != 0)
+		case 14:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeepRemoteObject", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.KeepRemoteObject = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -13355,6 +13876,70 @@ func (m *ObjectTransactionRequest) UnmarshalVT(dAtA []byte) error {
 				}
 			}
 			m.IsMoved = bool(v != 0)
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RequestId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConditionAltKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ConditionAltKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -14706,6 +15291,26 @@ func (m *UpdateEntryRequest) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IsMoved", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.IsMoved = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -15545,6 +16150,26 @@ func (m *DeleteEntryRequest) UnmarshalVT(dAtA []byte) error {
 					break
 				}
 			}
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KeepRemoteObject", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.KeepRemoteObject = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -15919,6 +16544,26 @@ func (m *AtomicRenameEntryRequest) UnmarshalVT(dAtA []byte) error {
 			} else {
 				return fmt.Errorf("proto: wrong wireType = %d for field Signatures", wireType)
 			}
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FailIfTargetExists", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.FailIfTargetExists = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -16995,6 +17640,45 @@ func (m *AssignVolumeResponse) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Fsync", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Fsync = bool(v != 0)
+		case 12:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ErrorCode", wireType)
+			}
+			m.ErrorCode = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ErrorCode |= FilerError(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -17329,6 +18013,26 @@ func (m *Location) UnmarshalVT(dAtA []byte) error {
 			}
 			m.DataCenter = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DataInRemote", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DataInRemote = bool(v != 0)
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -19463,6 +20167,25 @@ func (m *SubscribeMetadataResponse) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field FlushedTsNs", wireType)
+			}
+			m.FlushedTsNs = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.FlushedTsNs |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -20269,6 +20992,25 @@ func (m *TraverseBfsMetadataResponse) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EntryTsNs", wireType)
+			}
+			m.EntryTsNs = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.EntryTsNs |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -21554,7 +22296,8 @@ func (m *FilerConf_PathConf) UnmarshalVT(dAtA []byte) error {
 					break
 				}
 			}
-			m.Fsync = bool(v != 0)
+			b := bool(v != 0)
+			m.Fsync = &b
 		case 7:
 			if wireType != 0 {
 				return fmt.Errorf("proto: wrong wireType = %d for field VolumeGrowthCount", wireType)
@@ -24741,3 +25484,626 @@ func (m *MountInfo) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *LookupDirectoryEntriesRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LookupDirectoryEntriesRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LookupDirectoryEntriesRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Requests = append(m.Requests, &LookupDirectoryEntryRequest{})
+			if err := m.Requests[len(m.Requests)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UnavailableVolumeIsMiss", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.UnavailableVolumeIsMiss = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LookupDirectoryEntryResult) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LookupDirectoryEntryResult: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LookupDirectoryEntryResult: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Found", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Found = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Entry", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Entry == nil {
+				m.Entry = &Entry{}
+			}
+			if err := m.Entry.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogTsNs", wireType)
+			}
+			m.LogTsNs = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.LogTsNs |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LogSignature", wireType)
+			}
+			m.LogSignature = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.LogSignature |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LookupDirectoryEntriesResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LookupDirectoryEntriesResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LookupDirectoryEntriesResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Results", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Results = append(m.Results, &LookupDirectoryEntryResult{})
+			if err := m.Results[len(m.Results)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LocationsMap", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LocationsMap == nil {
+				m.LocationsMap = make(map[string]*Locations)
+			}
+			var mapkey string
+			var mapvalue *Locations
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &Locations{}
+					if err := mapvalue.UnmarshalVT(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.LocationsMap[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReadAuth", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ReadAuth == nil {
+				m.ReadAuth = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.ReadAuth[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/weed/pb/filer_pb_direct_read.go b/weed/pb/filer_pb_direct_read.go
index 0011d82d79..f536b93a14 100644
--- a/weed/pb/filer_pb_direct_read.go
+++ b/weed/pb/filer_pb_direct_read.go
@@ -19,12 +19,17 @@ import (
 type LogFileReaderFn func(chunks []*filer_pb.FileChunk) (io.ReadCloser, error)
 
 // logEntryChannelSize bounds decoded entries in flight per filer stream.
-const logEntryChannelSize = 512
+const logEntryChannelSize = 4096
 
 // maxLogEntrySize guards the per-entry allocation against a corrupt size
 // prefix, mirroring the filer package's unexported constant.
 const maxLogEntrySize = 1 << 30
 
+// ErrLogFileRead marks a failure to read persisted log chunks from volume
+// servers. It surfaces as the metadata stream's error, but says nothing about
+// the filer connection that carried the stream.
+var ErrLogFileRead = errors.New("read log file refs")
+
 // errReaderStopped signals that the entry consumer asked to stop (the merge
 // loop aborted or the caller hit a processing error). It is not a read failure.
 var errReaderStopped = errors.New("log entry reader stopped")
diff --git a/weed/pb/filer_pb_tail.go b/weed/pb/filer_pb_tail.go
index 4612a91d40..edbd68c01a 100644
--- a/weed/pb/filer_pb_tail.go
+++ b/weed/pb/filer_pb_tail.go
@@ -2,6 +2,7 @@ package pb
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"time"
@@ -44,8 +45,23 @@ type MetadataFollowOption struct {
 	// a freshness signal only and does not advance StartTsNs, so the resume
 	// checkpoint stays on the last real event.
 	OnIdleHeartbeat func(tsNs int64)
+	// GetResumeTsNs, when non-nil, supplies the reconnect position instead of
+	// StartTsNs. It is read on every subscribe, so a callback can return the
+	// durably processed watermark while StartTsNs keeps tracking positions the
+	// stream has merely seen.
+	GetResumeTsNs func() int64
+	// Resubscribe, when closed, drops the stream with ErrResubscribe so the
+	// caller's reconnect loop resubscribes from GetResumeTsNs and replays the
+	// events still pinning the processed watermark. Target-side job failures
+	// never surface on this stream, so without it a pinned event waits for an
+	// unrelated source-stream reconnect (or a restart) to be replayed.
+	Resubscribe <-chan struct{}
 }
 
+// ErrResubscribe ends a metadata follow when the consumer asked for the
+// stream to drop so the reconnect replays what the resume watermark pins.
+var ErrResubscribe = errors.New("resubscribe to replay events behind the failed offset")
+
 type ProcessMetadataFunc func(resp *filer_pb.SubscribeMetadataResponse) error
 
 func FollowMetadata(filerAddress ServerAddress, grpcDialOption grpc.DialOption, option *MetadataFollowOption, processEventFn ProcessMetadataFunc) error {
@@ -71,12 +87,16 @@ func makeSubscribeMetadataFunc(option *MetadataFollowOption, processEventFn Proc
 	return func(client filer_pb.SeaweedFilerClient) error {
 		ctx, cancel := context.WithCancel(context.Background())
 		defer cancel()
+		sinceNs := option.StartTsNs
+		if option.GetResumeTsNs != nil {
+			sinceNs = option.GetResumeTsNs()
+		}
 		stream, err := client.SubscribeMetadata(ctx, &filer_pb.SubscribeMetadataRequest{
 			ClientName:                   option.ClientName,
 			PathPrefix:                   option.PathPrefix,
 			PathPrefixes:                 option.AdditionalPathPrefixes,
 			Directories:                  option.DirectoriesToWatch,
-			SinceNs:                      option.StartTsNs,
+			SinceNs:                      sinceNs,
 			Signature:                    option.SelfSignature,
 			ClientId:                     option.ClientId,
 			ClientEpoch:                  option.ClientEpoch,
@@ -89,6 +109,16 @@ func makeSubscribeMetadataFunc(option *MetadataFollowOption, processEventFn Proc
 			return fmt.Errorf("subscribe: %w", err)
 		}
 
+		if option.Resubscribe != nil {
+			go func() {
+				select {
+				case <-option.Resubscribe:
+					cancel()
+				case <-ctx.Done():
+				}
+			}()
+		}
+
 		handleErr := func(resp *filer_pb.SubscribeMetadataResponse, err error) {
 			switch option.EventErrorType {
 			case TrivialOnError:
@@ -96,12 +126,21 @@ func makeSubscribeMetadataFunc(option *MetadataFollowOption, processEventFn Proc
 			case FatalOnError:
 				glog.Fatalf("process %v: %v", resp, err)
 			case RetryForeverOnError:
-				util.RetryUntil("followMetaUpdates", func() error {
-					return processEventFn(resp)
-				}, func(err error) bool {
-					glog.Errorf("process %v: %v", resp, err)
-					return true
-				})
+				waitTime := time.Second
+				for ctx.Err() == nil {
+					if err := processEventFn(resp); err == nil {
+						break
+					} else {
+						glog.Errorf("process %v: %v", resp, err)
+					}
+					select {
+					case <-ctx.Done():
+					case <-time.After(waitTime):
+					}
+					if waitTime < util.RetryWaitTime {
+						waitTime += waitTime / 2
+					}
+				}
 			case DontLogError:
 				// pass
 			default:
@@ -121,16 +160,31 @@ func makeSubscribeMetadataFunc(option *MetadataFollowOption, processEventFn Proc
 					option.OnIdleHeartbeat(resp.TsNs)
 				}
 				// The marker advances the resume cursor past the filtered range; the
-				// heartbeat leaves StartTsNs put so a restart cannot outrun a straggler.
+				// heartbeat leaves it put so a restart cannot outrun a straggler. A
+				// consumer with a resume callback keeps its cursor in its processed
+				// watermark, so it sees the marker instead.
 				if resp.EventNotification != nil && resp.TsNs > 0 {
-					option.StartTsNs = resp.TsNs
+					if option.GetResumeTsNs != nil {
+						if err := processEventFn(resp); err != nil {
+							handleErr(resp, err)
+						}
+					} else {
+						option.StartTsNs = resp.TsNs
+					}
 				}
 				return
 			}
 			if err := processEventFn(resp); err != nil {
 				handleErr(resp, err)
+				// RetryForeverOnError only returns once the event was handled;
+				// other modes leave it failed and the cursor stays behind it.
+				if option.EventErrorType != RetryForeverOnError {
+					return
+				}
+			}
+			if option.GetResumeTsNs == nil {
+				option.StartTsNs = resp.TsNs
 			}
-			option.StartTsNs = resp.TsNs
 		}
 
 		var pendingRefs []*filer_pb.LogFileChunkRef
@@ -145,8 +199,15 @@ func makeSubscribeMetadataFunc(option *MetadataFollowOption, processEventFn Proc
 			if len(pendingRefs) == 0 || option.LogFileReaderFn == nil {
 				return nil
 			}
+			readFromNs := option.StartTsNs
+			if option.GetResumeTsNs != nil {
+				// The resume cursor lives in the processed watermark, so a
+				// resubscribed ref replay must not be filtered by positions the
+				// previous stream had only seen.
+				readFromNs = sinceNs
+			}
 			lastTs, readErr := ReadLogFileRefs(pendingRefs, option.LogFileReaderFn,
-				option.StartTsNs, option.StopTsNs,
+				readFromNs, option.StopTsNs,
 				PathFilter{
 					PathPrefix:             option.PathPrefix,
 					AdditionalPathPrefixes: option.AdditionalPathPrefixes,
@@ -154,9 +215,9 @@ func makeSubscribeMetadataFunc(option *MetadataFollowOption, processEventFn Proc
 				},
 				processEventFn)
 			if readErr != nil {
-				return fmt.Errorf("read log file refs: %w", readErr)
+				return fmt.Errorf("%w: %w", ErrLogFileRead, readErr)
 			}
-			if lastTs > 0 {
+			if lastTs > 0 && option.GetResumeTsNs == nil {
 				option.StartTsNs = lastTs
 			}
 			pendingRefs = nil
@@ -169,6 +230,11 @@ func makeSubscribeMetadataFunc(option *MetadataFollowOption, processEventFn Proc
 				return drainPendingRefs()
 			}
 			if listenErr != nil {
+				select {
+				case <-option.Resubscribe:
+					return ErrResubscribe
+				default:
+				}
 				return listenErr
 			}
 
diff --git a/weed/pb/filer_pb_tail_test.go b/weed/pb/filer_pb_tail_test.go
index 224d323bd7..63909f4d4a 100644
--- a/weed/pb/filer_pb_tail_test.go
+++ b/weed/pb/filer_pb_tail_test.go
@@ -2,7 +2,10 @@ package pb
 
 import (
 	"context"
+	"errors"
 	"io"
+	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -60,8 +63,9 @@ func TestFilerSyncOffsetStaysFreshOnFilteredMarker(t *testing.T) {
 	var timeline []gaugeWrite
 	var heartbeatCalls, markerToProcessFn int
 
-	// AddSyncJob drops empty events and does not advance the watermark; the real
-	// processor is checked in command.TestMetadataProcessorEmptyMarkerKeepsWatermarkStale.
+	// This consumer sets no resume callback, so markers keep moving StartTsNs
+	// and never reach processEventFn; the callback path is checked in
+	// TestFilerSyncMarkerReachesCallbackConsumer.
 	realProcessFn := func(resp *filer_pb.SubscribeMetadataResponse) error {
 		if filer_pb.IsEmpty(resp) {
 			markerToProcessFn++
@@ -192,3 +196,294 @@ func TestFilerSyncBatchedFreshnessSignalDoesNotCrash(t *testing.T) {
 		t.Errorf("expected StartTsNs %d (marker), got %d (heartbeat must not advance the cursor)", markerTs, option.StartTsNs)
 	}
 }
+
+// TestFilerSyncResumeFromProcessedWatermarkOnReconnect verifies that when GetResumeTsNs is
+// configured, reconnection uses the processed watermark instead of skipping ahead to the
+// latest received timestamp.
+func TestFilerSyncResumeFromProcessedWatermarkOnReconnect(t *testing.T) {
+	const initialTs = int64(100)
+	const watermarkTs = int64(200)
+	const latestStreamTs = int64(500)
+
+	var capturedSinceNs int64
+	recordingClient := &recordingFilerClient{
+		onSubscribe: func(req *filer_pb.SubscribeMetadataRequest) {
+			capturedSinceNs = req.SinceNs
+		},
+		stream: &fakeSubscribeStream{
+			responses: []*filer_pb.SubscribeMetadataResponse{
+				{
+					Directory:         "/watched",
+					TsNs:              latestStreamTs,
+					EventNotification: &filer_pb.EventNotification{NewEntry: &filer_pb.Entry{Name: "file"}},
+				},
+			},
+		},
+	}
+
+	option := &MetadataFollowOption{
+		ClientName: "syncFrom_A_To_B",
+		StartTsNs:  initialTs,
+		GetResumeTsNs: func() int64 {
+			return watermarkTs
+		},
+	}
+
+	processFn := func(resp *filer_pb.SubscribeMetadataResponse) error {
+		return nil
+	}
+
+	fn := makeSubscribeMetadataFunc(option, processFn)
+	if err := fn(recordingClient); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if capturedSinceNs != watermarkTs {
+		t.Fatalf("expected subscribe SinceNs to be watermark %d, got %d", watermarkTs, capturedSinceNs)
+	}
+	// StartTsNs must not be mutated when GetResumeTsNs is set
+	if option.StartTsNs != initialTs {
+		t.Fatalf("expected option.StartTsNs to remain %d, got %d", initialTs, option.StartTsNs)
+	}
+}
+
+// TestFilerSyncDoesNotAdvanceStartTsNsOnProcessError verifies that a failing synchronous
+// processEventFn does not advance option.StartTsNs past the failed event.
+func TestFilerSyncDoesNotAdvanceStartTsNsOnProcessError(t *testing.T) {
+	const initialTs = int64(100)
+	const failedTs = int64(200)
+
+	option := &MetadataFollowOption{
+		ClientName:     "syncFrom_A_To_B",
+		StartTsNs:      initialTs,
+		EventErrorType: TrivialOnError,
+	}
+
+	stream := &fakeSubscribeStream{
+		responses: []*filer_pb.SubscribeMetadataResponse{
+			{
+				Directory:         "/watched",
+				TsNs:              failedTs,
+				EventNotification: &filer_pb.EventNotification{NewEntry: &filer_pb.Entry{Name: "bad"}},
+			},
+		},
+	}
+
+	processFn := func(resp *filer_pb.SubscribeMetadataResponse) error {
+		return io.ErrUnexpectedEOF
+	}
+
+	fn := makeSubscribeMetadataFunc(option, processFn)
+	_ = fn(&fakeFilerClient{stream: stream})
+
+	if option.StartTsNs != initialTs {
+		t.Fatalf("expected StartTsNs to stay at %d on error, got %d", initialTs, option.StartTsNs)
+	}
+}
+
+type recordingFilerClient struct {
+	filer_pb.SeaweedFilerClient
+	onSubscribe func(req *filer_pb.SubscribeMetadataRequest)
+	stream      *fakeSubscribeStream
+}
+
+func (c *recordingFilerClient) SubscribeMetadata(ctx context.Context, in *filer_pb.SubscribeMetadataRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[filer_pb.SubscribeMetadataResponse], error) {
+	if c.onSubscribe != nil {
+		c.onSubscribe(in)
+	}
+	return c.stream, nil
+}
+
+// RetryForeverOnError resolves a failure inside handleErr, so the cursor must
+// still move past the recovered event instead of replaying it on reconnect.
+func TestFilerSyncRecoveredEventAdvancesCursor(t *testing.T) {
+	var calls int
+	processFn := func(resp *filer_pb.SubscribeMetadataResponse) error {
+		calls++
+		if calls == 1 {
+			return io.ErrUnexpectedEOF
+		}
+		return nil
+	}
+	option := &MetadataFollowOption{
+		ClientName:     "syncFrom_A_To_B",
+		StartTsNs:      100,
+		EventErrorType: RetryForeverOnError,
+	}
+	stream := &fakeSubscribeStream{
+		responses: []*filer_pb.SubscribeMetadataResponse{
+			{Directory: "/watched", TsNs: 300, EventNotification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "file"},
+			}},
+		},
+	}
+	if err := makeSubscribeMetadataFunc(option, processFn)(&fakeFilerClient{stream: stream}); err != nil {
+		t.Fatalf("follow: %v", err)
+	}
+	if calls != 2 {
+		t.Fatalf("expected the event retried once (2 calls), got %d", calls)
+	}
+	if option.StartTsNs != 300 {
+		t.Fatalf("expected StartTsNs 300 after the retry succeeded, got %d", option.StartTsNs)
+	}
+}
+
+// A consumer with a resume callback keeps its cursor in its processed
+// watermark, so a filtered-progress marker is handed to processEventFn (which
+// can count it as processed) instead of mutating StartTsNs.
+func TestFilerSyncMarkerReachesCallbackConsumer(t *testing.T) {
+	var markers, events int
+	option := &MetadataFollowOption{
+		ClientName: "syncFrom_A_To_B",
+		StartTsNs:  100,
+		GetResumeTsNs: func() int64 {
+			return 100
+		},
+	}
+	stream := &fakeSubscribeStream{
+		responses: []*filer_pb.SubscribeMetadataResponse{
+			{Directory: "/watched", TsNs: 300, EventNotification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "file"},
+			}},
+			{TsNs: 500, EventNotification: &filer_pb.EventNotification{}},
+		},
+	}
+	fn := makeSubscribeMetadataFunc(option, func(resp *filer_pb.SubscribeMetadataResponse) error {
+		if filer_pb.IsEmpty(resp) {
+			markers++
+		} else {
+			events++
+		}
+		return nil
+	})
+	if err := fn(&fakeFilerClient{stream: stream}); err != nil {
+		t.Fatalf("follow: %v", err)
+	}
+	if markers != 1 || events != 1 {
+		t.Fatalf("expected 1 marker and 1 event at processEventFn, got %d and %d", markers, events)
+	}
+	if option.StartTsNs != 100 {
+		t.Fatalf("callback consumer must not mutate StartTsNs, got %d", option.StartTsNs)
+	}
+}
+
+func TestFilerSyncMarkerCallbackRetries(t *testing.T) {
+	var calls int
+	option := &MetadataFollowOption{
+		StartTsNs:      100,
+		EventErrorType: RetryForeverOnError,
+		GetResumeTsNs:  func() int64 { return 100 },
+	}
+	stream := &fakeSubscribeStream{responses: []*filer_pb.SubscribeMetadataResponse{
+		{TsNs: 500, EventNotification: &filer_pb.EventNotification{}},
+	}}
+	fn := makeSubscribeMetadataFunc(option, func(resp *filer_pb.SubscribeMetadataResponse) error {
+		calls++
+		if calls == 1 {
+			return io.ErrUnexpectedEOF
+		}
+		return nil
+	})
+	if err := fn(&fakeFilerClient{stream: stream}); err != nil {
+		t.Fatalf("follow: %v", err)
+	}
+	if calls != 2 || option.StartTsNs != 100 {
+		t.Fatalf("calls = %d, cursor = %d; want 2 calls and unchanged cursor 100", calls, option.StartTsNs)
+	}
+}
+
+// Each subscribe call re-reads the callback, so a reconnect after the consumer
+// made progress resumes from the newer watermark.
+func TestFilerSyncReconnectReadsWatermarkEachSubscribe(t *testing.T) {
+	var watermark atomic.Int64
+	watermark.Store(100)
+	var sinceNs []int64
+	var mu sync.Mutex
+	stream := &fakeSubscribeStream{
+		responses: []*filer_pb.SubscribeMetadataResponse{
+			{Directory: "/watched", TsNs: 300, EventNotification: &filer_pb.EventNotification{
+				NewEntry: &filer_pb.Entry{Name: "file"},
+			}},
+		},
+	}
+	client := &recordingFilerClient{
+		onSubscribe: func(req *filer_pb.SubscribeMetadataRequest) {
+			mu.Lock()
+			sinceNs = append(sinceNs, req.SinceNs)
+			mu.Unlock()
+		},
+		stream: stream,
+	}
+	option := &MetadataFollowOption{
+		ClientName: "syncFrom_A_To_B",
+		StartTsNs:  100,
+		GetResumeTsNs: func() int64 {
+			return watermark.Load()
+		},
+	}
+	fn := makeSubscribeMetadataFunc(option, func(resp *filer_pb.SubscribeMetadataResponse) error {
+		watermark.Store(resp.TsNs)
+		return nil
+	})
+	if err := fn(client); err != nil {
+		t.Fatalf("first subscribe: %v", err)
+	}
+	client.stream = &fakeSubscribeStream{}
+	if err := fn(client); err != nil {
+		t.Fatalf("resubscribe: %v", err)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(sinceNs) != 2 || sinceNs[0] != 100 || sinceNs[1] != 300 {
+		t.Fatalf("expected subscribes at 100 then 300, got %v", sinceNs)
+	}
+}
+
+// blockingFilerClient returns a stream whose Recv parks until the subscribe
+// context ends, standing in for a quiet source stream during a sink outage.
+type blockingFilerClient struct {
+	filer_pb.SeaweedFilerClient
+}
+
+func (c *blockingFilerClient) SubscribeMetadata(ctx context.Context, in *filer_pb.SubscribeMetadataRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[filer_pb.SubscribeMetadataResponse], error) {
+	return &blockingSubscribeStream{ctx: ctx}, nil
+}
+
+type blockingSubscribeStream struct {
+	grpc.ClientStream
+	ctx context.Context
+}
+
+func (s *blockingSubscribeStream) Recv() (*filer_pb.SubscribeMetadataResponse, error) {
+	<-s.ctx.Done()
+	return nil, s.ctx.Err()
+}
+
+// A consumer that pins an event asks for the stream to drop so the reconnect
+// replays it; the follower must end with ErrResubscribe, not sit on Recv.
+func TestFilerSyncResubscribeSignalEndsStream(t *testing.T) {
+	resubscribe := make(chan struct{})
+	option := &MetadataFollowOption{
+		ClientName:     "syncFrom_A_To_B",
+		EventErrorType: DontLogError,
+		Resubscribe:    resubscribe,
+	}
+	fn := makeSubscribeMetadataFunc(option, func(resp *filer_pb.SubscribeMetadataResponse) error {
+		return nil
+	})
+	done := make(chan error, 1)
+	go func() {
+		done <- fn(&blockingFilerClient{})
+	}()
+
+	close(resubscribe)
+
+	select {
+	case err := <-done:
+		if !errors.Is(err, ErrResubscribe) {
+			t.Fatalf("expected ErrResubscribe, got %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("follower did not end after the resubscribe signal")
+	}
+}
diff --git a/weed/pb/grpc_client_cascade_test.go b/weed/pb/grpc_client_cascade_test.go
new file mode 100644
index 0000000000..9b94d239b7
--- /dev/null
+++ b/weed/pb/grpc_client_cascade_test.go
@@ -0,0 +1,209 @@
+package pb
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+// cascadeFilerServer answers a "slow" lookup only once its caller is known to be
+// in flight, so a second caller can fail while the first still holds the shared
+// cached ClientConn.
+type cascadeFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	inFlight  chan struct{}
+	release   chan struct{}
+	closeOnce sync.Once
+}
+
+func (s *cascadeFilerServer) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if req.Name == "slow" {
+		s.closeOnce.Do(func() { close(s.inFlight) })
+		select {
+		case <-s.release:
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{}, nil
+}
+
+// startCascadeFiler serves a fake filer and resets the process-wide connection
+// cache so the test owns the shared ClientConn under exercise.
+func startCascadeFiler(t *testing.T) (*cascadeFilerServer, string, grpc.DialOption) {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	fake := &cascadeFilerServer{inFlight: make(chan struct{}), release: make(chan struct{})}
+	server := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(server, fake)
+	go server.Serve(listener)
+
+	grpcClientsLock.Lock()
+	previous := grpcClients
+	grpcClients = make(map[string]*versionedGrpcClient)
+	grpcClientsLock.Unlock()
+	t.Cleanup(func() {
+		grpcClientsLock.Lock()
+		cached := grpcClients
+		grpcClients = previous
+		grpcClientsLock.Unlock()
+		for _, connection := range cached {
+			connection.Close()
+		}
+		server.Stop()
+	})
+
+	return fake, listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials())
+}
+
+// TestWithGrpcClient_AbandonedRequestKeepsSharedConnection reproduces
+// seaweedfs#10947 end to end: an S3-style caller that hands WithGrpcClient a
+// context.Background() while its RPC rides the (now abandoned) HTTP request
+// context used to close the shared filer ClientConn, killing every concurrent
+// upload on it with "the client connection is closing".
+func TestWithGrpcClient_AbandonedRequestKeepsSharedConnection(t *testing.T) {
+	fake, address, dialOption := startCascadeFiler(t)
+
+	var concurrentErr error
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		concurrentErr = WithGrpcClient(context.Background(), false, 0, func(connection *grpc.ClientConn) error {
+			_, err := filer_pb.NewSeaweedFilerClient(connection).LookupDirectoryEntry(context.Background(),
+				&filer_pb.LookupDirectoryEntryRequest{Directory: "/buckets/b", Name: "slow"})
+			return err
+		}, address, false, dialOption)
+	}()
+	<-fake.inFlight
+
+	abandoned, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := WithGrpcClient(context.Background(), false, 0, func(connection *grpc.ClientConn) error {
+		_, err := filer_pb.NewSeaweedFilerClient(connection).LookupDirectoryEntry(abandoned,
+			&filer_pb.LookupDirectoryEntryRequest{Directory: "/buckets/b", Name: "fast"})
+		return err
+	}, address, false, dialOption); err == nil {
+		t.Fatal("the abandoned request should have failed")
+	}
+
+	close(fake.release)
+	wg.Wait()
+	if concurrentErr != nil {
+		t.Fatalf("concurrent caller must survive an unrelated abandoned request: %v", concurrentErr)
+	}
+}
+
+func (s *cascadeFilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest, stream filer_pb.SeaweedFiler_SubscribeMetadataServer) error {
+	if !req.ClientSupportsMetadataChunks {
+		return nil
+	}
+	return stream.Send(&filer_pb.SubscribeMetadataResponse{
+		LogFileRefs: []*filer_pb.LogFileChunkRef{{
+			FilerId:  "5319c0e8",
+			FileTsNs: time.Now().UnixNano(),
+			Chunks:   []*filer_pb.FileChunk{{FileId: "4471,ce598bfff8416e", Size: 64}},
+		}},
+	})
+}
+
+// TestWithGrpcClient_EndedStreamKeepsSharedConnection covers the other half of
+// seaweedfs#10947: the S3 gateway follows filer metadata on a long-lived
+// SubscribeMetadata stream and reconnects forever. Every ordinary end of that
+// stream used to drop the shared filer ClientConn the request handlers use,
+// firing the same burst of "the client connection is closing" failures.
+func TestWithGrpcClient_EndedStreamKeepsSharedConnection(t *testing.T) {
+	fake, address, dialOption := startCascadeFiler(t)
+
+	var concurrentErr error
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		concurrentErr = WithGrpcClient(context.Background(), false, 0, func(connection *grpc.ClientConn) error {
+			_, err := filer_pb.NewSeaweedFilerClient(connection).LookupDirectoryEntry(context.Background(),
+				&filer_pb.LookupDirectoryEntryRequest{Directory: "/buckets/b", Name: "slow"})
+			return err
+		}, address, false, dialOption)
+	}()
+	<-fake.inFlight
+
+	if err := WithGrpcClient(context.Background(), true, 0, func(connection *grpc.ClientConn) error {
+		stream, err := filer_pb.NewSeaweedFilerClient(connection).SubscribeMetadata(context.Background(), &filer_pb.SubscribeMetadataRequest{})
+		if err != nil {
+			return err
+		}
+		_, err = stream.Recv()
+		return err
+	}, address, false, dialOption); err == nil {
+		t.Fatal("the ended stream should have reported io.EOF")
+	}
+
+	close(fake.release)
+	wg.Wait()
+	if concurrentErr != nil {
+		t.Fatalf("concurrent caller must survive an unrelated stream ending: %v", concurrentErr)
+	}
+}
+
+// TestWithGrpcClient_LogChunkReadFailureKeepsSharedConnection covers a
+// subscriber replaying persisted log chunks over HTTP: an unreachable volume
+// server reports "connection refused" as the subscription's error, which used
+// to drop the shared filer ClientConn and cancel the assign and upload RPCs
+// riding on it.
+func TestWithGrpcClient_LogChunkReadFailureKeepsSharedConnection(t *testing.T) {
+	fake, address, dialOption := startCascadeFiler(t)
+
+	var concurrentErr error
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		concurrentErr = WithGrpcClient(context.Background(), false, 0, func(connection *grpc.ClientConn) error {
+			_, err := filer_pb.NewSeaweedFilerClient(connection).LookupDirectoryEntry(context.Background(),
+				&filer_pb.LookupDirectoryEntryRequest{Directory: "/buckets/b", Name: "slow"})
+			return err
+		}, address, false, dialOption)
+	}()
+	<-fake.inFlight
+
+	option := &MetadataFollowOption{
+		ClientName:     "mount",
+		PathPrefix:     "/",
+		EventErrorType: DontLogError,
+		LogFileReaderFn: func(chunks []*filer_pb.FileChunk) (io.ReadCloser, error) {
+			// An unreachable volume server, as a filerProxy mount sees it.
+			response, err := http.Get("http://127.0.0.1:1/" + chunks[0].FileId)
+			if err != nil {
+				return nil, err
+			}
+			return response.Body, nil
+		},
+	}
+	subscribe := makeSubscribeMetadataFunc(option, func(resp *filer_pb.SubscribeMetadataResponse) error { return nil })
+	err := WithGrpcClient(context.Background(), true, 0, func(connection *grpc.ClientConn) error {
+		return subscribe(filer_pb.NewSeaweedFilerClient(connection))
+	}, address, false, dialOption)
+	if err == nil || !errors.Is(err, ErrLogFileRead) {
+		t.Fatalf("the replay should have failed reading the log chunk: %v", err)
+	}
+
+	close(fake.release)
+	wg.Wait()
+	if concurrentErr != nil {
+		t.Fatalf("concurrent caller must survive a log chunk read failure: %v", concurrentErr)
+	}
+}
diff --git a/weed/pb/grpc_client_server.go b/weed/pb/grpc_client_server.go
index f1c5bbcc9a..2a119c075e 100644
--- a/weed/pb/grpc_client_server.go
+++ b/weed/pb/grpc_client_server.go
@@ -140,6 +140,22 @@ func resolveLocalGrpcSocket(address string) string {
 	return localGrpcSockets[port]
 }
 
+// ListenOnLocalSocket binds a unix socket listener for a local fast path
+// next to the TCP listener. A stale socket file is removed first; a path
+// that cannot be cleared or bound is skipped, since the socket is optional.
+func ListenOnLocalSocket(socketPath string) net.Listener {
+	if err := os.Remove(socketPath); err != nil && !os.IsNotExist(err) {
+		glog.Warningf("Failed to remove old socket %s: %v", socketPath, err)
+	}
+	lc := net.ListenConfig{Control: setLocalSocketBuffers}
+	listener, err := lc.Listen(context.Background(), "unix", socketPath)
+	if err != nil {
+		glog.Errorf("Failed to listen on Unix socket %s: %v", socketPath, err)
+		return nil
+	}
+	return listener
+}
+
 // ServeGrpcOnLocalSocket starts serving a gRPC server on a Unix socket
 // if one is registered for the given port.
 func ServeGrpcOnLocalSocket(grpcServer *grpc.Server, grpcPort int) {
@@ -147,14 +163,11 @@ func ServeGrpcOnLocalSocket(grpcServer *grpc.Server, grpcPort int) {
 	if socketPath == "" {
 		return
 	}
-	if err := os.Remove(socketPath); err != nil && !os.IsNotExist(err) {
-		glog.Warningf("Failed to remove old gRPC socket %s: %v", socketPath, err)
-	}
-	listener, err := net.Listen("unix", socketPath)
-	if err != nil {
-		glog.Errorf("Failed to listen on gRPC Unix socket %s: %v", socketPath, err)
+	listener := ListenOnLocalSocket(socketPath)
+	if listener == nil {
 		return
 	}
+	listener = &localSocketListener{Listener: listener}
 	glog.V(0).Infof("gRPC also listening on Unix socket %s", socketPath)
 	go func() {
 		if err := grpcServer.Serve(listener); err != nil && err != grpc.ErrServerStopped {
@@ -164,6 +177,20 @@ func ServeGrpcOnLocalSocket(grpcServer *grpc.Server, grpcPort int) {
 	}()
 }
 
+// localSocketListener re-applies the buffer sizes to every accepted connection.
+type localSocketListener struct {
+	net.Listener
+}
+
+func (l *localSocketListener) Accept() (net.Conn, error) {
+	c, err := l.Listener.Accept()
+	if err != nil {
+		return nil, err
+	}
+	applyLocalSocketBuffers(c)
+	return c, nil
+}
+
 func NewGrpcServer(opts ...grpc.ServerOption) *grpc.Server {
 	var options []grpc.ServerOption
 	options = append(options,
@@ -209,7 +236,7 @@ func GrpcDial(ctx context.Context, address string, waitForReady bool, opts ...gr
 	// Route through Unix socket if one is registered for this address's port
 	if socketPath := resolveLocalGrpcSocket(address); socketPath != "" {
 		options = append(options, grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
-			var d net.Dialer
+			d := net.Dialer{Control: setLocalSocketBuffers}
 			return d.DialContext(ctx, "unix", socketPath)
 		}))
 	} else {
@@ -370,9 +397,9 @@ func isClientSideMarshalError(err error) bool {
 }
 
 // shouldInvalidateConnection checks if an error indicates the cached connection
-// should be invalidated. ctx is the caller's per-request context (nil is treated
-// as a live context); it disambiguates a genuinely broken channel from the
-// caller cancelling or timing out its own request.
+// should be invalidated. ctx must be the context that bounds this RPC attempt; it
+// disambiguates a genuinely broken channel from the RPC hitting its own deadline
+// or cancellation. A nil or non-cancellable ctx carries no such evidence.
 func shouldInvalidateConnection(ctx context.Context, err error) bool {
 	if err == nil {
 		return false
@@ -385,6 +412,23 @@ func shouldInvalidateConnection(ctx context.Context, err error) bool {
 		return false
 	}
 
+	// A metadata subscriber reads log chunks over HTTP from volume servers and
+	// returns what went wrong there through the stream. Those failures read like
+	// transport failures below, and would drop a filer channel that is fine.
+	if errors.Is(err, ErrLogFileRead) {
+		return false
+	}
+
+	// gRPC raises this locally, before the RPC reaches the wire, when this
+	// process already closed the ClientConn. The caller is a bystander of
+	// someone else's teardown, and knows nothing about the peer. Its message
+	// is the only thing separating it from any other Canceled, so the plain
+	// codes.Canceled its deprecation notice recommends cannot stand in: that
+	// is the very code this function has to keep telling apart below.
+	if errors.Is(err, grpc.ErrClientConnClosing) {
+		return false
+	}
+
 	// Check gRPC status codes first (more reliable)
 	if s, ok := status.FromError(err); ok {
 		code := s.Code()
@@ -399,16 +443,15 @@ func shouldInvalidateConnection(ctx context.Context, err error) bool {
 			// the caller retry.
 			return false
 		case codes.Canceled, codes.DeadlineExceeded:
-			// Ambiguous: this fires both when a stale cached channel rejects
-			// RPCs (e.g. a peer restart behind a k8s Service VIP), where we must
-			// invalidate, and when the caller's own context expired, where the
-			// shared channel is fine. Tearing the channel down for the latter
-			// cancels every other in-flight RPC on it with "the client
-			// connection is closing", a cascade that turns one slow request into
-			// a flood of failures across all concurrent callers. Only invalidate
-			// while the caller's context is still live, isolating the genuine
-			// stale-channel signal.
-			return ctx == nil || ctx.Err() == nil
+			// Ambiguous: a stale cached channel rejects RPCs this way (a peer
+			// restart behind a k8s Service VIP), and so does the RPC's own context
+			// expiring. Tearing the channel down for the latter cancels every other
+			// in-flight RPC on it with "the client connection is closing", turning
+			// one abandoned request into a flood of failures. Only a cancellable
+			// context bounds an RPC attempt and can tell the two apart:
+			// Background/TODO never expires, so its Err() would answer
+			// "stale channel" for every caller with no deadline to honor.
+			return ctx != nil && ctx.Done() != nil && ctx.Err() == nil
 		}
 	}
 
@@ -425,10 +468,11 @@ func shouldInvalidateConnection(ctx context.Context, err error) bool {
 }
 
 // WithGrpcClient In streamingMode, always use a fresh connection. Otherwise, try to reuse an existing connection.
-// ctx is the caller's per-request context: a Canceled/DeadlineExceeded that fires
-// because ctx itself expired will not tear down the shared cached ClientConn out
-// from under other concurrent callers. Pass context.Background() when there is no
-// per-request deadline to honor.
+// ctx must be the context that bounds the RPC fn issues, so that a
+// Canceled/DeadlineExceeded fired by ctx itself does not tear down the shared
+// cached ClientConn out from under other concurrent callers. Pass
+// context.Background() when fn picks its own context: a Canceled/DeadlineExceeded
+// then never invalidates, since nothing here can attribute it to the channel.
 func WithGrpcClient(ctx context.Context, streamingMode bool, signature int32, fn func(*grpc.ClientConn) error, address string, waitForReady bool, opts ...grpc.DialOption) error {
 
 	if !streamingMode {
@@ -465,14 +509,15 @@ func WithGrpcClient(ctx context.Context, streamingMode bool, signature int32, fn
 	}
 	defer grpcConnection.Close()
 	executionErr := fn(grpcConnection)
-	if executionErr != nil {
+	if executionErr != nil && shouldInvalidateConnection(ctx, executionErr) {
 		// The streaming channel is dedicated to this caller, but unrelated
 		// request-path callers share a cached non-streaming ClientConn to the
-		// same peer. When the stream fails, drop that cached channel so the
-		// next caller dials fresh: this recovers cases where a stable L4
-		// endpoint (k8s Service VIP, external LB) hides a peer restart from
-		// the transport layer, leaving the cached ClientConn healthy-looking
-		// but silently cancelling RPCs.
+		// same peer. When the stream dies of a peer that went away, drop that
+		// cached channel so the next caller dials fresh: this recovers cases
+		// where a stable L4 endpoint (k8s Service VIP, external LB) hides a
+		// peer restart from the transport layer, leaving the cached ClientConn
+		// healthy-looking but silently cancelling RPCs. A stream that merely
+		// ended, or that its own caller gave up on, says nothing about the peer.
 		InvalidateGrpcConnection(address)
 	}
 	return executionErr
@@ -517,7 +562,8 @@ func ServerToGrpcAddress(server string) (serverGrpcAddress string) {
 
 	host, port, parseErr := hostAndPort(server)
 	if parseErr != nil {
-		glog.Fatalf("server address %s parse error: %v", server, parseErr)
+		glog.Errorf("server address %s parse error: %v", server, parseErr)
+		return server
 	}
 
 	grpcPort := int(port) + 10000
@@ -528,7 +574,8 @@ func ServerToGrpcAddress(server string) (serverGrpcAddress string) {
 func GrpcAddressToServerAddress(grpcAddress string) (serverAddress string) {
 	host, grpcPort, parseErr := hostAndPort(grpcAddress)
 	if parseErr != nil {
-		glog.Fatalf("server grpc address %s parse error: %v", grpcAddress, parseErr)
+		glog.Errorf("server grpc address %s parse error: %v", grpcAddress, parseErr)
+		return ""
 	}
 
 	port := int(grpcPort) - 10000
@@ -536,10 +583,10 @@ func GrpcAddressToServerAddress(grpcAddress string) (serverAddress string) {
 	return util.JoinHostPort(host, port)
 }
 
-// WithMasterClient threads the caller's per-request context into the
+// WithMasterClient threads the context bounding this RPC attempt into the
 // connection-invalidation decision, so a Canceled/DeadlineExceeded from the
-// caller's own timeout does not invalidate the shared cached master connection.
-// Pass context.Background() when there is no per-request deadline to honor.
+// attempt's own timeout does not invalidate the shared cached master connection.
+// Pass context.Background() when fn picks its own context.
 func WithMasterClient(ctx context.Context, streamingMode bool, master ServerAddress, grpcDialOption grpc.DialOption, waitForReady bool, fn func(client master_pb.SeaweedClient) error) error {
 	return WithGrpcClient(ctx, streamingMode, 0, func(grpcConnection *grpc.ClientConn) error {
 		client := master_pb.NewSeaweedClient(grpcConnection)
diff --git a/weed/pb/grpc_client_server_test.go b/weed/pb/grpc_client_server_test.go
index 89b6d6ea5d..a544392c86 100644
--- a/weed/pb/grpc_client_server_test.go
+++ b/weed/pb/grpc_client_server_test.go
@@ -6,6 +6,7 @@ import (
 	"runtime"
 	"testing"
 
+	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -49,19 +50,50 @@ func TestShouldInvalidateConnection_CallerContextExpiryIsPerRequest(t *testing.T
 }
 
 // TestShouldInvalidateConnection_StaleChannelStillInvalidates ensures the
-// carve-out above is gated on the caller's context: a Canceled/DeadlineExceeded
-// while the context is still live is the genuine stale-channel signal (e.g. a
+// carve-out above is gated on the RPC's context: a Canceled/DeadlineExceeded
+// while that context is still live is the genuine stale-channel signal (e.g. a
 // peer restart behind a k8s Service VIP) and must still invalidate so the next
 // attempt dials fresh.
 func TestShouldInvalidateConnection_StaleChannelStillInvalidates(t *testing.T) {
+	live, cancel := context.WithCancel(context.Background())
+	defer cancel()
 	for _, code := range []codes.Code{codes.Canceled, codes.DeadlineExceeded} {
-		err := status.Error(code, "the client connection is closing")
-		if !shouldInvalidateConnection(context.Background(), err) {
-			t.Fatalf("%v with a live caller context must still invalidate the connection", code)
+		err := status.Error(code, "stale channel")
+		if !shouldInvalidateConnection(live, err) {
+			t.Fatalf("%v with a live attempt context must still invalidate the connection", code)
 		}
-		// nil context is treated as live for the context-free WithGrpcClient path.
-		if !shouldInvalidateConnection(nil, err) {
-			t.Fatalf("%v with a nil caller context must still invalidate the connection", code)
+	}
+}
+
+// TestShouldInvalidateConnection_NonCancellableContextIsNoEvidence covers
+// seaweedfs#10947. Background/TODO never expires, so Err() stays nil forever and
+// the guard above answered "stale channel" for every caller that has no deadline
+// to honor — which is almost all of them, the S3 gateway included. One client
+// abandoning a request then closed the shared filer channel and every concurrent
+// multipart part died with "the client connection is closing".
+func TestShouldInvalidateConnection_NonCancellableContextIsNoEvidence(t *testing.T) {
+	for _, ctx := range []context.Context{context.Background(), context.TODO(), nil} {
+		for _, code := range []codes.Code{codes.Canceled, codes.DeadlineExceeded} {
+			err := status.Error(code, "context canceled")
+			if shouldInvalidateConnection(ctx, err) {
+				t.Fatalf("%v must not invalidate the shared connection on a non-cancellable context", code)
+			}
+		}
+	}
+}
+
+// TestShouldInvalidateConnection_ClientConnClosingIsNotStale ensures a caller
+// whose RPC was rejected because this process is already closing the shared
+// ClientConn does not close it again. gRPC raises ErrClientConnClosing locally,
+// so it is only ever the footprint of another goroutine's teardown - reading it
+// as a stale-channel signal lets one teardown re-arm itself across the herd of
+// callers it just cancelled.
+func TestShouldInvalidateConnection_ClientConnClosingIsNotStale(t *testing.T) {
+	live, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	for _, err := range []error{grpc.ErrClientConnClosing, fmt.Errorf("assign volume: %w", grpc.ErrClientConnClosing)} {
+		if shouldInvalidateConnection(live, err) {
+			t.Fatalf("%v must not invalidate the shared connection", err)
 		}
 	}
 }
diff --git a/weed/pb/iam.proto b/weed/pb/iam.proto
index 45a08d8f39..89c9002dff 100644
--- a/weed/pb/iam.proto
+++ b/weed/pb/iam.proto
@@ -38,6 +38,20 @@ service SeaweedIdentityAccessManagement {
     rpc GetServiceAccount (GetServiceAccountRequest) returns (GetServiceAccountResponse);
     rpc ListServiceAccounts (ListServiceAccountsRequest) returns (ListServiceAccountsResponse);
     rpc GetServiceAccountByAccessKey (GetServiceAccountByAccessKeyRequest) returns (GetServiceAccountByAccessKeyResponse);
+
+    // OIDC Provider Management. Writes the records the S3 servers' STS trusts
+    // when they run with "oidcProviderStore": {"storeType": "filer"}.
+    rpc PutOIDCProvider (PutOIDCProviderRequest) returns (PutOIDCProviderResponse);
+    rpc GetOIDCProvider (GetOIDCProviderRequest) returns (GetOIDCProviderResponse);
+    rpc DeleteOIDCProvider (DeleteOIDCProviderRequest) returns (DeleteOIDCProviderResponse);
+    rpc ListOIDCProviders (ListOIDCProvidersRequest) returns (ListOIDCProvidersResponse);
+
+    // Role Management. Writes the roles the S3 servers' STS assumes when they
+    // run with "roleStore": {"storeType": "filer"}.
+    rpc PutRole (PutRoleRequest) returns (PutRoleResponse);
+    rpc GetRole (GetRoleRequest) returns (GetRoleResponse);
+    rpc DeleteRole (DeleteRoleRequest) returns (DeleteRoleResponse);
+    rpc ListRoles (ListRolesRequest) returns (ListRolesResponse);
 }
 
 //////////////////////////////////////////////////
@@ -306,6 +320,99 @@ message GetServiceAccountByAccessKeyResponse {
 }
 
 
+//////////////////////////////////////////////////
+// OIDC Provider Messages
+
+message OIDCProvider {
+    string issuer_url = 1;
+    repeated string client_ids = 2;
+    repeated string thumbprints = 3;
+    // account_id scopes the provider; empty means global. The ARN is derived
+    // from it and the issuer URL.
+    string account_id = 4;
+    string arn = 5; // output only
+}
+
+// PutOIDCProviderRequest creates the provider, or replaces the client IDs and
+// thumbprints of an existing one.
+message PutOIDCProviderRequest {
+    string issuer_url = 1;
+    repeated string client_ids = 2;
+    repeated string thumbprints = 3;
+    string account_id = 4;
+}
+
+message PutOIDCProviderResponse {
+    string arn = 1;
+}
+
+message GetOIDCProviderRequest {
+    string issuer_url = 1;
+    string account_id = 2;
+}
+
+message GetOIDCProviderResponse {
+    OIDCProvider provider = 1;
+}
+
+message DeleteOIDCProviderRequest {
+    string issuer_url = 1;
+    string account_id = 2;
+}
+
+message DeleteOIDCProviderResponse {
+}
+
+message ListOIDCProvidersRequest {
+}
+
+message ListOIDCProvidersResponse {
+    repeated OIDCProvider providers = 1;
+}
+
+//////////////////////////////////////////////////
+// Role Messages
+
+message Role {
+    string role_name = 1;
+    string role_arn = 2; // defaults to arn:aws:iam::role/<role_name>
+    string trust_policy = 3; // JSON trust policy document
+    repeated string attached_policies = 4; // managed policy names
+    string description = 5;
+    int64 max_session_duration = 6; // seconds; 0 uses the STS default
+}
+
+// PutRoleRequest creates the role or replaces it.
+message PutRoleRequest {
+    Role role = 1;
+}
+
+message PutRoleResponse {
+    string role_arn = 1;
+}
+
+message GetRoleRequest {
+    string role_name = 1;
+}
+
+message GetRoleResponse {
+    Role role = 1;
+}
+
+message DeleteRoleRequest {
+    string role_name = 1;
+}
+
+message DeleteRoleResponse {
+}
+
+message ListRolesRequest {
+}
+
+message ListRolesResponse {
+    repeated Role roles = 1;
+}
+
 //////////////////////////////////////////////////
 // S3 IAM Cache Management
 // Designed for unidirectional propagation from Filer to S3 Servers
diff --git a/weed/pb/iam_pb/iam.pb.go b/weed/pb/iam_pb/iam.pb.go
index 22e0c5dc30..2c43bf8807 100644
--- a/weed/pb/iam_pb/iam.pb.go
+++ b/weed/pb/iam_pb/iam.pb.go
@@ -2680,6 +2680,883 @@ func (x *GetServiceAccountByAccessKeyResponse) GetServiceAccount() *ServiceAccou
 	return nil
 }
 
+type OIDCProvider struct {
+	state       protoimpl.MessageState `protogen:"open.v1"`
+	IssuerUrl   string                 `protobuf:"bytes,1,opt,name=issuer_url,json=issuerUrl,proto3" json:"issuer_url,omitempty"`
+	ClientIds   []string               `protobuf:"bytes,2,rep,name=client_ids,json=clientIds,proto3" json:"client_ids,omitempty"`
+	Thumbprints []string               `protobuf:"bytes,3,rep,name=thumbprints,proto3" json:"thumbprints,omitempty"`
+	// account_id scopes the provider; empty means global. The ARN is derived
+	// from it and the issuer URL.
+	AccountId     string `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	Arn           string `protobuf:"bytes,5,opt,name=arn,proto3" json:"arn,omitempty"` // output only
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *OIDCProvider) Reset() {
+	*x = OIDCProvider{}
+	mi := &file_iam_proto_msgTypes[56]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *OIDCProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OIDCProvider) ProtoMessage() {}
+
+func (x *OIDCProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[56]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OIDCProvider.ProtoReflect.Descriptor instead.
+func (*OIDCProvider) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{56}
+}
+
+func (x *OIDCProvider) GetIssuerUrl() string {
+	if x != nil {
+		return x.IssuerUrl
+	}
+	return ""
+}
+
+func (x *OIDCProvider) GetClientIds() []string {
+	if x != nil {
+		return x.ClientIds
+	}
+	return nil
+}
+
+func (x *OIDCProvider) GetThumbprints() []string {
+	if x != nil {
+		return x.Thumbprints
+	}
+	return nil
+}
+
+func (x *OIDCProvider) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+func (x *OIDCProvider) GetArn() string {
+	if x != nil {
+		return x.Arn
+	}
+	return ""
+}
+
+// PutOIDCProviderRequest creates the provider, or replaces the client IDs and
+// thumbprints of an existing one.
+type PutOIDCProviderRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	IssuerUrl     string                 `protobuf:"bytes,1,opt,name=issuer_url,json=issuerUrl,proto3" json:"issuer_url,omitempty"`
+	ClientIds     []string               `protobuf:"bytes,2,rep,name=client_ids,json=clientIds,proto3" json:"client_ids,omitempty"`
+	Thumbprints   []string               `protobuf:"bytes,3,rep,name=thumbprints,proto3" json:"thumbprints,omitempty"`
+	AccountId     string                 `protobuf:"bytes,4,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PutOIDCProviderRequest) Reset() {
+	*x = PutOIDCProviderRequest{}
+	mi := &file_iam_proto_msgTypes[57]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PutOIDCProviderRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PutOIDCProviderRequest) ProtoMessage() {}
+
+func (x *PutOIDCProviderRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[57]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PutOIDCProviderRequest.ProtoReflect.Descriptor instead.
+func (*PutOIDCProviderRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{57}
+}
+
+func (x *PutOIDCProviderRequest) GetIssuerUrl() string {
+	if x != nil {
+		return x.IssuerUrl
+	}
+	return ""
+}
+
+func (x *PutOIDCProviderRequest) GetClientIds() []string {
+	if x != nil {
+		return x.ClientIds
+	}
+	return nil
+}
+
+func (x *PutOIDCProviderRequest) GetThumbprints() []string {
+	if x != nil {
+		return x.Thumbprints
+	}
+	return nil
+}
+
+func (x *PutOIDCProviderRequest) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+type PutOIDCProviderResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Arn           string                 `protobuf:"bytes,1,opt,name=arn,proto3" json:"arn,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PutOIDCProviderResponse) Reset() {
+	*x = PutOIDCProviderResponse{}
+	mi := &file_iam_proto_msgTypes[58]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PutOIDCProviderResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PutOIDCProviderResponse) ProtoMessage() {}
+
+func (x *PutOIDCProviderResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[58]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PutOIDCProviderResponse.ProtoReflect.Descriptor instead.
+func (*PutOIDCProviderResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{58}
+}
+
+func (x *PutOIDCProviderResponse) GetArn() string {
+	if x != nil {
+		return x.Arn
+	}
+	return ""
+}
+
+type GetOIDCProviderRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	IssuerUrl     string                 `protobuf:"bytes,1,opt,name=issuer_url,json=issuerUrl,proto3" json:"issuer_url,omitempty"`
+	AccountId     string                 `protobuf:"bytes,2,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetOIDCProviderRequest) Reset() {
+	*x = GetOIDCProviderRequest{}
+	mi := &file_iam_proto_msgTypes[59]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetOIDCProviderRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetOIDCProviderRequest) ProtoMessage() {}
+
+func (x *GetOIDCProviderRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[59]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetOIDCProviderRequest.ProtoReflect.Descriptor instead.
+func (*GetOIDCProviderRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{59}
+}
+
+func (x *GetOIDCProviderRequest) GetIssuerUrl() string {
+	if x != nil {
+		return x.IssuerUrl
+	}
+	return ""
+}
+
+func (x *GetOIDCProviderRequest) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+type GetOIDCProviderResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Provider      *OIDCProvider          `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetOIDCProviderResponse) Reset() {
+	*x = GetOIDCProviderResponse{}
+	mi := &file_iam_proto_msgTypes[60]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetOIDCProviderResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetOIDCProviderResponse) ProtoMessage() {}
+
+func (x *GetOIDCProviderResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[60]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetOIDCProviderResponse.ProtoReflect.Descriptor instead.
+func (*GetOIDCProviderResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{60}
+}
+
+func (x *GetOIDCProviderResponse) GetProvider() *OIDCProvider {
+	if x != nil {
+		return x.Provider
+	}
+	return nil
+}
+
+type DeleteOIDCProviderRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	IssuerUrl     string                 `protobuf:"bytes,1,opt,name=issuer_url,json=issuerUrl,proto3" json:"issuer_url,omitempty"`
+	AccountId     string                 `protobuf:"bytes,2,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteOIDCProviderRequest) Reset() {
+	*x = DeleteOIDCProviderRequest{}
+	mi := &file_iam_proto_msgTypes[61]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteOIDCProviderRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteOIDCProviderRequest) ProtoMessage() {}
+
+func (x *DeleteOIDCProviderRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[61]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteOIDCProviderRequest.ProtoReflect.Descriptor instead.
+func (*DeleteOIDCProviderRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *DeleteOIDCProviderRequest) GetIssuerUrl() string {
+	if x != nil {
+		return x.IssuerUrl
+	}
+	return ""
+}
+
+func (x *DeleteOIDCProviderRequest) GetAccountId() string {
+	if x != nil {
+		return x.AccountId
+	}
+	return ""
+}
+
+type DeleteOIDCProviderResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteOIDCProviderResponse) Reset() {
+	*x = DeleteOIDCProviderResponse{}
+	mi := &file_iam_proto_msgTypes[62]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteOIDCProviderResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteOIDCProviderResponse) ProtoMessage() {}
+
+func (x *DeleteOIDCProviderResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[62]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteOIDCProviderResponse.ProtoReflect.Descriptor instead.
+func (*DeleteOIDCProviderResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{62}
+}
+
+type ListOIDCProvidersRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListOIDCProvidersRequest) Reset() {
+	*x = ListOIDCProvidersRequest{}
+	mi := &file_iam_proto_msgTypes[63]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListOIDCProvidersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListOIDCProvidersRequest) ProtoMessage() {}
+
+func (x *ListOIDCProvidersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[63]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListOIDCProvidersRequest.ProtoReflect.Descriptor instead.
+func (*ListOIDCProvidersRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{63}
+}
+
+type ListOIDCProvidersResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Providers     []*OIDCProvider        `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListOIDCProvidersResponse) Reset() {
+	*x = ListOIDCProvidersResponse{}
+	mi := &file_iam_proto_msgTypes[64]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListOIDCProvidersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListOIDCProvidersResponse) ProtoMessage() {}
+
+func (x *ListOIDCProvidersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[64]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListOIDCProvidersResponse.ProtoReflect.Descriptor instead.
+func (*ListOIDCProvidersResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{64}
+}
+
+func (x *ListOIDCProvidersResponse) GetProviders() []*OIDCProvider {
+	if x != nil {
+		return x.Providers
+	}
+	return nil
+}
+
+type Role struct {
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	RoleName           string                 `protobuf:"bytes,1,opt,name=role_name,json=roleName,proto3" json:"role_name,omitempty"`
+	RoleArn            string                 `protobuf:"bytes,2,opt,name=role_arn,json=roleArn,proto3" json:"role_arn,omitempty"`                            // defaults to arn:aws:iam::role/<role_name>
+	TrustPolicy        string                 `protobuf:"bytes,3,opt,name=trust_policy,json=trustPolicy,proto3" json:"trust_policy,omitempty"`                // JSON trust policy document
+	AttachedPolicies   []string               `protobuf:"bytes,4,rep,name=attached_policies,json=attachedPolicies,proto3" json:"attached_policies,omitempty"` // managed policy names
+	Description        string                 `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
+	MaxSessionDuration int64                  `protobuf:"varint,6,opt,name=max_session_duration,json=maxSessionDuration,proto3" json:"max_session_duration,omitempty"` // seconds; 0 uses the STS default
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *Role) Reset() {
+	*x = Role{}
+	mi := &file_iam_proto_msgTypes[65]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Role) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Role) ProtoMessage() {}
+
+func (x *Role) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[65]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Role.ProtoReflect.Descriptor instead.
+func (*Role) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{65}
+}
+
+func (x *Role) GetRoleName() string {
+	if x != nil {
+		return x.RoleName
+	}
+	return ""
+}
+
+func (x *Role) GetRoleArn() string {
+	if x != nil {
+		return x.RoleArn
+	}
+	return ""
+}
+
+func (x *Role) GetTrustPolicy() string {
+	if x != nil {
+		return x.TrustPolicy
+	}
+	return ""
+}
+
+func (x *Role) GetAttachedPolicies() []string {
+	if x != nil {
+		return x.AttachedPolicies
+	}
+	return nil
+}
+
+func (x *Role) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *Role) GetMaxSessionDuration() int64 {
+	if x != nil {
+		return x.MaxSessionDuration
+	}
+	return 0
+}
+
+// PutRoleRequest creates the role or replaces it.
+type PutRoleRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Role          *Role                  `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PutRoleRequest) Reset() {
+	*x = PutRoleRequest{}
+	mi := &file_iam_proto_msgTypes[66]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PutRoleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PutRoleRequest) ProtoMessage() {}
+
+func (x *PutRoleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[66]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PutRoleRequest.ProtoReflect.Descriptor instead.
+func (*PutRoleRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{66}
+}
+
+func (x *PutRoleRequest) GetRole() *Role {
+	if x != nil {
+		return x.Role
+	}
+	return nil
+}
+
+type PutRoleResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RoleArn       string                 `protobuf:"bytes,1,opt,name=role_arn,json=roleArn,proto3" json:"role_arn,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PutRoleResponse) Reset() {
+	*x = PutRoleResponse{}
+	mi := &file_iam_proto_msgTypes[67]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PutRoleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PutRoleResponse) ProtoMessage() {}
+
+func (x *PutRoleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[67]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PutRoleResponse.ProtoReflect.Descriptor instead.
+func (*PutRoleResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{67}
+}
+
+func (x *PutRoleResponse) GetRoleArn() string {
+	if x != nil {
+		return x.RoleArn
+	}
+	return ""
+}
+
+type GetRoleRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RoleName      string                 `protobuf:"bytes,1,opt,name=role_name,json=roleName,proto3" json:"role_name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRoleRequest) Reset() {
+	*x = GetRoleRequest{}
+	mi := &file_iam_proto_msgTypes[68]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRoleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRoleRequest) ProtoMessage() {}
+
+func (x *GetRoleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[68]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRoleRequest.ProtoReflect.Descriptor instead.
+func (*GetRoleRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{68}
+}
+
+func (x *GetRoleRequest) GetRoleName() string {
+	if x != nil {
+		return x.RoleName
+	}
+	return ""
+}
+
+type GetRoleResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Role          *Role                  `protobuf:"bytes,1,opt,name=role,proto3" json:"role,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetRoleResponse) Reset() {
+	*x = GetRoleResponse{}
+	mi := &file_iam_proto_msgTypes[69]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetRoleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRoleResponse) ProtoMessage() {}
+
+func (x *GetRoleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[69]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRoleResponse.ProtoReflect.Descriptor instead.
+func (*GetRoleResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{69}
+}
+
+func (x *GetRoleResponse) GetRole() *Role {
+	if x != nil {
+		return x.Role
+	}
+	return nil
+}
+
+type DeleteRoleRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RoleName      string                 `protobuf:"bytes,1,opt,name=role_name,json=roleName,proto3" json:"role_name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRoleRequest) Reset() {
+	*x = DeleteRoleRequest{}
+	mi := &file_iam_proto_msgTypes[70]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRoleRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRoleRequest) ProtoMessage() {}
+
+func (x *DeleteRoleRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[70]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRoleRequest.ProtoReflect.Descriptor instead.
+func (*DeleteRoleRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{70}
+}
+
+func (x *DeleteRoleRequest) GetRoleName() string {
+	if x != nil {
+		return x.RoleName
+	}
+	return ""
+}
+
+type DeleteRoleResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DeleteRoleResponse) Reset() {
+	*x = DeleteRoleResponse{}
+	mi := &file_iam_proto_msgTypes[71]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DeleteRoleResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRoleResponse) ProtoMessage() {}
+
+func (x *DeleteRoleResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[71]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRoleResponse.ProtoReflect.Descriptor instead.
+func (*DeleteRoleResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{71}
+}
+
+type ListRolesRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRolesRequest) Reset() {
+	*x = ListRolesRequest{}
+	mi := &file_iam_proto_msgTypes[72]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRolesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRolesRequest) ProtoMessage() {}
+
+func (x *ListRolesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[72]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRolesRequest.ProtoReflect.Descriptor instead.
+func (*ListRolesRequest) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{72}
+}
+
+type ListRolesResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Roles         []*Role                `protobuf:"bytes,1,rep,name=roles,proto3" json:"roles,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListRolesResponse) Reset() {
+	*x = ListRolesResponse{}
+	mi := &file_iam_proto_msgTypes[73]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListRolesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRolesResponse) ProtoMessage() {}
+
+func (x *ListRolesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_iam_proto_msgTypes[73]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRolesResponse.ProtoReflect.Descriptor instead.
+func (*ListRolesResponse) Descriptor() ([]byte, []int) {
+	return file_iam_proto_rawDescGZIP(), []int{73}
+}
+
+func (x *ListRolesResponse) GetRoles() []*Role {
+	if x != nil {
+		return x.Roles
+	}
+	return nil
+}
+
 type PutIdentityRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Identity      *Identity              `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
@@ -2689,7 +3566,7 @@ type PutIdentityRequest struct {
 
 func (x *PutIdentityRequest) Reset() {
 	*x = PutIdentityRequest{}
-	mi := &file_iam_proto_msgTypes[56]
+	mi := &file_iam_proto_msgTypes[74]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2701,7 +3578,7 @@ func (x *PutIdentityRequest) String() string {
 func (*PutIdentityRequest) ProtoMessage() {}
 
 func (x *PutIdentityRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[56]
+	mi := &file_iam_proto_msgTypes[74]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2714,7 +3591,7 @@ func (x *PutIdentityRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PutIdentityRequest.ProtoReflect.Descriptor instead.
 func (*PutIdentityRequest) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{56}
+	return file_iam_proto_rawDescGZIP(), []int{74}
 }
 
 func (x *PutIdentityRequest) GetIdentity() *Identity {
@@ -2732,7 +3609,7 @@ type PutIdentityResponse struct {
 
 func (x *PutIdentityResponse) Reset() {
 	*x = PutIdentityResponse{}
-	mi := &file_iam_proto_msgTypes[57]
+	mi := &file_iam_proto_msgTypes[75]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2744,7 +3621,7 @@ func (x *PutIdentityResponse) String() string {
 func (*PutIdentityResponse) ProtoMessage() {}
 
 func (x *PutIdentityResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[57]
+	mi := &file_iam_proto_msgTypes[75]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2757,7 +3634,7 @@ func (x *PutIdentityResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PutIdentityResponse.ProtoReflect.Descriptor instead.
 func (*PutIdentityResponse) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{57}
+	return file_iam_proto_rawDescGZIP(), []int{75}
 }
 
 type RemoveIdentityRequest struct {
@@ -2769,7 +3646,7 @@ type RemoveIdentityRequest struct {
 
 func (x *RemoveIdentityRequest) Reset() {
 	*x = RemoveIdentityRequest{}
-	mi := &file_iam_proto_msgTypes[58]
+	mi := &file_iam_proto_msgTypes[76]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2781,7 +3658,7 @@ func (x *RemoveIdentityRequest) String() string {
 func (*RemoveIdentityRequest) ProtoMessage() {}
 
 func (x *RemoveIdentityRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[58]
+	mi := &file_iam_proto_msgTypes[76]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2794,7 +3671,7 @@ func (x *RemoveIdentityRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveIdentityRequest.ProtoReflect.Descriptor instead.
 func (*RemoveIdentityRequest) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{58}
+	return file_iam_proto_rawDescGZIP(), []int{76}
 }
 
 func (x *RemoveIdentityRequest) GetUsername() string {
@@ -2812,7 +3689,7 @@ type RemoveIdentityResponse struct {
 
 func (x *RemoveIdentityResponse) Reset() {
 	*x = RemoveIdentityResponse{}
-	mi := &file_iam_proto_msgTypes[59]
+	mi := &file_iam_proto_msgTypes[77]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2824,7 +3701,7 @@ func (x *RemoveIdentityResponse) String() string {
 func (*RemoveIdentityResponse) ProtoMessage() {}
 
 func (x *RemoveIdentityResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[59]
+	mi := &file_iam_proto_msgTypes[77]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2837,7 +3714,7 @@ func (x *RemoveIdentityResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveIdentityResponse.ProtoReflect.Descriptor instead.
 func (*RemoveIdentityResponse) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{59}
+	return file_iam_proto_rawDescGZIP(), []int{77}
 }
 
 type PutGroupRequest struct {
@@ -2849,7 +3726,7 @@ type PutGroupRequest struct {
 
 func (x *PutGroupRequest) Reset() {
 	*x = PutGroupRequest{}
-	mi := &file_iam_proto_msgTypes[60]
+	mi := &file_iam_proto_msgTypes[78]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2861,7 +3738,7 @@ func (x *PutGroupRequest) String() string {
 func (*PutGroupRequest) ProtoMessage() {}
 
 func (x *PutGroupRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[60]
+	mi := &file_iam_proto_msgTypes[78]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2874,7 +3751,7 @@ func (x *PutGroupRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PutGroupRequest.ProtoReflect.Descriptor instead.
 func (*PutGroupRequest) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{60}
+	return file_iam_proto_rawDescGZIP(), []int{78}
 }
 
 func (x *PutGroupRequest) GetGroup() *Group {
@@ -2892,7 +3769,7 @@ type PutGroupResponse struct {
 
 func (x *PutGroupResponse) Reset() {
 	*x = PutGroupResponse{}
-	mi := &file_iam_proto_msgTypes[61]
+	mi := &file_iam_proto_msgTypes[79]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2904,7 +3781,7 @@ func (x *PutGroupResponse) String() string {
 func (*PutGroupResponse) ProtoMessage() {}
 
 func (x *PutGroupResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[61]
+	mi := &file_iam_proto_msgTypes[79]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2917,7 +3794,7 @@ func (x *PutGroupResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PutGroupResponse.ProtoReflect.Descriptor instead.
 func (*PutGroupResponse) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{61}
+	return file_iam_proto_rawDescGZIP(), []int{79}
 }
 
 type RemoveGroupRequest struct {
@@ -2929,7 +3806,7 @@ type RemoveGroupRequest struct {
 
 func (x *RemoveGroupRequest) Reset() {
 	*x = RemoveGroupRequest{}
-	mi := &file_iam_proto_msgTypes[62]
+	mi := &file_iam_proto_msgTypes[80]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2941,7 +3818,7 @@ func (x *RemoveGroupRequest) String() string {
 func (*RemoveGroupRequest) ProtoMessage() {}
 
 func (x *RemoveGroupRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[62]
+	mi := &file_iam_proto_msgTypes[80]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2954,7 +3831,7 @@ func (x *RemoveGroupRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveGroupRequest.ProtoReflect.Descriptor instead.
 func (*RemoveGroupRequest) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{62}
+	return file_iam_proto_rawDescGZIP(), []int{80}
 }
 
 func (x *RemoveGroupRequest) GetGroupName() string {
@@ -2972,7 +3849,7 @@ type RemoveGroupResponse struct {
 
 func (x *RemoveGroupResponse) Reset() {
 	*x = RemoveGroupResponse{}
-	mi := &file_iam_proto_msgTypes[63]
+	mi := &file_iam_proto_msgTypes[81]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2984,7 +3861,7 @@ func (x *RemoveGroupResponse) String() string {
 func (*RemoveGroupResponse) ProtoMessage() {}
 
 func (x *RemoveGroupResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_iam_proto_msgTypes[63]
+	mi := &file_iam_proto_msgTypes[81]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2997,7 +3874,7 @@ func (x *RemoveGroupResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RemoveGroupResponse.ProtoReflect.Descriptor instead.
 func (*RemoveGroupResponse) Descriptor() ([]byte, []int) {
-	return file_iam_proto_rawDescGZIP(), []int{63}
+	return file_iam_proto_rawDescGZIP(), []int{81}
 }
 
 var File_iam_proto protoreflect.FileDescriptor
@@ -3162,7 +4039,63 @@ const file_iam_proto_rawDesc = "" +
 	"\n" +
 	"access_key\x18\x01 \x01(\tR\taccessKey\"g\n" +
 	"$GetServiceAccountByAccessKeyResponse\x12?\n" +
-	"\x0fservice_account\x18\x01 \x01(\v2\x16.iam_pb.ServiceAccountR\x0eserviceAccount\"B\n" +
+	"\x0fservice_account\x18\x01 \x01(\v2\x16.iam_pb.ServiceAccountR\x0eserviceAccount\"\x9f\x01\n" +
+	"\fOIDCProvider\x12\x1d\n" +
+	"\n" +
+	"issuer_url\x18\x01 \x01(\tR\tissuerUrl\x12\x1d\n" +
+	"\n" +
+	"client_ids\x18\x02 \x03(\tR\tclientIds\x12 \n" +
+	"\vthumbprints\x18\x03 \x03(\tR\vthumbprints\x12\x1d\n" +
+	"\n" +
+	"account_id\x18\x04 \x01(\tR\taccountId\x12\x10\n" +
+	"\x03arn\x18\x05 \x01(\tR\x03arn\"\x97\x01\n" +
+	"\x16PutOIDCProviderRequest\x12\x1d\n" +
+	"\n" +
+	"issuer_url\x18\x01 \x01(\tR\tissuerUrl\x12\x1d\n" +
+	"\n" +
+	"client_ids\x18\x02 \x03(\tR\tclientIds\x12 \n" +
+	"\vthumbprints\x18\x03 \x03(\tR\vthumbprints\x12\x1d\n" +
+	"\n" +
+	"account_id\x18\x04 \x01(\tR\taccountId\"+\n" +
+	"\x17PutOIDCProviderResponse\x12\x10\n" +
+	"\x03arn\x18\x01 \x01(\tR\x03arn\"V\n" +
+	"\x16GetOIDCProviderRequest\x12\x1d\n" +
+	"\n" +
+	"issuer_url\x18\x01 \x01(\tR\tissuerUrl\x12\x1d\n" +
+	"\n" +
+	"account_id\x18\x02 \x01(\tR\taccountId\"K\n" +
+	"\x17GetOIDCProviderResponse\x120\n" +
+	"\bprovider\x18\x01 \x01(\v2\x14.iam_pb.OIDCProviderR\bprovider\"Y\n" +
+	"\x19DeleteOIDCProviderRequest\x12\x1d\n" +
+	"\n" +
+	"issuer_url\x18\x01 \x01(\tR\tissuerUrl\x12\x1d\n" +
+	"\n" +
+	"account_id\x18\x02 \x01(\tR\taccountId\"\x1c\n" +
+	"\x1aDeleteOIDCProviderResponse\"\x1a\n" +
+	"\x18ListOIDCProvidersRequest\"O\n" +
+	"\x19ListOIDCProvidersResponse\x122\n" +
+	"\tproviders\x18\x01 \x03(\v2\x14.iam_pb.OIDCProviderR\tproviders\"\xe2\x01\n" +
+	"\x04Role\x12\x1b\n" +
+	"\trole_name\x18\x01 \x01(\tR\broleName\x12\x19\n" +
+	"\brole_arn\x18\x02 \x01(\tR\aroleArn\x12!\n" +
+	"\ftrust_policy\x18\x03 \x01(\tR\vtrustPolicy\x12+\n" +
+	"\x11attached_policies\x18\x04 \x03(\tR\x10attachedPolicies\x12 \n" +
+	"\vdescription\x18\x05 \x01(\tR\vdescription\x120\n" +
+	"\x14max_session_duration\x18\x06 \x01(\x03R\x12maxSessionDuration\"2\n" +
+	"\x0ePutRoleRequest\x12 \n" +
+	"\x04role\x18\x01 \x01(\v2\f.iam_pb.RoleR\x04role\",\n" +
+	"\x0fPutRoleResponse\x12\x19\n" +
+	"\brole_arn\x18\x01 \x01(\tR\aroleArn\"-\n" +
+	"\x0eGetRoleRequest\x12\x1b\n" +
+	"\trole_name\x18\x01 \x01(\tR\broleName\"3\n" +
+	"\x0fGetRoleResponse\x12 \n" +
+	"\x04role\x18\x01 \x01(\v2\f.iam_pb.RoleR\x04role\"0\n" +
+	"\x11DeleteRoleRequest\x12\x1b\n" +
+	"\trole_name\x18\x01 \x01(\tR\broleName\"\x14\n" +
+	"\x12DeleteRoleResponse\"\x12\n" +
+	"\x10ListRolesRequest\"7\n" +
+	"\x11ListRolesResponse\x12\"\n" +
+	"\x05roles\x18\x01 \x03(\v2\f.iam_pb.RoleR\x05roles\"B\n" +
 	"\x12PutIdentityRequest\x12,\n" +
 	"\bidentity\x18\x01 \x01(\v2\x10.iam_pb.IdentityR\bidentity\"\x15\n" +
 	"\x13PutIdentityResponse\"3\n" +
@@ -3175,7 +4108,7 @@ const file_iam_proto_rawDesc = "" +
 	"\x12RemoveGroupRequest\x12\x1d\n" +
 	"\n" +
 	"group_name\x18\x01 \x01(\tR\tgroupName\"\x15\n" +
-	"\x13RemoveGroupResponse2\x99\r\n" +
+	"\x13RemoveGroupResponse2\xf7\x11\n" +
 	"\x1fSeaweedIdentityAccessManagement\x12U\n" +
 	"\x10GetConfiguration\x12\x1f.iam_pb.GetConfigurationRequest\x1a .iam_pb.GetConfigurationResponse\x12U\n" +
 	"\x10PutConfiguration\x12\x1f.iam_pb.PutConfigurationRequest\x1a .iam_pb.PutConfigurationResponse\x12C\n" +
@@ -3199,7 +4132,16 @@ const file_iam_proto_rawDesc = "" +
 	"\x14DeleteServiceAccount\x12#.iam_pb.DeleteServiceAccountRequest\x1a$.iam_pb.DeleteServiceAccountResponse\x12X\n" +
 	"\x11GetServiceAccount\x12 .iam_pb.GetServiceAccountRequest\x1a!.iam_pb.GetServiceAccountResponse\x12^\n" +
 	"\x13ListServiceAccounts\x12\".iam_pb.ListServiceAccountsRequest\x1a#.iam_pb.ListServiceAccountsResponse\x12y\n" +
-	"\x1cGetServiceAccountByAccessKey\x12+.iam_pb.GetServiceAccountByAccessKeyRequest\x1a,.iam_pb.GetServiceAccountByAccessKeyResponseBK\n" +
+	"\x1cGetServiceAccountByAccessKey\x12+.iam_pb.GetServiceAccountByAccessKeyRequest\x1a,.iam_pb.GetServiceAccountByAccessKeyResponse\x12R\n" +
+	"\x0fPutOIDCProvider\x12\x1e.iam_pb.PutOIDCProviderRequest\x1a\x1f.iam_pb.PutOIDCProviderResponse\x12R\n" +
+	"\x0fGetOIDCProvider\x12\x1e.iam_pb.GetOIDCProviderRequest\x1a\x1f.iam_pb.GetOIDCProviderResponse\x12[\n" +
+	"\x12DeleteOIDCProvider\x12!.iam_pb.DeleteOIDCProviderRequest\x1a\".iam_pb.DeleteOIDCProviderResponse\x12X\n" +
+	"\x11ListOIDCProviders\x12 .iam_pb.ListOIDCProvidersRequest\x1a!.iam_pb.ListOIDCProvidersResponse\x12:\n" +
+	"\aPutRole\x12\x16.iam_pb.PutRoleRequest\x1a\x17.iam_pb.PutRoleResponse\x12:\n" +
+	"\aGetRole\x12\x16.iam_pb.GetRoleRequest\x1a\x17.iam_pb.GetRoleResponse\x12C\n" +
+	"\n" +
+	"DeleteRole\x12\x19.iam_pb.DeleteRoleRequest\x1a\x1a.iam_pb.DeleteRoleResponse\x12@\n" +
+	"\tListRoles\x12\x18.iam_pb.ListRolesRequest\x1a\x19.iam_pb.ListRolesResponseBK\n" +
 	"\x10seaweedfs.clientB\bIamProtoZ-github.com/seaweedfs/seaweedfs/weed/pb/iam_pbb\x06proto3"
 
 var (
@@ -3214,7 +4156,7 @@ func file_iam_proto_rawDescGZIP() []byte {
 	return file_iam_proto_rawDescData
 }
 
-var file_iam_proto_msgTypes = make([]protoimpl.MessageInfo, 64)
+var file_iam_proto_msgTypes = make([]protoimpl.MessageInfo, 82)
 var file_iam_proto_goTypes = []any{
 	(*GetConfigurationRequest)(nil),              // 0: iam_pb.GetConfigurationRequest
 	(*GetConfigurationResponse)(nil),             // 1: iam_pb.GetConfigurationResponse
@@ -3272,14 +4214,32 @@ var file_iam_proto_goTypes = []any{
 	(*ListServiceAccountsResponse)(nil),          // 53: iam_pb.ListServiceAccountsResponse
 	(*GetServiceAccountByAccessKeyRequest)(nil),  // 54: iam_pb.GetServiceAccountByAccessKeyRequest
 	(*GetServiceAccountByAccessKeyResponse)(nil), // 55: iam_pb.GetServiceAccountByAccessKeyResponse
-	(*PutIdentityRequest)(nil),                   // 56: iam_pb.PutIdentityRequest
-	(*PutIdentityResponse)(nil),                  // 57: iam_pb.PutIdentityResponse
-	(*RemoveIdentityRequest)(nil),                // 58: iam_pb.RemoveIdentityRequest
-	(*RemoveIdentityResponse)(nil),               // 59: iam_pb.RemoveIdentityResponse
-	(*PutGroupRequest)(nil),                      // 60: iam_pb.PutGroupRequest
-	(*PutGroupResponse)(nil),                     // 61: iam_pb.PutGroupResponse
-	(*RemoveGroupRequest)(nil),                   // 62: iam_pb.RemoveGroupRequest
-	(*RemoveGroupResponse)(nil),                  // 63: iam_pb.RemoveGroupResponse
+	(*OIDCProvider)(nil),                         // 56: iam_pb.OIDCProvider
+	(*PutOIDCProviderRequest)(nil),               // 57: iam_pb.PutOIDCProviderRequest
+	(*PutOIDCProviderResponse)(nil),              // 58: iam_pb.PutOIDCProviderResponse
+	(*GetOIDCProviderRequest)(nil),               // 59: iam_pb.GetOIDCProviderRequest
+	(*GetOIDCProviderResponse)(nil),              // 60: iam_pb.GetOIDCProviderResponse
+	(*DeleteOIDCProviderRequest)(nil),            // 61: iam_pb.DeleteOIDCProviderRequest
+	(*DeleteOIDCProviderResponse)(nil),           // 62: iam_pb.DeleteOIDCProviderResponse
+	(*ListOIDCProvidersRequest)(nil),             // 63: iam_pb.ListOIDCProvidersRequest
+	(*ListOIDCProvidersResponse)(nil),            // 64: iam_pb.ListOIDCProvidersResponse
+	(*Role)(nil),                                 // 65: iam_pb.Role
+	(*PutRoleRequest)(nil),                       // 66: iam_pb.PutRoleRequest
+	(*PutRoleResponse)(nil),                      // 67: iam_pb.PutRoleResponse
+	(*GetRoleRequest)(nil),                       // 68: iam_pb.GetRoleRequest
+	(*GetRoleResponse)(nil),                      // 69: iam_pb.GetRoleResponse
+	(*DeleteRoleRequest)(nil),                    // 70: iam_pb.DeleteRoleRequest
+	(*DeleteRoleResponse)(nil),                   // 71: iam_pb.DeleteRoleResponse
+	(*ListRolesRequest)(nil),                     // 72: iam_pb.ListRolesRequest
+	(*ListRolesResponse)(nil),                    // 73: iam_pb.ListRolesResponse
+	(*PutIdentityRequest)(nil),                   // 74: iam_pb.PutIdentityRequest
+	(*PutIdentityResponse)(nil),                  // 75: iam_pb.PutIdentityResponse
+	(*RemoveIdentityRequest)(nil),                // 76: iam_pb.RemoveIdentityRequest
+	(*RemoveIdentityResponse)(nil),               // 77: iam_pb.RemoveIdentityResponse
+	(*PutGroupRequest)(nil),                      // 78: iam_pb.PutGroupRequest
+	(*PutGroupResponse)(nil),                     // 79: iam_pb.PutGroupResponse
+	(*RemoveGroupRequest)(nil),                   // 80: iam_pb.RemoveGroupRequest
+	(*RemoveGroupResponse)(nil),                  // 81: iam_pb.RemoveGroupResponse
 }
 var file_iam_proto_depIdxs = []int32{
 	28, // 0: iam_pb.GetConfigurationResponse.configuration:type_name -> iam_pb.S3ApiConfiguration
@@ -3305,53 +4265,74 @@ var file_iam_proto_depIdxs = []int32{
 	34, // 20: iam_pb.GetServiceAccountResponse.service_account:type_name -> iam_pb.ServiceAccount
 	34, // 21: iam_pb.ListServiceAccountsResponse.service_accounts:type_name -> iam_pb.ServiceAccount
 	34, // 22: iam_pb.GetServiceAccountByAccessKeyResponse.service_account:type_name -> iam_pb.ServiceAccount
-	30, // 23: iam_pb.PutIdentityRequest.identity:type_name -> iam_pb.Identity
-	29, // 24: iam_pb.PutGroupRequest.group:type_name -> iam_pb.Group
-	0,  // 25: iam_pb.SeaweedIdentityAccessManagement.GetConfiguration:input_type -> iam_pb.GetConfigurationRequest
-	2,  // 26: iam_pb.SeaweedIdentityAccessManagement.PutConfiguration:input_type -> iam_pb.PutConfigurationRequest
-	4,  // 27: iam_pb.SeaweedIdentityAccessManagement.CreateUser:input_type -> iam_pb.CreateUserRequest
-	6,  // 28: iam_pb.SeaweedIdentityAccessManagement.GetUser:input_type -> iam_pb.GetUserRequest
-	8,  // 29: iam_pb.SeaweedIdentityAccessManagement.UpdateUser:input_type -> iam_pb.UpdateUserRequest
-	10, // 30: iam_pb.SeaweedIdentityAccessManagement.DeleteUser:input_type -> iam_pb.DeleteUserRequest
-	12, // 31: iam_pb.SeaweedIdentityAccessManagement.ListUsers:input_type -> iam_pb.ListUsersRequest
-	14, // 32: iam_pb.SeaweedIdentityAccessManagement.CreateAccessKey:input_type -> iam_pb.CreateAccessKeyRequest
-	16, // 33: iam_pb.SeaweedIdentityAccessManagement.DeleteAccessKey:input_type -> iam_pb.DeleteAccessKeyRequest
-	18, // 34: iam_pb.SeaweedIdentityAccessManagement.GetUserByAccessKey:input_type -> iam_pb.GetUserByAccessKeyRequest
-	35, // 35: iam_pb.SeaweedIdentityAccessManagement.PutPolicy:input_type -> iam_pb.PutPolicyRequest
-	37, // 36: iam_pb.SeaweedIdentityAccessManagement.GetPolicy:input_type -> iam_pb.GetPolicyRequest
-	39, // 37: iam_pb.SeaweedIdentityAccessManagement.ListPolicies:input_type -> iam_pb.ListPoliciesRequest
-	41, // 38: iam_pb.SeaweedIdentityAccessManagement.DeletePolicy:input_type -> iam_pb.DeletePolicyRequest
-	44, // 39: iam_pb.SeaweedIdentityAccessManagement.CreateServiceAccount:input_type -> iam_pb.CreateServiceAccountRequest
-	46, // 40: iam_pb.SeaweedIdentityAccessManagement.UpdateServiceAccount:input_type -> iam_pb.UpdateServiceAccountRequest
-	48, // 41: iam_pb.SeaweedIdentityAccessManagement.DeleteServiceAccount:input_type -> iam_pb.DeleteServiceAccountRequest
-	50, // 42: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccount:input_type -> iam_pb.GetServiceAccountRequest
-	52, // 43: iam_pb.SeaweedIdentityAccessManagement.ListServiceAccounts:input_type -> iam_pb.ListServiceAccountsRequest
-	54, // 44: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccountByAccessKey:input_type -> iam_pb.GetServiceAccountByAccessKeyRequest
-	1,  // 45: iam_pb.SeaweedIdentityAccessManagement.GetConfiguration:output_type -> iam_pb.GetConfigurationResponse
-	3,  // 46: iam_pb.SeaweedIdentityAccessManagement.PutConfiguration:output_type -> iam_pb.PutConfigurationResponse
-	5,  // 47: iam_pb.SeaweedIdentityAccessManagement.CreateUser:output_type -> iam_pb.CreateUserResponse
-	7,  // 48: iam_pb.SeaweedIdentityAccessManagement.GetUser:output_type -> iam_pb.GetUserResponse
-	9,  // 49: iam_pb.SeaweedIdentityAccessManagement.UpdateUser:output_type -> iam_pb.UpdateUserResponse
-	11, // 50: iam_pb.SeaweedIdentityAccessManagement.DeleteUser:output_type -> iam_pb.DeleteUserResponse
-	13, // 51: iam_pb.SeaweedIdentityAccessManagement.ListUsers:output_type -> iam_pb.ListUsersResponse
-	15, // 52: iam_pb.SeaweedIdentityAccessManagement.CreateAccessKey:output_type -> iam_pb.CreateAccessKeyResponse
-	17, // 53: iam_pb.SeaweedIdentityAccessManagement.DeleteAccessKey:output_type -> iam_pb.DeleteAccessKeyResponse
-	19, // 54: iam_pb.SeaweedIdentityAccessManagement.GetUserByAccessKey:output_type -> iam_pb.GetUserByAccessKeyResponse
-	36, // 55: iam_pb.SeaweedIdentityAccessManagement.PutPolicy:output_type -> iam_pb.PutPolicyResponse
-	38, // 56: iam_pb.SeaweedIdentityAccessManagement.GetPolicy:output_type -> iam_pb.GetPolicyResponse
-	40, // 57: iam_pb.SeaweedIdentityAccessManagement.ListPolicies:output_type -> iam_pb.ListPoliciesResponse
-	42, // 58: iam_pb.SeaweedIdentityAccessManagement.DeletePolicy:output_type -> iam_pb.DeletePolicyResponse
-	45, // 59: iam_pb.SeaweedIdentityAccessManagement.CreateServiceAccount:output_type -> iam_pb.CreateServiceAccountResponse
-	47, // 60: iam_pb.SeaweedIdentityAccessManagement.UpdateServiceAccount:output_type -> iam_pb.UpdateServiceAccountResponse
-	49, // 61: iam_pb.SeaweedIdentityAccessManagement.DeleteServiceAccount:output_type -> iam_pb.DeleteServiceAccountResponse
-	51, // 62: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccount:output_type -> iam_pb.GetServiceAccountResponse
-	53, // 63: iam_pb.SeaweedIdentityAccessManagement.ListServiceAccounts:output_type -> iam_pb.ListServiceAccountsResponse
-	55, // 64: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccountByAccessKey:output_type -> iam_pb.GetServiceAccountByAccessKeyResponse
-	45, // [45:65] is the sub-list for method output_type
-	25, // [25:45] is the sub-list for method input_type
-	25, // [25:25] is the sub-list for extension type_name
-	25, // [25:25] is the sub-list for extension extendee
-	0,  // [0:25] is the sub-list for field type_name
+	56, // 23: iam_pb.GetOIDCProviderResponse.provider:type_name -> iam_pb.OIDCProvider
+	56, // 24: iam_pb.ListOIDCProvidersResponse.providers:type_name -> iam_pb.OIDCProvider
+	65, // 25: iam_pb.PutRoleRequest.role:type_name -> iam_pb.Role
+	65, // 26: iam_pb.GetRoleResponse.role:type_name -> iam_pb.Role
+	65, // 27: iam_pb.ListRolesResponse.roles:type_name -> iam_pb.Role
+	30, // 28: iam_pb.PutIdentityRequest.identity:type_name -> iam_pb.Identity
+	29, // 29: iam_pb.PutGroupRequest.group:type_name -> iam_pb.Group
+	0,  // 30: iam_pb.SeaweedIdentityAccessManagement.GetConfiguration:input_type -> iam_pb.GetConfigurationRequest
+	2,  // 31: iam_pb.SeaweedIdentityAccessManagement.PutConfiguration:input_type -> iam_pb.PutConfigurationRequest
+	4,  // 32: iam_pb.SeaweedIdentityAccessManagement.CreateUser:input_type -> iam_pb.CreateUserRequest
+	6,  // 33: iam_pb.SeaweedIdentityAccessManagement.GetUser:input_type -> iam_pb.GetUserRequest
+	8,  // 34: iam_pb.SeaweedIdentityAccessManagement.UpdateUser:input_type -> iam_pb.UpdateUserRequest
+	10, // 35: iam_pb.SeaweedIdentityAccessManagement.DeleteUser:input_type -> iam_pb.DeleteUserRequest
+	12, // 36: iam_pb.SeaweedIdentityAccessManagement.ListUsers:input_type -> iam_pb.ListUsersRequest
+	14, // 37: iam_pb.SeaweedIdentityAccessManagement.CreateAccessKey:input_type -> iam_pb.CreateAccessKeyRequest
+	16, // 38: iam_pb.SeaweedIdentityAccessManagement.DeleteAccessKey:input_type -> iam_pb.DeleteAccessKeyRequest
+	18, // 39: iam_pb.SeaweedIdentityAccessManagement.GetUserByAccessKey:input_type -> iam_pb.GetUserByAccessKeyRequest
+	35, // 40: iam_pb.SeaweedIdentityAccessManagement.PutPolicy:input_type -> iam_pb.PutPolicyRequest
+	37, // 41: iam_pb.SeaweedIdentityAccessManagement.GetPolicy:input_type -> iam_pb.GetPolicyRequest
+	39, // 42: iam_pb.SeaweedIdentityAccessManagement.ListPolicies:input_type -> iam_pb.ListPoliciesRequest
+	41, // 43: iam_pb.SeaweedIdentityAccessManagement.DeletePolicy:input_type -> iam_pb.DeletePolicyRequest
+	44, // 44: iam_pb.SeaweedIdentityAccessManagement.CreateServiceAccount:input_type -> iam_pb.CreateServiceAccountRequest
+	46, // 45: iam_pb.SeaweedIdentityAccessManagement.UpdateServiceAccount:input_type -> iam_pb.UpdateServiceAccountRequest
+	48, // 46: iam_pb.SeaweedIdentityAccessManagement.DeleteServiceAccount:input_type -> iam_pb.DeleteServiceAccountRequest
+	50, // 47: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccount:input_type -> iam_pb.GetServiceAccountRequest
+	52, // 48: iam_pb.SeaweedIdentityAccessManagement.ListServiceAccounts:input_type -> iam_pb.ListServiceAccountsRequest
+	54, // 49: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccountByAccessKey:input_type -> iam_pb.GetServiceAccountByAccessKeyRequest
+	57, // 50: iam_pb.SeaweedIdentityAccessManagement.PutOIDCProvider:input_type -> iam_pb.PutOIDCProviderRequest
+	59, // 51: iam_pb.SeaweedIdentityAccessManagement.GetOIDCProvider:input_type -> iam_pb.GetOIDCProviderRequest
+	61, // 52: iam_pb.SeaweedIdentityAccessManagement.DeleteOIDCProvider:input_type -> iam_pb.DeleteOIDCProviderRequest
+	63, // 53: iam_pb.SeaweedIdentityAccessManagement.ListOIDCProviders:input_type -> iam_pb.ListOIDCProvidersRequest
+	66, // 54: iam_pb.SeaweedIdentityAccessManagement.PutRole:input_type -> iam_pb.PutRoleRequest
+	68, // 55: iam_pb.SeaweedIdentityAccessManagement.GetRole:input_type -> iam_pb.GetRoleRequest
+	70, // 56: iam_pb.SeaweedIdentityAccessManagement.DeleteRole:input_type -> iam_pb.DeleteRoleRequest
+	72, // 57: iam_pb.SeaweedIdentityAccessManagement.ListRoles:input_type -> iam_pb.ListRolesRequest
+	1,  // 58: iam_pb.SeaweedIdentityAccessManagement.GetConfiguration:output_type -> iam_pb.GetConfigurationResponse
+	3,  // 59: iam_pb.SeaweedIdentityAccessManagement.PutConfiguration:output_type -> iam_pb.PutConfigurationResponse
+	5,  // 60: iam_pb.SeaweedIdentityAccessManagement.CreateUser:output_type -> iam_pb.CreateUserResponse
+	7,  // 61: iam_pb.SeaweedIdentityAccessManagement.GetUser:output_type -> iam_pb.GetUserResponse
+	9,  // 62: iam_pb.SeaweedIdentityAccessManagement.UpdateUser:output_type -> iam_pb.UpdateUserResponse
+	11, // 63: iam_pb.SeaweedIdentityAccessManagement.DeleteUser:output_type -> iam_pb.DeleteUserResponse
+	13, // 64: iam_pb.SeaweedIdentityAccessManagement.ListUsers:output_type -> iam_pb.ListUsersResponse
+	15, // 65: iam_pb.SeaweedIdentityAccessManagement.CreateAccessKey:output_type -> iam_pb.CreateAccessKeyResponse
+	17, // 66: iam_pb.SeaweedIdentityAccessManagement.DeleteAccessKey:output_type -> iam_pb.DeleteAccessKeyResponse
+	19, // 67: iam_pb.SeaweedIdentityAccessManagement.GetUserByAccessKey:output_type -> iam_pb.GetUserByAccessKeyResponse
+	36, // 68: iam_pb.SeaweedIdentityAccessManagement.PutPolicy:output_type -> iam_pb.PutPolicyResponse
+	38, // 69: iam_pb.SeaweedIdentityAccessManagement.GetPolicy:output_type -> iam_pb.GetPolicyResponse
+	40, // 70: iam_pb.SeaweedIdentityAccessManagement.ListPolicies:output_type -> iam_pb.ListPoliciesResponse
+	42, // 71: iam_pb.SeaweedIdentityAccessManagement.DeletePolicy:output_type -> iam_pb.DeletePolicyResponse
+	45, // 72: iam_pb.SeaweedIdentityAccessManagement.CreateServiceAccount:output_type -> iam_pb.CreateServiceAccountResponse
+	47, // 73: iam_pb.SeaweedIdentityAccessManagement.UpdateServiceAccount:output_type -> iam_pb.UpdateServiceAccountResponse
+	49, // 74: iam_pb.SeaweedIdentityAccessManagement.DeleteServiceAccount:output_type -> iam_pb.DeleteServiceAccountResponse
+	51, // 75: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccount:output_type -> iam_pb.GetServiceAccountResponse
+	53, // 76: iam_pb.SeaweedIdentityAccessManagement.ListServiceAccounts:output_type -> iam_pb.ListServiceAccountsResponse
+	55, // 77: iam_pb.SeaweedIdentityAccessManagement.GetServiceAccountByAccessKey:output_type -> iam_pb.GetServiceAccountByAccessKeyResponse
+	58, // 78: iam_pb.SeaweedIdentityAccessManagement.PutOIDCProvider:output_type -> iam_pb.PutOIDCProviderResponse
+	60, // 79: iam_pb.SeaweedIdentityAccessManagement.GetOIDCProvider:output_type -> iam_pb.GetOIDCProviderResponse
+	62, // 80: iam_pb.SeaweedIdentityAccessManagement.DeleteOIDCProvider:output_type -> iam_pb.DeleteOIDCProviderResponse
+	64, // 81: iam_pb.SeaweedIdentityAccessManagement.ListOIDCProviders:output_type -> iam_pb.ListOIDCProvidersResponse
+	67, // 82: iam_pb.SeaweedIdentityAccessManagement.PutRole:output_type -> iam_pb.PutRoleResponse
+	69, // 83: iam_pb.SeaweedIdentityAccessManagement.GetRole:output_type -> iam_pb.GetRoleResponse
+	71, // 84: iam_pb.SeaweedIdentityAccessManagement.DeleteRole:output_type -> iam_pb.DeleteRoleResponse
+	73, // 85: iam_pb.SeaweedIdentityAccessManagement.ListRoles:output_type -> iam_pb.ListRolesResponse
+	58, // [58:86] is the sub-list for method output_type
+	30, // [30:58] is the sub-list for method input_type
+	30, // [30:30] is the sub-list for extension type_name
+	30, // [30:30] is the sub-list for extension extendee
+	0,  // [0:30] is the sub-list for field type_name
 }
 
 func init() { file_iam_proto_init() }
@@ -3365,7 +4346,7 @@ func file_iam_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_iam_proto_rawDesc), len(file_iam_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   64,
+			NumMessages:   82,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/weed/pb/iam_pb/iam_grpc.pb.go b/weed/pb/iam_pb/iam_grpc.pb.go
index 9fb76c4569..17df34b2a7 100644
--- a/weed/pb/iam_pb/iam_grpc.pb.go
+++ b/weed/pb/iam_pb/iam_grpc.pb.go
@@ -39,6 +39,14 @@ const (
 	SeaweedIdentityAccessManagement_GetServiceAccount_FullMethodName            = "/iam_pb.SeaweedIdentityAccessManagement/GetServiceAccount"
 	SeaweedIdentityAccessManagement_ListServiceAccounts_FullMethodName          = "/iam_pb.SeaweedIdentityAccessManagement/ListServiceAccounts"
 	SeaweedIdentityAccessManagement_GetServiceAccountByAccessKey_FullMethodName = "/iam_pb.SeaweedIdentityAccessManagement/GetServiceAccountByAccessKey"
+	SeaweedIdentityAccessManagement_PutOIDCProvider_FullMethodName              = "/iam_pb.SeaweedIdentityAccessManagement/PutOIDCProvider"
+	SeaweedIdentityAccessManagement_GetOIDCProvider_FullMethodName              = "/iam_pb.SeaweedIdentityAccessManagement/GetOIDCProvider"
+	SeaweedIdentityAccessManagement_DeleteOIDCProvider_FullMethodName           = "/iam_pb.SeaweedIdentityAccessManagement/DeleteOIDCProvider"
+	SeaweedIdentityAccessManagement_ListOIDCProviders_FullMethodName            = "/iam_pb.SeaweedIdentityAccessManagement/ListOIDCProviders"
+	SeaweedIdentityAccessManagement_PutRole_FullMethodName                      = "/iam_pb.SeaweedIdentityAccessManagement/PutRole"
+	SeaweedIdentityAccessManagement_GetRole_FullMethodName                      = "/iam_pb.SeaweedIdentityAccessManagement/GetRole"
+	SeaweedIdentityAccessManagement_DeleteRole_FullMethodName                   = "/iam_pb.SeaweedIdentityAccessManagement/DeleteRole"
+	SeaweedIdentityAccessManagement_ListRoles_FullMethodName                    = "/iam_pb.SeaweedIdentityAccessManagement/ListRoles"
 )
 
 // SeaweedIdentityAccessManagementClient is the client API for SeaweedIdentityAccessManagement service.
@@ -70,6 +78,18 @@ type SeaweedIdentityAccessManagementClient interface {
 	GetServiceAccount(ctx context.Context, in *GetServiceAccountRequest, opts ...grpc.CallOption) (*GetServiceAccountResponse, error)
 	ListServiceAccounts(ctx context.Context, in *ListServiceAccountsRequest, opts ...grpc.CallOption) (*ListServiceAccountsResponse, error)
 	GetServiceAccountByAccessKey(ctx context.Context, in *GetServiceAccountByAccessKeyRequest, opts ...grpc.CallOption) (*GetServiceAccountByAccessKeyResponse, error)
+	// OIDC Provider Management. Writes the records the S3 servers' STS trusts
+	// when they run with "oidcProviderStore": {"storeType": "filer"}.
+	PutOIDCProvider(ctx context.Context, in *PutOIDCProviderRequest, opts ...grpc.CallOption) (*PutOIDCProviderResponse, error)
+	GetOIDCProvider(ctx context.Context, in *GetOIDCProviderRequest, opts ...grpc.CallOption) (*GetOIDCProviderResponse, error)
+	DeleteOIDCProvider(ctx context.Context, in *DeleteOIDCProviderRequest, opts ...grpc.CallOption) (*DeleteOIDCProviderResponse, error)
+	ListOIDCProviders(ctx context.Context, in *ListOIDCProvidersRequest, opts ...grpc.CallOption) (*ListOIDCProvidersResponse, error)
+	// Role Management. Writes the roles the S3 servers' STS assumes when they
+	// run with "roleStore": {"storeType": "filer"}.
+	PutRole(ctx context.Context, in *PutRoleRequest, opts ...grpc.CallOption) (*PutRoleResponse, error)
+	GetRole(ctx context.Context, in *GetRoleRequest, opts ...grpc.CallOption) (*GetRoleResponse, error)
+	DeleteRole(ctx context.Context, in *DeleteRoleRequest, opts ...grpc.CallOption) (*DeleteRoleResponse, error)
+	ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error)
 }
 
 type seaweedIdentityAccessManagementClient struct {
@@ -280,6 +300,86 @@ func (c *seaweedIdentityAccessManagementClient) GetServiceAccountByAccessKey(ctx
 	return out, nil
 }
 
+func (c *seaweedIdentityAccessManagementClient) PutOIDCProvider(ctx context.Context, in *PutOIDCProviderRequest, opts ...grpc.CallOption) (*PutOIDCProviderResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PutOIDCProviderResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_PutOIDCProvider_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *seaweedIdentityAccessManagementClient) GetOIDCProvider(ctx context.Context, in *GetOIDCProviderRequest, opts ...grpc.CallOption) (*GetOIDCProviderResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetOIDCProviderResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_GetOIDCProvider_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *seaweedIdentityAccessManagementClient) DeleteOIDCProvider(ctx context.Context, in *DeleteOIDCProviderRequest, opts ...grpc.CallOption) (*DeleteOIDCProviderResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteOIDCProviderResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_DeleteOIDCProvider_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *seaweedIdentityAccessManagementClient) ListOIDCProviders(ctx context.Context, in *ListOIDCProvidersRequest, opts ...grpc.CallOption) (*ListOIDCProvidersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListOIDCProvidersResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_ListOIDCProviders_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *seaweedIdentityAccessManagementClient) PutRole(ctx context.Context, in *PutRoleRequest, opts ...grpc.CallOption) (*PutRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PutRoleResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_PutRole_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *seaweedIdentityAccessManagementClient) GetRole(ctx context.Context, in *GetRoleRequest, opts ...grpc.CallOption) (*GetRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetRoleResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_GetRole_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *seaweedIdentityAccessManagementClient) DeleteRole(ctx context.Context, in *DeleteRoleRequest, opts ...grpc.CallOption) (*DeleteRoleResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(DeleteRoleResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_DeleteRole_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *seaweedIdentityAccessManagementClient) ListRoles(ctx context.Context, in *ListRolesRequest, opts ...grpc.CallOption) (*ListRolesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListRolesResponse)
+	err := c.cc.Invoke(ctx, SeaweedIdentityAccessManagement_ListRoles_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // SeaweedIdentityAccessManagementServer is the server API for SeaweedIdentityAccessManagement service.
 // All implementations must embed UnimplementedSeaweedIdentityAccessManagementServer
 // for forward compatibility.
@@ -309,6 +409,18 @@ type SeaweedIdentityAccessManagementServer interface {
 	GetServiceAccount(context.Context, *GetServiceAccountRequest) (*GetServiceAccountResponse, error)
 	ListServiceAccounts(context.Context, *ListServiceAccountsRequest) (*ListServiceAccountsResponse, error)
 	GetServiceAccountByAccessKey(context.Context, *GetServiceAccountByAccessKeyRequest) (*GetServiceAccountByAccessKeyResponse, error)
+	// OIDC Provider Management. Writes the records the S3 servers' STS trusts
+	// when they run with "oidcProviderStore": {"storeType": "filer"}.
+	PutOIDCProvider(context.Context, *PutOIDCProviderRequest) (*PutOIDCProviderResponse, error)
+	GetOIDCProvider(context.Context, *GetOIDCProviderRequest) (*GetOIDCProviderResponse, error)
+	DeleteOIDCProvider(context.Context, *DeleteOIDCProviderRequest) (*DeleteOIDCProviderResponse, error)
+	ListOIDCProviders(context.Context, *ListOIDCProvidersRequest) (*ListOIDCProvidersResponse, error)
+	// Role Management. Writes the roles the S3 servers' STS assumes when they
+	// run with "roleStore": {"storeType": "filer"}.
+	PutRole(context.Context, *PutRoleRequest) (*PutRoleResponse, error)
+	GetRole(context.Context, *GetRoleRequest) (*GetRoleResponse, error)
+	DeleteRole(context.Context, *DeleteRoleRequest) (*DeleteRoleResponse, error)
+	ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error)
 	mustEmbedUnimplementedSeaweedIdentityAccessManagementServer()
 }
 
@@ -379,6 +491,30 @@ func (UnimplementedSeaweedIdentityAccessManagementServer) ListServiceAccounts(co
 func (UnimplementedSeaweedIdentityAccessManagementServer) GetServiceAccountByAccessKey(context.Context, *GetServiceAccountByAccessKeyRequest) (*GetServiceAccountByAccessKeyResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetServiceAccountByAccessKey not implemented")
 }
+func (UnimplementedSeaweedIdentityAccessManagementServer) PutOIDCProvider(context.Context, *PutOIDCProviderRequest) (*PutOIDCProviderResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method PutOIDCProvider not implemented")
+}
+func (UnimplementedSeaweedIdentityAccessManagementServer) GetOIDCProvider(context.Context, *GetOIDCProviderRequest) (*GetOIDCProviderResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetOIDCProvider not implemented")
+}
+func (UnimplementedSeaweedIdentityAccessManagementServer) DeleteOIDCProvider(context.Context, *DeleteOIDCProviderRequest) (*DeleteOIDCProviderResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteOIDCProvider not implemented")
+}
+func (UnimplementedSeaweedIdentityAccessManagementServer) ListOIDCProviders(context.Context, *ListOIDCProvidersRequest) (*ListOIDCProvidersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListOIDCProviders not implemented")
+}
+func (UnimplementedSeaweedIdentityAccessManagementServer) PutRole(context.Context, *PutRoleRequest) (*PutRoleResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method PutRole not implemented")
+}
+func (UnimplementedSeaweedIdentityAccessManagementServer) GetRole(context.Context, *GetRoleRequest) (*GetRoleResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetRole not implemented")
+}
+func (UnimplementedSeaweedIdentityAccessManagementServer) DeleteRole(context.Context, *DeleteRoleRequest) (*DeleteRoleResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteRole not implemented")
+}
+func (UnimplementedSeaweedIdentityAccessManagementServer) ListRoles(context.Context, *ListRolesRequest) (*ListRolesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListRoles not implemented")
+}
 func (UnimplementedSeaweedIdentityAccessManagementServer) mustEmbedUnimplementedSeaweedIdentityAccessManagementServer() {
 }
 func (UnimplementedSeaweedIdentityAccessManagementServer) testEmbeddedByValue() {}
@@ -761,6 +897,150 @@ func _SeaweedIdentityAccessManagement_GetServiceAccountByAccessKey_Handler(srv i
 	return interceptor(ctx, in, info, handler)
 }
 
+func _SeaweedIdentityAccessManagement_PutOIDCProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PutOIDCProviderRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).PutOIDCProvider(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_PutOIDCProvider_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).PutOIDCProvider(ctx, req.(*PutOIDCProviderRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SeaweedIdentityAccessManagement_GetOIDCProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetOIDCProviderRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).GetOIDCProvider(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_GetOIDCProvider_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).GetOIDCProvider(ctx, req.(*GetOIDCProviderRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SeaweedIdentityAccessManagement_DeleteOIDCProvider_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteOIDCProviderRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).DeleteOIDCProvider(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_DeleteOIDCProvider_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).DeleteOIDCProvider(ctx, req.(*DeleteOIDCProviderRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SeaweedIdentityAccessManagement_ListOIDCProviders_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListOIDCProvidersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).ListOIDCProviders(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_ListOIDCProviders_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).ListOIDCProviders(ctx, req.(*ListOIDCProvidersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SeaweedIdentityAccessManagement_PutRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PutRoleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).PutRole(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_PutRole_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).PutRole(ctx, req.(*PutRoleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SeaweedIdentityAccessManagement_GetRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetRoleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).GetRole(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_GetRole_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).GetRole(ctx, req.(*GetRoleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SeaweedIdentityAccessManagement_DeleteRole_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRoleRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).DeleteRole(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_DeleteRole_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).DeleteRole(ctx, req.(*DeleteRoleRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _SeaweedIdentityAccessManagement_ListRoles_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRolesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedIdentityAccessManagementServer).ListRoles(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: SeaweedIdentityAccessManagement_ListRoles_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedIdentityAccessManagementServer).ListRoles(ctx, req.(*ListRolesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // SeaweedIdentityAccessManagement_ServiceDesc is the grpc.ServiceDesc for SeaweedIdentityAccessManagement service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -848,6 +1128,38 @@ var SeaweedIdentityAccessManagement_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetServiceAccountByAccessKey",
 			Handler:    _SeaweedIdentityAccessManagement_GetServiceAccountByAccessKey_Handler,
 		},
+		{
+			MethodName: "PutOIDCProvider",
+			Handler:    _SeaweedIdentityAccessManagement_PutOIDCProvider_Handler,
+		},
+		{
+			MethodName: "GetOIDCProvider",
+			Handler:    _SeaweedIdentityAccessManagement_GetOIDCProvider_Handler,
+		},
+		{
+			MethodName: "DeleteOIDCProvider",
+			Handler:    _SeaweedIdentityAccessManagement_DeleteOIDCProvider_Handler,
+		},
+		{
+			MethodName: "ListOIDCProviders",
+			Handler:    _SeaweedIdentityAccessManagement_ListOIDCProviders_Handler,
+		},
+		{
+			MethodName: "PutRole",
+			Handler:    _SeaweedIdentityAccessManagement_PutRole_Handler,
+		},
+		{
+			MethodName: "GetRole",
+			Handler:    _SeaweedIdentityAccessManagement_GetRole_Handler,
+		},
+		{
+			MethodName: "DeleteRole",
+			Handler:    _SeaweedIdentityAccessManagement_DeleteRole_Handler,
+		},
+		{
+			MethodName: "ListRoles",
+			Handler:    _SeaweedIdentityAccessManagement_ListRoles_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "iam.proto",
diff --git a/weed/pb/local_socket_buffers.go b/weed/pb/local_socket_buffers.go
new file mode 100644
index 0000000000..3f7f426f35
--- /dev/null
+++ b/weed/pb/local_socket_buffers.go
@@ -0,0 +1,39 @@
+//go:build !windows
+
+package pb
+
+import (
+	"net"
+	"syscall"
+)
+
+// Unix socket buffers default small and never autotune (208KB on Linux, 8KB on
+// macOS). Once a buffer cannot absorb what gRPC's loopyWriter emits for the
+// in-flight streams the writer blocks, both peers latch grpc-go's control-buffer
+// throttle, and the connection deadlocks for good. Best effort: a value the OS
+// clamps down only lowers the concurrency this survives.
+const localSocketBufBytes = 8 << 20
+
+func setLocalSocketBufferFD(fd uintptr) {
+	syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_SNDBUF, localSocketBufBytes)
+	syscall.SetsockoptInt(int(fd), syscall.SOL_SOCKET, syscall.SO_RCVBUF, localSocketBufBytes)
+}
+
+func setLocalSocketBuffers(_, _ string, c syscall.RawConn) error {
+	return c.Control(setLocalSocketBufferFD)
+}
+
+// applyLocalSocketBuffers tunes an already-established connection. Linux does
+// not carry the listener's buffer sizes onto accepted sockets, so the server
+// half needs setting explicitly or only the dialing side gets the headroom.
+func applyLocalSocketBuffers(c net.Conn) {
+	sc, ok := c.(syscall.Conn)
+	if !ok {
+		return
+	}
+	raw, err := sc.SyscallConn()
+	if err != nil {
+		return
+	}
+	raw.Control(setLocalSocketBufferFD)
+}
diff --git a/weed/pb/local_socket_buffers_windows.go b/weed/pb/local_socket_buffers_windows.go
new file mode 100644
index 0000000000..b847c5c1a3
--- /dev/null
+++ b/weed/pb/local_socket_buffers_windows.go
@@ -0,0 +1,13 @@
+//go:build windows
+
+package pb
+
+import (
+	"net"
+	"syscall"
+)
+
+// Windows never registers local Unix sockets, so there is nothing to tune.
+func setLocalSocketBuffers(_, _ string, _ syscall.RawConn) error { return nil }
+
+func applyLocalSocketBuffers(_ net.Conn) {}
diff --git a/weed/pb/master.proto b/weed/pb/master.proto
index 37ee52a800..d1cf3dd342 100644
--- a/weed/pb/master.proto
+++ b/weed/pb/master.proto
@@ -27,6 +27,8 @@ service Seaweed {
   }
   rpc VolumeList (VolumeListRequest) returns (VolumeListResponse) {
   }
+  rpc VolumeListStream (VolumeListRequest) returns (stream VolumeListStreamResponse) {
+  }
   rpc LookupEcVolume (LookupEcVolumeRequest) returns (LookupEcVolumeResponse) {
   }
   rpc VacuumVolume (VacuumVolumeRequest) returns (VacuumVolumeResponse) {
@@ -57,6 +59,8 @@ service Seaweed {
   }
   rpc RaftLeadershipTransfer (RaftLeadershipTransferRequest) returns (RaftLeadershipTransferResponse) {
   }
+  rpc ResumeVolumeGrowth (ResumeVolumeGrowthRequest) returns (ResumeVolumeGrowthResponse) {
+  }
   rpc VolumeGrow (VolumeGrowRequest) returns (VolumeGrowResponse) {
   }
   rpc CollectionStatistics (CollectionStatisticsRequest) returns (CollectionStatisticsResponse) {
@@ -117,6 +121,12 @@ message Heartbeat {
   // place of `volumes`. A master that does not understand this never sets
   // volume_digest_supported, so it keeps being sent the whole list.
   repeated VolumeInformationMessage changed_volumes = 28;
+
+  // Highest volume id this server has ever observed, persisted locally. Fed
+  // by HeartbeatResponse.max_volume_id echoes and by AllocateVolume requests.
+  uint32 max_volume_id_seen = 29;
+  // Topology id of the master cluster this server last heartbeated to.
+  string last_seen_topology_id = 30;
 }
 
 message HeartbeatResponse {
@@ -133,6 +143,12 @@ message HeartbeatResponse {
   // The master compares volume digests, so a server that reports one may send
   // changed_volumes in place of its whole list.
   bool volume_digest_supported = 9;
+  // The leader's current allocation bound; servers persist it and report it
+  // back as max_volume_id_seen so the bound survives master state loss.
+  uint32 max_volume_id = 10;
+  // The leader's cluster identity; a different value reported back later
+  // means the master's state was rebuilt.
+  string topology_id = 11;
 }
 
 message VolumeInformationMessage {
@@ -143,6 +159,7 @@ message VolumeInformationMessage {
   uint64 delete_count = 5;
   uint64 deleted_byte_count = 6;
   bool read_only = 7;
+  bool read_only_can_delete = 17;
   uint32 replica_placement = 8;
   uint32 version = 9;
   uint32 ttl = 10;
@@ -162,6 +179,8 @@ message VolumeShortInformationMessage {
   uint32 ttl = 10;
   string disk_type = 15;
   uint32 disk_id = 16;
+  bool read_only = 17;
+  bool read_only_can_delete = 18;
 }
 
 message VolumeEcShardInformationMessage {
@@ -208,6 +227,9 @@ message KeepConnectedRequest {
   string filer_group = 5;
   string data_center = 6;
   string rack = 7;
+  // A draining filer leaves the lock ring but stays a cluster member, so peers
+  // keep following its metadata until the stream closes.
+  bool leave_lock_ring = 8;
 }
 
 message VolumeLocation {
@@ -220,6 +242,9 @@ message VolumeLocation {
   uint32 grpc_port = 7;
   repeated uint32 new_ec_vids = 8;
   repeated uint32 deleted_ec_vids = 9;
+  repeated uint32 remote_vids = 10;
+  repeated uint32 read_only_vids = 11;
+  repeated uint32 read_only_can_delete_vids = 12;
 }
 
 message ClusterNodeUpdate {
@@ -265,6 +290,9 @@ message Location {
   string public_url = 2;
   uint32 grpc_port = 3;
   string data_center = 4;
+  bool data_in_remote = 5;
+  bool read_only = 6;
+  bool read_only_can_delete = 7;
 }
 
 message AssignRequest {
@@ -291,6 +319,18 @@ message VolumeGrowRequest {
   string data_node = 7;
   uint32 memory_map_max_size_mb = 8;
   string disk_type = 9;
+  // If > 0, grow only when the average fill ratio of the layout's writable
+  // volumes has reached this threshold (e.g. 0.6). Lets callers pre-grow on
+  // fill level with one call, instead of listing volumes to compute the
+  // ratio themselves. Ignored when there are no writable volumes.
+  float grow_avg_fill_threshold = 10;
+}
+
+message ResumeVolumeGrowthRequest {
+}
+
+message ResumeVolumeGrowthResponse {
+  bool was_frozen = 1;
 }
 
 message AssignResponse {
@@ -406,12 +446,44 @@ message TopologyInfo {
   map<string, DiskInfo> diskInfos = 3;
 }
 message VolumeListRequest {
+  // Empty and zero take everything. Only the volumes and ec shards listed
+  // under a disk are selected; the topology and its disk counters are always
+  // reported in full.
+  string collection = 1;
+  repeated uint32 volume_ids = 2;
+  // The one collection the empty string cannot name. A named collection wins.
+  bool default_collection_only = 3;
+  // Empty and zero take everything. Wildcards are supported.
+  string remote_storage_name = 4;
+  bool local_volume_only = 5;
+  // The topology, its disks and their counters alone, without the volumes
+  // and ec shards. Selecting volumes above contradicts this and is refused.
+  // A master that predates this field ignores it and answers in full.
+  bool topology_only = 6;
 }
 message VolumeListResponse {
   TopologyInfo topology_info = 1;
   uint64 volume_size_limit_mb = 2;
 }
 
+// VolumeListStream answers the same request as VolumeList without either end
+// holding every volume in the cluster at once. At 800k volumes the reply is
+// 36MB on the wire but 305MB as messages, which the master built in full
+// before sending any of it.
+message VolumeListStreamResponse {
+  // Sent once, first, listing no volumes: the topology, its disks and their
+  // counters. Every message after carries volumes for one of those disks.
+  VolumeListResponse header = 1;
+  // Which disk this batch is from. A disk arrives over as many batches as it
+  // takes, so append rather than assign.
+  string data_center = 2;
+  string rack = 3;
+  string data_node = 4;
+  string disk_type = 5;
+  repeated VolumeInformationMessage volume_infos = 6;
+  repeated VolumeEcShardInformationMessage ec_shard_infos = 7;
+}
+
 message LookupEcVolumeRequest {
   uint32 volume_id = 1;
 }
@@ -565,4 +637,9 @@ message RaftLeadershipTransferResponse {
 }
 
 message VolumeGrowResponse {
+  // Average fill ratio of the layout's writable volumes at request time
+  // (0 when there are none). Reported whether or not growth was triggered.
+  float avg_fill = 1;
+  // Number of writable volumes at request time.
+  uint32 writable_count = 2;
 }
diff --git a/weed/pb/master_pb/master.pb.go b/weed/pb/master_pb/master.pb.go
index 45bf1606d9..d507d81da6 100644
--- a/weed/pb/master_pb/master.pb.go
+++ b/weed/pb/master_pb/master.pb.go
@@ -130,8 +130,13 @@ type Heartbeat struct {
 	// place of `volumes`. A master that does not understand this never sets
 	// volume_digest_supported, so it keeps being sent the whole list.
 	ChangedVolumes []*VolumeInformationMessage `protobuf:"bytes,28,rep,name=changed_volumes,json=changedVolumes,proto3" json:"changed_volumes,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// Highest volume id this server has ever observed, persisted locally. Fed
+	// by HeartbeatResponse.max_volume_id echoes and by AllocateVolume requests.
+	MaxVolumeIdSeen uint32 `protobuf:"varint,29,opt,name=max_volume_id_seen,json=maxVolumeIdSeen,proto3" json:"max_volume_id_seen,omitempty"`
+	// Topology id of the master cluster this server last heartbeated to.
+	LastSeenTopologyId string `protobuf:"bytes,30,opt,name=last_seen_topology_id,json=lastSeenTopologyId,proto3" json:"last_seen_topology_id,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
 }
 
 func (x *Heartbeat) Reset() {
@@ -339,6 +344,20 @@ func (x *Heartbeat) GetChangedVolumes() []*VolumeInformationMessage {
 	return nil
 }
 
+func (x *Heartbeat) GetMaxVolumeIdSeen() uint32 {
+	if x != nil {
+		return x.MaxVolumeIdSeen
+	}
+	return 0
+}
+
+func (x *Heartbeat) GetLastSeenTopologyId() string {
+	if x != nil {
+		return x.LastSeenTopologyId
+	}
+	return ""
+}
+
 type HeartbeatResponse struct {
 	state                  protoimpl.MessageState `protogen:"open.v1"`
 	VolumeSizeLimit        uint64                 `protobuf:"varint,1,opt,name=volume_size_limit,json=volumeSizeLimit,proto3" json:"volume_size_limit,omitempty"`
@@ -354,8 +373,14 @@ type HeartbeatResponse struct {
 	// The master compares volume digests, so a server that reports one may send
 	// changed_volumes in place of its whole list.
 	VolumeDigestSupported bool `protobuf:"varint,9,opt,name=volume_digest_supported,json=volumeDigestSupported,proto3" json:"volume_digest_supported,omitempty"`
-	unknownFields         protoimpl.UnknownFields
-	sizeCache             protoimpl.SizeCache
+	// The leader's current allocation bound; servers persist it and report it
+	// back as max_volume_id_seen so the bound survives master state loss.
+	MaxVolumeId uint32 `protobuf:"varint,10,opt,name=max_volume_id,json=maxVolumeId,proto3" json:"max_volume_id,omitempty"`
+	// The leader's cluster identity; a different value reported back later
+	// means the master's state was rebuilt.
+	TopologyId    string `protobuf:"bytes,11,opt,name=topology_id,json=topologyId,proto3" json:"topology_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *HeartbeatResponse) Reset() {
@@ -451,6 +476,20 @@ func (x *HeartbeatResponse) GetVolumeDigestSupported() bool {
 	return false
 }
 
+func (x *HeartbeatResponse) GetMaxVolumeId() uint32 {
+	if x != nil {
+		return x.MaxVolumeId
+	}
+	return 0
+}
+
+func (x *HeartbeatResponse) GetTopologyId() string {
+	if x != nil {
+		return x.TopologyId
+	}
+	return ""
+}
+
 type VolumeInformationMessage struct {
 	state             protoimpl.MessageState `protogen:"open.v1"`
 	Id                uint32                 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
@@ -460,6 +499,7 @@ type VolumeInformationMessage struct {
 	DeleteCount       uint64                 `protobuf:"varint,5,opt,name=delete_count,json=deleteCount,proto3" json:"delete_count,omitempty"`
 	DeletedByteCount  uint64                 `protobuf:"varint,6,opt,name=deleted_byte_count,json=deletedByteCount,proto3" json:"deleted_byte_count,omitempty"`
 	ReadOnly          bool                   `protobuf:"varint,7,opt,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
+	ReadOnlyCanDelete bool                   `protobuf:"varint,17,opt,name=read_only_can_delete,json=readOnlyCanDelete,proto3" json:"read_only_can_delete,omitempty"`
 	ReplicaPlacement  uint32                 `protobuf:"varint,8,opt,name=replica_placement,json=replicaPlacement,proto3" json:"replica_placement,omitempty"`
 	Version           uint32                 `protobuf:"varint,9,opt,name=version,proto3" json:"version,omitempty"`
 	Ttl               uint32                 `protobuf:"varint,10,opt,name=ttl,proto3" json:"ttl,omitempty"`
@@ -552,6 +592,13 @@ func (x *VolumeInformationMessage) GetReadOnly() bool {
 	return false
 }
 
+func (x *VolumeInformationMessage) GetReadOnlyCanDelete() bool {
+	if x != nil {
+		return x.ReadOnlyCanDelete
+	}
+	return false
+}
+
 func (x *VolumeInformationMessage) GetReplicaPlacement() uint32 {
 	if x != nil {
 		return x.ReplicaPlacement
@@ -616,16 +663,18 @@ func (x *VolumeInformationMessage) GetDiskId() uint32 {
 }
 
 type VolumeShortInformationMessage struct {
-	state            protoimpl.MessageState `protogen:"open.v1"`
-	Id               uint32                 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	Collection       string                 `protobuf:"bytes,3,opt,name=collection,proto3" json:"collection,omitempty"`
-	ReplicaPlacement uint32                 `protobuf:"varint,8,opt,name=replica_placement,json=replicaPlacement,proto3" json:"replica_placement,omitempty"`
-	Version          uint32                 `protobuf:"varint,9,opt,name=version,proto3" json:"version,omitempty"`
-	Ttl              uint32                 `protobuf:"varint,10,opt,name=ttl,proto3" json:"ttl,omitempty"`
-	DiskType         string                 `protobuf:"bytes,15,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`
-	DiskId           uint32                 `protobuf:"varint,16,opt,name=disk_id,json=diskId,proto3" json:"disk_id,omitempty"`
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Id                uint32                 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Collection        string                 `protobuf:"bytes,3,opt,name=collection,proto3" json:"collection,omitempty"`
+	ReplicaPlacement  uint32                 `protobuf:"varint,8,opt,name=replica_placement,json=replicaPlacement,proto3" json:"replica_placement,omitempty"`
+	Version           uint32                 `protobuf:"varint,9,opt,name=version,proto3" json:"version,omitempty"`
+	Ttl               uint32                 `protobuf:"varint,10,opt,name=ttl,proto3" json:"ttl,omitempty"`
+	DiskType          string                 `protobuf:"bytes,15,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`
+	DiskId            uint32                 `protobuf:"varint,16,opt,name=disk_id,json=diskId,proto3" json:"disk_id,omitempty"`
+	ReadOnly          bool                   `protobuf:"varint,17,opt,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
+	ReadOnlyCanDelete bool                   `protobuf:"varint,18,opt,name=read_only_can_delete,json=readOnlyCanDelete,proto3" json:"read_only_can_delete,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *VolumeShortInformationMessage) Reset() {
@@ -707,6 +756,20 @@ func (x *VolumeShortInformationMessage) GetDiskId() uint32 {
 	return 0
 }
 
+func (x *VolumeShortInformationMessage) GetReadOnly() bool {
+	if x != nil {
+		return x.ReadOnly
+	}
+	return false
+}
+
+func (x *VolumeShortInformationMessage) GetReadOnlyCanDelete() bool {
+	if x != nil {
+		return x.ReadOnlyCanDelete
+	}
+	return false
+}
+
 type VolumeEcShardInformationMessage struct {
 	state       protoimpl.MessageState `protogen:"open.v1"`
 	Id          uint32                 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
@@ -974,6 +1037,9 @@ type KeepConnectedRequest struct {
 	FilerGroup    string                 `protobuf:"bytes,5,opt,name=filer_group,json=filerGroup,proto3" json:"filer_group,omitempty"`
 	DataCenter    string                 `protobuf:"bytes,6,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"`
 	Rack          string                 `protobuf:"bytes,7,opt,name=rack,proto3" json:"rack,omitempty"`
+	// A draining filer leaves the lock ring but stays a cluster member, so peers
+	// keep following its metadata until the stream closes.
+	LeaveLockRing bool `protobuf:"varint,8,opt,name=leave_lock_ring,json=leaveLockRing,proto3" json:"leave_lock_ring,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1050,19 +1116,29 @@ func (x *KeepConnectedRequest) GetRack() string {
 	return ""
 }
 
+func (x *KeepConnectedRequest) GetLeaveLockRing() bool {
+	if x != nil {
+		return x.LeaveLockRing
+	}
+	return false
+}
+
 type VolumeLocation struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Url           string                 `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	PublicUrl     string                 `protobuf:"bytes,2,opt,name=public_url,json=publicUrl,proto3" json:"public_url,omitempty"`
-	NewVids       []uint32               `protobuf:"varint,3,rep,packed,name=new_vids,json=newVids,proto3" json:"new_vids,omitempty"`
-	DeletedVids   []uint32               `protobuf:"varint,4,rep,packed,name=deleted_vids,json=deletedVids,proto3" json:"deleted_vids,omitempty"`
-	Leader        string                 `protobuf:"bytes,5,opt,name=leader,proto3" json:"leader,omitempty"`                           // optional when leader is not itself
-	DataCenter    string                 `protobuf:"bytes,6,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"` // optional when DataCenter is in use
-	GrpcPort      uint32                 `protobuf:"varint,7,opt,name=grpc_port,json=grpcPort,proto3" json:"grpc_port,omitempty"`
-	NewEcVids     []uint32               `protobuf:"varint,8,rep,packed,name=new_ec_vids,json=newEcVids,proto3" json:"new_ec_vids,omitempty"`
-	DeletedEcVids []uint32               `protobuf:"varint,9,rep,packed,name=deleted_ec_vids,json=deletedEcVids,proto3" json:"deleted_ec_vids,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state                 protoimpl.MessageState `protogen:"open.v1"`
+	Url                   string                 `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	PublicUrl             string                 `protobuf:"bytes,2,opt,name=public_url,json=publicUrl,proto3" json:"public_url,omitempty"`
+	NewVids               []uint32               `protobuf:"varint,3,rep,packed,name=new_vids,json=newVids,proto3" json:"new_vids,omitempty"`
+	DeletedVids           []uint32               `protobuf:"varint,4,rep,packed,name=deleted_vids,json=deletedVids,proto3" json:"deleted_vids,omitempty"`
+	Leader                string                 `protobuf:"bytes,5,opt,name=leader,proto3" json:"leader,omitempty"`                           // optional when leader is not itself
+	DataCenter            string                 `protobuf:"bytes,6,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"` // optional when DataCenter is in use
+	GrpcPort              uint32                 `protobuf:"varint,7,opt,name=grpc_port,json=grpcPort,proto3" json:"grpc_port,omitempty"`
+	NewEcVids             []uint32               `protobuf:"varint,8,rep,packed,name=new_ec_vids,json=newEcVids,proto3" json:"new_ec_vids,omitempty"`
+	DeletedEcVids         []uint32               `protobuf:"varint,9,rep,packed,name=deleted_ec_vids,json=deletedEcVids,proto3" json:"deleted_ec_vids,omitempty"`
+	RemoteVids            []uint32               `protobuf:"varint,10,rep,packed,name=remote_vids,json=remoteVids,proto3" json:"remote_vids,omitempty"`
+	ReadOnlyVids          []uint32               `protobuf:"varint,11,rep,packed,name=read_only_vids,json=readOnlyVids,proto3" json:"read_only_vids,omitempty"`
+	ReadOnlyCanDeleteVids []uint32               `protobuf:"varint,12,rep,packed,name=read_only_can_delete_vids,json=readOnlyCanDeleteVids,proto3" json:"read_only_can_delete_vids,omitempty"`
+	unknownFields         protoimpl.UnknownFields
+	sizeCache             protoimpl.SizeCache
 }
 
 func (x *VolumeLocation) Reset() {
@@ -1158,6 +1234,27 @@ func (x *VolumeLocation) GetDeletedEcVids() []uint32 {
 	return nil
 }
 
+func (x *VolumeLocation) GetRemoteVids() []uint32 {
+	if x != nil {
+		return x.RemoteVids
+	}
+	return nil
+}
+
+func (x *VolumeLocation) GetReadOnlyVids() []uint32 {
+	if x != nil {
+		return x.ReadOnlyVids
+	}
+	return nil
+}
+
+func (x *VolumeLocation) GetReadOnlyCanDeleteVids() []uint32 {
+	if x != nil {
+		return x.ReadOnlyCanDeleteVids
+	}
+	return nil
+}
+
 type ClusterNodeUpdate struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	NodeType      string                 `protobuf:"bytes,1,opt,name=node_type,json=nodeType,proto3" json:"node_type,omitempty"`
@@ -1455,13 +1552,16 @@ func (x *LookupVolumeResponse) GetVolumeIdLocations() []*LookupVolumeResponse_Vo
 }
 
 type Location struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Url           string                 `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
-	PublicUrl     string                 `protobuf:"bytes,2,opt,name=public_url,json=publicUrl,proto3" json:"public_url,omitempty"`
-	GrpcPort      uint32                 `protobuf:"varint,3,opt,name=grpc_port,json=grpcPort,proto3" json:"grpc_port,omitempty"`
-	DataCenter    string                 `protobuf:"bytes,4,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Url               string                 `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	PublicUrl         string                 `protobuf:"bytes,2,opt,name=public_url,json=publicUrl,proto3" json:"public_url,omitempty"`
+	GrpcPort          uint32                 `protobuf:"varint,3,opt,name=grpc_port,json=grpcPort,proto3" json:"grpc_port,omitempty"`
+	DataCenter        string                 `protobuf:"bytes,4,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"`
+	DataInRemote      bool                   `protobuf:"varint,5,opt,name=data_in_remote,json=dataInRemote,proto3" json:"data_in_remote,omitempty"`
+	ReadOnly          bool                   `protobuf:"varint,6,opt,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
+	ReadOnlyCanDelete bool                   `protobuf:"varint,7,opt,name=read_only_can_delete,json=readOnlyCanDelete,proto3" json:"read_only_can_delete,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *Location) Reset() {
@@ -1522,6 +1622,27 @@ func (x *Location) GetDataCenter() string {
 	return ""
 }
 
+func (x *Location) GetDataInRemote() bool {
+	if x != nil {
+		return x.DataInRemote
+	}
+	return false
+}
+
+func (x *Location) GetReadOnly() bool {
+	if x != nil {
+		return x.ReadOnly
+	}
+	return false
+}
+
+func (x *Location) GetReadOnlyCanDelete() bool {
+	if x != nil {
+		return x.ReadOnlyCanDelete
+	}
+	return false
+}
+
 type AssignRequest struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Count               uint64                 `protobuf:"varint,1,opt,name=count,proto3" json:"count,omitempty"`
@@ -1657,8 +1778,13 @@ type VolumeGrowRequest struct {
 	DataNode            string                 `protobuf:"bytes,7,opt,name=data_node,json=dataNode,proto3" json:"data_node,omitempty"`
 	MemoryMapMaxSizeMb  uint32                 `protobuf:"varint,8,opt,name=memory_map_max_size_mb,json=memoryMapMaxSizeMb,proto3" json:"memory_map_max_size_mb,omitempty"`
 	DiskType            string                 `protobuf:"bytes,9,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`
-	unknownFields       protoimpl.UnknownFields
-	sizeCache           protoimpl.SizeCache
+	// If > 0, grow only when the average fill ratio of the layout's writable
+	// volumes has reached this threshold (e.g. 0.6). Lets callers pre-grow on
+	// fill level with one call, instead of listing volumes to compute the
+	// ratio themselves. Ignored when there are no writable volumes.
+	GrowAvgFillThreshold float32 `protobuf:"fixed32,10,opt,name=grow_avg_fill_threshold,json=growAvgFillThreshold,proto3" json:"grow_avg_fill_threshold,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *VolumeGrowRequest) Reset() {
@@ -1754,6 +1880,93 @@ func (x *VolumeGrowRequest) GetDiskType() string {
 	return ""
 }
 
+func (x *VolumeGrowRequest) GetGrowAvgFillThreshold() float32 {
+	if x != nil {
+		return x.GrowAvgFillThreshold
+	}
+	return 0
+}
+
+type ResumeVolumeGrowthRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ResumeVolumeGrowthRequest) Reset() {
+	*x = ResumeVolumeGrowthRequest{}
+	mi := &file_master_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ResumeVolumeGrowthRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResumeVolumeGrowthRequest) ProtoMessage() {}
+
+func (x *ResumeVolumeGrowthRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_master_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResumeVolumeGrowthRequest.ProtoReflect.Descriptor instead.
+func (*ResumeVolumeGrowthRequest) Descriptor() ([]byte, []int) {
+	return file_master_proto_rawDescGZIP(), []int{19}
+}
+
+type ResumeVolumeGrowthResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	WasFrozen     bool                   `protobuf:"varint,1,opt,name=was_frozen,json=wasFrozen,proto3" json:"was_frozen,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ResumeVolumeGrowthResponse) Reset() {
+	*x = ResumeVolumeGrowthResponse{}
+	mi := &file_master_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ResumeVolumeGrowthResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResumeVolumeGrowthResponse) ProtoMessage() {}
+
+func (x *ResumeVolumeGrowthResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_master_proto_msgTypes[20]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResumeVolumeGrowthResponse.ProtoReflect.Descriptor instead.
+func (*ResumeVolumeGrowthResponse) Descriptor() ([]byte, []int) {
+	return file_master_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *ResumeVolumeGrowthResponse) GetWasFrozen() bool {
+	if x != nil {
+		return x.WasFrozen
+	}
+	return false
+}
+
 type AssignResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Fid           string                 `protobuf:"bytes,1,opt,name=fid,proto3" json:"fid,omitempty"`
@@ -1768,7 +1981,7 @@ type AssignResponse struct {
 
 func (x *AssignResponse) Reset() {
 	*x = AssignResponse{}
-	mi := &file_master_proto_msgTypes[19]
+	mi := &file_master_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1780,7 +1993,7 @@ func (x *AssignResponse) String() string {
 func (*AssignResponse) ProtoMessage() {}
 
 func (x *AssignResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[19]
+	mi := &file_master_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1793,7 +2006,7 @@ func (x *AssignResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AssignResponse.ProtoReflect.Descriptor instead.
 func (*AssignResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{19}
+	return file_master_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *AssignResponse) GetFid() string {
@@ -1850,7 +2063,7 @@ type StatisticsRequest struct {
 
 func (x *StatisticsRequest) Reset() {
 	*x = StatisticsRequest{}
-	mi := &file_master_proto_msgTypes[20]
+	mi := &file_master_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1862,7 +2075,7 @@ func (x *StatisticsRequest) String() string {
 func (*StatisticsRequest) ProtoMessage() {}
 
 func (x *StatisticsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[20]
+	mi := &file_master_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1875,7 +2088,7 @@ func (x *StatisticsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StatisticsRequest.ProtoReflect.Descriptor instead.
 func (*StatisticsRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{20}
+	return file_master_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *StatisticsRequest) GetReplication() string {
@@ -1922,7 +2135,7 @@ type StatisticsResponse struct {
 
 func (x *StatisticsResponse) Reset() {
 	*x = StatisticsResponse{}
-	mi := &file_master_proto_msgTypes[21]
+	mi := &file_master_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1934,7 +2147,7 @@ func (x *StatisticsResponse) String() string {
 func (*StatisticsResponse) ProtoMessage() {}
 
 func (x *StatisticsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[21]
+	mi := &file_master_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1947,7 +2160,7 @@ func (x *StatisticsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StatisticsResponse.ProtoReflect.Descriptor instead.
 func (*StatisticsResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{21}
+	return file_master_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *StatisticsResponse) GetTotalSize() uint64 {
@@ -1995,7 +2208,7 @@ type Collection struct {
 
 func (x *Collection) Reset() {
 	*x = Collection{}
-	mi := &file_master_proto_msgTypes[22]
+	mi := &file_master_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2007,7 +2220,7 @@ func (x *Collection) String() string {
 func (*Collection) ProtoMessage() {}
 
 func (x *Collection) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[22]
+	mi := &file_master_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2020,7 +2233,7 @@ func (x *Collection) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Collection.ProtoReflect.Descriptor instead.
 func (*Collection) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{22}
+	return file_master_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *Collection) GetName() string {
@@ -2040,7 +2253,7 @@ type CollectionListRequest struct {
 
 func (x *CollectionListRequest) Reset() {
 	*x = CollectionListRequest{}
-	mi := &file_master_proto_msgTypes[23]
+	mi := &file_master_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2052,7 +2265,7 @@ func (x *CollectionListRequest) String() string {
 func (*CollectionListRequest) ProtoMessage() {}
 
 func (x *CollectionListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[23]
+	mi := &file_master_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2065,7 +2278,7 @@ func (x *CollectionListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionListRequest.ProtoReflect.Descriptor instead.
 func (*CollectionListRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{23}
+	return file_master_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *CollectionListRequest) GetIncludeNormalVolumes() bool {
@@ -2091,7 +2304,7 @@ type CollectionListResponse struct {
 
 func (x *CollectionListResponse) Reset() {
 	*x = CollectionListResponse{}
-	mi := &file_master_proto_msgTypes[24]
+	mi := &file_master_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2103,7 +2316,7 @@ func (x *CollectionListResponse) String() string {
 func (*CollectionListResponse) ProtoMessage() {}
 
 func (x *CollectionListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[24]
+	mi := &file_master_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2116,7 +2329,7 @@ func (x *CollectionListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionListResponse.ProtoReflect.Descriptor instead.
 func (*CollectionListResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{24}
+	return file_master_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *CollectionListResponse) GetCollections() []*Collection {
@@ -2136,7 +2349,7 @@ type CollectionStatisticsRequest struct {
 
 func (x *CollectionStatisticsRequest) Reset() {
 	*x = CollectionStatisticsRequest{}
-	mi := &file_master_proto_msgTypes[25]
+	mi := &file_master_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2148,7 +2361,7 @@ func (x *CollectionStatisticsRequest) String() string {
 func (*CollectionStatisticsRequest) ProtoMessage() {}
 
 func (x *CollectionStatisticsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[25]
+	mi := &file_master_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2161,7 +2374,7 @@ func (x *CollectionStatisticsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionStatisticsRequest.ProtoReflect.Descriptor instead.
 func (*CollectionStatisticsRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{25}
+	return file_master_proto_rawDescGZIP(), []int{27}
 }
 
 type CollectionStatisticsResponse struct {
@@ -2173,7 +2386,7 @@ type CollectionStatisticsResponse struct {
 
 func (x *CollectionStatisticsResponse) Reset() {
 	*x = CollectionStatisticsResponse{}
-	mi := &file_master_proto_msgTypes[26]
+	mi := &file_master_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2185,7 +2398,7 @@ func (x *CollectionStatisticsResponse) String() string {
 func (*CollectionStatisticsResponse) ProtoMessage() {}
 
 func (x *CollectionStatisticsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[26]
+	mi := &file_master_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2198,7 +2411,7 @@ func (x *CollectionStatisticsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionStatisticsResponse.ProtoReflect.Descriptor instead.
 func (*CollectionStatisticsResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{26}
+	return file_master_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *CollectionStatisticsResponse) GetCollections() []*CollectionStatistics {
@@ -2226,7 +2439,7 @@ type CollectionStatistics struct {
 
 func (x *CollectionStatistics) Reset() {
 	*x = CollectionStatistics{}
-	mi := &file_master_proto_msgTypes[27]
+	mi := &file_master_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2238,7 +2451,7 @@ func (x *CollectionStatistics) String() string {
 func (*CollectionStatistics) ProtoMessage() {}
 
 func (x *CollectionStatistics) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[27]
+	mi := &file_master_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2251,7 +2464,7 @@ func (x *CollectionStatistics) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionStatistics.ProtoReflect.Descriptor instead.
 func (*CollectionStatistics) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{27}
+	return file_master_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *CollectionStatistics) GetCollection() string {
@@ -2312,7 +2525,7 @@ type CollectionDeleteRequest struct {
 
 func (x *CollectionDeleteRequest) Reset() {
 	*x = CollectionDeleteRequest{}
-	mi := &file_master_proto_msgTypes[28]
+	mi := &file_master_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2324,7 +2537,7 @@ func (x *CollectionDeleteRequest) String() string {
 func (*CollectionDeleteRequest) ProtoMessage() {}
 
 func (x *CollectionDeleteRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[28]
+	mi := &file_master_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2337,7 +2550,7 @@ func (x *CollectionDeleteRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionDeleteRequest.ProtoReflect.Descriptor instead.
 func (*CollectionDeleteRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{28}
+	return file_master_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *CollectionDeleteRequest) GetName() string {
@@ -2355,7 +2568,7 @@ type CollectionDeleteResponse struct {
 
 func (x *CollectionDeleteResponse) Reset() {
 	*x = CollectionDeleteResponse{}
-	mi := &file_master_proto_msgTypes[29]
+	mi := &file_master_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2367,7 +2580,7 @@ func (x *CollectionDeleteResponse) String() string {
 func (*CollectionDeleteResponse) ProtoMessage() {}
 
 func (x *CollectionDeleteResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[29]
+	mi := &file_master_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2380,7 +2593,7 @@ func (x *CollectionDeleteResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CollectionDeleteResponse.ProtoReflect.Descriptor instead.
 func (*CollectionDeleteResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{29}
+	return file_master_proto_rawDescGZIP(), []int{31}
 }
 
 // volume related
@@ -2412,7 +2625,7 @@ type DiskInfo struct {
 
 func (x *DiskInfo) Reset() {
 	*x = DiskInfo{}
-	mi := &file_master_proto_msgTypes[30]
+	mi := &file_master_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2424,7 +2637,7 @@ func (x *DiskInfo) String() string {
 func (*DiskInfo) ProtoMessage() {}
 
 func (x *DiskInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[30]
+	mi := &file_master_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2437,7 +2650,7 @@ func (x *DiskInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DiskInfo.ProtoReflect.Descriptor instead.
 func (*DiskInfo) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{30}
+	return file_master_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *DiskInfo) GetType() string {
@@ -2543,7 +2756,7 @@ type DataNodeInfo struct {
 
 func (x *DataNodeInfo) Reset() {
 	*x = DataNodeInfo{}
-	mi := &file_master_proto_msgTypes[31]
+	mi := &file_master_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2555,7 +2768,7 @@ func (x *DataNodeInfo) String() string {
 func (*DataNodeInfo) ProtoMessage() {}
 
 func (x *DataNodeInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[31]
+	mi := &file_master_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2568,7 +2781,7 @@ func (x *DataNodeInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DataNodeInfo.ProtoReflect.Descriptor instead.
 func (*DataNodeInfo) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{31}
+	return file_master_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *DataNodeInfo) GetId() string {
@@ -2610,7 +2823,7 @@ type RackInfo struct {
 
 func (x *RackInfo) Reset() {
 	*x = RackInfo{}
-	mi := &file_master_proto_msgTypes[32]
+	mi := &file_master_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2622,7 +2835,7 @@ func (x *RackInfo) String() string {
 func (*RackInfo) ProtoMessage() {}
 
 func (x *RackInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[32]
+	mi := &file_master_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2635,7 +2848,7 @@ func (x *RackInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RackInfo.ProtoReflect.Descriptor instead.
 func (*RackInfo) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{32}
+	return file_master_proto_rawDescGZIP(), []int{34}
 }
 
 func (x *RackInfo) GetId() string {
@@ -2670,7 +2883,7 @@ type DataCenterInfo struct {
 
 func (x *DataCenterInfo) Reset() {
 	*x = DataCenterInfo{}
-	mi := &file_master_proto_msgTypes[33]
+	mi := &file_master_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2682,7 +2895,7 @@ func (x *DataCenterInfo) String() string {
 func (*DataCenterInfo) ProtoMessage() {}
 
 func (x *DataCenterInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[33]
+	mi := &file_master_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2695,7 +2908,7 @@ func (x *DataCenterInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DataCenterInfo.ProtoReflect.Descriptor instead.
 func (*DataCenterInfo) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{33}
+	return file_master_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *DataCenterInfo) GetId() string {
@@ -2730,7 +2943,7 @@ type TopologyInfo struct {
 
 func (x *TopologyInfo) Reset() {
 	*x = TopologyInfo{}
-	mi := &file_master_proto_msgTypes[34]
+	mi := &file_master_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2742,7 +2955,7 @@ func (x *TopologyInfo) String() string {
 func (*TopologyInfo) ProtoMessage() {}
 
 func (x *TopologyInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[34]
+	mi := &file_master_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2755,7 +2968,7 @@ func (x *TopologyInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use TopologyInfo.ProtoReflect.Descriptor instead.
 func (*TopologyInfo) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{34}
+	return file_master_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *TopologyInfo) GetId() string {
@@ -2780,14 +2993,28 @@ func (x *TopologyInfo) GetDiskInfos() map[string]*DiskInfo {
 }
 
 type VolumeListRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Empty and zero take everything. Only the volumes and ec shards listed
+	// under a disk are selected; the topology and its disk counters are always
+	// reported in full.
+	Collection string   `protobuf:"bytes,1,opt,name=collection,proto3" json:"collection,omitempty"`
+	VolumeIds  []uint32 `protobuf:"varint,2,rep,packed,name=volume_ids,json=volumeIds,proto3" json:"volume_ids,omitempty"`
+	// The one collection the empty string cannot name. A named collection wins.
+	DefaultCollectionOnly bool `protobuf:"varint,3,opt,name=default_collection_only,json=defaultCollectionOnly,proto3" json:"default_collection_only,omitempty"`
+	// Empty and zero take everything. Wildcards are supported.
+	RemoteStorageName string `protobuf:"bytes,4,opt,name=remote_storage_name,json=remoteStorageName,proto3" json:"remote_storage_name,omitempty"`
+	LocalVolumeOnly   bool   `protobuf:"varint,5,opt,name=local_volume_only,json=localVolumeOnly,proto3" json:"local_volume_only,omitempty"`
+	// The topology, its disks and their counters alone, without the volumes
+	// and ec shards. Selecting volumes above contradicts this and is refused.
+	// A master that predates this field ignores it and answers in full.
+	TopologyOnly  bool `protobuf:"varint,6,opt,name=topology_only,json=topologyOnly,proto3" json:"topology_only,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VolumeListRequest) Reset() {
 	*x = VolumeListRequest{}
-	mi := &file_master_proto_msgTypes[35]
+	mi := &file_master_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2799,7 +3026,7 @@ func (x *VolumeListRequest) String() string {
 func (*VolumeListRequest) ProtoMessage() {}
 
 func (x *VolumeListRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[35]
+	mi := &file_master_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2812,7 +3039,49 @@ func (x *VolumeListRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VolumeListRequest.ProtoReflect.Descriptor instead.
 func (*VolumeListRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{35}
+	return file_master_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *VolumeListRequest) GetCollection() string {
+	if x != nil {
+		return x.Collection
+	}
+	return ""
+}
+
+func (x *VolumeListRequest) GetVolumeIds() []uint32 {
+	if x != nil {
+		return x.VolumeIds
+	}
+	return nil
+}
+
+func (x *VolumeListRequest) GetDefaultCollectionOnly() bool {
+	if x != nil {
+		return x.DefaultCollectionOnly
+	}
+	return false
+}
+
+func (x *VolumeListRequest) GetRemoteStorageName() string {
+	if x != nil {
+		return x.RemoteStorageName
+	}
+	return ""
+}
+
+func (x *VolumeListRequest) GetLocalVolumeOnly() bool {
+	if x != nil {
+		return x.LocalVolumeOnly
+	}
+	return false
+}
+
+func (x *VolumeListRequest) GetTopologyOnly() bool {
+	if x != nil {
+		return x.TopologyOnly
+	}
+	return false
 }
 
 type VolumeListResponse struct {
@@ -2825,7 +3094,7 @@ type VolumeListResponse struct {
 
 func (x *VolumeListResponse) Reset() {
 	*x = VolumeListResponse{}
-	mi := &file_master_proto_msgTypes[36]
+	mi := &file_master_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2837,7 +3106,7 @@ func (x *VolumeListResponse) String() string {
 func (*VolumeListResponse) ProtoMessage() {}
 
 func (x *VolumeListResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[36]
+	mi := &file_master_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2850,7 +3119,7 @@ func (x *VolumeListResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VolumeListResponse.ProtoReflect.Descriptor instead.
 func (*VolumeListResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{36}
+	return file_master_proto_rawDescGZIP(), []int{38}
 }
 
 func (x *VolumeListResponse) GetTopologyInfo() *TopologyInfo {
@@ -2867,6 +3136,106 @@ func (x *VolumeListResponse) GetVolumeSizeLimitMb() uint64 {
 	return 0
 }
 
+// VolumeListStream answers the same request as VolumeList without either end
+// holding every volume in the cluster at once. At 800k volumes the reply is
+// 36MB on the wire but 305MB as messages, which the master built in full
+// before sending any of it.
+type VolumeListStreamResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Sent once, first, listing no volumes: the topology, its disks and their
+	// counters. Every message after carries volumes for one of those disks.
+	Header *VolumeListResponse `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"`
+	// Which disk this batch is from. A disk arrives over as many batches as it
+	// takes, so append rather than assign.
+	DataCenter    string                             `protobuf:"bytes,2,opt,name=data_center,json=dataCenter,proto3" json:"data_center,omitempty"`
+	Rack          string                             `protobuf:"bytes,3,opt,name=rack,proto3" json:"rack,omitempty"`
+	DataNode      string                             `protobuf:"bytes,4,opt,name=data_node,json=dataNode,proto3" json:"data_node,omitempty"`
+	DiskType      string                             `protobuf:"bytes,5,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`
+	VolumeInfos   []*VolumeInformationMessage        `protobuf:"bytes,6,rep,name=volume_infos,json=volumeInfos,proto3" json:"volume_infos,omitempty"`
+	EcShardInfos  []*VolumeEcShardInformationMessage `protobuf:"bytes,7,rep,name=ec_shard_infos,json=ecShardInfos,proto3" json:"ec_shard_infos,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VolumeListStreamResponse) Reset() {
+	*x = VolumeListStreamResponse{}
+	mi := &file_master_proto_msgTypes[39]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VolumeListStreamResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VolumeListStreamResponse) ProtoMessage() {}
+
+func (x *VolumeListStreamResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_master_proto_msgTypes[39]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VolumeListStreamResponse.ProtoReflect.Descriptor instead.
+func (*VolumeListStreamResponse) Descriptor() ([]byte, []int) {
+	return file_master_proto_rawDescGZIP(), []int{39}
+}
+
+func (x *VolumeListStreamResponse) GetHeader() *VolumeListResponse {
+	if x != nil {
+		return x.Header
+	}
+	return nil
+}
+
+func (x *VolumeListStreamResponse) GetDataCenter() string {
+	if x != nil {
+		return x.DataCenter
+	}
+	return ""
+}
+
+func (x *VolumeListStreamResponse) GetRack() string {
+	if x != nil {
+		return x.Rack
+	}
+	return ""
+}
+
+func (x *VolumeListStreamResponse) GetDataNode() string {
+	if x != nil {
+		return x.DataNode
+	}
+	return ""
+}
+
+func (x *VolumeListStreamResponse) GetDiskType() string {
+	if x != nil {
+		return x.DiskType
+	}
+	return ""
+}
+
+func (x *VolumeListStreamResponse) GetVolumeInfos() []*VolumeInformationMessage {
+	if x != nil {
+		return x.VolumeInfos
+	}
+	return nil
+}
+
+func (x *VolumeListStreamResponse) GetEcShardInfos() []*VolumeEcShardInformationMessage {
+	if x != nil {
+		return x.EcShardInfos
+	}
+	return nil
+}
+
 type LookupEcVolumeRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	VolumeId      uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
@@ -2876,7 +3245,7 @@ type LookupEcVolumeRequest struct {
 
 func (x *LookupEcVolumeRequest) Reset() {
 	*x = LookupEcVolumeRequest{}
-	mi := &file_master_proto_msgTypes[37]
+	mi := &file_master_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2888,7 +3257,7 @@ func (x *LookupEcVolumeRequest) String() string {
 func (*LookupEcVolumeRequest) ProtoMessage() {}
 
 func (x *LookupEcVolumeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[37]
+	mi := &file_master_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2901,7 +3270,7 @@ func (x *LookupEcVolumeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LookupEcVolumeRequest.ProtoReflect.Descriptor instead.
 func (*LookupEcVolumeRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{37}
+	return file_master_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *LookupEcVolumeRequest) GetVolumeId() uint32 {
@@ -2921,7 +3290,7 @@ type LookupEcVolumeResponse struct {
 
 func (x *LookupEcVolumeResponse) Reset() {
 	*x = LookupEcVolumeResponse{}
-	mi := &file_master_proto_msgTypes[38]
+	mi := &file_master_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2933,7 +3302,7 @@ func (x *LookupEcVolumeResponse) String() string {
 func (*LookupEcVolumeResponse) ProtoMessage() {}
 
 func (x *LookupEcVolumeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[38]
+	mi := &file_master_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2946,7 +3315,7 @@ func (x *LookupEcVolumeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LookupEcVolumeResponse.ProtoReflect.Descriptor instead.
 func (*LookupEcVolumeResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{38}
+	return file_master_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *LookupEcVolumeResponse) GetVolumeId() uint32 {
@@ -2974,7 +3343,7 @@ type VacuumVolumeRequest struct {
 
 func (x *VacuumVolumeRequest) Reset() {
 	*x = VacuumVolumeRequest{}
-	mi := &file_master_proto_msgTypes[39]
+	mi := &file_master_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2986,7 +3355,7 @@ func (x *VacuumVolumeRequest) String() string {
 func (*VacuumVolumeRequest) ProtoMessage() {}
 
 func (x *VacuumVolumeRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[39]
+	mi := &file_master_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2999,7 +3368,7 @@ func (x *VacuumVolumeRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VacuumVolumeRequest.ProtoReflect.Descriptor instead.
 func (*VacuumVolumeRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{39}
+	return file_master_proto_rawDescGZIP(), []int{42}
 }
 
 func (x *VacuumVolumeRequest) GetGarbageThreshold() float32 {
@@ -3031,7 +3400,7 @@ type VacuumVolumeResponse struct {
 
 func (x *VacuumVolumeResponse) Reset() {
 	*x = VacuumVolumeResponse{}
-	mi := &file_master_proto_msgTypes[40]
+	mi := &file_master_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3043,7 +3412,7 @@ func (x *VacuumVolumeResponse) String() string {
 func (*VacuumVolumeResponse) ProtoMessage() {}
 
 func (x *VacuumVolumeResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[40]
+	mi := &file_master_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3056,7 +3425,7 @@ func (x *VacuumVolumeResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VacuumVolumeResponse.ProtoReflect.Descriptor instead.
 func (*VacuumVolumeResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{40}
+	return file_master_proto_rawDescGZIP(), []int{43}
 }
 
 type DisableVacuumRequest struct {
@@ -3068,7 +3437,7 @@ type DisableVacuumRequest struct {
 
 func (x *DisableVacuumRequest) Reset() {
 	*x = DisableVacuumRequest{}
-	mi := &file_master_proto_msgTypes[41]
+	mi := &file_master_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3080,7 +3449,7 @@ func (x *DisableVacuumRequest) String() string {
 func (*DisableVacuumRequest) ProtoMessage() {}
 
 func (x *DisableVacuumRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[41]
+	mi := &file_master_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3093,7 +3462,7 @@ func (x *DisableVacuumRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DisableVacuumRequest.ProtoReflect.Descriptor instead.
 func (*DisableVacuumRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{41}
+	return file_master_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *DisableVacuumRequest) GetByPlugin() bool {
@@ -3111,7 +3480,7 @@ type DisableVacuumResponse struct {
 
 func (x *DisableVacuumResponse) Reset() {
 	*x = DisableVacuumResponse{}
-	mi := &file_master_proto_msgTypes[42]
+	mi := &file_master_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3123,7 +3492,7 @@ func (x *DisableVacuumResponse) String() string {
 func (*DisableVacuumResponse) ProtoMessage() {}
 
 func (x *DisableVacuumResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[42]
+	mi := &file_master_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3136,7 +3505,7 @@ func (x *DisableVacuumResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DisableVacuumResponse.ProtoReflect.Descriptor instead.
 func (*DisableVacuumResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{42}
+	return file_master_proto_rawDescGZIP(), []int{45}
 }
 
 type EnableVacuumRequest struct {
@@ -3148,7 +3517,7 @@ type EnableVacuumRequest struct {
 
 func (x *EnableVacuumRequest) Reset() {
 	*x = EnableVacuumRequest{}
-	mi := &file_master_proto_msgTypes[43]
+	mi := &file_master_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3160,7 +3529,7 @@ func (x *EnableVacuumRequest) String() string {
 func (*EnableVacuumRequest) ProtoMessage() {}
 
 func (x *EnableVacuumRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[43]
+	mi := &file_master_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3173,7 +3542,7 @@ func (x *EnableVacuumRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EnableVacuumRequest.ProtoReflect.Descriptor instead.
 func (*EnableVacuumRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{43}
+	return file_master_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *EnableVacuumRequest) GetByPlugin() bool {
@@ -3191,7 +3560,7 @@ type EnableVacuumResponse struct {
 
 func (x *EnableVacuumResponse) Reset() {
 	*x = EnableVacuumResponse{}
-	mi := &file_master_proto_msgTypes[44]
+	mi := &file_master_proto_msgTypes[47]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3203,7 +3572,7 @@ func (x *EnableVacuumResponse) String() string {
 func (*EnableVacuumResponse) ProtoMessage() {}
 
 func (x *EnableVacuumResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[44]
+	mi := &file_master_proto_msgTypes[47]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3216,7 +3585,7 @@ func (x *EnableVacuumResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EnableVacuumResponse.ProtoReflect.Descriptor instead.
 func (*EnableVacuumResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{44}
+	return file_master_proto_rawDescGZIP(), []int{47}
 }
 
 type VolumeMarkReadonlyRequest struct {
@@ -3236,7 +3605,7 @@ type VolumeMarkReadonlyRequest struct {
 
 func (x *VolumeMarkReadonlyRequest) Reset() {
 	*x = VolumeMarkReadonlyRequest{}
-	mi := &file_master_proto_msgTypes[45]
+	mi := &file_master_proto_msgTypes[48]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3248,7 +3617,7 @@ func (x *VolumeMarkReadonlyRequest) String() string {
 func (*VolumeMarkReadonlyRequest) ProtoMessage() {}
 
 func (x *VolumeMarkReadonlyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[45]
+	mi := &file_master_proto_msgTypes[48]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3261,7 +3630,7 @@ func (x *VolumeMarkReadonlyRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VolumeMarkReadonlyRequest.ProtoReflect.Descriptor instead.
 func (*VolumeMarkReadonlyRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{45}
+	return file_master_proto_rawDescGZIP(), []int{48}
 }
 
 func (x *VolumeMarkReadonlyRequest) GetIp() string {
@@ -3335,7 +3704,7 @@ type VolumeMarkReadonlyResponse struct {
 
 func (x *VolumeMarkReadonlyResponse) Reset() {
 	*x = VolumeMarkReadonlyResponse{}
-	mi := &file_master_proto_msgTypes[46]
+	mi := &file_master_proto_msgTypes[49]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3347,7 +3716,7 @@ func (x *VolumeMarkReadonlyResponse) String() string {
 func (*VolumeMarkReadonlyResponse) ProtoMessage() {}
 
 func (x *VolumeMarkReadonlyResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[46]
+	mi := &file_master_proto_msgTypes[49]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3360,7 +3729,7 @@ func (x *VolumeMarkReadonlyResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VolumeMarkReadonlyResponse.ProtoReflect.Descriptor instead.
 func (*VolumeMarkReadonlyResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{46}
+	return file_master_proto_rawDescGZIP(), []int{49}
 }
 
 type GetMasterConfigurationRequest struct {
@@ -3371,7 +3740,7 @@ type GetMasterConfigurationRequest struct {
 
 func (x *GetMasterConfigurationRequest) Reset() {
 	*x = GetMasterConfigurationRequest{}
-	mi := &file_master_proto_msgTypes[47]
+	mi := &file_master_proto_msgTypes[50]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3383,7 +3752,7 @@ func (x *GetMasterConfigurationRequest) String() string {
 func (*GetMasterConfigurationRequest) ProtoMessage() {}
 
 func (x *GetMasterConfigurationRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[47]
+	mi := &file_master_proto_msgTypes[50]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3396,7 +3765,7 @@ func (x *GetMasterConfigurationRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetMasterConfigurationRequest.ProtoReflect.Descriptor instead.
 func (*GetMasterConfigurationRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{47}
+	return file_master_proto_rawDescGZIP(), []int{50}
 }
 
 type GetMasterConfigurationResponse struct {
@@ -3417,7 +3786,7 @@ type GetMasterConfigurationResponse struct {
 
 func (x *GetMasterConfigurationResponse) Reset() {
 	*x = GetMasterConfigurationResponse{}
-	mi := &file_master_proto_msgTypes[48]
+	mi := &file_master_proto_msgTypes[51]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3429,7 +3798,7 @@ func (x *GetMasterConfigurationResponse) String() string {
 func (*GetMasterConfigurationResponse) ProtoMessage() {}
 
 func (x *GetMasterConfigurationResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[48]
+	mi := &file_master_proto_msgTypes[51]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3442,7 +3811,7 @@ func (x *GetMasterConfigurationResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetMasterConfigurationResponse.ProtoReflect.Descriptor instead.
 func (*GetMasterConfigurationResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{48}
+	return file_master_proto_rawDescGZIP(), []int{51}
 }
 
 func (x *GetMasterConfigurationResponse) GetMetricsAddress() string {
@@ -3519,7 +3888,7 @@ type ListClusterNodesRequest struct {
 
 func (x *ListClusterNodesRequest) Reset() {
 	*x = ListClusterNodesRequest{}
-	mi := &file_master_proto_msgTypes[49]
+	mi := &file_master_proto_msgTypes[52]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3531,7 +3900,7 @@ func (x *ListClusterNodesRequest) String() string {
 func (*ListClusterNodesRequest) ProtoMessage() {}
 
 func (x *ListClusterNodesRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[49]
+	mi := &file_master_proto_msgTypes[52]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3544,7 +3913,7 @@ func (x *ListClusterNodesRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListClusterNodesRequest.ProtoReflect.Descriptor instead.
 func (*ListClusterNodesRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{49}
+	return file_master_proto_rawDescGZIP(), []int{52}
 }
 
 func (x *ListClusterNodesRequest) GetClientType() string {
@@ -3577,7 +3946,7 @@ type ListClusterNodesResponse struct {
 
 func (x *ListClusterNodesResponse) Reset() {
 	*x = ListClusterNodesResponse{}
-	mi := &file_master_proto_msgTypes[50]
+	mi := &file_master_proto_msgTypes[53]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3589,7 +3958,7 @@ func (x *ListClusterNodesResponse) String() string {
 func (*ListClusterNodesResponse) ProtoMessage() {}
 
 func (x *ListClusterNodesResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[50]
+	mi := &file_master_proto_msgTypes[53]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3602,7 +3971,7 @@ func (x *ListClusterNodesResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ListClusterNodesResponse.ProtoReflect.Descriptor instead.
 func (*ListClusterNodesResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{50}
+	return file_master_proto_rawDescGZIP(), []int{53}
 }
 
 func (x *ListClusterNodesResponse) GetClusterNodes() []*ListClusterNodesResponse_ClusterNode {
@@ -3625,7 +3994,7 @@ type LeaseAdminTokenRequest struct {
 
 func (x *LeaseAdminTokenRequest) Reset() {
 	*x = LeaseAdminTokenRequest{}
-	mi := &file_master_proto_msgTypes[51]
+	mi := &file_master_proto_msgTypes[54]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3637,7 +4006,7 @@ func (x *LeaseAdminTokenRequest) String() string {
 func (*LeaseAdminTokenRequest) ProtoMessage() {}
 
 func (x *LeaseAdminTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[51]
+	mi := &file_master_proto_msgTypes[54]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3650,7 +4019,7 @@ func (x *LeaseAdminTokenRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LeaseAdminTokenRequest.ProtoReflect.Descriptor instead.
 func (*LeaseAdminTokenRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{51}
+	return file_master_proto_rawDescGZIP(), []int{54}
 }
 
 func (x *LeaseAdminTokenRequest) GetPreviousToken() int64 {
@@ -3698,7 +4067,7 @@ type LeaseAdminTokenResponse struct {
 
 func (x *LeaseAdminTokenResponse) Reset() {
 	*x = LeaseAdminTokenResponse{}
-	mi := &file_master_proto_msgTypes[52]
+	mi := &file_master_proto_msgTypes[55]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3710,7 +4079,7 @@ func (x *LeaseAdminTokenResponse) String() string {
 func (*LeaseAdminTokenResponse) ProtoMessage() {}
 
 func (x *LeaseAdminTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[52]
+	mi := &file_master_proto_msgTypes[55]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3723,7 +4092,7 @@ func (x *LeaseAdminTokenResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use LeaseAdminTokenResponse.ProtoReflect.Descriptor instead.
 func (*LeaseAdminTokenResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{52}
+	return file_master_proto_rawDescGZIP(), []int{55}
 }
 
 func (x *LeaseAdminTokenResponse) GetToken() int64 {
@@ -3751,7 +4120,7 @@ type ReleaseAdminTokenRequest struct {
 
 func (x *ReleaseAdminTokenRequest) Reset() {
 	*x = ReleaseAdminTokenRequest{}
-	mi := &file_master_proto_msgTypes[53]
+	mi := &file_master_proto_msgTypes[56]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3763,7 +4132,7 @@ func (x *ReleaseAdminTokenRequest) String() string {
 func (*ReleaseAdminTokenRequest) ProtoMessage() {}
 
 func (x *ReleaseAdminTokenRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[53]
+	mi := &file_master_proto_msgTypes[56]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3776,7 +4145,7 @@ func (x *ReleaseAdminTokenRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseAdminTokenRequest.ProtoReflect.Descriptor instead.
 func (*ReleaseAdminTokenRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{53}
+	return file_master_proto_rawDescGZIP(), []int{56}
 }
 
 func (x *ReleaseAdminTokenRequest) GetPreviousToken() int64 {
@@ -3808,7 +4177,7 @@ type ReleaseAdminTokenResponse struct {
 
 func (x *ReleaseAdminTokenResponse) Reset() {
 	*x = ReleaseAdminTokenResponse{}
-	mi := &file_master_proto_msgTypes[54]
+	mi := &file_master_proto_msgTypes[57]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3820,7 +4189,7 @@ func (x *ReleaseAdminTokenResponse) String() string {
 func (*ReleaseAdminTokenResponse) ProtoMessage() {}
 
 func (x *ReleaseAdminTokenResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[54]
+	mi := &file_master_proto_msgTypes[57]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3833,7 +4202,7 @@ func (x *ReleaseAdminTokenResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseAdminTokenResponse.ProtoReflect.Descriptor instead.
 func (*ReleaseAdminTokenResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{54}
+	return file_master_proto_rawDescGZIP(), []int{57}
 }
 
 type GetAdminLockStatusRequest struct {
@@ -3845,7 +4214,7 @@ type GetAdminLockStatusRequest struct {
 
 func (x *GetAdminLockStatusRequest) Reset() {
 	*x = GetAdminLockStatusRequest{}
-	mi := &file_master_proto_msgTypes[55]
+	mi := &file_master_proto_msgTypes[58]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3857,7 +4226,7 @@ func (x *GetAdminLockStatusRequest) String() string {
 func (*GetAdminLockStatusRequest) ProtoMessage() {}
 
 func (x *GetAdminLockStatusRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[55]
+	mi := &file_master_proto_msgTypes[58]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3870,7 +4239,7 @@ func (x *GetAdminLockStatusRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAdminLockStatusRequest.ProtoReflect.Descriptor instead.
 func (*GetAdminLockStatusRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{55}
+	return file_master_proto_rawDescGZIP(), []int{58}
 }
 
 func (x *GetAdminLockStatusRequest) GetLockName() string {
@@ -3891,7 +4260,7 @@ type GetAdminLockStatusResponse struct {
 
 func (x *GetAdminLockStatusResponse) Reset() {
 	*x = GetAdminLockStatusResponse{}
-	mi := &file_master_proto_msgTypes[56]
+	mi := &file_master_proto_msgTypes[59]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3903,7 +4272,7 @@ func (x *GetAdminLockStatusResponse) String() string {
 func (*GetAdminLockStatusResponse) ProtoMessage() {}
 
 func (x *GetAdminLockStatusResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[56]
+	mi := &file_master_proto_msgTypes[59]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3916,7 +4285,7 @@ func (x *GetAdminLockStatusResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetAdminLockStatusResponse.ProtoReflect.Descriptor instead.
 func (*GetAdminLockStatusResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{56}
+	return file_master_proto_rawDescGZIP(), []int{59}
 }
 
 func (x *GetAdminLockStatusResponse) GetIsLocked() bool {
@@ -3950,7 +4319,7 @@ type PingRequest struct {
 
 func (x *PingRequest) Reset() {
 	*x = PingRequest{}
-	mi := &file_master_proto_msgTypes[57]
+	mi := &file_master_proto_msgTypes[60]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -3962,7 +4331,7 @@ func (x *PingRequest) String() string {
 func (*PingRequest) ProtoMessage() {}
 
 func (x *PingRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[57]
+	mi := &file_master_proto_msgTypes[60]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -3975,7 +4344,7 @@ func (x *PingRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PingRequest.ProtoReflect.Descriptor instead.
 func (*PingRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{57}
+	return file_master_proto_rawDescGZIP(), []int{60}
 }
 
 func (x *PingRequest) GetTarget() string {
@@ -4003,7 +4372,7 @@ type PingResponse struct {
 
 func (x *PingResponse) Reset() {
 	*x = PingResponse{}
-	mi := &file_master_proto_msgTypes[58]
+	mi := &file_master_proto_msgTypes[61]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4015,7 +4384,7 @@ func (x *PingResponse) String() string {
 func (*PingResponse) ProtoMessage() {}
 
 func (x *PingResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[58]
+	mi := &file_master_proto_msgTypes[61]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4028,7 +4397,7 @@ func (x *PingResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PingResponse.ProtoReflect.Descriptor instead.
 func (*PingResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{58}
+	return file_master_proto_rawDescGZIP(), []int{61}
 }
 
 func (x *PingResponse) GetStartTimeNs() int64 {
@@ -4063,7 +4432,7 @@ type RaftAddServerRequest struct {
 
 func (x *RaftAddServerRequest) Reset() {
 	*x = RaftAddServerRequest{}
-	mi := &file_master_proto_msgTypes[59]
+	mi := &file_master_proto_msgTypes[62]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4075,7 +4444,7 @@ func (x *RaftAddServerRequest) String() string {
 func (*RaftAddServerRequest) ProtoMessage() {}
 
 func (x *RaftAddServerRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[59]
+	mi := &file_master_proto_msgTypes[62]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4088,7 +4457,7 @@ func (x *RaftAddServerRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftAddServerRequest.ProtoReflect.Descriptor instead.
 func (*RaftAddServerRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{59}
+	return file_master_proto_rawDescGZIP(), []int{62}
 }
 
 func (x *RaftAddServerRequest) GetId() string {
@@ -4120,7 +4489,7 @@ type RaftAddServerResponse struct {
 
 func (x *RaftAddServerResponse) Reset() {
 	*x = RaftAddServerResponse{}
-	mi := &file_master_proto_msgTypes[60]
+	mi := &file_master_proto_msgTypes[63]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4132,7 +4501,7 @@ func (x *RaftAddServerResponse) String() string {
 func (*RaftAddServerResponse) ProtoMessage() {}
 
 func (x *RaftAddServerResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[60]
+	mi := &file_master_proto_msgTypes[63]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4145,7 +4514,7 @@ func (x *RaftAddServerResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftAddServerResponse.ProtoReflect.Descriptor instead.
 func (*RaftAddServerResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{60}
+	return file_master_proto_rawDescGZIP(), []int{63}
 }
 
 type RaftRemoveServerRequest struct {
@@ -4158,7 +4527,7 @@ type RaftRemoveServerRequest struct {
 
 func (x *RaftRemoveServerRequest) Reset() {
 	*x = RaftRemoveServerRequest{}
-	mi := &file_master_proto_msgTypes[61]
+	mi := &file_master_proto_msgTypes[64]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4170,7 +4539,7 @@ func (x *RaftRemoveServerRequest) String() string {
 func (*RaftRemoveServerRequest) ProtoMessage() {}
 
 func (x *RaftRemoveServerRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[61]
+	mi := &file_master_proto_msgTypes[64]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4183,7 +4552,7 @@ func (x *RaftRemoveServerRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftRemoveServerRequest.ProtoReflect.Descriptor instead.
 func (*RaftRemoveServerRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{61}
+	return file_master_proto_rawDescGZIP(), []int{64}
 }
 
 func (x *RaftRemoveServerRequest) GetId() string {
@@ -4208,7 +4577,7 @@ type RaftRemoveServerResponse struct {
 
 func (x *RaftRemoveServerResponse) Reset() {
 	*x = RaftRemoveServerResponse{}
-	mi := &file_master_proto_msgTypes[62]
+	mi := &file_master_proto_msgTypes[65]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4220,7 +4589,7 @@ func (x *RaftRemoveServerResponse) String() string {
 func (*RaftRemoveServerResponse) ProtoMessage() {}
 
 func (x *RaftRemoveServerResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[62]
+	mi := &file_master_proto_msgTypes[65]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4233,7 +4602,7 @@ func (x *RaftRemoveServerResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftRemoveServerResponse.ProtoReflect.Descriptor instead.
 func (*RaftRemoveServerResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{62}
+	return file_master_proto_rawDescGZIP(), []int{65}
 }
 
 type RaftListClusterServersRequest struct {
@@ -4244,7 +4613,7 @@ type RaftListClusterServersRequest struct {
 
 func (x *RaftListClusterServersRequest) Reset() {
 	*x = RaftListClusterServersRequest{}
-	mi := &file_master_proto_msgTypes[63]
+	mi := &file_master_proto_msgTypes[66]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4256,7 +4625,7 @@ func (x *RaftListClusterServersRequest) String() string {
 func (*RaftListClusterServersRequest) ProtoMessage() {}
 
 func (x *RaftListClusterServersRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[63]
+	mi := &file_master_proto_msgTypes[66]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4269,7 +4638,7 @@ func (x *RaftListClusterServersRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftListClusterServersRequest.ProtoReflect.Descriptor instead.
 func (*RaftListClusterServersRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{63}
+	return file_master_proto_rawDescGZIP(), []int{66}
 }
 
 type RaftListClusterServersResponse struct {
@@ -4281,7 +4650,7 @@ type RaftListClusterServersResponse struct {
 
 func (x *RaftListClusterServersResponse) Reset() {
 	*x = RaftListClusterServersResponse{}
-	mi := &file_master_proto_msgTypes[64]
+	mi := &file_master_proto_msgTypes[67]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4293,7 +4662,7 @@ func (x *RaftListClusterServersResponse) String() string {
 func (*RaftListClusterServersResponse) ProtoMessage() {}
 
 func (x *RaftListClusterServersResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[64]
+	mi := &file_master_proto_msgTypes[67]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4306,7 +4675,7 @@ func (x *RaftListClusterServersResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftListClusterServersResponse.ProtoReflect.Descriptor instead.
 func (*RaftListClusterServersResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{64}
+	return file_master_proto_rawDescGZIP(), []int{67}
 }
 
 func (x *RaftListClusterServersResponse) GetClusterServers() []*RaftListClusterServersResponse_ClusterServers {
@@ -4326,7 +4695,7 @@ type RaftLeadershipTransferRequest struct {
 
 func (x *RaftLeadershipTransferRequest) Reset() {
 	*x = RaftLeadershipTransferRequest{}
-	mi := &file_master_proto_msgTypes[65]
+	mi := &file_master_proto_msgTypes[68]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4338,7 +4707,7 @@ func (x *RaftLeadershipTransferRequest) String() string {
 func (*RaftLeadershipTransferRequest) ProtoMessage() {}
 
 func (x *RaftLeadershipTransferRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[65]
+	mi := &file_master_proto_msgTypes[68]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4351,7 +4720,7 @@ func (x *RaftLeadershipTransferRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftLeadershipTransferRequest.ProtoReflect.Descriptor instead.
 func (*RaftLeadershipTransferRequest) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{65}
+	return file_master_proto_rawDescGZIP(), []int{68}
 }
 
 func (x *RaftLeadershipTransferRequest) GetTargetId() string {
@@ -4378,7 +4747,7 @@ type RaftLeadershipTransferResponse struct {
 
 func (x *RaftLeadershipTransferResponse) Reset() {
 	*x = RaftLeadershipTransferResponse{}
-	mi := &file_master_proto_msgTypes[66]
+	mi := &file_master_proto_msgTypes[69]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4390,7 +4759,7 @@ func (x *RaftLeadershipTransferResponse) String() string {
 func (*RaftLeadershipTransferResponse) ProtoMessage() {}
 
 func (x *RaftLeadershipTransferResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[66]
+	mi := &file_master_proto_msgTypes[69]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4403,7 +4772,7 @@ func (x *RaftLeadershipTransferResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RaftLeadershipTransferResponse.ProtoReflect.Descriptor instead.
 func (*RaftLeadershipTransferResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{66}
+	return file_master_proto_rawDescGZIP(), []int{69}
 }
 
 func (x *RaftLeadershipTransferResponse) GetPreviousLeader() string {
@@ -4421,14 +4790,19 @@ func (x *RaftLeadershipTransferResponse) GetNewLeader() string {
 }
 
 type VolumeGrowResponse struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Average fill ratio of the layout's writable volumes at request time
+	// (0 when there are none). Reported whether or not growth was triggered.
+	AvgFill float32 `protobuf:"fixed32,1,opt,name=avg_fill,json=avgFill,proto3" json:"avg_fill,omitempty"`
+	// Number of writable volumes at request time.
+	WritableCount uint32 `protobuf:"varint,2,opt,name=writable_count,json=writableCount,proto3" json:"writable_count,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VolumeGrowResponse) Reset() {
 	*x = VolumeGrowResponse{}
-	mi := &file_master_proto_msgTypes[67]
+	mi := &file_master_proto_msgTypes[70]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4440,7 +4814,7 @@ func (x *VolumeGrowResponse) String() string {
 func (*VolumeGrowResponse) ProtoMessage() {}
 
 func (x *VolumeGrowResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[67]
+	mi := &file_master_proto_msgTypes[70]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4453,7 +4827,21 @@ func (x *VolumeGrowResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use VolumeGrowResponse.ProtoReflect.Descriptor instead.
 func (*VolumeGrowResponse) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{67}
+	return file_master_proto_rawDescGZIP(), []int{70}
+}
+
+func (x *VolumeGrowResponse) GetAvgFill() float32 {
+	if x != nil {
+		return x.AvgFill
+	}
+	return 0
+}
+
+func (x *VolumeGrowResponse) GetWritableCount() uint32 {
+	if x != nil {
+		return x.WritableCount
+	}
+	return 0
 }
 
 type SuperBlockExtra_ErasureCoding struct {
@@ -4467,7 +4855,7 @@ type SuperBlockExtra_ErasureCoding struct {
 
 func (x *SuperBlockExtra_ErasureCoding) Reset() {
 	*x = SuperBlockExtra_ErasureCoding{}
-	mi := &file_master_proto_msgTypes[72]
+	mi := &file_master_proto_msgTypes[75]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4479,7 +4867,7 @@ func (x *SuperBlockExtra_ErasureCoding) String() string {
 func (*SuperBlockExtra_ErasureCoding) ProtoMessage() {}
 
 func (x *SuperBlockExtra_ErasureCoding) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[72]
+	mi := &file_master_proto_msgTypes[75]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4528,7 +4916,7 @@ type LookupVolumeResponse_VolumeIdLocation struct {
 
 func (x *LookupVolumeResponse_VolumeIdLocation) Reset() {
 	*x = LookupVolumeResponse_VolumeIdLocation{}
-	mi := &file_master_proto_msgTypes[73]
+	mi := &file_master_proto_msgTypes[76]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4540,7 +4928,7 @@ func (x *LookupVolumeResponse_VolumeIdLocation) String() string {
 func (*LookupVolumeResponse_VolumeIdLocation) ProtoMessage() {}
 
 func (x *LookupVolumeResponse_VolumeIdLocation) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[73]
+	mi := &file_master_proto_msgTypes[76]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4594,7 +4982,7 @@ type LookupEcVolumeResponse_EcShardIdLocation struct {
 
 func (x *LookupEcVolumeResponse_EcShardIdLocation) Reset() {
 	*x = LookupEcVolumeResponse_EcShardIdLocation{}
-	mi := &file_master_proto_msgTypes[79]
+	mi := &file_master_proto_msgTypes[82]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4606,7 +4994,7 @@ func (x *LookupEcVolumeResponse_EcShardIdLocation) String() string {
 func (*LookupEcVolumeResponse_EcShardIdLocation) ProtoMessage() {}
 
 func (x *LookupEcVolumeResponse_EcShardIdLocation) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[79]
+	mi := &file_master_proto_msgTypes[82]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4619,7 +5007,7 @@ func (x *LookupEcVolumeResponse_EcShardIdLocation) ProtoReflect() protoreflect.M
 
 // Deprecated: Use LookupEcVolumeResponse_EcShardIdLocation.ProtoReflect.Descriptor instead.
 func (*LookupEcVolumeResponse_EcShardIdLocation) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{38, 0}
+	return file_master_proto_rawDescGZIP(), []int{41, 0}
 }
 
 func (x *LookupEcVolumeResponse_EcShardIdLocation) GetShardId() uint32 {
@@ -4649,7 +5037,7 @@ type ListClusterNodesResponse_ClusterNode struct {
 
 func (x *ListClusterNodesResponse_ClusterNode) Reset() {
 	*x = ListClusterNodesResponse_ClusterNode{}
-	mi := &file_master_proto_msgTypes[80]
+	mi := &file_master_proto_msgTypes[83]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4661,7 +5049,7 @@ func (x *ListClusterNodesResponse_ClusterNode) String() string {
 func (*ListClusterNodesResponse_ClusterNode) ProtoMessage() {}
 
 func (x *ListClusterNodesResponse_ClusterNode) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[80]
+	mi := &file_master_proto_msgTypes[83]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4674,7 +5062,7 @@ func (x *ListClusterNodesResponse_ClusterNode) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use ListClusterNodesResponse_ClusterNode.ProtoReflect.Descriptor instead.
 func (*ListClusterNodesResponse_ClusterNode) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{50, 0}
+	return file_master_proto_rawDescGZIP(), []int{53, 0}
 }
 
 func (x *ListClusterNodesResponse_ClusterNode) GetAddress() string {
@@ -4724,7 +5112,7 @@ type RaftListClusterServersResponse_ClusterServers struct {
 
 func (x *RaftListClusterServersResponse_ClusterServers) Reset() {
 	*x = RaftListClusterServersResponse_ClusterServers{}
-	mi := &file_master_proto_msgTypes[81]
+	mi := &file_master_proto_msgTypes[84]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -4736,7 +5124,7 @@ func (x *RaftListClusterServersResponse_ClusterServers) String() string {
 func (*RaftListClusterServersResponse_ClusterServers) ProtoMessage() {}
 
 func (x *RaftListClusterServersResponse_ClusterServers) ProtoReflect() protoreflect.Message {
-	mi := &file_master_proto_msgTypes[81]
+	mi := &file_master_proto_msgTypes[84]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4749,7 +5137,7 @@ func (x *RaftListClusterServersResponse_ClusterServers) ProtoReflect() protorefl
 
 // Deprecated: Use RaftListClusterServersResponse_ClusterServers.ProtoReflect.Descriptor instead.
 func (*RaftListClusterServersResponse_ClusterServers) Descriptor() ([]byte, []int) {
-	return file_master_proto_rawDescGZIP(), []int{64, 0}
+	return file_master_proto_rawDescGZIP(), []int{67, 0}
 }
 
 func (x *RaftListClusterServersResponse_ClusterServers) GetId() string {
@@ -4789,7 +5177,7 @@ const file_master_proto_rawDesc = "" +
 	"\adisk_id\x18\x01 \x01(\rR\x06diskId\x12\x12\n" +
 	"\x04tags\x18\x02 \x03(\tR\x04tags\x12\x12\n" +
 	"\x04type\x18\x03 \x01(\tR\x04type\x12(\n" +
-	"\x10max_volume_count\x18\x04 \x01(\x03R\x0emaxVolumeCount\"\xf0\v\n" +
+	"\x10max_volume_count\x18\x04 \x01(\x03R\x0emaxVolumeCount\"\xd0\f\n" +
 	"\tHeartbeat\x12\x0e\n" +
 	"\x02ip\x18\x01 \x01(\tR\x02ip\x12\x12\n" +
 	"\x04port\x18\x02 \x01(\rR\x04port\x12\x1d\n" +
@@ -4821,7 +5209,9 @@ const file_master_proto_rawDesc = "" +
 	"\x10disk_total_bytes\x18\x19 \x03(\v2(.master_pb.Heartbeat.DiskTotalBytesEntryR\x0ediskTotalBytes\x12O\n" +
 	"\x0fdisk_free_bytes\x18\x1a \x03(\v2'.master_pb.Heartbeat.DiskFreeBytesEntryR\rdiskFreeBytes\x12(\n" +
 	"\rvolume_digest\x18\x1b \x01(\x04H\x00R\fvolumeDigest\x88\x01\x01\x12L\n" +
-	"\x0fchanged_volumes\x18\x1c \x03(\v2#.master_pb.VolumeInformationMessageR\x0echangedVolumes\x1aB\n" +
+	"\x0fchanged_volumes\x18\x1c \x03(\v2#.master_pb.VolumeInformationMessageR\x0echangedVolumes\x12+\n" +
+	"\x12max_volume_id_seen\x18\x1d \x01(\rR\x0fmaxVolumeIdSeen\x121\n" +
+	"\x15last_seen_topology_id\x18\x1e \x01(\tR\x12lastSeenTopologyId\x1aB\n" +
 	"\x14MaxVolumeCountsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\rR\x05value:\x028\x01\x1aA\n" +
@@ -4831,7 +5221,7 @@ const file_master_proto_rawDesc = "" +
 	"\x12DiskFreeBytesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\x04R\x05value:\x028\x01B\x10\n" +
-	"\x0e_volume_digest\"\xbc\x03\n" +
+	"\x0e_volume_digest\"\x81\x04\n" +
 	"\x11HeartbeatResponse\x12*\n" +
 	"\x11volume_size_limit\x18\x01 \x01(\x04R\x0fvolumeSizeLimit\x12\x16\n" +
 	"\x06leader\x18\x02 \x01(\tR\x06leader\x12'\n" +
@@ -4841,7 +5231,11 @@ const file_master_proto_rawDesc = "" +
 	"\x10duplicated_uuids\x18\x06 \x03(\tR\x0fduplicatedUuids\x12 \n" +
 	"\vpreallocate\x18\a \x01(\bR\vpreallocate\x125\n" +
 	"\x17resend_full_volume_list\x18\b \x01(\bR\x14resendFullVolumeList\x126\n" +
-	"\x17volume_digest_supported\x18\t \x01(\bR\x15volumeDigestSupported\"\xb1\x04\n" +
+	"\x17volume_digest_supported\x18\t \x01(\bR\x15volumeDigestSupported\x12\"\n" +
+	"\rmax_volume_id\x18\n" +
+	" \x01(\rR\vmaxVolumeId\x12\x1f\n" +
+	"\vtopology_id\x18\v \x01(\tR\n" +
+	"topologyId\"\xe2\x04\n" +
 	"\x18VolumeInformationMessage\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\rR\x02id\x12\x12\n" +
 	"\x04size\x18\x02 \x01(\x04R\x04size\x12\x1e\n" +
@@ -4852,7 +5246,8 @@ const file_master_proto_rawDesc = "" +
 	"file_count\x18\x04 \x01(\x04R\tfileCount\x12!\n" +
 	"\fdelete_count\x18\x05 \x01(\x04R\vdeleteCount\x12,\n" +
 	"\x12deleted_byte_count\x18\x06 \x01(\x04R\x10deletedByteCount\x12\x1b\n" +
-	"\tread_only\x18\a \x01(\bR\breadOnly\x12+\n" +
+	"\tread_only\x18\a \x01(\bR\breadOnly\x12/\n" +
+	"\x14read_only_can_delete\x18\x11 \x01(\bR\x11readOnlyCanDelete\x12+\n" +
 	"\x11replica_placement\x18\b \x01(\rR\x10replicaPlacement\x12\x18\n" +
 	"\aversion\x18\t \x01(\rR\aversion\x12\x10\n" +
 	"\x03ttl\x18\n" +
@@ -4862,7 +5257,7 @@ const file_master_proto_rawDesc = "" +
 	"\x13remote_storage_name\x18\r \x01(\tR\x11remoteStorageName\x12,\n" +
 	"\x12remote_storage_key\x18\x0e \x01(\tR\x10remoteStorageKey\x12\x1b\n" +
 	"\tdisk_type\x18\x0f \x01(\tR\bdiskType\x12\x17\n" +
-	"\adisk_id\x18\x10 \x01(\rR\x06diskId\"\xde\x01\n" +
+	"\adisk_id\x18\x10 \x01(\rR\x06diskId\"\xac\x02\n" +
 	"\x1dVolumeShortInformationMessage\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\rR\x02id\x12\x1e\n" +
 	"\n" +
@@ -4873,7 +5268,9 @@ const file_master_proto_rawDesc = "" +
 	"\x03ttl\x18\n" +
 	" \x01(\rR\x03ttl\x12\x1b\n" +
 	"\tdisk_type\x18\x0f \x01(\tR\bdiskType\x12\x17\n" +
-	"\adisk_id\x18\x10 \x01(\rR\x06diskId\"\xd4\x02\n" +
+	"\adisk_id\x18\x10 \x01(\rR\x06diskId\x12\x1b\n" +
+	"\tread_only\x18\x11 \x01(\bR\breadOnly\x12/\n" +
+	"\x14read_only_can_delete\x18\x12 \x01(\bR\x11readOnlyCanDelete\"\xd4\x02\n" +
 	"\x1fVolumeEcShardInformationMessage\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\rR\x02id\x12\x1e\n" +
 	"\n" +
@@ -4906,7 +5303,7 @@ const file_master_proto_rawDesc = "" +
 	"\x04data\x18\x01 \x01(\rR\x04data\x12\x16\n" +
 	"\x06parity\x18\x02 \x01(\rR\x06parity\x12\x1d\n" +
 	"\n" +
-	"volume_ids\x18\x03 \x03(\rR\tvolumeIds\"\xce\x01\n" +
+	"volume_ids\x18\x03 \x03(\rR\tvolumeIds\"\xf6\x01\n" +
 	"\x14KeepConnectedRequest\x12\x1f\n" +
 	"\vclient_type\x18\x01 \x01(\tR\n" +
 	"clientType\x12%\n" +
@@ -4916,7 +5313,8 @@ const file_master_proto_rawDesc = "" +
 	"filerGroup\x12\x1f\n" +
 	"\vdata_center\x18\x06 \x01(\tR\n" +
 	"dataCenter\x12\x12\n" +
-	"\x04rack\x18\a \x01(\tR\x04rack\"\x9d\x02\n" +
+	"\x04rack\x18\a \x01(\tR\x04rack\x12&\n" +
+	"\x0fleave_lock_ring\x18\b \x01(\bR\rleaveLockRing\"\x9e\x03\n" +
 	"\x0eVolumeLocation\x12\x10\n" +
 	"\x03url\x18\x01 \x01(\tR\x03url\x12\x1d\n" +
 	"\n" +
@@ -4928,7 +5326,12 @@ const file_master_proto_rawDesc = "" +
 	"dataCenter\x12\x1b\n" +
 	"\tgrpc_port\x18\a \x01(\rR\bgrpcPort\x12\x1e\n" +
 	"\vnew_ec_vids\x18\b \x03(\rR\tnewEcVids\x12&\n" +
-	"\x0fdeleted_ec_vids\x18\t \x03(\rR\rdeletedEcVids\"\xa6\x01\n" +
+	"\x0fdeleted_ec_vids\x18\t \x03(\rR\rdeletedEcVids\x12\x1f\n" +
+	"\vremote_vids\x18\n" +
+	" \x03(\rR\n" +
+	"remoteVids\x12$\n" +
+	"\x0eread_only_vids\x18\v \x03(\rR\freadOnlyVids\x128\n" +
+	"\x19read_only_can_delete_vids\x18\f \x03(\rR\x15readOnlyCanDeleteVids\"\xa6\x01\n" +
 	"\x11ClusterNodeUpdate\x12\x1b\n" +
 	"\tnode_type\x18\x01 \x01(\tR\bnodeType\x12\x18\n" +
 	"\aaddress\x18\x02 \x01(\tR\aaddress\x12\x15\n" +
@@ -4956,14 +5359,17 @@ const file_master_proto_rawDesc = "" +
 	"\x11volume_or_file_id\x18\x01 \x01(\tR\x0evolumeOrFileId\x121\n" +
 	"\tlocations\x18\x02 \x03(\v2\x13.master_pb.LocationR\tlocations\x12\x14\n" +
 	"\x05error\x18\x03 \x01(\tR\x05error\x12\x12\n" +
-	"\x04auth\x18\x04 \x01(\tR\x04auth\"y\n" +
+	"\x04auth\x18\x04 \x01(\tR\x04auth\"\xed\x01\n" +
 	"\bLocation\x12\x10\n" +
 	"\x03url\x18\x01 \x01(\tR\x03url\x12\x1d\n" +
 	"\n" +
 	"public_url\x18\x02 \x01(\tR\tpublicUrl\x12\x1b\n" +
 	"\tgrpc_port\x18\x03 \x01(\rR\bgrpcPort\x12\x1f\n" +
 	"\vdata_center\x18\x04 \x01(\tR\n" +
-	"dataCenter\"\xfe\x02\n" +
+	"dataCenter\x12$\n" +
+	"\x0edata_in_remote\x18\x05 \x01(\bR\fdataInRemote\x12\x1b\n" +
+	"\tread_only\x18\x06 \x01(\bR\breadOnly\x12/\n" +
+	"\x14read_only_can_delete\x18\a \x01(\bR\x11readOnlyCanDelete\"\xfe\x02\n" +
 	"\rAssignRequest\x12\x14\n" +
 	"\x05count\x18\x01 \x01(\x04R\x05count\x12 \n" +
 	"\vreplication\x18\x02 \x01(\tR\vreplication\x12\x1e\n" +
@@ -4979,7 +5385,7 @@ const file_master_proto_rawDesc = "" +
 	"\x15writable_volume_count\x18\t \x01(\rR\x13writableVolumeCount\x12\x1b\n" +
 	"\tdisk_type\x18\n" +
 	" \x01(\tR\bdiskType\x12,\n" +
-	"\x12expected_data_size\x18\v \x01(\x04R\x10expectedDataSize\"\xbe\x02\n" +
+	"\x12expected_data_size\x18\v \x01(\x04R\x10expectedDataSize\"\xf5\x02\n" +
 	"\x11VolumeGrowRequest\x122\n" +
 	"\x15writable_volume_count\x18\x01 \x01(\rR\x13writableVolumeCount\x12 \n" +
 	"\vreplication\x18\x02 \x01(\tR\vreplication\x12\x1e\n" +
@@ -4992,7 +5398,13 @@ const file_master_proto_rawDesc = "" +
 	"\x04rack\x18\x06 \x01(\tR\x04rack\x12\x1b\n" +
 	"\tdata_node\x18\a \x01(\tR\bdataNode\x122\n" +
 	"\x16memory_map_max_size_mb\x18\b \x01(\rR\x12memoryMapMaxSizeMb\x12\x1b\n" +
-	"\tdisk_type\x18\t \x01(\tR\bdiskType\"\xc4\x01\n" +
+	"\tdisk_type\x18\t \x01(\tR\bdiskType\x125\n" +
+	"\x17grow_avg_fill_threshold\x18\n" +
+	" \x01(\x02R\x14growAvgFillThreshold\"\x1b\n" +
+	"\x19ResumeVolumeGrowthRequest\";\n" +
+	"\x1aResumeVolumeGrowthResponse\x12\x1d\n" +
+	"\n" +
+	"was_frozen\x18\x01 \x01(\bR\twasFrozen\"\xc4\x01\n" +
 	"\x0eAssignResponse\x12\x10\n" +
 	"\x03fid\x18\x01 \x01(\tR\x03fid\x12\x14\n" +
 	"\x05count\x18\x04 \x01(\x04R\x05count\x12\x14\n" +
@@ -5087,11 +5499,29 @@ const file_master_proto_rawDesc = "" +
 	"\tdiskInfos\x18\x03 \x03(\v2&.master_pb.TopologyInfo.DiskInfosEntryR\tdiskInfos\x1aQ\n" +
 	"\x0eDiskInfosEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12)\n" +
-	"\x05value\x18\x02 \x01(\v2\x13.master_pb.DiskInfoR\x05value:\x028\x01\"\x13\n" +
-	"\x11VolumeListRequest\"\x83\x01\n" +
+	"\x05value\x18\x02 \x01(\v2\x13.master_pb.DiskInfoR\x05value:\x028\x01\"\x8b\x02\n" +
+	"\x11VolumeListRequest\x12\x1e\n" +
+	"\n" +
+	"collection\x18\x01 \x01(\tR\n" +
+	"collection\x12\x1d\n" +
+	"\n" +
+	"volume_ids\x18\x02 \x03(\rR\tvolumeIds\x126\n" +
+	"\x17default_collection_only\x18\x03 \x01(\bR\x15defaultCollectionOnly\x12.\n" +
+	"\x13remote_storage_name\x18\x04 \x01(\tR\x11remoteStorageName\x12*\n" +
+	"\x11local_volume_only\x18\x05 \x01(\bR\x0flocalVolumeOnly\x12#\n" +
+	"\rtopology_only\x18\x06 \x01(\bR\ftopologyOnly\"\x83\x01\n" +
 	"\x12VolumeListResponse\x12<\n" +
 	"\rtopology_info\x18\x01 \x01(\v2\x17.master_pb.TopologyInfoR\ftopologyInfo\x12/\n" +
-	"\x14volume_size_limit_mb\x18\x02 \x01(\x04R\x11volumeSizeLimitMb\"4\n" +
+	"\x14volume_size_limit_mb\x18\x02 \x01(\x04R\x11volumeSizeLimitMb\"\xda\x02\n" +
+	"\x18VolumeListStreamResponse\x125\n" +
+	"\x06header\x18\x01 \x01(\v2\x1d.master_pb.VolumeListResponseR\x06header\x12\x1f\n" +
+	"\vdata_center\x18\x02 \x01(\tR\n" +
+	"dataCenter\x12\x12\n" +
+	"\x04rack\x18\x03 \x01(\tR\x04rack\x12\x1b\n" +
+	"\tdata_node\x18\x04 \x01(\tR\bdataNode\x12\x1b\n" +
+	"\tdisk_type\x18\x05 \x01(\tR\bdiskType\x12F\n" +
+	"\fvolume_infos\x18\x06 \x03(\v2#.master_pb.VolumeInformationMessageR\vvolumeInfos\x12P\n" +
+	"\x0eec_shard_infos\x18\a \x03(\v2*.master_pb.VolumeEcShardInformationMessageR\fecShardInfos\"4\n" +
 	"\x15LookupEcVolumeRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\xfb\x01\n" +
 	"\x16LookupEcVolumeResponse\x12\x1b\n" +
@@ -5209,8 +5639,10 @@ const file_master_proto_rawDesc = "" +
 	"\x1eRaftLeadershipTransferResponse\x12'\n" +
 	"\x0fprevious_leader\x18\x01 \x01(\tR\x0epreviousLeader\x12\x1d\n" +
 	"\n" +
-	"new_leader\x18\x02 \x01(\tR\tnewLeader\"\x14\n" +
-	"\x12VolumeGrowResponse2\x96\x12\n" +
+	"new_leader\x18\x02 \x01(\tR\tnewLeader\"V\n" +
+	"\x12VolumeGrowResponse\x12\x19\n" +
+	"\bavg_fill\x18\x01 \x01(\x02R\aavgFill\x12%\n" +
+	"\x0ewritable_count\x18\x02 \x01(\rR\rwritableCount2\xd6\x13\n" +
 	"\aSeaweed\x12I\n" +
 	"\rSendHeartbeat\x12\x14.master_pb.Heartbeat\x1a\x1c.master_pb.HeartbeatResponse\"\x00(\x010\x01\x12X\n" +
 	"\rKeepConnected\x12\x1f.master_pb.KeepConnectedRequest\x1a .master_pb.KeepConnectedResponse\"\x00(\x010\x01\x12Q\n" +
@@ -5222,7 +5654,8 @@ const file_master_proto_rawDesc = "" +
 	"\x0eCollectionList\x12 .master_pb.CollectionListRequest\x1a!.master_pb.CollectionListResponse\"\x00\x12]\n" +
 	"\x10CollectionDelete\x12\".master_pb.CollectionDeleteRequest\x1a#.master_pb.CollectionDeleteResponse\"\x00\x12K\n" +
 	"\n" +
-	"VolumeList\x12\x1c.master_pb.VolumeListRequest\x1a\x1d.master_pb.VolumeListResponse\"\x00\x12W\n" +
+	"VolumeList\x12\x1c.master_pb.VolumeListRequest\x1a\x1d.master_pb.VolumeListResponse\"\x00\x12Y\n" +
+	"\x10VolumeListStream\x12\x1c.master_pb.VolumeListRequest\x1a#.master_pb.VolumeListStreamResponse\"\x000\x01\x12W\n" +
 	"\x0eLookupEcVolume\x12 .master_pb.LookupEcVolumeRequest\x1a!.master_pb.LookupEcVolumeResponse\"\x00\x12Q\n" +
 	"\fVacuumVolume\x12\x1e.master_pb.VacuumVolumeRequest\x1a\x1f.master_pb.VacuumVolumeResponse\"\x00\x12T\n" +
 	"\rDisableVacuum\x12\x1f.master_pb.DisableVacuumRequest\x1a .master_pb.DisableVacuumResponse\"\x00\x12Q\n" +
@@ -5237,7 +5670,8 @@ const file_master_proto_rawDesc = "" +
 	"\x16RaftListClusterServers\x12(.master_pb.RaftListClusterServersRequest\x1a).master_pb.RaftListClusterServersResponse\"\x00\x12T\n" +
 	"\rRaftAddServer\x12\x1f.master_pb.RaftAddServerRequest\x1a .master_pb.RaftAddServerResponse\"\x00\x12]\n" +
 	"\x10RaftRemoveServer\x12\".master_pb.RaftRemoveServerRequest\x1a#.master_pb.RaftRemoveServerResponse\"\x00\x12o\n" +
-	"\x16RaftLeadershipTransfer\x12(.master_pb.RaftLeadershipTransferRequest\x1a).master_pb.RaftLeadershipTransferResponse\"\x00\x12K\n" +
+	"\x16RaftLeadershipTransfer\x12(.master_pb.RaftLeadershipTransferRequest\x1a).master_pb.RaftLeadershipTransferResponse\"\x00\x12c\n" +
+	"\x12ResumeVolumeGrowth\x12$.master_pb.ResumeVolumeGrowthRequest\x1a%.master_pb.ResumeVolumeGrowthResponse\"\x00\x12K\n" +
 	"\n" +
 	"VolumeGrow\x12\x1c.master_pb.VolumeGrowRequest\x1a\x1d.master_pb.VolumeGrowResponse\"\x00\x12i\n" +
 	"\x14CollectionStatistics\x12&.master_pb.CollectionStatisticsRequest\x1a'.master_pb.CollectionStatisticsResponse\"\x00B2Z0github.com/seaweedfs/seaweedfs/weed/pb/master_pbb\x06proto3"
@@ -5254,7 +5688,7 @@ func file_master_proto_rawDescGZIP() []byte {
 	return file_master_proto_rawDescData
 }
 
-var file_master_proto_msgTypes = make([]protoimpl.MessageInfo, 82)
+var file_master_proto_msgTypes = make([]protoimpl.MessageInfo, 85)
 var file_master_proto_goTypes = []any{
 	(*DiskTag)(nil),                               // 0: master_pb.DiskTag
 	(*Heartbeat)(nil),                             // 1: master_pb.Heartbeat
@@ -5275,70 +5709,73 @@ var file_master_proto_goTypes = []any{
 	(*Location)(nil),                              // 16: master_pb.Location
 	(*AssignRequest)(nil),                         // 17: master_pb.AssignRequest
 	(*VolumeGrowRequest)(nil),                     // 18: master_pb.VolumeGrowRequest
-	(*AssignResponse)(nil),                        // 19: master_pb.AssignResponse
-	(*StatisticsRequest)(nil),                     // 20: master_pb.StatisticsRequest
-	(*StatisticsResponse)(nil),                    // 21: master_pb.StatisticsResponse
-	(*Collection)(nil),                            // 22: master_pb.Collection
-	(*CollectionListRequest)(nil),                 // 23: master_pb.CollectionListRequest
-	(*CollectionListResponse)(nil),                // 24: master_pb.CollectionListResponse
-	(*CollectionStatisticsRequest)(nil),           // 25: master_pb.CollectionStatisticsRequest
-	(*CollectionStatisticsResponse)(nil),          // 26: master_pb.CollectionStatisticsResponse
-	(*CollectionStatistics)(nil),                  // 27: master_pb.CollectionStatistics
-	(*CollectionDeleteRequest)(nil),               // 28: master_pb.CollectionDeleteRequest
-	(*CollectionDeleteResponse)(nil),              // 29: master_pb.CollectionDeleteResponse
-	(*DiskInfo)(nil),                              // 30: master_pb.DiskInfo
-	(*DataNodeInfo)(nil),                          // 31: master_pb.DataNodeInfo
-	(*RackInfo)(nil),                              // 32: master_pb.RackInfo
-	(*DataCenterInfo)(nil),                        // 33: master_pb.DataCenterInfo
-	(*TopologyInfo)(nil),                          // 34: master_pb.TopologyInfo
-	(*VolumeListRequest)(nil),                     // 35: master_pb.VolumeListRequest
-	(*VolumeListResponse)(nil),                    // 36: master_pb.VolumeListResponse
-	(*LookupEcVolumeRequest)(nil),                 // 37: master_pb.LookupEcVolumeRequest
-	(*LookupEcVolumeResponse)(nil),                // 38: master_pb.LookupEcVolumeResponse
-	(*VacuumVolumeRequest)(nil),                   // 39: master_pb.VacuumVolumeRequest
-	(*VacuumVolumeResponse)(nil),                  // 40: master_pb.VacuumVolumeResponse
-	(*DisableVacuumRequest)(nil),                  // 41: master_pb.DisableVacuumRequest
-	(*DisableVacuumResponse)(nil),                 // 42: master_pb.DisableVacuumResponse
-	(*EnableVacuumRequest)(nil),                   // 43: master_pb.EnableVacuumRequest
-	(*EnableVacuumResponse)(nil),                  // 44: master_pb.EnableVacuumResponse
-	(*VolumeMarkReadonlyRequest)(nil),             // 45: master_pb.VolumeMarkReadonlyRequest
-	(*VolumeMarkReadonlyResponse)(nil),            // 46: master_pb.VolumeMarkReadonlyResponse
-	(*GetMasterConfigurationRequest)(nil),         // 47: master_pb.GetMasterConfigurationRequest
-	(*GetMasterConfigurationResponse)(nil),        // 48: master_pb.GetMasterConfigurationResponse
-	(*ListClusterNodesRequest)(nil),               // 49: master_pb.ListClusterNodesRequest
-	(*ListClusterNodesResponse)(nil),              // 50: master_pb.ListClusterNodesResponse
-	(*LeaseAdminTokenRequest)(nil),                // 51: master_pb.LeaseAdminTokenRequest
-	(*LeaseAdminTokenResponse)(nil),               // 52: master_pb.LeaseAdminTokenResponse
-	(*ReleaseAdminTokenRequest)(nil),              // 53: master_pb.ReleaseAdminTokenRequest
-	(*ReleaseAdminTokenResponse)(nil),             // 54: master_pb.ReleaseAdminTokenResponse
-	(*GetAdminLockStatusRequest)(nil),             // 55: master_pb.GetAdminLockStatusRequest
-	(*GetAdminLockStatusResponse)(nil),            // 56: master_pb.GetAdminLockStatusResponse
-	(*PingRequest)(nil),                           // 57: master_pb.PingRequest
-	(*PingResponse)(nil),                          // 58: master_pb.PingResponse
-	(*RaftAddServerRequest)(nil),                  // 59: master_pb.RaftAddServerRequest
-	(*RaftAddServerResponse)(nil),                 // 60: master_pb.RaftAddServerResponse
-	(*RaftRemoveServerRequest)(nil),               // 61: master_pb.RaftRemoveServerRequest
-	(*RaftRemoveServerResponse)(nil),              // 62: master_pb.RaftRemoveServerResponse
-	(*RaftListClusterServersRequest)(nil),         // 63: master_pb.RaftListClusterServersRequest
-	(*RaftListClusterServersResponse)(nil),        // 64: master_pb.RaftListClusterServersResponse
-	(*RaftLeadershipTransferRequest)(nil),         // 65: master_pb.RaftLeadershipTransferRequest
-	(*RaftLeadershipTransferResponse)(nil),        // 66: master_pb.RaftLeadershipTransferResponse
-	(*VolumeGrowResponse)(nil),                    // 67: master_pb.VolumeGrowResponse
-	nil,                                           // 68: master_pb.Heartbeat.MaxVolumeCountsEntry
-	nil,                                           // 69: master_pb.Heartbeat.DiskTotalBytesEntry
-	nil,                                           // 70: master_pb.Heartbeat.DiskFreeBytesEntry
-	nil,                                           // 71: master_pb.StorageBackend.PropertiesEntry
-	(*SuperBlockExtra_ErasureCoding)(nil),         // 72: master_pb.SuperBlockExtra.ErasureCoding
-	(*LookupVolumeResponse_VolumeIdLocation)(nil), // 73: master_pb.LookupVolumeResponse.VolumeIdLocation
-	nil, // 74: master_pb.DiskInfo.MaxVolumeCountByDiskEntry
-	nil, // 75: master_pb.DataNodeInfo.DiskInfosEntry
-	nil, // 76: master_pb.RackInfo.DiskInfosEntry
-	nil, // 77: master_pb.DataCenterInfo.DiskInfosEntry
-	nil, // 78: master_pb.TopologyInfo.DiskInfosEntry
-	(*LookupEcVolumeResponse_EcShardIdLocation)(nil),      // 79: master_pb.LookupEcVolumeResponse.EcShardIdLocation
-	(*ListClusterNodesResponse_ClusterNode)(nil),          // 80: master_pb.ListClusterNodesResponse.ClusterNode
-	(*RaftListClusterServersResponse_ClusterServers)(nil), // 81: master_pb.RaftListClusterServersResponse.ClusterServers
-	(*volume_server_pb.VolumeServerState)(nil),            // 82: volume_server_pb.VolumeServerState
+	(*ResumeVolumeGrowthRequest)(nil),             // 19: master_pb.ResumeVolumeGrowthRequest
+	(*ResumeVolumeGrowthResponse)(nil),            // 20: master_pb.ResumeVolumeGrowthResponse
+	(*AssignResponse)(nil),                        // 21: master_pb.AssignResponse
+	(*StatisticsRequest)(nil),                     // 22: master_pb.StatisticsRequest
+	(*StatisticsResponse)(nil),                    // 23: master_pb.StatisticsResponse
+	(*Collection)(nil),                            // 24: master_pb.Collection
+	(*CollectionListRequest)(nil),                 // 25: master_pb.CollectionListRequest
+	(*CollectionListResponse)(nil),                // 26: master_pb.CollectionListResponse
+	(*CollectionStatisticsRequest)(nil),           // 27: master_pb.CollectionStatisticsRequest
+	(*CollectionStatisticsResponse)(nil),          // 28: master_pb.CollectionStatisticsResponse
+	(*CollectionStatistics)(nil),                  // 29: master_pb.CollectionStatistics
+	(*CollectionDeleteRequest)(nil),               // 30: master_pb.CollectionDeleteRequest
+	(*CollectionDeleteResponse)(nil),              // 31: master_pb.CollectionDeleteResponse
+	(*DiskInfo)(nil),                              // 32: master_pb.DiskInfo
+	(*DataNodeInfo)(nil),                          // 33: master_pb.DataNodeInfo
+	(*RackInfo)(nil),                              // 34: master_pb.RackInfo
+	(*DataCenterInfo)(nil),                        // 35: master_pb.DataCenterInfo
+	(*TopologyInfo)(nil),                          // 36: master_pb.TopologyInfo
+	(*VolumeListRequest)(nil),                     // 37: master_pb.VolumeListRequest
+	(*VolumeListResponse)(nil),                    // 38: master_pb.VolumeListResponse
+	(*VolumeListStreamResponse)(nil),              // 39: master_pb.VolumeListStreamResponse
+	(*LookupEcVolumeRequest)(nil),                 // 40: master_pb.LookupEcVolumeRequest
+	(*LookupEcVolumeResponse)(nil),                // 41: master_pb.LookupEcVolumeResponse
+	(*VacuumVolumeRequest)(nil),                   // 42: master_pb.VacuumVolumeRequest
+	(*VacuumVolumeResponse)(nil),                  // 43: master_pb.VacuumVolumeResponse
+	(*DisableVacuumRequest)(nil),                  // 44: master_pb.DisableVacuumRequest
+	(*DisableVacuumResponse)(nil),                 // 45: master_pb.DisableVacuumResponse
+	(*EnableVacuumRequest)(nil),                   // 46: master_pb.EnableVacuumRequest
+	(*EnableVacuumResponse)(nil),                  // 47: master_pb.EnableVacuumResponse
+	(*VolumeMarkReadonlyRequest)(nil),             // 48: master_pb.VolumeMarkReadonlyRequest
+	(*VolumeMarkReadonlyResponse)(nil),            // 49: master_pb.VolumeMarkReadonlyResponse
+	(*GetMasterConfigurationRequest)(nil),         // 50: master_pb.GetMasterConfigurationRequest
+	(*GetMasterConfigurationResponse)(nil),        // 51: master_pb.GetMasterConfigurationResponse
+	(*ListClusterNodesRequest)(nil),               // 52: master_pb.ListClusterNodesRequest
+	(*ListClusterNodesResponse)(nil),              // 53: master_pb.ListClusterNodesResponse
+	(*LeaseAdminTokenRequest)(nil),                // 54: master_pb.LeaseAdminTokenRequest
+	(*LeaseAdminTokenResponse)(nil),               // 55: master_pb.LeaseAdminTokenResponse
+	(*ReleaseAdminTokenRequest)(nil),              // 56: master_pb.ReleaseAdminTokenRequest
+	(*ReleaseAdminTokenResponse)(nil),             // 57: master_pb.ReleaseAdminTokenResponse
+	(*GetAdminLockStatusRequest)(nil),             // 58: master_pb.GetAdminLockStatusRequest
+	(*GetAdminLockStatusResponse)(nil),            // 59: master_pb.GetAdminLockStatusResponse
+	(*PingRequest)(nil),                           // 60: master_pb.PingRequest
+	(*PingResponse)(nil),                          // 61: master_pb.PingResponse
+	(*RaftAddServerRequest)(nil),                  // 62: master_pb.RaftAddServerRequest
+	(*RaftAddServerResponse)(nil),                 // 63: master_pb.RaftAddServerResponse
+	(*RaftRemoveServerRequest)(nil),               // 64: master_pb.RaftRemoveServerRequest
+	(*RaftRemoveServerResponse)(nil),              // 65: master_pb.RaftRemoveServerResponse
+	(*RaftListClusterServersRequest)(nil),         // 66: master_pb.RaftListClusterServersRequest
+	(*RaftListClusterServersResponse)(nil),        // 67: master_pb.RaftListClusterServersResponse
+	(*RaftLeadershipTransferRequest)(nil),         // 68: master_pb.RaftLeadershipTransferRequest
+	(*RaftLeadershipTransferResponse)(nil),        // 69: master_pb.RaftLeadershipTransferResponse
+	(*VolumeGrowResponse)(nil),                    // 70: master_pb.VolumeGrowResponse
+	nil,                                           // 71: master_pb.Heartbeat.MaxVolumeCountsEntry
+	nil,                                           // 72: master_pb.Heartbeat.DiskTotalBytesEntry
+	nil,                                           // 73: master_pb.Heartbeat.DiskFreeBytesEntry
+	nil,                                           // 74: master_pb.StorageBackend.PropertiesEntry
+	(*SuperBlockExtra_ErasureCoding)(nil),         // 75: master_pb.SuperBlockExtra.ErasureCoding
+	(*LookupVolumeResponse_VolumeIdLocation)(nil), // 76: master_pb.LookupVolumeResponse.VolumeIdLocation
+	nil, // 77: master_pb.DiskInfo.MaxVolumeCountByDiskEntry
+	nil, // 78: master_pb.DataNodeInfo.DiskInfosEntry
+	nil, // 79: master_pb.RackInfo.DiskInfosEntry
+	nil, // 80: master_pb.DataCenterInfo.DiskInfosEntry
+	nil, // 81: master_pb.TopologyInfo.DiskInfosEntry
+	(*LookupEcVolumeResponse_EcShardIdLocation)(nil),      // 82: master_pb.LookupEcVolumeResponse.EcShardIdLocation
+	(*ListClusterNodesResponse_ClusterNode)(nil),          // 83: master_pb.ListClusterNodesResponse.ClusterNode
+	(*RaftListClusterServersResponse_ClusterServers)(nil), // 84: master_pb.RaftListClusterServersResponse.ClusterServers
+	(*volume_server_pb.VolumeServerState)(nil),            // 85: volume_server_pb.VolumeServerState
 }
 var file_master_proto_depIdxs = []int32{
 	3,  // 0: master_pb.Heartbeat.volumes:type_name -> master_pb.VolumeInformationMessage
@@ -5347,101 +5784,108 @@ var file_master_proto_depIdxs = []int32{
 	5,  // 3: master_pb.Heartbeat.ec_shards:type_name -> master_pb.VolumeEcShardInformationMessage
 	5,  // 4: master_pb.Heartbeat.new_ec_shards:type_name -> master_pb.VolumeEcShardInformationMessage
 	5,  // 5: master_pb.Heartbeat.deleted_ec_shards:type_name -> master_pb.VolumeEcShardInformationMessage
-	68, // 6: master_pb.Heartbeat.max_volume_counts:type_name -> master_pb.Heartbeat.MaxVolumeCountsEntry
-	82, // 7: master_pb.Heartbeat.state:type_name -> volume_server_pb.VolumeServerState
+	71, // 6: master_pb.Heartbeat.max_volume_counts:type_name -> master_pb.Heartbeat.MaxVolumeCountsEntry
+	85, // 7: master_pb.Heartbeat.state:type_name -> volume_server_pb.VolumeServerState
 	0,  // 8: master_pb.Heartbeat.disk_tags:type_name -> master_pb.DiskTag
-	69, // 9: master_pb.Heartbeat.disk_total_bytes:type_name -> master_pb.Heartbeat.DiskTotalBytesEntry
-	70, // 10: master_pb.Heartbeat.disk_free_bytes:type_name -> master_pb.Heartbeat.DiskFreeBytesEntry
+	72, // 9: master_pb.Heartbeat.disk_total_bytes:type_name -> master_pb.Heartbeat.DiskTotalBytesEntry
+	73, // 10: master_pb.Heartbeat.disk_free_bytes:type_name -> master_pb.Heartbeat.DiskFreeBytesEntry
 	3,  // 11: master_pb.Heartbeat.changed_volumes:type_name -> master_pb.VolumeInformationMessage
 	6,  // 12: master_pb.HeartbeatResponse.storage_backends:type_name -> master_pb.StorageBackend
-	71, // 13: master_pb.StorageBackend.properties:type_name -> master_pb.StorageBackend.PropertiesEntry
-	72, // 14: master_pb.SuperBlockExtra.erasure_coding:type_name -> master_pb.SuperBlockExtra.ErasureCoding
+	74, // 13: master_pb.StorageBackend.properties:type_name -> master_pb.StorageBackend.PropertiesEntry
+	75, // 14: master_pb.SuperBlockExtra.erasure_coding:type_name -> master_pb.SuperBlockExtra.ErasureCoding
 	10, // 15: master_pb.KeepConnectedResponse.volume_location:type_name -> master_pb.VolumeLocation
 	11, // 16: master_pb.KeepConnectedResponse.cluster_node_update:type_name -> master_pb.ClusterNodeUpdate
 	13, // 17: master_pb.KeepConnectedResponse.lock_ring_update:type_name -> master_pb.LockRingUpdate
-	73, // 18: master_pb.LookupVolumeResponse.volume_id_locations:type_name -> master_pb.LookupVolumeResponse.VolumeIdLocation
+	76, // 18: master_pb.LookupVolumeResponse.volume_id_locations:type_name -> master_pb.LookupVolumeResponse.VolumeIdLocation
 	16, // 19: master_pb.AssignResponse.replicas:type_name -> master_pb.Location
 	16, // 20: master_pb.AssignResponse.location:type_name -> master_pb.Location
-	22, // 21: master_pb.CollectionListResponse.collections:type_name -> master_pb.Collection
-	27, // 22: master_pb.CollectionStatisticsResponse.collections:type_name -> master_pb.CollectionStatistics
+	24, // 21: master_pb.CollectionListResponse.collections:type_name -> master_pb.Collection
+	29, // 22: master_pb.CollectionStatisticsResponse.collections:type_name -> master_pb.CollectionStatistics
 	3,  // 23: master_pb.DiskInfo.volume_infos:type_name -> master_pb.VolumeInformationMessage
 	5,  // 24: master_pb.DiskInfo.ec_shard_infos:type_name -> master_pb.VolumeEcShardInformationMessage
-	74, // 25: master_pb.DiskInfo.max_volume_count_by_disk:type_name -> master_pb.DiskInfo.MaxVolumeCountByDiskEntry
-	75, // 26: master_pb.DataNodeInfo.diskInfos:type_name -> master_pb.DataNodeInfo.DiskInfosEntry
-	31, // 27: master_pb.RackInfo.data_node_infos:type_name -> master_pb.DataNodeInfo
-	76, // 28: master_pb.RackInfo.diskInfos:type_name -> master_pb.RackInfo.DiskInfosEntry
-	32, // 29: master_pb.DataCenterInfo.rack_infos:type_name -> master_pb.RackInfo
-	77, // 30: master_pb.DataCenterInfo.diskInfos:type_name -> master_pb.DataCenterInfo.DiskInfosEntry
-	33, // 31: master_pb.TopologyInfo.data_center_infos:type_name -> master_pb.DataCenterInfo
-	78, // 32: master_pb.TopologyInfo.diskInfos:type_name -> master_pb.TopologyInfo.DiskInfosEntry
-	34, // 33: master_pb.VolumeListResponse.topology_info:type_name -> master_pb.TopologyInfo
-	79, // 34: master_pb.LookupEcVolumeResponse.shard_id_locations:type_name -> master_pb.LookupEcVolumeResponse.EcShardIdLocation
-	6,  // 35: master_pb.GetMasterConfigurationResponse.storage_backends:type_name -> master_pb.StorageBackend
-	80, // 36: master_pb.ListClusterNodesResponse.cluster_nodes:type_name -> master_pb.ListClusterNodesResponse.ClusterNode
-	81, // 37: master_pb.RaftListClusterServersResponse.cluster_servers:type_name -> master_pb.RaftListClusterServersResponse.ClusterServers
-	16, // 38: master_pb.LookupVolumeResponse.VolumeIdLocation.locations:type_name -> master_pb.Location
-	30, // 39: master_pb.DataNodeInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
-	30, // 40: master_pb.RackInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
-	30, // 41: master_pb.DataCenterInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
-	30, // 42: master_pb.TopologyInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
-	16, // 43: master_pb.LookupEcVolumeResponse.EcShardIdLocation.locations:type_name -> master_pb.Location
-	1,  // 44: master_pb.Seaweed.SendHeartbeat:input_type -> master_pb.Heartbeat
-	9,  // 45: master_pb.Seaweed.KeepConnected:input_type -> master_pb.KeepConnectedRequest
-	14, // 46: master_pb.Seaweed.LookupVolume:input_type -> master_pb.LookupVolumeRequest
-	17, // 47: master_pb.Seaweed.Assign:input_type -> master_pb.AssignRequest
-	17, // 48: master_pb.Seaweed.StreamAssign:input_type -> master_pb.AssignRequest
-	20, // 49: master_pb.Seaweed.Statistics:input_type -> master_pb.StatisticsRequest
-	23, // 50: master_pb.Seaweed.CollectionList:input_type -> master_pb.CollectionListRequest
-	28, // 51: master_pb.Seaweed.CollectionDelete:input_type -> master_pb.CollectionDeleteRequest
-	35, // 52: master_pb.Seaweed.VolumeList:input_type -> master_pb.VolumeListRequest
-	37, // 53: master_pb.Seaweed.LookupEcVolume:input_type -> master_pb.LookupEcVolumeRequest
-	39, // 54: master_pb.Seaweed.VacuumVolume:input_type -> master_pb.VacuumVolumeRequest
-	41, // 55: master_pb.Seaweed.DisableVacuum:input_type -> master_pb.DisableVacuumRequest
-	43, // 56: master_pb.Seaweed.EnableVacuum:input_type -> master_pb.EnableVacuumRequest
-	45, // 57: master_pb.Seaweed.VolumeMarkReadonly:input_type -> master_pb.VolumeMarkReadonlyRequest
-	47, // 58: master_pb.Seaweed.GetMasterConfiguration:input_type -> master_pb.GetMasterConfigurationRequest
-	49, // 59: master_pb.Seaweed.ListClusterNodes:input_type -> master_pb.ListClusterNodesRequest
-	51, // 60: master_pb.Seaweed.LeaseAdminToken:input_type -> master_pb.LeaseAdminTokenRequest
-	53, // 61: master_pb.Seaweed.ReleaseAdminToken:input_type -> master_pb.ReleaseAdminTokenRequest
-	55, // 62: master_pb.Seaweed.GetAdminLockStatus:input_type -> master_pb.GetAdminLockStatusRequest
-	57, // 63: master_pb.Seaweed.Ping:input_type -> master_pb.PingRequest
-	63, // 64: master_pb.Seaweed.RaftListClusterServers:input_type -> master_pb.RaftListClusterServersRequest
-	59, // 65: master_pb.Seaweed.RaftAddServer:input_type -> master_pb.RaftAddServerRequest
-	61, // 66: master_pb.Seaweed.RaftRemoveServer:input_type -> master_pb.RaftRemoveServerRequest
-	65, // 67: master_pb.Seaweed.RaftLeadershipTransfer:input_type -> master_pb.RaftLeadershipTransferRequest
-	18, // 68: master_pb.Seaweed.VolumeGrow:input_type -> master_pb.VolumeGrowRequest
-	25, // 69: master_pb.Seaweed.CollectionStatistics:input_type -> master_pb.CollectionStatisticsRequest
-	2,  // 70: master_pb.Seaweed.SendHeartbeat:output_type -> master_pb.HeartbeatResponse
-	12, // 71: master_pb.Seaweed.KeepConnected:output_type -> master_pb.KeepConnectedResponse
-	15, // 72: master_pb.Seaweed.LookupVolume:output_type -> master_pb.LookupVolumeResponse
-	19, // 73: master_pb.Seaweed.Assign:output_type -> master_pb.AssignResponse
-	19, // 74: master_pb.Seaweed.StreamAssign:output_type -> master_pb.AssignResponse
-	21, // 75: master_pb.Seaweed.Statistics:output_type -> master_pb.StatisticsResponse
-	24, // 76: master_pb.Seaweed.CollectionList:output_type -> master_pb.CollectionListResponse
-	29, // 77: master_pb.Seaweed.CollectionDelete:output_type -> master_pb.CollectionDeleteResponse
-	36, // 78: master_pb.Seaweed.VolumeList:output_type -> master_pb.VolumeListResponse
-	38, // 79: master_pb.Seaweed.LookupEcVolume:output_type -> master_pb.LookupEcVolumeResponse
-	40, // 80: master_pb.Seaweed.VacuumVolume:output_type -> master_pb.VacuumVolumeResponse
-	42, // 81: master_pb.Seaweed.DisableVacuum:output_type -> master_pb.DisableVacuumResponse
-	44, // 82: master_pb.Seaweed.EnableVacuum:output_type -> master_pb.EnableVacuumResponse
-	46, // 83: master_pb.Seaweed.VolumeMarkReadonly:output_type -> master_pb.VolumeMarkReadonlyResponse
-	48, // 84: master_pb.Seaweed.GetMasterConfiguration:output_type -> master_pb.GetMasterConfigurationResponse
-	50, // 85: master_pb.Seaweed.ListClusterNodes:output_type -> master_pb.ListClusterNodesResponse
-	52, // 86: master_pb.Seaweed.LeaseAdminToken:output_type -> master_pb.LeaseAdminTokenResponse
-	54, // 87: master_pb.Seaweed.ReleaseAdminToken:output_type -> master_pb.ReleaseAdminTokenResponse
-	56, // 88: master_pb.Seaweed.GetAdminLockStatus:output_type -> master_pb.GetAdminLockStatusResponse
-	58, // 89: master_pb.Seaweed.Ping:output_type -> master_pb.PingResponse
-	64, // 90: master_pb.Seaweed.RaftListClusterServers:output_type -> master_pb.RaftListClusterServersResponse
-	60, // 91: master_pb.Seaweed.RaftAddServer:output_type -> master_pb.RaftAddServerResponse
-	62, // 92: master_pb.Seaweed.RaftRemoveServer:output_type -> master_pb.RaftRemoveServerResponse
-	66, // 93: master_pb.Seaweed.RaftLeadershipTransfer:output_type -> master_pb.RaftLeadershipTransferResponse
-	67, // 94: master_pb.Seaweed.VolumeGrow:output_type -> master_pb.VolumeGrowResponse
-	26, // 95: master_pb.Seaweed.CollectionStatistics:output_type -> master_pb.CollectionStatisticsResponse
-	70, // [70:96] is the sub-list for method output_type
-	44, // [44:70] is the sub-list for method input_type
-	44, // [44:44] is the sub-list for extension type_name
-	44, // [44:44] is the sub-list for extension extendee
-	0,  // [0:44] is the sub-list for field type_name
+	77, // 25: master_pb.DiskInfo.max_volume_count_by_disk:type_name -> master_pb.DiskInfo.MaxVolumeCountByDiskEntry
+	78, // 26: master_pb.DataNodeInfo.diskInfos:type_name -> master_pb.DataNodeInfo.DiskInfosEntry
+	33, // 27: master_pb.RackInfo.data_node_infos:type_name -> master_pb.DataNodeInfo
+	79, // 28: master_pb.RackInfo.diskInfos:type_name -> master_pb.RackInfo.DiskInfosEntry
+	34, // 29: master_pb.DataCenterInfo.rack_infos:type_name -> master_pb.RackInfo
+	80, // 30: master_pb.DataCenterInfo.diskInfos:type_name -> master_pb.DataCenterInfo.DiskInfosEntry
+	35, // 31: master_pb.TopologyInfo.data_center_infos:type_name -> master_pb.DataCenterInfo
+	81, // 32: master_pb.TopologyInfo.diskInfos:type_name -> master_pb.TopologyInfo.DiskInfosEntry
+	36, // 33: master_pb.VolumeListResponse.topology_info:type_name -> master_pb.TopologyInfo
+	38, // 34: master_pb.VolumeListStreamResponse.header:type_name -> master_pb.VolumeListResponse
+	3,  // 35: master_pb.VolumeListStreamResponse.volume_infos:type_name -> master_pb.VolumeInformationMessage
+	5,  // 36: master_pb.VolumeListStreamResponse.ec_shard_infos:type_name -> master_pb.VolumeEcShardInformationMessage
+	82, // 37: master_pb.LookupEcVolumeResponse.shard_id_locations:type_name -> master_pb.LookupEcVolumeResponse.EcShardIdLocation
+	6,  // 38: master_pb.GetMasterConfigurationResponse.storage_backends:type_name -> master_pb.StorageBackend
+	83, // 39: master_pb.ListClusterNodesResponse.cluster_nodes:type_name -> master_pb.ListClusterNodesResponse.ClusterNode
+	84, // 40: master_pb.RaftListClusterServersResponse.cluster_servers:type_name -> master_pb.RaftListClusterServersResponse.ClusterServers
+	16, // 41: master_pb.LookupVolumeResponse.VolumeIdLocation.locations:type_name -> master_pb.Location
+	32, // 42: master_pb.DataNodeInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
+	32, // 43: master_pb.RackInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
+	32, // 44: master_pb.DataCenterInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
+	32, // 45: master_pb.TopologyInfo.DiskInfosEntry.value:type_name -> master_pb.DiskInfo
+	16, // 46: master_pb.LookupEcVolumeResponse.EcShardIdLocation.locations:type_name -> master_pb.Location
+	1,  // 47: master_pb.Seaweed.SendHeartbeat:input_type -> master_pb.Heartbeat
+	9,  // 48: master_pb.Seaweed.KeepConnected:input_type -> master_pb.KeepConnectedRequest
+	14, // 49: master_pb.Seaweed.LookupVolume:input_type -> master_pb.LookupVolumeRequest
+	17, // 50: master_pb.Seaweed.Assign:input_type -> master_pb.AssignRequest
+	17, // 51: master_pb.Seaweed.StreamAssign:input_type -> master_pb.AssignRequest
+	22, // 52: master_pb.Seaweed.Statistics:input_type -> master_pb.StatisticsRequest
+	25, // 53: master_pb.Seaweed.CollectionList:input_type -> master_pb.CollectionListRequest
+	30, // 54: master_pb.Seaweed.CollectionDelete:input_type -> master_pb.CollectionDeleteRequest
+	37, // 55: master_pb.Seaweed.VolumeList:input_type -> master_pb.VolumeListRequest
+	37, // 56: master_pb.Seaweed.VolumeListStream:input_type -> master_pb.VolumeListRequest
+	40, // 57: master_pb.Seaweed.LookupEcVolume:input_type -> master_pb.LookupEcVolumeRequest
+	42, // 58: master_pb.Seaweed.VacuumVolume:input_type -> master_pb.VacuumVolumeRequest
+	44, // 59: master_pb.Seaweed.DisableVacuum:input_type -> master_pb.DisableVacuumRequest
+	46, // 60: master_pb.Seaweed.EnableVacuum:input_type -> master_pb.EnableVacuumRequest
+	48, // 61: master_pb.Seaweed.VolumeMarkReadonly:input_type -> master_pb.VolumeMarkReadonlyRequest
+	50, // 62: master_pb.Seaweed.GetMasterConfiguration:input_type -> master_pb.GetMasterConfigurationRequest
+	52, // 63: master_pb.Seaweed.ListClusterNodes:input_type -> master_pb.ListClusterNodesRequest
+	54, // 64: master_pb.Seaweed.LeaseAdminToken:input_type -> master_pb.LeaseAdminTokenRequest
+	56, // 65: master_pb.Seaweed.ReleaseAdminToken:input_type -> master_pb.ReleaseAdminTokenRequest
+	58, // 66: master_pb.Seaweed.GetAdminLockStatus:input_type -> master_pb.GetAdminLockStatusRequest
+	60, // 67: master_pb.Seaweed.Ping:input_type -> master_pb.PingRequest
+	66, // 68: master_pb.Seaweed.RaftListClusterServers:input_type -> master_pb.RaftListClusterServersRequest
+	62, // 69: master_pb.Seaweed.RaftAddServer:input_type -> master_pb.RaftAddServerRequest
+	64, // 70: master_pb.Seaweed.RaftRemoveServer:input_type -> master_pb.RaftRemoveServerRequest
+	68, // 71: master_pb.Seaweed.RaftLeadershipTransfer:input_type -> master_pb.RaftLeadershipTransferRequest
+	19, // 72: master_pb.Seaweed.ResumeVolumeGrowth:input_type -> master_pb.ResumeVolumeGrowthRequest
+	18, // 73: master_pb.Seaweed.VolumeGrow:input_type -> master_pb.VolumeGrowRequest
+	27, // 74: master_pb.Seaweed.CollectionStatistics:input_type -> master_pb.CollectionStatisticsRequest
+	2,  // 75: master_pb.Seaweed.SendHeartbeat:output_type -> master_pb.HeartbeatResponse
+	12, // 76: master_pb.Seaweed.KeepConnected:output_type -> master_pb.KeepConnectedResponse
+	15, // 77: master_pb.Seaweed.LookupVolume:output_type -> master_pb.LookupVolumeResponse
+	21, // 78: master_pb.Seaweed.Assign:output_type -> master_pb.AssignResponse
+	21, // 79: master_pb.Seaweed.StreamAssign:output_type -> master_pb.AssignResponse
+	23, // 80: master_pb.Seaweed.Statistics:output_type -> master_pb.StatisticsResponse
+	26, // 81: master_pb.Seaweed.CollectionList:output_type -> master_pb.CollectionListResponse
+	31, // 82: master_pb.Seaweed.CollectionDelete:output_type -> master_pb.CollectionDeleteResponse
+	38, // 83: master_pb.Seaweed.VolumeList:output_type -> master_pb.VolumeListResponse
+	39, // 84: master_pb.Seaweed.VolumeListStream:output_type -> master_pb.VolumeListStreamResponse
+	41, // 85: master_pb.Seaweed.LookupEcVolume:output_type -> master_pb.LookupEcVolumeResponse
+	43, // 86: master_pb.Seaweed.VacuumVolume:output_type -> master_pb.VacuumVolumeResponse
+	45, // 87: master_pb.Seaweed.DisableVacuum:output_type -> master_pb.DisableVacuumResponse
+	47, // 88: master_pb.Seaweed.EnableVacuum:output_type -> master_pb.EnableVacuumResponse
+	49, // 89: master_pb.Seaweed.VolumeMarkReadonly:output_type -> master_pb.VolumeMarkReadonlyResponse
+	51, // 90: master_pb.Seaweed.GetMasterConfiguration:output_type -> master_pb.GetMasterConfigurationResponse
+	53, // 91: master_pb.Seaweed.ListClusterNodes:output_type -> master_pb.ListClusterNodesResponse
+	55, // 92: master_pb.Seaweed.LeaseAdminToken:output_type -> master_pb.LeaseAdminTokenResponse
+	57, // 93: master_pb.Seaweed.ReleaseAdminToken:output_type -> master_pb.ReleaseAdminTokenResponse
+	59, // 94: master_pb.Seaweed.GetAdminLockStatus:output_type -> master_pb.GetAdminLockStatusResponse
+	61, // 95: master_pb.Seaweed.Ping:output_type -> master_pb.PingResponse
+	67, // 96: master_pb.Seaweed.RaftListClusterServers:output_type -> master_pb.RaftListClusterServersResponse
+	63, // 97: master_pb.Seaweed.RaftAddServer:output_type -> master_pb.RaftAddServerResponse
+	65, // 98: master_pb.Seaweed.RaftRemoveServer:output_type -> master_pb.RaftRemoveServerResponse
+	69, // 99: master_pb.Seaweed.RaftLeadershipTransfer:output_type -> master_pb.RaftLeadershipTransferResponse
+	20, // 100: master_pb.Seaweed.ResumeVolumeGrowth:output_type -> master_pb.ResumeVolumeGrowthResponse
+	70, // 101: master_pb.Seaweed.VolumeGrow:output_type -> master_pb.VolumeGrowResponse
+	28, // 102: master_pb.Seaweed.CollectionStatistics:output_type -> master_pb.CollectionStatisticsResponse
+	75, // [75:103] is the sub-list for method output_type
+	47, // [47:75] is the sub-list for method input_type
+	47, // [47:47] is the sub-list for extension type_name
+	47, // [47:47] is the sub-list for extension extendee
+	0,  // [0:47] is the sub-list for field type_name
 }
 
 func init() { file_master_proto_init() }
@@ -5456,7 +5900,7 @@ func file_master_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_master_proto_rawDesc), len(file_master_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   82,
+			NumMessages:   85,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/weed/pb/master_pb/master_grpc.pb.go b/weed/pb/master_pb/master_grpc.pb.go
index a5d0267781..c697724512 100644
--- a/weed/pb/master_pb/master_grpc.pb.go
+++ b/weed/pb/master_pb/master_grpc.pb.go
@@ -28,6 +28,7 @@ const (
 	Seaweed_CollectionList_FullMethodName         = "/master_pb.Seaweed/CollectionList"
 	Seaweed_CollectionDelete_FullMethodName       = "/master_pb.Seaweed/CollectionDelete"
 	Seaweed_VolumeList_FullMethodName             = "/master_pb.Seaweed/VolumeList"
+	Seaweed_VolumeListStream_FullMethodName       = "/master_pb.Seaweed/VolumeListStream"
 	Seaweed_LookupEcVolume_FullMethodName         = "/master_pb.Seaweed/LookupEcVolume"
 	Seaweed_VacuumVolume_FullMethodName           = "/master_pb.Seaweed/VacuumVolume"
 	Seaweed_DisableVacuum_FullMethodName          = "/master_pb.Seaweed/DisableVacuum"
@@ -43,6 +44,7 @@ const (
 	Seaweed_RaftAddServer_FullMethodName          = "/master_pb.Seaweed/RaftAddServer"
 	Seaweed_RaftRemoveServer_FullMethodName       = "/master_pb.Seaweed/RaftRemoveServer"
 	Seaweed_RaftLeadershipTransfer_FullMethodName = "/master_pb.Seaweed/RaftLeadershipTransfer"
+	Seaweed_ResumeVolumeGrowth_FullMethodName     = "/master_pb.Seaweed/ResumeVolumeGrowth"
 	Seaweed_VolumeGrow_FullMethodName             = "/master_pb.Seaweed/VolumeGrow"
 	Seaweed_CollectionStatistics_FullMethodName   = "/master_pb.Seaweed/CollectionStatistics"
 )
@@ -60,6 +62,7 @@ type SeaweedClient interface {
 	CollectionList(ctx context.Context, in *CollectionListRequest, opts ...grpc.CallOption) (*CollectionListResponse, error)
 	CollectionDelete(ctx context.Context, in *CollectionDeleteRequest, opts ...grpc.CallOption) (*CollectionDeleteResponse, error)
 	VolumeList(ctx context.Context, in *VolumeListRequest, opts ...grpc.CallOption) (*VolumeListResponse, error)
+	VolumeListStream(ctx context.Context, in *VolumeListRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[VolumeListStreamResponse], error)
 	LookupEcVolume(ctx context.Context, in *LookupEcVolumeRequest, opts ...grpc.CallOption) (*LookupEcVolumeResponse, error)
 	VacuumVolume(ctx context.Context, in *VacuumVolumeRequest, opts ...grpc.CallOption) (*VacuumVolumeResponse, error)
 	DisableVacuum(ctx context.Context, in *DisableVacuumRequest, opts ...grpc.CallOption) (*DisableVacuumResponse, error)
@@ -75,6 +78,7 @@ type SeaweedClient interface {
 	RaftAddServer(ctx context.Context, in *RaftAddServerRequest, opts ...grpc.CallOption) (*RaftAddServerResponse, error)
 	RaftRemoveServer(ctx context.Context, in *RaftRemoveServerRequest, opts ...grpc.CallOption) (*RaftRemoveServerResponse, error)
 	RaftLeadershipTransfer(ctx context.Context, in *RaftLeadershipTransferRequest, opts ...grpc.CallOption) (*RaftLeadershipTransferResponse, error)
+	ResumeVolumeGrowth(ctx context.Context, in *ResumeVolumeGrowthRequest, opts ...grpc.CallOption) (*ResumeVolumeGrowthResponse, error)
 	VolumeGrow(ctx context.Context, in *VolumeGrowRequest, opts ...grpc.CallOption) (*VolumeGrowResponse, error)
 	CollectionStatistics(ctx context.Context, in *CollectionStatisticsRequest, opts ...grpc.CallOption) (*CollectionStatisticsResponse, error)
 }
@@ -186,6 +190,25 @@ func (c *seaweedClient) VolumeList(ctx context.Context, in *VolumeListRequest, o
 	return out, nil
 }
 
+func (c *seaweedClient) VolumeListStream(ctx context.Context, in *VolumeListRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[VolumeListStreamResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Seaweed_ServiceDesc.Streams[3], Seaweed_VolumeListStream_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[VolumeListRequest, VolumeListStreamResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Seaweed_VolumeListStreamClient = grpc.ServerStreamingClient[VolumeListStreamResponse]
+
 func (c *seaweedClient) LookupEcVolume(ctx context.Context, in *LookupEcVolumeRequest, opts ...grpc.CallOption) (*LookupEcVolumeResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(LookupEcVolumeResponse)
@@ -336,6 +359,16 @@ func (c *seaweedClient) RaftLeadershipTransfer(ctx context.Context, in *RaftLead
 	return out, nil
 }
 
+func (c *seaweedClient) ResumeVolumeGrowth(ctx context.Context, in *ResumeVolumeGrowthRequest, opts ...grpc.CallOption) (*ResumeVolumeGrowthResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ResumeVolumeGrowthResponse)
+	err := c.cc.Invoke(ctx, Seaweed_ResumeVolumeGrowth_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *seaweedClient) VolumeGrow(ctx context.Context, in *VolumeGrowRequest, opts ...grpc.CallOption) (*VolumeGrowResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(VolumeGrowResponse)
@@ -369,6 +402,7 @@ type SeaweedServer interface {
 	CollectionList(context.Context, *CollectionListRequest) (*CollectionListResponse, error)
 	CollectionDelete(context.Context, *CollectionDeleteRequest) (*CollectionDeleteResponse, error)
 	VolumeList(context.Context, *VolumeListRequest) (*VolumeListResponse, error)
+	VolumeListStream(*VolumeListRequest, grpc.ServerStreamingServer[VolumeListStreamResponse]) error
 	LookupEcVolume(context.Context, *LookupEcVolumeRequest) (*LookupEcVolumeResponse, error)
 	VacuumVolume(context.Context, *VacuumVolumeRequest) (*VacuumVolumeResponse, error)
 	DisableVacuum(context.Context, *DisableVacuumRequest) (*DisableVacuumResponse, error)
@@ -384,6 +418,7 @@ type SeaweedServer interface {
 	RaftAddServer(context.Context, *RaftAddServerRequest) (*RaftAddServerResponse, error)
 	RaftRemoveServer(context.Context, *RaftRemoveServerRequest) (*RaftRemoveServerResponse, error)
 	RaftLeadershipTransfer(context.Context, *RaftLeadershipTransferRequest) (*RaftLeadershipTransferResponse, error)
+	ResumeVolumeGrowth(context.Context, *ResumeVolumeGrowthRequest) (*ResumeVolumeGrowthResponse, error)
 	VolumeGrow(context.Context, *VolumeGrowRequest) (*VolumeGrowResponse, error)
 	CollectionStatistics(context.Context, *CollectionStatisticsRequest) (*CollectionStatisticsResponse, error)
 	mustEmbedUnimplementedSeaweedServer()
@@ -423,6 +458,9 @@ func (UnimplementedSeaweedServer) CollectionDelete(context.Context, *CollectionD
 func (UnimplementedSeaweedServer) VolumeList(context.Context, *VolumeListRequest) (*VolumeListResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method VolumeList not implemented")
 }
+func (UnimplementedSeaweedServer) VolumeListStream(*VolumeListRequest, grpc.ServerStreamingServer[VolumeListStreamResponse]) error {
+	return status.Error(codes.Unimplemented, "method VolumeListStream not implemented")
+}
 func (UnimplementedSeaweedServer) LookupEcVolume(context.Context, *LookupEcVolumeRequest) (*LookupEcVolumeResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method LookupEcVolume not implemented")
 }
@@ -468,6 +506,9 @@ func (UnimplementedSeaweedServer) RaftRemoveServer(context.Context, *RaftRemoveS
 func (UnimplementedSeaweedServer) RaftLeadershipTransfer(context.Context, *RaftLeadershipTransferRequest) (*RaftLeadershipTransferResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method RaftLeadershipTransfer not implemented")
 }
+func (UnimplementedSeaweedServer) ResumeVolumeGrowth(context.Context, *ResumeVolumeGrowthRequest) (*ResumeVolumeGrowthResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ResumeVolumeGrowth not implemented")
+}
 func (UnimplementedSeaweedServer) VolumeGrow(context.Context, *VolumeGrowRequest) (*VolumeGrowResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method VolumeGrow not implemented")
 }
@@ -624,6 +665,17 @@ func _Seaweed_VolumeList_Handler(srv interface{}, ctx context.Context, dec func(
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Seaweed_VolumeListStream_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(VolumeListRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(SeaweedServer).VolumeListStream(m, &grpc.GenericServerStream[VolumeListRequest, VolumeListStreamResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Seaweed_VolumeListStreamServer = grpc.ServerStreamingServer[VolumeListStreamResponse]
+
 func _Seaweed_LookupEcVolume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(LookupEcVolumeRequest)
 	if err := dec(in); err != nil {
@@ -894,6 +946,24 @@ func _Seaweed_RaftLeadershipTransfer_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Seaweed_ResumeVolumeGrowth_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResumeVolumeGrowthRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(SeaweedServer).ResumeVolumeGrowth(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Seaweed_ResumeVolumeGrowth_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(SeaweedServer).ResumeVolumeGrowth(ctx, req.(*ResumeVolumeGrowthRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Seaweed_VolumeGrow_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(VolumeGrowRequest)
 	if err := dec(in); err != nil {
@@ -1021,6 +1091,10 @@ var Seaweed_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "RaftLeadershipTransfer",
 			Handler:    _Seaweed_RaftLeadershipTransfer_Handler,
 		},
+		{
+			MethodName: "ResumeVolumeGrowth",
+			Handler:    _Seaweed_ResumeVolumeGrowth_Handler,
+		},
 		{
 			MethodName: "VolumeGrow",
 			Handler:    _Seaweed_VolumeGrow_Handler,
@@ -1049,6 +1123,11 @@ var Seaweed_ServiceDesc = grpc.ServiceDesc{
 			ServerStreams: true,
 			ClientStreams: true,
 		},
+		{
+			StreamName:    "VolumeListStream",
+			Handler:       _Seaweed_VolumeListStream_Handler,
+			ServerStreams: true,
+		},
 	},
 	Metadata: "master.proto",
 }
diff --git a/weed/pb/plugin.proto b/weed/pb/plugin.proto
index 9333a456c7..ffef11de56 100644
--- a/weed/pb/plugin.proto
+++ b/weed/pb/plugin.proto
@@ -27,6 +27,8 @@ message WorkerToAdminMessage {
     DetectionComplete detection_complete = 15;
     JobProgressUpdate job_progress_update = 16;
     JobCompleted job_completed = 17;
+    WorkerObservations observations = 18;
+    ObjectPreviewResponse object_preview_response = 19;
   }
 }
 
@@ -42,6 +44,7 @@ message AdminToWorkerMessage {
     ExecuteJobRequest execute_job_request = 13;
     CancelRequest cancel_request = 14;
     AdminShutdown shutdown = 15;
+    RequestObjectPreview request_object_preview = 16;
   }
 }
 
@@ -452,3 +455,61 @@ enum ActivitySource {
   ACTIVITY_SOURCE_DETECTOR = 2;
   ACTIVITY_SOURCE_EXECUTOR = 3;
 }
+
+// WorkerObservations reports what a worker learned about the objects it
+// inspected. A worker opens a table to decide whether it needs a job; what it
+// saw is worth keeping either way, because for a format the cluster cannot
+// read, the worker is the only thing that can describe it.
+//
+// Observations are not work. Admin caches them and serves them back, so a
+// worker that goes away leaves its last ones standing rather than blanking a
+// page.
+message WorkerObservations {
+  string job_type = 1;
+  repeated ObjectObservation observations = 2;
+}
+
+// ObjectObservation is one object as a worker last saw it.
+message ObjectObservation {
+  // Identifier of the object, e.g. ["bucket", "namespace", "table"].
+  repeated string object_id = 1;
+  // What kind of object this is, e.g. "table".
+  string object_kind = 2;
+  // The object's format, e.g. "LANCE", so a reader can tell whose observation
+  // this is without parsing the attributes.
+  string format = 3;
+  // Whatever the worker can cheaply say: schema, row count, fragment count.
+  // The keys are the worker's to choose.
+  map<string, ConfigValue> attributes = 4;
+  google.protobuf.Timestamp observed_at = 5;
+}
+
+// RequestObjectPreview asks a worker for sample rows of an object admin cannot
+// read itself. Unlike an observation this is not cached: it is fetched when
+// someone opens the page, because rows are the object's data rather than a
+// description of it, and holding a copy in admin is neither fresh nor its
+// business.
+message RequestObjectPreview {
+  repeated string object_id = 1;
+  // The format admin believes this object is, so a worker that does not own it
+  // can decline instead of guessing.
+  string format = 2;
+  int32 row_limit = 3;
+}
+
+// ObjectPreviewResponse carries the sample back, already rendered as text. The
+// worker is the only thing that knows the object's types, so it formats them;
+// admin displays what it is given.
+message ObjectPreviewResponse {
+  string request_id = 6;
+  bool success = 1;
+  string error_message = 2;
+  repeated string columns = 3;
+  repeated PreviewRow rows = 4;
+  // Rows in the object, which is not the number sampled.
+  int64 total_rows = 5;
+}
+
+message PreviewRow {
+  repeated string values = 1;
+}
diff --git a/weed/pb/plugin_pb/plugin.pb.go b/weed/pb/plugin_pb/plugin.pb.go
index 06c0b02e80..dd25056889 100644
--- a/weed/pb/plugin_pb/plugin.pb.go
+++ b/weed/pb/plugin_pb/plugin.pb.go
@@ -453,6 +453,8 @@ type WorkerToAdminMessage struct {
 	//	*WorkerToAdminMessage_DetectionComplete
 	//	*WorkerToAdminMessage_JobProgressUpdate
 	//	*WorkerToAdminMessage_JobCompleted
+	//	*WorkerToAdminMessage_Observations
+	//	*WorkerToAdminMessage_ObjectPreviewResponse
 	Body          isWorkerToAdminMessage_Body `protobuf_oneof:"body"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -581,6 +583,24 @@ func (x *WorkerToAdminMessage) GetJobCompleted() *JobCompleted {
 	return nil
 }
 
+func (x *WorkerToAdminMessage) GetObservations() *WorkerObservations {
+	if x != nil {
+		if x, ok := x.Body.(*WorkerToAdminMessage_Observations); ok {
+			return x.Observations
+		}
+	}
+	return nil
+}
+
+func (x *WorkerToAdminMessage) GetObjectPreviewResponse() *ObjectPreviewResponse {
+	if x != nil {
+		if x, ok := x.Body.(*WorkerToAdminMessage_ObjectPreviewResponse); ok {
+			return x.ObjectPreviewResponse
+		}
+	}
+	return nil
+}
+
 type isWorkerToAdminMessage_Body interface {
 	isWorkerToAdminMessage_Body()
 }
@@ -617,6 +637,14 @@ type WorkerToAdminMessage_JobCompleted struct {
 	JobCompleted *JobCompleted `protobuf:"bytes,17,opt,name=job_completed,json=jobCompleted,proto3,oneof"`
 }
 
+type WorkerToAdminMessage_Observations struct {
+	Observations *WorkerObservations `protobuf:"bytes,18,opt,name=observations,proto3,oneof"`
+}
+
+type WorkerToAdminMessage_ObjectPreviewResponse struct {
+	ObjectPreviewResponse *ObjectPreviewResponse `protobuf:"bytes,19,opt,name=object_preview_response,json=objectPreviewResponse,proto3,oneof"`
+}
+
 func (*WorkerToAdminMessage_Hello) isWorkerToAdminMessage_Body() {}
 
 func (*WorkerToAdminMessage_Heartbeat) isWorkerToAdminMessage_Body() {}
@@ -633,6 +661,10 @@ func (*WorkerToAdminMessage_JobProgressUpdate) isWorkerToAdminMessage_Body() {}
 
 func (*WorkerToAdminMessage_JobCompleted) isWorkerToAdminMessage_Body() {}
 
+func (*WorkerToAdminMessage_Observations) isWorkerToAdminMessage_Body() {}
+
+func (*WorkerToAdminMessage_ObjectPreviewResponse) isWorkerToAdminMessage_Body() {}
+
 // AdminToWorkerMessage carries commands and lifecycle notifications from admin.
 type AdminToWorkerMessage struct {
 	state     protoimpl.MessageState `protogen:"open.v1"`
@@ -646,6 +678,7 @@ type AdminToWorkerMessage struct {
 	//	*AdminToWorkerMessage_ExecuteJobRequest
 	//	*AdminToWorkerMessage_CancelRequest
 	//	*AdminToWorkerMessage_Shutdown
+	//	*AdminToWorkerMessage_RequestObjectPreview
 	Body          isAdminToWorkerMessage_Body `protobuf_oneof:"body"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -756,6 +789,15 @@ func (x *AdminToWorkerMessage) GetShutdown() *AdminShutdown {
 	return nil
 }
 
+func (x *AdminToWorkerMessage) GetRequestObjectPreview() *RequestObjectPreview {
+	if x != nil {
+		if x, ok := x.Body.(*AdminToWorkerMessage_RequestObjectPreview); ok {
+			return x.RequestObjectPreview
+		}
+	}
+	return nil
+}
+
 type isAdminToWorkerMessage_Body interface {
 	isAdminToWorkerMessage_Body()
 }
@@ -784,6 +826,10 @@ type AdminToWorkerMessage_Shutdown struct {
 	Shutdown *AdminShutdown `protobuf:"bytes,15,opt,name=shutdown,proto3,oneof"`
 }
 
+type AdminToWorkerMessage_RequestObjectPreview struct {
+	RequestObjectPreview *RequestObjectPreview `protobuf:"bytes,16,opt,name=request_object_preview,json=requestObjectPreview,proto3,oneof"`
+}
+
 func (*AdminToWorkerMessage_Hello) isAdminToWorkerMessage_Body() {}
 
 func (*AdminToWorkerMessage_RequestConfigSchema) isAdminToWorkerMessage_Body() {}
@@ -796,6 +842,8 @@ func (*AdminToWorkerMessage_CancelRequest) isAdminToWorkerMessage_Body() {}
 
 func (*AdminToWorkerMessage_Shutdown) isAdminToWorkerMessage_Body() {}
 
+func (*AdminToWorkerMessage_RequestObjectPreview) isAdminToWorkerMessage_Body() {}
+
 type WorkerHello struct {
 	state            protoimpl.MessageState `protogen:"open.v1"`
 	WorkerId         string                 `protobuf:"bytes,1,opt,name=worker_id,json=workerId,proto3" json:"worker_id,omitempty"`
@@ -3928,11 +3976,353 @@ func (x *PersistedJobTypeConfig) GetUpdatedBy() string {
 	return ""
 }
 
+// WorkerObservations reports what a worker learned about the objects it
+// inspected. A worker opens a table to decide whether it needs a job; what it
+// saw is worth keeping either way, because for a format the cluster cannot
+// read, the worker is the only thing that can describe it.
+//
+// Observations are not work. Admin caches them and serves them back, so a
+// worker that goes away leaves its last ones standing rather than blanking a
+// page.
+type WorkerObservations struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	JobType       string                 `protobuf:"bytes,1,opt,name=job_type,json=jobType,proto3" json:"job_type,omitempty"`
+	Observations  []*ObjectObservation   `protobuf:"bytes,2,rep,name=observations,proto3" json:"observations,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WorkerObservations) Reset() {
+	*x = WorkerObservations{}
+	mi := &file_plugin_proto_msgTypes[39]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WorkerObservations) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkerObservations) ProtoMessage() {}
+
+func (x *WorkerObservations) ProtoReflect() protoreflect.Message {
+	mi := &file_plugin_proto_msgTypes[39]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkerObservations.ProtoReflect.Descriptor instead.
+func (*WorkerObservations) Descriptor() ([]byte, []int) {
+	return file_plugin_proto_rawDescGZIP(), []int{39}
+}
+
+func (x *WorkerObservations) GetJobType() string {
+	if x != nil {
+		return x.JobType
+	}
+	return ""
+}
+
+func (x *WorkerObservations) GetObservations() []*ObjectObservation {
+	if x != nil {
+		return x.Observations
+	}
+	return nil
+}
+
+// ObjectObservation is one object as a worker last saw it.
+type ObjectObservation struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Identifier of the object, e.g. ["bucket", "namespace", "table"].
+	ObjectId []string `protobuf:"bytes,1,rep,name=object_id,json=objectId,proto3" json:"object_id,omitempty"`
+	// What kind of object this is, e.g. "table".
+	ObjectKind string `protobuf:"bytes,2,opt,name=object_kind,json=objectKind,proto3" json:"object_kind,omitempty"`
+	// The object's format, e.g. "LANCE", so a reader can tell whose observation
+	// this is without parsing the attributes.
+	Format string `protobuf:"bytes,3,opt,name=format,proto3" json:"format,omitempty"`
+	// Whatever the worker can cheaply say: schema, row count, fragment count.
+	// The keys are the worker's to choose.
+	Attributes    map[string]*ConfigValue `protobuf:"bytes,4,rep,name=attributes,proto3" json:"attributes,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	ObservedAt    *timestamppb.Timestamp  `protobuf:"bytes,5,opt,name=observed_at,json=observedAt,proto3" json:"observed_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ObjectObservation) Reset() {
+	*x = ObjectObservation{}
+	mi := &file_plugin_proto_msgTypes[40]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ObjectObservation) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ObjectObservation) ProtoMessage() {}
+
+func (x *ObjectObservation) ProtoReflect() protoreflect.Message {
+	mi := &file_plugin_proto_msgTypes[40]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ObjectObservation.ProtoReflect.Descriptor instead.
+func (*ObjectObservation) Descriptor() ([]byte, []int) {
+	return file_plugin_proto_rawDescGZIP(), []int{40}
+}
+
+func (x *ObjectObservation) GetObjectId() []string {
+	if x != nil {
+		return x.ObjectId
+	}
+	return nil
+}
+
+func (x *ObjectObservation) GetObjectKind() string {
+	if x != nil {
+		return x.ObjectKind
+	}
+	return ""
+}
+
+func (x *ObjectObservation) GetFormat() string {
+	if x != nil {
+		return x.Format
+	}
+	return ""
+}
+
+func (x *ObjectObservation) GetAttributes() map[string]*ConfigValue {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *ObjectObservation) GetObservedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ObservedAt
+	}
+	return nil
+}
+
+// RequestObjectPreview asks a worker for sample rows of an object admin cannot
+// read itself. Unlike an observation this is not cached: it is fetched when
+// someone opens the page, because rows are the object's data rather than a
+// description of it, and holding a copy in admin is neither fresh nor its
+// business.
+type RequestObjectPreview struct {
+	state    protoimpl.MessageState `protogen:"open.v1"`
+	ObjectId []string               `protobuf:"bytes,1,rep,name=object_id,json=objectId,proto3" json:"object_id,omitempty"`
+	// The format admin believes this object is, so a worker that does not own it
+	// can decline instead of guessing.
+	Format        string `protobuf:"bytes,2,opt,name=format,proto3" json:"format,omitempty"`
+	RowLimit      int32  `protobuf:"varint,3,opt,name=row_limit,json=rowLimit,proto3" json:"row_limit,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RequestObjectPreview) Reset() {
+	*x = RequestObjectPreview{}
+	mi := &file_plugin_proto_msgTypes[41]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RequestObjectPreview) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestObjectPreview) ProtoMessage() {}
+
+func (x *RequestObjectPreview) ProtoReflect() protoreflect.Message {
+	mi := &file_plugin_proto_msgTypes[41]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestObjectPreview.ProtoReflect.Descriptor instead.
+func (*RequestObjectPreview) Descriptor() ([]byte, []int) {
+	return file_plugin_proto_rawDescGZIP(), []int{41}
+}
+
+func (x *RequestObjectPreview) GetObjectId() []string {
+	if x != nil {
+		return x.ObjectId
+	}
+	return nil
+}
+
+func (x *RequestObjectPreview) GetFormat() string {
+	if x != nil {
+		return x.Format
+	}
+	return ""
+}
+
+func (x *RequestObjectPreview) GetRowLimit() int32 {
+	if x != nil {
+		return x.RowLimit
+	}
+	return 0
+}
+
+// ObjectPreviewResponse carries the sample back, already rendered as text. The
+// worker is the only thing that knows the object's types, so it formats them;
+// admin displays what it is given.
+type ObjectPreviewResponse struct {
+	state        protoimpl.MessageState `protogen:"open.v1"`
+	RequestId    string                 `protobuf:"bytes,6,opt,name=request_id,json=requestId,proto3" json:"request_id,omitempty"`
+	Success      bool                   `protobuf:"varint,1,opt,name=success,proto3" json:"success,omitempty"`
+	ErrorMessage string                 `protobuf:"bytes,2,opt,name=error_message,json=errorMessage,proto3" json:"error_message,omitempty"`
+	Columns      []string               `protobuf:"bytes,3,rep,name=columns,proto3" json:"columns,omitempty"`
+	Rows         []*PreviewRow          `protobuf:"bytes,4,rep,name=rows,proto3" json:"rows,omitempty"`
+	// Rows in the object, which is not the number sampled.
+	TotalRows     int64 `protobuf:"varint,5,opt,name=total_rows,json=totalRows,proto3" json:"total_rows,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ObjectPreviewResponse) Reset() {
+	*x = ObjectPreviewResponse{}
+	mi := &file_plugin_proto_msgTypes[42]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ObjectPreviewResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ObjectPreviewResponse) ProtoMessage() {}
+
+func (x *ObjectPreviewResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_plugin_proto_msgTypes[42]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ObjectPreviewResponse.ProtoReflect.Descriptor instead.
+func (*ObjectPreviewResponse) Descriptor() ([]byte, []int) {
+	return file_plugin_proto_rawDescGZIP(), []int{42}
+}
+
+func (x *ObjectPreviewResponse) GetRequestId() string {
+	if x != nil {
+		return x.RequestId
+	}
+	return ""
+}
+
+func (x *ObjectPreviewResponse) GetSuccess() bool {
+	if x != nil {
+		return x.Success
+	}
+	return false
+}
+
+func (x *ObjectPreviewResponse) GetErrorMessage() string {
+	if x != nil {
+		return x.ErrorMessage
+	}
+	return ""
+}
+
+func (x *ObjectPreviewResponse) GetColumns() []string {
+	if x != nil {
+		return x.Columns
+	}
+	return nil
+}
+
+func (x *ObjectPreviewResponse) GetRows() []*PreviewRow {
+	if x != nil {
+		return x.Rows
+	}
+	return nil
+}
+
+func (x *ObjectPreviewResponse) GetTotalRows() int64 {
+	if x != nil {
+		return x.TotalRows
+	}
+	return 0
+}
+
+type PreviewRow struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Values        []string               `protobuf:"bytes,1,rep,name=values,proto3" json:"values,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PreviewRow) Reset() {
+	*x = PreviewRow{}
+	mi := &file_plugin_proto_msgTypes[43]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PreviewRow) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PreviewRow) ProtoMessage() {}
+
+func (x *PreviewRow) ProtoReflect() protoreflect.Message {
+	mi := &file_plugin_proto_msgTypes[43]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PreviewRow.ProtoReflect.Descriptor instead.
+func (*PreviewRow) Descriptor() ([]byte, []int) {
+	return file_plugin_proto_rawDescGZIP(), []int{43}
+}
+
+func (x *PreviewRow) GetValues() []string {
+	if x != nil {
+		return x.Values
+	}
+	return nil
+}
+
 var File_plugin_proto protoreflect.FileDescriptor
 
 const file_plugin_proto_rawDesc = "" +
 	"\n" +
-	"\fplugin.proto\x12\x06plugin\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\x90\x05\n" +
+	"\fplugin.proto\x12\x06plugin\x1a\x1egoogle/protobuf/duration.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xab\x06\n" +
 	"\x14WorkerToAdminMessage\x12\x1b\n" +
 	"\tworker_id\x18\x01 \x01(\tR\bworkerId\x123\n" +
 	"\asent_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\x06sentAt\x12+\n" +
@@ -3944,8 +4334,10 @@ const file_plugin_proto_rawDesc = "" +
 	"\x13detection_proposals\x18\x0e \x01(\v2\x1a.plugin.DetectionProposalsH\x00R\x12detectionProposals\x12J\n" +
 	"\x12detection_complete\x18\x0f \x01(\v2\x19.plugin.DetectionCompleteH\x00R\x11detectionComplete\x12K\n" +
 	"\x13job_progress_update\x18\x10 \x01(\v2\x19.plugin.JobProgressUpdateH\x00R\x11jobProgressUpdate\x12;\n" +
-	"\rjob_completed\x18\x11 \x01(\v2\x14.plugin.JobCompletedH\x00R\fjobCompletedB\x06\n" +
-	"\x04body\"\x86\x04\n" +
+	"\rjob_completed\x18\x11 \x01(\v2\x14.plugin.JobCompletedH\x00R\fjobCompleted\x12@\n" +
+	"\fobservations\x18\x12 \x01(\v2\x1a.plugin.WorkerObservationsH\x00R\fobservations\x12W\n" +
+	"\x17object_preview_response\x18\x13 \x01(\v2\x1d.plugin.ObjectPreviewResponseH\x00R\x15objectPreviewResponseB\x06\n" +
+	"\x04body\"\xdc\x04\n" +
 	"\x14AdminToWorkerMessage\x12\x1d\n" +
 	"\n" +
 	"request_id\x18\x01 \x01(\tR\trequestId\x123\n" +
@@ -3956,7 +4348,8 @@ const file_plugin_proto_rawDesc = "" +
 	"\x15run_detection_request\x18\f \x01(\v2\x1b.plugin.RunDetectionRequestH\x00R\x13runDetectionRequest\x12K\n" +
 	"\x13execute_job_request\x18\r \x01(\v2\x19.plugin.ExecuteJobRequestH\x00R\x11executeJobRequest\x12>\n" +
 	"\x0ecancel_request\x18\x0e \x01(\v2\x15.plugin.CancelRequestH\x00R\rcancelRequest\x123\n" +
-	"\bshutdown\x18\x0f \x01(\v2\x15.plugin.AdminShutdownH\x00R\bshutdownB\x06\n" +
+	"\bshutdown\x18\x0f \x01(\v2\x15.plugin.AdminShutdownH\x00R\bshutdown\x12T\n" +
+	"\x16request_object_preview\x18\x10 \x01(\v2\x1c.plugin.RequestObjectPreviewH\x00R\x14requestObjectPreviewB\x06\n" +
 	"\x04body\"\xff\x02\n" +
 	"\vWorkerHello\x12\x1b\n" +
 	"\tworker_id\x18\x01 \x01(\tR\bworkerId\x12,\n" +
@@ -4319,7 +4712,39 @@ const file_plugin_proto_rawDesc = "" +
 	"\x05value\x18\x02 \x01(\v2\x13.plugin.ConfigValueR\x05value:\x028\x01\x1aZ\n" +
 	"\x17WorkerConfigValuesEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12)\n" +
-	"\x05value\x18\x02 \x01(\v2\x13.plugin.ConfigValueR\x05value:\x028\x01*W\n" +
+	"\x05value\x18\x02 \x01(\v2\x13.plugin.ConfigValueR\x05value:\x028\x01\"n\n" +
+	"\x12WorkerObservations\x12\x19\n" +
+	"\bjob_type\x18\x01 \x01(\tR\ajobType\x12=\n" +
+	"\fobservations\x18\x02 \x03(\v2\x19.plugin.ObjectObservationR\fobservations\"\xc5\x02\n" +
+	"\x11ObjectObservation\x12\x1b\n" +
+	"\tobject_id\x18\x01 \x03(\tR\bobjectId\x12\x1f\n" +
+	"\vobject_kind\x18\x02 \x01(\tR\n" +
+	"objectKind\x12\x16\n" +
+	"\x06format\x18\x03 \x01(\tR\x06format\x12I\n" +
+	"\n" +
+	"attributes\x18\x04 \x03(\v2).plugin.ObjectObservation.AttributesEntryR\n" +
+	"attributes\x12;\n" +
+	"\vobserved_at\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\n" +
+	"observedAt\x1aR\n" +
+	"\x0fAttributesEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12)\n" +
+	"\x05value\x18\x02 \x01(\v2\x13.plugin.ConfigValueR\x05value:\x028\x01\"h\n" +
+	"\x14RequestObjectPreview\x12\x1b\n" +
+	"\tobject_id\x18\x01 \x03(\tR\bobjectId\x12\x16\n" +
+	"\x06format\x18\x02 \x01(\tR\x06format\x12\x1b\n" +
+	"\trow_limit\x18\x03 \x01(\x05R\browLimit\"\xd6\x01\n" +
+	"\x15ObjectPreviewResponse\x12\x1d\n" +
+	"\n" +
+	"request_id\x18\x06 \x01(\tR\trequestId\x12\x18\n" +
+	"\asuccess\x18\x01 \x01(\bR\asuccess\x12#\n" +
+	"\rerror_message\x18\x02 \x01(\tR\ferrorMessage\x12\x18\n" +
+	"\acolumns\x18\x03 \x03(\tR\acolumns\x12&\n" +
+	"\x04rows\x18\x04 \x03(\v2\x12.plugin.PreviewRowR\x04rows\x12\x1d\n" +
+	"\n" +
+	"total_rows\x18\x05 \x01(\x03R\ttotalRows\"$\n" +
+	"\n" +
+	"PreviewRow\x12\x16\n" +
+	"\x06values\x18\x01 \x03(\tR\x06values*W\n" +
 	"\bWorkKind\x12\x19\n" +
 	"\x15WORK_KIND_UNSPECIFIED\x10\x00\x12\x17\n" +
 	"\x13WORK_KIND_DETECTION\x10\x01\x12\x17\n" +
@@ -4388,7 +4813,7 @@ func file_plugin_proto_rawDescGZIP() []byte {
 }
 
 var file_plugin_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
-var file_plugin_proto_msgTypes = make([]protoimpl.MessageInfo, 59)
+var file_plugin_proto_msgTypes = make([]protoimpl.MessageInfo, 65)
 var file_plugin_proto_goTypes = []any{
 	(WorkKind)(0),                  // 0: plugin.WorkKind
 	(JobPriority)(0),               // 1: plugin.JobPriority
@@ -4436,31 +4861,37 @@ var file_plugin_proto_goTypes = []any{
 	(*CancelRequest)(nil),          // 43: plugin.CancelRequest
 	(*AdminShutdown)(nil),          // 44: plugin.AdminShutdown
 	(*PersistedJobTypeConfig)(nil), // 45: plugin.PersistedJobTypeConfig
-	nil,                            // 46: plugin.WorkerHello.MetadataEntry
-	nil,                            // 47: plugin.WorkerHeartbeat.QueuedJobsByTypeEntry
-	nil,                            // 48: plugin.WorkerHeartbeat.MetadataEntry
-	nil,                            // 49: plugin.JobTypeDescriptor.WorkerDefaultValuesEntry
-	nil,                            // 50: plugin.ConfigForm.DefaultValuesEntry
-	nil,                            // 51: plugin.ValueMap.FieldsEntry
-	nil,                            // 52: plugin.RunDetectionRequest.AdminConfigValuesEntry
-	nil,                            // 53: plugin.RunDetectionRequest.WorkerConfigValuesEntry
-	nil,                            // 54: plugin.JobProposal.ParametersEntry
-	nil,                            // 55: plugin.JobProposal.LabelsEntry
-	nil,                            // 56: plugin.ExecuteJobRequest.AdminConfigValuesEntry
-	nil,                            // 57: plugin.ExecuteJobRequest.WorkerConfigValuesEntry
-	nil,                            // 58: plugin.JobSpec.ParametersEntry
-	nil,                            // 59: plugin.JobSpec.LabelsEntry
-	nil,                            // 60: plugin.JobProgressUpdate.MetricsEntry
-	nil,                            // 61: plugin.JobResult.OutputValuesEntry
-	nil,                            // 62: plugin.ClusterContext.MetadataEntry
-	nil,                            // 63: plugin.ActivityEvent.DetailsEntry
-	nil,                            // 64: plugin.PersistedJobTypeConfig.AdminConfigValuesEntry
-	nil,                            // 65: plugin.PersistedJobTypeConfig.WorkerConfigValuesEntry
-	(*timestamppb.Timestamp)(nil),  // 66: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),    // 67: google.protobuf.Duration
+	(*WorkerObservations)(nil),     // 46: plugin.WorkerObservations
+	(*ObjectObservation)(nil),      // 47: plugin.ObjectObservation
+	(*RequestObjectPreview)(nil),   // 48: plugin.RequestObjectPreview
+	(*ObjectPreviewResponse)(nil),  // 49: plugin.ObjectPreviewResponse
+	(*PreviewRow)(nil),             // 50: plugin.PreviewRow
+	nil,                            // 51: plugin.WorkerHello.MetadataEntry
+	nil,                            // 52: plugin.WorkerHeartbeat.QueuedJobsByTypeEntry
+	nil,                            // 53: plugin.WorkerHeartbeat.MetadataEntry
+	nil,                            // 54: plugin.JobTypeDescriptor.WorkerDefaultValuesEntry
+	nil,                            // 55: plugin.ConfigForm.DefaultValuesEntry
+	nil,                            // 56: plugin.ValueMap.FieldsEntry
+	nil,                            // 57: plugin.RunDetectionRequest.AdminConfigValuesEntry
+	nil,                            // 58: plugin.RunDetectionRequest.WorkerConfigValuesEntry
+	nil,                            // 59: plugin.JobProposal.ParametersEntry
+	nil,                            // 60: plugin.JobProposal.LabelsEntry
+	nil,                            // 61: plugin.ExecuteJobRequest.AdminConfigValuesEntry
+	nil,                            // 62: plugin.ExecuteJobRequest.WorkerConfigValuesEntry
+	nil,                            // 63: plugin.JobSpec.ParametersEntry
+	nil,                            // 64: plugin.JobSpec.LabelsEntry
+	nil,                            // 65: plugin.JobProgressUpdate.MetricsEntry
+	nil,                            // 66: plugin.JobResult.OutputValuesEntry
+	nil,                            // 67: plugin.ClusterContext.MetadataEntry
+	nil,                            // 68: plugin.ActivityEvent.DetailsEntry
+	nil,                            // 69: plugin.PersistedJobTypeConfig.AdminConfigValuesEntry
+	nil,                            // 70: plugin.PersistedJobTypeConfig.WorkerConfigValuesEntry
+	nil,                            // 71: plugin.ObjectObservation.AttributesEntry
+	(*timestamppb.Timestamp)(nil),  // 72: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),    // 73: google.protobuf.Duration
 }
 var file_plugin_proto_depIdxs = []int32{
-	66,  // 0: plugin.WorkerToAdminMessage.sent_at:type_name -> google.protobuf.Timestamp
+	72,  // 0: plugin.WorkerToAdminMessage.sent_at:type_name -> google.protobuf.Timestamp
 	9,   // 1: plugin.WorkerToAdminMessage.hello:type_name -> plugin.WorkerHello
 	11,  // 2: plugin.WorkerToAdminMessage.heartbeat:type_name -> plugin.WorkerHeartbeat
 	12,  // 3: plugin.WorkerToAdminMessage.acknowledge:type_name -> plugin.WorkerAcknowledge
@@ -4469,104 +4900,112 @@ var file_plugin_proto_depIdxs = []int32{
 	34,  // 6: plugin.WorkerToAdminMessage.detection_complete:type_name -> plugin.DetectionComplete
 	38,  // 7: plugin.WorkerToAdminMessage.job_progress_update:type_name -> plugin.JobProgressUpdate
 	39,  // 8: plugin.WorkerToAdminMessage.job_completed:type_name -> plugin.JobCompleted
-	66,  // 9: plugin.AdminToWorkerMessage.sent_at:type_name -> google.protobuf.Timestamp
-	10,  // 10: plugin.AdminToWorkerMessage.hello:type_name -> plugin.AdminHello
-	15,  // 11: plugin.AdminToWorkerMessage.request_config_schema:type_name -> plugin.RequestConfigSchema
-	32,  // 12: plugin.AdminToWorkerMessage.run_detection_request:type_name -> plugin.RunDetectionRequest
-	36,  // 13: plugin.AdminToWorkerMessage.execute_job_request:type_name -> plugin.ExecuteJobRequest
-	43,  // 14: plugin.AdminToWorkerMessage.cancel_request:type_name -> plugin.CancelRequest
-	44,  // 15: plugin.AdminToWorkerMessage.shutdown:type_name -> plugin.AdminShutdown
-	14,  // 16: plugin.WorkerHello.capabilities:type_name -> plugin.JobTypeCapability
-	46,  // 17: plugin.WorkerHello.metadata:type_name -> plugin.WorkerHello.MetadataEntry
-	13,  // 18: plugin.WorkerHeartbeat.running_work:type_name -> plugin.RunningWork
-	47,  // 19: plugin.WorkerHeartbeat.queued_jobs_by_type:type_name -> plugin.WorkerHeartbeat.QueuedJobsByTypeEntry
-	48,  // 20: plugin.WorkerHeartbeat.metadata:type_name -> plugin.WorkerHeartbeat.MetadataEntry
-	0,   // 21: plugin.RunningWork.kind:type_name -> plugin.WorkKind
-	2,   // 22: plugin.RunningWork.state:type_name -> plugin.JobState
-	17,  // 23: plugin.ConfigSchemaResponse.job_type_descriptor:type_name -> plugin.JobTypeDescriptor
-	18,  // 24: plugin.JobTypeDescriptor.admin_config_form:type_name -> plugin.ConfigForm
-	18,  // 25: plugin.JobTypeDescriptor.worker_config_form:type_name -> plugin.ConfigForm
-	30,  // 26: plugin.JobTypeDescriptor.admin_runtime_defaults:type_name -> plugin.AdminRuntimeDefaults
-	49,  // 27: plugin.JobTypeDescriptor.worker_default_values:type_name -> plugin.JobTypeDescriptor.WorkerDefaultValuesEntry
-	19,  // 28: plugin.ConfigForm.sections:type_name -> plugin.ConfigSection
-	50,  // 29: plugin.ConfigForm.default_values:type_name -> plugin.ConfigForm.DefaultValuesEntry
-	20,  // 30: plugin.ConfigSection.fields:type_name -> plugin.ConfigField
-	3,   // 31: plugin.ConfigField.field_type:type_name -> plugin.ConfigFieldType
-	4,   // 32: plugin.ConfigField.widget:type_name -> plugin.ConfigWidget
-	23,  // 33: plugin.ConfigField.min_value:type_name -> plugin.ConfigValue
-	23,  // 34: plugin.ConfigField.max_value:type_name -> plugin.ConfigValue
-	21,  // 35: plugin.ConfigField.options:type_name -> plugin.ConfigOption
-	22,  // 36: plugin.ConfigField.validation_rules:type_name -> plugin.ValidationRule
-	23,  // 37: plugin.ConfigField.visible_when_equals:type_name -> plugin.ConfigValue
-	5,   // 38: plugin.ValidationRule.type:type_name -> plugin.ValidationRuleType
-	67,  // 39: plugin.ConfigValue.duration_value:type_name -> google.protobuf.Duration
-	24,  // 40: plugin.ConfigValue.string_list:type_name -> plugin.StringList
-	25,  // 41: plugin.ConfigValue.int64_list:type_name -> plugin.Int64List
-	26,  // 42: plugin.ConfigValue.double_list:type_name -> plugin.DoubleList
-	27,  // 43: plugin.ConfigValue.bool_list:type_name -> plugin.BoolList
-	28,  // 44: plugin.ConfigValue.list_value:type_name -> plugin.ValueList
-	29,  // 45: plugin.ConfigValue.map_value:type_name -> plugin.ValueMap
-	23,  // 46: plugin.ValueList.values:type_name -> plugin.ConfigValue
-	51,  // 47: plugin.ValueMap.fields:type_name -> plugin.ValueMap.FieldsEntry
-	31,  // 48: plugin.RunDetectionRequest.admin_runtime:type_name -> plugin.AdminRuntimeConfig
-	52,  // 49: plugin.RunDetectionRequest.admin_config_values:type_name -> plugin.RunDetectionRequest.AdminConfigValuesEntry
-	53,  // 50: plugin.RunDetectionRequest.worker_config_values:type_name -> plugin.RunDetectionRequest.WorkerConfigValuesEntry
-	41,  // 51: plugin.RunDetectionRequest.cluster_context:type_name -> plugin.ClusterContext
-	66,  // 52: plugin.RunDetectionRequest.last_successful_run:type_name -> google.protobuf.Timestamp
-	35,  // 53: plugin.DetectionProposals.proposals:type_name -> plugin.JobProposal
-	1,   // 54: plugin.JobProposal.priority:type_name -> plugin.JobPriority
-	54,  // 55: plugin.JobProposal.parameters:type_name -> plugin.JobProposal.ParametersEntry
-	55,  // 56: plugin.JobProposal.labels:type_name -> plugin.JobProposal.LabelsEntry
-	66,  // 57: plugin.JobProposal.not_before:type_name -> google.protobuf.Timestamp
-	66,  // 58: plugin.JobProposal.expires_at:type_name -> google.protobuf.Timestamp
-	37,  // 59: plugin.ExecuteJobRequest.job:type_name -> plugin.JobSpec
-	31,  // 60: plugin.ExecuteJobRequest.admin_runtime:type_name -> plugin.AdminRuntimeConfig
-	56,  // 61: plugin.ExecuteJobRequest.admin_config_values:type_name -> plugin.ExecuteJobRequest.AdminConfigValuesEntry
-	57,  // 62: plugin.ExecuteJobRequest.worker_config_values:type_name -> plugin.ExecuteJobRequest.WorkerConfigValuesEntry
-	41,  // 63: plugin.ExecuteJobRequest.cluster_context:type_name -> plugin.ClusterContext
-	1,   // 64: plugin.JobSpec.priority:type_name -> plugin.JobPriority
-	58,  // 65: plugin.JobSpec.parameters:type_name -> plugin.JobSpec.ParametersEntry
-	59,  // 66: plugin.JobSpec.labels:type_name -> plugin.JobSpec.LabelsEntry
-	66,  // 67: plugin.JobSpec.created_at:type_name -> google.protobuf.Timestamp
-	66,  // 68: plugin.JobSpec.scheduled_at:type_name -> google.protobuf.Timestamp
-	2,   // 69: plugin.JobProgressUpdate.state:type_name -> plugin.JobState
-	60,  // 70: plugin.JobProgressUpdate.metrics:type_name -> plugin.JobProgressUpdate.MetricsEntry
-	42,  // 71: plugin.JobProgressUpdate.activities:type_name -> plugin.ActivityEvent
-	66,  // 72: plugin.JobProgressUpdate.updated_at:type_name -> google.protobuf.Timestamp
-	40,  // 73: plugin.JobCompleted.result:type_name -> plugin.JobResult
-	42,  // 74: plugin.JobCompleted.activities:type_name -> plugin.ActivityEvent
-	66,  // 75: plugin.JobCompleted.completed_at:type_name -> google.protobuf.Timestamp
-	61,  // 76: plugin.JobResult.output_values:type_name -> plugin.JobResult.OutputValuesEntry
-	62,  // 77: plugin.ClusterContext.metadata:type_name -> plugin.ClusterContext.MetadataEntry
-	6,   // 78: plugin.ActivityEvent.source:type_name -> plugin.ActivitySource
-	63,  // 79: plugin.ActivityEvent.details:type_name -> plugin.ActivityEvent.DetailsEntry
-	66,  // 80: plugin.ActivityEvent.created_at:type_name -> google.protobuf.Timestamp
-	0,   // 81: plugin.CancelRequest.target_kind:type_name -> plugin.WorkKind
-	64,  // 82: plugin.PersistedJobTypeConfig.admin_config_values:type_name -> plugin.PersistedJobTypeConfig.AdminConfigValuesEntry
-	65,  // 83: plugin.PersistedJobTypeConfig.worker_config_values:type_name -> plugin.PersistedJobTypeConfig.WorkerConfigValuesEntry
-	31,  // 84: plugin.PersistedJobTypeConfig.admin_runtime:type_name -> plugin.AdminRuntimeConfig
-	66,  // 85: plugin.PersistedJobTypeConfig.updated_at:type_name -> google.protobuf.Timestamp
-	23,  // 86: plugin.JobTypeDescriptor.WorkerDefaultValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 87: plugin.ConfigForm.DefaultValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 88: plugin.ValueMap.FieldsEntry.value:type_name -> plugin.ConfigValue
-	23,  // 89: plugin.RunDetectionRequest.AdminConfigValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 90: plugin.RunDetectionRequest.WorkerConfigValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 91: plugin.JobProposal.ParametersEntry.value:type_name -> plugin.ConfigValue
-	23,  // 92: plugin.ExecuteJobRequest.AdminConfigValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 93: plugin.ExecuteJobRequest.WorkerConfigValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 94: plugin.JobSpec.ParametersEntry.value:type_name -> plugin.ConfigValue
-	23,  // 95: plugin.JobProgressUpdate.MetricsEntry.value:type_name -> plugin.ConfigValue
-	23,  // 96: plugin.JobResult.OutputValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 97: plugin.ActivityEvent.DetailsEntry.value:type_name -> plugin.ConfigValue
-	23,  // 98: plugin.PersistedJobTypeConfig.AdminConfigValuesEntry.value:type_name -> plugin.ConfigValue
-	23,  // 99: plugin.PersistedJobTypeConfig.WorkerConfigValuesEntry.value:type_name -> plugin.ConfigValue
-	7,   // 100: plugin.PluginControlService.WorkerStream:input_type -> plugin.WorkerToAdminMessage
-	8,   // 101: plugin.PluginControlService.WorkerStream:output_type -> plugin.AdminToWorkerMessage
-	101, // [101:102] is the sub-list for method output_type
-	100, // [100:101] is the sub-list for method input_type
-	100, // [100:100] is the sub-list for extension type_name
-	100, // [100:100] is the sub-list for extension extendee
-	0,   // [0:100] is the sub-list for field type_name
+	46,  // 9: plugin.WorkerToAdminMessage.observations:type_name -> plugin.WorkerObservations
+	49,  // 10: plugin.WorkerToAdminMessage.object_preview_response:type_name -> plugin.ObjectPreviewResponse
+	72,  // 11: plugin.AdminToWorkerMessage.sent_at:type_name -> google.protobuf.Timestamp
+	10,  // 12: plugin.AdminToWorkerMessage.hello:type_name -> plugin.AdminHello
+	15,  // 13: plugin.AdminToWorkerMessage.request_config_schema:type_name -> plugin.RequestConfigSchema
+	32,  // 14: plugin.AdminToWorkerMessage.run_detection_request:type_name -> plugin.RunDetectionRequest
+	36,  // 15: plugin.AdminToWorkerMessage.execute_job_request:type_name -> plugin.ExecuteJobRequest
+	43,  // 16: plugin.AdminToWorkerMessage.cancel_request:type_name -> plugin.CancelRequest
+	44,  // 17: plugin.AdminToWorkerMessage.shutdown:type_name -> plugin.AdminShutdown
+	48,  // 18: plugin.AdminToWorkerMessage.request_object_preview:type_name -> plugin.RequestObjectPreview
+	14,  // 19: plugin.WorkerHello.capabilities:type_name -> plugin.JobTypeCapability
+	51,  // 20: plugin.WorkerHello.metadata:type_name -> plugin.WorkerHello.MetadataEntry
+	13,  // 21: plugin.WorkerHeartbeat.running_work:type_name -> plugin.RunningWork
+	52,  // 22: plugin.WorkerHeartbeat.queued_jobs_by_type:type_name -> plugin.WorkerHeartbeat.QueuedJobsByTypeEntry
+	53,  // 23: plugin.WorkerHeartbeat.metadata:type_name -> plugin.WorkerHeartbeat.MetadataEntry
+	0,   // 24: plugin.RunningWork.kind:type_name -> plugin.WorkKind
+	2,   // 25: plugin.RunningWork.state:type_name -> plugin.JobState
+	17,  // 26: plugin.ConfigSchemaResponse.job_type_descriptor:type_name -> plugin.JobTypeDescriptor
+	18,  // 27: plugin.JobTypeDescriptor.admin_config_form:type_name -> plugin.ConfigForm
+	18,  // 28: plugin.JobTypeDescriptor.worker_config_form:type_name -> plugin.ConfigForm
+	30,  // 29: plugin.JobTypeDescriptor.admin_runtime_defaults:type_name -> plugin.AdminRuntimeDefaults
+	54,  // 30: plugin.JobTypeDescriptor.worker_default_values:type_name -> plugin.JobTypeDescriptor.WorkerDefaultValuesEntry
+	19,  // 31: plugin.ConfigForm.sections:type_name -> plugin.ConfigSection
+	55,  // 32: plugin.ConfigForm.default_values:type_name -> plugin.ConfigForm.DefaultValuesEntry
+	20,  // 33: plugin.ConfigSection.fields:type_name -> plugin.ConfigField
+	3,   // 34: plugin.ConfigField.field_type:type_name -> plugin.ConfigFieldType
+	4,   // 35: plugin.ConfigField.widget:type_name -> plugin.ConfigWidget
+	23,  // 36: plugin.ConfigField.min_value:type_name -> plugin.ConfigValue
+	23,  // 37: plugin.ConfigField.max_value:type_name -> plugin.ConfigValue
+	21,  // 38: plugin.ConfigField.options:type_name -> plugin.ConfigOption
+	22,  // 39: plugin.ConfigField.validation_rules:type_name -> plugin.ValidationRule
+	23,  // 40: plugin.ConfigField.visible_when_equals:type_name -> plugin.ConfigValue
+	5,   // 41: plugin.ValidationRule.type:type_name -> plugin.ValidationRuleType
+	73,  // 42: plugin.ConfigValue.duration_value:type_name -> google.protobuf.Duration
+	24,  // 43: plugin.ConfigValue.string_list:type_name -> plugin.StringList
+	25,  // 44: plugin.ConfigValue.int64_list:type_name -> plugin.Int64List
+	26,  // 45: plugin.ConfigValue.double_list:type_name -> plugin.DoubleList
+	27,  // 46: plugin.ConfigValue.bool_list:type_name -> plugin.BoolList
+	28,  // 47: plugin.ConfigValue.list_value:type_name -> plugin.ValueList
+	29,  // 48: plugin.ConfigValue.map_value:type_name -> plugin.ValueMap
+	23,  // 49: plugin.ValueList.values:type_name -> plugin.ConfigValue
+	56,  // 50: plugin.ValueMap.fields:type_name -> plugin.ValueMap.FieldsEntry
+	31,  // 51: plugin.RunDetectionRequest.admin_runtime:type_name -> plugin.AdminRuntimeConfig
+	57,  // 52: plugin.RunDetectionRequest.admin_config_values:type_name -> plugin.RunDetectionRequest.AdminConfigValuesEntry
+	58,  // 53: plugin.RunDetectionRequest.worker_config_values:type_name -> plugin.RunDetectionRequest.WorkerConfigValuesEntry
+	41,  // 54: plugin.RunDetectionRequest.cluster_context:type_name -> plugin.ClusterContext
+	72,  // 55: plugin.RunDetectionRequest.last_successful_run:type_name -> google.protobuf.Timestamp
+	35,  // 56: plugin.DetectionProposals.proposals:type_name -> plugin.JobProposal
+	1,   // 57: plugin.JobProposal.priority:type_name -> plugin.JobPriority
+	59,  // 58: plugin.JobProposal.parameters:type_name -> plugin.JobProposal.ParametersEntry
+	60,  // 59: plugin.JobProposal.labels:type_name -> plugin.JobProposal.LabelsEntry
+	72,  // 60: plugin.JobProposal.not_before:type_name -> google.protobuf.Timestamp
+	72,  // 61: plugin.JobProposal.expires_at:type_name -> google.protobuf.Timestamp
+	37,  // 62: plugin.ExecuteJobRequest.job:type_name -> plugin.JobSpec
+	31,  // 63: plugin.ExecuteJobRequest.admin_runtime:type_name -> plugin.AdminRuntimeConfig
+	61,  // 64: plugin.ExecuteJobRequest.admin_config_values:type_name -> plugin.ExecuteJobRequest.AdminConfigValuesEntry
+	62,  // 65: plugin.ExecuteJobRequest.worker_config_values:type_name -> plugin.ExecuteJobRequest.WorkerConfigValuesEntry
+	41,  // 66: plugin.ExecuteJobRequest.cluster_context:type_name -> plugin.ClusterContext
+	1,   // 67: plugin.JobSpec.priority:type_name -> plugin.JobPriority
+	63,  // 68: plugin.JobSpec.parameters:type_name -> plugin.JobSpec.ParametersEntry
+	64,  // 69: plugin.JobSpec.labels:type_name -> plugin.JobSpec.LabelsEntry
+	72,  // 70: plugin.JobSpec.created_at:type_name -> google.protobuf.Timestamp
+	72,  // 71: plugin.JobSpec.scheduled_at:type_name -> google.protobuf.Timestamp
+	2,   // 72: plugin.JobProgressUpdate.state:type_name -> plugin.JobState
+	65,  // 73: plugin.JobProgressUpdate.metrics:type_name -> plugin.JobProgressUpdate.MetricsEntry
+	42,  // 74: plugin.JobProgressUpdate.activities:type_name -> plugin.ActivityEvent
+	72,  // 75: plugin.JobProgressUpdate.updated_at:type_name -> google.protobuf.Timestamp
+	40,  // 76: plugin.JobCompleted.result:type_name -> plugin.JobResult
+	42,  // 77: plugin.JobCompleted.activities:type_name -> plugin.ActivityEvent
+	72,  // 78: plugin.JobCompleted.completed_at:type_name -> google.protobuf.Timestamp
+	66,  // 79: plugin.JobResult.output_values:type_name -> plugin.JobResult.OutputValuesEntry
+	67,  // 80: plugin.ClusterContext.metadata:type_name -> plugin.ClusterContext.MetadataEntry
+	6,   // 81: plugin.ActivityEvent.source:type_name -> plugin.ActivitySource
+	68,  // 82: plugin.ActivityEvent.details:type_name -> plugin.ActivityEvent.DetailsEntry
+	72,  // 83: plugin.ActivityEvent.created_at:type_name -> google.protobuf.Timestamp
+	0,   // 84: plugin.CancelRequest.target_kind:type_name -> plugin.WorkKind
+	69,  // 85: plugin.PersistedJobTypeConfig.admin_config_values:type_name -> plugin.PersistedJobTypeConfig.AdminConfigValuesEntry
+	70,  // 86: plugin.PersistedJobTypeConfig.worker_config_values:type_name -> plugin.PersistedJobTypeConfig.WorkerConfigValuesEntry
+	31,  // 87: plugin.PersistedJobTypeConfig.admin_runtime:type_name -> plugin.AdminRuntimeConfig
+	72,  // 88: plugin.PersistedJobTypeConfig.updated_at:type_name -> google.protobuf.Timestamp
+	47,  // 89: plugin.WorkerObservations.observations:type_name -> plugin.ObjectObservation
+	71,  // 90: plugin.ObjectObservation.attributes:type_name -> plugin.ObjectObservation.AttributesEntry
+	72,  // 91: plugin.ObjectObservation.observed_at:type_name -> google.protobuf.Timestamp
+	50,  // 92: plugin.ObjectPreviewResponse.rows:type_name -> plugin.PreviewRow
+	23,  // 93: plugin.JobTypeDescriptor.WorkerDefaultValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 94: plugin.ConfigForm.DefaultValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 95: plugin.ValueMap.FieldsEntry.value:type_name -> plugin.ConfigValue
+	23,  // 96: plugin.RunDetectionRequest.AdminConfigValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 97: plugin.RunDetectionRequest.WorkerConfigValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 98: plugin.JobProposal.ParametersEntry.value:type_name -> plugin.ConfigValue
+	23,  // 99: plugin.ExecuteJobRequest.AdminConfigValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 100: plugin.ExecuteJobRequest.WorkerConfigValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 101: plugin.JobSpec.ParametersEntry.value:type_name -> plugin.ConfigValue
+	23,  // 102: plugin.JobProgressUpdate.MetricsEntry.value:type_name -> plugin.ConfigValue
+	23,  // 103: plugin.JobResult.OutputValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 104: plugin.ActivityEvent.DetailsEntry.value:type_name -> plugin.ConfigValue
+	23,  // 105: plugin.PersistedJobTypeConfig.AdminConfigValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 106: plugin.PersistedJobTypeConfig.WorkerConfigValuesEntry.value:type_name -> plugin.ConfigValue
+	23,  // 107: plugin.ObjectObservation.AttributesEntry.value:type_name -> plugin.ConfigValue
+	7,   // 108: plugin.PluginControlService.WorkerStream:input_type -> plugin.WorkerToAdminMessage
+	8,   // 109: plugin.PluginControlService.WorkerStream:output_type -> plugin.AdminToWorkerMessage
+	109, // [109:110] is the sub-list for method output_type
+	108, // [108:109] is the sub-list for method input_type
+	108, // [108:108] is the sub-list for extension type_name
+	108, // [108:108] is the sub-list for extension extendee
+	0,   // [0:108] is the sub-list for field type_name
 }
 
 func init() { file_plugin_proto_init() }
@@ -4583,6 +5022,8 @@ func file_plugin_proto_init() {
 		(*WorkerToAdminMessage_DetectionComplete)(nil),
 		(*WorkerToAdminMessage_JobProgressUpdate)(nil),
 		(*WorkerToAdminMessage_JobCompleted)(nil),
+		(*WorkerToAdminMessage_Observations)(nil),
+		(*WorkerToAdminMessage_ObjectPreviewResponse)(nil),
 	}
 	file_plugin_proto_msgTypes[1].OneofWrappers = []any{
 		(*AdminToWorkerMessage_Hello)(nil),
@@ -4591,6 +5032,7 @@ func file_plugin_proto_init() {
 		(*AdminToWorkerMessage_ExecuteJobRequest)(nil),
 		(*AdminToWorkerMessage_CancelRequest)(nil),
 		(*AdminToWorkerMessage_Shutdown)(nil),
+		(*AdminToWorkerMessage_RequestObjectPreview)(nil),
 	}
 	file_plugin_proto_msgTypes[16].OneofWrappers = []any{
 		(*ConfigValue_BoolValue)(nil),
@@ -4612,7 +5054,7 @@ func file_plugin_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_plugin_proto_rawDesc), len(file_plugin_proto_rawDesc)),
 			NumEnums:      7,
-			NumMessages:   59,
+			NumMessages:   65,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/weed/pb/remote.proto b/weed/pb/remote.proto
index 9654719de4..2f50a3a737 100644
--- a/weed/pb/remote.proto
+++ b/weed/pb/remote.proto
@@ -65,6 +65,9 @@ message RemoteConf {
   string contabo_secret_key = 69;
   string contabo_endpoint = 70;
   string contabo_region = 71;
+
+  uint32 upload_concurrency = 72; // multipart upload concurrency per file, 0 = client default (1 for S3, 16 for Azure)
+  uint32 download_concurrency = 73; // multipart download concurrency per read, 0 = client default (5 for S3, 16 for Azure)
 }
 
 message RemoteStorageMapping {
@@ -76,4 +79,5 @@ message RemoteStorageLocation {
   string bucket = 2;
   string path = 3;
   int32 listing_cache_ttl_seconds = 4; // 0 = disabled; >0 enables on-demand directory listing with this TTL in seconds
+  optional int32 cache_wait_ms = 5; // unset = size based default; 0 = read straight from the remote without caching
 }
diff --git a/weed/pb/remote_pb/remote.pb.go b/weed/pb/remote_pb/remote.pb.go
index 611819c08b..daf6cb7893 100644
--- a/weed/pb/remote_pb/remote.pb.go
+++ b/weed/pb/remote_pb/remote.pb.go
@@ -71,6 +71,8 @@ type RemoteConf struct {
 	ContaboSecretKey                string                 `protobuf:"bytes,69,opt,name=contabo_secret_key,json=contaboSecretKey,proto3" json:"contabo_secret_key,omitempty"`
 	ContaboEndpoint                 string                 `protobuf:"bytes,70,opt,name=contabo_endpoint,json=contaboEndpoint,proto3" json:"contabo_endpoint,omitempty"`
 	ContaboRegion                   string                 `protobuf:"bytes,71,opt,name=contabo_region,json=contaboRegion,proto3" json:"contabo_region,omitempty"`
+	UploadConcurrency               uint32                 `protobuf:"varint,72,opt,name=upload_concurrency,json=uploadConcurrency,proto3" json:"upload_concurrency,omitempty"`       // multipart upload concurrency per file, 0 = client default (1 for S3, 16 for Azure)
+	DownloadConcurrency             uint32                 `protobuf:"varint,73,opt,name=download_concurrency,json=downloadConcurrency,proto3" json:"download_concurrency,omitempty"` // multipart download concurrency per read, 0 = client default (5 for S3, 16 for Azure)
 	unknownFields                   protoimpl.UnknownFields
 	sizeCache                       protoimpl.SizeCache
 }
@@ -420,6 +422,20 @@ func (x *RemoteConf) GetContaboRegion() string {
 	return ""
 }
 
+func (x *RemoteConf) GetUploadConcurrency() uint32 {
+	if x != nil {
+		return x.UploadConcurrency
+	}
+	return 0
+}
+
+func (x *RemoteConf) GetDownloadConcurrency() uint32 {
+	if x != nil {
+		return x.DownloadConcurrency
+	}
+	return 0
+}
+
 type RemoteStorageMapping struct {
 	state                    protoimpl.MessageState            `protogen:"open.v1"`
 	Mappings                 map[string]*RemoteStorageLocation `protobuf:"bytes,1,rep,name=mappings,proto3" json:"mappings,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
@@ -478,6 +494,7 @@ type RemoteStorageLocation struct {
 	Bucket                 string                 `protobuf:"bytes,2,opt,name=bucket,proto3" json:"bucket,omitempty"`
 	Path                   string                 `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"`
 	ListingCacheTtlSeconds int32                  `protobuf:"varint,4,opt,name=listing_cache_ttl_seconds,json=listingCacheTtlSeconds,proto3" json:"listing_cache_ttl_seconds,omitempty"` // 0 = disabled; >0 enables on-demand directory listing with this TTL in seconds
+	CacheWaitMs            *int32                 `protobuf:"varint,5,opt,name=cache_wait_ms,json=cacheWaitMs,proto3,oneof" json:"cache_wait_ms,omitempty"`                              // unset = size based default; 0 = read straight from the remote without caching
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -540,11 +557,18 @@ func (x *RemoteStorageLocation) GetListingCacheTtlSeconds() int32 {
 	return 0
 }
 
+func (x *RemoteStorageLocation) GetCacheWaitMs() int32 {
+	if x != nil && x.CacheWaitMs != nil {
+		return *x.CacheWaitMs
+	}
+	return 0
+}
+
 var File_remote_proto protoreflect.FileDescriptor
 
 const file_remote_proto_rawDesc = "" +
 	"\n" +
-	"\fremote.proto\x12\tremote_pb\"\xea\x0e\n" +
+	"\fremote.proto\x12\tremote_pb\"\xcc\x0f\n" +
 	"\n" +
 	"RemoteConf\x12\x12\n" +
 	"\x04type\x18\x01 \x01(\tR\x04type\x12\x12\n" +
@@ -593,18 +617,22 @@ const file_remote_proto_rawDesc = "" +
 	"\x12contabo_access_key\x18D \x01(\tR\x10contaboAccessKey\x12,\n" +
 	"\x12contabo_secret_key\x18E \x01(\tR\x10contaboSecretKey\x12)\n" +
 	"\x10contabo_endpoint\x18F \x01(\tR\x0fcontaboEndpoint\x12%\n" +
-	"\x0econtabo_region\x18G \x01(\tR\rcontaboRegion\"\xff\x01\n" +
+	"\x0econtabo_region\x18G \x01(\tR\rcontaboRegion\x12-\n" +
+	"\x12upload_concurrency\x18H \x01(\rR\x11uploadConcurrency\x121\n" +
+	"\x14download_concurrency\x18I \x01(\rR\x13downloadConcurrency\"\xff\x01\n" +
 	"\x14RemoteStorageMapping\x12I\n" +
 	"\bmappings\x18\x01 \x03(\v2-.remote_pb.RemoteStorageMapping.MappingsEntryR\bmappings\x12=\n" +
 	"\x1bprimary_bucket_storage_name\x18\x02 \x01(\tR\x18primaryBucketStorageName\x1a]\n" +
 	"\rMappingsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x126\n" +
-	"\x05value\x18\x02 \x01(\v2 .remote_pb.RemoteStorageLocationR\x05value:\x028\x01\"\x92\x01\n" +
+	"\x05value\x18\x02 \x01(\v2 .remote_pb.RemoteStorageLocationR\x05value:\x028\x01\"\xcd\x01\n" +
 	"\x15RemoteStorageLocation\x12\x12\n" +
 	"\x04name\x18\x01 \x01(\tR\x04name\x12\x16\n" +
 	"\x06bucket\x18\x02 \x01(\tR\x06bucket\x12\x12\n" +
 	"\x04path\x18\x03 \x01(\tR\x04path\x129\n" +
-	"\x19listing_cache_ttl_seconds\x18\x04 \x01(\x05R\x16listingCacheTtlSecondsBP\n" +
+	"\x19listing_cache_ttl_seconds\x18\x04 \x01(\x05R\x16listingCacheTtlSeconds\x12'\n" +
+	"\rcache_wait_ms\x18\x05 \x01(\x05H\x00R\vcacheWaitMs\x88\x01\x01B\x10\n" +
+	"\x0e_cache_wait_msBP\n" +
 	"\x10seaweedfs.clientB\n" +
 	"FilerProtoZ0github.com/seaweedfs/seaweedfs/weed/pb/remote_pbb\x06proto3"
 
@@ -642,6 +670,7 @@ func file_remote_proto_init() {
 	if File_remote_proto != nil {
 		return
 	}
+	file_remote_proto_msgTypes[2].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
diff --git a/weed/pb/server_discovery.go b/weed/pb/server_discovery.go
index 59a333f0a2..b869c5100e 100644
--- a/weed/pb/server_discovery.go
+++ b/weed/pb/server_discovery.go
@@ -24,8 +24,19 @@ func NewServiceDiscoveryFromMap(m map[string]ServerAddress) (sd *ServerDiscovery
 // RefreshBySrvIfAvailable performs a DNS SRV lookup and updates list with the results
 // of the lookup
 func (sd *ServerDiscovery) RefreshBySrvIfAvailable() {
+	if newList := sd.LookupSrvInstances(); newList != nil {
+		sd.SetInstances(newList)
+	}
+}
+
+// LookupSrvInstances resolves the SRV record without touching the stored
+// list. It returns nil when there is no SRV record, the lookup fails, or the
+// result has no well-formed names. Running it without holding a lock keeps a
+// slow resolver from blocking GetInstances callers; callers serialize the
+// SetInstances that saves the result.
+func (sd *ServerDiscovery) LookupSrvInstances() []ServerAddress {
 	if sd.srvRecord == nil {
-		return
+		return nil
 	}
 	newList, err := sd.srvRecord.LookUp()
 	if err != nil {
@@ -33,8 +44,14 @@ func (sd *ServerDiscovery) RefreshBySrvIfAvailable() {
 	}
 	if newList == nil || len(newList) == 0 {
 		glog.V(0).Infof("looked up SRV for %s, but found no well-formed names", *sd.srvRecord)
-		return
+		return nil
 	}
+	return newList
+}
+
+// SetInstances saves a resolved address list. Callers racing a refresh must
+// serialize this with their GetInstances reads.
+func (sd *ServerDiscovery) SetInstances(newList []ServerAddress) {
 	if !reflect.DeepEqual(sd.list, newList) {
 		sd.list = newList
 	}
diff --git a/weed/pb/volume_list_stream.go b/weed/pb/volume_list_stream.go
new file mode 100644
index 0000000000..5985c441ac
--- /dev/null
+++ b/weed/pb/volume_list_stream.go
@@ -0,0 +1,212 @@
+package pb
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// ReceiveVolumeList reads a streamed volume listing: the topology first, then
+// its volumes in batches as they arrive. A caller that works a volume at a
+// time never holds the cluster; one that needs it whole can use
+// CollectVolumeList.
+//
+// onTopology is given a listing whose disks name themselves but list nothing,
+// because the volumes come through onVolumes instead. That holds however the
+// master answered: one too old for the stream is asked the old way and its
+// reply cut into the same batches, so a caller cannot tell the difference and
+// must not read volumes off the topology either way.
+func ReceiveVolumeList(ctx context.Context, client master_pb.SeaweedClient, request *master_pb.VolumeListRequest,
+	onTopology func(*master_pb.VolumeListResponse) error,
+	onVolumes func(*master_pb.VolumeListStreamResponse) error) error {
+
+	stream, err := client.VolumeListStream(ctx, request)
+	if err == nil {
+		started, streamErr := receiveVolumeListStream(stream, onTopology, onVolumes)
+		// Only a stream that said nothing can be asked again the old way. Past
+		// its first message the master plainly does have the method, and the
+		// error may even be the caller's own, so starting over would hand back
+		// what has already been handed over.
+		if started || status.Code(streamErr) != codes.Unimplemented {
+			return streamErr
+		}
+	} else if status.Code(err) != codes.Unimplemented {
+		return err
+	}
+
+	response, err := client.VolumeList(ctx, request)
+	if err != nil {
+		return err
+	}
+	return replayVolumeList(response, onTopology, onVolumes)
+}
+
+// receiveVolumeListStream reports whether the stream said anything at all,
+// which decides whether it can be started over as an unstreamed listing.
+func receiveVolumeListStream(stream master_pb.Seaweed_VolumeListStreamClient,
+	onTopology func(*master_pb.VolumeListResponse) error,
+	onVolumes func(*master_pb.VolumeListStreamResponse) error) (started bool, err error) {
+
+	told := false
+	for {
+		batch, err := stream.Recv()
+		if err == io.EOF {
+			if !told {
+				return started, fmt.Errorf("volume list stream ended before its topology")
+			}
+			return started, nil
+		}
+		if err != nil {
+			return started, err
+		}
+		started = true
+		if batch.Header != nil {
+			if told {
+				return started, fmt.Errorf("volume list stream sent its topology twice")
+			}
+			told = true
+			if onTopology != nil {
+				if err := onTopology(batch.Header); err != nil {
+					return started, err
+				}
+			}
+			continue
+		}
+		if !told {
+			return started, fmt.Errorf("volume list stream sent volumes before its topology")
+		}
+		if onVolumes != nil {
+			if err := onVolumes(batch); err != nil {
+				return started, err
+			}
+		}
+	}
+}
+
+// replayVolumeList cuts an unstreamed reply into the batches a caller expects.
+// Each disk's volumes are moved out of the topology rather than shared with it,
+// so the topology handed over lists nothing, exactly as a streamed one does.
+func replayVolumeList(response *master_pb.VolumeListResponse,
+	onTopology func(*master_pb.VolumeListResponse) error,
+	onVolumes func(*master_pb.VolumeListStreamResponse) error) error {
+
+	type batch struct {
+		key    [4]string
+		volume []*master_pb.VolumeInformationMessage
+		ec     []*master_pb.VolumeEcShardInformationMessage
+	}
+	var batches []batch
+
+	if response.TopologyInfo != nil {
+		for _, dc := range response.TopologyInfo.DataCenterInfos {
+			for _, rack := range dc.RackInfos {
+				for _, node := range rack.DataNodeInfos {
+					for diskType, disk := range node.DiskInfos {
+						if len(disk.VolumeInfos) == 0 && len(disk.EcShardInfos) == 0 {
+							continue
+						}
+						batches = append(batches, batch{
+							key:    [4]string{dc.Id, rack.Id, node.Id, diskType},
+							volume: disk.VolumeInfos,
+							ec:     disk.EcShardInfos,
+						})
+						disk.VolumeInfos, disk.EcShardInfos = nil, nil
+					}
+				}
+			}
+		}
+	}
+
+	if onTopology != nil {
+		if err := onTopology(response); err != nil {
+			return err
+		}
+	}
+	if onVolumes == nil {
+		return nil
+	}
+	for _, b := range batches {
+		err := onVolumes(&master_pb.VolumeListStreamResponse{
+			DataCenter:   b.key[0],
+			Rack:         b.key[1],
+			DataNode:     b.key[2],
+			DiskType:     b.key[3],
+			VolumeInfos:  b.volume,
+			EcShardInfos: b.ec,
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// CollectVolumeList streams a listing and puts it back together, for callers
+// that need the whole topology. The master still never holds it all, which is
+// the point; this only moves that cost to the caller.
+func CollectVolumeList(ctx context.Context, client master_pb.SeaweedClient, request *master_pb.VolumeListRequest) (*master_pb.VolumeListResponse, error) {
+	var response *master_pb.VolumeListResponse
+	var skipped int
+	disks := make(map[[4]string]*master_pb.DiskInfo)
+
+	err := ReceiveVolumeList(ctx, client, request,
+		func(topology *master_pb.VolumeListResponse) error {
+			response = topology
+			return nil
+		},
+		func(batch *master_pb.VolumeListStreamResponse) error {
+			key := [4]string{batch.DataCenter, batch.Rack, batch.DataNode, batch.DiskType}
+			disk, known := disks[key]
+			if !known {
+				disk = findDisk(response, key)
+				disks[key] = disk
+			}
+			if disk == nil {
+				// A disk registered after the topology went out. It is not in
+				// the listing being rebuilt and has nowhere to go, so leave it
+				// to the next one rather than failing this one -- an unstreamed
+				// listing would not have shown it either, having read each
+				// node's disks once.
+				skipped++
+				return nil
+			}
+			disk.VolumeInfos = append(disk.VolumeInfos, batch.VolumeInfos...)
+			disk.EcShardInfos = append(disk.EcShardInfos, batch.EcShardInfos...)
+			return nil
+		})
+	if err != nil {
+		return nil, err
+	}
+	if skipped > 0 {
+		glog.V(1).Infof("volume list: %d batches were for disks added after the topology was sent", skipped)
+	}
+	return response, nil
+}
+
+func findDisk(response *master_pb.VolumeListResponse, key [4]string) *master_pb.DiskInfo {
+	if response == nil || response.TopologyInfo == nil {
+		return nil
+	}
+	for _, dc := range response.TopologyInfo.DataCenterInfos {
+		if dc.Id != key[0] {
+			continue
+		}
+		for _, rack := range dc.RackInfos {
+			if rack.Id != key[1] {
+				continue
+			}
+			for _, node := range rack.DataNodeInfos {
+				if node.Id != key[2] {
+					continue
+				}
+				return node.DiskInfos[key[3]]
+			}
+		}
+	}
+	return nil
+}
diff --git a/weed/pb/volume_list_stream_test.go b/weed/pb/volume_list_stream_test.go
new file mode 100644
index 0000000000..9a765b664d
--- /dev/null
+++ b/weed/pb/volume_list_stream_test.go
@@ -0,0 +1,306 @@
+package pb
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+	"google.golang.org/grpc/test/bufconn"
+	"google.golang.org/protobuf/proto"
+)
+
+// fakeMaster answers a listing either way, so the same assertions can be made
+// of a master that streams and one too old to.
+type fakeMaster struct {
+	master_pb.UnimplementedSeaweedServer
+	response *master_pb.VolumeListResponse
+	streams  bool
+	batch    int
+	// extraBatch is sent after the rest, standing for a disk that registered
+	// once the topology had gone out.
+	extraBatch *master_pb.VolumeListStreamResponse
+	// failAfterHeader stands for a master that plainly has the method but
+	// gives up mid-stream, reporting the one code that means "ask the old way".
+	failAfterHeader bool
+}
+
+func (m *fakeMaster) VolumeList(ctx context.Context, req *master_pb.VolumeListRequest) (*master_pb.VolumeListResponse, error) {
+	return cloneListing(m.response), nil
+}
+
+func (m *fakeMaster) VolumeListStream(req *master_pb.VolumeListRequest, stream master_pb.Seaweed_VolumeListStreamServer) error {
+	if !m.streams {
+		return status_Unimplemented()
+	}
+	full := cloneListing(m.response)
+	header := &master_pb.VolumeListResponse{
+		TopologyInfo:      &master_pb.TopologyInfo{Id: full.TopologyInfo.Id},
+		VolumeSizeLimitMb: full.VolumeSizeLimitMb,
+	}
+	// The header names every disk but lists nothing on it.
+	for _, dc := range full.TopologyInfo.DataCenterInfos {
+		headerDc := &master_pb.DataCenterInfo{Id: dc.Id}
+		for _, rack := range dc.RackInfos {
+			headerRack := &master_pb.RackInfo{Id: rack.Id}
+			for _, node := range rack.DataNodeInfos {
+				headerNode := &master_pb.DataNodeInfo{Id: node.Id, DiskInfos: map[string]*master_pb.DiskInfo{}}
+				for diskType, disk := range node.DiskInfos {
+					headerNode.DiskInfos[diskType] = &master_pb.DiskInfo{Type: diskType, DiskId: disk.DiskId}
+				}
+				headerRack.DataNodeInfos = append(headerRack.DataNodeInfos, headerNode)
+			}
+			headerDc.RackInfos = append(headerDc.RackInfos, headerRack)
+		}
+		header.TopologyInfo.DataCenterInfos = append(header.TopologyInfo.DataCenterInfos, headerDc)
+	}
+	if err := stream.Send(&master_pb.VolumeListStreamResponse{Header: header}); err != nil {
+		return err
+	}
+	if m.failAfterHeader {
+		return status_Unimplemented()
+	}
+
+	for _, dc := range full.TopologyInfo.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, node := range rack.DataNodeInfos {
+				for diskType, disk := range node.DiskInfos {
+					for start := 0; start < len(disk.VolumeInfos); start += m.batch {
+						end := min(start+m.batch, len(disk.VolumeInfos))
+						err := stream.Send(&master_pb.VolumeListStreamResponse{
+							DataCenter: dc.Id, Rack: rack.Id, DataNode: node.Id, DiskType: diskType,
+							VolumeInfos: disk.VolumeInfos[start:end],
+						})
+						if err != nil {
+							return err
+						}
+					}
+					if len(disk.EcShardInfos) > 0 {
+						err := stream.Send(&master_pb.VolumeListStreamResponse{
+							DataCenter: dc.Id, Rack: rack.Id, DataNode: node.Id, DiskType: diskType,
+							EcShardInfos: disk.EcShardInfos,
+						})
+						if err != nil {
+							return err
+						}
+					}
+				}
+			}
+		}
+	}
+	if m.extraBatch != nil {
+		if err := stream.Send(m.extraBatch); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func testListing(volumes int) *master_pb.VolumeListResponse {
+	disk := &master_pb.DiskInfo{Type: "", DiskId: 2}
+	for i := 1; i <= volumes; i++ {
+		disk.VolumeInfos = append(disk.VolumeInfos, &master_pb.VolumeInformationMessage{
+			Id: uint32(i), Size: uint64(i) * 100, Collection: "c",
+		})
+	}
+	disk.EcShardInfos = append(disk.EcShardInfos, &master_pb.VolumeEcShardInformationMessage{
+		Id: 900, Collection: "c", EcIndexBits: 0x3fff,
+	})
+	return &master_pb.VolumeListResponse{
+		VolumeSizeLimitMb: 30000,
+		TopologyInfo: &master_pb.TopologyInfo{
+			Id: "topo",
+			DataCenterInfos: []*master_pb.DataCenterInfo{{
+				Id: "dc1",
+				RackInfos: []*master_pb.RackInfo{{
+					Id: "rack1",
+					DataNodeInfos: []*master_pb.DataNodeInfo{{
+						Id:        "10.0.0.1:8080",
+						DiskInfos: map[string]*master_pb.DiskInfo{"": disk},
+					}},
+				}},
+			}},
+		},
+	}
+}
+
+func dial(t *testing.T, master *fakeMaster) master_pb.SeaweedClient {
+	t.Helper()
+	listener := bufconn.Listen(1 << 20)
+	server := grpc.NewServer()
+	master_pb.RegisterSeaweedServer(server, master)
+	go server.Serve(listener)
+	t.Cleanup(server.Stop)
+
+	conn, err := grpc.NewClient("passthrough://bufnet",
+		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) { return listener.DialContext(ctx) }),
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { conn.Close() })
+	return master_pb.NewSeaweedClient(conn)
+}
+
+// Whichever way the master answers, a caller sees the same volumes, and sees
+// none of them on the topology it is handed.
+func TestReceiveVolumeListIsTheSameEitherWay(t *testing.T) {
+	const volumes = 250
+	for _, streams := range []bool{true, false} {
+		t.Run(fmt.Sprintf("streaming=%v", streams), func(t *testing.T) {
+			client := dial(t, &fakeMaster{response: testListing(volumes), streams: streams, batch: 32})
+
+			var got []uint32
+			var ec []uint32
+			var topology *master_pb.VolumeListResponse
+			err := ReceiveVolumeList(context.Background(), client, &master_pb.VolumeListRequest{},
+				func(header *master_pb.VolumeListResponse) error {
+					topology = header
+					return nil
+				},
+				func(batch *master_pb.VolumeListStreamResponse) error {
+					for _, v := range batch.VolumeInfos {
+						got = append(got, v.Id)
+					}
+					for _, s := range batch.EcShardInfos {
+						ec = append(ec, s.Id)
+					}
+					return nil
+				})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(got) != volumes {
+				t.Errorf("received %d volumes, want %d", len(got), volumes)
+			}
+			if len(ec) != 1 {
+				t.Errorf("received %d ec shards, want 1", len(ec))
+			}
+			if topology == nil {
+				t.Fatal("never told the topology")
+			}
+			if topology.VolumeSizeLimitMb != 30000 {
+				t.Errorf("volume size limit %d, want 30000", topology.VolumeSizeLimitMb)
+			}
+			disk := topology.TopologyInfo.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0].DiskInfos[""]
+			if len(disk.VolumeInfos) != 0 || len(disk.EcShardInfos) != 0 {
+				t.Errorf("the topology handed over listed %d volumes and %d ec shards, want none",
+					len(disk.VolumeInfos), len(disk.EcShardInfos))
+			}
+		})
+	}
+}
+
+// Reassembly must put back exactly what an unstreamed listing holds -- in
+// particular it must not double the volumes when the master did not stream.
+func TestCollectVolumeListRebuildsTheListing(t *testing.T) {
+	const volumes = 250
+	for _, streams := range []bool{true, false} {
+		t.Run(fmt.Sprintf("streaming=%v", streams), func(t *testing.T) {
+			client := dial(t, &fakeMaster{response: testListing(volumes), streams: streams, batch: 32})
+
+			response, err := CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			disk := response.TopologyInfo.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0].DiskInfos[""]
+			if len(disk.VolumeInfos) != volumes {
+				t.Fatalf("rebuilt %d volumes, want %d", len(disk.VolumeInfos), volumes)
+			}
+			if len(disk.EcShardInfos) != 1 {
+				t.Fatalf("rebuilt %d ec shards, want 1", len(disk.EcShardInfos))
+			}
+			if disk.DiskId != 2 {
+				t.Errorf("rebuilt disk id %d, want 2", disk.DiskId)
+			}
+			seen := make(map[uint32]int, volumes)
+			for _, v := range disk.VolumeInfos {
+				seen[v.Id]++
+			}
+			for id, n := range seen {
+				if n != 1 {
+					t.Fatalf("volume %d rebuilt %d times", id, n)
+				}
+			}
+		})
+	}
+}
+
+func status_Unimplemented() error {
+	return status.Error(codes.Unimplemented, "this master does not stream volume listings")
+}
+
+func cloneListing(r *master_pb.VolumeListResponse) *master_pb.VolumeListResponse {
+	return proto.Clone(r).(*master_pb.VolumeListResponse)
+}
+
+// A heartbeat can register a disk between the topology going out and the
+// batches following it. Those volumes have nowhere to go in the listing being
+// rebuilt, but they must not fail it: the scan that reads it runs every 30
+// minutes and would lose the whole cluster over one new disk.
+func TestCollectVolumeListSurvivesADiskAddedMidStream(t *testing.T) {
+	const volumes = 100
+	master := &fakeMaster{response: testListing(volumes), streams: true, batch: 32}
+	master.extraBatch = &master_pb.VolumeListStreamResponse{
+		DataCenter: "dc1", Rack: "rack1", DataNode: "10.0.0.1:8080", DiskType: "ssd",
+		VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 5000, Collection: "c"}},
+	}
+	client := dial(t, master)
+
+	response, err := CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
+	if err != nil {
+		t.Fatalf("a disk arriving mid-stream failed the listing: %v", err)
+	}
+	node := response.TopologyInfo.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0]
+	if len(node.DiskInfos[""].VolumeInfos) != volumes {
+		t.Errorf("rebuilt %d volumes, want %d", len(node.DiskInfos[""].VolumeInfos), volumes)
+	}
+	if _, appeared := node.DiskInfos["ssd"]; appeared {
+		t.Error("the listing grew a disk its topology never named")
+	}
+}
+
+// A stream that has already spoken cannot be started over as an unstreamed
+// listing: the caller would be handed the same volumes twice.
+func TestReceiveVolumeListDoesNotRestartAStreamThatBegan(t *testing.T) {
+	client := dial(t, &fakeMaster{response: testListing(100), streams: true, batch: 32, failAfterHeader: true})
+
+	topologies, batches := 0, 0
+	err := ReceiveVolumeList(context.Background(), client, &master_pb.VolumeListRequest{},
+		func(*master_pb.VolumeListResponse) error { topologies++; return nil },
+		func(*master_pb.VolumeListStreamResponse) error { batches++; return nil })
+	if err == nil {
+		t.Fatal("a stream that failed after its topology was quietly restarted")
+	}
+	if topologies != 1 {
+		t.Errorf("handed the topology %d times, want 1", topologies)
+	}
+	if batches != 0 {
+		t.Errorf("handed %d volume batches, want none", batches)
+	}
+}
+
+// A caller's own error must reach it, even when it happens to carry the code
+// that means an older master.
+func TestReceiveVolumeListDoesNotRestartOnACallersError(t *testing.T) {
+	client := dial(t, &fakeMaster{response: testListing(100), streams: true, batch: 32})
+
+	batches := 0
+	err := ReceiveVolumeList(context.Background(), client, &master_pb.VolumeListRequest{},
+		nil,
+		func(*master_pb.VolumeListStreamResponse) error {
+			batches++
+			return status.Error(codes.Unimplemented, "the caller cannot handle this")
+		})
+	if err == nil {
+		t.Fatal("the caller's error was swallowed and the listing restarted")
+	}
+	if batches != 1 {
+		t.Errorf("called back %d times, want 1 before giving up", batches)
+	}
+}
diff --git a/weed/pb/volume_server.proto b/weed/pb/volume_server.proto
index 72c0b78775..3a66ffff77 100644
--- a/weed/pb/volume_server.proto
+++ b/weed/pb/volume_server.proto
@@ -168,6 +168,7 @@ message VacuumVolumeCheckRequest {
 }
 message VacuumVolumeCheckResponse {
     double garbage_ratio = 1;
+    bool disk_space_low = 4; // the volume is read-only solely because its disk is low on space — a cause compaction itself reclaims
 }
 
 message VacuumVolumeCompactRequest {
@@ -236,6 +237,7 @@ message VolumeIncrementalCopyResponse {
 
 message VolumeMountRequest {
     uint32 volume_id = 1;
+    optional string collection = 2;
 }
 message VolumeMountResponse {
 }
@@ -258,6 +260,10 @@ message VolumeDeleteRequest {
     // when true, do not remove the cloud-tier object backing the volume.
     // used for moves where another server is taking over the same .vif.
     bool keep_remote_data = 3;
+    // when true, delete only if every needle is deleted: the volume held
+    // data once but nothing is live anymore. Passing either check,
+    // only_empty or this one, is enough to delete.
+    bool only_garbage = 4;
 }
 message VolumeDeleteResponse {
 }
@@ -265,6 +271,8 @@ message VolumeDeleteResponse {
 message VolumeMarkReadonlyRequest {
     uint32 volume_id = 1;
     bool persist = 2;
+    // reject writes but keep accepting deletes, so expiring data can drain the volume
+    bool can_delete = 3;
 }
 message VolumeMarkReadonlyResponse {
 }
@@ -459,6 +467,7 @@ message VolumeEcShardsCopyRequest {
     bool copy_vif_file = 7;
     uint32 disk_id = 8;  // Target disk ID for storing EC shards
     bool copy_ecsum_file = 9; // copy the bitrot checksum sidecar (.ecsum) when present; tolerant of a missing source (no-op), since this non-2PC path has no Prepare backstop
+    int64 io_byte_per_second = 10; // limit the copy rate; 0 falls back to the server's maintenance rate
 }
 message VolumeEcShardsCopyResponse {
 }
@@ -469,6 +478,7 @@ message VolumeEcShardsDeleteRequest {
     repeated uint32 shard_ids = 3;
     bool full_teardown = 4; // pre-encode cleanup: wipe every EC artifact + generation for this volume, not just shard_ids
     int64 encode_ts_ns = 5; // full_teardown generation fence: delete only a disk whose .vif generation is strictly OLDER than this; preserve same-or-newer, generation 0, and an unreadable .vif. 0 => wipe-all (shell pre-encode / pre-upgrade)
+    uint32 delete_generations_older_than = 6; // post-commit cleanup: delete only staged <base>.*.v<N> artifacts with N strictly below this; 0 disables
 }
 message VolumeEcShardsDeleteResponse {
     bool full_teardown_done = 1; // set by a new server that performed full_teardown; absent from an old server lets the caller detect the silent no-op
@@ -538,6 +548,7 @@ message VolumeEcShardsInfoResponse {
     uint64 volume_size = 2;
     uint64 file_count = 3;
     uint64 file_deleted_count = 4;
+    EcShardConfig ec_shard_config = 10;  // the layout this holder serves reads through; a binary predating a field reports it as unset
 }
 
 message EcShardInfo {
@@ -562,6 +573,7 @@ message ReadVolumeFileStatusResponse {
     string disk_type = 9;
     VolumeInfo volume_info = 10;
     uint32 version = 11;
+    uint64 expire_at_sec = 12; // TTL expiry counted from the last write; 0 when the volume never expires
 }
 
 message DiskStatus {
@@ -604,6 +616,7 @@ message VolumeInfo {
     uint64 expire_at_sec = 6; // expiration time of ec volume
     bool read_only = 7;
     EcShardConfig ec_shard_config = 8; // EC shard configuration (optional, null = use default 10+4)
+    bool read_only_can_delete = 9; // with read_only: writes are rejected but deletes still land
 }
 
 // EcShardConfig specifies erasure coding shard configuration
@@ -611,6 +624,7 @@ message EcShardConfig {
     uint32 data_shards = 1;   // Number of data shards (e.g., 10)
     uint32 parity_shards = 2; // Number of parity shards (e.g., 4)
     int64 encode_ts_ns = 3;   // encode time (unix nanos); a read served from a shard of a different encode run is rejected
+    int64 block_size = 4;     // uniform block layout: each shard is a single contiguous block of this many bytes; 0 = legacy 1GiB/1MiB two-tier layout
 }
 
 // EcBitrotProtection is the entire content of a bitrot checksum sidecar
@@ -652,6 +666,7 @@ message VolumeTierMoveDatToRemoteRequest {
     string collection = 2;
     string destination_backend_name = 3;
     bool keep_local_dat_file = 4;
+    int32 concurrency = 5; // multipart upload concurrency, 0 = backend default (5 for S3)
 }
 message VolumeTierMoveDatToRemoteResponse {
     int64 processed = 1;
@@ -662,6 +677,7 @@ message VolumeTierMoveDatFromRemoteRequest {
     uint32 volume_id = 1;
     string collection = 2;
     bool keep_remote_dat_file = 3;
+    int32 concurrency = 4; // multipart download concurrency, 0 = backend default (5 for S3)
 }
 message VolumeTierMoveDatFromRemoteResponse {
     int64 processed = 1;
@@ -714,6 +730,7 @@ enum VolumeScrubMode {
     FULL = 2;
     LOCAL = 3;
     CHECKSUM = 4; // EC only: verify each local shard's raw bytes against the bitrot checksum sidecar
+    READS = 5;    // like FULL, but EC intervals no shard can serve are reconstructed from parity
 }
 
 message ScrubVolumeRequest {
diff --git a/weed/pb/volume_server_pb/volume_server.pb.go b/weed/pb/volume_server_pb/volume_server.pb.go
index 056d41a290..ce6c0c6c71 100644
--- a/weed/pb/volume_server_pb/volume_server.pb.go
+++ b/weed/pb/volume_server_pb/volume_server.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.6
-// 	protoc        v7.35.0
+// 	protoc        v3.21.12
 // source: volume_server.proto
 
 package volume_server_pb
@@ -76,6 +76,7 @@ const (
 	VolumeScrubMode_FULL     VolumeScrubMode = 2
 	VolumeScrubMode_LOCAL    VolumeScrubMode = 3
 	VolumeScrubMode_CHECKSUM VolumeScrubMode = 4 // EC only: verify each local shard's raw bytes against the bitrot checksum sidecar
+	VolumeScrubMode_READS    VolumeScrubMode = 5 // like FULL, but EC intervals no shard can serve are reconstructed from parity
 )
 
 // Enum value maps for VolumeScrubMode.
@@ -86,6 +87,7 @@ var (
 		2: "FULL",
 		3: "LOCAL",
 		4: "CHECKSUM",
+		5: "READS",
 	}
 	VolumeScrubMode_value = map[string]int32{
 		"UNKNOWN":  0,
@@ -93,6 +95,7 @@ var (
 		"FULL":     2,
 		"LOCAL":    3,
 		"CHECKSUM": 4,
+		"READS":    5,
 	}
 )
 
@@ -433,6 +436,7 @@ func (x *VacuumVolumeCheckRequest) GetVolumeId() uint32 {
 type VacuumVolumeCheckResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	GarbageRatio  float64                `protobuf:"fixed64,1,opt,name=garbage_ratio,json=garbageRatio,proto3" json:"garbage_ratio,omitempty"`
+	DiskSpaceLow  bool                   `protobuf:"varint,4,opt,name=disk_space_low,json=diskSpaceLow,proto3" json:"disk_space_low,omitempty"` // the volume is read-only solely because its disk is low on space — a cause compaction itself reclaims
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -474,6 +478,13 @@ func (x *VacuumVolumeCheckResponse) GetGarbageRatio() float64 {
 	return 0
 }
 
+func (x *VacuumVolumeCheckResponse) GetDiskSpaceLow() bool {
+	if x != nil {
+		return x.DiskSpaceLow
+	}
+	return false
+}
+
 type VacuumVolumeCompactRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	VolumeId      uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
@@ -1213,6 +1224,7 @@ func (x *VolumeIncrementalCopyResponse) GetFileContent() []byte {
 type VolumeMountRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	VolumeId      uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
+	Collection    *string                `protobuf:"bytes,2,opt,name=collection,proto3,oneof" json:"collection,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1254,6 +1266,13 @@ func (x *VolumeMountRequest) GetVolumeId() uint32 {
 	return 0
 }
 
+func (x *VolumeMountRequest) GetCollection() string {
+	if x != nil && x.Collection != nil {
+		return *x.Collection
+	}
+	return ""
+}
+
 type VolumeMountResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -1457,8 +1476,12 @@ type VolumeDeleteRequest struct {
 	// when true, do not remove the cloud-tier object backing the volume.
 	// used for moves where another server is taking over the same .vif.
 	KeepRemoteData bool `protobuf:"varint,3,opt,name=keep_remote_data,json=keepRemoteData,proto3" json:"keep_remote_data,omitempty"`
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	// when true, delete only if every needle is deleted: the volume held
+	// data once but nothing is live anymore. Passing either check,
+	// only_empty or this one, is enough to delete.
+	OnlyGarbage   bool `protobuf:"varint,4,opt,name=only_garbage,json=onlyGarbage,proto3" json:"only_garbage,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *VolumeDeleteRequest) Reset() {
@@ -1512,6 +1535,13 @@ func (x *VolumeDeleteRequest) GetKeepRemoteData() bool {
 	return false
 }
 
+func (x *VolumeDeleteRequest) GetOnlyGarbage() bool {
+	if x != nil {
+		return x.OnlyGarbage
+	}
+	return false
+}
+
 type VolumeDeleteResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -1549,9 +1579,11 @@ func (*VolumeDeleteResponse) Descriptor() ([]byte, []int) {
 }
 
 type VolumeMarkReadonlyRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	VolumeId      uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
-	Persist       bool                   `protobuf:"varint,2,opt,name=persist,proto3" json:"persist,omitempty"`
+	state    protoimpl.MessageState `protogen:"open.v1"`
+	VolumeId uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
+	Persist  bool                   `protobuf:"varint,2,opt,name=persist,proto3" json:"persist,omitempty"`
+	// reject writes but keep accepting deletes, so expiring data can drain the volume
+	CanDelete     bool `protobuf:"varint,3,opt,name=can_delete,json=canDelete,proto3" json:"can_delete,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1600,6 +1632,13 @@ func (x *VolumeMarkReadonlyRequest) GetPersist() bool {
 	return false
 }
 
+func (x *VolumeMarkReadonlyRequest) GetCanDelete() bool {
+	if x != nil {
+		return x.CanDelete
+	}
+	return false
+}
+
 type VolumeMarkReadonlyResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -3550,18 +3589,19 @@ func (x *VolumeEcShardsRebuildResponse) GetRebuiltShardIds() []uint32 {
 }
 
 type VolumeEcShardsCopyRequest struct {
-	state          protoimpl.MessageState `protogen:"open.v1"`
-	VolumeId       uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
-	Collection     string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
-	ShardIds       []uint32               `protobuf:"varint,3,rep,packed,name=shard_ids,json=shardIds,proto3" json:"shard_ids,omitempty"`
-	CopyEcxFile    bool                   `protobuf:"varint,4,opt,name=copy_ecx_file,json=copyEcxFile,proto3" json:"copy_ecx_file,omitempty"`
-	SourceDataNode string                 `protobuf:"bytes,5,opt,name=source_data_node,json=sourceDataNode,proto3" json:"source_data_node,omitempty"`
-	CopyEcjFile    bool                   `protobuf:"varint,6,opt,name=copy_ecj_file,json=copyEcjFile,proto3" json:"copy_ecj_file,omitempty"`
-	CopyVifFile    bool                   `protobuf:"varint,7,opt,name=copy_vif_file,json=copyVifFile,proto3" json:"copy_vif_file,omitempty"`
-	DiskId         uint32                 `protobuf:"varint,8,opt,name=disk_id,json=diskId,proto3" json:"disk_id,omitempty"`                        // Target disk ID for storing EC shards
-	CopyEcsumFile  bool                   `protobuf:"varint,9,opt,name=copy_ecsum_file,json=copyEcsumFile,proto3" json:"copy_ecsum_file,omitempty"` // copy the bitrot checksum sidecar (.ecsum) when present; tolerant of a missing source (no-op), since this non-2PC path has no Prepare backstop
-	unknownFields  protoimpl.UnknownFields
-	sizeCache      protoimpl.SizeCache
+	state           protoimpl.MessageState `protogen:"open.v1"`
+	VolumeId        uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
+	Collection      string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
+	ShardIds        []uint32               `protobuf:"varint,3,rep,packed,name=shard_ids,json=shardIds,proto3" json:"shard_ids,omitempty"`
+	CopyEcxFile     bool                   `protobuf:"varint,4,opt,name=copy_ecx_file,json=copyEcxFile,proto3" json:"copy_ecx_file,omitempty"`
+	SourceDataNode  string                 `protobuf:"bytes,5,opt,name=source_data_node,json=sourceDataNode,proto3" json:"source_data_node,omitempty"`
+	CopyEcjFile     bool                   `protobuf:"varint,6,opt,name=copy_ecj_file,json=copyEcjFile,proto3" json:"copy_ecj_file,omitempty"`
+	CopyVifFile     bool                   `protobuf:"varint,7,opt,name=copy_vif_file,json=copyVifFile,proto3" json:"copy_vif_file,omitempty"`
+	DiskId          uint32                 `protobuf:"varint,8,opt,name=disk_id,json=diskId,proto3" json:"disk_id,omitempty"`                                 // Target disk ID for storing EC shards
+	CopyEcsumFile   bool                   `protobuf:"varint,9,opt,name=copy_ecsum_file,json=copyEcsumFile,proto3" json:"copy_ecsum_file,omitempty"`          // copy the bitrot checksum sidecar (.ecsum) when present; tolerant of a missing source (no-op), since this non-2PC path has no Prepare backstop
+	IoBytePerSecond int64                  `protobuf:"varint,10,opt,name=io_byte_per_second,json=ioBytePerSecond,proto3" json:"io_byte_per_second,omitempty"` // limit the copy rate; 0 falls back to the server's maintenance rate
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *VolumeEcShardsCopyRequest) Reset() {
@@ -3657,6 +3697,13 @@ func (x *VolumeEcShardsCopyRequest) GetCopyEcsumFile() bool {
 	return false
 }
 
+func (x *VolumeEcShardsCopyRequest) GetIoBytePerSecond() int64 {
+	if x != nil {
+		return x.IoBytePerSecond
+	}
+	return 0
+}
+
 type VolumeEcShardsCopyResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -3694,14 +3741,15 @@ func (*VolumeEcShardsCopyResponse) Descriptor() ([]byte, []int) {
 }
 
 type VolumeEcShardsDeleteRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	VolumeId      uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
-	Collection    string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
-	ShardIds      []uint32               `protobuf:"varint,3,rep,packed,name=shard_ids,json=shardIds,proto3" json:"shard_ids,omitempty"`
-	FullTeardown  bool                   `protobuf:"varint,4,opt,name=full_teardown,json=fullTeardown,proto3" json:"full_teardown,omitempty"` // pre-encode cleanup: wipe every EC artifact + generation for this volume, not just shard_ids
-	EncodeTsNs    int64                  `protobuf:"varint,5,opt,name=encode_ts_ns,json=encodeTsNs,proto3" json:"encode_ts_ns,omitempty"`     // full_teardown generation fence: delete only a disk whose .vif generation is strictly OLDER than this; preserve same-or-newer, generation 0, and an unreadable .vif. 0 => wipe-all (shell pre-encode / pre-upgrade)
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state                      protoimpl.MessageState `protogen:"open.v1"`
+	VolumeId                   uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
+	Collection                 string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
+	ShardIds                   []uint32               `protobuf:"varint,3,rep,packed,name=shard_ids,json=shardIds,proto3" json:"shard_ids,omitempty"`
+	FullTeardown               bool                   `protobuf:"varint,4,opt,name=full_teardown,json=fullTeardown,proto3" json:"full_teardown,omitempty"`                                               // pre-encode cleanup: wipe every EC artifact + generation for this volume, not just shard_ids
+	EncodeTsNs                 int64                  `protobuf:"varint,5,opt,name=encode_ts_ns,json=encodeTsNs,proto3" json:"encode_ts_ns,omitempty"`                                                   // full_teardown generation fence: delete only a disk whose .vif generation is strictly OLDER than this; preserve same-or-newer, generation 0, and an unreadable .vif. 0 => wipe-all (shell pre-encode / pre-upgrade)
+	DeleteGenerationsOlderThan uint32                 `protobuf:"varint,6,opt,name=delete_generations_older_than,json=deleteGenerationsOlderThan,proto3" json:"delete_generations_older_than,omitempty"` // post-commit cleanup: delete only staged <base>.*.v<N> artifacts with N strictly below this; 0 disables
+	unknownFields              protoimpl.UnknownFields
+	sizeCache                  protoimpl.SizeCache
 }
 
 func (x *VolumeEcShardsDeleteRequest) Reset() {
@@ -3769,6 +3817,13 @@ func (x *VolumeEcShardsDeleteRequest) GetEncodeTsNs() int64 {
 	return 0
 }
 
+func (x *VolumeEcShardsDeleteRequest) GetDeleteGenerationsOlderThan() uint32 {
+	if x != nil {
+		return x.DeleteGenerationsOlderThan
+	}
+	return 0
+}
+
 type VolumeEcShardsDeleteResponse struct {
 	state            protoimpl.MessageState `protogen:"open.v1"`
 	FullTeardownDone bool                   `protobuf:"varint,1,opt,name=full_teardown_done,json=fullTeardownDone,proto3" json:"full_teardown_done,omitempty"` // set by a new server that performed full_teardown; absent from an old server lets the caller detect the silent no-op
@@ -4428,6 +4483,7 @@ type VolumeEcShardsInfoResponse struct {
 	VolumeSize       uint64                 `protobuf:"varint,2,opt,name=volume_size,json=volumeSize,proto3" json:"volume_size,omitempty"`
 	FileCount        uint64                 `protobuf:"varint,3,opt,name=file_count,json=fileCount,proto3" json:"file_count,omitempty"`
 	FileDeletedCount uint64                 `protobuf:"varint,4,opt,name=file_deleted_count,json=fileDeletedCount,proto3" json:"file_deleted_count,omitempty"`
+	EcShardConfig    *EcShardConfig         `protobuf:"bytes,10,opt,name=ec_shard_config,json=ecShardConfig,proto3" json:"ec_shard_config,omitempty"` // the layout this holder serves reads through; a binary predating a field reports it as unset
 	unknownFields    protoimpl.UnknownFields
 	sizeCache        protoimpl.SizeCache
 }
@@ -4490,6 +4546,13 @@ func (x *VolumeEcShardsInfoResponse) GetFileDeletedCount() uint64 {
 	return 0
 }
 
+func (x *VolumeEcShardsInfoResponse) GetEcShardConfig() *EcShardConfig {
+	if x != nil {
+		return x.EcShardConfig
+	}
+	return nil
+}
+
 type EcShardInfo struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	ShardId       uint32                 `protobuf:"varint,1,opt,name=shard_id,json=shardId,proto3" json:"shard_id,omitempty"`
@@ -4615,6 +4678,7 @@ type ReadVolumeFileStatusResponse struct {
 	DiskType                string                 `protobuf:"bytes,9,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`
 	VolumeInfo              *VolumeInfo            `protobuf:"bytes,10,opt,name=volume_info,json=volumeInfo,proto3" json:"volume_info,omitempty"`
 	Version                 uint32                 `protobuf:"varint,11,opt,name=version,proto3" json:"version,omitempty"`
+	ExpireAtSec             uint64                 `protobuf:"varint,12,opt,name=expire_at_sec,json=expireAtSec,proto3" json:"expire_at_sec,omitempty"` // TTL expiry counted from the last write; 0 when the volume never expires
 	unknownFields           protoimpl.UnknownFields
 	sizeCache               protoimpl.SizeCache
 }
@@ -4726,6 +4790,13 @@ func (x *ReadVolumeFileStatusResponse) GetVersion() uint32 {
 	return 0
 }
 
+func (x *ReadVolumeFileStatusResponse) GetExpireAtSec() uint64 {
+	if x != nil {
+		return x.ExpireAtSec
+	}
+	return 0
+}
+
 type DiskStatus struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Dir           string                 `protobuf:"bytes,1,opt,name=dir,proto3" json:"dir,omitempty"`
@@ -5012,17 +5083,18 @@ func (x *RemoteFile) GetExtension() string {
 }
 
 type VolumeInfo struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Files         []*RemoteFile          `protobuf:"bytes,1,rep,name=files,proto3" json:"files,omitempty"`
-	Version       uint32                 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
-	Replication   string                 `protobuf:"bytes,3,opt,name=replication,proto3" json:"replication,omitempty"`
-	BytesOffset   uint32                 `protobuf:"varint,4,opt,name=bytes_offset,json=bytesOffset,proto3" json:"bytes_offset,omitempty"`
-	DatFileSize   int64                  `protobuf:"varint,5,opt,name=dat_file_size,json=datFileSize,proto3" json:"dat_file_size,omitempty"` // store the original dat file size
-	ExpireAtSec   uint64                 `protobuf:"varint,6,opt,name=expire_at_sec,json=expireAtSec,proto3" json:"expire_at_sec,omitempty"` // expiration time of ec volume
-	ReadOnly      bool                   `protobuf:"varint,7,opt,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
-	EcShardConfig *EcShardConfig         `protobuf:"bytes,8,opt,name=ec_shard_config,json=ecShardConfig,proto3" json:"ec_shard_config,omitempty"` // EC shard configuration (optional, null = use default 10+4)
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	Files             []*RemoteFile          `protobuf:"bytes,1,rep,name=files,proto3" json:"files,omitempty"`
+	Version           uint32                 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
+	Replication       string                 `protobuf:"bytes,3,opt,name=replication,proto3" json:"replication,omitempty"`
+	BytesOffset       uint32                 `protobuf:"varint,4,opt,name=bytes_offset,json=bytesOffset,proto3" json:"bytes_offset,omitempty"`
+	DatFileSize       int64                  `protobuf:"varint,5,opt,name=dat_file_size,json=datFileSize,proto3" json:"dat_file_size,omitempty"` // store the original dat file size
+	ExpireAtSec       uint64                 `protobuf:"varint,6,opt,name=expire_at_sec,json=expireAtSec,proto3" json:"expire_at_sec,omitempty"` // expiration time of ec volume
+	ReadOnly          bool                   `protobuf:"varint,7,opt,name=read_only,json=readOnly,proto3" json:"read_only,omitempty"`
+	EcShardConfig     *EcShardConfig         `protobuf:"bytes,8,opt,name=ec_shard_config,json=ecShardConfig,proto3" json:"ec_shard_config,omitempty"`                // EC shard configuration (optional, null = use default 10+4)
+	ReadOnlyCanDelete bool                   `protobuf:"varint,9,opt,name=read_only_can_delete,json=readOnlyCanDelete,proto3" json:"read_only_can_delete,omitempty"` // with read_only: writes are rejected but deletes still land
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *VolumeInfo) Reset() {
@@ -5111,12 +5183,20 @@ func (x *VolumeInfo) GetEcShardConfig() *EcShardConfig {
 	return nil
 }
 
+func (x *VolumeInfo) GetReadOnlyCanDelete() bool {
+	if x != nil {
+		return x.ReadOnlyCanDelete
+	}
+	return false
+}
+
 // EcShardConfig specifies erasure coding shard configuration
 type EcShardConfig struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	DataShards    uint32                 `protobuf:"varint,1,opt,name=data_shards,json=dataShards,proto3" json:"data_shards,omitempty"`       // Number of data shards (e.g., 10)
 	ParityShards  uint32                 `protobuf:"varint,2,opt,name=parity_shards,json=parityShards,proto3" json:"parity_shards,omitempty"` // Number of parity shards (e.g., 4)
 	EncodeTsNs    int64                  `protobuf:"varint,3,opt,name=encode_ts_ns,json=encodeTsNs,proto3" json:"encode_ts_ns,omitempty"`     // encode time (unix nanos); a read served from a shard of a different encode run is rejected
+	BlockSize     int64                  `protobuf:"varint,4,opt,name=block_size,json=blockSize,proto3" json:"block_size,omitempty"`          // uniform block layout: each shard is a single contiguous block of this many bytes; 0 = legacy 1GiB/1MiB two-tier layout
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -5172,6 +5252,13 @@ func (x *EcShardConfig) GetEncodeTsNs() int64 {
 	return 0
 }
 
+func (x *EcShardConfig) GetBlockSize() int64 {
+	if x != nil {
+		return x.BlockSize
+	}
+	return 0
+}
+
 // EcBitrotProtection is the entire content of a bitrot checksum sidecar
 // (<base>.ecsum for the legacy generation, <base>.ecsum.v<N> for vacuum
 // generation N). On disk it is wrapped in a fixed header carrying a CRC32C
@@ -5419,6 +5506,7 @@ type VolumeTierMoveDatToRemoteRequest struct {
 	Collection             string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
 	DestinationBackendName string                 `protobuf:"bytes,3,opt,name=destination_backend_name,json=destinationBackendName,proto3" json:"destination_backend_name,omitempty"`
 	KeepLocalDatFile       bool                   `protobuf:"varint,4,opt,name=keep_local_dat_file,json=keepLocalDatFile,proto3" json:"keep_local_dat_file,omitempty"`
+	Concurrency            int32                  `protobuf:"varint,5,opt,name=concurrency,proto3" json:"concurrency,omitempty"` // multipart upload concurrency, 0 = backend default (5 for S3)
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -5481,6 +5569,13 @@ func (x *VolumeTierMoveDatToRemoteRequest) GetKeepLocalDatFile() bool {
 	return false
 }
 
+func (x *VolumeTierMoveDatToRemoteRequest) GetConcurrency() int32 {
+	if x != nil {
+		return x.Concurrency
+	}
+	return 0
+}
+
 type VolumeTierMoveDatToRemoteResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Processed           int64                  `protobuf:"varint,1,opt,name=processed,proto3" json:"processed,omitempty"`
@@ -5538,6 +5633,7 @@ type VolumeTierMoveDatFromRemoteRequest struct {
 	VolumeId          uint32                 `protobuf:"varint,1,opt,name=volume_id,json=volumeId,proto3" json:"volume_id,omitempty"`
 	Collection        string                 `protobuf:"bytes,2,opt,name=collection,proto3" json:"collection,omitempty"`
 	KeepRemoteDatFile bool                   `protobuf:"varint,3,opt,name=keep_remote_dat_file,json=keepRemoteDatFile,proto3" json:"keep_remote_dat_file,omitempty"`
+	Concurrency       int32                  `protobuf:"varint,4,opt,name=concurrency,proto3" json:"concurrency,omitempty"` // multipart download concurrency, 0 = backend default (5 for S3)
 	unknownFields     protoimpl.UnknownFields
 	sizeCache         protoimpl.SizeCache
 }
@@ -5593,6 +5689,13 @@ func (x *VolumeTierMoveDatFromRemoteRequest) GetKeepRemoteDatFile() bool {
 	return false
 }
 
+func (x *VolumeTierMoveDatFromRemoteRequest) GetConcurrency() int32 {
+	if x != nil {
+		return x.Concurrency
+	}
+	return 0
+}
+
 type VolumeTierMoveDatFromRemoteResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Processed           int64                  `protobuf:"varint,1,opt,name=processed,proto3" json:"processed,omitempty"`
@@ -7189,9 +7292,10 @@ const file_volume_server_proto_rawDesc = "" +
 	"\aversion\x18\x05 \x01(\rR\aversion\"\a\n" +
 	"\x05Empty\"7\n" +
 	"\x18VacuumVolumeCheckRequest\x12\x1b\n" +
-	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"@\n" +
+	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"f\n" +
 	"\x19VacuumVolumeCheckResponse\x12#\n" +
-	"\rgarbage_ratio\x18\x01 \x01(\x01R\fgarbageRatio\"[\n" +
+	"\rgarbage_ratio\x18\x01 \x01(\x01R\fgarbageRatio\x12$\n" +
+	"\x0edisk_space_low\x18\x04 \x01(\bR\fdiskSpaceLow\"[\n" +
 	"\x1aVacuumVolumeCompactRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12 \n" +
 	"\vpreallocate\x18\x02 \x01(\x03R\vpreallocate\"f\n" +
@@ -7243,25 +7347,32 @@ const file_volume_server_proto_rawDesc = "" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x19\n" +
 	"\bsince_ns\x18\x02 \x01(\x04R\asinceNs\"B\n" +
 	"\x1dVolumeIncrementalCopyResponse\x12!\n" +
-	"\ffile_content\x18\x01 \x01(\fR\vfileContent\"1\n" +
+	"\ffile_content\x18\x01 \x01(\fR\vfileContent\"e\n" +
 	"\x12VolumeMountRequest\x12\x1b\n" +
-	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\x15\n" +
+	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12#\n" +
+	"\n" +
+	"collection\x18\x02 \x01(\tH\x00R\n" +
+	"collection\x88\x01\x01B\r\n" +
+	"\v_collection\"\x15\n" +
 	"\x13VolumeMountResponse\"3\n" +
 	"\x14VolumeUnmountRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\x17\n" +
 	"\x15VolumeUnmountResponse\"<\n" +
 	"\x1dVolumeConsolidateIndexRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\" \n" +
-	"\x1eVolumeConsolidateIndexResponse\"{\n" +
+	"\x1eVolumeConsolidateIndexResponse\"\x9e\x01\n" +
 	"\x13VolumeDeleteRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x1d\n" +
 	"\n" +
 	"only_empty\x18\x02 \x01(\bR\tonlyEmpty\x12(\n" +
-	"\x10keep_remote_data\x18\x03 \x01(\bR\x0ekeepRemoteData\"\x16\n" +
-	"\x14VolumeDeleteResponse\"R\n" +
+	"\x10keep_remote_data\x18\x03 \x01(\bR\x0ekeepRemoteData\x12!\n" +
+	"\fonly_garbage\x18\x04 \x01(\bR\vonlyGarbage\"\x16\n" +
+	"\x14VolumeDeleteResponse\"q\n" +
 	"\x19VolumeMarkReadonlyRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x18\n" +
-	"\apersist\x18\x02 \x01(\bR\apersist\"\x1c\n" +
+	"\apersist\x18\x02 \x01(\bR\apersist\x12\x1d\n" +
+	"\n" +
+	"can_delete\x18\x03 \x01(\bR\tcanDelete\"\x1c\n" +
 	"\x1aVolumeMarkReadonlyResponse\"8\n" +
 	"\x19VolumeMarkWritableRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\x1c\n" +
@@ -7405,7 +7516,7 @@ const file_volume_server_proto_rawDesc = "" +
 	"collection\x122\n" +
 	"\x15unsafe_ignore_sidecar\x18\x03 \x01(\bR\x13unsafeIgnoreSidecar\"K\n" +
 	"\x1dVolumeEcShardsRebuildResponse\x12*\n" +
-	"\x11rebuilt_shard_ids\x18\x01 \x03(\rR\x0frebuiltShardIds\"\xcc\x02\n" +
+	"\x11rebuilt_shard_ids\x18\x01 \x03(\rR\x0frebuiltShardIds\"\xf9\x02\n" +
 	"\x19VolumeEcShardsCopyRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x1e\n" +
 	"\n" +
@@ -7417,8 +7528,10 @@ const file_volume_server_proto_rawDesc = "" +
 	"\rcopy_ecj_file\x18\x06 \x01(\bR\vcopyEcjFile\x12\"\n" +
 	"\rcopy_vif_file\x18\a \x01(\bR\vcopyVifFile\x12\x17\n" +
 	"\adisk_id\x18\b \x01(\rR\x06diskId\x12&\n" +
-	"\x0fcopy_ecsum_file\x18\t \x01(\bR\rcopyEcsumFile\"\x1c\n" +
-	"\x1aVolumeEcShardsCopyResponse\"\xbe\x01\n" +
+	"\x0fcopy_ecsum_file\x18\t \x01(\bR\rcopyEcsumFile\x12+\n" +
+	"\x12io_byte_per_second\x18\n" +
+	" \x01(\x03R\x0fioBytePerSecond\"\x1c\n" +
+	"\x1aVolumeEcShardsCopyResponse\"\x81\x02\n" +
 	"\x1bVolumeEcShardsDeleteRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x1e\n" +
 	"\n" +
@@ -7427,7 +7540,8 @@ const file_volume_server_proto_rawDesc = "" +
 	"\tshard_ids\x18\x03 \x03(\rR\bshardIds\x12#\n" +
 	"\rfull_teardown\x18\x04 \x01(\bR\ffullTeardown\x12 \n" +
 	"\fencode_ts_ns\x18\x05 \x01(\x03R\n" +
-	"encodeTsNs\"L\n" +
+	"encodeTsNs\x12A\n" +
+	"\x1ddelete_generations_older_than\x18\x06 \x01(\rR\x1adeleteGenerationsOlderThan\"L\n" +
 	"\x1cVolumeEcShardsDeleteResponse\x12,\n" +
 	"\x12full_teardown_done\x18\x01 \x01(\bR\x10fullTeardownDone\"\xd4\x01\n" +
 	"\x1aVolumeEcShardsMountRequest\x12\x1b\n" +
@@ -7477,14 +7591,16 @@ const file_volume_server_proto_rawDesc = "" +
 	"\tdisk_type\x18\x04 \x01(\tR\bdiskType\" \n" +
 	"\x1eVolumeEcShardsToVolumeResponse\"8\n" +
 	"\x19VolumeEcShardsInfoRequest\x12\x1b\n" +
-	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\xcf\x01\n" +
+	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\x98\x02\n" +
 	"\x1aVolumeEcShardsInfoResponse\x12C\n" +
 	"\x0eec_shard_infos\x18\x01 \x03(\v2\x1d.volume_server_pb.EcShardInfoR\fecShardInfos\x12\x1f\n" +
 	"\vvolume_size\x18\x02 \x01(\x04R\n" +
 	"volumeSize\x12\x1d\n" +
 	"\n" +
 	"file_count\x18\x03 \x01(\x04R\tfileCount\x12,\n" +
-	"\x12file_deleted_count\x18\x04 \x01(\x04R\x10fileDeletedCount\"y\n" +
+	"\x12file_deleted_count\x18\x04 \x01(\x04R\x10fileDeletedCount\x12G\n" +
+	"\x0fec_shard_config\x18\n" +
+	" \x01(\v2\x1f.volume_server_pb.EcShardConfigR\recShardConfig\"y\n" +
 	"\vEcShardInfo\x12\x19\n" +
 	"\bshard_id\x18\x01 \x01(\rR\ashardId\x12\x12\n" +
 	"\x04size\x18\x02 \x01(\x03R\x04size\x12\x1e\n" +
@@ -7493,7 +7609,7 @@ const file_volume_server_proto_rawDesc = "" +
 	"collection\x12\x1b\n" +
 	"\tvolume_id\x18\x04 \x01(\rR\bvolumeId\":\n" +
 	"\x1bReadVolumeFileStatusRequest\x12\x1b\n" +
-	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\xe3\x03\n" +
+	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\"\x87\x04\n" +
 	"\x1cReadVolumeFileStatusResponse\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12;\n" +
 	"\x1aidx_file_timestamp_seconds\x18\x02 \x01(\x04R\x17idxFileTimestampSeconds\x12\"\n" +
@@ -7510,7 +7626,8 @@ const file_volume_server_proto_rawDesc = "" +
 	"\vvolume_info\x18\n" +
 	" \x01(\v2\x1c.volume_server_pb.VolumeInfoR\n" +
 	"volumeInfo\x12\x18\n" +
-	"\aversion\x18\v \x01(\rR\aversion\"\xd1\x01\n" +
+	"\aversion\x18\v \x01(\rR\aversion\x12\"\n" +
+	"\rexpire_at_sec\x18\f \x01(\x04R\vexpireAtSec\"\xd1\x01\n" +
 	"\n" +
 	"DiskStatus\x12\x10\n" +
 	"\x03dir\x18\x01 \x01(\tR\x03dir\x12\x10\n" +
@@ -7540,7 +7657,7 @@ const file_volume_server_proto_rawDesc = "" +
 	"\x06offset\x18\x04 \x01(\x04R\x06offset\x12\x1b\n" +
 	"\tfile_size\x18\x05 \x01(\x04R\bfileSize\x12#\n" +
 	"\rmodified_time\x18\x06 \x01(\x04R\fmodifiedTime\x12\x1c\n" +
-	"\textension\x18\a \x01(\tR\textension\"\xcd\x02\n" +
+	"\textension\x18\a \x01(\tR\textension\"\xfe\x02\n" +
 	"\n" +
 	"VolumeInfo\x122\n" +
 	"\x05files\x18\x01 \x03(\v2\x1c.volume_server_pb.RemoteFileR\x05files\x12\x18\n" +
@@ -7550,13 +7667,16 @@ const file_volume_server_proto_rawDesc = "" +
 	"\rdat_file_size\x18\x05 \x01(\x03R\vdatFileSize\x12\"\n" +
 	"\rexpire_at_sec\x18\x06 \x01(\x04R\vexpireAtSec\x12\x1b\n" +
 	"\tread_only\x18\a \x01(\bR\breadOnly\x12G\n" +
-	"\x0fec_shard_config\x18\b \x01(\v2\x1f.volume_server_pb.EcShardConfigR\recShardConfig\"w\n" +
+	"\x0fec_shard_config\x18\b \x01(\v2\x1f.volume_server_pb.EcShardConfigR\recShardConfig\x12/\n" +
+	"\x14read_only_can_delete\x18\t \x01(\bR\x11readOnlyCanDelete\"\x96\x01\n" +
 	"\rEcShardConfig\x12\x1f\n" +
 	"\vdata_shards\x18\x01 \x01(\rR\n" +
 	"dataShards\x12#\n" +
 	"\rparity_shards\x18\x02 \x01(\rR\fparityShards\x12 \n" +
 	"\fencode_ts_ns\x18\x03 \x01(\x03R\n" +
-	"encodeTsNs\"\xbc\x02\n" +
+	"encodeTsNs\x12\x1d\n" +
+	"\n" +
+	"block_size\x18\x04 \x01(\x03R\tblockSize\"\xbc\x02\n" +
 	"\x12EcBitrotProtection\x12A\n" +
 	"\talgorithm\x18\x01 \x01(\x0e2#.volume_server_pb.ChecksumAlgorithmR\talgorithm\x12\x1d\n" +
 	"\n" +
@@ -7579,23 +7699,25 @@ const file_volume_server_proto_rawDesc = "" +
 	"\vBytesOffset\x18\x04 \x01(\rR\vBytesOffset\x12\"\n" +
 	"\rdat_file_size\x18\x05 \x01(\x03R\vdatFileSize\x12 \n" +
 	"\vDestroyTime\x18\x06 \x01(\x04R\vDestroyTime\x12\x1b\n" +
-	"\tread_only\x18\a \x01(\bR\breadOnly\"\xc8\x01\n" +
+	"\tread_only\x18\a \x01(\bR\breadOnly\"\xea\x01\n" +
 	" VolumeTierMoveDatToRemoteRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x1e\n" +
 	"\n" +
 	"collection\x18\x02 \x01(\tR\n" +
 	"collection\x128\n" +
 	"\x18destination_backend_name\x18\x03 \x01(\tR\x16destinationBackendName\x12-\n" +
-	"\x13keep_local_dat_file\x18\x04 \x01(\bR\x10keepLocalDatFile\"s\n" +
+	"\x13keep_local_dat_file\x18\x04 \x01(\bR\x10keepLocalDatFile\x12 \n" +
+	"\vconcurrency\x18\x05 \x01(\x05R\vconcurrency\"s\n" +
 	"!VolumeTierMoveDatToRemoteResponse\x12\x1c\n" +
 	"\tprocessed\x18\x01 \x01(\x03R\tprocessed\x120\n" +
-	"\x13processedPercentage\x18\x02 \x01(\x02R\x13processedPercentage\"\x92\x01\n" +
+	"\x13processedPercentage\x18\x02 \x01(\x02R\x13processedPercentage\"\xb4\x01\n" +
 	"\"VolumeTierMoveDatFromRemoteRequest\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x1e\n" +
 	"\n" +
 	"collection\x18\x02 \x01(\tR\n" +
 	"collection\x12/\n" +
-	"\x14keep_remote_dat_file\x18\x03 \x01(\bR\x11keepRemoteDatFile\"u\n" +
+	"\x14keep_remote_dat_file\x18\x03 \x01(\bR\x11keepRemoteDatFile\x12 \n" +
+	"\vconcurrency\x18\x04 \x01(\x05R\vconcurrency\"u\n" +
 	"#VolumeTierMoveDatFromRemoteResponse\x12\x1c\n" +
 	"\tprocessed\x18\x01 \x01(\x03R\tprocessed\x120\n" +
 	"\x13processedPercentage\x18\x02 \x01(\x02R\x13processedPercentage\"\x1b\n" +
@@ -7718,13 +7840,14 @@ const file_volume_server_proto_rawDesc = "" +
 	"stopTimeNs*;\n" +
 	"\x11ChecksumAlgorithm\x12\x11\n" +
 	"\rCHECKSUM_NONE\x10\x00\x12\x13\n" +
-	"\x0fCHECKSUM_CRC32C\x10\x01*L\n" +
+	"\x0fCHECKSUM_CRC32C\x10\x01*W\n" +
 	"\x0fVolumeScrubMode\x12\v\n" +
 	"\aUNKNOWN\x10\x00\x12\t\n" +
 	"\x05INDEX\x10\x01\x12\b\n" +
 	"\x04FULL\x10\x02\x12\t\n" +
 	"\x05LOCAL\x10\x03\x12\f\n" +
-	"\bCHECKSUM\x10\x042\xfa)\n" +
+	"\bCHECKSUM\x10\x04\x12\t\n" +
+	"\x05READS\x10\x052\xfa)\n" +
 	"\fVolumeServer\x12\\\n" +
 	"\vBatchDelete\x12$.volume_server_pb.BatchDeleteRequest\x1a%.volume_server_pb.BatchDeleteResponse\"\x00\x12n\n" +
 	"\x11VacuumVolumeCheck\x12*.volume_server_pb.VacuumVolumeCheckRequest\x1a+.volume_server_pb.VacuumVolumeCheckResponse\"\x00\x12v\n" +
@@ -7924,133 +8047,134 @@ var file_volume_server_proto_depIdxs = []int32{
 	2,   // 3: volume_server_pb.SetStateResponse.state:type_name -> volume_server_pb.VolumeServerState
 	48,  // 4: volume_server_pb.ReceiveFileRequest.info:type_name -> volume_server_pb.ReceiveFileInfo
 	82,  // 5: volume_server_pb.VolumeEcShardsInfoResponse.ec_shard_infos:type_name -> volume_server_pb.EcShardInfo
-	88,  // 6: volume_server_pb.ReadVolumeFileStatusResponse.volume_info:type_name -> volume_server_pb.VolumeInfo
-	87,  // 7: volume_server_pb.VolumeInfo.files:type_name -> volume_server_pb.RemoteFile
-	89,  // 8: volume_server_pb.VolumeInfo.ec_shard_config:type_name -> volume_server_pb.EcShardConfig
-	0,   // 9: volume_server_pb.EcBitrotProtection.algorithm:type_name -> volume_server_pb.ChecksumAlgorithm
-	89,  // 10: volume_server_pb.EcBitrotProtection.ec_shard_config:type_name -> volume_server_pb.EcShardConfig
-	91,  // 11: volume_server_pb.EcBitrotProtection.shards:type_name -> volume_server_pb.EcShardChecksums
-	87,  // 12: volume_server_pb.OldVersionVolumeInfo.files:type_name -> volume_server_pb.RemoteFile
-	85,  // 13: volume_server_pb.VolumeServerStatusResponse.disk_statuses:type_name -> volume_server_pb.DiskStatus
-	86,  // 14: volume_server_pb.VolumeServerStatusResponse.memory_status:type_name -> volume_server_pb.MemStatus
-	2,   // 15: volume_server_pb.VolumeServerStatusResponse.state:type_name -> volume_server_pb.VolumeServerState
-	113, // 16: volume_server_pb.FetchAndWriteNeedleRequest.replicas:type_name -> volume_server_pb.FetchAndWriteNeedleRequest.Replica
-	122, // 17: volume_server_pb.FetchAndWriteNeedleRequest.remote_conf:type_name -> remote_pb.RemoteConf
-	123, // 18: volume_server_pb.FetchAndWriteNeedleRequest.remote_location:type_name -> remote_pb.RemoteStorageLocation
-	1,   // 19: volume_server_pb.ScrubVolumeRequest.mode:type_name -> volume_server_pb.VolumeScrubMode
-	1,   // 20: volume_server_pb.ScrubEcVolumeRequest.mode:type_name -> volume_server_pb.VolumeScrubMode
-	82,  // 21: volume_server_pb.ScrubEcVolumeResponse.broken_shard_infos:type_name -> volume_server_pb.EcShardInfo
-	114, // 22: volume_server_pb.QueryRequest.filter:type_name -> volume_server_pb.QueryRequest.Filter
-	115, // 23: volume_server_pb.QueryRequest.input_serialization:type_name -> volume_server_pb.QueryRequest.InputSerialization
-	116, // 24: volume_server_pb.QueryRequest.output_serialization:type_name -> volume_server_pb.QueryRequest.OutputSerialization
-	117, // 25: volume_server_pb.QueryRequest.InputSerialization.csv_input:type_name -> volume_server_pb.QueryRequest.InputSerialization.CSVInput
-	118, // 26: volume_server_pb.QueryRequest.InputSerialization.json_input:type_name -> volume_server_pb.QueryRequest.InputSerialization.JSONInput
-	119, // 27: volume_server_pb.QueryRequest.InputSerialization.parquet_input:type_name -> volume_server_pb.QueryRequest.InputSerialization.ParquetInput
-	120, // 28: volume_server_pb.QueryRequest.OutputSerialization.csv_output:type_name -> volume_server_pb.QueryRequest.OutputSerialization.CSVOutput
-	121, // 29: volume_server_pb.QueryRequest.OutputSerialization.json_output:type_name -> volume_server_pb.QueryRequest.OutputSerialization.JSONOutput
-	3,   // 30: volume_server_pb.VolumeServer.BatchDelete:input_type -> volume_server_pb.BatchDeleteRequest
-	7,   // 31: volume_server_pb.VolumeServer.VacuumVolumeCheck:input_type -> volume_server_pb.VacuumVolumeCheckRequest
-	9,   // 32: volume_server_pb.VolumeServer.VacuumVolumeCompact:input_type -> volume_server_pb.VacuumVolumeCompactRequest
-	11,  // 33: volume_server_pb.VolumeServer.VacuumVolumeCommit:input_type -> volume_server_pb.VacuumVolumeCommitRequest
-	13,  // 34: volume_server_pb.VolumeServer.VacuumVolumeCleanup:input_type -> volume_server_pb.VacuumVolumeCleanupRequest
-	15,  // 35: volume_server_pb.VolumeServer.DeleteCollection:input_type -> volume_server_pb.DeleteCollectionRequest
-	17,  // 36: volume_server_pb.VolumeServer.AllocateVolume:input_type -> volume_server_pb.AllocateVolumeRequest
-	19,  // 37: volume_server_pb.VolumeServer.VolumeSyncStatus:input_type -> volume_server_pb.VolumeSyncStatusRequest
-	21,  // 38: volume_server_pb.VolumeServer.VolumeIncrementalCopy:input_type -> volume_server_pb.VolumeIncrementalCopyRequest
-	23,  // 39: volume_server_pb.VolumeServer.VolumeMount:input_type -> volume_server_pb.VolumeMountRequest
-	25,  // 40: volume_server_pb.VolumeServer.VolumeUnmount:input_type -> volume_server_pb.VolumeUnmountRequest
-	27,  // 41: volume_server_pb.VolumeServer.VolumeConsolidateIndex:input_type -> volume_server_pb.VolumeConsolidateIndexRequest
-	29,  // 42: volume_server_pb.VolumeServer.VolumeDelete:input_type -> volume_server_pb.VolumeDeleteRequest
-	31,  // 43: volume_server_pb.VolumeServer.VolumeMarkReadonly:input_type -> volume_server_pb.VolumeMarkReadonlyRequest
-	33,  // 44: volume_server_pb.VolumeServer.VolumeMarkWritable:input_type -> volume_server_pb.VolumeMarkWritableRequest
-	35,  // 45: volume_server_pb.VolumeServer.VolumeConfigure:input_type -> volume_server_pb.VolumeConfigureRequest
-	37,  // 46: volume_server_pb.VolumeServer.VolumeStatus:input_type -> volume_server_pb.VolumeStatusRequest
-	39,  // 47: volume_server_pb.VolumeServer.GetState:input_type -> volume_server_pb.GetStateRequest
-	41,  // 48: volume_server_pb.VolumeServer.SetState:input_type -> volume_server_pb.SetStateRequest
-	43,  // 49: volume_server_pb.VolumeServer.VolumeCopy:input_type -> volume_server_pb.VolumeCopyRequest
-	83,  // 50: volume_server_pb.VolumeServer.ReadVolumeFileStatus:input_type -> volume_server_pb.ReadVolumeFileStatusRequest
-	45,  // 51: volume_server_pb.VolumeServer.CopyFile:input_type -> volume_server_pb.CopyFileRequest
-	47,  // 52: volume_server_pb.VolumeServer.ReceiveFile:input_type -> volume_server_pb.ReceiveFileRequest
-	50,  // 53: volume_server_pb.VolumeServer.ReadNeedleBlob:input_type -> volume_server_pb.ReadNeedleBlobRequest
-	52,  // 54: volume_server_pb.VolumeServer.ReadNeedleMeta:input_type -> volume_server_pb.ReadNeedleMetaRequest
-	54,  // 55: volume_server_pb.VolumeServer.WriteNeedleBlob:input_type -> volume_server_pb.WriteNeedleBlobRequest
-	56,  // 56: volume_server_pb.VolumeServer.ReadAllNeedles:input_type -> volume_server_pb.ReadAllNeedlesRequest
-	58,  // 57: volume_server_pb.VolumeServer.VolumeTailSender:input_type -> volume_server_pb.VolumeTailSenderRequest
-	60,  // 58: volume_server_pb.VolumeServer.VolumeTailReceiver:input_type -> volume_server_pb.VolumeTailReceiverRequest
-	62,  // 59: volume_server_pb.VolumeServer.VolumeEcShardsGenerate:input_type -> volume_server_pb.VolumeEcShardsGenerateRequest
-	64,  // 60: volume_server_pb.VolumeServer.VolumeEcShardsRebuild:input_type -> volume_server_pb.VolumeEcShardsRebuildRequest
-	66,  // 61: volume_server_pb.VolumeServer.VolumeEcShardsCopy:input_type -> volume_server_pb.VolumeEcShardsCopyRequest
-	68,  // 62: volume_server_pb.VolumeServer.VolumeEcShardsDelete:input_type -> volume_server_pb.VolumeEcShardsDeleteRequest
-	70,  // 63: volume_server_pb.VolumeServer.VolumeEcShardsMount:input_type -> volume_server_pb.VolumeEcShardsMountRequest
-	72,  // 64: volume_server_pb.VolumeServer.VolumeEcShardsUnmount:input_type -> volume_server_pb.VolumeEcShardsUnmountRequest
-	74,  // 65: volume_server_pb.VolumeServer.VolumeEcShardRead:input_type -> volume_server_pb.VolumeEcShardReadRequest
-	76,  // 66: volume_server_pb.VolumeServer.VolumeEcBlobDelete:input_type -> volume_server_pb.VolumeEcBlobDeleteRequest
-	78,  // 67: volume_server_pb.VolumeServer.VolumeEcShardsToVolume:input_type -> volume_server_pb.VolumeEcShardsToVolumeRequest
-	80,  // 68: volume_server_pb.VolumeServer.VolumeEcShardsInfo:input_type -> volume_server_pb.VolumeEcShardsInfoRequest
-	93,  // 69: volume_server_pb.VolumeServer.VolumeTierMoveDatToRemote:input_type -> volume_server_pb.VolumeTierMoveDatToRemoteRequest
-	95,  // 70: volume_server_pb.VolumeServer.VolumeTierMoveDatFromRemote:input_type -> volume_server_pb.VolumeTierMoveDatFromRemoteRequest
-	97,  // 71: volume_server_pb.VolumeServer.VolumeServerStatus:input_type -> volume_server_pb.VolumeServerStatusRequest
-	99,  // 72: volume_server_pb.VolumeServer.VolumeServerLeave:input_type -> volume_server_pb.VolumeServerLeaveRequest
-	101, // 73: volume_server_pb.VolumeServer.FetchAndWriteNeedle:input_type -> volume_server_pb.FetchAndWriteNeedleRequest
-	103, // 74: volume_server_pb.VolumeServer.ScrubVolume:input_type -> volume_server_pb.ScrubVolumeRequest
-	105, // 75: volume_server_pb.VolumeServer.ScrubEcVolume:input_type -> volume_server_pb.ScrubEcVolumeRequest
-	107, // 76: volume_server_pb.VolumeServer.Query:input_type -> volume_server_pb.QueryRequest
-	109, // 77: volume_server_pb.VolumeServer.VolumeNeedleStatus:input_type -> volume_server_pb.VolumeNeedleStatusRequest
-	111, // 78: volume_server_pb.VolumeServer.Ping:input_type -> volume_server_pb.PingRequest
-	4,   // 79: volume_server_pb.VolumeServer.BatchDelete:output_type -> volume_server_pb.BatchDeleteResponse
-	8,   // 80: volume_server_pb.VolumeServer.VacuumVolumeCheck:output_type -> volume_server_pb.VacuumVolumeCheckResponse
-	10,  // 81: volume_server_pb.VolumeServer.VacuumVolumeCompact:output_type -> volume_server_pb.VacuumVolumeCompactResponse
-	12,  // 82: volume_server_pb.VolumeServer.VacuumVolumeCommit:output_type -> volume_server_pb.VacuumVolumeCommitResponse
-	14,  // 83: volume_server_pb.VolumeServer.VacuumVolumeCleanup:output_type -> volume_server_pb.VacuumVolumeCleanupResponse
-	16,  // 84: volume_server_pb.VolumeServer.DeleteCollection:output_type -> volume_server_pb.DeleteCollectionResponse
-	18,  // 85: volume_server_pb.VolumeServer.AllocateVolume:output_type -> volume_server_pb.AllocateVolumeResponse
-	20,  // 86: volume_server_pb.VolumeServer.VolumeSyncStatus:output_type -> volume_server_pb.VolumeSyncStatusResponse
-	22,  // 87: volume_server_pb.VolumeServer.VolumeIncrementalCopy:output_type -> volume_server_pb.VolumeIncrementalCopyResponse
-	24,  // 88: volume_server_pb.VolumeServer.VolumeMount:output_type -> volume_server_pb.VolumeMountResponse
-	26,  // 89: volume_server_pb.VolumeServer.VolumeUnmount:output_type -> volume_server_pb.VolumeUnmountResponse
-	28,  // 90: volume_server_pb.VolumeServer.VolumeConsolidateIndex:output_type -> volume_server_pb.VolumeConsolidateIndexResponse
-	30,  // 91: volume_server_pb.VolumeServer.VolumeDelete:output_type -> volume_server_pb.VolumeDeleteResponse
-	32,  // 92: volume_server_pb.VolumeServer.VolumeMarkReadonly:output_type -> volume_server_pb.VolumeMarkReadonlyResponse
-	34,  // 93: volume_server_pb.VolumeServer.VolumeMarkWritable:output_type -> volume_server_pb.VolumeMarkWritableResponse
-	36,  // 94: volume_server_pb.VolumeServer.VolumeConfigure:output_type -> volume_server_pb.VolumeConfigureResponse
-	38,  // 95: volume_server_pb.VolumeServer.VolumeStatus:output_type -> volume_server_pb.VolumeStatusResponse
-	40,  // 96: volume_server_pb.VolumeServer.GetState:output_type -> volume_server_pb.GetStateResponse
-	42,  // 97: volume_server_pb.VolumeServer.SetState:output_type -> volume_server_pb.SetStateResponse
-	44,  // 98: volume_server_pb.VolumeServer.VolumeCopy:output_type -> volume_server_pb.VolumeCopyResponse
-	84,  // 99: volume_server_pb.VolumeServer.ReadVolumeFileStatus:output_type -> volume_server_pb.ReadVolumeFileStatusResponse
-	46,  // 100: volume_server_pb.VolumeServer.CopyFile:output_type -> volume_server_pb.CopyFileResponse
-	49,  // 101: volume_server_pb.VolumeServer.ReceiveFile:output_type -> volume_server_pb.ReceiveFileResponse
-	51,  // 102: volume_server_pb.VolumeServer.ReadNeedleBlob:output_type -> volume_server_pb.ReadNeedleBlobResponse
-	53,  // 103: volume_server_pb.VolumeServer.ReadNeedleMeta:output_type -> volume_server_pb.ReadNeedleMetaResponse
-	55,  // 104: volume_server_pb.VolumeServer.WriteNeedleBlob:output_type -> volume_server_pb.WriteNeedleBlobResponse
-	57,  // 105: volume_server_pb.VolumeServer.ReadAllNeedles:output_type -> volume_server_pb.ReadAllNeedlesResponse
-	59,  // 106: volume_server_pb.VolumeServer.VolumeTailSender:output_type -> volume_server_pb.VolumeTailSenderResponse
-	61,  // 107: volume_server_pb.VolumeServer.VolumeTailReceiver:output_type -> volume_server_pb.VolumeTailReceiverResponse
-	63,  // 108: volume_server_pb.VolumeServer.VolumeEcShardsGenerate:output_type -> volume_server_pb.VolumeEcShardsGenerateResponse
-	65,  // 109: volume_server_pb.VolumeServer.VolumeEcShardsRebuild:output_type -> volume_server_pb.VolumeEcShardsRebuildResponse
-	67,  // 110: volume_server_pb.VolumeServer.VolumeEcShardsCopy:output_type -> volume_server_pb.VolumeEcShardsCopyResponse
-	69,  // 111: volume_server_pb.VolumeServer.VolumeEcShardsDelete:output_type -> volume_server_pb.VolumeEcShardsDeleteResponse
-	71,  // 112: volume_server_pb.VolumeServer.VolumeEcShardsMount:output_type -> volume_server_pb.VolumeEcShardsMountResponse
-	73,  // 113: volume_server_pb.VolumeServer.VolumeEcShardsUnmount:output_type -> volume_server_pb.VolumeEcShardsUnmountResponse
-	75,  // 114: volume_server_pb.VolumeServer.VolumeEcShardRead:output_type -> volume_server_pb.VolumeEcShardReadResponse
-	77,  // 115: volume_server_pb.VolumeServer.VolumeEcBlobDelete:output_type -> volume_server_pb.VolumeEcBlobDeleteResponse
-	79,  // 116: volume_server_pb.VolumeServer.VolumeEcShardsToVolume:output_type -> volume_server_pb.VolumeEcShardsToVolumeResponse
-	81,  // 117: volume_server_pb.VolumeServer.VolumeEcShardsInfo:output_type -> volume_server_pb.VolumeEcShardsInfoResponse
-	94,  // 118: volume_server_pb.VolumeServer.VolumeTierMoveDatToRemote:output_type -> volume_server_pb.VolumeTierMoveDatToRemoteResponse
-	96,  // 119: volume_server_pb.VolumeServer.VolumeTierMoveDatFromRemote:output_type -> volume_server_pb.VolumeTierMoveDatFromRemoteResponse
-	98,  // 120: volume_server_pb.VolumeServer.VolumeServerStatus:output_type -> volume_server_pb.VolumeServerStatusResponse
-	100, // 121: volume_server_pb.VolumeServer.VolumeServerLeave:output_type -> volume_server_pb.VolumeServerLeaveResponse
-	102, // 122: volume_server_pb.VolumeServer.FetchAndWriteNeedle:output_type -> volume_server_pb.FetchAndWriteNeedleResponse
-	104, // 123: volume_server_pb.VolumeServer.ScrubVolume:output_type -> volume_server_pb.ScrubVolumeResponse
-	106, // 124: volume_server_pb.VolumeServer.ScrubEcVolume:output_type -> volume_server_pb.ScrubEcVolumeResponse
-	108, // 125: volume_server_pb.VolumeServer.Query:output_type -> volume_server_pb.QueriedStripe
-	110, // 126: volume_server_pb.VolumeServer.VolumeNeedleStatus:output_type -> volume_server_pb.VolumeNeedleStatusResponse
-	112, // 127: volume_server_pb.VolumeServer.Ping:output_type -> volume_server_pb.PingResponse
-	79,  // [79:128] is the sub-list for method output_type
-	30,  // [30:79] is the sub-list for method input_type
-	30,  // [30:30] is the sub-list for extension type_name
-	30,  // [30:30] is the sub-list for extension extendee
-	0,   // [0:30] is the sub-list for field type_name
+	89,  // 6: volume_server_pb.VolumeEcShardsInfoResponse.ec_shard_config:type_name -> volume_server_pb.EcShardConfig
+	88,  // 7: volume_server_pb.ReadVolumeFileStatusResponse.volume_info:type_name -> volume_server_pb.VolumeInfo
+	87,  // 8: volume_server_pb.VolumeInfo.files:type_name -> volume_server_pb.RemoteFile
+	89,  // 9: volume_server_pb.VolumeInfo.ec_shard_config:type_name -> volume_server_pb.EcShardConfig
+	0,   // 10: volume_server_pb.EcBitrotProtection.algorithm:type_name -> volume_server_pb.ChecksumAlgorithm
+	89,  // 11: volume_server_pb.EcBitrotProtection.ec_shard_config:type_name -> volume_server_pb.EcShardConfig
+	91,  // 12: volume_server_pb.EcBitrotProtection.shards:type_name -> volume_server_pb.EcShardChecksums
+	87,  // 13: volume_server_pb.OldVersionVolumeInfo.files:type_name -> volume_server_pb.RemoteFile
+	85,  // 14: volume_server_pb.VolumeServerStatusResponse.disk_statuses:type_name -> volume_server_pb.DiskStatus
+	86,  // 15: volume_server_pb.VolumeServerStatusResponse.memory_status:type_name -> volume_server_pb.MemStatus
+	2,   // 16: volume_server_pb.VolumeServerStatusResponse.state:type_name -> volume_server_pb.VolumeServerState
+	113, // 17: volume_server_pb.FetchAndWriteNeedleRequest.replicas:type_name -> volume_server_pb.FetchAndWriteNeedleRequest.Replica
+	122, // 18: volume_server_pb.FetchAndWriteNeedleRequest.remote_conf:type_name -> remote_pb.RemoteConf
+	123, // 19: volume_server_pb.FetchAndWriteNeedleRequest.remote_location:type_name -> remote_pb.RemoteStorageLocation
+	1,   // 20: volume_server_pb.ScrubVolumeRequest.mode:type_name -> volume_server_pb.VolumeScrubMode
+	1,   // 21: volume_server_pb.ScrubEcVolumeRequest.mode:type_name -> volume_server_pb.VolumeScrubMode
+	82,  // 22: volume_server_pb.ScrubEcVolumeResponse.broken_shard_infos:type_name -> volume_server_pb.EcShardInfo
+	114, // 23: volume_server_pb.QueryRequest.filter:type_name -> volume_server_pb.QueryRequest.Filter
+	115, // 24: volume_server_pb.QueryRequest.input_serialization:type_name -> volume_server_pb.QueryRequest.InputSerialization
+	116, // 25: volume_server_pb.QueryRequest.output_serialization:type_name -> volume_server_pb.QueryRequest.OutputSerialization
+	117, // 26: volume_server_pb.QueryRequest.InputSerialization.csv_input:type_name -> volume_server_pb.QueryRequest.InputSerialization.CSVInput
+	118, // 27: volume_server_pb.QueryRequest.InputSerialization.json_input:type_name -> volume_server_pb.QueryRequest.InputSerialization.JSONInput
+	119, // 28: volume_server_pb.QueryRequest.InputSerialization.parquet_input:type_name -> volume_server_pb.QueryRequest.InputSerialization.ParquetInput
+	120, // 29: volume_server_pb.QueryRequest.OutputSerialization.csv_output:type_name -> volume_server_pb.QueryRequest.OutputSerialization.CSVOutput
+	121, // 30: volume_server_pb.QueryRequest.OutputSerialization.json_output:type_name -> volume_server_pb.QueryRequest.OutputSerialization.JSONOutput
+	3,   // 31: volume_server_pb.VolumeServer.BatchDelete:input_type -> volume_server_pb.BatchDeleteRequest
+	7,   // 32: volume_server_pb.VolumeServer.VacuumVolumeCheck:input_type -> volume_server_pb.VacuumVolumeCheckRequest
+	9,   // 33: volume_server_pb.VolumeServer.VacuumVolumeCompact:input_type -> volume_server_pb.VacuumVolumeCompactRequest
+	11,  // 34: volume_server_pb.VolumeServer.VacuumVolumeCommit:input_type -> volume_server_pb.VacuumVolumeCommitRequest
+	13,  // 35: volume_server_pb.VolumeServer.VacuumVolumeCleanup:input_type -> volume_server_pb.VacuumVolumeCleanupRequest
+	15,  // 36: volume_server_pb.VolumeServer.DeleteCollection:input_type -> volume_server_pb.DeleteCollectionRequest
+	17,  // 37: volume_server_pb.VolumeServer.AllocateVolume:input_type -> volume_server_pb.AllocateVolumeRequest
+	19,  // 38: volume_server_pb.VolumeServer.VolumeSyncStatus:input_type -> volume_server_pb.VolumeSyncStatusRequest
+	21,  // 39: volume_server_pb.VolumeServer.VolumeIncrementalCopy:input_type -> volume_server_pb.VolumeIncrementalCopyRequest
+	23,  // 40: volume_server_pb.VolumeServer.VolumeMount:input_type -> volume_server_pb.VolumeMountRequest
+	25,  // 41: volume_server_pb.VolumeServer.VolumeUnmount:input_type -> volume_server_pb.VolumeUnmountRequest
+	27,  // 42: volume_server_pb.VolumeServer.VolumeConsolidateIndex:input_type -> volume_server_pb.VolumeConsolidateIndexRequest
+	29,  // 43: volume_server_pb.VolumeServer.VolumeDelete:input_type -> volume_server_pb.VolumeDeleteRequest
+	31,  // 44: volume_server_pb.VolumeServer.VolumeMarkReadonly:input_type -> volume_server_pb.VolumeMarkReadonlyRequest
+	33,  // 45: volume_server_pb.VolumeServer.VolumeMarkWritable:input_type -> volume_server_pb.VolumeMarkWritableRequest
+	35,  // 46: volume_server_pb.VolumeServer.VolumeConfigure:input_type -> volume_server_pb.VolumeConfigureRequest
+	37,  // 47: volume_server_pb.VolumeServer.VolumeStatus:input_type -> volume_server_pb.VolumeStatusRequest
+	39,  // 48: volume_server_pb.VolumeServer.GetState:input_type -> volume_server_pb.GetStateRequest
+	41,  // 49: volume_server_pb.VolumeServer.SetState:input_type -> volume_server_pb.SetStateRequest
+	43,  // 50: volume_server_pb.VolumeServer.VolumeCopy:input_type -> volume_server_pb.VolumeCopyRequest
+	83,  // 51: volume_server_pb.VolumeServer.ReadVolumeFileStatus:input_type -> volume_server_pb.ReadVolumeFileStatusRequest
+	45,  // 52: volume_server_pb.VolumeServer.CopyFile:input_type -> volume_server_pb.CopyFileRequest
+	47,  // 53: volume_server_pb.VolumeServer.ReceiveFile:input_type -> volume_server_pb.ReceiveFileRequest
+	50,  // 54: volume_server_pb.VolumeServer.ReadNeedleBlob:input_type -> volume_server_pb.ReadNeedleBlobRequest
+	52,  // 55: volume_server_pb.VolumeServer.ReadNeedleMeta:input_type -> volume_server_pb.ReadNeedleMetaRequest
+	54,  // 56: volume_server_pb.VolumeServer.WriteNeedleBlob:input_type -> volume_server_pb.WriteNeedleBlobRequest
+	56,  // 57: volume_server_pb.VolumeServer.ReadAllNeedles:input_type -> volume_server_pb.ReadAllNeedlesRequest
+	58,  // 58: volume_server_pb.VolumeServer.VolumeTailSender:input_type -> volume_server_pb.VolumeTailSenderRequest
+	60,  // 59: volume_server_pb.VolumeServer.VolumeTailReceiver:input_type -> volume_server_pb.VolumeTailReceiverRequest
+	62,  // 60: volume_server_pb.VolumeServer.VolumeEcShardsGenerate:input_type -> volume_server_pb.VolumeEcShardsGenerateRequest
+	64,  // 61: volume_server_pb.VolumeServer.VolumeEcShardsRebuild:input_type -> volume_server_pb.VolumeEcShardsRebuildRequest
+	66,  // 62: volume_server_pb.VolumeServer.VolumeEcShardsCopy:input_type -> volume_server_pb.VolumeEcShardsCopyRequest
+	68,  // 63: volume_server_pb.VolumeServer.VolumeEcShardsDelete:input_type -> volume_server_pb.VolumeEcShardsDeleteRequest
+	70,  // 64: volume_server_pb.VolumeServer.VolumeEcShardsMount:input_type -> volume_server_pb.VolumeEcShardsMountRequest
+	72,  // 65: volume_server_pb.VolumeServer.VolumeEcShardsUnmount:input_type -> volume_server_pb.VolumeEcShardsUnmountRequest
+	74,  // 66: volume_server_pb.VolumeServer.VolumeEcShardRead:input_type -> volume_server_pb.VolumeEcShardReadRequest
+	76,  // 67: volume_server_pb.VolumeServer.VolumeEcBlobDelete:input_type -> volume_server_pb.VolumeEcBlobDeleteRequest
+	78,  // 68: volume_server_pb.VolumeServer.VolumeEcShardsToVolume:input_type -> volume_server_pb.VolumeEcShardsToVolumeRequest
+	80,  // 69: volume_server_pb.VolumeServer.VolumeEcShardsInfo:input_type -> volume_server_pb.VolumeEcShardsInfoRequest
+	93,  // 70: volume_server_pb.VolumeServer.VolumeTierMoveDatToRemote:input_type -> volume_server_pb.VolumeTierMoveDatToRemoteRequest
+	95,  // 71: volume_server_pb.VolumeServer.VolumeTierMoveDatFromRemote:input_type -> volume_server_pb.VolumeTierMoveDatFromRemoteRequest
+	97,  // 72: volume_server_pb.VolumeServer.VolumeServerStatus:input_type -> volume_server_pb.VolumeServerStatusRequest
+	99,  // 73: volume_server_pb.VolumeServer.VolumeServerLeave:input_type -> volume_server_pb.VolumeServerLeaveRequest
+	101, // 74: volume_server_pb.VolumeServer.FetchAndWriteNeedle:input_type -> volume_server_pb.FetchAndWriteNeedleRequest
+	103, // 75: volume_server_pb.VolumeServer.ScrubVolume:input_type -> volume_server_pb.ScrubVolumeRequest
+	105, // 76: volume_server_pb.VolumeServer.ScrubEcVolume:input_type -> volume_server_pb.ScrubEcVolumeRequest
+	107, // 77: volume_server_pb.VolumeServer.Query:input_type -> volume_server_pb.QueryRequest
+	109, // 78: volume_server_pb.VolumeServer.VolumeNeedleStatus:input_type -> volume_server_pb.VolumeNeedleStatusRequest
+	111, // 79: volume_server_pb.VolumeServer.Ping:input_type -> volume_server_pb.PingRequest
+	4,   // 80: volume_server_pb.VolumeServer.BatchDelete:output_type -> volume_server_pb.BatchDeleteResponse
+	8,   // 81: volume_server_pb.VolumeServer.VacuumVolumeCheck:output_type -> volume_server_pb.VacuumVolumeCheckResponse
+	10,  // 82: volume_server_pb.VolumeServer.VacuumVolumeCompact:output_type -> volume_server_pb.VacuumVolumeCompactResponse
+	12,  // 83: volume_server_pb.VolumeServer.VacuumVolumeCommit:output_type -> volume_server_pb.VacuumVolumeCommitResponse
+	14,  // 84: volume_server_pb.VolumeServer.VacuumVolumeCleanup:output_type -> volume_server_pb.VacuumVolumeCleanupResponse
+	16,  // 85: volume_server_pb.VolumeServer.DeleteCollection:output_type -> volume_server_pb.DeleteCollectionResponse
+	18,  // 86: volume_server_pb.VolumeServer.AllocateVolume:output_type -> volume_server_pb.AllocateVolumeResponse
+	20,  // 87: volume_server_pb.VolumeServer.VolumeSyncStatus:output_type -> volume_server_pb.VolumeSyncStatusResponse
+	22,  // 88: volume_server_pb.VolumeServer.VolumeIncrementalCopy:output_type -> volume_server_pb.VolumeIncrementalCopyResponse
+	24,  // 89: volume_server_pb.VolumeServer.VolumeMount:output_type -> volume_server_pb.VolumeMountResponse
+	26,  // 90: volume_server_pb.VolumeServer.VolumeUnmount:output_type -> volume_server_pb.VolumeUnmountResponse
+	28,  // 91: volume_server_pb.VolumeServer.VolumeConsolidateIndex:output_type -> volume_server_pb.VolumeConsolidateIndexResponse
+	30,  // 92: volume_server_pb.VolumeServer.VolumeDelete:output_type -> volume_server_pb.VolumeDeleteResponse
+	32,  // 93: volume_server_pb.VolumeServer.VolumeMarkReadonly:output_type -> volume_server_pb.VolumeMarkReadonlyResponse
+	34,  // 94: volume_server_pb.VolumeServer.VolumeMarkWritable:output_type -> volume_server_pb.VolumeMarkWritableResponse
+	36,  // 95: volume_server_pb.VolumeServer.VolumeConfigure:output_type -> volume_server_pb.VolumeConfigureResponse
+	38,  // 96: volume_server_pb.VolumeServer.VolumeStatus:output_type -> volume_server_pb.VolumeStatusResponse
+	40,  // 97: volume_server_pb.VolumeServer.GetState:output_type -> volume_server_pb.GetStateResponse
+	42,  // 98: volume_server_pb.VolumeServer.SetState:output_type -> volume_server_pb.SetStateResponse
+	44,  // 99: volume_server_pb.VolumeServer.VolumeCopy:output_type -> volume_server_pb.VolumeCopyResponse
+	84,  // 100: volume_server_pb.VolumeServer.ReadVolumeFileStatus:output_type -> volume_server_pb.ReadVolumeFileStatusResponse
+	46,  // 101: volume_server_pb.VolumeServer.CopyFile:output_type -> volume_server_pb.CopyFileResponse
+	49,  // 102: volume_server_pb.VolumeServer.ReceiveFile:output_type -> volume_server_pb.ReceiveFileResponse
+	51,  // 103: volume_server_pb.VolumeServer.ReadNeedleBlob:output_type -> volume_server_pb.ReadNeedleBlobResponse
+	53,  // 104: volume_server_pb.VolumeServer.ReadNeedleMeta:output_type -> volume_server_pb.ReadNeedleMetaResponse
+	55,  // 105: volume_server_pb.VolumeServer.WriteNeedleBlob:output_type -> volume_server_pb.WriteNeedleBlobResponse
+	57,  // 106: volume_server_pb.VolumeServer.ReadAllNeedles:output_type -> volume_server_pb.ReadAllNeedlesResponse
+	59,  // 107: volume_server_pb.VolumeServer.VolumeTailSender:output_type -> volume_server_pb.VolumeTailSenderResponse
+	61,  // 108: volume_server_pb.VolumeServer.VolumeTailReceiver:output_type -> volume_server_pb.VolumeTailReceiverResponse
+	63,  // 109: volume_server_pb.VolumeServer.VolumeEcShardsGenerate:output_type -> volume_server_pb.VolumeEcShardsGenerateResponse
+	65,  // 110: volume_server_pb.VolumeServer.VolumeEcShardsRebuild:output_type -> volume_server_pb.VolumeEcShardsRebuildResponse
+	67,  // 111: volume_server_pb.VolumeServer.VolumeEcShardsCopy:output_type -> volume_server_pb.VolumeEcShardsCopyResponse
+	69,  // 112: volume_server_pb.VolumeServer.VolumeEcShardsDelete:output_type -> volume_server_pb.VolumeEcShardsDeleteResponse
+	71,  // 113: volume_server_pb.VolumeServer.VolumeEcShardsMount:output_type -> volume_server_pb.VolumeEcShardsMountResponse
+	73,  // 114: volume_server_pb.VolumeServer.VolumeEcShardsUnmount:output_type -> volume_server_pb.VolumeEcShardsUnmountResponse
+	75,  // 115: volume_server_pb.VolumeServer.VolumeEcShardRead:output_type -> volume_server_pb.VolumeEcShardReadResponse
+	77,  // 116: volume_server_pb.VolumeServer.VolumeEcBlobDelete:output_type -> volume_server_pb.VolumeEcBlobDeleteResponse
+	79,  // 117: volume_server_pb.VolumeServer.VolumeEcShardsToVolume:output_type -> volume_server_pb.VolumeEcShardsToVolumeResponse
+	81,  // 118: volume_server_pb.VolumeServer.VolumeEcShardsInfo:output_type -> volume_server_pb.VolumeEcShardsInfoResponse
+	94,  // 119: volume_server_pb.VolumeServer.VolumeTierMoveDatToRemote:output_type -> volume_server_pb.VolumeTierMoveDatToRemoteResponse
+	96,  // 120: volume_server_pb.VolumeServer.VolumeTierMoveDatFromRemote:output_type -> volume_server_pb.VolumeTierMoveDatFromRemoteResponse
+	98,  // 121: volume_server_pb.VolumeServer.VolumeServerStatus:output_type -> volume_server_pb.VolumeServerStatusResponse
+	100, // 122: volume_server_pb.VolumeServer.VolumeServerLeave:output_type -> volume_server_pb.VolumeServerLeaveResponse
+	102, // 123: volume_server_pb.VolumeServer.FetchAndWriteNeedle:output_type -> volume_server_pb.FetchAndWriteNeedleResponse
+	104, // 124: volume_server_pb.VolumeServer.ScrubVolume:output_type -> volume_server_pb.ScrubVolumeResponse
+	106, // 125: volume_server_pb.VolumeServer.ScrubEcVolume:output_type -> volume_server_pb.ScrubEcVolumeResponse
+	108, // 126: volume_server_pb.VolumeServer.Query:output_type -> volume_server_pb.QueriedStripe
+	110, // 127: volume_server_pb.VolumeServer.VolumeNeedleStatus:output_type -> volume_server_pb.VolumeNeedleStatusResponse
+	112, // 128: volume_server_pb.VolumeServer.Ping:output_type -> volume_server_pb.PingResponse
+	80,  // [80:129] is the sub-list for method output_type
+	31,  // [31:80] is the sub-list for method input_type
+	31,  // [31:31] is the sub-list for extension type_name
+	31,  // [31:31] is the sub-list for extension extendee
+	0,   // [0:31] is the sub-list for field type_name
 }
 
 func init() { file_volume_server_proto_init() }
@@ -8058,6 +8182,7 @@ func file_volume_server_proto_init() {
 	if File_volume_server_proto != nil {
 		return
 	}
+	file_volume_server_proto_msgTypes[21].OneofWrappers = []any{}
 	file_volume_server_proto_msgTypes[45].OneofWrappers = []any{
 		(*ReceiveFileRequest_Info)(nil),
 		(*ReceiveFileRequest_FileContent)(nil),
diff --git a/weed/pb/volume_server_pb/volume_server_grpc.pb.go b/weed/pb/volume_server_pb/volume_server_grpc.pb.go
index 692b9702c2..2104ed8ff7 100644
--- a/weed/pb/volume_server_pb/volume_server_grpc.pb.go
+++ b/weed/pb/volume_server_pb/volume_server_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             v7.35.0
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             v3.21.12
 // source: volume_server.proto
 
 package volume_server_pb
@@ -74,7 +74,7 @@ const (
 //
 // For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
 type VolumeServerClient interface {
-	// Experts only: takes multiple fid parameters. This function does not propagate deletes to replicas.
+	//Experts only: takes multiple fid parameters. This function does not propagate deletes to replicas.
 	BatchDelete(ctx context.Context, in *BatchDeleteRequest, opts ...grpc.CallOption) (*BatchDeleteResponse, error)
 	VacuumVolumeCheck(ctx context.Context, in *VacuumVolumeCheckRequest, opts ...grpc.CallOption) (*VacuumVolumeCheckResponse, error)
 	VacuumVolumeCompact(ctx context.Context, in *VacuumVolumeCompactRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[VacuumVolumeCompactResponse], error)
@@ -727,7 +727,7 @@ func (c *volumeServerClient) Ping(ctx context.Context, in *PingRequest, opts ...
 // All implementations must embed UnimplementedVolumeServerServer
 // for forward compatibility.
 type VolumeServerServer interface {
-	// Experts only: takes multiple fid parameters. This function does not propagate deletes to replicas.
+	//Experts only: takes multiple fid parameters. This function does not propagate deletes to replicas.
 	BatchDelete(context.Context, *BatchDeleteRequest) (*BatchDeleteResponse, error)
 	VacuumVolumeCheck(context.Context, *VacuumVolumeCheckRequest) (*VacuumVolumeCheckResponse, error)
 	VacuumVolumeCompact(*VacuumVolumeCompactRequest, grpc.ServerStreamingServer[VacuumVolumeCompactResponse]) error
@@ -794,151 +794,151 @@ type VolumeServerServer interface {
 type UnimplementedVolumeServerServer struct{}
 
 func (UnimplementedVolumeServerServer) BatchDelete(context.Context, *BatchDeleteRequest) (*BatchDeleteResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method BatchDelete not implemented")
+	return nil, status.Error(codes.Unimplemented, "method BatchDelete not implemented")
 }
 func (UnimplementedVolumeServerServer) VacuumVolumeCheck(context.Context, *VacuumVolumeCheckRequest) (*VacuumVolumeCheckResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VacuumVolumeCheck not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VacuumVolumeCheck not implemented")
 }
 func (UnimplementedVolumeServerServer) VacuumVolumeCompact(*VacuumVolumeCompactRequest, grpc.ServerStreamingServer[VacuumVolumeCompactResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method VacuumVolumeCompact not implemented")
+	return status.Error(codes.Unimplemented, "method VacuumVolumeCompact not implemented")
 }
 func (UnimplementedVolumeServerServer) VacuumVolumeCommit(context.Context, *VacuumVolumeCommitRequest) (*VacuumVolumeCommitResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VacuumVolumeCommit not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VacuumVolumeCommit not implemented")
 }
 func (UnimplementedVolumeServerServer) VacuumVolumeCleanup(context.Context, *VacuumVolumeCleanupRequest) (*VacuumVolumeCleanupResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VacuumVolumeCleanup not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VacuumVolumeCleanup not implemented")
 }
 func (UnimplementedVolumeServerServer) DeleteCollection(context.Context, *DeleteCollectionRequest) (*DeleteCollectionResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method DeleteCollection not implemented")
+	return nil, status.Error(codes.Unimplemented, "method DeleteCollection not implemented")
 }
 func (UnimplementedVolumeServerServer) AllocateVolume(context.Context, *AllocateVolumeRequest) (*AllocateVolumeResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method AllocateVolume not implemented")
+	return nil, status.Error(codes.Unimplemented, "method AllocateVolume not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeSyncStatus(context.Context, *VolumeSyncStatusRequest) (*VolumeSyncStatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeSyncStatus not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeSyncStatus not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeIncrementalCopy(*VolumeIncrementalCopyRequest, grpc.ServerStreamingServer[VolumeIncrementalCopyResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method VolumeIncrementalCopy not implemented")
+	return status.Error(codes.Unimplemented, "method VolumeIncrementalCopy not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeMount(context.Context, *VolumeMountRequest) (*VolumeMountResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeMount not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeMount not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeUnmount(context.Context, *VolumeUnmountRequest) (*VolumeUnmountResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeUnmount not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeUnmount not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeConsolidateIndex(context.Context, *VolumeConsolidateIndexRequest) (*VolumeConsolidateIndexResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeConsolidateIndex not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeConsolidateIndex not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeDelete(context.Context, *VolumeDeleteRequest) (*VolumeDeleteResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeDelete not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeDelete not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeMarkReadonly(context.Context, *VolumeMarkReadonlyRequest) (*VolumeMarkReadonlyResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeMarkReadonly not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeMarkReadonly not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeMarkWritable(context.Context, *VolumeMarkWritableRequest) (*VolumeMarkWritableResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeMarkWritable not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeMarkWritable not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeConfigure(context.Context, *VolumeConfigureRequest) (*VolumeConfigureResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeConfigure not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeConfigure not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeStatus(context.Context, *VolumeStatusRequest) (*VolumeStatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeStatus not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeStatus not implemented")
 }
 func (UnimplementedVolumeServerServer) GetState(context.Context, *GetStateRequest) (*GetStateResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetState not implemented")
+	return nil, status.Error(codes.Unimplemented, "method GetState not implemented")
 }
 func (UnimplementedVolumeServerServer) SetState(context.Context, *SetStateRequest) (*SetStateResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SetState not implemented")
+	return nil, status.Error(codes.Unimplemented, "method SetState not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeCopy(*VolumeCopyRequest, grpc.ServerStreamingServer[VolumeCopyResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method VolumeCopy not implemented")
+	return status.Error(codes.Unimplemented, "method VolumeCopy not implemented")
 }
 func (UnimplementedVolumeServerServer) ReadVolumeFileStatus(context.Context, *ReadVolumeFileStatusRequest) (*ReadVolumeFileStatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ReadVolumeFileStatus not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ReadVolumeFileStatus not implemented")
 }
 func (UnimplementedVolumeServerServer) CopyFile(*CopyFileRequest, grpc.ServerStreamingServer[CopyFileResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method CopyFile not implemented")
+	return status.Error(codes.Unimplemented, "method CopyFile not implemented")
 }
 func (UnimplementedVolumeServerServer) ReceiveFile(grpc.ClientStreamingServer[ReceiveFileRequest, ReceiveFileResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method ReceiveFile not implemented")
+	return status.Error(codes.Unimplemented, "method ReceiveFile not implemented")
 }
 func (UnimplementedVolumeServerServer) ReadNeedleBlob(context.Context, *ReadNeedleBlobRequest) (*ReadNeedleBlobResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ReadNeedleBlob not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ReadNeedleBlob not implemented")
 }
 func (UnimplementedVolumeServerServer) ReadNeedleMeta(context.Context, *ReadNeedleMetaRequest) (*ReadNeedleMetaResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ReadNeedleMeta not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ReadNeedleMeta not implemented")
 }
 func (UnimplementedVolumeServerServer) WriteNeedleBlob(context.Context, *WriteNeedleBlobRequest) (*WriteNeedleBlobResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method WriteNeedleBlob not implemented")
+	return nil, status.Error(codes.Unimplemented, "method WriteNeedleBlob not implemented")
 }
 func (UnimplementedVolumeServerServer) ReadAllNeedles(*ReadAllNeedlesRequest, grpc.ServerStreamingServer[ReadAllNeedlesResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method ReadAllNeedles not implemented")
+	return status.Error(codes.Unimplemented, "method ReadAllNeedles not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeTailSender(*VolumeTailSenderRequest, grpc.ServerStreamingServer[VolumeTailSenderResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method VolumeTailSender not implemented")
+	return status.Error(codes.Unimplemented, "method VolumeTailSender not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeTailReceiver(context.Context, *VolumeTailReceiverRequest) (*VolumeTailReceiverResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeTailReceiver not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeTailReceiver not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsGenerate(context.Context, *VolumeEcShardsGenerateRequest) (*VolumeEcShardsGenerateResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsGenerate not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsGenerate not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsRebuild(context.Context, *VolumeEcShardsRebuildRequest) (*VolumeEcShardsRebuildResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsRebuild not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsRebuild not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsCopy(context.Context, *VolumeEcShardsCopyRequest) (*VolumeEcShardsCopyResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsCopy not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsCopy not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsDelete(context.Context, *VolumeEcShardsDeleteRequest) (*VolumeEcShardsDeleteResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsDelete not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsDelete not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsMount(context.Context, *VolumeEcShardsMountRequest) (*VolumeEcShardsMountResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsMount not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsMount not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsUnmount(context.Context, *VolumeEcShardsUnmountRequest) (*VolumeEcShardsUnmountResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsUnmount not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsUnmount not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardRead(*VolumeEcShardReadRequest, grpc.ServerStreamingServer[VolumeEcShardReadResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method VolumeEcShardRead not implemented")
+	return status.Error(codes.Unimplemented, "method VolumeEcShardRead not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcBlobDelete(context.Context, *VolumeEcBlobDeleteRequest) (*VolumeEcBlobDeleteResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcBlobDelete not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcBlobDelete not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsToVolume(context.Context, *VolumeEcShardsToVolumeRequest) (*VolumeEcShardsToVolumeResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsToVolume not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsToVolume not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeEcShardsInfo(context.Context, *VolumeEcShardsInfoRequest) (*VolumeEcShardsInfoResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeEcShardsInfo not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeEcShardsInfo not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeTierMoveDatToRemote(*VolumeTierMoveDatToRemoteRequest, grpc.ServerStreamingServer[VolumeTierMoveDatToRemoteResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method VolumeTierMoveDatToRemote not implemented")
+	return status.Error(codes.Unimplemented, "method VolumeTierMoveDatToRemote not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeTierMoveDatFromRemote(*VolumeTierMoveDatFromRemoteRequest, grpc.ServerStreamingServer[VolumeTierMoveDatFromRemoteResponse]) error {
-	return status.Errorf(codes.Unimplemented, "method VolumeTierMoveDatFromRemote not implemented")
+	return status.Error(codes.Unimplemented, "method VolumeTierMoveDatFromRemote not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeServerStatus(context.Context, *VolumeServerStatusRequest) (*VolumeServerStatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeServerStatus not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeServerStatus not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeServerLeave(context.Context, *VolumeServerLeaveRequest) (*VolumeServerLeaveResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeServerLeave not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeServerLeave not implemented")
 }
 func (UnimplementedVolumeServerServer) FetchAndWriteNeedle(context.Context, *FetchAndWriteNeedleRequest) (*FetchAndWriteNeedleResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method FetchAndWriteNeedle not implemented")
+	return nil, status.Error(codes.Unimplemented, "method FetchAndWriteNeedle not implemented")
 }
 func (UnimplementedVolumeServerServer) ScrubVolume(context.Context, *ScrubVolumeRequest) (*ScrubVolumeResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ScrubVolume not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ScrubVolume not implemented")
 }
 func (UnimplementedVolumeServerServer) ScrubEcVolume(context.Context, *ScrubEcVolumeRequest) (*ScrubEcVolumeResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method ScrubEcVolume not implemented")
+	return nil, status.Error(codes.Unimplemented, "method ScrubEcVolume not implemented")
 }
 func (UnimplementedVolumeServerServer) Query(*QueryRequest, grpc.ServerStreamingServer[QueriedStripe]) error {
-	return status.Errorf(codes.Unimplemented, "method Query not implemented")
+	return status.Error(codes.Unimplemented, "method Query not implemented")
 }
 func (UnimplementedVolumeServerServer) VolumeNeedleStatus(context.Context, *VolumeNeedleStatusRequest) (*VolumeNeedleStatusResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method VolumeNeedleStatus not implemented")
+	return nil, status.Error(codes.Unimplemented, "method VolumeNeedleStatus not implemented")
 }
 func (UnimplementedVolumeServerServer) Ping(context.Context, *PingRequest) (*PingResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Ping not implemented")
+	return nil, status.Error(codes.Unimplemented, "method Ping not implemented")
 }
 func (UnimplementedVolumeServerServer) mustEmbedUnimplementedVolumeServerServer() {}
 func (UnimplementedVolumeServerServer) testEmbeddedByValue()                      {}
@@ -951,7 +951,7 @@ type UnsafeVolumeServerServer interface {
 }
 
 func RegisterVolumeServerServer(s grpc.ServiceRegistrar, srv VolumeServerServer) {
-	// If the following call pancis, it indicates UnimplementedVolumeServerServer was
+	// If the following call panics, it indicates UnimplementedVolumeServerServer was
 	// embedded by pointer and is nil.  This will cause panics if an
 	// unimplemented method is ever invoked, so we test this at initialization
 	// time to prevent it from happening at runtime later due to I/O.
diff --git a/weed/pb/worker.proto b/weed/pb/worker.proto
index 00d4cb288b..822f89269c 100644
--- a/weed/pb/worker.proto
+++ b/weed/pb/worker.proto
@@ -220,6 +220,7 @@ message BalanceTaskParams {
   int32 timeout_seconds = 2;              // Operation timeout
   int32 max_concurrent_moves = 3;         // Max concurrent moves in a batch job (0 = default 5)
   repeated BalanceMoveSpec moves = 4;     // Batch: multiple volume moves in one job
+  int64 io_byte_per_second = 5;           // limit each move's copy rate; 0 falls back to the volume server's maintenance rate
 }
 
 // ReplicationTaskParams for adding replicas
@@ -323,7 +324,10 @@ message TaskLogEntry {
 
 // MaintenanceConfig holds configuration for the maintenance system
 message MaintenanceConfig {
-  bool enabled = 1;
+  // optional so a file that predates presence tracking (where an operator's
+  // explicit false and the field's absence are indistinguishable on the wire)
+  // can be told apart from one that explicitly persists the toggle
+  optional bool enabled = 1;
   int32 scan_interval_seconds = 2;    // How often to scan for maintenance needs
   int32 worker_timeout_seconds = 3;   // Worker heartbeat timeout
   int32 task_timeout_seconds = 4;     // Individual task timeout
@@ -376,12 +380,15 @@ message ErasureCodingTaskConfig {
   string collection_filter = 4;     // Only process volumes from specific collections
   repeated string preferred_tags = 5; // Disk tags to prioritize for EC shard placement
   string replica_placement = 6;     // EC shard replica placement (e.g. "020"); empty falls back to master default replication
+  bool strict_placement = 7;        // fail planning instead of relaxing placement constraints
+  int32 free_slots_deadband = 8;    // Place free-volume-slot deadband; |ΔfreeSlots| ≤ M×dataShards ranks by liveShards; 0 = strict
 }
 
 // BalanceTaskConfig contains balance-specific configuration
 message BalanceTaskConfig {
   double imbalance_threshold = 1;   // Threshold for triggering rebalancing (0.0-1.0)
   int32 min_server_count = 2;       // Minimum number of servers required for balancing
+  int64 io_byte_per_second = 3;     // limit each move's copy rate; 0 falls back to the volume server's maintenance rate
 }
 
 // ReplicationTaskConfig contains replication-specific configuration
@@ -395,6 +402,11 @@ message EcBalanceTaskParams {
   int32 max_parallelization = 2;           // Max parallel shard moves within a batch
   int32 timeout_seconds = 3;               // Operation timeout per move
   repeated EcShardMoveSpec moves = 4;      // Batch: multiple shard moves in one job
+  // For a dedup move, the node that keeps the shard. The worker confirms this
+  // node really holds it before deleting the copy, so a topology entry naming a
+  // location that holds nothing cannot cause the last copy to be removed.
+  string dedup_keep_node = 5;
+  int64 io_byte_per_second = 6;            // limit each shard copy's rate; 0 falls back to the volume server's maintenance rate
 }
 
 // EcShardMoveSpec describes a single EC shard move within a batch
@@ -416,6 +428,7 @@ message EcBalanceTaskConfig {
   string disk_type = 4;                   // Disk type filter
   repeated string preferred_tags = 5;     // Preferred disk tags for placement
   string replica_placement = 6;           // EC shard replica placement (e.g. "020"); empty falls back to master default replication
+  int64 io_byte_per_second = 7;           // limit each shard copy's rate; 0 falls back to the volume server's maintenance rate
 }
 
 // ========== Task Persistence Messages ==========
diff --git a/weed/pb/worker_pb/worker.pb.go b/weed/pb/worker_pb/worker.pb.go
index d3305a474c..e2a81e3f5f 100644
--- a/weed/pb/worker_pb/worker.pb.go
+++ b/weed/pb/worker_pb/worker.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.6
-// 	protoc        v6.33.4
+// 	protoc        v7.35.0
 // source: worker.proto
 
 package worker_pb
@@ -1684,6 +1684,7 @@ type BalanceTaskParams struct {
 	TimeoutSeconds     int32                  `protobuf:"varint,2,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`               // Operation timeout
 	MaxConcurrentMoves int32                  `protobuf:"varint,3,opt,name=max_concurrent_moves,json=maxConcurrentMoves,proto3" json:"max_concurrent_moves,omitempty"` // Max concurrent moves in a batch job (0 = default 5)
 	Moves              []*BalanceMoveSpec     `protobuf:"bytes,4,rep,name=moves,proto3" json:"moves,omitempty"`                                                        // Batch: multiple volume moves in one job
+	IoBytePerSecond    int64                  `protobuf:"varint,5,opt,name=io_byte_per_second,json=ioBytePerSecond,proto3" json:"io_byte_per_second,omitempty"`        // limit each move's copy rate; 0 falls back to the volume server's maintenance rate
 	unknownFields      protoimpl.UnknownFields
 	sizeCache          protoimpl.SizeCache
 }
@@ -1746,6 +1747,13 @@ func (x *BalanceTaskParams) GetMoves() []*BalanceMoveSpec {
 	return nil
 }
 
+func (x *BalanceTaskParams) GetIoBytePerSecond() int64 {
+	if x != nil {
+		return x.IoBytePerSecond
+	}
+	return 0
+}
+
 // ReplicationTaskParams for adding replicas
 type ReplicationTaskParams struct {
 	state             protoimpl.MessageState `protogen:"open.v1"`
@@ -2558,16 +2566,19 @@ func (x *TaskLogEntry) GetStatus() string {
 
 // MaintenanceConfig holds configuration for the maintenance system
 type MaintenanceConfig struct {
-	state                  protoimpl.MessageState `protogen:"open.v1"`
-	Enabled                bool                   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
-	ScanIntervalSeconds    int32                  `protobuf:"varint,2,opt,name=scan_interval_seconds,json=scanIntervalSeconds,proto3" json:"scan_interval_seconds,omitempty"`          // How often to scan for maintenance needs
-	WorkerTimeoutSeconds   int32                  `protobuf:"varint,3,opt,name=worker_timeout_seconds,json=workerTimeoutSeconds,proto3" json:"worker_timeout_seconds,omitempty"`       // Worker heartbeat timeout
-	TaskTimeoutSeconds     int32                  `protobuf:"varint,4,opt,name=task_timeout_seconds,json=taskTimeoutSeconds,proto3" json:"task_timeout_seconds,omitempty"`             // Individual task timeout
-	RetryDelaySeconds      int32                  `protobuf:"varint,5,opt,name=retry_delay_seconds,json=retryDelaySeconds,proto3" json:"retry_delay_seconds,omitempty"`                // Delay between retries
-	MaxRetries             int32                  `protobuf:"varint,6,opt,name=max_retries,json=maxRetries,proto3" json:"max_retries,omitempty"`                                       // Default max retries for tasks
-	CleanupIntervalSeconds int32                  `protobuf:"varint,7,opt,name=cleanup_interval_seconds,json=cleanupIntervalSeconds,proto3" json:"cleanup_interval_seconds,omitempty"` // How often to clean up old tasks
-	TaskRetentionSeconds   int32                  `protobuf:"varint,8,opt,name=task_retention_seconds,json=taskRetentionSeconds,proto3" json:"task_retention_seconds,omitempty"`       // How long to keep completed/failed tasks
-	Policy                 *MaintenancePolicy     `protobuf:"bytes,9,opt,name=policy,proto3" json:"policy,omitempty"`
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// optional so a file that predates presence tracking (where an operator's
+	// explicit false and the field's absence are indistinguishable on the wire)
+	// can be told apart from one that explicitly persists the toggle
+	Enabled                *bool              `protobuf:"varint,1,opt,name=enabled,proto3,oneof" json:"enabled,omitempty"`
+	ScanIntervalSeconds    int32              `protobuf:"varint,2,opt,name=scan_interval_seconds,json=scanIntervalSeconds,proto3" json:"scan_interval_seconds,omitempty"`          // How often to scan for maintenance needs
+	WorkerTimeoutSeconds   int32              `protobuf:"varint,3,opt,name=worker_timeout_seconds,json=workerTimeoutSeconds,proto3" json:"worker_timeout_seconds,omitempty"`       // Worker heartbeat timeout
+	TaskTimeoutSeconds     int32              `protobuf:"varint,4,opt,name=task_timeout_seconds,json=taskTimeoutSeconds,proto3" json:"task_timeout_seconds,omitempty"`             // Individual task timeout
+	RetryDelaySeconds      int32              `protobuf:"varint,5,opt,name=retry_delay_seconds,json=retryDelaySeconds,proto3" json:"retry_delay_seconds,omitempty"`                // Delay between retries
+	MaxRetries             int32              `protobuf:"varint,6,opt,name=max_retries,json=maxRetries,proto3" json:"max_retries,omitempty"`                                       // Default max retries for tasks
+	CleanupIntervalSeconds int32              `protobuf:"varint,7,opt,name=cleanup_interval_seconds,json=cleanupIntervalSeconds,proto3" json:"cleanup_interval_seconds,omitempty"` // How often to clean up old tasks
+	TaskRetentionSeconds   int32              `protobuf:"varint,8,opt,name=task_retention_seconds,json=taskRetentionSeconds,proto3" json:"task_retention_seconds,omitempty"`       // How long to keep completed/failed tasks
+	Policy                 *MaintenancePolicy `protobuf:"bytes,9,opt,name=policy,proto3" json:"policy,omitempty"`
 	unknownFields          protoimpl.UnknownFields
 	sizeCache              protoimpl.SizeCache
 }
@@ -2603,8 +2614,8 @@ func (*MaintenanceConfig) Descriptor() ([]byte, []int) {
 }
 
 func (x *MaintenanceConfig) GetEnabled() bool {
-	if x != nil {
-		return x.Enabled
+	if x != nil && x.Enabled != nil {
+		return *x.Enabled
 	}
 	return false
 }
@@ -2962,15 +2973,17 @@ func (x *VacuumTaskConfig) GetMinIntervalSeconds() int32 {
 
 // ErasureCodingTaskConfig contains EC-specific configuration
 type ErasureCodingTaskConfig struct {
-	state            protoimpl.MessageState `protogen:"open.v1"`
-	FullnessRatio    float64                `protobuf:"fixed64,1,opt,name=fullness_ratio,json=fullnessRatio,proto3" json:"fullness_ratio,omitempty"`          // Minimum fullness ratio to trigger EC (0.0-1.0)
-	QuietForSeconds  int32                  `protobuf:"varint,2,opt,name=quiet_for_seconds,json=quietForSeconds,proto3" json:"quiet_for_seconds,omitempty"`   // Minimum quiet time before EC
-	MinVolumeSizeMb  int32                  `protobuf:"varint,3,opt,name=min_volume_size_mb,json=minVolumeSizeMb,proto3" json:"min_volume_size_mb,omitempty"` // Minimum volume size for EC
-	CollectionFilter string                 `protobuf:"bytes,4,opt,name=collection_filter,json=collectionFilter,proto3" json:"collection_filter,omitempty"`   // Only process volumes from specific collections
-	PreferredTags    []string               `protobuf:"bytes,5,rep,name=preferred_tags,json=preferredTags,proto3" json:"preferred_tags,omitempty"`            // Disk tags to prioritize for EC shard placement
-	ReplicaPlacement string                 `protobuf:"bytes,6,opt,name=replica_placement,json=replicaPlacement,proto3" json:"replica_placement,omitempty"`   // EC shard replica placement (e.g. "020"); empty falls back to master default replication
-	unknownFields    protoimpl.UnknownFields
-	sizeCache        protoimpl.SizeCache
+	state             protoimpl.MessageState `protogen:"open.v1"`
+	FullnessRatio     float64                `protobuf:"fixed64,1,opt,name=fullness_ratio,json=fullnessRatio,proto3" json:"fullness_ratio,omitempty"`              // Minimum fullness ratio to trigger EC (0.0-1.0)
+	QuietForSeconds   int32                  `protobuf:"varint,2,opt,name=quiet_for_seconds,json=quietForSeconds,proto3" json:"quiet_for_seconds,omitempty"`       // Minimum quiet time before EC
+	MinVolumeSizeMb   int32                  `protobuf:"varint,3,opt,name=min_volume_size_mb,json=minVolumeSizeMb,proto3" json:"min_volume_size_mb,omitempty"`     // Minimum volume size for EC
+	CollectionFilter  string                 `protobuf:"bytes,4,opt,name=collection_filter,json=collectionFilter,proto3" json:"collection_filter,omitempty"`       // Only process volumes from specific collections
+	PreferredTags     []string               `protobuf:"bytes,5,rep,name=preferred_tags,json=preferredTags,proto3" json:"preferred_tags,omitempty"`                // Disk tags to prioritize for EC shard placement
+	ReplicaPlacement  string                 `protobuf:"bytes,6,opt,name=replica_placement,json=replicaPlacement,proto3" json:"replica_placement,omitempty"`       // EC shard replica placement (e.g. "020"); empty falls back to master default replication
+	StrictPlacement   bool                   `protobuf:"varint,7,opt,name=strict_placement,json=strictPlacement,proto3" json:"strict_placement,omitempty"`         // fail planning instead of relaxing placement constraints
+	FreeSlotsDeadband int32                  `protobuf:"varint,8,opt,name=free_slots_deadband,json=freeSlotsDeadband,proto3" json:"free_slots_deadband,omitempty"` // Place free-volume-slot deadband; |ΔfreeSlots| ≤ M×dataShards ranks by liveShards; 0 = strict
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *ErasureCodingTaskConfig) Reset() {
@@ -3045,11 +3058,26 @@ func (x *ErasureCodingTaskConfig) GetReplicaPlacement() string {
 	return ""
 }
 
+func (x *ErasureCodingTaskConfig) GetStrictPlacement() bool {
+	if x != nil {
+		return x.StrictPlacement
+	}
+	return false
+}
+
+func (x *ErasureCodingTaskConfig) GetFreeSlotsDeadband() int32 {
+	if x != nil {
+		return x.FreeSlotsDeadband
+	}
+	return 0
+}
+
 // BalanceTaskConfig contains balance-specific configuration
 type BalanceTaskConfig struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
 	ImbalanceThreshold float64                `protobuf:"fixed64,1,opt,name=imbalance_threshold,json=imbalanceThreshold,proto3" json:"imbalance_threshold,omitempty"` // Threshold for triggering rebalancing (0.0-1.0)
 	MinServerCount     int32                  `protobuf:"varint,2,opt,name=min_server_count,json=minServerCount,proto3" json:"min_server_count,omitempty"`            // Minimum number of servers required for balancing
+	IoBytePerSecond    int64                  `protobuf:"varint,3,opt,name=io_byte_per_second,json=ioBytePerSecond,proto3" json:"io_byte_per_second,omitempty"`       // limit each move's copy rate; 0 falls back to the volume server's maintenance rate
 	unknownFields      protoimpl.UnknownFields
 	sizeCache          protoimpl.SizeCache
 }
@@ -3098,6 +3126,13 @@ func (x *BalanceTaskConfig) GetMinServerCount() int32 {
 	return 0
 }
 
+func (x *BalanceTaskConfig) GetIoBytePerSecond() int64 {
+	if x != nil {
+		return x.IoBytePerSecond
+	}
+	return 0
+}
+
 // ReplicationTaskConfig contains replication-specific configuration
 type ReplicationTaskConfig struct {
 	state              protoimpl.MessageState `protogen:"open.v1"`
@@ -3150,8 +3185,13 @@ type EcBalanceTaskParams struct {
 	MaxParallelization int32                  `protobuf:"varint,2,opt,name=max_parallelization,json=maxParallelization,proto3" json:"max_parallelization,omitempty"` // Max parallel shard moves within a batch
 	TimeoutSeconds     int32                  `protobuf:"varint,3,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`             // Operation timeout per move
 	Moves              []*EcShardMoveSpec     `protobuf:"bytes,4,rep,name=moves,proto3" json:"moves,omitempty"`                                                      // Batch: multiple shard moves in one job
-	unknownFields      protoimpl.UnknownFields
-	sizeCache          protoimpl.SizeCache
+	// For a dedup move, the node that keeps the shard. The worker confirms this
+	// node really holds it before deleting the copy, so a topology entry naming a
+	// location that holds nothing cannot cause the last copy to be removed.
+	DedupKeepNode   string `protobuf:"bytes,5,opt,name=dedup_keep_node,json=dedupKeepNode,proto3" json:"dedup_keep_node,omitempty"`
+	IoBytePerSecond int64  `protobuf:"varint,6,opt,name=io_byte_per_second,json=ioBytePerSecond,proto3" json:"io_byte_per_second,omitempty"` // limit each shard copy's rate; 0 falls back to the volume server's maintenance rate
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
 }
 
 func (x *EcBalanceTaskParams) Reset() {
@@ -3212,6 +3252,20 @@ func (x *EcBalanceTaskParams) GetMoves() []*EcShardMoveSpec {
 	return nil
 }
 
+func (x *EcBalanceTaskParams) GetDedupKeepNode() string {
+	if x != nil {
+		return x.DedupKeepNode
+	}
+	return ""
+}
+
+func (x *EcBalanceTaskParams) GetIoBytePerSecond() int64 {
+	if x != nil {
+		return x.IoBytePerSecond
+	}
+	return 0
+}
+
 // EcShardMoveSpec describes a single EC shard move within a batch
 type EcShardMoveSpec struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
@@ -3314,6 +3368,7 @@ type EcBalanceTaskConfig struct {
 	DiskType           string                 `protobuf:"bytes,4,opt,name=disk_type,json=diskType,proto3" json:"disk_type,omitempty"`                                 // Disk type filter
 	PreferredTags      []string               `protobuf:"bytes,5,rep,name=preferred_tags,json=preferredTags,proto3" json:"preferred_tags,omitempty"`                  // Preferred disk tags for placement
 	ReplicaPlacement   string                 `protobuf:"bytes,6,opt,name=replica_placement,json=replicaPlacement,proto3" json:"replica_placement,omitempty"`         // EC shard replica placement (e.g. "020"); empty falls back to master default replication
+	IoBytePerSecond    int64                  `protobuf:"varint,7,opt,name=io_byte_per_second,json=ioBytePerSecond,proto3" json:"io_byte_per_second,omitempty"`       // limit each shard copy's rate; 0 falls back to the volume server's maintenance rate
 	unknownFields      protoimpl.UnknownFields
 	sizeCache          protoimpl.SizeCache
 }
@@ -3390,6 +3445,13 @@ func (x *EcBalanceTaskConfig) GetReplicaPlacement() string {
 	return ""
 }
 
+func (x *EcBalanceTaskConfig) GetIoBytePerSecond() int64 {
+	if x != nil {
+		return x.IoBytePerSecond
+	}
+	return 0
+}
+
 // MaintenanceTaskData represents complete task state for persistence
 type MaintenanceTaskData struct {
 	state       protoimpl.MessageState `protogen:"open.v1"`
@@ -4107,13 +4169,14 @@ const file_worker_proto_rawDesc = "" +
 	"collection\x18\x04 \x01(\tR\n" +
 	"collection\x12\x1f\n" +
 	"\vvolume_size\x18\x05 \x01(\x04R\n" +
-	"volumeSize\"\xbf\x01\n" +
+	"volumeSize\"\xec\x01\n" +
 	"\x11BalanceTaskParams\x12\x1d\n" +
 	"\n" +
 	"force_move\x18\x01 \x01(\bR\tforceMove\x12'\n" +
 	"\x0ftimeout_seconds\x18\x02 \x01(\x05R\x0etimeoutSeconds\x120\n" +
 	"\x14max_concurrent_moves\x18\x03 \x01(\x05R\x12maxConcurrentMoves\x120\n" +
-	"\x05moves\x18\x04 \x03(\v2\x1a.worker_pb.BalanceMoveSpecR\x05moves\"k\n" +
+	"\x05moves\x18\x04 \x03(\v2\x1a.worker_pb.BalanceMoveSpecR\x05moves\x12+\n" +
+	"\x12io_byte_per_second\x18\x05 \x01(\x03R\x0fioBytePerSecond\"k\n" +
 	"\x15ReplicationTaskParams\x12#\n" +
 	"\rreplica_count\x18\x01 \x01(\x05R\freplicaCount\x12-\n" +
 	"\x12verify_consistency\x18\x02 \x01(\bR\x11verifyConsistency\"\x8e\x02\n" +
@@ -4201,9 +4264,9 @@ const file_worker_proto_rawDesc = "" +
 	"\x06status\x18\x06 \x01(\tR\x06status\x1a9\n" +
 	"\vFieldsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc0\x03\n" +
-	"\x11MaintenanceConfig\x12\x18\n" +
-	"\aenabled\x18\x01 \x01(\bR\aenabled\x122\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xd1\x03\n" +
+	"\x11MaintenanceConfig\x12\x1d\n" +
+	"\aenabled\x18\x01 \x01(\bH\x00R\aenabled\x88\x01\x01\x122\n" +
 	"\x15scan_interval_seconds\x18\x02 \x01(\x05R\x13scanIntervalSeconds\x124\n" +
 	"\x16worker_timeout_seconds\x18\x03 \x01(\x05R\x14workerTimeoutSeconds\x120\n" +
 	"\x14task_timeout_seconds\x18\x04 \x01(\x05R\x12taskTimeoutSeconds\x12.\n" +
@@ -4212,7 +4275,9 @@ const file_worker_proto_rawDesc = "" +
 	"maxRetries\x128\n" +
 	"\x18cleanup_interval_seconds\x18\a \x01(\x05R\x16cleanupIntervalSeconds\x124\n" +
 	"\x16task_retention_seconds\x18\b \x01(\x05R\x14taskRetentionSeconds\x124\n" +
-	"\x06policy\x18\t \x01(\v2\x1c.worker_pb.MaintenancePolicyR\x06policy\"\x80\x03\n" +
+	"\x06policy\x18\t \x01(\v2\x1c.worker_pb.MaintenancePolicyR\x06policyB\n" +
+	"\n" +
+	"\b_enabled\"\x80\x03\n" +
 	"\x11MaintenancePolicy\x12S\n" +
 	"\rtask_policies\x18\x01 \x03(\v2..worker_pb.MaintenancePolicy.TaskPoliciesEntryR\ftaskPolicies\x122\n" +
 	"\x15global_max_concurrent\x18\x02 \x01(\x05R\x13globalMaxConcurrent\x12E\n" +
@@ -4236,24 +4301,29 @@ const file_worker_proto_rawDesc = "" +
 	"\x10VacuumTaskConfig\x12+\n" +
 	"\x11garbage_threshold\x18\x01 \x01(\x01R\x10garbageThreshold\x12/\n" +
 	"\x14min_volume_age_hours\x18\x02 \x01(\x05R\x11minVolumeAgeHours\x120\n" +
-	"\x14min_interval_seconds\x18\x03 \x01(\x05R\x12minIntervalSeconds\"\x9a\x02\n" +
+	"\x14min_interval_seconds\x18\x03 \x01(\x05R\x12minIntervalSeconds\"\xf5\x02\n" +
 	"\x17ErasureCodingTaskConfig\x12%\n" +
 	"\x0efullness_ratio\x18\x01 \x01(\x01R\rfullnessRatio\x12*\n" +
 	"\x11quiet_for_seconds\x18\x02 \x01(\x05R\x0fquietForSeconds\x12+\n" +
 	"\x12min_volume_size_mb\x18\x03 \x01(\x05R\x0fminVolumeSizeMb\x12+\n" +
 	"\x11collection_filter\x18\x04 \x01(\tR\x10collectionFilter\x12%\n" +
 	"\x0epreferred_tags\x18\x05 \x03(\tR\rpreferredTags\x12+\n" +
-	"\x11replica_placement\x18\x06 \x01(\tR\x10replicaPlacement\"n\n" +
+	"\x11replica_placement\x18\x06 \x01(\tR\x10replicaPlacement\x12)\n" +
+	"\x10strict_placement\x18\a \x01(\bR\x0fstrictPlacement\x12.\n" +
+	"\x13free_slots_deadband\x18\b \x01(\x05R\x11freeSlotsDeadband\"\x9b\x01\n" +
 	"\x11BalanceTaskConfig\x12/\n" +
 	"\x13imbalance_threshold\x18\x01 \x01(\x01R\x12imbalanceThreshold\x12(\n" +
-	"\x10min_server_count\x18\x02 \x01(\x05R\x0eminServerCount\"I\n" +
+	"\x10min_server_count\x18\x02 \x01(\x05R\x0eminServerCount\x12+\n" +
+	"\x12io_byte_per_second\x18\x03 \x01(\x03R\x0fioBytePerSecond\"I\n" +
 	"\x15ReplicationTaskConfig\x120\n" +
-	"\x14target_replica_count\x18\x01 \x01(\x05R\x12targetReplicaCount\"\xbe\x01\n" +
+	"\x14target_replica_count\x18\x01 \x01(\x05R\x12targetReplicaCount\"\x93\x02\n" +
 	"\x13EcBalanceTaskParams\x12\x1b\n" +
 	"\tdisk_type\x18\x01 \x01(\tR\bdiskType\x12/\n" +
 	"\x13max_parallelization\x18\x02 \x01(\x05R\x12maxParallelization\x12'\n" +
 	"\x0ftimeout_seconds\x18\x03 \x01(\x05R\x0etimeoutSeconds\x120\n" +
-	"\x05moves\x18\x04 \x03(\v2\x1a.worker_pb.EcShardMoveSpecR\x05moves\"\xf7\x01\n" +
+	"\x05moves\x18\x04 \x03(\v2\x1a.worker_pb.EcShardMoveSpecR\x05moves\x12&\n" +
+	"\x0fdedup_keep_node\x18\x05 \x01(\tR\rdedupKeepNode\x12+\n" +
+	"\x12io_byte_per_second\x18\x06 \x01(\x03R\x0fioBytePerSecond\"\xf7\x01\n" +
 	"\x0fEcShardMoveSpec\x12\x1b\n" +
 	"\tvolume_id\x18\x01 \x01(\rR\bvolumeId\x12\x19\n" +
 	"\bshard_id\x18\x02 \x01(\rR\ashardId\x12\x1e\n" +
@@ -4265,14 +4335,15 @@ const file_worker_proto_rawDesc = "" +
 	"\x0esource_disk_id\x18\x05 \x01(\rR\fsourceDiskId\x12\x1f\n" +
 	"\vtarget_node\x18\x06 \x01(\tR\n" +
 	"targetNode\x12$\n" +
-	"\x0etarget_disk_id\x18\a \x01(\rR\ftargetDiskId\"\x8e\x02\n" +
+	"\x0etarget_disk_id\x18\a \x01(\rR\ftargetDiskId\"\xbb\x02\n" +
 	"\x13EcBalanceTaskConfig\x12/\n" +
 	"\x13imbalance_threshold\x18\x01 \x01(\x01R\x12imbalanceThreshold\x12(\n" +
 	"\x10min_server_count\x18\x02 \x01(\x05R\x0eminServerCount\x12+\n" +
 	"\x11collection_filter\x18\x03 \x01(\tR\x10collectionFilter\x12\x1b\n" +
 	"\tdisk_type\x18\x04 \x01(\tR\bdiskType\x12%\n" +
 	"\x0epreferred_tags\x18\x05 \x03(\tR\rpreferredTags\x12+\n" +
-	"\x11replica_placement\x18\x06 \x01(\tR\x10replicaPlacement\"\xae\a\n" +
+	"\x11replica_placement\x18\x06 \x01(\tR\x10replicaPlacement\x12+\n" +
+	"\x12io_byte_per_second\x18\a \x01(\x03R\x0fioBytePerSecond\"\xae\a\n" +
 	"\x13MaintenanceTaskData\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
 	"\x04type\x18\x02 \x01(\tR\x04type\x12\x1a\n" +
@@ -4506,6 +4577,7 @@ func file_worker_proto_init() {
 		(*TaskParams_EcBalanceParams)(nil),
 		(*TaskParams_S3LifecycleParams)(nil),
 	}
+	file_worker_proto_msgTypes[27].OneofWrappers = []any{}
 	file_worker_proto_msgTypes[29].OneofWrappers = []any{
 		(*TaskPolicy_VacuumConfig)(nil),
 		(*TaskPolicy_ErasureCodingConfig)(nil),
diff --git a/weed/pb/worker_pb/worker_grpc.pb.go b/weed/pb/worker_pb/worker_grpc.pb.go
index 7e7aba7487..649ab6165b 100644
--- a/weed/pb/worker_pb/worker_grpc.pb.go
+++ b/weed/pb/worker_pb/worker_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.5.1
-// - protoc             v6.33.4
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             v7.35.0
 // source: worker.proto
 
 package worker_pb
@@ -72,7 +72,7 @@ type WorkerServiceServer interface {
 type UnimplementedWorkerServiceServer struct{}
 
 func (UnimplementedWorkerServiceServer) WorkerStream(grpc.BidiStreamingServer[WorkerMessage, AdminMessage]) error {
-	return status.Errorf(codes.Unimplemented, "method WorkerStream not implemented")
+	return status.Error(codes.Unimplemented, "method WorkerStream not implemented")
 }
 func (UnimplementedWorkerServiceServer) mustEmbedUnimplementedWorkerServiceServer() {}
 func (UnimplementedWorkerServiceServer) testEmbeddedByValue()                       {}
@@ -85,7 +85,7 @@ type UnsafeWorkerServiceServer interface {
 }
 
 func RegisterWorkerServiceServer(s grpc.ServiceRegistrar, srv WorkerServiceServer) {
-	// If the following call pancis, it indicates UnimplementedWorkerServiceServer was
+	// If the following call panics, it indicates UnimplementedWorkerServiceServer was
 	// embedded by pointer and is nil.  This will cause panics if an
 	// unimplemented method is ever invoked, so we test this at initialization
 	// time to prevent it from happening at runtime later due to I/O.
diff --git a/weed/plugin/worker/admin_script_handler.go b/weed/plugin/worker/admin_script_handler.go
index 5643956d02..d6ff69cca9 100644
--- a/weed/plugin/worker/admin_script_handler.go
+++ b/weed/plugin/worker/admin_script_handler.go
@@ -290,6 +290,11 @@ func (h *AdminScriptHandler) Execute(ctx context.Context, request *plugin_pb.Exe
 				continue
 			}
 			found = true
+			// The env is reused for every command in the script, and noLock
+			// belongs to the invocation that set it. ForceNoLock already exempts
+			// this path, so this changes nothing today -- it keeps the rule the
+			// same in all three dispatchers rather than resting on that.
+			commandEnv.SetNoLock(false)
 			if err := command.Do(cmd.Args, commandEnv, output); err != nil {
 				msg := fmt.Sprintf("%s: %v", cmd.Name, err)
 				errorMessages = append(errorMessages, msg)
diff --git a/weed/plugin/worker/collection_filter.go b/weed/plugin/worker/collection_filter.go
deleted file mode 100644
index 7721858c76..0000000000
--- a/weed/plugin/worker/collection_filter.go
+++ /dev/null
@@ -1,14 +0,0 @@
-package pluginworker
-
-// CollectionFilterMode controls how collections are interpreted during
-// detection. The two recognized sentinels short-circuit regex matching:
-//   - CollectionFilterAll: pool every collection together (default).
-//   - CollectionFilterEach: run detection separately per collection.
-//
-// Any other non-empty value is treated as a regex.
-type CollectionFilterMode string
-
-const (
-	CollectionFilterAll  CollectionFilterMode = "ALL_COLLECTIONS"
-	CollectionFilterEach CollectionFilterMode = "EACH_COLLECTION"
-)
diff --git a/weed/plugin/worker/config.go b/weed/plugin/worker/config.go
index 0f2d66a2ec..9f5ec5cda0 100644
--- a/weed/plugin/worker/config.go
+++ b/weed/plugin/worker/config.go
@@ -125,6 +125,21 @@ func ReadIntConfig(values map[string]*plugin_pb.ConfigValue, field string, fallb
 	return int(v)
 }
 
+// ReadBoolConfig reads a bool-valued plugin config field.
+func ReadBoolConfig(values map[string]*plugin_pb.ConfigValue, field string, fallback bool) bool {
+	if values == nil {
+		return fallback
+	}
+	value := values[field]
+	if value == nil {
+		return fallback
+	}
+	if kind, ok := value.Kind.(*plugin_pb.ConfigValue_BoolValue); ok {
+		return kind.BoolValue
+	}
+	return fallback
+}
+
 // ReadBytesConfig reads a bytes-valued plugin config field, returning nil when
 // the value is missing or of a different kind.
 func ReadBytesConfig(values map[string]*plugin_pb.ConfigValue, field string) []byte {
diff --git a/weed/plugin/worker/handler_registry.go b/weed/plugin/worker/handler_registry.go
index 029382c060..cddd04b3c6 100644
--- a/weed/plugin/worker/handler_registry.go
+++ b/weed/plugin/worker/handler_registry.go
@@ -37,6 +37,9 @@ type HandlerBuildOptions struct {
 	GrpcDialOption grpc.DialOption
 	MaxExecute     int
 	WorkingDir     string
+	// WorkerAddress is the advertised weed worker -address (host:port).
+	// It is not a volume-server URL; handlers match replicas by hostname.
+	WorkerAddress string
 }
 
 var (
diff --git a/weed/plugin/worker/volume_metrics.go b/weed/plugin/worker/volume_metrics.go
index 0a9ff97a6b..be60d05ee1 100644
--- a/weed/plugin/worker/volume_metrics.go
+++ b/weed/plugin/worker/volume_metrics.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"regexp"
 	"sort"
 	"strings"
 	"time"
@@ -13,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	workertypes "github.com/seaweedfs/seaweedfs/weed/worker/types"
 	"google.golang.org/grpc"
 )
@@ -108,7 +108,7 @@ func FetchVolumeList(ctx context.Context, address string, grpcDialOption grpc.Di
 
 		client := master_pb.NewSeaweedClient(conn)
 		callCtx, cancelCall := context.WithTimeout(ctx, 10*time.Second)
-		response, callErr := client.VolumeList(callCtx, &master_pb.VolumeListRequest{})
+		response, callErr := pb.CollectVolumeList(callCtx, client, &master_pb.VolumeListRequest{})
 		cancelCall()
 		_ = conn.Close()
 
@@ -137,15 +137,9 @@ func buildVolumeMetrics(
 		return nil, nil, nil, err
 	}
 
-	var collectionRegex *regexp.Regexp
-	trimmedFilter := strings.TrimSpace(collectionFilter)
-	filterMode := CollectionFilterMode(trimmedFilter)
-	if trimmedFilter != "" && filterMode != CollectionFilterAll && filterMode != CollectionFilterEach && trimmedFilter != "*" {
-		var err error
-		collectionRegex, err = regexp.Compile(trimmedFilter)
-		if err != nil {
-			return nil, nil, nil, &configError{err: fmt.Errorf("invalid collection_filter regex %q: %w", trimmedFilter, err)}
-		}
+	collectionMatcher, err := wildcard.CompileCollectionMatcher(collectionFilter)
+	if err != nil {
+		return nil, nil, nil, &configError{err: err}
 	}
 
 	volumeSizeLimitBytes := uint64(response.VolumeSizeLimitMb) * 1024 * 1024
@@ -167,7 +161,7 @@ func buildVolumeMetrics(
 							Host:       pb.NewServerAddressFromDataNode(node).ToHost(),
 						})
 
-						if collectionRegex != nil && !collectionRegex.MatchString(volume.Collection) {
+						if !collectionMatcher.Matches(volume.Collection) {
 							continue
 						}
 
diff --git a/weed/plugin/worker/volume_metrics_test.go b/weed/plugin/worker/volume_metrics_test.go
index 05eeb008fc..3deec52835 100644
--- a/weed/plugin/worker/volume_metrics_test.go
+++ b/weed/plugin/worker/volume_metrics_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 )
 
 func makeTestVolumeListResponse(volumes ...*master_pb.VolumeInformationMessage) *master_pb.VolumeListResponse {
@@ -53,7 +54,7 @@ func TestBuildVolumeMetricsAllCollections(t *testing.T) {
 		&master_pb.VolumeInformationMessage{Id: 1, Collection: "photos", Size: 100},
 		&master_pb.VolumeInformationMessage{Id: 2, Collection: "videos", Size: 200},
 	)
-	metrics, _, _, err := buildVolumeMetrics(resp, string(CollectionFilterAll))
+	metrics, _, _, err := buildVolumeMetrics(resp, string(wildcard.CollectionFilterAll))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -68,7 +69,7 @@ func TestBuildVolumeMetricsEachCollection(t *testing.T) {
 		&master_pb.VolumeInformationMessage{Id: 2, Collection: "videos", Size: 200},
 	)
 	// EACH_COLLECTION passes all volumes through; filtering happens in the handler
-	metrics, _, _, err := buildVolumeMetrics(resp, string(CollectionFilterEach))
+	metrics, _, _, err := buildVolumeMetrics(resp, string(wildcard.CollectionFilterEach))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -95,6 +96,26 @@ func TestBuildVolumeMetricsRegexFilter(t *testing.T) {
 	}
 }
 
+func TestBuildVolumeMetricsCollectionList(t *testing.T) {
+	resp := makeTestVolumeListResponse(
+		&master_pb.VolumeInformationMessage{Id: 1, Collection: "photos", Size: 100},
+		&master_pb.VolumeInformationMessage{Id: 2, Collection: "videos", Size: 200},
+		&master_pb.VolumeInformationMessage{Id: 3, Collection: "clips", Size: 300},
+	)
+	metrics, _, _, err := buildVolumeMetrics(resp, "photos,videos")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(metrics) != 2 {
+		t.Fatalf("expected 2 metrics, got %d", len(metrics))
+	}
+	for _, metric := range metrics {
+		if metric.Collection != "photos" && metric.Collection != "videos" {
+			t.Fatalf("unexpected collection %q", metric.Collection)
+		}
+	}
+}
+
 func TestBuildVolumeMetricsInvalidRegex(t *testing.T) {
 	resp := makeTestVolumeListResponse(
 		&master_pb.VolumeInformationMessage{Id: 1, Collection: "photos", Size: 100},
diff --git a/weed/plugin/worker/worker.go b/weed/plugin/worker/worker.go
index 279ffbe9d3..28a04c2f2c 100644
--- a/weed/plugin/worker/worker.go
+++ b/weed/plugin/worker/worker.go
@@ -14,7 +14,10 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
@@ -204,6 +207,12 @@ func (w *Worker) runOnce(ctx context.Context, adminAddress string) error {
 	connCtx, cancelConn := context.WithCancel(ctx)
 	defer cancelConn()
 
+	if md := security.GrpcAdminPeerCredentials(
+		security.SigningKey(util.GetViper().GetString("jwt.filer_signing.key")),
+		util.GetViper().GetInt("jwt.filer_signing.expires_after_seconds")); len(md) > 0 {
+		connCtx = metadata.NewOutgoingContext(connCtx, md)
+	}
+
 	stream, err := client.WorkerStream(connCtx)
 	if err != nil {
 		return fmt.Errorf("open worker stream: %w", err)
@@ -651,8 +660,7 @@ func (w *Worker) buildHeartbeat() *plugin_pb.WorkerHeartbeat {
 		if work == nil {
 			continue
 		}
-		cloned := *work
-		running = append(running, &cloned)
+		running = append(running, proto.Clone(work).(*plugin_pb.RunningWork))
 	}
 	w.runningMu.RUnlock()
 
diff --git a/weed/query/engine/aggregations.go b/weed/query/engine/aggregations.go
index 54130212e2..e672e61743 100644
--- a/weed/query/engine/aggregations.go
+++ b/weed/query/engine/aggregations.go
@@ -116,8 +116,9 @@ func (opt *FastPathOptimizer) CollectDataSourcesWithTimeFilter(ctx context.Conte
 		// Read parquet file statistics
 		parquetStats, err := hybridScanner.ReadParquetStatistics(partitionPath)
 		if err != nil {
-			if isDebugMode(ctx) {
-				fmt.Printf("  ERROR: Failed to read parquet statistics: %v\n", err)
+			return dataSources, DataSourceError{
+				Source: "parquet_statistics",
+				Cause:  fmt.Errorf("partition %s: %w", partitionPath, err),
 			}
 		} else if len(parquetStats) == 0 {
 			if isDebugMode(ctx) {
@@ -141,8 +142,9 @@ func (opt *FastPathOptimizer) CollectDataSourcesWithTimeFilter(ctx context.Conte
 		parquetSources := opt.engine.extractParquetSourceFiles(dataSources.ParquetFiles[partitionPath])
 		liveLogCount, liveLogErr := opt.engine.countLiveLogRowsExcludingParquetSources(ctx, partitionPath, parquetSources)
 		if liveLogErr != nil {
-			if isDebugMode(ctx) {
-				fmt.Printf("  ERROR: Failed to count live log rows: %v\n", liveLogErr)
+			return dataSources, DataSourceError{
+				Source: "live_log_count",
+				Cause:  fmt.Errorf("partition %s: %w", partitionPath, liveLogErr),
 			}
 		} else {
 			dataSources.LiveLogRowCount += liveLogCount
@@ -308,7 +310,7 @@ func (comp *AggregationComputer) computeGlobalMin(spec AggregationSpec, dataSour
 
 			liveLogMin, _, err := comp.engine.computeLiveLogMinMax(partition, spec.Column, partitionParquetSources)
 			if err != nil {
-				continue // Skip partitions with errors
+				return nil, err
 			}
 
 			if liveLogMin != nil {
@@ -384,7 +386,7 @@ func (comp *AggregationComputer) computeGlobalMax(spec AggregationSpec, dataSour
 
 			_, liveLogMax, err := comp.engine.computeLiveLogMinMax(partition, spec.Column, partitionParquetSources)
 			if err != nil {
-				continue // Skip partitions with errors
+				return nil, err
 			}
 
 			if liveLogMax != nil {
diff --git a/weed/query/engine/engine.go b/weed/query/engine/engine.go
index 7a1c783bae..ec8707c0ca 100644
--- a/weed/query/engine/engine.go
+++ b/weed/query/engine/engine.go
@@ -3894,8 +3894,7 @@ func (e *SQLEngine) computeLiveLogMinMax(partitionPath string, columnName string
 		// Scan this log file for MIN/MAX values
 		fileMin, fileMax, err := e.computeFileMinMax(filerClient, filePath, columnName)
 		if err != nil {
-			fmt.Printf("Warning: failed to compute min/max for file %s: %v\n", filePath, err)
-			return nil // Continue with other files
+			return err
 		}
 
 		// Update global min/max
@@ -4030,7 +4029,10 @@ func (e *SQLEngine) eachLogEntryInFile(filerClient filer_pb.FilerClient, filePat
 
 	// Read file chunks and process them (pattern from countRowsInLogFile)
 	fileSize := filer.FileSize(fileEntry)
-	visibleIntervals, _ := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, fileEntry.Chunks, 0, int64(fileSize))
+	visibleIntervals, err := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, fileEntry.Chunks, 0, int64(fileSize))
+	if err != nil {
+		return err
+	}
 	chunkViews := filer.ViewFromVisibleIntervals(visibleIntervals, 0, int64(fileSize))
 
 	for x := chunkViews.Front(); x != nil; x = x.Next {
@@ -4185,8 +4187,7 @@ func (e *SQLEngine) countLiveLogRowsExcludingParquetSources(ctx context.Context,
 		// Count rows in live log file
 		rowCount, err := e.countRowsInLogFile(filerClient, partitionPath, entry)
 		if err != nil {
-			fmt.Printf("Warning: failed to count rows in %s/%s: %v\n", partitionPath, entry.Name, err)
-			return nil // Continue with other files
+			return err
 		}
 		totalRows += rowCount
 		return nil
@@ -4354,7 +4355,10 @@ func (e *SQLEngine) countRowsInLogFile(filerClient filer_pb.FilerClient, partiti
 
 	// Read file chunks and process them (pattern from read_log_from_disk.go)
 	fileSize := filer.FileSize(entry)
-	visibleIntervals, _ := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, entry.Chunks, 0, int64(fileSize))
+	visibleIntervals, err := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, entry.Chunks, 0, int64(fileSize))
+	if err != nil {
+		return 0, err
+	}
 	chunkViews := filer.ViewFromVisibleIntervals(visibleIntervals, 0, int64(fileSize))
 
 	for x := chunkViews.Front(); x != nil; x = x.Next {
@@ -4456,23 +4460,22 @@ func (e *SQLEngine) getTopicTotalRowCount(ctx context.Context, namespace, topicN
 	// For each partition, count both parquet and live log rows
 	for _, partition := range partitions {
 		// Count parquet rows
-		parquetStats, parquetErr := hybridScanner.ReadParquetStatistics(partition)
-		if parquetErr == nil {
-			for _, stats := range parquetStats {
-				totalRowCount += stats.RowCount
-			}
+		parquetStats, err := hybridScanner.ReadParquetStatistics(partition)
+		if err != nil {
+			return 0, fmt.Errorf("read parquet statistics for %s: %w", partition, err)
+		}
+		for _, stats := range parquetStats {
+			totalRowCount += stats.RowCount
 		}
 
 		// Count live log rows (with deduplication)
-		parquetSourceFiles := make(map[string]bool)
-		if parquetErr == nil {
-			parquetSourceFiles = e.extractParquetSourceFiles(parquetStats)
-		}
+		parquetSourceFiles := e.extractParquetSourceFiles(parquetStats)
 
-		liveLogCount, liveLogErr := e.countLiveLogRowsExcludingParquetSources(ctx, partition, parquetSourceFiles)
-		if liveLogErr == nil {
-			totalRowCount += liveLogCount
+		liveLogCount, err := e.countLiveLogRowsExcludingParquetSources(ctx, partition, parquetSourceFiles)
+		if err != nil {
+			return 0, fmt.Errorf("count live log rows for %s: %w", partition, err)
 		}
+		totalRowCount += liveLogCount
 	}
 
 	return totalRowCount, nil
@@ -4509,17 +4512,18 @@ func (e *SQLEngine) getActualRowsScannedForFastPath(ctx context.Context, namespa
 	// (parquet files use metadata/statistics, so they contribute 0 to scan count)
 	for _, partition := range partitions {
 		// Get parquet files to determine what was converted
-		parquetStats, parquetErr := hybridScanner.ReadParquetStatistics(partition)
-		parquetSourceFiles := make(map[string]bool)
-		if parquetErr == nil {
-			parquetSourceFiles = e.extractParquetSourceFiles(parquetStats)
+		parquetStats, err := hybridScanner.ReadParquetStatistics(partition)
+		if err != nil {
+			return 0, fmt.Errorf("read parquet statistics for %s: %w", partition, err)
 		}
+		parquetSourceFiles := e.extractParquetSourceFiles(parquetStats)
 
 		// Count only live log rows that haven't been converted to parquet
-		liveLogCount, liveLogErr := e.countLiveLogRowsExcludingParquetSources(ctx, partition, parquetSourceFiles)
-		if liveLogErr == nil {
-			totalScannedRows += liveLogCount
+		liveLogCount, err := e.countLiveLogRowsExcludingParquetSources(ctx, partition, parquetSourceFiles)
+		if err != nil {
+			return 0, fmt.Errorf("count live log rows for %s: %w", partition, err)
 		}
+		totalScannedRows += liveLogCount
 
 		// Note: Parquet files contribute 0 to scan count since we use their metadata/statistics
 	}
diff --git a/weed/query/engine/hybrid_message_scanner.go b/weed/query/engine/hybrid_message_scanner.go
index 2b45e9cdce..e7836ee8ca 100644
--- a/weed/query/engine/hybrid_message_scanner.go
+++ b/weed/query/engine/hybrid_message_scanner.go
@@ -1140,9 +1140,7 @@ func (h *HybridMessageScanner) ReadParquetStatistics(partitionPath string) ([]*P
 		// Extract statistics from this parquet file
 		stats, err := h.extractParquetFileStats(entry, lookupFileIdFn, chunkCache)
 		if err != nil {
-			// Log error but continue processing other files
-			fmt.Printf("Warning: failed to extract stats from %s: %v\n", entry.Name, err)
-			return nil
+			return err
 		}
 
 		if stats != nil {
@@ -1164,7 +1162,10 @@ func (h *HybridMessageScanner) extractParquetFileStats(entry *filer_pb.Entry, lo
 	}
 	// Create reader for the parquet file
 	fileSize := filer.FileSize(entry)
-	visibleIntervals, _ := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, entry.Chunks, 0, int64(fileSize))
+	visibleIntervals, err := filer.NonOverlappingVisibleIntervals(context.Background(), lookupFileIdFn, entry.Chunks, 0, int64(fileSize))
+	if err != nil {
+		return nil, fmt.Errorf("resolve chunks of %s: %w", entry.Name, err)
+	}
 	chunkViews := filer.ViewFromVisibleIntervals(visibleIntervals, 0, int64(fileSize))
 	readerCache := filer.NewReaderCache(32, chunkCache, lookupFileIdFn, nil)
 	readerAt := filer.NewChunkReaderAtFromClient(context.Background(), readerCache, chunkViews, int64(fileSize), filer.DefaultPrefetchCount)
diff --git a/weed/remote_storage/azure/azure_credentials.go b/weed/remote_storage/azure/azure_credentials.go
index d749b41365..a163186b59 100644
--- a/weed/remote_storage/azure/azure_credentials.go
+++ b/weed/remote_storage/azure/azure_credentials.go
@@ -2,6 +2,7 @@ package azure
 
 import (
 	"fmt"
+	"net/http"
 	"net/url"
 	"os"
 	"regexp"
@@ -27,7 +28,10 @@ var validAzureAccountName = regexp.MustCompile(`^[a-z0-9]{3,24}$`)
 //
 // endpoint is the blob service URL, for accounts outside the public cloud. An
 // empty endpoint derives the public one from accountName.
-func NewAzBlobClient(accountName, accountKey, clientID, endpoint string) (*azblob.Client, error) {
+//
+// A non-nil httpClient overrides the SDK transport; the volume server passes one
+// whose dialer pins the validated endpoint against DNS rebinding.
+func NewAzBlobClient(accountName, accountKey, clientID, endpoint string, httpClient *http.Client) (*azblob.Client, error) {
 
 	if accountName == "" {
 		return nil, fmt.Errorf("azure account name is required")
@@ -41,13 +45,18 @@ func NewAzBlobClient(accountName, accountKey, clientID, endpoint string) (*azblo
 		return nil, err
 	}
 
+	options := DefaultAzBlobClientOptions()
+	if httpClient != nil {
+		options.Transport = httpClient
+	}
+
 	if accountKey == "" {
 		credential, err := newAzureTokenCredential(clientID)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create Azure Entra ID credential for account %s: %w", accountName, err)
 		}
 		glog.V(1).Infof("azure %s: authenticating with Entra ID", accountName)
-		client, err := azblob.NewClient(serviceURL, credential, DefaultAzBlobClientOptions())
+		client, err := azblob.NewClient(serviceURL, credential, options)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create Azure client: %w", err)
 		}
@@ -58,7 +67,7 @@ func NewAzBlobClient(accountName, accountKey, clientID, endpoint string) (*azblo
 	if err != nil {
 		return nil, fmt.Errorf("failed to create Azure credential with account name:%s: %w", accountName, err)
 	}
-	client, err := azblob.NewClientWithSharedKeyCredential(serviceURL, credential, DefaultAzBlobClientOptions())
+	client, err := azblob.NewClientWithSharedKeyCredential(serviceURL, credential, options)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create Azure client: %w", err)
 	}
diff --git a/weed/remote_storage/azure/azure_credentials_test.go b/weed/remote_storage/azure/azure_credentials_test.go
index 6f63a91551..48206ac656 100644
--- a/weed/remote_storage/azure/azure_credentials_test.go
+++ b/weed/remote_storage/azure/azure_credentials_test.go
@@ -6,21 +6,21 @@ import (
 )
 
 func TestNewAzBlobClientRequiresAccountName(t *testing.T) {
-	if _, err := NewAzBlobClient("", "aW52YWxpZGtleQ==", "", ""); err == nil {
+	if _, err := NewAzBlobClient("", "aW52YWxpZGtleQ==", "", "", nil); err == nil {
 		t.Error("expected an error without an account name")
 	}
 }
 
 func TestNewAzBlobClientRejectsMalformedAccountName(t *testing.T) {
 	for _, accountName := range []string{"ab", "TestAccount", "test-account", "evil.com/x", "evil@host.com", "account?x=1"} {
-		if _, err := NewAzBlobClient(accountName, "", "", ""); err == nil {
+		if _, err := NewAzBlobClient(accountName, "", "", "", nil); err == nil {
 			t.Errorf("expected an error for account name %q", accountName)
 		}
 	}
 }
 
 func TestNewAzBlobClientSharedKey(t *testing.T) {
-	client, err := NewAzBlobClient("testaccount", "aW52YWxpZGtleQ==", "", "")
+	client, err := NewAzBlobClient("testaccount", "aW52YWxpZGtleQ==", "", "", nil)
 	if err != nil {
 		t.Fatalf("failed to create a shared key client: %v", err)
 	}
@@ -30,7 +30,7 @@ func TestNewAzBlobClientSharedKey(t *testing.T) {
 }
 
 func TestNewAzBlobClientSharedKeyRejectsMalformedKey(t *testing.T) {
-	if _, err := NewAzBlobClient("testaccount", "not base64", "", ""); err == nil {
+	if _, err := NewAzBlobClient("testaccount", "not base64", "", "", nil); err == nil {
 		t.Error("expected an error with a malformed account key")
 	}
 }
@@ -62,7 +62,7 @@ func TestAzureServiceURL(t *testing.T) {
 
 // no account key: authenticate through the Entra ID chain instead
 func TestNewAzBlobClientEntraID(t *testing.T) {
-	client, err := NewAzBlobClient("testaccount", "", "", "")
+	client, err := NewAzBlobClient("testaccount", "", "", "", nil)
 	if err != nil {
 		t.Fatalf("failed to create an Entra ID client: %v", err)
 	}
@@ -75,7 +75,7 @@ func TestNewAzBlobClientWorkloadIdentity(t *testing.T) {
 	t.Setenv("AZURE_FEDERATED_TOKEN_FILE", filepath.Join(t.TempDir(), "token"))
 	t.Setenv("AZURE_TENANT_ID", "00000000-0000-0000-0000-000000000000")
 
-	client, err := NewAzBlobClient("testaccount", "", "11111111-1111-1111-1111-111111111111", "")
+	client, err := NewAzBlobClient("testaccount", "", "11111111-1111-1111-1111-111111111111", "", nil)
 	if err != nil {
 		t.Fatalf("failed to create a workload identity client: %v", err)
 	}
diff --git a/weed/remote_storage/azure/azure_storage_client.go b/weed/remote_storage/azure/azure_storage_client.go
index 5e9495ab2f..15ff2519d1 100644
--- a/weed/remote_storage/azure/azure_storage_client.go
+++ b/weed/remote_storage/azure/azure_storage_client.go
@@ -2,9 +2,11 @@ package azure
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"math"
+	"net/http"
 	"os"
 	"reflect"
 	"regexp"
@@ -116,6 +118,14 @@ func (s azureRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s azureRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
+	return MakeWithHTTPClient(conf, nil)
+}
+
+// MakeWithHTTPClient builds an azure client using the supplied *http.Client for
+// its transport (or the SDK default when nil). Callers that need to pin the dial
+// path against DNS rebinding pass a client whose transport has a guarded
+// DialContext, mirroring the S3 backend.
+func MakeWithHTTPClient(conf *remote_pb.RemoteConf, httpClient *http.Client) (remote_storage.RemoteStorageClient, error) {
 
 	client := &azureRemoteStorageClient{
 		conf: conf,
@@ -126,7 +136,7 @@ func (s azureRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storag
 		return nil, fmt.Errorf("neither azure_account_name nor the AZURE_STORAGE_ACCOUNT environment variable is set")
 	}
 
-	azClient, err := NewAzBlobClient(accountName, accountKey, conf.AzureClientId, conf.AzureEndpoint)
+	azClient, err := NewAzBlobClient(accountName, accountKey, conf.AzureClientId, conf.AzureEndpoint, httpClient)
 	if err != nil {
 		return nil, err
 	}
@@ -144,6 +154,20 @@ type azureRemoteStorageClient struct {
 var _ = remote_storage.RemoteStorageClient(&azureRemoteStorageClient{})
 var _ = remote_storage.RemoteStorageConcurrentReader(&azureRemoteStorageClient{})
 
+func (az *azureRemoteStorageClient) uploadConcurrency() int {
+	if n := int(az.conf.GetUploadConcurrency()); n > 0 {
+		return n
+	}
+	return defaultConcurrency
+}
+
+func (az *azureRemoteStorageClient) downloadConcurrency() int {
+	if n := int(az.conf.GetDownloadConcurrency()); n > 0 {
+		return n
+	}
+	return defaultReadConcurrency
+}
+
 func (az *azureRemoteStorageClient) ListDirectory(ctx context.Context, loc *remote_pb.RemoteStorageLocation, visitFn remote_storage.VisitFunc) (err error) {
 	pathKey := loc.Path[1:]
 	if pathKey != "" && !strings.HasSuffix(pathKey, "/") {
@@ -294,7 +318,7 @@ func (az *azureRemoteStorageClient) Traverse(loc *remote_pb.RemoteStorageLocatio
 }
 
 func (az *azureRemoteStorageClient) ReadFile(loc *remote_pb.RemoteStorageLocation, offset int64, size int64) (data []byte, err error) {
-	return az.ReadFileWithConcurrency(loc, offset, size, defaultReadConcurrency)
+	return az.ReadFileWithConcurrency(loc, offset, size, 0)
 }
 
 // ReadFileWithConcurrency fetches a byte range of a blob using the Azure SDK's
@@ -313,9 +337,9 @@ func (az *azureRemoteStorageClient) ReadFileWithConcurrency(loc *remote_pb.Remot
 	}
 
 	if concurrency <= 0 {
-		concurrency = defaultReadConcurrency
-	} else if concurrency > math.MaxUint16 {
-		// DownloadBufferOptions.Concurrency is uint16; clamp to avoid wraparound.
+		concurrency = az.downloadConcurrency()
+	}
+	if concurrency > math.MaxUint16 {
 		concurrency = math.MaxUint16
 	}
 
@@ -330,6 +354,9 @@ func (az *azureRemoteStorageClient) ReadFileWithConcurrency(loc *remote_pb.Remot
 		props, propsErr := blobClient.GetProperties(propsCtx, nil)
 		cancelProps()
 		if propsErr != nil {
+			if bloberror.HasCode(propsErr, bloberror.BlobNotFound) {
+				return nil, remote_storage.ErrRemoteObjectNotFound
+			}
 			return nil, fmt.Errorf("get properties %s%s: %w", loc.Bucket, loc.Path, propsErr)
 		}
 		if props.ContentLength == nil {
@@ -351,6 +378,9 @@ func (az *azureRemoteStorageClient) ReadFileWithConcurrency(loc *remote_pb.Remot
 		Concurrency: uint16(concurrency),
 	})
 	if err != nil {
+		if bloberror.HasCode(err, bloberror.BlobNotFound) {
+			return nil, remote_storage.ErrRemoteObjectNotFound
+		}
 		return nil, fmt.Errorf("failed to download file %s%s: %w", loc.Bucket, loc.Path, err)
 	}
 	// Pre-sized buffer: a short read stays zero-padded. Reject it rather than
@@ -373,6 +403,9 @@ func (az *azureRemoteStorageClient) ReadFileAsStream(ctx context.Context, loc *r
 		},
 	})
 	if err != nil {
+		if bloberror.HasCode(err, bloberror.BlobNotFound) {
+			return nil, remote_storage.ErrRemoteObjectNotFound
+		}
 		return nil, fmt.Errorf("failed to open stream for %s%s: %v", loc.Bucket, loc.Path, err)
 	}
 	return downloadResponse.Body, nil
@@ -436,7 +469,7 @@ func (az *azureRemoteStorageClient) WriteFile(loc *remote_pb.RemoteStorageLocati
 
 	_, err = blobClient.UploadStream(context.Background(), reader, &blockblob.UploadStreamOptions{
 		BlockSize:   defaultBlockSize,
-		Concurrency: defaultConcurrency,
+		Concurrency: az.uploadConcurrency(),
 		HTTPHeaders: httpHeaders,
 		Metadata:    metadata,
 	})
@@ -469,38 +502,54 @@ func toMetadata(attributes map[string][]byte) map[string]*string {
 	return metadata
 }
 
-func (az *azureRemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (err error) {
+func (az *azureRemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (remoteEntry *filer_pb.RemoteEntry, err error) {
 	if reflect.DeepEqual(oldEntry.Extended, newEntry.Extended) {
-		return nil
+		return nil, nil
 	}
 	metadata := toMetadata(newEntry.Extended)
 
 	key := loc.Path[1:]
 	blobClient := az.client.ServiceClient().NewContainerClient(loc.Bucket).NewBlobClient(key)
 
+	updated := false
+	var writeETag *azcore.ETag
 	if !reflect.DeepEqual(toMetadata(oldEntry.Extended), metadata) {
-		if _, err = blobClient.SetMetadata(context.Background(), metadata, nil); err != nil {
-			return err
+		metaResp, metaErr := blobClient.SetMetadata(context.Background(), metadata, nil)
+		if metaErr != nil {
+			return nil, metaErr
 		}
+		writeETag = metaResp.ETag
+		updated = true
 	}
 
 	if encoding := remote_storage.EntryContentEncoding(newEntry); encoding != remote_storage.EntryContentEncoding(oldEntry) {
 		// SetHTTPHeaders replaces the whole header set, so carry the rest over
 		props, getErr := blobClient.GetProperties(context.Background(), nil)
 		if getErr != nil {
-			return fmt.Errorf("azure get properties %s%s: %w", loc.Bucket, loc.Path, getErr)
+			return nil, fmt.Errorf("azure get properties %s%s: %w", loc.Bucket, loc.Path, getErr)
 		}
 		httpHeaders := blob.ParseHTTPHeaders(props)
 		httpHeaders.BlobContentEncoding = nil
 		if encoding != "" {
 			httpHeaders.BlobContentEncoding = &encoding
 		}
-		if _, err = blobClient.SetHTTPHeaders(context.Background(), httpHeaders, nil); err != nil {
-			return fmt.Errorf("azure set http headers %s%s: %w", loc.Bucket, loc.Path, err)
+		hdrResp, hdrErr := blobClient.SetHTTPHeaders(context.Background(), httpHeaders, nil)
+		if hdrErr != nil {
+			return nil, fmt.Errorf("azure set http headers %s%s: %w", loc.Bucket, loc.Path, hdrErr)
 		}
+		writeETag = hdrResp.ETag
+		updated = true
 	}
-
-	return
+	if !updated {
+		return nil, nil
+	}
+	remoteEntry, err = az.StatFile(loc)
+	if err == nil && writeETag != nil {
+		// the stat can describe a concurrent replacement; the write response
+		// names the object this update produced
+		remoteEntry.RemoteETag = string(*writeETag)
+	}
+	return remoteEntry, err
 }
 
 func (az *azureRemoteStorageClient) DeleteFile(loc *remote_pb.RemoteStorageLocation) (err error) {
@@ -520,6 +569,45 @@ func (az *azureRemoteStorageClient) DeleteFile(loc *remote_pb.RemoteStorageLocat
 	return
 }
 
+// DeleteFileIfUnchanged deletes the blob only while it is still the one the
+// stat describes, enforced with an If-Match ETag precondition. A replacement
+// that lands between the stat and the delete fails the precondition instead
+// of being deleted.
+func (az *azureRemoteStorageClient) DeleteFileIfUnchanged(loc *remote_pb.RemoteStorageLocation, stamp *filer_pb.RemoteEntry) (bool, error) {
+	live, err := az.StatFile(loc)
+	if err != nil {
+		if errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+			return true, nil
+		}
+		return false, err
+	}
+	if !remote_storage.StillCurrent(stamp, live) {
+		return false, nil
+	}
+	key := loc.Path[1:]
+	blobClient := az.client.ServiceClient().NewContainerClient(loc.Bucket).NewBlobClient(key)
+	options := &blob.DeleteOptions{
+		DeleteSnapshots: to.Ptr(blob.DeleteSnapshotsOptionTypeInclude),
+	}
+	if live.RemoteETag != "" {
+		options.AccessConditions = &blob.AccessConditions{
+			ModifiedAccessConditions: &blob.ModifiedAccessConditions{
+				IfMatch: to.Ptr(azcore.ETag(live.RemoteETag)),
+			},
+		}
+	}
+	if _, err := blobClient.Delete(context.Background(), options); err != nil {
+		if bloberror.HasCode(err, bloberror.BlobNotFound) {
+			return true, nil
+		}
+		if bloberror.HasCode(err, bloberror.ConditionNotMet) {
+			return false, nil
+		}
+		return false, fmt.Errorf("azure delete %s%s: %w", loc.Bucket, loc.Path, err)
+	}
+	return true, nil
+}
+
 func (az *azureRemoteStorageClient) ListBuckets() (buckets []*remote_storage.Bucket, err error) {
 	pager := az.client.NewListContainersPager(nil)
 
diff --git a/weed/remote_storage/azure/azure_storage_client_test.go b/weed/remote_storage/azure/azure_storage_client_test.go
index eadba08c5e..5c58a7bd73 100644
--- a/weed/remote_storage/azure/azure_storage_client_test.go
+++ b/weed/remote_storage/azure/azure_storage_client_test.go
@@ -3,7 +3,10 @@ package azure
 import (
 	"bytes"
 	"fmt"
+	"io"
+	"net/http"
 	"os"
+	"strings"
 	"testing"
 	"time"
 
@@ -135,7 +138,7 @@ func TestAzureStorageClientBasic(t *testing.T) {
 				"x-amz-meta-new-key":  []byte("new-value"),
 			},
 		}
-		err := azClient.UpdateFileMetadata(loc, oldEntry, newEntry)
+		_, err := azClient.UpdateFileMetadata(loc, oldEntry, newEntry)
 		if err != nil {
 			t.Fatalf("Failed to update metadata: %v", err)
 		}
@@ -430,3 +433,53 @@ func TestAzureErrRemoteObjectNotFoundIsAccessible(t *testing.T) {
 	require.Error(t, remote_storage.ErrRemoteObjectNotFound)
 	require.Equal(t, "remote object not found", remote_storage.ErrRemoteObjectNotFound.Error())
 }
+
+// azureErrorRoundTripper answers every request with an Azure blob error.
+type azureErrorRoundTripper struct {
+	statusCode int
+	code       string
+}
+
+func (e *azureErrorRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+		_ = req.Body.Close()
+	}
+	body := `<?xml version="1.0" encoding="utf-8"?><Error><Code>` + e.code + `</Code><Message>m</Message></Error>`
+	return &http.Response{
+		StatusCode: e.statusCode,
+		Body:       io.NopCloser(strings.NewReader(body)),
+		Header: http.Header{
+			"Content-Type":    []string{"application/xml"},
+			"X-Ms-Error-Code": []string{e.code},
+		},
+		Request: req,
+	}, nil
+}
+
+func TestAzureReadNotFoundClassification(t *testing.T) {
+	loc := &remote_pb.RemoteStorageLocation{Name: "test", Bucket: "container", Path: "/obj.bin"}
+	tests := []struct {
+		name       string
+		statusCode int
+		code       string
+		size       int64
+		notFound   bool
+	}{
+		{"missing blob", http.StatusNotFound, "BlobNotFound", 10, true},
+		{"missing blob, read to end", http.StatusNotFound, "BlobNotFound", 0, true},
+		{"missing container", http.StatusNotFound, "ContainerNotFound", 10, false},
+		{"auth failure", http.StatusForbidden, "AuthenticationFailed", 10, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			conf := &remote_pb.RemoteConf{Name: "test", AzureAccountName: "testaccount", AzureAccountKey: "dGVzdGtleQ=="}
+			rs, err := MakeWithHTTPClient(conf, &http.Client{Transport: &azureErrorRoundTripper{statusCode: tt.statusCode, code: tt.code}})
+			require.NoError(t, err)
+
+			_, err = rs.ReadFile(loc, 0, tt.size)
+			require.Error(t, err)
+			require.Equal(t, tt.notFound, err == remote_storage.ErrRemoteObjectNotFound, "err: %v", err)
+		})
+	}
+}
diff --git a/weed/remote_storage/gcs/gcs_storage_client.go b/weed/remote_storage/gcs/gcs_storage_client.go
index 4b535d5148..20de17a645 100644
--- a/weed/remote_storage/gcs/gcs_storage_client.go
+++ b/weed/remote_storage/gcs/gcs_storage_client.go
@@ -2,15 +2,19 @@ package gcs
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"os"
 	"reflect"
+	"slices"
 	"strings"
 	"time"
 
 	"cloud.google.com/go/storage"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
@@ -18,6 +22,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google"
+	"google.golang.org/api/googleapi"
 	"google.golang.org/api/iterator"
 	"google.golang.org/api/option"
 	"google.golang.org/protobuf/proto"
@@ -27,6 +32,34 @@ func init() {
 	remote_storage.RemoteStorageClientMakers["gcs"] = new(gcsRemoteStorageMaker)
 }
 
+// defaultTokenURL is where the SDK sends the token request when the credentials
+// leave token_uri unset.
+const defaultTokenURL = "https://oauth2.googleapis.com/token"
+
+// StaticKeyCredentialTypes are the credential types that carry their own key
+// material. Every other type tells the SDK to fetch the token from a url, file
+// or executable named inside the credentials.
+var StaticKeyCredentialTypes = []string{
+	string(google.ServiceAccount),
+	string(google.AuthorizedUser),
+}
+
+// ParseInlineCredentials reports the credential type of an inline credentials
+// document and the token endpoint it makes the SDK dial.
+func ParseInlineCredentials(creds string) (credType string, tokenURL string, err error) {
+	var doc struct {
+		Type     string `json:"type"`
+		TokenURI string `json:"token_uri"`
+	}
+	if err := json.Unmarshal([]byte(creds), &doc); err != nil {
+		return "", "", fmt.Errorf("parse gcs credentials: %w", err)
+	}
+	if doc.TokenURI == "" {
+		return doc.Type, defaultTokenURL, nil
+	}
+	return doc.Type, doc.TokenURI, nil
+}
+
 type gcsRemoteStorageMaker struct{}
 
 func (s gcsRemoteStorageMaker) HasBucket() bool {
@@ -34,10 +67,24 @@ func (s gcsRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s gcsRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
+	return MakeWithHTTPClient(conf, nil)
+}
+
+// MakeWithHTTPClient builds a gcs client whose token exchange and object reads
+// both go through the supplied *http.Client (or the SDK default when nil).
+// Callers that need to pin the dial path against DNS rebinding pass a client
+// whose transport has a guarded DialContext, mirroring the S3 backend. Callers
+// handling credentials they do not control pass the types they accept.
+func MakeWithHTTPClient(conf *remote_pb.RemoteConf, httpClient *http.Client, allowedTypes ...string) (remote_storage.RemoteStorageClient, error) {
 	client := &gcsRemoteStorageClient{
 		conf: conf,
 	}
 
+	ctx := context.Background()
+	if httpClient != nil {
+		ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
+	}
+
 	googleApplicationCredentials := conf.GcsGoogleApplicationCredentials
 
 	if googleApplicationCredentials == "" {
@@ -71,15 +118,23 @@ func (s gcsRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.
 				return nil, fmt.Errorf("failed to read credentials file %s: %w", googleApplicationCredentials, err)
 			}
 		}
-		creds, err := google.CredentialsFromJSON(context.Background(), data, storage.ScopeFullControl)
+		credType, _, parseErr := ParseInlineCredentials(string(data))
+		if parseErr != nil {
+			return nil, parseErr
+		}
+		if len(allowedTypes) > 0 && !slices.Contains(allowedTypes, credType) {
+			return nil, fmt.Errorf("gcs credential type %q is not accepted here", credType)
+		}
+		// Declaring the type keeps the SDK from reading the document as anything
+		// else; the untyped loader is deprecated for exactly that reason.
+		creds, err := google.CredentialsFromJSONWithType(ctx, data, google.CredentialsType(credType), storage.ScopeFullControl)
 		if err != nil {
 			return nil, fmt.Errorf("failed to parse credentials: %w", err)
 		}
-		httpClient := oauth2.NewClient(context.Background(), creds.TokenSource)
-		clientOpts = append(clientOpts, option.WithHTTPClient(httpClient), option.WithoutAuthentication())
+		clientOpts = append(clientOpts, option.WithHTTPClient(oauth2.NewClient(ctx, creds.TokenSource)), option.WithoutAuthentication())
 	}
 
-	c, err := storage.NewClient(context.Background(), clientOpts...)
+	c, err := storage.NewClient(ctx, clientOpts...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create client: %w", err)
 	}
@@ -199,6 +254,9 @@ func (gcs *gcsRemoteStorageClient) ReadFile(loc *remote_pb.RemoteStorageLocation
 	// breaks range reads and returns sizes that disagree with RemoteSize
 	rangeReader, readErr := gcs.client.Bucket(loc.Bucket).Object(key).ReadCompressed(true).NewRangeReader(context.Background(), offset, size)
 	if readErr != nil {
+		if errors.Is(readErr, storage.ErrObjectNotExist) {
+			return nil, gcs.missingObjectError(context.Background(), loc)
+		}
 		return nil, readErr
 	}
 	data, err = io.ReadAll(rangeReader)
@@ -212,7 +270,37 @@ func (gcs *gcsRemoteStorageClient) ReadFile(loc *remote_pb.RemoteStorageLocation
 
 func (gcs *gcsRemoteStorageClient) ReadFileAsStream(ctx context.Context, loc *remote_pb.RemoteStorageLocation, offset int64, size int64) (reader io.ReadCloser, err error) {
 	key := loc.Path[1:]
-	return gcs.client.Bucket(loc.Bucket).Object(key).ReadCompressed(true).NewRangeReader(ctx, offset, size)
+	reader, err = gcs.client.Bucket(loc.Bucket).Object(key).ReadCompressed(true).NewRangeReader(ctx, offset, size)
+	if err != nil {
+		if errors.Is(err, storage.ErrObjectNotExist) {
+			return nil, gcs.missingObjectError(ctx, loc)
+		}
+		return nil, fmt.Errorf("failed to open stream for %s%s: %w", loc.Bucket, loc.Path, err)
+	}
+	return reader, nil
+}
+
+// missingObjectError confirms a read's ErrObjectNotExist before reporting the
+// object gone: GCS answers a read from a missing bucket the same way, and that
+// must not read as every object under the mount being deleted.
+func (gcs *gcsRemoteStorageClient) missingObjectError(ctx context.Context, loc *remote_pb.RemoteStorageLocation) error {
+	ctx, cancel := context.WithTimeout(ctx, defaultGCSOpTimeout)
+	defer cancel()
+	key := loc.Path[1:]
+	query := &storage.Query{Prefix: key}
+	if err := query.SetAttrSelection([]string{"Name"}); err != nil {
+		return fmt.Errorf("read gcs %s%s: %w", loc.Bucket, loc.Path, err)
+	}
+	attrs, err := gcs.client.Bucket(loc.Bucket).Objects(ctx, query).Next()
+	switch {
+	case errors.Is(err, iterator.Done):
+		return remote_storage.ErrRemoteObjectNotFound
+	case err != nil:
+		return fmt.Errorf("read gcs %s%s: object not found and bucket unconfirmed: %w", loc.Bucket, loc.Path, err)
+	case attrs.Name == key:
+		return fmt.Errorf("read gcs %s%s: object not found but listed", loc.Bucket, loc.Path)
+	}
+	return remote_storage.ErrRemoteObjectNotFound
 }
 
 func (gcs *gcsRemoteStorageClient) WriteDirectory(loc *remote_pb.RemoteStorageLocation, entry *filer_pb.Entry) (err error) {
@@ -261,6 +349,16 @@ func (gcs *gcsRemoteStorageClient) WriteFile(loc *remote_pb.RemoteStorageLocatio
 		wc.ContentType = entry.Attributes.Mime
 	}
 	wc.ContentEncoding = remote_storage.EntryContentEncoding(entry)
+	// A Writer reserves a buffer of ChunkSize bytes (16 MiB by default) so a
+	// failed request can be retried. An object below that size takes a buffer
+	// of its own size plus one 256 KiB unit, the SDK's granularity: a burst of
+	// small uploads in flight does not hold 16 MiB each, every upload keeps
+	// its retry buffer, and the object stays below ChunkSize so it goes in one
+	// request rather than a resumable session. The size counts the chunks,
+	// not only the attribute, which some write paths leave at zero.
+	if size := filer.FileSize(entry); size < uint64(googleapi.DefaultUploadChunkSize) {
+		wc.ChunkSize = int((size/googleapi.MinUploadChunkSize + 1) * googleapi.MinUploadChunkSize)
+	}
 	if _, err = io.Copy(wc, reader); err != nil {
 		return nil, fmt.Errorf("upload to gcs %s/%s%s: %v", loc.Name, loc.Bucket, loc.Path, err)
 	}
@@ -288,9 +386,9 @@ func toMetadata(attributes map[string][]byte) map[string]string {
 	return metadata
 }
 
-func (gcs *gcsRemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (err error) {
+func (gcs *gcsRemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (remoteEntry *filer_pb.RemoteEntry, err error) {
 	if reflect.DeepEqual(oldEntry.Extended, newEntry.Extended) {
-		return nil
+		return nil, nil
 	}
 	attrsToUpdate := storage.ObjectAttrsToUpdate{}
 	if metadata := toMetadata(newEntry.Extended); len(metadata) > 0 {
@@ -303,11 +401,14 @@ func (gcs *gcsRemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStora
 	}
 
 	if attrsToUpdate.Metadata == nil && attrsToUpdate.ContentEncoding == nil {
-		return nil
+		return nil, nil
 	}
 	key := loc.Path[1:]
-	_, err = gcs.client.Bucket(loc.Bucket).Object(key).Update(context.Background(), attrsToUpdate)
-	return
+	attr, err := gcs.client.Bucket(loc.Bucket).Object(key).Update(context.Background(), attrsToUpdate)
+	if err != nil {
+		return nil, err
+	}
+	return gcs.toRemoteEntry(attr), nil
 }
 func (gcs *gcsRemoteStorageClient) DeleteFile(loc *remote_pb.RemoteStorageLocation) (err error) {
 	key := loc.Path[1:]
@@ -320,6 +421,38 @@ func (gcs *gcsRemoteStorageClient) DeleteFile(loc *remote_pb.RemoteStorageLocati
 	return
 }
 
+// DeleteFileIfUnchanged deletes the object only while it is still the one the
+// stat describes, enforced with a generation precondition. A replacement that
+// lands between the stat and the delete gets a new generation and fails the
+// precondition instead of being deleted.
+func (gcs *gcsRemoteStorageClient) DeleteFileIfUnchanged(loc *remote_pb.RemoteStorageLocation, stamp *filer_pb.RemoteEntry) (bool, error) {
+	key := loc.Path[1:]
+	object := gcs.client.Bucket(loc.Bucket).Object(key)
+	ctx, cancel := context.WithTimeout(context.Background(), defaultGCSOpTimeout)
+	defer cancel()
+	attr, err := object.Attrs(ctx)
+	if err != nil {
+		if errors.Is(err, storage.ErrObjectNotExist) {
+			return true, nil
+		}
+		return false, fmt.Errorf("stat gcs %s%s: %w", loc.Bucket, loc.Path, err)
+	}
+	if !remote_storage.StillCurrent(stamp, gcs.toRemoteEntry(attr)) {
+		return false, nil
+	}
+	if err := object.If(storage.Conditions{GenerationMatch: attr.Generation}).Delete(ctx); err != nil {
+		if errors.Is(err, storage.ErrObjectNotExist) {
+			return true, nil
+		}
+		var gerr *googleapi.Error
+		if errors.As(err, &gerr) && gerr.Code == http.StatusPreconditionFailed {
+			return false, nil
+		}
+		return false, fmt.Errorf("gcs delete %s%s: %w", loc.Bucket, key, err)
+	}
+	return true, nil
+}
+
 func (gcs *gcsRemoteStorageClient) ListBuckets() (buckets []*remote_storage.Bucket, err error) {
 	if gcs.projectID == "" {
 		return nil, fmt.Errorf("gcs project id or GOOGLE_CLOUD_PROJECT env variable not set")
diff --git a/weed/remote_storage/gcs/gcs_storage_client_test.go b/weed/remote_storage/gcs/gcs_storage_client_test.go
index 8e74a25a85..7ca67dac3c 100644
--- a/weed/remote_storage/gcs/gcs_storage_client_test.go
+++ b/weed/remote_storage/gcs/gcs_storage_client_test.go
@@ -1,10 +1,19 @@
 package gcs
 
 import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
 	"testing"
 
+	"cloud.google.com/go/storage"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/api/option"
 )
 
 func TestGCSRemoteStorageClientImplementsInterface(t *testing.T) {
@@ -15,3 +24,86 @@ func TestGCSErrRemoteObjectNotFoundIsAccessible(t *testing.T) {
 	require.Error(t, remote_storage.ErrRemoteObjectNotFound)
 	require.Equal(t, "remote object not found", remote_storage.ErrRemoteObjectNotFound.Error())
 }
+
+// TestMakeWithHTTPClientAllowedTypes covers the restriction a caller applies to
+// credentials it does not control: a federated document never reaches the SDK,
+// while an unrestricted caller keeps loading whatever the operator configured.
+func TestMakeWithHTTPClientAllowedTypes(t *testing.T) {
+	federated := `{"type":"external_account","audience":"a","subject_token_type":"t","token_url":"http://127.0.0.1:9/v1/token","credential_source":{"url":"http://169.254.169.254/"}}`
+	conf := &remote_pb.RemoteConf{Type: "gcs", GcsGoogleApplicationCredentials: federated}
+
+	_, err := MakeWithHTTPClient(conf, nil, StaticKeyCredentialTypes...)
+	require.ErrorContains(t, err, `"external_account" is not accepted`)
+
+	_, err = MakeWithHTTPClient(conf, nil)
+	require.NoError(t, err)
+}
+
+func TestParseInlineCredentials(t *testing.T) {
+	credType, tokenURL, err := ParseInlineCredentials(`{"type":"service_account"}`)
+	require.NoError(t, err)
+	require.Equal(t, "service_account", credType)
+	require.Equal(t, defaultTokenURL, tokenURL)
+
+	_, tokenURL, err = ParseInlineCredentials(`{"type":"service_account","token_uri":"https://example.com/t"}`)
+	require.NoError(t, err)
+	require.Equal(t, "https://example.com/t", tokenURL)
+
+	_, _, err = ParseInlineCredentials(`not json`)
+	require.Error(t, err)
+}
+
+// fakeGCS answers object reads with readStatus and the JSON object listing
+// with listStatus/listBody, counting listings.
+type fakeGCS struct {
+	readStatus int
+	listStatus int
+	listBody   string
+	listCalls  atomic.Int32
+}
+
+func (f *fakeGCS) client(t *testing.T) *gcsRemoteStorageClient {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/storage/v1/b/") && strings.HasSuffix(r.URL.Path, "/o") {
+			f.listCalls.Add(1)
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(f.listStatus)
+			_, _ = io.WriteString(w, f.listBody)
+			return
+		}
+		w.WriteHeader(f.readStatus)
+	}))
+	t.Cleanup(srv.Close)
+	client, err := storage.NewClient(context.Background(), option.WithEndpoint(srv.URL+"/storage/v1/"), option.WithoutAuthentication())
+	require.NoError(t, err)
+	t.Cleanup(func() { client.Close() })
+	return &gcsRemoteStorageClient{conf: &remote_pb.RemoteConf{Name: "test"}, client: client}
+}
+
+func TestGCSReadNotFoundClassification(t *testing.T) {
+	loc := &remote_pb.RemoteStorageLocation{Name: "test", Bucket: "bucket", Path: "/dir/obj.bin"}
+	tests := []struct {
+		name      string
+		gcs       *fakeGCS
+		notFound  bool
+		wantLists int32
+	}{
+		{"missing object", &fakeGCS{readStatus: http.StatusNotFound, listStatus: http.StatusOK, listBody: `{"items":[{"name":"dir/obj.bin.bak"}]}`}, true, 2},
+		{"missing bucket", &fakeGCS{readStatus: http.StatusNotFound, listStatus: http.StatusNotFound, listBody: `{"error":{"code":404}}`}, false, 2},
+		{"bucket listing denied", &fakeGCS{readStatus: http.StatusNotFound, listStatus: http.StatusForbidden, listBody: `{"error":{"code":403}}`}, false, 2},
+		{"object listed after the read missed it", &fakeGCS{readStatus: http.StatusNotFound, listStatus: http.StatusOK, listBody: `{"items":[{"name":"dir/obj.bin"}]}`}, false, 2},
+		{"read denied", &fakeGCS{readStatus: http.StatusForbidden}, false, 0},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			client := tt.gcs.client(t)
+
+			_, err := client.ReadFile(loc, 0, 10)
+			require.Equal(t, tt.notFound, err == remote_storage.ErrRemoteObjectNotFound, "ReadFile: %v", err)
+			_, err = client.ReadFileAsStream(context.Background(), loc, 0, 10)
+			require.Equal(t, tt.notFound, err == remote_storage.ErrRemoteObjectNotFound, "ReadFileAsStream: %v", err)
+			require.Equal(t, tt.wantLists, tt.gcs.listCalls.Load())
+		})
+	}
+}
diff --git a/weed/remote_storage/remote_storage.go b/weed/remote_storage/remote_storage.go
index 5e84548593..73f568f5a8 100644
--- a/weed/remote_storage/remote_storage.go
+++ b/weed/remote_storage/remote_storage.go
@@ -26,6 +26,28 @@ func ParseLocationName(remote string) (locationName string) {
 	return
 }
 
+// Describes reports whether a stored remote entry's stamp still describes the
+// live remote object: same size, and equal ETags when both are known.
+func Describes(stamp, object *filer_pb.RemoteEntry) bool {
+	if stamp == nil || object == nil || stamp.RemoteSize != object.RemoteSize {
+		return false
+	}
+	return stamp.RemoteETag == "" || object.RemoteETag == "" || stamp.RemoteETag == object.RemoteETag
+}
+
+// StillCurrent reports whether live can still be the object the stored stamp
+// described: not newer than the stamp, matching it on size, and not having
+// dropped an ETag the stamp carried.
+func StillCurrent(stamp, live *filer_pb.RemoteEntry) bool {
+	if live != nil && live.RemoteMtime > stamp.GetRemoteMtime() {
+		return false
+	}
+	if !Describes(stamp, live) {
+		return false
+	}
+	return stamp.GetRemoteETag() == "" || live.RemoteETag != ""
+}
+
 func parseBucketLocation(remote string) (loc *remote_pb.RemoteStorageLocation) {
 	loc = &remote_pb.RemoteStorageLocation{}
 	remote = strings.TrimSuffix(remote, slash)
@@ -80,7 +102,7 @@ type Bucket struct {
 	CreatedAt time.Time
 }
 
-// ErrRemoteObjectNotFound is returned by StatFile when the object does not exist in the remote storage backend.
+// ErrRemoteObjectNotFound is returned by StatFile and the ReadFile variants when the object does not exist in the remote storage backend.
 var ErrRemoteObjectNotFound = errors.New("remote object not found")
 
 type RemoteStorageClient interface {
@@ -91,7 +113,11 @@ type RemoteStorageClient interface {
 	WriteDirectory(loc *remote_pb.RemoteStorageLocation, entry *filer_pb.Entry) (err error)
 	RemoveDirectory(loc *remote_pb.RemoteStorageLocation) (err error)
 	WriteFile(loc *remote_pb.RemoteStorageLocation, entry *filer_pb.Entry, reader io.Reader) (remoteEntry *filer_pb.RemoteEntry, err error)
-	UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (err error)
+	// UpdateFileMetadata returns the stamp of the object the update produced —
+	// a backend that rewrites the object to change its metadata can give it a
+	// new ETag or mtime — or nil when the object was not rewritten. Callers
+	// restamp their entries from the result and keep the previous stamp on nil.
+	UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (remoteEntry *filer_pb.RemoteEntry, err error)
 	DeleteFile(loc *remote_pb.RemoteStorageLocation) (err error)
 	ListBuckets() ([]*Bucket, error)
 	CreateBucket(name string) (err error)
@@ -110,6 +136,41 @@ type RemoteStorageStreamReader interface {
 	ReadFileAsStream(ctx context.Context, loc *remote_pb.RemoteStorageLocation, offset int64, size int64) (reader io.ReadCloser, err error)
 }
 
+// RemoteStorageObjectCopier is an optional interface for remote storage clients
+// that copy an object to another key within the storage, without the content
+// passing through the client. A rename of an entry whose content exists only
+// on the remote needs it.
+type RemoteStorageObjectCopier interface {
+	CopyFile(src *remote_pb.RemoteStorageLocation, dst *remote_pb.RemoteStorageLocation) (remoteEntry *filer_pb.RemoteEntry, err error)
+}
+
+// RemoteStorageConditionalDeleter is an optional interface for remote storage
+// clients whose backend can delete an object only while it is still the one a
+// stat described, enforced with a backend version precondition (S3 and Azure:
+// ETag, GCS: generation). deleted is false without an error when the object
+// differs from stamp or changed between the stat and the delete.
+type RemoteStorageConditionalDeleter interface {
+	DeleteFileIfUnchanged(loc *remote_pb.RemoteStorageLocation, stamp *filer_pb.RemoteEntry) (deleted bool, err error)
+}
+
+// CacheWaitTimeout is how long a read of an uncached remote-only object waits
+// for the local cache before serving another way: small files wait longer since
+// their cache completes quickly, large files fail fast for better TTFB. A mount
+// carrying cache_wait_ms replaces the size tiers, and 0 means never wait.
+func CacheWaitTimeout(remoteSize int64, mountedLocation *remote_pb.RemoteStorageLocation) time.Duration {
+	if mountedLocation != nil && mountedLocation.CacheWaitMs != nil {
+		return max(0, time.Duration(*mountedLocation.CacheWaitMs)*time.Millisecond)
+	}
+	switch {
+	case remoteSize > 500*1024*1024:
+		return 2 * time.Second
+	case remoteSize > 0 && remoteSize < 50*1024*1024:
+		return 10 * time.Second
+	default:
+		return 5 * time.Second
+	}
+}
+
 type RemoteStorageClientMaker interface {
 	Make(remoteConf *remote_pb.RemoteConf) (RemoteStorageClient, error)
 	HasBucket() bool
diff --git a/weed/remote_storage/remote_storage_test.go b/weed/remote_storage/remote_storage_test.go
new file mode 100644
index 0000000000..6417cc65dd
--- /dev/null
+++ b/weed/remote_storage/remote_storage_test.go
@@ -0,0 +1,54 @@
+package remote_storage
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestCacheWaitTimeout(t *testing.T) {
+	tests := []struct {
+		name            string
+		remoteSize      int64
+		mountedLocation *remote_pb.RemoteStorageLocation
+		want            time.Duration
+	}{
+		{name: "large file fails fast", remoteSize: 600 * 1024 * 1024, want: 2 * time.Second},
+		{name: "small file waits longer", remoteSize: 1024, want: 10 * time.Second},
+		{name: "medium file", remoteSize: 100 * 1024 * 1024, want: 5 * time.Second},
+		{name: "unknown size", want: 5 * time.Second},
+		{
+			name:            "mount replaces the size tier",
+			remoteSize:      600 * 1024 * 1024,
+			mountedLocation: &remote_pb.RemoteStorageLocation{CacheWaitMs: proto.Int32(30000)},
+			want:            30 * time.Second,
+		},
+		{
+			name:            "mount opts out of caching",
+			remoteSize:      1024,
+			mountedLocation: &remote_pb.RemoteStorageLocation{CacheWaitMs: proto.Int32(0)},
+			want:            0,
+		},
+		{
+			name:            "negative wait never waits",
+			remoteSize:      1024,
+			mountedLocation: &remote_pb.RemoteStorageLocation{CacheWaitMs: proto.Int32(-1)},
+			want:            0,
+		},
+		{
+			name:            "unset wait keeps the size tier",
+			remoteSize:      600 * 1024 * 1024,
+			mountedLocation: &remote_pb.RemoteStorageLocation{},
+			want:            2 * time.Second,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := CacheWaitTimeout(tt.remoteSize, tt.mountedLocation); got != tt.want {
+				t.Errorf("CacheWaitTimeout(%d) = %v, want %v", tt.remoteSize, got, tt.want)
+			}
+		})
+	}
+}
diff --git a/weed/remote_storage/s3/aliyun.go b/weed/remote_storage/s3/aliyun.go
index 6954c26693..f32a5c0306 100644
--- a/weed/remote_storage/s3/aliyun.go
+++ b/weed/remote_storage/s3/aliyun.go
@@ -1,16 +1,8 @@
 package s3
 
 import (
-	"fmt"
-	"os"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 func init() {
@@ -24,27 +16,5 @@ func (s AliyunRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s AliyunRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	accessKey := util.Nvl(conf.AliyunAccessKey, os.Getenv("ALICLOUD_ACCESS_KEY_ID"))
-	secretKey := util.Nvl(conf.AliyunSecretKey, os.Getenv("ALICLOUD_ACCESS_KEY_SECRET"))
-
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.AliyunEndpoint),
-		Region:                        aws.String(conf.AliyunRegion),
-		S3ForcePathStyle:              aws.Bool(false),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if accessKey != "" && secretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(accessKey, secretKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create aliyun session: %w", err)
-	}
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/s3/backblaze.go b/weed/remote_storage/s3/backblaze.go
index d8cfbeb154..64a50e636b 100644
--- a/weed/remote_storage/s3/backblaze.go
+++ b/weed/remote_storage/s3/backblaze.go
@@ -1,12 +1,6 @@
 package s3
 
 import (
-	"fmt"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
 )
@@ -22,24 +16,5 @@ func (s BackBlazeRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s BackBlazeRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.BackblazeEndpoint),
-		Region:                        aws.String(conf.BackblazeRegion),
-		S3ForcePathStyle:              aws.Bool(true),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if conf.BackblazeKeyId != "" && conf.BackblazeApplicationKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(conf.BackblazeKeyId, conf.BackblazeApplicationKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create backblaze session: %w", err)
-	}
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/s3/baidu.go b/weed/remote_storage/s3/baidu.go
index 285e095c30..7844c7c0ff 100644
--- a/weed/remote_storage/s3/baidu.go
+++ b/weed/remote_storage/s3/baidu.go
@@ -1,17 +1,8 @@
 package s3
 
 import (
-	"fmt"
-	"os"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 func init() {
@@ -25,28 +16,5 @@ func (s BaiduRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s BaiduRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	accessKey := util.Nvl(conf.BaiduAccessKey, os.Getenv("BDCLOUD_ACCESS_KEY"))
-	secretKey := util.Nvl(conf.BaiduSecretKey, os.Getenv("BDCLOUD_SECRET_KEY"))
-
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.BaiduEndpoint),
-		Region:                        aws.String(conf.BaiduRegion),
-		S3ForcePathStyle:              aws.Bool(false),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if accessKey != "" && secretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(accessKey, secretKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create baidu session: %w", err)
-	}
-	sess.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/s3/contabo.go b/weed/remote_storage/s3/contabo.go
index d20a8ec0ad..2a0883fb44 100644
--- a/weed/remote_storage/s3/contabo.go
+++ b/weed/remote_storage/s3/contabo.go
@@ -1,16 +1,8 @@
 package s3
 
 import (
-	"fmt"
-	"os"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 func init() {
@@ -24,27 +16,5 @@ func (s ContaboRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s ContaboRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	accessKey := util.Nvl(conf.ContaboAccessKey, os.Getenv("ACCESS_KEY"))
-	secretKey := util.Nvl(conf.ContaboSecretKey, os.Getenv("SECRET_KEY"))
-
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.ContaboEndpoint),
-		Region:                        aws.String(conf.ContaboRegion),
-		S3ForcePathStyle:              aws.Bool(true),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if accessKey != "" && secretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(accessKey, secretKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create contabo session: %w", err)
-	}
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/s3/endpoint_test.go b/weed/remote_storage/s3/endpoint_test.go
new file mode 100644
index 0000000000..85a9c06822
--- /dev/null
+++ b/weed/remote_storage/s3/endpoint_test.go
@@ -0,0 +1,44 @@
+package s3
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+)
+
+// TestS3CompatibleEndpointCoversAllProviders locks the type-to-endpoint mapping
+// the volume server's SSRF guard relies on. Every S3-SDK-backed provider dials
+// a caller-supplied endpoint, so each must surface it here; a new sibling that
+// forgets to would silently bypass the guard.
+func TestS3CompatibleEndpointCoversAllProviders(t *testing.T) {
+	cases := []struct {
+		conf *remote_pb.RemoteConf
+		want string
+	}{
+		{&remote_pb.RemoteConf{Type: "s3", S3Endpoint: "http://s3.internal"}, "http://s3.internal"},
+		{&remote_pb.RemoteConf{Type: "wasabi", WasabiEndpoint: "http://wasabi.internal"}, "http://wasabi.internal"},
+		{&remote_pb.RemoteConf{Type: "b2", BackblazeEndpoint: "http://b2.internal"}, "http://b2.internal"},
+		{&remote_pb.RemoteConf{Type: "aliyun", AliyunEndpoint: "http://aliyun.internal"}, "http://aliyun.internal"},
+		{&remote_pb.RemoteConf{Type: "tencent", TencentEndpoint: "http://tencent.internal"}, "http://tencent.internal"},
+		{&remote_pb.RemoteConf{Type: "baidu", BaiduEndpoint: "http://baidu.internal"}, "http://baidu.internal"},
+		{&remote_pb.RemoteConf{Type: "filebase", FilebaseEndpoint: "http://filebase.internal"}, "http://filebase.internal"},
+		{&remote_pb.RemoteConf{Type: "storj", StorjEndpoint: "http://storj.internal"}, "http://storj.internal"},
+		{&remote_pb.RemoteConf{Type: "contabo", ContaboEndpoint: "http://contabo.internal"}, "http://contabo.internal"},
+	}
+	for _, tc := range cases {
+		endpoint, ok := S3CompatibleEndpoint(tc.conf)
+		if !ok {
+			t.Errorf("type %q: expected an S3-compatible endpoint, got ok=false", tc.conf.Type)
+			continue
+		}
+		if endpoint != tc.want {
+			t.Errorf("type %q: endpoint = %q, want %q", tc.conf.Type, endpoint, tc.want)
+		}
+	}
+
+	// Every registered maker must be an S3-compatible type; the guard treats
+	// anything else (gcs, azure, ...) as not dialing a caller-supplied URL.
+	if _, ok := S3CompatibleEndpoint(&remote_pb.RemoteConf{Type: "gcs"}); ok {
+		t.Error("gcs must not be reported as an S3-compatible endpoint")
+	}
+}
diff --git a/weed/remote_storage/s3/filebase.go b/weed/remote_storage/s3/filebase.go
index 89b96e3853..23fc508341 100644
--- a/weed/remote_storage/s3/filebase.go
+++ b/weed/remote_storage/s3/filebase.go
@@ -1,17 +1,8 @@
 package s3
 
 import (
-	"fmt"
-	"os"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 func init() {
@@ -25,28 +16,5 @@ func (s FilebaseRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s FilebaseRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	accessKey := util.Nvl(conf.FilebaseAccessKey, os.Getenv("AWS_ACCESS_KEY_ID"))
-	secretKey := util.Nvl(conf.FilebaseSecretKey, os.Getenv("AWS_SECRET_ACCESS_KEY"))
-
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.FilebaseEndpoint),
-		Region:                        aws.String("us-east-1"),
-		S3ForcePathStyle:              aws.Bool(true),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if accessKey != "" && secretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(accessKey, secretKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create filebase session: %w", err)
-	}
-	sess.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/s3/s3_storage_client.go b/weed/remote_storage/s3/s3_storage_client.go
index 1ca6066339..9641195ea0 100644
--- a/weed/remote_storage/s3/s3_storage_client.go
+++ b/weed/remote_storage/s3/s3_storage_client.go
@@ -2,10 +2,12 @@ package s3
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/url"
+	"os"
 	"reflect"
 	"strings"
 
@@ -41,50 +43,253 @@ func (s s3RemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.R
 	return MakeWithHTTPClient(conf, nil)
 }
 
-// MakeWithHTTPClient builds an s3 remote storage client using the supplied
-// *http.Client (or the AWS SDK default when nil). Callers that need to pin
-// the dial path against DNS rebinding can pass a client whose transport has
-// a guarded DialContext.
+// s3CompatibleOptions carries the per-provider AWS SDK knobs the shared client
+// builder needs. Every S3-SDK-backed provider (s3 plus the wasabi/b2/... family)
+// converges on the same s3RemoteStorageClient and dials a caller-supplied
+// endpoint, differing only in which RemoteConf fields it reads.
+type s3CompatibleOptions struct {
+	name           string
+	endpoint       string
+	region         string
+	accessKey      string
+	secretKey      string
+	forcePathStyle bool
+	signV4         bool
+	// anonymousWhenNoCreds disables SigV4 signing for public buckets when no
+	// credentials are supplied. Only the generic "s3" provider does this.
+	anonymousWhenNoCreds bool
+	// setUserAgent adds the SeaweedFS User-Agent header (generic "s3" only).
+	setUserAgent bool
+}
+
+// s3CompatibleClientOptions returns the client knobs for an S3-SDK-backed
+// RemoteConf and whether conf is such a type. Keeping the type-to-fields
+// mapping in one place lets the client builder and the SSRF endpoint guard
+// agree on exactly which endpoint each provider dials.
+func s3CompatibleClientOptions(conf *remote_pb.RemoteConf) (s3CompatibleOptions, bool) {
+	switch conf.Type {
+	case "s3":
+		return s3CompatibleOptions{
+			name:                 "s3",
+			endpoint:             conf.S3Endpoint,
+			region:               conf.S3Region,
+			accessKey:            conf.S3AccessKey,
+			secretKey:            conf.S3SecretKey,
+			forcePathStyle:       conf.S3ForcePathStyle,
+			signV4:               conf.S3V4Signature,
+			anonymousWhenNoCreds: true,
+			setUserAgent:         true,
+		}, true
+	case "aliyun":
+		return s3CompatibleOptions{
+			name:      "aliyun",
+			endpoint:  conf.AliyunEndpoint,
+			region:    conf.AliyunRegion,
+			accessKey: util.Nvl(conf.AliyunAccessKey, os.Getenv("ALICLOUD_ACCESS_KEY_ID")),
+			secretKey: util.Nvl(conf.AliyunSecretKey, os.Getenv("ALICLOUD_ACCESS_KEY_SECRET")),
+		}, true
+	case "b2":
+		return s3CompatibleOptions{
+			name:           "backblaze",
+			endpoint:       conf.BackblazeEndpoint,
+			region:         conf.BackblazeRegion,
+			accessKey:      conf.BackblazeKeyId,
+			secretKey:      conf.BackblazeApplicationKey,
+			forcePathStyle: true,
+		}, true
+	case "baidu":
+		return s3CompatibleOptions{
+			name:      "baidu",
+			endpoint:  conf.BaiduEndpoint,
+			region:    conf.BaiduRegion,
+			accessKey: util.Nvl(conf.BaiduAccessKey, os.Getenv("BDCLOUD_ACCESS_KEY")),
+			secretKey: util.Nvl(conf.BaiduSecretKey, os.Getenv("BDCLOUD_SECRET_KEY")),
+			signV4:    true,
+		}, true
+	case "contabo":
+		return s3CompatibleOptions{
+			name:           "contabo",
+			endpoint:       conf.ContaboEndpoint,
+			region:         conf.ContaboRegion,
+			accessKey:      util.Nvl(conf.ContaboAccessKey, os.Getenv("ACCESS_KEY")),
+			secretKey:      util.Nvl(conf.ContaboSecretKey, os.Getenv("SECRET_KEY")),
+			forcePathStyle: true,
+		}, true
+	case "filebase":
+		return s3CompatibleOptions{
+			name:           "filebase",
+			endpoint:       conf.FilebaseEndpoint,
+			region:         "us-east-1",
+			accessKey:      util.Nvl(conf.FilebaseAccessKey, os.Getenv("AWS_ACCESS_KEY_ID")),
+			secretKey:      util.Nvl(conf.FilebaseSecretKey, os.Getenv("AWS_SECRET_ACCESS_KEY")),
+			forcePathStyle: true,
+			signV4:         true,
+		}, true
+	case "storj":
+		return s3CompatibleOptions{
+			name:           "storj",
+			endpoint:       conf.StorjEndpoint,
+			region:         "us-west-2",
+			accessKey:      util.Nvl(conf.StorjAccessKey, os.Getenv("AWS_ACCESS_KEY_ID")),
+			secretKey:      util.Nvl(conf.StorjSecretKey, os.Getenv("AWS_SECRET_ACCESS_KEY")),
+			forcePathStyle: true,
+		}, true
+	case "tencent":
+		return s3CompatibleOptions{
+			name:           "tencent",
+			endpoint:       conf.TencentEndpoint,
+			region:         "us-west-2",
+			accessKey:      util.Nvl(conf.TencentSecretId, os.Getenv("COS_SECRETID")),
+			secretKey:      util.Nvl(conf.TencentSecretKey, os.Getenv("COS_SECRETKEY")),
+			forcePathStyle: true,
+		}, true
+	case "wasabi":
+		return s3CompatibleOptions{
+			name:           "wasabi",
+			endpoint:       conf.WasabiEndpoint,
+			region:         conf.WasabiRegion,
+			accessKey:      conf.WasabiAccessKey,
+			secretKey:      conf.WasabiSecretKey,
+			forcePathStyle: true,
+		}, true
+	}
+	return s3CompatibleOptions{}, false
+}
+
+// S3CompatibleEndpoint returns the endpoint an S3-SDK-backed RemoteConf would
+// dial directly, and whether conf is such a type. The volume server validates
+// this endpoint against the SSRF deny-list for every S3-compatible provider,
+// not just the generic "s3" type.
+func S3CompatibleEndpoint(conf *remote_pb.RemoteConf) (string, bool) {
+	opt, ok := s3CompatibleClientOptions(conf)
+	if !ok {
+		return "", false
+	}
+	return opt.endpoint, true
+}
+
+// awsCredentialSourceConfigured reports whether the environment names a source
+// for the AWS SDK default credential chain, such as static keys, a profile,
+// IRSA web identity or the ECS/EKS container credentials endpoint.
+func awsCredentialSourceConfigured() bool {
+	for _, name := range []string{
+		"AWS_ACCESS_KEY_ID",
+		"AWS_PROFILE",
+		"AWS_DEFAULT_PROFILE",
+		"AWS_WEB_IDENTITY_TOKEN_FILE",
+		"AWS_CONTAINER_CREDENTIALS_FULL_URI",
+		"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+		"AWS_SHARED_CREDENTIALS_FILE",
+		"AWS_CONFIG_FILE",
+	} {
+		if os.Getenv(name) != "" {
+			return true
+		}
+	}
+	return false
+}
+
+// MakeWithHTTPClient builds the client for any S3-SDK-backed remote storage
+// type using the supplied *http.Client (or the AWS SDK default when nil).
+// Callers that need to pin the dial path against DNS rebinding can pass a
+// client whose transport has a guarded DialContext.
 func MakeWithHTTPClient(conf *remote_pb.RemoteConf, httpClient *http.Client) (remote_storage.RemoteStorageClient, error) {
+	opt, ok := s3CompatibleClientOptions(conf)
+	if !ok {
+		return nil, fmt.Errorf("%q is not an S3-compatible remote storage type", conf.Type)
+	}
 	client := &s3RemoteStorageClient{
 		conf: conf,
 	}
 	config := &aws.Config{
-		Region:                        aws.String(conf.S3Region),
-		Endpoint:                      aws.String(conf.S3Endpoint),
-		S3ForcePathStyle:              aws.Bool(conf.S3ForcePathStyle),
+		Region:                        aws.String(opt.region),
+		Endpoint:                      aws.String(opt.endpoint),
+		S3ForcePathStyle:              aws.Bool(opt.forcePathStyle),
 		S3DisableContentMD5Validation: aws.Bool(true),
 	}
 	if httpClient != nil {
 		config.HTTPClient = httpClient
 	}
-	if conf.S3AccessKey != "" && conf.S3SecretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(conf.S3AccessKey, conf.S3SecretKey, "")
-	} else if conf.S3AccessKey == "" && conf.S3SecretKey == "" {
-		// Explicitly disable signing for public buckets.
+	if opt.accessKey != "" && opt.secretKey != "" {
+		config.Credentials = credentials.NewStaticCredentials(opt.accessKey, opt.secretKey, "")
+	} else if opt.anonymousWhenNoCreds && opt.accessKey == "" && opt.secretKey == "" && !awsCredentialSourceConfigured() {
+		// Explicitly disable signing for public buckets. When the environment
+		// names an AWS credential source, leave Credentials nil so the SDK
+		// default chain (env, web identity, container, shared profile) is used.
 		config.Credentials = credentials.AnonymousCredentials
+	} else if config.Credentials == nil && config.HTTPClient != nil {
+		// Remote credential providers (container endpoints, IMDS, web
+		// identity) fetch through this HTTP client; the guarded one is for the
+		// S3 endpoint and blocks the link-local credential endpoints, so the
+		// default chain resolves on an unguarded client. Shared config stays
+		// enabled so web identity and profiles resolve here too, and the
+		// region carries over so STS can sign assume-role requests.
+		credSess, err := session.NewSessionWithOptions(session.Options{
+			Config:            aws.Config{Region: config.Region, HTTPClient: &http.Client{}},
+			SharedConfigState: session.SharedConfigEnable,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("create %s credential session: %w", opt.name, err)
+		}
+		config.Credentials = credSess.Config.Credentials
 	}
 
-	sess, err := session.NewSession(config)
+	sess, err := session.NewSessionWithOptions(session.Options{
+		Config:            *config,
+		SharedConfigState: session.SharedConfigEnable,
+	})
 	if err != nil {
-		return nil, fmt.Errorf("create aws session: %w", err)
+		return nil, fmt.Errorf("create %s session: %w", opt.name, err)
 	}
-	if conf.S3V4Signature {
+	if opt.signV4 {
 		sess.Handlers.Sign.PushBackNamed(v4.SignRequestHandler)
 	}
-	sess.Handlers.Build.PushBack(func(r *request.Request) {
-		r.HTTPRequest.Header.Set("User-Agent", "SeaweedFS/"+version.VERSION_NUMBER)
-	})
+	if opt.setUserAgent {
+		sess.Handlers.Build.PushBack(func(r *request.Request) {
+			r.HTTPRequest.Header.Set("User-Agent", "SeaweedFS/"+version.VERSION_NUMBER)
+		})
+	}
 	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
 	client.conn = s3.New(sess)
 	return client, nil
 }
 
+var skipSha256PayloadSigning = func(r *request.Request) {
+	// see https://github.com/ceph/ceph/pull/15965/files
+	if r.ClientInfo.ServiceID != "S3" {
+		return
+	}
+	if r.Operation.Name == "PutObject" || r.Operation.Name == "UploadPart" {
+		if len(r.HTTPRequest.Header.Get("X-Amz-Content-Sha256")) == 0 {
+			r.HTTPRequest.Header.Set("X-Amz-Content-Sha256", "UNSIGNED-PAYLOAD")
+		}
+	}
+}
+
 type s3RemoteStorageClient struct {
 	conf *remote_pb.RemoteConf
 	conn s3iface.S3API
 }
 
+const (
+	defaultUploadConcurrency = 1
+	defaultReadConcurrency   = 5
+)
+
+func (s *s3RemoteStorageClient) uploadConcurrency() int {
+	if n := int(s.conf.GetUploadConcurrency()); n > 0 {
+		return n
+	}
+	return defaultUploadConcurrency
+}
+
+func (s *s3RemoteStorageClient) downloadConcurrency() int {
+	if n := int(s.conf.GetDownloadConcurrency()); n > 0 {
+		return n
+	}
+	return defaultReadConcurrency
+}
+
 var _ = remote_storage.RemoteStorageClient(&s3RemoteStorageClient{})
 
 func (s *s3RemoteStorageClient) Traverse(remote *remote_pb.RemoteStorageLocation, visitFn remote_storage.VisitFunc) (err error) {
@@ -230,12 +435,12 @@ func (s *s3RemoteStorageClient) StatFile(loc *remote_pb.RemoteStorageLocation) (
 }
 
 func (s *s3RemoteStorageClient) ReadFile(loc *remote_pb.RemoteStorageLocation, offset int64, size int64) (data []byte, err error) {
-	return s.ReadFileWithConcurrency(loc, offset, size, 5)
+	return s.ReadFileWithConcurrency(loc, offset, size, 0)
 }
 
 func (s *s3RemoteStorageClient) ReadFileWithConcurrency(loc *remote_pb.RemoteStorageLocation, offset int64, size int64, concurrency int) (data []byte, err error) {
 	if concurrency <= 0 {
-		concurrency = 5
+		concurrency = s.downloadConcurrency()
 	}
 	downloader := s3manager.NewDownloaderWithClient(s.conn, func(u *s3manager.Downloader) {
 		u.PartSize = int64(4 * 1024 * 1024)
@@ -251,6 +456,9 @@ func (s *s3RemoteStorageClient) ReadFileWithConcurrency(loc *remote_pb.RemoteSto
 		Range:  aws.String(fmt.Sprintf("bytes=%d-%d", offset, offset+size-1)),
 	})
 	if err != nil {
+		if isNoSuchKey(err) {
+			return nil, remote_storage.ErrRemoteObjectNotFound
+		}
 		return nil, fmt.Errorf("failed to download file %s%s: %v", loc.Bucket, loc.Path, err)
 	}
 	// The buffer is pre-sized to size, so a short read leaves the tail
@@ -270,7 +478,7 @@ func (s *s3RemoteStorageClient) ReadFileAsStream(ctx context.Context, loc *remot
 		Range:  aws.String(fmt.Sprintf("bytes=%d-%d", offset, offset+size-1)),
 	})
 	if err != nil {
-		if aerr, ok := err.(awserr.Error); ok && aerr.Code() == s3.ErrCodeNoSuchKey {
+		if isNoSuchKey(err) {
 			return nil, remote_storage.ErrRemoteObjectNotFound
 		}
 		return nil, fmt.Errorf("failed to open stream for %s%s: %v", loc.Bucket, loc.Path, err)
@@ -278,6 +486,13 @@ func (s *s3RemoteStorageClient) ReadFileAsStream(ctx context.Context, loc *remot
 	return output.Body, nil
 }
 
+// isNoSuchKey matches only a missing key: a missing bucket is also a 404 but
+// says nothing about the object.
+func isNoSuchKey(err error) bool {
+	var aerr awserr.Error
+	return errors.As(err, &aerr) && aerr.Code() == s3.ErrCodeNoSuchKey
+}
+
 func (s *s3RemoteStorageClient) WriteDirectory(loc *remote_pb.RemoteStorageLocation, entry *filer_pb.Entry) (err error) {
 	return nil
 }
@@ -349,7 +564,7 @@ func (s *s3RemoteStorageClient) WriteFile(loc *remote_pb.RemoteStorageLocation,
 	// Create an uploader with the session and custom options
 	uploader := s3manager.NewUploaderWithClient(s.conn, func(u *s3manager.Uploader) {
 		u.PartSize = partSize
-		u.Concurrency = 1
+		u.Concurrency = s.uploadConcurrency()
 	})
 
 	// process tagging
@@ -412,9 +627,9 @@ func (s *s3RemoteStorageClient) readFileRemoteEntry(loc *remote_pb.RemoteStorage
 // the largest object a single CopyObject call accepts
 const s3CopyObjectSizeLimit = 5 * 1024 * 1024 * 1024
 
-func (s *s3RemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (err error) {
+func (s *s3RemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageLocation, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) (remoteEntry *filer_pb.RemoteEntry, err error) {
 	if reflect.DeepEqual(oldEntry.Extended, newEntry.Extended) {
-		return nil
+		return nil, nil
 	}
 
 	// Content-Encoding is S3 system metadata, changeable without a content
@@ -431,12 +646,12 @@ func (s *s3RemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageL
 				Key:    aws.String(key),
 			})
 			if headErr != nil {
-				return fmt.Errorf("stat %s/%s before metadata copy: %w", loc.Bucket, key, headErr)
+				return nil, fmt.Errorf("stat %s/%s before metadata copy: %w", loc.Bucket, key, headErr)
 			}
 			copyInput := &s3.CopyObjectInput{
 				Bucket:                  aws.String(loc.Bucket),
 				Key:                     aws.String(key),
-				CopySource:              aws.String(url.PathEscape(loc.Bucket + "/" + key)),
+				CopySource:              aws.String(s3CopySource(loc.Bucket, key)),
 				MetadataDirective:       aws.String(s3.MetadataDirectiveReplace),
 				Metadata:                headOut.Metadata,
 				ContentType:             headOut.ContentType,
@@ -462,8 +677,25 @@ func (s *s3RemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageL
 			if s.conf.S3StorageClass != "" {
 				copyInput.StorageClass = aws.String(s.conf.S3StorageClass)
 			}
-			if _, err = s.conn.CopyObject(copyInput); err != nil {
-				return fmt.Errorf("update content encoding of %s/%s: %w", loc.Bucket, key, err)
+			copyOutput, copyErr := s.conn.CopyObject(copyInput)
+			if copyErr != nil {
+				return nil, fmt.Errorf("update content encoding of %s/%s: %w", loc.Bucket, key, copyErr)
+			}
+			// the copy rewrites the object and can mint a new ETag, so the
+			// stamp it produced is reported instead of a fresh stat — which
+			// could describe a replacement that landed in between
+			remoteEntry = &filer_pb.RemoteEntry{
+				StorageName: s.conf.Name,
+				RemoteSize:  aws.Int64Value(headOut.ContentLength),
+			}
+			if result := copyOutput.CopyObjectResult; result != nil {
+				remoteEntry.RemoteETag = aws.StringValue(result.ETag)
+				if result.LastModified != nil {
+					remoteEntry.RemoteMtime = result.LastModified.Unix()
+				}
+			}
+			if encoding != "" {
+				remoteEntry.RemoteContentEncoding = aws.String(encoding)
 			}
 		}
 	}
@@ -487,8 +719,173 @@ func (s *s3RemoteStorageClient) UpdateFileMetadata(loc *remote_pb.RemoteStorageL
 			Key:    aws.String(loc.Path[1:]),
 		})
 	}
+	if err != nil {
+		return nil, err
+	}
 	return
 }
+
+// s3CopyPartSize is the smallest part a multipart copy uses; parts grow so
+// the largest object stays within the 10000-part limit
+const s3CopyPartSize = 512 * 1024 * 1024
+
+// CopyFile copies the object at src to dst on the server side, with a single
+// CopyObject up to the 5 GB limit and a multipart copy above it. The copy
+// keeps the source's metadata.
+func (s *s3RemoteStorageClient) CopyFile(src *remote_pb.RemoteStorageLocation, dst *remote_pb.RemoteStorageLocation) (remoteEntry *filer_pb.RemoteEntry, err error) {
+	srcKey, dstKey := src.Path[1:], dst.Path[1:]
+	headOut, err := s.conn.HeadObject(&s3.HeadObjectInput{
+		Bucket: aws.String(src.Bucket),
+		Key:    aws.String(srcKey),
+	})
+	if err != nil {
+		if reqErr, ok := err.(awserr.RequestFailure); ok && reqErr.StatusCode() == http.StatusNotFound {
+			return nil, remote_storage.ErrRemoteObjectNotFound
+		}
+		return nil, fmt.Errorf("stat s3 %s/%s before copy: %w", src.Bucket, srcKey, err)
+	}
+	copySource := aws.String(s3CopySource(src.Bucket, srcKey))
+	var storageClass *string
+	if s.conf.S3StorageClass != "" {
+		storageClass = aws.String(s.conf.S3StorageClass)
+	}
+
+	if size := aws.Int64Value(headOut.ContentLength); size <= s3CopyObjectSizeLimit {
+		// a copy takes the bucket's default encryption unless told otherwise
+		if _, err = s.conn.CopyObject(&s3.CopyObjectInput{
+			Bucket:               aws.String(dst.Bucket),
+			Key:                  aws.String(dstKey),
+			CopySource:           copySource,
+			StorageClass:         storageClass,
+			ServerSideEncryption: headOut.ServerSideEncryption,
+			SSEKMSKeyId:          headOut.SSEKMSKeyId,
+		}); err != nil {
+			return nil, fmt.Errorf("copy s3 %s/%s to %s/%s: %w", src.Bucket, srcKey, dst.Bucket, dstKey, err)
+		}
+	} else if err = s.multipartCopy(headOut, src, copySource, size, dst.Bucket, dstKey, storageClass); err != nil {
+		return nil, fmt.Errorf("copy s3 %s/%s to %s/%s: %w", src.Bucket, srcKey, dst.Bucket, dstKey, err)
+	}
+
+	return s.readFileRemoteEntry(dst)
+}
+
+// s3CopySource escapes each segment of the copy source and keeps the slashes,
+// which every S3 implementation reads back
+func s3CopySource(bucket, key string) string {
+	segments := strings.Split(bucket+"/"+key, "/")
+	for i, segment := range segments {
+		segments[i] = url.PathEscape(segment)
+	}
+	return strings.Join(segments, "/")
+}
+
+// s3TaggingHeader encodes tags as the query string x-amz-tagging takes, with
+// spaces as %20: a + is read back as a space by some implementations and
+// literally by others
+func s3TaggingHeader(tagSet []*s3.Tag) string {
+	escape := func(s string) string {
+		return strings.ReplaceAll(url.QueryEscape(s), "+", "%20")
+	}
+	pairs := make([]string, 0, len(tagSet))
+	for _, tag := range tagSet {
+		pairs = append(pairs, escape(aws.StringValue(tag.Key))+"="+escape(aws.StringValue(tag.Value)))
+	}
+	return strings.Join(pairs, "&")
+}
+
+// multipartCopy copies an object above the CopyObject limit part by part. A
+// multipart upload does not inherit the source's metadata or tags, so they are
+// carried over like CopyObject would: metadata from the source's HeadObject,
+// tags when the remote supports tagging.
+func (s *s3RemoteStorageClient) multipartCopy(headOut *s3.HeadObjectOutput, src *remote_pb.RemoteStorageLocation, copySource *string, size int64, bucket, key string, storageClass *string) error {
+	createInput := &s3.CreateMultipartUploadInput{
+		Bucket:                  aws.String(bucket),
+		Key:                     aws.String(key),
+		Metadata:                headOut.Metadata,
+		ContentType:             headOut.ContentType,
+		ContentEncoding:         headOut.ContentEncoding,
+		CacheControl:            headOut.CacheControl,
+		ContentDisposition:      headOut.ContentDisposition,
+		ContentLanguage:         headOut.ContentLanguage,
+		WebsiteRedirectLocation: headOut.WebsiteRedirectLocation,
+		ServerSideEncryption:    headOut.ServerSideEncryption,
+		SSEKMSKeyId:             headOut.SSEKMSKeyId,
+		StorageClass:            storageClass,
+	}
+	if headOut.Expires != nil {
+		if expires, parseErr := http.ParseTime(*headOut.Expires); parseErr == nil {
+			createInput.Expires = aws.Time(expires)
+		}
+	}
+	if s.conf.S3SupportTagging {
+		tagOut, tagErr := s.conn.GetObjectTagging(&s3.GetObjectTaggingInput{
+			Bucket: aws.String(src.Bucket),
+			Key:    aws.String(src.Path[1:]),
+		})
+		if tagErr != nil {
+			return fmt.Errorf("read tags: %w", tagErr)
+		}
+		if len(tagOut.TagSet) > 0 {
+			createInput.Tagging = aws.String(s3TaggingHeader(tagOut.TagSet))
+		}
+	}
+	createOut, err := s.conn.CreateMultipartUpload(createInput)
+	if err != nil {
+		return err
+	}
+
+	partSize := int64(s3CopyPartSize)
+	for partSize*10000 < size {
+		partSize *= 2
+	}
+	var parts []*s3.CompletedPart
+	for offset, partNumber := int64(0), int64(1); offset < size; offset, partNumber = offset+partSize, partNumber+1 {
+		partOut, partErr := s.conn.UploadPartCopy(&s3.UploadPartCopyInput{
+			Bucket:          aws.String(bucket),
+			Key:             aws.String(key),
+			UploadId:        createOut.UploadId,
+			PartNumber:      aws.Int64(partNumber),
+			CopySource:      copySource,
+			CopySourceRange: aws.String(fmt.Sprintf("bytes=%d-%d", offset, min(offset+partSize, size)-1)),
+			// every part from the object the HeadObject saw, not a mix of
+			// versions if it is overwritten mid-copy
+			CopySourceIfMatch: headOut.ETag,
+		})
+		if partErr == nil && partOut.CopyPartResult == nil {
+			partErr = errors.New("no part result")
+		}
+		if partErr != nil {
+			s.abortMultipartUpload(bucket, key, createOut.UploadId)
+			return fmt.Errorf("copy part %d: %w", partNumber, partErr)
+		}
+		parts = append(parts, &s3.CompletedPart{
+			ETag:       partOut.CopyPartResult.ETag,
+			PartNumber: aws.Int64(partNumber),
+		})
+	}
+
+	if _, err = s.conn.CompleteMultipartUpload(&s3.CompleteMultipartUploadInput{
+		Bucket:          aws.String(bucket),
+		Key:             aws.String(key),
+		UploadId:        createOut.UploadId,
+		MultipartUpload: &s3.CompletedMultipartUpload{Parts: parts},
+	}); err != nil {
+		s.abortMultipartUpload(bucket, key, createOut.UploadId)
+		return err
+	}
+	return nil
+}
+
+func (s *s3RemoteStorageClient) abortMultipartUpload(bucket, key string, uploadId *string) {
+	if _, err := s.conn.AbortMultipartUpload(&s3.AbortMultipartUploadInput{
+		Bucket:   aws.String(bucket),
+		Key:      aws.String(key),
+		UploadId: uploadId,
+	}); err != nil {
+		glog.Warningf("abort multipart copy to s3 %s/%s: %v", bucket, key, err)
+	}
+}
+
 func (s *s3RemoteStorageClient) DeleteFile(loc *remote_pb.RemoteStorageLocation) (err error) {
 	_, err = s.conn.DeleteObject(&s3.DeleteObjectInput{
 		Bucket: aws.String(loc.Bucket),
@@ -497,6 +894,45 @@ func (s *s3RemoteStorageClient) DeleteFile(loc *remote_pb.RemoteStorageLocation)
 	return
 }
 
+// DeleteFileIfUnchanged deletes the object only while it is still the one the
+// stat describes, enforced with the S3 conditional-delete If-Match header. A
+// replacement that lands between the stat and the delete fails the
+// precondition instead of being deleted.
+func (s *s3RemoteStorageClient) DeleteFileIfUnchanged(loc *remote_pb.RemoteStorageLocation, stamp *filer_pb.RemoteEntry) (bool, error) {
+	live, err := s.StatFile(loc)
+	if err != nil {
+		if errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+			return true, nil
+		}
+		return false, err
+	}
+	if !remote_storage.StillCurrent(stamp, live) {
+		return false, nil
+	}
+	if live.RemoteETag == "" {
+		return true, s.DeleteFile(loc)
+	}
+	req, _ := s.conn.DeleteObjectRequest(&s3.DeleteObjectInput{
+		Bucket: aws.String(loc.Bucket),
+		Key:    aws.String(loc.Path[1:]),
+	})
+	req.Handlers.Build.PushBack(func(r *request.Request) {
+		r.HTTPRequest.Header.Set("If-Match", live.RemoteETag)
+	})
+	if err := req.Send(); err != nil {
+		if reqErr, ok := err.(awserr.RequestFailure); ok {
+			switch reqErr.StatusCode() {
+			case http.StatusPreconditionFailed:
+				return false, nil
+			case http.StatusNotFound:
+				return true, nil
+			}
+		}
+		return false, fmt.Errorf("delete s3 %s%s: %w", loc.Bucket, loc.Path, err)
+	}
+	return true, nil
+}
+
 func (s *s3RemoteStorageClient) ListBuckets() (buckets []*remote_storage.Bucket, err error) {
 	resp, err := s.conn.ListBuckets(&s3.ListBucketsInput{})
 	if err != nil {
diff --git a/weed/remote_storage/s3/s3_storage_client_copy_test.go b/weed/remote_storage/s3/s3_storage_client_copy_test.go
new file mode 100644
index 0000000000..a20fbf57ad
--- /dev/null
+++ b/weed/remote_storage/s3/s3_storage_client_copy_test.go
@@ -0,0 +1,169 @@
+package s3
+
+import (
+	"errors"
+	"net/http"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
+	awss3 "github.com/aws/aws-sdk-go/service/s3"
+	"github.com/aws/aws-sdk-go/service/s3/s3iface"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/stretchr/testify/require"
+)
+
+// copyObjectMock serves HeadObject for a source of size bytes and records the
+// copy calls.
+type copyObjectMock struct {
+	s3iface.S3API
+	size        int64
+	missing     bool
+	partErr     error
+	copyInputs  []*awss3.CopyObjectInput
+	partInputs  []*awss3.UploadPartCopyInput
+	createInput *awss3.CreateMultipartUploadInput
+	tagInputs   []*awss3.GetObjectTaggingInput
+	completed   *awss3.CompleteMultipartUploadInput
+	aborted     bool
+}
+
+func (m *copyObjectMock) HeadObject(input *awss3.HeadObjectInput) (*awss3.HeadObjectOutput, error) {
+	if m.missing {
+		return nil, awserr.NewRequestFailure(awserr.New("NotFound", "not found", nil), http.StatusNotFound, "")
+	}
+	return &awss3.HeadObjectOutput{
+		ContentLength:           aws.Int64(m.size),
+		ContentType:             aws.String("image/jpeg"),
+		Expires:                 aws.String("Wed, 21 Oct 2026 07:28:00 GMT"),
+		WebsiteRedirectLocation: aws.String("/elsewhere"),
+		ServerSideEncryption:    aws.String("aws:kms"),
+		SSEKMSKeyId:             aws.String("key-1"),
+		ETag:                    aws.String(`"etag-` + aws.StringValue(input.Key) + `"`),
+	}, nil
+}
+
+func (m *copyObjectMock) GetObjectTagging(input *awss3.GetObjectTaggingInput) (*awss3.GetObjectTaggingOutput, error) {
+	m.tagInputs = append(m.tagInputs, input)
+	return &awss3.GetObjectTaggingOutput{TagSet: []*awss3.Tag{
+		{Key: aws.String("album"), Value: aws.String("2026 & co")},
+		{Key: aws.String("a+b"), Value: aws.String("x=y")},
+	}}, nil
+}
+
+func (m *copyObjectMock) CopyObject(input *awss3.CopyObjectInput) (*awss3.CopyObjectOutput, error) {
+	m.copyInputs = append(m.copyInputs, input)
+	return &awss3.CopyObjectOutput{}, nil
+}
+
+func (m *copyObjectMock) CreateMultipartUpload(input *awss3.CreateMultipartUploadInput) (*awss3.CreateMultipartUploadOutput, error) {
+	m.createInput = input
+	return &awss3.CreateMultipartUploadOutput{UploadId: aws.String("upload-1")}, nil
+}
+
+func (m *copyObjectMock) UploadPartCopy(input *awss3.UploadPartCopyInput) (*awss3.UploadPartCopyOutput, error) {
+	m.partInputs = append(m.partInputs, input)
+	if m.partErr != nil && len(m.partInputs) == 2 {
+		return nil, m.partErr
+	}
+	return &awss3.UploadPartCopyOutput{CopyPartResult: &awss3.CopyPartResult{ETag: aws.String(`"part"`)}}, nil
+}
+
+func (m *copyObjectMock) CompleteMultipartUpload(input *awss3.CompleteMultipartUploadInput) (*awss3.CompleteMultipartUploadOutput, error) {
+	m.completed = input
+	return &awss3.CompleteMultipartUploadOutput{}, nil
+}
+
+func (m *copyObjectMock) AbortMultipartUpload(*awss3.AbortMultipartUploadInput) (*awss3.AbortMultipartUploadOutput, error) {
+	m.aborted = true
+	return &awss3.AbortMultipartUploadOutput{}, nil
+}
+
+func newCopyTestClient(mock *copyObjectMock) *s3RemoteStorageClient {
+	return &s3RemoteStorageClient{conf: &remote_pb.RemoteConf{Name: "test"}, conn: mock}
+}
+
+var (
+	copySrc = &remote_pb.RemoteStorageLocation{Name: "test", Bucket: "bucket", Path: "/src/a b.jpg"}
+	copyDst = &remote_pb.RemoteStorageLocation{Name: "test", Bucket: "bucket", Path: "/dst/a b.jpg"}
+)
+
+func TestS3ClientImplementsObjectCopier(t *testing.T) {
+	var _ remote_storage.RemoteStorageObjectCopier = &s3RemoteStorageClient{}
+}
+
+func TestS3CopyFileUsesCopyObjectUpToTheLimit(t *testing.T) {
+	mock := &copyObjectMock{size: s3CopyObjectSizeLimit}
+
+	remoteEntry, err := newCopyTestClient(mock).CopyFile(copySrc, copyDst)
+	require.NoError(t, err)
+
+	require.Len(t, mock.copyInputs, 1)
+	require.Equal(t, "bucket/src/a%20b.jpg", aws.StringValue(mock.copyInputs[0].CopySource))
+	require.Equal(t, "dst/a b.jpg", aws.StringValue(mock.copyInputs[0].Key))
+	require.Equal(t, "aws:kms", aws.StringValue(mock.copyInputs[0].ServerSideEncryption))
+	require.Equal(t, "key-1", aws.StringValue(mock.copyInputs[0].SSEKMSKeyId))
+	require.Nil(t, mock.createInput)
+	// the RemoteEntry describes the destination
+	require.Equal(t, `"etag-dst/a b.jpg"`, remoteEntry.RemoteETag)
+	require.Equal(t, int64(s3CopyObjectSizeLimit), remoteEntry.RemoteSize)
+}
+
+func TestS3CopyFileCopiesLargeObjectsInParts(t *testing.T) {
+	size := int64(s3CopyObjectSizeLimit) + 1
+	mock := &copyObjectMock{size: size}
+
+	_, err := newCopyTestClient(mock).CopyFile(copySrc, copyDst)
+	require.NoError(t, err)
+
+	require.Empty(t, mock.copyInputs)
+	require.NotNil(t, mock.createInput)
+	require.Equal(t, "image/jpeg", aws.StringValue(mock.createInput.ContentType))
+	require.Equal(t, "/elsewhere", aws.StringValue(mock.createInput.WebsiteRedirectLocation))
+	require.Equal(t, "aws:kms", aws.StringValue(mock.createInput.ServerSideEncryption))
+	require.Equal(t, "key-1", aws.StringValue(mock.createInput.SSEKMSKeyId))
+	require.Equal(t, int64(1792567680), aws.TimeValue(mock.createInput.Expires).Unix())
+	// tags only where the remote supports tagging
+	require.Empty(t, mock.tagInputs)
+	require.Nil(t, mock.createInput.Tagging)
+	require.Len(t, mock.partInputs, 11)
+	require.Equal(t, "bytes=0-536870911", aws.StringValue(mock.partInputs[0].CopySourceRange))
+	require.Equal(t, "bytes=5368709120-5368709120", aws.StringValue(mock.partInputs[10].CopySourceRange))
+	for _, part := range mock.partInputs {
+		require.Equal(t, `"etag-src/a b.jpg"`, aws.StringValue(part.CopySourceIfMatch))
+	}
+	require.Len(t, mock.completed.MultipartUpload.Parts, 11)
+	require.Equal(t, int64(11), aws.Int64Value(mock.completed.MultipartUpload.Parts[10].PartNumber))
+	require.False(t, mock.aborted)
+}
+
+func TestS3CopyFileCarriesTagsIntoAMultipartCopy(t *testing.T) {
+	mock := &copyObjectMock{size: s3CopyObjectSizeLimit + 1}
+	client := newCopyTestClient(mock)
+	client.conf.S3SupportTagging = true
+
+	_, err := client.CopyFile(copySrc, copyDst)
+	require.NoError(t, err)
+
+	require.Len(t, mock.tagInputs, 1)
+	require.Equal(t, "src/a b.jpg", aws.StringValue(mock.tagInputs[0].Key))
+	require.Equal(t, "album=2026%20%26%20co&a%2Bb=x%3Dy", aws.StringValue(mock.createInput.Tagging))
+}
+
+func TestS3CopyFileAbortsAFailedMultipartCopy(t *testing.T) {
+	mock := &copyObjectMock{size: 2 * s3CopyObjectSizeLimit, partErr: errors.New("part failed")}
+
+	_, err := newCopyTestClient(mock).CopyFile(copySrc, copyDst)
+	require.ErrorContains(t, err, "part failed")
+	require.True(t, mock.aborted)
+	require.Nil(t, mock.completed)
+}
+
+func TestS3CopyFileMissingSource(t *testing.T) {
+	mock := &copyObjectMock{missing: true}
+
+	_, err := newCopyTestClient(mock).CopyFile(copySrc, copyDst)
+	require.ErrorIs(t, err, remote_storage.ErrRemoteObjectNotFound)
+	require.Empty(t, mock.copyInputs)
+}
diff --git a/weed/remote_storage/s3/s3_storage_client_test.go b/weed/remote_storage/s3/s3_storage_client_test.go
index 40bc56fb0d..dc404d5b18 100644
--- a/weed/remote_storage/s3/s3_storage_client_test.go
+++ b/weed/remote_storage/s3/s3_storage_client_test.go
@@ -2,6 +2,7 @@ package s3
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"net/http"
@@ -9,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials"
 	awss3 "github.com/aws/aws-sdk-go/service/s3"
 	"github.com/aws/aws-sdk-go/service/s3/s3iface"
@@ -19,6 +21,7 @@ import (
 )
 
 func TestS3MakeUsesAnonymousCredentialsWhenKeysAreEmpty(t *testing.T) {
+	clearAWSCredentialEnv(t)
 	maker := s3RemoteStorageMaker{}
 	conf := &remote_pb.RemoteConf{
 		Type:             "s3",
@@ -38,6 +41,74 @@ func TestS3MakeUsesAnonymousCredentialsWhenKeysAreEmpty(t *testing.T) {
 	require.Same(t, credentials.AnonymousCredentials, s3Client.Config.Credentials)
 }
 
+func clearAWSCredentialEnv(t *testing.T) {
+	t.Helper()
+	for _, name := range []string{
+		"AWS_ACCESS_KEY_ID",
+		"AWS_PROFILE",
+		"AWS_DEFAULT_PROFILE",
+		"AWS_WEB_IDENTITY_TOKEN_FILE",
+		"AWS_CONTAINER_CREDENTIALS_FULL_URI",
+		"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+		"AWS_SHARED_CREDENTIALS_FILE",
+		"AWS_CONFIG_FILE",
+	} {
+		t.Setenv(name, "")
+	}
+}
+
+func TestS3MakeUsesDefaultCredentialChainWhenKeysAreEmptyAndSourceIsConfigured(t *testing.T) {
+	for name, value := range map[string]string{
+		"AWS_ACCESS_KEY_ID":                      "env-access",
+		"AWS_PROFILE":                            "some-profile",
+		"AWS_WEB_IDENTITY_TOKEN_FILE":            "/var/run/secrets/token",
+		"AWS_CONTAINER_CREDENTIALS_FULL_URI":     "http://127.0.0.1:1/creds",
+		"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI": "/creds",
+	} {
+		t.Run(name, func(t *testing.T) {
+			clearAWSCredentialEnv(t)
+			t.Setenv(name, value)
+			t.Setenv("AWS_ROLE_ARN", "arn:aws:iam::123456789012:role/test")
+
+			remoteClient, err := s3RemoteStorageMaker{}.Make(&remote_pb.RemoteConf{
+				Type:             "s3",
+				S3Region:         "us-east-1",
+				S3Endpoint:       "http://localhost:8333",
+				S3ForcePathStyle: true,
+			})
+			require.NoError(t, err)
+
+			s3Client, ok := remoteClient.(*s3RemoteStorageClient).conn.(*awss3.S3)
+			require.True(t, ok)
+			require.NotSame(t, credentials.AnonymousCredentials, s3Client.Config.Credentials)
+		})
+	}
+}
+
+// A caller that pins a custom http.Client still gets the default chain, so
+// remote providers resolve on an unguarded client while S3 requests use the
+// pinned one.
+func TestS3MakeResolvesEnvCredentialsWithCustomHTTPClient(t *testing.T) {
+	clearAWSCredentialEnv(t)
+	t.Setenv("AWS_ACCESS_KEY_ID", "env-access")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "env-secret")
+
+	remoteClient, err := MakeWithHTTPClient(&remote_pb.RemoteConf{
+		Type:             "s3",
+		S3Region:         "us-east-1",
+		S3Endpoint:       "http://localhost:8333",
+		S3ForcePathStyle: true,
+	}, &http.Client{})
+	require.NoError(t, err)
+
+	s3Client, ok := remoteClient.(*s3RemoteStorageClient).conn.(*awss3.S3)
+	require.True(t, ok)
+	require.NotSame(t, credentials.AnonymousCredentials, s3Client.Config.Credentials)
+	value, err := s3Client.Config.Credentials.Get()
+	require.NoError(t, err)
+	require.Equal(t, "env-access", value.AccessKeyID)
+}
+
 func TestS3MakeUsesStaticCredentialsWhenKeysAreProvided(t *testing.T) {
 	maker := s3RemoteStorageMaker{}
 	conf := &remote_pb.RemoteConf{
@@ -224,21 +295,27 @@ func (c *captureRoundTripper) uploadContentType() string {
 	return c.uploadReq.Header.Get("Content-Type")
 }
 
-func newCapturingS3Client(t *testing.T) (*s3RemoteStorageClient, *captureRoundTripper) {
+func newS3ClientWithTransport(t *testing.T, rt http.RoundTripper, supportTagging bool) *s3RemoteStorageClient {
 	t.Helper()
-	rt := &captureRoundTripper{}
 	conf := &remote_pb.RemoteConf{
+		Type:             "s3",
 		Name:             "test",
 		S3Region:         "us-east-1",
 		S3Endpoint:       "https://example.invalid",
 		S3ForcePathStyle: true,
 		S3AccessKey:      "test-key",
 		S3SecretKey:      "test-secret",
+		S3SupportTagging: supportTagging,
 	}
-	httpClient := &http.Client{Transport: rt}
-	rs, err := MakeWithHTTPClient(conf, httpClient)
+	rs, err := MakeWithHTTPClient(conf, &http.Client{Transport: rt})
 	require.NoError(t, err)
-	return rs.(*s3RemoteStorageClient), rt
+	return rs.(*s3RemoteStorageClient)
+}
+
+func newCapturingS3Client(t *testing.T) (*s3RemoteStorageClient, *captureRoundTripper) {
+	t.Helper()
+	rt := &captureRoundTripper{}
+	return newS3ClientWithTransport(t, rt, false), rt
 }
 
 func TestS3WriteFilePassesMimeAsContentType(t *testing.T) {
@@ -280,18 +357,7 @@ func (c *recordingRoundTripper) RoundTrip(req *http.Request) (*http.Response, er
 func newRecordingS3Client(t *testing.T, supportTagging bool) (*s3RemoteStorageClient, *recordingRoundTripper) {
 	t.Helper()
 	rt := &recordingRoundTripper{}
-	conf := &remote_pb.RemoteConf{
-		Name:             "test",
-		S3Region:         "us-east-1",
-		S3Endpoint:       "https://example.invalid",
-		S3ForcePathStyle: true,
-		S3AccessKey:      "test-key",
-		S3SecretKey:      "test-secret",
-		S3SupportTagging: supportTagging,
-	}
-	rs, err := MakeWithHTTPClient(conf, &http.Client{Transport: rt})
-	require.NoError(t, err)
-	return rs.(*s3RemoteStorageClient), rt
+	return newS3ClientWithTransport(t, rt, supportTagging), rt
 }
 
 func TestS3UpdateFileMetadataSkipsTaggingWhenUnsupported(t *testing.T) {
@@ -300,10 +366,12 @@ func TestS3UpdateFileMetadataSkipsTaggingWhenUnsupported(t *testing.T) {
 	plain := &filer_pb.Entry{}
 	tagged := &filer_pb.Entry{Extended: map[string][]byte{"k1": []byte("v1")}}
 
-	require.NoError(t, client.UpdateFileMetadata(loc, plain, tagged))
+	_, err := client.UpdateFileMetadata(loc, plain, tagged)
+	require.NoError(t, err)
 	require.Empty(t, rt.requests, "adding attributes must not send PutObjectTagging")
 
-	require.NoError(t, client.UpdateFileMetadata(loc, tagged, plain))
+	_, err = client.UpdateFileMetadata(loc, tagged, plain)
+	require.NoError(t, err)
 	require.Empty(t, rt.requests, "removing attributes must not send DeleteObjectTagging")
 }
 
@@ -313,13 +381,15 @@ func TestS3UpdateFileMetadataSendsTaggingWhenSupported(t *testing.T) {
 	plain := &filer_pb.Entry{}
 	tagged := &filer_pb.Entry{Extended: map[string][]byte{"k1": []byte("v1")}}
 
-	require.NoError(t, client.UpdateFileMetadata(loc, plain, tagged))
+	_, err := client.UpdateFileMetadata(loc, plain, tagged)
+	require.NoError(t, err)
 	require.Len(t, rt.requests, 1)
 	require.Equal(t, http.MethodPut, rt.requests[0].Method)
 	require.Contains(t, rt.requests[0].URL.RawQuery, "tagging")
 
 	rt.requests = nil
-	require.NoError(t, client.UpdateFileMetadata(loc, tagged, plain))
+	_, err = client.UpdateFileMetadata(loc, tagged, plain)
+	require.NoError(t, err)
 	require.Len(t, rt.requests, 1)
 	require.Equal(t, http.MethodDelete, rt.requests[0].Method)
 	require.Contains(t, rt.requests[0].URL.RawQuery, "tagging")
@@ -343,3 +413,76 @@ func TestS3WriteFileOmitsContentTypeWhenMimeMissing(t *testing.T) {
 	// remote can apply its own default rather than getting a misleading one.
 	require.Equal(t, "", rt.uploadContentType())
 }
+
+// errorRoundTripper answers every request with an S3 XML error.
+type errorRoundTripper struct {
+	statusCode int
+	code       string
+}
+
+func (e *errorRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	if req.Body != nil {
+		_, _ = io.Copy(io.Discard, req.Body)
+		_ = req.Body.Close()
+	}
+	body := `<?xml version="1.0" encoding="UTF-8"?><Error><Code>` + e.code + `</Code><Message>m</Message></Error>`
+	return &http.Response{
+		StatusCode: e.statusCode,
+		Body:       io.NopCloser(strings.NewReader(body)),
+		Header:     http.Header{"Content-Type": []string{"application/xml"}},
+		Request:    req,
+	}, nil
+}
+
+func TestS3ReadNotFoundClassification(t *testing.T) {
+	loc := &remote_pb.RemoteStorageLocation{Name: "test", Bucket: "bucket", Path: "/obj.bin"}
+	tests := []struct {
+		name       string
+		statusCode int
+		code       string
+		notFound   bool
+	}{
+		{"missing key", http.StatusNotFound, "NoSuchKey", true},
+		{"missing bucket", http.StatusNotFound, "NoSuchBucket", false},
+		{"access denied", http.StatusForbidden, "AccessDenied", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			client := newS3ClientWithTransport(t, &errorRoundTripper{statusCode: tt.statusCode, code: tt.code}, false)
+
+			_, err := client.ReadFile(loc, 0, 10)
+			require.Error(t, err)
+			require.Equal(t, tt.notFound, err == remote_storage.ErrRemoteObjectNotFound, "ReadFile: %v", err)
+
+			_, err = client.ReadFileAsStream(context.Background(), loc, 0, 10)
+			require.Error(t, err)
+			require.Equal(t, tt.notFound, err == remote_storage.ErrRemoteObjectNotFound, "ReadFileAsStream: %v", err)
+		})
+	}
+}
+
+func TestIsNoSuchKey(t *testing.T) {
+	require.True(t, isNoSuchKey(fmt.Errorf("download: %w", awserr.New(awss3.ErrCodeNoSuchKey, "missing", nil))))
+	require.False(t, isNoSuchKey(awserr.New(awss3.ErrCodeNoSuchBucket, "missing", nil)))
+}
+
+func TestS3MakeResolvesEnvCredentialsWhenAnonymousDefault(t *testing.T) {
+	clearAWSCredentialEnv(t)
+	t.Setenv("AWS_ACCESS_KEY_ID", "env-access")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "env-secret")
+
+	remoteClient, err := s3RemoteStorageMaker{}.Make(&remote_pb.RemoteConf{
+		Type:             "s3",
+		S3Region:         "us-east-1",
+		S3Endpoint:       "http://localhost:8333",
+		S3ForcePathStyle: true,
+	})
+	require.NoError(t, err)
+
+	s3Client, ok := remoteClient.(*s3RemoteStorageClient).conn.(*awss3.S3)
+	require.True(t, ok)
+	value, err := s3Client.Config.Credentials.Get()
+	require.NoError(t, err)
+	require.Equal(t, "env-access", value.AccessKeyID)
+	require.Equal(t, "env-secret", value.SecretAccessKey)
+}
diff --git a/weed/remote_storage/s3/storj.go b/weed/remote_storage/s3/storj.go
index 9ec403d614..4674b944a4 100644
--- a/weed/remote_storage/s3/storj.go
+++ b/weed/remote_storage/s3/storj.go
@@ -1,16 +1,8 @@
 package s3
 
 import (
-	"fmt"
-	"os"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 func init() {
@@ -24,27 +16,5 @@ func (s StorjRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s StorjRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	accessKey := util.Nvl(conf.StorjAccessKey, os.Getenv("AWS_ACCESS_KEY_ID"))
-	secretKey := util.Nvl(conf.StorjSecretKey, os.Getenv("AWS_SECRET_ACCESS_KEY"))
-
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.StorjEndpoint),
-		Region:                        aws.String("us-west-2"),
-		S3ForcePathStyle:              aws.Bool(true),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if accessKey != "" && secretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(accessKey, secretKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create storj session: %w", err)
-	}
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/s3/tencent.go b/weed/remote_storage/s3/tencent.go
index 184a5b3720..1fdd58b774 100644
--- a/weed/remote_storage/s3/tencent.go
+++ b/weed/remote_storage/s3/tencent.go
@@ -1,16 +1,8 @@
 package s3
 
 import (
-	"fmt"
-	"os"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 func init() {
@@ -24,27 +16,5 @@ func (s TencentRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s TencentRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	accessKey := util.Nvl(conf.TencentSecretId, os.Getenv("COS_SECRETID"))
-	secretKey := util.Nvl(conf.TencentSecretKey, os.Getenv("COS_SECRETKEY"))
-
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.TencentEndpoint),
-		Region:                        aws.String("us-west-2"),
-		S3ForcePathStyle:              aws.Bool(true),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if accessKey != "" && secretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(accessKey, secretKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create tencent session: %w", err)
-	}
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/s3/wasabi.go b/weed/remote_storage/s3/wasabi.go
index 5b98485cae..7649b23776 100644
--- a/weed/remote_storage/s3/wasabi.go
+++ b/weed/remote_storage/s3/wasabi.go
@@ -1,16 +1,8 @@
 package s3
 
 import (
-	"fmt"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/aws/session"
-	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 func init() {
@@ -24,39 +16,5 @@ func (s WasabiRemoteStorageMaker) HasBucket() bool {
 }
 
 func (s WasabiRemoteStorageMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
-	client := &s3RemoteStorageClient{
-		conf: conf,
-	}
-	accessKey := util.Nvl(conf.WasabiAccessKey)
-	secretKey := util.Nvl(conf.WasabiSecretKey)
-
-	config := &aws.Config{
-		Endpoint:                      aws.String(conf.WasabiEndpoint),
-		Region:                        aws.String(conf.WasabiRegion),
-		S3ForcePathStyle:              aws.Bool(true),
-		S3DisableContentMD5Validation: aws.Bool(true),
-	}
-	if accessKey != "" && secretKey != "" {
-		config.Credentials = credentials.NewStaticCredentials(accessKey, secretKey, "")
-	}
-
-	sess, err := session.NewSession(config)
-	if err != nil {
-		return nil, fmt.Errorf("create wasabi session: %w", err)
-	}
-	sess.Handlers.Build.PushFront(skipSha256PayloadSigning)
-	client.conn = s3.New(sess)
-	return client, nil
-}
-
-var skipSha256PayloadSigning = func(r *request.Request) {
-	// see https://github.com/ceph/ceph/pull/15965/files
-	if r.ClientInfo.ServiceID != "S3" {
-		return
-	}
-	if r.Operation.Name == "PutObject" || r.Operation.Name == "UploadPart" {
-		if len(r.HTTPRequest.Header.Get("X-Amz-Content-Sha256")) == 0 {
-			r.HTTPRequest.Header.Set("X-Amz-Content-Sha256", "UNSIGNED-PAYLOAD")
-		}
-	}
+	return MakeWithHTTPClient(conf, nil)
 }
diff --git a/weed/remote_storage/track_sync_offset.go b/weed/remote_storage/track_sync_offset.go
index f5de002d08..7fa77a468a 100644
--- a/weed/remote_storage/track_sync_offset.go
+++ b/weed/remote_storage/track_sync_offset.go
@@ -14,15 +14,19 @@ const (
 	SyncKeyPrefix = "remote.sync."
 )
 
+// SyncOffsetKey is the filer store key holding the write-back sync watermark
+// for a mounted directory.
+func SyncOffsetKey(dir string) []byte {
+	syncKey := make([]byte, len(SyncKeyPrefix)+4)
+	copy(syncKey, SyncKeyPrefix)
+	util.Uint32toBytes(syncKey[len(SyncKeyPrefix):], uint32(util.HashStringToLong(dir)))
+	return syncKey
+}
+
 func GetSyncOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, dir string) (lastOffsetTsNs int64, readErr error) {
 
-	dirHash := uint32(util.HashStringToLong(dir))
-
 	readErr = pb.WithFilerClient(false, 0, filer, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
-		syncKey := []byte(SyncKeyPrefix + "____")
-		util.Uint32toBytes(syncKey[len(SyncKeyPrefix):len(SyncKeyPrefix)+4], dirHash)
-
-		resp, err := client.KvGet(context.Background(), &filer_pb.KvGetRequest{Key: syncKey})
+		resp, err := client.KvGet(context.Background(), &filer_pb.KvGetRequest{Key: SyncOffsetKey(dir)})
 		if err != nil {
 			return err
 		}
@@ -45,18 +49,13 @@ func GetSyncOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, dir s
 
 func SetSyncOffset(grpcDialOption grpc.DialOption, filer pb.ServerAddress, dir string, offsetTsNs int64) error {
 
-	dirHash := uint32(util.HashStringToLong(dir))
-
 	return pb.WithFilerClient(false, 0, filer, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
 
-		syncKey := []byte(SyncKeyPrefix + "____")
-		util.Uint32toBytes(syncKey[len(SyncKeyPrefix):len(SyncKeyPrefix)+4], dirHash)
-
 		valueBuf := make([]byte, 8)
 		util.Uint64toBytes(valueBuf, uint64(offsetTsNs))
 
 		resp, err := client.KvPut(context.Background(), &filer_pb.KvPutRequest{
-			Key:   syncKey,
+			Key:   SyncOffsetKey(dir),
 			Value: valueBuf,
 		})
 		if err != nil {
diff --git a/weed/replication/repl_util/replication_util.go b/weed/replication/repl_util/replication_util.go
index 6e13e03598..b1394c8502 100644
--- a/weed/replication/repl_util/replication_util.go
+++ b/weed/replication/repl_util/replication_util.go
@@ -80,7 +80,7 @@ func copyChunkViews(chunkViews *filer.IntervalList[*filer.ChunkView], filerSourc
 
 		var writeErr error
 		var shouldRetry bool
-		jwt := filer.JwtForVolumeServer(chunk.FileId)
+		jwt := filer.ChunkReadJwt(fileUrls, chunk.FileId)
 
 		for _, fileUrl := range fileUrls {
 			shouldRetry, err = util_http.ReadUrlAsStream(context.Background(), fileUrl, jwt, chunk.CipherKey, chunk.IsGzipped, chunk.IsFullChunk(), chunk.OffsetInChunk, int(chunk.ViewSize), func(data []byte) {
diff --git a/weed/replication/replicator.go b/weed/replication/replicator.go
index 26915d5c78..1beb5ad650 100644
--- a/weed/replication/replicator.go
+++ b/weed/replication/replicator.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -100,7 +101,7 @@ func (r *Replicator) Replicate(ctx context.Context, key string, message *filer_p
 
 	if oldEntry != nil && newEntry == nil {
 		glog.V(4).Infof("deleting %v", oldSinkKey)
-		return r.sink.DeleteEntry(oldSinkKey, oldEntry.IsDirectory, message.DeleteChunks, message.Signatures)
+		return sink.DeleteEntry(r.sink, oldSinkKey, oldEntry.IsDirectory, message.DeleteChunks, filer.IsMetadataOnlyDelete(oldEntry), message.Signatures)
 	}
 	if oldEntry == nil && newEntry != nil {
 		glog.V(4).Infof("creating %v", oldSinkKey)
diff --git a/weed/replication/replicator_test.go b/weed/replication/replicator_test.go
index 6c4947ef55..1aab7da950 100644
--- a/weed/replication/replicator_test.go
+++ b/weed/replication/replicator_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/replication/sink"
 	"github.com/seaweedfs/seaweedfs/weed/replication/source"
@@ -71,6 +72,10 @@ func (s *recordingSink) GetSinkToDirectory() string {
 	return s.sinkToDirectory
 }
 
+func (s *recordingSink) GetDestinationIdentity() string {
+	return s.sinkToDirectory
+}
+
 func (s *recordingSink) SetSourceFiler(*source.FilerSource) {}
 
 func (s *recordingSink) IsIncremental() bool {
@@ -405,3 +410,37 @@ func TestReplicateRenameFromExcludedDirBecomesCreate(t *testing.T) {
 		t.Fatalf("unexpected delete/update calls: deletes=%+v updates=%+v", s.deleteCalls, s.updateCalls)
 	}
 }
+
+type keepingSink struct {
+	*recordingSink
+	keepCalls []deleteCall
+}
+
+var _ sink.MetadataOnlyDeleter = (*keepingSink)(nil)
+
+func (s *keepingSink) DeleteEntryKeepingRemoteObject(key string, isDirectory, deleteIncludeChunks bool, signatures []int32) error {
+	s.keepCalls = append(s.keepCalls, deleteCall{key: key, isDirectory: isDirectory})
+	return nil
+}
+
+func TestReplicateMetadataOnlyDeleteKeepsTheRemoteObject(t *testing.T) {
+	s := &keepingSink{recordingSink: &recordingSink{name: "filer", sinkToDirectory: "/dest"}}
+	r := &Replicator{sink: s, source: &source.FilerSource{Dir: "/source"}}
+	deleteOf := func(name string, extended map[string][]byte) *filer_pb.EventNotification {
+		return &filer_pb.EventNotification{OldEntry: &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}, Extended: extended}}
+	}
+
+	if err := r.Replicate(context.Background(), "/source/dir/kept.bin", deleteOf("kept.bin", map[string][]byte{filer.ExtKeepRemoteObjectKey: []byte("true")})); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Replicate(context.Background(), "/source/dir/gone.bin", deleteOf("gone.bin", nil)); err != nil {
+		t.Fatal(err)
+	}
+
+	if len(s.keepCalls) != 1 || s.keepCalls[0].key != "/dest/dir/kept.bin" {
+		t.Fatalf("metadata-only deletes = %+v, want /dest/dir/kept.bin", s.keepCalls)
+	}
+	if len(s.deleteCalls) != 1 || s.deleteCalls[0].key != "/dest/dir/gone.bin" {
+		t.Fatalf("ordinary deletes = %+v, want /dest/dir/gone.bin", s.deleteCalls)
+	}
+}
diff --git a/weed/replication/sink/azuresink/azure_sink.go b/weed/replication/sink/azuresink/azure_sink.go
index 6688483a4d..1ce8d62cd1 100644
--- a/weed/replication/sink/azuresink/azure_sink.go
+++ b/weed/replication/sink/azuresink/azure_sink.go
@@ -24,6 +24,8 @@ import (
 
 type AzureSink struct {
 	client        *azblob.Client
+	accountName   string
+	endpoint      string
 	container     string
 	dir           string
 	filerSource   *source.FilerSource
@@ -42,6 +44,10 @@ func (g *AzureSink) GetSinkToDirectory() string {
 	return g.dir
 }
 
+func (g *AzureSink) GetDestinationIdentity() string {
+	return g.accountName + "\x00" + g.endpoint + "\x00" + g.container + "\x00" + g.dir
+}
+
 func (g *AzureSink) IsIncremental() bool {
 	return g.isIncremental
 }
@@ -63,10 +69,12 @@ func (g *AzureSink) SetSourceFiler(s *source.FilerSource) {
 }
 
 func (g *AzureSink) initialize(accountName, accountKey, clientID, endpoint, container, dir string) error {
+	g.accountName = accountName
+	g.endpoint = endpoint
 	g.container = container
 	g.dir = dir
 
-	client, err := azure.NewAzBlobClient(accountName, accountKey, clientID, endpoint)
+	client, err := azure.NewAzBlobClient(accountName, accountKey, clientID, endpoint, nil)
 	if err != nil {
 		return err
 	}
@@ -122,7 +130,10 @@ func (g *AzureSink) CreateEntry(key string, entry *filer_pb.Entry, signatures []
 	}
 
 	totalSize := filer.FileSize(entry)
-	chunkViews := filer.ViewFromChunks(context.Background(), g.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	chunkViews, err := filer.ViewFromChunks(context.Background(), g.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	if err != nil {
+		return fmt.Errorf("resolve chunks of %s: %w", key, err)
+	}
 
 	// Create append blob client
 	appendBlobClient := g.client.ServiceClient().NewContainerClient(g.container).NewAppendBlobClient(key)
@@ -130,7 +141,7 @@ func (g *AzureSink) CreateEntry(key string, entry *filer_pb.Entry, signatures []
 	// Try to create the blob first (without access conditions for initial creation)
 	ctxCreate, cancelCreate := context.WithTimeout(context.Background(), azure.DefaultAzureOpTimeout)
 	defer cancelCreate()
-	_, err := appendBlobClient.Create(ctxCreate, nil)
+	_, err = appendBlobClient.Create(ctxCreate, nil)
 
 	needsWrite := true
 	freshlyCreated := false
diff --git a/weed/replication/sink/b2sink/b2_sink.go b/weed/replication/sink/b2sink/b2_sink.go
index c69dffa33f..a3b59a7cf7 100644
--- a/weed/replication/sink/b2sink/b2_sink.go
+++ b/weed/replication/sink/b2sink/b2_sink.go
@@ -34,6 +34,10 @@ func (g *B2Sink) GetSinkToDirectory() string {
 	return g.dir
 }
 
+func (g *B2Sink) GetDestinationIdentity() string {
+	return g.bucket + "\x00" + g.dir
+}
+
 func (g *B2Sink) IsIncremental() bool {
 	return g.isIncremental
 }
@@ -100,7 +104,10 @@ func (g *B2Sink) CreateEntry(key string, entry *filer_pb.Entry, signatures []int
 	}
 
 	totalSize := filer.FileSize(entry)
-	chunkViews := filer.ViewFromChunks(context.Background(), g.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	chunkViews, err := filer.ViewFromChunks(context.Background(), g.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	if err != nil {
+		return fmt.Errorf("resolve chunks of %s: %w", key, err)
+	}
 
 	bucket, err := g.client.Bucket(context.Background(), g.bucket)
 	if err != nil {
diff --git a/weed/replication/sink/filersink/fetch_write.go b/weed/replication/sink/filersink/fetch_write.go
index b8532f091e..2675975dd8 100644
--- a/weed/replication/sink/filersink/fetch_write.go
+++ b/weed/replication/sink/filersink/fetch_write.go
@@ -29,7 +29,68 @@ import (
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
-func (fs *FilerSink) replicateChunks(ctx context.Context, sourceChunks []*filer_pb.FileChunk, path string, sourceMtimeNs int64) (replicatedChunks []*filer_pb.FileChunk, err error) {
+// missingSourceChunkGrace is how long a chunk the source cannot produce keeps
+// being retried before it counts as gone for good. Long enough to outlast a
+// volume server restart or a master failover, after which every volume that
+// still exists is registered again.
+var missingSourceChunkGrace = 30 * time.Minute
+
+// errSourceChunkMissing is a permanent replication failure: the source cluster
+// no longer holds the chunk's data, so no later attempt can fetch it.
+var errSourceChunkMissing = errors.New("source chunk missing")
+
+// isSourceChunkMissing reports whether the source answered that it does not have
+// the chunk — no location for its volume, or a 404 from the volume server that
+// does. Both shapes also cover a volume that is merely offline, which is why the
+// gate below waits them out instead of trusting a single answer.
+func isSourceChunkMissing(err error) bool {
+	return errors.Is(err, source.ErrVolumeNotFound) || errors.Is(err, util_http.ErrNotFound)
+}
+
+// missingSourceChunkGate decides when to stop retrying a chunk the source cannot
+// produce, so a lookup race or a restarting volume server is waited out while a
+// vacuumed one is written off instead of retried forever. A volume that is gone
+// took every file it held with it, so its wait is kept per volume on the sink;
+// a 404 is one needle's answer, so its wait is kept per file id instead — a
+// sibling needle succeeding must not restart it, and a different needle must get
+// its own full wait.
+type missingSourceChunkGate struct {
+	sink     *FilerSink
+	volumeId string
+	fileId   string
+	gaveUp   bool
+}
+
+func (g *missingSourceChunkGate) isPermanent(err error) bool {
+	var since time.Time
+	switch {
+	case errors.Is(err, source.ErrVolumeNotFound):
+		since = g.sink.sourceVolumeMissingSince(g.volumeId)
+	case errors.Is(err, util_http.ErrNotFound):
+		since = g.sink.sourceNeedleMissingSince(g.fileId)
+	default:
+		return false
+	}
+	if time.Since(since) < missingSourceChunkGrace {
+		return false
+	}
+	g.gaveUp = true
+	return true
+}
+
+// wrap marks err permanent once the gate gave up, so the sink can tell a source
+// that lost the data from one that is only unreachable right now.
+func (g *missingSourceChunkGate) wrap(err error) error {
+	if err == nil || !g.gaveUp {
+		return err
+	}
+	return fmt.Errorf("%w: %w", errSourceChunkMissing, err)
+}
+
+// topLevelId anchors nested chunks to the entry-level chunk that contains them:
+// supersession is judged by whether the live entry still lists that chunk, since
+// a manifest's id is the identity of its contents.
+func (fs *FilerSink) replicateChunks(ctx context.Context, sourceChunks []*filer_pb.FileChunk, path string, sourceMtimeNs int64, topLevelId string) (replicatedChunks []*filer_pb.FileChunk, err error) {
 	if len(sourceChunks) == 0 {
 		return
 	}
@@ -76,7 +137,11 @@ func (fs *FilerSink) replicateChunks(ctx context.Context, sourceChunks []*filer_
 		}
 
 		if sourceChunk.IsChunkManifest {
-			replicatedChunk, replicateErr := fs.replicateOneManifestChunk(ctx, sourceChunk, path, sourceMtimeNs)
+			anchor := topLevelId
+			if anchor == "" {
+				anchor = sourceChunk.GetFileIdString()
+			}
+			replicatedChunk, replicateErr := fs.replicateOneManifestChunk(ctx, sourceChunk, path, sourceMtimeNs, anchor)
 			if replicateErr != nil {
 				setError(replicateErr)
 				break
@@ -94,7 +159,7 @@ func (fs *FilerSink) replicateChunks(ctx context.Context, sourceChunks []*filer_
 			defer wg.Done()
 			var replicatedChunk *filer_pb.FileChunk
 			retryErr := util.Retry("replicate chunks", func() error {
-				chunk, e := fs.replicateOneChunk(source, path, sourceMtimeNs)
+				chunk, e := fs.replicateOneChunk(source, path, sourceMtimeNs, topLevelId)
 				if e != nil {
 					return e
 				}
@@ -117,9 +182,9 @@ func (fs *FilerSink) replicateChunks(ctx context.Context, sourceChunks []*filer_
 	return
 }
 
-func (fs *FilerSink) replicateOneChunk(sourceChunk *filer_pb.FileChunk, path string, sourceMtimeNs int64) (*filer_pb.FileChunk, error) {
+func (fs *FilerSink) replicateOneChunk(sourceChunk *filer_pb.FileChunk, path string, sourceMtimeNs int64, topLevelId string) (*filer_pb.FileChunk, error) {
 
-	fileId, err := fs.fetchAndWrite(sourceChunk, path, sourceMtimeNs)
+	fileId, err := fs.fetchAndWrite(sourceChunk, path, sourceMtimeNs, topLevelId)
 	if err != nil {
 		return nil, fmt.Errorf("copy %s: %w", sourceChunk.GetFileIdString(), err)
 	}
@@ -138,33 +203,33 @@ func (fs *FilerSink) replicateOneChunk(sourceChunk *filer_pb.FileChunk, path str
 	}, nil
 }
 
-func (fs *FilerSink) replicateOneManifestChunk(ctx context.Context, sourceChunk *filer_pb.FileChunk, path string, sourceMtimeNs int64) (*filer_pb.FileChunk, error) {
+func (fs *FilerSink) replicateOneManifestChunk(ctx context.Context, sourceChunk *filer_pb.FileChunk, path string, sourceMtimeNs int64, topLevelId string) (*filer_pb.FileChunk, error) {
 	// LookupFileId can transiently fail during a write burst (volume not yet
 	// registered). Retry like the data-chunk path does; the gate stops on
 	// supersession or, when that cannot be checked, after a few attempts.
 	var resolvedChunks []*filer_pb.FileChunk
 	resolveName := fmt.Sprintf("resolve manifest %s", sourceChunk.GetFileIdString())
+	missingGate := fs.newMissingSourceChunkGate(sourceChunk.GetFileIdString())
 	err := util.RetryUntil(resolveName, func() error {
-		rc, e := filer.ResolveOneChunkManifest(ctx, fs.filerSource.LookupFileId, sourceChunk)
+		rc, e := filer.ResolveOneChunkManifestWithFilerJwt(ctx, fs.filerSource.LookupFileId, fs.filerSource.FilerJwt(), sourceChunk, nil)
 		if e != nil {
 			return e
 		}
 		resolvedChunks = rc
 		return nil
-	}, fs.manifestResolveRetryGate(path, sourceMtimeNs, sourceChunk.GetFileIdString()))
+	}, fs.manifestResolveRetryGate(path, sourceMtimeNs, topLevelId, missingGate))
 	if err != nil {
-		return nil, fmt.Errorf("resolve manifest %s: %w", sourceChunk.GetFileIdString(), err)
+		return nil, fmt.Errorf("resolve manifest %s: %w", sourceChunk.GetFileIdString(), missingGate.wrap(err))
 	}
 
-	replicatedResolvedChunks, err := fs.replicateChunks(ctx, resolvedChunks, path, sourceMtimeNs)
+	replicatedResolvedChunks, err := fs.replicateChunks(ctx, resolvedChunks, path, sourceMtimeNs, topLevelId)
 	if err != nil {
 		return nil, fmt.Errorf("replicate manifest data chunks %s: %w", sourceChunk.GetFileIdString(), err)
 	}
 
 	manifestDataChunks := make([]*filer_pb.FileChunk, len(replicatedResolvedChunks))
 	for i, chunk := range replicatedResolvedChunks {
-		copied := *chunk
-		manifestDataChunks[i] = &copied
+		manifestDataChunks[i] = proto.Clone(chunk).(*filer_pb.FileChunk)
 	}
 	filer_pb.BeforeEntrySerialization(manifestDataChunks)
 	manifestData, err := proto.Marshal(&filer_pb.FileChunkManifest{
@@ -196,13 +261,14 @@ const maxUnverifiableResolveAttempts = 3
 
 // manifestResolveRetryGate decides whether a failing manifest resolve keeps
 // retrying: stop when the source superseded the replayed version (the caller
-// skips it as lossless), stop immediately on non-transient errors (e.g. corrupt
-// manifest data) so the configured metadata error policy applies, and stop
-// after a few attempts when supersession cannot be checked at all (incremental
+// skips it as lossless), stop once the source has been unable to produce the
+// manifest for the whole grace period, stop immediately on non-transient errors
+// (e.g. corrupt manifest data) so the configured metadata error policy applies,
+// and stop after a few attempts when supersession cannot be checked at all (incremental
 // dated target keys don't map back to a source path) — propagating lets
 // filer.backup decide with the event's real source key instead of spinning
 // here forever.
-func (fs *FilerSink) manifestResolveRetryGate(path string, sourceMtimeNs int64, chunkName string) func(error) bool {
+func (fs *FilerSink) manifestResolveRetryGate(path string, sourceMtimeNs int64, chunkName string, missingGate *missingSourceChunkGate) func(error) bool {
 	_, canCheckSupersession := fs.targetPathToSourcePath(path)
 	attempts := 0
 	return func(resolveErr error) (shouldContinue bool) {
@@ -210,6 +276,16 @@ func (fs *FilerSink) manifestResolveRetryGate(path string, sourceMtimeNs int64,
 			glog.V(1).Infof("skip retrying stale source manifest %s for %s: %v", chunkName, path, resolveErr)
 			return false
 		}
+		if missingGate.isPermanent(resolveErr) {
+			glog.Errorf("source has not had manifest %s for %s in %v, giving up on it: %v",
+				chunkName, path, missingSourceChunkGrace, resolveErr)
+			return false
+		}
+		if isSourceChunkMissing(resolveErr) && fs.sourceDroppedChunk(path, chunkName, sourceMtimeNs) {
+			glog.V(0).Infof("source no longer lists manifest %s for %s, skipping the obsolete version: %v",
+				chunkName, path, resolveErr)
+			return false
+		}
 		if !isTransientResolveError(resolveErr) {
 			glog.V(0).Infof("resolve manifest %s for %s: non-transient error, propagating: %v", chunkName, path, resolveErr)
 			return false
@@ -259,6 +335,7 @@ func (fs *FilerSink) uploadManifestChunk(path string, sourceMtimeNs int64, sourc
 		}
 		if fs.writeChunkByFiler {
 			uploadOption.GenUploadUrl = operation.GenUploadUrlProxy(fs.address)
+			uploadOption.FilerJwt = fs.jwtForFiler
 		}
 		currentFileId, uploadResult, uploadErr, _ := uploader.UploadWithRetry(
 			fs,
@@ -298,7 +375,7 @@ func (fs *FilerSink) uploadManifestChunk(path string, sourceMtimeNs int64, sourc
 	return fileId, nil
 }
 
-func (fs *FilerSink) fetchAndWrite(sourceChunk *filer_pb.FileChunk, path string, sourceMtimeNs int64) (fileId string, err error) {
+func (fs *FilerSink) fetchAndWrite(sourceChunk *filer_pb.FileChunk, path string, sourceMtimeNs int64, topLevelId string) (fileId string, err error) {
 	uploader, err := fs.getUploader()
 	if err != nil {
 		glog.V(0).Infof("upload source data %v: %v", sourceChunk.GetFileIdString(), err)
@@ -316,6 +393,8 @@ func (fs *FilerSink) fetchAndWrite(sourceChunk *filer_pb.FileChunk, path string,
 	defer fs.activeTransfers.Delete(sourceChunk.GetFileIdString())
 
 	transientBackoff := time.Duration(0)
+	_, canCheckSupersession := fs.targetPathToSourcePath(path)
+	missingGate := fs.newMissingSourceChunkGate(sourceChunk.GetFileIdString())
 	var partialData []byte
 	var savedFilename string
 	var savedHeader http.Header
@@ -359,6 +438,7 @@ func (fs *FilerSink) fetchAndWrite(sourceChunk *filer_pb.FileChunk, path string,
 		if err := validateReplicatedReadSize(sourceChunk, len(fullData)); err != nil {
 			return err
 		}
+		fs.sourceServed(sourceChunk.GetFileIdString())
 
 		transferStatus.mu.Lock()
 		transferStatus.BytesReceived = int64(len(fullData))
@@ -376,6 +456,7 @@ func (fs *FilerSink) fetchAndWrite(sourceChunk *filer_pb.FileChunk, path string,
 		}
 		if fs.writeChunkByFiler {
 			uploadOption.GenUploadUrl = operation.GenUploadUrlProxy(fs.address)
+			uploadOption.FilerJwt = fs.jwtForFiler
 		}
 		currentFileId, uploadResult, uploadErr, _ := uploader.UploadWithRetry(
 			fs,
@@ -417,6 +498,27 @@ func (fs *FilerSink) fetchAndWrite(sourceChunk *filer_pb.FileChunk, path string,
 		transferStatus.mu.Lock()
 		transferStatus.LastErr = retryErr.Error()
 		transferStatus.mu.Unlock()
+		if isSourceChunkMissing(retryErr) {
+			if !canCheckSupersession {
+				glog.V(0).Infof("source does not have %s for %s, supersession unverifiable, propagating: %v",
+					sourceChunk.GetFileIdString(), path, retryErr)
+				return false
+			}
+			anchorId := topLevelId
+			if anchorId == "" {
+				anchorId = sourceChunk.GetFileIdString()
+			}
+			if fs.sourceDroppedChunk(path, anchorId, sourceMtimeNs) {
+				glog.V(0).Infof("source no longer lists %s for %s, skipping the obsolete version: %v",
+					anchorId, path, retryErr)
+				return false
+			}
+		}
+		if missingGate.isPermanent(retryErr) {
+			glog.Errorf("source has not had %s for %s in %v, giving up on it: %v",
+				sourceChunk.GetFileIdString(), path, missingSourceChunkGrace, retryErr)
+			return false
+		}
 		if isRetryableNetworkError(retryErr) {
 			transientBackoff = nextTransientBackoff(transientBackoff)
 			transferStatus.mu.Lock()
@@ -435,7 +537,7 @@ func (fs *FilerSink) fetchAndWrite(sourceChunk *filer_pb.FileChunk, path string,
 		return true
 	})
 	if err != nil {
-		return "", err
+		return "", missingGate.wrap(err)
 	}
 
 	return fileId, nil
@@ -486,6 +588,57 @@ func validateReplicatedReadSize(sourceChunk *filer_pb.FileChunk, readSize int) e
 	return nil
 }
 
+func (fs *FilerSink) newMissingSourceChunkGate(fileId string) *missingSourceChunkGate {
+	return &missingSourceChunkGate{sink: fs, volumeId: filer.VolumeId(fileId), fileId: fileId}
+}
+
+// sourceVolumeMissingSince returns when the sink first found volumeId
+// unlocatable, recording now on the first sighting.
+func (fs *FilerSink) sourceVolumeMissingSince(volumeId string) time.Time {
+	since, _ := fs.missingVolumes.LoadOrStore(volumeId, time.Now())
+	return since.(time.Time)
+}
+
+// sourceNeedleMissingSince returns when fileId first came back not-found from
+// an answering volume, recording now on the first sighting.
+func (fs *FilerSink) sourceNeedleMissingSince(fileId string) time.Time {
+	since, _ := fs.missingNeedles.LoadOrStore(fileId, time.Now())
+	return since.(time.Time)
+}
+
+// sourceServed records a chunk the source did serve: the probe
+// sourceStillServesChunks re-checks, proof its volume is locatable again, and
+// proof the needle itself is back if it had been reported missing.
+func (fs *FilerSink) sourceServed(fileId string) {
+	fs.lastServedFileId.Store(&fileId)
+	fs.missingVolumes.Delete(filer.VolumeId(fileId))
+	fs.missingNeedles.Delete(fileId)
+}
+
+// sourceStillServesChunks reports whether the source cluster can still produce the
+// last chunk it served. A volume with no locations reads the same whether it was
+// vacuumed away or every replica is down, so before an entry is written off the
+// sink re-reads a file id the source did serve: if that one cannot be produced
+// either the source is in an outage, and skipping would drop live files wholesale.
+// It is a read and not a lookup because a lookup only proves the master still has
+// the topology, not that a volume server answers.
+func (fs *FilerSink) sourceStillServesChunks() bool {
+	if fs.filerSource == nil {
+		return false
+	}
+	probe := fs.lastServedFileId.Load()
+	if probe == nil {
+		return false
+	}
+	_, _, resp, err := fs.filerSource.ReadPart(*probe, 0)
+	if err != nil {
+		glog.V(0).Infof("source cannot serve %s either, so it is not only the one chunk: %v", *probe, err)
+		return false
+	}
+	util_http.CloseResponse(resp)
+	return true
+}
+
 // hasSourceNewerVersion reports whether the source's current entry for targetPath
 // has moved past sourceMtimeNs — gone, or a strictly-newer mtime — meaning the
 // version being replayed is stale. The lookup runs regardless of sourceMtimeNs so
@@ -498,6 +651,34 @@ func (fs *FilerSink) hasSourceNewerVersion(targetPath string, sourceMtimeNs int6
 	return SourceSupersedes(context.Background(), fs.filerSource, sourcePath, sourceMtimeNs)
 }
 
+// sourceDroppedChunk reports whether the live source entry still exists but no
+// longer references fileId — a version rewritten in place, which the mtime
+// supersession check cannot see. Only a live entry at least as new as the
+// replayed version can prove that; an older one means the source was rolled
+// back and says nothing about whether the chunk is still needed.
+func (fs *FilerSink) sourceDroppedChunk(targetPath string, fileId string, sourceMtimeNs int64) bool {
+	sourcePath, ok := fs.targetPathToSourcePath(targetPath)
+	if !ok {
+		return false
+	}
+	live, _, _, err := filer_pb.GetEntry(context.Background(), fs.filerSource, sourcePath)
+	if err != nil || live == nil || sourceMtimeNs <= 0 || getEntryMtimeNs(live) < sourceMtimeNs {
+		return false
+	}
+	return !chunkFileIds(live.GetChunks())[fileId]
+}
+
+// chunkFileIds indexes a chunk list by file id. The id is the immutable needle
+// identity, so the sets compare chunk content exactly — manifest chunks need no
+// resolution, and no volume reads are involved.
+func chunkFileIds(chunks []*filer_pb.FileChunk) map[string]bool {
+	ids := make(map[string]bool, len(chunks))
+	for _, c := range chunks {
+		ids[c.GetFileIdString()] = true
+	}
+	return ids
+}
+
 // SourceSupersedes reports whether the live source's entry at sourcePath has
 // moved past the replayed version (mtimeNs) — deleted or strictly newer — so
 // skipping it is lossless. Exported for filer.backup's non-filer-sink decision.
diff --git a/weed/replication/sink/filersink/fetch_write_test.go b/weed/replication/sink/filersink/fetch_write_test.go
index b4b357d44d..05eb1855a0 100644
--- a/weed/replication/sink/filersink/fetch_write_test.go
+++ b/weed/replication/sink/filersink/fetch_write_test.go
@@ -1,17 +1,23 @@
 package filersink
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"slices"
 	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/replication/source"
@@ -227,7 +233,7 @@ func TestFetchAndWriteRejectsZeroByteSource(t *testing.T) {
 		err    error
 	}, 1)
 	go func() {
-		gotFileId, gotErr := fs.fetchAndWrite(sourceChunk, "/dst/index.bin", 0)
+		gotFileId, gotErr := fs.fetchAndWrite(sourceChunk, "/dst/index.bin", 0, "")
 		done <- struct {
 			fileId string
 			err    error
@@ -325,7 +331,7 @@ func TestReplicateChunksPreservesSizeMismatchSentinel(t *testing.T) {
 
 	sourceChunks := []*filer_pb.FileChunk{{FileId: fid, Size: expectedSize}}
 
-	_, err := fs.replicateChunks(nil, sourceChunks, "/dst/index.bin", 0)
+	_, err := fs.replicateChunks(nil, sourceChunks, "/dst/index.bin", 0, "")
 	if err == nil {
 		t.Fatal("expected error from replicateChunks, got nil")
 	}
@@ -390,7 +396,7 @@ func TestSourceSupersedesEpochMtime(t *testing.T) {
 // attempts and propagate instead of spinning forever.
 func TestManifestResolveRetryGateUnverifiableSupersessionBounded(t *testing.T) {
 	fs := &FilerSink{isIncremental: true, dir: "/backup"}
-	gate := fs.manifestResolveRetryGate("/backup/2026-07-10/buckets/x/f.pt", 123, "3,01abc")
+	gate := fs.manifestResolveRetryGate("/backup/2026-07-10/buckets/x/f.pt", 123, "3,01abc", fs.newMissingSourceChunkGate("3,01abc"))
 	resolveErr := errors.New("LookupFileId volume id 3: not found")
 	for i := 1; i < maxUnverifiableResolveAttempts; i++ {
 		if !gate(resolveErr) {
@@ -408,7 +414,7 @@ func TestManifestResolveRetryGateUnverifiableSupersessionBounded(t *testing.T) {
 // retrying until the source is superseded.
 func TestManifestResolveRetryGateNonTransientPropagates(t *testing.T) {
 	fs := &FilerSink{dir: "/backup"}
-	gate := fs.manifestResolveRetryGate("/backup/buckets/x/f.pt", 123, "3,01abc")
+	gate := fs.manifestResolveRetryGate("/backup/buckets/x/f.pt", 123, "3,01abc", fs.newMissingSourceChunkGate("3,01abc"))
 	permanentErrs := []error{
 		errors.New("fail to unmarshal manifest 3,01abc: proto: cannot parse invalid wire-format data"),
 		errors.New("invalid fileId abc"),
@@ -425,3 +431,458 @@ func TestManifestResolveRetryGateNonTransientPropagates(t *testing.T) {
 		t.Error("isTransientResolveError(nil) must be false")
 	}
 }
+
+// sourceFilerServer answers as a source filer that still holds the entry,
+// unchanged, while its master locates the chunk's volume only for the volume ids
+// in resolvable, which it serves from volumeUrl. With none listed it is a cluster
+// that has vacuumed the volume away — or lost every replica of it.
+type sourceFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	mtime      int64
+	volumeUrl  string
+	resolvable []string
+	entry      *filer_pb.Entry
+}
+
+func (s *sourceFilerServer) LookupVolume(ctx context.Context, req *filer_pb.LookupVolumeRequest) (*filer_pb.LookupVolumeResponse, error) {
+	locationsMap := make(map[string]*filer_pb.Locations)
+	for _, vid := range req.VolumeIds {
+		if slices.Contains(s.resolvable, vid) {
+			locationsMap[vid] = &filer_pb.Locations{
+				Locations: []*filer_pb.Location{{Url: s.volumeUrl}},
+			}
+		}
+	}
+	return &filer_pb.LookupVolumeResponse{LocationsMap: locationsMap}, nil
+}
+
+func (s *sourceFilerServer) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if s.entry != nil {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: s.entry}, nil
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: &filer_pb.Entry{
+		Name:       req.Name,
+		Attributes: &filer_pb.FuseAttributes{Mtime: s.mtime},
+	}}, nil
+}
+
+// liveVolume serves a chunk read the way a healthy volume server would, so the
+// sink's probe finds the source still producing data.
+func liveVolume(t *testing.T) string {
+	t.Helper()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte("chunk bytes"))
+	}))
+	t.Cleanup(server.Close)
+	return strings.TrimPrefix(server.URL, "http://")
+}
+
+func startSourceFiler(t *testing.T, mtime int64, volumeUrl string, resolvable ...string) *source.FilerSource {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	server := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(server, &sourceFilerServer{mtime: mtime, volumeUrl: volumeUrl, resolvable: resolvable})
+	go server.Serve(listener)
+	t.Cleanup(server.Stop)
+
+	address := listener.Addr().String()
+	filerSrc := &source.FilerSource{}
+	if err := filerSrc.DoInitialize(address, address, "/src", false); err != nil {
+		t.Fatalf("filerSource.DoInitialize: %v", err)
+	}
+	filerSrc.SetGrpcDialOption(grpc.WithTransportCredentials(insecure.NewCredentials()))
+	return filerSrc
+}
+
+func startSourceFilerWithEntry(t *testing.T, entry *filer_pb.Entry, volumeUrl string, resolvable ...string) *source.FilerSource {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	server := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(server, &sourceFilerServer{volumeUrl: volumeUrl, resolvable: resolvable, entry: entry})
+	go server.Serve(listener)
+	t.Cleanup(server.Stop)
+
+	address := listener.Addr().String()
+	filerSrc := &source.FilerSource{}
+	if err := filerSrc.DoInitialize(address, address, "/src", false); err != nil {
+		t.Fatalf("filerSource.DoInitialize: %v", err)
+	}
+	filerSrc.SetGrpcDialOption(grpc.WithTransportCredentials(insecure.NewCredentials()))
+	return filerSrc
+}
+
+// A chunk the source cluster cannot produce must stop being retried once the
+// grace period is up. Before, the retry loop ran forever: the sync job never
+// completed, so it held its slot and pinned the offset watermark at the event
+// ahead of it, and filer.sync never checkpointed again.
+func TestFetchAndWriteStopsOnMissingSourceChunk(t *testing.T) {
+	prevRetryWaitTime, prevGrace := util.RetryWaitTime, missingSourceChunkGrace
+	util.RetryWaitTime = 100 * time.Millisecond
+	missingSourceChunkGrace = 500 * time.Millisecond
+	t.Cleanup(func() {
+		util.RetryWaitTime, missingSourceChunkGrace = prevRetryWaitTime, prevGrace
+	})
+
+	live := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: 5},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "5617,01abc", Size: 10}},
+	}
+	filerSrc := startSourceFilerWithEntry(t, live, "")
+
+	fs := &FilerSink{
+		filerSource: filerSrc,
+		dir:         "/dst",
+		executor:    util.NewLimitedConcurrentExecutor(1),
+	}
+	fs.SetUploader(operation.NewUploaderWithHttpClient(http.DefaultClient))
+
+	done := make(chan error, 1)
+	go func() {
+		_, fetchErr := fs.fetchAndWrite(&filer_pb.FileChunk{FileId: "5617,01abc", Size: 10}, "/dst/x.bin", 5*int64(time.Second), "")
+		done <- fetchErr
+	}()
+
+	select {
+	case fetchErr := <-done:
+		if !errors.Is(fetchErr, errSourceChunkMissing) {
+			t.Fatalf("expected errSourceChunkMissing, got %v", fetchErr)
+		}
+		if !errors.Is(fetchErr, source.ErrVolumeNotFound) {
+			t.Fatalf("expected the underlying lookup failure to survive, got %v", fetchErr)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("fetchAndWrite is still retrying a chunk the source cannot produce")
+	}
+}
+
+// The gate waits out the shapes a restarting volume server produces, and only
+// gives up once the source has been saying "gone" for the whole grace period.
+// The wait belongs to the volume: a vacuumed one takes every file it held with
+// it, and waiting it out per file would stall the sync for as long as it holds
+// files.
+func TestMissingSourceChunkGate(t *testing.T) {
+	volumeGone := fmt.Errorf("read part 5617,01abc: %w", source.ErrVolumeNotFound)
+	needleGone := fmt.Errorf("read part 5617,01abc: 404 Not Found: %w", util_http.ErrNotFound)
+
+	fs := &FilerSink{}
+	gate := fs.newMissingSourceChunkGate("5617,01abc")
+	for _, err := range []error{volumeGone, needleGone} {
+		if gate.isPermanent(err) {
+			t.Fatalf("must keep retrying inside the grace period: %v", err)
+		}
+	}
+	if got := gate.wrap(volumeGone); errors.Is(got, errSourceChunkMissing) {
+		t.Fatalf("must not mark permanent while still retrying: %v", got)
+	}
+
+	// an unrelated failure is not the source answering "gone": it must not start a wait
+	other := fs.newMissingSourceChunkGate("5618,01abc")
+	other.isPermanent(errors.New("connection reset by peer"))
+	if _, found := fs.missingVolumes.Load("5618"); found {
+		t.Fatal("a non-missing error must not start the volume's wait")
+	}
+
+	// a second file in the same volume inherits that wait instead of restarting it
+	fs.missingVolumes.Store("5617", time.Now().Add(-2*missingSourceChunkGrace))
+	second := fs.newMissingSourceChunkGate("5617,02def")
+	if !second.isPermanent(volumeGone) {
+		t.Fatal("a later file must inherit the wait its volume already served")
+	}
+	wrapped := second.wrap(volumeGone)
+	if !errors.Is(wrapped, errSourceChunkMissing) || !errors.Is(wrapped, source.ErrVolumeNotFound) {
+		t.Fatalf("wrapped error lost a sentinel: %v", wrapped)
+	}
+	if second.wrap(nil) != nil {
+		t.Fatal("a successful retry must not be turned into an error")
+	}
+
+	// the volume answering again clears the wait it had served
+	fs.sourceServed("5617,09fff")
+	if _, found := fs.missingVolumes.Load("5617"); found {
+		t.Fatal("a served chunk must clear its volume's wait")
+	}
+
+	// a needle not-found answer keeps its own clock: the volume staying alive
+	// for other needles must not restart the wait for the one that is gone
+	fs.missingNeedles.Store("5619,01abc", time.Now().Add(-2*missingSourceChunkGrace))
+	needleGate := fs.newMissingSourceChunkGate("5619,01abc")
+	fs.sourceServed("5619,02def")
+	if !needleGate.isPermanent(needleGone) {
+		t.Fatal("a needle 404 must keep aging while its volume serves other needles")
+	}
+
+	// one needle's elapsed wait must not cut short a different needle's
+	fresh := fs.newMissingSourceChunkGate("5619,03ghi")
+	if fresh.isPermanent(needleGone) {
+		t.Fatal("a different needle on the same volume must get its own wait")
+	}
+
+	// the needle itself serving again is the only thing that restarts its wait
+	fs.sourceServed("5619,01abc")
+	if needleGate.isPermanent(needleGone) {
+		t.Fatal("a needle that serves again must restart its wait")
+	}
+}
+
+// Once the source has lost a chunk for good, holding the sync offset for its
+// entry only stops every later event from ever being checkpointed: the bytes are
+// not coming back. Skip it loudly instead — but only while the source is
+// demonstrably still serving other chunks, since a cluster that cannot locate
+// anything is having an outage and skipping would drop live files wholesale.
+func TestOnReplicateChunkErrorMissingSourceChunk(t *testing.T) {
+	const probe = "5616,01abc"
+	liveEntry := &filer_pb.Entry{Attributes: &filer_pb.FuseAttributes{Mtime: 5}}
+	missing := fmt.Errorf("copy 5617,02def: %w: %w", errSourceChunkMissing, source.ErrVolumeNotFound)
+
+	t.Run("source still serving", func(t *testing.T) {
+		fs := &FilerSink{filerSource: startSourceFiler(t, 5, liveVolume(t), "5616"), dir: "/dst"}
+		served := probe
+		fs.lastServedFileId.Store(&served)
+
+		if err := fs.onReplicateChunkError("/dst/x.bin", liveEntry, missing); err != nil {
+			t.Fatalf("expected the entry to be skipped, got %v", err)
+		}
+	})
+
+	t.Run("needle 404 needs no probe", func(t *testing.T) {
+		fs := &FilerSink{filerSource: startSourceFiler(t, 5, ""), dir: "/dst"}
+		notFound := fmt.Errorf("copy 5617,02def: %w: %w", errSourceChunkMissing, util_http.ErrNotFound)
+
+		if err := fs.onReplicateChunkError("/dst/x.bin", liveEntry, notFound); err != nil {
+			t.Fatalf("a 404 answered by the source is itself proof of liveness, got %v", err)
+		}
+	})
+
+	t.Run("proxied 404 still needs the probe", func(t *testing.T) {
+		proxied := &source.FilerSource{}
+		if err := proxied.DoInitialize("127.0.0.1:1", "127.0.0.1:1", "/src", true); err != nil {
+			t.Fatalf("DoInitialize: %v", err)
+		}
+		fs := &FilerSink{filerSource: proxied, dir: "/dst"}
+		notFound := fmt.Errorf("copy 5617,02def: %w: %w", errSourceChunkMissing, util_http.ErrNotFound)
+
+		if err := fs.onReplicateChunkError("/dst/x.bin", liveEntry, notFound); !errors.Is(err, errSourceChunkMissing) {
+			t.Fatalf("a filer-proxied 404 also covers missing locations, so it must not skip without the probe, got %v", err)
+		}
+	})
+
+	t.Run("source locating nothing", func(t *testing.T) {
+		fs := &FilerSink{filerSource: startSourceFiler(t, 5, ""), dir: "/dst"}
+		served := probe
+		fs.lastServedFileId.Store(&served)
+
+		if err := fs.onReplicateChunkError("/dst/x.bin", liveEntry, missing); !errors.Is(err, errSourceChunkMissing) {
+			t.Fatalf("expected the error to be held for a retry, got %v", err)
+		}
+	})
+
+	t.Run("probe locates but cannot be read", func(t *testing.T) {
+		gone := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			http.Error(w, "Not Found", http.StatusNotFound)
+		}))
+		defer gone.Close()
+		fs := &FilerSink{
+			filerSource: startSourceFiler(t, 5, strings.TrimPrefix(gone.URL, "http://"), "5616"),
+			dir:         "/dst",
+		}
+		served := probe
+		fs.lastServedFileId.Store(&served)
+
+		if err := fs.onReplicateChunkError("/dst/x.bin", liveEntry, missing); !errors.Is(err, errSourceChunkMissing) {
+			t.Fatalf("a volume the master lists but no server answers must not license a skip, got %v", err)
+		}
+	})
+
+	t.Run("nothing served yet", func(t *testing.T) {
+		fs := &FilerSink{filerSource: startSourceFiler(t, 5, liveVolume(t), "5616"), dir: "/dst"}
+
+		if err := fs.onReplicateChunkError("/dst/x.bin", liveEntry, missing); !errors.Is(err, errSourceChunkMissing) {
+			t.Fatalf("expected the error to be held with no probe to check, got %v", err)
+		}
+	})
+}
+
+// An incremental sink's dated target keys cannot be mapped back to a source path,
+// so nothing here can tell a vacuumed chunk from a superseded one. Waiting out the
+// grace period would stall every such entry for half an hour; propagate instead
+// and let filer.backup decide with the event's real source key.
+func TestFetchAndWriteMissingSourceChunkUnverifiableSupersession(t *testing.T) {
+	prevRetryWaitTime := util.RetryWaitTime
+	util.RetryWaitTime = 100 * time.Millisecond
+	t.Cleanup(func() { util.RetryWaitTime = prevRetryWaitTime })
+
+	fs := &FilerSink{
+		filerSource:   startSourceFiler(t, 5, ""),
+		dir:           "/backup",
+		isIncremental: true,
+		executor:      util.NewLimitedConcurrentExecutor(1),
+	}
+	fs.SetUploader(operation.NewUploaderWithHttpClient(http.DefaultClient))
+
+	done := make(chan error, 1)
+	go func() {
+		_, fetchErr := fs.fetchAndWrite(&filer_pb.FileChunk{FileId: "5617,01abc", Size: 10},
+			"/backup/2026-07-10/x.bin", 5*int64(time.Second), "")
+		done <- fetchErr
+	}()
+
+	select {
+	case fetchErr := <-done:
+		if !errors.Is(fetchErr, source.ErrVolumeNotFound) {
+			t.Fatalf("expected the lookup failure to propagate, got %v", fetchErr)
+		}
+		if errors.Is(fetchErr, errSourceChunkMissing) {
+			t.Fatalf("must not write the chunk off without checking supersession: %v", fetchErr)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("fetchAndWrite waited out the grace period with supersession unverifiable")
+	}
+}
+
+func TestSourceDroppedChunk(t *testing.T) {
+	live := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: 5},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "5617,02def", Size: 10}},
+	}
+	fs := &FilerSink{filerSource: startSourceFilerWithEntry(t, live, ""), dir: "/dst"}
+
+	if !fs.sourceDroppedChunk("/dst/x.bin", "5617,01abc", 5*int64(time.Second)) {
+		t.Fatal("live entry no longer referencing the chunk must count as dropped")
+	}
+	if fs.sourceDroppedChunk("/dst/x.bin", "5617,02def", 5*int64(time.Second)) {
+		t.Fatal("a chunk the live entry still lists must not count as dropped")
+	}
+	live.Attributes.Mtime = 4
+	if fs.sourceDroppedChunk("/dst/x.bin", "5617,01abc", 5*int64(time.Second)) {
+		t.Fatal("a live entry older than the replayed version cannot prove the chunk dropped")
+	}
+}
+
+func TestSourceMovedOn(t *testing.T) {
+	live := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: 5},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "5617,02def", Size: 10}},
+	}
+	replayed := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: 5},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "5617,01abc", Size: 10}},
+	}
+
+	fs := &FilerSink{filerSource: startSourceFilerWithEntry(t, live, ""), dir: "/dst"}
+	if !fs.sourceMovedOn("/dst/x.bin", replayed) {
+		t.Fatal("same-mtime entry with different chunks is moved on")
+	}
+	replayed.Chunks = live.Chunks
+	if fs.sourceMovedOn("/dst/x.bin", replayed) {
+		t.Fatal("identical chunks at equal mtime is the same version")
+	}
+	live.Attributes.Mtime = 6
+	if !fs.sourceMovedOn("/dst/x.bin", replayed) {
+		t.Fatal("newer mtime is still moved on")
+	}
+	live.Attributes.Mtime = 4
+	replayed.Chunks = []*filer_pb.FileChunk{{FileId: "5617,01abc", Size: 10}}
+	if fs.sourceMovedOn("/dst/x.bin", replayed) {
+		t.Fatal("an older live entry cannot supersede the replayed version")
+	}
+}
+
+// A replayed version the source rewrote in place must not wait out the
+// missing-chunk grace period: the live entry no longer lists the chunk, so the
+// loop stops on the first 404.
+func TestFetchAndWriteStopsWhenSourceDroppedChunk(t *testing.T) {
+	prevRetryWaitTime := util.RetryWaitTime
+	util.RetryWaitTime = 100 * time.Millisecond
+	t.Cleanup(func() { util.RetryWaitTime = prevRetryWaitTime })
+
+	gone := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "not found", http.StatusNotFound)
+	}))
+	defer gone.Close()
+
+	live := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: 5},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "5617,02def", Size: 10}},
+	}
+	filerSrc := startSourceFilerWithEntry(t, live, strings.TrimPrefix(gone.URL, "http://"), "5617")
+
+	fs := &FilerSink{
+		filerSource: filerSrc,
+		dir:         "/dst",
+		executor:    util.NewLimitedConcurrentExecutor(1),
+	}
+	fs.SetUploader(operation.NewUploaderWithHttpClient(http.DefaultClient))
+
+	done := make(chan error, 1)
+	go func() {
+		_, fetchErr := fs.fetchAndWrite(&filer_pb.FileChunk{FileId: "5617,01abc", Size: 10},
+			"/dst/x.bin", 5*int64(time.Second), "")
+		done <- fetchErr
+	}()
+
+	select {
+	case fetchErr := <-done:
+		if !errors.Is(fetchErr, util_http.ErrNotFound) {
+			t.Fatalf("expected the 404 to propagate, got %v", fetchErr)
+		}
+		if errors.Is(fetchErr, errSourceChunkMissing) {
+			t.Fatalf("an obsolete version must not wait for the give-up gate: %v", fetchErr)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("fetchAndWrite kept retrying a chunk the live entry no longer lists")
+	}
+}
+
+// A missing needle that lives inside a manifest is judged by whether the live
+// entry still lists the manifest, not the child: the manifest id is the
+// identity of its contents, so a live entry that kept it still needs the child.
+// The child must keep retrying under the gate — its error must come back marked
+// permanent by the clock, not returned raw by the dropped-chunk check.
+func TestFetchAndWriteManifestChildKeepsRetrying(t *testing.T) {
+	prevRetryWaitTime, prevGrace := util.RetryWaitTime, missingSourceChunkGrace
+	util.RetryWaitTime = 100 * time.Millisecond
+	missingSourceChunkGrace = 500 * time.Millisecond
+	t.Cleanup(func() {
+		util.RetryWaitTime, missingSourceChunkGrace = prevRetryWaitTime, prevGrace
+	})
+
+	gone := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "not found", http.StatusNotFound)
+	}))
+	defer gone.Close()
+
+	live := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: 5},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "5617,09fed", Size: 10}},
+	}
+	filerSrc := startSourceFilerWithEntry(t, live, strings.TrimPrefix(gone.URL, "http://"), "5617")
+
+	fs := &FilerSink{
+		filerSource: filerSrc,
+		dir:         "/dst",
+		executor:    util.NewLimitedConcurrentExecutor(1),
+	}
+	fs.SetUploader(operation.NewUploaderWithHttpClient(http.DefaultClient))
+
+	done := make(chan error, 1)
+	go func() {
+		_, fetchErr := fs.fetchAndWrite(&filer_pb.FileChunk{FileId: "5617,01abc", Size: 10},
+			"/dst/x.bin", 5*int64(time.Second), "5617,09fed")
+		done <- fetchErr
+	}()
+
+	select {
+	case fetchErr := <-done:
+		if !errors.Is(fetchErr, errSourceChunkMissing) {
+			t.Fatalf("a child of a still-listed manifest must expire via the gate, got %v", fetchErr)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("a still-listed manifest's missing child must not retry past the gate")
+	}
+}
diff --git a/weed/replication/sink/filersink/filer_sink.go b/weed/replication/sink/filersink/filer_sink.go
index a76923c410..838cd16950 100644
--- a/weed/replication/sink/filersink/filer_sink.go
+++ b/weed/replication/sink/filersink/filer_sink.go
@@ -8,6 +8,7 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
@@ -23,6 +24,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/replication/sink"
 	"github.com/seaweedfs/seaweedfs/weed/replication/source"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
 // ChunkTransferSnapshot is a lock-free, copyable view of a chunk transfer's
@@ -61,6 +63,15 @@ type FilerSink struct {
 	signature         int32
 	activeTransfers   sync.Map // chunkFileId -> *ChunkTransferStatus
 	uploader          *operation.Uploader
+	jwtForFiler       security.FilerJwtProvider
+	// lastServedFileId is the most recent chunk the source did serve, the probe
+	// sourceStillServesChunks re-checks before writing an entry off.
+	lastServedFileId atomic.Pointer[string]
+	missingVolumes   sync.Map // source volume id -> time.Time first found unlocatable
+	// missingNeedles records when each file id first came back not-found from an
+	// answering volume: only that needle serving again resets it, so a live
+	// volume's other needles neither shorten nor restart the wait.
+	missingNeedles sync.Map // source file id -> time.Time first answered not-found
 }
 
 func init() {
@@ -75,6 +86,10 @@ func (fs *FilerSink) GetSinkToDirectory() string {
 	return fs.dir
 }
 
+func (fs *FilerSink) GetDestinationIdentity() string {
+	return fs.grpcAddress + "\x00" + fs.dir
+}
+
 func (fs *FilerSink) IsIncremental() bool {
 	return fs.isIncremental
 }
@@ -107,6 +122,12 @@ func (fs *FilerSink) SetUploader(uploader *operation.Uploader) {
 	fs.uploader = uploader
 }
 
+// SetFilerJwtProvider sets the filer API credential for proxied chunk writes.
+// Must be called during initialization, before any replication goroutines start.
+func (fs *FilerSink) SetFilerJwtProvider(provider security.FilerJwtProvider) {
+	fs.jwtForFiler = provider
+}
+
 func (fs *FilerSink) getUploader() (*operation.Uploader, error) {
 	if fs.uploader != nil {
 		return fs.uploader, nil
@@ -156,14 +177,34 @@ func (fs *FilerSink) ActiveTransfers() []ChunkTransferSnapshot {
 }
 
 func (fs *FilerSink) DeleteEntry(key string, isDirectory, deleteIncludeChunks bool, signatures []int32) error {
+	return fs.deleteEntry(key, deleteIncludeChunks, false, signatures)
+}
+
+func (fs *FilerSink) DeleteEntryKeepingRemoteObject(key string, isDirectory, deleteIncludeChunks bool, signatures []int32) error {
+	return fs.deleteEntry(key, deleteIncludeChunks, true, signatures)
+}
+
+func (fs *FilerSink) deleteEntry(key string, deleteIncludeChunks, keepRemoteObject bool, signatures []int32) error {
 
 	dir, name := util.FullPath(key).DirAndName()
 
 	glog.V(4).Infof("delete entry: %v", key)
-	err := filer_pb.Remove(context.Background(), fs, dir, name, deleteIncludeChunks, true, true, true, signatures)
+	err := fs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		_, err := filer_pb.DoRemoveRequest(context.Background(), client, &filer_pb.DeleteEntryRequest{
+			Directory:            dir,
+			Name:                 name,
+			IsDeleteData:         deleteIncludeChunks,
+			IsRecursive:          true,
+			IgnoreRecursiveError: true,
+			IsFromOtherCluster:   true,
+			Signatures:           signatures,
+			KeepRemoteObject:     keepRemoteObject,
+		})
+		return err
+	})
 	if err != nil {
 		glog.V(0).Infof("delete entry %s: %v", key, err)
-		return fmt.Errorf("delete entry %s: %v", key, err)
+		return fmt.Errorf("delete entry %s: %w", key, err)
 	}
 	return nil
 }
@@ -253,7 +294,7 @@ func (fs *FilerSink) CreateEntry(key string, entry *filer_pb.Entry, signatures [
 				key, len(resp.Entry.GetChunks()), len(entry.GetChunks()))
 		}
 
-		replicatedChunks, err := fs.replicateChunks(context.Background(), entry.GetChunks(), key, getEntryMtimeNs(entry))
+		replicatedChunks, err := fs.replicateChunks(context.Background(), entry.GetChunks(), key, getEntryMtimeNs(entry), "")
 
 		if err != nil {
 			// don't swallow: committing mismatched bytes would propagate corruption
@@ -283,7 +324,7 @@ func (fs *FilerSink) CreateEntry(key string, entry *filer_pb.Entry, signatures [
 		glog.V(3).Infof("create: %v", request)
 		if err := filer_pb.CreateEntry(context.Background(), client, request); err != nil {
 			glog.V(0).Infof("create entry %s: %v", key, err)
-			return fmt.Errorf("create entry %s: %v", key, err)
+			return fmt.Errorf("create entry %s: %w", key, err)
 		}
 
 		return nil
@@ -316,7 +357,7 @@ func (fs *FilerSink) UpdateEntry(key string, oldEntry *filer_pb.Entry, newParent
 	})
 
 	if err != nil {
-		return false, fmt.Errorf("lookup %s: %v", key, err)
+		return false, fmt.Errorf("lookup %s: %w", key, err)
 	}
 
 	glog.V(4).Infof("oldEntry %+v, newEntry %+v, existingEntry: %+v", oldEntry, newEntry, existingEntry)
@@ -333,7 +374,7 @@ func (fs *FilerSink) UpdateEntry(key string, oldEntry *filer_pb.Entry, newParent
 	case updateRepair:
 		glog.Warningf("repair %s: destination diverged from source (dst %d chunks, src %d chunks); re-replicating full source content",
 			key, len(existingEntry.GetChunks()), len(newEntry.GetChunks()))
-		replicatedChunks, err := fs.replicateChunks(context.Background(), newEntry.GetChunks(), targetKey, getEntryMtimeNs(newEntry))
+		replicatedChunks, err := fs.replicateChunks(context.Background(), newEntry.GetChunks(), targetKey, getEntryMtimeNs(newEntry), "")
 		if err != nil {
 			if errors.Is(err, errChunkSizeMismatch) {
 				return true, fs.onCorruptChunk(targetKey, newEntry, err)
@@ -349,9 +390,9 @@ func (fs *FilerSink) UpdateEntry(key string, oldEntry *filer_pb.Entry, newParent
 		existingEntry.RemoteEntry = newEntry.RemoteEntry
 	default:
 		// source-side chunks resolve via source filer; sink volume IDs may collide.
-		deletedChunks, newChunks, err := compareChunks(context.Background(), filer.LookupFn(fs.filerSource), oldEntry, newEntry)
+		deletedChunks, newChunks, err := compareChunks(context.Background(), filer.LookupFn(fs.filerSource), fs.filerSource.FilerJwt(), oldEntry, newEntry)
 		if err != nil {
-			return true, fmt.Errorf("replicate %s compare chunks error: %v", key, err)
+			return true, fmt.Errorf("replicate %s compare chunks error: %w", key, err)
 		}
 
 		// delete the chunks that are deleted from the source
@@ -361,7 +402,7 @@ func (fs *FilerSink) UpdateEntry(key string, oldEntry *filer_pb.Entry, newParent
 		}
 
 		// replicate the chunks that are new in the source
-		replicatedChunks, err := fs.replicateChunks(context.Background(), newChunks, targetKey, getEntryMtimeNs(newEntry))
+		replicatedChunks, err := fs.replicateChunks(context.Background(), newChunks, targetKey, getEntryMtimeNs(newEntry), "")
 		if err != nil {
 			if errors.Is(err, errChunkSizeMismatch) {
 				return true, fs.onCorruptChunk(targetKey, newEntry, err)
@@ -388,19 +429,19 @@ func (fs *FilerSink) UpdateEntry(key string, oldEntry *filer_pb.Entry, newParent
 		}
 
 		if _, err := client.UpdateEntry(context.Background(), request); err != nil {
-			return fmt.Errorf("update existingEntry %s: %v", key, err)
+			return fmt.Errorf("update existingEntry %s: %w", key, err)
 		}
 
 		return nil
 	})
 
 }
-func compareChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, oldEntry, newEntry *filer_pb.Entry) (deletedChunks, newChunks []*filer_pb.FileChunk, err error) {
-	aData, aMeta, aErr := filer.ResolveChunkManifest(ctx, lookupFileIdFn, oldEntry.GetChunks(), 0, math.MaxInt64)
+func compareChunks(ctx context.Context, lookupFileIdFn wdclient.LookupFileIdFunctionType, filerJwtFn security.FilerJwtProvider, oldEntry, newEntry *filer_pb.Entry) (deletedChunks, newChunks []*filer_pb.FileChunk, err error) {
+	aData, aMeta, aErr := filer.ResolveChunkManifestWithFilerJwt(ctx, lookupFileIdFn, filerJwtFn, oldEntry.GetChunks(), 0, math.MaxInt64, nil)
 	if aErr != nil {
 		return nil, nil, aErr
 	}
-	bData, bMeta, bErr := filer.ResolveChunkManifest(ctx, lookupFileIdFn, newEntry.GetChunks(), 0, math.MaxInt64)
+	bData, bMeta, bErr := filer.ResolveChunkManifestWithFilerJwt(ctx, lookupFileIdFn, filerJwtFn, newEntry.GetChunks(), 0, math.MaxInt64, nil)
 	if bErr != nil {
 		return nil, nil, bErr
 	}
@@ -434,7 +475,7 @@ func EntryMtimeNs(entry *filer_pb.Entry) int64 {
 // meta events are full snapshots, so a later event re-carries the current chunks).
 // Otherwise the live version is corrupt, so return the error and halt loudly.
 func (fs *FilerSink) onCorruptChunk(key string, entry *filer_pb.Entry, err error) error {
-	if fs.hasSourceNewerVersion(key, getEntryMtimeNs(entry)) {
+	if fs.sourceMovedOn(key, entry) {
 		glog.Warningf("skip stale entry %s with superseded corrupt chunk: %v", key, err)
 		return nil
 	}
@@ -443,18 +484,58 @@ func (fs *FilerSink) onCorruptChunk(key string, entry *filer_pb.Entry, err error
 }
 
 // onReplicateChunkError handles a non-size-mismatch replicateChunks failure.
-// Skip (return nil) only when the live source has moved past this version —
-// deleted or strictly-newer mtime — so a later event carries the current
-// content and the skip is lossless. Otherwise propagate so the offset stays
-// put and the event is retried; returning nil would silently drop the file.
+// Skip (return nil) when the live source has moved past this version — deleted
+// or strictly-newer mtime — so a later event carries the current content and the
+// skip is lossless, or when the source has lost the chunk for good: it can never
+// serve those bytes to anyone, and holding the offset for it only stops every
+// later event from ever being checkpointed. Otherwise propagate so the offset
+// stays put and the event is retried; returning nil would silently drop the file.
 func (fs *FilerSink) onReplicateChunkError(key string, entry *filer_pb.Entry, err error) error {
-	if fs.hasSourceNewerVersion(key, getEntryMtimeNs(entry)) {
+	if fs.sourceMovedOn(key, entry) {
 		glog.Warningf("skip stale entry %s, source superseded during replicate: %v", key, err)
 		return nil
 	}
+	// A volume server's own 404 names this needle, so a direct-read 404 needs no
+	// liveness probe; a filer-proxied 404 also covers "no volume locations" and
+	// could be an outage, so it still must pass the probe.
+	direct404 := errors.Is(err, util_http.ErrNotFound) && fs.filerSource != nil && !fs.filerSource.ProxyByFiler()
+	if errors.Is(err, errSourceChunkMissing) && (direct404 || fs.sourceStillServesChunks()) {
+		glog.Errorf("skip %s: the source cluster cannot produce its data, so it stays unreplicated: %v", key, err)
+		return nil
+	}
 	return fmt.Errorf("replicate entry chunks %s: %w", key, err)
 }
 
+// sourceMovedOn reports whether the live source entry moved past the replayed
+// version: gone, strictly newer, or rewritten in place so it no longer
+// references the same chunks — the last is invisible to the mtime check. A live
+// entry older than the replayed version proves nothing about it.
+func (fs *FilerSink) sourceMovedOn(targetPath string, entry *filer_pb.Entry) bool {
+	sourcePath, ok := fs.targetPathToSourcePath(targetPath)
+	if !ok {
+		return false
+	}
+	replayedMtimeNs := getEntryMtimeNs(entry)
+	live, _, _, lookupErr := filer_pb.GetEntry(context.Background(), fs.filerSource, sourcePath)
+	if sourceSupersedes(sourcePath, live, lookupErr, replayedMtimeNs) {
+		return true
+	}
+	if lookupErr != nil || live == nil || replayedMtimeNs <= 0 || getEntryMtimeNs(live) < replayedMtimeNs {
+		return false
+	}
+	liveIds := chunkFileIds(live.GetChunks())
+	replayedIds := chunkFileIds(entry.GetChunks())
+	if len(liveIds) != len(replayedIds) {
+		return true
+	}
+	for id := range replayedIds {
+		if !liveIds[id] {
+			return true
+		}
+	}
+	return false
+}
+
 // updateAction decides how UpdateEntry reconciles an incoming source version with
 // the destination's current entry.
 type updateAction int
diff --git a/weed/replication/sink/gcssink/gcs_sink.go b/weed/replication/sink/gcssink/gcs_sink.go
index f0508f1fc5..ff2879addd 100644
--- a/weed/replication/sink/gcssink/gcs_sink.go
+++ b/weed/replication/sink/gcssink/gcs_sink.go
@@ -39,6 +39,10 @@ func (g *GcsSink) GetSinkToDirectory() string {
 	return g.dir
 }
 
+func (g *GcsSink) GetDestinationIdentity() string {
+	return g.bucket + "\x00" + g.dir
+}
+
 func (g *GcsSink) IsIncremental() bool {
 	return g.isIncremental
 }
@@ -113,7 +117,10 @@ func (g *GcsSink) CreateEntry(key string, entry *filer_pb.Entry, signatures []in
 	}
 
 	totalSize := filer.FileSize(entry)
-	chunkViews := filer.ViewFromChunks(context.Background(), g.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	chunkViews, err := filer.ViewFromChunks(context.Background(), g.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	if err != nil {
+		return fmt.Errorf("resolve chunks of %s: %w", key, err)
+	}
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
diff --git a/weed/replication/sink/localsink/local_sink.go b/weed/replication/sink/localsink/local_sink.go
index 8d17241709..8debf7993a 100644
--- a/weed/replication/sink/localsink/local_sink.go
+++ b/weed/replication/sink/localsink/local_sink.go
@@ -56,6 +56,10 @@ func (localsink *LocalSink) GetSinkToDirectory() string {
 	return localsink.Dir
 }
 
+func (localsink *LocalSink) GetDestinationIdentity() string {
+	return localsink.Dir
+}
+
 func (localsink *LocalSink) IsIncremental() bool {
 	return localsink.isIncremental
 }
@@ -80,7 +84,10 @@ func (localsink *LocalSink) CreateEntry(key string, entry *filer_pb.Entry, signa
 	glog.V(4).Infof("Create Entry key: %s", key)
 
 	totalSize := filer.FileSize(entry)
-	chunkViews := filer.ViewFromChunks(context.Background(), localsink.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	chunkViews, err := filer.ViewFromChunks(context.Background(), localsink.filerSource.LookupFileId, entry.GetChunks(), 0, int64(totalSize))
+	if err != nil {
+		return fmt.Errorf("resolve chunks of %s: %w", key, err)
+	}
 
 	dir := filepath.Dir(key)
 
diff --git a/weed/replication/sink/replication_sink.go b/weed/replication/sink/replication_sink.go
index 80eca00940..9528f4fb6e 100644
--- a/weed/replication/sink/replication_sink.go
+++ b/weed/replication/sink/replication_sink.go
@@ -13,6 +13,12 @@ type ReplicationSink interface {
 	CreateEntry(key string, entry *filer_pb.Entry, signatures []int32) error
 	UpdateEntry(key string, oldEntry *filer_pb.Entry, newParentPath string, newEntry *filer_pb.Entry, deleteIncludeChunks bool, signatures []int32) (foundExistingEntry bool, err error)
 	GetSinkToDirectory() string
+	// GetDestinationIdentity distinguishes this sink's write destination from
+	// any other destination the same sink type could write to: endpoint or
+	// account, bucket or container, and directory. filer.backup keys its resume
+	// checkpoint on it, so two configurations writing to different places must
+	// not share a value.
+	GetDestinationIdentity() string
 	SetSourceFiler(s *source.FilerSource)
 	IsIncremental() bool
 }
@@ -26,6 +32,21 @@ type EntryMover interface {
 	MoveEntry(oldKey, newKey string, newEntry *filer_pb.Entry, signatures []int32) error
 }
 
+// MetadataOnlyDeleter is an optional capability for sinks whose own delete
+// events reach remote write-back daemons: the destination filer re-emits a
+// replicated delete, so a source delete that kept the remote object must stay
+// metadata-only there too.
+type MetadataOnlyDeleter interface {
+	DeleteEntryKeepingRemoteObject(key string, isDirectory, deleteIncludeChunks bool, signatures []int32) error
+}
+
+func DeleteEntry(s ReplicationSink, key string, isDirectory, deleteIncludeChunks, keepRemoteObject bool, signatures []int32) error {
+	if deleter, ok := s.(MetadataOnlyDeleter); ok && keepRemoteObject {
+		return deleter.DeleteEntryKeepingRemoteObject(key, isDirectory, deleteIncludeChunks, signatures)
+	}
+	return s.DeleteEntry(key, isDirectory, deleteIncludeChunks, signatures)
+}
+
 var (
 	Sinks []ReplicationSink
 )
diff --git a/weed/replication/sink/s3sink/s3_sink.go b/weed/replication/sink/s3sink/s3_sink.go
index 310af9878c..8f365a6e5a 100644
--- a/weed/replication/sink/s3sink/s3_sink.go
+++ b/weed/replication/sink/s3sink/s3_sink.go
@@ -53,6 +53,10 @@ func (s3sink *S3Sink) GetSinkToDirectory() string {
 	return s3sink.dir
 }
 
+func (s3sink *S3Sink) GetDestinationIdentity() string {
+	return s3sink.endpoint + "\x00" + s3sink.bucket + "\x00" + s3sink.dir
+}
+
 func (s3sink *S3Sink) IsIncremental() bool {
 	return s3sink.isIncremental
 }
@@ -216,6 +220,11 @@ func (s3sink *S3Sink) CreateEntry(key string, entry *filer_pb.Entry, signatures
 		uploadInput.ContentMD5 = aws.String(base64.StdEncoding.EncodeToString([]byte(entry.Attributes.Md5)))
 	}
 	_, err = uploader.Upload(&uploadInput)
+	if err != nil {
+		if sourceErr := filer.ReaderSourceError(reader); sourceErr != nil {
+			return fmt.Errorf("read source %s: %w", key, sourceErr)
+		}
+	}
 
 	return err
 
diff --git a/weed/replication/source/filer_source.go b/weed/replication/source/filer_source.go
index babbb6c71f..cb8f4fcd0c 100644
--- a/weed/replication/source/filer_source.go
+++ b/weed/replication/source/filer_source.go
@@ -2,6 +2,7 @@ package source
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
@@ -18,6 +19,12 @@ import (
 	util_http_client "github.com/seaweedfs/seaweedfs/weed/util/http/client"
 )
 
+// ErrVolumeNotFound reports that the source cluster has no location for a
+// chunk's volume: vacuumed away, deleted, or every replica offline. Callers
+// need it apart from a lookup that simply failed, which a later attempt can
+// still get past.
+var ErrVolumeNotFound = errors.New("volume not found")
+
 type FilerSource struct {
 	grpcAddress    string
 	grpcDialOption grpc.DialOption
@@ -27,6 +34,7 @@ type FilerSource struct {
 	dataCenter     string
 	signature      int32
 	httpClient     *util_http_client.HTTPClient
+	jwtForFiler    security.FilerJwtProvider
 }
 
 func (fs *FilerSource) Initialize(configuration util.Configuration, prefix string) error {
@@ -60,6 +68,23 @@ func (fs *FilerSource) SetHttpClient(client *util_http_client.HTTPClient) {
 	fs.httpClient = client
 }
 
+func (fs *FilerSource) SetFilerJwtProvider(provider security.FilerJwtProvider) {
+	fs.jwtForFiler = provider
+}
+
+// FilerJwt returns the side-specific filer API credential, or nil when the
+// process-wide jwt.filer_signing configuration applies.
+// ProxyByFiler reports whether chunk reads are proxied through the source
+// filer. A proxied 404 can also mean the filer found no volume locations, so it
+// does not isolate a missing needle the way a direct volume read's 404 does.
+func (fs *FilerSource) ProxyByFiler() bool {
+	return fs.proxyByFiler
+}
+
+func (fs *FilerSource) FilerJwt() security.FilerJwtProvider {
+	return fs.jwtForFiler
+}
+
 func (fs *FilerSource) LookupFileId(ctx context.Context, part string) (fileUrls []string, err error) {
 
 	vid2Locations := make(map[string]*filer_pb.Locations)
@@ -88,8 +113,8 @@ func (fs *FilerSource) LookupFileId(ctx context.Context, part string) (fileUrls
 	locations := vid2Locations[vid]
 
 	if locations == nil || len(locations.Locations) == 0 {
-		glog.V(1).InfofCtx(ctx, "LookupFileId locate volume id %s: %v", vid, err)
-		return nil, fmt.Errorf("LookupFileId locate volume id %s: %v", vid, err)
+		glog.V(1).InfofCtx(ctx, "LookupFileId locate volume id %s: %v", vid, ErrVolumeNotFound)
+		return nil, fmt.Errorf("LookupFileId locate volume id %s: %w", vid, ErrVolumeNotFound)
 	}
 
 	if !fs.proxyByFiler {
@@ -103,7 +128,7 @@ func (fs *FilerSource) LookupFileId(ctx context.Context, part string) (fileUrls
 			}
 		}
 	} else {
-		fileUrls = append(fileUrls, fmt.Sprintf("http://%s/?proxyChunkId=%s", fs.address, part))
+		fileUrls = append(fileUrls, util_http.ProxyChunkUrl(fs.address, part))
 	}
 
 	return
@@ -118,12 +143,20 @@ func (fs *FilerSource) ReadPart(fileId string, offset int64) (filename string, h
 	}
 
 	if fs.proxyByFiler {
-		filename, header, resp, err = downloadFn("http://"+fs.address+"/?proxyChunkId="+fileId, "", offset)
+		fileUrl := util_http.ProxyChunkUrl(fs.address, fileId)
+		jwt := util_http.JwtForFilerServer(false)
+		if fs.jwtForFiler != nil {
+			jwt = string(fs.jwtForFiler(false))
+		}
+		filename, header, resp, err = downloadFn(fileUrl, jwt, offset)
+		if err == nil {
+			err = readPartStatusError(fileUrl, resp)
+		}
 		if err != nil {
 			glog.V(0).Infof("read part %s via filer proxy %s offset %d: %v", fileId, fs.address, offset, err)
-		} else {
-			glog.V(4).Infof("read part %s via filer proxy %s offset %d content-length:%s", fileId, fs.address, offset, header.Get("Content-Length"))
+			return "", nil, nil, err
 		}
+		glog.V(4).Infof("read part %s via filer proxy %s offset %d content-length:%s", fileId, fs.address, offset, header.Get("Content-Length"))
 		return
 	}
 
@@ -134,17 +167,36 @@ func (fs *FilerSource) ReadPart(fileId string, offset int64) (filename string, h
 
 	for _, fileUrl := range fileUrls {
 		filename, header, resp, err = downloadFn(fileUrl, "", offset)
-		if err != nil {
-			glog.V(0).Infof("fail to read part %s from %s offset %d: %v", fileId, fileUrl, offset, err)
-		} else {
-			glog.V(4).Infof("read part %s from %s offset %d content-length:%s", fileId, fileUrl, offset, header.Get("Content-Length"))
-			break
+		if err == nil {
+			err = readPartStatusError(fileUrl, resp)
 		}
+		if err != nil {
+			resp = nil
+			glog.V(0).Infof("fail to read part %s from %s offset %d: %v", fileId, fileUrl, offset, err)
+			continue
+		}
+		glog.V(4).Infof("read part %s from %s offset %d content-length:%s", fileId, fileUrl, offset, header.Get("Content-Length"))
+		break
 	}
 
 	return filename, header, resp, err
 }
 
+// readPartStatusError turns a failure status into an error and closes the
+// response. Otherwise the caller copies the error page as chunk content and
+// reports it as a short read; a needle vacuum has removed answers 404, which
+// is the source having lost the data rather than corruption.
+func readPartStatusError(fileUrl string, resp *http.Response) error {
+	if resp == nil || resp.StatusCode < http.StatusBadRequest {
+		return nil
+	}
+	defer util_http.CloseResponse(resp)
+	if resp.StatusCode == http.StatusNotFound {
+		return fmt.Errorf("%s: %s: %w", fileUrl, resp.Status, util_http.ErrNotFound)
+	}
+	return fmt.Errorf("%s: %s", fileUrl, resp.Status)
+}
+
 var _ = filer_pb.FilerClient(&FilerSource{})
 
 func (fs *FilerSource) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error {
diff --git a/weed/replication/source/filer_source_test.go b/weed/replication/source/filer_source_test.go
index 72ac122aa4..dd5d2215b3 100644
--- a/weed/replication/source/filer_source_test.go
+++ b/weed/replication/source/filer_source_test.go
@@ -3,14 +3,22 @@ package source
 import (
 	"bytes"
 	"compress/gzip"
+	"context"
+	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
 	"os"
+	"strings"
 	"sync/atomic"
 	"testing"
 
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
@@ -282,3 +290,106 @@ func TestDownloadFile_GzipPartialReadThenResume(t *testing.T) {
 		t.Fatalf("combined data mismatch: got %d bytes, want %d", len(fullData), len(testData))
 	}
 }
+
+// lookupFilerServer answers volume lookups with a fixed set of locations, so a
+// test can hand ReadPart several replicas, or none at all.
+type lookupFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	locations []string
+}
+
+func (s *lookupFilerServer) LookupVolume(ctx context.Context, req *filer_pb.LookupVolumeRequest) (*filer_pb.LookupVolumeResponse, error) {
+	locationsMap := make(map[string]*filer_pb.Locations)
+	for _, vid := range req.VolumeIds {
+		if len(s.locations) == 0 {
+			continue
+		}
+		locations := &filer_pb.Locations{}
+		for _, url := range s.locations {
+			locations.Locations = append(locations.Locations, &filer_pb.Location{Url: url})
+		}
+		locationsMap[vid] = locations
+	}
+	return &filer_pb.LookupVolumeResponse{LocationsMap: locationsMap}, nil
+}
+
+func startLookupFiler(t *testing.T, locations ...string) *FilerSource {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	server := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(server, &lookupFilerServer{locations: locations})
+	go server.Serve(listener)
+	t.Cleanup(server.Stop)
+
+	address := listener.Addr().String()
+	filerSource := &FilerSource{}
+	if err := filerSource.DoInitialize(address, address, "/", false); err != nil {
+		t.Fatalf("DoInitialize: %v", err)
+	}
+	filerSource.SetGrpcDialOption(grpc.WithTransportCredentials(insecure.NewCredentials()))
+	return filerSource
+}
+
+// A volume the source cluster no longer has must be reported as ErrVolumeNotFound,
+// not as an untyped message the caller can only string-match.
+func TestLookupFileIdVolumeNotFound(t *testing.T) {
+	filerSource := startLookupFiler(t)
+
+	_, err := filerSource.LookupFileId(context.Background(), "5617,01abc")
+	if !errors.Is(err, ErrVolumeNotFound) {
+		t.Fatalf("expected ErrVolumeNotFound, got %v", err)
+	}
+}
+
+// A replica answering 404 is a failed read, not an empty file: ReadPart must move
+// on to the next replica instead of handing the error page back as content.
+func TestReadPartSkipsNotFoundReplica(t *testing.T) {
+	const body = "chunk bytes"
+
+	gone := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "Not Found", http.StatusNotFound)
+	}))
+	defer gone.Close()
+	live := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write([]byte(body))
+	}))
+	defer live.Close()
+
+	filerSource := startLookupFiler(t,
+		strings.TrimPrefix(gone.URL, "http://"), strings.TrimPrefix(live.URL, "http://"))
+
+	_, _, resp, err := filerSource.ReadPart("5617,01abc", 0)
+	if err != nil {
+		t.Fatalf("ReadPart: %v", err)
+	}
+	defer util_http.CloseResponse(resp)
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("read body: %v", err)
+	}
+	if string(data) != body {
+		t.Fatalf("got %q, want %q", data, body)
+	}
+}
+
+// Every replica gone: the caller must see a not-found error it can act on, and no
+// response left open behind it.
+func TestReadPartAllReplicasNotFound(t *testing.T) {
+	gone := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "Not Found", http.StatusNotFound)
+	}))
+	defer gone.Close()
+
+	filerSource := startLookupFiler(t, strings.TrimPrefix(gone.URL, "http://"))
+
+	_, _, resp, err := filerSource.ReadPart("5617,01abc", 0)
+	if !errors.Is(err, util_http.ErrNotFound) {
+		t.Fatalf("expected ErrNotFound, got %v", err)
+	}
+	if resp != nil {
+		t.Fatal("expected no response alongside the error")
+	}
+}
diff --git a/weed/s3api/auth_access_key_attribution_test.go b/weed/s3api/auth_access_key_attribution_test.go
new file mode 100644
index 0000000000..729e50e98a
--- /dev/null
+++ b/weed/s3api/auth_access_key_attribution_test.go
@@ -0,0 +1,75 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+const (
+	sharedKeyA    = "AKIASHAREDKEYAAAAAAA"
+	sharedSecretA = "secret-a-wJalrXUtnFEMI/K7MDENG/bPxRfiCY"
+	sharedKeyB    = "AKIASHAREDKEYBBBBBBB"
+	sharedSecretB = "secret-b-wJalrXUtnFEMI/K7MDENG/bPxRfiCY"
+)
+
+// newSharedIdentityIAM returns one identity holding two key pairs, as when
+// several people or services are given their own key on one identity.
+func newSharedIdentityIAM() *IdentityAccessManagement {
+	iam := &IdentityAccessManagement{}
+	shared := &Identity{
+		Name: "shared-user",
+		Credentials: []*Credential{
+			{AccessKey: sharedKeyA, SecretKey: sharedSecretA},
+			{AccessKey: sharedKeyB, SecretKey: sharedSecretB},
+		},
+		Actions: []Action{s3_constants.ACTION_READ},
+	}
+	iam.identities = []*Identity{shared}
+	iam.accessKeyIdent = map[string]*Identity{sharedKeyA: shared, sharedKeyB: shared}
+	iam.nameToIdentity = map[string]*Identity{shared.Name: shared}
+	return iam
+}
+
+// Two keys of one identity: the audit entry names the same requester for both
+// and tells them apart by the key each request was signed with.
+func TestAuditLogCarriesTheSigningAccessKey(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	for _, key := range []struct{ id, secret string }{{sharedKeyA, sharedSecretA}, {sharedKeyB, sharedSecretB}} {
+		req, err := newTestRequest(http.MethodGet, "https://example.com/bucket/ns/t/data/f.parquet", 0, nil)
+		require.NoError(t, err)
+		require.NoError(t, signRequestV4(req, key.id, key.secret))
+		// track() installs the holder before authentication runs.
+		outer := s3_constants.EnsureIdentityHolder(req)
+
+		identity, errCode := iam.reqSignatureV4Verify(outer)
+		require.Equal(t, s3err.ErrNone, errCode)
+		iam.handleAuthResult(httptest.NewRecorder(), outer, identity, s3err.ErrNone, func(http.ResponseWriter, *http.Request) {})
+
+		log := s3err.GetAccessLog(outer, http.StatusOK, s3err.ErrNone)
+		assert.Equal(t, "shared-user", log.Requester)
+		assert.Equal(t, key.id, log.AccessKeyId, "audit entry must name the key the request was signed with")
+	}
+}
+
+// A request refused after authentication still names its key, like its requester.
+func TestAuditLogCarriesTheAccessKeyOnTheDenyPath(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	req, err := newTestRequest(http.MethodGet, "https://example.com/bucket/f.parquet", 0, nil)
+	require.NoError(t, err)
+	require.NoError(t, signRequestV4(req, sharedKeyB, sharedSecretB))
+	outer := s3_constants.EnsureIdentityHolder(req)
+	identity, errCode := iam.reqSignatureV4Verify(outer)
+	require.Equal(t, s3err.ErrNone, errCode)
+
+	iam.handleAuthResult(httptest.NewRecorder(), outer, identity, s3err.ErrAccessDenied, func(http.ResponseWriter, *http.Request) {
+		t.Fatal("handler must not run on the deny path")
+	})
+	assert.Equal(t, sharedKeyB, s3err.GetAccessLog(outer, http.StatusForbidden, s3err.ErrAccessDenied).AccessKeyId)
+}
diff --git a/weed/s3api/auth_access_key_post_policy_test.go b/weed/s3api/auth_access_key_post_policy_test.go
new file mode 100644
index 0000000000..50e36bb023
--- /dev/null
+++ b/weed/s3api/auth_access_key_post_policy_test.go
@@ -0,0 +1,86 @@
+package s3api
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// signedPostFormV2 builds a multipart POST Object request whose policy is
+// signed with SigV2 under postAuthzAccessKey and secret.
+func signedPostFormV2(t *testing.T, key, secret string) *http.Request {
+	t.Helper()
+	policyJSON := fmt.Sprintf(`{"expiration":"%s","conditions":[["eq","$bucket","%s"],["eq","$key","%s"]]}`,
+		time.Now().UTC().Add(time.Hour).Format("2006-01-02T15:04:05.000Z"), postAuthzBucket, key)
+	encodedPolicy := base64.StdEncoding.EncodeToString([]byte(policyJSON))
+
+	var buf bytes.Buffer
+	writer := multipart.NewWriter(&buf)
+	for _, field := range [][2]string{{"bucket", postAuthzBucket}, {"key", key}, {"AWSAccessKeyId", postAuthzAccessKey},
+		{"policy", encodedPolicy}, {"Signature", calculateSignatureV2(encodedPolicy, secret)}} {
+		require.NoError(t, writer.WriteField(field[0], field[1]))
+	}
+	filePart, err := writer.CreateFormFile("file", "payload.txt")
+	require.NoError(t, err)
+	_, err = filePart.Write([]byte("payload"))
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+
+	req := httptest.NewRequest(http.MethodPost, "/"+postAuthzBucket, &buf)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	return mux.SetURLVars(req, map[string]string{"bucket": postAuthzBucket})
+}
+
+// A browser POST upload is verified in the handler from its form fields; the
+// key of the verified form reaches the audit log like a signed PUT's. The
+// bucket policy denies denied/ so the request ends before the filer.
+func TestPostPolicyUploadRecordsTheSigningKey(t *testing.T) {
+	s3a := newPostAuthzServer(t)
+	for name, req := range map[string]*http.Request{
+		"SigV4": newSignedPostRequest(t, "denied/secret.txt"),
+		"SigV2": signedPostFormV2(t, "denied/secret.txt", postAuthzSecretKey),
+	} {
+		outer := s3_constants.EnsureIdentityHolder(req)
+		rec := httptest.NewRecorder()
+		s3a.PostPolicyBucketHandler(rec, outer)
+		require.Equal(t, http.StatusForbidden, rec.Code, "%s: %s", name, rec.Body.String())
+		assert.Equal(t, postAuthzAccessKey, s3err.GetAccessLog(outer, http.StatusForbidden, s3err.ErrAccessDenied).AccessKeyId, name)
+	}
+
+	// A form whose signature does not verify records nothing.
+	outer := s3_constants.EnsureIdentityHolder(signedPostFormV2(t, "denied/secret.txt", "not-the-secret"))
+	rec := httptest.NewRecorder()
+	s3a.PostPolicyBucketHandler(rec, outer)
+	require.Contains(t, rec.Body.String(), "SignatureDoesNotMatch")
+	assert.Equal(t, "", s3_constants.GetAccessKeyIdFromContext(outer))
+}
+
+// A signature that verifies for one virtual-hosted bucket but is routed to
+// another is refused after verification; the refusal still names the key.
+func TestSignedVirtualHostRetargetRecordsTheSigningKey(t *testing.T) {
+	iam := newVirtualHostTestIAM("s3.test")
+	r, err := newTestRequest("GET", "http://alpha-bkt.s3.test/shared.txt", 0, nil)
+	require.NoError(t, err)
+	r.Header.Set("Host", "alpha-bkt.s3.test")
+	signV4WithPath(r, "access_key_1", "secret_key_1", r.URL.Path)
+	r.Host = "beta-bkt.s3.test"
+	r.Header.Set("X-Forwarded-Host", "alpha-bkt.s3.test")
+	r = mux.SetURLVars(r, map[string]string{"bucket": "beta-bkt", "object": "shared.txt"})
+	r = s3_constants.EnsureIdentityHolder(r)
+
+	_, _, errCode := iam.doesSignatureMatch(r)
+	require.Equal(t, s3err.ErrAccessDenied, errCode)
+	assert.Equal(t, "access_key_1", s3_constants.GetAccessKeyIdFromContext(r))
+}
diff --git a/weed/s3api/auth_access_key_shapes_test.go b/weed/s3api/auth_access_key_shapes_test.go
new file mode 100644
index 0000000000..5ea2b2ac4c
--- /dev/null
+++ b/weed/s3api/auth_access_key_shapes_test.go
@@ -0,0 +1,141 @@
+package s3api
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// The key recorded for a request is the key of the credential that verified,
+// whatever else the request carries. A request names its key in several
+// places (SigV4 header, X-Amz-Credential, SigV2 header, AWSAccessKeyId);
+// getRequestAuthType picks one and that verifier records it, so a second,
+// unverified key in another place never reaches the audit log or a vended
+// session.
+
+func authAndRecordedKey(t *testing.T, iam *IdentityAccessManagement, r *http.Request) (s3err.ErrorCode, string) {
+	t.Helper()
+	r = s3_constants.EnsureIdentityHolder(r)
+	_, errCode, _ := iam.authenticateRequestInternal(r)
+	return errCode, s3_constants.GetAccessKeyIdFromContext(r)
+}
+
+func credOf(key, secret string) *Credential { return &Credential{AccessKey: key, SecretKey: secret} }
+
+func TestRecordedKeyIsTheVerifiedKeyForSigV4Header(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	r, err := newTestRequest(http.MethodGet, "https://example.com/bucket/f.parquet", 0, nil)
+	require.NoError(t, err)
+	require.NoError(t, signRequestV4(r, sharedKeyA, sharedSecretA))
+	errCode, got := authAndRecordedKey(t, iam, r)
+	require.Equal(t, s3err.ErrNone, errCode)
+	assert.Equal(t, sharedKeyA, got)
+}
+
+// SigV2 header signed with A, plus X-Amz-Credential naming B or garbage: the
+// request authenticates as A (SigV2 is checked first) and A is recorded.
+func TestRecordedKeyIgnoresAJunkCredentialQueryOnASigV2Request(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	for _, junk := range []string{sharedKeyB + "/20261016/us-east-1/s3/aws4_request", "GARBAGE"} {
+		r, err := http.NewRequest(http.MethodGet, "http://example.com/bucket/f.parquet?X-Amz-Credential="+url.QueryEscape(junk), nil)
+		require.NoError(t, err)
+		r.Header.Set("Date", time.Now().UTC().Format(http.TimeFormat))
+		r.Header.Set("Authorization", signatureV2(credOf(sharedKeyA, sharedSecretA), r.Method, r.URL.EscapedPath(), r.URL.Query().Encode(), r.Header))
+		errCode, got := authAndRecordedKey(t, iam, r)
+		require.Equal(t, s3err.ErrNone, errCode, "the SigV2 signature with A verifies (junk %q)", junk)
+		assert.Equal(t, sharedKeyA, got, "the key that verified, not the junk %q", junk)
+	}
+}
+
+// SigV2 presigned with A, plus a junk SigV4 Authorization naming B: the
+// presigned A verifies and A is recorded.
+func TestRecordedKeyIgnoresAJunkSigV4HeaderOnASigV2PresignedRequest(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	expires := strconv.FormatInt(time.Now().Add(10*time.Minute).Unix(), 10)
+	q := url.Values{"AWSAccessKeyId": {sharedKeyA}, "Expires": {expires}}
+	r, err := http.NewRequest(http.MethodGet, "http://example.com/bucket/f.parquet?"+q.Encode(), nil)
+	require.NoError(t, err)
+	sig := preSignatureV2(credOf(sharedKeyA, sharedSecretA), r.Method, r.URL.EscapedPath(), r.URL.Query().Encode(), r.Header, expires)
+	q.Set("Signature", sig)
+	r.URL.RawQuery = q.Encode()
+	r.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential="+sharedKeyB+"/20261016/us-east-1/s3/aws4_request, SignedHeaders=host, Signature=00")
+
+	errCode, got := authAndRecordedKey(t, iam, r)
+	require.Equal(t, s3err.ErrNone, errCode, "the SigV2 presigned A verifies (SigV2 is dispatched first)")
+	assert.Equal(t, sharedKeyA, got, "the presigned key A is recorded, never the unverified B")
+}
+
+// A refused signature records nothing, even when the key exists.
+func TestRecordedKeyIsEmptyWhenTheSignatureFails(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	r, err := newTestRequest(http.MethodGet, "https://example.com/bucket/f.parquet", 0, nil)
+	require.NoError(t, err)
+	require.NoError(t, signRequestV4(r, sharedKeyA, "not-the-secret"))
+	errCode, got := authAndRecordedKey(t, iam, r)
+	require.NotEqual(t, s3err.ErrNone, errCode)
+	assert.Equal(t, "", got)
+
+	r2 := httptest.NewRequest(http.MethodGet, "http://example.com/bucket/f.parquet", nil)
+	r2.Header.Set("Date", time.Now().UTC().Format(http.TimeFormat))
+	r2.Header.Set("Authorization", "AWS "+sharedKeyB+":bm90LWEtc2lnbmF0dXJl")
+	errCode, got = authAndRecordedKey(t, iam, r2)
+	require.NotEqual(t, s3err.ErrNone, errCode)
+	assert.Equal(t, "", got)
+}
+
+// A streaming (aws-chunked) upload records the key of its seed signature.
+func TestRecordedKeyForAStreamingUpload(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	now := time.Now().UTC()
+	amzDate, dateStamp := now.Format(iso8601Format), now.Format(yyyymmdd)
+	scope := dateStamp + "/us-east-1/s3/aws4_request"
+	hashedPayload := "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
+	canonicalHeaders := "content-encoding:aws-chunked\n" + "host:s3.amazonaws.com\n" +
+		"x-amz-content-sha256:" + hashedPayload + "\n" + "x-amz-date:" + amzDate + "\n" + "x-amz-decoded-content-length:4\n"
+	signedHeaders := "content-encoding;host;x-amz-content-sha256;x-amz-date;x-amz-decoded-content-length"
+	canonicalRequest := "PUT\n/bucket/ns/t/data/f.parquet\n\n" + canonicalHeaders + "\n" + signedHeaders + "\n" + hashedPayload
+	stringToSign := "AWS4-HMAC-SHA256\n" + amzDate + "\n" + scope + "\n" + getSHA256Hash([]byte(canonicalRequest))
+	seed := getSignature(getSigningKey(sharedSecretB, dateStamp, "us-east-1", "s3"), stringToSign)
+
+	r, err := http.NewRequest(http.MethodPut, "http://s3.amazonaws.com/bucket/ns/t/data/f.parquet", bytes.NewReader([]byte("ignored")))
+	require.NoError(t, err)
+	r.Header.Set("Host", "s3.amazonaws.com")
+	r.Header.Set("x-amz-date", amzDate)
+	r.Header.Set("x-amz-content-sha256", hashedPayload)
+	r.Header.Set("Content-Encoding", "aws-chunked")
+	r.Header.Set("x-amz-decoded-content-length", "4")
+	r.Header.Set("Authorization", fmt.Sprintf("AWS4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%s", sharedKeyB, scope, signedHeaders, seed))
+
+	errCode, got := authAndRecordedKey(t, iam, r)
+	require.Equal(t, s3err.ErrNone, errCode)
+	assert.Equal(t, sharedKeyB, got)
+}
+
+// An STS session's request records the session's temporary key.
+func TestRecordedKeyForAnSTSSession(t *testing.T) {
+	stsService, config := setupTestSTSService(t)
+	iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{}, nil, "memory")
+	iam.SetIAMIntegration(&S3IAMIntegration{stsService: stsService, enabled: true})
+	sessionInfo, sessionToken := issueTestSession(t, stsService, config)
+
+	r, err := newTestRequest(http.MethodGet, "https://example.com/reports/data.csv", 0, nil)
+	require.NoError(t, err)
+	r.Header.Set("X-Amz-Security-Token", sessionToken)
+	require.NoError(t, signRequestV4(r, sessionInfo.Credentials.AccessKeyId, sessionInfo.Credentials.SecretAccessKey))
+	outer := s3_constants.EnsureIdentityHolder(r)
+	identity, errCode := iam.reqSignatureV4Verify(outer)
+	require.Equal(t, s3err.ErrNone, errCode)
+	iam.handleAuthResult(httptest.NewRecorder(), outer, identity, s3err.ErrNone, func(http.ResponseWriter, *http.Request) {})
+	assert.Equal(t, sessionInfo.Credentials.AccessKeyId, s3err.GetAccessLog(outer, http.StatusOK, s3err.ErrNone).AccessKeyId)
+}
diff --git a/weed/s3api/auth_account_collapse_test.go b/weed/s3api/auth_account_collapse_test.go
index 141c6440d4..b2b741a7c2 100644
--- a/weed/s3api/auth_account_collapse_test.go
+++ b/weed/s3api/auth_account_collapse_test.go
@@ -290,3 +290,32 @@ func TestDeclaredAccountOutranksInlineIdentityAccount(t *testing.T) {
 	assert.Equal(t, "100000000001", iam.GetAccountIdByEmail("alice@example.com"), "the declared email must stay indexed")
 	assert.Empty(t, iam.GetAccountIdByEmail("wrong@example.com"), "an inline block must not claim an email for a declared account")
 }
+
+// Stored owner strings that name a configured identity or account were never
+// OIDC subjects; recognizing them keeps issuer re-anchoring away from local
+// principals.
+func TestIsConfiguredAccountID(t *testing.T) {
+	resetMemoryStore()
+
+	config := `{
+  "identities": [
+    {"name": "alice", "credentials": [{"accessKey": "alice_ak", "secretKey": "alice_sk"}], "actions": ["Read"]},
+    {"name": "bob", "account": {"id": "100000000002"}, "credentials": [{"accessKey": "bob_ak", "secretKey": "bob_sk"}], "actions": ["Read"]}
+  ]
+}`
+	tmp, err := os.CreateTemp("", "s3-config-*.json")
+	require.NoError(t, err)
+	defer os.Remove(tmp.Name())
+	_, err = tmp.WriteString(config)
+	require.NoError(t, err)
+	require.NoError(t, tmp.Close())
+
+	iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{Config: tmp.Name()}, nil, "memory")
+
+	for _, id := range []string{"admin", "anonymous", "alice", "bob", "100000000002"} {
+		assert.True(t, iam.isConfiguredAccountID(id), "%q is a configured local account", id)
+	}
+	for _, id := range []string{"mallory", "alice-sub", "000000000042"} {
+		assert.False(t, iam.isConfiguredAccountID(id), "%q is not a configured local account", id)
+	}
+}
diff --git a/weed/s3api/auth_audit_requester_test.go b/weed/s3api/auth_audit_requester_test.go
index bf1df04e4d..189f328e24 100644
--- a/weed/s3api/auth_audit_requester_test.go
+++ b/weed/s3api/auth_audit_requester_test.go
@@ -57,6 +57,130 @@ func TestAuditRequesterArnForSTSSession(t *testing.T) {
 		"audit entry must name the assumed role and session")
 }
 
+// An OIDC-federated STS session authenticates as an opaque session subject, so
+// the requester field alone is useless for compliance auditing. The audit entry
+// must surface the authoritative OIDC identity claim (preferred_username, email
+// or sub) carried in the session request context, independent of the
+// client-supplied role session name. See issue #11264.
+func TestAuditRequesterIdentityForOIDCFederatedSession(t *testing.T) {
+	iam := &IdentityAccessManagement{
+		iamIntegration: &MockIAMIntegration{
+			validateSessionFunc: func(ctx context.Context, token string) (*sts.SessionInfo, error) {
+				return &sts.SessionInfo{
+					AssumedRoleUser: "S3ReadOnlyRole/boto3-session",
+					Principal:       "arn:aws:sts::assumed-role/S3ReadOnlyRole/boto3-session",
+					Subject:         "2a19e647c5d43a62a91ecf664d07dbe1",
+					SessionName:     "boto3-session",
+					Credentials: &sts.Credentials{
+						AccessKeyId:     "ASIA0189777d42cba8e2",
+						SecretAccessKey: "secret",
+					},
+					ExpiresAt:  time.Now().Add(time.Hour),
+					Policies:   []string{"S3ReadOnly"},
+					ParentUser: sts.ComputeParentUser("oidc-sub-123", "https://idp.example/"),
+					RequestContext: map[string]interface{}{
+						"preferred_username": "grant.west",
+						"email":              "grant.west@digital.mod.uk",
+						"sub":                "oidc-sub-123",
+					},
+				}, nil
+			},
+		},
+	}
+
+	outer := s3_constants.EnsureIdentityHolder(httptest.NewRequest(http.MethodGet, "http://s3/test/", nil))
+
+	identity, _, errCode := iam.validateSTSSessionToken(outer, "session-token", "ASIA0189777d42cba8e2")
+	require.Equal(t, s3err.ErrNone, errCode)
+
+	iam.handleAuthResult(httptest.NewRecorder(), outer, identity, s3err.ErrNone, func(http.ResponseWriter, *http.Request) {})
+
+	log := s3err.GetAccessLog(outer, http.StatusOK, s3err.ErrNone)
+	assert.Equal(t, "2a19e647c5d43a62a91ecf664d07dbe1", log.Requester,
+		"requester stays the opaque session subject for backward compatibility")
+	assert.Equal(t, "grant.west", log.RequesterIdentity,
+		"audit entry must surface the authoritative OIDC identity claim, not the client-supplied role session name")
+}
+
+// A non-federated STS session has no OIDC identity. ValidateJWTWithClaims merges
+// the JWT registered sub claim (the opaque session id) into RequestContext, so
+// the context carries a sub even though it is not an OIDC subject. The audit
+// entry must not surface that session id as a requester_identity — ParentUser
+// gates the resolution so only federated sessions report an identity claim.
+func TestAuditRequesterIdentityEmptyForNonFederatedSession(t *testing.T) {
+	iam := &IdentityAccessManagement{
+		iamIntegration: &MockIAMIntegration{
+			validateSessionFunc: func(ctx context.Context, token string) (*sts.SessionInfo, error) {
+				return &sts.SessionInfo{
+					AssumedRoleUser: "ClientRole/dev-session",
+					Principal:       "arn:aws:sts::000000000000:assumed-role/ClientRole/dev-session",
+					Subject:         "47ad4828c45b3f337bc3146081ba8f0f",
+					SessionName:     "dev-session",
+					Credentials: &sts.Credentials{
+						AccessKeyId:     "ASIA0189777d42cba8e2",
+						SecretAccessKey: "secret",
+					},
+					ExpiresAt: time.Now().Add(time.Hour),
+					Policies:  []string{"ClientPolicy"},
+					// Simulate ValidateJWTWithClaims merging the registered sub
+					// (the session id) into RequestContext for a session that has
+					// no OIDC identity and therefore no ParentUser.
+					RequestContext: map[string]interface{}{
+						"sub": "47ad4828c45b3f337bc3146081ba8f0f",
+					},
+				}, nil
+			},
+		},
+	}
+
+	outer := s3_constants.EnsureIdentityHolder(httptest.NewRequest(http.MethodGet, "http://s3/test/", nil))
+
+	identity, _, errCode := iam.validateSTSSessionToken(outer, "session-token", "ASIA0189777d42cba8e2")
+	require.Equal(t, s3err.ErrNone, errCode)
+
+	iam.handleAuthResult(httptest.NewRecorder(), outer, identity, s3err.ErrNone, func(http.ResponseWriter, *http.Request) {})
+
+	log := s3err.GetAccessLog(outer, http.StatusOK, s3err.ErrNone)
+	assert.Empty(t, log.RequesterIdentity, "non-federated session must not surface the session id as a requester_identity")
+}
+
+// Authentication resolves the identity before the policy verdict, so a denied
+// request still has a requester and the audit entry must name it. See issue
+// #11474.
+func TestAuditRequesterForDeniedRequest(t *testing.T) {
+	iam := &IdentityAccessManagement{}
+	require.NoError(t, iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{
+			Name:        "read_only_user",
+			Credentials: []*iam_pb.Credential{{AccessKey: "readonly_access_key", SecretKey: "readonly_secret_key"}},
+			Actions:     []string{"Read", "List"},
+		}},
+	}))
+
+	denied, err := newTestRequest(http.MethodDelete, "http://s3/bucket/obj", 0, nil)
+	require.NoError(t, err)
+	require.NoError(t, signRequestV4(denied, "readonly_access_key", "readonly_secret_key"))
+	denied = s3_constants.EnsureIdentityHolder(denied)
+
+	rec := httptest.NewRecorder()
+	iam.Auth(func(http.ResponseWriter, *http.Request) {
+		t.Error("denied request must not reach the handler")
+	}, s3_constants.ACTION_WRITE)(rec, denied)
+
+	require.Equal(t, http.StatusForbidden, rec.Code)
+	log := s3err.GetAccessLog(denied, rec.Code, s3err.ErrAccessDenied)
+	assert.Equal(t, "read_only_user", log.Requester, "denied request must still audit the requester")
+	assert.Equal(t, "arn:aws:iam::"+defaultAccountID+":user/read_only_user", log.RequesterArn)
+
+	anonymous := s3_constants.EnsureIdentityHolder(httptest.NewRequest(http.MethodDelete, "http://s3/bucket/obj", nil))
+	rec = httptest.NewRecorder()
+	iam.handleAuthResult(rec, anonymous, nil, s3err.ErrAccessDenied, func(http.ResponseWriter, *http.Request) {
+		t.Error("denied request must not reach the handler")
+	})
+	log = s3err.GetAccessLog(anonymous, rec.Code, s3err.ErrAccessDenied)
+	assert.Empty(t, log.Requester, "unauthenticated denial must not attribute a requester")
+}
+
 // A JWT-authenticated identity carries no PrincipalArn of its own — the auth
 // layer hands the principal over in a request header — so the audit entry has to
 // resolve the ARN the same way policy evaluation does.
diff --git a/weed/s3api/auth_config_default_deny_test.go b/weed/s3api/auth_config_default_deny_test.go
new file mode 100644
index 0000000000..bb1277ce08
--- /dev/null
+++ b/weed/s3api/auth_config_default_deny_test.go
@@ -0,0 +1,68 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+)
+
+// A config file the proto parser reads as empty - an unpopulated secret mount,
+// a singular "identity" - used to leave the gateway serving every anonymous
+// request, including ListBuckets and bucket creation.
+func TestConfigWithoutIdentitiesDeniesAnonymous(t *testing.T) {
+	for name, config := range map[string]string{
+		"no identities key": `{}`,
+		"empty":             `{"identities":[]}`,
+		"unrecognised key":  `{"identity":[{"name":"admin","credentials":[{"accessKey":"adminkey","secretKey":"adminsecret"}],"actions":["Admin"]}]}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			resetMemoryStore()
+			clearEnvironmentVariableCredentials(t)
+
+			path := writeTempIamConfig(t, config)
+			iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{Config: path}, nil, "memory")
+
+			assert.True(t, iam.isEnabled(), "naming a config file asks for authentication, even if it yields no identity")
+
+			handlerCalled := false
+			handler := iam.Auth(func(w http.ResponseWriter, r *http.Request) {
+				handlerCalled = true
+			}, s3_constants.ACTION_LIST)
+
+			recorder := httptest.NewRecorder()
+			handler.ServeHTTP(recorder, httptest.NewRequest(http.MethodGet, "/", nil))
+
+			assert.False(t, handlerCalled, "ListBuckets must not run for an anonymous caller")
+			assert.Equal(t, http.StatusForbidden, recorder.Code)
+		})
+	}
+}
+
+// `weed mini` and `docker run seaweedfs` name no config file and stay open.
+func TestNoConfigKeepsAnonymousAllowed(t *testing.T) {
+	resetMemoryStore()
+	clearEnvironmentVariableCredentials(t)
+
+	iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{}, nil, "memory")
+
+	assert.False(t, iam.isEnabled(), "auth must stay off when no config file and no identities are configured")
+}
+
+// AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY register an admin identity of
+// their own, which would decide isAuthEnabled before the config file does.
+func clearEnvironmentVariableCredentials(t *testing.T) {
+	t.Setenv("AWS_ACCESS_KEY_ID", "")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "")
+}
+
+// The proto parser drops what it does not recognise, so a typo has to be named
+// at startup or the resulting lockout has no visible cause.
+func TestUnknownS3ConfigKeys(t *testing.T) {
+	assert.Equal(t, []string{"identity"}, unknownS3ConfigKeys([]byte(`{"identity":[],"accounts":[]}`)))
+	assert.Empty(t, unknownS3ConfigKeys([]byte(`{"identities":[],"service_accounts":[],"serviceAccounts":[],"policies":[],"groups":[]}`)))
+	assert.Empty(t, unknownS3ConfigKeys([]byte(`{"kms":{},"sts":{},"policy":{},"providers":[],"roles":[]}`)), "sections owned by other subsystems are not typos")
+	assert.Empty(t, unknownS3ConfigKeys([]byte(`not json`)))
+}
diff --git a/weed/s3api/auth_copy_source_test.go b/weed/s3api/auth_copy_source_test.go
index 746f16009f..21415ddc9e 100644
--- a/weed/s3api/auth_copy_source_test.go
+++ b/weed/s3api/auth_copy_source_test.go
@@ -3,6 +3,7 @@ package s3api
 import (
 	"context"
 	"net/http"
+	"net/url"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -251,9 +252,10 @@ func TestAuthorizeCopySource_PresignedURLSessionTokenPreserved(t *testing.T) {
 	}
 
 	// Presigned URL: session token is in the query string, no
-	// X-Amz-Security-Token header. The destination URL also carries unrelated
-	// SigV4 query params (X-Amz-Algorithm, etc.) that must not leak into the
-	// synthetic source action resolution.
+	// X-Amz-Security-Token header. The destination URL also carries the rest of
+	// the SigV4 presign params, which ride along so auth-derived policy
+	// conditions (s3:authType) match the real request; none of them steer
+	// ResolveS3Action.
 	req, err := http.NewRequest(http.MethodPut,
 		"http://s3.local/bucket-a/dst.bin?X-Amz-Algorithm=AWS4-HMAC-SHA256"+
 			"&X-Amz-Credential=stsKey%2F20260518%2Fus-east-1%2Fs3%2Faws4_request"+
@@ -267,8 +269,12 @@ func TestAuthorizeCopySource_PresignedURLSessionTokenPreserved(t *testing.T) {
 	assert.Equal(t, s3err.ErrNone, errCode)
 	assert.Equal(t, "presigned-session-token", capturedSessionToken,
 		"session token from presigned-URL query must reach the IAM check")
-	// versionId omitted, only the token should be present in the synthetic query.
-	assert.Equal(t, "X-Amz-Security-Token=presigned-session-token", capturedRawQuery)
+	capturedQuery, err := url.ParseQuery(capturedRawQuery)
+	require.NoError(t, err)
+	assert.Equal(t, "presigned-session-token", capturedQuery.Get("X-Amz-Security-Token"))
+	assert.Equal(t, "AWS4-HMAC-SHA256", capturedQuery.Get("X-Amz-Algorithm"))
+	assert.False(t, capturedQuery.Has("versionId"))
+	assert.False(t, capturedQuery.Has("acl"))
 }
 
 // TestAuthorizeCopySource_PreservesCopySourceHeader verifies that the synthetic
diff --git a/weed/s3api/auth_credentials.go b/weed/s3api/auth_credentials.go
index 37fcc26fbe..502283a944 100644
--- a/weed/s3api/auth_credentials.go
+++ b/weed/s3api/auth_credentials.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"net/url"
 	"os"
+	"regexp"
 	"slices"
 	"strings"
 	"sync"
@@ -24,13 +25,14 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3bucket"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/protobuf/reflect/protoreflect"
 
 	// Import KMS providers to register them
 	_ "github.com/seaweedfs/seaweedfs/weed/kms/aws"
-	// _ "github.com/seaweedfs/seaweedfs/weed/kms/azure"  // TODO: Fix Azure SDK compatibility issues
 	_ "github.com/seaweedfs/seaweedfs/weed/kms/gcp"
 	_ "github.com/seaweedfs/seaweedfs/weed/kms/local"
 	_ "github.com/seaweedfs/seaweedfs/weed/kms/openbao"
@@ -58,7 +60,7 @@ type IdentityAccessManagement struct {
 	hashCounters      map[string]*int32
 	identityAnonymous *Identity
 	domain            string
-	externalHost      string // pre-computed host for S3 signature verification (from ExternalUrl)
+	externalHost      string // pre-computed host tried first during S3 signature verification (from ExternalUrl)
 	isAuthEnabled     bool
 	credentialManager *credential.CredentialManager
 	filerClient       *wdclient.FilerClient
@@ -67,6 +69,11 @@ type IdentityAccessManagement struct {
 	// IAM Integration for advanced features
 	iamIntegration IAMIntegration
 
+	// selfServiceRequiresGrant makes the self-service IAM actions (an
+	// identity's own access keys, GetUser on itself) need an iam:<Action>
+	// grant like every other IAM action. Off by default.
+	selfServiceRequiresGrant bool
+
 	// Serializes resyncs of the policy set into the advanced IAM manager so that
 	// concurrent policy updates can't apply stale views out of order. See
 	// resyncIAMManagerPolicies.
@@ -75,10 +82,19 @@ type IdentityAccessManagement struct {
 	// Bucket policy engine for evaluating bucket policies
 	policyEngine *BucketPolicyEngine
 
+	// primeBucketForIAM loads a bucket's config (and with it the advanced-IAM
+	// bucket-policy mirror backfill) before an IAM authorization that will
+	// evaluate that mirror. Set by NewS3ApiServer; nil in tests.
+	primeBucketForIAM func(bucket string)
+
 	// Cached policy engine for IAM policy fallback evaluation.
 	// Keyed by policy name, kept in sync by PutPolicy/DeletePolicy.
 	iamPolicyEngine *policy_engine.PolicyEngine
 
+	// trustedProxies is applied to every (re)built iamPolicyEngine so that
+	// aws:SourceIp resolution honors the configured allowlist across rebuilds.
+	trustedProxies *policy_engine.TrustedProxies
+
 	// background polling
 	stopChan     chan struct{}
 	shutdownOnce sync.Once
@@ -90,6 +106,12 @@ type IdentityAccessManagement struct {
 	// These identities are immutable and cannot be updated by dynamic configuration
 	staticIdentityNames map[string]bool
 
+	// fileIdentityNames tracks the identity names the current static config file
+	// declares, as opposed to staticIdentityNames, which also carries identities
+	// added outside the file (the AWS environment credentials). A reload reads the
+	// file as the full set of its own identities, so this is the set it may revoke
+	fileIdentityNames map[string]bool
+
 	// staticPolicyNames tracks policy names loaded from the static config file
 	// so full-state reconciliation does not drop them
 	staticPolicyNames map[string]bool
@@ -97,21 +119,23 @@ type IdentityAccessManagement struct {
 	// reloadCh coalesces failed-reload retries handled by reloadRetryLoop
 	reloadCh chan struct{}
 
-	// reloadMu serializes configuration loads end-to-end (store snapshot
-	// through commit) so an older snapshot cannot overwrite a newer one
+	// reloadMu serializes configuration loads and pushes end-to-end (store
+	// snapshot through commit) so an older snapshot cannot overwrite a newer
+	// one
 	reloadMu sync.Mutex
 }
 
 type Identity struct {
-	Name         string
-	Account      *Account
-	Credentials  []*Credential
-	Actions      []Action
-	PolicyNames  []string               // Attached IAM policy names
-	PrincipalArn string                 // ARN for IAM authorization (e.g., "arn:aws:iam::account-id:user/username")
-	Disabled     bool                   // User status: false = enabled (default), true = disabled
-	Claims       map[string]interface{} // JWT claims for policy substitution
-	IsStatic     bool                   // Whether identity was loaded from static config (immutable)
+	Name          string
+	Account       *Account
+	Credentials   []*Credential
+	Actions       []Action
+	PolicyNames   []string               // Attached IAM policy names
+	PrincipalArn  string                 // ARN for IAM authorization (e.g., "arn:aws:iam::account-id:user/username")
+	Disabled      bool                   // User status: false = enabled (default), true = disabled
+	Claims        map[string]interface{} // JWT claims for policy substitution
+	IsStatic      bool                   // Whether identity was loaded from static config (immutable)
+	IdentityClaim string                 // Authoritative OIDC identity claim for audit logging (preferred_username/email/sub); empty for non-federated sessions
 }
 
 // Account represents a system user, a system user can
@@ -308,7 +332,7 @@ func NewIdentityAccessManagementWithStore(option *S3ApiServerOption, filerClient
 		if err != nil {
 			glog.Fatalf("failed to parse s3.externalUrl: %v", err)
 		}
-		glog.V(0).Infof("S3 signature verification will use external host: %q (from %q)", externalHost, option.ExternalUrl)
+		glog.V(0).Infof("S3 signature verification will try external host %q (from %q) first", externalHost, option.ExternalUrl)
 	}
 
 	iam := &IdentityAccessManagement{
@@ -318,6 +342,7 @@ func NewIdentityAccessManagementWithStore(option *S3ApiServerOption, filerClient
 		hashCounters: make(map[string]*int32),
 		filerClient:  filerClient,
 	}
+	iam.selfServiceRequiresGrant = option.IamSelfServiceRequiresGrant
 
 	// Always initialize credential manager with fallback to defaults
 	credentialManager, err := credential.NewCredentialManagerWithDefaults(credential.CredentialStoreTypeName(explicitStore))
@@ -394,45 +419,60 @@ func NewIdentityAccessManagementWithStore(option *S3ApiServerOption, filerClient
 	// For "weed mini" without any S3 config, default to allowing all access (isAuthEnabled = false)
 	// If any credentials are configured (via file, filer, or env vars), enable authentication
 	iam.m.Lock()
-	iam.isAuthEnabled = len(iam.identities) > 0
+	identityCount := len(iam.identities)
+	// Pointing the gateway at a config file is the operator asking for
+	// authentication. A file that yields no identity - an empty secret mount, a
+	// key the proto parser does not recognise - must deny everyone rather than serve
+	// the cluster to anonymous callers.
+	iam.isAuthEnabled = identityCount > 0 || startConfigFile != ""
 	iam.m.Unlock()
-	if iam.isAuthEnabled {
-		hasAnyIdentity.Store(true)
-	}
 
-	if iam.isAuthEnabled {
-		// Credentials were configured - enable authentication
-		glog.V(1).Infof("S3 authentication enabled (%d identities configured)", len(iam.identities))
-	} else {
-		// No credentials configured
-		if startConfigFile != "" {
-			// Config file was specified but contained no identities - this is unusual, log a warning
-			glog.Warningf("S3 config file %s specified but no identities loaded - authentication disabled", startConfigFile)
-		} else {
-			// No config file and no identities - this is the normal allow-all case
-			glog.V(1).Infof("S3 authentication disabled - no credentials configured (allowing all access)")
-		}
+	switch {
+	case identityCount > 0:
+		hasAnyIdentity.Store(true)
+		glog.V(1).Infof("S3 authentication enabled (%d identities configured)", identityCount)
+	case startConfigFile != "":
+		glog.Warningf("S3 config file %s loaded no identities - every request is denied until one is configured", startConfigFile)
+	default:
+		// No config file and no identities - this is the normal allow-all case
+		glog.V(1).Infof("S3 authentication disabled - no credentials configured (allowing all access)")
 	}
 
 	return iam
 }
 
-// markStaticIdentities marks the identities declared in a static config file
+// markStaticIdentities records the identities declared by a static config file
 // (-config, or -iam.config when it carries inline identities) as immutable, so
-// dynamic filer reloads can't overwrite them. It is additive and scoped to the
-// file's identities: a reload protects newly added ones without un-protecting
-// the existing set or freezing dynamic filer-managed identities. useStaticConfig
-// stays gated on whether any static identity exists, so an advanced-IAM file
-// with no inline identities (OIDC/STS only) keeps the dynamic store live.
+// dynamic filer reloads can't overwrite them, and remembers which names that file
+// itself declares: a reload reads the file as the full set of its own identities,
+// so one that has left the file is dropped by MergeS3ApiConfiguration together
+// with its access keys, and its name stops being static. Names that did not come
+// from the file (the AWS environment credentials) stay static, because the file
+// cannot revoke what it never declared. useStaticConfig stays gated on whether
+// any static identity exists, so an advanced-IAM file with no inline identities
+// (OIDC/STS only) keeps the dynamic store live.
 func (iam *IdentityAccessManagement) markStaticIdentities(config *iam_pb.S3ApiConfiguration) {
+	fileNames := make(map[string]bool, len(config.Identities))
+	for _, ident := range config.Identities {
+		fileNames[ident.Name] = true
+	}
+
 	iam.m.Lock()
 	defer iam.m.Unlock()
-	if iam.staticIdentityNames == nil {
-		iam.staticIdentityNames = make(map[string]bool)
+	// staticIdentityNames is the union of the file's own names and the ones added
+	// outside it, which no reload of the file may un-protect.
+	staticNames := make(map[string]bool, len(fileNames)+len(iam.staticIdentityNames))
+	for name := range fileNames {
+		staticNames[name] = true
 	}
-	for _, ident := range config.Identities {
-		iam.staticIdentityNames[ident.Name] = true
+	for name := range iam.staticIdentityNames {
+		if !iam.fileIdentityNames[name] {
+			staticNames[name] = true
+		}
 	}
+	iam.fileIdentityNames = fileNames
+	iam.staticIdentityNames = staticNames
+
 	if iam.staticPolicyNames == nil {
 		iam.staticPolicyNames = make(map[string]bool)
 	}
@@ -449,10 +489,11 @@ func (iam *IdentityAccessManagement) markStaticIdentities(config *iam_pb.S3ApiCo
 
 var iamReloadRetryInterval = 5 * time.Second
 
-// scheduleReload queues a full configuration reload that retries until it
-// succeeds. Signals coalesce, and the reload is state-based, so it is safe to
-// call for every failed event.
-func (iam *IdentityAccessManagement) scheduleReload() {
+// scheduleReload queues a coalesced full configuration reload that retries
+// until it succeeds. Safe to call for every IAM config change event: bursts
+// collapse into a single reload via the buffered reloadCh.
+func (iam *IdentityAccessManagement) scheduleReload(reason string) {
+	glog.V(1).Infof("IAM change detected in %s, scheduling reload", reason)
 	select {
 	case iam.reloadCh <- struct{}{}:
 	default:
@@ -623,6 +664,10 @@ func (iam *IdentityAccessManagement) loadS3ApiConfigurationFromFile(fileName str
 		return fmt.Errorf("fail to read %s : %v", fileName, readErr)
 	}
 
+	if unknown := unknownS3ConfigKeys(content); len(unknown) > 0 {
+		glog.Warningf("S3 config %s: ignoring unknown top-level keys %v", fileName, unknown)
+	}
+
 	// Initialize KMS if configuration contains KMS settings
 	if err := iam.initializeKMSFromConfig(content); err != nil {
 		glog.Warningf("KMS initialization failed: %v", err)
@@ -644,6 +689,31 @@ func (iam *IdentityAccessManagement) loadS3ApiConfigurationFromFile(fileName str
 	return nil
 }
 
+// nonIdentityS3ConfigKeys are the top-level sections of a config file that
+// belong to another subsystem rather than to S3ApiConfiguration: the KMS block,
+// and the advanced IAM blocks of a -s3.iam.config file.
+var nonIdentityS3ConfigKeys = []string{"kms", "sts", "policy", "providers", "roles"}
+
+// unknownS3ConfigKeys returns the top-level keys the proto parser discards. A
+// singular "identity" otherwise loads as an empty config, which denies every
+// request with nothing pointing at the mistake.
+func unknownS3ConfigKeys(content []byte) []string {
+	var root map[string]json.RawMessage
+	if err := json.Unmarshal(content, &root); err != nil {
+		return nil
+	}
+	fields := (&iam_pb.S3ApiConfiguration{}).ProtoReflect().Descriptor().Fields()
+	var unknown []string
+	for key := range root {
+		if slices.Contains(nonIdentityS3ConfigKeys, key) || fields.ByName(protoreflect.Name(key)) != nil || fields.ByJSONName(key) != nil {
+			continue
+		}
+		unknown = append(unknown, key)
+	}
+	slices.Sort(unknown)
+	return unknown
+}
+
 func (iam *IdentityAccessManagement) LoadS3ApiConfigurationFromBytes(content []byte) error {
 	_, err := iam.loadS3ApiConfigurationFromBytes(content, false)
 	return err
@@ -661,6 +731,10 @@ func (iam *IdentityAccessManagement) loadS3ApiConfigurationFromBytes(content []b
 		s3ApiConfiguration.Groups = nil
 	}
 
+	if fromStaticFile {
+		expandCredentialEnvRefs(s3ApiConfiguration)
+	}
+
 	if err := filer.CheckDuplicateAccessKey(s3ApiConfiguration); err != nil {
 		return nil, err
 	}
@@ -671,6 +745,56 @@ func (iam *IdentityAccessManagement) loadS3ApiConfigurationFromBytes(content []b
 	return s3ApiConfiguration, nil
 }
 
+var credentialEnvRef = regexp.MustCompile(`\$\{([A-Za-z_][A-Za-z0-9_]*)\}`)
+
+// expandCredentialEnvRefs resolves ${VAR} references in the keys of a static
+// config file, so a deployment can keep the keys in its own secret store and
+// hand them to the process as environment variables. A credential still holding
+// an unresolved reference is dropped instead of becoming a literal key.
+//
+// A variable that is set but empty counts as unresolved: a secret store handing
+// over a blank value must not leave an access key signed by an empty secret.
+func expandCredentialEnvRefs(config *iam_pb.S3ApiConfiguration) {
+	for _, ident := range config.Identities {
+		kept := ident.Credentials[:0]
+		for _, cred := range ident.Credentials {
+			accessKey, accessResolved := expandEnvRefs(cred.AccessKey)
+			secretKey, secretResolved := expandEnvRefs(cred.SecretKey)
+			if !accessResolved || !secretResolved {
+				glog.Warningf("identity %s: dropping credential %s, it references an unset environment variable", ident.Name, cred.AccessKey)
+				continue
+			}
+			cred.AccessKey, cred.SecretKey = accessKey, secretKey
+			kept = append(kept, cred)
+		}
+		ident.Credentials = kept
+	}
+}
+
+// expandEnvRefs reports false when any reference is malformed or names a
+// variable that is unset or empty, leaving the reference in place for the
+// caller to reject.
+func expandEnvRefs(value string) (string, bool) {
+	if !strings.Contains(value, "${") {
+		return value, true
+	}
+	// Every ${ has to open a well-formed reference. A typo like ${MY-VAR} matches
+	// nothing, so it would otherwise survive substitution as a literal key.
+	if strings.Count(value, "${") != len(credentialEnvRef.FindAllString(value, -1)) {
+		return value, false
+	}
+	resolved := true
+	expanded := credentialEnvRef.ReplaceAllStringFunc(value, func(ref string) string {
+		env, found := os.LookupEnv(ref[2 : len(ref)-1])
+		if !found || env == "" {
+			resolved = false
+			return ref
+		}
+		return env
+	})
+	return expanded, resolved
+}
+
 func (iam *IdentityAccessManagement) loadS3ApiConfiguration(config *iam_pb.S3ApiConfiguration) error {
 	return iam.loadS3ApiConfigurationWithSource(config, false)
 }
@@ -683,7 +807,10 @@ func (iam *IdentityAccessManagement) loadS3ApiConfigurationWithSource(config *ia
 	hasStaticConfig := iam.useStaticConfig && len(iam.staticIdentityNames) > 0
 	iam.m.RUnlock()
 
-	if hasStaticConfig {
+	// A static config file always merges. It is authoritative for the identities it
+	// declares and never for the dynamic store, so a file that no longer declares
+	// any identity must not fall back to replacing that store on the next reload.
+	if hasStaticConfig || fromStaticFile {
 		// Merge mode: a dynamic load is the full store state, so it also reconciles deletions
 		return iam.MergeS3ApiConfiguration(config, fromStaticFile, !fromStaticFile)
 	}
@@ -889,7 +1016,9 @@ func (iam *IdentityAccessManagement) ReplaceS3ApiConfiguration(config *iam_pb.S3
 }
 
 // MergeS3ApiConfiguration adds/updates dynamic identities while preserving static
-// ones. A config-file reload (fromStaticFile) may also overwrite its static identities.
+// ones. A config-file reload (fromStaticFile) may also overwrite its static
+// identities, and is authoritative for the ones that file declares: an identity
+// it no longer lists is dropped here, with its access keys.
 // isFullState marks config as the complete store snapshot, so dynamic identities
 // absent from it are removed; partial merges (a single pushed identity) pass false.
 func (iam *IdentityAccessManagement) MergeS3ApiConfiguration(config *iam_pb.S3ApiConfiguration, fromStaticFile bool, isFullState bool) error {
@@ -906,10 +1035,6 @@ func (iam *IdentityAccessManagement) MergeS3ApiConfiguration(config *iam_pb.S3Ap
 	for k, v := range iam.nameToIdentity {
 		nameToIdentity[k] = v
 	}
-	policies := make(map[string]*iam_pb.Policy)
-	for k, v := range iam.policies {
-		policies[k] = v
-	}
 	accounts := make(map[string]*Account)
 	for k, v := range iam.accounts {
 		accounts[k] = v
@@ -922,6 +1047,10 @@ func (iam *IdentityAccessManagement) MergeS3ApiConfiguration(config *iam_pb.S3Ap
 	for k, v := range iam.staticIdentityNames {
 		staticNames[k] = v
 	}
+	fileNames := make(map[string]bool)
+	for k, v := range iam.fileIdentityNames {
+		fileNames[k] = v
+	}
 	staticPolicies := make(map[string]bool)
 	for k, v := range iam.staticPolicyNames {
 		staticPolicies[k] = v
@@ -1030,15 +1159,28 @@ func (iam *IdentityAccessManagement) MergeS3ApiConfiguration(config *iam_pb.S3Ap
 		nameToIdentity[t.Name] = t
 	}
 
-	// full snapshot: drop dynamic identities the store no longer has
-	if isFullState {
+	// Reconcile against the loaded state. A store snapshot owns the dynamic
+	// identities it no longer has; a static config file owns the identities that
+	// file declares, so one that has left the file is removed here with its access
+	// keys - otherwise a key revoked by editing the file keeps authenticating
+	// until the process restarts.
+	if isFullState || fromStaticFile {
 		present := make(map[string]bool, len(config.Identities))
 		for _, ident := range config.Identities {
 			present[ident.Name] = true
 		}
 		kept := identities[:0]
 		for _, existing := range identities {
-			if staticNames[existing.Name] || present[existing.Name] {
+			var drop bool
+			if fromStaticFile {
+				// Only the identities the file declared before are its to revoke:
+				// the AWS environment credentials and the dynamic filer-managed
+				// identities are left alone.
+				drop = fileNames[existing.Name] && !present[existing.Name]
+			} else {
+				drop = !staticNames[existing.Name] && !present[existing.Name]
+			}
+			if !drop {
 				kept = append(kept, existing)
 				continue
 			}
@@ -1108,22 +1250,6 @@ func (iam *IdentityAccessManagement) MergeS3ApiConfiguration(config *iam_pb.S3Ap
 		glog.V(3).Infof("Loaded service account %s for dynamic parent %s (expiration: %d)", sa.Id, sa.ParentUser, sa.Expiration)
 	}
 
-	for _, policy := range config.Policies {
-		policies[policy.Name] = policy
-	}
-	// full snapshot: drop dynamic policies the store no longer has
-	if isFullState {
-		presentPolicies := make(map[string]bool, len(config.Policies))
-		for _, policy := range config.Policies {
-			presentPolicies[policy.Name] = true
-		}
-		for name := range policies {
-			if !staticPolicies[name] && !presentPolicies[name] {
-				delete(policies, name)
-			}
-		}
-	}
-
 	iam.m.Lock()
 	// atomically switch
 	iam.identities = identities
@@ -1132,7 +1258,28 @@ func (iam *IdentityAccessManagement) MergeS3ApiConfiguration(config *iam_pb.S3Ap
 	iam.emailAccount = emailAccount
 	iam.nameToIdentity = nameToIdentity
 	iam.accessKeyIdent = accessKeyIdent
-	iam.policies = policies
+
+	// Apply policy changes to the live map rather than swapping in a snapshot
+	// taken before this merge prepared: a policy committed in the meantime (a
+	// pushed inline document or a PutPolicy update) must not be discarded.
+	if iam.policies == nil {
+		iam.policies = make(map[string]*iam_pb.Policy)
+	}
+	for _, policy := range config.Policies {
+		iam.policies[policy.Name] = policy
+	}
+	// full snapshot: drop dynamic policies the store no longer has
+	if isFullState {
+		presentPolicies := make(map[string]bool, len(config.Policies))
+		for _, policy := range config.Policies {
+			presentPolicies[policy.Name] = true
+		}
+		for name := range iam.policies {
+			if !staticPolicies[name] && !presentPolicies[name] {
+				delete(iam.policies, name)
+			}
+		}
+	}
 
 	// Groups: a full snapshot is authoritative even when empty (last group
 	// deleted); partial updates pass nil Groups and preserve existing state.
@@ -1228,15 +1375,58 @@ func (iam *IdentityAccessManagement) UpsertIdentity(ident *iam_pb.Identity) erro
 		return fmt.Errorf("upsert identity failed: empty identity name")
 	}
 	glog.V(1).Infof("IAM: upsert identity %s", ident.Name)
-	return iam.MergeS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+	// Serialize the store reads below with the merge that publishes them:
+	// reloadMu already gives full reloads the same snapshot-through-commit
+	// ordering, so a document read here cannot overwrite a newer copy that a
+	// concurrent push or reload committed in the meantime.
+	iam.reloadMu.Lock()
+	defer iam.reloadMu.Unlock()
+	config := &iam_pb.S3ApiConfiguration{
 		Identities: []*iam_pb.Identity{ident},
-	}, false, false)
+	}
+	// The wire proto lacks runtime inline policy names; merging it raw would
+	// drop them until the next reload and authorize by flattened Actions.
+	// Reattach the names and their documents, scoped to this identity: a name
+	// without its document would deny requests the policy allows until the
+	// next reload.
+	if iam.credentialManager != nil {
+		if store, ok := iam.credentialManager.GetStore().(credential.InlinePolicyStore); ok {
+			policyNames, err := store.ListUserInlinePolicies(context.Background(), ident.Name)
+			if err != nil {
+				return err
+			}
+			for _, policyName := range policyNames {
+				runtimeName := inlinePolicyRuntimeName(ident.Name, policyName)
+				ident.PolicyNames = appendUniquePolicyName(ident.PolicyNames, runtimeName)
+				doc, err := store.GetUserInlinePolicy(context.Background(), ident.Name, policyName)
+				if err != nil {
+					return err
+				}
+				if doc == nil {
+					continue
+				}
+				content, err := json.Marshal(doc)
+				if err != nil {
+					return fmt.Errorf("failed to marshal inline policy %q for user %q: %w", policyName, ident.Name, err)
+				}
+				config.Policies = append(config.Policies, &iam_pb.Policy{Name: runtimeName, Content: string(content)})
+			}
+		}
+	}
+	if err := iam.MergeS3ApiConfiguration(config, false, false); err != nil {
+		return err
+	}
+	if len(config.Policies) > 0 {
+		iam.resyncIAMManagerPolicies()
+	}
+	return nil
 }
 
 // isEnabled reports whether S3 auth should be enforced for this server.
 //
 // Driven solely by isAuthEnabled, which is set when:
 //   - any locally managed identities/credentials are loaded (file/filer/env), or
+//   - the operator names a config file, whether or not it yields an identity, or
 //   - the operator passes -s3.iam.config, which triggers EnableAuthEnforcement
 //     at startup time even before any identities sync in.
 //
@@ -1462,14 +1652,42 @@ func (iam *IdentityAccessManagement) GetAccountIdByEmail(email string) string {
 	return ""
 }
 
+// isConfiguredAccountID reports whether id names a configured local identity
+// or account — the reserved accounts included — i.e. an owner string that was
+// never an OIDC subject.
+func (iam *IdentityAccessManagement) isConfiguredAccountID(id string) bool {
+	if id == "" || id == s3_constants.AccountAdminId || id == s3_constants.AccountAnonymousId {
+		return true
+	}
+	iam.m.RLock()
+	defer iam.m.RUnlock()
+	if _, ok := iam.nameToIdentity[id]; ok {
+		return true
+	}
+	if _, ok := iam.accounts[id]; ok {
+		return true
+	}
+	for _, identity := range iam.identities {
+		if identity.Account != nil && identity.Account.Id == id {
+			return true
+		}
+	}
+	return false
+}
+
 func (iam *IdentityAccessManagement) Auth(f http.HandlerFunc, action Action) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		scrubInternalHeaders(r)
 		if !iam.isEnabled() {
 			f(w, r)
 			return
 		}
 
-		identity, errCode := iam.authRequest(r, action)
+		// authRequestWithAuthType keeps the resolved identity when authN
+		// succeeds but authZ denies, so the denied request still audits its
+		// requester; a failed authN resolves no identity at all.
+		identity, errCode, _ := iam.authRequestWithAuthType(r, action)
+		errCode = refineDenialForBucketName(r, identity, errCode)
 		if errCode != s3err.ErrNone {
 			glog.V(3).Infof("auth error: %v", errCode)
 		}
@@ -1486,6 +1704,7 @@ func (iam *IdentityAccessManagement) Auth(f http.HandlerFunc, action Action) htt
 // signature verification, which is mandatory for all PostPolicy uploads.
 func (iam *IdentityAccessManagement) AuthPostPolicy(f http.HandlerFunc, action Action) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		scrubInternalHeaders(r)
 		if !iam.isEnabled() {
 			f(w, r)
 			return
@@ -1508,6 +1727,7 @@ func (iam *IdentityAccessManagement) AuthPostPolicy(f http.HandlerFunc, action A
 			}
 		}
 
+		errCode = refineDenialForBucketName(r, identity, errCode)
 		if errCode != s3err.ErrNone {
 			glog.V(3).Infof("auth error: %v", errCode)
 		}
@@ -1516,10 +1736,44 @@ func (iam *IdentityAccessManagement) AuthPostPolicy(f http.HandlerFunc, action A
 	}
 }
 
+// refineDenialForBucketName answers 400 InvalidBucketName, as AWS S3 does,
+// when an authenticated caller is denied on a bucket whose name breaks the S3
+// naming rules. The rules are public and the answer depends on the name alone,
+// so it tells the caller nothing about which buckets exist. Authentication
+// failures (no identity resolved) and every other answer are left unchanged.
+func refineDenialForBucketName(r *http.Request, identity *Identity, errCode s3err.ErrorCode) s3err.ErrorCode {
+	if errCode != s3err.ErrAccessDenied || identity == nil {
+		return errCode
+	}
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	if bucket == "" {
+		return errCode
+	}
+	if !isASCIIBucketName(bucket) || s3bucket.VerifyS3BucketName(bucket) != nil {
+		return s3err.ErrInvalidBucketName
+	}
+	return errCode
+}
+
+// isASCIIBucketName reports whether name uses only the characters S3 allows
+// in a bucket name. VerifyS3BucketName checks with unicode.IsLower and
+// unicode.IsNumber, which also accept letters such as 'ü' and digits such as
+// '²' that S3 refuses.
+func isASCIIBucketName(name string) bool {
+	for i := 0; i < len(name); i++ {
+		c := name[i]
+		if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '.' || c == '-') {
+			return false
+		}
+	}
+	return true
+}
+
 // recordIdentityInContext stores the authenticated identity, its name and its
 // principal ARN in the request context. An STS session's name is only an opaque
-// subject, so the ARN is what carries the assumed role and session name to the
-// audit log. A JWT-authenticated identity carries no PrincipalArn of its own,
+// session subject, so the ARN is what carries the assumed role and session name
+// to the audit log, and the identity claim carries the authoritative OIDC
+// identity. A JWT-authenticated identity carries no PrincipalArn of its own,
 // hence the resolution through buildPrincipalARN.
 func recordIdentityInContext(r *http.Request, identity *Identity) context.Context {
 	if identity == nil {
@@ -1527,17 +1781,19 @@ func recordIdentityInContext(r *http.Request, identity *Identity) context.Contex
 	}
 	ctx := s3_constants.SetIdentityNameInContext(r.Context(), identity.Name)
 	ctx = s3_constants.SetPrincipalArnInContext(ctx, buildPrincipalARN(identity, r))
+	ctx = s3_constants.SetIdentityClaimInContext(ctx, identity.IdentityClaim)
 	// Also store the full identity object for handlers that need it (e.g., ListBuckets)
 	// This is especially important for JWT users whose identity is not in the identities list
 	return s3_constants.SetIdentityInContext(ctx, identity)
 }
 
 func (iam *IdentityAccessManagement) handleAuthResult(w http.ResponseWriter, r *http.Request, identity *Identity, errCode s3err.ErrorCode, f http.HandlerFunc) {
+	// Store the authenticated identity in request context (secure, cannot be spoofed)
+	// even on the deny path so audit records for rejected requests keep requester attribution
+	if identity != nil && identity.Name != "" {
+		r = r.WithContext(recordIdentityInContext(r, identity))
+	}
 	if errCode == s3err.ErrNone {
-		// Store the authenticated identity in request context (secure, cannot be spoofed)
-		if identity != nil && identity.Name != "" {
-			r = r.WithContext(recordIdentityInContext(r, identity))
-		}
 		f(w, r)
 		return
 	}
@@ -1568,19 +1824,35 @@ func (iam *IdentityAccessManagement) AuthenticateRequest(r *http.Request) (*Iden
 	return ident, err
 }
 
+// scrubInternalHeaders drops internal headers only the server may set, so
+// client-supplied values cannot spoof identity claims or reach the handlers'
+// internal consumers (putToFiler persists the object-lock and version-id ones
+// into authoritative metadata; the SSE ones carry key material between handler
+// stages of a request). The server sets them itself after this point.
+func scrubInternalHeaders(r *http.Request) {
+	r.Header.Del(s3_constants.SeaweedFSPrincipalHeader)
+	r.Header.Del(s3_constants.SeaweedFSSessionTokenHeader)
+	r.Header.Del(s3_constants.ExtObjectLockModeKey)
+	r.Header.Del(s3_constants.ExtRetentionUntilDateKey)
+	r.Header.Del(s3_constants.ExtLegalHoldKey)
+	r.Header.Del(s3_constants.ExtVersionIdKey)
+	r.Header.Del(s3_constants.SeaweedFSSSEKMSBaseIVHeader)
+	r.Header.Del(s3_constants.SeaweedFSSSES3BaseIVHeader)
+	r.Header.Del(s3_constants.SeaweedFSSSES3KeyDataHeader)
+}
+
 func (iam *IdentityAccessManagement) authenticateRequestInternal(r *http.Request) (*Identity, s3err.ErrorCode, authType) {
 	var identity *Identity
 	var s3Err s3err.ErrorCode
 	var found bool
 	var amzAuthType string
 
-	// SECURITY: Prevent clients from spoofing internal IAM headers.
-	// These headers are only set by the server after successful JWT authentication
-	// and are trusted by downstream authorization (including S3Tables IAM checks
-	// reached via AuthSignatureOnly). Clearing them here — the shared entry point
-	// for every auth path — prevents privilege escalation via header injection.
-	r.Header.Del(s3_constants.SeaweedFSPrincipalHeader)
-	r.Header.Del(s3_constants.SeaweedFSSessionTokenHeader)
+	// Clearing them here — the shared entry point for every auth path —
+	// prevents privilege escalation via header injection, including through
+	// the S3Tables checks reached via AuthSignatureOnly.
+	scrubInternalHeaders(r)
+	// Deferred so signature verification can still read a client-signed value.
+	defer r.Header.Del(s3_constants.AmzAccountId)
 
 	reqAuthType := getRequestAuthType(r)
 
@@ -1649,6 +1921,44 @@ func (iam *IdentityAccessManagement) authenticateRequestInternal(r *http.Request
 	return identity, s3Err, reqAuthType
 }
 
+// isBucketListingRequest reports whether the request lists bucket contents:
+// the ACTION_LIST routes, and ListMultipartUploads (GET ?uploads), which the
+// router registers under ACTION_READ without an object-path constraint.
+// GET /bucket/key?uploads therefore also reaches the listing handler. Route
+// vars are used so a prefix promoted into the authorization object does not
+// hide the bucket-level shape.
+func isBucketListingRequest(r *http.Request, action Action) bool {
+	if action == s3_constants.ACTION_LIST {
+		return true
+	}
+	if r.Method != http.MethodGet || r.URL == nil || !r.URL.Query().Has("uploads") {
+		return false
+	}
+	_, object := s3_constants.GetBucketAndObject(r)
+	return object == "" || object == "/"
+}
+
+// multipartListingAction returns the scoped action for a request the router
+// sends to ListObjectPartsHandler or ListMultipartUploadsHandler, or "" for
+// any other request. It follows the route order in s3api_server.go and reads
+// the object from the route vars, so a ?prefix promoted into the
+// authorization object, or extra subresource parameters such as ?policy, do
+// not change which operation the grant has to name.
+func multipartListingAction(r *http.Request, action Action) Action {
+	if action != s3_constants.ACTION_READ || r == nil || r.Method != http.MethodGet || r.URL == nil {
+		return ""
+	}
+	query := r.URL.Query()
+	_, object := s3_constants.GetBucketAndObject(r)
+	if object != "" && object != "/" && query.Has("uploadId") {
+		return s3_constants.ACTION_LIST_PARTS
+	}
+	if query.Has("uploads") {
+		return s3_constants.ACTION_LIST_MULTIPART_UPLOADS
+	}
+	return ""
+}
+
 // authRequestWithAuthType authenticates and then authorizes a request for a given action.
 func (iam *IdentityAccessManagement) authRequestWithAuthType(r *http.Request, action Action) (*Identity, s3err.ErrorCode, authType) {
 	identity, s3Err, reqAuthType := iam.authenticateRequestInternal(r)
@@ -1657,15 +1967,22 @@ func (iam *IdentityAccessManagement) authRequestWithAuthType(r *http.Request, ac
 	}
 
 	bucket, object := s3_constants.GetBucketAndObject(r)
+	// Verify the original signature first, then evaluate policies against the
+	// effective PUT ACL, including signed query parameters hoisted by presigners.
+	originalRequest := r
+	r, s3Err = putObjectACLPolicyRequest(r, action, bucket, object)
+	if s3Err != s3err.ErrNone {
+		return identity, s3Err, reqAuthType
+	}
 	prefix := s3_constants.GetPrefix(r)
 
-	// For List operations, use prefix for permission checking if available
-	if action == s3_constants.ACTION_LIST && object == "" && prefix != "" {
-		// List operation with prefix - check permission for the prefix path
-		object = prefix
-	} else if (object == "/" || object == "") && prefix != "" {
-		// Using the aws cli with s3, and s3api, and with boto3, the object is often set to "/" or empty
-		// but the prefix is set to the actual object key for permission checking
+	// For bucket listings, use prefix for permission checking if available:
+	// the aws cli, s3api, and boto3 carry the key scope in ?prefix= rather
+	// than the URL path. Other actions must not promote it — a bucket-level
+	// request has no object, and a promoted prefix would let an object-scoped
+	// grant (e.g. Write:bucket/*) authorize bucket-subresource operations
+	// like ?versioning or ?lifecycle as if they were object writes.
+	if isBucketListingRequest(r, action) && (object == "" || object == "/") && prefix != "" {
 		object = prefix
 	}
 
@@ -1706,11 +2023,11 @@ func (iam *IdentityAccessManagement) authRequestWithAuthType(r *http.Request, ac
 			if identity != nil {
 				claims = identity.Claims
 			}
-			// List is bucket-level; the prefix promoted into object (for the
-			// legacy CanDo path) must not scope the resource ARN. Prefix is
-			// matched via the s3:prefix Condition.
+			// Bucket listings are bucket-level; the prefix promoted into
+			// object (for the legacy CanDo path) must not scope the resource
+			// ARN. Prefix is matched via the s3:prefix Condition.
 			policyObject := object
-			if action == s3_constants.ACTION_LIST {
+			if isBucketListingRequest(r, action) {
 				policyObject = ""
 			}
 			allowed, evaluated, err := iam.policyEngine.EvaluatePolicy(bucket, policyObject, string(action), principal, r, claims, nil)
@@ -1723,8 +2040,14 @@ func (iam *IdentityAccessManagement) authRequestWithAuthType(r *http.Request, ac
 			} else if evaluated {
 				// A bucket policy exists and was evaluated with a matching statement
 				if allowed {
-					// Policy explicitly allows this action - grant access immediately
-					// This bypasses IAM checks to support cross-account access and policy-only principals
+					// A resource policy may supply the Allow an identity policy omits
+					// (for cross-account access and policy-only principals), but it
+					// must not override an applicable explicit Deny from an identity,
+					// group, or session policy.
+					if iam.isActionExplicitlyDeniedByApplicablePolicies(r, identity, action, bucket, object) {
+						glog.V(3).Infof("identity policy explicitly denies %s to %s on %s/%s despite bucket policy allow", identity.Name, action, bucket, object)
+						return identity, s3err.ErrAccessDenied, reqAuthType
+					}
 					glog.V(3).Infof("Bucket policy allows %s to %s on %s/%s (bypassing IAM)", identity.Name, action, bucket, object)
 					policyAllows = true
 				} else {
@@ -1746,7 +2069,7 @@ func (iam *IdentityAccessManagement) authRequestWithAuthType(r *http.Request, ac
 		}
 	}
 
-	r.Header.Set(s3_constants.AmzAccountId, identity.Account.Id)
+	originalRequest.Header.Set(s3_constants.AmzAccountId, identity.Account.Id)
 
 	return identity, s3err.ErrNone, reqAuthType
 
@@ -2324,11 +2647,12 @@ func (iam *IdentityAccessManagement) authenticateJWTWithIAM(r *http.Request) (*I
 
 	// Convert IAMIdentity to existing Identity structure
 	identity := &Identity{
-		Name:        iamIdentity.Name,
-		Account:     iamIdentity.Account,
-		Actions:     []Action{}, // Empty - authorization handled by policy engine
-		PolicyNames: iamIdentity.PolicyNames,
-		Claims:      iamIdentity.Claims,
+		Name:          iamIdentity.Name,
+		Account:       iamIdentity.Account,
+		Actions:       []Action{}, // Empty - authorization handled by policy engine
+		PolicyNames:   iamIdentity.PolicyNames,
+		Claims:        iamIdentity.Claims,
+		IdentityClaim: iamIdentity.IdentityClaim,
 	}
 
 	// Store session info in request headers for later authorization
@@ -2362,12 +2686,22 @@ func determineIAMAuthPath(sessionToken, principal, principalArn string) iamAuthP
 	return iamAuthPathNone
 }
 
-// evaluateIAMPolicies evaluates attached IAM policies for a user identity.
-// Returns true if any matching statement explicitly allows the action.
-// Uses the cached iamPolicyEngine to avoid re-parsing policy JSON on every request.
-func (iam *IdentityAccessManagement) evaluateIAMPolicies(r *http.Request, identity *Identity, action Action, bucket, object string) bool {
+// attachedIAMPolicyResult is the tri-state outcome of evaluating an identity's
+// attached IAM policies: explicit Allow, explicit Deny, or no match.
+type attachedIAMPolicyResult int
+
+const (
+	attachedIAMPolicyNoMatch attachedIAMPolicyResult = iota
+	attachedIAMPolicyAllow
+	attachedIAMPolicyDeny
+)
+
+// evaluateAttachedIAMPolicies evaluates the identity's own and group attached
+// IAM policies and reports whether they explicitly allow, deny, or do not
+// match the action.
+func (iam *IdentityAccessManagement) evaluateAttachedIAMPolicies(r *http.Request, identity *Identity, action Action, bucket, object string) attachedIAMPolicyResult {
 	if identity == nil {
-		return false
+		return attachedIAMPolicyNoMatch
 	}
 
 	iam.m.RLock()
@@ -2389,25 +2723,26 @@ func (iam *IdentityAccessManagement) evaluateIAMPolicies(r *http.Request, identi
 
 	// Collect all policy names: user policies + group policies
 	if len(identity.PolicyNames) == 0 && len(groupPolicies) == 0 {
-		return false
+		return attachedIAMPolicyNoMatch
 	}
 
 	if engine == nil {
-		return false
+		return attachedIAMPolicyNoMatch
 	}
 
-	// List is bucket-level; the prefix promoted into object (for the legacy
-	// CanDo path) must not scope the resource ARN or the resolved action
-	// (e.g. ListBucketVersions on ?versions). Prefix is matched via s3:prefix.
+	// Bucket listings are bucket-level; the prefix promoted into object (for
+	// the legacy CanDo path) must not scope the resource ARN or the resolved
+	// action (e.g. ListBucketVersions on ?versions). Prefix is matched via
+	// s3:prefix.
 	resourceObject := object
-	if action == s3_constants.ACTION_LIST {
+	if isBucketListingRequest(r, action) {
 		resourceObject = ""
 	}
 	resource := buildResourceARN(bucket, resourceObject)
 	principal := buildPrincipalARN(identity, r)
 	s3Action := ResolveS3Action(r, string(action), bucket, resourceObject)
 	explicitAllow := false
-	conditions := policy_engine.ExtractConditionValuesFromRequest(r)
+	conditions := engine.ExtractConditionValuesFromRequest(r)
 	for k, v := range policy_engine.ExtractPrincipalVariables(principal) {
 		conditions[k] = v
 	}
@@ -2419,12 +2754,13 @@ func (iam *IdentityAccessManagement) evaluateIAMPolicies(r *http.Request, identi
 		Conditions: conditions,
 		Claims:     identity.Claims,
 	}
+	evalArgs.OriginalGrantConditions = policy_engine.OriginalGrantConditionsFromRequest(r)
 
 	// Evaluate user's own policies
 	for _, policyName := range identity.PolicyNames {
 		result := engine.EvaluatePolicy(policyName, evalArgs)
 		if result == policy_engine.PolicyResultDeny {
-			return false
+			return attachedIAMPolicyDeny
 		}
 		if result == policy_engine.PolicyResultAllow {
 			explicitAllow = true
@@ -2436,7 +2772,7 @@ func (iam *IdentityAccessManagement) evaluateIAMPolicies(r *http.Request, identi
 		for _, policyName := range policyNames {
 			result := engine.EvaluatePolicy(policyName, evalArgs)
 			if result == policy_engine.PolicyResultDeny {
-				return false
+				return attachedIAMPolicyDeny
 			}
 			if result == policy_engine.PolicyResultAllow {
 				explicitAllow = true
@@ -2444,7 +2780,16 @@ func (iam *IdentityAccessManagement) evaluateIAMPolicies(r *http.Request, identi
 		}
 	}
 
-	return explicitAllow
+	if explicitAllow {
+		return attachedIAMPolicyAllow
+	}
+	return attachedIAMPolicyNoMatch
+}
+
+// evaluateIAMPolicies is a bool projection of evaluateAttachedIAMPolicies for
+// callers that only need the allow outcome.
+func (iam *IdentityAccessManagement) evaluateIAMPolicies(r *http.Request, identity *Identity, action Action, bucket, object string) bool {
+	return iam.evaluateAttachedIAMPolicies(r, identity, action, bucket, object) == attachedIAMPolicyAllow
 }
 
 // isActionExplicitlyDeniedByIAM reports whether the identity's attached IAM
@@ -2474,13 +2819,7 @@ func (iam *IdentityAccessManagement) isActionExplicitlyDeniedByIAM(r *http.Reque
 
 	// A chained caller authenticates with an STS session token whose inline
 	// session policy can also carry an explicit deny.
-	sessionToken := r.Header.Get(s3_constants.SeaweedFSSessionTokenHeader)
-	if sessionToken == "" {
-		sessionToken = r.Header.Get("X-Amz-Security-Token")
-		if sessionToken == "" {
-			sessionToken = r.URL.Query().Get("X-Amz-Security-Token")
-		}
-	}
+	sessionToken := extractSessionToken(r)
 
 	if len(policyNames) == 0 && sessionToken == "" {
 		return false
@@ -2490,7 +2829,11 @@ func (iam *IdentityAccessManagement) isActionExplicitlyDeniedByIAM(r *http.Reque
 	if manager == nil {
 		return false
 	}
-	denied, err := manager.IsPrincipalActionExplicitlyDenied(r.Context(), principal, action, resource, policyNames, sessionToken, extractRequestContext(r))
+	var requestContext map[string]interface{}
+	if s3iam, ok := iam.iamIntegration.(*S3IAMIntegration); ok {
+		requestContext = s3iam.extractRequestContext(r)
+	}
+	denied, err := manager.IsPrincipalActionExplicitlyDenied(r.Context(), principal, action, resource, policyNames, sessionToken, requestContext)
 	if err != nil {
 		glog.Warningf("AssumeRole explicit-deny check failed for %s, denying: %v", identity.Name, err)
 		return true
@@ -2498,6 +2841,24 @@ func (iam *IdentityAccessManagement) isActionExplicitlyDeniedByIAM(r *http.Reque
 	return denied
 }
 
+// isActionExplicitlyDeniedByApplicablePolicies reports whether any applicable
+// identity-side policy (attached IAM policies, enabled-group policies, or the
+// IAM-integration session policy) explicitly denies the action. A bucket
+// policy may supply the Allow an identity policy omits, but it must not
+// override a matching explicit Deny. A nil identity has no identity-side
+// policy plane, so the bucket policy remains authoritative for public access.
+func (iam *IdentityAccessManagement) isActionExplicitlyDeniedByApplicablePolicies(r *http.Request, identity *Identity, action Action, bucket, object string) bool {
+	if identity == nil {
+		return false
+	}
+	if iam.evaluateAttachedIAMPolicies(r, identity, action, bucket, object) == attachedIAMPolicyDeny {
+		return true
+	}
+	s3Action, resourceArn := resolveS3AuthTarget(action, bucket, object, r)
+	principal := buildPrincipalARN(identity, r)
+	return iam.isActionExplicitlyDeniedByIAM(r, identity, principal, s3Action, resourceArn)
+}
+
 // authorizationRoute is the mechanism that decides a request/identity pair's
 // permissions: the IAM integration, locally attached IAM policies, the
 // identity's legacy Actions, or nothing at all.
@@ -2526,12 +2887,26 @@ func (iam *IdentityAccessManagement) attachedPolicyNames(identity *Identity) []s
 	return names
 }
 
+// extractSessionToken returns the request's session token, whichever transport
+// carried it: the internal header set after JWT authentication, the
+// X-Amz-Security-Token header, or the presigned-URL query parameter.
+func extractSessionToken(r *http.Request) string {
+	if s3_constants.IsSessionTokenIgnored(r.Context()) {
+		return ""
+	}
+	if token := r.Header.Get(s3_constants.SeaweedFSSessionTokenHeader); token != "" {
+		return token
+	}
+	if token := r.Header.Get("X-Amz-Security-Token"); token != "" {
+		return token
+	}
+	return r.URL.Query().Get("X-Amz-Security-Token")
+}
+
 // hasSessionToken reports whether the request carries an STS session token,
 // whose session policies are known only to the IAM integration.
 func hasSessionToken(r *http.Request) bool {
-	return r.Header.Get(s3_constants.SeaweedFSSessionTokenHeader) != "" ||
-		r.Header.Get("X-Amz-Security-Token") != "" ||
-		r.URL.Query().Get("X-Amz-Security-Token") != ""
+	return extractSessionToken(r) != ""
 }
 
 // authorizationRoute picks the mechanism, so every caller routes identically.
@@ -2581,13 +2956,28 @@ func (iam *IdentityAccessManagement) VerifyActionPermission(r *http.Request, ide
 		// field is a lossy projection that cannot represent deny statements,
 		// conditions, or fine-grained action differences such as PutObject vs
 		// DeleteObject.
-		if iam.evaluateIAMPolicies(r, identity, action, bucket, object) {
+		switch iam.evaluateAttachedIAMPolicies(r, identity, action, bucket, object) {
+		case attachedIAMPolicyAllow:
 			return s3err.ErrNone
+		case attachedIAMPolicyDeny:
+			return s3err.ErrAccessDenied
+		default:
+			// No matching statement: a native bare Admin grant survives
+			// attaching a policy (issue #11226). Scoped actions are not
+			// consulted because inline policies flatten lossily into Actions.
+			if identity.isAdmin() {
+				return s3err.ErrNone
+			}
+			return s3err.ErrAccessDenied
 		}
-		return s3err.ErrAccessDenied
 	case authorizeViaLegacyActions:
 		if !identity.CanDo(action, bucket, object) {
-			return s3err.ErrAccessDenied
+			// The multipart listing routes are gated on ACTION_READ, but a
+			// grant may name the listing operation itself.
+			listing := multipartListingAction(r, action)
+			if listing == "" || !identity.CanDo(listing, bucket, object) {
+				return s3err.ErrAccessDenied
+			}
 		}
 		return s3err.ErrNone
 	default:
@@ -2668,96 +3058,31 @@ func (iam *IdentityAccessManagement) bucketsNamedByAttachedPolicies(r *http.Requ
 	return true, granted
 }
 
-// AuthorizeCopySource verifies the caller is allowed to read the CopyObject /
-// UploadPartCopy source. The Auth middleware only checks the destination
-// (s3:PutObject) because routing keys on the request URL; without this call,
-// an STS session token scoped to a prefix could copy from any other prefix in
-// the same bucket.
-//
-// The source path is checked against both bucket policy and IAM/identity
-// permissions, mirroring the normal request-routed flow but with a synthetic
-// GetObject request so action resolution and ARN building target the source.
-// Returns s3err.ErrNone when allowed or when auth is disabled.
-func (iam *IdentityAccessManagement) AuthorizeCopySource(r *http.Request, identity *Identity, srcBucket, srcObject, srcVersionId string) s3err.ErrorCode {
-	if !iam.isEnabled() {
-		return s3err.ErrNone
-	}
-	if srcBucket == "" {
-		return s3err.ErrNone
-	}
-	if identity == nil {
-		return s3err.ErrAccessDenied
-	}
-	if identity.isAdmin() {
-		return s3err.ErrNone
-	}
-
-	srcReq := r.Clone(r.Context())
-	srcURL := &url.URL{
-		Scheme: r.URL.Scheme,
-		Host:   r.URL.Host,
-		Path:   "/" + srcBucket + "/" + srcObject,
-	}
-	// Build the synthetic source query from scratch so leftover params like
-	// uploadId/partNumber on UploadPartCopy do not steer ResolveS3Action away
-	// from s3:GetObject. The session token must still flow through for
-	// presigned URLs that carry STS credentials in the query string.
-	srcQuery := make(url.Values)
-	if token := r.URL.Query().Get("X-Amz-Security-Token"); token != "" {
-		srcQuery.Set("X-Amz-Security-Token", token)
-	}
-	if srcVersionId != "" {
-		srcQuery.Set("versionId", srcVersionId)
-	}
-	if len(srcQuery) > 0 {
-		srcURL.RawQuery = srcQuery.Encode()
-	}
-	srcReq.URL = srcURL
-	srcReq.Method = http.MethodGet
-	srcReq.RequestURI = ""
-	srcReq.Body = nil
-	srcReq.GetBody = nil
-	srcReq.ContentLength = 0
-
-	action := s3_constants.ACTION_READ
-
-	if iam.policyEngine != nil {
-		principal := buildPrincipalARN(identity, srcReq)
-		allowed, evaluated, err := iam.policyEngine.EvaluatePolicy(srcBucket, srcObject, action, principal, srcReq, identity.Claims, nil)
-		if err != nil {
-			glog.Errorf("CopyObject source policy evaluation failed for %s/%s: %v - denying", srcBucket, srcObject, err)
-			return s3err.ErrAccessDenied
-		}
-		if evaluated {
-			if allowed {
-				return s3err.ErrNone
-			}
-			return s3err.ErrAccessDenied
-		}
-	}
-
-	return iam.VerifyActionPermission(srcReq, identity, Action(action), srcBucket, srcObject)
+// authorizeObjectKeyAction authorizes action on bucket/objectKey for an
+// already-authenticated identity, for a key the request URL does not name: a
+// copy/rename source, a DeleteObjects body key, or a POST Object form key. It
+// evaluates the bucket policy (an explicit Deny wins) and then IAM/identity
+// against a synthetic <method> /<bucket>/<objectKey> request, so ResolveS3Action
+// and buildResourceARN target the object rather than whatever the real URL and
+// its query describe. versionId, when set, and the STS session token ride along
+// for policy conditions. Returns ErrNone when auth is disabled (checked by the
+// callers) or the identity is an admin.
+// authQueryParams are the query keys carrying a request's authentication
+// material (SigV2 and SigV4 presign parameters). None steer ResolveS3Action,
+// so they can ride along on a synthesized request.
+var authQueryParams = []string{
+	"AWSAccessKeyId", "Signature", "Expires",
+	"X-Amz-Algorithm", "X-Amz-Credential", "X-Amz-Date", "X-Amz-Expires",
+	"X-Amz-Signature", "X-Amz-SignedHeaders", "X-Amz-Security-Token",
 }
 
-// AuthorizeObjectDelete authorizes removing one key the request URL does not
-// name: a key from a DeleteObjects body, or the source of a RenameObject. It is
-// checked against a synthetic DELETE /<bucket>/<key> so that ResolveS3Action and
-// buildResourceARN target the object. Mirrors AuthorizeCopySource.
-func (iam *IdentityAccessManagement) AuthorizeObjectDelete(r *http.Request, identity *Identity, bucket, objectKey, versionId string) s3err.ErrorCode {
-	if !iam.isEnabled() {
-		return s3err.ErrNone
-	}
-	if bucket == "" || objectKey == "" {
-		return s3err.ErrNone
-	}
-	if identity == nil {
-		return s3err.ErrAccessDenied
-	}
-	if identity.isAdmin() {
-		return s3err.ErrNone
-	}
-
-	// Shallow copy: authorization only reads headers, and this runs once per key.
+// objectKeyPolicyRequest synthesizes a <method> /<bucket>/<objectKey> request
+// for policy evaluation against a key the real URL does not name. The query is
+// built from scratch so a param on the real request (delete, uploadId,
+// partNumber, ...) cannot steer ResolveS3Action off the intended action; the
+// versionId and the auth-material params ride along so auth-derived policy
+// conditions (s3:authType) evaluate as they did on the real request.
+func objectKeyPolicyRequest(r *http.Request, method, bucket, objectKey, versionId string) *http.Request {
 	keyReq := new(http.Request)
 	*keyReq = *r
 	keyURL := &url.URL{
@@ -2765,67 +3090,129 @@ func (iam *IdentityAccessManagement) AuthorizeObjectDelete(r *http.Request, iden
 		Host:   r.URL.Host,
 		Path:   "/" + bucket + "/" + objectKey,
 	}
-	// Build the query from scratch so the envelope's "delete" param can't steer
-	// ResolveS3Action; keep the STS token and per-key versionId for policy eval.
 	keyQuery := make(url.Values)
 	if versionId != "" {
 		keyQuery.Set("versionId", versionId)
 	}
-	if strings.Contains(r.URL.RawQuery, "X-Amz-Security-Token") {
-		if token := r.URL.Query().Get("X-Amz-Security-Token"); token != "" {
-			keyQuery.Set("X-Amz-Security-Token", token)
+	for _, key := range authQueryParams {
+		if vals, ok := r.URL.Query()[key]; ok {
+			keyQuery[key] = vals
 		}
 	}
 	if len(keyQuery) > 0 {
 		keyURL.RawQuery = keyQuery.Encode()
 	}
 	keyReq.URL = keyURL
-	keyReq.Method = http.MethodDelete
+	keyReq.Method = method
 	keyReq.RequestURI = ""
 	keyReq.Body = nil
 	keyReq.GetBody = nil
 	keyReq.ContentLength = 0
+	return keyReq
+}
 
-	action := s3_constants.ACTION_WRITE
+func (iam *IdentityAccessManagement) authorizeObjectKeyAction(r *http.Request, identity *Identity, method string, action Action, bucket, objectKey, versionId string) s3err.ErrorCode {
+	if identity == nil {
+		return s3err.ErrAccessDenied
+	}
+	if identity.isAdmin() {
+		return s3err.ErrNone
+	}
+
+	keyReq := objectKeyPolicyRequest(r, method, bucket, objectKey, versionId)
 
 	if iam.policyEngine != nil {
 		principal := buildPrincipalARN(identity, keyReq)
-		allowed, evaluated, err := iam.policyEngine.EvaluatePolicy(bucket, objectKey, action, principal, keyReq, identity.Claims, nil)
+		allowed, evaluated, err := iam.policyEngine.EvaluatePolicy(bucket, objectKey, string(action), principal, keyReq, identity.Claims, nil)
 		if err != nil {
-			glog.Errorf("DeleteObjects key policy evaluation failed for %s/%s: %v - denying", bucket, objectKey, err)
+			glog.Errorf("policy evaluation failed for %s %s/%s: %v - denying", action, bucket, objectKey, err)
 			return s3err.ErrAccessDenied
 		}
 		if evaluated {
 			if allowed {
+				if iam.isActionExplicitlyDeniedByApplicablePolicies(keyReq, identity, action, bucket, objectKey) {
+					return s3err.ErrAccessDenied
+				}
 				return s3err.ErrNone
 			}
 			return s3err.ErrAccessDenied
 		}
 	}
 
-	return iam.VerifyActionPermission(keyReq, identity, Action(action), bucket, objectKey)
+	return iam.VerifyActionPermission(keyReq, identity, action, bucket, objectKey)
+}
+
+// AuthorizeCopySource verifies the caller is allowed to read the CopyObject /
+// UploadPartCopy source. The Auth middleware only checks the destination
+// (s3:PutObject) because routing keys on the request URL; without this call,
+// an STS session token scoped to a prefix could copy from any other prefix in
+// the same bucket. Returns s3err.ErrNone when allowed or when auth is disabled.
+func (iam *IdentityAccessManagement) AuthorizeCopySource(r *http.Request, identity *Identity, srcBucket, srcObject, srcVersionId string) s3err.ErrorCode {
+	if !iam.isEnabled() {
+		return s3err.ErrNone
+	}
+	if srcBucket == "" {
+		return s3err.ErrNone
+	}
+	return iam.authorizeObjectKeyAction(r, identity, http.MethodGet, s3_constants.ACTION_READ, srcBucket, srcObject, srcVersionId)
+}
+
+// AuthorizeObjectDelete authorizes removing one key the request URL does not
+// name: a key from a DeleteObjects body, or the source of a RenameObject.
+func (iam *IdentityAccessManagement) AuthorizeObjectDelete(r *http.Request, identity *Identity, bucket, objectKey, versionId string) s3err.ErrorCode {
+	if !iam.isEnabled() {
+		return s3err.ErrNone
+	}
+	if bucket == "" || objectKey == "" {
+		return s3err.ErrNone
+	}
+	return iam.authorizeObjectKeyAction(r, identity, http.MethodDelete, s3_constants.ACTION_WRITE, bucket, objectKey, versionId)
+}
+
+// AuthorizeObjectWrite authorizes writing one key the request URL does not name:
+// a POST Object (presigned-POST / HTML-form) upload carries its key in the
+// multipart form, so the Auth middleware only checked the coarse bucket-level
+// Write action. This runs the same per-object authorization the PUT path applies.
+func (iam *IdentityAccessManagement) AuthorizeObjectWrite(r *http.Request, identity *Identity, bucket, objectKey string) s3err.ErrorCode {
+	if !iam.isEnabled() {
+		return s3err.ErrNone
+	}
+	if bucket == "" || objectKey == "" {
+		return s3err.ErrNone
+	}
+	return iam.authorizeObjectKeyAction(r, identity, http.MethodPut, s3_constants.ACTION_WRITE, bucket, objectKey, "")
+}
+
+// AuthorizeObjectAclWrite authorizes setting an ACL on one key the request URL
+// does not name: a POST Object upload promotes its acl form field and any
+// x-amz-grant-* fields onto the upload's ACL headers, which the PUT path only
+// applies after an s3:PutObjectAcl grant.
+func (iam *IdentityAccessManagement) AuthorizeObjectAclWrite(r *http.Request, identity *Identity, bucket, objectKey string) s3err.ErrorCode {
+	if !iam.isEnabled() {
+		return s3err.ErrNone
+	}
+	if bucket == "" || objectKey == "" {
+		return s3err.ErrNone
+	}
+	return iam.authorizeObjectKeyAction(r, identity, http.MethodPut, s3_constants.ACTION_WRITE_ACP, bucket, objectKey, "")
 }
 
 // authorizeWithIAM authorizes requests using the IAM integration policy engine
 func (iam *IdentityAccessManagement) authorizeWithIAM(r *http.Request, identity *Identity, action Action, bucket string, object string) s3err.ErrorCode {
 	ctx := r.Context()
 
-	// Get session info from request headers
-	// First check for JWT-based authentication headers (SeaweedFSSessionTokenHeader)
-	sessionToken := r.Header.Get(s3_constants.SeaweedFSSessionTokenHeader)
-	principal := r.Header.Get(s3_constants.SeaweedFSPrincipalHeader)
-
-	// Fallback to AWS Signature V4 STS token if JWT token not present
-	// This handles the case where STS AssumeRoleWithWebIdentity generates temporary credentials
-	// that include an X-Amz-Security-Token header (in addition to the access key and secret)
-	if sessionToken == "" {
-		sessionToken = r.Header.Get("X-Amz-Security-Token")
-		if sessionToken == "" {
-			// Also check query parameters for presigned URLs with STS tokens
-			sessionToken = r.URL.Query().Get("X-Amz-Security-Token")
-		}
+	// The evaluation below consults the bucket-policy:<bucket> mirror, so the
+	// bucket's lazy load (which backfills that mirror) must happen first -
+	// nothing earlier on a denied request's path would ever trigger it.
+	if iam.primeBucketForIAM != nil && bucket != "" {
+		iam.primeBucketForIAM(bucket)
 	}
 
+	// JWT authentication records its token in SeaweedFSSessionTokenHeader;
+	// SigV4 requests carry it as X-Amz-Security-Token.
+	sessionToken := extractSessionToken(r)
+	principal := r.Header.Get(s3_constants.SeaweedFSPrincipalHeader)
+
 	policyNames := iam.attachedPolicyNames(identity)
 
 	iamIdentity := &IAMIdentity{
@@ -2835,6 +3222,19 @@ func (iam *IdentityAccessManagement) authorizeWithIAM(r *http.Request, identity
 		Claims:      identity.Claims, // Copy claims for policy variable substitution
 	}
 
+	// A native bare Admin grant survives attaching a policy (issue #11226);
+	// an explicit Deny in an attached policy still wins. This runs before the
+	// auth-path switch so an Admin identity without a session principal or
+	// PrincipalArn is still authorized through its native grant.
+	if identity.isAdmin() {
+		s3Action, resourceArn := resolveS3AuthTarget(action, bucket, object, r)
+		principal := buildPrincipalARN(identity, r)
+		if !iam.isActionExplicitlyDeniedByIAM(r, identity, principal, s3Action, resourceArn) {
+			return s3err.ErrNone
+		}
+		return s3err.ErrAccessDenied
+	}
+
 	// Determine authorization path and configure identity
 	authPath := determineIAMAuthPath(sessionToken, principal, identity.PrincipalArn)
 	switch authPath {
@@ -2862,6 +3262,19 @@ func (iam *IdentityAccessManagement) authorizeWithIAM(r *http.Request, identity
 	return iam.iamIntegration.AuthorizeAction(ctx, iamIdentity, action, bucket, object, r)
 }
 
+// resolveS3AuthTarget mirrors the action and resource resolution that
+// AuthorizeAction applies, so the native-permission floor's explicit-deny
+// check evaluates the same action and resource ARN as the policy engine.
+func resolveS3AuthTarget(action Action, bucket, object string, r *http.Request) (s3Action, resourceArn string) {
+	resourceObjectKey := object
+	if isBucketListingRequest(r, action) {
+		resourceObjectKey = ""
+	}
+	resourceArn = buildS3ResourceArn(bucket, resourceObjectKey)
+	s3Action = ResolveS3Action(r, string(action), bucket, resourceObjectKey)
+	return
+}
+
 // PutPolicy adds or updates a policy
 func (iam *IdentityAccessManagement) PutPolicy(name string, content string) error {
 	iam.m.Lock()
@@ -2926,8 +3339,42 @@ func (iam *IdentityAccessManagement) PutGroup(group *iam_pb.Group) error {
 	}
 	glog.V(1).Infof("IAM: put group %s", group.Name)
 
+	// Serialize the store reads below with their installation under iam.m:
+	// the same reloadMu ordering that identity pushes and full reloads use,
+	// so a document read here cannot overwrite a newer committed copy.
+	iam.reloadMu.Lock()
+	defer iam.reloadMu.Unlock()
+
+	// As for identity pushes, the wire proto lacks the group's runtime
+	// inline policy names; reattach them with their documents, scoped to
+	// this group.
+	var inlinePolicies []*iam_pb.Policy
+	if iam.credentialManager != nil {
+		if store, ok := iam.credentialManager.GetStore().(credential.GroupInlinePolicyStore); ok {
+			policyNames, err := store.ListGroupInlinePolicies(context.Background(), group.Name)
+			if err != nil {
+				return err
+			}
+			for _, policyName := range policyNames {
+				runtimeName := inlineGroupPolicyRuntimeName(group.Name, policyName)
+				group.PolicyNames = appendUniquePolicyName(group.PolicyNames, runtimeName)
+				doc, err := store.GetGroupInlinePolicy(context.Background(), group.Name, policyName)
+				if err != nil {
+					return err
+				}
+				if doc == nil {
+					continue
+				}
+				content, err := json.Marshal(doc)
+				if err != nil {
+					return fmt.Errorf("failed to marshal inline policy %q for group %q: %w", policyName, group.Name, err)
+				}
+				inlinePolicies = append(inlinePolicies, &iam_pb.Policy{Name: runtimeName, Content: string(content)})
+			}
+		}
+	}
+
 	iam.m.Lock()
-	defer iam.m.Unlock()
 
 	// Remove old reverse index entries for this group
 	if old, ok := iam.groups[group.Name]; ok && !old.Disabled {
@@ -2945,6 +3392,20 @@ func (iam *IdentityAccessManagement) PutGroup(group *iam_pb.Group) error {
 		}
 	}
 
+	if len(inlinePolicies) > 0 {
+		if iam.policies == nil {
+			iam.policies = make(map[string]*iam_pb.Policy)
+		}
+		for _, policy := range inlinePolicies {
+			iam.policies[policy.Name] = policy
+		}
+		iam.rebuildIAMPolicyEngineLocked()
+	}
+	iam.m.Unlock()
+
+	if len(inlinePolicies) > 0 {
+		iam.resyncIAMManagerPolicies()
+	}
 	return nil
 }
 
@@ -2982,9 +3443,22 @@ func (iam *IdentityAccessManagement) removeUserGroupLocked(username, groupName s
 func (iam *IdentityAccessManagement) ensureIAMPolicyEngine() {
 	if iam.iamPolicyEngine == nil {
 		iam.iamPolicyEngine = policy_engine.NewPolicyEngine()
+		iam.iamPolicyEngine.SetTrustedProxies(iam.trustedProxies)
 	}
 }
 
+// SetTrustedProxies configures the allowlist used by the IAM policy engine
+// when resolving aws:SourceIp from forwarded headers, and applies it to the
+// current cached engine if one exists.
+func (iam *IdentityAccessManagement) SetTrustedProxies(tp *policy_engine.TrustedProxies) {
+	iam.m.Lock()
+	iam.trustedProxies = tp
+	if iam.iamPolicyEngine != nil {
+		iam.iamPolicyEngine.SetTrustedProxies(tp)
+	}
+	iam.m.Unlock()
+}
+
 // rebuildIAMPolicyEngineLocked rebuilds the entire IAM policy engine cache
 // from the current policies map. Must be called with iam.m held.
 func (iam *IdentityAccessManagement) rebuildIAMPolicyEngineLocked() {
@@ -2993,6 +3467,7 @@ func (iam *IdentityAccessManagement) rebuildIAMPolicyEngineLocked() {
 		return
 	}
 	engine := policy_engine.NewPolicyEngine()
+	engine.SetTrustedProxies(iam.trustedProxies)
 	for name, p := range iam.policies {
 		if err := engine.SetBucketPolicy(name, p.Content); err != nil {
 			glog.Warningf("IAM policy cache rebuild: skipping invalid policy %q: %v", name, err)
diff --git a/weed/s3api/auth_credentials_native_floor_test.go b/weed/s3api/auth_credentials_native_floor_test.go
new file mode 100644
index 0000000000..e5a392b0b7
--- /dev/null
+++ b/weed/s3api/auth_credentials_native_floor_test.go
@@ -0,0 +1,177 @@
+package s3api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newNativeFloorTestIAM(t *testing.T) (*IdentityAccessManagement, *Identity) {
+	t.Helper()
+	mgr := newTestIAMManager(t)
+	iam := &IdentityAccessManagement{}
+	iam.SetIAMIntegration(NewS3IAMIntegration(mgr, ""))
+
+	doc, _ := json.Marshal(map[string]interface{}{
+		"Version": "2012-10-17",
+		"Statement": []map[string]interface{}{
+			{"Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "*"},
+		},
+	})
+	require.NoError(t, iam.PutPolicy("ListBucketsOnly", string(doc)))
+
+	identity := &Identity{
+		Name:         "admin",
+		Account:      &Account{DisplayName: "admin", Id: "admin"},
+		Actions:      []Action{s3_constants.ACTION_ADMIN},
+		PolicyNames:  []string{"ListBucketsOnly"},
+		PrincipalArn: "arn:aws:iam::111122223333:user/admin",
+	}
+	return iam, identity
+}
+
+func putObjectRequest() *http.Request {
+	return httptest.NewRequest(http.MethodPut, "/mybucket/file.txt", nil)
+}
+
+// TestNativeAdminSurvivesAttachedPolicy reproduces issue #11226: attaching an
+// IAM policy to a user with native Admin must not override the native grant.
+// The effective permissions are the union of native permissions and attached
+// policy grants, so a Write the attached policy never mentions still succeeds.
+func TestNativeAdminSurvivesAttachedPolicy(t *testing.T) {
+	iam, identity := newNativeFloorTestIAM(t)
+
+	errCode := iam.VerifyActionPermission(putObjectRequest(), identity,
+		s3_constants.ACTION_WRITE, "mybucket", "file.txt")
+	assert.Equal(t, s3err.ErrNone, errCode,
+		"native Admin must remain effective after attaching a policy")
+}
+
+// TestNativeAdminSurvivesDeletedPolicy reproduces the second half of #11226:
+// deleting the attached policy without detaching it first must not leave the
+// user locked out of their native permissions.
+func TestNativeAdminSurvivesDeletedPolicy(t *testing.T) {
+	iam, identity := newNativeFloorTestIAM(t)
+
+	require.NoError(t, iam.DeletePolicy("ListBucketsOnly"))
+
+	errCode := iam.VerifyActionPermission(putObjectRequest(), identity,
+		s3_constants.ACTION_WRITE, "mybucket", "file.txt")
+	assert.Equal(t, s3err.ErrNone, errCode,
+		"native Admin must remain effective after the attached policy is deleted")
+}
+
+// TestNativeAdminSurvivesAttachedPolicyWithoutPrincipalArn covers the IAM
+// integration path when the Admin identity has no PrincipalArn (and no session
+// token), so the auth-path switch would otherwise deny before the native floor.
+func TestNativeAdminSurvivesAttachedPolicyWithoutPrincipalArn(t *testing.T) {
+	mgr := newTestIAMManager(t)
+	iam := &IdentityAccessManagement{}
+	iam.SetIAMIntegration(NewS3IAMIntegration(mgr, ""))
+
+	doc, _ := json.Marshal(map[string]interface{}{
+		"Version": "2012-10-17",
+		"Statement": []map[string]interface{}{
+			{"Effect": "Allow", "Action": "s3:ListAllMyBuckets", "Resource": "*"},
+		},
+	})
+	require.NoError(t, iam.PutPolicy("ListBucketsOnly", string(doc)))
+
+	identity := &Identity{
+		Name:        "admin",
+		Account:     &Account{DisplayName: "admin", Id: "admin"},
+		Actions:     []Action{s3_constants.ACTION_ADMIN},
+		PolicyNames: []string{"ListBucketsOnly"},
+	}
+
+	errCode := iam.VerifyActionPermission(putObjectRequest(), identity,
+		s3_constants.ACTION_WRITE, "mybucket", "file.txt")
+	assert.Equal(t, s3err.ErrNone, errCode,
+		"native Admin must remain effective without a PrincipalArn")
+}
+
+// TestAttachedPolicyExplicitDenyOverridesNativeAdmin ensures deny-always-wins:
+// an explicit Deny in an attached policy still constrains a native admin.
+func TestAttachedPolicyExplicitDenyOverridesNativeAdmin(t *testing.T) {
+	mgr := newTestIAMManager(t)
+	iam := &IdentityAccessManagement{}
+	iam.SetIAMIntegration(NewS3IAMIntegration(mgr, ""))
+
+	doc, _ := json.Marshal(map[string]interface{}{
+		"Version": "2012-10-17",
+		"Statement": []map[string]interface{}{
+			{"Effect": "Deny", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::mybucket/*"},
+		},
+	})
+	require.NoError(t, iam.PutPolicy("DenyPutMyBucket", string(doc)))
+
+	identity := &Identity{
+		Name:         "admin",
+		Account:      &Account{DisplayName: "admin", Id: "admin"},
+		Actions:      []Action{s3_constants.ACTION_ADMIN},
+		PolicyNames:  []string{"DenyPutMyBucket"},
+		PrincipalArn: "arn:aws:iam::111122223333:user/admin",
+	}
+
+	errCode := iam.VerifyActionPermission(putObjectRequest(), identity,
+		s3_constants.ACTION_WRITE, "mybucket", "file.txt")
+	assert.Equal(t, s3err.ErrAccessDenied, errCode,
+		"explicit Deny in an attached policy must override native Admin")
+}
+
+// GET ?uploads lists multipart uploads at bucket level but routes under Read,
+// so the prefix promoted into object must not change the evaluated action or
+// resource: an explicit Deny on s3:ListBucketMultipartUploads must still
+// constrain a native admin, and an Allow on the bucket ARN must satisfy a
+// plain attached-policy identity.
+func TestMultipartListingResolvesBucketAction(t *testing.T) {
+	mgr := newTestIAMManager(t)
+	iam := &IdentityAccessManagement{}
+	iam.SetIAMIntegration(NewS3IAMIntegration(mgr, ""))
+
+	denyDoc, _ := json.Marshal(map[string]interface{}{
+		"Version": "2012-10-17",
+		"Statement": []map[string]interface{}{
+			{"Effect": "Deny", "Action": "s3:ListBucketMultipartUploads", "Resource": "arn:aws:s3:::mybucket"},
+		},
+	})
+	require.NoError(t, iam.PutPolicy("DenyUploadsListing", string(denyDoc)))
+	allowDoc, _ := json.Marshal(map[string]interface{}{
+		"Version": "2012-10-17",
+		"Statement": []map[string]interface{}{
+			{"Effect": "Allow", "Action": "s3:ListBucketMultipartUploads", "Resource": "arn:aws:s3:::mybucket"},
+		},
+	})
+	require.NoError(t, iam.PutPolicy("AllowUploadsListing", string(allowDoc)))
+
+	uploadsReq := func() *http.Request {
+		return httptest.NewRequest(http.MethodGet, "/mybucket?uploads&prefix=x/", nil)
+	}
+	admin := &Identity{
+		Name:         "admin",
+		Account:      &Account{DisplayName: "admin", Id: "admin"},
+		Actions:      []Action{s3_constants.ACTION_ADMIN},
+		PolicyNames:  []string{"DenyUploadsListing"},
+		PrincipalArn: "arn:aws:iam::111122223333:user/admin",
+	}
+	reader := &Identity{
+		Name:         "reader",
+		Account:      &Account{DisplayName: "reader", Id: "reader"},
+		PolicyNames:  []string{"AllowUploadsListing"},
+		PrincipalArn: "arn:aws:iam::111122223333:user/reader",
+	}
+
+	// object carries the promoted prefix, matching authRequestWithAuthType
+	assert.Equal(t, s3err.ErrAccessDenied,
+		iam.VerifyActionPermission(uploadsReq(), admin, s3_constants.ACTION_READ, "mybucket", "x/"),
+		"explicit Deny on the uploads listing must override native Admin")
+	assert.Equal(t, s3err.ErrNone,
+		iam.VerifyActionPermission(uploadsReq(), reader, s3_constants.ACTION_READ, "mybucket", "x/"),
+		"s3:ListBucketMultipartUploads on the bucket must allow the uploads listing")
+}
diff --git a/weed/s3api/auth_credentials_static_config_test.go b/weed/s3api/auth_credentials_static_config_test.go
index 70c791a808..9c12436f58 100644
--- a/weed/s3api/auth_credentials_static_config_test.go
+++ b/weed/s3api/auth_credentials_static_config_test.go
@@ -38,9 +38,7 @@ func TestIamConfigWithoutIdentitiesIsNotStatic(t *testing.T) {
 	if err := s3a.onIamConfigChange(filer.IamConfigDirectory+"/identities", nil, &filer_pb.Entry{Name: "alice.json"}); err != nil {
 		t.Fatalf("onIamConfigChange returned error: %v", err)
 	}
-	if !hasIdentity(s3a.iam, "alice") {
-		t.Fatalf("expected alice to load after filer change with -iam.config-only setup")
-	}
+	waitForIdentity(t, s3a.iam, "alice")
 }
 
 // A -config identity file protects its identities but must not block live
@@ -70,9 +68,7 @@ func TestConfigWithIdentitiesStillLiveReloadsDynamic(t *testing.T) {
 	if err := s3a.onIamConfigChange(filer.IamConfigDirectory+"/identities", nil, &filer_pb.Entry{Name: "alice.json"}); err != nil {
 		t.Fatalf("onIamConfigChange returned error: %v", err)
 	}
-	if !hasIdentity(s3a.iam, "alice") {
-		t.Fatalf("expected alice to live-reload despite the static identity file")
-	}
+	waitForIdentity(t, s3a.iam, "alice")
 	if !hasIdentity(s3a.iam, "static-admin") {
 		t.Fatalf("static-admin must survive the dynamic reload")
 	}
@@ -84,9 +80,7 @@ func TestConfigWithIdentitiesStillLiveReloadsDynamic(t *testing.T) {
 	if err := s3a.onIamConfigChange(filer.IamConfigDirectory+"/identities", &filer_pb.Entry{Name: "alice.json"}, nil); err != nil {
 		t.Fatalf("onIamConfigChange returned error: %v", err)
 	}
-	if hasIdentity(s3a.iam, "alice") {
-		t.Fatalf("expected alice to be removed after deletion on the filer")
-	}
+	waitForIdentityGone(t, s3a.iam, "alice")
 	if !hasIdentity(s3a.iam, "static-admin") {
 		t.Fatalf("static-admin must survive the deletion reload")
 	}
@@ -285,7 +279,8 @@ func (f *flakyStore) LoadConfiguration(ctx context.Context) (*iam_pb.S3ApiConfig
 	return f.CredentialStore.LoadConfiguration(ctx)
 }
 
-// A failed event-driven reload must keep retrying until the store recovers.
+// A failed reload queued from an IAM config change must keep retrying until
+// the store recovers.
 func TestFailedReloadRetriesUntilSuccess(t *testing.T) {
 	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
 
@@ -293,26 +288,17 @@ func TestFailedReloadRetriesUntilSuccess(t *testing.T) {
 	iamReloadRetryInterval = 10 * time.Millisecond
 	t.Cleanup(func() { iamReloadRetryInterval = prev })
 
-	s3a.iam.reloadCh = make(chan struct{}, 1)
-	go s3a.iam.reloadRetryLoop()
-	t.Cleanup(s3a.iam.Shutdown)
-
 	if err := s3a.iam.credentialManager.CreateUser(context.Background(), &iam_pb.Identity{Name: "alice"}); err != nil {
 		t.Fatalf("failed to create alice: %v", err)
 	}
 	s3a.iam.credentialManager.Store = &flakyStore{CredentialStore: s3a.iam.credentialManager.Store, failures: 2}
 
-	// the event-driven reload fails and hands off to the retry loop
-	if err := s3a.onIamConfigChange(filer.IamConfigDirectory+"/identities", nil, &filer_pb.Entry{Name: "alice.json"}); err == nil {
-		t.Fatalf("expected the event-driven reload to fail")
-	}
-	deadline := time.Now().Add(5 * time.Second)
-	for !hasIdentity(s3a.iam, "alice") {
-		if time.Now().After(deadline) {
-			t.Fatalf("expected alice to load once the store recovered")
-		}
-		time.Sleep(10 * time.Millisecond)
+	// onIamConfigChange only queues a coalesced reload; the retry loop does the
+	// work and retries through the transient store failures.
+	if err := s3a.onIamConfigChange(filer.IamConfigDirectory+"/identities", nil, &filer_pb.Entry{Name: "alice.json"}); err != nil {
+		t.Fatalf("onIamConfigChange returned error: %v", err)
 	}
+	waitForIdentity(t, s3a.iam, "alice")
 }
 
 func hasPolicy(iam *IdentityAccessManagement, name string) bool {
@@ -343,3 +329,259 @@ func writeTempIamConfig(t *testing.T, content string) string {
 	}
 	return path
 }
+
+// A static config file may hold ${VAR} in place of a key, so a deployment can
+// keep the keys in its own secret store and pass them in as environment
+// variables rather than baking them into the file.
+func TestStaticConfigExpandsEnvCredentialRefs(t *testing.T) {
+	t.Setenv("SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID", "AKIAFROMENV")
+	t.Setenv("SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY", "secretfromenv")
+
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	path := writeTempIamConfig(t, `{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"${SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID}","secretKey":"${SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY}"}],"actions":["Admin"]}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(path); err != nil {
+		t.Fatalf("failed to load identity config: %v", err)
+	}
+
+	_, cred, found := s3a.iam.lookupByAccessKey("AKIAFROMENV")
+	if !found {
+		t.Fatalf("expected the access key from the environment to be loaded")
+	}
+	if cred.SecretKey != "secretfromenv" {
+		t.Fatalf("expected the secret key from the environment, got %q", cred.SecretKey)
+	}
+	if _, _, found := s3a.iam.lookupByAccessKey("${SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID}"); found {
+		t.Fatalf("the unexpanded reference must not remain usable as an access key")
+	}
+}
+
+// An unset variable must not leave the reference behind as a literal key.
+func TestStaticConfigDropsUnresolvedEnvCredentialRefs(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	path := writeTempIamConfig(t, `{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"${SEAWEEDFS_S3_MISSING_ACCESS_KEY_ID}","secretKey":"${SEAWEEDFS_S3_MISSING_SECRET_ACCESS_KEY}"}],"actions":["Admin"]}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(path); err != nil {
+		t.Fatalf("failed to load identity config: %v", err)
+	}
+
+	if _, _, found := s3a.iam.lookupByAccessKey("${SEAWEEDFS_S3_MISSING_ACCESS_KEY_ID}"); found {
+		t.Fatalf("a credential referencing an unset variable must be dropped")
+	}
+	if !hasIdentity(s3a.iam, "anvAdmin") {
+		t.Fatalf("expected the identity itself to still load")
+	}
+}
+
+// Keys that merely contain a dollar sign are literal, and identities coming
+// from the filer are never expanded.
+func TestEnvCredentialRefsOnlyApplyToStaticConfig(t *testing.T) {
+	t.Setenv("SEAWEEDFS_S3_DYNAMIC_SECRET_ACCESS_KEY", "secretfromenv")
+
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	if err := s3a.iam.LoadS3ApiConfigurationFromBytes([]byte(`{"identities":[{"name":"dynamic","credentials":[{"accessKey":"AKIALITERAL","secretKey":"${SEAWEEDFS_S3_DYNAMIC_SECRET_ACCESS_KEY}"}],"actions":["Admin"]}]}`)); err != nil {
+		t.Fatalf("failed to load dynamic config: %v", err)
+	}
+
+	_, cred, found := s3a.iam.lookupByAccessKey("AKIALITERAL")
+	if !found {
+		t.Fatalf("expected the dynamic identity to load")
+	}
+	if cred.SecretKey != "${SEAWEEDFS_S3_DYNAMIC_SECRET_ACCESS_KEY}" {
+		t.Fatalf("a dynamic identity must keep its secret key verbatim, got %q", cred.SecretKey)
+	}
+}
+
+// A key holding a dollar sign that is not a reference stays untouched.
+func TestStaticConfigKeepsLiteralDollarSigns(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	path := writeTempIamConfig(t, `{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"AKIALITERAL","secretKey":"pa$$word"}],"actions":["Admin"]}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(path); err != nil {
+		t.Fatalf("failed to load identity config: %v", err)
+	}
+
+	_, cred, found := s3a.iam.lookupByAccessKey("AKIALITERAL")
+	if !found {
+		t.Fatalf("expected the identity to load")
+	}
+	if cred.SecretKey != "pa$$word" {
+		t.Fatalf("expected the literal secret key, got %q", cred.SecretKey)
+	}
+}
+
+// A secret store handing over a blank value must not leave an access key that
+// any signature matches.
+func TestStaticConfigDropsEmptyEnvCredentialRefs(t *testing.T) {
+	t.Setenv("SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID", "AKIAFROMENV")
+	t.Setenv("SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY", "")
+
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	path := writeTempIamConfig(t, `{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"${SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID}","secretKey":"${SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY}"}],"actions":["Admin"]}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(path); err != nil {
+		t.Fatalf("failed to load identity config: %v", err)
+	}
+
+	if _, _, found := s3a.iam.lookupByAccessKey("AKIAFROMENV"); found {
+		t.Fatalf("a credential whose secret key resolves to empty must be dropped")
+	}
+}
+
+// A reference the substitution cannot match, such as a typo in the variable
+// name, must not survive as a literal key.
+func TestStaticConfigDropsMalformedEnvCredentialRefs(t *testing.T) {
+	for _, malformed := range []string{"${MY-VAR}", "${1VAR}", "${}", "${UNTERMINATED", "${A}${B"} {
+		t.Run(malformed, func(t *testing.T) {
+			t.Setenv("SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY", "secretfromenv")
+			t.Setenv("A", "a")
+
+			s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+			path := writeTempIamConfig(t, fmt.Sprintf(`{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":%q,"secretKey":"${SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY}"}],"actions":["Admin"]}]}`, malformed))
+			if err := s3a.iam.loadS3ApiConfigurationFromFile(path); err != nil {
+				t.Fatalf("failed to load identity config: %v", err)
+			}
+
+			if _, _, found := s3a.iam.lookupByAccessKey(malformed); found {
+				t.Fatalf("%s must not become a usable access key", malformed)
+			}
+		})
+	}
+}
+
+// A resolved value that happens to contain ${ is still the key the operator set.
+func TestStaticConfigKeepsBracesComingFromTheEnvironment(t *testing.T) {
+	t.Setenv("SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID", "AKIAFROMENV")
+	t.Setenv("SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY", "pa${ss}word")
+
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	path := writeTempIamConfig(t, `{"identities":[{"name":"anvAdmin","credentials":[{"accessKey":"${SEAWEEDFS_S3_ADMIN_ACCESS_KEY_ID}","secretKey":"${SEAWEEDFS_S3_ADMIN_SECRET_ACCESS_KEY}"}],"actions":["Admin"]}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(path); err != nil {
+		t.Fatalf("failed to load identity config: %v", err)
+	}
+
+	_, cred, found := s3a.iam.lookupByAccessKey("AKIAFROMENV")
+	if !found {
+		t.Fatalf("expected the identity to load")
+	}
+	if cred.SecretKey != "pa${ss}word" {
+		t.Fatalf("expected the secret key from the environment verbatim, got %q", cred.SecretKey)
+	}
+}
+
+// Editing an identity out of the static config file and reloading must revoke it:
+// the identity, its access keys and those of its service accounts stop working on
+// the running gateway, and its name stops being protected as static. What the file
+// still declares, a dynamic filer-managed identity and the AWS environment
+// identity are all untouched.
+func TestReloadStaticConfigRevokesRemovedIdentity(t *testing.T) {
+	t.Setenv("AWS_ACCESS_KEY_ID", "AKIAENV1")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "c2VjcmV0")
+
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	p1 := writeTempIamConfig(t, `{"identities":[{"name":"static-admin","credentials":[{"accessKey":"AKADMIN0","secretKey":"c2VjcmV0"}],"actions":["Admin"]},{"name":"revoked","credentials":[{"accessKey":"AKREVOKE","secretKey":"c2VjcmV0"}],"actions":["Read","List"]},{"name":"kept","credentials":[{"accessKey":"AKKEPT00","secretKey":"c2VjcmV0"}],"actions":["Read"]}],"serviceAccounts":[{"id":"sa-1","parentUser":"revoked","credential":{"accessKey":"AKSA0001","secretKey":"c2VjcmV0"}}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(p1); err != nil {
+		t.Fatalf("failed to load initial config: %v", err)
+	}
+	if _, _, found := s3a.iam.lookupByAccessKey("AKREVOKE"); !found {
+		t.Fatalf("expected the identity to authenticate before the reload")
+	}
+	if _, _, found := s3a.iam.lookupByAccessKey("AKSA0001"); !found {
+		t.Fatalf("expected the service account key to be loaded before the reload")
+	}
+
+	// A dynamic identity arrives from the filer and must survive the reload.
+	if err := s3a.iam.credentialManager.CreateUser(context.Background(), &iam_pb.Identity{Name: "dynamic", Credentials: []*iam_pb.Credential{{AccessKey: "AKDYN000", SecretKey: "c2VjcmV0"}}}); err != nil {
+		t.Fatalf("failed to create dynamic identity: %v", err)
+	}
+	if err := s3a.iam.LoadS3ApiConfigurationFromCredentialManager(); err != nil {
+		t.Fatalf("failed to load from credential manager: %v", err)
+	}
+	if _, _, found := s3a.iam.lookupByAccessKey("AKDYN000"); !found {
+		t.Fatalf("expected the dynamic identity's key to authenticate before the reload")
+	}
+
+	// Drop "revoked" and its service account from the file and reload.
+	p2 := writeTempIamConfig(t, `{"identities":[{"name":"static-admin","credentials":[{"accessKey":"AKADMIN0","secretKey":"c2VjcmV0"}],"actions":["Admin"]},{"name":"kept","credentials":[{"accessKey":"AKKEPT00","secretKey":"c2VjcmV0"}],"actions":["Read"]}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(p2); err != nil {
+		t.Fatalf("failed to reload config: %v", err)
+	}
+
+	if hasIdentity(s3a.iam, "revoked") {
+		t.Fatalf("an identity removed from the config file must be dropped by the reload")
+	}
+	for _, key := range []string{"AKREVOKE", "AKSA0001"} {
+		if _, _, found := s3a.iam.lookupByAccessKey(key); found {
+			t.Fatalf("access key %s of the removed identity must stop authenticating", key)
+		}
+	}
+	if isStaticName(s3a.iam, "revoked") {
+		t.Fatalf("a name that left the config file must stop being static")
+	}
+
+	// What the file still declares is untouched.
+	if !hasIdentity(s3a.iam, "kept") || !isStaticName(s3a.iam, "kept") {
+		t.Fatalf("identities still in the file must survive the reload")
+	}
+	if _, _, found := s3a.iam.lookupByAccessKey("AKKEPT00"); !found {
+		t.Fatalf("a kept identity's access key must keep working")
+	}
+
+	// The file cannot revoke what it never declared.
+	if !hasIdentity(s3a.iam, "dynamic") {
+		t.Fatalf("a dynamic identity must survive a static-file reload")
+	}
+	if _, _, found := s3a.iam.lookupByAccessKey("AKDYN000"); !found {
+		t.Fatalf("a dynamic identity's access key must keep working after a static-file reload")
+	}
+	if !hasIdentity(s3a.iam, "admin-AKIAENV1") {
+		t.Fatalf("the AWS environment identity must survive a static-file reload")
+	}
+	if _, _, found := s3a.iam.lookupByAccessKey("AKIAENV1"); !found {
+		t.Fatalf("the AWS environment identity's access key must keep working")
+	}
+}
+
+// A file reload always merges, so emptying the file must not flip the next reload
+// into replacing the store and dropping the filer-managed identities.
+func TestReloadStaticConfigWithoutIdentitiesKeepsDynamic(t *testing.T) {
+	// The AWS environment identity stays static across a file reload, so with credentials
+	// in the environment it would keep `hasStaticConfig` true and the regression would pass
+	// unnoticed. Clear them whatever the runner has set.
+	t.Setenv("AWS_ACCESS_KEY_ID", "")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "")
+
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{})
+
+	p1 := writeTempIamConfig(t, `{"identities":[{"name":"static-admin","credentials":[{"accessKey":"AKADMIN0","secretKey":"c2VjcmV0"}],"actions":["Admin"]}]}`)
+	if err := s3a.iam.loadS3ApiConfigurationFromFile(p1); err != nil {
+		t.Fatalf("failed to load initial config: %v", err)
+	}
+
+	if err := s3a.iam.credentialManager.CreateUser(context.Background(), &iam_pb.Identity{Name: "alice", Credentials: []*iam_pb.Credential{{AccessKey: "AKALICE0", SecretKey: "c2VjcmV0"}}}); err != nil {
+		t.Fatalf("failed to create alice: %v", err)
+	}
+	if err := s3a.iam.LoadS3ApiConfigurationFromCredentialManager(); err != nil {
+		t.Fatalf("failed to load from credential manager: %v", err)
+	}
+
+	empty := writeTempIamConfig(t, `{"identities":[]}`)
+	for i := 1; i <= 2; i++ {
+		if err := s3a.iam.loadS3ApiConfigurationFromFile(empty); err != nil {
+			t.Fatalf("reload %d failed: %v", i, err)
+		}
+		if hasIdentity(s3a.iam, "static-admin") {
+			t.Fatalf("reload %d: an identity removed from the file must stay removed", i)
+		}
+		if !hasIdentity(s3a.iam, "alice") {
+			t.Fatalf("reload %d: a filer-managed identity must survive a reload of an emptied file", i)
+		}
+		if _, _, found := s3a.iam.lookupByAccessKey("AKALICE0"); !found {
+			t.Fatalf("reload %d: the filer-managed identity's access key must keep working", i)
+		}
+	}
+}
diff --git a/weed/s3api/auth_credentials_subscribe.go b/weed/s3api/auth_credentials_subscribe.go
index 2f67148399..69334a5fa2 100644
--- a/weed/s3api/auth_credentials_subscribe.go
+++ b/weed/s3api/auth_credentials_subscribe.go
@@ -14,6 +14,9 @@ import (
 
 const oidcProvidersDir = filer.IamConfigDirectory + "/oidc-providers"
 
+// rolesDir is the filer role store's default base path (sts.DefaultRoleBasePath).
+const rolesDir = filer.IamConfigDirectory + "/roles"
+
 func (s3a *S3ApiServer) subscribeMetaEvents(clientName string, lastTsNs int64, prefix string, directoriesToWatch []string) {
 
 	processEventFn := func(resp *filer_pb.SubscribeMetadataResponse) error {
@@ -33,6 +36,7 @@ func (s3a *S3ApiServer) subscribeMetaEvents(clientName string, lastTsNs int64, p
 		_ = s3a.onBucketMetadataChange(dir, message.OldEntry, message.NewEntry)
 		_ = s3a.onIamConfigChange(dir, message.OldEntry, message.NewEntry)
 		_ = s3a.onOIDCProviderChange(dir, message.OldEntry, message.NewEntry)
+		s3a.onRoleChange(dir)
 		_ = s3a.onCircuitBreakerConfigChange(dir, message.OldEntry, message.NewEntry)
 
 		// For moves across directories, replay a delete event for the source directory
@@ -40,6 +44,7 @@ func (s3a *S3ApiServer) subscribeMetaEvents(clientName string, lastTsNs int64, p
 			_ = s3a.onBucketMetadataChange(resp.Directory, message.OldEntry, nil)
 			_ = s3a.onIamConfigChange(resp.Directory, message.OldEntry, nil)
 			_ = s3a.onOIDCProviderChange(resp.Directory, message.OldEntry, nil)
+			s3a.onRoleChange(resp.Directory)
 			_ = s3a.onCircuitBreakerConfigChange(resp.Directory, message.OldEntry, nil)
 		}
 
@@ -84,44 +89,27 @@ func (s3a *S3ApiServer) onIamConfigChange(dir string, oldEntry *filer_pb.Entry,
 		return nil
 	}
 
-	reloadIamConfig := func(reason string) error {
-		glog.V(1).Infof("IAM change detected in %s, reloading configuration", reason)
-		if err := s3a.iam.LoadS3ApiConfigurationFromCredentialManager(); err != nil {
-			// the event stream moves on; retry state-based until a reload succeeds
-			glog.Errorf("failed to reload IAM configuration after change in %s: %v", reason, err)
-			s3a.iam.scheduleReload()
-			return err
-		}
-		return nil
-	}
+	// Coalesce bursts through the reload queue instead of one full synchronous
+	// reload per event: independently-refreshing credentials can rewrite several
+	// files within the same second.
 
 	// 1. Handle traditional single identity.json file
 	if dir == filer.IamConfigDirectory {
-		// Handle create/update/delete events on legacy identity.json.
-		// During migration this file is renamed, which emits a delete event.
-		// Always reload from the credential manager so we keep the migrated identities.
 		if (oldEntry != nil && oldEntry.Name == filer.IamIdentityFile) ||
 			(newEntry != nil && newEntry.Name == filer.IamIdentityFile) {
-			if err := reloadIamConfig(dir + "/" + filer.IamIdentityFile); err != nil {
-				return err
-			}
+			s3a.iam.scheduleReload(dir + "/" + filer.IamIdentityFile)
 		}
 		return nil
 	}
 
-	// 2. Handle multiple-file identities and policies
-	// Watch /etc/iam/{identities,policies,service_accounts}
+	// 2. Handle multiple-file identities, policies, service accounts and groups
 	isIdentityDir := dir == filer.IamConfigDirectory+"/identities" || strings.HasPrefix(dir, filer.IamConfigDirectory+"/identities/")
 	isPolicyDir := dir == filer.IamConfigDirectory+"/policies" || strings.HasPrefix(dir, filer.IamConfigDirectory+"/policies/")
 	isServiceAccountDir := dir == filer.IamConfigDirectory+"/service_accounts" || strings.HasPrefix(dir, filer.IamConfigDirectory+"/service_accounts/")
 	isGroupDir := dir == filer.IamConfigDirectory+"/groups" || strings.HasPrefix(dir, filer.IamConfigDirectory+"/groups/")
 
 	if isIdentityDir || isPolicyDir || isServiceAccountDir || isGroupDir {
-		// For multiple-file mode, any change in these directories should trigger a full reload
-		// from the credential manager (which handles the details of loading from multiple files).
-		if err := reloadIamConfig(dir); err != nil {
-			return err
-		}
+		s3a.iam.scheduleReload(dir)
 	}
 
 	return nil
@@ -154,6 +142,40 @@ func (s3a *S3ApiServer) onOIDCProviderChange(dir string, oldEntry *filer_pb.Entr
 	return nil
 }
 
+// roleStoreDir is the directory the persisted role store keeps roles in: its
+// configured basePath, else the default. The metadata subscription watches it.
+func (s3a *S3ApiServer) roleStoreDir() string {
+	if s3a.iam != nil {
+		if provider, ok := s3a.iam.iamIntegration.(IAMManagerProvider); ok {
+			if mgr := provider.GetIAMManager(); mgr != nil {
+				if dir := mgr.RoleStoreDirectory(); dir != "" {
+					return dir
+				}
+			}
+		}
+	}
+	return rolesDir
+}
+
+// onRoleChange drops the cached role definitions when the persisted role
+// store's directory changes, so a role created, changed or deleted on a peer
+// takes effect here on the next lookup instead of after the cache TTL.
+func (s3a *S3ApiServer) onRoleChange(dir string) {
+	base := s3a.roleStoreDir()
+	if dir != base && !strings.HasPrefix(dir, base+"/") {
+		return
+	}
+	if s3a.iam == nil || s3a.iam.iamIntegration == nil {
+		return
+	}
+	s3iam, ok := s3a.iam.iamIntegration.(*S3IAMIntegration)
+	if !ok || s3iam.iamManager == nil {
+		return
+	}
+	s3iam.iamManager.InvalidateRoleCache()
+	glog.V(2).Infof("Invalidated cached roles after %s change", dir)
+}
+
 // onCircuitBreakerConfigChange handles circuit breaker config file changes (create, update, delete)
 func (s3a *S3ApiServer) onCircuitBreakerConfigChange(dir string, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) error {
 	if dir != s3_constants.CircuitBreakerConfigDir {
@@ -184,6 +206,7 @@ func (s3a *S3ApiServer) onCircuitBreakerConfigChange(dir string, oldEntry *filer
 func (s3a *S3ApiServer) onBucketMetadataChange(dir string, oldEntry *filer_pb.Entry, newEntry *filer_pb.Entry) error {
 	if dir == s3a.option.BucketsPath {
 		s3a.maintainBucketOwnerIndex(oldEntry, newEntry)
+		s3a.mirrorBucketPolicyToIAM(oldEntry, newEntry)
 		if newEntry != nil {
 			// Update bucket registry (existing functionality)
 			s3a.bucketRegistry.LoadBucketMetadata(newEntry)
diff --git a/weed/s3api/auth_credentials_subscribe_test.go b/weed/s3api/auth_credentials_subscribe_test.go
index 7ee2365940..59520f1e8a 100644
--- a/weed/s3api/auth_credentials_subscribe_test.go
+++ b/weed/s3api/auth_credentials_subscribe_test.go
@@ -2,8 +2,11 @@ package s3api
 
 import (
 	"context"
+	"fmt"
 	"sync"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/credential"
 	_ "github.com/seaweedfs/seaweedfs/weed/credential/memory"
@@ -53,18 +56,15 @@ func TestOnIamConfigChangeReloadsOnIamIdentityDirectoryChanges(t *testing.T) {
 		t.Fatalf("failed to create alice in memory credential manager: %v", err)
 	}
 
-	err := s3a.onIamConfigChange(
+	if err := s3a.onIamConfigChange(
 		filer.IamConfigDirectory+"/identities",
 		nil,
 		&filer_pb.Entry{Name: "alice.json"},
-	)
-	if err != nil {
+	); err != nil {
 		t.Fatalf("onIamConfigChange returned error for identities directory update: %v", err)
 	}
 
-	if !hasIdentity(s3a.iam, "alice") {
-		t.Fatalf("expected alice identity to be loaded after /etc/iam/identities update")
-	}
+	waitForIdentity(t, s3a.iam, "alice")
 }
 
 func newTestS3ApiServerWithMemoryIAM(t *testing.T, identities []*iam_pb.Identity) *S3ApiServer {
@@ -101,9 +101,12 @@ func newTestS3ApiServerWithMemoryIAM(t *testing.T, identities []*iam_pb.Identity
 		hashCounters:      make(map[string]*int32),
 		isAuthEnabled:     false,
 		stopChan:          make(chan struct{}),
+		reloadCh:          make(chan struct{}, 1),
 		useStaticConfig:   false,
 		credentialManager: cm,
 	}
+	go iam.reloadRetryLoop()
+	t.Cleanup(iam.Shutdown)
 
 	// Load test configuration
 	if err := iam.ReplaceS3ApiConfiguration(config); err != nil {
@@ -122,3 +125,78 @@ func hasIdentity(iam *IdentityAccessManagement, identityName string) bool {
 	_, ok := iam.nameToIdentity[identityName]
 	return ok
 }
+
+func waitForIdentity(t *testing.T, iam *IdentityAccessManagement, name string) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for !hasIdentity(iam, name) {
+		if time.Now().After(deadline) {
+			t.Fatalf("expected identity %s to be loaded", name)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func waitForIdentityGone(t *testing.T, iam *IdentityAccessManagement, name string) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for hasIdentity(iam, name) {
+		if time.Now().After(deadline) {
+			t.Fatalf("expected identity %s to be gone", name)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+// countingStore wraps a store and counts LoadConfiguration calls.
+type countingStore struct {
+	credential.CredentialStore
+	loads int64
+}
+
+func (c *countingStore) LoadConfiguration(ctx context.Context) (*iam_pb.S3ApiConfiguration, error) {
+	atomic.AddInt64(&c.loads, 1)
+	return c.CredentialStore.LoadConfiguration(ctx)
+}
+
+// A burst of IAM config change events must coalesce into a handful of reloads,
+// not one full reload per event.
+func TestOnIamConfigChangeCoalescesBurstReloads(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{{Name: "anonymous"}})
+
+	counter := &countingStore{CredentialStore: s3a.iam.credentialManager.Store}
+	s3a.iam.credentialManager.Store = counter
+
+	const burst = 50
+	for i := 0; i < burst; i++ {
+		if err := s3a.onIamConfigChange(
+			filer.IamConfigDirectory+"/identities",
+			nil,
+			&filer_pb.Entry{Name: fmt.Sprintf("u%d.json", i)},
+		); err != nil {
+			t.Fatalf("onIamConfigChange returned error: %v", err)
+		}
+	}
+
+	// Wait for the queue to drain: no pending signal.
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		s3a.iam.reloadMu.Lock()
+		empty := len(s3a.iam.reloadCh) == 0
+		s3a.iam.reloadMu.Unlock()
+		if empty {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("reload queue did not drain")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	// Let any final coalesced reload finish.
+	time.Sleep(50 * time.Millisecond)
+
+	loads := atomic.LoadInt64(&counter.loads)
+	if loads > 3 {
+		t.Fatalf("expected a burst of %d events to coalesce into <=3 reloads, got %d", burst, loads)
+	}
+}
diff --git a/weed/s3api/auth_credentials_upsert_test.go b/weed/s3api/auth_credentials_upsert_test.go
new file mode 100644
index 0000000000..bc272f330a
--- /dev/null
+++ b/weed/s3api/auth_credentials_upsert_test.go
@@ -0,0 +1,369 @@
+package s3api
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	s3_constants "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// PutIdentity pushes carry the persisted identity proto, which records the
+// inline policy flattened into Actions but not its runtime policy name. The
+// upsert must keep the identity on the attached-policy route; otherwise its
+// coarse "Write:bucket" action authorizes deletes the policy never granted.
+// The push must also install the policy document itself: the inline policy
+// here is never loaded by a full reload, so only the push can supply it.
+func TestUpsertIdentityKeepsInlinePolicyAuthorization(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{{
+		Name:        "writer",
+		Credentials: []*iam_pb.Credential{{AccessKey: "AKW", SecretKey: "secret"}},
+		Actions:     []string{"Read:bucket", "Write:bucket", "List:bucket"},
+	}})
+	ctx := context.Background()
+
+	var doc policy_engine.PolicyDocument
+	require.NoError(t, doc.UnmarshalJSON([]byte(`{
+		"Version":"2012-10-17",
+		"Statement":[{
+			"Effect":"Allow",
+			"Action":["s3:GetObject","s3:PutObject","s3:ListBucket"],
+			"Resource":["arn:aws:s3:::bucket","arn:aws:s3:::bucket/*"]
+		}]
+	}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutUserInlinePolicy(ctx, "writer", "writer", doc))
+
+	pushed, err := s3a.iam.credentialManager.GetUser(ctx, "writer")
+	require.NoError(t, err)
+	require.NotContains(t, pushed.PolicyNames, inlinePolicyRuntimeName("writer", "writer"),
+		"persisted protos do not carry runtime inline policy names")
+	require.NoError(t, s3a.iam.UpsertIdentity(pushed))
+
+	ident := s3a.iam.lookupByIdentityName("writer")
+	require.NotNil(t, ident)
+	require.Contains(t, ident.PolicyNames, inlinePolicyRuntimeName("writer", "writer"))
+
+	_, err = s3a.iam.GetPolicy(inlinePolicyRuntimeName("writer", "writer"))
+	require.NoError(t, err, "the push must install the inline policy document, not just its name")
+
+	req, err := http.NewRequest(http.MethodGet, "http://s3/bucket/obj", nil)
+	require.NoError(t, err)
+	assert.Equal(t, s3err.ErrNone,
+		s3a.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_READ, "bucket", "obj"),
+		"an allowed request must succeed through the pushed inline policy")
+
+	req, err = http.NewRequest(http.MethodDelete, "http://s3/bucket/obj", nil)
+	require.NoError(t, err)
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_WRITE, "bucket", "obj"),
+		"an identity pushed without its inline policy must not fall back to legacy Actions")
+}
+
+// A pushed identity must also refresh a cached inline policy document that has
+// since been replaced in the store; otherwise the stale allow keeps
+// authorizing requests the new policy revoked.
+func TestUpsertIdentityRefreshesInlinePolicyDocument(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{{
+		Name:        "writer",
+		Credentials: []*iam_pb.Credential{{AccessKey: "AKW", SecretKey: "secret"}},
+		Actions:     []string{"Read:bucket", "Write:bucket", "List:bucket"},
+	}})
+	ctx := context.Background()
+
+	var doc policy_engine.PolicyDocument
+	require.NoError(t, doc.UnmarshalJSON([]byte(`{
+		"Version":"2012-10-17",
+		"Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]
+	}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutUserInlinePolicy(ctx, "writer", "writer", doc))
+	require.NoError(t, s3a.iam.LoadS3ApiConfigurationFromCredentialManager())
+
+	ident := s3a.iam.lookupByIdentityName("writer")
+	require.NotNil(t, ident)
+	req, err := http.NewRequest(http.MethodGet, "http://s3/bucket/obj", nil)
+	require.NoError(t, err)
+	require.Equal(t, s3err.ErrNone,
+		s3a.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_READ, "bucket", "obj"))
+
+	require.NoError(t, doc.UnmarshalJSON([]byte(`{
+		"Version":"2012-10-17",
+		"Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]
+	}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutUserInlinePolicy(ctx, "writer", "writer", doc))
+
+	pushed, err := s3a.iam.credentialManager.GetUser(ctx, "writer")
+	require.NoError(t, err)
+	require.NoError(t, s3a.iam.UpsertIdentity(pushed))
+
+	ident = s3a.iam.lookupByIdentityName("writer")
+	require.NotNil(t, ident)
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_READ, "bucket", "obj"),
+		"a push must replace the stale cached document, not keep the old allow")
+}
+
+// The same applies to PutGroup pushes: the persisted group proto lacks the
+// group's runtime inline policy names, and the inline document is never
+// loaded by a full reload here, so only the push can supply it.
+func TestPutGroupKeepsInlinePolicyAuthorization(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{{Name: "alice"}})
+	ctx := context.Background()
+
+	require.NoError(t, s3a.iam.credentialManager.CreateGroup(ctx,
+		&iam_pb.Group{Name: "devs", Members: []string{"alice"}}))
+	var doc policy_engine.PolicyDocument
+	require.NoError(t, doc.UnmarshalJSON([]byte(`{
+		"Version":"2012-10-17",
+		"Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]
+	}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutGroupInlinePolicy(ctx, "devs", "p", doc))
+
+	pushed, err := s3a.iam.credentialManager.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+	require.NoError(t, s3a.iam.PutGroup(pushed))
+
+	s3a.iam.m.RLock()
+	require.Contains(t, s3a.iam.groups["devs"].PolicyNames, inlineGroupPolicyRuntimeName("devs", "p"))
+	s3a.iam.m.RUnlock()
+
+	_, err = s3a.iam.GetPolicy(inlineGroupPolicyRuntimeName("devs", "p"))
+	require.NoError(t, err, "the push must install the group's inline policy document")
+
+	ident := s3a.iam.lookupByIdentityName("alice")
+	require.NotNil(t, ident)
+	req, err := http.NewRequest(http.MethodGet, "http://s3/bucket/obj", nil)
+	require.NoError(t, err)
+	assert.Equal(t, s3err.ErrNone,
+		s3a.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_READ, "bucket", "obj"),
+		"a pushed group must keep its inline policy grant active")
+}
+
+// pausingInlineStore pauses only the first user and first group inline policy
+// Get, after capturing the document, so a test can interleave a newer write
+// between a push's store read and the install of what it read. Later calls
+// proceed immediately.
+type pausingInlineStore struct {
+	credential.CredentialStore
+
+	userGets     int32
+	userPaused   chan struct{}
+	userRelease  chan struct{}
+	groupGets    int32
+	groupPaused  chan struct{}
+	groupRelease chan struct{}
+}
+
+func (s *pausingInlineStore) userPolicies() credential.InlinePolicyStore {
+	return s.CredentialStore.(credential.InlinePolicyStore)
+}
+
+func (s *pausingInlineStore) groupPolicies() credential.GroupInlinePolicyStore {
+	return s.CredentialStore.(credential.GroupInlinePolicyStore)
+}
+
+func (s *pausingInlineStore) PutUserInlinePolicy(ctx context.Context, userName, policyName string, doc policy_engine.PolicyDocument) error {
+	return s.userPolicies().PutUserInlinePolicy(ctx, userName, policyName, doc)
+}
+
+func (s *pausingInlineStore) GetUserInlinePolicy(ctx context.Context, userName, policyName string) (*policy_engine.PolicyDocument, error) {
+	doc, err := s.userPolicies().GetUserInlinePolicy(ctx, userName, policyName)
+	if err != nil {
+		return nil, err
+	}
+	if atomic.AddInt32(&s.userGets, 1) == 1 {
+		close(s.userPaused)
+		<-s.userRelease
+	}
+	return doc, nil
+}
+
+func (s *pausingInlineStore) DeleteUserInlinePolicy(ctx context.Context, userName, policyName string) error {
+	return s.userPolicies().DeleteUserInlinePolicy(ctx, userName, policyName)
+}
+
+func (s *pausingInlineStore) ListUserInlinePolicies(ctx context.Context, userName string) ([]string, error) {
+	return s.userPolicies().ListUserInlinePolicies(ctx, userName)
+}
+
+func (s *pausingInlineStore) PutGroupInlinePolicy(ctx context.Context, groupName, policyName string, doc policy_engine.PolicyDocument) error {
+	return s.groupPolicies().PutGroupInlinePolicy(ctx, groupName, policyName, doc)
+}
+
+func (s *pausingInlineStore) GetGroupInlinePolicy(ctx context.Context, groupName, policyName string) (*policy_engine.PolicyDocument, error) {
+	doc, err := s.groupPolicies().GetGroupInlinePolicy(ctx, groupName, policyName)
+	if err != nil {
+		return nil, err
+	}
+	if atomic.AddInt32(&s.groupGets, 1) == 1 {
+		close(s.groupPaused)
+		<-s.groupRelease
+	}
+	return doc, nil
+}
+
+func (s *pausingInlineStore) DeleteGroupInlinePolicy(ctx context.Context, groupName, policyName string) error {
+	return s.groupPolicies().DeleteGroupInlinePolicy(ctx, groupName, policyName)
+}
+
+func (s *pausingInlineStore) ListGroupInlinePolicies(ctx context.Context, groupName string) ([]string, error) {
+	return s.groupPolicies().ListGroupInlinePolicies(ctx, groupName)
+}
+
+// A push paused after reading a permissive inline policy must not overwrite a
+// tighter document a later push already installed: once the pause lifts, the
+// stale read may still land, but the newer push must be the state that wins.
+func TestUpsertIdentityRaceKeepsNewerInlinePolicy(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{{
+		Name:        "writer",
+		Credentials: []*iam_pb.Credential{{AccessKey: "AKW", SecretKey: "secret"}},
+	}})
+	ctx := context.Background()
+
+	pauser := &pausingInlineStore{
+		CredentialStore: s3a.iam.credentialManager.GetStore(),
+		userPaused:      make(chan struct{}),
+		userRelease:     make(chan struct{}),
+	}
+	s3a.iam.credentialManager.Store = pauser
+
+	var docV1 policy_engine.PolicyDocument
+	require.NoError(t, docV1.UnmarshalJSON([]byte(
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutUserInlinePolicy(ctx, "writer", "p", docV1))
+
+	pushed, err := s3a.iam.credentialManager.GetUser(ctx, "writer")
+	require.NoError(t, err)
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		assert.NoError(t, s3a.iam.UpsertIdentity(pushed))
+	}()
+
+	select {
+	case <-pauser.userPaused:
+	case <-time.After(5 * time.Second):
+		t.Fatal("first push did not reach the inline policy read")
+	}
+
+	// The administrator tightens the policy; its push must be the surviving one.
+	var docV2 policy_engine.PolicyDocument
+	require.NoError(t, docV2.UnmarshalJSON([]byte(
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutUserInlinePolicy(ctx, "writer", "p", docV2))
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		assert.NoError(t, s3a.iam.UpsertIdentity(pushed))
+	}()
+
+	// Give the second push a moment to install the newer document; with the
+	// ordering fix it instead waits for the first push and this poll expires.
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if p, err := s3a.iam.GetPolicy(inlinePolicyRuntimeName("writer", "p")); err == nil && strings.Contains(p.Content, "s3:ListBucket") {
+			break
+		}
+		time.Sleep(time.Millisecond)
+	}
+	close(pauser.userRelease)
+	wg.Wait()
+
+	installed, err := s3a.iam.GetPolicy(inlinePolicyRuntimeName("writer", "p"))
+	require.NoError(t, err)
+	assert.JSONEq(t,
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`,
+		installed.Content, "the newer pushed document must win over the stale read")
+
+	ident := s3a.iam.lookupByIdentityName("writer")
+	require.NotNil(t, ident)
+	req, err := http.NewRequest(http.MethodGet, "http://s3/bucket/obj", nil)
+	require.NoError(t, err)
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_READ, "bucket", "obj"),
+		"a stale push must not restore a grant the newer policy revoked")
+}
+
+// Same ordering guarantee for group pushes: a paused PutGroup must not
+// overwrite a tighter inline document installed by a later push.
+func TestPutGroupRaceKeepsNewerInlinePolicy(t *testing.T) {
+	s3a := newTestS3ApiServerWithMemoryIAM(t, []*iam_pb.Identity{{Name: "alice"}})
+	ctx := context.Background()
+
+	pauser := &pausingInlineStore{
+		CredentialStore: s3a.iam.credentialManager.GetStore(),
+		groupPaused:     make(chan struct{}),
+		groupRelease:    make(chan struct{}),
+	}
+	s3a.iam.credentialManager.Store = pauser
+
+	require.NoError(t, s3a.iam.credentialManager.CreateGroup(ctx,
+		&iam_pb.Group{Name: "devs", Members: []string{"alice"}}))
+	var docV1 policy_engine.PolicyDocument
+	require.NoError(t, docV1.UnmarshalJSON([]byte(
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutGroupInlinePolicy(ctx, "devs", "p", docV1))
+
+	pushed, err := s3a.iam.credentialManager.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		assert.NoError(t, s3a.iam.PutGroup(pushed))
+	}()
+
+	select {
+	case <-pauser.groupPaused:
+	case <-time.After(5 * time.Second):
+		t.Fatal("first group push did not reach the inline policy read")
+	}
+
+	var docV2 policy_engine.PolicyDocument
+	require.NoError(t, docV2.UnmarshalJSON([]byte(
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`)))
+	require.NoError(t, s3a.iam.credentialManager.PutGroupInlinePolicy(ctx, "devs", "p", docV2))
+
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		assert.NoError(t, s3a.iam.PutGroup(pushed))
+	}()
+
+	deadline := time.Now().Add(500 * time.Millisecond)
+	for time.Now().Before(deadline) {
+		if p, err := s3a.iam.GetPolicy(inlineGroupPolicyRuntimeName("devs", "p")); err == nil && strings.Contains(p.Content, "s3:ListBucket") {
+			break
+		}
+		time.Sleep(time.Millisecond)
+	}
+	close(pauser.groupRelease)
+	wg.Wait()
+
+	installed, err := s3a.iam.GetPolicy(inlineGroupPolicyRuntimeName("devs", "p"))
+	require.NoError(t, err)
+	assert.JSONEq(t,
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListBucket","Resource":"*"}]}`,
+		installed.Content, "the newer pushed group document must win over the stale read")
+
+	ident := s3a.iam.lookupByIdentityName("alice")
+	require.NotNil(t, ident)
+	req, err := http.NewRequest(http.MethodGet, "http://s3/bucket/obj", nil)
+	require.NoError(t, err)
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_READ, "bucket", "obj"),
+		"a stale group push must not restore a grant the newer policy revoked")
+}
diff --git a/weed/s3api/auth_invalid_bucket_name_test.go b/weed/s3api/auth_invalid_bucket_name_test.go
new file mode 100644
index 0000000000..e702d49001
--- /dev/null
+++ b/weed/s3api/auth_invalid_bucket_name_test.go
@@ -0,0 +1,250 @@
+package s3api
+
+import (
+	"bytes"
+	"encoding/base64"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	invalidNameTestAccessKey = "INVALIDNAMEKEY000001"
+	invalidNameTestSecretKey = "invalid-name-secret-for-tests-only"
+	invalidNameTestBucket    = "readable-bucket"
+)
+
+// newInvalidNameIAM has one identity that may read invalidNameTestBucket only
+// and a configured anonymous identity with no actions.
+func newInvalidNameIAM(t *testing.T) *IdentityAccessManagement {
+	t.Helper()
+	iam := &IdentityAccessManagement{hashes: make(map[string]*sync.Pool), hashCounters: make(map[string]*int32)}
+	require.NoError(t, iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{Name: "reader", Actions: []string{"Read:" + invalidNameTestBucket},
+				Credentials: []*iam_pb.Credential{{AccessKey: invalidNameTestAccessKey, SecretKey: invalidNameTestSecretKey}}},
+			{Name: s3_constants.AccountAnonymousId},
+		},
+	}))
+	require.True(t, iam.isEnabled())
+	return iam
+}
+
+func invalidNameRequest(t *testing.T, bucket string, sign bool) *http.Request {
+	t.Helper()
+	req := mustNewRequest(http.MethodGet, fmt.Sprintf("http://127.0.0.1:8333/%s/key", bucket), 0, nil, t)
+	if sign {
+		require.NoError(t, signRequestV4(req, invalidNameTestAccessKey, invalidNameTestSecretKey))
+	}
+	return mux.SetURLVars(req, map[string]string{"bucket": bucket, "object": "key"})
+}
+
+func serveAuth(iam *IdentityAccessManagement, r *http.Request) (int, bool) {
+	ran := false
+	rec := httptest.NewRecorder()
+	iam.Auth(func(w http.ResponseWriter, r *http.Request) { ran = true; w.WriteHeader(http.StatusOK) }, s3_constants.ACTION_READ).ServeHTTP(rec, r)
+	return rec.Code, ran
+}
+
+// A denied request on a malformed bucket name answers 400 InvalidBucketName,
+// as AWS S3 does; a denied request on a well-formed name stays 403.
+func TestAuthDeniedInvalidBucketName(t *testing.T) {
+	iam := newInvalidNameIAM(t)
+
+	code, ran := serveAuth(iam, invalidNameRequest(t, invalidNameTestBucket, true))
+	assert.True(t, ran, "the identity's own bucket is allowed")
+	assert.Equal(t, http.StatusOK, code)
+
+	code, ran = serveAuth(iam, invalidNameRequest(t, "other-bucket", true))
+	assert.False(t, ran)
+	assert.Equal(t, http.StatusForbidden, code, "a well-formed name the caller may not read stays AccessDenied")
+
+	for _, bucket := range []string{"Bad_Bucket", "ab", "bucket..name", "bücket"} {
+		for _, sign := range []bool{true, false} {
+			code, ran = serveAuth(iam, invalidNameRequest(t, bucket, sign))
+			assert.False(t, ran, bucket)
+			assert.Equal(t, http.StatusBadRequest, code, "bucket %q signed=%v", bucket, sign)
+		}
+	}
+}
+
+func TestRefineDenialForBucketName(t *testing.T) {
+	reader := &Identity{Name: "reader"}
+	req := func(bucket string) *http.Request {
+		return mux.SetURLVars(httptest.NewRequest(http.MethodGet, "/", nil), map[string]string{"bucket": bucket})
+	}
+	cases := []struct {
+		name     string
+		bucket   string
+		identity *Identity
+		in, want s3err.ErrorCode
+	}{
+		{"space in the name", "bucket name", reader, s3err.ErrAccessDenied, s3err.ErrInvalidBucketName},
+		{"non-ASCII letter", "bücket", reader, s3err.ErrAccessDenied, s3err.ErrInvalidBucketName},
+		{"superscript digit", "b²cket", reader, s3err.ErrAccessDenied, s3err.ErrInvalidBucketName},
+		{"too short", "ab", reader, s3err.ErrAccessDenied, s3err.ErrInvalidBucketName},
+		{"well-formed name", "other-bucket", reader, s3err.ErrAccessDenied, s3err.ErrAccessDenied},
+		{"no bucket in the request", "", reader, s3err.ErrAccessDenied, s3err.ErrAccessDenied},
+		{"allowed", "Bad_Bucket", reader, s3err.ErrNone, s3err.ErrNone},
+		{"authentication failed", "Bad_Bucket", nil, s3err.ErrAccessDenied, s3err.ErrAccessDenied},
+		{"bad signature", "Bad_Bucket", nil, s3err.ErrSignatureDoesNotMatch, s3err.ErrSignatureDoesNotMatch},
+	}
+	for _, c := range cases {
+		assert.Equal(t, c.want, refineDenialForBucketName(req(c.bucket), c.identity, c.in), c.name)
+	}
+}
+
+// signedPostForm builds a multipart POST Object request for bucket, its policy
+// signed with secret under postAuthzAccessKey.
+func signedPostForm(t *testing.T, bucket, key, secret string) *http.Request {
+	t.Helper()
+	now := time.Now().UTC()
+	amzDate := now.Format(iso8601Format)
+	day := now.Format(yyyymmdd)
+	credential := fmt.Sprintf("%s/%s/%s/%s/aws4_request", postAuthzAccessKey, day, postAuthzRegion, postAuthzService)
+	policyJSON := fmt.Sprintf(`{"expiration":"%s","conditions":[["eq","$bucket","%s"],["eq","$key","%s"],`+
+		`["eq","$x-amz-credential","%s"],["eq","$x-amz-algorithm","AWS4-HMAC-SHA256"],["eq","$x-amz-date","%s"]]}`,
+		now.Add(time.Hour).Format("2006-01-02T15:04:05.000Z"), bucket, key, credential, amzDate)
+	encodedPolicy := base64.StdEncoding.EncodeToString([]byte(policyJSON))
+	signature := getSignature(getSigningKey(secret, day, postAuthzRegion, postAuthzService), encodedPolicy)
+
+	var buf bytes.Buffer
+	writer := multipart.NewWriter(&buf)
+	for _, field := range [][2]string{{"bucket", bucket}, {"key", key}, {"x-amz-credential", credential},
+		{"x-amz-algorithm", "AWS4-HMAC-SHA256"}, {"x-amz-date", amzDate}, {"policy", encodedPolicy}, {"x-amz-signature", signature}} {
+		require.NoError(t, writer.WriteField(field[0], field[1]))
+	}
+	filePart, err := writer.CreateFormFile("file", "payload.txt")
+	require.NoError(t, err)
+	_, err = filePart.Write([]byte("payload"))
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+
+	req := httptest.NewRequest(http.MethodPost, "/"+bucket, &buf)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	return mux.SetURLVars(req, map[string]string{"bucket": bucket})
+}
+
+// A browser POST upload authenticates in the handler, after AuthPostPolicy has
+// delegated it, so its denials are refined there: a verified form denied on a
+// malformed bucket name answers 400, a bad signature or a well-formed name 403.
+func TestPostPolicyDeniedInvalidBucketName(t *testing.T) {
+	s3a := newPostAuthzServer(t)
+	for _, bucket := range []string{"Bad_Bucket", "other-bucket"} {
+		s3a.bucketRegistry.setMetadataCache(&BucketMetaData{Name: bucket})
+	}
+	// A second identity may write Bad_Bucket, except under denied/.
+	require.NoError(t, s3a.iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{Name: "tester", Actions: []string{"Write:" + postAuthzBucket},
+				Credentials: []*iam_pb.Credential{{AccessKey: postAuthzAccessKey, SecretKey: postAuthzSecretKey}}},
+		},
+	}))
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("Bad_Bucket", `{"Version":"2012-10-17","Statement":[`+
+		`{"Effect":"Deny","Principal":"*","Action":["s3:PutObject"],"Resource":["arn:aws:s3:::Bad_Bucket/denied/*"]}]}`))
+
+	serve := func(r *http.Request) *httptest.ResponseRecorder {
+		rec := httptest.NewRecorder()
+		s3a.iam.AuthPostPolicy(s3a.PostPolicyBucketHandler, s3_constants.ACTION_WRITE).ServeHTTP(rec, r)
+		return rec
+	}
+
+	rec := serve(signedPostForm(t, "Bad_Bucket", "k", postAuthzSecretKey))
+	assert.Equal(t, http.StatusBadRequest, rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "InvalidBucketName")
+
+	rec = serve(signedPostForm(t, "Bad_Bucket", "k", "not-the-secret"))
+	assert.Equal(t, http.StatusForbidden, rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "SignatureDoesNotMatch", "a form that fails verification is not refined")
+
+	rec = serve(signedPostForm(t, "other-bucket", "k", postAuthzSecretKey))
+	assert.Equal(t, http.StatusForbidden, rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "AccessDenied")
+
+	// The per-key authorization after the coarse Write check is refined too.
+	require.NoError(t, s3a.iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{Name: "tester", Actions: []string{"Write:Bad_Bucket"},
+				Credentials: []*iam_pb.Credential{{AccessKey: postAuthzAccessKey, SecretKey: postAuthzSecretKey}}},
+		},
+	}))
+	rec = serve(signedPostForm(t, "Bad_Bucket", "denied/k", postAuthzSecretKey))
+	assert.Equal(t, http.StatusBadRequest, rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "InvalidBucketName")
+}
+
+// Unsigned GET/HEAD object reads are authorized inside the object handlers, not
+// by Auth; their denial on a malformed bucket name answers 400 as well.
+func TestAnonymousReadDeniedInvalidBucketName(t *testing.T) {
+	read := func(s3a *S3ApiServer, method, bucket string) int {
+		r := httptest.NewRequest(method, "/"+bucket+"/key", nil)
+		r = mux.SetURLVars(r, map[string]string{"bucket": bucket, "object": "key"})
+		handler := s3a.GetObjectHandler
+		if method == http.MethodHead {
+			handler = s3a.HeadObjectHandler
+		}
+		rr := httptest.NewRecorder()
+		s3a.AuthWithPublicRead(handler, s3_constants.ACTION_READ)(rr, r)
+		return rr.Code
+	}
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		s3a, _ := newAnonymousReadTestServer(t)
+		s3a.iam.identityAnonymous = &Identity{Name: s3_constants.AccountAnonymousId}
+		assert.Equal(t, http.StatusBadRequest, read(s3a, method, "Bad_Bucket"), method)
+		assert.Equal(t, http.StatusForbidden, read(s3a, method, "other-bucket"), "%s: a well-formed missing bucket stays masked", method)
+
+		// No anonymous identity configured: no identity resolves, as in Auth.
+		s3a, _ = newAnonymousReadTestServer(t)
+		assert.Equal(t, http.StatusForbidden, read(s3a, method, "Bad_Bucket"), method)
+	}
+}
+
+// An existing private key and a missing key in the same malformed-name bucket
+// must answer alike, or the status code tells an anonymous caller which keys
+// exist.
+func TestAnonymousReadDeniedInvalidBucketNameExistingKey(t *testing.T) {
+	const bucket = "bücket"
+	read := func(s3a *S3ApiServer, method, object string) int {
+		r := httptest.NewRequest(method, "/"+bucket+"/"+object, nil)
+		r = mux.SetURLVars(r, map[string]string{"bucket": bucket, "object": object})
+		handler := s3a.GetObjectHandler
+		if method == http.MethodHead {
+			handler = s3a.HeadObjectHandler
+		}
+		rr := httptest.NewRecorder()
+		s3a.AuthWithPublicRead(handler, s3_constants.ACTION_READ)(rr, r)
+		return rr.Code
+	}
+	setup := func(anonymous bool) *S3ApiServer {
+		s3a, f := newAnonymousReadTestServer(t)
+		if anonymous {
+			s3a.iam.identityAnonymous = &Identity{Name: s3_constants.AccountAnonymousId}
+		}
+		s3a.bucketConfigCache.Set(bucket, &BucketConfig{Name: bucket, Ownership: s3_constants.OwnershipObjectWriter})
+		f.entries["/buckets/"+bucket+"/private"] = anonymousReadEntry([]byte(`[]`))
+		f.entries["/buckets/"+bucket+"/public"] = anonymousReadEntry(anonymousReadGrant("READ"))
+		return s3a
+	}
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		s3a := setup(true)
+		assert.Equal(t, http.StatusOK, read(s3a, method, "public"), "%s: a public key is still served", method)
+		assert.Equal(t, http.StatusBadRequest, read(s3a, method, "missing"), method)
+		assert.Equal(t, http.StatusBadRequest, read(s3a, method, "private"), "%s: an existing private key answers like a missing one", method)
+
+		// No anonymous identity configured: both stay 403, as in Auth.
+		s3a = setup(false)
+		assert.Equal(t, http.StatusForbidden, read(s3a, method, "missing"), method)
+		assert.Equal(t, http.StatusForbidden, read(s3a, method, "private"), method)
+	}
+}
diff --git a/weed/s3api/auth_security_test.go b/weed/s3api/auth_security_test.go
index b6e31089db..d6b1440ee2 100644
--- a/weed/s3api/auth_security_test.go
+++ b/weed/s3api/auth_security_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
+	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/stretchr/testify/assert"
@@ -312,6 +313,20 @@ func TestExternalUrlSignatureVerification(t *testing.T) {
 			externalUrl:   "http://api.example.com:80",
 			expectSuccess: true,
 		},
+		{
+			name:          "externalUrl set, in-cluster client signs the service host",
+			clientUrl:     "http://seaweedfs-s3:8333/test-bucket/object",
+			backendHost:   "seaweedfs-s3:8333",
+			externalUrl:   "https://api.example.com",
+			expectSuccess: true,
+		},
+		{
+			name:          "externalUrl set, external client signs a virtual-hosted bucket name",
+			clientUrl:     "https://test-bucket.api.example.com/object",
+			backendHost:   "test-bucket.api.example.com",
+			externalUrl:   "https://api.example.com",
+			expectSuccess: true,
+		},
 		{
 			name:          "without externalUrl, internal host causes mismatch",
 			clientUrl:     "https://api.example.com:9000/test-bucket/object",
@@ -543,3 +558,108 @@ func TestRealSDKSignerWithForwardedHeaders(t *testing.T) {
 		})
 	}
 }
+
+// GHSA-8rrx-349w-6396: ?prefix= was promoted into the object for every action,
+// so PUT /cache?versioning&prefix=x authorized as Write:cache/x. An identity
+// holding only Write:cache/* could then change bucket versioning, lifecycle,
+// cors, and object-lock configuration.
+func TestPrefixParameterDoesNotEscalateBucketActions(t *testing.T) {
+	resetMemoryStore()
+	defer resetMemoryStore()
+
+	configContent := `{
+  "identities": [
+    {"name":"admin","credentials":[{"accessKey":"ADMINKEY","secretKey":"adminsecret0000000000000000000001"}],"actions":["Admin"]},
+    {"name":"writer","credentials":[{"accessKey":"WRITERKEY","secretKey":"writersecret000000000000000000001"}],"actions":["Read:cache","Write:cache/*","List:cache"]},
+    {"name":"uploadreader","credentials":[{"accessKey":"UPREADERKEY","secretKey":"upreadersecret00000000000000001"}],"actions":["Read:cache/uploads/*"]},
+    {"name":"policywriter","credentials":[{"accessKey":"POLICYKEY","secretKey":"policysecret00000000000000000001"}],"policyNames":["WriterPolicy"]},
+    {"name":"uploadlister","credentials":[{"accessKey":"UPLISTERKEY","secretKey":"uplistersecret00000000000000001"}],"policyNames":["UploadsPolicy"]},
+    {"name":"getonly","credentials":[{"accessKey":"GETONLYKEY","secretKey":"getonlysecret0000000000000000001"}],"policyNames":["GetOnlyPolicy"]}
+  ],
+  "policies":[
+    {"name":"WriterPolicy","content":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:PutObject\"],\"Resource\":[\"arn:aws:s3:::cache/*\"]}]}"},
+    {"name":"UploadsPolicy","content":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:ListBucketMultipartUploads\"],\"Resource\":[\"arn:aws:s3:::cache\"]}]}"},
+    {"name":"GetOnlyPolicy","content":"{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\"],\"Resource\":[\"arn:aws:s3:::cache/*\"]}]}"}
+  ]
+}`
+	tmpFile, err := os.CreateTemp("", "s3-config-*.json")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+	_, err = tmpFile.Write([]byte(configContent))
+	require.NoError(t, err)
+	require.NoError(t, tmpFile.Close())
+
+	iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{Config: tmpFile.Name()}, nil, "memory")
+	require.True(t, iam.isEnabled(), "Auth should be enabled")
+
+	for _, tc := range []struct {
+		name   string
+		access string
+		secret string
+		object string
+		query  string
+		action Action
+		want   s3err.ErrorCode
+	}{
+		{"writer put object", "WRITERKEY", "writersecret000000000000000000001", "key", "", s3_constants.ACTION_WRITE, s3err.ErrNone},
+		{"writer put versioning", "WRITERKEY", "writersecret000000000000000000001", "", "versioning", s3_constants.ACTION_WRITE, s3err.ErrAccessDenied},
+		{"writer put versioning with prefix", "WRITERKEY", "writersecret000000000000000000001", "", "versioning&prefix=x", s3_constants.ACTION_WRITE, s3err.ErrAccessDenied},
+		{"writer put lifecycle with prefix", "WRITERKEY", "writersecret000000000000000000001", "", "lifecycle&prefix=x", s3_constants.ACTION_WRITE, s3err.ErrAccessDenied},
+		{"writer list with prefix", "WRITERKEY", "writersecret000000000000000000001", "", "list-type=2&prefix=x", s3_constants.ACTION_LIST, s3err.ErrNone},
+		{"policywriter put object", "POLICYKEY", "policysecret00000000000000000001", "key", "", s3_constants.ACTION_WRITE, s3err.ErrNone},
+		{"policywriter put versioning with prefix", "POLICYKEY", "policysecret00000000000000000001", "", "versioning&prefix=x", s3_constants.ACTION_WRITE, s3err.ErrAccessDenied},
+		{"uploadreader lists uploads under prefix", "UPREADERKEY", "upreadersecret00000000000000001", "", "uploads&prefix=uploads/foo", s3_constants.ACTION_READ, s3err.ErrNone},
+		{"uploadreader cannot list outside prefix", "UPREADERKEY", "upreadersecret00000000000000001", "", "uploads&prefix=other/", s3_constants.ACTION_READ, s3err.ErrAccessDenied},
+		{"uploadlister lists uploads", "UPLISTERKEY", "uplistersecret00000000000000001", "", "uploads&prefix=x", s3_constants.ACTION_READ, s3err.ErrNone},
+		{"getonly cannot list uploads", "GETONLYKEY", "getonlysecret0000000000000000001", "", "uploads&prefix=x", s3_constants.ACTION_READ, s3err.ErrAccessDenied},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			url := "http://localhost:8333/cache"
+			if tc.object != "" {
+				url += "/" + tc.object
+			}
+			if tc.query != "" {
+				url += "?" + tc.query
+			}
+			r := httptest.NewRequest(http.MethodPut, url, nil)
+			if tc.action == s3_constants.ACTION_LIST || tc.action == s3_constants.ACTION_READ {
+				r.Method = http.MethodGet
+			}
+			r = mux.SetURLVars(r, map[string]string{"bucket": "cache", "object": tc.object})
+			require.NoError(t, signRawHTTPRequest(context.Background(), r, tc.access, tc.secret, "us-east-1"))
+
+			_, errCode := iam.authRequest(r, tc.action)
+			assert.Equal(t, tc.want, errCode)
+		})
+	}
+}
+
+// The admin explicit-deny path resolves the same action and resource the
+// policy engine sees, so a promoted prefix must not hide a listing variant:
+// ?uploads resolves s3:ListBucketMultipartUploads on the bucket ARN, and
+// ?versions resolves s3:ListBucketVersions, both at bucket level.
+func TestResolveS3AuthTarget_BucketListings(t *testing.T) {
+	for _, tt := range []struct {
+		name         string
+		url          string
+		action       Action
+		object       string
+		wantAction   string
+		wantResource string
+	}{
+		{"uploads listing keeps its action", "/cache?uploads&prefix=uploads/", s3_constants.ACTION_READ, "uploads/",
+			s3_constants.S3_ACTION_LIST_MULTIPART_UPLOADS, "arn:aws:s3:::cache"},
+		{"versions listing keeps its action", "/cache?versions&prefix=a/", s3_constants.ACTION_LIST, "a/",
+			s3_constants.S3_ACTION_LIST_BUCKET_VERSIONS, "arn:aws:s3:::cache"},
+		{"plain list keeps its action", "/cache?list-type=2&prefix=a/", s3_constants.ACTION_LIST, "a/",
+			s3_constants.S3_ACTION_LIST_BUCKET, "arn:aws:s3:::cache"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, tt.url, nil)
+			r = mux.SetURLVars(r, map[string]string{"bucket": "cache"})
+			action, resource := resolveS3AuthTarget(tt.action, "cache", tt.object, r)
+			assert.Equal(t, tt.wantAction, action)
+			assert.Equal(t, tt.wantResource, resource)
+		})
+	}
+}
diff --git a/weed/s3api/auth_signature_v2.go b/weed/s3api/auth_signature_v2.go
index 2a61bfd85d..5148be2218 100644
--- a/weed/s3api/auth_signature_v2.go
+++ b/weed/s3api/auth_signature_v2.go
@@ -18,6 +18,7 @@
 package s3api
 
 import (
+	"context"
 	"crypto/hmac"
 	"crypto/sha1"
 	"crypto/subtle"
@@ -68,11 +69,11 @@ func (iam *IdentityAccessManagement) isReqAuthenticatedV2(r *http.Request) (*Ide
 	return iam.doesPresignV2SignatureMatch(r)
 }
 
-func (iam *IdentityAccessManagement) doesPolicySignatureV2Match(formValues http.Header) s3err.ErrorCode {
+func (iam *IdentityAccessManagement) doesPolicySignatureV2Match(ctx context.Context, formValues http.Header) (*Identity, s3err.ErrorCode) {
 
 	accessKey := formValues.Get("AWSAccessKeyId")
 	if accessKey == "" {
-		return s3err.ErrMissingFields
+		return nil, s3err.ErrMissingFields
 	}
 
 	identity, cred, found := iam.lookupByAccessKey(accessKey)
@@ -85,35 +86,32 @@ func (iam *IdentityAccessManagement) doesPolicySignatureV2Match(formValues http.
 		glog.Warningf("InvalidAccessKeyId (V2 POST): attempted key '%s' not found. Available keys: %d, Auth enabled: %v",
 			accessKey, availableKeyCount, iam.isAuthEnabled)
 
-		return s3err.ErrInvalidAccessKeyID
+		return nil, s3err.ErrInvalidAccessKeyID
 	}
 
 	// Check service account expiration
 	if cred.isCredentialExpired() {
 		glog.V(2).Infof("Service account credential %s has expired (expiration: %d, now: %d)",
 			accessKey, cred.Expiration, time.Now().Unix())
-		return s3err.ErrAccessDenied
-	}
-
-	bucket := formValues.Get("bucket")
-	if !identity.CanDo(s3_constants.ACTION_WRITE, bucket, "") {
-		return s3err.ErrAccessDenied
+		return nil, s3err.ErrAccessDenied
 	}
 
 	policy := formValues.Get("Policy")
 	if policy == "" {
-		return s3err.ErrMissingFields
+		return nil, s3err.ErrMissingFields
 	}
 
 	signature := formValues.Get("Signature")
 	if signature == "" {
-		return s3err.ErrMissingFields
+		return nil, s3err.ErrMissingFields
 	}
 
 	if !compareSignatureV2(signature, calculateSignatureV2(policy, cred.SecretKey)) {
-		return s3err.ErrSignatureDoesNotMatch
+		return nil, s3err.ErrSignatureDoesNotMatch
 	}
-	return s3err.ErrNone
+	s3_constants.RecordAccessKeyId(ctx, cred.AccessKey)
+	s3_constants.RecordStoredAccessKeyId(ctx, cred.AccessKey, cred.SecretKey)
+	return identity, s3err.ErrNone
 }
 
 // doesSignV2Match - Verify authorization header with calculated header in accordance with
@@ -170,6 +168,8 @@ func (iam *IdentityAccessManagement) doesSignV2Match(r *http.Request) (*Identity
 	if !compareSignatureV2(v2Signature, expectedV2Signature) {
 		return nil, s3err.ErrSignatureDoesNotMatch
 	}
+	s3_constants.RecordAccessKeyId(r.Context(), cred.AccessKey)
+	s3_constants.RecordStoredAccessKeyId(r.Context(), cred.AccessKey, cred.SecretKey)
 	return identity, s3err.ErrNone
 }
 
@@ -228,6 +228,8 @@ func (iam *IdentityAccessManagement) doesPresignV2SignatureMatch(r *http.Request
 	if !compareSignatureV2(signature, expectedSignature) {
 		return nil, s3err.ErrSignatureDoesNotMatch
 	}
+	s3_constants.RecordAccessKeyId(r.Context(), cred.AccessKey)
+	s3_constants.RecordStoredAccessKeyId(r.Context(), cred.AccessKey, cred.SecretKey)
 	return identity, s3err.ErrNone
 }
 
diff --git a/weed/s3api/auth_signature_v4.go b/weed/s3api/auth_signature_v4.go
index bd3d2b34e1..5f96669554 100644
--- a/weed/s3api/auth_signature_v4.go
+++ b/weed/s3api/auth_signature_v4.go
@@ -19,6 +19,7 @@ package s3api
 
 import (
 	"bytes"
+	"context"
 	"crypto/hmac"
 	"crypto/sha256"
 	"crypto/subtle"
@@ -38,6 +39,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	weed_iam "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
@@ -125,6 +127,27 @@ func normalizePayloadHash(payloadHashValue string) string {
 	return payloadHashValue
 }
 
+// requestSigningService extracts the service name from the SigV4 credential
+// scope (…/region/service/aws4_request) so a failed request can be answered in
+// that service's error envelope.
+func requestSigningService(r *http.Request) string {
+	credential := r.URL.Query().Get("X-Amz-Credential")
+	if credential == "" {
+		v4Auth := strings.Replace(r.Header.Get("Authorization"), " ", "", -1)
+		v4Auth = strings.TrimPrefix(v4Auth, signV4Algorithm)
+		for _, field := range strings.Split(v4Auth, ",") {
+			if cred, ok := strings.CutPrefix(field, "Credential="); ok {
+				credential = cred
+				break
+			}
+		}
+	}
+	if parts := strings.Split(credential, "/"); len(parts) == 5 {
+		return parts[3]
+	}
+	return ""
+}
+
 // signValues data type represents structured form of AWS Signature V4 header.
 type signValues struct {
 	Credential    credentialHeader
@@ -150,8 +173,20 @@ func parseSignV4(v4Auth string) (sv signValues, aec s3err.ErrorCode) {
 	// Strip off the Algorithm prefix.
 	v4Auth = strings.TrimPrefix(v4Auth, signV4Algorithm)
 	authFields := strings.Split(strings.TrimSpace(v4Auth), ",")
-	if len(authFields) != 3 {
-		return sv, s3err.ErrMissingFields
+	malformed := len(authFields) != 3
+	var hasCredential, hasSignature bool
+	for _, field := range authFields {
+		field = strings.TrimSpace(field)
+		malformed = malformed || field == ""
+		hasCredential = hasCredential || strings.HasPrefix(field, "Credential=")
+		hasSignature = hasSignature || strings.HasPrefix(field, "Signature=")
+	}
+	if malformed {
+		// AWS distinguishes which required field is absent.
+		if !hasCredential {
+			return sv, s3err.ErrInvalidArgument
+		}
+		return sv, s3err.ErrAuthorizationHeaderMalformed
 	}
 
 	// Initialize signature version '4' structured header.
@@ -231,38 +266,40 @@ func (iam *IdentityAccessManagement) verifyV4Signature(r *http.Request, shouldCh
 
 	var cred *Credential
 
-	// 2. Check for STS session token
-	sessionToken := r.Header.Get("X-Amz-Security-Token")
-	if sessionToken == "" {
-		sessionToken = r.URL.Query().Get("X-Amz-Security-Token")
-	}
-	if sessionToken != "" {
-		// Validate STS session token
-		identity, cred, errCode = iam.validateSTSSessionToken(r, sessionToken, authInfo.AccessKey)
-		if errCode != s3err.ErrNone {
-			return nil, nil, "", nil, errCode
-		}
-	} else {
-		// 3. Lookup user and credentials
-		var found bool
-		identity, cred, found = iam.lookupByAccessKey(authInfo.AccessKey)
-		if !found {
-			// Log detailed error information for InvalidAccessKeyId (avoid slice allocation for performance)
-			iam.m.RLock()
-			keyCount := len(iam.accessKeyIdent)
-			iam.m.RUnlock()
-
-			glog.Warningf("InvalidAccessKeyId: attempted key '%s' not found. Available keys: %d, Auth enabled: %v",
-				authInfo.AccessKey, keyCount, iam.isAuthEnabled)
-			return nil, nil, "", nil, s3err.ErrInvalidAccessKeyID
-		}
-
+	// 2. Resolve the credential. A configured access key wins over a session
+	// token: credential vendors like Unity Catalog emit a token with static
+	// credentials too, and it adds nothing the signature does not prove.
+	// STS-issued access keys are never registered in the static map, so they
+	// still land on session-token validation.
+	sessionToken := extractSessionToken(r)
+	var found bool
+	identity, cred, found = iam.lookupByAccessKey(authInfo.AccessKey)
+	switch {
+	case found:
 		// Check service account expiration
 		if cred.isCredentialExpired() {
 			glog.V(2).Infof("Service account credential %s has expired (expiration: %d, now: %d)",
 				authInfo.AccessKey, cred.Expiration, time.Now().Unix())
 			return nil, nil, "", nil, s3err.ErrAccessDenied
 		}
+		if sessionToken != "" {
+			*r = *r.WithContext(s3_constants.IgnoreSessionTokenInContext(r.Context()))
+		}
+	case sessionToken != "":
+		// Validate STS session token
+		identity, cred, errCode = iam.validateSTSSessionToken(r, sessionToken, authInfo.AccessKey)
+		if errCode != s3err.ErrNone {
+			return nil, nil, "", nil, errCode
+		}
+	default:
+		// Log detailed error information for InvalidAccessKeyId (avoid slice allocation for performance)
+		iam.m.RLock()
+		keyCount := len(iam.accessKeyIdent)
+		iam.m.RUnlock()
+
+		glog.Warningf("InvalidAccessKeyId: attempted key '%s' not found. Available keys: %d, Auth enabled: %v",
+			authInfo.AccessKey, keyCount, iam.isAuthEnabled)
+		return nil, nil, "", nil, s3err.ErrInvalidAccessKeyID
 	}
 
 	// 3. Perform permission check
@@ -318,11 +355,26 @@ func (iam *IdentityAccessManagement) verifyV4Signature(r *http.Request, shouldCh
 	// 8. Verify the signature for each plausible host value: when X-Forwarded-Host carries
 	// no port, the client may have signed the Host header the proxy kept or the forwarded
 	// host and port, and the headers alone cannot tell which.
-	pathForSignature := r.URL.EscapedPath()
+	// A router that rewrote the request path (e.g. the Iceberg catalog's
+	// doubled-/v1 collapse) records the client-sent path in the context;
+	// the signature covers that original path.
+	pathForSignature := s3_constants.GetOriginalRequestPathFromContext(r)
 	if pathForSignature == "" {
-		pathForSignature = r.URL.Path
+		pathForSignature = r.URL.EscapedPath()
+		if pathForSignature == "" {
+			pathForSignature = r.URL.Path
+		}
 	}
-	forwardedPrefix := r.Header.Get("X-Forwarded-Prefix")
+	// The signature is checked against prefix+path but the request is routed
+	// and authorized on path alone, so only a trusted proxy may set the prefix.
+	iam.m.RLock()
+	trustedPeer := iam.trustedProxies.IsTrustedPeer(r)
+	iam.m.RUnlock()
+	forwardedPrefix := ""
+	if trustedPeer {
+		forwardedPrefix = r.Header.Get("X-Forwarded-Prefix")
+	}
+	var matchedHost string
 	for i, hostCandidate := range extractHostHeaderCandidates(r, iam.externalHost) {
 		if i > 0 && !replaceSignedHostHeader(extractedSignedHeaders, hostCandidate) {
 			break
@@ -333,25 +385,46 @@ func (iam *IdentityAccessManagement) verifyV4Signature(r *http.Request, shouldCh
 			cleanedPath := buildPathWithForwardedPrefix(forwardedPrefix, pathForSignature)
 			calculatedSignature, errCode = verify(cleanedPath)
 			if errCode == s3err.ErrNone {
-				return identity, cred, calculatedSignature, authInfo, s3err.ErrNone
+				matchedHost = hostCandidate
+				break
 			}
 		}
 
 		// 10. Verify with the original path
 		calculatedSignature, errCode = verify(pathForSignature)
 		if errCode == s3err.ErrNone {
-			return identity, cred, calculatedSignature, authInfo, s3err.ErrNone
+			matchedHost = hostCandidate
+			break
 		}
 
 		// 11. Retry with decoded path if signature used raw path encoding
 		if decodedPath, decodeErr := url.PathUnescape(pathForSignature); decodeErr == nil && decodedPath != pathForSignature {
 			calculatedSignature, errCode = verify(decodedPath)
 			if errCode == s3err.ErrNone {
-				return identity, cred, calculatedSignature, authInfo, s3err.ErrNone
+				matchedHost = hostCandidate
+				break
 			}
 		}
 	}
 
+	if matchedHost != "" {
+		// The key of the credential that verified: the audit log and the
+		// catalog's vended sessions name it (never a key re-read from the request).
+		// Recorded before the retarget check so that refusal names it too.
+		s3_constants.RecordAccessKeyId(r.Context(), cred.AccessKey)
+		if found {
+			s3_constants.RecordStoredAccessKeyId(r.Context(), cred.AccessKey, cred.SecretKey)
+		}
+		if signedBucket, ok := bucketFromVirtualHost(matchedHost, iam.domain); ok {
+			if routedBucket, _ := s3_constants.GetBucketAndObject(r); routedBucket != "" && routedBucket != signedBucket {
+				glog.V(2).Infof("reject %s %s: signed host %q implies bucket %q but routed to %q",
+					r.Method, r.URL.Path, matchedHost, signedBucket, routedBucket)
+				return nil, nil, "", nil, s3err.ErrAccessDenied
+			}
+		}
+		return identity, cred, calculatedSignature, authInfo, s3err.ErrNone
+	}
+
 	return nil, nil, "", nil, errCode
 }
 
@@ -426,6 +499,19 @@ func (iam *IdentityAccessManagement) validateSTSSessionToken(r *http.Request, se
 		return nil, nil, s3err.ErrExpiredToken
 	}
 
+	// A session the table catalog vended for a static access key is bound to
+	// that key, as a role session is bound to its role's ID: deleting or
+	// deactivating the key, or deleting or disabling its identity, ends the
+	// session at its next request instead of at its expiry. Sessions minted
+	// before the binding existed carry only the audit field and stay unbound.
+	if sessionInfo.IdentityProvider == icebergVendedCredentialsProvider && sessionInfo.BoundAccessKeyId != "" {
+		if errCode := iam.vendedSessionKeyLive(sessionInfo.ExternalUserId, sessionInfo.BoundAccessKeyId, sessionInfo.BoundAccessKeyFingerprint); errCode != s3err.ErrNone {
+			glog.V(2).Infof("vended STS session %s: identity %q or the access key it was vended for is gone, disabled or inactive",
+				sessionInfo.SessionId, sessionInfo.ExternalUserId)
+			return nil, nil, errCode
+		}
+	}
+
 	// Validate required credential fields
 	if sessionInfo.Credentials.SecretAccessKey == "" {
 		glog.Warningf("STS service returned empty SecretAccessKey in credentials")
@@ -470,12 +556,52 @@ func (iam *IdentityAccessManagement) validateSTSSessionToken(r *http.Request, se
 		PolicyNames:  sessionInfo.Policies, // Populate PolicyNames for IAM authorization
 		Claims:       claims,               // Populate Claims for policy variable substitution
 	}
+	// ParentUser is set only for OIDC-federated sessions (see
+	// AssumeRoleWithWebIdentity), so it gates the audit identity claim: without
+	// it the request context's sub is the opaque session subject injected by
+	// ValidateJWTWithClaims, not the OIDC subject, and must not be surfaced as
+	// an authoritative identity.
+	if sessionInfo.ParentUser != "" {
+		identity.IdentityClaim = sts.ResolveIdentityClaim(sessionInfo.RequestContext)
+	}
 
 	glog.V(2).Infof("Successfully validated STS session token for principal: %s, assumed role user: %s",
 		sessionInfo.Principal, sessionInfo.AssumedRoleUser)
 	return identity, cred, s3err.ErrNone
 }
 
+// vendedSessionKeyLive answers ErrNone while owner is a known, enabled
+// identity holding accessKey as an active, unexpired credential, and
+// ErrInvalidAccessKeyID (as for an unknown key) otherwise. A fingerprint set
+// at mint time must still match, so a key re-created under the same id does
+// not revive sessions the deleted original had carried. One map lookup under
+// the read lock.
+func (iam *IdentityAccessManagement) vendedSessionKeyLive(owner, accessKey, fingerprint string) s3err.ErrorCode {
+	if owner == "" || accessKey == "" {
+		return s3err.ErrInvalidAccessKeyID
+	}
+	fingerprintKey := iam.stsSigningKey()
+	iam.m.RLock()
+	defer iam.m.RUnlock()
+	identity, ok := iam.nameToIdentity[owner]
+	if !ok || identity == nil || identity.Disabled {
+		return s3err.ErrInvalidAccessKeyID
+	}
+	for _, credential := range identity.Credentials {
+		if credential == nil || credential.AccessKey != accessKey {
+			continue
+		}
+		if credential.Status == iamAccessKeyStatusInactive || credential.isCredentialExpired() {
+			return s3err.ErrInvalidAccessKeyID
+		}
+		if fingerprint != "" && s3_constants.StoredCredentialFingerprint(fingerprintKey, accessKey, credential.SecretKey) != fingerprint {
+			return s3err.ErrInvalidAccessKeyID
+		}
+		return s3err.ErrNone
+	}
+	return s3err.ErrInvalidAccessKeyID
+}
+
 // calculateAndVerifySignature contains the core logic for creating the canonical request,
 // string-to-sign, and comparing the final signature.
 func calculateAndVerifySignature(secretKey, method, urlPath, queryStr string, extractedSignedHeaders http.Header, authInfo *v4AuthInfo) (string, s3err.ErrorCode) {
@@ -720,13 +846,13 @@ func parseCredentialHeader(credElement string) (ch credentialHeader, aec s3err.E
 func parseSignature(signElement string) (string, s3err.ErrorCode) {
 	signFields := strings.Split(strings.TrimSpace(signElement), "=")
 	if len(signFields) != 2 {
-		return "", s3err.ErrMissingFields
+		return "", s3err.ErrAuthorizationHeaderMalformed
 	}
 	if signFields[0] != "Signature" {
 		return "", s3err.ErrMissingSignTag
 	}
 	if signFields[1] == "" {
-		return "", s3err.ErrMissingFields
+		return "", s3err.ErrAuthorizationHeaderMalformed
 	}
 	signature := signFields[1]
 	return signature, s3err.ErrNone
@@ -757,12 +883,12 @@ func parseSignedHeaderList(signedHeadersValue string) ([]string, s3err.ErrorCode
 	return signedHeaders, s3err.ErrNone
 }
 
-func (iam *IdentityAccessManagement) doesPolicySignatureV4Match(formValues http.Header) s3err.ErrorCode {
+func (iam *IdentityAccessManagement) doesPolicySignatureV4Match(ctx context.Context, formValues http.Header) (*Identity, s3err.ErrorCode) {
 
 	// Parse credential tag.
 	credHeader, err := parseCredentialHeader("Credential=" + formValues.Get("X-Amz-Credential"))
 	if err != s3err.ErrNone {
-		return err
+		return nil, err
 	}
 
 	identity, cred, found := iam.lookupByAccessKey(credHeader.accessKey)
@@ -775,19 +901,14 @@ func (iam *IdentityAccessManagement) doesPolicySignatureV4Match(formValues http.
 		glog.Warningf("InvalidAccessKeyId (POST policy): attempted key '%s' not found. Available keys: %d, Auth enabled: %v",
 			credHeader.accessKey, availableKeyCount, iam.isAuthEnabled)
 
-		return s3err.ErrInvalidAccessKeyID
+		return nil, s3err.ErrInvalidAccessKeyID
 	}
 
 	// Check service account expiration
 	if cred.isCredentialExpired() {
 		glog.V(2).Infof("Service account credential %s has expired (expiration: %d, now: %d)",
 			credHeader.accessKey, cred.Expiration, time.Now().Unix())
-		return s3err.ErrAccessDenied
-	}
-
-	bucket := formValues.Get("bucket")
-	if !identity.CanDo(s3_constants.ACTION_WRITE, bucket, "") {
-		return s3err.ErrAccessDenied
+		return nil, s3err.ErrAccessDenied
 	}
 
 	// Get signing key.
@@ -798,9 +919,11 @@ func (iam *IdentityAccessManagement) doesPolicySignatureV4Match(formValues http.
 
 	// Verify signature.
 	if !compareSignatureV4(newSignature, formValues.Get("X-Amz-Signature")) {
-		return s3err.ErrSignatureDoesNotMatch
+		return nil, s3err.ErrSignatureDoesNotMatch
 	}
-	return s3err.ErrNone
+	s3_constants.RecordAccessKeyId(ctx, cred.AccessKey)
+	s3_constants.RecordStoredAccessKeyId(ctx, cred.AccessKey, cred.SecretKey)
+	return identity, s3err.ErrNone
 }
 
 // sigV4PayloadHashHeader is x-amz-content-sha256. It participates in the
@@ -824,6 +947,16 @@ var presignedSigV4ProtocolHeaders = map[string]struct{}{
 	"x-amz-signature":     {},
 }
 
+// presignedUnsignedSSECHeaders exempts SSE-C key material that AWS requires to
+// be sent but not signed on presigned requests: only the algorithm header is
+// part of the signature calculation.
+var presignedUnsignedSSECHeaders = map[string]struct{}{
+	strings.ToLower(s3_constants.AmzServerSideEncryptionCustomerKey):              {},
+	strings.ToLower(s3_constants.AmzServerSideEncryptionCustomerKeyMD5):           {},
+	strings.ToLower(s3_constants.AmzCopySourceServerSideEncryptionCustomerKey):    {},
+	strings.ToLower(s3_constants.AmzCopySourceServerSideEncryptionCustomerKeyMD5): {},
+}
+
 // verifySignedHeadersCoverage rejects requests that carry x-amz-* headers
 // outside of the SignedHeaders list. AWS SigV4 requires every x-amz-* header
 // present in the request to be covered by the signature; without this check a
@@ -850,6 +983,9 @@ func verifySignedHeadersCoverage(r *http.Request, signedHeaders []string, isPres
 			if _, exempt := presignedSigV4ProtocolHeaders[lower]; exempt {
 				continue
 			}
+			if _, exempt := presignedUnsignedSSECHeaders[lower]; exempt {
+				continue
+			}
 		}
 		glog.V(2).Infof("reject %s %s: unsigned header %q not in SignedHeaders", r.Method, r.URL.Path, name)
 		return s3err.ErrSignatureDoesNotMatch
@@ -873,6 +1009,12 @@ func extractSignedHeaders(signedHeaders []string, r *http.Request, externalHost
 			extractedSignedHeaders[header] = []string{hostHeaderValue}
 			continue
 		}
+		// The Go server strips Content-Length into r.ContentLength; clients do
+		// sign it, so rebuild the value the same way the client saw it.
+		if strings.EqualFold(header, "content-length") && r.ContentLength >= 0 {
+			extractedSignedHeaders[header] = []string{strconv.FormatInt(r.ContentLength, 10)}
+			continue
+		}
 		// For all other headers we need to find them in the HTTP headers and copy them over.
 		// We skip non-existent headers to be compatible with AWS signatures.
 		if values, ok := reqHeaders[http.CanonicalHeaderKey(header)]; ok {
@@ -888,14 +1030,16 @@ func extractHostHeader(r *http.Request, externalHost string) string {
 }
 
 // extractHostHeaderCandidates returns the host values the client may have signed, most
-// likely first. When externalHost is set (from s3.externalUrl), it is the only candidate.
-// Otherwise, the host is reconstructed from X-Forwarded-* headers or the request Host.
+// likely first. externalHost (from s3.externalUrl) leads when set, but the hosts derived
+// from X-Forwarded-* headers or the request Host still follow it, so clients that reach
+// the gateway directly rather than through the proxy keep verifying.
 // When X-Forwarded-Host carries no port, the true client port is ambiguous: a proxy that
 // kept the Host header makes the r.Host port right, one that rewrote it makes
 // X-Forwarded-Port right, and a client on the scheme's default port signed no port at all.
 func extractHostHeaderCandidates(r *http.Request, externalHost string) []string {
+	var candidates []string
 	if externalHost != "" {
-		return []string{externalHost}
+		candidates = append(candidates, externalHost)
 	}
 
 	forwardedHost := r.Header.Get("X-Forwarded-Host")
@@ -968,7 +1112,6 @@ func extractHostHeaderCandidates(r *http.Request, externalHost string) []string
 		}
 	}
 
-	var candidates []string
 	for _, port := range ports {
 		candidate := joinSignedHost(host, port, scheme)
 		if !slices.Contains(candidates, candidate) {
@@ -978,6 +1121,33 @@ func extractHostHeaderCandidates(r *http.Request, externalHost string) []string
 	return candidates
 }
 
+func bucketFromVirtualHost(host, domainConfig string) (string, bool) {
+	if domainConfig == "" {
+		return "", false
+	}
+	h := host
+	if hh, _, err := net.SplitHostPort(host); err == nil {
+		h = hh
+	}
+	h = strings.ToLower(h)
+	pathStyleDomains, virtualHostDomains := classifyDomainNames(strings.Split(domainConfig, ","))
+	for _, domain := range pathStyleDomains {
+		if h == strings.ToLower(strings.TrimSpace(domain)) {
+			return "", false
+		}
+	}
+	for _, domain := range virtualHostDomains {
+		suffix := "." + strings.ToLower(strings.TrimSpace(domain))
+		if strings.HasSuffix(h, suffix) {
+			bucket := h[:len(h)-len(suffix)]
+			if bucket != "" {
+				return bucket, true
+			}
+		}
+	}
+	return "", false
+}
+
 // joinSignedHost renders host:port the way AWS SDKs sign it: default ports are stripped
 // to match SanitizeHostForHeader, and bare IPv6 addresses lose their brackets.
 // Reference: https://github.com/aws/aws-sdk-go-v2/blob/main/aws/signer/internal/v4/host.go
diff --git a/weed/s3api/auth_signature_v4_test.go b/weed/s3api/auth_signature_v4_test.go
index 4be2f97aae..a426357b02 100644
--- a/weed/s3api/auth_signature_v4_test.go
+++ b/weed/s3api/auth_signature_v4_test.go
@@ -7,9 +7,12 @@ import (
 	"fmt"
 	"net/http"
 	"slices"
+	"sync"
 	"testing"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 )
 
@@ -535,9 +538,23 @@ func TestExtractHostHeaderCandidates(t *testing.T) {
 		expected       []string
 	}{
 		{
-			name:         "externalHost is the only candidate",
+			name:         "externalHost leads, request host still follows",
 			hostHeader:   "backend:8333",
 			externalHost: "api.example.com:9000",
+			expected:     []string{"api.example.com:9000", "backend:8333"},
+		},
+		{
+			name:          "externalHost leads the forwarded candidates",
+			hostHeader:    "backend:8333",
+			forwardedHost: "example.com",
+			forwardedPort: "9000",
+			externalHost:  "api.example.com",
+			expected:      []string{"api.example.com", "example.com:9000", "example.com"},
+		},
+		{
+			name:         "externalHost equal to the request host is not repeated",
+			hostHeader:   "api.example.com:9000",
+			externalHost: "api.example.com:9000",
 			expected:     []string{"api.example.com:9000"},
 		},
 		{
@@ -663,3 +680,58 @@ func TestExtractSignedHeadersCase(t *testing.T) {
 		})
 	}
 }
+
+// A client may sign content-length even when the request carries no body
+// (aws-cli's checksum HEAD does). The Go server strips the header into
+// r.ContentLength, so extraction rebuilds it rather than dropping it.
+func TestExtractSignedHeadersContentLength(t *testing.T) {
+	r, _ := http.NewRequest("HEAD", "http://bucket.domain.com/bucket/key", nil)
+	r.Host = "bucket.domain.com"
+	r.ContentLength = 0
+	extracted, errCode := extractSignedHeaders([]string{"host", "content-length"}, r, "")
+	if errCode != s3err.ErrNone {
+		t.Fatalf("extractSignedHeaders failed: %v", errCode)
+	}
+	if got := getCanonicalHeaders(extracted); got != "content-length:0\nhost:bucket.domain.com\n" {
+		t.Fatalf("unexpected canonical headers %q", got)
+	}
+}
+
+// A router that internally rewrites the request path (the Iceberg catalog
+// collapses a doubled /v1 prefix) must still verify the signature against
+// the path the client signed, which is kept in the request context.
+func TestVerifyV4SignatureUsesOriginalRequestPath(t *testing.T) {
+	iam := &IdentityAccessManagement{
+		hashes:       make(map[string]*sync.Pool),
+		hashCounters: make(map[string]*int32),
+	}
+	_ = iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{
+				Name: "someone",
+				Credentials: []*iam_pb.Credential{
+					{
+						AccessKey: "access_key_1",
+						SecretKey: "secret_key_1",
+					},
+				},
+				Actions: []string{"Admin", "Read", "Write"},
+			},
+		},
+	})
+
+	req := mustNewSignedRequest(http.MethodGet, "http://127.0.0.1:9000/v1/v1/bucket/namespaces", 0, nil, t)
+
+	// Simulate the rewrite: the routed path is collapsed while the signature
+	// still covers the doubled path the client sent.
+	rewritten := req.Clone(req.Context())
+	rewritten.URL.Path = "/v1/bucket/namespaces"
+	if _, errCode := iam.reqSignatureV4Verify(rewritten); errCode == s3err.ErrNone {
+		t.Fatal("rewritten request verified without the original path; expected a signature mismatch")
+	}
+
+	rewritten = rewritten.WithContext(s3_constants.SetOriginalRequestPathInContext(rewritten.Context(), "/v1/v1/bucket/namespaces"))
+	if _, errCode := iam.reqSignatureV4Verify(rewritten); errCode != s3err.ErrNone {
+		t.Fatalf("signed request rejected after path rewrite: %d", errCode)
+	}
+}
diff --git a/weed/s3api/auth_signature_v4_unsigned_headers_test.go b/weed/s3api/auth_signature_v4_unsigned_headers_test.go
index a0397fad3b..49bbe65643 100644
--- a/weed/s3api/auth_signature_v4_unsigned_headers_test.go
+++ b/weed/s3api/auth_signature_v4_unsigned_headers_test.go
@@ -142,6 +142,50 @@ func TestVerifySignedHeadersCoverage_Unit(t *testing.T) {
 			signedHeaders: []string{"HOST", "X-Amz-Tagging"},
 			want:          s3err.ErrNone,
 		},
+		{
+			name: "presigned exempts unsigned SSE-C key headers",
+			headers: map[string]string{
+				"X-Amz-Server-Side-Encryption-Customer-Algorithm": "AES256",
+				"X-Amz-Server-Side-Encryption-Customer-Key":       "key",
+				"X-Amz-Server-Side-Encryption-Customer-Key-MD5":   "md5",
+			},
+			signedHeaders: []string{"host", "x-amz-server-side-encryption-customer-algorithm"},
+			isPresigned:   true,
+			want:          s3err.ErrNone,
+		},
+		{
+			name: "presigned exempts unsigned SSE-C copy-source key headers",
+			headers: map[string]string{
+				"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Algorithm": "AES256",
+				"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key":       "key",
+				"X-Amz-Copy-Source-Server-Side-Encryption-Customer-Key-MD5":   "md5",
+			},
+			signedHeaders: []string{"host", "x-amz-copy-source-server-side-encryption-customer-algorithm"},
+			isPresigned:   true,
+			want:          s3err.ErrNone,
+		},
+		{
+			name: "presigned still requires SSE-C algorithm to be signed",
+			headers: map[string]string{
+				"X-Amz-Server-Side-Encryption-Customer-Algorithm": "AES256",
+				"X-Amz-Server-Side-Encryption-Customer-Key":       "key",
+				"X-Amz-Server-Side-Encryption-Customer-Key-MD5":   "md5",
+			},
+			signedHeaders: []string{"host"},
+			isPresigned:   true,
+			want:          s3err.ErrSignatureDoesNotMatch,
+		},
+		{
+			name: "header-based does NOT exempt unsigned SSE-C key headers",
+			headers: map[string]string{
+				"X-Amz-Server-Side-Encryption-Customer-Algorithm": "AES256",
+				"X-Amz-Server-Side-Encryption-Customer-Key":       "key",
+				"X-Amz-Server-Side-Encryption-Customer-Key-MD5":   "md5",
+			},
+			signedHeaders: []string{"host", "x-amz-server-side-encryption-customer-algorithm"},
+			isPresigned:   false,
+			want:          s3err.ErrSignatureDoesNotMatch,
+		},
 	}
 
 	for _, tt := range tests {
@@ -203,6 +247,29 @@ func TestPresignedPutAcceptsSignedTagging(t *testing.T) {
 	}
 }
 
+// TestPresignedGetAcceptsUnsignedSSECKeyHeaders mirrors the AWS SDK presign
+// flow for SSE-C objects: only the algorithm header is signed while the key
+// and key-MD5 headers are attached to the request unsigned.
+func TestPresignedGetAcceptsUnsignedSSECKeyHeaders(t *testing.T) {
+	iam := newTestIAM()
+
+	req, err := newTestRequest(http.MethodGet, "http://127.0.0.1:9000/bucket/key", 0, nil)
+	if err != nil {
+		t.Fatalf("newTestRequest: %v", err)
+	}
+	req.Header.Set("X-Amz-Server-Side-Encryption-Customer-Algorithm", "AES256")
+	if err := preSignV4WithHeaders(iam, req, "AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", 600, []string{"host", "x-amz-server-side-encryption-customer-algorithm"}); err != nil {
+		t.Fatalf("preSignV4WithHeaders: %v", err)
+	}
+	req.Header.Set("X-Amz-Server-Side-Encryption-Customer-Key", "MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=")
+	req.Header.Set("X-Amz-Server-Side-Encryption-Customer-Key-MD5", "md5")
+
+	_, errCode := iam.reqSignatureV4Verify(req)
+	if errCode != s3err.ErrNone {
+		t.Fatalf("expected ErrNone for presigned SSE-C with unsigned key headers, got %v", errCode)
+	}
+}
+
 // preSignV4WithHeaders is a test helper that builds a presigned URL whose
 // SignedHeaders list covers the specified headers (which must already be set
 // on the request), then computes the signature over those headers and
@@ -293,3 +360,29 @@ func TestPresignedPutRejectsUnsignedMetadataHeaders(t *testing.T) {
 		})
 	}
 }
+
+// TestParseSignV4MissingFields exercises how a truncated Authorization header
+// maps to the AWS error code for the absent field.
+func TestParseSignV4MissingFields(t *testing.T) {
+	valid := "AWS4-HMAC-SHA256 Credential=AKIA/20260101/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=0123456789abcdef"
+
+	tests := []struct {
+		name string
+		auth string
+		want s3err.ErrorCode
+	}{
+		{"valid", valid, s3err.ErrNone},
+		{"no signature field", "AWS4-HMAC-SHA256 Credential=AKIA/20260101/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date", s3err.ErrAuthorizationHeaderMalformed},
+		{"empty signature field", "AWS4-HMAC-SHA256 Credential=AKIA/20260101/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, ", s3err.ErrAuthorizationHeaderMalformed},
+		{"no credential field", "AWS4-HMAC-SHA256 SignedHeaders=host;x-amz-date, Signature=0123456789abcdef", s3err.ErrInvalidArgument},
+		{"leading comma after dropping credential", "AWS4-HMAC-SHA256 , SignedHeaders=host;x-amz-date, Signature=0123456789abcdef", s3err.ErrInvalidArgument},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, got := parseSignV4(tt.auth)
+			if got != tt.want {
+				t.Fatalf("parseSignV4() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/auth_static_session_token_test.go b/weed/s3api/auth_static_session_token_test.go
new file mode 100644
index 0000000000..44d1f08afa
--- /dev/null
+++ b/weed/s3api/auth_static_session_token_test.go
@@ -0,0 +1,121 @@
+package s3api
+
+import (
+	"net/http"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// Credential vendors like Unity Catalog emit a session token even for static
+// credentials. A request signed by a configured access key must authenticate
+// as that identity, tolerating the foreign token.
+func TestStaticCredentialWithSessionToken(t *testing.T) {
+	const token = "vended-static-session-token"
+
+	newSigned := func(t *testing.T) *http.Request {
+		req := mustNewRequest(http.MethodGet, "http://127.0.0.1:9000/bucket/object", 0, nil, t)
+		req.Header.Set("X-Amz-Security-Token", token)
+		require.NoError(t, signRequestV4(req, "access_key_1", "secret_key_1"))
+		return mux.SetURLVars(req, map[string]string{"bucket": "bucket", "object": "object"})
+	}
+
+	t.Run("authenticates as the static identity", func(t *testing.T) {
+		iam := newTestIAMWithCreds()
+		r := newSigned(t)
+
+		identity, errCode := iam.reqSignatureV4Verify(r)
+		require.Equal(t, s3err.ErrNone, errCode)
+		assert.Equal(t, "someone", identity.Name)
+		assert.True(t, s3_constants.IsSessionTokenIgnored(r.Context()))
+		assert.False(t, hasSessionToken(r), "tolerated token must be inert for authorization")
+	})
+
+	t.Run("authorized through the static action path", func(t *testing.T) {
+		iam := newTestIAMWithCreds()
+		r := newSigned(t)
+
+		_, errCode := iam.authRequest(r, s3_constants.ACTION_READ)
+		assert.Equal(t, s3err.ErrNone, errCode)
+	})
+
+	t.Run("repeat verification stays idempotent", func(t *testing.T) {
+		iam := newTestIAMWithCreds()
+		r := newSigned(t)
+
+		_, errCode := iam.reqSignatureV4Verify(r)
+		require.Equal(t, s3err.ErrNone, errCode)
+		// Handlers re-authenticate the same request (e.g. PutObjectAcl).
+		_, errCode = iam.reqSignatureV4Verify(r)
+		assert.Equal(t, s3err.ErrNone, errCode)
+	})
+
+	t.Run("unsigned token is still rejected", func(t *testing.T) {
+		iam := newTestIAMWithCreds()
+		r := mustNewSignedRequest(http.MethodGet, "http://127.0.0.1:9000/bucket/object", 0, nil, t)
+		r.Header.Set("X-Amz-Security-Token", token)
+
+		_, errCode := iam.reqSignatureV4Verify(r)
+		assert.Equal(t, s3err.ErrSignatureDoesNotMatch, errCode)
+	})
+
+	t.Run("unknown access key with token still rejected", func(t *testing.T) {
+		iam := newTestIAMWithCreds()
+		req := mustNewRequest(http.MethodGet, "http://127.0.0.1:9000/bucket/object", 0, nil, t)
+		req.Header.Set("X-Amz-Security-Token", token)
+		require.NoError(t, signRequestV4(req, "no_such_key", "secret_key_1"))
+
+		_, errCode := iam.reqSignatureV4Verify(req)
+		assert.Equal(t, s3err.ErrInvalidAccessKeyID, errCode)
+	})
+
+	t.Run("wrong secret with token still rejected", func(t *testing.T) {
+		iam := newTestIAMWithCreds()
+		req := mustNewRequest(http.MethodGet, "http://127.0.0.1:9000/bucket/object", 0, nil, t)
+		req.Header.Set("X-Amz-Security-Token", token)
+		require.NoError(t, signRequestV4(req, "access_key_1", "wrong_secret"))
+
+		_, errCode := iam.reqSignatureV4Verify(req)
+		assert.Equal(t, s3err.ErrSignatureDoesNotMatch, errCode)
+	})
+
+	t.Run("presigned URL with token works", func(t *testing.T) {
+		iam := newTestIAMWithCreds()
+		req := mustNewRequest(http.MethodGet, "http://127.0.0.1:9000/bucket/object", 0, nil, t)
+		q := req.URL.Query()
+		q.Set("X-Amz-Security-Token", token)
+		req.URL.RawQuery = q.Encode()
+		require.NoError(t, preSignV4(iam, req, "access_key_1", "secret_key_1", int64((10*time.Minute).Seconds())))
+
+		_, _, errCode := iam.doesPresignedSignatureMatch(req)
+		require.Equal(t, s3err.ErrNone, errCode)
+		assert.True(t, s3_constants.IsSessionTokenIgnored(req.Context()))
+	})
+}
+
+func newTestIAMWithCreds() *IdentityAccessManagement {
+	iam := &IdentityAccessManagement{
+		hashes:       make(map[string]*sync.Pool),
+		hashCounters: make(map[string]*int32),
+	}
+	_ = iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{
+				Name: "someone",
+				Credentials: []*iam_pb.Credential{
+					{AccessKey: "access_key_1", SecretKey: "secret_key_1"},
+				},
+				Actions: []string{"Admin", "Read", "Write"},
+			},
+		},
+	})
+	return iam
+}
diff --git a/weed/s3api/auth_sts_session_token_test.go b/weed/s3api/auth_sts_session_token_test.go
new file mode 100644
index 0000000000..7fe322f9c2
--- /dev/null
+++ b/weed/s3api/auth_sts_session_token_test.go
@@ -0,0 +1,121 @@
+package s3api
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// sessionIdFromToken reads the session id out of a session token (or a
+// presigned URL's X-Amz-Security-Token) without any key.
+func sessionIdFromToken(t *testing.T, token string) string {
+	t.Helper()
+	parts := strings.Split(token, ".")
+	require.Len(t, parts, 3)
+	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
+	require.NoError(t, err)
+	var claims map[string]interface{}
+	require.NoError(t, json.Unmarshal(payload, &claims))
+	sid, ok := claims["sid"].(string)
+	require.True(t, ok, "session token should carry a sid claim")
+	return sid
+}
+
+// issueTestSession mints an STS session the way AssumeRoleWithWebIdentity does.
+func issueTestSession(t *testing.T, stsService *sts.STSService, config *sts.STSConfig) (*sts.SessionInfo, string) {
+	t.Helper()
+	sessionId, err := sts.GenerateSessionId()
+	require.NoError(t, err)
+	claims := sts.NewSTSSessionClaims(sessionId, config.Issuer, time.Now().Add(time.Hour)).
+		WithSessionName("alice-session").
+		WithRoleInfo("arn:aws:iam::role/AppRole",
+			"arn:aws:sts::assumed-role/AppRole/alice-session",
+			"arn:aws:sts::assumed-role/AppRole/alice-session")
+	token, err := sts.NewTokenGenerator(config.SigningKey, config.Issuer).GenerateJWTWithClaims(claims)
+	require.NoError(t, err)
+	sessionInfo, err := stsService.ValidateSessionToken(context.Background(), token)
+	require.NoError(t, err)
+	return sessionInfo, token
+}
+
+// testIdentityFromSessionToken builds the identity for a validated STS session
+// token. Session tokens are not bearer credentials; tests use this to reach
+// the authorization layer the way a verified SigV4 request would.
+func testIdentityFromSessionToken(t *testing.T, s3iam *S3IAMIntegration, sessionToken string) *IAMIdentity {
+	t.Helper()
+	sessionInfo, err := s3iam.stsService.ValidateSessionToken(context.Background(), sessionToken)
+	require.NoError(t, err)
+	claims := make(map[string]interface{}, len(sessionInfo.RequestContext)+4)
+	for k, v := range sessionInfo.RequestContext {
+		claims[k] = v
+	}
+	claims["sub"] = sessionInfo.Subject
+	claims["role"] = sessionInfo.RoleArn
+	claims["principal"] = sessionInfo.Principal
+	claims["snam"] = sessionInfo.SessionName
+	return &IAMIdentity{
+		Name:         sessionInfo.Subject,
+		Principal:    sessionInfo.Principal,
+		SessionToken: sessionToken,
+		Account: &Account{
+			DisplayName:  sessionInfo.SessionName,
+			EmailAddress: sessionInfo.Subject + "@seaweedfs.local",
+			Id:           sessionInfo.Subject,
+		},
+		Claims: claims,
+	}
+}
+
+// A presigned URL discloses the session token in X-Amz-Security-Token. Whoever
+// holds it must not be able to reconstruct the temporary credential or turn it
+// into a standalone credential.
+func TestSTSSessionTokenDoesNotRevealCredential(t *testing.T) {
+	stsService, config := setupTestSTSService(t)
+	iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{}, nil, "memory")
+	s3iam := &S3IAMIntegration{stsService: stsService, enabled: true}
+	iam.SetIAMIntegration(s3iam)
+
+	sessionInfo, sessionToken := issueTestSession(t, stsService, config)
+
+	// control: the issued credential verifies
+	req, err := newTestRequest(http.MethodGet, "https://example.com/reports/data.csv", 0, nil)
+	require.NoError(t, err)
+	req.Header.Set("X-Amz-Security-Token", sessionToken)
+	require.NoError(t, signRequestV4(req, sessionInfo.Credentials.AccessKeyId, sessionInfo.Credentials.SecretAccessKey))
+	_, errCode := iam.reqSignatureV4Verify(req)
+	require.Equal(t, s3err.ErrNone, errCode)
+
+	// attack: recompute the credential from the token's public claims
+	sid := sessionIdFromToken(t, sessionToken)
+	akHash := sha256.Sum256([]byte("access-key:" + sid))
+	accessKey := "ASIA" + hex.EncodeToString(akHash[:8])
+	skHash := sha256.Sum256([]byte("secret-key:" + sid))
+	secretKey := base64.StdEncoding.EncodeToString(skHash[:])
+
+	forged, err := newTestRequest(http.MethodDelete, "https://example.com/reports/payroll.csv", 0, nil)
+	require.NoError(t, err)
+	forged.Header.Set("X-Amz-Security-Token", sessionToken)
+	require.NoError(t, signRequestV4(forged, accessKey, secretKey))
+	_, errCode = iam.reqSignatureV4Verify(forged)
+	require.NotEqual(t, s3err.ErrNone, errCode,
+		"a request signed with a credential derived from the session token must not verify")
+
+	// attack: replay the token itself as a bearer credential
+	bearerReq := httptest.NewRequest(http.MethodDelete, "/reports/payroll.csv", http.NoBody)
+	bearerReq.Header.Set("Authorization", "Bearer "+sessionToken)
+	_, errCode = s3iam.AuthenticateJWT(context.Background(), bearerReq)
+	require.NotEqual(t, s3err.ErrNone, errCode,
+		"an STS session token must not authenticate as a bearer token")
+}
diff --git a/weed/s3api/auth_sts_v4_test.go b/weed/s3api/auth_sts_v4_test.go
index e384038880..5fd7ac2b6e 100644
--- a/weed/s3api/auth_sts_v4_test.go
+++ b/weed/s3api/auth_sts_v4_test.go
@@ -98,7 +98,7 @@ func TestAuthorizeWithIAMSessionTokenExtraction(t *testing.T) {
 // preserved when converting to credentials for authorization.
 func TestSTSSessionTokenIntoCredentials(t *testing.T) {
 	// Create a credential generator and session claims
-	credGen := sts.NewCredentialGenerator()
+	credGen := sts.NewCredentialGenerator([]byte("test-signing-key"))
 	sessionId := "test-session-123"
 	expiresAt := time.Now().Add(time.Hour)
 
diff --git a/weed/s3api/auto_signature_v4_test.go b/weed/s3api/auto_signature_v4_test.go
index 8d8ba104f7..e7747515d6 100644
--- a/weed/s3api/auto_signature_v4_test.go
+++ b/weed/s3api/auto_signature_v4_test.go
@@ -18,6 +18,7 @@ import (
 
 	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
@@ -302,6 +303,14 @@ func newTestIAM() *IdentityAccessManagement {
 	return iam
 }
 
+// newTestIAMWithTrustedProxy returns a test IAM that trusts the proxy peer
+// (10.0.0.1) used by the forwarded-header tests.
+func newTestIAMWithTrustedProxy() *IdentityAccessManagement {
+	iam := newTestIAM()
+	iam.SetTrustedProxies(policy_engine.NewTrustedProxies([]string{"10.0.0.1"}))
+	return iam
+}
+
 // Test X-Forwarded-Prefix support for reverse proxy scenarios
 func TestSignatureV4WithForwardedPrefix(t *testing.T) {
 	tests := []struct {
@@ -323,7 +332,7 @@ func TestSignatureV4WithForwardedPrefix(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			iam := newTestIAM()
+			iam := newTestIAMWithTrustedProxy()
 
 			// Create a request with X-Forwarded-Prefix header
 			r, err := newTestRequest("GET", "https://example.com/test-bucket/test-object", 0, nil)
@@ -340,6 +349,7 @@ func TestSignatureV4WithForwardedPrefix(t *testing.T) {
 			r.Header.Set("X-Forwarded-Prefix", tt.forwardedPrefix)
 			r.Header.Set("Host", "example.com")
 			r.Header.Set("X-Forwarded-Host", "example.com")
+			r.RemoteAddr = "10.0.0.1:1234"
 
 			// Sign the request with the expected normalized path
 			signV4WithPath(r, "AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", tt.expectedPath)
@@ -391,7 +401,7 @@ func TestSignatureV4WithForwardedPrefixTrailingSlash(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			iam := newTestIAM()
+			iam := newTestIAMWithTrustedProxy()
 
 			// Create a request with the URL path that has a trailing slash
 			r, err := newTestRequest("GET", "https://example.com"+tt.urlPath, 0, nil)
@@ -405,6 +415,7 @@ func TestSignatureV4WithForwardedPrefixTrailingSlash(t *testing.T) {
 			r.Header.Set("X-Forwarded-Prefix", tt.forwardedPrefix)
 			r.Header.Set("Host", "example.com")
 			r.Header.Set("X-Forwarded-Host", "example.com")
+			r.RemoteAddr = "10.0.0.1:1234"
 
 			// Sign the request with the full path including the trailing slash
 			// This simulates what S3 SDK does for listObjects operations
@@ -423,6 +434,7 @@ func TestSignatureV4WithoutProxy(t *testing.T) {
 	tests := []struct {
 		name         string
 		host         string
+		urlHost      string // request-URL form of host, when host is not valid in a URL
 		proto        string
 		expectedHost string
 	}{
@@ -489,12 +501,14 @@ func TestSignatureV4WithoutProxy(t *testing.T) {
 		{
 			name:         "IPv6 HTTP without port",
 			host:         "::1",
+			urlHost:      "[::1]",
 			proto:        "http",
 			expectedHost: "::1",
 		},
 		{
 			name:         "IPv6 HTTPS without port",
 			host:         "::1",
+			urlHost:      "[::1]",
 			proto:        "https",
 			expectedHost: "::1",
 		},
@@ -504,11 +518,19 @@ func TestSignatureV4WithoutProxy(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			iam := newTestIAM()
 
+			// A bare IPv6 literal is legal in a Host header but not in a URL, so the
+			// two forms are carried separately.
+			urlHost := tt.urlHost
+			if urlHost == "" {
+				urlHost = tt.host
+			}
+
 			// Create a request
-			r, err := newTestRequest("GET", tt.proto+"://"+tt.host+"/test-bucket/test-object", 0, nil)
+			r, err := newTestRequest("GET", tt.proto+"://"+urlHost+"/test-bucket/test-object", 0, nil)
 			if err != nil {
 				t.Fatalf("Failed to create test request: %v", err)
 			}
+			r.Host = tt.host
 
 			// Set the mux variables manually since we're not going through the actual router
 			r = mux.SetURLVars(r, map[string]string{
@@ -815,7 +837,7 @@ func TestPresignedSignatureV4WithForwardedPrefix(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			iam := newTestIAM()
+			iam := newTestIAMWithTrustedProxy()
 
 			// Create a presigned request that simulates reverse proxy scenario:
 			// 1. Client generates presigned URL with prefixed path
@@ -848,6 +870,7 @@ func TestPresignedSignatureV4WithForwardedPrefix(t *testing.T) {
 			r.Header.Set("X-Forwarded-Prefix", tt.forwardedPrefix)
 			r.Header.Set("Host", "example.com")
 			r.Header.Set("X-Forwarded-Host", "example.com")
+			r.RemoteAddr = "10.0.0.1:1234"
 
 			// Test presigned signature verification
 			_, _, errCode := iam.doesPresignedSignatureMatch(r)
@@ -889,7 +912,7 @@ func TestPresignedSignatureV4WithForwardedPrefixTrailingSlash(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			iam := newTestIAM()
+			iam := newTestIAMWithTrustedProxy()
 
 			// Create a presigned request that simulates reverse proxy scenario with trailing slashes:
 			// 1. Client generates presigned URL with prefixed path including trailing slash
@@ -916,6 +939,7 @@ func TestPresignedSignatureV4WithForwardedPrefixTrailingSlash(t *testing.T) {
 			r.Header.Set("X-Forwarded-Prefix", tt.forwardedPrefix)
 			r.Header.Set("Host", "example.com")
 			r.Header.Set("X-Forwarded-Host", "example.com")
+			r.RemoteAddr = "10.0.0.1:1234"
 
 			// Test presigned signature verification - this should succeed with trailing slashes
 			_, _, errCode := iam.doesPresignedSignatureMatch(r)
@@ -927,6 +951,53 @@ func TestPresignedSignatureV4WithForwardedPrefixTrailingSlash(t *testing.T) {
 	}
 }
 
+// A presigned URL holder may replay the signed query against a different
+// request path and claim the skipped part via X-Forwarded-Prefix. The header
+// is only meaningful when the direct peer is a configured trusted proxy.
+func TestPresignedSignatureV4ForwardedPrefixPeerTrust(t *testing.T) {
+	const proxyIP = "10.0.0.1"
+
+	newRetargetedRequest := func(t *testing.T) *http.Request {
+		// Sign over the full external path, as a client of the reverse proxy would.
+		r, err := newTestRequest("GET", "https://example.com/shared/tenanta/report.txt", 0, nil)
+		if err != nil {
+			t.Fatalf("Failed to create test request: %v", err)
+		}
+		if err = preSignV4WithPath(newTestIAM(), r, "AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", 3600, "/shared/tenanta/report.txt"); err != nil {
+			t.Fatalf("Failed to presign request: %v", err)
+		}
+
+		// Replay the same query string at a suffix path, supplying the
+		// skipped segment as the forwarded prefix.
+		r.URL.Path = "/tenanta/report.txt"
+		r = mux.SetURLVars(r, map[string]string{
+			"bucket": "tenanta",
+			"object": "report.txt",
+		})
+		r.Header.Set("X-Forwarded-Prefix", "/shared")
+		r.Header.Set("Host", "example.com")
+		r.RemoteAddr = proxyIP + ":54321"
+		return r
+	}
+
+	t.Run("untrusted peer", func(t *testing.T) {
+		iam := newTestIAM()
+		_, _, errCode := iam.doesPresignedSignatureMatch(newRetargetedRequest(t))
+		if errCode != s3err.ErrSignatureDoesNotMatch {
+			t.Errorf("Expected ErrSignatureDoesNotMatch for untrusted peer, got: %v (code: %d)", errCode, int(errCode))
+		}
+	})
+
+	t.Run("trusted proxy", func(t *testing.T) {
+		iam := newTestIAM()
+		iam.SetTrustedProxies(policy_engine.NewTrustedProxies([]string{proxyIP}))
+		_, _, errCode := iam.doesPresignedSignatureMatch(newRetargetedRequest(t))
+		if errCode != s3err.ErrNone {
+			t.Errorf("Expected successful presigned signature validation from trusted proxy, got: %v (code: %d)", errCode, int(errCode))
+		}
+	})
+}
+
 // preSignV4WithPath adds presigned URL parameters to the request with a custom path
 func preSignV4WithPath(iam *IdentityAccessManagement, req *http.Request, accessKey, secretKey string, expires int64, urlPath string) error {
 	// Create credential scope
@@ -1900,3 +1971,127 @@ func BenchmarkStreamingVsNonStreaming(b *testing.B) {
 		}
 	})
 }
+
+func TestBucketFromVirtualHost(t *testing.T) {
+	tests := []struct {
+		host       string
+		domain     string
+		wantBucket string
+		wantOk     bool
+	}{
+		{"alpha-bkt.s3.test", "s3.test", "alpha-bkt", true},
+		{"alpha-bkt.s3.test:8333", "s3.test", "alpha-bkt", true},
+		{"alpha-bkt.S3.TEST", "s3.test", "alpha-bkt", true},
+		{"s3.test", "s3.test", "", false},
+		{"example.com", "s3.test", "", false},
+		{"alpha-bkt.s3.test", "", "", false},
+		{"alpha-bkt.s3.test", "s3.test,develop.s3.test", "alpha-bkt", true},
+		{"bucket.develop.s3.test", "s3.test,develop.s3.test", "bucket.develop", true},
+		{"develop.s3.test", "s3.test,develop.s3.test", "", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.host, func(t *testing.T) {
+			bucket, ok := bucketFromVirtualHost(tt.host, tt.domain)
+			if bucket != tt.wantBucket || ok != tt.wantOk {
+				t.Errorf("bucketFromVirtualHost(%q, %q) = (%q, %v), want (%q, %v)",
+					tt.host, tt.domain, bucket, ok, tt.wantBucket, tt.wantOk)
+			}
+		})
+	}
+}
+
+func newVirtualHostTestIAM(domain string) *IdentityAccessManagement {
+	iam := &IdentityAccessManagement{
+		domain:       domain,
+		hashes:       make(map[string]*sync.Pool),
+		hashCounters: make(map[string]*int32),
+	}
+	_ = iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{
+				Name: "someone",
+				Credentials: []*iam_pb.Credential{
+					{AccessKey: "access_key_1", SecretKey: "secret_key_1"},
+				},
+				Actions: []string{"Read", "Write"},
+			},
+		},
+	})
+	return iam
+}
+
+func TestPresignedVirtualHostRetargetRejected(t *testing.T) {
+	iam := newVirtualHostTestIAM("s3.test")
+
+	r, err := newTestRequest("GET", "http://alpha-bkt.s3.test/shared.txt", 0, nil)
+	if err != nil {
+		t.Fatalf("Failed to create test request: %v", err)
+	}
+	r.Header.Set("Host", "alpha-bkt.s3.test")
+
+	if err := preSignV4WithPath(iam, r, "access_key_1", "secret_key_1", 3600, r.URL.Path); err != nil {
+		t.Fatalf("Failed to presign request: %v", err)
+	}
+
+	r.Host = "beta-bkt.s3.test"
+	r.Header.Set("X-Forwarded-Host", "alpha-bkt.s3.test")
+
+	r = mux.SetURLVars(r, map[string]string{
+		"bucket": "beta-bkt",
+		"object": "shared.txt",
+	})
+
+	_, _, errCode := iam.doesPresignedSignatureMatch(r)
+	if errCode != s3err.ErrAccessDenied {
+		t.Errorf("Expected ErrAccessDenied for retargeted presigned URL, got: %v (code: %d)", errCode, int(errCode))
+	}
+}
+
+func TestSignedVirtualHostRetargetRejected(t *testing.T) {
+	iam := newVirtualHostTestIAM("s3.test")
+
+	r, err := newTestRequest("GET", "http://alpha-bkt.s3.test/shared.txt", 0, nil)
+	if err != nil {
+		t.Fatalf("Failed to create test request: %v", err)
+	}
+	r.Header.Set("Host", "alpha-bkt.s3.test")
+
+	signV4WithPath(r, "access_key_1", "secret_key_1", r.URL.Path)
+
+	r.Host = "beta-bkt.s3.test"
+	r.Header.Set("X-Forwarded-Host", "alpha-bkt.s3.test")
+
+	r = mux.SetURLVars(r, map[string]string{
+		"bucket": "beta-bkt",
+		"object": "shared.txt",
+	})
+
+	_, _, errCode := iam.doesSignatureMatch(r)
+	if errCode != s3err.ErrAccessDenied {
+		t.Errorf("Expected ErrAccessDenied for retargeted signed URL, got: %v (code: %d)", errCode, int(errCode))
+	}
+}
+
+func TestPresignedVirtualHostNoRetarget(t *testing.T) {
+	iam := newVirtualHostTestIAM("s3.test")
+
+	r, err := newTestRequest("GET", "http://alpha-bkt.s3.test/shared.txt", 0, nil)
+	if err != nil {
+		t.Fatalf("Failed to create test request: %v", err)
+	}
+	r.Header.Set("Host", "alpha-bkt.s3.test")
+
+	if err := preSignV4WithPath(iam, r, "access_key_1", "secret_key_1", 3600, r.URL.Path); err != nil {
+		t.Fatalf("Failed to presign request: %v", err)
+	}
+
+	r = mux.SetURLVars(r, map[string]string{
+		"bucket": "alpha-bkt",
+		"object": "shared.txt",
+	})
+
+	_, _, errCode := iam.doesPresignedSignatureMatch(r)
+	if errCode != s3err.ErrNone {
+		t.Errorf("Expected successful presigned signature validation, got: %v (code: %d)", errCode, int(errCode))
+	}
+}
diff --git a/weed/s3api/bucket_metadata_test.go b/weed/s3api/bucket_metadata_test.go
index 14cea39968..e7b59dedbf 100644
--- a/weed/s3api/bucket_metadata_test.go
+++ b/weed/s3api/bucket_metadata_test.go
@@ -176,6 +176,8 @@ func TestBuildBucketMetadata(t *testing.T) {
 }
 
 func TestGetBucketMetadata(t *testing.T) {
+	original := loadBucketMetadataFromFiler
+	t.Cleanup(func() { loadBucketMetadataFromFiler = original })
 	loadBucketMetadataFromFiler = func(r *BucketRegistry, bucketName string) (*BucketMetaData, error) {
 		time.Sleep(time.Second)
 		loadFilerBucketLock.Lock()
diff --git a/weed/s3api/bucket_paths.go b/weed/s3api/bucket_paths.go
index f3febef4f5..2d70a03826 100644
--- a/weed/s3api/bucket_paths.go
+++ b/weed/s3api/bucket_paths.go
@@ -2,8 +2,12 @@ package s3api
 
 import (
 	"errors"
+	"net/http"
 	"path"
+	"regexp"
+	"strconv"
 	"strings"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -69,6 +73,11 @@ func (s3a *S3ApiServer) validateTableBucketObjectPath(bucket, object string) err
 		return err
 	}
 	parts := strings.SplitN(cleanObject, "/", 4)
+	// A table's marker files sit at namespace/table/<marker>, one level above
+	// everything else, so they are three parts rather than four.
+	if len(parts) == 3 && s3tables.IsTableMarkerFile(parts[2]) {
+		return nil
+	}
 	if len(parts) < 4 {
 		return &s3tables.IcebergLayoutError{
 			Code:    s3tables.ErrCodeInvalidIcebergLayout,
@@ -78,6 +87,117 @@ func (s3a *S3ApiServer) validateTableBucketObjectPath(bucket, object string) err
 	return nil
 }
 
+// volumeVerifyKey matches the object Snowflake writes, reads, lists and
+// deletes at the base of an S3-compatible external volume before it creates
+// or writes Iceberg tables there (SYSTEM$VERIFY_EXTERNAL_VOLUME, also run
+// implicitly): <base>/verify_<epoch milliseconds>_<number>, a 21-byte body.
+// A table bucket refuses every key outside the Iceberg layout, so without
+// this exception Snowflake cannot use a table bucket as an external volume.
+//
+// The exception is narrow so that it cannot be used to store data:
+//   - only at the bucket root: nothing can be encoded in a prefix, written
+//     into a hidden tree or take a namespace or table name;
+//   - one shape: 13 digits of epoch milliseconds, then 1-10 digits;
+//   - never a directory: a namespace may carry a name of that shape, and the
+//     key then names its directory (volumeVerifyKeyIsDirectory);
+//   - a PUT must be dated within volumeVerifyWindow of the server's clock,
+//     declare a Content-Length of at most volumeVerifyMaxBytes (no chunked or
+//     undeclared body), and carry no user metadata, tagging, stored content
+//     headers or extraction request (volumeVerifyPutAllowed). Reads and
+//     deletes take a key of any date, so an object a check left behind can
+//     still be removed.
+//
+// Only the calls the check makes (PUT, GET, HEAD, DELETE, DeleteObjects)
+// accept the key; multipart, copy, rename, ACL, tagging and POST policy keep
+// the plain layout rule.
+var volumeVerifyKey = regexp.MustCompile(`^verify_([0-9]{13})_[0-9]{1,10}$`)
+
+const (
+	volumeVerifyMaxBytes = 1024
+	volumeVerifyWindow   = time.Hour
+)
+
+// volumeVerifyNow is the clock a PUT's key is checked against.
+var volumeVerifyNow = time.Now
+
+// volumeVerifyKeyTime is the time a verification key is dated, and whether
+// the object has the key's shape.
+func volumeVerifyKeyTime(object string) (time.Time, bool) {
+	m := volumeVerifyKey.FindStringSubmatch(strings.TrimPrefix(object, "/"))
+	if m == nil {
+		return time.Time{}, false
+	}
+	ms, err := strconv.ParseInt(m[1], 10, 64)
+	if err != nil {
+		return time.Time{}, false
+	}
+	return time.UnixMilli(ms), true
+}
+
+func isVolumeVerifyKey(object string) bool {
+	_, ok := volumeVerifyKeyTime(object)
+	return ok
+}
+
+// volumeVerifyLookup reads the entry a verification key names.
+var volumeVerifyLookup = func(s3a *S3ApiServer, dir, name string) (*filer_pb.Entry, error) {
+	return s3a.getEntry(dir, name)
+}
+
+// volumeVerifyKeyIsDirectory reports whether the key names a directory (a
+// namespace), or whether that cannot be known.
+func (s3a *S3ApiServer) volumeVerifyKeyIsDirectory(bucket, object string) bool {
+	entry, err := volumeVerifyLookup(s3a, s3a.bucketDir(bucket), strings.TrimPrefix(object, "/"))
+	if err != nil {
+		return !errors.Is(err, filer_pb.ErrNotFound)
+	}
+	return entry != nil && entry.IsDirectory
+}
+
+// validateTableBucketObjectPathOrVerify is validateTableBucketObjectPath that
+// also accepts the external-volume verification key, and reports it so the
+// PUT handler can apply its limits.
+func (s3a *S3ApiServer) validateTableBucketObjectPathOrVerify(bucket, object string) (isVerify bool, err error) {
+	if !s3a.isTableBucket(bucket) {
+		return false, nil
+	}
+	if isVolumeVerifyKey(object) && !s3a.volumeVerifyKeyIsDirectory(bucket, object) {
+		return true, nil
+	}
+	return false, s3a.validateTableBucketObjectPath(bucket, object)
+}
+
+// volumeVerifyPutAllowed reports whether a PUT to the verification key is
+// dated now, declares a small body and stores nothing beside it.
+func volumeVerifyPutAllowed(r *http.Request, object string) bool {
+	at, ok := volumeVerifyKeyTime(object)
+	if !ok {
+		return false
+	}
+	if d := volumeVerifyNow().Sub(at); d > volumeVerifyWindow || d < -volumeVerifyWindow {
+		return false
+	}
+	if r.ContentLength < 0 || r.ContentLength > volumeVerifyMaxBytes || len(r.TransferEncoding) > 0 {
+		return false
+	}
+	if isExtractZip(r) {
+		return false
+	}
+	for name, values := range r.Header {
+		n := strings.ToLower(name)
+		if strings.HasPrefix(n, "x-amz-meta-") || n == "x-amz-tagging" || n == "content-disposition" ||
+			n == "response-content-disposition" || n == "content-language" ||
+			n == "cache-control" || n == "expires" || n == "x-amz-website-redirect-location" {
+			return false
+		}
+		// aws-chunked only frames the body; any other coding is stored.
+		if n == "content-encoding" && storedContentEncoding(values) != "" {
+			return false
+		}
+	}
+	return true
+}
+
 func (s3a *S3ApiServer) bucketPrefix(bucket string) string {
 	return s3a.bucketDir(bucket) + "/"
 }
diff --git a/weed/s3api/chunked_reader_trailer_split_test.go b/weed/s3api/chunked_reader_trailer_split_test.go
new file mode 100644
index 0000000000..6d457657ca
--- /dev/null
+++ b/weed/s3api/chunked_reader_trailer_split_test.go
@@ -0,0 +1,59 @@
+package s3api
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"encoding/base64"
+	"hash/crc32"
+	"io"
+	"testing"
+)
+
+// segmentedReader returns one segment per Read call.
+type segmentedReader struct{ segments [][]byte }
+
+func (s *segmentedReader) Read(p []byte) (int, error) {
+	if len(s.segments) == 0 {
+		return 0, io.EOF
+	}
+	n := copy(p, s.segments[0])
+	s.segments[0] = s.segments[0][n:]
+	if len(s.segments[0]) == 0 {
+		s.segments = s.segments[1:]
+	}
+	return n, nil
+}
+
+func TestTrailerChecksumSurvivesSplitTrailerLines(t *testing.T) {
+	payload := []byte("hello, trailer\n")
+	crcWriter := crc32.NewIEEE()
+	crcWriter.Write(payload)
+	checksum := base64.StdEncoding.EncodeToString(crcWriter.Sum(nil))
+	sig := "0000000000000000000000000000000000000000000000000000000000000000"
+
+	segments := [][]byte{
+		[]byte("f;chunk-signature=" + sig + "\r\n"),
+		append(payload, "\r\n"...),
+		[]byte("0;chunk-signature=" + sig + "\r\n"),
+		[]byte("x-amz-checksum-crc32:" + checksum),
+		[]byte("\r\n"),
+		[]byte("x-amz-trailer-signature:" + sig + "\r\n\r\n"),
+	}
+
+	cr := &s3ChunkedReader{
+		reader:            bufio.NewReader(&segmentedReader{segments: segments}),
+		chunkSHA256Writer: sha256.New(),
+		checkSumAlgorithm: ChecksumAlgorithmCRC32.String(),
+		checkSumWriter:    getCheckSumWriter(ChecksumAlgorithmCRC32),
+		state:             readChunkHeader,
+		hasTrailer:        true,
+	}
+
+	got, err := io.ReadAll(cr)
+	if err != nil {
+		t.Fatalf("read failed: %v", err)
+	}
+	if string(got) != string(payload) {
+		t.Fatalf("payload = %q, want %q", got, payload)
+	}
+}
diff --git a/weed/s3api/chunked_reader_v4.go b/weed/s3api/chunked_reader_v4.go
index 31c7119210..dc4a0b9467 100644
--- a/weed/s3api/chunked_reader_v4.go
+++ b/weed/s3api/chunked_reader_v4.go
@@ -46,8 +46,12 @@ import (
 //
 // returns signature, error otherwise if the signature mismatches or any other
 // error while parsing and validating.
+//
+// Only the signature is verified here. The request was already authorized by
+// the Auth middleware, which also evaluates bucket policies; re-running the
+// permission check here does not, and would deny what the middleware allowed.
 func (iam *IdentityAccessManagement) calculateSeedSignature(r *http.Request) (cred *Credential, signature string, region string, service string, date time.Time, errCode s3err.ErrorCode) {
-	_, credential, calculatedSignature, authInfo, errCode := iam.verifyV4Signature(r, true)
+	_, credential, calculatedSignature, authInfo, errCode := iam.verifyV4Signature(r, false)
 	if errCode != s3err.ErrNone {
 		return nil, "", "", "", time.Time{}, errCode
 	}
@@ -90,18 +94,22 @@ func (iam *IdentityAccessManagement) newChunkedReader(req *http.Request) (io.Rea
 	// Payload for STREAMING signature should be 'STREAMING-AWS4-HMAC-SHA256-PAYLOAD' or 'STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER'
 	case streamingContentSHA256, streamingContentSHA256Trailer:
 		glog.V(3).Infof("streaming content sha256 (with trailer: %v)", contentSha256Header == streamingContentSHA256Trailer)
-		credential, seedSignature, region, service, seedDate, errCode = iam.calculateSeedSignature(req)
-		if errCode != s3err.ErrNone {
-			return nil, errCode
+		// With IAM disabled there is no credential to verify against; leave
+		// cred nil so chunk signatures are decoded but not verified.
+		if iam.isEnabled() {
+			credential, seedSignature, region, service, seedDate, errCode = iam.calculateSeedSignature(req)
+			if errCode != s3err.ErrNone {
+				return nil, errCode
+			}
 		}
 	case streamingUnsignedPayload:
 		glog.V(3).Infof("streaming unsigned payload")
 		// The seed signature is a SigV4 concept; recompute it only for SigV4-signed
 		// requests. JWT-bearer, presigned, and anonymous unsigned-streaming uploads
 		// carry no header seed, and verifyV4Signature would fail parsing them.
-		if isRequestSignatureV4(req) {
+		if iam.isEnabled() && isRequestSignatureV4(req) {
 			// We do not need to pass the seed signature to the Reader as each chunk is not signed,
-			// but we do compute it to verify the caller has the correct permissions.
+			// but we do compute it to verify the request's signature.
 			_, _, _, _, _, errCode = iam.calculateSeedSignature(req)
 			if errCode != s3err.ErrNone {
 				return nil, errCode
@@ -537,7 +545,7 @@ func parseChunkChecksum(b *bufio.Reader) (ChecksumAlgorithm, []byte, error) {
 					glog.V(3).Infof("multiple checksum headers found in trailer, using last: %s", key)
 				}
 				checksumAlgorithm = alg
-				checksum = value
+				checksum = bytes.Clone(value)
 			}
 			// Ignore other trailer headers like x-amz-trailer-signature
 		}
diff --git a/weed/s3api/chunked_reader_v4_bucket_policy_test.go b/weed/s3api/chunked_reader_v4_bucket_policy_test.go
new file mode 100644
index 0000000000..afbd6ef3c9
--- /dev/null
+++ b/weed/s3api/chunked_reader_v4_bucket_policy_test.go
@@ -0,0 +1,89 @@
+package s3api
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	bpcBucket       = "policy-bucket"
+	bpcObject       = "incoming/part.bin"
+	bpcAccessKey    = "LOCALPOLICYKEY000001"
+	bpcSecretKey    = "local-policy-secret-for-loopback-only"
+	bpcIdentityName = "policy-writer"
+	bpcAccountID    = "000000000000"
+)
+
+// An identity with credentials and nothing else, plus a bucket policy that lets it put objects.
+func newBucketPolicyOnlyIAM(t *testing.T) *IdentityAccessManagement {
+	t.Helper()
+	iam := &IdentityAccessManagement{
+		hashes:       make(map[string]*sync.Pool),
+		hashCounters: make(map[string]*int32),
+	}
+	err := iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Accounts: []*iam_pb.Account{{Id: bpcAccountID, DisplayName: bpcIdentityName}},
+		Identities: []*iam_pb.Identity{{
+			Name:        bpcIdentityName,
+			Account:     &iam_pb.Account{Id: bpcAccountID, DisplayName: bpcIdentityName},
+			Credentials: []*iam_pb.Credential{{AccessKey: bpcAccessKey, SecretKey: bpcSecretKey}},
+		}},
+	})
+	require.NoError(t, err)
+
+	policy := fmt.Sprintf(`{"Version":"2012-10-17","Statement":[
+	  {"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::%s:user/%s"},
+	   "Action":"s3:PutObject","Resource":"arn:aws:s3:::%s/*"}]}`, bpcAccountID, bpcIdentityName, bpcBucket)
+	engine := NewBucketPolicyEngine()
+	require.NoError(t, engine.engine.SetBucketPolicy(bpcBucket, policy))
+	iam.policyEngine = engine
+	return iam
+}
+
+// A SigV4 PutObject whose body is aws-chunked with an unsigned payload and a CRC32 trailer.
+func bpcStreamingPut(t *testing.T, secretKey string) *http.Request {
+	t.Helper()
+	payload := generateStreamingUnsignedPayloadTrailerPayload(true)
+	urlStr := fmt.Sprintf("http://127.0.0.1:9000/%s/%s", bpcBucket, bpcObject)
+	req := mustNewRequest(http.MethodPut, urlStr, int64(len(payload)), bytes.NewReader([]byte(payload)), t)
+	req.Header.Set("Content-Encoding", "aws-chunked")
+	req.Header.Set("x-amz-decoded-content-length", "17408")
+	req.Header.Set("x-amz-content-sha256", streamingUnsignedPayload)
+	req.Header.Set("x-amz-trailer", "x-amz-checksum-crc32")
+	require.NoError(t, signRequestV4(req, bpcAccessKey, secretKey))
+	return mux.SetURLVars(req, map[string]string{"bucket": bpcBucket, "object": bpcObject})
+}
+
+func TestChunkedReaderDoesNotReauthorizeBucketPolicyPrincipal(t *testing.T) {
+	iam := newBucketPolicyOnlyIAM(t)
+
+	// The middleware authorizes the write through the bucket policy.
+	req := bpcStreamingPut(t, bpcSecretKey)
+	identity, errCode := iam.authRequest(req, s3_constants.ACTION_WRITE)
+	require.Equal(t, s3err.ErrNone, errCode, "the bucket policy must allow the PutObject")
+	require.NotNil(t, identity)
+	require.Empty(t, identity.Actions)
+	require.Empty(t, identity.PolicyNames)
+
+	// The handler then builds the body reader for the same request.
+	reader, errCode := iam.newChunkedReader(req)
+	require.Equal(t, s3err.ErrNone, errCode, "the chunked reader must not deny what the middleware allowed")
+	data, err := io.ReadAll(reader)
+	require.NoError(t, err)
+	require.Equal(t, strings.Repeat("a", 17408), string(data))
+
+	// The seed signature is still verified.
+	_, errCode = iam.newChunkedReader(bpcStreamingPut(t, "not-the-secret"))
+	require.Equal(t, s3err.ErrSignatureDoesNotMatch, errCode)
+}
diff --git a/weed/s3api/chunked_reader_v4_test.go b/weed/s3api/chunked_reader_v4_test.go
index e386129c03..03b37215a1 100644
--- a/weed/s3api/chunked_reader_v4_test.go
+++ b/weed/s3api/chunked_reader_v4_test.go
@@ -111,7 +111,7 @@ func TestNewSignV4ChunkedReaderStreamingUnsignedPayloadTrailer(t *testing.T) {
 	runWithRequest(iam, req, t, expectedPayload)
 }
 
-func runWithRequest(iam IdentityAccessManagement, req *http.Request, t *testing.T, expectedPayload string) {
+func runWithRequest(iam *IdentityAccessManagement, req *http.Request, t *testing.T, expectedPayload string) {
 	reader, errCode := iam.newChunkedReader(req)
 	assert.NotNil(t, reader)
 	assert.Equal(t, s3err.ErrNone, errCode)
@@ -124,11 +124,11 @@ func runWithRequest(iam IdentityAccessManagement, req *http.Request, t *testing.
 	assert.Equal(t, expectedPayload, string(data))
 }
 
-func setupIam() IdentityAccessManagement {
+func setupIam() *IdentityAccessManagement {
 	// Create an IdentityAccessManagement instance
 	// Add default access keys and secrets
 
-	iam := IdentityAccessManagement{
+	iam := &IdentityAccessManagement{
 		identities:        []*Identity{},
 		accessKeyIdent:    map[string]*Identity{},
 		accounts:          map[string]*Account{},
@@ -137,7 +137,7 @@ func setupIam() IdentityAccessManagement {
 		hashCounters:      map[string]*int32{},
 		identityAnonymous: nil,
 		domain:            "",
-		isAuthEnabled:     false,
+		isAuthEnabled:     true,
 	}
 
 	iam.identities = append(iam.identities, &Identity{
@@ -477,3 +477,58 @@ func TestSignedStreamingUploadInvalidSignature(t *testing.T) {
 	assert.Error(t, err, "Expected error when reading chunk with invalid signature")
 	assert.Contains(t, err.Error(), "chunk signature does not match", "Error should indicate chunk signature mismatch")
 }
+
+// TestSignedStreamingUploadWithoutIAM verifies that signed streaming uploads
+// (STREAMING-AWS4-HMAC-SHA256-PAYLOAD) are decoded rather than rejected when no
+// credentials are configured. Trino and other AWS SDK v2 clients always send
+// this payload type, so open gateways must accept it.
+func TestSignedStreamingUploadWithoutIAM(t *testing.T) {
+	iam := IdentityAccessManagement{
+		identities:     []*Identity{},
+		accessKeyIdent: map[string]*Identity{},
+		isAuthEnabled:  false,
+	}
+	s3a := &S3ApiServer{iam: &iam}
+
+	chunkData := strings.Repeat("a", 1024)
+	payload := fmt.Sprintf("400;chunk-signature=%064x\r\n%s\r\n", 1, chunkData) +
+		fmt.Sprintf("0;chunk-signature=%064x\r\n\r\n", 2)
+
+	req, err := http.NewRequest(http.MethodPut, "http://localhost/test-bucket/test-object",
+		bytes.NewReader([]byte(payload)))
+	assert.NoError(t, err)
+	req.Header.Set("x-amz-content-sha256", streamingContentSHA256)
+	req.Header.Set("Content-Encoding", "aws-chunked")
+	req.Header.Set("x-amz-decoded-content-length", "1024")
+	req.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential=x/20261016/us-east-1/s3/aws4_request, SignedHeaders=host, Signature=abc")
+
+	reader, errCode := getRequestDataReader(s3a, req)
+	assert.Equal(t, s3err.ErrNone, errCode)
+	assert.NotNil(t, reader)
+
+	data, err := io.ReadAll(reader)
+	assert.NoError(t, err)
+	assert.Equal(t, chunkData, string(data))
+}
+
+// TestTrailerStreamingUploadWithoutIAM verifies that the trailer variant
+// (STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER) is also decoded when no
+// credentials are configured, and that the checksum trailer is still honored.
+func TestTrailerStreamingUploadWithoutIAM(t *testing.T) {
+	iam := IdentityAccessManagement{
+		identities:     []*Identity{},
+		accessKeyIdent: map[string]*Identity{},
+		isAuthEnabled:  false,
+	}
+	s3a := &S3ApiServer{iam: &iam}
+
+	req, expectedData := createTrailerStreamingRequest(t, true)
+
+	reader, errCode := getRequestDataReader(s3a, req)
+	assert.Equal(t, s3err.ErrNone, errCode)
+	assert.NotNil(t, reader)
+
+	data, err := io.ReadAll(reader)
+	assert.NoError(t, err)
+	assert.Equal(t, expectedData, string(data))
+}
diff --git a/weed/s3api/cors/cors.go b/weed/s3api/cors/cors.go
index d6eb520af0..8562467304 100644
--- a/weed/s3api/cors/cors.go
+++ b/weed/s3api/cors/cors.go
@@ -235,13 +235,15 @@ func buildPreflightResponse(rule *CORSRule, corsReq *CORSRequest) *CORSResponse
 
 		// Set exposed headers
 		if len(rule.ExposeHeaders) > 0 {
-			response.ExposeHeaders = strings.Join(rule.ExposeHeaders, ", ")
+			response.ExposeHeaders = formatExposeHeaders(rule.ExposeHeaders)
 		}
 
 		// Set max age
 		if rule.MaxAgeSeconds != nil {
 			response.MaxAge = strconv.Itoa(*rule.MaxAgeSeconds)
 		}
+
+		response.AllowCredentials = true
 	}
 
 	return response
@@ -250,7 +252,8 @@ func buildPreflightResponse(rule *CORSRule, corsReq *CORSRequest) *CORSResponse
 // buildResponse builds a CORS response from a matching rule
 func buildResponse(rule *CORSRule, corsReq *CORSRequest) *CORSResponse {
 	response := &CORSResponse{
-		AllowOrigin: corsReq.Origin,
+		AllowOrigin:      corsReq.Origin,
+		AllowCredentials: true,
 	}
 
 	// Set allowed methods
@@ -263,7 +266,7 @@ func buildResponse(rule *CORSRule, corsReq *CORSRequest) *CORSResponse {
 
 	// Set expose headers
 	if len(rule.ExposeHeaders) > 0 {
-		response.ExposeHeaders = strings.Join(rule.ExposeHeaders, ", ")
+		response.ExposeHeaders = formatExposeHeaders(rule.ExposeHeaders)
 	}
 
 	// Set max age
@@ -274,6 +277,47 @@ func buildResponse(rule *CORSRule, corsReq *CORSRequest) *CORSResponse {
 	return response
 }
 
+// defaultExposeHeaders are emitted alongside "*" so credentialed CORS requests
+// can read standard response headers ("*" is treated literally when credentials
+// are included, per the Fetch spec).
+var defaultExposeHeaders = []string{
+	"ETag",
+	"Content-Length",
+	"Content-Type",
+	"Last-Modified",
+	"Content-Range",
+	"x-amz-request-id",
+	"x-amz-version-id",
+	"x-amz-tagging-count",
+}
+
+// formatExposeHeaders formats the exposed headers slice into a comma-separated string.
+func formatExposeHeaders(exposeHeaders []string) string {
+	var headers []string
+	hasWildcard := false
+	seen := map[string]bool{}
+	for _, h := range exposeHeaders {
+		if h == "*" {
+			hasWildcard = true
+			continue
+		}
+		if lower := strings.ToLower(h); !seen[lower] {
+			seen[lower] = true
+			headers = append(headers, h)
+		}
+	}
+	if hasWildcard {
+		for _, h := range defaultExposeHeaders {
+			if lower := strings.ToLower(h); !seen[lower] {
+				seen[lower] = true
+				headers = append(headers, h)
+			}
+		}
+		headers = append(headers, "*")
+	}
+	return strings.Join(headers, ", ")
+}
+
 // Helper functions
 
 // matchesOrigin checks if the request origin matches any allowed origin
diff --git a/weed/s3api/cors/cors_test.go b/weed/s3api/cors/cors_test.go
index 33d7b11b89..de30b49156 100644
--- a/weed/s3api/cors/cors_test.go
+++ b/weed/s3api/cors/cors_test.go
@@ -405,11 +405,12 @@ func TestEvaluateRequest(t *testing.T) {
 				Method: "GET",
 			},
 			want: &CORSResponse{
-				AllowOrigin:   "http://example.com",
-				AllowMethods:  "GET, POST",
-				AllowHeaders:  "Content-Type",
-				ExposeHeaders: "ETag",
-				MaxAge:        "3600",
+				AllowOrigin:      "http://example.com",
+				AllowMethods:     "GET, POST",
+				AllowHeaders:     "Content-Type",
+				ExposeHeaders:    "ETag",
+				MaxAge:           "3600",
+				AllowCredentials: true,
 			},
 			wantErr: false,
 		},
@@ -421,8 +422,9 @@ func TestEvaluateRequest(t *testing.T) {
 				Method: "PUT",
 			},
 			want: &CORSResponse{
-				AllowOrigin:  "http://other.com",
-				AllowMethods: "PUT",
+				AllowOrigin:      "http://other.com",
+				AllowMethods:     "PUT",
+				AllowCredentials: true,
 			},
 			wantErr: false,
 		},
@@ -447,11 +449,12 @@ func TestEvaluateRequest(t *testing.T) {
 				AccessControlRequestHeaders: []string{"Content-Type"},
 			},
 			want: &CORSResponse{
-				AllowOrigin:   "http://example.com",
-				AllowMethods:  "GET, POST",
-				AllowHeaders:  "Content-Type",
-				ExposeHeaders: "ETag",
-				MaxAge:        "3600",
+				AllowOrigin:      "http://example.com",
+				AllowMethods:     "GET, POST",
+				AllowHeaders:     "Content-Type",
+				ExposeHeaders:    "ETag",
+				MaxAge:           "3600",
+				AllowCredentials: true,
 			},
 			wantErr: false,
 		},
@@ -467,7 +470,30 @@ func TestEvaluateRequest(t *testing.T) {
 			},
 			want: &CORSResponse{
 				AllowOrigin: "http://example.com",
-				// No AllowMethods or AllowHeaders because the requested header is forbidden
+				// No AllowMethods, AllowHeaders, or AllowCredentials because the requested header is forbidden
+			},
+			wantErr: false,
+		},
+		{
+			name: "wildcard expose headers expands for credentialed responses",
+			config: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"http://example.com"},
+						AllowedMethods: []string{"GET"},
+						ExposeHeaders:  []string{"*"},
+					},
+				},
+			},
+			corsReq: &CORSRequest{
+				Origin: "http://example.com",
+				Method: "GET",
+			},
+			want: &CORSResponse{
+				AllowOrigin:      "http://example.com",
+				AllowMethods:     "GET",
+				ExposeHeaders:    "ETag, Content-Length, Content-Type, Last-Modified, Content-Range, x-amz-request-id, x-amz-version-id, x-amz-tagging-count, *",
+				AllowCredentials: true,
 			},
 			wantErr: false,
 		},
@@ -511,18 +537,20 @@ func TestApplyHeaders(t *testing.T) {
 		{
 			name: "complete response",
 			corsResp: &CORSResponse{
-				AllowOrigin:   "http://example.com",
-				AllowMethods:  "GET, POST",
-				AllowHeaders:  "Content-Type",
-				ExposeHeaders: "ETag",
-				MaxAge:        "3600",
+				AllowOrigin:      "http://example.com",
+				AllowMethods:     "GET, POST",
+				AllowHeaders:     "Content-Type",
+				ExposeHeaders:    "ETag",
+				MaxAge:           "3600",
+				AllowCredentials: true,
 			},
 			want: map[string]string{
-				"Access-Control-Allow-Origin":   "http://example.com",
-				"Access-Control-Allow-Methods":  "GET, POST",
-				"Access-Control-Allow-Headers":  "Content-Type",
-				"Access-Control-Expose-Headers": "ETag",
-				"Access-Control-Max-Age":        "3600",
+				"Access-Control-Allow-Origin":      "http://example.com",
+				"Access-Control-Allow-Methods":     "GET, POST",
+				"Access-Control-Allow-Headers":     "Content-Type",
+				"Access-Control-Expose-Headers":    "ETag",
+				"Access-Control-Max-Age":           "3600",
+				"Access-Control-Allow-Credentials": "true",
 			},
 		},
 		{
diff --git a/weed/s3api/filer_multipart.go b/weed/s3api/filer_multipart.go
index bfa2eb3caa..299c9899cd 100644
--- a/weed/s3api/filer_multipart.go
+++ b/weed/s3api/filer_multipart.go
@@ -2,6 +2,8 @@ package s3api
 
 import (
 	"cmp"
+	"container/heap"
+	"context"
 	"crypto/md5"
 	"crypto/rand"
 	"encoding/base64"
@@ -42,6 +44,10 @@ const (
 type InitiateMultipartUploadResult struct {
 	XMLName xml.Name `xml:"http://s3.amazonaws.com/doc/2006-03-01/ InitiateMultipartUploadResult"`
 	s3.CreateMultipartUploadOutput
+
+	// Checksum fields — returned as HTTP response headers, not in the XML body
+	ChecksumAlgorithm string `xml:"-"`
+	ChecksumType      string `xml:"-"`
 }
 
 // getRequestScheme determines the URL scheme (http or https) from the request
@@ -64,7 +70,8 @@ func (s3a *S3ApiServer) createMultipartUpload(r *http.Request, input *s3.CreateM
 
 	uploadIdString := s3a.generateUploadID(*input.Key)
 
-	uploadIdString = uploadIdString + "_" + strings.ReplaceAll(uuid.New().String(), "-", "")
+	// a time-ordered uuid keeps uploads of one key in initiation order
+	uploadIdString = uploadIdString + "_" + strings.ReplaceAll(uuid.Must(uuid.NewV7()).String(), "-", "")
 
 	// Validate checksum algorithm before creating the upload directory
 	checksumAlgo, checksumHeaderName, checksumErrCode := detectRequestedChecksumAlgorithm(r)
@@ -105,6 +112,7 @@ func (s3a *S3ApiServer) createMultipartUpload(r *http.Request, input *s3.CreateM
 		if input.ContentType != nil {
 			entry.Attributes.Mime = *input.ContentType
 		}
+		applyPutObjectACL(r, entry)
 
 		// Prepare and apply encryption configuration within directory creation
 		// This ensures encryption resources are only allocated if directory creation succeeds
@@ -147,6 +155,8 @@ func (s3a *S3ApiServer) createMultipartUpload(r *http.Request, input *s3.CreateM
 			Key:      objectKey(input.Key),
 			UploadId: aws.String(uploadIdString),
 		},
+		ChecksumAlgorithm: checksumAlgorithmNameFromHeaderName(checksumHeaderName),
+		ChecksumType:      checksumType,
 	}
 
 	return
@@ -159,10 +169,8 @@ type CompleteMultipartUploadResult struct {
 	Key      *string  `xml:"Key,omitempty"`
 	ETag     *string  `xml:"ETag,omitempty"`
 
-	// Checksum fields — returned as HTTP response headers, not in the XML body
-	ChecksumHeaderName string `xml:"-"`
-	ChecksumValue      string `xml:"-"`
-	ChecksumType       string `xml:"-"`
+	ChecksumResult
+	ChecksumType string `xml:"ChecksumType,omitempty"`
 
 	// VersionId is NOT included in XML body - it should only be in x-amz-version-id HTTP header
 
@@ -236,6 +244,7 @@ type multipartCompletionState struct {
 	manifestsReferenced     bool                  // failed rollback left an entry holding newManifestChunks
 	supersededPartManifests []*filer_pb.FileChunk // part-entry blobs replaced by flattening; deleted after commit
 	metadataOnlyCleanup     bool                  // deleteEntries share chunks with the live object; keep their data
+	uploadDirRemoved        bool                  // the finalize transaction already removed .uploads/<uploadId>
 }
 
 func completeMultipartResult(r *http.Request, input *s3.CompleteMultipartUploadInput, etag string, entry *filer_pb.Entry) *CompleteMultipartUploadResult {
@@ -252,6 +261,8 @@ func completeMultipartResult(r *http.Request, input *s3.CompleteMultipartUploadI
 				result.VersionId = aws.String(versionId)
 			}
 		}
+		result.SetChecksum(string(entry.Extended[s3_constants.ExtChecksumAlgorithm]), string(entry.Extended[s3_constants.ExtChecksumValue]))
+		result.ChecksumType = string(entry.Extended[s3_constants.ExtChecksumType])
 	}
 	return result
 }
@@ -375,8 +386,8 @@ func applyMultipartSSES3HeadersFromUploadEntry(dst *filer_pb.Entry, sses3Info *m
 	}
 }
 
-func (s3a *S3ApiServer) prepareMultipartCompletionState(r *http.Request, input *s3.CompleteMultipartUploadInput, uploadDirectory, entryName, dirName string, completedPartNumbers []int, completedPartMap map[int][]string, maxPartNo int) (*multipartCompletionState, *CompleteMultipartUploadResult, s3err.ErrorCode) {
-	if entry, err := s3a.resolveObjectEntry(*input.Bucket, *input.Key); err == nil && entry != nil && entry.Extended != nil {
+func (s3a *S3ApiServer) prepareMultipartCompletionState(r *http.Request, input *s3.CompleteMultipartUploadInput, parts *CompleteMultipartUpload, uploadDirectory, entryName, dirName string, completedPartNumbers []int, completedPartMap map[int][]string, maxPartNo int) (*multipartCompletionState, *CompleteMultipartUploadResult, s3err.ErrorCode) {
+	if entry, err := s3a.resolveObjectEntry(*input.Bucket, *input.Key, ""); err == nil && entry != nil && entry.Extended != nil {
 		if uploadId, ok := entry.Extended[s3_constants.SeaweedFSUploadId]; ok && *input.UploadId == string(uploadId) {
 			cleanupEntries, _, cleanupErr := s3a.list(uploadDirectory, "", "", false, s3_constants.MaxS3MultipartParts+1)
 			if cleanupErr != nil && !errors.Is(cleanupErr, filer_pb.ErrNotFound) {
@@ -389,7 +400,10 @@ func (s3a *S3ApiServer) prepareMultipartCompletionState(r *http.Request, input *
 	entries, _, err := s3a.list(uploadDirectory, "", "", false, s3_constants.MaxS3MultipartParts+1)
 	if err != nil {
 		glog.Errorf("completeMultipartUpload %s %s error: %v", *input.Bucket, *input.UploadId, err)
-		if isFilerListNotFound(err) {
+		if isFilerNotFound(err) {
+			if output, code := s3a.resumeCommittedObject(r, input, dirName, entryName); code != s3err.ErrNoSuchUpload {
+				return &multipartCompletionState{metadataOnlyCleanup: true}, output, code
+			}
 			stats.S3HandlerCounter.WithLabelValues(stats.ErrorCompletedNoSuchUpload).Inc()
 			return nil, nil, s3err.ErrNoSuchUpload
 		}
@@ -397,6 +411,9 @@ func (s3a *S3ApiServer) prepareMultipartCompletionState(r *http.Request, input *
 		return nil, nil, s3err.ErrInternalError
 	}
 	if len(entries) == 0 {
+		if output, code := s3a.resumeCommittedObject(r, input, dirName, entryName); code != s3err.ErrNoSuchUpload {
+			return &multipartCompletionState{metadataOnlyCleanup: true}, output, code
+		}
 		stats.S3HandlerCounter.WithLabelValues(stats.ErrorCompletedNoSuchUpload).Inc()
 		return nil, nil, s3err.ErrNoSuchUpload
 	}
@@ -410,6 +427,11 @@ func (s3a *S3ApiServer) prepareMultipartCompletionState(r *http.Request, input *
 		}
 		return nil, nil, s3err.ErrInternalError
 	}
+	// only createMultipartUpload stamps the key; a directory a part write left behind is not an upload
+	if !isMultipartUploadEntry(pentry) {
+		stats.S3HandlerCounter.WithLabelValues(stats.ErrorCompletedNoSuchUpload).Inc()
+		return nil, nil, s3err.ErrNoSuchUpload
+	}
 
 	deleteEntries := make([]*filer_pb.Entry, 0)
 	partEntries := make(map[int][]*filer_pb.Entry, len(entries))
@@ -562,8 +584,37 @@ func (s3a *S3ApiServer) prepareMultipartCompletionState(r *http.Request, input *
 			glog.Errorf("completeMultipartUpload: %v", typeErr)
 			return nil, nil, s3err.ErrInvalidRequest
 		}
+		query := parseRequestQuery(r)
+		if completeType := lookupHeaderOrQuery(r, query, s3_constants.AmzChecksumType); completeType != "" && !strings.EqualFold(completeType, resolvedType) {
+			return nil, nil, s3err.ErrBadDigest
+		}
 		checksumType = resolvedType
 
+		provided := make(map[int]string, len(parts.Parts))
+		for _, part := range parts.Parts {
+			provided[part.PartNumber] = part.GetChecksum(checksumHeaderName)
+		}
+		for _, partNumber := range completedPartNumbers {
+			providedChecksum := provided[partNumber]
+			if providedChecksum == "" {
+				// COMPOSITE uploads must carry every part checksum in the
+				// request; FULL_OBJECT uploads instead carry the whole-object
+				// checksum in a request header.
+				if checksumType == s3_constants.ChecksumTypeComposite {
+					return nil, nil, s3err.ErrInvalidRequest
+				}
+				continue
+			}
+			raw, _, decodeErr := decodePartChecksum(partNumber, partEntries[partNumber], checksumHeaderName)
+			if decodeErr != nil {
+				glog.Errorf("completeMultipartUpload: %v", decodeErr)
+				return nil, nil, s3err.ErrInvalidPart
+			}
+			if providedChecksum != base64.StdEncoding.EncodeToString(raw) {
+				return nil, nil, s3err.ErrBadDigest
+			}
+		}
+
 		var checksumErr error
 		if checksumType == s3_constants.ChecksumTypeFullObject {
 			checksumValue, checksumErr = computeFullObjectChecksum(checksumHeaderName, partEntries, completedPartNumbers)
@@ -574,6 +625,9 @@ func (s3a *S3ApiServer) prepareMultipartCompletionState(r *http.Request, input *
 			glog.Errorf("completeMultipartUpload: %s checksum computation failed: %v", checksumType, checksumErr)
 			return nil, nil, s3err.ErrInvalidPart
 		}
+		if objectChecksum := lookupHeaderOrQuery(r, query, checksumHeaderName); objectChecksum != "" && objectChecksum != checksumValue {
+			return nil, nil, s3err.ErrBadDigest
+		}
 	}
 
 	// Fold after the boundaries captured byte offsets; finalParts is flat
@@ -637,7 +691,7 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 	routeKey := s3a.objectRouteKey(*input.Bucket, *input.Key)
 	completionBody := func() s3err.ErrorCode {
 		var prepCode s3err.ErrorCode
-		completionState, output, prepCode = s3a.prepareMultipartCompletionState(r, input, uploadDirectory, entryName, dirName, completedPartNumbers, completedPartMap, maxPartNo)
+		completionState, output, prepCode = s3a.prepareMultipartCompletionState(r, input, parts, uploadDirectory, entryName, dirName, completedPartNumbers, completedPartMap, maxPartNo)
 		if prepCode != s3err.ErrNone || output != nil {
 			return prepCode
 		}
@@ -662,8 +716,9 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 			versionMtime := time.Now().Unix()
 			amzAccountId := r.Header.Get(s3_constants.AmzAccountId)
 
-			// Create the version file in the .versions directory
-			if err := s3a.mkFile(versionDir, versionFileName, completionState.finalParts, func(versionEntry *filer_pb.Entry) {
+			// Fills in the version entry; on the routed path this runs inside the
+			// finalize transaction, on the fallback inside mkFile.
+			decorateVersionEntry := func(versionEntry *filer_pb.Entry) {
 				if versionEntry.Extended == nil {
 					versionEntry.Extended = make(map[string][]byte)
 				}
@@ -712,9 +767,6 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 				}
 				versionEntry.Attributes.FileSize = uint64(completionState.offset)
 				versionEntry.Attributes.Mtime = versionMtime
-			}); err != nil {
-				glog.Errorf("completeMultipartUpload: failed to create version %s: %v", versionId, err)
-				return s3err.ErrInternalError
 			}
 
 			// Construct entry with metadata for caching in .versions directory
@@ -733,44 +785,71 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 				versionEntryForCache.Extended[s3_constants.ExtAmzOwnerKey] = []byte(amzAccountId)
 			}
 
-			// Update the .versions directory metadata to indicate this is the latest version
-			// Pass entry to cache its metadata for single-scan list efficiency
-			// Route the pointer flip to the owner (off the lock) via
-			// RECOMPUTE_LATEST; the just-written version file is the newest.
-			if owner != "" {
-				if code := s3a.routedVersionedFinalize(owner, *input.Bucket, *input.Key, useInvertedFormat); code != s3err.ErrNone {
-					if rollbackErr := s3a.rollbackMultipartVersion(versionDir, versionFileName); rollbackErr != nil {
-						glog.Errorf("completeMultipartUpload: failed to rollback version %s for %s/%s after routed finalize error: %v", versionId, *input.Bucket, *input.Key, rollbackErr)
+			// objectTxnOnFiler needs an owner to route to or a filerClient to
+			// pick a filer from; only the bootstrap fallback keeps the
+			// mkFile + pointer-update sequence.
+			if owner != "" || s3a.filerClient != nil {
+				// The transaction removes the upload directory metadata-only,
+				// so the part entries the object does not reference are freed
+				// first or their chunks leak.
+				if err := s3a.deleteUnusedPartEntries(r.Context(), uploadDirectory, *input.Bucket, *input.UploadId, completionState); err != nil {
+					glog.Errorf("completeMultipartUpload %s upload %s unused part cleanup: %v", *input.Bucket, *input.UploadId, err)
+					return s3err.ErrInternalError
+				}
+				if code := s3a.routedMultipartFinalize(owner, *input.Bucket, *input.Key, useInvertedFormat, versionDir, versionFileName, completionState.finalParts, decorateVersionEntry, *input.UploadId); code != s3err.ErrNone {
+					if code == s3err.ErrNoSuchUpload {
+						return code
+					}
+					// Roll back only while the upload directory survives: once the
+					// transaction removed it, the version file is the only record
+					// left and deleting it would make a retry impossible.
+					if exists, _ := s3a.exists(s3a.genUploadsFolder(*input.Bucket), *input.UploadId, true); exists {
+						if rollbackErr := s3a.rollbackMultipartVersion(versionDir, versionFileName); rollbackErr != nil {
+							glog.Errorf("completeMultipartUpload: failed to rollback version %s for %s/%s after routed finalize error: %v", versionId, *input.Bucket, *input.Key, rollbackErr)
+							completionState.manifestsReferenced = true
+						}
+					} else {
 						completionState.manifestsReferenced = true
 					}
 					return code
 				}
-			} else if err := s3a.updateLatestVersionInDirectory(*input.Bucket, *input.Key, versionId, versionFileName, versionEntryForCache); err != nil {
-				if rollbackErr := s3a.rollbackMultipartVersion(versionDir, versionFileName); rollbackErr != nil {
-					glog.Errorf("completeMultipartUpload: failed to rollback version %s for %s/%s after latest pointer update error: %v", versionId, *input.Bucket, *input.Key, rollbackErr)
-					completionState.manifestsReferenced = true
+				completionState.uploadDirRemoved = true
+			} else {
+				if err := s3a.mkFile(versionDir, versionFileName, completionState.finalParts, decorateVersionEntry); err != nil {
+					glog.Errorf("completeMultipartUpload: failed to create version %s: %v", versionId, err)
+					return s3err.ErrInternalError
+				}
+				if err := s3a.updateLatestVersionInDirectory(*input.Bucket, *input.Key, versionId, versionFileName, versionEntryForCache); err != nil {
+					if rollbackErr := s3a.rollbackMultipartVersion(versionDir, versionFileName); rollbackErr != nil {
+						glog.Errorf("completeMultipartUpload: failed to rollback version %s for %s/%s after latest pointer update error: %v", versionId, *input.Bucket, *input.Key, rollbackErr)
+						completionState.manifestsReferenced = true
+					}
+					glog.Errorf("completeMultipartUpload: failed to update latest version in directory: %v", err)
+					return s3err.ErrInternalError
 				}
-				glog.Errorf("completeMultipartUpload: failed to update latest version in directory: %v", err)
-				return s3err.ErrInternalError
 			}
 
 			// For versioned buckets, all content is stored in .versions directory
 			// The latest version information is tracked in the .versions directory metadata
 			output = &CompleteMultipartUploadResult{
-				Location:           aws.String(fmt.Sprintf("%s://%s/%s/%s", getRequestScheme(r), r.Host, url.PathEscape(*input.Bucket), urlPathEscape(*input.Key))),
-				Bucket:             input.Bucket,
-				ETag:               aws.String(etagQuote),
-				Key:                objectKey(input.Key),
-				VersionId:          aws.String(versionId),
-				ChecksumHeaderName: completionState.checksumHeaderName,
-				ChecksumValue:      completionState.checksumValue,
-				ChecksumType:       completionState.checksumType,
+				Location:     aws.String(fmt.Sprintf("%s://%s/%s/%s", getRequestScheme(r), r.Host, url.PathEscape(*input.Bucket), urlPathEscape(*input.Key))),
+				Bucket:       input.Bucket,
+				ETag:         aws.String(etagQuote),
+				Key:          objectKey(input.Key),
+				VersionId:    aws.String(versionId),
+				ChecksumType: completionState.checksumType,
 			}
+			output.SetChecksum(completionState.checksumHeaderName, completionState.checksumValue)
 			return s3err.ErrNone
 		}
 
 		if versioningState == s3_constants.VersioningSuspended {
 			// For suspended versioning, add "null" version ID metadata and return "null" version ID
+			removal, err := s3a.routedUploadRemoval(r.Context(), owner, uploadDirectory, *input.Bucket, *input.UploadId, completionState)
+			if err != nil {
+				glog.Errorf("completeMultipartUpload %s upload %s unused part cleanup: %v", *input.Bucket, *input.UploadId, err)
+				return s3err.ErrInternalError
+			}
 			if err := s3a.writeMultipartObject(owner, routeKey, dirName, entryName, completionState.finalParts, func(entry *filer_pb.Entry) {
 				if entry.Extended == nil {
 					entry.Extended = make(map[string][]byte)
@@ -819,34 +898,48 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 					entry.Attributes.Mime = completionState.mime
 				}
 				entry.Attributes.FileSize = uint64(completionState.offset)
-			}); err != nil {
+			}, removal); err != nil {
+				if errors.Is(err, errUploadRemoved) {
+					return s3err.ErrNoSuchUpload
+				}
+				// The transaction may have committed the object before failing on
+				// the upload removal; a surviving entry references the manifests.
+				if exists, err := s3a.exists(dirName, entryName, false); err != nil || exists {
+					completionState.manifestsReferenced = true
+				}
 				glog.Errorf("completeMultipartUpload: failed to create suspended versioning object: %v", err)
 				return s3err.ErrInternalError
 			}
+			completionState.uploadDirRemoved = removal != nil
 
 			// A failed finalize leaves the key reading as deleted, so fail rather than
 			// return 200 — a non-ErrNone finalize keeps the upload directory, so the
 			// caller's retry replays.
 			if err := s3a.finalizeSuspendedNullWrite(owner, *input.Bucket, normalizedKey, s3_constants.SeaweedFSUploadId, *input.UploadId); err != nil {
+				completionState.manifestsReferenced = true
 				glog.Errorf("completeMultipartUpload: failed to retire the null delete marker for %s/%s: %v", *input.Bucket, normalizedKey, err)
 				return s3err.ErrInternalError
 			}
 
 			// Note: Suspended versioning should NOT return VersionId field according to AWS S3 spec
 			output = &CompleteMultipartUploadResult{
-				Location:           aws.String(fmt.Sprintf("%s://%s/%s/%s", getRequestScheme(r), r.Host, url.PathEscape(*input.Bucket), urlPathEscape(*input.Key))),
-				Bucket:             input.Bucket,
-				ETag:               aws.String(etagQuote),
-				Key:                objectKey(input.Key),
-				ChecksumHeaderName: completionState.checksumHeaderName,
-				ChecksumValue:      completionState.checksumValue,
-				ChecksumType:       completionState.checksumType,
+				Location:     aws.String(fmt.Sprintf("%s://%s/%s/%s", getRequestScheme(r), r.Host, url.PathEscape(*input.Bucket), urlPathEscape(*input.Key))),
+				Bucket:       input.Bucket,
+				ETag:         aws.String(etagQuote),
+				Key:          objectKey(input.Key),
+				ChecksumType: completionState.checksumType,
 				// VersionId field intentionally omitted for suspended versioning
 			}
+			output.SetChecksum(completionState.checksumHeaderName, completionState.checksumValue)
 			return s3err.ErrNone
 		}
 
 		// For non-versioned buckets, create main object file
+		removal, err := s3a.routedUploadRemoval(r.Context(), owner, uploadDirectory, *input.Bucket, *input.UploadId, completionState)
+		if err != nil {
+			glog.Errorf("completeMultipartUpload %s upload %s unused part cleanup: %v", *input.Bucket, *input.UploadId, err)
+			return s3err.ErrInternalError
+		}
 		if err := s3a.writeMultipartObject(owner, routeKey, dirName, entryName, completionState.finalParts, func(entry *filer_pb.Entry) {
 			if entry.Extended == nil {
 				entry.Extended = make(map[string][]byte)
@@ -898,21 +991,29 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 			if completionState.entityWithTtl {
 				entry.Extended[s3_constants.SeaweedFSExpiresS3] = []byte("true")
 			}
-		}); err != nil {
+		}, removal); err != nil {
+			if errors.Is(err, errUploadRemoved) {
+				return s3err.ErrNoSuchUpload
+			}
+			// The transaction may have committed the object before failing on
+			// the upload removal; a surviving entry references the manifests.
+			if exists, err := s3a.exists(dirName, entryName, false); err != nil || exists {
+				completionState.manifestsReferenced = true
+			}
 			glog.Errorf("completeMultipartUpload %s/%s error: %v", dirName, entryName, err)
 			return s3err.ErrInternalError
 		}
+		completionState.uploadDirRemoved = removal != nil
 
 		// For non-versioned buckets, return response without VersionId
 		output = &CompleteMultipartUploadResult{
-			Location:           aws.String(fmt.Sprintf("%s://%s/%s/%s", getRequestScheme(r), r.Host, url.PathEscape(*input.Bucket), urlPathEscape(*input.Key))),
-			Bucket:             input.Bucket,
-			ETag:               aws.String(etagQuote),
-			Key:                objectKey(input.Key),
-			ChecksumHeaderName: completionState.checksumHeaderName,
-			ChecksumValue:      completionState.checksumValue,
-			ChecksumType:       completionState.checksumType,
+			Location:     aws.String(fmt.Sprintf("%s://%s/%s/%s", getRequestScheme(r), r.Host, url.PathEscape(*input.Bucket), urlPathEscape(*input.Key))),
+			Bucket:       input.Bucket,
+			ETag:         aws.String(etagQuote),
+			Key:          objectKey(input.Key),
+			ChecksumType: completionState.checksumType,
 		}
+		output.SetChecksum(completionState.checksumHeaderName, completionState.checksumValue)
 		return s3err.ErrNone
 	}
 	var finalizeCode s3err.ErrorCode
@@ -936,14 +1037,19 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 	}
 
 	if completionState != nil {
-		for _, deleteEntry := range completionState.deleteEntries {
-			if err := s3a.rm(uploadDirectory, deleteEntry.Name, !completionState.metadataOnlyCleanup, true); err != nil {
-				glog.Warningf("completeMultipartUpload cleanup %s upload %s unused %s : %v", *input.Bucket, *input.UploadId, deleteEntry.Name, err)
+		if !completionState.uploadDirRemoved {
+			// The object is already committed and the client is still waiting, so the
+			// cleanup below runs on its own context but spends one allowance between
+			// all of it rather than a retry backoff per unused entry.
+			cleanupCtx := withFilerRetryBudget(context.Background(), filerRetryRequestBudget)
+			// Keep the directory when an entry delete failed so its metadata
+			// still references the chunks; removing it metadata-only orphans them.
+			if err := s3a.deleteUnusedPartEntries(cleanupCtx, uploadDirectory, *input.Bucket, *input.UploadId, completionState); err != nil {
+				glog.V(1).Infof("completeMultipartUpload cleanup %s upload %s: %v", *input.Bucket, *input.UploadId, err)
+			} else if err := s3a.rm(cleanupCtx, s3a.genUploadsFolder(*input.Bucket), *input.UploadId, false, true); err != nil {
+				glog.V(1).Infof("completeMultipartUpload cleanup %s upload %s: %v", *input.Bucket, *input.UploadId, err)
 			}
 		}
-		if err := s3a.rm(s3a.genUploadsFolder(*input.Bucket), *input.UploadId, false, true); err != nil {
-			glog.V(1).Infof("completeMultipartUpload cleanup %s upload %s: %v", *input.Bucket, *input.UploadId, err)
-		}
 		if len(completionState.supersededPartManifests) > 0 {
 			s3a.deleteOrphanedChunks(completionState.supersededPartManifests)
 		}
@@ -952,10 +1058,56 @@ func (s3a *S3ApiServer) completeMultipartUpload(r *http.Request, input *s3.Compl
 	return
 }
 
+// deleteUnusedPartEntries frees the part entries the completed object does not
+// reference. A finalize that removes the whole upload directory metadata-only
+// frees them first, or their chunks leak; a failure here must abort the
+// completion, since the surviving entries keep the upload retriable.
+func (s3a *S3ApiServer) deleteUnusedPartEntries(ctx context.Context, uploadDirectory, bucket, uploadId string, completionState *multipartCompletionState) error {
+	var lastErr error
+	for _, deleteEntry := range completionState.deleteEntries {
+		if err := s3a.rm(ctx, uploadDirectory, deleteEntry.Name, !completionState.metadataOnlyCleanup, true); err != nil {
+			glog.Warningf("completeMultipartUpload cleanup %s upload %s unused %s : %v", bucket, uploadId, deleteEntry.Name, err)
+			lastErr = err
+		}
+	}
+	return lastErr
+}
+
+// resumeCommittedObject finds an entry this upload already committed at the
+// regular path when the upload directory is gone. Suspended versioning can
+// leave such an entry hidden behind a delete marker the finalize failed to
+// retire, so re-running it repairs the key and lets the retry succeed. Any
+// other versioning state means a newer write owns the key and the marker must
+// not be demoted.
+func (s3a *S3ApiServer) resumeCommittedObject(r *http.Request, input *s3.CompleteMultipartUploadInput, dirName, entryName string) (*CompleteMultipartUploadResult, s3err.ErrorCode) {
+	entry, err := s3a.getEntry(dirName, entryName)
+	if err != nil {
+		if isFilerNotFound(err) {
+			return nil, s3err.ErrNoSuchUpload
+		}
+		return nil, s3err.ErrInternalError
+	}
+	if entry == nil || string(entry.Extended[s3_constants.SeaweedFSUploadId]) != *input.UploadId {
+		return nil, s3err.ErrNoSuchUpload
+	}
+	state, err := s3a.getVersioningState(*input.Bucket)
+	if err != nil {
+		return nil, s3err.ErrInternalError
+	}
+	if state != s3_constants.VersioningSuspended {
+		return nil, s3err.ErrNoSuchUpload
+	}
+	if err := s3a.finalizeSuspendedNullWrite(s3a.objectWriteOwner(*input.Bucket, *input.Key), *input.Bucket, s3_constants.NormalizeObjectKey(*input.Key), s3_constants.SeaweedFSUploadId, *input.UploadId); err != nil {
+		glog.Errorf("completeMultipartUpload: failed to retire the null delete marker for %s/%s: %v", *input.Bucket, *input.Key, err)
+		return nil, s3err.ErrInternalError
+	}
+	return completeMultipartResult(r, input, getEtagFromEntry(entry), entry), s3err.ErrNone
+}
+
 // Metadata-only: the version file's chunks are the still-registered parts'
 // chunks, which a retried completion needs.
 func (s3a *S3ApiServer) rollbackMultipartVersion(versionDir, versionFileName string) error {
-	return s3a.rmObject(versionDir, versionFileName, false, false)
+	return s3a.rmObject(context.Background(), versionDir, versionFileName, false, false)
 }
 
 func (s3a *S3ApiServer) getEntryNameAndDir(input *s3.CompleteMultipartUploadInput) (string, string) {
@@ -987,22 +1139,136 @@ func (s3a *S3ApiServer) abortMultipartUpload(input *s3.AbortMultipartUploadInput
 
 	glog.V(2).Infof("abortMultipartUpload input %v", input)
 
-	exists, err := s3a.exists(s3a.genUploadsFolder(*input.Bucket), *input.UploadId, true)
+	uploadsFolder := s3a.genUploadsFolder(*input.Bucket)
+	uploadEntry, err := s3a.getEntry(uploadsFolder, *input.UploadId)
 	if err != nil {
-		// filer_pb.Exists reports not-found as (false, nil), so an error here is
-		// always a store failure; answering NoSuchUpload would leak the parts.
+		if isFilerNotFound(err) {
+			return &s3.AbortMultipartUploadOutput{}, s3err.ErrNone
+		}
 		glog.Errorf("bucket %s abort upload %s: %v", *input.Bucket, *input.UploadId, err)
 		return nil, s3err.ErrInternalError
 	}
-	if exists {
-		err = s3a.rm(s3a.genUploadsFolder(*input.Bucket), *input.UploadId, true, true)
-	}
-	if err != nil {
-		glog.V(1).Infof("bucket %s remove upload %s: %v", *input.Bucket, *input.UploadId, err)
-		return nil, s3err.ErrInternalError
+	if uploadEntry == nil {
+		return &s3.AbortMultipartUploadOutput{}, s3err.ErrNone
 	}
 
-	return &s3.AbortMultipartUploadOutput{}, s3err.ErrNone
+	object := string(uploadEntry.Extended[s3_constants.ExtMultipartObjectKey])
+	if object == "" && input.Key != nil {
+		object = *input.Key
+	}
+	return &s3.AbortMultipartUploadOutput{}, s3a.withObjectWriteLock(*input.Bucket, object, nil, func() s3err.ErrorCode {
+		return s3a.removeUploadDir(*input.Bucket, *input.UploadId, object)
+	})
+}
+
+// removeUploadDir removes a leftover upload directory under the object write
+// lock: a directory that outlived the object it completed into shares chunks
+// with it and goes metadata-only; anything else frees the parts' chunks.
+func (s3a *S3ApiServer) removeUploadDir(bucket, uploadId, object string) s3err.ErrorCode {
+	completed, err := s3a.uploadCompleted(s3a.bucketDir(bucket), uploadId, object)
+	if err != nil {
+		glog.Errorf("bucket %s remove upload %s completed check: %v", bucket, uploadId, err)
+		return s3err.ErrInternalError
+	}
+	if completed {
+		if err := s3a.rm(context.Background(), s3a.genUploadsFolder(bucket), uploadId, false, true); err != nil {
+			glog.V(1).Infof("bucket %s remove upload %s: %v", bucket, uploadId, err)
+			return s3err.ErrInternalError
+		}
+		return s3err.ErrNone
+	}
+	return s3a.routedUploadDirDelete(bucket, uploadId, object)
+}
+
+// routedUploadDirDelete frees an open upload's chunks. The delete rides an
+// ObjectTransaction on the object's lock key, so a racing routed commit either
+// fails its upload-exists precondition afterwards or has already stamped the
+// object — the condition then rejects the data delete and it falls back to
+// metadata-only. With no owner there is no routed commit to exclude, and the
+// caller's object write lock already serializes the mkFile fallback.
+func (s3a *S3ApiServer) routedUploadDirDelete(bucket, uploadId, object string) s3err.ErrorCode {
+	uploadsFolder := s3a.genUploadsFolder(bucket)
+	rmUploadDir := func(isDeleteData bool) s3err.ErrorCode {
+		if err := s3a.rm(context.Background(), uploadsFolder, uploadId, isDeleteData, true); err != nil {
+			glog.V(1).Infof("bucket %s remove upload %s: %v", bucket, uploadId, err)
+			return s3err.ErrInternalError
+		}
+		return s3err.ErrNone
+	}
+	if object == "" {
+		return rmUploadDir(true)
+	}
+	owner := s3a.objectWriteOwner(bucket, object)
+	if owner == "" {
+		return rmUploadDir(true)
+	}
+	objectPath := s3a.toFilerPath(bucket, object)
+	resp, err := s3a.objectTxnOnFiler(owner, &filer_pb.ObjectTransactionRequest{
+		LockKey:      objectPath,
+		RouteKey:     s3a.objectRouteKey(bucket, object),
+		ConditionKey: objectPath,
+		Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{{
+			Kind:     filer_pb.WriteCondition_IF_EXTENDED_NOT_EQUAL,
+			ExtKey:   s3_constants.SeaweedFSUploadId,
+			ExtValue: uploadId,
+		}}},
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type:         filer_pb.ObjectMutation_DELETE,
+			Directory:    uploadsFolder,
+			Name:         uploadId,
+			IsDeleteData: true,
+			IsRecursive:  true,
+		}},
+	})
+	if err != nil {
+		glog.Errorf("bucket %s abort upload %s transaction: %v", bucket, uploadId, err)
+		return s3err.ErrInternalError
+	}
+	if resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED {
+		return rmUploadDir(false)
+	}
+	if resp.Error != "" {
+		glog.Errorf("bucket %s abort upload %s transaction: %s", bucket, uploadId, resp.Error)
+		return s3err.ErrInternalError
+	}
+	return s3err.ErrNone
+}
+
+// uploadCompleted reports whether the upload assembled into an object: the
+// object entry, or any version file under <key>.versions, still carries the
+// upload id completion stamps on it.
+func (s3a *S3ApiServer) uploadCompleted(bucketDir, uploadId, objectKey string) (bool, error) {
+	if objectKey == "" {
+		return false, nil
+	}
+	name := path.Base(objectKey)
+	dir := path.Dir(objectKey)
+	if dir == "." {
+		dir = ""
+	}
+	objectDir := path.Join(bucketDir, dir)
+
+	entry, err := s3a.getEntry(objectDir, name)
+	if err != nil && !isFilerNotFound(err) {
+		return false, err
+	}
+	if entry != nil && string(entry.Extended[s3_constants.SeaweedFSUploadId]) == uploadId {
+		return true, nil
+	}
+
+	versions, _, err := s3a.list(objectDir+"/"+name+s3_constants.VersionsFolder, "", "", false, math.MaxInt32)
+	if err != nil {
+		if isFilerNotFound(err) {
+			return false, nil
+		}
+		return false, err
+	}
+	for _, version := range versions {
+		if string(version.Extended[s3_constants.SeaweedFSUploadId]) == uploadId {
+			return true, nil
+		}
+	}
+	return false, nil
 }
 
 type ListMultipartUploadsResult struct {
@@ -1027,52 +1293,172 @@ func (s3a *S3ApiServer) listMultipartUploads(input *s3.ListMultipartUploadsInput
 
 	glog.V(2).Infof("listMultipartUploads input %v", input)
 
-	output = &ListMultipartUploadsResult{
-		Bucket:       input.Bucket,
-		Delimiter:    input.Delimiter,
-		EncodingType: input.EncodingType,
-		KeyMarker:    input.KeyMarker,
-		MaxUploads:   input.MaxUploads,
-		Prefix:       input.Prefix,
-		IsTruncated:  aws.Bool(false),
-	}
-
-	entries, _, err := s3a.list(s3a.genUploadsFolder(*input.Bucket), "", *input.UploadIdMarker, false, math.MaxInt32)
+	uploadsFolder := s3a.genUploadsFolder(*input.Bucket)
+	var page *multipartUploadPage
+	err := listRetry(uploadsFolder, func() error {
+		page = newMultipartUploadPage(input)
+		return filer_pb.List(context.Background(), s3a, uploadsFolder, "", func(entry *filer_pb.Entry, isLastEntry bool) error {
+			page.add(entry)
+			return nil
+		}, "", false, math.MaxInt32)
+	})
 	if err != nil {
 		// A missing .uploads folder normally lists as empty with no error; a
 		// store that reports it as not-found still means an empty list.
-		if isFilerListNotFound(err) {
-			return output, s3err.ErrNone
+		if isFilerNotFound(err) {
+			return selectMultipartUploads(input, nil), s3err.ErrNone
 		}
 		// surface a real store error; a masked empty 200 makes a resuming client treat the upload as gone
 		glog.Errorf("listMultipartUploads %s error: %v", *input.Bucket, err)
-		return output, s3err.ErrInternalError
+		return nil, s3err.ErrInternalError
 	}
 
-	uploadsCount := int64(0)
+	return page.result(), s3err.ErrNone
+}
+
+// selectMultipartUploads orders uploads by key, then by upload id, and resumes
+// after the (key-marker, upload-id-marker) position, so an aborted marker
+// upload does not hide the rest of its key.
+func selectMultipartUploads(input *s3.ListMultipartUploadsInput, entries []*filer_pb.Entry) *ListMultipartUploadsResult {
+	page := newMultipartUploadPage(input)
 	for _, entry := range entries {
-		if entry.Extended != nil {
-			key := string(entry.Extended[s3_constants.ExtMultipartObjectKey])
-			if *input.KeyMarker != "" && *input.KeyMarker != key {
-				continue
-			}
-			if *input.Prefix != "" && !strings.HasPrefix(key, *input.Prefix) {
-				continue
-			}
-			output.Upload = append(output.Upload, &s3.MultipartUpload{
-				Key:      objectKey(aws.String(key)),
-				UploadId: aws.String(entry.Name),
-			})
-			uploadsCount += 1
-		}
-		if uploadsCount >= *input.MaxUploads {
-			output.IsTruncated = aws.Bool(true)
-			output.NextUploadIdMarker = aws.String(entry.Name)
-			break
-		}
+		page.add(entry)
 	}
+	return page.result()
+}
 
-	return
+// multipartUploadPage accumulates one page of a ListMultipartUploads result.
+// Upload order is the object key kept in extended attributes, not the upload
+// id the filer sorts by, so every entry has to be seen; keeping only the
+// maxUploads smallest candidates bounds the heap by the page, not the folder.
+type multipartUploadPage struct {
+	input *s3.ListMultipartUploadsInput
+	limit int
+	top   candidateHeap
+	more  bool
+}
+
+type multipartCandidate struct {
+	key   string
+	entry *filer_pb.Entry
+}
+
+func compareMultipartCandidate(a, b multipartCandidate) int {
+	return cmp.Or(strings.Compare(a.key, b.key), strings.Compare(a.entry.Name, b.entry.Name))
+}
+
+// candidateHeap is a max-heap on (key, upload id): the root sorts last of the
+// candidates held, so popping it keeps the page's smallest entries.
+type candidateHeap []multipartCandidate
+
+func (h candidateHeap) Len() int { return len(h) }
+func (h candidateHeap) Less(i, j int) bool {
+	return compareMultipartCandidate(h[i], h[j]) > 0
+}
+func (h candidateHeap) Swap(i, j int) { h[i], h[j] = h[j], h[i] }
+func (h *candidateHeap) Push(x any)   { *h = append(*h, x.(multipartCandidate)) }
+func (h *candidateHeap) Pop() any {
+	old := *h
+	n := len(old)
+	*h = old[:n-1]
+	return old[n-1]
+}
+
+func newMultipartUploadPage(input *s3.ListMultipartUploadsInput) *multipartUploadPage {
+	limit := maxUploadsList
+	if *input.MaxUploads < int64(limit) {
+		limit = int(*input.MaxUploads)
+	}
+	return &multipartUploadPage{input: input, limit: limit}
+}
+
+func (p *multipartUploadPage) add(entry *filer_pb.Entry) {
+	if p.limit <= 0 || !isMultipartUploadEntry(entry) {
+		return
+	}
+	input := p.input
+	key := *objectKey(aws.String(string(entry.Extended[s3_constants.ExtMultipartObjectKey])))
+	if *input.Prefix != "" && !strings.HasPrefix(key, *input.Prefix) {
+		return
+	}
+	if *input.KeyMarker != "" && (key < *input.KeyMarker || key == *input.KeyMarker && (*input.UploadIdMarker == "" || entry.Name <= *input.UploadIdMarker)) {
+		return
+	}
+	c := multipartCandidate{key: key, entry: entry}
+	if p.top.Len() >= p.limit {
+		p.more = true
+		if compareMultipartCandidate(c, p.top[0]) >= 0 {
+			return
+		}
+		heap.Pop(&p.top)
+	}
+	heap.Push(&p.top, c)
+}
+
+func (p *multipartUploadPage) result() *ListMultipartUploadsResult {
+	input := p.input
+	output := &ListMultipartUploadsResult{
+		Bucket:         input.Bucket,
+		Delimiter:      input.Delimiter,
+		KeyMarker:      input.KeyMarker,
+		MaxUploads:     aws.Int64(int64(p.limit)),
+		Prefix:         input.Prefix,
+		UploadIdMarker: input.UploadIdMarker,
+		IsTruncated:    aws.Bool(false),
+	}
+	candidates := make([]multipartCandidate, len(p.top))
+	copy(candidates, p.top)
+	slices.SortFunc(candidates, compareMultipartCandidate)
+	for _, c := range candidates {
+		upload := &s3.MultipartUpload{
+			Key:      aws.String(c.key),
+			UploadId: aws.String(c.entry.Name),
+		}
+		if c.entry.Attributes != nil {
+			upload.Initiated = aws.Time(time.Unix(c.entry.Attributes.Crtime, int64(c.entry.Attributes.CrtimeNs)))
+		}
+		output.Upload = append(output.Upload, upload)
+	}
+	if p.more {
+		last := candidates[len(candidates)-1]
+		output.IsTruncated = aws.Bool(true)
+		output.NextKeyMarker, output.NextUploadIdMarker = aws.String(last.key), aws.String(last.entry.Name)
+	}
+	if aws.StringValue(input.EncodingType) == s3.EncodingTypeUrl {
+		// AWS url-encodes these key-named elements when encoding-type=url is
+		// requested; without it XML 1.0 cannot carry the keys at all and the
+		// encoder replaces their characters with U+FFFD.
+		output.EncodingType = input.EncodingType
+		output.Delimiter = encodeMultipartUploadURLField(output.Delimiter)
+		output.Prefix = encodeMultipartUploadURLField(output.Prefix)
+		output.KeyMarker = encodeMultipartUploadURLField(output.KeyMarker)
+		output.NextKeyMarker = encodeMultipartUploadURLField(output.NextKeyMarker)
+		for _, upload := range output.Upload {
+			upload.Key = encodeMultipartUploadURLField(upload.Key)
+		}
+	} else {
+		output.KeyMarker = encodeListContinuationTokenField(output.KeyMarker)
+		output.NextKeyMarker = encodeListContinuationTokenField(output.NextKeyMarker)
+	}
+	return output
+}
+
+// urlQueryEscape url-encodes key text per segment: every "/"-separated part is
+// query-escaped and the separators are kept, so a client recovers the exact key
+// with url.QueryUnescape.
+func urlQueryEscape(key string) string {
+	segments := strings.Split(key, "/")
+	for i, segment := range segments {
+		segments[i] = url.QueryEscape(segment)
+	}
+	return strings.Join(segments, "/")
+}
+
+func encodeMultipartUploadURLField(value *string) *string {
+	if value == nil {
+		return nil
+	}
+	return aws.String(urlQueryEscape(*value))
 }
 
 type ListPartsResult struct {
@@ -1095,6 +1481,23 @@ func (s3a *S3ApiServer) listObjectParts(input *s3.ListPartsInput) (output *ListP
 
 	glog.V(2).Infof("listObjectParts input %v", input)
 
+	// complete/abort delete the upload directory, but most stores list a missing
+	// directory as empty instead of erroring, so listing alone cannot tell a
+	// completed upload (NoSuchUpload on AWS) from an open upload with no parts
+	// yet (200 with an empty list). Probe the upload record instead.
+	pentry, err := s3a.getEntry(s3a.genUploadsFolder(*input.Bucket), *input.UploadId)
+	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			return nil, s3err.ErrNoSuchUpload
+		}
+		glog.Errorf("listObjectParts %s %s error: %v", *input.Bucket, *input.UploadId, err)
+		return nil, s3err.ErrInternalError
+	}
+	// only createMultipartUpload stamps the key; a directory a part write left behind is not an upload
+	if !isMultipartUploadEntry(pentry) {
+		return nil, s3err.ErrNoSuchUpload
+	}
+
 	output = &ListPartsResult{
 		Bucket:           input.Bucket,
 		Key:              objectKey(input.Key),
@@ -1104,11 +1507,19 @@ func (s3a *S3ApiServer) listObjectParts(input *s3.ListPartsInput) (output *ListP
 		StorageClass:     aws.String("STANDARD"),
 	}
 
-	entries, isLast, err := s3a.list(s3a.genUploadsFolder(*input.Bucket)+"/"+*input.UploadId, "", fmt.Sprintf("%04d%s", *input.PartNumberMarker, multipartExt), false, uint32(*input.MaxParts))
+	// part files are "%04d_<uuid>.part" (legacy "%04d.part"). '_' sorts after
+	// '.', so an exclusive start at "%04d.part" still returns the marker part
+	// and a page of max-parts=1 never advances. The next part number sorts
+	// past both name shapes of the marker part.
+	if *input.PartNumberMarker >= math.MaxInt64 {
+		output.IsTruncated = aws.Bool(false)
+		return output, s3err.ErrNone
+	}
+	entries, isLast, err := s3a.list(s3a.genUploadsFolder(*input.Bucket)+"/"+*input.UploadId, "", fmt.Sprintf("%04d", *input.PartNumberMarker+1), true, uint32(*input.MaxParts))
 	if err != nil {
 		// A store that reports the missing upload directory as not-found means
 		// the upload is gone (completed or aborted), not a store error.
-		if isFilerListNotFound(err) {
+		if isFilerNotFound(err) {
 			return nil, s3err.ErrNoSuchUpload
 		}
 		glog.Errorf("listObjectParts %s %s error: %v", *input.Bucket, *input.UploadId, err)
@@ -1127,6 +1538,10 @@ func (s3a *S3ApiServer) listObjectParts(input *s3.ListPartsInput) (output *ListP
 				glog.Errorf("listObjectParts %s %s parse %s: %v", *input.Bucket, *input.UploadId, entry.Name, err)
 				continue
 			}
+			// the marker is exclusive even if a store ignores startFrom
+			if partNumber <= int(*input.PartNumberMarker) {
+				continue
+			}
 
 			partETag := getEtagFromEntry(entry)
 			part := &s3.Part{
@@ -1144,6 +1559,12 @@ func (s3a *S3ApiServer) listObjectParts(input *s3.ListPartsInput) (output *ListP
 		}
 	}
 
+	// a page that surfaced no parts has no next page to claim
+	if len(output.Part) == 0 {
+		output.IsTruncated = aws.Bool(false)
+		output.NextPartNumberMarker = nil
+	}
+
 	glog.V(2).Infof("listObjectParts: Returning %d parts for uploadId=%s", len(output.Part), *input.UploadId)
 	return
 }
diff --git a/weed/s3api/filer_multipart_abort_test.go b/weed/s3api/filer_multipart_abort_test.go
new file mode 100644
index 0000000000..37f3945afd
--- /dev/null
+++ b/weed/s3api/filer_multipart_abort_test.go
@@ -0,0 +1,261 @@
+package s3api
+
+import (
+	"context"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/s3_lifecycle_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// fakeAbortFiler answers the three calls abortMultipartUpload makes: the
+// .uploads/<id> record lookup, the completed-object lookup, the .versions
+// listing, and records the DeleteEntry request it receives.
+type fakeAbortFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	uploadsDir  string
+	uploadEntry *filer_pb.Entry
+	objectDir   string
+	objectName  string
+	objectEntry *filer_pb.Entry
+	objectErr   error
+	versionsDir string
+	versions    []*filer_pb.Entry
+	listErr     error
+	deleteReq   *filer_pb.DeleteEntryRequest
+}
+
+func (f *fakeAbortFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	switch req.Directory {
+	case f.uploadsDir:
+		if f.uploadEntry != nil && req.Name == f.uploadEntry.Name {
+			return &filer_pb.LookupDirectoryEntryResponse{Entry: f.uploadEntry}, nil
+		}
+		return nil, filer_pb.ErrNotFound
+	case f.objectDir:
+		if f.objectErr != nil {
+			return nil, f.objectErr
+		}
+		if req.Name == f.objectName && f.objectEntry != nil {
+			return &filer_pb.LookupDirectoryEntryResponse{Entry: f.objectEntry}, nil
+		}
+		return nil, filer_pb.ErrNotFound
+	}
+	return nil, status.Errorf(codes.Internal, "unexpected lookup in %s", req.Directory)
+}
+
+func (f *fakeAbortFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	if req.Directory != f.versionsDir {
+		return status.Errorf(codes.Internal, "unexpected listing of %s", req.Directory)
+	}
+	if f.listErr != nil {
+		return f.listErr
+	}
+	for _, entry := range f.versions {
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: entry}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (f *fakeAbortFiler) DeleteEntry(ctx context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	f.deleteReq = req
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+func newAbortTestServer(t *testing.T, f *fakeAbortFiler) *S3ApiServer {
+	t.Helper()
+	bucketDir := (&S3ApiServer{option: &S3ApiServerOption{}}).bucketDir("b")
+	f.uploadsDir = bucketDir + "/" + s3_constants.MultipartUploadsFolder
+	f.objectDir = bucketDir
+	f.objectName = "a.bin"
+	f.versionsDir = bucketDir + "/a.bin" + s3_constants.VersionsFolder
+	return newFailoverTestServer(t, startFakeFiler(t, f))
+}
+
+func abortInput(uploadId string) *s3.AbortMultipartUploadInput {
+	return &s3.AbortMultipartUploadInput{
+		Bucket:   aws.String("b"),
+		Key:      aws.String("a.bin"),
+		UploadId: aws.String(uploadId),
+	}
+}
+
+func versionEntry(name, uploadId string) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Name:     name,
+		Extended: map[string][]byte{s3_constants.SeaweedFSUploadId: []byte(uploadId)},
+	}
+}
+
+// A leftover .uploads/<id> whose object entry still carries the upload id
+// shares chunks with that object; abort must drop the metadata only.
+func TestAbortCompletedUploadDeletesMetadataOnly(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: uploadRecordEntry("up1"),
+		objectEntry: versionEntry("a.bin", "up1"),
+	}
+	s3a := newAbortTestServer(t, f)
+
+	_, code := s3a.abortMultipartUpload(abortInput("up1"))
+
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if f.deleteReq == nil || f.deleteReq.IsDeleteData {
+		t.Fatalf("deleteReq = %+v, want IsDeleteData=false", f.deleteReq)
+	}
+}
+
+// A version file carrying the upload id is the same case: the versioned
+// object's chunks are the part chunks.
+func TestAbortCompletedVersionDeletesMetadataOnly(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: uploadRecordEntry("up1"),
+		versions:    []*filer_pb.Entry{versionEntry("v_123", "up1")},
+	}
+	s3a := newAbortTestServer(t, f)
+
+	_, code := s3a.abortMultipartUpload(abortInput("up1"))
+
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if f.deleteReq == nil || f.deleteReq.IsDeleteData {
+		t.Fatalf("deleteReq = %+v, want IsDeleteData=false", f.deleteReq)
+	}
+}
+
+// An upload record missing its object-key stamp can still have completed;
+// the abort's Key is the fallback lookup path.
+func TestAbortCompletedUploadWithoutRecordedKey(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: &filer_pb.Entry{Name: "up1", IsDirectory: true},
+		objectEntry: versionEntry("a.bin", "up1"),
+	}
+	s3a := newAbortTestServer(t, f)
+
+	_, code := s3a.abortMultipartUpload(abortInput("up1"))
+
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if f.deleteReq == nil || f.deleteReq.IsDeleteData {
+		t.Fatalf("deleteReq = %+v, want IsDeleteData=false", f.deleteReq)
+	}
+}
+
+// An upload that never completed owns its part chunks; abort frees them.
+func TestAbortOpenUploadDeletesData(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: uploadRecordEntry("up1"),
+		objectEntry: versionEntry("a.bin", "other-upload"),
+	}
+	s3a := newAbortTestServer(t, f)
+
+	_, code := s3a.abortMultipartUpload(abortInput("up1"))
+
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if f.deleteReq == nil || !f.deleteReq.IsDeleteData {
+		t.Fatalf("deleteReq = %+v, want IsDeleteData=true", f.deleteReq)
+	}
+}
+
+// When the completed check cannot decide, abort must refuse rather than
+// risk freeing chunks a live object references.
+func TestAbortUndecidableCheckRefuses(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: uploadRecordEntry("up1"),
+		objectErr:   status.Error(codes.Unavailable, "store down"),
+	}
+	s3a := newAbortTestServer(t, f)
+
+	_, code := s3a.abortMultipartUpload(abortInput("up1"))
+
+	if code != s3err.ErrInternalError {
+		t.Fatalf("code = %v, want ErrInternalError", code)
+	}
+	if f.deleteReq != nil {
+		t.Fatalf("delete issued despite undecidable check: %+v", f.deleteReq)
+	}
+}
+
+// No upload directory at all answers success, the same as before.
+func TestAbortGoneUploadAnswersSuccess(t *testing.T) {
+	s3a := newAbortTestServer(t, &fakeAbortFiler{})
+
+	_, code := s3a.abortMultipartUpload(abortInput("gone"))
+
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+}
+
+// A failed .versions listing is undecidable the same way a failed object
+// lookup is: refuse instead of guessing.
+func TestAbortVersionsListErrorRefuses(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: uploadRecordEntry("up1"),
+		listErr:     status.Error(codes.Internal, "store down"),
+	}
+	s3a := newAbortTestServer(t, f)
+
+	_, code := s3a.abortMultipartUpload(abortInput("up1"))
+
+	if code != s3err.ErrInternalError {
+		t.Fatalf("code = %v, want ErrInternalError", code)
+	}
+	if f.deleteReq != nil {
+		t.Fatalf("delete issued despite undecidable check: %+v", f.deleteReq)
+	}
+}
+
+func lifecycleAbortRequest(uploadId string) *s3_lifecycle_pb.LifecycleDeleteRequest {
+	return &s3_lifecycle_pb.LifecycleDeleteRequest{
+		Bucket:     "b",
+		ObjectPath: s3_constants.MultipartUploadsFolder + "/" + uploadId,
+	}
+}
+
+func TestLifecycleAbortCompletedUploadDeletesMetadataOnly(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: uploadRecordEntry("up1"),
+		objectEntry: versionEntry("a.bin", "up1"),
+	}
+	s3a := newAbortTestServer(t, f)
+
+	resp, err := s3a.lifecycleAbortMPU(context.Background(), lifecycleAbortRequest("up1"))
+
+	if err != nil || resp.Outcome != s3_lifecycle_pb.LifecycleDeleteOutcome_DONE {
+		t.Fatalf("resp = %v, err = %v, want DONE", resp, err)
+	}
+	if f.deleteReq == nil || f.deleteReq.IsDeleteData {
+		t.Fatalf("deleteReq = %+v, want IsDeleteData=false", f.deleteReq)
+	}
+}
+
+func TestLifecycleAbortUndecidableCheckRetriesLater(t *testing.T) {
+	f := &fakeAbortFiler{
+		uploadEntry: uploadRecordEntry("up1"),
+		objectErr:   status.Error(codes.Unavailable, "store down"),
+	}
+	s3a := newAbortTestServer(t, f)
+
+	resp, err := s3a.lifecycleAbortMPU(context.Background(), lifecycleAbortRequest("up1"))
+
+	if err != nil || resp.Outcome != s3_lifecycle_pb.LifecycleDeleteOutcome_RETRY_LATER {
+		t.Fatalf("resp = %v, err = %v, want RETRY_LATER", resp, err)
+	}
+	if f.deleteReq != nil {
+		t.Fatalf("delete issued despite undecidable check: %+v", f.deleteReq)
+	}
+}
diff --git a/weed/s3api/filer_multipart_checksum_test.go b/weed/s3api/filer_multipart_checksum_test.go
index f0558e8f18..02a0f738b3 100644
--- a/weed/s3api/filer_multipart_checksum_test.go
+++ b/weed/s3api/filer_multipart_checksum_test.go
@@ -4,11 +4,17 @@ import (
 	"bytes"
 	"encoding/base64"
 	"hash/crc32"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
 
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/minio/crc64nvme"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 )
 
 func makeCRC64NVMEPartEntry(data []byte) *filer_pb.Entry {
@@ -144,3 +150,57 @@ func TestResolveMultipartChecksumType(t *testing.T) {
 		})
 	}
 }
+
+// CompleteMultipartUpload returns the object checksum in the XML body, where the
+// AWS SDKs read it from — not as an HTTP response header.
+func TestCompleteMultipartUploadResultChecksumXML(t *testing.T) {
+	result := &CompleteMultipartUploadResult{
+		ETag:         aws.String("\"etag-1\""),
+		ChecksumType: s3_constants.ChecksumTypeComposite,
+	}
+	result.SetChecksum(s3_constants.AmzChecksumCRC32C, "fx4FQw==-1")
+
+	encoded := string(s3err.EncodeXMLResponse(result))
+	for _, want := range []string{
+		"<ChecksumCRC32C>fx4FQw==-1</ChecksumCRC32C>",
+		"<ChecksumType>COMPOSITE</ChecksumType>",
+	} {
+		if !strings.Contains(encoded, want) {
+			t.Fatalf("response %q does not contain %q", encoded, want)
+		}
+	}
+	if strings.Contains(encoded, "<ChecksumCRC32>") {
+		t.Fatalf("response %q carries an unrequested algorithm", encoded)
+	}
+}
+
+// A retried CompleteMultipartUpload rebuilds the response from the committed
+// entry, so it must repeat the checksum the first attempt returned.
+func TestCompleteMultipartResultChecksumFromEntry(t *testing.T) {
+	input := &s3.CompleteMultipartUploadInput{Bucket: aws.String("bucket"), Key: aws.String("key")}
+	entry := &filer_pb.Entry{Extended: map[string][]byte{
+		s3_constants.ExtChecksumAlgorithm: []byte(s3_constants.AmzChecksumCRC32C),
+		s3_constants.ExtChecksumValue:     []byte("fx4FQw==-1"),
+		s3_constants.ExtChecksumType:      []byte(s3_constants.ChecksumTypeComposite),
+	}}
+
+	result := completeMultipartResult(httptest.NewRequest(http.MethodPost, "/bucket/key", nil), input, "\"etag-1\"", entry)
+	if result.ChecksumCRC32C != "fx4FQw==-1" {
+		t.Fatalf("ChecksumCRC32C = %q, want %q", result.ChecksumCRC32C, "fx4FQw==-1")
+	}
+	if result.ChecksumType != s3_constants.ChecksumTypeComposite {
+		t.Fatalf("ChecksumType = %q, want %q", result.ChecksumType, s3_constants.ChecksumTypeComposite)
+	}
+}
+
+// CreateMultipartUpload echoes the algorithm and type it recorded, so a client
+// can tell which checksum the upload will be completed with.
+func TestCreateMultipartUploadResultChecksumHeaders(t *testing.T) {
+	result := &InitiateMultipartUploadResult{
+		ChecksumAlgorithm: "CRC32C",
+		ChecksumType:      s3_constants.ChecksumTypeComposite,
+	}
+	if encoded := string(s3err.EncodeXMLResponse(result)); strings.Contains(encoded, "Checksum") {
+		t.Fatalf("response %q carries checksum members in the XML body", encoded)
+	}
+}
diff --git a/weed/s3api/filer_multipart_initiate_acl_test.go b/weed/s3api/filer_multipart_initiate_acl_test.go
new file mode 100644
index 0000000000..8f5dc43e3b
--- /dev/null
+++ b/weed/s3api/filer_multipart_initiate_acl_test.go
@@ -0,0 +1,126 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseS3MetadataIgnoresInternalAclHeaders(t *testing.T) {
+	req := httptest.NewRequest(http.MethodPost, "http://s3/b/o?uploads", nil)
+	req.Header.Set(s3_constants.ExtAmzAclKey, `[{"Grantee":{"Type":"Group","URI":"http://acs.amazonaws.com/groups/global/AllUsers"},"Permission":"READ"}]`)
+	req.Header.Set(s3_constants.ExtAmzOwnerKey, "forged-owner")
+	req.Header.Set("X-Amz-Meta-Color", "red")
+
+	metadata, code := ParseS3Metadata(req, nil, false)
+	require.Equal(t, s3err.ErrNone, code)
+	require.NotContains(t, metadata, s3_constants.ExtAmzAclKey)
+	require.NotContains(t, metadata, s3_constants.ExtAmzOwnerKey)
+	require.Equal(t, "red", string(metadata["X-Amz-Meta-Color"]))
+}
+
+// Multipart initiation previously trusted the internal Seaweed-X-Amz-*
+// headers, so a caller could forge ownership or a public ACL onto the
+// completed object without s3:PutObjectAcl. Initiate must run the same ACL
+// validation as PUT and store only the validated grants.
+func TestNewMultipartUploadInitiateACL(t *testing.T) {
+	const bucket, object, writer, bucketOwner = "mpu-bucket", "dir/blob.bin", "mpu-writer", "bucket-owner"
+	forgedACL := `[{"Grantee":{"Type":"Group","URI":"http://acs.amazonaws.com/groups/global/AllUsers"},"Permission":"READ"}]`
+
+	setup := func(t *testing.T, writeAcp bool) (*S3ApiServer, *ambiguousPutFiler) {
+		volume := startFakeVolumeServer(t)
+		f := &ambiguousPutFiler{volume: volume, apply: true, entries: map[string]*filer_pb.Entry{}}
+		s3a := newPutTestServer(t, startFakeFiler(t, f))
+		s3a.iam = NewIdentityAccessManagementWithStore(s3a.option, nil, "memory")
+		t.Cleanup(s3a.iam.Shutdown)
+		s3a.iam.isAuthEnabled = true
+		account := &Account{Id: writer, DisplayName: writer}
+		identity := &Identity{Name: "mpu-acl-test", Account: account, IsStatic: true,
+			Actions:     []Action{"Write:" + bucket + "/*"},
+			Credentials: []*Credential{{AccessKey: routingTestAccessKey, SecretKey: routingTestSecretKey}}}
+		if writeAcp {
+			identity.Actions = append(identity.Actions, Action("WriteAcp:"+bucket+"/*"))
+		}
+		s3a.iam.accessKeyIdent[routingTestAccessKey] = identity
+		s3a.iam.nameToIdentity[identity.Name] = identity
+		s3a.iam.accounts[writer] = account
+		s3a.iam.accounts[bucketOwner] = &Account{Id: bucketOwner, DisplayName: bucketOwner}
+		bucketEntry := &filer_pb.Entry{Name: bucket, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{},
+			Extended: map[string][]byte{s3_constants.ExtAmzOwnerKey: []byte(bucketOwner)}}
+		bucketEntry.Extended[s3_constants.ExtOwnershipKey] = []byte(s3_constants.OwnershipObjectWriter)
+		f.entries["/buckets/"+bucket] = bucketEntry
+		s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+		s3a.bucketConfigCache.Set(bucket, &BucketConfig{Name: bucket, Owner: bucketOwner, Ownership: s3_constants.OwnershipObjectWriter})
+		return s3a, f
+	}
+
+	initiate := func(t *testing.T, s3a *S3ApiServer, headers map[string]string) *httptest.ResponseRecorder {
+		req := httptest.NewRequest(http.MethodPost, "http://s3/"+bucket+"/"+object+"?uploads", nil)
+		req = mux.SetURLVars(req, map[string]string{"bucket": bucket, "object": object})
+		for k, v := range headers {
+			req.Header.Set(k, v)
+		}
+		signRoutingTestRequest(t, req, "", "s3")
+		rr := httptest.NewRecorder()
+		s3a.iam.Auth(s3a.NewMultipartUploadHandler, s3_constants.ACTION_WRITE)(rr, req)
+		return rr
+	}
+
+	uploadEntry := func(t *testing.T, f *ambiguousPutFiler) *filer_pb.Entry {
+		t.Helper()
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		prefix := "/buckets/" + bucket + "/" + s3_constants.MultipartUploadsFolder + "/"
+		for key, entry := range f.entries {
+			if strings.HasPrefix(key, prefix) {
+				return entry
+			}
+		}
+		t.Fatalf("no upload entry recorded under %s", prefix)
+		return nil
+	}
+
+	t.Run("forged internal headers are ignored", func(t *testing.T) {
+		s3a, f := setup(t, false)
+		rr := initiate(t, s3a, map[string]string{
+			s3_constants.ExtAmzAclKey:   forgedACL,
+			s3_constants.ExtAmzOwnerKey: "forged-owner",
+		})
+		require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+		entry := uploadEntry(t, f)
+		require.Equal(t, writer, string(entry.Extended[s3_constants.ExtAmzOwnerKey]))
+		require.NotEqual(t, forgedACL, string(entry.Extended[s3_constants.ExtAmzAclKey]))
+		for _, grant := range GetAcpGrants(entry.Extended) {
+			require.Nil(t, grant.Grantee.URI)
+		}
+	})
+
+	t.Run("explicit acl requires write acp", func(t *testing.T) {
+		s3a, f := setup(t, false)
+		rr := initiate(t, s3a, map[string]string{s3_constants.AmzCannedAcl: "public-read"})
+		require.Equal(t, http.StatusForbidden, rr.Code, rr.Body.String())
+		require.Empty(t, f.entries["/buckets/"+bucket+"/"+s3_constants.MultipartUploadsFolder])
+	})
+
+	t.Run("explicit acl lands on upload entry", func(t *testing.T) {
+		s3a, f := setup(t, true)
+		rr := initiate(t, s3a, map[string]string{s3_constants.AmzCannedAcl: "public-read"})
+		require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+		grants := GetAcpGrants(uploadEntry(t, f).Extended)
+		var publicRead bool
+		for _, grant := range grants {
+			if grant.Grantee.URI != nil && *grant.Grantee.URI == "http://acs.amazonaws.com/groups/global/AllUsers" && grant.Permission != nil && *grant.Permission == "READ" {
+				publicRead = true
+			}
+		}
+		require.True(t, publicRead, "public-read grants should persist on the upload entry: %s", string(uploadEntry(t, f).Extended[s3_constants.ExtAmzAclKey]))
+	})
+}
diff --git a/weed/s3api/filer_multipart_list_encoding_test.go b/weed/s3api/filer_multipart_list_encoding_test.go
new file mode 100644
index 0000000000..2449c10585
--- /dev/null
+++ b/weed/s3api/filer_multipart_list_encoding_test.go
@@ -0,0 +1,76 @@
+package s3api
+
+import (
+	"encoding/xml"
+	"net/url"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// With encoding-type=url the upload keys have to be url-encoded, as ListObjects
+// does; otherwise XML 1.0 cannot carry a key with a control character, the
+// encoder turns it into U+FFFD, and no client can recover the key to abort the
+// upload.
+func TestSelectMultipartUploadsEncodingTypeURL(t *testing.T) {
+	entries := []*filer_pb.Entry{
+		uploadEntry("1", "m\x01p b+.bin", 10),
+		uploadEntry("2", "plain/key.txt", 20),
+	}
+	input := listUploadsInput("m\x01", "m\x01", "", 1000)
+	input.EncodingType = aws.String(s3.EncodingTypeUrl)
+	out := selectMultipartUploads(input, entries)
+
+	require.Len(t, out.Upload, 1)
+	assert.Equal(t, "m%01p+b%2B.bin", *out.Upload[0].Key)
+	decoded, err := url.QueryUnescape(*out.Upload[0].Key)
+	require.NoError(t, err)
+	assert.Equal(t, "m\x01p b+.bin", decoded)
+	assert.Equal(t, "m%01", *out.Prefix)
+	assert.Equal(t, "m%01", *out.KeyMarker)
+
+	body, err := xml.Marshal(out)
+	require.NoError(t, err)
+	assert.NotContains(t, string(body), "\uFFFD")
+	assert.Contains(t, string(body), "<Key>m%01p+b%2B.bin</Key>")
+	assert.Contains(t, string(body), "<EncodingType>url</EncodingType>")
+}
+
+func TestSelectMultipartUploadsEncodingTypeURLNextKeyMarker(t *testing.T) {
+	entries := []*filer_pb.Entry{
+		uploadEntry("1", "a\x1fb", 10),
+		uploadEntry("2", "c", 20),
+	}
+	input := listUploadsInput("", "", "", 1)
+	input.EncodingType = aws.String(s3.EncodingTypeUrl)
+	out := selectMultipartUploads(input, entries)
+
+	require.True(t, *out.IsTruncated)
+	assert.Equal(t, "a%1Fb", *out.NextKeyMarker)
+	// The upload id is opaque, not a key name.
+	assert.Equal(t, "1", *out.NextUploadIdMarker)
+
+	body, err := xml.Marshal(out)
+	require.NoError(t, err)
+	assert.NotContains(t, string(body), "\uFFFD")
+}
+
+// Without encoding-type=url the response is unchanged, and the keys keep their
+// raw form for clients that do not ask for encoding.
+func TestSelectMultipartUploadsKeepsKeysRawWithoutEncodingType(t *testing.T) {
+	entries := []*filer_pb.Entry{
+		uploadEntry("1", "m\x01p b+.bin", 10),
+		uploadEntry("2", "plain/key.txt", 20),
+	}
+	out := selectMultipartUploads(listUploadsInput("", "", "", 1000), entries)
+
+	var got []string
+	for _, upload := range out.Upload {
+		got = append(got, *upload.Key)
+	}
+	assert.Equal(t, []string{"m\x01p b+.bin", "plain/key.txt"}, got)
+}
diff --git a/weed/s3api/filer_multipart_list_test.go b/weed/s3api/filer_multipart_list_test.go
new file mode 100644
index 0000000000..3d2a73789c
--- /dev/null
+++ b/weed/s3api/filer_multipart_list_test.go
@@ -0,0 +1,263 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"net/url"
+	"slices"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// uploadEntry is an upload folder as createMultipartUpload leaves it.
+func uploadEntry(id, key string, crtime int64) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Name:        id,
+		IsDirectory: true,
+		Extended:    map[string][]byte{s3_constants.ExtMultipartObjectKey: []byte(key)},
+		Attributes:  &filer_pb.FuseAttributes{Crtime: crtime},
+	}
+}
+
+func listUploadsInput(prefix, keyMarker, uploadIdMarker string, maxUploads int64) *s3.ListMultipartUploadsInput {
+	return &s3.ListMultipartUploadsInput{
+		Prefix:         aws.String(prefix),
+		KeyMarker:      aws.String(keyMarker),
+		UploadIdMarker: aws.String(uploadIdMarker),
+		MaxUploads:     aws.Int64(maxUploads),
+	}
+}
+
+func listedUploads(entries []*filer_pb.Entry, prefix, keyMarker, uploadIdMarker string, maxUploads int64) ([]string, bool) {
+	out := selectMultipartUploads(listUploadsInput(prefix, keyMarker, uploadIdMarker, maxUploads), entries)
+	var got []string
+	for _, u := range out.Upload {
+		got = append(got, *u.Key+"/"+*u.UploadId)
+	}
+	return got, *out.IsTruncated
+}
+
+func TestSelectMultipartUploads(t *testing.T) {
+	// listed from the filer in upload id order, which is not key order
+	entries := []*filer_pb.Entry{
+		uploadEntry("1", "c", 10),
+		uploadEntry("2", "a", 30),
+		uploadEntry("3", "b", 10),
+		uploadEntry("4", "a", 20),
+		uploadEntry("5", "up/x", 10),
+		// a folder with Extended set but no object key is not an upload
+		{Name: "6", IsDirectory: true, Extended: map[string][]byte{}},
+	}
+
+	tests := []struct {
+		name           string
+		prefix         string
+		keyMarker      string
+		uploadIdMarker string
+		maxUploads     int64
+		want           []string
+		truncated      bool
+	}{
+		{name: "sorted by key, then by upload id", maxUploads: 1000, want: []string{"a/2", "a/4", "b/3", "c/1", "up/x/5"}},
+		{name: "key-marker starts after that key", keyMarker: "a", maxUploads: 1000, want: []string{"b/3", "c/1", "up/x/5"}},
+		{name: "key-marker between keys", keyMarker: "bb", maxUploads: 1000, want: []string{"c/1", "up/x/5"}},
+		{name: "upload-id-marker continues inside its key", keyMarker: "a", uploadIdMarker: "2", maxUploads: 1000, want: []string{"a/4", "b/3", "c/1", "up/x/5"}},
+		{name: "upload-id-marker of an aborted upload", keyMarker: "a", uploadIdMarker: "3", maxUploads: 1000, want: []string{"a/4", "b/3", "c/1", "up/x/5"}},
+		{name: "upload-id-marker without key-marker is ignored", uploadIdMarker: "4", maxUploads: 1000, want: []string{"a/2", "a/4", "b/3", "c/1", "up/x/5"}},
+		{name: "prefix", prefix: "up/", maxUploads: 1000, want: []string{"up/x/5"}},
+		{name: "page", maxUploads: 2, want: []string{"a/2", "a/4"}, truncated: true},
+		{name: "exact last page is not truncated", keyMarker: "b", maxUploads: 2, want: []string{"c/1", "up/x/5"}},
+		{name: "max-uploads 0", maxUploads: 0, want: nil},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, truncated := listedUploads(entries, tt.prefix, tt.keyMarker, tt.uploadIdMarker, tt.maxUploads)
+			if !slices.Equal(got, tt.want) || truncated != tt.truncated {
+				t.Fatalf("got %v truncated=%v, want %v truncated=%v", got, truncated, tt.want, tt.truncated)
+			}
+		})
+	}
+}
+
+func TestSelectMultipartUploadsPaginatesEveryUploadOnce(t *testing.T) {
+	var entries []*filer_pb.Entry
+	for i, key := range []string{"k3", "k1", "k2", "k1", "k3", "k1", "k2"} {
+		entries = append(entries, uploadEntry(string(rune('a'+i)), key, int64(i)))
+	}
+	seen := map[string]bool{}
+	input := listUploadsInput("", "", "", 2)
+	pages := 0
+	for {
+		out := selectMultipartUploads(input, entries)
+		for _, u := range out.Upload {
+			if seen[*u.UploadId] {
+				t.Fatalf("upload %s listed twice", *u.UploadId)
+			}
+			seen[*u.UploadId] = true
+		}
+		pages++
+		if !*out.IsTruncated {
+			break
+		}
+		if out.NextKeyMarker == nil || out.NextUploadIdMarker == nil {
+			t.Fatalf("truncated page without next markers")
+		}
+		input.KeyMarker, input.UploadIdMarker = out.NextKeyMarker, out.NextUploadIdMarker
+	}
+	if pages != 4 {
+		t.Fatalf("got %d pages, want 4", pages)
+	}
+	if len(seen) != len(entries) {
+		t.Fatalf("listed %d of %d uploads", len(seen), len(entries))
+	}
+}
+
+func TestSelectMultipartUploadsHoldsOnlyThePage(t *testing.T) {
+	// a folder far larger than the page must not accumulate in the collector:
+	// peak memory tracks maxUploads, not the open-upload count
+	page := newMultipartUploadPage(listUploadsInput("", "", "", 3))
+	const total = 20000
+	for i := 0; i < total; i++ {
+		page.add(uploadEntry(fmt.Sprintf("%05d", i), fmt.Sprintf("k%05d", total-1-i), int64(i)))
+	}
+	if page.top.Len() != 3 {
+		t.Fatalf("collector holds %d candidates, want the 3-entry page", page.top.Len())
+	}
+	out := page.result()
+	var got []string
+	for _, u := range out.Upload {
+		got = append(got, *u.Key+"/"+*u.UploadId)
+	}
+	want := []string{"k00000/19999", "k00001/19998", "k00002/19997"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+	if !*out.IsTruncated || *out.NextKeyMarker != "k00002" || *out.NextUploadIdMarker != "19997" {
+		t.Fatalf("truncation markers got (%v, %v, %v)", *out.IsTruncated, *out.NextKeyMarker, *out.NextUploadIdMarker)
+	}
+}
+
+// With encoding-type=url the markers and upload keys take the wire form the
+// object listings already use: a client that echoes the escaped marker back
+// still resumes at the decoded key.
+func TestSelectMultipartUploadsUrlEncodesMarkersAndKeys(t *testing.T) {
+	entries := []*filer_pb.Entry{
+		uploadEntry("1", "a\x01b", 10),
+		uploadEntry("2", "a b", 20),
+		uploadEntry("3", "b", 30),
+	}
+	input := listUploadsInput("", "", "", 1)
+	input.EncodingType = aws.String(s3.EncodingTypeUrl)
+
+	out := selectMultipartUploads(input, entries)
+	if *out.Upload[0].Key != "a%01b" || *out.NextUploadIdMarker != "1" {
+		t.Fatalf("page got key %q upload-id-marker %q", *out.Upload[0].Key, *out.NextUploadIdMarker)
+	}
+	marker, err := url.QueryUnescape(*out.NextKeyMarker)
+	if err != nil || decodeListContinuationToken(marker) != "a\x01b" {
+		t.Fatalf("next key marker %q does not resume at %q", *out.NextKeyMarker, "a\x01b")
+	}
+
+	input.KeyMarker = aws.String(decodeListContinuationToken(marker))
+	input.UploadIdMarker = out.NextUploadIdMarker
+	out = selectMultipartUploads(input, entries)
+	if *out.KeyMarker != "a%01b" || *out.Upload[0].Key != "a+b" || *out.NextKeyMarker != "a+b" {
+		t.Fatalf("page got marker %q key %q next %q", *out.KeyMarker, *out.Upload[0].Key, *out.NextKeyMarker)
+	}
+
+	input.KeyMarker = aws.String("a b")
+	input.UploadIdMarker = out.NextUploadIdMarker
+	out = selectMultipartUploads(input, entries)
+	if *out.IsTruncated || *out.Upload[0].Key != "b" {
+		t.Fatalf("last page got truncated=%v key %q", *out.IsTruncated, *out.Upload[0].Key)
+	}
+}
+
+// A raw key that already carries the token prefix must survive an
+// encoding-type=url round trip: under url mode the wire form is the url escape
+// alone, so the request decode only unescapes — running the token decode on
+// "base64:..." would misread the raw key as an encoded token.
+func TestSelectMultipartUploadsUrlTokenPrefixedKeyRoundTrip(t *testing.T) {
+	entries := []*filer_pb.Entry{
+		uploadEntry("1", "base64:AQ", 10),
+		uploadEntry("2", "base64:z", 20),
+	}
+	input := listUploadsInput("", "", "", 1)
+	input.EncodingType = aws.String(s3.EncodingTypeUrl)
+
+	out := selectMultipartUploads(input, entries)
+	resume := decodeEscapedEcho(*out.NextKeyMarker, true, urlQueryEscape)
+	if resume != "base64:AQ" {
+		t.Fatalf("next key marker %q resumes at %q, want %q", *out.NextKeyMarker, resume, "base64:AQ")
+	}
+
+	input.KeyMarker = aws.String(resume)
+	input.UploadIdMarker = out.NextUploadIdMarker
+	out = selectMultipartUploads(input, entries)
+	if *out.IsTruncated || len(out.Upload) != 1 || *out.Upload[0].Key != "base64%3Az" {
+		t.Fatalf("second page got truncated=%v uploads %v", *out.IsTruncated, out.Upload)
+	}
+}
+
+func TestSelectMultipartUploadsCapsRequestedPageSize(t *testing.T) {
+	// max-uploads is caller-controlled; the page stays bounded at the server cap
+	page := newMultipartUploadPage(listUploadsInput("", "", "", 10*maxUploadsList))
+	if page.limit != maxUploadsList {
+		t.Fatalf("page limit %d, want capped at %d", page.limit, maxUploadsList)
+	}
+	if got := *page.result().MaxUploads; got != int64(maxUploadsList) {
+		t.Fatalf("MaxUploads reports %d, want the effective cap %d", got, maxUploadsList)
+	}
+}
+
+// A transient failure mid-stream replays through a fresh page, so the uploads
+// the aborted attempt already handed to the collector must not bleed into the
+// result: each upload lists once and the markers track the retried attempt.
+func TestListMultipartUploadsRetryCollectsEachUploadOnce(t *testing.T) {
+	entries := []*filer_pb.Entry{
+		uploadEntry("1", "c", 10),
+		uploadEntry("2", "a", 30),
+		uploadEntry("3", "b", 10),
+	}
+	client := &listRetryClient{
+		entries:   entries,
+		recvErrs:  []error{status.Error(codes.Unavailable, "transport is closing"), nil},
+		recvAfter: []int{2, 0},
+	}
+	accessor := &listRetryAccessor{client: client}
+	input := listUploadsInput("", "", "", 2)
+
+	var page *multipartUploadPage
+	err := listRetry("/buckets/b/.uploads", func() error {
+		page = newMultipartUploadPage(input)
+		return filer_pb.List(context.Background(), accessor, "/buckets/b/.uploads", "", func(entry *filer_pb.Entry, isLastEntry bool) error {
+			page.add(entry)
+			return nil
+		}, "", false, math.MaxInt32)
+	})
+	if err != nil {
+		t.Fatalf("listRetry: %v", err)
+	}
+	if client.attempts != 2 {
+		t.Fatalf("got %d attempts, want 2", client.attempts)
+	}
+	out := page.result()
+	var got []string
+	for _, u := range out.Upload {
+		got = append(got, *u.Key+"/"+*u.UploadId)
+	}
+	want := []string{"a/2", "b/3"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("got %v, want %v (no entry from the aborted attempt may carry over)", got, want)
+	}
+	if !*out.IsTruncated || *out.NextKeyMarker != "b" || *out.NextUploadIdMarker != "3" {
+		t.Fatalf("truncation markers got (%v, %v, %v)", *out.IsTruncated, *out.NextKeyMarker, *out.NextUploadIdMarker)
+	}
+}
diff --git a/weed/s3api/filer_util.go b/weed/s3api/filer_util.go
index 9a883bbf35..3ec242a4d3 100644
--- a/weed/s3api/filer_util.go
+++ b/weed/s3api/filer_util.go
@@ -5,11 +5,13 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
@@ -21,61 +23,146 @@ func (s3a *S3ApiServer) mkdir(parentDirectoryPath string, dirName string, fn fun
 
 }
 
+// mkdirExclusive never replaces an entry already at the path: PutBucket uses
+// it so a plain bucket cannot replace a table bucket created in its
+// check-to-create window.
+func (s3a *S3ApiServer) mkdirExclusive(parentDirectoryPath string, dirName string, fn func(entry *filer_pb.Entry)) error {
+
+	return filer_pb.MkdirExclusive(context.Background(), s3a, parentDirectoryPath, dirName, fn)
+
+}
+
+// concurrentEntryIsForeign: after PutBucket's exclusive mkdir met an entry,
+// whether that entry must be answered BucketAlreadyExists without looking at
+// its owner: a table bucket (it carries no S3 owner and must never read as
+// "owned by you"), or an entry that could not be read.
+func concurrentEntryIsForeign(entry *filer_pb.Entry, err error) bool {
+	return err != nil || entry == nil || s3tables.IsTableBucketEntry(entry)
+}
+
 func (s3a *S3ApiServer) mkFile(parentDirectoryPath string, fileName string, chunks []*filer_pb.FileChunk, fn func(entry *filer_pb.Entry)) error {
 
-	return filer_pb.MkFile(context.Background(), s3a, parentDirectoryPath, fileName, chunks, fn)
+	err := filer_pb.MkFile(context.Background(), s3a, parentDirectoryPath, fileName, chunks, fn)
+	if errors.Is(err, filer_pb.ErrExistingIsDirectory) && !isReservedDirectoryName(fileName) {
+		// Other keys are nested under this one, so the object goes onto the directory
+		// they live in - the same place a PutObject of this key writes it.
+		err = filer_pb.MkFile(context.Background(), s3a, parentDirectoryPath, fileName, chunks, func(entry *filer_pb.Entry) {
+			if fn != nil {
+				fn(entry)
+			}
+			entry.MarkPrefixObject()
+		})
+	}
+	return err
 
 }
 
 func (s3a *S3ApiServer) list(parentDirectoryPath, prefix, startFrom string, inclusive bool, limit uint32) (entries []*filer_pb.Entry, isLast bool, err error) {
 
-	err = filer_pb.List(context.Background(), s3a, parentDirectoryPath, prefix, func(entry *filer_pb.Entry, isLastEntry bool) error {
-		entries = append(entries, entry)
-		if isLastEntry {
+	return listWithRetry(parentDirectoryPath, func() (entries []*filer_pb.Entry, isLast bool, err error) {
+		err = filer_pb.List(context.Background(), s3a, parentDirectoryPath, prefix, func(entry *filer_pb.Entry, isLastEntry bool) error {
+			entries = append(entries, entry)
+			if isLastEntry {
+				isLast = true
+			}
+			return nil
+		}, startFrom, inclusive, limit)
+
+		if len(entries) == 0 {
 			isLast = true
 		}
-		return nil
-	}, startFrom, inclusive, limit)
 
-	if len(entries) == 0 {
-		isLast = true
+		return
+	})
+
+}
+
+// A listing has no side effects and collects into a fresh slice per attempt, so
+// a replay can neither duplicate nor drop entries; the bound caps a filer that
+// is genuinely down at two extra attempts and 300ms of added wait.
+const (
+	listRetryAttempts       = 3
+	listRetryInitialBackoff = 100 * time.Millisecond
+)
+
+// isRetryableListError defers to util.IsTransientError, which reads the status
+// the filer sent rather than the message DoSeaweedListWithSnapshot builds around
+// it out of the bucket and prefix the client chose. Not-found is authoritative
+// and must reach the caller unchanged.
+func isRetryableListError(err error) bool {
+	return err != nil && !isFilerNotFound(err) && util.IsTransientError(err)
+}
+
+// listRetry replays doList while the filer answers with a transient error.
+// Both failure points, the ListEntries call itself and the stream.Recv that
+// follows it, surface as a plain error out of filer_pb.List, so a single retry
+// point above it covers both. A replayed attempt may re-deliver entries the
+// last attempt already saw, so a doList that accumulates must reset first.
+func listRetry(parentDirectoryPath string, doList func() error) (err error) {
+
+	backoff := listRetryInitialBackoff
+	for attempt := 1; ; attempt++ {
+		if err = doList(); err == nil || attempt >= listRetryAttempts || !isRetryableListError(err) {
+			return err
+		}
+		glog.V(1).Infof("list %s attempt %d/%d hit a transient error, retrying in %v: %v", parentDirectoryPath, attempt, listRetryAttempts, backoff, err)
+		time.Sleep(backoff)
+		backoff *= 2
 	}
 
-	return
+}
+
+func listWithRetry(parentDirectoryPath string, doList func() (entries []*filer_pb.Entry, isLast bool, err error)) (entries []*filer_pb.Entry, isLast bool, err error) {
+
+	err = listRetry(parentDirectoryPath, func() error {
+		entries, isLast, err = doList()
+		return err
+	})
+	return entries, isLast, err
 
 }
 
-func (s3a *S3ApiServer) rm(parentDirectoryPath, entryName string, isDeleteData, isRecursive bool) error {
+// A delete is idempotent at the filer, which answers an entry that is already
+// gone with an empty resp.Error, so a reply the transport dropped can be
+// reissued instead of surfaced: as a 500 on the bucket delete, or as a per-key
+// InternalError inside the 200 of a multi-object delete, which no SDK retries.
+// Each attempt re-enters WithFilerClient, so it walks the failover list again
+// on a connection the failed one had invalidated.
+func (s3a *S3ApiServer) rm(ctx context.Context, parentDirectoryPath, entryName string, isDeleteData, isRecursive bool) error {
 
-	return s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	return retryFilerOp(ctx, "rm "+parentDirectoryPath+"/"+entryName, func() error {
+		return s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 
-		return doDeleteEntry(client, parentDirectoryPath, entryName, isDeleteData, isRecursive)
+			return doDeleteEntry(ctx, client, parentDirectoryPath, entryName, isDeleteData, isRecursive)
+		})
 	})
 
 }
 
-func (s3a *S3ApiServer) rmObject(parentDirectoryPath, entryName string, isDeleteData, isRecursive bool) error {
+func (s3a *S3ApiServer) rmObject(ctx context.Context, parentDirectoryPath, entryName string, isDeleteData, isRecursive bool) error {
 
-	return s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	return retryFilerOp(ctx, "rmObject "+parentDirectoryPath+"/"+entryName, func() error {
+		return s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 
-		return deleteObjectEntry(client, parentDirectoryPath, entryName, isDeleteData, isRecursive)
+			return deleteObjectEntry(ctx, client, parentDirectoryPath, entryName, isDeleteData, isRecursive)
+		})
 	})
 
 }
 
-func deleteObjectEntry(client filer_pb.SeaweedFilerClient, parentDirectoryPath, entryName string, isDeleteData, isRecursive bool) error {
-	err := doDeleteEntry(client, parentDirectoryPath, entryName, isDeleteData, isRecursive)
+func deleteObjectEntry(ctx context.Context, client filer_pb.SeaweedFilerClient, parentDirectoryPath, entryName string, isDeleteData, isRecursive bool) error {
+	err := doDeleteEntry(ctx, client, parentDirectoryPath, entryName, isDeleteData, isRecursive)
 	if err == nil {
 		return nil
 	}
-	if !strings.Contains(err.Error(), filer.MsgFailDelNonEmptyFolder) {
+	if !errors.Is(err, filer.ErrNonEmptyFolder) {
 		return err
 	}
 
-	return demoteDirectoryMarkerToImplicitDirectory(client, parentDirectoryPath, entryName)
+	return demoteDirectoryMarkerToImplicitDirectory(ctx, client, parentDirectoryPath, entryName)
 }
 
-func doDeleteEntry(client filer_pb.SeaweedFilerClient, parentDirectoryPath string, entryName string, isDeleteData bool, isRecursive bool) error {
+func doDeleteEntry(ctx context.Context, client filer_pb.SeaweedFilerClient, parentDirectoryPath string, entryName string, isDeleteData bool, isRecursive bool) error {
 	request := &filer_pb.DeleteEntryRequest{
 		Directory:            parentDirectoryPath,
 		Name:                 entryName,
@@ -85,19 +172,21 @@ func doDeleteEntry(client filer_pb.SeaweedFilerClient, parentDirectoryPath strin
 	}
 
 	glog.V(1).Infof("delete entry %v/%v: %v", parentDirectoryPath, entryName, request)
-	if resp, err := client.DeleteEntry(context.Background(), request); err != nil {
+	if resp, err := client.DeleteEntry(ctx, request); err != nil {
 		glog.V(1).Infof("delete entry %v: %v", request, err)
-		return fmt.Errorf("delete entry %s/%s: %v", parentDirectoryPath, entryName, err)
+		return fmt.Errorf("delete entry %s/%s: %w", parentDirectoryPath, entryName, err)
 	} else {
 		if resp.Error != "" {
-			return fmt.Errorf("delete entry %s/%s: %v", parentDirectoryPath, entryName, resp.Error)
+			// the path wrapped in here is the client's, so classify the filer's
+			// text now, while it still stands alone
+			return fmt.Errorf("delete entry %s/%s: %w", parentDirectoryPath, entryName, filer.DeleteEntryError(resp.Error))
 		}
 	}
 	return nil
 }
 
-func demoteDirectoryMarkerToImplicitDirectory(client filer_pb.SeaweedFilerClient, parentDirectoryPath, entryName string) error {
-	resp, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+func demoteDirectoryMarkerToImplicitDirectory(ctx context.Context, client filer_pb.SeaweedFilerClient, parentDirectoryPath, entryName string) error {
+	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
 		Directory: parentDirectoryPath,
 		Name:      entryName,
 	})
@@ -116,7 +205,7 @@ func demoteDirectoryMarkerToImplicitDirectory(client filer_pb.SeaweedFilerClient
 
 	clearDirectoryMarkerMetadata(resp.Entry)
 
-	if err := filer_pb.UpdateEntry(context.Background(), client, &filer_pb.UpdateEntryRequest{
+	if err := filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
 		Directory: parentDirectoryPath,
 		Entry:     resp.Entry,
 	}); err != nil {
@@ -149,6 +238,10 @@ func clearDirectoryMarkerMetadata(entry *filer_pb.Entry) {
 	filtered := make(map[string][]byte)
 	for k, v := range entry.Extended {
 		lowerKey := strings.ToLower(k)
+		if lowerKey == s3_constants.SeaweedFSPrefixObject {
+			// The path is a plain directory again, not a key of its own.
+			continue
+		}
 		if strings.HasPrefix(lowerKey, "xattr-") || strings.HasPrefix(lowerKey, s3_constants.SeaweedFSInternalPrefix) {
 			filtered[k] = v
 		}
diff --git a/weed/s3api/filer_util_delete_test.go b/weed/s3api/filer_util_delete_test.go
index 31339a4703..8ee94a4d35 100644
--- a/weed/s3api/filer_util_delete_test.go
+++ b/weed/s3api/filer_util_delete_test.go
@@ -3,7 +3,9 @@ package s3api
 import (
 	"context"
 	"errors"
+	"fmt"
 	"testing"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -24,13 +26,34 @@ type deleteObjectEntryTestClient struct {
 	lookupErr  error
 	updateErr  error
 
-	deleteReq *filer_pb.DeleteEntryRequest
-	lookupReq *filer_pb.LookupDirectoryEntryRequest
-	updateReq *filer_pb.UpdateEntryRequest
+	// deleteCallErrs scripts the RPC itself per attempt, deleteRespErrs the
+	// filer's own message: the two ways a delete fails, told apart because
+	// only the first is a transport that dropped a reply.
+	deleteCallErrs []error
+	deleteRespErrs []string
+
+	deleteAttempts int
+	deleteReqs     []*filer_pb.DeleteEntryRequest
+	deleteReq      *filer_pb.DeleteEntryRequest
+	lookupReq      *filer_pb.LookupDirectoryEntryRequest
+	updateReq      *filer_pb.UpdateEntryRequest
 }
 
-func (c *deleteObjectEntryTestClient) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest, _ ...grpc.CallOption) (*filer_pb.DeleteEntryResponse, error) {
+func (c *deleteObjectEntryTestClient) DeleteEntry(ctx context.Context, req *filer_pb.DeleteEntryRequest, _ ...grpc.CallOption) (*filer_pb.DeleteEntryResponse, error) {
+	attempt := c.deleteAttempts
+	c.deleteAttempts++
 	c.deleteReq = req
+	c.deleteReqs = append(c.deleteReqs, req)
+
+	if err := ctx.Err(); err != nil {
+		return nil, status.FromContextError(err).Err()
+	}
+	if attempt < len(c.deleteCallErrs) && c.deleteCallErrs[attempt] != nil {
+		return nil, c.deleteCallErrs[attempt]
+	}
+	if attempt < len(c.deleteRespErrs) && c.deleteRespErrs[attempt] != "" {
+		return &filer_pb.DeleteEntryResponse{Error: c.deleteRespErrs[attempt]}, nil
+	}
 	if c.deleteResp == nil {
 		return &filer_pb.DeleteEntryResponse{}, c.deleteErr
 	}
@@ -77,7 +100,7 @@ func TestDeleteObjectEntryDemotesNonEmptyDirectoryMarker(t *testing.T) {
 		},
 	}
 
-	err := deleteObjectEntry(client, "/buckets/test", "photos", true, false)
+	err := deleteObjectEntry(context.Background(), client, "/buckets/test", "photos", true, false)
 	require.NoError(t, err)
 	require.NotNil(t, client.lookupReq)
 	require.NotNil(t, client.updateReq)
@@ -96,6 +119,36 @@ func TestDeleteObjectEntryDemotesNonEmptyDirectoryMarker(t *testing.T) {
 	}, updated.Extended)
 }
 
+// A prefix object is demoted the same way, and the mark has to go with the data:
+// the path is a plain directory again, and no longer a key of its own.
+func TestDeleteObjectEntryDemotesPrefixObject(t *testing.T) {
+	client := &deleteObjectEntryTestClient{
+		deleteResp: &filer_pb.DeleteEntryResponse{
+			Error: filer.MsgFailDelNonEmptyFolder + ": /buckets/test/photos",
+		},
+		lookupResp: &filer_pb.LookupDirectoryEntryResponse{
+			Entry: &filer_pb.Entry{
+				Name:        "photos",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{},
+				Extended: map[string][]byte{
+					s3_constants.SeaweedFSPrefixObject: []byte("true"),
+					s3_constants.ExtETagKey:            []byte("etag"),
+				},
+			},
+		},
+	}
+
+	require.NoError(t, deleteObjectEntry(context.Background(), client, "/buckets/test", "photos", true, false))
+	require.NotNil(t, client.updateReq)
+
+	updated := client.updateReq.Entry
+	require.NotNil(t, updated)
+	assert.False(t, updated.IsPrefixObject())
+	assert.False(t, updated.IsDirectoryKeyObject())
+	assert.Empty(t, updated.Extended)
+}
+
 func TestDeleteObjectEntryTreatsImplicitDirectoryAsSuccessfulNoop(t *testing.T) {
 	client := &deleteObjectEntryTestClient{
 		deleteResp: &filer_pb.DeleteEntryResponse{
@@ -110,7 +163,7 @@ func TestDeleteObjectEntryTreatsImplicitDirectoryAsSuccessfulNoop(t *testing.T)
 		},
 	}
 
-	err := deleteObjectEntry(client, "/buckets/test", "photos", true, false)
+	err := deleteObjectEntry(context.Background(), client, "/buckets/test", "photos", true, false)
 	require.NoError(t, err)
 	require.NotNil(t, client.lookupReq)
 	assert.Nil(t, client.updateReq)
@@ -133,20 +186,153 @@ func TestDeleteObjectEntryIgnoresConcurrentUpdateNotFound(t *testing.T) {
 		updateErr: status.Error(codes.NotFound, "already removed"),
 	}
 
-	err := deleteObjectEntry(client, "/buckets/test", "photos", true, false)
+	err := deleteObjectEntry(context.Background(), client, "/buckets/test", "photos", true, false)
 	require.NoError(t, err)
 	require.NotNil(t, client.lookupReq)
 	require.NotNil(t, client.updateReq)
 }
 
+// The key is the client's and the filer echoes it in the message it sends back,
+// so a key named after the marker must not turn a real failure into the demote
+// no-op, which would answer a failed delete with a 204.
+func TestDeleteObjectEntryIgnoresMarkerSpoofedByKey(t *testing.T) {
+	name := filer.MsgFailDelNonEmptyFolder
+	client := &deleteObjectEntryTestClient{
+		deleteResp: &filer_pb.DeleteEntryResponse{
+			Error: "delete file /buckets/test/" + name + ": filer store delete: disk full",
+		},
+	}
+
+	err := deleteObjectEntry(context.Background(), client, "/buckets/test", name, true, false)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "disk full")
+	assert.Nil(t, client.lookupReq)
+	assert.Nil(t, client.updateReq)
+}
+
 func TestDeleteObjectEntryPropagatesNonDirectoryDeleteErrors(t *testing.T) {
 	client := &deleteObjectEntryTestClient{
 		deleteErr: errors.New("boom"),
 	}
 
-	err := deleteObjectEntry(client, "/buckets/test", "photos", true, false)
+	err := deleteObjectEntry(context.Background(), client, "/buckets/test", "photos", true, false)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "boom")
 	assert.Nil(t, client.lookupReq)
 	assert.Nil(t, client.updateReq)
 }
+
+// A delete is idempotent at the filer, so a reply the transport dropped is
+// reissued rather than surfaced. Issue #7204 saw the surfaced version as a 500
+// on the bucket delete, which boto3 resent and then answered NoSuchBucket;
+// issue #7224 saw it as a per-key InternalError inside a 200, which no SDK
+// retries, so the object silently stayed.
+func TestDeleteUnversionedObjectReplaysADroppedReply(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+	client := &deleteObjectEntryTestClient{
+		deleteCallErrs: []error{status.Error(codes.Unavailable, "transport is closing"), nil},
+	}
+
+	err := s3a.deleteUnversionedObjectWithClient(testRetryCtx(10*time.Millisecond), client, "mybucket", "a/b/c.txt", false)
+
+	require.NoError(t, err)
+	assert.Equal(t, 2, client.deleteAttempts)
+	// the replay must ask for the same delete, not a differently shaped one
+	require.Len(t, client.deleteReqs, 2)
+	assert.Equal(t, client.deleteReqs[0].String(), client.deleteReqs[1].String())
+}
+
+// The filer formats the deleted path, and for a recursive delete the child it
+// stopped on, into the message it sends back, so both are the client's text.
+// Nothing here reads that text, and this pins it: the same failure under a key
+// named after a transport condition is replayed exactly as often as under a
+// plain one.
+func TestDeleteUnversionedObjectReplayIgnoresTheObjectName(t *testing.T) {
+	attemptsFor := func(key string) int {
+		s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+		client := &deleteObjectEntryTestClient{
+			deleteRespErrs: []string{"delete file /buckets/b/" + key + ": permission denied", ""},
+		}
+		require.NoError(t, s3a.deleteUnversionedObjectWithClient(testRetryCtx(10*time.Millisecond), client, "b", key, false))
+		return client.deleteAttempts
+	}
+
+	plain := attemptsFor("plain.log")
+	for _, key := range []string{"transport.log", "unavailable.txt", "slowdown.csv", filer_pb.ErrNotFound.Error()} {
+		assert.Equal(t, plain, attemptsFor(key), "key %q must not steer the replay", key)
+	}
+}
+
+// A folder the filer refused because it still has children is an answer about
+// the tree, not a hiccup: it is handed straight to the demote path instead of
+// being replayed until the allowance runs out.
+func TestDeleteUnversionedObjectDoesNotReplayANonEmptyFolder(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+	client := &deleteObjectEntryTestClient{
+		deleteResp: &filer_pb.DeleteEntryResponse{
+			Error: filer.MsgFailDelNonEmptyFolder + ": /buckets/b/photos",
+		},
+	}
+
+	require.NoError(t, s3a.deleteUnversionedObjectWithClient(context.Background(), client, "b", "photos", false))
+	assert.Equal(t, 1, client.deleteAttempts)
+	assert.NotNil(t, client.lookupReq, "the demote must still run")
+}
+
+// A caller that has gone away is not worth replaying for.
+func TestDeleteUnversionedObjectDoesNotReplayForACancelledCaller(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+	client := &deleteObjectEntryTestClient{}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	err := s3a.deleteUnversionedObjectWithClient(ctx, client, "b", "k", false)
+
+	require.Error(t, err)
+	assert.Equal(t, 1, client.deleteAttempts)
+}
+
+// The client picks how many keys a multi-object delete carries, so the backoff
+// is drawn from one allowance held by the request rather than one per key.
+func TestDeleteUnversionedObjectDrawsFromTheRequestAllowance(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+	ctx := testRetryCtx(20 * time.Millisecond)
+
+	start := time.Now()
+	var attempts int
+	for i := 0; i < 50; i++ {
+		client := &deleteObjectEntryTestClient{deleteErr: status.Error(codes.Unavailable, "transport is closing")}
+		require.Error(t, s3a.deleteUnversionedObjectWithClient(ctx, client, "b", fmt.Sprintf("k%d", i), false))
+		attempts += client.deleteAttempts
+	}
+
+	assert.Less(t, time.Since(start), time.Second, "one allowance, not one per key")
+	assert.Greater(t, attempts, 50, "the allowance must still buy a replay")
+}
+
+// testRetryCtx caps the backoff so a test exercises the replay without waiting
+// out the real per-request allowance.
+func testRetryCtx(allowance time.Duration) context.Context {
+	return withFilerRetryBudget(context.Background(), allowance)
+}
+
+func TestIsRetryableFilerErr(t *testing.T) {
+	assert.False(t, isRetryableFilerErr(nil))
+	assert.True(t, isRetryableFilerErr(status.Error(codes.Unavailable, "transport is closing")))
+	assert.True(t, isRetryableFilerErr(fmt.Errorf("delete entry /b/k: %w", status.Error(codes.Unavailable, "x"))))
+	// the filer's own message carries no status, and a store error may well clear
+	assert.True(t, isRetryableFilerErr(filer.DeleteEntryError("delete file /b/k: filer store delete: disk full")))
+
+	assert.False(t, isRetryableFilerErr(filer.DeleteEntryError(filer.MsgFailDelNonEmptyFolder+": /b/photos")))
+	assert.False(t, isRetryableFilerErr(filer_pb.ErrNotFound))
+	assert.False(t, isRetryableFilerErr(status.Error(codes.NotFound, "gone")))
+	assert.False(t, isRetryableFilerErr(context.Canceled))
+	assert.False(t, isRetryableFilerErr(status.Error(codes.Canceled, "context canceled")))
+	assert.False(t, isRetryableFilerErr(status.Error(codes.DeadlineExceeded, "context deadline exceeded")))
+
+	// the message is never read, so the same code classifies the same way
+	// whatever the client named the key
+	assert.Equal(t,
+		isRetryableFilerErr(status.Error(codes.PermissionDenied, "denied for /b/plain.log")),
+		isRetryableFilerErr(status.Error(codes.PermissionDenied, "denied for /b/transport.log")))
+}
diff --git a/weed/s3api/filer_util_list_retry_test.go b/weed/s3api/filer_util_list_retry_test.go
new file mode 100644
index 0000000000..dc3280805c
--- /dev/null
+++ b/weed/s3api/filer_util_list_retry_test.go
@@ -0,0 +1,297 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	grpc "google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+)
+
+// listRetryStream replays a scripted sequence of entries and then, optionally,
+// fails. failAfter < 0 means the stream runs to EOF.
+type listRetryStream struct {
+	entries   []*filer_pb.Entry
+	index     int
+	failAfter int
+	failErr   error
+}
+
+func (s *listRetryStream) Recv() (*filer_pb.ListEntriesResponse, error) {
+	if s.failErr != nil && s.failAfter >= 0 && s.index >= s.failAfter {
+		return nil, s.failErr
+	}
+	if s.index >= len(s.entries) {
+		return nil, io.EOF
+	}
+	entry := s.entries[s.index]
+	s.index++
+	return &filer_pb.ListEntriesResponse{Entry: entry}, nil
+}
+
+func (s *listRetryStream) Header() (metadata.MD, error) { return metadata.MD{}, nil }
+func (s *listRetryStream) Trailer() metadata.MD         { return metadata.MD{} }
+func (s *listRetryStream) CloseSend() error             { return nil }
+func (s *listRetryStream) Context() context.Context     { return context.Background() }
+func (s *listRetryStream) SendMsg(any) error            { return nil }
+func (s *listRetryStream) RecvMsg(any) error            { return nil }
+
+// listRetryClient is a filer whose ListEntries fails in a scripted way for the
+// first attempts and then behaves. callErrs is consumed one entry per attempt:
+// a non-nil entry fails the ListEntries call itself (issue #7221), a nil entry
+// lets the call through so recvErrs decides whether the stream breaks partway
+// (issue #7235).
+type listRetryClient struct {
+	filer_pb.SeaweedFilerClient
+
+	entries   []*filer_pb.Entry
+	callErrs  []error
+	recvErrs  []error
+	recvAfter []int
+
+	attempts int
+}
+
+func (c *listRetryClient) ListEntries(ctx context.Context, in *filer_pb.ListEntriesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[filer_pb.ListEntriesResponse], error) {
+	attempt := c.attempts
+	c.attempts++
+
+	if attempt < len(c.callErrs) && c.callErrs[attempt] != nil {
+		return nil, c.callErrs[attempt]
+	}
+
+	stream := &listRetryStream{entries: c.entries, failAfter: -1}
+	if attempt < len(c.recvErrs) && c.recvErrs[attempt] != nil {
+		stream.failErr = c.recvErrs[attempt]
+		stream.failAfter = c.recvAfter[attempt]
+	}
+	return stream, nil
+}
+
+// listRetryAccessor hands the scripted client to filer_pb.List without any
+// wrapping of its own, so the test sees the error exactly as it leaves
+// DoSeaweedListWithSnapshot.
+type listRetryAccessor struct {
+	client filer_pb.SeaweedFilerClient
+}
+
+func (a *listRetryAccessor) WithFilerClient(_ bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return fn(a.client)
+}
+
+func (a *listRetryAccessor) AdjustedUrl(*filer_pb.Location) string { return "" }
+func (a *listRetryAccessor) GetDataCenter() string                 { return "" }
+
+// listOnce mirrors (*S3ApiServer).list so the test drives the real
+// filer_pb.List and DoSeaweedListWithSnapshot code path, including the fresh
+// accumulator that makes a replay safe.
+func listOnce(client filer_pb.FilerClient, parentDirectoryPath string) (entries []*filer_pb.Entry, isLast bool, err error) {
+	err = filer_pb.List(context.Background(), client, parentDirectoryPath, "", func(entry *filer_pb.Entry, isLastEntry bool) error {
+		entries = append(entries, entry)
+		if isLastEntry {
+			isLast = true
+		}
+		return nil
+	}, "", false, 100)
+
+	if len(entries) == 0 {
+		isLast = true
+	}
+
+	return
+}
+
+func testUploadEntries(names ...string) []*filer_pb.Entry {
+	entries := make([]*filer_pb.Entry, 0, len(names))
+	for _, name := range names {
+		entries = append(entries, &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}})
+	}
+	return entries
+}
+
+func entryNames(entries []*filer_pb.Entry) []string {
+	names := make([]string, 0, len(entries))
+	for _, entry := range entries {
+		names = append(names, entry.Name)
+	}
+	return names
+}
+
+// Issue #7221: a transient failure of the ListEntries call itself.
+func TestListWithRetryRecoversFromTransientListEntriesCall(t *testing.T) {
+	client := &listRetryClient{
+		entries: testUploadEntries("upload-1", "upload-2", "upload-3"),
+		callErrs: []error{
+			status.Error(codes.Unavailable, "filer is restarting"),
+			status.Error(codes.Unavailable, "filer is restarting"),
+			nil,
+		},
+	}
+	accessor := &listRetryAccessor{client: client}
+
+	entries, _, err := listWithRetry("/buckets/b/.uploads", func() ([]*filer_pb.Entry, bool, error) {
+		return listOnce(accessor, "/buckets/b/.uploads")
+	})
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"upload-1", "upload-2", "upload-3"}, entryNames(entries))
+	assert.Equal(t, listRetryAttempts, client.attempts, "should have used every allowed attempt")
+}
+
+// Issue #7235: a transient failure on stream.Recv part way through the listing.
+// The replay must return the full listing exactly once, with no entry from the
+// aborted attempt carried over.
+func TestListWithRetryRecoversFromTransientStreamRecv(t *testing.T) {
+	client := &listRetryClient{
+		entries: testUploadEntries("upload-1", "upload-2", "upload-3"),
+		// break after two successful receives, so the first attempt has already
+		// handed "upload-1" to the callback when the stream dies
+		recvErrs:  []error{status.Error(codes.Unavailable, "transport is closing"), nil},
+		recvAfter: []int{2, 0},
+	}
+	accessor := &listRetryAccessor{client: client}
+
+	entries, _, err := listWithRetry("/buckets/b/.uploads", func() ([]*filer_pb.Entry, bool, error) {
+		return listOnce(accessor, "/buckets/b/.uploads")
+	})
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"upload-1", "upload-2", "upload-3"}, entryNames(entries), "replay must not duplicate the entries of the aborted attempt")
+	assert.Equal(t, 2, client.attempts)
+}
+
+// The retry is bounded: a filer that stays down still fails the request, and
+// the transient error reaches the caller.
+func TestListWithRetryGivesUpAfterBoundedAttempts(t *testing.T) {
+	client := &listRetryClient{
+		entries: testUploadEntries("upload-1"),
+		callErrs: []error{
+			status.Error(codes.Unavailable, "no filer available"),
+			status.Error(codes.Unavailable, "no filer available"),
+			status.Error(codes.Unavailable, "no filer available"),
+			nil, // would succeed on a fourth attempt, which must never happen
+		},
+	}
+	accessor := &listRetryAccessor{client: client}
+
+	_, _, err := listWithRetry("/buckets/b/.uploads", func() ([]*filer_pb.Entry, bool, error) {
+		return listOnce(accessor, "/buckets/b/.uploads")
+	})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "Unavailable")
+	assert.Equal(t, listRetryAttempts, client.attempts)
+}
+
+// A non-transient error is a real failure and must propagate on the first
+// attempt rather than being retried away.
+func TestListWithRetryPropagatesNonTransientError(t *testing.T) {
+	for name, listErr := range map[string]error{
+		"permission denied": status.Error(codes.PermissionDenied, "not allowed"),
+		"invalid argument":  status.Error(codes.InvalidArgument, "bad prefix"),
+	} {
+		t.Run(name, func(t *testing.T) {
+			client := &listRetryClient{
+				entries:  testUploadEntries("upload-1"),
+				callErrs: []error{listErr, nil},
+			}
+			accessor := &listRetryAccessor{client: client}
+
+			_, _, err := listWithRetry("/buckets/b/.uploads", func() ([]*filer_pb.Entry, bool, error) {
+				return listOnce(accessor, "/buckets/b/.uploads")
+			})
+
+			require.Error(t, err)
+			assert.Equal(t, 1, client.attempts, "a non-transient error must not be retried")
+		})
+	}
+}
+
+// Not-found is authoritative: it must not be retried, and it must still read as
+// not-found afterwards so listMultipartUploads keeps answering with an empty
+// list instead of a 500.
+func TestListWithRetryPropagatesNotFound(t *testing.T) {
+	client := &listRetryClient{
+		entries:  testUploadEntries("upload-1"),
+		callErrs: []error{status.Error(codes.NotFound, "filer: no entry is found in filer store"), nil},
+	}
+	accessor := &listRetryAccessor{client: client}
+
+	_, _, err := listWithRetry("/buckets/b/.uploads", func() ([]*filer_pb.Entry, bool, error) {
+		return listOnce(accessor, "/buckets/b/.uploads")
+	})
+
+	require.Error(t, err)
+	assert.Equal(t, 1, client.attempts, "not-found is authoritative and must not be retried")
+	assert.True(t, isFilerNotFound(err), "not-found must survive the retry wrapper")
+}
+
+func TestIsRetryableListError(t *testing.T) {
+	assert.False(t, isRetryableListError(nil))
+	assert.True(t, isRetryableListError(status.Error(codes.Unavailable, "connection refused")))
+	assert.True(t, isRetryableListError(status.Error(codes.ResourceExhausted, "too many requests")))
+	// the ListEntries path loses the gRPC status to a %v wrap, so classification
+	// has to survive on the message alone
+	assert.True(t, isRetryableListError(fmt.Errorf("list /buckets/b/.uploads: %v", status.Error(codes.Unavailable, "filer is restarting"))))
+	// and this is the shape the S3 gateway actually sees once the failover in
+	// (*S3ApiServer).WithFilerClient has exhausted every filer
+	assert.True(t, isRetryableListError(fmt.Errorf("all filers failed, last error: %w",
+		fmt.Errorf("list /buckets/b/.uploads: %v", status.Error(codes.Unavailable, "filer is restarting")))))
+	assert.False(t, isRetryableListError(status.Error(codes.NotFound, "filer: no entry is found in filer store")))
+	assert.False(t, isRetryableListError(status.Error(codes.PermissionDenied, "not allowed")))
+	assert.False(t, isRetryableListError(context.Canceled))
+}
+
+// The bucket and the prefix are the client's to choose and they land inside the
+// message DoSeaweedListWithSnapshot builds, so they must not decide whether the
+// failure is retried.
+func TestListWithRetryIgnoresUserControlledPath(t *testing.T) {
+	for name, listErr := range map[string]error{
+		"permission denied": status.Error(codes.PermissionDenied, "not allowed"),
+		"invalid argument":  status.Error(codes.InvalidArgument, "bad prefix"),
+	} {
+		t.Run(name, func(t *testing.T) {
+			client := &listRetryClient{
+				entries:  testUploadEntries("upload-1"),
+				callErrs: []error{listErr, nil},
+			}
+			accessor := &listRetryAccessor{client: client}
+
+			_, _, err := listWithRetry("/buckets/transport/unavailable", func() ([]*filer_pb.Entry, bool, error) {
+				return listOnce(accessor, "/buckets/transport/unavailable")
+			})
+
+			require.Error(t, err)
+			assert.Equal(t, 1, client.attempts, "a bucket name must not make a non-transient error look transient")
+		})
+	}
+}
+
+// The inverse: a prefix carrying the not-found sentence must not suppress a
+// retry the filer actually asked for.
+func TestListWithRetryIgnoresSpoofedNotFoundPath(t *testing.T) {
+	client := &listRetryClient{
+		entries: testUploadEntries("upload-1"),
+		callErrs: []error{
+			status.Error(codes.Unavailable, "filer is restarting"),
+			nil,
+		},
+	}
+	accessor := &listRetryAccessor{client: client}
+
+	dir := "/buckets/b/filer: no entry is found in filer store"
+	entries, _, err := listWithRetry(dir, func() ([]*filer_pb.Entry, bool, error) {
+		return listOnce(accessor, dir)
+	})
+
+	require.NoError(t, err)
+	assert.Equal(t, []string{"upload-1"}, entryNames(entries))
+	assert.Equal(t, 2, client.attempts, "an object name must not suppress a retry")
+}
diff --git a/weed/s3api/iam_defaults_test.go b/weed/s3api/iam_defaults_test.go
index 37aeeb4827..5f9d4747a9 100644
--- a/weed/s3api/iam_defaults_test.go
+++ b/weed/s3api/iam_defaults_test.go
@@ -277,3 +277,66 @@ func TestLoadIAMManagerFromConfig_ExplicitFileEnforcesUserScopedPolicy(t *testin
 	assert.NoError(t, err)
 	assert.True(t, allowed, "user-scoped bucket creation should be allowed")
 }
+
+func TestLoadIAMManagerFromConfig_HonorsOIDCProviderStore(t *testing.T) {
+	// The documented oidcProviderStore key must reach the IAM manager; without
+	// it, providers created through the IAM API live in one gateway's memory.
+	cases := []struct {
+		name  string
+		store string
+		filer bool
+	}{
+		{"absent keeps memory", ``, false},
+		{"filer persists", `,"oidcProviderStore":{"storeType":"filer"}`, true},
+		{"no config file persists", "no-file", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			configPath := ""
+			if tc.store != "no-file" {
+				configPath = filepath.Join(t.TempDir(), "iam_config.json")
+				configContent := `{"sts":{"providers":[]},"policy":{"storeType":"memory","defaultEffect":"Deny"}` + tc.store + `}`
+				assert.NoError(t, os.WriteFile(configPath, []byte(configContent), 0644))
+			}
+
+			manager, err := loadIAMManagerFromConfig(configPath, func() string { return "localhost:8888" }, func() string { return "oidc-store-signing-key" })
+			assert.NoError(t, err)
+			_, isFiler := manager.GetOIDCProviderStore().(*integration.FilerOIDCProviderStore)
+			assert.Equal(t, tc.filer, isFiler)
+		})
+	}
+}
+
+func TestLoadIAMManagerFromConfig_HonorsRoleStoreAndMarksStaticRoles(t *testing.T) {
+	cases := []struct {
+		name  string
+		store string
+		filer bool
+	}{
+		{"absent keeps memory", ``, false},
+		{"filer persists", `,"roleStore":{"storeType":"filer"}`, true},
+		{"no config file persists", "no-file", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			configPath := ""
+			if tc.store != "no-file" {
+				configPath = filepath.Join(t.TempDir(), "iam_config.json")
+				configContent := `{"sts":{"providers":[]},"policy":{"storeType":"memory","defaultEffect":"Deny"},` +
+					`"roles":[{"roleName":"from-file","trustPolicy":{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Federated":"https://issuer.example"},"Action":["sts:AssumeRoleWithWebIdentity"]}]}}]` +
+					tc.store + `}`
+				assert.NoError(t, os.WriteFile(configPath, []byte(configContent), 0644))
+			}
+
+			manager, err := loadIAMManagerFromConfig(configPath, func() string { return "localhost:8888" }, func() string { return "role-store-signing-key" })
+			assert.NoError(t, err)
+			_, inMemory := manager.GetRoleStore().(*integration.MemoryRoleStore)
+			assert.Equal(t, tc.filer, !inMemory)
+			if !tc.filer {
+				role, err := manager.GetRole(context.Background(), "from-file")
+				assert.NoError(t, err)
+				assert.Equal(t, integration.RoleSourceStaticConfig, role.Source)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/iam_list_prefix_regression_test.go b/weed/s3api/iam_list_prefix_regression_test.go
index a2e611e7f1..c2af20c846 100644
--- a/weed/s3api/iam_list_prefix_regression_test.go
+++ b/weed/s3api/iam_list_prefix_regression_test.go
@@ -1,11 +1,17 @@
 package s3api
 
 import (
+	"context"
 	"encoding/json"
 	"net/http/httptest"
 	"testing"
+	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/stretchr/testify/require"
 )
 
@@ -106,6 +112,152 @@ func TestEvaluateIAMPolicies_ListBucketVersionsWithPrefix(t *testing.T) {
 		"s3:ListBucketVersions must still resolve when listing with a prefix")
 }
 
+// GET ?uploads routes under ACTION_READ, not ACTION_LIST, but it is a bucket
+// listing: a promoted prefix must not resolve it to s3:GetObject, and only
+// s3:ListBucketMultipartUploads on the bucket ARN may allow it.
+func TestEvaluateIAMPolicies_ListMultipartUploadsWithPrefix(t *testing.T) {
+	const bucket = "test-bucket"
+
+	iam := &IdentityAccessManagement{}
+	require.NoError(t, iam.PutPolicy("list-uploads", mustPolicy(t, map[string]any{
+		"Version": "2012-10-17",
+		"Statement": []map[string]any{{
+			"Effect":   "Allow",
+			"Action":   "s3:ListBucketMultipartUploads",
+			"Resource": "arn:aws:s3:::" + bucket,
+		}},
+	})))
+	require.NoError(t, iam.PutPolicy("get-object", mustPolicy(t, map[string]any{
+		"Version": "2012-10-17",
+		"Statement": []map[string]any{{
+			"Effect":   "Allow",
+			"Action":   "s3:GetObject",
+			"Resource": "arn:aws:s3:::" + bucket + "/*",
+		}},
+	})))
+
+	uploadsReader := &Identity{
+		Name:        "dave",
+		Account:     &AccountAdmin,
+		PolicyNames: []string{"list-uploads"},
+		Credentials: []*Credential{{AccessKey: "AKIAEXAMPLE", SecretKey: "secret"}},
+	}
+	getReader := &Identity{
+		Name:        "erin",
+		Account:     &AccountAdmin,
+		PolicyNames: []string{"get-object"},
+		Credentials: []*Credential{{AccessKey: "AKIAEXAMPLE", SecretKey: "secret"}},
+	}
+
+	r := httptest.NewRequest("GET", "/"+bucket+"?uploads&prefix=uploads/", nil)
+	require.True(t, iam.evaluateIAMPolicies(r, uploadsReader, s3_constants.ACTION_READ, bucket, "uploads/"),
+		"s3:ListBucketMultipartUploads on the bucket must allow the uploads listing")
+	require.False(t, iam.evaluateIAMPolicies(r, getReader, s3_constants.ACTION_READ, bucket, "uploads/"),
+		"s3:GetObject must not satisfy the uploads listing")
+}
+
+// The IAM-integration authorizer must resolve the listing variant the same way
+// evaluateIAMPolicies does: a prefix promoted into the object argument is not
+// part of the request URL, so ?versions&prefix=... still resolves to
+// s3:ListBucketVersions and an s3:ListBucket grant must not cover it.
+func TestAuthorizeAction_ListVersionsWithPromotedPrefix(t *testing.T) {
+	const bucket = "test-bucket"
+
+	ctx := context.Background()
+	iamManager := integration.NewIAMManager()
+	require.NoError(t, iamManager.Initialize(&integration.IAMConfig{
+		STS: &sts.STSConfig{
+			TokenDuration:    sts.FlexibleDuration{Duration: time.Hour},
+			MaxSessionLength: sts.FlexibleDuration{Duration: 12 * time.Hour},
+			Issuer:           "test-sts",
+			SigningKey:       []byte("test-signing-key-32-characters-long"),
+		},
+		Policy: &policy.PolicyEngineConfig{DefaultEffect: "Deny", StoreType: "memory"},
+		Roles:  &integration.RoleStoreConfig{StoreType: "memory"},
+	}, func() string { return "localhost:8888" }))
+
+	require.NoError(t, iamManager.CreatePolicy(ctx, "", "ListBucketOnly", &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{{
+			Effect:    "Allow",
+			Action:    []string{"s3:ListBucket"},
+			Resource:  []string{"arn:aws:s3:::" + bucket},
+			Condition: map[string]map[string]interface{}{"StringLike": {"s3:prefix": "b/*"}},
+		}},
+	}))
+	require.NoError(t, iamManager.CreatePolicy(ctx, "", "ListVersionsOnly", &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{{
+			Effect:   "Allow",
+			Action:   []string{"s3:ListBucketVersions"},
+			Resource: []string{"arn:aws:s3:::" + bucket},
+		}},
+	}))
+	require.NoError(t, iamManager.CreatePolicy(ctx, "", "ListUploadsOnly", &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{{
+			Effect:   "Allow",
+			Action:   []string{"s3:ListBucketMultipartUploads"},
+			Resource: []string{"arn:aws:s3:::" + bucket},
+		}},
+	}))
+	require.NoError(t, iamManager.CreatePolicy(ctx, "", "GetObjectOnly", &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{{
+			Effect:   "Allow",
+			Action:   []string{"s3:GetObject"},
+			Resource: []string{"arn:aws:s3:::" + bucket + "/*"},
+		}},
+	}))
+
+	s3iam := NewS3IAMIntegration(iamManager, "localhost:8888")
+	reader := &IAMIdentity{
+		Name:        "reader",
+		Principal:   "arn:aws:iam::000000000000:user/reader",
+		PolicyNames: []string{"ListBucketOnly"},
+	}
+
+	versionsReq := httptest.NewRequest("GET", "/"+bucket+"?versions&prefix=b/", nil)
+	// object carries the promoted prefix, matching authRequestWithAuthType
+	require.Equal(t, s3err.ErrAccessDenied,
+		s3iam.AuthorizeAction(ctx, reader, s3_constants.ACTION_LIST, bucket, "b/", versionsReq),
+		"an s3:ListBucket grant must not cover ?versions listing")
+
+	listReq := httptest.NewRequest("GET", "/"+bucket+"?list-type=2&prefix=b/", nil)
+	require.Equal(t, s3err.ErrNone,
+		s3iam.AuthorizeAction(ctx, reader, s3_constants.ACTION_LIST, bucket, "b/", listReq),
+		"s3:ListBucket with a matching s3:prefix still lists")
+
+	versionsReader := &IAMIdentity{
+		Name:        "versions-reader",
+		Principal:   "arn:aws:iam::000000000000:user/versions-reader",
+		PolicyNames: []string{"ListVersionsOnly"},
+	}
+	require.Equal(t, s3err.ErrNone,
+		s3iam.AuthorizeAction(ctx, versionsReader, s3_constants.ACTION_LIST, bucket, "b/", versionsReq),
+		"s3:ListBucketVersions allows the versions listing")
+
+	// GET ?uploads routes under ACTION_READ; a promoted prefix must still
+	// resolve it to s3:ListBucketMultipartUploads, not s3:GetObject.
+	uploadsReq := httptest.NewRequest("GET", "/"+bucket+"?uploads&prefix=b/", nil)
+	uploadsReader := &IAMIdentity{
+		Name:        "uploads-reader",
+		Principal:   "arn:aws:iam::000000000000:user/uploads-reader",
+		PolicyNames: []string{"ListUploadsOnly"},
+	}
+	require.Equal(t, s3err.ErrNone,
+		s3iam.AuthorizeAction(ctx, uploadsReader, s3_constants.ACTION_READ, bucket, "b/", uploadsReq),
+		"s3:ListBucketMultipartUploads allows the uploads listing")
+	getReader := &IAMIdentity{
+		Name:        "get-reader",
+		Principal:   "arn:aws:iam::000000000000:user/get-reader",
+		PolicyNames: []string{"GetObjectOnly"},
+	}
+	require.Equal(t, s3err.ErrAccessDenied,
+		s3iam.AuthorizeAction(ctx, getReader, s3_constants.ACTION_READ, bucket, "b/", uploadsReq),
+		"s3:GetObject must not satisfy the uploads listing")
+}
+
 func mustPolicy(t *testing.T, doc map[string]any) string {
 	t.Helper()
 	b, err := json.Marshal(doc)
diff --git a/weed/s3api/iceberg/commit_helpers.go b/weed/s3api/iceberg/commit_helpers.go
index 2acf340446..116ed85862 100644
--- a/weed/s3api/iceberg/commit_helpers.go
+++ b/weed/s3api/iceberg/commit_helpers.go
@@ -5,8 +5,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"math/rand/v2"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/apache/iceberg-go/table"
 	"github.com/google/uuid"
@@ -17,6 +19,36 @@ import (
 
 const requirementAssertCreate = "assert-create"
 
+// sleepBeforeCommitRetry backs off between commit attempts, jittered so that
+// writers that collided do not line up again on the next try.
+func sleepBeforeCommitRetry(attempt int) {
+	jitter := time.Duration(rand.Int64N(int64(25 * time.Millisecond)))
+	time.Sleep(time.Duration(50*attempt)*time.Millisecond + jitter)
+}
+
+// stageCommitMetadata writes the metadata file a commit will point the catalog
+// at, returning the name and location it landed on. The exclusive create keeps
+// one writer from overwriting another's file; when the name is already taken
+// the metadata goes to a unique one instead of failing, because the file there
+// may be an orphan left by an interrupted commit, and refusing would wedge the
+// table until an orphan sweep ran. The catalog pointer, not the file name,
+// decides which commit won. This mirrors how the maintenance worker stages its
+// own metadata.
+func (s *Server) stageCommitMetadata(ctx context.Context, metadataBucket, metadataPath, location, metadataFileName string, metadataBytes []byte) (string, string, error) {
+	err := s.saveMetadataFile(ctx, metadataBucket, metadataPath, metadataFileName, metadataBytes, true)
+	if errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+		// v{N}-{uuid}, a form both the catalog and the maintenance worker
+		// still read the version from.
+		metadataFileName = fmt.Sprintf("%s-%s.metadata.json", strings.TrimSuffix(metadataFileName, ".metadata.json"), uuid.NewString())
+		glog.V(1).Infof("Iceberg: metadata file already staged for %s, using %s", location, metadataFileName)
+		err = s.saveMetadataFile(ctx, metadataBucket, metadataPath, metadataFileName, metadataBytes, true)
+	}
+	if err != nil {
+		return "", "", err
+	}
+	return metadataFileName, fmt.Sprintf("%s/metadata/%s", strings.TrimSuffix(location, "/"), metadataFileName), nil
+}
+
 type icebergRequestError struct {
 	status  int
 	errType string
@@ -155,7 +187,14 @@ func (s *Server) finalizeCreateOnCommit(ctx context.Context, input createOnCommi
 			message: "Invalid table location: " + err.Error(),
 		}
 	}
-	if err := s.saveMetadataFile(ctx, metadataBucket, metadataPath, metadataFileName, metadataBytes); err != nil {
+	if err := confineMetadataLocation(metadataBucket, metadataPath, input.markerBucket); err != nil {
+		return nil, &icebergRequestError{
+			status:  http.StatusBadRequest,
+			errType: "BadRequestException",
+			message: err.Error(),
+		}
+	}
+	if err := s.saveMetadataFile(ctx, metadataBucket, metadataPath, metadataFileName, metadataBytes, false); err != nil {
 		return nil, &icebergRequestError{
 			status:  http.StatusInternalServerError,
 			errType: "InternalServerError",
@@ -213,3 +252,59 @@ func (s *Server) finalizeCreateOnCommit(ctx context.Context, input createOnCommi
 		Metadata:         newMetadata,
 	}, nil
 }
+
+// authorizeCommit asks the S3 Tables layer, before anything is written, whether
+// the caller may update the table. Both commit paths stage the new metadata
+// file in the table's directory before UpdateTable authorizes the pointer
+// flip, so without this gate a caller who may only read the table could still
+// make the server write and delete files under it. UpdateTable decides again
+// when the pointer flips.
+func (s *Server) authorizeCommit(ctx context.Context, bucketARN string, namespace []string, tableName, identityName string) *icebergRequestError {
+	err := s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return s.tablesManager.AuthorizeUpdateTable(ctx, s3tables.NewManagerClient(client), &s3tables.UpdateTableRequest{
+			TableBucketARN: bucketARN,
+			Namespace:      namespace,
+			Name:           tableName,
+		}, identityName)
+	})
+	if err == nil {
+		return nil
+	}
+	var tableErr *s3tables.S3TablesError
+	if errors.As(err, &tableErr) {
+		switch tableErr.Type {
+		case s3tables.ErrCodeAccessDenied:
+			return &icebergRequestError{http.StatusForbidden, "ForbiddenException", fmt.Sprintf("Not authorized to commit to table %s", tableName)}
+		case s3tables.ErrCodeNoSuchTable, s3tables.ErrCodeNoSuchNamespace:
+			return &icebergRequestError{http.StatusNotFound, "NoSuchTableException", fmt.Sprintf("Table does not exist: %s", tableName)}
+		}
+	}
+	glog.V(1).Infof("Iceberg: commit authorization for %s failed: %v", tableName, err)
+	return &icebergRequestError{http.StatusInternalServerError, "InternalServerError", "Failed to authorize commit: " + err.Error()}
+}
+
+// authorizeViewCommit is authorizeCommit for a view, whose update path stages
+// its metadata file before UpdateView authorizes the pointer flip.
+func (s *Server) authorizeViewCommit(ctx context.Context, bucketARN string, namespace []string, viewName, identityName string) *icebergRequestError {
+	err := s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return s.tablesManager.AuthorizeUpdateView(ctx, s3tables.NewManagerClient(client), &s3tables.UpdateViewRequest{
+			TableBucketARN: bucketARN,
+			Namespace:      namespace,
+			Name:           viewName,
+		}, identityName)
+	})
+	if err == nil {
+		return nil
+	}
+	var tableErr *s3tables.S3TablesError
+	if errors.As(err, &tableErr) {
+		switch tableErr.Type {
+		case s3tables.ErrCodeAccessDenied:
+			return &icebergRequestError{http.StatusForbidden, "ForbiddenException", fmt.Sprintf("Not authorized to commit to view %s", viewName)}
+		case s3tables.ErrCodeNoSuchView, s3tables.ErrCodeNoSuchNamespace:
+			return &icebergRequestError{http.StatusNotFound, "NoSuchViewException", fmt.Sprintf("View does not exist: %s", viewName)}
+		}
+	}
+	glog.V(1).Infof("Iceberg: view commit authorization for %s failed: %v", viewName, err)
+	return &icebergRequestError{http.StatusInternalServerError, "InternalServerError", "Failed to authorize commit: " + err.Error()}
+}
diff --git a/weed/s3api/iceberg/handlers_commit.go b/weed/s3api/iceberg/handlers_commit.go
index c62c774cb6..c31a6d5d5d 100644
--- a/weed/s3api/iceberg/handlers_commit.go
+++ b/weed/s3api/iceberg/handlers_commit.go
@@ -4,11 +4,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"math/rand/v2"
 	"net/http"
 	"path"
 	"strings"
-	"time"
 
 	"github.com/apache/iceberg-go/table"
 	"github.com/google/uuid"
@@ -53,7 +51,12 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 	req.Identifier = raw.Identifier
 	var statisticsUpdates []statisticsUpdate
 	if len(raw.Requirements) > 0 {
-		if err := json.Unmarshal(raw.Requirements, &req.Requirements); err != nil {
+		normalized, err := normalizeRequirements(raw.Requirements)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "BadRequestException", "Invalid requirements: "+err.Error())
+			return
+		}
+		if err := json.Unmarshal(normalized, &req.Requirements); err != nil {
 			writeError(w, http.StatusBadRequest, "BadRequestException", "Invalid requirements: "+err.Error())
 			return
 		}
@@ -143,6 +146,10 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 						writeError(w, http.StatusInternalServerError, "InternalServerError", "Invalid staged metadata location: "+parseLocationErr.Error())
 						return
 					}
+					if err := confineMetadataLocation(stagedBucket, stagedPath, bucketName); err != nil {
+						writeError(w, http.StatusBadRequest, "BadRequestException", err.Error())
+						return
+					}
 					stagedMetadataBytes, loadErr := s.loadMetadataFile(r.Context(), stagedBucket, stagedPath, stagedFileName)
 					if loadErr != nil {
 						if !errors.Is(loadErr, filer_pb.ErrNotFound) {
@@ -171,6 +178,12 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 					writeError(w, http.StatusNotFound, "NoSuchTableException", fmt.Sprintf("Table does not exist: %s", tableName))
 					return
 				}
+				// From here the commit creates the table, writing its metadata
+				// file before the create that authorizes it.
+				if authErr := s.authorizeCreateTable(r.Context(), bucketARN, namespace, tableName, identityName); authErr != nil {
+					writeManagerError(w, authErr)
+					return
+				}
 
 				for _, requirement := range req.Requirements {
 					validateAgainst := table.Metadata(nil)
@@ -192,6 +205,16 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 					}
 				}
 
+				createBucket, createPath, createLocErr := parseS3Location(location)
+				if createLocErr != nil {
+					writeError(w, http.StatusInternalServerError, "InternalServerError", "Invalid table location: "+createLocErr.Error())
+					return
+				}
+				if err := confineMetadataLocation(createBucket, createPath, bucketName); err != nil {
+					writeError(w, http.StatusBadRequest, "BadRequestException", err.Error())
+					return
+				}
+
 				repairManifests(location)
 
 				result, reqErr := s.finalizeCreateOnCommit(r.Context(), createOnCommitInput{
@@ -219,11 +242,24 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 			writeManagerError(w, err)
 			return
 		}
+		if reqErr := s.authorizeCommit(r.Context(), bucketARN, namespace, tableName, identityName); reqErr != nil {
+			writeError(w, reqErr.status, reqErr.errType, reqErr.message)
+			return
+		}
 
 		location := tableLocationFromMetadataLocation(getResp.MetadataLocation)
 		if location == "" {
 			location = fmt.Sprintf("s3://%s/%s", bucketName, path.Join(flattenNamespacePath(namespace), tableName))
 		}
+		locBucket, locPath, locErr := parseS3Location(location)
+		if locErr != nil {
+			writeError(w, http.StatusInternalServerError, "InternalServerError", "Invalid table location: "+locErr.Error())
+			return
+		}
+		if err := confineMetadataLocation(locBucket, locPath, bucketName); err != nil {
+			writeError(w, http.StatusBadRequest, "BadRequestException", err.Error())
+			return
+		}
 		tableUUID := uuid.Nil
 		if getResp.Metadata != nil && getResp.Metadata.Iceberg != nil && getResp.Metadata.Iceberg.TableUUID != "" {
 			if parsed, parseErr := uuid.Parse(getResp.Metadata.Iceberg.TableUUID); parseErr == nil {
@@ -311,7 +347,12 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusInternalServerError, "InternalServerError", "Invalid table location: "+err.Error())
 			return
 		}
-		if err := s.saveMetadataFile(r.Context(), metadataBucket, metadataPath, metadataFileName, metadataBytes); err != nil {
+		if err := confineMetadataLocation(metadataBucket, metadataPath, bucketName); err != nil {
+			writeError(w, http.StatusBadRequest, "BadRequestException", err.Error())
+			return
+		}
+		metadataFileName, newMetadataLocation, err = s.stageCommitMetadata(r.Context(), metadataBucket, metadataPath, location, metadataFileName, metadataBytes)
+		if err != nil {
 			writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to save metadata file: "+err.Error())
 			return
 		}
@@ -350,8 +391,7 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 			}
 			if attempt < maxCommitAttempts {
 				glog.V(1).Infof("Iceberg: CommitTable conflict for %s (attempt %d/%d), retrying", tableName, attempt, maxCommitAttempts)
-				jitter := time.Duration(rand.Int64N(int64(25 * time.Millisecond)))
-				time.Sleep(time.Duration(50*attempt)*time.Millisecond + jitter)
+				sleepBeforeCommitRetry(attempt)
 				continue
 			}
 			writeError(w, http.StatusConflict, "CommitFailedException", "Version token mismatch")
@@ -361,8 +401,8 @@ func (s *Server) handleUpdateTable(w http.ResponseWriter, r *http.Request) {
 		if cleanupErr := s.deleteMetadataFile(r.Context(), metadataBucket, metadataPath, metadataFileName); cleanupErr != nil {
 			glog.V(1).Infof("Iceberg: failed to cleanup metadata file %s after update failure: %v", newMetadataLocation, cleanupErr)
 		}
-		glog.Errorf("Iceberg: CommitTable UpdateTable error: %v", err)
-		writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to commit table update: "+err.Error())
+		logManagerError("CommitTable UpdateTable", err)
+		writeManagerError(w, err)
 		return
 	}
 }
diff --git a/weed/s3api/iceberg/handlers_metrics.go b/weed/s3api/iceberg/handlers_metrics.go
new file mode 100644
index 0000000000..87dd3a813f
--- /dev/null
+++ b/weed/s3api/iceberg/handlers_metrics.go
@@ -0,0 +1,58 @@
+package iceberg
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// Reports carry per-file scan metrics and grow with the table. The content is
+// discarded either way, so anything past this is accepted without being read
+// into memory rather than rejected.
+const maxMetricsReportBytes = 1 << 20
+
+// handleReportMetrics accepts the scan and commit reports engines send after
+// planning or committing. The catalog keeps no metrics store, but the endpoint
+// has to exist: clients that get a 404 here log an error per query, and some
+// treat repeated failures as a broken catalog.
+func (s *Server) handleReportMetrics(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	namespace := parseNamespace(vars["namespace"])
+	tableName := vars["table"]
+
+	if len(namespace) == 0 || tableName == "" {
+		writeError(w, http.StatusBadRequest, "BadRequestException", "Namespace and table name are required")
+		return
+	}
+
+	// One byte past the limit distinguishes a report that fits from one that
+	// was cut short, which would otherwise fail to parse and look malformed.
+	body, err := io.ReadAll(io.LimitReader(r.Body, maxMetricsReportBytes+1))
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "BadRequestException", "Invalid request body")
+		return
+	}
+	if len(body) > maxMetricsReportBytes {
+		glog.V(3).Infof("Iceberg: discarding oversized metrics report for %s.%s", flattenNamespacePath(namespace), tableName)
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+
+	var report struct {
+		ReportType string `json:"report-type"`
+	}
+	if err := json.Unmarshal(body, &report); err != nil {
+		writeError(w, http.StatusBadRequest, "BadRequestException", "Invalid request body: "+err.Error())
+		return
+	}
+	if report.ReportType == "" {
+		writeError(w, http.StatusBadRequest, "BadRequestException", "report-type is required")
+		return
+	}
+
+	glog.V(3).Infof("Iceberg: metrics report %q for %s.%s", report.ReportType, flattenNamespacePath(namespace), tableName)
+	w.WriteHeader(http.StatusNoContent)
+}
diff --git a/weed/s3api/iceberg/handlers_metrics_test.go b/weed/s3api/iceberg/handlers_metrics_test.go
new file mode 100644
index 0000000000..41659c003a
--- /dev/null
+++ b/weed/s3api/iceberg/handlers_metrics_test.go
@@ -0,0 +1,63 @@
+package iceberg
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+)
+
+func postMetrics(t *testing.T, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	r := httptest.NewRequest(http.MethodPost, "/v1/namespaces/ns/tables/t/metrics", strings.NewReader(body))
+	r = mux.SetURLVars(r, map[string]string{"namespace": "ns", "table": "t"})
+	w := httptest.NewRecorder()
+	(&Server{}).handleReportMetrics(w, r)
+	return w
+}
+
+func TestHandleReportMetricsAcceptsScanReport(t *testing.T) {
+	w := postMetrics(t, `{"report-type":"scan-report","table-name":"t","snapshot-id":1}`)
+	if w.Code != http.StatusNoContent {
+		t.Errorf("status = %d, want %d: %s", w.Code, http.StatusNoContent, w.Body.String())
+	}
+}
+
+func TestHandleReportMetricsRejectsGarbage(t *testing.T) {
+	w := postMetrics(t, `not json`)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
+
+// The spec makes the body and its report-type required.
+func TestHandleReportMetricsRequiresReportType(t *testing.T) {
+	for _, body := range []string{``, `{}`, `{"report-type":""}`} {
+		if w := postMetrics(t, body); w.Code != http.StatusBadRequest {
+			t.Errorf("body %q: status = %d, want %d", body, w.Code, http.StatusBadRequest)
+		}
+	}
+}
+
+// A report larger than the read limit is still a valid report; truncating it
+// and then failing to parse would hand the client an error for a query that
+// worked.
+func TestHandleReportMetricsAcceptsOversizedReport(t *testing.T) {
+	padding := strings.Repeat("x", maxMetricsReportBytes)
+	w := postMetrics(t, `{"report-type":"scan-report","padding":"`+padding+`"}`)
+	if w.Code != http.StatusNoContent {
+		t.Errorf("status = %d, want %d: %s", w.Code, http.StatusNoContent, w.Body.String())
+	}
+}
+
+func TestHandleReportMetricsRequiresTable(t *testing.T) {
+	r := httptest.NewRequest(http.MethodPost, "/v1/namespaces/ns/tables//metrics", strings.NewReader(`{}`))
+	r = mux.SetURLVars(r, map[string]string{"namespace": "ns"})
+	w := httptest.NewRecorder()
+	(&Server{}).handleReportMetrics(w, r)
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want %d", w.Code, http.StatusBadRequest)
+	}
+}
diff --git a/weed/s3api/iceberg/handlers_namespace.go b/weed/s3api/iceberg/handlers_namespace.go
index 1cfdf856d1..00dd4700dd 100644
--- a/weed/s3api/iceberg/handlers_namespace.go
+++ b/weed/s3api/iceberg/handlers_namespace.go
@@ -140,7 +140,7 @@ func (s *Server) handleCreateNamespace(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusConflict, "AlreadyExistsException", err.Error())
 			return
 		}
-		glog.Errorf("Iceberg: CreateNamespace error: %v", err)
+		logManagerError("CreateNamespace", err)
 		writeManagerError(w, err)
 		return
 	}
diff --git a/weed/s3api/iceberg/handlers_oauth.go b/weed/s3api/iceberg/handlers_oauth.go
index 9a9b16d921..54391d04e4 100644
--- a/weed/s3api/iceberg/handlers_oauth.go
+++ b/weed/s3api/iceberg/handlers_oauth.go
@@ -5,6 +5,8 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"net/http"
+	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -18,6 +20,9 @@ type OAuthTokenResponse struct {
 	TokenType   string `json:"token_type"`
 	ExpiresIn   int    `json:"expires_in"`
 	Scope       string `json:"scope,omitempty"`
+	// IssuedTokenType is set to the access-token URN on token-exchange
+	// responses, where RFC 8693 requires it.
+	IssuedTokenType string `json:"issued_token_type,omitempty"`
 }
 
 // OAuthErrorResponse is the error response for the OAuth endpoint.
@@ -33,7 +38,58 @@ type IcebergClaims struct {
 	jwt.RegisteredClaims
 }
 
-const oauthTokenExpiry = 3600 // 1 hour in seconds
+const defaultOauthTokenExpiry = 3600
+
+// maxOauthTokenExpiry bounds the configured TTL so seconds-to-Duration
+// conversions cannot overflow into already-expired tokens.
+const maxOauthTokenExpiry = 365 * 24 * 3600
+
+// accessTokenTokenType is the RFC 8693 token-type URN for access tokens,
+// required in issued_token_type on token-exchange responses.
+const accessTokenTokenType = "urn:ietf:params:oauth:token-type:access_token"
+
+// grant types accepted by POST /v1/oauth/tokens. Iceberg Java 1.10.x
+// refreshes tokens via token-exchange (exchangeEnabled defaults true), so a
+// server that only accepts client_credentials leaves those clients unable
+// to refresh.
+const (
+	grantTypeClientCredentials = "client_credentials"
+	grantTypeTokenExchange     = "urn:ietf:params:oauth:grant-type:token-exchange"
+)
+
+// oauthExpirySeconds returns the OAuth token TTL. Deployments whose
+// clients cannot refresh tokens on 401 can raise this to survive client
+// restart cycles instead of dying every hour.
+func oauthExpirySeconds() int {
+	if v := os.Getenv("ICEBERG_OAUTH_TOKEN_EXPIRY"); v != "" {
+		// Parse in 64-bit space: on 32-bit platforms Atoi overflows and
+		// errors on oversized values, which would silently fall back to
+		// the default instead of clamping.
+		if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
+			if n > maxOauthTokenExpiry {
+				return maxOauthTokenExpiry
+			}
+			return int(n)
+		}
+	}
+	return defaultOauthTokenExpiry
+}
+
+// tokenExchangeGrace is how long an expired subject token may still be
+// exchanged for a fresh access token. Signature verification is the real
+// gate; the grace exists so a client holding a token that expired while the
+// exchange grant was unsupported (or during a server outage) recovers
+// without a process restart.
+func tokenExchangeGrace() time.Duration {
+	grace := 2 * oauthExpirySeconds()
+	if grace < 3600 {
+		grace = 3600
+	}
+	if grace > 86400 {
+		grace = 86400
+	}
+	return time.Duration(grace) * time.Second
+}
 
 // handleOAuthTokens implements the OAuth2 client_credentials flow.
 // POST /v1/oauth/tokens
@@ -50,7 +106,13 @@ func (s *Server) handleOAuthTokens(w http.ResponseWriter, r *http.Request) {
 	}
 
 	grantType := r.PostFormValue("grant_type")
-	if grantType != "client_credentials" {
+	switch grantType {
+	case grantTypeClientCredentials:
+		// handled below
+	case grantTypeTokenExchange, "token_exchange":
+		s.handleTokenExchange(w, r)
+		return
+	default:
 		writeOAuthError(w, http.StatusBadRequest, "unsupported_grant_type",
 			fmt.Sprintf("Unsupported grant_type: %s", grantType))
 		return
@@ -88,20 +150,7 @@ func (s *Server) handleOAuthTokens(w http.ResponseWriter, r *http.Request) {
 
 	// Generate a JWT signed with a key derived from the client secret.
 	// Include the access key in claims so we can look up the exact credential for verification.
-	signingKey := deriveSigningKey(clientID, clientSecret)
-	now := time.Now()
-	claims := IcebergClaims{
-		IdentityName: identityName,
-		AccessKey:    clientID,
-		RegisteredClaims: jwt.RegisteredClaims{
-			IssuedAt:  jwt.NewNumericDate(now),
-			ExpiresAt: jwt.NewNumericDate(now.Add(time.Duration(oauthTokenExpiry) * time.Second)),
-			Issuer:    "seaweedfs-iceberg",
-		},
-	}
-
-	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	tokenString, err := token.SignedString(signingKey)
+	tokenString, err := mintIcebergToken(identityName, clientID, clientSecret, oauthExpirySeconds())
 	if err != nil {
 		glog.Errorf("Iceberg OAuth: failed to sign token: %v", err)
 		writeOAuthError(w, http.StatusInternalServerError, "server_error", "Failed to generate token")
@@ -112,30 +161,191 @@ func (s *Server) handleOAuthTokens(w http.ResponseWriter, r *http.Request) {
 	resp := OAuthTokenResponse{
 		AccessToken: tokenString,
 		TokenType:   "bearer",
-		ExpiresIn:   oauthTokenExpiry,
+		ExpiresIn:   oauthExpirySeconds(),
 		Scope:       scope,
 	}
 	w.Header().Set("Cache-Control", "no-store")
 	writeJSON(w, http.StatusOK, resp)
 }
 
+// handleTokenExchange implements RFC 8693 token exchange for Iceberg REST
+// clients: a previously issued access token (subject_token) is exchanged for
+// a fresh one. Iceberg Java's OAuth2Manager refreshes via this grant
+// (exchangeEnabled defaults true), so supporting it lets those clients
+// self-heal before their token expires — no client restart needed.
+//
+// Client authentication (RFC 8693 §2.1) is accepted but not required:
+// Iceberg Java's refreshExpiredToken sends Basic credentials with the
+// exchange, while its proactive scheduled refresh sends only the Bearer
+// session headers. An expired subject_token is only exchangeable with valid
+// client credentials, and an unauthenticated exchange never extends the
+// token's lifetime beyond the subject_token's own expiry.
+func (s *Server) handleTokenExchange(w http.ResponseWriter, r *http.Request) {
+	if s.credentialValidator == nil {
+		writeOAuthError(w, http.StatusInternalServerError, "server_error", "Credential validation not configured")
+		return
+	}
+
+	subjectToken := r.PostFormValue("subject_token")
+	if subjectToken == "" {
+		writeOAuthError(w, http.StatusBadRequest, "invalid_request", "Missing subject_token")
+		return
+	}
+
+	// Verify the subject token by signature (exp checked separately against
+	// the recovery grace).
+	unverified := &IcebergClaims{}
+	parser := jwt.NewParser(jwt.WithoutClaimsValidation())
+	if _, _, err := parser.ParseUnverified(subjectToken, unverified); err != nil {
+		writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "Invalid subject_token")
+		return
+	}
+	if unverified.AccessKey == "" || unverified.Issuer != "seaweedfs-iceberg" {
+		writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "Invalid subject_token")
+		return
+	}
+	identityName, _, secretKey, err := s.credentialValidator.GetCredentialByAccessKey(unverified.AccessKey)
+	if err != nil {
+		glog.V(2).Infof("Iceberg OAuth: token exchange failed to get credential for access key: %v", err)
+		writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "Invalid subject_token")
+		return
+	}
+
+	// Optional client authentication. When present, the client must
+	// authenticate with the same credential that issued the subject_token.
+	clientID, clientSecret, hasBasic := r.BasicAuth()
+	if !hasBasic {
+		clientID = r.PostFormValue("client_id")
+		clientSecret = r.PostFormValue("client_secret")
+		hasBasic = clientID != "" && clientSecret != ""
+	}
+	clientAuthenticated := false
+	if hasBasic {
+		if _, _, err := s.credentialValidator.ValidateS3Credential(clientID, clientSecret); err != nil {
+			glog.V(2).Infof("Iceberg OAuth: token exchange client authentication failed for client_id=%s: %v", clientID, err)
+			writeOAuthError(w, http.StatusUnauthorized, "invalid_client", "Invalid client credentials")
+			return
+		}
+		if clientID != unverified.AccessKey {
+			writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "subject_token was issued to a different client")
+			return
+		}
+		clientAuthenticated = true
+	}
+
+	signingKey := deriveSigningKey(unverified.AccessKey, secretKey)
+	claims := &IcebergClaims{}
+	parsed, err := jwt.ParseWithClaims(subjectToken, claims, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return signingKey, nil
+	}, jwt.WithoutClaimsValidation())
+	if err != nil || !parsed.Valid {
+		glog.V(2).Infof("Iceberg OAuth: token exchange signature verification failed: %v", err)
+		writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "Invalid subject_token")
+		return
+	}
+	if claims.Issuer != "seaweedfs-iceberg" {
+		writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "Invalid subject_token")
+		return
+	}
+	if claims.ExpiresAt == nil {
+		// Tokens minted by this server always carry an expiry; a subject
+		// token without one must not be exchangeable forever.
+		writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "subject_token has no expiry")
+		return
+	}
+
+	ttlSeconds := oauthExpirySeconds()
+	if time.Now().After(claims.ExpiresAt.Time) {
+		// Expired subject tokens are only exchangeable by an authenticated
+		// client, within the recovery grace.
+		if !clientAuthenticated {
+			writeOAuthError(w, http.StatusBadRequest, "invalid_grant",
+				"subject_token is expired; client authentication is required to exchange it")
+			return
+		}
+		if time.Since(claims.ExpiresAt.Time) > tokenExchangeGrace() {
+			writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "subject_token expired beyond the exchange grace window")
+			return
+		}
+	} else if remaining := int(time.Until(claims.ExpiresAt.Time).Seconds()); !clientAuthenticated && remaining < ttlSeconds {
+		// Unauthenticated exchange (proactive refresh carrying only the
+		// Bearer) must not extend the lifetime past the subject's expiry;
+		// otherwise a leaked token could chain-refresh forever. An
+		// authenticated client gets a fresh full TTL — it could mint one
+		// via client_credentials anyway.
+		ttlSeconds = remaining
+	}
+	if ttlSeconds <= 0 {
+		// A subject token with under a second left would otherwise be
+		// exchanged for a token that is born expired.
+		writeOAuthError(w, http.StatusBadRequest, "invalid_grant", "subject_token has no remaining lifetime")
+		return
+	}
+
+	tokenString, err := mintIcebergToken(identityName, unverified.AccessKey, secretKey, ttlSeconds)
+	if err != nil {
+		glog.Errorf("Iceberg OAuth: failed to sign exchanged token: %v", err)
+		writeOAuthError(w, http.StatusInternalServerError, "server_error", "Failed to generate token")
+		return
+	}
+
+	resp := OAuthTokenResponse{
+		AccessToken:     tokenString,
+		TokenType:       "bearer",
+		ExpiresIn:       ttlSeconds,
+		Scope:           r.PostFormValue("scope"),
+		IssuedTokenType: accessTokenTokenType,
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// mintIcebergToken issues a signed access token for the given identity and
+// credential, valid for ttlSeconds.
+func mintIcebergToken(identityName, accessKey, secret string, ttlSeconds int) (string, error) {
+	signingKey := deriveSigningKey(accessKey, secret)
+	now := time.Now()
+	claims := IcebergClaims{
+		IdentityName: identityName,
+		AccessKey:    accessKey,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(time.Duration(ttlSeconds) * time.Second)),
+			Issuer:    "seaweedfs-iceberg",
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(signingKey)
+}
+
 // authenticateBearer validates a Bearer token from the Authorization header.
 // Returns the identity name, identity object, and whether auth succeeded.
 func (s *Server) authenticateBearer(r *http.Request) (string, interface{}, bool) {
+	identityName, identity, _, _, ok := s.authenticateBearerKey(r)
+	return identityName, identity, ok
+}
+
+// authenticateBearerKey is authenticateBearer that also returns the access key
+// the token was minted from (its verified access_key claim), so the catalog
+// can tell apart the holders of several keys on one identity.
+func (s *Server) authenticateBearerKey(r *http.Request) (string, interface{}, string, string, bool) {
 	auth := r.Header.Get("Authorization")
 	if auth == "" {
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 	if !strings.HasPrefix(strings.ToLower(auth), "bearer ") {
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 	tokenString := strings.TrimSpace(auth[7:])
 	if tokenString == "" {
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 
 	if s.credentialValidator == nil {
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 
 	// Parse the token without verification first to get the access key,
@@ -145,18 +355,18 @@ func (s *Server) authenticateBearer(r *http.Request) (string, interface{}, bool)
 	_, _, err := parser.ParseUnverified(tokenString, unverified)
 	if err != nil {
 		glog.V(2).Infof("Iceberg OAuth: failed to parse token: %v", err)
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 
 	if unverified.AccessKey == "" {
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 
 	// Look up the credential by access key to get the signing key for verification
 	identityName, identity, secretKey, err := s.credentialValidator.GetCredentialByAccessKey(unverified.AccessKey)
 	if err != nil {
 		glog.V(2).Infof("Iceberg OAuth: failed to get credential for access key: %v", err)
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 
 	signingKey := deriveSigningKey(unverified.AccessKey, secretKey)
@@ -169,10 +379,12 @@ func (s *Server) authenticateBearer(r *http.Request) (string, interface{}, bool)
 	})
 	if err != nil || !verified.Valid {
 		glog.V(2).Infof("Iceberg OAuth: token verification failed: %v", err)
-		return "", nil, false
+		return "", nil, "", "", false
 	}
 
-	return identityName, identity, true
+	// The token's signing key is derived from this access key, so a verified
+	// token was minted from it.
+	return identityName, identity, unverified.AccessKey, secretKey, true
 }
 
 // deriveSigningKey derives a signing key from the access key and secret using HMAC-SHA256.
diff --git a/weed/s3api/iceberg/handlers_oauth_test.go b/weed/s3api/iceberg/handlers_oauth_test.go
index 051d67eecc..e3888e13e1 100644
--- a/weed/s3api/iceberg/handlers_oauth_test.go
+++ b/weed/s3api/iceberg/handlers_oauth_test.go
@@ -5,8 +5,12 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
+	"time"
+
+	jwt "github.com/golang-jwt/jwt/v5"
 )
 
 type mockCredentialValidator struct {
@@ -68,8 +72,8 @@ func TestHandleOAuthTokens_Success(t *testing.T) {
 	if resp.AccessToken == "" {
 		t.Error("expected non-empty access_token")
 	}
-	if resp.ExpiresIn != oauthTokenExpiry {
-		t.Errorf("expected expires_in=%d, got %d", oauthTokenExpiry, resp.ExpiresIn)
+	if resp.ExpiresIn != oauthExpirySeconds() {
+		t.Errorf("expected expires_in=%d, got %d", oauthExpirySeconds(), resp.ExpiresIn)
 	}
 }
 
@@ -153,3 +157,254 @@ func TestBearerTokenNone(t *testing.T) {
 		t.Error("expected Bearer auth to fail with no token")
 	}
 }
+
+// TestOauthExpirySecondsEnvOverride pins the TTL knob: the token TTL must
+// be configurable so clients that cannot refresh on 401 can be given
+// longer-lived tokens instead of dying every hour.
+func TestOauthExpirySecondsEnvOverride(t *testing.T) {
+	if got := oauthExpirySeconds(); got != defaultOauthTokenExpiry {
+		t.Fatalf("default TTL = %d, want %d", got, defaultOauthTokenExpiry)
+	}
+	t.Setenv("ICEBERG_OAUTH_TOKEN_EXPIRY", "86400")
+	if got := oauthExpirySeconds(); got != 86400 {
+		t.Fatalf("env TTL = %d, want 86400", got)
+	}
+	t.Setenv("ICEBERG_OAUTH_TOKEN_EXPIRY", "-5")
+	if got := oauthExpirySeconds(); got != defaultOauthTokenExpiry {
+		t.Fatalf("negative TTL must fall back to default, got %d", got)
+	}
+	t.Setenv("ICEBERG_OAUTH_TOKEN_EXPIRY", "garbage")
+	if got := oauthExpirySeconds(); got != defaultOauthTokenExpiry {
+		t.Fatalf("invalid TTL must fall back to default, got %d", got)
+	}
+	// oversized values are clamped so Duration math cannot overflow
+	t.Setenv("ICEBERG_OAUTH_TOKEN_EXPIRY", "99999999999999999")
+	if got := oauthExpirySeconds(); got != maxOauthTokenExpiry {
+		t.Fatalf("oversized TTL must clamp to %d, got %d", maxOauthTokenExpiry, got)
+	}
+
+	// a token minted under an override carries the override's expiry
+	t.Setenv("ICEBERG_OAUTH_TOKEN_EXPIRY", "7200")
+	s := newTestServerWithOAuth()
+	body := "grant_type=client_credentials&client_id=AKID123&client_secret=secret456"
+	req := httptest.NewRequest(http.MethodPost, "/v1/oauth/tokens", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	s.handleOAuthTokens(w, req)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d", w.Code)
+	}
+	var resp OAuthTokenResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.ExpiresIn != 7200 {
+		t.Fatalf("minted token expires_in = %d, want 7200", resp.ExpiresIn)
+	}
+}
+
+func exchangeRequest(t *testing.T, subjectToken string) *httptest.ResponseRecorder {
+	return exchangeRequestWithBasic(t, subjectToken, "", "")
+}
+
+// exchangeRequestWithBasic mirrors Iceberg Java: refreshExpiredToken sends
+// Basic client credentials with the token-exchange grant, the proactive
+// scheduled refresh sends only the form body.
+func exchangeRequestWithBasic(t *testing.T, subjectToken, basicUser, basicPass string) *httptest.ResponseRecorder {
+	t.Helper()
+	s := newTestServerWithOAuth()
+	body := "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=" + url.QueryEscape(subjectToken)
+	req := httptest.NewRequest(http.MethodPost, "/v1/oauth/tokens", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	if basicUser != "" || basicPass != "" {
+		req.SetBasicAuth(basicUser, basicPass)
+	}
+	w := httptest.NewRecorder()
+	s.handleOAuthTokens(w, req)
+	return w
+}
+
+// TestTokenExchangeLiveSubject: the proactive refresh path Iceberg Java
+// 1.10.x uses (exchangeEnabled defaults true, Bearer-only headers) must
+// mint a fresh working token.
+func TestTokenExchangeLiveSubject(t *testing.T) {
+	s := newTestServerWithOAuth()
+	now := time.Now()
+	live := mintTestToken(t, "AKID123", "secret456", now, now.Add(30*time.Minute))
+
+	w := exchangeRequest(t, live)
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var resp OAuthTokenResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.TokenType != "bearer" || resp.AccessToken == "" {
+		t.Fatalf("bad token response: %+v", resp)
+	}
+	if resp.IssuedTokenType != accessTokenTokenType {
+		t.Fatalf("issued_token_type = %q, want %s", resp.IssuedTokenType, accessTokenTokenType)
+	}
+	// Unauthenticated exchange must not outlive the subject token.
+	if resp.ExpiresIn > 30*60 {
+		t.Fatalf("expires_in = %d, must be bounded by the subject's remaining lifetime (<= 1800)", resp.ExpiresIn)
+	}
+	// the exchanged token must authenticate like a normal Bearer
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	req.Header.Set("Authorization", "Bearer "+resp.AccessToken)
+	if _, _, ok := s.authenticateBearer(req); !ok {
+		t.Fatalf("exchanged token must pass authenticateBearer")
+	}
+}
+
+// TestTokenExchangeExpiredWithinGrace: a client whose token expired while
+// exchange was unsupported must recover without a restart. This is the
+// refreshExpiredToken path, which authenticates with Basic credentials.
+func TestTokenExchangeExpiredWithinGrace(t *testing.T) {
+	now := time.Now()
+	expiredRecently := mintTestToken(t, "AKID123", "secret456", now.Add(-20*time.Minute), now.Add(-10*time.Minute))
+
+	w := exchangeRequestWithBasic(t, expiredRecently, "AKID123", "secret456")
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200 within grace, got %d: %s", w.Code, w.Body.String())
+	}
+	var resp OAuthTokenResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	// Authenticated refresh gets the full configured TTL.
+	if resp.ExpiresIn != oauthExpirySeconds() {
+		t.Fatalf("expires_in = %d, want %d", resp.ExpiresIn, oauthExpirySeconds())
+	}
+}
+
+// TestTokenExchangeAuthenticatedLiveSubjectFullTTL: an authenticated client
+// exchanging a live token renews the session — the TTL cap only applies to
+// unauthenticated (Bearer-only) exchanges.
+func TestTokenExchangeAuthenticatedLiveSubjectFullTTL(t *testing.T) {
+	now := time.Now()
+	live := mintTestToken(t, "AKID123", "secret456", now, now.Add(30*time.Minute))
+
+	w := exchangeRequestWithBasic(t, live, "AKID123", "secret456")
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+	var resp OAuthTokenResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.ExpiresIn != oauthExpirySeconds() {
+		t.Fatalf("authenticated live exchange expires_in = %d, want full TTL %d", resp.ExpiresIn, oauthExpirySeconds())
+	}
+}
+
+// TestTokenExchangeSubjectNearlyExpired: a Bearer-only exchange when the
+// subject token has under a second left must be rejected, not minted into
+// an already-expired token (expires_in: 0).
+func TestTokenExchangeSubjectNearlyExpired(t *testing.T) {
+	// jwt/v5 serializes exp at one-second precision, so pin the expiry to
+	// the next whole-second boundary: the token is always live when minted
+	// and exchanged, yet has under a second of remaining lifetime.
+	exp := time.Now().Truncate(time.Second).Add(time.Second)
+	nearlyDead := mintTestToken(t, "AKID123", "secret456", exp.Add(-time.Hour), exp)
+
+	w := exchangeRequest(t, nearlyDead)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "invalid_grant") {
+		t.Fatalf("expected invalid_grant, got: %s", w.Body.String())
+	}
+}
+
+// TestTokenExchangeExpiredWithoutClientAuth: a leaked expired token must
+// not be exchangeable without client credentials.
+func TestTokenExchangeExpiredWithoutClientAuth(t *testing.T) {
+	now := time.Now()
+	expiredRecently := mintTestToken(t, "AKID123", "secret456", now.Add(-20*time.Minute), now.Add(-10*time.Minute))
+
+	w := exchangeRequest(t, expiredRecently)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "invalid_grant") {
+		t.Fatalf("expected invalid_grant, got: %s", w.Body.String())
+	}
+}
+
+// TestTokenExchangeExpiredBeyondGrace: stale tokens far past expiry must not
+// act as eternal credentials, even with client auth.
+func TestTokenExchangeExpiredBeyondGrace(t *testing.T) {
+	now := time.Now()
+	longDead := mintTestToken(t, "AKID123", "secret456", now.Add(-48*time.Hour), now.Add(-47*time.Hour))
+
+	w := exchangeRequestWithBasic(t, longDead, "AKID123", "secret456")
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 beyond grace, got %d: %s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "invalid_grant") {
+		t.Fatalf("expected invalid_grant, got: %s", w.Body.String())
+	}
+}
+
+// TestTokenExchangeGarbageSubject: malformed subject tokens are rejected
+// with 400 invalid_grant per RFC 6749 §5.2.
+func TestTokenExchangeGarbageSubject(t *testing.T) {
+	w := exchangeRequest(t, "not-a-jwt")
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", w.Code)
+	}
+}
+
+// TestTokenExchangeWrongClientCredentials: valid subject token, but Basic
+// auth with wrong credentials or a different client is rejected.
+func TestTokenExchangeWrongClientCredentials(t *testing.T) {
+	now := time.Now()
+	live := mintTestToken(t, "AKID123", "secret456", now, now.Add(30*time.Minute))
+
+	// wrong secret → invalid_client 401
+	w := exchangeRequestWithBasic(t, live, "AKID123", "wrongsecret")
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("wrong secret: expected 401, got %d", w.Code)
+	}
+
+	// a different valid client must not exchange someone else's token
+	s := &Server{credentialValidator: &mockCredentialValidator{
+		credentials: map[string]string{"AKID123": "secret456", "AKID999": "other-secret"},
+		identities:  map[string]string{"AKID123": "testuser", "AKID999": "otheruser"},
+	}}
+	body := "grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=" + url.QueryEscape(live)
+	req := httptest.NewRequest(http.MethodPost, "/v1/oauth/tokens", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.SetBasicAuth("AKID999", "other-secret")
+	rec := httptest.NewRecorder()
+	s.handleOAuthTokens(rec, req)
+	if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "invalid_grant") {
+		t.Fatalf("cross-client exchange: expected 400 invalid_grant, got %d: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// TestTokenExchangeSubjectWithoutExpiry: a correctly signed subject token
+// without an exp claim must be rejected — it would otherwise refresh forever.
+func TestTokenExchangeSubjectWithoutExpiry(t *testing.T) {
+	claims := IcebergClaims{
+		IdentityName: "testuser",
+		AccessKey:    "AKID123",
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt: jwt.NewNumericDate(time.Now()),
+			Issuer:   "seaweedfs-iceberg",
+			// no ExpiresAt
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString(deriveSigningKey("AKID123", "secret456"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	w := exchangeRequestWithBasic(t, signed, "AKID123", "secret456")
+	if w.Code != http.StatusBadRequest || !strings.Contains(w.Body.String(), "invalid_grant") {
+		t.Fatalf("expected 400 invalid_grant for nil-exp subject, got %d: %s", w.Code, w.Body.String())
+	}
+}
diff --git a/weed/s3api/iceberg/handlers_table.go b/weed/s3api/iceberg/handlers_table.go
index 6d9a4e7dcb..6cdbf0e661 100644
--- a/weed/s3api/iceberg/handlers_table.go
+++ b/weed/s3api/iceberg/handlers_table.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"os"
 	"path"
+	"strconv"
 	"strings"
 
 	"github.com/apache/iceberg-go"
@@ -118,6 +119,18 @@ func (s *Server) tablePathOccupied(ctx context.Context, bucketName, tablePath st
 	return occupied, err
 }
 
+// authorizeCreateTable checks the caller may create the table, for the create
+// paths that write to the bucket before the catalog registers it.
+func (s *Server) authorizeCreateTable(ctx context.Context, bucketARN string, namespace []string, tableName, identityName string) error {
+	return s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return s.tablesManager.AuthorizeCreateTable(ctx, s3tables.NewManagerClient(client), &s3tables.CreateTableRequest{
+			TableBucketARN: bucketARN,
+			Namespace:      namespace,
+			Name:           tableName,
+		}, identityName)
+	})
+}
+
 // handleCreateTable creates a new table.
 func (s *Server) handleCreateTable(w http.ResponseWriter, r *http.Request) {
 	vars := mux.Vars(r)
@@ -262,10 +275,18 @@ func (s *Server) handleCreateTable(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Both branches below write into the table bucket, and stage-create never
+	// reaches the registration that carries the authorization, so the caller has
+	// to pass the CreateTable gate here.
+	if authErr := s.authorizeCreateTable(r.Context(), bucketARN, namespace, tableName, identityName); authErr != nil {
+		writeManagerError(w, authErr)
+		return
+	}
+
 	// Stage-create persists metadata in the internal staged area and skips S3Tables registration.
 	if req.StageCreate {
 		stagedTablePath := stageCreateStagedTablePath(namespace, tableName, tableUUID)
-		if err := s.saveMetadataFile(r.Context(), metadataBucket, stagedTablePath, metadataFileName, metadataBytes); err != nil {
+		if err := s.saveMetadataFile(r.Context(), metadataBucket, stagedTablePath, metadataFileName, metadataBytes, false); err != nil {
 			writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to save staged metadata file: "+err.Error())
 			return
 		}
@@ -273,15 +294,20 @@ func (s *Server) handleCreateTable(w http.ResponseWriter, r *http.Request) {
 		if markerErr := s.writeStageCreateMarker(r.Context(), bucketName, namespace, tableName, tableUUID, location, stagedMetadataLocation); markerErr != nil {
 			glog.V(1).Infof("Iceberg: failed to persist stage-create marker for %s.%s: %v", flattenNamespacePath(namespace), tableName, markerErr)
 		}
+		// The staged table is not registered yet, so there is nothing to
+		// authorize an update against; the create gate above is the write
+		// authority for the prefix the staged table will occupy.
+		config, storageCredentials := s.buildFileIOConfig(r, location, func() bool { return true })
 		result := LoadTableResult{
-			MetadataLocation: metadataLocation,
-			Metadata:         metadata,
-			Config:           s.buildFileIOConfig(r),
+			MetadataLocation:   metadataLocation,
+			Metadata:           metadata,
+			Config:             config,
+			StorageCredentials: storageCredentials,
 		}
 		writeLoadResult(w, http.StatusOK, result)
 		return
 	}
-	if err := s.saveMetadataFile(r.Context(), metadataBucket, metadataPath, metadataFileName, metadataBytes); err != nil {
+	if err := s.saveMetadataFile(r.Context(), metadataBucket, metadataPath, metadataFileName, metadataBytes, false); err != nil {
 		writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to save metadata file: "+err.Error())
 		return
 	}
@@ -372,10 +398,14 @@ func (s *Server) handleCreateTable(w http.ResponseWriter, r *http.Request) {
 		glog.V(1).Infof("Iceberg: failed to cleanup stage-create markers for %s.%s after create: %v", flattenNamespacePath(namespace), tableName, markerErr)
 	}
 
+	config, storageCredentials := s.buildFileIOConfig(r, location, func() bool {
+		return s.mayUpdateTable(r, bucketName, namespace, req.Name)
+	})
 	result := LoadTableResult{
-		MetadataLocation: finalLocation,
-		Metadata:         metadata,
-		Config:           s.buildFileIOConfig(r),
+		MetadataLocation:   finalLocation,
+		Metadata:           metadata,
+		Config:             config,
+		StorageCredentials: storageCredentials,
 	}
 	writeLoadResult(w, http.StatusOK, result)
 }
@@ -516,6 +546,11 @@ func (s *Server) handleLoadTable(w http.ResponseWriter, r *http.Request) {
 	}
 
 	result, buildErr := s.buildLoadTableResult(r, getResp, bucketName, namespace, tableName)
+	if buildErr == nil {
+		// Only LoadTable defines ?snapshots=; a create response always carries
+		// the metadata it just wrote.
+		result.Metadata, buildErr = applySnapshotsParam(r, result.Metadata)
+	}
 	if buildErr != nil {
 		glog.Errorf("Iceberg: LoadTable %s: %v", tableName, buildErr)
 		writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to build table metadata")
@@ -560,34 +595,171 @@ func (s *Server) buildLoadTableResult(r *http.Request, getResp s3tables.GetTable
 		return LoadTableResult{}, fmt.Errorf("build metadata for %s: %w", tableName, err)
 	}
 
+	config, storageCredentials := s.buildFileIOConfig(r, location, func() bool {
+		return s.mayUpdateTable(r, bucketName, namespace, tableName)
+	})
 	return LoadTableResult{
-		MetadataLocation: getResp.MetadataLocation,
-		Metadata:         metadata,
-		Config:           s.buildFileIOConfig(r),
+		MetadataLocation:   getResp.MetadataLocation,
+		Metadata:           metadata,
+		Config:             config,
+		StorageCredentials: storageCredentials,
 	}, nil
 }
 
+// applySnapshotsParam honours ?snapshots=refs, which asks for only the
+// snapshots that branches and tags point at. Clients use it to avoid pulling a
+// long snapshot history they will not read. Anything else, including the
+// default, returns the metadata untouched.
+func applySnapshotsParam(r *http.Request, metadata table.Metadata) (table.Metadata, error) {
+	if !strings.EqualFold(strings.TrimSpace(r.URL.Query().Get("snapshots")), "refs") {
+		return metadata, nil
+	}
+	if metadata == nil {
+		return metadata, nil
+	}
+
+	referenced := make(map[int64]struct{})
+	for _, ref := range metadata.Refs() {
+		referenced[ref.SnapshotID] = struct{}{}
+	}
+	if current := metadata.CurrentSnapshot(); current != nil {
+		referenced[current.SnapshotID] = struct{}{}
+	}
+
+	var unreferenced []int64
+	for _, snapshot := range metadata.Snapshots() {
+		if _, keep := referenced[snapshot.SnapshotID]; !keep {
+			unreferenced = append(unreferenced, snapshot.SnapshotID)
+		}
+	}
+	if len(unreferenced) == 0 {
+		return metadata, nil
+	}
+
+	builder, err := table.MetadataBuilderFromBase(metadata, "")
+	if err != nil {
+		return nil, err
+	}
+	if err := builder.RemoveSnapshots(unreferenced, false); err != nil {
+		return nil, err
+	}
+	return builder.Build()
+}
+
 // buildFileIOConfig returns the FileIO properties to advertise to catalog
 // clients so they can read the table's data files directly from S3 without
 // separately discovering the endpoint. The region defaults to the same
 // value baked into table bucket ARNs so clients like DuckDB that require
 // a region on attach don't need to be told it out-of-band. See issue #9103.
-func (s *Server) buildFileIOConfig(r *http.Request) iceberg.Properties {
+// It also returns, for a client that asked for credential vending, the
+// credentials scoped to this table.
+func (s *Server) buildFileIOConfig(r *http.Request, location string, canWrite func() bool) (iceberg.Properties, []StorageCredential) {
 	config := make(iceberg.Properties)
 	if s.s3Endpoint == "" {
-		return config
+		return config, nil
 	}
-	// A client asking for vended credentials builds its storage credential out
-	// of whatever comes back here and stops using the one it was configured
-	// with. We vend none, so an endpoint on its own leaves it sending unsigned
-	// requests; say nothing instead and let it keep its own credentials.
+
+	vended := iceberg.Properties(nil)
 	if wantsVendedCredentials(r) {
-		return config
+		vended = s.vendCredentials(r, location, canWrite)
+		// A client asking for vended credentials builds its storage credential
+		// out of whatever comes back here and stops using the one it was
+		// configured with. With nothing to vend, an endpoint on its own leaves
+		// it sending unsigned requests; say nothing instead and let it keep its
+		// own credentials.
+		if vended == nil {
+			return config, nil
+		}
 	}
+
 	config["s3.endpoint"] = s.s3Endpoint
 	config["s3.path-style-access"] = "true"
 	config["s3.region"] = s3tables.DefaultRegion
-	return config
+	if vended == nil {
+		return config, nil
+	}
+
+	credentialConfig := make(iceberg.Properties, len(config)+len(vended))
+	for key, value := range config {
+		credentialConfig[key] = value
+	}
+	for key, value := range vended {
+		config[key] = value
+		credentialConfig[key] = value
+	}
+	return config, []StorageCredential{{Prefix: location, Config: credentialConfig}}
+}
+
+// vendCredentials mints credentials limited to this table's prefix. It returns
+// nil when the deployment has no vending configured or the mint failed, which
+// leaves the caller withholding the endpoint so the client keeps its own
+// credentials rather than falling back to unsigned requests.
+func (s *Server) vendCredentials(r *http.Request, location string, canWrite func() bool) iceberg.Properties {
+	if s.credentialVendor == nil || location == "" {
+		return nil
+	}
+
+	bucket, prefix, err := parseS3Location(location)
+	if err != nil {
+		glog.V(1).Infof("Iceberg: cannot vend credentials for %s: %v", location, err)
+		return nil
+	}
+
+	principal := s3_constants.GetIdentityNameFromContext(r)
+	credentials, err := s.credentialVendor.VendTableCredentials(r.Context(), principal, bucket, prefix, canWrite == nil || !canWrite())
+	if err != nil {
+		glog.Warningf("Iceberg: failed to vend credentials for %s: %v", location, err)
+		return nil
+	}
+	if credentials == nil {
+		return nil
+	}
+
+	vended := iceberg.Properties{
+		"s3.access-key-id":     credentials.AccessKeyID,
+		"s3.secret-access-key": credentials.SecretAccessKey,
+		"s3.session-token":     credentials.SessionToken,
+	}
+	if !credentials.Expiration.IsZero() {
+		vended["s3.session-token-expires-at-ms"] = strconv.FormatInt(credentials.Expiration.UnixMilli(), 10)
+	}
+	return vended
+}
+
+// mayUpdateTable reports whether the caller may commit to the table the
+// credentials would cover. The session stays read-only when it may not, so
+// the vend carries no more authority than the caller holds at the catalog.
+func (s *Server) mayUpdateTable(r *http.Request, bucketName string, namespace []string, tableName string) bool {
+	updateReq := &s3tables.UpdateTableRequest{
+		TableBucketARN: buildTableBucketARN(bucketName),
+		Namespace:      namespace,
+		Name:           tableName,
+	}
+	identityName := s3_constants.GetIdentityNameFromContext(r)
+	err := s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return s.tablesManager.AuthorizeUpdateTable(r.Context(), s3tables.NewManagerClient(client), updateReq, identityName)
+	})
+	if err != nil {
+		glog.V(1).Infof("Iceberg: UpdateTable check for %s/%s failed, vending read-only: %v", bucketName, tableName, err)
+	}
+	return err == nil
+}
+
+// mayUpdateView is mayUpdateTable for a view, whose commit path is UpdateView.
+func (s *Server) mayUpdateView(r *http.Request, bucketName string, namespace []string, viewName string) bool {
+	updateReq := &s3tables.UpdateViewRequest{
+		TableBucketARN: buildTableBucketARN(bucketName),
+		Namespace:      namespace,
+		Name:           viewName,
+	}
+	identityName := s3_constants.GetIdentityNameFromContext(r)
+	err := s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return s.tablesManager.AuthorizeUpdateView(r.Context(), s3tables.NewManagerClient(client), updateReq, identityName)
+	})
+	if err != nil {
+		glog.V(1).Infof("Iceberg: UpdateView check for %s/%s failed, vending read-only: %v", bucketName, viewName, err)
+	}
+	return err == nil
 }
 
 // handleTableExists checks if a table exists.
diff --git a/weed/s3api/iceberg/handlers_transaction.go b/weed/s3api/iceberg/handlers_transaction.go
index f46bdfa37c..6279cc4cc7 100644
--- a/weed/s3api/iceberg/handlers_transaction.go
+++ b/weed/s3api/iceberg/handlers_transaction.go
@@ -36,6 +36,7 @@ type preparedTableCommit struct {
 	versionToken     string
 	metadataBucket   string
 	metadataPath     string
+	location         string
 	metadataFileName string
 	metadataBytes    []byte
 	metadataVersion  int
@@ -81,15 +82,21 @@ func (s *Server) handleCommitTransaction(w http.ResponseWriter, r *http.Request)
 		prepared = append(prepared, *pc)
 	}
 
-	// Phase 2: write each new metadata.json object.
+	// Phase 2: write each new metadata.json object. Staging is exclusive for the
+	// same reason a single-table commit stages exclusively: a transaction racing
+	// another writer on one of its tables would otherwise overwrite that
+	// writer's metadata, and the pointer flip below decides who won.
 	for i := range prepared {
 		pc := &prepared[i]
-		if err := s.saveMetadataFile(r.Context(), pc.metadataBucket, pc.metadataPath, pc.metadataFileName, pc.metadataBytes); err != nil {
+		fileName, location, err := s.stageCommitMetadata(r.Context(), pc.metadataBucket, pc.metadataPath, pc.location, pc.metadataFileName, pc.metadataBytes)
+		if err != nil {
 			// No pointer flipped yet, so every written file is safe to delete.
 			s.cleanupPreparedMetadata(r.Context(), prepared[:i+1], nil)
 			writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to save metadata file: "+err.Error())
 			return
 		}
+		pc.metadataFileName = fileName
+		pc.newMetadataLoc = location
 	}
 
 	// Phase 3: flip each table's pointer xattr; on failure roll back prior flips.
@@ -102,8 +109,8 @@ func (s *Server) handleCommitTransaction(w http.ResponseWriter, r *http.Request)
 				writeError(w, http.StatusConflict, "CommitFailedException", "Version token mismatch")
 				return
 			}
-			glog.Errorf("Iceberg: CommitTransaction UpdateTable error: %v", err)
-			writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to commit table update: "+err.Error())
+			logManagerError("CommitTransaction UpdateTable", err)
+			writeManagerError(w, err)
 			return
 		}
 	}
@@ -133,6 +140,9 @@ func (s *Server) prepareTableCommit(ctx context.Context, bucketName, bucketARN,
 		glog.V(1).Infof("Iceberg: CommitTransaction GetTable error: %v", err)
 		return nil, &icebergRequestError{http.StatusInternalServerError, "InternalServerError", err.Error()}
 	}
+	if reqErr := s.authorizeCommit(ctx, bucketARN, namespace, tableName, identityName); reqErr != nil {
+		return nil, reqErr
+	}
 
 	location := tableLocationFromMetadataLocation(getResp.MetadataLocation)
 	if location == "" {
@@ -200,6 +210,9 @@ func (s *Server) prepareTableCommit(ctx context.Context, bucketName, bucketARN,
 	if err != nil {
 		return nil, &icebergRequestError{http.StatusInternalServerError, "InternalServerError", "Invalid table location: " + err.Error()}
 	}
+	if err := confineMetadataLocation(metadataBucket, metadataPath, bucketName); err != nil {
+		return nil, &icebergRequestError{http.StatusBadRequest, "BadRequestException", err.Error()}
+	}
 
 	return &preparedTableCommit{
 		namespace:           namespace,
@@ -208,6 +221,7 @@ func (s *Server) prepareTableCommit(ctx context.Context, bucketName, bucketARN,
 		versionToken:        getResp.VersionToken,
 		metadataBucket:      metadataBucket,
 		metadataPath:        metadataPath,
+		location:            location,
 		metadataFileName:    metadataFileName,
 		metadataBytes:       metadataBytes,
 		metadataVersion:     metadataVersion,
@@ -238,7 +252,11 @@ func cloneTableMetadata(m *s3tables.TableMetadata) *s3tables.TableMetadata {
 func parseTableChange(change tableChangeRequest) (table.Requirements, table.Updates, []statisticsUpdate, *icebergRequestError) {
 	var requirements table.Requirements
 	if len(change.Requirements) > 0 {
-		if err := json.Unmarshal(change.Requirements, &requirements); err != nil {
+		normalized, err := normalizeRequirements(change.Requirements)
+		if err != nil {
+			return nil, nil, nil, &icebergRequestError{http.StatusBadRequest, "BadRequestException", "Invalid requirements: " + err.Error()}
+		}
+		if err := json.Unmarshal(normalized, &requirements); err != nil {
 			return nil, nil, nil, &icebergRequestError{http.StatusBadRequest, "BadRequestException", "Invalid requirements: " + err.Error()}
 		}
 	}
diff --git a/weed/s3api/iceberg/handlers_view.go b/weed/s3api/iceberg/handlers_view.go
index ba3d29a454..0eb621b4dc 100644
--- a/weed/s3api/iceberg/handlers_view.go
+++ b/weed/s3api/iceberg/handlers_view.go
@@ -204,7 +204,7 @@ func (s *Server) handleCreateView(w http.ResponseWriter, r *http.Request) {
 
 	// Persist the metadata file only after the catalog registers the view, so a
 	// missing namespace or name collision fails before any bytes hit storage.
-	if err := s.saveMetadataFile(r.Context(), metadataBucket, metadataPath, metadataFileName, metadataBytes); err != nil {
+	if err := s.saveMetadataFile(r.Context(), metadataBucket, metadataPath, metadataFileName, metadataBytes, false); err != nil {
 		// Roll back the registered view so it doesn't linger pointing at metadata
 		// that was never written.
 		if dropErr := s.dropView(r, namespace, req.Name); dropErr != nil {
@@ -218,10 +218,13 @@ func (s *Server) handleCreateView(w http.ResponseWriter, r *http.Request) {
 	if finalLocation == "" {
 		finalLocation = metadataLocation
 	}
+	config, _ := s.buildFileIOConfig(r, location, func() bool {
+		return s.mayUpdateView(r, bucketName, namespace, req.Name)
+	})
 	writeLoadResult(w, http.StatusOK, ViewResponse{
 		MetadataLocation: finalLocation,
 		Metadata:         metadata,
-		Config:           s.buildFileIOConfig(r),
+		Config:           config,
 	})
 }
 
@@ -348,10 +351,13 @@ func (s *Server) buildViewResponse(r *http.Request, getResp s3tables.GetViewResp
 	if err != nil {
 		return ViewResponse{}, fmt.Errorf("failed to parse view metadata: %w", err)
 	}
+	config, _ := s.buildFileIOConfig(r, tableLocationFromMetadataLocation(getResp.MetadataLocation), func() bool {
+		return s.mayUpdateView(r, bucketName, namespace, viewName)
+	})
 	return ViewResponse{
 		MetadataLocation: getResp.MetadataLocation,
 		Metadata:         metadata,
-		Config:           s.buildFileIOConfig(r),
+		Config:           config,
 	}, nil
 }
 
@@ -387,3 +393,61 @@ func isViewAlreadyExists(err error) bool {
 	}
 	return strings.Contains(strings.ToLower(err.Error()), "already exists")
 }
+
+// handleRenameView moves a view's catalog pointer to a new namespace/name,
+// the view counterpart of POST /v1/{prefix}/tables/rename.
+func (s *Server) handleRenameView(w http.ResponseWriter, r *http.Request) {
+	var req RenameTableRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, http.StatusBadRequest, "BadRequestException", "Invalid request body")
+		return
+	}
+
+	source := parseNamespace(encodeNamespace(req.Source.Namespace))
+	dest := parseNamespace(encodeNamespace(req.Destination.Namespace))
+	if len(source) == 0 || req.Source.Name == "" || len(dest) == 0 || req.Destination.Name == "" {
+		writeError(w, http.StatusBadRequest, "BadRequestException", "source and destination namespace and name are required")
+		return
+	}
+
+	bucketName := getBucketFromPrefix(r)
+	identityName := s3_constants.GetIdentityNameFromContext(r)
+
+	renameReq := &s3tables.RenameTableRequest{
+		TableBucketARN:  buildTableBucketARN(bucketName),
+		SourceNamespace: source,
+		SourceName:      req.Source.Name,
+		DestNamespace:   dest,
+		DestName:        req.Destination.Name,
+	}
+
+	err := s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		mgrClient := s3tables.NewManagerClient(client)
+		return s.tablesManager.Execute(r.Context(), mgrClient, "RenameView", renameReq, nil, identityName)
+	})
+
+	if err != nil {
+		var viewErr *s3tables.S3TablesError
+		if errors.As(err, &viewErr) {
+			switch viewErr.Type {
+			case s3tables.ErrCodeNoSuchView:
+				writeError(w, http.StatusNotFound, "NoSuchViewException", fmt.Sprintf("View does not exist: %s", req.Source.Name))
+				return
+			case s3tables.ErrCodeNoSuchNamespace:
+				writeError(w, http.StatusNotFound, "NoSuchNamespaceException", fmt.Sprintf("Namespace does not exist: %v", dest))
+				return
+			case s3tables.ErrCodeViewAlreadyExists:
+				writeError(w, http.StatusConflict, "AlreadyExistsException", fmt.Sprintf("View already exists: %s", req.Destination.Name))
+				return
+			case s3tables.ErrCodeInvalidRequest:
+				writeError(w, http.StatusBadRequest, "BadRequestException", viewErr.Message)
+				return
+			}
+		}
+		glog.V(1).Infof("Iceberg: RenameView error: %v", err)
+		writeManagerError(w, err)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
diff --git a/weed/s3api/iceberg/handlers_view_update.go b/weed/s3api/iceberg/handlers_view_update.go
index 73ebcadd2b..60971a05fb 100644
--- a/weed/s3api/iceberg/handlers_view_update.go
+++ b/weed/s3api/iceberg/handlers_view_update.go
@@ -3,10 +3,8 @@ package iceberg
 import (
 	"encoding/json"
 	"fmt"
-	"math/rand/v2"
 	"net/http"
 	"strings"
-	"time"
 
 	"github.com/apache/iceberg-go/view"
 	"github.com/google/uuid"
@@ -50,6 +48,10 @@ func (s *Server) handleUpdateView(w http.ResponseWriter, r *http.Request) {
 			writeManagerError(w, err)
 			return
 		}
+		if reqErr := s.authorizeViewCommit(r.Context(), bucketARN, namespace, viewName, identityName); reqErr != nil {
+			writeError(w, reqErr.status, reqErr.errType, reqErr.message)
+			return
+		}
 		if getResp.Metadata == nil || len(getResp.Metadata.FullMetadata) == 0 {
 			writeError(w, http.StatusInternalServerError, "InternalServerError", "view has no metadata")
 			return
@@ -104,7 +106,12 @@ func (s *Server) handleUpdateView(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusInternalServerError, "InternalServerError", "Invalid view location: "+err.Error())
 			return
 		}
-		if err := s.saveMetadataFile(r.Context(), metadataBucket, metadataPath, metadataFileName, metadataBytes); err != nil {
+		if err := confineMetadataLocation(metadataBucket, metadataPath, bucketName); err != nil {
+			writeError(w, http.StatusBadRequest, "BadRequestException", err.Error())
+			return
+		}
+		metadataFileName, newMetadataLocation, err = s.stageCommitMetadata(r.Context(), metadataBucket, metadataPath, location, metadataFileName, metadataBytes)
+		if err != nil {
 			writeError(w, http.StatusInternalServerError, "InternalServerError", "Failed to save view metadata file: "+err.Error())
 			return
 		}
@@ -130,10 +137,11 @@ func (s *Server) handleUpdateView(w http.ResponseWriter, r *http.Request) {
 			return s.tablesManager.Execute(r.Context(), mgrClient, "UpdateView", updateReq, nil, identityName)
 		})
 		if err == nil {
+			config, _ := s.buildFileIOConfig(r, location, func() bool { return true })
 			writeLoadResult(w, http.StatusOK, ViewResponse{
 				MetadataLocation: newMetadataLocation,
 				Metadata:         newMetadata,
-				Config:           s.buildFileIOConfig(r),
+				Config:           config,
 			})
 			return
 		}
@@ -144,8 +152,7 @@ func (s *Server) handleUpdateView(w http.ResponseWriter, r *http.Request) {
 			}
 			if attempt < maxCommitAttempts {
 				glog.V(1).Infof("Iceberg: UpdateView conflict for %s (attempt %d/%d), retrying", viewName, attempt, maxCommitAttempts)
-				jitter := time.Duration(rand.Int64N(int64(25 * time.Millisecond)))
-				time.Sleep(time.Duration(50*attempt)*time.Millisecond + jitter)
+				sleepBeforeCommitRetry(attempt)
 				continue
 			}
 			writeError(w, http.StatusConflict, "CommitFailedException", "Version token mismatch")
diff --git a/weed/s3api/iceberg/iceberg_access_delegation_test.go b/weed/s3api/iceberg/iceberg_access_delegation_test.go
index 51a1931a4d..8e004a375a 100644
--- a/weed/s3api/iceberg/iceberg_access_delegation_test.go
+++ b/weed/s3api/iceberg/iceberg_access_delegation_test.go
@@ -35,20 +35,20 @@ func TestWantsVendedCredentials(t *testing.T) {
 }
 
 // A client that asked for vended credentials replaces its own storage
-// credentials with whatever the catalog returns. Since the catalog vends none,
-// an endpoint by itself would leave the client signing nothing and every data
-// file read and write would come back 403.
+// credentials with whatever the catalog returns. With no vending configured
+// there are none, so an endpoint by itself would leave the client signing
+// nothing and every data file read and write would come back 403.
 func TestBuildFileIOConfigWithholdsEndpointFromCredentialVendingClients(t *testing.T) {
 	s := &Server{s3Endpoint: "http://seaweed.example:8333"}
 
 	r := httptest.NewRequest(http.MethodGet, "/v1/namespaces/ns/tables/t", nil)
 	r.Header.Set(accessDelegationHeader, "vended-credentials")
-	if got := s.buildFileIOConfig(r); len(got) != 0 {
+	if got, _ := s.buildFileIOConfig(r, "s3://warehouse/ns/t", nil); len(got) != 0 {
 		t.Fatalf("buildFileIOConfig() = %v, want empty for a vended-credentials request", got)
 	}
 
 	plain := httptest.NewRequest(http.MethodGet, "/v1/namespaces/ns/tables/t", nil)
-	if got := s.buildFileIOConfig(plain); got["s3.endpoint"] != s.s3Endpoint {
+	if got, _ := s.buildFileIOConfig(plain, "s3://warehouse/ns/t", nil); got["s3.endpoint"] != s.s3Endpoint {
 		t.Fatalf("s3.endpoint = %q, want %q", got["s3.endpoint"], s.s3Endpoint)
 	}
 }
diff --git a/weed/s3api/iceberg/iceberg_commit_authorize_test.go b/weed/s3api/iceberg/iceberg_commit_authorize_test.go
new file mode 100644
index 0000000000..fc13c64dc9
--- /dev/null
+++ b/weed/s3api/iceberg/iceberg_commit_authorize_test.go
@@ -0,0 +1,237 @@
+package iceberg
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/apache/iceberg-go/view"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"google.golang.org/grpc"
+)
+
+// writeLogFiler records every file the handlers create, including files they
+// delete again before answering, which the final entry map cannot show.
+type writeLogFiler struct {
+	*memFiler
+	created []string
+}
+
+func (f *writeLogFiler) WithFilerClient(_ bool, fn func(client filer_pb.SeaweedFilerClient) error) error {
+	return fn(f)
+}
+
+func (f *writeLogFiler) CreateEntry(ctx context.Context, in *filer_pb.CreateEntryRequest, opts ...grpc.CallOption) (*filer_pb.CreateEntryResponse, error) {
+	if !in.Entry.IsDirectory {
+		f.created = append(f.created, path.Join(in.Directory, in.Entry.Name))
+	}
+	return f.memFiler.CreateEntry(ctx, in, opts...)
+}
+
+// seedOwnedTable registers an existing table owned by owner.
+func seedOwnedTable(fc *memFiler, bucket, namespace, tableName, owner string) {
+	internal := map[string]any{
+		"name":             tableName,
+		"namespace":        namespace,
+		"format":           "ICEBERG",
+		"ownerAccountId":   owner,
+		"versionToken":     "v1",
+		"metadataVersion":  1,
+		"metadataLocation": "s3://" + bucket + "/" + namespace + "/" + tableName + "/metadata/v1.metadata.json",
+		"metadata": s3tables.TableMetadata{
+			Iceberg: &s3tables.IcebergMetadata{TableUUID: "00000000-0000-0000-0000-000000000001"},
+		},
+	}
+	metaBytes, _ := json.Marshal(internal)
+	fc.seed(s3tables.GetTablePath(bucket, namespace, tableName), &filer_pb.Entry{
+		Name:        tableName,
+		IsDirectory: true,
+		Extended:    map[string][]byte{s3tables.ExtendedKeyMetadata: metaBytes},
+	})
+}
+
+// seedOwnedView registers an existing view owned by owner.
+func seedOwnedView(fc *memFiler, bucket, namespace, viewName, owner string, fullMetadata []byte) {
+	internal := map[string]any{
+		"name":             viewName,
+		"namespace":        namespace,
+		"format":           "ICEBERG",
+		"ownerAccountId":   owner,
+		"versionToken":     "v1",
+		"metadataVersion":  1,
+		"metadataLocation": "s3://" + bucket + "/" + namespace + "/" + viewName + "/metadata/v1.metadata.json",
+	}
+	if len(fullMetadata) > 0 {
+		internal["metadata"] = s3tables.TableMetadata{FullMetadata: fullMetadata}
+	}
+	metaBytes, _ := json.Marshal(internal)
+	fc.seed(s3tables.GetTablePath(bucket, namespace, viewName), &filer_pb.Entry{
+		Name:        viewName,
+		IsDirectory: true,
+		Extended: map[string][]byte{
+			s3tables.ExtendedKeyMetadata:  metaBytes,
+			s3tables.ExtendedKeyEntryType: []byte(s3tables.EntryTypeView),
+		},
+	})
+}
+
+// withActions gives the request an identity allowed only the listed actions.
+func withActions(r *http.Request, name string, actions ...string) *http.Request {
+	ctx := s3_constants.SetIdentityNameInContext(r.Context(), name)
+	return r.WithContext(s3_constants.SetIdentityInContext(ctx, &struct {
+		Name    string
+		Actions []string
+	}{Name: name, Actions: actions}))
+}
+
+func viewMetadataJSON(t *testing.T, location string) []byte {
+	t.Helper()
+	schema := iceberg.NewSchemaWithIdentifiers(0, nil,
+		iceberg.NestedField{ID: 1, Name: "id", Type: iceberg.PrimitiveTypes.Int32, Required: true})
+	ver, err := view.NewVersionFromSQL(1, schema.ID, "SELECT 1", table.Identifier{"finance"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	md, err := view.NewMetadata(ver, schema, location, iceberg.Properties{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	fullMetadata, err := json.Marshal(md)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return fullMetadata
+}
+
+// A caller that may load a table but not commit to it must be refused before
+// the commit stages its metadata file in the table's directory. The commit
+// paths used to write that file, reach the UpdateTable authorization, and
+// delete the file again on the way out.
+func TestCommitDeniedBeforeStagingMetadata(t *testing.T) {
+	const bucket = "warehouse"
+	cases := map[string]func(s *Server) *httptest.ResponseRecorder{
+		"commit-table": func(s *Server) *httptest.ResponseRecorder {
+			r := httptest.NewRequest(http.MethodPost, "/v1/"+bucket+"/namespaces/finance/tables/quarterly_reports",
+				strings.NewReader(`{"requirements":[],"updates":[{"action":"set-properties","updates":{"k":"v"}}]}`))
+			r = mux.SetURLVars(r, map[string]string{"prefix": bucket, "namespace": "finance", "table": "quarterly_reports"})
+			w := httptest.NewRecorder()
+			s.handleUpdateTable(w, withActions(r, "reader", "s3tables:GetTable"))
+			return w
+		},
+		"commit-transaction": func(s *Server) *httptest.ResponseRecorder {
+			body := `{"table-changes":[{"identifier":{"namespace":["finance"],"name":"quarterly_reports"},"requirements":[],"updates":[{"action":"set-properties","updates":{"k":"v"}}]}]}`
+			r := httptest.NewRequest(http.MethodPost, "/v1/"+bucket+"/transactions/commit", strings.NewReader(body))
+			r = mux.SetURLVars(r, map[string]string{"prefix": bucket})
+			w := httptest.NewRecorder()
+			s.handleCommitTransaction(w, withActions(r, "reader", "s3tables:GetTable"))
+			return w
+		},
+		"commit-view": func(s *Server) *httptest.ResponseRecorder {
+			r := httptest.NewRequest(http.MethodPost, "/v1/"+bucket+"/namespaces/finance/views/quarterly_view",
+				strings.NewReader(`{"requirements":[],"updates":[{"action":"set-properties","updates":{"k":"v"}}]}`))
+			r = mux.SetURLVars(r, map[string]string{"prefix": bucket, "namespace": "finance", "view": "quarterly_view"})
+			w := httptest.NewRecorder()
+			s.handleUpdateView(w, withActions(r, "reader", "s3tables:GetView"))
+			return w
+		},
+	}
+	for name, run := range cases {
+		t.Run(name, func(t *testing.T) {
+			fc := &writeLogFiler{memFiler: newMemFiler()}
+			seedNamespace(fc.memFiler, bucket, "finance", "alice")
+			seedOwnedTable(fc.memFiler, bucket, "finance", "quarterly_reports", "alice")
+			seedOwnedView(fc.memFiler, bucket, "finance", "quarterly_view", "alice", viewMetadataJSON(t, "s3://"+bucket+"/finance/quarterly_view"))
+			s := NewServer(fc, nil)
+
+			w := run(s)
+
+			if w.Code != http.StatusForbidden {
+				t.Errorf("status = %d, want %d (body: %s)", w.Code, http.StatusForbidden, w.Body.String())
+			}
+			if len(fc.created) != 0 {
+				t.Errorf("refused commit wrote %v", fc.created)
+			}
+		})
+	}
+}
+
+// The owner, and a caller whose own identity carries UpdateTable, still
+// stage their metadata file and land the commit.
+func TestCommitAllowedStagesMetadata(t *testing.T) {
+	const bucket = "warehouse"
+	callers := map[string]func(r *http.Request) *http.Request{
+		"owner": func(r *http.Request) *http.Request {
+			return r.WithContext(s3_constants.SetIdentityNameInContext(r.Context(), "alice"))
+		},
+		"identity-actions": func(r *http.Request) *http.Request {
+			return withActions(r, "writer", "s3tables:GetTable", "s3tables:UpdateTable")
+		},
+	}
+	for name, as := range callers {
+		t.Run(name, func(t *testing.T) {
+			fc := &writeLogFiler{memFiler: newMemFiler()}
+			seedNamespace(fc.memFiler, bucket, "finance", "alice")
+			seedOwnedTable(fc.memFiler, bucket, "finance", "quarterly_reports", "alice")
+			s := NewServer(fc, nil)
+
+			r := httptest.NewRequest(http.MethodPost, "/v1/"+bucket+"/namespaces/finance/tables/quarterly_reports",
+				strings.NewReader(`{"requirements":[],"updates":[{"action":"set-properties","updates":{"k":"v"}}]}`))
+			r = mux.SetURLVars(r, map[string]string{"prefix": bucket, "namespace": "finance", "table": "quarterly_reports"})
+			w := httptest.NewRecorder()
+			s.handleUpdateTable(w, as(r))
+
+			if w.Code != http.StatusOK {
+				t.Fatalf("status = %d, want %d (body: %s)", w.Code, http.StatusOK, w.Body.String())
+			}
+			if len(fc.created) != 1 || !strings.HasSuffix(fc.created[0], ".metadata.json") {
+				t.Fatalf("created = %v, want one metadata file", fc.created)
+			}
+		})
+	}
+}
+
+// Same staging gate on the view commit path: the owner, and a caller whose own
+// identity carries UpdateView, stage a metadata file and land the commit.
+func TestViewCommitAllowedStagesMetadata(t *testing.T) {
+	const bucket = "warehouse"
+	fullMetadata := viewMetadataJSON(t, "s3://"+bucket+"/finance/quarterly_view")
+
+	callers := map[string]func(r *http.Request) *http.Request{
+		"owner": func(r *http.Request) *http.Request {
+			return r.WithContext(s3_constants.SetIdentityNameInContext(r.Context(), "alice"))
+		},
+		"identity-actions": func(r *http.Request) *http.Request {
+			return withActions(r, "writer", "s3tables:GetView", "s3tables:UpdateView")
+		},
+	}
+	for name, as := range callers {
+		t.Run(name, func(t *testing.T) {
+			fc := &writeLogFiler{memFiler: newMemFiler()}
+			seedNamespace(fc.memFiler, bucket, "finance", "alice")
+			seedOwnedView(fc.memFiler, bucket, "finance", "quarterly_view", "alice", fullMetadata)
+			s := NewServer(fc, nil)
+
+			r := httptest.NewRequest(http.MethodPost, "/v1/"+bucket+"/namespaces/finance/views/quarterly_view",
+				strings.NewReader(`{"requirements":[],"updates":[{"action":"set-properties","updates":{"k":"v"}}]}`))
+			r = mux.SetURLVars(r, map[string]string{"prefix": bucket, "namespace": "finance", "view": "quarterly_view"})
+			w := httptest.NewRecorder()
+			s.handleUpdateView(w, as(r))
+
+			if w.Code != http.StatusOK {
+				t.Fatalf("status = %d, want %d (body: %s)", w.Code, http.StatusOK, w.Body.String())
+			}
+			if len(fc.created) != 1 || !strings.HasSuffix(fc.created[0], ".metadata.json") {
+				t.Fatalf("created = %v, want one metadata file", fc.created)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/iceberg/iceberg_commit_location_test.go b/weed/s3api/iceberg/iceberg_commit_location_test.go
new file mode 100644
index 0000000000..4ac9f694bb
--- /dev/null
+++ b/weed/s3api/iceberg/iceberg_commit_location_test.go
@@ -0,0 +1,97 @@
+package iceberg
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// seedPoisonedTable registers a table entry whose stored metadataLocation
+// points outside its own bucket via a ".." segment, simulating a value
+// persisted verbatim by the raw S3Tables UpdateTable API.
+func seedPoisonedTable(t *testing.T, fc *memFiler, bucket, namespace, tableName, metadataLocation string) {
+	t.Helper()
+	meta := s3tables.TableMetadata{
+		Iceberg: &s3tables.IcebergMetadata{TableUUID: "00000000-0000-0000-0000-000000000001"},
+	}
+	internal := map[string]any{
+		"name":             tableName,
+		"namespace":        namespace,
+		"format":           "ICEBERG",
+		"ownerAccountId":   s3_constants.AccountAdminId,
+		"versionToken":     "v1",
+		"metadataVersion":  1,
+		"metadataLocation": metadataLocation,
+		"metadata":         meta,
+	}
+	metaBytes, _ := json.Marshal(internal)
+	fc.seed(s3tables.GetTablePath(bucket, namespace, tableName), &filer_pb.Entry{
+		Name:        tableName,
+		IsDirectory: true,
+		Extended:    map[string][]byte{s3tables.ExtendedKeyMetadata: metaBytes},
+	})
+}
+
+func TestCommitTableRejectsStoredTraversalLocation(t *testing.T) {
+	const attacker = "attacker"
+	const victim = "victim"
+	fc := newMemFiler()
+	seedNamespace(fc, attacker, "ns", s3_constants.AccountAdminId)
+	seedPoisonedTable(t, fc, attacker, "ns", "t",
+		"s3://attacker/../victim/planted/metadata/v1.metadata.json")
+
+	s := NewServer(fc, nil)
+
+	r := httptest.NewRequest(http.MethodPost, "/v1/"+attacker+"/namespaces/ns/tables/t",
+		strings.NewReader(`{"requirements":[],"updates":[]}`))
+	r = mux.SetURLVars(r, map[string]string{"prefix": attacker, "namespace": "ns", "table": "t"})
+	r = r.WithContext(s3_constants.SetIdentityNameInContext(r.Context(), s3_constants.AccountAdminId))
+
+	w := httptest.NewRecorder()
+	s.handleUpdateTable(w, r)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d (body=%s)", w.Code, http.StatusBadRequest, w.Body.String())
+	}
+	for p := range fc.entries {
+		if strings.Contains(p, "/"+victim+"/") && !strings.Contains(p, "/"+attacker+"/") {
+			t.Fatalf("cross-tenant write escaped into victim tree at %s (status=%d body=%s)", p, w.Code, w.Body.String())
+		}
+	}
+}
+
+func TestCommitTransactionRejectsStoredTraversalLocation(t *testing.T) {
+	const attacker = "attacker"
+	const victim = "victim"
+	fc := newMemFiler()
+	seedNamespace(fc, attacker, "ns", s3_constants.AccountAdminId)
+	seedPoisonedTable(t, fc, attacker, "ns", "t",
+		"s3://attacker/../victim/planted/metadata/v1.metadata.json")
+
+	s := NewServer(fc, nil)
+
+	body := `{"table-changes":[{"identifier":{"namespace":["ns"],"name":"t"},"requirements":[],"updates":[]}]}`
+	r := httptest.NewRequest(http.MethodPost, "/v1/"+attacker+"/transactions/commit",
+		strings.NewReader(body))
+	r = mux.SetURLVars(r, map[string]string{"prefix": attacker})
+	r = r.WithContext(s3_constants.SetIdentityNameInContext(r.Context(), s3_constants.AccountAdminId))
+
+	w := httptest.NewRecorder()
+	s.handleCommitTransaction(w, r)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d (body=%s)", w.Code, http.StatusBadRequest, w.Body.String())
+	}
+	for p := range fc.entries {
+		if strings.Contains(p, "/"+victim+"/") && !strings.Contains(p, "/"+attacker+"/") {
+			t.Fatalf("cross-tenant transaction write escaped into victim tree at %s (status=%d body=%s)", p, w.Code, w.Body.String())
+		}
+	}
+}
diff --git a/weed/s3api/iceberg/iceberg_commit_updates_test.go b/weed/s3api/iceberg/iceberg_commit_updates_test.go
index 96ed7e4027..9811b5e73a 100644
--- a/weed/s3api/iceberg/iceberg_commit_updates_test.go
+++ b/weed/s3api/iceberg/iceberg_commit_updates_test.go
@@ -3,9 +3,14 @@ package iceberg
 import (
 	"encoding/json"
 	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/apache/iceberg-go/table"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 )
 
@@ -101,3 +106,29 @@ func TestIsS3TablesConflict(t *testing.T) {
 		t.Fatalf("unexpected conflict for non-conflict error")
 	}
 }
+
+// A create-on-commit is a create, and it writes the new table's metadata file
+// before the registration that authorizes it.
+func TestCreateOnCommitDeniedBeforeAnyWrite(t *testing.T) {
+	const bucket = "warehouse"
+	fc := newMemFiler()
+	seedNamespace(fc, bucket, "finance", "alice")
+	s := NewServer(fc, nil)
+
+	r := httptest.NewRequest(http.MethodPost, "/v1/"+bucket+"/namespaces/finance/tables/quarterly_reports",
+		strings.NewReader(`{"requirements":[{"type":"assert-create"}],"updates":[]}`))
+	r = mux.SetURLVars(r, map[string]string{"prefix": bucket, "namespace": "finance", "table": "quarterly_reports"})
+	r = r.WithContext(s3_constants.SetIdentityNameInContext(r.Context(), "mallory"))
+
+	w := httptest.NewRecorder()
+	s.handleUpdateTable(w, r)
+
+	if w.Code != http.StatusForbidden {
+		t.Errorf("status = %d, want %d (body: %s)", w.Code, http.StatusForbidden, w.Body.String())
+	}
+	for p, entry := range fc.entries {
+		if !entry.IsDirectory && strings.Contains(p, "quarterly_reports") {
+			t.Errorf("unauthorized caller wrote %s", p)
+		}
+	}
+}
diff --git a/weed/s3api/iceberg/iceberg_create_table_test.go b/weed/s3api/iceberg/iceberg_create_table_test.go
index ea09e42521..bd083f8116 100644
--- a/weed/s3api/iceberg/iceberg_create_table_test.go
+++ b/weed/s3api/iceberg/iceberg_create_table_test.go
@@ -10,6 +10,8 @@ import (
 
 	"github.com/apache/iceberg-go"
 	"github.com/google/uuid"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
 )
 
@@ -109,3 +111,90 @@ func TestBuildLoadTableResultNeverReturnsNilMetadata(t *testing.T) {
 		})
 	}
 }
+
+func newCreateTableRequest(t *testing.T, bucket, namespace, body, identity string) *http.Request {
+	t.Helper()
+	r := httptest.NewRequest(http.MethodPost, "/v1/"+bucket+"/namespaces/"+namespace+"/tables", strings.NewReader(body))
+	r = mux.SetURLVars(r, map[string]string{"prefix": bucket, "namespace": namespace})
+	return r.WithContext(s3_constants.SetIdentityNameInContext(r.Context(), identity))
+}
+
+// A caller who may not create the table must be refused before anything is
+// written: both branches of CreateTable write to the bucket, and stage-create
+// never reaches the registration that carries the authorization.
+func TestCreateTableDeniedBeforeAnyWrite(t *testing.T) {
+	const bucket = "warehouse"
+	for name, body := range map[string]string{
+		"stage-create": `{"name":"quarterly_reports","stage-create":true}`,
+		"create":       `{"name":"quarterly_reports"}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			fc := newMemFiler()
+			seedNamespace(fc, bucket, "finance", "alice")
+			s := NewServer(fc, nil)
+
+			w := httptest.NewRecorder()
+			s.handleCreateTable(w, newCreateTableRequest(t, bucket, "finance", body, "mallory"))
+
+			if w.Code != http.StatusForbidden {
+				t.Errorf("status = %d, want %d (body: %s)", w.Code, http.StatusForbidden, w.Body.String())
+			}
+			for p, entry := range fc.entries {
+				if !entry.IsDirectory && strings.Contains(p, "quarterly_reports") {
+					t.Errorf("unauthorized caller wrote %s", p)
+				}
+			}
+		})
+	}
+}
+
+// The namespace owner still gets the staged metadata and marker stage-create
+// exists to leave behind.
+func TestStageCreateWritesStagedFilesForOwner(t *testing.T) {
+	const bucket = "warehouse"
+	fc := newMemFiler()
+	seedNamespace(fc, bucket, "finance", "alice")
+	s := NewServer(fc, nil)
+
+	w := httptest.NewRecorder()
+	s.handleCreateTable(w, newCreateTableRequest(t, bucket, "finance", `{"name":"quarterly_reports","stage-create":true}`, "alice"))
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d (body: %s)", w.Code, http.StatusOK, w.Body.String())
+	}
+
+	staged := 0
+	for p, entry := range fc.entries {
+		if !entry.IsDirectory && strings.Contains(p, stageCreateMarkerDirName) {
+			staged++
+		}
+	}
+	if staged != 2 {
+		t.Fatalf("staged files = %d, want the metadata file and its marker", staged)
+	}
+	if _, ok := fc.entries[s3tables.GetTablePath(bucket, "finance", "quarterly_reports")]; ok {
+		t.Error("stage-create registered the table")
+	}
+}
+
+// A caller allowed by the actions on its own identity, rather than by ownership
+// or a resource policy, has to survive the hop into the s3tables manager: the
+// gate must not refuse what the create behind it would allow.
+func TestCreateTableAllowedByIdentityActions(t *testing.T) {
+	const bucket = "warehouse"
+	fc := newMemFiler()
+	seedNamespace(fc, bucket, "finance", "alice")
+	s := NewServer(fc, nil)
+
+	r := newCreateTableRequest(t, bucket, "finance", `{"name":"quarterly_reports","stage-create":true}`, "mallory")
+	r = r.WithContext(s3_constants.SetIdentityInContext(r.Context(), &struct {
+		Name    string
+		Actions []string
+	}{Name: "mallory", Actions: []string{"s3tables:CreateTable"}}))
+
+	w := httptest.NewRecorder()
+	s.handleCreateTable(w, r)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want %d (body: %s)", w.Code, http.StatusOK, w.Body.String())
+	}
+}
diff --git a/weed/s3api/iceberg/iceberg_create_view_test.go b/weed/s3api/iceberg/iceberg_create_view_test.go
index bc7c6a74ea..7f5e641f07 100644
--- a/weed/s3api/iceberg/iceberg_create_view_test.go
+++ b/weed/s3api/iceberg/iceberg_create_view_test.go
@@ -5,9 +5,11 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"path"
+	"sort"
 	"strings"
 	"testing"
 
@@ -76,6 +78,35 @@ func (m *memFiler) UpdateEntry(_ context.Context, in *filer_pb.UpdateEntryReques
 	return &filer_pb.UpdateEntryResponse{}, nil
 }
 
+func (m *memFiler) ListEntries(_ context.Context, in *filer_pb.ListEntriesRequest, _ ...grpc.CallOption) (filer_pb.SeaweedFiler_ListEntriesClient, error) {
+	var names []string
+	for p := range m.entries {
+		if path.Dir(p) == in.Directory {
+			names = append(names, p)
+		}
+	}
+	sort.Strings(names)
+	stream := &memListEntries{}
+	for _, name := range names {
+		stream.entries = append(stream.entries, m.entries[name])
+	}
+	return stream, nil
+}
+
+type memListEntries struct {
+	grpc.ClientStream
+	entries []*filer_pb.Entry
+}
+
+func (m *memListEntries) Recv() (*filer_pb.ListEntriesResponse, error) {
+	if len(m.entries) == 0 {
+		return nil, io.EOF
+	}
+	entry := m.entries[0]
+	m.entries = m.entries[1:]
+	return &filer_pb.ListEntriesResponse{Entry: entry}, nil
+}
+
 func newCreateViewRequest(t *testing.T, namespace, name, sql string) *http.Request {
 	t.Helper()
 	schema := iceberg.NewSchemaWithIdentifiers(0, nil,
@@ -95,12 +126,11 @@ func newCreateViewRequest(t *testing.T, namespace, name, sql string) *http.Reque
 	return r
 }
 
-// seedNamespace registers a bucket and namespace so the s3tables existence and
-// auth-context lookups pass; ownership is irrelevant since the admin principal
-// is always allowed.
-func seedNamespace(fc *memFiler, bucket, namespace string) {
+// seedNamespace registers a bucket and namespace owned by owner so the s3tables
+// existence and auth-context lookups pass.
+func seedNamespace(fc *memFiler, bucket, namespace, owner string) {
 	fc.seed(s3tables.GetTableBucketPath(bucket), &filer_pb.Entry{Name: bucket, IsDirectory: true})
-	meta, _ := json.Marshal(map[string]any{"namespace": []string{namespace}, "ownerAccountId": s3_constants.AccountAdminId})
+	meta, _ := json.Marshal(map[string]any{"namespace": []string{namespace}, "ownerAccountId": owner})
 	fc.seed(s3tables.GetNamespacePath(bucket, namespace), &filer_pb.Entry{
 		Name:        namespace,
 		IsDirectory: true,
@@ -130,7 +160,7 @@ func TestCreateViewMissingNamespaceReturns404(t *testing.T) {
 func TestCreateViewTagsEntryAsView(t *testing.T) {
 	const bucket = "warehouse"
 	fc := newMemFiler()
-	seedNamespace(fc, bucket, "ns")
+	seedNamespace(fc, bucket, "ns", s3_constants.AccountAdminId)
 	s := NewServer(fc, nil)
 
 	w := httptest.NewRecorder()
@@ -154,7 +184,7 @@ func TestCreateViewTagsEntryAsView(t *testing.T) {
 func TestCreateViewDuplicateDoesNotClobberMetadata(t *testing.T) {
 	const bucket = "warehouse"
 	fc := newMemFiler()
-	seedNamespace(fc, bucket, "ns")
+	seedNamespace(fc, bucket, "ns", s3_constants.AccountAdminId)
 	s := NewServer(fc, nil)
 
 	w := httptest.NewRecorder()
@@ -185,7 +215,7 @@ func TestCreateViewDuplicateDoesNotClobberMetadata(t *testing.T) {
 func TestCreateViewRollsBackEntryWhenMetadataWriteFails(t *testing.T) {
 	const bucket = "warehouse"
 	fc := newMemFiler()
-	seedNamespace(fc, bucket, "ns")
+	seedNamespace(fc, bucket, "ns", s3_constants.AccountAdminId)
 	fc.failFileCreate = errors.New("disk full")
 	s := NewServer(fc, nil)
 
diff --git a/weed/s3api/iceberg/iceberg_credential_vending_test.go b/weed/s3api/iceberg/iceberg_credential_vending_test.go
new file mode 100644
index 0000000000..83f81a0124
--- /dev/null
+++ b/weed/s3api/iceberg/iceberg_credential_vending_test.go
@@ -0,0 +1,135 @@
+package iceberg
+
+import (
+	"context"
+	"errors"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+type stubVendor struct {
+	credentials *VendedCredentials
+	err         error
+	gotBucket   string
+	gotPrefix   string
+	gotcaller   string
+	gotReadOnly bool
+}
+
+func (v *stubVendor) VendTableCredentials(_ context.Context, principal, bucket, prefix string, readOnly bool) (*VendedCredentials, error) {
+	v.gotcaller, v.gotBucket, v.gotPrefix, v.gotReadOnly = principal, bucket, prefix, readOnly
+	return v.credentials, v.err
+}
+
+func vendingServer(vendor CredentialVendor) *Server {
+	s := &Server{s3Endpoint: "http://s3.example:8333"}
+	s.SetCredentialVendor(vendor)
+	return s
+}
+
+func TestBuildFileIOConfigVendingVendsScopedCredentials(t *testing.T) {
+	expiry := time.Now().Add(time.Hour).Truncate(time.Millisecond)
+	vendor := &stubVendor{credentials: &VendedCredentials{
+		AccessKeyID:     "ASIAEXAMPLE",
+		SecretAccessKey: "secret",
+		SessionToken:    "token",
+		Expiration:      expiry,
+	}}
+	s := vendingServer(vendor)
+
+	r := httptest.NewRequest("GET", "/v1/namespaces/ns/tables/t", nil)
+	r.Header.Set(accessDelegationHeader, "vended-credentials")
+
+	config, storageCredentials := s.buildFileIOConfig(r, "s3://warehouse/ns/t", nil)
+
+	if vendor.gotBucket != "warehouse" || vendor.gotPrefix != "ns/t" {
+		t.Errorf("vendor called with bucket=%q prefix=%q, want warehouse and ns/t", vendor.gotBucket, vendor.gotPrefix)
+	}
+	if config["s3.access-key-id"] != "ASIAEXAMPLE" || config["s3.secret-access-key"] != "secret" || config["s3.session-token"] != "token" {
+		t.Errorf("config missing vended credentials: %v", config)
+	}
+	if config["s3.endpoint"] != "http://s3.example:8333" {
+		t.Errorf("config missing the endpoint the credentials are for: %v", config)
+	}
+	if len(storageCredentials) != 1 {
+		t.Fatalf("storage-credentials = %d entries, want 1", len(storageCredentials))
+	}
+	if storageCredentials[0].Prefix != "s3://warehouse/ns/t" {
+		t.Errorf("storage credential prefix = %q", storageCredentials[0].Prefix)
+	}
+	if storageCredentials[0].Config["s3.session-token"] != "token" {
+		t.Errorf("storage credential is missing the session token: %v", storageCredentials[0].Config)
+	}
+}
+
+// Without a vendor the response must stay silent about the endpoint too: a
+// client that asked for vended credentials would otherwise drop its own and
+// start sending unsigned requests.
+func TestBuildFileIOConfigVendingWithoutVendorSaysNothing(t *testing.T) {
+	s := &Server{s3Endpoint: "http://s3.example:8333"}
+	r := httptest.NewRequest("GET", "/v1/namespaces/ns/tables/t", nil)
+	r.Header.Set(accessDelegationHeader, "vended-credentials")
+
+	config, storageCredentials := s.buildFileIOConfig(r, "s3://warehouse/ns/t", nil)
+	if len(config) != 0 || storageCredentials != nil {
+		t.Errorf("config = %v, storage-credentials = %v, want both empty", config, storageCredentials)
+	}
+}
+
+func TestBuildFileIOConfigVendingFallsBackWhenVendingFails(t *testing.T) {
+	s := vendingServer(&stubVendor{err: errors.New("no role configured")})
+	r := httptest.NewRequest("GET", "/v1/namespaces/ns/tables/t", nil)
+	r.Header.Set(accessDelegationHeader, "vended-credentials")
+
+	config, storageCredentials := s.buildFileIOConfig(r, "s3://warehouse/ns/t", nil)
+	if len(config) != 0 || storageCredentials != nil {
+		t.Errorf("config = %v, storage-credentials = %v, want both empty", config, storageCredentials)
+	}
+}
+
+// The vend stays read-only unless the caller proved write authority: a nil
+// or false canWrite must reach the vendor as readOnly.
+func TestBuildFileIOConfigVendingReadOnlyUnlessCanWrite(t *testing.T) {
+	vendor := &stubVendor{credentials: &VendedCredentials{AccessKeyID: "ASIAEXAMPLE"}}
+	s := vendingServer(vendor)
+
+	r := httptest.NewRequest("GET", "/v1/namespaces/ns/tables/t", nil)
+	r.Header.Set(accessDelegationHeader, "vended-credentials")
+
+	s.buildFileIOConfig(r, "s3://warehouse/ns/t", nil)
+	if !vendor.gotReadOnly {
+		t.Error("vendCredentials() passed readOnly=false for a nil canWrite, want readOnly=true")
+	}
+	s.buildFileIOConfig(r, "s3://warehouse/ns/t", func() bool { return false })
+	if !vendor.gotReadOnly {
+		t.Error("vendCredentials() passed readOnly=false for canWrite=false, want readOnly=true")
+	}
+	s.buildFileIOConfig(r, "s3://warehouse/ns/t", func() bool { return true })
+	if vendor.gotReadOnly {
+		t.Error("vendCredentials() passed readOnly=true for canWrite=true, want readOnly=false")
+	}
+}
+
+// A client that did not ask for delegation keeps the plain endpoint config and
+// must never be handed credentials.
+func TestBuildFileIOConfigVendingWithoutDelegationHeader(t *testing.T) {
+	vendor := &stubVendor{credentials: &VendedCredentials{AccessKeyID: "ASIAEXAMPLE"}}
+	s := vendingServer(vendor)
+
+	r := httptest.NewRequest("GET", "/v1/namespaces/ns/tables/t", nil)
+	config, storageCredentials := s.buildFileIOConfig(r, "s3://warehouse/ns/t", nil)
+
+	if _, vended := config["s3.access-key-id"]; vended {
+		t.Errorf("credentials vended without the delegation header: %v", config)
+	}
+	if config["s3.endpoint"] != "http://s3.example:8333" {
+		t.Errorf("config = %v, want the endpoint", config)
+	}
+	if storageCredentials != nil {
+		t.Errorf("storage-credentials = %v, want none", storageCredentials)
+	}
+	if vendor.gotBucket != "" {
+		t.Errorf("vendor was called for a request that did not ask for delegation")
+	}
+}
diff --git a/weed/s3api/iceberg/iceberg_invalid_name_test.go b/weed/s3api/iceberg/iceberg_invalid_name_test.go
index b56bdecb70..a7e3b5f726 100644
--- a/weed/s3api/iceberg/iceberg_invalid_name_test.go
+++ b/weed/s3api/iceberg/iceberg_invalid_name_test.go
@@ -58,6 +58,12 @@ func TestWriteManagerError(t *testing.T) {
 			// say how to name a real one.
 			wantMessage: []string{"table bucket warehouse not found", "warehouse=s3://<table-bucket>/", "/v1/<table-bucket>/"},
 		},
+		{
+			name:     "denied catalog write is forbidden, not a server fault",
+			err:      &s3tables.S3TablesError{Type: s3tables.ErrCodeAccessDenied, Message: "not authorized to update table"},
+			wantCode: http.StatusForbidden,
+			wantType: "ForbiddenException",
+		},
 		{name: "everything else is a server fault", err: fmt.Errorf("all filers failed, last error: connection refused"), wantCode: http.StatusInternalServerError, wantType: "InternalServerError"},
 	}
 	for _, c := range cases {
diff --git a/weed/s3api/iceberg/iceberg_issue_9103_test.go b/weed/s3api/iceberg/iceberg_issue_9103_test.go
index 555d09c9e6..8fb72499b6 100644
--- a/weed/s3api/iceberg/iceberg_issue_9103_test.go
+++ b/weed/s3api/iceberg/iceberg_issue_9103_test.go
@@ -61,7 +61,7 @@ func TestBuildFileIOConfig(t *testing.T) {
 
 	t.Run("no endpoint configured yields empty config", func(t *testing.T) {
 		s := &Server{}
-		got := s.buildFileIOConfig(loadTable())
+		got, _ := s.buildFileIOConfig(loadTable(), "s3://warehouse/ns/t", nil)
 		if len(got) != 0 {
 			t.Fatalf("buildFileIOConfig() = %v, want empty", got)
 		}
@@ -69,7 +69,7 @@ func TestBuildFileIOConfig(t *testing.T) {
 
 	t.Run("endpoint is advertised with path-style-access and region", func(t *testing.T) {
 		s := &Server{s3Endpoint: "http://seaweed.example:8333"}
-		got := s.buildFileIOConfig(loadTable())
+		got, _ := s.buildFileIOConfig(loadTable(), "s3://warehouse/ns/t", nil)
 		if got["s3.endpoint"] != "http://seaweed.example:8333" {
 			t.Fatalf("s3.endpoint = %q, want %q", got["s3.endpoint"], "http://seaweed.example:8333")
 		}
@@ -81,3 +81,25 @@ func TestBuildFileIOConfig(t *testing.T) {
 		}
 	})
 }
+
+func TestGetBucketFromPrefix_TableBucketEnvFallback(t *testing.T) {
+	r := httptest.NewRequest("GET", "/v1/namespaces", nil)
+
+	t.Setenv("S3_TABLE_BUCKET", " ,analytics, other")
+	if got := getBucketFromPrefix(r); got != "analytics" {
+		t.Fatalf("first S3_TABLE_BUCKET entry: got %q, want analytics", got)
+	}
+
+	// The explicit default still wins over the table bucket list.
+	t.Setenv("S3TABLES_DEFAULT_BUCKET", "explicit")
+	if got := getBucketFromPrefix(r); got != "explicit" {
+		t.Fatalf("S3TABLES_DEFAULT_BUCKET override: got %q, want explicit", got)
+	}
+
+	// A prefixless value with neither env set falls through to the default.
+	t.Setenv("S3TABLES_DEFAULT_BUCKET", "")
+	t.Setenv("S3_TABLE_BUCKET", " , ")
+	if got := getBucketFromPrefix(r); got != "warehouse" {
+		t.Fatalf("empty specs: got %q, want warehouse", got)
+	}
+}
diff --git a/weed/s3api/iceberg/iceberg_snapshots_param_test.go b/weed/s3api/iceberg/iceberg_snapshots_param_test.go
new file mode 100644
index 0000000000..85c1c02d00
--- /dev/null
+++ b/weed/s3api/iceberg/iceberg_snapshots_param_test.go
@@ -0,0 +1,93 @@
+package iceberg
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go/table"
+	"github.com/google/uuid"
+)
+
+// metadataWithSnapshots builds metadata whose main branch is on the last
+// snapshot, optionally tagging one of the earlier ones.
+func metadataWithSnapshots(t *testing.T, ids []int64, tagged int64) table.Metadata {
+	t.Helper()
+
+	base, err := newTableMetadata(uuid.New(), "s3://bkt/ns/t", nil, nil, nil, nil)
+	if err != nil {
+		t.Fatalf("newTableMetadata() error = %v", err)
+	}
+	builder, err := table.MetadataBuilderFromBase(base, "")
+	if err != nil {
+		t.Fatalf("MetadataBuilderFromBase() error = %v", err)
+	}
+
+	now := time.Now().UnixMilli()
+	for i, id := range ids {
+		snapshot := table.Snapshot{
+			SnapshotID:   id,
+			TimestampMs:  now + int64(i),
+			ManifestList: "metadata/snap-" + string(rune('0'+i)) + ".avro",
+		}
+		if err := builder.AddSnapshot(&snapshot); err != nil {
+			t.Fatalf("AddSnapshot(%d) error = %v", id, err)
+		}
+	}
+	if err := builder.SetSnapshotRef(table.MainBranch, ids[len(ids)-1], table.BranchRef); err != nil {
+		t.Fatalf("SetSnapshotRef(main) error = %v", err)
+	}
+	if tagged != 0 {
+		if err := builder.SetSnapshotRef("release", tagged, table.TagRef); err != nil {
+			t.Fatalf("SetSnapshotRef(release) error = %v", err)
+		}
+	}
+
+	metadata, err := builder.Build()
+	if err != nil {
+		t.Fatalf("Build() error = %v", err)
+	}
+	return metadata
+}
+
+func snapshotIDs(metadata table.Metadata) map[int64]bool {
+	ids := map[int64]bool{}
+	for _, snapshot := range metadata.Snapshots() {
+		ids[snapshot.SnapshotID] = true
+	}
+	return ids
+}
+
+func TestApplySnapshotsParamRefsKeepsOnlyReferenced(t *testing.T) {
+	metadata := metadataWithSnapshots(t, []int64{1, 2, 3}, 1)
+
+	got, err := applySnapshotsParam(httptest.NewRequest("GET", "/v1/namespaces/ns/tables/t?snapshots=refs", nil), metadata)
+	if err != nil {
+		t.Fatalf("applySnapshotsParam() error = %v", err)
+	}
+
+	ids := snapshotIDs(got)
+	if !ids[1] {
+		t.Error("tagged snapshot 1 was dropped")
+	}
+	if !ids[3] {
+		t.Error("current snapshot 3 was dropped")
+	}
+	if ids[2] {
+		t.Error("unreferenced snapshot 2 was returned")
+	}
+}
+
+func TestApplySnapshotsParamDefaultsToAll(t *testing.T) {
+	metadata := metadataWithSnapshots(t, []int64{1, 2, 3}, 1)
+
+	for _, target := range []string{"/v1/namespaces/ns/tables/t", "/v1/namespaces/ns/tables/t?snapshots=all"} {
+		got, err := applySnapshotsParam(httptest.NewRequest("GET", target, nil), metadata)
+		if err != nil {
+			t.Fatalf("applySnapshotsParam(%s) error = %v", target, err)
+		}
+		if len(got.Snapshots()) != 3 {
+			t.Errorf("applySnapshotsParam(%s) kept %d snapshots, want 3", target, len(got.Snapshots()))
+		}
+	}
+}
diff --git a/weed/s3api/iceberg/log_manager_error_test.go b/weed/s3api/iceberg/log_manager_error_test.go
new file mode 100644
index 0000000000..ff52da322b
--- /dev/null
+++ b/weed/s3api/iceberg/log_manager_error_test.go
@@ -0,0 +1,36 @@
+package iceberg
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+func TestLogManagerErrorRefusalsAreNotErrors(t *testing.T) {
+	var refusals, faults []string
+	oldR, oldF := logManagerRefusal, logManagerFault
+	logManagerRefusal = func(f string, a ...interface{}) { refusals = append(refusals, fmt.Sprintf(f, a...)) }
+	logManagerFault = func(f string, a ...interface{}) { faults = append(faults, fmt.Sprintf(f, a...)) }
+	defer func() { logManagerRefusal, logManagerFault = oldR, oldF }()
+	for _, c := range []struct {
+		err   error
+		fault bool
+	}{
+		{&s3tables.S3TablesError{Type: s3tables.ErrCodeAccessDenied, Message: "not authorized to create namespace in this bucket"}, false},
+		{&s3tables.S3TablesError{Type: s3tables.ErrCodeNoSuchNamespace, Message: "no such namespace"}, false},
+		{&s3tables.S3TablesError{Type: s3tables.ErrCodeNamespaceAlreadyExists, Message: "exists"}, false},
+		{errors.New("filer: connection refused"), true}, // positive control: a real fault stays at ERROR
+	} {
+		refusals, faults = nil, nil
+		logManagerError("CreateNamespace", c.err)
+		wantFaults, wantRefusals := 0, 1
+		if c.fault {
+			wantFaults, wantRefusals = 1, 0
+		}
+		if len(faults) != wantFaults || len(refusals) != wantRefusals {
+			t.Errorf("%v: %d ERROR and %d refusal log(s), want %d and %d (refusals %v, faults %v)", c.err, len(faults), len(refusals), wantFaults, wantRefusals, refusals, faults)
+		}
+	}
+}
diff --git a/weed/s3api/iceberg/manifest_repair.go b/weed/s3api/iceberg/manifest_repair.go
index ea629ffdd6..e1326d9d0d 100644
--- a/weed/s3api/iceberg/manifest_repair.go
+++ b/weed/s3api/iceberg/manifest_repair.go
@@ -556,7 +556,7 @@ func (st *serverManifestStore) saveFile(ctx context.Context, location string, da
 	if err != nil {
 		return err
 	}
-	return st.server.saveMetadataBlob(ctx, bucket, tablePath, fileName, data, "application/avro")
+	return st.server.saveMetadataBlob(ctx, bucket, tablePath, fileName, data, "application/avro", false)
 }
 
 // repairAddSnapshotManifests is the server entry point used by the commit
diff --git a/weed/s3api/iceberg/metadata_files.go b/weed/s3api/iceberg/metadata_files.go
index 1e6223f0a9..7d9021dc45 100644
--- a/weed/s3api/iceberg/metadata_files.go
+++ b/weed/s3api/iceberg/metadata_files.go
@@ -22,13 +22,17 @@ func metadataDirPath(bucketName, tablePath string) string {
 }
 
 // saveMetadataFile saves the Iceberg metadata JSON file to the filer.
-// It constructs the filer path from the S3 location components.
-func (s *Server) saveMetadataFile(ctx context.Context, bucketName, tablePath, metadataFileName string, content []byte) error {
-	return s.saveMetadataBlob(ctx, bucketName, tablePath, metadataFileName, content, "application/json")
+// It constructs the filer path from the S3 location components. With exclusive
+// set the write fails with filer_pb.ErrEntryAlreadyExists rather than replacing
+// a file that is already there: two commits racing off the same base pick the
+// same v{N} name, and letting the second overwrite the first would leave the
+// winner's catalog pointer aimed at the loser's metadata.
+func (s *Server) saveMetadataFile(ctx context.Context, bucketName, tablePath, metadataFileName string, content []byte, exclusive bool) error {
+	return s.saveMetadataBlob(ctx, bucketName, tablePath, metadataFileName, content, "application/json", exclusive)
 }
 
 // saveMetadataBlob saves a file into the table's metadata directory.
-func (s *Server) saveMetadataBlob(ctx context.Context, bucketName, tablePath, metadataFileName string, content []byte, mimeType string) error {
+func (s *Server) saveMetadataBlob(ctx context.Context, bucketName, tablePath, metadataFileName string, content []byte, mimeType string, exclusive bool) error {
 
 	// Create context with timeout for file operations
 	opCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
@@ -101,6 +105,7 @@ func (s *Server) saveMetadataBlob(ctx context.Context, bucketName, tablePath, me
 		// 4. Write the file
 		resp, err := client.CreateEntry(opCtx, &filer_pb.CreateEntryRequest{
 			Directory: metadataDir,
+			OExcl:     exclusive,
 			Entry: &filer_pb.Entry{
 				Name: metadataFileName,
 				Attributes: &filer_pb.FuseAttributes{
diff --git a/weed/s3api/iceberg/metadata_files_test.go b/weed/s3api/iceberg/metadata_files_test.go
new file mode 100644
index 0000000000..1952475826
--- /dev/null
+++ b/weed/s3api/iceberg/metadata_files_test.go
@@ -0,0 +1,128 @@
+package iceberg
+
+import (
+	"context"
+	"errors"
+	"path"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"google.golang.org/grpc"
+)
+
+// stubFilerClient answers only the calls the metadata writers make, tracking
+// which paths exist so exclusive creates can be exercised.
+type stubFilerClient struct {
+	filer_pb.SeaweedFilerClient
+	entries map[string][]byte
+}
+
+func newStubFilerClient() *stubFilerClient {
+	return &stubFilerClient{entries: make(map[string][]byte)}
+}
+
+func (c *stubFilerClient) WithFilerClient(_ bool, fn func(client filer_pb.SeaweedFilerClient) error) error {
+	return fn(c)
+}
+
+func (c *stubFilerClient) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest, _ ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	key := path.Join(req.Directory, req.Name)
+	if _, ok := c.entries[key]; !ok {
+		return nil, filer_pb.ErrNotFound
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: &filer_pb.Entry{Name: req.Name}}, nil
+}
+
+func (c *stubFilerClient) CreateEntry(_ context.Context, req *filer_pb.CreateEntryRequest, _ ...grpc.CallOption) (*filer_pb.CreateEntryResponse, error) {
+	key := path.Join(req.Directory, req.Entry.Name)
+	if _, exists := c.entries[key]; exists && req.OExcl {
+		return &filer_pb.CreateEntryResponse{
+			Error:     "entry already exists",
+			ErrorCode: filer_pb.FilerError_ENTRY_ALREADY_EXISTS,
+		}, nil
+	}
+	c.entries[key] = req.Entry.Content
+	return &filer_pb.CreateEntryResponse{}, nil
+}
+
+// Two commits racing off the same base metadata pick the same v{N} file name.
+// The loser must be told, not allowed to replace the winner's metadata.
+func TestSaveMetadataFileExclusiveRefusesToOverwrite(t *testing.T) {
+	client := newStubFilerClient()
+	s := &Server{filerClient: client}
+	ctx := context.Background()
+
+	if err := s.saveMetadataFile(ctx, "bkt", "ns/tbl", "v2.metadata.json", []byte(`{"winner":true}`), true); err != nil {
+		t.Fatalf("first write failed: %v", err)
+	}
+
+	err := s.saveMetadataFile(ctx, "bkt", "ns/tbl", "v2.metadata.json", []byte(`{"loser":true}`), true)
+	if !errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+		t.Fatalf("second write err = %v, want ErrEntryAlreadyExists", err)
+	}
+
+	stored := string(client.entries[path.Join(metadataDirPath("bkt", "ns/tbl"), "v2.metadata.json")])
+	if stored != `{"winner":true}` {
+		t.Errorf("stored metadata = %s, want the first writer's content", stored)
+	}
+}
+
+// A metadata file left behind by an interrupted commit must not wedge the
+// table: the next commit stages under a unique name rather than failing or
+// overwriting, and the catalog pointer still decides the winner.
+func TestStageCommitMetadataFallsBackToAUniqueName(t *testing.T) {
+	client := newStubFilerClient()
+	s := &Server{filerClient: client}
+	ctx := context.Background()
+
+	name, location, err := s.stageCommitMetadata(ctx, "bkt", "ns/tbl", "s3://bkt/ns/tbl", "v2.metadata.json", []byte(`{"orphan":true}`))
+	if err != nil {
+		t.Fatalf("first stage failed: %v", err)
+	}
+	if name != "v2.metadata.json" {
+		t.Errorf("first stage used %q, want the plain versioned name", name)
+	}
+	if location != "s3://bkt/ns/tbl/metadata/v2.metadata.json" {
+		t.Errorf("location = %q", location)
+	}
+
+	name, location, err = s.stageCommitMetadata(ctx, "bkt", "ns/tbl", "s3://bkt/ns/tbl", "v2.metadata.json", []byte(`{"second":true}`))
+	if err != nil {
+		t.Fatalf("second stage failed: %v", err)
+	}
+	if !strings.HasPrefix(name, "v2-") || !strings.HasSuffix(name, ".metadata.json") {
+		t.Errorf("second stage used %q, want a unique v2-* name", name)
+	}
+	if location != "s3://bkt/ns/tbl/metadata/"+name {
+		t.Errorf("location = %q, want it to match the staged name", location)
+	}
+
+	stored := string(client.entries[path.Join(metadataDirPath("bkt", "ns/tbl"), "v2.metadata.json")])
+	if stored != `{"orphan":true}` {
+		t.Errorf("the first file was overwritten: %s", stored)
+	}
+	if fallback := string(client.entries[path.Join(metadataDirPath("bkt", "ns/tbl"), name)]); fallback != `{"second":true}` {
+		t.Errorf("fallback file holds %s, want the second writer's metadata", fallback)
+	}
+}
+
+// Paths that legitimately rewrite a file, such as manifest repair, keep the
+// overwriting behaviour.
+func TestSaveMetadataFileOverwrites(t *testing.T) {
+	client := newStubFilerClient()
+	s := &Server{filerClient: client}
+	ctx := context.Background()
+
+	if err := s.saveMetadataFile(ctx, "bkt", "ns/tbl", "v2.metadata.json", []byte(`{"first":true}`), false); err != nil {
+		t.Fatalf("first write failed: %v", err)
+	}
+	if err := s.saveMetadataFile(ctx, "bkt", "ns/tbl", "v2.metadata.json", []byte(`{"second":true}`), false); err != nil {
+		t.Fatalf("second write failed: %v", err)
+	}
+
+	stored := string(client.entries[path.Join(metadataDirPath("bkt", "ns/tbl"), "v2.metadata.json")])
+	if stored != `{"second":true}` {
+		t.Errorf("stored metadata = %s, want the second write", stored)
+	}
+}
diff --git a/weed/s3api/iceberg/path_validation.go b/weed/s3api/iceberg/path_validation.go
index c1911ae110..6fbe63ba44 100644
--- a/weed/s3api/iceberg/path_validation.go
+++ b/weed/s3api/iceberg/path_validation.go
@@ -1,6 +1,7 @@
 package iceberg
 
 import (
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -58,8 +59,11 @@ func validateRequestPath(next http.Handler) http.Handler {
 
 // isValidTablePath reports whether a "/"-separated table path (the part below
 // the bucket) is free of segments that path.Join would collapse to escape the
-// bucket directory. Empty segments (from leading/duplicate slashes) are ignored.
+// bucket directory. Empty segments (from leading/duplicate slashes) are
+// ignored, but the path must resolve to at least one real segment so it does
+// not collapse to the bucket-level metadata directory.
 func isValidTablePath(tablePath string) bool {
+	hasSegment := false
 	for _, segment := range strings.Split(tablePath, "/") {
 		if segment == "" {
 			continue
@@ -67,8 +71,9 @@ func isValidTablePath(tablePath string) bool {
 		if !isValidNameSegment(segment) {
 			return false
 		}
+		hasSegment = true
 	}
-	return true
+	return hasSegment
 }
 
 // isValidNameSegment rejects a single path-segment value (bucket prefix slot,
@@ -83,3 +88,17 @@ func isValidNameSegment(s string) bool {
 	}
 	return !strings.ContainsAny(s, "/\\\x00")
 }
+
+// confineMetadataLocation checks that a parsed s3 location stays within the
+// authorized table bucket and rejects traversal segments that path.Join in
+// saveMetadataBlob would collapse to escape it. The table path must resolve
+// to at least one real segment so its metadata directory is table-specific.
+func confineMetadataLocation(metadataBucket, metadataPath, bucketName string) error {
+	if metadataBucket != bucketName {
+		return fmt.Errorf("table location must be within bucket %s", bucketName)
+	}
+	if !isValidTablePath(metadataPath) {
+		return fmt.Errorf("invalid table location path")
+	}
+	return nil
+}
diff --git a/weed/s3api/iceberg/path_validation_test.go b/weed/s3api/iceberg/path_validation_test.go
index fe7a0912bf..7b86e1da29 100644
--- a/weed/s3api/iceberg/path_validation_test.go
+++ b/weed/s3api/iceberg/path_validation_test.go
@@ -16,7 +16,9 @@ func TestIsValidTablePath(t *testing.T) {
 		{"sales.orders", true},
 		{"ns/table", true},
 		{"ns//table", true},
-		{"", true},
+		{"", false},
+		{"/", false},
+		{"//", false},
 		{"../other", false},
 		{"ns/../../etc", false},
 		{"ns/./x", false},
diff --git a/weed/s3api/iceberg/requirements.go b/weed/s3api/iceberg/requirements.go
new file mode 100644
index 0000000000..4e0265399a
--- /dev/null
+++ b/weed/s3api/iceberg/requirements.go
@@ -0,0 +1,55 @@
+package iceberg
+
+import (
+	"encoding/json"
+)
+
+// normalizeRequirements repairs requirement JSON that iceberg-go's parser
+// rejects but the Iceberg REST spec permits.
+//
+// iceberg-go's assert-ref-snapshot-id parser uses a nullableInt64 that tracks
+// whether the "snapshot-id" field was present in the JSON. An absent field
+// (set == false) is rejected as "missing required field", even though the spec
+// makes snapshot-id optional — null means the ref must not already exist.
+// iceberg-go v0.6.0 used a plain *int64, so absent was nil and accepted.
+//
+// Clients like ClickHouse send assert-ref-snapshot-id without snapshot-id when
+// asserting a branch does not yet exist. Splicing in an explicit null before
+// unmarshaling restores the v0.6.0 behavior across both iceberg-go versions.
+func normalizeRequirements(raw json.RawMessage) (json.RawMessage, error) {
+	if len(raw) == 0 {
+		return raw, nil
+	}
+	var reqs []json.RawMessage
+	if err := json.Unmarshal(raw, &reqs); err != nil {
+		return raw, err
+	}
+	changed := false
+	for i, req := range reqs {
+		var obj map[string]json.RawMessage
+		if err := json.Unmarshal(req, &obj); err != nil {
+			continue // let the downstream parser report the error
+		}
+		var typ string
+		if rawType, ok := obj["type"]; ok {
+			_ = json.Unmarshal(rawType, &typ)
+		}
+		if typ != "assert-ref-snapshot-id" {
+			continue
+		}
+		if _, hasSnapshotID := obj["snapshot-id"]; hasSnapshotID {
+			continue
+		}
+		obj["snapshot-id"] = json.RawMessage("null")
+		fixed, err := json.Marshal(obj)
+		if err != nil {
+			continue
+		}
+		reqs[i] = fixed
+		changed = true
+	}
+	if !changed {
+		return raw, nil
+	}
+	return json.Marshal(reqs)
+}
diff --git a/weed/s3api/iceberg/requirements_test.go b/weed/s3api/iceberg/requirements_test.go
new file mode 100644
index 0000000000..1b29a417cf
--- /dev/null
+++ b/weed/s3api/iceberg/requirements_test.go
@@ -0,0 +1,94 @@
+package iceberg
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/apache/iceberg-go/table"
+)
+
+func TestNormalizeRequirementsAddsNullSnapshotID(t *testing.T) {
+	// ClickHouse sends assert-ref-snapshot-id without snapshot-id when
+	// asserting a branch does not yet exist. iceberg-go's parser rejects
+	// an absent field; normalizeRequirements splices in an explicit null.
+	raw := json.RawMessage(`[{"type":"assert-ref-snapshot-id","ref":"main"}]`)
+
+	// Without normalization, iceberg-go rejects the requirement.
+	var reqs table.Requirements
+	if err := json.Unmarshal(raw, &reqs); err == nil {
+		t.Fatal("iceberg-go accepted an assert-ref-snapshot-id without snapshot-id; expected an error")
+	}
+
+	normalized, err := normalizeRequirements(raw)
+	if err != nil {
+		t.Fatalf("normalizeRequirements: %v", err)
+	}
+
+	if err := json.Unmarshal(normalized, &reqs); err != nil {
+		t.Fatalf("unmarshal normalized requirements: %v", err)
+	}
+	if len(reqs) != 1 {
+		t.Fatalf("got %d requirements, want 1", len(reqs))
+	}
+	if reqs[0].GetType() != "assert-ref-snapshot-id" {
+		t.Fatalf("requirement type = %s, want assert-ref-snapshot-id", reqs[0].GetType())
+	}
+}
+
+func TestNormalizeRequirementsPreservesPresentSnapshotID(t *testing.T) {
+	raw := json.RawMessage(`[{"type":"assert-ref-snapshot-id","ref":"main","snapshot-id":42}]`)
+	normalized, err := normalizeRequirements(raw)
+	if err != nil {
+		t.Fatalf("normalizeRequirements: %v", err)
+	}
+
+	var reqs table.Requirements
+	if err := json.Unmarshal(normalized, &reqs); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(reqs) != 1 {
+		t.Fatalf("got %d requirements, want 1", len(reqs))
+	}
+}
+
+func TestNormalizeRequirementsPreservesExplicitNullSnapshotID(t *testing.T) {
+	raw := json.RawMessage(`[{"type":"assert-ref-snapshot-id","ref":"main","snapshot-id":null}]`)
+	normalized, err := normalizeRequirements(raw)
+	if err != nil {
+		t.Fatalf("normalizeRequirements: %v", err)
+	}
+
+	var reqs table.Requirements
+	if err := json.Unmarshal(normalized, &reqs); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(reqs) != 1 {
+		t.Fatalf("got %d requirements, want 1", len(reqs))
+	}
+}
+
+func TestNormalizeRequirementsLeavesOtherTypesUnchanged(t *testing.T) {
+	raw := json.RawMessage(`[{"type":"assert-create"},{"type":"assert-table-uuid","uuid":"00000000-0000-0000-0000-000000000000"}]`)
+	normalized, err := normalizeRequirements(raw)
+	if err != nil {
+		t.Fatalf("normalizeRequirements: %v", err)
+	}
+
+	var reqs table.Requirements
+	if err := json.Unmarshal(normalized, &reqs); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if len(reqs) != 2 {
+		t.Fatalf("got %d requirements, want 2", len(reqs))
+	}
+}
+
+func TestNormalizeRequirementsEmptyInput(t *testing.T) {
+	normalized, err := normalizeRequirements(nil)
+	if err != nil {
+		t.Fatalf("normalizeRequirements(nil): %v", err)
+	}
+	if normalized != nil {
+		t.Fatalf("expected nil output for nil input, got %s", normalized)
+	}
+}
diff --git a/weed/s3api/iceberg/server.go b/weed/s3api/iceberg/server.go
index 366853bf1d..1849f2e6e8 100644
--- a/weed/s3api/iceberg/server.go
+++ b/weed/s3api/iceberg/server.go
@@ -1,7 +1,10 @@
 package iceberg
 
 import (
+	"context"
 	"net/http"
+	"strings"
+	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -33,6 +36,22 @@ type CredentialValidator interface {
 	GetCredentialByAccessKey(accessKey string) (identityName string, identity interface{}, secretKey string, err error)
 }
 
+// VendedCredentials are short-lived S3 credentials scoped to one table.
+type VendedCredentials struct {
+	AccessKeyID     string
+	SecretAccessKey string
+	SessionToken    string
+	Expiration      time.Time
+}
+
+// CredentialVendor mints credentials limited to a single table's prefix for a
+// caller the catalog has already authenticated and authorized, read-only when
+// readOnly is set. A nil result with no error means the deployment has vending
+// switched off.
+type CredentialVendor interface {
+	VendTableCredentials(ctx context.Context, principal, bucket, prefix string, readOnly bool) (*VendedCredentials, error)
+}
+
 // Server implements the Iceberg REST Catalog API.
 type Server struct {
 	filerClient         FilerClient
@@ -40,6 +59,7 @@ type Server struct {
 	prefix              string // optional prefix for routes
 	authenticator       S3Authenticator
 	credentialValidator CredentialValidator
+	credentialVendor    CredentialVendor
 	s3Endpoint          string // http(s):// URL advertised in LoadTable FileIO config
 }
 
@@ -61,6 +81,12 @@ func NewServer(filerClient FilerClient, authenticator S3Authenticator) *Server {
 	}
 }
 
+// SetCredentialVendor enables credential vending for clients that ask for it
+// with X-Iceberg-Access-Delegation: vended-credentials.
+func (s *Server) SetCredentialVendor(vendor CredentialVendor) {
+	s.credentialVendor = vendor
+}
+
 // SetCredentialValidator sets the credential validator for OAuth token support.
 func (s *Server) SetCredentialValidator(cv CredentialValidator) {
 	s.credentialValidator = cv
@@ -85,6 +111,14 @@ func (s *Server) RegisterRoutes(router *mux.Router) {
 	// audit-logged.
 	router.Use(validateRequestPath)
 
+	// Clients pointed at a catalog URI ending in /v1 still append the API
+	// version themselves, producing /v1/v1/... requests (iceberg-java does
+	// this when configured with a /v1-suffixed URI). Collapse the repeated
+	// segments before routing so those requests reach the intended handler;
+	// a table bucket can never be named "v1" (names require 3-63 chars), so
+	// the rewrite is unambiguous.
+	router.Use(collapseDoubledV1Middleware(router))
+
 	// Configuration endpoint - no auth needed for config
 	router.HandleFunc("/v1/config", s.handleConfig).Methods(http.MethodGet)
 
@@ -116,6 +150,8 @@ func (s *Server) RegisterRoutes(router *mux.Router) {
 	router.HandleFunc("/v1/namespaces/{namespace}/views/{view}", s.Auth(s.handleViewExists)).Methods(http.MethodHead)
 	router.HandleFunc("/v1/namespaces/{namespace}/views/{view}", s.Auth(s.handleDropView)).Methods(http.MethodDelete)
 	router.HandleFunc("/v1/namespaces/{namespace}/views/{view}", s.Auth(s.handleUpdateView)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/views/rename", s.Auth(s.handleRenameView)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/namespaces/{namespace}/tables/{table}/metrics", s.Auth(s.handleReportMetrics)).Methods(http.MethodPost)
 
 	// Multi-table transaction commit - wrapped with Auth middleware
 	router.HandleFunc("/v1/transactions/commit", s.Auth(s.handleCommitTransaction)).Methods(http.MethodPost)
@@ -141,6 +177,8 @@ func (s *Server) RegisterRoutes(router *mux.Router) {
 	router.HandleFunc("/v1/{prefix}/namespaces/{namespace}/views/{view}", s.Auth(s.handleViewExists)).Methods(http.MethodHead)
 	router.HandleFunc("/v1/{prefix}/namespaces/{namespace}/views/{view}", s.Auth(s.handleDropView)).Methods(http.MethodDelete)
 	router.HandleFunc("/v1/{prefix}/namespaces/{namespace}/views/{view}", s.Auth(s.handleUpdateView)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/{prefix}/views/rename", s.Auth(s.handleRenameView)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/{prefix}/namespaces/{namespace}/tables/{table}/metrics", s.Auth(s.handleReportMetrics)).Methods(http.MethodPost)
 	router.HandleFunc("/v1/{prefix}/transactions/commit", s.Auth(s.handleCommitTransaction)).Methods(http.MethodPost)
 
 	// Catch-all for debugging
@@ -152,6 +190,39 @@ func (s *Server) RegisterRoutes(router *mux.Router) {
 	glog.V(2).Infof("Registered Iceberg REST Catalog routes")
 }
 
+// collapseDoubledV1Middleware rewrites /v1/v1/... (and deeper repetitions) to
+// the single-/v1 path and re-dispatches through the router once. The collapsed
+// path never starts with /v1/v1 again, so re-entry cannot recurse. The path
+// the client sent is kept in the request context for SigV4 verification,
+// which must check the signature against what was actually signed.
+func collapseDoubledV1Middleware(router *mux.Router) mux.MiddlewareFunc {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			path := r.URL.Path
+			if path != "/v1/v1" && !strings.HasPrefix(path, "/v1/v1/") {
+				next.ServeHTTP(w, r)
+				return
+			}
+			for path == "/v1/v1" || strings.HasPrefix(path, "/v1/v1/") {
+				path = path[len("/v1"):]
+			}
+			signedPath := r.URL.EscapedPath()
+			if signedPath == "" {
+				signedPath = r.URL.Path
+			}
+			r2 := r.Clone(r.Context())
+			r2.URL.Path = path
+			r2.URL.RawPath = ""
+			r2.RequestURI = r2.URL.EscapedPath()
+			if r.URL.RawQuery != "" {
+				r2.RequestURI += "?" + r.URL.RawQuery
+			}
+			r2 = r2.WithContext(s3_constants.SetOriginalRequestPathInContext(r2.Context(), signedPath))
+			router.ServeHTTP(w, r2)
+		})
+	}
+}
+
 func loggingMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		glog.V(2).Infof("Iceberg REST request: %s %s from %s", r.Method, r.RequestURI, r.RemoteAddr)
@@ -189,15 +260,30 @@ func (w *responseWriter) WriteHeader(code int) {
 
 func (s *Server) Auth(handler http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Try Bearer token authentication first (from OAuth2 flow)
-		if identityName, identity, ok := s.authenticateBearer(r); ok {
-			ctx := r.Context()
-			ctx = s3_constants.SetIdentityNameInContext(ctx, identityName)
-			if identity != nil {
-				ctx = s3_constants.SetIdentityInContext(ctx, identity)
+		// A request carrying a Bearer token is an Iceberg REST client. When
+		// the token is invalid or expired, answer 401 immediately so clients
+		// (Iceberg Java OAuth2Manager, pyiceberg) refresh their token and
+		// retry. Falling through to the S3 authenticator instead would parse
+		// the Authorization header as SigV4, fail with NotImplemented (501),
+		// and clients would retry the dead token forever.
+		// The auth scheme is case-insensitive (RFC 7235), matching
+		// authenticateBearer below.
+		if strings.HasPrefix(strings.ToLower(r.Header.Get("Authorization")), "bearer ") {
+			if identityName, identity, accessKey, secretKey, ok := s.authenticateBearerKey(r); ok {
+				ctx := r.Context()
+				ctx = s3_constants.SetIdentityNameInContext(ctx, identityName)
+				ctx = s3_constants.SetAccessKeyIdInContext(ctx, accessKey)
+				ctx = s3_constants.SetStoredAccessKeyIdInContext(ctx, accessKey, secretKey)
+				if identity != nil {
+					ctx = s3_constants.SetIdentityInContext(ctx, identity)
+				}
+				r = r.WithContext(ctx)
+				handler(w, r)
+				return
 			}
-			r = r.WithContext(ctx)
-			handler(w, r)
+			// RFC 6750 / Iceberg REST spec: 401 is the refresh signal.
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			writeError(w, http.StatusUnauthorized, "NotAuthorizedException", "Bearer token is invalid or expired")
 			return
 		}
 
@@ -206,27 +292,25 @@ func (s *Server) Auth(handler http.HandlerFunc) http.HandlerFunc {
 			return
 		}
 
+		// The verifier records the key of the credential that matched into
+		// this holder; the vended credentials name it.
+		r = s3_constants.EnsureIdentityHolder(r)
 		identityName, identity, errCode := s.authenticator.AuthenticateRequest(r)
 		if errCode != s3err.ErrNone {
-			// If authentication failed but DefaultAllow is enabled, proceed without identity
-			if s.authenticator.DefaultAllow() {
-				glog.V(2).Infof("Iceberg: AuthenticateRequest failed (%v), but DefaultAllow is true, proceeding", errCode)
-			} else {
-				apiErr := s3err.GetAPIError(errCode)
-				errorType := "RESTException"
-				switch apiErr.HTTPStatusCode {
-				case http.StatusForbidden:
-					errorType = "ForbiddenException"
-				case http.StatusUnauthorized:
-					errorType = "NotAuthorizedException"
-				case http.StatusBadRequest:
-					errorType = "BadRequestException"
-				case http.StatusInternalServerError:
-					errorType = "InternalServerError"
-				}
-				writeError(w, apiErr.HTTPStatusCode, errorType, apiErr.Description)
-				return
+			apiErr := s3err.GetAPIError(errCode)
+			errorType := "RESTException"
+			switch apiErr.HTTPStatusCode {
+			case http.StatusForbidden:
+				errorType = "ForbiddenException"
+			case http.StatusUnauthorized:
+				errorType = "NotAuthorizedException"
+			case http.StatusBadRequest:
+				errorType = "BadRequestException"
+			case http.StatusInternalServerError:
+				errorType = "InternalServerError"
 			}
+			writeError(w, apiErr.HTTPStatusCode, errorType, apiErr.Description)
+			return
 		}
 
 		if identityName != "" || identity != nil {
diff --git a/weed/s3api/iceberg/server_access_key_test.go b/weed/s3api/iceberg/server_access_key_test.go
new file mode 100644
index 0000000000..80ef9923b5
--- /dev/null
+++ b/weed/s3api/iceberg/server_access_key_test.go
@@ -0,0 +1,97 @@
+package iceberg
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// keyedS3Authenticator accepts every SigV4 request as one identity and records
+// the key that verified into the request's holder, as S3ApiServer's verifiers do.
+type keyedS3Authenticator struct {
+	mockS3Authenticator
+	accessKey string
+}
+
+func (k *keyedS3Authenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) {
+	s3_constants.RecordAccessKeyId(r.Context(), k.accessKey)
+	return "shared-identity", "identity-object", s3err.ErrNone
+}
+
+// A catalog token is minted from one access key; the request it authenticates
+// carries that key, so the credentials it vends can name it.
+func TestAuthBearerRecordsTheTokensAccessKey(t *testing.T) {
+	s, _ := newAuthTestServer()
+	now := time.Now()
+	token := mintTestToken(t, "AKID123", "secret456", now, now.Add(time.Hour))
+
+	var gotKey, gotName string
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		gotKey = s3_constants.GetAccessKeyIdFromContext(r)
+		gotName = s3_constants.GetIdentityNameFromContext(r)
+		w.WriteHeader(http.StatusOK)
+	})
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("valid Bearer: status = %d, want 200", rec.Code)
+	}
+	if gotName != "testuser" {
+		t.Errorf("identity = %q, want testuser", gotName)
+	}
+	if gotKey != "AKID123" {
+		t.Errorf("access key in context = %q, want AKID123", gotKey)
+	}
+}
+
+// A SigV4-signed catalog request carries the key its authenticator verified.
+func TestAuthSigV4RecordsTheAuthenticatorsAccessKey(t *testing.T) {
+	s := newTestServerWithOAuth()
+	s.authenticator = &keyedS3Authenticator{accessKey: "AKIDSIGV4"}
+
+	var gotKey string
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		gotKey = s3_constants.GetAccessKeyIdFromContext(r)
+		w.WriteHeader(http.StatusOK)
+	})
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	req.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential=AKIDSIGV4/20261016/us-east-1/s3/aws4_request, SignedHeaders=host, Signature=00")
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if gotKey != "AKIDSIGV4" {
+		t.Errorf("access key in context = %q, want AKIDSIGV4", gotKey)
+	}
+}
+
+// An authenticator that records no key leaves the context without one.
+func TestAuthSigV4WithoutKeyAuthenticatorRecordsNoKey(t *testing.T) {
+	s := newTestServerWithOAuth()
+	s.authenticator = &mockS3Authenticator{}
+
+	gotKey := "unset"
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		gotKey = s3_constants.GetAccessKeyIdFromContext(r)
+		w.WriteHeader(http.StatusOK)
+	})
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	if gotKey != "" {
+		t.Errorf("access key in context = %q, want none", gotKey)
+	}
+}
diff --git a/weed/s3api/iceberg/server_auth_test.go b/weed/s3api/iceberg/server_auth_test.go
new file mode 100644
index 0000000000..fcf93067ea
--- /dev/null
+++ b/weed/s3api/iceberg/server_auth_test.go
@@ -0,0 +1,231 @@
+package iceberg
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+type mockS3Authenticator struct {
+	called  bool
+	errCode s3err.ErrorCode
+}
+
+func (m *mockS3Authenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) {
+	m.called = true
+	if m.errCode != s3err.ErrNone {
+		return "", nil, m.errCode
+	}
+	return "s3user", nil, s3err.ErrNone
+}
+
+func (m *mockS3Authenticator) DefaultAllow() bool { return false }
+
+func mintTestToken(t *testing.T, accessKey, secret string, issuedAt, expiresAt time.Time) string {
+	t.Helper()
+	key := deriveSigningKey(accessKey, secret)
+	claims := IcebergClaims{
+		IdentityName: "testuser",
+		AccessKey:    accessKey,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(issuedAt),
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			Issuer:    "seaweedfs-iceberg",
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString(key)
+	if err != nil {
+		t.Fatalf("sign token: %v", err)
+	}
+	return signed
+}
+
+func newAuthTestServer() (*Server, *mockS3Authenticator) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrNotImplemented}
+	s.authenticator = auth
+	return s, auth
+}
+
+// TestAuthExpiredBearerReturns401: an expired Bearer token must get 401
+// (the refresh signal for Iceberg clients), never fall through to the S3
+// authenticator and surface as 501 NotImplemented.
+func TestAuthExpiredBearerReturns401(t *testing.T) {
+	s, auth := newAuthTestServer()
+	now := time.Now()
+	expired := mintTestToken(t, "AKID123", "secret456", now.Add(-2*time.Hour), now.Add(-1*time.Hour))
+
+	var handlerCalled bool
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled = true
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	req.Header.Set("Authorization", "Bearer "+expired)
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expired Bearer: status = %d, want 401 (previously fell through to 501)", rec.Code)
+	}
+	if auth.called {
+		t.Fatalf("expired Bearer must not fall through to the S3 authenticator")
+	}
+	if handlerCalled {
+		t.Fatalf("handler must not run for an expired token")
+	}
+	if wa := rec.Header().Get("WWW-Authenticate"); wa != "Bearer" {
+		t.Fatalf("WWW-Authenticate = %q, want Bearer", wa)
+	}
+	if !strings.Contains(rec.Body.String(), "NotAuthorizedException") {
+		t.Fatalf("error type must be NotAuthorizedException, got: %s", rec.Body.String())
+	}
+}
+
+// TestAuthCaseInsensitiveBearerScheme: RFC 7235 auth schemes are
+// case-insensitive; a lowercase or mixed-case "bearer" must take the same
+// Bearer path (401 refresh signal) instead of falling through to S3 auth.
+func TestAuthCaseInsensitiveBearerScheme(t *testing.T) {
+	s, auth := newAuthTestServer()
+	now := time.Now()
+	expired := mintTestToken(t, "AKID123", "secret456", now.Add(-2*time.Hour), now.Add(-1*time.Hour))
+
+	for _, scheme := range []string{"bearer", "BEARER", "BeArEr"} {
+		var handlerCalled bool
+		handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+			handlerCalled = true
+			w.WriteHeader(http.StatusOK)
+		})
+
+		req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+		req.Header.Set("Authorization", scheme+" "+expired)
+		rec := httptest.NewRecorder()
+		handler(rec, req)
+
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("scheme %q: status = %d, want 401", scheme, rec.Code)
+		}
+		if auth.called {
+			t.Fatalf("scheme %q: must not fall through to the S3 authenticator", scheme)
+		}
+		if handlerCalled {
+			t.Fatalf("scheme %q: handler must not run for an expired token", scheme)
+		}
+		if wa := rec.Header().Get("WWW-Authenticate"); wa != "Bearer" {
+			t.Fatalf("scheme %q: WWW-Authenticate = %q, want Bearer", scheme, wa)
+		}
+	}
+}
+
+// TestAuthGarbageBearerReturns401 pins the same contract for malformed tokens.
+func TestAuthGarbageBearerReturns401(t *testing.T) {
+	s, auth := newAuthTestServer()
+
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	req.Header.Set("Authorization", "Bearer not-a-jwt")
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("garbage Bearer: status = %d, want 401", rec.Code)
+	}
+	if auth.called {
+		t.Fatalf("garbage Bearer must not fall through to the S3 authenticator")
+	}
+}
+
+// TestAuthFreshBearerRunsHandler verifies the happy path still authenticates
+// and hands the identity to the handler.
+func TestAuthFreshBearerRunsHandler(t *testing.T) {
+	s, auth := newAuthTestServer()
+	now := time.Now()
+	fresh := mintTestToken(t, "AKID123", "secret456", now, now.Add(time.Hour))
+
+	var gotIdentity string
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		gotIdentity = s3_constants.GetIdentityNameFromContext(r)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	req.Header.Set("Authorization", "Bearer "+fresh)
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("fresh Bearer: status = %d, want 200", rec.Code)
+	}
+	if auth.called {
+		t.Fatalf("fresh Bearer should not need the S3 authenticator")
+	}
+	if gotIdentity != "testuser" {
+		t.Fatalf("identity in context = %q, want testuser", gotIdentity)
+	}
+}
+
+// TestAuthNoBearerStillUsesS3Authenticator keeps the non-Bearer path intact:
+// SigV4 requests keep flowing through the S3 authenticator as before.
+func TestAuthNoBearerStillUsesS3Authenticator(t *testing.T) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrNone}
+	s.authenticator = auth
+
+	var handlerCalled bool
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled = true
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if !auth.called {
+		t.Fatalf("request without Bearer header must use the S3 authenticator")
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200 after successful S3 auth", rec.Code)
+	}
+	if !handlerCalled {
+		t.Fatalf("handler must run after S3 auth succeeds")
+	}
+}
+
+// TestAuthNonBearerAuthorizationHeaderUsesS3Authenticator pins that other
+// Authorization schemes (e.g. SigV4) never take the Bearer fast path.
+func TestAuthNonBearerAuthorizationHeaderUsesS3Authenticator(t *testing.T) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrNone}
+	s.authenticator = auth
+
+	var handlerCalled bool
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled = true
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespaces", nil)
+	req.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential=AKID123/...")
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if !auth.called {
+		t.Fatalf("SigV4 Authorization header must use the S3 authenticator")
+	}
+	if !handlerCalled {
+		t.Fatalf("handler must run after S3 auth succeeds")
+	}
+}
diff --git a/weed/s3api/iceberg/server_routes_test.go b/weed/s3api/iceberg/server_routes_test.go
new file mode 100644
index 0000000000..1d01d702ac
--- /dev/null
+++ b/weed/s3api/iceberg/server_routes_test.go
@@ -0,0 +1,107 @@
+package iceberg
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+// The catch-all answers anything unrouted, so a path that reaches it is a
+// route that does not exist.
+func TestRegisteredRoutesReachAHandler(t *testing.T) {
+	router := mux.NewRouter().SkipClean(true)
+	(&Server{}).RegisterRoutes(router)
+
+	cases := []struct {
+		method string
+		target string
+	}{
+		{http.MethodPost, "/v1/views/rename"},
+		{http.MethodPost, "/v1/warehouse/views/rename"},
+		{http.MethodPost, "/v1/namespaces/ns/tables/t/metrics"},
+		{http.MethodPost, "/v1/warehouse/namespaces/ns/tables/t/metrics"},
+	}
+
+	for _, tc := range cases {
+		var match mux.RouteMatch
+		if !router.Match(httptest.NewRequest(tc.method, tc.target, nil), &match) {
+			t.Errorf("%s %s matched no route", tc.method, tc.target)
+			continue
+		}
+		if match.MatchErr != nil {
+			t.Errorf("%s %s: %v", tc.method, tc.target, match.MatchErr)
+			continue
+		}
+		if tmpl, err := match.Route.GetPathTemplate(); err == nil && tmpl == "/" {
+			t.Errorf("%s %s fell through to the catch-all", tc.method, tc.target)
+		}
+	}
+}
+
+// A catalog URI configured with a trailing /v1 (a common iceberg-java client
+// mistake) produces /v1/v1/... requests; the router collapses the repeated
+// prefix instead of answering "Path not found" or resolving "v1" as a table
+// bucket name.
+func TestDoubledV1PrefixIsCollapsed(t *testing.T) {
+	router := mux.NewRouter().SkipClean(true)
+	(&Server{}).RegisterRoutes(router)
+
+	for _, target := range []string{
+		"/v1/v1/config?warehouse=bucket",
+		// Degenerate repetition collapses in a single pass.
+		"/v1/v1/v1/config",
+	} {
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, target, nil))
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s: got %d, want 200: %s", target, rec.Code, rec.Body.String())
+		}
+	}
+
+	// /v1/v1/namespaces also matches the {prefix} routes ("v1" can never be a
+	// table bucket name); it must still collapse to the unprefixed endpoint,
+	// which requires auth here rather than answering 404.
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/v1/v1/namespaces", nil))
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("/v1/v1/namespaces: got %d, want 401: %s", rec.Code, rec.Body.String())
+	}
+
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/v1/nonexistent/path", nil))
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("/v1/nonexistent/path: got %d, want 404", rec.Code)
+	}
+}
+
+// The rewrite must preserve the client-sent path for SigV4 verification: a
+// signed request is checked against the URI it was signed with, not the
+// collapsed path it was routed under.
+func TestDoubledV1CollapsePreservesOriginalPath(t *testing.T) {
+	router := mux.NewRouter().SkipClean(true)
+	var gotPath, gotSignedPath, gotQuery string
+	router.HandleFunc("/v1/probe", func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotQuery = r.URL.RawQuery
+		gotSignedPath = s3_constants.GetOriginalRequestPathFromContext(r)
+	}).Methods(http.MethodGet)
+	router.Use(collapseDoubledV1Middleware(router))
+	router.PathPrefix("/").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	})
+
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/v1/v1/probe?warehouse=bucket", nil))
+	if gotPath != "/v1/probe" {
+		t.Fatalf("routed path: got %q, want /v1/probe", gotPath)
+	}
+	if gotQuery != "warehouse=bucket" {
+		t.Fatalf("query: got %q, want warehouse=bucket", gotQuery)
+	}
+	if gotSignedPath != "/v1/v1/probe" {
+		t.Fatalf("original signed path: got %q, want /v1/v1/probe", gotSignedPath)
+	}
+}
diff --git a/weed/s3api/iceberg/types.go b/weed/s3api/iceberg/types.go
index 43f37913fd..e66c209e44 100644
--- a/weed/s3api/iceberg/types.go
+++ b/weed/s3api/iceberg/types.go
@@ -101,16 +101,25 @@ type RegisterTableRequest struct {
 }
 
 type LoadTableResult struct {
-	MetadataLocation string             `json:"metadata-location,omitempty"`
-	Metadata         table.Metadata     `json:"metadata"`
-	Config           iceberg.Properties `json:"config"`
+	MetadataLocation   string              `json:"metadata-location,omitempty"`
+	Metadata           table.Metadata      `json:"metadata"`
+	Config             iceberg.Properties  `json:"config"`
+	StorageCredentials []StorageCredential `json:"storage-credentials,omitempty"`
+}
+
+// StorageCredential is one set of credentials scoped to a location prefix, as
+// returned to clients that asked for credential vending.
+type StorageCredential struct {
+	Prefix string             `json:"prefix"`
+	Config iceberg.Properties `json:"config"`
 }
 
 // loadTableResultAlias is used for custom JSON unmarshaling.
 type loadTableResultAlias struct {
-	MetadataLocation string             `json:"metadata-location,omitempty"`
-	RawMetadata      json.RawMessage    `json:"metadata"`
-	Config           iceberg.Properties `json:"config,omitempty"`
+	MetadataLocation   string              `json:"metadata-location,omitempty"`
+	RawMetadata        json.RawMessage     `json:"metadata"`
+	Config             iceberg.Properties  `json:"config,omitempty"`
+	StorageCredentials []StorageCredential `json:"storage-credentials,omitempty"`
 }
 
 // MarshalJSON serializes LoadTableResult while backfilling spec-required
@@ -126,13 +135,15 @@ func (r LoadTableResult) MarshalJSON() ([]byte, error) {
 	metaBytes = ensureMetadataSpecCompliance(metaBytes)
 
 	return json.Marshal(struct {
-		MetadataLocation string             `json:"metadata-location,omitempty"`
-		Metadata         json.RawMessage    `json:"metadata"`
-		Config           iceberg.Properties `json:"config"`
+		MetadataLocation   string              `json:"metadata-location,omitempty"`
+		Metadata           json.RawMessage     `json:"metadata"`
+		Config             iceberg.Properties  `json:"config"`
+		StorageCredentials []StorageCredential `json:"storage-credentials,omitempty"`
 	}{
-		MetadataLocation: r.MetadataLocation,
-		Metadata:         metaBytes,
-		Config:           r.Config,
+		MetadataLocation:   r.MetadataLocation,
+		Metadata:           metaBytes,
+		Config:             r.Config,
+		StorageCredentials: r.StorageCredentials,
 	})
 }
 
@@ -146,6 +157,7 @@ func (r *LoadTableResult) UnmarshalJSON(data []byte) error {
 
 	r.MetadataLocation = alias.MetadataLocation
 	r.Config = alias.Config
+	r.StorageCredentials = alias.StorageCredentials
 
 	if len(alias.RawMetadata) > 0 {
 		metadata, err := table.ParseMetadataBytes(alias.RawMetadata)
diff --git a/weed/s3api/iceberg/utils.go b/weed/s3api/iceberg/utils.go
index 84f02c47a5..40bab282be 100644
--- a/weed/s3api/iceberg/utils.go
+++ b/weed/s3api/iceberg/utils.go
@@ -158,7 +158,9 @@ func nameValidationError(err error) bool {
 // errors (400) and must carry the reason -- a variant field without
 // format-version 3 otherwise reads as a bare 500 with "variant is not supported
 // until v3" only in the log. Anything else is a server fault (500).
-func writeManagerError(w http.ResponseWriter, err error) {
+// classifyManagerError maps a storage-layer error to the HTTP status, the
+// Iceberg error type and the message the catalog answers with.
+func classifyManagerError(err error) (int, string, string) {
 	switch {
 	case nameValidationError(err),
 		errors.Is(err, iceberg.ErrInvalidSchema),
@@ -166,20 +168,61 @@ func writeManagerError(w http.ResponseWriter, err error) {
 		errors.Is(err, iceberg.ErrInvalidTypeString),
 		errors.Is(err, iceberg.ErrInvalidTransform),
 		errors.Is(err, iceberg.ErrInvalidArgument):
-		writeError(w, http.StatusBadRequest, "BadRequestException", err.Error())
-		return
+		return http.StatusBadRequest, "BadRequestException", err.Error()
 	}
-	// A missing table bucket means the catalog the client selected does not
-	// exist, not a server fault. The storage-layer message names the resolved
-	// bucket, which for a client that sent no warehouse at all is the default
-	// one it never asked for, so say how to select a real table bucket.
+	// Storage-layer failures are mostly the client's, not the server's. Reporting
+	// a missing namespace or a name conflict as a 500 makes the catalog look
+	// broken and gives the client nothing to act on.
 	var tableErr *s3tables.S3TablesError
-	if errors.As(err, &tableErr) && tableErr.Type == s3tables.ErrCodeNoSuchBucket {
-		writeError(w, http.StatusNotFound, "NoSuchNamespaceException",
-			fmt.Sprintf("%s: each table bucket is a separate catalog, select one with warehouse=s3://<table-bucket>/ or /v1/<table-bucket>/", tableErr.Message))
+	if errors.As(err, &tableErr) {
+		switch tableErr.Type {
+		case s3tables.ErrCodeNoSuchBucket:
+			// The storage-layer message names the resolved bucket, which for a
+			// client that sent no warehouse at all is the default one it never
+			// asked for, so say how to select a real table bucket.
+			return http.StatusNotFound, "NoSuchNamespaceException",
+				fmt.Sprintf("%s: each table bucket is a separate catalog, select one with warehouse=s3://<table-bucket>/ or /v1/<table-bucket>/", tableErr.Message)
+		case s3tables.ErrCodeNoSuchNamespace:
+			return http.StatusNotFound, "NoSuchNamespaceException", tableErr.Message
+		case s3tables.ErrCodeNoSuchTable:
+			return http.StatusNotFound, "NoSuchTableException", tableErr.Message
+		case s3tables.ErrCodeNoSuchView:
+			return http.StatusNotFound, "NoSuchViewException", tableErr.Message
+		case s3tables.ErrCodeNamespaceAlreadyExists, s3tables.ErrCodeBucketAlreadyExists,
+			s3tables.ErrCodeTableAlreadyExists, s3tables.ErrCodeViewAlreadyExists:
+			return http.StatusConflict, "AlreadyExistsException", tableErr.Message
+		case s3tables.ErrCodeNamespaceNotEmpty, s3tables.ErrCodeBucketNotEmpty:
+			return http.StatusConflict, "AlreadyExistsException", tableErr.Message
+		case s3tables.ErrCodeConflict:
+			return http.StatusConflict, "CommitFailedException", tableErr.Message
+		case s3tables.ErrCodeAccessDenied:
+			return http.StatusForbidden, "ForbiddenException", tableErr.Message
+		case s3tables.ErrCodeInvalidRequest, s3tables.ErrCodeInvalidIcebergLayout:
+			return http.StatusBadRequest, "BadRequestException", tableErr.Message
+		}
+	}
+	return http.StatusInternalServerError, "InternalServerError", err.Error()
+}
+
+func writeManagerError(w http.ResponseWriter, err error) {
+	status, typ, msg := classifyManagerError(err)
+	writeError(w, status, typ, msg)
+}
+
+// A storage-layer error the catalog answers with a 4xx (access denied, not
+// found, already exists, not empty, a conflict) is the API refusing a request
+// as intended, not a server fault; it is logged at V(1). A 5xx stays at ERROR.
+var (
+	logManagerRefusal = func(format string, args ...interface{}) { glog.V(1).Infof(format, args...) }
+	logManagerFault   = glog.Errorf
+)
+
+func logManagerError(op string, err error) {
+	if status, _, _ := classifyManagerError(err); status >= 400 && status < 500 {
+		logManagerRefusal("Iceberg: %s refused (%d): %v", op, status, err)
 		return
 	}
-	writeError(w, http.StatusInternalServerError, "InternalServerError", err.Error())
+	logManagerFault("Iceberg: %s error: %v", op, err)
 }
 
 // resolveWarehouseBucket maps a client-supplied warehouse value to a table
@@ -236,6 +279,14 @@ func getBucketFromPrefix(r *http.Request) string {
 	if bucket := os.Getenv("S3TABLES_DEFAULT_BUCKET"); bucket != "" {
 		return bucket
 	}
+	// Some writers commit to the unprefixed path even though their reads
+	// honor the /v1/config prefix; the deployment's first table bucket is
+	// where those commits belong.
+	for _, name := range strings.Split(os.Getenv("S3_TABLE_BUCKET"), ",") {
+		if name = strings.TrimSpace(name); name != "" {
+			return name
+		}
+	}
 	// Default bucket if no prefix - use "warehouse" for Iceberg
 	return "warehouse"
 }
diff --git a/weed/s3api/kms_azure.go b/weed/s3api/kms_azure.go
new file mode 100644
index 0000000000..ab5f731ea4
--- /dev/null
+++ b/weed/s3api/kms_azure.go
@@ -0,0 +1,8 @@
+//go:build azurekms
+
+package s3api
+
+// Import the Azure KMS provider so its init() registers it with
+// weed/kms. The provider is gated behind the `azurekms` build tag so that
+// default builds do not pull in the Azure SDK.
+import _ "github.com/seaweedfs/seaweedfs/weed/kms/azure"
diff --git a/weed/s3api/lance/errors.go b/weed/s3api/lance/errors.go
new file mode 100644
index 0000000000..f40062869b
--- /dev/null
+++ b/weed/s3api/lance/errors.go
@@ -0,0 +1,100 @@
+package lance
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// Lance Namespace error codes. The spec numbers them, so a client switches on
+// the code rather than parsing the message.
+const (
+	codeUnsupported            = 0
+	codeNamespaceNotFound      = 1
+	codeNamespaceAlreadyExists = 2
+	codeNamespaceNotEmpty      = 3
+	codeTableNotFound          = 4
+	codeTableAlreadyExists     = 5
+	codeTableVersionNotFound   = 11
+	codeInvalidInput           = 13
+	codeConcurrentModification = 14
+	codePermissionDenied       = 15
+	codeUnauthenticated        = 16
+	codeInternal               = 18
+)
+
+type errorResponse struct {
+	Error    string `json:"error,omitempty"`
+	Code     int    `json:"code"`
+	Detail   string `json:"detail,omitempty"`
+	Instance string `json:"instance,omitempty"`
+}
+
+func writeJSON(w http.ResponseWriter, status int, body interface{}) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	if body == nil {
+		return
+	}
+	if err := json.NewEncoder(w).Encode(body); err != nil {
+		glog.Warningf("lance: failed to encode response: %v", err)
+	}
+}
+
+func writeError(w http.ResponseWriter, r *http.Request, status, code int, message string) {
+	instance := ""
+	if r != nil {
+		instance = r.URL.Path
+	}
+	writeJSON(w, status, errorResponse{Error: message, Code: code, Instance: instance})
+}
+
+// writeStorageError translates an S3 Tables storage error into the Lance error
+// model. A table bucket is the first namespace level here, so a missing bucket
+// is a missing namespace rather than a missing catalog.
+func writeStorageError(w http.ResponseWriter, r *http.Request, err error) {
+	var storageErr *s3tables.S3TablesError
+	if !errors.As(err, &storageErr) {
+		writeError(w, r, http.StatusInternalServerError, codeInternal, err.Error())
+		return
+	}
+
+	status, code := http.StatusInternalServerError, codeInternal
+	switch storageErr.Type {
+	case s3tables.ErrCodeNoSuchBucket, s3tables.ErrCodeNoSuchNamespace:
+		status, code = http.StatusNotFound, codeNamespaceNotFound
+	case s3tables.ErrCodeNoSuchTable, s3tables.ErrCodeNoSuchView:
+		status, code = http.StatusNotFound, codeTableNotFound
+	case s3tables.ErrCodeBucketAlreadyExists, s3tables.ErrCodeNamespaceAlreadyExists:
+		status, code = http.StatusConflict, codeNamespaceAlreadyExists
+	case s3tables.ErrCodeTableAlreadyExists, s3tables.ErrCodeViewAlreadyExists:
+		status, code = http.StatusConflict, codeTableAlreadyExists
+	case s3tables.ErrCodeBucketNotEmpty, s3tables.ErrCodeNamespaceNotEmpty:
+		status, code = http.StatusConflict, codeNamespaceNotEmpty
+	case s3tables.ErrCodeConflict:
+		status, code = http.StatusConflict, codeConcurrentModification
+	case s3tables.ErrCodeAccessDenied:
+		status, code = http.StatusForbidden, codePermissionDenied
+	case s3tables.ErrCodeInvalidRequest, s3tables.ErrCodeInvalidIcebergLayout:
+		status, code = http.StatusBadRequest, codeInvalidInput
+	}
+	writeError(w, r, status, code, storageErr.Message)
+}
+
+// isNotFound reports whether a storage error means the object is absent, so
+// exists-style handlers can answer without a second lookup.
+func isNotFound(err error) bool {
+	var storageErr *s3tables.S3TablesError
+	if !errors.As(err, &storageErr) {
+		return false
+	}
+	switch storageErr.Type {
+	case s3tables.ErrCodeNoSuchBucket, s3tables.ErrCodeNoSuchNamespace,
+		s3tables.ErrCodeNoSuchTable, s3tables.ErrCodeNoSuchView:
+		return true
+	}
+	return false
+}
diff --git a/weed/s3api/lance/handlers_namespace.go b/weed/s3api/lance/handlers_namespace.go
new file mode 100644
index 0000000000..9d3a51b2dc
--- /dev/null
+++ b/weed/s3api/lance/handlers_namespace.go
@@ -0,0 +1,341 @@
+package lance
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// handleCreateNamespace creates a table bucket for a one-part identifier and a
+// namespace inside one for anything deeper. The root cannot be created.
+func (s *Server) handleCreateNamespace(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+
+	var req CreateNamespaceRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	if len(id) == 0 {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, "the root namespace always exists and cannot be created")
+		return
+	}
+
+	mode := normalizeMode(req.Mode, modeCreate)
+	switch mode {
+	case modeCreate, modeExistOk, modeOverwrite:
+	default:
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, "mode must be Create, ExistOk or Overwrite")
+		return
+	}
+
+	bucket, ns := id.namespace()
+	exists, err := s.namespaceExists(r, bucket, ns)
+	if err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	if exists {
+		switch mode {
+		case modeExistOk:
+			writeJSON(w, http.StatusOK, CreateNamespaceResponse{Properties: req.Properties})
+			return
+		case modeCreate:
+			writeError(w, r, http.StatusConflict, codeNamespaceAlreadyExists, "namespace already exists")
+			return
+		}
+		// Overwrite replaces the namespace with an empty one, so the drop has to
+		// succeed first. A namespace holding tables refuses, which is the point.
+		if err := s.dropNamespace(r, bucket, ns); err != nil {
+			writeStorageError(w, r, err)
+			return
+		}
+	}
+
+	if err := s.createNamespace(r, bucket, ns, req.Properties); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, CreateNamespaceResponse{Properties: normalizeProperties(req.Properties)})
+}
+
+// handleListNamespaces lists the children of a namespace: table buckets at the
+// root, and the next path component below that.
+func (s *Server) handleListNamespaces(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	bucket, ns := id.namespace()
+
+	if bucket == "" {
+		var resp s3tables.ListTableBucketsResponse
+		req := &s3tables.ListTableBucketsRequest{
+			ContinuationToken: r.URL.Query().Get("page_token"),
+			MaxBuckets:        pageSize(r),
+		}
+		if err := s.execute(r, "ListTableBuckets", req, &resp); err != nil {
+			writeStorageError(w, r, err)
+			return
+		}
+		names := make([]string, 0, len(resp.TableBuckets))
+		for _, b := range resp.TableBuckets {
+			names = append(names, b.Name)
+		}
+		writeJSON(w, http.StatusOK, ListNamespacesResponse{Namespaces: names, PageToken: resp.ContinuationToken})
+		return
+	}
+
+	var resp s3tables.ListNamespacesResponse
+	req := &s3tables.ListNamespacesRequest{
+		TableBucketARN:    bucketARN(bucket),
+		ContinuationToken: r.URL.Query().Get("page_token"),
+		MaxNamespaces:     pageSize(r),
+	}
+	if len(ns) > 0 {
+		req.Prefix = strings.Join(ns, ".") + "."
+	}
+	if err := s.execute(r, "ListNamespaces", req, &resp); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+
+	// Storage namespaces are full paths; the spec wants the child name relative
+	// to the parent, so take the next component and drop repeats.
+	children := make([]string, 0, len(resp.Namespaces))
+	seen := make(map[string]struct{}, len(resp.Namespaces))
+	for _, summary := range resp.Namespaces {
+		if len(summary.Namespace) <= len(ns) {
+			continue
+		}
+		child := summary.Namespace[len(ns)]
+		if _, done := seen[child]; done {
+			continue
+		}
+		seen[child] = struct{}{}
+		children = append(children, child)
+	}
+	writeJSON(w, http.StatusOK, ListNamespacesResponse{Namespaces: children, PageToken: resp.ContinuationToken})
+}
+
+// handleDescribeNamespace returns a namespace's properties.
+func (s *Server) handleDescribeNamespace(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req DescribeNamespaceRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+
+	bucket, ns := id.namespace()
+	if bucket == "" {
+		writeJSON(w, http.StatusOK, DescribeNamespaceResponse{Properties: map[string]string{}})
+		return
+	}
+	if len(ns) == 0 {
+		var resp s3tables.GetTableBucketResponse
+		if err := s.execute(r, "GetTableBucket", &s3tables.GetTableBucketRequest{TableBucketARN: bucketARN(bucket)}, &resp); err != nil {
+			writeStorageError(w, r, err)
+			return
+		}
+		writeJSON(w, http.StatusOK, DescribeNamespaceResponse{Properties: map[string]string{}})
+		return
+	}
+
+	var resp s3tables.GetNamespaceResponse
+	req2 := &s3tables.GetNamespaceRequest{TableBucketARN: bucketARN(bucket), Namespace: ns}
+	if err := s.execute(r, "GetNamespace", req2, &resp); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, DescribeNamespaceResponse{Properties: normalizeProperties(resp.Properties)})
+}
+
+// handleDropNamespace removes a namespace or table bucket.
+func (s *Server) handleDropNamespace(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req DropNamespaceRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	if len(id) == 0 {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, "the root namespace cannot be dropped")
+		return
+	}
+
+	if normalizeMode(req.Behavior, behaviorRestrict) == behaviorCascade {
+		writeError(w, r, http.StatusNotImplemented, codeUnsupported,
+			"cascade drop is not supported; drop the tables in the namespace first")
+		return
+	}
+
+	bucket, ns := id.namespace()
+	err := s.dropNamespace(r, bucket, ns)
+	if err == nil {
+		writeJSON(w, http.StatusOK, DropNamespaceResponse{})
+		return
+	}
+	if isNotFound(err) {
+		// Skip reports success on a missing namespace; Fail reports 400 rather
+		// than 404, which is what the spec asks for on this operation alone.
+		if normalizeMode(req.Mode, modeFail) == modeSkip {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		writeError(w, r, http.StatusBadRequest, codeNamespaceNotFound, "namespace does not exist")
+		return
+	}
+	writeStorageError(w, r, err)
+}
+
+// handleNamespaceExists answers with the status code and no body.
+func (s *Server) handleNamespaceExists(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req NamespaceExistsRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+
+	bucket, ns := id.namespace()
+	if bucket == "" {
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+	exists, err := s.namespaceExists(r, bucket, ns)
+	if err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	if !exists {
+		writeError(w, r, http.StatusNotFound, codeNamespaceNotFound, "namespace does not exist")
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+}
+
+func (s *Server) namespaceExists(r *http.Request, bucket string, ns []string) (bool, error) {
+	var err error
+	if len(ns) == 0 {
+		var resp s3tables.GetTableBucketResponse
+		err = s.execute(r, "GetTableBucket", &s3tables.GetTableBucketRequest{TableBucketARN: bucketARN(bucket)}, &resp)
+	} else {
+		var resp s3tables.GetNamespaceResponse
+		err = s.execute(r, "GetNamespace", &s3tables.GetNamespaceRequest{TableBucketARN: bucketARN(bucket), Namespace: ns}, &resp)
+	}
+	if err == nil {
+		return true, nil
+	}
+	if isNotFound(err) {
+		return false, nil
+	}
+	return false, err
+}
+
+func (s *Server) createNamespace(r *http.Request, bucket string, ns []string, properties map[string]string) error {
+	if len(ns) == 0 {
+		// A bucket made through this surface holds Lance tables. Saying so is
+		// what stops it from being described to a client as an Iceberg catalog.
+		var resp s3tables.CreateTableBucketResponse
+		return s.execute(r, "CreateTableBucket", &s3tables.CreateTableBucketRequest{
+			Name:   bucket,
+			Format: s3tables.FormatLance,
+		}, &resp)
+	}
+	// A table bucket is a tenant resource with its own policy and lifecycle, so
+	// it is created deliberately, never as a side effect of naming a namespace
+	// inside it.
+	// The immediate parent has to exist too. Storage keeps a namespace's parts
+	// flattened, so creating "a.b" without "a" leaves an intermediate that
+	// listing derives from the name and describe then denies exists. The spec
+	// asks for NamespaceNotFound here, which also keeps the two consistent.
+	if len(ns) > 1 {
+		parent := ns[:len(ns)-1]
+		if exists, err := s.namespaceExists(r, bucket, parent); err != nil {
+			return err
+		} else if !exists {
+			return &s3tables.S3TablesError{
+				Type:    s3tables.ErrCodeNoSuchNamespace,
+				Message: "parent namespace " + strings.Join(parent, ".") + " does not exist",
+			}
+		}
+	}
+	if exists, err := s.namespaceExists(r, bucket, nil); err != nil {
+		return err
+	} else if !exists {
+		return &s3tables.S3TablesError{
+			Type:    s3tables.ErrCodeNoSuchBucket,
+			Message: "table bucket " + bucket + " does not exist",
+		}
+	}
+	var resp s3tables.CreateNamespaceResponse
+	req := &s3tables.CreateNamespaceRequest{
+		TableBucketARN: bucketARN(bucket),
+		Namespace:      ns,
+		Properties:     properties,
+	}
+	return s.execute(r, "CreateNamespace", req, &resp)
+}
+
+func (s *Server) dropNamespace(r *http.Request, bucket string, ns []string) error {
+	if len(ns) == 0 {
+		return s.execute(r, "DeleteTableBucket", &s3tables.DeleteTableBucketRequest{TableBucketARN: bucketARN(bucket)}, nil)
+	}
+	req := &s3tables.DeleteNamespaceRequest{TableBucketARN: bucketARN(bucket), Namespace: ns}
+	return s.execute(r, "DeleteNamespace", req, nil)
+}
+
+// normalizeMode folds a spec mode or behavior value, which is case-insensitive
+// and spelled either PascalCase or snake_case, onto its lowercase form.
+func normalizeMode(value, fallback string) string {
+	value = strings.ToLower(strings.ReplaceAll(strings.TrimSpace(value), "_", ""))
+	if value == "" {
+		return fallback
+	}
+	return value
+}
+
+func normalizeProperties(properties map[string]string) map[string]string {
+	if properties == nil {
+		return map[string]string{}
+	}
+	return properties
+}
diff --git a/weed/s3api/lance/handlers_oauth.go b/weed/s3api/lance/handlers_oauth.go
new file mode 100644
index 0000000000..d348a5c200
--- /dev/null
+++ b/weed/s3api/lance/handlers_oauth.go
@@ -0,0 +1,254 @@
+package lance
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"fmt"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// OAuthTokenResponse is the response for POST /oauth/token.
+type OAuthTokenResponse struct {
+	AccessToken string `json:"access_token"`
+	TokenType   string `json:"token_type"`
+	ExpiresIn   int    `json:"expires_in"`
+	Scope       string `json:"scope,omitempty"`
+}
+
+// OAuthErrorResponse is the error response for the OAuth endpoint.
+type OAuthErrorResponse struct {
+	Error       string `json:"error"`
+	Description string `json:"error_description,omitempty"`
+}
+
+// LanceClaims are JWT claims for Lance catalog OAuth tokens.
+type LanceClaims struct {
+	IdentityName string `json:"identity_name"`
+	AccessKey    string `json:"access_key"`
+	jwt.RegisteredClaims
+}
+
+const defaultOauthTokenExpiry = 3600
+
+// maxOauthTokenExpiry bounds the configured TTL so seconds-to-Duration
+// conversions cannot overflow into already-expired tokens.
+const maxOauthTokenExpiry = 365 * 24 * 3600
+
+const grantTypeClientCredentials = "client_credentials"
+
+// oauthExpirySeconds returns the OAuth token TTL. Lance clients hold a static
+// Authorization header and cannot refresh on 401, so deployments can raise
+// this to survive beyond the default hour.
+func oauthExpirySeconds() int {
+	if v := os.Getenv("LANCE_OAUTH_TOKEN_EXPIRY"); v != "" {
+		if n, err := strconv.ParseInt(v, 10, 64); err == nil && n > 0 {
+			if n > maxOauthTokenExpiry {
+				return maxOauthTokenExpiry
+			}
+			return int(n)
+		}
+	}
+	return defaultOauthTokenExpiry
+}
+
+// handleOAuthTokens implements the OAuth2 client_credentials flow.
+// POST /oauth/token
+func (s *Server) handleOAuthTokens(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxRequestBody)
+	if err := r.ParseForm(); err != nil {
+		writeOAuthError(w, http.StatusBadRequest, "invalid_request", "Could not parse form body")
+		return
+	}
+
+	// Reject credentials in query string to prevent leaking secrets into logs and caches.
+	if r.URL.Query().Get("client_secret") != "" {
+		writeOAuthError(w, http.StatusBadRequest, "invalid_request", "client_secret must not be sent in the URL")
+		return
+	}
+
+	if grantType := r.PostFormValue("grant_type"); grantType != grantTypeClientCredentials {
+		writeOAuthError(w, http.StatusBadRequest, "unsupported_grant_type",
+			fmt.Sprintf("Unsupported grant_type: %s", grantType))
+		return
+	}
+
+	clientID := r.PostFormValue("client_id")
+	clientSecret := r.PostFormValue("client_secret")
+
+	// Also support HTTP Basic auth per OAuth2 spec
+	if clientID == "" && clientSecret == "" {
+		var ok bool
+		clientID, clientSecret, ok = r.BasicAuth()
+		if !ok {
+			writeInvalidClient(w, "Missing client credentials")
+			return
+		}
+	}
+
+	if clientID == "" || clientSecret == "" {
+		writeInvalidClient(w, "Missing client_id or client_secret")
+		return
+	}
+
+	if s.credentialValidator == nil {
+		writeOAuthError(w, http.StatusInternalServerError, "server_error", "Credential validation not configured")
+		return
+	}
+
+	identityName, _, err := s.credentialValidator.ValidateS3Credential(clientID, clientSecret)
+	if err != nil {
+		glog.V(2).Infof("Lance OAuth: credential validation failed for client_id=%s: %v", clientID, err)
+		writeInvalidClient(w, "Invalid client credentials")
+		return
+	}
+
+	tokenString, err := mintToken(identityName, clientID, clientSecret, oauthExpirySeconds())
+	if err != nil {
+		glog.Errorf("Lance OAuth: failed to sign token: %v", err)
+		writeOAuthError(w, http.StatusInternalServerError, "server_error", "Failed to generate token")
+		return
+	}
+
+	resp := OAuthTokenResponse{
+		AccessToken: tokenString,
+		TokenType:   "bearer",
+		ExpiresIn:   oauthExpirySeconds(),
+		Scope:       r.PostFormValue("scope"),
+	}
+	w.Header().Set("Cache-Control", "no-store")
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// mintToken issues a signed access token for the given identity and
+// credential, valid for ttlSeconds.
+func mintToken(identityName, accessKey, secret string, ttlSeconds int) (string, error) {
+	signingKey := deriveSigningKey(accessKey, secret)
+	now := time.Now()
+	claims := LanceClaims{
+		IdentityName: identityName,
+		AccessKey:    accessKey,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(time.Duration(ttlSeconds) * time.Second)),
+			Issuer:    "seaweedfs-lance",
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString(signingKey)
+}
+
+// authenticateBearer validates a Bearer token from the Authorization header.
+// Returns the identity name, identity object, and whether auth succeeded.
+func (s *Server) authenticateBearer(r *http.Request) (string, interface{}, bool) {
+	identityName, identity, _, _, ok := s.authenticateBearerKey(r)
+	return identityName, identity, ok
+}
+
+// authenticateBearerKey is authenticateBearer that also returns the access key
+// the token was minted from (its verified access_key claim).
+func (s *Server) authenticateBearerKey(r *http.Request) (string, interface{}, string, string, bool) {
+	auth := r.Header.Get("Authorization")
+	if auth == "" {
+		return "", nil, "", "", false
+	}
+	if !strings.HasPrefix(strings.ToLower(auth), "bearer ") {
+		return "", nil, "", "", false
+	}
+	tokenString := strings.TrimSpace(auth[7:])
+	if tokenString == "" {
+		return "", nil, "", "", false
+	}
+
+	if s.credentialValidator == nil {
+		return "", nil, "", "", false
+	}
+
+	// Parse the token without verification first to get the access key,
+	// then look up the exact credential to verify the signature.
+	parser := jwt.NewParser(jwt.WithoutClaimsValidation())
+	unverified := &LanceClaims{}
+	_, _, err := parser.ParseUnverified(tokenString, unverified)
+	if err != nil {
+		glog.V(2).Infof("Lance OAuth: failed to parse token: %v", err)
+		return "", nil, "", "", false
+	}
+
+	if unverified.AccessKey == "" {
+		return "", nil, "", "", false
+	}
+
+	identityName, identity, secretKey, err := s.credentialValidator.GetCredentialByAccessKey(unverified.AccessKey)
+	if err != nil {
+		glog.V(2).Infof("Lance OAuth: failed to get credential for access key: %v", err)
+		return "", nil, "", "", false
+	}
+
+	signingKey := deriveSigningKey(unverified.AccessKey, secretKey)
+	claims := &LanceClaims{}
+	verified, err := jwt.ParseWithClaims(tokenString, claims, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return signingKey, nil
+	})
+	if err != nil || !verified.Valid {
+		glog.V(2).Infof("Lance OAuth: token verification failed: %v", err)
+		return "", nil, "", "", false
+	}
+
+	// The token's signing key is derived from this access key, so a verified
+	// token was minted from it.
+	return identityName, identity, unverified.AccessKey, secretKey, true
+}
+
+// authenticateApiKey validates an x-api-key header carrying an S3 credential
+// as "access_key:secret_key". Unlike a Bearer token it does not expire, which
+// suits clients that hold static headers.
+func (s *Server) authenticateApiKey(apiKey string) (string, interface{}, bool) {
+	if s.credentialValidator == nil {
+		return "", nil, false
+	}
+	accessKey, secretKey, ok := strings.Cut(apiKey, ":")
+	if !ok || accessKey == "" || secretKey == "" {
+		return "", nil, false
+	}
+	identityName, identity, err := s.credentialValidator.ValidateS3Credential(accessKey, secretKey)
+	if err != nil {
+		glog.V(2).Infof("Lance x-api-key: credential validation failed: %v", err)
+		return "", nil, false
+	}
+	return identityName, identity, true
+}
+
+// deriveSigningKey derives a signing key from the access key and secret using HMAC-SHA256.
+// Including the access key prevents cross-credential token forgery when two
+// credentials happen to share the same secret.
+func deriveSigningKey(accessKey, secret string) []byte {
+	h := hmac.New(sha256.New, []byte("seaweedfs-lance-oauth"))
+	h.Write([]byte(accessKey))
+	h.Write([]byte{0}) // null separator
+	h.Write([]byte(secret))
+	return h.Sum(nil)
+}
+
+// writeInvalidClient answers 401 with the Basic challenge RFC 6749 §5.2
+// requires, so a client knows which scheme to retry with.
+func writeInvalidClient(w http.ResponseWriter, description string) {
+	w.Header().Set("WWW-Authenticate", `Basic realm="lance"`)
+	writeOAuthError(w, http.StatusUnauthorized, "invalid_client", description)
+}
+
+func writeOAuthError(w http.ResponseWriter, status int, errCode, description string) {
+	resp := OAuthErrorResponse{
+		Error:       errCode,
+		Description: description,
+	}
+	writeJSON(w, status, resp)
+}
diff --git a/weed/s3api/lance/handlers_oauth_test.go b/weed/s3api/lance/handlers_oauth_test.go
new file mode 100644
index 0000000000..236b101f32
--- /dev/null
+++ b/weed/s3api/lance/handlers_oauth_test.go
@@ -0,0 +1,340 @@
+package lance
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+type mockCredentialValidator struct {
+	credentials map[string]string // accessKey -> secretKey
+	identities  map[string]string // accessKey -> identityName
+}
+
+func (m *mockCredentialValidator) ValidateS3Credential(accessKey, secretKey string) (string, interface{}, error) {
+	expected, ok := m.credentials[accessKey]
+	if !ok {
+		return "", nil, fmt.Errorf("access key not found")
+	}
+	if expected != secretKey {
+		return "", nil, fmt.Errorf("invalid secret key")
+	}
+	return m.identities[accessKey], nil, nil
+}
+
+func (m *mockCredentialValidator) GetCredentialByAccessKey(accessKey string) (string, interface{}, string, error) {
+	secret, ok := m.credentials[accessKey]
+	if !ok {
+		return "", nil, "", fmt.Errorf("access key not found")
+	}
+	return m.identities[accessKey], nil, secret, nil
+}
+
+func newTestServerWithOAuth() *Server {
+	return &Server{
+		credentialValidator: &mockCredentialValidator{
+			credentials: map[string]string{"AKID123": "secret456"},
+			identities:  map[string]string{"AKID123": "testuser"},
+		},
+	}
+}
+
+type mockS3Authenticator struct {
+	called  bool
+	errCode s3err.ErrorCode
+}
+
+func (m *mockS3Authenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) {
+	m.called = true
+	if m.errCode != s3err.ErrNone {
+		return "", nil, m.errCode
+	}
+	return "s3user", nil, s3err.ErrNone
+}
+
+func (m *mockS3Authenticator) DefaultAllow() bool { return false }
+
+func mintTestToken(t *testing.T, accessKey, secret string, issuedAt, expiresAt time.Time) string {
+	t.Helper()
+	key := deriveSigningKey(accessKey, secret)
+	claims := LanceClaims{
+		IdentityName: "testuser",
+		AccessKey:    accessKey,
+		RegisteredClaims: jwt.RegisteredClaims{
+			IssuedAt:  jwt.NewNumericDate(issuedAt),
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			Issuer:    "seaweedfs-lance",
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString(key)
+	if err != nil {
+		t.Fatalf("sign token: %v", err)
+	}
+	return signed
+}
+
+func TestHandleOAuthTokens_Success(t *testing.T) {
+	s := newTestServerWithOAuth()
+
+	body := "grant_type=client_credentials&client_id=AKID123&client_secret=secret456"
+	req := httptest.NewRequest(http.MethodPost, "/oauth/token", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	s.handleOAuthTokens(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+	}
+
+	var resp OAuthTokenResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.TokenType != "bearer" {
+		t.Errorf("expected token_type=bearer, got %s", resp.TokenType)
+	}
+	if resp.AccessToken == "" {
+		t.Error("expected non-empty access_token")
+	}
+	if resp.ExpiresIn != oauthExpirySeconds() {
+		t.Errorf("expected expires_in=%d, got %d", oauthExpirySeconds(), resp.ExpiresIn)
+	}
+}
+
+func TestHandleOAuthTokens_InvalidCredentials(t *testing.T) {
+	s := newTestServerWithOAuth()
+
+	body := "grant_type=client_credentials&client_id=AKID123&client_secret=wrongsecret"
+	req := httptest.NewRequest(http.MethodPost, "/oauth/token", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	s.handleOAuthTokens(w, req)
+
+	if w.Code != http.StatusUnauthorized {
+		t.Fatalf("expected 401, got %d: %s", w.Code, w.Body.String())
+	}
+	if wa := w.Header().Get("WWW-Authenticate"); wa != `Basic realm="lance"` {
+		t.Fatalf("WWW-Authenticate = %q, want Basic challenge", wa)
+	}
+}
+
+func TestHandleOAuthTokens_OversizedBody(t *testing.T) {
+	s := newTestServerWithOAuth()
+
+	body := "grant_type=client_credentials&client_id=" + strings.Repeat("x", maxRequestBody)
+	req := httptest.NewRequest(http.MethodPost, "/oauth/token", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	s.handleOAuthTokens(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestHandleOAuthTokens_UnsupportedGrantType(t *testing.T) {
+	s := newTestServerWithOAuth()
+
+	body := "grant_type=authorization_code&client_id=AKID123&client_secret=secret456"
+	req := httptest.NewRequest(http.MethodPost, "/oauth/token", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+
+	s.handleOAuthTokens(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestBearerTokenRoundTrip(t *testing.T) {
+	s := newTestServerWithOAuth()
+
+	body := "grant_type=client_credentials&client_id=AKID123&client_secret=secret456"
+	req := httptest.NewRequest(http.MethodPost, "/oauth/token", strings.NewReader(body))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	s.handleOAuthTokens(w, req)
+
+	var resp OAuthTokenResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+
+	authReq := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	authReq.Header.Set("Authorization", "Bearer "+resp.AccessToken)
+
+	identityName, _, ok := s.authenticateBearer(authReq)
+	if !ok {
+		t.Fatal("expected Bearer auth to succeed")
+	}
+	if identityName != "testuser" {
+		t.Errorf("expected identity 'testuser', got '%s'", identityName)
+	}
+}
+
+func TestBearerTokenInvalid(t *testing.T) {
+	s := newTestServerWithOAuth()
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	req.Header.Set("Authorization", "Bearer invalid-token")
+
+	_, _, ok := s.authenticateBearer(req)
+	if ok {
+		t.Error("expected Bearer auth to fail with invalid token")
+	}
+}
+
+// The issue-11430 reproduction: behind an auth-enabled gateway, a catalog
+// request with no signature is denied, but the same request carrying a Bearer
+// token minted from S3 credentials must pass.
+func TestAuthBearerRunsHandler(t *testing.T) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrAccessDenied}
+	s.authenticator = auth
+	now := time.Now()
+	fresh := mintTestToken(t, "AKID123", "secret456", now, now.Add(time.Hour))
+
+	var gotIdentity string
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		gotIdentity = s3_constants.GetIdentityNameFromContext(r)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	req.Header.Set("Authorization", "Bearer "+fresh)
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("fresh Bearer: status = %d, want 200", rec.Code)
+	}
+	if auth.called {
+		t.Fatalf("fresh Bearer should not need the S3 authenticator")
+	}
+	if gotIdentity != "testuser" {
+		t.Fatalf("identity in context = %q, want testuser", gotIdentity)
+	}
+}
+
+// An expired or malformed Bearer token answers 401 rather than falling
+// through to the S3 authenticator, which would misread the header as SigV4.
+func TestAuthExpiredBearerReturns401(t *testing.T) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrAccessDenied}
+	s.authenticator = auth
+	now := time.Now()
+	expired := mintTestToken(t, "AKID123", "secret456", now.Add(-2*time.Hour), now.Add(-1*time.Hour))
+
+	var handlerCalled bool
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled = true
+		w.WriteHeader(http.StatusOK)
+	})
+
+	for _, scheme := range []string{"Bearer", "bearer", "BEARER"} {
+		req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+		req.Header.Set("Authorization", scheme+" "+expired)
+		rec := httptest.NewRecorder()
+		handler(rec, req)
+
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("scheme %q: status = %d, want 401", scheme, rec.Code)
+		}
+		if wa := rec.Header().Get("WWW-Authenticate"); wa != "Bearer" {
+			t.Fatalf("scheme %q: WWW-Authenticate = %q, want Bearer", scheme, wa)
+		}
+	}
+	if auth.called {
+		t.Fatalf("expired Bearer must not fall through to the S3 authenticator")
+	}
+	if handlerCalled {
+		t.Fatalf("handler must not run for an expired token")
+	}
+}
+
+// x-api-key carries "access_key:secret_key" straight to the catalog, with no
+// token to mint or expire - the header form LanceDB documents for API keys.
+func TestAuthApiKeyRunsHandler(t *testing.T) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrAccessDenied}
+	s.authenticator = auth
+
+	var gotIdentity string
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		gotIdentity = s3_constants.GetIdentityNameFromContext(r)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	req.Header.Set("x-api-key", "AKID123:secret456")
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("x-api-key: status = %d, want 200", rec.Code)
+	}
+	if gotIdentity != "testuser" {
+		t.Fatalf("identity in context = %q, want testuser", gotIdentity)
+	}
+}
+
+func TestAuthApiKeyInvalid(t *testing.T) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrAccessDenied}
+	s.authenticator = auth
+
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	for _, key := range []string{"AKID123:wrongsecret", "AKID123", ":secret456", "unknown:key"} {
+		req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+		req.Header.Set("x-api-key", key)
+		rec := httptest.NewRecorder()
+		handler(rec, req)
+
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("x-api-key %q: status = %d, want 401", key, rec.Code)
+		}
+	}
+	if auth.called {
+		t.Fatalf("bad x-api-key must not fall through to the S3 authenticator")
+	}
+}
+
+func TestAuthNoBearerStillUsesS3Authenticator(t *testing.T) {
+	s := newTestServerWithOAuth()
+	auth := &mockS3Authenticator{errCode: s3err.ErrNone}
+	s.authenticator = auth
+
+	var handlerCalled bool
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		handlerCalled = true
+		w.WriteHeader(http.StatusOK)
+	})
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+
+	if !auth.called {
+		t.Fatalf("request without Bearer header must use the S3 authenticator")
+	}
+	if rec.Code != http.StatusOK || !handlerCalled {
+		t.Fatalf("status = %d, handler called = %v", rec.Code, handlerCalled)
+	}
+}
diff --git a/weed/s3api/lance/handlers_table.go b/weed/s3api/lance/handlers_table.go
new file mode 100644
index 0000000000..7c63fd6ce8
--- /dev/null
+++ b/weed/s3api/lance/handlers_table.go
@@ -0,0 +1,577 @@
+package lance
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// handleListTables lists the Lance tables under a namespace. The spec asks for
+// full string identifiers, not bare names, so a recursive listing stays
+// unambiguous.
+func (s *Server) handleListTables(w http.ResponseWriter, r *http.Request) {
+	id, delimiter, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	bucket, ns := id.namespace()
+	if bucket == "" {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, "listing tables needs a namespace, not the root")
+		return
+	}
+
+	req := &s3tables.ListTablesRequest{
+		TableBucketARN:    bucketARN(bucket),
+		Namespace:         ns,
+		ContinuationToken: r.URL.Query().Get("page_token"),
+		MaxTables:         pageSize(r),
+	}
+	var resp s3tables.ListTablesResponse
+	if err := s.execute(r, "ListTables", req, &resp); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+
+	includeDeclared := true
+	if raw := r.URL.Query().Get("include_declared"); raw != "" {
+		includeDeclared = boolQuery(r, "include_declared")
+	}
+
+	writeJSON(w, http.StatusOK, ListTablesResponse{
+		Tables:    s.lanceTableIDs(r, bucket, resp.Tables, delimiter, includeDeclared),
+		PageToken: resp.ContinuationToken,
+	})
+}
+
+// handleListAllTables lists every Lance table the caller can see, across every
+// table bucket.
+func (s *Server) handleListAllTables(w http.ResponseWriter, r *http.Request) {
+	delimiter := requestDelimiter(r)
+
+	var buckets s3tables.ListTableBucketsResponse
+	if err := s.execute(r, "ListTableBuckets", &s3tables.ListTableBucketsRequest{MaxBuckets: pageSize(r)}, &buckets); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+
+	// The spec marks `tables` required, so an empty catalog answers with an
+	// empty list rather than null.
+	all := []string{}
+	for _, bucket := range buckets.TableBuckets {
+		var tables s3tables.ListTablesResponse
+		req := &s3tables.ListTablesRequest{TableBucketARN: bucketARN(bucket.Name), MaxTables: pageSize(r)}
+		if err := s.execute(r, "ListTables", req, &tables); err != nil {
+			// One unreadable bucket must not hide the rest; a caller with access
+			// to some buckets still gets those.
+			glog.V(2).Infof("lance: skipping bucket %s in ListAllTables: %v", bucket.Name, err)
+			continue
+		}
+		all = append(all, s.lanceTableIDs(r, bucket.Name, tables.Tables, delimiter, true)...)
+	}
+	writeJSON(w, http.StatusOK, ListTablesResponse{Tables: all})
+}
+
+// lanceTableIDs keeps the Lance tables out of a listing that also carries
+// Iceberg tables, and drops deregistered ones because they are meant to be
+// invisible until re-registered.
+func (s *Server) lanceTableIDs(r *http.Request, bucket string, summaries []s3tables.TableSummary, delimiter string, includeDeclared bool) []string {
+	ids := make([]string, 0, len(summaries))
+	for _, summary := range summaries {
+		if summary.Format != s3tables.FormatLance {
+			continue
+		}
+		location := summary.MetadataLocation
+		if location == "" {
+			location = tableLocation(bucket, summary.Namespace, summary.Name)
+		}
+		deregistered, hasData, err := s.datasetState(r, location)
+		if err != nil {
+			glog.V(2).Infof("lance: cannot read dataset state for %s: %v", location, err)
+			continue
+		}
+		if deregistered {
+			continue
+		}
+		if !hasData && !includeDeclared {
+			continue
+		}
+		parts := append([]string{bucket}, summary.Namespace...)
+		ids = append(ids, identifier(append(parts, summary.Name)).String(delimiter))
+	}
+	return ids
+}
+
+// handleDeclareTable records a table that does not exist on storage yet. This
+// is what a Lance client calls on CREATE TABLE, before it writes any data.
+func (s *Server) handleDeclareTable(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req DeclareTableRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	bucket, ns, name, err := id.table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+
+	location := strings.TrimSuffix(req.Location, "/")
+	if location == "" {
+		location = tableLocation(bucket, ns, name)
+	} else if err := confineLocation(bucket, location); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+
+	if err := s.createTable(r, bucket, ns, name, location); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	if err := s.writeMarker(r, location, reservedMarker); err != nil {
+		// The catalog entry is the authority; the marker only mirrors it for
+		// clients that read the storage prefix directly.
+		glog.V(1).Infof("lance: could not write %s for %s: %v", reservedMarker, location, err)
+	}
+	// Declaring a name that was deregistered brings it back, the same way
+	// registering it does.
+	if err := s.removeMarker(r, location, deregisteredMarker); err != nil {
+		glog.V(2).Infof("lance: could not clear %s for %s: %v", deregisteredMarker, location, err)
+	}
+
+	// A Lance commit is a direct S3 write that never revisits the catalog, so
+	// the create authorization above is the write evidence for the dataset.
+	options, err := s.storageOptions(r, bucket, location, wants(r, "vend_credentials", req.VendCredentials), func() bool { return true })
+	if err != nil {
+		writeError(w, r, http.StatusInternalServerError, codeInternal, err.Error())
+		return
+	}
+	// Properties are not persisted for a table, so neither response carries
+	// them: null says "this catalog does not keep them", where echoing the
+	// request back or answering {} would say they were stored and are empty.
+	writeJSON(w, http.StatusOK, DeclareTableResponse{
+		Location:       location,
+		StorageOptions: options,
+	})
+}
+
+// handleDescribeTable resolves a table to a location, and to credentials when
+// the caller asks for them.
+func (s *Server) handleDescribeTable(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req DescribeTableRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	bucket, ns, name, err := id.table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if req.Version != nil || req.Tag != "" || req.Branch != "" {
+		writeError(w, r, http.StatusNotImplemented, codeUnsupported,
+			"this namespace does not resolve versions, tags or branches; the dataset owns them")
+		return
+	}
+
+	table, err := s.loadLanceTable(r, bucket, ns, name)
+	if err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	location := table.location
+
+	deregistered, hasData, err := s.datasetState(r, location)
+	if err != nil {
+		writeError(w, r, http.StatusInternalServerError, codeInternal, err.Error())
+		return
+	}
+	if deregistered {
+		writeError(w, r, http.StatusNotFound, codeTableNotFound, "table is deregistered")
+		return
+	}
+
+	options, err := s.storageOptions(r, bucket, location, wants(r, "vend_credentials", req.VendCredentials), func() bool {
+		return s.mayUpdateTable(r, bucket, ns, name)
+	})
+	if err != nil {
+		writeError(w, r, http.StatusInternalServerError, codeInternal, err.Error())
+		return
+	}
+
+	resp := DescribeTableResponse{
+		Location: location,
+	}
+	if len(options) > 0 {
+		resp.StorageOptions = options
+	}
+	if wants(r, "with_table_uri", req.WithTableURI) {
+		resp.TableURI = location
+	}
+	if wants(r, "check_declared", req.CheckDeclared) {
+		onlyDeclared := !hasData
+		resp.IsOnlyDeclared = &onlyDeclared
+	}
+	if wants(r, "load_detailed_metadata", req.LoadDetailedMetadata) {
+		resp.Table = name
+		resp.Namespace = ns
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// handleTableExists answers with the status code and no body.
+func (s *Server) handleTableExists(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req TableExistsRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	bucket, ns, name, err := id.table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+
+	table, err := s.loadLanceTable(r, bucket, ns, name)
+	if err != nil {
+		if isNotFound(err) {
+			writeError(w, r, http.StatusNotFound, codeTableNotFound, "table does not exist")
+			return
+		}
+		writeStorageError(w, r, err)
+		return
+	}
+	deregistered, _, err := s.datasetState(r, table.location)
+	if err != nil {
+		writeError(w, r, http.StatusInternalServerError, codeInternal, err.Error())
+		return
+	}
+	if deregistered {
+		writeError(w, r, http.StatusNotFound, codeTableNotFound, "table is deregistered")
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+}
+
+// handleRegisterTable points a table name at an existing dataset.
+func (s *Server) handleRegisterTable(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req RegisterTableRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	bucket, ns, name, err := id.table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	location := strings.TrimSuffix(req.Location, "/")
+	if location == "" {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, "location is required")
+		return
+	}
+	if err := confineLocation(bucket, location); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+
+	mode := normalizeMode(req.Mode, modeCreate)
+	if mode != modeCreate && mode != modeOverwrite {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, "mode must be Create or Overwrite")
+		return
+	}
+
+	existing, err := s.loadLanceTable(r, bucket, ns, name)
+	switch {
+	case err != nil && !isNotFound(err):
+		writeStorageError(w, r, err)
+		return
+	case err == nil:
+		// A deregistered table is absent as far as the spec is concerned, so
+		// registering over it is a re-registration rather than a conflict.
+		deregistered, _, stateErr := s.datasetState(r, existing.location)
+		if stateErr != nil {
+			writeError(w, r, http.StatusInternalServerError, codeInternal, stateErr.Error())
+			return
+		}
+		if !deregistered && mode == modeCreate {
+			writeError(w, r, http.StatusConflict, codeTableAlreadyExists, "table already exists")
+			return
+		}
+		if existing.location != location {
+			// Repointing the name at another dataset is an update. Dropping and
+			// recreating the entry would take the old dataset's files with it,
+			// because the entry is the directory holding them.
+			if err := s.repointTable(r, bucket, ns, name, location, existing.versionToken); err != nil {
+				writeStorageError(w, r, err)
+				return
+			}
+		}
+	default:
+		if err := s.createTable(r, bucket, ns, name, location); err != nil {
+			writeStorageError(w, r, err)
+			return
+		}
+	}
+
+	// Registering a deregistered dataset brings it back.
+	if err := s.removeMarker(r, location, deregisteredMarker); err != nil {
+		glog.V(2).Infof("lance: could not clear %s for %s: %v", deregisteredMarker, location, err)
+	}
+
+	writeJSON(w, http.StatusOK, RegisterTableResponse{
+		Location:   location,
+		Properties: normalizeProperties(req.Properties),
+	})
+}
+
+// handleDeregisterTable forgets a table without touching its data.
+func (s *Server) handleDeregisterTable(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req DeregisterTableRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	bucket, ns, name, err := id.table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+
+	table, err := s.loadLanceTable(r, bucket, ns, name)
+	if err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+
+	// Deregistering is a state, not a deletion. Dropping the catalog entry would
+	// take the dataset with it, because the entry is the dataset directory and
+	// DeleteTable purges what it holds. The marker is what hides the table, and
+	// it is also what a directory-catalog client reads.
+	if err := s.writeMarker(r, table.location, deregisteredMarker); err != nil {
+		writeError(w, r, http.StatusInternalServerError, codeInternal,
+			"could not mark the table deregistered: "+err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusOK, DeregisterTableResponse{
+		ID:         append(append([]string{bucket}, ns...), name),
+		Location:   table.location,
+		Properties: map[string]string{},
+	})
+}
+
+// handleDropTable removes the table and its data.
+func (s *Server) handleDropTable(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req DropTableRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	bucket, ns, name, err := id.table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+
+	table, err := s.loadLanceTable(r, bucket, ns, name)
+	if err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	if err := s.dropTableEntry(r, bucket, ns, name); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+
+	writeJSON(w, http.StatusOK, DropTableResponse{
+		ID:         append(append([]string{bucket}, ns...), name),
+		Location:   table.location,
+		Properties: map[string]string{},
+	})
+}
+
+// handleRenameTable moves a table's catalog entry. The dataset stays put, which
+// is what the storage layer already does for a renamed Iceberg table.
+func (s *Server) handleRenameTable(w http.ResponseWriter, r *http.Request) {
+	id, _, ok := routeIdentifier(w, r)
+	if !ok {
+		return
+	}
+	var req RenameTableRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	if len(id) == 0 && len(req.ID) > 0 {
+		id = req.ID
+	}
+	if !checkBodyIdentifier(w, r, id, req.ID) {
+		return
+	}
+	bucket, ns, name, err := id.table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return
+	}
+	destBucket, destNS, destName, err := identifier(req.NewID).table()
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, "new_id: "+err.Error())
+		return
+	}
+	if destBucket != bucket {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput,
+			"a table cannot move between table buckets")
+		return
+	}
+
+	if _, err := s.loadLanceTable(r, bucket, ns, name); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+
+	renameReq := &s3tables.RenameTableRequest{
+		TableBucketARN:  bucketARN(bucket),
+		SourceNamespace: ns,
+		SourceName:      name,
+		DestNamespace:   destNS,
+		DestName:        destName,
+	}
+	var renameResp s3tables.RenameTableResponse
+	if err := s.execute(r, "RenameTable", renameReq, &renameResp); err != nil {
+		writeStorageError(w, r, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, RenameTableResponse{})
+}
+
+// lanceTable is the catalog's record of one Lance table.
+type lanceTable struct {
+	location     string
+	versionToken string
+}
+
+// loadLanceTable reads a table and refuses one that is not a Lance table, so a
+// Lance client never resolves an Iceberg table's location and writes over it.
+func (s *Server) loadLanceTable(r *http.Request, bucket string, ns []string, name string) (*lanceTable, error) {
+	req := &s3tables.GetTableRequest{
+		TableBucketARN: bucketARN(bucket),
+		Namespace:      ns,
+		Name:           name,
+	}
+	var resp s3tables.GetTableResponse
+	if err := s.execute(r, "GetTable", req, &resp); err != nil {
+		return nil, err
+	}
+	if resp.Format != s3tables.FormatLance {
+		return nil, &s3tables.S3TablesError{
+			Type:    s3tables.ErrCodeNoSuchTable,
+			Message: "table " + name + " is not a lance table",
+		}
+	}
+	location := resp.MetadataLocation
+	if location == "" {
+		location = tableLocation(bucket, resp.Namespace, resp.Name)
+	}
+	return &lanceTable{location: location, versionToken: resp.VersionToken}, nil
+}
+
+func (s *Server) createTable(r *http.Request, bucket string, ns []string, name, location string) error {
+	req := &s3tables.CreateTableRequest{
+		TableBucketARN: bucketARN(bucket),
+		Namespace:      ns,
+		Name:           name,
+		Format:         s3tables.FormatLance,
+		// A Lance table has no metadata file, so the location the catalog stores
+		// is the dataset root itself.
+		MetadataLocation: location,
+	}
+	var resp s3tables.CreateTableResponse
+	return s.execute(r, "CreateTable", req, &resp)
+}
+
+// repointTable moves an existing entry to another dataset location without
+// touching either dataset's files.
+func (s *Server) repointTable(r *http.Request, bucket string, ns []string, name, location, versionToken string) error {
+	req := &s3tables.UpdateTableRequest{
+		TableBucketARN:   bucketARN(bucket),
+		Namespace:        ns,
+		Name:             name,
+		VersionToken:     versionToken,
+		MetadataLocation: location,
+	}
+	var resp s3tables.UpdateTableResponse
+	return s.execute(r, "UpdateTable", req, &resp)
+}
+
+// dropTableEntry removes the catalog entry and the dataset under it. Only
+// DropTable wants this; deregistering and repointing must leave the files.
+func (s *Server) dropTableEntry(r *http.Request, bucket string, ns []string, name string) error {
+	req := &s3tables.DeleteTableRequest{
+		TableBucketARN: bucketARN(bucket),
+		Namespace:      ns,
+		Name:           name,
+	}
+	return s.execute(r, "DeleteTable", req, nil)
+}
diff --git a/weed/s3api/lance/handlers_test.go b/weed/s3api/lance/handlers_test.go
new file mode 100644
index 0000000000..d62bdc7089
--- /dev/null
+++ b/weed/s3api/lance/handlers_test.go
@@ -0,0 +1,417 @@
+package lance
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+)
+
+// openAuthenticator stands in for a gateway with no IAM configured, which is the
+// mode the namespace falls open in.
+type openAuthenticator struct{}
+
+func (openAuthenticator) AuthenticateRequest(*http.Request) (string, interface{}, s3err.ErrorCode) {
+	return s3tables.DefaultAccountID, nil, s3err.ErrNone
+}
+
+func (openAuthenticator) DefaultAllow() bool { return true }
+
+type testHarness struct {
+	router *mux.Router
+	filer  *s3tablestest.MemFiler
+	admin  *s3tables.Manager
+	server *Server
+}
+
+func newTestHarness(t *testing.T) *testHarness {
+	t.Helper()
+	filer := s3tablestest.Start(t)
+	server := NewServer(s3tables.NewManagerClient(filer.Client), openAuthenticator{})
+	server.SetS3Endpoint("http://127.0.0.1:8333")
+	server.SetS3Region(s3tables.DefaultRegion)
+	router := mux.NewRouter().SkipClean(true)
+	server.RegisterRoutes(router)
+
+	// Table buckets are created by an operator, not by a namespace client, so
+	// the harness seeds them the way the shell and admin console would.
+	admin := s3tables.NewManager()
+	admin.SetTrusted(true)
+	return &testHarness{router: router, filer: filer, admin: admin, server: server}
+}
+
+// createBucket seeds a table bucket the Lance namespace can then be pointed at.
+// An empty format strips the declaration afterwards, which is the only way to
+// get the shape a bucket made before formats existed has: one that still
+// accepts either format.
+func (h *testHarness) createBucket(t *testing.T, name, format string) {
+	t.Helper()
+	var resp s3tables.CreateTableBucketResponse
+	declared := format
+	if declared == "" {
+		declared = s3tables.FormatIceberg
+	}
+	err := h.admin.Execute(t.Context(), s3tables.NewManagerClient(h.filer.Client), "CreateTableBucket",
+		&s3tables.CreateTableBucketRequest{Name: name, Format: declared}, &resp, "")
+	if err != nil {
+		t.Fatalf("create table bucket %s: %v", name, err)
+	}
+	if format == "" {
+		h.undeclareBucket(t, name)
+	}
+}
+
+// undeclareBucket removes a bucket's format from its metadata, ageing it back to
+// what the filer holds for a bucket created before the field existed.
+func (h *testHarness) undeclareBucket(t *testing.T, name string) {
+	t.Helper()
+	entry := h.filer.Get(s3tables.TablesPath, name)
+	if entry == nil {
+		t.Fatalf("table bucket %s is not in the filer", name)
+	}
+	var metadata map[string]any
+	if err := json.Unmarshal(entry.Extended[s3tables.ExtendedKeyMetadata], &metadata); err != nil {
+		t.Fatalf("read bucket metadata: %v", err)
+	}
+	delete(metadata, "format")
+	updated, err := json.Marshal(metadata)
+	if err != nil {
+		t.Fatalf("write bucket metadata: %v", err)
+	}
+	extended := map[string][]byte{}
+	for key, value := range entry.Extended {
+		extended[key] = value
+	}
+	extended[s3tables.ExtendedKeyMetadata] = updated
+	h.filer.Put(s3tables.TablesPath, name, extended)
+}
+
+func (h *testHarness) bucketARN(t *testing.T, name string) string {
+	t.Helper()
+	arn, err := s3tables.BuildBucketARN(s3tables.DefaultRegion, s3tables.DefaultAccountID, name)
+	if err != nil {
+		t.Fatalf("build arn: %v", err)
+	}
+	return arn
+}
+
+func (h *testHarness) do(t *testing.T, method, target, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	var reader *strings.Reader
+	if body == "" {
+		reader = strings.NewReader("")
+	} else {
+		reader = strings.NewReader(body)
+	}
+	req := httptest.NewRequest(method, target, reader)
+	recorder := httptest.NewRecorder()
+	h.router.ServeHTTP(recorder, req)
+	return recorder
+}
+
+func (h *testHarness) mustDo(t *testing.T, method, target, body string, want int) *httptest.ResponseRecorder {
+	t.Helper()
+	recorder := h.do(t, method, target, body)
+	if recorder.Code != want {
+		t.Fatalf("%s %s = %d (%s), want %d", method, target, recorder.Code, recorder.Body.String(), want)
+	}
+	return recorder
+}
+
+func decode[T any](t *testing.T, recorder *httptest.ResponseRecorder) T {
+	t.Helper()
+	var out T
+	if err := json.Unmarshal(recorder.Body.Bytes(), &out); err != nil {
+		t.Fatalf("decode %s: %v", recorder.Body.String(), err)
+	}
+	return out
+}
+
+// The lifecycle a Lance client drives: create the namespace, declare the table
+// before any data exists, resolve it to a location, then deregister and bring it
+// back by registering the same location.
+func TestTableLifecycle(t *testing.T) {
+	h := newTestHarness(t)
+
+	h.createBucket(t, "analytics", s3tables.FormatLance)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+
+	declared := decode[DeclareTableResponse](t,
+		h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/declare", `{}`, http.StatusOK))
+	if declared.Location != "s3://analytics/sales/orders" {
+		t.Fatalf("declared location = %q", declared.Location)
+	}
+	// The endpoint is plaintext, so a client that does not get allow_http fails
+	// with what looks like a credential error.
+	if declared.StorageOptions["aws_endpoint"] != "http://127.0.0.1:8333" ||
+		declared.StorageOptions["allow_http"] != "true" {
+		t.Fatalf("storage options = %v", declared.StorageOptions)
+	}
+
+	described := decode[DescribeTableResponse](t,
+		h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/describe?check_declared=true", `{}`, http.StatusOK))
+	if described.Location != declared.Location {
+		t.Fatalf("described location = %q, want %q", described.Location, declared.Location)
+	}
+	if described.IsOnlyDeclared == nil || !*described.IsOnlyDeclared {
+		t.Fatalf("is_only_declared = %v, want true for a table with no data", described.IsOnlyDeclared)
+	}
+
+	listed := decode[ListTablesResponse](t,
+		h.mustDo(t, http.MethodGet, "/v1/namespace/analytics$sales/table/list", "", http.StatusOK))
+	if len(listed.Tables) != 1 || listed.Tables[0] != "analytics$sales$orders" {
+		t.Fatalf("listed tables = %v, want the full identifier", listed.Tables)
+	}
+
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/exists", `{}`, http.StatusOK)
+
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/deregister", `{}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/exists", `{}`, http.StatusNotFound)
+	afterDrop := decode[ListTablesResponse](t,
+		h.mustDo(t, http.MethodGet, "/v1/namespace/analytics$sales/table/list", "", http.StatusOK))
+	if len(afterDrop.Tables) != 0 {
+		t.Fatalf("deregistered table still listed: %v", afterDrop.Tables)
+	}
+	// Deregistering preserves the data. The catalog entry is the dataset
+	// directory, so dropping it would take the dataset with it.
+	if h.filer.Get(s3tables.GetNamespacePath("analytics", "sales"), "orders") == nil {
+		t.Fatal("deregister deleted the dataset directory")
+	}
+
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/register",
+		`{"location":"s3://analytics/sales/orders"}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/exists", `{}`, http.StatusOK)
+
+	// Dropping is the operation that does remove the data.
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/drop", `{}`, http.StatusOK)
+	if h.filer.Get(s3tables.GetNamespacePath("analytics", "sales"), "orders") != nil {
+		t.Fatal("drop left the dataset directory behind")
+	}
+}
+
+// Repointing a registered name at another dataset must not take the dataset it
+// used to name with it.
+func TestRegisterOverwriteKeepsTheOldDataset(t *testing.T) {
+	h := newTestHarness(t)
+	h.createBucket(t, "analytics", s3tables.FormatLance)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/declare", `{}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$archive/declare", `{}`, http.StatusOK)
+
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/register",
+		`{"location":"s3://analytics/sales/archive","mode":"Overwrite"}`, http.StatusOK)
+
+	described := decode[DescribeTableResponse](t,
+		h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/describe", `{}`, http.StatusOK))
+	if described.Location != "s3://analytics/sales/archive" {
+		t.Fatalf("location after repointing = %q", described.Location)
+	}
+	if h.filer.Get(s3tables.GetNamespacePath("analytics", "sales"), "orders") == nil {
+		t.Fatal("repointing deleted the dataset the name used to hold")
+	}
+}
+
+// A required list field answers empty rather than null, which a generated
+// client may decode differently.
+func TestListAllTablesIsNeverNull(t *testing.T) {
+	h := newTestHarness(t)
+	h.createBucket(t, "analytics", s3tables.FormatLance)
+
+	body := h.mustDo(t, http.MethodGet, "/v1/table", "", http.StatusOK).Body.String()
+	if strings.Contains(body, `"tables":null`) {
+		t.Fatalf("ListAllTables returned null for a required field: %s", body)
+	}
+}
+
+func TestNamespaceListing(t *testing.T) {
+	h := newTestHarness(t)
+	h.createBucket(t, "analytics", s3tables.FormatLance)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$finance/create", `{}`, http.StatusOK)
+
+	roots := decode[ListNamespacesResponse](t,
+		h.mustDo(t, http.MethodGet, "/v1/namespace/$/list", "", http.StatusOK))
+	if len(roots.Namespaces) != 1 || roots.Namespaces[0] != "analytics" {
+		t.Fatalf("root listing = %v, want the table buckets", roots.Namespaces)
+	}
+
+	children := decode[ListNamespacesResponse](t,
+		h.mustDo(t, http.MethodGet, "/v1/namespace/analytics/list", "", http.StatusOK))
+	if len(children.Namespaces) != 2 {
+		t.Fatalf("bucket listing = %v, want two namespaces", children.Namespaces)
+	}
+
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/exists", `{}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$nope/exists", `{}`, http.StatusNotFound)
+
+	// Fail mode reports a missing namespace as 400 on this operation, which is
+	// what the spec asks for; Skip reports success.
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$nope/drop", `{}`, http.StatusBadRequest)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$nope/drop", `{"mode":"Skip"}`, http.StatusNoContent)
+}
+
+// Storage flattens a namespace's parts, so creating a$b without a would leave
+// an intermediate that listing derives from the name and describe denies
+// exists. The spec asks for NamespaceNotFound, which keeps them consistent.
+func TestCreateNamespaceRequiresItsParent(t *testing.T) {
+	h := newTestHarness(t)
+	h.createBucket(t, "analytics", s3tables.FormatLance)
+
+	recorder := h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$missing$child/create", `{}`, http.StatusNotFound)
+	if got := decode[errorResponse](t, recorder); got.Code != codeNamespaceNotFound {
+		t.Fatalf("error code = %d, want %d", got.Code, codeNamespaceNotFound)
+	}
+
+	// With the parent in place the child is fine, and both are then listed and
+	// describable.
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$parent/create", `{}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$parent$child/create", `{}`, http.StatusOK)
+
+	listed := decode[ListNamespacesResponse](t,
+		h.mustDo(t, http.MethodGet, "/v1/namespace/analytics/list", "", http.StatusOK))
+	for _, name := range listed.Namespaces {
+		path := "/v1/namespace/analytics$" + name
+		h.mustDo(t, http.MethodPost, path+"/exists", `{}`, http.StatusOK)
+	}
+}
+
+func TestCreateNamespaceModes(t *testing.T) {
+	h := newTestHarness(t)
+	h.createBucket(t, "analytics", s3tables.FormatLance)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusConflict)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{"mode":"ExistOk"}`, http.StatusOK)
+	// snake_case is the other spelling the spec accepts.
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{"mode":"exist_ok"}`, http.StatusOK)
+
+	h.mustDo(t, http.MethodPost, "/v1/namespace/$/create", `{}`, http.StatusBadRequest)
+}
+
+// A Lance client must never resolve an Iceberg table's location, or it would
+// write a dataset over a table another engine owns.
+func TestIcebergTablesAreInvisible(t *testing.T) {
+	h := newTestHarness(t)
+	// Undeclared, because a bucket that declares one format cannot hold the
+	// other - and mixing is exactly what this test needs to prove is hidden.
+	h.createBucket(t, "analytics", "")
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$vectors/declare", `{}`, http.StatusOK)
+
+	manager := h.admin
+	var created s3tables.CreateTableResponse
+	err := manager.Execute(t.Context(), s3tables.NewManagerClient(h.filer.Client), "CreateTable", &s3tables.CreateTableRequest{
+		TableBucketARN:   h.bucketARN(t, "analytics"),
+		Namespace:        []string{"sales"},
+		Name:             "ledger",
+		Format:           s3tables.FormatIceberg,
+		MetadataLocation: "s3://analytics/sales/ledger/metadata/v1.metadata.json",
+	}, &created, "")
+	if err != nil {
+		t.Fatalf("create iceberg table: %v", err)
+	}
+
+	listed := decode[ListTablesResponse](t,
+		h.mustDo(t, http.MethodGet, "/v1/namespace/analytics$sales/table/list", "", http.StatusOK))
+	if len(listed.Tables) != 1 || listed.Tables[0] != "analytics$sales$vectors" {
+		t.Fatalf("listing = %v, want only the lance table", listed.Tables)
+	}
+
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$ledger/describe", `{}`, http.StatusNotFound)
+	h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$ledger/exists", `{}`, http.StatusNotFound)
+
+	// Declaring over the Iceberg table must not quietly succeed and hand the
+	// Lance client a directory another format owns.
+	recorder := h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$ledger/declare", `{}`, http.StatusConflict)
+	if got := decode[errorResponse](t, recorder); got.Code != codeTableAlreadyExists {
+		t.Fatalf("error code = %d, want %d", got.Code, codeTableAlreadyExists)
+	}
+}
+
+// The route and the body naming different objects is a bad request, not a silent
+// preference for one of them.
+func TestRouteAndBodyMustAgree(t *testing.T) {
+	h := newTestHarness(t)
+	h.createBucket(t, "analytics", s3tables.FormatLance)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+
+	recorder := h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/declare",
+		`{"id":["analytics","sales","other"]}`, http.StatusBadRequest)
+	if got := decode[errorResponse](t, recorder); got.Code != codeInvalidInput {
+		t.Fatalf("error code = %d, want %d", got.Code, codeInvalidInput)
+	}
+}
+
+// A client-supplied location must resolve inside its own bucket. Without this,
+// a "../"-laden or cross-bucket location escapes when the marker path is joined
+// under /buckets, letting the request reach another tenant's namespace, or
+// outside /buckets entirely, and auto-create the parent directories on the way.
+func TestLocationOutsideBucketIsRejected(t *testing.T) {
+	cases := []struct {
+		name     string
+		location string
+	}{
+		{"another bucket", "s3://victim/secret"},
+		{"traversal into another bucket", "s3://analytics/../victim/secret"},
+		{"traversal above the buckets root", "s3://analytics/../../etc/cron.d"},
+		{"not an s3 uri", "../../etc/cron.d"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := s3tables.TableDataDirFromMetadataLocation(tc.location)
+			body := `{"location":"` + tc.location + `"}`
+
+			// declare writes .lance-reserved at the location: rejection must leave
+			// nothing behind at the escaped directory.
+			t.Run("declare", func(t *testing.T) {
+				h := newTestHarness(t)
+				h.createBucket(t, "analytics", s3tables.FormatLance)
+				h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+
+				recorder := h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/declare", body, http.StatusBadRequest)
+				if got := decode[errorResponse](t, recorder); got.Code != codeInvalidInput {
+					t.Fatalf("error code = %d, want %d", got.Code, codeInvalidInput)
+				}
+				if dir != "" && h.filer.Get(dir, reservedMarker) != nil {
+					t.Fatalf("declare wrote %s into %s despite rejection", reservedMarker, dir)
+				}
+			})
+
+			// register removes .lance-deregistered at the location: rejection must
+			// leave a victim's marker in place rather than un-hiding their table.
+			t.Run("register", func(t *testing.T) {
+				h := newTestHarness(t)
+				h.createBucket(t, "analytics", s3tables.FormatLance)
+				h.mustDo(t, http.MethodPost, "/v1/namespace/analytics$sales/create", `{}`, http.StatusOK)
+				if dir != "" {
+					h.filer.PutFile(dir, deregisteredMarker, time.Unix(1, 0))
+				}
+
+				recorder := h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/register", body, http.StatusBadRequest)
+				if got := decode[errorResponse](t, recorder); got.Code != codeInvalidInput {
+					t.Fatalf("error code = %d, want %d", got.Code, codeInvalidInput)
+				}
+				if dir != "" && h.filer.Get(dir, deregisteredMarker) == nil {
+					t.Fatalf("register removed %s from %s despite rejection", deregisteredMarker, dir)
+				}
+			})
+		})
+	}
+}
+
+// The data plane needs Lance format support that does not exist in Go, so it
+// answers with the spec's own Unsupported code rather than a bare 404.
+func TestDataPlaneIsUnsupported(t *testing.T) {
+	h := newTestHarness(t)
+	recorder := h.mustDo(t, http.MethodPost, "/v1/table/analytics$sales$orders/query", `{}`, http.StatusNotImplemented)
+	if got := decode[errorResponse](t, recorder); got.Code != codeUnsupported {
+		t.Fatalf("error code = %d, want %d", got.Code, codeUnsupported)
+	}
+}
diff --git a/weed/s3api/lance/identifier.go b/weed/s3api/lance/identifier.go
new file mode 100644
index 0000000000..dfe8aee2a5
--- /dev/null
+++ b/weed/s3api/lance/identifier.go
@@ -0,0 +1,84 @@
+package lance
+
+import (
+	"fmt"
+	"net/http"
+	"strings"
+)
+
+// defaultDelimiter joins the parts of a Lance string identifier when the caller
+// does not pass ?delimiter=. An id equal to the delimiter is the root namespace,
+// so /v1/namespace/$/list lists the root's children.
+const defaultDelimiter = "$"
+
+// identifier is a Lance object identifier: zero parts is the root namespace, one
+// part names a table bucket, and the rest are namespace parts with a table name
+// last. The mapping onto storage is bucket / namespace / table, which is the
+// three-level shape Lance clients already use.
+type identifier []string
+
+func requestDelimiter(r *http.Request) string {
+	if d := r.URL.Query().Get("delimiter"); d != "" {
+		return d
+	}
+	return defaultDelimiter
+}
+
+// parseIdentifier decodes the {id} route variable. Empty parts are rejected
+// rather than dropped so that "a$$b" cannot silently resolve to "a$b".
+func parseIdentifier(encoded, delimiter string) (identifier, error) {
+	if encoded == "" || encoded == delimiter {
+		return nil, nil
+	}
+	parts := strings.Split(encoded, delimiter)
+	for _, part := range parts {
+		if part == "" {
+			return nil, fmt.Errorf("identifier %q has an empty part", encoded)
+		}
+	}
+	return parts, nil
+}
+
+func (id identifier) String(delimiter string) string {
+	if len(id) == 0 {
+		return delimiter
+	}
+	return strings.Join(id, delimiter)
+}
+
+// namespace splits a namespace identifier into the table bucket and the parts of
+// the namespace inside it. The root and a bare bucket both return an empty
+// namespace, so callers check the bucket to tell them apart.
+func (id identifier) namespace() (bucket string, ns []string) {
+	if len(id) == 0 {
+		return "", nil
+	}
+	return id[0], id[1:]
+}
+
+// table splits a table identifier. A table needs a bucket, at least one
+// namespace part and a name, because storage has no unnamespaced tables.
+func (id identifier) table() (bucket string, ns []string, name string, err error) {
+	if len(id) < 3 {
+		return "", nil, "", fmt.Errorf("table identifier needs a bucket, a namespace and a name")
+	}
+	return id[0], id[1 : len(id)-1], id[len(id)-1], nil
+}
+
+// matchesBody reports whether an identifier carried in the request body agrees
+// with the one in the route. The spec requires 400 when both are present and
+// differ, and requires the route to win when the body omits it.
+func (id identifier) matchesBody(body []string) bool {
+	if len(body) == 0 {
+		return true
+	}
+	if len(body) != len(id) {
+		return false
+	}
+	for i := range body {
+		if body[i] != id[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/weed/s3api/lance/identifier_test.go b/weed/s3api/lance/identifier_test.go
new file mode 100644
index 0000000000..28bbf61aa2
--- /dev/null
+++ b/weed/s3api/lance/identifier_test.go
@@ -0,0 +1,104 @@
+package lance
+
+import "testing"
+
+func TestParseIdentifier(t *testing.T) {
+	cases := []struct {
+		name      string
+		encoded   string
+		delimiter string
+		want      []string
+		wantErr   bool
+	}{
+		{name: "root is the delimiter", encoded: "$", delimiter: "$"},
+		{name: "empty is the root", encoded: "", delimiter: "$"},
+		{name: "bucket", encoded: "analytics", delimiter: "$", want: []string{"analytics"}},
+		{name: "namespace", encoded: "analytics$sales", delimiter: "$", want: []string{"analytics", "sales"}},
+		{name: "table", encoded: "analytics$sales$orders", delimiter: "$", want: []string{"analytics", "sales", "orders"}},
+		{name: "custom delimiter", encoded: "a.b.c", delimiter: ".", want: []string{"a", "b", "c"}},
+		{name: "empty part is rejected", encoded: "a$$b", delimiter: "$", wantErr: true},
+		{name: "trailing delimiter is rejected", encoded: "a$", delimiter: "$", wantErr: true},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got, err := parseIdentifier(c.encoded, c.delimiter)
+			if c.wantErr {
+				if err == nil {
+					t.Fatalf("parseIdentifier(%q) error = nil, want an error", c.encoded)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("parseIdentifier(%q) error = %v", c.encoded, err)
+			}
+			if len(got) != len(c.want) {
+				t.Fatalf("parseIdentifier(%q) = %v, want %v", c.encoded, got, c.want)
+			}
+			for i := range got {
+				if got[i] != c.want[i] {
+					t.Fatalf("parseIdentifier(%q) = %v, want %v", c.encoded, got, c.want)
+				}
+			}
+		})
+	}
+}
+
+func TestIdentifierNamespace(t *testing.T) {
+	bucket, ns := identifier(nil).namespace()
+	if bucket != "" || len(ns) != 0 {
+		t.Fatalf("root namespace() = %q %v, want empty", bucket, ns)
+	}
+
+	bucket, ns = identifier{"analytics"}.namespace()
+	if bucket != "analytics" || len(ns) != 0 {
+		t.Fatalf("bucket namespace() = %q %v", bucket, ns)
+	}
+
+	bucket, ns = identifier{"analytics", "sales", "eu"}.namespace()
+	if bucket != "analytics" || len(ns) != 2 || ns[0] != "sales" || ns[1] != "eu" {
+		t.Fatalf("nested namespace() = %q %v", bucket, ns)
+	}
+}
+
+// A table always needs a bucket, a namespace and a name: storage has no
+// unnamespaced tables, so a two-part identifier is a client error rather than a
+// table at the top of a bucket.
+func TestIdentifierTable(t *testing.T) {
+	if _, _, _, err := (identifier{"analytics", "orders"}).table(); err == nil {
+		t.Fatal("table() on a two-part identifier error = nil, want an error")
+	}
+
+	bucket, ns, name, err := identifier{"analytics", "sales", "eu", "orders"}.table()
+	if err != nil {
+		t.Fatalf("table() error = %v", err)
+	}
+	if bucket != "analytics" || name != "orders" || len(ns) != 2 || ns[0] != "sales" || ns[1] != "eu" {
+		t.Fatalf("table() = %q %v %q", bucket, ns, name)
+	}
+}
+
+func TestIdentifierMatchesBody(t *testing.T) {
+	id := identifier{"a", "b", "c"}
+	if !id.matchesBody(nil) {
+		t.Fatal("an absent body identifier must defer to the route")
+	}
+	if !id.matchesBody([]string{"a", "b", "c"}) {
+		t.Fatal("an equal body identifier must match")
+	}
+	if id.matchesBody([]string{"a", "b"}) {
+		t.Fatal("a shorter body identifier must not match")
+	}
+	if id.matchesBody([]string{"a", "b", "d"}) {
+		t.Fatal("a different body identifier must not match")
+	}
+}
+
+func TestIdentifierString(t *testing.T) {
+	if got := identifier(nil).String("$"); got != "$" {
+		t.Fatalf("root String() = %q, want %q", got, "$")
+	}
+	if got := (identifier{"a", "b"}).String("$"); got != "a$b" {
+		t.Fatalf("String() = %q, want %q", got, "a$b")
+	}
+}
diff --git a/weed/s3api/lance/markers.go b/weed/s3api/lance/markers.go
new file mode 100644
index 0000000000..9b16336024
--- /dev/null
+++ b/weed/s3api/lance/markers.go
@@ -0,0 +1,93 @@
+package lance
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// Marker files the Lance Directory Catalog reads. Writing them beside the
+// dataset keeps a client that bypasses this namespace, and lists the storage
+// prefix directly, seeing the same table states the catalog reports.
+const (
+	reservedMarker     = ".lance-reserved"
+	deregisteredMarker = ".lance-deregistered"
+	versionsDir        = "_versions"
+)
+
+// datasetDir maps a table location onto the filer directory holding it.
+func datasetDir(location string) string {
+	return s3tables.TableDataDirFromMetadataLocation(location)
+}
+
+func (s *Server) entryExists(r *http.Request, dir, name string) (bool, error) {
+	found := false
+	err := s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		_, lookupErr := filer_pb.LookupEntry(r.Context(), client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: dir,
+			Name:      name,
+		})
+		if lookupErr == filer_pb.ErrNotFound {
+			return nil
+		}
+		if lookupErr != nil {
+			return lookupErr
+		}
+		found = true
+		return nil
+	})
+	return found, err
+}
+
+// writeMarker drops a zero-length marker into the dataset directory. The
+// directory has to exist already: a table declared through this namespace has
+// one, and a table registered at a location that does not yet exist has no
+// storage to mark.
+func (s *Server) writeMarker(r *http.Request, location, name string) error {
+	dir := datasetDir(location)
+	if dir == "" {
+		return nil
+	}
+	now := time.Now().Unix()
+	return s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return filer_pb.CreateEntry(r.Context(), client, &filer_pb.CreateEntryRequest{
+			Directory: dir,
+			Entry: &filer_pb.Entry{
+				Name: name,
+				Attributes: &filer_pb.FuseAttributes{
+					Mtime:    now,
+					Crtime:   now,
+					FileMode: uint32(0644),
+				},
+			},
+		})
+	})
+}
+
+func (s *Server) removeMarker(r *http.Request, location, name string) error {
+	dir := datasetDir(location)
+	if dir == "" {
+		return nil
+	}
+	return s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return filer_pb.DoRemove(r.Context(), client, dir, name, true, false, true, false, nil)
+	})
+}
+
+// datasetState reports the two things the spec asks about a table's storage:
+// whether it has been deregistered, and whether it holds data yet. A dataset
+// holds data once it has a version manifest, which is how a directory catalog
+// decides the same question.
+func (s *Server) datasetState(r *http.Request, location string) (deregistered, hasData bool, err error) {
+	dir := datasetDir(location)
+	if dir == "" {
+		return false, false, nil
+	}
+	if deregistered, err = s.entryExists(r, dir, deregisteredMarker); err != nil {
+		return false, false, err
+	}
+	hasData, err = s.entryExists(r, dir, versionsDir)
+	return deregistered, hasData, err
+}
diff --git a/weed/s3api/lance/server.go b/weed/s3api/lance/server.go
new file mode 100644
index 0000000000..53effee9e5
--- /dev/null
+++ b/weed/s3api/lance/server.go
@@ -0,0 +1,252 @@
+package lance
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// FilerClient provides access to the filer for storage operations.
+type FilerClient interface {
+	WithFilerClient(streamingMode bool, fn func(client filer_pb.SeaweedFilerClient) error) error
+}
+
+type S3Authenticator interface {
+	AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode)
+	DefaultAllow() bool
+}
+
+// CredentialValidator validates S3 access key / secret key pairs
+// and provides credential lookup for OAuth token verification.
+type CredentialValidator interface {
+	// ValidateS3Credential checks if the access key and secret key are valid.
+	// Returns the identity name and identity object on success.
+	ValidateS3Credential(accessKey, secretKey string) (identityName string, identity interface{}, err error)
+	// GetCredentialByAccessKey looks up a credential by access key.
+	// Returns the identity name, identity object, and secret key.
+	// Used for verifying Bearer tokens signed with a specific credential.
+	GetCredentialByAccessKey(accessKey string) (identityName string, identity interface{}, secretKey string, err error)
+}
+
+// VendedCredentials are short-lived S3 credentials scoped to one table.
+type VendedCredentials struct {
+	AccessKeyID     string
+	SecretAccessKey string
+	SessionToken    string
+	Expiration      time.Time
+}
+
+// CredentialVendor mints credentials limited to a single table's prefix for a
+// caller the catalog has already authenticated and authorized, read-only when
+// readOnly is set. A nil result with no error means the deployment has vending
+// switched off.
+type CredentialVendor interface {
+	VendTableCredentials(ctx context.Context, principal, bucket, prefix string, readOnly bool) (*VendedCredentials, error)
+}
+
+// Server implements the Lance Namespace REST spec.
+type Server struct {
+	filerClient         FilerClient
+	tablesManager       *s3tables.Manager
+	authenticator       S3Authenticator
+	credentialValidator CredentialValidator
+	credentialVendor    CredentialVendor
+	s3Endpoint          string
+	s3Region            string
+}
+
+// NewServer creates a Lance namespace server over the given filer.
+func NewServer(filerClient FilerClient, authenticator S3Authenticator) *Server {
+	manager := s3tables.NewManager()
+	// Mirror the S3 port: fall open by default only when the gateway itself is
+	// open, so an authenticated caller still passes the normal permission check.
+	if authenticator != nil {
+		manager.SetDefaultAllow(authenticator.DefaultAllow())
+	}
+	return &Server{
+		filerClient:   filerClient,
+		tablesManager: manager,
+		authenticator: authenticator,
+	}
+}
+
+// SetCredentialValidator sets the credential validator for OAuth token support.
+func (s *Server) SetCredentialValidator(cv CredentialValidator) {
+	s.credentialValidator = cv
+}
+
+// SetCredentialVendor enables storage_options credential vending for clients
+// that ask for it with vend_credentials.
+func (s *Server) SetCredentialVendor(vendor CredentialVendor) {
+	s.credentialVendor = vendor
+}
+
+// SetS3Endpoint configures the S3 endpoint advertised in storage_options so a
+// client can reach the dataset without separately discovering the S3 address.
+func (s *Server) SetS3Endpoint(endpoint string) {
+	s.s3Endpoint = endpoint
+}
+
+// SetS3Region configures the region advertised in storage_options.
+func (s *Server) SetS3Region(region string) {
+	s.s3Region = region
+}
+
+// RegisterRoutes registers the Lance Namespace REST routes.
+//
+// The spec puts the identifier in the path rather than the body so a reverse
+// proxy can route and authorize without deserializing the request.
+func (s *Server) RegisterRoutes(router *mux.Router) {
+	router.Use(loggingMiddleware)
+
+	// OAuth2 token endpoint - no auth needed (this IS the auth endpoint)
+	router.HandleFunc("/oauth/token", s.handleOAuthTokens).Methods(http.MethodPost)
+
+	router.HandleFunc("/v1/namespace/{id}/create", s.Auth(s.handleCreateNamespace)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/namespace/{id}/list", s.Auth(s.handleListNamespaces)).Methods(http.MethodGet)
+	router.HandleFunc("/v1/namespace/{id}/describe", s.Auth(s.handleDescribeNamespace)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/namespace/{id}/drop", s.Auth(s.handleDropNamespace)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/namespace/{id}/exists", s.Auth(s.handleNamespaceExists)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/namespace/{id}/table/list", s.Auth(s.handleListTables)).Methods(http.MethodGet)
+
+	router.HandleFunc("/v1/table", s.Auth(s.handleListAllTables)).Methods(http.MethodGet)
+	router.HandleFunc("/v1/table/{id}/declare", s.Auth(s.handleDeclareTable)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/table/{id}/describe", s.Auth(s.handleDescribeTable)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/table/{id}/exists", s.Auth(s.handleTableExists)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/table/{id}/register", s.Auth(s.handleRegisterTable)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/table/{id}/deregister", s.Auth(s.handleDeregisterTable)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/table/{id}/drop", s.Auth(s.handleDropTable)).Methods(http.MethodPost)
+	router.HandleFunc("/v1/table/{id}/rename", s.Auth(s.handleRenameTable)).Methods(http.MethodPost)
+
+	// The data plane needs Lance format support that does not exist in Go. Say
+	// so with the spec's own code instead of returning a bare 404.
+	for _, action := range []string{"create", "insert", "merge_insert", "update", "delete",
+		"query", "count_rows", "explain_plan", "analyze_plan", "restore",
+		"add_columns", "alter_columns", "drop_columns", "backfill_column",
+		"create_index", "create_scalar_index", "stats", "schema_metadata/update"} {
+		router.HandleFunc("/v1/table/{id}/"+action, s.Auth(s.handleUnsupported)).Methods(http.MethodPost)
+	}
+	// Version ops exist in the spec for stores that cannot order commits
+	// themselves. Ours can: a Lance commit is a put-if-not-exists, and this S3
+	// evaluates that precondition at the object's owner filer under a per-path
+	// lock, so the dataset keeps its own version history and the catalog stays
+	// out of the commit path.
+	for _, action := range []string{
+		"version/create", "version/list", "version/describe", "version/delete",
+		"index/list", "tags/list", "tags/version", "tags/create", "tags/delete", "tags/update",
+		"branches/list", "branches/create", "branches/delete"} {
+		router.HandleFunc("/v1/table/{id}/"+action, s.Auth(s.handleUnsupported)).Methods(http.MethodPost)
+	}
+
+	router.PathPrefix("/").HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		glog.V(2).Infof("lance: no route for %s %s", r.Method, r.URL.EscapedPath())
+		writeError(w, r, http.StatusNotFound, codeUnsupported, "no such operation")
+	})
+
+	glog.V(2).Infof("Registered Lance Namespace routes")
+}
+
+func (s *Server) handleUnsupported(w http.ResponseWriter, r *http.Request) {
+	writeError(w, r, http.StatusNotImplemented, codeUnsupported,
+		"this namespace records table metadata only; run data operations through a Lance client against the table location")
+}
+
+func loggingMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		glog.V(2).Infof("lance request: %s %s from %s", r.Method, r.URL.EscapedPath(), r.RemoteAddr)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// Auth authenticates the caller and puts the identity in the request context.
+// Lance clients authenticate the catalog with a Bearer token or an x-api-key
+// header; the S3 authenticator stays for callers that can SigV4-sign.
+func (s *Server) Auth(handler http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		// A request carrying a Bearer token is a Lance REST client. An invalid
+		// or expired token gets 401 immediately; falling through to the S3
+		// authenticator would parse the header as SigV4 and fail with a
+		// different error that clients cannot act on.
+		// The auth scheme is case-insensitive (RFC 7235).
+		if strings.HasPrefix(strings.ToLower(r.Header.Get("Authorization")), "bearer ") {
+			if identityName, identity, accessKey, secretKey, ok := s.authenticateBearerKey(r); ok {
+				ctx := r.Context()
+				ctx = s3_constants.SetIdentityNameInContext(ctx, identityName)
+				ctx = s3_constants.SetAccessKeyIdInContext(ctx, accessKey)
+				ctx = s3_constants.SetStoredAccessKeyIdInContext(ctx, accessKey, secretKey)
+				if identity != nil {
+					ctx = s3_constants.SetIdentityInContext(ctx, identity)
+				}
+				r = r.WithContext(ctx)
+				handler(w, r)
+				return
+			}
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			writeError(w, r, http.StatusUnauthorized, codeUnauthenticated, "Bearer token is invalid or expired")
+			return
+		}
+
+		if apiKey := r.Header.Get("x-api-key"); apiKey != "" {
+			if identityName, identity, ok := s.authenticateApiKey(apiKey); ok {
+				accessKey, secretKey, _ := strings.Cut(apiKey, ":")
+				ctx := r.Context()
+				ctx = s3_constants.SetIdentityNameInContext(ctx, identityName)
+				ctx = s3_constants.SetAccessKeyIdInContext(ctx, accessKey)
+				ctx = s3_constants.SetStoredAccessKeyIdInContext(ctx, accessKey, secretKey)
+				if identity != nil {
+					ctx = s3_constants.SetIdentityInContext(ctx, identity)
+				}
+				r = r.WithContext(ctx)
+				handler(w, r)
+				return
+			}
+			writeError(w, r, http.StatusUnauthorized, codeUnauthenticated, "invalid x-api-key")
+			return
+		}
+
+		if s.authenticator == nil {
+			writeError(w, r, http.StatusUnauthorized, codeUnauthenticated, "authentication required")
+			return
+		}
+
+		// The verifier records the key of the credential that matched into
+		// this holder; the vended credentials name it.
+		r = s3_constants.EnsureIdentityHolder(r)
+		identityName, identity, errCode := s.authenticator.AuthenticateRequest(r)
+		if errCode != s3err.ErrNone {
+			apiErr := s3err.GetAPIError(errCode)
+			code := codeInternal
+			switch apiErr.HTTPStatusCode {
+			case http.StatusForbidden:
+				code = codePermissionDenied
+			case http.StatusUnauthorized:
+				code = codeUnauthenticated
+			case http.StatusBadRequest:
+				code = codeInvalidInput
+			}
+			writeError(w, r, apiErr.HTTPStatusCode, code, apiErr.Description)
+			return
+		}
+
+		if identityName != "" || identity != nil {
+			ctx := r.Context()
+			if identityName != "" {
+				ctx = s3_constants.SetIdentityNameInContext(ctx, identityName)
+			}
+			if identity != nil {
+				ctx = s3_constants.SetIdentityInContext(ctx, identity)
+			}
+			r = r.WithContext(ctx)
+		}
+
+		handler(w, r)
+	}
+}
diff --git a/weed/s3api/lance/server_access_key_test.go b/weed/s3api/lance/server_access_key_test.go
new file mode 100644
index 0000000000..3013256453
--- /dev/null
+++ b/weed/s3api/lance/server_access_key_test.go
@@ -0,0 +1,69 @@
+package lance
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// keyedS3Authenticator accepts every request as one identity and records the
+// key that verified into the request's holder, as S3ApiServer's verifiers do.
+type keyedS3Authenticator struct {
+	mockS3Authenticator
+	accessKey string
+}
+
+func (k *keyedS3Authenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) {
+	s3_constants.RecordAccessKeyId(r.Context(), k.accessKey)
+	return "s3user", nil, s3err.ErrNone
+}
+
+func accessKeySeenByHandler(t *testing.T, s *Server, req *http.Request) string {
+	t.Helper()
+	gotKey := "unset"
+	handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+		gotKey = s3_constants.GetAccessKeyIdFromContext(r)
+		w.WriteHeader(http.StatusOK)
+	})
+	rec := httptest.NewRecorder()
+	handler(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rec.Code)
+	}
+	return gotKey
+}
+
+// Each way a Lance client authenticates leaves the access key it used in the
+// request context, so the credentials it vends can name that key.
+func TestAuthRecordsTheCallersAccessKey(t *testing.T) {
+	now := time.Now()
+
+	s := newTestServerWithOAuth()
+	req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	req.Header.Set("Authorization", "Bearer "+mintTestToken(t, "AKID123", "secret456", now, now.Add(time.Hour)))
+	if got := accessKeySeenByHandler(t, s, req); got != "AKID123" {
+		t.Errorf("Bearer: access key in context = %q, want AKID123", got)
+	}
+
+	req = httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	req.Header.Set("x-api-key", "AKID123:secret456")
+	if got := accessKeySeenByHandler(t, s, req); got != "AKID123" {
+		t.Errorf("x-api-key: access key in context = %q, want AKID123", got)
+	}
+
+	s.authenticator = &keyedS3Authenticator{accessKey: "AKIDSIGV4"}
+	req = httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	if got := accessKeySeenByHandler(t, s, req); got != "AKIDSIGV4" {
+		t.Errorf("SigV4: access key in context = %q, want AKIDSIGV4", got)
+	}
+
+	s.authenticator = &mockS3Authenticator{}
+	req = httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+	if got := accessKeySeenByHandler(t, s, req); got != "" {
+		t.Errorf("authenticator without a key: access key in context = %q, want none", got)
+	}
+}
diff --git a/weed/s3api/lance/storage.go b/weed/s3api/lance/storage.go
new file mode 100644
index 0000000000..c4ccd67385
--- /dev/null
+++ b/weed/s3api/lance/storage.go
@@ -0,0 +1,203 @@
+package lance
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+const defaultPageSize = 1000
+
+// execute runs one S3 Tables operation as the request's authenticated caller.
+func (s *Server) execute(r *http.Request, operation string, req, resp interface{}) error {
+	identityName := s3_constants.GetIdentityNameFromContext(r)
+	return s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return s.tablesManager.Execute(r.Context(), s3tables.NewManagerClient(client), operation, req, resp, identityName)
+	})
+}
+
+func bucketARN(bucket string) string {
+	arn, _ := s3tables.BuildBucketARN(s3tables.DefaultRegion, s3_constants.AccountAdminId, bucket)
+	return arn
+}
+
+// maxRequestBody bounds what one call can make the catalog hold. Every request
+// this surface takes is a small JSON envelope; the largest carries a set of
+// properties, not data.
+const maxRequestBody = 4 << 20
+
+// decodeBody reads an optional JSON request body. Every Lance operation carries
+// one, but the fields that matter are also in the route, so an empty body is
+// not an error.
+func decodeBody(r *http.Request, into interface{}) error {
+	body, err := io.ReadAll(io.LimitReader(r.Body, maxRequestBody+1))
+	if err != nil {
+		return fmt.Errorf("read request body: %w", err)
+	}
+	if len(body) > maxRequestBody {
+		return fmt.Errorf("request body is larger than %d bytes", maxRequestBody)
+	}
+	if len(strings.TrimSpace(string(body))) == 0 {
+		return nil
+	}
+	if err := json.Unmarshal(body, into); err != nil {
+		return fmt.Errorf("invalid request body: %w", err)
+	}
+	return nil
+}
+
+// routeIdentifier parses the {id} route variable, writing the error response
+// itself when the identifier is malformed.
+func routeIdentifier(w http.ResponseWriter, r *http.Request) (identifier, string, bool) {
+	delimiter := requestDelimiter(r)
+	id, err := parseIdentifier(mux.Vars(r)["id"], delimiter)
+	if err != nil {
+		writeError(w, r, http.StatusBadRequest, codeInvalidInput, err.Error())
+		return nil, delimiter, false
+	}
+	return id, delimiter, true
+}
+
+// checkBodyIdentifier enforces the spec rule that a route and a body naming
+// different objects is a bad request rather than a silent preference.
+func checkBodyIdentifier(w http.ResponseWriter, r *http.Request, id identifier, body []string) bool {
+	if id.matchesBody(body) {
+		return true
+	}
+	writeError(w, r, http.StatusBadRequest, codeInvalidInput,
+		"the identifier in the request body does not match the one in the route")
+	return false
+}
+
+func pageSize(r *http.Request) int {
+	if raw := r.URL.Query().Get("limit"); raw != "" {
+		if parsed, err := strconv.Atoi(raw); err == nil && parsed > 0 {
+			return parsed
+		}
+	}
+	return defaultPageSize
+}
+
+func boolQuery(r *http.Request, name string) bool {
+	value, err := strconv.ParseBool(r.URL.Query().Get(name))
+	return err == nil && value
+}
+
+// wants resolves a tri-state request flag: the query parameter the REST spec
+// adds, else the body field, else the implementation's own choice.
+func wants(r *http.Request, name string, body *bool) bool {
+	if boolQuery(r, name) {
+		return true
+	}
+	return body != nil && *body
+}
+
+// tableLocation is where a table's dataset lives when the caller does not name
+// a location. It mirrors the Iceberg catalog's layout so both catalogs put a
+// table of the same name in the same place.
+func tableLocation(bucket string, ns []string, name string) string {
+	return fmt.Sprintf("s3://%s/%s/%s", bucket, strings.Join(ns, "."), name)
+}
+
+// confineLocation rejects a client-supplied table location that does not resolve
+// inside the caller's own bucket, the way the Iceberg gateway confines the same
+// field. The location feeds TableDataDirFromMetadataLocation, which joins it
+// under /buckets and collapses any "../" segments; an unconfined location lets a
+// marker write escape into another tenant's namespace.
+func confineLocation(bucket, location string) error {
+	rest, ok := strings.CutPrefix(location, "s3://")
+	if !ok {
+		return fmt.Errorf("location must be an s3:// URI")
+	}
+	name, keys, _ := strings.Cut(rest, "/")
+	if name != bucket {
+		return fmt.Errorf("location must be within bucket %s", bucket)
+	}
+	for _, segment := range strings.Split(keys, "/") {
+		switch {
+		case segment == "." || segment == "..":
+			return fmt.Errorf("location must not contain a path traversal segment")
+		case strings.ContainsAny(segment, "\\\x00"):
+			return fmt.Errorf("location contains an invalid character")
+		}
+	}
+	return nil
+}
+
+// storageOptions builds the object_store settings a Lance client needs to reach
+// the dataset. The key names are the aws_-prefixed forms Lance clients pass
+// through to object_store.
+func (s *Server) storageOptions(r *http.Request, bucket, location string, vend bool, canWrite func() bool) (map[string]string, error) {
+	options := map[string]string{}
+	if s.s3Endpoint != "" {
+		options["aws_endpoint"] = s.s3Endpoint
+		if strings.HasPrefix(s.s3Endpoint, "http://") {
+			// object_store refuses a plaintext endpoint unless told to allow it,
+			// and the resulting failure reads like a credential problem.
+			options["allow_http"] = "true"
+		}
+	}
+	if s.s3Region != "" {
+		options["aws_region"] = s.s3Region
+	}
+
+	if !vend || s.credentialVendor == nil {
+		return options, nil
+	}
+
+	principal := s3_constants.GetIdentityNameFromContext(r)
+	credentials, err := s.credentialVendor.VendTableCredentials(r.Context(), principal, bucket, locationPrefix(location), canWrite == nil || !canWrite())
+	if err != nil {
+		return nil, err
+	}
+	if credentials == nil {
+		return options, nil
+	}
+	options["aws_access_key_id"] = credentials.AccessKeyID
+	options["aws_secret_access_key"] = credentials.SecretAccessKey
+	if credentials.SessionToken != "" {
+		options["aws_session_token"] = credentials.SessionToken
+	}
+	if !credentials.Expiration.IsZero() {
+		options["expires_at_millis"] = strconv.FormatInt(credentials.Expiration.UnixMilli(), 10)
+	}
+	return options, nil
+}
+
+// mayUpdateTable reports whether the caller may commit to the table the
+// credentials would cover, the same gate the Iceberg catalog applies so a
+// read-only caller never gets write-capable storage_options.
+func (s *Server) mayUpdateTable(r *http.Request, bucket string, ns []string, name string) bool {
+	req := &s3tables.UpdateTableRequest{
+		TableBucketARN: bucketARN(bucket),
+		Namespace:      ns,
+		Name:           name,
+	}
+	identityName := s3_constants.GetIdentityNameFromContext(r)
+	err := s.filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return s.tablesManager.AuthorizeUpdateTable(r.Context(), s3tables.NewManagerClient(client), req, identityName)
+	})
+	if err != nil {
+		glog.V(1).Infof("lance: UpdateTable check for %s/%s failed, vending read-only: %v", bucket, name, err)
+	}
+	return err == nil
+}
+
+// locationPrefix strips the s3://bucket/ part of a location, leaving the key
+// prefix a credential is scoped to.
+func locationPrefix(location string) string {
+	trimmed := strings.TrimPrefix(location, "s3://")
+	if _, prefix, found := strings.Cut(trimmed, "/"); found {
+		return prefix
+	}
+	return ""
+}
diff --git a/weed/s3api/lance/types.go b/weed/s3api/lance/types.go
new file mode 100644
index 0000000000..0f5ababb31
--- /dev/null
+++ b/weed/s3api/lance/types.go
@@ -0,0 +1,149 @@
+// Package lance serves the Lance Namespace REST spec over the same table
+// buckets the Iceberg REST catalog uses. A Lance table is a catalog entry with
+// format LANCE: the namespace records where the dataset lives and vends
+// credentials for it, and the Lance client owns everything under that location.
+package lance
+
+// Modes shared by create and register. The spec matches them case-insensitively
+// and accepts both PascalCase and snake_case.
+const (
+	modeCreate    = "create"
+	modeExistOk   = "existok"
+	modeOverwrite = "overwrite"
+	modeFail      = "fail"
+	modeSkip      = "skip"
+
+	behaviorRestrict = "restrict"
+	behaviorCascade  = "cascade"
+)
+
+type CreateNamespaceRequest struct {
+	ID         []string          `json:"id,omitempty"`
+	Mode       string            `json:"mode,omitempty"`
+	Properties map[string]string `json:"properties,omitempty"`
+}
+
+type CreateNamespaceResponse struct {
+	Properties map[string]string `json:"properties"`
+}
+
+type ListNamespacesResponse struct {
+	Namespaces []string `json:"namespaces"`
+	PageToken  string   `json:"page_token,omitempty"`
+}
+
+type DescribeNamespaceRequest struct {
+	ID []string `json:"id,omitempty"`
+}
+
+type DescribeNamespaceResponse struct {
+	Properties map[string]string `json:"properties"`
+}
+
+type DropNamespaceRequest struct {
+	ID       []string `json:"id,omitempty"`
+	Mode     string   `json:"mode,omitempty"`
+	Behavior string   `json:"behavior,omitempty"`
+}
+
+type DropNamespaceResponse struct {
+	Properties map[string]string `json:"properties,omitempty"`
+}
+
+type NamespaceExistsRequest struct {
+	ID []string `json:"id,omitempty"`
+}
+
+type ListTablesResponse struct {
+	Tables    []string `json:"tables"`
+	PageToken string   `json:"page_token,omitempty"`
+}
+
+type DeclareTableRequest struct {
+	ID              []string          `json:"id,omitempty"`
+	Location        string            `json:"location,omitempty"`
+	VendCredentials *bool             `json:"vend_credentials,omitempty"`
+	Properties      map[string]string `json:"properties,omitempty"`
+}
+
+type DeclareTableResponse struct {
+	Location       string            `json:"location"`
+	StorageOptions map[string]string `json:"storage_options,omitempty"`
+	// Properties are null rather than {}: the catalog does not keep a table's
+	// properties, and {} would claim it kept them and found none.
+	Properties map[string]string `json:"properties"`
+	// ManagedVersioning stays false: the dataset owns its version history,
+	// because this store can order commits without the catalog in the path.
+	ManagedVersioning bool `json:"managed_versioning"`
+}
+
+type DescribeTableRequest struct {
+	ID      []string `json:"id,omitempty"`
+	Version *int64   `json:"version,omitempty"`
+	Tag     string   `json:"tag,omitempty"`
+	Branch  string   `json:"branch,omitempty"`
+	// The REST spec carries these as query parameters, but clients also put
+	// them in the body, so honour both.
+	WithTableURI         *bool `json:"with_table_uri,omitempty"`
+	LoadDetailedMetadata *bool `json:"load_detailed_metadata,omitempty"`
+	CheckDeclared        *bool `json:"check_declared,omitempty"`
+	VendCredentials      *bool `json:"vend_credentials,omitempty"`
+}
+
+type DescribeTableResponse struct {
+	Table          string            `json:"table,omitempty"`
+	Namespace      []string          `json:"namespace,omitempty"`
+	Version        *int64            `json:"version,omitempty"`
+	Location       string            `json:"location"`
+	TableURI       string            `json:"table_uri,omitempty"`
+	StorageOptions map[string]string `json:"storage_options,omitempty"`
+	// Null, not {}: this catalog does not keep a table's properties.
+	Properties map[string]string `json:"properties"`
+	// ManagedVersioning stays false: the dataset owns its version history,
+	// because this store can order commits without the catalog in the path.
+	ManagedVersioning bool  `json:"managed_versioning"`
+	IsOnlyDeclared    *bool `json:"is_only_declared,omitempty"`
+}
+
+type TableExistsRequest struct {
+	ID []string `json:"id,omitempty"`
+}
+
+type RegisterTableRequest struct {
+	ID         []string          `json:"id,omitempty"`
+	Location   string            `json:"location"`
+	Mode       string            `json:"mode,omitempty"`
+	Properties map[string]string `json:"properties,omitempty"`
+}
+
+type RegisterTableResponse struct {
+	Location   string            `json:"location"`
+	Properties map[string]string `json:"properties"`
+}
+
+type DeregisterTableRequest struct {
+	ID []string `json:"id,omitempty"`
+}
+
+type DeregisterTableResponse struct {
+	ID         []string          `json:"id"`
+	Location   string            `json:"location"`
+	Properties map[string]string `json:"properties"`
+}
+
+type DropTableRequest struct {
+	ID []string `json:"id,omitempty"`
+}
+
+type DropTableResponse struct {
+	ID         []string          `json:"id"`
+	Location   string            `json:"location"`
+	Properties map[string]string `json:"properties"`
+}
+
+type RenameTableRequest struct {
+	ID    []string `json:"id,omitempty"`
+	NewID []string `json:"new_id"`
+}
+
+type RenameTableResponse struct{}
diff --git a/weed/s3api/lifecycle_xml/canonical.go b/weed/s3api/lifecycle_xml/canonical.go
index 6c930b790b..919bd325b3 100644
--- a/weed/s3api/lifecycle_xml/canonical.go
+++ b/weed/s3api/lifecycle_xml/canonical.go
@@ -3,6 +3,7 @@ package lifecycle_xml
 import (
 	"bytes"
 	"encoding/xml"
+	"sort"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
 )
@@ -81,6 +82,146 @@ func ruleToCanonical(r *Rule) *s3lifecycle.Rule {
 	return out
 }
 
+// CanonicalToLifecycle is the inverse of LifecycleToCanonical: it builds a
+// marshalable Lifecycle from the engine's flat Rule shape. Only the fields
+// s3lifecycle.Rule can represent are populated — there is no way back to
+// Transition / NoncurrentVersionTransition, which the canonical form never
+// carries.
+func CanonicalToLifecycle(rules []*s3lifecycle.Rule) *Lifecycle {
+	lc := &Lifecycle{
+		Rules: make([]Rule, 0, len(rules)),
+	}
+	for _, r := range rules {
+		lc.Rules = append(lc.Rules, ruleFromCanonical(r))
+	}
+	return lc
+}
+
+// s3XMLNamespace is the namespace every S3 client stamps on a lifecycle
+// document it PUTs. GetBucketLifecycleConfiguration replays the stored bytes
+// verbatim, so a document written here has to carry it too or it would come
+// back stripped of a namespace the client-written ones have.
+const s3XMLNamespace = "http://s3.amazonaws.com/doc/2006-03-01/"
+
+// MarshalCanonical serializes the canonical rules straight to a
+// BucketLifecycleConfiguration XML document, mirroring ParseCanonical.
+func MarshalCanonical(rules []*s3lifecycle.Rule) ([]byte, error) {
+	lc := CanonicalToLifecycle(rules)
+	out, err := xml.Marshal(struct {
+		Lifecycle
+		XMLNS string `xml:"xmlns,attr"`
+	}{Lifecycle: *lc, XMLNS: s3XMLNamespace})
+	if err != nil {
+		return nil, err
+	}
+	return append([]byte(xml.Header), out...), nil
+}
+
+func ruleFromCanonical(r *s3lifecycle.Rule) Rule {
+	out := Rule{
+		ID:     r.ID,
+		Status: RuleStatus(r.Status),
+		Filter: filterFromCanonical(r.Prefix, r.FilterTags, r.FilterSizeGreaterThan, r.FilterSizeLessThan),
+	}
+
+	if r.ExpirationDays > 0 || !r.ExpirationDate.IsZero() || r.ExpiredObjectDeleteMarker {
+		out.Expiration = Expiration{
+			set:  true,
+			Days: r.ExpirationDays,
+		}
+		if !r.ExpirationDate.IsZero() {
+			out.Expiration.Date = ExpirationDate{Time: r.ExpirationDate}
+		}
+		if r.ExpiredObjectDeleteMarker {
+			out.Expiration.DeleteMarker = ExpireDeleteMarker{val: true, set: true}
+		}
+	}
+
+	if r.NoncurrentVersionExpirationDays > 0 || r.NewerNoncurrentVersions > 0 {
+		out.NoncurrentVersionExpiration = NoncurrentVersionExpiration{
+			set:                     true,
+			NoncurrentDays:          r.NoncurrentVersionExpirationDays,
+			NewerNoncurrentVersions: r.NewerNoncurrentVersions,
+		}
+	}
+
+	if r.AbortMPUDaysAfterInitiation > 0 {
+		out.AbortIncompleteMultipartUpload = AbortIncompleteMultipartUpload{
+			set:                 true,
+			DaysAfterInitiation: r.AbortMPUDaysAfterInitiation,
+		}
+	}
+
+	return out
+}
+
+// filterFromCanonical is the inverse of flattenFilter: it picks the
+// narrowest Filter shape that represents the given prefix/tags/size bounds,
+// matching what Filter.MarshalXML (single Prefix|Tag branch plus optional
+// size bounds) and its And branch can each express.
+func filterFromCanonical(prefix string, tags map[string]string, sizeGT, sizeLT int64) Filter {
+	hasSize := sizeGT > 0 || sizeLT > 0
+
+	// <Filter> holds exactly one predicate; anything more goes under <And>,
+	// two size bounds included, which is the form AWS documents for a range.
+	discriminants := 0
+	if prefix != "" {
+		discriminants++
+	}
+	discriminants += len(tags)
+	if sizeGT > 0 {
+		discriminants++
+	}
+	if sizeLT > 0 {
+		discriminants++
+	}
+
+	f := Filter{set: true, ObjectSizeGreaterThan: sizeGT, ObjectSizeLessThan: sizeLT}
+
+	switch {
+	case discriminants > 1:
+		f.andSet = true
+		f.And = And{
+			ObjectSizeGreaterThan: sizeGT,
+			ObjectSizeLessThan:    sizeLT,
+		}
+		if prefix != "" {
+			f.And.Prefix = NewPrefix(prefix)
+		}
+		if len(tags) > 0 {
+			keys := make([]string, 0, len(tags))
+			for k := range tags {
+				keys = append(keys, k)
+			}
+			sort.Strings(keys)
+			f.And.Tags = make([]Tag, 0, len(keys))
+			for _, k := range keys {
+				f.And.Tags = append(f.And.Tags, Tag{Key: k, Value: tags[k]})
+			}
+		}
+		// The And branch carries its own size bounds; the enclosing
+		// Filter only emits them on the non-And path (see
+		// Filter.MarshalXML), so clear them here to avoid duplication.
+		f.ObjectSizeGreaterThan = 0
+		f.ObjectSizeLessThan = 0
+	case len(tags) == 1:
+		f.tagSet = true
+		for k, v := range tags {
+			f.Tag = Tag{Key: k, Value: v}
+		}
+	case hasSize:
+		// Single discriminant and it's a size range: the bounds set above
+		// already cover it — no <Prefix> (not even an empty one; nothing
+		// was requested) and no <And> (nothing else to combine with).
+	default:
+		// Either a single prefix or no discriminant at all (whole-bucket
+		// filter) — both are expressed as a <Prefix> element, empty or not.
+		f.Prefix = NewPrefix(prefix)
+	}
+
+	return f
+}
+
 func flattenFilter(f *Filter) (prefix string, tags map[string]string, sizeGT, sizeLT int64) {
 	if !f.set {
 		return
diff --git a/weed/s3api/lifecycle_xml/round_trip_test.go b/weed/s3api/lifecycle_xml/round_trip_test.go
index ca4d053068..52e34f464f 100644
--- a/weed/s3api/lifecycle_xml/round_trip_test.go
+++ b/weed/s3api/lifecycle_xml/round_trip_test.go
@@ -4,6 +4,9 @@ import (
 	"encoding/xml"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
 )
 
 func TestLifecycleXMLRoundTrip_NoncurrentVersionExpiration(t *testing.T) {
@@ -274,3 +277,323 @@ func TestLifecycleXMLRoundTrip_CompleteRule(t *testing.T) {
 		}
 	}
 }
+
+// assertCanonicalRoundTrip drives a canonical rule through
+// CanonicalToLifecycle -> MarshalCanonical -> ParseCanonical and checks the
+// result matches the input, proving the admin write path (which only ever
+// has the canonical form) produces XML the S3 API can read back unchanged.
+func assertCanonicalRoundTrip(t *testing.T, in *s3lifecycle.Rule) *s3lifecycle.Rule {
+	t.Helper()
+
+	xmlBytes, err := MarshalCanonical([]*s3lifecycle.Rule{in})
+	if err != nil {
+		t.Fatalf("MarshalCanonical: %v", err)
+	}
+
+	out, err := ParseCanonical(xmlBytes)
+	if err != nil {
+		t.Fatalf("ParseCanonical(%s): %v", xmlBytes, err)
+	}
+	if len(out) != 1 {
+		t.Fatalf("expected 1 rule after round trip, got %d: %s", len(out), xmlBytes)
+	}
+	return out[0]
+}
+
+func TestCanonicalRoundTrip_WholeBucket(t *testing.T) {
+	in := &s3lifecycle.Rule{ID: "whole-bucket", Status: s3lifecycle.StatusEnabled, ExpirationDays: 30}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Prefix != "" {
+		t.Errorf("expected empty prefix, got %q", out.Prefix)
+	}
+	if out.ExpirationDays != 30 {
+		t.Errorf("expected ExpirationDays=30, got %d", out.ExpirationDays)
+	}
+}
+
+func TestCanonicalRoundTrip_PrefixOnly(t *testing.T) {
+	in := &s3lifecycle.Rule{ID: "prefix-only", Status: s3lifecycle.StatusEnabled, Prefix: "logs/", ExpirationDays: 7}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Prefix != "logs/" {
+		t.Errorf("expected prefix 'logs/', got %q", out.Prefix)
+	}
+	if len(out.FilterTags) != 0 {
+		t.Errorf("expected no tags, got %v", out.FilterTags)
+	}
+}
+
+func TestCanonicalRoundTrip_TagOnly(t *testing.T) {
+	in := &s3lifecycle.Rule{
+		ID:             "tag-only",
+		Status:         s3lifecycle.StatusEnabled,
+		FilterTags:     map[string]string{"env": "dev"},
+		ExpirationDays: 7,
+	}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Prefix != "" {
+		t.Errorf("expected empty prefix, got %q", out.Prefix)
+	}
+	if len(out.FilterTags) != 1 || out.FilterTags["env"] != "dev" {
+		t.Errorf("expected tags {env:dev}, got %v", out.FilterTags)
+	}
+}
+
+func TestCanonicalRoundTrip_PrefixAndTags(t *testing.T) {
+	in := &s3lifecycle.Rule{
+		ID:             "prefix-and-tags",
+		Status:         s3lifecycle.StatusEnabled,
+		Prefix:         "logs/",
+		FilterTags:     map[string]string{"env": "dev", "tier": "hot"},
+		ExpirationDays: 7,
+	}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Prefix != "logs/" {
+		t.Errorf("expected prefix 'logs/', got %q", out.Prefix)
+	}
+	if len(out.FilterTags) != 2 || out.FilterTags["env"] != "dev" || out.FilterTags["tier"] != "hot" {
+		t.Errorf("expected tags {env:dev, tier:hot}, got %v", out.FilterTags)
+	}
+}
+
+func TestCanonicalRoundTrip_SizeBounds(t *testing.T) {
+	in := &s3lifecycle.Rule{
+		ID:                    "size-bounds",
+		Status:                s3lifecycle.StatusEnabled,
+		FilterSizeGreaterThan: 512,
+		FilterSizeLessThan:    1048576,
+		ExpirationDays:        30,
+	}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.FilterSizeGreaterThan != 512 {
+		t.Errorf("expected FilterSizeGreaterThan=512, got %d", out.FilterSizeGreaterThan)
+	}
+	if out.FilterSizeLessThan != 1048576 {
+		t.Errorf("expected FilterSizeLessThan=1048576, got %d", out.FilterSizeLessThan)
+	}
+}
+
+func TestCanonicalRoundTrip_PrefixAndTagsWithSizeBounds(t *testing.T) {
+	// Multiple discriminants (prefix + tags) force the <And> branch, which
+	// carries its own size bounds distinct from the single-branch Filter.
+	in := &s3lifecycle.Rule{
+		ID:                    "and-with-size",
+		Status:                s3lifecycle.StatusEnabled,
+		Prefix:                "logs/",
+		FilterTags:            map[string]string{"env": "dev"},
+		FilterSizeGreaterThan: 1024,
+		FilterSizeLessThan:    2048,
+		ExpirationDays:        7,
+	}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Prefix != "logs/" || len(out.FilterTags) != 1 {
+		t.Errorf("expected prefix 'logs/' and 1 tag, got prefix=%q tags=%v", out.Prefix, out.FilterTags)
+	}
+	if out.FilterSizeGreaterThan != 1024 || out.FilterSizeLessThan != 2048 {
+		t.Errorf("expected size bounds 1024/2048, got %d/%d", out.FilterSizeGreaterThan, out.FilterSizeLessThan)
+	}
+}
+
+func TestCanonicalRoundTrip_ExpirationDate(t *testing.T) {
+	date := time.Date(2030, 1, 15, 0, 0, 0, 0, time.UTC)
+	in := &s3lifecycle.Rule{ID: "expire-on-date", Status: s3lifecycle.StatusEnabled, ExpirationDate: date}
+	out := assertCanonicalRoundTrip(t, in)
+	if !out.ExpirationDate.Equal(date) {
+		t.Errorf("expected ExpirationDate=%v, got %v", date, out.ExpirationDate)
+	}
+}
+
+func TestCanonicalRoundTrip_ExpiredObjectDeleteMarker(t *testing.T) {
+	in := &s3lifecycle.Rule{ID: "delete-marker", Status: s3lifecycle.StatusEnabled, ExpiredObjectDeleteMarker: true}
+	out := assertCanonicalRoundTrip(t, in)
+	if !out.ExpiredObjectDeleteMarker {
+		t.Error("expected ExpiredObjectDeleteMarker=true")
+	}
+}
+
+func TestCanonicalRoundTrip_NoncurrentVersionExpiration(t *testing.T) {
+	in := &s3lifecycle.Rule{
+		ID:                              "noncurrent",
+		Status:                          s3lifecycle.StatusEnabled,
+		NoncurrentVersionExpirationDays: 30,
+		NewerNoncurrentVersions:         2,
+	}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.NoncurrentVersionExpirationDays != 30 {
+		t.Errorf("expected NoncurrentVersionExpirationDays=30, got %d", out.NoncurrentVersionExpirationDays)
+	}
+	if out.NewerNoncurrentVersions != 2 {
+		t.Errorf("expected NewerNoncurrentVersions=2, got %d", out.NewerNoncurrentVersions)
+	}
+}
+
+func TestCanonicalRoundTrip_AbortMultipartUpload(t *testing.T) {
+	in := &s3lifecycle.Rule{ID: "abort-mpu", Status: s3lifecycle.StatusEnabled, AbortMPUDaysAfterInitiation: 7}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.AbortMPUDaysAfterInitiation != 7 {
+		t.Errorf("expected AbortMPUDaysAfterInitiation=7, got %d", out.AbortMPUDaysAfterInitiation)
+	}
+}
+
+func TestCanonicalRoundTrip_Disabled(t *testing.T) {
+	in := &s3lifecycle.Rule{ID: "disabled-rule", Status: s3lifecycle.StatusDisabled, ExpirationDays: 30}
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Status != s3lifecycle.StatusDisabled {
+		t.Errorf("expected Status=Disabled, got %q", out.Status)
+	}
+}
+
+func TestCanonicalRoundTrip_TagOrderIsStable(t *testing.T) {
+	// FilterTags is a map; And.Tags must be emitted in a deterministic
+	// (sorted) order so re-saving an unchanged rule doesn't churn the
+	// stored XML.
+	in := &s3lifecycle.Rule{
+		ID:         "stable-order",
+		Status:     s3lifecycle.StatusEnabled,
+		Prefix:     "logs/",
+		FilterTags: map[string]string{"zeta": "1", "alpha": "2", "mu": "3"},
+	}
+
+	var firstXML []byte
+	for i := 0; i < 5; i++ {
+		xmlBytes, err := MarshalCanonical([]*s3lifecycle.Rule{in})
+		if err != nil {
+			t.Fatalf("MarshalCanonical: %v", err)
+		}
+		if i == 0 {
+			firstXML = xmlBytes
+			continue
+		}
+		if string(xmlBytes) != string(firstXML) {
+			t.Fatalf("marshal output is not stable across runs:\n%s\nvs\n%s", firstXML, xmlBytes)
+		}
+	}
+	if !strings.Contains(string(firstXML), "<Tag><Key>alpha</Key>") {
+		t.Errorf("expected tags sorted alphabetically (alpha first), got: %s", firstXML)
+	}
+}
+
+func TestCanonicalRoundTrip_PrefixWithSizeBoundsUsesAnd(t *testing.T) {
+	// A size range paired with a prefix is two different attributes, which
+	// requires <And> — unlike a size range alone (see
+	// TestCanonicalRoundTrip_SizeBounds), which doesn't need one.
+	in := &s3lifecycle.Rule{
+		ID:                    "prefix-with-size",
+		Status:                s3lifecycle.StatusEnabled,
+		Prefix:                "logs/",
+		FilterSizeGreaterThan: 1024,
+		ExpirationDays:        7,
+	}
+
+	xmlBytes, err := MarshalCanonical([]*s3lifecycle.Rule{in})
+	if err != nil {
+		t.Fatalf("MarshalCanonical: %v", err)
+	}
+	if !strings.Contains(string(xmlBytes), "<And>") {
+		t.Errorf("expected prefix+size to be wrapped in <And>, got: %s", xmlBytes)
+	}
+
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Prefix != "logs/" {
+		t.Errorf("expected prefix 'logs/', got %q", out.Prefix)
+	}
+	if out.FilterSizeGreaterThan != 1024 {
+		t.Errorf("expected FilterSizeGreaterThan=1024, got %d", out.FilterSizeGreaterThan)
+	}
+}
+
+func TestCanonicalRoundTrip_TagWithSizeBoundsUsesAnd(t *testing.T) {
+	in := &s3lifecycle.Rule{
+		ID:                 "tag-with-size",
+		Status:             s3lifecycle.StatusEnabled,
+		FilterTags:         map[string]string{"env": "dev"},
+		FilterSizeLessThan: 2048,
+		ExpirationDays:     7,
+	}
+
+	xmlBytes, err := MarshalCanonical([]*s3lifecycle.Rule{in})
+	if err != nil {
+		t.Fatalf("MarshalCanonical: %v", err)
+	}
+	if !strings.Contains(string(xmlBytes), "<And>") {
+		t.Errorf("expected tag+size to be wrapped in <And>, got: %s", xmlBytes)
+	}
+
+	out := assertCanonicalRoundTrip(t, in)
+	if len(out.FilterTags) != 1 || out.FilterTags["env"] != "dev" {
+		t.Errorf("expected tags {env:dev}, got %v", out.FilterTags)
+	}
+	if out.FilterSizeLessThan != 2048 {
+		t.Errorf("expected FilterSizeLessThan=2048, got %d", out.FilterSizeLessThan)
+	}
+}
+
+func TestCanonicalRoundTrip_SizeOnlyOmitsPrefixElement(t *testing.T) {
+	// A size-only filter must not stamp a spurious empty <Prefix> — nothing
+	// was requested, so nothing besides the size bounds should appear.
+	in := &s3lifecycle.Rule{
+		ID:                    "size-only-no-prefix",
+		Status:                s3lifecycle.StatusEnabled,
+		FilterSizeGreaterThan: 512,
+		ExpirationDays:        7,
+	}
+
+	xmlBytes, err := MarshalCanonical([]*s3lifecycle.Rule{in})
+	if err != nil {
+		t.Fatalf("MarshalCanonical: %v", err)
+	}
+	if strings.Contains(string(xmlBytes), "<Prefix>") {
+		t.Errorf("expected no <Prefix> element for a size-only filter, got: %s", xmlBytes)
+	}
+
+	out := assertCanonicalRoundTrip(t, in)
+	if out.Prefix != "" {
+		t.Errorf("expected empty prefix, got %q", out.Prefix)
+	}
+	if out.FilterSizeGreaterThan != 512 {
+		t.Errorf("expected FilterSizeGreaterThan=512, got %d", out.FilterSizeGreaterThan)
+	}
+}
+
+func TestCanonicalRoundTrip_SizeRangeUsesAnd(t *testing.T) {
+	// <Filter> holds one predicate; a range is two, so it belongs under <And>,
+	// which is the form AWS documents.
+	in := &s3lifecycle.Rule{
+		ID:                    "size-range",
+		Status:                s3lifecycle.StatusEnabled,
+		FilterSizeGreaterThan: 512,
+		FilterSizeLessThan:    1048576,
+		ExpirationDays:        30,
+	}
+
+	xmlBytes, err := MarshalCanonical([]*s3lifecycle.Rule{in})
+	if err != nil {
+		t.Fatalf("MarshalCanonical: %v", err)
+	}
+	if !strings.Contains(string(xmlBytes), "<And><ObjectSizeGreaterThan>512</ObjectSizeGreaterThan><ObjectSizeLessThan>1048576</ObjectSizeLessThan></And>") {
+		t.Errorf("expected both size bounds under <And>, got: %s", xmlBytes)
+	}
+
+	out := assertCanonicalRoundTrip(t, in)
+	if out.FilterSizeGreaterThan != 512 || out.FilterSizeLessThan != 1048576 {
+		t.Errorf("expected the size range to survive the round trip, got %+v", out)
+	}
+}
+
+func TestMarshalCanonical_CarriesTheS3Namespace(t *testing.T) {
+	// GetBucketLifecycleConfiguration replays these bytes verbatim, so a
+	// document written here has to look like one a client PUT.
+	xmlBytes, err := MarshalCanonical([]*s3lifecycle.Rule{{
+		ID:             "ns",
+		Status:         s3lifecycle.StatusEnabled,
+		ExpirationDays: 1,
+	}})
+	if err != nil {
+		t.Fatalf("MarshalCanonical: %v", err)
+	}
+	if !strings.Contains(string(xmlBytes), `<LifecycleConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">`) {
+		t.Errorf("expected the S3 namespace on the root element, got: %s", xmlBytes)
+	}
+	if _, err := ParseCanonical(xmlBytes); err != nil {
+		t.Errorf("the namespaced document must still parse: %v", err)
+	}
+}
diff --git a/weed/s3api/policy_engine/README_POLICY_ENGINE.md b/weed/s3api/policy_engine/README_POLICY_ENGINE.md
index 9a5ab3b3c6..78e1df5545 100644
--- a/weed/s3api/policy_engine/README_POLICY_ENGINE.md
+++ b/weed/s3api/policy_engine/README_POLICY_ENGINE.md
@@ -125,6 +125,7 @@ Support for all AWS condition operators:
 - **Boolean**: `Bool`
 - **ARN**: `ArnEquals`, `ArnLike`
 - **Null**: `Null`
+- **Set qualifiers**: `ForAllValues:` and `ForAnyValue:` before any of the above, for multi-valued keys such as `s3:RequestObjectTagKeys`
 
 ### 4. Condition Keys
 
@@ -193,9 +194,13 @@ This allows anonymous access only to objects that have a tag `status=public`.
 **Supported Operations for Tag-Based Conditions:**
 
 Tag-based conditions (`s3:ExistingObjectTag/<key>`) are evaluated for the following operations:
-- `s3:GetObject` (GET object)
-- `s3:GetObjectVersion` (GET object with versionId)
-- `s3:HeadObject` (HEAD object)
+- `s3:GetObject` / `s3:GetObjectVersion` / `s3:HeadObject` (object reads, including the source of CopyObject, UploadPartCopy and RenameObject)
+- `s3:DeleteObject` / `s3:DeleteObjectVersion` (single and batch deletes)
+- `s3:GetObjectAcl` / `s3:PutObjectAcl`
+- `s3:GetObjectTagging` / `s3:PutObjectTagging` / `s3:DeleteObjectTagging`
+- `s3:GetObjectAttributes`
+- `s3:GetObjectRetention` / `s3:PutObjectRetention`
+- `s3:GetObjectLegalHold` / `s3:PutObjectLegalHold`
 
 Note: For these conditions to be evaluated, the object must exist and the policy engine re-checks access after fetching the object metadata.
 
@@ -352,6 +357,8 @@ The policy engine provides a seamless upgrade path from SeaweedFS's existing sim
 | `aws:SecureTransport` | Require HTTPS |
 | `aws:CurrentTime` | Time-based access control |
 | `s3:ExistingObjectTag/<key>` | Tag-based access control for existing objects |
+| `s3:RequestObjectTag/<key>` | Tag conditions on the tags a PUT request sets |
+| `s3:RequestObjectTagKeys` | The set of tag keys a PUT request sets |
 | Wildcard Patterns | Support for `*` and `?` in actions and resources |
 | Principal Matching | `*`, account IDs, and user ARNs |
 
@@ -359,8 +366,6 @@ The policy engine provides a seamless upgrade path from SeaweedFS's existing sim
 
 | Feature | GitHub Issue |
 |---------|--------------|
-| `s3:RequestObjectTag/<key>` | For tag conditions on PUT requests |
-| `s3:RequestObjectTagKeys` | Check which tag keys are in request |
 | `s3:x-amz-content-sha256` | Content hash condition |
 | `s3:x-amz-server-side-encryption` | SSE condition |
 | `s3:x-amz-storage-class` | Storage class condition |
diff --git a/weed/s3api/policy_engine/bucket_policy.go b/weed/s3api/policy_engine/bucket_policy.go
new file mode 100644
index 0000000000..aac1f4bd54
--- /dev/null
+++ b/weed/s3api/policy_engine/bucket_policy.go
@@ -0,0 +1,90 @@
+package policy_engine
+
+import (
+	"fmt"
+	"strings"
+)
+
+// MaxBucketPolicySize mirrors AWS S3's 20 KB bucket-policy limit, enforced
+// by both writers (the S3 gateway's PutBucketPolicy and the admin UI) so
+// neither surface can store a document the other refuses to manage.
+const MaxBucketPolicySize = 20 * 1024
+
+// ValidateBucketPolicy performs bucket-specific policy validation, on top of
+// the generic structural checks in ValidatePolicy - callers run that first,
+// so the version and non-empty-statement rules are not re-checked here. It
+// enforces the rules that make a policy document valid as an S3 *bucket*
+// policy specifically: every statement must name a Principal, and every
+// Resource/NotResource/Action must scope to the given bucket.
+//
+// This is shared between the S3 gateway's PutBucketPolicy handler
+// (weed/s3api/s3api_bucket_policy_handlers.go) and the admin UI
+// (weed/admin/dash) so both enforce identical rules.
+func ValidateBucketPolicy(policyDoc *PolicyDocument, bucket string) error {
+	for i, statement := range policyDoc.Statement {
+		// Bucket policies must have Principal
+		if statement.Principal == nil {
+			return fmt.Errorf("statement %d: bucket policies must specify a Principal", i)
+		}
+
+		// Validate resources refer to this bucket
+		for _, resource := range statement.Resource.Strings() {
+			if !ResourceMatchesBucket(resource, bucket) {
+				return fmt.Errorf("statement %d: resource %s does not match bucket %s", i, resource, bucket)
+			}
+		}
+
+		// Validate NotResources refer to this bucket
+		if statement.NotResource != nil {
+			for _, notResource := range statement.NotResource.Strings() {
+				if !ResourceMatchesBucket(notResource, bucket) {
+					return fmt.Errorf("statement %d: NotResource %s does not match bucket %s", i, notResource, bucket)
+				}
+			}
+		}
+
+		// Validate actions are S3 actions
+		for _, action := range statement.Action.Strings() {
+			if !strings.HasPrefix(action, "s3:") {
+				return fmt.Errorf("statement %d: bucket policies only support S3 actions, got %s", i, action)
+			}
+		}
+
+		for operator := range statement.Condition {
+			if _, err := GetConditionEvaluator(operator); err != nil {
+				return fmt.Errorf("statement %d: unsupported condition operator %q: %v", i, operator, err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// ResourceMatchesBucket checks if a resource ARN is valid for the given bucket.
+func ResourceMatchesBucket(resource, bucket string) bool {
+	// Accepted formats for S3 bucket policies:
+	// AWS-style ARNs (standard):
+	//   arn:aws:s3:::bucket-name
+	//   arn:aws:s3:::bucket-name/*
+	//   arn:aws:s3:::bucket-name/path/to/object
+	// Simplified formats (for convenience):
+	//   bucket-name
+	//   bucket-name/*
+	//   bucket-name/path/to/object
+
+	var resourcePath string
+	const awsPrefix = "arn:aws:s3:::"
+
+	// Strip the optional ARN prefix to get the resource path
+	if path, ok := strings.CutPrefix(resource, awsPrefix); ok {
+		resourcePath = path
+	} else {
+		resourcePath = resource
+	}
+
+	// After stripping the optional ARN prefix, the resource path must
+	// either match the bucket name exactly, or be a path within the bucket.
+	return resourcePath == bucket ||
+		resourcePath == bucket+"/*" ||
+		strings.HasPrefix(resourcePath, bucket+"/")
+}
diff --git a/weed/s3api/policy_engine/bucket_policy_test.go b/weed/s3api/policy_engine/bucket_policy_test.go
new file mode 100644
index 0000000000..0126850e95
--- /dev/null
+++ b/weed/s3api/policy_engine/bucket_policy_test.go
@@ -0,0 +1,108 @@
+package policy_engine
+
+import "testing"
+
+func TestResourceMatchesBucket(t *testing.T) {
+	tests := []struct {
+		name     string
+		resource string
+		bucket   string
+		want     bool
+	}{
+		{"bare bucket name", "my-bucket", "my-bucket", true},
+		{"bare wildcard", "my-bucket/*", "my-bucket", true},
+		{"bare object key", "my-bucket/path/to/key", "my-bucket", true},
+		{"arn bucket", "arn:aws:s3:::my-bucket", "my-bucket", true},
+		{"arn wildcard", "arn:aws:s3:::my-bucket/*", "my-bucket", true},
+		{"arn object key", "arn:aws:s3:::my-bucket/path/to/key", "my-bucket", true},
+		{"wrong bucket", "other-bucket", "my-bucket", false},
+		{"wrong bucket arn", "arn:aws:s3:::other-bucket/*", "my-bucket", false},
+		{"prefix collision", "my-bucket2", "my-bucket", false},
+		{"prefix collision arn", "arn:aws:s3:::my-bucket2/*", "my-bucket", false},
+		{"empty resource", "", "my-bucket", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := ResourceMatchesBucket(tt.resource, tt.bucket); got != tt.want {
+				t.Errorf("ResourceMatchesBucket(%q, %q) = %v, want %v", tt.resource, tt.bucket, got, tt.want)
+			}
+		})
+	}
+}
+
+func simpleAwsPrincipal() *PolicyPrincipal {
+	return NewPolicyPrincipalPtr("*")
+}
+
+func TestValidateBucketPolicy(t *testing.T) {
+	bucket := "my-bucket"
+
+	validStatement := func() PolicyStatement {
+		return PolicyStatement{
+			Effect:    PolicyEffectAllow,
+			Principal: simpleAwsPrincipal(),
+			Action:    NewStringOrStringSlice("s3:GetObject"),
+			Resource:  NewStringOrStringSlicePtr("arn:aws:s3:::" + bucket + "/*"),
+		}
+	}
+
+	t.Run("valid policy", func(t *testing.T) {
+		doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{validStatement()}}
+		if err := ValidateBucketPolicy(doc, bucket); err != nil {
+			t.Errorf("expected no error, got %v", err)
+		}
+	})
+
+	t.Run("bad version", func(t *testing.T) {
+		// Version and non-empty-statement rules live in ValidatePolicy,
+		// which callers run first.
+		doc := &PolicyDocument{Version: "2008-10-17", Statement: []PolicyStatement{validStatement()}}
+		if err := ValidatePolicy(doc); err == nil {
+			t.Error("expected error for bad version")
+		}
+	})
+
+	t.Run("zero statements", func(t *testing.T) {
+		doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{}}
+		if err := ValidatePolicy(doc); err == nil {
+			t.Error("expected error for zero statements")
+		}
+	})
+
+	t.Run("missing principal", func(t *testing.T) {
+		stmt := validStatement()
+		stmt.Principal = nil
+		doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}}
+		if err := ValidateBucketPolicy(doc, bucket); err == nil {
+			t.Error("expected error for missing principal")
+		}
+	})
+
+	t.Run("foreign resource", func(t *testing.T) {
+		stmt := validStatement()
+		stmt.Resource = NewStringOrStringSlicePtr("arn:aws:s3:::other-bucket/*")
+		doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}}
+		if err := ValidateBucketPolicy(doc, bucket); err == nil {
+			t.Error("expected error for foreign resource")
+		}
+	})
+
+	t.Run("foreign not-resource", func(t *testing.T) {
+		stmt := validStatement()
+		stmt.Resource = nil
+		stmt.NotResource = NewStringOrStringSlicePtr("arn:aws:s3:::other-bucket/*")
+		doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}}
+		if err := ValidateBucketPolicy(doc, bucket); err == nil {
+			t.Error("expected error for foreign NotResource")
+		}
+	})
+
+	t.Run("non-s3 action", func(t *testing.T) {
+		stmt := validStatement()
+		stmt.Action = NewStringOrStringSlice("iam:CreateUser")
+		doc := &PolicyDocument{Version: PolicyVersion2012_10_17, Statement: []PolicyStatement{stmt}}
+		if err := ValidateBucketPolicy(doc, bucket); err == nil {
+			t.Error("expected error for non-s3 action")
+		}
+	})
+}
diff --git a/weed/s3api/policy_engine/conditions.go b/weed/s3api/policy_engine/conditions.go
index af55b06c27..bfb7bf0b94 100644
--- a/weed/s3api/policy_engine/conditions.go
+++ b/weed/s3api/policy_engine/conditions.go
@@ -218,6 +218,36 @@ func (e *StringNotLikeEvaluator) Evaluate(conditionValue interface{}, contextVal
 	return true
 }
 
+// StringEqualsIgnoreCaseEvaluator evaluates StringEqualsIgnoreCase conditions
+type StringEqualsIgnoreCaseEvaluator struct{}
+
+func (e *StringEqualsIgnoreCaseEvaluator) Evaluate(conditionValue interface{}, contextValues []string) bool {
+	expectedValues := getCachedNormalizedValues(conditionValue)
+	for _, expected := range expectedValues {
+		for _, contextValue := range contextValues {
+			if strings.EqualFold(expected, contextValue) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// StringNotEqualsIgnoreCaseEvaluator evaluates StringNotEqualsIgnoreCase conditions
+type StringNotEqualsIgnoreCaseEvaluator struct{}
+
+func (e *StringNotEqualsIgnoreCaseEvaluator) Evaluate(conditionValue interface{}, contextValues []string) bool {
+	expectedValues := getCachedNormalizedValues(conditionValue)
+	for _, expected := range expectedValues {
+		for _, contextValue := range contextValues {
+			if strings.EqualFold(expected, contextValue) {
+				return false
+			}
+		}
+	}
+	return true
+}
+
 // NumericEqualsEvaluator evaluates NumericEquals conditions
 type NumericEqualsEvaluator struct{}
 
@@ -639,8 +669,58 @@ func (e *NullEvaluator) Evaluate(conditionValue interface{}, contextValues []str
 	return false
 }
 
-// GetConditionEvaluator returns the appropriate evaluator for a condition operator
+// forAllValuesEvaluator matches when every request value satisfies the base
+// operator on its own, and so also when the request carries no value.
+type forAllValuesEvaluator struct {
+	base ConditionEvaluator
+}
+
+func (e *forAllValuesEvaluator) Evaluate(conditionValue interface{}, contextValues []string) bool {
+	for _, v := range contextValues {
+		if !e.base.Evaluate(conditionValue, []string{v}) {
+			return false
+		}
+	}
+	return true
+}
+
+// forAnyValueEvaluator matches when at least one request value satisfies the
+// base operator on its own. Checking values one at a time keeps a negated
+// base such as StringNotEquals from meaning "none of them".
+type forAnyValueEvaluator struct {
+	base ConditionEvaluator
+}
+
+func (e *forAnyValueEvaluator) Evaluate(conditionValue interface{}, contextValues []string) bool {
+	for _, v := range contextValues {
+		if e.base.Evaluate(conditionValue, []string{v}) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetConditionEvaluator returns the appropriate evaluator for a condition
+// operator, including the ForAllValues: and ForAnyValue: set qualifiers.
 func GetConditionEvaluator(operator string) (ConditionEvaluator, error) {
+	if base, ok := strings.CutPrefix(operator, "ForAllValues:"); ok {
+		evaluator, err := baseConditionEvaluator(base)
+		if err != nil {
+			return nil, err
+		}
+		return &forAllValuesEvaluator{base: evaluator}, nil
+	}
+	if base, ok := strings.CutPrefix(operator, "ForAnyValue:"); ok {
+		evaluator, err := baseConditionEvaluator(base)
+		if err != nil {
+			return nil, err
+		}
+		return &forAnyValueEvaluator{base: evaluator}, nil
+	}
+	return baseConditionEvaluator(operator)
+}
+
+func baseConditionEvaluator(operator string) (ConditionEvaluator, error) {
 	switch operator {
 	case "StringEquals":
 		return &StringEqualsEvaluator{}, nil
@@ -650,6 +730,10 @@ func GetConditionEvaluator(operator string) (ConditionEvaluator, error) {
 		return &StringLikeEvaluator{}, nil
 	case "StringNotLike":
 		return &StringNotLikeEvaluator{}, nil
+	case "StringEqualsIgnoreCase":
+		return &StringEqualsIgnoreCaseEvaluator{}, nil
+	case "StringNotEqualsIgnoreCase":
+		return &StringNotEqualsIgnoreCaseEvaluator{}, nil
 	case "NumericEquals":
 		return &NumericEqualsEvaluator{}, nil
 	case "NumericNotEquals":
@@ -694,6 +778,14 @@ func GetConditionEvaluator(operator string) (ConditionEvaluator, error) {
 // ExistingObjectTagPrefix is the prefix for S3 policy condition keys
 const ExistingObjectTagPrefix = "s3:ExistingObjectTag/"
 
+// RequestObjectTagPrefix is the prefix for condition keys on the tags a
+// request sets through the X-Amz-Tagging header.
+const RequestObjectTagPrefix = "s3:RequestObjectTag/"
+
+// RequestObjectTagKeys is the multi-valued condition key listing the keys of
+// the tags a request sets through the X-Amz-Tagging header.
+const RequestObjectTagKeys = "s3:RequestObjectTagKeys"
+
 // getConditionContextValue resolves the value(s) for a condition key.
 // For s3:ExistingObjectTag/<key> conditions, it looks up the tag in objectEntry.
 // For other condition keys, it looks up the value in contextValues.
@@ -722,6 +814,12 @@ func getConditionContextValue(key string, contextValues map[string][]string, obj
 // objectEntry is the object's metadata from entry.Extended (can be nil)
 // claims are JWT claims for jwt:* policy variables (can be nil)
 func EvaluateConditions(conditions PolicyConditions, contextValues map[string][]string, objectEntry map[string][]byte, claims map[string]interface{}) bool {
+	return evaluateConditions(conditions, contextValues, objectEntry, claims, nil)
+}
+
+// evaluateConditions supplements positive string grant conditions in explicit denies with the original complete list.
+// Select values per operator so whitespace or escapes cannot change negative conditions on the same key.
+func evaluateConditions(conditions PolicyConditions, contextValues map[string][]string, objectEntry map[string][]byte, claims map[string]interface{}, originalGrants map[string][]string) bool {
 	if len(conditions) == 0 {
 		return true // No conditions means always true
 	}
@@ -730,11 +828,18 @@ func EvaluateConditions(conditions PolicyConditions, contextValues map[string][]
 		conditionEvaluator, err := GetConditionEvaluator(operator)
 		if err != nil {
 			glog.Warningf("Unsupported condition operator: %s", operator)
-			continue
+			return false
 		}
 
 		for key, value := range conditionMap {
 			contextVals := getConditionContextValue(key, contextValues, objectEntry)
+			if original := originalGrants[key]; len(original) != 0 && isGrantConditionKey(key) {
+				// Extra values can only make ForAllValues fail, so it keeps the canonical list.
+				switch strings.TrimPrefix(operator, "ForAnyValue:") {
+				case "StringEquals", "StringEqualsIgnoreCase", "StringLike", "ArnEquals", "ArnLike":
+					contextVals = append(append([]string(nil), contextVals...), original...)
+				}
+			}
 
 			// Substitute variables in expected values
 			expectedValues := value.Strings()
diff --git a/weed/s3api/policy_engine/conditions_failclosed_test.go b/weed/s3api/policy_engine/conditions_failclosed_test.go
new file mode 100644
index 0000000000..f4b0a531c9
--- /dev/null
+++ b/weed/s3api/policy_engine/conditions_failclosed_test.go
@@ -0,0 +1,18 @@
+package policy_engine
+
+import (
+	"testing"
+)
+
+func TestEvaluateConditionsFailsClosedOnUnsupportedOperator(t *testing.T) {
+	conditions := PolicyConditions{
+		"StringEqualsBogus": {
+			"aws:username": NewStringOrStringSlice("alice"),
+		},
+	}
+	contextValues := map[string][]string{}
+	got := EvaluateConditions(conditions, contextValues, nil, nil)
+	if got {
+		t.Fatalf("EvaluateConditions returned true for unsupported operator; expected false (fail closed)")
+	}
+}
diff --git a/weed/s3api/policy_engine/conditions_ignorecase_test.go b/weed/s3api/policy_engine/conditions_ignorecase_test.go
new file mode 100644
index 0000000000..50ce78a482
--- /dev/null
+++ b/weed/s3api/policy_engine/conditions_ignorecase_test.go
@@ -0,0 +1,41 @@
+package policy_engine
+
+import (
+	"testing"
+)
+
+func TestConditionEvaluatorsIgnoreCase(t *testing.T) {
+	tests := []struct {
+		name           string
+		operator       string
+		conditionValue interface{}
+		contextValues  []string
+		expected       bool
+	}{
+		{"StringEqualsIgnoreCase - match", "StringEqualsIgnoreCase", "ALICE", []string{"alice"}, true},
+		{"StringEqualsIgnoreCase - no match", "StringEqualsIgnoreCase", "alice", []string{"bob"}, false},
+		{"StringNotEqualsIgnoreCase - match", "StringNotEqualsIgnoreCase", "alice", []string{"bob"}, true},
+		{"StringNotEqualsIgnoreCase - no match", "StringNotEqualsIgnoreCase", "ALICE", []string{"alice"}, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			evaluator, err := GetConditionEvaluator(tt.operator)
+			if err != nil {
+				t.Fatalf("Failed to get condition evaluator: %v", err)
+			}
+			result := evaluator.Evaluate(tt.conditionValue, tt.contextValues)
+			if result != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestGetConditionEvaluatorRejectsNonAWSIgnoreCaseOperators(t *testing.T) {
+	for _, op := range []string{"StringLikeIgnoreCase", "StringNotLikeIgnoreCase"} {
+		if _, err := GetConditionEvaluator(op); err == nil {
+			t.Fatalf("GetConditionEvaluator accepted non-AWS operator %q; expected error", op)
+		}
+	}
+}
diff --git a/weed/s3api/policy_engine/conditions_set_test.go b/weed/s3api/policy_engine/conditions_set_test.go
new file mode 100644
index 0000000000..80aac29a0f
--- /dev/null
+++ b/weed/s3api/policy_engine/conditions_set_test.go
@@ -0,0 +1,102 @@
+package policy_engine
+
+import (
+	"testing"
+)
+
+func TestConditionSetOperators(t *testing.T) {
+	allowed := []string{"department", "project"}
+	tests := []struct {
+		name           string
+		operator       string
+		conditionValue interface{}
+		contextValues  []string
+		expected       bool
+	}{
+		{"ForAllValues all match", "ForAllValues:StringEquals", allowed, []string{"department", "project"}, true},
+		{"ForAllValues subset matches", "ForAllValues:StringEquals", allowed, []string{"project"}, true},
+		{"ForAllValues one outsider fails", "ForAllValues:StringEquals", allowed, []string{"department", "owner"}, false},
+		{"ForAllValues empty set matches", "ForAllValues:StringEquals", allowed, []string{}, true},
+		{"ForAllValues nil set matches", "ForAllValues:StringEquals", allowed, nil, true},
+		{"ForAllValues is case sensitive", "ForAllValues:StringEquals", allowed, []string{"Department"}, false},
+		{"ForAllValues StringLike all match", "ForAllValues:StringLike", "proj-*", []string{"proj-a", "proj-b"}, true},
+		{"ForAllValues StringLike one outsider fails", "ForAllValues:StringLike", "proj-*", []string{"proj-a", "team"}, false},
+		{"ForAllValues StringNotEquals none listed", "ForAllValues:StringNotEquals", allowed, []string{"owner", "team"}, true},
+		{"ForAllValues StringNotEquals one listed fails", "ForAllValues:StringNotEquals", allowed, []string{"owner", "project"}, false},
+
+		{"ForAnyValue one match", "ForAnyValue:StringEquals", allowed, []string{"owner", "project"}, true},
+		{"ForAnyValue no match", "ForAnyValue:StringEquals", allowed, []string{"owner", "team"}, false},
+		{"ForAnyValue empty set fails", "ForAnyValue:StringEquals", allowed, []string{}, false},
+		{"ForAnyValue nil set fails", "ForAnyValue:StringEquals", allowed, nil, false},
+		{"ForAnyValue StringLike one match", "ForAnyValue:StringLike", []string{"secret*"}, []string{"owner", "secret-level"}, true},
+		{"ForAnyValue StringLike no match", "ForAnyValue:StringLike", []string{"secret*"}, []string{"owner"}, false},
+		{"ForAnyValue StringNotEquals one unlisted", "ForAnyValue:StringNotEquals", allowed, []string{"department", "owner"}, true},
+		{"ForAnyValue StringNotEquals all listed fails", "ForAnyValue:StringNotEquals", allowed, []string{"department", "project"}, false},
+		{"ForAnyValue StringEqualsIgnoreCase", "ForAnyValue:StringEqualsIgnoreCase", allowed, []string{"PROJECT"}, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			evaluator, err := GetConditionEvaluator(tt.operator)
+			if err != nil {
+				t.Fatalf("Failed to get condition evaluator: %v", err)
+			}
+			if got := evaluator.Evaluate(tt.conditionValue, tt.contextValues); got != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, got)
+			}
+		})
+	}
+}
+
+func TestGetConditionEvaluatorRejectsUnknownSetOperators(t *testing.T) {
+	for _, op := range []string{
+		"ForAllValues:StringBogus",
+		"ForAnyValue:",
+		"ForEachValue:StringEquals",
+		"ForAllValues:ForAnyValue:StringEquals",
+	} {
+		if _, err := GetConditionEvaluator(op); err == nil {
+			t.Errorf("GetConditionEvaluator accepted %q; expected error", op)
+		}
+	}
+}
+
+func TestValidateBucketPolicyAcceptsSetOperators(t *testing.T) {
+	policy := `{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Deny",
+			"Principal": "*",
+			"Action": "s3:PutObject",
+			"Resource": "arn:aws:s3:::test-bucket/*",
+			"Condition": {
+				"ForAllValues:StringNotEquals": {"s3:RequestObjectTagKeys": ["department", "project"]},
+				"ForAnyValue:StringLike": {"s3:RequestObjectTagKeys": ["secret*"]}
+			}
+		}]
+	}`
+	engine := NewPolicyEngine()
+	if err := engine.SetBucketPolicy("test-bucket", policy); err != nil {
+		t.Fatalf("SetBucketPolicy rejected set operators: %v", err)
+	}
+}
+
+func TestOriginalGrantsSupplementOnlyForAnyValue(t *testing.T) {
+	const key = "s3:x-amz-grant-read"
+	contextValues := map[string][]string{key: {"id=canonical"}}
+	originalGrants := map[string][]string{key: {"uri=original"}}
+
+	anyValue := PolicyConditions{
+		"ForAnyValue:StringEquals": {key: NewStringOrStringSlice("uri=original")},
+	}
+	if !evaluateConditions(anyValue, contextValues, nil, nil, originalGrants) {
+		t.Error("ForAnyValue should see the original grant values")
+	}
+
+	allValues := PolicyConditions{
+		"ForAllValues:StringEquals": {key: NewStringOrStringSlice("id=canonical")},
+	}
+	if !evaluateConditions(allValues, contextValues, nil, nil, originalGrants) {
+		t.Error("ForAllValues should be evaluated on the canonical values only")
+	}
+}
diff --git a/weed/s3api/policy_engine/conditions_validation_test.go b/weed/s3api/policy_engine/conditions_validation_test.go
new file mode 100644
index 0000000000..ec61feb76c
--- /dev/null
+++ b/weed/s3api/policy_engine/conditions_validation_test.go
@@ -0,0 +1,74 @@
+package policy_engine
+
+import (
+	"testing"
+)
+
+func TestValidateBucketPolicyRejectsUnsupportedConditionOperator(t *testing.T) {
+	unsupported := `{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Allow",
+			"Principal": "*",
+			"Action": "s3:GetObject",
+			"Resource": "arn:aws:s3:::test-bucket/*",
+			"Condition": {"StringEqualsBogus": {"aws:username": "alice"}}
+		}]
+	}`
+	supportedIgnoreCase := `{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Allow",
+			"Principal": "*",
+			"Action": "s3:GetObject",
+			"Resource": "arn:aws:s3:::test-bucket/*",
+			"Condition": {"StringEqualsIgnoreCase": {"aws:username": "alice"}}
+		}]
+	}`
+	supportedStringEquals := `{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Allow",
+			"Principal": "*",
+			"Action": "s3:GetObject",
+			"Resource": "arn:aws:s3:::test-bucket/*",
+			"Condition": {"StringEquals": {"aws:username": "alice"}}
+		}]
+	}`
+
+	t.Run("upload rejects unsupported operator", func(t *testing.T) {
+		policy, err := ParsePolicy(unsupported)
+		if err != nil {
+			t.Fatalf("ParsePolicy failed: %v", err)
+		}
+		if err := ValidateBucketPolicy(policy, "test-bucket"); err == nil {
+			t.Fatalf("ValidateBucketPolicy expected error for unsupported operator, got nil")
+		}
+	})
+
+	t.Run("upload accepts supported IgnoreCase operator", func(t *testing.T) {
+		policy, err := ParsePolicy(supportedIgnoreCase)
+		if err != nil {
+			t.Fatalf("ParsePolicy failed: %v", err)
+		}
+		if err := ValidateBucketPolicy(policy, "test-bucket"); err != nil {
+			t.Fatalf("ValidateBucketPolicy unexpected error: %v", err)
+		}
+	})
+
+	t.Run("upload accepts supported StringEquals operator", func(t *testing.T) {
+		policy, err := ParsePolicy(supportedStringEquals)
+		if err != nil {
+			t.Fatalf("ParsePolicy failed: %v", err)
+		}
+		if err := ValidateBucketPolicy(policy, "test-bucket"); err != nil {
+			t.Fatalf("ValidateBucketPolicy unexpected error: %v", err)
+		}
+	})
+
+	t.Run("load tolerates legacy unsupported operator", func(t *testing.T) {
+		if _, err := ParsePolicy(unsupported); err != nil {
+			t.Fatalf("ParsePolicy must not reject legacy unsupported operator at load time: %v", err)
+		}
+	})
+}
diff --git a/weed/s3api/policy_engine/engine.go b/weed/s3api/policy_engine/engine.go
index 6e54fdf91b..e544b227bd 100644
--- a/weed/s3api/policy_engine/engine.go
+++ b/weed/s3api/policy_engine/engine.go
@@ -2,14 +2,18 @@ package policy_engine
 
 import (
 	"fmt"
-	"net"
+	"maps"
 	"net/http"
+	"net/url"
 	"regexp"
+	"slices"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 )
 
 // PolicyEvaluationResult represents the result of policy evaluation
@@ -30,8 +34,9 @@ type PolicyEvaluationContext struct {
 
 // PolicyEngine is the main policy evaluation engine
 type PolicyEngine struct {
-	contexts map[string]*PolicyEvaluationContext
-	mutex    sync.RWMutex
+	contexts       map[string]*PolicyEvaluationContext
+	mutex          sync.RWMutex
+	trustedProxies atomic.Pointer[TrustedProxies]
 }
 
 // NewPolicyEngine creates a new policy evaluation engine
@@ -41,6 +46,12 @@ func NewPolicyEngine() *PolicyEngine {
 	}
 }
 
+// SetTrustedProxies configures the allowlist used to decide whether
+// forwarded headers are honored when extracting aws:SourceIp.
+func (engine *PolicyEngine) SetTrustedProxies(tp *TrustedProxies) {
+	engine.trustedProxies.Store(tp)
+}
+
 // SetBucketPolicy sets the policy for a bucket
 func (engine *PolicyEngine) SetBucketPolicy(bucketName string, policyJSON string) error {
 	policy, err := ParsePolicy(policyJSON)
@@ -239,6 +250,10 @@ func (engine *PolicyEngine) evaluateStatement(stmt *CompiledStatement, args *Pol
 			condCtx = injectSSEForMultipart(args.Conditions, args.InheritedSSEAlgorithm)
 		}
 		match := EvaluateConditions(stmt.Statement.Condition, condCtx, args.ObjectEntry, args.Claims)
+		// Preserve positive string denies on the original complete list; allows, negative conditions, and variables remain canonical.
+		if !match && stmt.Statement.Effect == PolicyEffectDeny && len(args.OriginalGrantConditions) != 0 {
+			match = evaluateConditions(stmt.Statement.Condition, condCtx, args.ObjectEntry, args.Claims, args.OriginalGrantConditions)
+		}
 		if !match {
 			return false
 		}
@@ -405,11 +420,11 @@ func ExtractPrincipalVariables(principal string) map[string][]string {
 }
 
 // ExtractConditionValuesFromRequest extracts condition values from HTTP request
-func ExtractConditionValuesFromRequest(r *http.Request) map[string][]string {
+func (engine *PolicyEngine) ExtractConditionValuesFromRequest(r *http.Request) map[string][]string {
 	values := make(map[string][]string)
 
 	// AWS condition keys
-	values["aws:SourceIp"] = []string{extractSourceIP(r)}
+	values["aws:SourceIp"] = []string{engine.extractSourceIP(r)}
 	values["aws:SecureTransport"] = []string{fmt.Sprintf("%t", r.TLS != nil)}
 	// Use AWS standard condition key for current time
 	values["aws:CurrentTime"] = []string{time.Now().Format(time.RFC3339)}
@@ -428,6 +443,13 @@ func ExtractConditionValuesFromRequest(r *http.Request) map[string][]string {
 	// Note: s3:ExistingObjectTag/<key> conditions are evaluated using objectEntry
 	// passed to EvaluatePolicy, not extracted from the request.
 
+	if tags := requestObjectTags(r); len(tags) > 0 {
+		for key, value := range tags {
+			values[RequestObjectTagPrefix+key] = []string{value}
+		}
+		values[RequestObjectTagKeys] = slices.Sorted(maps.Keys(tags))
+	}
+
 	// S3 bucket-level conditions
 	if delimiter := r.URL.Query().Get("delimiter"); delimiter != "" {
 		values["s3:delimiter"] = []string{delimiter}
@@ -485,6 +507,94 @@ func ExtractConditionValuesFromRequest(r *http.Request) map[string][]string {
 	return values
 }
 
+// requestObjectTags returns the tags that X-Amz-Tagging will store on the
+// object, or nil when the handler ignores the header — otherwise a tag
+// attached to a read or to a write that never stores it would satisfy a
+// tag-conditioned policy the object cannot meet.
+func requestObjectTags(r *http.Request) map[string]string {
+	tagging := r.Header.Get(s3_constants.AmzObjectTagging)
+	if tagging == "" {
+		return nil
+	}
+	if !storesRequestObjectTags(r) {
+		return nil
+	}
+	// Parse the same non-empty segments the tag handlers store: url.ParseQuery
+	// caps at 10,000 parameters, so a header padded with "&" segments would
+	// hide stored tag keys from every s3:RequestObjectTag* condition. A
+	// malformed pair is rejected by the handler with InvalidTag.
+	tags := make(map[string]string)
+	for _, segment := range strings.Split(tagging, "&") {
+		if segment == "" {
+			continue
+		}
+		rawKey, rawValue, _ := strings.Cut(segment, "=")
+		key, errKey := url.QueryUnescape(rawKey)
+		value, errValue := url.QueryUnescape(rawValue)
+		if errKey != nil || errValue != nil {
+			return nil
+		}
+		// putToFiler rejects a repeated key, but CopyObject stores its last
+		// value, so that is the one the policy has to see.
+		tags[key] = value
+	}
+	return tags
+}
+
+// storesRequestObjectTags reports whether the request's handler saves the
+// X-Amz-Tagging header on the object: PutObject, a copy under
+// X-Amz-Tagging-Directive: REPLACE, and CreateMultipartUpload do; every
+// other operation — reads, deletes, part uploads, completion, tagging
+// subresources — does not.
+func storesRequestObjectTags(r *http.Request) bool {
+	query := r.URL.Query()
+	if r.Method == http.MethodPost {
+		return query.Has("uploads") && !query.Has("uploadId")
+	}
+	if r.Method != http.MethodPut {
+		return false
+	}
+	// A numeric partNumber together with uploadId routes to the part
+	// handlers — with or without a copy source — which never read
+	// X-Amz-Tagging.
+	if query.Has("partNumber") && query.Has("uploadId") && isDigits(query.Get("partNumber")) {
+		return false
+	}
+	// The PUT subresources route before CopyObject and never read
+	// X-Amz-Tagging; any other query key — presign parameters included —
+	// still reaches the object PUT handlers.
+	for _, subresource := range []string{"tagging", "renameObject", "acl", "retention", "legal-hold"} {
+		if query.Has(subresource) {
+			return false
+		}
+	}
+	if r.Header.Get("X-Amz-Copy-Source") != "" {
+		return r.Header.Get(s3_constants.AmzObjectTaggingDirective) == "REPLACE"
+	}
+	if query.Has("partNumber") || query.Has("uploadId") {
+		return false
+	}
+	// An explicit directory-marker PUT stores no tags.
+	if strings.HasSuffix(r.URL.Path, "/") && r.ContentLength <= 1024 {
+		return false
+	}
+	return true
+}
+
+// isDigits reports whether s is non-empty and all ASCII digits, matching the
+// partNumber route constraint.
+func isDigits(s string) bool {
+	if s == "" {
+		return false
+	}
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return false
+		}
+	}
+	return true
+}
+
 // IsMultipartContinuationAction returns true for actions that do not carry
 // their own SSE header because SSE is inherited from CreateMultipartUpload.
 func IsMultipartContinuationAction(action string) bool {
@@ -519,99 +629,11 @@ func injectSSEForMultipart(conditions map[string][]string, inheritedSSE string)
 	return modified
 }
 
-// extractSourceIP returns the best-effort client IP address for condition evaluation.
-// Preference order: X-Forwarded-For (first valid IP), X-Real-Ip, then RemoteAddr.
-// IMPORTANT: X-Forwarded-For and X-Real-Ip are trusted without validation.
-// When the service is exposed directly, clients can spoof aws:SourceIp unless a
-// reverse proxy overwrites these headers.
-
-// isPrivateIP returns true if the given IP is considered a "trusted proxy"
-// address, such as loopback, link-local, or RFC1918 private ranges.
-// isPrivateIP returns true if the given IP is considered a "trusted proxy"
-// address, such as loopback, link-local, or private ranges.
-func isPrivateIP(ip net.IP) bool {
-	if ip == nil {
-		return false
-	}
-	return ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsPrivate()
-}
-
-func extractSourceIP(r *http.Request) string {
-	if r == nil {
-		return ""
-	}
-
-	remoteAddr := strings.TrimSpace(r.RemoteAddr)
-	if remoteAddr == "" {
-		return ""
-	}
-
-	// Fall back to unix socket markers or other non-IP placeholders.
-	if remoteAddr == "@" {
-		return remoteAddr
-	}
-
-	host := remoteAddr
-	if h, _, err := net.SplitHostPort(remoteAddr); err == nil {
-		host = h
-	}
-
-	remoteIP := net.ParseIP(host)
-	if remoteIP == nil {
-		// Do not return DNS names or unparseable values.
-		return ""
-	}
-
-	// Only trust forwarding headers when the connection appears to come from
-	// a trusted proxy (e.g., private/loopback address).
-	if isPrivateIP(remoteIP) {
-		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
-			// Iterate right-to-left to find the first non-trusted (public) IP
-			entries := strings.Split(xff, ",")
-			for i := len(entries) - 1; i >= 0; i-- {
-				candidate := strings.TrimSpace(entries[i])
-				if candidate == "" {
-					continue
-				}
-
-				ip := net.ParseIP(candidate)
-				if ip == nil {
-					continue
-				}
-
-				// If the IP is trusted/private, we treat it as another proxy in the chain and continue
-				if isPrivateIP(ip) {
-					continue
-				}
-
-				// Found a public/non-trusted IP, return it as the client IP
-				return ip.String()
-			}
-
-			// If we exhausted the list (all were private/trusted) or found no valid IPs,
-			// fallback related logic could go here.
-			// For now, if all are private, we continue to check X-Real-Ip or return RemoteIP?
-			// The prompt implies we should prefer the extracted IP.
-			// If all in XFF are private, likely the original client IS private (internal network).
-			// The best guess for "original client" in a fully trusted chain is the left-most valid IP.
-			for _, candidate := range entries {
-				candidate = strings.TrimSpace(candidate)
-				if ip := net.ParseIP(candidate); ip != nil {
-					return ip.String()
-				}
-			}
-		}
-
-		if xRealIP := strings.TrimSpace(r.Header.Get("X-Real-Ip")); xRealIP != "" {
-			if ip := net.ParseIP(xRealIP); ip != nil {
-				return ip.String()
-			}
-		}
-	}
-
-	// Default to the actual peer IP when no trusted proxy is detected or the
-	// forwarding headers are absent/invalid.
-	return remoteIP.String()
+// extractSourceIP returns the client IP for aws:SourceIp condition
+// evaluation, honoring forwarded headers only when the direct TCP peer is in
+// the configured trusted-proxy allowlist (see SetTrustedProxies).
+func (engine *PolicyEngine) extractSourceIP(r *http.Request) string {
+	return engine.trustedProxies.Load().ExtractSourceIP(r)
 }
 
 // BuildResourceArn builds an ARN for the given bucket and object
@@ -730,7 +752,7 @@ func (engine *PolicyEngine) GetAllBucketsWithPolicies() []string {
 func (engine *PolicyEngine) EvaluatePolicyForRequest(bucketName, objectName, action, principal string, r *http.Request) PolicyEvaluationResult {
 	resource := BuildResourceArn(bucketName, objectName)
 	actionName := BuildActionName(action)
-	conditions := ExtractConditionValuesFromRequest(r)
+	conditions := engine.ExtractConditionValuesFromRequest(r)
 
 	// Extract principal information for variables
 	principalVars := ExtractPrincipalVariables(principal)
diff --git a/weed/s3api/policy_engine/engine_test.go b/weed/s3api/policy_engine/engine_test.go
index 0e40985440..6f4cccc687 100644
--- a/weed/s3api/policy_engine/engine_test.go
+++ b/weed/s3api/policy_engine/engine_test.go
@@ -2,7 +2,9 @@ package policy_engine
 
 import (
 	"net/http"
+	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
@@ -379,7 +381,7 @@ func TestExtractConditionValuesFromRequest(t *testing.T) {
 		RemoteAddr: "192.168.1.100:12345",
 	}
 
-	values := ExtractConditionValuesFromRequest(req)
+	values := NewPolicyEngine().ExtractConditionValuesFromRequest(req)
 
 	// Check extracted values
 	if len(values["aws:SourceIp"]) != 1 || values["aws:SourceIp"][0] != "192.168.1.100" {
@@ -425,21 +427,21 @@ func TestExtractConditionValuesFromRequestSourceIPPrecedence(t *testing.T) {
 		expectedIP string
 	}{
 		{
-			name: "uses right-most public X-Forwarded-For entry",
+			name: "ignores X-Forwarded-For and uses RemoteAddr",
 			header: map[string][]string{
 				"X-Forwarded-For": {"bad-ip, 203.0.113.10, 198.51.100.5"},
 			},
 			remoteAddr: "192.168.1.100:12345",
-			expectedIP: "198.51.100.5",
+			expectedIP: "192.168.1.100",
 		},
 		{
-			name: "falls back to X-Real-Ip when X-Forwarded-For has no valid ip",
+			name: "ignores X-Real-Ip and uses RemoteAddr",
 			header: map[string][]string{
 				"X-Forwarded-For": {"bad-ip"},
 				"X-Real-Ip":       {"198.51.100.7"},
 			},
 			remoteAddr: "192.168.1.100:12345",
-			expectedIP: "198.51.100.7",
+			expectedIP: "192.168.1.100",
 		},
 		{
 			name:       "uses RemoteAddr ip when no forwarding headers",
@@ -454,20 +456,20 @@ func TestExtractConditionValuesFromRequestSourceIPPrecedence(t *testing.T) {
 			expectedIP: "@",
 		},
 		{
-			name: "uses IPv6 X-Forwarded-For entry",
+			name: "ignores IPv6 X-Forwarded-For entry and uses RemoteAddr",
 			header: map[string][]string{
 				"X-Forwarded-For": {"2001:db8::8, 198.51.100.7"},
 			},
 			remoteAddr: "192.168.1.100:12345",
-			expectedIP: "198.51.100.7",
+			expectedIP: "192.168.1.100",
 		},
 		{
-			name: "ignores spoofed IP when real client is public",
+			name: "ignores spoofed X-Forwarded-For behind private peer",
 			header: map[string][]string{
 				"X-Forwarded-For": {"8.8.8.8, 203.0.113.10, 10.0.0.1"},
 			},
 			remoteAddr: "192.168.1.100:12345",
-			expectedIP: "203.0.113.10",
+			expectedIP: "192.168.1.100",
 		},
 		{
 			name:       "handles bracketed IPv6 remote address",
@@ -492,7 +494,7 @@ func TestExtractConditionValuesFromRequestSourceIPPrecedence(t *testing.T) {
 				RemoteAddr: tt.remoteAddr,
 			}
 
-			values := ExtractConditionValuesFromRequest(req)
+			values := NewPolicyEngine().ExtractConditionValuesFromRequest(req)
 			if len(values["aws:SourceIp"]) != 1 || values["aws:SourceIp"][0] != tt.expectedIP {
 				t.Errorf("Expected SourceIp %q, got %v", tt.expectedIP, values["aws:SourceIp"])
 			}
@@ -500,6 +502,68 @@ func TestExtractConditionValuesFromRequestSourceIPPrecedence(t *testing.T) {
 	}
 }
 
+func TestExtractSourceIP_IgnoresForwardedHeaders(t *testing.T) {
+	req := &http.Request{
+		Method: "GET",
+		URL:    &url.URL{Path: "/"},
+		Header: map[string][]string{
+			"X-Forwarded-For": {"203.0.113.99"},
+			"X-Real-Ip":       {"198.51.100.1"},
+		},
+		RemoteAddr: "10.0.0.5:54321",
+	}
+
+	values := NewPolicyEngine().ExtractConditionValuesFromRequest(req)
+	if got := values["aws:SourceIp"]; len(got) != 1 || got[0] != "10.0.0.5" {
+		t.Errorf("Expected SourceIp to be the direct peer 10.0.0.5, got %v", got)
+	}
+}
+
+func TestExtractSourceIP_EnforcesIPRestrictionPolicy(t *testing.T) {
+	engine := NewPolicyEngine()
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{"Effect": "Allow", "Principal": "*", "Action": ["s3:GetObject"],
+			 "Resource": "arn:aws:s3:::secret-bucket/*"},
+			{"Effect": "Deny", "Principal": "*", "Action": ["s3:GetObject"],
+			 "Resource": "arn:aws:s3:::secret-bucket/*",
+			 "Condition": {"NotIpAddress": {"aws:SourceIp": ["10.0.0.0/24"]}}}
+		]
+	}`
+	if err := engine.SetBucketPolicy("secret-bucket", policyJSON); err != nil {
+		t.Fatalf("Failed to set bucket policy: %v", err)
+	}
+
+	r := httptest.NewRequest(http.MethodGet, "/secret-bucket/secret-key", nil)
+	r.RemoteAddr = "10.0.50.5:54321"
+	r.Header.Set("X-Forwarded-For", "10.0.0.5")
+
+	result := engine.EvaluatePolicy("secret-bucket", &PolicyEvaluationArgs{
+		Action:     "s3:GetObject",
+		Resource:   "arn:aws:s3:::secret-bucket/secret-key",
+		Principal:  "*",
+		Conditions: engine.ExtractConditionValuesFromRequest(r),
+	})
+	if result != PolicyResultDeny {
+		t.Errorf("Expected Deny for peer outside 10.0.0.0/24 despite spoofed X-Forwarded-For, got %v", result)
+	}
+}
+
+func TestExtractSourceIP_TrustedProxyHonorsForwardedHeader(t *testing.T) {
+	engine := NewPolicyEngine()
+	engine.SetTrustedProxies(NewTrustedProxies([]string{"10.0.0.0/24"}))
+
+	r := httptest.NewRequest(http.MethodGet, "/", nil)
+	r.RemoteAddr = "10.0.0.1:54321"
+	r.Header.Set("X-Forwarded-For", "203.0.113.99")
+
+	values := engine.ExtractConditionValuesFromRequest(r)
+	if got := values["aws:SourceIp"]; len(got) != 1 || got[0] != "203.0.113.99" {
+		t.Errorf("Expected trusted proxy to honor X-Forwarded-For 203.0.113.99, got %v", got)
+	}
+}
+
 func TestPolicyEvaluationWithConditions(t *testing.T) {
 	engine := NewPolicyEngine()
 
@@ -833,6 +897,313 @@ func TestExistingObjectTagCondition(t *testing.T) {
 	}
 }
 
+func TestRequestObjectTagCondition(t *testing.T) {
+	engine := NewPolicyEngine()
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:PutObject",
+				"Resource": "arn:aws:s3:::test-bucket/*",
+				"Condition": {
+					"StringEquals": {
+						"s3:RequestObjectTag/department": ["engineering"]
+					}
+				}
+			}
+		]
+	}`
+
+	if err := engine.SetBucketPolicy("test-bucket", policyJSON); err != nil {
+		t.Fatalf("Failed to set bucket policy: %v", err)
+	}
+
+	copyHeaders := map[string]string{"X-Amz-Copy-Source": "/src-bucket/src-object"}
+	replaceHeaders := map[string]string{
+		"X-Amz-Copy-Source":                    "/src-bucket/src-object",
+		s3_constants.AmzObjectTaggingDirective: "REPLACE",
+	}
+
+	tests := []struct {
+		name     string
+		method   string
+		target   string
+		headers  map[string]string
+		tagging  string
+		expected PolicyEvaluationResult
+	}{
+		{"matching tag allows", "", "", nil, "department=engineering", PolicyResultAllow},
+		{"matching tag among others allows", "", "", nil, "project=alpha&department=engineering", PolicyResultAllow},
+		{"url-encoded value is decoded", "", "", nil, "department=engin%65ering", PolicyResultAllow},
+		{"other value is not allowed", "", "", nil, "department=sales", PolicyResultIndeterminate},
+		{"missing tag is not allowed", "", "", nil, "project=alpha", PolicyResultIndeterminate},
+		{"no tagging header is not allowed", "", "", nil, "", PolicyResultIndeterminate},
+		{"malformed header is not allowed", "", "", nil, "department=engineering&%zz", PolicyResultIndeterminate},
+		{"last value of a repeated key counts", "", "", nil, "department=sales&department=engineering", PolicyResultAllow},
+		{"earlier value of a repeated key is ignored", "", "", nil, "department=engineering&department=sales", PolicyResultIndeterminate},
+		{"header is ignored on PutObjectTagging", "", "?tagging", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header counts with an unrelated query parameter", "", "?foo=bar", nil, "department=engineering", PolicyResultAllow},
+		{"header counts on a Signature V2 presigned PUT", "", "?AWSAccessKeyId=k&Signature=s&Expires=1", nil, "department=engineering", PolicyResultAllow},
+		{"header is ignored on a renameObject subresource", "", "?renameObject", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header is ignored on a copy that keeps source tags", "", "", copyHeaders, "department=engineering", PolicyResultIndeterminate},
+		{"header counts on a copy that replaces tags", "", "", replaceHeaders, "department=engineering", PolicyResultAllow},
+		{"header is ignored on a multipart copy that replaces tags", "", "?partNumber=1&uploadId=x", replaceHeaders, "department=engineering", PolicyResultIndeterminate},
+		{"header counts on a copy with a lone partNumber", "", "?partNumber=1", replaceHeaders, "department=engineering", PolicyResultAllow},
+		{"header counts on a multipart create", "POST", "?uploads", nil, "department=engineering", PolicyResultAllow},
+		{"header is ignored on a part upload", "", "?partNumber=1&uploadId=x", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header is ignored on multipart completion", "POST", "?uploadId=x", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header is ignored on a directory marker", "", "/", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header is ignored on an acl subresource", "", "?acl", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header is ignored on a GET", "GET", "", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header is ignored on a DELETE", "DELETE", "", nil, "department=engineering", PolicyResultIndeterminate},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			method := tt.method
+			if method == "" {
+				method = http.MethodPut
+			}
+			req := httptest.NewRequest(method, "/test-bucket/test-object"+tt.target, nil)
+			for k, v := range tt.headers {
+				req.Header.Set(k, v)
+			}
+			if tt.tagging != "" {
+				req.Header.Set(s3_constants.AmzObjectTagging, tt.tagging)
+			}
+
+			args := &PolicyEvaluationArgs{
+				Action:     "s3:PutObject",
+				Resource:   "arn:aws:s3:::test-bucket/test-object",
+				Principal:  "*",
+				Conditions: engine.ExtractConditionValuesFromRequest(req),
+			}
+
+			if result := engine.EvaluatePolicy("test-bucket", args); result != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestRequestObjectTagConditionDeny(t *testing.T) {
+	engine := NewPolicyEngine()
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:PutObject",
+				"Resource": "arn:aws:s3:::test-bucket/*"
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": "s3:PutObject",
+				"Resource": "arn:aws:s3:::test-bucket/*",
+				"Condition": {
+					"StringNotEquals": {
+						"s3:RequestObjectTag/department": ["engineering"]
+					}
+				}
+			}
+		]
+	}`
+
+	if err := engine.SetBucketPolicy("test-bucket", policyJSON); err != nil {
+		t.Fatalf("Failed to set bucket policy: %v", err)
+	}
+
+	tests := []struct {
+		name     string
+		target   string
+		tagging  string
+		expected PolicyEvaluationResult
+	}{
+		{"required tag passes", "", "department=engineering", PolicyResultAllow},
+		{"other value is denied", "", "department=sales", PolicyResultDeny},
+		{"missing tag is denied", "", "project=alpha", PolicyResultDeny},
+		{"repeated key ending in another value is denied", "", "department=engineering&department=sales", PolicyResultDeny},
+		{"malformed header is denied", "", "department=engineering&%zz", PolicyResultDeny},
+		{"unrelated query parameter does not hide the tag", "?foo=bar", "department=sales", PolicyResultDeny},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPut, "/test-bucket/test-object"+tt.target, nil)
+			req.Header.Set(s3_constants.AmzObjectTagging, tt.tagging)
+
+			args := &PolicyEvaluationArgs{
+				Action:     "s3:PutObject",
+				Resource:   "arn:aws:s3:::test-bucket/test-object",
+				Principal:  "*",
+				Conditions: engine.ExtractConditionValuesFromRequest(req),
+			}
+
+			if result := engine.EvaluatePolicy("test-bucket", args); result != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
+func evaluateTaggedRequest(engine *PolicyEngine, method, target string, headers map[string]string, tagging string) PolicyEvaluationResult {
+	if method == "" {
+		method = http.MethodPut
+	}
+	req := httptest.NewRequest(method, "/test-bucket/test-object"+target, nil)
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	if tagging != "" {
+		req.Header.Set(s3_constants.AmzObjectTagging, tagging)
+	}
+	return engine.EvaluatePolicy("test-bucket", &PolicyEvaluationArgs{
+		Action:     "s3:PutObject",
+		Resource:   "arn:aws:s3:::test-bucket/test-object",
+		Principal:  "*",
+		Conditions: engine.ExtractConditionValuesFromRequest(req),
+	})
+}
+
+func TestRequestObjectTagKeysCondition(t *testing.T) {
+	engine := NewPolicyEngine()
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:PutObject",
+				"Resource": "arn:aws:s3:::test-bucket/*",
+				"Condition": {
+					"ForAllValues:StringEquals": {
+						"s3:RequestObjectTagKeys": ["department", "project"]
+					},
+					"Null": {
+						"s3:RequestObjectTagKeys": "false"
+					}
+				}
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": "s3:PutObject",
+				"Resource": "arn:aws:s3:::test-bucket/*",
+				"Condition": {
+					"ForAnyValue:StringLike": {
+						"s3:RequestObjectTagKeys": ["secret*"]
+					}
+				}
+			}
+		]
+	}`
+
+	if err := engine.SetBucketPolicy("test-bucket", policyJSON); err != nil {
+		t.Fatalf("Failed to set bucket policy: %v", err)
+	}
+
+	copyHeaders := map[string]string{"X-Amz-Copy-Source": "/src-bucket/src-object"}
+	replaceHeaders := map[string]string{
+		"X-Amz-Copy-Source":                    "/src-bucket/src-object",
+		s3_constants.AmzObjectTaggingDirective: "REPLACE",
+	}
+
+	tests := []struct {
+		name     string
+		method   string
+		target   string
+		headers  map[string]string
+		tagging  string
+		expected PolicyEvaluationResult
+	}{
+		{"listed key allows", "", "", nil, "department=engineering", PolicyResultAllow},
+		{"all listed keys allow", "", "", nil, "department=engineering&project=alpha", PolicyResultAllow},
+		{"unlisted key is not allowed", "", "", nil, "department=engineering&owner=bob", PolicyResultIndeterminate},
+		{"no tagging header is not allowed", "", "", nil, "", PolicyResultIndeterminate},
+		{"repeated key counts once", "", "", nil, "department=a&department=b", PolicyResultAllow},
+		{"url-encoded key is decoded", "", "", nil, "depart%6Dent=engineering", PolicyResultAllow},
+		{"empty segments add no key", "", "", nil, "&department=engineering&", PolicyResultAllow},
+		{"empty key is not allowed", "", "", nil, "department=engineering&=x", PolicyResultIndeterminate},
+		{"key case is preserved", "", "", nil, "Department=engineering", PolicyResultIndeterminate},
+		{"malformed header is not allowed", "", "", nil, "department=engineering&%zz", PolicyResultIndeterminate},
+		{"secret key is denied", "", "", nil, "secret=1", PolicyResultDeny},
+		{"secret key behind a padded header is denied", "", "", nil, "secret=1" + strings.Repeat("&", 10001), PolicyResultDeny},
+		{"secret key among listed keys is denied", "", "", nil, "department=engineering&secret-level=2", PolicyResultDeny},
+		{"url-encoded secret key is denied", "", "", nil, "secr%65t=1", PolicyResultDeny},
+		{"secret key on a copy that replaces tags is denied", "", "", replaceHeaders, "secret=1", PolicyResultDeny},
+		{"secret key on a multipart create is denied", "POST", "?uploads", nil, "secret=1", PolicyResultDeny},
+		{"header is ignored on a copy that keeps source tags", "", "", copyHeaders, "secret=1", PolicyResultIndeterminate},
+		{"header is ignored on PutObjectTagging", "", "?tagging", nil, "department=engineering", PolicyResultIndeterminate},
+		{"header is ignored on a part upload", "", "?partNumber=1&uploadId=x", nil, "secret=1", PolicyResultIndeterminate},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if result := evaluateTaggedRequest(engine, tt.method, tt.target, tt.headers, tt.tagging); result != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestRequestObjectTagKeysRequiredTagDeny(t *testing.T) {
+	engine := NewPolicyEngine()
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:PutObject",
+				"Resource": "arn:aws:s3:::test-bucket/*"
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": "s3:PutObject",
+				"Resource": "arn:aws:s3:::test-bucket/*",
+				"Condition": {
+					"ForAllValues:StringNotEquals": {
+						"s3:RequestObjectTagKeys": ["department", "project"]
+					}
+				}
+			}
+		]
+	}`
+
+	if err := engine.SetBucketPolicy("test-bucket", policyJSON); err != nil {
+		t.Fatalf("Failed to set bucket policy: %v", err)
+	}
+
+	tests := []struct {
+		name     string
+		tagging  string
+		expected PolicyEvaluationResult
+	}{
+		{"required key passes", "department=engineering", PolicyResultAllow},
+		{"required key with another key passes", "project=alpha&owner=bob", PolicyResultAllow},
+		{"only other keys are denied", "owner=bob", PolicyResultDeny},
+		{"no tagging header is denied", "", PolicyResultDeny},
+		{"malformed header is denied", "department=engineering&%zz", PolicyResultDeny},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if result := evaluateTaggedRequest(engine, "", "", nil, tt.tagging); result != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
+
 // TestExistingObjectTagConditionMultipleTags tests policies with multiple tag conditions
 func TestExistingObjectTagConditionMultipleTags(t *testing.T) {
 	engine := NewPolicyEngine()
diff --git a/weed/s3api/policy_engine/request_grant_conditions.go b/weed/s3api/policy_engine/request_grant_conditions.go
new file mode 100644
index 0000000000..14fc88408b
--- /dev/null
+++ b/weed/s3api/policy_engine/request_grant_conditions.go
@@ -0,0 +1,46 @@
+package policy_engine
+
+import (
+	"context"
+	"net/http"
+)
+
+// originalGrantConditionsKey prevents clients from forging original grant values through request headers.
+type originalGrantConditionsKey struct{}
+
+// isGrantConditionKey restricts original-value checks to the five upload grant condition keys.
+func isGrantConditionKey(key string) bool {
+	switch key {
+	case "s3:x-amz-grant-read", "s3:x-amz-grant-write", "s3:x-amz-grant-read-acp", "s3:x-amz-grant-write-acp", "s3:x-amz-grant-full-control":
+		return true
+	}
+	return false
+}
+
+// cloneGrantConditions isolates inputs and results so later mutations cannot change the original complete grant representation.
+func cloneGrantConditions(values map[string][]string) map[string][]string {
+	if len(values) == 0 {
+		return nil
+	}
+	cloned := make(map[string][]string, len(values))
+	for key, grants := range values {
+		if isGrantConditionKey(key) {
+			cloned[key] = append([]string(nil), grants...)
+		}
+	}
+	return cloned
+}
+
+// WithOriginalGrantConditions saves the complete list before upload normalization to supplement explicit deny checks only.
+func WithOriginalGrantConditions(r *http.Request, values map[string][]string) *http.Request {
+	return r.WithContext(context.WithValue(r.Context(), originalGrantConditionsKey{}, cloneGrantConditions(values)))
+}
+
+// OriginalGrantConditionsFromRequest reads the internal snapshot; other operations have no such context.
+func OriginalGrantConditionsFromRequest(r *http.Request) map[string][]string {
+	if r == nil {
+		return nil
+	}
+	values, _ := r.Context().Value(originalGrantConditionsKey{}).(map[string][]string)
+	return cloneGrantConditions(values)
+}
diff --git a/weed/s3api/policy_engine/request_grant_conditions_test.go b/weed/s3api/policy_engine/request_grant_conditions_test.go
new file mode 100644
index 0000000000..bd017af714
--- /dev/null
+++ b/weed/s3api/policy_engine/request_grant_conditions_test.go
@@ -0,0 +1,63 @@
+package policy_engine
+
+import (
+	"fmt"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestOriginalGrantConditionsDeny verifies original positive denies without expanding allows or negative conditions.
+func TestOriginalGrantConditionsDeny(t *testing.T) {
+	const key = "s3:x-amz-grant-read"
+	const canonical, original = `id="bucket-owner"`, `id = "bucket-\u006fwner"`
+	tests := []struct {
+		name, effect, conditions string
+		result                   PolicyEvaluationResult
+	}{
+		{"original exact deny", "Deny", fmt.Sprintf(`{"StringEquals":{%q:%q}}`, key, original), PolicyResultDeny},
+		{"original wildcard deny", "Deny", fmt.Sprintf(`{"StringLike":{%q:%q}}`, key, `id = *`), PolicyResultDeny},
+		{"canonical deny unchanged", "Deny", fmt.Sprintf(`{"StringEquals":{%q:%q}}`, key, canonical), PolicyResultDeny},
+		{"approved negative condition not denied", "Deny", fmt.Sprintf(`{"StringNotEquals":{%q:%q}}`, key, canonical), PolicyResultIndeterminate},
+		{"negative deny unchanged", "Deny", fmt.Sprintf(`{"StringNotEquals":{%q:%q}}`, key, `id="other"`), PolicyResultDeny},
+		{"original value cannot allow", "Allow", fmt.Sprintf(`{"StringEquals":{%q:%q}}`, key, original), PolicyResultIndeterminate},
+		{"negative allow not expanded", "Allow", fmt.Sprintf(`{"StringNotEquals":{%q:%q}}`, key, canonical), PolicyResultIndeterminate},
+		{"complete list allow unchanged", "Allow", fmt.Sprintf(`{"StringEquals":{%q:%q}}`, key, canonical), PolicyResultAllow},
+		{"positive and negative conditions evaluated separately", "Deny", fmt.Sprintf(`{"StringEquals":{%q:%q},"StringNotEquals":{%q:%q}}`, key, original, key, canonical), PolicyResultIndeterminate},
+		{"other conditions must still match", "Deny", fmt.Sprintf(`{"StringEquals":{%q:%q,"aws:username":"other"}}`, key, original), PolicyResultIndeterminate},
+		{"variables remain canonical", "Deny", fmt.Sprintf(`{"StringEquals":{%q:"${s3:x-amz-grant-read}"}}`, key), PolicyResultDeny},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			engine := NewPolicyEngine()
+			policy := fmt.Sprintf(`{"Version":"2012-10-17","Statement":[{"Effect":%q,"Principal":"*","Action":"s3:PutObjectAcl","Resource":"arn:aws:s3:::bucket/object","Condition":%s}]}`, tt.effect, tt.conditions)
+			require.NoError(t, engine.SetBucketPolicy("bucket", policy))
+			req := WithOriginalGrantConditions(httptest.NewRequest("PUT", "/bucket/object", nil), map[string][]string{key: {original}})
+			args := &PolicyEvaluationArgs{
+				Action: "s3:PutObjectAcl", Resource: "arn:aws:s3:::bucket/object", Principal: "upload-writer",
+				Conditions:              map[string][]string{key: {canonical}, "aws:username": {"upload-writer"}},
+				OriginalGrantConditions: OriginalGrantConditionsFromRequest(req),
+			}
+			require.Equal(t, tt.result, engine.EvaluatePolicy("bucket", args))
+		})
+	}
+}
+
+// TestOriginalGrantConditionsSnapshot verifies original values cannot be forged through headers or later mutations.
+func TestOriginalGrantConditionsSnapshot(t *testing.T) {
+	const key = "s3:x-amz-grant-read"
+	values := map[string][]string{key: {`id = "bucket-owner"`}, "aws:username": {"forged"}}
+	original := httptest.NewRequest("PUT", "/bucket/object", nil)
+	original.Header.Set("X-Amz-Original-Grant-Read", `id="attacker"`)
+	require.Nil(t, OriginalGrantConditionsFromRequest(original))
+	require.Nil(t, OriginalGrantConditionsFromRequest(nil))
+	req := WithOriginalGrantConditions(original, values)
+	values[key][0] = `id="attacker"`
+	delete(values, key)
+	first := OriginalGrantConditionsFromRequest(req)
+	require.Equal(t, `id = "bucket-owner"`, first[key][0])
+	require.NotContains(t, first, "aws:username")
+	first[key][0] = `id="attacker"`
+	require.Equal(t, `id = "bucket-owner"`, OriginalGrantConditionsFromRequest(req)[key][0])
+}
diff --git a/weed/s3api/policy_engine/trusted_proxies.go b/weed/s3api/policy_engine/trusted_proxies.go
new file mode 100644
index 0000000000..e2495f2deb
--- /dev/null
+++ b/weed/s3api/policy_engine/trusted_proxies.go
@@ -0,0 +1,136 @@
+package policy_engine
+
+import (
+	"net"
+	"net/http"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+type TrustedProxies struct {
+	ips   map[string]struct{}
+	cidrs map[string]*net.IPNet
+}
+
+func NewTrustedProxies(whiteList []string) *TrustedProxies {
+	tp := &TrustedProxies{
+		ips:   make(map[string]struct{}),
+		cidrs: make(map[string]*net.IPNet),
+	}
+	for _, entry := range whiteList {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		if strings.Contains(entry, "/") {
+			_, cidrnet, err := net.ParseCIDR(entry)
+			if err != nil {
+				glog.Errorf("Parse CIDR %s in s3 trusted_proxies failed: %v", entry, err)
+				continue
+			}
+			tp.cidrs[entry] = cidrnet
+		} else {
+			ip := net.ParseIP(entry)
+			if ip == nil {
+				glog.Errorf("Parse IP %s in s3 trusted_proxies failed", entry)
+				continue
+			}
+			tp.ips[ip.String()] = struct{}{}
+		}
+	}
+	return tp
+}
+
+// IsTrustedPeer reports whether the direct TCP peer of the request is in the
+// allowlist. Use it to decide whether forwarding headers a proxy may have
+// added (X-Forwarded-*, X-Real-*) can be honored for this request.
+func (tp *TrustedProxies) IsTrustedPeer(r *http.Request) bool {
+	if r == nil {
+		return false
+	}
+	host := strings.TrimSpace(r.RemoteAddr)
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		host = h
+	}
+	return tp.IsTrusted(host)
+}
+
+func (tp *TrustedProxies) IsTrusted(ipStr string) bool {
+	if tp == nil {
+		return false
+	}
+	if _, ok := tp.ips[ipStr]; ok {
+		return true
+	}
+	ip := net.ParseIP(ipStr)
+	if ip == nil {
+		return false
+	}
+	for _, cidrnet := range tp.cidrs {
+		if cidrnet.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// ExtractSourceIP returns the client IP for aws:SourceIp condition evaluation.
+// The direct TCP peer is used unless it is in the trusted proxy allowlist, in
+// which case X-Forwarded-For (right-to-left, skipping trusted hops) then
+// X-Real-Ip are honored.
+func (tp *TrustedProxies) ExtractSourceIP(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	remoteAddr := strings.TrimSpace(r.RemoteAddr)
+	if remoteAddr == "" {
+		return ""
+	}
+	if remoteAddr == "@" {
+		return remoteAddr
+	}
+	host := remoteAddr
+	if h, _, err := net.SplitHostPort(remoteAddr); err == nil {
+		host = h
+	}
+	remoteIP := net.ParseIP(host)
+	if remoteIP == nil {
+		return ""
+	}
+	if tp.IsTrusted(host) {
+		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+			entries := strings.Split(xff, ",")
+			malformed := false
+			for i := len(entries) - 1; i >= 0; i-- {
+				candidate := strings.TrimSpace(entries[i])
+				if candidate == "" {
+					continue
+				}
+				ip := net.ParseIP(candidate)
+				if ip == nil {
+					malformed = true
+					break
+				}
+				if tp.IsTrusted(ip.String()) {
+					continue
+				}
+				return ip.String()
+			}
+			if !malformed {
+				for _, candidate := range entries {
+					candidate = strings.TrimSpace(candidate)
+					if ip := net.ParseIP(candidate); ip != nil {
+						return ip.String()
+					}
+				}
+			}
+		}
+		if xRealIP := strings.TrimSpace(r.Header.Get("X-Real-Ip")); xRealIP != "" {
+			if ip := net.ParseIP(xRealIP); ip != nil {
+				return ip.String()
+			}
+		}
+	}
+	return remoteIP.String()
+}
diff --git a/weed/s3api/policy_engine/trusted_proxies_test.go b/weed/s3api/policy_engine/trusted_proxies_test.go
new file mode 100644
index 0000000000..0af0f6861d
--- /dev/null
+++ b/weed/s3api/policy_engine/trusted_proxies_test.go
@@ -0,0 +1,151 @@
+package policy_engine
+
+import (
+	"net/http"
+	"testing"
+)
+
+func newReq(remoteAddr string, xff, xRealIP string) *http.Request {
+	r := &http.Request{RemoteAddr: remoteAddr, Header: http.Header{}}
+	if xff != "" {
+		r.Header.Set("X-Forwarded-For", xff)
+	}
+	if xRealIP != "" {
+		r.Header.Set("X-Real-Ip", xRealIP)
+	}
+	return r
+}
+
+func TestTrustedProxies_IsTrusted(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.5", "192.168.0.0/16"})
+	if !tp.IsTrusted("10.0.0.5") {
+		t.Error("bare IP should be trusted")
+	}
+	if !tp.IsTrusted("192.168.1.100") {
+		t.Error("IP in CIDR should be trusted")
+	}
+	if tp.IsTrusted("8.8.8.8") {
+		t.Error("public IP should not be trusted")
+	}
+	if tp.IsTrusted("not-an-ip") {
+		t.Error("invalid IP should not be trusted")
+	}
+}
+
+func TestTrustedProxies_CanonicalizesBareIPv6(t *testing.T) {
+	tp := NewTrustedProxies([]string{"2001:0db8::1"})
+	if !tp.IsTrusted("2001:db8::1") {
+		t.Error("canonical IPv6 should match non-canonical allowlist entry")
+	}
+}
+
+func TestTrustedProxies_InvalidBareIPSkipped(t *testing.T) {
+	tp := NewTrustedProxies([]string{"not-an-ip", "10.0.0.5"})
+	if tp.IsTrusted("not-an-ip") {
+		t.Error("invalid entry should not be stored")
+	}
+	if !tp.IsTrusted("10.0.0.5") {
+		t.Error("valid entry after invalid one should still load")
+	}
+}
+
+func TestTrustedProxies_IsTrustedPeer(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	if !tp.IsTrustedPeer(newReq("10.0.0.5:1234", "", "")) {
+		t.Error("peer in allowlist should be trusted")
+	}
+	if !tp.IsTrustedPeer(newReq("10.0.0.5:1234", "8.8.8.8", "")) {
+		t.Error("forwarded headers must not affect peer trust")
+	}
+	if tp.IsTrustedPeer(newReq("8.8.8.8:1234", "", "")) {
+		t.Error("peer outside allowlist should not be trusted")
+	}
+	if tp.IsTrustedPeer(newReq("not-an-addr", "", "")) {
+		t.Error("malformed RemoteAddr should not be trusted")
+	}
+	if tp.IsTrustedPeer(nil) {
+		t.Error("nil request should not be trusted")
+	}
+	var nilTP *TrustedProxies
+	if nilTP.IsTrustedPeer(newReq("10.0.0.5:1234", "", "")) {
+		t.Error("nil TrustedProxies should not trust any peer")
+	}
+}
+
+func TestTrustedProxies_NilNotTrusted(t *testing.T) {
+	var tp *TrustedProxies
+	if tp.IsTrusted("127.0.0.1") {
+		t.Error("nil TrustedProxies should not trust any IP")
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_DirectPeerWhenUntrusted(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	r := newReq("203.0.113.5:1234", "8.8.8.8", "1.1.1.1")
+	if got := tp.ExtractSourceIP(r); got != "203.0.113.5" {
+		t.Errorf("untrusted peer: want 203.0.113.5, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_XForwardedFor(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	r := newReq("10.0.0.1:1234", "8.8.8.8, 10.0.0.2", "")
+	if got := tp.ExtractSourceIP(r); got != "8.8.8.8" {
+		t.Errorf("trusted proxy: want 8.8.8.8, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_AllTrustedReturnsLeftmost(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	r := newReq("10.0.0.1:1234", "10.0.0.5, 10.0.0.6", "")
+	if got := tp.ExtractSourceIP(r); got != "10.0.0.5" {
+		t.Errorf("all-trusted chain: want leftmost 10.0.0.5, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_MalformedXFFFallsBackToPeer(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	r := newReq("10.0.0.1:1234", "8.8.8.8, garbage", "")
+	if got := tp.ExtractSourceIP(r); got != "10.0.0.1" {
+		t.Errorf("malformed XFF: want direct peer 10.0.0.1, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_XRealIP(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	r := newReq("10.0.0.1:1234", "", "8.8.8.8")
+	if got := tp.ExtractSourceIP(r); got != "8.8.8.8" {
+		t.Errorf("X-Real-Ip: want 8.8.8.8, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_XForwardedForPreferredOverXRealIP(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	r := newReq("10.0.0.1:1234", "8.8.8.8", "1.1.1.1")
+	if got := tp.ExtractSourceIP(r); got != "8.8.8.8" {
+		t.Errorf("XFF should win over X-Real-Ip: want 8.8.8.8, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_NoTrustedProxiesUsesPeer(t *testing.T) {
+	tp := NewTrustedProxies(nil)
+	r := newReq("10.0.0.1:1234", "8.8.8.8", "1.1.1.1")
+	if got := tp.ExtractSourceIP(r); got != "10.0.0.1" {
+		t.Errorf("empty allowlist: want 10.0.0.1, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_NilRequest(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	if got := tp.ExtractSourceIP(nil); got != "" {
+		t.Errorf("nil request: want empty, got %s", got)
+	}
+}
+
+func TestTrustedProxies_ExtractSourceIP_UnixSocket(t *testing.T) {
+	tp := NewTrustedProxies([]string{"10.0.0.0/24"})
+	r := newReq("@", "", "")
+	if got := tp.ExtractSourceIP(r); got != "@" {
+		t.Errorf("unix socket: want @, got %s", got)
+	}
+}
diff --git a/weed/s3api/policy_engine/types.go b/weed/s3api/policy_engine/types.go
index fe61b0263b..2979e21c43 100644
--- a/weed/s3api/policy_engine/types.go
+++ b/weed/s3api/policy_engine/types.go
@@ -315,6 +315,9 @@ type PolicyEvaluationArgs struct {
 	// inherited from the CreateMultipartUpload request for UploadPart and
 	// UploadPartCopy actions. The empty string means no SSE was used.
 	InheritedSSEAlgorithm string
+
+	// Original complete grant values supplement only positive string conditions in explicit denies, never allows or negative conditions.
+	OriginalGrantConditions map[string][]string
 }
 
 // PolicyCache for caching compiled policies
diff --git a/weed/s3api/request_body.go b/weed/s3api/request_body.go
new file mode 100644
index 0000000000..f55fc5c3e3
--- /dev/null
+++ b/weed/s3api/request_body.go
@@ -0,0 +1,23 @@
+package s3api
+
+import (
+	"errors"
+	"io"
+	"net/http"
+)
+
+var errRequestBodyTooLarge = errors.New("request body too large")
+
+func readRequestBody(r *http.Request, limit int64) ([]byte, error) {
+	if r.Body == nil {
+		return nil, nil
+	}
+	body, err := io.ReadAll(io.LimitReader(r.Body, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(body)) > limit {
+		return nil, errRequestBodyTooLarge
+	}
+	return body, nil
+}
diff --git a/weed/s3api/request_body_test.go b/weed/s3api/request_body_test.go
new file mode 100644
index 0000000000..0fc05b61ef
--- /dev/null
+++ b/weed/s3api/request_body_test.go
@@ -0,0 +1,24 @@
+package s3api
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestReadRequestBodyLeavesOversizedBodyDrainable(t *testing.T) {
+	req := httptest.NewRequest(http.MethodPost, "/", nil)
+	req.Body = io.NopCloser(strings.NewReader("abcdef"))
+
+	body, err := readRequestBody(req, 3)
+	remaining, readErr := io.ReadAll(req.Body)
+
+	assert.ErrorIs(t, err, errRequestBodyTooLarge)
+	assert.Nil(t, body)
+	assert.NoError(t, readErr)
+	assert.Equal(t, "ef", string(remaining))
+}
diff --git a/weed/s3api/s3_action_resolver.go b/weed/s3api/s3_action_resolver.go
index 4f25ef5376..ea33de78d0 100644
--- a/weed/s3api/s3_action_resolver.go
+++ b/weed/s3api/s3_action_resolver.go
@@ -33,6 +33,22 @@ func ResolveS3Action(r *http.Request, baseAction string, bucket string, object s
 		return baseAction
 	}
 
+	// Dedicated object-lock actions already name the operation — a query
+	// parameter must not re-map them. In particular the governance-bypass
+	// check authorizes against a synthetic DELETE ?versionId request, whose
+	// shape would otherwise resolve to s3:DeleteObjectVersion and satisfy
+	// the bypass check with the delete-version permission alone.
+	switch baseAction {
+	case s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION,
+		s3_constants.ACTION_GET_OBJECT_RETENTION,
+		s3_constants.ACTION_PUT_OBJECT_RETENTION,
+		s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD,
+		s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD,
+		s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG,
+		s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG:
+		return mapBaseActionToS3Format(baseAction)
+	}
+
 	if r == nil || r.URL == nil {
 		// No HTTP context available: fall back to coarse-grained mapping
 		// This ensures consistent behavior and avoids returning empty strings
@@ -97,6 +113,25 @@ var bucketQueryActions = map[string]map[string]string{
 		http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_OBJECT_LOCK,
 		http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK,
 	},
+	"encryption": {
+		http.MethodGet:    s3_constants.S3_ACTION_GET_BUCKET_ENCRYPTION,
+		http.MethodPut:    s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION,
+		http.MethodDelete: s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION, // DELETE uses same permission as PUT
+	},
+	"requestPayment": {
+		http.MethodGet: s3_constants.S3_ACTION_GET_BUCKET_REQUEST_PAYMENT,
+		http.MethodPut: s3_constants.S3_ACTION_PUT_BUCKET_REQUEST_PAYMENT,
+	},
+	"publicAccessBlock": {
+		http.MethodGet:    s3_constants.S3_ACTION_GET_BUCKET_PUBLIC_ACCESS_BLOCK,
+		http.MethodPut:    s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK,
+		http.MethodDelete: s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK, // DELETE uses same permission as PUT
+	},
+	"ownershipControls": {
+		http.MethodGet:    s3_constants.S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS,
+		http.MethodPut:    s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS,
+		http.MethodDelete: s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS, // DELETE uses same permission as PUT
+	},
 }
 
 // resolveFromQueryParameters checks query parameters to determine specific S3 actions
@@ -106,7 +141,9 @@ func resolveFromQueryParameters(query url.Values, method string, hasObject bool)
 	if hasObject && query.Has("uploadId") {
 		switch method {
 		case http.MethodPut:
-			if query.Has("partNumber") {
+			// Match the multipart route's [0-9]+ pattern; invalid part parameters fall through to regular uploads.
+			partNumber := query.Get("partNumber")
+			if partNumber != "" && strings.Trim(partNumber, "0123456789") == "" {
 				return s3_constants.S3_ACTION_UPLOAD_PART
 			}
 		case http.MethodPost:
@@ -129,15 +166,25 @@ func resolveFromQueryParameters(query url.Values, method string, hasObject bool)
 		}
 	}
 
-	// ACL operations
+	// ACL operations. A versionId retargets the request at a specific
+	// version, so the version ACL action applies, not the current-object one.
 	if query.Has("acl") {
+		versioned := hasObject && query.Get("versionId") != ""
 		switch method {
-		case http.MethodGet, http.MethodHead:
+		// HEAD has no acl route; it lands on HeadObjectHandler and should
+		// resolve like a read — s3:GetObject, or s3:GetObjectVersion below.
+		case http.MethodGet:
+			if versioned {
+				return s3_constants.S3_ACTION_GET_OBJECT_VERSION_ACL
+			}
 			if hasObject {
 				return s3_constants.S3_ACTION_GET_OBJECT_ACL
 			}
 			return s3_constants.S3_ACTION_GET_BUCKET_ACL
 		case http.MethodPut:
+			if versioned {
+				return s3_constants.S3_ACTION_PUT_OBJECT_VERSION_ACL
+			}
 			if hasObject {
 				return s3_constants.S3_ACTION_PUT_OBJECT_ACL
 			}
@@ -145,20 +192,33 @@ func resolveFromQueryParameters(query url.Values, method string, hasObject bool)
 		}
 	}
 
-	// Tagging operations
+	// Tagging operations. The routes match ?tagging whenever the key is
+	// present (gorilla/mux does not compare the value), so any value counts.
+	// A versionId retargets the request at a specific version, so the
+	// version-tagging action applies, not the current-object one.
 	if query.Has("tagging") {
+		versioned := hasObject && query.Get("versionId") != ""
 		switch method {
 		case http.MethodGet:
+			if versioned {
+				return s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING
+			}
 			if hasObject {
 				return s3_constants.S3_ACTION_GET_OBJECT_TAGGING
 			}
 			return s3_constants.S3_ACTION_GET_BUCKET_TAGGING
 		case http.MethodPut:
+			if versioned {
+				return s3_constants.S3_ACTION_PUT_OBJECT_VERSION_TAGGING
+			}
 			if hasObject {
 				return s3_constants.S3_ACTION_PUT_OBJECT_TAGGING
 			}
 			return s3_constants.S3_ACTION_PUT_BUCKET_TAGGING
 		case http.MethodDelete:
+			if versioned {
+				return s3_constants.S3_ACTION_DELETE_OBJECT_VERSION_TAGGING
+			}
 			if hasObject {
 				return s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING
 			}
@@ -170,6 +230,9 @@ func resolveFromQueryParameters(query url.Values, method string, hasObject bool)
 	// Must be checked before versionId, because GET /bucket/key?attributes&versionId=xyz
 	// is a GetObjectAttributes request, not a GetObjectVersion request
 	if hasObject && query.Has("attributes") && method == http.MethodGet {
+		if query.Get("versionId") != "" {
+			return s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES
+		}
 		return s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES
 	}
 
@@ -193,6 +256,12 @@ func resolveFromQueryParameters(query url.Values, method string, hasObject bool)
 		}
 	}
 
+	if query.Get("list-type") == "2" {
+		if method == http.MethodGet && !hasObject {
+			return s3_constants.S3_ACTION_LIST_BUCKET
+		}
+	}
+
 	// Check bucket-level query parameters using data-driven approach
 	// These are strictly bucket-level operations, so only apply when !hasObject
 	if !hasObject {
@@ -237,6 +306,17 @@ func resolveFromQueryParameters(query url.Values, method string, hasObject bool)
 		return s3_constants.S3_ACTION_DELETE_OBJECT
 	}
 
+	// SeaweedFS extension: the quota routes are registered last among the
+	// bucket subresource routes, so resolve seaweedfs-quota last to match.
+	if !hasObject && query.Has("seaweedfs-quota") {
+		switch method {
+		case http.MethodGet:
+			return s3_constants.S3_ACTION_GET_BUCKET_QUOTA
+		case http.MethodPut:
+			return s3_constants.S3_ACTION_PUT_BUCKET_QUOTA
+		}
+	}
+
 	return ""
 }
 
@@ -281,7 +361,9 @@ func resolveBucketLevelAction(method string, baseAction string) string {
 		}
 
 	case http.MethodPut:
-		if baseAction == s3_constants.ACTION_WRITE {
+		// CreateBucket is registered with ACTION_ADMIN; resolving it to s3:*
+		// would make it unmatchable by a policy granting s3:CreateBucket.
+		if baseAction == s3_constants.ACTION_WRITE || baseAction == s3_constants.ACTION_ADMIN {
 			return s3_constants.S3_ACTION_CREATE_BUCKET
 		}
 
@@ -345,6 +427,10 @@ func mapBaseActionToS3Format(baseAction string) string {
 		return s3_constants.S3_ACTION_PUT_BUCKET_POLICY
 	case s3_constants.ACTION_DELETE_BUCKET_POLICY:
 		return s3_constants.S3_ACTION_DELETE_BUCKET_POLICY
+	case s3_constants.ACTION_PUT_BUCKET_QUOTA:
+		return s3_constants.S3_ACTION_PUT_BUCKET_QUOTA
+	case s3_constants.ACTION_GET_BUCKET_QUOTA:
+		return s3_constants.S3_ACTION_GET_BUCKET_QUOTA
 	default:
 		// For unknown actions, prefix with s3: to maintain format consistency
 		return "s3:" + baseAction
diff --git a/weed/s3api/s3_action_resolver_test.go b/weed/s3api/s3_action_resolver_test.go
index 2b5709d004..d073355fd5 100644
--- a/weed/s3api/s3_action_resolver_test.go
+++ b/weed/s3api/s3_action_resolver_test.go
@@ -83,7 +83,7 @@ func TestResolveS3Action_AttributesBeforeVersionId(t *testing.T) {
 			method:     http.MethodGet,
 			baseAction: s3_constants.ACTION_READ,
 			object:     "key",
-			want:       s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES,
+			want:       s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES,
 		},
 		{
 			name:       "versionId only GET",
@@ -114,6 +114,230 @@ func TestResolveS3Action_AttributesBeforeVersionId(t *testing.T) {
 	}
 }
 
+// A tagging request carrying versionId targets a specific version and must
+// resolve to the version-tagging action so a grant limited to current-object
+// tagging cannot reach historical versions.
+func TestResolveS3Action_VersionTagging(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+		object string
+		query  string
+		want   string
+	}{
+		{"get current tags", http.MethodGet, "key", "tagging", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
+		{"put current tags", http.MethodPut, "key", "tagging", s3_constants.S3_ACTION_PUT_OBJECT_TAGGING},
+		{"delete current tags", http.MethodDelete, "key", "tagging", s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING},
+		{"get version tags", http.MethodGet, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING},
+		{"put version tags", http.MethodPut, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_PUT_OBJECT_VERSION_TAGGING},
+		{"delete version tags", http.MethodDelete, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_DELETE_OBJECT_VERSION_TAGGING},
+		{"empty versionId stays current", http.MethodGet, "key", "tagging&versionId=", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
+		{"bucket tagging ignores versionId", http.MethodGet, "", "tagging&versionId=v1", s3_constants.S3_ACTION_GET_BUCKET_TAGGING},
+		{"non-empty tagging is still tagging", http.MethodGet, "key", "tagging=x&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING},
+		{"non-empty tagging plain", http.MethodGet, "key", "tagging=x", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
+			if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
+				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// An ACL request carrying versionId targets a specific version and must
+// resolve to the version ACL action so a grant limited to the current-object
+// action cannot reach historical versions.
+func TestResolveS3Action_VersionAcl(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+		object string
+		query  string
+		want   string
+	}{
+		{"get current acl", http.MethodGet, "key", "acl", s3_constants.S3_ACTION_GET_OBJECT_ACL},
+		{"put current acl", http.MethodPut, "key", "acl", s3_constants.S3_ACTION_PUT_OBJECT_ACL},
+		{"get version acl", http.MethodGet, "key", "acl&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_ACL},
+		{"head acl resolves as head object", http.MethodHead, "key", "acl", s3_constants.S3_ACTION_GET_OBJECT},
+		{"head version acl resolves as head version", http.MethodHead, "key", "acl&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION},
+		{"put version acl", http.MethodPut, "key", "acl&versionId=v1", s3_constants.S3_ACTION_PUT_OBJECT_VERSION_ACL},
+		{"empty versionId stays current", http.MethodGet, "key", "acl&versionId=", s3_constants.S3_ACTION_GET_OBJECT_ACL},
+		{"bucket acl ignores versionId", http.MethodGet, "", "acl&versionId=v1", s3_constants.S3_ACTION_GET_BUCKET_ACL},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
+			if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
+				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// An attributes request carrying versionId targets a specific version and
+// must resolve to the version attributes action.
+func TestResolveS3Action_VersionAttributes(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+		object string
+		query  string
+		want   string
+	}{
+		{"get current attributes", http.MethodGet, "key", "attributes", s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES},
+		{"get version attributes", http.MethodGet, "key", "attributes&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
+			if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
+				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// Bucket subresources registered with ACTION_ADMIN must resolve to their own
+// S3 actions so a policy granting one of them does not need s3:*, and so no
+// broader grant sweeps them in.
+func TestResolveS3Action_AdminBucketSubresources(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+		query  string
+		want   string
+	}{
+		{"get encryption", http.MethodGet, "encryption", s3_constants.S3_ACTION_GET_BUCKET_ENCRYPTION},
+		{"put encryption", http.MethodPut, "encryption", s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION},
+		{"delete encryption", http.MethodDelete, "encryption", s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION},
+		{"get requestPayment", http.MethodGet, "requestPayment", s3_constants.S3_ACTION_GET_BUCKET_REQUEST_PAYMENT},
+		{"put requestPayment", http.MethodPut, "requestPayment", s3_constants.S3_ACTION_PUT_BUCKET_REQUEST_PAYMENT},
+		{"get publicAccessBlock", http.MethodGet, "publicAccessBlock", s3_constants.S3_ACTION_GET_BUCKET_PUBLIC_ACCESS_BLOCK},
+		{"put publicAccessBlock", http.MethodPut, "publicAccessBlock", s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK},
+		{"delete publicAccessBlock", http.MethodDelete, "publicAccessBlock", s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK},
+		{"get ownershipControls", http.MethodGet, "ownershipControls", s3_constants.S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS},
+		{"put ownershipControls", http.MethodPut, "ownershipControls", s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS},
+		{"delete ownershipControls", http.MethodDelete, "ownershipControls", s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest(tt.method, "http://localhost/bucket?"+tt.query, nil)
+			got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "bucket", "")
+			if got != tt.want {
+				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// CreateBucket is a plain bucket-level PUT registered with ACTION_ADMIN. It
+// must resolve to s3:CreateBucket so an attached policy granting that action
+// can authorize it without granting s3:*.
+func TestResolveS3Action_CreateBucket(t *testing.T) {
+	r, _ := http.NewRequest(http.MethodPut, "http://localhost/new-bucket", nil)
+	if got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "new-bucket", ""); got != s3_constants.S3_ACTION_CREATE_BUCKET {
+		t.Errorf("ResolveS3Action() = %q, want %q", got, s3_constants.S3_ACTION_CREATE_BUCKET)
+	}
+}
+
+// list-type selects ListObjectsV2, which the router registers ahead of the
+// bucket subresource routes. The resolver must align with routing and resolve
+// it to s3:ListBucket even when an operation subresource like ownershipControls
+// is also present, so authorization checks the listing action the handler runs.
+func TestResolveS3Action_ListType(t *testing.T) {
+	tests := []struct {
+		name  string
+		query string
+		want  string
+	}{
+		{"list-type alone", "list-type=2", s3_constants.S3_ACTION_LIST_BUCKET},
+		{"list-type with listing params", "list-type=2&prefix=a&continuation-token=x", s3_constants.S3_ACTION_LIST_BUCKET},
+		{"list-type with ownershipControls", "list-type=2&ownershipControls=", s3_constants.S3_ACTION_LIST_BUCKET},
+		// The router only selects ListObjectsV2 for list-type=2; another value
+		// falls through to the subresource route, so ownershipControls wins.
+		{"list-type=1 with ownershipControls", "list-type=1&ownershipControls=", s3_constants.S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest(http.MethodGet, "http://localhost/bucket?"+tt.query, nil)
+			if got := ResolveS3Action(r, s3_constants.ACTION_LIST, "bucket", ""); got != tt.want {
+				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// The seaweedfs-quota routes are registered last among the bucket subresource
+// routes, so the resolver must resolve it last as well: a request combining it
+// with another selector is served by that selector's handler, and authorization
+// must name the same operation.
+func TestResolveS3Action_Quota(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+		query  string
+		want   string
+	}{
+		{"quota get", http.MethodGet, "seaweedfs-quota", s3_constants.S3_ACTION_GET_BUCKET_QUOTA},
+		{"quota put", http.MethodPut, "seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_QUOTA},
+		{"policy wins over quota", http.MethodPut, "policy&seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_POLICY},
+		{"quota after policy wins too", http.MethodPut, "seaweedfs-quota&policy", s3_constants.S3_ACTION_PUT_BUCKET_POLICY},
+		{"tagging wins over quota", http.MethodPut, "tagging&seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_TAGGING},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest(tt.method, "http://localhost/bucket?"+tt.query, nil)
+			if got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "bucket", ""); got != tt.want {
+				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+// Dedicated object-lock actions already name the operation being authorized;
+// competing query parameters must not re-map them. Notably the synthetic
+// DELETE ?versionId request behind the governance-bypass check must stay
+// s3:BypassGovernanceRetention rather than resolving to s3:DeleteObjectVersion.
+func TestResolveS3ActionDedicatedObjectLockActions(t *testing.T) {
+	tests := []struct {
+		name       string
+		method     string
+		object     string
+		query      string
+		baseAction string
+		want       string
+	}{
+		{"bypass on versioned delete shape", http.MethodDelete, "key", "versionId=abc123",
+			s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, s3_constants.S3_ACTION_BYPASS_GOVERNANCE},
+		{"bypass on batch delete shape", http.MethodPost, "", "delete",
+			s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, s3_constants.S3_ACTION_BYPASS_GOVERNANCE},
+		{"get retention with versionId", http.MethodGet, "key", "retention&versionId=abc123",
+			s3_constants.ACTION_GET_OBJECT_RETENTION, s3_constants.S3_ACTION_GET_OBJECT_RETENTION},
+		{"put retention with versionId", http.MethodPut, "key", "retention&versionId=abc123",
+			s3_constants.ACTION_PUT_OBJECT_RETENTION, s3_constants.S3_ACTION_PUT_OBJECT_RETENTION},
+		{"get legal hold with versionId", http.MethodGet, "key", "legal-hold&versionId=abc123",
+			s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD, s3_constants.S3_ACTION_GET_OBJECT_LEGAL_HOLD},
+		{"put legal hold with versionId", http.MethodPut, "key", "legal-hold&versionId=abc123",
+			s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD, s3_constants.S3_ACTION_PUT_OBJECT_LEGAL_HOLD},
+		{"get object-lock config", http.MethodGet, "", "object-lock&versioning",
+			s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG, s3_constants.S3_ACTION_GET_BUCKET_OBJECT_LOCK},
+		{"put object-lock config", http.MethodPut, "", "object-lock",
+			s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG, s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
+			if got := ResolveS3Action(r, tt.baseAction, "bucket", tt.object); got != tt.want {
+				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
 // A base action naming another service carries no S3 request shape, so a query
 // parameter on the request must not redirect it to an S3 action.
 func TestResolveS3ActionKeepsNonS3Service(t *testing.T) {
diff --git a/weed/s3api/s3_constants/buckets.go b/weed/s3api/s3_constants/buckets.go
index a10cf0f504..3f9a9e9011 100644
--- a/weed/s3api/s3_constants/buckets.go
+++ b/weed/s3api/s3_constants/buckets.go
@@ -3,4 +3,9 @@ package s3_constants
 const (
 	// DefaultBucketsPath is the default path for S3 buckets in the filer
 	DefaultBucketsPath = "/buckets"
+
+	// ObjectWriteRouteKeyPrefix namespaces a full path into the ring key used to
+	// resolve and forward writes to it. Every writer of an object or bucket
+	// entry hashes this same key, so they serialize on one filer's path lock.
+	ObjectWriteRouteKeyPrefix = "s3.object.write:"
 )
diff --git a/weed/s3api/s3_constants/crypto.go b/weed/s3api/s3_constants/crypto.go
index 398e2b6696..f2a749bda2 100644
--- a/weed/s3api/s3_constants/crypto.go
+++ b/weed/s3api/s3_constants/crypto.go
@@ -10,6 +10,10 @@ const (
 	SSEAlgorithmAES256 = "AES256"
 	SSEAlgorithmKMS    = "aws:kms"
 
+	// SSEKMSDefaultKeyID is the AWS-managed key SSE-KMS requests resolve to
+	// when no key ID is given, matching AWS's aws/s3 managed key alias.
+	SSEKMSDefaultKeyID = "alias/aws/s3"
+
 	// SSE type identifiers for response headers and internal processing
 	SSETypeC   = "SSE-C"
 	SSETypeKMS = "SSE-KMS"
diff --git a/weed/s3api/s3_constants/extend_key.go b/weed/s3api/s3_constants/extend_key.go
index fe7c9ec810..959a962473 100644
--- a/weed/s3api/s3_constants/extend_key.go
+++ b/weed/s3api/s3_constants/extend_key.go
@@ -28,6 +28,12 @@ const (
 	// the entry's own mtime so legacy data still expires.
 	ExtNoncurrentSinceNsKey = "Seaweed-X-Amz-Noncurrent-Since-Ns"
 
+	// Set on a .versions directory when a suspended-versioning write made the
+	// base-path null object the current version; cleared whenever a version in
+	// the directory becomes current. Unlike an absent latest pointer, which a
+	// replica may simply not have received yet, this is an explicit signal.
+	ExtNullVersionIsLatestKey = "Seaweed-X-Amz-Null-Version-Is-Latest"
+
 	// Per-bucket opt-in for the PutObject lifecycle TTL fast path ("true"
 	// to enable). When on, an Expiration.Days rule is stamped as a volume
 	// TTL at write time instead of being expired by the worker. Off by
@@ -43,6 +49,10 @@ const (
 	// Bucket Policy
 	ExtBucketPolicyKey = "Seaweed-X-Amz-Bucket-Policy"
 
+	// Every attribute the s3tables catalog stores on a table bucket, namespace,
+	// table or view directory entry starts with this.
+	ExtS3TablesPrefix = "s3tables."
+
 	// Object Retention and Legal Hold
 	ExtObjectLockModeKey     = "Seaweed-X-Amz-Object-Lock-Mode"
 	ExtRetentionUntilDateKey = "Seaweed-X-Amz-Retention-Until-Date"
diff --git a/weed/s3api/s3_constants/header.go b/weed/s3api/s3_constants/header.go
index aa13c6df5f..a49d40220e 100644
--- a/weed/s3api/s3_constants/header.go
+++ b/weed/s3api/s3_constants/header.go
@@ -18,6 +18,9 @@ package s3_constants
 
 import (
 	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
 	"net/http"
 	"strings"
 	"sync/atomic"
@@ -58,6 +61,9 @@ const (
 	AmzDeleteMarker     = "X-Amz-Delete-Marker"
 
 	SeaweedFSUploadId                = "X-Seaweedfs-Upload-Id"
+	SeaweedFSExtract                 = "X-Seaweedfs-Extract"
+	SeaweedFSExtractedCount          = "X-Seaweedfs-Extracted-Count"
+	AmzMetaSnowballAutoExtract       = "X-Amz-Meta-Snowball-Auto-Extract"
 	SeaweedFSMultipartPartsCount     = "X-Seaweedfs-Multipart-Parts-Count"
 	SeaweedFSMultipartPartBoundaries = "X-Seaweedfs-Multipart-Part-Boundaries" // JSON: [{part:1,start:0,end:2,etag:"abc"},{part:2,start:2,end:3,etag:"def"}]
 	SeaweedFSExpiresS3               = "X-Seaweedfs-Expires-S3"
@@ -87,6 +93,7 @@ const (
 	AmzTrailer              = "X-Amz-Trailer"
 	AmzSdkChecksumAlgorithm = "X-Amz-Sdk-Checksum-Algorithm"
 	AmzChecksumType         = "X-Amz-Checksum-Type"
+	AmzChecksumMode         = "X-Amz-Checksum-Mode"
 
 	// S3 checksum type values (x-amz-checksum-type). A COMPOSITE checksum is a
 	// checksum-of-per-part-checksums ("base64-N"); a FULL_OBJECT checksum is the
@@ -107,6 +114,9 @@ const (
 	AmzCopySourceIfUnmodifiedSince = "X-Amz-Copy-Source-If-Unmodified-Since"
 
 	// RenameObject
+	// AmzClientToken makes a rename idempotent. The AWS SDKs fill it in on every
+	// call, so it arrives on requests that were never written with it in mind.
+	AmzClientToken                   = "X-Amz-Client-Token"
 	AmzRenameSource                  = "X-Amz-Rename-Source"
 	AmzRenameSourceIfMatch           = "X-Amz-Rename-Source-If-Match"
 	AmzRenameSourceIfNoneMatch       = "X-Amz-Rename-Source-If-None-Match"
@@ -139,6 +149,12 @@ const (
 	// SeaweedFS internal metadata prefix (used to filter internal headers from client responses)
 	SeaweedFSInternalPrefix = "x-seaweedfs-"
 
+	// SeaweedFSPrefixObject marks a directory entry that also holds the object named by
+	// its path without a trailing slash. S3 keys are flat, so "a/b" and "a/b/c" are
+	// independent keys, and the filer stores the first one on the directory the second
+	// one lives under.
+	SeaweedFSPrefixObject = "x-seaweedfs-prefix-object"
+
 	// SeaweedFS internal metadata keys for encryption (prefixed to avoid automatic HTTP header conversion)
 	SeaweedFSSSEKMSKey = "x-seaweedfs-sse-kms-key" // Key for storing serialized SSE-KMS metadata
 	SeaweedFSSSES3Key  = "x-seaweedfs-sse-s3-key"  // Key for storing serialized SSE-S3 metadata
@@ -151,6 +167,18 @@ const (
 	SeaweedFSSSEKMSEncryptionContext = "x-seaweedfs-sse-kms-encryption-context" // Encryption context for multipart upload SSE-KMS inheritance
 	SeaweedFSSSEKMSBaseIV            = "x-seaweedfs-sse-kms-base-iv"            // Base IV for multipart upload SSE-KMS (for IV offset calculation)
 
+	// SeaweedFSRenameToken records the x-amz-client-token of the rename that put an
+	// object at its key, together with the source that rename named. It rides on the
+	// object itself, so every gateway reads the same answer for a retry of that
+	// rename, and it is dropped whenever the key is written again.
+	SeaweedFSRenameToken = "x-seaweedfs-rename-token"
+
+	// SeaweedFSWriteId identifies the single write that stored an entry: putToFiler
+	// stamps a fresh id into Extended on every call. Recovery for an ambiguously
+	// committed write compares it to tell its own entry from an identical older
+	// object — chunk lists cannot, since an empty object carries none.
+	SeaweedFSWriteId = "x-seaweedfs-write-id"
+
 	// Multipart upload metadata keys for SSE-S3
 	SeaweedFSSSES3Encryption = "x-seaweedfs-sse-s3-encryption" // Encryption type for multipart upload SSE-S3 inheritance
 	SeaweedFSSSES3BaseIV     = "x-seaweedfs-sse-s3-base-iv"    // Base IV for multipart upload SSE-S3 (for IV offset calculation)
@@ -191,10 +219,21 @@ func GetBucketAndObject(r *http.Request) (bucket, object string) {
 	return
 }
 
-// IsValidObjectKey rejects S3 object keys that — after normalization
-// (backslash→slash, slash collapse) — contain a `.` or `..` path segment, or
-// embed a NUL byte. Such keys are collapsed by filepath.Join inside the filer
-// and would escape the bucket directory, so they must not reach the gRPC layer.
+// allowBackslashInObjectKey keeps '\' a literal object-key character instead
+// of normalizing it to '/'. It is a process-wide mode set once at S3 server
+// startup; the filer only treats '/' as a path separator, so a verbatim '\'
+// stays inside one filer entry name.
+var allowBackslashInObjectKey atomic.Bool
+
+func SetAllowBackslashInObjectKey(allow bool) {
+	allowBackslashInObjectKey.Store(allow)
+}
+
+// IsValidObjectKey rejects S3 object keys that — after the mode-dependent
+// normalization NormalizeObjectKey applies — contain a `.` or `..` path
+// segment, or embed a NUL byte. Such keys are collapsed by filepath.Join
+// inside the filer and would escape the bucket directory, so they must not
+// reach the gRPC layer.
 // Gorilla mux URL-decodes captured vars before this runs, so `%2e%2e` is
 // already `..` here.
 func IsValidObjectKey(object string) bool {
@@ -204,7 +243,9 @@ func IsValidObjectKey(object string) bool {
 	if strings.ContainsRune(object, '\x00') {
 		return false
 	}
-	object = strings.ReplaceAll(object, "\\", "/")
+	if !allowBackslashInObjectKey.Load() {
+		object = strings.ReplaceAll(object, "\\", "/")
+	}
 	for _, seg := range strings.Split(object, "/") {
 		if seg == "." || seg == ".." {
 			return false
@@ -238,7 +279,8 @@ func IsValidPathSegment(value string) bool {
 
 // NormalizeObjectKey normalizes object keys by removing duplicate slashes and converting backslashes.
 // This normalizes keys from various sources (URL path, form values, etc.) to a consistent format.
-// It also converts Windows-style backslashes to forward slashes for cross-platform compatibility.
+// It also converts Windows-style backslashes to forward slashes for cross-platform compatibility,
+// unless allowBackslashInObjectKey is set.
 // Returns keys WITHOUT leading slash to match S3 API format (e.g., "foo/bar" not "/foo/bar").
 // Preserves trailing slash if present (e.g., "foo/" stays "foo/").
 func NormalizeObjectKey(object string) string {
@@ -246,7 +288,9 @@ func NormalizeObjectKey(object string) string {
 	hasTrailingSlash := strings.HasSuffix(object, "/")
 
 	// Convert Windows-style backslashes to forward slashes
-	object = strings.ReplaceAll(object, "\\", "/")
+	if !allowBackslashInObjectKey.Load() {
+		object = strings.ReplaceAll(object, "\\", "/")
+	}
 	object = removeDuplicateSlashes(object)
 	// Remove leading slash to match S3 API format
 	object = strings.TrimPrefix(object, "/")
@@ -306,10 +350,15 @@ func IsSeaweedFSInternalHeader(headerKey string) bool {
 type contextKey string
 
 const (
-	contextKeyIdentityName   contextKey = "s3-identity-name"
-	contextKeyIdentityObject contextKey = "s3-identity-object"
-	contextKeyIdentityHolder contextKey = "s3-identity-holder"
-	contextKeyPrincipalArn   contextKey = "s3-principal-arn"
+	contextKeyIdentityName        contextKey = "s3-identity-name"
+	contextKeyIdentityObject      contextKey = "s3-identity-object"
+	contextKeyIdentityHolder      contextKey = "s3-identity-holder"
+	contextKeyPrincipalArn        contextKey = "s3-principal-arn"
+	contextKeyIdentityClaim       contextKey = "s3-identity-claim"
+	contextKeyIgnoredSessionToken contextKey = "s3-ignored-session-token"
+	contextKeyOriginalRequestPath contextKey = "s3-original-request-path"
+	contextKeyAccessKeyId         contextKey = "s3-access-key-id"
+	contextKeyStoredAccessKeyId   contextKey = "s3-stored-access-key-id"
 )
 
 // identityHolder is a mutable container for the authenticated identity name,
@@ -320,8 +369,37 @@ const (
 // holder installed before authentication is shared across all copies, so the
 // name written by the inner handler is readable by the outer middleware.
 type identityHolder struct {
-	name         atomic.Pointer[string]
-	principalArn atomic.Pointer[string]
+	name             atomic.Pointer[string]
+	principalArn     atomic.Pointer[string]
+	identityClaim    atomic.Pointer[string]
+	accessKeyId      atomic.Pointer[string]
+	storedCredential atomic.Pointer[storedCredential]
+}
+
+// storedCredential is the stored-identity credential a request authenticated
+// with: the access key id and its secret, so a credential vendor can bind
+// what it mints to this exact credential instance.
+type storedCredential struct {
+	accessKeyId string
+	secretKey   string
+}
+
+// StoredCredentialFingerprint identifies one credential instance. The key id
+// alone cannot: an operator can delete a key and re-create it under the same
+// id with a different secret. The fingerprint travels inside the vended
+// session token, so it is keyed with a server-held key — an unkeyed hash of
+// the secret would hand the token holder an offline guessing oracle.
+func StoredCredentialFingerprint(fingerprintKey []byte, accessKeyId, secretKey string) string {
+	if len(fingerprintKey) == 0 {
+		return ""
+	}
+	h := hmac.New(sha256.New, fingerprintKey)
+	h.Write([]byte("seaweedfs-stored-credential"))
+	h.Write([]byte{0})
+	h.Write([]byte(accessKeyId))
+	h.Write([]byte{0})
+	h.Write([]byte(secretKey))
+	return hex.EncodeToString(h.Sum(nil)[:16])
 }
 
 // EnsureIdentityHolder attaches a mutable identity holder to the request context
@@ -400,6 +478,193 @@ func GetPrincipalArnFromContext(r *http.Request) string {
 	return ""
 }
 
+// SetIdentityClaimInContext stores the authoritative OIDC identity claim (e.g.
+// preferred_username, email, sub) for the audit log. For an STS-assumed OIDC
+// session the requester name is an opaque session subject, so the claim is the
+// only place a stable, human-readable federated identity survives to the audit
+// log. Empty for non-federated sessions, where the requester name already
+// carries the real username.
+func SetIdentityClaimInContext(ctx context.Context, identityClaim string) context.Context {
+	if identityClaim == "" {
+		return ctx
+	}
+	if h, ok := ctx.Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		h.identityClaim.Store(&identityClaim)
+	}
+	return context.WithValue(ctx, contextKeyIdentityClaim, identityClaim)
+}
+
+// GetIdentityClaimFromContext retrieves the authoritative OIDC identity claim
+// from the request context, or "" when the request is unauthenticated or not
+// federated.
+func GetIdentityClaimFromContext(r *http.Request) string {
+	if claim, ok := r.Context().Value(contextKeyIdentityClaim).(string); ok && claim != "" {
+		return claim
+	}
+	if h, ok := r.Context().Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		if claim := h.identityClaim.Load(); claim != nil {
+			return *claim
+		}
+	}
+	return ""
+}
+
+// SetOriginalRequestPathInContext records the path a client actually sent
+// before an internal rewrite (e.g. the Iceberg catalog collapsing a doubled
+// /v1 prefix). SigV4 verification must run against this path: the client
+// signed the URI it requested, not the normalized path it was routed with.
+func SetOriginalRequestPathInContext(ctx context.Context, path string) context.Context {
+	if path == "" {
+		return ctx
+	}
+	return context.WithValue(ctx, contextKeyOriginalRequestPath, path)
+}
+
+// GetOriginalRequestPathFromContext returns the pre-rewrite request path
+// recorded by SetOriginalRequestPathInContext, or "" when unset.
+func GetOriginalRequestPathFromContext(r *http.Request) string {
+	if path, ok := r.Context().Value(contextKeyOriginalRequestPath).(string); ok {
+		return path
+	}
+	return ""
+}
+
+// SetAccessKeyIdInContext stores the access key id the request authenticated
+// with: a static key's id, or an STS session's temporary key id. Several keys
+// can belong to one identity, so the identity name alone cannot tell their
+// holders apart in the audit log. An access key id is not a secret (AWS logs
+// it in CloudTrail); the secret key never reaches the context.
+func SetAccessKeyIdInContext(ctx context.Context, accessKeyId string) context.Context {
+	if accessKeyId == "" {
+		return ctx
+	}
+	if h, ok := ctx.Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		h.accessKeyId.Store(&accessKeyId)
+	}
+	return context.WithValue(ctx, contextKeyAccessKeyId, accessKeyId)
+}
+
+// RecordAccessKeyId stores the access key id of a credential whose signature
+// was just verified into the request's identity holder, so the outer
+// middleware (the audit fallback) and the handler both see it. A no-op without
+// a holder (EnsureIdentityHolder) or without a key. Only a verifier calls it:
+// the key comes from the credential that matched, never from re-reading the
+// request, whose shape the verifier already resolved.
+func RecordAccessKeyId(ctx context.Context, accessKeyId string) {
+	if ctx == nil || accessKeyId == "" {
+		return
+	}
+	if h, ok := ctx.Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		h.accessKeyId.Store(&accessKeyId)
+	}
+}
+
+// GetAccessKeyIdFromContext retrieves the access key id the request
+// authenticated with, or "" when it carried none (anonymous, OIDC bearer).
+func GetAccessKeyIdFromContext(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	return AccessKeyIdFromContext(r.Context())
+}
+
+// AccessKeyIdFromContext is GetAccessKeyIdFromContext for code that holds
+// only the request's context, such as the Iceberg credential vendor.
+func AccessKeyIdFromContext(ctx context.Context) string {
+	if ctx == nil {
+		return ""
+	}
+	if id, ok := ctx.Value(contextKeyAccessKeyId).(string); ok && id != "" {
+		return id
+	}
+	if h, ok := ctx.Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		if id := h.accessKeyId.Load(); id != nil {
+			return *id
+		}
+	}
+	return ""
+}
+
+// SetStoredAccessKeyIdInContext records the stored-identity credential the
+// request authenticated with — set by an authenticator that verified the
+// credential against the identity store, so a credential vendor can tell the
+// caller apart from an STS session or OIDC user holding a key the store never
+// issued.
+func SetStoredAccessKeyIdInContext(ctx context.Context, accessKeyId, secretKey string) context.Context {
+	if accessKeyId == "" {
+		return ctx
+	}
+	sc := storedCredential{accessKeyId, secretKey}
+	if h, ok := ctx.Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		h.storedCredential.Store(&sc)
+	}
+	return context.WithValue(ctx, contextKeyStoredAccessKeyId, sc)
+}
+
+// RecordStoredAccessKeyId stores the stored-credential marker into the
+// request's identity holder: a verifier calls it when the credential that
+// matched resolves to a key held by a configured identity. A no-op without a
+// holder (EnsureIdentityHolder) or without a key.
+func RecordStoredAccessKeyId(ctx context.Context, accessKeyId, secretKey string) {
+	if ctx == nil || accessKeyId == "" {
+		return
+	}
+	sc := storedCredential{accessKeyId, secretKey}
+	if h, ok := ctx.Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		h.storedCredential.Store(&sc)
+	}
+}
+
+// StoredAccessKeyIdFromContext retrieves the stored-identity access key id the
+// request authenticated with, or "" when it authenticated another way (STS
+// session, OIDC bearer, anonymous).
+func StoredAccessKeyIdFromContext(ctx context.Context) string {
+	sc, _ := storedCredentialFromContext(ctx)
+	return sc.accessKeyId
+}
+
+// StoredCredentialFromContext retrieves the stored-identity access key id and
+// secret the request authenticated with, or "", "" when it authenticated
+// another way (STS session, OIDC bearer, anonymous).
+func StoredCredentialFromContext(ctx context.Context) (string, string) {
+	sc, ok := storedCredentialFromContext(ctx)
+	if !ok {
+		return "", ""
+	}
+	return sc.accessKeyId, sc.secretKey
+}
+
+func storedCredentialFromContext(ctx context.Context) (storedCredential, bool) {
+	if ctx == nil {
+		return storedCredential{}, false
+	}
+	if sc, ok := ctx.Value(contextKeyStoredAccessKeyId).(storedCredential); ok && sc.accessKeyId != "" {
+		return sc, true
+	}
+	if h, ok := ctx.Value(contextKeyIdentityHolder).(*identityHolder); ok && h != nil {
+		if sc := h.storedCredential.Load(); sc != nil && sc.accessKeyId != "" {
+			return *sc, true
+		}
+	}
+	return storedCredential{}, false
+}
+
+// IgnoreSessionTokenInContext marks the request's session token as tolerated
+// rather than authenticated: a statically configured access key signed the
+// request, so the token (which credential vendors like Unity Catalog emit on
+// static credentials too) must not steer authorization into the STS session
+// path. A context value because headers can be spoofed; this cannot.
+func IgnoreSessionTokenInContext(ctx context.Context) context.Context {
+	return context.WithValue(ctx, contextKeyIgnoredSessionToken, true)
+}
+
+// IsSessionTokenIgnored reports whether the request carries a session token
+// that was tolerated for a statically configured access key.
+func IsSessionTokenIgnored(ctx context.Context) bool {
+	ignored, _ := ctx.Value(contextKeyIgnoredSessionToken).(bool)
+	return ignored
+}
+
 // SetIdentityInContext stores the full authenticated identity object in the request context
 // This is used to pass the full identity (including for JWT users) to handlers
 func SetIdentityInContext(ctx context.Context, identity interface{}) context.Context {
diff --git a/weed/s3api/s3_constants/header_test.go b/weed/s3api/s3_constants/header_test.go
index 7e45882710..2d30f3e859 100644
--- a/weed/s3api/s3_constants/header_test.go
+++ b/weed/s3api/s3_constants/header_test.go
@@ -123,6 +123,54 @@ func TestIsValidObjectKey(t *testing.T) {
 	}
 }
 
+func TestNormalizeObjectKeyAllowBackslash(t *testing.T) {
+	SetAllowBackslashInObjectKey(true)
+	defer SetAllowBackslashInObjectKey(false)
+
+	normalizeTests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{"backslash kept verbatim", "folder\\file.txt", "folder\\file.txt"},
+		{"nested backslash kept", "folder\\sub\\file.txt", "folder\\sub\\file.txt"},
+		{"trailing backslash kept", "folder\\", "folder\\"},
+		{"lone backslash kept", "\\", "\\"},
+		{"double backslash kept", "a\\\\b", "a\\\\b"},
+		{"mixed separators", "folder\\sub/another\\file.txt", "folder\\sub/another\\file.txt"},
+		{"duplicate slashes still collapse", "folder//sub///file.txt", "folder/sub/file.txt"},
+		{"leading slash still trimmed", "/folder\\file.txt", "folder\\file.txt"},
+		{"trailing slash preserved", "folder/", "folder/"},
+		{"windows path style", "C:\\Users\\test\\file.txt", "C:\\Users\\test\\file.txt"},
+	}
+	for _, tt := range normalizeTests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := NormalizeObjectKey(tt.input); got != tt.expected {
+				t.Errorf("NormalizeObjectKey(%q) = %q, want %q", tt.input, got, tt.expected)
+			}
+		})
+	}
+
+	validTests := []struct {
+		name  string
+		input string
+		want  bool
+	}{
+		{"backslash dotdot is one segment", "..\\evil\\test.txt", true},
+		{"backslash dotdot inside", "good\\..\\evil/test.txt", true},
+		{"nested dotdot still rejected", "good/../evil/test.txt", false},
+		{"leading dotdot still rejected", "../evil/test.txt", false},
+		{"plain backslash key", "folder\\file.txt", true},
+	}
+	for _, tt := range validTests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := IsValidObjectKey(tt.input); got != tt.want {
+				t.Errorf("IsValidObjectKey(%q) = %v, want %v", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
 func TestIsValidBucketName(t *testing.T) {
 	tests := []struct {
 		name  string
@@ -265,3 +313,20 @@ func TestGetIdentityNameFromContextWithoutHolder(t *testing.T) {
 		t.Errorf("requester = %q, want admin", got)
 	}
 }
+
+func TestStoredCredentialFingerprintIsKeyed(t *testing.T) {
+	key := []byte("test-signing-key-32-characters!!")
+	fp := StoredCredentialFingerprint(key, "AKIAEXAMPLE", "secret")
+	if fp == "" {
+		t.Fatal("fingerprint is empty with a key")
+	}
+	if again := StoredCredentialFingerprint(key, "AKIAEXAMPLE", "secret"); again != fp {
+		t.Error("fingerprint is not deterministic")
+	}
+	if other := StoredCredentialFingerprint([]byte("another-signing-key-padded-out"), "AKIAEXAMPLE", "secret"); other == fp {
+		t.Error("fingerprint ignores the server key, leaving the secret guessable")
+	}
+	if noKey := StoredCredentialFingerprint(nil, "AKIAEXAMPLE", "secret"); noKey != "" {
+		t.Error("an empty key must yield an empty fingerprint")
+	}
+}
diff --git a/weed/s3api/s3_constants/s3_action_strings.go b/weed/s3api/s3_constants/s3_action_strings.go
index 5d96ba2c8d..124a29e5d2 100644
--- a/weed/s3api/s3_constants/s3_action_strings.go
+++ b/weed/s3api/s3_constants/s3_action_strings.go
@@ -4,22 +4,32 @@ package s3_constants
 // These match the official AWS S3 action format used in IAM and bucket policies
 const (
 	// Object operations
-	S3_ACTION_GET_OBJECT            = "s3:GetObject"
-	S3_ACTION_PUT_OBJECT            = "s3:PutObject"
-	S3_ACTION_DELETE_OBJECT         = "s3:DeleteObject"
-	S3_ACTION_DELETE_OBJECT_VERSION = "s3:DeleteObjectVersion"
-	S3_ACTION_GET_OBJECT_VERSION    = "s3:GetObjectVersion"
-	S3_ACTION_GET_OBJECT_ATTRIBUTES = "s3:GetObjectAttributes"
+	S3_ACTION_GET_OBJECT                    = "s3:GetObject"
+	S3_ACTION_PUT_OBJECT                    = "s3:PutObject"
+	S3_ACTION_DELETE_OBJECT                 = "s3:DeleteObject"
+	S3_ACTION_DELETE_OBJECT_VERSION         = "s3:DeleteObjectVersion"
+	S3_ACTION_GET_OBJECT_VERSION            = "s3:GetObjectVersion"
+	S3_ACTION_GET_OBJECT_ATTRIBUTES         = "s3:GetObjectAttributes"
+	S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES = "s3:GetObjectVersionAttributes"
 
 	// Object ACL operations
 	S3_ACTION_GET_OBJECT_ACL = "s3:GetObjectAcl"
 	S3_ACTION_PUT_OBJECT_ACL = "s3:PutObjectAcl"
 
+	// Version-specific ACL operations (?acl&versionId)
+	S3_ACTION_GET_OBJECT_VERSION_ACL = "s3:GetObjectVersionAcl"
+	S3_ACTION_PUT_OBJECT_VERSION_ACL = "s3:PutObjectVersionAcl"
+
 	// Object tagging operations
 	S3_ACTION_GET_OBJECT_TAGGING    = "s3:GetObjectTagging"
 	S3_ACTION_PUT_OBJECT_TAGGING    = "s3:PutObjectTagging"
 	S3_ACTION_DELETE_OBJECT_TAGGING = "s3:DeleteObjectTagging"
 
+	// Version-specific tagging operations (?tagging&versionId)
+	S3_ACTION_GET_OBJECT_VERSION_TAGGING    = "s3:GetObjectVersionTagging"
+	S3_ACTION_PUT_OBJECT_VERSION_TAGGING    = "s3:PutObjectVersionTagging"
+	S3_ACTION_DELETE_OBJECT_VERSION_TAGGING = "s3:DeleteObjectVersionTagging"
+
 	// Object retention and legal hold
 	S3_ACTION_GET_OBJECT_RETENTION  = "s3:GetObjectRetention"
 	S3_ACTION_PUT_OBJECT_RETENTION  = "s3:PutObjectRetention"
@@ -81,6 +91,92 @@ const (
 	S3_ACTION_GET_BUCKET_OBJECT_LOCK = "s3:GetBucketObjectLockConfiguration"
 	S3_ACTION_PUT_BUCKET_OBJECT_LOCK = "s3:PutBucketObjectLockConfiguration"
 
+	// Bucket encryption operations
+	// Note: DELETE bucket encryption uses s3:PutEncryptionConfiguration, matching AWS
+	S3_ACTION_GET_BUCKET_ENCRYPTION = "s3:GetEncryptionConfiguration"
+	S3_ACTION_PUT_BUCKET_ENCRYPTION = "s3:PutEncryptionConfiguration"
+
+	// Bucket request payment operations
+	S3_ACTION_GET_BUCKET_REQUEST_PAYMENT = "s3:GetBucketRequestPayment"
+	S3_ACTION_PUT_BUCKET_REQUEST_PAYMENT = "s3:PutBucketRequestPayment"
+
+	// Bucket public access block operations
+	// Note: DELETE uses s3:PutBucketPublicAccessBlock, matching AWS
+	S3_ACTION_GET_BUCKET_PUBLIC_ACCESS_BLOCK = "s3:GetBucketPublicAccessBlock"
+	S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK = "s3:PutBucketPublicAccessBlock"
+
+	// Bucket ownership controls operations
+	// Note: DELETE uses s3:PutBucketOwnershipControls, matching AWS
+	S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS = "s3:GetBucketOwnershipControls"
+	S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS = "s3:PutBucketOwnershipControls"
+
+	// SeaweedFS extension: bucket quota operations
+	// PUT /{bucket}?seaweedfs-quota and GET /{bucket}?seaweedfs-quota
+	// These are SeaweedFS-specific subresources, not part of the AWS S3 API.
+	S3_ACTION_PUT_BUCKET_QUOTA = "s3:PutBucketQuota"
+	S3_ACTION_GET_BUCKET_QUOTA = "s3:GetBucketQuota"
+
 	// Wildcard for all S3 actions
 	S3_ACTION_ALL = "s3:*"
 )
+
+// S3 Tables action strings for policy evaluation.
+// Source of truth for the operation names: the dispatch switch in
+// weed/s3api/s3tables/handler.go. Keep this list in sync with that switch
+// when operations are added, renamed, or removed.
+const (
+	// Table bucket operations
+	S3TABLES_ACTION_CREATE_TABLE_BUCKET = "s3tables:CreateTableBucket"
+	S3TABLES_ACTION_GET_TABLE_BUCKET    = "s3tables:GetTableBucket"
+	S3TABLES_ACTION_LIST_TABLE_BUCKETS  = "s3tables:ListTableBuckets"
+	S3TABLES_ACTION_DELETE_TABLE_BUCKET = "s3tables:DeleteTableBucket"
+
+	// Table bucket policy operations
+	S3TABLES_ACTION_PUT_TABLE_BUCKET_POLICY    = "s3tables:PutTableBucketPolicy"
+	S3TABLES_ACTION_GET_TABLE_BUCKET_POLICY    = "s3tables:GetTableBucketPolicy"
+	S3TABLES_ACTION_DELETE_TABLE_BUCKET_POLICY = "s3tables:DeleteTableBucketPolicy"
+
+	// Namespace operations
+	S3TABLES_ACTION_CREATE_NAMESPACE = "s3tables:CreateNamespace"
+	S3TABLES_ACTION_GET_NAMESPACE    = "s3tables:GetNamespace"
+	S3TABLES_ACTION_UPDATE_NAMESPACE = "s3tables:UpdateNamespace"
+	S3TABLES_ACTION_LIST_NAMESPACES  = "s3tables:ListNamespaces"
+	S3TABLES_ACTION_DELETE_NAMESPACE = "s3tables:DeleteNamespace"
+
+	// Table operations
+	S3TABLES_ACTION_CREATE_TABLE   = "s3tables:CreateTable"
+	S3TABLES_ACTION_REGISTER_TABLE = "s3tables:RegisterTable"
+	S3TABLES_ACTION_GET_TABLE      = "s3tables:GetTable"
+	S3TABLES_ACTION_LIST_TABLES    = "s3tables:ListTables"
+	S3TABLES_ACTION_UPDATE_TABLE   = "s3tables:UpdateTable"
+	S3TABLES_ACTION_DELETE_TABLE   = "s3tables:DeleteTable"
+	S3TABLES_ACTION_RENAME_TABLE   = "s3tables:RenameTable"
+
+	// View operations
+	S3TABLES_ACTION_CREATE_VIEW = "s3tables:CreateView"
+	S3TABLES_ACTION_GET_VIEW    = "s3tables:GetView"
+	S3TABLES_ACTION_LIST_VIEWS  = "s3tables:ListViews"
+	S3TABLES_ACTION_UPDATE_VIEW = "s3tables:UpdateView"
+	S3TABLES_ACTION_DELETE_VIEW = "s3tables:DeleteView"
+	S3TABLES_ACTION_RENAME_VIEW = "s3tables:RenameView"
+
+	// Table policy operations
+	S3TABLES_ACTION_PUT_TABLE_POLICY    = "s3tables:PutTablePolicy"
+	S3TABLES_ACTION_GET_TABLE_POLICY    = "s3tables:GetTablePolicy"
+	S3TABLES_ACTION_DELETE_TABLE_POLICY = "s3tables:DeleteTablePolicy"
+
+	// Maintenance configuration operations
+	S3TABLES_ACTION_PUT_TABLE_BUCKET_MAINTENANCE_CONFIGURATION = "s3tables:PutTableBucketMaintenanceConfiguration"
+	S3TABLES_ACTION_GET_TABLE_BUCKET_MAINTENANCE_CONFIGURATION = "s3tables:GetTableBucketMaintenanceConfiguration"
+	S3TABLES_ACTION_PUT_TABLE_MAINTENANCE_CONFIGURATION        = "s3tables:PutTableMaintenanceConfiguration"
+	S3TABLES_ACTION_GET_TABLE_MAINTENANCE_CONFIGURATION        = "s3tables:GetTableMaintenanceConfiguration"
+	S3TABLES_ACTION_GET_TABLE_MAINTENANCE_JOB_STATUS           = "s3tables:GetTableMaintenanceJobStatus"
+
+	// Tagging operations
+	S3TABLES_ACTION_TAG_RESOURCE           = "s3tables:TagResource"
+	S3TABLES_ACTION_LIST_TAGS_FOR_RESOURCE = "s3tables:ListTagsForResource"
+	S3TABLES_ACTION_UNTAG_RESOURCE         = "s3tables:UntagResource"
+
+	// Wildcard for all S3 Tables actions
+	S3TABLES_ACTION_ALL = "s3tables:*"
+)
diff --git a/weed/s3api/s3_constants/s3_actions.go b/weed/s3api/s3_constants/s3_actions.go
index f5122bb6d2..c920e87cbe 100644
--- a/weed/s3api/s3_constants/s3_actions.go
+++ b/weed/s3api/s3_constants/s3_actions.go
@@ -18,10 +18,18 @@ const (
 	ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG = "PutBucketObjectLockConfiguration"
 	ACTION_PUT_BUCKET_POLICY             = "PutBucketPolicy"
 	ACTION_DELETE_BUCKET_POLICY          = "DeleteBucketPolicy"
+	ACTION_PUT_BUCKET_QUOTA              = "PutBucketQuota"
+	ACTION_GET_BUCKET_QUOTA              = "GetBucketQuota"
+	// Scoped to their single operation: the multipart listing routes are
+	// gated on ACTION_READ for compatibility, but a policy granting one of
+	// these names must not widen into a general Read grant.
+	ACTION_LIST_MULTIPART_UPLOADS = "ListBucketMultipartUploads"
+	ACTION_LIST_PARTS             = "ListMultipartUploadParts"
 
 	SeaweedStorageDestinationHeader = "x-seaweedfs-destination"
 	MultipartUploadsFolder          = ".uploads"
 	VersionsFolder                  = ".versions"
+	SystemFolder                    = ".system"
 	FolderMimeType                  = "httpd/unix-directory"
 	DirectoryMimeType               = "application/x-directory"
 )
diff --git a/weed/s3api/s3_content_encoding_test.go b/weed/s3api/s3_content_encoding_test.go
index a50a8bb3c7..0b8f5cd9c6 100644
--- a/weed/s3api/s3_content_encoding_test.go
+++ b/weed/s3api/s3_content_encoding_test.go
@@ -2,6 +2,7 @@ package s3api
 
 import (
 	"bytes"
+	"net/http"
 	"net/http/httptest"
 	"testing"
 
@@ -202,3 +203,57 @@ func TestContentEncodingWithOtherHeaders(t *testing.T) {
 	assert.Equal(t, "max-age=3600", getResp.Header().Get("Cache-Control"))
 	assert.Equal(t, "attachment; filename=test.txt", getResp.Header().Get("Content-Disposition"))
 }
+
+// TestContentEncodingDropsAwsChunked verifies that aws-chunked, the SigV4
+// streaming framing of the request body, is not stored with the object, also
+// when the encodings come in separate Content-Encoding fields
+func TestContentEncodingDropsAwsChunked(t *testing.T) {
+	testCases := []struct {
+		name   string
+		fields []string
+		stored string
+	}{
+		{"last", []string{"gzip, aws-chunked"}, "gzip"},
+		{"first", []string{"aws-chunked, gzip"}, "gzip"},
+		{"no spaces", []string{"aws-chunked,gzip,br"}, "gzip, br"},
+		{"alone", []string{"aws-chunked"}, ""},
+		{"capitals", []string{"AWS-Chunked"}, ""},
+		{"twice", []string{"aws-chunked, aws-chunked"}, ""},
+		{"separate fields", []string{"aws-chunked", "gzip"}, "gzip"},
+		{"separate fields, alone", []string{"aws-chunked", "aws-chunked"}, ""},
+		{"without aws-chunked", []string{"deflate, gzip"}, "deflate, gzip"},
+		{"without aws-chunked, separate fields", []string{"deflate", "gzip"}, "deflate, gzip"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.stored, storedContentEncoding(tc.fields))
+
+			// CreateMultipartUpload
+			putReq := httptest.NewRequest("PUT", "/test-bucket/test-object.txt", bytes.NewBufferString("body"))
+			for _, field := range tc.fields {
+				putReq.Header.Add("Content-Encoding", field)
+			}
+			metadata, errCode := ParseS3Metadata(putReq, nil, false)
+			require.Equal(t, 0, int(errCode))
+			if tc.stored == "" {
+				assert.NotContains(t, metadata, "Content-Encoding")
+			} else {
+				assert.Equal(t, []byte(tc.stored), metadata["Content-Encoding"])
+			}
+
+			// CopyObject with the REPLACE metadata directive
+			copyReq := http.Header{}
+			for _, field := range tc.fields {
+				copyReq.Add("Content-Encoding", field)
+			}
+			metadata, err := processMetadataBytes(copyReq, map[string][]byte{"Content-Encoding": []byte("br")}, true, false)
+			require.NoError(t, err)
+			if tc.stored == "" {
+				assert.NotContains(t, metadata, "Content-Encoding")
+			} else {
+				assert.Equal(t, []byte(tc.stored), metadata["Content-Encoding"])
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3_end_to_end_test.go b/weed/s3api/s3_end_to_end_test.go
index 958323f7b0..bf246a2aef 100644
--- a/weed/s3api/s3_end_to_end_test.go
+++ b/weed/s3api/s3_end_to_end_test.go
@@ -17,6 +17,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/iam/oidc"
 	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
 	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -113,13 +114,12 @@ func TestS3EndToEndWithJWT(t *testing.T) {
 			})
 			require.NoError(t, err, "Failed to assume role %s", tt.roleArn)
 
-			jwtToken := response.Credentials.SessionToken
-			require.NotEmpty(t, jwtToken, "JWT token should not be empty")
+			require.NotEmpty(t, response.Credentials.SessionToken, "session token should not be empty")
 
 			// Execute S3 operations
 			for i, operation := range tt.s3Operations {
 				t.Run(fmt.Sprintf("%s_%s", tt.name, operation.Operation), func(t *testing.T) {
-					allowed := executeS3OperationWithJWT(t, s3Server, operation, jwtToken)
+					allowed := executeS3OperationWithJWT(t, s3Server, operation, response.Credentials)
 					expected := tt.expectedResults[i]
 
 					if expected {
@@ -152,8 +152,6 @@ func TestS3MultipartUploadWithJWT(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	jwtToken := response.Credentials.SessionToken
-
 	// Test multipart upload workflow
 	tests := []struct {
 		name      string
@@ -204,7 +202,7 @@ func TestS3MultipartUploadWithJWT(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			allowed := executeS3OperationWithJWT(t, s3Server, tt.operation, jwtToken)
+			allowed := executeS3OperationWithJWT(t, s3Server, tt.operation, response.Credentials)
 			if tt.expected {
 				assert.True(t, allowed, "Multipart operation %s should be allowed", tt.operation.Operation)
 			} else {
@@ -303,10 +301,7 @@ func TestS3ListObjectsV2PrefixCondition(t *testing.T) {
 	require.NotEmpty(t, sessionToken)
 
 	// Authenticate to get IAM identity
-	authReq := httptest.NewRequest("GET", "/examples", http.NoBody)
-	authReq.Header.Set("Authorization", "Bearer "+sessionToken)
-	identity, errCode := s3IAMIntegration.AuthenticateJWT(ctx, authReq)
-	require.Equal(t, s3err.ErrNone, errCode, "Authentication should succeed")
+	identity := testIdentityFromSessionToken(t, s3IAMIntegration, sessionToken)
 
 	tests := []struct {
 		name     string
@@ -361,6 +356,131 @@ func TestS3ListObjectsV2PrefixCondition(t *testing.T) {
 	}
 }
 
+// TestS3CreateBucketWithAttachedPolicy verifies a federated session whose
+// attached policy grants s3:CreateBucket on a bucket ARN pattern can create
+// matching buckets. CreateBucket is registered with ACTION_ADMIN, which used
+// to resolve to s3:* and made the operation unmatchable by any narrower grant.
+func TestS3CreateBucketWithAttachedPolicy(t *testing.T) {
+	iamManager := integration.NewIAMManager()
+	config := &integration.IAMConfig{
+		STS: &sts.STSConfig{
+			TokenDuration:    sts.FlexibleDuration{Duration: time.Hour},
+			MaxSessionLength: sts.FlexibleDuration{Duration: time.Hour * 12},
+			Issuer:           "test-sts",
+			SigningKey:       []byte("test-signing-key-32-characters-long"),
+		},
+		Policy: &policy.PolicyEngineConfig{
+			DefaultEffect: "Deny",
+			StoreType:     "memory",
+		},
+		Roles: &integration.RoleStoreConfig{
+			StoreType: "memory",
+		},
+	}
+
+	err := iamManager.Initialize(config, func() string { return "localhost:8888" })
+	require.NoError(t, err)
+
+	setupTestProviders(t, iamManager)
+
+	s3IAMIntegration := NewS3IAMIntegration(iamManager, "localhost:8888")
+	ctx := context.Background()
+
+	bucketPolicy := &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{
+			{
+				Sid:      "AllowBucketManagement",
+				Effect:   "Allow",
+				Action:   []string{"s3:CreateBucket", "s3:DeleteBucket"},
+				Resource: []string{"arn:aws:s3:::ml-*"},
+			},
+			{
+				Sid:      "AllowSTSSessionValidation",
+				Effect:   "Allow",
+				Action:   []string{"sts:ValidateSession"},
+				Resource: []string{"*"},
+			},
+		},
+	}
+
+	iamManager.CreatePolicy(ctx, "", "BucketManagementPolicy", bucketPolicy)
+	iamManager.CreateRole(ctx, "", "BucketManagerRole", &integration.RoleDefinition{
+		RoleName: "BucketManagerRole",
+		TrustPolicy: &policy.PolicyDocument{
+			Version: "2012-10-17",
+			Statement: []policy.Statement{
+				{
+					Effect:    "Allow",
+					Principal: map[string]interface{}{"Federated": "test-oidc"},
+					Action:    []string{"sts:AssumeRoleWithWebIdentity"},
+				},
+			},
+		},
+		AttachedPolicies: []string{"BucketManagementPolicy"},
+	})
+
+	validJWTToken := createTestJWTEndToEnd(t, "https://test-issuer.com", "test-user-123", "test-signing-key")
+	response, err := iamManager.AssumeRoleWithWebIdentity(ctx, &sts.AssumeRoleWithWebIdentityRequest{
+		RoleArn:          "arn:aws:iam::role/BucketManagerRole",
+		WebIdentityToken: validJWTToken,
+		RoleSessionName:  "bucket-create-session",
+	})
+	require.NoError(t, err)
+
+	identity := testIdentityFromSessionToken(t, s3IAMIntegration, response.Credentials.SessionToken)
+
+	tests := []struct {
+		name     string
+		method   string
+		url      string
+		bucket   string
+		action   Action
+		expected s3err.ErrorCode
+	}{
+		{
+			name:     "CreateBucket on matching bucket is allowed",
+			method:   "PUT",
+			url:      "/ml-models",
+			bucket:   "ml-models",
+			action:   Action(s3_constants.ACTION_ADMIN),
+			expected: s3err.ErrNone,
+		},
+		{
+			name:     "CreateBucket outside the resource pattern is denied",
+			method:   "PUT",
+			url:      "/other-bucket",
+			bucket:   "other-bucket",
+			action:   Action(s3_constants.ACTION_ADMIN),
+			expected: s3err.ErrAccessDenied,
+		},
+		{
+			name:     "PutBucketEncryption is not swept into CreateBucket",
+			method:   "PUT",
+			url:      "/ml-models?encryption",
+			bucket:   "ml-models",
+			action:   Action(s3_constants.ACTION_ADMIN),
+			expected: s3err.ErrAccessDenied,
+		},
+		{
+			name:     "DeleteBucket on matching bucket is allowed",
+			method:   "DELETE",
+			url:      "/ml-models",
+			bucket:   "ml-models",
+			action:   Action(s3_constants.ACTION_DELETE_BUCKET),
+			expected: s3err.ErrNone,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(tt.method, tt.url, http.NoBody)
+			result := s3IAMIntegration.AuthorizeAction(ctx, identity, tt.action, tt.bucket, "", req)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
 // TestS3CORSWithJWT tests CORS preflight requests with IAM
 func TestS3CORSWithJWT(t *testing.T) {
 	s3Server, iamManager := setupCompleteS3IAMSystem(t)
@@ -409,8 +529,6 @@ func TestS3PerformanceWithIAM(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	jwtToken := response.Credentials.SessionToken
-
 	// Benchmark multiple GET requests
 	numRequests := 100
 	start := time.Now()
@@ -423,7 +541,7 @@ func TestS3PerformanceWithIAM(t *testing.T) {
 			Operation: "GetObject",
 		}
 
-		executeS3OperationWithJWT(t, s3Server, operation, jwtToken)
+		executeS3OperationWithJWT(t, s3Server, operation, response.Credentials)
 	}
 
 	duration := time.Since(start)
@@ -500,11 +618,13 @@ func setupCompleteS3IAMSystem(t *testing.T) (http.Handler, *integration.IAMManag
 		t.Skip("Could not create S3 IAM integration")
 	}
 
+	iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{}, nil, "memory")
+	iam.SetIAMIntegration(s3IAMIntegration)
+
 	// Add a simple test endpoint that we can use to verify IAM functionality
 	router.HandleFunc("/test-auth", func(w http.ResponseWriter, r *http.Request) {
-		// Test JWT authentication
-		identity, errCode := s3IAMIntegration.AuthenticateJWT(r.Context(), r)
-		if errCode != s3err.ErrNone {
+		identity, errCode, _ := iam.authenticateRequestInternal(r)
+		if errCode != s3err.ErrNone || identity == nil {
 			w.WriteHeader(http.StatusUnauthorized)
 			w.Write([]byte("Authentication failed"))
 			return
@@ -526,7 +646,7 @@ func setupCompleteS3IAMSystem(t *testing.T) (http.Handler, *integration.IAMManag
 		}
 
 		// Test authorization with appropriate action
-		authErrCode := s3IAMIntegration.AuthorizeAction(r.Context(), identity, action, "test-bucket", "test-object", r)
+		authErrCode := iam.authorizeWithIAM(r, identity, action, "test-bucket", "test-object")
 		if authErrCode != s3err.ErrNone {
 			w.WriteHeader(http.StatusForbidden)
 			w.Write([]byte("Authorization failed"))
@@ -771,10 +891,11 @@ func setupS3IPRestrictedRole(ctx context.Context, manager *integration.IAMManage
 	})
 }
 
-func executeS3OperationWithJWT(t *testing.T, s3Server http.Handler, operation S3Operation, jwtToken string) bool {
+func executeS3OperationWithJWT(t *testing.T, s3Server http.Handler, operation S3Operation, creds *sts.Credentials) bool {
 	// Use our simplified test endpoint for IAM validation with the correct HTTP method
-	req := httptest.NewRequest(operation.Method, "/test-auth", nil)
-	req.Header.Set("Authorization", "Bearer "+jwtToken)
+	req, err := newTestRequest(operation.Method, "http://example.com/test-auth", 0, nil)
+	require.NoError(t, err)
+	req.Header.Set("X-Amz-Security-Token", creds.SessionToken)
 	req.Header.Set("Content-Type", "application/octet-stream")
 
 	// Set source IP if specified
@@ -783,6 +904,8 @@ func executeS3OperationWithJWT(t *testing.T, s3Server http.Handler, operation S3
 		req.RemoteAddr = operation.SourceIP + ":12345"
 	}
 
+	require.NoError(t, signRequestV4(req, creds.AccessKeyId, creds.SecretAccessKey))
+
 	// Execute request
 	recorder := httptest.NewRecorder()
 	s3Server.ServeHTTP(recorder, req)
diff --git a/weed/s3api/s3_error_utils.go b/weed/s3api/s3_error_utils.go
index bd38e50b79..e6eed6b56d 100644
--- a/weed/s3api/s3_error_utils.go
+++ b/weed/s3api/s3_error_utils.go
@@ -7,14 +7,26 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
 )
 
-// isFilerListNotFound reports whether a filer list error is a not-found.
-// Unlike lookups (normalized in filer_pb.LookupEntry), list errors cross gRPC
-// as raw status errors, so the sentinel survives only as text. Callers must
-// pass errors from paths without user-controlled segments that could spoof it.
-func isFilerListNotFound(err error) bool {
-	return errors.Is(err, filer_pb.ErrNotFound) || strings.Contains(err.Error(), filer_pb.ErrNotFound.Error())
+// isFilerNotFound reports whether a filer error is a not-found.
+// Unlike lookups (normalized in filer_pb.LookupEntry), list and cache errors
+// cross gRPC as raw status errors, so the sentinel survives as codes.NotFound
+// or only as text. The text is matched last and only on what the filer itself
+// said, since callers wrap these errors with a path the client chose.
+func isFilerNotFound(err error) bool {
+	if err == nil {
+		return false
+	}
+	if errors.Is(err, filer_pb.ErrNotFound) {
+		return true
+	}
+	if st, ok := util.ServerStatus(err); ok {
+		return st.Code() == codes.NotFound || strings.Contains(st.Message(), filer_pb.ErrNotFound.Error())
+	}
+	return strings.Contains(err.Error(), filer_pb.ErrNotFound.Error())
 }
 
 // ErrorHandlers provide common error handling patterns for S3 API operations
diff --git a/weed/s3api/s3_existing_object_tag_test.go b/weed/s3api/s3_existing_object_tag_test.go
index 0adea69766..c1809d9573 100644
--- a/weed/s3api/s3_existing_object_tag_test.go
+++ b/weed/s3api/s3_existing_object_tag_test.go
@@ -4,6 +4,9 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
@@ -257,3 +260,413 @@ func TestHasPolicyForBucket(t *testing.T) {
 	// No longer has policy
 	assert.False(t, engine.HasPolicyForBucket("test-bucket"))
 }
+
+// TestRecheckCopySourcePolicy verifies that a tag-conditioned Deny on
+// s3:GetObject also blocks CopyObject-style reads of the source object. The
+// destination request keeps its PUT method while the policy is evaluated
+// against a synthesized GET on the source key.
+func TestRecheckCopySourcePolicy(t *testing.T) {
+	s3a := &S3ApiServer{
+		policyEngine: NewBucketPolicyEngine(),
+	}
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:*",
+				"Resource": ["arn:aws:s3:::src-bucket", "arn:aws:s3:::src-bucket/*", "arn:aws:s3:::dst-bucket", "arn:aws:s3:::dst-bucket/*"]
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": "s3:GetObject",
+				"Resource": "arn:aws:s3:::src-bucket/*",
+				"Condition": {
+					"StringEquals": {
+						"s3:ExistingObjectTag/status": ["private"]
+					}
+				}
+			}
+		]
+	}`
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("src-bucket", policyJSON))
+
+	identity := &Identity{Name: "denied-user", PrincipalArn: "arn:aws:iam::123456789012:user/denied"}
+
+	req := httptest.NewRequest(http.MethodPut, "/dst-bucket/dst-key", nil)
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), identity))
+
+	privateEntry := map[string][]byte{
+		s3_constants.AmzObjectTaggingPrefix + "status": []byte("private"),
+	}
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckCopySourcePolicy(req, "src-bucket", "src-key", "", privateEntry, "test"))
+
+	publicEntry := map[string][]byte{
+		s3_constants.AmzObjectTaggingPrefix + "status": []byte("public"),
+	}
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckCopySourcePolicy(req, "src-bucket", "src-key", "", publicEntry, "test"))
+}
+
+// A source read whose only grant is conditioned on s3:ExistingObjectTag denies
+// in the tagless first phase; the deferred lookup recheck must still grant it
+// when the resolved entry's tags satisfy the Allow, and keep denying when they
+// do not. The same recheck with a synthesized DELETE is what a rename applies
+// to the source removal.
+func TestRecheckPolicyForKeyWithLookup(t *testing.T) {
+	filerImpl := &ambiguousPutFiler{
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/src-bucket/src-key": {
+				Name: "src-key",
+				Extended: map[string][]byte{
+					s3_constants.AmzObjectTaggingPrefix + "status": []byte("public"),
+				},
+			},
+		},
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	s3a.policyEngine = NewBucketPolicyEngine()
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set("src-bucket", &BucketConfig{Name: "src-bucket"})
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:GetObject",
+				"Resource": "arn:aws:s3:::src-bucket/*",
+				"Condition": {
+					"StringEquals": {
+						"s3:ExistingObjectTag/status": ["public"]
+					}
+				}
+			}
+		]
+	}`
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("src-bucket", policyJSON))
+
+	identity := &Identity{Name: "tagged-user", PrincipalArn: "arn:aws:iam::123456789012:user/tagged"}
+	req := httptest.NewRequest(http.MethodPut, "/dst-bucket/dst-key", nil)
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), identity))
+
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckPolicyForKeyWithLookup(req, http.MethodGet, "src-bucket", "src-key", "", string(s3_constants.ACTION_READ), "test"),
+		"a tag-conditioned Allow on the resolved entry must still grant the read")
+
+	filerImpl.entries["/buckets/src-bucket/src-key"].Extended[s3_constants.AmzObjectTaggingPrefix+"status"] = []byte("private")
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckPolicyForKeyWithLookup(req, http.MethodGet, "src-bucket", "src-key", "", string(s3_constants.ACTION_READ), "test"),
+		"non-matching tags must keep the first-phase deny")
+
+	// Without a policy on the bucket the recheck must not widen anything.
+	require.NoError(t, s3a.policyEngine.engine.DeleteBucketPolicy("src-bucket"))
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckPolicyForKeyWithLookup(req, http.MethodGet, "src-bucket", "src-key", "", string(s3_constants.ACTION_READ), "test"))
+}
+
+// A Deny on s3:DeleteObject / s3:DeleteObjectVersion conditioned on
+// s3:ExistingObjectTag only matches once the entry's tags are known; the
+// delete path's deferred lookup recheck must enforce it on the resolved
+// object. The batch-delete variant evaluates a synthesized DELETE request so
+// a key carrying a versionId resolves to s3:DeleteObjectVersion.
+func TestRecheckTagConditionedPolicyWithLookupDelete(t *testing.T) {
+	filerImpl := &ambiguousPutFiler{
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/b/secret.txt": {
+				Name: "secret.txt",
+				Extended: map[string][]byte{
+					s3_constants.AmzObjectTaggingPrefix + "classification": []byte("secret"),
+				},
+			},
+		},
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	s3a.policyEngine = NewBucketPolicyEngine()
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set("b", &BucketConfig{Name: "b"})
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:*",
+				"Resource": ["arn:aws:s3:::b", "arn:aws:s3:::b/*"]
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": ["s3:DeleteObject", "s3:DeleteObjectVersion"],
+				"Resource": "arn:aws:s3:::b/*",
+				"Condition": {
+					"StringEquals": {
+						"s3:ExistingObjectTag/classification": ["secret"]
+					}
+				}
+			}
+		]
+	}`
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", policyJSON))
+
+	identity := &Identity{Name: "writer", PrincipalArn: "arn:aws:iam::123456789012:user/writer"}
+
+	req := httptest.NewRequest(http.MethodDelete, "/b/secret.txt", nil)
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), identity))
+
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckTagConditionedPolicyWithLookup(req, "b", "secret.txt", "", string(s3_constants.ACTION_WRITE), "test"),
+		"a tag-conditioned Deny on s3:DeleteObject must block deleting the tagged object")
+
+	postReq := httptest.NewRequest(http.MethodPost, "/bv?delete", nil)
+	postReq = postReq.WithContext(s3_constants.SetIdentityInContext(postReq.Context(), identity))
+
+	filerImpl.entries["/buckets/bv/secret.txt"] = &filer_pb.Entry{
+		Name: "secret.txt",
+		Extended: map[string][]byte{
+			s3_constants.AmzObjectTaggingPrefix + "classification": []byte("public"),
+		},
+	}
+	filerImpl.entries["/buckets/bv/secret.txt.versions/v_v1"] = &filer_pb.Entry{
+		Name: "v_v1",
+		Extended: map[string][]byte{
+			s3_constants.AmzObjectTaggingPrefix + "classification": []byte("secret"),
+		},
+	}
+	filerImpl.entries["/buckets/bv/secret.txt.versions/v_v2"] = &filer_pb.Entry{
+		Name: "v_v2",
+		Extended: map[string][]byte{
+			s3_constants.AmzObjectTaggingPrefix + "classification": []byte("public"),
+		},
+	}
+	s3a.bucketConfigCache.Set("bv", &BucketConfig{Name: "bv", Versioning: s3_constants.VersioningEnabled})
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("bv", `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:*",
+				"Resource": ["arn:aws:s3:::bv", "arn:aws:s3:::bv/*"]
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": "s3:DeleteObjectVersion",
+				"Resource": "arn:aws:s3:::bv/*",
+				"Condition": {
+					"StringEquals": {
+						"s3:ExistingObjectTag/classification": ["secret"]
+					}
+				}
+			}
+		]
+	}`))
+
+	keyReq := objectKeyPolicyRequest(postReq, http.MethodDelete, "bv", "secret.txt", "v1")
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckTagConditionedPolicyWithLookup(keyReq, "bv", "secret.txt", "v1", string(s3_constants.ACTION_WRITE), "test"),
+		"a versioned batch-delete key must be denied by the s3:DeleteObjectVersion statement")
+
+	keyReq = objectKeyPolicyRequest(postReq, http.MethodDelete, "bv", "secret.txt", "v2")
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckTagConditionedPolicyWithLookup(keyReq, "bv", "secret.txt", "v2", string(s3_constants.ACTION_WRITE), "test"),
+		"a publicly tagged version of the same object stays deletable")
+
+	filerImpl.entries["/buckets/ba/key"] = &filer_pb.Entry{
+		Name: "key",
+		Extended: map[string][]byte{
+			s3_constants.AmzObjectTaggingPrefix + "classification": []byte("secret"),
+		},
+	}
+	s3a.bucketConfigCache.Set("ba", &BucketConfig{Name: "ba"})
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("ba", `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:DeleteObject",
+				"Resource": "arn:aws:s3:::ba/*",
+				"Condition": {
+					"StringEquals": {
+						"s3:ExistingObjectTag/classification": ["secret"]
+					}
+				}
+			}
+		]
+	}`))
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckPolicyForKeyWithLookup(postReq, http.MethodDelete, "ba", "key", "", string(s3_constants.ACTION_WRITE), "test"),
+		"a tag-conditioned Allow on s3:DeleteObject must grant the resolved tagged key")
+
+	filerImpl.entries["/buckets/ba/key"].Extended[s3_constants.AmzObjectTaggingPrefix+"classification"] = []byte("public")
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckPolicyForKeyWithLookup(postReq, http.MethodDelete, "ba", "key", "", string(s3_constants.ACTION_WRITE), "test"),
+		"a non-matching tag keeps the first-phase deny")
+
+	filerImpl.entries["/buckets/b/secret.txt"].Extended[s3_constants.AmzObjectTaggingPrefix+"classification"] = []byte("public")
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckTagConditionedPolicyWithLookup(req, "b", "secret.txt", "", string(s3_constants.ACTION_WRITE), "test"),
+		"a non-matching tag leaves the delete allowed")
+
+	// A missing object reports no entry; the handler answers its own NoSuchKey.
+	delete(filerImpl.entries, "/buckets/b/secret.txt")
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckTagConditionedPolicyWithLookup(req, "b", "secret.txt", "", string(s3_constants.ACTION_WRITE), "test"))
+}
+
+// Tag-conditioned Deny on the ACL subresources is enforced once the object
+// entry is in hand, the same way it is on a plain read.
+func TestRecheckObjectAclTagConditionedPolicy(t *testing.T) {
+	s3a := &S3ApiServer{
+		policyEngine: NewBucketPolicyEngine(),
+	}
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:*",
+				"Resource": ["arn:aws:s3:::b", "arn:aws:s3:::b/*"]
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": ["s3:GetObjectAcl", "s3:PutObjectAcl"],
+				"Resource": "arn:aws:s3:::b/*",
+				"Condition": {
+					"StringEquals": {
+						"s3:ExistingObjectTag/classification": ["secret"]
+					}
+				}
+			}
+		]
+	}`
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", policyJSON))
+
+	identity := &Identity{Name: "writer", PrincipalArn: "arn:aws:iam::123456789012:user/writer"}
+
+	getReq := httptest.NewRequest(http.MethodGet, "/b/secret.txt?acl", nil)
+	getReq = getReq.WithContext(s3_constants.SetIdentityInContext(getReq.Context(), identity))
+	putReq := httptest.NewRequest(http.MethodPut, "/b/secret.txt?acl", nil)
+	putReq = putReq.WithContext(s3_constants.SetIdentityInContext(putReq.Context(), identity))
+
+	secretEntry := map[string][]byte{
+		s3_constants.AmzObjectTaggingPrefix + "classification": []byte("secret"),
+	}
+	publicEntry := map[string][]byte{
+		s3_constants.AmzObjectTaggingPrefix + "classification": []byte("public"),
+	}
+
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckPolicyWithObjectEntry(getReq, "b", "secret.txt", s3_constants.S3_ACTION_GET_OBJECT_ACL, secretEntry, "test"))
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckPolicyWithObjectEntry(putReq, "b", "secret.txt", s3_constants.S3_ACTION_PUT_OBJECT_ACL, secretEntry, "test"))
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckPolicyWithObjectEntry(getReq, "b", "secret.txt", s3_constants.S3_ACTION_GET_OBJECT_ACL, publicEntry, "test"))
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckPolicyWithObjectEntry(putReq, "b", "secret.txt", s3_constants.S3_ACTION_PUT_OBJECT_ACL, publicEntry, "test"))
+}
+
+// A versioned GetObjectAttributes request is authorized against the version
+// read grant, not the attributes action the original request resolves to: an
+// explicit bucket-policy Deny on s3:GetObjectVersion blocks it, while a legacy
+// identity holding only the coarse Read grant is still accepted.
+func TestCheckVersionReadGrant(t *testing.T) {
+	s3a := &S3ApiServer{
+		policyEngine: NewBucketPolicyEngine(),
+		iam:          &IdentityAccessManagement{},
+	}
+
+	denyPolicyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:*",
+				"Resource": ["arn:aws:s3:::deny-bucket", "arn:aws:s3:::deny-bucket/*"]
+			},
+			{
+				"Effect": "Deny",
+				"Principal": "*",
+				"Action": "s3:GetObjectVersion",
+				"Resource": "arn:aws:s3:::deny-bucket/key"
+			}
+		]
+	}`
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("deny-bucket", denyPolicyJSON))
+
+	allowPolicyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [
+			{
+				"Effect": "Allow",
+				"Principal": "*",
+				"Action": "s3:*",
+				"Resource": ["arn:aws:s3:::allow-bucket", "arn:aws:s3:::allow-bucket/*"]
+			}
+		]
+	}`
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("allow-bucket", allowPolicyJSON))
+
+	identity := &Identity{
+		Name:         "reader",
+		Actions:      []Action{s3_constants.ACTION_READ},
+		PrincipalArn: "arn:aws:iam::000000000000:user/reader",
+	}
+
+	attrsReq := func(bucket string) *http.Request {
+		req := httptest.NewRequest(http.MethodGet, "/"+bucket+"/key?attributes&versionId=v1", nil)
+		return req.WithContext(s3_constants.SetIdentityInContext(req.Context(), identity))
+	}
+
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.checkVersionReadGrant(attrsReq("deny-bucket"), "deny-bucket", "key", "v1", nil))
+	assert.Equal(t, s3err.ErrNone,
+		s3a.checkVersionReadGrant(attrsReq("allow-bucket"), "allow-bucket", "key", "v1", nil))
+	assert.Equal(t, s3err.ErrNone,
+		s3a.checkVersionReadGrant(attrsReq("no-policy-bucket"), "no-policy-bucket", "key", "v1", nil))
+}
+
+// Presigned-URL credentials ride along on the synthesized version-read
+// request, so an s3:authType=REST-QUERY-STRING policy condition decides the
+// recheck the same way it decided the real request.
+func TestCheckVersionReadGrantPreservesQueryAuth(t *testing.T) {
+	s3a := &S3ApiServer{
+		policyEngine: NewBucketPolicyEngine(),
+		iam:          &IdentityAccessManagement{},
+	}
+
+	policyJSON := `{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Allow",
+			"Principal": "*",
+			"Action": "s3:*",
+			"Resource": ["arn:aws:s3:::qs-bucket", "arn:aws:s3:::qs-bucket/*"],
+			"Condition": {"StringEquals": {"s3:authType": "REST-QUERY-STRING"}}
+		}]
+	}`
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("qs-bucket", policyJSON))
+
+	presigned := httptest.NewRequest(http.MethodGet,
+		"/qs-bucket/key?attributes&versionId=v1&AWSAccessKeyId=AK&Signature=sig&Expires=9999999999", nil)
+	assert.Equal(t, s3err.ErrNone,
+		s3a.checkVersionReadGrant(presigned, "qs-bucket", "key", "v1", nil))
+
+	keyReq := objectKeyPolicyRequest(presigned, http.MethodGet, "qs-bucket", "key", "v1")
+	q := keyReq.URL.Query()
+	assert.Equal(t, "AK", q.Get("AWSAccessKeyId"))
+	assert.Equal(t, "v1", q.Get("versionId"))
+	assert.False(t, q.Has("attributes"))
+}
diff --git a/weed/s3api/s3_iam_bearer_trust_policy_test.go b/weed/s3api/s3_iam_bearer_trust_policy_test.go
index 017e95f443..51209a4502 100644
--- a/weed/s3api/s3_iam_bearer_trust_policy_test.go
+++ b/weed/s3api/s3_iam_bearer_trust_policy_test.go
@@ -6,8 +6,10 @@ import (
 	"crypto/rsa"
 	"encoding/base64"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -148,3 +150,159 @@ func TestOIDCBearerEnforcesRoleTrustPolicy(t *testing.T) {
 	require.Equal(t, s3err.ErrNone, errCode)
 	assert.Equal(t, "arn:aws:iam::role/BearerTrustedRole", identity.Principal)
 }
+
+// An OIDC bearer token's aws:userid claim is server-asserted from the
+// verified (sub, iss) pair: a token-supplied value is overwritten, and a
+// token without a subject is rejected outright.
+func TestOIDCBearerUserIDIsIssuerScoped(t *testing.T) {
+	ctx := context.Background()
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	jwks := map[string]interface{}{
+		"keys": []map[string]interface{}{{
+			"kty": "RSA",
+			"kid": "bearer-test-key",
+			"use": "sig",
+			"alg": "RS256",
+			"n":   base64.RawURLEncoding.EncodeToString(key.PublicKey.N.Bytes()),
+			"e":   "AQAB",
+		}},
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/jwks" {
+			json.NewEncoder(w).Encode(jwks)
+		}
+	}))
+	defer server.Close()
+
+	provider := oidc.NewOIDCProvider("test-oidc")
+	require.NoError(t, provider.Initialize(&oidc.OIDCConfig{
+		Issuer:   server.URL,
+		ClientID: "test-client",
+		JWKSUri:  server.URL + "/jwks",
+		RoleMapping: &providers.RoleMapping{
+			Rules: []providers.MappingRule{
+				{Claim: "groups", Value: "trusted-group", Role: "arn:aws:iam::role/BearerTrustedRole"},
+			},
+		},
+	}))
+
+	iamManager := integration.NewIAMManager()
+	require.NoError(t, iamManager.Initialize(&integration.IAMConfig{
+		STS: &sts.STSConfig{
+			TokenDuration:    sts.FlexibleDuration{Duration: time.Hour},
+			MaxSessionLength: sts.FlexibleDuration{Duration: 12 * time.Hour},
+			Issuer:           "test-sts",
+			SigningKey:       []byte("test-signing-key-32-characters-long"),
+		},
+		Policy: &policy.PolicyEngineConfig{DefaultEffect: "Deny", StoreType: "memory"},
+		Roles:  &integration.RoleStoreConfig{StoreType: "memory"},
+	}, func() string { return "localhost:8888" }))
+	require.NoError(t, iamManager.RegisterIdentityProvider(provider))
+	require.NoError(t, iamManager.CreatePolicy(ctx, "", "BearerTestPolicy", &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{{
+			Effect:   "Allow",
+			Action:   []string{"s3:*"},
+			Resource: []string{"arn:aws:s3:::*", "arn:aws:s3:::*/*"},
+		}},
+	}))
+	require.NoError(t, iamManager.CreateRole(ctx, "", "BearerTrustedRole", &integration.RoleDefinition{
+		RoleName: "BearerTrustedRole",
+		TrustPolicy: &policy.PolicyDocument{
+			Version: "2012-10-17",
+			Statement: []policy.Statement{{
+				Effect:    "Allow",
+				Principal: map[string]interface{}{"Federated": "test-oidc"},
+				Action:    []string{"sts:AssumeRoleWithWebIdentity"},
+			}},
+		},
+		AttachedPolicies: []string{"BearerTestPolicy"},
+	}))
+
+	sign := func(extra map[string]interface{}) string {
+		claims := jwt.MapClaims{
+			"iss":    server.URL,
+			"aud":    "test-client",
+			"exp":    time.Now().Add(time.Hour).Unix(),
+			"iat":    time.Now().Unix(),
+			"groups": []string{"trusted-group"},
+		}
+		for k, v := range extra {
+			claims[k] = v
+		}
+		token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+		token.Header["kid"] = "bearer-test-key"
+		signed, err := token.SignedString(key)
+		require.NoError(t, err)
+		return signed
+	}
+
+	s3iam := NewS3IAMIntegration(iamManager, "localhost:8888")
+	authenticate := func(token string) (*IAMIdentity, s3err.ErrorCode) {
+		req := httptest.NewRequest("GET", "/test-bucket/test-object", http.NoBody)
+		req.Header.Set("Authorization", "Bearer "+token)
+		return s3iam.AuthenticateJWT(ctx, req)
+	}
+
+	identity, errCode := authenticate(sign(map[string]interface{}{
+		"sub":        "bearer-user",
+		"aws:userid": "admin",
+	}))
+	require.Equal(t, s3err.ErrNone, errCode)
+	assert.Equal(t,
+		sts.ComputeParentUser("bearer-user", server.URL),
+		identity.Claims["aws:userid"],
+		"the token-supplied aws:userid must be overwritten with the verified (sub, iss) hash")
+	assert.Equal(t, "bearer-user", identity.Claims["sub"])
+	assert.Equal(t, server.URL, identity.Claims["iss"])
+	assert.Equal(t, server.URL, identity.Claims["seaweed:oidc-issuers"],
+		"the registered provider's issuer must be asserted as trusted for legacy-owner anchoring")
+
+	_, errCode = authenticate(sign(map[string]interface{}{"sub": ""}))
+	assert.Equal(t, s3err.ErrAccessDenied, errCode, "a token with no subject must not authenticate")
+}
+
+// flakyListOIDCStore fails ListProviders on demand, standing in for a
+// filer-backed provider store that cannot be read.
+type flakyListOIDCStore struct {
+	integration.OIDCProviderStore
+	fail atomic.Bool
+}
+
+func (s *flakyListOIDCStore) ListProviders(ctx context.Context, filerAddress string) ([]*integration.OIDCProviderRecord, error) {
+	if s.fail.Load() {
+		return nil, fmt.Errorf("list OIDC providers: simulated outage")
+	}
+	return s.OIDCProviderStore.ListProviders(ctx, filerAddress)
+}
+
+// A failed store listing must not pass the registered providers off as the
+// complete trusted set: hidden issuers could shrink the reported set to one
+// entry, the only shape under which a legacy bare subject re-anchors.
+func TestTrustedOIDCIssuersFailsClosedOnStoreError(t *testing.T) {
+	ctx := context.Background()
+
+	iamManager := integration.NewIAMManager()
+	s3iam := NewS3IAMIntegration(iamManager, "")
+
+	// No provider store at all: registered providers are the complete set —
+	// there is nowhere an issuer could hide behind a listing failure.
+	assert.Empty(t, s3iam.trustedOIDCIssuers(ctx))
+
+	mem := integration.NewMemoryOIDCProviderStore()
+	require.NoError(t, mem.StoreProvider(ctx, "", &integration.OIDCProviderRecord{
+		ARN: "arn:aws:iam::111122223333:oidc-provider/idp.example.com",
+		URL: "https://idp.example.com",
+	}))
+	store := &flakyListOIDCStore{OIDCProviderStore: mem}
+	iamManager.SetOIDCProviderStore(store)
+
+	assert.Equal(t, []string{"https://idp.example.com"}, s3iam.trustedOIDCIssuers(ctx))
+
+	store.fail.Store(true)
+	assert.Empty(t, s3iam.trustedOIDCIssuers(ctx),
+		"a failed listing must report no trusted issuers, not the partial registered set")
+}
diff --git a/weed/s3api/s3_iam_group_role_abac_test.go b/weed/s3api/s3_iam_group_role_abac_test.go
index c3ea4244de..9c7e344a17 100644
--- a/weed/s3api/s3_iam_group_role_abac_test.go
+++ b/weed/s3api/s3_iam_group_role_abac_test.go
@@ -220,9 +220,7 @@ func groupsRolesJWT(t *testing.T, subject string, groups, roles []string) string
 }
 
 func authenticateSessionToken(t *testing.T, s3iam *S3IAMIntegration, sessionToken string) (*IAMIdentity, s3err.ErrorCode) {
-	req := httptest.NewRequest("GET", "/", http.NoBody)
-	req.Header.Set("Authorization", "Bearer "+sessionToken)
-	return s3iam.AuthenticateJWT(context.Background(), req)
+	return testIdentityFromSessionToken(t, s3iam, sessionToken), s3err.ErrNone
 }
 
 func authorizeGet(ctx context.Context, s3iam *S3IAMIntegration, identity *IAMIdentity, bucket string) bool {
diff --git a/weed/s3api/s3_iam_middleware.go b/weed/s3api/s3_iam_middleware.go
index 42dd27d319..6861f48bf4 100644
--- a/weed/s3api/s3_iam_middleware.go
+++ b/weed/s3api/s3_iam_middleware.go
@@ -3,9 +3,9 @@ package s3api
 import (
 	"context"
 	"fmt"
-	"net"
 	"net/http"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
@@ -13,30 +13,11 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
 	"github.com/seaweedfs/seaweedfs/weed/iam/providers"
 	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 )
 
-// privateNetworks contains pre-parsed private IP ranges for efficient lookups
-var privateNetworks []*net.IPNet
-
-func init() {
-	// Private IPv4 ranges (RFC1918) and IPv6 Unique Local Addresses (ULA)
-	privateRanges := []string{
-		"10.0.0.0/8",     // IPv4 private
-		"172.16.0.0/12",  // IPv4 private
-		"192.168.0.0/16", // IPv4 private
-		"fc00::/7",       // IPv6 Unique Local Addresses (ULA)
-	}
-
-	for _, cidr := range privateRanges {
-		_, network, err := net.ParseCIDR(cidr)
-		if err == nil {
-			privateNetworks = append(privateNetworks, network)
-		}
-	}
-}
-
 // IAMIntegration defines the interface for IAM integration
 type IAMIntegration interface {
 	AuthenticateJWT(ctx context.Context, r *http.Request) (*IAMIdentity, s3err.ErrorCode)
@@ -53,10 +34,11 @@ type IAMManagerProvider interface {
 
 // S3IAMIntegration provides IAM integration for S3 API
 type S3IAMIntegration struct {
-	iamManager   *integration.IAMManager
-	stsService   *sts.STSService
-	filerAddress string
-	enabled      bool
+	iamManager     *integration.IAMManager
+	stsService     *sts.STSService
+	filerAddress   string
+	enabled        bool
+	trustedProxies atomic.Pointer[policy_engine.TrustedProxies]
 }
 
 // NewS3IAMIntegration creates a new S3 IAM integration
@@ -79,6 +61,12 @@ func (s3iam *S3IAMIntegration) GetIAMManager() *integration.IAMManager {
 	return s3iam.iamManager
 }
 
+// SetTrustedProxies configures the allowlist used to decide whether
+// forwarded headers are honored when extracting aws:SourceIp.
+func (s3iam *S3IAMIntegration) SetTrustedProxies(tp *policy_engine.TrustedProxies) {
+	s3iam.trustedProxies.Store(tp)
+}
+
 // AuthenticateJWT authenticates JWT tokens using our STS service
 func (s3iam *S3IAMIntegration) AuthenticateJWT(ctx context.Context, r *http.Request) (*IAMIdentity, s3err.ErrorCode) {
 
@@ -138,6 +126,12 @@ func (s3iam *S3IAMIntegration) AuthenticateJWT(ctx context.Context, r *http.Requ
 			return nil, s3err.ErrAccessDenied
 		}
 
+		// A token without a subject has no issuer-scoped principal; letting it
+		// through would make the client-supplied claims below stand in for one.
+		if identity.UserID == "" {
+			return nil, s3err.ErrAccessDenied
+		}
+
 		// Extract role from OIDC identity
 		if identity.RoleArn == "" {
 			return nil, s3err.ErrAccessDenied
@@ -174,6 +168,22 @@ func (s3iam *S3IAMIntegration) AuthenticateJWT(ctx context.Context, r *http.Requ
 		// Set critical claims explicitly, overwriting any from attributes to ensure correctness.
 		claims["sub"] = identity.UserID
 		claims["role"] = identity.RoleArn
+		claims["iss"] = identity.Issuer
+
+		// The bare sub collides across issuers; aws:userid carries the same
+		// (sub, iss) hash STS sessions already expose, so downstream ownership
+		// keys stay namespaced per identity provider. A claim the token itself
+		// supplies is always scrubbed, never adopted.
+		if parentUser := sts.ComputeParentUser(identity.UserID, identity.Issuer); parentUser != "" {
+			claims["aws:userid"] = parentUser
+		} else {
+			delete(claims, "aws:userid")
+		}
+		if issuers := s3iam.trustedOIDCIssuers(ctx); len(issuers) > 0 {
+			claims["seaweed:oidc-issuers"] = strings.Join(issuers, " ")
+		} else {
+			delete(claims, "seaweed:oidc-issuers")
+		}
 
 		// Use real email address if available
 		emailAddress := identity.UserID + "@oidc.local"
@@ -196,48 +206,17 @@ func (s3iam *S3IAMIntegration) AuthenticateJWT(ctx context.Context, r *http.Requ
 				EmailAddress: emailAddress,
 				Id:           identity.UserID,
 			},
-			Claims: claims,
+			Claims:        claims,
+			IdentityClaim: sts.ResolveIdentityClaim(claims),
 		}, s3err.ErrNone
 	}
 
-	// This is an STS-issued token - validate with STS service
-	// ValidateSessionToken performs cryptographic verification and extraction of trusted claims
-	sessionInfo, err := s3iam.stsService.ValidateSessionToken(ctx, sessionToken)
-	if err != nil {
-		glog.V(3).Infof("STS session validation failed: %v", err)
-		return nil, s3err.ErrAccessDenied
-	}
-
-	// Create claims map starting with request context (which holds custom claims)
-	claims := make(map[string]interface{})
-	if sessionInfo.RequestContext != nil {
-		for k, v := range sessionInfo.RequestContext {
-			claims[k] = v
-		}
-	}
-
-	// Add standard claims
-	claims["sub"] = sessionInfo.Subject
-	claims["role"] = sessionInfo.RoleArn
-	claims["principal"] = sessionInfo.Principal
-	claims["snam"] = sessionInfo.SessionName
-
-	// Create IAM identity from VALIDATED session info
-	// We use the trusted data returned by the STS service, not the unverified token claims
-	identity := &IAMIdentity{
-		Name:         sessionInfo.Subject,
-		Principal:    sessionInfo.Principal,
-		SessionToken: sessionToken,
-		Account: &Account{
-			DisplayName:  sessionInfo.SessionName,
-			EmailAddress: sessionInfo.Subject + "@seaweedfs.local",
-			Id:           sessionInfo.Subject,
-		},
-		Claims: claims,
-	}
-
-	glog.V(3).Infof("JWT authentication successful for principal: %s", identity.Principal)
-	return identity, s3err.ErrNone
+	// STS session tokens authenticate SigV4 requests via proof of possession
+	// (signature with the derived secret). As bearer tokens they would turn
+	// every presigned URL, which carries the token in X-Amz-Security-Token,
+	// into a standalone credential.
+	glog.V(3).Infof("Rejected STS session token presented as bearer token")
+	return nil, s3err.ErrAccessDenied
 }
 
 // ValidateSessionToken checks the validity of an STS session token
@@ -259,13 +238,13 @@ func (s3iam *S3IAMIntegration) AuthorizeAction(ctx context.Context, identity *IA
 	}
 
 	// Extract request context for policy conditions
-	requestContext := extractRequestContext(r)
+	requestContext := s3iam.extractRequestContext(r)
 
 	// For list operations, populate the s3:prefix condition key and ensure the
 	// resource ARN stays at bucket level (matching AWS ListBucket semantics).
 	// See https://github.com/seaweedfs/seaweedfs/issues/8969
 	resourceObjectKey := objectKey
-	if action == "List" {
+	if isBucketListingRequest(r, action) {
 		listPrefix := r.URL.Query().Get("prefix")
 		if listPrefix != "" {
 			requestContext["s3:prefix"] = listPrefix
@@ -301,8 +280,10 @@ func (s3iam *S3IAMIntegration) AuthorizeAction(ctx context.Context, identity *IA
 		}
 	}
 
-	// Determine the specific S3 action based on the HTTP request details
-	specificAction := ResolveS3Action(r, string(action), bucket, objectKey)
+	// Determine the specific S3 action based on the HTTP request details. The
+	// prefix promoted into objectKey is not part of the URL; resolve against
+	// the bucket-level object so ?versions and ?uploads keep their own action.
+	specificAction := ResolveS3Action(r, string(action), bucket, resourceObjectKey)
 
 	// Create action request
 	actionRequest := &integration.ActionRequest{
@@ -348,12 +329,13 @@ func (s3iam *S3IAMIntegration) DefaultAllow() bool {
 
 // IAMIdentity represents an authenticated identity with session information
 type IAMIdentity struct {
-	Name         string
-	Principal    string
-	SessionToken string
-	Account      *Account
-	PolicyNames  []string
-	Claims       map[string]interface{}
+	Name          string
+	Principal     string
+	SessionToken  string
+	Account       *Account
+	PolicyNames   []string
+	Claims        map[string]interface{}
+	IdentityClaim string // Authoritative OIDC identity claim for audit logging; empty for non-federated sessions
 }
 
 // IsAdmin checks if the identity has admin privileges
@@ -397,25 +379,20 @@ func buildS3ResourceArn(bucket string, objectKey string) string {
 }
 
 // extractRequestContext extracts request context for policy conditions
-func extractRequestContext(r *http.Request) map[string]interface{} {
+func (s3iam *S3IAMIntegration) extractRequestContext(r *http.Request) map[string]interface{} {
 	context := make(map[string]interface{})
 
-	// Extract source IP for IP-based conditions
-	// Use AWS-compatible key name for policy variable substitution
-	sourceIP := extractSourceIP(r)
+	sourceIP := s3iam.extractSourceIP(r)
 	if sourceIP != "" {
 		context["aws:SourceIp"] = sourceIP
 	}
 
-	// Extract user agent
 	if userAgent := r.Header.Get("User-Agent"); userAgent != "" {
 		context["userAgent"] = userAgent
 	}
 
-	// Extract request time
 	context["requestTime"] = r.Context().Value("requestTime")
 
-	// Extract additional headers that might be useful for conditions
 	if referer := r.Header.Get("Referer"); referer != "" {
 		context["referer"] = referer
 	}
@@ -423,62 +400,11 @@ func extractRequestContext(r *http.Request) map[string]interface{} {
 	return context
 }
 
-// extractSourceIP extracts the real source IP from the request
-// SECURITY: Prioritizes RemoteAddr over client-controlled headers to prevent spoofing
-// Only trusts X-Forwarded-For/X-Real-IP if RemoteAddr appears to be from a trusted proxy
-func extractSourceIP(r *http.Request) string {
-	// Always start with RemoteAddr as the most trustworthy source
-	remoteIP := r.RemoteAddr
-	if ip, _, err := net.SplitHostPort(remoteIP); err == nil {
-		remoteIP = ip
-	}
-
-	// NOTE: The current heuristic of using isPrivateIP assumes reverse proxies are on a
-	// private/local network. This may be insufficient for some cloud, CDN, or multi-tier
-	// proxy deployments where proxies terminate connections from public IPs. In such
-	// environments, deployment-specific controls (e.g., network ACLs or proxy configs)
-	// should be used to ensure only trusted components can set forwarding headers.
-	// Future enhancements may introduce an explicit, configurable trusted proxy CIDR list.
-	isTrustedProxy := isPrivateIP(remoteIP)
-
-	if isTrustedProxy {
-		// Check X-Real-IP header first (single IP, more reliable than X-Forwarded-For)
-		if realIP := r.Header.Get("X-Real-IP"); realIP != "" {
-			return strings.TrimSpace(realIP)
-		}
-
-		// Check X-Forwarded-For header (can contain multiple IPs, take the first one)
-		if forwardedFor := r.Header.Get("X-Forwarded-For"); forwardedFor != "" {
-			if ips := strings.Split(forwardedFor, ","); len(ips) > 0 {
-				return strings.TrimSpace(ips[0])
-			}
-		}
-	}
-
-	// Fall back to RemoteAddr (most secure)
-	return remoteIP
-}
-
-// isPrivateIP checks if an IP is in a private range (localhost or RFC1918)
-func isPrivateIP(ipStr string) bool {
-	ip := net.ParseIP(ipStr)
-	if ip == nil {
-		return false
-	}
-
-	// Check for localhost and link-local addresses (IPv4/IPv6)
-	if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
-		return true
-	}
-
-	// Check against pre-parsed private CIDR ranges
-	for _, network := range privateNetworks {
-		if network.Contains(ip) {
-			return true
-		}
-	}
-
-	return false
+// extractSourceIP returns the client IP for aws:SourceIp condition
+// evaluation, honoring forwarded headers only when the direct TCP peer is in
+// the configured trusted-proxy allowlist (see SetTrustedProxies).
+func (s3iam *S3IAMIntegration) extractSourceIP(r *http.Request) string {
+	return s3iam.trustedProxies.Load().ExtractSourceIP(r)
 }
 
 // ParseUnverifiedJWTToken parses a JWT token and returns its claims WITHOUT cryptographic verification
@@ -521,6 +447,7 @@ type OIDCIdentity struct {
 	UserID      string
 	RoleArn     string
 	Provider    string
+	Issuer      string
 	Email       string
 	DisplayName string
 	Groups      []string
@@ -584,6 +511,7 @@ func (s3iam *S3IAMIntegration) validateExternalOIDCToken(ctx context.Context, to
 		UserID:      externalIdentity.UserID,
 		RoleArn:     roleArn,
 		Provider:    fmt.Sprintf("%T", provider), // Use provider type as identifier
+		Issuer:      externalIdentity.Issuer,
 		Email:       externalIdentity.Email,
 		DisplayName: externalIdentity.DisplayName,
 		Groups:      externalIdentity.Groups,
@@ -591,6 +519,54 @@ func (s3iam *S3IAMIntegration) validateExternalOIDCToken(ctx context.Context, to
 	}, nil
 }
 
+// trustedOIDCIssuers returns the issuer URLs of the OIDC providers the
+// deployment is configured to trust. It is what a legacy (pre-scoping) bare
+// subject can be re-anchored to: exactly one issuer makes the mapping
+// unambiguous; anything else leaves it unknown, which callers must treat as
+// fail-closed rather than guessing from the caller's issuer.
+//
+// The list is only safe while complete. Without a provider store the
+// registered providers are the whole set — there is nowhere an issuer could
+// hide. With a store, a failed listing leaves the real set unknown, and
+// passing the registered subset off as complete could collapse a
+// multi-issuer deployment to a single issuer: the one shape a bare subject
+// re-anchors under, so a caller from that issuer could claim a stored
+// subject that belongs to a provider hidden behind the error. Fail closed.
+func (s3iam *S3IAMIntegration) trustedOIDCIssuers(ctx context.Context) []string {
+	if s3iam.iamManager == nil {
+		return nil
+	}
+	seen := make(map[string]bool)
+	var issuers []string
+	// Configured identity providers registered with STS cover deployments
+	// whose OIDC setup lives in config rather than the provider store.
+	if stsService := s3iam.iamManager.GetSTSService(); stsService != nil {
+		for _, p := range stsService.GetProviders() {
+			if issuer, ok := p.(interface{ GetIssuer() string }); ok {
+				if iss := issuer.GetIssuer(); iss != "" && !seen[iss] {
+					seen[iss] = true
+					issuers = append(issuers, iss)
+				}
+			}
+		}
+	}
+	if s3iam.iamManager.GetOIDCProviderStore() == nil {
+		return issuers
+	}
+	records, err := s3iam.iamManager.ListOIDCProviders(ctx)
+	if err != nil {
+		glog.V(2).Infof("trustedOIDCIssuers: %v", err)
+		return nil
+	}
+	for _, rec := range records {
+		if rec.URL != "" && !seen[rec.URL] {
+			seen[rec.URL] = true
+			issuers = append(issuers, rec.URL)
+		}
+	}
+	return issuers
+}
+
 // selectPrimaryRole simply picks the first role from the list
 // The OIDC provider should return roles in priority order (most important first)
 func (s3iam *S3IAMIntegration) selectPrimaryRole(roles []string, externalIdentity *providers.ExternalIdentity) string {
diff --git a/weed/s3api/s3_jwt_auth_test.go b/weed/s3api/s3_jwt_auth_test.go
index 8a71e09038..fd4ffc7eae 100644
--- a/weed/s3api/s3_jwt_auth_test.go
+++ b/weed/s3api/s3_jwt_auth_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/iam/oidc"
 	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
 	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/stretchr/testify/assert"
@@ -99,9 +100,9 @@ func TestJWTAuthenticationFlow(t *testing.T) {
 			// Test each operation
 			for _, op := range tt.testOperations {
 				t.Run(string(op.Action), func(t *testing.T) {
-					// Test JWT authentication
-					identity, errCode := testJWTAuthentication(t, iamServer, jwtToken)
-					require.Equal(t, s3err.ErrNone, errCode, "JWT authentication should succeed")
+					// Test session authentication via SigV4 proof of possession
+					identity, errCode := testSessionAuthentication(t, iamServer, response.Credentials)
+					require.Equal(t, s3err.ErrNone, errCode, "Session authentication should succeed")
 					require.NotNil(t, identity)
 
 					// Test authorization with appropriate role based on test case
@@ -171,11 +172,10 @@ func TestRequestContextExtraction(t *testing.T) {
 				req := httptest.NewRequest("GET", "/test-bucket/test-file.txt", http.NoBody)
 				req.Header.Set("X-Forwarded-For", "192.168.1.100")
 				req.Header.Set("User-Agent", "aws-sdk-go/1.0")
-				// Set RemoteAddr to private IP to simulate trusted proxy
 				req.RemoteAddr = "127.0.0.1:12345"
 				return req
 			},
-			expectedIP: "192.168.1.100",
+			expectedIP: "127.0.0.1",
 			expectedUA: "aws-sdk-go/1.0",
 		},
 		{
@@ -184,11 +184,10 @@ func TestRequestContextExtraction(t *testing.T) {
 				req := httptest.NewRequest("GET", "/test-bucket/test-file.txt", http.NoBody)
 				req.Header.Set("X-Real-IP", "10.0.0.1")
 				req.Header.Set("User-Agent", "boto3/1.0")
-				// Set RemoteAddr to private IP to simulate trusted proxy
 				req.RemoteAddr = "127.0.0.1:12345"
 				return req
 			},
-			expectedIP: "10.0.0.1",
+			expectedIP: "127.0.0.1",
 			expectedUA: "boto3/1.0",
 		},
 	}
@@ -197,8 +196,8 @@ func TestRequestContextExtraction(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			req := tt.setupRequest()
 
-			// Extract request context
-			context := extractRequestContext(req)
+			s3iam := &S3IAMIntegration{}
+			context := s3iam.extractRequestContext(req)
 
 			if tt.expectedIP != "" {
 				assert.Equal(t, tt.expectedIP, context["aws:SourceIp"])
@@ -211,6 +210,20 @@ func TestRequestContextExtraction(t *testing.T) {
 	}
 }
 
+// TestRequestContextExtraction_TrustedProxy verifies that when a trusted
+// proxy allowlist is configured, X-Forwarded-For is honored.
+func TestRequestContextExtraction_TrustedProxy(t *testing.T) {
+	s3iam := &S3IAMIntegration{}
+	s3iam.SetTrustedProxies(policy_engine.NewTrustedProxies([]string{"10.0.0.0/24"}))
+
+	req := httptest.NewRequest("GET", "/test-bucket/test-file.txt", http.NoBody)
+	req.Header.Set("X-Forwarded-For", "203.0.113.99")
+	req.RemoteAddr = "10.0.0.1:12345"
+
+	context := s3iam.extractRequestContext(req)
+	assert.Equal(t, "203.0.113.99", context["aws:SourceIp"])
+}
+
 // TestIPBasedPolicyEnforcement tests IP-based conditional policies
 func TestIPBasedPolicyEnforcement(t *testing.T) {
 	iamManager := setupTestIAMManager(t)
@@ -258,9 +271,7 @@ func TestIPBasedPolicyEnforcement(t *testing.T) {
 			// Create request with specific IP
 			req := httptest.NewRequest("GET", "/restricted-bucket/file.txt", http.NoBody)
 			req.Header.Set("Authorization", "Bearer "+response.Credentials.SessionToken)
-			req.Header.Set("X-Forwarded-For", tt.sourceIP)
-			// Set RemoteAddr to private IP to simulate trusted proxy
-			req.RemoteAddr = "127.0.0.1:12345"
+			req.RemoteAddr = tt.sourceIP + ":12345"
 
 			// Create IAM identity for testing
 			identity := &IAMIdentity{
@@ -526,6 +537,16 @@ func setupTestIPRestrictedRole(ctx context.Context, manager *integration.IAMMana
 	})
 }
 
+// testSessionAuthentication authenticates STS temporary credentials the way a
+// real client does: a SigV4-signed request carrying the session token.
+func testSessionAuthentication(t *testing.T, iam *IdentityAccessManagement, creds *sts.Credentials) (*Identity, s3err.ErrorCode) {
+	req, err := newTestRequest("GET", "https://example.com/test-bucket/test-object", 0, nil)
+	require.NoError(t, err)
+	req.Header.Set("X-Amz-Security-Token", creds.SessionToken)
+	require.NoError(t, signRequestV4(req, creds.AccessKeyId, creds.SecretAccessKey))
+	return iam.reqSignatureV4Verify(req)
+}
+
 func testJWTAuthentication(t *testing.T, iam *IdentityAccessManagement, token string) (*Identity, s3err.ErrorCode) {
 	// Create test request with JWT
 	req := httptest.NewRequest("GET", "/test-bucket/test-object", http.NoBody)
diff --git a/weed/s3api/s3_metadata_util.go b/weed/s3api/s3_metadata_util.go
index 71ef623f9c..01e0adc194 100644
--- a/weed/s3api/s3_metadata_util.go
+++ b/weed/s3api/s3_metadata_util.go
@@ -2,7 +2,6 @@ package s3api
 
 import (
 	"net/http"
-	"net/url"
 	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -30,7 +29,7 @@ func ParseS3Metadata(r *http.Request, existing map[string][]byte, isReplace bool
 	}
 
 	// Content-Encoding (standard HTTP header used by S3)
-	if ce := r.Header.Get("Content-Encoding"); ce != "" {
+	if ce := storedContentEncoding(r.Header.Values("Content-Encoding")); ce != "" {
 		metadata["Content-Encoding"] = []byte(ce)
 	}
 
@@ -52,25 +51,16 @@ func ParseS3Metadata(r *http.Request, existing map[string][]byte, isReplace bool
 
 	// Object tagging
 	if tags := r.Header.Get(s3_constants.AmzObjectTagging); tags != "" {
-		// Use url.ParseQuery for robust parsing and automatic URL decoding
-		parsedTags, err := url.ParseQuery(tags)
+		tagSet, err := parseTagsHeader(tags)
 		if err != nil {
-			// Return proper S3 error instead of silently dropping tags
-			glog.Warningf("Invalid S3 tag format in header '%s': %v", tags, err)
+			glog.Warningf("Invalid S3 tagging header: %v", err)
 			return nil, s3err.ErrInvalidTag
 		}
-
-		// Validate: S3 spec does not allow duplicate tag keys
-		for key, values := range parsedTags {
-			if len(values) > 1 {
-				glog.Warningf("Duplicate tag key '%s' in header '%s'", key, tags)
-				return nil, s3err.ErrInvalidTag
-			}
-			// Tag value can be an empty string but not nil
-			value := ""
-			if len(values) > 0 {
-				value = values[0]
-			}
+		if err := ValidateTags(tagSet); err != nil {
+			glog.Warningf("Invalid tags (%d): %v", len(tagSet), err)
+			return nil, s3err.ErrInvalidTag
+		}
+		for key, value := range tagSet {
 			metadata[s3_constants.AmzObjectTagging+"-"+key] = []byte(value)
 		}
 	}
@@ -94,17 +84,30 @@ func ParseS3Metadata(r *http.Request, existing map[string][]byte, isReplace bool
 		metadata[s3_constants.AmzServerSideEncryptionCustomerKeyMD5] = []byte(keyMD5)
 	}
 
-	// ACL owner
-	acpOwner := r.Header.Get(s3_constants.ExtAmzOwnerKey)
-	if len(acpOwner) > 0 {
-		metadata[s3_constants.ExtAmzOwnerKey] = []byte(acpOwner)
-	}
-
-	// ACL grants
-	acpGrants := r.Header.Get(s3_constants.ExtAmzAclKey)
-	if len(acpGrants) > 0 {
-		metadata[s3_constants.ExtAmzAclKey] = []byte(acpGrants)
-	}
-
 	return metadata, s3err.ErrNone
 }
+
+// storedContentEncoding returns the Content-Encoding to keep with an object,
+// from the values of the request's Content-Encoding fields, which it combines
+// as one list. aws-chunked names the SigV4 streaming framing of the request
+// body, which is decoded on upload, so S3 does not store it: "gzip,
+// aws-chunked" is kept as "gzip", and "aws-chunked" alone as no
+// Content-Encoding at all.
+func storedContentEncoding(values []string) string {
+	value := strings.Join(values, ", ")
+	var kept []string
+	chunked := false
+	for _, encoding := range strings.Split(value, ",") {
+		encoding = strings.TrimSpace(encoding)
+		switch {
+		case strings.EqualFold(encoding, "aws-chunked"):
+			chunked = true
+		case encoding != "":
+			kept = append(kept, encoding)
+		}
+	}
+	if !chunked {
+		return value
+	}
+	return strings.Join(kept, ", ")
+}
diff --git a/weed/s3api/s3_objectlock/object_lock_check.go b/weed/s3api/s3_objectlock/object_lock_check.go
index c1c8c0b185..da09b75d82 100644
--- a/weed/s3api/s3_objectlock/object_lock_check.go
+++ b/weed/s3api/s3_objectlock/object_lock_check.go
@@ -153,6 +153,13 @@ func recursivelyCheckLocksWithClient(ctx context.Context, client filer_pb.Seawee
 					return false, err
 				}
 			} else {
+				// A directory-marker object (key ending in "/") is stored as a
+				// directory entry and can carry a lock, so check it before recursing.
+				if EntryHasActiveLock(entry, currentTime) {
+					*hasLocks = true
+					glog.V(2).Infof("Found directory marker with active lock: %s/%s", dir, entry.Name)
+					return true, nil
+				}
 				// Recursively check subdirectories
 				if err := recursivelyCheckLocksWithClient(ctx, client, subDir, hasLocks, currentTime); err != nil {
 					return false, err
diff --git a/weed/s3api/s3_objectlock/object_lock_check_test.go b/weed/s3api/s3_objectlock/object_lock_check_test.go
new file mode 100644
index 0000000000..8f0894d5ce
--- /dev/null
+++ b/weed/s3api/s3_objectlock/object_lock_check_test.go
@@ -0,0 +1,93 @@
+package s3_objectlock
+
+import (
+	"context"
+	"io"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+type fakeListStream struct {
+	entries []*filer_pb.Entry
+	index   int
+}
+
+func (s *fakeListStream) Recv() (*filer_pb.ListEntriesResponse, error) {
+	if s.index >= len(s.entries) {
+		return nil, io.EOF
+	}
+	e := s.entries[s.index]
+	s.index++
+	return &filer_pb.ListEntriesResponse{Entry: e}, nil
+}
+
+func (s *fakeListStream) Header() (metadata.MD, error) { return metadata.MD{}, nil }
+func (s *fakeListStream) Trailer() metadata.MD         { return metadata.MD{} }
+func (s *fakeListStream) CloseSend() error             { return nil }
+func (s *fakeListStream) Context() context.Context     { return context.Background() }
+func (s *fakeListStream) SendMsg(any) error            { return nil }
+func (s *fakeListStream) RecvMsg(any) error            { return nil }
+
+// fakeFilerClient serves a fixed directory -> entries map.
+type fakeFilerClient struct {
+	filer_pb.SeaweedFilerClient
+	dirs map[string][]*filer_pb.Entry
+}
+
+func (c *fakeFilerClient) ListEntries(ctx context.Context, in *filer_pb.ListEntriesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[filer_pb.ListEntriesResponse], error) {
+	entries := c.dirs[in.Directory]
+	if in.StartFromFileName != "" {
+		// Already returned everything on the first page; the second call gets nothing.
+		return &fakeListStream{}, nil
+	}
+	return &fakeListStream{entries: entries}, nil
+}
+
+func lockedDirMarker(name string) *filer_pb.Entry {
+	until := strconv.FormatInt(time.Now().Add(24*time.Hour).Unix(), 10)
+	return &filer_pb.Entry{
+		Name:        name,
+		IsDirectory: true,
+		Extended: map[string][]byte{
+			s3_constants.ExtObjectLockModeKey:     []byte(s3_constants.RetentionModeCompliance),
+			s3_constants.ExtRetentionUntilDateKey: []byte(until),
+		},
+	}
+}
+
+func TestHasObjectsWithActiveLocksDirectoryMarker(t *testing.T) {
+	client := &fakeFilerClient{dirs: map[string][]*filer_pb.Entry{
+		"/buckets/lockb": {lockedDirMarker("records")},
+		// The marker's own subtree is empty; only the marker entry carries the lock.
+		"/buckets/lockb/records": {},
+	}}
+
+	has, err := HasObjectsWithActiveLocks(context.Background(), client, "/buckets/lockb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !has {
+		t.Fatalf("expected the locked directory marker to be reported as an active lock")
+	}
+}
+
+func TestHasObjectsWithActiveLocksUnlockedDirectory(t *testing.T) {
+	client := &fakeFilerClient{dirs: map[string][]*filer_pb.Entry{
+		"/buckets/plainb":        {{Name: "prefix", IsDirectory: true}},
+		"/buckets/plainb/prefix": {{Name: "obj.txt"}},
+	}}
+
+	has, err := HasObjectsWithActiveLocks(context.Background(), client, "/buckets/plainb")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if has {
+		t.Fatalf("expected no active lock for an ordinary prefix and object")
+	}
+}
diff --git a/weed/s3api/s3_sse_kms.go b/weed/s3api/s3_sse_kms.go
index 47e2dd8e52..b79154c85d 100644
--- a/weed/s3api/s3_sse_kms.go
+++ b/weed/s3api/s3_sse_kms.go
@@ -865,6 +865,10 @@ func DetermineUnifiedCopyStrategy(state *EncryptionState, srcMetadata map[string
 		return CopyStrategyReencrypt, nil
 	}
 
+	if state.SrcSSES3 && state.DstSSES3 {
+		return CopyStrategyDirect, nil
+	}
+
 	// Encrypt: plain → encrypted
 	if !state.IsSourceEncrypted() && state.IsTargetEncrypted() {
 		return CopyStrategyEncrypt, nil
diff --git a/weed/s3api/s3api_acl_header_parser_test.go b/weed/s3api/s3api_acl_header_parser_test.go
new file mode 100644
index 0000000000..2b3932dfc9
--- /dev/null
+++ b/weed/s3api/s3api_acl_header_parser_test.go
@@ -0,0 +1,61 @@
+package s3api
+
+import (
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/require"
+)
+
+// TestParseCustomAclHeaderList covers the wire syntax separately from account
+// resolution, including quoted delimiters and rejection without partial grants.
+func TestParseCustomAclHeaderList(t *testing.T) {
+	tests := []struct {
+		name, input string
+		values      []string
+		invalid     bool
+	}{
+		{name: "absent"},
+		{name: "single", input: `id="alice"`, values: []string{"alice"}},
+		{name: "comma without space", input: `id="alice",id="bob"`, values: []string{"alice", "bob"}},
+		{name: "comma with space", input: `id="alice", id="bob"`, values: []string{"alice", "bob"}},
+		{name: "optional whitespace", input: " id = \"alice\" ,\t id=\"bob\" ", values: []string{"alice", "bob"}},
+		{name: "quoted comma and equals", input: `id="a,b=c",id="bob"`, values: []string{"a,b=c", "bob"}},
+		{name: "escaped quote", input: `id="a\"b",id="bob"`, values: []string{`a"b`, "bob"}},
+		{name: "email", input: `emailAddress="a=b@example.com"`, values: []string{"a=b@example.com"}},
+		{name: "group", input: `uri="http://acs.amazonaws.com/groups/global/AllUsers"`, values: []string{s3_constants.GranteeGroupAllUsers}},
+		{name: "unknown type", input: `account="alice"`, invalid: true},
+		{name: "mixed unknown type", input: `id="alice",principal="bob"`, invalid: true},
+		{name: "empty grantee", input: `id=""`, invalid: true},
+		{name: "unquoted", input: `id=alice`, invalid: true},
+		{name: "unterminated", input: `id="alice`, invalid: true},
+		{name: "trailing comma", input: `id="alice",`, invalid: true},
+		{name: "empty element", input: `id="alice",,id="bob"`, invalid: true},
+		{name: "missing comma", input: `id="alice" id="bob"`, invalid: true},
+		{name: "invalid escape", input: `id="a\q"`, invalid: true},
+		{name: "whitespace only", input: "  ", invalid: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			original := &s3.Grant{Permission: aws.String(s3_constants.PermissionFullControl)}
+			grants := []*s3.Grant{original}
+			code := ParseCustomAclHeader(tt.input, s3_constants.PermissionRead, &grants)
+			if tt.invalid {
+				require.Equal(t, s3err.ErrInvalidRequest, code)
+				require.Equal(t, []*s3.Grant{original}, grants, "invalid lists must not leave partial grants")
+				return
+			}
+			require.Equal(t, s3err.ErrNone, code)
+			require.Len(t, grants, 1+len(tt.values))
+			for i, value := range tt.values {
+				grant := grants[i+1]
+				actual := aws.StringValue(grant.Grantee.ID) + aws.StringValue(grant.Grantee.EmailAddress) + aws.StringValue(grant.Grantee.URI)
+				require.Equal(t, value, actual)
+				require.Equal(t, s3_constants.PermissionRead, aws.StringValue(grant.Permission))
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_acl_helper.go b/weed/s3api/s3api_acl_helper.go
index a7d90b880d..7b9a51007a 100644
--- a/weed/s3api/s3api_acl_helper.go
+++ b/weed/s3api/s3api_acl_helper.go
@@ -21,8 +21,25 @@ type AccountManager interface {
 	GetAccountIdByIdentityName(name string) string
 }
 
+// aclOwnerAccountManager recognizes the stored resource owner as a valid
+// grantee even if that account is no longer registered, while every other
+// unknown account id is still rejected by the wrapped registry lookup.
+type aclOwnerAccountManager struct {
+	AccountManager
+	ownerId string
+}
+
+func (m aclOwnerAccountManager) GetAccountNameById(canonicalId string) string {
+	name := m.AccountManager.GetAccountNameById(canonicalId)
+	if name == "" && canonicalId != "" && canonicalId == m.ownerId {
+		return canonicalId
+	}
+	return name
+}
+
 // ExtractAcl extracts the acl from the request body, or from the header if request body is empty
 func ExtractAcl(r *http.Request, accountManager AccountManager, ownership, bucketOwnerId, ownerId, accountId string) (grants []*s3.Grant, errCode s3err.ErrorCode) {
+	accountManager = aclOwnerAccountManager{AccountManager: accountManager, ownerId: ownerId}
 	if r.Body != nil && r.Body != http.NoBody {
 		defer util_http.CloseRequest(r)
 
@@ -40,7 +57,10 @@ func ExtractAcl(r *http.Request, accountManager AccountManager, ownership, bucke
 
 		return ValidateAndTransferGrants(accountManager, acp.Grants)
 	} else {
-		_, grants, errCode = ParseAndValidateAclHeadersOrElseDefault(r, accountManager, ownership, bucketOwnerId, accountId, true)
+		// Canned and default ACLs grant FULL_CONTROL to the resource owner,
+		// not the requesting account: an admin updating another account's
+		// object must not take over its full-control grant.
+		_, grants, errCode = ParseAndValidateAclHeadersOrElseDefault(r, accountManager, ownership, bucketOwnerId, ownerId, true)
 		return grants, errCode
 	}
 }
@@ -110,7 +130,7 @@ func ParseCustomAclHeaders(r *http.Request, grants *[]*s3.Grant) s3err.ErrorCode
 	customAclHeaders := []string{s3_constants.AmzAclFullControl, s3_constants.AmzAclRead, s3_constants.AmzAclReadAcp, s3_constants.AmzAclWrite, s3_constants.AmzAclWriteAcp}
 	var errCode s3err.ErrorCode
 	for _, customAclHeader := range customAclHeaders {
-		headerValue := r.Header.Get(customAclHeader)
+		headerValue := strings.Join(r.Header.Values(customAclHeader), ",")
 		switch customAclHeader {
 		case s3_constants.AmzAclRead:
 			errCode = ParseCustomAclHeader(headerValue, s3_constants.PermissionRead, grants)
@@ -130,51 +150,64 @@ func ParseCustomAclHeaders(r *http.Request, grants *[]*s3.Grant) s3err.ErrorCode
 	return s3err.ErrNone
 }
 
-func ParseCustomAclHeader(headerValue, permission string, grants *[]*s3.Grant) s3err.ErrorCode {
-	if len(headerValue) > 0 {
-		split := strings.Split(headerValue, ", ")
-		for _, grantStr := range split {
-			kv := strings.Split(grantStr, "=")
-			if len(kv) != 2 {
-				return s3err.ErrInvalidRequest
-			}
-
-			switch kv[0] {
-			case "id":
-				var accountId string
-				_ = json.Unmarshal([]byte(kv[1]), &accountId)
-				*grants = append(*grants, &s3.Grant{
-					Grantee: &s3.Grantee{
-						Type: &s3_constants.GrantTypeCanonicalUser,
-						ID:   &accountId,
-					},
-					Permission: &permission,
-				})
-			case "emailAddress":
-				var emailAddress string
-				_ = json.Unmarshal([]byte(kv[1]), &emailAddress)
-				*grants = append(*grants, &s3.Grant{
-					Grantee: &s3.Grantee{
-						Type:         &s3_constants.GrantTypeAmazonCustomerByEmail,
-						EmailAddress: &emailAddress,
-					},
-					Permission: &permission,
-				})
-			case "uri":
-				var groupName string
-				_ = json.Unmarshal([]byte(kv[1]), &groupName)
-				*grants = append(*grants, &s3.Grant{
-					Grantee: &s3.Grantee{
-						Type: &s3_constants.GrantTypeGroup,
-						URI:  &groupName,
-					},
-					Permission: &permission,
-				})
-			}
-		}
+// parseAclGranteePairs decodes a comma-separated list of quoted grantees into
+// key/value pairs. Decoding each value before splitting keeps commas and equals
+// signs inside quotes intact.
+func parseAclGranteePairs(headerValue string) (pairs [][2]string, errCode s3err.ErrorCode) {
+	if headerValue == "" {
+		return nil, s3err.ErrNone
 	}
-	return s3err.ErrNone
+	remaining := strings.TrimSpace(headerValue)
+	for {
+		key, encoded, ok := strings.Cut(remaining, "=")
+		if !ok {
+			return nil, s3err.ErrInvalidRequest
+		}
+		decoder := json.NewDecoder(strings.NewReader(encoded))
+		var value string
+		if decoder.Decode(&value) != nil || value == "" {
+			return nil, s3err.ErrInvalidRequest
+		}
+		key = strings.TrimSpace(key)
+		switch key {
+		case "id", "emailAddress", "uri":
+		default:
+			return nil, s3err.ErrInvalidRequest
+		}
+		pairs = append(pairs, [2]string{key, value})
+		remaining = strings.TrimSpace(encoded[decoder.InputOffset():])
+		if remaining == "" {
+			break
+		}
+		if remaining[0] != ',' {
+			return nil, s3err.ErrInvalidRequest
+		}
+		remaining = strings.TrimSpace(remaining[1:])
+	}
+	return pairs, s3err.ErrNone
+}
 
+func ParseCustomAclHeader(headerValue, permission string, grants *[]*s3.Grant) s3err.ErrorCode {
+	pairs, errCode := parseAclGranteePairs(headerValue)
+	if errCode != s3err.ErrNone {
+		return errCode
+	}
+	var parsed []*s3.Grant
+	for i := range pairs {
+		grantee := &s3.Grantee{}
+		switch pairs[i][0] {
+		case "id":
+			grantee.Type, grantee.ID = &s3_constants.GrantTypeCanonicalUser, &pairs[i][1]
+		case "emailAddress":
+			grantee.Type, grantee.EmailAddress = &s3_constants.GrantTypeAmazonCustomerByEmail, &pairs[i][1]
+		case "uri":
+			grantee.Type, grantee.URI = &s3_constants.GrantTypeGroup, &pairs[i][1]
+		}
+		parsed = append(parsed, &s3.Grant{Grantee: grantee, Permission: &permission})
+	}
+	// Do not leave partially parsed grants behind when any list element fails.
+	*grants = append(*grants, parsed...)
+	return s3err.ErrNone
 }
 
 func ParseCannedAclHeader(bucketOwnership, bucketOwnerId, accountId, cannedAcl string, putAcl bool) (ownerId string, grants []*s3.Grant, err s3err.ErrorCode) {
diff --git a/weed/s3api/s3api_ambiguous_subresource_test.go b/weed/s3api/s3api_ambiguous_subresource_test.go
new file mode 100644
index 0000000000..7af21e0a34
--- /dev/null
+++ b/weed/s3api/s3api_ambiguous_subresource_test.go
@@ -0,0 +1,142 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestAmbiguousSubresource pins the rule that a request may name only one
+// operation. The router picks a handler by registration order and the IAM action
+// resolver picks an action by its own order, so a request carrying two operation
+// subresources gets authorized as one and served as the other.
+func TestAmbiguousSubresource(t *testing.T) {
+	for _, query := range []string{
+		"",
+		"policy=",
+		"tagging=",
+		"acl=&versionId=abc",
+		"tagging=&versionId=abc",
+		"retention=&versionId=abc",
+		"uploadId=xyz&partNumber=3",
+		"attributes=&partNumber=3&versionId=abc",
+		"versions=&prefix=a&delimiter=/",
+		"uploads=&prefix=a&x-id=CreateMultipartUpload",
+		"list-type=2&prefix=a&continuation-token=x",
+		"acl=&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=deadbeef",
+		"seaweedfs-quota=",
+	} {
+		req, _ := http.NewRequest("GET", "http://localhost/bucket/key?"+query, nil)
+		assert.False(t, hasAmbiguousSubresource(req.URL.Query()), "%q names one operation", query)
+	}
+
+	for _, query := range []string{
+		"policy=&tagging=",
+		"tagging=&policy=",
+		"cors=&tagging=",
+		"lifecycle=&tagging=",
+		"versioning=&tagging=",
+		"object-lock=&tagging=",
+		"requestPayment=&tagging=",
+		"acl=&policy=",
+		"policy=&cors=",
+		"delete=&policy=",
+		"uploads=&uploadId=xyz",
+		"policy=&tagging=&cors=",
+		"list-type=2&ownershipControls=",
+		"list-type=2&tagging=",
+		"ownershipControls=&list-type=2",
+		"list-type=2&versions=",
+		"policy=&seaweedfs-quota=",
+		"seaweedfs-quota=&policy=",
+		"seaweedfs-quota=&tagging=",
+	} {
+		req, _ := http.NewRequest("PUT", "http://localhost/bucket?"+query, nil)
+		assert.True(t, hasAmbiguousSubresource(req.URL.Query()), "%q names two operations", query)
+	}
+}
+
+// The bucket tagger's escalation: PUT /bucket?policy&tagging routes to the
+// bucket-policy handler while resolving as s3:PutBucketTagging. The guard has to
+// reject it before either the handler or the IAM check runs.
+func TestAmbiguousSubresourceRejectedBeforeHandler(t *testing.T) {
+	served := false
+	handler := validateRequestPath(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		served = true
+	}))
+
+	req, _ := http.NewRequest("PUT", "http://localhost/bucket?policy=&tagging=", nil)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	require.False(t, served, "an ambiguous request must not reach a handler")
+	assert.Equal(t, http.StatusBadRequest, rec.Code)
+
+	served = false
+	req, _ = http.NewRequest("PUT", "http://localhost/bucket?policy=", nil)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	assert.True(t, served, "an unambiguous request must still be served")
+}
+
+// The listing disclosure: GET /bucket?list-type=2&ownershipControls= routes to
+// ListObjectsV2 while resolving as s3:GetBucketOwnershipControls, so a principal
+// denied s3:ListBucket but allowed the ownership-controls read would list the
+// bucket. The guard has to reject the combined request before the listing handler.
+func TestListTypeOwnershipControlsRejectedBeforeHandler(t *testing.T) {
+	served := false
+	handler := validateRequestPath(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		served = true
+	}))
+
+	req, _ := http.NewRequest("GET", "http://localhost/bucket?list-type=2&ownershipControls=", nil)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	require.False(t, served, "a list-type+ownershipControls request must not reach a handler")
+	assert.Equal(t, http.StatusBadRequest, rec.Code)
+
+	served = false
+	req, _ = http.NewRequest("GET", "http://localhost/bucket?list-type=2&prefix=a", nil)
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	assert.True(t, served, "a plain list-type request must still be served")
+}
+
+// Every query key a route can be selected by must be classified: an operation
+// subresource counted by the ambiguity guard, or a parameter that only
+// modifies the operation it accompanies. A selector left out of both
+// authorizes as one operation while the router serves another.
+func TestRouteQueryKeysAreClassified(t *testing.T) {
+	// Action selects STS routes on the root router, id narrows a config
+	// subresource, partNumber accompanies uploadId; none select an S3
+	// operation on their own.
+	modifiers := map[string]bool{
+		"Action": true, "id": true, "partNumber": true,
+	}
+
+	router := mux.NewRouter()
+	setupRoutingTestServer(t).registerRouter(router)
+	err := router.Walk(func(route *mux.Route, _ *mux.Router, _ []*mux.Route) error {
+		templates, err := route.GetQueriesTemplates()
+		if err != nil {
+			return nil
+		}
+		for _, q := range templates {
+			key, _, _ := strings.Cut(q, "=")
+			if modifiers[key] {
+				continue
+			}
+			_, resolved := bucketQueryActions[key]
+			assert.True(t, operationSubresources[key] || resolved,
+				"route query key %q selects an operation but is not counted by hasAmbiguousSubresource", key)
+		}
+		return nil
+	})
+	require.NoError(t, err)
+}
diff --git a/weed/s3api/s3api_bucket_config.go b/weed/s3api/s3api_bucket_config.go
index fdecb24db8..dc13958eca 100644
--- a/weed/s3api/s3api_bucket_config.go
+++ b/weed/s3api/s3api_bucket_config.go
@@ -381,6 +381,19 @@ func (s3a *S3ApiServer) getBucketConfig(bucket string) (*BucketConfig, s3err.Err
 
 	config := s3a.newBucketConfigFromEntry(bucket, entry)
 
+	// A cold load is the first time this gateway learns the bucket's policy
+	// exists, and the metadata subscription only mirrors changes - a policy
+	// that predates the IAM integration would otherwise never reach the
+	// advanced-IAM mirror and its grants would not bind on the IAM path.
+	// Synchronous: the IAM auth path primes the bucket through here before
+	// evaluating the mirror, so the backfill has to land first - a one-time
+	// cost on the load that discovers the policy. Raw entry bytes, not the
+	// parsed document, so the backfill can byte-compare against a later
+	// entry read when it reconciles.
+	if policyJSON := entry.Extended[BUCKET_POLICY_METADATA_KEY]; len(policyJSON) > 0 && config.BucketPolicy != nil && s3a.bucketPolicyIAMManager() != nil {
+		s3a.ensureBucketPolicyInIAM(bucket, policyJSON)
+	}
+
 	// Cache the result
 	s3a.bucketConfigCache.Set(bucket, config)
 
@@ -633,6 +646,24 @@ func (s3a *S3ApiServer) isVersioningConfigured(bucket string) (bool, error) {
 	return config.Versioning != "" || config.ObjectLockConfig != nil, nil
 }
 
+// checkVersionIdConfigured reports ErrInvalidArgument when versionId names a
+// specific version on a bucket that has never had versioning configured. The
+// implicit "null" version of pre-versioning objects stays addressable.
+func (s3a *S3ApiServer) checkVersionIdConfigured(bucket, versionId string) s3err.ErrorCode {
+	if versionId == "" || versionId == "null" {
+		return s3err.ErrNone
+	}
+	configured, err := s3a.isVersioningConfigured(bucket)
+	if err != nil {
+		// Missing buckets and lookup failures are answered by the handler path.
+		return s3err.ErrNone
+	}
+	if !configured {
+		return s3err.ErrInvalidArgument
+	}
+	return s3err.ErrNone
+}
+
 // isObjectLockEnabled checks if Object Lock is enabled for a bucket (with caching)
 func (s3a *S3ApiServer) isObjectLockEnabled(bucket string) (bool, error) {
 	config, errCode := s3a.getBucketConfig(bucket)
diff --git a/weed/s3api/s3api_bucket_default_encryption_test.go b/weed/s3api/s3api_bucket_default_encryption_test.go
new file mode 100644
index 0000000000..ece46b4a21
--- /dev/null
+++ b/weed/s3api/s3api_bucket_default_encryption_test.go
@@ -0,0 +1,116 @@
+package s3api
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// Issue 11647: Bucket default encryption (SSE-S3) must be applied when
+// -s3.encryptVolumeData (s3a.cipher) is enabled, matching explicit SSE headers.
+func TestPutObjectAppliesBucketDefaultEncryptionWithVolumeCipher(t *testing.T) {
+	// Configure test key manager with a super key for SSE-S3 encryption.
+	km := GetSSES3KeyManager()
+	oldSuperKey := km.superKey
+	km.superKey = make([]byte, 32)
+	for i := range km.superKey {
+		km.superKey[i] = byte(i + 1)
+	}
+	t.Cleanup(func() {
+		km.superKey = oldSuperKey
+	})
+
+	testCases := []struct {
+		name         string
+		enableCipher bool
+	}{
+		{
+			name:         "volume encryption enabled (s3a.cipher=true)",
+			enableCipher: true,
+		},
+		{
+			name:         "volume encryption disabled (s3a.cipher=false)",
+			enableCipher: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			volume := startFakeVolumeServer(t)
+			filerImpl := &ambiguousPutFiler{
+				volume:  volume,
+				entries: map[string]*filer_pb.Entry{},
+				apply:   true,
+			}
+			s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+			s3a.cipher = tc.enableCipher
+
+			// Configure bucket "b" with default AES256 (SSE-S3) encryption.
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set("b", &BucketConfig{
+				Name: "b",
+				Encryption: &s3_pb.EncryptionConfiguration{
+					SseAlgorithm: "AES256",
+				},
+			})
+
+			// PUT request without explicit SSE headers.
+			r := httptest.NewRequest(http.MethodPut, "/b/plain.txt", nil)
+			filePath := "/buckets/b/plain.txt"
+			etag, code, sseMeta := s3a.putToFiler(r, filePath, strings.NewReader("hello seaweedfs"), "b", "plain.txt", 1, 0, nil, false, "")
+			if code != s3err.ErrNone {
+				t.Fatalf("putToFiler returned error code %v, want %v", code, s3err.ErrNone)
+			}
+			if etag == "" {
+				t.Fatal("expected non-empty etag")
+			}
+
+			// Verify returned SSE response metadata.
+			if sseMeta.SSEType != s3_constants.SSETypeS3 {
+				t.Fatalf("expected SSE response metadata type %s, got %s", s3_constants.SSETypeS3, sseMeta.SSEType)
+			}
+
+			// Verify entry saved on the filer.
+			entry, ok := filerImpl.entries[filePath]
+			if !ok {
+				t.Fatalf("entry not found on filer at %s", filePath)
+			}
+
+			sseHeaderVal, hasSSE := entry.Extended[s3_constants.AmzServerSideEncryption]
+			if !hasSSE || !bytes.Equal(sseHeaderVal, []byte("AES256")) {
+				t.Fatalf("expected entry to have %s=AES256, got hasSSE=%v val=%s", s3_constants.AmzServerSideEncryption, hasSSE, string(sseHeaderVal))
+			}
+
+			if len(entry.Extended[s3_constants.SeaweedFSSSES3Key]) == 0 {
+				t.Fatal("expected entry to have stored SSE-S3 key metadata")
+			}
+
+			if len(entry.Chunks) == 0 {
+				t.Fatal("expected entry to have at least one chunk")
+			}
+
+			for i, chunk := range entry.Chunks {
+				if chunk.SseType != filer_pb.SSEType_SSE_S3 {
+					t.Errorf("chunk %d: expected SseType SSE_S3, got %v", i, chunk.SseType)
+				}
+				if len(chunk.SseMetadata) == 0 {
+					t.Errorf("chunk %d: expected non-empty SseMetadata", i)
+				}
+				if tc.enableCipher && len(chunk.CipherKey) == 0 {
+					t.Errorf("chunk %d: expected volume CipherKey when s3a.cipher is true", i)
+				}
+				if !tc.enableCipher && len(chunk.CipherKey) != 0 {
+					t.Errorf("chunk %d: expected empty volume CipherKey when s3a.cipher is false", i)
+				}
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_bucket_delete_test.go b/weed/s3api/s3api_bucket_delete_test.go
new file mode 100644
index 0000000000..ab57dee2c6
--- /dev/null
+++ b/weed/s3api/s3api_bucket_delete_test.go
@@ -0,0 +1,356 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type fakeBucketDeleteFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entriesByDir map[string][]*filer_pb.Entry
+	deleteReq    *filer_pb.DeleteEntryRequest
+}
+
+func (f *fakeBucketDeleteFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	entries, ok := f.entriesByDir[req.Directory]
+	if !ok {
+		return nil, filer_pb.ErrNotFound
+	}
+	for _, e := range entries {
+		if e.Name == req.Name {
+			return &filer_pb.LookupDirectoryEntryResponse{Entry: e}, nil
+		}
+	}
+	return nil, filer_pb.ErrNotFound
+}
+
+func (f *fakeBucketDeleteFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	entries := f.entriesByDir[req.Directory]
+	if inPrefix := req.Prefix; inPrefix != "" && inPrefix != "/" {
+		filtered := make([]*filer_pb.Entry, 0)
+		for _, e := range entries {
+			if strings.HasPrefix(e.Name, inPrefix) {
+				filtered = append(filtered, e)
+			}
+		}
+		entries = filtered
+	}
+	if req.StartFromFileName != "" {
+		filtered := make([]*filer_pb.Entry, 0)
+		for _, e := range entries {
+			if e.Name > req.StartFromFileName || (req.InclusiveStartFrom && e.Name == req.StartFromFileName) {
+				filtered = append(filtered, e)
+			}
+		}
+		entries = filtered
+	}
+	if req.Limit > 0 && int(req.Limit) < len(entries) {
+		entries = entries[:req.Limit]
+	}
+	for _, entry := range entries {
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: entry}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (f *fakeBucketDeleteFiler) DeleteEntry(ctx context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	f.deleteReq = req
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+func newBucketDeleteTestServer(t *testing.T, f *fakeBucketDeleteFiler, allowDeleteBucketNotEmpty bool) *S3ApiServer {
+	t.Helper()
+	s3a := newFailoverTestServer(t, startFakeFiler(t, f))
+	s3a.option.BucketsPath = "/buckets"
+	s3a.option.AllowDeleteBucketNotEmpty = allowDeleteBucketNotEmpty
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.iam = &IdentityAccessManagement{}
+	return s3a
+}
+
+func TestBucketHasUserObjects_EmptyDirectories(t *testing.T) {
+	cases := []struct {
+		name         string
+		entriesByDir map[string][]*filer_pb.Entry
+		wantHasUser  bool
+	}{
+		{
+			name: "completely empty bucket",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {},
+			},
+			wantHasUser: false,
+		},
+		{
+			name: "bucket with root file",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "file.txt", IsDirectory: false},
+				},
+			},
+			wantHasUser: true,
+		},
+		{
+			name: "bucket with leftover empty directory from rm --recursive",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "data", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+				},
+				"/buckets/b/data": {},
+			},
+			wantHasUser: false,
+		},
+		{
+			name: "bucket with nested leftover empty directories",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "data", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+				},
+				"/buckets/b/data": {
+					{Name: "2026", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+				},
+				"/buckets/b/data/2026": {},
+			},
+			wantHasUser: false,
+		},
+		{
+			name: "bucket with nested directory containing a file",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "data", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+				},
+				"/buckets/b/data": {
+					{Name: "2026", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+				},
+				"/buckets/b/data/2026": {
+					{Name: "report.pdf", IsDirectory: false},
+				},
+			},
+			wantHasUser: true,
+		},
+		{
+			name: "bucket with explicit directory object (MIME set)",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "logs", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: "application/x-directory"}},
+				},
+				"/buckets/b/logs": {},
+			},
+			wantHasUser: true,
+		},
+		{
+			name: "empty *.versions folder and .uploads do not count",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: s3_constants.MultipartUploadsFolder, IsDirectory: true},
+					{Name: "oldfile.txt" + s3_constants.VersionsFolder, IsDirectory: true},
+				},
+			},
+			wantHasUser: false,
+		},
+		{
+			name: "nested versions directory with stored versions counts",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "logs", IsDirectory: true},
+				},
+				"/buckets/b/logs": {
+					{Name: "foo" + s3_constants.VersionsFolder, IsDirectory: true},
+				},
+				"/buckets/b/logs/foo" + s3_constants.VersionsFolder: {
+					{Name: "v1", IsDirectory: false},
+				},
+			},
+			wantHasUser: true,
+		},
+		{
+			name: "nested versions directory left empty does not count",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "logs", IsDirectory: true},
+				},
+				"/buckets/b/logs": {
+					{Name: "foo" + s3_constants.VersionsFolder, IsDirectory: true},
+				},
+				"/buckets/b/logs/foo" + s3_constants.VersionsFolder: {},
+			},
+			wantHasUser: false,
+		},
+		{
+			name: "nested uploads-named directories are internal",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "data", IsDirectory: true},
+				},
+				"/buckets/b/data": {
+					{Name: s3_constants.MultipartUploadsFolder, IsDirectory: true},
+				},
+				"/buckets/b/data/" + s3_constants.MultipartUploadsFolder: {
+					{Name: "part-1", IsDirectory: false},
+				},
+			},
+			wantHasUser: false,
+		},
+		{
+			name: "directory object with a reserved name counts",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "data", IsDirectory: true},
+				},
+				"/buckets/b/data": {
+					{Name: s3_constants.MultipartUploadsFolder, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: s3_constants.FolderMimeType}},
+				},
+			},
+			wantHasUser: true,
+		},
+		{
+			name: "file with a reserved name counts",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: "dir", IsDirectory: true},
+				},
+				"/buckets/b/dir": {
+					{Name: "data" + s3_constants.VersionsFolder, IsDirectory: false},
+				},
+			},
+			wantHasUser: true,
+		},
+		{
+			name: "file with backslash in name",
+			entriesByDir: map[string][]*filer_pb.Entry{
+				"/buckets/b": {
+					{Name: `a\b`, IsDirectory: false},
+				},
+			},
+			wantHasUser: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := &fakeBucketDeleteFiler{entriesByDir: tc.entriesByDir}
+			s3a := newBucketDeleteTestServer(t, f, false)
+
+			got, err := s3a.bucketHasUserObjects("b")
+			require.NoError(t, err)
+			assert.Equal(t, tc.wantHasUser, got)
+		})
+	}
+}
+
+func TestBucketHasUserObjects_DeepEmptyChain(t *testing.T) {
+	entriesByDir := map[string][]*filer_pb.Entry{
+		"/buckets/b": {{Name: "d0", IsDirectory: true}},
+	}
+	dir := "/buckets/b/d0"
+	for i := 1; i < 500; i++ {
+		child := fmt.Sprintf("d%d", i)
+		entriesByDir[dir] = []*filer_pb.Entry{{Name: child, IsDirectory: true}}
+		dir = dir + "/" + child
+	}
+	entriesByDir[dir] = []*filer_pb.Entry{}
+
+	f := &fakeBucketDeleteFiler{entriesByDir: entriesByDir}
+	s3a := newBucketDeleteTestServer(t, f, false)
+
+	got, err := s3a.bucketHasUserObjects("b")
+	require.NoError(t, err)
+	assert.False(t, got)
+}
+
+func TestDeleteBucketHandler_EmptyDirectoriesAllowedWhenNotEmptyFalse(t *testing.T) {
+	// A bucket that holds only an empty directory leftover from deleted objects
+	// must succeed when AllowDeleteBucketNotEmpty is false.
+	f := &fakeBucketDeleteFiler{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets": {
+				{Name: "repro-bucket", IsDirectory: true},
+			},
+			"/buckets/repro-bucket": {
+				{Name: "data", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+			},
+			"/buckets/repro-bucket/data": {},
+		},
+	}
+	s3a := newBucketDeleteTestServer(t, f, false)
+	s3a.bucketConfigCache.Set("repro-bucket", &BucketConfig{Name: "repro-bucket"})
+
+	req := httptest.NewRequest(http.MethodDelete, "/repro-bucket", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": "repro-bucket"})
+	rr := httptest.NewRecorder()
+
+	s3a.DeleteBucketHandler(rr, req)
+
+	assert.Equal(t, http.StatusNoContent, rr.Code, "deleting bucket with only empty directory must succeed: %s", rr.Body.String())
+	assert.NotNil(t, f.deleteReq)
+	assert.Equal(t, "/buckets", f.deleteReq.Directory)
+	assert.Equal(t, "repro-bucket", f.deleteReq.Name)
+	assert.True(t, f.deleteReq.IsRecursive)
+}
+
+func TestDeleteBucketHandler_RefusesBucketWithFilesWhenNotEmptyFalse(t *testing.T) {
+	f := &fakeBucketDeleteFiler{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets": {
+				{Name: "non-empty-bucket", IsDirectory: true},
+			},
+			"/buckets/non-empty-bucket": {
+				{Name: "data", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+			},
+			"/buckets/non-empty-bucket/data": {
+				{Name: "hello.txt", IsDirectory: false},
+			},
+		},
+	}
+	s3a := newBucketDeleteTestServer(t, f, false)
+	s3a.bucketConfigCache.Set("non-empty-bucket", &BucketConfig{Name: "non-empty-bucket"})
+
+	req := httptest.NewRequest(http.MethodDelete, "/non-empty-bucket", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": "non-empty-bucket"})
+	rr := httptest.NewRecorder()
+
+	s3a.DeleteBucketHandler(rr, req)
+
+	assert.Equal(t, http.StatusConflict, rr.Code)
+	assert.Contains(t, rr.Body.String(), "<Code>BucketNotEmpty</Code>")
+	assert.Nil(t, f.deleteReq, "delete request must not have been sent to filer")
+}
+
+func TestDeleteBucketHandler_RefusesBucketWithDirectoryObjectWhenNotEmptyFalse(t *testing.T) {
+	f := &fakeBucketDeleteFiler{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets": {
+				{Name: "dir-obj-bucket", IsDirectory: true},
+			},
+			"/buckets/dir-obj-bucket": {
+				{Name: "photos", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: "application/x-directory"}},
+			},
+			"/buckets/dir-obj-bucket/photos": {},
+		},
+	}
+	s3a := newBucketDeleteTestServer(t, f, false)
+	s3a.bucketConfigCache.Set("dir-obj-bucket", &BucketConfig{Name: "dir-obj-bucket"})
+
+	req := httptest.NewRequest(http.MethodDelete, "/dir-obj-bucket", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": "dir-obj-bucket"})
+	rr := httptest.NewRecorder()
+
+	s3a.DeleteBucketHandler(rr, req)
+
+	assert.Equal(t, http.StatusConflict, rr.Code)
+	assert.Contains(t, rr.Body.String(), "<Code>BucketNotEmpty</Code>")
+	assert.Nil(t, f.deleteReq, "delete request must not have been sent to filer")
+}
diff --git a/weed/s3api/s3api_bucket_handlers.go b/weed/s3api/s3api_bucket_handlers.go
index 2f4cae39dc..0f74211e65 100644
--- a/weed/s3api/s3api_bucket_handlers.go
+++ b/weed/s3api/s3api_bucket_handlers.go
@@ -8,7 +8,6 @@ import (
 	"encoding/xml"
 	"errors"
 	"fmt"
-	"io"
 	"net/http"
 	"net/url"
 	"sort"
@@ -35,6 +34,13 @@ import (
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
+// A bucket creation lists collections. The RPC carried no deadline, so a
+// transient failure anywhere down the chain -- gateway to filer, filer to
+// master, master to volume server -- held the S3 request open until the client
+// gave up on it. The budget is taken outside the filer failover walk, so it
+// covers the whole walk rather than granting each filer a fresh one.
+const collectionListTimeout = 15 * time.Second
+
 func (s3a *S3ApiServer) ListBucketsHandler(w http.ResponseWriter, r *http.Request) {
 
 	glog.V(3).Infof("ListBucketsHandler")
@@ -218,6 +224,15 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request)
 	// collect parameters
 	bucket, _ := s3_constants.GetBucketAndObject(r)
 
+	// Only bucket-level PUTs with a registered sub-resource route land in a
+	// dedicated handler; anything else that reaches here is an operation we do
+	// not implement, not a bare CreateBucket.
+	if subresource, found := unroutedSubresource(r, nil); found {
+		glog.V(1).Infof("unimplemented bucket PUT subresource ?%s", subresource)
+		s3err.WriteErrorResponse(w, r, s3err.ErrNotImplemented)
+		return
+	}
+
 	// validate the bucket name
 	err := s3bucket.VerifyS3BucketName(bucket)
 	if err != nil {
@@ -259,12 +274,12 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request)
 		s3err.WriteErrorResponse(w, r, s3err.ErrBucketAlreadyExists)
 		return
 	}
-	if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		if resp, err := client.CollectionList(context.Background(), &filer_pb.CollectionListRequest{
+	listCtx, cancelList := context.WithTimeout(r.Context(), collectionListTimeout)
+	if err := s3a.withFilerClient(listCtx, false, func(client filer_pb.SeaweedFilerClient) error {
+		if resp, err := client.CollectionList(listCtx, &filer_pb.CollectionListRequest{
 			IncludeEcVolumes:     true,
 			IncludeNormalVolumes: true,
 		}); err != nil {
-			glog.Errorf("list collection: %v", err)
 			return fmt.Errorf("list collections: %w", err)
 		} else {
 			for _, c := range resp.Collections {
@@ -276,9 +291,13 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request)
 		}
 		return nil
 	}); err != nil {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
-		return
+		// Advisory: the answer decides nothing below except whether to log that a
+		// leftover collection is being reused. s3a.exists is what decides whether
+		// the bucket already exists, so a listing that failed is no reason to
+		// refuse the creation.
+		glog.Warningf("PutBucketHandler: list collections for %s: %v", bucket, err)
 	}
+	cancelList()
 
 	// Bucket already exists: report whether the caller already owns it or the
 	// name is taken / the request conflicts.
@@ -311,7 +330,7 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request)
 	// This ensures Object Lock configuration is set in the same CreateEntry call,
 	// preventing race conditions where the bucket exists without Object Lock enabled
 	var bucketCrtime int64
-	if err := s3a.mkdir(s3a.option.BucketsPath, bucket, func(entry *filer_pb.Entry) {
+	if err := s3a.mkdirExclusive(s3a.option.BucketsPath, bucket, func(entry *filer_pb.Entry) {
 		bucketCrtime = entry.Attributes.Crtime
 
 		// Set bucket owner
@@ -354,6 +373,16 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request)
 		// return the appropriate already-exists error instead of InternalError.
 		if exist, checkErr := s3a.exists(s3a.option.BucketsPath, bucket, true); checkErr == nil && exist {
 			glog.V(3).Infof("PutBucketHandler: bucket %s was created concurrently", bucket)
+			// From the entry itself, not the bucket registry: the pre-check
+			// above has just cached this name as not found, so in the race this
+			// branch exists for the registry would still say "no table bucket".
+			if concurrentEntryIsForeign(s3a.getEntry(s3a.option.BucketsPath, bucket)) {
+				s3err.WriteErrorResponse(w, r, s3err.ErrBucketAlreadyExists)
+				return
+			}
+			if s3a.bucketConfigCache != nil {
+				s3a.bucketConfigCache.RemoveNegativeCache(bucket)
+			}
 			errCode := s3a.existingBucketError(r, bucket, currentIdentityId, requestHasACL)
 			if errCode == s3err.ErrBucketAlreadyOwnedByYou {
 				s3a.healBucketOwnerIndex(bucket, currentIdentityId)
@@ -370,7 +399,7 @@ func (s3a *S3ApiServer) PutBucketHandler(w http.ResponseWriter, r *http.Request)
 	// This ensures we don't leave a bucket without the requested Object Lock configuration
 	if objectLockSetupError != nil {
 		glog.Errorf("PutBucketHandler: rolling back bucket %s creation due to Object Lock setup failure: %v", bucket, objectLockSetupError)
-		if deleteErr := s3a.rm(s3a.option.BucketsPath, bucket, true, true); deleteErr != nil {
+		if deleteErr := s3a.rm(context.Background(), s3a.option.BucketsPath, bucket, true, true); deleteErr != nil {
 			glog.Errorf("PutBucketHandler: failed to rollback bucket %s after Object Lock setup failure: %v", bucket, deleteErr)
 		}
 		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
@@ -415,6 +444,17 @@ func (s3a *S3ApiServer) DeleteBucketHandler(w http.ResponseWriter, r *http.Reque
 	bucket, _ := s3_constants.GetBucketAndObject(r)
 	glog.V(3).Infof("DeleteBucketHandler %s", bucket)
 
+	// Same as PutBucketHandler: a query key no DELETE route claimed is an
+	// unimplemented subresource, not a bare DeleteBucket.
+	if subresource, found := unroutedSubresource(r, nil); found {
+		glog.V(1).Infof("unimplemented bucket DELETE subresource ?%s", subresource)
+		s3err.WriteErrorResponse(w, r, s3err.ErrNotImplemented)
+		return
+	}
+	// The teardown below retries, and a failover walk repeats it once per
+	// filer, so the backoff comes out of one allowance held here.
+	r = r.WithContext(withFilerRetryBudget(r.Context(), filerRetryRequestBudget))
+
 	if s3a.isTableBucket(bucket) {
 		s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
 		return
@@ -458,12 +498,9 @@ func (s3a *S3ApiServer) DeleteBucketHandler(w http.ResponseWriter, r *http.Reque
 		}
 	}
 
-	// Delete bucket directory first, then collection. This order ensures that if
-	// collection deletion fails, the bucket directory is already gone, preventing
-	// the "collection exists but bucket directory missing" inconsistency that blocks
-	// bucket recreation. An orphaned collection is harmless and will be cleaned up
-	// or reused when the bucket is recreated.
-	err := s3a.rm(s3a.option.BucketsPath, bucket, false, true)
+	// The filer resolves and drops the bucket's collection inside the delete;
+	// it keeps a shared one rather than risk another bucket's volumes.
+	err := s3a.rm(r.Context(), s3a.option.BucketsPath, bucket, false, true)
 	if err != nil {
 		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 		return
@@ -475,25 +512,6 @@ func (s3a *S3ApiServer) DeleteBucketHandler(w http.ResponseWriter, r *http.Reque
 		}
 	}
 
-	err = s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		deleteCollectionRequest := &filer_pb.DeleteCollectionRequest{
-			Collection: s3a.getCollectionName(bucket),
-		}
-
-		glog.V(1).Infof("delete collection: %v", deleteCollectionRequest)
-		if _, err := client.DeleteCollection(context.Background(), deleteCollectionRequest); err != nil {
-			return fmt.Errorf("delete collection %s: %v", bucket, err)
-		}
-
-		return nil
-	})
-
-	if err != nil {
-		// Log but don't fail — the bucket directory is already removed, so the bucket
-		// is effectively deleted. The orphaned collection will be cleaned up or reused.
-		glog.Errorf("DeleteBucketHandler: failed to delete collection for bucket %s: %v", bucket, err)
-	}
-
 	// Clean up bucket-related caches, locks, and metrics after successful deletion
 	s3a.invalidateBucketConfigCache(bucket)
 	stats_collect.DeleteBucketMetrics(bucket)
@@ -512,31 +530,58 @@ func (s3a *S3ApiServer) DeleteBucketHandler(w http.ResponseWriter, r *http.Reque
 	s3err.WriteEmptyResponse(w, r, http.StatusNoContent)
 }
 
-// bucketHasUserObjects checks whether a bucket contains any non-special entries.
-// Special entries (.uploads, *.versions) are internal to S3 and don't count as user objects.
+// bucketHasUserObjects checks whether a bucket contains any user objects.
+// Empty directories left behind by deleted objects and the .uploads staging
+// folder do not count as user objects; stored versions inside a <key>.versions
+// directory do.
 func (s3a *S3ApiServer) bucketHasUserObjects(bucket string) (bool, error) {
-	bucketPath := s3a.option.BucketsPath + "/" + bucket
-	startFrom := ""
-	// Start with a small batch — most non-empty buckets have a real object early.
-	// If we only find special entries, switch to larger batches to page through quickly.
-	limit := uint32(10)
-	for {
-		entries, isLast, err := s3a.list(bucketPath, "", startFrom, false, limit)
-		if err != nil {
-			return false, err
-		}
-		for _, entry := range entries {
-			if entry.Name != s3_constants.MultipartUploadsFolder &&
-				!strings.HasSuffix(entry.Name, s3_constants.VersionsFolder) {
-				return true, nil
+	return s3a.dirHasUserObjects(s3a.option.BucketsPath + "/" + bucket)
+}
+
+func (s3a *S3ApiServer) dirHasUserObjects(root string) (bool, error) {
+	dirs := []string{root}
+	for len(dirs) > 0 {
+		dir := dirs[len(dirs)-1]
+		dirs = dirs[:len(dirs)-1]
+		startFrom := ""
+		// Start with a small batch — most non-empty buckets have a real object
+		// early; switch to larger batches to page through quickly.
+		limit := uint32(10)
+		for {
+			entries, isLast, err := s3a.list(dir, "", startFrom, false, limit)
+			if err != nil {
+				if isFilerNotFound(err) {
+					break // the directory was deleted between listing and walking it
+				}
+				return false, err
 			}
-			startFrom = entry.Name
+			for _, entry := range entries {
+				startFrom = entry.Name
+				if entry.Name == "" || entry.Name == "." || entry.Name == ".." || strings.Contains(entry.Name, "/") {
+					continue
+				}
+				if !entry.IsDirectory {
+					return true, nil
+				}
+				// An explicit directory object counts even under a reserved name.
+				if entry.IsDirectoryKeyObject() {
+					return true, nil
+				}
+				// Multipart staging folders are invisible to object listing at
+				// every level, so they never count. A <key>.versions directory
+				// is descended into since it may still hold stored versions.
+				if entry.Name == s3_constants.MultipartUploadsFolder {
+					continue
+				}
+				dirs = append(dirs, dir+"/"+entry.Name)
+			}
+			if isLast || len(entries) == 0 {
+				break
+			}
+			limit = 1000
 		}
-		if isLast {
-			return false, nil
-		}
-		limit = 1000
 	}
+	return false, nil
 }
 
 // hasObjectsWithActiveLocks checks if any objects in the bucket have active retention or legal hold
@@ -561,8 +606,13 @@ func (s3a *S3ApiServer) HeadBucketHandler(w http.ResponseWriter, r *http.Request
 	bucket, _ := s3_constants.GetBucketAndObject(r)
 	glog.V(3).Infof("HeadBucketHandler %s", bucket)
 
-	if entry, err := s3a.getBucketEntry(bucket); entry == nil || errors.Is(err, filer_pb.ErrNotFound) {
-		s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+	if _, err := s3a.getBucketEntry(bucket); err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+			return
+		}
+		glog.Errorf("HeadBucketHandler: failed to get bucket entry for %s: %v", bucket, err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 		return
 	}
 
@@ -589,6 +639,9 @@ func (s3a *S3ApiServer) checkBucket(r *http.Request, bucket string) s3err.ErrorC
 // ErrAutoCreatePermissionDenied is returned when a user lacks permission to auto-create buckets
 var ErrAutoCreatePermissionDenied = errors.New("permission denied - requires Admin permission")
 
+// ErrAutoCreateDisabled is returned when bucket auto-creation is disabled by configuration
+var ErrAutoCreateDisabled = errors.New("bucket auto-creation is disabled")
+
 // ErrInvalidBucketName is returned when a bucket name doesn't meet S3 naming requirements
 var ErrInvalidBucketName = errors.New("invalid bucket name")
 
@@ -690,6 +743,10 @@ func (s3a *S3ApiServer) autoCreateBucket(r *http.Request, bucket string) error {
 		return fmt.Errorf("auto-create bucket %s: %w", bucket, errors.Join(ErrInvalidBucketName, err))
 	}
 
+	if !s3a.option.AutoCreateBucket {
+		return fmt.Errorf("auto-create bucket %s: %w", bucket, ErrAutoCreateDisabled)
+	}
+
 	// Check if user has admin permissions
 	if !s3a.isUserAdmin(r) {
 		return fmt.Errorf("auto-create bucket %s: %w", bucket, ErrAutoCreatePermissionDenied)
@@ -697,7 +754,7 @@ func (s3a *S3ApiServer) autoCreateBucket(r *http.Request, bucket string) error {
 
 	identityId := s3_constants.GetIdentityNameFromContext(r)
 	var bucketCrtime int64
-	if err := s3a.mkdir(s3a.option.BucketsPath, bucket, func(entry *filer_pb.Entry) {
+	if err := s3a.mkdirExclusive(s3a.option.BucketsPath, bucket, func(entry *filer_pb.Entry) {
 		bucketCrtime = entry.Attributes.Crtime
 		setBucketOwner(r)(entry)
 	}); err != nil {
@@ -707,26 +764,35 @@ func (s3a *S3ApiServer) autoCreateBucket(r *http.Request, bucket string) error {
 			glog.Warningf("autoCreateBucket: failed to check existence for bucket %s: %v", bucket, err2)
 			return fmt.Errorf("failed to auto-create bucket %s: %w", bucket, errors.Join(err, err2))
 		} else if exist {
+			entry, getErr := s3a.getEntry(s3a.option.BucketsPath, bucket)
+			if getErr != nil {
+				glog.Warningf("autoCreateBucket: failed to get entry for existing bucket %s: %v", bucket, getErr)
+				return fmt.Errorf("failed to auto-create bucket %s: %w", bucket, errors.Join(err, getErr))
+			}
+			if concurrentEntryIsForeign(entry, nil) {
+				// A table bucket carries no S3 owner and must not gain one —
+				// or a write intended for a missing plain bucket.
+				if s3a.bucketConfigCache != nil {
+					s3a.bucketConfigCache.RemoveNegativeCache(bucket)
+				}
+				return fmt.Errorf("auto-create bucket %s: name taken by a table bucket: %w", bucket, err)
+			}
 			// The bucket exists, which is fine. However, we should ensure it has an owner.
 			// If it was created by a concurrent request that didn't set an owner,
 			// we'll set it here to ensure consistency.
-			if entry, getErr := s3a.getEntry(s3a.option.BucketsPath, bucket); getErr == nil {
-				if entry.Extended == nil || len(entry.Extended[s3_constants.AmzIdentityId]) == 0 {
-					// No owner set, assign current admin as owner
-					setBucketOwner(r)(entry)
-					if updateErr := s3a.updateEntry(s3a.option.BucketsPath, entry); updateErr != nil {
-						glog.Warningf("autoCreateBucket: failed to set owner for existing bucket %s: %v", bucket, updateErr)
-					} else {
-						glog.V(1).Infof("Set owner for existing bucket %s (created by concurrent request)", bucket)
-						if owner := bucketEntryOwner(entry); owner != "" {
-							if indexErr := s3a.addBucketToOwnerIndex(owner, bucket, entry.Attributes.Crtime); indexErr != nil {
-								glog.Warningf("autoCreateBucket: owner index add %s/%s: %v", owner, bucket, indexErr)
-							}
+			if entry.Extended == nil || len(entry.Extended[s3_constants.AmzIdentityId]) == 0 {
+				// No owner set, assign current admin as owner
+				setBucketOwner(r)(entry)
+				if updateErr := s3a.updateEntry(s3a.option.BucketsPath, entry); updateErr != nil {
+					glog.Warningf("autoCreateBucket: failed to set owner for existing bucket %s: %v", bucket, updateErr)
+				} else {
+					glog.V(1).Infof("Set owner for existing bucket %s (created by concurrent request)", bucket)
+					if owner := bucketEntryOwner(entry); owner != "" {
+						if indexErr := s3a.addBucketToOwnerIndex(owner, bucket, entry.Attributes.Crtime); indexErr != nil {
+							glog.Warningf("autoCreateBucket: owner index add %s/%s: %v", owner, bucket, indexErr)
 						}
 					}
 				}
-			} else {
-				glog.Warningf("autoCreateBucket: failed to get entry for existing bucket %s: %v", bucket, getErr)
 			}
 			// Remove bucket from negative cache — it exists now
 			if s3a.bucketConfigCache != nil {
@@ -758,7 +824,9 @@ func (s3a *S3ApiServer) handleAutoCreateBucket(w http.ResponseWriter, r *http.Re
 	if err := s3a.autoCreateBucket(r, bucket); err != nil {
 		glog.Warningf("%s: %v", handlerName, err)
 		// Check for specific errors to return appropriate S3 error codes
-		if errors.Is(err, ErrInvalidBucketName) {
+		if errors.Is(err, ErrAutoCreateDisabled) {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+		} else if errors.Is(err, ErrInvalidBucketName) {
 			s3err.WriteErrorResponse(w, r, s3err.ErrInvalidBucketName)
 		} else if errors.Is(err, ErrAutoCreatePermissionDenied) {
 			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
@@ -846,6 +914,11 @@ func isPublicReadGrants(grants []*s3.Grant) bool {
 // buildResourceARN builds a resource ARN from bucket and object
 // Used by the policy engine wrapper
 func buildResourceARN(bucket, object string) string {
+	// An already-ARN resource (IAM management actions authorize against
+	// arn:aws:iam::...) passes through; no bucket name can contain ':'.
+	if strings.HasPrefix(bucket, "arn:") {
+		return bucket
+	}
 	if object == "" || object == "/" {
 		return fmt.Sprintf("arn:aws:s3:::%s", bucket)
 	}
@@ -854,27 +927,38 @@ func buildResourceARN(bucket, object string) string {
 	return fmt.Sprintf("arn:aws:s3:::%s/%s", bucket, object)
 }
 
-// AuthWithPublicRead creates an auth wrapper that allows anonymous access for public-read buckets
+// AuthWithPublicRead allows anonymous reads granted by bucket policies or ACLs,
+// deferring object ACL decisions until the GET/HEAD handler selects its entry.
 func (s3a *S3ApiServer) AuthWithPublicRead(handler http.HandlerFunc, action Action) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		bucket, object := s3_constants.GetBucketAndObject(r)
+		if objectRequest, deferred := s3a.deferAnonymousObjectRead(r, action, bucket, object); deferred {
+			handler(w, objectRequest)
+			return
+		}
 		authType := getRequestAuthType(r)
 		isAnonymous := authType == authTypeAnonymous
 
 		glog.V(4).Infof("AuthWithPublicRead: bucket=%s, object=%s, authType=%v, isAnonymous=%v", bucket, object, authType, isAnonymous)
 
-		// For anonymous requests, check if bucket allows public read via ACLs or bucket policies
+		// For anonymous requests, check if bucket allows public read via bucket policies or ACLs
 		if isAnonymous {
-			// First check ACL-based public access
+			// Loading the bucket config on a cache miss also refreshes the
+			// compiled policy, so a remotely deleted policy cannot leave a
+			// stale verdict in the engine.
 			isPublic := s3a.isBucketPublicRead(bucket)
 			glog.V(4).Infof("AuthWithPublicRead: bucket=%s, isPublicACL=%v", bucket, isPublic)
-			if isPublic {
+
+			// Object requests are re-evaluated inside Get/HeadObjectHandler
+			// once the entry is fetched, where tag conditions like
+			// s3:ExistingObjectTag/<key> can resolve correctly. Only
+			// bucket-level requests (List, HeadBucket) rely on this check alone.
+			if isPublic && object != "" {
 				glog.V(3).Infof("AuthWithPublicRead: allowing anonymous access to public-read bucket %s (ACL)", bucket)
 				handler(w, r)
 				return
 			}
 
-			// Check bucket policy for anonymous access using the policy engine
 			principal := "*" // Anonymous principal
 			// Evaluate bucket policy (objectEntry nil - not yet fetched)
 			allowed, evaluated, err := s3a.policyEngine.EvaluatePolicy(bucket, object, string(action), principal, r, nil, nil)
@@ -898,7 +982,13 @@ func (s3a *S3ApiServer) AuthWithPublicRead(handler http.HandlerFunc, action Acti
 					return
 				}
 			}
-			// No matching policy statement - fall through to check ACLs and then IAM auth
+
+			// No matching policy statement - fall back to the ACL grant
+			if isPublic {
+				glog.V(3).Infof("AuthWithPublicRead: allowing anonymous access to public-read bucket %s (ACL)", bucket)
+				handler(w, r)
+				return
+			}
 			glog.V(3).Infof("AuthWithPublicRead: no bucket policy match for %s, checking ACLs", bucket)
 		}
 
@@ -1083,12 +1173,10 @@ func (s3a *S3ApiServer) PutBucketLifecycleConfigurationHandler(w http.ResponseWr
 		return
 	}
 
-	r.Body = http.MaxBytesReader(w, r.Body, maxBucketLifecycleConfigurationSize)
-	lifecycleXML, err := io.ReadAll(r.Body)
+	lifecycleXML, err := readRequestBody(r, maxBucketLifecycleConfigurationSize)
 	if err != nil {
 		glog.Warningf("PutBucketLifecycleConfigurationHandler read body: %s", err)
-		var maxBytesErr *http.MaxBytesError
-		if errors.As(err, &maxBytesErr) {
+		if errors.Is(err, errRequestBodyTooLarge) {
 			s3err.WriteErrorResponse(w, r, s3err.ErrEntityTooLarge)
 			return
 		}
@@ -1123,36 +1211,25 @@ func (s3a *S3ApiServer) PutBucketLifecycleConfigurationHandler(w http.ResponseWr
 	// (volume server expires under the old rule) or contradict the new
 	// XML after a rule change. The add path is gone — this loop only
 	// shrinks the conf, never grows it.
-	fc, err := filer.ReadFilerConfFromFilers(s3a.option.Filers, s3a.option.GrpcDialOption, nil)
-	if err != nil {
-		glog.Errorf("PutBucketLifecycleConfigurationHandler read filer config: %s", err)
+	if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return filer.ClearBucketLifecycleDayTTLs(context.Background(), client, s3a.option.BucketsPath, bucket, s3a.getCollectionName(bucket))
+	}); err != nil {
+		glog.Errorf("PutBucketLifecycleConfigurationHandler clear legacy day-TTLs: %s", err)
 		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 		return
 	}
-	collectionTtls := fc.GetCollectionTtls(s3a.getCollectionName(bucket))
-	changed := false
-	bucketPrefix := fmt.Sprintf("%s/%s/", s3a.option.BucketsPath, bucket)
-	for prefix, ttl := range collectionTtls {
-		if !strings.HasPrefix(prefix, bucketPrefix) || !strings.HasSuffix(ttl, "d") {
-			continue
-		}
-		fc.DeleteLocationConf(prefix)
-		changed = true
-	}
 
-	if changed {
-		var buf bytes.Buffer
-		if err := fc.ToText(&buf); err != nil {
-			glog.Errorf("PutBucketLifecycleConfigurationHandler save config to text: %s", err)
-			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
-		}
-		if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-			return filer.SaveInsideFiler(context.Background(), client, filer.DirectoryEtcSeaweedFS, filer.FilerConfName, buf.Bytes())
-		}); err != nil {
-			glog.Errorf("PutBucketLifecycleConfigurationHandler save config inside filer: %s", err)
-			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
-			return
-		}
+	// The per-write TTL fast path stamps a volume TTL at write time that
+	// can't be taken back. If it's active on this bucket, warn when the new
+	// config removes or lengthens a rule: objects already written keep their
+	// baked-in TTL and won't be rescued by this change (unlike the default
+	// worker path, which re-evaluates the current rules each pass).
+	// Compute the reason before storing, but emit only after the store
+	// succeeds so a failed mutation never carries a warning for a change
+	// that was not applied.
+	var fastpathWarnReason string
+	if cfg, _ := s3a.getBucketConfig(bucket); cfg != nil && cfg.LifecycleTTL != nil {
+		fastpathWarnReason = fastpathConfigChangeLeavesStampedObjects(cfg.LifecycleXML, lifecycleXML)
 	}
 
 	if errCode := s3a.storeBucketLifecycleConfiguration(bucket, lifecycleXML, r.Header.Get(bucketLifecycleTransitionMinimumObjectSizeHeader)); errCode != s3err.ErrNone {
@@ -1160,6 +1237,11 @@ func (s3a *S3ApiServer) PutBucketLifecycleConfigurationHandler(w http.ResponseWr
 		return
 	}
 
+	if fastpathWarnReason != "" {
+		glog.Warningf("PutBucketLifecycleConfigurationHandler %s: %s", bucket, fastpathWarnReason)
+		w.Header().Set(fastpathWarningHeader, fastpathWarnReason)
+	}
+
 	writeSuccessResponseEmpty(w, r)
 }
 
@@ -1175,36 +1257,24 @@ func (s3a *S3ApiServer) DeleteBucketLifecycleHandler(w http.ResponseWriter, r *h
 		return
 	}
 
-	fc, err := filer.ReadFilerConfFromFilers(s3a.option.Filers, s3a.option.GrpcDialOption, nil)
-	if err != nil {
-		glog.Errorf("DeleteBucketLifecycleHandler read filer config: %s", err)
+	// Same legacy day-TTL migration as the PUT handler.
+	if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return filer.ClearBucketLifecycleDayTTLs(context.Background(), client, s3a.option.BucketsPath, bucket, s3a.getCollectionName(bucket))
+	}); err != nil {
+		glog.Errorf("DeleteBucketLifecycleHandler clear legacy day-TTLs: %s", err)
 		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 		return
 	}
-	collectionTtls := fc.GetCollectionTtls(s3a.getCollectionName(bucket))
-	changed := false
-	bucketPrefix := fmt.Sprintf("%s/%s/", s3a.option.BucketsPath, bucket)
-	for prefix, ttl := range collectionTtls {
-		if !strings.HasPrefix(prefix, bucketPrefix) || !strings.HasSuffix(ttl, "d") {
-			continue
-		}
-		fc.DeleteLocationConf(prefix)
-		changed = true
-	}
 
-	if changed {
-		var buf bytes.Buffer
-		if err := fc.ToText(&buf); err != nil {
-			glog.Errorf("DeleteBucketLifecycleHandler save config to text: %s", err)
-			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
-		}
-		if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-			return filer.SaveInsideFiler(context.Background(), client, filer.DirectoryEtcSeaweedFS, filer.FilerConfName, buf.Bytes())
-		}); err != nil {
-			glog.Errorf("DeleteBucketLifecycleHandler save config inside filer: %s", err)
-			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
-			return
-		}
+	// If the per-write TTL fast path is active, every previously-stamped
+	// object keeps its baked-in volume TTL after the config is removed —
+	// deleting the rules does not rescue them (unlike the default worker
+	// path). Compute the reason before clearing, but emit only after the
+	// clear succeeds so a failed mutation never carries a warning for a
+	// change that was not applied.
+	var fastpathWarnReason string
+	if cfg, _ := s3a.getBucketConfig(bucket); cfg != nil && cfg.LifecycleTTL != nil {
+		fastpathWarnReason = fastpathConfigChangeLeavesStampedObjects(cfg.LifecycleXML, nil)
 	}
 
 	if errCode := s3a.clearStoredBucketLifecycleConfiguration(bucket); errCode != s3err.ErrNone {
@@ -1212,6 +1282,11 @@ func (s3a *S3ApiServer) DeleteBucketLifecycleHandler(w http.ResponseWriter, r *h
 		return
 	}
 
+	if fastpathWarnReason != "" {
+		glog.Warningf("DeleteBucketLifecycleHandler %s: %s", bucket, fastpathWarnReason)
+		w.Header().Set(fastpathWarningHeader, fastpathWarnReason)
+	}
+
 	s3err.WriteEmptyResponse(w, r, http.StatusNoContent)
 }
 
@@ -1220,6 +1295,11 @@ func (s3a *S3ApiServer) DeleteBucketLifecycleHandler(w http.ResponseWriter, r *h
 func (s3a *S3ApiServer) GetBucketLocationHandler(w http.ResponseWriter, r *http.Request) {
 	bucket, _ := s3_constants.GetBucketAndObject(r)
 
+	if err := s3bucket.VerifyS3BucketName(bucket); err != nil {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidBucketName)
+		return
+	}
+
 	if err := s3a.checkBucket(r, bucket); err != s3err.ErrNone {
 		s3err.WriteErrorResponse(w, r, err)
 		return
diff --git a/weed/s3api/s3api_bucket_handlers_misc.go b/weed/s3api/s3api_bucket_handlers_misc.go
index 211c5c55b5..798257a8e1 100644
--- a/weed/s3api/s3api_bucket_handlers_misc.go
+++ b/weed/s3api/s3api_bucket_handlers_misc.go
@@ -3,8 +3,8 @@ package s3api
 import (
 	"encoding/xml"
 	"errors"
-	"io"
 	"net/http"
+	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
@@ -30,6 +30,10 @@ type bucketLoggingStatusResponse struct {
 	XMLName xml.Name `xml:"http://s3.amazonaws.com/doc/2006-03-01/ BucketLoggingStatus"`
 }
 
+type notificationConfigurationResponse struct {
+	XMLName xml.Name `xml:"http://s3.amazonaws.com/doc/2006-03-01/ NotificationConfiguration"`
+}
+
 // GetBucketPolicyStatusHandler reports whether the bucket policy grants public access.
 // https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketPolicyStatus.html
 func (s3a *S3ApiServer) GetBucketPolicyStatusHandler(w http.ResponseWriter, r *http.Request) {
@@ -87,9 +91,8 @@ func (s3a *S3ApiServer) PutBucketRequestPaymentHandler(w http.ResponseWriter, r
 		return
 	}
 
-	r.Body = http.MaxBytesReader(w, r.Body, putBucketRequestPaymentMaxBodyBytes)
 	defer r.Body.Close()
-	body, err := io.ReadAll(r.Body)
+	body, err := readRequestBody(r, putBucketRequestPaymentMaxBodyBytes)
 	if err != nil {
 		s3err.WriteErrorResponse(w, r, s3err.ErrMalformedXML)
 		return
@@ -130,3 +133,72 @@ func (s3a *S3ApiServer) GetBucketLoggingHandler(w http.ResponseWriter, r *http.R
 	}
 	writeSuccessResponseXML(w, r, bucketLoggingStatusResponse{})
 }
+
+// GetBucketNotificationConfigurationHandler returns an empty configuration; SeaweedFS
+// has no bucket event notifications, and AWS answers an unconfigured bucket the same way.
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketNotificationConfiguration.html
+func (s3a *S3ApiServer) GetBucketNotificationConfigurationHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	if err := s3a.checkBucket(r, bucket); err != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, err)
+		return
+	}
+	writeSuccessResponseXML(w, r, notificationConfigurationResponse{})
+}
+
+// GetBucketReplicationHandler reports that no replication configuration exists.
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketReplication.html
+func (s3a *S3ApiServer) GetBucketReplicationHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	if err := s3a.checkBucket(r, bucket); err != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, err)
+		return
+	}
+	s3err.WriteErrorResponse(w, r, s3err.ErrReplicationConfigurationNotFound)
+}
+
+// GetBucketWebsiteHandler reports that no website configuration exists.
+// https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetBucketWebsite.html
+func (s3a *S3ApiServer) GetBucketWebsiteHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	if err := s3a.checkBucket(r, bucket); err != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, err)
+		return
+	}
+	s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchWebsiteConfiguration)
+}
+
+// listObjectsQueryParams are the query keys a ListObjects/ListObjectsV2 request may
+// carry. x-id is stamped by the AWS SDKs and carries no meaning for the server; the
+// rest of the non-listing keys are what a presigned URL signs into the query string.
+var listObjectsQueryParams = map[string]bool{
+	"prefix": true, "delimiter": true, "marker": true, "max-keys": true,
+	"encoding-type": true, "list-type": true, "continuation-token": true,
+	"start-after": true, "fetch-owner": true, "expected-bucket-owner": true,
+	"allow-unordered": true, "x-id": true,
+	// SigV2 presigned URLs.
+	"AWSAccessKeyId": true, "Signature": true, "Expires": true,
+}
+
+// unroutedBucketSubresource names a query key on a bucket GET that no route claimed.
+// Everything SeaweedFS implements is matched by its own route before the ListObjects
+// catch-all, so anything left is a subresource it does not implement - and answering
+// it with a bucket listing is worse than saying so.
+func unroutedBucketSubresource(r *http.Request) (string, bool) {
+	return unroutedSubresource(r, listObjectsQueryParams)
+}
+
+// unroutedSubresource names a query key that no route claimed, outside the
+// request's own parameters, SigV2 presign keys, and SigV4 presign keys
+// (all "X-Amz-" prefixed).
+func unroutedSubresource(r *http.Request, allowed map[string]bool) (string, bool) {
+	for key := range r.URL.Query() {
+		switch {
+		case allowed[key], strings.HasPrefix(key, "X-Amz-"):
+		case key == "x-id", key == "AWSAccessKeyId", key == "Signature", key == "Expires":
+		default:
+			return key, true
+		}
+	}
+	return "", false
+}
diff --git a/weed/s3api/s3api_bucket_handlers_misc_test.go b/weed/s3api/s3api_bucket_handlers_misc_test.go
index b25d8720e4..b8d98fe265 100644
--- a/weed/s3api/s3api_bucket_handlers_misc_test.go
+++ b/weed/s3api/s3api_bucket_handlers_misc_test.go
@@ -2,6 +2,7 @@ package s3api
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -13,6 +14,7 @@ import (
 	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/require"
 )
 
 func newMiscTestServer(t *testing.T, bucket string) *S3ApiServer {
@@ -162,6 +164,11 @@ func TestGetBucketOwnershipControlsDefaultsToBucketOwnerEnforced(t *testing.T) {
 	})
 	req := newBucketRequest(http.MethodGet, "b", "ownershipControls=", "")
 	req.Header.Set(s3_constants.AmzAccountId, AccountAdmin.Id)
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), &Identity{
+		Name:    "admin",
+		Account: &AccountAdmin,
+		Actions: []Action{s3_constants.ACTION_ADMIN},
+	}))
 	rec := httptest.NewRecorder()
 
 	s3a.GetBucketOwnershipControls(rec, req)
@@ -221,3 +228,138 @@ func TestGetBucketLogging(t *testing.T) {
 		t.Fatalf("missing xmlns: %s", got)
 	}
 }
+
+func TestGetBucketLocationInvalidBucketName(t *testing.T) {
+	// AWS answers 400 InvalidBucketName for a malformed bucket name rather than
+	// the 404 NoSuchBucket an unknown-but-valid name gets.
+	s3a := &S3ApiServer{}
+	req := httptest.NewRequest(http.MethodGet, "/invalid%20bucket%20name?location=", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": "invalid bucket name"})
+	rec := httptest.NewRecorder()
+
+	s3a.GetBucketLocationHandler(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusBadRequest, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "InvalidBucketName") {
+		t.Fatalf("body = %s, want InvalidBucketName", rec.Body.String())
+	}
+}
+
+func TestHandleAutoCreateBucketDisabled(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{}}
+	req := newBucketRequest(http.MethodPut, "test-bucket", "", "")
+	rec := httptest.NewRecorder()
+
+	if s3a.handleAutoCreateBucket(rec, req, "test-bucket", "PutObjectHandler") {
+		t.Fatal("expected auto-create to be rejected")
+	}
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusNotFound)
+	}
+	if !strings.Contains(rec.Body.String(), "NoSuchBucket") {
+		t.Fatalf("body = %s, want NoSuchBucket", rec.Body.String())
+	}
+}
+
+func TestHandleAutoCreateBucketNonAdmin(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{AutoCreateBucket: true}}
+	req := newBucketRequest(http.MethodPut, "test-bucket", "", "")
+	rec := httptest.NewRecorder()
+
+	if s3a.handleAutoCreateBucket(rec, req, "test-bucket", "PutObjectHandler") {
+		t.Fatal("expected auto-create to be rejected")
+	}
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)
+	}
+}
+
+func TestUploadMissingBucketAutoCreateDisabled(t *testing.T) {
+	cases := []struct {
+		name    string
+		method  string
+		object  string
+		handler func(*S3ApiServer, http.ResponseWriter, *http.Request)
+	}{
+		{"put object", http.MethodPut, "/key", (*S3ApiServer).PutObjectHandler},
+		{"put directory marker", http.MethodPut, "/dir/", (*S3ApiServer).PutObjectHandler},
+		{"new multipart upload", http.MethodPost, "/key", (*S3ApiServer).NewMultipartUploadHandler},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s3a := &S3ApiServer{
+				option:            &S3ApiServerOption{},
+				iam:               &IdentityAccessManagement{},
+				bucketConfigCache: NewBucketConfigCache(time.Minute),
+			}
+			s3a.bucketConfigCache.SetNegativeCache("missing")
+			req := httptest.NewRequest(tc.method, "/missing"+tc.object, strings.NewReader(""))
+			req = mux.SetURLVars(req, map[string]string{"bucket": "missing", "object": tc.object})
+			rec := httptest.NewRecorder()
+
+			tc.handler(s3a, rec, req)
+
+			if rec.Code != http.StatusNotFound {
+				t.Fatalf("status = %d, want %d", rec.Code, http.StatusNotFound)
+			}
+			if !strings.Contains(rec.Body.String(), "NoSuchBucket") {
+				t.Fatalf("body = %s, want NoSuchBucket", rec.Body.String())
+			}
+		})
+	}
+}
+
+func TestAuthWithPublicReadHonorsPolicyDeny(t *testing.T) {
+	const bucket = "public-deny"
+	s3a := newMiscTestServer(t, bucket)
+	s3a.bucketConfigCache.Set(bucket, &BucketConfig{Name: bucket, IsPublicRead: true})
+	s3a.policyEngine = NewBucketPolicyEngine()
+
+	called := false
+	handler := s3a.AuthWithPublicRead(func(w http.ResponseWriter, r *http.Request) { called = true }, s3_constants.ACTION_LIST)
+	serve := func() *httptest.ResponseRecorder {
+		called = false
+		rr := httptest.NewRecorder()
+		handler(rr, newBucketRequest(http.MethodGet, bucket, "list-type=2", ""))
+		return rr
+	}
+	setPolicy := func(statements ...string) {
+		doc := `{"Version":"2012-10-17","Statement":[` + strings.Join(statements, ",") + `]}`
+		require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy(bucket, doc))
+	}
+	arn := fmt.Sprintf("arn:aws:s3:::%s", bucket)
+	denyList := fmt.Sprintf(`{"Effect":"Deny","Principal":"*","Action":"s3:ListBucket","Resource":"%s"}`, arn)
+	denyGet := fmt.Sprintf(`{"Effect":"Deny","Principal":"*","Action":"s3:GetObject","Resource":"%s/*"}`, arn)
+	allowList := fmt.Sprintf(`{"Effect":"Allow","Principal":"*","Action":"s3:ListBucket","Resource":"%s"}`, arn)
+
+	setPolicy(denyList)
+	rr := serve()
+	require.False(t, called, "anonymous ListObjectsV2 reached the handler despite an explicit ListBucket Deny")
+	require.Equal(t, http.StatusForbidden, rr.Code)
+
+	setPolicy(denyGet)
+	rr = serve()
+	require.True(t, called, "an unrelated Deny must not block the ACL public-read grant")
+
+	setPolicy(denyList, allowList)
+	rr = serve()
+	require.False(t, called, "explicit Deny must beat a matching Allow")
+
+	setPolicy(allowList)
+	rr = serve()
+	require.True(t, called, "explicit Allow must still permit anonymous listing")
+
+	// Object requests defer to the handler's phase-2 recheck, which evaluates
+	// tag conditions against the fetched entry — a tag-conditional Deny must
+	// not terminate them here on a missing value.
+	tagDeny := fmt.Sprintf(`{"Effect":"Deny","Principal":"*","Action":"s3:GetObject","Resource":"%s/*","Condition":{"StringNotEquals":{"s3:ExistingObjectTag/classification":"public"}}}`, arn)
+	setPolicy(tagDeny)
+	called = false
+	rr = httptest.NewRecorder()
+	objectReq := newBucketRequest(http.MethodGet, bucket, "", "")
+	objectReq = mux.SetURLVars(objectReq, map[string]string{"bucket": bucket, "object": "secret/x"})
+	s3a.AuthWithPublicRead(func(w http.ResponseWriter, r *http.Request) { called = true }, s3_constants.ACTION_READ)(rr, objectReq)
+	require.True(t, called, "anonymous object request on a public bucket must reach the handler's tag-aware recheck")
+}
diff --git a/weed/s3api/s3api_bucket_lifecycle_config.go b/weed/s3api/s3api_bucket_lifecycle_config.go
index 6b49f7419b..a38821c7d8 100644
--- a/weed/s3api/s3api_bucket_lifecycle_config.go
+++ b/weed/s3api/s3api_bucket_lifecycle_config.go
@@ -4,14 +4,18 @@ import (
 	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/scheduler"
 )
 
 const (
-	bucketLifecycleConfigurationXMLKey               = "s3-bucket-lifecycle-configuration-xml"
-	bucketLifecycleTransitionMinimumObjectSizeKey    = "s3-bucket-lifecycle-transition-default-minimum-object-size"
+	// The stored form is defined in the scheduler package, which callers
+	// outside the gateway also read; these are local shorthands for it.
+	bucketLifecycleConfigurationXMLKey            = scheduler.BucketLifecycleConfigurationXMLKey
+	bucketLifecycleTransitionMinimumObjectSizeKey = scheduler.BucketLifecycleTransitionMinimumObjectSizeKey
+	maxBucketLifecycleConfigurationSize           = scheduler.MaxBucketLifecycleConfigurationSize
+
 	bucketLifecycleTransitionMinimumObjectSizeHeader = "X-Amz-Transition-Default-Minimum-Object-Size"
 	defaultLifecycleTransitionMinimumObjectSize      = "all_storage_classes_128K"
-	maxBucketLifecycleConfigurationSize              = 1 << 20
 )
 
 func normalizeBucketLifecycleTransitionMinimumObjectSize(value string) string {
diff --git a/weed/s3api/s3api_bucket_lifecycle_fastpath_warn.go b/weed/s3api/s3api_bucket_lifecycle_fastpath_warn.go
new file mode 100644
index 0000000000..a62bc8d187
--- /dev/null
+++ b/weed/s3api/s3api_bucket_lifecycle_fastpath_warn.go
@@ -0,0 +1,161 @@
+package s3api
+
+import (
+	"fmt"
+	"math"
+	"sort"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/lifecycle_xml"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
+)
+
+// fastpathWarningHeader is set on Put/DeleteBucketLifecycle responses when
+// the bucket has the lifecycle TTL fast path enabled and the configuration
+// change leaves objects already written under the previous rules on their
+// baked-in volume TTL. A volume TTL is decided once, at write time, and
+// can't be taken back: removing or lengthening a rule does not retroactively
+// apply to objects already stamped, unlike the default worker-driven path
+// which re-evaluates the current rules each pass. The header lets an
+// operator notice (and act before the old deadline) that "extend retention
+// / remove the rule" did not protect already-recorded objects.
+const fastpathWarningHeader = "X-Seaweed-Lifecycle-Fastpath-Warning"
+
+// fastpathConfigChangeLeavesStampedObjects reports whether a lifecycle
+// configuration change from oldXML to newXML on a fastpath-enabled bucket
+// leaves previously-stamped objects on a volume TTL that no longer matches
+// the new policy. Returns a short human-readable reason when it does, and
+// an empty string when it does not.
+//
+// A change "leaves stamped objects" when, for any rule that was on the
+// fast path before (Enabled, ExpirationDays>0, no tag filter, fits int32
+// seconds — the same eligibility NewLifecycleTTLResolver applies):
+//
+//   - it is absent or Disabled in the new config (removed/disabled), or
+//   - its ExpirationDays increased (lengthened — old objects keep the
+//     shorter baked-in TTL), or
+//   - its prefix or size filter changed (objects that matched before may
+//     keep an expiry the new rule no longer describes).
+//
+// Rule identity is matched in two passes: first by ID, then by fast-path
+// predicates (prefix + size filters). An ID-only rename with unchanged
+// predicates and days is NOT a warning — the policy is equivalent, only
+// the label moved.
+//
+// Shortening a rule (e.g. 30d -> 7d) does NOT warn: old objects simply
+// expire later than the new shorter rule, which is not the data-loss
+// direction. Tag-filtered rules are never on the fast path, so their
+// removal/change does not warn here (the worker re-evaluates tags).
+//
+// newXML may be nil/empty, which represents DeleteBucketLifecycle: every
+// previously-eligible rule is removed.
+func fastpathConfigChangeLeavesStampedObjects(oldXML, newXML []byte) string {
+	oldRules := fastpathEligibleRules(oldXML)
+	if len(oldRules) == 0 {
+		return ""
+	}
+	newRules := fastpathEligibleRules(newXML)
+
+	// Match old rules to new rules in two passes so an ID-only rename
+	// (same prefix/size/days, different ID) does not produce a false
+	// "removed" warning:
+	//   1. Match by ID. A rule that kept its ID is the same rule; check
+	//      for filter or days changes.
+	//   2. For unmatched old rules, try matching by fast-path predicates
+	//      (prefix + size). A predicate match with different days means
+	//      the rule was renamed and possibly lengthened; same days means
+	//      a pure rename — no warning.
+	// Greedy: each new rule is consumed by at most one old rule so
+	// overlapping rules can't be double-matched.
+	used := make([]bool, len(newRules))
+	newByID := make(map[string]int, len(newRules))
+	for i, r := range newRules {
+		if r.ID != "" {
+			newByID[r.ID] = i
+		}
+	}
+
+	var reasons []string
+	for _, r := range oldRules {
+		// Pass 1: ID match.
+		if r.ID != "" {
+			if idx, ok := newByID[r.ID]; ok && !used[idx] {
+				used[idx] = true
+				nr := newRules[idx]
+				if nr.Prefix != r.Prefix || nr.FilterSizeGreaterThan != r.FilterSizeGreaterThan || nr.FilterSizeLessThan != r.FilterSizeLessThan {
+					reasons = append(reasons, fmt.Sprintf("rule %q filter changed", ruleName(r)))
+				} else if nr.ExpirationDays > r.ExpirationDays {
+					reasons = append(reasons, fmt.Sprintf("rule %q lengthened %d -> %d days", ruleName(r), r.ExpirationDays, nr.ExpirationDays))
+				}
+				continue
+			}
+		}
+		// Pass 2: predicate match (prefix + size filters).
+		matched := false
+		for i, nr := range newRules {
+			if used[i] {
+				continue
+			}
+			if nr.Prefix == r.Prefix && nr.FilterSizeGreaterThan == r.FilterSizeGreaterThan && nr.FilterSizeLessThan == r.FilterSizeLessThan {
+				used[i] = true
+				// Same coverage; only days can differ. An ID-only
+				// rename with unchanged days is not a warning.
+				if nr.ExpirationDays > r.ExpirationDays {
+					reasons = append(reasons, fmt.Sprintf("rule %q lengthened %d -> %d days", ruleName(r), r.ExpirationDays, nr.ExpirationDays))
+				}
+				matched = true
+				break
+			}
+		}
+		if !matched {
+			reasons = append(reasons, fmt.Sprintf("rule %q removed or disabled", ruleName(r)))
+		}
+	}
+	if len(reasons) == 0 {
+		return ""
+	}
+	sort.Strings(reasons)
+	return "fast path enabled; objects already written keep their baked-in volume TTL: " + strings.Join(reasons, "; ")
+}
+
+// fastpathEligibleRules parses lifecycle XML and returns the subset of
+// rules the per-write fast path would stamp: Enabled, ExpirationDays>0,
+// no tag filter, and ExpirationDays fits int32 seconds. Mirrors the
+// filter in NewLifecycleTTLResolver so the warning fires exactly for
+// rules that could have stamped objects. A nil/empty XML yields nil.
+func fastpathEligibleRules(xmlBytes []byte) []*s3lifecycle.Rule {
+	if len(xmlBytes) == 0 {
+		return nil
+	}
+	rules, err := lifecycle_xml.ParseCanonical(xmlBytes)
+	if err != nil {
+		return nil
+	}
+	out := make([]*s3lifecycle.Rule, 0, len(rules))
+	for _, r := range rules {
+		if r == nil || r.Status != s3lifecycle.StatusEnabled {
+			continue
+		}
+		if r.ExpirationDays <= 0 {
+			continue
+		}
+		if len(r.FilterTags) > 0 {
+			continue
+		}
+		if int64(r.ExpirationDays)*secondsPerDay > math.MaxInt32 {
+			continue
+		}
+		out = append(out, r)
+	}
+	return out
+}
+
+func ruleName(r *s3lifecycle.Rule) string {
+	if r.ID != "" {
+		return r.ID
+	}
+	if r.Prefix != "" {
+		return "prefix=" + r.Prefix
+	}
+	return "(whole-bucket)"
+}
diff --git a/weed/s3api/s3api_bucket_lifecycle_fastpath_warn_test.go b/weed/s3api/s3api_bucket_lifecycle_fastpath_warn_test.go
new file mode 100644
index 0000000000..3b9f7af21a
--- /dev/null
+++ b/weed/s3api/s3api_bucket_lifecycle_fastpath_warn_test.go
@@ -0,0 +1,187 @@
+package s3api
+
+import (
+	"strings"
+	"testing"
+)
+
+// lcXML builds a minimal lifecycle config XML with one Enabled
+// Expiration.Days rule. prefix may be "" for a whole-bucket rule.
+func lcXML(id, prefix string, days int) []byte {
+	var b strings.Builder
+	b.WriteString("<LifecycleConfiguration><Rule>")
+	if id != "" {
+		b.WriteString("<ID>" + id + "</ID>")
+	}
+	b.WriteString("<Status>Enabled</Status>")
+	if prefix != "" {
+		b.WriteString("<Filter><Prefix>" + prefix + "</Prefix></Filter>")
+	}
+	b.WriteString("<Expiration><Days>")
+	// days is small in tests; fmt-free int->string
+	b.WriteString(itoa(days))
+	b.WriteString("</Days></Expiration></Rule></LifecycleConfiguration>")
+	return []byte(b.String())
+}
+
+func itoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var buf [12]byte
+	i := len(buf)
+	neg := n < 0
+	if neg {
+		n = -n
+	}
+	for n > 0 {
+		i--
+		buf[i] = byte('0' + n%10)
+		n /= 10
+	}
+	if neg {
+		i--
+		buf[i] = '-'
+	}
+	return string(buf[i:])
+}
+
+func TestFastpathWarn_Lengthened(t *testing.T) {
+	old := lcXML("r1", "logs/", 7)
+	new := lcXML("r1", "logs/", 30)
+	got := fastpathConfigChangeLeavesStampedObjects(old, new)
+	if got == "" {
+		t.Fatalf("lengthen 7->30 must warn")
+	}
+	if !strings.Contains(got, "lengthened") || !strings.Contains(got, "7 -> 30") {
+		t.Fatalf("unexpected reason: %q", got)
+	}
+}
+
+func TestFastpathWarn_Shortened_NoWarn(t *testing.T) {
+	old := lcXML("r1", "logs/", 30)
+	new := lcXML("r1", "logs/", 7)
+	if got := fastpathConfigChangeLeavesStampedObjects(old, new); got != "" {
+		t.Fatalf("shorten 30->7 must not warn, got %q", got)
+	}
+}
+
+func TestFastpathWarn_Removed(t *testing.T) {
+	old := lcXML("r1", "logs/", 7)
+	// new config has a different rule; r1 is gone
+	new := lcXML("r2", "data/", 30)
+	got := fastpathConfigChangeLeavesStampedObjects(old, new)
+	if got == "" {
+		t.Fatalf("removing an eligible rule must warn")
+	}
+	if !strings.Contains(got, "removed or disabled") || !strings.Contains(got, "r1") {
+		t.Fatalf("unexpected reason: %q", got)
+	}
+}
+
+func TestFastpathWarn_Delete(t *testing.T) {
+	old := lcXML("r1", "logs/", 7)
+	got := fastpathConfigChangeLeavesStampedObjects(old, nil)
+	if got == "" {
+		t.Fatalf("delete with an eligible rule must warn")
+	}
+	if !strings.Contains(got, "removed or disabled") {
+		t.Fatalf("unexpected reason: %q", got)
+	}
+}
+
+func TestFastpathWarn_Unchanged_NoWarn(t *testing.T) {
+	old := lcXML("r1", "logs/", 7)
+	new := lcXML("r1", "logs/", 7)
+	if got := fastpathConfigChangeLeavesStampedObjects(old, new); got != "" {
+		t.Fatalf("identical config must not warn, got %q", got)
+	}
+}
+
+func TestFastpathWarn_NoOldRules_NoWarn(t *testing.T) {
+	// fastpath off path: old had no eligible rules -> no warning even on delete
+	if got := fastpathConfigChangeLeavesStampedObjects(nil, nil); got != "" {
+		t.Fatalf("no old rules must not warn, got %q", got)
+	}
+	new := lcXML("r1", "logs/", 7)
+	if got := fastpathConfigChangeLeavesStampedObjects(nil, new); got != "" {
+		t.Fatalf("adding a rule (no old eligible) must not warn, got %q", got)
+	}
+}
+
+func TestFastpathWarn_TagFilteredRule_NoWarn(t *testing.T) {
+	// Tag-filtered rules are never on the fast path; removing one must not warn.
+	old := []byte(`<LifecycleConfiguration><Rule><ID>rt</ID><Status>Enabled</Status>` +
+		`<Filter><Tag><Key>k</Key><Value>v</Value></Tag></Filter>` +
+		`<Expiration><Days>7</Days></Expiration></Rule></LifecycleConfiguration>`)
+	if got := fastpathConfigChangeLeavesStampedObjects(old, nil); got != "" {
+		t.Fatalf("tag-only rule removal must not warn, got %q", got)
+	}
+}
+
+func TestFastpathWarn_DisabledInNew_Warns(t *testing.T) {
+	old := lcXML("r1", "logs/", 7)
+	new := []byte(`<LifecycleConfiguration><Rule><ID>r1</ID><Status>Disabled</Status>` +
+		`<Filter><Prefix>logs/</Prefix></Filter>` +
+		`<Expiration><Days>7</Days></Expiration></Rule></LifecycleConfiguration>`)
+	got := fastpathConfigChangeLeavesStampedObjects(old, new)
+	if got == "" {
+		t.Fatalf("disabling an eligible rule must warn")
+	}
+}
+
+func TestFastpathWarn_PrefixChanged_Warns(t *testing.T) {
+	// Same ID, narrower prefix: old objects under "logs/" keep the old TTL
+	// but the new rule only covers "logs/2026/". Treated as removed for the
+	// old coverage -> warn.
+	old := lcXML("r1", "logs/", 7)
+	new := lcXML("r1", "logs/2026/", 7)
+	got := fastpathConfigChangeLeavesStampedObjects(old, new)
+	if got == "" {
+		t.Fatalf("prefix change must warn")
+	}
+}
+
+func TestFastpathWarn_OverflowDays_NoWarn(t *testing.T) {
+	// ~68 years overflows int32 seconds; such a rule is never on the fast
+	// path, so changing it must not warn.
+	big := []byte(`<LifecycleConfiguration><Rule><ID>rb</ID><Status>Enabled</Status>` +
+		`<Filter><Prefix>logs/</Prefix></Filter>` +
+		`<Expiration><Days>30000</Days></Expiration></Rule></LifecycleConfiguration>`)
+	if got := fastpathConfigChangeLeavesStampedObjects(big, nil); got != "" {
+		t.Fatalf("overflow rule must not warn, got %q", got)
+	}
+}
+
+func TestFastpathWarn_IDOnlyRename_NoWarn(t *testing.T) {
+	// Renaming a rule while keeping the same prefix, size filters, and
+	// days must not warn: the policy is unchanged, only the label moved.
+	old := lcXML("r1", "logs/", 7)
+	new := lcXML("r2", "logs/", 7)
+	if got := fastpathConfigChangeLeavesStampedObjects(old, new); got != "" {
+		t.Fatalf("ID-only rename must not warn, got %q", got)
+	}
+}
+
+func TestFastpathWarn_IDRenameAndLengthen_Warns(t *testing.T) {
+	// Renaming AND lengthening: the predicate match finds the successor
+	// and the days increase triggers a lengthened warning.
+	old := lcXML("r1", "logs/", 7)
+	new := lcXML("r2", "logs/", 30)
+	got := fastpathConfigChangeLeavesStampedObjects(old, new)
+	if got == "" {
+		t.Fatalf("rename + lengthen must warn")
+	}
+	if !strings.Contains(got, "lengthened") || !strings.Contains(got, "7 -> 30") {
+		t.Fatalf("unexpected reason: %q", got)
+	}
+}
+
+func TestFastpathWarn_IDRenameAndShorten_NoWarn(t *testing.T) {
+	// Renaming AND shortening: not the data-loss direction.
+	old := lcXML("r1", "logs/", 30)
+	new := lcXML("r2", "logs/", 7)
+	if got := fastpathConfigChangeLeavesStampedObjects(old, new); got != "" {
+		t.Fatalf("rename + shorten must not warn, got %q", got)
+	}
+}
diff --git a/weed/s3api/s3api_bucket_owner_index.go b/weed/s3api/s3api_bucket_owner_index.go
index 977aa39f40..a8ccd8ae31 100644
--- a/weed/s3api/s3api_bucket_owner_index.go
+++ b/weed/s3api/s3api_bucket_owner_index.go
@@ -1,6 +1,7 @@
 package s3api
 
 import (
+	"context"
 	"net/http"
 	"net/url"
 	"slices"
@@ -26,7 +27,7 @@ import (
 // indexes pre-existing buckets. The .complete marker is written once the
 // backfill has finished; until it exists readers keep scanning /buckets.
 const (
-	s3SystemFolder              = ".system"
+	s3SystemFolder              = s3_constants.SystemFolder
 	bucketOwnerIndexFolder      = "owners"
 	bucketOwnerIndexReadyMarker = ".complete"
 )
@@ -67,7 +68,7 @@ func (s3a *S3ApiServer) addBucketToOwnerIndex(owner, bucket string, crtime int64
 }
 
 func (s3a *S3ApiServer) removeBucketFromOwnerIndex(owner, bucket string) error {
-	return s3a.rm(s3a.bucketOwnerDir(owner), bucket, false, false)
+	return s3a.rm(context.Background(), s3a.bucketOwnerDir(owner), bucket, false, false)
 }
 
 // maintainBucketOwnerIndex applies a /buckets metadata event to the owner
diff --git a/weed/s3api/s3api_bucket_policy_engine.go b/weed/s3api/s3api_bucket_policy_engine.go
index 28e4b90e18..8552ccc3ab 100644
--- a/weed/s3api/s3api_bucket_policy_engine.go
+++ b/weed/s3api/s3api_bucket_policy_engine.go
@@ -145,7 +145,8 @@ func (bpe *BucketPolicyEngine) EvaluatePolicy(bucket, object, action, principal
 
 	// Extract conditions and claims from request if available
 	if r != nil {
-		args.Conditions = policy_engine.ExtractConditionValuesFromRequest(r)
+		args.OriginalGrantConditions = policy_engine.OriginalGrantConditionsFromRequest(r)
+		args.Conditions = bpe.engine.ExtractConditionValuesFromRequest(r)
 
 		// Extract principal-related variables (aws:username, etc.) from principal ARN
 		principalVars := policy_engine.ExtractPrincipalVariables(principal)
diff --git a/weed/s3api/s3api_bucket_policy_handlers.go b/weed/s3api/s3api_bucket_policy_handlers.go
index f8cdea1535..4842403a38 100644
--- a/weed/s3api/s3api_bucket_policy_handlers.go
+++ b/weed/s3api/s3api_bucket_policy_handlers.go
@@ -1,22 +1,26 @@
 package s3api
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
-	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 )
 
-// Bucket policy metadata key for storing policies in filer
+// Bucket policy metadata key for storing policies in filer.
+// Also consumed directly by weed/admin/dash for the admin UI's bucket
+// policy management, so keep it exported and don't change its value
+// without updating that package too.
 const BUCKET_POLICY_METADATA_KEY = "s3-bucket-policy"
 
 // Sentinel errors for bucket policy operations
@@ -73,7 +77,7 @@ func (s3a *S3ApiServer) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Re
 	glog.V(3).Infof("PutBucketPolicyHandler: bucket=%s", bucket)
 
 	// Read policy document from request body
-	body, err := io.ReadAll(r.Body)
+	body, err := io.ReadAll(io.LimitReader(r.Body, policy_engine.MaxBucketPolicySize+1))
 	if err != nil {
 		glog.Errorf("Failed to read bucket policy request body: %v", err)
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPolicyDocument)
@@ -81,6 +85,11 @@ func (s3a *S3ApiServer) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Re
 	}
 	defer r.Body.Close()
 
+	if len(body) > policy_engine.MaxBucketPolicySize {
+		s3err.WriteErrorResponse(w, r, s3err.ErrPolicyTooLarge)
+		return
+	}
+
 	// Parse and validate policy document
 	var policyDoc policy_engine.PolicyDocument
 	if err := json.Unmarshal(body, &policyDoc); err != nil {
@@ -97,7 +106,7 @@ func (s3a *S3ApiServer) PutBucketPolicyHandler(w http.ResponseWriter, r *http.Re
 	}
 
 	// Additional bucket policy specific validation
-	if err := s3a.validateBucketPolicy(&policyDoc, bucket); err != nil {
+	if err := policy_engine.ValidateBucketPolicy(&policyDoc, bucket); err != nil {
 		glog.Errorf("Bucket policy validation failed: %v", err)
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPolicyDocument)
 		return
@@ -293,113 +302,161 @@ func (s3a *S3ApiServer) deleteBucketPolicy(bucket string) error {
 	})
 }
 
-// validateBucketPolicy performs bucket-specific policy validation
-func (s3a *S3ApiServer) validateBucketPolicy(policyDoc *policy_engine.PolicyDocument, bucket string) error {
-	if policyDoc.Version != "2012-10-17" {
-		return fmt.Errorf("unsupported policy version: %s (must be 2012-10-17)", policyDoc.Version)
-	}
-
-	if len(policyDoc.Statement) == 0 {
-		return fmt.Errorf("policy document must contain at least one statement")
-	}
-
-	for i, statement := range policyDoc.Statement {
-		// Bucket policies must have Principal
-		if statement.Principal == nil {
-			return fmt.Errorf("statement %d: bucket policies must specify a Principal", i)
-		}
-
-		// Validate resources refer to this bucket
-		for _, resource := range statement.Resource.Strings() {
-			if !s3a.validateResourceForBucket(resource, bucket) {
-				return fmt.Errorf("statement %d: resource %s does not match bucket %s", i, resource, bucket)
-			}
-		}
-
-		// Validate NotResources refer to this bucket
-		if statement.NotResource != nil {
-			for _, notResource := range statement.NotResource.Strings() {
-				if !s3a.validateResourceForBucket(notResource, bucket) {
-					return fmt.Errorf("statement %d: NotResource %s does not match bucket %s", i, notResource, bucket)
-				}
-			}
-		}
-
-		// Validate actions are S3 actions
-		for _, action := range statement.Action.Strings() {
-			if !strings.HasPrefix(action, "s3:") {
-				return fmt.Errorf("statement %d: bucket policies only support S3 actions, got %s", i, action)
-			}
-		}
-	}
-
-	return nil
-}
-
-// validateResourceForBucket checks if a resource ARN is valid for the given bucket
-func (s3a *S3ApiServer) validateResourceForBucket(resource, bucket string) bool {
-	// Accepted formats for S3 bucket policies:
-	// AWS-style ARNs (standard):
-	//   arn:aws:s3:::bucket-name
-	//   arn:aws:s3:::bucket-name/*
-	//   arn:aws:s3:::bucket-name/path/to/object
-	// Simplified formats (for convenience):
-	//   bucket-name
-	//   bucket-name/*
-	//   bucket-name/path/to/object
-
-	var resourcePath string
-	const awsPrefix = "arn:aws:s3:::"
-
-	// Strip the optional ARN prefix to get the resource path
-	if path, ok := strings.CutPrefix(resource, awsPrefix); ok {
-		resourcePath = path
-	} else {
-		resourcePath = resource
-	}
-
-	// After stripping the optional ARN prefix, the resource path must
-	// either match the bucket name exactly, or be a path within the bucket.
-	return resourcePath == bucket ||
-		resourcePath == bucket+"/*" ||
-		strings.HasPrefix(resourcePath, bucket+"/")
-}
-
 // IAM integration functions
 
 // updateBucketPolicyInIAM updates the IAM system with the new bucket policy
 func (s3a *S3ApiServer) updateBucketPolicyInIAM(bucket string, policyDoc *policy_engine.PolicyDocument) error {
-	// Update IAM integration with new bucket policy
-	if s3a.iam.iamIntegration != nil {
-		// Type assert to access the concrete implementation which has access to iamManager
-		if s3Integration, ok := s3a.iam.iamIntegration.(*S3IAMIntegration); ok {
-			if s3Integration.iamManager != nil {
-				glog.V(2).Infof("Updated bucket policy for %s in IAM system", bucket)
-
-				policyJSON, err := json.Marshal(policyDoc)
-				if err != nil {
-					return fmt.Errorf("failed to marshal policy: %w", err)
-				}
-
-				return s3Integration.iamManager.UpdateBucketPolicy(context.Background(), bucket, policyJSON)
-			}
-		}
+	iamManager := s3a.bucketPolicyIAMManager()
+	if iamManager == nil {
+		return nil
 	}
 
-	return nil
+	policyJSON, err := json.Marshal(policyDoc)
+	if err != nil {
+		return fmt.Errorf("failed to marshal policy: %w", err)
+	}
+
+	glog.V(2).Infof("Updated bucket policy for %s in IAM system", bucket)
+	return iamManager.UpdateBucketPolicy(context.Background(), bucket, policyJSON)
+}
+
+// ensureBucketPolicyInIAM backfills the IAM mirror for a policy the
+// subscription never saw change (one that predates the IAM integration).
+// Called from the lazy bucket-config load; a present mirror is left alone.
+func (s3a *S3ApiServer) ensureBucketPolicyInIAM(bucket string, policyJSON []byte) {
+	iamManager := s3a.bucketPolicyIAMManager()
+	if iamManager == nil {
+		return
+	}
+
+	wrote, err := iamManager.EnsureBucketPolicy(context.Background(), bucket, policyJSON)
+	if err != nil {
+		glog.Warningf("backfill bucket policy for %s into IAM: %v", bucket, err)
+		return
+	}
+	if !wrote {
+		return
+	}
+
+	// The check-then-write above can race a concurrent policy change or
+	// delete: the event-driven mirror may have landed in between, and this
+	// write would then have re-stored bytes that are already stale - with
+	// no later event to heal it. Reconcile against a fresh entry read,
+	// which is authoritative; anything changing after this read fires its
+	// own event, and the mirror for it finds this write already present.
+	entry, err := s3a.getBucketEntry(bucket)
+	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			if err := s3a.removeBucketPolicyFromIAM(bucket); err != nil {
+				glog.Warningf("remove bucket policy for %s from IAM: %v", bucket, err)
+			}
+		}
+		return
+	}
+	current := entry.Extended[BUCKET_POLICY_METADATA_KEY]
+	if bytes.Equal(current, policyJSON) {
+		return
+	}
+	if len(current) == 0 {
+		if err := s3a.removeBucketPolicyFromIAM(bucket); err != nil {
+			glog.Warningf("remove bucket policy for %s from IAM: %v", bucket, err)
+		}
+		return
+	}
+	var policyDoc policy_engine.PolicyDocument
+	if err := json.Unmarshal(current, &policyDoc); err != nil {
+		glog.Warningf("backfill bucket policy for %s into IAM: parse: %v", bucket, err)
+		return
+	}
+	if err := s3a.updateBucketPolicyInIAM(bucket, &policyDoc); err != nil {
+		glog.Warningf("backfill bucket policy for %s into IAM: %v", bucket, err)
+	}
 }
 
 // removeBucketPolicyFromIAM removes the bucket policy from the IAM system
 func (s3a *S3ApiServer) removeBucketPolicyFromIAM(bucket string) error {
-	// This would remove the bucket policy from our advanced IAM system
+	iamManager := s3a.bucketPolicyIAMManager()
+	if iamManager == nil {
+		return nil
+	}
+
 	glog.V(2).Infof("Removed bucket policy for %s from IAM system", bucket)
+	return iamManager.RemoveBucketPolicy(context.Background(), bucket)
+}
 
-	// TODO: Integrate with IAM manager to remove resource-based policies
-	// s3a.iam.iamIntegration.iamManager.RemoveBucketPolicy(bucket)
-
+// bucketPolicyIAMManager returns the advanced-IAM manager the
+// "bucket-policy:<bucket>" mirror lives in, or nil when the integration is
+// not enabled.
+func (s3a *S3ApiServer) bucketPolicyIAMManager() *integration.IAMManager {
+	if s3a.iam == nil || s3a.iam.iamIntegration == nil {
+		return nil
+	}
+	if s3Integration, ok := s3a.iam.iamIntegration.(*S3IAMIntegration); ok {
+		return s3Integration.iamManager
+	}
 	return nil
 }
 
+// mirrorBucketPolicyToIAM keeps the "bucket-policy:<bucket>" IAM mirror in
+// sync with the policy stored on a bucket's filer entry. Driven from the
+// metadata subscription so it covers every writer - this gateway's own
+// PutBucketPolicy, another gateway's, the admin UI, bucket deletion, and
+// rename - where the handlers' direct calls only ever covered the first.
+func (s3a *S3ApiServer) mirrorBucketPolicyToIAM(oldEntry, newEntry *filer_pb.Entry) {
+	if s3a.bucketPolicyIAMManager() == nil {
+		return
+	}
+	removeName, updateName, updatePolicy := bucketPolicyMirrorOps(oldEntry, newEntry)
+	if removeName != "" {
+		if err := s3a.removeBucketPolicyFromIAM(removeName); err != nil {
+			glog.Warningf("remove bucket policy for %s from IAM: %v", removeName, err)
+		}
+	}
+	if updateName == "" {
+		return
+	}
+	var policyDoc policy_engine.PolicyDocument
+	if err := json.Unmarshal(updatePolicy, &policyDoc); err != nil {
+		glog.Warningf("mirror bucket policy for %s to IAM: parse: %v", updateName, err)
+		return
+	}
+	if err := s3a.updateBucketPolicyInIAM(updateName, &policyDoc); err != nil {
+		glog.Warningf("mirror bucket policy for %s to IAM: %v", updateName, err)
+	}
+}
+
+// bucketPolicyMirrorOps computes what a bucket entry change means for the
+// IAM mirror: a name whose mirror must be removed, and a (name, policy) to
+// write. A rename delivers both entries under different names in one event,
+// and the old name's mirror has to move even when the policy bytes are
+// unchanged - equality only short-circuits same-name updates.
+func bucketPolicyMirrorOps(oldEntry, newEntry *filer_pb.Entry) (removeName, updateName string, updatePolicy []byte) {
+	var oldName, newName string
+	var oldPolicy, newPolicy []byte
+	if oldEntry != nil {
+		oldName = oldEntry.Name
+		oldPolicy = oldEntry.Extended[BUCKET_POLICY_METADATA_KEY]
+	}
+	if newEntry != nil {
+		newName = newEntry.Name
+		newPolicy = newEntry.Extended[BUCKET_POLICY_METADATA_KEY]
+	}
+	if oldName != "" && oldName != newName && len(oldPolicy) > 0 {
+		removeName = oldName
+		oldPolicy = nil
+	}
+	if newName == "" || bytes.Equal(oldPolicy, newPolicy) {
+		return
+	}
+	if len(newPolicy) == 0 {
+		removeName = newName
+		return
+	}
+	updateName = newName
+	updatePolicy = newPolicy
+	return
+}
+
 // GetPublicAccessBlockHandler Retrieves the PublicAccessBlock configuration for an S3 bucket
 // https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetPublicAccessBlock.html
 func (s3a *S3ApiServer) GetPublicAccessBlockHandler(w http.ResponseWriter, r *http.Request) {
diff --git a/weed/s3api/s3api_bucket_policy_identity_deny_test.go b/weed/s3api/s3api_bucket_policy_identity_deny_test.go
new file mode 100644
index 0000000000..8ea9008fa0
--- /dev/null
+++ b/weed/s3api/s3api_bucket_policy_identity_deny_test.go
@@ -0,0 +1,213 @@
+package s3api
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Reproducer for GHSA-xxc3-72qf-3g5r: a bucket-policy Allow must not override an
+// applicable explicit Deny in an authenticated identity's attached policy.
+//
+// restricted-reader holds an attached IAM policy that allows GetObject on
+// allowed/*, explicitly denies GetObject on secret/*, and may install a bucket
+// policy. The bucket policy separately allows it GetObject on secret/* and
+// other/*. AWS evaluation lets a resource policy supply the Allow an identity
+// policy omits (other/*), but an explicit Deny must still win (secret/*).
+
+const (
+	bpdBucket       = "victim-bucket"
+	bpdAccessKey    = "LOCALDENYKEY00000001"
+	bpdSecretKey    = "local-deny-secret-for-loopback-only"
+	bpdPrincipal    = "arn:aws:iam::000000000000:user/restricted-reader"
+	bpdPolicyName   = "RestrictedRead"
+	bpdIdentityName = "restricted-reader"
+	bpdAccountID    = "000000000000"
+	bpdAccountName  = "restricted-reader"
+)
+
+const bpdIdentityPolicy = `{
+  "Version":"2012-10-17",
+  "Statement":[
+    {"Effect":"Allow","Action":"s3:PutBucketPolicy","Resource":"arn:aws:s3:::` + bpdBucket + `"},
+    {"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::` + bpdBucket + `/allowed/*"},
+    {"Effect":"Deny","Action":"s3:GetObject","Resource":"arn:aws:s3:::` + bpdBucket + `/secret/*"}
+  ]
+}`
+
+// bpdBucketPolicyDoc returns a bucket policy that allows restricted-reader
+// GetObject on the given prefixes. The secret/* statement is the bypass under
+// test; the other/* statement supplies an Allow over an implicit identity
+// denial, which the fix must preserve.
+func bpdBucketPolicyDoc(t *testing.T, prefixes ...string) string {
+	t.Helper()
+	stmts := ""
+	for i, p := range prefixes {
+		if i > 0 {
+			stmts += ","
+		}
+		stmts += fmt.Sprintf(
+			`{"Effect":"Allow","Principal":{"AWS":"%s"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::%s/%s"}`,
+			bpdPrincipal, bpdBucket, p)
+	}
+	return fmt.Sprintf(`{"Version":"2012-10-17","Statement":[%s]}`, stmts)
+}
+
+// newBucketPolicyDenyIAM builds an IAM whose restricted-reader identity carries
+// the attached RestrictedRead policy, plus a bucket policy engine that allows
+// the reader on the supplied prefixes.
+func newBucketPolicyDenyIAM(t *testing.T, bucketPolicy string) *IdentityAccessManagement {
+	t.Helper()
+	iam := &IdentityAccessManagement{
+		hashes:       make(map[string]*sync.Pool),
+		hashCounters: make(map[string]*int32),
+	}
+	err := iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Accounts: []*iam_pb.Account{
+			{Id: bpdAccountID, DisplayName: bpdAccountName},
+		},
+		Identities: []*iam_pb.Identity{
+			{
+				Name:    "admin",
+				Actions: []string{"Admin"},
+				Credentials: []*iam_pb.Credential{
+					{AccessKey: "LOCALADMINKEY0000001", SecretKey: "local-admin-secret-for-loopback-only"},
+				},
+			},
+			{
+				Name:        bpdIdentityName,
+				Account:     &iam_pb.Account{Id: bpdAccountID, DisplayName: bpdAccountName},
+				PolicyNames: []string{bpdPolicyName},
+				Credentials: []*iam_pb.Credential{
+					{AccessKey: bpdAccessKey, SecretKey: bpdSecretKey},
+				},
+			},
+		},
+		Policies: []*iam_pb.Policy{
+			{Name: bpdPolicyName, Content: bpdIdentityPolicy},
+		},
+	})
+	require.NoError(t, err)
+
+	engine := NewBucketPolicyEngine()
+	require.NoError(t, engine.engine.SetBucketPolicy(bpdBucket, bucketPolicy))
+	iam.policyEngine = engine
+	return iam
+}
+
+// bpdSignedRequest builds a SigV4-signed S3 request for the given key, signed
+// as the restricted-reader, with mux vars set so GetBucketAndObject resolves.
+func bpdSignedRequest(t *testing.T, method, objectKey string) *http.Request {
+	t.Helper()
+	urlStr := fmt.Sprintf("http://127.0.0.1:9000/%s/%s", bpdBucket, objectKey)
+	req := mustNewRequest(method, urlStr, 0, nil, t)
+	require.NoError(t, signRequestV4(req, bpdAccessKey, bpdSecretKey))
+	return mux.SetURLVars(req, map[string]string{"bucket": bpdBucket, "object": objectKey})
+}
+
+// bpdReader looks up the loaded restricted-reader identity.
+func bpdReader(t *testing.T, iam *IdentityAccessManagement) *Identity {
+	t.Helper()
+	ident := iam.lookupByIdentityName(bpdIdentityName)
+	require.NotNil(t, ident, "restricted-reader must be loaded")
+	return ident
+}
+
+// TestBucketPolicyAllowDoesNotOverrideIdentityExplicitDeny is the primary
+// reproducer: a bucket-policy Allow on secret/* must not let restricted-reader
+// read an object its attached policy explicitly denies.
+func TestBucketPolicyAllowDoesNotOverrideIdentityExplicitDeny(t *testing.T) {
+	iam := newBucketPolicyDenyIAM(t, bpdBucketPolicyDoc(t, "secret/*", "other/*"))
+
+	// Precondition: the bucket policy alone would allow the reader on secret/*.
+	req := bpdSignedRequest(t, http.MethodGet, "secret/payroll.txt")
+	allowed, evaluated, err := iam.policyEngine.EvaluatePolicy(
+		bpdBucket, "secret/payroll.txt", s3_constants.ACTION_READ, bpdPrincipal, req, nil, nil)
+	require.NoError(t, err)
+	require.True(t, evaluated && allowed, "bucket policy must allow the reader on secret/*")
+
+	_, errCode := iam.authRequest(req, s3_constants.ACTION_READ)
+	assert.Equal(t, s3err.ErrAccessDenied, errCode,
+		"a bucket-policy Allow must not override an explicit Deny in the identity policy")
+}
+
+// TestBucketPolicyAllowSuppliesImplicitIdentityDeny preserves the cross-account
+// behavior: a bucket-policy Allow on a prefix the identity policy does not
+// mention (other/*) must still grant access.
+func TestBucketPolicyAllowSuppliesImplicitIdentityDeny(t *testing.T) {
+	iam := newBucketPolicyDenyIAM(t, bpdBucketPolicyDoc(t, "secret/*", "other/*"))
+
+	_, errCode := iam.authRequest(bpdSignedRequest(t, http.MethodGet, "other/data.txt"), s3_constants.ACTION_READ)
+	assert.Equal(t, s3err.ErrNone, errCode,
+		"a bucket-policy Allow must supply the Allow an identity policy omits (implicit denial)")
+}
+
+// TestBucketPolicyAllowControlPathUnaffected checks the path the bucket policy
+// does not match: allowed/* falls through to the identity policy, which allows.
+func TestBucketPolicyAllowControlPathUnaffected(t *testing.T) {
+	iam := newBucketPolicyDenyIAM(t, bpdBucketPolicyDoc(t, "secret/*", "other/*"))
+
+	_, errCode := iam.authRequest(bpdSignedRequest(t, http.MethodGet, "allowed/report.txt"), s3_constants.ACTION_READ)
+	assert.Equal(t, s3err.ErrNone, errCode,
+		"a key the bucket policy does not match must fall through to the identity policy")
+}
+
+// TestAuthorizeObjectKeyActionBucketAllowDoesNotOverrideIdentityDeny covers the
+// secondary object-key authorization path (CopySource, DeleteObjects body
+// keys, POST Object form keys): the same bucket-Allow short-circuit must also
+// honor an applicable explicit identity Deny.
+func TestAuthorizeObjectKeyActionBucketAllowDoesNotOverrideIdentityDeny(t *testing.T) {
+	iam := newBucketPolicyDenyIAM(t, bpdBucketPolicyDoc(t, "secret/*", "other/*"))
+	reader := bpdReader(t, iam)
+	req := bpdSignedRequest(t, http.MethodGet, "secret/payroll.txt")
+
+	// CopySource reads the source key; the bucket policy allows it but the
+	// identity policy explicitly denies GetObject on secret/*.
+	assert.Equal(t, s3err.ErrAccessDenied,
+		iam.AuthorizeCopySource(req, reader, bpdBucket, "secret/payroll.txt", ""),
+		"AuthorizeCopySource must honor the identity explicit Deny despite a bucket-policy Allow")
+
+	// other/* has no identity statement, so the bucket Allow supplies access.
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeCopySource(req, reader, bpdBucket, "other/data.txt", ""),
+		"AuthorizeCopySource must preserve the bucket Allow over an implicit identity denial")
+}
+
+// A deferred tag-aware recheck (copy/rename source) re-runs only the bucket
+// policy; it must still honor an explicit Deny in the caller's attached or
+// session policies, or the phase-1 veto on secret/* could be bypassed.
+func TestRecheckPolicyForKeyWithLookupHonorsIdentityDeny(t *testing.T) {
+	filerImpl := &ambiguousPutFiler{
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/" + bpdBucket + "/secret/payroll.txt": {Name: "payroll.txt"},
+			"/buckets/" + bpdBucket + "/other/data.txt":     {Name: "data.txt"},
+		},
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	iam := newBucketPolicyDenyIAM(t, bpdBucketPolicyDoc(t, "secret/*", "other/*"))
+	s3a.iam = iam
+	s3a.policyEngine = iam.policyEngine
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set(bpdBucket, &BucketConfig{Name: bpdBucket})
+
+	req := httptest.NewRequest(http.MethodPut, "/victim-bucket/dst-key", nil)
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), bpdReader(t, iam)))
+
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.recheckPolicyForKeyWithLookup(req, http.MethodGet, bpdBucket, "secret/payroll.txt", "", s3_constants.ACTION_READ, "test"),
+		"an explicit identity-policy Deny must survive the bucket-policy recheck")
+	assert.Equal(t, s3err.ErrNone,
+		s3a.recheckPolicyForKeyWithLookup(req, http.MethodGet, bpdBucket, "other/data.txt", "", s3_constants.ACTION_READ, "test"),
+		"a bucket-policy Allow on a prefix the identity does not deny must still grant")
+}
diff --git a/weed/s3api/s3api_bucket_policy_mirror_test.go b/weed/s3api/s3api_bucket_policy_mirror_test.go
new file mode 100644
index 0000000000..b000e32779
--- /dev/null
+++ b/weed/s3api/s3api_bucket_policy_mirror_test.go
@@ -0,0 +1,114 @@
+package s3api
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+func bucketEntryWithPolicy(name, policy string) *filer_pb.Entry {
+	entry := &filer_pb.Entry{Name: name}
+	if policy != "" {
+		entry.Extended = map[string][]byte{BUCKET_POLICY_METADATA_KEY: []byte(policy)}
+	}
+	return entry
+}
+
+func TestBucketPolicyMirrorOps(t *testing.T) {
+	policyA := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow"}]}`
+	policyB := `{"Version":"2012-10-17","Statement":[{"Effect":"Deny"}]}`
+
+	tests := []struct {
+		name         string
+		oldEntry     *filer_pb.Entry
+		newEntry     *filer_pb.Entry
+		removeName   string
+		updateName   string
+		updatePolicy string
+	}{
+		{
+			name:     "create without policy",
+			newEntry: bucketEntryWithPolicy("a", ""),
+		},
+		{
+			name:         "policy set",
+			oldEntry:     bucketEntryWithPolicy("a", ""),
+			newEntry:     bucketEntryWithPolicy("a", policyA),
+			updateName:   "a",
+			updatePolicy: policyA,
+		},
+		{
+			name:         "policy replaced",
+			oldEntry:     bucketEntryWithPolicy("a", policyA),
+			newEntry:     bucketEntryWithPolicy("a", policyB),
+			updateName:   "a",
+			updatePolicy: policyB,
+		},
+		{
+			name:     "policy unchanged",
+			oldEntry: bucketEntryWithPolicy("a", policyA),
+			newEntry: bucketEntryWithPolicy("a", policyA),
+		},
+		{
+			name:       "policy removed",
+			oldEntry:   bucketEntryWithPolicy("a", policyA),
+			newEntry:   bucketEntryWithPolicy("a", ""),
+			removeName: "a",
+		},
+		{
+			name:       "bucket deleted",
+			oldEntry:   bucketEntryWithPolicy("a", policyA),
+			removeName: "a",
+		},
+		{
+			name:     "bucket deleted without policy",
+			oldEntry: bucketEntryWithPolicy("a", ""),
+		},
+		{
+			// The rename case: same policy bytes on both sides must still
+			// move the mirror to the new name.
+			name:         "renamed with unchanged policy",
+			oldEntry:     bucketEntryWithPolicy("a", policyA),
+			newEntry:     bucketEntryWithPolicy("b", policyA),
+			removeName:   "a",
+			updateName:   "b",
+			updatePolicy: policyA,
+		},
+		{
+			name:         "renamed with changed policy",
+			oldEntry:     bucketEntryWithPolicy("a", policyA),
+			newEntry:     bucketEntryWithPolicy("b", policyB),
+			removeName:   "a",
+			updateName:   "b",
+			updatePolicy: policyB,
+		},
+		{
+			name:       "renamed and policy dropped",
+			oldEntry:   bucketEntryWithPolicy("a", policyA),
+			newEntry:   bucketEntryWithPolicy("b", ""),
+			removeName: "a",
+		},
+		{
+			name:         "renamed without prior policy",
+			oldEntry:     bucketEntryWithPolicy("a", ""),
+			newEntry:     bucketEntryWithPolicy("b", policyA),
+			updateName:   "b",
+			updatePolicy: policyA,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			removeName, updateName, updatePolicy := bucketPolicyMirrorOps(tc.oldEntry, tc.newEntry)
+			if removeName != tc.removeName {
+				t.Errorf("removeName = %q, want %q", removeName, tc.removeName)
+			}
+			if updateName != tc.updateName {
+				t.Errorf("updateName = %q, want %q", updateName, tc.updateName)
+			}
+			if string(updatePolicy) != tc.updatePolicy {
+				t.Errorf("updatePolicy = %q, want %q", updatePolicy, tc.updatePolicy)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_bucket_quota_handlers.go b/weed/s3api/s3api_bucket_quota_handlers.go
new file mode 100644
index 0000000000..ba4be281ed
--- /dev/null
+++ b/weed/s3api/s3api_bucket_quota_handlers.go
@@ -0,0 +1,242 @@
+package s3api
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"net/http"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// putBucketQuotaMaxBodyBytes caps the request body to prevent DoS via large
+// payloads. The valid payload is a few hundred bytes.
+const putBucketQuotaMaxBodyBytes = 64 * 1024
+
+// bucketQuotaRequest is the JSON body for PUT /{bucket}?seaweedfs-quota.
+//
+// SeaweedFS stores quota on the bucket's filer entry:
+//   - positive value: quota enabled, enforced server-side
+//   - negative value: quota disabled but size retained
+//   - zero: no quota
+//
+// The quota_unit field accepts B, KB, MB, GB, TB (case-insensitive).
+// quota_size is the numeric size in the given unit.
+// quota_enabled false with a positive size stores a negative (disabled) quota.
+type bucketQuotaRequest struct {
+	QuotaSize    int64  `json:"quota_size"`
+	QuotaUnit    string `json:"quota_unit"`
+	QuotaEnabled bool   `json:"quota_enabled"`
+}
+
+// bucketQuotaResponse is the JSON body for GET /{bucket}?seaweedfs-quota.
+type bucketQuotaResponse struct {
+	QuotaSize    int64  `json:"quota_size"`
+	QuotaUnit    string `json:"quota_unit"`
+	QuotaEnabled bool   `json:"quota_enabled"`
+}
+
+// PutBucketQuotaHandler handles PUT /{bucket}?seaweedfs-quota.
+//
+// This is a SeaweedFS-specific S3 extension that allows setting a bucket's
+// storage quota through the S3 API, authenticated via SigV4 and authorized via
+// the s3:PutBucketQuota IAM permission. It avoids the need for a separate
+// admin API credential for integrations like Apache CloudStack.
+func (s3a *S3ApiServer) PutBucketQuotaHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("PutBucketQuotaHandler %s", bucket)
+
+	if bucket == "" {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidBucketName)
+		return
+	}
+
+	defer r.Body.Close()
+
+	body, err := readRequestBody(r, putBucketQuotaMaxBodyBytes)
+	if err != nil {
+		s3err.WriteErrorResponse(w, r, s3err.ErrMalformedXML)
+		return
+	}
+
+	var req bucketQuotaRequest
+	dec := json.NewDecoder(bytes.NewReader(body))
+	if err := dec.Decode(&req); err != nil {
+		s3err.WriteErrorResponse(w, r, s3err.ErrMalformedXML)
+		return
+	}
+	// Reject trailing data after the JSON object to prevent malformed payloads
+	// from being silently accepted.
+	if err := dec.Decode(&struct{}{}); err != io.EOF {
+		writeQuotaError(w, r, http.StatusBadRequest, "unexpected trailing data after JSON object")
+		return
+	}
+
+	if req.QuotaEnabled && req.QuotaSize <= 0 {
+		writeQuotaError(w, r, http.StatusBadRequest, "quota_size must be > 0 when quota_enabled is true")
+		return
+	}
+
+	normalizedUnit, err := normalizeQuotaUnit(req.QuotaUnit)
+	if err != nil {
+		writeQuotaError(w, r, http.StatusBadRequest, err.Error())
+		return
+	}
+	req.QuotaUnit = normalizedUnit
+
+	quotaBytes, err := convertQuotaToBytes(req.QuotaSize, normalizedUnit)
+	if err != nil {
+		writeQuotaError(w, r, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	var quota int64
+	switch {
+	case req.QuotaEnabled && quotaBytes > 0:
+		quota = quotaBytes
+	case !req.QuotaEnabled && quotaBytes > 0:
+		quota = -quotaBytes
+	default:
+		quota = 0
+	}
+
+	err = s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		lookupResp, err := client.LookupDirectoryEntry(r.Context(), &filer_pb.LookupDirectoryEntryRequest{
+			Directory: s3a.option.BucketsPath,
+			Name:      bucket,
+		})
+		if err != nil {
+			if errors.Is(err, filer_pb.ErrNotFound) {
+				return filer_pb.ErrNotFound
+			}
+			return fmt.Errorf("failed to look up bucket: %w", err)
+		}
+		bucketEntry := lookupResp.Entry
+		bucketEntry.Quota = quota
+
+		_, err = client.UpdateEntry(r.Context(), &filer_pb.UpdateEntryRequest{
+			Directory: s3a.option.BucketsPath,
+			Entry:     bucketEntry,
+		})
+		if err != nil {
+			return fmt.Errorf("failed to update bucket quota: %w", err)
+		}
+
+		if quota <= 0 {
+			if _, err := filer.ClearBucketReadOnly(r.Context(), client, s3a.option.BucketsPath, bucket); err != nil {
+				return fmt.Errorf("failed to clear bucket read-only flag: %w", err)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+			return
+		}
+		glog.Errorf("PutBucketQuotaHandler %s: %v", bucket, err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// GetBucketQuotaHandler handles GET /{bucket}?seaweedfs-quota.
+//
+// Returns the current quota configuration for the bucket as JSON.
+func (s3a *S3ApiServer) GetBucketQuotaHandler(w http.ResponseWriter, r *http.Request) {
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+	glog.V(3).Infof("GetBucketQuotaHandler %s", bucket)
+
+	if bucket == "" {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidBucketName)
+		return
+	}
+
+	entry, err := s3a.getBucketEntry(bucket)
+	if err != nil {
+		s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+		return
+	}
+
+	// Return the absolute quota magnitude as quota_size; the sign only
+	// encodes enabled/disabled state internally. This makes the response
+	// round-trippable: a client can send the same JSON back via PUT without
+	// the negative sentinel being interpreted as zero.
+	quotaSize := entry.Quota
+	if quotaSize < 0 {
+		quotaSize = -quotaSize
+	}
+	resp := bucketQuotaResponse{
+		QuotaSize:    quotaSize,
+		QuotaUnit:    "B",
+		QuotaEnabled: entry.Quota > 0,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(resp); err != nil {
+		glog.Errorf("GetBucketQuotaHandler %s: failed to encode response: %v", bucket, err)
+	}
+}
+
+// writeQuotaError writes a JSON error response for quota operations.
+func writeQuotaError(w http.ResponseWriter, r *http.Request, statusCode int, message string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+	if err := json.NewEncoder(w).Encode(map[string]string{"error": message}); err != nil {
+		glog.V(1).Infof("failed to write quota error response: %v", err)
+	}
+}
+
+// normalizeQuotaUnit normalizes the quota unit string to a canonical uppercase form.
+func normalizeQuotaUnit(unit string) (string, error) {
+	switch unit {
+	case "", "B", "b":
+		return "B", nil
+	case "KB", "kb":
+		return "KB", nil
+	case "MB", "mb":
+		return "MB", nil
+	case "GB", "gb":
+		return "GB", nil
+	case "TB", "tb":
+		return "TB", nil
+	default:
+		return "", fmt.Errorf("unsupported quota_unit %q (supported: B, KB, MB, GB, TB)", unit)
+	}
+}
+
+// convertQuotaToBytes converts a quota size + unit to bytes.
+// Returns an error if the result would overflow int64.
+func convertQuotaToBytes(size int64, unit string) (int64, error) {
+	if size <= 0 {
+		return 0, nil
+	}
+	var multiplier int64
+	switch unit {
+	case "TB":
+		multiplier = 1024 * 1024 * 1024 * 1024
+	case "GB":
+		multiplier = 1024 * 1024 * 1024
+	case "MB":
+		multiplier = 1024 * 1024
+	case "KB":
+		multiplier = 1024
+	case "B":
+		multiplier = 1
+	default:
+		return 0, fmt.Errorf("unsupported quota_unit %q", unit)
+	}
+	if multiplier > 0 && size > math.MaxInt64/multiplier {
+		return 0, fmt.Errorf("quota_size %d %s overflows maximum bytes (%d)", size, unit, int64(math.MaxInt64))
+	}
+	return size * multiplier, nil
+}
diff --git a/weed/s3api/s3api_bucket_quota_handlers_test.go b/weed/s3api/s3api_bucket_quota_handlers_test.go
new file mode 100644
index 0000000000..d15c540a55
--- /dev/null
+++ b/weed/s3api/s3api_bucket_quota_handlers_test.go
@@ -0,0 +1,156 @@
+package s3api
+
+import (
+	"math"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+)
+
+func TestNormalizeQuotaUnit(t *testing.T) {
+	tests := []struct {
+		input string
+		want  string
+		err   bool
+	}{
+		{"", "B", false},
+		{"B", "B", false},
+		{"b", "B", false},
+		{"KB", "KB", false},
+		{"kb", "KB", false},
+		{"MB", "MB", false},
+		{"mb", "MB", false},
+		{"GB", "GB", false},
+		{"gb", "GB", false},
+		{"TB", "TB", false},
+		{"tb", "TB", false},
+		{"PB", "", true},
+		{"invalid", "", true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.input, func(t *testing.T) {
+			got, err := normalizeQuotaUnit(tc.input)
+			if tc.err && err == nil {
+				t.Errorf("expected error for %q, got nil", tc.input)
+			}
+			if !tc.err && err != nil {
+				t.Errorf("unexpected error for %q: %v", tc.input, err)
+			}
+			if got != tc.want {
+				t.Errorf("normalizeQuotaUnit(%q) = %q, want %q", tc.input, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestConvertQuotaToBytes(t *testing.T) {
+	tests := []struct {
+		size    int64
+		unit    string
+		want    int64
+		wantErr bool
+	}{
+		{0, "B", 0, false},
+		{0, "GB", 0, false},
+		{1024, "B", 1024, false},
+		{1, "KB", 1024, false},
+		{1, "MB", 1024 * 1024, false},
+		{1, "GB", 1024 * 1024 * 1024, false},
+		{1, "TB", 1024 * 1024 * 1024 * 1024, false},
+		{2, "GB", 2 * 1024 * 1024 * 1024, false},
+		{-1, "GB", 0, false},
+		// Overflow: 8388608 TB = 2^23 * 2^40 = 2^63 which overflows int64
+		{8388608, "TB", 0, true},
+		// MaxInt64 KB overflows
+		{math.MaxInt64, "KB", 0, true},
+		// MaxInt64 B does not overflow
+		{math.MaxInt64, "B", math.MaxInt64, false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.unit, func(t *testing.T) {
+			got, err := convertQuotaToBytes(tc.size, tc.unit)
+			if tc.wantErr && err == nil {
+				t.Errorf("expected error for %d %s, got %d", tc.size, tc.unit, got)
+			}
+			if !tc.wantErr && err != nil {
+				t.Errorf("unexpected error for %d %s: %v", tc.size, tc.unit, err)
+			}
+			if got != tc.want {
+				t.Errorf("convertQuotaToBytes(%d, %q) = %d, want %d", tc.size, tc.unit, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestPutBucketQuotaHandler_InvalidBody(t *testing.T) {
+	s3a := &S3ApiServer{}
+	req := httptest.NewRequest(http.MethodPut, "/test-bucket?seaweedfs-quota", strings.NewReader("not json"))
+	req = mux.SetURLVars(req, map[string]string{"bucket": "test-bucket"})
+	rr := httptest.NewRecorder()
+	s3a.PutBucketQuotaHandler(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for malformed body, got %d", rr.Code)
+	}
+}
+
+func TestPutBucketQuotaHandler_TrailingData(t *testing.T) {
+	s3a := &S3ApiServer{}
+	body := `{"quota_size":100,"quota_unit":"GB","quota_enabled":true} garbage`
+	req := httptest.NewRequest(http.MethodPut, "/test-bucket?seaweedfs-quota", strings.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{"bucket": "test-bucket"})
+	rr := httptest.NewRecorder()
+	s3a.PutBucketQuotaHandler(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for trailing data, got %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestPutBucketQuotaHandler_EnabledWithZeroSize(t *testing.T) {
+	s3a := &S3ApiServer{}
+	body := `{"quota_size":0,"quota_unit":"GB","quota_enabled":true}`
+	req := httptest.NewRequest(http.MethodPut, "/test-bucket?seaweedfs-quota", strings.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{"bucket": "test-bucket"})
+	rr := httptest.NewRecorder()
+	s3a.PutBucketQuotaHandler(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for enabled quota with size=0, got %d", rr.Code)
+	}
+}
+
+func TestPutBucketQuotaHandler_InvalidUnit(t *testing.T) {
+	s3a := &S3ApiServer{}
+	body := `{"quota_size":100,"quota_unit":"PB","quota_enabled":true}`
+	req := httptest.NewRequest(http.MethodPut, "/test-bucket?seaweedfs-quota", strings.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{"bucket": "test-bucket"})
+	rr := httptest.NewRecorder()
+	s3a.PutBucketQuotaHandler(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for invalid unit, got %d", rr.Code)
+	}
+}
+
+func TestPutBucketQuotaHandler_NoBucket(t *testing.T) {
+	s3a := &S3ApiServer{}
+	body := `{"quota_size":100,"quota_unit":"GB","quota_enabled":true}`
+	req := httptest.NewRequest(http.MethodPut, "/?seaweedfs-quota", strings.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{"bucket": ""})
+	rr := httptest.NewRecorder()
+	s3a.PutBucketQuotaHandler(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for missing bucket, got %d", rr.Code)
+	}
+}
+
+func TestGetBucketQuotaHandler_NoBucket(t *testing.T) {
+	s3a := &S3ApiServer{}
+	req := httptest.NewRequest(http.MethodGet, "/?seaweedfs-quota", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": ""})
+	rr := httptest.NewRecorder()
+	s3a.GetBucketQuotaHandler(rr, req)
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for missing bucket, got %d", rr.Code)
+	}
+}
diff --git a/weed/s3api/s3api_bucket_subresource_routing_test.go b/weed/s3api/s3api_bucket_subresource_routing_test.go
new file mode 100644
index 0000000000..b82f863e17
--- /dev/null
+++ b/weed/s3api/s3api_bucket_subresource_routing_test.go
@@ -0,0 +1,39 @@
+package s3api
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// TestUnroutedBucketSubresource guards the rule that keeps a bucket GET carrying an
+// unimplemented subresource from being answered with a bucket listing: everything
+// SeaweedFS implements is matched by its own route before the ListObjects catch-all,
+// so anything left over that is not a listing parameter is a subresource.
+func TestUnroutedBucketSubresource(t *testing.T) {
+	for _, query := range []string{
+		"",
+		"prefix=a&max-keys=10",
+		"list-type=2&continuation-token=x",
+		"delimiter=/&encoding-type=url",
+		"x-id=ListObjectsV2",
+		// The listing handlers read allow-unordered and validate it against
+		// delimiter, so the guard has to let it through to them.
+		"allow-unordered=true",
+		"allow-unordered=true&max-keys=1000",
+		"list-type=2&allow-unordered=true",
+		"prefix=a&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Signature=deadbeef&X-Amz-Expires=900",
+		"AWSAccessKeyId=key&Signature=sig&Expires=1700000000",
+	} {
+		req, _ := http.NewRequest("GET", "http://localhost/bucket?"+query, nil)
+		name, found := unroutedBucketSubresource(req)
+		assert.False(t, found, "%q is a listing request, got %q", query, name)
+	}
+
+	for _, query := range []string{"torrent=", "replication=", "prefix=a&torrent="} {
+		req, _ := http.NewRequest("GET", "http://localhost/bucket?"+query, nil)
+		_, found := unroutedBucketSubresource(req)
+		assert.True(t, found, "%q should be reported as a subresource", query)
+	}
+}
diff --git a/weed/s3api/s3api_bucket_tagging_handlers.go b/weed/s3api/s3api_bucket_tagging_handlers.go
index a1b116fd28..9541f38cb1 100644
--- a/weed/s3api/s3api_bucket_tagging_handlers.go
+++ b/weed/s3api/s3api_bucket_tagging_handlers.go
@@ -68,9 +68,14 @@ func (s3a *S3ApiServer) PutBucketTaggingHandler(w http.ResponseWriter, r *http.R
 	}
 
 	tags := tagging.ToTags()
+	// A key may appear only once in a tag set; the map keeps one of them.
+	if len(tags) != len(tagging.TagSet.Tag) {
+		glog.Errorf("PutBucketTagging duplicate tag keys %s", r.URL)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidTag)
+		return
+	}
 
-	// Validate tags using existing validation
-	err = ValidateTags(tags)
+	err = ValidateBucketTags(tags)
 	if err != nil {
 		glog.Errorf("PutBucketTagging ValidateTags error %s: %v", r.URL, err)
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidTag)
diff --git a/weed/s3api/s3api_bucket_tagging_handlers_test.go b/weed/s3api/s3api_bucket_tagging_handlers_test.go
new file mode 100644
index 0000000000..a1cc26b165
--- /dev/null
+++ b/weed/s3api/s3api_bucket_tagging_handlers_test.go
@@ -0,0 +1,91 @@
+package s3api
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
+	"google.golang.org/protobuf/proto"
+)
+
+// A bucket's tag set holds up to 50 tags, unlike an object's 10, and no key
+// twice.
+func TestPutBucketTaggingTagCountLimit(t *testing.T) {
+	const bucket = "tag-limit-bucket"
+	for _, tc := range []struct {
+		tags      int
+		repeatKey bool // the last tag repeats the first tag's key
+		emptyKey  bool // the first tag has an empty key
+		wantCode  int
+	}{
+		{tags: 10, wantCode: http.StatusOK},
+		{tags: 11, wantCode: http.StatusOK},
+		{tags: 50, wantCode: http.StatusOK},
+		{tags: 51, wantCode: http.StatusBadRequest},
+		{tags: 2, repeatKey: true, wantCode: http.StatusBadRequest},
+		{tags: 51, repeatKey: true, wantCode: http.StatusBadRequest},
+		{tags: 1, emptyKey: true, wantCode: http.StatusBadRequest},
+	} {
+		name := fmt.Sprintf("%d tags", tc.tags)
+		if tc.repeatKey {
+			name += " with a repeated key"
+		}
+		if tc.emptyKey {
+			name += " with an empty key"
+		}
+		t.Run(name, func(t *testing.T) {
+			filer := &fakeTxnFiler{}
+			s3a := newHeadBucketTestServer(t, filer)
+			s3a.iam = &IdentityAccessManagement{isAuthEnabled: true}
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set(bucket, &BucketConfig{Name: bucket})
+
+			var body strings.Builder
+			body.WriteString("<Tagging><TagSet>")
+			for i := 0; i < tc.tags; i++ {
+				key := fmt.Sprintf("key%d", i)
+				if tc.repeatKey && i == tc.tags-1 {
+					key = "key0"
+				}
+				if tc.emptyKey && i == 0 {
+					key = ""
+				}
+				fmt.Fprintf(&body, "<Tag><Key>%s</Key><Value>value%d</Value></Tag>", key, i)
+			}
+			body.WriteString("</TagSet></Tagging>")
+
+			req := httptest.NewRequest(http.MethodPut, "/"+bucket+"?tagging", strings.NewReader(body.String()))
+			req = mux.SetURLVars(req, map[string]string{"bucket": bucket})
+			rr := httptest.NewRecorder()
+			s3a.PutBucketTaggingHandler(rr, req)
+
+			if rr.Code != tc.wantCode {
+				t.Fatalf("status = %d, want %d; body: %s", rr.Code, tc.wantCode, rr.Body.String())
+			}
+			if tc.wantCode != http.StatusOK {
+				if !strings.Contains(rr.Body.String(), "<Code>InvalidTag</Code>") {
+					t.Fatalf("body = %s, want InvalidTag", rr.Body.String())
+				}
+				if filer.lastReq != nil {
+					t.Fatalf("rejected tag set was written to the filer")
+				}
+				return
+			}
+			if filer.lastReq == nil || len(filer.lastReq.Mutations) != 1 {
+				t.Fatalf("expected one bucket metadata write, got %+v", filer.lastReq)
+			}
+			var stored s3_pb.BucketMetadata
+			if err := proto.Unmarshal(filer.lastReq.Mutations[0].Content, &stored); err != nil {
+				t.Fatalf("decode stored bucket metadata: %v", err)
+			}
+			if len(stored.Tags) != tc.tags {
+				t.Fatalf("stored %d tags, want %d", len(stored.Tags), tc.tags)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_chunk_manifest.go b/weed/s3api/s3api_chunk_manifest.go
index c25a36ca23..c60d39ed77 100644
--- a/weed/s3api/s3api_chunk_manifest.go
+++ b/weed/s3api/s3api_chunk_manifest.go
@@ -33,29 +33,13 @@ func (s3a *S3ApiServer) saveManifestChunk(filePath string, bucket string, ttlSec
 }
 
 // manifestizeChunks folds a large flat chunk list into manifest chunks. A
-// failed fold falls back to the flat list, deleting any blobs it saved.
+// failed fold falls back to the flat list, which is still a correct object.
 func (s3a *S3ApiServer) manifestizeChunks(filePath string, bucket string, ttlSec int32, chunks []*filer_pb.FileChunk) []*filer_pb.FileChunk {
-	return manifestizeOrKeepFlat(s3a.saveManifestChunk(filePath, bucket, ttlSec), s3a.deleteOrphanedChunks, filePath, chunks)
-}
-
-func manifestizeOrKeepFlat(save filer.SaveDataAsChunkFunctionType, deleteChunks func([]*filer_pb.FileChunk), filePath string, chunks []*filer_pb.FileChunk) []*filer_pb.FileChunk {
-	var saved []*filer_pb.FileChunk
-	record := func(reader io.Reader, name string, offset int64, tsNs int64, expectedDataSize uint64) (*filer_pb.FileChunk, error) {
-		chunk, err := save(reader, name, offset, tsNs, expectedDataSize)
-		if err == nil {
-			saved = append(saved, chunk)
-		}
-		return chunk, err
-	}
-	manifested, err := filer.MaybeManifestize(record, chunks)
+	folded, err := filer.MaybeManifestize(s3a.saveManifestChunk(filePath, bucket, ttlSec), s3a.deleteOrphanedChunks, chunks)
 	if err != nil {
 		glog.V(0).Infof("MaybeManifestize %s: %v", filePath, err)
-		if len(saved) > 0 {
-			deleteChunks(saved)
-		}
-		return chunks
 	}
-	return manifested
+	return folded
 }
 
 // flattenManifestChunks resolves manifest chunks into flat data chunks,
@@ -65,7 +49,7 @@ func (s3a *S3ApiServer) flattenManifestChunks(ctx context.Context, entry *filer_
 	if entry == nil || !filer.HasChunkManifest(entry.GetChunks()) {
 		return nil, nil
 	}
-	dataChunks, manifestChunks, err := filer.ResolveChunkManifest(ctx, s3a.createLookupFileIdFunction(), entry.GetChunks(), 0, math.MaxInt64)
+	dataChunks, manifestChunks, err := filer.ResolveChunkManifest(ctx, s3a.createLookupFileIdFunction(), entry.GetChunks(), 0, math.MaxInt64, s3a.filerClient)
 	if err != nil {
 		return nil, err
 	}
diff --git a/weed/s3api/s3api_chunk_manifest_test.go b/weed/s3api/s3api_chunk_manifest_test.go
index 8c3f373f54..6ce26f8f33 100644
--- a/weed/s3api/s3api_chunk_manifest_test.go
+++ b/weed/s3api/s3api_chunk_manifest_test.go
@@ -1,105 +1,212 @@
 package s3api
 
 import (
-	"fmt"
+	"bytes"
+	"context"
 	"io"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync/atomic"
 	"testing"
 
-	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"github.com/stretchr/testify/require"
 )
 
-func flatChunks(n int) []*filer_pb.FileChunk {
-	chunks := make([]*filer_pb.FileChunk, n)
-	for i := range chunks {
-		chunks[i] = &filer_pb.FileChunk{
-			FileId: fmt.Sprintf("1,%x", i+1),
-			Offset: int64(i) * 8,
-			Size:   8,
+type manifestVolumeFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	volumeServer string
+}
+
+func (f *manifestVolumeFiler) LookupVolume(_ context.Context, req *filer_pb.LookupVolumeRequest) (*filer_pb.LookupVolumeResponse, error) {
+	locations := make(map[string]*filer_pb.Locations, len(req.VolumeIds))
+	for _, volumeID := range req.VolumeIds {
+		locations[volumeID] = &filer_pb.Locations{Locations: []*filer_pb.Location{{Url: f.volumeServer}}}
+	}
+	return &filer_pb.LookupVolumeResponse{LocationsMap: locations}, nil
+}
+
+func TestDetectPrimarySSETypeFromManifestedEntry(t *testing.T) {
+	s3a := &S3ApiServer{}
+	manifest := &filer_pb.FileChunk{IsChunkManifest: true}
+	for _, test := range []struct {
+		name     string
+		extended map[string][]byte
+		want     string
+	}{
+		{
+			name: "SSE-C",
+			extended: map[string][]byte{
+				s3_constants.AmzServerSideEncryptionCustomerAlgorithm: []byte(s3_constants.SSEAlgorithmAES256),
+			},
+			want: s3_constants.SSETypeC,
+		},
+		{
+			name: "SSE-KMS",
+			extended: map[string][]byte{
+				s3_constants.AmzServerSideEncryption: []byte(s3_constants.SSEAlgorithmKMS),
+			},
+			want: s3_constants.SSETypeKMS,
+		},
+		{
+			name: "SSE-S3",
+			extended: map[string][]byte{
+				s3_constants.AmzServerSideEncryption: []byte(s3_constants.SSEAlgorithmAES256),
+			},
+			want: s3_constants.SSETypeS3,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			entry := &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{manifest}, Extended: test.extended}
+			require.Equal(t, test.want, s3a.detectPrimarySSEType(entry))
+		})
+	}
+}
+
+func TestSSECReadsResolveChunkManifests(t *testing.T) {
+	keyPair := GenerateTestSSECKey(9)
+	customerKey := &SSECustomerKey{Algorithm: s3_constants.SSEAlgorithmAES256, Key: keyPair.Key, KeyMD5: keyPair.KeyMD5}
+	parts := [][]byte{[]byte("first encrypted part"), []byte("second encrypted part")}
+	objects := make(map[string][]byte)
+	chunks := make([]*filer_pb.FileChunk, 0, len(parts))
+	var plaintext []byte
+	var firstIV []byte
+	var offset int64
+	for i, part := range parts {
+		encrypted, iv, err := CreateSSECEncryptedReader(bytes.NewReader(part), customerKey)
+		require.NoError(t, err)
+		ciphertext, err := io.ReadAll(encrypted)
+		require.NoError(t, err)
+		metadata, err := SerializeSSECMetadata(iv, keyPair.KeyMD5, 0)
+		require.NoError(t, err)
+
+		chunk := &filer_pb.FileChunk{
+			Fid:         &filer_pb.FileId{VolumeId: uint32(8 + i), FileKey: 1, Cookie: 1},
+			Offset:      offset,
+			Size:        uint64(len(part)),
+			SseType:     filer_pb.SSEType_SSE_C,
+			SseMetadata: metadata,
+		}
+		objects[chunk.GetFileIdString()] = ciphertext
+		chunks = append(chunks, chunk)
+		plaintext = append(plaintext, part...)
+		offset += int64(len(part))
+		if i == 0 {
+			firstIV = iv
 		}
 	}
-	return chunks
-}
 
-type fakeManifestStore struct {
-	saves   int
-	failOn  int // 1-based save call to fail on; 0 = never
-	deleted []*filer_pb.FileChunk
-}
-
-func (s *fakeManifestStore) save(reader io.Reader, name string, offset int64, tsNs int64, expectedDataSize uint64) (*filer_pb.FileChunk, error) {
-	s.saves++
-	if s.saves == s.failOn {
-		return nil, fmt.Errorf("save %d failed", s.saves)
+	manifests := make([]*filer_pb.FileChunk, 0, len(chunks))
+	for i, chunk := range chunks {
+		serializedChunks := []*filer_pb.FileChunk{proto.Clone(chunk).(*filer_pb.FileChunk)}
+		filer_pb.BeforeEntrySerialization(serializedChunks)
+		manifestData, err := proto.Marshal(&filer_pb.FileChunkManifest{Chunks: serializedChunks})
+		require.NoError(t, err)
+		manifest := &filer_pb.FileChunk{
+			Fid:             &filer_pb.FileId{VolumeId: uint32(17 + i), FileKey: 1, Cookie: 1},
+			Offset:          chunk.Offset,
+			Size:            chunk.Size,
+			IsChunkManifest: true,
+		}
+		objects[manifest.GetFileIdString()] = manifestData
+		manifests = append(manifests, manifest)
 	}
-	if _, err := io.Copy(io.Discard, reader); err != nil {
-		return nil, err
+
+	var failFirstManifest atomic.Bool
+	volumeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fileID := strings.TrimPrefix(r.URL.Path, "/")
+		data, found := objects[fileID]
+		if fileID == manifests[0].GetFileIdString() && failFirstManifest.Load() {
+			found = false
+		}
+		if !found {
+			http.NotFound(w, r)
+			return
+		}
+		_, _ = w.Write(data)
+	}))
+	t.Cleanup(volumeServer.Close)
+	filerAddress := startFakeFiler(t, &manifestVolumeFiler{volumeServer: strings.TrimPrefix(volumeServer.URL, "http://")})
+	filerClient := wdclient.NewFilerClient(
+		[]pb.ServerAddress{filerAddress},
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		"",
+	)
+	t.Cleanup(filerClient.Close)
+	s3a := &S3ApiServer{option: &S3ApiServerOption{}, filerClient: filerClient}
+
+	newEntry := func() *filer_pb.Entry {
+		entryManifests := make([]*filer_pb.FileChunk, len(manifests))
+		for i, manifest := range manifests {
+			entryManifests[i] = proto.Clone(manifest).(*filer_pb.FileChunk)
+		}
+		return &filer_pb.Entry{
+			Name:       "object",
+			Attributes: &filer_pb.FuseAttributes{FileSize: uint64(len(plaintext))},
+			Chunks:     entryManifests,
+			Extended: map[string][]byte{
+				s3_constants.AmzServerSideEncryptionCustomerAlgorithm: []byte(s3_constants.SSEAlgorithmAES256),
+				s3_constants.AmzServerSideEncryptionCustomerKeyMD5:    []byte(keyPair.KeyMD5),
+				s3_constants.SeaweedFSSSEIV:                           firstIV,
+			},
+		}
 	}
-	return &filer_pb.FileChunk{FileId: fmt.Sprintf("2,%x", s.saves), Offset: offset}, nil
-}
-
-func (s *fakeManifestStore) delete(chunks []*filer_pb.FileChunk) {
-	s.deleted = append(s.deleted, chunks...)
-}
-
-func TestManifestizeOrKeepFlatFolds(t *testing.T) {
-	store := &fakeManifestStore{}
-	chunks := flatChunks(filer.ManifestBatch + 50)
-
-	result := manifestizeOrKeepFlat(store.save, store.delete, "/buckets/b/o", chunks)
-
-	manifests, data := filer.SeparateManifestChunks(result)
-	if len(manifests) != 1 || len(data) != 50 {
-		t.Fatalf("expected 1 manifest + 50 flat chunks, got %d + %d", len(manifests), len(data))
+	newRequest := func() *http.Request {
+		r := httptest.NewRequest(http.MethodGet, "/bucket/object", nil)
+		SetupTestSSECHeaders(r, keyPair)
+		return r
 	}
-	if store.saves != 1 || len(store.deleted) != 0 {
-		t.Errorf("expected 1 save and no deletes, got %d saves, %d deleted", store.saves, len(store.deleted))
-	}
-	if manifests[0].Offset != 0 || manifests[0].Size != uint64(filer.ManifestBatch*8) {
-		t.Errorf("manifest span [%d,%d) wrong", manifests[0].Offset, manifests[0].Size)
-	}
-}
 
-func TestManifestizeOrKeepFlatBelowThreshold(t *testing.T) {
-	store := &fakeManifestStore{}
-	chunks := flatChunks(filer.ManifestBatch - 1)
+	t.Run("full object", func(t *testing.T) {
+		entry := newEntry()
+		sseType := s3a.detectPrimarySSEType(entry)
+		w := httptest.NewRecorder()
+		err := s3a.streamFromVolumeServersWithSSE(w, newRequest(), entry, sseType, "bucket", "object", "")
+		require.NoError(t, err)
+		require.Equal(t, plaintext, w.Body.Bytes())
+	})
 
-	result := manifestizeOrKeepFlat(store.save, store.delete, "/buckets/b/o", chunks)
+	t.Run("range", func(t *testing.T) {
+		failFirstManifest.Store(true)
+		entry := newEntry()
+		sseType := s3a.detectPrimarySSEType(entry)
+		r := newRequest()
+		start, end := len(parts[0])+2, len(parts[0])+8
+		r.Header.Set("Range", "bytes="+strconv.Itoa(start)+"-"+strconv.Itoa(end))
+		w := httptest.NewRecorder()
+		err := s3a.streamFromVolumeServersWithSSE(w, r, entry, sseType, "bucket", "object", "")
+		require.NoError(t, err)
+		require.Equal(t, plaintext[start:end+1], w.Body.Bytes())
+	})
 
-	if len(result) != len(chunks) || store.saves != 0 {
-		t.Fatalf("expected untouched flat list, got %d chunks, %d saves", len(result), store.saves)
-	}
-}
+	t.Run("invalid range", func(t *testing.T) {
+		entry := newEntry()
+		r := newRequest()
+		r.Header.Set("Range", "bytes="+strconv.Itoa(len(plaintext))+"-")
+		w := httptest.NewRecorder()
+		err := s3a.streamFromVolumeServersWithSSE(w, r, entry, s3a.detectPrimarySSEType(entry), "bucket", "object", "")
+		require.Error(t, err)
+		require.Equal(t, http.StatusRequestedRangeNotSatisfiable, w.Code)
+	})
 
-func TestManifestizeOrKeepFlatSkipsSse(t *testing.T) {
-	store := &fakeManifestStore{}
-	chunks := flatChunks(filer.ManifestBatch + 50)
-	chunks[0].SseType = filer_pb.SSEType_SSE_S3
-
-	result := manifestizeOrKeepFlat(store.save, store.delete, "/buckets/b/o", chunks)
-
-	if len(result) != len(chunks) || store.saves != 0 {
-		t.Fatalf("SSE chunks must not be folded, got %d chunks, %d saves", len(result), store.saves)
-	}
-}
-
-// A fold that fails midway must fall back to the flat list and delete the
-// manifest blobs its earlier batches already uploaded.
-func TestManifestizeOrKeepFlatRollsBackPartialFold(t *testing.T) {
-	store := &fakeManifestStore{failOn: 2}
-	chunks := flatChunks(2*filer.ManifestBatch + 50)
-
-	result := manifestizeOrKeepFlat(store.save, store.delete, "/buckets/b/o", chunks)
-
-	if len(result) != len(chunks) {
-		t.Fatalf("expected fallback to %d flat chunks, got %d", len(chunks), len(result))
-	}
-	if filer.HasChunkManifest(result) {
-		t.Error("fallback list must not contain manifest chunks")
-	}
-	if len(store.deleted) != 1 || store.deleted[0].FileId != "2,1" {
-		t.Fatalf("expected the first saved blob deleted, got %+v", store.deleted)
-	}
+	t.Run("wrong key", func(t *testing.T) {
+		entry := newEntry()
+		r := httptest.NewRequest(http.MethodGet, "/bucket/object", nil)
+		SetupTestSSECHeaders(r, GenerateTestSSECKey(10))
+		w := httptest.NewRecorder()
+		err := s3a.streamFromVolumeServersWithSSE(w, r, entry, s3a.detectPrimarySSEType(entry), "bucket", "object", "")
+		require.Error(t, err)
+		require.Equal(t, http.StatusForbidden, w.Code)
+	})
 }
 
 func TestPartRange(t *testing.T) {
@@ -109,19 +216,16 @@ func TestPartRange(t *testing.T) {
 		{FileId: "1,c", Offset: 16, Size: 24},
 	}
 
-	// Byte offsets win even when the chunk indexes no longer match the list.
 	start, end, ok := partRange(&PartBoundaryInfo{StartChunk: 40, EndChunk: 80, StartOffset: 16, EndOffset: 40}, chunks)
 	if !ok || start != 16 || end != 39 {
 		t.Errorf("offset boundary: got [%d,%d] ok=%v, want [16,39]", start, end, ok)
 	}
 
-	// Legacy record: range from chunk indexes.
 	start, end, ok = partRange(&PartBoundaryInfo{StartChunk: 1, EndChunk: 3}, chunks)
 	if !ok || start != 8 || end != 39 {
 		t.Errorf("legacy boundary: got [%d,%d] ok=%v, want [8,39]", start, end, ok)
 	}
 
-	// Legacy record with indexes off the list must report, not panic.
 	for _, b := range []*PartBoundaryInfo{
 		{StartChunk: 2, EndChunk: 9},
 		{StartChunk: -1, EndChunk: 2},
diff --git a/weed/s3api/s3api_copy_validation.go b/weed/s3api/s3api_copy_validation.go
index 9298787e07..eab3cf8d36 100644
--- a/weed/s3api/s3api_copy_validation.go
+++ b/weed/s3api/s3api_copy_validation.go
@@ -1,6 +1,7 @@
 package s3api
 
 import (
+	"errors"
 	"fmt"
 	"net/http"
 
@@ -115,6 +116,26 @@ func validateSSEKMSCopyRequirements(srcMetadata map[string][]byte, headers http.
 
 // validateEncryptionCompatibility validates that encryption methods are not conflicting
 func validateEncryptionCompatibility(headers http.Header) error {
+	// A repeated header is rejected rather than deduped: the encryption paths
+	// apply only the first value, so extra values could hide the method the
+	// client actually asked for.
+	for _, name := range []string{
+		s3_constants.AmzServerSideEncryption,
+		s3_constants.AmzServerSideEncryptionCustomerAlgorithm,
+		s3_constants.AmzServerSideEncryptionCustomerKey,
+		s3_constants.AmzServerSideEncryptionCustomerKeyMD5,
+		s3_constants.AmzServerSideEncryptionAwsKmsKeyId,
+		s3_constants.AmzServerSideEncryptionContext,
+		s3_constants.AmzServerSideEncryptionBucketKeyEnabled,
+	} {
+		if len(headers.Values(name)) > 1 {
+			return &CopyValidationError{
+				Code:    s3err.ErrInvalidRequest,
+				Message: fmt.Sprintf("Multiple %s headers specified - only one is allowed", name),
+			}
+		}
+	}
+
 	sseAlgorithm := headers.Get(s3_constants.AmzServerSideEncryption)
 	hasSSEC := hasSSECHeaders(headers)
 	hasSSEKMS := sseAlgorithm == s3_constants.SSEAlgorithmKMS
@@ -129,19 +150,25 @@ func validateEncryptionCompatibility(headers http.Header) error {
 		}
 	}
 
-	// Count how many encryption methods are specified
-	encryptionCount := 0
-	if hasSSEC {
-		encryptionCount++
-	}
-	if hasSSEKMS {
-		encryptionCount++
-	}
-	if hasSSES3 {
-		encryptionCount++
+	// KMS options only apply to aws:kms; with another method or none they name
+	// no method at all.
+	if !hasSSEKMS && hasHeaderValue(headers,
+		s3_constants.AmzServerSideEncryptionAwsKmsKeyId,
+		s3_constants.AmzServerSideEncryptionContext,
+		s3_constants.AmzServerSideEncryptionBucketKeyEnabled) {
+		return &CopyValidationError{
+			Code:    s3err.ErrInvalidRequest,
+			Message: "KMS encryption options require the aws:kms encryption method",
+		}
 	}
 
 	// Only one encryption method should be specified
+	encryptionCount := 0
+	for _, specified := range []bool{hasSSEC, hasSSEKMS, hasSSES3} {
+		if specified {
+			encryptionCount++
+		}
+	}
 	if encryptionCount > 1 {
 		return &CopyValidationError{
 			Code:    s3err.ErrInvalidRequest,
@@ -152,6 +179,21 @@ func validateEncryptionCompatibility(headers http.Header) error {
 	return nil
 }
 
+// ValidateRequestEncryption rejects PutObject or CreateMultipartUpload
+// encryption headers that no single method can honor, with the InvalidArgument
+// codes S3 returns for them.
+func ValidateRequestEncryption(headers http.Header) s3err.ErrorCode {
+	err := validateEncryptionCompatibility(headers)
+	if err == nil {
+		return s3err.ErrNone
+	}
+	var validationErr *CopyValidationError
+	if errors.As(err, &validationErr) && validationErr.Code == s3err.ErrInvalidEncryptionAlgorithm {
+		return s3err.ErrInvalidEncryptionMethod
+	}
+	return s3err.ErrIncompatibleEncryptionMethod
+}
+
 // validateSSECCopyHeaderCompleteness validates that all required SSE-C copy headers are present
 func validateSSECCopyHeaderCompleteness(headers http.Header) error {
 	algorithm := headers.Get(s3_constants.AmzCopySourceServerSideEncryptionCustomerAlgorithm)
@@ -229,16 +271,29 @@ func validateSSECHeaderCompleteness(headers http.Header) error {
 }
 
 // Helper functions for header detection
+func hasHeaderValue(headers http.Header, names ...string) bool {
+	for _, name := range names {
+		for _, value := range headers.Values(name) {
+			if value != "" {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 func hasSSECCopyHeaders(headers http.Header) bool {
-	return headers.Get(s3_constants.AmzCopySourceServerSideEncryptionCustomerAlgorithm) != "" ||
-		headers.Get(s3_constants.AmzCopySourceServerSideEncryptionCustomerKey) != "" ||
-		headers.Get(s3_constants.AmzCopySourceServerSideEncryptionCustomerKeyMD5) != ""
+	return hasHeaderValue(headers,
+		s3_constants.AmzCopySourceServerSideEncryptionCustomerAlgorithm,
+		s3_constants.AmzCopySourceServerSideEncryptionCustomerKey,
+		s3_constants.AmzCopySourceServerSideEncryptionCustomerKeyMD5)
 }
 
 func hasSSECHeaders(headers http.Header) bool {
-	return headers.Get(s3_constants.AmzServerSideEncryptionCustomerAlgorithm) != "" ||
-		headers.Get(s3_constants.AmzServerSideEncryptionCustomerKey) != "" ||
-		headers.Get(s3_constants.AmzServerSideEncryptionCustomerKeyMD5) != ""
+	return hasHeaderValue(headers,
+		s3_constants.AmzServerSideEncryptionCustomerAlgorithm,
+		s3_constants.AmzServerSideEncryptionCustomerKey,
+		s3_constants.AmzServerSideEncryptionCustomerKeyMD5)
 }
 
 // validateEncryptionContext validates the encryption context header format
diff --git a/weed/s3api/s3api_copy_validation_test.go b/weed/s3api/s3api_copy_validation_test.go
new file mode 100644
index 0000000000..00edd60101
--- /dev/null
+++ b/weed/s3api/s3api_copy_validation_test.go
@@ -0,0 +1,107 @@
+package s3api
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+)
+
+// TestValidateRequestEncryption verifies that a PutObject or
+// CreateMultipartUpload request asking for an encryption method that cannot be
+// honored is rejected instead of being stored unencrypted
+func TestValidateRequestEncryption(t *testing.T) {
+	ssec := map[string]string{
+		s3_constants.AmzServerSideEncryptionCustomerAlgorithm: "AES256",
+		s3_constants.AmzServerSideEncryptionCustomerKey:       "a2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2s=",
+		s3_constants.AmzServerSideEncryptionCustomerKeyMD5:    "f6OQvGsmFBq4WOqaVcuO5w==",
+	}
+	testCases := []struct {
+		name      string
+		headers   map[string]string
+		sse       string
+		sseValues []string
+		dup       string
+		want      s3err.ErrorCode
+	}{
+		{name: "no encryption", want: s3err.ErrNone},
+		{name: "SSE-S3", sse: s3_constants.SSEAlgorithmAES256, want: s3err.ErrNone},
+		{name: "SSE-KMS", sse: s3_constants.SSEAlgorithmKMS, want: s3err.ErrNone},
+		{name: "SSE-C", headers: ssec, want: s3err.ErrNone},
+		{name: "unknown algorithm", sse: "aes:kms", want: s3err.ErrInvalidEncryptionMethod},
+		{name: "misspelled AES256", sse: "AES-256", want: s3err.ErrInvalidEncryptionMethod},
+		{name: "SSE-C and SSE-S3", headers: ssec, sse: s3_constants.SSEAlgorithmAES256, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "SSE-C and SSE-KMS", headers: ssec, sse: s3_constants.SSEAlgorithmKMS, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "repeated algorithm header", sseValues: []string{"AES256", "aws:kms"}, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "repeated identical algorithm", sseValues: []string{"AES256", "AES256"}, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "empty value before KMS", sseValues: []string{"", "aws:kms"}, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "SSE-S3 hidden behind empty value", sseValues: []string{"", "AES256"}, headers: ssec, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "repeated SSE-C key header", headers: ssec, dup: s3_constants.AmzServerSideEncryptionCustomerKey, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "repeated KMS key id", sse: s3_constants.SSEAlgorithmKMS, dup: s3_constants.AmzServerSideEncryptionAwsKmsKeyId, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "SSE-S3 with KMS key id", sse: s3_constants.SSEAlgorithmAES256, headers: map[string]string{s3_constants.AmzServerSideEncryptionAwsKmsKeyId: "key-id"}, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "KMS key id without method", headers: map[string]string{s3_constants.AmzServerSideEncryptionAwsKmsKeyId: "key-id"}, want: s3err.ErrIncompatibleEncryptionMethod},
+		{name: "KMS key id with aws:kms", sse: s3_constants.SSEAlgorithmKMS, headers: map[string]string{s3_constants.AmzServerSideEncryptionAwsKmsKeyId: "key-id"}, want: s3err.ErrNone},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			h := http.Header{}
+			for k, v := range tc.headers {
+				h.Set(k, v)
+			}
+			if tc.sse != "" {
+				h.Set(s3_constants.AmzServerSideEncryption, tc.sse)
+			}
+			for _, v := range tc.sseValues {
+				h.Add(s3_constants.AmzServerSideEncryption, v)
+			}
+			if tc.dup != "" {
+				h.Add(tc.dup, "first")
+				h.Add(tc.dup, "second")
+			}
+			assert.Equal(t, tc.want, ValidateRequestEncryption(h))
+		})
+	}
+}
+
+// TestDirectoryMarkerSSEC verifies marker content stored under SSE-C encrypts
+// on write and decrypts on read through the stored entry metadata
+func TestDirectoryMarkerSSEC(t *testing.T) {
+	ssecHeaders := func(r *http.Request) {
+		r.Header.Set(s3_constants.AmzServerSideEncryptionCustomerAlgorithm, "AES256")
+		r.Header.Set(s3_constants.AmzServerSideEncryptionCustomerKey, "a2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2s=")
+		r.Header.Set(s3_constants.AmzServerSideEncryptionCustomerKeyMD5, "mT2HRsMGJ5IX5C+0rreZ8Q==")
+	}
+	plaintext := []byte("directory marker content")
+	s3a := &S3ApiServer{}
+
+	putReq := httptest.NewRequest(http.MethodPut, "/bucket/dir/", nil)
+	ssecHeaders(putReq)
+	sseResult, errCode := s3a.handleAllSSEEncryption(putReq, bytes.NewReader(plaintext), 0)
+	assert.Equal(t, s3err.ErrNone, errCode)
+	encrypted, err := io.ReadAll(sseResult.DataReader)
+	assert.NoError(t, err)
+	assert.NotEqual(t, plaintext, encrypted)
+
+	entry := &filer_pb.Entry{Extended: map[string][]byte{}, Content: encrypted}
+	storeSSEMetadata(entry, sseResult)
+
+	sseType := s3a.detectPrimarySSEType(entry)
+	assert.Equal(t, s3_constants.SSETypeC, sseType)
+
+	getReq := httptest.NewRequest(http.MethodGet, "/bucket/dir/", nil)
+	ssecHeaders(getReq)
+	decrypted, errCode := s3a.decryptDirectoryContent(getReq, entry, sseType)
+	assert.Equal(t, s3err.ErrNone, errCode)
+	assert.Equal(t, plaintext, decrypted)
+
+	bareReq := httptest.NewRequest(http.MethodGet, "/bucket/dir/", nil)
+	_, errCode = s3a.decryptDirectoryContent(bareReq, entry, sseType)
+	assert.Equal(t, s3err.ErrSSECustomerKeyMissing, errCode)
+}
diff --git a/weed/s3api/s3api_directory_marker.go b/weed/s3api/s3api_directory_marker.go
index b70955b76d..0c97382a56 100644
--- a/weed/s3api/s3api_directory_marker.go
+++ b/weed/s3api/s3api_directory_marker.go
@@ -2,6 +2,7 @@ package s3api
 
 import (
 	"errors"
+	"net/http"
 	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -25,7 +26,9 @@ import (
 
 // deleteDirectoryMarker removes the key "<dir>/". Callers hold the object write lock,
 // so the entry this decides about cannot change between the read and the delete.
-func (s3a *S3ApiServer) deleteDirectoryMarker(bucket, object string) s3err.ErrorCode {
+func (s3a *S3ApiServer) deleteDirectoryMarker(r *http.Request, bucket, object string) s3err.ErrorCode {
+	governanceBypassAllowed := s3a.evaluateGovernanceBypassRequest(r, bucket, object)
+
 	markerDir := s3a.bucketDir(bucket) + "/" + strings.TrimSuffix(strings.TrimPrefix(object, "/"), "/")
 	dir, name := util.FullPath(markerDir).DirAndName()
 
@@ -45,12 +48,52 @@ func (s3a *S3ApiServer) deleteDirectoryMarker(bucket, object string) s3err.Error
 		return s3err.ErrNone
 	}
 
+	// The key is deleted the unversioned way, but Object Lock still covers it: the
+	// gateway lists it as an object and serves retention set on it. The lock that
+	// matters is the one on this entry, since that is what is removed -- looking the
+	// key up instead would answer with a version once the key has a history.
+	if err := s3a.enforceObjectLockOnEntry(entry, bucket, object, "", governanceBypassAllowed); err != nil {
+		glog.V(2).Infof("deleteDirectoryMarker: %s/%s is locked: %v", bucket, object, err)
+		return s3err.ErrAccessDenied
+	}
+
 	// Drop a history an older build recorded for this key. Nothing writes one now, and
 	// leaving it behind keeps reporting the key in ListObjectVersions, so a history we
 	// cannot read or remove fails the delete rather than half finishing it.
 	switch _, historyErr := s3a.getEntry(markerDir, s3_constants.VersionsFolder); {
 	case historyErr == nil:
-		if rmErr := s3a.rm(markerDir, s3_constants.VersionsFolder, true, true); rmErr != nil {
+		// The removal below takes every entry under the key, so each has to be clear
+		// of a lock of its own.
+		versionsDir := markerDir + "/" + s3_constants.VersionsFolder
+		for startFrom := ""; ; {
+			entries, isLast, listErr := s3a.list(versionsDir, "", startFrom, false, 1000)
+			if listErr != nil {
+				glog.Errorf("deleteDirectoryMarker: cannot list history of %s/%s: %v", bucket, object, listErr)
+				return s3err.ErrInternalError
+			}
+			for _, entry := range entries {
+				startFrom = entry.Name
+				versionId, named := entry.Extended[s3_constants.ExtVersionIdKey]
+				if !named {
+					// An entry an older build left without a version id is what this
+					// removal is here to clear, but one still under a lock cannot be
+					// named to check it, so judge it on what it carries itself.
+					if err := s3a.enforceObjectLockOnEntry(entry, bucket, object, "", governanceBypassAllowed); err != nil {
+						glog.V(2).Infof("deleteDirectoryMarker: unnamed history entry %s of %s/%s is locked: %v", entry.Name, bucket, object, err)
+						return s3err.ErrAccessDenied
+					}
+					continue
+				}
+				if err := s3a.enforceObjectLockProtections(r, bucket, object, string(versionId), governanceBypassAllowed); err != nil {
+					glog.V(2).Infof("deleteDirectoryMarker: version %s of %s/%s is locked: %v", versionId, bucket, object, err)
+					return s3err.ErrAccessDenied
+				}
+			}
+			if isLast || len(entries) == 0 {
+				break
+			}
+		}
+		if rmErr := s3a.rm(r.Context(), markerDir, s3_constants.VersionsFolder, true, true); rmErr != nil {
 			glog.Errorf("deleteDirectoryMarker: failed to remove stale history of %s/%s: %v", bucket, object, rmErr)
 			return s3err.ErrInternalError
 		}
@@ -60,7 +103,7 @@ func (s3a *S3ApiServer) deleteDirectoryMarker(bucket, object string) s3err.Error
 	}
 
 	if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		return s3a.deleteUnversionedObjectWithClient(client, bucket, object, false)
+		return s3a.deleteUnversionedObjectWithClient(r.Context(), client, bucket, object, false)
 	}); err != nil {
 		glog.Errorf("deleteDirectoryMarker: failed to delete %s/%s: %v", bucket, object, err)
 		return s3err.ErrInternalError
diff --git a/weed/s3api/s3api_embedded_iam.go b/weed/s3api/s3api_embedded_iam.go
index 4dfab6074c..1c6aa1bec0 100644
--- a/weed/s3api/s3api_embedded_iam.go
+++ b/weed/s3api/s3api_embedded_iam.go
@@ -22,6 +22,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
@@ -66,6 +67,136 @@ func (e *EmbeddedIamApi) refreshIAMConfiguration() error {
 	return nil
 }
 
+// canPersistIdentity reports whether a change to the named identity can be written through the
+// credential manager's single-identity methods instead of SaveConfiguration. It is false when
+// there is no credential manager, when the caller asked for no persistent write (skipPersist),
+// and for static identities, which live outside the store: those keep the full-save path.
+func (e *EmbeddedIamApi) canPersistIdentity(skipPersist bool, userName string) bool {
+	return e.credentialManager != nil && !skipPersist && !e.credentialManager.IsStaticIdentity(userName)
+}
+
+// groupsWithMember returns the groups in s3cfg that list userName as a member. Taken before a
+// handler renames or removes the user, it names the group records that handler will change.
+func groupsWithMember(s3cfg *iam_pb.S3ApiConfiguration, userName string) []*iam_pb.Group {
+	var groups []*iam_pb.Group
+	for _, g := range s3cfg.Groups {
+		for _, m := range g.Members {
+			if m == userName {
+				groups = append(groups, g)
+				break
+			}
+		}
+	}
+	return groups
+}
+
+// serviceAccountsOf returns the service accounts in s3cfg whose parent is userName.
+func serviceAccountsOf(s3cfg *iam_pb.S3ApiConfiguration, userName string) []*iam_pb.ServiceAccount {
+	var accounts []*iam_pb.ServiceAccount
+	for _, sa := range s3cfg.ServiceAccounts {
+		if sa.ParentUser == userName {
+			accounts = append(accounts, sa)
+		}
+	}
+	return accounts
+}
+
+// persistIdentity writes the one identity a handler changed in s3cfg through the credential
+// manager. The store writes that identity's record and propagates it alone; the other
+// identities are not rewritten.
+func (e *EmbeddedIamApi) persistIdentity(ctx context.Context, s3cfg *iam_pb.S3ApiConfiguration, userName string) error {
+	ident := findIdentityByName(s3cfg, userName)
+	if ident == nil {
+		return credential.ErrUserNotFound
+	}
+	return e.credentialManager.UpdateUser(ctx, userName, ident)
+}
+
+// persistRenamedIdentity writes a user renamed from oldName to newName by UpdateUser through the
+// credential manager: the identity, the groups that listed the old name and the service accounts
+// it parented. Where the store has RenameUser the handler already moved the record and its inline
+// policies, and the identity is written under the new name. Otherwise UpdateUser under the old
+// name moves the record in stores that treat a changed Name as a rename (filer_etc, memory), the
+// propagating store propagates the new identity and the old name's removal, and the inline policy
+// copies the handler left under the old name are removed. A store that did neither still holds
+// the user under the old name; the caller is told so (false) and keeps the full save, which is
+// what renames such a store today.
+func (e *EmbeddedIamApi) persistRenamedIdentity(ctx context.Context, s3cfg *iam_pb.S3ApiConfiguration, oldName, newName string, groups []*iam_pb.Group, accounts []*iam_pb.ServiceAccount) (bool, error) {
+	ident := findIdentityByName(s3cfg, newName)
+	if ident == nil {
+		return false, credential.ErrUserNotFound
+	}
+	storedAs := oldName
+	if _, err := e.credentialManager.GetUser(ctx, newName); err == nil {
+		storedAs = newName
+	}
+	if err := e.credentialManager.UpdateUser(ctx, storedAs, ident); err != nil {
+		return false, err
+	}
+	if storedAs == oldName {
+		if _, err := e.credentialManager.GetUser(ctx, newName); err != nil {
+			return false, nil
+		}
+		policyNames, err := e.credentialManager.ListUserInlinePolicies(ctx, oldName)
+		if err != nil {
+			return false, fmt.Errorf("list inline policies for %s: %w", oldName, err)
+		}
+		for _, policyName := range policyNames {
+			if err := e.credentialManager.DeleteUserInlinePolicy(ctx, oldName, policyName); err != nil {
+				return false, fmt.Errorf("remove inline policy %s from %s: %w", policyName, oldName, err)
+			}
+		}
+	}
+	for _, g := range groups {
+		if err := e.credentialManager.UpdateGroup(ctx, g); err != nil {
+			return false, fmt.Errorf("update group %s: %w", g.Name, err)
+		}
+	}
+	for _, sa := range accounts {
+		if err := e.credentialManager.UpdateServiceAccount(ctx, sa.Id, sa); err != nil {
+			return false, fmt.Errorf("update service account %s: %w", sa.Id, err)
+		}
+	}
+	return true, nil
+}
+
+// deleteIdentity removes a user deleted by DeleteUser through the credential manager: its inline
+// policies, its record (the store propagates the one removal) and the groups that listed it,
+// whose membership DeleteUser already changed in s3cfg.
+func (e *EmbeddedIamApi) deleteIdentity(ctx context.Context, userName string, groups []*iam_pb.Group) error {
+	policyNames, err := e.credentialManager.ListUserInlinePolicies(ctx, userName)
+	if err != nil {
+		return fmt.Errorf("list inline policies for %s: %w", userName, err)
+	}
+	for _, policyName := range policyNames {
+		if err := e.credentialManager.DeleteUserInlinePolicy(ctx, userName, policyName); err != nil {
+			return fmt.Errorf("remove inline policy %s from %s: %w", policyName, userName, err)
+		}
+	}
+	if err := e.credentialManager.DeleteUser(ctx, userName); err != nil {
+		return err
+	}
+	for _, g := range groups {
+		if err := e.credentialManager.UpdateGroup(ctx, g); err != nil {
+			return fmt.Errorf("update group %s: %w", g.Name, err)
+		}
+	}
+	return nil
+}
+
+// reloadsAfterTargetedWrite names the actions that persist through the credential manager
+// rather than SaveConfiguration; the in-memory identity maps are refreshed after them the way
+// they are after a full save.
+func reloadsAfterTargetedWrite(action string) bool {
+	switch action {
+	case "AttachUserPolicy", "DetachUserPolicy", "CreatePolicy", "CreatePolicyVersion", "DeletePolicy",
+		"CreateUser", "UpdateUser", "DeleteUser", "CreateAccessKey", "DeleteAccessKey", "UpdateAccessKey",
+		"SetUserStatus", "PutUserPolicy", "DeleteUserPolicy", "PutGroupPolicy", "DeleteGroupPolicy":
+		return true
+	}
+	return false
+}
+
 // Constants for service account identifiers
 const (
 	ServiceAccountIDLength  = 12 // Length of the service account ID
@@ -195,10 +326,32 @@ func newIamErrorResponse(errCode string, errMsg string, requestID string) iamErr
 	return errorResp
 }
 
-func (e *EmbeddedIamApi) writeIamErrorResponse(w http.ResponseWriter, r *http.Request, reqID string, iamErr *iamError) {
+// iamAuthErrorCode maps an S3-side signature failure onto the IAM
+// query-protocol code IAM clients expect for the same request.
+func iamAuthErrorCode(errCode s3err.ErrorCode) string {
+	switch errCode {
+	case s3err.ErrInvalidAccessKeyID:
+		return "InvalidClientTokenId"
+	case s3err.ErrSignatureDoesNotMatch:
+		return "SignatureDoesNotMatch"
+	case s3err.ErrAccessDenied:
+		return "AccessDenied"
+	case s3err.ErrExpiredToken:
+		return "ExpiredToken"
+	case s3err.ErrRequestTimeTooSkewed:
+		return "RequestTimeTooSkewed"
+	case s3err.ErrInternalError:
+		return iam.ErrCodeServiceFailureException
+	default:
+		return "IncompleteSignature"
+	}
+}
+
+func writeIamErrorResponse(w http.ResponseWriter, r *http.Request, reqID string, iamErr *iamError) {
 	if iamErr == nil {
 		glog.Errorf("writeIamErrorResponse called with nil error")
 		internalResp := newIamErrorResponse(iam.ErrCodeServiceFailureException, "Internal server error", reqID)
+		internalResp.Error.Type = "Receiver"
 		s3err.WriteXMLResponse(w, r, http.StatusInternalServerError, internalResp)
 		return
 	}
@@ -209,22 +362,29 @@ func (e *EmbeddedIamApi) writeIamErrorResponse(w http.ResponseWriter, r *http.Re
 
 	errorResp := newIamErrorResponse(errCode, errMsg, reqID)
 	internalErrorResponse := newIamErrorResponse(iam.ErrCodeServiceFailureException, "Internal server error", reqID)
+	internalErrorResponse.Error.Type = "Receiver"
 
 	switch errCode {
 	case iam.ErrCodeNoSuchEntityException:
 		s3err.WriteXMLResponse(w, r, http.StatusNotFound, errorResp)
 	case iam.ErrCodeEntityAlreadyExistsException:
 		s3err.WriteXMLResponse(w, r, http.StatusConflict, errorResp)
-	case iam.ErrCodeMalformedPolicyDocumentException, iam.ErrCodeInvalidInputException, "ValidationError":
+	case iam.ErrCodeMalformedPolicyDocumentException, iam.ErrCodeInvalidInputException, "ValidationError", "IncompleteSignature", "ExpiredToken":
 		s3err.WriteXMLResponse(w, r, http.StatusBadRequest, errorResp)
-	case "AccessDenied", iam.ErrCodeLimitExceededException:
+	case "AccessDenied", "InvalidClientTokenId", "SignatureDoesNotMatch", "RequestTimeTooSkewed":
 		s3err.WriteXMLResponse(w, r, http.StatusForbidden, errorResp)
+	case iam.ErrCodeLimitExceededException:
+		s3err.WriteXMLResponse(w, r, http.StatusConflict, errorResp)
 	case iam.ErrCodeServiceFailureException:
 		s3err.WriteXMLResponse(w, r, http.StatusInternalServerError, internalErrorResponse)
 	case "NotImplemented":
 		s3err.WriteXMLResponse(w, r, http.StatusNotImplemented, errorResp)
+	case "InvalidAction":
+		s3err.WriteXMLResponse(w, r, http.StatusNotFound, errorResp)
 	case iam.ErrCodeDeleteConflictException:
 		s3err.WriteXMLResponse(w, r, http.StatusConflict, errorResp)
+	case iam.ErrCodeUnmodifiableEntityException:
+		s3err.WriteXMLResponse(w, r, http.StatusBadRequest, errorResp)
 	default:
 		s3err.WriteXMLResponse(w, r, http.StatusInternalServerError, internalErrorResponse)
 	}
@@ -325,8 +485,8 @@ func (e *EmbeddedIamApi) DeleteUser(s3cfg *iam_pb.S3ApiConfiguration, userName s
 	resp := &iamDeleteUserResponse{}
 	for i, ident := range s3cfg.Identities {
 		if userName == ident.Name {
-			// AWS IAM behavior: prevent deletion if user has service accounts
-			// This ensures explicit cleanup and prevents orphaned resources
+			// AWS IAM behavior: prevent deletion if user has dependent resources.
+			// This ensures explicit cleanup and prevents orphaned resources.
 			if len(ident.ServiceAccountIds) > 0 {
 				return resp, &iamError{
 					Code: iam.ErrCodeDeleteConflictException,
@@ -334,6 +494,13 @@ func (e *EmbeddedIamApi) DeleteUser(s3cfg *iam_pb.S3ApiConfiguration, userName s
 						userName, len(ident.ServiceAccountIds)),
 				}
 			}
+			if len(ident.Credentials) > 0 {
+				return resp, &iamError{
+					Code: iam.ErrCodeDeleteConflictException,
+					Error: fmt.Errorf("cannot delete user %s: user has %d access key(s). Delete access keys first",
+						userName, len(ident.Credentials)),
+				}
+			}
 			s3cfg.Identities = append(s3cfg.Identities[:i], s3cfg.Identities[i+1:]...)
 			// Remove user from all groups
 			for _, g := range s3cfg.Groups {
@@ -644,6 +811,20 @@ func (e *EmbeddedIamApi) DeletePolicy(ctx context.Context, values url.Values) (*
 			}
 		}
 	}
+	// Roles attach policies by name too; see integration.RolesAttachingPolicy,
+	// including why a role only in a peer's IAM config file is not seen here.
+	if mgr := e.oidcIAMManager(); mgr != nil && mgr.GetRoleStore() != nil {
+		roles, err := integration.RolesAttachingPolicy(ctx, mgr.GetRoleStore(), policyName)
+		if err != nil {
+			return resp, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+		}
+		if len(roles) > 0 {
+			return resp, &iamError{
+				Code:  iam.ErrCodeDeleteConflictException,
+				Error: fmt.Errorf("policy %s is attached to role %s", policyName, roles[0]),
+			}
+		}
+	}
 	if err := e.credentialManager.DeletePolicy(ctx, policyName); err != nil {
 		return resp, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
 	}
@@ -1110,9 +1291,9 @@ func (e *EmbeddedIamApi) GetUserPolicy(s3cfg *iam_pb.S3ApiConfiguration, values
 			ctx := context.Background()
 			storedDoc, storeErr := e.credentialManager.GetUserInlinePolicy(ctx, userName, policyName)
 			if storeErr != nil {
-				glog.Warningf("GetUserPolicy: failed to read stored inline policy %q for user %s: %v; falling back to reconstruction", policyName, userName, storeErr)
+				return resp, &iamError{Code: iam.ErrCodeServiceFailureException, Error: fmt.Errorf("get inline policy %s for %s: %w", policyName, userName, storeErr)}
 			}
-			if storeErr == nil && storedDoc != nil {
+			if storedDoc != nil {
 				policyDocumentJSON, err := json.Marshal(storedDoc)
 				if err != nil {
 					return resp, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
@@ -1120,6 +1301,14 @@ func (e *EmbeddedIamApi) GetUserPolicy(s3cfg *iam_pb.S3ApiConfiguration, values
 				resp.GetUserPolicyResult.PolicyDocument = string(policyDocumentJSON)
 				return resp, nil
 			}
+			// The user has stored inline policies, but none by this name
+			policyNames, err := e.credentialManager.ListUserInlinePolicies(ctx, userName)
+			if err != nil {
+				return resp, &iamError{Code: iam.ErrCodeServiceFailureException, Error: fmt.Errorf("list inline policies for %s: %w", userName, err)}
+			}
+			if len(policyNames) > 0 {
+				return resp, &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("the user policy with name %s cannot be found", policyName)}
+			}
 		}
 
 		// Fallback: reconstruct from ident.Actions (lossy - fine-grained actions
@@ -1143,6 +1332,9 @@ func (e *EmbeddedIamApi) GetUserPolicy(s3cfg *iam_pb.S3ApiConfiguration, values
 				resource = fmt.Sprintf("arn:aws:s3:::%s", act[1])
 			}
 			s3Action := fmt.Sprintf("s3:%s", iamMapToIdentitiesAction(act[0]))
+			if iamMapToIdentitiesAction(act[0]) == "" {
+				s3Action = fmt.Sprintf("s3:%s", act[0])
+			}
 			// Dedupe actions per resource
 			if seenAction[resource] == nil {
 				seenAction[resource] = make(map[string]bool)
@@ -2410,57 +2602,23 @@ func (e *EmbeddedIamApi) ListGroupPolicies(s3cfg *iam_pb.S3ApiConfiguration, val
 	return resp, nil
 }
 
-// handleImplicitUsername adds username who signs the request to values if 'username' is not specified.
-// According to AWS documentation: "If you do not specify a user name, IAM determines the user name
-// implicitly based on the Amazon Web Services access key ID signing the request."
-// This function extracts the AccessKeyId from the SigV4 credential and looks up the corresponding
-// identity name in the credential store.
+// handleImplicitUsername adds the name of the authenticated caller to values
+// when 'UserName' is not specified, per AWS: "If you do not specify a user name,
+// IAM determines the user name implicitly based on the Amazon Web Services
+// access key ID signing the request." The name comes from the identity the
+// authentication middleware verified, which the request context carries; the
+// Authorization header itself is attacker-controlled and is never re-parsed.
 func (e *EmbeddedIamApi) handleImplicitUsername(r *http.Request, values url.Values) {
-	if len(r.Header["Authorization"]) == 0 || values.Get("UserName") != "" {
+	if values.Get("UserName") != "" {
 		return
 	}
-	// Log presence of auth header without exposing sensitive signature material
-	glog.V(4).Infof("Authorization header present, extracting access key")
-	// Parse AWS SigV4 Authorization header format:
-	// "AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20130524/us-east-1/iam/aws4_request, ..."
-	s := strings.Split(r.Header["Authorization"][0], "Credential=")
-	if len(s) < 2 {
-		return
+	if name := s3_constants.GetIdentityNameFromContext(r); name != "" {
+		values.Set("UserName", name)
 	}
-	s = strings.Split(s[1], ",")
-	if len(s) < 1 {
-		return
-	}
-	s = strings.Split(s[0], "/")
-	if len(s) < 1 {
-		return
-	}
-	// s[0] is the AccessKeyId
-	accessKeyId := s[0]
-	if accessKeyId == "" {
-		return
-	}
-	// Nil-guard: ensure iam is initialized before lookup
-	if e.iam == nil {
-		glog.V(4).Infof("IAM not initialized, cannot look up access key")
-		return
-	}
-	// Look up the identity by access key to get the username
-	identity, _, found := e.iam.LookupByAccessKey(accessKeyId)
-	if !found {
-		// Mask access key in logs - show only first 4 chars
-		maskedKey := accessKeyId
-		if len(accessKeyId) > 4 {
-			maskedKey = accessKeyId[:4] + "***"
-		}
-		glog.V(4).Infof("Access key %s not found in credential store", maskedKey)
-		return
-	}
-	values.Set("UserName", identity.Name)
 }
 
-// iamSelfServiceActions are actions that users can perform on their own resources without admin rights.
-// According to AWS IAM, users can manage their own access keys without requiring full admin permissions.
+// iamSelfServiceActions are actions that users can perform on their own resources without admin rights,
+// unless selfServiceRequiresGrant is set, in which case they need an iam:<Action> grant like any other.
 var iamSelfServiceActions = map[string]bool{
 	"CreateAccessKey": true,
 	"DeleteAccessKey": true,
@@ -2474,29 +2632,70 @@ func iamRequiresAdminForOthers(action string) bool {
 	return iamSelfServiceActions[action]
 }
 
+// iamSelfTargetActions are authorized against the target identity's ARN so a
+// policy can scope the grant (arn:aws:iam:::user/team-parent). The target
+// parameter is action-specific (UserName for most, ParentUser for
+// CreateServiceAccount).
+var iamSelfTargetActions = map[string]bool{
+	"CreateServiceAccount": true,
+}
+
+func iamRequiresSelfTarget(action string) bool {
+	return iamSelfTargetActions[action]
+}
+
+// iamTargetUserName returns the request's target identity for authorization.
+// Most IAM actions target UserName; CreateServiceAccount targets ParentUser.
+// Both IAM dispatch surfaces (AuthIamManagement and UnifiedPostHandler) use
+// this so the authorized target and the acted-on target cannot differ.
+func iamTargetUserName(action string, r *http.Request) string {
+	if action == "CreateServiceAccount" {
+		return r.PostForm.Get("ParentUser")
+	}
+	return r.PostForm.Get("UserName")
+}
+
 // AuthorizeIamAction authorizes an IAM management action for identity, with
-// targetUserName taken from the request's UserName parameter.
+// targetUserName taken from the request's target parameter (UserName, or
+// ParentUser for CreateServiceAccount).
 //
 // IAM management is not part of the S3 data plane, so the grant is checked as
 // iam:<Action>. A coarse S3 action would instead be matched by an ordinary
 // data-plane policy, which says nothing about administering the credential
 // store.
 //
-// Users may run self-service actions against their own identity without any
-// IAM grant, matching AWS.
+// By default users may run self-service actions against their own identity
+// without any IAM grant. With selfServiceRequiresGrant set they need the
+// iam:<Action> grant as AWS requires, authorized against the target user's
+// ARN (the caller's own when UserName is empty), so a policy can confine it
+// to the caller's own keys.
 func (iam *IdentityAccessManagement) AuthorizeIamAction(r *http.Request, identity *Identity, action, targetUserName string) s3err.ErrorCode {
 	// The anonymous identity has no user of its own, so every self-service
 	// action it names would run against someone else's.
 	if identity == nil || identity.Name == s3_constants.AccountAnonymousId {
 		return s3err.ErrAccessDenied
 	}
-	if iamRequiresAdminForOthers(action) && (targetUserName == "" || targetUserName == identity.Name) {
+	if !iam.selfServiceRequiresGrant && iamRequiresAdminForOthers(action) && (targetUserName == "" || targetUserName == identity.Name) {
 		return s3err.ErrNone
 	}
 	if identity.isAdmin() {
 		return s3err.ErrNone
 	}
-	return iam.VerifyActionPermission(r, identity, Action("iam:"+action), "arn:aws:iam:::*", "")
+	// Self-target actions authorize against the target identity's ARN. The
+	// account segment stays empty so existing arn:aws:iam:::* wildcard
+	// grants keep matching.
+	resource := "arn:aws:iam:::*"
+	if iamRequiresSelfTarget(action) && targetUserName != "" {
+		resource = fmt.Sprintf("arn:aws:iam:::user/%s", targetUserName)
+	}
+	if iam.selfServiceRequiresGrant && iamRequiresAdminForOthers(action) {
+		target := targetUserName
+		if target == "" {
+			target = identity.Name
+		}
+		resource = fmt.Sprintf("arn:aws:iam:::user/%s", target)
+	}
+	return iam.VerifyActionPermission(r, identity, Action("iam:"+action), resource, "")
 }
 
 // AuthIamManagement authenticates an IAM management request and authorizes the
@@ -2516,22 +2715,30 @@ func (iam *IdentityAccessManagement) AuthIamManagement(f http.HandlerFunc) http.
 		// needs to hash the body for IAM requests (service != "s3").
 		// The streamHashRequestBody function in auth_signature_v4.go preserves the body
 		// after reading it, so ParseForm() will work correctly after authentication.
+		r, reqID := request_id.Ensure(r)
 		identity, errCode := iam.AuthSignatureOnly(r)
 		if errCode != s3err.ErrNone {
-			s3err.WriteErrorResponse(w, r, errCode)
+			writeIamErrorResponse(w, r, reqID, &iamError{
+				Code:  iamAuthErrorCode(errCode),
+				Error: errors.New(s3err.GetAPIError(errCode).Description),
+			})
 			return
 		}
 
 		// Now parse form to get Action and UserName (body was preserved by auth)
 		if err := r.ParseForm(); err != nil {
-			s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+			writeIamErrorResponse(w, r, reqID, &iamError{Code: "InvalidInput", Error: err})
 			return
 		}
 
 		// UserName comes from the body only, the same place the handlers read it
 		// from, so the authorized target and the acted-on target cannot differ.
-		if errCode := iam.AuthorizeIamAction(r, identity, r.Form.Get("Action"), r.PostForm.Get("UserName")); errCode != s3err.ErrNone {
-			s3err.WriteErrorResponse(w, r, errCode)
+		action := r.Form.Get("Action")
+		if errCode := iam.AuthorizeIamAction(r, identity, action, iamTargetUserName(action, r)); errCode != s3err.ErrNone {
+			writeIamErrorResponse(w, r, reqID, &iamError{
+				Code:  iamAuthErrorCode(errCode),
+				Error: errors.New(s3err.GetAPIError(errCode).Description),
+			})
 			return
 		}
 
@@ -2552,7 +2759,10 @@ func (e *EmbeddedIamApi) AuthIam(f http.HandlerFunc, _ Action) http.HandlerFunc
 }
 
 // ExecuteAction executes an IAM action with the given values.
-// If skipPersist is true, the changed configuration is not saved to the persistent store.
+// If skipPersist is true, the changed S3ApiConfiguration is not saved to the
+// persistent store. OIDC provider and role actions do not change that
+// configuration: they write to the IAM manager's own stores, whichever the
+// server was configured with, and skipPersist does not apply to them.
 // reqID is set on the response; if empty, a new request ID is generated.
 func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, skipPersist bool, reqID string) (iamlib.RequestIDSetter, *iamError) {
 	if reqID == "" {
@@ -2568,7 +2778,8 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 		case "ListUsers", "ListAccessKeys", "GetUser", "GetUserPolicy", "ListUserPolicies", "ListAttachedUserPolicies", "ListPolicies", "GetPolicy", "ListPolicyVersions", "GetPolicyVersion", "ListServiceAccounts", "GetServiceAccount",
 			"GetGroup", "ListGroups", "ListAttachedGroupPolicies", "GetGroupPolicy", "ListGroupPolicies", "ListGroupsForUser",
 			"ListUserTags",
-			actionListOpenIDConnectProviders, actionGetOpenIDConnectProvider:
+			actionListOpenIDConnectProviders, actionGetOpenIDConnectProvider,
+			actionGetRole, actionListRoles, actionListAttachedRolePolicies:
 			// Allowed read-only actions
 		default:
 			return nil, &iamError{Code: s3err.GetAPIError(s3err.ErrAccessDenied).Code, Error: fmt.Errorf("IAM write operations are disabled on this server")}
@@ -2585,6 +2796,15 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 		return response, nil
 	}
 
+	// Role actions operate on the IAM manager's role store, likewise.
+	if response, iamErr, ok := e.dispatchRoleAction(ctx, values); ok {
+		if iamErr != nil {
+			return nil, iamErr
+		}
+		response.SetRequestId(reqID)
+		return response, nil
+	}
+
 	s3cfg := &iam_pb.S3ApiConfiguration{}
 	if err := e.GetS3ApiConfiguration(s3cfg); err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
 		return nil, &iamError{Code: s3err.GetAPIError(s3err.ErrInternalError).Code, Error: fmt.Errorf("failed to get s3 api configuration: %v", err)}
@@ -2629,27 +2849,79 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 		}
 		changed = false
 	case "UpdateUser":
+		userName, newUserName := values.Get("UserName"), values.Get("NewUserName")
+		// Taken before the rename: the records the handler changes besides the identity.
+		groups := groupsWithMember(s3cfg, userName)
+		accounts := serviceAccountsOf(s3cfg, userName)
 		var iamErr *iamError
 		response, iamErr = e.UpdateUser(ctx, s3cfg, values)
 		if iamErr != nil {
 			return nil, iamErr
 		}
+		// Write the renamed identity, its groups and service accounts through the credential
+		// manager instead of rewriting every identity via SaveConfiguration. A request that
+		// renames nothing changed nothing, so there is nothing to write either way.
+		if e.canPersistIdentity(skipPersist, userName) {
+			renamed := true
+			if newUserName != "" && newUserName != userName {
+				var err error
+				renamed, err = e.persistRenamedIdentity(ctx, s3cfg, userName, newUserName, groups, accounts)
+				if err != nil {
+					return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+				}
+			}
+			changed = !renamed
+		}
 	case "DeleteUser":
 		userName := values.Get("UserName")
+		groups := groupsWithMember(s3cfg, userName)
 		var iamErr *iamError
 		response, iamErr = e.DeleteUser(s3cfg, userName)
 		if iamErr != nil {
 			return nil, iamErr
 		}
+		// Targeted delete: one record removed and one removal propagated, plus the groups whose
+		// membership changed, instead of rewriting every remaining identity.
+		if e.canPersistIdentity(skipPersist, userName) {
+			if err := e.deleteIdentity(ctx, userName, groups); err != nil {
+				return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+			}
+			changed = false
+		}
 	case "CreateAccessKey":
-		var iamErr *iamError
-		response, iamErr = e.CreateAccessKey(s3cfg, values)
+		userName := values.Get("UserName")
+		resp, iamErr := e.CreateAccessKey(s3cfg, values)
 		if iamErr != nil {
 			glog.Errorf("CreateAccessKey: %+v", iamErr.Error)
 			return nil, iamErr
 		}
+		response = resp
+		// Targeted write: credentialManager.CreateAccessKey adds the key to the one identity
+		// and propagates that identity alone.
+		if e.canPersistIdentity(skipPersist, userName) {
+			cred := &iam_pb.Credential{
+				AccessKey: *resp.CreateAccessKeyResult.AccessKey.AccessKeyId,
+				SecretKey: *resp.CreateAccessKeyResult.AccessKey.SecretAccessKey,
+				Status:    iamAccessKeyStatusActive,
+			}
+			if err := e.credentialManager.CreateAccessKey(ctx, userName, cred); err != nil {
+				return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+			}
+			changed = false
+		}
 	case "DeleteAccessKey":
+		userName, accessKeyId := values.Get("UserName"), values.Get("AccessKeyId")
 		response = e.DeleteAccessKey(s3cfg, values)
+		// Targeted write: credentialManager.DeleteAccessKey removes the key from the one identity
+		// and propagates that identity alone. The handler answers 200 for a key or user it does
+		// not know, so a not-found from the store is the same no-op it always was.
+		if e.canPersistIdentity(skipPersist, userName) {
+			err := e.credentialManager.DeleteAccessKey(ctx, userName, accessKeyId)
+			if err != nil && !errors.Is(err, credential.ErrAccessKeyNotFound) && !errors.Is(err, credential.ErrUserNotFound) {
+				return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+			}
+			changed = false
+		}
 	case "CreatePolicy":
 		var iamErr *iamError
 		response, iamErr = e.CreatePolicy(ctx, values)
@@ -2667,12 +2939,21 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 		}
 		changed = false
 	case "PutUserPolicy":
+		userName := values.Get("UserName")
 		var iamErr *iamError
 		response, iamErr = e.PutUserPolicy(s3cfg, values)
 		if iamErr != nil {
 			glog.Errorf("PutUserPolicy: %+v", iamErr.Error)
 			return nil, iamErr
 		}
+		// The policy document is already stored; what remains is the identity's recomputed
+		// Actions, written and propagated for that identity alone.
+		if e.canPersistIdentity(skipPersist, userName) {
+			if err := e.persistIdentity(ctx, s3cfg, userName); err != nil {
+				return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+			}
+			changed = false
+		}
 	case "GetUserPolicy":
 		var iamErr *iamError
 		response, iamErr = e.GetUserPolicy(s3cfg, values)
@@ -2681,11 +2962,18 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 		}
 		changed = false
 	case "DeleteUserPolicy":
+		userName := values.Get("UserName")
 		var iamErr *iamError
 		response, iamErr = e.DeleteUserPolicy(s3cfg, values)
 		if iamErr != nil {
 			return nil, iamErr
 		}
+		if e.canPersistIdentity(skipPersist, userName) {
+			if err := e.persistIdentity(ctx, s3cfg, userName); err != nil {
+				return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+			}
+			changed = false
+		}
 	case "ListUserPolicies":
 		var iamErr *iamError
 		response, iamErr = e.ListUserPolicies(s3cfg, values)
@@ -2777,17 +3065,31 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 		}
 		changed = false
 	case "SetUserStatus":
+		userName := values.Get("UserName")
 		var iamErr *iamError
 		response, iamErr = e.SetUserStatus(s3cfg, values)
 		if iamErr != nil {
 			return nil, iamErr
 		}
+		if e.canPersistIdentity(skipPersist, userName) {
+			if err := e.persistIdentity(ctx, s3cfg, userName); err != nil {
+				return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+			}
+			changed = false
+		}
 	case "UpdateAccessKey":
+		userName := values.Get("UserName")
 		var iamErr *iamError
 		response, iamErr = e.UpdateAccessKey(s3cfg, values)
 		if iamErr != nil {
 			return nil, iamErr
 		}
+		if e.canPersistIdentity(skipPersist, userName) {
+			if err := e.persistIdentity(ctx, s3cfg, userName); err != nil {
+				return nil, &iamError{Code: CredentialErrToIamErrCode(err), Error: err}
+			}
+			changed = false
+		}
 	// Service Account actions
 	case "CreateServiceAccount":
 		createdBy := values.Get("CreatedBy")
@@ -2914,7 +3216,7 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 		}
 		changed = false
 	default:
-		return nil, &iamError{Code: s3err.GetAPIError(s3err.ErrNotImplemented).Code, Error: errors.New(s3err.GetAPIError(s3err.ErrNotImplemented).Description)}
+		return nil, &iamError{Code: "InvalidAction", Error: fmt.Errorf("The action %s is not valid for this endpoint", values.Get("Action"))}
 	}
 	if changed {
 		if !skipPersist {
@@ -2928,7 +3230,7 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 			glog.Errorf("Failed to reload IAM configuration after mutation: %v", err)
 			// Don't fail the request since the persistent save succeeded
 		}
-	} else if action == "AttachUserPolicy" || action == "DetachUserPolicy" || action == "CreatePolicy" || action == "CreatePolicyVersion" || action == "DeletePolicy" || action == "CreateUser" || action == "PutGroupPolicy" || action == "DeleteGroupPolicy" {
+	} else if reloadsAfterTargetedWrite(action) {
 		// Even if changed=false (persisted via credentialManager), we should still reload
 		// if we are utilizing the local in-memory cache for speed
 		if err := e.ReloadConfiguration(); err != nil {
@@ -2943,7 +3245,7 @@ func (e *EmbeddedIamApi) ExecuteAction(ctx context.Context, values url.Values, s
 func (e *EmbeddedIamApi) DoActions(w http.ResponseWriter, r *http.Request) {
 	r, reqID := request_id.Ensure(r)
 	if err := r.ParseForm(); err != nil {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		writeIamErrorResponse(w, r, reqID, &iamError{Code: iam.ErrCodeInvalidInputException, Error: err})
 		return
 	}
 	values := r.PostForm
@@ -2959,7 +3261,7 @@ func (e *EmbeddedIamApi) DoActions(w http.ResponseWriter, r *http.Request) {
 
 	response, iamErr := e.ExecuteAction(r.Context(), values, false, reqID)
 	if iamErr != nil {
-		e.writeIamErrorResponse(w, r, reqID, iamErr)
+		writeIamErrorResponse(w, r, reqID, iamErr)
 		return
 	}
 
diff --git a/weed/s3api/s3api_embedded_iam_authz_test.go b/weed/s3api/s3api_embedded_iam_authz_test.go
index d39ab19b3e..81a1dd3e8b 100644
--- a/weed/s3api/s3api_embedded_iam_authz_test.go
+++ b/weed/s3api/s3api_embedded_iam_authz_test.go
@@ -12,8 +12,14 @@ import (
 )
 
 const (
-	dataPlanePolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}`
-	iamAdminPolicy  = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*","Resource":"*"}]}`
+	dataPlanePolicy        = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}`
+	iamAdminPolicy         = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:*","Resource":"*"}]}`
+	iamCreateSvcAcctPolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["iam:CreateServiceAccount"],"Resource":["*"]}]}`
+	// The wildcard ARN shape this authorization always used; it must keep
+	// matching any parent so existing grants survive.
+	iamCreateSvcAcctWildcardArnPolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["iam:CreateServiceAccount"],"Resource":["arn:aws:iam:::*"]}]}`
+	// Scoped to one parent identity.
+	iamCreateSvcAcctZonePolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["iam:CreateServiceAccount"],"Resource":["arn:aws:iam:::user/team-parent"]}]}`
 )
 
 func newIamAuthzTestIam(t *testing.T) *IdentityAccessManagement {
@@ -93,3 +99,121 @@ func TestAuthorizeIamActionDeniesAnonymous(t *testing.T) {
 	assert.Equal(t, s3err.ErrAccessDenied,
 		iam.AuthorizeIamAction(iamPostRequest(""), anonymous, "CreateUser", "victim"))
 }
+
+// CreateServiceAccount takes its target from the ParentUser parameter. A
+// non-admin holding iam:CreateServiceAccount targets the identities its
+// policy resource covers: a wildcard resource allows any target, a scoped
+// resource confines the grant to the named parent identity.
+func TestAuthorizeIamActionCreateServiceAccountScopedByPolicyResource(t *testing.T) {
+	iam := newIamAuthzTestIam(t)
+	require.NoError(t, iam.PutPolicy("CreateSvcAcctPolicy", iamCreateSvcAcctPolicy))
+	require.NoError(t, iam.PutPolicy("CreateSvcAcctWildcardArnPolicy", iamCreateSvcAcctWildcardArnPolicy))
+	require.NoError(t, iam.PutPolicy("CreateSvcAcctZonePolicy", iamCreateSvcAcctZonePolicy))
+	dev := &Identity{Name: "dev", PolicyNames: []string{"CreateSvcAcctPolicy"}}
+	wildcardArn := &Identity{Name: "wildcard-arn", PolicyNames: []string{"CreateSvcAcctWildcardArnPolicy"}}
+	keymaker := &Identity{Name: "keymaker", PolicyNames: []string{"CreateSvcAcctZonePolicy"}}
+	admin := &Identity{Name: "admin", Actions: []Action{s3_constants.ACTION_ADMIN}}
+
+	// Wildcard resource: any target, including the caller itself.
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeIamAction(iamPostRequest(""), dev, "CreateServiceAccount", "dev"))
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeIamAction(iamPostRequest(""), dev, "CreateServiceAccount", ""))
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeIamAction(iamPostRequest(""), dev, "CreateServiceAccount", "admin"))
+
+	// Wildcard ARN: any target.
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeIamAction(iamPostRequest(""), wildcardArn, "CreateServiceAccount", "team-parent"))
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeIamAction(iamPostRequest(""), wildcardArn, "CreateServiceAccount", "admin"))
+
+	// Scoped resource: the named parent only. IAM resource matching is
+	// case-sensitive, so a case variant is a different identity.
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeIamAction(iamPostRequest(""), keymaker, "CreateServiceAccount", "team-parent"))
+	assert.Equal(t, s3err.ErrAccessDenied,
+		iam.AuthorizeIamAction(iamPostRequest(""), keymaker, "CreateServiceAccount", "Team-Parent"))
+	assert.Equal(t, s3err.ErrAccessDenied,
+		iam.AuthorizeIamAction(iamPostRequest(""), keymaker, "CreateServiceAccount", "admin"))
+	assert.Equal(t, s3err.ErrAccessDenied,
+		iam.AuthorizeIamAction(iamPostRequest(""), keymaker, "CreateServiceAccount", "keymaker"))
+	assert.Equal(t, s3err.ErrAccessDenied,
+		iam.AuthorizeIamAction(iamPostRequest(""), keymaker, "CreateServiceAccount", ""))
+
+	// Admins remain unrestricted.
+	assert.Equal(t, s3err.ErrNone,
+		iam.AuthorizeIamAction(iamPostRequest(""), admin, "CreateServiceAccount", "victim"))
+}
+
+var iamSelfServiceActionNames = []string{"CreateAccessKey", "DeleteAccessKey", "UpdateAccessKey", "ListAccessKeys", "GetUser"}
+
+func ownKeysPolicy(resource string) string {
+	return `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["iam:CreateAccessKey","iam:DeleteAccessKey","iam:UpdateAccessKey","iam:ListAccessKeys","iam:GetUser"],"Resource":["` + resource + `"]}]}`
+}
+
+// With selfServiceRequiresGrant, an identity holding only data-plane rights may
+// no longer manage its own access keys: a leaked key cannot mint further keys
+// that outlive its own revocation, nor deactivate the keys it was issued.
+func TestAuthorizeIamActionSelfServiceRequiresGrantWhenConfigured(t *testing.T) {
+	iam := newIamAuthzTestIam(t)
+	iam.selfServiceRequiresGrant = true
+	powerUser := &Identity{Name: "power_user", PolicyNames: []string{"PowerUserPolicy"}}
+	bare := &Identity{Name: "bare_user"}
+
+	for _, action := range iamSelfServiceActionNames {
+		for _, identity := range []*Identity{powerUser, bare} {
+			for _, target := range []string{"", identity.Name, "victim"} {
+				assert.Equal(t, s3err.ErrAccessDenied, iam.AuthorizeIamAction(iamPostRequest(""), identity, action, target),
+					"%s by %s on %q", action, identity.Name, target)
+			}
+		}
+	}
+}
+
+// The grant is authorized against the target user's ARN, the caller's own when
+// UserName is empty, so a policy can confine it to the caller's own keys.
+func TestAuthorizeIamActionSelfServiceGrantIsScopedByResource(t *testing.T) {
+	for _, resource := range []string{"arn:aws:iam:::user/key_owner", "arn:aws:iam:::user/${aws:username}"} {
+		t.Run(resource, func(t *testing.T) {
+			iam := newIamAuthzTestIam(t)
+			iam.selfServiceRequiresGrant = true
+			require.NoError(t, iam.PutPolicy("OwnKeysPolicy", ownKeysPolicy(resource)))
+			owner := &Identity{Name: "key_owner", PolicyNames: []string{"OwnKeysPolicy"}}
+
+			for _, action := range iamSelfServiceActionNames {
+				assert.Equal(t, s3err.ErrNone, iam.AuthorizeIamAction(iamPostRequest(""), owner, action, ""), "%s on itself, implicit", action)
+				assert.Equal(t, s3err.ErrNone, iam.AuthorizeIamAction(iamPostRequest(""), owner, action, "key_owner"), "%s on itself", action)
+				assert.Equal(t, s3err.ErrAccessDenied, iam.AuthorizeIamAction(iamPostRequest(""), owner, action, "victim"), "%s on another user", action)
+			}
+			assert.Equal(t, s3err.ErrAccessDenied, iam.AuthorizeIamAction(iamPostRequest(""), owner, "CreateUser", "victim"))
+		})
+	}
+}
+
+// The setting changes nothing for the admin, nor for an iam:* grant.
+func TestAuthorizeIamActionSelfServiceRequiresGrantKeepsAdmin(t *testing.T) {
+	iam := newIamAuthzTestIam(t)
+	iam.selfServiceRequiresGrant = true
+	admin := &Identity{Name: "admin", Actions: []Action{s3_constants.ACTION_ADMIN}}
+	operator := &Identity{Name: "iam_operator", PolicyNames: []string{"IamAdminPolicy"}}
+
+	for _, action := range iamSelfServiceActionNames {
+		for _, identity := range []*Identity{admin, operator} {
+			for _, target := range []string{"", identity.Name, "victim"} {
+				assert.Equal(t, s3err.ErrNone, iam.AuthorizeIamAction(iamPostRequest(""), identity, action, target),
+					"%s by %s on %q", action, identity.Name, target)
+			}
+		}
+	}
+}
+
+// Off by default: self-service stays allowed without a grant.
+func TestAuthorizeIamActionSelfServiceDefaultUnchanged(t *testing.T) {
+	iam := newIamAuthzTestIam(t)
+	powerUser := &Identity{Name: "power_user", PolicyNames: []string{"PowerUserPolicy"}}
+	for _, action := range iamSelfServiceActionNames {
+		assert.Equal(t, s3err.ErrNone, iam.AuthorizeIamAction(iamPostRequest(""), powerUser, action, ""), action)
+		assert.Equal(t, s3err.ErrNone, iam.AuthorizeIamAction(iamPostRequest(""), powerUser, action, "power_user"), action)
+	}
+}
diff --git a/weed/s3api/s3api_embedded_iam_oidc.go b/weed/s3api/s3api_embedded_iam_oidc.go
index ccfdf9ee7b..764bc56bc0 100644
--- a/weed/s3api/s3api_embedded_iam_oidc.go
+++ b/weed/s3api/s3api_embedded_iam_oidc.go
@@ -161,7 +161,7 @@ func (e *EmbeddedIamApi) deleteOpenIDConnectProvider(ctx context.Context, mgr *i
 		return nil, iamErr
 	}
 	if err := mgr.DeleteOIDCProvider(ctx, arn); err != nil {
-		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+		return nil, oidcMutationError(err)
 	}
 	return &iamlib.DeleteOpenIDConnectProviderResponse{}, nil
 }
@@ -176,10 +176,7 @@ func (e *EmbeddedIamApi) addClientIDToOpenIDConnectProvider(ctx context.Context,
 		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("ClientID is required")}
 	}
 	if err := mgr.AddClientIDToOIDCProvider(ctx, arn, clientID); err != nil {
-		if errors.Is(err, integration.ErrOIDCProviderNotFound) {
-			return nil, &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: err}
-		}
-		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+		return nil, oidcMutationError(err)
 	}
 	return &iamlib.AddClientIDToOpenIDConnectProviderResponse{}, nil
 }
@@ -194,10 +191,7 @@ func (e *EmbeddedIamApi) removeClientIDFromOpenIDConnectProvider(ctx context.Con
 		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("ClientID is required")}
 	}
 	if err := mgr.RemoveClientIDFromOIDCProvider(ctx, arn, clientID); err != nil {
-		if errors.Is(err, integration.ErrOIDCProviderNotFound) {
-			return nil, &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: err}
-		}
-		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+		return nil, oidcMutationError(err)
 	}
 	return &iamlib.RemoveClientIDFromOpenIDConnectProviderResponse{}, nil
 }
@@ -212,6 +206,9 @@ func (e *EmbeddedIamApi) updateOpenIDConnectProviderThumbprint(ctx context.Conte
 		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("ThumbprintList must contain at least one entry")}
 	}
 	if err := mgr.UpdateOIDCProviderThumbprints(ctx, arn, thumbprints); err != nil {
+		if errors.Is(err, integration.ErrOIDCProviderStatic) {
+			return nil, oidcMutationError(err)
+		}
 		if errors.Is(err, integration.ErrOIDCProviderNotFound) {
 			return nil, &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: err}
 		}
@@ -230,10 +227,7 @@ func (e *EmbeddedIamApi) tagOpenIDConnectProvider(ctx context.Context, mgr *inte
 		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("Tags must contain at least one Key/Value pair")}
 	}
 	if err := mgr.TagOIDCProvider(ctx, arn, tags); err != nil {
-		if errors.Is(err, integration.ErrOIDCProviderNotFound) {
-			return nil, &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: err}
-		}
-		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+		return nil, oidcMutationError(err)
 	}
 	return &iamlib.TagOpenIDConnectProviderResponse{}, nil
 }
@@ -248,10 +242,7 @@ func (e *EmbeddedIamApi) untagOpenIDConnectProvider(ctx context.Context, mgr *in
 		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("TagKeys must contain at least one entry")}
 	}
 	if err := mgr.UntagOIDCProvider(ctx, arn, keys); err != nil {
-		if errors.Is(err, integration.ErrOIDCProviderNotFound) {
-			return nil, &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: err}
-		}
-		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+		return nil, oidcMutationError(err)
 	}
 	return &iamlib.UntagOpenIDConnectProviderResponse{}, nil
 }
@@ -339,3 +330,17 @@ func (e *EmbeddedIamApi) getOpenIDConnectProvider(ctx context.Context, mgr *inte
 	}
 	return resp, nil
 }
+
+// oidcMutationError maps an IAMManager error from a provider change to its
+// IAM error code. A provider defined in the IAM config file is changed there,
+// not through the API.
+func oidcMutationError(err error) *iamError {
+	switch {
+	case errors.Is(err, integration.ErrOIDCProviderStatic):
+		return &iamError{Code: iam.ErrCodeUnmodifiableEntityException, Error: err}
+	case errors.Is(err, integration.ErrOIDCProviderNotFound):
+		return &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: err}
+	default:
+		return &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+	}
+}
diff --git a/weed/s3api/s3api_embedded_iam_role.go b/weed/s3api/s3api_embedded_iam_role.go
new file mode 100644
index 0000000000..3f4dbe84d6
--- /dev/null
+++ b/weed/s3api/s3api_embedded_iam_role.go
@@ -0,0 +1,419 @@
+package s3api
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go/service/iam"
+	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+)
+
+// Role IAM actions handled by this file.
+const (
+	actionCreateRole               = "CreateRole"
+	actionGetRole                  = "GetRole"
+	actionListRoles                = "ListRoles"
+	actionDeleteRole               = "DeleteRole"
+	actionUpdateAssumeRolePolicy   = "UpdateAssumeRolePolicy"
+	actionAttachRolePolicy         = "AttachRolePolicy"
+	actionDetachRolePolicy         = "DetachRolePolicy"
+	actionListAttachedRolePolicies = "ListAttachedRolePolicies"
+)
+
+// isRoleAction reports whether an action belongs to the role family.
+func isRoleAction(action string) bool {
+	switch action {
+	case actionCreateRole, actionGetRole, actionListRoles, actionDeleteRole,
+		actionUpdateAssumeRolePolicy, actionAttachRolePolicy, actionDetachRolePolicy,
+		actionListAttachedRolePolicies:
+		return true
+	default:
+		return false
+	}
+}
+
+// dispatchRoleAction handles the role IAM actions. Roles live in the IAM
+// manager's role store, not in S3ApiConfiguration, so like the OIDC provider
+// actions they are dispatched before the configuration load. The boolean
+// reports whether the action was recognised.
+func (e *EmbeddedIamApi) dispatchRoleAction(ctx context.Context, values url.Values) (iamlib.RequestIDSetter, *iamError, bool) {
+	if !isRoleAction(values.Get("Action")) {
+		return nil, nil, false
+	}
+	mgr := e.oidcIAMManager()
+	if mgr == nil {
+		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: errors.New("role store not configured: start the S3 server with an IAM config")}, true
+	}
+
+	switch values.Get("Action") {
+	case actionCreateRole:
+		resp, err := e.createRole(ctx, mgr, values)
+		return resp, err, true
+	case actionGetRole:
+		resp, err := e.getRole(ctx, mgr, values)
+		return resp, err, true
+	case actionListRoles:
+		resp, err := e.listRoles(ctx, mgr)
+		return resp, err, true
+	case actionDeleteRole:
+		resp, err := e.deleteRole(ctx, mgr, values)
+		return resp, err, true
+	case actionUpdateAssumeRolePolicy:
+		resp, err := e.updateAssumeRolePolicy(ctx, mgr, values)
+		return resp, err, true
+	case actionAttachRolePolicy:
+		resp, err := e.attachRolePolicy(ctx, mgr, values)
+		return resp, err, true
+	case actionDetachRolePolicy:
+		resp, err := e.detachRolePolicy(ctx, mgr, values)
+		return resp, err, true
+	case actionListAttachedRolePolicies:
+		resp, err := e.listAttachedRolePolicies(ctx, mgr, values)
+		return resp, err, true
+	}
+	return nil, nil, false
+}
+
+// parseTrustPolicy decodes and validates an AssumeRolePolicyDocument.
+func parseTrustPolicy(document string) (*policy.PolicyDocument, *iamError) {
+	if strings.TrimSpace(document) == "" {
+		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("AssumeRolePolicyDocument is required")}
+	}
+	var doc policy.PolicyDocument
+	if err := json.Unmarshal([]byte(document), &doc); err != nil {
+		return nil, &iamError{Code: iam.ErrCodeMalformedPolicyDocumentException, Error: fmt.Errorf("parse trust policy: %w", err)}
+	}
+	if err := policy.ValidateTrustPolicyDocument(&doc); err != nil {
+		return nil, &iamError{Code: iam.ErrCodeMalformedPolicyDocumentException, Error: err}
+	}
+	return &doc, nil
+}
+
+// requireRole loads the named role, mapping a missing role to NoSuchEntity.
+func requireRole(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*integration.RoleDefinition, *iamError) {
+	name := strings.TrimSpace(values.Get("RoleName"))
+	if name == "" {
+		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("RoleName is required")}
+	}
+	role, err := mgr.GetRole(ctx, name)
+	if errors.Is(err, integration.ErrRoleNotFound) || (err == nil && role == nil) {
+		return nil, &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("role %s not found", name)}
+	}
+	if err != nil {
+		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+	}
+	return role, nil
+}
+
+// requireMutableRole is requireRole for actions that change or delete the
+// role. A role loaded from the IAM config file is reloaded from it at every
+// start, so a change made through the API would be silently reverted; it is
+// refused instead.
+func requireMutableRole(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*integration.RoleDefinition, *iamError) {
+	role, iamErr := requireRole(ctx, mgr, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	if role.Source == integration.RoleSourceStaticConfig {
+		return nil, &iamError{Code: iam.ErrCodeUnmodifiableEntityException, Error: fmt.Errorf("role %s is defined in the IAM config file; change it there", role.RoleName)}
+	}
+	return role, nil
+}
+
+// errRoleUpdateRefused aborts a RoleStore update whose refusal the handler
+// has already recorded as an iamError.
+var errRoleUpdateRefused = errors.New("role update refused")
+
+// updateRole applies change to the named role through the role store's atomic
+// update, so a concurrent change on another server is neither lost nor
+// written over a delete. change sees the current role and returns an iamError
+// to refuse; a missing role is NoSuchEntity and a config-file role is
+// UnmodifiableEntity, as requireMutableRole reports them.
+func updateRole(ctx context.Context, mgr *integration.IAMManager, name string, change func(role *integration.RoleDefinition) *iamError) *iamError {
+	var refused *iamError
+	err := mgr.UpdateRole(ctx, name, func(current *integration.RoleDefinition) (*integration.RoleDefinition, error) {
+		if current == nil {
+			refused = &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("role %s not found", name)}
+			return nil, errRoleUpdateRefused
+		}
+		if refused = change(current); refused != nil {
+			return nil, errRoleUpdateRefused
+		}
+		return current, nil
+	})
+	return roleWriteError(err, refused)
+}
+
+// roleWriteError maps a role store write's outcome to the IAM error to
+// report: the handler's own refusal, else the store's error by kind. A write
+// that failed for another reason is a service failure, which clients retry.
+func roleWriteError(err error, refused *iamError) *iamError {
+	switch {
+	case err == nil:
+		return nil
+	case errors.Is(err, errRoleUpdateRefused) && refused != nil:
+		return refused
+	case errors.Is(err, integration.ErrRoleStatic):
+		return &iamError{Code: iam.ErrCodeUnmodifiableEntityException, Error: fmt.Errorf("%w; change it there", err)}
+	case errors.Is(err, integration.ErrRoleExists):
+		return &iamError{Code: iam.ErrCodeEntityAlreadyExistsException, Error: err}
+	default:
+		return &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+	}
+}
+
+// roleID is the role's stored ID. A role stored before IDs were recorded has
+// none; it is reported with the ID StaticRoleID derives for it.
+func roleID(role *integration.RoleDefinition) string {
+	if role.RoleId != "" {
+		return role.RoleId
+	}
+	return integration.StaticRoleID(role)
+}
+
+func toIAMRole(role *integration.RoleDefinition) iamlib.IAMRole {
+	out := iamlib.IAMRole{
+		Path:               "/",
+		RoleName:           role.RoleName,
+		RoleId:             roleID(role),
+		Arn:                role.RoleArn,
+		Description:        role.Description,
+		MaxSessionDuration: role.MaxSessionDuration,
+	}
+	if !role.CreatedAt.IsZero() {
+		out.CreateDate = role.CreatedAt.UTC().Format(time.RFC3339)
+	}
+	if role.TrustPolicy != nil {
+		if doc, err := json.Marshal(role.TrustPolicy); err == nil {
+			// AWS returns the document URL-encoded.
+			out.AssumeRolePolicyDocument = url.PathEscape(string(doc))
+		}
+	}
+	return out
+}
+
+func (e *EmbeddedIamApi) createRole(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*iamlib.CreateRoleResponse, *iamError) {
+	name := strings.TrimSpace(values.Get("RoleName"))
+	if name == "" {
+		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("RoleName is required")}
+	}
+	if err := integration.ValidateRoleName(name); err != nil {
+		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: err}
+	}
+	if path := values.Get("Path"); path != "" && path != "/" {
+		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("role paths are not supported: %s", path)}
+	}
+	for key := range values {
+		if strings.HasPrefix(key, "Tags.") {
+			return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: errors.New("role tags are not supported")}
+		}
+	}
+	// A config-file role is served beside the store, not from it, so the
+	// store's create-if-absent cannot see it.
+	existing, err := mgr.GetRole(ctx, name)
+	if err == nil && existing != nil {
+		return nil, &iamError{Code: iam.ErrCodeEntityAlreadyExistsException, Error: fmt.Errorf("role %s already exists", name)}
+	}
+	if err != nil && !errors.Is(err, integration.ErrRoleNotFound) {
+		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+	}
+	trust, iamErr := parseTrustPolicy(values.Get("AssumeRolePolicyDocument"))
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	var maxSession int64
+	if raw := values.Get("MaxSessionDuration"); raw != "" {
+		n, err := strconv.ParseInt(raw, 10, 64)
+		if err != nil {
+			return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: fmt.Errorf("MaxSessionDuration: %w", err)}
+		}
+		maxSession = n
+	}
+
+	role := &integration.RoleDefinition{
+		RoleName:           name,
+		TrustPolicy:        trust,
+		Description:        values.Get("Description"),
+		MaxSessionDuration: maxSession,
+		CreatedAt:          time.Now().UTC(),
+		RoleId:             integration.NewRoleID(),
+	}
+	// Validation first: only a bad request is InvalidInput. The write below
+	// is created only if no role of this name exists by then, so of two
+	// concurrent creates, one fails with EntityAlreadyExists.
+	if err := integration.PrepareRoleDefinition(name, role); err != nil {
+		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: err}
+	}
+	err = mgr.UpdateRole(ctx, name, func(current *integration.RoleDefinition) (*integration.RoleDefinition, error) {
+		if current != nil {
+			return nil, fmt.Errorf("%w: %s", integration.ErrRoleExists, name)
+		}
+		return role, nil
+	})
+	if iamErr := roleWriteError(err, nil); iamErr != nil {
+		return nil, iamErr
+	}
+	resp := &iamlib.CreateRoleResponse{}
+	resp.CreateRoleResult.Role = toIAMRole(role)
+	return resp, nil
+}
+
+func (e *EmbeddedIamApi) getRole(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*iamlib.GetRoleResponse, *iamError) {
+	role, iamErr := requireRole(ctx, mgr, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	resp := &iamlib.GetRoleResponse{}
+	resp.GetRoleResult.Role = toIAMRole(role)
+	return resp, nil
+}
+
+func (e *EmbeddedIamApi) listRoles(ctx context.Context, mgr *integration.IAMManager) (*iamlib.ListRolesResponse, *iamError) {
+	roles, err := mgr.ListRoles(ctx)
+	if err != nil {
+		return nil, &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+	}
+	resp := &iamlib.ListRolesResponse{}
+	resp.ListRolesResult.Roles = make([]*iamlib.IAMRole, 0, len(roles))
+	for _, role := range roles {
+		view := toIAMRole(role)
+		resp.ListRolesResult.Roles = append(resp.ListRolesResult.Roles, &view)
+	}
+	return resp, nil
+}
+
+func (e *EmbeddedIamApi) deleteRole(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*iamlib.DeleteRoleResponse, *iamError) {
+	role, iamErr := requireMutableRole(ctx, mgr, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	// The delete is decided against the role as it is when deleted, in the
+	// store's atomic update: a policy attached meanwhile on another server is
+	// a DeleteConflict, as AWS reports a role with managed policies attached.
+	var refused *iamError
+	err := mgr.UpdateRole(ctx, role.RoleName, func(current *integration.RoleDefinition) (*integration.RoleDefinition, error) {
+		if current == nil {
+			refused = &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("role %s not found", role.RoleName)}
+			return nil, errRoleUpdateRefused
+		}
+		if len(current.AttachedPolicies) > 0 {
+			refused = &iamError{Code: iam.ErrCodeDeleteConflictException, Error: fmt.Errorf("role %s has attached policies; detach them first", role.RoleName)}
+			return nil, errRoleUpdateRefused
+		}
+		return nil, nil
+	})
+	if iamErr := roleWriteError(err, refused); iamErr != nil {
+		return nil, iamErr
+	}
+	return &iamlib.DeleteRoleResponse{}, nil
+}
+
+func (e *EmbeddedIamApi) updateAssumeRolePolicy(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*iamlib.UpdateAssumeRolePolicyResponse, *iamError) {
+	role, iamErr := requireMutableRole(ctx, mgr, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	trust, iamErr := parseTrustPolicy(values.Get("PolicyDocument"))
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	if iamErr := updateRole(ctx, mgr, role.RoleName, func(current *integration.RoleDefinition) *iamError {
+		current.TrustPolicy = trust
+		return nil
+	}); iamErr != nil {
+		return nil, iamErr
+	}
+	return &iamlib.UpdateAssumeRolePolicyResponse{}, nil
+}
+
+// rolePolicyName resolves PolicyArn to the name of an existing managed policy.
+func (e *EmbeddedIamApi) rolePolicyName(ctx context.Context, values url.Values) (string, *iamError) {
+	name, err := iamPolicyNameFromArn(values.Get("PolicyArn"))
+	if err != nil {
+		return "", &iamError{Code: iam.ErrCodeInvalidInputException, Error: err}
+	}
+	if e.credentialManager == nil {
+		return "", &iamError{Code: iam.ErrCodeServiceFailureException, Error: errors.New("credential manager not configured")}
+	}
+	existing, err := e.credentialManager.GetPolicy(ctx, name)
+	if err != nil {
+		return "", &iamError{Code: iam.ErrCodeServiceFailureException, Error: err}
+	}
+	if existing == nil {
+		return "", &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("policy %s not found", name)}
+	}
+	return name, nil
+}
+
+func (e *EmbeddedIamApi) attachRolePolicy(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*iamlib.AttachRolePolicyResponse, *iamError) {
+	role, iamErr := requireMutableRole(ctx, mgr, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	name, iamErr := e.rolePolicyName(ctx, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	if slices.Contains(role.AttachedPolicies, name) {
+		return &iamlib.AttachRolePolicyResponse{}, nil
+	}
+	if iamErr := updateRole(ctx, mgr, role.RoleName, func(current *integration.RoleDefinition) *iamError {
+		if slices.Contains(current.AttachedPolicies, name) {
+			return nil
+		}
+		if len(current.AttachedPolicies) >= integration.MaxManagedPoliciesPerRole {
+			return &iamError{Code: iam.ErrCodeLimitExceededException,
+				Error: fmt.Errorf("cannot attach more than %d managed policies to role %s", integration.MaxManagedPoliciesPerRole, current.RoleName)}
+		}
+		current.AttachedPolicies = append(current.AttachedPolicies, name)
+		return nil
+	}); iamErr != nil {
+		return nil, iamErr
+	}
+	return &iamlib.AttachRolePolicyResponse{}, nil
+}
+
+func (e *EmbeddedIamApi) detachRolePolicy(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*iamlib.DetachRolePolicyResponse, *iamError) {
+	role, iamErr := requireMutableRole(ctx, mgr, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	name, err := iamPolicyNameFromArn(values.Get("PolicyArn"))
+	if err != nil {
+		return nil, &iamError{Code: iam.ErrCodeInvalidInputException, Error: err}
+	}
+	if iamErr := updateRole(ctx, mgr, role.RoleName, func(current *integration.RoleDefinition) *iamError {
+		idx := slices.Index(current.AttachedPolicies, name)
+		if idx < 0 {
+			return &iamError{Code: iam.ErrCodeNoSuchEntityException, Error: fmt.Errorf("policy %s is not attached to role %s", name, current.RoleName)}
+		}
+		current.AttachedPolicies = slices.Delete(current.AttachedPolicies, idx, idx+1)
+		return nil
+	}); iamErr != nil {
+		return nil, iamErr
+	}
+	return &iamlib.DetachRolePolicyResponse{}, nil
+}
+
+func (e *EmbeddedIamApi) listAttachedRolePolicies(ctx context.Context, mgr *integration.IAMManager, values url.Values) (*iamlib.ListAttachedRolePoliciesResponse, *iamError) {
+	role, iamErr := requireRole(ctx, mgr, values)
+	if iamErr != nil {
+		return nil, iamErr
+	}
+	resp := &iamlib.ListAttachedRolePoliciesResponse{}
+	resp.ListAttachedRolePoliciesResult.AttachedPolicies = make([]*iamlib.IAMAttachedPolicy, 0, len(role.AttachedPolicies))
+	for _, name := range role.AttachedPolicies {
+		resp.ListAttachedRolePoliciesResult.AttachedPolicies = append(resp.ListAttachedRolePoliciesResult.AttachedPolicies,
+			&iamlib.IAMAttachedPolicy{PolicyName: name, PolicyArn: iamPolicyArn(name)})
+	}
+	return resp, nil
+}
diff --git a/weed/s3api/s3api_embedded_iam_targeted_test.go b/weed/s3api/s3api_embedded_iam_targeted_test.go
new file mode 100644
index 0000000000..a13d7e4ca3
--- /dev/null
+++ b/weed/s3api/s3api_embedded_iam_targeted_test.go
@@ -0,0 +1,362 @@
+package s3api
+
+// Targeted-write regression tests: single-identity IAM actions must write and
+// propagate only the identity they changed, not every identity via
+// SaveConfiguration. See https://github.com/seaweedfs/seaweedfs/issues/11865.
+
+import (
+	"context"
+	"encoding/json"
+	"net/url"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// recordingStore wraps a memory store and counts the write methods the
+// dispatcher used, so a test can assert the single-identity path was taken and
+// SaveConfiguration was not. It embeds the concrete store (rather than the
+// CredentialStore interface) so optional interfaces like InlinePolicyStore and
+// UserRenamer stay visible through the wrapper.
+type recordingStore struct {
+	*memory.MemoryStore
+	saves            int
+	createAccessKeys int
+	deleteAccessKeys int
+	updateUsers      int
+	deleteUsers      int
+	updateGroups     int
+}
+
+func (r *recordingStore) SaveConfiguration(ctx context.Context, config *iam_pb.S3ApiConfiguration) error {
+	r.saves++
+	return r.MemoryStore.SaveConfiguration(ctx, config)
+}
+
+func (r *recordingStore) CreateAccessKey(ctx context.Context, username string, cred *iam_pb.Credential) error {
+	r.createAccessKeys++
+	return r.MemoryStore.CreateAccessKey(ctx, username, cred)
+}
+
+func (r *recordingStore) DeleteAccessKey(ctx context.Context, username string, accessKey string) error {
+	r.deleteAccessKeys++
+	return r.MemoryStore.DeleteAccessKey(ctx, username, accessKey)
+}
+
+func (r *recordingStore) UpdateUser(ctx context.Context, username string, identity *iam_pb.Identity) error {
+	r.updateUsers++
+	return r.MemoryStore.UpdateUser(ctx, username, identity)
+}
+
+func (r *recordingStore) DeleteUser(ctx context.Context, username string) error {
+	r.deleteUsers++
+	return r.MemoryStore.DeleteUser(ctx, username)
+}
+
+func (r *recordingStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
+	r.updateGroups++
+	return r.MemoryStore.UpdateGroup(ctx, group)
+}
+
+// newTargetedWriteTestApi seeds cfg into the store and wraps the store in a
+// recordingStore. The initial sync save happens before the recorder is
+// installed so it does not count.
+func newTargetedWriteTestApi(t *testing.T, cfg *iam_pb.S3ApiConfiguration) (*EmbeddedIamApiForTest, *recordingStore) {
+	t.Helper()
+	api := NewEmbeddedIamApiForTest()
+	api.mockConfig = cfg
+	// Trigger the one-time mockConfig -> store seed through a read action.
+	_, iamErr := api.ExecuteAction(context.Background(), url.Values{"Action": {"ListUsers"}}, false, "")
+	require.Nil(t, iamErr)
+	rec := &recordingStore{MemoryStore: api.credentialManager.Store.(*memory.MemoryStore)}
+	api.credentialManager.Store = rec
+	return api, rec
+}
+
+func executeAction(t *testing.T, api *EmbeddedIamApiForTest, vals url.Values) {
+	t.Helper()
+	_, iamErr := api.ExecuteAction(context.Background(), vals, false, "")
+	require.Nil(t, iamErr)
+}
+
+func TestEmbeddedIamCreateAccessKeyTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}, {Name: "bob"}},
+	})
+	ctx := context.Background()
+
+	resp, iamErr := api.ExecuteAction(ctx, url.Values{
+		"Action":   {"CreateAccessKey"},
+		"UserName": {"alice"},
+	}, false, "")
+	require.Nil(t, iamErr)
+	require.Equal(t, 0, rec.saves, "CreateAccessKey must not SaveConfiguration")
+	require.Equal(t, 1, rec.createAccessKeys)
+
+	out := resp.(*iamCreateAccessKeyResponse)
+	ident, err := api.credentialManager.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	require.Len(t, ident.Credentials, 1)
+	assert.Equal(t, *out.CreateAccessKeyResult.AccessKey.AccessKeyId, ident.Credentials[0].AccessKey)
+
+	// The new key resolves in the store.
+	byKey, err := api.credentialManager.GetUserByAccessKey(ctx, *out.CreateAccessKeyResult.AccessKey.AccessKeyId)
+	require.NoError(t, err)
+	assert.Equal(t, "alice", byKey.Name)
+}
+
+func TestEmbeddedIamDeleteAccessKeyTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{
+			Name:        "alice",
+			Credentials: []*iam_pb.Credential{{AccessKey: "AKIATESTFAKEKEY00001", SecretKey: "testsecretfake"}},
+		}},
+	})
+	ctx := context.Background()
+
+	executeAction(t, api, url.Values{
+		"Action":      {"DeleteAccessKey"},
+		"UserName":    {"alice"},
+		"AccessKeyId": {"AKIATESTFAKEKEY00001"},
+	})
+	require.Equal(t, 0, rec.saves, "DeleteAccessKey must not SaveConfiguration")
+	require.Equal(t, 1, rec.deleteAccessKeys)
+
+	ident, err := api.credentialManager.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.Empty(t, ident.Credentials)
+	_, err = api.credentialManager.GetUserByAccessKey(ctx, "AKIATESTFAKEKEY00001")
+	require.ErrorIs(t, err, credential.ErrAccessKeyNotFound)
+}
+
+func TestEmbeddedIamUpdateAccessKeyTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{
+			Name: "alice",
+			Credentials: []*iam_pb.Credential{
+				{AccessKey: "AKIATESTFAKEKEY00001", SecretKey: "testsecretfake", Status: iamAccessKeyStatusActive},
+			},
+		}},
+	})
+	ctx := context.Background()
+
+	executeAction(t, api, url.Values{
+		"Action":      {"UpdateAccessKey"},
+		"UserName":    {"alice"},
+		"AccessKeyId": {"AKIATESTFAKEKEY00001"},
+		"Status":      {iamAccessKeyStatusInactive},
+	})
+	require.Equal(t, 0, rec.saves, "UpdateAccessKey must not SaveConfiguration")
+	require.Equal(t, 1, rec.updateUsers)
+
+	ident, err := api.credentialManager.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	require.Len(t, ident.Credentials, 1)
+	assert.Equal(t, iamAccessKeyStatusInactive, ident.Credentials[0].Status)
+}
+
+const iamTargetedTestPolicy = `{
+	"Version": "2012-10-17",
+	"Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": ["arn:aws:s3:::bench/*"]}]
+}`
+
+func TestEmbeddedIamPutUserPolicyTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}, {Name: "bob"}},
+	})
+	ctx := context.Background()
+
+	executeAction(t, api, url.Values{
+		"Action":         {"PutUserPolicy"},
+		"UserName":       {"alice"},
+		"PolicyName":     {"read-bench"},
+		"PolicyDocument": {iamTargetedTestPolicy},
+	})
+	require.Equal(t, 0, rec.saves, "PutUserPolicy must not SaveConfiguration")
+	require.Equal(t, 1, rec.updateUsers)
+
+	ident, err := api.credentialManager.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.NotEmpty(t, ident.Actions, "identity Actions must be recomputed and persisted")
+
+	doc, err := api.credentialManager.GetUserInlinePolicy(ctx, "alice", "read-bench")
+	require.NoError(t, err)
+	require.NotNil(t, doc)
+}
+
+func TestEmbeddedIamDeleteUserPolicyTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	})
+	ctx := context.Background()
+
+	executeAction(t, api, url.Values{
+		"Action":         {"PutUserPolicy"},
+		"UserName":       {"alice"},
+		"PolicyName":     {"read-bench"},
+		"PolicyDocument": {iamTargetedTestPolicy},
+	})
+	require.Equal(t, 1, rec.updateUsers)
+
+	executeAction(t, api, url.Values{
+		"Action":     {"DeleteUserPolicy"},
+		"UserName":   {"alice"},
+		"PolicyName": {"read-bench"},
+	})
+	require.Equal(t, 0, rec.saves, "DeleteUserPolicy must not SaveConfiguration")
+	require.Equal(t, 2, rec.updateUsers)
+
+	policies, err := api.credentialManager.ListUserInlinePolicies(ctx, "alice")
+	require.NoError(t, err)
+	assert.Empty(t, policies)
+	ident, err := api.credentialManager.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.Empty(t, ident.Actions)
+}
+
+func TestEmbeddedIamSetUserStatusTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	})
+	ctx := context.Background()
+
+	executeAction(t, api, url.Values{
+		"Action":   {"SetUserStatus"},
+		"UserName": {"alice"},
+		"Status":   {iamAccessKeyStatusInactive},
+	})
+	require.Equal(t, 0, rec.saves, "SetUserStatus must not SaveConfiguration")
+	require.Equal(t, 1, rec.updateUsers)
+
+	ident, err := api.credentialManager.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.True(t, ident.Disabled)
+}
+
+func TestEmbeddedIamUpdateUserRenameTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}, {Name: "bob"}},
+		Groups: []*iam_pb.Group{
+			{Name: "devs", Members: []string{"alice", "bob"}},
+			{Name: "ops", Members: []string{"bob"}},
+		},
+	})
+	ctx := context.Background()
+	// Groups in the seed config must also be created in the store directly:
+	// the memory store only surfaces groups written via CreateGroup.
+	require.NoError(t, api.credentialManager.CreateGroup(ctx, &iam_pb.Group{Name: "devs", Members: []string{"alice", "bob"}}))
+	require.NoError(t, api.credentialManager.CreateGroup(ctx, &iam_pb.Group{Name: "ops", Members: []string{"bob"}}))
+	require.NoError(t, api.credentialManager.PutUserInlinePolicy(ctx, "alice", "p1", mustParseIamTargetedTestPolicy(t)))
+
+	executeAction(t, api, url.Values{
+		"Action":      {"UpdateUser"},
+		"UserName":    {"alice"},
+		"NewUserName": {"alice-renamed"},
+	})
+	require.Equal(t, 0, rec.saves, "UpdateUser rename must not SaveConfiguration")
+
+	_, err := api.credentialManager.GetUser(ctx, "alice")
+	require.ErrorIs(t, err, credential.ErrUserNotFound)
+	_, err = api.credentialManager.GetUser(ctx, "alice-renamed")
+	require.NoError(t, err)
+
+	// Group membership and inline policies follow the rename.
+	g, err := api.credentialManager.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"alice-renamed", "bob"}, g.Members)
+	g, err = api.credentialManager.GetGroup(ctx, "ops")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"bob"}, g.Members)
+
+	policies, err := api.credentialManager.ListUserInlinePolicies(ctx, "alice-renamed")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"p1"}, policies)
+	policies, err = api.credentialManager.ListUserInlinePolicies(ctx, "alice")
+	require.NoError(t, err)
+	assert.Empty(t, policies)
+}
+
+func TestEmbeddedIamDeleteUserTargeted(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}, {Name: "bob"}},
+		Groups:     []*iam_pb.Group{{Name: "devs", Members: []string{"alice", "bob"}}},
+	})
+	ctx := context.Background()
+	require.NoError(t, api.credentialManager.CreateGroup(ctx, &iam_pb.Group{Name: "devs", Members: []string{"alice", "bob"}}))
+
+	executeAction(t, api, url.Values{
+		"Action":   {"DeleteUser"},
+		"UserName": {"alice"},
+	})
+	require.Equal(t, 0, rec.saves, "DeleteUser must not SaveConfiguration")
+	require.Equal(t, 1, rec.deleteUsers)
+	require.Equal(t, 1, rec.updateGroups)
+
+	_, err := api.credentialManager.GetUser(ctx, "alice")
+	require.ErrorIs(t, err, credential.ErrUserNotFound)
+	g, err := api.credentialManager.GetGroup(ctx, "devs")
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"bob"}, g.Members)
+	_, err = api.credentialManager.GetUser(ctx, "bob")
+	require.NoError(t, err, "other identities must be untouched")
+}
+
+// TestEmbeddedIamTargetedSkipPersist: skipPersist must suppress the targeted
+// write exactly like it suppresses the full save.
+func TestEmbeddedIamTargetedSkipPersist(t *testing.T) {
+	api, rec := newTargetedWriteTestApi(t, &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "alice"}},
+	})
+	ctx := context.Background()
+
+	for _, vals := range []url.Values{
+		{"Action": {"CreateAccessKey"}, "UserName": {"alice"}},
+		{"Action": {"SetUserStatus"}, "UserName": {"alice"}, "Status": {iamAccessKeyStatusInactive}},
+		{"Action": {"PutUserPolicy"}, "UserName": {"alice"}, "PolicyName": {"p"}, "PolicyDocument": {iamTargetedTestPolicy}},
+	} {
+		_, iamErr := api.ExecuteAction(ctx, vals, true /*skipPersist*/, "")
+		require.Nil(t, iamErr, "action %v", vals.Get("Action"))
+	}
+	assert.Equal(t, 0, rec.saves)
+	assert.Equal(t, 0, rec.createAccessKeys)
+	assert.Equal(t, 0, rec.updateUsers)
+
+	ident, err := api.credentialManager.GetUser(ctx, "alice")
+	require.NoError(t, err)
+	assert.Empty(t, ident.Credentials)
+	assert.False(t, ident.Disabled)
+}
+
+// TestEmbeddedIamStaticIdentityKeepsFullSave: static identities live outside
+// the store, so a change to one still takes the full-save path.
+func TestEmbeddedIamStaticIdentityKeepsFullSave(t *testing.T) {
+	api := NewEmbeddedIamApiForTest()
+	api.mockConfig = &iam_pb.S3ApiConfiguration{}
+	api.credentialManager.SetStaticIdentities([]*iam_pb.Identity{{Name: "static-admin"}})
+	rec := &recordingStore{MemoryStore: api.credentialManager.Store.(*memory.MemoryStore)}
+	api.credentialManager.Store = rec
+
+	// Seed via a read action; static identities are merged into the loaded config.
+	_, iamErr := api.ExecuteAction(context.Background(), url.Values{"Action": {"ListUsers"}}, false, "")
+	require.Nil(t, iamErr)
+	rec.saves = 0
+
+	executeAction(t, api, url.Values{
+		"Action":   {"SetUserStatus"},
+		"UserName": {"static-admin"},
+		"Status":   {iamAccessKeyStatusInactive},
+	})
+	assert.Equal(t, 1, rec.saves, "static identity changes keep the full-save path")
+	assert.Equal(t, 0, rec.updateUsers)
+}
+
+func mustParseIamTargetedTestPolicy(t *testing.T) (doc policy_engine.PolicyDocument) {
+	t.Helper()
+	require.NoError(t, json.Unmarshal([]byte(iamTargetedTestPolicy), &doc))
+	return doc
+}
diff --git a/weed/s3api/s3api_embedded_iam_test.go b/weed/s3api/s3api_embedded_iam_test.go
index 4e82baaa33..4269958de9 100644
--- a/weed/s3api/s3api_embedded_iam_test.go
+++ b/weed/s3api/s3api_embedded_iam_test.go
@@ -372,13 +372,13 @@ func TestEmbeddedIamGetUserImplicitUsername(t *testing.T) {
 		t.Fatalf("failed to load iam config: %v", err)
 	}
 
-	// GetUser request with NO UserName, but signed by accessKey.
+	// GetUser request with NO UserName, carrying the identity authentication
+	// verified for accessKey, the way the middleware records it.
 	form := url.Values{}
 	form.Set("Action", "GetUser")
 	req, _ := http.NewRequest(http.MethodPost, "/", strings.NewReader(form.Encode()))
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential="+accessKey+
-		"/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesig")
+	req = req.WithContext(SetIdentityNameInContext(req.Context(), "TestUser"))
 
 	out := iamGetUserResponse{}
 	rr, err := executeEmbeddedIamRequest(api, req, &out)
@@ -1043,7 +1043,7 @@ func TestEmbeddedIamAttachPolicyLimitExceeded(t *testing.T) {
 
 	response, err := executeEmbeddedIamRequest(api, req.HTTPRequest, nil)
 	assert.NoError(t, err)
-	assert.Equal(t, http.StatusForbidden, response.Code)
+	assert.Equal(t, http.StatusConflict, response.Code)
 	code, _ := extractEmbeddedIamErrorCodeAndMessage(response)
 	assert.Equal(t, iam.ErrCodeLimitExceededException, code)
 	assert.Len(t, api.mockConfig.Identities[0].PolicyNames, MaxManagedPoliciesPerUser)
@@ -1578,29 +1578,15 @@ func TestEmbeddedIamDeleteAccessKey(t *testing.T) {
 	assert.Len(t, api.mockConfig.Identities[0].Credentials, 0)
 }
 
-// TestEmbeddedIamHandleImplicitUsername tests implicit username extraction from authorization header
+// TestEmbeddedIamHandleImplicitUsername checks that the implicit user name is
+// taken from the authenticated identity in the request context, never from
+// re-parsing the Authorization header.
 func TestEmbeddedIamHandleImplicitUsername(t *testing.T) {
-	// Create IAM with test credentials - the handleImplicitUsername function now looks
-	// up the username from the credential store based on AccessKeyId
-	// Note: Using obviously fake access keys to avoid secret scanner false positives
-	iam := &IdentityAccessManagement{}
-	testConfig := &iam_pb.S3ApiConfiguration{
-		Identities: []*iam_pb.Identity{
-			{
-				Name: "testuser1",
-				Credentials: []*iam_pb.Credential{
-					{AccessKey: UserAccessKeyPrefix + "TESTFAKEKEY000001", SecretKey: "testsecretfake"},
-				},
-			},
-		},
-	}
-	err := iam.LoadS3ApiConfigurationFromBytes(mustMarshalJSON(testConfig))
-	if err != nil {
-		t.Fatalf("Failed to load test config: %v", err)
-	}
+	embeddedApi := &EmbeddedIamApi{}
 
-	embeddedApi := &EmbeddedIamApi{
-		iam: iam,
+	withIdentity := func(name string) *http.Request {
+		r := &http.Request{Header: http.Header{}}
+		return r.WithContext(SetIdentityNameInContext(r.Context(), name))
 	}
 
 	var tests = []struct {
@@ -1608,14 +1594,14 @@ func TestEmbeddedIamHandleImplicitUsername(t *testing.T) {
 		values   url.Values
 		userName string
 	}{
-		// No authorization header - should not set username
+		// No authenticated identity - should not set username
 		{&http.Request{}, url.Values{}, ""},
-		// Valid auth header with known access key - should look up and find "testuser1"
-		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=" + UserAccessKeyPrefix + "TESTFAKEKEY000001/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, "testuser1"},
-		// Malformed auth header (no Credential=) - should not set username
-		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 =" + UserAccessKeyPrefix + "TESTFAKEKEY000001/20220420/test1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
-		// Unknown access key - should not set username
-		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=" + UserAccessKeyPrefix + "TESTUNKNOWN000000/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
+		// Authenticated identity in context - sets its name
+		{withIdentity("testuser1"), url.Values{}, "testuser1"},
+		// A client-controlled Authorization header naming another user is ignored
+		{&http.Request{Header: http.Header{"Authorization": []string{"AWS4-HMAC-SHA256 Credential=" + UserAccessKeyPrefix + "TESTFAKEKEY000001/20220420/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-date, Signature=fakesignature0123456789abcdef"}}}, url.Values{}, ""},
+		// An explicit UserName is left alone
+		{withIdentity("testuser1"), url.Values{"UserName": {"other"}}, "other"},
 	}
 
 	for i, test := range tests {
@@ -1692,7 +1678,34 @@ func TestEmbeddedIamFullWorkflow(t *testing.T) {
 		assert.Equal(t, http.StatusOK, response.Code)
 	})
 
-	// 5. Delete user
+	var accessKeyId string
+	for _, ident := range api.mockConfig.Identities {
+		if ident.Name == "WorkflowUser" && len(ident.Credentials) > 0 {
+			accessKeyId = ident.Credentials[0].AccessKey
+		}
+	}
+	assert.NotEmpty(t, accessKeyId)
+
+	// 5. Deleting a user that still has an access key is refused
+	t.Run("DeleteUserConflict", func(t *testing.T) {
+		params := &iam.DeleteUserInput{UserName: aws.String("WorkflowUser")}
+		req, _ := iam.New(session.New()).DeleteUserRequest(params)
+		_ = req.Build()
+		response, err := executeEmbeddedIamRequest(api, req.HTTPRequest, nil)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusConflict, response.Code)
+	})
+
+	// 6. Delete the access key, then the user
+	t.Run("DeleteAccessKey", func(t *testing.T) {
+		params := &iam.DeleteAccessKeyInput{UserName: aws.String("WorkflowUser"), AccessKeyId: aws.String(accessKeyId)}
+		req, _ := iam.New(session.New()).DeleteAccessKeyRequest(params)
+		_ = req.Build()
+		response, err := executeEmbeddedIamRequest(api, req.HTTPRequest, nil)
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusOK, response.Code)
+	})
+
 	t.Run("DeleteUser", func(t *testing.T) {
 		params := &iam.DeleteUserInput{UserName: aws.String("WorkflowUser")}
 		req, _ := iam.New(session.New()).DeleteUserRequest(params)
@@ -1966,6 +1979,56 @@ func TestEmbeddedIamGetUserPolicyFallback(t *testing.T) {
 	assert.ElementsMatch(t, []string{"arn:aws:s3:::b-le*", "arn:aws:s3:::b-le*/*"}, stmt.Resource.Strings())
 }
 
+// TestEmbeddedIamGetUserPolicyMissingName checks that a policy name the user does not have
+// is NoSuchEntity, not a policy rebuilt from the user's other inline policies.
+func TestEmbeddedIamGetUserPolicyMissingName(t *testing.T) {
+	api := NewEmbeddedIamApiForTest()
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "steward"}},
+	}
+	api.mockConfig = s3cfg
+
+	_, iamErr := api.PutUserPolicy(s3cfg, url.Values{
+		"UserName":       []string{"steward"},
+		"PolicyName":     []string{"read"},
+		"PolicyDocument": []string{`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}]}`},
+	})
+	require.Nil(t, iamErr)
+
+	_, iamErr = api.GetUserPolicy(s3cfg, url.Values{
+		"UserName":   []string{"steward"},
+		"PolicyName": []string{"write"},
+	})
+	require.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeNoSuchEntityException, iamErr.Code)
+}
+
+// TestEmbeddedIamGetUserPolicyStoreError checks that a store failure surfaces as
+// ServiceFailure instead of rebuilding a policy from the identity's actions.
+func TestEmbeddedIamGetUserPolicyStoreError(t *testing.T) {
+	api := NewEmbeddedIamApiForTest()
+	s3cfg := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{Name: "steward"}},
+	}
+	api.mockConfig = s3cfg
+
+	_, iamErr := api.PutUserPolicy(s3cfg, url.Values{
+		"UserName":       []string{"steward"},
+		"PolicyName":     []string{"read"},
+		"PolicyDocument": []string{`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}]}`},
+	})
+	require.Nil(t, iamErr)
+
+	api.credentialManager = &credential.CredentialManager{Store: &memory.MemoryStore{}}
+
+	_, iamErr = api.GetUserPolicy(s3cfg, url.Values{
+		"UserName":   []string{"steward"},
+		"PolicyName": []string{"read"},
+	})
+	require.NotNil(t, iamErr)
+	assert.Equal(t, iam.ErrCodeServiceFailureException, iamErr.Code)
+}
+
 // TestEmbeddedIamGetUserPolicyUserNotFound tests GetUserPolicy with non-existent user
 func TestEmbeddedIamGetUserPolicyUserNotFound(t *testing.T) {
 	api := NewEmbeddedIamApiForTest()
@@ -2039,7 +2102,8 @@ func TestEmbeddedIamNotImplementedAction(t *testing.T) {
 	apiRouter.Path("/").Methods(http.MethodPost).HandlerFunc(api.DoActions)
 	apiRouter.ServeHTTP(rr, req)
 
-	assert.Equal(t, http.StatusNotImplemented, rr.Code)
+	assert.Equal(t, http.StatusNotFound, rr.Code)
+	assert.Contains(t, rr.Body.String(), "InvalidAction")
 	assert.Contains(t, rr.Body.String(), "<RequestId>")
 	assert.NotContains(t, rr.Body.String(), "<ResponseMetadata>")
 	assert.Equal(t, rr.Header().Get(request_id.AmzRequestIDHeader), extractEmbeddedIamRequestID(rr))
@@ -2132,6 +2196,114 @@ func TestEmbeddedIamGetActionsPrefixScopedResource(t *testing.T) {
 		"PutObject outside the allowed prefix should be denied")
 }
 
+// TestEmbeddedIamGetActionsMultipartListing covers the AWS names for
+// listing multipart uploads and parts: they grant only the named listing
+// operation, never a general Read on the bucket.
+func TestEmbeddedIamGetActionsMultipartListing(t *testing.T) {
+	api := NewEmbeddedIamApiForTest()
+	iam := NewIdentityAccessManagementWithStore(&S3ApiServerOption{}, nil, "memory")
+
+	// Check each action on its own so a correct mapping for one cannot hide
+	// a wrong mapping for the other.
+	for _, tc := range []struct {
+		policyAction string
+		grant        string
+		url          string
+		object       string
+	}{
+		{"s3:ListBucketMultipartUploads", "ListBucketMultipartUploads:demo", "/demo?uploads", ""},
+		{"s3:ListMultipartUploadParts", "ListMultipartUploadParts:demo", "/demo/key?uploadId=u1", "key"},
+	} {
+		t.Run(tc.policyAction, func(t *testing.T) {
+			policyDoc := `{
+				"Version": "2012-10-17",
+				"Statement": [{
+					"Effect": "Allow",
+					"Action": ["` + tc.policyAction + `"],
+					"Resource": ["arn:aws:s3:::demo", "arn:aws:s3:::demo/*"]
+				}]
+			}`
+
+			policy, err := api.GetPolicyDocument(&policyDoc)
+			require.NoError(t, err)
+
+			actions, err := api.getActions(&policy)
+			require.NoError(t, err)
+			require.NotEmpty(t, actions)
+			for _, a := range actions {
+				assert.Equal(t, tc.grant, a,
+					"%s should only grant its own listing operation", tc.policyAction)
+			}
+
+			identity := &Identity{Name: "bob"}
+			for _, a := range actions {
+				identity.Actions = append(identity.Actions, Action(a))
+			}
+
+			// The listing routes are gated on ACTION_READ, but the grant must
+			// not authorize object reads or anything else.
+			assert.False(t, identity.CanDo(ACTION_READ, "demo", "key"),
+				"a listing grant must not allow object reads")
+			assert.False(t, identity.CanDo(ACTION_WRITE, "demo", "key"),
+				"a listing grant must not allow writes")
+			assert.False(t, identity.CanDo(ACTION_LIST, "demo", ""),
+				"a listing grant must not allow ListObjects")
+
+			routed := func(url, object string) *http.Request {
+				return mux.SetURLVars(httptest.NewRequest(http.MethodGet, url, nil),
+					map[string]string{"bucket": "demo", "object": object})
+			}
+
+			req := routed(tc.url, tc.object)
+			assert.Equal(t, s3err.ErrNone, iam.VerifyActionPermission(req, identity, ACTION_READ, "demo", tc.object),
+				"the listing action should be authorized")
+			assert.Equal(t, s3err.ErrAccessDenied, iam.VerifyActionPermission(req, identity, ACTION_READ, "other", tc.object),
+				"the grant must stay scoped to the policy's bucket")
+
+			getReq := routed("/demo/key", "key")
+			assert.Equal(t, s3err.ErrAccessDenied, iam.VerifyActionPermission(getReq, identity, ACTION_READ, "demo", "key"),
+				"the grant must not authorize GetObject")
+
+			// Other ACTION_READ routes must not be authorized by a listing
+			// grant, whatever query parameters ride along.
+			policyReq := routed("/demo?policy", "")
+			assert.Equal(t, s3err.ErrAccessDenied, iam.VerifyActionPermission(policyReq, identity, ACTION_READ, "demo", ""),
+				"the grant must not authorize GetBucketPolicy")
+		})
+	}
+
+	grant := func(a string) *Identity { return &Identity{Name: "bob", Actions: []Action{Action(a)}} }
+	routed := func(url, object string) *http.Request {
+		return mux.SetURLVars(httptest.NewRequest(http.MethodGet, url, nil),
+			map[string]string{"bucket": "demo", "object": object})
+	}
+
+	// authRequestWithAuthType promotes ?prefix into the object for upload
+	// listings; the operation must still come from the route, not the prefix.
+	t.Run("upload listing with prefix", func(t *testing.T) {
+		req := routed("/demo?uploads&prefix=foo/", "")
+		assert.Equal(t, s3err.ErrNone,
+			iam.VerifyActionPermission(req, grant("ListBucketMultipartUploads:demo"), ACTION_READ, "demo", "foo/"))
+		assert.Equal(t, s3err.ErrAccessDenied,
+			iam.VerifyActionPermission(req, grant("ListMultipartUploadParts:demo"), ACTION_READ, "demo", "foo/"))
+	})
+
+	// The ?uploads route is registered before ?policy, so this reaches the
+	// upload listing handler and needs the upload listing grant.
+	t.Run("upload listing with extra subresource", func(t *testing.T) {
+		req := routed("/demo?policy&uploads", "")
+		assert.Equal(t, s3err.ErrNone,
+			iam.VerifyActionPermission(req, grant("ListBucketMultipartUploads:demo"), ACTION_READ, "demo", ""))
+		assert.Equal(t, s3err.ErrAccessDenied,
+			iam.VerifyActionPermission(req, grant("GetBucketPolicy:demo"), ACTION_READ, "demo", ""))
+	})
+
+	// Policies rebuilt from these grants must use valid action names.
+	for _, a := range []string{ACTION_LIST_MULTIPART_UPLOADS, ACTION_LIST_PARTS} {
+		assert.Equal(t, a, iamMapToIdentitiesAction(a))
+	}
+}
+
 // TestEmbeddedIamPutUserPolicyAllResourceWildcard reproduces issue #9209:
 // an AWS-style policy using "Action":"s3:*" with a bare "Resource":"*" is
 // valid AWS IAM syntax (meaning "any resource") but was rejected with
@@ -2831,3 +3003,43 @@ func TestEmbeddedIamReadOnly(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, http.StatusOK, responseList.Code)
 }
+
+func TestWriteIamErrorResponseMapping(t *testing.T) {
+	tests := []struct {
+		name       string
+		code       string
+		wantStatus int
+	}{
+		{"NoSuchEntity", iam.ErrCodeNoSuchEntityException, http.StatusNotFound},
+		{"EntityAlreadyExists", iam.ErrCodeEntityAlreadyExistsException, http.StatusConflict},
+		{"InvalidInput", iam.ErrCodeInvalidInputException, http.StatusBadRequest},
+		{"LimitExceeded", iam.ErrCodeLimitExceededException, http.StatusConflict},
+		{"DeleteConflict", iam.ErrCodeDeleteConflictException, http.StatusConflict},
+		{"InvalidAction", "InvalidAction", http.StatusNotFound},
+		{"AccessDenied", "AccessDenied", http.StatusForbidden},
+		{"InvalidClientTokenId", "InvalidClientTokenId", http.StatusForbidden},
+		{"SignatureDoesNotMatch", "SignatureDoesNotMatch", http.StatusForbidden},
+		{"IncompleteSignature", "IncompleteSignature", http.StatusBadRequest},
+		{"ServiceFailure", iam.ErrCodeServiceFailureException, http.StatusInternalServerError},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			r := httptest.NewRequest(http.MethodPost, "/", nil)
+			writeIamErrorResponse(rec, r, "req-1", &iamError{Code: tt.code, Error: fmt.Errorf("boom")})
+			assert.Equal(t, tt.wantStatus, rec.Code)
+			body := rec.Body.String()
+			assert.True(t, strings.HasPrefix(strings.TrimSpace(body), "<ErrorResponse") ||
+				strings.Contains(body, "<ErrorResponse"), "expected IAM ErrorResponse envelope, got %s", body)
+			assert.Contains(t, body, "<Code>"+tt.code+"</Code>")
+		})
+	}
+}
+
+func TestIamAuthErrorCode(t *testing.T) {
+	assert.Equal(t, "InvalidClientTokenId", iamAuthErrorCode(s3err.ErrInvalidAccessKeyID))
+	assert.Equal(t, "SignatureDoesNotMatch", iamAuthErrorCode(s3err.ErrSignatureDoesNotMatch))
+	assert.Equal(t, "AccessDenied", iamAuthErrorCode(s3err.ErrAccessDenied))
+	assert.Equal(t, "RequestTimeTooSkewed", iamAuthErrorCode(s3err.ErrRequestTimeTooSkewed))
+	assert.Equal(t, "IncompleteSignature", iamAuthErrorCode(s3err.ErrMissingFields))
+}
diff --git a/weed/s3api/s3api_embedded_iam_user_tags_test.go b/weed/s3api/s3api_embedded_iam_user_tags_test.go
index 07c2b4e25c..ba9a5f389a 100644
--- a/weed/s3api/s3api_embedded_iam_user_tags_test.go
+++ b/weed/s3api/s3api_embedded_iam_user_tags_test.go
@@ -200,7 +200,7 @@ func TestEmbeddedIamTagUserLimitExceeded(t *testing.T) {
 	form.Set("Tags.member.1.Value", "v")
 	rr := postTagAction(t, api, form)
 
-	assert.Equal(t, http.StatusForbidden, rr.Code)
+	assert.Equal(t, http.StatusConflict, rr.Code)
 	code, _ := extractEmbeddedIamErrorCodeAndMessage(rr)
 	assert.Equal(t, iam.ErrCodeLimitExceededException, code)
 
diff --git a/weed/s3api/s3api_encrypted_volume_copy_test.go b/weed/s3api/s3api_encrypted_volume_copy_test.go
index 169a0f6162..bef2de1e8a 100644
--- a/weed/s3api/s3api_encrypted_volume_copy_test.go
+++ b/weed/s3api/s3api_encrypted_volume_copy_test.go
@@ -2,6 +2,8 @@ package s3api
 
 import (
 	"bytes"
+	"context"
+	"io"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -173,3 +175,202 @@ func TestEncryptedVolumeCopyScenario(t *testing.T) {
 		t.Log("✓ All chunk metadata properly preserved for encrypted volume copy scenario")
 	})
 }
+
+// A volume-encrypted source must take the re-encrypting UploadPartCopy path:
+// the raw chunk copy slices ciphertext the destination's whole-chunk cipher key
+// can no longer decrypt, and reports the part's ETag from chunks that carry
+// none (issue #10968).
+func TestSourceEntryIsEncryptedForVolumeCipher(t *testing.T) {
+	testCases := []struct {
+		name  string
+		entry *filer_pb.Entry
+		want  bool
+	}{
+		{
+			name:  "nil entry",
+			entry: nil,
+		},
+		{
+			name: "plaintext chunks",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, ETag: "etag1"},
+			}},
+		},
+		{
+			name: "volume-encrypted chunk",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, CipherKey: util.GenCipherKey()},
+			}},
+			want: true,
+		},
+		{
+			name: "volume-encrypted second chunk",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, ETag: "etag1"},
+				{FileId: "2,def456", Offset: 1024, Size: 1024, CipherKey: util.GenCipherKey()},
+			}},
+			want: true,
+		},
+		{
+			name: "SSE-S3 chunk",
+			entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,abc123", Size: 1024, SseType: filer_pb.SSEType_SSE_S3},
+			}},
+			want: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := sourceEntryIsEncrypted(tc.entry); got != tc.want {
+				t.Errorf("sourceEntryIsEncrypted = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// A ranged part copy asks the chunk stream for its slice; reading the whole
+// object and discarding the prefix would make an N-part copy read the source
+// N/2 times over.
+func TestGetEncryptedStreamFromVolumesRangesInlineContent(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := &filer_pb.Entry{Content: []byte("0123456789")}
+
+	testCases := []struct {
+		name   string
+		offset int64
+		size   int64
+		want   string
+	}{
+		{name: "whole content", size: 10, want: "0123456789"},
+		{name: "leading slice", size: 4, want: "0123"},
+		{name: "middle slice", offset: 3, size: 4, want: "3456"},
+		{name: "trailing slice", offset: 6, size: 4, want: "6789"},
+		{name: "size past the end", offset: 8, size: 10, want: "89"},
+		{name: "offset past the end", offset: 10, size: 4},
+		{name: "empty range", size: 0},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			reader, err := s3a.getEncryptedStreamFromVolumes(context.Background(), entry, tc.offset, tc.size)
+			if err != nil {
+				t.Fatalf("getEncryptedStreamFromVolumes: %v", err)
+			}
+			defer reader.Close()
+			got, err := io.ReadAll(reader)
+			if err != nil {
+				t.Fatalf("read: %v", err)
+			}
+			if string(got) != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestDetermineUnifiedCopyStrategySSES3(t *testing.T) {
+	testCases := []struct {
+		name     string
+		state    *EncryptionState
+		expected UnifiedCopyStrategy
+	}{
+		{
+			name: "SSE-S3 to SSE-S3 direct copy",
+			state: &EncryptionState{
+				SrcSSES3: true,
+				DstSSES3: true,
+			},
+			expected: CopyStrategyDirect,
+		},
+		{
+			name: "SSE-S3 to plain decrypt copy",
+			state: &EncryptionState{
+				SrcSSES3: true,
+				DstSSES3: false,
+			},
+			expected: CopyStrategyDecrypt,
+		},
+		{
+			name: "Plain to SSE-S3 encrypt copy",
+			state: &EncryptionState{
+				SrcSSES3: false,
+				DstSSES3: true,
+			},
+			expected: CopyStrategyEncrypt,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			strategy, err := DetermineUnifiedCopyStrategy(tc.state, nil, nil)
+			if err != nil {
+				t.Fatalf("DetermineUnifiedCopyStrategy failed: %v", err)
+			}
+			if strategy != tc.expected {
+				t.Errorf("expected strategy %v, got %v", tc.expected, strategy)
+			}
+		})
+	}
+}
+
+func TestDecryptChunkVolumeCipher(t *testing.T) {
+	s3a := &S3ApiServer{}
+	plainData := []byte("hello-seaweedfs-encrypted-volume-data-verification-test")
+
+	t.Run("unencrypted chunk passes through", func(t *testing.T) {
+		chunk := &filer_pb.FileChunk{
+			CipherKey: nil,
+		}
+		got, err := s3a.decryptChunkVolumeCipher(plainData, chunk)
+		if err != nil {
+			t.Fatalf("decryptChunkVolumeCipher failed: %v", err)
+		}
+		if !bytes.Equal(got, plainData) {
+			t.Fatalf("expected %q, got %q", plainData, got)
+		}
+	})
+
+	t.Run("volume cipher encrypted chunk decrypts correctly", func(t *testing.T) {
+		cipherKey := util.GenCipherKey()
+		encrypted, err := util.Encrypt(plainData, cipherKey)
+		if err != nil {
+			t.Fatalf("Encrypt failed: %v", err)
+		}
+
+		chunk := &filer_pb.FileChunk{
+			CipherKey: cipherKey,
+		}
+		got, err := s3a.decryptChunkVolumeCipher(encrypted, chunk)
+		if err != nil {
+			t.Fatalf("decryptChunkVolumeCipher failed: %v", err)
+		}
+		if !bytes.Equal(got, plainData) {
+			t.Fatalf("expected %q, got %q", plainData, got)
+		}
+	})
+
+	t.Run("volume cipher encrypted and compressed chunk decrypts correctly", func(t *testing.T) {
+		cipherKey := util.GenCipherKey()
+		compressed, err := util.GzipData(plainData)
+		if err != nil {
+			t.Fatalf("GzipData failed: %v", err)
+		}
+		encrypted, err := util.Encrypt(compressed, cipherKey)
+		if err != nil {
+			t.Fatalf("Encrypt failed: %v", err)
+		}
+
+		chunk := &filer_pb.FileChunk{
+			CipherKey:    cipherKey,
+			IsCompressed: true,
+		}
+		got, err := s3a.decryptChunkVolumeCipher(encrypted, chunk)
+		if err != nil {
+			t.Fatalf("decryptChunkVolumeCipher failed: %v", err)
+		}
+		if !bytes.Equal(got, plainData) {
+			t.Fatalf("expected %q, got %q", plainData, got)
+		}
+	})
+}
diff --git a/weed/s3api/s3api_governance_permissions_test.go b/weed/s3api/s3api_governance_permissions_test.go
index 22403ddaf2..9c05fbcd13 100644
--- a/weed/s3api/s3api_governance_permissions_test.go
+++ b/weed/s3api/s3api_governance_permissions_test.go
@@ -179,19 +179,15 @@ func TestCheckGovernanceBypassPermissionIntegrationBehavior(t *testing.T) {
 	// This test documents the expected behavior when checkGovernanceBypassPermission
 	// is called with a full IAM system:
 	//
-	// 1. Function calls s3a.iam.authRequest() with the bypass action
+	// 1. Function calls s3a.iam.authRequest() with the base bypass action;
+	//    authRequest derives the bucket and object resource from the request.
 	// 2. If authRequest returns errCode != s3err.ErrNone, function returns false
-	// 3. If authRequest succeeds, function checks identity.CanDo() with the bypass action
-	// 4. If CanDo() returns true, function returns true
-	// 5. If bypass permission fails, function checks admin action with identity.CanDo()
-	// 6. If admin action succeeds, function returns true and logs admin access
-	// 7. If all checks fail, function returns false
+	// 3. If authRequest succeeds through a legacy action, IAM/STS policy, bucket
+	//    policy, or Admin grant, function returns true without a second legacy check.
 	//
 	// The function correctly uses:
 	// - s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION for bypass permission
-	// - s3_constants.ACTION_ADMIN for admin permission
-	// - Proper resource path generation with bucket/object format
-	// - Trimming of leading slashes from object names
+	// - The normal authRequest resource and Admin semantics
 }
 
 // TestGovernanceBypassPermission was removed because it tested the old
diff --git a/weed/s3api/s3api_handlers.go b/weed/s3api/s3api_handlers.go
index 52c2d0cf3b..baaf58435a 100644
--- a/weed/s3api/s3api_handlers.go
+++ b/weed/s3api/s3api_handlers.go
@@ -6,10 +6,12 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/connectivity"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -17,10 +19,20 @@ import (
 
 var _ = filer_pb.FilerClient(&S3ApiServer{})
 
+// WithFilerClient satisfies filer_pb.FilerClient, whose signature carries no
+// context. Callers with a budget to spend call withFilerClient directly.
 func (s3a *S3ApiServer) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return s3a.withFilerClient(context.Background(), streamingMode, fn)
+}
+
+// withFilerClient runs fn with ctx as the budget bounding the calls fn makes. It
+// cancels nothing itself -- fn owns its own RPC contexts -- but the walk needs to
+// know whose budget ran out: a caller's expiry is not evidence against the filer
+// that was answering it.
+func (s3a *S3ApiServer) withFilerClient(ctx context.Context, streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error {
 	// Use filerClient for proper connection management and failover
 	if s3a.filerClient != nil {
-		return s3a.withFilerClientFailover("", streamingMode, fn)
+		return s3a.withFilerClientFailover(ctx, "", streamingMode, true, fn)
 	}
 
 	// Fallback to direct connection if filerClient not initialized
@@ -40,7 +52,20 @@ func (s3a *S3ApiServer) WithFilerClient(streamingMode bool, fn func(filer_pb.Sea
 // caller route to a key's ring owner for read-after-write; it may be a filer outside
 // the static list (the bookkeeping no-ops for untracked addresses). A failover
 // updates the current filer; a preferred read does not, as its owner is per-key.
-func (s3a *S3ApiServer) withFilerClientFailover(preferred pb.ServerAddress, streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+// Failover replays fn from scratch, so it stops once any response has reached
+// fn: a replay after that could silently duplicate state fn accumulated (a
+// listing that failed mid-stream, say), so the error surfaces instead and the
+// caller decides whether a clean-slate retry is safe. ctx is the budget bounding
+// fn's own calls; it is only read, to tell a filer's failure apart from the
+// caller running out of time.
+//
+// replayable=false is for requests that must not be re-sent once possibly
+// applied (a committed transaction whose response was lost is
+// indistinguishable from one that never arrived): such fn runs only on a
+// channel that just proved ready, and any error it returns ends the walk —
+// moving to the next filer is reserved for channels that never got ready, the
+// one failure mode that provably sent nothing.
+func (s3a *S3ApiServer) withFilerClientFailover(ctx context.Context, preferred pb.ServerAddress, streamingMode bool, replayable bool, fn func(filer_pb.SeaweedFilerClient) error) error {
 	currentFiler := s3a.filerClient.GetCurrentFiler()
 
 	candidates := make([]pb.ServerAddress, 0, 2+len(s3a.option.Filers))
@@ -82,8 +107,17 @@ func (s3a *S3ApiServer) withFilerClientFailover(preferred pb.ServerAddress, stre
 
 	var lastErr error
 	for _, filer := range ordered {
+		received := false
+		fnRan := false
+		// Background, not ctx: WithGrpcClient's context only decides whether an
+		// error invalidates the shared connection, and that call is fn's to make,
+		// with the context fn's own RPC ran on.
 		err := pb.WithGrpcClient(context.Background(), streamingMode, s3a.randomClientId, func(grpcConnection *grpc.ClientConn) error {
-			return fn(filer_pb.NewSeaweedFilerClient(grpcConnection))
+			if !replayable && !filerConnReady(ctx, grpcConnection) {
+				return errFilerConnNotReady
+			}
+			fnRan = true
+			return fn(filer_pb.NewSeaweedFilerClient(receiveTrackingConn{ClientConnInterface: grpcConnection, received: &received}))
 		}, filer.ToGrpcAddress(), false, s3a.option.GrpcDialOption)
 
 		if err == nil {
@@ -98,6 +132,21 @@ func (s3a *S3ApiServer) withFilerClientFailover(preferred pb.ServerAddress, stre
 			return err
 		}
 
+		// The caller's own budget expiring is not evidence against this filer, and
+		// the next one has no time left to answer either. Recorded as a failure, a
+		// slow master upstream would flag every filer in the walk, and the three
+		// that open the circuit take unrelated object reads down with them.
+		if ctx.Err() != nil {
+			glog.V(2).Infof("WithFilerClient: giving up on %s, the caller's context ended: %v", filer, err)
+			return err
+		}
+
+		// fn consumed part of a response; a replay would stack a second copy
+		// onto whatever it accumulated, so surface the error unwrapped. The filer
+		// answered, so this also says nothing about its health.
+		if received {
+			return err
+		}
 		s3a.filerClient.RecordFilerFailure(filer)
 		// A preferred owner is often outside the static filer list, where the health
 		// tracking above no-ops; flag it so route-by-key reads skip it briefly.
@@ -105,6 +154,11 @@ func (s3a *S3ApiServer) withFilerClientFailover(preferred pb.ServerAddress, stre
 			s3a.markOwnerUnreachable(filer)
 		}
 		glog.V(2).Infof("WithFilerClient: filer %s failed: %v", filer, err)
+		// A non-replayable fn that ran may have committed server-side; only a
+		// channel that never became ready proves nothing was sent.
+		if !replayable && fnRan {
+			return err
+		}
 		lastErr = err
 	}
 
@@ -114,6 +168,69 @@ func (s3a *S3ApiServer) withFilerClientFailover(preferred pb.ServerAddress, stre
 	return fmt.Errorf("all filers failed, last error: %w", lastErr)
 }
 
+// errFilerConnNotReady marks a candidate whose channel never became usable, so
+// the request was provably never sent and the walk may continue.
+var errFilerConnNotReady = errors.New("filer connection not ready")
+
+// filerConnReadyWait bounds how long a candidate gets to bring its channel up
+// before the walk tries the next filer.
+const filerConnReadyWait = 2 * time.Second
+
+func filerConnReady(ctx context.Context, conn *grpc.ClientConn) bool {
+	readyCtx, cancel := context.WithTimeout(ctx, filerConnReadyWait)
+	defer cancel()
+	conn.Connect()
+	for {
+		s := conn.GetState()
+		if s == connectivity.Ready {
+			return true
+		}
+		if s == connectivity.TransientFailure || s == connectivity.Shutdown {
+			return false
+		}
+		if !conn.WaitForStateChange(readyCtx, s) {
+			return false
+		}
+	}
+}
+
+// receiveTrackingConn flags *received once a unary reply or a streamed message
+// has been handed to the callback, the point past which a failover replay is
+// no longer transparent.
+type receiveTrackingConn struct {
+	grpc.ClientConnInterface
+	received *bool
+}
+
+func (c receiveTrackingConn) Invoke(ctx context.Context, method string, args, reply any, opts ...grpc.CallOption) error {
+	err := c.ClientConnInterface.Invoke(ctx, method, args, reply, opts...)
+	if err == nil {
+		*c.received = true
+	}
+	return err
+}
+
+func (c receiveTrackingConn) NewStream(ctx context.Context, desc *grpc.StreamDesc, method string, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+	stream, err := c.ClientConnInterface.NewStream(ctx, desc, method, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return receiveTrackingStream{ClientStream: stream, received: c.received}, nil
+}
+
+type receiveTrackingStream struct {
+	grpc.ClientStream
+	received *bool
+}
+
+func (s receiveTrackingStream) RecvMsg(m any) error {
+	err := s.ClientStream.RecvMsg(m)
+	if err == nil {
+		*s.received = true
+	}
+	return err
+}
+
 func (s3a *S3ApiServer) AdjustedUrl(location *filer_pb.Location) string {
 	return location.Url
 }
diff --git a/weed/s3api/s3api_handlers_failover_test.go b/weed/s3api/s3api_handlers_failover_test.go
new file mode 100644
index 0000000000..4606d6b23d
--- /dev/null
+++ b/weed/s3api/s3api_handlers_failover_test.go
@@ -0,0 +1,189 @@
+package s3api
+
+import (
+	"context"
+	"io"
+	"math"
+	"reflect"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+// fakeListFiler serves ListEntries from names; the first failCalls calls die
+// with Unavailable after streaming sendBeforeFail entries.
+type fakeListFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	names          []string
+	failCalls      int32
+	sendBeforeFail int
+	calls          int32
+}
+
+func (f *fakeListFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	names := f.names
+	failing := atomic.AddInt32(&f.calls, 1) <= f.failCalls
+	if failing {
+		names = names[:f.sendBeforeFail]
+	}
+	for _, name := range names {
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: &filer_pb.Entry{Name: name}}); err != nil {
+			return err
+		}
+	}
+	if failing {
+		return status.Error(codes.Unavailable, "filer restarting")
+	}
+	return nil
+}
+
+func newFailoverTestServer(t *testing.T, filers ...pb.ServerAddress) *S3ApiServer {
+	t.Helper()
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	return &S3ApiServer{
+		option:      &S3ApiServerOption{Filers: filers, GrpcDialOption: dialOption},
+		filerClient: wdclient.NewFilerClient(filers, dialOption, ""),
+	}
+}
+
+// accumulateListing is the callback shape the failover contract has to protect:
+// entries collect into a variable that survives a replay of the callback.
+func accumulateListing(got *[]string) func(filer_pb.SeaweedFilerClient) error {
+	return func(client filer_pb.SeaweedFilerClient) error {
+		stream, err := client.ListEntries(context.Background(), &filer_pb.ListEntriesRequest{Directory: "/d"})
+		if err != nil {
+			return err
+		}
+		for {
+			resp, err := stream.Recv()
+			if err == io.EOF {
+				return nil
+			}
+			if err != nil {
+				return err
+			}
+			*got = append(*got, resp.Entry.Name)
+		}
+	}
+}
+
+// A filer that dies mid-stream must surface the error, not fail over: the
+// callback has already consumed part of the response, and replaying it against
+// the next filer would append a second copy of what it accumulated.
+func TestFailoverStopsAfterPartialResponse(t *testing.T) {
+	names := []string{"e1", "e2", "e3", "e4"}
+	flaky := &fakeListFiler{names: names, failCalls: math.MaxInt32, sendBeforeFail: 2}
+	healthy := &fakeListFiler{names: names}
+	s3a := newFailoverTestServer(t, startFakeFiler(t, flaky), startFakeFiler(t, healthy))
+
+	var got []string
+	err := s3a.WithFilerClient(true, accumulateListing(&got))
+	if err == nil {
+		t.Fatalf("want the mid-stream failure surfaced, got success with %v", got)
+	}
+	if calls := atomic.LoadInt32(&healthy.calls); calls != 0 {
+		t.Fatalf("callback was replayed on the second filer %d time(s)", calls)
+	}
+}
+
+// A filer that fails before delivering anything is still failed over, so the
+// partial-response guard does not cost the healthy-peer retry that failover exists for.
+func TestFailoverBeforeFirstResponse(t *testing.T) {
+	names := []string{"e1", "e2", "e3", "e4"}
+	flaky := &fakeListFiler{names: names, failCalls: math.MaxInt32, sendBeforeFail: 0}
+	healthy := &fakeListFiler{names: names}
+	s3a := newFailoverTestServer(t, startFakeFiler(t, flaky), startFakeFiler(t, healthy))
+
+	var got []string
+	err := s3a.WithFilerClient(true, accumulateListing(&got))
+	if err != nil {
+		t.Fatalf("want failover success, got %v", err)
+	}
+	if !reflect.DeepEqual(got, names) {
+		t.Fatalf("entries = %v, want %v", got, names)
+	}
+}
+
+// End to end through the real listing path: a mid-stream failure surfaces to
+// listWithRetry, whose replay starts from a fresh accumulator, so the caller
+// sees each entry exactly once instead of a silently duplicated prefix.
+func TestListAfterMidStreamFailureHasNoDuplicates(t *testing.T) {
+	names := []string{"e1", "e2", "e3", "e4"}
+	flaky := &fakeListFiler{names: names, failCalls: 1, sendBeforeFail: 2}
+	healthy := &fakeListFiler{names: names}
+	s3a := newFailoverTestServer(t, startFakeFiler(t, flaky), startFakeFiler(t, healthy))
+
+	entries, isLast, err := s3a.list("/d", "", "", false, 10)
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	var got []string
+	for _, entry := range entries {
+		got = append(got, entry.Name)
+	}
+	if !reflect.DeepEqual(got, names) {
+		t.Fatalf("entries = %v, want %v", got, names)
+	}
+	if !isLast {
+		t.Fatal("want isLast")
+	}
+}
+
+// hangingCollectionFiler answers CollectionList only when the caller gives up,
+// standing in for a filer waiting on a master that has stopped answering.
+type hangingCollectionFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	calls atomic.Int32
+}
+
+func (f *hangingCollectionFiler) CollectionList(ctx context.Context, _ *filer_pb.CollectionListRequest) (*filer_pb.CollectionListResponse, error) {
+	f.calls.Add(1)
+	<-ctx.Done()
+	return nil, ctx.Err()
+}
+
+// The caller's own budget expiring says nothing about the filer that was
+// answering it. Counted as a filer failure it would, after the three that open
+// the circuit, mark every filer in the walk unhealthy -- and LookupVolumeIds
+// skips unhealthy filers, so unrelated object reads would start failing over a
+// slow master they never touched.
+func TestFailoverDoesNotBlameFilersForTheCallersExpiredBudget(t *testing.T) {
+	first := &hangingCollectionFiler{}
+	second := &hangingCollectionFiler{}
+	firstAddr := startFakeFiler(t, first)
+	secondAddr := startFakeFiler(t, second)
+	s3a := newFailoverTestServer(t, firstAddr, secondAddr)
+
+	// More attempts than the three failures it takes to open the circuit.
+	for attempt := 0; attempt < 5; attempt++ {
+		ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+		err := s3a.withFilerClient(ctx, false, func(client filer_pb.SeaweedFilerClient) error {
+			_, listErr := client.CollectionList(ctx, &filer_pb.CollectionListRequest{})
+			return listErr
+		})
+		cancel()
+		if err == nil {
+			t.Fatalf("attempt %d: want the expired budget surfaced as an error", attempt)
+		}
+	}
+
+	for _, addr := range []pb.ServerAddress{firstAddr, secondAddr} {
+		if s3a.filerClient.ShouldSkipUnhealthyFiler(addr) {
+			t.Errorf("filer %s was flagged unhealthy for the caller's own timeout; unrelated reads would now skip it", addr)
+		}
+	}
+
+	// And the walk stops rather than spending an already-spent budget on the next
+	// filer, which cannot answer any faster.
+	if n := second.calls.Load(); n != 0 {
+		t.Errorf("the second filer was tried %d times with no budget left to answer in", n)
+	}
+}
diff --git a/weed/s3api/s3api_head_bucket_test.go b/weed/s3api/s3api_head_bucket_test.go
new file mode 100644
index 0000000000..d83308c57b
--- /dev/null
+++ b/weed/s3api/s3api_head_bucket_test.go
@@ -0,0 +1,94 @@
+package s3api
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"path"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+type fakeLookupFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entry     *filer_pb.Entry
+	lookupErr error
+	deleted   []string
+}
+
+func (f *fakeLookupFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if f.lookupErr != nil {
+		return nil, f.lookupErr
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: f.entry}, nil
+}
+
+func (f *fakeLookupFiler) DeleteEntry(ctx context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	f.deleted = append(f.deleted, path.Join(req.Directory, req.Name))
+	f.entry = nil
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+func newHeadBucketTestServer(t *testing.T, impl filer_pb.SeaweedFilerServer) *S3ApiServer {
+	t.Helper()
+	filers := []pb.ServerAddress{startFakeFiler(t, impl)}
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	return &S3ApiServer{
+		option:      &S3ApiServerOption{Filers: filers, GrpcDialOption: dialOption, BucketsPath: "/buckets"},
+		filerClient: wdclient.NewFilerClient(filers, dialOption, ""),
+	}
+}
+
+// A lookup that fails for a reason other than "not found" must not be reported
+// as a missing bucket: a 404 is a definite answer and stops the client retrying.
+func TestHeadBucketSeparatesLookupFailureFromMissingBucket(t *testing.T) {
+	const bucket = "head-bucket"
+	cases := []struct {
+		name     string
+		filer    *fakeLookupFiler
+		wantCode int
+	}{
+		{
+			name:     "transient lookup failure",
+			filer:    &fakeLookupFiler{lookupErr: status.Error(codes.Internal, "filer store unavailable")},
+			wantCode: http.StatusInternalServerError,
+		},
+		{
+			name:     "missing bucket",
+			filer:    &fakeLookupFiler{},
+			wantCode: http.StatusNotFound,
+		},
+		{
+			name:     "existing bucket",
+			filer:    &fakeLookupFiler{entry: &filer_pb.Entry{Name: bucket, IsDirectory: true}},
+			wantCode: http.StatusOK,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s3a := newHeadBucketTestServer(t, tc.filer)
+			req := httptest.NewRequest(http.MethodHead, "/"+bucket, nil)
+			req = mux.SetURLVars(req, map[string]string{"bucket": bucket})
+			rr := httptest.NewRecorder()
+
+			s3a.HeadBucketHandler(rr, req)
+
+			if rr.Code != tc.wantCode {
+				t.Fatalf("status = %d, want %d: %s", rr.Code, tc.wantCode, rr.Body.String())
+			}
+			// HEAD returns the status without an XML error body, including for
+			// lookup failures and missing buckets.
+			if rr.Body.Len() != 0 {
+				t.Fatalf("HEAD response must have an empty body, got %q", rr.Body.String())
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_iam_oidc_test.go b/weed/s3api/s3api_iam_oidc_test.go
index cd503672cb..0889885ce4 100644
--- a/weed/s3api/s3api_iam_oidc_test.go
+++ b/weed/s3api/s3api_iam_oidc_test.go
@@ -2,6 +2,10 @@ package s3api
 
 import (
 	"context"
+	"fmt"
+	"github.com/aws/aws-sdk-go/service/iam"
+	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"testing"
 	"time"
@@ -394,3 +398,17 @@ func TestUpdateThumbprintAndTags(t *testing.T) {
 		t.Fatalf("Tags should be empty after untag, got: %v", gr.Tags)
 	}
 }
+
+// A refusal to change a config-file provider reaches the client as AWS sends
+// it (400 UnmodifiableEntity), not as an internal error clients retry.
+func TestUnmodifiableEntityIsAClientError(t *testing.T) {
+	rec := httptest.NewRecorder()
+	writeIamErrorResponse(rec, httptest.NewRequest(http.MethodPost, "/", nil), "req-1",
+		oidcMutationError(fmt.Errorf("%w: arn:aws:iam:::oidc-provider/static.example", integration.ErrOIDCProviderStatic)))
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if code, _ := extractEmbeddedIamErrorCodeAndMessage(rec); code != iam.ErrCodeUnmodifiableEntityException {
+		t.Fatalf("code = %q, want UnmodifiableEntity", code)
+	}
+}
diff --git a/weed/s3api/s3api_iam_role_test.go b/weed/s3api/s3api_iam_role_test.go
new file mode 100644
index 0000000000..985c3e8a3b
--- /dev/null
+++ b/weed/s3api/s3api_iam_role_test.go
@@ -0,0 +1,340 @@
+package s3api
+
+import (
+	"context"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/service/iam"
+	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const spiffeTrustPolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow",` +
+	`"Principal":{"Federated":"https://oidc.example"},"Action":["sts:AssumeRoleWithWebIdentity"],` +
+	`"Condition":{"StringEquals":{"oidc:sub":"spiffe://example.org/ns/app/sa/app"}}}]}`
+
+func roleAction(t *testing.T, api *EmbeddedIamApiForTest, params map[string]string) (iamlib.RequestIDSetter, *iamError) {
+	t.Helper()
+	values := url.Values{}
+	for k, v := range params {
+		values.Set(k, v)
+	}
+	return api.ExecuteAction(context.Background(), values, true, "role-test")
+}
+
+func requireIamCode(t *testing.T, iamErr *iamError, code string) {
+	t.Helper()
+	require.NotNil(t, iamErr, "expected %s", code)
+	assert.Equal(t, code, iamErr.Code, "error: %v", iamErr.Error)
+}
+
+func newRoleTestAPI(t *testing.T) (*EmbeddedIamApiForTest, *integration.IAMManager) {
+	t.Helper()
+	api, mgr := newOIDCTestAPI(t)
+	doc := policy_engine.PolicyDocument{Version: "2012-10-17", Statement: []policy_engine.PolicyStatement{{
+		Effect:   policy_engine.PolicyEffectAllow,
+		Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+		Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::bucket/*"),
+	}}}
+	require.NoError(t, api.credentialManager.CreatePolicy(context.Background(), "read-bucket", doc))
+	return api, mgr
+}
+
+func TestRoleLifecycle(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+
+	resp, iamErr := roleAction(t, api, map[string]string{
+		"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy,
+		"Description": "app runtime", "MaxSessionDuration": "3600",
+	})
+	require.Nil(t, iamErr)
+	created := resp.(*iamlib.CreateRoleResponse).CreateRoleResult.Role
+	assert.Equal(t, "arn:aws:iam::role/app", created.Arn)
+	assert.NotEmpty(t, created.RoleId)
+	assert.NotEmpty(t, created.CreateDate)
+	decoded, err := url.PathUnescape(created.AssumeRolePolicyDocument)
+	require.NoError(t, err)
+	assert.Contains(t, decoded, "spiffe://example.org/ns/app/sa/app")
+
+	// The role is the one STS evaluates.
+	stored, err := mgr.GetRole(context.Background(), "app")
+	require.NoError(t, err)
+	assert.Equal(t, "https://oidc.example", stored.TrustPolicy.Statement[0].Principal.(map[string]interface{})["Federated"])
+
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionAttachRolePolicy, "RoleName": "app", "PolicyArn": "arn:aws:iam:::policy/read-bucket"})
+	require.Nil(t, iamErr)
+	resp, iamErr = roleAction(t, api, map[string]string{"Action": actionListAttachedRolePolicies, "RoleName": "app"})
+	require.Nil(t, iamErr)
+	attached := resp.(*iamlib.ListAttachedRolePoliciesResponse).ListAttachedRolePoliciesResult.AttachedPolicies
+	require.Len(t, attached, 1)
+	assert.Equal(t, "read-bucket", attached[0].PolicyName)
+
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionDeleteRole, "RoleName": "app"})
+	requireIamCode(t, iamErr, iam.ErrCodeDeleteConflictException)
+
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionDetachRolePolicy, "RoleName": "app", "PolicyArn": "arn:aws:iam:::policy/read-bucket"})
+	require.Nil(t, iamErr)
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionDeleteRole, "RoleName": "app"})
+	require.Nil(t, iamErr)
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionGetRole, "RoleName": "app"})
+	requireIamCode(t, iamErr, iam.ErrCodeNoSuchEntityException)
+}
+
+func TestUpdateAssumeRolePolicyReplacesTheTrustPolicy(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	require.Nil(t, iamErr)
+
+	updated := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Federated":"https://other.example"},"Action":["sts:AssumeRoleWithWebIdentity"]}]}`
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionUpdateAssumeRolePolicy, "RoleName": "app", "PolicyDocument": updated})
+	require.Nil(t, iamErr)
+	stored, err := mgr.GetRole(context.Background(), "app")
+	require.NoError(t, err)
+	assert.Equal(t, "https://other.example", stored.TrustPolicy.Statement[0].Principal.(map[string]interface{})["Federated"])
+}
+
+func TestRoleActionsRefuseWhatTheyCannotHonour(t *testing.T) {
+	api, _ := newRoleTestAPI(t)
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	require.Nil(t, iamErr)
+
+	cases := []struct {
+		name   string
+		params map[string]string
+		code   string
+	}{
+		{"duplicate", map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy}, iam.ErrCodeEntityAlreadyExistsException},
+		{"no trust policy", map[string]string{"Action": actionCreateRole, "RoleName": "b"}, iam.ErrCodeInvalidInputException},
+		{"malformed trust policy", map[string]string{"Action": actionCreateRole, "RoleName": "b", "AssumeRolePolicyDocument": "{"}, iam.ErrCodeMalformedPolicyDocumentException},
+		{"path", map[string]string{"Action": actionCreateRole, "RoleName": "b", "Path": "/team/", "AssumeRolePolicyDocument": spiffeTrustPolicy}, iam.ErrCodeInvalidInputException},
+		{"tags", map[string]string{"Action": actionCreateRole, "RoleName": "b", "Tags.member.1.Key": "k", "Tags.member.1.Value": "v", "AssumeRolePolicyDocument": spiffeTrustPolicy}, iam.ErrCodeInvalidInputException},
+		{"session out of bounds", map[string]string{"Action": actionCreateRole, "RoleName": "b", "MaxSessionDuration": "60", "AssumeRolePolicyDocument": spiffeTrustPolicy}, iam.ErrCodeInvalidInputException},
+		{"attach missing policy", map[string]string{"Action": actionAttachRolePolicy, "RoleName": "app", "PolicyArn": "arn:aws:iam:::policy/nope"}, iam.ErrCodeNoSuchEntityException},
+		{"detach unattached", map[string]string{"Action": actionDetachRolePolicy, "RoleName": "app", "PolicyArn": "arn:aws:iam:::policy/read-bucket"}, iam.ErrCodeNoSuchEntityException},
+		{"missing role", map[string]string{"Action": actionDeleteRole, "RoleName": "nope"}, iam.ErrCodeNoSuchEntityException},
+		{"name leaving the role store", map[string]string{"Action": actionCreateRole, "RoleName": "../identities/admin", "AssumeRolePolicyDocument": spiffeTrustPolicy}, iam.ErrCodeInvalidInputException},
+		{"name too long", map[string]string{"Action": actionCreateRole, "RoleName": strings.Repeat("a", 65), "AssumeRolePolicyDocument": spiffeTrustPolicy}, iam.ErrCodeInvalidInputException},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, iamErr := roleAction(t, api, tc.params)
+			requireIamCode(t, iamErr, tc.code)
+		})
+	}
+}
+
+// A role from the IAM config file is reloaded from it at every start, so an
+// API change to it would be silently reverted; it is refused instead.
+func TestConfigFileRolesAreUnmodifiable(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+	trust, iamErr := parseTrustPolicy(spiffeTrustPolicy)
+	require.Nil(t, iamErr)
+	require.NoError(t, mgr.CreateRole(context.Background(), "", "from-file", &integration.RoleDefinition{
+		RoleName: "from-file", TrustPolicy: trust, Source: integration.RoleSourceStaticConfig,
+	}))
+
+	for _, params := range []map[string]string{
+		{"Action": actionDeleteRole, "RoleName": "from-file"},
+		{"Action": actionUpdateAssumeRolePolicy, "RoleName": "from-file", "PolicyDocument": spiffeTrustPolicy},
+		{"Action": actionAttachRolePolicy, "RoleName": "from-file", "PolicyArn": "arn:aws:iam:::policy/read-bucket"},
+		{"Action": actionDetachRolePolicy, "RoleName": "from-file", "PolicyArn": "arn:aws:iam:::policy/read-bucket"},
+	} {
+		t.Run(params["Action"], func(t *testing.T) {
+			_, iamErr := roleAction(t, api, params)
+			requireIamCode(t, iamErr, iam.ErrCodeUnmodifiableEntityException)
+		})
+	}
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionGetRole, "RoleName": "from-file"})
+	assert.Nil(t, iamErr, "reading a config-file role is allowed")
+}
+
+func TestReadOnlyAllowsRoleReadsAndDeniesMutations(t *testing.T) {
+	api, _ := newRoleTestAPI(t)
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	require.Nil(t, iamErr)
+	api.readOnly = true
+
+	for _, action := range []string{actionGetRole, actionListRoles, actionListAttachedRolePolicies} {
+		_, iamErr := roleAction(t, api, map[string]string{"Action": action, "RoleName": "app"})
+		assert.Nil(t, iamErr, "%s must be allowed in read-only mode", action)
+	}
+	for _, action := range []string{actionCreateRole, actionDeleteRole, actionUpdateAssumeRolePolicy, actionAttachRolePolicy, actionDetachRolePolicy} {
+		_, iamErr := roleAction(t, api, map[string]string{"Action": action, "RoleName": "app"})
+		assert.NotNil(t, iamErr, "%s must be denied in read-only mode", action)
+	}
+}
+
+// unreadableRoleStore fails every read the way an unreachable filer does.
+type unreadableRoleStore struct{ *integration.MemoryRoleStore }
+
+func (unreadableRoleStore) GetRole(context.Context, string, string) (*integration.RoleDefinition, error) {
+	return nil, errors.New("lookup role: filer unavailable")
+}
+
+// An unreadable store is not an absent role: CreateRole must not write over a
+// role it could not see, and the reads must not report NoSuchEntity.
+func TestRoleActionsTreatAnUnreadableStoreAsAFailureNotAnAbsence(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+	store := unreadableRoleStore{integration.NewMemoryRoleStore()}
+	mgr.SetRoleStore(store)
+
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	requireIamCode(t, iamErr, iam.ErrCodeServiceFailureException)
+	names, err := store.ListRoles(context.Background(), "")
+	require.NoError(t, err)
+	assert.Empty(t, names, "CreateRole wrote through a store it could not read")
+
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionGetRole, "RoleName": "app"})
+	requireIamCode(t, iamErr, iam.ErrCodeServiceFailureException)
+}
+
+// A policy is attached to a role by name, so deleting it while attached would
+// let a policy created later under that name take effect on the role. It is
+// refused, as for users and groups.
+func TestDeletePolicyAttachedToARoleIsAConflict(t *testing.T) {
+	api, _ := newRoleTestAPI(t)
+	// The test API replaces the credential store with mockConfig on the first
+	// action that loads the configuration, so the policy has to be declared
+	// there too.
+	api.mockConfig.Policies = append(api.mockConfig.Policies, &iam_pb.Policy{
+		Name:    "read-bucket",
+		Content: `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::bucket/*"]}]}`,
+	})
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	require.Nil(t, iamErr)
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionAttachRolePolicy, "RoleName": "app", "PolicyArn": "arn:aws:iam:::policy/read-bucket"})
+	require.Nil(t, iamErr)
+
+	_, iamErr = roleAction(t, api, map[string]string{"Action": "DeletePolicy", "PolicyArn": "arn:aws:iam:::policy/read-bucket"})
+	requireIamCode(t, iamErr, iam.ErrCodeDeleteConflictException)
+
+	_, iamErr = roleAction(t, api, map[string]string{"Action": actionDetachRolePolicy, "RoleName": "app", "PolicyArn": "arn:aws:iam:::policy/read-bucket"})
+	require.Nil(t, iamErr)
+	_, iamErr = roleAction(t, api, map[string]string{"Action": "DeletePolicy", "PolicyArn": "arn:aws:iam:::policy/read-bucket"})
+	assert.Nil(t, iamErr, "a detached policy could not be deleted")
+}
+
+func TestAttachRolePolicyStopsAtTheRoleQuota(t *testing.T) {
+	api, _ := newRoleTestAPI(t)
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	require.Nil(t, iamErr)
+	doc := policy_engine.PolicyDocument{Version: "2012-10-17", Statement: []policy_engine.PolicyStatement{{
+		Effect: policy_engine.PolicyEffectAllow, Action: policy_engine.NewStringOrStringSlice("s3:GetObject"),
+		Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::bucket/*"),
+	}}}
+	for i := 0; i <= integration.MaxManagedPoliciesPerRole; i++ {
+		name := fmt.Sprintf("p%d", i)
+		require.NoError(t, api.credentialManager.CreatePolicy(context.Background(), name, doc))
+		_, iamErr = roleAction(t, api, map[string]string{"Action": actionAttachRolePolicy, "RoleName": "app", "PolicyArn": "arn:aws:iam:::policy/" + name})
+		if i < integration.MaxManagedPoliciesPerRole {
+			require.Nil(t, iamErr, "attach %d", i)
+		}
+	}
+	requireIamCode(t, iamErr, iam.ErrCodeLimitExceededException)
+}
+
+// A role without a creation time omits CreateDate rather than sending it
+// empty, which clients cannot parse.
+func TestRoleWithoutACreationTimeOmitsCreateDate(t *testing.T) {
+	out, err := xml.Marshal(toIAMRole(&integration.RoleDefinition{RoleName: "r", RoleArn: "arn:aws:iam::role/r"}))
+	require.NoError(t, err)
+	assert.NotContains(t, string(out), "CreateDate")
+}
+
+// Roles take no tags, so any tag parameter is refused rather than dropped.
+func TestCreateRoleRefusesEveryTagParameter(t *testing.T) {
+	api, _ := newRoleTestAPI(t)
+	for _, key := range []string{"Tags.member.1.Key", "Tags.member.2.Key", "Tags.member.1.Value"} {
+		_, iamErr := roleAction(t, api, map[string]string{
+			"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy, key: "x",
+		})
+		requireIamCode(t, iamErr, iam.ErrCodeInvalidInputException)
+	}
+}
+
+// unwritableRoleStore fails every write the way an unreachable filer does.
+type unwritableRoleStore struct{ *integration.MemoryRoleStore }
+
+func (unwritableRoleStore) UpdateRole(context.Context, string, string, integration.RoleUpdate) error {
+	return errors.New("store role: filer unavailable")
+}
+
+// A store that cannot be written is a service failure, which clients retry;
+// only a bad request is InvalidInput.
+func TestCreateRoleReportsAFailedWriteAsAServiceFailure(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+	mgr.SetRoleStore(unwritableRoleStore{integration.NewMemoryRoleStore()})
+
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	requireIamCode(t, iamErr, iam.ErrCodeServiceFailureException)
+
+	_, iamErr = roleAction(t, api, map[string]string{
+		"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy, "MaxSessionDuration": "60",
+	})
+	requireIamCode(t, iamErr, iam.ErrCodeInvalidInputException)
+}
+
+// racingRoleStore reports every role absent to plain reads while the store
+// holds them: the view of a server whose create raced another server's.
+type racingRoleStore struct{ *integration.MemoryRoleStore }
+
+func (racingRoleStore) GetRole(_ context.Context, _ string, name string) (*integration.RoleDefinition, error) {
+	return nil, fmt.Errorf("%w: %s", integration.ErrRoleNotFound, name)
+}
+
+// Of two creates of one name, the second is told the role exists; it does
+// not replace the first role.
+func TestCreateRoleRacingAnotherCreateIsEntityAlreadyExists(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+	store := racingRoleStore{integration.NewMemoryRoleStore()}
+	require.NoError(t, store.StoreRole(context.Background(), "", "app", &integration.RoleDefinition{RoleName: "app", RoleId: "AROA-FIRST"}))
+	mgr.SetRoleStore(store)
+
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	requireIamCode(t, iamErr, iam.ErrCodeEntityAlreadyExistsException)
+	role, err := store.MemoryRoleStore.GetRole(context.Background(), "", "app")
+	require.NoError(t, err)
+	assert.Equal(t, "AROA-FIRST", role.RoleId, "the second create replaced the first role")
+}
+
+// vanishingRoleStore lists a role that is gone by the time it is read.
+type vanishingRoleStore struct{ *integration.MemoryRoleStore }
+
+func (s vanishingRoleStore) ListRoles(ctx context.Context, filerAddress string) ([]string, error) {
+	names, err := s.MemoryRoleStore.ListRoles(ctx, filerAddress)
+	return append(names, "deleted-meanwhile"), err
+}
+
+func TestListRolesSkipsARoleDeletedWhileListing(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+	mgr.SetRoleStore(vanishingRoleStore{integration.NewMemoryRoleStore()})
+	_, iamErr := roleAction(t, api, map[string]string{"Action": actionCreateRole, "RoleName": "app", "AssumeRolePolicyDocument": spiffeTrustPolicy})
+	require.Nil(t, iamErr)
+
+	resp, iamErr := roleAction(t, api, map[string]string{"Action": actionListRoles})
+	require.Nil(t, iamErr)
+	roles := resp.(*iamlib.ListRolesResponse).ListRolesResult.Roles
+	require.Len(t, roles, 1)
+	assert.Equal(t, "app", roles[0].RoleName)
+}
+
+// Peer role changes are watched in the role store's own directory.
+func TestRoleChangesAreWatchedInTheRoleStoresDirectory(t *testing.T) {
+	api, mgr := newRoleTestAPI(t)
+	s3a := &S3ApiServer{iam: api.iam}
+	assert.Equal(t, rolesDir, s3a.roleStoreDir(), "a memory store falls back to the default directory")
+
+	store, err := integration.NewGenericCachedRoleStore(map[string]interface{}{"basePath": "/custom/roles"}, func() string { return "localhost:8888" })
+	require.NoError(t, err)
+	mgr.SetRoleStore(store)
+	assert.Equal(t, "/custom/roles", s3a.roleStoreDir())
+}
diff --git a/weed/s3api/s3api_iceberg_credentials.go b/weed/s3api/s3api_iceberg_credentials.go
new file mode 100644
index 0000000000..967a5a79df
--- /dev/null
+++ b/weed/s3api/s3api_iceberg_credentials.go
@@ -0,0 +1,241 @@
+package s3api
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+// icebergVendedCredentialsProvider names the origin recorded on sessions the
+// catalog mints, so audit trails can tell them apart from ordinary logins.
+const icebergVendedCredentialsProvider = "iceberg-catalog"
+
+// SetIcebergCredentialRole configures the role the Iceberg catalog assumes when
+// a client asks for vended credentials. Vending stays off until it is set.
+func (s3a *S3ApiServer) SetIcebergCredentialRole(roleArn string, durationSeconds int64) {
+	s3a.icebergCredentialRole = strings.TrimSpace(roleArn)
+	s3a.icebergCredentialDuration = durationSeconds
+}
+
+// VendedCredentials are short-lived S3 credentials scoped to one table.
+type VendedCredentials struct {
+	AccessKeyID     string
+	SecretAccessKey string
+	SessionToken    string
+	Expiration      time.Time
+}
+
+// VendTableCredentials mints credentials that can read exactly one table's
+// prefix, and write it too unless readOnly, for a caller the Iceberg catalog
+// has already authenticated and authorized. Returns nil when no role is
+// configured, which leaves the catalog telling the client to keep using its
+// own credentials.
+//
+// The access key the caller authenticated with (from ctx) is recorded in the
+// session: a short hash of it ends the session name, so the audit log's
+// requester_arn tells apart the holders of several keys on one identity. When
+// the caller is a stored identity holding that key, the key id is also carried
+// in the session token, binding the session to it: the session ends when the
+// key is deleted or deactivated, or its identity removed or disabled
+// (validateSTSSessionToken).
+func (s3a *S3ApiServer) VendTableCredentials(ctx context.Context, principal, bucket, prefix string, readOnly bool) (*VendedCredentials, error) {
+	if s3a.icebergCredentialRole == "" {
+		return nil, nil
+	}
+	if principal == "" {
+		return nil, fmt.Errorf("no principal to vend credentials for")
+	}
+	if bucket == "" {
+		return nil, fmt.Errorf("no bucket to scope credentials to")
+	}
+
+	stsService := s3a.stsService()
+	if stsService == nil {
+		return nil, fmt.Errorf("STS is not configured")
+	}
+
+	policy, err := tablePrefixSessionPolicy(bucket, prefix, readOnly)
+	if err != nil {
+		return nil, err
+	}
+
+	accessKey := s3_constants.AccessKeyIdFromContext(ctx)
+	request := &sts.AssumeRoleForPrincipalRequest{
+		RoleArn:           s3a.icebergCredentialRole,
+		Principal:         principal,
+		RoleSessionName:   icebergSessionName(principal, bucket, prefix, accessKey),
+		ProviderName:      icebergVendedCredentialsProvider,
+		Policy:            &policy,
+		SourceAccessKeyId: accessKey,
+	}
+	// Bind the session to the caller's key when the caller authenticated with a
+	// stored identity's key — a marker its verifier records, so a caller that
+	// signed with an STS session key or OIDC token stays unbound even when its
+	// principal names a stored identity, whose session a binding would refuse
+	// on every request. The marker survives the key being revoked between
+	// authentication and this vend: the session then dies on its first request
+	// instead of living unbound until it expires. The binding travels under
+	// its own claim — SourceAccessKeyId is audit-only for compatibility with
+	// tokens minted before the binding existed.
+	if storedKey, storedSecret := s3_constants.StoredCredentialFromContext(ctx); storedKey != "" {
+		request.BoundAccessKeyId = storedKey
+		request.BoundAccessKeyFingerprint = s3_constants.StoredCredentialFingerprint(s3a.iam.stsSigningKey(), storedKey, storedSecret)
+	}
+	if s3a.icebergCredentialDuration > 0 {
+		duration := s3a.icebergCredentialDuration
+		request.DurationSeconds = &duration
+	}
+
+	resp, err := stsService.AssumeRoleForPrincipal(ctx, request)
+	if err != nil {
+		return nil, err
+	}
+	if resp == nil || resp.Credentials == nil {
+		return nil, fmt.Errorf("STS returned no credentials")
+	}
+
+	return &VendedCredentials{
+		AccessKeyID:     resp.Credentials.AccessKeyId,
+		SecretAccessKey: resp.Credentials.SecretAccessKey,
+		SessionToken:    resp.Credentials.SessionToken,
+		Expiration:      resp.Credentials.Expiration,
+	}, nil
+}
+
+func (s3a *S3ApiServer) stsService() *sts.STSService {
+	if s3a.iam == nil {
+		return nil
+	}
+	return s3a.iam.stsService()
+}
+
+func (iam *IdentityAccessManagement) stsService() *sts.STSService {
+	if iam.iamIntegration == nil {
+		return nil
+	}
+	provider, ok := iam.iamIntegration.(IAMManagerProvider)
+	if !ok {
+		return nil
+	}
+	manager := provider.GetIAMManager()
+	if manager == nil {
+		return nil
+	}
+	return manager.GetSTSService()
+}
+
+func (iam *IdentityAccessManagement) stsSigningKey() []byte {
+	if s := iam.stsService(); s != nil && s.Config != nil {
+		return s.Config.SigningKey
+	}
+	return nil
+}
+
+// tablePrefixSessionPolicy narrows a session to one table's files plus the
+// bucket listing that clients need to resolve them. A read-only session drops
+// the write verbs: the catalog vends no more authority than the caller holds.
+func tablePrefixSessionPolicy(bucket, prefix string, readOnly bool) (string, error) {
+	prefix = strings.Trim(prefix, "/")
+	// A resource pattern is matched with wildcards, so a location carrying one
+	// would widen the session to sibling tables. Refuse rather than escape it:
+	// nothing SeaweedFS generates contains these.
+	if strings.ContainsAny(bucket, "*?") || strings.ContainsAny(prefix, "*?") {
+		return "", fmt.Errorf("refusing to scope credentials to a location with wildcards: s3://%s/%s", bucket, prefix)
+	}
+	// Without a prefix there is nothing to scope to, and the session would carry
+	// read and write over every table in the bucket. A table registered at the
+	// bucket root is the only way to get here.
+	if prefix == "" {
+		return "", fmt.Errorf("refusing to scope credentials to a whole bucket: s3://%s", bucket)
+	}
+
+	objectActions := []string{"s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts"}
+	if readOnly {
+		objectActions = []string{"s3:GetObject"}
+	}
+
+	policy := map[string]interface{}{
+		"Version": "2012-10-17",
+		"Statement": []map[string]interface{}{
+			{
+				"Effect":   "Allow",
+				"Action":   objectActions,
+				"Resource": []string{fmt.Sprintf("arn:aws:s3:::%s/%s/*", bucket, prefix)},
+			},
+			{
+				// Listing is granted on the bucket, so without the condition the
+				// session could enumerate every other table's object names.
+				"Effect":   "Allow",
+				"Action":   []string{"s3:ListBucket"},
+				"Resource": []string{fmt.Sprintf("arn:aws:s3:::%s", bucket)},
+				"Condition": map[string]interface{}{
+					"StringLike": map[string]interface{}{
+						"s3:prefix": []string{prefix, prefix + "/*"},
+					},
+				},
+			},
+			{
+				// GetBucketLocation carries no prefix to condition on, so it sits
+				// in its own statement rather than being denied by one.
+				// ListBucketMultipartUploads is deliberately absent: Iceberg
+				// writers complete and abort by upload id, and granting it either
+				// leaks in-flight keys bucket-wide or breaks on the same missing
+				// prefix.
+				"Effect":   "Allow",
+				"Action":   []string{"s3:GetBucketLocation"},
+				"Resource": []string{fmt.Sprintf("arn:aws:s3:::%s", bucket)},
+			},
+		},
+	}
+
+	encoded, err := json.Marshal(policy)
+	if err != nil {
+		return "", fmt.Errorf("build session policy: %w", err)
+	}
+	return string(encoded), nil
+}
+
+// icebergSessionKeyTagLength is the hex length of the access key hash that ends
+// a vended session's name: 48 bits, so two keys of one identity collide with
+// odds of about 2^-48.
+const icebergSessionKeyTagLength = 12
+
+// icebergSessionKeyTag is "-k" and the first icebergSessionKeyTagLength hex
+// digits of the SHA-256 of the access key id, or "" without a key.
+func icebergSessionKeyTag(accessKey string) string {
+	if accessKey == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte(accessKey))
+	return "-k" + hex.EncodeToString(sum[:])[:icebergSessionKeyTagLength]
+}
+
+// icebergSessionName builds a session name that identifies the caller, the
+// table and the caller's access key in audit logs, within the 64-character AWS
+// limit. The key tag is never cut: the table part gives way to it.
+func icebergSessionName(principal, bucket, prefix, accessKey string) string {
+	name := fmt.Sprintf("iceberg-%s-%s", principal, strings.ReplaceAll(strings.Trim(prefix, "/"), "/", "-"))
+	if strings.Trim(prefix, "/") == "" {
+		name = fmt.Sprintf("iceberg-%s-%s", principal, bucket)
+	}
+	name = strings.Map(func(r rune) rune {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '-', r == '_':
+			return r
+		default:
+			return '-'
+		}
+	}, name)
+	tag := icebergSessionKeyTag(accessKey)
+	if limit := 64 - len(tag); len(name) > limit {
+		name = name[:limit]
+	}
+	return name + tag
+}
diff --git a/weed/s3api/s3api_iceberg_credentials_test.go b/weed/s3api/s3api_iceberg_credentials_test.go
new file mode 100644
index 0000000000..bdca1bf5da
--- /dev/null
+++ b/weed/s3api/s3api_iceberg_credentials_test.go
@@ -0,0 +1,208 @@
+package s3api
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func TestTablePrefixSessionPolicyScopesToTheTable(t *testing.T) {
+	raw, err := tablePrefixSessionPolicy("warehouse", "analytics/events", false)
+	if err != nil {
+		t.Fatalf("tablePrefixSessionPolicy() error = %v", err)
+	}
+
+	var policy struct {
+		Statement []struct {
+			Effect   string   `json:"Effect"`
+			Action   []string `json:"Action"`
+			Resource []string `json:"Resource"`
+		} `json:"Statement"`
+	}
+	if err := json.Unmarshal([]byte(raw), &policy); err != nil {
+		t.Fatalf("policy is not valid JSON: %v", err)
+	}
+	// objects, conditioned bucket listing, and unconditioned location lookup
+	if len(policy.Statement) != 3 {
+		t.Fatalf("policy has %d statements, want 3", len(policy.Statement))
+	}
+
+	objects := policy.Statement[0]
+	if objects.Resource[0] != "arn:aws:s3:::warehouse/analytics/events/*" {
+		t.Errorf("object resource = %q, want the table prefix only", objects.Resource[0])
+	}
+	if policy.Statement[1].Resource[0] != "arn:aws:s3:::warehouse" {
+		t.Errorf("bucket resource = %q", policy.Statement[1].Resource[0])
+	}
+	for _, statement := range policy.Statement {
+		if statement.Effect != "Allow" {
+			t.Errorf("statement effect = %q, want Allow", statement.Effect)
+		}
+	}
+}
+
+// A caller the catalog would not let commit gets a session that can read the
+// table's files and nothing more.
+func TestTablePrefixSessionPolicyReadOnly(t *testing.T) {
+	raw, err := tablePrefixSessionPolicy("warehouse", "analytics/events", true)
+	if err != nil {
+		t.Fatalf("tablePrefixSessionPolicy() error = %v", err)
+	}
+
+	var policy struct {
+		Statement []struct {
+			Action []string `json:"Action"`
+		} `json:"Statement"`
+	}
+	if err := json.Unmarshal([]byte(raw), &policy); err != nil {
+		t.Fatalf("policy is not valid JSON: %v", err)
+	}
+
+	for _, statement := range policy.Statement {
+		for _, action := range statement.Action {
+			switch action {
+			case "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts":
+				t.Errorf("read-only session policy grants %s", action)
+			}
+		}
+	}
+	if got := policy.Statement[0].Action; len(got) != 1 || got[0] != "s3:GetObject" {
+		t.Errorf("object actions = %v, want [s3:GetObject]", got)
+	}
+}
+
+// A table at the bucket root has no prefix to scope to, and vending would hand
+// out read and write over every other table in the bucket.
+func TestTablePrefixSessionPolicyRefusesAWholeBucket(t *testing.T) {
+	if _, err := tablePrefixSessionPolicy("warehouse", "", false); err == nil {
+		t.Error("tablePrefixSessionPolicy() error = nil, want a refusal for an empty prefix")
+	}
+	if _, err := tablePrefixSessionPolicy("warehouse", "/", false); err == nil {
+		t.Error("a prefix of only separators was accepted")
+	}
+}
+
+// GetBucketLocation carries no prefix, so conditioning it would deny location
+// discovery to every vended credential.
+func TestTablePrefixSessionPolicyLeavesBucketLocationUnconditioned(t *testing.T) {
+	raw, err := tablePrefixSessionPolicy("warehouse", "analytics/events", false)
+	if err != nil {
+		t.Fatalf("tablePrefixSessionPolicy() error = %v", err)
+	}
+
+	var policy struct {
+		Statement []struct {
+			Action    []string       `json:"Action"`
+			Condition map[string]any `json:"Condition"`
+		} `json:"Statement"`
+	}
+	if err := json.Unmarshal([]byte(raw), &policy); err != nil {
+		t.Fatalf("policy is not valid JSON: %v", err)
+	}
+
+	for _, statement := range policy.Statement {
+		for _, action := range statement.Action {
+			if action == "s3:GetBucketLocation" && statement.Condition != nil {
+				t.Errorf("s3:GetBucketLocation carries a condition it can never satisfy: %v", statement.Condition)
+			}
+			if action == "s3:ListBucketMultipartUploads" {
+				t.Error("s3:ListBucketMultipartUploads is granted; it cannot be scoped by prefix")
+			}
+		}
+	}
+}
+
+func TestIcebergSessionNameIsBounded(t *testing.T) {
+	name := icebergSessionName(strings.Repeat("principal", 10), "warehouse", "ns/table", "")
+	if len(name) > 64 {
+		t.Errorf("session name is %d chars, want at most 64", len(name))
+	}
+	for _, r := range name {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z', r >= '0' && r <= '9', r == '-', r == '_':
+		default:
+			t.Errorf("session name %q contains %q, which AWS rejects", name, r)
+		}
+	}
+}
+
+// Vending stays off until an operator names a role, so the catalog keeps
+// telling clients to use their own credentials.
+func TestVendTableCredentialsDisabledWithoutRole(t *testing.T) {
+	s3a := &S3ApiServer{}
+	credentials, err := s3a.VendTableCredentials(context.Background(), "admin", "warehouse", "ns/t", false)
+	if err != nil {
+		t.Fatalf("VendTableCredentials() error = %v, want nil", err)
+	}
+	if credentials != nil {
+		t.Errorf("VendTableCredentials() = %v, want nil while no role is configured", credentials)
+	}
+}
+
+func TestVendTableCredentialsNeedsSTS(t *testing.T) {
+	s3a := &S3ApiServer{}
+	s3a.SetIcebergCredentialRole("arn:aws:iam::role/IcebergTableAccess", 3600)
+
+	if _, err := s3a.VendTableCredentials(context.Background(), "admin", "warehouse", "ns/t", false); err == nil {
+		t.Error("VendTableCredentials() error = nil, want an error when STS is not configured")
+	}
+}
+
+// Listing is granted on the bucket, so the prefix condition is what keeps a
+// vended credential from enumerating other tables.
+func TestTablePrefixSessionPolicyRestrictsListing(t *testing.T) {
+	raw, err := tablePrefixSessionPolicy("warehouse", "analytics/events", false)
+	if err != nil {
+		t.Fatalf("tablePrefixSessionPolicy() error = %v", err)
+	}
+
+	var policy struct {
+		Statement []struct {
+			Action    []string                       `json:"Action"`
+			Condition map[string]map[string][]string `json:"Condition"`
+		} `json:"Statement"`
+	}
+	if err := json.Unmarshal([]byte(raw), &policy); err != nil {
+		t.Fatalf("policy is not valid JSON: %v", err)
+	}
+
+	var bucketStatement *struct {
+		Action    []string                       `json:"Action"`
+		Condition map[string]map[string][]string `json:"Condition"`
+	}
+	for i := range policy.Statement {
+		for _, action := range policy.Statement[i].Action {
+			if action == "s3:ListBucket" {
+				bucketStatement = &policy.Statement[i]
+			}
+		}
+	}
+	if bucketStatement == nil {
+		t.Fatal("no statement grants s3:ListBucket")
+	}
+
+	prefixes := bucketStatement.Condition["StringLike"]["s3:prefix"]
+	want := map[string]bool{"analytics/events": true, "analytics/events/*": true}
+	if len(prefixes) != len(want) {
+		t.Fatalf("s3:prefix = %v, want %v", prefixes, want)
+	}
+	for _, prefix := range prefixes {
+		if !want[prefix] {
+			t.Errorf("s3:prefix contains %q, which is outside the table", prefix)
+		}
+	}
+}
+
+// A location carrying a wildcard would widen the resource pattern to sibling
+// tables, so it is refused instead of vended.
+func TestTablePrefixSessionPolicyRefusesWildcards(t *testing.T) {
+	for _, prefix := range []string{"analytics/*", "analytics/ev?nts", "*"} {
+		if _, err := tablePrefixSessionPolicy("warehouse", prefix, false); err == nil {
+			t.Errorf("tablePrefixSessionPolicy(%q) error = nil, want a refusal", prefix)
+		}
+	}
+	if _, err := tablePrefixSessionPolicy("ware*house", "analytics/events", false); err == nil {
+		t.Error("a wildcard in the bucket name was accepted")
+	}
+}
diff --git a/weed/s3api/s3api_iceberg_session_name_test.go b/weed/s3api/s3api_iceberg_session_name_test.go
new file mode 100644
index 0000000000..2fd679d24d
--- /dev/null
+++ b/weed/s3api/s3api_iceberg_session_name_test.go
@@ -0,0 +1,100 @@
+package s3api
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+func TestIcebergSessionNameWithoutKeyIsUnchanged(t *testing.T) {
+	assert.Equal(t, "iceberg-analytics-ns-t", icebergSessionName("analytics", "b", "ns/t", ""))
+	assert.Equal(t, "iceberg-anonymous-ns-t", icebergSessionName("anonymous", "b", "ns/t", ""))
+}
+
+func TestIcebergSessionNameEndsWithTheKeyTag(t *testing.T) {
+	a := icebergSessionName("analytics", "b", "ns/t", sharedKeyA)
+	b := icebergSessionName("analytics", "b", "ns/t", sharedKeyB)
+	assert.NotEqual(t, a, b, "two keys of one identity must give distinguishable session names")
+	for _, name := range []string{a, b} {
+		assert.True(t, strings.HasPrefix(name, "iceberg-analytics-ns-t-k"), name)
+		assert.Len(t, name, len("iceberg-analytics-ns-t-k")+icebergSessionKeyTagLength)
+	}
+	assert.Equal(t, a, icebergSessionName("analytics", "b", "ns/t", sharedKeyA), "the tag is stable")
+	assert.NotContains(t, a, sharedKeyA, "the name carries a hash, not the key id")
+}
+
+// A long identity and table give way to the tag; the tag is never cut.
+func TestIcebergSessionNameKeepsTheWholeTagWithinTheLimit(t *testing.T) {
+	principal := "svc-0b6f6d1c-6f1e-4c1a-9f57-3a8f4c0f1d2e"
+	name := icebergSessionName(principal, "b", "a_long_namespace/a_long_table_name", sharedKeyA)
+	tag := icebergSessionKeyTag(sharedKeyA)
+	assert.LessOrEqual(t, len(name), 64)
+	assert.True(t, strings.HasSuffix(name, tag), name)
+	assert.True(t, strings.HasPrefix(name, "iceberg-"+principal), name)
+	for _, r := range name {
+		ok := r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || r == '-' || r == '_'
+		assert.True(t, ok, "session name %q contains %q", name, r)
+	}
+	long := icebergSessionName(strings.Repeat("principal", 10), "b", "ns/t", sharedKeyB)
+	assert.Len(t, long, 64)
+	assert.True(t, strings.HasSuffix(long, icebergSessionKeyTag(sharedKeyB)))
+}
+
+// The vendor reads the caller's key from the request context.
+func TestVendTableCredentialsReadsTheKeyFromTheContext(t *testing.T) {
+	ctx := s3_constants.SetAccessKeyIdInContext(context.Background(), sharedKeyA)
+	assert.Equal(t, sharedKeyA, s3_constants.AccessKeyIdFromContext(ctx))
+	assert.Equal(t, "", s3_constants.AccessKeyIdFromContext(context.Background()))
+}
+
+// VendTableCredentials mints a real session from the caller's key: the session
+// name ends with the key's tag and the token carries the key id.
+func TestVendTableCredentialsRecordsTheCallersKey(t *testing.T) {
+	mgr := newTestIAMManager(t)
+	require.NoError(t, mgr.CreateRole(context.Background(), "", "IcebergTableAccess", &integration.RoleDefinition{
+		RoleName: "IcebergTableAccess",
+		TrustPolicy: &policy.PolicyDocument{
+			Version: "2012-10-17",
+			Statement: []policy.Statement{{
+				Effect:    "Allow",
+				Principal: map[string]interface{}{"Federated": icebergVendedCredentialsProvider},
+				Action:    []string{"sts:AssumeRoleWithCredentials"},
+			}},
+		},
+	}))
+	iam := newSharedIdentityIAM()
+	iam.SetIAMIntegration(NewS3IAMIntegration(mgr, ""))
+	s3a := &S3ApiServer{iam: iam}
+	s3a.SetIcebergCredentialRole("arn:aws:iam::role/IcebergTableAccess", 3600)
+
+	for _, k := range []struct{ id, secret string }{{sharedKeyA, sharedSecretA}, {sharedKeyB, sharedSecretB}, {"", ""}} {
+		key := k.id
+		ctx := context.Background()
+		if key != "" {
+			// As the catalog's auth does: the holder is installed, the verifier records into it.
+			r := s3_constants.EnsureIdentityHolder(httptest.NewRequest(http.MethodGet, "/", nil))
+			s3_constants.RecordAccessKeyId(r.Context(), key)
+			s3_constants.RecordStoredAccessKeyId(r.Context(), k.id, k.secret)
+			ctx = r.Context()
+		}
+		creds, err := s3a.VendTableCredentials(ctx, "shared-user", "warehouse", "ns/t", false)
+		require.NoError(t, err)
+		require.NotNil(t, creds)
+		info, err := s3a.stsService().ValidateSessionToken(context.Background(), creds.SessionToken)
+		require.NoError(t, err)
+		assert.Equal(t, key, info.SourceAccessKeyId, "key %q", key)
+		assert.Equal(t, icebergSessionName("shared-user", "warehouse", "ns/t", key), info.SessionName, "key %q", key)
+		if key != "" {
+			assert.Contains(t, info.SessionName, icebergSessionKeyTag(key))
+		}
+	}
+}
diff --git a/weed/s3api/s3api_iceberg_vended_session_test.go b/weed/s3api/s3api_iceberg_vended_session_test.go
new file mode 100644
index 0000000000..9b9398cf0f
--- /dev/null
+++ b/weed/s3api/s3api_iceberg_vended_session_test.go
@@ -0,0 +1,234 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// vendingServer is an S3ApiServer whose catalog role trusts the vendor, with
+// the identity of newSharedIdentityIAM (one identity, two keys).
+func vendingServer(t *testing.T) *S3ApiServer {
+	t.Helper()
+	mgr := newTestIAMManager(t)
+	require.NoError(t, mgr.CreateRole(context.Background(), "", "IcebergTableAccess", &integration.RoleDefinition{
+		RoleName: "IcebergTableAccess",
+		TrustPolicy: &policy.PolicyDocument{
+			Version: "2012-10-17",
+			Statement: []policy.Statement{{
+				Effect:    "Allow",
+				Principal: map[string]interface{}{"Federated": icebergVendedCredentialsProvider},
+				Action:    []string{"sts:AssumeRoleWithCredentials"},
+			}},
+		},
+	}))
+	iam := newSharedIdentityIAM()
+	iam.SetIAMIntegration(NewS3IAMIntegration(mgr, ""))
+	s3a := &S3ApiServer{iam: iam}
+	s3a.SetIcebergCredentialRole("arn:aws:iam::role/IcebergTableAccess", 3600)
+	return s3a
+}
+
+// vend mints table credentials for principal as if its request had been
+// signed with accessKey ("" for a request that recorded none); a non-empty
+// secret marks the credential as a stored identity's, as a verifier would.
+func vend(t *testing.T, s3a *S3ApiServer, principal, accessKey, secret string) *VendedCredentials {
+	t.Helper()
+	ctx := context.Background()
+	if accessKey != "" {
+		ctx = s3_constants.SetAccessKeyIdInContext(ctx, accessKey)
+	}
+	if secret != "" {
+		ctx = s3_constants.SetStoredAccessKeyIdInContext(ctx, accessKey, secret)
+	}
+	creds, err := s3a.VendTableCredentials(ctx, principal, "warehouse", "ns/t", false)
+	require.NoError(t, err)
+	require.NotNil(t, creds)
+	return creds
+}
+
+// use validates a vended session the way a data-path request carrying it is
+// validated.
+func use(t *testing.T, s3a *S3ApiServer, creds *VendedCredentials) s3err.ErrorCode {
+	t.Helper()
+	r, err := newTestRequest("GET", "https://example.com/warehouse/ns/t/data/f.parquet", 0, nil)
+	require.NoError(t, err)
+	_, _, errCode := s3a.iam.validateSTSSessionToken(r, creds.SessionToken, creds.AccessKeyID)
+	return errCode
+}
+
+func sessionInfo(t *testing.T, s3a *S3ApiServer, creds *VendedCredentials) *sts.SessionInfo {
+	t.Helper()
+	info, err := s3a.stsService().ValidateSessionToken(context.Background(), creds.SessionToken)
+	require.NoError(t, err)
+	return info
+}
+
+func TestVendedSessionEndsWithItsAccessKey(t *testing.T) {
+	s3a := vendingServer(t)
+	sessionA := vend(t, s3a, "shared-user", sharedKeyA, sharedSecretA)
+	sessionB := vend(t, s3a, "shared-user", sharedKeyB, sharedSecretB)
+	require.Equal(t, s3err.ErrNone, use(t, s3a, sessionA), "control: the session works while its key does")
+	require.Equal(t, s3err.ErrNone, use(t, s3a, sessionB))
+
+	identity := s3a.iam.nameToIdentity["shared-user"]
+	identity.Credentials[0].Status = iamAccessKeyStatusInactive
+	assert.Equal(t, s3err.ErrInvalidAccessKeyID, use(t, s3a, sessionA), "key A deactivated")
+	assert.Equal(t, s3err.ErrNone, use(t, s3a, sessionB), "the session vended through key B keeps working")
+
+	identity.Credentials[0].Status = iamAccessKeyStatusActive
+	assert.Equal(t, s3err.ErrNone, use(t, s3a, sessionA), "key A reactivated")
+
+	identity.Credentials[0].Expiration = time.Now().Add(-time.Minute).Unix()
+	assert.Equal(t, s3err.ErrInvalidAccessKeyID, use(t, s3a, sessionA), "key A expired")
+	identity.Credentials[0].Expiration = 0
+
+	identity.Credentials = identity.Credentials[1:]
+	assert.Equal(t, s3err.ErrInvalidAccessKeyID, use(t, s3a, sessionA), "key A deleted")
+	assert.Equal(t, s3err.ErrNone, use(t, s3a, sessionB), "the session vended through key B keeps working")
+}
+
+func TestVendedSessionEndsWithItsIdentity(t *testing.T) {
+	s3a := vendingServer(t)
+	session := vend(t, s3a, "shared-user", sharedKeyA, sharedSecretA)
+	require.Equal(t, s3err.ErrNone, use(t, s3a, session))
+
+	s3a.iam.nameToIdentity["shared-user"].Disabled = true
+	assert.Equal(t, s3err.ErrInvalidAccessKeyID, use(t, s3a, session), "identity disabled")
+	s3a.iam.nameToIdentity["shared-user"].Disabled = false
+	assert.Equal(t, s3err.ErrNone, use(t, s3a, session), "identity enabled again")
+
+	delete(s3a.iam.nameToIdentity, "shared-user")
+	assert.Equal(t, s3err.ErrInvalidAccessKeyID, use(t, s3a, session), "identity deleted")
+}
+
+// A caller that is not a stored identity (a caller signing with another STS
+// session's key, an OIDC user, a request that recorded no key) still gets
+// credentials, unbound as before: binding them would refuse every request
+// made with them.
+func TestVendedSessionIsBoundOnlyForAStoredIdentitysKey(t *testing.T) {
+	s3a := vendingServer(t)
+	control := sessionInfo(t, s3a, vend(t, s3a, "shared-user", sharedKeyA, sharedSecretA))
+	assert.Equal(t, sharedKeyA, control.SourceAccessKeyId, "control")
+	assert.Equal(t, sharedKeyA, control.BoundAccessKeyId, "control")
+
+	for _, tc := range []struct{ principal, key, why string }{
+		{"47ad4828c45b3f337bc3146081ba8f0f", "ASIATEMPORARYKEY0001", "an STS session's subject and temporary key"},
+		{"shared-user", "ASIATEMPORARYKEY0001", "an STS session whose subject names a stored identity"},
+		{"alice@example.com", "", "an OIDC user"},
+		{"shared-user", "", "no recorded key"},
+	} {
+		session := vend(t, s3a, tc.principal, tc.key, "")
+		info := sessionInfo(t, s3a, session)
+		assert.Equal(t, tc.key, info.SourceAccessKeyId, tc.why)
+		assert.Empty(t, info.BoundAccessKeyId, tc.why)
+		assert.Equal(t, s3err.ErrNone, use(t, s3a, session), tc.why)
+	}
+}
+
+// Tokens minted before the binding existed record the caller's key under the
+// audit claim only. Validating them as bound would end live table credentials
+// at upgrade — a chained STS caller's key can never resolve to a stored
+// credential. They stay valid until expiry, as they always did.
+func TestLegacyVendedSessionStaysUnbound(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	iam.iamIntegration = &MockIAMIntegration{
+		validateSessionFunc: func(ctx context.Context, token string) (*sts.SessionInfo, error) {
+			return &sts.SessionInfo{
+				SessionId:         "sid",
+				AssumedRoleUser:   "arn:aws:sts::assumed-role/Reader/session",
+				Principal:         "arn:aws:sts::assumed-role/Reader/session",
+				IdentityProvider:  icebergVendedCredentialsProvider,
+				ExternalUserId:    "someone-not-in-the-identity-table",
+				SourceAccessKeyId: "ASIATEMPORARYKEY0001",
+				Credentials:       &sts.Credentials{AccessKeyId: "ASIALEGACY", SecretAccessKey: "secret"},
+				ExpiresAt:         time.Now().Add(time.Hour),
+			}, nil
+		},
+	}
+	r, err := newTestRequest("GET", "https://example.com/bucket/f.parquet", 0, nil)
+	require.NoError(t, err)
+	_, _, errCode := iam.validateSTSSessionToken(r, "token", "ASIALEGACY")
+	assert.Equal(t, s3err.ErrNone, errCode)
+}
+
+// A key re-created under the same id with a different secret does not revive
+// sessions bound to the deleted original: the fingerprint recorded at mint
+// time no longer matches.
+func TestRecreatedKeyDoesNotReviveVendedSession(t *testing.T) {
+	s3a := vendingServer(t)
+	session := vend(t, s3a, "shared-user", sharedKeyA, sharedSecretA)
+	require.Equal(t, s3err.ErrNone, use(t, s3a, session))
+
+	identity := s3a.iam.nameToIdentity["shared-user"]
+	identity.Credentials[0] = &Credential{AccessKey: sharedKeyA, SecretKey: "recreated-secret"}
+	assert.Equal(t, s3err.ErrInvalidAccessKeyID, use(t, s3a, session), "same id, different secret")
+
+	identity.Credentials[0] = &Credential{AccessKey: sharedKeyA, SecretKey: sharedSecretA}
+	assert.Equal(t, s3err.ErrNone, use(t, s3a, session), "the identical credential is indistinguishable")
+}
+
+// A session for a stored identity stays bound even when the key no longer
+// resolves at vend time — revoked between the request's authentication and
+// the vend, or held by a different identity now. The session dies on its
+// first request instead of living unbound until it expires.
+func TestVendedSessionStaysBoundWhenTheKeyIsGoneAtVend(t *testing.T) {
+	s3a := vendingServer(t)
+
+	identity := s3a.iam.nameToIdentity["shared-user"]
+	identity.Credentials = identity.Credentials[1:] // sharedKeyA revoked mid-request
+	session := vend(t, s3a, "shared-user", sharedKeyA, sharedSecretA)
+	assert.Equal(t, sharedKeyA, sessionInfo(t, s3a, session).SourceAccessKeyId, "still bound")
+	assert.Equal(t, s3err.ErrInvalidAccessKeyID, use(t, s3a, session), "the dead key's session is refused")
+}
+
+// Only sessions the catalog vended are bound; any other STS session (web
+// identity, AssumeRole) is validated as before.
+func TestOtherSessionsAreNotBoundToAKey(t *testing.T) {
+	iam := newSharedIdentityIAM()
+	iam.iamIntegration = &MockIAMIntegration{
+		validateSessionFunc: func(ctx context.Context, token string) (*sts.SessionInfo, error) {
+			return &sts.SessionInfo{
+				SessionId:         "sid",
+				AssumedRoleUser:   "arn:aws:sts::assumed-role/Reader/session",
+				Principal:         "arn:aws:sts::assumed-role/Reader/session",
+				IdentityProvider:  "oidc-provider",
+				ExternalUserId:    "someone-not-in-the-identity-table",
+				SourceAccessKeyId: "AKIAGONE",
+				Credentials:       &sts.Credentials{AccessKeyId: "ASIAWEBID", SecretAccessKey: "secret"},
+				ExpiresAt:         time.Now().Add(time.Hour),
+			}, nil
+		},
+	}
+	r, err := newTestRequest("GET", "https://example.com/bucket/f.parquet", 0, nil)
+	require.NoError(t, err)
+	_, _, errCode := iam.validateSTSSessionToken(r, "token", "ASIAWEBID")
+	assert.Equal(t, s3err.ErrNone, errCode)
+}
+
+// The check on the request path is one read-locked map lookup and a scan of
+// one identity's keys.
+func BenchmarkVendedSessionKeyLive(b *testing.B) {
+	iam := newSharedIdentityIAM()
+	for i := 0; i < 1000; i++ {
+		name := fmt.Sprintf("user-%04d", i)
+		iam.nameToIdentity[name] = &Identity{Name: name, Credentials: []*Credential{{AccessKey: name}}}
+	}
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if iam.vendedSessionKeyLive("shared-user", sharedKeyB, "") != s3err.ErrNone {
+			b.Fatal("refused")
+		}
+	}
+}
diff --git a/weed/s3api/s3api_inline_policy_condition_test.go b/weed/s3api/s3api_inline_policy_condition_test.go
index 9cd378285b..16b688b606 100644
--- a/weed/s3api/s3api_inline_policy_condition_test.go
+++ b/weed/s3api/s3api_inline_policy_condition_test.go
@@ -123,6 +123,35 @@ func TestUserInlinePolicySourceIpCondition_Allows(t *testing.T) {
 		"PutObject from 127.0.0.1 must be allowed: the user inline policy's aws:SourceIp condition (127.0.0.0/8) matches")
 }
 
+// TestUserInlinePolicySourceIpCondition_IgnoresForwardedHeaders proves that a
+// spoofed X-Forwarded-For cannot satisfy an aws:SourceIp condition: the policy
+// requires 198.51.100.0/24, the peer is 127.0.0.1, and the header claims
+// 198.51.100.5. The condition must be evaluated against the peer, not the
+// header, so the request is denied.
+func TestUserInlinePolicySourceIpCondition_IgnoresForwardedHeaders(t *testing.T) {
+	api := NewEmbeddedIamApiForTest()
+	api.mockConfig = &iam_pb.S3ApiConfiguration{}
+	seedInlineCondUser(t, api)
+
+	_, iamErr := api.PutUserPolicy(api.mockConfig, url.Values{
+		"UserName":       {"alice"},
+		"PolicyName":     {"OnlyFromTestNet"},
+		"PolicyDocument": {inlineCondPolicyDoc("198.51.100.0/24")},
+	})
+	require.Nil(t, iamErr, "PutUserPolicy must succeed")
+	require.NoError(t, api.PutS3ApiConfiguration(api.mockConfig))
+	require.NoError(t, api.iam.LoadS3ApiConfigurationFromCredentialManager())
+
+	ident := api.iam.lookupByIdentityName("alice")
+	require.NotNil(t, ident)
+
+	req := inlineCondRequest(t, http.MethodPut)
+	req.Header.Set("X-Forwarded-For", "198.51.100.5")
+	got := api.iam.VerifyActionPermission(req, ident, s3_constants.ACTION_WRITE, inlineCondTestBucket, "obj")
+	assert.Equal(t, s3err.ErrAccessDenied, got,
+		"PutObject from 127.0.0.1 must be denied despite X-Forwarded-For claiming 198.51.100.5: aws:SourceIp is the peer, not the header")
+}
+
 // TestGroupInlinePolicy_PutAndEnforce verifies that PutGroupPolicy is supported
 // (no longer returns NotImplemented) and that an aws:SourceIp condition on the
 // resulting inline policy is honored for group members.
diff --git a/weed/s3api/s3api_internal_lifecycle.go b/weed/s3api/s3api_internal_lifecycle.go
index 164a999ba6..20e76b62cd 100644
--- a/weed/s3api/s3api_internal_lifecycle.go
+++ b/weed/s3api/s3api_internal_lifecycle.go
@@ -12,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_lifecycle_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
 	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
 )
@@ -20,6 +21,9 @@ import (
 // CAS, object-lock check, dispatch by kind. Errors surface as outcomes;
 // reader cursors and pending state are the worker's concern.
 func (s3a *S3ApiServer) LifecycleDelete(ctx context.Context, req *s3_lifecycle_pb.LifecycleDeleteRequest) (*s3_lifecycle_pb.LifecycleDeleteResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req == nil || req.Bucket == "" || req.ObjectPath == "" {
 		return blocked("FATAL_EVENT_ERROR: empty bucket or object_path"), nil
 	}
@@ -88,7 +92,7 @@ func (s3a *S3ApiServer) lifecycleDispatch(ctx context.Context, req *s3_lifecycle
 			return done(), nil
 		default:
 			err := s3a.WithFilerClient(false, func(c filer_pb.SeaweedFilerClient) error {
-				return s3a.deleteUnversionedObjectWithClient(c, req.Bucket, req.ObjectPath, metadataOnly)
+				return s3a.deleteUnversionedObjectWithClient(ctx, c, req.Bucket, req.ObjectPath, metadataOnly)
 			})
 			if err != nil {
 				if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrObjectNotFound) {
@@ -169,24 +173,24 @@ func (s3a *S3ApiServer) lifecycleAbortMPU(ctx context.Context, req *s3_lifecycle
 	// Pre-check existence: filer.DeleteEntry suppresses ErrNotFound and
 	// returns success, so without this check an already-aborted upload
 	// would report DONE instead of the correct NOOP_RESOLVED.
-	exists, err := s3a.exists(uploadsFolder, uploadID, true)
+	uploadEntry, err := s3a.getEntry(uploadsFolder, uploadID)
 	if err != nil {
 		if errors.Is(err, filer_pb.ErrNotFound) {
 			return noopResolved("NOT_FOUND"), nil
 		}
-		return retryLater("TRANSPORT_ERROR: exists: " + err.Error()), nil
+		return retryLater("TRANSPORT_ERROR: getEntry: " + err.Error()), nil
 	}
-	if !exists {
+	if uploadEntry == nil {
 		return noopResolved("NOT_FOUND"), nil
 	}
-	if err := s3a.rm(uploadsFolder, uploadID, true, true); err != nil {
-		if errors.Is(err, filer_pb.ErrNotFound) {
-			return noopResolved("NOT_FOUND_AT_DELETE"), nil
-		}
-		glog.V(1).Infof("lifecycle abort_mpu %s/%s: %v", req.Bucket, req.ObjectPath, err)
-		return retryLater("TRANSPORT_ERROR: rm: " + err.Error()), nil
+	object := string(uploadEntry.Extended[s3_constants.ExtMultipartObjectKey])
+	code := s3a.withObjectWriteLock(req.Bucket, object, nil, func() s3err.ErrorCode {
+		return s3a.removeUploadDir(req.Bucket, uploadID, object)
+	})
+	if code == s3err.ErrNone {
+		return done(), nil
 	}
-	return done(), nil
+	return retryLater("TRANSPORT_ERROR: removeUploadDir: " + s3err.GetAPIError(code).Code), nil
 }
 
 // checkSoleSurvivorMarker returns nil to proceed with the delete, or a
diff --git a/weed/s3api/s3api_internal_lifecycle_test.go b/weed/s3api/s3api_internal_lifecycle_test.go
index 6a8cbeb7c7..54d44a49e5 100644
--- a/weed/s3api/s3api_internal_lifecycle_test.go
+++ b/weed/s3api/s3api_internal_lifecycle_test.go
@@ -2,13 +2,19 @@ package s3api
 
 import (
 	"bytes"
+	"context"
+	"net"
 	"testing"
 
 	"github.com/prometheus/client_golang/prometheus/testutil"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_lifecycle_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
+	"github.com/seaweedfs/seaweedfs/weed/security"
 	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
 )
 
 func TestComputeEntryIdentity_BasicFields(t *testing.T) {
@@ -111,7 +117,7 @@ func TestIdentityMatches_AllFieldsCompared(t *testing.T) {
 
 func TestLifecycleDelete_RejectsEmptyRequest(t *testing.T) {
 	s := &S3ApiServer{}
-	resp, err := s.LifecycleDelete(nil, &s3_lifecycle_pb.LifecycleDeleteRequest{})
+	resp, err := s.LifecycleDelete(s3LocalPeerCtx(), &s3_lifecycle_pb.LifecycleDeleteRequest{})
 	if err != nil {
 		t.Fatalf("unexpected gRPC error: %v", err)
 	}
@@ -134,7 +140,7 @@ func TestLifecycleAbortMPU_RejectsTraversalUploadIDs(t *testing.T) {
 	}
 	for _, path := range cases {
 		t.Run(path, func(t *testing.T) {
-			resp, err := s.LifecycleDelete(nil, &s3_lifecycle_pb.LifecycleDeleteRequest{
+			resp, err := s.LifecycleDelete(s3LocalPeerCtx(), &s3_lifecycle_pb.LifecycleDeleteRequest{
 				Bucket:     "bk",
 				ObjectPath: path,
 				ActionKind: s3_lifecycle_pb.ActionKind_ABORT_MPU,
@@ -329,3 +335,45 @@ func TestRecordMetadataOnlyIf_EmptyRuleHashCollapsesToEmptyLabel(t *testing.T) {
 		t.Fatalf("nil rule_hash should produce empty-label series; before=%v after=%v", before, got)
 	}
 }
+
+func TestLifecycleDelete_RequiresAdminAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.LifecycleDelete(context.Background(), &s3_lifecycle_pb.LifecycleDeleteRequest{
+		Bucket: "victim", ObjectPath: "important.dat",
+		ActionKind: s3_lifecycle_pb.ActionKind_EXPIRATION_DAYS,
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("LifecycleDelete without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+	bad := security.GenJwtForFilerAdmin(security.SigningKey("a-different-key"), 60)
+	_, err = s.LifecycleDelete(s3IamCacheBearerCtx(string(bad)), &s3_lifecycle_pb.LifecycleDeleteRequest{
+		Bucket: "victim", ObjectPath: "important.dat",
+		ActionKind: s3_lifecycle_pb.ActionKind_EXPIRATION_DAYS,
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("LifecycleDelete with mis-signed token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestLifecycleDelete_NoSigningKey_LocalPeerOnly(t *testing.T) {
+	s := newTestS3IamCacheServer(t, "")
+	_, err := s.LifecycleDelete(context.Background(), &s3_lifecycle_pb.LifecycleDeleteRequest{})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("LifecycleDelete with no peer info: got code %v, want %v (err=%v)", got, want, err)
+	}
+	remoteCtx := peer.NewContext(context.Background(),
+		&peer.Peer{Addr: &net.TCPAddr{IP: net.ParseIP("203.0.113.7"), Port: 11111}})
+	_, err = s.LifecycleDelete(remoteCtx, &s3_lifecycle_pb.LifecycleDeleteRequest{})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("LifecycleDelete from remote peer: got code %v, want %v (err=%v)", got, want, err)
+	}
+	localCtx := peer.NewContext(context.Background(),
+		&peer.Peer{Addr: &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 11111}})
+	resp, err := s.LifecycleDelete(localCtx, &s3_lifecycle_pb.LifecycleDeleteRequest{})
+	if err != nil {
+		t.Fatalf("LifecycleDelete from loopback without signing key: unexpected error %v", err)
+	}
+	if resp == nil || resp.Outcome != s3_lifecycle_pb.LifecycleDeleteOutcome_BLOCKED {
+		t.Fatalf("expected BLOCKED for empty request without signing key, got %v", resp)
+	}
+}
diff --git a/weed/s3api/s3api_list_parts_no_such_upload_test.go b/weed/s3api/s3api_list_parts_no_such_upload_test.go
new file mode 100644
index 0000000000..c894571bb0
--- /dev/null
+++ b/weed/s3api/s3api_list_parts_no_such_upload_test.go
@@ -0,0 +1,280 @@
+package s3api
+
+import (
+	"context"
+	"math"
+	"sort"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// fakePartsFiler serves the two lookups listObjectParts makes: the .uploads/<id>
+// record via LookupDirectoryEntry, and the part listing via ListEntries. A nil
+// uploadEntry answers the lookup with not-found, the way a filer does after
+// complete/abort removed the directory or for an upload id that never existed.
+// Any other directory is refused, so a path built wrong fails the test rather
+// than passing on the fixture.
+type fakePartsFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	uploadsDir  string
+	uploadEntry *filer_pb.Entry
+	parts       []*filer_pb.Entry
+}
+
+func (f *fakePartsFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if req.Directory != f.uploadsDir {
+		return nil, status.Errorf(codes.Internal, "unexpected lookup in %s", req.Directory)
+	}
+	if f.uploadEntry != nil && req.Name == f.uploadEntry.Name {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: f.uploadEntry}, nil
+	}
+	return nil, filer_pb.ErrNotFound
+}
+
+func (f *fakePartsFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	if f.uploadEntry == nil || req.Directory != f.uploadsDir+"/"+f.uploadEntry.Name {
+		return status.Errorf(codes.Internal, "unexpected listing of %s", req.Directory)
+	}
+	// most stores list a missing directory as empty rather than erroring, which
+	// is exactly the behavior under test
+	parts := append([]*filer_pb.Entry(nil), f.parts...)
+	sort.Slice(parts, func(i, j int) bool { return parts[i].Name < parts[j].Name })
+	var sent uint32
+	for _, entry := range parts {
+		name := entry.Name
+		if req.StartFromFileName != "" {
+			if name < req.StartFromFileName {
+				continue
+			}
+			if name == req.StartFromFileName && !req.InclusiveStartFrom {
+				continue
+			}
+		}
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: entry}); err != nil {
+			return err
+		}
+		sent++
+		if req.Limit > 0 && sent >= req.Limit {
+			return nil
+		}
+	}
+	return nil
+}
+
+func newListPartsServer(t *testing.T, f *fakePartsFiler) *S3ApiServer {
+	t.Helper()
+	f.uploadsDir = (&S3ApiServer{option: &S3ApiServerOption{}}).genUploadsFolder("b")
+	return newFailoverTestServer(t, startFakeFiler(t, f))
+}
+
+func uploadRecordEntry(uploadId string) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Name:        uploadId,
+		IsDirectory: true,
+		Extended:    map[string][]byte{s3_constants.ExtMultipartObjectKey: []byte("a.bin")},
+	}
+}
+
+func partEntry(name string, size uint64) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Name:       name,
+		Attributes: &filer_pb.FuseAttributes{FileSize: size},
+	}
+}
+
+func listPartsInput(uploadId string) *s3.ListPartsInput {
+	return &s3.ListPartsInput{
+		Bucket:           aws.String("b"),
+		Key:              aws.String("a.bin"),
+		UploadId:         aws.String(uploadId),
+		MaxParts:         aws.Int64(1000),
+		PartNumberMarker: aws.Int64(0),
+	}
+}
+
+// A completed (or aborted, or never-created) upload has no .uploads/<id>
+// record, and AWS answers ListParts on it with NoSuchUpload. Answering 200
+// with an empty list instead is indistinguishable from an open upload with no
+// parts yet, and clients that derive upload state from ListParts (tusd derives
+// the resumable-upload offset from the part sizes) read every completed upload
+// as one with zero bytes received.
+func TestListPartsGoneUploadAnswersNoSuchUpload(t *testing.T) {
+	s3a := newListPartsServer(t, &fakePartsFiler{})
+
+	_, code := s3a.listObjectParts(listPartsInput("gone-upload"))
+
+	if code != s3err.ErrNoSuchUpload {
+		t.Fatalf("code = %v, want ErrNoSuchUpload", code)
+	}
+}
+
+// Only createMultipartUpload stamps the destination key on the record; a
+// directory a late part write resurrected after an abort is not an upload.
+func TestListPartsResurrectedDirectoryAnswersNoSuchUpload(t *testing.T) {
+	entry := uploadRecordEntry("resurrected-upload")
+	entry.Extended = nil
+	s3a := newListPartsServer(t, &fakePartsFiler{uploadEntry: entry})
+
+	_, code := s3a.listObjectParts(listPartsInput("resurrected-upload"))
+
+	if code != s3err.ErrNoSuchUpload {
+		t.Fatalf("code = %v, want ErrNoSuchUpload", code)
+	}
+}
+
+// An open upload that has not received a part yet must keep answering 200 with
+// an empty list: the upload directory is the marker that the upload exists,
+// and an offset of zero is the truth here.
+func TestListPartsOpenUploadWithNoPartsAnswersEmptyList(t *testing.T) {
+	s3a := newListPartsServer(t, &fakePartsFiler{
+		uploadEntry: uploadRecordEntry("open-upload"),
+	})
+
+	output, code := s3a.listObjectParts(listPartsInput("open-upload"))
+
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if len(output.Part) != 0 {
+		t.Fatalf("parts = %d, want 0", len(output.Part))
+	}
+}
+
+func TestListPartsOpenUploadListsParts(t *testing.T) {
+	s3a := newListPartsServer(t, &fakePartsFiler{
+		uploadEntry: uploadRecordEntry("open-upload"),
+		parts: []*filer_pb.Entry{
+			partEntry("0001.part", 5),
+			partEntry("0002.part", 3),
+		},
+	})
+
+	output, code := s3a.listObjectParts(listPartsInput("open-upload"))
+
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if len(output.Part) != 2 {
+		t.Fatalf("parts = %d, want 2", len(output.Part))
+	}
+	if *output.Part[0].PartNumber != 1 || *output.Part[0].Size != 5 {
+		t.Fatalf("part[0] = %d/%d, want 1/5", *output.Part[0].PartNumber, *output.Part[0].Size)
+	}
+}
+
+// S3 part-number-marker is exclusive. Part objects are stored as
+// NNNN_<uuid>.part, which sorts after the NNNN.part prefix, so a page of
+// max-parts=1 must advance to the next part number instead of repeating it.
+func TestListPartsPartNumberMarkerIsExclusive(t *testing.T) {
+	s3a := newListPartsServer(t, &fakePartsFiler{
+		uploadEntry: uploadRecordEntry("open-upload"),
+		parts: []*filer_pb.Entry{
+			partEntry("0001_11111111-1111-1111-1111-111111111111.part", 5),
+			partEntry("0002_22222222-2222-2222-2222-222222222222.part", 5),
+			partEntry("0003_33333333-3333-3333-3333-333333333333.part", 5),
+		},
+	})
+
+	input := listPartsInput("open-upload")
+	input.PartNumberMarker = aws.Int64(1)
+	input.MaxParts = aws.Int64(1)
+	output, code := s3a.listObjectParts(input)
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if got := partNumbers(output); len(got) != 1 || got[0] != 2 {
+		t.Fatalf("parts = %v, want [2]", got)
+	}
+	if output.IsTruncated == nil || !*output.IsTruncated {
+		t.Fatal("IsTruncated = false, want true")
+	}
+	if output.NextPartNumberMarker == nil || *output.NextPartNumberMarker != 2 {
+		t.Fatalf("NextPartNumberMarker = %v, want 2", output.NextPartNumberMarker)
+	}
+
+	input.MaxParts = aws.Int64(1000)
+	output, code = s3a.listObjectParts(input)
+	if code != s3err.ErrNone {
+		t.Fatalf("code = %v, want ErrNone", code)
+	}
+	if got := partNumbers(output); len(got) != 2 || got[0] != 2 || got[1] != 3 {
+		t.Fatalf("parts = %v, want [2 3]", got)
+	}
+}
+
+// A client paging one part at a time must walk marker=0 through every part and
+// terminate: each page returns the next part and a NextPartNumberMarker that
+// the following page starts strictly after.
+func TestListPartsPaginationWithUUIDParts(t *testing.T) {
+	s3a := newListPartsServer(t, &fakePartsFiler{
+		uploadEntry: uploadRecordEntry("open-upload"),
+		parts: []*filer_pb.Entry{
+			partEntry("0001_c3a1e204-1111-1111-1111-111111111111.part", 5),
+			partEntry("0002_d4b2f315-2222-2222-2222-222222222222.part", 5),
+			partEntry("0003_e5c3a426-3333-3333-3333-333333333333.part", 5),
+		},
+	})
+
+	input := listPartsInput("open-upload")
+	input.MaxParts = aws.Int64(1)
+
+	for page, want := range []int64{1, 2, 3} {
+		output, code := s3a.listObjectParts(input)
+		if code != s3err.ErrNone {
+			t.Fatalf("page %d code = %v, want ErrNone", page+1, code)
+		}
+		if got := partNumbers(output); len(got) != 1 || got[0] != want {
+			t.Fatalf("page %d parts = %v, want [%d]", page+1, got, want)
+		}
+		if page < 2 {
+			if output.IsTruncated == nil || !*output.IsTruncated {
+				t.Fatalf("page %d IsTruncated = false, want true", page+1)
+			}
+			if output.NextPartNumberMarker == nil || *output.NextPartNumberMarker != want {
+				t.Fatalf("page %d NextPartNumberMarker = %v, want %d", page+1, output.NextPartNumberMarker, want)
+			}
+			input.PartNumberMarker = output.NextPartNumberMarker
+		} else {
+			if output.IsTruncated == nil || *output.IsTruncated {
+				t.Fatalf("page %d IsTruncated = true, want false", page+1)
+			}
+			if output.NextPartNumberMarker != nil {
+				t.Fatalf("page %d NextPartNumberMarker = %v, want nil", page+1, output.NextPartNumberMarker)
+			}
+		}
+	}
+
+	// a marker at the int64 ceiling cannot be incremented; answer an empty,
+	// untruncated page instead of wrapping the start name negative
+	input.PartNumberMarker = aws.Int64(math.MaxInt64)
+	output, code := s3a.listObjectParts(input)
+	if code != s3err.ErrNone {
+		t.Fatalf("max marker code = %v, want ErrNone", code)
+	}
+	if len(output.Part) != 0 {
+		t.Fatalf("max marker parts = %d, want 0", len(output.Part))
+	}
+	if output.IsTruncated == nil || *output.IsTruncated {
+		t.Fatal("max marker IsTruncated = true, want false")
+	}
+}
+
+func partNumbers(output *ListPartsResult) []int64 {
+	if output == nil {
+		return nil
+	}
+	nums := make([]int64, len(output.Part))
+	for i, part := range output.Part {
+		if part.PartNumber != nil {
+			nums[i] = *part.PartNumber
+		}
+	}
+	return nums
+}
diff --git a/weed/s3api/s3api_local_read_fallback_test.go b/weed/s3api/s3api_local_read_fallback_test.go
new file mode 100644
index 0000000000..6294ca1c0c
--- /dev/null
+++ b/weed/s3api/s3api_local_read_fallback_test.go
@@ -0,0 +1,366 @@
+package s3api
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/util/chunk_cache"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stubReaderAt stands in for ChunkReadAt in probe unit tests.
+type stubReaderAt struct {
+	n   int
+	err error
+}
+
+func (s stubReaderAt) ReadAtWithTime(ctx context.Context, p []byte, offset int64) (int, int64, error) {
+	return s.n, 0, s.err
+}
+
+// blockingReaderAt never returns until the context is cancelled.
+type blockingReaderAt struct{}
+
+func (blockingReaderAt) ReadAtWithTime(ctx context.Context, p []byte, offset int64) (int, int64, error) {
+	<-ctx.Done()
+	return 0, 0, ctx.Err()
+}
+
+func TestProbeReadable(t *testing.T) {
+	t.Run("readable local copy", func(t *testing.T) {
+		assert.NoError(t, probeReadable(context.Background(), stubReaderAt{n: 1}, 0, time.Second))
+	})
+
+	t.Run("final byte with trailing EOF counts as readable", func(t *testing.T) {
+		assert.NoError(t, probeReadable(context.Background(), stubReaderAt{n: 1, err: io.EOF}, 0, time.Second))
+	})
+
+	t.Run("zero-byte EOF is unreadable", func(t *testing.T) {
+		assert.Error(t, probeReadable(context.Background(), stubReaderAt{n: 0, err: io.EOF}, 0, time.Second))
+	})
+
+	t.Run("zero-byte read without error is unreadable", func(t *testing.T) {
+		assert.ErrorIs(t, probeReadable(context.Background(), stubReaderAt{n: 0, err: nil}, 0, time.Second), io.ErrUnexpectedEOF)
+	})
+
+	t.Run("read error surfaces", func(t *testing.T) {
+		boom := errors.New("volume: connection refused")
+		assert.ErrorIs(t, probeReadable(context.Background(), stubReaderAt{err: boom}, 0, time.Second), boom)
+	})
+
+	t.Run("stuck volume trips the timeout instead of blocking", func(t *testing.T) {
+		start := time.Now()
+		err := probeReadable(context.Background(), blockingReaderAt{}, 0, 50*time.Millisecond)
+		assert.ErrorIs(t, err, context.DeadlineExceeded)
+		assert.Less(t, time.Since(start), time.Second, "must not block past the probe timeout")
+	})
+}
+
+func TestShouldFallBackToRemote(t *testing.T) {
+	const size = int64(100)
+	remoteEntry := func() *filer_pb.Entry {
+		return &filer_pb.Entry{
+			Attributes:  &filer_pb.FuseAttributes{FileSize: uint64(size)},
+			RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: size},
+		}
+	}
+	server := func() *S3ApiServer {
+		return &S3ApiServer{option: &S3ApiServerOption{}}
+	}
+
+	t.Run("matching remote", func(t *testing.T) {
+		assert.True(t, server().shouldFallBackToRemote(remoteEntry(), size, ""))
+	})
+
+	t.Run("null versionId is treated as unversioned", func(t *testing.T) {
+		assert.True(t, server().shouldFallBackToRemote(remoteEntry(), size, "null"))
+	})
+
+	t.Run("versioned read cannot use the unversioned remote key", func(t *testing.T) {
+		assert.False(t, server().shouldFallBackToRemote(remoteEntry(), size, "v123"))
+	})
+
+	t.Run("latest read that resolves to a version cannot use the unversioned key", func(t *testing.T) {
+		versioned := remoteEntry()
+		versioned.Extended = map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v9")}
+		assert.False(t, server().shouldFallBackToRemote(versioned, size, ""))
+	})
+
+	t.Run("no remote entry", func(t *testing.T) {
+		local := &filer_pb.Entry{Attributes: &filer_pb.FuseAttributes{FileSize: uint64(size)}}
+		assert.False(t, server().shouldFallBackToRemote(local, size, ""))
+	})
+
+	t.Run("size mismatch is not served as identical bytes", func(t *testing.T) {
+		assert.False(t, server().shouldFallBackToRemote(remoteEntry(), size+1, ""))
+	})
+}
+
+// The fake filer does not implement LookupVolume, so every chunk read through
+// this ReaderCache fails, standing in for an unreachable volume server.
+func newLocalReadFallbackServer(t *testing.T, filerAddr pb.ServerAddress) *S3ApiServer {
+	t.Helper()
+	s3a := newRemoteCacheTestServer(filerAddr)
+	fc := wdclient.NewFilerClient(s3a.option.Filers, s3a.option.GrpcDialOption, s3a.option.DataCenter)
+	s3a.filerClient = fc
+	s3a.readerCache = filer.NewReaderCache(8, (*chunk_cache.TieredChunkCache)(nil), fc.GetLookupFileIdFunction(), fc)
+	return s3a
+}
+
+// a remote-mounted object whose cached copy is in the metadata but unreadable
+func cachedEntry(content []byte) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Name:        "obj.bin",
+		Attributes:  &filer_pb.FuseAttributes{FileSize: uint64(len(content))},
+		Chunks:      []*filer_pb.FileChunk{{FileId: "1,0123456789ab", Size: uint64(len(content)), Offset: 0}},
+		RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: int64(len(content))},
+	}
+}
+
+func TestS3CachedReadFallsBackToRemote(t *testing.T) {
+	content := []byte("0123456789")
+
+	t.Run("unreadable local copy is served from the mounted remote", func(t *testing.T) {
+		client := &fakeStreamRemoteClient{data: content}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, "faketest-cachedfail", nil))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, cachedEntry(content), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Equal(t, content, w.Body.Bytes())
+		require.NotNil(t, client.gotLoc, "must read from the mounted remote")
+		assert.Equal(t, "/data/dir/obj.bin", client.gotLoc.Path)
+	})
+
+	t.Run("range fallback serves the requested window from the remote", func(t *testing.T) {
+		client := &fakeStreamRemoteClient{data: content}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, "faketest-cachedrange", nil))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		r.Header.Set("Range", "bytes=2-5")
+
+		err := s3a.streamFromVolumeServers(w, r, cachedEntry(content), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusPartialContent, w.Code)
+		assert.Equal(t, content[2:6], w.Body.Bytes())
+		assert.Equal(t, int64(2), client.gotOffset)
+		assert.Equal(t, int64(4), client.gotSize)
+	})
+
+	t.Run("a local-only object gets a clean 500, not a broken 200 body", func(t *testing.T) {
+		client := &fakeStreamRemoteClient{data: content}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, "faketest-nofallback", nil))
+		local := cachedEntry(content)
+		local.RemoteEntry = nil
+		w := httptest.NewRecorder()
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil).WithContext(ctx)
+
+		err := s3a.streamFromVolumeServers(w, r, local, "", "mybucket", "dir/obj.bin", "")
+
+		require.Error(t, err)
+		assert.Equal(t, http.StatusInternalServerError, w.Code, "the status must not be committed before the first read succeeds")
+		assert.Contains(t, w.Body.String(), "InternalError")
+		assert.Nil(t, client.gotLoc, "an object that is not remote-mounted has no remote to fall back to")
+	})
+
+	t.Run("versioned read does not fall back to the unversioned remote key", func(t *testing.T) {
+		client := &fakeStreamRemoteClient{data: content}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, "faketest-cachedversioned", nil))
+		versioned := cachedEntry(content)
+		versioned.Extended = map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v456")}
+		w := httptest.NewRecorder()
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin?versionId=v456", nil).WithContext(ctx)
+
+		err := s3a.streamFromVolumeServers(w, r, versioned, "", "mybucket", "dir/obj.bin", "v456")
+
+		require.Error(t, err)
+		assert.Nil(t, client.gotLoc, "a versioned read must not serve the unversioned remote object")
+	})
+}
+
+// the deferred status commit must be invisible on the success path: a readable
+// local object still streams with the same status and headers as before
+func TestS3LocalReadCommitsStatusOnFirstWrite(t *testing.T) {
+	content := []byte("0123456789")
+	newLocalServer := func(t *testing.T, name string) *S3ApiServer {
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, name, nil))
+		cache := chunk_cache.NewChunkCacheInMemory(16)
+		cache.SetChunk("1,0123456789ab", content)
+		s3a.readerCache = filer.NewReaderCache(8, cache, s3a.filerClient.GetLookupFileIdFunction(), s3a.filerClient)
+		return s3a
+	}
+	localEntry := func() *filer_pb.Entry {
+		local := cachedEntry(content)
+		local.RemoteEntry = nil
+		return local
+	}
+
+	t.Run("readable local object streams a 200", func(t *testing.T) {
+		s3a := newLocalServer(t, "faketest-localok")
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, localEntry(), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Equal(t, content, w.Body.Bytes())
+		assert.Equal(t, "10", w.Header().Get("Content-Length"))
+	})
+
+	t.Run("readable range streams a 206 with range headers", func(t *testing.T) {
+		s3a := newLocalServer(t, "faketest-localrange")
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		r.Header.Set("Range", "bytes=2-5")
+
+		err := s3a.streamFromVolumeServers(w, r, localEntry(), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusPartialContent, w.Code)
+		assert.Equal(t, content[2:6], w.Body.Bytes())
+		assert.Equal(t, "bytes 2-5/10", w.Header().Get("Content-Range"))
+		assert.Equal(t, "4", w.Header().Get("Content-Length"))
+	})
+}
+
+// a multi-chunk object whose later chunk's volume server is unreachable
+type truncatedReaderAt struct {
+	data    []byte
+	breakAt int64
+	err     error
+}
+
+func (t truncatedReaderAt) ReadAt(p []byte, offset int64) (int, error) {
+	if offset >= t.breakAt {
+		return 0, t.err
+	}
+	return copy(p, t.data[offset:t.breakAt]), nil
+}
+
+// a client that disconnected mid-response
+type failingWriter struct{ err error }
+
+func (f failingWriter) Write(p []byte) (int, error) { return 0, f.err }
+
+// the window the probe cannot cover: the byte at offset reads fine, the response
+// is committed, and only then does a later chunk turn out to be unreadable
+func TestStreamRangeToClientFinishesFromRemote(t *testing.T) {
+	content := []byte("0123456789")
+	size := int64(len(content))
+	newServer := func(t *testing.T, name string) (*S3ApiServer, *fakeStreamRemoteClient) {
+		client := &fakeStreamRemoteClient{data: content}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		return newLocalReadFallbackServer(t, startStreamThroughFiler(t, name, nil)), client
+	}
+
+	t.Run("later chunk failure is finished from the remote", func(t *testing.T) {
+		s3a, client := newServer(t, "faketest-midstream")
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		local := truncatedReaderAt{data: content, breakAt: 4, err: errors.New("volume: connection refused")}
+
+		written, err := s3a.streamRangeToClient(w, r, local, cachedEntry(content), "mybucket", "dir/obj.bin", 0, size, size, "")
+
+		require.NoError(t, err)
+		assert.Equal(t, size, written)
+		assert.Equal(t, content, w.Body.Bytes())
+		assert.Equal(t, int64(4), client.gotOffset, "the remote must resume where the local copy stopped")
+		assert.Equal(t, int64(6), client.gotSize)
+	})
+
+	t.Run("a short local read reported as clean EOF is not served truncated", func(t *testing.T) {
+		s3a, client := newServer(t, "faketest-shortread")
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		local := truncatedReaderAt{data: content, breakAt: 7, err: io.EOF}
+
+		written, err := s3a.streamRangeToClient(w, r, local, cachedEntry(content), "mybucket", "dir/obj.bin", 0, size, size, "")
+
+		require.NoError(t, err)
+		assert.Equal(t, size, written)
+		assert.Equal(t, content, w.Body.Bytes())
+		assert.Equal(t, int64(7), client.gotOffset)
+	})
+
+	t.Run("range read resumes at the absolute offset", func(t *testing.T) {
+		s3a, client := newServer(t, "faketest-midstreamrange")
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		local := truncatedReaderAt{data: content, breakAt: 5, err: errors.New("volume: connection refused")}
+
+		written, err := s3a.streamRangeToClient(w, r, local, cachedEntry(content), "mybucket", "dir/obj.bin", 2, 6, size, "")
+
+		require.NoError(t, err)
+		assert.Equal(t, int64(6), written)
+		assert.Equal(t, content[2:8], w.Body.Bytes())
+		assert.Equal(t, int64(5), client.gotOffset)
+		assert.Equal(t, int64(3), client.gotSize)
+	})
+
+	t.Run("a remote overwritten since caching is not spliced onto the local prefix", func(t *testing.T) {
+		s3a, client := newServer(t, "faketest-midstreamchanged")
+		client.stat = &filer_pb.RemoteEntry{RemoteSize: size, RemoteETag: "reuploaded"}
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		boom := errors.New("volume: connection refused")
+
+		written, err := s3a.streamRangeToClient(w, r, truncatedReaderAt{data: content, breakAt: 4, err: boom}, cachedEntry(content), "mybucket", "dir/obj.bin", 0, size, size, "")
+
+		require.Error(t, err)
+		assert.Equal(t, int64(4), written, "a truncated body beats one mixing two generations")
+		assert.Nil(t, client.gotLoc, "must not read a remote that no longer matches what was cached")
+	})
+
+	t.Run("a local-only object keeps the mid-stream error", func(t *testing.T) {
+		s3a, client := newServer(t, "faketest-midstreamlocal")
+		local := cachedEntry(content)
+		local.RemoteEntry = nil
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		boom := errors.New("volume: connection refused")
+
+		written, err := s3a.streamRangeToClient(w, r, truncatedReaderAt{data: content, breakAt: 4, err: boom}, local, "mybucket", "dir/obj.bin", 0, size, size, "")
+
+		assert.ErrorIs(t, err, boom)
+		assert.Equal(t, int64(4), written)
+		assert.Nil(t, client.gotLoc, "an object that is not remote-mounted has no remote to fall back to")
+	})
+
+	t.Run("a failed write to the client is not refetched from the remote", func(t *testing.T) {
+		s3a, client := newServer(t, "faketest-midstreamwrite")
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		broken := errors.New("write: broken pipe")
+
+		written, err := s3a.streamRangeToClient(failingWriter{err: broken}, r, bytes.NewReader(content), cachedEntry(content), "mybucket", "dir/obj.bin", 0, size, size, "")
+
+		assert.ErrorIs(t, err, broken)
+		assert.Zero(t, written)
+		assert.Nil(t, client.gotLoc, "the client is gone; refetching from the remote is wasted work")
+	})
+}
diff --git a/weed/s3api/s3api_multipart_upload_entry_test.go b/weed/s3api/s3api_multipart_upload_entry_test.go
new file mode 100644
index 0000000000..024c88fa83
--- /dev/null
+++ b/weed/s3api/s3api_multipart_upload_entry_test.go
@@ -0,0 +1,28 @@
+package s3api
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+func TestIsMultipartUploadEntry(t *testing.T) {
+	tests := []struct {
+		name  string
+		entry *filer_pb.Entry
+		want  bool
+	}{
+		{"aborted upload", nil, false},
+		{"directory re-created by a part write", &filer_pb.Entry{IsDirectory: true}, false},
+		{"key emptied", &filer_pb.Entry{IsDirectory: true, Extended: map[string][]byte{s3_constants.ExtMultipartObjectKey: {}}}, false},
+		{"open upload", &filer_pb.Entry{IsDirectory: true, Extended: map[string][]byte{s3_constants.ExtMultipartObjectKey: []byte("a.bin")}}, true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isMultipartUploadEntry(tc.entry); got != tc.want {
+				t.Errorf("isMultipartUploadEntry() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_acl_permissions_test.go b/weed/s3api/s3api_object_acl_permissions_test.go
new file mode 100644
index 0000000000..b8eccce5d7
--- /dev/null
+++ b/weed/s3api/s3api_object_acl_permissions_test.go
@@ -0,0 +1,186 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/require"
+)
+
+// objectACLUpdateFiler records the UpdateEntry request the handler issues so
+// tests can assert that denied requests never write object metadata.
+type objectACLUpdateFiler struct {
+	fakeLookupFiler
+	mu     sync.Mutex
+	update *filer_pb.UpdateEntryRequest
+}
+
+func (f *objectACLUpdateFiler) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.update = req
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+// TestPutObjectAclPermissions exercises PutObjectAcl authorization end to end
+// with signed requests: legacy scoped actions, IAM and bucket policies, canned
+// and XML ACLs, retired owners, and objects without stored owner metadata.
+func TestPutObjectAclPermissions(t *testing.T) {
+	const bucket, object, owner = "acl-bucket", "allowed/image.png", "object-owner"
+	const bucketOwner = "bucket-owner"
+	xmlACL := func(ownerID, granteeID string) string {
+		return fmt.Sprintf(`<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Owner><ID>%s</ID></Owner><AccessControlList><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="CanonicalUser"><ID>%s</ID></Grantee><Permission>FULL_CONTROL</Permission></Grant></AccessControlList></AccessControlPolicy>`, ownerID, granteeID)
+	}
+	tests := []struct {
+		name          string
+		account       string
+		action        Action
+		acl           string
+		policy        string
+		retiredOwner  bool
+		ownerMetadata string
+		body          string
+		status        int
+	}{
+		{name: "bucket-wide write-acp grant", account: owner, action: "WriteAcp:acl-bucket", acl: "private", status: http.StatusOK},
+		{name: "prefix write-acp grant", account: owner, action: "WriteAcp:acl-bucket/allowed/*", acl: "public-read", status: http.StatusOK},
+		{name: "grant outside prefix denied", account: owner, action: "WriteAcp:acl-bucket/other/*", acl: "private", status: http.StatusForbidden},
+		{name: "grant on other bucket denied", account: owner, action: "WriteAcp:other-bucket", acl: "private", status: http.StatusForbidden},
+		{name: "read-only grant denied", account: owner, action: "Read:acl-bucket", acl: "private", status: http.StatusForbidden},
+		{name: "non-owner denied", account: "other-owner", action: "WriteAcp:acl-bucket", acl: "private", status: http.StatusForbidden},
+		{name: "admin sets private", account: AccountAdmin.Id, action: "Admin", acl: "private", status: http.StatusOK},
+		{name: "admin sets public-read", account: AccountAdmin.Id, action: "Admin", acl: "public-read", status: http.StatusOK},
+		{name: "iam policy allow", account: owner, policy: "iam-allow", acl: "private", status: http.StatusOK},
+		{name: "bucket policy allow", account: owner, policy: "bucket-allow", acl: "private", status: http.StatusOK},
+		{name: "iam policy explicit deny", account: owner, action: "WriteAcp:acl-bucket", policy: "iam-deny", acl: "private", status: http.StatusForbidden},
+		{name: "bucket policy explicit deny", account: owner, action: "WriteAcp:acl-bucket", policy: "bucket-deny", acl: "private", status: http.StatusForbidden},
+		{name: "retired owner private", account: AccountAdmin.Id, action: "Admin", acl: "private", retiredOwner: true, status: http.StatusOK},
+		{name: "retired owner public-read", account: AccountAdmin.Id, action: "Admin", acl: "public-read", retiredOwner: true, status: http.StatusOK},
+		{name: "bucket-owner-read with distinct bucket owner", account: AccountAdmin.Id, action: "Admin", acl: "bucket-owner-read", status: http.StatusOK},
+		{name: "bucket-owner-full-control with distinct bucket owner", account: AccountAdmin.Id, action: "Admin", acl: "bucket-owner-full-control", status: http.StatusOK},
+		{name: "xml acl preserves retired owner", account: AccountAdmin.Id, action: "Admin", body: xmlACL(owner, owner), retiredOwner: true, status: http.StatusOK},
+		{name: "xml acl unknown grantee denied", account: AccountAdmin.Id, action: "Admin", body: xmlACL(owner, "unknown-grantee"), retiredOwner: true, status: http.StatusBadRequest},
+		{name: "xml acl owner change denied", account: AccountAdmin.Id, action: "Admin", body: xmlACL("other-owner", owner), status: http.StatusForbidden},
+		{name: "nil extended metadata denied", account: owner, action: "WriteAcp:acl-bucket", acl: "private", ownerMetadata: "nil", status: http.StatusForbidden},
+		{name: "absent owner denied", account: owner, action: "WriteAcp:acl-bucket", acl: "private", ownerMetadata: "absent", status: http.StatusForbidden},
+		{name: "empty owner denied", account: owner, action: "WriteAcp:acl-bucket", acl: "private", ownerMetadata: "empty", status: http.StatusForbidden},
+		{name: "ownerless iam policy denied", account: owner, policy: "iam-allow", acl: "private", ownerMetadata: "absent", status: http.StatusForbidden},
+		{name: "ownerless bucket policy denied", account: owner, policy: "bucket-allow", acl: "private", ownerMetadata: "absent", status: http.StatusForbidden},
+		{name: "admin takes ownerless object private", account: AccountAdmin.Id, action: "Admin", acl: "private", ownerMetadata: "absent", status: http.StatusOK},
+		{name: "admin takes ownerless object public-read", account: AccountAdmin.Id, action: "Admin", acl: "public-read", ownerMetadata: "nil", status: http.StatusOK},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filer := &objectACLUpdateFiler{fakeLookupFiler: fakeLookupFiler{entry: &filer_pb.Entry{
+				Name: "image.png", Extended: map[string][]byte{s3_constants.ExtAmzOwnerKey: []byte(owner)},
+			}}}
+			// Model the ways an object written outside the S3 path (or by an
+			// older version) can lack owner metadata; the requester must not
+			// be treated as the owner in any of them.
+			switch tt.ownerMetadata {
+			case "nil":
+				filer.entry.Extended = nil
+			case "absent":
+				delete(filer.entry.Extended, s3_constants.ExtAmzOwnerKey)
+			case "empty":
+				filer.entry.Extended[s3_constants.ExtAmzOwnerKey] = []byte{}
+			}
+			s3a := newHeadBucketTestServer(t, filer)
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set(bucket, &BucketConfig{Name: bucket, Ownership: s3_constants.OwnershipObjectWriter, Owner: bucketOwner})
+			s3a.iam = NewIdentityAccessManagementWithStore(s3a.option, nil, "memory")
+			t.Cleanup(s3a.iam.Shutdown)
+			s3a.iam.isAuthEnabled = true
+			account := &Account{Id: tt.account, DisplayName: tt.account}
+			identity := &Identity{
+				Name: "acl-test-user", Account: account, Actions: []Action{tt.action}, IsStatic: true,
+				Credentials: []*Credential{{AccessKey: routingTestAccessKey, SecretKey: routingTestSecretKey}},
+			}
+			if tt.action == "" {
+				identity.Actions = nil
+			}
+			s3a.iam.accessKeyIdent[routingTestAccessKey] = identity
+			s3a.iam.nameToIdentity[identity.Name] = identity
+			if !tt.retiredOwner {
+				s3a.iam.accounts[owner] = &Account{Id: owner, DisplayName: owner}
+			}
+			s3a.iam.accounts[bucketOwner] = &Account{Id: bucketOwner, DisplayName: bucketOwner}
+			s3a.iam.accounts[account.Id] = account
+			if tt.policy != "" {
+				effect := "Allow"
+				if strings.HasSuffix(tt.policy, "deny") {
+					effect = "Deny"
+				}
+				statement := fmt.Sprintf(`{"Effect":%q,"Action":"s3:PutObjectAcl","Resource":"arn:aws:s3:::acl-bucket/allowed/*"}`, effect)
+				if strings.HasPrefix(tt.policy, "iam") {
+					require.NoError(t, s3a.iam.PutPolicy("acl-policy", `{"Version":"2012-10-17","Statement":[`+statement+`]}`))
+					identity.PolicyNames = []string{"acl-policy"}
+				} else {
+					statement = strings.Replace(statement, `{"Effect":`, `{"Principal":"*","Effect":`, 1)
+					s3a.iam.policyEngine = NewBucketPolicyEngine()
+					require.NoError(t, s3a.iam.policyEngine.engine.SetBucketPolicy(bucket, `{"Version":"2012-10-17","Statement":[`+statement+`]}`))
+				}
+			}
+
+			req := httptest.NewRequest(http.MethodPut, "http://s3/"+bucket+"/"+object+"?acl", strings.NewReader(tt.body))
+			req = mux.SetURLVars(req, map[string]string{"bucket": bucket, "object": object})
+			req.Header.Set(s3_constants.AmzCannedAcl, tt.acl)
+			signRoutingTestRequest(t, req, tt.body, "s3")
+			// The signing helper replaces the body; restore the bodyless shape
+			// a real HTTP request has so it is not mistaken for an empty XML ACL.
+			if tt.body == "" {
+				req.Body = http.NoBody
+			}
+			rr := httptest.NewRecorder()
+			s3a.iam.Auth(s3a.PutObjectAclHandler, s3_constants.ACTION_WRITE_ACP)(rr, req)
+			require.Equal(t, tt.status, rr.Code, rr.Body.String())
+
+			filer.mu.Lock()
+			update := filer.update
+			filer.mu.Unlock()
+			if tt.status != http.StatusOK {
+				require.Nil(t, update, "denied requests must not write metadata")
+				return
+			}
+			require.NotNil(t, update)
+			require.Equal(t, "/buckets/acl-bucket/allowed", update.Directory)
+			wantOwner := owner
+			if tt.ownerMetadata != "" {
+				// Admins keep the existing fallback that establishes them as
+				// owner of objects without stored owner metadata.
+				wantOwner = tt.account
+			}
+			require.Equal(t, wantOwner, string(update.Entry.Extended[s3_constants.ExtAmzOwnerKey]))
+			grants := GetAcpGrants(update.Entry.Extended)
+			wantGrants := 1
+			if tt.acl == "public-read" || strings.HasPrefix(tt.acl, "bucket-owner-") {
+				wantGrants = 2
+			}
+			require.Len(t, grants, wantGrants)
+			require.Equal(t, wantOwner, aws.StringValue(grants[0].Grantee.ID), "full-control grant must belong to the object owner")
+			require.Equal(t, s3_constants.PermissionFullControl, aws.StringValue(grants[0].Permission))
+			if tt.acl == "public-read" {
+				require.Equal(t, s3_constants.GranteeGroupAllUsers, aws.StringValue(grants[1].Grantee.URI))
+				require.Equal(t, s3_constants.PermissionRead, aws.StringValue(grants[1].Permission))
+			}
+			if strings.HasPrefix(tt.acl, "bucket-owner-") {
+				require.Equal(t, bucketOwner, aws.StringValue(grants[1].Grantee.ID))
+				permission := s3_constants.PermissionRead
+				if tt.acl == "bucket-owner-full-control" {
+					permission = s3_constants.PermissionFullControl
+				}
+				require.Equal(t, permission, aws.StringValue(grants[1].Permission))
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_ambiguous_route_test.go b/weed/s3api/s3api_object_ambiguous_route_test.go
new file mode 100644
index 0000000000..cc7d5c88a8
--- /dev/null
+++ b/weed/s3api/s3api_object_ambiguous_route_test.go
@@ -0,0 +1,226 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func ambiguousRouteServer(t *testing.T, addrs ...pb.ServerAddress) *S3ApiServer {
+	t.Helper()
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	return &S3ApiServer{
+		option:      &S3ApiServerOption{GrpcDialOption: dialOption, Filers: addrs},
+		filerClient: wdclient.NewFilerClient(addrs, dialOption, ""),
+	}
+}
+
+func TestCreateAfterAmbiguousRoute(t *testing.T) {
+	uploaded := []*filer_pb.FileChunk{{FileId: "5,01637037d6", Size: 55}}
+	filePath := "/buckets/b/o"
+	chunksAlive := func(context.Context, []*filer_pb.FileChunk) bool { return true }
+	chunksDead := func(context.Context, []*filer_pb.FileChunk) bool { return false }
+	newS3a := func(t *testing.T, f *fakeLookupFiler) (*S3ApiServer, pb.ServerAddress) {
+		addr := startFakeFiler(t, f)
+		return ambiguousRouteServer(t, addr), addr
+	}
+
+	t.Run("stored entry is this PUT's — route landed", func(t *testing.T) {
+		f := &fakeLookupFiler{entry: &filer_pb.Entry{Name: "o", Chunks: []*filer_pb.FileChunk{{FileId: "5,01637037d6", Size: 55}}}}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksAlive, func(*filer_pb.WriteCondition) s3err.ErrorCode { ran = true; return s3err.ErrNone })
+		if code != s3err.ErrNone || !entryCreated {
+			t.Fatalf("code=%v entryCreated=%v", code, entryCreated)
+		}
+		if ran {
+			t.Fatal("re-committed an entry the route already stored")
+		}
+	})
+
+	t.Run("stored entry is a newer write — refuse stale re-commit", func(t *testing.T) {
+		f := &fakeLookupFiler{entry: &filer_pb.Entry{Name: "o", Chunks: []*filer_pb.FileChunk{{FileId: "5,01637037d7", Size: 55}}}}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksAlive, func(*filer_pb.WriteCondition) s3err.ErrorCode { ran = true; return s3err.ErrNone })
+		if code != s3err.ErrServiceUnavailable {
+			t.Fatalf("code = %v, want ServiceUnavailable", code)
+		}
+		if ran || entryCreated {
+			t.Fatal("stale entry was committed over a newer write")
+		}
+	})
+
+	t.Run("stored entry is a directory, chunks alive — lock path answers", func(t *testing.T) {
+		dir := &filer_pb.Entry{Name: "o", IsDirectory: true}
+		f := &fakeLookupFiler{entry: dir}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		var gotCond *filer_pb.WriteCondition
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksAlive, func(cond *filer_pb.WriteCondition) s3err.ErrorCode {
+			ran = true
+			gotCond = cond
+			return s3err.ErrExistingObjectIsDirectory
+		})
+		if code != s3err.ErrExistingObjectIsDirectory || !ran {
+			t.Fatalf("code=%v ran=%v — a directory conflict with live chunks must reach createUnderLock, which maps it", code, ran)
+		}
+		c := oneClause(t, gotCond)
+		if c.Kind != filer_pb.WriteCondition_IF_ENTRY_EQUAL || !c.ExpectedEntry.IsDirectory {
+			t.Fatalf("directory retry carried %+v, want an IF_ENTRY_EQUAL pin on the directory", c)
+		}
+	})
+
+	// The routed PUT may have committed before a delete removed the entry and
+	// its chunks and a nested write recreated the name as a directory; dead
+	// chunks mean re-committing would store an entry pointing at them.
+	t.Run("stored entry is a directory, chunks unverifiable — refuse", func(t *testing.T) {
+		f := &fakeLookupFiler{entry: &filer_pb.Entry{Name: "o", IsDirectory: true}}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksDead, func(*filer_pb.WriteCondition) s3err.ErrorCode { ran = true; return s3err.ErrNone })
+		if code != s3err.ErrServiceUnavailable || ran {
+			t.Fatalf("code=%v ran=%v — re-committed over a directory with possibly-deleted chunks", code, ran)
+		}
+	})
+
+	t.Run("match behind an unanswered filer — refuse", func(t *testing.T) {
+		deadAddr := startFakeFiler(t, &fakeLookupFiler{lookupErr: context.DeadlineExceeded})
+		matchAddr := startFakeFiler(t, &fakeLookupFiler{entry: &filer_pb.Entry{Name: "o", Chunks: []*filer_pb.FileChunk{{FileId: "5,01637037d6", Size: 55}}}})
+		s3a := ambiguousRouteServer(t, deadAddr, matchAddr)
+		entryCreated := false
+		ran := false
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", deadAddr, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksAlive, func(*filer_pb.WriteCondition) s3err.ErrorCode { ran = true; return s3err.ErrNone })
+		if code != s3err.ErrServiceUnavailable || entryCreated || ran {
+			t.Fatalf("code=%v entryCreated=%v ran=%v — a match behind an unresolved lookup must not finalize", code, entryCreated, ran)
+		}
+	})
+
+	t.Run("entry proven absent, chunks alive — conditional create proceeds", func(t *testing.T) {
+		f := &fakeLookupFiler{}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		var gotCond *filer_pb.WriteCondition
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksAlive, func(cond *filer_pb.WriteCondition) s3err.ErrorCode { ran = true; gotCond = cond; return s3err.ErrNone })
+		if code != s3err.ErrNone || !ran {
+			t.Fatalf("code=%v ran=%v — proven-absent entry did not reach createUnderLock", code, ran)
+		}
+		if c := oneClause(t, gotCond); c.Kind != filer_pb.WriteCondition_IF_NOT_EXISTS {
+			t.Fatalf("absent-entry create carried %+v, want IF_NOT_EXISTS", c)
+		}
+	})
+
+	t.Run("entry absent but chunks unverifiable — refuse", func(t *testing.T) {
+		f := &fakeLookupFiler{}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksDead, func(*filer_pb.WriteCondition) s3err.ErrorCode { ran = true; return s3err.ErrNone })
+		if code != s3err.ErrServiceUnavailable || ran {
+			t.Fatalf("code=%v ran=%v — re-committed an entry over possibly-deleted chunks", code, ran)
+		}
+	})
+
+	t.Run("lookup cannot resolve state — refuse", func(t *testing.T) {
+		f := &fakeLookupFiler{lookupErr: context.DeadlineExceeded}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, nil, &entryCreated, chunksAlive, func(*filer_pb.WriteCondition) s3err.ErrorCode { ran = true; return s3err.ErrNone })
+		if code != s3err.ErrServiceUnavailable || ran {
+			t.Fatalf("code=%v ran=%v — uncertain state still committed", code, ran)
+		}
+	})
+
+	t.Run("finalize fails — recovered entry rolls back", func(t *testing.T) {
+		f := &fakeLookupFiler{entry: &filer_pb.Entry{Name: "o", Chunks: []*filer_pb.FileChunk{{FileId: "5,01637037d6", Size: 55}}}}
+		s3a, owner := newS3a(t, f)
+		entryCreated := false
+		ran := false
+		finalize := &putFinalize{afterCreate: func(*filer_pb.Entry) s3err.ErrorCode { return s3err.ErrInternalError }}
+		code := s3a.createAfterAmbiguousRoute(filePath, "b", "o", owner, &filer_pb.Entry{Name: "o"}, uploaded, finalize, &entryCreated, chunksAlive, func(*filer_pb.WriteCondition) s3err.ErrorCode { ran = true; return s3err.ErrNone })
+		if code != s3err.ErrInternalError || ran {
+			t.Fatalf("code=%v ran=%v", code, ran)
+		}
+		if len(f.deleted) != 1 || f.deleted[0] != filePath {
+			t.Fatalf("recovered entry was not rolled back: deleted=%v", f.deleted)
+		}
+	})
+}
+
+type fakeVersionedDirFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entries map[string]*filer_pb.Entry
+	updates map[string]*filer_pb.Entry
+}
+
+func (f *fakeVersionedDirFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if e, ok := f.entries[path.Join(req.Directory, req.Name)]; ok {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: e}, nil
+	}
+	return nil, filer_pb.ErrNotFound
+}
+
+func (f *fakeVersionedDirFiler) UpdateEntry(ctx context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	f.updates[path.Join(req.Directory, req.Entry.Name)] = req.Entry
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+// A late versioned write keeps the newer latest pointer, but the version it
+// just stored is born noncurrent — without a NoncurrentSinceNs stamp the
+// lifecycle engine never ages it out.
+func TestUpdateLatestVersionInDirectoryBornNoncurrent(t *testing.T) {
+	now := time.Now().UnixNano()
+	newerId := fmt.Sprintf("%016x%s", math.MaxInt64-now, "1111111111111111")
+	olderId := fmt.Sprintf("%016x%s", math.MaxInt64-(now-int64(time.Hour)), "2222222222222222")
+
+	bucketDir := "/buckets/b"
+	versionsPath := path.Join(bucketDir, "o"+s3_constants.VersionsFolder)
+	f := &fakeVersionedDirFiler{
+		entries: map[string]*filer_pb.Entry{
+			versionsPath: {
+				Name:        "o" + s3_constants.VersionsFolder,
+				IsDirectory: true,
+				Extended: map[string][]byte{
+					s3_constants.ExtLatestVersionIdKey:       []byte(newerId),
+					s3_constants.ExtLatestVersionFileNameKey: []byte("newer.v"),
+				},
+			},
+			path.Join(versionsPath, "late.v"): {Name: "late.v"},
+		},
+		updates: map[string]*filer_pb.Entry{},
+	}
+	s3a := ambiguousRouteServer(t, startFakeFiler(t, f))
+	s3a.option.BucketsPath = "/buckets"
+
+	err := s3a.updateLatestVersionInDirectory("b", "o", olderId, "late.v", &filer_pb.Entry{})
+	if err != nil {
+		t.Fatalf("updateLatestVersionInDirectory: %v", err)
+	}
+	stamped := f.updates[path.Join(versionsPath, "late.v")]
+	if stamped == nil {
+		t.Fatal("late version never got its noncurrent stamp")
+	}
+	if stamped.Extended[s3_constants.ExtNoncurrentSinceNsKey] == nil {
+		t.Fatal("stamp did not set ExtNoncurrentSinceNsKey")
+	}
+	if _, pointerTouched := f.updates[versionsPath]; pointerTouched {
+		t.Fatal("the newer latest pointer must not move")
+	}
+}
diff --git a/weed/s3api/s3api_object_anonymous_cache_test.go b/weed/s3api/s3api_object_anonymous_cache_test.go
new file mode 100644
index 0000000000..a349585727
--- /dev/null
+++ b/weed/s3api/s3api_object_anonymous_cache_test.go
@@ -0,0 +1,322 @@
+package s3api
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+// A cache fill may return newer metadata without committing downloaded chunks.
+// Keep lookup snapshots separate so the handler must authorize the RPC response.
+type anonymousReadCacheFiler struct {
+	*anonymousReadFiler
+	cached *filer_pb.Entry
+}
+
+func (f *anonymousReadCacheFiler) CacheRemoteObjectToLocalCluster(context.Context, *filer_pb.CacheRemoteObjectToLocalClusterRequest) (*filer_pb.CacheRemoteObjectToLocalClusterResponse, error) {
+	return &filer_pb.CacheRemoteObjectToLocalClusterResponse{Entry: proto.Clone(f.cached).(*filer_pb.Entry)}, nil
+}
+
+// anonymousReadDirectoryFiler provides the empty version history left after a marker delete.
+type anonymousReadDirectoryFiler struct {
+	*anonymousReadFiler
+}
+
+// ListEntries reports an empty history so recovery cannot mistake the parent for a version.
+func (f *anonymousReadDirectoryFiler) ListEntries(*filer_pb.ListEntriesRequest, filer_pb.SeaweedFiler_ListEntriesServer) error {
+	return nil
+}
+
+// DeleteEntry removes an exhausted version history without triggering missing-RPC retries.
+func (f *anonymousReadDirectoryFiler) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.entries, path.Join(req.Directory, req.Name))
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+func TestAnonymousObjectACLCacheMetadata(t *testing.T) {
+	for _, tc := range []struct {
+		name, change                    string
+		chunks, versioned, ranged, part bool
+		want                            int
+	}{
+		{name: "uncached ACL revoked", change: "acl", want: 403},
+		{name: "uncached policy tag changed", change: "tag", want: 403},
+		{name: "uncached policy tag removed", change: "missing-tag", want: 403},
+		{name: "uncached delete marker", change: "delete", want: 403},
+		{name: "cached ACL revoked", change: "acl", chunks: true, want: 403},
+		{name: "cached policy tag changed", change: "tag", chunks: true, want: 403},
+		{name: "versioned cached denial clears metadata", change: "acl", chunks: true, versioned: true, want: 403},
+		{name: "versioned uncached denial clears metadata", change: "tag", versioned: true, want: 403},
+		{name: "part denial clears metadata", change: "acl", chunks: true, part: true, want: 403},
+		{name: "uncached public origin read", want: 200},
+		{name: "uncached public origin range", ranged: true, want: 206},
+		{name: "uncached public origin part", part: true, want: 206},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			client := &fakeStreamRemoteClient{data: []byte("hello world")}
+			oldMaker, existed := remote_storage.RemoteStorageClientMakers["anonymous-cache-test"]
+			remote_storage.RemoteStorageClientMakers["anonymous-cache-test"] = &fakeStreamRemoteMaker{client: client}
+			t.Cleanup(func() {
+				if existed {
+					remote_storage.RemoteStorageClientMakers["anonymous-cache-test"] = oldMaker
+				} else {
+					delete(remote_storage.RemoteStorageClientMakers, "anonymous-cache-test")
+				}
+			})
+			entry := anonymousReadEntry(anonymousReadGrant("READ"))
+			entry.Content = nil
+			entry.RemoteEntry = &filer_pb.RemoteEntry{RemoteSize: 11}
+			entry.Extended[s3_constants.AmzObjectTaggingPrefix+"classification"] = []byte("public")
+			entry.Extended[s3_constants.ExtObjectLockModeKey] = []byte("GOVERNANCE")
+			entry.Extended[s3_constants.ExtRetentionUntilDateKey] = []byte("1900000000")
+			entry.Extended[s3_constants.ExtLegalHoldKey] = []byte("ON")
+			if tc.part {
+				entry.Extended[s3_constants.SeaweedFSMultipartPartsCount] = []byte("1")
+				boundaries, err := json.Marshal([]PartBoundaryInfo{{PartNumber: 1, StartOffset: 0, EndOffset: 11}})
+				require.NoError(t, err)
+				entry.Extended[s3_constants.SeaweedFSMultipartPartBoundaries] = boundaries
+			}
+			cached := proto.Clone(entry).(*filer_pb.Entry)
+			if tc.chunks {
+				cached.Chunks = []*filer_pb.FileChunk{{FileId: "1,abc", Size: 11}}
+			}
+			switch tc.change {
+			case "acl":
+				cached.Extended[s3_constants.ExtAmzAclKey] = []byte(`[]`)
+			case "tag":
+				cached.Extended[s3_constants.AmzObjectTaggingPrefix+"classification"] = []byte("private")
+			case "missing-tag":
+				delete(cached.Extended, s3_constants.AmzObjectTaggingPrefix+"classification")
+			case "delete":
+				cached.Extended[s3_constants.ExtDeleteMarkerKey] = []byte("true")
+			}
+			f := &anonymousReadCacheFiler{anonymousReadFiler: &anonymousReadFiler{entries: map[string]*filer_pb.Entry{"/buckets/b/o": entry}}, cached: cached}
+			// Reuse one cache slot while differing configurations refresh the fake client,
+			// including when a single subtest is repeated. The fake maker ignores the endpoint.
+			remoteName := "anonymous-cache-origin"
+			mapping, err := proto.Marshal(&remote_pb.RemoteStorageMapping{Mappings: map[string]*remote_pb.RemoteStorageLocation{"/buckets/b": {Name: remoteName, Bucket: "origin", Path: "/"}}})
+			require.NoError(t, err)
+			conf, err := proto.Marshal(&remote_pb.RemoteConf{Name: remoteName, Type: "anonymous-cache-test", S3Endpoint: fmt.Sprintf("https://origin-%p.invalid", client)})
+			require.NoError(t, err)
+			f.entries["/etc/remote/mount.mapping"] = &filer_pb.Entry{Content: mapping}
+			f.entries["/etc/remote/"+remoteName+".conf"] = &filer_pb.Entry{Content: conf}
+			s3a := newPutTestServer(t, startFakeFiler(t, f))
+			s3a.iam = &IdentityAccessManagement{isAuthEnabled: true}
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			config := &BucketConfig{Name: "b", Ownership: s3_constants.OwnershipObjectWriter}
+			s3a.bucketConfigCache.Set("b", config)
+			s3a.policyEngine = NewBucketPolicyEngine()
+			require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"s3:GetObject*","Resource":"arn:aws:s3:::b/*","Condition":{"StringNotEquals":{"s3:ExistingObjectTag/classification":"public"}}}]}`))
+			query := ""
+			if tc.part {
+				query = "partNumber=1"
+			}
+			if tc.versioned {
+				config.Versioning = "Enabled"
+				entry.Extended[s3_constants.ExtVersionIdKey] = []byte("v1")
+				cached.Extended[s3_constants.ExtVersionIdKey] = []byte("v1")
+				f.entries["/buckets/b/o.versions/v_v1"] = entry
+				query = "versionId=v1"
+			}
+			headers := map[string]string{}
+			if tc.ranged {
+				headers["Range"] = "bytes=2-5"
+			}
+			rr := serveAnonymousRead(s3a, http.MethodGet, "o", query, headers)
+			require.Equal(t, tc.want, rr.Code, rr.Body.String())
+			if tc.want == 403 {
+				require.Nil(t, client.gotLoc, "a denied cache snapshot must never reach the origin")
+				require.NotContains(t, rr.Body.String(), "hello world")
+				for _, name := range []string{"x-amz-version-id", s3_constants.AmzObjectLockMode, s3_constants.AmzObjectLockRetainUntilDate, s3_constants.AmzObjectLockLegalHold, s3_constants.AmzMpPartsCount} {
+					require.Empty(t, rr.Header().Get(name), name)
+				}
+			} else {
+				require.NotNil(t, client.gotLoc)
+				if tc.ranged {
+					require.Equal(t, "llo ", rr.Body.String())
+					require.Equal(t, "bytes 2-5/11", rr.Header().Get("Content-Range"))
+				} else {
+					require.Equal(t, "hello world", rr.Body.String())
+				}
+			}
+		})
+	}
+}
+
+// An explicit zero-byte directory marker is a null-version object, unlike a
+// request for the bare prefix. Both versioning states must keep that distinction.
+func TestAnonymousObjectACLVersionedEmptyDirectoryMarker(t *testing.T) {
+	for _, versioning := range []string{"Enabled", "Suspended"} {
+		for _, method := range []string{http.MethodGet, http.MethodHead} {
+			t.Run(versioning+"/"+method, func(t *testing.T) {
+				s3a, f := newAnonymousReadTestServer(t)
+				config, _ := s3a.getBucketConfig("b")
+				config.Versioning = versioning
+				marker := &filer_pb.Entry{Name: "folder", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: "application/octet-stream"}, Extended: map[string][]byte{s3_constants.ExtAmzAclKey: anonymousReadGrant("READ")}}
+				f.entries["/buckets/b/folder"] = marker
+				for _, query := range []string{"", "versionId=null"} {
+					rr := serveAnonymousRead(s3a, method, "folder/", query, nil)
+					require.Equal(t, 200, rr.Code, query+": "+rr.Body.String())
+					require.Equal(t, "null", rr.Header().Get("x-amz-version-id"))
+				}
+				rr := serveAnonymousRead(s3a, method, "folder", "", nil)
+				require.Equal(t, 403, rr.Code, "the bare prefix is not an object, and the miss stays masked for a non-listable bucket")
+				marker.Extended[s3_constants.ExtAmzAclKey] = []byte(`[]`)
+				rr = serveAnonymousRead(s3a, method, "folder/", "", nil)
+				require.Equal(t, 403, rr.Code, rr.Body.String())
+				require.Empty(t, rr.Header().Get("x-amz-version-id"))
+			})
+		}
+	}
+}
+
+// TestAnonymousObjectACLVersionedDirectoryIdentity distinguishes slash keys from
+// implicit parents, deleted markers, and objects stored under the bare prefix.
+func TestAnonymousObjectACLVersionedDirectoryIdentity(t *testing.T) {
+	for _, versioning := range []string{"Enabled", "Suspended"} {
+		for _, method := range []string{http.MethodGet, http.MethodHead} {
+			for _, kind := range []string{"implicit parent", "deleted marker", "regular file", "prefix object", "empty prefix object"} {
+				for _, route := range []struct {
+					name, query          string
+					conditional, history bool
+				}{{name: "latest"}, {name: "null", query: "versionId=null"}, {name: "conditional latest", conditional: true}, {name: "conditional null", query: "versionId=null", conditional: true}, {name: "empty history", history: true}} {
+					t.Run(versioning+"/"+method+"/"+kind+"/"+route.name, func(t *testing.T) {
+						f := &anonymousReadDirectoryFiler{anonymousReadFiler: &anonymousReadFiler{entries: make(map[string]*filer_pb.Entry)}}
+						s3a := newPutTestServer(t, startFakeFiler(t, f))
+						s3a.iam = &IdentityAccessManagement{isAuthEnabled: true}
+						s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+						s3a.bucketConfigCache.Set("b", &BucketConfig{Name: "b", Ownership: s3_constants.OwnershipObjectWriter, Versioning: versioning})
+						s3a.policyEngine = NewBucketPolicyEngine()
+						s3a.iam.policyEngine = s3a.policyEngine
+						require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject*","Resource":"arn:aws:s3:::b/folder/"}]}`))
+						entry := &filer_pb.Entry{Name: "folder", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: 1700000000}}
+						if kind == "deleted marker" {
+							// Deletion clears the marker metadata while preserving a parent with children.
+							entry.Extended = make(map[string][]byte)
+						} else if kind == "regular file" || kind == "prefix object" || kind == "empty prefix object" {
+							entry = anonymousReadEntry([]byte(`[]`))
+							entry.Name = "folder"
+							if kind != "regular file" {
+								entry.MarkPrefixObject()
+							}
+							if kind == "empty prefix object" {
+								entry.Content = nil
+								entry.Attributes.FileSize = 0
+								entry.Attributes.Mime = ""
+							}
+						}
+						f.entries["/buckets/b/folder"] = entry
+						f.entries["/buckets/b/folder/child"] = anonymousReadEntry([]byte(`[]`))
+						assertMissing := func(rr *httptest.ResponseRecorder) {
+							t.Helper()
+							require.Equal(t, http.StatusNotFound, rr.Code, rr.Body.String())
+							for _, header := range []string{"x-amz-version-id", "Last-Modified", "ETag"} {
+								require.Empty(t, rr.Header().Get(header), header)
+							}
+							require.NotContains(t, rr.Body.String(), "hello world")
+						}
+						headers := map[string]string{}
+						if route.conditional {
+							headers["If-Modified-Since"] = "Fri, 01 Jan 2100 00:00:00 GMT"
+						}
+						if route.history {
+							// An empty history exercises recovery instead of the no-history fast path.
+							f.entries["/buckets/b/folder/.versions"] = &filer_pb.Entry{IsDirectory: true, Extended: map[string][]byte{s3_constants.ExtLatestVersionIdKey: []byte("")}}
+						}
+						// Equivalent filer-path spellings must not recover a different object's data.
+						for _, object := range []string{"folder/", "folder//", "folder\\"} {
+							assertMissing(serveAnonymousRead(s3a, method, object, route.query, headers))
+						}
+						// Spellings the policy's folder/ grant does not cover are
+						// masked: a miss must be indistinguishable from a denied read.
+						for _, object := range []string{"folder//x", "folder\\x"} {
+							rr := serveAnonymousRead(s3a, method, object, route.query, headers)
+							require.Equal(t, http.StatusForbidden, rr.Code, rr.Body.String())
+						}
+						if kind == "regular file" || kind == "prefix object" || kind == "empty prefix object" {
+							// A slash-only policy must not authorize data belonging to the bare key.
+							rr := serveAnonymousRead(s3a, method, "folder", route.query, nil)
+							require.Equal(t, http.StatusForbidden, rr.Code, rr.Body.String())
+							entry.Extended[s3_constants.ExtAmzAclKey] = anonymousReadGrant("READ")
+							rr = serveAnonymousRead(s3a, method, "folder", route.query, nil)
+							require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+							if method == http.MethodGet {
+								require.Equal(t, string(entry.Content), rr.Body.String())
+							}
+						}
+						// The private child remains independently protected.
+						rr := serveAnonymousRead(s3a, method, "folder/child", "", nil)
+						require.Equal(t, http.StatusForbidden, rr.Code, rr.Body.String())
+						if method == http.MethodGet {
+							require.Contains(t, rr.Body.String(), "AccessDenied")
+						}
+						// A real historical slash-key version is a file, not a regular-path marker.
+						version := anonymousReadEntry([]byte(`[]`))
+						version.Extended[s3_constants.ExtVersionIdKey] = []byte("v1")
+						f.entries["/buckets/b/folder/.versions/v_v1"] = version
+						f.entries["/buckets/b/folder/.versions"] = &filer_pb.Entry{IsDirectory: true, Extended: map[string][]byte{s3_constants.ExtLatestVersionIdKey: []byte("v1"), s3_constants.ExtLatestVersionFileNameKey: []byte("v_v1")}}
+						for _, versionQuery := range []string{"versionId=v1", ""} {
+							rr = serveAnonymousRead(s3a, method, "folder/", versionQuery, nil)
+							require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+							require.Equal(t, "v1", rr.Header().Get("x-amz-version-id"))
+							if method == http.MethodGet {
+								require.Equal(t, "hello world", rr.Body.String())
+							}
+						}
+					})
+				}
+			}
+		}
+	}
+}
+
+// A literal-backslash key is a different object than its slash spelling only
+// when allowBackslashInObjectKey is set. A public grant on b/folder/ must not
+// authorize an anonymous read of the separate folder\ object under that mode.
+func TestAnonymousObjectACLBackslashKeyIdentity(t *testing.T) {
+	for _, allowBackslash := range []bool{false, true} {
+		t.Run(fmt.Sprintf("allowBackslashInKey=%v", allowBackslash), func(t *testing.T) {
+			s3a, f := newAnonymousReadTestServer(t)
+			s3_constants.SetAllowBackslashInObjectKey(allowBackslash)
+			t.Cleanup(func() { s3_constants.SetAllowBackslashInObjectKey(false) })
+			require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject*","Resource":"arn:aws:s3:::b/folder/"}]}`))
+			slash := anonymousReadEntry([]byte(`[]`))
+			slash.Name = "folder"
+			slash.MarkPrefixObject()
+			f.entries["/buckets/b/folder"] = slash
+			backslash := anonymousReadEntry([]byte(`[]`))
+			backslash.Name = `folder\`
+			f.entries[`/buckets/b/folder\`] = backslash
+
+			rr := serveAnonymousRead(s3a, http.MethodGet, "folder/", "", nil)
+			require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+			require.Equal(t, "hello world", rr.Body.String())
+
+			rr = serveAnonymousRead(s3a, http.MethodGet, `folder\`, "", nil)
+			if !allowBackslash {
+				// Default mode folds the spelling onto the slash key the policy covers.
+				require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+			} else {
+				require.Equal(t, http.StatusForbidden, rr.Code, rr.Body.String())
+				backslash.Extended[s3_constants.ExtAmzAclKey] = anonymousReadGrant("READ")
+				rr = serveAnonymousRead(s3a, http.MethodGet, `folder\`, "", nil)
+				require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+				require.Equal(t, "hello world", rr.Body.String())
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_anonymous_read.go b/weed/s3api/s3api_object_anonymous_read.go
new file mode 100644
index 0000000000..6fd86001aa
--- /dev/null
+++ b/weed/s3api/s3api_object_anonymous_read.go
@@ -0,0 +1,183 @@
+package s3api
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+type anonymousObjectReadContextKey struct{}
+
+// isAnonymousObjectRead identifies requests deferred by AuthWithPublicRead to
+// the selected entry's authorization check. Clients cannot set this marker.
+func isAnonymousObjectRead(r *http.Request) bool {
+	marked, _ := r.Context().Value(anonymousObjectReadContextKey{}).(bool)
+	return marked
+}
+
+// deferAnonymousObjectRead only grants entry-dependent authorization to raw
+// GET/HEAD reads. Subresources, writes and requests carrying credentials keep
+// their normal authentication path; no-auth development mode is unchanged.
+func (s3a *S3ApiServer) deferAnonymousObjectRead(r *http.Request, action Action, bucket, object string) (*http.Request, bool) {
+	if s3a.iam == nil || !s3a.iam.isEnabled() || action != s3_constants.ACTION_READ ||
+		getRequestAuthType(r) != authTypeAnonymous || object == "" || object == "/" ||
+		(r.Method != http.MethodGet && r.Method != http.MethodHead) || isSOSAPIObject(strings.TrimPrefix(object, "/")) {
+		return r, false
+	}
+	resolved := ResolveS3Action(r, string(action), bucket, object)
+	if r.URL.Query().Has("uploads") || (resolved != s3_constants.S3_ACTION_GET_OBJECT && resolved != s3_constants.S3_ACTION_GET_OBJECT_VERSION) {
+		return r, false
+	}
+	// A session token without a signature names no session; drop it so it
+	// cannot influence identity or policy evaluation downstream.
+	r.Header.Del("X-Amz-Security-Token")
+	if q := r.URL.Query(); q.Has("X-Amz-Security-Token") {
+		q.Del("X-Amz-Security-Token")
+		r.URL.RawQuery = q.Encode()
+	}
+
+	// Reuse authentication's internal-header sanitization. A public ACL does
+	// not require an anonymous identity; a configured one still contributes
+	// its permissions and explicit identity-policy denies.
+	identity, _, _ := s3a.iam.authenticateRequestInternal(r)
+	ctx := recordIdentityInContext(r, identity)
+	return r.WithContext(context.WithValue(ctx, anonymousObjectReadContextKey{}, true)), true
+}
+
+// authorizeAnonymousObjectRead evaluates policies and ACLs against the same
+// entry used for the response, including conditional and versioned reads.
+// Explicit policy denies take precedence over every public-access grant.
+func (s3a *S3ApiServer) authorizeAnonymousObjectRead(r *http.Request, bucket, object string, extended map[string][]byte) s3err.ErrorCode {
+	// A version's physical filer path is not another S3 key: accepting it would
+	// bypass GetObjectVersion policies on the logical key. Ordinary user keys
+	// containing ".versions" without internal version metadata are unaffected.
+	key := s3_constants.NormalizeObjectKey(object)
+	version := string(extended[s3_constants.ExtVersionIdKey])
+	if version != "" && strings.HasSuffix(path.Dir(key), s3_constants.VersionsFolder) && path.Base(key) == s3a.getVersionFileName(version) {
+		return s3err.ErrAccessDenied
+	}
+	if string(extended[s3_constants.ExtDeleteMarkerKey]) == "true" {
+		return s3err.ErrAccessDenied
+	}
+	// Loading config also synchronizes a cold bucket policy into the engine.
+	config, code := s3a.getBucketConfig(bucket)
+	if code != s3err.ErrNone {
+		return code
+	}
+	identity, _ := s3_constants.GetIdentityFromContext(r).(*Identity)
+	code, policyAllowed := s3a.checkPolicyWithEntry(r, bucket, object, string(s3_constants.ACTION_READ), buildPrincipalARN(identity, r), extended)
+	if code != s3err.ErrNone {
+		return code
+	}
+	if s3a.iam.isActionExplicitlyDeniedByApplicablePolicies(r, identity, s3_constants.ACTION_READ, bucket, object) {
+		return s3err.ErrAccessDenied
+	}
+	if policyAllowed {
+		return s3err.ErrNone
+	}
+	if identity != nil && s3a.iam.VerifyActionPermission(r, identity, s3_constants.ACTION_READ, bucket, object) == s3err.ErrNone {
+		return s3err.ErrNone
+	}
+	// Match the upload/ACL path: legacy buckets without recorded ownership
+	// controls still accept ACLs. An enforced control explicitly disables them.
+	if config.Ownership == "" || s3_constants.EffectiveOwnership(config.Ownership) != s3_constants.OwnershipBucketOwnerEnforced {
+		if data, exists := extended[s3_constants.ExtAmzAclKey]; exists {
+			// An explicitly stored ACL replaces the legacy bucket-ACL fallback.
+			// Empty, malformed and non-public ACLs must not grant anonymous read.
+			var grants []*s3.Grant
+			if json.Unmarshal(data, &grants) == nil {
+				for _, grant := range grants {
+					if grant != nil && grant.Grantee != nil && grant.Grantee.Type != nil && *grant.Grantee.Type == "Group" &&
+						grant.Grantee.URI != nil && *grant.Grantee.URI == s3_constants.GranteeGroupAllUsers && grant.Permission != nil &&
+						(*grant.Permission == s3_constants.PermissionRead || *grant.Permission == s3_constants.PermissionFullControl) {
+						return s3err.ErrNone
+					}
+				}
+			}
+			return s3err.ErrAccessDenied
+		}
+	}
+	// Preserve SeaweedFS's bucket-public-read behavior for legacy objects that
+	// have no stored object ACL; BucketOwnerEnforced ignores object grants.
+	if config.IsPublicRead {
+		return s3err.ErrNone
+	}
+	return s3err.ErrAccessDenied
+}
+
+// authorizeAnonymousBucketList reports whether an anonymous caller may learn
+// which keys exist in the bucket: bucket listing via policy or identity, or a
+// public-read bucket. Anything else masks the miss as AccessDenied.
+func (s3a *S3ApiServer) authorizeAnonymousBucketList(r *http.Request, bucket string) s3err.ErrorCode {
+	identity, _ := s3_constants.GetIdentityFromContext(r).(*Identity)
+	object := s3_constants.NormalizeObjectKey(mux.Vars(r)["object"])
+	// The caller's query parameters would otherwise retarget these checks
+	// (?policy resolves to GetBucketPolicy) or satisfy a prefix condition on an
+	// unrelated subtree, so each runs on a request with a fixed shape: a
+	// ListBucket scoped to the probed key, and a plain read of the key itself.
+	// A caller that could learn the key's existence either way — by listing or
+	// by getting it — gets the real miss.
+	listReq := r.Clone(r.Context())
+	listReq.URL = &url.URL{Path: "/" + bucket, RawQuery: url.Values{"prefix": {object}}.Encode()}
+	// versionId must survive: a read of a specific version resolves to
+	// s3:GetObjectVersion, and dropping it would let a GetObject grant answer
+	// for versions the caller may not read.
+	readQuery := url.Values{}
+	if v := r.URL.Query().Get("versionId"); v != "" {
+		readQuery.Set("versionId", v)
+	}
+	readReq := r.Clone(r.Context())
+	readReq.URL = &url.URL{Path: "/" + bucket + "/" + object, RawQuery: readQuery.Encode()}
+
+	principal := buildPrincipalARN(identity, r)
+	policyAllowed := false
+	code, allowed := s3a.checkPolicyWithEntry(listReq, bucket, "", string(s3_constants.ACTION_LIST), principal, nil)
+	if code != s3err.ErrNone {
+		return code
+	}
+	policyAllowed = allowed
+	if !policyAllowed {
+		code, allowed = s3a.checkPolicyWithEntry(readReq, bucket, object, string(s3_constants.ACTION_READ), principal, nil)
+		if code != s3err.ErrNone {
+			return code
+		}
+		policyAllowed = allowed
+	}
+	if s3a.iam.isActionExplicitlyDeniedByApplicablePolicies(listReq, identity, s3_constants.ACTION_LIST, bucket, "") ||
+		s3a.iam.isActionExplicitlyDeniedByApplicablePolicies(readReq, identity, s3_constants.ACTION_READ, bucket, object) {
+		return s3err.ErrAccessDenied
+	}
+	if policyAllowed {
+		return s3err.ErrNone
+	}
+	if identity != nil &&
+		(s3a.iam.VerifyActionPermission(listReq, identity, s3_constants.ACTION_LIST, bucket, "") == s3err.ErrNone ||
+			s3a.iam.VerifyActionPermission(readReq, identity, s3_constants.ACTION_READ, bucket, object) == s3err.ErrNone) {
+		return s3err.ErrNone
+	}
+	if config, code := s3a.getBucketConfig(bucket); code == s3err.ErrNone && config.IsPublicRead {
+		return s3err.ErrNone
+	}
+	return s3err.ErrAccessDenied
+}
+
+// writeAnonymousAwareNotFound keeps missing-bucket and missing-key misses
+// indistinguishable from denied reads for anonymous callers: a 404 only
+// reaches the wire when the bucket is anonymously listable. The denial is
+// refined like Auth's, so a malformed bucket name answers InvalidBucketName.
+func (s3a *S3ApiServer) writeAnonymousAwareNotFound(w http.ResponseWriter, r *http.Request, bucket string, code s3err.ErrorCode) {
+	if isAnonymousObjectRead(r) && s3a.authorizeAnonymousBucketList(r, bucket) != s3err.ErrNone {
+		identity, _ := s3_constants.GetIdentityFromContext(r).(*Identity)
+		s3err.WriteErrorResponse(w, r, refineDenialForBucketName(r, identity, s3err.ErrAccessDenied))
+		return
+	}
+	s3err.WriteErrorResponse(w, r, code)
+}
diff --git a/weed/s3api/s3api_object_anonymous_read_test.go b/weed/s3api/s3api_object_anonymous_read_test.go
new file mode 100644
index 0000000000..2f27c78acf
--- /dev/null
+++ b/weed/s3api/s3api_object_anonymous_read_test.go
@@ -0,0 +1,365 @@
+package s3api
+
+import (
+	"context"
+	"crypto/md5"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"path"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Read through the real gRPC lookup and HTTP handlers; replacing an entry does
+// not mutate an earlier snapshot, just as a filer metadata update would not.
+type anonymousReadFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	mu        sync.Mutex
+	entries   map[string]*filer_pb.Entry
+	lookupErr error
+}
+
+func (f *anonymousReadFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.lookupErr != nil {
+		return nil, f.lookupErr
+	}
+	entry := f.entries[path.Join(req.Directory, req.Name)]
+	if entry == nil {
+		return &filer_pb.LookupDirectoryEntryResponse{}, nil
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: proto.Clone(entry).(*filer_pb.Entry)}, nil
+}
+
+func newAnonymousReadTestServer(t *testing.T) (*S3ApiServer, *anonymousReadFiler) {
+	t.Helper()
+	f := &anonymousReadFiler{entries: make(map[string]*filer_pb.Entry)}
+	s3a := newPutTestServer(t, startFakeFiler(t, f))
+	s3a.iam = &IdentityAccessManagement{isAuthEnabled: true}
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set("b", &BucketConfig{Name: "b", Ownership: s3_constants.OwnershipObjectWriter})
+	s3a.policyEngine = NewBucketPolicyEngine()
+	s3a.iam.policyEngine = s3a.policyEngine
+	return s3a, f
+}
+
+func anonymousReadGrant(permission string) []byte {
+	grants := []*s3.Grant{{Grantee: &s3.Grantee{Type: aws.String("Group"), URI: aws.String(s3_constants.GranteeGroupAllUsers)}, Permission: aws.String(permission)}}
+	data, _ := json.Marshal(grants)
+	return data
+}
+
+func anonymousReadEntry(acl []byte) *filer_pb.Entry {
+	sum := md5.Sum([]byte("hello world"))
+	entry := &filer_pb.Entry{Name: "o", Attributes: &filer_pb.FuseAttributes{FileSize: 11, Md5: sum[:], Mtime: 1700000000, Mime: "text/plain"}, Content: []byte("hello world"), Extended: make(map[string][]byte)}
+	if acl != nil {
+		entry.Extended[s3_constants.ExtAmzAclKey] = acl
+	}
+	return entry
+}
+
+func serveAnonymousRead(s3a *S3ApiServer, method, object, query string, headers map[string]string) *httptest.ResponseRecorder {
+	r := httptest.NewRequest(method, "/b/"+object+"?"+query, nil)
+	r = mux.SetURLVars(r, map[string]string{"bucket": "b", "object": object})
+	for name, value := range headers {
+		r.Header.Set(name, value)
+	}
+	handler := s3a.GetObjectHandler
+	if method == http.MethodHead {
+		handler = s3a.HeadObjectHandler
+	}
+	rr := httptest.NewRecorder()
+	s3a.AuthWithPublicRead(handler, s3_constants.ACTION_READ)(rr, r)
+	return rr
+}
+
+func TestAnonymousObjectACLRead(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		acl          []byte
+		publicBucket bool
+		enforced     bool
+		want         int
+	}{
+		{"public read", anonymousReadGrant("READ"), false, false, 200},
+		{"public full control", anonymousReadGrant("FULL_CONTROL"), false, false, 200},
+		{"write is not read", anonymousReadGrant("WRITE"), false, false, 403},
+		{"private", []byte(`[]`), false, false, 403},
+		{"missing ACL private bucket", nil, false, false, 403},
+		{"legacy public bucket", nil, true, false, 200},
+		{"explicit private public bucket", []byte(`[]`), true, false, 403},
+		{"malformed public bucket", []byte(`{broken`), true, false, 403},
+		{"null grant", []byte(`[null]`), false, false, 403},
+		{"wrong grantee type", []byte(`[{"Grantee":{"Type":"CanonicalUser","URI":"http://acs.amazonaws.com/groups/global/AllUsers"},"Permission":"READ"}]`), false, false, 403},
+		{"authenticated users are not anonymous", []byte(`[ {"Grantee":{"Type":"Group","URI":"http://acs.amazonaws.com/groups/global/AuthenticatedUsers"},"Permission":"READ"}]`), false, false, 403},
+		{"ACL disabled", anonymousReadGrant("READ"), false, true, 403},
+	} {
+		for _, method := range []string{http.MethodGet, http.MethodHead} {
+			t.Run(tc.name+"/"+method, func(t *testing.T) {
+				s3a, f := newAnonymousReadTestServer(t)
+				config, _ := s3a.getBucketConfig("b")
+				config.IsPublicRead = tc.publicBucket
+				if tc.enforced {
+					config.Ownership = s3_constants.OwnershipBucketOwnerEnforced
+				}
+				f.entries["/buckets/b/o"] = anonymousReadEntry(tc.acl)
+				rr := serveAnonymousRead(s3a, method, "o", "", nil)
+				require.Equal(t, tc.want, rr.Code, rr.Body.String())
+				if tc.want == 200 && method == http.MethodGet {
+					require.Equal(t, "hello world", rr.Body.String())
+				}
+				if tc.want == 403 {
+					require.NotContains(t, rr.Body.String(), "hello world")
+					require.Empty(t, rr.Header().Get("ETag"))
+				}
+			})
+		}
+	}
+}
+
+func TestAnonymousObjectACLRangeConditionalAndRevocation(t *testing.T) {
+	s3a, f := newAnonymousReadTestServer(t)
+	f.entries["/buckets/b/o"] = anonymousReadEntry(anonymousReadGrant("READ"))
+	rr := serveAnonymousRead(s3a, http.MethodGet, "o", "", map[string]string{"Range": "bytes=1-4"})
+	require.Equal(t, 206, rr.Code, rr.Body.String())
+	require.Equal(t, "ello", rr.Body.String())
+	require.Equal(t, "bytes 1-4/11", rr.Header().Get("Content-Range"))
+	etag := rr.Header().Get("ETag")
+	require.NotEmpty(t, etag)
+	rr = serveAnonymousRead(s3a, http.MethodGet, "o", "", map[string]string{"If-None-Match": etag})
+	require.Equal(t, 304, rr.Code)
+	f.mu.Lock()
+	f.entries["/buckets/b/o"] = anonymousReadEntry([]byte(`[]`))
+	f.mu.Unlock()
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		for _, headers := range []map[string]string{nil, {"Range": "bytes=1-4"}, {"If-None-Match": etag}, {"If-Match": "\"other\""}} {
+			rr = serveAnonymousRead(s3a, method, "o", "", headers)
+			require.Equal(t, 403, rr.Code, rr.Body.String())
+			require.Empty(t, rr.Header().Get("ETag"))
+		}
+	}
+}
+
+func TestAnonymousObjectACLPolicy(t *testing.T) {
+	for _, tc := range []struct {
+		name, statement string
+		acl             []byte
+		tag             string
+		want            int
+	}{
+		{"explicit deny", `{"Effect":"Deny","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}`, anonymousReadGrant("READ"), "", 403},
+		{"unrelated deny", `{"Effect":"Deny","Principal":"*","Action":"s3:PutObject","Resource":"arn:aws:s3:::b/*"}`, anonymousReadGrant("READ"), "", 200},
+		{"tag deny matching", `{"Effect":"Deny","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*","Condition":{"StringNotEquals":{"s3:ExistingObjectTag/classification":"public"}}}`, anonymousReadGrant("READ"), "private", 403},
+		{"tag deny nonmatching", `{"Effect":"Deny","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*","Condition":{"StringNotEquals":{"s3:ExistingObjectTag/classification":"public"}}}`, anonymousReadGrant("READ"), "public", 200},
+		{"tag allow private ACL", `{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*","Condition":{"StringEquals":{"s3:ExistingObjectTag/classification":"public"}}}`, []byte(`[]`), "public", 200},
+		{"tag allow nonmatching", `{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*","Condition":{"StringEquals":{"s3:ExistingObjectTag/classification":"public"}}}`, []byte(`[]`), "private", 403},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s3a, f := newAnonymousReadTestServer(t)
+			entry := anonymousReadEntry(tc.acl)
+			entry.Extended[s3_constants.AmzObjectTaggingPrefix+"classification"] = []byte(tc.tag)
+			f.entries["/buckets/b/o"] = entry
+			require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[`+tc.statement+`]}`))
+			for _, method := range []string{http.MethodGet, http.MethodHead} {
+				rr := serveAnonymousRead(s3a, method, "o", "", nil)
+				require.Equal(t, tc.want, rr.Code, rr.Body.String())
+			}
+		})
+	}
+}
+
+func TestAnonymousObjectACLVersionAndDirectory(t *testing.T) {
+	s3a, f := newAnonymousReadTestServer(t)
+	config, _ := s3a.getBucketConfig("b")
+	config.Versioning = "Enabled"
+	public := anonymousReadEntry(anonymousReadGrant("READ"))
+	public.Extended[s3_constants.ExtVersionIdKey] = []byte("public-version")
+	public.Name = "v_public-version"
+	private := anonymousReadEntry([]byte(`[]`))
+	private.Extended[s3_constants.ExtVersionIdKey] = []byte("private-version")
+	f.entries["/buckets/b/o.versions/v_public-version"] = public
+	f.entries["/buckets/b/o.versions/v_private-version"] = private
+	f.entries["/buckets/b/o"] = anonymousReadEntry([]byte(`[]`))
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		for _, tc := range []struct {
+			query string
+			want  int
+		}{{"versionId=public-version", 200}, {"versionId=private-version", 403}, {"versionId=null", 403}, {"", 403}} {
+			rr := serveAnonymousRead(s3a, method, "o", tc.query, nil)
+			require.Equal(t, tc.want, rr.Code, rr.Body.String())
+			if tc.want == 403 {
+				require.Empty(t, rr.Header().Get("x-amz-version-id"))
+			}
+		}
+	}
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"s3:GetObjectVersion","Resource":"arn:aws:s3:::b/o"}]}`))
+	rr := serveAnonymousRead(s3a, http.MethodGet, "o", "versionId=public-version", nil)
+	require.Equal(t, 403, rr.Code)
+	// The backing file is not an alternative key for bypassing GetObjectVersion policy.
+	rr = serveAnonymousRead(s3a, http.MethodGet, "o.versions/v_public-version", "", nil)
+	require.Equal(t, 403, rr.Code)
+	// A versioned directory key must not return its public null-version marker.
+	dir := anonymousReadEntry(anonymousReadGrant("READ"))
+	dir.IsDirectory = true
+	f.entries["/buckets/b/folder"] = dir
+	f.entries["/buckets/b/folder/.versions/v_private-version"] = private
+	rr = serveAnonymousRead(s3a, http.MethodGet, "folder/", "versionId=private-version", nil)
+	require.Equal(t, 403, rr.Code)
+}
+
+func TestAnonymousObjectACLDoesNotReplaceAuthentication(t *testing.T) {
+	s3a, f := newAnonymousReadTestServer(t)
+	f.entries["/buckets/b/o"] = anonymousReadEntry(anonymousReadGrant("READ"))
+	for _, header := range []string{"", "invalid", "AWS4-HMAC-SHA256 broken", "AWS invalid:signature"} {
+		rr := serveAnonymousRead(s3a, http.MethodGet, "o", "", map[string]string{"Authorization": header})
+		require.NotEqual(t, 200, rr.Code, rr.Body.String())
+	}
+	for _, query := range []string{"X-Amz-Credential=unknown", "AWSAccessKeyId=unknown"} {
+		rr := serveAnonymousRead(s3a, http.MethodGet, "o", query, nil)
+		require.NotEqual(t, 200, rr.Code, rr.Body.String())
+	}
+	// The metadata ACL must never provide a grant for another API operation.
+	for _, query := range []string{"acl", "tagging", "attributes", "uploadId=upload", "uploads", "retention", "legal-hold"} {
+		called := false
+		r := mux.SetURLVars(httptest.NewRequest(http.MethodGet, "/b/o?"+query, nil), map[string]string{"bucket": "b", "object": "o"})
+		rr := httptest.NewRecorder()
+		s3a.AuthWithPublicRead(func(http.ResponseWriter, *http.Request) { called = true }, s3_constants.ACTION_READ)(rr, r)
+		require.False(t, called, query)
+	}
+	// Keep the existing no-auth development mode, including objects without ACLs.
+	s3a.iam.isAuthEnabled = false
+	f.entries["/buckets/b/o"] = anonymousReadEntry(nil)
+	rr := serveAnonymousRead(s3a, http.MethodGet, "o", "", nil)
+	require.Equal(t, 200, rr.Code, rr.Body.String())
+}
+
+func TestAnonymousObjectACLMetadataFailure(t *testing.T) {
+	s3a, f := newAnonymousReadTestServer(t)
+	f.lookupErr = status.Error(codes.Internal, "metadata unavailable")
+	rr := serveAnonymousRead(s3a, http.MethodGet, "o", "", nil)
+	require.NotEqual(t, 200, rr.Code)
+	require.NotContains(t, rr.Body.String(), "hello world")
+	// Injected internal headers cannot select an authenticated principal.
+	f.lookupErr = nil
+	f.entries["/buckets/b/o"] = anonymousReadEntry([]byte(`[]`))
+	require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::admin:user/admin"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}]}`))
+	rr = serveAnonymousRead(s3a, http.MethodGet, "o", "", map[string]string{s3_constants.SeaweedFSPrincipalHeader: "arn:aws:iam::admin:user/admin", s3_constants.AmzAccountId: "admin"})
+	require.Equal(t, 403, rr.Code)
+	require.False(t, strings.Contains(rr.Body.String(), "hello world"))
+}
+
+func TestAnonymousObjectACLLegacyOwnership(t *testing.T) {
+	s3a, f := newAnonymousReadTestServer(t)
+	config, _ := s3a.getBucketConfig("b")
+	f.entries["/buckets/b/o"] = anonymousReadEntry(anonymousReadGrant("READ"))
+	for _, tc := range []struct {
+		ownership string
+		want      int
+	}{
+		{"", 200}, {s3_constants.OwnershipBucketOwnerPreferred, 200},
+		{s3_constants.OwnershipBucketOwnerEnforced, 403}, {"invalid", 403},
+	} {
+		config.Ownership = tc.ownership
+		for _, method := range []string{http.MethodGet, http.MethodHead} {
+			rr := serveAnonymousRead(s3a, method, "o", "", nil)
+			require.Equal(t, tc.want, rr.Code, tc.ownership)
+		}
+	}
+	// A literal user key containing .versions is allowed without internal version metadata.
+	config.Ownership = ""
+	f.entries["/buckets/b/o.versions/v_literal"] = anonymousReadEntry(anonymousReadGrant("READ"))
+	rr := serveAnonymousRead(s3a, http.MethodGet, "o.versions/v_literal", "", nil)
+	require.Equal(t, 200, rr.Code, rr.Body.String())
+}
+
+func TestAnonymousObjectACLConfiguredIdentity(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		public   bool
+		actions  []Action
+		policy   string
+		disabled bool
+		want     int
+	}{
+		{"legacy anonymous permission", false, []Action{s3_constants.ACTION_READ}, "", false, 200},
+		{"identity policy allow", false, nil, `{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}`, false, 200},
+		// The fixture bucket "b" is shorter than S3's three-character minimum,
+		// so a denial for a resolved identity answers InvalidBucketName.
+		{"identity deny beats object ACL", true, nil, `{"Effect":"Deny","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*"}`, false, 400},
+		{"disabled identity cannot grant", false, []Action{s3_constants.ACTION_READ}, "", true, 403},
+		{"public ACL does not require identity", true, nil, "", true, 200},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			s3a, f := newAnonymousReadTestServer(t)
+			acl := []byte(`[]`)
+			if tc.public {
+				acl = anonymousReadGrant("READ")
+			}
+			f.entries["/buckets/b/o"] = anonymousReadEntry(acl)
+			identity := &Identity{Name: s3_constants.AccountAnonymousId, Actions: tc.actions, Disabled: tc.disabled}
+			if tc.policy != "" {
+				identity.PolicyNames = []string{"anonymous-policy"}
+				s3a.iam.iamPolicyEngine = policy_engine.NewPolicyEngine()
+				require.NoError(t, s3a.iam.iamPolicyEngine.SetBucketPolicy("anonymous-policy", `{"Version":"2012-10-17","Statement":[`+tc.policy+`]}`))
+			}
+			s3a.iam.identityAnonymous = identity
+			rr := serveAnonymousRead(s3a, http.MethodGet, "o", "", nil)
+			require.Equal(t, tc.want, rr.Code, rr.Body.String())
+		})
+	}
+}
+
+func TestAnonymousObjectACLRemoteCacheReauthorization(t *testing.T) {
+	for _, revokeACL := range []bool{true, false} {
+		t.Run(map[bool]string{true: "ACL revoked", false: "policy tag changed"}[revokeACL], func(t *testing.T) {
+			cached := anonymousReadEntry(anonymousReadGrant("READ"))
+			cached.Content = nil
+			cached.Chunks = []*filer_pb.FileChunk{{FileId: "1,abc", Size: 11}}
+			if revokeACL {
+				cached.Extended[s3_constants.ExtAmzAclKey] = []byte(`[]`)
+			} else {
+				cached.Extended[s3_constants.AmzObjectTaggingPrefix+"classification"] = []byte("private")
+			}
+			address := startFakeCacheFiler(t, &fakeCacheFiler{cache: func(context.Context, *filer_pb.CacheRemoteObjectToLocalClusterRequest) (*filer_pb.CacheRemoteObjectToLocalClusterResponse, error) {
+				return &filer_pb.CacheRemoteObjectToLocalClusterResponse{Entry: cached}, nil
+			}})
+			s3a := newPutTestServer(t, address)
+			s3a.iam = &IdentityAccessManagement{isAuthEnabled: true}
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set("b", &BucketConfig{Name: "b", Ownership: s3_constants.OwnershipObjectWriter})
+			s3a.policyEngine = NewBucketPolicyEngine()
+			if !revokeACL {
+				require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::b/*","Condition":{"StringNotEquals":{"s3:ExistingObjectTag/classification":"public"}}}]}`))
+			}
+			r := mux.SetURLVars(httptest.NewRequest(http.MethodGet, "/b/o", nil), map[string]string{"bucket": "b", "object": "o"})
+			r, deferred := s3a.deferAnonymousObjectRead(r, s3_constants.ACTION_READ, "b", "o")
+			require.True(t, deferred)
+			entry := anonymousReadEntry(anonymousReadGrant("READ"))
+			entry.Content = nil
+			entry.RemoteEntry = &filer_pb.RemoteEntry{RemoteSize: 11}
+			entry.Extended[s3_constants.AmzObjectTaggingPrefix+"classification"] = []byte("public")
+			require.Equal(t, s3err.ErrNone, s3a.authorizeAnonymousObjectRead(r, "b", "o", entry.Extended))
+			w := httptest.NewRecorder()
+			err := s3a.streamFromVolumeServers(w, r, entry, "", "b", "o", "")
+			require.Error(t, err)
+			require.Equal(t, http.StatusForbidden, w.Code, w.Body.String())
+			require.NotContains(t, w.Body.String(), "hello world")
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers.go b/weed/s3api/s3api_object_handlers.go
index dee0fb0cb6..ab01cfda36 100644
--- a/weed/s3api/s3api_object_handlers.go
+++ b/weed/s3api/s3api_object_handlers.go
@@ -21,7 +21,11 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
 	"github.com/seaweedfs/seaweedfs/weed/security"
+	weed_server "github.com/seaweedfs/seaweedfs/weed/server"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
@@ -31,6 +35,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 )
 
 // zeroBuf is a reusable buffer of zero bytes for padding operations
@@ -39,16 +44,43 @@ var zeroBuf = make([]byte, 32*1024)
 
 // countingWriter wraps an io.Writer to count bytes written
 type countingWriter struct {
-	w       io.Writer
-	written int64
+	w        io.Writer
+	written  int64
+	writeErr error
 }
 
 func (cw *countingWriter) Write(p []byte) (int, error) {
 	n, err := cw.w.Write(p)
 	cw.written += int64(n)
+	if err != nil {
+		cw.writeErr = err
+	}
 	return n, err
 }
 
+// commitOnFirstWrite defers the status line until the first body write, so the
+// first read from the volume servers must succeed before the 200 is committed
+// and a missing needle still gets a clean 5xx instead of a broken 200 body.
+type commitOnFirstWrite struct {
+	w         io.Writer
+	commit    func()
+	committed bool
+}
+
+func (c *commitOnFirstWrite) Write(p []byte) (int, error) {
+	c.Commit()
+	return c.w.Write(p)
+}
+
+// Commit commits the response if the first body write has not already done so;
+// a zero-length body never writes, so a successful stream must end with this.
+func (c *commitOnFirstWrite) Commit() {
+	if !c.committed {
+		c.committed = true
+		c.commit()
+	}
+}
+
 // adjustRangeForPart adjusts a client's Range header to absolute offsets within a part.
 // Parameters:
 //   - partStartOffset: the absolute start offset of the part in the object
@@ -149,8 +181,10 @@ func (s3a *S3ApiServer) parseAndValidateRange(w http.ResponseWriter, r *http.Req
 		return 0, totalSize, false, nil
 	}
 
-	// Empty directory: 404. A file promoted to a directory keeps its data and stays retrievable.
-	if entry.IsDirectory && totalSize == 0 {
+	// Empty directory: 404. A file promoted to a directory keeps its data and
+	// stays retrievable, and a stored directory-key marker is an object, not a
+	// missing key — an unsatisfiable range answers 416.
+	if entry.IsDirectory && totalSize == 0 && !entry.IsDirectoryKeyObject() {
 		s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
 		return 0, 0, false, newStreamErrorWithResponse(fmt.Errorf("directory object %s/%s cannot be retrieved", bucket, object))
 	}
@@ -356,7 +390,20 @@ func (s3a *S3ApiServer) hasChildren(ctx context.Context, bucket, prefix string)
 // Such a path is not an S3 object: GET/HEAD answer 404 like AWS does for a prefix, and
 // Hadoop-style clients then discover the directory through their LIST fallback.
 func isBareDirectory(entry *filer_pb.Entry) bool {
-	return entry != nil && entry.IsDirectory && filer.FileSize(entry) == 0
+	return entry != nil && entry.IsDirectory && filer.FileSize(entry) == 0 && !entry.IsPrefixObject()
+}
+
+// isNullVersionObject distinguishes logical S3 keys that share a regular filer path.
+// A slash key requires an explicit directory marker; a prefix object belongs to the bare key.
+// Actual version files are selected separately and must not be filtered by this predicate.
+func isNullVersionObject(entry *filer_pb.Entry, object string) bool {
+	if entry == nil {
+		return false
+	}
+	if strings.HasSuffix(object, "/") {
+		return entry.IsDirectoryKeyObject() && !entry.IsPrefixObject()
+	}
+	return !isBareDirectory(entry)
 }
 
 // checkDirectoryObject checks if the object is a directory object (ends with "/") and if it exists
@@ -392,9 +439,10 @@ func (s3a *S3ApiServer) checkDirectoryObject(bucket, object string) (*filer_pb.E
 	return dirEntry, true, nil
 }
 
-// resolveObjectEntry resolves the object entry for conditional checks,
-// handling versioned buckets by resolving the latest version.
-func (s3a *S3ApiServer) resolveObjectEntry(bucket, object string) (*filer_pb.Entry, error) {
+// resolveObjectEntry resolves the object entry for conditional checks: the version the
+// request names when the bucket is versioned, otherwise the latest version. Callers
+// with no version to target pass an empty versionId.
+func (s3a *S3ApiServer) resolveObjectEntry(bucket, object, versionId string) (*filer_pb.Entry, error) {
 	// Check if versioning is configured
 	versioningConfigured, err := s3a.isVersioningConfigured(bucket)
 	if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
@@ -403,6 +451,9 @@ func (s3a *S3ApiServer) resolveObjectEntry(bucket, object string) (*filer_pb.Ent
 	}
 
 	if versioningConfigured {
+		if versionId != "" {
+			return s3a.getSpecificObjectVersion(bucket, object, versionId)
+		}
 		// For versioned buckets, we must use getLatestObjectVersion to correctly
 		// find the latest versioned object (in .versions/) or null version.
 		// Standard getEntry would fail to find objects moved to .versions/.
@@ -416,7 +467,7 @@ func (s3a *S3ApiServer) resolveObjectEntry(bucket, object string) (*filer_pb.Ent
 }
 
 // serveDirectoryContent serves the content of a directory object directly
-func (s3a *S3ApiServer) serveDirectoryContent(w http.ResponseWriter, r *http.Request, entry *filer_pb.Entry) {
+func (s3a *S3ApiServer) serveDirectoryContent(w http.ResponseWriter, r *http.Request, entry *filer_pb.Entry, bucket, object string) {
 	// Defensive nil checks - entry and attributes should never be nil, but guard against it
 	if entry == nil || entry.Attributes == nil {
 		glog.Errorf("serveDirectoryContent: entry or attributes is nil")
@@ -424,10 +475,52 @@ func (s3a *S3ApiServer) serveDirectoryContent(w http.ResponseWriter, r *http.Req
 		return
 	}
 
+	// A directory promoted over an uploaded object still holds that object's
+	// chunks while entry.Content stays empty; GET streams them like a regular
+	// object so it delivers the bytes HEAD reports for this entry.
+	if r.Method != http.MethodHead && len(entry.Content) == 0 && len(entry.Chunks) > 0 {
+		sseType := s3a.detectPrimarySSEType(entry)
+		if err := s3a.streamFromVolumeServersWithSSE(w, r, entry, sseType, bucket, object, ""); err != nil {
+			var streamErr *StreamError
+			if errors.As(err, &streamErr) && streamErr.ResponseWritten {
+				return
+			}
+			if isCanceledStreamingError(err) {
+				glog.V(3).Infof("serveDirectoryContent: client disconnected while streaming %s/%s: %v", bucket, object, err)
+				return
+			}
+			glog.Errorf("serveDirectoryContent: failed to stream %s/%s: %v", bucket, object, err)
+			if errors.Is(err, util_http.ErrTooManyRequests) {
+				s3err.WriteErrorResponse(w, r, s3err.ErrRequestBytesExceed)
+			} else if shouldWriteStreamingErrorResponse(err) {
+				s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			}
+		}
+		return
+	}
+
 	// Set content type - use stored MIME type or default. A directory without a stored
 	// mime and without data of its own answers application/x-directory, the marker type
 	// Hadoop-style clients (e.g. flink-s3-fs-presto) require to classify the path as a
 	// directory; defaulting to octet-stream makes them treat it as a 0-byte file.
+	// Marker content may be stored encrypted; decrypt before serving. HEAD
+	// returns no body, so it only checks access and skips decryption — and
+	// any KMS call — entirely.
+	content := entry.Content
+	sseType := s3a.detectPrimarySSEType(entry)
+	if sseType != "" && sseType != "None" {
+		var errCode s3err.ErrorCode
+		if r.Method == http.MethodHead {
+			errCode = s3a.checkDirectorySSEAccess(r, entry, sseType)
+		} else {
+			content, errCode = s3a.decryptDirectoryContent(r, entry, sseType)
+		}
+		if errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
+	}
+
 	contentType := entry.Attributes.Mime
 	if contentType == "" {
 		if entry.IsDirectoryKeyObject() {
@@ -438,8 +531,28 @@ func (s3a *S3ApiServer) serveDirectoryContent(w http.ResponseWriter, r *http.Req
 	}
 	w.Header().Set("Content-Type", contentType)
 
-	// Set content length - use FileSize for accuracy, especially for large files
-	contentLength := int64(entry.Attributes.FileSize)
+	contentLength := int64(len(content))
+	if r.Method == http.MethodHead && len(entry.Chunks) > 0 {
+		contentLength = int64(entry.Attributes.FileSize)
+	}
+	statusCode := http.StatusOK
+	if r.Header.Get("Range") != "" && requestedPartNumber(r) == 0 {
+		// A ranged request answers like the object path does: 206 with its
+		// Content-Range and the range's length, served on GET, reported on HEAD.
+		totalSize := contentLength
+		offset, size, isRangeRequest, rangeErr := s3a.parseAndValidateRange(w, r, entry, totalSize, bucket, object)
+		if rangeErr != nil {
+			return
+		}
+		if isRangeRequest {
+			contentLength = size
+			w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", offset, offset+size-1, totalSize))
+			statusCode = http.StatusPartialContent
+			if r.Method != http.MethodHead {
+				content = content[offset : offset+size]
+			}
+		}
+	}
 	w.Header().Set("Content-Length", strconv.FormatInt(contentLength, 10))
 
 	// Set last modified
@@ -448,37 +561,129 @@ func (s3a *S3ApiServer) serveDirectoryContent(w http.ResponseWriter, r *http.Req
 	// Set ETag
 	w.Header().Set("ETag", "\""+filer.ETag(entry)+"\"")
 
+	s3a.addSSEResponseHeadersFromEntry(w, r, entry, sseType)
+
 	// For HEAD requests, don't write body
 	if r.Method == http.MethodHead {
-		w.WriteHeader(http.StatusOK)
+		w.WriteHeader(statusCode)
 		return
 	}
 
 	// Write content
-	w.WriteHeader(http.StatusOK)
-	if len(entry.Content) > 0 {
-		if _, err := w.Write(entry.Content); err != nil {
+	w.WriteHeader(statusCode)
+	if len(content) > 0 {
+		if _, err := w.Write(content); err != nil {
 			glog.Errorf("serveDirectoryContent: failed to write response: %v", err)
 		}
 	}
 }
 
+// decryptDirectoryContent returns the plaintext of a directory marker's inline
+// entry.Content, which PutObjectHandler stores through the shared SSE path.
+func (s3a *S3ApiServer) decryptDirectoryContent(r *http.Request, entry *filer_pb.Entry, sseType string) ([]byte, s3err.ErrorCode) {
+	var reader io.Reader
+	var err error
+	switch sseType {
+	case s3_constants.SSETypeC:
+		customerKey, parseErr := ParseSSECHeaders(r)
+		if parseErr != nil {
+			return nil, MapSSECErrorToS3Error(parseErr)
+		}
+		if customerKey == nil {
+			return nil, s3err.ErrSSECustomerKeyMissing
+		}
+		if storedKeyMD5 := string(entry.Extended[s3_constants.AmzServerSideEncryptionCustomerKeyMD5]); storedKeyMD5 != "" && customerKey.KeyMD5 != storedKeyMD5 {
+			return nil, s3err.ErrAccessDenied
+		}
+		iv, ivErr := GetSSECIVFromMetadata(entry.Extended)
+		if ivErr != nil {
+			return nil, s3err.ErrInternalError
+		}
+		reader, err = CreateSSECDecryptedReader(bytes.NewReader(entry.Content), customerKey, iv)
+	case s3_constants.SSETypeKMS:
+		sseKMSKey, deserErr := DeserializeSSEKMSMetadata(entry.Extended[s3_constants.SeaweedFSSSEKMSKey])
+		if deserErr != nil {
+			return nil, s3err.ErrInternalError
+		}
+		reader, err = CreateSSEKMSDecryptedReader(bytes.NewReader(entry.Content), sseKMSKey)
+	case s3_constants.SSETypeS3:
+		keyManager := GetSSES3KeyManager()
+		sseS3Key, deserErr := DeserializeSSES3Metadata(entry.Extended[s3_constants.SeaweedFSSSES3Key], keyManager)
+		if deserErr != nil {
+			return nil, s3err.ErrInternalError
+		}
+		iv, ivErr := GetSSES3IV(entry, sseS3Key, keyManager)
+		if ivErr != nil {
+			return nil, s3err.ErrInternalError
+		}
+		reader, err = CreateSSES3DecryptedReader(bytes.NewReader(entry.Content), sseS3Key, iv)
+	default:
+		return entry.Content, s3err.ErrNone
+	}
+	if err != nil {
+		glog.Errorf("decryptDirectoryContent: %v", err)
+		return nil, s3err.ErrInternalError
+	}
+	content, readErr := io.ReadAll(reader)
+	if readErr != nil {
+		glog.Errorf("decryptDirectoryContent: %v", readErr)
+		return nil, s3err.ErrInternalError
+	}
+	return content, s3err.ErrNone
+}
+
+// checkDirectorySSEAccess runs the request-level checks a HEAD of an encrypted
+// marker needs: SSE-C requires the customer key to parse and to match the key
+// the marker was written with; SSE-KMS and SSE-S3 need nothing from the caller.
+func (s3a *S3ApiServer) checkDirectorySSEAccess(r *http.Request, entry *filer_pb.Entry, sseType string) s3err.ErrorCode {
+	if sseType != s3_constants.SSETypeC {
+		return s3err.ErrNone
+	}
+	customerKey, parseErr := ParseSSECHeaders(r)
+	if parseErr != nil {
+		return MapSSECErrorToS3Error(parseErr)
+	}
+	if customerKey == nil {
+		return s3err.ErrSSECustomerKeyMissing
+	}
+	if storedKeyMD5 := string(entry.Extended[s3_constants.AmzServerSideEncryptionCustomerKeyMD5]); storedKeyMD5 != "" && customerKey.KeyMD5 != storedKeyMD5 {
+		return s3err.ErrAccessDenied
+	}
+	return s3err.ErrNone
+}
+
 // handleDirectoryObjectRequest is a helper function that handles directory object requests
 // for both GET and HEAD operations, eliminating code duplication
 func (s3a *S3ApiServer) handleDirectoryObjectRequest(w http.ResponseWriter, r *http.Request, bucket, object, handlerName string) bool {
+	if isAnonymousObjectRead(r) && strings.HasSuffix(object, "/") {
+		// Versioned directory keys must authorize and serve the selected version,
+		// rather than an unrelated directory marker at the regular filer path.
+		versioned, err := s3a.isVersioningConfigured(bucket)
+		if err != nil {
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			return true
+		}
+		if versioned {
+			return false
+		}
+	}
 	// Check if this is a directory object and handle it directly
 	if dirEntry, isDirectoryObject, err := s3a.checkDirectoryObject(bucket, object); err != nil {
 		glog.Errorf("%s: error checking directory object %s/%s: %v", handlerName, bucket, object, err)
 		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 		return true // Request was handled (with error)
 	} else if dirEntry != nil {
+		if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, string(s3_constants.ACTION_READ), dirEntry.Extended, handlerName); errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return true // Request was handled (denied)
+		}
 		glog.V(2).Infof("%s: directory object %s/%s found, serving content", handlerName, bucket, object)
-		s3a.serveDirectoryContent(w, r, dirEntry)
+		s3a.serveDirectoryContent(w, r, dirEntry, bucket, object)
 		return true // Request was handled successfully
 	} else if isDirectoryObject {
 		// Directory object but doesn't exist
 		glog.V(2).Infof("%s: directory object %s/%s not found", handlerName, bucket, object)
-		s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+		s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 		return true // Request was handled (with not found)
 	}
 
@@ -503,11 +708,16 @@ func newListEntry(s3a *S3ApiServer, entry *filer_pb.Entry, key string, dir strin
 	// Determine ETag: prioritize ExtETagKey for versioned objects (supports multipart ETags),
 	// then fall back to filer.ETag() which uses Md5 attribute or calculates from chunks
 	etag := s3a.getObjectETag(entry)
+	size := int64(filer.FileSize(entry))
+	if isDirectory && size == 0 {
+		// A trailing-slash key keeps its body inline in the directory entry, with no FileSize.
+		size = int64(len(entry.Content))
+	}
 	listEntry = ListEntry{
 		Key:          key,
 		LastModified: time.Unix(entry.Attributes.Mtime, 0).UTC(),
 		ETag:         etag,
-		Size:         int64(filer.FileSize(entry)),
+		Size:         size,
 		StorageClass: StorageClass(storageClass),
 	}
 	if fetchOwner {
@@ -564,6 +774,14 @@ func (s3a *S3ApiServer) processConditionalHeaders(w http.ResponseWriter, r *http
 	}
 
 	result := s3a.checkConditionalHeadersForReads(r, bucket, object)
+	if isAnonymousObjectRead(r) && result.Entry != nil {
+		// 304/412 are responses too: authorize before exposing the ETag or the
+		// outcome of a condition on an entry the caller cannot read.
+		if code := s3a.recheckPolicyWithObjectEntry(r, bucket, object, string(s3_constants.ACTION_READ), result.Entry.Extended, handlerName); code != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, code)
+			return result, true
+		}
+	}
 	if result.ErrorCode != s3err.ErrNone {
 		glog.V(3).Infof("%s: Conditional header check failed for %s/%s with error %v", handlerName, bucket, object, result.ErrorCode)
 
@@ -572,7 +790,11 @@ func (s3a *S3ApiServer) processConditionalHeaders(w http.ResponseWriter, r *http
 			w.Header().Set("ETag", result.ETag)
 		}
 
-		s3err.WriteErrorResponse(w, r, result.ErrorCode)
+		if result.ErrorCode == s3err.ErrNoSuchKey || result.ErrorCode == s3err.ErrNoSuchBucket {
+			s3a.writeAnonymousAwareNotFound(w, r, bucket, result.ErrorCode)
+		} else {
+			s3err.WriteErrorResponse(w, r, result.ErrorCode)
+		}
 		return result, true // request handled
 	}
 	return result, false // request not handled
@@ -582,7 +804,7 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 
 	bucket, object := s3_constants.GetBucketAndObject(r)
 	glog.V(3).Infof("GetObjectHandler %s %s", bucket, object)
-	if err := s3a.validateTableBucketObjectPath(bucket, object); err != nil {
+	if _, err := s3a.validateTableBucketObjectPathOrVerify(bucket, object); err != nil {
 		s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
 		return
 	}
@@ -607,6 +829,15 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 			bucket, object, totalTime, conditionalHeadersTime, versioningCheckTime, entryFetchTime, streamTime)
 	}()
 
+	// A non-null versionId only has meaning once versioning has been
+	// configured; reject it before directory or conditional handling can
+	// answer the request as a plain object.
+	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Handle directory objects with shared logic
 	if s3a.handleDirectoryObjectRequest(w, r, bucket, object, "GetObjectHandler") {
 		return // Directory object request was handled
@@ -620,11 +851,9 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	// Check for specific version ID in query parameters
-	versionId := r.URL.Query().Get("versionId")
-
 	var (
 		entry                *filer_pb.Entry // Declare entry at function scope for SSE processing
+		targetVersionId      string
 		versioningConfigured bool
 		err                  error
 	)
@@ -636,7 +865,7 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 	versioningConfigured, err = s3a.isVersioningConfigured(bucket)
 	if err != nil {
 		if err == filer_pb.ErrNotFound {
-			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+			s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchBucket)
 			return
 		}
 		glog.Errorf("Error checking versioning status for bucket %s: %v", bucket, err)
@@ -647,7 +876,6 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 
 	if versioningConfigured {
 		// Handle versioned GET - check if specific version requested
-		var targetVersionId string
 
 		if versionId != "" {
 			// Request for specific version - must look in .versions directory
@@ -656,7 +884,7 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 			if err != nil {
 				glog.Errorf("Failed to get specific version %s: %v", versionId, err)
 				if errors.Is(err, filer_pb.ErrNotFound) {
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchVersion)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchVersion)
 				} else {
 					s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 				}
@@ -682,20 +910,21 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 				entry, err = s3a.getLatestObjectVersion(bucket, object)
 				if err != nil {
 					glog.Errorf("GetObject: Failed to get latest version for %s/%s: %v", bucket, object, err)
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 					return
 				}
 			} else if errors.Is(versionsErr, filer_pb.ErrNotFound) {
 				// .versions/ doesn't exist (confirmed not found), check regular path for null version
 				regularEntry, regularErr := s3a.getEntry(bucketDir, normalizedObject)
-				if regularErr == nil && regularEntry != nil && !isBareDirectory(regularEntry) {
+				// A physical parent or bare-key object is not a trailing-slash null marker.
+				if regularErr == nil && isNullVersionObject(regularEntry, normalizedObject) {
 					// Found object at regular path - this is the null version
 					entry = regularEntry
 					targetVersionId = "null"
 				} else {
 					// No object at regular path either - object doesn't exist
 					glog.V(3).Infof("GetObject: object not found at regular path or .versions for %s/%s", bucket, object)
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 					return
 				}
 			} else {
@@ -704,7 +933,7 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 				entry, err = s3a.getLatestObjectVersion(bucket, object)
 				if err != nil {
 					glog.Errorf("GetObject: Failed to get latest version for %s/%s: %v", bucket, object, err)
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 					return
 				}
 			}
@@ -725,7 +954,7 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 		// Check if this is a delete marker
 		if entry.Extended != nil {
 			if deleteMarker, exists := entry.Extended[s3_constants.ExtDeleteMarkerKey]; exists && string(deleteMarker) == "true" {
-				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 				return
 			}
 		}
@@ -737,11 +966,6 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 			glog.V(2).Infof("GetObject: version %s for %s/%s", targetVersionId, bucket, object)
 		}
 
-		// Set version ID in response header
-		w.Header().Set("x-amz-version-id", targetVersionId)
-
-		// Add object lock metadata to response headers if present
-		s3a.addObjectLockHeadersToResponse(w, entry)
 	}
 
 	versioningCheckTime = time.Since(tVersioning)
@@ -775,7 +999,7 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 				return
 			}
 			if objectEntryForSSE == nil {
-				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 				return
 			}
 		}
@@ -792,7 +1016,7 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 	// A bare directory path is not an object: 404 like AWS instead of an empty 200,
 	// so Hadoop-style clients fall back to LIST discovery. HEAD and ranged GET already 404.
 	if !strings.HasSuffix(object, "/") && isBareDirectory(objectEntryForSSE) {
-		s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+		s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 		return
 	}
 
@@ -802,6 +1026,12 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	// Return version and lock metadata only after authorizing this entry.
+	if versioningConfigured {
+		w.Header().Set("x-amz-version-id", targetVersionId)
+		s3a.addObjectLockHeadersToResponse(w, objectEntryForSSE)
+	}
+
 	// Handle remote storage objects: initiate background caching without blocking
 	// This implements stream-through caching: serve first byte immediately while
 	// caching happens in the background, improving TTFB for large files
@@ -814,75 +1044,15 @@ func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request)
 		// Continue with streaming immediately - will serve from remote or cached chunks
 	}
 
-	// Check if PartNumber query parameter is present (for multipart GET requests)
-	partNumberStr := r.URL.Query().Get("partNumber")
-	if partNumberStr == "" {
-		partNumberStr = r.URL.Query().Get("PartNumber")
-	}
-
-	// If PartNumber is specified, set headers and modify Range to read only that part
-	// This replicates the filer handler logic
-	if partNumberStr != "" {
-		if partNumber, parseErr := strconv.Atoi(partNumberStr); parseErr == nil && partNumber > 0 {
-			// Get actual parts count from metadata (not chunk count)
-			partsCount, partInfo := s3a.getMultipartInfo(objectEntryForSSE, partNumber)
-
-			// Validate part number
-			if partNumber > partsCount {
-				glog.Warningf("GetObject: Invalid part number %d, object has %d parts", partNumber, partsCount)
-				s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPart)
-				return
-			}
-
-			// Set parts count header
-			w.Header().Set(s3_constants.AmzMpPartsCount, strconv.Itoa(partsCount))
-			glog.V(3).Infof("GetObject: Set PartsCount=%d for multipart GET with PartNumber=%d", partsCount, partNumber)
-
-			// Calculate the byte range for this part
-			// Note: ETag is NOT overridden - AWS S3 returns the complete object's ETag
-			// even when requesting a specific part via PartNumber
-			var startOffset, endOffset int64
-			if partInfo != nil {
-				var ok bool
-				startOffset, endOffset, ok = partRange(partInfo, objectEntryForSSE.Chunks)
-				if !ok {
-					glog.Errorf("GetObject: part %d boundary chunks [%d,%d) out of range (chunks: %d)", partNumber, partInfo.StartChunk, partInfo.EndChunk, len(objectEntryForSSE.Chunks))
-					s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
-					return
-				}
-			} else {
-				// Fallback: assume 1:1 part-to-chunk mapping (backward compatibility)
-				chunkIndex := partNumber - 1
-				if chunkIndex >= len(objectEntryForSSE.Chunks) {
-					glog.Warningf("GetObject: Part %d chunk index %d out of range (chunks: %d)", partNumber, chunkIndex, len(objectEntryForSSE.Chunks))
-					s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPart)
-					return
-				}
-				partChunk := objectEntryForSSE.Chunks[chunkIndex]
-				startOffset = partChunk.Offset
-				endOffset = partChunk.Offset + int64(partChunk.Size) - 1
-			}
-
-			// Check if client supplied a Range header - if so, apply it within the part's boundaries
-			// S3 allows both partNumber and Range together, where Range applies within the selected part
-			clientRangeHeader := r.Header.Get("Range")
-			if clientRangeHeader != "" {
-				adjustedStart, adjustedEnd, rangeErr := adjustRangeForPart(startOffset, endOffset, clientRangeHeader)
-				if rangeErr != nil {
-					glog.Warningf("GetObject: Invalid Range for part %d: %v", partNumber, rangeErr)
-					s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRange)
-					return
-				}
-				startOffset = adjustedStart
-				endOffset = adjustedEnd
-				glog.V(3).Infof("GetObject: Client Range %s applied to part %d, adjusted to bytes=%d-%d", clientRangeHeader, partNumber, startOffset, endOffset)
-			}
-
-			// Set Range header to read the requested bytes (full part or client-specified range within part)
-			rangeHeader := fmt.Sprintf("bytes=%d-%d", startOffset, endOffset)
-			r.Header.Set("Range", rangeHeader)
-			glog.V(3).Infof("GetObject: Set Range header for part %d: %s", partNumber, rangeHeader)
+	// If PartNumber is specified, turn the request into a ranged read of that part
+	if partNumber := requestedPartNumber(r); partNumber > 0 {
+		startOffset, endOffset, errCode := s3a.partByteRange(w, r, objectEntryForSSE, partNumber)
+		if errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
 		}
+		r.Header.Set("Range", fmt.Sprintf("bytes=%d-%d", startOffset, endOffset))
+		glog.V(3).Infof("GetObject: part %d served as bytes=%d-%d", partNumber, startOffset, endOffset)
 	}
 
 	// NEW OPTIMIZATION: Stream directly from volume servers, bypassing filer proxy
@@ -1011,27 +1181,55 @@ func (s3a *S3ApiServer) streamFromVolumeServers(w http.ResponseWriter, r *http.R
 			glog.V(1).Infof("streamFromVolumeServers: entry is remote-only, attempting stream-through cache")
 			cacheVersionId := resolvedSourceVersionId(versionId, entry)
 			cachedEntry, cacheErr := s3a.cacheRemoteObjectForStreamingWithShortTimeout(r, entry, bucket, object, cacheVersionId)
+			// A superseded cache fill can return metadata without chunks; authorize it before any origin fallback.
+			if cacheErr == nil && cachedEntry != nil && isAnonymousObjectRead(r) {
+				if code := s3a.recheckPolicyWithObjectEntry(r, bucket, object, string(s3_constants.ACTION_READ), cachedEntry.Extended, "streamFromVolumeServers"); code != s3err.ErrNone {
+					// A denied replacement must not expose metadata headers GET already prepared.
+					for _, name := range []string{"x-amz-version-id", s3_constants.AmzObjectLockMode, s3_constants.AmzObjectLockRetainUntilDate, s3_constants.AmzObjectLockLegalHold, s3_constants.AmzMpPartsCount} {
+						w.Header().Del(name)
+					}
+					s3err.WriteErrorResponse(w, r, code)
+					return newStreamErrorWithResponse(fmt.Errorf("cached entry authorization failed: %v", code))
+				}
+			}
 			if cacheErr == nil && cachedEntry != nil && len(cachedEntry.GetChunks()) > 0 {
 				// Cache completed, use cached chunks
 				chunks = cachedEntry.GetChunks()
 				entry = cachedEntry
 				glog.V(1).Infof("streamFromVolumeServers: successfully cached remote object, got %d chunks", len(chunks))
-			} else if cacheErr != nil && !errors.Is(cacheErr, context.DeadlineExceeded) && !errors.Is(cacheErr, context.Canceled) && status.Code(cacheErr) != codes.DeadlineExceeded && status.Code(cacheErr) != codes.Canceled {
-				// Permanent error (e.g. not found, permission denied) - return final status
-				glog.Errorf("streamFromVolumeServers: permanent cache error for %s/%s: %v", bucket, object, cacheErr)
-				if status.Code(cacheErr) == codes.NotFound {
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
-				} else {
-					s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
-				}
-				return newStreamErrorWithResponse(cacheErr)
+			} else if isFilerNotFound(cacheErr) {
+				// Authoritative: the entry vanished or its remote object is gone
+				return respondObjectGone(w, r, bucket, object, cacheErr)
 			} else {
-				// Client disconnected during the cache wait: report cancellation, not 503,
-				// so we don't write to a closed connection.
+				// Client disconnected during the cache wait: report cancellation, not an
+				// error response, so we don't write to a closed connection.
 				if ctxErr := r.Context().Err(); ctxErr != nil {
 					return ctxErr
 				}
-				// Cache not ready yet; return 503 with Retry-After for client backoff
+				// Cache not ready or failing locally (e.g. no assignable volume): serve
+				// straight from the origin while the detached cache keeps filling for
+				// later reads. An entry resolved to a specific version -- even on a
+				// latest-version read -- has no origin key, so it keeps the error
+				// paths below.
+				if cacheVersionId == "" || cacheVersionId == "null" {
+					served, streamErr := s3a.serveObjectFromRemoteMount(w, r, entry, bucket, object, offset, size, isRangeRequest, totalSize, t0)
+					if served {
+						if streamErr != nil {
+							return newStreamErrorWithResponse(streamErr)
+						}
+						return nil
+					}
+					if errors.Is(streamErr, remote_storage.ErrRemoteObjectNotFound) {
+						return respondObjectGone(w, r, bucket, object, streamErr)
+					}
+				}
+				// Origin unreadable. A permanent cache error is final; a transient one
+				// gets 503 so the client retries the still-filling cache.
+				if cacheErr != nil && !errors.Is(cacheErr, context.DeadlineExceeded) && !errors.Is(cacheErr, context.Canceled) && status.Code(cacheErr) != codes.DeadlineExceeded && status.Code(cacheErr) != codes.Canceled {
+					glog.Errorf("streamFromVolumeServers: permanent cache error for %s/%s: %v", bucket, object, cacheErr)
+					s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+					return newStreamErrorWithResponse(cacheErr)
+				}
 				glog.V(1).Infof("streamFromVolumeServers: remote object %s/%s not cached yet, returning 503 for retry", bucket, object)
 				w.Header().Set("Retry-After", "2")
 				s3err.WriteErrorResponse(w, r, s3err.ErrServiceUnavailable)
@@ -1078,6 +1276,15 @@ func (s3a *S3ApiServer) streamFromVolumeServers(w http.ResponseWriter, r *http.R
 		} else {
 			glog.Errorf("streamFromVolumeServers: failed to resolve chunks: %v", err)
 		}
+		if s3a.shouldFallBackToRemote(entry, totalSize, versionId) {
+			glog.V(1).Infof("streamFromVolumeServers: resolving chunks for %s/%s failed, falling back to remote mount", bucket, object)
+			if served, streamErr := s3a.serveObjectFromRemoteMount(w, r, entry, bucket, object, offset, size, isRangeRequest, totalSize, t0); served {
+				if streamErr != nil {
+					return newStreamErrorWithResponse(streamErr)
+				}
+				return nil
+			}
+		}
 		// Write S3-compliant XML error response
 		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 		return newStreamErrorWithResponse(fmt.Errorf("failed to resolve chunks: %v", err))
@@ -1099,78 +1306,213 @@ func (s3a *S3ApiServer) streamFromVolumeServers(w http.ResponseWriter, r *http.R
 	tStreamPrep := time.Now()
 	chunkViews := filer.ViewFromVisibleIntervals(visibleIntervals, offset, size)
 	reader := filer.NewChunkReaderAtFromClient(ctx, s3a.readerCache, chunkViews, totalSize, filer.DefaultPrefetchCount)
+	defer reader.ReleaseStream()
 	streamPrepTime = time.Since(tStreamPrep)
 
-	// All validation and preparation successful - NOW set headers and write status
-	tHeaderSet := time.Now()
-	s3a.setResponseHeaders(w, r, entry, totalSize)
-
-	// Override/add range-specific headers if this is a range request
-	if isRangeRequest {
-		w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", offset, offset+size-1, totalSize))
-		w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
-	} else {
-		w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
-	}
-	headerSetTime = time.Since(tHeaderSet)
-
-	// Now write status code (headers are all set, stream is ready)
-	if isRangeRequest {
-		w.WriteHeader(http.StatusPartialContent)
-	} else {
-		w.WriteHeader(http.StatusOK)
+	// A cached chunk whose volume server is down, or whose needle was evicted and
+	// now 404s under retry-backoff, would stall and then 500 after the headers are
+	// already sent -- serve the authoritative remote instead.
+	if s3a.shouldFallBackToRemote(entry, totalSize, versionId) {
+		if probeErr := probeReadable(ctx, reader, offset, localReadProbeTimeout); probeErr != nil {
+			if isCanceledStreamingError(probeErr) {
+				glog.V(3).Infof("streamFromVolumeServers: request canceled while probing %s/%s: %v", bucket, object, probeErr)
+				return probeErr
+			}
+			glog.V(1).Infof("streamFromVolumeServers: local read of %s/%s failed (%v), falling back to remote mount", bucket, object, probeErr)
+			if served, streamErr := s3a.serveObjectFromRemoteMount(w, r, entry, bucket, object, offset, size, isRangeRequest, totalSize, t0); served {
+				if streamErr != nil {
+					return newStreamErrorWithResponse(streamErr)
+				}
+				return nil
+			}
+			glog.Errorf("streamFromVolumeServers: local read of %s/%s failed and remote mount unavailable: %v", bucket, object, probeErr)
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			return newStreamErrorWithResponse(probeErr)
+		}
 	}
 
-	// Track time to first byte metric
-	TimeToFirstByte(r.Method, t0, r)
+	// Headers and status are committed on the first body write, once the first
+	// read from the volume servers has succeeded. The client sees the same wire
+	// timing either way -- the status line sits in the server's write buffer
+	// until body bytes arrive -- but a first read that fails now surfaces as a
+	// clean 5xx instead of a 200 with a broken body.
+	body := &commitOnFirstWrite{w: w, commit: func() {
+		tHeaderSet := time.Now()
+		s3a.setResponseHeaders(w, r, entry, totalSize)
+		if isRangeRequest {
+			w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", offset, offset+size-1, totalSize))
+		}
+		w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
+		headerSetTime = time.Since(tHeaderSet)
+		if isRangeRequest {
+			w.WriteHeader(http.StatusPartialContent)
+		} else {
+			w.WriteHeader(http.StatusOK)
+		}
+		TimeToFirstByte(r.Method, t0, r)
+	}}
 
 	// Stream directly to response with counting wrapper.
 	// ChunkReadAt's ReadAt is backed by in-memory prefetched chunk buffers, so
 	// io.CopyBuffer drains them as fast memcpys.
 	tStreamExec := time.Now()
 	glog.V(4).Infof("streamFromVolumeServers: starting chunk reader, offset=%d, size=%d", offset, size)
+	written, err := s3a.streamRangeToClient(body, r, reader, entry, bucket, object, offset, size, totalSize, versionId)
+	streamExecTime = time.Since(tStreamExec)
+	// Track traffic even on partial writes for accurate egress accounting
+	if written > 0 {
+		BucketTrafficSent(written, r)
+	}
+	if err != nil {
+		if !body.committed {
+			if isCanceledStreamingError(err) {
+				glog.V(3).Infof("streamFromVolumeServers: request canceled before first byte of %s/%s: %v", bucket, object, err)
+				return err
+			}
+			glog.Errorf("streamFromVolumeServers: first read of %s/%s failed: %v", bucket, object, err)
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			return newStreamErrorWithResponse(err)
+		}
+		switch {
+		case isCanceledStreamingError(err):
+			// Client disconnected mid-stream (e.g. Nginx upstream timeout, browser cancel) - expected
+			glog.V(3).Infof("streamFromVolumeServers: client disconnected after writing %d bytes: %v", written, err)
+		case errors.Is(err, context.DeadlineExceeded):
+			// Server-side deadline exceeded - unexpected, warrants operator attention
+			glog.Warningf("streamFromVolumeServers: server-side deadline exceeded after writing %d bytes: %v", written, err)
+		default:
+			glog.Errorf("streamFromVolumeServers: streamFn failed after writing %d bytes: %v", written, err)
+		}
+		// Streaming error after WriteHeader was called - response already partially written
+		return newStreamErrorWithResponse(err)
+	}
+	body.Commit()
+	glog.V(4).Infof("streamFromVolumeServers: streamFn completed successfully, wrote %d bytes", written)
+	return nil
+}
+
+// short, so a down volume server or an evicted needle under retry-backoff falls
+// back promptly instead of stalling the request
+const localReadProbeTimeout = 2 * time.Second
+
+// shouldFallBackToRemote reports whether a failed local read may be served from
+// the mounted remote instead: openRemoteStream only reads the unversioned key,
+// and the sizes must match for the bytes to be identical under the
+// already-computed Content-Length.
+func (s3a *S3ApiServer) shouldFallBackToRemote(entry *filer_pb.Entry, totalSize int64, versionId string) bool {
+	if v := resolvedSourceVersionId(versionId, entry); v != "" && v != "null" {
+		return false
+	}
+	remote := entry.GetRemoteEntry()
+	return totalSize > 0 && remote != nil && remote.GetRemoteSize() == totalSize
+}
+
+// the context-honoring read of filer.ChunkReadAt, so probeReadable can bound it
+type ctxReaderAt interface {
+	ReadAtWithTime(ctx context.Context, p []byte, offset int64) (int, int64, error)
+}
+
+// probeReadable decides whether the local copy is usable by reading one byte at
+// offset. Only a returned byte counts -- a zero-byte read, EOF or not, would
+// otherwise wave through a stream that then truncates.
+func probeReadable(ctx context.Context, reader ctxReaderAt, offset int64, timeout time.Duration) error {
+	probeCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	var b [1]byte
+	n, _, err := reader.ReadAtWithTime(probeCtx, b[:], offset)
+	if n == len(b) {
+		return nil
+	}
+	if err == nil {
+		err = io.ErrUnexpectedEOF
+	}
+	return err
+}
+
+func respondObjectGone(w http.ResponseWriter, r *http.Request, bucket, object string, err error) error {
+	glog.V(1).Infof("streamFromVolumeServers: %s/%s not found: %v", bucket, object, err)
+	s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+	return newStreamErrorWithResponse(err)
+}
+
+// serveObjectFromRemoteMount serves [offset, offset+size) straight from the
+// mounted remote. served=false means nothing was written and the caller still
+// owns the error path, with err saying why the origin could not be opened; once
+// served is true the response is committed.
+func (s3a *S3ApiServer) serveObjectFromRemoteMount(w http.ResponseWriter, r *http.Request, entry *filer_pb.Entry, bucket, object string, offset, size int64, isRangeRequest bool, totalSize int64, t0 time.Time) (served bool, err error) {
+	remoteReader, remoteErr := s3a.openRemoteStream(r.Context(), bucket, object, offset, size, nil)
+	if remoteErr != nil {
+		glog.Warningf("streamFromVolumeServers: origin stream %s/%s: %v", bucket, object, remoteErr)
+		return false, remoteErr
+	}
+	defer remoteReader.Close()
+
+	s3a.setResponseHeaders(w, r, entry, totalSize)
+	w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
+	if isRangeRequest {
+		w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", offset, offset+size-1, totalSize))
+		w.WriteHeader(http.StatusPartialContent)
+	} else {
+		w.WriteHeader(http.StatusOK)
+	}
+
+	TimeToFirstByte(r.Method, t0, r)
 	cw := &countingWriter{w: w}
-	// Cap the copy buffer to the response size so small-object GETs (common
-	// for thumbnails, config files, etc.) don't allocate a 256 KiB scratch
-	// buffer per request.
+	_, copyErr := io.CopyN(cw, remoteReader, size)
+	if copyErr == io.EOF {
+		// the origin returned fewer bytes than the entry's RemoteSize
+		copyErr = io.ErrUnexpectedEOF
+	}
+	if cw.written > 0 {
+		BucketTrafficSent(cw.written, r)
+	}
+	if copyErr != nil {
+		glog.V(2).Infof("streamFromVolumeServers: origin stream %s/%s ended after %d bytes: %v", bucket, object, cw.written, copyErr)
+		return true, copyErr
+	}
+	return true, nil
+}
+
+// streamRangeToClient copies the local copy into the already-committed response.
+// The probe only proved the byte at offset readable, so a later chunk can still
+// be gone: finish such a body from the remote -- if it is still the generation
+// that was cached -- instead of truncating it under the Content-Length already
+// sent.
+func (s3a *S3ApiServer) streamRangeToClient(w io.Writer, r *http.Request, reader io.ReaderAt, entry *filer_pb.Entry, bucket, object string, offset, size, totalSize int64, versionId string) (int64, error) {
+	// small-object GETs shouldn't allocate a 256 KiB scratch buffer per request
 	const maxCopyBuf = 256 * 1024
 	copyBufSize := int64(maxCopyBuf)
 	if size > 0 && size < copyBufSize {
 		copyBufSize = size
 	}
-	copyBuf := make([]byte, copyBufSize)
-	_, err = io.CopyBuffer(cw, io.NewSectionReader(reader, offset, size), copyBuf)
-	streamExecTime = time.Since(tStreamExec)
-	// Track traffic even on partial writes for accurate egress accounting
-	if cw.written > 0 {
-		BucketTrafficSent(cw.written, r)
+	cw := &countingWriter{w: w}
+	_, err := io.CopyBuffer(cw, io.NewSectionReader(reader, offset, size), make([]byte, copyBufSize))
+	if err == nil && cw.written < size {
+		// a short local read surfaces as a clean EOF
+		err = io.ErrUnexpectedEOF
 	}
-	if err != nil {
-		switch {
-		case isCanceledStreamingError(err):
-			// Client disconnected mid-stream (e.g. Nginx upstream timeout, browser cancel) - expected
-			glog.V(3).Infof("streamFromVolumeServers: client disconnected after writing %d bytes: %v", cw.written, err)
-		case errors.Is(err, context.DeadlineExceeded):
-			// Server-side deadline exceeded - unexpected, warrants operator attention
-			glog.Warningf("streamFromVolumeServers: server-side deadline exceeded after writing %d bytes: %v", cw.written, err)
-		default:
-			glog.Errorf("streamFromVolumeServers: streamFn failed after writing %d bytes: %v", cw.written, err)
-		}
-		// Streaming error after WriteHeader was called - response already partially written
-		return newStreamErrorWithResponse(err)
+	if err == nil || cw.writeErr != nil || isCanceledStreamingError(err) || !s3a.shouldFallBackToRemote(entry, totalSize, versionId) {
+		return cw.written, err
 	}
-	glog.V(4).Infof("streamFromVolumeServers: streamFn completed successfully, wrote %d bytes", cw.written)
-	return nil
-}
 
-// Shared HTTP client for volume server requests (connection pooling)
-var volumeServerHTTPClient = &http.Client{
-	Timeout: 5 * time.Minute,
-	Transport: &http.Transport{
-		MaxIdleConns:        100,
-		MaxIdleConnsPerHost: 10,
-		IdleConnTimeout:     90 * time.Second,
-	},
+	remaining := size - cw.written
+	glog.V(1).Infof("streamFromVolumeServers: local read of %s/%s failed after %d bytes (%v), finishing from the remote mount", bucket, object, cw.written, err)
+	// the bytes already sent are the cached generation, so splice on the remote
+	// only while it still is that generation
+	remoteReader, remoteErr := s3a.openRemoteStream(r.Context(), bucket, object, offset+cw.written, remaining, entry.GetRemoteEntry())
+	if remoteErr != nil {
+		glog.Warningf("streamFromVolumeServers: origin stream %s/%s: %v", bucket, object, remoteErr)
+		return cw.written, err
+	}
+	defer remoteReader.Close()
+	if _, copyErr := io.CopyN(cw, remoteReader, remaining); copyErr != nil {
+		if copyErr == io.EOF {
+			copyErr = io.ErrUnexpectedEOF
+		}
+		glog.V(2).Infof("streamFromVolumeServers: origin stream %s/%s ended after %d bytes: %v", bucket, object, cw.written, copyErr)
+		return cw.written, copyErr
+	}
+	return cw.written, nil
 }
 
 // createLookupFileIdFunction creates a reusable lookup function for resolving volume URLs
@@ -1276,28 +1618,26 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 	}
 	keyValidateTime = time.Since(tKeyValidate)
 
-	// Set response headers
-	// IMPORTANT: Set ALL headers BEFORE calling WriteHeader (headers are ignored after WriteHeader)
-	tHeaderSet := time.Now()
-	s3a.setResponseHeaders(w, r, entry, totalSize)
-	s3a.addSSEResponseHeadersFromEntry(w, r, entry, sseType)
-
-	// Override/add range-specific headers if this is a range request
-	if isRangeRequest {
-		w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", offset, offset+size-1, totalSize))
-		w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
-	}
-	headerSetTime = time.Since(tHeaderSet)
-
-	// Now write status code (headers are all set)
-	if isRangeRequest {
-		w.WriteHeader(http.StatusPartialContent)
-	} else {
-		w.WriteHeader(http.StatusOK)
-	}
-
-	// Track time to first byte metric
-	TimeToFirstByte(r.Method, t0, r)
+	// Headers and status are committed on the first body write, once the first
+	// fetch and decryption step has succeeded -- the same deferral as
+	// streamFromVolumeServers, so a missing needle or broken decrypt setup
+	// surfaces as a clean 5xx instead of a 200 with a broken body.
+	body := &commitOnFirstWrite{w: w, commit: func() {
+		tHeaderSet := time.Now()
+		s3a.setResponseHeaders(w, r, entry, totalSize)
+		s3a.addSSEResponseHeadersFromEntry(w, r, entry, sseType)
+		if isRangeRequest {
+			w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", offset, offset+size-1, totalSize))
+			w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
+		}
+		headerSetTime = time.Since(tHeaderSet)
+		if isRangeRequest {
+			w.WriteHeader(http.StatusPartialContent)
+		} else {
+			w.WriteHeader(http.StatusOK)
+		}
+		TimeToFirstByte(r.Method, t0, r)
+	}}
 
 	// Full Range Optimization: Use ViewFromChunks to only fetch/decrypt needed chunks
 	tDecryptSetup := time.Now()
@@ -1306,7 +1646,7 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 	if isRangeRequest {
 		glog.V(2).Infof("Using range-aware SSE decryption for offset=%d size=%d", offset, size)
 		streamFetchTime = 0 // No full stream fetch in range-aware path
-		written, err := s3a.streamDecryptedRangeFromChunks(r.Context(), w, entry, offset, size, sseType, decryptionKey)
+		written, err := s3a.streamDecryptedRangeFromChunks(r.Context(), body, entry, offset, size, sseType, decryptionKey)
 		decryptSetupTime = time.Since(tDecryptSetup)
 		copyTime = decryptSetupTime // Streaming is included in decrypt setup for range-aware path
 		// Track traffic even on partial writes for accurate egress accounting
@@ -1314,11 +1654,18 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 			BucketTrafficSent(written, r)
 		}
 		if err != nil {
-			// Error after WriteHeader - response already written
+			if !body.committed {
+				// nothing written yet -- the caller writes the S3 error response
+				return err
+			}
 			return newStreamErrorWithResponse(err)
 		}
+		body.Commit()
 		return nil
 	}
+	if _, err := s3a.flattenManifestChunks(r.Context(), entry); err != nil {
+		return fmt.Errorf("resolve encrypted chunk manifests: %w", err)
+	}
 
 	// Full object path: Optimize multipart vs single-part
 	var decryptedReader io.Reader
@@ -1348,18 +1695,16 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 		} else {
 			// For single-part, get encrypted stream and decrypt
 			tStreamFetch := time.Now()
-			encryptedReader, streamErr := s3a.getEncryptedStreamFromVolumes(r.Context(), entry)
+			encryptedReader, streamErr := s3a.getEncryptedStreamFromVolumes(r.Context(), entry, 0, int64(filer.FileSize(entry)))
 			streamFetchTime = time.Since(tStreamFetch)
 			if streamErr != nil {
-				// Error after WriteHeader - response already written
-				return newStreamErrorWithResponse(streamErr)
+				return streamErr
 			}
 			defer encryptedReader.Close()
 
 			iv := entry.Extended[s3_constants.SeaweedFSSSEIV]
 			if len(iv) == 0 {
-				// Error after WriteHeader - response already written
-				return newStreamErrorWithResponse(fmt.Errorf("SSE-C IV not found in entry metadata"))
+				return fmt.Errorf("SSE-C IV not found in entry metadata")
 			}
 			glog.V(2).Infof("SSE-C decryption: IV length=%d, KeyMD5=%s", len(iv), customerKey.KeyMD5)
 			decryptedReader, err = CreateSSECDecryptedReader(encryptedReader, customerKey, iv)
@@ -1386,11 +1731,10 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 		} else {
 			// For single-part, get encrypted stream and decrypt
 			tStreamFetch := time.Now()
-			encryptedReader, streamErr := s3a.getEncryptedStreamFromVolumes(r.Context(), entry)
+			encryptedReader, streamErr := s3a.getEncryptedStreamFromVolumes(r.Context(), entry, 0, int64(filer.FileSize(entry)))
 			streamFetchTime = time.Since(tStreamFetch)
 			if streamErr != nil {
-				// Error after WriteHeader - response already written
-				return newStreamErrorWithResponse(streamErr)
+				return streamErr
 			}
 			defer encryptedReader.Close()
 
@@ -1419,19 +1763,17 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 		} else {
 			// For single-part, get encrypted stream and decrypt
 			tStreamFetch := time.Now()
-			encryptedReader, streamErr := s3a.getEncryptedStreamFromVolumes(r.Context(), entry)
+			encryptedReader, streamErr := s3a.getEncryptedStreamFromVolumes(r.Context(), entry, 0, int64(filer.FileSize(entry)))
 			streamFetchTime = time.Since(tStreamFetch)
 			if streamErr != nil {
-				// Error after WriteHeader - response already written
-				return newStreamErrorWithResponse(streamErr)
+				return streamErr
 			}
 			defer encryptedReader.Close()
 
 			keyManager := GetSSES3KeyManager()
 			iv, ivErr := GetSSES3IV(entry, sseS3Key, keyManager)
 			if ivErr != nil {
-				// Error after WriteHeader - response already written
-				return newStreamErrorWithResponse(fmt.Errorf("failed to get SSE-S3 IV: %w", ivErr))
+				return fmt.Errorf("failed to get SSE-S3 IV: %w", ivErr)
 			}
 			glog.V(2).Infof("SSE-S3 decryption: KeyID=%s, IV length=%d", sseS3Key.KeyID, len(iv))
 			decryptedReader, err = CreateSSES3DecryptedReader(encryptedReader, sseS3Key, iv)
@@ -1441,8 +1783,7 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 
 	if err != nil {
 		glog.Errorf("SSE decryption error (%s): %v", sseType, err)
-		// Error after WriteHeader - response already written
-		return newStreamErrorWithResponse(fmt.Errorf("failed to create decrypted reader: %w", err))
+		return fmt.Errorf("failed to create decrypted reader: %w", err)
 	}
 
 	// Close the decrypted reader to avoid leaking HTTP bodies
@@ -1457,7 +1798,7 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 	// Stream full decrypted object to client
 	tCopy := time.Now()
 	buf := make([]byte, 128*1024)
-	copied, copyErr := io.CopyBuffer(w, decryptedReader, buf)
+	copied, copyErr := io.CopyBuffer(body, decryptedReader, buf)
 	copyTime = time.Since(tCopy)
 	// Track traffic even on partial writes for accurate egress accounting
 	if copied > 0 {
@@ -1465,9 +1806,13 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 	}
 	if copyErr != nil {
 		glog.Errorf("Failed to copy full object: copied %d bytes: %v", copied, copyErr)
-		// Error after WriteHeader - response already written
+		if !body.committed {
+			// nothing written yet -- the caller writes the S3 error response
+			return copyErr
+		}
 		return newStreamErrorWithResponse(copyErr)
 	}
+	body.Commit()
 	glog.V(3).Infof("Full object request: copied %d bytes", copied)
 	return nil
 }
@@ -1476,9 +1821,15 @@ func (s3a *S3ApiServer) streamFromVolumeServersWithSSE(w http.ResponseWriter, r
 // This implements the filer's ViewFromChunks approach for optimal range performance
 // Returns the number of bytes written and any error
 func (s3a *S3ApiServer) streamDecryptedRangeFromChunks(ctx context.Context, w io.Writer, entry *filer_pb.Entry, offset int64, size int64, sseType string, decryptionKey interface{}) (int64, error) {
-	// Use filer's ViewFromChunks to resolve only needed chunks for the range
 	lookupFileIdFn := s3a.createLookupFileIdFunction()
-	chunkViews := filer.ViewFromChunks(ctx, lookupFileIdFn, entry.GetChunks(), offset, size)
+	resolvedChunks, _, err := filer.ResolveChunkManifest(ctx, lookupFileIdFn, entry.GetChunks(), offset, offset+size, s3a.filerClient)
+	if err != nil {
+		return 0, err
+	}
+	chunkViews, err := filer.ViewFromChunks(ctx, nil, resolvedChunks, offset, size)
+	if err != nil {
+		return 0, err
+	}
 
 	totalWritten := int64(0)
 	targetOffset := offset
@@ -1500,7 +1851,7 @@ func (s3a *S3ApiServer) streamDecryptedRangeFromChunks(ctx context.Context, w io
 
 		// Find the corresponding FileChunk for this chunkView
 		var fileChunk *filer_pb.FileChunk
-		for _, chunk := range entry.GetChunks() {
+		for _, chunk := range resolvedChunks {
 			if chunk.GetFileIdString() == chunkView.FileId {
 				fileChunk = chunk
 				break
@@ -1612,7 +1963,7 @@ func (s3a *S3ApiServer) decryptSSECChunkView(ctx context.Context, fileChunk *fil
 
 		// Fetch FULL encrypted chunk
 		// Note: Fetching full chunk is necessary for proper CTR decryption stream
-		fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView.FileId)
+		fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch full chunk: %w", err)
 		}
@@ -1681,7 +2032,7 @@ func (s3a *S3ApiServer) decryptSSEKMSChunkView(ctx context.Context, fileChunk *f
 		}
 
 		// Fetch FULL encrypted chunk
-		fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView.FileId)
+		fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch full chunk: %w", err)
 		}
@@ -1746,7 +2097,7 @@ func (s3a *S3ApiServer) decryptSSES3ChunkView(ctx context.Context, fileChunk *fi
 		}
 
 		// Fetch FULL encrypted chunk (necessary for proper CTR decryption stream)
-		fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView.FileId)
+		fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch full chunk: %w", err)
 		}
@@ -1792,7 +2143,7 @@ func (s3a *S3ApiServer) decryptSSES3ChunkView(ctx context.Context, fileChunk *fi
 	}
 
 	// Fetch FULL encrypted chunk
-	fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView.FileId)
+	fullChunkReader, err := s3a.fetchFullChunk(ctx, chunkView)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch full chunk: %w", err)
 	}
@@ -1828,8 +2179,37 @@ func (s3a *S3ApiServer) decryptSSES3ChunkView(ctx context.Context, fileChunk *fi
 	return &rc{Reader: limitedReader, Closer: fullChunkReader}, nil
 }
 
-// fetchFullChunk fetches the complete encrypted chunk from volume server
-func (s3a *S3ApiServer) fetchFullChunk(ctx context.Context, fileId string) (io.ReadCloser, error) {
+// fetchFullChunk fetches the complete chunk from the volume server
+func (s3a *S3ApiServer) fetchFullChunk(ctx context.Context, chunkView *filer.ChunkView) (io.ReadCloser, error) {
+	return s3a.fetchChunkData(ctx, chunkView.FileId, chunkView.CipherKey, chunkView.IsGzipped, 0, int64(chunkView.ChunkSize), true)
+}
+
+// fetchChunkViewData fetches data for a chunk view (with range)
+func (s3a *S3ApiServer) fetchChunkViewData(ctx context.Context, chunkView *filer.ChunkView) (io.ReadCloser, error) {
+	return s3a.fetchChunkData(ctx, chunkView.FileId, chunkView.CipherKey, chunkView.IsGzipped, chunkView.OffsetInChunk, int64(chunkView.ViewSize), chunkView.IsFullChunk())
+}
+
+// fetchChunkData reads [offset, offset+size) of a chunk in plaintext space:
+// the volume cipher is decrypted and compression undone by
+// RetriedFetchChunkData. Unencrypted chunks take the streaming range read.
+func (s3a *S3ApiServer) fetchChunkData(ctx context.Context, fileId string, cipherKey []byte, isCompressed bool, offset int64, size int64, isFullChunk bool) (io.ReadCloser, error) {
+	if len(cipherKey) > 0 || isCompressed {
+		lookupFileIdFn := s3a.createLookupFileIdFunction()
+		urlStrings, err := lookupFileIdFn(ctx, fileId)
+		if err != nil || len(urlStrings) == 0 {
+			return nil, fmt.Errorf("failed to lookup chunk %s: %w", fileId, err)
+		}
+		buffer := make([]byte, size)
+		n, err := util_http.RetriedFetchChunkData(ctx, buffer, urlStrings, cipherKey, isCompressed, isFullChunk, offset, fileId, nil)
+		if err != nil {
+			return nil, fmt.Errorf("failed to fetch chunk %s: %w", fileId, err)
+		}
+		return io.NopCloser(bytes.NewReader(buffer[:n])), nil
+	}
+	return s3a.readChunkRange(ctx, fileId, offset, size, isFullChunk)
+}
+
+func (s3a *S3ApiServer) readChunkRange(ctx context.Context, fileId string, offset int64, size int64, isFullChunk bool) (io.ReadCloser, error) {
 	// Lookup the volume server URLs for this chunk
 	lookupFileIdFn := s3a.createLookupFileIdFunction()
 	urlStrings, err := lookupFileIdFn(ctx, fileId)
@@ -1837,63 +2217,25 @@ func (s3a *S3ApiServer) fetchFullChunk(ctx context.Context, fileId string) (io.R
 		return nil, fmt.Errorf("failed to lookup chunk %s: %w", fileId, err)
 	}
 
-	// Use the first URL
-	chunkUrl := urlStrings[0]
+	// Use the first URL (already contains complete URL with fileId). The lookup returns http:// URLs; when
+	// [https.client] is configured the volume servers only speak TLS, so take the global client's scheme.
+	chunkUrl, err := util_http.NormalizeUrl(urlStrings[0])
+	if err != nil {
+		return nil, fmt.Errorf("failed to normalize chunk URL %s: %w", fileId, err)
+	}
 
 	// Generate JWT for volume server authentication (uses config loaded once at startup)
 	jwt := filer.JwtForVolumeServer(fileId)
 
-	// Create request WITHOUT Range header to get full chunk
-	req, err := http.NewRequestWithContext(ctx, "GET", chunkUrl, nil)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create request: %w", err)
-	}
-
-	// Set JWT for authentication
-	if jwt != "" {
-		req.Header.Set("Authorization", security.BearerPrefix+jwt)
-	}
-
-	// Use shared HTTP client
-	resp, err := volumeServerHTTPClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("failed to fetch chunk: %w", err)
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		resp.Body.Close()
-		return nil, fmt.Errorf("unexpected status code %d for chunk %s", resp.StatusCode, fileId)
-	}
-
-	return resp.Body, nil
-}
-
-// fetchChunkViewData fetches encrypted data for a chunk view (with range)
-func (s3a *S3ApiServer) fetchChunkViewData(ctx context.Context, chunkView *filer.ChunkView) (io.ReadCloser, error) {
-	// Lookup the volume server URLs for this chunk
-	lookupFileIdFn := s3a.createLookupFileIdFunction()
-	urlStrings, err := lookupFileIdFn(ctx, chunkView.FileId)
-	if err != nil || len(urlStrings) == 0 {
-		return nil, fmt.Errorf("failed to lookup chunk %s: %w", chunkView.FileId, err)
-	}
-
-	// Use the first URL (already contains complete URL with fileId)
-	chunkUrl := urlStrings[0]
-
-	// Generate JWT for volume server authentication (uses config loaded once at startup)
-	jwt := filer.JwtForVolumeServer(chunkView.FileId)
-
 	// Create request with Range header for the chunk view
-	// chunkUrl already contains the complete URL including fileId
 	req, err := http.NewRequestWithContext(ctx, "GET", chunkUrl, nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create request: %w", err)
 	}
 
 	// Set Range header to fetch only the needed portion of the chunk
-	if !chunkView.IsFullChunk() {
-		rangeEnd := chunkView.OffsetInChunk + int64(chunkView.ViewSize) - 1
-		req.Header.Set("Range", fmt.Sprintf("bytes=%d-%d", chunkView.OffsetInChunk, rangeEnd))
+	if !isFullChunk {
+		req.Header.Set("Range", fmt.Sprintf("bytes=%d-%d", offset, offset+size-1))
 	}
 
 	// Set JWT for authentication
@@ -1901,39 +2243,51 @@ func (s3a *S3ApiServer) fetchChunkViewData(ctx context.Context, chunkView *filer
 		req.Header.Set("Authorization", security.BearerPrefix+jwt)
 	}
 
-	// Use shared HTTP client with connection pooling
-	resp, err := volumeServerHTTPClient.Do(req)
+	// Use the global HTTP client: it carries the [https.client] TLS configuration (CA and client
+	// certificate) that HTTPS volume servers require; a bare http.Client cannot reach them.
+	resp, err := util_http.GetGlobalHttpClient().Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch chunk: %w", err)
 	}
 
 	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusPartialContent {
+		err = util_http.StatusError(chunkUrl, resp)
 		resp.Body.Close()
-		return nil, fmt.Errorf("unexpected status code %d for chunk %s", resp.StatusCode, chunkView.FileId)
+		return nil, err
 	}
 
 	return resp.Body, nil
 }
 
-// getEncryptedStreamFromVolumes gets raw encrypted data stream from volume servers
-func (s3a *S3ApiServer) getEncryptedStreamFromVolumes(ctx context.Context, entry *filer_pb.Entry) (io.ReadCloser, error) {
+// getEncryptedStreamFromVolumes gets a raw encrypted data stream from volume
+// servers for [offset, offset+size) of the entry.
+func (s3a *S3ApiServer) getEncryptedStreamFromVolumes(ctx context.Context, entry *filer_pb.Entry, offset, size int64) (io.ReadCloser, error) {
+	if size <= 0 {
+		return io.NopCloser(bytes.NewReader(nil)), nil
+	}
+
 	// Handle inline content
 	if len(entry.Content) > 0 {
-		return io.NopCloser(bytes.NewReader(entry.Content)), nil
+		content := entry.Content
+		if offset >= int64(len(content)) {
+			content = nil
+		} else {
+			content = content[offset:min(offset+size, int64(len(content)))]
+		}
+		return io.NopCloser(bytes.NewReader(content)), nil
 	}
 
 	// Handle empty files
 	chunks := entry.GetChunks()
 	if len(chunks) == 0 {
-		return io.NopCloser(bytes.NewReader([]byte{})), nil
+		return io.NopCloser(bytes.NewReader(nil)), nil
 	}
 
 	// Reuse shared lookup function to keep volume lookup logic in one place
 	lookupFileIdFn := s3a.createLookupFileIdFunction()
 
 	// Resolve chunks
-	totalSize := int64(filer.FileSize(entry))
-	resolvedChunks, _, err := filer.ResolveChunkManifest(ctx, lookupFileIdFn, chunks, 0, totalSize)
+	resolvedChunks, _, err := filer.ResolveChunkManifest(ctx, lookupFileIdFn, chunks, offset, offset+size, s3a.filerClient)
 	if err != nil {
 		return nil, err
 	}
@@ -1944,8 +2298,8 @@ func (s3a *S3ApiServer) getEncryptedStreamFromVolumes(ctx context.Context, entry
 		s3a.filerClient,
 		filer.JwtForVolumeServer, // Use filer's JWT function (loads config once, generates JWT locally)
 		resolvedChunks,
-		0,
-		totalSize,
+		offset,
+		size,
 		0,
 		4, // prefetch 4 chunks ahead for overlapped fetching
 	)
@@ -2082,10 +2436,10 @@ func (s3a *S3ApiServer) setResponseHeaders(w http.ResponseWriter, r *http.Reques
 
 	// Set checksum header if stored in metadata, but only when:
 	// 1. The request contains "x-amz-checksum-mode: ENABLED" (per AWS S3 spec)
-	// 2. The request is NOT a ranged GET (Range header absent)
+	// 2. The response covers the full object (no Range header, no partNumber)
 	//    The stored checksum covers the full object; returning it for partial
 	//    responses causes SDK checksum validation failures.
-	if r != nil && r.Header.Get("X-Amz-Checksum-Mode") == "ENABLED" && r.Header.Get("Range") == "" {
+	if r != nil && strings.EqualFold(lookupHeaderOrQuery(r, parseRequestQuery(r), s3_constants.AmzChecksumMode), "ENABLED") && r.Header.Get("Range") == "" && requestedPartNumber(r) == 0 {
 		if entry.Extended != nil {
 			if algoName, ok := entry.Extended[s3_constants.ExtChecksumAlgorithm]; ok {
 				if checksumVal, ok := entry.Extended[s3_constants.ExtChecksumValue]; ok {
@@ -2101,8 +2455,10 @@ func (s3a *S3ApiServer) setResponseHeaders(w http.ResponseWriter, r *http.Reques
 	// Apply S3 passthrough headers from query parameters
 	// AWS S3 supports overriding response headers via query parameters like:
 	// ?response-cache-control=no-cache&response-content-type=application/json
-	// This allows presigned URLs to control how browsers handle the downloaded content
-	if r != nil {
+	// This allows presigned URLs to control how browsers handle the downloaded content.
+	// AWS requires the request to be signed; anonymous requests must not influence
+	// how the stored object is served.
+	if r != nil && getRequestAuthType(r) != authTypeAnonymous {
 		for queryParam, headerValue := range r.URL.Query() {
 			if normalizedHeader, ok := s3_constants.PassThroughHeaders[strings.ToLower(queryParam)]; ok && len(headerValue) > 0 && headerValue[0] != "" {
 				w.Header().Set(normalizedHeader, headerValue[0])
@@ -2144,7 +2500,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 
 	bucket, object := s3_constants.GetBucketAndObject(r)
 	glog.V(3).Infof("HeadObjectHandler %s %s", bucket, object)
-	if err := s3a.validateTableBucketObjectPath(bucket, object); err != nil {
+	if _, err := s3a.validateTableBucketObjectPathOrVerify(bucket, object); err != nil {
 		s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
 		return
 	}
@@ -2155,6 +2511,14 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 		return // SOSAPI request was handled
 	}
 
+	// Reject named versions before directory or conditional handling can
+	// answer the request as a plain object.
+	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Handle directory objects with shared logic
 	if s3a.handleDirectoryObjectRequest(w, r, bucket, object, "HeadObjectHandler") {
 		return // Directory object request was handled
@@ -2166,11 +2530,9 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 		return
 	}
 
-	// Check for specific version ID in query parameters
-	versionId := r.URL.Query().Get("versionId")
-
 	var (
 		entry                *filer_pb.Entry // Declare entry at function scope for SSE processing
+		targetVersionId      string
 		versioningConfigured bool
 		err                  error
 	)
@@ -2181,7 +2543,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 	versioningConfigured, err = s3a.isVersioningConfigured(bucket)
 	if err != nil {
 		if err == filer_pb.ErrNotFound {
-			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+			s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchBucket)
 			return
 		}
 		glog.Errorf("Error checking versioning status for bucket %s: %v", bucket, err)
@@ -2191,7 +2553,6 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 
 	if versioningConfigured {
 		// Handle versioned HEAD - all versions are stored in .versions directory
-		var targetVersionId string
 
 		if versionId != "" {
 			// Request for specific version
@@ -2200,7 +2561,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 			if err != nil {
 				glog.Errorf("Failed to get specific version %s for %s/%s: %v", versionId, bucket, object, err)
 				if errors.Is(err, filer_pb.ErrNotFound) {
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchVersion)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchVersion)
 				} else {
 					s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 				}
@@ -2226,20 +2587,21 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 				entry, err = s3a.getLatestObjectVersion(bucket, object)
 				if err != nil {
 					glog.Errorf("HeadObject: Failed to get latest version for %s/%s: %v", bucket, object, err)
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 					return
 				}
 			} else if errors.Is(versionsErr, filer_pb.ErrNotFound) {
 				// .versions/ doesn't exist (confirmed not found), check regular path for null version
 				regularEntry, regularErr := s3a.getEntry(bucketDir, normalizedObject)
-				if regularErr == nil && regularEntry != nil && !isBareDirectory(regularEntry) {
+				// A physical parent or bare-key object is not a trailing-slash null marker.
+				if regularErr == nil && isNullVersionObject(regularEntry, normalizedObject) {
 					// Found object at regular path - this is the null version
 					entry = regularEntry
 					targetVersionId = "null"
 				} else {
 					// No object at regular path either - object doesn't exist
 					glog.V(3).Infof("HeadObject: object not found at regular path or .versions for %s/%s", bucket, object)
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 					return
 				}
 			} else {
@@ -2248,7 +2610,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 				entry, err = s3a.getLatestObjectVersion(bucket, object)
 				if err != nil {
 					glog.Errorf("HeadObject: Failed to get latest version for %s/%s: %v", bucket, object, err)
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 					return
 				}
 			}
@@ -2269,7 +2631,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 		// Check if this is a delete marker
 		if entry.Extended != nil {
 			if deleteMarker, exists := entry.Extended[s3_constants.ExtDeleteMarkerKey]; exists && string(deleteMarker) == "true" {
-				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 				return
 			}
 		}
@@ -2281,11 +2643,6 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 			glog.V(2).Infof("HeadObject: version %s for %s/%s", targetVersionId, bucket, object)
 		}
 
-		// Set version ID in response header
-		w.Header().Set("x-amz-version-id", targetVersionId)
-
-		// Add object lock metadata to response headers if present
-		s3a.addObjectLockHeadersToResponse(w, entry)
 	}
 
 	// Fetch the correct entry for SSE processing (respects versionId)
@@ -2312,7 +2669,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 				return
 			}
 			if objectEntryForSSE == nil {
-				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 				return
 			}
 		}
@@ -2331,6 +2688,12 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 		return
 	}
 
+	// Return version and lock metadata only after authorizing this entry.
+	if versioningConfigured {
+		w.Header().Set("x-amz-version-id", targetVersionId)
+		s3a.addObjectLockHeadersToResponse(w, objectEntryForSSE)
+	}
+
 	// Implicit Directory Handling for s3fs Compatibility
 	// ====================================================
 	//
@@ -2372,7 +2735,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 			isZeroByteFile := objectEntryForSSE.Attributes.FileSize == 0 && !objectEntryForSSE.IsDirectory
 			// A directory with data (a promoted file) is retrievable; empty directories 404 for LIST fallback.
 			if isBareDirectory(objectEntryForSSE) {
-				s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+				s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 				return
 			}
 			if isZeroByteFile {
@@ -2380,7 +2743,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 				if s3a.hasChildren(r.Context(), bucket, object) {
 					// This is an implicit directory with children
 					// Return 404 to force clients (like s3fs) to use LIST-based discovery
-					s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
+					s3a.writeAnonymousAwareNotFound(w, r, bucket, s3err.ErrNoSuchKey)
 					return
 				}
 			}
@@ -2389,36 +2752,35 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 
 	// For HEAD requests, we already have all metadata - just set headers directly
 	totalSize := int64(filer.FileSize(objectEntryForSSE))
-	s3a.setResponseHeaders(w, r, objectEntryForSSE, totalSize)
+	responseSize := totalSize
+	statusCode := http.StatusOK
 
-	// Check if PartNumber query parameter is present (for multipart objects)
-	// This logic matches the filer handler for consistency
-	partNumberStr := r.URL.Query().Get("partNumber")
-	if partNumberStr == "" {
-		partNumberStr = r.URL.Query().Get("PartNumber")
-	}
-
-	// If PartNumber is specified, set headers (matching filer logic)
-	if partNumberStr != "" {
-		if partNumber, parseErr := strconv.Atoi(partNumberStr); parseErr == nil && partNumber > 0 {
-			// Get actual parts count from metadata (not chunk count)
-			partsCount, _ := s3a.getMultipartInfo(objectEntryForSSE, partNumber)
-
-			// Validate part number
-			if partNumber > partsCount {
-				glog.Warningf("HeadObject: Invalid part number %d, object has %d parts", partNumber, partsCount)
-				s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPart)
-				return
-			}
-
-			// Set parts count header
-			// Note: ETag is NOT overridden - AWS S3 returns the complete object's ETag
-			// even when requesting a specific part via PartNumber
-			w.Header().Set(s3_constants.AmzMpPartsCount, strconv.Itoa(partsCount))
-			glog.V(3).Infof("HeadObject: Set PartsCount=%d for part %d", partsCount, partNumber)
+	// A partNumber HEAD is a ranged HEAD of that part: report the part's size and range
+	if partNumber := requestedPartNumber(r); partNumber > 0 {
+		startOffset, endOffset, errCode := s3a.partByteRange(w, r, objectEntryForSSE, partNumber)
+		if errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
+		responseSize = endOffset - startOffset + 1
+		w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", startOffset, endOffset, totalSize))
+		statusCode = http.StatusPartialContent
+		glog.V(3).Infof("HeadObject: part %d is bytes %d-%d/%d", partNumber, startOffset, endOffset, totalSize)
+	} else if r.Header.Get("Range") != "" {
+		// A ranged HEAD reports the range like GET does: 206 with its Content-Range and length
+		offset, size, isRangeRequest, rangeErr := s3a.parseAndValidateRange(w, r, objectEntryForSSE, totalSize, bucket, object)
+		if rangeErr != nil {
+			return
+		}
+		if isRangeRequest {
+			responseSize = size
+			w.Header().Set("Content-Range", fmt.Sprintf("bytes %d-%d/%d", offset, offset+size-1, totalSize))
+			statusCode = http.StatusPartialContent
 		}
 	}
 
+	s3a.setResponseHeaders(w, r, objectEntryForSSE, responseSize)
+
 	// Detect and handle SSE
 	glog.V(3).Infof("HeadObjectHandler: Retrieved entry for %s/%s - %d chunks", bucket, object, len(objectEntryForSSE.Chunks))
 	sseType := s3a.detectPrimarySSEType(objectEntryForSSE)
@@ -2449,7 +2811,7 @@ func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request
 		s3a.addSSEResponseHeadersFromEntry(w, r, objectEntryForSSE, sseType)
 	}
 
-	w.WriteHeader(http.StatusOK)
+	w.WriteHeader(statusCode)
 }
 
 // fetchObjectEntry fetches the filer entry for an object
@@ -2518,48 +2880,24 @@ func (s3a *S3ApiServer) addObjectLockHeadersToResponse(w http.ResponseWriter, en
 
 // detectPrimarySSEType determines the primary SSE type by examining chunk metadata
 func (s3a *S3ApiServer) detectPrimarySSEType(entry *filer_pb.Entry) string {
-	// Safety check: handle nil entry
 	if entry == nil {
 		return "None"
 	}
 
-	if len(entry.GetChunks()) == 0 {
-		// No chunks - check object-level metadata only (single objects or smallContent)
-		hasSSEC := entry.Extended[s3_constants.AmzServerSideEncryptionCustomerAlgorithm] != nil
-		hasSSEKMS := entry.Extended[s3_constants.AmzServerSideEncryption] != nil
-
-		// Check for SSE-S3: algorithm is AES256 but no customer key
-		if hasSSEKMS && !hasSSEC {
-			// Distinguish SSE-S3 from SSE-KMS: check the algorithm value and the presence of a KMS key ID
-			sseAlgo := string(entry.Extended[s3_constants.AmzServerSideEncryption])
-			switch sseAlgo {
-			case s3_constants.SSEAlgorithmAES256:
-				// Could be SSE-S3 or SSE-KMS, check for KMS key ID
-				if _, hasKMSKey := entry.Extended[s3_constants.AmzServerSideEncryptionAwsKmsKeyId]; hasKMSKey {
-					return s3_constants.SSETypeKMS
-				}
-				// No KMS key, this is SSE-S3
-				return s3_constants.SSETypeS3
-			case s3_constants.SSEAlgorithmKMS:
-				return s3_constants.SSETypeKMS
-			default:
-				// Unknown or unsupported algorithm
-				return "None"
-			}
-		} else if hasSSEC && !hasSSEKMS {
-			return s3_constants.SSETypeC
-		} else if hasSSEC && hasSSEKMS {
-			// Both present - this should only happen during cross-encryption copies
-			// Use content to determine actual encryption state
-			if len(entry.Content) > 0 {
-				// smallContent - check if it's encrypted (heuristic: random-looking data)
-				return s3_constants.SSETypeC // Default to SSE-C for mixed case
-			} else {
-				// No content, both headers - default to SSE-C
-				return s3_constants.SSETypeC
+	metadataType := "None"
+	hasSSEC := entry.Extended[s3_constants.AmzServerSideEncryptionCustomerAlgorithm] != nil
+	if hasSSEC {
+		metadataType = s3_constants.SSETypeC
+	} else {
+		switch string(entry.Extended[s3_constants.AmzServerSideEncryption]) {
+		case s3_constants.SSEAlgorithmAES256:
+			metadataType = s3_constants.SSETypeS3
+			if _, hasKMSKey := entry.Extended[s3_constants.AmzServerSideEncryptionAwsKmsKeyId]; hasKMSKey {
+				metadataType = s3_constants.SSETypeKMS
 			}
+		case s3_constants.SSEAlgorithmKMS:
+			metadataType = s3_constants.SSETypeKMS
 		}
-		return "None"
 	}
 
 	// Count chunk types to determine primary (multipart objects)
@@ -2600,7 +2938,7 @@ func (s3a *S3ApiServer) detectPrimarySSEType(entry *filer_pb.Entry) string {
 		return s3_constants.SSETypeS3
 	}
 
-	return "None"
+	return metadataType
 }
 
 // createMultipartSSECDecryptedReaderDirect creates a reader that decrypts each chunk independently for multipart SSE-C objects (direct volume path)
@@ -2949,36 +3287,7 @@ func (l *lazyMultipartChunkReader) Close() error {
 // createEncryptedChunkReader creates a reader for a single encrypted chunk
 // Context propagation ensures cancellation if the S3 client disconnects
 func (s3a *S3ApiServer) createEncryptedChunkReader(ctx context.Context, chunk *filer_pb.FileChunk) (io.ReadCloser, error) {
-	// Get chunk URL
-	srcUrl, err := s3a.lookupVolumeUrl(chunk.GetFileIdString())
-	if err != nil {
-		return nil, fmt.Errorf("lookup volume URL for chunk %s: %v", chunk.GetFileIdString(), err)
-	}
-
-	// Create HTTP request with context for cancellation propagation
-	req, err := http.NewRequestWithContext(ctx, "GET", srcUrl, nil)
-	if err != nil {
-		return nil, fmt.Errorf("create HTTP request for chunk: %v", err)
-	}
-
-	// Attach volume server JWT for authentication (uses config loaded once at startup)
-	jwt := filer.JwtForVolumeServer(chunk.GetFileIdString())
-	if jwt != "" {
-		req.Header.Set("Authorization", security.BearerPrefix+jwt)
-	}
-
-	// Use shared HTTP client with connection pooling
-	resp, err := volumeServerHTTPClient.Do(req)
-	if err != nil {
-		return nil, fmt.Errorf("execute HTTP request for chunk: %v", err)
-	}
-
-	if resp.StatusCode != http.StatusOK {
-		resp.Body.Close()
-		return nil, fmt.Errorf("HTTP request for chunk failed: %d", resp.StatusCode)
-	}
-
-	return resp.Body, nil
+	return s3a.fetchChunkData(ctx, chunk.GetFileIdString(), chunk.CipherKey, chunk.IsCompressed, 0, int64(chunk.Size), true)
 }
 
 // MultipartSSEReader wraps multiple readers and ensures all underlying readers are properly closed
@@ -3047,16 +3356,17 @@ type rc struct {
 }
 
 // getMultipartInfo retrieves multipart metadata for a given part number
-// Returns: (partsCount, partInfo)
+// Returns: (partsCount, partInfo, hasBoundaries)
 // - partsCount: total number of parts in the multipart object
 // - partInfo: boundary information for the requested part (nil if not found or not a multipart object)
-func (s3a *S3ApiServer) getMultipartInfo(entry *filer_pb.Entry, partNumber int) (int, *PartBoundaryInfo) {
+// - hasBoundaries: the entry carries part boundaries, so a nil partInfo means the object has no such part
+func (s3a *S3ApiServer) getMultipartInfo(entry *filer_pb.Entry, partNumber int) (int, *PartBoundaryInfo, bool) {
 	if entry == nil {
-		return 0, nil
+		return 0, nil, false
 	}
 	if entry.Extended == nil {
 		// Not a multipart object or no metadata
-		return len(entry.GetChunks()), nil
+		return len(entry.GetChunks()), nil, false
 	}
 
 	// Try to get parts count from metadata
@@ -3068,20 +3378,82 @@ func (s3a *S3ApiServer) getMultipartInfo(entry *filer_pb.Entry, partNumber int)
 	}
 
 	// Try to get part boundaries from metadata
-	if boundariesJSON, exists := entry.Extended[s3_constants.SeaweedFSMultipartPartBoundaries]; exists {
-		var boundaries []PartBoundaryInfo
-		if err := json.Unmarshal(boundariesJSON, &boundaries); err == nil {
-			// Find the requested part
-			for i := range boundaries {
-				if boundaries[i].PartNumber == partNumber {
-					return partsCount, &boundaries[i]
-				}
-			}
+	boundariesJSON, exists := entry.Extended[s3_constants.SeaweedFSMultipartPartBoundaries]
+	if !exists {
+		return partsCount, nil, false
+	}
+	var boundaries []PartBoundaryInfo
+	if err := json.Unmarshal(boundariesJSON, &boundaries); err != nil {
+		glog.Warningf("getMultipartInfo: failed to unmarshal part boundaries: %v", err)
+		return partsCount, nil, false
+	}
+	for i := range boundaries {
+		if boundaries[i].PartNumber == partNumber {
+			return partsCount, &boundaries[i], true
 		}
 	}
 
-	// No part boundaries metadata or part not found
-	return partsCount, nil
+	// The object records its parts and this is not one of them
+	return partsCount, nil, true
+}
+
+// requestedPartNumber returns the partNumber query parameter, or 0 when it is
+// absent or not a positive integer.
+func requestedPartNumber(r *http.Request) int {
+	partNumberStr := r.URL.Query().Get("partNumber")
+	if partNumberStr == "" {
+		partNumberStr = r.URL.Query().Get("PartNumber")
+	}
+	partNumber, parseErr := strconv.Atoi(partNumberStr)
+	if parseErr != nil || partNumber <= 0 {
+		return 0
+	}
+	return partNumber
+}
+
+// partByteRange resolves the inclusive byte range a partNumber request reads,
+// narrowed by a client Range within the part, and sets the parts count header.
+// The object ETag is kept as is, matching AWS.
+func (s3a *S3ApiServer) partByteRange(w http.ResponseWriter, r *http.Request, entry *filer_pb.Entry, partNumber int) (startOffset, endOffset int64, errCode s3err.ErrorCode) {
+	// Part numbers need not be consecutive, so an object that records its part
+	// boundaries is asked for the part itself rather than for a count.
+	partsCount, partInfo, hasBoundaries := s3a.getMultipartInfo(entry, partNumber)
+	if partInfo == nil && (hasBoundaries || partNumber > partsCount) {
+		glog.Warningf("partByteRange: object has no part %d, it has %d parts", partNumber, partsCount)
+		return 0, 0, s3err.ErrInvalidPartNumber
+	}
+
+	w.Header().Set(s3_constants.AmzMpPartsCount, strconv.Itoa(partsCount))
+
+	if partInfo != nil {
+		var ok bool
+		startOffset, endOffset, ok = partRange(partInfo, entry.Chunks)
+		if !ok {
+			glog.Errorf("partByteRange: part %d boundary chunks [%d,%d) out of range (chunks: %d)", partNumber, partInfo.StartChunk, partInfo.EndChunk, len(entry.Chunks))
+			return 0, 0, s3err.ErrInternalError
+		}
+	} else {
+		// Fallback: assume 1:1 part-to-chunk mapping (backward compatibility)
+		chunkIndex := partNumber - 1
+		if chunkIndex >= len(entry.Chunks) {
+			glog.Warningf("partByteRange: part %d chunk index %d out of range (chunks: %d)", partNumber, chunkIndex, len(entry.Chunks))
+			return 0, 0, s3err.ErrInvalidPartNumber
+		}
+		partChunk := entry.Chunks[chunkIndex]
+		startOffset, endOffset = partChunk.Offset, partChunk.Offset+int64(partChunk.Size)-1
+	}
+
+	// S3 allows both partNumber and Range together, where Range applies within the selected part
+	if clientRangeHeader := r.Header.Get("Range"); clientRangeHeader != "" {
+		adjustedStart, adjustedEnd, rangeErr := adjustRangeForPart(startOffset, endOffset, clientRangeHeader)
+		if rangeErr != nil {
+			glog.Warningf("partByteRange: invalid Range for part %d: %v", partNumber, rangeErr)
+			return 0, 0, s3err.ErrInvalidRange
+		}
+		startOffset, endOffset = adjustedStart, adjustedEnd
+	}
+
+	return startOffset, endOffset, s3err.ErrNone
 }
 
 // buildRemoteObjectPath builds the filer directory and object name from S3 bucket/object.
@@ -3096,6 +3468,72 @@ func (s3a *S3ApiServer) buildRemoteObjectPath(bucket, object string) (dir, name
 	return dir, name
 }
 
+// findMountedRemoteMapping resolves the remote mount covering dir from the
+// mount mapping kept in the filer.
+func (s3a *S3ApiServer) findMountedRemoteMapping(ctx context.Context, dir string) (localMountedDir string, mountedLocation *remote_pb.RemoteStorageLocation, err error) {
+	err = s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		mappingContent, readErr := filer.ReadInsideFiler(ctx, client, filer.DirectoryEtcRemote, filer.REMOTE_STORAGE_MOUNT_FILE)
+		if readErr != nil {
+			return readErr
+		}
+		mappings, unmarshalErr := filer.UnmarshalRemoteStorageMappings(mappingContent)
+		if unmarshalErr != nil {
+			return unmarshalErr
+		}
+		var findErr error
+		localMountedDir, mountedLocation, findErr = filer.FindMountedRemoteMapping(mappings, dir)
+		return findErr
+	})
+	return localMountedDir, mountedLocation, err
+}
+
+// openRemoteStream opens a ranged read of a remote-only object straight from
+// its mounted origin, resolving the mount and storage conf from the filer.
+// cached, when set, is the remote generation the local copy was made from: the
+// stream is refused unless the remote still matches it.
+func (s3a *S3ApiServer) openRemoteStream(ctx context.Context, bucket, object string, offset, size int64, cached *filer_pb.RemoteEntry) (io.ReadCloser, error) {
+	dir, name := s3a.buildRemoteObjectPath(bucket, object)
+
+	localMountedDir, mountedLocation, err := s3a.findMountedRemoteMapping(ctx, dir)
+	if err != nil {
+		return nil, err
+	}
+
+	var storageConf *remote_pb.RemoteConf
+	err = s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		confContent, readErr := filer.ReadInsideFiler(ctx, client, filer.DirectoryEtcRemote, mountedLocation.Name+filer.REMOTE_STORAGE_CONF_SUFFIX)
+		if readErr != nil {
+			return readErr
+		}
+		storageConf = &remote_pb.RemoteConf{}
+		return proto.Unmarshal(confContent, storageConf)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := weed_server.BuildGuardedRemoteStorageClient(ctx, storageConf, s3a.option.AllowUntrustedRemoteEndpoints)
+	if err != nil {
+		return nil, err
+	}
+	streamer, ok := client.(remote_storage.RemoteStorageStreamReader)
+	if !ok {
+		return nil, fmt.Errorf("remote storage type %s does not support streaming reads", storageConf.Type)
+	}
+
+	loc := filer.MapFullPathToRemoteStorageLocation(util.FullPath(localMountedDir), mountedLocation, util.FullPath(dir).Child(name))
+	if cached != nil {
+		current, statErr := client.StatFile(loc)
+		if statErr != nil {
+			return nil, statErr
+		}
+		if current.GetRemoteSize() != cached.GetRemoteSize() || current.GetRemoteETag() != cached.GetRemoteETag() || current.GetRemoteMtime() != cached.GetRemoteMtime() {
+			return nil, fmt.Errorf("remote %s/%s changed since it was cached", bucket, object)
+		}
+	}
+	return streamer.ReadFileAsStream(ctx, loc, offset, size)
+}
+
 // doCacheRemoteObject calls the filer's CacheRemoteObjectToLocalCluster gRPC endpoint.
 // This is the core caching function used by cacheRemoteObjectForStreaming.
 func (s3a *S3ApiServer) doCacheRemoteObject(ctx context.Context, dir, name string) (*filer_pb.Entry, error) {
@@ -3117,7 +3555,9 @@ func (s3a *S3ApiServer) doCacheRemoteObject(ctx context.Context, dir, name strin
 }
 
 func (s3a *S3ApiServer) buildVersionedRemoteObjectPath(bucket, object, versionId string) (dir, name string) {
-	if versionId != "" && versionId != "null" {
+	// versionId names a .versions file, so a value that is not a valid path
+	// segment falls back to the unversioned remote path rather than escaping it.
+	if versionId != "" && versionId != "null" && isValidVersionID(versionId) {
 		normalizedObject := s3_constants.NormalizeObjectKey(object)
 		return s3a.bucketDir(bucket) + "/" + normalizedObject + s3_constants.VersionsFolder, s3a.getVersionFileName(versionId)
 	}
@@ -3139,30 +3579,41 @@ func cachedEntryHasLocalData(entry *filer_pb.Entry) bool {
 // Atomic so tests can shorten it without racing the read path.
 var remoteCacheStreamingTimeoutNS = int64(20 * time.Second)
 
+// remoteCacheWait resolves how long a read of dir may wait for the local cache.
+// Zero means the mount opted out of caching, so the read is served from the
+// origin instead -- except for a version-specific read, which has no origin key
+// to fall back to and therefore keeps the size tiers.
+func (s3a *S3ApiServer) remoteCacheWait(ctx context.Context, dir string, remoteSize int64, versionId string) time.Duration {
+	_, mountedLocation, mountErr := s3a.findMountedRemoteMapping(ctx, dir)
+	if mountErr != nil {
+		glog.V(2).Infof("remoteCacheWait: find mount for %s: %v", dir, mountErr)
+	}
+	wait := remote_storage.CacheWaitTimeout(remoteSize, mountedLocation)
+	if wait <= 0 && versionId != "" && versionId != "null" {
+		return remote_storage.CacheWaitTimeout(remoteSize, nil)
+	}
+	return wait
+}
+
 // cacheRemoteObjectForStreamingWithShortTimeout polls for cache completion with an adaptive timeout.
-// Timeout is based on file size: small files wait longer to maximize cache hits, large files
-// fail-fast to improve TTFB. Returns the cached entry and error to allow callers to distinguish
-// between transient errors (timeout) and permanent errors (not found, permission denied).
-// The filer continues caching on detached context, so retry finds cached chunks.
+// Timeout comes from the file size or the mount's cache_wait_ms: small files wait longer to
+// maximize cache hits, large files fail-fast to improve TTFB. Returns the cached entry and error
+// to allow callers to distinguish between transient errors (timeout) and permanent errors (not
+// found, permission denied). The filer continues caching on detached context, so retry finds
+// cached chunks.
 func (s3a *S3ApiServer) cacheRemoteObjectForStreamingWithShortTimeout(r *http.Request, entry *filer_pb.Entry, bucket, object, versionId string) (*filer_pb.Entry, error) {
-	// Adaptive timeout: smaller files can afford to wait longer since cache completes faster
-	pollTimeout := 5 * time.Second
-	if entry.RemoteEntry != nil && entry.RemoteEntry.RemoteSize > 0 {
-		// For very large files (>500MB), use shorter timeout to improve TTFB
-		// For smaller files, allow longer to increase cache hit rate
-		remoteSize := entry.RemoteEntry.RemoteSize
-		if remoteSize > 500*1024*1024 {
-			pollTimeout = 2 * time.Second
-		} else if remoteSize < 50*1024*1024 {
-			pollTimeout = 10 * time.Second
-		}
+	dir, name := s3a.buildVersionedRemoteObjectPath(bucket, object, versionId)
+
+	pollTimeout := s3a.remoteCacheWait(r.Context(), dir, entry.GetRemoteEntry().GetRemoteSize(), versionId)
+	if pollTimeout <= 0 {
+		// The mount opted out of caching: report it uncached so the caller serves the origin.
+		glog.V(2).Infof("cacheRemoteObjectForStreamingWithShortTimeout: caching disabled for %s/%s", dir, name)
+		return nil, nil
 	}
 
 	cacheCtx, cancel := context.WithTimeout(r.Context(), pollTimeout)
 	defer cancel()
 
-	dir, name := s3a.buildVersionedRemoteObjectPath(bucket, object, versionId)
-
 	glog.V(2).Infof("cacheRemoteObjectForStreamingWithShortTimeout: polling cache status for %s/%s (timeout=%v)", dir, name, pollTimeout)
 
 	cachedEntry, err := s3a.doCacheRemoteObject(cacheCtx, dir, name)
@@ -3178,10 +3629,10 @@ func (s3a *S3ApiServer) cacheRemoteObjectForStreamingWithShortTimeout(r *http.Re
 
 	if cachedEntry != nil && len(cachedEntry.GetChunks()) > 0 {
 		glog.V(1).Infof("cacheRemoteObjectForStreamingWithShortTimeout: successfully cached %s/%s (%d chunks)", dir, name, len(cachedEntry.GetChunks()))
-		return cachedEntry, nil
 	}
 
-	return nil, nil
+	// Even an uncached response can carry newer ACLs or tags that must be checked.
+	return cachedEntry, nil
 }
 
 // cacheRemoteObjectForStreaming caches a remote-only object to the local cluster for streaming.
@@ -3268,6 +3719,10 @@ func (s3a *S3ApiServer) startBackgroundRemoteCache(bucket, object, versionId str
 		// Use timeout to bound goroutine and prevent pile-up if RPC stalls under load
 		bgCtx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 		defer cancel()
+		if s3a.remoteCacheWait(bgCtx, dir, entry.GetRemoteEntry().GetRemoteSize(), versionId) <= 0 {
+			glog.V(2).Infof("startBackgroundRemoteCache: caching disabled for %s/%s", dir, name)
+			return
+		}
 		_, err := s3a.doCacheRemoteObject(bgCtx, dir, name)
 		if err != nil {
 			glog.V(2).Infof("startBackgroundRemoteCache: cache failed for %s/%s: %v", bucket, object, err)
diff --git a/weed/s3api/s3api_object_handlers_acl.go b/weed/s3api/s3api_object_handlers_acl.go
index d6dc3da6f1..e832db33dc 100644
--- a/weed/s3api/s3api_object_handlers_acl.go
+++ b/weed/s3api/s3api_object_handlers_acl.go
@@ -3,7 +3,6 @@ package s3api
 import (
 	"context"
 	"errors"
-	"fmt"
 	"net/http"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -31,6 +30,10 @@ func (s3a *S3ApiServer) GetObjectAclHandler(w http.ResponseWriter, r *http.Reque
 
 	// Check for specific version ID in query parameters
 	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
 
 	// Check if versioning is configured for the bucket (Enabled or Suspended)
 	versioningConfigured, err := s3a.isVersioningConfigured(bucket)
@@ -90,6 +93,15 @@ func (s3a *S3ApiServer) GetObjectAclHandler(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
+	action := s3_constants.S3_ACTION_GET_OBJECT_ACL
+	if versionId != "" {
+		action = s3_constants.S3_ACTION_GET_OBJECT_VERSION_ACL
+	}
+	if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, action, entry.Extended, "GetObjectAclHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Get object owner from metadata, fallback to request account
 	var objectOwner string
 	var objectOwnerDisplayName string
@@ -138,6 +150,10 @@ func (s3a *S3ApiServer) PutObjectAclHandler(w http.ResponseWriter, r *http.Reque
 
 	// Check for specific version ID in query parameters
 	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
 
 	// Check if versioning is configured for the bucket (Enabled or Suspended)
 	versioningConfigured, err := s3a.isVersioningConfigured(bucket)
@@ -197,6 +213,15 @@ func (s3a *S3ApiServer) PutObjectAclHandler(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
+	putAction := s3_constants.S3_ACTION_PUT_OBJECT_ACL
+	if versionId != "" {
+		putAction = s3_constants.S3_ACTION_PUT_OBJECT_VERSION_ACL
+	}
+	if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, putAction, entry.Extended, "PutObjectAclHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Get current object owner from metadata
 	var objectOwner string
 	amzAccountId := r.Header.Get(s3_constants.AmzAccountId)
@@ -207,15 +232,27 @@ func (s3a *S3ApiServer) PutObjectAclHandler(w http.ResponseWriter, r *http.Reque
 		}
 	}
 
+	// **PERMISSION CHECKS**
+
+	isAdmin := s3a.isUserAdmin(r)
+
+	// Without stored owner metadata there is no way to prove a non-admin
+	// caller owns this object, so they must not modify its ACL or claim it.
+	// Admins keep the fallback below to take over ownerless objects, which
+	// can be produced by non-S3 filer writes.
+	if objectOwner == "" && !isAdmin {
+		glog.V(3).Infof("PutObjectAclHandler: Access denied - object %s/%s has no owner metadata", bucket, object)
+		s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+		return
+	}
+
 	// Fallback to current account if no owner stored
 	if objectOwner == "" {
 		objectOwner = amzAccountId
 	}
 
-	// **PERMISSION CHECKS**
-
 	// 1. Check if user is admin (admins can modify any ACL)
-	if !s3a.isUserAdmin(r) {
+	if !isAdmin {
 		// 2. Check object ownership - only object owner can modify ACL (unless admin)
 		if objectOwner != amzAccountId {
 			glog.V(3).Infof("PutObjectAclHandler: Access denied - user %s is not owner of object %s/%s (owner: %s)",
@@ -224,22 +261,16 @@ func (s3a *S3ApiServer) PutObjectAclHandler(w http.ResponseWriter, r *http.Reque
 			return
 		}
 
-		// 3. Check object-level WRITE_ACP permission
-		// Create the specific action for this object
-		writeAcpAction := Action(fmt.Sprintf("WriteAcp:%s/%s", bucket, object))
-		identity, errCode := s3a.iam.authRequest(r, writeAcpAction)
+		// 3. Check object-level WRITE_ACP permission. The unified auth path
+		// scopes the base action to the request's bucket/object for both
+		// legacy Actions and IAM/bucket policies; embedding the resource path
+		// in the action here would scope it twice.
+		_, errCode := s3a.iam.authRequest(r, Action(s3_constants.ACTION_WRITE_ACP))
 		if errCode != s3err.ErrNone {
 			glog.V(3).Infof("PutObjectAclHandler: Auth failed for WriteAcp action on %s/%s: %v", bucket, object, errCode)
 			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
 			return
 		}
-
-		// 4. Verify the authenticated identity can perform WriteAcp on this specific object
-		if identity == nil || !identity.CanDo(writeAcpAction, bucket, object) {
-			glog.V(3).Infof("PutObjectAclHandler: Identity %v cannot perform WriteAcp on %s/%s", identity, bucket, object)
-			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
-			return
-		}
 	} else {
 		glog.V(3).Infof("PutObjectAclHandler: Admin user %s granted ACL modification permission for %s/%s", amzAccountId, bucket, object)
 	}
diff --git a/weed/s3api/s3api_object_handlers_attributes.go b/weed/s3api/s3api_object_handlers_attributes.go
index 4f372e2567..9e8881ebc1 100644
--- a/weed/s3api/s3api_object_handlers_attributes.go
+++ b/weed/s3api/s3api_object_handlers_attributes.go
@@ -29,10 +29,8 @@ type GetObjectAttributesResponse struct {
 
 // ObjectAttributesChecksum holds checksum info for GetObjectAttributes.
 type ObjectAttributesChecksum struct {
-	ChecksumCRC32  string `xml:"ChecksumCRC32,omitempty"`
-	ChecksumCRC32C string `xml:"ChecksumCRC32C,omitempty"`
-	ChecksumSHA1   string `xml:"ChecksumSHA1,omitempty"`
-	ChecksumSHA256 string `xml:"ChecksumSHA256,omitempty"`
+	ChecksumResult
+	ChecksumType string `xml:"ChecksumType,omitempty"`
 }
 
 // ObjectAttributesParts holds parts info for GetObjectAttributes.
@@ -77,6 +75,24 @@ func validateObjectAttributes(attrs map[string]struct{}) bool {
 	return true
 }
 
+// objectAttributesChecksum returns the additional checksum that PutObject or
+// CompleteMultipartUpload stored with the object, or nil if it has none.
+func objectAttributesChecksum(entry *filer_pb.Entry) *ObjectAttributesChecksum {
+	if entry == nil || entry.Extended == nil {
+		return nil
+	}
+	value := string(entry.Extended[s3_constants.ExtChecksumValue])
+	if value == "" {
+		return nil
+	}
+	checksum := &ObjectAttributesChecksum{ChecksumType: string(entry.Extended[s3_constants.ExtChecksumType])}
+	checksum.SetChecksum(string(entry.Extended[s3_constants.ExtChecksumAlgorithm]), value)
+	if checksum.ChecksumResult == (ChecksumResult{}) {
+		return nil
+	}
+	return checksum
+}
+
 func (s3a *S3ApiServer) GetObjectAttributesHandler(w http.ResponseWriter, r *http.Request) {
 	bucket, object := s3_constants.GetBucketAndObject(r)
 	glog.V(3).Infof("GetObjectAttributesHandler %s %s", bucket, object)
@@ -113,6 +129,10 @@ func (s3a *S3ApiServer) GetObjectAttributesHandler(w http.ResponseWriter, r *htt
 
 	// Check for specific version ID
 	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
 
 	var (
 		entry *filer_pb.Entry
@@ -203,6 +223,24 @@ func (s3a *S3ApiServer) GetObjectAttributesHandler(w http.ResponseWriter, r *htt
 		}
 	}
 
+	action := s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES
+	if versionId != "" {
+		action = s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES
+	}
+	if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, action, entry.Extended, "GetObjectAttributesHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
+	// AWS also asks for the version read grant on a versioned attributes
+	// request: s3:GetObjectVersionAttributes alone is not sufficient.
+	if versionId != "" {
+		if errCode := s3a.checkVersionReadGrant(r, bucket, object, versionId, entry.Extended); errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
+	}
+
 	// Evaluate conditional headers against the resolved entry (after version resolution)
 	// This ensures conditions are checked against the correct version, not always the latest
 	if s3a.hasConditionalHeaders(r) {
@@ -245,10 +283,9 @@ func (s3a *S3ApiServer) GetObjectAttributesHandler(w http.ResponseWriter, r *htt
 		resp.StorageClass = storageClass
 	}
 
-	// Checksum: accepted in validation so clients don't get a 400, but SeaweedFS
-	// does not yet store S3 checksums (CRC32, CRC32C, SHA1, SHA256), so
-	// resp.Checksum is intentionally left nil. When checksum storage is added,
-	// populate resp.Checksum here.
+	if _, ok := requestedAttrs["Checksum"]; ok {
+		resp.Checksum = objectAttributesChecksum(entry)
+	}
 
 	if _, ok := requestedAttrs["ObjectSize"]; ok {
 		var size int64
diff --git a/weed/s3api/s3api_object_handlers_attributes_test.go b/weed/s3api/s3api_object_handlers_attributes_test.go
new file mode 100644
index 0000000000..6138c267e1
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_attributes_test.go
@@ -0,0 +1,88 @@
+package s3api
+
+import (
+	"encoding/xml"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestObjectAttributesChecksum verifies that GetObjectAttributes reports the
+// checksum that PutObject or CompleteMultipartUpload stored with the object
+func TestObjectAttributesChecksum(t *testing.T) {
+	testCases := []struct {
+		name     string
+		extended map[string][]byte
+		want     *ObjectAttributesChecksum
+	}{
+		{
+			name: "PutObject with SHA256",
+			extended: map[string][]byte{
+				s3_constants.ExtChecksumAlgorithm: []byte(s3_constants.AmzChecksumSHA256),
+				s3_constants.ExtChecksumValue:     []byte("arcu6553sHVAiX4MjW0j7I7vD4w6R+Gz9Ok0Q9lTa+0="),
+			},
+			want: &ObjectAttributesChecksum{
+				ChecksumResult: ChecksumResult{ChecksumSHA256: "arcu6553sHVAiX4MjW0j7I7vD4w6R+Gz9Ok0Q9lTa+0="},
+			},
+		},
+		{
+			name: "multipart upload with a composite CRC32C",
+			extended: map[string][]byte{
+				s3_constants.ExtChecksumAlgorithm: []byte(s3_constants.AmzChecksumCRC32C),
+				s3_constants.ExtChecksumValue:     []byte("x3Y2bw==-3"),
+				s3_constants.ExtChecksumType:      []byte("COMPOSITE"),
+			},
+			want: &ObjectAttributesChecksum{
+				ChecksumResult: ChecksumResult{ChecksumCRC32C: "x3Y2bw==-3"},
+				ChecksumType:   "COMPOSITE",
+			},
+		},
+		{
+			name: "multipart upload with a full object CRC64NVME",
+			extended: map[string][]byte{
+				s3_constants.ExtChecksumAlgorithm: []byte(s3_constants.AmzChecksumCRC64NVME),
+				s3_constants.ExtChecksumValue:     []byte("AAAAAAAAAAA="),
+				s3_constants.ExtChecksumType:      []byte("FULL_OBJECT"),
+			},
+			want: &ObjectAttributesChecksum{
+				ChecksumResult: ChecksumResult{ChecksumCRC64NVME: "AAAAAAAAAAA="},
+				ChecksumType:   "FULL_OBJECT",
+			},
+		},
+		{
+			name:     "no checksum",
+			extended: map[string][]byte{s3_constants.ExtETagKey: []byte("d41d8cd98f00b204e9800998ecf8427e")},
+		},
+		{
+			name: "unknown algorithm",
+			extended: map[string][]byte{
+				s3_constants.ExtChecksumAlgorithm: []byte("X-Amz-Checksum-Md5"),
+				s3_constants.ExtChecksumValue:     []byte("1B2M2Y8AsgTpgAmY7PhCfg=="),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, objectAttributesChecksum(&filer_pb.Entry{Extended: tc.extended}))
+		})
+	}
+	assert.Nil(t, objectAttributesChecksum(&filer_pb.Entry{}))
+}
+
+// TestGetObjectAttributesChecksumXML verifies the Checksum element's layout
+func TestGetObjectAttributesChecksumXML(t *testing.T) {
+	resp := GetObjectAttributesResponse{
+		Checksum: &ObjectAttributesChecksum{
+			ChecksumResult: ChecksumResult{ChecksumCRC32: "NhCmhg=="},
+			ChecksumType:   "FULL_OBJECT",
+		},
+	}
+	out, err := xml.Marshal(resp)
+	require.NoError(t, err)
+	assert.Equal(t, "<GetObjectAttributesResponse><Checksum><ChecksumCRC32>NhCmhg==</ChecksumCRC32>"+
+		"<ChecksumType>FULL_OBJECT</ChecksumType></Checksum></GetObjectAttributesResponse>", string(out))
+}
diff --git a/weed/s3api/s3api_object_handlers_conditional_read_test.go b/weed/s3api/s3api_object_handlers_conditional_read_test.go
new file mode 100644
index 0000000000..71e9acd94a
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_conditional_read_test.go
@@ -0,0 +1,267 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// A precondition can only fail against an object that exists. GET/HEAD of a missing
+// key must stay a missing-key answer even when If-Match or If-Unmodified-Since is sent.
+func TestValidateConditionalHeadersForReadsMissingObject(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	existing := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()},
+		Extended:   map[string][]byte{s3_constants.ExtETagKey: []byte("d41d8cd98f00b204e9800998ecf8427e")},
+	}
+	deleteMarker := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()},
+		Extended:   map[string][]byte{s3_constants.ExtDeleteMarkerKey: []byte("true")},
+	}
+	future := time.Now().Add(24 * time.Hour).UTC().Format(http.TimeFormat)
+
+	testCases := []struct {
+		name   string
+		header string
+		value  string
+		entry  *filer_pb.Entry
+		want   s3err.ErrorCode
+	}{
+		{"if-match on missing object", s3_constants.IfMatch, "0000", nil, s3err.ErrNoSuchKey},
+		{"if-match star on missing object", s3_constants.IfMatch, "*", nil, s3err.ErrNoSuchKey},
+		{"if-unmodified-since on missing object", s3_constants.IfUnmodifiedSince, future, nil, s3err.ErrNoSuchKey},
+		{"if-match on delete marker", s3_constants.IfMatch, "0000", deleteMarker, s3err.ErrNoSuchKey},
+		{"if-none-match on missing object", s3_constants.IfNoneMatch, "*", nil, s3err.ErrNone},
+		{"if-modified-since on missing object", s3_constants.IfModifiedSince, future, nil, s3err.ErrNone},
+		{"if-match mismatch on existing object", s3_constants.IfMatch, "0000", existing, s3err.ErrPreconditionFailed},
+		{"if-match hit on existing object", s3_constants.IfMatch, "d41d8cd98f00b204e9800998ecf8427e", existing, s3err.ErrNone},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/bucket/object", nil)
+			r.Header.Set(tc.header, tc.value)
+			headers, errCode := parseConditionalHeaders(r)
+			if errCode != s3err.ErrNone {
+				t.Fatalf("parseConditionalHeaders: %v", errCode)
+			}
+			result := s3a.validateConditionalHeadersForReads(r, headers, tc.entry, "bucket", "object")
+			if result.ErrorCode != tc.want {
+				t.Errorf("got %v, want %v", result.ErrorCode, tc.want)
+			}
+		})
+	}
+}
+
+func TestRemoteObjectETagAcrossCacheFill(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := &filer_pb.Entry{
+		Name:        "object",
+		Attributes:  &filer_pb.FuseAttributes{FileSize: 2048, Mtime: 100},
+		RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 2048, RemoteMtime: 100, RemoteETag: "remote-multipart-2"},
+	}
+	head := httptest.NewRecorder()
+	s3a.setResponseHeaders(head, httptest.NewRequest(http.MethodHead, "/bucket/object", nil), entry, 2048)
+	headETag := head.Header().Get("ETag")
+	if headETag != `"remote-multipart-2"` {
+		t.Errorf("cold ETag = %q", headETag)
+	}
+	entry.Chunks = []*filer_pb.FileChunk{
+		{Offset: 0, Size: 1024, ETag: "1B2M2Y8AsgTpgAmY7PhCfg=="},
+		{Offset: 1024, Size: 1024, ETag: "1B2M2Y8AsgTpgAmY7PhCfg=="},
+	}
+	entry.RemoteEntry.LastLocalSyncTsNs = 200
+	if got := s3a.getObjectETag(entry); got != headETag {
+		t.Errorf("cached ETag = %q, cold ETag = %q", got, headETag)
+	}
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		r := httptest.NewRequest(method, "/bucket/object", nil)
+		r.Header.Set(s3_constants.IfMatch, headETag)
+		r.Header.Set("Range", "bytes=1024-2047")
+		headers, code := parseConditionalHeaders(r)
+		if code != s3err.ErrNone {
+			t.Fatal(code)
+		}
+		result := s3a.validateConditionalHeadersForReads(r, headers, entry, "bucket", "object")
+		if result.ErrorCode != s3err.ErrNone {
+			t.Errorf("%s after cache fill: %v", method, result.ErrorCode)
+		}
+	}
+	entry.RemoteEntry.RemoteETag = `"remote-multipart-2"`
+	if got := s3a.getObjectETag(entry); got != headETag {
+		t.Errorf("quoted remote ETag = %q", got)
+	}
+	entry.Extended = map[string][]byte{s3_constants.ExtETagKey: []byte("local-etag")}
+	if got := s3a.getObjectETag(entry); got != `"local-etag"` {
+		t.Errorf("explicit ETag = %q", got)
+	}
+	entry.Extended = nil
+	entry.RemoteEntry.LastLocalSyncTsNs = 0
+	if got, want := s3a.getObjectETag(entry), s3a.calculateETagFromChunks(entry.Chunks); got != want {
+		t.Errorf("unsynced local ETag = %q, want %q", got, want)
+	}
+}
+
+// A metadata-only update such as utimens changes Mtime without touching the
+// remote bytes, so the object must keep its remote ETag; otherwise a later
+// cache fill restores it and breaks clients holding the interim value.
+func TestRemoteObjectETagMetadataOnlyTouch(t *testing.T) {
+	s3a := &S3ApiServer{}
+	for _, cached := range []bool{false, true} {
+		entry := &filer_pb.Entry{
+			Name:       "object",
+			Attributes: &filer_pb.FuseAttributes{FileSize: 2048, Mtime: 100},
+			RemoteEntry: &filer_pb.RemoteEntry{
+				RemoteSize: 2048, RemoteMtime: 100, RemoteETag: "remote-multipart-2",
+			},
+		}
+		if cached {
+			entry.Chunks = []*filer_pb.FileChunk{{Size: 2048, ETag: "1B2M2Y8AsgTpgAmY7PhCfg=="}}
+			entry.RemoteEntry.LastLocalSyncTsNs = 200
+		}
+		entry.Attributes.Mtime = 101
+		entry.Attributes.MtimeNs = 500
+		if got := s3a.getObjectETag(entry); got != `"remote-multipart-2"` {
+			t.Errorf("cached=%v touched ETag = %q", cached, got)
+		}
+	}
+}
+
+// Extending or shrinking a cached remote file through setattr changes FileSize
+// while leaving its chunks and sync stamp alone; the remote ETag no longer
+// describes the local bytes and conditional reads must not answer 304 for it.
+func TestRemoteObjectETagLocalResize(t *testing.T) {
+	s3a := &S3ApiServer{}
+	for _, size := range []uint64{0, 1024, 4096} {
+		entry := &filer_pb.Entry{
+			Name:       "object",
+			Attributes: &filer_pb.FuseAttributes{FileSize: 2048, Mtime: 100},
+			Chunks:     []*filer_pb.FileChunk{{Size: 2048, ETag: "1B2M2Y8AsgTpgAmY7PhCfg=="}},
+			RemoteEntry: &filer_pb.RemoteEntry{
+				RemoteSize: 2048, RemoteMtime: 100, RemoteETag: "remote-multipart-2",
+				LastLocalSyncTsNs: 200,
+			},
+		}
+		entry.Attributes.FileSize = size
+		if got := s3a.getObjectETag(entry); got == `"remote-multipart-2"` {
+			t.Errorf("resized to %d retained remote ETag", size)
+		}
+		r := httptest.NewRequest(http.MethodHead, "/bucket/object", nil)
+		r.Header.Set(s3_constants.IfNoneMatch, `"remote-multipart-2"`)
+		headers, code := parseConditionalHeaders(r)
+		if code != s3err.ErrNone {
+			t.Fatal(code)
+		}
+		if got := s3a.validateConditionalHeadersForReads(r, headers, entry, "bucket", "object"); got.ErrorCode != s3err.ErrNone {
+			t.Errorf("resized to %d read: %v", size, got.ErrorCode)
+		}
+	}
+}
+
+func TestRemoteObjectETagCopyConditions(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := &filer_pb.Entry{
+		Attributes:  &filer_pb.FuseAttributes{FileSize: 2048, Mtime: 100},
+		RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 2048, RemoteMtime: 100, RemoteETag: "remote-multipart-2"},
+	}
+	for _, cached := range []bool{false, true} {
+		if cached {
+			entry.Chunks = []*filer_pb.FileChunk{{Size: 2048, ETag: "1B2M2Y8AsgTpgAmY7PhCfg=="}}
+			entry.RemoteEntry.LastLocalSyncTsNs = 200
+		}
+		for _, condition := range []string{s3_constants.AmzCopySourceIfMatch, s3_constants.AmzCopySourceIfNoneMatch} {
+			r := httptest.NewRequest(http.MethodPut, "/bucket/copy", nil)
+			r.Header.Set(condition, s3a.getObjectETag(entry))
+			want := s3err.ErrNone
+			if condition == s3_constants.AmzCopySourceIfNoneMatch {
+				want = s3err.ErrPreconditionFailed
+			}
+			if got := s3a.validateConditionalCopyHeaders(r, entry); got != want {
+				t.Errorf("cached=%v %s: got %v, want %v", cached, condition, got, want)
+			}
+		}
+	}
+}
+
+func TestRemoteObjectETagLocalChanges(t *testing.T) {
+	s3a := &S3ApiServer{}
+	for _, content := range [][]byte{nil, []byte("new local content")} {
+		entry := &filer_pb.Entry{
+			Attributes:  &filer_pb.FuseAttributes{FileSize: uint64(len(content)), Mtime: 101},
+			Content:     content,
+			RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 2048, RemoteMtime: 100, RemoteETag: "old-origin"},
+		}
+		if got, want := copyEntryETag(entry), strings.Trim(s3a.getObjectETag(entry), `"`); got != want {
+			t.Errorf("local copy ETag = %q, read ETag = %q", got, want)
+		}
+		if got := s3a.getObjectETag(entry); got == `"old-origin"` {
+			t.Errorf("local content %q retained remote ETag", content)
+		}
+		r := httptest.NewRequest(http.MethodHead, "/bucket/object", nil)
+		r.Header.Set(s3_constants.IfNoneMatch, `"old-origin"`)
+		headers, code := parseConditionalHeaders(r)
+		if code != s3err.ErrNone {
+			t.Fatal(code)
+		}
+		if got := s3a.validateConditionalHeadersForReads(r, headers, entry, "bucket", "object"); got.ErrorCode != s3err.ErrNone {
+			t.Errorf("local content %q read: %v", content, got.ErrorCode)
+		}
+		r.Header.Set(s3_constants.AmzCopySourceIfMatch, `"old-origin"`)
+		if got := s3a.validateConditionalCopyHeaders(r, entry); got != s3err.ErrPreconditionFailed {
+			t.Errorf("local content %q copy: %v", content, got)
+		}
+	}
+}
+
+func TestRemoteObjectETagFallback(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := &filer_pb.Entry{
+		Attributes:  &filer_pb.FuseAttributes{Md5: []byte{0xab, 0xcd}},
+		RemoteEntry: &filer_pb.RemoteEntry{},
+	}
+	if got := s3a.getObjectETag(entry); got != `"abcd"` {
+		t.Errorf("missing remote ETag = %q", got)
+	}
+	entry.RemoteEntry.RemoteETag = "empty-origin"
+	if got := s3a.getObjectETag(entry); got != `"empty-origin"` {
+		t.Errorf("empty remote object ETag = %q", got)
+	}
+	entry.RemoteEntry = nil
+	if got := s3a.getObjectETag(entry); got != `"abcd"` {
+		t.Errorf("local object ETag = %q", got)
+	}
+}
+
+func TestSetResponseHeadersIgnoresOverridesForAnonymous(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := &filer_pb.Entry{
+		Name:       "object",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 8, Mtime: 100},
+	}
+	for name, url := range map[string]string{
+		"anonymous": "/bucket/object?response-content-type=text%2Fhtml&response-content-disposition=inline",
+		"signed":    "/bucket/object?response-content-type=text%2Fhtml&response-content-disposition=inline",
+		"presigned": "/bucket/object?X-Amz-Credential=k&response-content-type=text%2Fhtml",
+	} {
+		r := httptest.NewRequest(http.MethodGet, url, nil)
+		if name == "signed" {
+			r.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential=k")
+		}
+		w := httptest.NewRecorder()
+		s3a.setResponseHeaders(w, r, entry, 8)
+		if name == "anonymous" {
+			if got := w.Header().Get("Content-Disposition"); got != "" {
+				t.Errorf("anonymous request must not override response headers, got Content-Disposition %q", got)
+			}
+		} else if got := w.Header().Get("Content-Type"); got != "text/html" {
+			t.Errorf("%s request should apply response overrides, got Content-Type %q", name, got)
+		}
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_conditional_write_test.go b/weed/s3api/s3api_object_handlers_conditional_write_test.go
new file mode 100644
index 0000000000..fb329c06cb
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_conditional_write_test.go
@@ -0,0 +1,58 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// A conditional write with If-Match has nothing to compare against when the key has
+// no current version; AWS answers 404 there, not 412.
+func TestValidateConditionalHeadersMissingObject(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	existing := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()},
+		Extended:   map[string][]byte{s3_constants.ExtETagKey: []byte("d41d8cd98f00b204e9800998ecf8427e")},
+	}
+	deleteMarker := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()},
+		Extended:   map[string][]byte{s3_constants.ExtDeleteMarkerKey: []byte("true")},
+	}
+
+	testCases := []struct {
+		name   string
+		header string
+		value  string
+		entry  *filer_pb.Entry
+		want   s3err.ErrorCode
+	}{
+		{"if-match on missing object", s3_constants.IfMatch, "d41d8cd98f00b204e9800998ecf8427e", nil, s3err.ErrNoSuchKey},
+		{"if-match star on missing object", s3_constants.IfMatch, "*", nil, s3err.ErrNoSuchKey},
+		{"if-match on delete marker", s3_constants.IfMatch, "d41d8cd98f00b204e9800998ecf8427e", deleteMarker, s3err.ErrNoSuchKey},
+		{"if-match mismatch on existing object", s3_constants.IfMatch, "0000", existing, s3err.ErrPreconditionFailed},
+		{"if-match hit on existing object", s3_constants.IfMatch, "d41d8cd98f00b204e9800998ecf8427e", existing, s3err.ErrNone},
+		{"if-none-match star on missing object", s3_constants.IfNoneMatch, "*", nil, s3err.ErrNone},
+		{"if-none-match star on delete marker", s3_constants.IfNoneMatch, "*", deleteMarker, s3err.ErrNone},
+		{"if-none-match star on existing object", s3_constants.IfNoneMatch, "*", existing, s3err.ErrPreconditionFailed},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodPut, "/bucket/object", nil)
+			r.Header.Set(tc.header, tc.value)
+			headers, errCode := parseConditionalHeaders(r)
+			if errCode != s3err.ErrNone {
+				t.Fatalf("parseConditionalHeaders: %v", errCode)
+			}
+			if got := s3a.validateConditionalHeaders(r, headers, tc.entry, "bucket", "object"); got != tc.want {
+				t.Errorf("got %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_copy.go b/weed/s3api/s3api_object_handlers_copy.go
index 846e4b7bc7..555dcaf696 100644
--- a/weed/s3api/s3api_object_handlers_copy.go
+++ b/weed/s3api/s3api_object_handlers_copy.go
@@ -2,15 +2,21 @@ package s3api
 
 import (
 	"bytes"
+	"cmp"
 	"context"
+	"crypto/md5"
 	"crypto/rand"
 	"encoding/base64"
+	"encoding/xml"
 	"errors"
 	"fmt"
+	"hash"
 	"io"
 	"net/http"
 	"net/url"
+	"os"
 	"reflect"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -64,11 +70,36 @@ func isValidDirective(value string) bool {
 	return value == "" || value == DirectiveCopy || value == DirectiveReplace
 }
 
+// copyChangesStorageClass reports whether a copy request asks for a storage
+// class other than the source object's. That makes copying an object onto
+// itself a change AWS accepts, even with the COPY directive.
+func (s3a *S3ApiServer) copyChangesStorageClass(h http.Header, src *filer_pb.Entry) bool {
+	sc := h.Get(s3_constants.AmzStorageClass)
+	return sc != "" && sc != s3a.getStorageClassFromExtended(src.Extended)
+}
+
 // hasPrefixFold reports whether s starts with prefix, ignoring case.
 func hasPrefixFold(s, prefix string) bool {
 	return len(s) >= len(prefix) && strings.EqualFold(s[:len(prefix)], prefix)
 }
 
+// prefixObjectSource presents the object stored on a key that other keys are nested
+// under as the plain object that key names. The entry itself stays a directory - it
+// is where those keys live - so a caller that copies or moves the object works off
+// this view and leaves the directory, and everything under it, alone.
+func prefixObjectSource(entry *filer_pb.Entry) *filer_pb.Entry {
+	if entry == nil || !entry.IsPrefixObject() {
+		return entry
+	}
+	flattened := proto.Clone(entry).(*filer_pb.Entry)
+	flattened.IsDirectory = false
+	if flattened.Attributes != nil {
+		flattened.Attributes.FileMode &^= uint32(os.ModeDir)
+	}
+	delete(flattened.Extended, s3_constants.SeaweedFSPrefixObject)
+	return flattened
+}
+
 // classifyCopySourceError maps a copy-source lookup to an S3 error: a missing
 // or directory source is NoSuchKey like AWS, but a transient store error
 // becomes a retryable 5xx so a resumable copy/commit survives a blip.
@@ -140,6 +171,30 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 		return
 	}
 
+	// Validate the client's encryption headers as sent: synthesizing bucket
+	// defaults first would launder a malformed request (a KMS option without
+	// aws:kms, or a repeated header) into an accepted one.
+	if errCode := ValidateRequestEncryption(r.Header); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
+	// A copy request without SSE headers takes the destination bucket's
+	// default encryption, including its configured KMS key and bucket-key
+	// setting. Surface them as headers so every downstream parse sees them.
+	if !IsSSECRequest(r) && r.Header.Get(s3_constants.AmzServerSideEncryption) == "" {
+		encryptionConfig, encErr := s3a.GetBucketEncryptionConfig(dstBucket)
+		switch {
+		case encErr == nil:
+			applyCopyBucketDefaultEncryptionHeaders(r, encryptionConfig)
+		case errors.Is(encErr, ErrNoEncryptionConfig):
+		default:
+			glog.Errorf("CopyObjectHandler: read encryption config for bucket %s: %v", dstBucket, encErr)
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			return
+		}
+	}
+
 	if !isValidDirective(r.Header.Get(s3_constants.AmzUserMetaDirective)) {
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidMetadataDirective)
 		return
@@ -149,6 +204,11 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 		return
 	}
 
+	if sc := r.Header.Get(s3_constants.AmzStorageClass); sc != "" && !validateStorageClass(sc) {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidStorageClass)
+		return
+	}
+
 	replaceMeta, replaceTagging := replaceDirective(r.Header)
 
 	// If source object is empty or bucket is empty, reply back invalid copy source.
@@ -159,9 +219,22 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 
 	// CopyObject requires s3:GetObject on the source in addition to s3:PutObject
 	// on the destination. The Auth middleware only checked the destination, so
-	// verify the source explicitly here.
+	// verify the source explicitly here. A first-phase deny decided without
+	// object tags can still flip on a tag-conditioned Allow, so when a bucket
+	// policy exists the tag-aware recheck gets the last word.
 	if errCode := s3a.authorizeCopySource(r, srcBucket, srcObject, srcVersionId); errCode != s3err.ErrNone {
-		s3err.WriteErrorResponse(w, r, errCode)
+		if s3a.recheckPolicyForKeyWithLookup(r, http.MethodGet, srcBucket, srcObject, srcVersionId, string(s3_constants.ACTION_READ), "CopyObjectHandler") != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
+	}
+
+	// A copy creates destination ownership and grants independently of the
+	// source ACL. Validate explicit grants before caching or writing any data.
+	var aclCode s3err.ErrorCode
+	r, aclCode = s3a.preparePutObjectACL(r, dstBucket)
+	if aclCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, aclCode)
 		return
 	}
 
@@ -180,11 +253,17 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 	}
 
 	entry, err := s3a.resolveCopySourceEntry(srcBucket, srcObject, srcVersionId, srcVersioningState)
+	entry = prefixObjectSource(entry)
 	if errCode := classifyCopySourceError(entry, err); errCode != s3err.ErrNone {
 		s3err.WriteErrorResponse(w, r, errCode)
 		return
 	}
 
+	if errCode := s3a.recheckCopySourcePolicy(r, srcBucket, srcObject, srcVersionId, entry.Extended, "CopyObjectHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Cache remote-only sources before copying; otherwise the copy path below
 	// writes a destination with FileSize > 0 but no chunks/content.
 	if entry.IsInRemoteOnly() {
@@ -200,9 +279,10 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 	}
 
 	sameDestination := srcBucket == dstBucket && srcObject == dstObject
+	changesStorageClass := s3a.copyChangesStorageClass(r.Header, entry)
 	// A self-copy into a versioned bucket writes a new version instead of overwriting in
 	// place, so it is not the no-op AWS rejects. It is how an earlier version is restored.
-	if sameDestination && !(replaceMeta || replaceTagging) && srcVersioningState != s3_constants.VersioningEnabled {
+	if sameDestination && !(replaceMeta || replaceTagging || changesStorageClass) && srcVersioningState != s3_constants.VersioningEnabled {
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidCopyDest)
 		return
 	}
@@ -234,47 +314,100 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 
 	replacesSource := copyReplacesSourceEntry(sameDestination, dstVersioningState, srcVersionId)
 
-	if replacesSource && (replaceMeta || replaceTagging) && s3a.canUseMetadataOnlySelfCopy(entry, r, dstBucket, dstObject) {
+	// A self-copy that only changes the storage class updates the object in
+	// place and has to keep its encryption as stored. The direct strategy
+	// compares only KMS key IDs, so SSE-KMS requests stay rejected too.
+	if replacesSource && changesStorageClass && !(replaceMeta || replaceTagging) &&
+		(IsSSEKMSRequest(r) || !s3a.canUseMetadataOnlySelfCopy(entry, r, dstBucket, dstObject)) {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidCopyDest)
+		return
+	}
+
+	if replacesSource && (replaceMeta || replaceTagging || changesStorageClass) && s3a.canUseMetadataOnlySelfCopy(entry, r, dstBucket, dstObject) {
 		var dstVersionId string
 		var etag string
-		// An in-place metadata replace routes to the owner as a serialized PATCH
-		// (off the distributed lock); the no-owner bootstrap keeps the lock.
-		//
-		// REPLACE can also change Content-Type, which lives on Attributes.Mime,
-		// not Extended. The routed PATCH only carries Extended keys, so when the
-		// Mime actually changes keep the lock and take the clone path below: it is
-		// still metadata-only (reuses the source chunks) but can set the Mime.
+		// Bind the entire self-copy update to the snapshot read on each attempt.
+		// ACLs and their file mode must commit together, even when another writer
+		// changes the mode between the gateway's read and the owner's commit.
 		owner := s3a.objectWriteOwner(dstBucket, dstObject)
-		sourceMime := entry.GetAttributes().GetMime()
-		mimeChanged := resolveDestinationMime(r.Header, sourceMime, replaceMeta) != sourceMime
-		routeInPlace := owner != "" && !mimeChanged
+		fileMode := s3a.resolveFileMode(r)
 		selfCopyBody := func() s3err.ErrorCode {
-			currentEntry, currentErr := s3a.resolveCopySourceEntry(srcBucket, srcObject, srcVersionId, srcVersioningState)
+			var rawEntry *filer_pb.Entry
+			var currentErr error
+			if owner != "" {
+				// Read the same owner that will check the snapshot, so a lagging
+				// replica does not make every retry conflict with a completed PUT.
+				rawEntry, currentErr = s3a.getObjectEntryRoutedByKey(srcBucket, srcObject)
+			} else {
+				rawEntry, currentErr = s3a.resolveCopySourceEntry(srcBucket, srcObject, srcVersionId, srcVersioningState)
+			}
+			currentEntry := prefixObjectSource(rawEntry)
 			if errCode := classifyCopySourceError(currentEntry, currentErr); errCode != s3err.ErrNone {
 				return errCode
 			}
 			if errCode := s3a.validateConditionalCopyHeaders(r, currentEntry); errCode != s3err.ErrNone {
 				return errCode
 			}
+			// Source and destination name the same unversioned entry. Evaluate
+			// destination conditions against the exact snapshot guarded at commit.
+			headers, errCode := parseConditionalHeaders(r)
+			if errCode != s3err.ErrNone {
+				return errCode
+			}
+			if errCode = s3a.validateConditionalHeaders(r, headers, currentEntry, dstBucket, dstObject); errCode != s3err.ErrNone {
+				return errCode
+			}
+			if err := ValidateCopyEncryption(currentEntry.Extended, r.Header); err != nil {
+				return MapCopyValidationError(err)
+			}
+			if !s3a.canUseMetadataOnlySelfCopy(currentEntry, r, dstBucket, dstObject) {
+				// A new encryption/storage state needs the ordinary copy path on a
+				// fresh request; never reuse chunks from an incompatible snapshot.
+				return s3err.ErrConditionalRequestConflict
+			}
 			updatedMetadata, metadataErr := processMetadataBytes(r.Header, currentEntry.Extended, replaceMeta, replaceTagging)
 			if metadataErr != nil {
 				glog.Errorf("CopyObjectHandler ValidateTags error %s: %v", r.URL, metadataErr)
 				return s3err.ErrInvalidTag
 			}
-			if routeInPlace {
-				if err := s3a.routedMetadataReplace(owner, dstBucket, dstObject, currentEntry, updatedMetadata); err != nil {
-					return filerErrorToS3Error(err)
-				}
-				etag = getEtagFromEntry(currentEntry)
-				return s3err.ErrNone
-			}
+			// Both ACL keys replace the source's grants on every fresh attempt.
+			applyPutObjectACL(r, &filer_pb.Entry{Extended: updatedMetadata})
 			updatedEntry := cloneProtoEntry(currentEntry)
+			if owner != "" {
+				// Prefix objects remain directories containing child keys. Use
+				// their raw form both for the condition and for the update.
+				updatedEntry = cloneProtoEntry(rawEntry)
+			}
 			updatedEntry.Extended = mergeCopyMetadata(updatedEntry.Extended, updatedMetadata)
+			// The update keeps the object's existing lock state, but request
+			// lock headers still need validating so a disallowed combination
+			// is rejected rather than silently ignored.
+			if errCode := s3a.applyCopyObjectLockHeaders(r, dstBucket, dstObject, updatedEntry); errCode != s3err.ErrNone {
+				return errCode
+			}
 			if updatedEntry.Attributes == nil {
 				updatedEntry.Attributes = &filer_pb.FuseAttributes{}
 			}
 			updatedEntry.Attributes.Mime = resolveDestinationMime(r.Header, currentEntry.GetAttributes().GetMime(), replaceMeta)
+			updatedEntry.Attributes.FileMode = fileMode
+			if updatedEntry.IsDirectory {
+				updatedEntry.Attributes.FileMode |= uint32(os.ModeDir)
+			}
 			updatedEntry.Attributes.Mtime = t.Unix()
+			if owner != "" {
+				if err := s3a.routedSelfCopy(r.Context(), owner, dstBucket, dstObject, rawEntry, updatedEntry); err != nil {
+					switch status.Code(err) {
+					case codes.FailedPrecondition:
+						return s3err.ErrConditionalRequestConflict
+					case codes.NotFound:
+						return s3err.ErrNoSuchKey
+					default:
+						return filerErrorToS3Error(err)
+					}
+				}
+				etag = getEtagFromEntry(currentEntry)
+				return s3err.ErrNone
+			}
 			var finErr error
 			dstVersionId, etag, finErr = s3a.finalizeCopyDestination(dstBucket, dstObject, dstVersioningState, updatedEntry)
 			if finErr != nil {
@@ -283,9 +416,14 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 			return s3err.ErrNone
 		}
 		var updateCode s3err.ErrorCode
-		if routeInPlace {
-			if updateCode = s3a.checkConditionalHeaders(r, dstBucket, dstObject); updateCode == s3err.ErrNone {
+		if owner != "" {
+			// A rejected snapshot has not mutated the object. Re-read and
+			// revalidate on bounded conflicts, without an unconditional fallback.
+			for attempt := 0; attempt < 3; attempt++ {
 				updateCode = selfCopyBody()
+				if updateCode != s3err.ErrConditionalRequestConflict {
+					break
+				}
 			}
 		} else {
 			updateCode = s3a.withObjectWriteLock(dstBucket, dstObject, func() s3err.ErrorCode {
@@ -302,7 +440,7 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 		}
 		setEtag(w, etag)
 		writeSuccessResponseXML(w, r, CopyObjectResult{
-			ETag:         etag,
+			ETag:         quoteETag(etag),
 			LastModified: t,
 		})
 		return
@@ -329,6 +467,9 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 			Mtime:    t.Unix(),
 			Crtime:   entry.Attributes.Crtime,
 			Mime:     resolveDestinationMime(r.Header, entry.Attributes.Mime, replaceMeta),
+			FileMode: s3a.resolveFileMode(r),
+			Uid:      filer_pb.OS_UID,
+			Gid:      filer_pb.OS_GID,
 		},
 		Extended: make(map[string][]byte),
 	}
@@ -343,6 +484,16 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 	dstWantsSSES3 := IsSSES3RequestInternal(r)
 
 	for k, v := range entry.Extended {
+		// Object ACLs and ownership are not copied, regardless of the metadata directive.
+		if k == s3_constants.ExtAmzOwnerKey || k == s3_constants.ExtAmzAclKey {
+			continue
+		}
+		// Retention and legal hold are destination settings, not object
+		// metadata: the copy takes its own lock headers or the destination
+		// bucket's default instead.
+		if isCopyLockKey(k) {
+			continue
+		}
 		// Skip encryption-specific headers that might conflict with destination encryption type
 		skipHeader := false
 
@@ -376,10 +527,14 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 	}
 
 	// mergeCopyMetadata drops stale managed keys before applying the new set,
-	// so REPLACE doesn't leak source values through the merge. Mirrors the
-	// self-copy path's routedMetadataReplace.
+	// so REPLACE doesn't leak source values through the merge, as on self-copies.
 	dstEntry.Extended = mergeCopyMetadata(dstEntry.Extended, processedMetadata)
 
+	if errCode := s3a.applyCopyObjectLockHeaders(r, dstBucket, dstObject, dstEntry); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// For zero-size files or files without chunks, handle inline content
 	// This includes encrypted inline files that need decryption/re-encryption
 	if entry.Attributes.FileSize == 0 || len(entry.GetChunks()) == 0 {
@@ -444,6 +599,7 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 
 	var dstVersionId string
 	var etag string
+	applyPutObjectACL(r, dstEntry)
 
 	finalizeCode := s3a.withObjectWriteLock(dstBucket, dstObject, func() s3err.ErrorCode {
 		return s3a.checkConditionalHeaders(r, dstBucket, dstObject)
@@ -467,7 +623,7 @@ func (s3a *S3ApiServer) CopyObjectHandler(w http.ResponseWriter, r *http.Request
 	setEtag(w, etag)
 
 	response := CopyObjectResult{
-		ETag:         etag,
+		ETag:         quoteETag(etag),
 		LastModified: t,
 	}
 
@@ -487,6 +643,39 @@ func copyReplacesSourceEntry(sameDestination bool, dstVersioningState, srcVersio
 	return sameDestination && dstVersioningState == "" && srcVersionId == ""
 }
 
+// isCopyLockKey marks the extended attributes that carry object lock state; a
+// copy never inherits them from the source.
+func isCopyLockKey(key string) bool {
+	switch key {
+	case s3_constants.ExtObjectLockModeKey, s3_constants.ExtRetentionUntilDateKey, s3_constants.ExtLegalHoldKey:
+		return true
+	}
+	return false
+}
+
+// applyCopyObjectLockHeaders resolves the copied object's retention: explicit
+// copy-request lock headers win, then the destination bucket's default, and
+// the source's own retention never carries over.
+func (s3a *S3ApiServer) applyCopyObjectLockHeaders(r *http.Request, dstBucket, dstObject string, dstEntry *filer_pb.Entry) s3err.ErrorCode {
+	objectLockEnabled, lockErr := s3a.isObjectLockEnabled(dstBucket)
+	if lockErr != nil && !errors.Is(lockErr, filer_pb.ErrNotFound) {
+		glog.Errorf("CopyObjectHandler: failed to check object lock for bucket %s: %v", dstBucket, lockErr)
+		return s3err.ErrInternalError
+	}
+	if validationErr := s3a.validateObjectLockHeaders(r, dstBucket, dstObject, objectLockEnabled); validationErr != nil {
+		glog.V(2).Infof("CopyObjectHandler: object lock header validation failed for %s/%s: %v", dstBucket, dstObject, validationErr)
+		return mapValidationErrorToS3Error(validationErr)
+	}
+	if !objectLockEnabled {
+		return s3err.ErrNone
+	}
+	if err := s3a.extractObjectLockMetadataFromRequest(r, dstEntry); err != nil {
+		glog.Errorf("CopyObjectHandler: failed to extract object lock metadata for %s/%s: %v", dstBucket, dstObject, err)
+		return mapValidationErrorToS3Error(err)
+	}
+	return s3err.ErrNone
+}
+
 func cloneProtoEntry(entry *filer_pb.Entry) *filer_pb.Entry {
 	if entry == nil {
 		return nil
@@ -498,27 +687,7 @@ func copyEntryETag(entry *filer_pb.Entry) string {
 	if entry == nil {
 		return ""
 	}
-	if entry.Extended != nil {
-		if etag, ok := entry.Extended[s3_constants.ExtETagKey]; ok && len(etag) > 0 {
-			return string(etag)
-		}
-	}
-	attr := filer.Attr{}
-	if entry.Attributes != nil {
-		attr = filer.Attr{
-			FileSize: entry.Attributes.FileSize,
-			Mtime:    time.Unix(entry.Attributes.Mtime, 0),
-			Crtime:   time.Unix(entry.Attributes.Crtime, 0),
-			Mime:     entry.Attributes.Mime,
-			Md5:      entry.Attributes.Md5,
-		}
-	}
-	return filer.ETagEntry(&filer.Entry{
-		Attr:    attr,
-		Chunks:  entry.Chunks,
-		Content: entry.Content,
-		Remote:  entry.RemoteEntry,
-	})
+	return strings.Trim(objectETag(entry), `"`)
 }
 
 func copyEntryToTarget(dst, src *filer_pb.Entry) {
@@ -620,7 +789,7 @@ func (s3a *S3ApiServer) finalizeCopyDestination(dstBucket, dstObject, dstVersion
 func (s3a *S3ApiServer) rollbackCopyVersion(bucketDir, versionObjectPath string) error {
 	versionPath := util.FullPath(fmt.Sprintf("%s/%s", bucketDir, versionObjectPath))
 	versionDir, versionName := versionPath.DirAndName()
-	return s3a.rmObject(versionDir, versionName, true, false)
+	return s3a.rmObject(context.Background(), versionDir, versionName, true, false)
 }
 
 func (s3a *S3ApiServer) resolveCopySourceEntry(bucket, object, versionId, versioningState string) (*filer_pb.Entry, error) {
@@ -754,42 +923,40 @@ func pathToBucketObjectAndVersion(rawPath, decodedPath string) (bucket, object,
 				}
 
 				bucket, object = pathToBucketAndObject(pathForBucket)
-				return bucket, object, versionId
+				return bucket, s3_constants.NormalizeObjectKey(object), versionId
 			}
 		}
 	}
 
 	bucket, object = pathToBucketAndObject(pathForBucket)
-	return bucket, object, versionId
+	return bucket, s3_constants.NormalizeObjectKey(object), versionId
 }
 
 type CopyPartResult struct {
-	LastModified      time.Time `xml:"LastModified"`
-	ETag              string    `xml:"ETag"`
-	ChecksumCRC32     string    `xml:"ChecksumCRC32,omitempty"`
-	ChecksumCRC32C    string    `xml:"ChecksumCRC32C,omitempty"`
-	ChecksumCRC64NVME string    `xml:"ChecksumCRC64NVME,omitempty"`
-	ChecksumSHA1      string    `xml:"ChecksumSHA1,omitempty"`
-	ChecksumSHA256    string    `xml:"ChecksumSHA256,omitempty"`
+	LastModified time.Time `xml:"LastModified"`
+	ETag         string    `xml:"ETag"`
+	ChecksumResult
+}
+
+// MarshalXML writes LastModified in the S3 timestamp format (see xsdDateTime)
+// instead of encoding/xml's RFC 3339 with trimmed fractional seconds.
+func (r CopyPartResult) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	type T CopyPartResult
+	var layout struct {
+		*T
+		LastModified xsdDateTime `xml:"LastModified"`
+	}
+	layout.T = (*T)(&r)
+	layout.LastModified = xsdDateTime(r.LastModified)
+	return e.EncodeElement(layout, start)
 }
 
 func buildCopyPartResult(etag string, lastModified time.Time, metadata SSEResponseMetadata) CopyPartResult {
 	result := CopyPartResult{
-		ETag:         etag,
+		ETag:         quoteETag(etag),
 		LastModified: lastModified,
 	}
-	switch metadata.ChecksumHeaderName {
-	case s3_constants.AmzChecksumCRC32:
-		result.ChecksumCRC32 = metadata.ChecksumValue
-	case s3_constants.AmzChecksumCRC32C:
-		result.ChecksumCRC32C = metadata.ChecksumValue
-	case s3_constants.AmzChecksumCRC64NVME:
-		result.ChecksumCRC64NVME = metadata.ChecksumValue
-	case s3_constants.AmzChecksumSHA1:
-		result.ChecksumSHA1 = metadata.ChecksumValue
-	case s3_constants.AmzChecksumSHA256:
-		result.ChecksumSHA256 = metadata.ChecksumValue
-	}
+	result.SetChecksum(metadata.ChecksumHeaderName, metadata.ChecksumValue)
 	return result
 }
 
@@ -850,8 +1017,10 @@ func (s3a *S3ApiServer) CopyObjectPartHandler(w http.ResponseWriter, r *http.Req
 	// UploadPartCopy requires s3:GetObject on the source. The Auth middleware
 	// only verified s3:PutObject (s3:UploadPart) on the destination.
 	if errCode := s3a.authorizeCopySource(r, srcBucket, srcObject, srcVersionId); errCode != s3err.ErrNone {
-		s3err.WriteErrorResponse(w, r, errCode)
-		return
+		if s3a.recheckPolicyForKeyWithLookup(r, http.MethodGet, srcBucket, srcObject, srcVersionId, string(s3_constants.ACTION_READ), "CopyObjectPartHandler") != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
 	}
 
 	partIDString := r.URL.Query().Get("partNumber")
@@ -920,6 +1089,11 @@ func (s3a *S3ApiServer) CopyObjectPartHandler(w http.ResponseWriter, r *http.Req
 		return
 	}
 
+	if errCode := s3a.recheckCopySourcePolicy(r, srcBucket, srcObject, srcVersionId, entry.Extended, "CopyObjectPartHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Cache remote-only sources before copying; the part-copy paths below
 	// iterate entry.GetChunks() and would otherwise produce an empty part.
 	if entry.IsInRemoteOnly() {
@@ -951,7 +1125,7 @@ func (s3a *S3ApiServer) CopyObjectPartHandler(w http.ResponseWriter, r *http.Req
 	rangeHeader := r.Header.Get("x-amz-copy-source-range")
 	var startOffset, endOffset int64
 	if rangeHeader != "" {
-		startOffset, endOffset, err = parseRangeHeader(rangeHeader)
+		startOffset, endOffset, err = parseRangeHeader(rangeHeader, int64(filer.FileSize(entry)))
 		if err != nil {
 			s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRange)
 			return
@@ -999,13 +1173,19 @@ func (s3a *S3ApiServer) CopyObjectPartHandler(w http.ResponseWriter, r *http.Req
 		return
 	}
 
-	if uploadEntryHasSSE(uploadEntry) || sourceEntryHasSSE(entry) || uploadEntryHasChecksum(uploadEntry) {
-		etag, sseMetadata, errCode := s3a.copyObjectPartViaReencryption(r, entry, startOffset, endOffset, dstBucket, uploadID, partID, uploadEntry)
+	// Inline-Content sources have no chunks for the raw-byte path to copy;
+	// the plaintext stream serves their range instead.
+	if uploadEntryHasSSE(uploadEntry) || sourceEntryIsEncrypted(entry) || uploadEntryHasChecksum(uploadEntry) || len(entry.Content) > 0 {
+		etag, sseMetadata, errCode := s3a.copyObjectPartViaReencryption(r, entry, startOffset, endOffset, dstBucket, dstObject, uploadID, partID, uploadEntry)
 		if errCode != s3err.ErrNone {
 			s3err.WriteErrorResponse(w, r, errCode)
 			return
 		}
-		setEtag(w, "\""+strings.Trim(etag, "\"")+"\"")
+		// the copy above re-creates a directory an abort removed mid-copy
+		if !s3a.checkUploadStillOpen(w, r, dstBucket, dstObject, uploadID) {
+			return
+		}
+		setEtag(w, etag)
 		// Mirror PutObjectPartHandler: write x-amz-server-side-encryption /
 		// x-amz-server-side-encryption-aws-kms-key-id headers on the response
 		// so clients can see the destination's encryption state.
@@ -1030,39 +1210,53 @@ func (s3a *S3ApiServer) CopyObjectPartHandler(w http.ResponseWriter, r *http.Req
 			Mtime:    t.Unix(),
 			Crtime:   t.Unix(),
 			Mime:     entry.Attributes.Mime,
+			FileMode: s3a.resolveFileMode(r),
+			Uid:      filer_pb.OS_UID,
+			Gid:      filer_pb.OS_GID,
 		},
 		Extended: make(map[string][]byte),
 	}
 
-	// The copied part lives under the destination bucket's .uploads folder.
-	// Assign destination volumes against that real filer path so they land in
-	// the destination bucket's collection. r.URL.Path is the S3 request URI
-	// (e.g. /bucket/key), not a filer path, so passing it would skip the
-	// filer's bucket-to-collection mapping and route the copied bytes to the
-	// default collection.
 	uploadDir, partName := s3a.copyPartLocation(dstBucket, uploadID, partID)
-	dstPartPath := uploadDir + "/" + partName
+
+	// The copied part entry lives under the destination bucket's .uploads
+	// folder, but its bytes become the object, so assign destination volumes
+	// against the destination object's filer path: that is the path filer.conf
+	// storage rules and the bucket-to-collection mapping are written for.
+	// r.URL.Path is the S3 request URI (e.g. /bucket/key), not a filer path, so
+	// passing it would skip the mapping and route the copied bytes to the
+	// default collection.
+	dstAssignPath := s3a.toFilerPath(dstBucket, dstObject)
 
 	// Handle zero-size files or empty ranges
 	if entry.Attributes.FileSize == 0 || endOffset < startOffset {
 		// For zero-size files or invalid ranges, create an empty part with size 0
 		dstEntry.Attributes.FileSize = 0
 		dstEntry.Chunks = nil
+		dstEntry.Attributes.Md5 = md5.New().Sum(nil)
 	} else {
 		// Copy chunks that overlap with the range
-		dstChunks, err := s3a.copyChunksForRange(entry, startOffset, endOffset, dstPartPath)
+		dstChunks, partMd5, err := s3a.copyChunksForRange(entry, startOffset, endOffset, dstAssignPath)
 		if err != nil {
 			glog.Errorf("CopyObjectPartHandler copy chunks error: %v", err)
-			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			s3err.WriteErrorResponse(w, r, s3a.mapCopyErrorToS3Error(err))
 			return
 		}
 		dstEntry.Chunks = dstChunks
+		dstEntry.Attributes.Md5 = partMd5
+	}
+
+	// Mirror putToFiler: the part entry carries the MD5 of its bytes so
+	// CopyPartResult, ListParts and complete's composite ETag all describe
+	// the copied range rather than the source chunks.
+	if len(dstEntry.Attributes.Md5) > 0 {
+		dstEntry.Extended[s3_constants.ExtETagKey] = []byte(fmt.Sprintf("%x", dstEntry.Attributes.Md5))
 	}
 
 	// Save the part entry to the multipart uploads folder
 	// Check if part exists and remove it first (allow re-copying same part)
 	if exists, _ := s3a.exists(uploadDir, partName, false); exists {
-		if err := s3a.rm(uploadDir, partName, false, false); err != nil {
+		if err := s3a.rm(r.Context(), uploadDir, partName, false, false); err != nil {
 			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
 			return
 		}
@@ -1076,6 +1270,11 @@ func (s3a *S3ApiServer) CopyObjectPartHandler(w http.ResponseWriter, r *http.Req
 		return
 	}
 
+	// the copy above re-creates a directory an abort removed mid-copy
+	if !s3a.checkUploadStillOpen(w, r, dstBucket, dstObject, uploadID) {
+		return
+	}
+
 	// Calculate ETag for the part
 	etag := copyEntryETag(dstEntry)
 	setEtag(w, etag)
@@ -1161,7 +1360,11 @@ func processMetadataBytes(reqHeader http.Header, existing map[string][]byte, rep
 			}
 		}
 		for _, h := range copyReplaceSystemHeaders {
-			if v := reqHeader.Get(h); v != "" {
+			v := reqHeader.Get(h)
+			if h == "Content-Encoding" {
+				v = storedContentEncoding(reqHeader.Values(h))
+			}
+			if v != "" {
 				metadata[h] = []byte(v)
 			}
 		}
@@ -1270,7 +1473,7 @@ func (s3a *S3ApiServer) copyChunks(entry *filer_pb.Entry, dstPath string) ([]*fi
 		executor.Execute(func() {
 			dstChunk, err := s3a.copySingleChunk(chunk, dstPath)
 			if err != nil {
-				errChan <- fmt.Errorf("chunk %d: %v", chunkIndex, err)
+				errChan <- fmt.Errorf("chunk %d: %w", chunkIndex, err)
 				return
 			}
 			dstChunks[chunkIndex] = dstChunk
@@ -1314,7 +1517,7 @@ func (s3a *S3ApiServer) copySingleChunk(chunk *filer_pb.FileChunk, dstPath strin
 	// the source volume for compressed bytes, so a gzipped chunk is
 	// forwarded to the destination without anyone having to decompress.
 	if canStreamCopyChunk(chunk) {
-		if err := s3a.streamCopyChunkRange(context.Background(), srcUrl, fileId, 0, int64(chunk.Size), true /*isFullChunk*/, assignResult); err != nil {
+		if err := s3a.streamCopyChunkRange(context.Background(), srcUrl, fileId, 0, int64(chunk.Size), true /*isFullChunk*/, assignResult, nil); err != nil {
 			return nil, fmt.Errorf("stream chunk: %w", err)
 		}
 		return dstChunk, nil
@@ -1369,9 +1572,22 @@ func (s3a *S3ApiServer) copySingleChunkForRange(originalChunk, rangeChunk *filer
 	// part-size = chunk-size assemble pattern hits this branch.
 	if canStreamCopyChunk(originalChunk) {
 		isFullChunk := offsetInChunk == 0 && rangeChunk.Size == originalChunk.Size
-		if err := s3a.streamCopyChunkRange(context.Background(), srcUrl, fileId, offsetInChunk, int64(rangeChunk.Size), isFullChunk, assignResult); err != nil {
+		// A partial range stores different bytes than the source chunk, so
+		// its ETag has to be recomputed; a whole-chunk copy reuses it.
+		var digest hash.Hash
+		if !isFullChunk {
+			digest = md5.New()
+		}
+		if err := s3a.streamCopyChunkRange(context.Background(), srcUrl, fileId, offsetInChunk, int64(rangeChunk.Size), isFullChunk, assignResult, digest); err != nil {
 			return nil, fmt.Errorf("stream chunk range: %w", err)
 		}
+		if digest != nil {
+			dstChunk.ETag = base64.StdEncoding.EncodeToString(digest.Sum(nil))
+			// The range fetch returns raw bytes and the destination stores
+			// them uncompressed, so the source chunk's gzip flag must not
+			// carry over onto a partial copy.
+			dstChunk.IsCompressed = false
+		}
 		return dstChunk, nil
 	}
 
@@ -1404,8 +1620,8 @@ func (s3a *S3ApiServer) assignNewVolume(dstPath string, expectedDataSize uint64)
 		if err != nil {
 			return fmt.Errorf("assign volume: %w", err)
 		}
-		if resp.Error != "" {
-			return fmt.Errorf("assign volume: %v", resp.Error)
+		if err := filer_pb.AssignVolumeResponseError(resp); err != nil {
+			return fmt.Errorf("assign volume: %w", err)
 		}
 		assignResult = resp
 		return nil
@@ -1416,8 +1632,10 @@ func (s3a *S3ApiServer) assignNewVolume(dstPath string, expectedDataSize uint64)
 	return assignResult, nil
 }
 
-// parseRangeHeader parses the x-amz-copy-source-range header
-func parseRangeHeader(rangeHeader string) (startOffset, endOffset int64, err error) {
+// parseRangeHeader parses the x-amz-copy-source-range header against a source of
+// fileSize bytes. Unlike a GET, a part copy does not clamp: a range reaching past
+// the source is unsatisfiable, and copying it would pad the part with zeros.
+func parseRangeHeader(rangeHeader string, fileSize int64) (startOffset, endOffset int64, err error) {
 	// Remove "bytes=" prefix if present
 	rangeStr := strings.TrimPrefix(rangeHeader, "bytes=")
 	parts := strings.Split(rangeStr, "-")
@@ -1435,11 +1653,23 @@ func parseRangeHeader(rangeHeader string) (startOffset, endOffset int64, err err
 		return 0, 0, fmt.Errorf("invalid end offset: %w", err)
 	}
 
+	if startOffset < 0 || endOffset < startOffset || endOffset >= fileSize {
+		return 0, 0, fmt.Errorf("range %s is not satisfiable for a %d byte source", rangeHeader, fileSize)
+	}
+
 	return startOffset, endOffset, nil
 }
 
-// copyChunksForRange copies chunks that overlap with the specified range
-func (s3a *S3ApiServer) copyChunksForRange(entry *filer_pb.Entry, startOffset, endOffset int64, dstPath string) ([]*filer_pb.FileChunk, error) {
+// partMd5Result carries the whole-part MD5 the copiedRangeMd5 goroutine
+// computes beside the per-chunk copies.
+type partMd5Result struct {
+	sum []byte
+	err error
+}
+
+// copyChunksForRange copies chunks that overlap with the specified range and
+// returns the MD5 of the copied bytes for the part entry's Attributes.Md5.
+func (s3a *S3ApiServer) copyChunksForRange(entry *filer_pb.Entry, startOffset, endOffset int64, dstPath string) ([]*filer_pb.FileChunk, []byte, error) {
 	var relevantChunks []*filer_pb.FileChunk
 	var originalChunks []*filer_pb.FileChunk
 
@@ -1470,6 +1700,36 @@ func (s3a *S3ApiServer) copyChunksForRange(entry *filer_pb.Entry, startOffset, e
 		}
 	}
 
+	// The part's Attributes.Md5 must cover the copied range in byte order,
+	// and md5 cannot combine per-chunk digests. A single chunk's own digest
+	// is the answer only when it supplies the whole range; anything else —
+	// several chunks, or gaps a sparse source zero-fills — needs an ordered
+	// pass the concurrent copies cannot feed, so a second stream of the
+	// source range hashes beside them.
+	partSize := endOffset - startOffset + 1
+	singleChunkCovers := len(relevantChunks) == 1 &&
+		relevantChunks[0].Offset == 0 && int64(relevantChunks[0].Size) == partSize
+
+	md5Ctx, cancelMd5 := context.WithCancel(context.Background())
+	defer cancelMd5()
+
+	var partMd5 []byte
+	var partMd5Ch chan partMd5Result
+	switch {
+	case singleChunkCovers:
+		// resolved below from the copied chunk's own digest
+	case len(entry.GetChunks()) == 0:
+		// no chunks to read at all: the part is partSize zero bytes (the
+		// stream helper returns empty for a chunkless entry, not zero-fill)
+		partMd5 = md5Zeros(partSize)
+	default:
+		partMd5Ch = make(chan partMd5Result, 1)
+		go func() {
+			sum, err := s3a.copiedRangeMd5(md5Ctx, entry, startOffset, endOffset)
+			partMd5Ch <- partMd5Result{sum, err}
+		}()
+	}
+
 	// Copy the relevant chunks using a specialized method for range copies
 	dstChunks := make([]*filer_pb.FileChunk, len(relevantChunks))
 	const defaultChunkCopyConcurrency = 4
@@ -1482,7 +1742,7 @@ func (s3a *S3ApiServer) copyChunksForRange(entry *filer_pb.Entry, startOffset, e
 		executor.Execute(func() {
 			dstChunk, err := s3a.copySingleChunkForRange(originalChunk, chunk, startOffset, endOffset, dstPath)
 			if err != nil {
-				errChan <- fmt.Errorf("chunk %d: %v", chunkIndex, err)
+				errChan <- fmt.Errorf("chunk %d: %w", chunkIndex, err)
 				return
 			}
 			dstChunks[chunkIndex] = dstChunk
@@ -1493,11 +1753,79 @@ func (s3a *S3ApiServer) copyChunksForRange(entry *filer_pb.Entry, startOffset, e
 	// Wait for all operations to complete and check for errors
 	for i := 0; i < len(relevantChunks); i++ {
 		if err := <-errChan; err != nil {
-			return nil, err
+			return nil, nil, err
 		}
 	}
 
-	return dstChunks, nil
+	// Reads resolve overlapping chunks by ModifiedTsNs, and the concurrent
+	// copies stamped arbitrary finish times: rank the destination chunks by
+	// the source's timestamps so the part resolves overlaps the way the
+	// source did (and the way copiedRangeMd5 hashed it).
+	if len(dstChunks) > 1 {
+		order := make([]int, len(dstChunks))
+		for i := range order {
+			order[i] = i
+		}
+		slices.SortStableFunc(order, func(a, b int) int {
+			return cmp.Compare(originalChunks[a].ModifiedTsNs, originalChunks[b].ModifiedTsNs)
+		})
+		now := time.Now().UnixNano()
+		for rank, i := range order {
+			dstChunks[i].ModifiedTsNs = now + int64(rank)
+		}
+	}
+
+	if partMd5Ch != nil {
+		if res := <-partMd5Ch; res.err != nil {
+			return nil, nil, fmt.Errorf("md5 of copied range: %w", res.err)
+		} else {
+			partMd5 = res.sum
+		}
+	} else if singleChunkCovers {
+		if partMd5 = util.Base64Md5ToBytes(dstChunks[0].ETag); len(partMd5) != md5.Size {
+			// TUS and mount writes leave chunks without an ETag; hash the
+			// copied range when the inherited digest is missing or malformed.
+			sum, err := s3a.copiedRangeMd5(md5Ctx, entry, startOffset, endOffset)
+			if err != nil {
+				return nil, nil, fmt.Errorf("md5 of copied range: %w", err)
+			}
+			partMd5 = sum
+		}
+	}
+
+	return dstChunks, partMd5, nil
+}
+
+// md5Zeros hashes size zero bytes without a volume read — a copied range
+// that overlaps no source chunk assembles to all zeros.
+func md5Zeros(size int64) []byte {
+	h := md5.New()
+	var zeros [1 << 16]byte
+	for size > 0 {
+		n := min(size, int64(len(zeros)))
+		h.Write(zeros[:n])
+		size -= n
+	}
+	return h.Sum(nil)
+}
+
+// copiedRangeMd5 streams the source range once and hashes its plaintext —
+// exactly the bytes the non-SSE part copy assembles on the destination.
+func (s3a *S3ApiServer) copiedRangeMd5(ctx context.Context, entry *filer_pb.Entry, startOffset, endOffset int64) ([]byte, error) {
+	size := endOffset - startOffset + 1
+	// The copy walks the chunks, so the hash must too: on an entry that also
+	// carries inline Content the stream helper would prefer Content instead.
+	chunked := &filer_pb.Entry{Chunks: entry.GetChunks()}
+	reader, err := s3a.getEncryptedStreamFromVolumes(ctx, chunked, startOffset, size)
+	if err != nil {
+		return nil, err
+	}
+	defer reader.Close()
+	h := md5.New()
+	if _, err := io.Copy(h, reader); err != nil {
+		return nil, err
+	}
+	return h.Sum(nil), nil
 }
 
 // Helper methods for copy operations to avoid code duplication
@@ -1682,6 +2010,47 @@ func (s3a *S3ApiServer) uploadChunkData(chunkData []byte, assignResult *filer_pb
 	return nil
 }
 
+func (s3a *S3ApiServer) uploadTransformedChunkData(chunkData []byte, assignResult *filer_pb.AssignVolumeResponse) (*operation.UploadResult, error) {
+	dstUrl := fmt.Sprintf("http://%s/%s", assignResult.Location.Url, assignResult.FileId)
+	if assignResult.Fsync {
+		dstUrl += "?fsync=true"
+	}
+	uploadOption := &operation.UploadOption{
+		UploadUrl:         dstUrl,
+		Cipher:            s3a.cipher,
+		IsInputCompressed: false,
+		MimeType:          "",
+		PairMap:           nil,
+		Jwt:               security.EncodedJwt(assignResult.Auth),
+		BytesBuffer:       bytes.NewBuffer(make([]byte, 0, len(chunkData))),
+	}
+	uploader, err := operation.NewUploader()
+	if err != nil {
+		return nil, fmt.Errorf("create uploader: %w", err)
+	}
+	uploadResult, err := uploader.UploadData(context.Background(), chunkData, uploadOption)
+	if err != nil {
+		return nil, fmt.Errorf("upload transformed chunk: %w", err)
+	}
+	return uploadResult, nil
+}
+
+func (s3a *S3ApiServer) decryptChunkVolumeCipher(data []byte, chunk *filer_pb.FileChunk) ([]byte, error) {
+	if len(chunk.CipherKey) == 0 {
+		return data, nil
+	}
+	decrypted, err := util.Decrypt(data, util.CipherKey(chunk.CipherKey))
+	if err != nil {
+		return nil, fmt.Errorf("decrypt volume cipher: %w", err)
+	}
+	if chunk.IsCompressed {
+		if decrypted, err = util.DecompressData(decrypted); err != nil {
+			return nil, fmt.Errorf("decompress chunk: %w", err)
+		}
+	}
+	return decrypted, nil
+}
+
 // multipartFramingOverhead reserves space for the multipart wrapper
 // upload_content writes around chunkData (boundary + Content-Disposition +
 // optional Content-Type/Content-Encoding/Content-MD5 headers + trailing
@@ -1698,6 +2067,9 @@ const multipartFramingOverhead = 1024
 // buffer is GC'd as soon as the upload returns.
 func newChunkUploadOption(chunkData []byte, assignResult *filer_pb.AssignVolumeResponse, isCompressed bool) *operation.UploadOption {
 	dstUrl := fmt.Sprintf("http://%s/%s", assignResult.Location.Url, assignResult.FileId)
+	if assignResult.Fsync {
+		dstUrl += "?fsync=true"
+	}
 	return &operation.UploadOption{
 		UploadUrl:         dstUrl,
 		Cipher:            false, // Data is already encrypted if source had CipherKey; don't re-encrypt
@@ -1908,6 +2280,10 @@ func (s3a *S3ApiServer) copyMultipartSSEKMSChunk(chunk *filer_pb.FileChunk, sour
 	if err != nil {
 		return nil, fmt.Errorf("download encrypted chunk data: %w", err)
 	}
+	encryptedData, err = s3a.decryptChunkVolumeCipher(encryptedData, chunk)
+	if err != nil {
+		return nil, err
+	}
 
 	var finalData []byte
 
@@ -1970,9 +2346,14 @@ func (s3a *S3ApiServer) copyMultipartSSEKMSChunk(chunk *filer_pb.FileChunk, sour
 	}
 
 	// Upload the final data
-	if err := s3a.uploadChunkData(finalData, assignResult, false); err != nil {
+	uploadResult, err := s3a.uploadTransformedChunkData(finalData, assignResult)
+	if err != nil {
 		return nil, fmt.Errorf("upload chunk data: %w", err)
 	}
+	if uploadResult != nil {
+		dstChunk.CipherKey = uploadResult.CipherKey
+		dstChunk.IsCompressed = uploadResult.Gzip > 0
+	}
 
 	// Update chunk size
 	dstChunk.Size = uint64(len(finalData))
@@ -2005,6 +2386,10 @@ func (s3a *S3ApiServer) copyMultipartSSECChunk(chunk *filer_pb.FileChunk, copySo
 	if err != nil {
 		return nil, nil, fmt.Errorf("download encrypted chunk data: %w", err)
 	}
+	encryptedData, err = s3a.decryptChunkVolumeCipher(encryptedData, chunk)
+	if err != nil {
+		return nil, nil, err
+	}
 
 	var finalData []byte
 	var destIV []byte
@@ -2100,9 +2485,14 @@ func (s3a *S3ApiServer) copyMultipartSSECChunk(chunk *filer_pb.FileChunk, copySo
 	}
 
 	// Upload the final data
-	if err := s3a.uploadChunkData(finalData, assignResult, false); err != nil {
+	uploadResult, err := s3a.uploadTransformedChunkData(finalData, assignResult)
+	if err != nil {
 		return nil, nil, fmt.Errorf("upload chunk data: %w", err)
 	}
+	if uploadResult != nil {
+		dstChunk.CipherKey = uploadResult.CipherKey
+		dstChunk.IsCompressed = uploadResult.Gzip > 0
+	}
 
 	// Update chunk size
 	dstChunk.Size = uint64(len(finalData))
@@ -2299,6 +2689,10 @@ func (s3a *S3ApiServer) copyCrossEncryptionChunk(chunk *filer_pb.FileChunk, sour
 	if err != nil {
 		return nil, fmt.Errorf("download encrypted chunk data: %w", err)
 	}
+	encryptedData, err = s3a.decryptChunkVolumeCipher(encryptedData, chunk)
+	if err != nil {
+		return nil, err
+	}
 
 	var finalData []byte
 
@@ -2489,9 +2883,14 @@ func (s3a *S3ApiServer) copyCrossEncryptionChunk(chunk *filer_pb.FileChunk, sour
 	// For unencrypted destination, finalData remains as decrypted plaintext
 
 	// Upload the final data
-	if err := s3a.uploadChunkData(finalData, assignResult, false); err != nil {
+	uploadResult, err := s3a.uploadTransformedChunkData(finalData, assignResult)
+	if err != nil {
 		return nil, fmt.Errorf("upload chunk data: %w", err)
 	}
+	if uploadResult != nil {
+		dstChunk.CipherKey = uploadResult.CipherKey
+		dstChunk.IsCompressed = uploadResult.Gzip > 0
+	}
 
 	// Update chunk size
 	dstChunk.Size = uint64(len(finalData))
@@ -2604,7 +3003,7 @@ func (s3a *S3ApiServer) copyChunksWithReencryption(entry *filer_pb.Entry, copySo
 		executor.Execute(func() {
 			dstChunk, err := s3a.copyChunkWithReencryption(chunk, copySourceKey, destKey, dstPath, entry.Extended, destIV)
 			if err != nil {
-				errChan <- fmt.Errorf("chunk %d: %v", chunkIndex, err)
+				errChan <- fmt.Errorf("chunk %d: %w", chunkIndex, err)
 				return
 			}
 			dstChunks[chunkIndex] = dstChunk
@@ -2644,6 +3043,10 @@ func (s3a *S3ApiServer) copyChunkWithReencryption(chunk *filer_pb.FileChunk, cop
 	if err != nil {
 		return nil, fmt.Errorf("download encrypted chunk data: %w", err)
 	}
+	encryptedData, err = s3a.decryptChunkVolumeCipher(encryptedData, chunk)
+	if err != nil {
+		return nil, err
+	}
 
 	var finalData []byte
 
@@ -2702,9 +3105,14 @@ func (s3a *S3ApiServer) copyChunkWithReencryption(chunk *filer_pb.FileChunk, cop
 	}
 
 	// Upload the processed data
-	if err := s3a.uploadChunkData(finalData, assignResult, false); err != nil {
+	uploadResult, err := s3a.uploadTransformedChunkData(finalData, assignResult)
+	if err != nil {
 		return nil, fmt.Errorf("upload processed chunk data: %w", err)
 	}
+	if uploadResult != nil {
+		dstChunk.CipherKey = uploadResult.CipherKey
+		dstChunk.IsCompressed = uploadResult.Gzip > 0
+	}
 
 	return dstChunk, nil
 }
@@ -2975,6 +3383,10 @@ func (s3a *S3ApiServer) copyChunkWithSSEKMSReencryption(chunk *filer_pb.FileChun
 	if err != nil {
 		return nil, fmt.Errorf("download chunk data: %w", err)
 	}
+	chunkData, err = s3a.decryptChunkVolumeCipher(chunkData, chunk)
+	if err != nil {
+		return nil, err
+	}
 
 	var finalData []byte
 
@@ -3058,9 +3470,14 @@ func (s3a *S3ApiServer) copyChunkWithSSEKMSReencryption(chunk *filer_pb.FileChun
 	}
 
 	// Upload the processed data
-	if err := s3a.uploadChunkData(finalData, assignResult, false); err != nil {
+	uploadResult, err := s3a.uploadTransformedChunkData(finalData, assignResult)
+	if err != nil {
 		return nil, fmt.Errorf("upload processed chunk data: %w", err)
 	}
+	if uploadResult != nil {
+		dstChunk.CipherKey = uploadResult.CipherKey
+		dstChunk.IsCompressed = uploadResult.Gzip > 0
+	}
 
 	glog.V(3).Infof("Successfully processed SSE-KMS chunk re-encryption: src_key=%s, dst_key=%s, size=%d→%d",
 		getKeyIDString(sourceSSEKey), destKeyID, len(chunkData), len(finalData))
diff --git a/weed/s3api/s3api_object_handlers_copy_acl_test.go b/weed/s3api/s3api_object_handlers_copy_acl_test.go
new file mode 100644
index 0000000000..ef2997e582
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_copy_acl_test.go
@@ -0,0 +1,484 @@
+package s3api
+
+import (
+	"context"
+	"encoding/xml"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// copyACLFiler records both ordinary creates and the metadata-only self-copy
+// transaction, so tests inspect the actual entry sent to the filer.
+type copyACLFiler struct {
+	*ambiguousPutFiler
+	transactions []*filer_pb.ObjectTransactionRequest
+	updates      []*filer_pb.UpdateEntryRequest
+	afterLookup  func(*filer_pb.LookupDirectoryEntryRequest)
+	beforeCommit func()
+}
+
+// Count two-node RPCs to distinguish a business rejection from failover.
+type selfCopyReplyFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	code  codes.Code
+	calls atomic.Int32
+}
+
+func (f *selfCopyReplyFiler) UpdateEntry(context.Context, *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	f.calls.Add(1)
+	return nil, status.Error(f.code, "test self-copy reply")
+}
+
+// A snapshot conflict or deletion is an authoritative owner reply. It must
+// preserve its status without consulting a peer or tripping owner health.
+func TestRoutedSelfCopyBusinessErrors(t *testing.T) {
+	for _, code := range []codes.Code{codes.FailedPrecondition, codes.NotFound} {
+		t.Run(code.String(), func(t *testing.T) {
+			owner := &selfCopyReplyFiler{code: code}
+			peer := &selfCopyReplyFiler{code: codes.Unavailable}
+			ownerAddress := startFakeFiler(t, owner)
+			peerAddress := startFakeFiler(t, peer)
+			s3a := newPutTestServer(t, peerAddress)
+			current := &filer_pb.Entry{Name: "obj", Attributes: &filer_pb.FuseAttributes{FileMode: defaultFileMode}}
+			err := s3a.routedSelfCopy(context.Background(), ownerAddress, "b", "obj", current, proto.Clone(current).(*filer_pb.Entry))
+			require.Equal(t, code, status.Code(err), "a peer transport error must not mask the owner's business rejection")
+			require.Equal(t, int32(1), owner.calls.Load())
+			require.Zero(t, peer.calls.Load(), "rejected commits must not be replayed")
+			require.False(t, s3a.ownerRecentlyUnreachable(ownerAddress))
+		})
+	}
+}
+
+// Race hooks place an intervening write after the snapshot or immediately
+// before the filer's serialized precondition check, without timing-dependent sleeps.
+func (f *copyACLFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	resp, err := f.ambiguousPutFiler.LookupDirectoryEntry(ctx, req)
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.afterLookup != nil {
+		f.afterLookup(req)
+	}
+	return resp, err
+}
+
+// Match the filer's normalized whole-entry condition, then atomically replace
+// the entry; native condition/commit behavior is covered by server tests too.
+func (f *copyACLFiler) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.updates = append(f.updates, proto.Clone(req).(*filer_pb.UpdateEntryRequest))
+	if f.beforeCommit != nil {
+		f.beforeCommit()
+	}
+	current := f.entries[req.Directory+"/"+req.Entry.Name]
+	if current == nil {
+		return nil, status.Error(codes.NotFound, "missing entry")
+	}
+	if req.Condition == nil || len(req.Condition.Clauses) != 1 || req.Condition.Clauses[0].Kind != filer_pb.WriteCondition_IF_ENTRY_EQUAL {
+		return nil, status.Error(codes.InvalidArgument, "self-copy requires an entry condition")
+	}
+	normalize := func(e *filer_pb.Entry) *filer_pb.Entry { return filer.FromPbEntry("", e).ToProtoEntry() }
+	if !proto.Equal(normalize(current), normalize(req.Condition.Clauses[0].ExpectedEntry)) {
+		return nil, status.Error(codes.FailedPrecondition, "entry changed")
+	}
+	f.entries[req.Directory+"/"+req.Entry.Name] = proto.Clone(req.Entry).(*filer_pb.Entry)
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+// These fixtures have no prior destination versions to list during a null write.
+func (f *copyACLFiler) ListEntries(_ *filer_pb.ListEntriesRequest, _ filer_pb.SeaweedFiler_ListEntriesServer) error {
+	return nil
+}
+
+func (f *copyACLFiler) ObjectTransaction(_ context.Context, req *filer_pb.ObjectTransactionRequest) (*filer_pb.ObjectTransactionResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.transactions = append(f.transactions, proto.Clone(req).(*filer_pb.ObjectTransactionRequest))
+	if f.beforeCommit != nil {
+		f.beforeCommit()
+	}
+	for _, mutation := range req.Mutations {
+		if mutation.Type != filer_pb.ObjectMutation_PATCH_EXTENDED {
+			return &filer_pb.ObjectTransactionResponse{Error: "unexpected mutation"}, nil
+		}
+		entry := f.entries[mutation.Directory+"/"+mutation.Name]
+		if entry == nil {
+			return &filer_pb.ObjectTransactionResponse{Error: "missing entry"}, nil
+		}
+		for _, key := range mutation.DeleteExtended {
+			delete(entry.Extended, key)
+		}
+		for key, value := range mutation.SetExtended {
+			entry.Extended[key] = append([]byte(nil), value...)
+		}
+	}
+	return &filer_pb.ObjectTransactionResponse{}, nil
+}
+
+// TestCopyObjectDestinationACL uses authenticated CopyObject requests to verify
+// that source grants never become destination grants, including self-copies.
+func TestCopyObjectDestinationACL(t *testing.T) {
+	const bucket, writer, bucketOwner, sourceOwner = "copy-acl", "copy-writer", "bucket-owner", "source-owner"
+	const object, sourceObject = "destination", "source"
+	const versionID = "672a75d526ef29c79fe6b5680cad4a0d"
+	tests := []struct {
+		name, acl, grantHeader, grant, ownership, versioning, denyAction, errorCode      string
+		self, routed, replace, presigned, v2, noRead, noWrite, noWriteACP, sourceVersion bool
+		query                                                                            url.Values
+		sourceMode                                                                       uint32
+		mime                                                                             string
+		race, condition                                                                  string
+		prefix                                                                           bool
+	}{
+		{name: "default private"},
+		{name: "replace metadata also defaults private", replace: true},
+		{name: "explicit private", acl: "private"},
+		{name: "explicit public read", acl: "public-read"},
+		{name: "signed query public read", acl: "public-read", presigned: true},
+		{name: "custom read", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`},
+		{name: "custom full control", grantHeader: s3_constants.AmzAclFullControl, grant: `id="bucket-owner"`},
+		{name: "custom read acp", grantHeader: s3_constants.AmzAclReadAcp, grant: `id="bucket-owner"`},
+		{name: "custom write acp", grantHeader: s3_constants.AmzAclWriteAcp, grant: `id="bucket-owner"`, presigned: true},
+		{name: "self copy bootstrap", self: true, replace: true},
+		{name: "self copy routed private", self: true, replace: true, routed: true},
+		{name: "self copy routed explicit public", self: true, replace: true, routed: true, acl: "public-read", sourceMode: 0644},
+		{name: "self copy routed custom", self: true, replace: true, routed: true, grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`},
+		{name: "self copy changes file mode", self: true, replace: true, routed: true, sourceMode: 0644},
+		{name: "self copy changes mime", self: true, replace: true, routed: true, mime: "image/png"},
+		{name: "versioned destination", versioning: s3_constants.VersioningEnabled},
+		{name: "versioned public destination", versioning: s3_constants.VersioningEnabled, acl: "public-read"},
+		{name: "suspended destination", versioning: s3_constants.VersioningSuspended},
+		{name: "specific source version", sourceVersion: true},
+		{name: "versioned self copy", versioning: s3_constants.VersioningEnabled, sourceVersion: true, self: true},
+		{name: "preferred bucket owner", ownership: s3_constants.OwnershipBucketOwnerPreferred, acl: "bucket-owner-full-control"},
+		{name: "enforced bucket owner", ownership: s3_constants.OwnershipBucketOwnerEnforced},
+		{name: "enforced accepts full control", ownership: s3_constants.OwnershipBucketOwnerEnforced, acl: "bucket-owner-full-control"},
+		{name: "enforced rejects public", ownership: s3_constants.OwnershipBucketOwnerEnforced, acl: "public-read", errorCode: "AccessControlListNotSupported"},
+		{name: "default needs no write acp", noWriteACP: true},
+		{name: "public requires write acp", acl: "public-read", noWriteACP: true, errorCode: "AccessDenied"},
+		{name: "custom requires write acp", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, noWriteACP: true, errorCode: "AccessDenied"},
+		{name: "requires source read", noRead: true, errorCode: "AccessDenied"},
+		{name: "requires destination write", noWrite: true, errorCode: "AccessDenied"},
+		{name: "query put deny", acl: "public-read", presigned: true, denyAction: "s3:PutObject", errorCode: "AccessDenied"},
+		{name: "query acl deny", acl: "public-read", presigned: true, denyAction: "s3:PutObjectAcl", errorCode: "AccessDenied"},
+		{name: "query custom put deny", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, presigned: true, denyAction: "s3:PutObject", errorCode: "AccessDenied"},
+		{name: "query custom acl deny", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, presigned: true, denyAction: "s3:PutObjectAcl", errorCode: "AccessDenied"},
+		{name: "invalid canned", acl: "invalid", errorCode: "InvalidRequest"},
+		{name: "conflicting canned and grants", acl: "private", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, errorCode: "InvalidRequest"},
+		{name: "duplicate signed query", query: url.Values{"x-amz-acl": {"private", "public-read"}}, presigned: true, errorCode: "InvalidRequest"},
+		{name: "v2 unsigned query ignored", v2: true, query: url.Values{"x-amz-acl": {"public-read"}}},
+		{name: "private mode changes after first read", self: true, replace: true, routed: true, race: "read"},
+		{name: "public mode changes after first read", self: true, replace: true, routed: true, race: "read", acl: "public-read", sourceMode: 0644},
+		{name: "private mode changes before commit", self: true, replace: true, routed: true, race: "commit"},
+		{name: "public mode changes before commit", self: true, replace: true, routed: true, race: "commit", acl: "public-read", sourceMode: 0644},
+		{name: "mime changes before commit", self: true, replace: true, routed: true, race: "mime"},
+		{name: "content changes before commit", self: true, replace: true, routed: true, race: "content"},
+		{name: "source condition rechecked on retry", self: true, replace: true, routed: true, race: "content", condition: "source", errorCode: "PreconditionFailed"},
+		{name: "destination condition rechecked on retry", self: true, replace: true, routed: true, race: "content", condition: "destination", errorCode: "PreconditionFailed"},
+		{name: "deleted before commit", self: true, replace: true, routed: true, race: "delete", errorCode: "NoSuchKey"},
+		{name: "bounded self copy conflicts", self: true, replace: true, routed: true, race: "repeat", errorCode: "ConditionalRequestConflict"},
+		{name: "prefix private control", self: true, replace: true, routed: true, prefix: true},
+		{name: "prefix mode changes before commit", self: true, replace: true, routed: true, prefix: true, race: "commit"},
+		{name: "self copy reads owner ahead of replica", self: true, replace: true, routed: true, race: "replica"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			filer := &copyACLFiler{ambiguousPutFiler: &ambiguousPutFiler{apply: true, entries: map[string]*filer_pb.Entry{}}}
+			address := startFakeFiler(t, filer)
+			s3a := newPutTestServer(t, address)
+			s3a.iam = NewIdentityAccessManagementWithStore(s3a.option, nil, "memory")
+			t.Cleanup(s3a.iam.Shutdown)
+			s3a.iam.isAuthEnabled = true
+			account := &Account{Id: writer, DisplayName: writer}
+			identity := &Identity{Name: "copy-acl-test", Account: account, IsStatic: true,
+				Credentials: []*Credential{{AccessKey: routingTestAccessKey, SecretKey: routingTestSecretKey}}}
+			for action, enabled := range map[Action]bool{"Read:" + bucket: !tt.noRead, "Write:" + bucket: !tt.noWrite, "WriteAcp:" + bucket: !tt.noWriteACP} {
+				if enabled {
+					identity.Actions = append(identity.Actions, action)
+				}
+			}
+			s3a.iam.accessKeyIdent[routingTestAccessKey] = identity
+			s3a.iam.nameToIdentity[identity.Name] = identity
+			s3a.iam.accounts[writer] = account
+			s3a.iam.accounts[bucketOwner] = &Account{Id: bucketOwner, DisplayName: bucketOwner}
+			ownership := tt.ownership
+			if ownership == "" {
+				ownership = s3_constants.OwnershipObjectWriter
+			}
+			bucketEntry := &filer_pb.Entry{Name: bucket, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}, Extended: map[string][]byte{
+				s3_constants.ExtAmzOwnerKey: []byte(bucketOwner), s3_constants.ExtOwnershipKey: []byte(ownership),
+			}}
+			filer.entries["/buckets/"+bucket] = bucketEntry
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set(bucket, &BucketConfig{Name: bucket, Owner: bucketOwner, Ownership: ownership, Versioning: tt.versioning})
+			s3a.bucketRegistry = NewBucketRegistry(s3a)
+			s3a.bucketRegistry.LoadBucketMetadata(bucketEntry)
+			mode := tt.sourceMode
+			if mode == 0 {
+				mode = defaultFileMode
+			}
+			source := &filer_pb.Entry{Name: sourceObject, Attributes: &filer_pb.FuseAttributes{FileMode: mode, FileSize: 4, Mime: "text/plain"}, Content: []byte("data"),
+				Extended: map[string][]byte{"X-Amz-Meta-Source": []byte("kept"), "internal-other": []byte("retained")}}
+			require.Equal(t, s3err.ErrNone, AssembleEntryWithAcp(source, sourceOwner, []*s3.Grant{
+				{Grantee: &s3.Grantee{Type: aws.String(s3_constants.GrantTypeCanonicalUser), ID: aws.String(sourceOwner)}, Permission: aws.String(s3_constants.PermissionFullControl)},
+				{Grantee: &s3.Grantee{Type: aws.String(s3_constants.GrantTypeGroup), URI: aws.String(s3_constants.GranteeGroupAllUsers)}, Permission: aws.String(s3_constants.PermissionRead)},
+			}))
+			if tt.prefix {
+				source.IsDirectory = true
+				source.Attributes.FileMode |= uint32(os.ModeDir)
+				source.Extended[s3_constants.SeaweedFSPrefixObject] = []byte("true")
+				filer.entries["/buckets/"+bucket+"/"+sourceObject+"/child"] = &filer_pb.Entry{Name: "child", Content: []byte("child data")}
+			}
+			key := object
+			if tt.self {
+				key = sourceObject
+			}
+			sourcePath := "/buckets/" + bucket + "/" + sourceObject
+			copySource := "/" + bucket + "/" + sourceObject
+			if tt.sourceVersion {
+				source.Name = s3a.getVersionFileName(versionID)
+				source.Extended[s3_constants.ExtVersionIdKey] = []byte(versionID)
+				sourcePath += s3_constants.VersionsFolder + "/" + source.Name
+				copySource += "?versionId=" + versionID
+			}
+			filer.entries[sourcePath] = source
+			originalSource := proto.Clone(source).(*filer_pb.Entry)
+			if tt.race != "" {
+				injected := false
+				intervene := func() {
+					if injected && tt.race != "repeat" {
+						return
+					}
+					injected = true
+					if tt.race == "delete" {
+						delete(filer.entries, sourcePath)
+						return
+					}
+					current := filer.entries[sourcePath]
+					current.Attributes.FileMode ^= 0024
+					current.Extended["internal-other"] = []byte("concurrent retained")
+					current.Extended[s3_constants.ExtLegalHoldKey] = []byte("ON")
+					if tt.race == "mime" {
+						current.Attributes.Mime = "image/png"
+					}
+					if tt.race == "content" || tt.race == "replica" {
+						current.Content = []byte("next")
+						current.Extended[s3_constants.ExtETagKey] = []byte("next-etag")
+					}
+				}
+				if tt.race == "replica" {
+					// The default filer still has the pre-PUT snapshot. The owner
+					// already committed the newer entry before this copy starts.
+					replica := &copyACLFiler{ambiguousPutFiler: &ambiguousPutFiler{entries: map[string]*filer_pb.Entry{sourcePath: proto.Clone(originalSource).(*filer_pb.Entry)}}}
+					replicaAddress := startFakeFiler(t, replica)
+					s3a.filerClient = wdclient.NewFilerClient([]pb.ServerAddress{replicaAddress, address}, s3a.option.GrpcDialOption, "")
+					intervene()
+				} else if tt.race == "read" {
+					filer.afterLookup = func(req *filer_pb.LookupDirectoryEntryRequest) {
+						if req.Directory+"/"+req.Name == sourcePath {
+							intervene()
+						}
+					}
+				} else {
+					filer.beforeCommit = intervene
+				}
+			}
+			if tt.versioning != "" || tt.sourceVersion {
+				filer.entries["/buckets/"+bucket+"/"+key+s3_constants.VersionsFolder] = &filer_pb.Entry{Name: key + s3_constants.VersionsFolder, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+			}
+			if tt.routed {
+				s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, address)
+				s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{address}, 1)
+			}
+			if tt.denyAction != "" {
+				s3a.policyEngine = NewBucketPolicyEngine()
+				s3a.iam.policyEngine = s3a.policyEngine
+				conditionKey, conditionValue := "s3:x-amz-acl", "public-read"
+				if tt.grantHeader != "" {
+					conditionKey, conditionValue = "s3:"+strings.ToLower(tt.grantHeader), tt.grant
+				}
+				policy := fmt.Sprintf(`{"Version":"2012-10-17","Statement":[{"Principal":"*","Effect":"Deny","Action":%q,"Resource":"arn:aws:s3:::copy-acl/*","Condition":{"StringEquals":{%q:%q}}}]}`, tt.denyAction, conditionKey, conditionValue)
+				require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy(bucket, policy))
+			}
+			req := httptest.NewRequest(http.MethodPut, "http://s3/"+bucket+"/"+key, nil)
+			req = mux.SetURLVars(req, map[string]string{"bucket": bucket, "object": key})
+			req.Header.Set("X-Amz-Copy-Source", copySource)
+			if tt.condition != "" {
+				header := "X-Amz-Copy-Source-If-Match"
+				if tt.condition == "destination" {
+					header = "If-Match"
+				}
+				req.Header.Set(header, getEtagFromEntry(prefixObjectSource(originalSource)))
+			}
+			// Forged internal headers must not influence the new owner or grants.
+			req.Header.Set(s3_constants.ExtAmzOwnerKey, "forged-owner")
+			req.Header.Set(s3_constants.ExtAmzAclKey, string(source.Extended[s3_constants.ExtAmzAclKey]))
+			if tt.replace {
+				req.Header.Set(s3_constants.AmzUserMetaDirective, "REPLACE")
+				req.Header.Set("X-Amz-Meta-Destination", "new")
+				req.Header.Set("Content-Type", "text/plain")
+			}
+			if tt.mime != "" {
+				req.Header.Set("Content-Type", tt.mime)
+			}
+			if tt.acl != "" {
+				req.Header.Set(s3_constants.AmzCannedAcl, tt.acl)
+			}
+			if tt.grantHeader != "" {
+				req.Header.Set(tt.grantHeader, tt.grant)
+			}
+			req.URL.RawQuery = tt.query.Encode()
+			if tt.presigned {
+				query := req.URL.Query()
+				for _, header := range []string{s3_constants.AmzCannedAcl, tt.grantHeader} {
+					if value := req.Header.Get(header); value != "" {
+						query.Set(header, value)
+						req.Header.Del(header)
+					}
+				}
+				req.URL.RawQuery = query.Encode()
+				signer := v4.NewSigner(credentials.NewStaticCredentials(routingTestAccessKey, routingTestSecretKey, ""))
+				_, err := signer.Presign(req, nil, "s3", "us-east-1", time.Minute, time.Now())
+				require.NoError(t, err)
+			} else if tt.v2 {
+				req.Header.Set("Date", time.Now().UTC().Format(http.TimeFormat))
+				req.Header.Set("Authorization", signatureV2(&Credential{AccessKey: routingTestAccessKey, SecretKey: routingTestSecretKey}, req.Method, req.URL.EscapedPath(), req.URL.RawQuery, req.Header))
+			} else {
+				signRoutingTestRequest(t, req, "", "s3")
+			}
+			rr := httptest.NewRecorder()
+			s3a.iam.Auth(s3a.CopyObjectHandler, s3_constants.ACTION_WRITE)(rr, req)
+			filer.mu.Lock()
+			defer filer.mu.Unlock()
+			if tt.errorCode != "" {
+				require.Contains(t, rr.Body.String(), "<Code>"+tt.errorCode+"</Code>")
+				require.NotEqual(t, http.StatusOK, rr.Code)
+				if tt.race != "" {
+					if tt.race == "repeat" {
+						require.Equal(t, http.StatusConflict, rr.Code)
+					}
+					if tt.race == "delete" {
+						require.Nil(t, filer.entries[sourcePath])
+					} else {
+						require.Equal(t, originalSource.Extended[s3_constants.ExtAmzAclKey], filer.entries[sourcePath].Extended[s3_constants.ExtAmzAclKey], "conflicts must not commit the self-copy ACL")
+					}
+					require.LessOrEqual(t, len(filer.updates), 3, "CAS retries must be bounded")
+					return
+				}
+				require.Empty(t, filer.transactions, "rejected copies must not issue mutations")
+				require.Nil(t, filer.entries["/buckets/"+bucket+"/"+object])
+				require.True(t, proto.Equal(originalSource, filer.entries[sourcePath]), "rejected copies must preserve the source")
+				return
+			}
+			require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+			storedPath := "/buckets/" + bucket + "/" + key
+			if tt.versioning == s3_constants.VersioningEnabled {
+				newVersion := rr.Header().Get("X-Amz-Version-Id")
+				require.NotEmpty(t, newVersion)
+				storedPath += s3_constants.VersionsFolder + "/" + s3a.getVersionFileName(newVersion)
+			}
+			stored := filer.entries[storedPath]
+			require.NotNil(t, stored)
+			wantContent, wantOther := "data", "retained"
+			if tt.race != "" {
+				wantOther = "concurrent retained"
+				require.Equal(t, []byte("ON"), stored.Extended[s3_constants.ExtLegalHoldKey])
+			}
+			if tt.race == "content" || tt.race == "replica" {
+				wantContent = "next"
+				var result CopyObjectResult
+				require.NoError(t, xml.Unmarshal(rr.Body.Bytes(), &result))
+				require.Equal(t, `"next-etag"`, result.ETag)
+			}
+			require.Equal(t, []byte(wantContent), stored.Content)
+			require.Equal(t, []byte(wantOther), stored.Extended["internal-other"])
+			if tt.replace {
+				require.NotContains(t, stored.Extended, "X-Amz-Meta-Source")
+				require.Equal(t, []byte("new"), stored.Extended["X-Amz-Meta-Destination"])
+			} else {
+				require.Equal(t, []byte("kept"), stored.Extended["X-Amz-Meta-Source"])
+			}
+			wantOwner := writer
+			if tt.ownership == s3_constants.OwnershipBucketOwnerEnforced || (tt.ownership == s3_constants.OwnershipBucketOwnerPreferred && tt.acl == "bucket-owner-full-control") {
+				wantOwner = bucketOwner
+			}
+			require.Equal(t, wantOwner, string(stored.Extended[s3_constants.ExtAmzOwnerKey]))
+			grants := GetAcpGrants(stored.Extended)
+			ownerFullControl := false
+			publicRead := false
+			customPermission := map[string]string{s3_constants.AmzAclRead: s3_constants.PermissionRead, s3_constants.AmzAclFullControl: s3_constants.PermissionFullControl, s3_constants.AmzAclReadAcp: s3_constants.PermissionReadAcp, s3_constants.AmzAclWriteAcp: s3_constants.PermissionWriteAcp}[tt.grantHeader]
+			for _, grant := range grants {
+				require.NotEqual(t, sourceOwner, aws.StringValue(grant.Grantee.ID), "source owner grants must not transfer")
+				ownerFullControl = ownerFullControl || (aws.StringValue(grant.Grantee.ID) == wantOwner && aws.StringValue(grant.Permission) == s3_constants.PermissionFullControl)
+				publicRead = publicRead || (aws.StringValue(grant.Grantee.URI) == s3_constants.GranteeGroupAllUsers && aws.StringValue(grant.Permission) == s3_constants.PermissionRead)
+			}
+			require.True(t, ownerFullControl)
+			require.Equal(t, tt.acl == "public-read", publicRead)
+			if customPermission != "" {
+				require.Len(t, grants, 2)
+				require.Equal(t, bucketOwner, aws.StringValue(grants[0].Grantee.ID))
+				require.Equal(t, customPermission, aws.StringValue(grants[0].Permission))
+			} else if tt.acl == "" || tt.acl == "private" {
+				require.Len(t, grants, 1, "private copies must not inherit any source grants")
+			}
+			wantMode := defaultFileMode
+			if tt.acl == "public-read" {
+				wantMode = 0644
+			}
+			if tt.prefix {
+				wantMode |= uint32(os.ModeDir)
+				require.True(t, stored.IsDirectory)
+				require.Equal(t, []byte("true"), stored.Extended[s3_constants.SeaweedFSPrefixObject])
+				require.Equal(t, []byte("child data"), filer.entries[sourcePath+"/child"].Content)
+			}
+			require.Equal(t, wantMode, stored.Attributes.FileMode)
+			if tt.race == "mime" {
+				require.Equal(t, "text/plain", stored.Attributes.Mime)
+			}
+			if tt.mime != "" {
+				require.Equal(t, tt.mime, stored.Attributes.Mime)
+			}
+			require.Empty(t, filer.transactions, "self-copies must not use an unguarded metadata PATCH")
+			if tt.self && tt.routed && tt.versioning == "" && !tt.sourceVersion {
+				attempts := 1
+				if tt.race != "" && tt.race != "read" && tt.race != "replica" {
+					attempts = 2
+				}
+				require.Len(t, filer.updates, attempts)
+				update := filer.updates[attempts-1]
+				require.Equal(t, filer_pb.WriteCondition_IF_ENTRY_EQUAL, update.Condition.Clauses[0].Kind)
+				require.Equal(t, stored.Extended[s3_constants.ExtAmzOwnerKey], update.Entry.Extended[s3_constants.ExtAmzOwnerKey])
+				require.Equal(t, stored.Extended[s3_constants.ExtAmzAclKey], update.Entry.Extended[s3_constants.ExtAmzAclKey])
+			} else {
+				require.Empty(t, filer.updates)
+			}
+			if !tt.self || tt.sourceVersion {
+				require.True(t, proto.Equal(originalSource, filer.entries[sourcePath]), "copy must preserve its source ACL and content")
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_copy_bench_test.go b/weed/s3api/s3api_object_handlers_copy_bench_test.go
index 31fb773839..f2011b9fe8 100644
--- a/weed/s3api/s3api_object_handlers_copy_bench_test.go
+++ b/weed/s3api/s3api_object_handlers_copy_bench_test.go
@@ -160,7 +160,7 @@ func BenchmarkCopyChunk_Streamed(b *testing.B) {
 			for i := 0; i < b.N; i++ {
 				if err := s3a.streamCopyChunkRange(context.Background(),
 					env.srcSrv.URL, env.assign.FileId, 0, int64(size),
-					true /*isFullChunk*/, env.assign); err != nil {
+					true /*isFullChunk*/, env.assign, nil); err != nil {
 					b.Fatalf("stream: %v", err)
 				}
 			}
diff --git a/weed/s3api/s3api_object_handlers_copy_checksum_test.go b/weed/s3api/s3api_object_handlers_copy_checksum_test.go
index b6ed9247a9..8d08ee0782 100644
--- a/weed/s3api/s3api_object_handlers_copy_checksum_test.go
+++ b/weed/s3api/s3api_object_handlers_copy_checksum_test.go
@@ -75,7 +75,7 @@ func TestBuildCopyPartResult(t *testing.T) {
 			header:  s3_constants.AmzChecksumCRC32,
 			element: "<ChecksumCRC32>value</ChecksumCRC32>",
 			expected: CopyPartResult{
-				ETag: "etag", LastModified: modified, ChecksumCRC32: "value",
+				ETag: `"etag"`, LastModified: modified, ChecksumResult: ChecksumResult{ChecksumCRC32: "value"},
 			},
 		},
 		{
@@ -83,7 +83,7 @@ func TestBuildCopyPartResult(t *testing.T) {
 			header:  s3_constants.AmzChecksumCRC32C,
 			element: "<ChecksumCRC32C>value</ChecksumCRC32C>",
 			expected: CopyPartResult{
-				ETag: "etag", LastModified: modified, ChecksumCRC32C: "value",
+				ETag: `"etag"`, LastModified: modified, ChecksumResult: ChecksumResult{ChecksumCRC32C: "value"},
 			},
 		},
 		{
@@ -91,7 +91,7 @@ func TestBuildCopyPartResult(t *testing.T) {
 			header:  s3_constants.AmzChecksumCRC64NVME,
 			element: "<ChecksumCRC64NVME>value</ChecksumCRC64NVME>",
 			expected: CopyPartResult{
-				ETag: "etag", LastModified: modified, ChecksumCRC64NVME: "value",
+				ETag: `"etag"`, LastModified: modified, ChecksumResult: ChecksumResult{ChecksumCRC64NVME: "value"},
 			},
 		},
 		{
@@ -99,7 +99,7 @@ func TestBuildCopyPartResult(t *testing.T) {
 			header:  s3_constants.AmzChecksumSHA1,
 			element: "<ChecksumSHA1>value</ChecksumSHA1>",
 			expected: CopyPartResult{
-				ETag: "etag", LastModified: modified, ChecksumSHA1: "value",
+				ETag: `"etag"`, LastModified: modified, ChecksumResult: ChecksumResult{ChecksumSHA1: "value"},
 			},
 		},
 		{
@@ -107,14 +107,14 @@ func TestBuildCopyPartResult(t *testing.T) {
 			header:  s3_constants.AmzChecksumSHA256,
 			element: "<ChecksumSHA256>value</ChecksumSHA256>",
 			expected: CopyPartResult{
-				ETag: "etag", LastModified: modified, ChecksumSHA256: "value",
+				ETag: `"etag"`, LastModified: modified, ChecksumResult: ChecksumResult{ChecksumSHA256: "value"},
 			},
 		},
 		{
 			name:     "Unknown",
 			header:   "x-amz-checksum-unknown",
 			element:  "",
-			expected: CopyPartResult{ETag: "etag", LastModified: modified},
+			expected: CopyPartResult{ETag: `"etag"`, LastModified: modified},
 		},
 	}
 
diff --git a/weed/s3api/s3api_object_handlers_copy_collection_test.go b/weed/s3api/s3api_object_handlers_copy_collection_test.go
index 79d0bcac69..165cea5b3c 100644
--- a/weed/s3api/s3api_object_handlers_copy_collection_test.go
+++ b/weed/s3api/s3api_object_handlers_copy_collection_test.go
@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
@@ -29,17 +30,46 @@ func TestCopyDestinationPathResolvesBucketCollection(t *testing.T) {
 		t.Fatalf("S3 request URI unexpectedly mapped to collection %q; the test no longer reproduces the bug", got)
 	}
 
-	// UploadPartCopy assigns against the destination part path under .uploads.
-	uploadDir, partName := s3a.copyPartLocation(bucket, "uploadid", 1)
-	partPath := uploadDir + "/" + partName
-	if got := f.DetectBucket(util.FullPath(partPath)); got != bucket {
-		t.Fatalf("UploadPartCopy dst path %q resolved to collection %q, want %q", partPath, got, bucket)
-	}
-
-	// CopyObject (including the SSE-C paths) assigns against the destination
-	// object path.
+	// CopyObject (including the SSE-C paths) and UploadPartCopy both assign
+	// against the destination object path.
 	objPath := fmt.Sprintf("%s/%s", s3a.bucketDir(bucket), "blobs/data")
 	if got := f.DetectBucket(util.FullPath(objPath)); got != bucket {
 		t.Fatalf("CopyObject dst path %q resolved to collection %q, want %q", objPath, got, bucket)
 	}
+
+	// The part entry itself still lives under .uploads, which maps to the same
+	// collection, so the entry write is unaffected either way.
+	uploadDir, partName := s3a.copyPartLocation(bucket, "uploadid", 1)
+	partPath := uploadDir + "/" + partName
+	if got := f.DetectBucket(util.FullPath(partPath)); got != bucket {
+		t.Fatalf("UploadPartCopy part path %q resolved to collection %q, want %q", partPath, got, bucket)
+	}
+}
+
+// TestMultipartStorageRuleFollowsDestinationObject guards the filer.conf storage
+// rule a multipart part's chunks are placed by.
+//
+// Parts stage under /buckets/<bucket>/.uploads/..., so a rule scoped to a key
+// prefix ("place /buckets/b/data/ on a 30d TTL volume") matches the object but
+// not the part. Assigning against the part path therefore scattered a large
+// object's bytes onto TTL-less volumes while its entry carried the rule's TTL.
+// The gateway assigns against the destination object instead, the way the
+// x-seaweedfs-destination header made the filer resolve it before the S3 write
+// path moved off the filer proxy.
+func TestMultipartStorageRuleFollowsDestinationObject(t *testing.T) {
+	const bucket, object = "b", "/data/big.bin"
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+	fc := filer.NewFilerConf()
+	fc.AddLocationConf(&filer_pb.FilerConf_PathConf{LocationPrefix: "/buckets/b/data/", Ttl: "30d"})
+
+	partPath := s3a.genPartUploadPath(bucket, "uploadid", 1)
+	if got := fc.MatchStorageRule(partPath).GetTtl(); got != "" {
+		t.Fatalf("part path %q matched ttl %q; the test no longer reproduces the gap", partPath, got)
+	}
+
+	// What PutObjectPart and UploadPartCopy now assign against.
+	dstPath := s3a.toFilerPath(bucket, object)
+	if got := fc.MatchStorageRule(dstPath).GetTtl(); got != "30d" {
+		t.Fatalf("destination path %q resolved ttl %q, want 30d", dstPath, got)
+	}
 }
diff --git a/weed/s3api/s3api_object_handlers_copy_default_encryption_test.go b/weed/s3api/s3api_object_handlers_copy_default_encryption_test.go
new file mode 100644
index 0000000000..821a3dfc14
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_copy_default_encryption_test.go
@@ -0,0 +1,105 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+// Multi-chunk copy paths read SSE settings from request headers only, so the
+// destination bucket default must be synthesized into headers to reach them.
+func TestApplyCopyBucketDefaultEncryptionHeaders(t *testing.T) {
+	tests := []struct {
+		name       string
+		cfg        *s3_pb.EncryptionConfiguration
+		wantSse    string
+		wantKmsKey string
+		wantBktKey string
+	}{
+		{name: "nil config", cfg: nil},
+		{
+			name: "kms with key and bucket key",
+			cfg: &s3_pb.EncryptionConfiguration{
+				SseAlgorithm:     "aws:kms",
+				KmsKeyId:         "arn:aws:kms:us-east-1:123:key/abc",
+				BucketKeyEnabled: true,
+			},
+			wantSse:    "aws:kms",
+			wantKmsKey: "arn:aws:kms:us-east-1:123:key/abc",
+			wantBktKey: "true",
+		},
+		{
+			name: "kms without key resolves the aws/s3 default",
+			cfg: &s3_pb.EncryptionConfiguration{
+				SseAlgorithm: "aws:kms",
+			},
+			wantSse:    "aws:kms",
+			wantKmsKey: "alias/aws/s3",
+		},
+		{
+			name:    "aes256",
+			cfg:     &s3_pb.EncryptionConfiguration{SseAlgorithm: "AES256"},
+			wantSse: "AES256",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r, _ := http.NewRequest("PUT", "/dst", nil)
+			applyCopyBucketDefaultEncryptionHeaders(r, tt.cfg)
+			if got := r.Header.Get(s3_constants.AmzServerSideEncryption); got != tt.wantSse {
+				t.Fatalf("SSE header = %q, want %q", got, tt.wantSse)
+			}
+			if got := r.Header.Get(s3_constants.AmzServerSideEncryptionAwsKmsKeyId); got != tt.wantKmsKey {
+				t.Fatalf("KMS key header = %q, want %q", got, tt.wantKmsKey)
+			}
+			if got := r.Header.Get(s3_constants.AmzServerSideEncryptionBucketKeyEnabled); got != tt.wantBktKey {
+				t.Fatalf("bucket-key header = %q, want %q", got, tt.wantBktKey)
+			}
+		})
+	}
+}
+
+// The client's encryption headers must validate before bucket defaults are
+// synthesized: a KMS option without aws:kms, or a repeated header, would
+// otherwise be laundered into an accepted request by the default headers.
+func TestCopyObjectHandlerRejectsMalformedEncryptionBeforeDefaults(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		headers map[string][]string
+	}{
+		{
+			name: "kms key id without algorithm",
+			headers: map[string][]string{
+				s3_constants.AmzServerSideEncryptionAwsKmsKeyId: {"arn:aws:kms:us-east-1:123:key/abc"},
+			},
+		},
+		{
+			name: "repeated algorithm header",
+			headers: map[string][]string{
+				s3_constants.AmzServerSideEncryption: {"AES256", "aws:kms"},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			s3a := newHeadBucketTestServer(t, &fakeLookupFiler{})
+			r, _ := http.NewRequest(http.MethodPut, "/dst-b/o", nil)
+			r = mux.SetURLVars(r, map[string]string{"bucket": "dst-b", "object": "o"})
+			r.Header.Set("X-Amz-Copy-Source", "/src-b/k")
+			for name, values := range tt.headers {
+				for _, v := range values {
+					r.Header.Add(name, v)
+				}
+			}
+			w := httptest.NewRecorder()
+			s3a.CopyObjectHandler(w, r)
+			if w.Code != http.StatusBadRequest {
+				t.Fatalf("status = %d, want 400; body: %s", w.Code, w.Body.String())
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_copy_etag_test.go b/weed/s3api/s3api_object_handlers_copy_etag_test.go
index 11036cd3eb..a6ec92bfac 100644
--- a/weed/s3api/s3api_object_handlers_copy_etag_test.go
+++ b/weed/s3api/s3api_object_handlers_copy_etag_test.go
@@ -1,13 +1,21 @@
 package s3api
 
 import (
+	"bytes"
+	"crypto/md5"
+	"encoding/base64"
+	"fmt"
+	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
+	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 )
 
 func TestCopyEntryETagPrefersStoredExtendedETag(t *testing.T) {
@@ -63,3 +71,430 @@ func newCopyETagTestEntry(t *testing.T, storedETag, computedETag string) *filer_
 	}
 	return entry
 }
+
+func TestQuoteETag(t *testing.T) {
+	testCases := []struct {
+		etag string
+		want string
+	}{
+		{etag: "b1946ac92492d2347c6235b4d2611184", want: `"b1946ac92492d2347c6235b4d2611184"`},
+		{etag: `"b1946ac92492d2347c6235b4d2611184"`, want: `"b1946ac92492d2347c6235b4d2611184"`},
+		{etag: "", want: ""},
+	}
+	for _, tc := range testCases {
+		if got := quoteETag(tc.etag); got != tc.want {
+			t.Errorf("quoteETag(%q) = %q, want %q", tc.etag, got, tc.want)
+		}
+	}
+}
+
+func TestBuildCopyPartResultQuotesETag(t *testing.T) {
+	result := buildCopyPartResult("b1946ac92492d2347c6235b4d2611184", time.Now(), SSEResponseMetadata{})
+	if result.ETag != `"b1946ac92492d2347c6235b4d2611184"` {
+		t.Fatalf("buildCopyPartResult().ETag = %q, want quoted", result.ETag)
+	}
+	if encoded := string(s3err.EncodeXMLResponse(result)); !strings.Contains(encoded, `<ETag>&#34;b1946ac92492d2347c6235b4d2611184&#34;</ETag>`) {
+		t.Fatalf("response %q does not contain a quoted ETag", encoded)
+	}
+}
+
+func TestCopyObjectResultXMLQuotesETag(t *testing.T) {
+	encoded := string(s3err.EncodeXMLResponse(CopyObjectResult{
+		ETag:         quoteETag("b1946ac92492d2347c6235b4d2611184"),
+		LastModified: time.Now(),
+	}))
+	if !strings.Contains(encoded, `<ETag>&#34;b1946ac92492d2347c6235b4d2611184&#34;</ETag>`) {
+		t.Fatalf("response %q does not contain a quoted ETag", encoded)
+	}
+}
+
+// A part copy has no way to report a short part, so an unsatisfiable
+// x-amz-copy-source-range has to be rejected rather than clamped like a GET —
+// the re-encrypting path would otherwise pad the part out with zeros.
+func TestParseRangeHeaderRejectsUnsatisfiableRange(t *testing.T) {
+	const fileSize = 2048
+
+	testCases := []struct {
+		name       string
+		header     string
+		wantStart  int64
+		wantEnd    int64
+		wantReject bool
+	}{
+		{name: "whole source", header: "bytes=0-2047", wantEnd: 2047},
+		{name: "leading slice", header: "bytes=0-1023", wantEnd: 1023},
+		{name: "trailing slice", header: "bytes=1024-2047", wantStart: 1024, wantEnd: 2047},
+		{name: "single byte", header: "bytes=7-7", wantStart: 7, wantEnd: 7},
+		{name: "no bytes prefix", header: "0-1023", wantEnd: 1023},
+		{name: "end past the source", header: "bytes=0-2048", wantReject: true},
+		{name: "start past the source", header: "bytes=4096-8191", wantReject: true},
+		{name: "start at the source size", header: "bytes=2048-2048", wantReject: true},
+		{name: "reversed", header: "bytes=1023-0", wantReject: true},
+		{name: "negative start", header: "bytes=-1-1023", wantReject: true},
+		{name: "malformed", header: "bytes=abc", wantReject: true},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			start, end, err := parseRangeHeader(tc.header, fileSize)
+			if tc.wantReject {
+				if err == nil {
+					t.Fatalf("parseRangeHeader(%q) = %d, %d, want an error", tc.header, start, end)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("parseRangeHeader(%q): %v", tc.header, err)
+			}
+			if start != tc.wantStart || end != tc.wantEnd {
+				t.Errorf("parseRangeHeader(%q) = %d, %d, want %d, %d", tc.header, start, end, tc.wantStart, tc.wantEnd)
+			}
+		})
+	}
+}
+
+// A part copied with x-amz-copy-source-range must report the MD5 of the copied
+// bytes: per destination chunk for a partial-chunk copy, and the whole-part MD5
+// the part entry's Attributes.Md5 carries for CopyPartResult / ListParts /
+// complete's composite ETag.
+func TestCopyChunksForRangeCopiedETags(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	util_http.InitGlobalHttpClient()
+
+	const chunkSize = 4 << 20
+	payload := make([]byte, 2*chunkSize)
+	for i := range payload {
+		payload[i] = byte(i*31 + 7)
+	}
+	b64md5 := func(data []byte) string {
+		sum := md5.Sum(data)
+		return base64.StdEncoding.EncodeToString(sum[:])
+	}
+	fid0 := fmt.Sprintf("3,%016x%08x", 101, 202)
+	fid1 := fmt.Sprintf("3,%016x%08x", 103, 204)
+	volume.stored[fid0] = payload[:chunkSize]
+	volume.stored[fid1] = payload[chunkSize:]
+	entry := &filer_pb.Entry{
+		Name: "src",
+		Attributes: &filer_pb.FuseAttributes{
+			FileSize: uint64(len(payload)),
+		},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: fid0, Offset: 0, Size: chunkSize, ETag: b64md5(payload[:chunkSize])},
+			{FileId: fid1, Offset: chunkSize, Size: chunkSize, ETag: b64md5(payload[chunkSize:])},
+		},
+	}
+
+	// A range spanning the first chunk fully plus 1 MiB of the second.
+	multiEnd := int64(chunkSize + 1<<20 - 1)
+	dstChunks, partMd5, err := s3a.copyChunksForRange(entry, 0, multiEnd, "/dst")
+	if err != nil {
+		t.Fatalf("copyChunksForRange: %v", err)
+	}
+	if len(dstChunks) != 2 {
+		t.Fatalf("copyChunksForRange returned %d chunks, want 2", len(dstChunks))
+	}
+	// A whole-chunk copy forwards the stored bytes, so the source ETag stays valid.
+	if got, want := dstChunks[0].ETag, entry.Chunks[0].ETag; got != want {
+		t.Errorf("whole-chunk copy ETag = %q, want source chunk ETag %q", got, want)
+	}
+	// A partial copy stores only the range bytes; its ETag must be their MD5.
+	if got, want := dstChunks[1].ETag, b64md5(payload[chunkSize:multiEnd+1]); got != want {
+		t.Errorf("partial-chunk copy ETag = %q, want copied-bytes MD5 %q", got, want)
+	}
+	// The copied bytes landed on the destination volume (inside the multipart framing).
+	if stored := volume.stored[dstChunks[1].GetFileIdString()]; !bytes.Contains(stored, payload[chunkSize:multiEnd+1]) {
+		t.Error("destination volume does not hold the copied range bytes")
+	}
+	// The whole-part MD5 hashes every copied byte once, in range order.
+	wantPartMd5 := md5.Sum(payload[:multiEnd+1])
+	if !bytes.Equal(partMd5, wantPartMd5[:]) {
+		t.Errorf("part Md5 = %x, want %x", partMd5, wantPartMd5)
+	}
+	partEntry := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{Md5: partMd5},
+		Chunks:     dstChunks,
+	}
+	if got, want := copyEntryETag(partEntry), fmt.Sprintf("%x", wantPartMd5); got != want {
+		t.Errorf("copyEntryETag = %q, want %q", got, want)
+	}
+
+	// A range inside one chunk: the part's ETag is the MD5 of those bytes.
+	innerChunks, innerMd5, err := s3a.copyChunksForRange(entry, 100, 199, "/dst")
+	if err != nil {
+		t.Fatalf("copyChunksForRange inner range: %v", err)
+	}
+	if len(innerChunks) != 1 {
+		t.Fatalf("inner range returned %d chunks, want 1", len(innerChunks))
+	}
+	if got, want := innerChunks[0].ETag, b64md5(payload[100:200]); got != want {
+		t.Errorf("inner-range chunk ETag = %q, want copied-bytes MD5 %q", got, want)
+	}
+	wantInnerMd5 := md5.Sum(payload[100:200])
+	if !bytes.Equal(innerMd5, wantInnerMd5[:]) {
+		t.Errorf("inner-range part Md5 = %x, want %x", innerMd5, wantInnerMd5)
+	}
+}
+
+// A range over a sparse source zero-fills the gaps, so the part MD5 has to
+// hash the logical range — not just the one chunk that overlaps it.
+func TestCopyChunksForRangeSparseETags(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	util_http.InitGlobalHttpClient()
+
+	fid := fmt.Sprintf("3,%016x%08x", 105, 206)
+	volume.stored[fid] = []byte("abc")
+	sum := md5.Sum([]byte("abc"))
+	entry := &filer_pb.Entry{
+		Name: "sparse",
+		Attributes: &filer_pb.FuseAttributes{
+			FileSize: 6,
+		},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: fid, Offset: 3, Size: 3, ETag: base64.StdEncoding.EncodeToString(sum[:])},
+		},
+	}
+
+	// bytes 0-5 read as "\x00\x00\x00abc"; the part MD5 must cover the zeros too.
+	dstChunks, partMd5, err := s3a.copyChunksForRange(entry, 0, 5, "/dst")
+	if err != nil {
+		t.Fatalf("copyChunksForRange sparse: %v", err)
+	}
+	if len(dstChunks) != 1 || dstChunks[0].Offset != 3 {
+		t.Fatalf("sparse copy chunks = %+v, want one chunk at offset 3", dstChunks)
+	}
+	wantMd5 := md5.Sum([]byte("\x00\x00\x00abc"))
+	if !bytes.Equal(partMd5, wantMd5[:]) {
+		t.Errorf("sparse part Md5 = %x, want %x (zero-filled range)", partMd5, wantMd5)
+	}
+
+	// A range over a pure hole copies nothing but still reads as zeros.
+	holeChunks, holeMd5, err := s3a.copyChunksForRange(entry, 0, 2, "/dst")
+	if err != nil {
+		t.Fatalf("copyChunksForRange hole: %v", err)
+	}
+	if len(holeChunks) != 0 {
+		t.Fatalf("hole copy returned %d chunks, want 0", len(holeChunks))
+	}
+	wantHoleMd5 := md5.Sum([]byte{0, 0, 0})
+	if !bytes.Equal(holeMd5, wantHoleMd5[:]) {
+		t.Errorf("hole part Md5 = %x, want %x (all zeros)", holeMd5, wantHoleMd5)
+	}
+}
+
+// Destination chunks must resolve overlaps the way the source did: reads
+// pick winners by ModifiedTsNs, so the copied chunks keep the source's
+// precedence even though they were uploaded concurrently.
+func TestCopyChunksForRangePreservesSourcePrecedence(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	util_http.InitGlobalHttpClient()
+
+	etagOf := func(b []byte) string {
+		sum := md5.Sum(b)
+		return base64.StdEncoding.EncodeToString(sum[:])
+	}
+	fidA := fmt.Sprintf("3,%016x%08x", 107, 208)
+	fidB := fmt.Sprintf("3,%016x%08x", 109, 210)
+	volume.stored[fidA] = []byte("aaaa")
+	volume.stored[fidB] = []byte("bbbb")
+
+	// A covers [0,4), B covers [2,6); B's range is copied into a chunk that
+	// overlaps A's copy on [2,4), and the source says A wins there.
+	entry := &filer_pb.Entry{
+		Name:       "overlap",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 6},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: fidA, Offset: 0, Size: 4, ModifiedTsNs: 20, ETag: etagOf([]byte("aaaa"))},
+			{FileId: fidB, Offset: 2, Size: 4, ModifiedTsNs: 10, ETag: etagOf([]byte("bbbb"))},
+		},
+	}
+	dstChunks, partMd5, err := s3a.copyChunksForRange(entry, 0, 5, "/dst")
+	if err != nil {
+		t.Fatalf("copyChunksForRange overlap: %v", err)
+	}
+	if len(dstChunks) != 2 {
+		t.Fatalf("overlap copy returned %d chunks, want 2", len(dstChunks))
+	}
+	if dstChunks[0].ModifiedTsNs <= dstChunks[1].ModifiedTsNs {
+		t.Errorf("destination precedence inverted: chunk from ts=20 got %d, chunk from ts=10 got %d",
+			dstChunks[0].ModifiedTsNs, dstChunks[1].ModifiedTsNs)
+	}
+	// The source resolves to "aaaa"+"bb"; the part MD5 must match that view.
+	wantMd5 := md5.Sum([]byte("aaaabb"))
+	if !bytes.Equal(partMd5, wantMd5[:]) {
+		t.Errorf("overlap part Md5 = %x, want %x", partMd5, wantMd5)
+	}
+}
+
+// An inline-Content source has no chunks for the raw-byte copy; the plaintext
+// stream path must write the range's real bytes and tag the part with their
+// MD5, not a zero-fill digest.
+func TestCopyObjectPartInlineContent(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, apply: true, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	util_http.InitGlobalHttpClient()
+
+	content := []byte("inline-content")
+	entry := &filer_pb.Entry{
+		Name:       "src",
+		Attributes: &filer_pb.FuseAttributes{FileSize: uint64(len(content))},
+		Content:    content,
+	}
+	r := httptest.NewRequest(http.MethodPut, "/b/dst?partNumber=1&uploadId=u1", nil)
+	etag, _, code := s3a.copyObjectPartViaReencryption(r, entry, 2, 5, "b", "dst", "u1", 1, &filer_pb.Entry{})
+	if code != s3err.ErrNone {
+		t.Fatalf("copyObjectPartViaReencryption: %v", code)
+	}
+	wantMd5 := md5.Sum(content[2:6])
+	if got := strings.Trim(etag, `"`); got != fmt.Sprintf("%x", wantMd5) {
+		t.Errorf("etag = %q, want %x", got, wantMd5)
+	}
+	var partEntry *filer_pb.Entry
+	for key, e := range filerImpl.entries {
+		if strings.Contains(key, "u1") {
+			partEntry = e
+		}
+	}
+	if partEntry == nil || len(partEntry.Chunks) == 0 {
+		t.Fatalf("no part entry with chunks stored: %+v", filerImpl.entries)
+	}
+	found := false
+	for _, stored := range volume.stored {
+		if bytes.Contains(stored, content[2:6]) {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("destination volume does not hold the copied content bytes")
+	}
+}
+
+// The handler must route an inline-Content source away from the raw chunk
+// copy — CopyObjectPartHandler has to send it through the plaintext stream
+// path or the part lands as zeros.
+func TestCopyObjectPartHandlerInlineContent(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, apply: true, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	util_http.InitGlobalHttpClient()
+
+	content := []byte("inline-content")
+	uploadID := s3a.generateUploadID("dst")
+	filerImpl.entries["/buckets/b"] = &filer_pb.Entry{Name: "b", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+	filerImpl.entries["/buckets/b/src"] = &filer_pb.Entry{
+		Name:       "src",
+		Attributes: &filer_pb.FuseAttributes{FileSize: uint64(len(content))},
+		Content:    content,
+	}
+	filerImpl.entries["/buckets/b/.uploads/"+uploadID] = &filer_pb.Entry{
+		Name:        uploadID,
+		IsDirectory: true,
+		Extended:    map[string][]byte{s3_constants.ExtMultipartObjectKey: []byte("dst")},
+	}
+
+	r := httptest.NewRequest(http.MethodPut, "/b/dst?partNumber=1&uploadId="+uploadID, nil)
+	r = mux.SetURLVars(r, map[string]string{"bucket": "b", "object": "dst"})
+	r.Header.Set("X-Amz-Copy-Source", "/b/src")
+	r.Header.Set("x-amz-copy-source-range", "bytes=2-5")
+	w := httptest.NewRecorder()
+	s3a.CopyObjectPartHandler(w, r)
+	if w.Code != http.StatusOK {
+		t.Fatalf("CopyObjectPartHandler = %d %s, want 200", w.Code, w.Body.String())
+	}
+	wantMd5 := fmt.Sprintf("%x", md5.Sum(content[2:6]))
+	if !strings.Contains(w.Body.String(), wantMd5) {
+		t.Errorf("response %q does not contain copied-range ETag %q", w.Body.String(), wantMd5)
+	}
+	var partEntry *filer_pb.Entry
+	for key, e := range filerImpl.entries {
+		if strings.Contains(key, uploadID) && !e.IsDirectory {
+			partEntry = e
+		}
+	}
+	if partEntry == nil || len(partEntry.Chunks) == 0 {
+		t.Fatalf("no part entry with chunks stored: %+v", filerImpl.entries)
+	}
+	found := false
+	for _, stored := range volume.stored {
+		if bytes.Contains(stored, content[2:6]) {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("destination volume does not hold the copied content bytes")
+	}
+}
+
+// An empty part must carry the empty-body MD5 on the stored entry too, so
+// ListParts and complete's composite ETag see the same digest CopyPartResult
+// reported.
+func TestWriteEmptyCopyPartStoresMd5(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, apply: true, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	util_http.InitGlobalHttpClient()
+
+	etag, code := s3a.writeEmptyCopyPart("b", "u1", 3)
+	if code != s3err.ErrNone {
+		t.Fatalf("writeEmptyCopyPart: %v", code)
+	}
+	const emptyMD5Hex = "d41d8cd98f00b204e9800998ecf8427e"
+	if etag != emptyMD5Hex {
+		t.Fatalf("writeEmptyCopyPart etag = %q, want %q", etag, emptyMD5Hex)
+	}
+	var partEntry *filer_pb.Entry
+	for key, e := range filerImpl.entries {
+		if strings.Contains(key, "u1") {
+			partEntry = e
+		}
+	}
+	if partEntry == nil {
+		t.Fatalf("no part entry stored: %+v", filerImpl.entries)
+	}
+	if got := string(partEntry.Extended[s3_constants.ExtETagKey]); got != emptyMD5Hex {
+		t.Errorf("stored ExtETagKey = %q, want %q", got, emptyMD5Hex)
+	}
+	if got := fmt.Sprintf("%x", partEntry.Attributes.Md5); got != emptyMD5Hex {
+		t.Errorf("stored Attributes.Md5 = %q, want %q", got, emptyMD5Hex)
+	}
+}
+
+// A whole-range chunk copy normally reuses the source chunk's ETag as the
+// part MD5; TUS and mount writes leave chunks without one, so the part has
+// to hash the copied bytes instead of saving an empty digest.
+func TestCopyChunksForRangeMissingChunkETag(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	util_http.InitGlobalHttpClient()
+
+	fid := fmt.Sprintf("3,%016x%08x", 111, 212)
+	volume.stored[fid] = []byte("etagless")
+	entry := &filer_pb.Entry{
+		Name:       "src",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 8},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: fid, Offset: 0, Size: 8},
+		},
+	}
+
+	dstChunks, partMd5, err := s3a.copyChunksForRange(entry, 0, 7, "/dst")
+	if err != nil {
+		t.Fatalf("copyChunksForRange: %v", err)
+	}
+	if len(dstChunks) != 1 {
+		t.Fatalf("copyChunksForRange returned %d chunks, want 1", len(dstChunks))
+	}
+	wantMd5 := md5.Sum([]byte("etagless"))
+	if !bytes.Equal(partMd5, wantMd5[:]) {
+		t.Errorf("part Md5 = %x, want %x (hashed copied range)", partMd5, wantMd5)
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_copy_part_sse.go b/weed/s3api/s3api_object_handlers_copy_part_sse.go
index 163543212c..f8baa8782d 100644
--- a/weed/s3api/s3api_object_handlers_copy_part_sse.go
+++ b/weed/s3api/s3api_object_handlers_copy_part_sse.go
@@ -2,6 +2,7 @@ package s3api
 
 import (
 	"context"
+	"crypto/md5"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -14,6 +15,7 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
@@ -73,15 +75,17 @@ func uploadEntryHasChecksum(uploadEntry *filer_pb.Entry) bool {
 	return checksumAlgorithmFromHeaderName(headerName) != ChecksumAlgorithmNone
 }
 
-// sourceEntryHasSSE reports whether the source object's chunks are SSE
+// sourceEntryIsEncrypted reports whether the source object's chunks are
 // ciphertext on disk and therefore cannot be raw-copied — they must be
-// decrypted on read.
-func sourceEntryHasSSE(srcEntry *filer_pb.Entry) bool {
+// decrypted on read. That is SSE, and also -encryptVolumeData, whose per-chunk
+// key only ever decrypts a whole chunk and whose chunks carry no ETag for the
+// copied part to report.
+func sourceEntryIsEncrypted(srcEntry *filer_pb.Entry) bool {
 	if srcEntry == nil {
 		return false
 	}
 	for _, c := range srcEntry.GetChunks() {
-		if c.GetSseType() != filer_pb.SSEType_NONE {
+		if c.GetSseType() != filer_pb.SSEType_NONE || len(c.GetCipherKey()) > 0 {
 			return true
 		}
 	}
@@ -150,12 +154,13 @@ func (s3a *S3ApiServer) openSourcePlaintextReader(
 	case s3_constants.SSETypeC:
 		return nil, fmt.Errorf("%w: UploadPartCopy from SSE-C source", errCopySourceSSEUnsupported)
 	default:
-		// Unencrypted source: stream raw bytes and apply range.
-		raw, err := s3a.getEncryptedStreamFromVolumes(ctx, srcEntry)
+		// Plaintext or volume-encrypted source: the chunk stream seeks, so ask
+		// it for the range rather than reading and discarding the prefix.
+		raw, err := s3a.getEncryptedStreamFromVolumes(ctx, srcEntry, startOffset, sliceLen)
 		if err != nil {
-			return nil, fmt.Errorf("open unencrypted source: %w", err)
+			return nil, fmt.Errorf("open source: %w", err)
 		}
-		return applyRange(raw, startOffset, sliceLen)
+		return raw, nil
 	}
 }
 
@@ -221,7 +226,7 @@ func (s3a *S3ApiServer) openSSES3SourcePlaintextReader(
 	if err != nil {
 		return nil, fmt.Errorf("get SSE-S3 IV: %w", err)
 	}
-	encStream, err := s3a.getEncryptedStreamFromVolumes(ctx, srcEntry)
+	encStream, err := s3a.getEncryptedStreamFromVolumes(ctx, srcEntry, 0, int64(filer.FileSize(srcEntry)))
 	if err != nil {
 		return nil, fmt.Errorf("open ciphertext source: %w", err)
 	}
@@ -364,7 +369,7 @@ func (s3a *S3ApiServer) copyObjectPartViaReencryption(
 	r *http.Request,
 	srcEntry *filer_pb.Entry,
 	startOffset, endOffset int64,
-	dstBucket, uploadID string,
+	dstBucket, dstObject, uploadID string,
 	partID int,
 	uploadEntry *filer_pb.Entry,
 ) (etag string, sseMetadata SSEResponseMetadata, errCode s3err.ErrorCode) {
@@ -399,7 +404,7 @@ func (s3a *S3ApiServer) copyObjectPartViaReencryption(
 	applyDestChecksumHeaderToCopyRequest(cloned, uploadEntry)
 
 	filePath := s3a.genPartUploadPath(dstBucket, uploadID, partID)
-	tag, code, putSSE := s3a.putToFiler(cloned, filePath, srcReader, dstBucket, "", partID, 0, nil, false)
+	tag, code, putSSE := s3a.putToFiler(cloned, filePath, srcReader, dstBucket, "", partID, 0, nil, false, s3a.toFilerPath(dstBucket, dstObject))
 	if code != s3err.ErrNone {
 		return "", SSEResponseMetadata{}, code
 	}
@@ -411,18 +416,23 @@ func (s3a *S3ApiServer) copyObjectPartViaReencryption(
 func (s3a *S3ApiServer) writeEmptyCopyPart(dstBucket, uploadID string, partID int) (string, s3err.ErrorCode) {
 	uploadDir, partName := s3a.copyPartLocation(dstBucket, uploadID, partID)
 	if exists, _ := s3a.exists(uploadDir, partName, false); exists {
-		if err := s3a.rm(uploadDir, partName, false, false); err != nil {
+		if err := s3a.rm(context.Background(), uploadDir, partName, false, false); err != nil {
 			return "", s3err.ErrInternalError
 		}
 	}
+	const emptyMD5Hex = "d41d8cd98f00b204e9800998ecf8427e"
 	if err := s3a.mkFile(uploadDir, partName, nil, func(e *filer_pb.Entry) {
 		if e.Attributes == nil {
 			e.Attributes = &filer_pb.FuseAttributes{}
 		}
 		e.Attributes.FileSize = 0
+		e.Attributes.Md5 = md5.New().Sum(nil)
+		if e.Extended == nil {
+			e.Extended = map[string][]byte{}
+		}
+		e.Extended[s3_constants.ExtETagKey] = []byte(emptyMD5Hex)
 	}); err != nil {
 		return "", s3err.ErrInternalError
 	}
-	const emptyMD5Hex = "d41d8cd98f00b204e9800998ecf8427e"
 	return emptyMD5Hex, s3err.ErrNone
 }
diff --git a/weed/s3api/s3api_object_handlers_copy_storage_class_test.go b/weed/s3api/s3api_object_handlers_copy_storage_class_test.go
new file mode 100644
index 0000000000..e176fe5daa
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_copy_storage_class_test.go
@@ -0,0 +1,111 @@
+package s3api
+
+import (
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/protobuf/proto"
+)
+
+// AWS changes an object's storage class by copying the object onto itself
+// with the COPY directive and a new x-amz-storage-class. Only a self-copy that
+// changes nothing is rejected, and a bucket's default encryption is no change.
+// A self-copy that would also change the encryption stays rejected.
+func TestCopyObjectToItselfChangingStorageClass(t *testing.T) {
+	const bucket, object = "self-copy", "object"
+	kmsObject := map[string]string{
+		s3_constants.AmzServerSideEncryption:            s3_constants.SSEAlgorithmKMS,
+		s3_constants.AmzServerSideEncryptionAwsKmsKeyId: "key-a",
+		s3_constants.AmzServerSideEncryptionContext:     base64.StdEncoding.EncodeToString([]byte(`{"env":"old"}`)),
+	}
+	for _, tt := range []struct {
+		name              string
+		stored            map[string]string // extra object metadata
+		storageClass      string
+		headers           map[string]string // extra request headers
+		defaultEncryption bool
+		wantCode          int
+		wantErr           string
+	}{
+		{name: "no change", wantCode: http.StatusBadRequest, wantErr: "InvalidRequest"},
+		{name: "no change under default encryption", defaultEncryption: true, wantCode: http.StatusBadRequest, wantErr: "InvalidRequest"},
+		{name: "invalid storage class", storageClass: "NOT_A_CLASS", wantCode: http.StatusBadRequest, wantErr: "InvalidStorageClass"},
+		{name: "new storage class", storageClass: "STANDARD_IA", wantCode: http.StatusOK},
+		{name: "current storage class", stored: map[string]string{s3_constants.AmzStorageClass: "STANDARD_IA"},
+			storageClass: "STANDARD_IA", wantCode: http.StatusBadRequest, wantErr: "InvalidRequest"},
+		{name: "STANDARD without a stored class", storageClass: "STANDARD", wantCode: http.StatusBadRequest, wantErr: "InvalidRequest"},
+		{name: "encryption only", headers: map[string]string{s3_constants.AmzServerSideEncryption: "AES256"},
+			wantCode: http.StatusBadRequest, wantErr: "InvalidRequest"},
+		{name: "new storage class and SSE-KMS context", stored: kmsObject, storageClass: "STANDARD_IA", headers: map[string]string{
+			s3_constants.AmzServerSideEncryption:            s3_constants.SSEAlgorithmKMS,
+			s3_constants.AmzServerSideEncryptionAwsKmsKeyId: "key-a",
+			s3_constants.AmzServerSideEncryptionContext:     base64.StdEncoding.EncodeToString([]byte(`{"env":"new"}`)),
+		}, wantCode: http.StatusBadRequest, wantErr: "InvalidRequest"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			filer := &copyACLFiler{ambiguousPutFiler: &ambiguousPutFiler{apply: true, entries: map[string]*filer_pb.Entry{}}}
+			s3a := newPutTestServer(t, startFakeFiler(t, filer))
+			s3a.iam = &IdentityAccessManagement{}
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			config := &BucketConfig{Name: bucket, Ownership: s3_constants.OwnershipObjectWriter}
+			if tt.defaultEncryption {
+				config.Encryption = &s3_pb.EncryptionConfiguration{SseAlgorithm: s3_constants.SSEAlgorithmAES256}
+			}
+			s3a.bucketConfigCache.Set(bucket, config)
+			objectPath := "/buckets/" + bucket + "/" + object
+			original := &filer_pb.Entry{Name: object, Content: []byte("data"),
+				Attributes: &filer_pb.FuseAttributes{FileMode: defaultFileMode, FileSize: 4, Mime: "text/plain"},
+				Extended:   map[string][]byte{"X-Amz-Meta-Owner": []byte("kept")}}
+			for k, v := range tt.stored {
+				original.Extended[k] = []byte(v)
+			}
+			filer.entries[objectPath] = proto.Clone(original).(*filer_pb.Entry)
+
+			req := httptest.NewRequest(http.MethodPut, "/"+bucket+"/"+object, nil)
+			req = mux.SetURLVars(req, map[string]string{"bucket": bucket, "object": object})
+			req.Header.Set("X-Amz-Copy-Source", "/"+bucket+"/"+object)
+			req.Header.Set(s3_constants.AmzUserMetaDirective, DirectiveCopy)
+			if tt.storageClass != "" {
+				req.Header.Set(s3_constants.AmzStorageClass, tt.storageClass)
+			}
+			for k, v := range tt.headers {
+				req.Header.Set(k, v)
+			}
+			rr := httptest.NewRecorder()
+			s3a.CopyObjectHandler(rr, req)
+
+			if rr.Code != tt.wantCode {
+				t.Fatalf("status = %d, want %d; body: %s", rr.Code, tt.wantCode, rr.Body.String())
+			}
+			filer.mu.Lock()
+			defer filer.mu.Unlock()
+			stored := filer.entries[objectPath]
+			if tt.wantCode != http.StatusOK {
+				if !strings.Contains(rr.Body.String(), "<Code>"+tt.wantErr+"</Code>") {
+					t.Fatalf("body = %s, want %s", rr.Body.String(), tt.wantErr)
+				}
+				if !proto.Equal(stored, original) {
+					t.Fatalf("rejected copy changed the object: %v", stored)
+				}
+				return
+			}
+			if got := string(stored.Extended[s3_constants.AmzStorageClass]); got != tt.storageClass {
+				t.Fatalf("storage class = %q, want %q", got, tt.storageClass)
+			}
+			if got := string(stored.Extended["X-Amz-Meta-Owner"]); got != "kept" {
+				t.Fatalf("user metadata = %q, want it kept under the COPY directive", got)
+			}
+			if got := string(stored.Content); got != "data" {
+				t.Fatalf("content = %q, want %q", got, "data")
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_copy_stream.go b/weed/s3api/s3api_object_handlers_copy_stream.go
index acba56caff..910ec3aca5 100644
--- a/weed/s3api/s3api_object_handlers_copy_stream.go
+++ b/weed/s3api/s3api_object_handlers_copy_stream.go
@@ -73,12 +73,19 @@ func canStreamCopyChunk(chunk *filer_pb.FileChunk) bool {
 // Trusting a hint that disagrees with the wire bytes (e.g. caller says
 // "compressed" but the volume returned raw bytes for a partial range)
 // would label raw bytes as gzip and corrupt reads on the destination.
+//
+// digestWriter, when non-nil, receives the plaintext bytes as they are
+// forwarded so the caller can derive the destination chunk's ETag. It is
+// not fed when the wire bytes are gzip — only possible on the full-chunk
+// pass-through, whose logical content still matches the source chunk's
+// own ETag and needs no recomputation.
 func (s3a *S3ApiServer) streamCopyChunkRange(
 	ctx context.Context,
 	srcUrl, srcFileId string,
 	offset, size int64,
 	isFullChunk bool,
 	assignResult *filer_pb.AssignVolumeResponse,
+	digestWriter io.Writer,
 ) error {
 	// Range header takes int64, but mirror the int32 bound from
 	// downloadChunkData so the two paths reject the same inputs.
@@ -166,7 +173,11 @@ func (s3a *S3ApiServer) streamCopyChunkRange(
 			return
 		}
 
-		if _, err := io.Copy(fw, srcResp.Body); err != nil {
+		src := io.Reader(srcResp.Body)
+		if digestWriter != nil && !bodyIsGzipped {
+			src = io.TeeReader(srcResp.Body, digestWriter)
+		}
+		if _, err := io.Copy(fw, src); err != nil {
 			if shouldLogStreamError(err) {
 				glog.V(2).Infof("stream copy %s offset=%d size=%d: %v",
 					srcUrl, offset, size, err)
diff --git a/weed/s3api/s3api_object_handlers_copy_unified.go b/weed/s3api/s3api_object_handlers_copy_unified.go
index 613e748444..6f8d050da4 100644
--- a/weed/s3api/s3api_object_handlers_copy_unified.go
+++ b/weed/s3api/s3api_object_handlers_copy_unified.go
@@ -7,6 +7,8 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	weed_server "github.com/seaweedfs/seaweedfs/weed/server"
 )
@@ -185,3 +187,29 @@ func (s3a *S3ApiServer) applyCopyBucketDefaultEncryption(state *EncryptionState,
 		}
 	}
 }
+
+// applyCopyBucketDefaultEncryptionHeaders surfaces a bucket's default
+// encryption as request headers, so multi-chunk copy paths that only read
+// request headers honor it too.
+func applyCopyBucketDefaultEncryptionHeaders(r *http.Request, cfg *s3_pb.EncryptionConfiguration) {
+	if cfg == nil {
+		return
+	}
+	switch cfg.SseAlgorithm {
+	case EncryptionTypeKMS:
+		r.Header.Set(s3_constants.AmzServerSideEncryption, "aws:kms")
+		// aws:kms with no configured key resolves the AWS default, the same
+		// fallback applySSEKMSDefaultEncryption uses for uploads; an empty
+		// key ID here would let the copy paths take their plaintext branch.
+		keyID := cfg.KmsKeyId
+		if keyID == "" {
+			keyID = s3_constants.SSEKMSDefaultKeyID
+		}
+		r.Header.Set(s3_constants.AmzServerSideEncryptionAwsKmsKeyId, keyID)
+		if cfg.BucketKeyEnabled {
+			r.Header.Set(s3_constants.AmzServerSideEncryptionBucketKeyEnabled, "true")
+		}
+	case EncryptionTypeAES256:
+		r.Header.Set(s3_constants.AmzServerSideEncryption, "AES256")
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_delete.go b/weed/s3api/s3api_object_handlers_delete.go
index bd60d05ef4..caa0069624 100644
--- a/weed/s3api/s3api_object_handlers_delete.go
+++ b/weed/s3api/s3api_object_handlers_delete.go
@@ -1,6 +1,7 @@
 package s3api
 
 import (
+	"context"
 	"encoding/xml"
 	"errors"
 	"io"
@@ -78,7 +79,7 @@ func (s3a *S3ApiServer) resolveDeleteConditionalEntry(bucket, object, versionId,
 		}
 		return normalizeConditionalTargetEntry(entry), nil
 	default:
-		entry, err := s3a.resolveObjectEntry(bucket, normalizedObject)
+		entry, err := s3a.resolveObjectEntry(bucket, normalizedObject, "")
 		if err != nil {
 			return nil, err
 		}
@@ -126,7 +127,7 @@ func (s3a *S3ApiServer) deleteVersionedObject(r *http.Request, bucket, object, v
 	// in for without hiding the children underneath it. It is not a versioned object,
 	// so it is deleted the way an unversioned bucket deletes it.
 	if versionId == "" && strings.HasSuffix(object, "/") {
-		return result, s3a.deleteDirectoryMarker(bucket, object)
+		return result, s3a.deleteDirectoryMarker(r, bucket, object)
 	}
 
 	switch {
@@ -189,20 +190,27 @@ func (s3a *S3ApiServer) deleteVersionedObject(r *http.Request, bucket, object, v
 // relies on the volume's natural TTL to reclaim chunks; pass true only
 // when the entry's Attributes.TtlSec > 0 so the volume is guaranteed to
 // drop the chunks on its own.
-func (s3a *S3ApiServer) deleteUnversionedObjectWithClient(client filer_pb.SeaweedFilerClient, bucket, object string, metadataOnly bool) error {
+func (s3a *S3ApiServer) deleteUnversionedObjectWithClient(ctx context.Context, client filer_pb.SeaweedFilerClient, bucket, object string, metadataOnly bool) error {
 	if !s3_constants.IsValidBucketName(bucket) || !s3_constants.IsValidObjectKey(object) {
 		return errors.New("invalid bucket or object path")
 	}
 	target := util.NewFullPath(s3a.bucketDir(bucket), object)
 	dir, name := target.DirAndName()
-	return deleteObjectEntry(client, dir, name, !metadataOnly, false)
+	// The caller holds one client for a whole batch, so a dropped reply is
+	// replayed on that client rather than by re-entering WithFilerClient.
+	return retryFilerOp(ctx, "delete "+string(target), func() error {
+		return deleteObjectEntry(ctx, client, dir, name, !metadataOnly, false)
+	})
 }
 
 func (s3a *S3ApiServer) DeleteObjectHandler(w http.ResponseWriter, r *http.Request) {
 
 	bucket, object := s3_constants.GetBucketAndObject(r)
 	glog.Infof("DeleteObjectHandler %s %s", bucket, object)
-	if err := s3a.validateTableBucketObjectPath(bucket, object); err != nil {
+	// The filer ops below each retry, and a failover walk runs the whole set
+	// once per filer, so the backoff comes out of one allowance held here.
+	r = r.WithContext(withFilerRetryBudget(r.Context(), filerRetryRequestBudget))
+	if _, err := s3a.validateTableBucketObjectPathOrVerify(bucket, object); err != nil {
 		s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
 		return
 	}
@@ -224,6 +232,16 @@ func (s3a *S3ApiServer) DeleteObjectHandler(w http.ResponseWriter, r *http.Reque
 
 	versioningConfigured := (versioningState != "")
 
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
+	if errCode := s3a.recheckTagConditionedPolicyWithLookup(r, bucket, object, versionId, string(s3_constants.ACTION_WRITE), "DeleteObjectHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	var auditLog *s3err.AccessLog
 	if s3err.Logger != nil {
 		auditLog = s3err.GetAccessLog(r, http.StatusNoContent, s3err.ErrNone)
@@ -245,7 +263,7 @@ func (s3a *S3ApiServer) DeleteObjectHandler(w http.ResponseWriter, r *http.Reque
 		deleteCode, deleteHandled = s3a.withObjectWriteLock(bucket, object, func() s3err.ErrorCode {
 			return s3a.checkDeleteIfMatch(bucket, object, versionId, versioningState, r.Header.Get(s3_constants.IfMatch), s3err.ErrPreconditionFailed)
 		}, func() s3err.ErrorCode {
-			return s3a.deleteDirectoryMarker(bucket, object)
+			return s3a.deleteDirectoryMarker(r, bucket, object)
 		}), true
 	}
 
@@ -299,11 +317,10 @@ func (s3a *S3ApiServer) DeleteObjectHandler(w http.ResponseWriter, r *http.Reque
 					}
 				}
 				if versionId == "null" {
-					deleteCode = s3a.routedDeleteNullVersion(owner, bucket, object, worm, bypass)
+					deleteCode, deleteHandled = s3a.routedDeleteNullVersion(owner, bucket, object, worm, bypass)
 				} else {
-					deleteCode = s3a.routedDeleteSpecificVersion(owner, bucket, object, versionId, worm, bypass)
+					deleteCode, deleteHandled = s3a.routedDeleteSpecificVersion(owner, bucket, object, versionId, worm, bypass), true
 				}
-				deleteHandled = true
 			}
 		}
 	}
@@ -327,7 +344,7 @@ func (s3a *S3ApiServer) DeleteObjectHandler(w http.ResponseWriter, r *http.Reque
 			}
 
 			if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-				return s3a.deleteUnversionedObjectWithClient(client, bucket, object, false)
+				return s3a.deleteUnversionedObjectWithClient(r.Context(), client, bucket, object, false)
 			}); err != nil {
 				glog.Errorf("DeleteObjectHandler: failed to delete %s/%s: %v", bucket, object, err)
 				return s3err.ErrInternalError
@@ -414,7 +431,7 @@ func (s3a *S3ApiServer) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *h
 	}
 
 	if len(deleteObjects.Objects) > deleteMultipleObjectsLimit {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidMaxDeleteObjects)
+		s3err.WriteErrorResponse(w, r, s3err.ErrMalformedXML)
 		return
 	}
 
@@ -448,6 +465,10 @@ func (s3a *S3ApiServer) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *h
 		identity, _ = id.(*Identity)
 	}
 
+	// The keys below each drive their own bounded filer retries, and the client
+	// picks how many keys there are, so the whole batch shares one allowance.
+	r = r.WithContext(withFilerRetryBudget(r.Context(), filerRetryRequestBudget))
+
 	err = s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		// delete file entries
 		for _, object := range deleteObjects.Objects {
@@ -458,21 +479,44 @@ func (s3a *S3ApiServer) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *h
 				deleteErrors = append(deleteErrors, deleteErrorFromCode(validationCode, object.Key, object.VersionId))
 				continue
 			}
-			if err := s3a.validateTableBucketObjectPath(bucket, object.Key); err != nil {
+			key := s3_constants.NormalizeObjectKey(object.Key)
+			if key == "" {
+				// A key of only slashes can never name a stored entry; like a
+				// missing key the delete is an idempotent no-op, and a
+				// conditional delete has no target to match.
+				if object.ETag != "" {
+					deleteErrors = append(deleteErrors, deleteErrorFromCode(s3err.ErrNoSuchKey, object.Key, object.VersionId))
+					continue
+				}
+				deletedCount++
+				if !deleteObjects.Quiet {
+					deletedObjects = append(deletedObjects, ObjectIdentifier{Key: object.Key, VersionId: object.VersionId})
+				}
+				continue
+			}
+			if _, err := s3a.validateTableBucketObjectPathOrVerify(bucket, key); err != nil {
 				deleteErrors = append(deleteErrors, deleteErrorFromCode(s3err.ErrAccessDenied, object.Key, object.VersionId))
 				continue
 			}
-			if authErr := s3a.iam.AuthorizeObjectDelete(r, identity, bucket, object.Key, object.VersionId); authErr != s3err.ErrNone {
-				deleteErrors = append(deleteErrors, deleteErrorFromCode(authErr, object.Key, object.VersionId))
+			if authErr := s3a.iam.AuthorizeObjectDelete(r, identity, bucket, key, object.VersionId); authErr != s3err.ErrNone {
+				// Defer to the recheck, mirroring the copy-source fallback: a
+				// tag-conditioned Allow may still grant what phase one denied.
+				if authErr != s3err.ErrAccessDenied || s3a.recheckPolicyForKeyWithLookup(r, http.MethodDelete, bucket, key, object.VersionId, string(s3_constants.ACTION_WRITE), "DeleteMultipleObjectsHandler") != s3err.ErrNone {
+					deleteErrors = append(deleteErrors, deleteErrorFromCode(authErr, object.Key, object.VersionId))
+					continue
+				}
+			}
+			if errCode := s3a.recheckTagConditionedPolicyWithLookup(objectKeyPolicyRequest(r, http.MethodDelete, bucket, key, object.VersionId), bucket, key, object.VersionId, string(s3_constants.ACTION_WRITE), "DeleteMultipleObjectsHandler"); errCode != s3err.ErrNone {
+				deleteErrors = append(deleteErrors, deleteErrorFromCode(errCode, object.Key, object.VersionId))
 				continue
 			}
 
 			var deleteResult deleteMutationResult
-			deleteCode := s3a.withObjectWriteLock(bucket, object.Key, func() s3err.ErrorCode {
-				return s3a.checkDeleteIfMatch(bucket, object.Key, object.VersionId, versioningState, object.ETag, s3err.ErrNoSuchKey)
+			deleteCode := s3a.withObjectWriteLock(bucket, key, func() s3err.ErrorCode {
+				return s3a.checkDeleteIfMatch(bucket, key, object.VersionId, versioningState, object.ETag, s3err.ErrNoSuchKey)
 			}, func() s3err.ErrorCode {
 				if versioningConfigured {
-					result, errCode := s3a.deleteVersionedObject(r, bucket, object.Key, object.VersionId, versioningState)
+					result, errCode := s3a.deleteVersionedObject(r, bucket, key, object.VersionId, versioningState)
 					if errCode != s3err.ErrNone {
 						return errCode
 					}
@@ -480,18 +524,18 @@ func (s3a *S3ApiServer) DeleteMultipleObjectsHandler(w http.ResponseWriter, r *h
 					return s3err.ErrNone
 				}
 
-				governanceBypassAllowed := s3a.evaluateGovernanceBypassRequest(r, bucket, object.Key)
-				if err := s3a.enforceObjectLockProtections(r, bucket, object.Key, "", governanceBypassAllowed); err != nil {
-					glog.V(2).Infof("DeleteMultipleObjectsHandler: object lock check failed for %s/%s: %v", bucket, object.Key, err)
+				governanceBypassAllowed := s3a.evaluateGovernanceBypassRequest(r, bucket, key)
+				if err := s3a.enforceObjectLockProtections(r, bucket, key, "", governanceBypassAllowed); err != nil {
+					glog.V(2).Infof("DeleteMultipleObjectsHandler: object lock check failed for %s/%s: %v", bucket, key, err)
 					return s3err.ErrAccessDenied
 				}
 
-				if strings.HasSuffix(object.Key, "/") {
-					return s3a.deleteDirectoryMarker(bucket, object.Key)
+				if strings.HasSuffix(key, "/") {
+					return s3a.deleteDirectoryMarker(r, bucket, key)
 				}
 
-				if err := s3a.deleteUnversionedObjectWithClient(client, bucket, object.Key, false); err != nil {
-					glog.Errorf("DeleteMultipleObjectsHandler: failed to delete %s/%s: %v", bucket, object.Key, err)
+				if err := s3a.deleteUnversionedObjectWithClient(r.Context(), client, bucket, key, false); err != nil {
+					glog.Errorf("DeleteMultipleObjectsHandler: failed to delete %s/%s: %v", bucket, key, err)
 					return s3err.ErrInternalError
 				}
 
diff --git a/weed/s3api/s3api_object_handlers_delete_test.go b/weed/s3api/s3api_object_handlers_delete_test.go
index b2104e257f..dd680d6c0e 100644
--- a/weed/s3api/s3api_object_handlers_delete_test.go
+++ b/weed/s3api/s3api_object_handlers_delete_test.go
@@ -1,6 +1,7 @@
 package s3api
 
 import (
+	"context"
 	"errors"
 	"testing"
 
@@ -47,7 +48,7 @@ func TestDeleteUnversionedObjectWithClient_MetadataOnlySkipsChunkDelete(t *testi
 	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
 	client := &deleteObjectEntryTestClient{}
 
-	err := s3a.deleteUnversionedObjectWithClient(client, "b", "k", true)
+	err := s3a.deleteUnversionedObjectWithClient(context.Background(), client, "b", "k", true)
 	require.NoError(t, err)
 	require.NotNil(t, client.deleteReq)
 	assert.Equal(t, "/buckets/b", client.deleteReq.Directory)
@@ -61,7 +62,7 @@ func TestDeleteUnversionedObjectWithClient_FullDeletePreservesIsDeleteData(t *te
 	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
 	client := &deleteObjectEntryTestClient{}
 
-	err := s3a.deleteUnversionedObjectWithClient(client, "b", "k", false)
+	err := s3a.deleteUnversionedObjectWithClient(context.Background(), client, "b", "k", false)
 	require.NoError(t, err)
 	require.NotNil(t, client.deleteReq)
 	assert.True(t, client.deleteReq.IsDeleteData, "default delete must keep IsDeleteData true")
@@ -75,7 +76,7 @@ func TestDeleteUnversionedObjectWithClient_FullPathFromBucketsRoot(t *testing.T)
 	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
 	client := &deleteObjectEntryTestClient{}
 
-	err := s3a.deleteUnversionedObjectWithClient(client, "mybucket", "a/b/c.txt", false)
+	err := s3a.deleteUnversionedObjectWithClient(context.Background(), client, "mybucket", "a/b/c.txt", false)
 	require.NoError(t, err)
 	require.NotNil(t, client.deleteReq)
 	assert.Equal(t, "/buckets/mybucket/a/b", client.deleteReq.Directory)
@@ -86,7 +87,7 @@ func TestDeleteUnversionedObjectWithClientRejectsTraversal(t *testing.T) {
 	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
 	client := &deleteObjectEntryTestClient{}
 
-	err := s3a.deleteUnversionedObjectWithClient(client, "source-bucket", "../victim-bucket/secret", false)
+	err := s3a.deleteUnversionedObjectWithClient(context.Background(), client, "source-bucket", "../victim-bucket/secret", false)
 
 	require.Error(t, err)
 	assert.Nil(t, client.deleteReq, "invalid path must be rejected before a filer delete RPC")
@@ -102,7 +103,7 @@ func TestDeleteUnversionedObjectWithClient_PropagatesEntryAttributesIrrelevant(t
 		deleteResp: &filer_pb.DeleteEntryResponse{},
 	}
 
-	require.NoError(t, s3a.deleteUnversionedObjectWithClient(client, "b", "k", true))
+	require.NoError(t, s3a.deleteUnversionedObjectWithClient(context.Background(), client, "b", "k", true))
 	require.NotNil(t, client.deleteReq)
 	assert.False(t, client.deleteReq.IsDeleteData)
 }
diff --git a/weed/s3api/s3api_object_handlers_dir_test.go b/weed/s3api/s3api_object_handlers_dir_test.go
index ff7057094c..4dd15f33ba 100644
--- a/weed/s3api/s3api_object_handlers_dir_test.go
+++ b/weed/s3api/s3api_object_handlers_dir_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 )
 
 func TestServeDirectoryContentContentType(t *testing.T) {
@@ -37,7 +38,7 @@ func TestServeDirectoryContentContentType(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			req := httptest.NewRequest(http.MethodHead, "/bucket/dir/", nil)
 			rec := httptest.NewRecorder()
-			s3a.serveDirectoryContent(rec, req, tt.entry)
+			s3a.serveDirectoryContent(rec, req, tt.entry, "bucket", "dir/")
 			if rec.Code != http.StatusOK {
 				t.Fatalf("status = %d, want 200", rec.Code)
 			}
@@ -47,3 +48,31 @@ func TestServeDirectoryContentContentType(t *testing.T) {
 		})
 	}
 }
+
+func TestIsBareDirectory(t *testing.T) {
+	tests := []struct {
+		name  string
+		entry *filer_pb.Entry
+		want  bool
+	}{
+		{"nothing there", nil, false},
+		{"file", &filer_pb.Entry{Attributes: &filer_pb.FuseAttributes{}}, false},
+		{"directory a listing stands for", &filer_pb.Entry{IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}, true},
+		{"promoted file with data", &filer_pb.Entry{IsDirectory: true, Content: []byte("data"), Attributes: &filer_pb.FuseAttributes{FileSize: 4}}, false},
+		{
+			// The key is real even at zero bytes, so it answers rather than 404s.
+			name: "empty prefix object",
+			entry: &filer_pb.Entry{IsDirectory: true, Attributes: &filer_pb.FuseAttributes{},
+				Extended: map[string][]byte{s3_constants.SeaweedFSPrefixObject: []byte("true")}},
+			want: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isBareDirectory(tt.entry); got != tt.want {
+				t.Errorf("isBareDirectory() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_extract.go b/weed/s3api/s3api_object_handlers_extract.go
new file mode 100644
index 0000000000..1bdcb523d9
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_extract.go
@@ -0,0 +1,347 @@
+package s3api
+
+import (
+	"archive/zip"
+	"bytes"
+	"crypto/md5"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"hash"
+	"io"
+	"mime"
+	"net/http"
+	"path"
+	"strconv"
+	"strings"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+func isExtractZip(r *http.Request) bool {
+	if r.URL.Query().Get("extract") == "zip" ||
+		r.Header.Get(s3_constants.SeaweedFSExtract) == "zip" {
+		return true
+	}
+	// AWS Snowball auto-extract: header presence requests extraction.
+	if v := r.Header.Get(s3_constants.AmzMetaSnowballAutoExtract); v != "" && v != "false" {
+		return true
+	}
+	return false
+}
+
+func hasExplicitSseHeaders(r *http.Request) bool {
+	return r.Header.Get(s3_constants.AmzServerSideEncryption) != "" ||
+		r.Header.Get(s3_constants.AmzServerSideEncryptionAwsKmsKeyId) != "" ||
+		r.Header.Get(s3_constants.AmzServerSideEncryptionCustomerAlgorithm) != ""
+}
+
+type extractMemberResult struct {
+	Name string `json:"name"`
+	Size int64  `json:"size,omitempty"`
+	ETag string `json:"etag,omitempty"`
+}
+
+type extractZipResult struct {
+	Extracted []*extractMemberResult `json:"extracted"`
+	Errors    []string               `json:"errors,omitempty"`
+}
+
+// extractZipObject writes a PutObject zip body as one object per member under
+// the object's directory, like AWS Snowball's x-amz-meta-snowball-auto-extract.
+// The archive object itself is not stored.
+func (s3a *S3ApiServer) extractZipObject(w http.ResponseWriter, r *http.Request, bucket, object string, dataReader io.Reader) {
+	if hasExplicitSseHeaders(r) {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		return
+	}
+
+	versioningState, err := s3a.getVersioningState(bucket)
+	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			if !s3a.handleAutoCreateBucket(w, r, bucket, "PutObjectHandler") {
+				return
+			}
+			versioningState, err = s3a.getVersioningState(bucket)
+		}
+		if err != nil {
+			glog.Errorf("extractZipObject: versioning state for bucket %s: %v", bucket, err)
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			return
+		}
+	}
+	versioningConfigured := versioningState != ""
+
+	r, aclCode := s3a.preparePutObjectACL(r, bucket)
+	if aclCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, aclCode)
+		return
+	}
+
+	objectLockEnabled, lockErr := s3a.isObjectLockEnabled(bucket)
+	if lockErr != nil && !errors.Is(lockErr, filer_pb.ErrNotFound) {
+		glog.Errorf("extractZipObject: object lock state for bucket %s: %v", bucket, lockErr)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+	// Malformed or unauthorized lock headers fail the request outright, the
+	// same as a standalone PutObject; per-member permission re-checks happen in
+	// authorizeMember.
+	if vErr := s3a.validateObjectLockHeaders(r, bucket, object, objectLockEnabled); vErr != nil {
+		s3err.WriteErrorResponse(w, r, mapValidationErrorToS3Error(vErr))
+		return
+	}
+
+	// Checksums describing the archive body are verified while it spools, then
+	// scrubbed so members are validated against their own bytes instead.
+	requestQuery := parseRequestQuery(r)
+	archiveMd5 := r.Header.Get("Content-Md5")
+	var archiveMd5Hash hash.Hash
+	if archiveMd5 != "" {
+		archiveMd5Hash = md5.New()
+		dataReader = io.TeeReader(dataReader, archiveMd5Hash)
+	}
+	archiveChecksumAlgo, archiveChecksumHeader, checksumCode := detectRequestedChecksumAlgorithmQ(r, requestQuery)
+	if checksumCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, checksumCode)
+		return
+	}
+	var archiveChecksumHash hash.Hash
+	expectedArchiveChecksum := ""
+	if archiveChecksumAlgo != ChecksumAlgorithmNone {
+		if archiveChecksumHash = getCheckSumWriter(archiveChecksumAlgo); archiveChecksumHash != nil {
+			dataReader = io.TeeReader(dataReader, archiveChecksumHash)
+		}
+		expectedArchiveChecksum = lookupHeaderOrQuery(r, requestQuery, archiveChecksumHeader)
+	}
+	scrubArchiveChecksums(r)
+	// Content-Encoding describes the archive body on the wire; the members it
+	// fans out to are stored as-is.
+	r.Header.Del("Content-Encoding")
+
+	ra, size, cleanup, err := filer.SpoolZipReader(dataReader, 0)
+	if err != nil {
+		if errors.Is(err, filer.ErrZipTooLarge) {
+			s3err.WriteErrorResponse(w, r, s3err.ErrEntityTooLarge)
+		} else if strings.Contains(err.Error(), s3err.ErrMsgContentSha256Mismatch) {
+			s3err.WriteErrorResponse(w, r, s3err.ErrContentSHA256Mismatch)
+		} else {
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		}
+		return
+	}
+	defer cleanup()
+	if errCode := verifyArchiveChecksums(archiveMd5, archiveMd5Hash, expectedArchiveChecksum, archiveChecksumHash); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+	zr, err := zip.NewReader(ra, size)
+	if err != nil {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		return
+	}
+	if err = filer.CheckZipLimits(zr); err != nil {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		return
+	}
+
+	root := object
+	if !strings.HasSuffix(root, "/") {
+		root = path.Dir(root)
+	}
+	root = strings.TrimSuffix(root, "/")
+	if root == "." {
+		root = ""
+	}
+
+	identity, _ := s3_constants.GetIdentityFromContext(r).(*Identity)
+	result := &extractZipResult{}
+
+	join := func(rel string) string {
+		if root == "" {
+			return rel
+		}
+		return root + "/" + rel
+	}
+	// authorizeMember applies to a member key the same checks a standalone
+	// PutObject of that key would face: IAM, table layout, bucket policy,
+	// object-lock header permissions, and existing-entry protections.
+	authorizeMember := func(memberKey string) s3err.ErrorCode {
+		if code := s3a.iam.AuthorizeObjectWrite(r, identity, bucket, memberKey); code != s3err.ErrNone {
+			return code
+		}
+		if err := s3a.validateTableBucketObjectPath(bucket, memberKey); err != nil {
+			return s3err.ErrAccessDenied
+		}
+		if code, _ := s3a.checkPolicyWithEntry(r, bucket, memberKey, string(s3_constants.ACTION_WRITE), "", nil); code != s3err.ErrNone {
+			return code
+		}
+		// Lock headers validated for the request still need the dedicated
+		// permissions against the member's own key.
+		if r.Header.Get(s3_constants.AmzObjectLockMode) != "" || r.Header.Get(s3_constants.AmzObjectLockRetainUntilDate) != "" {
+			if !s3a.checkObjectLockHeaderPermission(r, bucket, memberKey, s3_constants.ACTION_PUT_OBJECT_RETENTION) {
+				return s3err.ErrAccessDenied
+			}
+		}
+		if r.Header.Get(s3_constants.AmzObjectLockLegalHold) != "" {
+			if !s3a.checkObjectLockHeaderPermission(r, bucket, memberKey, s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD) {
+				return s3err.ErrAccessDenied
+			}
+		}
+		if !versioningConfigured {
+			if lockErr := s3a.enforceObjectLockProtections(r, bucket, memberKey, "", s3a.evaluateGovernanceBypassRequest(r, bucket, memberKey)); lockErr != nil {
+				return s3err.ErrAccessDenied
+			}
+		}
+		return s3err.ErrNone
+	}
+	writeMember := func(rel string, memberReader io.Reader, memberSize int64) {
+		memberKey := join(rel)
+		if authCode := authorizeMember(memberKey); authCode != s3err.ErrNone {
+			result.Errors = append(result.Errors, memberKey+": "+s3err.GetAPIError(authCode).Code)
+			return
+		}
+		memberContentType := mime.TypeByExtension(path.Ext(memberKey))
+		if memberContentType == "" {
+			memberContentType = "application/octet-stream"
+		}
+		// Write helpers read the object from route vars, e.g. for the SSE-KMS
+		// encryption context ARN; point them at the member, not the archive.
+		memberReq := mux.SetURLVars(r, map[string]string{
+			"bucket": bucket,
+			"object": memberKey,
+		})
+		memberReq.Header.Set("Content-Type", memberContentType)
+		memberReq.ContentLength = memberSize
+		var etag string
+		var errCode s3err.ErrorCode
+		switch versioningState {
+		case s3_constants.VersioningEnabled:
+			_, etag, errCode, _ = s3a.putVersionedObject(memberReq, bucket, memberKey, memberReader, memberContentType)
+		case s3_constants.VersioningSuspended:
+			etag, errCode, _ = s3a.putSuspendedVersioningObject(memberReq, bucket, memberKey, memberReader, memberContentType)
+		default:
+			filePath := s3a.toFilerPath(bucket, memberKey)
+			lifecycleTTLSec := s3a.lifecycleTTLForObjectWrite(bucket, memberKey, memberSize)
+			etag, errCode, _ = s3a.putToFiler(memberReq, filePath, memberReader, bucket, memberKey, 1, lifecycleTTLSec, nil, false, "")
+		}
+		if errCode != s3err.ErrNone {
+			result.Errors = append(result.Errors, memberKey+": "+s3err.GetAPIError(errCode).Code)
+			return
+		}
+		result.Extracted = append(result.Extracted, &extractMemberResult{Name: memberKey, Size: memberSize, ETag: etag})
+	}
+	mkdirMember := func(memberKey string) {
+		if authCode := authorizeMember(memberKey); authCode != s3err.ErrNone {
+			result.Errors = append(result.Errors, memberKey+": "+s3err.GetAPIError(authCode).Code)
+			return
+		}
+		dirPath := s3a.toFilerPath(bucket, memberKey)
+		dirName, entryName := path.Dir(dirPath), path.Base(dirPath)
+		// mkdir replaces an existing marker outright, so a lock recorded on the
+		// entry itself is checked under the same lock the replacement takes,
+		// mirroring the explicit-directory branch of PutObjectHandler.
+		markerCode := s3a.withObjectWriteLock(bucket, memberKey, func() s3err.ErrorCode {
+			if !objectLockEnabled {
+				return s3err.ErrNone
+			}
+			existing, existErr := s3a.getEntry(dirName, entryName)
+			if existErr != nil {
+				return s3err.ErrNone
+			}
+			if lockErr := s3a.enforceObjectLockOnEntry(existing, bucket, memberKey, "", s3a.evaluateGovernanceBypassRequest(r, bucket, memberKey)); lockErr != nil {
+				return s3err.ErrAccessDenied
+			}
+			return s3err.ErrNone
+		}, func() s3err.ErrorCode {
+			mkErr := s3a.mkdir(dirName, entryName, func(entry *filer_pb.Entry) {
+				entry.Attributes.Mime = s3_constants.FolderMimeType
+				s3a.setObjectOwnerFromRequest(r, bucket, entry)
+				applyPutObjectACL(r, entry)
+				if lockErr := s3a.extractObjectLockMetadataFromRequest(r, entry); lockErr != nil {
+					glog.Errorf("extractZipObject: object lock metadata for %s/%s: %v", bucket, memberKey, lockErr)
+				}
+			})
+			return filerErrorToS3Error(mkErr)
+		})
+		if markerCode != s3err.ErrNone {
+			result.Errors = append(result.Errors, memberKey+": "+s3err.GetAPIError(markerCode).Code)
+		}
+	}
+
+	for _, zf := range zr.File {
+		if ctxErr := r.Context().Err(); ctxErr != nil {
+			result.Errors = append(result.Errors, ctxErr.Error())
+			break
+		}
+		rel, ok := filer.SanitizeZipMemberName(zf)
+		if !ok {
+			result.Errors = append(result.Errors, zf.Name+": unsafe member name")
+			continue
+		}
+		if zf.FileInfo().IsDir() {
+			mkdirMember(join(rel))
+			continue
+		}
+		memberReader, openErr := zf.Open()
+		if openErr != nil {
+			result.Errors = append(result.Errors, rel+": "+openErr.Error())
+			continue
+		}
+		writeMember(rel, memberReader, int64(zf.UncompressedSize64))
+		memberReader.Close()
+	}
+
+	w.Header().Set(s3_constants.SeaweedFSExtractedCount, strconv.Itoa(len(result.Extracted)))
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(result)
+}
+
+// verifyArchiveChecksums compares the archive's supplied Content-Md5 and
+// x-amz-checksum-* values against the bytes consumed while spooling. A nil
+// hash means the client supplied nothing to check.
+func verifyArchiveChecksums(expectedMd5 string, md5Hash hash.Hash, expectedChecksum string, checksumHash hash.Hash) s3err.ErrorCode {
+	if md5Hash != nil {
+		expected, err := base64.StdEncoding.DecodeString(expectedMd5)
+		if err != nil {
+			return s3err.ErrInvalidDigest
+		}
+		if sum := md5Hash.Sum(nil); !bytes.Equal(expected, sum) {
+			return s3err.ErrBadDigest
+		}
+	}
+	if checksumHash != nil && expectedChecksum != "" {
+		if sum := base64.StdEncoding.EncodeToString(checksumHash.Sum(nil)); expectedChecksum != sum {
+			return s3err.ErrBadDigest
+		}
+	}
+	return s3err.ErrNone
+}
+
+// scrubArchiveChecksums removes request checksums that describe the archive
+// body; members are validated against their own bytes.
+func scrubArchiveChecksums(r *http.Request) {
+	isChecksumHeader := func(k string) bool {
+		k = strings.ToLower(k)
+		return k == "content-md5" || k == "x-amz-trailer" || k == "x-amz-content-sha256" ||
+			strings.HasPrefix(k, "x-amz-checksum") || strings.HasPrefix(k, "x-amz-sdk-checksum")
+	}
+	for k := range r.Header {
+		if isChecksumHeader(k) {
+			delete(r.Header, k)
+		}
+	}
+	query := r.URL.Query()
+	for k := range query {
+		if isChecksumHeader(k) {
+			query.Del(k)
+		}
+	}
+	r.URL.RawQuery = query.Encode()
+}
diff --git a/weed/s3api/s3api_object_handlers_extract_test.go b/weed/s3api/s3api_object_handlers_extract_test.go
new file mode 100644
index 0000000000..f0e1a7f34f
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_extract_test.go
@@ -0,0 +1,193 @@
+package s3api
+
+import (
+	"archive/zip"
+	"bytes"
+	"crypto/md5"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+func makeZipArchive(t *testing.T, members map[string]string) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	for name, content := range members {
+		w, err := zw.Create(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := w.Write([]byte(content)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return buf.Bytes()
+}
+
+func newExtractTestServer(t *testing.T) (*S3ApiServer, *ambiguousPutFiler) {
+	t.Helper()
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, entries: map[string]*filer_pb.Entry{}, apply: true}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+	s3a.iam = NewIdentityAccessManagementWithStore(s3a.option, nil, "memory")
+	t.Cleanup(s3a.iam.Shutdown)
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set("b", &BucketConfig{Name: "b"})
+	return s3a, filerImpl
+}
+
+func TestIsExtractZip(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		setup func(r *http.Request)
+		want  bool
+	}{
+		{"none", func(r *http.Request) {}, false},
+		{"query", func(r *http.Request) {
+			q := r.URL.Query()
+			q.Set("extract", "zip")
+			r.URL.RawQuery = q.Encode()
+		}, true},
+		{"seaweed header", func(r *http.Request) {
+			r.Header.Set(s3_constants.SeaweedFSExtract, "zip")
+		}, true},
+		{"snowball header", func(r *http.Request) {
+			r.Header.Set(s3_constants.AmzMetaSnowballAutoExtract, "true")
+		}, true},
+		{"snowball false", func(r *http.Request) {
+			r.Header.Set(s3_constants.AmzMetaSnowballAutoExtract, "false")
+		}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodPut, "/b/o", nil)
+			tc.setup(r)
+			if got := isExtractZip(r); got != tc.want {
+				t.Fatalf("isExtractZip = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestExtractZipPutObject(t *testing.T) {
+	s3a, filerImpl := newExtractTestServer(t)
+
+	body := makeZipArchive(t, map[string]string{
+		"a.txt":     "hello",
+		"sub/b.txt": "world!",
+	})
+	r := httptest.NewRequest(http.MethodPut, "/b/dir/archive.zip", bytes.NewReader(body))
+	r.Header.Set(s3_constants.AmzMetaSnowballAutoExtract, "true")
+	rec := httptest.NewRecorder()
+	s3a.extractZipObject(rec, r, "b", "dir/archive.zip", r.Body)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rec.Code, rec.Body.String())
+	}
+	if got := rec.Header().Get(s3_constants.SeaweedFSExtractedCount); got != "2" {
+		t.Fatalf("extracted count = %q, want 2", got)
+	}
+	var result extractZipResult
+	if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
+		t.Fatal(err)
+	}
+	if len(result.Errors) != 0 {
+		t.Fatalf("unexpected member errors: %v", result.Errors)
+	}
+	for _, want := range []string{"/buckets/b/dir/a.txt", "/buckets/b/dir/sub/b.txt"} {
+		entry, ok := filerImpl.entries[want]
+		if !ok {
+			t.Fatalf("member %s was not created; entries: %v", want, filerImpl.entries)
+		}
+		if entry.IsDirectory {
+			t.Fatalf("member %s stored as directory", want)
+		}
+	}
+	if _, ok := filerImpl.entries["/buckets/b/dir/archive.zip"]; ok {
+		t.Fatal("archive object itself should not be stored")
+	}
+}
+
+func TestExtractZipPutObjectArchiveChecksum(t *testing.T) {
+	s3a, filerImpl := newExtractTestServer(t)
+
+	body := makeZipArchive(t, map[string]string{"a.txt": "hello"})
+	md5sum := md5.Sum(body)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/dir/archive.zip", bytes.NewReader(body))
+	r.Header.Set(s3_constants.SeaweedFSExtract, "zip")
+	r.Header.Set("Content-Md5", base64.StdEncoding.EncodeToString(md5sum[:]))
+	r.Header.Set(s3_constants.AmzChecksumSHA256, base64.StdEncoding.EncodeToString([]byte("not-the-sha256")))
+	rec := httptest.NewRecorder()
+	s3a.extractZipObject(rec, r, "b", "dir/archive.zip", r.Body)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if len(filerImpl.entries) != 0 {
+		t.Fatalf("entries created despite checksum mismatch: %v", filerImpl.entries)
+	}
+}
+
+func TestExtractZipPutObjectGoodArchiveMd5(t *testing.T) {
+	s3a, filerImpl := newExtractTestServer(t)
+
+	body := makeZipArchive(t, map[string]string{"a.txt": "hello"})
+	md5sum := md5.Sum(body)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/dir/archive.zip", bytes.NewReader(body))
+	r.Header.Set(s3_constants.SeaweedFSExtract, "zip")
+	r.Header.Set("Content-Md5", base64.StdEncoding.EncodeToString(md5sum[:]))
+	rec := httptest.NewRecorder()
+	s3a.extractZipObject(rec, r, "b", "dir/archive.zip", r.Body)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body: %s", rec.Code, rec.Body.String())
+	}
+	if _, ok := filerImpl.entries["/buckets/b/dir/a.txt"]; !ok {
+		t.Fatalf("member not created; entries: %v", filerImpl.entries)
+	}
+}
+
+func TestExtractZipPutObjectNotAZip(t *testing.T) {
+	s3a, filerImpl := newExtractTestServer(t)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/dir/archive.zip", bytes.NewReader([]byte("not a zip")))
+	r.Header.Set(s3_constants.SeaweedFSExtract, "zip")
+	rec := httptest.NewRecorder()
+	s3a.extractZipObject(rec, r, "b", "dir/archive.zip", r.Body)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if len(filerImpl.entries) != 0 {
+		t.Fatalf("entries created for invalid zip: %v", filerImpl.entries)
+	}
+}
+
+func TestExtractZipPutObjectRejectsExplicitSSE(t *testing.T) {
+	s3a, filerImpl := newExtractTestServer(t)
+
+	body := makeZipArchive(t, map[string]string{"a.txt": "hello"})
+	r := httptest.NewRequest(http.MethodPut, "/b/dir/archive.zip", bytes.NewReader(body))
+	r.Header.Set(s3_constants.SeaweedFSExtract, "zip")
+	r.Header.Set(s3_constants.AmzServerSideEncryption, "aws:kms")
+	rec := httptest.NewRecorder()
+	s3a.extractZipObject(rec, r, "b", "dir/archive.zip", r.Body)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", rec.Code)
+	}
+	if len(filerImpl.entries) != 0 {
+		t.Fatalf("entries created despite explicit SSE headers: %v", filerImpl.entries)
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_legal_hold.go b/weed/s3api/s3api_object_handlers_legal_hold.go
index da7af82b7b..326ebb59ac 100644
--- a/weed/s3api/s3api_object_handlers_legal_hold.go
+++ b/weed/s3api/s3api_object_handlers_legal_hold.go
@@ -25,6 +25,11 @@ func (s3a *S3ApiServer) PutObjectLegalHoldHandler(w http.ResponseWriter, r *http
 	// Get version ID from query parameters
 	versionId := r.URL.Query().Get("versionId")
 
+	if errCode := s3a.recheckTagConditionedPolicyWithLookup(r, bucket, object, versionId, s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD, "PutObjectLegalHoldHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Parse legal hold configuration from request body
 	legalHold, err := parseObjectLegalHold(r)
 	if err != nil {
@@ -81,6 +86,11 @@ func (s3a *S3ApiServer) GetObjectLegalHoldHandler(w http.ResponseWriter, r *http
 	// Get version ID from query parameters
 	versionId := r.URL.Query().Get("versionId")
 
+	if errCode := s3a.recheckTagConditionedPolicyWithLookup(r, bucket, object, versionId, s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD, "GetObjectLegalHoldHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Get legal hold configuration for the object
 	legalHold, err := s3a.getObjectLegalHold(bucket, object, versionId)
 	if err != nil {
diff --git a/weed/s3api/s3api_object_handlers_list.go b/weed/s3api/s3api_object_handlers_list.go
index 23785cb314..76614932ce 100644
--- a/weed/s3api/s3api_object_handlers_list.go
+++ b/weed/s3api/s3api_object_handlers_list.go
@@ -2,6 +2,7 @@ package s3api
 
 import (
 	"context"
+	"encoding/base64"
 	"encoding/xml"
 	"errors"
 	"fmt"
@@ -11,12 +12,17 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 
+	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/s3"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 )
 
 type OptionalString struct {
@@ -67,8 +73,8 @@ func toListBucketResultV1(in ListBucketResult) listBucketResultV1 {
 		Metadata:       in.Metadata,
 		Name:           in.Name,
 		Prefix:         in.Prefix,
-		Marker:         in.Marker,
-		NextMarker:     in.NextMarker,
+		Marker:         encodeMarkerEcho(in.Marker, in.EncodingType == s3.EncodingTypeUrl),
+		NextMarker:     encodeMarkerEcho(in.NextMarker, in.EncodingType == s3.EncodingTypeUrl),
 		MaxKeys:        in.MaxKeys,
 		Delimiter:      in.Delimiter,
 		IsTruncated:    in.IsTruncated,
@@ -101,18 +107,21 @@ func (s3a *S3ApiServer) ListObjectsV2Handler(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
-	marker := continuationToken.string
+	startAfterKey := decodeMarkerEcho(startAfter, encodingTypeUrl)
+	marker := decodeListContinuationToken(continuationToken.string)
 	if !continuationToken.set {
-		marker = startAfter
+		marker = startAfterKey
 	}
 
 	// Adjust marker if it ends with delimiter to skip all entries with that prefix
-	marker = adjustMarkerForDelimiter(marker, delimiter)
+	requestMarker := marker
+	marker = adjustMarkerForDelimiter(marker, originalPrefix, delimiter)
 
 	response, err := s3a.listFilerEntries(r.Context(), listObjectsRequest{
 		bucket:          bucket,
 		prefix:          originalPrefix,
 		marker:          marker,
+		requestMarker:   requestMarker,
 		delimiter:       delimiter,
 		maxKeys:         maxKeys,
 		encodingTypeUrl: encodingTypeUrl,
@@ -140,37 +149,146 @@ func (s3a *S3ApiServer) ListObjectsV2Handler(w http.ResponseWriter, r *http.Requ
 		IsTruncated:           response.IsTruncated,
 		KeyCount:              len(response.Contents) + len(response.CommonPrefixes),
 		MaxKeys:               uint16(response.MaxKeys),
-		NextContinuationToken: response.NextMarker,
+		NextContinuationToken: encodeListContinuationToken(response.NextMarker),
 		Prefix:                response.Prefix,
 		StartAfter:            startAfter,
 	}
 	if encodingTypeUrl {
 		responseV2.EncodingType = s3.EncodingTypeUrl
+		responseV2.StartAfter = urlPathEscape(startAfterKey)
 	}
 
 	glog.V(3).Infof("ListObjectsV2Handler response: %+v", responseV2)
 	writeSuccessResponseXML(w, r, responseV2)
 }
 
+// continuationTokenEncodingPrefix tags a NextContinuationToken whose payload is the
+// base64url encoding of the raw key. XML 1.0 cannot carry control characters, and the
+// XML encoder replaces them with U+FFFD, so a token holding such a key would resume
+// past a mangled name and skip every key sorting between the two. Keys that are valid
+// XML text still travel as the bare key, so the token is unchanged for them.
+const continuationTokenEncodingPrefix = "base64:"
+
+func encodeListContinuationToken(key string) string {
+	if key == "" {
+		return ""
+	}
+	if isXMLText(key) && !strings.HasPrefix(key, continuationTokenEncodingPrefix) {
+		return key
+	}
+	return continuationTokenEncodingPrefix + base64.RawURLEncoding.EncodeToString([]byte(key))
+}
+
+func encodeListContinuationTokenField(value *string) *string {
+	if value == nil {
+		return nil
+	}
+	return aws.String(encodeListContinuationToken(*value))
+}
+
+// encodeMarkerEcho renders a decoded request marker for the response echo:
+// the token encoding keeps an XML-unsafe key legible, and urlPathEscape applies
+// the encoding-type=url form the keys in the same response already carry.
+func encodeMarkerEcho(marker string, encodingTypeUrl bool) string {
+	marker = encodeListContinuationToken(marker)
+	if encodingTypeUrl {
+		marker = urlPathEscape(marker)
+	}
+	return marker
+}
+
+// decodeMarkerEcho reverses the wire encoding on a marker the client echoes
+// back: under encoding-type=url the emitted echo was urlPathEscape'd. Only a
+// value that is the canonical escaped form of its unescape could have come
+// from that encoder — "a%2541" round-trips to itself, "a%41" does not — so
+// anything else stays the raw key the client sent.
+func decodeMarkerEcho(marker string, encodingTypeUrl bool) string {
+	return decodeEscapedEcho(marker, encodingTypeUrl, urlPathEscape)
+}
+
+func decodeEscapedEcho(marker string, encodingTypeUrl bool, escape func(string) string) string {
+	if !encodingTypeUrl {
+		return marker
+	}
+	if unescaped, err := url.QueryUnescape(marker); err == nil && escape(unescaped) == marker {
+		return unescaped
+	}
+	return marker
+}
+
+func decodeListContinuationToken(token string) string {
+	key, ok := strings.CutPrefix(token, continuationTokenEncodingPrefix)
+	if !ok {
+		return token
+	}
+	decoded, err := base64.RawURLEncoding.DecodeString(key)
+	if err != nil {
+		// Not a token this server wrote; resume at the token as the raw key.
+		return token
+	}
+	decodedKey := string(decoded)
+	// encodeListContinuationToken only writes a token for a key that cannot
+	// travel bare, so a decoded key that could have stayed bare — valid XML
+	// text without the prefix — means the input was a legacy raw-key token,
+	// not something to decode.
+	if isXMLText(decodedKey) && !strings.HasPrefix(decodedKey, continuationTokenEncodingPrefix) {
+		return token
+	}
+	// A decoded key that could not travel bare makes the token ambiguous
+	// ("base64:AQ" reads as both the encoded form of "\x01" and a literal
+	// legacy key). The encoded reading wins: preferring the raw one would
+	// resume past real entries for every token this server writes, while a
+	// legacy token aliasing the encoded form only re-lists keys.
+	return decodedKey
+}
+
+// isXMLText reports whether s survives an XML 1.0 round trip unchanged, i.e. the
+// encoder does not replace any of its characters with U+FFFD.
+func isXMLText(s string) bool {
+	for i := 0; i < len(s); {
+		r, size := utf8.DecodeRuneInString(s[i:])
+		if r == utf8.RuneError && size == 1 {
+			return false
+		}
+		if !isXMLChar(r) {
+			return false
+		}
+		i += size
+	}
+	return true
+}
+
+// isXMLChar follows the XML 1.0 Char production the encoding/xml encoder enforces.
+func isXMLChar(r rune) bool {
+	switch {
+	case r == 0x9 || r == 0xA || r == 0xD:
+		return true
+	case r >= 0x20 && r <= 0xD7FF:
+		return true
+	case r >= 0xE000 && r <= 0xFFFD:
+		return true
+	case r >= 0x10000 && r <= 0x10FFFF:
+		return true
+	}
+	return false
+}
+
 func (s3a *S3ApiServer) ListObjectsV1Handler(w http.ResponseWriter, r *http.Request) {
 
 	// https://docs.aws.amazon.com/AmazonS3/latest/API/API_ListObjects.html
 
 	// collect parameters
 	bucket, _ := s3_constants.GetBucketAndObject(r)
-	originalPrefix, marker, delimiter, encodingTypeUrl, maxKeys, allowUnordered, errCode := getListObjectsV1Args(r.URL.Query())
+	originalPrefix, listMarker, delimiter, encodingTypeUrl, maxKeys, allowUnordered, errCode := getListObjectsV1Args(r.URL.Query())
 
-	glog.V(2).Infof("ListObjectsV1Handler bucket=%s prefix=%s marker=%s delimiter=%s maxKeys=%d", bucket, originalPrefix, marker, delimiter, maxKeys)
+	glog.V(2).Infof("ListObjectsV1Handler bucket=%s prefix=%s marker=%s delimiter=%s maxKeys=%d", bucket, originalPrefix, listMarker, delimiter, maxKeys)
 
 	if errCode != s3err.ErrNone {
 		s3err.WriteErrorResponse(w, r, errCode)
 		return
 	}
 
-	if maxKeys < 0 {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidMaxKeys)
-		return
-	}
+	// maxKeys is uint16 here; negative values are rejected during parsing.
 
 	// AWS S3 compatibility: allow-unordered cannot be used with delimiter
 	if allowUnordered && delimiter != "" {
@@ -179,14 +297,16 @@ func (s3a *S3ApiServer) ListObjectsV1Handler(w http.ResponseWriter, r *http.Requ
 	}
 
 	// Adjust marker if it ends with delimiter to skip all entries with that prefix
-	marker = adjustMarkerForDelimiter(marker, delimiter)
+	requestMarker := decodeListContinuationToken(decodeMarkerEcho(listMarker, encodingTypeUrl))
+	marker := adjustMarkerForDelimiter(requestMarker, originalPrefix, delimiter)
 
 	response, err := s3a.listFilerEntries(r.Context(), listObjectsRequest{
 		bucket:          bucket,
 		prefix:          originalPrefix,
 		marker:          marker,
+		requestMarker:   requestMarker,
 		delimiter:       delimiter,
-		maxKeys:         uint16(maxKeys),
+		maxKeys:         maxKeys,
 		encodingTypeUrl: encodingTypeUrl,
 		fetchOwner:      true,
 	})
@@ -249,9 +369,13 @@ func sanitizeV1MarkerEcho(response *ListBucketResult, marker string, encodingTyp
 }
 
 type listObjectsRequest struct {
-	bucket          string
-	prefix          string
-	marker          string
+	bucket string
+	prefix string
+	marker string
+	// requestMarker is the marker as the client sent it, before a marker ending on the
+	// delimiter was trimmed to the walk's cutoff. The response echoes it, and no key it
+	// names is listed.
+	requestMarker   string
 	delimiter       string
 	maxKeys         uint16
 	encodingTypeUrl bool
@@ -262,8 +386,13 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 	bucket, originalPrefix, originalMarker := req.bucket, req.prefix, req.marker
 	maxKeys, delimiter := req.maxKeys, req.delimiter
 	encodingTypeUrl, fetchOwner := req.encodingTypeUrl, req.fetchOwner
+	requestMarker := req.requestMarker
+	if requestMarker == "" {
+		requestMarker = originalMarker
+	}
+	excludedKey := excludedMarkerKey(requestMarker, originalMarker)
 	// convert full path prefix into directory name and prefix for entry name
-	requestDir, prefix, marker := normalizePrefixMarker(originalPrefix, originalMarker)
+	requestDir, prefix, marker, prefixEndsOnDelimiter := normalizePrefixMarker(originalPrefix, originalMarker)
 	bucketPrefix := s3a.bucketPrefix(bucket)
 	reqDir := bucketPrefix[:len(bucketPrefix)-1]
 	if requestDir != "" {
@@ -276,7 +405,7 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 	var nextMarker string
 	cursor := &ListingCursor{
 		maxKeys:               maxKeys,
-		prefixEndsOnDelimiter: strings.HasSuffix(originalPrefix, "/") && len(originalMarker) == 0,
+		prefixEndsOnDelimiter: prefixEndsOnDelimiter,
 	}
 
 	// Special case: when maxKeys = 0, return empty results immediately with IsTruncated=false
@@ -284,7 +413,7 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 		response = ListBucketResult{
 			Name:           bucket,
 			Prefix:         originalPrefix,
-			Marker:         originalMarker,
+			Marker:         requestMarker,
 			NextMarker:     "",
 			MaxKeys:        int(maxKeys),
 			Delimiter:      delimiter,
@@ -298,40 +427,245 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 		return
 	}
 
+	alignedMarker := marker
+
 	// check filer
 	err = s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		// The failover wrapper retries this callback on another filer after a
+		// transport error, so every attempt rebuilds the page from scratch: a
+		// partially built page must not leak into the retry.
+		contents = nil
+		commonPrefixes = nil
+		doErr = nil
+		nextMarker = ""
+		marker = alignedMarker
+		*cursor = ListingCursor{
+			maxKeys:               maxKeys,
+			prefixEndsOnDelimiter: prefixEndsOnDelimiter,
+		}
+
 		var lastEntryWasCommonPrefix bool
 		var lastCommonPrefix string
+		// Backing for the newest CommonPrefix: which unsettled null objects stand
+		// behind it, and whether anything definitely listable does. A prefix whose
+		// null backers all settle as delete-marked names nothing and is retracted;
+		// tracking backers by key keeps a marker that never joined the prefix (a
+		// version-only key with no base object) from debiting it. Contributors to
+		// a prefix stream contiguously, so only the newest prefix needs this.
+		var lastPrefixNullBackers map[string]bool
+		var lastPrefixConfirmed bool
 
 		// Hoist versioning check out of per-entry callback
 		versioningState, _ := s3a.getVersioningState(bucket)
-		versioningEnabled := versioningState == "Enabled"
-		// Suspending versioning keeps the delete markers already written, so both states
-		// can hold a directory whose objects are all gone from the current-version view.
-		cursor.hideDeletedPrefixes = versioningState != ""
+		// Suspending versioning keeps the .versions directories already written, so both
+		// states can emit a key twice (base-path null object plus its .versions sibling)
+		// and can hold a directory whose objects are all gone from the current-version view.
+		versioningConfigured := versioningState != ""
+		cursor.hideDeletedPrefixes = versioningConfigured
 
 		// Helper function to handle dedup/append logic
 		appendOrDedup := func(newEntry ListEntry) {
-			if versioningEnabled {
-				// For versioned buckets, we need to handle duplicates between the main file and the .versions directory
-				if len(contents) > 0 && contents[len(contents)-1].Key == newEntry.Key {
-					glog.V(3).Infof("listFilerEntries deduplicating versioned entry: %s", newEntry.Key)
-					contents[len(contents)-1] = newEntry
-				} else {
-					contents = append(contents, newEntry)
-					cursor.maxKeys--
+			if versioningConfigured {
+				// A key's .versions sibling resolves after every key that sorts between
+				// them ("k.bak" lists between "k" and "k.versions"), so the base entry is
+				// found by scanning back through the page and a late resolution is
+				// inserted where it keeps the page sorted, not at the end.
+				insertAt := len(contents)
+				for insertAt > 0 && contents[insertAt-1].Key > newEntry.Key {
+					insertAt--
 				}
+				if insertAt > 0 && contents[insertAt-1].Key == newEntry.Key {
+					glog.V(3).Infof("listFilerEntries deduplicating versioned entry: %s", newEntry.Key)
+					contents[insertAt-1] = newEntry
+					return
+				}
+				contents = append(contents, ListEntry{})
+				copy(contents[insertAt+1:], contents[insertAt:])
+				contents[insertAt] = newEntry
+				cursor.maxKeys--
 			} else {
 				contents = append(contents, newEntry)
 				cursor.maxKeys--
 			}
 		}
 
+		// Null objects whose .versions sibling has not streamed yet, and so may still
+		// turn out to be shadowed by a delete marker. Entries stream in order, so a
+		// pending null is dropped once the stream passes its sibling's name; the cap
+		// only binds on pathological prefix nests and falls back to sibling-adjacent
+		// behavior for the evicted oldest.
+		type pendingNull struct{ dir, name string }
+		var pendingNulls []pendingNull
+		prunePendingNulls := func(dir, passedName string) {
+			kept := pendingNulls[:0]
+			for _, p := range pendingNulls {
+				if p.dir != dir || p.name+s3_constants.VersionsFolder >= passedName {
+					kept = append(kept, p)
+				}
+			}
+			pendingNulls = kept
+		}
+		dropPendingNull := func(dir, name string) {
+			kept := pendingNulls[:0]
+			for _, p := range pendingNulls {
+				if p.dir != dir || p.name != name {
+					kept = append(kept, p)
+				}
+			}
+			pendingNulls = kept
+		}
+		// prefixForKey returns the CommonPrefix a key folds into under the request's
+		// delimiter, derived exactly as the emission sites derive it, or "".
+		prefixForKey := func(dir, name string) string {
+			if delimiter == "" {
+				return ""
+			}
+			undelimited := strings.TrimPrefix((dir + "/" + name)[len(bucketPrefix):], originalPrefix)
+			if parts := strings.SplitN(undelimited, delimiter, 2); len(parts) == 2 {
+				return originalPrefix + parts[0] + delimiter
+			}
+			return ""
+		}
+
+		// addCommonPrefix records a CommonPrefix the page has not emitted yet. maxKeys is
+		// unsigned, so the decrement is clamped rather than allowed to wrap: a prefix
+		// object spends two slots on one entry, and the budget is only checked between
+		// entries.
+		addCommonPrefix := func(prefix string) {
+			for i := range commonPrefixes {
+				if commonPrefixes[i].Prefix == prefix {
+					if prefix == lastCommonPrefix {
+						lastPrefixConfirmed = true
+					}
+					return
+				}
+			}
+			commonPrefixes = append(commonPrefixes, PrefixEntry{Prefix: prefix})
+			if cursor.maxKeys > 0 {
+				cursor.maxKeys--
+			}
+			lastEntryWasCommonPrefix = true
+			lastCommonPrefix = prefix
+			lastPrefixNullBackers, lastPrefixConfirmed = nil, true
+		}
+
+		retractPrefixBacking := func(prefix, dir, name string) {
+			if prefix != lastCommonPrefix || !lastPrefixNullBackers[dir+"/"+name] {
+				return
+			}
+			delete(lastPrefixNullBackers, dir+"/"+name)
+			if len(lastPrefixNullBackers) == 0 && !lastPrefixConfirmed &&
+				len(commonPrefixes) > 0 && commonPrefixes[len(commonPrefixes)-1].Prefix == prefix {
+				commonPrefixes = commonPrefixes[:len(commonPrefixes)-1]
+				cursor.maxKeys++
+				lastEntryWasCommonPrefix = false
+				lastCommonPrefix = ""
+			}
+		}
+
+		// The null object for a key lists before its .versions sibling can reveal
+		// that the current version is a delete marker, so the reveal retracts it -
+		// from the page's keys, or from the CommonPrefix it was folded into.
+		cursor.retractEntry = func(dir, name string) {
+			dropPendingNull(dir, name)
+			dirName, entryName, _ := entryUrlEncode(dir, name, encodingTypeUrl)
+			key := fmt.Sprintf("%s/%s", dirName, entryName)[len(bucketPrefix):]
+			for i := len(contents) - 1; i >= 0 && contents[i].Key >= key; i-- {
+				if contents[i].Key == key {
+					contents = append(contents[:i], contents[i+1:]...)
+					cursor.maxKeys++
+					return
+				}
+			}
+			if prefix := prefixForKey(dir, name); prefix != "" {
+				retractPrefixBacking(prefix, dir, name)
+			}
+		}
+
+		// Only a definitive not-found means the null object is live; a transient
+		// failure leaves the entry unsettled and must not commit it to the page,
+		// since the next page would then skip the sibling for good.
+		settlePendingNull := func(p pendingNull) error {
+			versionsEntry, err := s3a.getEntry(p.dir, p.name+s3_constants.VersionsFolder)
+			if err != nil {
+				if errors.Is(err, filer_pb.ErrNotFound) || status.Code(err) == codes.NotFound {
+					return nil
+				}
+				return fmt.Errorf("settle null object %s/%s: %w", p.dir, p.name, err)
+			}
+			fullObjectPath := strings.TrimPrefix(p.dir+"/"+p.name, bucketPrefix)
+			latest, lerr := s3a.getLatestVersionEntryFromDirectoryEntry(bucket, fullObjectPath, versionsEntry)
+			switch {
+			case lerr == nil:
+				if prefix := prefixForKey(p.dir, p.name); prefix != "" {
+					// The key folds into a CommonPrefix; a live current version
+					// confirms the prefix rather than surfacing the key.
+					if prefix == lastCommonPrefix {
+						lastPrefixConfirmed = true
+					}
+				} else {
+					dirName, entryName, _ := entryUrlEncode(p.dir, latest.Name, encodingTypeUrl)
+					appendOrDedup(newListEntry(s3a, latest, "", dirName, entryName, bucketPrefix, fetchOwner, false, false))
+				}
+			case errors.Is(lerr, ErrDeleteMarker), errors.Is(lerr, filer_pb.ErrNotFound):
+				cursor.retractEntry(p.dir, p.name)
+			default:
+				return fmt.Errorf("settle null object %s/%s: %w", p.dir, p.name, lerr)
+			}
+			return nil
+		}
+
+		addPendingNull := func(dir, name string) {
+			if len(pendingNulls) >= 8 {
+				// Settle rather than silently evict: an unsettled null would leak past
+				// the page, and the resume skip would then keep it stale for good. A
+				// failed settlement is retained for page-close resolution to retry.
+				settled := pendingNulls[0]
+				pendingNulls = pendingNulls[1:]
+				if settleErr := settlePendingNull(settled); settleErr != nil {
+					pendingNulls = append([]pendingNull{settled}, pendingNulls...)
+				}
+			}
+			pendingNulls = append(pendingNulls, pendingNull{dir, name})
+		}
+
+		// A page may fill while a trailing null object's .versions sibling is still
+		// unstreamed; settle each one by direct lookup before the page is declared
+		// final. A retraction here reopens the page's quota, and a failure fails the
+		// listing rather than committing an unsettled entry.
+		cursor.resolvePendingNulls = func() error {
+			for len(pendingNulls) > 0 {
+				p := pendingNulls[0]
+				pendingNulls = pendingNulls[1:]
+				if settleErr := settlePendingNull(p); settleErr != nil {
+					pendingNulls = append([]pendingNull{p}, pendingNulls...)
+					return settleErr
+				}
+			}
+			return nil
+		}
+
 		for {
 			empty := true
 
 			nextMarker, doErr = s3a.doListFilerEntries(ctx, client, listDirectoryRequest{dir: reqDir, prefix: prefix, marker: marker, delimiter: delimiter, bucket: bucket}, cursor, func(dir string, entry *filer_pb.Entry) {
 				empty = false
+				prunePendingNulls(dir, entry.Name)
+				if excludedKey != "" && !entry.IsDirectory && fmt.Sprintf("%s/%s", dir, entry.Name)[len(bucketPrefix):] == excludedKey {
+					return
+				}
+				// A delimiter marker excludes the entire folded prefix, not just
+				// the key bearing its name. This also applies to delimiters such as
+				// "_", whose groups are not directory blocks in the filer walk.
+				if delimiter != "" {
+					name := entry.Name
+					if entry.IsDirectory && !entry.IsPrefixObject() {
+						name += "/"
+					}
+					if folded := prefixForKey(dir, name); folded != "" && folded <= requestMarker {
+						return
+					}
+				}
 				dirName, entryName, _ := entryUrlEncode(dir, entry.Name, encodingTypeUrl)
 				if entry.IsDirectory {
 					if originalPrefix != "" {
@@ -344,6 +678,33 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 							}
 						}
 					}
+					// A prefix object's key carries no trailing slash, so it lists as a
+					// plain key. The traversal never descends into it under a delimiter,
+					// so the CommonPrefix its nested keys fold into is added here too.
+					if entry.IsPrefixObject() {
+						keyOnly := cursor.prefixObjectKeyOnly
+						cursor.prefixObjectKeyOnly = false
+						key := fmt.Sprintf("%s/%s", dir, entry.Name)[len(bucketPrefix):]
+						if strings.HasPrefix(key, originalPrefix) {
+							if folded := prefixForKey(dir, entry.Name); folded != "" {
+								// The key and everything under it fold into the same prefix.
+								addCommonPrefix(folded)
+								return
+							}
+							appendOrDedup(newListEntry(s3a, entry, "", dirName, entryName, bucketPrefix, fetchOwner, false, false))
+							lastEntryWasCommonPrefix = false
+						}
+						// The key and the prefix come off one entry, which a marker names as a
+						// whole, so a page ending between them cannot resume at the prefix:
+						// a marker of "<key>/" means the subtree is done, not that it is
+						// next. The page runs one item over maxKeys instead of dropping it.
+						if !keyOnly {
+							if childPrefix := prefixForKey(dir, entry.Name+"/"); childPrefix != "" && s3a.hasChildren(ctx, bucket, key) {
+								addCommonPrefix(childPrefix)
+							}
+						}
+						return
+					}
 					// When delimiter is specified, apply delimiter logic to directory key objects too
 					if delimiter != "" && entry.IsDirectoryKeyObject() {
 						// Apply the same delimiter logic as for regular files
@@ -370,9 +731,11 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 								delimiterFound = true
 								lastEntryWasCommonPrefix = true
 								lastCommonPrefix = delimitedPrefix
+								lastPrefixNullBackers, lastPrefixConfirmed = nil, true
 							} else {
 								// This directory object belongs to an existing CommonPrefix, skip it
 								delimiterFound = true
+								lastPrefixConfirmed = true
 							}
 						}
 
@@ -399,6 +762,7 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 						cursor.maxKeys--
 						lastEntryWasCommonPrefix = true
 						lastCommonPrefix = dirPrefix
+						lastPrefixNullBackers, lastPrefixConfirmed = nil, true
 					}
 				} else {
 					var delimiterFound bool
@@ -416,6 +780,15 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 							// S3 clients expect the delimited prefix to contain the delimiter and prefix.
 							delimitedPrefix := originalPrefix + delimitedPath[0] + delimiter
 
+							// A null object rolled into a prefix still awaits its .versions
+							// sibling, and the prefix must not outlive its only backers.
+							isNullBacker := false
+							if versioningConfigured {
+								if vid := string(entry.Extended[s3_constants.ExtVersionIdKey]); vid == "" || vid == "null" {
+									isNullBacker = true
+								}
+							}
+
 							for i := range commonPrefixes {
 								if commonPrefixes[i].Prefix == delimitedPrefix {
 									delimiterFound = true
@@ -431,10 +804,27 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 								delimiterFound = true
 								lastEntryWasCommonPrefix = true
 								lastCommonPrefix = delimitedPrefix
+								lastPrefixNullBackers, lastPrefixConfirmed = nil, !isNullBacker
+								if isNullBacker {
+									lastPrefixNullBackers = map[string]bool{dir + "/" + entry.Name: true}
+									addPendingNull(dir, entry.Name)
+								}
 							} else {
 								// This object belongs to an existing CommonPrefix, skip it
 								// but continue processing to maintain correct flow
 								delimiterFound = true
+								if delimitedPrefix == lastCommonPrefix {
+									if isNullBacker {
+										if lastPrefixNullBackers == nil {
+											lastPrefixNullBackers = map[string]bool{}
+										}
+										lastPrefixNullBackers[dir+"/"+entry.Name] = true
+										addPendingNull(dir, entry.Name)
+									} else {
+										lastPrefixConfirmed = true
+										dropPendingNull(dir, entry.Name)
+									}
+								}
 							}
 						}
 					}
@@ -443,6 +833,15 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 						newEntry := newListEntry(s3a, entry, "", dirName, entryName, bucketPrefix, fetchOwner, false, false)
 						appendOrDedup(newEntry)
 						lastEntryWasCommonPrefix = false
+						if versioningConfigured {
+							// A real version id means the .versions sibling resolved this
+							// key; anything else is a null object the sibling may shadow.
+							if vid := string(entry.Extended[s3_constants.ExtVersionIdKey]); vid == "" || vid == "null" {
+								addPendingNull(dir, entry.Name)
+							} else {
+								dropPendingNull(dir, entry.Name)
+							}
+						}
 					}
 				}
 			})
@@ -473,7 +872,7 @@ func (s3a *S3ApiServer) listFilerEntries(ctx context.Context, req listObjectsReq
 		response = ListBucketResult{
 			Name:           bucket,
 			Prefix:         originalPrefix,
-			Marker:         originalMarker,
+			Marker:         requestMarker,
 			NextMarker:     nextMarker,
 			MaxKeys:        int(maxKeys),
 			Delimiter:      delimiter,
@@ -511,11 +910,73 @@ type ListingCursor struct {
 	// something to find once a bucket has version history to leave behind.
 	hideDeletedPrefixes bool
 	probedEntries       int
+	// probeBudget overrides hiddenProbeBudget for the per-prefix probe; 0 means use
+	// the package default. Tests set this to a small value to stay fast.
+	probeBudget int
+	// probeTotalBudget overrides hiddenProbeTotalBudget for the request-wide probe
+	// ceiling; 0 means use the package default.
+	probeTotalBudget int
+	// retractEntry undoes the listing of a base-path null object once its .versions
+	// sibling reveals that the current version is a delete marker.
+	retractEntry func(dir, name string)
+	// resolvePendingNulls settles trailing null objects whose .versions sibling
+	// has not streamed yet before a page is declared full.
+	resolvePendingNulls func() error
+	// prefixObjectKeyOnly limits the next prefix-object entry passed to the entry
+	// callback to its plain key; its "<name>/" CommonPrefix is deferred to the
+	// directory's own block position.
+	prefixObjectKeyOnly bool
+}
+
+// excludedMarkerKey returns the key an exclusive marker names that the walk's cutoff no
+// longer excludes, because a marker ending on the delimiter is trimmed to that cutoff.
+// The key is skipped as it streams, rather than spending a slot of the page and being
+// dropped from the answer afterwards, which would turn a truncated page into a final one.
+func excludedMarkerKey(requestMarker, marker string) string {
+	if requestMarker == marker {
+		return ""
+	}
+	return strings.TrimLeft(requestMarker, "/")
+}
+
+// markerSortsBeforePrefix reports whether marker is a cutoff that excludes no key
+// under prefix: the marker sorts before the prefix and is not under it, so every key
+// carrying the prefix already sorts after it. A marker that sorts after the prefix is
+// left alone: it may sit inside a partial name prefix's match set ("parent" also
+// matches "parentDir/…"), which normalizePrefixMarker handles.
+func markerSortsBeforePrefix(prefix, marker string) bool {
+	prefix = strings.TrimLeft(prefix, "/")
+	marker = strings.TrimLeft(marker, "/")
+	if marker == "" || prefix == "" {
+		return false
+	}
+	return !strings.HasPrefix(marker, prefix) && marker < prefix
+}
+
+// markerSortsPastPrefix reports whether marker lies beyond the last key the
+// prefix can match. A marker that diverges from the prefix at a larger byte
+// is after every key under it, so the listing is empty no matter where the
+// walk would resume.
+func markerSortsPastPrefix(prefix, marker string) bool {
+	prefix = strings.TrimLeft(prefix, "/")
+	marker = strings.TrimLeft(marker, "/")
+	if marker == "" || prefix == "" {
+		return false
+	}
+	return !strings.HasPrefix(marker, prefix) && marker > prefix
 }
 
 // the prefix and marker may be in different directories
-// normalizePrefixMarker ensures the prefix and marker both starts from the same directory
-func normalizePrefixMarker(prefix, marker string) (alignedDir, alignedPrefix, alignedMarker string) {
+// normalizePrefixMarker ensures the prefix and marker both starts from the same directory.
+// prefixEndsOnDelimiter tells the walk that the prefix names one directory, whose own key
+// is in scope.
+func normalizePrefixMarker(prefix, marker string) (alignedDir, alignedPrefix, alignedMarker string, prefixEndsOnDelimiter bool) {
+	// A marker that excludes no key under the prefix is dropped, so the listing is the
+	// one with no marker at all. The response still echoes the marker the client sent.
+	if markerSortsBeforePrefix(prefix, marker) {
+		marker = ""
+	}
+	prefixEndsOnDelimiter = strings.HasSuffix(prefix, "/") && len(marker) == 0
 	// alignedDir should not end with "/"
 	// alignedDir, alignedPrefix, alignedMarker should only have "/" in middle
 	if len(marker) == 0 {
@@ -525,7 +986,7 @@ func normalizePrefixMarker(prefix, marker string) (alignedDir, alignedPrefix, al
 	}
 	marker = strings.TrimLeft(marker, "/")
 	if prefix == "" {
-		return "", "", marker
+		return "", "", marker, prefixEndsOnDelimiter
 	}
 	if marker == "" {
 		alignedDir, alignedPrefix = toDirAndName(prefix)
@@ -533,7 +994,7 @@ func normalizePrefixMarker(prefix, marker string) (alignedDir, alignedPrefix, al
 	}
 	if !strings.HasPrefix(marker, prefix) {
 		// something wrong
-		return "", prefix, marker
+		return "", prefix, marker, prefixEndsOnDelimiter
 	}
 	// Resolve the listing dir from the prefix, not the marker: a partial name prefix like
 	// "data/a" also matches siblings such as "data/ab/", which narrowing to the marker's
@@ -604,26 +1065,158 @@ func (s3a *S3ApiServer) doListFilerEntries(ctx context.Context, client filer_pb.
 		return // Don't set isTruncated here - let caller decide based on whether more entries exist
 	}
 
-	if strings.Contains(marker, "/") {
-		subDir, subMarker := toParentAndDescendants(marker)
-		// println("doListFilerEntries dir", dir+"/"+subDir, "subMarker", subMarker)
-		subNextMarker, subErr := s3a.doListFilerEntries(ctx, client, listDirectoryRequest{dir: dir + "/" + subDir, marker: subMarker, delimiter: delimiter, bucket: bucket}, cursor, eachEntryFn)
-		if subErr != nil {
-			err = subErr
-			return
-		}
-		nextMarker = subDir + "/" + subNextMarker
-		// finished processing this subdirectory
-		marker = subDir
-	}
-	if cursor.isTruncated {
+	// A marker past the prefix's range leaves nothing under the prefix to
+	// resume at, and descending into the marker's own directory below would
+	// drop the prefix filter entirely.
+	if markerSortsPastPrefix(prefix, marker) {
 		return
 	}
 
+	// A directory's keys sort at "<name>/" among this level's children, not at
+	// the name itself: siblings like "a-c" and "a.txt" sort before "a/b" while
+	// "a0" sorts after. Start the window at the first child whose block can
+	// still hold keys past the marker — the shortest prefix of the marker
+	// followed by a byte no greater than "/" — and ask for it inclusively, so
+	// a marker-named directory's subtree is reached at all.
+	startName := marker
+	for i := 0; i < len(marker); i++ {
+		if marker[i] <= '/' {
+			startName = marker[:i]
+			break
+		}
+	}
+	inclusiveStartFrom = startName != ""
+
 	// now marker is also a direct child of dir
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
+	// The marker this page started from, unlike marker below, which advances with
+	// each request window inside the page.
+	pageMarker := marker
+
+	// Defer each directory until a child past its "<name>/" block arrives, so
+	// emission follows S3 byte order rather than the filer's name order.
+	type pendingDir struct {
+		e                *filer_pb.Entry
+		matchedPrefixDir bool
+	}
+	var pendingDirs []pendingDir
+	stopped := false
+	// hasEntries reports whether the filer directory holds at least one entry,
+	// probed on the request's own client; errors answer conservatively as true.
+	hasEntries := func(path string) bool {
+		probeCtx, cancel := context.WithCancel(ctx)
+		defer cancel()
+		stream, lerr := client.ListEntries(probeCtx, &filer_pb.ListEntriesRequest{Directory: path, Limit: 1})
+		if lerr != nil {
+			return true
+		}
+		_, recvErr := stream.Recv()
+		return recvErr == nil
+	}
+	emitDir := func(e *filer_pb.Entry, matchedPrefixDir bool) error {
+		blockKey := e.Name + "/"
+		var subMarker string
+		if strings.HasPrefix(marker, blockKey) {
+			if delimiter == "/" {
+				// this block collapses to one common prefix, already emitted
+				return nil
+			}
+			subMarker = marker[len(blockKey):]
+		} else if blockKey <= marker {
+			return nil
+		}
+		// A prefix object's plain key is emitted at the name position or not at
+		// all; the block emits only its "<name>/" fold, so the callback sees a
+		// plain directory.
+		emitEntry := e
+		if e.IsPrefixObject() {
+			emitEntry = proto.Clone(e).(*filer_pb.Entry)
+			delete(emitEntry.Extended, s3_constants.SeaweedFSPrefixObject)
+		}
+		isKeyObject := e.IsDirectoryKeyObject() && !e.IsPrefixObject()
+		if delimiter != "/" || cursor.prefixEndsOnDelimiter {
+			// A trailing-slash prefix (e.g. "logs/") names one directory, so the
+			// recursion below answers whether it exists and what it holds.
+			if cursor.prefixEndsOnDelimiter {
+				cursor.prefixEndsOnDelimiter = false
+			}
+			if isKeyObject && blockKey > marker {
+				// Directory key objects (created via PutObject with trailing "/")
+				// appear as regular keys in recursive listing mode.
+				eachEntryFn(dir, emitEntry)
+			}
+			subNextMarker, subErr := s3a.doListFilerEntries(ctx, client, listDirectoryRequest{dir: dir + "/" + e.Name, marker: subMarker, delimiter: delimiter, bucket: bucket}, cursor, eachEntryFn)
+			if subErr != nil {
+				return fmt.Errorf("doListFilerEntries2: %w", subErr)
+			}
+			nextMarker = e.Name + "/" + subNextMarker
+			if cursor.maxKeys <= 0 && subNextMarker == "" && hasEntries(dir+"/"+e.Name) {
+				// The recursion starved on quota before listing the subtree;
+				// keep a resume position that re-enters it.
+				cursor.isTruncated = true
+			}
+			// An empty directory gets no marker under its own "<dir>/" prefix:
+			// that listing enumerates children, where S3 returns nothing for an
+			// empty prefix, and a fake entry is read back as a real object by
+			// clients that enumerate locks or similar.
+			// println("doListFilerEntries2 dir", dir+"/"+e.Name, "subNextMarker", subNextMarker)
+			if cursor.isTruncated || matchedPrefixDir {
+				stopped = true
+			}
+			// println("doListFilerEntries2 nextMarker", nextMarker)
+		} else {
+			switch {
+			case isKeyObject && blockKey > marker:
+				eachEntryFn(dir, emitEntry)
+			case e.IsPrefixObject():
+				// The plain key already listed at the name position; the
+				// deferred block emits the "<name>/" common prefix only when
+				// children fold under it.
+				if hasEntries(dir + "/" + e.Name) {
+					eachEntryFn(dir, emitEntry)
+				}
+			case !s3a.dirHoldsOnlyHiddenEntries(ctx, client, bucket, dir+"/"+e.Name, cursor):
+				eachEntryFn(dir, emitEntry)
+			}
+			// Whatever the block emitted sits at its "<name>/" position, so the
+			// resume marker is the block boundary: the bare name sorts inside the
+			// (name, name/) band and would reopen the block for a second emission.
+			nextMarker = e.Name + "/"
+		}
+		return nil
+	}
+	// pendingDirs is kept ordered by "<name>/" rather than by name: "a-c/" and
+	// "a./" sort before "a/" even though "a" is the smaller name.
+	flushDirs := func(upTo string) error {
+		for len(pendingDirs) > 0 && (upTo == "" || pendingDirs[0].e.Name+"/" < upTo) {
+			if cursor.maxKeys <= 0 {
+				cursor.isTruncated = true
+				return nil
+			}
+			d := pendingDirs[0]
+			pendingDirs = pendingDirs[1:]
+			if err := emitDir(d.e, d.matchedPrefixDir); err != nil {
+				return err
+			}
+			if stopped || cursor.isTruncated {
+				return nil
+			}
+		}
+		return nil
+	}
+	queueDir := func(pd pendingDir) {
+		blockKey := pd.e.Name + "/"
+		i := 0
+		for i < len(pendingDirs) && pendingDirs[i].e.Name+"/" < blockKey {
+			i++
+		}
+		pendingDirs = append(pendingDirs, pendingDir{})
+		copy(pendingDirs[i+1:], pendingDirs[i:])
+		pendingDirs[i] = pd
+	}
+
 	// Entries that emit nothing (empty directories, the .uploads folder, the marker
 	// echo) consume the request window without consuming maxKeys, so one window may
 	// end before maxKeys is satisfied. Keep requesting from the last received entry
@@ -633,7 +1226,7 @@ func (s3a *S3ApiServer) doListFilerEntries(ctx context.Context, client filer_pb.
 			Directory:          dir,
 			Prefix:             prefix,
 			Limit:              uint32(cursor.maxKeys) + 2, // bucket root directory needs to skip additional s3_constants.MultipartUploadsFolder folder
-			StartFromFileName:  marker,
+			StartFromFileName:  startName,
 			InclusiveStartFrom: inclusiveStartFrom,
 		}
 
@@ -664,22 +1257,38 @@ func (s3a *S3ApiServer) doListFilerEntries(ctx context.Context, client filer_pb.
 			}
 			entriesReceived++
 			lastEntryName = entry.Name
-			// listFilerEntries always calls doListFilerEntries with inclusiveStartFrom=false
-			// (S3 marker semantics are exclusive), but keep the guard explicit to preserve
-			// behavior if inclusive callers are introduced in the future.
-			// A versioned object lives in a "<key>.versions" directory, so the marker also
-			// has to be matched against the object name that directory stands for.
-			markerName := entry.Name
-			if entry.IsDirectory {
-				markerName = strings.TrimSuffix(markerName, s3_constants.VersionsFolder)
+			// A directory whose block sorts before this entry emits now — every
+			// key it yields still sorts before this entry's name.
+			if err = flushDirs(entry.Name); err != nil || stopped || cursor.isTruncated {
+				return
 			}
-			if !inclusiveStartFrom && marker != "" && (entry.Name == marker || markerName == marker) {
-				continue
+			// A directory block still contributes past a marker that lands inside
+			// its "<name>/" band; only a block entirely behind it is skipped.
+			if marker != "" {
+				if entry.IsDirectory {
+					if entry.Name+"/" <= marker && !strings.HasPrefix(marker, entry.Name+"/") {
+						continue
+					}
+				} else if entry.Name <= marker {
+					continue
+				}
 			}
 
-			if cursor.maxKeys <= 0 {
-				cursor.isTruncated = true
-				break
+			// The .versions sibling of the key just emitted still decides that key's
+			// fate (metadata replacement or retraction) and consumes no quota of its
+			// own, so it must not be pushed past the page boundary.
+			versionsSiblingOfLast := cursor.hideDeletedPrefixes && entry.IsDirectory &&
+				entry.Name == nextMarker+s3_constants.VersionsFolder
+			if cursor.maxKeys <= 0 && !versionsSiblingOfLast {
+				if cursor.resolvePendingNulls != nil {
+					if err = cursor.resolvePendingNulls(); err != nil {
+						return
+					}
+				}
+				if cursor.maxKeys <= 0 {
+					cursor.isTruncated = true
+					break
+				}
 			}
 
 			// Set nextMarker only when we have quota to process this entry
@@ -689,16 +1298,34 @@ func (s3a *S3ApiServer) doListFilerEntries(ctx context.Context, client filer_pb.
 			// we must stop processing siblings to avoid matching unrelated entries like "foo1000".
 			matchedPrefixDir := cursor.prefixEndsOnDelimiter && entry.Name == prefix && entry.IsDirectory
 			if cursor.prefixEndsOnDelimiter {
-				if entry.Name == prefix && entry.IsDirectory {
-					if delimiter != "/" {
-						cursor.prefixEndsOnDelimiter = false
-					}
-				} else {
+				if !matchedPrefixDir {
 					continue
 				}
+				// Keep the exact-directory filter until emitDir descends into
+				// the deferred block. Clearing it at the name position lets
+				// siblings like "a.txt" leak into a listing for "a/".
 			}
 			if entry.IsDirectory {
 				// glog.V(4).Infof("List Dir Entries %s, file: %s, maxKeys %d", dir, entry.Name, cursor.maxKeys)
+				// A marker inside a skipped subtree still descends — the
+				// internal folder is not listed, its contents may be.
+				if strings.HasPrefix(marker, entry.Name+"/") {
+					if delimiter == "/" {
+						// The whole block already collapsed into its common
+						// prefix; nothing under it is listed again.
+						continue
+					}
+					subNextMarker, subErr := s3a.doListFilerEntries(ctx, client, listDirectoryRequest{dir: dir + "/" + entry.Name, marker: marker[len(entry.Name)+1:], delimiter: delimiter, bucket: bucket}, cursor, eachEntryFn)
+					if subErr != nil {
+						err = fmt.Errorf("doListFilerEntries: %w", subErr)
+						return
+					}
+					nextMarker = entry.Name + "/" + subNextMarker
+					if cursor.isTruncated {
+						return
+					}
+					continue
+				}
 				if entry.Name == s3_constants.MultipartUploadsFolder { // FIXME no need to apply to all directories. this extra also affects maxKeys
 					continue
 				}
@@ -713,6 +1340,21 @@ func (s3a *S3ApiServer) doListFilerEntries(ctx context.Context, client filer_pb.
 					}
 					// Extract object name from .versions directory name
 					baseObjectName := strings.TrimSuffix(entry.Name, s3_constants.VersionsFolder)
+					// A marker at or past the folded key already covered it.
+					if marker != "" && baseObjectName <= marker {
+						continue
+					}
+					// A page resuming from a marker inside the base key's extension
+					// region ("k.bak" sorts between "k" and "k.versions") means an
+					// earlier page already listed and settled the base null object;
+					// resolving this directory again would duplicate the key. Without
+					// a base object the key has not been listed yet, so it still
+					// resolves here.
+					if pageMarker != "" && baseObjectName < pageMarker {
+						if _, baseErr := s3a.getEntry(dir, baseObjectName); baseErr == nil {
+							continue
+						}
+					}
 					// Construct full object path relative to bucket
 					bucketFullPath := s3a.bucketDir(bucket)
 					bucketRelativePath := strings.TrimPrefix(dir, bucketFullPath)
@@ -726,87 +1368,58 @@ func (s3a *S3ApiServer) doListFilerEntries(ctx context.Context, client filer_pb.
 					// Use metadata from the already-fetched .versions directory entry
 					if latestVersionEntry, err := s3a.getLatestVersionEntryFromDirectoryEntry(bucket, fullObjectPath, entry); err == nil {
 						eachEntryFn(dir, latestVersionEntry)
-					} else if !errors.Is(err, ErrDeleteMarker) {
-						// Log unexpected errors (delete markers are expected)
+					} else if errors.Is(err, ErrDeleteMarker) {
+						// The current version is a delete marker, so a null object listed
+						// for the base path just before this directory is stale.
+						if cursor.retractEntry != nil {
+							cursor.retractEntry(dir, baseObjectName)
+						}
+					} else {
 						glog.V(2).Infof("Skipping versioned object %s due to error: %v", fullObjectPath, err)
 					}
 					continue
 				}
 
-				if delimiter != "/" || cursor.prefixEndsOnDelimiter {
-					// A trailing-slash prefix (e.g. "logs/") names one directory and asks
-					// whether it exists, so a real but empty directory must be reported for
-					// that probe.
-					explicitDirProbe := cursor.prefixEndsOnDelimiter
-					if cursor.prefixEndsOnDelimiter {
-						cursor.prefixEndsOnDelimiter = false
-					}
-					isKeyObject := entry.IsDirectoryKeyObject()
-					if isKeyObject {
-						// Directory key objects (created via PutObject with trailing "/")
-						// must appear as regular keys in recursive listing mode.
-						eachEntryFn(dir, entry)
-					}
-					// Recurse into subdirectory to list any children, noting whether the
-					// subtree produced any entries.
-					childEmitted := false
-					subNextMarker, subErr := s3a.doListFilerEntries(ctx, client, listDirectoryRequest{dir: dir + "/" + entry.Name, delimiter: delimiter, bucket: bucket}, cursor, func(d string, e *filer_pb.Entry) {
-						childEmitted = true
-						eachEntryFn(d, e)
-					})
-					if subErr != nil {
-						err = fmt.Errorf("doListFilerEntries2: %w", subErr)
-						return
-					}
-					// A real but empty directory (created out of band via mount, mkdir or
-					// the filer API, so it carries no MIME) is otherwise invisible to S3
-					// clients that detect directories by listing it under its own "<dir>/"
-					// prefix. Surface it as a directory marker for that explicit probe,
-					// identical to a directory created via PutObject with a trailing "/", so
-					// tools like hadoop-aws can find it. Plain listings are left untouched, so
-					// empty directories left behind by deleted objects are not shown as keys.
-					// A directory that still holds version history no longer names anything,
-					// so it gets no marker either.
-					if explicitDirProbe && !isKeyObject && !childEmitted && !cursor.isTruncated && entry.Attributes != nil &&
-						!s3a.dirHoldsOnlyHiddenEntries(ctx, client, bucket, dir+"/"+entry.Name, cursor) {
-						entry.Attributes.Mime = s3_constants.FolderMimeType
-						eachEntryFn(dir, entry)
-					}
-					// println("doListFilerEntries2 dir", dir+"/"+entry.Name, "subNextMarker", subNextMarker)
-					nextMarker = entry.Name + "/" + subNextMarker
-					if cursor.isTruncated {
-						return
-					}
-					if matchedPrefixDir {
-						return
-					}
-					// println("doListFilerEntries2 nextMarker", nextMarker)
-				} else if entry.IsDirectoryKeyObject() || !s3a.dirHoldsOnlyHiddenEntries(ctx, client, bucket, dir+"/"+entry.Name, cursor) {
+				pd := pendingDir{e: entry, matchedPrefixDir: matchedPrefixDir}
+				// A prefix object lists as the plain key "<name>", which sorts
+				// at the name, not at the "<name>/" block its children occupy; the
+				// deferred block emits the common prefix at its own position.
+				if entry.IsPrefixObject() && entry.Name > marker {
+					cursor.prefixObjectKeyOnly = true
 					eachEntryFn(dir, entry)
 				}
-			} else {
-				eachEntryFn(dir, entry)
-				// glog.V(4).Infof("List File Entries %s, file: %s, maxKeys %d", dir, entry.Name, cursor.maxKeys)
+				queueDir(pd)
+				continue
 			}
+			eachEntryFn(dir, entry)
+			// glog.V(4).Infof("List File Entries %s, file: %s, maxKeys %d", dir, entry.Name, cursor.maxKeys)
 			if cursor.prefixEndsOnDelimiter {
 				cursor.prefixEndsOnDelimiter = false
 			}
 		}
 
-		if cursor.isTruncated || entriesReceived < request.Limit {
+		if cursor.isTruncated || stopped {
 			return
 		}
-		marker = lastEntryName
+		if entriesReceived < request.Limit {
+			err = flushDirs("")
+			return
+		}
+		startName = lastEntryName
 		inclusiveStartFrom = false
 	}
 }
 
-// hiddenProbePageSize is the window one probe request asks the filer for, and
-// hiddenProbeBudget caps how many entries a single list request may look at while
-// deciding which directories still stand for a prefix.
+// hiddenProbePageSize is the window one probe request asks the filer for.
+// hiddenProbeBudget caps how many entries one prefix's probe may scan; it
+// resets for every candidate prefix so one large all-deleted subtree cannot
+// exhaust the allowance for later prefixes. hiddenProbeTotalBudget caps the
+// scanned entries a single listing request spends on probing overall, since a
+// page may still walk an unbounded number of all-deleted prefixes.
 const (
-	hiddenProbePageSize = 64
-	hiddenProbeBudget   = 10000
+	hiddenProbePageSize    = 64
+	hiddenProbeBudget      = 10000
+	hiddenProbeTotalBudget = 100000
 )
 
 // dirHoldsOnlyHiddenEntries reports whether dir holds entries but none that a
@@ -819,18 +1432,38 @@ const (
 //
 // The scan stops at the first key it finds, so a populated prefix costs one ListEntries
 // answered by its first entry. A subtree that is entirely delete-marked costs a walk of
-// that subtree, bounded by the request's probe budget; once the budget is spent the
-// prefix is reported, as it was before this check existed.
+// that subtree, bounded by hiddenProbeBudget entries per prefix. The budget resets for
+// each candidate prefix, so a large all-deleted subtree cannot exhaust the allowance
+// for later prefixes in the same request.
 func (s3a *S3ApiServer) dirHoldsOnlyHiddenEntries(ctx context.Context, client filer_pb.SeaweedFilerClient, bucket, dir string, cursor *ListingCursor) bool {
 	if !cursor.hideDeletedPrefixes {
 		return false
 	}
+	budget := hiddenProbeBudget
+	if cursor.probeBudget > 0 {
+		budget = cursor.probeBudget
+	}
+	totalBudget := hiddenProbeTotalBudget
+	if cursor.probeTotalBudget > 0 {
+		totalBudget = cursor.probeTotalBudget
+	}
+	return s3a.dirHoldsOnlyHiddenEntriesInner(ctx, client, bucket, dir, &budget, totalBudget, cursor)
+}
 
+// dirHoldsOnlyHiddenEntriesInner is the recursive body of dirHoldsOnlyHiddenEntries.
+// budget is shared across the recursive descent for one prefix but reset by the
+// caller for each top-level prefix, preventing cross-prefix budget exhaustion.
+// cursor.probedEntries bounds the total work one listing request spends probing.
+func (s3a *S3ApiServer) dirHoldsOnlyHiddenEntriesInner(ctx context.Context, client filer_pb.SeaweedFilerClient, bucket, dir string, budget *int, totalBudget int, cursor *ListingCursor) bool {
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
 	sawEntry := false
 	startFrom := ""
+	// A plain file is a null object that its .versions sibling, streaming later,
+	// may prove delete-marked; it stays pending until then. A pending file whose
+	// sibling window closes without one is a live key.
+	var pendingFiles []string
 	for {
 		request := &filer_pb.ListEntriesRequest{
 			Directory:         dir,
@@ -863,13 +1496,20 @@ func (s3a *S3ApiServer) dirHoldsOnlyHiddenEntries(ctx context.Context, client fi
 			startFrom = entry.Name
 			sawEntry = true
 
+			*budget--
 			cursor.probedEntries++
-			if cursor.probedEntries > hiddenProbeBudget {
+			if *budget < 0 || cursor.probedEntries > totalBudget {
 				return false
 			}
 
+			for _, pendingFile := range pendingFiles {
+				if entry.Name > pendingFile+s3_constants.VersionsFolder {
+					return false
+				}
+			}
 			if !entry.IsDirectory {
-				return false
+				pendingFiles = append(pendingFiles, entry.Name)
+				continue
 			}
 			if entry.Name == s3_constants.MultipartUploadsFolder {
 				continue
@@ -883,6 +1523,15 @@ func (s3a *S3ApiServer) dirHoldsOnlyHiddenEntries(ctx context.Context, client fi
 				// serving this list - and an unknown object keeps its prefix rather than
 				// turning one listing into a version rescan per object.
 				if isDeleteMarker, stamped := entry.Extended[s3_constants.ExtLatestVersionIsDeleteMarker]; stamped && string(isDeleteMarker) == "true" {
+					// The marker also hides the null object the key left at the base path.
+					base := strings.TrimSuffix(entry.Name, s3_constants.VersionsFolder)
+					kept := pendingFiles[:0]
+					for _, pendingFile := range pendingFiles {
+						if pendingFile != base {
+							kept = append(kept, pendingFile)
+						}
+					}
+					pendingFiles = kept
 					continue
 				}
 				return false
@@ -890,13 +1539,13 @@ func (s3a *S3ApiServer) dirHoldsOnlyHiddenEntries(ctx context.Context, client fi
 			if entry.IsDirectoryKeyObject() {
 				return false
 			}
-			if !s3a.dirHoldsOnlyHiddenEntries(ctx, client, bucket, dir+"/"+entry.Name, cursor) {
+			if !s3a.dirHoldsOnlyHiddenEntriesInner(ctx, client, bucket, dir+"/"+entry.Name, budget, totalBudget, cursor) {
 				return false
 			}
 		}
 
 		if entriesReceived < request.Limit {
-			return sawEntry
+			return sawEntry && len(pendingFiles) == 0
 		}
 	}
 }
@@ -907,16 +1556,9 @@ func getListObjectsV2Args(values url.Values) (prefix, startAfter, delimiter stri
 	startAfter = values.Get("start-after")
 	delimiter = values.Get("delimiter")
 	encodingTypeUrl = values.Get("encoding-type") == s3.EncodingTypeUrl
-	if values.Get("max-keys") != "" {
-		if maxKeys, err := strconv.ParseUint(values.Get("max-keys"), 10, 16); err == nil {
-			maxkeys = uint16(maxKeys)
-		} else {
-			// Invalid max-keys value (non-numeric)
-			errCode = s3err.ErrInvalidMaxKeys
-			return
-		}
-	} else {
-		maxkeys = maxObjectListSizeLimit
+	maxkeys, errCode = parseMaxKeys(values.Get("max-keys"))
+	if errCode != s3err.ErrNone {
+		return
 	}
 	fetchOwner = values.Get("fetch-owner") == "true"
 	allowUnordered = values.Get("allow-unordered") == "true"
@@ -924,27 +1566,37 @@ func getListObjectsV2Args(values url.Values) (prefix, startAfter, delimiter stri
 	return
 }
 
-func getListObjectsV1Args(values url.Values) (prefix, marker, delimiter string, encodingTypeUrl bool, maxkeys int16, allowUnordered bool, errCode s3err.ErrorCode) {
+func getListObjectsV1Args(values url.Values) (prefix, marker, delimiter string, encodingTypeUrl bool, maxkeys uint16, allowUnordered bool, errCode s3err.ErrorCode) {
 	prefix = values.Get("prefix")
 	marker = values.Get("marker")
 	delimiter = values.Get("delimiter")
 	encodingTypeUrl = values.Get("encoding-type") == "url"
-	if values.Get("max-keys") != "" {
-		if maxKeys, err := strconv.ParseInt(values.Get("max-keys"), 10, 16); err == nil {
-			maxkeys = int16(maxKeys)
-		} else {
-			// Invalid max-keys value (non-numeric)
-			errCode = s3err.ErrInvalidMaxKeys
-			return
-		}
-	} else {
-		maxkeys = maxObjectListSizeLimit
+	maxkeys, errCode = parseMaxKeys(values.Get("max-keys"))
+	if errCode != s3err.ErrNone {
+		return
 	}
 	allowUnordered = values.Get("allow-unordered") == "true"
 	errCode = s3err.ErrNone
 	return
 }
 
+// parseMaxKeys parses the max-keys query parameter. Like AWS S3, any integer in
+// [0, 2147483647] is accepted and the page size is capped at maxObjectListSizeLimit;
+// an empty value means the default limit, anything else is ErrInvalidMaxKeys.
+func parseMaxKeys(value string) (uint16, s3err.ErrorCode) {
+	if value == "" {
+		return maxObjectListSizeLimit, s3err.ErrNone
+	}
+	maxKeys, err := strconv.ParseInt(value, 10, 32)
+	if err != nil || maxKeys < 0 {
+		return 0, s3err.ErrInvalidMaxKeys
+	}
+	if maxKeys > maxObjectListSizeLimit {
+		return maxObjectListSizeLimit, s3err.ErrNone
+	}
+	return uint16(maxKeys), s3err.ErrNone
+}
+
 // compareWithDelimiter compares two strings for sorting, treating the delimiter character
 // as having lower precedence than other characters to match AWS S3 behavior.
 // For example, with delimiter '/', 'foo/' should come before 'foo+1/' even though '+' < '/' in ASCII.
@@ -1001,18 +1653,32 @@ func compareWithDelimiter(a, b, delimiter string) bool {
 // but still finds any "bop" or later entries. We add a high ASCII character rather than incrementing
 // the last character to avoid skipping potential directory entries.
 // This is essential for correct S3 list operations with delimiters and CommonPrefixes.
-func adjustMarkerForDelimiter(marker, delimiter string) string {
+// A marker equal to the prefix names no subtree to skip: it excludes only the prefix's own
+// key. Leading slashes are insignificant here, as they are to normalizePrefixMarker.
+func adjustMarkerForDelimiter(marker, prefix, delimiter string) string {
 	if delimiter == "" || !strings.HasSuffix(marker, delimiter) {
 		return marker
 	}
+	if strings.TrimLeft(marker, "/") == strings.TrimLeft(prefix, "/") {
+		return marker
+	}
+
+	// A marker ending on "/" already names the bound past that directory's
+	// block — the walk reads "boo/" as "the boo/ block is done". Trimming it
+	// to the bare name would sort inside the (name, name/) band instead and
+	// reopen the block. Other delimiters have no matching directory boundary,
+	// so their markers still need the trim below.
+	if delimiter == "/" {
+		return marker
+	}
 
 	// Remove the trailing delimiter
 	// This ensures we skip all entries under the prefix but don't skip
 	// potential directory entries that start with a similar prefix
-	prefix := strings.TrimSuffix(marker, delimiter)
-	if len(prefix) == 0 {
+	trimmed := strings.TrimSuffix(marker, delimiter)
+	if len(trimmed) == 0 {
 		return marker
 	}
 
-	return prefix
+	return trimmed
 }
diff --git a/weed/s3api/s3api_object_handlers_list_deleted_prefix_test.go b/weed/s3api/s3api_object_handlers_list_deleted_prefix_test.go
index ce3b02c3af..1a635f21cf 100644
--- a/weed/s3api/s3api_object_handlers_list_deleted_prefix_test.go
+++ b/weed/s3api/s3api_object_handlers_list_deleted_prefix_test.go
@@ -101,6 +101,34 @@ func TestLivePrefixIsStillACommonPrefix(t *testing.T) {
 	assert.Equal(t, []string{"20260102"}, seen, "only the date prefix with a current version is listed")
 }
 
+// TestDeletedPrefixWithNullObjectIsNotACommonPrefix covers a key written before
+// versioning was enabled: the delete marker leaves its null object at the base
+// path, and that file must not keep the prefix alive.
+func TestDeletedPrefixWithNullObjectIsNotACommonPrefix(t *testing.T) {
+	nullObject := &filer_pb.Entry{Name: "manifest", Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: 6}}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/test":        {newDir("backup")},
+			"/buckets/test/backup": {nullObject, deleteMarkedVersionsDir("manifest")},
+		},
+	}
+
+	seen := listedNames(t, client, listDirectoryRequest{dir: "/buckets/test", delimiter: "/", bucket: "test"}, &ListingCursor{maxKeys: 1000, hideDeletedPrefixes: true})
+	assert.Empty(t, seen, "the null object is shadowed by the delete marker, so nothing under the prefix is a key")
+
+	// A second, unshadowed null object keeps the prefix live.
+	liveNull := &filer_pb.Entry{Name: "kept", Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: 6}}
+	client = &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/test":        {newDir("backup")},
+			"/buckets/test/backup": {liveNull, nullObject, deleteMarkedVersionsDir("manifest")},
+		},
+	}
+
+	seen = listedNames(t, client, listDirectoryRequest{dir: "/buckets/test", delimiter: "/", bucket: "test"}, &ListingCursor{maxKeys: 1000, hideDeletedPrefixes: true})
+	assert.Equal(t, []string{"backup"}, seen)
+}
+
 // TestDeletedPrefixGetsNoDirectoryMarker checks the trailing-slash probe. The empty
 // directory marker exists for directories created out of band; a directory that only
 // holds version history names nothing, so the probe answers empty like AWS does.
@@ -222,3 +250,82 @@ func TestDeletedPrefixesDoNotConsumeMaxKeys(t *testing.T) {
 	assert.False(t, cursor.isTruncated, "stepping over deleted prefixes must not truncate the page")
 	assert.Zero(t, cursor.maxKeys, "only the live prefixes may spend the page budget")
 }
+
+// TestPerPrefixBudgetNotShared is a regression test for the bug reported in issue #10847:
+// one large all-deleted prefix exhausts the shared probe budget, causing every later
+// prefix to be reported as visible even when all its objects are delete-marked.
+//
+// The fix gives each candidate prefix its own probe budget (hiddenProbeBudget, 10000 by
+// default). The test sets cursor.probeBudget = 3 to stay fast without touching the
+// package-level constant.
+func TestPerPrefixBudgetNotShared(t *testing.T) {
+	// Build 5 delete-marked objects under "bigdeleted/" – more than the budget of 3.
+	bigDeletedEntries := make([]*filer_pb.Entry, 0, 5)
+	for i := 0; i < 5; i++ {
+		bigDeletedEntries = append(bigDeletedEntries, deleteMarkedVersionsDir(
+			"obj"+strconv.Itoa(i),
+		))
+	}
+
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/test": {
+				newDir("bigdeleted"),
+				newDir("emptydeleted"),
+				newDir("live"),
+			},
+			"/buckets/test/bigdeleted":   bigDeletedEntries,
+			"/buckets/test/emptydeleted": {deleteMarkedVersionsDir("obj")},
+			"/buckets/test/live":         {liveVersionsDir("obj")},
+		},
+	}
+
+	// probeBudget: 3 simulates the bug scenario with a tiny dataset; real default is
+	// hiddenProbeBudget (10000).
+	seen := listedNames(t, client, listDirectoryRequest{dir: "/buckets/test", delimiter: "/", bucket: "test"},
+		&ListingCursor{maxKeys: 1000, hideDeletedPrefixes: true, probeBudget: 3})
+
+	// "bigdeleted" exhausted its own probe budget, so it is reported rather than
+	// proven all-deleted.
+	assert.Contains(t, seen, "bigdeleted", "a prefix whose probe budget ran out must be reported")
+
+	// "emptydeleted" must be hidden: all its objects are delete-marked and its probe
+	// budget was not exhausted by "bigdeleted".
+	assert.NotContains(t, seen, "emptydeleted", "all-deleted prefix after a budget-exhausting prefix must still be hidden")
+
+	// "live" must always appear.
+	assert.Contains(t, seen, "live", "prefix with a live current version must be listed")
+}
+
+// TestPerRequestProbeBudgetStillBoundsWork covers the request-wide ceiling:
+// deleted prefixes do not spend maxKeys, so a page can walk an unbounded
+// number of them. Once probedEntries exceeds the request total, a later
+// all-deleted prefix is reported rather than proven.
+func TestPerRequestProbeBudgetStillBoundsWork(t *testing.T) {
+	deleted := func(n int) []*filer_pb.Entry {
+		entries := make([]*filer_pb.Entry, 0, n)
+		for i := 0; i < n; i++ {
+			entries = append(entries, deleteMarkedVersionsDir("obj"+strconv.Itoa(i)))
+		}
+		return entries
+	}
+
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/test": {
+				newDir("d1"),
+				newDir("d2"),
+			},
+			"/buckets/test/d1": deleted(4),
+			"/buckets/test/d2": deleted(4),
+		},
+	}
+
+	// Per-prefix budget (10) can cover either prefix alone, but the request
+	// total (5) is spent probing "d1", so "d2" is reported without a full scan.
+	seen := listedNames(t, client, listDirectoryRequest{dir: "/buckets/test", delimiter: "/", bucket: "test"},
+		&ListingCursor{maxKeys: 1000, hideDeletedPrefixes: true, probeBudget: 10, probeTotalBudget: 5})
+
+	assert.NotContains(t, seen, "d1", "a fully probed all-deleted prefix stays hidden")
+	assert.Contains(t, seen, "d2", "a prefix probed past the request total is reported")
+}
diff --git a/weed/s3api/s3api_object_handlers_list_directory_marker_test.go b/weed/s3api/s3api_object_handlers_list_directory_marker_test.go
index fe5ab2c7ed..d3b3789761 100644
--- a/weed/s3api/s3api_object_handlers_list_directory_marker_test.go
+++ b/weed/s3api/s3api_object_handlers_list_directory_marker_test.go
@@ -123,3 +123,19 @@ func TestDirectoryMarkersCostNoLookups(t *testing.T) {
 	assert.Equal(t, []string{"d1", "d2", "d3"}, seen)
 	assert.Equal(t, 1, client.calls, "listing directory markers must not cost a round trip per marker")
 }
+
+// TestDirectoryMarkerWithBodyListsItsSize covers a trailing-slash key PUT with a body:
+// the body is kept inline in the directory entry, which has no FileSize, and GET/HEAD
+// already report its length.
+func TestDirectoryMarkerWithBodyListsItsSize(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+	entry := directoryMarker("m2")
+	entry.Content = []byte("marker body")
+
+	listed := newListEntry(s3a, entry, "", "/buckets/test", "m2", "/buckets/test/", false, true, false)
+	assert.Equal(t, "m2/", listed.Key)
+	assert.Equal(t, int64(len("marker body")), listed.Size)
+
+	listed = newListEntry(s3a, directoryMarker("m3"), "", "/buckets/test", "m3", "/buckets/test/", false, true, false)
+	assert.Equal(t, int64(0), listed.Size)
+}
diff --git a/weed/s3api/s3api_object_handlers_list_directory_test.go b/weed/s3api/s3api_object_handlers_list_directory_test.go
index e4e65500a0..d74a75d980 100644
--- a/weed/s3api/s3api_object_handlers_list_directory_test.go
+++ b/weed/s3api/s3api_object_handlers_list_directory_test.go
@@ -3,10 +3,11 @@ package s3api
 import (
 	"context"
 	"testing"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 // TestDirectoryListedAsCommonPrefix tests that regular directories (without MIME)
@@ -64,12 +65,11 @@ func TestDirectoryListedAsCommonPrefix(t *testing.T) {
 	assert.Empty(t, seenFiles, "No files should be seen, only the directory")
 }
 
-// TestEmptyDirectorySurfacedAsMarker reproduces the hadoop-aws / Spark case where a
-// real but empty directory (created via mount, mkdir or the filer API, so it has no
-// MIME) must be visible to S3 clients that detect directories by listing under the
-// "<dir>/" prefix. Such a directory is surfaced as a directory marker, identical to
-// one created via PutObject with a trailing "/".
-func TestEmptyDirectorySurfacedAsMarker(t *testing.T) {
+// TestEmptyDirectoryNotListedUnderOwnPrefix covers the explicit "<dir>/" probe
+// on a real but empty directory (created via mount, mkdir or the filer API, so
+// it has no MIME): it is listed under its own prefix in neither delimited nor
+// recursive mode, matching S3 where an empty prefix has no key to return.
+func TestEmptyDirectoryNotListedUnderOwnPrefix(t *testing.T) {
 	s3a := &S3ApiServer{
 		option: &S3ApiServerOption{BucketsPath: "/buckets"},
 	}
@@ -86,19 +86,15 @@ func TestEmptyDirectorySurfacedAsMarker(t *testing.T) {
 		},
 	}
 
-	// Mirrors the getFileStatus probe: prefix "logs/" with delimiter "/".
-	cursor := &ListingCursor{maxKeys: 1000, prefixEndsOnDelimiter: true}
-	var seen []*filer_pb.Entry
-	_, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/test", prefix: "logs", delimiter: "/", bucket: "test"}, cursor,
-		func(dir string, entry *filer_pb.Entry) {
-			seen = append(seen, entry)
-		})
-
-	assert.NoError(t, err)
-	if assert.Len(t, seen, 1, "empty directory must be surfaced under the logs/ prefix") {
-		assert.True(t, seen[0].IsDirectoryKeyObject(),
-			"empty directory must be marked as a directory key object so it lists as logs/")
-		assert.Equal(t, s3_constants.FolderMimeType, seen[0].Attributes.Mime)
+	for _, delimiter := range []string{"/", ""} {
+		cursor := &ListingCursor{maxKeys: 1000, prefixEndsOnDelimiter: true}
+		var seen []*filer_pb.Entry
+		_, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/test", prefix: "logs", delimiter: delimiter, bucket: "test"}, cursor,
+			func(dir string, entry *filer_pb.Entry) {
+				seen = append(seen, entry)
+			})
+		assert.NoError(t, err)
+		assert.Empty(t, seen, "an empty directory reports nothing under its own prefix (delimiter %q)", delimiter)
 	}
 }
 
@@ -182,3 +178,29 @@ func TestEmptyDirectoryHiddenInFlatListing(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, []string{"foo"}, seen, "flat listing must hide the empty directory and return only real objects")
 }
+
+// A trailing-slash delimited listing of an empty directory enumerates its
+// children, so it returns nothing: the directory is neither a readable Contents
+// key nor a CommonPrefix of its own.
+func TestEmptyDirectoryHiddenInDelimitedSelfListing(t *testing.T) {
+	filer := &fakeBucketDeleteFiler{entriesByDir: map[string][]*filer_pb.Entry{
+		"/buckets/test": {
+			{Name: "locks", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: ""}},
+		},
+		"/buckets/test/locks": {},
+	}}
+	s3a := newFailoverTestServer(t, startFakeFiler(t, filer))
+	s3a.option.BucketsPath = "/buckets"
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set("test", &BucketConfig{Name: "test"})
+
+	response, err := s3a.listFilerEntries(context.Background(), listObjectsRequest{
+		bucket:    "test",
+		prefix:    "locks/",
+		delimiter: "/",
+		maxKeys:   1000,
+	})
+	require.NoError(t, err)
+	assert.Empty(t, response.Contents, "an empty directory is not a readable key")
+	assert.Empty(t, response.CommonPrefixes, "an empty directory has no prefixes to fold into")
+}
diff --git a/weed/s3api/s3api_object_handlers_list_marker_before_prefix_test.go b/weed/s3api/s3api_object_handlers_list_marker_before_prefix_test.go
new file mode 100644
index 0000000000..98589883a0
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_list_marker_before_prefix_test.go
@@ -0,0 +1,163 @@
+package s3api
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+)
+
+// A marker that sorts before the prefix excludes nothing under the prefix, so the
+// listing must be the one with no marker. docker/distribution's S3 driver sends
+// exactly this shape: prefix "<root>/<path>/" with start-after "<root>".
+func Test_markerSortsBeforePrefix(t *testing.T) {
+	tests := []struct {
+		name   string
+		prefix string
+		marker string
+		want   bool
+	}{
+		{"marker is the root directory the prefix walks under", "docker/registry/", "docker", true},
+		{"marker is the prefix directory without its slash", "docker/registry/", "docker/registry", true},
+		{"marker is an unrelated earlier key", "docker/registry/", "a", true},
+		{"marker is an earlier sibling", "docker/registry/", "docker/regisr", true},
+		{"leading slashes are ignored on both sides", "/docker/registry/", "/docker", true},
+		{"empty marker is not a cutoff", "docker/registry/", "", false},
+		{"empty prefix: every key is in scope, marker stands", "", "docker", false},
+		{"marker under the prefix resumes inside it", "docker/registry/", "docker/registry/v2/link", false},
+		{"marker equal to the prefix stands", "docker/registry/", "docker/registry/", false},
+		{"marker after the prefix's subtree stands", "docker/registry/", "docker/registryx", false},
+		{"partial name prefix: a later match-set marker stands", "parent", "parentDir/data/0e", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, markerSortsBeforePrefix(tt.prefix, tt.marker), "markerSortsBeforePrefix(%q, %q)", tt.prefix, tt.marker)
+		})
+	}
+}
+
+// A marker that sorts past the prefix leaves no key under the prefix to resume
+// at, so the listing is empty instead of continuing into later prefixes.
+func Test_markerSortsPastPrefix(t *testing.T) {
+	tests := []struct {
+		name   string
+		prefix string
+		marker string
+		want   bool
+	}{
+		{"marker is a later directory", "b/", "c/", true},
+		{"marker is a later key without a slash", "b/", "c", true},
+		{"marker shares the parent dir but sorts past", "data/a", "data/b", true},
+		{"marker diverges after the prefix", "b/", "b0/x", true},
+		{"leading slashes are ignored on both sides", "/b/", "/c/", true},
+		{"empty marker is in range", "b/", "", false},
+		{"empty prefix: every key is in scope", "", "c/", false},
+		{"marker under the prefix resumes inside it", "b/", "b/allowed-1", false},
+		{"marker equal to the prefix stands", "b/", "b/", false},
+		{"partial name prefix: marker under the match set stands", "parent", "parentDir/data/0e", false},
+		{"marker before the prefix is not past it", "b/", "a/", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, markerSortsPastPrefix(tt.prefix, tt.marker), "markerSortsPastPrefix(%q, %q)", tt.prefix, tt.marker)
+		})
+	}
+}
+
+// TestListWithMarkerPastPrefix walks the listing the way listFilerEntries does
+// for a start position past the requested prefix. normalizePrefixMarker hands
+// such a marker through at the bucket root, where the walk's marker descent
+// would otherwise drop the prefix filter and continue into a later prefix.
+func TestListWithMarkerPastPrefix(t *testing.T) {
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/test":     {newDir("a"), newDir("b"), newDir("c")},
+			"/buckets/test/b":   {{Name: "allowed-1", Attributes: &filer_pb.FuseAttributes{}}},
+			"/buckets/test/c":   {{Name: "other-2", Attributes: &filer_pb.FuseAttributes{}}},
+			"/buckets/test/c/z": {{Name: "deep", Attributes: &filer_pb.FuseAttributes{}}},
+		},
+	}
+
+	for _, tt := range []struct {
+		name   string
+		marker string
+		want   []string
+	}{
+		{"marker is a later directory", "c/", nil},
+		{"marker is a deeper path in a later directory", "c/z", nil},
+		{"marker is a later bare key", "c", nil},
+		{"marker inside the prefix resumes normally", "b/", []string{"allowed-1"}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			requestDir, entryPrefix, entryMarker, prefixEndsOnDelimiter := normalizePrefixMarker("b/", tt.marker)
+			dir := "/buckets/test"
+			if requestDir != "" {
+				dir += "/" + requestDir
+			}
+			seen := listedNames(t, client, listDirectoryRequest{
+				dir:    dir,
+				prefix: entryPrefix,
+				marker: entryMarker,
+				bucket: "test",
+			}, &ListingCursor{maxKeys: 1000, prefixEndsOnDelimiter: prefixEndsOnDelimiter})
+			assert.Equal(t, tt.want, seen)
+		})
+	}
+}
+
+// A marker ending on the delimiter is trimmed to a shorter cutoff for the walk, which no
+// longer excludes the key the client named, so that key is skipped as it streams.
+func Test_excludedMarkerKey(t *testing.T) {
+	tests := []struct {
+		name          string
+		requestMarker string
+		marker        string
+		want          string
+	}{
+		{"marker trimmed to a shorter cutoff", "docker/", "docker", "docker/"},
+		{"leading slashes are dropped, as the keys carry none", "/docker/", "docker", "docker/"},
+		{"untrimmed marker: the walk already excludes it", "docker", "docker", ""},
+		{"no marker", "", "", ""},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, excludedMarkerKey(tt.requestMarker, tt.marker), "excludedMarkerKey(%q, %q)", tt.requestMarker, tt.marker)
+		})
+	}
+}
+
+// TestListWithMarkerBeforePrefix walks the whole listing path the way listFilerEntries
+// does, for the two start-after values a registry sends against the same prefix.
+func TestListWithMarkerBeforePrefix(t *testing.T) {
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/registry/docker/registry/v2":              {newDir("repositories")},
+			"/buckets/registry/docker/registry/v2/repositories": {newDir("app")},
+			"/buckets/registry/docker/registry/v2/repositories/app": {
+				{Name: "link", Attributes: &filer_pb.FuseAttributes{}},
+			},
+		},
+	}
+	prefix := "docker/registry/v2/repositories/"
+
+	for _, tt := range []struct {
+		name   string
+		marker string
+	}{
+		{"start-after is the root directory the walk starts from", "docker"},
+		{"start-after is the prefix itself", prefix},
+		{"start-after is the prefix with a leading slash", "/" + prefix},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			marker := adjustMarkerForDelimiter(tt.marker, prefix, "/")
+			requestDir, entryPrefix, entryMarker, prefixEndsOnDelimiter := normalizePrefixMarker(prefix, marker)
+			seen := listedNames(t, client, listDirectoryRequest{
+				dir:    "/buckets/registry/" + requestDir,
+				prefix: entryPrefix,
+				marker: entryMarker,
+				bucket: "registry",
+			}, &ListingCursor{maxKeys: 1000, prefixEndsOnDelimiter: prefixEndsOnDelimiter})
+			assert.Equal(t, []string{"link"}, seen)
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_list_regression_test.go b/weed/s3api/s3api_object_handlers_list_regression_test.go
new file mode 100644
index 0000000000..72d4066189
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_list_regression_test.go
@@ -0,0 +1,125 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"sort"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Exercise the response builder as well as the directory walker: deferred
+// directory resume markers can make the outer loop repeat prefixes.
+// Derive the expected response from S3 keys, independently of filer traversal.
+func TestListFilerEntriesListingRegression(t *testing.T) {
+	keys := []string{
+		"a", "a-c", "a.txt", "a/b", "a/c/d", "a0",
+		"boo/bar", "boo/baz", "boo/boo", "boo/boo2",
+		"foo_bar", "foo_bar_baz", "foo_baz", "logs/", "quux ab", "space dir/value", "z",
+	}
+	sort.Strings(keys)
+	prefixObject := newDir("a")
+	prefixObject.MarkPrefixObject()
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	filer := &fakeBucketDeleteFiler{entriesByDir: map[string][]*filer_pb.Entry{
+		"/buckets/test": {
+			prefixObject, file("a-c"), file("a.txt"), file("a0"), newDir("boo"),
+			file("foo_bar"), file("foo_bar_baz"), file("foo_baz"),
+			directoryMarker("logs"), file("quux ab"), newDir("space dir"), file("z"),
+		},
+		"/buckets/test/a":         {file("b"), newDir("c")},
+		"/buckets/test/a/c":       {file("d")},
+		"/buckets/test/boo":       {file("bar"), file("baz"), file("boo"), file("boo2")},
+		"/buckets/test/logs":      {},
+		"/buckets/test/space dir": {file("value")},
+	}}
+	s3a := newFailoverTestServer(t, startFakeFiler(t, filer))
+	s3a.option.BucketsPath = "/buckets"
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	for _, versioning := range []string{"", "Enabled", "Suspended"} {
+		t.Run("versioning="+versioning, func(t *testing.T) {
+			s3a.bucketConfigCache.Set("test", &BucketConfig{Name: "test", Versioning: versioning})
+			for _, encoded := range []bool{false, true} {
+				t.Run(fmt.Sprintf("encoded=%t", encoded), func(t *testing.T) {
+					testListingRegressionMatrix(t, s3a, keys, encoded)
+				})
+			}
+		})
+	}
+}
+
+func testListingRegressionMatrix(t *testing.T, s3a *S3ApiServer, keys []string, encoded bool) {
+	t.Helper()
+	for _, prefix := range []string{"", "a", "a/", "a/c/", "boo", "boo/", "boo/b", "foo", "foo_", "logs/", "space dir/", "missing/"} {
+		for _, delimiter := range []string{"", "/", "_"} {
+			for _, pageSize := range []uint16{1, 2, 1000} {
+				t.Run(fmt.Sprintf("prefix=%s/delimiter=%s/max=%d", prefix, delimiter, pageSize), func(t *testing.T) {
+					var wantKeys, wantPrefixes []string
+					prefixes := map[string]bool{}
+					for _, key := range keys {
+						if !strings.HasPrefix(key, prefix) {
+							continue
+						}
+						if delimiter != "" {
+							if i := strings.Index(strings.TrimPrefix(key, prefix), delimiter); i >= 0 {
+								prefixes[key[:len(prefix)+i+len(delimiter)]] = true
+								continue
+							}
+						}
+						wantKeys = append(wantKeys, key)
+					}
+					for p := range prefixes {
+						wantPrefixes = append(wantPrefixes, p)
+					}
+					sort.Strings(wantKeys)
+					sort.Strings(wantPrefixes)
+
+					var gotKeys, gotPrefixes []string
+					marker := ""
+					for page := 0; ; page++ {
+						require.Less(t, page, len(keys)+1, "listing did not terminate")
+						response, err := s3a.listFilerEntries(context.Background(), listObjectsRequest{
+							bucket: "test", prefix: prefix, delimiter: delimiter,
+							marker:        adjustMarkerForDelimiter(marker, prefix, delimiter),
+							requestMarker: marker, maxKeys: pageSize,
+							encodingTypeUrl: encoded,
+						})
+						require.NoError(t, err)
+						decode := func(value string) string {
+							if !encoded {
+								return value
+							}
+							decoded, err := url.QueryUnescape(value)
+							require.NoError(t, err)
+							return decoded
+						}
+						for _, entry := range response.Contents {
+							gotKeys = append(gotKeys, decode(entry.Key))
+						}
+						for _, entry := range response.CommonPrefixes {
+							gotPrefixes = append(gotPrefixes, decode(entry.Prefix))
+						}
+						if !response.IsTruncated {
+							break
+						}
+						require.Greater(t, response.NextMarker, marker, "pagination must advance")
+						marker = response.NextMarker
+					}
+					// Sorting retains duplicates, so repeated prefixes still fail.
+					sort.Strings(gotKeys)
+					sort.Strings(gotPrefixes)
+					assert.Equal(t, wantKeys, gotKeys)
+					assert.Equal(t, wantPrefixes, gotPrefixes)
+				})
+			}
+		}
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_list_test.go b/weed/s3api/s3api_object_handlers_list_test.go
index 9cffaee857..a53e3421a4 100644
--- a/weed/s3api/s3api_object_handlers_list_test.go
+++ b/weed/s3api/s3api_object_handlers_list_test.go
@@ -4,11 +4,13 @@ import (
 	"context"
 	"io"
 	"net/http/httptest"
+	"os"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/stretchr/testify/assert"
 	grpc "google.golang.org/grpc"
@@ -72,6 +74,15 @@ func (c *testFilerClient) ListEntries(ctx context.Context, in *filer_pb.ListEntr
 	return &testListEntriesStream{entries: entries}, nil
 }
 
+func (c *testFilerClient) LookupDirectoryEntry(ctx context.Context, in *filer_pb.LookupDirectoryEntryRequest, opts ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	for _, e := range c.entriesByDir[in.Directory] {
+		if e.Name == in.Name {
+			return &filer_pb.LookupDirectoryEntryResponse{Entry: e}, nil
+		}
+	}
+	return nil, filer_pb.ErrNotFound
+}
+
 type markerEchoFilerClient struct {
 	filer_pb.SeaweedFilerClient
 	entriesByDir    map[string][]*filer_pb.Entry
@@ -89,18 +100,31 @@ func (c *markerEchoFilerClient) ListEntries(ctx context.Context, in *filer_pb.Li
 		return &testListEntriesStream{entries: entries}, nil
 	}
 
-	for i, e := range entries {
-		if e.Name == in.StartFromFileName {
-			// Emulate buggy backend behavior: return marker again even when exclusive.
-			if c.returnFollowing {
-				echoAndFollowing := entries[i:]
-				return &testListEntriesStream{entries: echoAndFollowing}, nil
-			}
-			return &testListEntriesStream{entries: []*filer_pb.Entry{e}}, nil
+	filtered := make([]*filer_pb.Entry, 0, len(entries))
+	for _, e := range entries {
+		if e.Name > in.StartFromFileName || (in.InclusiveStartFrom && e.Name == in.StartFromFileName) {
+			filtered = append(filtered, e)
 		}
 	}
-
-	return &testListEntriesStream{entries: nil}, nil
+	// Emulate buggy backend behavior: echo the start entry again even when the
+	// request did not ask for it.
+	if !in.InclusiveStartFrom {
+		var echo *filer_pb.Entry
+		for _, e := range entries {
+			if e.Name == in.StartFromFileName {
+				echo = e
+				break
+			}
+		}
+		if echo != nil {
+			if c.returnFollowing {
+				filtered = append([]*filer_pb.Entry{echo}, filtered...)
+			} else {
+				filtered = []*filer_pb.Entry{echo}
+			}
+		}
+	}
+	return &testListEntriesStream{entries: filtered}, nil
 }
 
 func ensureEntryAttributes(entries []*filer_pb.Entry) {
@@ -119,7 +143,7 @@ func TestListObjectsHandler(t *testing.T) {
 	// https://docs.aws.amazon.com/AmazonS3/latest/API/v2-RESTBucketGET.html
 
 	expected := `<?xml version="1.0" encoding="UTF-8"?>
-<ListBucketResult><Name>test_container</Name><Prefix></Prefix><Marker></Marker><MaxKeys>1000</MaxKeys><IsTruncated>false</IsTruncated><Contents><Key>1.zip</Key><ETag>&#34;4397da7a7649e8085de9916c240e8166&#34;</ETag><Size>1234567</Size><Owner><ID>65a011niqo39cdf8ec533ec3d1ccaafsa932</ID></Owner><StorageClass>STANDARD</StorageClass><LastModified>2011-04-09T12:34:49Z</LastModified></Contents><EncodingType></EncodingType></ListBucketResult>`
+<ListBucketResult><Name>test_container</Name><Prefix></Prefix><Marker></Marker><MaxKeys>1000</MaxKeys><IsTruncated>false</IsTruncated><Contents><Key>1.zip</Key><ETag>&#34;4397da7a7649e8085de9916c240e8166&#34;</ETag><Size>1234567</Size><Owner><ID>65a011niqo39cdf8ec533ec3d1ccaafsa932</ID></Owner><StorageClass>STANDARD</StorageClass><LastModified>2011-04-09T12:34:49.000Z</LastModified></Contents><EncodingType></EncodingType></ListBucketResult>`
 
 	response := ListBucketResult{
 		Name:        "test_container",
@@ -166,11 +190,12 @@ func Test_normalizePrefixMarker(t *testing.T) {
 		marker string
 	}
 	tests := []struct {
-		name              string
-		args              args
-		wantAlignedDir    string
-		wantAlignedPrefix string
-		wantAlignedMarker string
+		name                      string
+		args                      args
+		wantAlignedDir            string
+		wantAlignedPrefix         string
+		wantAlignedMarker         string
+		wantPrefixEndsOnDelimiter bool
 	}{
 		{"bucket root listing with delimiter",
 			args{"/",
@@ -178,6 +203,7 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"",
 			"",
 			"",
+			true,
 		},
 		{"prefix is a directory",
 			args{"/parentDir/data/",
@@ -185,6 +211,7 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"parentDir",
 			"data",
 			"",
+			true,
 		},
 		{"normal case",
 			args{"/parentDir/data/0",
@@ -192,6 +219,7 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"parentDir/data",
 			"0",
 			"0e/0e149049a2137b0cc12e",
+			false,
 		},
 		{"empty prefix",
 			args{"",
@@ -199,6 +227,7 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"",
 			"",
 			"parentDir/data/0e/0e149049a2137b0cc12e",
+			false,
 		},
 		{"empty directory",
 			args{"parent",
@@ -206,6 +235,7 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"",
 			"parent",
 			"parentDir/data/0e/0e149049a2137b0cc12e",
+			false,
 		},
 		{"partial name prefix, marker resumes inside a matching subdirectory",
 			args{"data/a",
@@ -213,6 +243,7 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"data",
 			"a",
 			"a/1",
+			false,
 		},
 		{"partial name prefix, marker resumes inside a matching sibling directory",
 			args{"data/a",
@@ -220,6 +251,7 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"data",
 			"a",
 			"ab/1",
+			false,
 		},
 		{"top-level partial name prefix, marker resumes inside a matching subdirectory",
 			args{"a",
@@ -227,14 +259,32 @@ func Test_normalizePrefixMarker(t *testing.T) {
 			"",
 			"a",
 			"a/1",
+			false,
+		},
+		{"marker sorts before the prefix, so it excludes nothing under it",
+			args{"parentDir/data/",
+				"parentDir"},
+			"parentDir",
+			"data",
+			"",
+			true,
+		},
+		{"marker is the prefix directory, whose own key it excludes",
+			args{"parentDir/data/",
+				"parentDir/data/"},
+			"parentDir/data",
+			"",
+			"",
+			false,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			gotAlignedDir, gotAlignedPrefix, gotAlignedMarker := normalizePrefixMarker(tt.args.prefix, tt.args.marker)
+			gotAlignedDir, gotAlignedPrefix, gotAlignedMarker, gotPrefixEndsOnDelimiter := normalizePrefixMarker(tt.args.prefix, tt.args.marker)
 			assert.Equalf(t, tt.wantAlignedDir, gotAlignedDir, "normalizePrefixMarker(%v, %v)", tt.args.prefix, tt.args.marker)
 			assert.Equalf(t, tt.wantAlignedPrefix, gotAlignedPrefix, "normalizePrefixMarker(%v, %v)", tt.args.prefix, tt.args.marker)
 			assert.Equalf(t, tt.wantAlignedMarker, gotAlignedMarker, "normalizePrefixMarker(%v, %v)", tt.args.prefix, tt.args.marker)
+			assert.Equalf(t, tt.wantPrefixEndsOnDelimiter, gotPrefixEndsOnDelimiter, "normalizePrefixMarker(%v, %v)", tt.args.prefix, tt.args.marker)
 		})
 	}
 }
@@ -388,6 +438,50 @@ func TestDoListFilerEntries_ExclusiveStartSkipsMarkerEchoWithSubsequentEntries(t
 	assert.Equal(t, "zebra.txt", nextMarker)
 }
 
+func TestDoListFilerEntries_MarkerNamingDirectoryListsItsChildren(t *testing.T) {
+	// StartAfter=d00/s01 must still list d00/s01's contents: every child sorts
+	// after the marker key. The same holds for a bare top-level directory.
+	s3a := &S3ApiServer{}
+	dir := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/test-bucket":         {dir("d00"), dir("d01")},
+			"/buckets/test-bucket/d00":     {dir("s00"), dir("s01"), dir("s02")},
+			"/buckets/test-bucket/d00/s00": {file("f000.txt")},
+			"/buckets/test-bucket/d00/s01": {file("f000.txt")},
+			"/buckets/test-bucket/d00/s02": {file("f000.txt")},
+			"/buckets/test-bucket/d01":     {dir("s00")},
+			"/buckets/test-bucket/d01/s00": {file("f000.txt")},
+		},
+	}
+
+	collect := func(marker string) []string {
+		cursor := &ListingCursor{maxKeys: 1000}
+		var seen []string
+		_, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/test-bucket", marker: marker, bucket: "test-bucket"}, cursor, func(dir string, entry *filer_pb.Entry) {
+			seen = append(seen, dir+"/"+entry.Name)
+			cursor.maxKeys--
+		})
+		assert.NoError(t, err)
+		return seen
+	}
+
+	assert.Equal(t, []string{
+		"/buckets/test-bucket/d00/s01/f000.txt",
+		"/buckets/test-bucket/d00/s02/f000.txt",
+		"/buckets/test-bucket/d01/s00/f000.txt",
+	}, collect("d00/s01"))
+
+	assert.Equal(t, []string{
+		"/buckets/test-bucket/d01/s00/f000.txt",
+	}, collect("d01"))
+}
+
 func TestDoListFilerEntries_EmptyDirectoriesDoNotHideLaterEntries(t *testing.T) {
 	// With maxKeys=1 the listing window is 3 entries. The first window holds only
 	// empty directories, so the real object further down must still be found.
@@ -632,12 +726,48 @@ func TestMaxKeysParameterValidation(t *testing.T) {
 		assert.Equal(t, s3err.ErrInvalidMaxKeys, errCode, "non-numeric max-keys should return ErrInvalidMaxKeys")
 	})
 
+	t.Run("out of range max-keys values should return error", func(t *testing.T) {
+		for _, v := range []string{"-1", "2147483648", "1.5", " 10"} {
+			values := map[string][]string{
+				"max-keys": {v},
+			}
+			_, _, _, _, _, _, errCode := getListObjectsV1Args(values)
+			assert.Equal(t, s3err.ErrInvalidMaxKeys, errCode, "V1 max-keys=%q should return ErrInvalidMaxKeys", v)
+
+			_, _, _, _, _, _, _, _, errCode = getListObjectsV2Args(values)
+			assert.Equal(t, s3err.ErrInvalidMaxKeys, errCode, "V2 max-keys=%q should return ErrInvalidMaxKeys", v)
+		}
+	})
+
+	t.Run("max-keys up to 2147483647 is accepted and capped at 1000", func(t *testing.T) {
+		for v, want := range map[string]int{
+			"0":          0,
+			"999":        999,
+			"1000":       1000,
+			"1001":       1000,
+			"32768":      1000,
+			"65536":      1000,
+			"2147483647": 1000,
+		} {
+			values := map[string][]string{
+				"max-keys": {v},
+			}
+			_, _, _, _, maxkeys, _, errCode := getListObjectsV1Args(values)
+			assert.Equal(t, s3err.ErrNone, errCode, "V1 max-keys=%q should not return error", v)
+			assert.Equal(t, uint16(want), maxkeys, "V1 max-keys=%q", v)
+
+			_, _, _, _, _, _, maxkeys2, _, errCode := getListObjectsV2Args(values)
+			assert.Equal(t, s3err.ErrNone, errCode, "V2 max-keys=%q should not return error", v)
+			assert.Equal(t, uint16(want), maxkeys2, "V2 max-keys=%q", v)
+		}
+	})
+
 	t.Run("empty max-keys should use default", func(t *testing.T) {
 		// Test empty max-keys
 		values := map[string][]string{}
 		_, _, _, _, maxkeys, _, errCode := getListObjectsV1Args(values)
 		assert.Equal(t, s3err.ErrNone, errCode, "empty max-keys should not return error")
-		assert.Equal(t, int16(1000), maxkeys, "empty max-keys should use default value")
+		assert.Equal(t, uint16(1000), maxkeys, "empty max-keys should use default value")
 
 		_, _, _, _, _, _, maxkeys2, _, errCode := getListObjectsV2Args(values)
 		assert.Equal(t, s3err.ErrNone, errCode, "empty max-keys should not return error")
@@ -1028,3 +1158,323 @@ func TestListObjectsV2_PrefixEndingWithSlash_WithDelimiter(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, []string{"fileA"}, results, "Should only return files under directory '1', not '1000'")
 }
+
+// A marker landing between a directory's name and its trailing slash must
+// still produce keys inside the directory in byte order: the marker's own
+// block band, not just its name, decides what follows it.
+func TestDoListFilerEntries_MarkerBetweenDirAndSlash(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dir := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b/o":     {dir("a"), file("a-c"), file("a.txt"), file("a0"), file("ab")},
+			"/buckets/b/o/a":   {file("b"), dir("c")},
+			"/buckets/b/o/a/c": {file("d")},
+		},
+	}
+
+	collect := func(marker string) []string {
+		cursor := &ListingCursor{maxKeys: 1000}
+		var seen []string
+		_, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b/o", marker: marker, bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+			seen = append(seen, strings.TrimPrefix(dir, "/buckets/b/")+"/"+entry.Name)
+			cursor.maxKeys--
+		})
+		assert.NoError(t, err)
+		return seen
+	}
+
+	// byte order: o/a-c, o/a.txt, o/a/b, o/a/c/d, o/a0, o/ab
+	assert.Equal(t, []string{
+		"o/a-c", "o/a.txt", "o/a/b", "o/a/c/d", "o/a0", "o/ab",
+	}, collect(""))
+
+	assert.Equal(t, []string{
+		"o/a/b", "o/a/c/d", "o/a0", "o/ab",
+	}, collect("a.txt"))
+
+	assert.Equal(t, []string{
+		"o/a/c/d", "o/a0", "o/ab",
+	}, collect("a/b"))
+
+	assert.Equal(t, []string{
+		"o/ab",
+	}, collect("a0"))
+
+	// a marker that sorts inside the "a" band before its slash still walks a:
+	assert.Equal(t, []string{
+		"o/a.txt", "o/a/b", "o/a/c/d", "o/a0", "o/ab",
+	}, collect("a-c"))
+}
+
+// Directory blocks order by "<name>/", not by name: "a-/" sorts before "a/".
+func TestDoListFilerEntries_DirBlocksSortBySlashName(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dir := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b":    {dir("a"), dir("a-"), file("a.txt")},
+			"/buckets/b/a":  {file("b")},
+			"/buckets/b/a-": {file("x")},
+		},
+	}
+
+	cursor := &ListingCursor{maxKeys: 1000}
+	var seen []string
+	_, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+		seen = append(seen, strings.TrimPrefix(dir, "/buckets/b")+"/"+entry.Name)
+		cursor.maxKeys--
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"/a-/x", "/a.txt", "/a/b"}, seen)
+}
+
+// A full page must report truncation while deferred directories still hold keys.
+func TestDoListFilerEntries_FullPageTruncatesWithPendingDir(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dir := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b":   {dir("a"), file("a-c")},
+			"/buckets/b/a": {file("x")},
+		},
+	}
+
+	cursor := &ListingCursor{maxKeys: 1}
+	var seen []string
+	nextMarker, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+		seen = append(seen, entry.Name)
+		cursor.maxKeys--
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"a-c"}, seen)
+	assert.True(t, cursor.isTruncated, "deferred directory still holds a key")
+	assert.Equal(t, "a-c", nextMarker)
+
+	// the next page re-enters the deferred block through the marker band
+	cursor = &ListingCursor{maxKeys: 1000}
+	seen = nil
+	_, err = s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", marker: nextMarker, bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+		seen = append(seen, dir+"/"+entry.Name)
+		cursor.maxKeys--
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"/buckets/b/a/x"}, seen)
+}
+
+// A directory that is also a plain object lists "a" at the name position and
+// does not repeat it when the marker is the object itself.
+func TestDoListFilerEntries_PrefixObjectKeepsNamePosition(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dirObj := func(name string) *filer_pb.Entry {
+		e := &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{FileMode: uint32(os.ModeDir | 0644)}}
+		e.MarkPrefixObject()
+		return e
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b":   {dirObj("a"), file("a.txt")},
+			"/buckets/b/a": {file("b")},
+		},
+	}
+
+	collect := func(marker string) []string {
+		cursor := &ListingCursor{maxKeys: 1000}
+		var seen []string
+		_, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", marker: marker, bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+			seen = append(seen, dir+"/"+entry.Name)
+			cursor.maxKeys--
+		})
+		assert.NoError(t, err)
+		return seen
+	}
+
+	assert.Equal(t, []string{"/buckets/b/a", "/buckets/b/a.txt", "/buckets/b/a/b"}, collect(""))
+	// the marker is the object "a" itself: excluded, but "a.txt" and the
+	// "a/" block still follow
+	assert.Equal(t, []string{"/buckets/b/a.txt", "/buckets/b/a/b"}, collect("a"))
+}
+
+// A marker that lands inside a directory's "<name>/" block — the continuation
+// token a delimited page returns for it — must not re-list the block's folded
+// contents under delimiter "/".
+func TestDoListFilerEntries_DelimiterSkipsResumedDirBlock(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dir := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b":   {dir("a"), file("b")},
+			"/buckets/b/a": {file("x")},
+		},
+	}
+
+	collect := func(marker string) []string {
+		cursor := &ListingCursor{maxKeys: 1000}
+		var seen []string
+		_, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", marker: marker, delimiter: "/", bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+			seen = append(seen, strings.TrimPrefix(dir, "/buckets/b")+"/"+entry.Name)
+			cursor.maxKeys--
+		})
+		assert.NoError(t, err)
+		return seen
+	}
+
+	// The "a/" block already collapsed into a common prefix on the earlier
+	// page, so neither "a/" nor anything under it is emitted again.
+	assert.Equal(t, []string{"/b"}, collect("a/"))
+	assert.Equal(t, []string{"/b"}, collect("a/x"))
+}
+
+// A delimited listing resumes a directory at its "<name>/" block boundary, not
+// the bare name: the name alone sorts inside the (name, name/) band and makes
+// the next pass re-emit the same common prefix until the quota runs out. The
+// marker also survives a round trip through the request path unchanged —
+// adjustMarkerForDelimiter must not trim the trailing slash off it.
+func TestDoListFilerEntries_DelimitedDirResumesAtBlockBoundary(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dir := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b":   {dir("a"), file("b")},
+			"/buckets/b/a": {file("x")},
+		},
+	}
+
+	// The outer listFilerEntries loop re-enters with the returned marker until
+	// a pass comes back empty; every entry must be emitted exactly once.
+	var seen []string
+	marker := ""
+	for pass := 0; pass < 4; pass++ {
+		cursor := &ListingCursor{maxKeys: 1000}
+		emitted := 0
+		nextMarker, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", marker: marker, delimiter: "/", bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+			seen = append(seen, strings.TrimPrefix(dir, "/buckets/b")+"/"+entry.Name)
+			emitted++
+		})
+		assert.NoError(t, err)
+		if emitted == 0 {
+			break
+		}
+		marker = adjustMarkerForDelimiter(nextMarker, "", "/")
+	}
+	assert.Equal(t, []string{"/a", "/b"}, seen)
+}
+
+// A prefix object's "<name>/" common prefix belongs to the block position, not
+// the name position: it must not outrank "a.txt" on a full page nor repeat on
+// the next one.
+func TestDoListFilerEntries_PrefixObjectDefersCommonPrefix(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dirObj := func(name string) *filer_pb.Entry {
+		e := &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{FileMode: uint32(os.ModeDir | 0644)}}
+		e.MarkPrefixObject()
+		return e
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b":   {dirObj("a"), file("a.txt")},
+			"/buckets/b/a": {file("b")},
+		},
+	}
+
+	// Page one holds the plain key "a" and "a.txt"; the "a/" block sort after
+	// both, so the page truncates at "a.txt" without touching it.
+	cursor := &ListingCursor{maxKeys: 2}
+	var seen []string
+	var sawPrefixObject bool
+	nextMarker, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", delimiter: "/", bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+		seen = append(seen, entry.Name)
+		sawPrefixObject = sawPrefixObject || entry.IsPrefixObject()
+		cursor.maxKeys--
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"a", "a.txt"}, seen)
+	assert.True(t, sawPrefixObject, "the name-position emission is the plain object")
+	assert.True(t, cursor.isTruncated)
+	assert.Equal(t, "a.txt", nextMarker)
+
+	// Page two emits the deferred block once, as a plain directory fold.
+	cursor = &ListingCursor{maxKeys: 2}
+	seen = nil
+	sawPrefixObject = false
+	_, err = s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", marker: nextMarker, delimiter: "/", bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+		seen = append(seen, entry.Name)
+		sawPrefixObject = sawPrefixObject || entry.IsPrefixObject()
+		cursor.maxKeys--
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"a"}, seen)
+	assert.False(t, sawPrefixObject, "the block emission is the \"<name>/\" fold, not the plain key again")
+	assert.False(t, cursor.isTruncated)
+}
+
+// A directory key object that spends the page's last slot still reports
+// truncation so the next page re-enters its subtree.
+func TestDoListFilerEntries_DirKeyObjectBoundaryTruncates(t *testing.T) {
+	s3a := &S3ApiServer{}
+	dirKeyObj := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: s3_constants.FolderMimeType}}
+	}
+	file := func(name string) *filer_pb.Entry {
+		return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+	}
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b":   {dirKeyObj("a")},
+			"/buckets/b/a": {file("x")},
+		},
+	}
+
+	cursor := &ListingCursor{maxKeys: 1}
+	var seen []string
+	nextMarker, err := s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+		seen = append(seen, entry.Name)
+		cursor.maxKeys--
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"a"}, seen)
+	assert.True(t, cursor.isTruncated, "the subtree may still hold unlisted keys")
+	assert.Equal(t, "a/", nextMarker)
+
+	// The next page resumes inside the "a/" block and lists the child.
+	cursor = &ListingCursor{maxKeys: 1000}
+	seen = nil
+	_, err = s3a.doListFilerEntries(context.Background(), client, listDirectoryRequest{dir: "/buckets/b", marker: nextMarker, bucket: "b"}, cursor, func(dir string, entry *filer_pb.Entry) {
+		seen = append(seen, strings.TrimPrefix(dir, "/buckets/b")+"/"+entry.Name)
+		cursor.maxKeys--
+	})
+	assert.NoError(t, err)
+	assert.Equal(t, []string{"/a/x"}, seen)
+	assert.False(t, cursor.isTruncated)
+}
diff --git a/weed/s3api/s3api_object_handlers_list_token_test.go b/weed/s3api/s3api_object_handlers_list_token_test.go
new file mode 100644
index 0000000000..75ffbdcf9f
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_list_token_test.go
@@ -0,0 +1,328 @@
+package s3api
+
+import (
+	"encoding/xml"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type listV2TestPage struct {
+	XMLName               xml.Name `xml:"ListBucketResult"`
+	IsTruncated           bool     `xml:"IsTruncated"`
+	NextContinuationToken string   `xml:"NextContinuationToken"`
+	StartAfter            string   `xml:"StartAfter"`
+	Contents              []struct {
+		Key string `xml:"Key"`
+	} `xml:"Contents"`
+}
+
+func listTokenTestFile(name string) *filer_pb.Entry {
+	return &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}
+}
+
+func newListTokenTestServer(t *testing.T, keys []string) *S3ApiServer {
+	t.Helper()
+	entries := make([]*filer_pb.Entry, 0, len(keys))
+	for _, key := range keys {
+		entries = append(entries, listTokenTestFile(key))
+	}
+	filer := &fakeBucketDeleteFiler{entriesByDir: map[string][]*filer_pb.Entry{
+		"/buckets/test": entries,
+	}}
+	s3a := newFailoverTestServer(t, startFakeFiler(t, filer))
+	s3a.option.BucketsPath = "/buckets"
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set("test", &BucketConfig{Name: "test"})
+	return s3a
+}
+
+func listV2Page(t *testing.T, s3a *S3ApiServer, query url.Values) listV2TestPage {
+	t.Helper()
+	r := httptest.NewRequest(http.MethodGet, "/test?"+query.Encode(), nil)
+	r = mux.SetURLVars(r, map[string]string{"bucket": "test"})
+	w := httptest.NewRecorder()
+	s3a.ListObjectsV2Handler(w, r)
+	require.Equal(t, http.StatusOK, w.Code, w.Body.String())
+	var page listV2TestPage
+	require.NoError(t, xml.Unmarshal(w.Body.Bytes(), &page), w.Body.String())
+	return page
+}
+
+// A page that ends on a key XML 1.0 cannot carry must still resume right after
+// that key. The token used to be the raw key, which the XML encoder turned into
+// U+FFFD, so the next page resumed past the mangled name and skipped every key
+// sorting between it and the real one.
+func TestListObjectsV2ContinuationTokenWithXMLUnsafeKeys(t *testing.T) {
+	keys := []string{"a\x01b", "a\x02b", "a\x1fb", "a b", "b", "c"}
+
+	for _, encodingTypeURL := range []bool{false, true} {
+		t.Run("encoding-type=url:"+strconv.FormatBool(encodingTypeURL), func(t *testing.T) {
+			s3a := newListTokenTestServer(t, keys)
+
+			var got []string
+			token := ""
+			for page := 0; ; page++ {
+				require.Less(t, page, len(keys), "listing did not terminate")
+				query := url.Values{"list-type": {"2"}, "max-keys": {"2"}}
+				if encodingTypeURL {
+					query.Set("encoding-type", "url")
+				}
+				if token != "" {
+					query.Set("continuation-token", token)
+				}
+				result := listV2Page(t, s3a, query)
+				for _, content := range result.Contents {
+					key := content.Key
+					if encodingTypeURL {
+						decoded, err := url.QueryUnescape(key)
+						require.NoError(t, err)
+						key = decoded
+					}
+					got = append(got, key)
+				}
+				if !result.IsTruncated {
+					break
+				}
+				require.NotEmpty(t, result.NextContinuationToken)
+				token = result.NextContinuationToken
+			}
+
+			if encodingTypeURL {
+				assert.Equal(t, keys, got)
+				return
+			}
+			// Without encoding-type=url the keys themselves still lose control
+			// characters to the XML encoder, but no key may be skipped.
+			require.Len(t, got, len(keys))
+			assert.Equal(t, "c", got[len(got)-1])
+		})
+	}
+}
+
+// The StartAfter echo is the wire encoding of the decoded key, so a client
+// that feeds the echo back lands on the same resume point instead of
+// drifting to the literal escape text.
+func TestListObjectsV2StartAfterEchoStable(t *testing.T) {
+	s3a := newListTokenTestServer(t, []string{"a b", "c"})
+	for _, sent := range []string{"a%20b", "a b"} {
+		result := listV2Page(t, s3a, url.Values{
+			"list-type": {"2"}, "encoding-type": {"url"}, "start-after": {sent},
+		})
+		assert.Equal(t, "a%20b", result.StartAfter, "start-after %q", sent)
+		require.Len(t, result.Contents, 1)
+		assert.Equal(t, "c", result.Contents[0].Key)
+	}
+}
+
+// A token for a key that XML carries unchanged stays the bare key.
+func TestListObjectsV2ContinuationTokenUnchangedForNormalKeys(t *testing.T) {
+	keys := []string{"a\x01b", "a\x02b", "a\x1fb", "a b", "b", "c"}
+	s3a := newListTokenTestServer(t, keys)
+
+	result := listV2Page(t, s3a, url.Values{"list-type": {"2"}, "max-keys": {"5"}})
+	require.True(t, result.IsTruncated)
+	assert.Equal(t, "b", result.NextContinuationToken)
+}
+
+func TestListObjectsV2ContinuationTokenRoundTrip(t *testing.T) {
+	for _, key := range []string{"a\x01b", "a\x1fb", "a\xffb", "base64:literal", "dir/file", "a b", "b"} {
+		token := encodeListContinuationToken(key)
+		assert.Equal(t, key, decodeListContinuationToken(token), "token %q", token)
+	}
+	for _, key := range []string{"b", "dir/file", "a b"} {
+		assert.Equal(t, key, encodeListContinuationToken(key))
+	}
+	// Tokens written before the encoding existed are still bare keys.
+	assert.Equal(t, "dir/file", decodeListContinuationToken("dir/file"))
+}
+
+func TestDecodeListContinuationTokenKeepsForeignTokensRaw(t *testing.T) {
+	// A prefix-looking token that does not decode is a key, not a token.
+	assert.Equal(t, "base64:%%%", decodeListContinuationToken("base64:%%%"))
+	// An empty payload is never something encodeListContinuationToken wrote.
+	assert.Equal(t, "base64:", decodeListContinuationToken("base64:"))
+	// A legacy bare token is a raw key even when its suffix is valid base64:
+	// the decoded key could have traveled bare, so the input never was an
+	// encoded token.
+	for _, legacy := range []string{"base64:Yw", "base64:YQ", "base64:cGFy", "base64:a2V5LXdpdGg"} {
+		assert.Equal(t, legacy, decodeListContinuationToken(legacy), "token %q", legacy)
+	}
+}
+
+// Some tokens are ambiguous: "base64:AQ" is both a possible legacy bare key
+// and the encoded form of "\x01". The encoded reading wins because a decoded
+// key that cannot travel bare is a shape only encodeListContinuationToken
+// writes — and a wrong raw reading skips entries, while a wrong encoded
+// reading only re-lists them.
+func TestDecodeListContinuationTokenResolvesCollisionEncoded(t *testing.T) {
+	assert.Equal(t, "\x01", decodeListContinuationToken("base64:AQ"))
+	assert.Equal(t, "\xff", decodeListContinuationToken("base64:_w"))
+	assert.Equal(t, "base64:AQ", decodeListContinuationToken("base64:YmFzZTY0OkFR"))
+}
+
+type listV1TestPage struct {
+	XMLName     xml.Name `xml:"ListBucketResult"`
+	IsTruncated bool     `xml:"IsTruncated"`
+	Marker      string   `xml:"Marker"`
+	NextMarker  string   `xml:"NextMarker"`
+	Contents    []struct {
+		Key string `xml:"Key"`
+	} `xml:"Contents"`
+}
+
+func listV1Page(t *testing.T, s3a *S3ApiServer, query url.Values) listV1TestPage {
+	t.Helper()
+	r := httptest.NewRequest(http.MethodGet, "/test?"+query.Encode(), nil)
+	r = mux.SetURLVars(r, map[string]string{"bucket": "test"})
+	w := httptest.NewRecorder()
+	s3a.ListObjectsV1Handler(w, r)
+	require.Equal(t, http.StatusOK, w.Code, w.Body.String())
+	var page listV1TestPage
+	require.NoError(t, xml.Unmarshal(w.Body.Bytes(), &page), w.Body.String())
+	return page
+}
+
+// The V1 marker carries the same resume position as the V2 token, so it gets
+// the same treatment: a page ending on an XML-unsafe key must still resume
+// right after it.
+func TestListObjectsV1MarkerWithXMLUnsafeKeys(t *testing.T) {
+	keys := []string{"a\x01b", "a\x02b", "a\x1fb", "a b", "b", "c"}
+	s3a := newListTokenTestServer(t, keys)
+
+	var got []string
+	marker := ""
+	for page := 0; ; page++ {
+		require.Less(t, page, len(keys), "listing did not terminate")
+		query := url.Values{"max-keys": {"2"}, "encoding-type": {"url"}}
+		if marker != "" {
+			query.Set("marker", marker)
+		}
+		result := listV1Page(t, s3a, query)
+		for _, content := range result.Contents {
+			key, err := url.QueryUnescape(content.Key)
+			require.NoError(t, err)
+			got = append(got, key)
+		}
+		if !result.IsTruncated {
+			break
+		}
+		require.NotEmpty(t, result.NextMarker)
+		marker = result.NextMarker
+	}
+	require.Equal(t, keys, got)
+}
+
+// A url-encoded marker is only a wire echo when re-escaping its unescaped
+// form reproduces it: a real echo decodes, a raw key merely containing '%'
+// or a malformed escape passes through untouched.
+func TestDecodeMarkerEchoKeepsNonCanonicalRawKey(t *testing.T) {
+	assert.Equal(t, "a b", decodeMarkerEcho("a%20b", true))
+	assert.Equal(t, "a%41", decodeMarkerEcho("a%2541", true))
+	assert.Equal(t, "a%41", decodeMarkerEcho("a%41", true))
+	assert.Equal(t, "a%2G", decodeMarkerEcho("a%2G", true))
+	assert.Equal(t, "a%20b", decodeMarkerEcho("a%20b", false))
+}
+
+// Under encoding-type=url AWS encodes the StartAfter echo the same as the
+// listed keys; a client resuming from the emitted form lands on the raw key.
+func TestListObjectsV2UrlStartAfterEchoAndResume(t *testing.T) {
+	s3a := newListTokenTestServer(t, []string{"a b", "a b0", "a c", "b"})
+
+	result := listV2Page(t, s3a, url.Values{"list-type": {"2"}, "encoding-type": {"url"}, "start-after": {"a b"}})
+	assert.Equal(t, urlPathEscape("a b"), result.StartAfter)
+
+	var got []string
+	for _, content := range result.Contents {
+		key, err := url.QueryUnescape(content.Key)
+		require.NoError(t, err)
+		got = append(got, key)
+	}
+	assert.Equal(t, []string{"a b0", "a c", "b"}, got)
+
+	// Echoing the emitted form back resumes at the same raw key.
+	result = listV2Page(t, s3a, url.Values{"list-type": {"2"}, "encoding-type": {"url"}, "start-after": {result.StartAfter}})
+	got = nil
+	for _, content := range result.Contents {
+		key, err := url.QueryUnescape(content.Key)
+		require.NoError(t, err)
+		got = append(got, key)
+	}
+	assert.Equal(t, []string{"a b0", "a c", "b"}, got)
+}
+
+// A url-encoded marker that is not the canonical urlPathEscape form of any key
+// is the client's raw key, not an encoded echo: "a%41" must resume after that
+// literal key instead of decoding to "aA" and skipping the keys between them.
+func TestListObjectsV1UrlMarkerKeepsNonCanonicalRawKey(t *testing.T) {
+	s3a := newListTokenTestServer(t, []string{"a%41", "a%42", "aA", "b"})
+
+	result := listV1Page(t, s3a, url.Values{"encoding-type": {"url"}, "marker": {"a%41"}})
+	var got []string
+	for _, content := range result.Contents {
+		key, err := url.QueryUnescape(content.Key)
+		require.NoError(t, err)
+		got = append(got, key)
+	}
+	assert.Equal(t, []string{"a%42", "aA", "b"}, got)
+}
+
+// The echoed request marker carries the client's token, not the decoded key:
+// echoing the raw key would mangle an XML-unsafe name to U+FFFD, and under
+// encoding-type=url the echo takes the same escaped form as the listed keys.
+func TestListObjectsV1MarkerEchoStaysXMLSafe(t *testing.T) {
+	s3a := newListTokenTestServer(t, []string{"a\x01b", "b", "c"})
+
+	token := encodeListContinuationToken("a\x01b")
+	result := listV1Page(t, s3a, url.Values{"max-keys": {"2"}, "marker": {token}})
+	assert.Equal(t, token, result.Marker)
+
+	result = listV1Page(t, s3a, url.Values{"max-keys": {"2"}, "marker": {"a b"}, "encoding-type": {"url"}})
+	assert.Equal(t, urlPathEscape("a b"), result.Marker)
+}
+
+// A raw-key token resuming at an XML-unsafe prefix must not lose keys when a
+// sibling directory shares the key's leading bytes: the start window begins at
+// the marker's first path segment and descends only into blocks that can still
+// hold keys past it.
+func TestListObjectsV2ResumeXMLUnsafePrefixWithSiblingDir(t *testing.T) {
+	filer := &fakeBucketDeleteFiler{entriesByDir: map[string][]*filer_pb.Entry{
+		"/buckets/test/x": {
+			{Name: "a\x01", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}},
+			listTokenTestFile("a\x01b"),
+			{Name: "a\x01b", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}},
+			listTokenTestFile("a\x01b0"),
+		},
+		"/buckets/test/x/a\x01": {
+			listTokenTestFile("b"),
+		},
+		"/buckets/test/x/a\x01b": {
+			listTokenTestFile("0"),
+		},
+	}}
+	s3a := newFailoverTestServer(t, startFakeFiler(t, filer))
+	s3a.option.BucketsPath = "/buckets"
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.bucketConfigCache.Set("test", &BucketConfig{Name: "test"})
+
+	result := listV2Page(t, s3a, url.Values{
+		"list-type":          {"2"},
+		"encoding-type":      {"url"},
+		"prefix":             {"x/a\x01b"},
+		"max-keys":           {"1"},
+		"continuation-token": {"x/a\x01b"},
+	})
+	require.Len(t, result.Contents, 1)
+	got, err := url.QueryUnescape(result.Contents[0].Key)
+	require.NoError(t, err)
+	assert.Equal(t, "x/a\x01b/0", got)
+	assert.True(t, result.IsTruncated)
+}
diff --git a/weed/s3api/s3api_object_handlers_list_versioned_test.go b/weed/s3api/s3api_object_handlers_list_versioned_test.go
index 43ec65f27f..51a01ce898 100644
--- a/weed/s3api/s3api_object_handlers_list_versioned_test.go
+++ b/weed/s3api/s3api_object_handlers_list_versioned_test.go
@@ -641,7 +641,7 @@ func TestComputeStartFrom(t *testing.T) {
 	}{
 		{"empty marker", "", "", "", false},
 		{"empty marker with path", "", "dir", "", false},
-		{"root level file", "file1.txt", "", "file1.txt", true},
+		{"root level file", "file1.txt", "", "file1", true},
 		{"root level with subpath", "Mailboxes/5ac/file1", "", "Mailboxes", true},
 		{"matching subdir", "Mailboxes/5ac/file1", "Mailboxes", "5ac", true},
 		{"deeper subdir", "Mailboxes/5ac/ItemsData/file1", "Mailboxes/5ac", "ItemsData", true},
@@ -649,6 +649,12 @@ func TestComputeStartFrom(t *testing.T) {
 		{"unrelated directory", "other/path", "Mailboxes", "", false},
 		{"marker equals relativePath", "Mailboxes", "Mailboxes", "", false},
 		{"marker before directory", "aaa/file", "zzz", "", false},
+		{"dir prefix below slash", "d.x", "", "d", true},
+		{"dir prefix below slash nested", "a-b/file", "", "a", true},
+		{"dir prefix at marker end", "d-", "", "d", true},
+		{"no qualifying prefix", "zzz", "", "zzz", true},
+		{"leading below-slash byte", ".hidden", "", ".hidden", true},
+		{"leading below-slash byte nested", ".hidden/file", "", ".hidden", true},
 	}
 
 	for _, tt := range tests {
@@ -733,3 +739,19 @@ func TestVersionedListSkipsEchoedVersionsMarker(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, []string{"file-2"}, seen, "the echoed marker entry should not be returned")
 }
+
+// TestListObjectVersionsMaxKeysZero verifies that max-keys=0 returns an empty,
+// non-truncated page without listing the bucket, matching ListObjects.
+func TestListObjectVersionsMaxKeysZero(t *testing.T) {
+	s3a := &S3ApiServer{}
+	result, err := s3a.listObjectVersions("bucket", "prefix/", "key-marker", "version-marker", "/", 0)
+	assert.NoError(t, err)
+	assert.Empty(t, result.Entries)
+	assert.False(t, result.IsTruncated)
+	assert.Equal(t, 0, result.MaxKeys)
+	assert.Equal(t, "", result.NextKeyMarker)
+	assert.Equal(t, "", result.NextVersionIdMarker)
+	assert.Equal(t, "key-marker", result.KeyMarker)
+	assert.Equal(t, "version-marker", result.VersionIdMarker)
+	assert.Equal(t, "/", result.Delimiter)
+}
diff --git a/weed/s3api/s3api_object_handlers_multipart.go b/weed/s3api/s3api_object_handlers_multipart.go
index 8b7b6b05b4..ddb349bdeb 100644
--- a/weed/s3api/s3api_object_handlers_multipart.go
+++ b/weed/s3api/s3api_object_handlers_multipart.go
@@ -40,6 +40,12 @@ func (s3a *S3ApiServer) NewMultipartUploadHandler(w http.ResponseWriter, r *http
 		return
 	}
 
+	// Reject before the auto-create check so a refused upload cannot leave a bucket behind
+	if errCode := ValidateRequestEncryption(r.Header); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Check if bucket exists, and create it if it doesn't (auto-create bucket)
 	if err := s3a.checkBucket(r, bucket); err == s3err.ErrNoSuchBucket {
 		// Auto-create bucket if it doesn't exist (requires Admin permission)
@@ -69,7 +75,7 @@ func (s3a *S3ApiServer) NewMultipartUploadHandler(w http.ResponseWriter, r *http
 	}
 
 	// Validate object lock headers before processing
-	if err := s3a.validateObjectLockHeaders(r, versioningEnabled); err != nil {
+	if err := s3a.validateObjectLockHeaders(r, bucket, object, versioningEnabled); err != nil {
 		glog.V(2).Infof("NewMultipartUploadHandler: object lock header validation failed for bucket %s, object %s: %v", bucket, object, err)
 		s3err.WriteErrorResponse(w, r, mapValidationErrorToS3Error(err))
 		return
@@ -91,6 +97,15 @@ func (s3a *S3ApiServer) NewMultipartUploadHandler(w http.ResponseWriter, r *http
 		}
 	}
 
+	// An explicit ACL on initiate applies to the completed object and requires
+	// s3:PutObjectAcl, same as PUT. The validated grants ride on the upload
+	// entry so CompleteMultipartUpload cannot be handed forged internal headers.
+	r, aclCode := s3a.preparePutObjectACL(r, bucket)
+	if aclCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, aclCode)
+		return
+	}
+
 	createMultipartUploadInput := &s3.CreateMultipartUploadInput{
 		Bucket:   aws.String(bucket),
 		Key:      objectKey(aws.String(object)),
@@ -120,6 +135,13 @@ func (s3a *S3ApiServer) NewMultipartUploadHandler(w http.ResponseWriter, r *http
 		return
 	}
 
+	if response.ChecksumAlgorithm != "" {
+		w.Header().Set(s3_constants.AmzChecksumAlgorithm, response.ChecksumAlgorithm)
+		if response.ChecksumType != "" {
+			w.Header().Set(s3_constants.AmzChecksumType, response.ChecksumType)
+		}
+	}
+
 	writeSuccessResponseXML(w, r, response)
 
 }
@@ -180,14 +202,6 @@ func (s3a *S3ApiServer) CompleteMultipartUploadHandler(w http.ResponseWriter, r
 		w.Header().Set("x-amz-version-id", *response.VersionId)
 	}
 
-	// Set checksum header if present
-	if response.ChecksumHeaderName != "" && response.ChecksumValue != "" {
-		w.Header().Set(response.ChecksumHeaderName, response.ChecksumValue)
-		if response.ChecksumType != "" {
-			w.Header().Set(s3_constants.AmzChecksumType, response.ChecksumType)
-		}
-	}
-
 	stats_collect.RecordBucketActiveTime(bucket)
 	stats_collect.S3UploadedObjectsCounter.WithLabelValues(bucket).Inc()
 
@@ -246,11 +260,17 @@ func (s3a *S3ApiServer) ListMultipartUploadsHandler(w http.ResponseWriter, r *ht
 		return
 	}
 
-	prefix, keyMarker, uploadIDMarker, delimiter, maxUploads, encodingType := getBucketMultipartResources(r.URL.Query())
+	prefix, multipartKeyMarker, uploadIDMarker, delimiter, maxUploads, encodingType := getBucketMultipartResources(r.URL.Query())
 	if maxUploads < 0 {
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidMaxUploads)
 		return
 	}
+	// The decode mirrors the response encoding: under encoding-type=url the
+	// markers go out url-escaped, otherwise they carry the token form.
+	keyMarker := decodeListContinuationToken(multipartKeyMarker)
+	if encodingType == s3.EncodingTypeUrl {
+		keyMarker = decodeEscapedEcho(multipartKeyMarker, true, urlQueryEscape)
+	}
 	if keyMarker != "" {
 		// Marker not common with prefix is not implemented.
 		if !strings.HasPrefix(keyMarker, prefix) {
@@ -276,8 +296,6 @@ func (s3a *S3ApiServer) ListMultipartUploadsHandler(w http.ResponseWriter, r *ht
 		return
 	}
 
-	// TODO handle encodingType
-
 	writeSuccessResponseXML(w, r, response)
 }
 
@@ -329,6 +347,12 @@ func (s3a *S3ApiServer) ListObjectPartsHandler(w http.ResponseWriter, r *http.Re
 // PutObjectPartHandler - Put an object part in a multipart upload.
 func (s3a *S3ApiServer) PutObjectPartHandler(w http.ResponseWriter, r *http.Request) {
 	bucket, object := s3_constants.GetBucketAndObject(r)
+	if src := r.Header.Get("X-Amz-Copy-Source"); src != "" {
+		// Well-formed copy sources are claimed by the CopyObjectPart route; what
+		// is left here has no "bucket/key" form and is not a plain PutObjectPart.
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidArgument)
+		return
+	}
 	_, err := validateContentMd5(r.Header)
 	if err != nil {
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidDigest)
@@ -351,16 +375,8 @@ func (s3a *S3ApiServer) PutObjectPartHandler(w http.ResponseWriter, r *http.Requ
 
 	partIDString := r.URL.Query().Get("partNumber")
 	partID, err := strconv.Atoi(partIDString)
-	if err != nil {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPart)
-		return
-	}
-	if partID > s3_constants.MaxS3MultipartParts {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPart)
-		return
-	}
-	if partID < 1 {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPart)
+	if err != nil || partID < 1 || partID > s3_constants.MaxS3MultipartParts {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidArgument)
 		return
 	}
 
@@ -446,6 +462,21 @@ func (s3a *S3ApiServer) PutObjectPartHandler(w http.ResponseWriter, r *http.Requ
 		}
 	}
 
+	// Parts inherit the checksum algorithm declared at CreateMultipartUpload
+	// when the request doesn't specify one; a conflicting one is rejected.
+	if headerName := string(uploadEntry.Extended[s3_constants.ExtChecksumAlgorithm]); headerName != "" {
+		if algo, reqHeaderName, code := detectRequestedChecksumAlgorithm(r); code == s3err.ErrNone {
+			if algo == ChecksumAlgorithmNone {
+				if name := checksumAlgorithmNameFromHeaderName(headerName); name != "" {
+					r.Header.Set(s3_constants.AmzChecksumAlgorithm, name)
+				}
+			} else if reqHeaderName != headerName {
+				s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+				return
+			}
+		}
+	}
+
 	filePath := s3a.genPartUploadPath(bucket, uploadID, partID)
 
 	if partID == 1 && r.Header.Get("Content-Type") == "" {
@@ -459,8 +490,9 @@ func (s3a *S3ApiServer) PutObjectPartHandler(w http.ResponseWriter, r *http.Requ
 	// volume TTL: the rule targets the user-visible object, not the
 	// transient .uploads/<id>/<n> path, and a part write would otherwise
 	// start the TTL clock before CompleteMultipartUpload ever assembled
-	// the object.
-	etag, errCode, sseMetadata := s3a.putToFiler(r, filePath, dataReader, bucket, "", partID, 0, nil, false)
+	// the object. filer.conf storage rules are the opposite case: they
+	// place the bytes the part becomes, so they resolve against the object.
+	etag, errCode, sseMetadata := s3a.putToFiler(r, filePath, dataReader, bucket, "", partID, 0, nil, false, s3a.toFilerPath(bucket, object))
 	if errCode != s3err.ErrNone {
 		glog.Errorf("PutObjectPart: putToFiler failed with error code %v for bucket=%s, object=%s, partNumber=%d",
 			errCode, bucket, object, partID)
@@ -468,6 +500,11 @@ func (s3a *S3ApiServer) PutObjectPartHandler(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
+	// the write above re-creates a directory an abort removed mid-body
+	if !s3a.checkUploadStillOpen(w, r, bucket, object, uploadID) {
+		return
+	}
+
 	glog.V(2).Infof("PutObjectPart: SUCCESS - bucket=%s, object=%s, partNumber=%d, etag=%s, sseType=%s",
 		bucket, object, partID, etag, sseMetadata.SSEType)
 
@@ -484,6 +521,38 @@ func (s3a *S3ApiServer) genUploadsFolder(bucket string) string {
 	return fmt.Sprintf("%s/%s", s3a.bucketDir(bucket), s3_constants.MultipartUploadsFolder)
 }
 
+// isMultipartUploadEntry tells the .uploads/<id> directory createMultipartUpload
+// made from the one a part write re-created on its way to the filer: only the
+// former carries the destination object key.
+func isMultipartUploadEntry(entry *filer_pb.Entry) bool {
+	return entry != nil && len(entry.Extended[s3_constants.ExtMultipartObjectKey]) > 0
+}
+
+// checkUploadStillOpen re-checks the upload after a part landed, and removes the
+// part along with the directory it resurrected when an abort was answered while
+// the part was in flight. It reports whether the caller may answer success.
+func (s3a *S3ApiServer) checkUploadStillOpen(w http.ResponseWriter, r *http.Request, bucket, object, uploadID string) bool {
+	entry, err := s3a.getEntry(s3a.genUploadsFolder(bucket), uploadID)
+	if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		glog.Errorf("checkUploadStillOpen %s/%s: %v", bucket, uploadID, err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return false
+	}
+	if isMultipartUploadEntry(entry) {
+		return true
+	}
+	// the upload is gone either way, so the client still hears NoSuchUpload
+	if _, code := s3a.abortMultipartUpload(&s3.AbortMultipartUploadInput{
+		Bucket:   aws.String(bucket),
+		Key:      objectKey(aws.String(object)),
+		UploadId: aws.String(uploadID),
+	}); code != s3err.ErrNone {
+		glog.Warningf("checkUploadStillOpen %s/%s: part left behind, cleanup failed", bucket, uploadID)
+	}
+	s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchUpload)
+	return false
+}
+
 // getMultipartSSEAlgorithm returns the canonical SSE algorithm ("AES256" or
 // "aws:kms") that was stored when the multipart upload was initiated, or ""
 // if the upload entry is not found or had no SSE. It is used by the bucket
@@ -598,6 +667,7 @@ type CompleteMultipartUpload struct {
 type CompletedPart struct {
 	ETag       string
 	PartNumber int
+	ChecksumResult
 }
 
 // handleSSES3MultipartHeaders handles SSE-S3 multipart upload header setup to reduce nesting complexity
diff --git a/weed/s3api/s3api_object_handlers_postpolicy.go b/weed/s3api/s3api_object_handlers_postpolicy.go
index ce3d74d697..1e8705ba11 100644
--- a/weed/s3api/s3api_object_handlers_postpolicy.go
+++ b/weed/s3api/s3api_object_handlers_postpolicy.go
@@ -2,6 +2,7 @@ package s3api
 
 import (
 	"bytes"
+	"context"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -14,6 +15,7 @@ import (
 	"github.com/dustin/go-humanize"
 	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
@@ -79,11 +81,14 @@ func (s3a *S3ApiServer) PostPolicyBucketHandler(w http.ResponseWriter, r *http.R
 	}
 
 	// Verify policy signature.
-	errCode := s3a.iam.doesPolicySignatureMatch(formValues)
+	identity, errCode := s3a.iam.doesPolicySignatureMatch(r.Context(), formValues)
 	if errCode != s3err.ErrNone {
-		s3err.WriteErrorResponse(w, r, errCode)
+		s3err.WriteErrorResponse(w, r, refineDenialForBucketName(r, identity, errCode))
 		return
 	}
+	if identity != nil {
+		r = r.WithContext(recordIdentityInContext(r, identity))
+	}
 
 	policyBytes, err := base64.StdEncoding.DecodeString(formValues.Get("Policy"))
 	if err != nil {
@@ -123,8 +128,6 @@ func (s3a *S3ApiServer) PostPolicyBucketHandler(w http.ResponseWriter, r *http.R
 		}
 	}
 
-	filePath := fmt.Sprintf("%s/%s", s3a.bucketDir(bucket), object)
-
 	// Get ContentType from post formData
 	// Otherwise from formFile ContentType
 	contentType := formValues.Get("Content-Type")
@@ -136,16 +139,64 @@ func (s3a *S3ApiServer) PostPolicyBucketHandler(w http.ResponseWriter, r *http.R
 	// Forward validated POST form fields to the underlying PUT as headers.
 	applyPostPolicyFormHeaders(r, formValues)
 
-	// Use fileSize, not r.ContentLength: the multipart body wrapping form
-	// fields and boundaries inflates ContentLength relative to the
-	// object body, which would mis-evaluate any size-filtered rule.
-	ttlSec := s3a.lifecycleTTLForObjectWrite(bucket, object, fileSize)
-	etag, errCode, sseMetadata := s3a.putToFiler(r, filePath, fileBody, bucket, object, 1, ttlSec, nil, false)
+	// Authorize the object like the PUT path; the coarse Write check above does not consult the bucket policy.
+	if errCode := s3a.iam.AuthorizeObjectWrite(r, identity, bucket, object); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, refineDenialForBucketName(r, identity, errCode))
+		return
+	}
+	// An acl or x-amz-grant-* form field rides onto the upload as ACL headers,
+	// which the PUT path only applies under s3:PutObjectAcl.
+	if postRequestsAcl(r) {
+		if errCode := s3a.iam.AuthorizeObjectAclWrite(r, identity, bucket, object); errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, refineDenialForBucketName(r, identity, errCode))
+			return
+		}
+	}
+
+	versioningState, err := s3a.getVersioningState(bucket)
+	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchBucket)
+			return
+		}
+		glog.Errorf("PostPolicyBucketHandler: versioning state for bucket %s: %v", bucket, err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+	objectLockEnabled, err := s3a.isObjectLockEnabled(bucket)
+	if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		glog.Errorf("PostPolicyBucketHandler: object lock state for bucket %s: %v", bucket, err)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+		return
+	}
+	if err := s3a.validateObjectLockHeaders(r, bucket, object, objectLockEnabled); err != nil {
+		glog.V(2).Infof("PostPolicyBucketHandler: object lock header validation failed for %s/%s: %v", bucket, object, err)
+		s3err.WriteErrorResponse(w, r, mapValidationErrorToS3Error(err))
+		return
+	}
+
+	var etag string
+	var versionId string
+	var sseMetadata SSEResponseMetadata
+	switch versioningState {
+	case s3_constants.VersioningEnabled:
+		versionId, etag, errCode, sseMetadata = s3a.putVersionedObject(r, bucket, object, fileBody, contentType)
+	case s3_constants.VersioningSuspended:
+		etag, errCode, sseMetadata = s3a.putSuspendedVersioningObject(r, bucket, object, fileBody, contentType)
+	default:
+		filePath := fmt.Sprintf("%s/%s", s3a.bucketDir(bucket), object)
+		// Use fileSize, not r.ContentLength: the multipart body inflates ContentLength.
+		ttlSec := s3a.lifecycleTTLForObjectWrite(bucket, object, fileSize)
+		etag, errCode, sseMetadata = s3a.putToFiler(r, filePath, fileBody, bucket, object, 1, ttlSec, nil, false, "")
+	}
 
 	if errCode != s3err.ErrNone {
 		s3err.WriteErrorResponse(w, r, errCode)
 		return
 	}
+	if versionId != "" {
+		w.Header().Set("x-amz-version-id", versionId)
+	}
 
 	if successRedirect != "" {
 		// Replace raw query params..
@@ -232,6 +283,17 @@ func applyPostPolicyFormHeaders(r *http.Request, formValues http.Header) {
 	}
 }
 
+// postRequestsAcl reports whether the request carries ACL headers, whether
+// promoted from the POST form fields or supplied on the request itself.
+func postRequestsAcl(r *http.Request) bool {
+	for _, header := range []string{s3_constants.AmzCannedAcl, s3_constants.AmzAclFullControl, s3_constants.AmzAclRead, s3_constants.AmzAclReadAcp, s3_constants.AmzAclWrite, s3_constants.AmzAclWriteAcp} {
+		if r.Header.Get(header) != "" {
+			return true
+		}
+	}
+	return false
+}
+
 // Extract form fields and file data from a HTTP POST Policy
 func extractPostPolicyFormValues(form *multipart.Form) (filePart io.ReadCloser, fileName, fileContentType string, fileSize int64, formValues http.Header, err error) {
 	// / HTML Form values
@@ -319,11 +381,26 @@ func getRedirectPostRawQuery(bucket, key, etag string) string {
 	return redirectValues.Encode()
 }
 
-// Check to see if Policy is signed correctly.
-func (iam *IdentityAccessManagement) doesPolicySignatureMatch(formValues http.Header) s3err.ErrorCode {
+// Check to see if Policy is signed correctly, returning the signing identity.
+// The verified form's access key is recorded in ctx's identity holder. The
+// identity's Write permission on the bucket is checked only once the signature
+// verifies, as on the header-signed path, so a form that fails verification
+// learns nothing about the key's permissions. A verified identity that may not
+// write is returned with ErrAccessDenied.
+func (iam *IdentityAccessManagement) doesPolicySignatureMatch(ctx context.Context, formValues http.Header) (*Identity, s3err.ErrorCode) {
+	var identity *Identity
+	var errCode s3err.ErrorCode
 	// For SignV2 - Signature field will be valid
 	if _, ok := formValues["Signature"]; ok {
-		return iam.doesPolicySignatureV2Match(formValues)
+		identity, errCode = iam.doesPolicySignatureV2Match(ctx, formValues)
+	} else {
+		identity, errCode = iam.doesPolicySignatureV4Match(ctx, formValues)
 	}
-	return iam.doesPolicySignatureV4Match(formValues)
+	if errCode != s3err.ErrNone {
+		return nil, errCode
+	}
+	if !identity.CanDo(s3_constants.ACTION_WRITE, formValues.Get("bucket"), "") {
+		return identity, s3err.ErrAccessDenied
+	}
+	return identity, s3err.ErrNone
 }
diff --git a/weed/s3api/s3api_object_handlers_postpolicy_authz_test.go b/weed/s3api/s3api_object_handlers_postpolicy_authz_test.go
new file mode 100644
index 0000000000..553ff2f0a5
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_postpolicy_authz_test.go
@@ -0,0 +1,276 @@
+package s3api
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"sort"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	postAuthzAccessKey = "AKIATESTTESTTEST"
+	postAuthzSecretKey = "secret-key-for-tests"
+	postAuthzRegion    = "us-east-1"
+	postAuthzService   = "s3"
+	postAuthzBucket    = "testbucket"
+	postAuthzPrincipal = "arn:aws:iam::000000000000:user/tester"
+
+	postAclAccessKey = "AKIAACLTESTTEST"
+	postAclSecretKey = "secret-key-for-acl-tests"
+	postAclPrincipal = "arn:aws:iam::000000000000:user/aclwriter"
+)
+
+// newPostAuthzServer builds an S3ApiServer whose non-admin "tester" identity
+// holds the coarse Write action on the bucket and whose bucket policy denies it
+// s3:PutObject under denied/: a writer confined by a bucket policy to part of a
+// shared bucket.
+func newPostAuthzServer(t *testing.T) *S3ApiServer {
+	t.Helper()
+
+	iam := &IdentityAccessManagement{
+		hashes:       make(map[string]*sync.Pool),
+		hashCounters: make(map[string]*int32),
+	}
+	err := iam.loadS3ApiConfiguration(&iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{{
+			Name:        "tester",
+			Account:     &iam_pb.Account{Id: "000000000000", DisplayName: "tester"},
+			Credentials: []*iam_pb.Credential{{AccessKey: postAuthzAccessKey, SecretKey: postAuthzSecretKey}},
+			Actions:     []string{"Read:" + postAuthzBucket, "Write:" + postAuthzBucket, "List:" + postAuthzBucket},
+		}, {
+			Name:        "aclwriter",
+			Account:     &iam_pb.Account{Id: "000000000000", DisplayName: "aclwriter"},
+			Credentials: []*iam_pb.Credential{{AccessKey: postAclAccessKey, SecretKey: postAclSecretKey}},
+			Actions:     []string{"Read:" + postAuthzBucket, "Write:" + postAuthzBucket, "WriteAcp:" + postAuthzBucket},
+		}},
+	})
+	require.NoError(t, err)
+
+	policyEngine := NewBucketPolicyEngine()
+	err = policyEngine.engine.SetBucketPolicy(postAuthzBucket, fmt.Sprintf(`{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Sid": "DenyTesterDeniedPrefix",
+			"Effect": "Deny",
+			"Principal": {"AWS": "%s"},
+			"Action": ["s3:PutObject"],
+			"Resource": ["arn:aws:s3:::%s/denied/*"]
+		}, {
+			"Sid": "DenyAclWriterAclPrefix",
+			"Effect": "Deny",
+			"Principal": {"AWS": "%s"},
+			"Action": ["s3:PutObjectAcl"],
+			"Resource": ["arn:aws:s3:::%s/acl-denied/*"]
+		}]
+	}`, postAuthzPrincipal, postAuthzBucket, postAclPrincipal, postAuthzBucket))
+	require.NoError(t, err)
+	iam.policyEngine = policyEngine
+
+	s3a := &S3ApiServer{
+		option:       &S3ApiServerOption{BucketsPath: "/buckets"},
+		iam:          iam,
+		policyEngine: policyEngine,
+	}
+	// Pre-populate the bucket registry so validateTableBucketObjectPath sees a
+	// non-table bucket without needing a live filer connection.
+	s3a.bucketRegistry = NewBucketRegistry(s3a)
+	s3a.bucketRegistry.setMetadataCache(&BucketMetaData{Name: postAuthzBucket, IsTableBucket: false})
+	return s3a
+}
+
+// newSignedPostRequest builds a signed multipart POST Object request whose POST
+// policy conditions are satisfied by the form, so the handler passes signature
+// and CheckPostPolicy verification and reaches the write-authorization stage.
+func newSignedPostRequest(t *testing.T, key string) *http.Request {
+	return newSignedPostRequestFor(t, key, postAuthzAccessKey, postAuthzSecretKey, nil)
+}
+
+// extraFields are added to both the form and the policy conditions so
+// CheckPostPolicy accepts them.
+func newSignedPostRequestFor(t *testing.T, key, accessKey, secretKey string, extraFields map[string]string) *http.Request {
+	t.Helper()
+
+	now := time.Now().UTC()
+	amzDate := now.Format(iso8601Format)
+	yyyymmddStr := now.Format(yyyymmdd)
+	credential := fmt.Sprintf("%s/%s/%s/%s/aws4_request", accessKey, yyyymmddStr, postAuthzRegion, postAuthzService)
+	expiration := now.Add(1 * time.Hour).Format("2006-01-02T15:04:05.000Z")
+
+	extraKeys := make([]string, 0, len(extraFields))
+	for k := range extraFields {
+		extraKeys = append(extraKeys, k)
+	}
+	sort.Strings(extraKeys)
+	conditions := []any{
+		[]any{"eq", "$bucket", postAuthzBucket},
+		[]any{"eq", "$key", key},
+		[]any{"eq", "$x-amz-credential", credential},
+		[]any{"eq", "$x-amz-algorithm", "AWS4-HMAC-SHA256"},
+		[]any{"eq", "$x-amz-date", amzDate},
+	}
+	for _, k := range extraKeys {
+		conditions = append(conditions, []any{"eq", "$" + k, extraFields[k]})
+	}
+	policyJSON, err := json.Marshal(map[string]any{
+		"expiration": expiration,
+		"conditions": conditions,
+	})
+	require.NoError(t, err)
+	encodedPolicy := base64.StdEncoding.EncodeToString(policyJSON)
+	signature := getSignature(getSigningKey(secretKey, yyyymmddStr, postAuthzRegion, postAuthzService), encodedPolicy)
+
+	var buf bytes.Buffer
+	writer := multipart.NewWriter(&buf)
+	require.NoError(t, writer.WriteField("bucket", postAuthzBucket))
+	require.NoError(t, writer.WriteField("key", key))
+	require.NoError(t, writer.WriteField("x-amz-credential", credential))
+	require.NoError(t, writer.WriteField("x-amz-algorithm", "AWS4-HMAC-SHA256"))
+	require.NoError(t, writer.WriteField("x-amz-date", amzDate))
+	for _, k := range extraKeys {
+		require.NoError(t, writer.WriteField(k, extraFields[k]))
+	}
+	require.NoError(t, writer.WriteField("policy", encodedPolicy))
+	require.NoError(t, writer.WriteField("x-amz-signature", signature))
+	filePart, err := writer.CreateFormFile("file", "payload.txt")
+	require.NoError(t, err)
+	_, err = filePart.Write([]byte("payload"))
+	require.NoError(t, err)
+	require.NoError(t, writer.Close())
+
+	req := httptest.NewRequest(http.MethodPost, "/"+postAuthzBucket, &buf)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	return mux.SetURLVars(req, map[string]string{"bucket": postAuthzBucket})
+}
+
+// TestPostPolicyBucketHandlerHonorsBucketPolicyDeny drives a signed POST Object
+// upload whose key a bucket policy denies the caller, and asserts the handler
+// rejects it with 403 -- the same result the equivalent PUT gives, now that POST
+// runs the shared per-key authorization instead of only the coarse Write check.
+func TestPostPolicyBucketHandlerHonorsBucketPolicyDeny(t *testing.T) {
+	s3a := newPostAuthzServer(t)
+
+	// Precondition: the policy really denies this principal the denied/ key, so a
+	// non-403 below is the POST path not consulting it, not a mis-configured policy.
+	putReq := httptest.NewRequest(http.MethodPut, "/"+postAuthzBucket+"/denied/secret.txt", nil)
+	allowed, evaluated, err := s3a.iam.policyEngine.EvaluatePolicy(
+		postAuthzBucket, "denied/secret.txt", s3_constants.ACTION_WRITE, postAuthzPrincipal, putReq, nil, nil)
+	require.NoError(t, err)
+	require.True(t, evaluated, "policy must match the denied key for the tester principal")
+	require.False(t, allowed, "policy must deny the tester principal on the denied key")
+
+	rec := httptest.NewRecorder()
+	s3a.PostPolicyBucketHandler(rec, newSignedPostRequest(t, "denied/secret.txt"))
+
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"POST Object into a bucket-policy-denied key must be rejected, body: %s", rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "AccessDenied",
+		"response should identify AccessDenied, body: %s", rec.Body.String())
+}
+
+// TestAuthorizeObjectWrite covers the write-authorization decision the POST
+// handler defers to: a bucket-policy Deny blocks the key, a key the policy does
+// not deny clears (the coarse Write action still grants it), and admins are
+// unaffected. Driving the full handler for the allowed case is not hermetic --
+// past authorization it reaches the lifecycle/write path that needs a filer --
+// so the counter-cases are checked at the authorization boundary directly.
+func TestAuthorizeObjectWrite(t *testing.T) {
+	s3a := newPostAuthzServer(t)
+	tester, _, found := s3a.iam.lookupByAccessKey(postAuthzAccessKey)
+	require.True(t, found)
+
+	req := httptest.NewRequest(http.MethodPost, "/"+postAuthzBucket, nil)
+
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.iam.AuthorizeObjectWrite(req, tester, postAuthzBucket, "denied/secret.txt"),
+		"a bucket-policy-denied key must be denied")
+	assert.Equal(t, s3err.ErrNone,
+		s3a.iam.AuthorizeObjectWrite(req, tester, postAuthzBucket, "allowed/report.txt"),
+		"a key the policy does not deny must clear on the coarse Write grant")
+
+	admin := &Identity{Name: "admin", Actions: []Action{s3_constants.ACTION_ADMIN}}
+	assert.Equal(t, s3err.ErrNone,
+		s3a.iam.AuthorizeObjectWrite(req, admin, postAuthzBucket, "denied/secret.txt"),
+		"an admin is not confined by the bucket policy")
+}
+
+// TestPostPolicyBucketHandlerGatesAclFields drives signed POST uploads carrying
+// an acl form field and asserts the handler rejects them the way the PUT path
+// does: a writer without the WriteAcp action is refused, and so is a writer the
+// bucket policy denies s3:PutObjectAcl on the target key.
+func TestPostPolicyBucketHandlerGatesAclFields(t *testing.T) {
+	s3a := newPostAuthzServer(t)
+
+	rec := httptest.NewRecorder()
+	s3a.PostPolicyBucketHandler(rec, newSignedPostRequestFor(t, "allowed/report.txt",
+		postAuthzAccessKey, postAuthzSecretKey, map[string]string{"acl": "public-read"}))
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"POST with an acl field needs WriteAcp like PUT, body: %s", rec.Body.String())
+
+	rec = httptest.NewRecorder()
+	s3a.PostPolicyBucketHandler(rec, newSignedPostRequestFor(t, "acl-denied/secret.txt",
+		postAclAccessKey, postAclSecretKey, map[string]string{"acl": "public-read"}))
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"POST with an acl field must honor the bucket-policy PutObjectAcl deny, body: %s", rec.Body.String())
+
+	for _, field := range []string{"x-amz-grant-read", "x-amz-grant-write", "x-amz-grant-read-acp", "x-amz-grant-write-acp", "x-amz-grant-full-control"} {
+		rec = httptest.NewRecorder()
+		s3a.PostPolicyBucketHandler(rec, newSignedPostRequestFor(t, "allowed/report.txt",
+			postAuthzAccessKey, postAuthzSecretKey,
+			map[string]string{field: `id="0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"`}))
+		assert.Equal(t, http.StatusForbidden, rec.Code,
+			"POST with an %s field needs WriteAcp like PUT, body: %s", field, rec.Body.String())
+	}
+}
+
+func TestPostRequestsAcl(t *testing.T) {
+	for _, header := range []string{
+		s3_constants.AmzCannedAcl, s3_constants.AmzAclFullControl, s3_constants.AmzAclRead,
+		s3_constants.AmzAclReadAcp, s3_constants.AmzAclWrite, s3_constants.AmzAclWriteAcp,
+	} {
+		req := httptest.NewRequest(http.MethodPost, "/"+postAuthzBucket, nil)
+		req.Header.Set(header, "x")
+		assert.True(t, postRequestsAcl(req), "%s must trip the ACL gate", header)
+	}
+	assert.False(t, postRequestsAcl(httptest.NewRequest(http.MethodPost, "/"+postAuthzBucket, nil)))
+}
+
+// TestAuthorizeObjectAclWrite covers the acl authorization decision at the
+// boundary, for the same reason as TestAuthorizeObjectWrite.
+func TestAuthorizeObjectAclWrite(t *testing.T) {
+	s3a := newPostAuthzServer(t)
+	tester, _, found := s3a.iam.lookupByAccessKey(postAuthzAccessKey)
+	require.True(t, found)
+	aclwriter, _, found := s3a.iam.lookupByAccessKey(postAclAccessKey)
+	require.True(t, found)
+
+	req := httptest.NewRequest(http.MethodPost, "/"+postAuthzBucket, nil)
+
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.iam.AuthorizeObjectAclWrite(req, tester, postAuthzBucket, "allowed/report.txt"),
+		"a writer without the WriteAcp action cannot attach an ACL")
+	assert.Equal(t, s3err.ErrNone,
+		s3a.iam.AuthorizeObjectAclWrite(req, aclwriter, postAuthzBucket, "allowed/report.txt"),
+		"the WriteAcp holder clears keys the policy does not deny")
+	assert.Equal(t, s3err.ErrAccessDenied,
+		s3a.iam.AuthorizeObjectAclWrite(req, aclwriter, postAuthzBucket, "acl-denied/secret.txt"),
+		"a bucket-policy PutObjectAcl deny must block the ACL-bearing upload")
+
+	admin := &Identity{Name: "admin", Actions: []Action{s3_constants.ACTION_ADMIN}}
+	assert.Equal(t, s3err.ErrNone,
+		s3a.iam.AuthorizeObjectAclWrite(req, admin, postAuthzBucket, "acl-denied/secret.txt"),
+		"an admin is not confined by the bucket policy")
+}
diff --git a/weed/s3api/s3api_object_handlers_put.go b/weed/s3api/s3api_object_handlers_put.go
index 3e30b67746..aa6682712a 100644
--- a/weed/s3api/s3api_object_handlers_put.go
+++ b/weed/s3api/s3api_object_handlers_put.go
@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"hash"
 	"io"
+	"math"
 	"net/http"
 	"net/url"
 	"path"
@@ -17,10 +18,12 @@ import (
 	"strings"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/pquerna/cachecontrol/cacheobject"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
@@ -29,6 +32,9 @@ import (
 	weed_server "github.com/seaweedfs/seaweedfs/weed/server"
 	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/util/constants"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 // Object lock validation errors
@@ -41,6 +47,7 @@ var (
 	ErrObjectLockModeRequiresDate            = errors.New("object lock mode requires retention until date")
 	ErrRetentionDateRequiresMode             = errors.New("retention until date requires object lock mode")
 	ErrGovernanceBypassVersioningRequired    = errors.New("governance bypass header can only be used on buckets with Object Lock enabled")
+	ErrObjectLockNotAuthorized               = errors.New("object lock headers require the corresponding object lock permission")
 	ErrInvalidObjectLockDuration             = errors.New("object lock duration must be greater than 0 days")
 	ErrObjectLockDurationExceeded            = errors.New("object lock duration exceeds maximum allowed days")
 	ErrObjectLockConfigurationMissingEnabled = errors.New("object lock configuration must specify ObjectLockEnabled")
@@ -81,6 +88,20 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 	// http://docs.aws.amazon.com/AmazonS3/latest/dev/UploadingObjects.html
 
 	bucket, object := s3_constants.GetBucketAndObject(r)
+
+	// A copy-source header that did not satisfy the CopyObject route is
+	// malformed (it needs a '/' separating source bucket from key), and a
+	// partNumber/uploadId pair that did not satisfy the UploadPart route is
+	// malformed too; neither should be silently written as a plain object.
+	if r.Header.Get("X-Amz-Copy-Source") != "" {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidCopySource)
+		return
+	}
+	if r.URL.Query().Has("partNumber") || r.URL.Query().Has("uploadId") {
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidArgument)
+		return
+	}
+
 	_, err := validateContentMd5(r.Header)
 	if err != nil {
 		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidDigest)
@@ -91,7 +112,7 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 		s3err.WriteErrorResponse(w, r, s3err.ErrKeyTooLongError)
 		return
 	}
-	if err := s3a.validateTableBucketObjectPath(bucket, object); err != nil {
+	if isVerify, err := s3a.validateTableBucketObjectPathOrVerify(bucket, object); err != nil || (isVerify && !volumeVerifyPutAllowed(r, object)) {
 		s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
 		return
 	}
@@ -108,6 +129,11 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
+	if errCode := ValidateRequestEncryption(r.Header); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	if r.Header.Get("Cache-Control") != "" {
 		if _, err = cacheobject.ParseRequestCacheControl(r.Header.Get("Cache-Control")); err != nil {
 			s3err.WriteErrorResponse(w, r, s3err.ErrInvalidDigest)
@@ -129,8 +155,42 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 	}
 	defer dataReader.Close()
 
+	if isExtractZip(r) {
+		s3a.extractZipObject(w, r, bucket, object, dataReader)
+		return
+	}
+
 	objectContentType := r.Header.Get("Content-Type")
 	if strings.HasSuffix(object, "/") && r.ContentLength <= 1024 {
+		// The filer mkdir below would implicitly create a missing bucket, so gate it
+		// on the same auto-create policy as regular uploads.
+		if err := s3a.checkBucket(r, bucket); err == s3err.ErrNoSuchBucket {
+			if !s3a.handleAutoCreateBucket(w, r, bucket, "PutObjectHandler") {
+				return
+			}
+		} else if err != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, err)
+			return
+		}
+
+		var aclCode s3err.ErrorCode
+		r, aclCode = s3a.preparePutObjectACL(r, bucket)
+		if aclCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, aclCode)
+			return
+		}
+
+		objectLockEnabled, lockErr := s3a.isObjectLockEnabled(bucket)
+		if lockErr != nil && !errors.Is(lockErr, filer_pb.ErrNotFound) {
+			glog.Errorf("PutObjectHandler: failed to check object lock for bucket %s: %v", bucket, lockErr)
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			return
+		}
+		if validationErr := s3a.validateObjectLockHeaders(r, bucket, object, objectLockEnabled); validationErr != nil {
+			glog.V(2).Infof("PutObjectHandler: object lock header validation failed for %s/%s: %v", bucket, object, validationErr)
+			s3err.WriteErrorResponse(w, r, mapValidationErrorToS3Error(validationErr))
+			return
+		}
 		// Split the object into directory path and name
 		objectWithoutSlash := strings.TrimSuffix(object, "/")
 		dirName := path.Dir(objectWithoutSlash)
@@ -154,7 +214,11 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 			dirContent, readErr = io.ReadAll(dataReader)
 			if readErr != nil {
 				glog.Errorf("PutObjectHandler: failed to read directory marker content %s/%s: %v", bucket, object, readErr)
-				s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+				if strings.Contains(readErr.Error(), s3err.ErrMsgContentSha256Mismatch) {
+					s3err.WriteErrorResponse(w, r, s3err.ErrContentSHA256Mismatch)
+				} else {
+					s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+				}
 				return
 			}
 		}
@@ -163,32 +227,80 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 		dirMd5 := md5.Sum(dirContent)
 		dirEtag := fmt.Sprintf("%x", dirMd5)
 
-		glog.Infof("PutObjectHandler: explicit directory marker %s/%s (contentType=%q, len=%d)",
-			bucket, object, objectContentType, r.ContentLength)
-		if err := s3a.mkdir(
-			fullDirPath, entryName,
-			func(entry *filer_pb.Entry) {
-				if objectContentType == "" {
-					objectContentType = s3_constants.FolderMimeType
-				}
-				if len(dirContent) > 0 {
-					entry.Content = dirContent
-				}
-				entry.Attributes.Mime = objectContentType
-				entry.Attributes.Md5 = dirMd5[:]
-
-				// Store ETag in extended attributes for consistency with regular objects
-				if entry.Extended == nil {
-					entry.Extended = make(map[string][]byte)
-				}
-				entry.Extended[s3_constants.ExtETagKey] = []byte(dirEtag)
-
-				// Set object owner for directory objects (same as regular objects)
-				s3a.setObjectOwnerFromRequest(r, bucket, entry)
-			}); err != nil {
-			s3err.WriteErrorResponse(w, r, filerErrorToS3Error(err))
+		// SSE applies to marker content too — it is stored in entry.Content
+		sseResult, sseErrCode := s3a.handleAllSSEEncryption(r, bytes.NewReader(dirContent), 0)
+		if sseErrCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, sseErrCode)
 			return
 		}
+		if dirContent, err = io.ReadAll(sseResult.DataReader); err != nil {
+			glog.Errorf("PutObjectHandler: failed to encrypt directory marker content %s/%s: %v", bucket, object, err)
+			s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
+			return
+		}
+
+		glog.Infof("PutObjectHandler: explicit directory marker %s/%s (contentType=%q, len=%d)",
+			bucket, object, objectContentType, r.ContentLength)
+		// mkdir replaces this entry outright, so a lock recorded on the entry itself
+		// is what stands in the way -- not the latest version, which a versioned
+		// write of the same key is free to add to. Check it under the same lock the
+		// marker delete takes, so the entry cannot change in between.
+		markerCode := s3a.withObjectWriteLock(bucket, object, func() s3err.ErrorCode {
+			if !objectLockEnabled {
+				return s3err.ErrNone
+			}
+			existing, existErr := s3a.getEntry(fullDirPath, entryName)
+			if existErr != nil {
+				return s3err.ErrNone
+			}
+			if lockErr := s3a.enforceObjectLockOnEntry(existing, bucket, object, "", s3a.evaluateGovernanceBypassRequest(r, bucket, object)); lockErr != nil {
+				glog.V(2).Infof("PutObjectHandler: object lock permissions check failed for %s/%s: %v", bucket, object, lockErr)
+				return s3err.ErrAccessDenied
+			}
+			return s3err.ErrNone
+		}, func() s3err.ErrorCode {
+			if err := s3a.mkdir(
+				fullDirPath, entryName,
+				func(entry *filer_pb.Entry) {
+					if objectContentType == "" {
+						objectContentType = s3_constants.FolderMimeType
+					}
+					if len(dirContent) > 0 {
+						entry.Content = dirContent
+					}
+					entry.Attributes.Mime = objectContentType
+					entry.Attributes.Md5 = dirMd5[:]
+
+					// Store ETag in extended attributes for consistency with regular objects
+					if entry.Extended == nil {
+						entry.Extended = make(map[string][]byte)
+					}
+					entry.Extended[s3_constants.ExtETagKey] = []byte(dirEtag)
+
+					storeSSEMetadata(entry, sseResult)
+
+					// Set object owner for directory objects (same as regular objects)
+					s3a.setObjectOwnerFromRequest(r, bucket, entry)
+					applyPutObjectACL(r, entry)
+
+					if lockErr := s3a.extractObjectLockMetadataFromRequest(r, entry); lockErr != nil {
+						glog.Errorf("PutObjectHandler: failed to extract object lock metadata for %s/%s: %v", bucket, object, lockErr)
+					}
+				}); err != nil {
+				return filerErrorToS3Error(err)
+			}
+			return s3err.ErrNone
+		})
+		if markerCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, markerCode)
+			return
+		}
+		sseRespMetadata := SSEResponseMetadata{SSEType: sseResult.SSEType}
+		if sseResult.SSEKMSKey != nil {
+			sseRespMetadata.KMSKeyID = sseResult.SSEKMSKey.KeyID
+			sseRespMetadata.BucketKeyEnabled = sseResult.SSEKMSKey.BucketKeyEnabled
+		}
+		s3a.setSSEResponseHeaders(w, r, sseRespMetadata)
 		setEtag(w, dirEtag)
 	} else {
 		// Get detailed versioning state for the bucket
@@ -214,6 +326,13 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 			}
 		}
 
+		var aclCode s3err.ErrorCode
+		r, aclCode = s3a.preparePutObjectACL(r, bucket)
+		if aclCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, aclCode)
+			return
+		}
+
 		versioningEnabled := (versioningState == s3_constants.VersioningEnabled)
 		versioningConfigured := (versioningState != "")
 
@@ -228,7 +347,7 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 		}
 
 		// Validate object lock headers before processing
-		if err := s3a.validateObjectLockHeaders(r, objectLockEnabled); err != nil {
+		if err := s3a.validateObjectLockHeaders(r, bucket, object, objectLockEnabled); err != nil {
 			glog.V(2).Infof("PutObjectHandler: object lock header validation failed for bucket %s, object %s: %v", bucket, object, err)
 			s3err.WriteErrorResponse(w, r, mapValidationErrorToS3Error(err))
 			return
@@ -297,7 +416,7 @@ func (s3a *S3ApiServer) PutObjectHandler(w http.ResponseWriter, r *http.Request)
 			}
 
 			ttlSec := s3a.lifecycleTTLForObjectWrite(bucket, object, r.ContentLength)
-			etag, errCode, sseMetadata := s3a.putToFiler(r, filePath, dataReader, bucket, object, 1, ttlSec, nil, false)
+			etag, errCode, sseMetadata := s3a.putToFiler(r, filePath, dataReader, bucket, object, 1, ttlSec, nil, false, "")
 
 			if errCode != s3err.ErrNone {
 				s3err.WriteErrorResponse(w, r, errCode)
@@ -332,7 +451,11 @@ func (s3a *S3ApiServer) withObjectWriteLock(bucket, object string, preconditionF
 		return fn()
 	}
 
-	lock := s3a.newObjectWriteLock(bucket, object)
+	lock, err := s3a.newObjectWriteLock(bucket, object)
+	if err != nil {
+		glog.Warningf("withObjectWriteLock: %v", err)
+		return s3err.ErrServiceUnavailable
+	}
 	if lock == nil {
 		if errCode := runPrecondition(); errCode != s3err.ErrNone {
 			return errCode
@@ -361,6 +484,10 @@ type putFinalize struct {
 	lockKey     string
 	mutations   []*filer_pb.ObjectMutation
 	afterCreate func(entry *filer_pb.Entry) s3err.ErrorCode
+	// conditionAltKey names the entry a routed WriteCondition falls back to
+	// when the write path is absent — a suspended-versioning write points it
+	// at the latest version so check and write stay under the filer lock
+	conditionAltKey string
 }
 
 const (
@@ -391,10 +518,31 @@ func (s3a *S3ApiServer) uploadChunkSize() int32 {
 // pass 0 because their own keys aren't the user-visible object the rule
 // targets and a part write would otherwise bind a TTL clock starting
 // before CompleteMultipartUpload.
-func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader io.Reader, bucket string, object string, partNumber int, lifecycleTTLSec int32, finalize *putFinalize, uniqueWritePath bool) (etag string, code s3err.ErrorCode, sseMetadata SSEResponseMetadata) {
+//
+// storageDestination overrides the path the filer resolves filer.conf storage
+// rules against, empty meaning filePath. MPU parts stage under the bucket's
+// .uploads folder but their bytes become the object, so they pass the object's
+// path the way the x-seaweedfs-destination header used to carry it.
+func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader io.Reader, bucket string, object string, partNumber int, lifecycleTTLSec int32, finalize *putFinalize, uniqueWritePath bool, storageDestination string) (etag string, code s3err.ErrorCode, sseMetadata SSEResponseMetadata) {
 	if !s3_constants.IsValidBucketName(bucket) || (object != "" && !s3_constants.IsValidObjectKey(object)) {
 		return "", s3err.ErrInvalidRequest, SSEResponseMetadata{}
 	}
+
+	// Reject invalid tags before any chunks are uploaded so a failed request
+	// leaves nothing behind on the volume servers.
+	var tagSet map[string]string
+	if tagging := r.Header.Get(s3_constants.AmzObjectTagging); tagging != "" {
+		parsed, err := parseTagsHeader(tagging)
+		if err != nil {
+			glog.Warningf("putToFiler: invalid tagging header for %s: %v", filePath, err)
+			return "", s3err.ErrInvalidTag, SSEResponseMetadata{}
+		}
+		if err := ValidateTags(parsed); err != nil {
+			glog.Warningf("putToFiler: invalid tags (%d) for %s: %v", len(parsed), filePath, err)
+			return "", s3err.ErrInvalidTag, SSEResponseMetadata{}
+		}
+		tagSet = parsed
+	}
 	// NEW OPTIMIZATION: Write directly to volume servers, bypassing filer proxy
 	// This eliminates the filer proxy overhead for PUT operations
 	// Note: filePath is now passed directly instead of URL (no parsing needed)
@@ -442,7 +590,7 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 
 	// Apply bucket default encryption if no explicit encryption was provided
 	// This implements AWS S3 behavior where bucket default encryption automatically applies
-	if !hasExplicitEncryption(customerKey, sseKMSKey, sseS3Key) && !s3a.cipher {
+	if !hasExplicitEncryption(customerKey, sseKMSKey, sseS3Key) {
 		glog.V(4).Infof("putToFiler: no explicit encryption detected, checking for bucket default encryption")
 
 		// Apply bucket default encryption and get the result
@@ -481,6 +629,12 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 				return "", s3err.ErrInternalError, SSEResponseMetadata{}
 			}
 		}
+
+		sseResult.SSEKMSKey = sseKMSKey
+		sseResult.SSEKMSMetadata = sseKMSMetadata
+		sseResult.SSES3Key = sseS3Key
+		sseResult.SSES3Metadata = sseS3Metadata
+		sseResult.SSEType = sseType
 	} else {
 		glog.V(4).Infof("putToFiler: explicit encryption already applied, skipping bucket default encryption")
 	}
@@ -495,6 +649,11 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 		collection = s3a.getCollectionName(bucket)
 	}
 
+	assignPath := filePath
+	if storageDestination != "" {
+		assignPath = storageDestination
+	}
+
 	// Create assign function for chunked upload
 	assignFunc := func(ctx context.Context, count int, expectedDataSize uint64) (*operation.VolumeAssignRequest, *operation.AssignResult, error) {
 		var assignResult *filer_pb.AssignVolumeResponse
@@ -505,15 +664,15 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 				Collection:       collection,
 				DiskType:         "",
 				DataCenter:       s3a.option.DataCenter,
-				Path:             filePath,
+				Path:             assignPath,
 				ExpectedDataSize: expectedDataSize,
 				TtlSec:           lifecycleTTLSec,
 			})
 			if err != nil {
 				return fmt.Errorf("assign volume: %w", err)
 			}
-			if resp.Error != "" {
-				return fmt.Errorf("assign volume: %v", resp.Error)
+			if err := filer_pb.AssignVolumeResponseError(resp); err != nil {
+				return fmt.Errorf("assign volume: %w", err)
 			}
 			assignResult = resp
 			return nil
@@ -529,6 +688,7 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 			PublicUrl: assignResult.Location.PublicUrl,
 			Count:     uint64(count),
 			Auth:      security.EncodedJwt(assignResult.Auth),
+			Fsync:     assignResult.Fsync,
 		}
 		for _, replica := range assignResult.Replicas {
 			result.Replicas = append(result.Replicas, operation.Location{
@@ -552,6 +712,7 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 		MimeType:        r.Header.Get("Content-Type"),
 		Cipher:          s3a.cipher, // encrypt data on volume servers
 		AssignFunc:      assignFunc,
+		LookupJwtFunc:   s3a.lookupVolumeJwt,
 	})
 	if err != nil {
 		glog.Errorf("putToFiler: chunked upload failed: %v", err)
@@ -683,8 +844,8 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 			Crtime:   now.Unix(),
 			Mtime:    now.Unix(),
 			FileMode: fileMode,
-			Uid:      0,
-			Gid:      0,
+			Uid:      filer_pb.OS_UID,
+			Gid:      filer_pb.OS_GID,
 			Mime:     mimeType,
 			FileSize: uint64(chunkResult.TotalSize),
 			TtlSec:   lifecycleTTLSec,
@@ -707,6 +868,11 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 	// Store ETag in Extended attribute for future retrieval (e.g. multipart parts)
 	entry.Extended[s3_constants.ExtETagKey] = []byte(etag)
 
+	// Stamp this write's identity: an ambiguously committed PUT is told apart
+	// from an identical older object by it during recovery, which chunk identity
+	// cannot do for a chunkless (empty) object.
+	entry.Extended[s3_constants.SeaweedFSWriteId] = []byte(uuid.NewString())
+
 	// Store additional checksum if one was computed
 	checksumBase64 := ""
 	if checksumHash != nil && checksumHeaderName != "" {
@@ -727,9 +893,16 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 
 	// Set object owner according to bucket ownership settings.
 	s3a.setObjectOwnerFromRequest(r, bucket, entry)
+	applyPutObjectACL(r, entry)
 
-	// Set version ID if present
+	// Set version ID if present. It is later used as a filer path segment, so a
+	// value carrying "/", "\\" or ".." must never be stored.
 	if versionIdHeader := r.Header.Get(s3_constants.ExtVersionIdKey); versionIdHeader != "" {
+		if !isValidVersionID(versionIdHeader) {
+			glog.Warningf("putToFiler: rejecting invalid version ID %q for object %s", versionIdHeader, filePath)
+			s3a.deleteOrphanedChunks(chunkResult.FileChunks)
+			return "", s3err.ErrInvalidRequest, SSEResponseMetadata{}
+		}
 		entry.Extended[s3_constants.ExtVersionIdKey] = []byte(versionIdHeader)
 		glog.V(3).Infof("putToFiler: setting version ID %s for object %s", versionIdHeader, filePath)
 	}
@@ -758,8 +931,12 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 				entry.Extended[k] = []byte(v[0])
 			} else {
 				switch k {
-				case "Cache-Control", "Expires", "Content-Disposition", "Content-Encoding", "Content-Language":
+				case "Cache-Control", "Expires", "Content-Disposition", "Content-Language":
 					entry.Extended[k] = []byte(v[0])
+				case "Content-Encoding":
+					if ce := storedContentEncoding(v); ce != "" {
+						entry.Extended[k] = []byte(ce)
+					}
 				}
 			}
 			if k == "Response-Content-Disposition" {
@@ -777,55 +954,15 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 		entry.Extended[s3_constants.AmzStorageClass] = []byte(sc)
 	}
 
-	// Parse and store object tags from X-Amz-Tagging header
-	// Fix for GitHub issue #7589: Tags sent during object upload were not being stored
-	if tagging := r.Header.Get(s3_constants.AmzObjectTagging); tagging != "" {
-		parsedTags, err := url.ParseQuery(tagging)
-		if err != nil {
-			glog.Warningf("putToFiler: Invalid S3 tag format in header '%s': %v", tagging, err)
-			return "", s3err.ErrInvalidTag, SSEResponseMetadata{}
-		}
-		for key, values := range parsedTags {
-			if len(values) > 1 {
-				glog.Warningf("putToFiler: Duplicate tag key '%s' in header", key)
-				return "", s3err.ErrInvalidTag, SSEResponseMetadata{}
-			}
-			value := ""
-			if len(values) > 0 {
-				value = values[0]
-			}
-			entry.Extended[s3_constants.AmzObjectTagging+"-"+key] = []byte(value)
-		}
-		glog.V(3).Infof("putToFiler: stored %d tags from X-Amz-Tagging header", len(parsedTags))
+	// Store the tags validated before the chunk upload
+	for key, value := range tagSet {
+		entry.Extended[s3_constants.AmzObjectTagging+"-"+key] = []byte(value)
+	}
+	if len(tagSet) > 0 {
+		glog.V(3).Infof("putToFiler: stored %d tags from X-Amz-Tagging header", len(tagSet))
 	}
 
-	// Set SSE-C metadata
-	if customerKey != nil && len(sseIV) > 0 {
-		// Store IV as RAW bytes (matches filer behavior - filer decodes base64 headers and stores raw bytes)
-		entry.Extended[s3_constants.SeaweedFSSSEIV] = sseIV
-		entry.Extended[s3_constants.AmzServerSideEncryptionCustomerAlgorithm] = []byte("AES256")
-		entry.Extended[s3_constants.AmzServerSideEncryptionCustomerKeyMD5] = []byte(customerKey.KeyMD5)
-		glog.V(3).Infof("putToFiler: storing SSE-C metadata - IV len=%d", len(sseIV))
-	}
-
-	// Set SSE-KMS metadata
-	if sseKMSKey != nil {
-		// Store metadata as RAW bytes (matches filer behavior - filer decodes base64 headers and stores raw bytes)
-		entry.Extended[s3_constants.SeaweedFSSSEKMSKey] = sseKMSMetadata
-		// Set standard SSE headers for detection
-		entry.Extended[s3_constants.AmzServerSideEncryption] = []byte("aws:kms")
-		entry.Extended[s3_constants.AmzServerSideEncryptionAwsKmsKeyId] = []byte(sseKMSKey.KeyID)
-		glog.V(3).Infof("putToFiler: storing SSE-KMS metadata - keyID=%s, raw len=%d", sseKMSKey.KeyID, len(sseKMSMetadata))
-	}
-
-	// Set SSE-S3 metadata
-	if sseS3Key != nil && len(sseS3Metadata) > 0 {
-		// Store metadata as RAW bytes (matches filer behavior - filer decodes base64 headers and stores raw bytes)
-		entry.Extended[s3_constants.SeaweedFSSSES3Key] = sseS3Metadata
-		// Set standard SSE header for detection
-		entry.Extended[s3_constants.AmzServerSideEncryption] = []byte("AES256")
-		glog.V(3).Infof("putToFiler: storing SSE-S3 metadata - keyID=%s, raw len=%d", sseS3Key.KeyID, len(sseS3Metadata))
-	}
+	storeSSEMetadata(entry, sseResult)
 
 	// Parts (object == "") stay flat: completion rebases chunk offsets, which
 	// manifest chunks cannot express.
@@ -841,32 +978,65 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 	var createErr error
 	var rollbackErr error
 	entryCreated := false
+	var owner pb.ServerAddress
 	preconditionFn := func() s3err.ErrorCode {
 		if object == "" {
 			return s3err.ErrNone
 		}
 		return s3a.checkConditionalHeaders(r, bucket, object)
 	}
-	createUnderLock := func() s3err.ErrorCode {
-		createErr = s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+	createUnderLock := func(cond *filer_pb.WriteCondition) s3err.ErrorCode {
+		create := func(client filer_pb.SeaweedFilerClient) error {
 			req := &filer_pb.CreateEntryRequest{
 				Directory: path.Dir(filePath),
 				Entry:     entry,
+				Condition: cond,
 			}
 			glog.V(3).Infof("putToFiler: Calling CreateEntry for %s", filePath)
-			if err := filer_pb.CreateEntry(context.Background(), client, req); err != nil {
+			err := filer_pb.CreateEntry(context.Background(), client, req)
+			// A verification key in a table bucket never becomes a prefix
+			// object: the directory it meets is a namespace, created after the
+			// handler looked.
+			if errors.Is(err, filer_pb.ErrExistingIsDirectory) && !isReservedDirectoryName(entry.Name) &&
+				!(isVolumeVerifyKey(object) && s3a.isTableBucket(bucket)) {
+				// Other keys are nested under this one. S3 keys are flat, so the key is
+				// stored on the directory they live under rather than refused.
+				entry.MarkPrefixObject()
+				err = filer_pb.CreateEntry(context.Background(), client, req)
+			}
+			if err != nil {
 				glog.Errorf("putToFiler: CreateEntry returned error: %v", err)
 				return err
 			}
 			return nil
-		})
+		}
+		// A conditional create must not be replayed once possibly sent: a lost
+		// commit followed by a delete lets the replayed IF_NOT_EXISTS pass and
+		// recreates an entry whose chunks the delete already reclaimed.
+		if cond != nil && owner != "" {
+			// The condition and the routed write serialize on the owner's
+			// per-path lock. Failover cannot preserve that: another filer's lock
+			// is a different boundary, and its forwarding is only correct when
+			// its ring view agrees — exactly what is not guaranteed after an
+			// ambiguous write. The create goes to the owner alone; an
+			// unreachable owner leaves the outcome uncertain.
+			createErr = pb.WithFilerClient(false, 0, owner, s3a.option.GrpcDialOption, create)
+			switch status.Code(createErr) {
+			case codes.Unavailable, codes.Canceled, codes.DeadlineExceeded:
+				s3a.markOwnerUnreachable(owner)
+			}
+		} else if s3a.filerClient != nil {
+			createErr = s3a.withFilerClientFailover(context.Background(), "", false, cond == nil, create)
+		} else {
+			createErr = s3a.withFilerClient(context.Background(), false, create)
+		}
 		if createErr != nil {
 			return filerErrorToS3Error(createErr)
 		}
 		entryCreated = true
 		if finalize != nil && finalize.afterCreate != nil {
 			if afterCreateCode := finalize.afterCreate(entry); afterCreateCode != s3err.ErrNone {
-				rollbackErr = s3a.rmObject(path.Dir(filePath), path.Base(filePath), true, false)
+				rollbackErr = s3a.rmObject(context.Background(), path.Dir(filePath), path.Base(filePath), true, false)
 				if rollbackErr != nil {
 					glog.Errorf("putToFiler: failed to rollback created entry for %s after post-create error: %v", filePath, rollbackErr)
 				} else {
@@ -882,22 +1052,47 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 	// it); conditional/object-lock/non-reducible cases fall back to the lock.
 	var createCode s3err.ErrorCode
 	routed := false
-	if owner := s3a.routableWriteOwner(bucket, object); owner != "" {
-		if cond, ok := routeWriteCondition(r, uniqueWritePath); ok {
+	routedAmbiguous := false
+	condAltKey := ""
+	if finalize != nil {
+		condAltKey = finalize.conditionAltKey
+	}
+	if owner = s3a.routableWriteOwner(bucket, object); owner != "" {
+		if cond, ok := routeWriteCondition(r, uniqueWritePath && condAltKey == ""); ok {
 			// Routed mutations ride in the PUT's transaction (committing atomically),
 			// so lockKey is the object path they carry, not the version file path.
 			lockKey, finalizeMutations := filePath, []*filer_pb.ObjectMutation(nil)
 			if finalize != nil && len(finalize.mutations) > 0 {
 				lockKey, finalizeMutations = finalize.lockKey, finalize.mutations
 			}
-			resp, err := s3a.routedPut(owner, s3a.objectRouteKey(bucket, object), lockKey, filePath, entry, cond, finalizeMutations)
+			routeKey := s3a.objectRouteKey(bucket, object)
+			resp, err := s3a.routedPut(owner, routeKey, lockKey, filePath, entry, cond, "", condAltKey, finalizeMutations)
+			if err == nil && resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED && condAltKey != "" {
+				// A filer that ignores condition_alt_key evaluated the empty
+				// null slot alone; resend the transaction against the entry the
+				// read path serves, still under the object's path lock.
+				conditionKey := filePath
+				if resolved, resolveErr := s3a.resolveObjectEntry(bucket, object, ""); resolveErr == nil &&
+					resolved != nil &&
+					string(resolved.Extended[s3_constants.ExtDeleteMarkerKey]) != "true" &&
+					resolved.Name != path.Base(filePath) {
+					conditionKey = condAltKey + "/" + resolved.Name
+				}
+				glog.Warningf("putToFiler: routed PUT to %s precondition-failed for %s; resending against %s", owner, filePath, conditionKey)
+				resp, err = s3a.routedPut(owner, routeKey, lockKey, filePath, entry, cond, conditionKey, condAltKey, finalizeMutations)
+			}
 			switch {
 			case err != nil:
+				routedAmbiguous = true
 				glog.Warningf("putToFiler: routed PUT to %s failed for %s, falling back to lock: %v", owner, filePath, err)
 			case resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED:
 				createCode, routed = s3err.ErrPreconditionFailed, true
 			case resp.Error != "":
-				// Non-precondition mutation error: fall back so the lock path maps it.
+				// A mutation can store the entry before a later step of the
+				// same mutation fails, so even an error from the first mutation
+				// does not prove nothing committed — every transaction error is
+				// ambiguous until the recovery lookup decides.
+				routedAmbiguous = true
 				glog.Warningf("putToFiler: routed PUT to %s returned %q for %s, falling back to lock", owner, resp.Error, filePath)
 			default:
 				entryCreated, routed, createCode = true, true, s3err.ErrNone
@@ -910,7 +1105,13 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 		}
 	}
 	if !routed {
-		createCode = s3a.withObjectWriteLock(bucket, object, preconditionFn, createUnderLock)
+		createFn := func() s3err.ErrorCode { return createUnderLock(nil) }
+		if routedAmbiguous {
+			createFn = func() s3err.ErrorCode {
+				return s3a.createAfterAmbiguousRoute(filePath, bucket, object, owner, entry, chunkResult.FileChunks, finalize, &entryCreated, s3a.uploadedChunksExist, createUnderLock)
+			}
+		}
+		createCode = s3a.withObjectWriteLock(bucket, object, preconditionFn, createFn)
 	}
 	if createCode != s3err.ErrNone {
 		if createErr != nil {
@@ -919,17 +1120,29 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 
 		// If the entry was never created, the uploaded chunks are orphaned and must be deleted.
 		if !entryCreated {
-			orphaned := chunkResult.FileChunks
-			if manifestChunks, _ := filer.SeparateManifestChunks(entry.GetChunks()); len(manifestChunks) > 0 {
-				orphaned = append(manifestChunks, orphaned...)
+			// A failed create does not prove the entry is absent: a lost response
+			// can hide a commit (issue #11366) and the filer can fail after
+			// inserting the entry (issue #11387), so the entry's presence — not
+			// the error class — decides the chunks' fate.
+			landed, absent := s3a.confirmCreateLanded(filePath, bucket, object, entry, chunkResult.FileChunks, finalize)
+			if landed {
+				createCode = s3err.ErrNone
 			}
-			if len(orphaned) > 0 {
-				glog.Warningf("putToFiler: finalization failed, attempting to cleanup %d orphaned chunks", len(orphaned))
-				s3a.deleteOrphanedChunks(orphaned)
+			if createCode != s3err.ErrNone && absent {
+				orphaned := chunkResult.FileChunks
+				if manifestChunks, _ := filer.SeparateManifestChunks(entry.GetChunks()); len(manifestChunks) > 0 {
+					orphaned = append(manifestChunks, orphaned...)
+				}
+				if len(orphaned) > 0 {
+					glog.Warningf("putToFiler: finalization failed, attempting to cleanup %d orphaned chunks", len(orphaned))
+					s3a.deleteOrphanedChunks(orphaned)
+				}
 			}
 		}
 
-		return "", createCode, SSEResponseMetadata{}
+		if createCode != s3err.ErrNone {
+			return "", createCode, SSEResponseMetadata{}
+		}
 	}
 	glog.V(3).Infof("putToFiler: CreateEntry SUCCESS for %s", filePath)
 
@@ -956,6 +1169,291 @@ func (s3a *S3ApiServer) putToFiler(r *http.Request, filePath string, dataReader
 	return etag, s3err.ErrNone, responseMetadata
 }
 
+// createLookupTimeout bounds the entry lookups confirmCreateLanded runs under
+// the object write lock, so a hung filer cannot stall the write path.
+const createLookupTimeout = 10 * time.Second
+
+// createAfterAmbiguousRoute decides, inside the object write lock, what an
+// ambiguous routed PUT left behind before re-committing its entry. A stored
+// entry resolving to the uploaded chunks means the route landed and the create
+// is already done. A different stored entry means a concurrent write
+// superseded the commit, and its old-chunk cleanup may have deleted this
+// entry's chunks — committing would write back a stale entry pointing at dead
+// needles, so the request fails for the client to retry with a fresh upload.
+// Unresolvable lookups fail the same way; only a proven-absent entry with
+// verifiably-live chunks or a directory conflict with them falls through to
+// the normal create — an empty upload has nothing to verify, so neither the
+// absent nor the lookalike-entry outcome is provable for it.
+func (s3a *S3ApiServer) createAfterAmbiguousRoute(filePath, bucket, object string, owner pb.ServerAddress, entry *filer_pb.Entry, uploaded []*filer_pb.FileChunk, finalize *putFinalize, entryCreated *bool, chunksExist func(ctx context.Context, chunks []*filer_pb.FileChunk) bool, createUnderLock func(cond *filer_pb.WriteCondition) s3err.ErrorCode) s3err.ErrorCode {
+	dir, name := path.Dir(filePath), path.Base(filePath)
+	lookupCtx, cancel := context.WithTimeout(context.Background(), createLookupTimeout)
+	defer cancel()
+	// The verified state and the create are made atomic by a WriteCondition on
+	// the create itself, which the filer evaluates under its per-path lock — a
+	// routed write committing in between fails the precondition instead of
+	// being clobbered, and the next pass re-derives the verdict from what the
+	// racer left.
+	for attempt := 0; attempt < 2; attempt++ {
+		existing, uncertain := s3a.lookupCommittedEntry(lookupCtx, s3a.createTargetFilers(owner, bucket, object), dir, name)
+		if existing != nil {
+			if uncertain {
+				// A filer earlier in the list could not answer and may hold a
+				// newer entry; this match is not authoritative.
+				glog.Warningf("putToFiler: ambiguous routed PUT for %s matches an entry but a filer could not be checked; not recovering", filePath)
+				return s3err.ErrServiceUnavailable
+			}
+			if existing.IsDirectory {
+				// The directory can postdate this PUT's commit: the route may
+				// have stored the file entry, a delete removed it, and a nested
+				// write recreated the directory before recovery took the lock.
+				// Re-committing is only safe while the uploaded chunks verifiably
+				// survive — that delete may already have reclaimed the needles,
+				// and a create retrying over the directory would store an entry
+				// pointing at dead chunks.
+				if !chunksExist(lookupCtx, uploaded) {
+					glog.Warningf("putToFiler: ambiguous routed PUT for %s resolved to a directory and its chunks cannot be verified; not re-applying entry", filePath)
+					return s3err.ErrServiceUnavailable
+				}
+				code := createUnderLock(&filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{{
+					Kind:          filer_pb.WriteCondition_IF_ENTRY_EQUAL,
+					ExpectedEntry: existing,
+				}}})
+				if code != s3err.ErrPreconditionFailed {
+					return code
+				}
+				continue
+			}
+			resolved, _, resolveErr := filer.ResolveChunkManifest(lookupCtx, s3a.createLookupFileIdFunction(), existing.GetChunks(), 0, math.MaxInt64, s3a.filerClient)
+			if resolveErr != nil || !sameFileChunks(resolved, uploaded) {
+				glog.Warningf("putToFiler: ambiguous routed PUT for %s was superseded by another write; not committing stale entry", filePath)
+				return s3err.ErrServiceUnavailable
+			}
+			// An empty PUT carries no fids, so two chunkless entries compare
+			// equal even when the stored one predates this write; only this
+			// write's stamped id proves the entry is its own commit.
+			if len(uploaded) == 0 && !sameStoredEntry(existing, entry) {
+				glog.Warningf("putToFiler: ambiguous routed PUT for %s cannot prove an empty stored entry is its own; not claiming it", filePath)
+				return s3err.ErrServiceUnavailable
+			}
+			*entryCreated = true
+			if finalize != nil && finalize.afterCreate != nil {
+				if code := finalize.afterCreate(entry); code != s3err.ErrNone {
+					// Same undo the create path applies when post-create
+					// finalization fails.
+					if rbErr := s3a.rmObject(context.Background(), dir, name, true, false); rbErr != nil {
+						glog.Errorf("putToFiler: failed to rollback recovered entry for %s: %v", filePath, rbErr)
+					}
+					return code
+				}
+			}
+			return s3err.ErrNone
+		}
+		if uncertain {
+			glog.Warningf("putToFiler: cannot confirm what ambiguous routed PUT for %s committed; not re-applying entry", filePath)
+			return s3err.ErrServiceUnavailable
+		}
+		// An absent entry cannot prove an empty PUT never committed — the routed
+		// create may have landed and a delete already reclaimed it — and there
+		// are no chunks to verify either way. IF_NOT_EXISTS would recreate an
+		// object a delete already removed, so the outcome stays uncertain.
+		if len(uploaded) == 0 {
+			glog.Warningf("putToFiler: ambiguous routed PUT for %s left no entry and no chunks to verify; not re-applying entry", filePath)
+			return s3err.ErrServiceUnavailable
+		}
+		if !chunksExist(lookupCtx, uploaded) {
+			glog.Warningf("putToFiler: ambiguous routed PUT for %s left no entry and its chunks cannot be verified; not re-applying entry", filePath)
+			return s3err.ErrServiceUnavailable
+		}
+		code := createUnderLock(clause(filer_pb.WriteCondition_IF_NOT_EXISTS))
+		if code != s3err.ErrPreconditionFailed {
+			return code
+		}
+	}
+	return s3err.ErrServiceUnavailable
+}
+
+// lookupCommittedEntry returns the entry any of the candidate filers stores
+// for dir/name. uncertain reports that a filer earlier in the list could not
+// answer, so a found entry is not authoritative — the unreachable filer may
+// hold a newer one.
+func (s3a *S3ApiServer) lookupCommittedEntry(ctx context.Context, targets []pb.ServerAddress, dir, name string) (existing *filer_pb.Entry, uncertain bool) {
+	for _, target := range targets {
+		e, lookupErr := s3a.lookupEntryOnFiler(ctx, target, dir, name)
+		if e != nil {
+			return e, uncertain
+		}
+		if lookupErr != nil && !errors.Is(lookupErr, filer_pb.ErrNotFound) {
+			uncertain = true
+		}
+	}
+	return nil, uncertain
+}
+
+// uploadedChunksExist probes every uploaded chunk's needle on the volumes the
+// master reports for it. A proven-absent entry is only safe to re-commit when
+// its chunks survive: if the routed PUT committed and a delete then removed
+// the entry, its chunk cleanup may have reclaimed the needles too.
+func (s3a *S3ApiServer) uploadedChunksExist(ctx context.Context, uploaded []*filer_pb.FileChunk) bool {
+	lookupFileId := s3a.createLookupFileIdFunction()
+	for _, chunk := range uploaded {
+		fileId := chunk.GetFileIdString()
+		urls, err := lookupFileId(ctx, fileId)
+		if err != nil || len(urls) == 0 {
+			return false
+		}
+		jwt := filer.ChunkReadJwt(urls, fileId)
+		found := false
+		for _, fileUrl := range urls {
+			if chunkNeedleExists(ctx, fileUrl, jwt) {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+	return true
+}
+
+func chunkNeedleExists(ctx context.Context, fileUrl, jwt string) bool {
+	req, err := http.NewRequestWithContext(ctx, http.MethodHead, fileUrl, nil)
+	if err != nil {
+		return false
+	}
+	if jwt != "" {
+		req.Header.Set("Authorization", security.BearerPrefix+string(jwt))
+	}
+	resp, err := util_http.Do(req)
+	if err != nil {
+		return false
+	}
+	util_http.CloseResponse(resp)
+	return resp.StatusCode == http.StatusOK
+}
+
+// confirmCreateLanded resolves a create whose outcome is uncertain: a stored
+// entry resolving to the uploaded chunks confirms the write landed — the
+// finalization the error skipped then runs under the object write lock, and
+// landed reports success — while absent requires every filer the create could
+// have committed on to lack the entry, the only outcome where the uploaded
+// chunks are orphaned.
+func (s3a *S3ApiServer) confirmCreateLanded(filePath, bucket, object string, entry *filer_pb.Entry, uploaded []*filer_pb.FileChunk, finalize *putFinalize) (landed, absent bool) {
+	dir, name := path.Dir(filePath), path.Base(filePath)
+	owner := s3a.routableWriteOwner(bucket, object)
+	lookupCtx, cancel := context.WithTimeout(context.Background(), createLookupTimeout)
+	defer cancel()
+	// Verify, finalize, and roll back inside one critical section: a concurrent
+	// write to the same key must not slip in between them.
+	s3a.withObjectWriteLock(bucket, object, nil, func() s3err.ErrorCode {
+		targets := s3a.createTargetFilers(owner, bucket, object)
+		existing, uncertain := s3a.lookupCommittedEntry(lookupCtx, targets, dir, name)
+		if existing == nil {
+			absent = len(targets) > 0 && !uncertain
+			return s3err.ErrNone
+		}
+		if uncertain {
+			// The match may sit on a replica behind the filer that could not
+			// answer; it is not authoritative enough to finalize on.
+			return s3err.ErrNone
+		}
+		if len(uploaded) == 0 {
+			// No chunks to compare; only this write's stamped id proves the
+			// entry is its own commit rather than an identical older object.
+			if !sameStoredEntry(existing, entry) {
+				return s3err.ErrNone
+			}
+		} else {
+			resolved, _, resolveErr := filer.ResolveChunkManifest(lookupCtx, s3a.createLookupFileIdFunction(), existing.GetChunks(), 0, math.MaxInt64, s3a.filerClient)
+			if resolveErr != nil || !sameFileChunks(resolved, uploaded) {
+				return s3err.ErrNone
+			}
+		}
+		glog.Warningf("putToFiler: create entry for %s failed but the entry exists, treating the write as successful", filePath)
+		if finalize == nil || finalize.afterCreate == nil {
+			landed = true
+			return s3err.ErrNone
+		}
+		if code := finalize.afterCreate(entry); code != s3err.ErrNone {
+			// Same undo the create path applies when post-create finalization fails.
+			if rbErr := s3a.rmObject(context.Background(), dir, name, true, false); rbErr != nil {
+				glog.Errorf("putToFiler: failed to rollback recovered entry for %s: %v", filePath, rbErr)
+			}
+			return s3err.ErrNone
+		}
+		landed = true
+		return s3err.ErrNone
+	})
+	return landed, absent
+}
+
+// createTargetFilers lists the filers a failed create could have committed on:
+// the routed owner and the prior one mid-rebalance first, then the failover
+// set the lock path dials. Deduped, empty addresses skipped.
+func (s3a *S3ApiServer) createTargetFilers(owner pb.ServerAddress, bucket, object string) []pb.ServerAddress {
+	var filers []pb.ServerAddress
+	seen := map[pb.ServerAddress]bool{}
+	add := func(f pb.ServerAddress) {
+		if f != "" && !seen[f] {
+			seen[f] = true
+			filers = append(filers, f)
+		}
+	}
+	add(owner)
+	add(s3a.priorWriteOwner(bucket, object))
+	if s3a.filerClient != nil {
+		add(s3a.filerClient.GetCurrentFiler())
+		for _, f := range s3a.filerClient.GetAllFilers() {
+			add(f)
+		}
+	}
+	for _, f := range s3a.option.Filers {
+		add(f)
+	}
+	return filers
+}
+
+// sameFileChunks reports whether two chunk lists reference the same needles,
+// regardless of order. File id strings are normalized through the parsed Fid so
+// a non-canonical representation cannot masquerade as a different chunk.
+func sameFileChunks(a, b []*filer_pb.FileChunk) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	key := func(c *filer_pb.FileChunk) string {
+		fid := c.GetFid()
+		if fid == nil {
+			fid, _ = filer_pb.ToFileIdObject(c.GetFileIdString())
+		}
+		if fid == nil {
+			return c.GetFileIdString()
+		}
+		return fmt.Sprintf("%d,%x,%x", fid.VolumeId, fid.FileKey, fid.Cookie)
+	}
+	counts := make(map[string]int, len(a))
+	for _, c := range a {
+		counts[key(c)]++
+	}
+	for _, c := range b {
+		k := key(c)
+		if counts[k] == 0 {
+			return false
+		}
+		counts[k]--
+	}
+	return true
+}
+
+// sameStoredEntry reports whether the stored entry is this write's own
+// commit. Matching metadata cannot say so — an identical older object carries
+// the same fields — but the write id putToFiler stamps into every entry does:
+// the filer stores Extended verbatim, so the id rides the commit and a lookup
+// reads it back. An entry without this write's id cannot be claimed.
+func sameStoredEntry(existing, entry *filer_pb.Entry) bool {
+	id := entry.GetExtended()[s3_constants.SeaweedFSWriteId]
+	return len(id) > 0 && bytes.Equal(existing.GetExtended()[s3_constants.SeaweedFSWriteId], id)
+}
+
 // checksumAlgorithmMapping maps algorithm name strings to their enum and header name.
 var checksumAlgorithmMapping = map[string]struct {
 	alg  ChecksumAlgorithm
@@ -994,6 +1492,47 @@ var checksumHeaders = []struct {
 	{s3_constants.AmzChecksumSHA256, ChecksumAlgorithmSHA256, s3_constants.AmzChecksumSHA256},
 }
 
+// ChecksumResult carries the flexible-checksum members S3 returns inside an XML
+// response body, keyed by the canonical x-amz-checksum-* header name.
+type ChecksumResult struct {
+	ChecksumCRC32     string `xml:"ChecksumCRC32,omitempty"`
+	ChecksumCRC32C    string `xml:"ChecksumCRC32C,omitempty"`
+	ChecksumCRC64NVME string `xml:"ChecksumCRC64NVME,omitempty"`
+	ChecksumSHA1      string `xml:"ChecksumSHA1,omitempty"`
+	ChecksumSHA256    string `xml:"ChecksumSHA256,omitempty"`
+}
+
+func (c *ChecksumResult) SetChecksum(headerName, value string) {
+	switch headerName {
+	case s3_constants.AmzChecksumCRC32:
+		c.ChecksumCRC32 = value
+	case s3_constants.AmzChecksumCRC32C:
+		c.ChecksumCRC32C = value
+	case s3_constants.AmzChecksumCRC64NVME:
+		c.ChecksumCRC64NVME = value
+	case s3_constants.AmzChecksumSHA1:
+		c.ChecksumSHA1 = value
+	case s3_constants.AmzChecksumSHA256:
+		c.ChecksumSHA256 = value
+	}
+}
+
+func (c *ChecksumResult) GetChecksum(headerName string) string {
+	switch headerName {
+	case s3_constants.AmzChecksumCRC32:
+		return c.ChecksumCRC32
+	case s3_constants.AmzChecksumCRC32C:
+		return c.ChecksumCRC32C
+	case s3_constants.AmzChecksumCRC64NVME:
+		return c.ChecksumCRC64NVME
+	case s3_constants.AmzChecksumSHA1:
+		return c.ChecksumSHA1
+	case s3_constants.AmzChecksumSHA256:
+		return c.ChecksumSHA256
+	}
+	return ""
+}
+
 // lookupHeaderOrQuery returns the value of an x-amz-* parameter, checking the
 // request headers first and falling back to the pre-parsed query values. AWS
 // SDK presigners hoist headers such as x-amz-sdk-checksum-algorithm into the
@@ -1099,9 +1638,14 @@ func detectRequestedChecksumAlgorithmQ(r *http.Request, query url.Values) (Check
 const defaultFileMode = uint32(0660)
 
 // resolveFileMode determines the file permission mode for an S3 upload.
-// Priority: per-object X-Amz-Acl header > server default > defaultFileMode.
+// Priority: validated PUT ACL > X-Amz-Acl header > server default > defaultFileMode.
 func (s3a *S3ApiServer) resolveFileMode(r *http.Request) uint32 {
-	if cannedAcl := r.Header.Get(s3_constants.AmzCannedAcl); cannedAcl != "" {
+	cannedAcl := r.Header.Get(s3_constants.AmzCannedAcl)
+	if metadata, ok := r.Context().Value(putObjectACLContextKey{}).(putObjectACLMetadata); ok {
+		// Signed query ACLs must resolve identically to signed ACL headers.
+		cannedAcl = metadata.canned
+	}
+	if cannedAcl != "" {
 		switch cannedAcl {
 		case s3_constants.CannedAclPublicRead, s3_constants.CannedAclAuthenticatedRead,
 			s3_constants.CannedAclBucketOwnerRead:
@@ -1120,14 +1664,17 @@ func (s3a *S3ApiServer) resolveFileMode(r *http.Request) uint32 {
 
 func setEtag(w http.ResponseWriter, etag string) {
 	if etag != "" {
-		if strings.HasPrefix(etag, "\"") {
-			w.Header()["ETag"] = []string{etag}
-		} else {
-			w.Header()["ETag"] = []string{"\"" + etag + "\""}
-		}
+		w.Header()["ETag"] = []string{quoteETag(etag)}
 	}
 }
 
+func quoteETag(etag string) string {
+	if etag == "" || strings.HasPrefix(etag, "\"") {
+		return etag
+	}
+	return strconv.Quote(etag)
+}
+
 // setSSEResponseHeaders sets appropriate SSE response headers based on encryption type
 func (s3a *S3ApiServer) setSSEResponseHeaders(w http.ResponseWriter, r *http.Request, sseMetadata SSEResponseMetadata) {
 	switch sseMetadata.SSEType {
@@ -1170,6 +1717,14 @@ func (s3a *S3ApiServer) setSSEResponseHeaders(w http.ResponseWriter, r *http.Req
 	}
 }
 
+// isReservedDirectoryName reports whether a directory standing at an object's path is
+// one SeaweedFS keeps its own state in - a multipart staging folder, or a key's version
+// history - rather than a prefix the key can be stored on. Writing the object onto it
+// would replace that state with the object's own.
+func isReservedDirectoryName(name string) bool {
+	return name == s3_constants.MultipartUploadsFolder || strings.HasSuffix(name, s3_constants.VersionsFolder)
+}
+
 func filerErrorToS3Error(err error) s3err.ErrorCode {
 	if err == nil {
 		return s3err.ErrNone
@@ -1185,6 +1740,18 @@ func filerErrorToS3Error(err error) s3err.ErrorCode {
 		return s3err.ErrExistingObjectIsDirectory
 	case errors.Is(err, weed_server.ErrReadOnly):
 		return s3err.ErrAccessDenied
+	case errors.Is(err, filer_pb.ErrPreconditionFailed):
+		return s3err.ErrPreconditionFailed
+	}
+
+	// A transport failure leaves the outcome ambiguous — the write may have
+	// been applied anyway — so it must stay retryable, not a permanent 4xx.
+	switch status.Code(err) {
+	case codes.Canceled, codes.DeadlineExceeded, codes.Unavailable:
+		return s3err.ErrServiceUnavailable
+	}
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return s3err.ErrServiceUnavailable
 	}
 
 	// Non-filer errors that don't go through CreateEntryResponse — string matching required
@@ -1193,7 +1760,7 @@ func filerErrorToS3Error(err error) s3err.ErrorCode {
 	case errString == constants.ErrMsgBadDigest:
 		return s3err.ErrBadDigest
 	case strings.Contains(errString, "context canceled") || strings.Contains(errString, "code = Canceled"):
-		return s3err.ErrInvalidRequest
+		return s3err.ErrServiceUnavailable
 	default:
 		return s3err.ErrInternalError
 	}
@@ -1217,8 +1784,15 @@ func filerErrorToS3Error(err error) s3err.ErrorCode {
 // added later that does — a request budget, an auth deadline, shutdown draining —
 // would have to cancel with its own cause and be excluded here, otherwise a body
 // truncated at that instant gets attributed to the peer.
+//
+// A read-only destination (the filer refused the volume assign, e.g. bucket over
+// quota) is AccessDenied, as in filerErrorToS3Error and mapCopyErrorToS3Error.
 func mapChunkedUploadErrorToS3Error(reqCtx context.Context, err error) s3err.ErrorCode {
 	switch {
+	case errors.Is(err, weed_server.ErrReadOnly):
+		return s3err.ErrAccessDenied
+	case strings.Contains(err.Error(), s3err.ErrMsgContentSha256Mismatch):
+		return s3err.ErrContentSHA256Mismatch
 	case strings.Contains(err.Error(), s3err.ErrMsgPayloadChecksumMismatch):
 		return s3err.ErrInvalidDigest
 	case errors.Is(err, operation.ErrTruncatedBody):
@@ -1363,7 +1937,19 @@ func (s3a *S3ApiServer) putSuspendedVersioningObject(r *http.Request, bucket, ob
 	// naming a marker that is gone, and the read path heals that by promoting an older
 	// version, republishing the deleted key. Best-effort, as a stale flag self-heals on
 	// the next list.
+	// A conditional suspended write checks "the null slot if present, else the
+	// latest version". Naming the pointed-at version as the fallback lets the
+	// routed transaction evaluate that rule under the filer lock instead of
+	// splitting check and write across a gateway lock that routed writes skip.
+	conditionAltKey := ""
+	if headers, headersErr := parseConditionalHeaders(r); headersErr == s3err.ErrNone && headers.isSet {
+		// The filer resolves the latest pointer under the same lock that
+		// serializes the write, so the condition cannot read a version a
+		// concurrent delete has already displaced.
+		conditionAltKey = s3a.toFilerPath(bucket, normalizedObject+s3_constants.VersionsFolder)
+	}
 	etag, errCode, sseMetadata = s3a.putToFiler(r, filePath, body, bucket, normalizedObject, 1, 0, &putFinalize{
+		conditionAltKey: conditionAltKey,
 		afterCreate: func(entry *filer_pb.Entry) s3err.ErrorCode {
 			writtenETag := string(entry.Extended[s3_constants.ExtETagKey])
 			if err := s3a.finalizeSuspendedNullWrite("", bucket, normalizedObject, s3_constants.ExtETagKey, writtenETag); err != nil {
@@ -1371,7 +1957,7 @@ func (s3a *S3ApiServer) putSuspendedVersioningObject(r *http.Request, bucket, ob
 			}
 			return s3err.ErrNone
 		},
-	}, false)
+	}, true, "")
 	if errCode != s3err.ErrNone {
 		glog.Errorf("putSuspendedVersioningObject: failed to upload object: %v", errCode)
 		return "", errCode, SSEResponseMetadata{}
@@ -1395,7 +1981,7 @@ func (s3a *S3ApiServer) removeNullVersionFile(bucket, object string) {
 		if string(entry.Extended[s3_constants.ExtVersionIdKey]) != "null" {
 			continue
 		}
-		if rmErr := s3a.rm(versionsDir, entry.Name, true, false); rmErr != nil {
+		if rmErr := s3a.rm(context.Background(), versionsDir, entry.Name, true, false); rmErr != nil {
 			glog.Warningf("removeNullVersionFile: %s/%s: %v", bucket, object, rmErr)
 		}
 		return
@@ -1474,6 +2060,9 @@ func (s3a *S3ApiServer) updateIsLatestFlagsForSuspendedVersioning(bucket, object
 		delete(versionsEntry.Extended, s3_constants.ExtLatestVersionIdKey)
 		delete(versionsEntry.Extended, s3_constants.ExtLatestVersionFileNameKey)
 		clearCachedVersionMetadata(versionsEntry.Extended)
+		// Record that the null object is current explicitly: an absent pointer
+		// alone also looks like replication lag to a reader.
+		versionsEntry.Extended[s3_constants.ExtNullVersionIsLatestKey] = []byte("true")
 
 		// Update the .versions directory entry
 		err = s3a.mkFile(bucketDir, versionsObjectPath, versionsEntry.Chunks, func(updatedEntry *filer_pb.Entry) {
@@ -1558,7 +2147,7 @@ func (s3a *S3ApiServer) putVersionedObject(r *http.Request, bucket, object strin
 	// directly — versioned objects sit on regular volumes and the
 	// lifecycle worker handles their expiration.
 	etag, errCode, sseMetadata = s3a.putToFiler(r, versionFilePath, body, bucket, normalizedObject, 1, 0,
-		s3a.versionedFinalize(bucket, normalizedObject, versionId, versionFileName, useInvertedFormat), true)
+		s3a.versionedFinalize(bucket, normalizedObject, versionId, versionFileName, useInvertedFormat), true, "")
 	if errCode != s3err.ErrNone {
 		glog.Errorf("putVersionedObject: failed to upload version: %v", errCode)
 		return "", "", errCode, SSEResponseMetadata{}
@@ -1606,6 +2195,18 @@ func (s3a *S3ApiServer) updateLatestVersionInDirectory(bucket, object, versionId
 	// detected by filename equality and skip the stamp.
 	prevLatestFileName := string(versionsEntry.Extended[s3_constants.ExtLatestVersionFileNameKey])
 
+	// A newer version may have committed while this write's outcome was
+	// uncertain; a pointer already naming one newer than this version must
+	// keep latest where it belongs instead of pointing back.
+	prevLatestVersionId := string(versionsEntry.Extended[s3_constants.ExtLatestVersionIdKey])
+	if prevLatestVersionId != "" && versionId != "null" && compareVersionIds(prevLatestVersionId, versionId) < 0 {
+		// This version is born noncurrent: stamp it so the lifecycle engine
+		// can compute NoncurrentDays, but leave latest where it belongs.
+		s3a.markVersionNoncurrent(bucketDir, versionsObjectPath, versionFileName, time.Now().UnixNano())
+		glog.V(2).Infof("updateLatestVersionInDirectory: %s/%s already points at newer version %s; keeping it", bucket, object, prevLatestVersionId)
+		return nil
+	}
+
 	// Stamp the demoted entry BEFORE updating the .versions/ directory
 	// pointer. The pointer-flip emits a meta-log event that the
 	// lifecycle router consumes; that router then looks up the demoted
@@ -1624,6 +2225,7 @@ func (s3a *S3ApiServer) updateLatestVersionInDirectory(bucket, object, versionId
 
 	versionsEntry.Extended[s3_constants.ExtLatestVersionIdKey] = []byte(versionId)
 	versionsEntry.Extended[s3_constants.ExtLatestVersionFileNameKey] = []byte(versionFileName)
+	delete(versionsEntry.Extended, s3_constants.ExtNullVersionIsLatestKey)
 
 	// Cache list metadata for single-scan efficiency (avoids extra getEntry per object during list)
 	setCachedListMetadata(versionsEntry, versionEntry)
@@ -1769,7 +2371,7 @@ func (s3a *S3ApiServer) applySSEKMSDefaultEncryption(bucket string, r *http.Requ
 	// Use the KMS key ID from bucket configuration, or default if not specified
 	keyID := encryptionConfig.KmsKeyId
 	if keyID == "" {
-		keyID = "alias/aws/s3" // AWS default KMS key for S3
+		keyID = s3_constants.SSEKMSDefaultKeyID
 	}
 
 	// Check if bucket key is enabled in configuration
@@ -1856,9 +2458,29 @@ func (s3a *S3ApiServer) applyBucketDefaultRetention(bucket string, entry *filer_
 	return nil
 }
 
+// checkObjectLockHeaderPermission reports whether the caller may set object
+// lock through PutObject-style request headers. On AWS these headers require
+// the dedicated s3:PutObjectRetention / s3:PutObjectLegalHold permissions;
+// s3:PutObject alone must not be enough, or any writer can pin data with
+// COMPLIANCE retention. Without auth there is nothing to check against.
+func (s3a *S3ApiServer) checkObjectLockHeaderPermission(r *http.Request, bucket, object string, action Action) bool {
+	if s3a.iam == nil || !s3a.iam.isEnabled() {
+		return true
+	}
+	identity, _ := s3_constants.GetIdentityFromContext(r).(*Identity)
+	if identity == nil {
+		var errCode s3err.ErrorCode
+		identity, errCode, _ = s3a.iam.authenticateRequestInternal(r)
+		if errCode != s3err.ErrNone {
+			return false
+		}
+	}
+	return s3a.iam.authorizeObjectKeyAction(r, identity, r.Method, action, bucket, s3_constants.NormalizeObjectKey(object), "") == s3err.ErrNone
+}
+
 // validateObjectLockHeaders validates object lock headers in PUT requests
 // objectLockEnabled should be true only if the bucket has Object Lock configured
-func (s3a *S3ApiServer) validateObjectLockHeaders(r *http.Request, objectLockEnabled bool) error {
+func (s3a *S3ApiServer) validateObjectLockHeaders(r *http.Request, bucket, object string, objectLockEnabled bool) error {
 	// Extract object lock headers from request
 	mode := r.Header.Get(s3_constants.AmzObjectLockMode)
 	retainUntilDateStr := r.Header.Get(s3_constants.AmzObjectLockRetainUntilDate)
@@ -1920,6 +2542,17 @@ func (s3a *S3ApiServer) validateObjectLockHeaders(r *http.Request, objectLockEna
 		return ErrGovernanceBypassVersioningRequired
 	}
 
+	if mode != "" || retainUntilDateStr != "" {
+		if !s3a.checkObjectLockHeaderPermission(r, bucket, object, s3_constants.ACTION_PUT_OBJECT_RETENTION) {
+			return ErrObjectLockNotAuthorized
+		}
+	}
+	if legalHold != "" {
+		if !s3a.checkObjectLockHeaderPermission(r, bucket, object, s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD) {
+			return ErrObjectLockNotAuthorized
+		}
+	}
+
 	return nil
 }
 
@@ -1959,6 +2592,8 @@ func mapValidationErrorToS3Error(err error) s3err.ErrorCode {
 		// For governance bypass on non-versioned bucket, return InvalidRequest
 		// This matches the test expectations
 		return s3err.ErrInvalidRequest
+	case errors.Is(err, ErrObjectLockNotAuthorized):
+		return s3err.ErrAccessDenied
 	case errors.Is(err, ErrMalformedXML):
 		// For malformed XML in request body, return MalformedXML
 		// This matches the test expectations for invalid retention mode and legal hold status
@@ -2084,6 +2719,10 @@ func parseConditionalHeaders(r *http.Request) (conditionalHeaders, s3err.ErrorCo
 
 // S3ApiServer implements EntryGetter interface
 func (s3a *S3ApiServer) getObjectETag(entry *filer_pb.Entry) string {
+	return objectETag(entry)
+}
+
+func objectETag(entry *filer_pb.Entry) string {
 	// Try to get ETag from Extended attributes first
 	if etagBytes, hasETag := entry.Extended[s3_constants.ExtETagKey]; hasETag {
 		etag := string(etagBytes)
@@ -2095,13 +2734,27 @@ func (s3a *S3ApiServer) getObjectETag(entry *filer_pb.Entry) string {
 		}
 		// Empty stored ETag — fall through to Md5/chunk-based calculation
 	}
+	// The remote ETag still describes this entry only while the local copy
+	// holds the remote bytes: a synced cache fill, or a remote-only entry
+	// with no local content. Content changes made through the filer clear
+	// the sync stamp (Filer.UpdateEntry) or add chunks or inline content;
+	// resizes without new bytes show up in FileSize. Metadata-only updates
+	// like utimens keep the remote bytes, so Mtime is not part of the check.
+	if remote := entry.RemoteEntry; remote != nil && remote.RemoteETag != "" &&
+		entry.GetAttributes().GetFileSize() == uint64(remote.RemoteSize) &&
+		(remote.LastLocalSyncTsNs > 0 || (len(entry.Chunks) == 0 && len(entry.Content) == 0)) {
+		return quoteETag(remote.RemoteETag)
+	}
 	// Check for Md5 in Attributes (matches filer.ETag behavior)
 	// Note: len(nil slice) == 0 in Go, so no need for explicit nil check
 	if entry.Attributes != nil && len(entry.Attributes.Md5) > 0 {
 		return fmt.Sprintf("\"%x\"", entry.Attributes.Md5)
 	}
 	// Fallback: calculate ETag from chunks
-	return s3a.calculateETagFromChunks(entry.Chunks)
+	if len(entry.Chunks) == 0 {
+		return `""`
+	}
+	return quoteETag(filer.ETagChunks(entry.Chunks))
 }
 
 func (s3a *S3ApiServer) etagMatches(headerValue, objectETag string) bool {
@@ -2150,8 +2803,9 @@ func (s3a *S3ApiServer) validateConditionalHeaders(r *http.Request, headers cond
 
 	// 1. Check If-Match
 	if headers.ifMatch != "" {
+		// AWS answers 404 when there is no current version (or it is a delete marker)
 		if !objectExists {
-			return s3err.ErrPreconditionFailed
+			return s3err.ErrNoSuchKey
 		}
 		// If `ifMatch` is "*", the condition is met if the object exists.
 		// Otherwise, we need to check the ETag.
@@ -2236,7 +2890,7 @@ func (s3a *S3ApiServer) checkConditionalHeaders(r *http.Request, bucket, object
 
 	// Use resolveObjectEntry to correctly handle versioned objects.
 	// This ensures we check conditions against the LATEST version, not a null version.
-	entry, err := s3a.resolveObjectEntry(bucket, object)
+	entry, err := s3a.resolveObjectEntry(bucket, object, "")
 	if err != nil {
 		if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrDeleteMarker) {
 			entry = nil
@@ -2257,18 +2911,14 @@ func (s3a *S3ApiServer) validateConditionalHeadersForReads(r *http.Request, head
 	entry = normalizeConditionalTargetEntry(entry)
 	objectExists := entry != nil
 
-	// If object doesn't exist, fail for If-Match and If-Unmodified-Since
+	// A precondition only fails against an object that exists: AWS keeps GET/HEAD of a
+	// missing key a missing-key answer, so a condition never turns absence into 412.
+	// If-None-Match and If-Modified-Since pass here and the handler answers 404 itself.
 	if !objectExists {
-		if headers.ifMatch != "" {
-			glog.V(3).Infof("validateConditionalHeadersForReads: If-Match failed - object %s/%s does not exist", bucket, object)
-			return ConditionalHeaderResult{ErrorCode: s3err.ErrPreconditionFailed, Entry: nil}
+		if headers.ifMatch != "" || !headers.ifUnmodifiedSince.IsZero() {
+			glog.V(3).Infof("validateConditionalHeadersForReads: object %s/%s does not exist", bucket, object)
+			return ConditionalHeaderResult{ErrorCode: s3err.ErrNoSuchKey, Entry: nil}
 		}
-		if !headers.ifUnmodifiedSince.IsZero() {
-			glog.V(3).Infof("validateConditionalHeadersForReads: If-Unmodified-Since failed - object %s/%s does not exist", bucket, object)
-			return ConditionalHeaderResult{ErrorCode: s3err.ErrPreconditionFailed, Entry: nil}
-		}
-		// If-None-Match and If-Modified-Since succeed when object doesn't exist
-		// No entry to return since object doesn't exist
 		return ConditionalHeaderResult{ErrorCode: s3err.ErrNone, Entry: nil}
 	}
 
@@ -2355,9 +3005,10 @@ func (s3a *S3ApiServer) checkConditionalHeadersForReads(r *http.Request, bucket,
 		return ConditionalHeaderResult{ErrorCode: s3err.ErrNone, Entry: nil}
 	}
 
-	// Use resolveObjectEntry to correctly handle versioned objects.
-	// This ensures we check conditions against the LATEST version, not a null version.
-	entry, err := s3a.resolveObjectEntry(bucket, object)
+	// Use resolveObjectEntry to correctly handle versioned objects: the version the
+	// request names, or the LATEST version rather than a null version.
+	versionId := r.URL.Query().Get("versionId")
+	entry, err := s3a.resolveObjectEntry(bucket, object, versionId)
 	if err != nil {
 		if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrDeleteMarker) {
 			entry = nil
@@ -2366,9 +3017,23 @@ func (s3a *S3ApiServer) checkConditionalHeadersForReads(r *http.Request, bucket,
 			return ConditionalHeaderResult{ErrorCode: s3err.ErrInternalError, Entry: nil}
 		}
 	}
+	// A named version that resolves to nothing is the handler's answer to give: only it
+	// knows whether the bucket is versioned, and so whether that is NoSuchVersion.
+	if versionId != "" && normalizeConditionalTargetEntry(entry) == nil {
+		return ConditionalHeaderResult{ErrorCode: s3err.ErrNone, Entry: nil}
+	}
 	return s3a.validateConditionalHeadersForReads(r, headers, entry, bucket, object)
 }
 
+// lookupVolumeJwt mints a fresh volume-server JWT for an existing file id, so a
+// cleanup delete that runs past the assignment JWT's expiry still authenticates.
+func (s3a *S3ApiServer) lookupVolumeJwt(ctx context.Context, fileId string) security.EncodedJwt {
+	if s3a.masterClient == nil {
+		return ""
+	}
+	return operation.LookupJwt(ctx, s3a.masterClient.GetMaster(ctx), s3a.option.GrpcDialOption, fileId)
+}
+
 // deleteOrphanedChunks attempts to delete chunks that were uploaded but whose entry creation failed
 // This prevents resource leaks and wasted storage. Errors are logged but don't prevent cleanup attempts.
 func (s3a *S3ApiServer) deleteOrphanedChunks(chunks []*filer_pb.FileChunk) {
@@ -2429,7 +3094,7 @@ func (s3a *S3ApiServer) deleteOrphanedChunks(chunks []*filer_pb.FileChunk) {
 	}
 
 	// Attempt deletion using the operation package's batch delete with custom lookup
-	deleteResults := operation.DeleteFileIdsWithLookupVolumeId(s3a.option.GrpcDialOption, fileIds, lookupFunc)
+	deleteResults := operation.DeleteFileIdsWithLookupVolumeId(context.Background(), s3a.option.GrpcDialOption, fileIds, lookupFunc)
 
 	// Log results - track successes and failures
 	successCount := 0
diff --git a/weed/s3api/s3api_object_handlers_put_ambiguous_test.go b/weed/s3api/s3api_object_handlers_put_ambiguous_test.go
new file mode 100644
index 0000000000..01d45bc701
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_put_ambiguous_test.go
@@ -0,0 +1,1124 @@
+package s3api
+
+import (
+	"bytes"
+	"context"
+	"crypto/md5"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"path"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+)
+
+// fakeVolumeServer serves the two volume-server calls putToFiler makes: chunk
+// uploads over HTTP and BatchDelete over gRPC. Deleted fids are recorded so a
+// test can tell whether chunk cleanup ran.
+type fakeVolumeServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	httpAddr string
+	grpcPort uint32
+
+	mu          sync.Mutex
+	deletedFids []string
+	stored      map[string][]byte
+}
+
+func (f *fakeVolumeServer) BatchDelete(_ context.Context, req *volume_server_pb.BatchDeleteRequest) (*volume_server_pb.BatchDeleteResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	resp := &volume_server_pb.BatchDeleteResponse{}
+	for _, fid := range req.FileIds {
+		f.deletedFids = append(f.deletedFids, fid)
+		resp.Results = append(resp.Results, &volume_server_pb.DeleteResult{FileId: fid, Status: http.StatusAccepted})
+	}
+	return resp, nil
+}
+
+func (f *fakeVolumeServer) deleted() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]string(nil), f.deletedFids...)
+}
+
+func startFakeVolumeServer(t *testing.T) *fakeVolumeServer {
+	t.Helper()
+	v := &fakeVolumeServer{stored: map[string][]byte{}}
+	upload := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fid := strings.TrimPrefix(r.URL.Path, "/")
+		if r.Method == http.MethodGet {
+			v.mu.Lock()
+			data, ok := v.stored[fid]
+			v.mu.Unlock()
+			if !ok {
+				w.WriteHeader(http.StatusNotFound)
+				return
+			}
+			if rg := r.Header.Get("Range"); rg != "" {
+				var start, end int
+				fmt.Sscanf(rg, "bytes=%d-%d", &start, &end)
+				if end >= len(data) {
+					end = len(data) - 1
+				}
+				w.WriteHeader(http.StatusPartialContent)
+				w.Write(data[start : end+1])
+				return
+			}
+			w.Write(data)
+			return
+		}
+		if r.Method == http.MethodHead {
+			v.mu.Lock()
+			_, ok := v.stored[fid]
+			v.mu.Unlock()
+			if !ok {
+				w.WriteHeader(http.StatusNotFound)
+				return
+			}
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		data, _ := io.ReadAll(r.Body)
+		v.mu.Lock()
+		v.stored[fid] = data
+		v.mu.Unlock()
+		w.Header().Set("Content-MD5", r.Header.Get("Content-MD5"))
+		w.WriteHeader(http.StatusCreated)
+		io.WriteString(w, `{"size":1}`)
+	}))
+	t.Cleanup(upload.Close)
+	v.httpAddr = strings.TrimPrefix(upload.URL, "http://")
+
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	grpcSrv := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(grpcSrv, v)
+	go grpcSrv.Serve(lis)
+	t.Cleanup(grpcSrv.Stop)
+	v.grpcPort = uint32(lis.Addr().(*net.TCPAddr).Port)
+	return v
+}
+
+// ambiguousPutFiler fakes the filer calls putToFiler makes. CreateEntry can
+// apply the write and still return an error — the ambiguous outcome a
+// restarting owner filer produces for issue 11366.
+type ambiguousPutFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	volume *fakeVolumeServer
+
+	mu            sync.Mutex
+	entries       map[string]*filer_pb.Entry
+	txnCount      int
+	txnCheck      func(req *filer_pb.ObjectTransactionRequest)
+	apply         bool
+	ignoreAltKey  bool
+	createErr     error
+	respError     string
+	lookupErr     error
+	lookupFailKey string
+	nextKey       uint64
+	// supersede, once, swaps in a concurrent write's entry as the routed
+	// transaction commits — issue 11631's client retry. txnNoApply models a
+	// transaction that failed before applying (e.g. its forward was refused).
+	supersede  *filer_pb.Entry
+	txnErr     error
+	txnNoApply bool
+	// beforeCreate runs inside CreateEntry's lock, before the condition is
+	// evaluated, letting a test land a racing write at the worst moment.
+	// beforeLookup runs inside LookupDirectoryEntry, letting a test delete a
+	// just-committed entry before recovery reads it.
+	beforeCreate func()
+	beforeLookup func()
+	stores       int
+	conds        []*filer_pb.WriteCondition
+}
+
+func (f *ambiguousPutFiler) AssignVolume(context.Context, *filer_pb.AssignVolumeRequest) (*filer_pb.AssignVolumeResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.nextKey++
+	return &filer_pb.AssignVolumeResponse{
+		FileId: fmt.Sprintf("3,%016x%08x", f.nextKey, uint32(f.nextKey)),
+		Count:  1,
+		Location: &filer_pb.Location{
+			Url:       f.volume.httpAddr,
+			PublicUrl: f.volume.httpAddr,
+			GrpcPort:  f.volume.grpcPort,
+		},
+	}, nil
+}
+
+func (f *ambiguousPutFiler) CreateEntry(_ context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.beforeCreate != nil {
+		f.beforeCreate()
+	}
+	f.conds = append(f.conds, req.Condition)
+	key := req.Directory + "/" + req.Entry.Name
+	if !putConditionSatisfied(req.Condition, f.entries[key]) {
+		return &filer_pb.CreateEntryResponse{Error: "precondition failed", ErrorCode: filer_pb.FilerError_PRECONDITION_FAILED}, nil
+	}
+	if f.apply {
+		entry := proto.Clone(req.Entry).(*filer_pb.Entry)
+		filer_pb.BeforeEntrySerialization(entry.Chunks)
+		f.entries[key] = entry
+		f.stores++
+	}
+	if f.createErr != nil {
+		return nil, f.createErr
+	}
+	return &filer_pb.CreateEntryResponse{Error: f.respError}, nil
+}
+
+// putConditionSatisfied mirrors the filer's clauseSatisfied for the condition
+// kinds the ambiguous-route recovery emits.
+func putConditionSatisfied(cond *filer_pb.WriteCondition, current *filer_pb.Entry) bool {
+	for _, c := range cond.GetClauses() {
+		switch c.Kind {
+		case filer_pb.WriteCondition_IF_NOT_EXISTS:
+			if current != nil {
+				return false
+			}
+		case filer_pb.WriteCondition_IF_ENTRY_EQUAL:
+			if current == nil || c.ExpectedEntry == nil {
+				if current != nil || c.ExpectedEntry != nil {
+					return false
+				}
+				continue
+			}
+			expected := proto.Clone(c.ExpectedEntry).(*filer_pb.Entry)
+			filer_pb.BeforeEntrySerialization(expected.Chunks)
+			actual := proto.Clone(current).(*filer_pb.Entry)
+			filer_pb.BeforeEntrySerialization(actual.Chunks)
+			if !proto.Equal(filer.FromPbEntry("", actual).ToProtoEntry(), filer.FromPbEntry("", expected).ToProtoEntry()) {
+				return false
+			}
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+func (f *ambiguousPutFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.beforeLookup != nil {
+		f.beforeLookup()
+	}
+	if f.lookupErr != nil && req.Directory+"/"+req.Name == f.lookupFailKey {
+		return nil, f.lookupErr
+	}
+	if entry, ok := f.entries[req.Directory+"/"+req.Name]; ok {
+		out := proto.Clone(entry).(*filer_pb.Entry)
+		filer_pb.AfterEntryDeserialization(out.Chunks)
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: out}, nil
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{}, nil
+}
+
+// ObjectTransaction applies the WriteCondition against the entry the condition
+// key names, the way a real filer evaluates it under the path lock, then
+// applies PUT mutations. Routed-write tests use it to catch a condition sent
+// for an entry the gateway's conditional check never looked at.
+func (f *ambiguousPutFiler) ObjectTransaction(_ context.Context, req *filer_pb.ObjectTransactionRequest) (*filer_pb.ObjectTransactionResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.txnCount++
+	if f.txnCheck != nil {
+		f.txnCheck(req)
+	}
+	key := req.LockKey
+	if req.ConditionKey != "" {
+		key = req.ConditionKey
+	}
+	current := f.entries[key]
+	if current == nil && req.ConditionAltKey != "" && !f.ignoreAltKey {
+		// Mirrors the filer's fallback: the alt key is the object's .versions
+		// directory and the entry under test is the one its latest pointer
+		// names; a delete marker resolves to absent.
+		if versionsEntry := f.entries[req.ConditionAltKey]; versionsEntry != nil {
+			if latest := string(versionsEntry.Extended[s3_constants.ExtLatestVersionFileNameKey]); latest != "" {
+				key = req.ConditionAltKey + "/" + latest
+				current = f.entries[key]
+				if current != nil && string(current.Extended[s3_constants.ExtDeleteMarkerKey]) == "true" {
+					current = nil
+				}
+			}
+		}
+	}
+	for _, clause := range req.GetCondition().GetClauses() {
+		var md5Hex string
+		if current != nil && current.Attributes != nil {
+			md5Hex = fmt.Sprintf("%x", current.Attributes.Md5)
+		}
+		ok := true
+		switch clause.Kind {
+		case filer_pb.WriteCondition_IF_NOT_EXISTS:
+			ok = current == nil
+		case filer_pb.WriteCondition_IF_EXISTS:
+			ok = current != nil
+		case filer_pb.WriteCondition_IF_ETAG_MATCH:
+			ok = current != nil && slices.Contains(clause.Etags, md5Hex)
+		case filer_pb.WriteCondition_IF_ETAG_NOT_MATCH:
+			ok = current == nil || !slices.Contains(clause.Etags, md5Hex)
+		}
+		if !ok {
+			return &filer_pb.ObjectTransactionResponse{ErrorCode: filer_pb.FilerError_PRECONDITION_FAILED}, nil
+		}
+	}
+	if !f.txnNoApply {
+		for _, m := range req.Mutations {
+			if m.Type == filer_pb.ObjectMutation_PUT {
+				entry := proto.Clone(m.Entry).(*filer_pb.Entry)
+				filer_pb.BeforeEntrySerialization(entry.Chunks)
+				f.entries[m.Directory+"/"+m.Entry.Name] = entry
+			}
+		}
+	}
+	if f.supersede != nil {
+		f.entries[req.LockKey] = f.supersede
+		f.supersede = nil
+	}
+	return &filer_pb.ObjectTransactionResponse{}, f.txnErr
+}
+
+func (f *ambiguousPutFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for fullPath, entry := range f.entries {
+		if path.Dir(fullPath) != req.Directory {
+			continue
+		}
+		if req.Prefix != "" && !strings.HasPrefix(entry.Name, req.Prefix) {
+			continue
+		}
+		if req.StartFromFileName != "" && (entry.Name < req.StartFromFileName ||
+			(entry.Name == req.StartFromFileName && !req.InclusiveStartFrom)) {
+			continue
+		}
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: proto.Clone(entry).(*filer_pb.Entry)}); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (f *ambiguousPutFiler) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.entries[req.Directory+"/"+req.Entry.Name] = proto.Clone(req.Entry).(*filer_pb.Entry)
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+func (f *ambiguousPutFiler) LookupVolume(_ context.Context, req *filer_pb.LookupVolumeRequest) (*filer_pb.LookupVolumeResponse, error) {
+	resp := &filer_pb.LookupVolumeResponse{LocationsMap: map[string]*filer_pb.Locations{}}
+	for _, vid := range req.VolumeIds {
+		resp.LocationsMap[vid] = &filer_pb.Locations{Locations: []*filer_pb.Location{{
+			Url:       f.volume.httpAddr,
+			PublicUrl: f.volume.httpAddr,
+			GrpcPort:  f.volume.grpcPort,
+		}}}
+	}
+	return resp, nil
+}
+
+func newPutTestServer(t *testing.T, filerAddrs ...pb.ServerAddress) *S3ApiServer {
+	t.Helper()
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	return &S3ApiServer{
+		option: &S3ApiServerOption{
+			Filers:         filerAddrs,
+			GrpcDialOption: dialOption,
+			BucketsPath:    "/buckets",
+		},
+		filerClient: wdclient.NewFilerClient(filerAddrs, dialOption, ""),
+	}
+}
+
+func putTestObject(t *testing.T, s3a *S3ApiServer) (string, s3err.ErrorCode) {
+	t.Helper()
+	r := httptest.NewRequest(http.MethodPut, "/b/o", nil)
+	etag, code, _ := s3a.putToFiler(r, "/buckets/b/o", strings.NewReader("hello world"), "b", "o", 1, 0, nil, false, "")
+	return etag, code
+}
+
+// Issue 11366: CreateEntry applied on the filer but the response was lost
+// (owner restarting). Once the entry is confirmed, the write is successful —
+// deleting the chunks would leave the entry pointing at tombstoned needles.
+func TestPutToFilerAmbiguousCreateKeepsChunks(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{},
+		apply:     true,
+		createErr: status.Error(codes.Unavailable, "connect: connection refused"),
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+
+	etag, code := putTestObject(t, s3a)
+	if code != s3err.ErrNone {
+		t.Fatalf("putToFiler returned %v, want success once the entry is confirmed on the filer", code)
+	}
+	if etag == "" {
+		t.Fatal("expected an etag")
+	}
+	if deleted := volume.deleted(); len(deleted) != 0 {
+		t.Fatalf("chunks under a live entry were deleted: %v", deleted)
+	}
+}
+
+// Issue 11387: the filer can report a create failure after inserting the entry
+// (e.g. a parent-directory creation failing post-insert). The failure arrives
+// in the response rather than as a transport status, so it maps to a
+// definitive error — but the entry exists and deleting its chunks would
+// tombstone live needles.
+func TestPutToFilerPostCommitErrorKeepsChunks(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{},
+		apply:     true,
+		respError: "create parent directories of /buckets/b: i/o timeout",
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+
+	etag, code := putTestObject(t, s3a)
+	if code != s3err.ErrNone {
+		t.Fatalf("putToFiler returned %v, want success once the entry is confirmed on the filer", code)
+	}
+	if etag == "" {
+		t.Fatal("expected an etag")
+	}
+	if deleted := volume.deleted(); len(deleted) != 0 {
+		t.Fatalf("chunks under a live entry were deleted: %v", deleted)
+	}
+}
+
+// Issue 11387, multi-filer: a create that fails over mid-flight can commit on
+// a filer the confirmation does not ask first. A not-found from one replica
+// does not authorize deleting chunks an entry on another filer references.
+func TestPutToFilerPostCommitErrorOnFailoverFilerKeepsChunks(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerA := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{},
+		apply:     false,
+		createErr: status.Error(codes.Unavailable, "connect: connection refused"),
+	}
+	filerB := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{},
+		apply:     true,
+		respError: "create parent directories of /buckets/b: i/o timeout",
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerA), startFakeFiler(t, filerB))
+
+	etag, code := putTestObject(t, s3a)
+	if code != s3err.ErrNone {
+		t.Fatalf("putToFiler returned %v, want success once the entry is confirmed on the filer", code)
+	}
+	if etag == "" {
+		t.Fatal("expected an etag")
+	}
+	if deleted := volume.deleted(); len(deleted) != 0 {
+		t.Fatalf("chunks under a live entry were deleted: %v", deleted)
+	}
+}
+
+// A create the filer definitively refused still cleans up the uploaded chunks.
+func TestPutToFilerConfirmedFailureDeletesOrphans(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{},
+		apply:     false,
+		createErr: status.Error(codes.Unknown, "create refused"),
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+
+	_, code := putTestObject(t, s3a)
+	if code == s3err.ErrNone {
+		t.Fatal("expected an error when the entry was not created")
+	}
+	if deleted := volume.deleted(); len(deleted) == 0 {
+		t.Fatal("orphaned chunks were not deleted")
+	}
+}
+
+// A stale entry from an earlier object does not prove this PUT landed: the
+// outcome stays unknown, so the new chunks are kept and an error returned.
+func TestPutToFilerAmbiguousCreateWithStaleEntryKeepsChunks(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	stale := &filer_pb.Entry{
+		Name:       "o",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 5},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "3,000000000000009900000099", Size: 5}},
+	}
+	filerImpl := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{"/buckets/b/o": stale},
+		apply:     false,
+		createErr: status.Error(codes.Unavailable, "connect: connection refused"),
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+
+	_, code := putTestObject(t, s3a)
+	if code == s3err.ErrNone {
+		t.Fatal("expected an error when the create outcome is unknown")
+	}
+	if deleted := volume.deleted(); len(deleted) != 0 {
+		t.Fatalf("chunks were deleted while the create outcome was unverifiable: %v", deleted)
+	}
+}
+
+// When neither the create nor the lookup can be answered, the outcome stays
+// unknown: keep the chunks (vacuum reclaims orphans) rather than risk deleting
+// chunks a live entry references.
+func TestPutToFilerUnverifiableCreateKeepsChunks(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	unavailable := status.Error(codes.Unavailable, "connect: connection refused")
+	filerImpl := &ambiguousPutFiler{
+		volume:        volume,
+		entries:       map[string]*filer_pb.Entry{},
+		apply:         false,
+		createErr:     unavailable,
+		lookupErr:     unavailable,
+		lookupFailKey: "/buckets/b/o",
+	}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+
+	_, code := putTestObject(t, s3a)
+	if code == s3err.ErrNone {
+		t.Fatal("expected an error when the create outcome is unknown")
+	}
+	if deleted := volume.deleted(); len(deleted) != 0 {
+		t.Fatalf("chunks were deleted while the create outcome was unverifiable: %v", deleted)
+	}
+}
+
+// Issue 11631: a routed PUT committed on the owner but its response was lost;
+// a client retry then superseded the entry and the retry's old-chunk cleanup
+// deleted this PUT's chunks. Re-committing the stale entry would resurrect a
+// pointer to dead needles — the recovery must leave the newer write alone.
+func TestPutToFilerRoutedAmbiguousKeepsNewerWrite(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	newer := &filer_pb.Entry{
+		Name:       "o",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 11},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "3,00000000000000bb0000000b", Size: 11}},
+	}
+	filerImpl := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{},
+		supersede: newer,
+		txnErr:    status.Error(codes.Unavailable, "owner restarted mid-write"),
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	_, code := putTestObject(t, s3a)
+	if code != s3err.ErrServiceUnavailable {
+		t.Fatalf("putToFiler returned %v, want refusal once a newer write is found", code)
+	}
+	if filerImpl.stores != 0 {
+		t.Fatalf("recovery re-committed the stale entry %d times", filerImpl.stores)
+	}
+	if got := filerImpl.entries["/buckets/b/o"]; got == nil || len(got.Chunks) == 0 || got.Chunks[0].FileId != newer.Chunks[0].FileId {
+		t.Fatalf("the newer write's entry was clobbered: %+v", got)
+	}
+	if deleted := volume.deleted(); len(deleted) != 0 {
+		t.Fatalf("chunks were deleted during recovery: %v", deleted)
+	}
+}
+
+// Issue 11631, raced variant: the routed PUT never committed and the recovery
+// lookup finds the entry absent, but a concurrent write lands before the
+// fallback create. The create's precondition — evaluated under the owner's
+// path lock — refuses instead of overwriting the racer.
+func TestPutToFilerRoutedRecoveryLosesRace(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	newer := &filer_pb.Entry{
+		Name:       "o",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 11},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "3,00000000000000bb0000000b", Size: 11}},
+	}
+	filerImpl := &ambiguousPutFiler{
+		volume:     volume,
+		entries:    map[string]*filer_pb.Entry{},
+		apply:      true,
+		txnNoApply: true,
+		txnErr:     status.Error(codes.Unavailable, "response lost"),
+	}
+	filerImpl.beforeCreate = func() {
+		filerImpl.entries["/buckets/b/o"] = newer
+		filerImpl.beforeCreate = nil
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	_, code := putTestObject(t, s3a)
+	if code != s3err.ErrServiceUnavailable {
+		t.Fatalf("putToFiler returned %v, want refusal after losing the create race", code)
+	}
+	if filerImpl.stores != 0 {
+		t.Fatalf("the raced recovery create stored %d entries", filerImpl.stores)
+	}
+	if len(filerImpl.conds) == 0 || filerImpl.conds[0].GetClauses()[0].Kind != filer_pb.WriteCondition_IF_NOT_EXISTS {
+		t.Fatalf("recovery create carried no IF_NOT_EXISTS precondition: %+v", filerImpl.conds)
+	}
+	if got := filerImpl.entries["/buckets/b/o"]; got == nil || len(got.Chunks) == 0 || got.Chunks[0].FileId != newer.Chunks[0].FileId {
+		t.Fatalf("the racing write's entry was clobbered: %+v", got)
+	}
+}
+
+// Same incident, but the ambiguous PUT wrote a zero-byte object: recovery must
+// still run — an unconditional fallback would overwrite the newer write even
+// though there were no chunks to verify.
+func TestPutToFilerRoutedAmbiguousEmptyPutKeepsNewerWrite(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	newer := &filer_pb.Entry{
+		Name:       "o",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 11},
+		Chunks:     []*filer_pb.FileChunk{{FileId: "3,00000000000000bb0000000b", Size: 11}},
+	}
+	filerImpl := &ambiguousPutFiler{
+		volume:    volume,
+		entries:   map[string]*filer_pb.Entry{},
+		supersede: newer,
+		txnErr:    status.Error(codes.Unavailable, "owner restarted mid-write"),
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/o", nil)
+	_, code, _ := s3a.putToFiler(r, "/buckets/b/o", strings.NewReader(""), "b", "o", 1, 0, nil, false, "")
+	if code != s3err.ErrServiceUnavailable {
+		t.Fatalf("putToFiler returned %v, want refusal once a newer write is found", code)
+	}
+	if filerImpl.stores != 0 {
+		t.Fatalf("recovery re-committed the stale entry %d times", filerImpl.stores)
+	}
+	if got := filerImpl.entries["/buckets/b/o"]; got == nil || len(got.Chunks) == 0 || got.Chunks[0].FileId != newer.Chunks[0].FileId {
+		t.Fatalf("the newer write's entry was clobbered: %+v", got)
+	}
+}
+
+// Chunk lists cannot prove a zero-byte PUT landed — an older empty object at
+// the same path compares equal too. A stored entry whose metadata differs from
+// this write's must not be claimed as its commit: it belongs to a different
+// request, so the outcome stays uncertain for the client to retry.
+func TestPutToFilerRoutedAmbiguousEmptyPutStaleMetadata(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume:     volume,
+		txnNoApply: true,
+		txnErr:     status.Error(codes.Unavailable, "response lost before commit"),
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/b/o": {
+				Name:       "o",
+				Attributes: &filer_pb.FuseAttributes{Mime: "text/plain"},
+				Extended:   map[string][]byte{s3_constants.ExtETagKey: []byte("\"d41d8cd98f00b204e9800998ecf8427e\"")},
+			},
+		},
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/o", nil)
+	_, code, _ := s3a.putToFiler(r, "/buckets/b/o", strings.NewReader(""), "b", "o", 1, 0, nil, false, "")
+	if code != s3err.ErrServiceUnavailable {
+		t.Fatalf("putToFiler returned %v, want refusal when the stored empty entry cannot be this write's", code)
+	}
+	if filerImpl.stores != 0 {
+		t.Fatalf("recovery committed over an unverifiable empty entry %d times", filerImpl.stores)
+	}
+	if got := filerImpl.entries["/buckets/b/o"]; got.GetAttributes().GetMime() != "text/plain" {
+		t.Fatalf("the older object's entry was replaced: %+v", got)
+	}
+}
+
+// The counterpart: when the routed zero-byte PUT did commit and only its
+// response was lost, the stored entry is this write's own — it carries this
+// write's stamped id — and recovery must still claim it rather than fail a
+// successful write.
+func TestPutToFilerRoutedAmbiguousEmptyPutLanded(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume:  volume,
+		entries: map[string]*filer_pb.Entry{},
+		txnErr:  status.Error(codes.Unavailable, "response lost after commit"),
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/o", nil)
+	_, code, _ := s3a.putToFiler(r, "/buckets/b/o", strings.NewReader(""), "b", "o", 1, 0, nil, false, "")
+	if code != s3err.ErrNone {
+		t.Fatalf("putToFiler returned %v, want success — the stored empty entry is this write's own commit", code)
+	}
+	if filerImpl.stores != 0 {
+		t.Fatalf("recovery re-committed an entry that was already stored %d times", filerImpl.stores)
+	}
+}
+
+// A conditional recovery create is itself ambiguous once sent: if it commits
+// and the response is lost, replaying it on another filer can resurrect an
+// entry whose chunks a delete already reclaimed. It also serializes with
+// routed writes only under the owner's per-path lock, so it is sent to the
+// owner alone — never failed over — and a possibly-committed attempt is
+// confirmed by lookup instead.
+func TestPutToFilerRecoveryCreateNotReplayed(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	// The owner commits the conditional create and loses the response. The
+	// healthy failover filer must never see it: the committed copy on the
+	// owner is confirmed instead of re-sent elsewhere.
+	filerA := &ambiguousPutFiler{
+		volume:     volume,
+		entries:    map[string]*filer_pb.Entry{},
+		apply:      true,
+		createErr:  status.Error(codes.Unavailable, "response lost after commit"),
+		txnNoApply: true,
+		txnErr:     status.Error(codes.Unavailable, "response lost"),
+	}
+	filerB := &ambiguousPutFiler{
+		volume:  volume,
+		entries: map[string]*filer_pb.Entry{},
+		apply:   true,
+	}
+	addrA := startFakeFiler(t, filerA)
+	addrB := startFakeFiler(t, filerB)
+	s3a := newPutTestServer(t, addrA, addrB)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, addrA)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{addrA}, 1)
+
+	_, code := putTestObject(t, s3a)
+	if code != s3err.ErrNone {
+		t.Fatalf("putToFiler returned %v — the committed create should be confirmed, not replayed", code)
+	}
+	if filerA.stores != 1 {
+		t.Fatalf("the owner stored the entry %d times, want once", filerA.stores)
+	}
+	if filerB.stores != 0 || len(filerB.conds) != 0 {
+		t.Fatalf("the recovery create reached a failover filer: stores=%d conds=%d", filerB.stores, len(filerB.conds))
+	}
+	if got := filerA.entries["/buckets/b/o"]; got == nil || len(got.Chunks) != 1 {
+		t.Fatalf("the committed entry is missing on the owner: %+v", got)
+	}
+	if deleted := volume.deleted(); len(deleted) != 0 {
+		t.Fatalf("chunks under a live entry were deleted: %v", deleted)
+	}
+}
+
+// The conditional recovery create serializes with routed writes only under the
+// owner's per-path lock, so it goes to the owner alone — a failover filer's
+// lock is a different serialization boundary.
+func TestPutToFilerRoutedRecoveryCreateStaysOnOwner(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerA := &ambiguousPutFiler{
+		volume:     volume,
+		entries:    map[string]*filer_pb.Entry{},
+		apply:      true,
+		txnNoApply: true,
+		txnErr:     status.Error(codes.Unavailable, "response lost"),
+	}
+	filerB := &ambiguousPutFiler{
+		volume:  volume,
+		entries: map[string]*filer_pb.Entry{},
+		apply:   true,
+	}
+	addrA := startFakeFiler(t, filerA)
+	addrB := startFakeFiler(t, filerB)
+	s3a := newPutTestServer(t, addrA, addrB)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, addrA)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{addrA}, 1)
+
+	_, code := putTestObject(t, s3a)
+	if code != s3err.ErrNone {
+		t.Fatalf("putToFiler returned %v — the conditional create should commit on the owner", code)
+	}
+	if filerA.stores != 1 {
+		t.Fatalf("the owner stored the entry %d times, want once", filerA.stores)
+	}
+	if len(filerA.conds) != 1 || filerA.conds[0].GetClauses()[0].GetKind() != filer_pb.WriteCondition_IF_NOT_EXISTS {
+		t.Fatalf("recovery create carried %+v, want one IF_NOT_EXISTS", filerA.conds)
+	}
+	if filerB.stores != 0 || len(filerB.conds) != 0 {
+		t.Fatalf("the conditional create failed over to another filer: stores=%d conds=%d", filerB.stores, len(filerB.conds))
+	}
+}
+
+// When the owner cannot accept the recovery create, the outcome is uncertain —
+// not a failover create under a different filer's lock.
+func TestPutToFilerRoutedRecoveryOwnerDownIsUncertain(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerA := &ambiguousPutFiler{
+		volume:     volume,
+		entries:    map[string]*filer_pb.Entry{},
+		createErr:  status.Error(codes.Unavailable, "connection refused"),
+		txnNoApply: true,
+		txnErr:     status.Error(codes.Unavailable, "response lost"),
+	}
+	filerB := &ambiguousPutFiler{
+		volume:  volume,
+		entries: map[string]*filer_pb.Entry{},
+		apply:   true,
+	}
+	addrA := startFakeFiler(t, filerA)
+	addrB := startFakeFiler(t, filerB)
+	s3a := newPutTestServer(t, addrA, addrB)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, addrA)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{addrA}, 1)
+
+	_, code := putTestObject(t, s3a)
+	if code != s3err.ErrServiceUnavailable {
+		t.Fatalf("putToFiler returned %v, want an uncertain result when the owner cannot take the create", code)
+	}
+	if filerB.stores != 0 || len(filerB.conds) != 0 {
+		t.Fatalf("the conditional create failed over to another filer: stores=%d conds=%d", filerB.stores, len(filerB.conds))
+	}
+	if deleted := volume.deleted(); len(deleted) == 0 {
+		t.Fatal("orphaned chunks were not deleted")
+	}
+}
+
+// An absent entry cannot prove an empty PUT never committed — the routed
+// create may have landed and a delete already removed it. Recovery must not
+// recreate the object: the outcome is uncertain, not an IF_NOT_EXISTS create.
+func TestPutToFilerRoutedAmbiguousEmptyPutAbsentNotRecreated(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume:  volume,
+		entries: map[string]*filer_pb.Entry{},
+		txnErr:  status.Error(codes.Unavailable, "response lost after commit"),
+	}
+	// The committed empty object is deleted before recovery looks it up.
+	filerImpl.beforeLookup = func() {
+		delete(filerImpl.entries, "/buckets/b/o")
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/o", nil)
+	_, code, _ := s3a.putToFiler(r, "/buckets/b/o", strings.NewReader(""), "b", "o", 1, 0, nil, false, "")
+	if code != s3err.ErrServiceUnavailable {
+		t.Fatalf("putToFiler returned %v, want an uncertain result for an unverifiable empty PUT", code)
+	}
+	if filerImpl.stores != 0 {
+		t.Fatalf("recovery recreated an object a delete may have removed %d times", filerImpl.stores)
+	}
+	if got := filerImpl.entries["/buckets/b/o"]; got != nil {
+		t.Fatalf("the deleted object was resurrected: %+v", got)
+	}
+}
+
+// Matching metadata alone cannot pass an older empty object off as this PUT's
+// commit: a foreign write id marks it as a different write, so the outcome
+// stays uncertain for the client to retry.
+func TestPutToFilerRoutedAmbiguousEmptyPutForeignWriteId(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	emptyMd5 := md5.Sum(nil)
+	filerImpl := &ambiguousPutFiler{
+		volume:     volume,
+		txnNoApply: true,
+		txnErr:     status.Error(codes.Unavailable, "response lost before commit"),
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/b/o": {
+				Name:       "o",
+				Attributes: &filer_pb.FuseAttributes{Mime: "application/octet-stream", Md5: emptyMd5[:]},
+				Extended: map[string][]byte{
+					s3_constants.ExtETagKey:       []byte("\"d41d8cd98f00b204e9800998ecf8427e\""),
+					s3_constants.SeaweedFSWriteId: []byte("another-write"),
+				},
+			},
+		},
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/o", nil)
+	_, code, _ := s3a.putToFiler(r, "/buckets/b/o", strings.NewReader(""), "b", "o", 1, 0, nil, false, "")
+	if code != s3err.ErrServiceUnavailable {
+		t.Fatalf("putToFiler returned %v, want refusal when the stored empty entry carries another write's id", code)
+	}
+	if filerImpl.stores != 0 {
+		t.Fatalf("recovery committed over an unverifiable empty entry %d times", filerImpl.stores)
+	}
+	if got := filerImpl.entries["/buckets/b/o"]; string(got.GetExtended()[s3_constants.SeaweedFSWriteId]) != "another-write" {
+		t.Fatalf("the older object's entry was replaced: %+v", got)
+	}
+}
+
+// A volume-encrypted chunk must be decrypted before SSE decryption sees it:
+// fetchChunkData feeds ciphered chunks through the cipher-aware read path and
+// slices plaintext space, while plain chunks keep streaming range reads.
+func TestFetchChunkDataDecryptsVolumeCipher(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{volume: volume, entries: map[string]*filer_pb.Entry{}}
+	s3a := newPutTestServer(t, startFakeFiler(t, filerImpl))
+
+	plaintext := []byte("0123456789abcdefghijklmnopqrstuvwxyz")
+	cipherKey := util.GenCipherKey()
+	ciphertext, err := util.Encrypt(plaintext, cipherKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	fid := "3,01637037d6"
+	volume.mu.Lock()
+	volume.stored[fid] = ciphertext
+	volume.mu.Unlock()
+
+	full, err := s3a.fetchFullChunk(context.Background(), &filer.ChunkView{
+		FileId: fid, ChunkSize: uint64(len(plaintext)), CipherKey: cipherKey,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, _ := io.ReadAll(full)
+	full.Close()
+	if !bytes.Equal(got, plaintext) {
+		t.Fatalf("full chunk read = %q, want %q", got, plaintext)
+	}
+
+	view, err := s3a.fetchChunkViewData(context.Background(), &filer.ChunkView{
+		FileId: fid, OffsetInChunk: 5, ViewSize: 4, ChunkSize: uint64(len(plaintext)), CipherKey: cipherKey,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, _ = io.ReadAll(view)
+	view.Close()
+	if !bytes.Equal(got, plaintext[5:9]) {
+		t.Fatalf("ranged ciphered read = %q, want %q", got, plaintext[5:9])
+	}
+
+	volume.mu.Lock()
+	volume.stored[fid] = plaintext
+	volume.mu.Unlock()
+	plain, err := s3a.fetchChunkViewData(context.Background(), &filer.ChunkView{
+		FileId: fid, OffsetInChunk: 5, ViewSize: 4, ChunkSize: uint64(len(plaintext)),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, _ = io.ReadAll(plain)
+	plain.Close()
+	if !bytes.Equal(got, plaintext[5:9]) {
+		t.Fatalf("ranged plain read = %q, want %q", got, plaintext[5:9])
+	}
+}
+
+// A suspended-versioning overwrite resolves the conditional check against the
+// entry the read path serves: the null slot when present, else the latest
+// version under .versions/. The routed transaction carries that version as the
+// condition's fallback key so check and write stay under the filer lock —
+// checking the empty null-version slot alone would reject a matching If-Match.
+func TestSuspendedPutIfMatchRoutesWithConditionAltKey(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume: volume,
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/b": {
+				Name:        "b",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{},
+				Extended:    map[string][]byte{s3_constants.ExtVersioningKey: []byte(s3_constants.VersioningSuspended)},
+			},
+			"/buckets/b/k.versions": {
+				Name:        "k.versions",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{},
+				Extended: map[string][]byte{
+					s3_constants.ExtLatestVersionIdKey:       []byte("v1"),
+					s3_constants.ExtLatestVersionFileNameKey: []byte("v_v1"),
+				},
+			},
+			"/buckets/b/k.versions/v_v1": {
+				Name:       "v_v1",
+				Attributes: &filer_pb.FuseAttributes{Md5: []byte{0xab, 0xc1, 0x23}, FileSize: 1},
+				Extended: map[string][]byte{
+					s3_constants.ExtETagKey:      []byte("abc123"),
+					s3_constants.ExtVersionIdKey: []byte("v1"),
+				},
+			},
+		},
+		apply: true,
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	filerImpl.txnCheck = func(req *filer_pb.ObjectTransactionRequest) {
+		if req.ConditionAltKey != "/buckets/b/k.versions" {
+			t.Fatalf("condition alt key = %q, want /buckets/b/k.versions", req.ConditionAltKey)
+		}
+	}
+
+	r := httptest.NewRequest(http.MethodPut, "/b/k", strings.NewReader("new"))
+	r.Header.Set(s3_constants.IfMatch, `"abc123"`)
+	_, code, _ := s3a.putSuspendedVersioningObject(r, "b", "k", r.Body, "")
+	if code != s3err.ErrNone {
+		t.Fatalf("suspended If-Match PUT = %v", code)
+	}
+	if filerImpl.entries["/buckets/b/k"] == nil {
+		t.Fatal("null-version entry was not created")
+	}
+	if filerImpl.txnCount != 1 {
+		t.Fatalf("conditional suspended write should route one transaction, got %d", filerImpl.txnCount)
+	}
+}
+
+// When the latest version is a delete marker, a suspended If-None-Match: *
+// write must treat the object as absent — the fallback resolves a tombstone
+// to "no current version", not an existing one.
+func TestSuspendedPutIfNoneMatchWithDeleteMarkerLatest(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume: volume,
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/b": {
+				Name:        "b",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{},
+				Extended:    map[string][]byte{s3_constants.ExtVersioningKey: []byte(s3_constants.VersioningSuspended)},
+			},
+			"/buckets/b/k.versions": {
+				Name:        "k.versions",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{},
+				Extended: map[string][]byte{
+					s3_constants.ExtLatestVersionFileNameKey: []byte("v_v1"),
+				},
+			},
+			"/buckets/b/k.versions/v_v1": {
+				Name:       "v_v1",
+				Attributes: &filer_pb.FuseAttributes{FileSize: 0},
+				Extended: map[string][]byte{
+					s3_constants.ExtVersionIdKey:    []byte("v1"),
+					s3_constants.ExtDeleteMarkerKey: []byte("true"),
+				},
+			},
+		},
+		apply: true,
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	r := httptest.NewRequest(http.MethodPut, "/b/k", strings.NewReader("new"))
+	r.Header.Set(s3_constants.IfNoneMatch, "*")
+	_, code, _ := s3a.putSuspendedVersioningObject(r, "b", "k", r.Body, "")
+	if code != s3err.ErrNone {
+		t.Fatalf("suspended If-None-Match PUT over a delete-marker latest = %v, want success", code)
+	}
+	if filerImpl.entries["/buckets/b/k"] == nil {
+		t.Fatal("null-version entry was not created")
+	}
+}
+
+// A filer that predates condition_alt_key ignores the field and checks the
+// empty null slot alone, so the transaction precondition-fails even though
+// If-Match matches the served version. The gateway resends the transaction
+// against the resolved version instead of surfacing the false 412.
+func TestSuspendedPutIfMatchRecheckedWhenAltKeyIgnored(t *testing.T) {
+	volume := startFakeVolumeServer(t)
+	filerImpl := &ambiguousPutFiler{
+		volume: volume,
+		entries: map[string]*filer_pb.Entry{
+			"/buckets/b": {
+				Name:        "b",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{},
+				Extended:    map[string][]byte{s3_constants.ExtVersioningKey: []byte(s3_constants.VersioningSuspended)},
+			},
+			"/buckets/b/k.versions": {
+				Name:        "k.versions",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{},
+				Extended: map[string][]byte{
+					s3_constants.ExtLatestVersionIdKey:       []byte("v1"),
+					s3_constants.ExtLatestVersionFileNameKey: []byte("v_v1"),
+				},
+			},
+			"/buckets/b/k.versions/v_v1": {
+				Name:       "v_v1",
+				Attributes: &filer_pb.FuseAttributes{Md5: []byte{0xab, 0xc1, 0x23}, FileSize: 1},
+				Extended: map[string][]byte{
+					s3_constants.ExtETagKey:      []byte("abc123"),
+					s3_constants.ExtVersionIdKey: []byte("v1"),
+				},
+			},
+		},
+		apply:        true,
+		ignoreAltKey: true,
+	}
+	filerAddr := startFakeFiler(t, filerImpl)
+	s3a := newPutTestServer(t, filerAddr)
+	s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+	s3a.objectWriteLockClient = cluster.NewLockClient(s3a.option.GrpcDialOption, filerAddr)
+	s3a.objectWriteLockClient.SetRing([]pb.ServerAddress{filerAddr}, 1)
+
+	var conditionKeys []string
+	filerImpl.txnCheck = func(req *filer_pb.ObjectTransactionRequest) {
+		conditionKeys = append(conditionKeys, req.ConditionKey)
+	}
+
+	r := httptest.NewRequest(http.MethodPut, "/b/k", strings.NewReader("new"))
+	r.Header.Set(s3_constants.IfMatch, `"abc123"`)
+	_, code, _ := s3a.putSuspendedVersioningObject(r, "b", "k", r.Body, "")
+	if code != s3err.ErrNone {
+		t.Fatalf("suspended If-Match PUT against a filer ignoring condition_alt_key = %v", code)
+	}
+	if filerImpl.entries["/buckets/b/k"] == nil {
+		t.Fatal("null-version entry was not created")
+	}
+	if filerImpl.txnCount != 2 {
+		t.Fatalf("got %d transactions, want the routed attempt plus a resend against the resolved version", filerImpl.txnCount)
+	}
+	if len(conditionKeys) != 2 || conditionKeys[0] != "" || conditionKeys[1] != "/buckets/b/k.versions/v_v1" {
+		t.Fatalf("condition keys = %v, want [\"\" \"/buckets/b/k.versions/v_v1\"]", conditionKeys)
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_put_error_test.go b/weed/s3api/s3api_object_handlers_put_error_test.go
index 7fda9dbbb2..ade6b661f8 100644
--- a/weed/s3api/s3api_object_handlers_put_error_test.go
+++ b/weed/s3api/s3api_object_handlers_put_error_test.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 )
 
@@ -42,6 +43,22 @@ func TestMapChunkedUploadErrorToS3Error(t *testing.T) {
 			err:  errors.New("assign volume: no free volumes"),
 			want: s3err.ErrInternalError,
 		},
+		{
+			// Over-quota (read-only) buckets must be 403, not retryable 500.
+			name: "filer read-only verdict maps to AccessDenied",
+			err: fmt.Errorf("upload chunk: assign volume: %w", filer_pb.AssignVolumeResponseError(&filer_pb.AssignVolumeResponse{
+				Error:     "assign volume: read only: /buckets/q (e.g. bucket over quota)",
+				ErrorCode: filer_pb.FilerError_READ_ONLY,
+			})),
+			want: s3err.ErrAccessDenied,
+		},
+		{
+			// A full volume rejecting a write is a transient server fault the
+			// client should retry, even though its text also says "read only".
+			name: "volume server read-only write stays InternalError",
+			err:  errors.New("upload chunk: upload data: unexpected status 500: volume 5 is read only"),
+			want: s3err.ErrInternalError,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/weed/s3api/s3api_object_handlers_readonly_test.go b/weed/s3api/s3api_object_handlers_readonly_test.go
new file mode 100644
index 0000000000..09074644f7
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_readonly_test.go
@@ -0,0 +1,94 @@
+package s3api
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	weed_server "github.com/seaweedfs/seaweedfs/weed/server"
+)
+
+// readOnlyAssignFiler answers AssignVolume the way a filer does for a path
+// under a read-only rule (e.g. an over-quota bucket), and counts the calls.
+type readOnlyAssignFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	calls int32
+}
+
+func (f *readOnlyAssignFiler) AssignVolume(context.Context, *filer_pb.AssignVolumeRequest) (*filer_pb.AssignVolumeResponse, error) {
+	atomic.AddInt32(&f.calls, 1)
+	return &filer_pb.AssignVolumeResponse{
+		Error:     "assign volume: read only: /buckets/b (e.g. bucket over quota)",
+		ErrorCode: filer_pb.FilerError_READ_ONLY,
+	}, nil
+}
+
+// LookupDirectoryEntry finds nothing, so the bucket has no config to apply.
+func (f *readOnlyAssignFiler) LookupDirectoryEntry(context.Context, *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	return &filer_pb.LookupDirectoryEntryResponse{}, nil
+}
+
+// startReadOnlyFilers starts a read-only filer followed by a spare one, so a
+// test can assert the verdict was not treated as a reason to fail over.
+func startReadOnlyFilers(t *testing.T) (*S3ApiServer, *readOnlyAssignFiler, *readOnlyAssignFiler) {
+	t.Helper()
+	first, spare := &readOnlyAssignFiler{}, &readOnlyAssignFiler{}
+	s3a := newPutTestServer(t, startFakeFiler(t, first), startFakeFiler(t, spare))
+	return s3a, first, spare
+}
+
+func assertNoFailover(t *testing.T, first, spare *readOnlyAssignFiler) {
+	t.Helper()
+	if calls := atomic.LoadInt32(&first.calls); calls == 0 {
+		t.Fatal("the first filer was never asked")
+	}
+	if calls := atomic.LoadInt32(&spare.calls); calls != 0 {
+		t.Fatalf("read-only verdict failed over to the next filer %d time(s)", calls)
+	}
+}
+
+// PutObject into an over-quota bucket is 403, not a retryable 500.
+func TestPutToFilerReadOnlyBucketIsAccessDenied(t *testing.T) {
+	s3a, first, spare := startReadOnlyFilers(t)
+
+	if _, code := putTestObject(t, s3a); code != s3err.ErrAccessDenied {
+		t.Fatalf("putToFiler = %v, want %v", code, s3err.ErrAccessDenied)
+	}
+	assertNoFailover(t, first, spare)
+}
+
+func TestAssignNewVolumeReadOnlyKeepsSentinel(t *testing.T) {
+	s3a, first, spare := startReadOnlyFilers(t)
+
+	_, err := s3a.assignNewVolume("/buckets/b/o", 1)
+	if !errors.Is(err, weed_server.ErrReadOnly) {
+		t.Fatalf("assignNewVolume err = %v, want ErrReadOnly", err)
+	}
+	assertNoFailover(t, first, spare)
+}
+
+// The copy paths fan chunks out to workers; the sentinel must survive the
+// per-chunk wrapping so CopyObject and UploadPartCopy report 403 too.
+func TestCopyChunksReadOnlyIsAccessDenied(t *testing.T) {
+	s3a, _, _ := startReadOnlyFilers(t)
+	entry := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{FileSize: 8},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: "3,01637037d6", Offset: 0, Size: 4},
+			{FileId: "3,02637037d6", Offset: 4, Size: 4},
+		},
+	}
+
+	_, err := s3a.copyChunks(entry, "/buckets/b/dst")
+	if code := s3a.mapCopyErrorToS3Error(err); code != s3err.ErrAccessDenied {
+		t.Fatalf("copyChunks err %v maps to %v, want %v", err, code, s3err.ErrAccessDenied)
+	}
+
+	_, _, err = s3a.copyChunksForRange(entry, 0, 7, "/buckets/b/dst")
+	if code := s3a.mapCopyErrorToS3Error(err); code != s3err.ErrAccessDenied {
+		t.Fatalf("copyChunksForRange err %v maps to %v, want %v", err, code, s3err.ErrAccessDenied)
+	}
+}
diff --git a/weed/s3api/s3api_object_handlers_rename.go b/weed/s3api/s3api_object_handlers_rename.go
index 8ac6c0be63..fc1ba4436e 100644
--- a/weed/s3api/s3api_object_handlers_rename.go
+++ b/weed/s3api/s3api_object_handlers_rename.go
@@ -2,10 +2,12 @@ package s3api
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"net/http"
 	"net/url"
 	"strings"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -31,6 +33,8 @@ var renameSourceConditionalHeaders = sourceConditionalHeaderNames{
 //
 // The object is moved by the filer's AtomicRenameEntry, so its bytes are never
 // read or rewritten and its metadata (ETag, tags, SSE keys) travels unchanged.
+// x-amz-client-token travels with it too, so a rename whose response was lost
+// answers its own retry instead of the NoSuchKey its vanished source would give.
 // Versioned buckets are rejected: the move would have to rebuild the .versions
 // chain, and AWS itself only offers RenameObject on directory buckets, which
 // cannot be versioned.
@@ -73,8 +77,14 @@ func (s3a *S3ApiServer) RenameObjectHandler(w http.ResponseWriter, r *http.Reque
 	// is what the request URL names. The source arrives in a header and loses
 	// its key, so it needs both read and delete permission checked here.
 	if errCode := s3a.authorizeRenameSource(r, bucket, srcObject); errCode != s3err.ErrNone {
-		s3err.WriteErrorResponse(w, r, errCode)
-		return
+		// Same tag-conditioned-Allow deferral as the copy path: the first
+		// phase ran without the source's tags, so a tag-gated Allow can still
+		// grant both the read and the delete the rename performs.
+		if s3a.recheckPolicyForKeyWithLookup(r, http.MethodGet, bucket, srcObject, "", string(s3_constants.ACTION_READ), "RenameObjectHandler") != s3err.ErrNone ||
+			s3a.recheckPolicyForKeyWithLookup(r, http.MethodDelete, bucket, srcObject, "", string(s3_constants.ACTION_WRITE), "RenameObjectHandler") != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
 	}
 
 	versioningState, err := s3a.getVersioningState(bucket)
@@ -92,9 +102,31 @@ func (s3a *S3ApiServer) RenameObjectHandler(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
+	clientToken := r.Header.Get(s3_constants.AmzClientToken)
+	renameSource := r.Header.Get(s3_constants.AmzRenameSource)
+
 	errCode = s3a.withRenameWriteLocks(bucket, srcObject, dstObject, func() s3err.ErrorCode {
 		entry, err := s3a.resolveCopySourceEntry(bucket, srcObject, "", "")
-		if errCode := classifyCopySourceError(entry, err); errCode != s3err.ErrNone {
+		srcIsPrefixObject := entry.IsPrefixObject()
+		entry = prefixObjectSource(entry)
+		srcErrCode := classifyCopySourceError(entry, err)
+
+		dstEntry, errCode := s3a.lookupRenameDestination(bucket, dstObject)
+		if errCode != s3err.ErrNone {
+			return errCode
+		}
+		if errCode, settled := retryRenameDecision(dstEntry, clientToken, renameSource, dstObject, srcErrCode); settled {
+			return errCode
+		}
+		if srcErrCode != s3err.ErrNone {
+			return srcErrCode
+		}
+		if errCode := s3a.recheckCopySourcePolicy(r, bucket, srcObject, "", entry.Extended, "RenameObjectHandler"); errCode != s3err.ErrNone {
+			return errCode
+		}
+		// The rename also deletes the source; a tag-gated Deny on the delete
+		// applies the same way it does to a direct DELETE.
+		if errCode := s3a.recheckPolicyWithObjectEntry(objectKeyPolicyRequest(r, http.MethodDelete, bucket, srcObject, ""), bucket, srcObject, string(s3_constants.ACTION_WRITE), entry.Extended, "RenameObjectHandler"); errCode != s3err.ErrNone {
 			return errCode
 		}
 		if errCode := validateSourceConditionalHeaders(r, entry, renameSourceConditionalHeaders); errCode != s3err.ErrNone {
@@ -103,7 +135,14 @@ func (s3a *S3ApiServer) RenameObjectHandler(w http.ResponseWriter, r *http.Reque
 		if errCode := s3a.checkConditionalHeaders(r, bucket, dstObject); errCode != s3err.ErrNone {
 			return errCode
 		}
-		return s3a.renameObjectEntry(r.Context(), bucket, srcObject, dstObject)
+
+		// AtomicRenameEntry moves a directory by moving everything under it, and the keys
+		// nested under either end of this rename are not part of what is being renamed.
+		keyHoldsNestedKeys := srcIsPrefixObject || (dstEntry != nil && dstEntry.IsDirectory)
+		if clientToken != "" {
+			s3a.stampRenameToken(bucket, srcObject, dstObject, entry, clientToken, renameSource, keyHoldsNestedKeys)
+		}
+		return s3a.renameObjectEntry(r.Context(), bucket, srcObject, dstObject, entry, keyHoldsNestedKeys)
 	})
 	if errCode != s3err.ErrNone {
 		s3err.WriteErrorResponse(w, r, errCode)
@@ -205,6 +244,139 @@ func (s3a *S3ApiServer) authorizeRenameSource(r *http.Request, bucket, srcObject
 	return s3a.iam.AuthorizeObjectDelete(r, identity, bucket, srcObject, "")
 }
 
+// renameTokenValidity bounds how long a committed rename answers for its own
+// retry. An SDK gives up retrying long before this, so the window covers every
+// retry there is, while a token that comes back days later no longer stands in
+// for a move the caller means to happen now.
+const renameTokenValidity = 24 * time.Hour
+
+// renameToken is what a rename leaves on the object it moves, so that the same
+// request replayed after its response was lost can be answered from the
+// destination instead of from a source that is no longer there.
+//
+// Source is the x-amz-rename-source header as it was sent. A retry resends the
+// request byte for byte, so equality on the raw value recognises it, and any
+// other value is the token used for a different rename. Dest is the key the
+// rename wrote, which tells a token that travelled here some other way - on a
+// CopyObject of a renamed object, say - from one this rename left.
+type renameToken struct {
+	Token  string `json:"token"`
+	Source string `json:"source"`
+	Dest   string `json:"dest"`
+	Unix   int64  `json:"unix"`
+}
+
+type renameTokenVerdict int
+
+const (
+	// renameTokenUnrelated: the destination carries no live token of this request's.
+	renameTokenUnrelated renameTokenVerdict = iota
+	// renameTokenSameRequest: this very rename already committed here.
+	renameTokenSameRequest
+	// renameTokenReused: the same token was sent for a different rename.
+	renameTokenReused
+)
+
+// classifyRenameToken reads what the destination object says about a request
+// carrying clientToken.
+func classifyRenameToken(dstEntry *filer_pb.Entry, clientToken, renameSource, dstObject string) renameTokenVerdict {
+	if clientToken == "" || dstEntry == nil {
+		return renameTokenUnrelated
+	}
+	stamped, found := dstEntry.Extended[s3_constants.SeaweedFSRenameToken]
+	if !found {
+		return renameTokenUnrelated
+	}
+	var token renameToken
+	if err := json.Unmarshal(stamped, &token); err != nil {
+		glog.Warningf("RenameObject: unreadable rename token on %s: %v", dstEntry.Name, err)
+		return renameTokenUnrelated
+	}
+	if token.Token != clientToken || token.Dest != dstObject || time.Since(time.Unix(token.Unix, 0)) > renameTokenValidity {
+		return renameTokenUnrelated
+	}
+	if token.Source != renameSource {
+		return renameTokenReused
+	}
+	return renameTokenSameRequest
+}
+
+// retryRenameDecision says what to do with a request whose destination carries
+// a rename token. settled=true means the request is answered (return errCode);
+// settled=false means continue with the rename.
+//
+// A reused token is refused. A token from this very rename is answered as
+// success only when the source is gone — the move already committed and only
+// its response was lost. A source that is back is not that retry: the move is
+// still to be made, and making it is what leaves the caller where it asked to
+// be, so the decision falls through and the rename proceeds.
+func retryRenameDecision(dstEntry *filer_pb.Entry, clientToken, renameSource, dstObject string, srcErrCode s3err.ErrorCode) (s3err.ErrorCode, bool) {
+	switch classifyRenameToken(dstEntry, clientToken, renameSource, dstObject) {
+	case renameTokenReused:
+		return s3err.ErrIdempotentParameterMismatch, true
+	case renameTokenSameRequest:
+		if srcErrCode == s3err.ErrNoSuchKey {
+			return s3err.ErrNone, true
+		}
+	}
+	return s3err.ErrNone, false
+}
+
+// markRenameToken puts the client token on the entry the rename moves.
+func markRenameToken(srcEntry *filer_pb.Entry, clientToken, renameSource, dstObject string) error {
+	stamped, err := json.Marshal(renameToken{Token: clientToken, Source: renameSource, Dest: dstObject, Unix: time.Now().Unix()})
+	if err != nil {
+		return err
+	}
+	if srcEntry.Extended == nil {
+		srcEntry.Extended = make(map[string][]byte)
+	}
+	srcEntry.Extended[s3_constants.SeaweedFSRenameToken] = stamped
+	return nil
+}
+
+// stampRenameToken records the client token on the object about to be moved, so
+// that the move carries it to the destination.
+//
+// The token goes on before the move rather than after it: a move that commits
+// and then loses its token is exactly the failure the token exists to cover,
+// while a token left on a move that never happened simply rides along with the
+// next attempt. Failing to record it costs this rename its idempotency and
+// nothing else, so the move goes ahead either way.
+func (s3a *S3ApiServer) stampRenameToken(bucket, srcObject, dstObject string, srcEntry *filer_pb.Entry, clientToken, renameSource string, keyHoldsNestedKeys bool) {
+	// The ETag as it stands now, read before the token joins it.
+	expected := map[string][]byte{s3_constants.ExtETagKey: srcEntry.Extended[s3_constants.ExtETagKey]}
+
+	if err := markRenameToken(srcEntry, clientToken, renameSource, dstObject); err != nil {
+		glog.Errorf("RenameObject %s: rename token for %s: %v", bucket, srcObject, err)
+		return
+	}
+
+	// renameKeyHoldingNestedKeys writes the destination out of this entry, so the
+	// token reaches it without a write of its own.
+	if keyHoldsNestedKeys {
+		return
+	}
+
+	// AtomicRenameEntry moves the entry as the filer holds it, so the token has to
+	// be on the source for the move to carry it. markRenameToken already mutated
+	// srcEntry.Extended in place, so the move carries the token to the destination
+	// whether or not this UpdateEntry succeeds — the write only persists the token
+	// on the source ahead of the move, and a lost write costs idempotency, not
+	// correctness. The precondition keeps the write off an object another gateway
+	// replaced in the meantime.
+	srcDir, _ := util.FullPath(s3a.toFilerPath(bucket, srcObject)).DirAndName()
+	if err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return filer_pb.UpdateEntry(context.Background(), client, &filer_pb.UpdateEntryRequest{
+			Directory:        srcDir,
+			Entry:            srcEntry,
+			ExpectedExtended: expected,
+		})
+	}); err != nil {
+		glog.Warningf("RenameObject %s: record rename token on %s: %v", bucket, srcObject, err)
+	}
+}
+
 // withRenameWriteLocks holds the object write lock of both keys across the
 // precondition checks and the move. The keys are locked in a fixed order so a
 // rename in the opposite direction cannot deadlock against this one.
@@ -218,17 +390,33 @@ func (s3a *S3ApiServer) withRenameWriteLocks(bucket, srcObject, dstObject string
 	})
 }
 
-func (s3a *S3ApiServer) renameObjectEntry(ctx context.Context, bucket, srcObject, dstObject string) s3err.ErrorCode {
+// lookupRenameDestination reads what the destination key already holds. A key
+// nothing lives at is the ordinary case and comes back as a nil entry.
+//
+// The move overwrites an existing destination object. A directory there is not a
+// conflict: it means other keys are nested under the destination key, and the
+// object goes onto the directory they live in, the way a PutObject of that key
+// would put it there.
+func (s3a *S3ApiServer) lookupRenameDestination(bucket, dstObject string) (*filer_pb.Entry, s3err.ErrorCode) {
+	dstDir, dstName := util.FullPath(s3a.toFilerPath(bucket, dstObject)).DirAndName()
+
+	entry, err := s3a.getEntry(dstDir, dstName)
+	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			return nil, s3err.ErrNone
+		}
+		glog.Errorf("RenameObject %s: destination %s: %v", bucket, dstObject, err)
+		return nil, s3err.ErrInternalError
+	}
+	return entry, s3err.ErrNone
+}
+
+func (s3a *S3ApiServer) renameObjectEntry(ctx context.Context, bucket, srcObject, dstObject string, srcEntry *filer_pb.Entry, keyHoldsNestedKeys bool) s3err.ErrorCode {
 	srcDir, srcName := util.FullPath(s3a.toFilerPath(bucket, srcObject)).DirAndName()
 	dstDir, dstName := util.FullPath(s3a.toFilerPath(bucket, dstObject)).DirAndName()
 
-	// The move overwrites an existing destination object, but a directory in
-	// the way is a conflict the filer reports as an opaque error.
-	if existing, err := s3a.getEntry(dstDir, dstName); err == nil && existing.IsDirectory {
-		return s3err.ErrExistingObjectIsDirectory
-	} else if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
-		glog.Errorf("RenameObject %s: destination %s: %v", bucket, dstObject, err)
-		return s3err.ErrInternalError
+	if keyHoldsNestedKeys {
+		return s3a.renameKeyHoldingNestedKeys(bucket, srcObject, dstObject, srcEntry)
 	}
 
 	err := s3a.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
@@ -249,3 +437,38 @@ func (s3a *S3ApiServer) renameObjectEntry(ctx context.Context, bucket, srcObject
 	}
 	return s3err.ErrNone
 }
+
+// renameKeyHoldingNestedKeys moves an object when either key of the rename is one
+// other keys are nested under. Such a key is stored on the directory those keys live
+// in, which has to stay where it is, so the object's own data is written at the
+// destination and then stripped off the source key - the entry survives as the plain
+// directory it also is. Both keys are held under their write locks for the whole
+// move, so no other S3 write interleaves; a crash between the two steps leaves the
+// destination written and the source still there, which a retry settles.
+func (s3a *S3ApiServer) renameKeyHoldingNestedKeys(bucket, srcObject, dstObject string, srcEntry *filer_pb.Entry) s3err.ErrorCode {
+	dstPath := util.FullPath(s3a.toFilerPath(bucket, dstObject))
+	dstDir, dstName := dstPath.DirAndName()
+
+	chunks, err := s3a.copyChunks(srcEntry, string(dstPath))
+	if err != nil {
+		glog.Errorf("RenameObject %s: copy chunks of %s: %v", bucket, srcObject, err)
+		return s3err.ErrInternalError
+	}
+
+	if err := s3a.mkFile(dstDir, dstName, chunks, func(entry *filer_pb.Entry) {
+		copyEntryToTarget(entry, srcEntry)
+		entry.Chunks = chunks
+	}); err != nil {
+		glog.Errorf("RenameObject %s: write %s: %v", bucket, dstObject, err)
+		s3a.deleteOrphanedChunks(chunks)
+		return filerErrorToS3Error(err)
+	}
+
+	// The destination holds copies now, so the source's own chunks go with it.
+	srcDir, srcName := util.FullPath(s3a.toFilerPath(bucket, srcObject)).DirAndName()
+	if err := s3a.rmObject(context.Background(), srcDir, srcName, true, false); err != nil {
+		glog.Errorf("RenameObject %s: strip %s: %v", bucket, srcObject, err)
+		return s3err.ErrInternalError
+	}
+	return s3err.ErrNone
+}
diff --git a/weed/s3api/s3api_object_handlers_rename_test.go b/weed/s3api/s3api_object_handlers_rename_test.go
index 4c73974355..c377bea732 100644
--- a/weed/s3api/s3api_object_handlers_rename_test.go
+++ b/weed/s3api/s3api_object_handlers_rename_test.go
@@ -1,6 +1,7 @@
 package s3api
 
 import (
+	"encoding/json"
 	"net/http"
 	"testing"
 	"time"
@@ -11,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
 )
 
 // TestRenameSourceCandidates: AWS spells x-amz-rename-source as a bare key in
@@ -144,6 +146,122 @@ func TestSourceConditionalHeaderPrecedence(t *testing.T) {
 	}
 }
 
+// TestRenameTokenAnswersItsOwnRetry walks the retry x-amz-client-token is there
+// for: the rename commits, its response is lost, and the SDK resends the request
+// unchanged. The move carries the token to the destination, so the destination
+// can answer a retry that its own source no longer can.
+func TestRenameTokenAnswersItsOwnRetry(t *testing.T) {
+	const clientToken = "rename-token-of-this-request"
+	const renameSource = "/bucket/src.txt"
+
+	entry := &filer_pb.Entry{
+		Name:     "src.txt",
+		Extended: map[string][]byte{s3_constants.ExtETagKey: []byte("d41d8cd98f00b204e9800998ecf8427e")},
+	}
+	require.NoError(t, markRenameToken(entry, clientToken, renameSource, "dst.txt"))
+
+	moved := proto.Clone(entry).(*filer_pb.Entry)
+	moved.Name = "dst.txt"
+
+	assert.Equal(t, renameTokenSameRequest, classifyRenameToken(moved, clientToken, renameSource, "dst.txt"))
+	assert.Equal(t, renameTokenReused, classifyRenameToken(moved, clientToken, "/bucket/other.txt", "dst.txt"))
+	assert.Equal(t, renameTokenUnrelated, classifyRenameToken(moved, "rename-token-of-another-request", renameSource, "dst.txt"))
+	// A copy of a renamed object carries its token along; the key it names does not.
+	assert.Equal(t, renameTokenUnrelated, classifyRenameToken(moved, clientToken, renameSource, "copy.txt"))
+
+	// The token is the gateway's own bookkeeping and must not reach a GET or HEAD.
+	assert.True(t, s3_constants.IsSeaweedFSInternalHeader(s3_constants.SeaweedFSRenameToken))
+}
+
+// A reused token is refused with 400 Bad Request, matching the AWS S3
+// RenameObject API documentation for IdempotencyParameterMismatch.
+func TestRenameTokenReuseAnswersBadRequest(t *testing.T) {
+	api := s3err.GetAPIError(s3err.ErrIdempotentParameterMismatch)
+	assert.Equal(t, http.StatusBadRequest, api.HTTPStatusCode)
+	assert.Equal(t, "IdempotentParameterMismatch", api.Code)
+}
+
+func TestClassifyRenameToken(t *testing.T) {
+	const clientToken = "rename-token-of-this-request"
+	const renameSource = "/bucket/src.txt"
+
+	stamped := func(token renameToken) *filer_pb.Entry {
+		raw, err := json.Marshal(token)
+		require.NoError(t, err)
+		return &filer_pb.Entry{Name: "dst.txt", Extended: map[string][]byte{s3_constants.SeaweedFSRenameToken: raw}}
+	}
+	live := renameToken{Token: clientToken, Source: renameSource, Dest: "dst.txt", Unix: time.Now().Unix()}
+
+	tests := []struct {
+		name        string
+		dstEntry    *filer_pb.Entry
+		clientToken string
+		want        renameTokenVerdict
+	}{
+		{"nothing at the destination", nil, clientToken, renameTokenUnrelated},
+		{"request without a token", stamped(live), "", renameTokenUnrelated},
+		{"destination the rename never wrote", &filer_pb.Entry{Name: "dst.txt"}, clientToken, renameTokenUnrelated},
+		{"another rename's token", stamped(live), "rename-token-of-another-request", renameTokenUnrelated},
+		{"same request", stamped(live), clientToken, renameTokenSameRequest},
+		{"token reused for another source", stamped(renameToken{Token: clientToken, Source: "/bucket/other.txt", Dest: "dst.txt", Unix: time.Now().Unix()}), clientToken, renameTokenReused},
+		{"token of a rename to another key", stamped(renameToken{Token: clientToken, Source: renameSource, Dest: "elsewhere.txt", Unix: time.Now().Unix()}), clientToken, renameTokenUnrelated},
+		{"expired token", stamped(renameToken{Token: clientToken, Source: renameSource, Dest: "dst.txt", Unix: time.Now().Add(-renameTokenValidity - time.Minute).Unix()}), clientToken, renameTokenUnrelated},
+		{"unreadable token", &filer_pb.Entry{Name: "dst.txt", Extended: map[string][]byte{s3_constants.SeaweedFSRenameToken: []byte("{")}}, clientToken, renameTokenUnrelated},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, classifyRenameToken(tc.dstEntry, tc.clientToken, renameSource, "dst.txt"))
+		})
+	}
+}
+
+// TestRetryRenameDecision covers the handler's retry branch, including the
+// fallthrough the classification alone cannot express: when the destination
+// carries this request's token but the source is still there, the rename is
+// performed rather than short-circuited.
+func TestRetryRenameDecision(t *testing.T) {
+	const clientToken = "rename-token-of-this-request"
+	const renameSource = "/bucket/src.txt"
+
+	stamped := func(token renameToken) *filer_pb.Entry {
+		raw, err := json.Marshal(token)
+		require.NoError(t, err)
+		return &filer_pb.Entry{Name: "dst.txt", Extended: map[string][]byte{s3_constants.SeaweedFSRenameToken: raw}}
+	}
+	live := renameToken{Token: clientToken, Source: renameSource, Dest: "dst.txt", Unix: time.Now().Unix()}
+
+	tests := []struct {
+		name        string
+		dstEntry    *filer_pb.Entry
+		clientToken string
+		srcErrCode  s3err.ErrorCode
+		wantErr     s3err.ErrorCode
+		wantSettled bool
+	}{
+		// A retry whose source is gone is answered as success.
+		{"same request, source gone", stamped(live), clientToken, s3err.ErrNoSuchKey, s3err.ErrNone, true},
+		// A retry whose source is back falls through: the rename proceeds.
+		{"same request, source present", stamped(live), clientToken, s3err.ErrNone, s3err.ErrNone, false},
+		// A reused token is refused regardless of source state.
+		{"reused token, source gone", stamped(renameToken{Token: clientToken, Source: "/bucket/other.txt", Dest: "dst.txt", Unix: time.Now().Unix()}), clientToken, s3err.ErrNoSuchKey, s3err.ErrIdempotentParameterMismatch, true},
+		{"reused token, source present", stamped(renameToken{Token: clientToken, Source: "/bucket/other.txt", Dest: "dst.txt", Unix: time.Now().Unix()}), clientToken, s3err.ErrNone, s3err.ErrIdempotentParameterMismatch, true},
+		// An unrelated destination falls through to the ordinary rename path.
+		{"unrelated, source gone", nil, clientToken, s3err.ErrNoSuchKey, s3err.ErrNone, false},
+		{"unrelated, source present", nil, clientToken, s3err.ErrNone, s3err.ErrNone, false},
+		// A request without a token is never settled by the retry path.
+		{"no token, destination stamped", stamped(live), "", s3err.ErrNoSuchKey, s3err.ErrNone, false},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			errCode, settled := retryRenameDecision(tc.dstEntry, tc.clientToken, renameSource, "dst.txt", tc.srcErrCode)
+			assert.Equal(t, tc.wantSettled, settled)
+			assert.Equal(t, tc.wantErr, errCode)
+		})
+	}
+}
+
 // TestRouting_RenameObject pins PUT /bucket/key?renameObject to the RenameObject
 // route rather than the plain PutObject one that would otherwise match it.
 func TestRouting_RenameObject(t *testing.T) {
diff --git a/weed/s3api/s3api_object_handlers_retention.go b/weed/s3api/s3api_object_handlers_retention.go
index 5695be25d1..157bb99c42 100644
--- a/weed/s3api/s3api_object_handlers_retention.go
+++ b/weed/s3api/s3api_object_handlers_retention.go
@@ -25,6 +25,11 @@ func (s3a *S3ApiServer) PutObjectRetentionHandler(w http.ResponseWriter, r *http
 	// Get version ID from query parameters
 	versionId := r.URL.Query().Get("versionId")
 
+	if errCode := s3a.recheckTagConditionedPolicyWithLookup(r, bucket, object, versionId, s3_constants.ACTION_PUT_OBJECT_RETENTION, "PutObjectRetentionHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Evaluate governance bypass request (header + permission validation)
 	governanceBypassAllowed := s3a.evaluateGovernanceBypassRequest(r, bucket, object)
 
@@ -90,6 +95,11 @@ func (s3a *S3ApiServer) GetObjectRetentionHandler(w http.ResponseWriter, r *http
 	// Get version ID from query parameters
 	versionId := r.URL.Query().Get("versionId")
 
+	if errCode := s3a.recheckTagConditionedPolicyWithLookup(r, bucket, object, versionId, s3_constants.ACTION_GET_OBJECT_RETENTION, "GetObjectRetentionHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// Get retention configuration for the object
 	retention, err := s3a.getObjectRetention(bucket, object, versionId)
 	if err != nil {
diff --git a/weed/s3api/s3api_object_handlers_tagging.go b/weed/s3api/s3api_object_handlers_tagging.go
index 976721888d..c55b38c09c 100644
--- a/weed/s3api/s3api_object_handlers_tagging.go
+++ b/weed/s3api/s3api_object_handlers_tagging.go
@@ -29,6 +29,10 @@ func (s3a *S3ApiServer) GetObjectTaggingHandler(w http.ResponseWriter, r *http.R
 
 	// Check for specific version ID in query parameters
 	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
 
 	// Check if versioning is configured for the bucket (Enabled or Suspended)
 	versioningConfigured, err := s3a.isVersioningConfigured(bucket)
@@ -74,7 +78,7 @@ func (s3a *S3ApiServer) GetObjectTaggingHandler(w http.ResponseWriter, r *http.R
 		target := util.FullPath(fmt.Sprintf("%s/%s", s3a.bucketDir(bucket), object))
 		dir, name := target.DirAndName()
 
-		tags, err := s3a.getTags(dir, name)
+		entry, err = s3a.getEntry(dir, name)
 		if err != nil {
 			if err == filer_pb.ErrNotFound {
 				glog.Errorf("GetObjectTaggingHandler %s: %v", r.URL, err)
@@ -85,8 +89,14 @@ func (s3a *S3ApiServer) GetObjectTaggingHandler(w http.ResponseWriter, r *http.R
 			}
 			return
 		}
+	}
 
-		writeSuccessResponseXML(w, r, FromTags(tags))
+	action := s3_constants.S3_ACTION_GET_OBJECT_TAGGING
+	if versionId != "" {
+		action = s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING
+	}
+	if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, action, entry.Extended, "GetObjectTaggingHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
 		return
 	}
 
@@ -129,6 +139,12 @@ func (s3a *S3ApiServer) PutObjectTaggingHandler(w http.ResponseWriter, r *http.R
 		return
 	}
 	tags := tagging.ToTags()
+	// A key may appear only once in a tag set; the map keeps one of them.
+	if len(tags) != len(tagging.TagSet.Tag) {
+		glog.Errorf("PutObjectTaggingHandler duplicate tag keys %s", r.URL)
+		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidTag)
+		return
+	}
 	err = ValidateTags(tags)
 	if err != nil {
 		glog.Errorf("PutObjectTaggingHandler ValidateTags error %s: %v", r.URL, err)
@@ -138,6 +154,10 @@ func (s3a *S3ApiServer) PutObjectTaggingHandler(w http.ResponseWriter, r *http.R
 
 	// Check for specific version ID in query parameters
 	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
 
 	// Check if versioning is configured for the bucket (Enabled or Suspended)
 	versioningConfigured, err := s3a.isVersioningConfigured(bucket)
@@ -183,6 +203,15 @@ func (s3a *S3ApiServer) PutObjectTaggingHandler(w http.ResponseWriter, r *http.R
 		target := util.FullPath(fmt.Sprintf("%s/%s", s3a.bucketDir(bucket), object))
 		dir, name := target.DirAndName()
 
+		putAction := s3_constants.S3_ACTION_PUT_OBJECT_TAGGING
+		if versionId != "" {
+			putAction = s3_constants.S3_ACTION_PUT_OBJECT_VERSION_TAGGING
+		}
+		if errCode := s3a.recheckTagConditionedPolicyWithLookup(r, bucket, object, versionId, putAction, "PutObjectTaggingHandler"); errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
+
 		if err = s3a.setTags(dir, name, tags); err != nil {
 			if err == filer_pb.ErrNotFound {
 				glog.Errorf("PutObjectTaggingHandler setTags %s: %v", r.URL, err)
@@ -199,6 +228,15 @@ func (s3a *S3ApiServer) PutObjectTaggingHandler(w http.ResponseWriter, r *http.R
 		return
 	}
 
+	putAction := s3_constants.S3_ACTION_PUT_OBJECT_TAGGING
+	if versionId != "" {
+		putAction = s3_constants.S3_ACTION_PUT_OBJECT_VERSION_TAGGING
+	}
+	if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, putAction, entry.Extended, "PutObjectTaggingHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// For versioned objects, resolve the directory holding the entry to update. A null
 	// version lives under its full key's parent directory, so a nested key must not fall
 	// back to the bucket root and rewrite a different object sharing the same basename.
@@ -256,6 +294,10 @@ func (s3a *S3ApiServer) DeleteObjectTaggingHandler(w http.ResponseWriter, r *htt
 
 	// Check for specific version ID in query parameters
 	versionId := r.URL.Query().Get("versionId")
+	if errCode := s3a.checkVersionIdConfigured(bucket, versionId); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
 
 	// Check if versioning is configured for the bucket (Enabled or Suspended)
 	versioningConfigured, err := s3a.isVersioningConfigured(bucket)
@@ -301,6 +343,15 @@ func (s3a *S3ApiServer) DeleteObjectTaggingHandler(w http.ResponseWriter, r *htt
 		target := util.FullPath(fmt.Sprintf("%s/%s", s3a.bucketDir(bucket), object))
 		dir, name := target.DirAndName()
 
+		deleteAction := s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING
+		if versionId != "" {
+			deleteAction = s3_constants.S3_ACTION_DELETE_OBJECT_VERSION_TAGGING
+		}
+		if errCode := s3a.recheckTagConditionedPolicyWithLookup(r, bucket, object, versionId, deleteAction, "DeleteObjectTaggingHandler"); errCode != s3err.ErrNone {
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
+		}
+
 		err := s3a.rmTags(dir, name)
 		if err != nil {
 			if err == filer_pb.ErrNotFound {
@@ -318,6 +369,15 @@ func (s3a *S3ApiServer) DeleteObjectTaggingHandler(w http.ResponseWriter, r *htt
 		return
 	}
 
+	deleteAction := s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING
+	if versionId != "" {
+		deleteAction = s3_constants.S3_ACTION_DELETE_OBJECT_VERSION_TAGGING
+	}
+	if errCode := s3a.recheckPolicyWithObjectEntry(r, bucket, object, deleteAction, entry.Extended, "DeleteObjectTaggingHandler"); errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
+	}
+
 	// For versioned objects, resolve the directory holding the entry to update. A null
 	// version lives under its full key's parent directory, so a nested key must not fall
 	// back to the bucket root and rewrite a different object sharing the same basename.
diff --git a/weed/s3api/s3api_object_handlers_tagging_test.go b/weed/s3api/s3api_object_handlers_tagging_test.go
new file mode 100644
index 0000000000..05dec5a833
--- /dev/null
+++ b/weed/s3api/s3api_object_handlers_tagging_test.go
@@ -0,0 +1,29 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+)
+
+func TestPutObjectTaggingRejectsDuplicateKeys(t *testing.T) {
+	s3a := newHeadBucketTestServer(t, &fakeTxnFiler{})
+	body := "<Tagging><TagSet>" +
+		"<Tag><Key>a</Key><Value>1</Value></Tag>" +
+		"<Tag><Key>a</Key><Value>2</Value></Tag>" +
+		"</TagSet></Tagging>"
+	req := httptest.NewRequest(http.MethodPut, "/b/o?tagging", strings.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{"bucket": "b", "object": "o"})
+	rr := httptest.NewRecorder()
+	s3a.PutObjectTaggingHandler(rr, req)
+
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d; body: %s", rr.Code, http.StatusBadRequest, rr.Body.String())
+	}
+	if !strings.Contains(rr.Body.String(), "<Code>InvalidTag</Code>") {
+		t.Fatalf("body = %s, want InvalidTag", rr.Body.String())
+	}
+}
diff --git a/weed/s3api/s3api_object_lock_actions_authz_test.go b/weed/s3api/s3api_object_lock_actions_authz_test.go
new file mode 100644
index 0000000000..a90f7d93ae
--- /dev/null
+++ b/weed/s3api/s3api_object_lock_actions_authz_test.go
@@ -0,0 +1,310 @@
+package s3api
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/require"
+)
+
+func TestObjectLockRoutesUseDedicatedActions(t *testing.T) {
+	bindings := handlerActionBindings(t)
+	for _, tc := range []struct{ handler, want string }{
+		{"GetObjectRetentionHandler", "ACTION_GET_OBJECT_RETENTION"},
+		{"PutObjectRetentionHandler", "ACTION_PUT_OBJECT_RETENTION"},
+		{"GetObjectLegalHoldHandler", "ACTION_GET_OBJECT_LEGAL_HOLD"},
+		{"PutObjectLegalHoldHandler", "ACTION_PUT_OBJECT_LEGAL_HOLD"},
+		{"GetObjectLockConfigurationHandler", "ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG"},
+		{"PutObjectLockConfigurationHandler", "ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG"},
+	} {
+		if got := bindings[tc.handler]; got != tc.want {
+			t.Errorf("%s is gated on %s, want %s", tc.handler, got, tc.want)
+		}
+	}
+}
+
+func TestGovernanceBypassUsesDedicatedAuthorization(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		action  Action
+		allowed bool
+	}{
+		{"dedicated permission", Action(s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION + ":test-bucket/*"), true},
+		{"coarse write", Action(s3_constants.ACTION_WRITE + ":test-bucket/*"), false},
+		{"admin", Action(s3_constants.ACTION_ADMIN), true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			iam := newTestIAM()
+			iam.identities[0].Actions = []Action{tc.action}
+			iam.identities[0].Account = &Account{Id: "test-account"}
+			s3a := &S3ApiServer{iam: iam}
+			req := httptest.NewRequest(http.MethodDelete, "http://localhost:8333/test-bucket/test-object", nil)
+			req = mux.SetURLVars(req, map[string]string{"bucket": "test-bucket", "object": "test-object"})
+			require.NoError(t, signRawHTTPRequest(context.Background(), req,
+				"AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "us-east-1"))
+
+			if got := s3a.checkGovernanceBypassPermission(req, "test-bucket", "/test-object"); got != tc.allowed {
+				t.Errorf("checkGovernanceBypassPermission() = %v, want %v", got, tc.allowed)
+			}
+		})
+	}
+}
+
+// The bypass check authorizes against a synthetic request shaped like the
+// real one; DELETE ?versionId used to re-resolve to s3:DeleteObjectVersion,
+// so the delete-version grant silently satisfied the bypass check.
+func TestGovernanceBypassDoesNotInheritDeleteObjectVersion(t *testing.T) {
+	iam := &IdentityAccessManagement{}
+	require.NoError(t, iam.PutPolicy("DeleteVersions",
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:DeleteObject","s3:DeleteObjectVersion"],"Resource":"arn:aws:s3:::worm/*"}]}`))
+	require.NoError(t, iam.PutPolicy("BypassGovernance",
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:DeleteObject","s3:DeleteObjectVersion","s3:BypassGovernanceRetention"],"Resource":"arn:aws:s3:::worm/*"}]}`))
+	s3a := &S3ApiServer{iam: iam}
+
+	req := httptest.NewRequest(http.MethodDelete, "http://localhost:8333/worm/doc.txt?versionId=abc123", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": "worm", "object": "doc.txt"})
+
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), &Identity{
+		Name:        "deleter",
+		PolicyNames: []string{"DeleteVersions"},
+		Account:     &Account{Id: "test-account"},
+	}))
+	if s3a.checkGovernanceBypassPermission(req, "worm", "/doc.txt") {
+		t.Fatal("s3:DeleteObjectVersion alone satisfied the governance bypass check")
+	}
+
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), &Identity{
+		Name:        "breaker",
+		PolicyNames: []string{"BypassGovernance"},
+		Account:     &Account{Id: "test-account"},
+	}))
+	if !s3a.checkGovernanceBypassPermission(req, "worm", "/doc.txt") {
+		t.Fatal("s3:BypassGovernanceRetention did not satisfy the governance bypass check")
+	}
+}
+
+// The object-lock request headers on PutObject/CreateMultipartUpload must be
+// authorized as s3:PutObjectRetention / s3:PutObjectLegalHold; s3:PutObject
+// alone used to set retention and legal hold on new versions.
+func TestObjectLockHeadersRequireDedicatedActions(t *testing.T) {
+	iam := &IdentityAccessManagement{isAuthEnabled: true}
+	require.NoError(t, iam.PutPolicy("Writer",
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:PutObject"],"Resource":"arn:aws:s3:::worm/*"}]}`))
+	require.NoError(t, iam.PutPolicy("Locked",
+		`{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:PutObject","s3:PutObjectRetention","s3:PutObjectLegalHold"],"Resource":"arn:aws:s3:::worm/*"}]}`))
+	s3a := &S3ApiServer{iam: iam}
+
+	retainUntil := time.Now().Add(24 * time.Hour).Format(time.RFC3339)
+	for _, tc := range []struct {
+		name    string
+		policy  string
+		headers map[string]string
+		wantErr error
+	}{
+		{"writer sets retention", "Writer",
+			map[string]string{s3_constants.AmzObjectLockMode: "COMPLIANCE", s3_constants.AmzObjectLockRetainUntilDate: retainUntil},
+			ErrObjectLockNotAuthorized},
+		{"writer sets legal hold", "Writer",
+			map[string]string{s3_constants.AmzObjectLockLegalHold: s3_constants.LegalHoldOn},
+			ErrObjectLockNotAuthorized},
+		{"writer plain put", "Writer", nil, nil},
+		{"locked principal sets both", "Locked",
+			map[string]string{s3_constants.AmzObjectLockMode: "GOVERNANCE", s3_constants.AmzObjectLockRetainUntilDate: retainUntil, s3_constants.AmzObjectLockLegalHold: s3_constants.LegalHoldOn},
+			nil},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodPut, "http://localhost:8333/worm/doc.txt", nil)
+			req = mux.SetURLVars(req, map[string]string{"bucket": "worm", "object": "doc.txt"})
+			for k, v := range tc.headers {
+				req.Header.Set(k, v)
+			}
+			req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), &Identity{
+				Name:        "caller",
+				PolicyNames: []string{tc.policy},
+				Account:     &Account{Id: "test-account"},
+			}))
+			if err := s3a.validateObjectLockHeaders(req, "worm", "doc.txt", true); !errors.Is(err, tc.wantErr) {
+				t.Errorf("validateObjectLockHeaders() = %v, want %v", err, tc.wantErr)
+			}
+		})
+	}
+}
+
+func TestGovernanceBypassUsesBodyObjectKey(t *testing.T) {
+	iam := newTestIAM()
+	iam.identities[0].Actions = []Action{
+		Action(s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION + ":test-bucket/allowed/*"),
+	}
+	iam.identities[0].Account = &Account{Id: "test-account"}
+	s3a := &S3ApiServer{iam: iam}
+
+	req := httptest.NewRequest(http.MethodPost, "http://localhost:8333/test-bucket?delete", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": "test-bucket"})
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), iam.identities[0]))
+
+	if !s3a.checkGovernanceBypassPermission(req, "test-bucket", "allowed/object") {
+		t.Fatal("object-scoped bypass grant did not authorize a DeleteObjects body key")
+	}
+	if s3a.checkGovernanceBypassPermission(req, "test-bucket", "denied/object") {
+		t.Fatal("object-scoped bypass grant authorized a key outside its prefix")
+	}
+}
+
+func TestGovernanceBypassNormalizesBodyObjectKey(t *testing.T) {
+	iam := newTestIAM()
+	iam.identities[0].Account = &Account{Id: "test-account"}
+	s3a := &S3ApiServer{iam: iam}
+
+	req := httptest.NewRequest(http.MethodPost, "http://localhost:8333/test-bucket?delete", nil)
+	req = mux.SetURLVars(req, map[string]string{"bucket": "test-bucket"})
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), iam.identities[0]))
+
+	iam.identities[0].Actions = []Action{
+		Action(s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION + ":test-bucket/allowed/o?ject"),
+	}
+	if !s3a.checkGovernanceBypassPermission(req, "test-bucket", "//allowed//object") {
+		t.Fatal("canonical object grant did not authorize the equivalent noncanonical body key")
+	}
+
+	iam.identities[0].Actions = []Action{
+		Action(s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION + ":test-bucket/allowed//o?ject"),
+	}
+	if s3a.checkGovernanceBypassPermission(req, "test-bucket", "//allowed//object") {
+		t.Fatal("noncanonical alias grant authorized the canonical mutation target")
+	}
+}
+
+func TestCoarseReadWriteDoNotGrantObjectLockActions(t *testing.T) {
+	identity := &Identity{
+		Name: "object-reader-writer",
+		Actions: []Action{
+			Action(s3_constants.ACTION_READ + ":test-bucket"),
+			Action(s3_constants.ACTION_WRITE + ":test-bucket"),
+		},
+	}
+
+	for _, action := range []string{
+		s3_constants.ACTION_GET_OBJECT_RETENTION,
+		s3_constants.ACTION_PUT_OBJECT_RETENTION,
+		s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD,
+		s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD,
+		s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG,
+		s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG,
+		s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION,
+	} {
+		if identity.CanDo(Action(action), "test-bucket", "some/key") {
+			t.Errorf("coarse Read/Write unexpectedly granted %s", action)
+		}
+	}
+}
+
+func TestObjectLockActionsRoundTrip(t *testing.T) {
+	for _, tc := range []struct{ policyAction, identityAction string }{
+		{"GetObjectRetention", s3_constants.ACTION_GET_OBJECT_RETENTION},
+		{"PutObjectRetention", s3_constants.ACTION_PUT_OBJECT_RETENTION},
+		{"GetObjectLegalHold", s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD},
+		{"PutObjectLegalHold", s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD},
+		{"GetBucketObjectLockConfiguration", s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG},
+		{"PutBucketObjectLockConfiguration", s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG},
+		{"BypassGovernanceRetention", s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION},
+	} {
+		t.Run(tc.policyAction, func(t *testing.T) {
+			for _, action := range []string{tc.policyAction, "s3:" + tc.policyAction} {
+				if got := iamlib.MapToStatementAction(action); got != tc.identityAction {
+					t.Errorf("MapToStatementAction(%q) = %q, want %q", action, got, tc.identityAction)
+				}
+			}
+			if got := iamlib.MapToIdentitiesAction(tc.identityAction); got != tc.policyAction {
+				t.Errorf("MapToIdentitiesAction(%q) = %q, want %q", tc.identityAction, got, tc.policyAction)
+			}
+		})
+	}
+}
+
+// Anonymous misses must not disclose bucket or key existence: 404 is only
+// served when anonymous listing is allowed.
+func TestAnonymousBucketListAuthorization(t *testing.T) {
+	s3a := &S3ApiServer{iam: &IdentityAccessManagement{}, bucketConfigCache: NewBucketConfigCache(time.Minute)}
+	s3a.bucketConfigCache.Set("open", &BucketConfig{Name: "open", IsPublicRead: true})
+	s3a.bucketConfigCache.Set("private", &BucketConfig{Name: "private"})
+
+	req := httptest.NewRequest(http.MethodGet, "http://localhost:8333/open/key", nil)
+	if got := s3a.authorizeAnonymousBucketList(req, "open"); got != s3err.ErrNone {
+		t.Errorf("listable bucket: %v, want ErrNone", got)
+	}
+	if got := s3a.authorizeAnonymousBucketList(req, "private"); got != s3err.ErrAccessDenied {
+		t.Errorf("private bucket: %v, want AccessDenied", got)
+	}
+}
+
+// Internal Seaweed-X-Amz-* headers carry server-validated object lock values
+// into entry metadata; client-supplied ones must be dropped on entry or the
+// dedicated-permission check on x-amz-object-lock-* is bypassed.
+func TestInternalObjectLockHeadersStrippedOnAuth(t *testing.T) {
+	iam := newTestIAM()
+
+	internal := []string{
+		s3_constants.ExtObjectLockModeKey,
+		s3_constants.ExtRetentionUntilDateKey,
+		s3_constants.ExtLegalHoldKey,
+		s3_constants.ExtVersionIdKey,
+		s3_constants.SeaweedFSSSEKMSBaseIVHeader,
+		s3_constants.SeaweedFSSSES3BaseIVHeader,
+		s3_constants.SeaweedFSSSES3KeyDataHeader,
+	}
+	req := httptest.NewRequest(http.MethodPut, "http://localhost:8333/worm/doc.txt", nil)
+	for _, k := range internal {
+		req.Header.Set(k, "injected")
+	}
+	require.NoError(t, signRawHTTPRequest(context.Background(), req,
+		"AKIAIOSFODNN7EXAMPLE", "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "us-east-1"))
+
+	_, _, _ = iam.authenticateRequestInternal(req)
+
+	for _, k := range internal {
+		if got := req.Header.Get(k); got != "" {
+			t.Errorf("client-supplied %s survived authentication: %q", k, got)
+		}
+	}
+}
+
+// With IAM disabled the Auth wrapper calls the handler directly; internal
+// headers must still be stripped so they never reach putToFiler.
+func TestInternalHeadersStrippedWithoutAuth(t *testing.T) {
+	iam := &IdentityAccessManagement{}
+
+	internal := []string{
+		s3_constants.ExtObjectLockModeKey,
+		s3_constants.ExtRetentionUntilDateKey,
+		s3_constants.ExtLegalHoldKey,
+		s3_constants.ExtVersionIdKey,
+		s3_constants.SeaweedFSSSEKMSBaseIVHeader,
+		s3_constants.SeaweedFSSSES3BaseIVHeader,
+		s3_constants.SeaweedFSSSES3KeyDataHeader,
+	}
+	var leaked []string
+	handler := iam.Auth(func(w http.ResponseWriter, r *http.Request) {
+		for _, k := range internal {
+			if v := r.Header.Get(k); v != "" {
+				leaked = append(leaked, k)
+			}
+		}
+	}, s3_constants.ACTION_WRITE)
+
+	req := httptest.NewRequest(http.MethodPut, "http://localhost:8333/worm/doc.txt", nil)
+	for _, k := range internal {
+		req.Header.Set(k, "injected")
+	}
+	handler(httptest.NewRecorder(), req)
+	if len(leaked) > 0 {
+		t.Errorf("client-supplied internal headers reached handler with auth disabled: %v", leaked)
+	}
+}
diff --git a/weed/s3api/s3api_object_lock_authz_test.go b/weed/s3api/s3api_object_lock_authz_test.go
new file mode 100644
index 0000000000..1f287b051b
--- /dev/null
+++ b/weed/s3api/s3api_object_lock_authz_test.go
@@ -0,0 +1,57 @@
+package s3api
+
+import (
+	"testing"
+
+	iamlib "github.com/seaweedfs/seaweedfs/weed/iam"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+)
+
+func TestPutObjectLockConfigurationUsesDedicatedAction(t *testing.T) {
+	bindings := handlerActionBindings(t)
+	if got := bindings["PutObjectLockConfigurationHandler"]; got != "ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG" {
+		t.Fatalf("PutObjectLockConfigurationHandler is gated on %s, want ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG", got)
+	}
+}
+
+func TestObjectWriteDoesNotAllowPutObjectLockConfiguration(t *testing.T) {
+	objectWriter := &Identity{
+		Name:    "object-writer",
+		Actions: []Action{Action(s3_constants.ACTION_WRITE + ":test-bucket")},
+	}
+
+	if !objectWriter.CanDo(s3_constants.ACTION_WRITE, "test-bucket", "some/key") {
+		t.Fatal("precondition failed: the identity should be able to write objects")
+	}
+	if objectWriter.CanDo(s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG, "test-bucket", "") {
+		t.Fatal("an object writer was allowed to change the bucket Object Lock configuration")
+	}
+
+	lockManager := &Identity{
+		Name: "lock-manager",
+		Actions: []Action{
+			Action(s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG + ":test-bucket"),
+		},
+	}
+	if !lockManager.CanDo(s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG, "test-bucket", "") {
+		t.Fatal("an explicitly delegated identity was denied permission to change the bucket Object Lock configuration")
+	}
+}
+
+func TestPutObjectLockConfigurationActionRoundTrips(t *testing.T) {
+	for _, policyAction := range []string{
+		"s3:PutBucketObjectLockConfiguration",
+		"PutBucketObjectLockConfiguration",
+	} {
+		if got := iamlib.MapToStatementAction(policyAction); got != s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG {
+			t.Errorf("MapToStatementAction(%q) = %q, want %q", policyAction, got, s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG)
+		}
+	}
+
+	if got := iamlib.MapToIdentitiesAction(s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG); got != "PutBucketObjectLockConfiguration" {
+		t.Errorf("MapToIdentitiesAction(%q) = %q, want PutBucketObjectLockConfiguration", s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG, got)
+	}
+	if got := mapBaseActionToS3Format(s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG); got != s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK {
+		t.Errorf("mapBaseActionToS3Format(%q) = %q, want %q", s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG, got, s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK)
+	}
+}
diff --git a/weed/s3api/s3api_object_lock_fix_test.go b/weed/s3api/s3api_object_lock_fix_test.go
index 492564e646..cc58a90ab7 100644
--- a/weed/s3api/s3api_object_lock_fix_test.go
+++ b/weed/s3api/s3api_object_lock_fix_test.go
@@ -79,3 +79,20 @@ func TestVeeamObjectLockBugFix(t *testing.T) {
 		assert.True(t, enabled, "Object Lock should be enabled when constant is used")
 	})
 }
+
+// Copied objects get their own retention from the request or the destination
+// bucket's default; the source's lock keys never carry into the destination
+// entry.
+func TestCopyDoesNotInheritLockKeys(t *testing.T) {
+	// The destination-Extended copy loop filters on isCopyLockKey, so
+	// retention and legal hold never carry over from the source entry.
+	for _, key := range []string{
+		s3_constants.ExtObjectLockModeKey,
+		s3_constants.ExtRetentionUntilDateKey,
+		s3_constants.ExtLegalHoldKey,
+	} {
+		assert.True(t, isCopyLockKey(key), "%s must be filtered from a copy destination", key)
+	}
+	assert.False(t, isCopyLockKey(s3_constants.ExtAmzOwnerKey))
+	assert.False(t, isCopyLockKey("custom-key"))
+}
diff --git a/weed/s3api/s3api_object_lock_headers_test.go b/weed/s3api/s3api_object_lock_headers_test.go
index fc8a01232a..fed8355236 100644
--- a/weed/s3api/s3api_object_lock_headers_test.go
+++ b/weed/s3api/s3api_object_lock_headers_test.go
@@ -410,7 +410,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.NoError(t, err)
 	})
 
@@ -420,7 +420,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.NoError(t, err)
 	})
 
@@ -428,7 +428,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req := httptest.NewRequest("PUT", "/bucket/object", nil)
 		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.NoError(t, err)
 	})
 
@@ -436,7 +436,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req := httptest.NewRequest("PUT", "/bucket/object", nil)
 		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "OFF")
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.NoError(t, err)
 	})
 
@@ -446,7 +446,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		retainUntilDate := time.Now().Add(24 * time.Hour)
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrInvalidObjectLockMode))
 	})
@@ -455,7 +455,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req := httptest.NewRequest("PUT", "/bucket/object", nil)
 		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "INVALID_STATUS")
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrInvalidLegalHoldStatus))
 	})
@@ -466,7 +466,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		retainUntilDate := time.Now().Add(24 * time.Hour)
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
 
-		err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", false) // non-versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrObjectLockVersioningRequired))
 	})
@@ -476,7 +476,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, "invalid-date-format")
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrInvalidRetentionDateFormat))
 	})
@@ -487,7 +487,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		pastDate := time.Now().Add(-24 * time.Hour)
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, pastDate.Format(time.RFC3339))
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrRetentionDateMustBeFuture))
 	})
@@ -496,7 +496,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req := httptest.NewRequest("PUT", "/bucket/object", nil)
 		req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrObjectLockModeRequiresDate))
 	})
@@ -506,7 +506,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		retainUntilDate := time.Now().Add(24 * time.Hour)
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrRetentionDateRequiresMode))
 	})
@@ -515,7 +515,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req := httptest.NewRequest("PUT", "/bucket/object", nil)
 		req.Header.Set("x-amz-bypass-governance-retention", "true")
 
-		err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", false) // non-versioned bucket
 		assert.Error(t, err)
 		assert.True(t, errors.Is(err, ErrGovernanceBypassVersioningRequired))
 	})
@@ -524,7 +524,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req := httptest.NewRequest("PUT", "/bucket/object", nil)
 		req.Header.Set("x-amz-bypass-governance-retention", "true")
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.NoError(t, err)
 	})
 
@@ -532,7 +532,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req := httptest.NewRequest("PUT", "/bucket/object", nil)
 		// No object lock headers set
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.NoError(t, err)
 	})
 
@@ -543,7 +543,7 @@ func TestValidateObjectLockHeaders(t *testing.T) {
 		req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
 		req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
 
-		err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
+		err := s3a.validateObjectLockHeaders(req, "bucket", "object", true) // versioned bucket
 		assert.NoError(t, err)
 	})
 }
diff --git a/weed/s3api/s3api_object_part_number_test.go b/weed/s3api/s3api_object_part_number_test.go
new file mode 100644
index 0000000000..1e125cb6cc
--- /dev/null
+++ b/weed/s3api/s3api_object_part_number_test.go
@@ -0,0 +1,142 @@
+package s3api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	part1Size = 5 * 1024 * 1024
+	part2Size = 3 * 1024 * 1024
+)
+
+func TestRequestedPartNumber(t *testing.T) {
+	for query, want := range map[string]int{
+		"":                 0,
+		"partNumber=1":     1,
+		"PartNumber=2":     2,
+		"partNumber=0":     0,
+		"partNumber=-1":    0,
+		"partNumber=abc":   0,
+		"versionId=v1":     0,
+		"partNumber=2&x=1": 2,
+	} {
+		r := httptest.NewRequest(http.MethodHead, "/bucket/object?"+query, nil)
+		assert.Equal(t, want, requestedPartNumber(r), "query %q", query)
+	}
+}
+
+// twoPartEntry models a 2-part multipart object of part1Size + part2Size bytes.
+func twoPartEntry(t *testing.T, withBoundaries bool) *filer_pb.Entry {
+	t.Helper()
+	entry := &filer_pb.Entry{
+		Attributes: &filer_pb.FuseAttributes{FileSize: part1Size + part2Size},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: "1,a", Offset: 0, Size: part1Size},
+			{FileId: "1,b", Offset: part1Size, Size: part2Size},
+		},
+		Extended: map[string][]byte{
+			s3_constants.SeaweedFSMultipartPartsCount: []byte("2"),
+		},
+	}
+	if withBoundaries {
+		boundaries, err := json.Marshal([]PartBoundaryInfo{
+			{PartNumber: 1, StartChunk: 0, EndChunk: 1, StartOffset: 0, EndOffset: part1Size},
+			{PartNumber: 2, StartChunk: 1, EndChunk: 2, StartOffset: part1Size, EndOffset: part1Size + part2Size},
+		})
+		require.NoError(t, err)
+		entry.Extended[s3_constants.SeaweedFSMultipartPartBoundaries] = boundaries
+	}
+	return entry
+}
+
+// partRequest is a HEAD of partNumber, optionally narrowed by a client Range.
+func partRequest(rangeHeader string) *http.Request {
+	r := httptest.NewRequest(http.MethodHead, "/bucket/object", nil)
+	if rangeHeader != "" {
+		r.Header.Set("Range", rangeHeader)
+	}
+	return r
+}
+
+func TestPartByteRange(t *testing.T) {
+	s3a := &S3ApiServer{}
+
+	for _, withBoundaries := range []bool{true, false} {
+		entry := twoPartEntry(t, withBoundaries)
+
+		w := httptest.NewRecorder()
+		start, end, errCode := s3a.partByteRange(w, partRequest(""), entry, 1)
+		assert.Equal(t, s3err.ErrNone, errCode)
+		assert.Equal(t, int64(0), start)
+		assert.Equal(t, int64(part1Size-1), end)
+		assert.Equal(t, "2", w.Header().Get(s3_constants.AmzMpPartsCount))
+
+		w = httptest.NewRecorder()
+		start, end, errCode = s3a.partByteRange(w, partRequest(""), entry, 2)
+		assert.Equal(t, s3err.ErrNone, errCode)
+		assert.Equal(t, int64(part1Size), start)
+		assert.Equal(t, int64(part1Size+part2Size-1), end)
+
+		// A client Range applies within the selected part
+		w = httptest.NewRecorder()
+		start, end, errCode = s3a.partByteRange(w, partRequest("bytes=0-1023"), entry, 2)
+		assert.Equal(t, s3err.ErrNone, errCode)
+		assert.Equal(t, int64(part1Size), start)
+		assert.Equal(t, int64(part1Size+1023), end)
+
+		w = httptest.NewRecorder()
+		_, _, errCode = s3a.partByteRange(w, partRequest(""), entry, 3)
+		assert.Equal(t, s3err.ErrInvalidPartNumber, errCode, "part beyond the object must not resolve")
+	}
+
+	// AWS answers an unsatisfiable partNumber with 416, not 400.
+	assert.Equal(t, http.StatusRequestedRangeNotSatisfiable, s3err.GetAPIError(s3err.ErrInvalidPartNumber).HTTPStatusCode)
+}
+
+// Completion accepts ascending, not consecutive, part numbers.
+func TestPartByteRangeSparsePartNumbers(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := twoPartEntry(t, true)
+	boundaries, err := json.Marshal([]PartBoundaryInfo{
+		{PartNumber: 1, StartChunk: 0, EndChunk: 1, StartOffset: 0, EndOffset: part1Size},
+		{PartNumber: 3, StartChunk: 1, EndChunk: 2, StartOffset: part1Size, EndOffset: part1Size + part2Size},
+	})
+	require.NoError(t, err)
+	entry.Extended[s3_constants.SeaweedFSMultipartPartBoundaries] = boundaries
+
+	start, end, errCode := s3a.partByteRange(httptest.NewRecorder(), partRequest(""), entry, 3)
+	assert.Equal(t, s3err.ErrNone, errCode, "the uploaded part 3 must resolve")
+	assert.Equal(t, int64(part1Size), start)
+	assert.Equal(t, int64(part1Size+part2Size-1), end)
+
+	_, _, errCode = s3a.partByteRange(httptest.NewRecorder(), partRequest(""), entry, 2)
+	assert.Equal(t, s3err.ErrInvalidPartNumber, errCode, "part 2 was never uploaded")
+}
+
+// The stored checksum covers the whole object, so a part response must not carry it.
+func TestSetResponseHeadersSkipsChecksumForPart(t *testing.T) {
+	s3a := &S3ApiServer{}
+	entry := twoPartEntry(t, true)
+	entry.Extended[s3_constants.ExtChecksumAlgorithm] = []byte("x-amz-checksum-crc32")
+	entry.Extended[s3_constants.ExtChecksumValue] = []byte("AAAAAA==")
+
+	for query, want := range map[string]string{
+		"":             "AAAAAA==",
+		"partNumber=1": "",
+	} {
+		r := httptest.NewRequest(http.MethodHead, "/bucket/object?"+query, nil)
+		r.Header.Set("X-Amz-Checksum-Mode", "ENABLED")
+		w := httptest.NewRecorder()
+		s3a.setResponseHeaders(w, r, entry, part1Size)
+		assert.Equal(t, want, w.Header().Get("x-amz-checksum-crc32"), "query %q", query)
+	}
+}
diff --git a/weed/s3api/s3api_object_range_test.go b/weed/s3api/s3api_object_range_test.go
index ced294148e..40ccb8768b 100644
--- a/weed/s3api/s3api_object_range_test.go
+++ b/weed/s3api/s3api_object_range_test.go
@@ -40,3 +40,33 @@ func TestParseAndValidateRangeRejectsMalformedNumericOffsets(t *testing.T) {
 		})
 	}
 }
+
+func TestHeadObjectRange(t *testing.T) {
+	s3a, f := newAnonymousReadTestServer(t)
+	f.entries["/buckets/b/o"] = anonymousReadEntry(anonymousReadGrant("READ"))
+	for _, tc := range []struct {
+		rangeHeader, contentRange, contentLength string
+		code                                     int
+	}{
+		{"", "", "11", http.StatusOK},
+		{"bytes=1-4", "bytes 1-4/11", "4", http.StatusPartialContent},
+		{"bytes=-3", "bytes 8-10/11", "3", http.StatusPartialContent},
+		{"bytes=5-", "bytes 5-10/11", "6", http.StatusPartialContent},
+		{"bytes=20-", "bytes */11", "", http.StatusRequestedRangeNotSatisfiable},
+	} {
+		headers := map[string]string{}
+		if tc.rangeHeader != "" {
+			headers["Range"] = tc.rangeHeader
+		}
+		rr := serveAnonymousRead(s3a, http.MethodHead, "o", "", headers)
+		if rr.Code != tc.code {
+			t.Errorf("Range %q: status %d, want %d", tc.rangeHeader, rr.Code, tc.code)
+		}
+		if got := rr.Header().Get("Content-Range"); got != tc.contentRange {
+			t.Errorf("Range %q: Content-Range %q, want %q", tc.rangeHeader, got, tc.contentRange)
+		}
+		if got := rr.Header().Get("Content-Length"); tc.contentLength != "" && got != tc.contentLength {
+			t.Errorf("Range %q: Content-Length %q, want %q", tc.rangeHeader, got, tc.contentLength)
+		}
+	}
+}
diff --git a/weed/s3api/s3api_object_retention.go b/weed/s3api/s3api_object_retention.go
index 42e18b9af8..53f92f3574 100644
--- a/weed/s3api/s3api_object_retention.go
+++ b/weed/s3api/s3api_object_retention.go
@@ -6,13 +6,13 @@ import (
 	"fmt"
 	"net/http"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 // ====================================================================
@@ -214,6 +214,49 @@ func (s3a *S3ApiServer) getObjectEntry(bucket, object, versionId string) (*filer
 	return entry, nil
 }
 
+// getObjectEntryForUpdate resolves the entry a metadata update targets and the
+// filer path it is written under. It applies the same version resolution as
+// getSpecificObjectVersion - "null" names the plain pre-versioning entry, not a
+// .versions file - so the write lands on the entry that was read.
+func (s3a *S3ApiServer) getObjectEntryForUpdate(bucket, object, versionId string) (entry *filer_pb.Entry, entryPath string, err error) {
+	entryPath = object
+	if versionId != "" {
+		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
+		if err != nil {
+			return nil, "", fmt.Errorf("failed to get version %s for object %s/%s: %w", versionId, bucket, object, ErrVersionNotFound)
+		}
+		if versionId != "null" {
+			entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
+		}
+		return entry, entryPath, nil
+	}
+
+	versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
+	if vErr != nil {
+		return nil, "", fmt.Errorf("error checking versioning: %w", vErr)
+	}
+	if !versioningEnabled {
+		entry, err = s3a.fetchObjectEntryRequired(bucket, object)
+		if err != nil {
+			return nil, "", fmt.Errorf("failed to get object %s/%s: %w", bucket, object, ErrObjectNotFound)
+		}
+		return entry, entryPath, nil
+	}
+
+	entry, err = s3a.getLatestObjectVersion(bucket, object)
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to get latest version for object %s/%s: %w", bucket, object, ErrLatestVersionNotFound)
+	}
+	if entry.Extended != nil {
+		if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
+			if storedVersionId := string(versionIdBytes); storedVersionId != "null" && isValidVersionID(storedVersionId) {
+				entryPath = object + ".versions/" + s3a.getVersionFileName(storedVersionId)
+			}
+		}
+	}
+	return entry, entryPath, nil
+}
+
 // ====================================================================
 // RETENTION OPERATIONS
 // ====================================================================
@@ -255,45 +298,9 @@ func (s3a *S3ApiServer) getObjectRetention(bucket, object, versionId string) (*O
 
 // setObjectRetention sets object retention configuration
 func (s3a *S3ApiServer) setObjectRetention(bucket, object, versionId string, retention *ObjectRetention, bypassGovernance bool) error {
-	var entry *filer_pb.Entry
-	var err error
-	var entryPath string
-
-	if versionId != "" {
-		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
-		if err != nil {
-			return fmt.Errorf("failed to get version %s for object %s/%s: %w", versionId, bucket, object, ErrVersionNotFound)
-		}
-		entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
-	} else {
-		// Check if versioning is enabled
-		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
-		if vErr != nil {
-			return fmt.Errorf("error checking versioning: %w", vErr)
-		}
-
-		if versioningEnabled {
-			entry, err = s3a.getLatestObjectVersion(bucket, object)
-			if err != nil {
-				return fmt.Errorf("failed to get latest version for object %s/%s: %w", bucket, object, ErrLatestVersionNotFound)
-			}
-			// Extract version ID from entry metadata
-			entryPath = object // default to regular object path
-			if entry.Extended != nil {
-				if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
-					versionId = string(versionIdBytes)
-					if versionId != "null" {
-						entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
-					}
-				}
-			}
-		} else {
-			entry, err = s3a.fetchObjectEntryRequired(bucket, object)
-			if err != nil {
-				return fmt.Errorf("failed to get object %s/%s: %w", bucket, object, ErrObjectNotFound)
-			}
-			entryPath = object
-		}
+	entry, entryPath, err := s3a.getObjectEntryForUpdate(bucket, object, versionId)
+	if err != nil {
+		return err
 	}
 
 	// Check if object is already under retention
@@ -354,18 +361,15 @@ func (s3a *S3ApiServer) setObjectRetention(bucket, object, versionId string, ret
 		entry.WormEnforcedAtTsNs = time.Now().UnixNano()
 	}
 
-	// Update the entry
+	// Update the entry in place. UpdateEntry persists the whole fetched entry, so
+	// attributes, inline content, and remote references survive the metadata change
+	// where mkFile's fresh entry would drop them.
 	// NOTE: Potential race condition exists if concurrent calls to PutObjectRetention
 	// and PutObjectLegalHold update the same object simultaneously, as they might
-	// overwrite each other's Extended map changes. This is mitigated by the fact
-	// that mkFile operations are typically serialized at the filer level, but
-	// future implementations might consider using atomic update operations or
-	// entry-level locking for complete safety.
-	bucketDir := s3a.bucketDir(bucket)
-	return s3a.mkFile(bucketDir, entryPath, entry.Chunks, func(updatedEntry *filer_pb.Entry) {
-		updatedEntry.Extended = entry.Extended
-		updatedEntry.WormEnforcedAtTsNs = entry.WormEnforcedAtTsNs
-	})
+	// overwrite each other's Extended map changes.
+	dir, name := util.NewFullPath(s3a.bucketDir(bucket), entryPath).DirAndName()
+	entry.Name = name
+	return s3a.updateEntry(dir, entry)
 }
 
 // ====================================================================
@@ -398,45 +402,9 @@ func (s3a *S3ApiServer) getObjectLegalHold(bucket, object, versionId string) (*O
 
 // setObjectLegalHold sets object legal hold configuration
 func (s3a *S3ApiServer) setObjectLegalHold(bucket, object, versionId string, legalHold *ObjectLegalHold) error {
-	var entry *filer_pb.Entry
-	var err error
-	var entryPath string
-
-	if versionId != "" {
-		entry, err = s3a.getSpecificObjectVersion(bucket, object, versionId)
-		if err != nil {
-			return fmt.Errorf("failed to get version %s for object %s/%s: %w", versionId, bucket, object, ErrVersionNotFound)
-		}
-		entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
-	} else {
-		// Check if versioning is enabled
-		versioningEnabled, vErr := s3a.isVersioningEnabled(bucket)
-		if vErr != nil {
-			return fmt.Errorf("error checking versioning: %w", vErr)
-		}
-
-		if versioningEnabled {
-			entry, err = s3a.getLatestObjectVersion(bucket, object)
-			if err != nil {
-				return fmt.Errorf("failed to get latest version for object %s/%s: %w", bucket, object, ErrLatestVersionNotFound)
-			}
-			// Extract version ID from entry metadata
-			entryPath = object // default to regular object path
-			if entry.Extended != nil {
-				if versionIdBytes, exists := entry.Extended[s3_constants.ExtVersionIdKey]; exists {
-					versionId = string(versionIdBytes)
-					if versionId != "null" {
-						entryPath = object + ".versions/" + s3a.getVersionFileName(versionId)
-					}
-				}
-			}
-		} else {
-			entry, err = s3a.fetchObjectEntryRequired(bucket, object)
-			if err != nil {
-				return fmt.Errorf("failed to get object %s/%s: %w", bucket, object, ErrObjectNotFound)
-			}
-			entryPath = object
-		}
+	entry, entryPath, err := s3a.getObjectEntryForUpdate(bucket, object, versionId)
+	if err != nil {
+		return err
 	}
 
 	// Update legal hold metadata
@@ -446,17 +414,9 @@ func (s3a *S3ApiServer) setObjectLegalHold(bucket, object, versionId string, leg
 
 	entry.Extended[s3_constants.ExtLegalHoldKey] = []byte(legalHold.Status)
 
-	// Update the entry
-	// NOTE: Potential race condition exists if concurrent calls to PutObjectRetention
-	// and PutObjectLegalHold update the same object simultaneously, as they might
-	// overwrite each other's Extended map changes. This is mitigated by the fact
-	// that mkFile operations are typically serialized at the filer level, but
-	// future implementations might consider using atomic update operations or
-	// entry-level locking for complete safety.
-	bucketDir := s3a.bucketDir(bucket)
-	return s3a.mkFile(bucketDir, entryPath, entry.Chunks, func(updatedEntry *filer_pb.Entry) {
-		updatedEntry.Extended = entry.Extended
-	})
+	dir, name := util.NewFullPath(s3a.bucketDir(bucket), entryPath).DirAndName()
+	entry.Name = name
+	return s3a.updateEntry(dir, entry)
 }
 
 // ====================================================================
@@ -517,33 +477,26 @@ func (s3a *S3ApiServer) getLegalHoldFromEntry(entry *filer_pb.Entry) (*ObjectLeg
 
 // checkGovernanceBypassPermission checks if user has permission to bypass governance retention
 func (s3a *S3ApiServer) checkGovernanceBypassPermission(request *http.Request, bucket, object string) bool {
-	// Use the existing IAM auth system to check the specific permission
-	// Create the governance bypass action with proper bucket/object concatenation
-	// Note: path.Join would drop bucket if object has leading slash, so use explicit formatting
-	resource := fmt.Sprintf("%s/%s", bucket, strings.TrimPrefix(object, "/"))
-	action := Action(fmt.Sprintf("%s:%s", s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, resource))
+	identity, _ := s3_constants.GetIdentityFromContext(request).(*Identity)
+	if identity == nil {
+		// Most handlers arrive through Auth and carry the authenticated identity
+		// in context. Keep direct callers correct without authorizing against the
+		// request URL, which is bucket-only for DeleteObjects.
+		var errCode s3err.ErrorCode
+		identity, errCode, _ = s3a.iam.authenticateRequestInternal(request)
+		if errCode != s3err.ErrNone {
+			glog.V(3).Infof("IAM authentication failed for governance bypass: %v", errCode)
+			return false
+		}
+	}
 
-	// Use the IAM system to authenticate and authorize this specific action
-	identity, errCode := s3a.iam.authRequest(request, action)
+	errCode := s3a.iam.authorizeObjectKeyAction(request, identity, request.Method,
+		s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, bucket, s3_constants.NormalizeObjectKey(object), request.URL.Query().Get("versionId"))
 	if errCode != s3err.ErrNone {
-		glog.V(3).Infof("IAM auth failed for governance bypass: %v", errCode)
+		glog.V(3).Infof("IAM authorization failed for governance bypass on %s/%s: %v", bucket, object, errCode)
 		return false
 	}
-
-	// Verify that the authenticated identity can perform this action
-	if identity != nil && identity.CanDo(action, bucket, object) {
-		return true
-	}
-
-	// Additional check: allow users with Admin action to bypass governance retention
-	// Use the proper S3 Admin action constant instead of generic isAdmin() method
-	adminAction := Action(fmt.Sprintf("%s:%s", s3_constants.ACTION_ADMIN, resource))
-	if identity != nil && identity.CanDo(adminAction, bucket, object) {
-		glog.V(2).Infof("Admin user %s granted governance bypass permission for %s/%s", identity.Name, bucket, object)
-		return true
-	}
-
-	return false
+	return true
 }
 
 // evaluateGovernanceBypassRequest evaluates if governance bypass is requested and permitted
@@ -608,14 +561,20 @@ func (s3a *S3ApiServer) enforceObjectLockProtections(request *http.Request, buck
 		return err
 	}
 
-	// Extract retention information from the entry
+	return s3a.enforceObjectLockOnEntry(entry, bucket, object, versionId, governanceBypassAllowed)
+}
+
+// enforceObjectLockOnEntry reports whether a lock recorded on an entry stops the
+// operation. Callers holding the entry already -- one reached without a version id
+// of its own, or the one a write is about to replace -- use it directly, so that
+// the decision lives in one place.
+func (s3a *S3ApiServer) enforceObjectLockOnEntry(entry *filer_pb.Entry, bucket, object, versionId string, governanceBypassAllowed bool) error {
 	retention, retentionActive, err := s3a.getRetentionFromEntry(entry)
 	if err != nil {
 		glog.Warningf("Error parsing retention for %s/%s (versionId: %s): %v", bucket, object, versionId, err)
 		// Continue with legal hold check even if retention parsing fails
 	}
 
-	// Extract legal hold information from the entry
 	_, legalHoldActive, err := s3a.getLegalHoldFromEntry(entry)
 	if err != nil {
 		glog.Warningf("Error parsing legal hold for %s/%s (versionId: %s): %v", bucket, object, versionId, err)
diff --git a/weed/s3api/s3api_object_retention_test.go b/weed/s3api/s3api_object_retention_test.go
index 44089deb33..201d471658 100644
--- a/weed/s3api/s3api_object_retention_test.go
+++ b/weed/s3api/s3api_object_retention_test.go
@@ -1,15 +1,23 @@
 package s3api
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"net/http"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 )
 
 func TestValidateRetention(t *testing.T) {
@@ -857,3 +865,95 @@ func TestStoreObjectLockConfigurationClearsStaleYears(t *testing.T) {
 func timePtr(t time.Time) *time.Time {
 	return &t
 }
+
+// retentionTestFiler serves the two filer calls a lock write needs: the lookup
+// that resolves the version and the update that persists the modified entry.
+type retentionTestFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+
+	mu      sync.Mutex
+	entries map[string]*filer_pb.Entry
+	updates []string
+}
+
+func (f *retentionTestFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if entry, ok := f.entries[req.Directory+"/"+req.Name]; ok {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: proto.Clone(entry).(*filer_pb.Entry)}, nil
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{}, nil
+}
+
+func (f *retentionTestFiler) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.updates = append(f.updates, req.Directory+"/"+req.Entry.Name)
+	f.entries[req.Directory+"/"+req.Entry.Name] = req.Entry
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+func newRetentionTestServer(t *testing.T, f *retentionTestFiler) *S3ApiServer {
+	t.Helper()
+	addr := startFakeFiler(t, f)
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	return &S3ApiServer{
+		option: &S3ApiServerOption{
+			Filers:         []pb.ServerAddress{addr},
+			GrpcDialOption: dialOption,
+			BucketsPath:    "/buckets",
+		},
+		filerClient: wdclient.NewFilerClient([]pb.ServerAddress{addr}, dialOption, ""),
+	}
+}
+
+// A "null" version id resolves to the pre-versioning entry under the plain
+// object key, the same place getSpecificObjectVersion reads it from. Writing
+// the lock under .versions/v_null leaves the real entry unlocked.
+func TestNullVersionLockWritesToPlainEntry(t *testing.T) {
+	f := &retentionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/buckets/b/key": {
+			Name:    "key",
+			Chunks:  []*filer_pb.FileChunk{{FileId: "1,0000000000000001"}},
+			Content: []byte("inline"),
+			Attributes: &filer_pb.FuseAttributes{
+				Mime: "text/plain",
+				Md5:  []byte("etagmd5"),
+			},
+			Extended: map[string][]byte{
+				"ETag": []byte("\"etagmd5\""),
+			},
+		},
+	}}
+	s3a := newRetentionTestServer(t, f)
+
+	retainUntil := time.Now().Add(24 * time.Hour).Truncate(time.Second)
+	err := s3a.setObjectRetention("b", "key", "null", &ObjectRetention{
+		Mode:            s3_constants.RetentionModeCompliance,
+		RetainUntilDate: &retainUntil,
+	}, false)
+	if err != nil {
+		t.Fatalf("setObjectRetention: %v", err)
+	}
+	if len(f.updates) != 1 || f.updates[0] != "/buckets/b/key" {
+		t.Fatalf("retention write landed on %v, want /buckets/b/key", f.updates)
+	}
+	updated := f.entries["/buckets/b/key"]
+	if got := string(updated.Extended[s3_constants.ExtObjectLockModeKey]); got != s3_constants.RetentionModeCompliance {
+		t.Fatalf("plain entry lock mode = %q, want COMPLIANCE", got)
+	}
+	if updated.Attributes.Mime != "text/plain" || len(updated.Content) == 0 || len(updated.Chunks) != 1 || string(updated.Extended["ETag"]) != "\"etagmd5\"" {
+		t.Fatalf("lock write dropped entry fields: %+v", updated)
+	}
+
+	f.updates = nil
+	if err := s3a.setObjectLegalHold("b", "key", "null", &ObjectLegalHold{Status: "ON"}); err != nil {
+		t.Fatalf("setObjectLegalHold: %v", err)
+	}
+	if len(f.updates) != 1 || f.updates[0] != "/buckets/b/key" {
+		t.Fatalf("legal hold write landed on %v, want /buckets/b/key", f.updates)
+	}
+	if got := string(f.entries["/buckets/b/key"].Extended[s3_constants.ExtLegalHoldKey]); got != "ON" {
+		t.Fatalf("plain entry legal hold = %q, want ON", got)
+	}
+}
diff --git a/weed/s3api/s3api_object_routed_read.go b/weed/s3api/s3api_object_routed_read.go
index 3bfff77b96..f267478794 100644
--- a/weed/s3api/s3api_object_routed_read.go
+++ b/weed/s3api/s3api_object_routed_read.go
@@ -38,7 +38,7 @@ func (s3a *S3ApiServer) getObjectEntryRoutedByKey(bucket, object string) (*filer
 
 	dir, name := fullPath.DirAndName()
 	var entry *filer_pb.Entry
-	err := s3a.withFilerClientFailover(preferred, false, func(client filer_pb.SeaweedFilerClient) error {
+	err := s3a.withFilerClientFailover(context.Background(), preferred, false, true, func(client filer_pb.SeaweedFilerClient) error {
 		resp, lookupErr := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
 			Directory: dir,
 			Name:      name,
@@ -54,7 +54,7 @@ func (s3a *S3ApiServer) getObjectEntryRoutedByKey(bucket, object string) (*filer
 	// prior owner once while the ring change is within the cooling-off window.
 	if errors.Is(err, filer_pb.ErrNotFound) {
 		if prior := s3a.priorWriteOwner(bucket, object); prior != "" && prior != owner {
-			if priorEntry, priorErr := s3a.lookupEntryOnFiler(prior, dir, name); priorErr == nil {
+			if priorEntry, priorErr := s3a.lookupEntryOnFiler(context.Background(), prior, dir, name); priorErr == nil {
 				return priorEntry, nil
 			}
 		}
@@ -87,14 +87,14 @@ func (s3a *S3ApiServer) lookupEntryPreferringOwner(owner pb.ServerAddress, dir,
 	if owner == "" {
 		return s3a.getEntry(dir, name)
 	}
-	return s3a.lookupEntryOnFiler(owner, dir, name)
+	return s3a.lookupEntryOnFiler(context.Background(), owner, dir, name)
 }
 
 // lookupEntryOnFiler resolves dir/name against a single filer, without failover.
-func (s3a *S3ApiServer) lookupEntryOnFiler(filer pb.ServerAddress, dir, name string) (*filer_pb.Entry, error) {
+func (s3a *S3ApiServer) lookupEntryOnFiler(ctx context.Context, filer pb.ServerAddress, dir, name string) (*filer_pb.Entry, error) {
 	var entry *filer_pb.Entry
 	err := pb.WithFilerClient(false, 0, filer, s3a.option.GrpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
-		resp, lookupErr := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{
+		resp, lookupErr := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
 			Directory: dir,
 			Name:      name,
 		})
diff --git a/weed/s3api/s3api_object_routed_write.go b/weed/s3api/s3api_object_routed_write.go
index 5adf732b4f..27c5188423 100644
--- a/weed/s3api/s3api_object_routed_write.go
+++ b/weed/s3api/s3api_object_routed_write.go
@@ -2,23 +2,27 @@ package s3api
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"path"
 	"strings"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 // objectWriteRouteKeyPrefix namespaces an object's full path into the ring key
 // used to resolve and forward its writes. Shared by every routed builder so the
-// gateway and filer hash the same key.
-const objectWriteRouteKeyPrefix = "s3.object.write:"
+// gateway, the admin dashboard and the filer hash the same key.
+const objectWriteRouteKeyPrefix = s3_constants.ObjectWriteRouteKeyPrefix
 
 // objectRouteKey is the ring key the gateway hashes to resolve an object's owner
 // filer. It is also sent as route_key on each routed transaction, so a non-owner
@@ -153,7 +157,16 @@ func singleStrongETag(v string) (string, bool) {
 // restarted filer's stale ring address (e.g. a rolled K8s pod's old IP) can't hang
 // the write. The reached filer forwards to the real owner by route_key, keeping its
 // per-path lock authoritative. Mirrors getObjectEntryRoutedByKey on the read path.
+// The transaction is not replayable: it fails over only over a channel that
+// never came up, never past a possibly-committed attempt — a lost response is
+// ambiguous and re-sending could re-apply mutations over a write that landed in
+// between. The caller resolves that ambiguity (e.g. createAfterAmbiguousRoute).
 func (s3a *S3ApiServer) objectTxnOnFiler(owner pb.ServerAddress, req *filer_pb.ObjectTransactionRequest) (*filer_pb.ObjectTransactionResponse, error) {
+	// One id per logical transaction: failover retries reuse it so the owner
+	// replays the recorded outcome instead of re-applying the mutations.
+	if req.RequestId == "" {
+		req.RequestId = uuid.NewString()
+	}
 	var resp *filer_pb.ObjectTransactionResponse
 	txn := func(client filer_pb.SeaweedFilerClient) error {
 		var e error
@@ -170,7 +183,7 @@ func (s3a *S3ApiServer) objectTxnOnFiler(owner pb.ServerAddress, req *filer_pb.O
 	if s3a.ownerRecentlyUnreachable(owner) {
 		preferred = ""
 	}
-	err := s3a.withFilerClientFailover(preferred, false, txn)
+	err := s3a.withFilerClientFailover(context.Background(), preferred, false, false, txn)
 	return resp, err
 }
 
@@ -180,7 +193,7 @@ func (s3a *S3ApiServer) objectTxnOnFiler(owner pb.ServerAddress, req *filer_pb.O
 // object path plus a RECOMPUTE_LATEST finalize, so the version's PUT and its
 // .versions pointer flip commit atomically (the recompute scans .versions/ after
 // the PUT and sees the new version).
-func (s3a *S3ApiServer) routedPut(owner pb.ServerAddress, routeKey, lockKey, filePath string, entry *filer_pb.Entry, cond *filer_pb.WriteCondition, finalize []*filer_pb.ObjectMutation) (*filer_pb.ObjectTransactionResponse, error) {
+func (s3a *S3ApiServer) routedPut(owner pb.ServerAddress, routeKey, lockKey, filePath string, entry *filer_pb.Entry, cond *filer_pb.WriteCondition, conditionKey, conditionAltKey string, finalize []*filer_pb.ObjectMutation) (*filer_pb.ObjectTransactionResponse, error) {
 	mutations := make([]*filer_pb.ObjectMutation, 0, 1+len(finalize))
 	mutations = append(mutations, &filer_pb.ObjectMutation{
 		Type:      filer_pb.ObjectMutation_PUT,
@@ -189,17 +202,19 @@ func (s3a *S3ApiServer) routedPut(owner pb.ServerAddress, routeKey, lockKey, fil
 	})
 	mutations = append(mutations, finalize...)
 	return s3a.objectTxnOnFiler(owner, &filer_pb.ObjectTransactionRequest{
-		LockKey:   lockKey,
-		RouteKey:  routeKey,
-		Condition: cond,
-		Mutations: mutations,
+		LockKey:         lockKey,
+		RouteKey:        routeKey,
+		Condition:       cond,
+		ConditionKey:    conditionKey,
+		ConditionAltKey: conditionAltKey,
+		Mutations:       mutations,
 	})
 }
 
 // routedMkFile builds an entry like filer_pb.MkFile and writes it through a
 // routed PUT on the owner filer, for callers that would otherwise mkFile to the
 // default filer (e.g. multipart completion of a non-versioned object).
-func (s3a *S3ApiServer) routedMkFile(owner pb.ServerAddress, routeKey, parentDir, name string, chunks []*filer_pb.FileChunk, fn func(*filer_pb.Entry)) error {
+func (s3a *S3ApiServer) routedMkFile(owner pb.ServerAddress, routeKey, parentDir, name string, chunks []*filer_pb.FileChunk, fn func(*filer_pb.Entry), removal *uploadRemovalTxn) error {
 	now := time.Now().Unix()
 	entry := &filer_pb.Entry{
 		Name: name,
@@ -216,27 +231,73 @@ func (s3a *S3ApiServer) routedMkFile(owner pb.ServerAddress, routeKey, parentDir
 		fn(entry)
 	}
 	filePath := parentDir + "/" + name
-	resp, err := s3a.routedPut(owner, routeKey, filePath, filePath, entry, nil, nil)
+	var cond *filer_pb.WriteCondition
+	var conditionKey string
+	var finalize []*filer_pb.ObjectMutation
+	if removal != nil {
+		cond, conditionKey = removal.condition, removal.conditionKey
+		finalize = []*filer_pb.ObjectMutation{removal.mutation}
+	}
+	resp, err := s3a.routedPut(owner, routeKey, filePath, filePath, entry, cond, conditionKey, "", finalize)
 	if err != nil {
 		return err
 	}
+	if resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED {
+		return errUploadRemoved
+	}
 	if resp.Error != "" {
 		return fmt.Errorf("routed mkfile %s/%s: %s", parentDir, name, resp.Error)
 	}
 	return nil
 }
 
+// errUploadRemoved is a routed commit rejected because its precondition found
+// the upload directory already deleted, mapped to NoSuchUpload by callers.
+var errUploadRemoved = errors.New("upload directory already removed")
+
 // writeMultipartObject writes a completed multipart object entry, routed to the
 // owner when known (so it serializes with concurrent writes to the same key)
-// and falling back to a plain mkFile otherwise. routeKey must be the same key the
-// caller used to resolve owner, so owner selection and forwarding stay consistent.
-func (s3a *S3ApiServer) writeMultipartObject(owner pb.ServerAddress, routeKey, dir, name string, chunks []*filer_pb.FileChunk, fn func(*filer_pb.Entry)) error {
+// and falling back to a plain mkFile otherwise. removal carries the upload
+// precondition and deletion applied in the same transaction as the routed PUT.
+// routeKey must be the same key the caller used to resolve owner, so owner
+// selection and forwarding stay consistent.
+func (s3a *S3ApiServer) writeMultipartObject(owner pb.ServerAddress, routeKey, dir, name string, chunks []*filer_pb.FileChunk, fn func(*filer_pb.Entry), removal *uploadRemovalTxn) error {
 	if owner != "" {
-		return s3a.routedMkFile(owner, routeKey, dir, name, chunks, fn)
+		return s3a.routedMkFile(owner, routeKey, dir, name, chunks, fn, removal)
 	}
 	return s3a.mkFile(dir, name, chunks, fn)
 }
 
+// uploadRemovalTxn carries the precondition and mutation that drop a completed
+// upload's directory inside the object's commit transaction. The precondition
+// fails the commit when a delete that does not take the object lock (abort,
+// lifecycle, s3.clean.uploads) removed the directory first, instead of
+// publishing the object over freed chunks.
+type uploadRemovalTxn struct {
+	condition    *filer_pb.WriteCondition
+	conditionKey string
+	mutation     *filer_pb.ObjectMutation
+}
+
+// routedUploadRemoval returns the transaction parts that remove a completed
+// upload's directory inside the object's commit, after freeing the part
+// entries the object does not reference. It is nil when the write is not
+// routed and the upload directory still needs post-commit cleanup.
+func (s3a *S3ApiServer) routedUploadRemoval(ctx context.Context, owner pb.ServerAddress, uploadDirectory, bucket, uploadId string, completionState *multipartCompletionState) (*uploadRemovalTxn, error) {
+	if owner == "" {
+		return nil, nil
+	}
+	if err := s3a.deleteUnusedPartEntries(ctx, uploadDirectory, bucket, uploadId, completionState); err != nil {
+		return nil, err
+	}
+	conditionKey, condition := uploadExistsCondition(uploadDirectory)
+	return &uploadRemovalTxn{
+		condition:    condition,
+		conditionKey: conditionKey,
+		mutation:     s3a.removeUploadDirMutation(bucket, uploadId),
+	}, nil
+}
+
 func (s3a *S3ApiServer) routedDelete(owner pb.ServerAddress, bucket, object string, cond *filer_pb.WriteCondition) (*filer_pb.ObjectTransactionResponse, error) {
 	// NewFullPath normalizes a trailing-slash directory-marker key (e.g. "dir/")
 	// to the entry name "dir", matching deleteUnversionedObjectWithClient.
@@ -255,41 +316,42 @@ func (s3a *S3ApiServer) routedDelete(owner pb.ServerAddress, bucket, object stri
 	})
 }
 
-// routedMetadataReplace applies a metadata-only self-copy (REPLACE directive) to
-// an existing object in place via a routed PATCH_EXTENDED. The owner merges the
-// new managed metadata onto a fresh read of the entry under its per-path lock —
-// so a concurrent change to non-managed keys (legal hold, retention, version id)
-// is preserved rather than clobbered by a whole-entry rewrite — and bumps mtime.
-// updatedMetadata is the full managed-metadata set (processMetadataBytes); the
-// delete list is the managed keys the replace dropped.
-func (s3a *S3ApiServer) routedMetadataReplace(owner pb.ServerAddress, bucket, object string, current *filer_pb.Entry, updatedMetadata map[string][]byte) error {
+// routedSelfCopy updates metadata and attributes together, guarded by the raw
+// source snapshot. UpdateEntry routes conditional writes to the owner and checks
+// the condition under its path lock, so concurrent content, ACL or retention
+// updates cannot be overwritten by a stale self-copy. Chunks are reused in place.
+func (s3a *S3ApiServer) routedSelfCopy(ctx context.Context, owner pb.ServerAddress, bucket, object string, current, updated *filer_pb.Entry) error {
 	fullpath := util.NewFullPath(s3a.bucketDir(bucket), object)
-	dir, name := fullpath.DirAndName()
-	var del []string
-	for k := range current.Extended {
-		if isManagedCopyMetadataKey(k) {
-			if _, keep := updatedMetadata[k]; !keep {
-				del = append(del, k)
-			}
+	dir, _ := fullpath.DirAndName()
+	req := &filer_pb.UpdateEntryRequest{
+		Directory: dir,
+		Entry:     updated,
+		Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{{
+			Kind:          filer_pb.WriteCondition_IF_ENTRY_EQUAL,
+			ExpectedEntry: current,
+		}}},
+	}
+	var conditionErr error
+	update := func(client filer_pb.SeaweedFilerClient) error {
+		err := filer_pb.UpdateEntry(ctx, client, req)
+		switch status.Code(err) {
+		case codes.FailedPrecondition, codes.NotFound:
+			// These are authoritative replies from a healthy owner, not a
+			// transport failure. Do not replay them or mark the owner down.
+			conditionErr = err
+			return nil
+		default:
+			return err
 		}
 	}
-	resp, err := s3a.objectTxnOnFiler(owner, &filer_pb.ObjectTransactionRequest{
-		LockKey:  string(fullpath),
-		RouteKey: s3a.objectRouteKey(bucket, object),
-		Mutations: []*filer_pb.ObjectMutation{{
-			Type:           filer_pb.ObjectMutation_PATCH_EXTENDED,
-			Directory:      dir,
-			Name:           name,
-			SetExtended:    updatedMetadata,
-			DeleteExtended: del,
-			TouchMtime:     true,
-		}},
-	})
+	var err error
+	if s3a.filerClient == nil {
+		err = pb.WithFilerClient(false, 0, owner, s3a.option.GrpcDialOption, update)
+	} else {
+		err = s3a.withFilerClientFailover(ctx, owner, false, false, update)
+	}
 	if err != nil {
 		return err
 	}
-	if resp.Error != "" {
-		return fmt.Errorf("routed metadata replace %s/%s: %s", bucket, object, resp.Error)
-	}
-	return nil
+	return conditionErr
 }
diff --git a/weed/s3api/s3api_object_routed_write_test.go b/weed/s3api/s3api_object_routed_write_test.go
index 0e47b15596..470a63e0f3 100644
--- a/weed/s3api/s3api_object_routed_write_test.go
+++ b/weed/s3api/s3api_object_routed_write_test.go
@@ -15,7 +15,9 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
 )
 
 func reqWith(headers map[string]string) *http.Request {
@@ -254,17 +256,24 @@ func TestSingleStrongETag(t *testing.T) {
 // calls, standing in for a live filer that a routed write fails over to.
 type fakeTxnFiler struct {
 	filer_pb.UnimplementedSeaweedFilerServer
-	calls int32
+	calls   int32
+	lastReq *filer_pb.ObjectTransactionRequest
+	resp    *filer_pb.ObjectTransactionResponse
+	err     error
 }
 
 func (f *fakeTxnFiler) ObjectTransaction(ctx context.Context, req *filer_pb.ObjectTransactionRequest) (*filer_pb.ObjectTransactionResponse, error) {
 	atomic.AddInt32(&f.calls, 1)
+	f.lastReq = req
+	if f.resp != nil || f.err != nil {
+		return f.resp, f.err
+	}
 	return &filer_pb.ObjectTransactionResponse{}, nil
 }
 
-// startFakeTxnFiler serves impl on a random localhost port and returns the S3-style
+// startFakeFiler serves impl on a random localhost port and returns the S3-style
 // filer address whose ToGrpcAddress resolves back to that port.
-func startFakeTxnFiler(t *testing.T, impl *fakeTxnFiler) pb.ServerAddress {
+func startFakeFiler(t *testing.T, impl filer_pb.SeaweedFilerServer) pb.ServerAddress {
 	t.Helper()
 	lis, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
@@ -278,6 +287,89 @@ func startFakeTxnFiler(t *testing.T, impl *fakeTxnFiler) pb.ServerAddress {
 	return pb.ServerAddress(fmt.Sprintf("127.0.0.1:1.%d", port))
 }
 
+func TestRoutedDeleteSpecificVersionUsesWormCondition(t *testing.T) {
+	versionId := "672a75d526ef29c79fe6b5680cad4a0d"
+	versionFile := "v_" + versionId
+	filer := &fakeTxnFiler{
+		resp: &filer_pb.ObjectTransactionResponse{
+			Error:     "precondition failed",
+			ErrorCode: filer_pb.FilerError_PRECONDITION_FAILED,
+		},
+	}
+	owner := startFakeFiler(t, filer)
+	s3a := &S3ApiServer{
+		option: &S3ApiServerOption{
+			BucketsPath:    "/buckets",
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		},
+	}
+
+	if code := s3a.routedDeleteSpecificVersion(owner, "b", "obj", versionId, true, false); code != s3err.ErrAccessDenied {
+		t.Fatalf("locked version delete returned %v, want %v", code, s3err.ErrAccessDenied)
+	}
+
+	req := filer.lastReq
+	if req == nil {
+		t.Fatal("expected an ObjectTransaction request")
+	}
+	if req.LockKey != "/buckets/b/obj" {
+		t.Fatalf("LockKey = %q", req.LockKey)
+	}
+	if req.ConditionKey != "/buckets/b/obj.versions/"+versionFile {
+		t.Fatalf("ConditionKey = %q", req.ConditionKey)
+	}
+	if req.RouteKey != "s3.object.write:/buckets/b/obj" {
+		t.Fatalf("RouteKey = %q", req.RouteKey)
+	}
+
+	if len(req.Condition.GetClauses()) != 2 {
+		t.Fatalf("condition clauses = %d, want 2", len(req.Condition.GetClauses()))
+	}
+	hold := req.Condition.GetClauses()[0]
+	if hold.Kind != filer_pb.WriteCondition_IF_EXTENDED_NOT_EQUAL ||
+		hold.ExtKey != s3_constants.ExtLegalHoldKey ||
+		hold.ExtValue != s3_constants.LegalHoldOn {
+		t.Fatalf("legal hold clause = %+v", hold)
+	}
+	retain := req.Condition.GetClauses()[1]
+	if retain.Kind != filer_pb.WriteCondition_IF_EXTENDED_TIME_ELAPSED ||
+		retain.ExtKey != s3_constants.ExtRetentionUntilDateKey ||
+		retain.GateKey != "" {
+		t.Fatalf("retention clause = %+v", retain)
+	}
+
+	if len(req.Mutations) != 2 {
+		t.Fatalf("mutations = %d, want 2", len(req.Mutations))
+	}
+	recompute := req.Mutations[0]
+	if recompute.Type != filer_pb.ObjectMutation_RECOMPUTE_LATEST ||
+		recompute.GetRecompute().GetExcludeName() != versionFile {
+		t.Fatalf("recompute mutation = %+v", recompute)
+	}
+	deleteVersion := req.Mutations[1]
+	if deleteVersion.Type != filer_pb.ObjectMutation_DELETE ||
+		deleteVersion.Directory != "/buckets/b/obj.versions" ||
+		deleteVersion.Name != versionFile ||
+		!deleteVersion.IsDeleteData ||
+		!deleteVersion.RemoveEmptyParent {
+		t.Fatalf("delete mutation = %+v", deleteVersion)
+	}
+}
+
+func TestWormDeleteConditionForGovernanceBypass(t *testing.T) {
+	cond := wormDeleteCondition(true, true)
+	if len(cond.GetClauses()) != 2 {
+		t.Fatalf("condition clauses = %d, want 2", len(cond.GetClauses()))
+	}
+	retain := cond.GetClauses()[1]
+	if retain.Kind != filer_pb.WriteCondition_IF_EXTENDED_TIME_ELAPSED ||
+		retain.ExtKey != s3_constants.ExtRetentionUntilDateKey ||
+		retain.GateKey != s3_constants.ExtObjectLockModeKey ||
+		retain.GateValue != s3_constants.RetentionModeCompliance {
+		t.Fatalf("retention clause = %+v", retain)
+	}
+}
+
 // closedFilerAddress returns an address whose gRPC port has nothing listening,
 // modeling a filer whose ring address is stale after a pod restart.
 func closedFilerAddress(t *testing.T) pb.ServerAddress {
@@ -296,7 +388,7 @@ func closedFilerAddress(t *testing.T) pb.ServerAddress {
 // so an object write survives a filer pod IP change without an S3 gateway restart.
 func TestObjectTxnFailsOverStaleOwner(t *testing.T) {
 	live := &fakeTxnFiler{}
-	liveAddr := startFakeTxnFiler(t, live)
+	liveAddr := startFakeFiler(t, live)
 	deadOwner := closedFilerAddress(t)
 
 	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
@@ -331,6 +423,146 @@ func TestObjectTxnFailsOverStaleOwner(t *testing.T) {
 	}
 }
 
+// Issue 11631: a transaction the owner may have applied must not be re-sent to
+// another filer — a lost response is indistinguishable from a commit. Failover
+// is only for channels that never came up, which provably sent nothing.
+func TestObjectTxnNoReplayAfterSend(t *testing.T) {
+	owner := &fakeTxnFiler{err: status.Error(codes.Unavailable, "response lost")}
+	ownerAddr := startFakeFiler(t, owner)
+	backup := &fakeTxnFiler{}
+	backupAddr := startFakeFiler(t, backup)
+
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	s3a := &S3ApiServer{
+		option:      &S3ApiServerOption{GrpcDialOption: dialOption},
+		filerClient: wdclient.NewFilerClient([]pb.ServerAddress{ownerAddr, backupAddr}, dialOption, ""),
+	}
+	req := &filer_pb.ObjectTransactionRequest{LockKey: "/buckets/b/o", RouteKey: "s3.object.write:/buckets/b/o"}
+
+	if _, err := s3a.objectTxnOnFiler(ownerAddr, req); err == nil {
+		t.Fatal("expected the lost response to surface as an error")
+	}
+	if got := atomic.LoadInt32(&backup.calls); got != 0 {
+		t.Fatalf("backup filer calls = %d — replayed a possibly-committed transaction", got)
+	}
+}
+
+// A completed multipart upload commits in one transaction: the version file's
+// PUT, the metadata-only removal of .uploads/<id> (its chunks are the object's
+// chunks), and the latest-pointer recompute, in that order.
+func TestRoutedMultipartFinalize(t *testing.T) {
+	filer := &fakeTxnFiler{}
+	owner := startFakeFiler(t, filer)
+	s3a := &S3ApiServer{
+		option: &S3ApiServerOption{
+			BucketsPath:    "/buckets",
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		},
+	}
+
+	chunks := []*filer_pb.FileChunk{{FileId: "1,01637037d6"}}
+	code := s3a.routedMultipartFinalize(owner, "b", "obj", false, "/buckets/b/obj.versions", "v_1", chunks, func(entry *filer_pb.Entry) {
+		entry.Extended = map[string][]byte{s3_constants.SeaweedFSUploadId: []byte("up1")}
+	}, "up1")
+	if code != s3err.ErrNone {
+		t.Fatalf("routedMultipartFinalize = %v", code)
+	}
+
+	req := filer.lastReq
+	if req == nil {
+		t.Fatal("expected an ObjectTransaction request")
+	}
+	if req.LockKey != "/buckets/b/obj" {
+		t.Fatalf("LockKey = %q", req.LockKey)
+	}
+	if req.RouteKey != "s3.object.write:/buckets/b/obj" {
+		t.Fatalf("RouteKey = %q", req.RouteKey)
+	}
+	if req.ConditionKey != "/buckets/b/.uploads/up1" {
+		t.Fatalf("ConditionKey = %q", req.ConditionKey)
+	}
+	if req.Condition == nil || len(req.Condition.Clauses) != 1 || req.Condition.Clauses[0].Kind != filer_pb.WriteCondition_IF_EXISTS {
+		t.Fatalf("Condition = %+v", req.Condition)
+	}
+	if len(req.Mutations) != 3 {
+		t.Fatalf("mutations = %d, want 3", len(req.Mutations))
+	}
+
+	put := req.Mutations[0]
+	if put.Type != filer_pb.ObjectMutation_PUT ||
+		put.Directory != "/buckets/b/obj.versions" ||
+		put.Entry == nil ||
+		put.Entry.Name != "v_1" ||
+		len(put.Entry.Chunks) != 1 ||
+		string(put.Entry.Extended[s3_constants.SeaweedFSUploadId]) != "up1" {
+		t.Fatalf("put mutation = %+v", put)
+	}
+	removeUpload := req.Mutations[1]
+	if removeUpload.Type != filer_pb.ObjectMutation_DELETE ||
+		removeUpload.Directory != "/buckets/b/.uploads" ||
+		removeUpload.Name != "up1" ||
+		!removeUpload.IsRecursive ||
+		removeUpload.IsDeleteData {
+		t.Fatalf("remove upload mutation = %+v", removeUpload)
+	}
+	if req.Mutations[2].Type != filer_pb.ObjectMutation_RECOMPUTE_LATEST {
+		t.Fatalf("recompute mutation = %+v", req.Mutations[2])
+	}
+}
+
+// A non-versioned multipart completion removes .uploads/<id> metadata-only in
+// the same transaction as the object's PUT.
+func TestWriteMultipartObjectRemovesUploadDir(t *testing.T) {
+	filer := &fakeTxnFiler{}
+	owner := startFakeFiler(t, filer)
+	s3a := &S3ApiServer{
+		option: &S3ApiServerOption{
+			BucketsPath:    "/buckets",
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		},
+	}
+
+	if removal, err := s3a.routedUploadRemoval(context.Background(), "", "/buckets/b/.uploads/up1", "b", "up1", &multipartCompletionState{}); removal != nil || err != nil {
+		t.Fatalf("unrouted write should not carry the removal, got %+v, %v", removal, err)
+	}
+	removal, err := s3a.routedUploadRemoval(context.Background(), owner, "/buckets/b/.uploads/up1", "b", "up1", &multipartCompletionState{})
+	if err != nil {
+		t.Fatalf("routedUploadRemoval: %v", err)
+	}
+	if err := s3a.writeMultipartObject(owner, "s3.object.write:/buckets/b/o", "/buckets/b", "o", nil, nil, removal); err != nil {
+		t.Fatalf("writeMultipartObject: %v", err)
+	}
+
+	req := filer.lastReq
+	if req == nil {
+		t.Fatal("expected an ObjectTransaction request")
+	}
+	if req.LockKey != "/buckets/b/o" {
+		t.Fatalf("LockKey = %q", req.LockKey)
+	}
+	if req.ConditionKey != "/buckets/b/.uploads/up1" {
+		t.Fatalf("ConditionKey = %q", req.ConditionKey)
+	}
+	if req.Condition == nil || len(req.Condition.Clauses) != 1 || req.Condition.Clauses[0].Kind != filer_pb.WriteCondition_IF_EXISTS {
+		t.Fatalf("Condition = %+v", req.Condition)
+	}
+	if len(req.Mutations) != 2 {
+		t.Fatalf("mutations = %d, want 2", len(req.Mutations))
+	}
+	put := req.Mutations[0]
+	if put.Type != filer_pb.ObjectMutation_PUT || put.Directory != "/buckets/b" || put.Entry == nil || put.Entry.Name != "o" {
+		t.Fatalf("put mutation = %+v", put)
+	}
+	removeUpload := req.Mutations[1]
+	if removeUpload.Type != filer_pb.ObjectMutation_DELETE ||
+		removeUpload.Directory != "/buckets/b/.uploads" ||
+		removeUpload.Name != "up1" ||
+		!removeUpload.IsRecursive ||
+		removeUpload.IsDeleteData {
+		t.Fatalf("remove upload mutation = %+v", removeUpload)
+	}
+}
+
 func TestRouteWriteCondition(t *testing.T) {
 	// Unconditional routes either way.
 	if c, ok := routeWriteCondition(reqWith(nil), false); !ok || c != nil {
diff --git a/weed/s3api/s3api_object_upload_acl.go b/weed/s3api/s3api_object_upload_acl.go
new file mode 100644
index 0000000000..929b791656
--- /dev/null
+++ b/weed/s3api/s3api_object_upload_acl.go
@@ -0,0 +1,256 @@
+package s3api
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// putObjectACLContextKey carries validated ACL metadata to each object creation
+// path without exposing an internal header that a client could forge.
+type putObjectACLContextKey struct{}
+
+type putObjectACLMetadata struct {
+	extended map[string][]byte
+	canned   string
+}
+
+// putObjectACLValue ignores unsigned V2 query ACLs and rejects ambiguity.
+// Headers stay untouched because authentication verifies the original request.
+func putObjectACLValue(r *http.Request, query url.Values, header string) (string, s3err.ErrorCode) {
+	// Preserve SigV2's header-only ACL behavior: arbitrary query parameters
+	// are not in its canonical resource and must have no effect on grants.
+	switch getRequestAuthType(r) {
+	case authTypeSignedV2, authTypePresignedV2:
+		query = nil
+	}
+	var queryValues []string
+	queryPresent := false
+	for key, values := range query {
+		if strings.EqualFold(key, header) {
+			queryPresent = true
+			queryValues = append(queryValues, values...)
+		}
+	}
+	if queryPresent {
+		if len(queryValues) != 1 {
+			// V4 sorts duplicate values when signing. Choosing the first value
+			// would let reordering change the effective ACL without resigning.
+			return "", s3err.ErrInvalidRequest
+		}
+	}
+	values := r.Header.Values(header)
+	if header == s3_constants.AmzCannedAcl && len(values) > 1 {
+		return "", s3err.ErrInvalidRequest
+	}
+	value := strings.Join(values, ",")
+	if queryPresent {
+		if len(values) > 0 && value != queryValues[0] {
+			return "", s3err.ErrInvalidRequest
+		}
+		value = queryValues[0]
+	}
+	return value, s3err.ErrNone
+}
+
+// putObjectACLPolicyRequest exposes upload and copy ACLs to policy conditions only
+// after authentication. Other operations keep their original request semantics.
+func putObjectACLPolicyRequest(r *http.Request, action Action, bucket, object string) (*http.Request, s3err.ErrorCode) {
+	if (action != s3_constants.ACTION_WRITE && action != s3_constants.ACTION_WRITE_ACP) ||
+		r.Method != http.MethodPut || object == "" || object == "/" ||
+		ResolveS3Action(r, string(s3_constants.ACTION_WRITE), bucket, object) != s3_constants.S3_ACTION_PUT_OBJECT {
+		return r, s3err.ErrNone
+	}
+	// Rechecks reuse the normalized internal request, preserving signed original values without false query conflicts.
+	if len(policy_engine.OriginalGrantConditionsFromRequest(r)) != 0 {
+		return r, s3err.ErrNone
+	}
+	policyRequest := r.Clone(r.Context())
+	query := parseRequestQuery(r)
+	originalGrants := make(map[string][]string)
+	for _, header := range []string{s3_constants.AmzCannedAcl, s3_constants.AmzAclFullControl, s3_constants.AmzAclRead, s3_constants.AmzAclReadAcp, s3_constants.AmzAclWrite, s3_constants.AmzAclWriteAcp} {
+		value, code := putObjectACLValue(r, query, header)
+		if code != s3err.ErrNone {
+			return r, code
+		}
+		if value == "" {
+			continue
+		}
+		if header == s3_constants.AmzCannedAcl {
+			policyRequest.Header.Set(header, value)
+			continue
+		}
+		// Preserve only the complete effective list for original-string denies, not individual header lines as separate lists.
+		originalGrants["s3:"+strings.ToLower(header)] = []string{value}
+		// Policy conditions see the canonical grant list: one comma-separated
+		// value covering every persisted grantee, identical for a single line,
+		// repeated lines, or a signed query parameter. Sneaking an extra grantee
+		// past a StringEquals allow or a StringNotEquals allowlist deny requires
+		// changing this value, which a signed request cannot do.
+		pairs, pairCode := parseAclGranteePairs(value)
+		if pairCode != s3err.ErrNone {
+			return r, pairCode
+		}
+		var tokens []string
+		for _, pair := range pairs {
+			// Grant conditions use JSON quoting without HTML escaping, so valid
+			// literal characters in an account or email still match the policy.
+			var encoded strings.Builder
+			encoder := json.NewEncoder(&encoded)
+			encoder.SetEscapeHTML(false)
+			if err := encoder.Encode(pair[1]); err != nil {
+				return r, s3err.ErrInvalidRequest
+			}
+			tokens = append(tokens, pair[0]+"="+strings.TrimSuffix(encoded.String(), "\n"))
+		}
+		policyRequest.Header.Set(header, strings.Join(tokens, ","))
+	}
+	if len(originalGrants) != 0 {
+		policyRequest = policy_engine.WithOriginalGrantConditions(policyRequest, originalGrants)
+	}
+	return policyRequest, s3err.ErrNone
+}
+
+// preparePutObjectACL validates and authorizes ACLs before upload or copy data
+// is written. The metadata is committed in the same entry as the new object.
+func (s3a *S3ApiServer) preparePutObjectACL(r *http.Request, bucket string) (*http.Request, s3err.ErrorCode) {
+	metadata, code := s3a.getBucketConfig(bucket)
+	if code != s3err.ErrNone {
+		return r, code
+	}
+	if metadata == nil || s3a.iam == nil {
+		return r, s3err.ErrInternalError
+	}
+
+	// Presigners can hoist ACL headers into the signed query string. Normalize a
+	// separate request for parsing, preserving the original for signature checks.
+	aclRequest := r.Clone(r.Context())
+	query := parseRequestQuery(r)
+	custom := false
+	for _, header := range []string{s3_constants.AmzAclFullControl, s3_constants.AmzAclRead, s3_constants.AmzAclReadAcp, s3_constants.AmzAclWrite, s3_constants.AmzAclWriteAcp} {
+		value, code := putObjectACLValue(r, query, header)
+		if code != s3err.ErrNone {
+			return r, code
+		}
+		if value != "" {
+			custom = true
+			aclRequest.Header.Set(header, value)
+		}
+	}
+	canned, code := putObjectACLValue(r, query, s3_constants.AmzCannedAcl)
+	if code != s3err.ErrNone {
+		return r, code
+	}
+	aclRequest.Header.Set(s3_constants.AmzCannedAcl, canned)
+	explicit := canned != "" || custom
+	accountID := r.Header.Get(s3_constants.AmzAccountId)
+	if !s3a.iam.isEnabled() {
+		accountID = AccountAdmin.Id
+	} else if explicit {
+		// Setting an ACL during upload or copy also requires s3:PutObjectAcl. Use the
+		// unified authorization path so bucket-policy allows and explicit denies
+		// retain the same semantics as standalone ACL requests.
+		identity, authCode := s3a.iam.authRequest(r.Clone(r.Context()), s3_constants.ACTION_WRITE_ACP)
+		if authCode != s3err.ErrNone {
+			return r, authCode
+		}
+		if identity == nil || identity.Account == nil {
+			return r, s3err.ErrAccessDenied
+		}
+		accountID = identity.Account.Id
+	}
+	if explicit && !s3a.iam.isEnabled() {
+		_, object := s3_constants.GetBucketAndObject(r)
+		policyRequest, policyCode := putObjectACLPolicyRequest(r, s3_constants.ACTION_WRITE, bucket, object)
+		if policyCode != s3err.ErrNone {
+			return r, policyCode
+		}
+		for _, action := range []Action{s3_constants.ACTION_WRITE, s3_constants.ACTION_WRITE_ACP} {
+			if policyCode, _ := s3a.checkPolicyWithEntry(policyRequest, bucket, object, string(action), "", nil); policyCode != s3err.ErrNone {
+				return r, policyCode
+			}
+		}
+	}
+	if accountID == "" {
+		return r, s3err.ErrAccessDenied
+	}
+	if canned != "" && custom {
+		return r, s3err.ErrInvalidRequest
+	}
+
+	bucketOwner := metadata.Owner
+	if bucketOwner == "" {
+		// Buckets created outside S3 can have no recorded owner, matching the
+		// bucket registry's existing admin fallback for these entries.
+		bucketOwner = AccountAdmin.Id
+	}
+	ownership := s3_constants.EffectiveOwnership(metadata.Ownership)
+	if ownership == s3_constants.OwnershipBucketOwnerEnforced {
+		if metadata.Ownership == s3_constants.OwnershipBucketOwnerEnforced {
+			// Keep legacy buckets without recorded ownership controls accepting
+			// ACLs; only an explicitly configured enforced control disables them.
+			if custom || (canned != "" && canned != s3_constants.CannedAclBucketOwnerFullControl) {
+				return r, s3err.ErrAccessControlListNotSupported
+			}
+			aclRequest.Header.Set(s3_constants.AmzCannedAcl, s3_constants.CannedAclPrivate)
+		}
+		accountID = bucketOwner
+	}
+	if aclRequest.Header.Get(s3_constants.AmzCannedAcl) == "" && !custom {
+		aclRequest.Header.Set(s3_constants.AmzCannedAcl, s3_constants.CannedAclPrivate)
+	}
+	// Canned grants contain only authenticated writer and recorded bucket-owner
+	// IDs. Dynamic IAM/JWT accounts need not exist in the static account directory.
+	// Client-supplied custom grantees must still pass directory validation.
+	owner, grants, code := ParseAclHeaders(aclRequest, ownership, bucketOwner, accountID, false)
+	if code == s3err.ErrNone && custom {
+		grants, code = ValidateAndTransferGrants(s3a.iam, grants)
+	}
+	if code != s3err.ErrNone {
+		return r, code
+	}
+	if custom {
+		// Custom upload grants supplement the owner's default full control.
+		// Check after email resolution to avoid duplicating an explicit owner
+		// grant; the authenticated owner need not be in the static directory.
+		ownerFullControl := false
+		for _, grant := range grants {
+			if grant.Grantee != nil && grant.Grantee.Type != nil &&
+				*grant.Grantee.Type == s3_constants.GrantTypeCanonicalUser &&
+				grant.Grantee.ID != nil && *grant.Grantee.ID == owner &&
+				grant.Permission != nil && *grant.Permission == s3_constants.PermissionFullControl {
+				ownerFullControl = true
+				break
+			}
+		}
+		if !ownerFullControl {
+			grants = append(grants, &s3.Grant{
+				Grantee:    &s3.Grantee{Type: &s3_constants.GrantTypeCanonicalUser, ID: &owner},
+				Permission: &s3_constants.PermissionFullControl,
+			})
+		}
+	}
+	entry := &filer_pb.Entry{}
+	if code = AssembleEntryWithAcp(entry, owner, grants); code != s3err.ErrNone {
+		return r, code
+	}
+	prepared := putObjectACLMetadata{extended: entry.Extended, canned: canned}
+	return r.WithContext(context.WithValue(r.Context(), putObjectACLContextKey{}, prepared)), s3err.ErrNone
+}
+
+// applyPutObjectACL adds prevalidated ownership and grants before CreateEntry.
+// Multipart parts and POST form uploads do not carry this PutObject context.
+func applyPutObjectACL(r *http.Request, entry *filer_pb.Entry) {
+	metadata, _ := r.Context().Value(putObjectACLContextKey{}).(putObjectACLMetadata)
+	for key, value := range metadata.extended {
+		entry.Extended[key] = value
+	}
+}
diff --git a/weed/s3api/s3api_object_upload_acl_test.go b/weed/s3api/s3api_object_upload_acl_test.go
new file mode 100644
index 0000000000..067145376f
--- /dev/null
+++ b/weed/s3api/s3api_object_upload_acl_test.go
@@ -0,0 +1,708 @@
+package s3api
+
+import (
+	"crypto/md5"
+	"encoding/base64"
+	"encoding/xml"
+	"fmt"
+	"hash/crc32"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+// TestPutObjectUploadACL exercises signed uploads and inspects the actual filer
+// entry, including rejection before any volume allocation or object replacement.
+func TestPutObjectUploadACL(t *testing.T) {
+	const bucket, object, writer, bucketOwner = "acl-bucket", "allowed/image.png", "upload-writer", "bucket-owner"
+	type uploadACLTest struct {
+		name, acl, grantHeader, grant, ownership, policy, versioning, errorCode  string
+		writeOnly, wrongScope, marker, presigned, overwrite, unsigned, streaming bool
+		status                                                                   int
+		signature                                                                string
+		query, afterSigning                                                      url.Values
+		grantees                                                                 []string
+		repeatedGrant                                                            string
+		conditionValue                                                           string
+		conditionOperator                                                        string
+		defaultMode                                                              uint32
+		unregisteredAccounts                                                     bool
+		policyOnly                                                               bool
+		route                                                                    bool
+		copySource                                                               string
+		grantAccount, grantEmail                                                 string
+		unregisteredWriter                                                       bool
+	}
+	tests := []uploadACLTest{
+		{name: "default private", status: 200},
+		{name: "explicit private", acl: "private", status: 200},
+		{name: "public read", acl: "public-read", status: 200},
+		{name: "public read write", acl: "public-read-write", status: 200},
+		{name: "authenticated read", acl: "authenticated-read", status: 200},
+		{name: "custom read", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, status: 200},
+		{name: "custom write", grantHeader: s3_constants.AmzAclWrite, grant: `id="bucket-owner"`, status: 200},
+		{name: "custom read acp", grantHeader: s3_constants.AmzAclReadAcp, grant: `id="bucket-owner"`, status: 200},
+		{name: "custom write acp", grantHeader: s3_constants.AmzAclWriteAcp, grant: `id="bucket-owner"`, status: 200},
+		{name: "custom full control", grantHeader: s3_constants.AmzAclFullControl, grant: `id="bucket-owner"`, status: 200},
+		{name: "custom owner full control is not duplicated", grantHeader: s3_constants.AmzAclFullControl, grant: `id="upload-writer"`, grantees: []string{writer}, status: 200},
+		{name: "custom owner email full control is not duplicated", grantHeader: s3_constants.AmzAclFullControl, grant: `emailAddress="writer@example.com"`, grantEmail: "writer@example.com", grantAccount: writer, grantees: []string{writer}, status: 200},
+		{name: "custom owner read retains full control", grantHeader: s3_constants.AmzAclRead, grant: `id="upload-writer"`, grantees: []string{writer}, status: 200},
+		{name: "custom dynamic writer keeps full control", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, unregisteredWriter: true, status: 200},
+		{name: "unknown grantee", grantHeader: s3_constants.AmzAclRead, grant: `id="unknown"`, status: 400, errorCode: "InvalidRequest"},
+		{name: "unknown canned acl", acl: "invalid", status: 400, errorCode: "InvalidRequest"},
+		{name: "conflicting acl headers", acl: "public-read", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, status: 400, errorCode: "InvalidRequest"},
+		{name: "bucket owner read", acl: "bucket-owner-read", status: 200},
+		{name: "bucket owner full control", acl: "bucket-owner-full-control", status: 200},
+		{name: "preferred ownership", acl: "bucket-owner-full-control", ownership: s3_constants.OwnershipBucketOwnerPreferred, status: 200},
+		{name: "preferred default private", ownership: s3_constants.OwnershipBucketOwnerPreferred, status: 200},
+		{name: "enforced default", ownership: s3_constants.OwnershipBucketOwnerEnforced, status: 200},
+		{name: "enforced full control", acl: "bucket-owner-full-control", ownership: s3_constants.OwnershipBucketOwnerEnforced, status: 200},
+		{name: "enforced rejects private", acl: "private", ownership: s3_constants.OwnershipBucketOwnerEnforced, status: 400, errorCode: "AccessControlListNotSupported"},
+		{name: "enforced rejects public", acl: "public-read", ownership: s3_constants.OwnershipBucketOwnerEnforced, status: 400, errorCode: "AccessControlListNotSupported"},
+		{name: "enforced rejects grants", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, ownership: s3_constants.OwnershipBucketOwnerEnforced, status: 400, errorCode: "AccessControlListNotSupported"},
+		{name: "write only default", writeOnly: true, status: 200},
+		{name: "write only rejects explicit private", acl: "private", writeOnly: true, status: 403, errorCode: "AccessDenied"},
+		{name: "write only rejects public", acl: "public-read", writeOnly: true, status: 403, errorCode: "AccessDenied"},
+		{name: "write only rejects grants", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, writeOnly: true, status: 403, errorCode: "AccessDenied"},
+		{name: "acl permission outside prefix", acl: "public-read", wrongScope: true, status: 403, errorCode: "AccessDenied"},
+		{name: "iam allows acl", acl: "public-read", writeOnly: true, policy: "iam-allow", status: 200},
+		{name: "iam denies acl", acl: "public-read", policy: "iam-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "bucket allows acl", acl: "public-read", writeOnly: true, policy: "bucket-allow", status: 200},
+		{name: "bucket denies acl", acl: "public-read", policy: "bucket-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "presigned public read", acl: "public-read", presigned: true, status: 200},
+		{name: "presigned requires acl permission", acl: "public-read", presigned: true, writeOnly: true, status: 403, errorCode: "AccessDenied"},
+		{name: "presigned custom read", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, presigned: true, status: 200},
+		{name: "unsigned with authentication disabled", acl: "public-read", unsigned: true, status: 200},
+		{name: "streaming unsigned payload", acl: "public-read", streaming: true, status: 200},
+		{name: "directory marker", acl: "public-read", marker: true, status: 200},
+		{name: "directory marker rejects acl", acl: "public-read", marker: true, writeOnly: true, status: 403, errorCode: "AccessDenied"},
+		{name: "suspended version", acl: "public-read", versioning: s3_constants.VersioningSuspended, status: 200},
+		{name: "enabled version", acl: "public-read", versioning: s3_constants.VersioningEnabled, status: 200},
+		{name: "overwrite resets private", overwrite: true, status: 200},
+		{name: "rejected overwrite preserves acl", overwrite: true, acl: "invalid", status: 400, errorCode: "InvalidRequest"},
+		// Preserve the upstream review fixes and legacy ownership behavior.
+		{name: "multi grantee without space", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner",id="upload-writer"`, grantees: []string{bucketOwner, writer}, status: 200},
+		{name: "unknown grantee key", grantHeader: s3_constants.AmzAclRead, grant: `account="bucket-owner"`, status: 400, errorCode: "InvalidRequest"},
+		{name: "absent ownership default", ownership: "absent", status: 200},
+		{name: "absent ownership public read", acl: "public-read", ownership: "absent", status: 200},
+		{name: "absent ownership grants", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, ownership: "absent", status: 200},
+		{name: "sigv2 ignores unsigned query acl", signature: "v2", afterSigning: url.Values{"X-Amz-Acl": {"public-read"}}, status: 200},
+		{name: "external account uploader", acl: "public-read", unregisteredAccounts: true, status: 200},
+		{name: "unknown grant type", grantHeader: s3_constants.AmzAclRead, grant: `account="bucket-owner"`, status: 400, errorCode: "InvalidRequest"},
+		{name: "mixed unknown grant type", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner",principal="upload-writer"`, status: 400, errorCode: "InvalidRequest"},
+		{name: "multiple grants without spaces", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner",id="upload-writer"`, grantees: []string{bucketOwner, writer}, status: 200},
+		{name: "repeated grant headers", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, repeatedGrant: `id="upload-writer"`, grantees: []string{bucketOwner, writer}, status: 200},
+		{name: "presigned multiple grants", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner",id="upload-writer"`, grantees: []string{bucketOwner, writer}, presigned: true, status: 200},
+		{name: "presigned public read write", acl: "public-read-write", presigned: true, status: 200},
+		{name: "presigned public version", acl: "public-read", presigned: true, versioning: s3_constants.VersioningEnabled, status: 200},
+		{name: "default server mode", defaultMode: 0600, status: 200},
+		{name: "enforced default server mode", ownership: s3_constants.OwnershipBucketOwnerEnforced, defaultMode: 0600, status: 200},
+		{name: "v2 signed header", signature: "v2", acl: "public-read", status: 200},
+		{name: "v2 presigned default", signature: "v2", presigned: true, status: 200},
+		{name: "v2 presigned signed header", signature: "v2-header", presigned: true, acl: "public-read", status: 200},
+		{name: "v2 unsigned canned query", signature: "v2", presigned: true, acl: "public-read", status: 200},
+		{name: "v2 unsigned grant query", signature: "v2", presigned: true, grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, status: 200},
+		{name: "v2 tampered mixed case query", signature: "v2", afterSigning: url.Values{"x-AMZ-aCl": {"public-read"}}, status: 200},
+		{name: "v2 tampered presigned query", signature: "v2", presigned: true, afterSigning: url.Values{"x-amz-acl": {"public-read"}}, status: 200},
+		{name: "v2 empty acl query", signature: "v2", afterSigning: url.Values{"x-amz-acl": {""}}, status: 200},
+		{name: "v2 header cannot hide unsigned query", signature: "v2", acl: "private", afterSigning: url.Values{"x-amz-acl": {"public-read"}}, status: 200},
+		{name: "v2 fake v4 marker cannot bypass", signature: "v2", afterSigning: url.Values{"x-amz-acl": {"public-read"}, "X-Amz-Credential": {"fake"}}, status: 200},
+		{name: "v4 duplicate canned query", presigned: true, query: url.Values{"X-Amz-Acl": {"private", "public-read"}}, afterSigning: url.Values{"X-Amz-Acl": {"public-read", "private"}}, status: 400, errorCode: "InvalidRequest"},
+		{name: "v4 case alias query", presigned: true, query: url.Values{"X-Amz-Acl": {"private"}, "x-amz-acl": {"public-read"}}, status: 400, errorCode: "InvalidRequest"},
+		{name: "v4 conflicting header query", acl: "private", query: url.Values{"X-Amz-Acl": {"public-read"}}, status: 400, errorCode: "InvalidRequest"},
+		{name: "v4 tampered signed query", presigned: true, acl: "private", afterSigning: url.Values{"X-Amz-Acl": {"public-read"}}, status: 403, errorCode: "SignatureDoesNotMatch"},
+		{name: "dynamic default writer", unregisteredAccounts: true, status: 200},
+		{name: "dynamic public writer", unregisteredAccounts: true, acl: "public-read", status: 200},
+		{name: "dynamic bucket owner", unregisteredAccounts: true, acl: "bucket-owner-full-control", status: 200},
+		{name: "dynamic preferred owner", unregisteredAccounts: true, acl: "bucket-owner-full-control", ownership: s3_constants.OwnershipBucketOwnerPreferred, status: 200},
+		{name: "dynamic enforced default", unregisteredAccounts: true, ownership: s3_constants.OwnershipBucketOwnerEnforced, status: 200},
+		{name: "dynamic enforced full control", unregisteredAccounts: true, acl: "bucket-owner-full-control", ownership: s3_constants.OwnershipBucketOwnerEnforced, status: 200},
+		{name: "dynamic does not bypass custom validation", unregisteredAccounts: true, grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, status: 400, errorCode: "InvalidRequest"},
+		{name: "disabled authentication bucket denies acl", unsigned: true, acl: "public-read", policy: "bucket-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "header bucket condition denies acl", acl: "public-read", policy: "bucket-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "query bucket condition denies acl", acl: "public-read", presigned: true, policy: "bucket-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "query bucket condition denies upload", acl: "public-read", presigned: true, policy: "bucket-put-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "query iam condition denies acl", acl: "public-read", presigned: true, policy: "iam-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "query iam condition denies upload", acl: "public-read", presigned: true, policy: "iam-put-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "query bucket condition allows acl", acl: "public-read", presigned: true, writeOnly: true, policy: "bucket-condition-allow", status: 200},
+		{name: "query bucket condition supplies all permissions", acl: "public-read", presigned: true, policyOnly: true, policy: "bucket-all-condition-allow", status: 200},
+		{name: "query iam condition supplies all permissions", acl: "public-read", presigned: true, policyOnly: true, policy: "iam-all-condition-allow", status: 200},
+		{name: "query grant bucket condition denies", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, presigned: true, policy: "bucket-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "query grant iam condition denies", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, presigned: true, policy: "iam-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "disabled authentication query condition denies acl", unsigned: true, presigned: true, acl: "public-read", policy: "bucket-condition-deny", status: 403, errorCode: "AccessDenied"},
+		{name: "disabled authentication query condition denies upload", unsigned: true, presigned: true, acl: "public-read", policy: "bucket-put-condition-deny", status: 403, errorCode: "AccessDenied"},
+		// Policy conditions compare the canonical grant list as a whole, so a
+		// deny on the exact list fires identically for repeated header lines, a
+		// single comma-joined line, or a signed query parameter.
+		{name: "repeated grants preserve condition deny", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, repeatedGrant: `id="upload-writer"`, policy: "bucket-condition-deny", conditionValue: `id="bucket-owner",id="upload-writer"`, status: 403, errorCode: "AccessDenied"},
+		{name: "single line grants preserve condition deny", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner",id="upload-writer"`, policy: "bucket-condition-deny", conditionValue: `id="bucket-owner",id="upload-writer"`, status: 403, errorCode: "AccessDenied"},
+		{name: "presigned grants preserve condition deny", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner",id="upload-writer"`, presigned: true, policy: "bucket-condition-deny", conditionValue: `id="bucket-owner",id="upload-writer"`, status: 403, errorCode: "AccessDenied"},
+		{name: "extra grantee defeats allow condition", grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, repeatedGrant: `id="upload-writer"`, writeOnly: true, policy: "bucket-condition-allow", conditionValue: `id="bucket-owner"`, status: 403, errorCode: "AccessDenied"},
+	}
+	// Invalid multipart parameters or copy headers must not bypass policy normalization on the actual regular-upload route.
+	for _, policy := range []string{"bucket", "iam"} {
+		for _, shape := range []string{"upload id only", "invalid part number", "invalid copy source"} {
+			query, copySource := url.Values{}, ""
+			switch shape {
+			case "upload id only":
+				query.Set("uploadId", "opaque")
+			case "invalid part number":
+				query.Set("uploadId", "opaque")
+				query.Set("partNumber", "abc")
+			case "invalid copy source":
+				copySource = "bogus"
+			}
+			tests = append(tests, uploadACLTest{
+				name: "routed extra grant denied " + policy + " " + shape, route: true, query: query, copySource: copySource,
+				grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, repeatedGrant: `id="upload-writer"`,
+				conditionValue: `id="bucket-owner"`, policy: policy + "-all-condition-allow", policyOnly: true,
+				status: 403, errorCode: "AccessDenied",
+			})
+		}
+		for _, presigned := range []bool{false, true} {
+			tests = append(tests, uploadACLTest{
+				name:        fmt.Sprintf("put action approved negative deny %s presigned %t", policy, presigned),
+				grantHeader: s3_constants.AmzAclRead, grant: `id = "bucket-owner" , id = "upload-writer"`,
+				conditionValue: `id="bucket-owner",id="upload-writer"`, conditionOperator: "StringNotEquals",
+				policy: policy + "-put-condition-deny", presigned: presigned, grantees: []string{bucketOwner, writer}, status: 200,
+			})
+		}
+	}
+	// Every grant header must pass the same policy boundary, not just read grants.
+	for _, header := range []string{s3_constants.AmzAclRead, s3_constants.AmzAclWrite, s3_constants.AmzAclReadAcp, s3_constants.AmzAclWriteAcp, s3_constants.AmzAclFullControl} {
+		for _, policy := range []string{"bucket", "iam"} {
+			for _, presigned := range []bool{false, true} {
+				tests = append(tests, uploadACLTest{
+					name:        fmt.Sprintf("raw grant header deny %s %s presigned %t", header, policy, presigned),
+					grantHeader: header, grant: `id = "bucket-owner"`, policy: policy + "-condition-deny", presigned: presigned,
+					status: 403, errorCode: "AccessDenied",
+				})
+			}
+		}
+	}
+	for _, presigned := range []bool{false, true} {
+		tests = append(tests, uploadACLTest{
+			name:        fmt.Sprintf("disabled authentication raw deny presigned %t", presigned),
+			grantHeader: s3_constants.AmzAclRead, grant: `id = "bucket-owner"`, unsigned: true, presigned: presigned,
+			policy: "bucket-condition-deny", status: 403, errorCode: "AccessDenied",
+		})
+		for _, policy := range []string{"bucket", "iam"} {
+			for _, repeated := range []bool{false, true} {
+				grant, extra := `id="bucket-owner",id="upload-writer"`, ""
+				if repeated {
+					grant, extra = `id="bucket-owner"`, `id="upload-writer"`
+				}
+				tests = append(tests, uploadACLTest{
+					name:        fmt.Sprintf("whole list deny preserves extra grantee %s presigned %t repeated %t", policy, presigned, repeated),
+					grantHeader: s3_constants.AmzAclRead, grant: grant, repeatedGrant: extra,
+					conditionValue: `id="bucket-owner"`, policy: policy + "-condition-deny", presigned: presigned,
+					grantees: []string{bucketOwner, writer}, status: 200,
+				}, uploadACLTest{
+					name:        fmt.Sprintf("whole list allow rejects extra grantee %s presigned %t repeated %t", policy, presigned, repeated),
+					grantHeader: s3_constants.AmzAclRead, grant: grant, repeatedGrant: extra,
+					conditionValue: `id="bucket-owner"`, policy: policy + "-all-condition-allow", presigned: presigned,
+					policyOnly: true, status: 403, errorCode: "AccessDenied",
+				})
+			}
+			tests = append(tests, uploadACLTest{
+				name:        fmt.Sprintf("canonical approved allow with whitespace %s presigned %t", policy, presigned),
+				grantHeader: s3_constants.AmzAclRead, grant: `id = "bucket-owner" , id = "upload-writer"`,
+				conditionValue: `id="bucket-owner",id="upload-writer"`, policy: policy + "-all-condition-allow", presigned: presigned,
+				policyOnly: true, grantees: []string{bucketOwner, writer}, status: 200,
+			})
+		}
+	}
+	// Explicit denies on original complete grant values must survive whitespace and escape normalization.
+	for _, policy := range []string{"bucket", "iam"} {
+		for _, presigned := range []bool{false, true} {
+			for _, grant := range []string{
+				`id="bucket-owner",id="upload-writer"`,
+				`id = "bucket-owner" , id = "upload-writer"`,
+				`id="bucket-\u006fwner",id="upload-writer"`,
+			} {
+				for _, operator := range []string{"StringEquals", "StringEqualsIgnoreCase", "StringLike"} {
+					tests = append(tests, uploadACLTest{
+						name:        fmt.Sprintf("raw grant deny %s %s presigned %t %s", policy, operator, presigned, grant),
+						grantHeader: s3_constants.AmzAclRead, grant: grant, presigned: presigned,
+						conditionOperator: operator, policy: policy + "-condition-deny", status: 403, errorCode: "AccessDenied",
+					})
+				}
+			}
+			// Repeated headers and presigned queries must check all grants; an approved value cannot hide an added grantee.
+			tests = append(tests, uploadACLTest{
+				name:        fmt.Sprintf("joined repeated raw deny %s presigned %t", policy, presigned),
+				grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, repeatedGrant: `id="upload-writer"`,
+				conditionValue: `id="bucket-owner",id="upload-writer"`, policy: policy + "-condition-deny", presigned: presigned,
+				status: 403, errorCode: "AccessDenied",
+			}, uploadACLTest{
+				name:        fmt.Sprintf("original repeated line deny %s presigned %t", policy, presigned),
+				grantHeader: s3_constants.AmzAclRead, grant: `id = "bucket-owner"`, repeatedGrant: `id="upload-writer"`,
+				conditionValue: `*id = "bucket-owner"*`, conditionOperator: "StringLike", policy: policy + "-condition-deny", presigned: presigned,
+				status: 403, errorCode: "AccessDenied",
+			})
+			// Negative conditions still compare the canonical complete list, preserving equivalent encodings of approved lists.
+			for _, operator := range []string{"StringNotEquals", "StringNotLike", "StringNotEqualsIgnoreCase"} {
+				for _, grant := range []string{`id="bucket-owner",id="upload-writer"`, `id = "bucket-owner" , id = "upload-writer"`} {
+					tests = append(tests, uploadACLTest{
+						name:        fmt.Sprintf("approved negative deny %s %s presigned %t %s", policy, operator, presigned, grant),
+						grantHeader: s3_constants.AmzAclRead, grant: grant, conditionOperator: operator,
+						conditionValue: `id="bucket-owner",id="upload-writer"`, policy: policy + "-condition-deny", presigned: presigned,
+						grantees: []string{bucketOwner, writer}, status: 200,
+					}, uploadACLTest{
+						name:        fmt.Sprintf("negative allow unchanged %s %s presigned %t %s", policy, operator, presigned, grant),
+						grantHeader: s3_constants.AmzAclRead, grant: grant, conditionOperator: operator,
+						conditionValue: `id="bucket-owner",id="upload-writer"`, policy: policy + "-all-condition-allow", presigned: presigned,
+						policyOnly: true, status: 403, errorCode: "AccessDenied",
+					})
+				}
+				tests = append(tests, uploadACLTest{
+					name:        fmt.Sprintf("extra repeated grantee denied %s %s presigned %t", policy, operator, presigned),
+					grantHeader: s3_constants.AmzAclRead, grant: `id="bucket-owner"`, repeatedGrant: `id="upload-writer"`,
+					conditionOperator: operator, conditionValue: `id="bucket-owner"`, policy: policy + "-condition-deny", presigned: presigned,
+					status: 403, errorCode: "AccessDenied",
+				})
+			}
+		}
+	}
+	// Special characters must remain literal in canonical policy values, while
+	// authorization still checks both upload permissions and complete grant lists.
+	for _, grantee := range []struct{ key, value, account string }{
+		{"emailAddress", "a&b@example.com", "email-reader"},
+		{"id", "reader<account", "reader<account"},
+		{"id", "reader>account", "reader>account"},
+	} {
+		grant := fmt.Sprintf("%s=%q", grantee.key, grantee.value)
+		for _, policy := range []string{"bucket", "iam"} {
+			for _, presigned := range []bool{false, true} {
+				for _, rule := range []struct {
+					name, operator, policy string
+					status                 int
+				}{
+					{"allow", "StringEquals", "-all-condition-allow", 200},
+					{"approved negative deny", "StringNotEquals", "-condition-deny", 200},
+					{"positive deny", "StringEquals", "-condition-deny", 403},
+				} {
+					tt := uploadACLTest{
+						name:        fmt.Sprintf("html grant %s %s %s presigned %t", grantee.value, policy, rule.name, presigned),
+						grantHeader: s3_constants.AmzAclRead, grant: grant, grantAccount: grantee.account,
+						conditionValue: grant, conditionOperator: rule.operator, policy: policy + rule.policy,
+						presigned: presigned, policyOnly: rule.name == "allow", grantees: []string{grantee.account}, status: rule.status,
+					}
+					if grantee.key == "emailAddress" {
+						tt.grantEmail = grantee.value
+					}
+					if rule.status == 403 {
+						tt.errorCode = "AccessDenied"
+					}
+					tests = append(tests, tt)
+				}
+			}
+		}
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			key := object
+			if tt.marker {
+				key = "allowed/folder/"
+			}
+			volume := startFakeVolumeServer(t)
+			filer := &ambiguousPutFiler{volume: volume, apply: true, entries: map[string]*filer_pb.Entry{}}
+			s3a := newPutTestServer(t, startFakeFiler(t, filer))
+			s3a.option.DefaultFileMode = tt.defaultMode
+			s3a.iam = NewIdentityAccessManagementWithStore(s3a.option, nil, "memory")
+			t.Cleanup(s3a.iam.Shutdown)
+			s3a.iam.isAuthEnabled = !tt.unsigned
+			account := &Account{Id: writer, DisplayName: writer}
+			identity := &Identity{Name: "upload-acl-test", Account: account, IsStatic: true,
+				Actions:     []Action{"Write:acl-bucket/allowed/*"},
+				Credentials: []*Credential{{AccessKey: routingTestAccessKey, SecretKey: routingTestSecretKey}}}
+			if !tt.writeOnly {
+				scope := "WriteAcp:acl-bucket/allowed/*"
+				if tt.wrongScope {
+					scope = "WriteAcp:acl-bucket/other/*"
+				}
+				identity.Actions = append(identity.Actions, Action(scope))
+			}
+			if tt.policyOnly {
+				identity.Actions = nil
+			}
+			s3a.iam.accessKeyIdent[routingTestAccessKey] = identity
+			s3a.iam.nameToIdentity[identity.Name] = identity
+			s3a.iam.accounts[writer] = account
+			s3a.iam.accounts[bucketOwner] = &Account{Id: bucketOwner, DisplayName: bucketOwner}
+			if tt.grantAccount != "" {
+				grantee := &Account{Id: tt.grantAccount, DisplayName: tt.grantAccount, EmailAddress: tt.grantEmail}
+				s3a.iam.accounts[tt.grantAccount] = grantee
+				if tt.grantEmail != "" {
+					s3a.iam.emailAccount[tt.grantEmail] = grantee
+				}
+			}
+			if tt.unregisteredWriter {
+				delete(s3a.iam.accounts, writer)
+			}
+			if tt.unregisteredAccounts {
+				// JWT/STS authentication supplies trusted accounts dynamically;
+				// their IDs are not registered in the static grantee directory.
+				delete(s3a.iam.accounts, writer)
+				delete(s3a.iam.accounts, bucketOwner)
+			}
+			ownership := tt.ownership
+			if ownership == "" {
+				ownership = s3_constants.OwnershipObjectWriter
+			}
+			bucketEntry := &filer_pb.Entry{Name: bucket, IsDirectory: true, Attributes: &filer_pb.FuseAttributes{},
+				Extended: map[string][]byte{s3_constants.ExtAmzOwnerKey: []byte(bucketOwner)}}
+			storedOwnership := ownership
+			if ownership == "absent" {
+				storedOwnership = ""
+			} else {
+				bucketEntry.Extended[s3_constants.ExtOwnershipKey] = []byte(ownership)
+			}
+			filer.entries["/buckets/"+bucket] = bucketEntry
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set(bucket, &BucketConfig{Name: bucket, Owner: bucketOwner, Ownership: storedOwnership, Versioning: tt.versioning})
+			s3a.bucketRegistry = NewBucketRegistry(s3a)
+			s3a.bucketRegistry.LoadBucketMetadata(bucketEntry)
+			if tt.versioning == s3_constants.VersioningEnabled {
+				filer.entries["/buckets/"+bucket+"/"+key+s3_constants.VersionsFolder] = &filer_pb.Entry{Name: "image.png.versions", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{}}
+			}
+			var original *filer_pb.Entry
+			if tt.overwrite {
+				original = &filer_pb.Entry{Name: "image.png", Attributes: &filer_pb.FuseAttributes{}, Extended: map[string][]byte{s3_constants.ExtAmzOwnerKey: []byte(bucketOwner), s3_constants.ExtAmzAclKey: []byte("old-acl")}}
+				filer.entries["/buckets/"+bucket+"/"+key] = proto.Clone(original).(*filer_pb.Entry)
+			}
+			if tt.policy != "" {
+				effect := "Allow"
+				if strings.HasSuffix(tt.policy, "deny") {
+					effect = "Deny"
+				}
+				statement := fmt.Sprintf(`{"Effect":%q,"Action":"s3:PutObjectAcl","Resource":"arn:aws:s3:::acl-bucket/allowed/*"}`, effect)
+				if strings.Contains(tt.policy, "put-") {
+					statement = strings.Replace(statement, `"s3:PutObjectAcl"`, `"s3:PutObject"`, 1)
+				} else if strings.Contains(tt.policy, "all-") {
+					statement = strings.Replace(statement, `"s3:PutObjectAcl"`, `["s3:PutObject","s3:PutObjectAcl"]`, 1)
+				}
+				if strings.Contains(tt.policy, "condition") {
+					header, value := s3_constants.AmzCannedAcl, tt.acl
+					if tt.grantHeader != "" {
+						header, value = tt.grantHeader, tt.grant
+					}
+					if tt.conditionValue != "" {
+						value = tt.conditionValue
+					}
+					operator := tt.conditionOperator
+					if operator == "" {
+						operator = "StringEquals"
+					}
+					condition := fmt.Sprintf(`,"Condition":{%q:{%q:%q}}}`, operator, "s3:"+strings.ToLower(header), value)
+					statement = strings.TrimSuffix(statement, "}") + condition
+				}
+				if strings.HasPrefix(tt.policy, "iam") {
+					statements := statement
+					if !tt.policyOnly {
+						allowActions := `"s3:PutObject"`
+						if strings.Contains(tt.policy, "condition") && effect == "Deny" {
+							allowActions = `["s3:PutObject","s3:PutObjectAcl"]`
+						}
+						statements = `{"Effect":"Allow","Action":` + allowActions + `,"Resource":"arn:aws:s3:::acl-bucket/allowed/*"},` + statement
+					}
+					require.NoError(t, s3a.iam.PutPolicy("upload-acl-policy", `{"Version":"2012-10-17","Statement":[`+statements+`]}`))
+					identity.PolicyNames = []string{"upload-acl-policy"}
+				} else {
+					s3a.policyEngine = NewBucketPolicyEngine()
+					s3a.iam.policyEngine = s3a.policyEngine
+					statement = strings.Replace(statement, `{"Effect":`, `{"Principal":"*","Effect":`, 1)
+					require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy(bucket, `{"Version":"2012-10-17","Statement":[`+statement+`]}`))
+				}
+			}
+			body := "uploaded content"
+			wireBody := body
+			if tt.streaming {
+				checksum := crc32.NewIEEE()
+				_, err := checksum.Write([]byte(body))
+				require.NoError(t, err)
+				wireBody = fmt.Sprintf("%x\r\n%s\r\n0\r\n\r\nx-amz-checksum-crc32:%s\r\n\r\n", len(body), body, base64.StdEncoding.EncodeToString(checksum.Sum(nil)))
+			}
+			req := httptest.NewRequest(http.MethodPut, "http://s3/"+bucket+"/"+key, strings.NewReader(wireBody))
+			req = mux.SetURLVars(req, map[string]string{"bucket": bucket, "object": key})
+			req.Header.Set("Content-Type", "text/plain")
+			if tt.copySource != "" {
+				req.Header.Set("X-Amz-Copy-Source", tt.copySource)
+			}
+			if tt.acl != "" {
+				req.Header.Set(s3_constants.AmzCannedAcl, tt.acl)
+			}
+			if tt.grantHeader != "" {
+				req.Header.Set(tt.grantHeader, tt.grant)
+				if tt.repeatedGrant != "" {
+					req.Header.Add(tt.grantHeader, tt.repeatedGrant)
+				}
+			}
+			req.URL.RawQuery = tt.query.Encode()
+			if tt.streaming {
+				req.Header.Set("X-Amz-Content-Sha256", streamingUnsignedPayload)
+				req.Header.Set("X-Amz-Trailer", "x-amz-checksum-crc32")
+				req.Header.Set("X-Amz-Decoded-Content-Length", fmt.Sprint(len(body)))
+				req.Header.Set("Content-Encoding", "aws-chunked")
+			}
+			if tt.presigned && tt.signature != "v2-header" {
+				// Exercise ACLs in the signed query rather than relying on a
+				// particular SDK version's automatic header-hoisting behavior.
+				query := req.URL.Query()
+				if tt.acl != "" {
+					query.Set(s3_constants.AmzCannedAcl, tt.acl)
+					req.Header.Del(s3_constants.AmzCannedAcl)
+				}
+				if tt.grantHeader != "" {
+					query.Set(tt.grantHeader, strings.Join(req.Header.Values(tt.grantHeader), ","))
+					req.Header.Del(tt.grantHeader)
+				}
+				req.URL.RawQuery = query.Encode()
+			}
+			if tt.unsigned {
+				// Disabled authentication uses the admin account, not a caller's
+				// forged internal account header.
+				req.Header.Set(s3_constants.AmzAccountId, "forged-account")
+			}
+			if tt.signature != "" {
+				cred := &Credential{AccessKey: routingTestAccessKey, SecretKey: routingTestSecretKey}
+				if tt.presigned {
+					query := req.URL.Query()
+					expires := fmt.Sprint(time.Now().Add(time.Minute).Unix())
+					query.Set("AWSAccessKeyId", routingTestAccessKey)
+					query.Set("Expires", expires)
+					query.Set("Signature", preSignatureV2(cred, req.Method, req.URL.EscapedPath(), query.Encode(), req.Header, expires))
+					req.URL.RawQuery = query.Encode()
+				} else {
+					req.Header.Set("Date", time.Now().UTC().Format(http.TimeFormat))
+					req.Header.Set("Authorization", signatureV2(cred, req.Method, req.URL.EscapedPath(), req.URL.RawQuery, req.Header))
+				}
+			} else if tt.presigned && !tt.unsigned {
+				signer := v4.NewSigner(credentials.NewStaticCredentials(routingTestAccessKey, routingTestSecretKey, ""))
+				_, err := signer.Presign(req, strings.NewReader(wireBody), "s3", "us-east-1", time.Minute, time.Now())
+				require.NoError(t, err)
+			} else if !tt.unsigned {
+				signRoutingTestRequest(t, req, wireBody, "s3")
+			}
+			if tt.afterSigning != nil {
+				query := req.URL.Query()
+				for key, values := range tt.afterSigning {
+					query[key] = values
+				}
+				req.URL.RawQuery = query.Encode()
+				if tt.errorCode != "SignatureDoesNotMatch" {
+					// These attacks preserve a valid signature. Unsigned V2 ACLs
+					// must be ignored; ambiguous signed V4 ACLs must be rejected.
+					_, code := s3a.iam.AuthenticateRequest(req.Clone(req.Context()))
+					require.Equal(t, s3err.ErrNone, code)
+				}
+			}
+			rr := httptest.NewRecorder()
+			if tt.route {
+				s3a.cb = &CircuitBreaker{s3a: s3a}
+				router := mux.NewRouter()
+				s3a.registerRouter(router)
+				router.ServeHTTP(rr, req)
+			} else {
+				s3a.iam.Auth(s3a.PutObjectHandler, s3_constants.ACTION_WRITE)(rr, req)
+			}
+			require.Equal(t, tt.status, rr.Code, rr.Body.String())
+			// Snapshot the committed entry under the fixture lock, then release it
+			// before GetObjectAcl makes another RPC to the fake filer.
+			var allocatedChunks uint64
+			stored := func() *filer_pb.Entry {
+				filer.mu.Lock()
+				defer filer.mu.Unlock()
+				allocatedChunks = filer.nextKey
+				entry := filer.entries["/buckets/"+bucket+"/"+strings.TrimSuffix(key, "/")]
+				if tt.status == http.StatusOK && tt.versioning == s3_constants.VersioningEnabled {
+					versionID := rr.Header().Get("x-amz-version-id")
+					require.NotEmpty(t, versionID)
+					entry = nil
+					for _, candidate := range filer.entries {
+						if string(candidate.Extended[s3_constants.ExtVersionIdKey]) == versionID {
+							entry = candidate
+							break
+						}
+					}
+				}
+				if entry == nil {
+					return nil
+				}
+				return proto.Clone(entry).(*filer_pb.Entry)
+			}()
+			if tt.status != http.StatusOK {
+				require.Contains(t, rr.Body.String(), "<Code>"+tt.errorCode+"</Code>")
+				require.Zero(t, allocatedChunks, "rejected ACLs must not allocate chunks")
+				require.True(t, proto.Equal(original, stored), "rejected uploads must not replace the object")
+				return
+			}
+			wantACL, wantGrantHeader := tt.acl, tt.grantHeader
+			if strings.HasPrefix(tt.signature, "v2") && tt.presigned && tt.signature != "v2-header" {
+				wantACL, wantGrantHeader = "", ""
+			}
+			require.NotNil(t, stored)
+			if !tt.marker {
+				mode := defaultFileMode
+				if tt.defaultMode != 0 && wantACL == "" {
+					mode = tt.defaultMode
+				}
+				switch wantACL {
+				case "public-read", "authenticated-read", "bucket-owner-read":
+					mode = 0644
+				case "public-read-write":
+					mode = 0666
+				}
+				require.Equal(t, mode, stored.Attributes.FileMode, "header and signed query ACLs must use the same file mode")
+			}
+			bodyMD5 := md5.Sum([]byte(body))
+			require.Equal(t, bodyMD5[:], stored.Attributes.Md5, "ACL parsing must not consume or alter the upload body")
+			wantOwner := writer
+			if tt.unsigned {
+				wantOwner = AccountAdmin.Id
+			}
+			if s3_constants.EffectiveOwnership(storedOwnership) == s3_constants.OwnershipBucketOwnerEnforced || (ownership == s3_constants.OwnershipBucketOwnerPreferred && wantACL == "bucket-owner-full-control") {
+				wantOwner = bucketOwner
+			}
+			require.Equal(t, wantOwner, string(stored.Extended[s3_constants.ExtAmzOwnerKey]))
+			grants := GetAcpGrants(stored.Extended)
+			require.NotEmpty(t, grants, "ACL must be persisted in the object create")
+			if wantGrantHeader != "" {
+				wantGrantees := tt.grantees
+				if wantGrantees == nil {
+					wantGrantees = []string{bucketOwner}
+				}
+				wantPermission := map[string]string{
+					s3_constants.AmzAclRead:        s3_constants.PermissionRead,
+					s3_constants.AmzAclWrite:       s3_constants.PermissionWrite,
+					s3_constants.AmzAclReadAcp:     s3_constants.PermissionReadAcp,
+					s3_constants.AmzAclWriteAcp:    s3_constants.PermissionWriteAcp,
+					s3_constants.AmzAclFullControl: s3_constants.PermissionFullControl,
+				}[wantGrantHeader]
+				ownerFullControl := false
+				for _, grantee := range wantGrantees {
+					ownerFullControl = ownerFullControl || (grantee == wantOwner && wantPermission == s3_constants.PermissionFullControl)
+				}
+				wantCount := len(wantGrantees)
+				if !ownerFullControl {
+					wantCount++
+				}
+				require.Len(t, grants, wantCount, "custom uploads must retain the owner's full control")
+				for i, grantee := range wantGrantees {
+					require.Equal(t, grantee, aws.StringValue(grants[i].Grantee.ID))
+					require.Equal(t, wantPermission, aws.StringValue(grants[i].Permission))
+				}
+				if !ownerFullControl {
+					ownerGrant := grants[len(grants)-1]
+					require.Equal(t, wantOwner, aws.StringValue(ownerGrant.Grantee.ID))
+					require.Equal(t, s3_constants.GrantTypeCanonicalUser, aws.StringValue(ownerGrant.Grantee.Type))
+					require.Equal(t, s3_constants.PermissionFullControl, aws.StringValue(ownerGrant.Permission))
+				}
+			} else {
+				require.Equal(t, wantOwner, aws.StringValue(grants[0].Grantee.ID))
+				require.Equal(t, s3_constants.PermissionFullControl, aws.StringValue(grants[0].Permission))
+				if wantACL == "public-read" || wantACL == "public-read-write" || wantACL == "authenticated-read" {
+					wantGrants := 2
+					if wantACL == "public-read-write" {
+						wantGrants = 3
+					}
+					require.Len(t, grants, wantGrants)
+					wantGroup := s3_constants.GranteeGroupAllUsers
+					if wantACL == "authenticated-read" {
+						wantGroup = s3_constants.GranteeGroupAuthenticatedUsers
+					}
+					require.Equal(t, wantGroup, aws.StringValue(grants[1].Grantee.URI))
+					require.Equal(t, s3_constants.PermissionRead, aws.StringValue(grants[1].Permission))
+					if wantACL == "public-read-write" {
+						require.Equal(t, s3_constants.GranteeGroupAllUsers, aws.StringValue(grants[2].Grantee.URI))
+						require.Equal(t, s3_constants.PermissionWrite, aws.StringValue(grants[2].Permission))
+					}
+				} else if ownership == s3_constants.OwnershipObjectWriter && strings.HasPrefix(wantACL, "bucket-owner-") {
+					require.Len(t, grants, 2)
+					require.Equal(t, bucketOwner, aws.StringValue(grants[1].Grantee.ID))
+					wantPermission := s3_constants.PermissionRead
+					if wantACL == "bucket-owner-full-control" {
+						wantPermission = s3_constants.PermissionFullControl
+					}
+					require.Equal(t, wantPermission, aws.StringValue(grants[1].Permission))
+				} else {
+					require.Len(t, grants, 1)
+				}
+			}
+			if wantGrantHeader != "" {
+				aclRequest := httptest.NewRequest(http.MethodGet, "http://s3/"+bucket+"/"+key+"?acl", nil)
+				aclRequest = mux.SetURLVars(aclRequest, map[string]string{"bucket": bucket, "object": key})
+				aclRequest.Header.Set(s3_constants.AmzAccountId, wantOwner)
+				aclResponse := httptest.NewRecorder()
+				s3a.GetObjectAclHandler(aclResponse, aclRequest)
+				require.Equal(t, http.StatusOK, aclResponse.Code, aclResponse.Body.String())
+				var acl AccessControlPolicy
+				require.NoError(t, xml.Unmarshal(aclResponse.Body.Bytes(), &acl))
+				require.Equal(t, wantOwner, acl.Owner.ID)
+				require.Len(t, acl.AccessControlList.Grant, len(grants))
+				for i, grant := range acl.AccessControlList.Grant {
+					require.Equal(t, aws.StringValue(grants[i].Grantee.ID), grant.Grantee.ID)
+					require.Equal(t, Permission(aws.StringValue(grants[i].Permission)), grant.Permission)
+				}
+			}
+		})
+	}
+}
+
+// TestPutObjectACLPolicyScope ensures query normalization cannot alter other
+// operations or the original signed request passed to the upload/copy handler.
+func TestPutObjectACLPolicyScope(t *testing.T) {
+	tests := []struct {
+		name, method, object, subresource string
+		action                            Action
+		copy                              bool
+		repeatedCopy                      bool
+		wantACL                           string
+	}{
+		{name: "upload", method: http.MethodPut, object: "key", action: s3_constants.ACTION_WRITE, wantACL: "public-read"},
+		{name: "upload acl authorization", method: http.MethodPut, object: "key", action: s3_constants.ACTION_WRITE_ACP, wantACL: "public-read"},
+		{name: "bucket", method: http.MethodPut, action: s3_constants.ACTION_WRITE},
+		{name: "post form", method: http.MethodPost, object: "key", action: s3_constants.ACTION_WRITE},
+		{name: "copy", method: http.MethodPut, object: "key", action: s3_constants.ACTION_WRITE, copy: true, wantACL: "public-read"},
+		{name: "copy acl authorization", method: http.MethodPut, object: "key", action: s3_constants.ACTION_WRITE_ACP, copy: true, wantACL: "public-read"},
+		{name: "repeated copy source", method: http.MethodPut, object: "key", action: s3_constants.ACTION_WRITE, repeatedCopy: true, wantACL: "public-read"},
+		{name: "multipart part copy", method: http.MethodPut, object: "key", subresource: "uploadId=upload&partNumber=1", action: s3_constants.ACTION_WRITE, copy: true},
+		{name: "multipart part", method: http.MethodPut, object: "key", subresource: "uploadId=upload&partNumber=1", action: s3_constants.ACTION_WRITE},
+		{name: "multipart leading zero", method: http.MethodPut, object: "key", subresource: "uploadId=upload&partNumber=01", action: s3_constants.ACTION_WRITE},
+		{name: "upload id only", method: http.MethodPut, object: "key", subresource: "uploadId=upload", action: s3_constants.ACTION_WRITE, wantACL: "public-read"},
+		{name: "invalid part number", method: http.MethodPut, object: "key", subresource: "uploadId=upload&partNumber=abc", action: s3_constants.ACTION_WRITE, wantACL: "public-read"},
+		{name: "standalone acl", method: http.MethodPut, object: "key", subresource: "acl=", action: s3_constants.ACTION_WRITE_ACP},
+		{name: "tagging", method: http.MethodPut, object: "key", subresource: "tagging=", action: s3_constants.ACTION_WRITE},
+		{name: "retention", method: http.MethodPut, object: "key", subresource: "retention=", action: s3_constants.ACTION_WRITE},
+		{name: "other service", method: http.MethodPut, object: "key", action: "iam:CreateUser"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(tt.method, "http://s3/bucket/"+tt.object+"?x-amz-acl=public-read&"+tt.subresource, nil)
+			if tt.copy {
+				req.Header.Set("X-Amz-Copy-Source", "/source/key")
+			}
+			if tt.repeatedCopy {
+				req.Header.Set("X-Amz-Copy-Source", "bogus")
+				req.Header.Add("X-Amz-Copy-Source", "%2fsource%2fkey")
+			}
+			policyRequest, code := putObjectACLPolicyRequest(req, tt.action, "bucket", tt.object)
+			require.Equal(t, s3err.ErrNone, code)
+			require.Equal(t, tt.wantACL, policyRequest.Header.Get(s3_constants.AmzCannedAcl))
+			require.Empty(t, req.Header.Get(s3_constants.AmzCannedAcl), "normalization must preserve signed headers")
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_versioned_finalize.go b/weed/s3api/s3api_object_versioned_finalize.go
index ea0393c8b1..e37d5d6f8d 100644
--- a/weed/s3api/s3api_object_versioned_finalize.go
+++ b/weed/s3api/s3api_object_versioned_finalize.go
@@ -46,6 +46,9 @@ func (s3a *S3ApiServer) latestPointerRecompute(bucket, object string, useInverte
 			s3_constants.ExtLatestVersionOwnerKey:        s3_constants.ExtAmzOwnerKey,
 			s3_constants.ExtLatestVersionIsDeleteMarker:  s3_constants.ExtDeleteMarkerKey,
 			s3_constants.ExtLatestVersionStorageClassKey: s3_constants.AmzStorageClass,
+			// Version files never carry the null-current signal, so this mapping
+			// deletes a stale one from the pointer whenever it recomputes.
+			s3_constants.ExtNullVersionIsLatestKey: s3_constants.ExtNullVersionIsLatestKey,
 		},
 		ExcludeName: excludeName,
 	}
@@ -84,12 +87,79 @@ func (s3a *S3ApiServer) routedVersionedFinalize(owner pb.ServerAddress, bucket,
 	}
 }
 
+// removeUploadDirMutation deletes a completed upload's directory metadata-only:
+// the finished object's chunks are the part chunks, so freeing their data would
+// destroy the object.
+func (s3a *S3ApiServer) removeUploadDirMutation(bucket, uploadID string) *filer_pb.ObjectMutation {
+	return &filer_pb.ObjectMutation{
+		Type:        filer_pb.ObjectMutation_DELETE,
+		Directory:   s3a.genUploadsFolder(bucket),
+		Name:        uploadID,
+		IsRecursive: true,
+	}
+}
+
+// uploadExistsCondition requires the upload directory to still exist when the
+// commit transaction runs, so a delete that does not take the object lock
+// (abort, lifecycle, s3.clean.uploads) fails the commit instead of letting it
+// publish the object over freed chunks.
+func uploadExistsCondition(uploadDirectory string) (string, *filer_pb.WriteCondition) {
+	return uploadDirectory, &filer_pb.WriteCondition{
+		Clauses: []*filer_pb.WriteCondition_Clause{{Kind: filer_pb.WriteCondition_IF_EXISTS}},
+	}
+}
+
+// routedMultipartFinalize commits a completed multipart upload in one
+// ObjectTransaction on the owner filer: PUT the version file, remove the upload
+// directory, recompute the latest pointer. The transaction applies mutations in
+// order with no rollback, so the order picks which partial states are
+// reachable: PUT first keeps the chunks referenced at all times, and removing
+// the upload directory before the recompute means a published object never
+// coexists with a leftover .uploads directory that s3.clean.uploads would purge
+// with data.
+func (s3a *S3ApiServer) routedMultipartFinalize(owner pb.ServerAddress, bucket, object string, useInvertedFormat bool, versionDir, versionFileName string, chunks []*filer_pb.FileChunk, decorate func(*filer_pb.Entry), uploadID string) s3err.ErrorCode {
+	now := time.Now().Unix()
+	versionEntry := &filer_pb.Entry{
+		Name: versionFileName,
+		Attributes: &filer_pb.FuseAttributes{
+			Mtime:    now,
+			Crtime:   now,
+			FileMode: uint32(0770),
+			Uid:      filer_pb.OS_UID,
+			Gid:      filer_pb.OS_GID,
+		},
+		Chunks: chunks,
+	}
+	if decorate != nil {
+		decorate(versionEntry)
+	}
+
+	routeKey := ""
+	if owner != "" {
+		routeKey = s3a.objectRouteKey(bucket, object)
+	}
+	conditionKey, condition := uploadExistsCondition(s3a.genUploadsFolder(bucket) + "/" + uploadID)
+	resp, err := s3a.routedPut(owner, routeKey, s3a.toFilerPath(bucket, object), versionDir+"/"+versionFileName, versionEntry, condition, conditionKey, "", []*filer_pb.ObjectMutation{
+		s3a.removeUploadDirMutation(bucket, uploadID),
+		s3a.latestPointerRecompute(bucket, object, useInvertedFormat, "", true),
+	})
+	switch {
+	case err != nil:
+		glog.Errorf("routedMultipartFinalize: %s/%s upload %s on %s: %v", bucket, object, uploadID, owner, err)
+		return s3err.ErrInternalError
+	case resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED:
+		return s3err.ErrNoSuchUpload
+	case resp.Error != "":
+		glog.Errorf("routedMultipartFinalize: %s/%s upload %s: %s", bucket, object, uploadID, resp.Error)
+		return s3err.ErrInternalError
+	default:
+		return s3err.ErrNone
+	}
+}
+
 // wormDeleteCondition returns the object-lock guards for a delete, or nil when
-// the bucket has no object lock. Legal hold always blocks. Retention blocks
-// while not elapsed; with governance bypass the retention guard is gated to
-// COMPLIANCE mode, so a governance-mode version becomes deletable while a
-// compliance-mode one stays protected — the filer decides from the version's
-// mode under the lock, so the gateway never has to read it.
+// the bucket has no object lock. Governance bypass gates the retention check to
+// COMPLIANCE mode so the filer still protects compliance versions under lock.
 func wormDeleteCondition(worm, bypass bool) *filer_pb.WriteCondition {
 	if !worm {
 		return nil
@@ -108,15 +178,8 @@ func wormDeleteCondition(worm, bypass bool) *filer_pb.WriteCondition {
 	}}
 }
 
-// routedDeleteSpecificVersion deletes one version off the distributed lock: in a
-// single transaction on the owner it recomputes the .versions pointer excluding
-// the version (repoint-before-delete, so a crash leaves a recoverable orphan
-// rather than a dangling pointer) and deletes the version file. lock_key is the
-// object (serializing the pointer recompute); for object-lock buckets the
-// condition gates the delete on the version's WORM guards evaluated on the owner.
-// Deleting the last version also removes the emptied .versions/ directory —
-// leaving it behind would keep re-triggering the read path's self-heal rescans
-// on every GET of the key (Veeam probes its deleted lock objects forever).
+// routedDeleteSpecificVersion removes one version under the owner filer's object
+// lock, first repointing .versions while excluding the deleted version.
 func (s3a *S3ApiServer) routedDeleteSpecificVersion(owner pb.ServerAddress, bucket, object, versionId string, worm, bypass bool) s3err.ErrorCode {
 	if !isValidVersionID(versionId) {
 		return s3err.ErrInvalidRequest
@@ -153,8 +216,10 @@ func (s3a *S3ApiServer) routedDeleteSpecificVersion(owner pb.ServerAddress, buck
 // routedDeleteNullVersion deletes the null version (the regular object entry, not
 // a .versions file) off the distributed lock. There is no pointer to recompute;
 // the WORM guards, when present, gate the delete on the object entry itself
-// (condition defaults to lock_key).
-func (s3a *S3ApiServer) routedDeleteNullVersion(owner pb.ServerAddress, bucket, object string, worm, bypass bool) s3err.ErrorCode {
+// (condition defaults to lock_key). The second return reports whether the delete
+// was settled here: the raw delete cannot remove an entry other keys are nested
+// under, which the lock path handles by stripping the object off it instead.
+func (s3a *S3ApiServer) routedDeleteNullVersion(owner pb.ServerAddress, bucket, object string, worm, bypass bool) (s3err.ErrorCode, bool) {
 	fullpath := util.NewFullPath(s3a.bucketDir(bucket), object)
 	dir, name := fullpath.DirAndName()
 	resp, err := s3a.objectTxnOnFiler(owner, &filer_pb.ObjectTransactionRequest{
@@ -167,15 +232,15 @@ func (s3a *S3ApiServer) routedDeleteNullVersion(owner pb.ServerAddress, bucket,
 	})
 	switch {
 	case err != nil:
-		glog.Errorf("routedDeleteNullVersion: %s/%s on %s: %v", bucket, object, owner, err)
-		return s3err.ErrInternalError
+		glog.Warningf("routedDeleteNullVersion: %s/%s on %s, falling back to lock: %v", bucket, object, owner, err)
+		return s3err.ErrNone, false
 	case resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED:
-		return s3err.ErrAccessDenied
+		return s3err.ErrAccessDenied, true
 	case resp.Error != "":
-		glog.Errorf("routedDeleteNullVersion: %s/%s: %s", bucket, object, resp.Error)
-		return s3err.ErrInternalError
+		glog.Warningf("routedDeleteNullVersion: %s/%s returned %q, falling back to lock", bucket, object, resp.Error)
+		return s3err.ErrNone, false
 	default:
-		return s3err.ErrNone
+		return s3err.ErrNone, true
 	}
 }
 
diff --git a/weed/s3api/s3api_object_versioning.go b/weed/s3api/s3api_object_versioning.go
index 21d7194ca5..0e4cc950f3 100644
--- a/weed/s3api/s3api_object_versioning.go
+++ b/weed/s3api/s3api_object_versioning.go
@@ -15,6 +15,7 @@ import (
 	"sort"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -22,8 +23,10 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	s3_constants "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 )
 
 // ErrDeleteMarker is returned when the latest version is a delete marker (expected condition)
@@ -325,6 +328,10 @@ func (s3a *S3ApiServer) listObjectVersions(bucket, prefix, keyMarker, versionIdM
 	if maxKeys > 1000 {
 		maxKeys = 1000
 	}
+	// max-keys=0 asks for an empty, non-truncated page; no need to scan the bucket
+	if maxKeys <= 0 {
+		return s3a.splitIntoResult(nil, bucket, prefix, keyMarker, versionIdMarker, delimiter, 0, false, "", ""), nil
+	}
 	// Pre-allocate with capacity for maxKeys+1 to reduce reallocations
 	// The extra 1 is for truncation detection
 	allVersions := make([]interface{}, 0, maxKeys+1)
@@ -344,14 +351,8 @@ func (s3a *S3ApiServer) listObjectVersions(bucket, prefix, keyMarker, versionIdM
 	// Pass keyMarker and versionIdMarker to enable efficient pagination (skip entries before marker)
 	bucketPath := s3a.bucketDir(bucket)
 
-	// Memory optimization: limit collection to maxKeys+1 versions.
-	// This works correctly for objects using the NEW inverted-timestamp format, where
-	// filesystem order (lexicographic) matches sorted order (newest-first).
-	// For OLD format objects (raw timestamps), filesystem order is oldest-first, so
-	// limiting collection may return older versions instead of newest. However:
-	// - New objects going forward use the new format
-	// - The alternative (collecting all) causes memory issues for buckets with many versions
-	// - Pagination continues correctly; users can page through to see all versions
+	// Memory optimization: limit collection to maxKeys+1 versions, extended past
+	// entry names that can still resolve to keys sorting into the page.
 	maxCollect := maxKeys + 1 // +1 to detect truncation
 	err := s3a.findVersionsRecursively(bucketPath, "", &allVersions, processedObjects, seenVersionIds, bucket, prefix, keyMarker, versionIdMarker, delimiter, commonPrefixes, maxCollect)
 	if err != nil {
@@ -447,12 +448,12 @@ func (s3a *S3ApiServer) splitIntoResult(combinedList []versionListItem, bucket,
 	result := &S3ListObjectVersionsResult{
 		Name:                bucket,
 		Prefix:              prefix,
-		KeyMarker:           keyMarker,
+		KeyMarker:           encodeListContinuationToken(keyMarker),
 		VersionIdMarker:     versionIdMarker,
 		MaxKeys:             maxKeys,
 		Delimiter:           delimiter,
 		IsTruncated:         isTruncated,
-		NextKeyMarker:       nextKeyMarker,
+		NextKeyMarker:       encodeListContinuationToken(nextKeyMarker),
 		NextVersionIdMarker: nextVersionIdMarker,
 		Entries:             make([]VersionListEntry, 0, len(combinedList)),
 	}
@@ -477,6 +478,8 @@ func (s3a *S3ApiServer) splitIntoResult(combinedList []versionListItem, bucket,
 // versionCollector holds state for collecting object versions during recursive traversal
 type versionCollector struct {
 	s3a              *S3ApiServer
+	list             entryLister
+	getEntry         func(parentDirectoryPath, entryName string) (entry *filer_pb.Entry, err error)
 	bucket           string
 	prefix           string
 	keyMarker        string
@@ -487,6 +490,7 @@ type versionCollector struct {
 	seenVersionIds   map[string]bool
 	delimiter        string
 	commonPrefixes   map[string]bool
+	maxKey           string
 }
 
 // isFull returns true if we've collected enough versions
@@ -501,6 +505,58 @@ func (vc *versionCollector) isFull() bool {
 	return currentCount >= vc.maxCollect
 }
 
+// recordKey tracks the largest key collected so far, so collectVersions can
+// tell when an entry name still pending can resolve to a key that sorts into
+// the collected page.
+func (vc *versionCollector) recordKey(key string) {
+	if key > vc.maxKey {
+		vc.maxKey = key
+	}
+}
+
+// nameCeiling returns the largest directory-entry name that can still resolve
+// to a key at or below key. Name order is not key order: "a.copy.versions"
+// sorts before "a.versions" while key "a.copy" sorts after "a", so the names
+// that map to keys <= key reach past key+".versions" - every prefix of key can
+// host a .versions directory whose name is the real ceiling.
+func nameCeiling(key string) string {
+	ceiling := key + s3_constants.VersionsFolder
+	for i := 0; i < len(key); i++ {
+		if n := key[:i] + s3_constants.VersionsFolder; n > ceiling {
+			ceiling = n
+		}
+	}
+	return ceiling
+}
+
+// collectBound returns the largest entry name under relativePath that can still
+// resolve to a key at or below maxKey, and whether the walk may stop past it.
+// The bound is absent when nothing was collected yet, or when every key under
+// relativePath already sorts below maxKey and the whole subtree must be read.
+func (vc *versionCollector) collectBound(relativePath string) (string, bool) {
+	if vc.maxKey == "" {
+		return "", false
+	}
+	if relativePath == "" {
+		return nameCeiling(vc.maxKey), true
+	}
+	if rel, ok := strings.CutPrefix(vc.maxKey, relativePath+"/"); ok {
+		return nameCeiling(rel), true
+	}
+	return "", vc.maxKey < relativePath+"/"
+}
+
+// mayCollect reports whether entry name under relativePath can still resolve
+// to a key that sorts into the collected page; once the collector is full and
+// the name is past the bound, every later name can only produce keys above it.
+func (vc *versionCollector) mayCollect(relativePath, name string) bool {
+	if !vc.isFull() {
+		return true
+	}
+	bound, bounded := vc.collectBound(relativePath)
+	return !bounded || name <= bound
+}
+
 // matchesPrefixFilter checks if an entry path matches the prefix filter
 func (vc *versionCollector) matchesPrefixFilter(entryPath string, isDirectory bool) bool {
 	if vc.prefix == "" {
@@ -542,12 +598,49 @@ func (vc *versionCollector) computeStartFrom(relativePath string) (startFrom str
 		return "", false
 	}
 
-	if idx := strings.Index(remainder, "/"); idx >= 0 {
-		return remainder[:idx], true
+	// A sibling directory that is a prefix of the marker up to a byte below '0'
+	// still holds keys that sort after it - "d" for marker "d.x" contains "d/*".
+	// Resuming at the marker's name would skip those keys, so the walk resumes
+	// at the earliest such prefix instead.
+	for i := 1; i < len(remainder); i++ {
+		if remainder[i] < '0' {
+			return remainder[:i], true
+		}
 	}
 	return remainder, true
 }
 
+// computeListPrefix returns the name prefix that every entry of the directory
+// at relativePath must carry to be relevant to vc.prefix: the next path
+// component of the requested prefix under that directory. Pushing it into the
+// filer listing stops unrelated siblings from being transferred and scanned at
+// every level on the way down to the prefix. A name can hold no slash, so a
+// directory whose name does not start with this component cannot contain a
+// matching key, and a file whose name does not start with it cannot be one.
+// Inside the prefix zone (and without a prefix) it returns "" - no constraint.
+func (vc *versionCollector) computeListPrefix(relativePath string) string {
+	if vc.prefix == "" {
+		return ""
+	}
+
+	var remainder string
+	if relativePath == "" {
+		remainder = vc.prefix
+	} else if strings.HasPrefix(vc.prefix, relativePath+"/") {
+		remainder = vc.prefix[len(relativePath)+1:]
+	} else {
+		// The walk only enters a directory that matches the prefix or can
+		// descend toward it; one the prefix does not extend into means the
+		// whole directory is inside the prefix zone.
+		return ""
+	}
+
+	if idx := strings.Index(remainder, "/"); idx >= 0 {
+		return remainder[:idx]
+	}
+	return remainder
+}
+
 // shouldSkipObjectForMarker returns true if the object should be skipped based on keyMarker
 func (vc *versionCollector) shouldSkipObjectForMarker(objectKey string) bool {
 	if vc.keyMarker == "" {
@@ -580,13 +673,14 @@ func (vc *versionCollector) shouldSkipVersionForMarker(objectKey, versionId stri
 
 // addVersion adds a version or delete marker to results
 func (vc *versionCollector) addVersion(version *ObjectVersion, objectKey string) {
+	vc.recordKey(objectKey)
 	if version.IsDeleteMarker {
 		deleteMarker := &DeleteMarkerEntry{
 			Key:          objectKey,
 			VersionId:    version.VersionId,
 			IsLatest:     version.IsLatest,
 			LastModified: version.LastModified,
-			Owner:        vc.s3a.getObjectOwnerFromVersion(version, vc.bucket, objectKey),
+			Owner:        vc.s3a.getObjectOwnerFromVersion(version),
 		}
 		*vc.allVersions = append(*vc.allVersions, deleteMarker)
 	} else {
@@ -597,15 +691,16 @@ func (vc *versionCollector) addVersion(version *ObjectVersion, objectKey string)
 			LastModified: version.LastModified,
 			ETag:         version.ETag,
 			Size:         version.Size,
-			Owner:        vc.s3a.getObjectOwnerFromVersion(version, vc.bucket, objectKey),
+			Owner:        vc.s3a.getObjectOwnerFromVersion(version),
 			StorageClass: StorageClass(vc.s3a.getStorageClassFromExtended(entryExtended(version))),
 		}
 		*vc.allVersions = append(*vc.allVersions, versionEntry)
 	}
 }
 
-// processVersionsDirectory handles a .versions directory entry
-func (vc *versionCollector) processVersionsDirectory(entryPath string) error {
+// processVersionsDirectory handles a .versions directory entry, using the
+// entry already fetched by the parent directory listing.
+func (vc *versionCollector) processVersionsDirectory(entryPath string, versionsEntry *filer_pb.Entry) error {
 	objectKey := strings.TrimSuffix(entryPath, s3_constants.VersionsFolder)
 	normalizedObjectKey := s3_constants.NormalizeObjectKey(objectKey)
 
@@ -621,17 +716,13 @@ func (vc *versionCollector) processVersionsDirectory(entryPath string) error {
 
 	glog.V(2).Infof("processVersionsDirectory: found object %s", normalizedObjectKey)
 
-	versions, err := vc.s3a.getObjectVersionList(vc.bucket, normalizedObjectKey)
+	versions, err := vc.getObjectVersionList(normalizedObjectKey, versionsEntry)
 	if err != nil {
 		glog.Warningf("processVersionsDirectory: failed to get versions for %s: %v", normalizedObjectKey, err)
 		return nil // Continue with other entries
 	}
 
 	for _, version := range versions {
-		if vc.isFull() {
-			return nil
-		}
-
 		versionKey := normalizedObjectKey + ":" + version.VersionId
 		if vc.seenVersionIds[versionKey] {
 			continue
@@ -670,6 +761,7 @@ func (vc *versionCollector) processExplicitDirectory(entryPath string, entry *fi
 		return
 	}
 
+	vc.recordKey(directoryKey)
 	versionEntry := &VersionEntry{
 		Key:          directoryKey,
 		VersionId:    "null",
@@ -708,10 +800,10 @@ func (vc *versionCollector) processRegularFile(currentPath, entryPath string, en
 
 	// Check if a .versions directory exists for this object
 	versionsEntryName := entry.Name + s3_constants.VersionsFolder
-	_, versionsErr := vc.s3a.getEntry(currentPath, versionsEntryName)
+	versionsDirEntry, versionsErr := vc.getEntry(currentPath, versionsEntryName)
 	if versionsErr == nil && !hasVersionMeta {
 		// .versions exists but file has no version metadata - check for null version in .versions
-		versions, err := vc.s3a.getObjectVersionList(vc.bucket, normalizedObjectKey)
+		versions, err := vc.getObjectVersionList(normalizedObjectKey, versionsDirEntry)
 		if err == nil {
 			for _, v := range versions {
 				if v.VersionId == "null" {
@@ -731,10 +823,27 @@ func (vc *versionCollector) processRegularFile(currentPath, entryPath string, en
 	}
 	vc.seenVersionIds[versionKey] = true
 
+	// A latest-version pointer on the .versions sibling names the current version
+	// and outranks a stale null-current signal a recompute may not have cleared
+	// yet. With no pointer, the explicit signal decides; with neither, the
+	// sibling may still hold replicated versions the lagging pointer has not
+	// caught up with, and the nullObjectWins rule decides.
+	isLatest := true
+	if versionsErr == nil {
+		if len(versionsDirEntry.Extended[s3_constants.ExtLatestVersionIdKey]) > 0 {
+			isLatest = false
+		} else if !nullVersionIsLatest(versionsDirEntry) {
+			if latestVersion, _, _, _, scanErr := scanLatestVersionEntry(vc.list, currentPath+"/"+versionsEntryName); scanErr == nil && latestVersion != nil && !nullObjectWins(entry, latestVersion) {
+				isLatest = false
+			}
+		}
+	}
+
+	vc.recordKey(normalizedObjectKey)
 	versionEntry := &VersionEntry{
 		Key:          normalizedObjectKey,
 		VersionId:    "null",
-		IsLatest:     true,
+		IsLatest:     isLatest,
 		LastModified: time.Unix(entry.Attributes.Mtime, 0),
 		ETag:         vc.s3a.calculateETagFromChunks(entry.Chunks),
 		Size:         int64(entry.Attributes.FileSize),
@@ -751,6 +860,8 @@ func (vc *versionCollector) processRegularFile(currentPath, entryPath string, en
 func (s3a *S3ApiServer) findVersionsRecursively(currentPath, relativePath string, allVersions *[]interface{}, processedObjects map[string]bool, seenVersionIds map[string]bool, bucket, prefix, keyMarker, versionIdMarker, delimiter string, commonPrefixes map[string]bool, maxCollect int) error {
 	vc := &versionCollector{
 		s3a:              s3a,
+		list:             s3a.list,
+		getEntry:         s3a.getEntry,
 		bucket:           bucket,
 		prefix:           prefix,
 		keyMarker:        keyMarker,
@@ -776,12 +887,13 @@ func (vc *versionCollector) collectVersions(currentPath, relativePath string) er
 		startFrom = markerStart
 		inclusive = true
 	}
+	listPrefix := vc.computeListPrefix(relativePath)
 	for {
-		if vc.isFull() {
+		if bound, bounded := vc.collectBound(relativePath); vc.isFull() && bounded && startFrom >= bound {
 			return nil
 		}
 
-		entries, isLast, err := vc.s3a.list(currentPath, "", startFrom, inclusive, filer.PaginationSize)
+		entries, isLast, err := vc.list(currentPath, listPrefix, startFrom, inclusive, filer.PaginationSize)
 		// After the first batch, use exclusive mode for standard pagination
 		inclusive = false
 		if err != nil {
@@ -789,7 +901,7 @@ func (vc *versionCollector) collectVersions(currentPath, relativePath string) er
 		}
 
 		for _, entry := range entries {
-			if vc.isFull() {
+			if !vc.mayCollect(relativePath, entry.Name) {
 				return nil
 			}
 			startFrom = entry.Name
@@ -810,7 +922,7 @@ func (vc *versionCollector) collectVersions(currentPath, relativePath string) er
 
 				// Handle .versions directory
 				if strings.HasSuffix(entry.Name, s3_constants.VersionsFolder) {
-					if err := vc.processVersionsDirectory(entryPath); err != nil {
+					if err := vc.processVersionsDirectory(entryPath, entry); err != nil {
 						return err
 					}
 					continue
@@ -834,10 +946,15 @@ func (vc *versionCollector) collectVersions(currentPath, relativePath string) er
 							if vc.keyMarker != "" && commonPrefix <= vc.keyMarker {
 								continue
 							}
-							if vc.isFull() {
-								return nil
-							}
 							vc.commonPrefixes[commonPrefix] = true
+							vc.recordKey(commonPrefix)
+						}
+
+						// The prefix rolled up here belongs to the keys nested under this
+						// entry. A prefix object is also a key of its own, and that key
+						// carries no trailing slash, so it does not roll up with them.
+						if entry.IsPrefixObject() {
+							vc.processPrefixObject(currentPath, entryPath, entry)
 						}
 
 						// Skip further processing (recursion or addition) for this entry
@@ -863,13 +980,31 @@ func (vc *versionCollector) collectVersions(currentPath, relativePath string) er
 	return nil
 }
 
+// processPrefixObject emits the null version of a key that other keys are nested
+// under. The key carries no trailing slash, so it is a null object like any other and
+// needs the same reconciliation against a .versions sibling - but the directory it is
+// stored on is walked as an ancestor of the requested prefix, which its own key does
+// not have to match.
+func (vc *versionCollector) processPrefixObject(currentPath, entryPath string, entry *filer_pb.Entry) {
+	if !strings.HasPrefix(entryPath, vc.prefix) {
+		return
+	}
+	if vc.delimiter != "" && strings.Contains(entryPath[len(vc.prefix):], vc.delimiter) {
+		// The key folds into the same CommonPrefix its nested keys do.
+		return
+	}
+	vc.processRegularFile(currentPath, entryPath, entry)
+}
+
 // processDirectory handles directory entries
 func (vc *versionCollector) processDirectory(currentPath, entryPath string, entry *filer_pb.Entry) error {
 	// Handle explicit S3 directory object. Match ListObjectsV2's
 	// IsDirectoryKeyObject (any non-empty mime), not just FolderMimeType:
 	// an SDK PutObject of "dir/" carries a default Content-Type, so the two
 	// listings must agree on what counts as a directory key.
-	if entry.IsDirectoryKeyObject() {
+	if entry.IsPrefixObject() {
+		vc.processPrefixObject(currentPath, entryPath, entry)
+	} else if entry.IsDirectoryKeyObject() {
 		vc.processExplicitDirectory(entryPath, entry)
 	}
 
@@ -881,6 +1016,12 @@ func (vc *versionCollector) processDirectory(currentPath, entryPath string, entr
 		return nil
 	}
 
+	// Once the page is full, a subtree whose keys all sort above maxKey cannot
+	// contribute to it.
+	if bound, bounded := vc.collectBound(entryPath); vc.isFull() && bounded && bound == "" {
+		return nil
+	}
+
 	// Recursively search subdirectory
 	fullPath := path.Join(currentPath, entry.Name)
 	if err := vc.collectVersions(fullPath, entryPath); err != nil {
@@ -890,26 +1031,25 @@ func (vc *versionCollector) processDirectory(currentPath, entryPath string, entr
 	return nil
 }
 
-// getObjectVersionList returns all versions of a specific object
+// getObjectVersionList returns all versions of a specific object.
+// versionsEntry is the object's .versions directory entry, which every caller
+// already holds from listing the parent directory - re-fetching it here would
+// cost one extra filer round-trip per object listed.
 // Uses pagination to handle objects with more than 1000 versions
-func (s3a *S3ApiServer) getObjectVersionList(bucket, object string) ([]*ObjectVersion, error) {
+func (vc *versionCollector) getObjectVersionList(object string, versionsEntry *filer_pb.Entry) ([]*ObjectVersion, error) {
 	var versions []*ObjectVersion
 
-	glog.V(2).Infof("getObjectVersionList: looking for versions of %s/%s in .versions directory", bucket, object)
-
-	// All versions are now stored in the .versions directory only
-	bucketDir := s3a.bucketDir(bucket)
-	versionsObjectPath := object + s3_constants.VersionsFolder
-	glog.V(2).Infof("getObjectVersionList: checking versions directory %s", versionsObjectPath)
-
-	// Get the .versions directory entry to read latest version metadata
-	versionsEntry, err := s3a.getEntry(bucketDir, versionsObjectPath)
-	if err != nil {
-		// No versions directory exists, return empty list
-		glog.V(2).Infof("getObjectVersionList: no versions directory found: %v", err)
+	// A nil entry means the .versions directory is absent: no versions, the
+	// same empty result the internal lookup used to produce.
+	if versionsEntry == nil {
 		return versions, nil
 	}
 
+	// All versions are now stored in the .versions directory only
+	bucketDir := vc.s3a.bucketDir(vc.bucket)
+	versionsObjectPath := object + s3_constants.VersionsFolder
+	glog.V(2).Infof("getObjectVersionList: looking for versions of %s/%s in %s", vc.bucket, object, versionsObjectPath)
+
 	// Get the latest version info from directory metadata
 	var latestVersionId string
 	if versionsEntry.Extended != nil {
@@ -929,7 +1069,7 @@ func (s3a *S3ApiServer) getObjectVersionList(bucket, object string) ([]*ObjectVe
 	totalEntries := 0
 
 	for {
-		entries, isLast, err := s3a.list(versionsDir, "", startFrom, false, pageSize)
+		entries, isLast, err := vc.list(versionsDir, "", startFrom, false, pageSize)
 		if err != nil {
 			glog.Warningf("getObjectVersionList: failed to list version files in %s: %v", versionsDir, err)
 			return nil, err
@@ -956,7 +1096,7 @@ func (s3a *S3ApiServer) getObjectVersionList(bucket, object string) ([]*ObjectVe
 
 			// Check for duplicate version IDs and skip if already seen
 			if seenVersionIds[versionId] {
-				glog.Warningf("getObjectVersionList: duplicate version ID %s detected for object %s/%s, skipping", versionId, bucket, object)
+				glog.Warningf("getObjectVersionList: duplicate version ID %s detected for object %s/%s, skipping", versionId, vc.bucket, object)
 				continue
 			}
 			seenVersionIds[versionId] = true
@@ -981,7 +1121,7 @@ func (s3a *S3ApiServer) getObjectVersionList(bucket, object string) ([]*ObjectVe
 				IsDeleteMarker: isDeleteMarker,
 				LastModified:   time.Unix(entry.Attributes.Mtime, 0),
 				OwnerID:        ownerID,
-				StorageClass:   s3a.getStorageClassFromExtended(entry.Extended),
+				StorageClass:   vc.s3a.getStorageClassFromExtended(entry.Extended),
 			}
 
 			if !isDeleteMarker {
@@ -993,7 +1133,7 @@ func (s3a *S3ApiServer) getObjectVersionList(bucket, object string) ([]*ObjectVe
 					}
 				} else {
 					// Fallback: calculate ETag from chunks
-					version.ETag = s3a.calculateETagFromChunks(entry.Chunks)
+					version.ETag = vc.s3a.calculateETagFromChunks(entry.Chunks)
 				}
 				version.Size = int64(entry.Attributes.FileSize)
 			}
@@ -1012,7 +1152,7 @@ func (s3a *S3ApiServer) getObjectVersionList(bucket, object string) ([]*ObjectVe
 
 	// Don't sort here - let the main listObjectVersions function handle sorting consistently
 
-	glog.V(2).Infof("getObjectVersionList: returning %d total versions for %s/%s (after deduplication from %d entries)", len(versions), bucket, object, totalEntries)
+	glog.V(2).Infof("getObjectVersionList: returning %d total versions for %s/%s (after deduplication from %d entries)", len(versions), vc.bucket, object, totalEntries)
 	for i, version := range versions {
 		glog.V(2).Infof("getObjectVersionList: version %d: %s (isLatest=%v, isDeleteMarker=%v)", i, version.VersionId, version.IsLatest, version.IsDeleteMarker)
 	}
@@ -1055,6 +1195,9 @@ func (s3a *S3ApiServer) getSpecificObjectVersion(bucket, object, versionId strin
 		if err != nil {
 			return nil, fmt.Errorf("null version object %s not found: %w", normalizedObject, err)
 		}
+		if !isNullVersionObject(entry, normalizedObject) {
+			return nil, fmt.Errorf("null version object %s not found: %w", normalizedObject, filer_pb.ErrNotFound)
+		}
 		return entry, nil
 	}
 
@@ -1097,8 +1240,11 @@ func (s3a *S3ApiServer) deleteSpecificObjectVersion(ctx context.Context, bucket,
 			return nil
 		}
 
-		// Delete the regular file
-		deleteErr := s3a.rmObject(bucketDir, normalizedObject, !metadataOnly, false)
+		// Delete the regular file. rmObject takes a parent and a name, and the demote
+		// it falls back to for an entry other keys are nested under writes the entry
+		// back under that parent - so a key with a slash in it has to be split first.
+		dir, name := util.NewFullPath(bucketDir, normalizedObject).DirAndName()
+		deleteErr := s3a.rmObject(ctx, dir, name, !metadataOnly, false)
 		if deleteErr != nil {
 			// Check if file was already deleted by another process
 			if _, checkErr := s3a.getEntry(bucketDir, normalizedObject); checkErr != nil {
@@ -1147,7 +1293,7 @@ func (s3a *S3ApiServer) deleteSpecificObjectVersion(ctx context.Context, bucket,
 	// Attempt to delete the version file
 	// Note: We don't check if the file exists first to avoid race conditions
 	// The deletion operation should be idempotent
-	deleteErr := s3a.rm(versionsDir, versionFile, !metadataOnly, false)
+	deleteErr := s3a.rm(ctx, versionsDir, versionFile, !metadataOnly, false)
 	if deleteErr != nil {
 		// Check if file was already deleted by another process (race condition handling)
 		if _, checkErr := s3a.getEntry(versionsDir, versionFile); checkErr != nil {
@@ -1166,7 +1312,7 @@ func (s3a *S3ApiServer) deleteSpecificObjectVersion(ctx context.Context, bucket,
 		// down. Non-recursive: any orphan from older code paths leaves
 		// the directory in place for the empty-folder cleaner or our
 		// reconciler to handle.
-		if rmErr := s3a.rm(s3a.bucketDir(bucket), normalizedObject+s3_constants.VersionsFolder, true, false); rmErr != nil {
+		if rmErr := s3a.rm(ctx, s3a.bucketDir(bucket), normalizedObject+s3_constants.VersionsFolder, true, false); rmErr != nil {
 			glog.V(2).Infof("deleteSpecificObjectVersion: deferring .versions/ teardown for %s/%s: %v", bucket, normalizedObject, rmErr)
 		}
 	case isLatestVersion && !prePointerRolled:
@@ -1330,14 +1476,64 @@ func (s3a *S3ApiServer) repointLatestBeforeDeletion(ctx context.Context, bucket,
 
 // retryAttempts and retryStep tune the bounded retries used when the
 // load-bearing filer ops in updateLatestVersionAfterDeletion fail with
-// transient errors. Doubled per attempt, capped at retryCap. Total
-// worst-case wall time ≈ 6.3s before propagating.
+// transient errors. Doubled per attempt, capped at retryCap, for a
+// worst case of ~3.1s of backoff per op before propagating.
 const (
 	updateLatestRetryAttempts = 6
 	updateLatestRetryStep     = 100 * time.Millisecond
 	updateLatestRetryCap      = 2 * time.Second
 )
 
+func retryFilerBackoff(attempt int) time.Duration {
+	backoff := updateLatestRetryStep << (attempt - 1)
+	if backoff <= 0 || backoff > updateLatestRetryCap {
+		return updateLatestRetryCap
+	}
+	return backoff
+}
+
+// filerRetryRequestBudget is the total backoff one request may spend across
+// every retryFilerOp it drives: the worst case of a single op, so a batch
+// whose length the client chooses waits about as long as one key would.
+var filerRetryRequestBudget = func() (total time.Duration) {
+	for attempt := 1; attempt < updateLatestRetryAttempts; attempt++ {
+		total += retryFilerBackoff(attempt)
+	}
+	return total
+}()
+
+type filerRetryBudgetKey struct{}
+
+type filerRetryBudget struct {
+	mu        sync.Mutex
+	remaining time.Duration
+}
+
+// withFilerRetryBudget hands every retryFilerOp reached through ctx one shared
+// allowance, so per-key backoff no longer multiplies by the number of keys.
+func withFilerRetryBudget(ctx context.Context, total time.Duration) context.Context {
+	return context.WithValue(ctx, filerRetryBudgetKey{}, &filerRetryBudget{remaining: total})
+}
+
+func filerRetryBudgetFrom(ctx context.Context) *filerRetryBudget {
+	budget, _ := ctx.Value(filerRetryBudgetKey{}).(*filerRetryBudget)
+	return budget
+}
+
+// take reserves up to d of what is left, reporting false once nothing is.
+func (b *filerRetryBudget) take(d time.Duration) (time.Duration, bool) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.remaining <= 0 {
+		return 0, false
+	}
+	if d > b.remaining {
+		d = b.remaining
+	}
+	b.remaining -= d
+	return d, true
+}
+
 // isRetryableFilerErr reports whether err is worth retrying through
 // retryFilerOp. Terminal conditions return false so the caller surfaces
 // them immediately without the backoff delay or the retry-budget
@@ -1346,6 +1542,8 @@ const (
 //   - NotFound: the entry genuinely doesn't exist. Retrying won't make
 //     it appear, and callers (e.g. repointLatestBeforeDeletion) want
 //     to act on this directly.
+//   - non-empty folder: the filer looked and the children are there, so
+//     the answer will not change; callers act on it directly too.
 //   - context.Canceled / DeadlineExceeded: the request was aborted by
 //     the client or hit a deadline. Continuing to retry just delays
 //     the failure return.
@@ -1356,18 +1554,24 @@ func isRetryableFilerErr(err error) bool {
 	if err == nil {
 		return false
 	}
-	if errors.Is(err, filer_pb.ErrNotFound) || status.Code(err) == codes.NotFound {
+	if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, filer.ErrNonEmptyFolder) {
 		return false
 	}
 	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 		return false
 	}
+	// the same conditions once they have crossed gRPC, where a cancelled
+	// context arrives as a status and no longer matches the sentinel above
+	switch status.Code(err) {
+	case codes.NotFound, codes.Canceled, codes.DeadlineExceeded:
+		return false
+	}
 	return true
 }
 
 func retryFilerOp(ctx context.Context, name string, fn func() error) error {
 	var lastErr error
-	backoff := updateLatestRetryStep
+	budget := filerRetryBudgetFrom(ctx)
 	for attempt := 1; attempt <= updateLatestRetryAttempts; attempt++ {
 		err := fn()
 		if err == nil {
@@ -1386,9 +1590,17 @@ func retryFilerOp(ctx context.Context, name string, fn func() error) error {
 		if attempt == updateLatestRetryAttempts {
 			break
 		}
+		backoff := retryFilerBackoff(attempt)
+		if budget != nil {
+			granted, ok := budget.take(backoff)
+			if !ok {
+				return fmt.Errorf("%s stopped after %d attempts, request retry allowance spent: %w", name, attempt, lastErr)
+			}
+			backoff = granted
+		}
 		// Context-aware backoff so a server shutdown / client
-		// disconnect cancels the worst-case ~6.3s retry budget
-		// immediately instead of blocking the goroutine.
+		// disconnect cancels the pending retries immediately
+		// instead of blocking the goroutine.
 		timer := time.NewTimer(backoff)
 		select {
 		case <-ctx.Done():
@@ -1396,10 +1608,6 @@ func retryFilerOp(ctx context.Context, name string, fn func() error) error {
 			return ctx.Err()
 		case <-timer.C:
 		}
-		backoff *= 2
-		if backoff > updateLatestRetryCap {
-			backoff = updateLatestRetryCap
-		}
 	}
 	return fmt.Errorf("%s exhausted %d retries: %w", name, updateLatestRetryAttempts, lastErr)
 }
@@ -1550,41 +1758,28 @@ func (s3a *S3ApiServer) updateLatestVersionAfterDeletion(ctx context.Context, bu
 		// object is correctly absent.
 		glog.V(2).Infof("updateLatestVersionAfterDeletion: no versions left for %s/%s, deleting .versions directory", bucket, object)
 
-		rmErr := s3a.rm(bucketDir, versionsObjectPath, true, false)
+		rmErr := s3a.rm(ctx, bucketDir, versionsObjectPath, true, false)
 		if rmErr == nil {
 			return nil
 		}
-		// Two ways rm can fail here: "non-empty folder" (orphan entries
-		// blocking the teardown — fall through to pointer clear) and a
-		// transient filer error (worth retrying). Distinguish by the
-		// canonical error substring; if we can't tell, treat as transient.
-		if strings.Contains(rmErr.Error(), filer.MsgFailDelNonEmptyFolder) {
+		// "non-empty folder" means orphan entries are blocking the
+		// teardown — fall through to the pointer clear. Anything else
+		// has already exhausted rm's own retries. Either way we still
+		// clear the stale pointer so readers get a clean miss; the
+		// directory can be tidied by the reconciler later.
+		if errors.Is(rmErr, filer.ErrNonEmptyFolder) {
 			glog.V(2).Infof("updateLatestVersionAfterDeletion: .versions/ for %s/%s still has orphan entries: %v", bucket, object, rmErr)
 			s3a.clearStaleLatestVersionPointer(bucket, object, bucketDir, versionsObjectPath, versionsEntry, "updateLatestVersionAfterDeletion")
 			return nil
 		}
-		// Transient — retry the rm a few times before giving up. Even
-		// if it ultimately fails, we still clear the stale pointer so
-		// readers get a clean miss; the directory can be tidied by the
-		// reconciler later.
-		retryErr := retryFilerOp(ctx, "updateLatestVersionAfterDeletion.rm", func() error {
-			return s3a.rm(bucketDir, versionsObjectPath, true, false)
-		})
-		if retryErr == nil {
-			return nil
-		}
-		if strings.Contains(retryErr.Error(), filer.MsgFailDelNonEmptyFolder) {
-			s3a.clearStaleLatestVersionPointer(bucket, object, bucketDir, versionsObjectPath, versionsEntry, "updateLatestVersionAfterDeletion")
-			return nil
-		}
-		versioningHealWarningf("teardown_failed", "bucket=%s key=%s err=%v (fell through to clearStale)", bucket, object, retryErr)
+		versioningHealWarningf("teardown_failed", "bucket=%s key=%s err=%v (fell through to clearStale)", bucket, object, rmErr)
 		if s3a.clearStaleLatestVersionPointer(bucket, object, bucketDir, versionsObjectPath, versionsEntry, "updateLatestVersionAfterDeletion") {
 			// Pointer is consistent again; reader will get NoSuchKey via
 			// the clean-miss path. Don't emit `produced` or enqueue the
 			// reconciler — there's no stranded state left to heal.
 			return nil
 		}
-		return fmt.Errorf("delete .versions directory: %w", retryErr)
+		return fmt.Errorf("delete .versions directory: %w", rmErr)
 	}
 
 	return nil
@@ -1660,20 +1855,34 @@ func (s3a *S3ApiServer) clearStaleLatestVersionPointer(bucket, object, bucketDir
 		// Already cleared by another path.
 		return true
 	}
-	if observedStaleId != "" && string(currentIdBytes) != observedStaleId {
+	// The live pointer must still be the stale one this clear observed. With an
+	// empty observed id, any pointer the re-fetch sees was promoted by a
+	// concurrent writer between the rescan and here — a pointer this clear
+	// never set out to remove, so leave it alone (the rescan's no-tagged-
+	// versions result only covered the pre-promotion directory).
+	if string(currentIdBytes) != observedStaleId {
 		glog.V(1).Infof("%s: skipping pointer clear for %s/%s, live pointer changed (observed=%s, current=%s)", caller, bucket, object, observedStaleId, string(currentIdBytes))
 		return false
 	}
 
-	delete(liveEntry.Extended, s3_constants.ExtLatestVersionIdKey)
-	delete(liveEntry.Extended, s3_constants.ExtLatestVersionFileNameKey)
-	clearCachedVersionMetadata(liveEntry.Extended)
-	if mkErr := s3a.mkFile(bucketDir, versionsObjectPath, liveEntry.Chunks, func(updatedEntry *filer_pb.Entry) {
-		updatedEntry.Extended = liveEntry.Extended
-		updatedEntry.Attributes = liveEntry.Attributes
-		updatedEntry.Chunks = liveEntry.Chunks
-	}); mkErr != nil {
-		versioningHealWarningf("clear_failed", "bucket=%s key=%s caller=%s err=%v", bucket, object, caller, mkErr)
+	expected := proto.Clone(liveEntry).(*filer_pb.Entry)
+	updated := proto.Clone(liveEntry).(*filer_pb.Entry)
+	delete(updated.Extended, s3_constants.ExtLatestVersionIdKey)
+	delete(updated.Extended, s3_constants.ExtLatestVersionFileNameKey)
+	clearCachedVersionMetadata(updated.Extended)
+	updated.Name = versionsObjectPath
+	if err := s3a.conditionalUpdateEntry(bucketDir, updated, expected); err != nil {
+		switch status.Code(err) {
+		case codes.FailedPrecondition:
+			// A writer moved the pointer after this heal's snapshot; its
+			// pointer stands.
+			glog.V(1).Infof("%s: skipping pointer clear for %s/%s, live entry changed", caller, bucket, object)
+		case codes.NotFound:
+			// The .versions entry vanished; nothing left to clear.
+			return true
+		default:
+			versioningHealWarningf("clear_failed", "bucket=%s key=%s caller=%s err=%v", bucket, object, caller, err)
+		}
 		return false
 	}
 	versioningHealInfof("healed", "bucket=%s key=%s mode=pointer_cleared caller=%s (orphan entries remain in .versions directory)", bucket, object, caller)
@@ -1697,20 +1906,18 @@ func (s3a *S3ApiServer) ListObjectVersionsHandler(w http.ResponseWriter, r *http
 	prefix := strings.TrimPrefix(originalPrefix, "/")
 	// Note: prefix is used for filtering relative to bucket root, so no leading slash needed
 
-	keyMarker := query.Get("key-marker")
+	keyMarker := decodeListContinuationToken(query.Get("key-marker"))
 	versionIdMarker := query.Get("version-id-marker")
 	delimiter := query.Get("delimiter")
 
-	maxKeysStr := query.Get("max-keys")
-	maxKeys := 1000
-	if maxKeysStr != "" {
-		if mk, err := strconv.Atoi(maxKeysStr); err == nil && mk > 0 {
-			maxKeys = mk
-		}
+	maxKeys, errCode := parseMaxKeys(query.Get("max-keys"))
+	if errCode != s3err.ErrNone {
+		s3err.WriteErrorResponse(w, r, errCode)
+		return
 	}
 
 	// List versions
-	result, err := s3a.listObjectVersions(bucket, prefix, keyMarker, versionIdMarker, delimiter, maxKeys)
+	result, err := s3a.listObjectVersions(bucket, prefix, keyMarker, versionIdMarker, delimiter, int(maxKeys))
 	if err != nil {
 		glog.Errorf("ListObjectVersionsHandler: %v", err)
 		s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
@@ -1729,6 +1936,28 @@ func (s3a *S3ApiServer) getLatestObjectVersion(bucket, object string) (*filer_pb
 	return s3a.doGetLatestObjectVersion(bucket, object, 8)
 }
 
+// lookupVersionsEntryWithRetry retries a .versions directory lookup, but only
+// for errors that can change on retry (isRetryableFilerErr). A definitive
+// NotFound is an answer, not a transient failure: retrying it walks the whole
+// backoff ladder (12.7s at 8 attempts) before the caller's pre-versioning
+// fallback gets to run, stalling every missing-key retention/tagging/ACL call.
+func lookupVersionsEntryWithRetry(lookup func() (*filer_pb.Entry, error), maxRetries int) (entry *filer_pb.Entry, err error) {
+	for attempt := 1; attempt <= maxRetries; attempt++ {
+		entry, err = lookup()
+		if err == nil || !isRetryableFilerErr(err) {
+			return entry, err
+		}
+
+		if attempt < maxRetries {
+			// Exponential backoff with higher base: 100ms, 200ms, 400ms, 800ms, 1600ms, 3200ms, 6400ms
+			delay := time.Millisecond * time.Duration(100*(1<<(attempt-1)))
+			time.Sleep(delay)
+		}
+	}
+	return entry, err
+}
+
+// doGetLatestObjectVersion resolves the latest real version or a matching regular-path null object.
 func (s3a *S3ApiServer) doGetLatestObjectVersion(bucket, object string, maxRetries int) (*filer_pb.Entry, error) {
 	// Normalize object path to ensure consistency with toFilerPath behavior
 	normalizedObject := s3_constants.NormalizeObjectKey(object)
@@ -1739,20 +1968,9 @@ func (s3a *S3ApiServer) doGetLatestObjectVersion(bucket, object string, maxRetri
 	glog.V(1).Infof("doGetLatestObjectVersion: looking for latest version of %s/%s (normalized: %s, retries: %d)", bucket, object, normalizedObject, maxRetries)
 
 	// Get the .versions directory entry to read latest version metadata with retry logic for filer consistency
-	var versionsEntry *filer_pb.Entry
-	var err error
-	for attempt := 1; attempt <= maxRetries; attempt++ {
-		versionsEntry, err = s3a.getEntry(bucketDir, versionsObjectPath)
-		if err == nil {
-			break
-		}
-
-		if attempt < maxRetries {
-			// Exponential backoff with higher base: 100ms, 200ms, 400ms, 800ms, 1600ms, 3200ms, 6400ms
-			delay := time.Millisecond * time.Duration(100*(1<<(attempt-1)))
-			time.Sleep(delay)
-		}
-	}
+	versionsEntry, err := lookupVersionsEntryWithRetry(func() (*filer_pb.Entry, error) {
+		return s3a.getEntry(bucketDir, versionsObjectPath)
+	}, maxRetries)
 
 	if err != nil {
 		// .versions directory doesn't exist - this can happen for objects that existed
@@ -1765,6 +1983,9 @@ func (s3a *S3ApiServer) doGetLatestObjectVersion(bucket, object string, maxRetri
 			glog.V(1).Infof("getLatestObjectVersion: no pre-versioning object found for %s/%s (error: %v)", bucket, normalizedObject, regularErr)
 			return nil, fmt.Errorf("failed to get %s/%s .versions directory and no regular object found: %w", bucket, normalizedObject, err)
 		}
+		if !isNullVersionObject(regularEntry, normalizedObject) {
+			return nil, fmt.Errorf("no regular object found for %s/%s: %w", bucket, normalizedObject, filer_pb.ErrNotFound)
+		}
 
 		glog.V(1).Infof("getLatestObjectVersion: found pre-versioning object for %s/%s", bucket, normalizedObject)
 		return regularEntry, nil
@@ -1838,7 +2059,7 @@ func (s3a *S3ApiServer) doGetLatestObjectVersion(bucket, object string, maxRetri
 func (s3a *S3ApiServer) recoverLatestVersionWithoutPointer(bucket, normalizedObject string, versionsEntry *filer_pb.Entry) (*filer_pb.Entry, error) {
 	bucketDir := s3a.bucketDir(bucket)
 
-	if regularEntry, regularErr := s3a.getEntry(bucketDir, normalizedObject); regularErr == nil {
+	if regularEntry, regularErr := s3a.getEntry(bucketDir, normalizedObject); regularErr == nil && isNullVersionObject(regularEntry, normalizedObject) {
 		return regularEntry, nil
 	}
 
@@ -1901,6 +2122,9 @@ func selectLatestVersion(entries []*filer_pb.Entry) (latestEntry *filer_pb.Entry
 	return
 }
 
+// entryLister is the shared signature of s3a.list and versionCollector.list.
+type entryLister func(parentDirectoryPath, prefix, startFrom string, inclusive bool, limit uint32) (entries []*filer_pb.Entry, isLast bool, err error)
+
 // scanLatestVersionEntry paginates a .versions/ directory and returns the
 // chronologically newest version entry (including delete markers; see
 // selectLatestVersion). A single-shot list would miss the true latest when
@@ -1908,9 +2132,13 @@ func selectLatestVersion(entries []*filer_pb.Entry) (latestEntry *filer_pb.Entry
 // order is lexicographic-ascending = oldest-first for that format. latestEntry
 // is nil when the directory holds no version entries.
 func (s3a *S3ApiServer) scanLatestVersionEntry(versionsDir string) (latestEntry *filer_pb.Entry, latestVersionId, latestVersionFileName string, isDeleteMarker bool, err error) {
+	return scanLatestVersionEntry(s3a.list, versionsDir)
+}
+
+func scanLatestVersionEntry(list entryLister, versionsDir string) (latestEntry *filer_pb.Entry, latestVersionId, latestVersionFileName string, isDeleteMarker bool, err error) {
 	startFrom := ""
 	for {
-		entries, isLast, listErr := s3a.list(versionsDir, "", startFrom, false, filer.PaginationSize)
+		entries, isLast, listErr := list(versionsDir, "", startFrom, false, filer.PaginationSize)
 		if listErr != nil {
 			return nil, "", "", false, fmt.Errorf("list %s: %w", versionsDir, listErr)
 		}
@@ -1933,11 +2161,13 @@ func (s3a *S3ApiServer) scanLatestVersionEntry(versionsDir string) (latestEntry
 // healStaleLatestVersionPointer is invoked when the .versions directory metadata
 // points to a version file that no longer exists. It paginates the directory,
 // picks the chronologically newest remaining entry (content version or delete
-// marker), updates the directory pointer metadata best-effort, and returns the
-// rescanned entry. Downstream handlers detect ExtDeleteMarkerKey on the
-// returned entry and render NoSuchKey, so promoting a delete marker preserves
-// correct S3 semantics. If no version-tagged entry remains an error is
-// returned and the caller surfaces it as not found.
+// marker), updates the directory pointer metadata best-effort — atomically
+// guarded by an IF_ENTRY_EQUAL precondition, so a pointer a concurrent writer
+// advanced in the meantime is left alone — and returns the rescanned entry.
+// Downstream handlers detect ExtDeleteMarkerKey on the returned entry and
+// render NoSuchKey, so promoting a delete marker preserves correct S3
+// semantics. If no version-tagged entry remains an error is returned and the
+// caller surfaces it as not found.
 func (s3a *S3ApiServer) healStaleLatestVersionPointer(bucket, normalizedObject string, versionsEntry *filer_pb.Entry, stalePointerFile string) (*filer_pb.Entry, error) {
 	bucketDir := s3a.bucketDir(bucket)
 	versionsObjectPath := normalizedObject + s3_constants.VersionsFolder
@@ -1967,7 +2197,7 @@ func (s3a *S3ApiServer) healStaleLatestVersionPointer(bucket, normalizedObject s
 		// non-recursive rm makes this safe against a concurrent PUT — a new
 		// child fails the rm, and a directory removed just before that PUT's
 		// version file lands is recreated by the create's parent handling.
-		if rmErr := s3a.rm(bucketDir, versionsObjectPath, true, false); rmErr == nil {
+		if rmErr := s3a.rm(context.Background(), bucketDir, versionsObjectPath, true, false); rmErr == nil {
 			versioningHealInfof("healed", "bucket=%s key=%s mode=empty_dir_removed", bucket, normalizedObject)
 		} else {
 			// Orphan entries (files in .versions/ that lack the version-id
@@ -1983,28 +2213,102 @@ func (s3a *S3ApiServer) healStaleLatestVersionPointer(bucket, normalizedObject s
 		return nil, fmt.Errorf("%w: no remaining version in %s", filer_pb.ErrNotFound, versionsDir)
 	}
 
-	if versionsEntry.Extended == nil {
-		versionsEntry.Extended = make(map[string][]byte)
+	// The persist is CAS-style (mirroring clearStaleLatestVersionPointer) so a
+	// stale repair cannot supersede a concurrent writer: the rescan takes time,
+	// during which a PUT or delete may have atomically advanced the pointer on
+	// the owner filer. Re-fetch the live .versions entry and require its pointer
+	// fields to still match the ones this heal observed when it decided the
+	// pointer was unusable. If they moved, abandon the persist — this read
+	// still returns the scanned entry, and the winner's pointer needs no
+	// repair. Write the live Extended map so fields a concurrent writer
+	// updated between the re-fetch and the persist are preserved.
+	liveEntry, liveErr := s3a.getEntry(bucketDir, versionsObjectPath)
+	if liveErr != nil {
+		// The directory is gone (e.g. a concurrent delete's teardown); nothing
+		// to repair, and this read still returns the scanned entry.
+		versioningHealInfof("abandoned", "bucket=%s key=%s mode=versions_dir_gone err=%v", bucket, normalizedObject, liveErr)
+		return latestEntry, nil
+	}
+	observedId := string(versionsEntry.Extended[s3_constants.ExtLatestVersionIdKey])
+	observedFile := string(versionsEntry.Extended[s3_constants.ExtLatestVersionFileNameKey])
+	liveId := string(liveEntry.Extended[s3_constants.ExtLatestVersionIdKey])
+	liveFile := string(liveEntry.Extended[s3_constants.ExtLatestVersionFileNameKey])
+	if liveId != observedId || liveFile != observedFile {
+		// A concurrent writer promoted the pointer between the heal's snapshot
+		// and this check; rolling it back to the scanned version would make
+		// older content or ACLs current again.
+		versioningHealInfof("abandoned", "bucket=%s key=%s mode=pointer_moved observed_id=%s live_id=%s", bucket, normalizedObject, observedId, liveId)
+		return latestEntry, nil
 	}
-	versionsEntry.Extended[s3_constants.ExtLatestVersionIdKey] = []byte(latestVersionId)
-	versionsEntry.Extended[s3_constants.ExtLatestVersionFileNameKey] = []byte(latestVersionFileName)
-	setCachedListMetadata(versionsEntry, latestEntry)
 
-	if mkErr := s3a.mkFile(bucketDir, versionsObjectPath, versionsEntry.Chunks, func(updatedEntry *filer_pb.Entry) {
-		updatedEntry.Extended = versionsEntry.Extended
-		updatedEntry.Attributes = versionsEntry.Attributes
-		updatedEntry.Chunks = versionsEntry.Chunks
-	}); mkErr != nil {
+	// Clone the live image before any mutation so the precondition compares
+	// against exactly what the filer stores (nil and empty Extended maps are
+	// not proto-equal).
+	expected := proto.Clone(liveEntry).(*filer_pb.Entry)
+	updated := proto.Clone(liveEntry).(*filer_pb.Entry)
+	if updated.Extended == nil {
+		updated.Extended = make(map[string][]byte)
+	}
+	updated.Name = versionsObjectPath
+	updated.Extended[s3_constants.ExtLatestVersionIdKey] = []byte(latestVersionId)
+	updated.Extended[s3_constants.ExtLatestVersionFileNameKey] = []byte(latestVersionFileName)
+	setCachedListMetadata(updated, latestEntry)
+
+	updateErr := s3a.conditionalUpdateEntry(bucketDir, updated, expected)
+	switch {
+	case updateErr == nil:
+		versioningHealInfof("healed", "bucket=%s key=%s mode=pointer_repaired new_version=%s file=%s delete_marker=%v", bucket, normalizedObject, latestVersionId, latestVersionFileName, isDeleteMarker)
+	case status.Code(updateErr) == codes.FailedPrecondition, status.Code(updateErr) == codes.NotFound:
+		// The filer refused the stale repair: the live entry changed between
+		// the re-fetch and the persist, so the winner's pointer stands.
+		versioningHealInfof("abandoned", "bucket=%s key=%s mode=entry_changed err=%v", bucket, normalizedObject, updateErr)
+	default:
 		// Persisting the repair is best-effort. Surface a warning but still
 		// return the rescanned entry so the read succeeds; a subsequent write
 		// on the object will persist a fresh pointer.
-		versioningHealWarningf("heal_persist_failed", "bucket=%s key=%s err=%v (returning rescanned entry)", bucket, normalizedObject, mkErr)
-	} else {
-		versioningHealInfof("healed", "bucket=%s key=%s mode=pointer_repaired new_version=%s file=%s delete_marker=%v", bucket, normalizedObject, latestVersionId, latestVersionFileName, isDeleteMarker)
+		versioningHealWarningf("heal_persist_failed", "bucket=%s key=%s err=%v (returning rescanned entry)", bucket, normalizedObject, updateErr)
 	}
 	return latestEntry, nil
 }
 
+// conditionalUpdateEntry persists entry only while the stored image still
+// equals expected: the filer evaluates IF_ENTRY_EQUAL under the entry's path
+// lock, and conditional writes route to the owner filer, so a writer
+// committing between the caller's snapshot and this update fails the
+// precondition instead of being rolled back. FailedPrecondition and NotFound
+// are authoritative replies, not transport failures — they return without
+// retrying or marking the filer down.
+func (s3a *S3ApiServer) conditionalUpdateEntry(directory string, entry, expected *filer_pb.Entry) error {
+	req := &filer_pb.UpdateEntryRequest{
+		Directory: directory,
+		Entry:     entry,
+		Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{{
+			Kind:          filer_pb.WriteCondition_IF_ENTRY_EQUAL,
+			ExpectedEntry: expected,
+		}}},
+	}
+	var conditionErr error
+	update := func(client filer_pb.SeaweedFilerClient) error {
+		err := filer_pb.UpdateEntry(context.Background(), client, req)
+		if wrapped := errors.Unwrap(err); wrapped != nil {
+			// The helper wraps the RPC error ("UpdateEntry: %w"); unwrap so
+			// the status code below survives the wrapping.
+			err = wrapped
+		}
+		switch status.Code(err) {
+		case codes.FailedPrecondition, codes.NotFound:
+			conditionErr = err
+			return nil
+		default:
+			return err
+		}
+	}
+	if err := s3a.WithFilerClient(false, update); err != nil {
+		return err
+	}
+	return conditionErr
+}
+
 // getLatestVersionEntryFromDirectoryEntry creates a logical entry for list operations using cached metadata
 // from the .versions directory entry. This achieves SINGLE-SCAN efficiency - no additional getEntry calls needed.
 //
@@ -2029,7 +2333,7 @@ func (s3a *S3ApiServer) getLatestVersionEntryFromDirectoryEntry(bucket, object s
 	// here). Indexing a nil Extended map is safe and yields !ok.
 	latestVersionIdBytes, hasLatestVersionId := versionsDirEntry.Extended[s3_constants.ExtLatestVersionIdKey]
 	if !hasLatestVersionId {
-		return s3a.recoverLatestListEntryByScan(bucket, normalizedObject)
+		return s3a.recoverLatestListEntryByScan(bucket, normalizedObject, nullVersionIsLatest(versionsDirEntry))
 	}
 
 	// Check if this is a delete marker (should not be shown in regular list)
@@ -2095,7 +2399,7 @@ func (s3a *S3ApiServer) getLatestVersionEntryFromDirectoryEntry(bucket, object s
 	// Fallback: fetch version file if cached metadata not available (for older versions)
 	latestVersionFileBytes, hasLatestVersionFile := versionsDirEntry.Extended[s3_constants.ExtLatestVersionFileNameKey]
 	if !hasLatestVersionFile {
-		return s3a.recoverLatestListEntryByScan(bucket, normalizedObject)
+		return s3a.recoverLatestListEntryByScan(bucket, normalizedObject, nullVersionIsLatest(versionsDirEntry))
 	}
 	latestVersionFile := string(latestVersionFileBytes)
 
@@ -2128,6 +2432,26 @@ func (s3a *S3ApiServer) getLatestVersionEntryFromDirectoryEntry(bucket, object s
 	return logicalEntry, nil
 }
 
+// nullObjectWins decides, with no latest-version pointer and no null-is-latest
+// signal to consult, whether the base-path null object or the newest scanned
+// version is the current version: the newer mtime wins, and a tie goes to the
+// version, since second-resolution mtimes cannot order same-second writes and
+// an intentional null carries the ExtNullVersionIsLatestKey signal. The
+// NoncurrentSinceNs demotion stamp is deliberately not consulted: promotions
+// do not clear it, so it does not prove the null displaced the version.
+func nullObjectWins(regular, latest *filer_pb.Entry) bool {
+	if latest == nil {
+		return true
+	}
+	return regular.GetAttributes().GetMtime() > latest.GetAttributes().GetMtime()
+}
+
+// nullVersionIsLatest reports the explicit signal a suspended-versioning write
+// leaves on the .versions directory when the null object is current.
+func nullVersionIsLatest(versionsDirEntry *filer_pb.Entry) bool {
+	return versionsDirEntry != nil && string(versionsDirEntry.Extended[s3_constants.ExtNullVersionIsLatestKey]) == "true"
+}
+
 // recoverLatestListEntryByScan rebuilds an object's current-version list entry by
 // rescanning .versions/ when the cached latest-version pointer is missing on the
 // filer serving the list. This is the listing-path counterpart to the read path's
@@ -2139,20 +2463,27 @@ func (s3a *S3ApiServer) getLatestVersionEntryFromDirectoryEntry(bucket, object s
 // a write per diverged object); convergence is handled on the write/replication
 // side. Returns ErrDeleteMarker when the current version is a delete marker
 // (excluded from a regular listing) and filer_pb.ErrNotFound when nothing remains.
-func (s3a *S3ApiServer) recoverLatestListEntryByScan(bucket, normalizedObject string) (*filer_pb.Entry, error) {
+func (s3a *S3ApiServer) recoverLatestListEntryByScan(bucket, normalizedObject string, nullIsLatest bool) (*filer_pb.Entry, error) {
 	bucketDir := s3a.bucketDir(bucket)
 	versionsDir := bucketDir + "/" + normalizedObject + s3_constants.VersionsFolder
 
+	// An absent pointer can mean a suspended-versioning write made the null
+	// object current (the write clears the pointer and leaves the explicit
+	// nullIsLatest signal), or that the pointer has not replicated to this
+	// filer while the version files have.
+	regularEntry, regularErr := s3a.getEntry(bucketDir, normalizedObject)
+	if regularErr == nil && nullIsLatest {
+		return regularEntry, nil
+	}
+
 	latestEntry, latestVersionId, _, isDeleteMarker, err := s3a.scanLatestVersionEntry(versionsDir)
 	if err != nil {
 		return nil, err
 	}
+	if regularErr == nil && nullObjectWins(regularEntry, latestEntry) {
+		return regularEntry, nil
+	}
 	if latestEntry == nil {
-		// No version files remain. A pre-versioning / suspended "null" object at the
-		// base path is the current version if one exists.
-		if regularEntry, regularErr := s3a.getEntry(bucketDir, normalizedObject); regularErr == nil {
-			return regularEntry, nil
-		}
 		return nil, fmt.Errorf("%w: no current version for %s/%s", filer_pb.ErrNotFound, bucket, normalizedObject)
 	}
 	if isDeleteMarker {
@@ -2177,24 +2508,16 @@ func (s3a *S3ApiServer) recoverLatestListEntryByScan(bucket, normalizedObject st
 }
 
 // getObjectOwnerFromVersion extracts object owner information from version metadata
-func (s3a *S3ApiServer) getObjectOwnerFromVersion(version *ObjectVersion, bucket, objectKey string) CanonicalUser {
-	// First try to get owner from the version's OwnerID field (extracted during listing)
+// getObjectOwnerFromVersion resolves the owner recorded on a listed version.
+// OwnerID was extracted from the version entry's Extended metadata during
+// listing; an empty value means that entry carries no owner (data written
+// before owners were stamped), so re-fetching the same entry cannot answer
+// differently and would only add one filer round-trip per listed version.
+func (s3a *S3ApiServer) getObjectOwnerFromVersion(version *ObjectVersion) CanonicalUser {
 	if version.OwnerID != "" {
 		ownerDisplayName := s3a.iam.GetAccountNameById(version.OwnerID)
 		return CanonicalUser{ID: version.OwnerID, DisplayName: ownerDisplayName}
 	}
-
-	// Fallback: fetch the specific version entry to get the owner
-	// This handles cases where OwnerID wasn't populated during listing
-	if specificVersionEntry, err := s3a.getSpecificObjectVersion(bucket, objectKey, version.VersionId); err == nil && specificVersionEntry.Extended != nil {
-		if ownerBytes, exists := specificVersionEntry.Extended[s3_constants.ExtAmzOwnerKey]; exists {
-			ownerId := string(ownerBytes)
-			ownerDisplayName := s3a.iam.GetAccountNameById(ownerId)
-			return CanonicalUser{ID: ownerId, DisplayName: ownerDisplayName}
-		}
-	}
-
-	// Fallback: return anonymous if no owner found
 	return CanonicalUser{ID: s3_constants.AccountAnonymousId, DisplayName: "anonymous"}
 }
 
diff --git a/weed/s3api/s3api_object_versioning_heal_test.go b/weed/s3api/s3api_object_versioning_heal_test.go
new file mode 100644
index 0000000000..cb8b4b6906
--- /dev/null
+++ b/weed/s3api/s3api_object_versioning_heal_test.go
@@ -0,0 +1,214 @@
+package s3api
+
+import (
+	"context"
+	"net/http"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// anonymousReadHealFiler drives the versioned self-heal path for "folder/": it
+// serves a real version file from .versions, runs hooks at the heal's rescan
+// and at the persist (simulating a writer committing at either point), and
+// evaluates the heal's IF_ENTRY_EQUAL precondition like a filer would, so
+// tests can inspect the resulting .versions metadata.
+type anonymousReadHealFiler struct {
+	*anonymousReadFiler
+	onScan  func(*anonymousReadHealFiler)
+	onWrite func(*anonymousReadHealFiler)
+}
+
+// ListEntries serves the version files under .versions for the heal's rescan.
+func (f *anonymousReadHealFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream filer_pb.SeaweedFiler_ListEntriesServer) error {
+	f.mu.Lock()
+	if f.onScan != nil {
+		onScan := f.onScan
+		f.onScan = nil
+		f.mu.Unlock()
+		onScan(f)
+	} else {
+		f.mu.Unlock()
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, entry := range f.entries {
+		if path.Join(req.Directory, entry.Name) == "/buckets/b/folder/.versions/v_v1" {
+			if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: proto.Clone(entry).(*filer_pb.Entry)}); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// UpdateEntry evaluates the heal's IF_ENTRY_EQUAL precondition the way a
+// filer does under the path lock: the stored entry must still equal the live
+// image the heal re-read, otherwise the stale repair is rejected.
+func (f *anonymousReadHealFiler) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	f.mu.Lock()
+	if f.onWrite != nil {
+		onWrite := f.onWrite
+		f.onWrite = nil
+		f.mu.Unlock()
+		// A writer commits between the heal's re-fetch and the persist.
+		onWrite(f)
+	} else {
+		f.mu.Unlock()
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	fullPath := path.Join(req.Directory, req.Entry.Name)
+	current := f.entries[fullPath]
+	for _, clause := range req.Condition.Clauses {
+		if clause.Kind != filer_pb.WriteCondition_IF_ENTRY_EQUAL {
+			return nil, status.Error(codes.Unimplemented, "unsupported clause")
+		}
+		expected := proto.Clone(clause.ExpectedEntry).(*filer_pb.Entry)
+		actual := proto.Clone(current).(*filer_pb.Entry)
+		filer_pb.BeforeEntrySerialization(expected.Chunks)
+		filer_pb.BeforeEntrySerialization(actual.Chunks)
+		if !proto.Equal(actual, expected) {
+			return nil, status.Error(codes.FailedPrecondition, "entry changed")
+		}
+	}
+	f.entries[fullPath] = proto.Clone(req.Entry).(*filer_pb.Entry)
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+// TestAnonymousObjectACLHealPointerConcurrentWriter pins the CAS contract of
+// the self-heal persist: a pointer that a concurrent writer promoted while the
+// heal was rescanning, or between the heal's re-fetch and its persist, must
+// survive, instead of being rolled back to the scanned version, which would
+// make older content or ACLs current again.
+func TestAnonymousObjectACLHealPointerConcurrentWriter(t *testing.T) {
+	for _, tc := range []struct {
+		name               string
+		writerDuringScan   bool
+		writerDuringWrite  bool
+		wantPointer        string
+		wantPointerVersion string
+	}{
+		{name: "idle key persists the rescanned pointer", wantPointer: "v1", wantPointerVersion: "v_v1"},
+		{name: "concurrent writer during scan keeps its promotion", writerDuringScan: true, wantPointer: "v2", wantPointerVersion: "v_v2"},
+		{name: "concurrent writer during persist keeps its promotion", writerDuringWrite: true, wantPointer: "v3", wantPointerVersion: "v_v3"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			f := &anonymousReadHealFiler{anonymousReadFiler: &anonymousReadFiler{entries: make(map[string]*filer_pb.Entry)}}
+			// The object is "folder/"; the regular path is a physical parent, so a
+			// pointerless read falls through to the persistent self-heal.
+			f.entries["/buckets/b/folder"] = &filer_pb.Entry{Name: "folder", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: 1700000000}}
+			f.entries["/buckets/b/folder/child"] = anonymousReadEntry([]byte(`[]`))
+			f.entries["/buckets/b/folder/.versions"] = &filer_pb.Entry{Name: ".versions", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: 1700000000}, Extended: map[string][]byte{s3_constants.ExtLatestVersionIdKey: []byte("")}}
+			v1 := anonymousReadEntry([]byte(`[]`))
+			v1.Name = "v_v1"
+			v1.Extended[s3_constants.ExtVersionIdKey] = []byte("v1")
+			f.entries["/buckets/b/folder/.versions/v_v1"] = v1
+			promotePointer := func(versionId, fileName string) func(*anonymousReadHealFiler) {
+				return func(f *anonymousReadHealFiler) {
+					// A concurrent PUT commits a newer version.
+					f.mu.Lock()
+					defer f.mu.Unlock()
+					f.entries["/buckets/b/folder/.versions"].Extended[s3_constants.ExtLatestVersionIdKey] = []byte(versionId)
+					f.entries["/buckets/b/folder/.versions"].Extended[s3_constants.ExtLatestVersionFileNameKey] = []byte(fileName)
+				}
+			}
+			if tc.writerDuringScan {
+				f.onScan = promotePointer("v2", "v_v2")
+			}
+			if tc.writerDuringWrite {
+				f.onWrite = promotePointer("v3", "v_v3")
+			}
+			s3a := newPutTestServer(t, startFakeFiler(t, f))
+			s3a.iam = &IdentityAccessManagement{isAuthEnabled: true}
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set("b", &BucketConfig{Name: "b", Ownership: s3_constants.OwnershipObjectWriter, Versioning: "Enabled"})
+			s3a.policyEngine = NewBucketPolicyEngine()
+			s3a.iam.policyEngine = s3a.policyEngine
+			require.NoError(t, s3a.policyEngine.engine.SetBucketPolicy("b", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject*","Resource":"arn:aws:s3:::b/folder/"}]}`))
+
+			rr := serveAnonymousRead(s3a, http.MethodGet, "folder/", "", nil)
+			require.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+			// This read returns the rescanned entry either way.
+			require.Equal(t, "hello world", rr.Body.String())
+
+			// The persisted pointer must reflect the concurrent writer, not the scan.
+			pointer := f.entries["/buckets/b/folder/.versions"].Extended[s3_constants.ExtLatestVersionIdKey]
+			require.Equal(t, tc.wantPointer, string(pointer))
+			pointerFile := f.entries["/buckets/b/folder/.versions"].Extended[s3_constants.ExtLatestVersionFileNameKey]
+			require.Equal(t, tc.wantPointerVersion, string(pointerFile))
+		})
+	}
+}
+
+// TestClearStaleLatestVersionPointerConcurrentWriter pins the same CAS
+// contract on the pointer clear: a writer that promotes the pointer between
+// the clear's re-fetch and its persist must not be rolled back to a cleared
+// pointer. A pointerless caller snapshot must not clear a pointer a writer
+// promoted after the clear's rescan either — the only live pointer such a
+// clear can observe is one that appeared concurrently, never the stale one
+// the clear set out to remove.
+func TestClearStaleLatestVersionPointerConcurrentWriter(t *testing.T) {
+	for _, tc := range []struct {
+		name              string
+		observedEmpty     bool
+		writerDuringScan  bool
+		writerDuringWrite bool
+		wantCleared       bool
+		wantPointer       string
+	}{
+		{name: "idle key clears the stale pointer", wantCleared: true, wantPointer: ""},
+		{name: "concurrent writer during persist keeps its promotion", writerDuringWrite: true, wantCleared: false, wantPointer: "v2"},
+		{name: "pointerless snapshot keeps a post-rescan promotion", observedEmpty: true, writerDuringScan: true, wantCleared: false, wantPointer: "v2"},
+		{name: "pointerless snapshot on an idle key is already clear", observedEmpty: true, wantCleared: true, wantPointer: ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			f := &anonymousReadHealFiler{anonymousReadFiler: &anonymousReadFiler{entries: make(map[string]*filer_pb.Entry)}}
+			extended := map[string][]byte{
+				s3_constants.ExtLatestVersionIdKey:       []byte("v1"),
+				s3_constants.ExtLatestVersionFileNameKey: []byte("v_v1"),
+			}
+			if tc.observedEmpty {
+				extended = map[string][]byte{}
+			}
+			f.entries["/buckets/b/folder/.versions"] = &filer_pb.Entry{
+				Name:        ".versions",
+				IsDirectory: true,
+				Attributes:  &filer_pb.FuseAttributes{Mtime: 1700000000},
+				Extended:    extended,
+			}
+			promotePointer := func(f *anonymousReadHealFiler) {
+				f.mu.Lock()
+				defer f.mu.Unlock()
+				f.entries["/buckets/b/folder/.versions"].Extended[s3_constants.ExtLatestVersionIdKey] = []byte("v2")
+				f.entries["/buckets/b/folder/.versions"].Extended[s3_constants.ExtLatestVersionFileNameKey] = []byte("v_v2")
+			}
+			if tc.writerDuringScan {
+				f.onScan = promotePointer
+			}
+			if tc.writerDuringWrite {
+				f.onWrite = promotePointer
+			}
+			s3a := newPutTestServer(t, startFakeFiler(t, f))
+			versionsEntry := proto.Clone(f.entries["/buckets/b/folder/.versions"]).(*filer_pb.Entry)
+			if versionsEntry.Extended == nil {
+				// proto.Clone turns an empty Extended map into nil; real callers
+				// (updateLatestVersionAfterDeletion) hand the clear a non-nil
+				// snapshot, so mirror that here.
+				versionsEntry.Extended = map[string][]byte{}
+			}
+
+			cleared := s3a.clearStaleLatestVersionPointer("b", "folder", "/buckets/b", "folder/.versions", versionsEntry, "test")
+			require.Equal(t, tc.wantCleared, cleared)
+			pointer := f.entries["/buckets/b/folder/.versions"].Extended[s3_constants.ExtLatestVersionIdKey]
+			require.Equal(t, tc.wantPointer, string(pointer))
+		})
+	}
+}
diff --git a/weed/s3api/s3api_object_versioning_list_prefix_test.go b/weed/s3api/s3api_object_versioning_list_prefix_test.go
new file mode 100644
index 0000000000..94d064267b
--- /dev/null
+++ b/weed/s3api/s3api_object_versioning_list_prefix_test.go
@@ -0,0 +1,41 @@
+package s3api
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// The component handed to the filer must keep every entry that can match or
+// descend toward the requested prefix at that directory level, while excluding
+// siblings that cannot: a name holds no slash, so a directory not starting
+// with the component cannot contain a matching key.
+func TestComputeListPrefix(t *testing.T) {
+	cases := []struct {
+		prefix       string
+		relativePath string
+		want         string
+	}{
+		{"", "", ""},
+		{"", "a/b", ""},
+		{"a/b/c", "", "a"},
+		{"a/b/c", "a", "b"},
+		{"a/b/c", "a/b", "c"},
+		// at or inside the prefix zone: no constraint
+		{"a/b/c", "a/b/c", ""},
+		{"a/b/", "a/b", ""},
+		{"a", "a/sub", ""},
+		// partial component narrows the listing but keeps deeper matches
+		// ("a/bc" keeps dir "bc", file "bcd", and "bc.versions" at level "a")
+		{"a/bc", "a", "bc"},
+		{"abc", "", "abc"},
+		// a directory off the prefix path is inside the zone by construction
+		{"a/b/c", "x", ""},
+	}
+
+	for _, tc := range cases {
+		vc := &versionCollector{prefix: tc.prefix}
+		assert.Equal(t, tc.want, vc.computeListPrefix(tc.relativePath),
+			"prefix %q at %q", tc.prefix, tc.relativePath)
+	}
+}
diff --git a/weed/s3api/s3api_object_versioning_lookup_retry_test.go b/weed/s3api/s3api_object_versioning_lookup_retry_test.go
new file mode 100644
index 0000000000..e985e33f8d
--- /dev/null
+++ b/weed/s3api/s3api_object_versioning_lookup_retry_test.go
@@ -0,0 +1,62 @@
+package s3api
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// A definitive NotFound (or an aborted request) is an answer, not a transient
+// failure. Walking the full backoff ladder before the pre-versioning fallback
+// turned every missing-key GetObjectRetention into a 12.7s stall in the field.
+func TestLookupVersionsEntryTerminalErrorsSkipTheLadder(t *testing.T) {
+	for _, terminal := range []error{
+		filer_pb.ErrNotFound,
+		fmt.Errorf("wrapped: %w", filer_pb.ErrNotFound),
+		status.Error(codes.NotFound, "gone"),
+		context.Canceled,
+		status.Error(codes.DeadlineExceeded, "context deadline exceeded"),
+	} {
+		calls := 0
+		entry, err := lookupVersionsEntryWithRetry(func() (*filer_pb.Entry, error) {
+			calls++
+			return nil, terminal
+		}, 8)
+		assert.Nil(t, entry)
+		assert.Equal(t, terminal, err)
+		assert.Equal(t, 1, calls, "%v is definitive, no retry", terminal)
+	}
+}
+
+// Transient filer errors keep the original retry-with-backoff behavior.
+func TestLookupVersionsEntryTransientErrorsStillRetry(t *testing.T) {
+	want := &filer_pb.Entry{Name: "obj" + ".versions"}
+	calls := 0
+	entry, err := lookupVersionsEntryWithRetry(func() (*filer_pb.Entry, error) {
+		calls++
+		if calls < 3 {
+			return nil, status.Error(codes.Unavailable, "transport is closing")
+		}
+		return want, nil
+	}, 8)
+	assert.NoError(t, err)
+	assert.Same(t, want, entry)
+	assert.Equal(t, 3, calls)
+}
+
+// Exhausting the attempts surfaces the last transient error to the caller.
+func TestLookupVersionsEntryTransientExhaustionReturnsLastErr(t *testing.T) {
+	calls := 0
+	entry, err := lookupVersionsEntryWithRetry(func() (*filer_pb.Entry, error) {
+		calls++
+		return nil, status.Error(codes.Unavailable, "still down")
+	}, 2)
+	assert.Nil(t, entry)
+	assert.Error(t, err)
+	assert.Equal(t, 2, calls)
+}
diff --git a/weed/s3api/s3api_object_versioning_pagination_test.go b/weed/s3api/s3api_object_versioning_pagination_test.go
new file mode 100644
index 0000000000..91389ff89c
--- /dev/null
+++ b/weed/s3api/s3api_object_versioning_pagination_test.go
@@ -0,0 +1,152 @@
+package s3api
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// versionedDir builds the .versions directory entry of a versioned object whose
+// latest version has the given id.
+func versionedDir(object, latestVersionId string) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Name:        object + s3_constants.VersionsFolder,
+		IsDirectory: true,
+		Attributes:  &filer_pb.FuseAttributes{Mtime: time.Now().Unix()},
+		Extended: map[string][]byte{
+			s3_constants.ExtLatestVersionIdKey: []byte(latestVersionId),
+		},
+	}
+}
+
+// versionFile builds one version entry inside a .versions directory.
+func versionFile(versionId string, deleteMarker bool) *filer_pb.Entry {
+	e := &filer_pb.Entry{
+		Name:       "v_" + versionId,
+		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()},
+		Extended: map[string][]byte{
+			s3_constants.ExtVersionIdKey: []byte(versionId),
+		},
+	}
+	if deleteMarker {
+		e.Extended[s3_constants.ExtDeleteMarkerKey] = []byte("true")
+	}
+	return e
+}
+
+func listVersionsPage(t *testing.T, s3a *S3ApiServer, client filer_pb.SeaweedFilerClient, bucketDir string, maxKeys int, keyMarker, versionIdMarker string) ([]versionListItem, string, string, bool) {
+	t.Helper()
+	var allVersions []interface{}
+	vc := &versionCollector{
+		s3a:              s3a,
+		list:             clientLister(client),
+		getEntry:         clientLookup(client),
+		bucket:           "b",
+		keyMarker:        keyMarker,
+		versionIdMarker:  versionIdMarker,
+		maxCollect:       maxKeys + 1,
+		allVersions:      &allVersions,
+		processedObjects: map[string]bool{},
+		seenVersionIds:   map[string]bool{},
+		commonPrefixes:   map[string]bool{},
+	}
+	require.NoError(t, vc.collectVersions(bucketDir, ""))
+	combined := s3a.buildSortedCombinedList(allVersions, vc.commonPrefixes)
+	return s3a.truncateAndSetMarkers(combined, maxKeys)
+}
+
+// clientLister adapts a stubbed filer client to the collector's list function.
+func clientLister(client filer_pb.SeaweedFilerClient) entryLister {
+	return func(parentDirectoryPath, prefix, startFrom string, inclusive bool, limit uint32) (entries []*filer_pb.Entry, isLast bool, err error) {
+		err = filer_pb.SeaweedList(context.Background(), client, parentDirectoryPath, prefix, func(entry *filer_pb.Entry, isLastEntry bool) error {
+			entries = append(entries, entry)
+			if isLastEntry {
+				isLast = true
+			}
+			return nil
+		}, startFrom, inclusive, limit)
+		if len(entries) == 0 {
+			isLast = true
+		}
+		return
+	}
+}
+
+// clientLookup adapts a stubbed filer client to the collector's getEntry.
+func clientLookup(client filer_pb.SeaweedFilerClient) func(string, string) (*filer_pb.Entry, error) {
+	return func(dir, name string) (*filer_pb.Entry, error) {
+		resp, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{Directory: dir, Name: name})
+		if err != nil {
+			return nil, err
+		}
+		return resp.Entry, nil
+	}
+}
+
+func itemId(item versionListItem) string {
+	return item.key + ":" + item.versionId
+}
+
+// TestListObjectVersionsPagination covers issue 11594: "a.copy.versions" sorts
+// before "a.versions" in the filer even though key "a.copy" sorts after "a", so
+// cutting the walk at maxKeys+1 can put the later key on the first page and the
+// marker then skips the earlier key for good. Directory "d" and file "d.x"
+// exercise the mirror-image resume case: a marker on "d.x" must not skip the
+// subtree of "d", whose keys all sort after it.
+func TestListObjectVersionsPagination(t *testing.T) {
+	client := &testFilerClient{
+		entriesByDir: map[string][]*filer_pb.Entry{
+			"/buckets/b": {
+				newDir(".hidden"),
+				versionedDir("a.copy", "c2"),
+				versionedDir("a", "a2"),
+				newDir("d"),
+				{Name: "d.x", Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()}},
+			},
+			"/buckets/b/.hidden": {
+				versionedDir("file", "h1"),
+				versionedDir("z", "z1"),
+			},
+			"/buckets/b/.hidden/file.versions": {versionFile("h1", false)},
+			"/buckets/b/.hidden/z.versions":    {versionFile("z1", false)},
+			"/buckets/b/a.copy.versions":       {versionFile("c1", false), versionFile("c2", true)},
+			"/buckets/b/a.versions":            {versionFile("a1", false), versionFile("a2", false)},
+			"/buckets/b/d": {
+				versionedDir("f", "f1"),
+				versionedDir("g", "g1"),
+			},
+			"/buckets/b/d/f.versions": {versionFile("f1", false)},
+			"/buckets/b/d/g.versions": {versionFile("g1", false)},
+		},
+	}
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+
+	want, _, _, truncated := listVersionsPage(t, s3a, client, "/buckets/b", 100, "", "")
+	require.False(t, truncated)
+	wantIds := make([]string, 0, len(want))
+	for _, item := range want {
+		wantIds = append(wantIds, itemId(item))
+	}
+	require.Equal(t, []string{".hidden/file:h1", ".hidden/z:z1", "a:a2", "a:a1", "a.copy:c2", "a.copy:c1", "d.x:null", "d/f:f1", "d/g:g1"}, wantIds)
+
+	for maxKeys := 1; maxKeys <= len(wantIds)+1; maxKeys++ {
+		var got []string
+		keyMarker, versionIdMarker := "", ""
+		for i := 0; i < 20; i++ {
+			page, nextKey, nextVersion, trunc := listVersionsPage(t, s3a, client, "/buckets/b", maxKeys, keyMarker, versionIdMarker)
+			for _, item := range page {
+				got = append(got, itemId(item))
+			}
+			if !trunc {
+				break
+			}
+			keyMarker, versionIdMarker = nextKey, nextVersion
+		}
+		assert.Equal(t, wantIds, got, "maxKeys=%d", maxKeys)
+	}
+}
diff --git a/weed/s3api/s3api_path_validation.go b/weed/s3api/s3api_path_validation.go
index e95140291c..3e5d489c1c 100644
--- a/weed/s3api/s3api_path_validation.go
+++ b/weed/s3api/s3api_path_validation.go
@@ -39,6 +39,40 @@ func hasPathSegmentQuery(rawQuery string) bool {
 	return false
 }
 
+// operationSubresources are the query keys that select which operation a request
+// is, so at most one may appear. The router matches them in registration order
+// and the IAM action resolver in its own, so a request carrying two is
+// authorized as one operation and served as another: `PUT /bucket?policy&tagging`
+// authorizes as PutBucketTagging and runs PutBucketPolicy. Keys left out here
+// (versionId, partNumber, prefix, ...) modify an operation instead of selecting
+// one and may accompany any of these.
+var operationSubresources = map[string]bool{
+	"accelerate": true, "acl": true, "analytics": true, "attributes": true,
+	"cors": true, "delete": true, "encryption": true, "intelligent-tiering": true,
+	"inventory": true, "legal-hold": true, "lifecycle": true, "list-type": true,
+	"location": true, "logging": true, "metrics": true, "notification": true,
+	"object-lock": true, "ownershipControls": true, "policy": true, "policyStatus": true,
+	"publicAccessBlock": true, "renameObject": true, "replication": true,
+	"requestPayment": true, "retention": true, "seaweedfs-quota": true,
+	"tagging": true, "uploadId": true,
+	"uploads": true, "versioning": true, "versions": true, "website": true,
+}
+
+func hasAmbiguousSubresource(query url.Values) bool {
+	seen := 0
+	for key := range query {
+		// bucketQueryActions keys select an operation by definition, so they
+		// count even if operationSubresources was not updated for them.
+		if _, ok := bucketQueryActions[key]; !ok && !operationSubresources[key] {
+			continue
+		}
+		if seen++; seen > 1 {
+			return true
+		}
+	}
+	return false
+}
+
 func hasInvalidPathSegment(values []string) bool {
 	for _, value := range values {
 		if value != "" && !s3_constants.IsValidPathSegment(value) {
@@ -73,14 +107,20 @@ func validateRequestPath(next http.Handler) http.Handler {
 				return
 			}
 		}
-		// versionId and uploadId are later used as filer entry names. Avoid
-		// parsing every request's query while still recognizing encoded names.
-		if hasPathSegmentQuery(r.URL.RawQuery) {
+		if r.URL.RawQuery != "" {
 			query := r.URL.Query()
-			if hasInvalidPathSegment(query["versionId"]) || hasInvalidPathSegment(query["uploadId"]) {
+			if hasAmbiguousSubresource(query) {
 				s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
 				return
 			}
+			// versionId and uploadId are later used as filer entry names, and
+			// the encoded spelling of either still names one.
+			if hasPathSegmentQuery(r.URL.RawQuery) {
+				if hasInvalidPathSegment(query["versionId"]) || hasInvalidPathSegment(query["uploadId"]) {
+					s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+					return
+				}
+			}
 		}
 		next.ServeHTTP(w, r)
 	})
diff --git a/weed/s3api/s3api_put_handlers.go b/weed/s3api/s3api_put_handlers.go
index 825e2f904f..0b3a0b5f40 100644
--- a/weed/s3api/s3api_put_handlers.go
+++ b/weed/s3api/s3api_put_handlers.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 )
@@ -225,6 +226,28 @@ func (s3a *S3ApiServer) handleSSES3Encryption(r *http.Request, dataReader io.Rea
 	return encryptedReader, sseS3Key, sseS3Metadata, s3err.ErrNone
 }
 
+// storeSSEMetadata records the encryption result on the entry, in the same
+// extended attributes the GET and HEAD handlers read back.
+func storeSSEMetadata(entry *filer_pb.Entry, sseResult *PutToFilerEncryptionResult) {
+	if sseResult == nil {
+		return
+	}
+	if sseResult.CustomerKey != nil && len(sseResult.SSEIV) > 0 {
+		entry.Extended[s3_constants.SeaweedFSSSEIV] = sseResult.SSEIV
+		entry.Extended[s3_constants.AmzServerSideEncryptionCustomerAlgorithm] = []byte(s3_constants.SSEAlgorithmAES256)
+		entry.Extended[s3_constants.AmzServerSideEncryptionCustomerKeyMD5] = []byte(sseResult.CustomerKey.KeyMD5)
+	}
+	if sseResult.SSEKMSKey != nil {
+		entry.Extended[s3_constants.SeaweedFSSSEKMSKey] = sseResult.SSEKMSMetadata
+		entry.Extended[s3_constants.AmzServerSideEncryption] = []byte(s3_constants.SSEAlgorithmKMS)
+		entry.Extended[s3_constants.AmzServerSideEncryptionAwsKmsKeyId] = []byte(sseResult.SSEKMSKey.KeyID)
+	}
+	if sseResult.SSES3Key != nil && len(sseResult.SSES3Metadata) > 0 {
+		entry.Extended[s3_constants.SeaweedFSSSES3Key] = sseResult.SSES3Metadata
+		entry.Extended[s3_constants.AmzServerSideEncryption] = []byte(s3_constants.SSEAlgorithmAES256)
+	}
+}
+
 // handleAllSSEEncryption processes all SSE types in sequence and returns the final encrypted reader
 // This eliminates repetitive dataReader assignments and centralizes SSE processing
 func (s3a *S3ApiServer) handleAllSSEEncryption(r *http.Request, dataReader io.Reader, partOffset int64) (*PutToFilerEncryptionResult, s3err.ErrorCode) {
diff --git a/weed/s3api/s3api_put_object_helper.go b/weed/s3api/s3api_put_object_helper.go
index d020772e93..d6042aec55 100644
--- a/weed/s3api/s3api_put_object_helper.go
+++ b/weed/s3api/s3api_put_object_helper.go
@@ -1,6 +1,12 @@
 package s3api
 
 import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"hash"
 	"io"
 	"net/http"
 
@@ -8,28 +14,86 @@ import (
 )
 
 // getRequestDataReader returns the appropriate reader for the request body.
-// When IAM is disabled, it still processes chunked transfer encoding for
-// authTypeStreamingUnsigned to strip checksum headers and extract the actual data.
-// This fixes issues where chunked data with checksums would be stored incorrectly
-// when IAM is not enabled.
+// Chunked streaming uploads are decoded regardless of whether IAM is enabled;
+// with no credentials to verify against, signature checking is skipped inside
+// newChunkedReader.
 func getRequestDataReader(s3a *S3ApiServer, r *http.Request) (io.ReadCloser, s3err.ErrorCode) {
 	var s3ErrCode s3err.ErrorCode
 	dataReader := r.Body
 	rAuthType := getRequestAuthType(r)
-	if s3a.iam.isEnabled() {
-		if rAuthType == authTypeStreamingSigned || rAuthType == authTypeStreamingUnsigned {
-			dataReader, s3ErrCode = s3a.iam.newChunkedReader(r)
-		}
-	} else {
-		switch rAuthType {
-		case authTypeStreamingSigned:
-			s3ErrCode = s3err.ErrAuthNotSetup
-		case authTypeStreamingUnsigned:
-			// Even when IAM is disabled, we still need to handle chunked transfer encoding
-			// to strip checksum headers and process the data correctly
-			dataReader, s3ErrCode = s3a.iam.newChunkedReader(r)
-		}
+	if rAuthType == authTypeStreamingSigned || rAuthType == authTypeStreamingUnsigned {
+		dataReader, s3ErrCode = s3a.iam.newChunkedReader(r)
+	}
+	if s3ErrCode != s3err.ErrNone {
+		return nil, s3ErrCode
 	}
 
-	return dataReader, s3ErrCode
+	expected, valid := expectedContentSha256(r)
+	if !valid {
+		return nil, s3err.ErrInvalidArgument
+	}
+	if expected != nil && dataReader != nil {
+		if r.ContentLength == 0 {
+			// Handlers may never read an empty body, so check it now.
+			emptySum := sha256.Sum256(nil)
+			if !bytes.Equal(expected, emptySum[:]) {
+				return nil, s3err.ErrContentSHA256Mismatch
+			}
+			return dataReader, s3err.ErrNone
+		}
+		dataReader = &contentSha256Verifier{reader: dataReader, hasher: sha256.New(), expected: expected}
+	}
+	return dataReader, s3err.ErrNone
+}
+
+// expectedContentSha256 decodes the x-amz-content-sha256 header when it declares
+// a payload hash — hex or base64 per SigV4 — so the body can be checked as it
+// streams. Sentinel values (streaming, unsigned) carry no hash and are skipped;
+// anything that decodes to neither returns valid=false.
+func expectedContentSha256(r *http.Request) (expected []byte, valid bool) {
+	v := r.Header.Get("X-Amz-Content-Sha256")
+	if v == "" || v == unsignedPayload || v == streamingContentSHA256 ||
+		v == streamingContentSHA256Trailer || v == streamingUnsignedPayload {
+		return nil, true
+	}
+	if decoded, err := hex.DecodeString(v); err == nil && len(decoded) == sha256.Size {
+		return decoded, true
+	}
+	if decoded, err := base64.StdEncoding.DecodeString(v); err == nil && len(decoded) == sha256.Size {
+		return decoded, true
+	}
+	return nil, false
+}
+
+// contentSha256Verifier checks the decoded x-amz-content-sha256 once the stream
+// is exhausted; handlers that never consume the body are unaffected.
+type contentSha256Verifier struct {
+	reader   io.ReadCloser
+	hasher   hash.Hash
+	expected []byte
+	done     bool
+	pending  error
+}
+
+func (v *contentSha256Verifier) Read(p []byte) (int, error) {
+	if v.pending != nil {
+		return 0, v.pending
+	}
+	n, err := v.reader.Read(p)
+	v.hasher.Write(p[:n])
+	if err == io.EOF && !v.done {
+		v.done = true
+		if !bytes.Equal(v.hasher.Sum(nil), v.expected) {
+			v.pending = errors.New(s3err.ErrMsgContentSha256Mismatch)
+			err = nil
+		}
+	}
+	if n == 0 && v.pending != nil {
+		return 0, v.pending
+	}
+	return n, err
+}
+
+func (v *contentSha256Verifier) Close() error {
+	return v.reader.Close()
 }
diff --git a/weed/s3api/s3api_put_object_helper_test.go b/weed/s3api/s3api_put_object_helper_test.go
index 8e6565783c..292ce9dc7c 100644
--- a/weed/s3api/s3api_put_object_helper_test.go
+++ b/weed/s3api/s3api_put_object_helper_test.go
@@ -1,7 +1,13 @@
 package s3api
 
 import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"io"
 	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 
@@ -35,9 +41,9 @@ func TestGetRequestDataReader_ChunkedEncodingWithoutIAM(t *testing.T) {
 		{
 			name:          "StreamingSignedWithoutIAM",
 			contentSha256: "STREAMING-AWS4-HMAC-SHA256-PAYLOAD",
-			expectedError: s3err.ErrAuthNotSetup,
-			shouldProcess: false,
-			description:   "Streaming signed requests should fail when IAM is disabled",
+			expectedError: s3err.ErrNone,
+			shouldProcess: true,
+			description:   "Streaming signed requests are decoded when IAM is disabled; signatures are skipped since there is nothing to verify them against",
 		},
 		{
 			name:          "StreamingUnsignedWithoutIAM",
@@ -183,3 +189,126 @@ func TestAuthTypeDetection(t *testing.T) {
 		})
 	}
 }
+
+func sha256Hex(t *testing.T, b []byte) string {
+	t.Helper()
+	sum := sha256.Sum256(b)
+	return hex.EncodeToString(sum[:])
+}
+
+func TestExpectedContentSha256(t *testing.T) {
+	good := sha256Hex(t, []byte("payload"))
+
+	tests := []struct {
+		name      string
+		header    string
+		wantValid bool
+		wantNil   bool
+	}{
+		{"absent", "", true, true},
+		{"unsigned", unsignedPayload, true, true},
+		{"streaming signed", streamingContentSHA256, true, true},
+		{"streaming trailer", streamingContentSHA256Trailer, true, true},
+		{"streaming unsigned", streamingUnsignedPayload, true, true},
+		{"hex", good, true, false},
+		{"not hex", "nothex", false, true},
+		{"short hex", "deadbeef", false, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := httptest.NewRequest("PUT", "/b/o", nil)
+			if tt.header != "" {
+				r.Header.Set("X-Amz-Content-Sha256", tt.header)
+			}
+			got, valid := expectedContentSha256(r)
+			if valid != tt.wantValid {
+				t.Fatalf("valid=%v want %v", valid, tt.wantValid)
+			}
+			if (got == nil) != tt.wantNil {
+				t.Fatalf("expected nil=%v, got %x", tt.wantNil, got)
+			}
+		})
+	}
+
+	t.Run("base64 decodes to sha256", func(t *testing.T) {
+		sum := sha256.Sum256([]byte("payload"))
+		r := httptest.NewRequest("PUT", "/b/o", nil)
+		r.Header.Set("X-Amz-Content-Sha256", base64.StdEncoding.EncodeToString(sum[:]))
+		got, valid := expectedContentSha256(r)
+		if !valid || !bytes.Equal(got, sum[:]) {
+			t.Fatalf("valid=%v got=%x", valid, got)
+		}
+	})
+}
+
+func newVerifier(body string, expectedHex string) *contentSha256Verifier {
+	expected, _ := hex.DecodeString(expectedHex)
+	return &contentSha256Verifier{
+		reader:   io.NopCloser(strings.NewReader(body)),
+		hasher:   sha256.New(),
+		expected: expected,
+	}
+}
+
+func TestContentSha256VerifierMatch(t *testing.T) {
+	v := newVerifier("hello", sha256Hex(t, []byte("hello")))
+	got, err := io.ReadAll(v)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if string(got) != "hello" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestContentSha256VerifierMismatch(t *testing.T) {
+	v := newVerifier("hello", sha256Hex(t, []byte("other")))
+	_, err := io.ReadAll(v)
+	if err == nil || !strings.Contains(err.Error(), "does not match") {
+		t.Fatalf("expected mismatch error, got %v", err)
+	}
+	if _, err := v.Read(make([]byte, 8)); err == nil {
+		t.Fatal("expected error to persist")
+	}
+}
+
+// mimeDetect performs a single Read and ignores its error; the verifier must
+// defer the mismatch so a dropped (n>0, err) result still surfaces later.
+func TestContentSha256VerifierSurvivesDroppedError(t *testing.T) {
+	v := newVerifier("hello", sha256Hex(t, []byte("other")))
+	buf := make([]byte, 512)
+	n, _ := v.Read(buf)
+	rest := io.MultiReader(bytes.NewReader(buf[:n]), v)
+	_, err := io.ReadAll(rest)
+	if err == nil || !strings.Contains(err.Error(), "does not match") {
+		t.Fatalf("expected deferred mismatch error, got %v", err)
+	}
+}
+
+// A zero-length body never reaches the verifier, so the declared hash is
+// compared against the empty-payload digest up front.
+func TestGetRequestDataReaderEmptyBodyHash(t *testing.T) {
+	s3a := &S3ApiServer{
+		iam: NewIdentityAccessManagementWithStore(&S3ApiServerOption{}, nil, string(credential.StoreTypeMemory)),
+	}
+	s3a.iam.isAuthEnabled = false
+
+	mismatch := httptest.NewRequest("PUT", "/b/dir/", http.NoBody)
+	mismatch.Header.Set("X-Amz-Content-Sha256", sha256Hex(t, []byte("other")))
+	if _, code := getRequestDataReader(s3a, mismatch); code != s3err.ErrContentSHA256Mismatch {
+		t.Fatalf("empty body with wrong hash: code=%v", code)
+	}
+
+	malformed := httptest.NewRequest("PUT", "/b/o", strings.NewReader("x"))
+	malformed.Header.Set("X-Amz-Content-Sha256", "nothex")
+	if _, code := getRequestDataReader(s3a, malformed); code != s3err.ErrInvalidArgument {
+		t.Fatalf("malformed sha256 header: code=%v", code)
+	}
+
+	emptySum := sha256.Sum256(nil)
+	match := httptest.NewRequest("PUT", "/b/dir/", http.NoBody)
+	match.Header.Set("X-Amz-Content-Sha256", hex.EncodeToString(emptySum[:]))
+	if _, code := getRequestDataReader(s3a, match); code != s3err.ErrNone {
+		t.Fatalf("empty body with empty hash: code=%v", code)
+	}
+}
diff --git a/weed/s3api/s3api_remote_storage_test.go b/weed/s3api/s3api_remote_storage_test.go
index 4ef982f9ff..fab96e187e 100644
--- a/weed/s3api/s3api_remote_storage_test.go
+++ b/weed/s3api/s3api_remote_storage_test.go
@@ -1,11 +1,15 @@
 package s3api
 
 import (
+	"bytes"
 	"context"
+	"errors"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
 	"sync/atomic"
 	"testing"
@@ -14,11 +18,16 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 )
 
 // TestIsInRemoteOnly tests the IsInRemoteOnly method on filer_pb.Entry
@@ -498,16 +507,26 @@ func TestCopyObjectRemoteOnlySourceDetection(t *testing.T) {
 
 // fakeCacheFiler is a minimal SeaweedFiler gRPC server whose
 // CacheRemoteObjectToLocalCluster behavior is driven by a callback, so tests can
-// model a slow (still-caching) filer or one that returns cached chunks.
+// model a slow (still-caching) filer or one that returns cached chunks. The
+// optional entries map serves LookupDirectoryEntry for inline-content paths
+// such as the /etc/remote configuration.
 type fakeCacheFiler struct {
 	filer_pb.UnimplementedSeaweedFilerServer
-	cache func(context.Context, *filer_pb.CacheRemoteObjectToLocalClusterRequest) (*filer_pb.CacheRemoteObjectToLocalClusterResponse, error)
+	cache   func(context.Context, *filer_pb.CacheRemoteObjectToLocalClusterRequest) (*filer_pb.CacheRemoteObjectToLocalClusterResponse, error)
+	entries map[string][]byte
 }
 
 func (f *fakeCacheFiler) CacheRemoteObjectToLocalCluster(ctx context.Context, req *filer_pb.CacheRemoteObjectToLocalClusterRequest) (*filer_pb.CacheRemoteObjectToLocalClusterResponse, error) {
 	return f.cache(ctx, req)
 }
 
+func (f *fakeCacheFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if content, ok := f.entries[req.Directory+"/"+req.Name]; ok {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: &filer_pb.Entry{Name: req.Name, Content: content}}, nil
+	}
+	return nil, filer_pb.ErrNotFound
+}
+
 // startFakeCacheFiler serves impl on a random localhost port and returns the
 // S3-style filer address whose ToGrpcAddress resolves back to that port.
 func startFakeCacheFiler(t *testing.T, impl *fakeCacheFiler) pb.ServerAddress {
@@ -585,3 +604,268 @@ func TestCacheRemoteObjectForStreamingCached(t *testing.T) {
 	require.NotNil(t, got)
 	assert.Len(t, got.GetChunks(), 1)
 }
+
+// fakeStreamRemoteClient records the ReadFileAsStream call and serves from an
+// in-memory byte slice. The embedded nil interface panics on any other call.
+type fakeStreamRemoteClient struct {
+	remote_storage.RemoteStorageClient
+	data      []byte
+	stat      *filer_pb.RemoteEntry // what the remote reports now; defaults to matching data
+	openErr   error
+	gotLoc    *remote_pb.RemoteStorageLocation
+	gotOffset int64
+	gotSize   int64
+}
+
+func (c *fakeStreamRemoteClient) StatFile(loc *remote_pb.RemoteStorageLocation) (*filer_pb.RemoteEntry, error) {
+	if c.stat != nil {
+		return c.stat, nil
+	}
+	return &filer_pb.RemoteEntry{RemoteSize: int64(len(c.data))}, nil
+}
+
+func (c *fakeStreamRemoteClient) ReadFileAsStream(ctx context.Context, loc *remote_pb.RemoteStorageLocation, offset int64, size int64) (io.ReadCloser, error) {
+	c.gotLoc, c.gotOffset, c.gotSize = loc, offset, size
+	if c.openErr != nil {
+		return nil, c.openErr
+	}
+	end := min(offset+size, int64(len(c.data)))
+	return io.NopCloser(bytes.NewReader(c.data[offset:end])), nil
+}
+
+type fakeStreamRemoteMaker struct{ client *fakeStreamRemoteClient }
+
+func (m *fakeStreamRemoteMaker) Make(conf *remote_pb.RemoteConf) (remote_storage.RemoteStorageClient, error) {
+	return m.client, nil
+}
+func (m *fakeStreamRemoteMaker) HasBucket() bool { return true }
+
+// startStreamThroughFiler serves a filer whose cache RPC always fails with
+// cacheErr and whose /etc/remote mounts /buckets/mybucket on a fake origin.
+func startStreamThroughFiler(t *testing.T, remoteName string, cacheErr error, mountOpts ...func(*remote_pb.RemoteStorageLocation)) pb.ServerAddress {
+	mount := &remote_pb.RemoteStorageLocation{Name: remoteName, Bucket: "origin-bucket", Path: "/data"}
+	for _, opt := range mountOpts {
+		opt(mount)
+	}
+	mappingBytes, err := proto.Marshal(&remote_pb.RemoteStorageMapping{
+		Mappings: map[string]*remote_pb.RemoteStorageLocation{
+			"/buckets/mybucket": mount,
+		},
+	})
+	require.NoError(t, err)
+	confBytes, err := proto.Marshal(&remote_pb.RemoteConf{Name: remoteName, Type: "faketest"})
+	require.NoError(t, err)
+	return startFakeCacheFiler(t, &fakeCacheFiler{
+		cache: func(ctx context.Context, req *filer_pb.CacheRemoteObjectToLocalClusterRequest) (*filer_pb.CacheRemoteObjectToLocalClusterResponse, error) {
+			return nil, cacheErr
+		},
+		entries: map[string][]byte{
+			"/etc/remote/mount.mapping":           mappingBytes,
+			"/etc/remote/" + remoteName + ".conf": confBytes,
+		},
+	})
+}
+
+var stillCachingErr = status.Error(codes.DeadlineExceeded, "still caching")
+
+// TestS3ColdReadStreamsFromOrigin pins the stream-through path: when the filer
+// reports the cache is still filling, the GET is served straight from the
+// mounted origin instead of a 503 retry loop.
+func TestS3ColdReadStreamsFromOrigin(t *testing.T) {
+	content := []byte("0123456789")
+	client := &fakeStreamRemoteClient{data: content}
+	remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+
+	entry := func() *filer_pb.Entry {
+		return &filer_pb.Entry{
+			Name:        "obj.bin",
+			Attributes:  &filer_pb.FuseAttributes{FileSize: uint64(len(content))},
+			RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: int64(len(content))},
+		}
+	}
+
+	t.Run("full read", func(t *testing.T) {
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-full", stillCachingErr))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Equal(t, content, w.Body.Bytes())
+		require.NotNil(t, client.gotLoc, "must read from the origin")
+		assert.Equal(t, "origin-bucket", client.gotLoc.Bucket)
+		assert.Equal(t, "/data/dir/obj.bin", client.gotLoc.Path)
+		assert.Equal(t, strconv.Itoa(len(content)), w.Header().Get("Content-Length"))
+	})
+
+	t.Run("range read", func(t *testing.T) {
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-range", stillCachingErr))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+		r.Header.Set("Range", "bytes=2-5")
+
+		err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusPartialContent, w.Code)
+		assert.Equal(t, content[2:6], w.Body.Bytes())
+		assert.Equal(t, int64(2), client.gotOffset)
+		assert.Equal(t, int64(4), client.gotSize)
+		assert.Equal(t, fmt.Sprintf("bytes 2-5/%d", len(content)), w.Header().Get("Content-Range"))
+	})
+
+	t.Run("short origin read fails instead of silently truncating", func(t *testing.T) {
+		shortClient := &fakeStreamRemoteClient{data: content[:4]}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: shortClient}
+		defer func() {
+			remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		}()
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-short", stillCachingErr))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "")
+
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), io.ErrUnexpectedEOF.Error())
+	})
+
+	t.Run("version-specific read keeps 503 retry", func(t *testing.T) {
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-versioned", stillCachingErr))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin?versionId=v123", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "v123")
+
+		require.Error(t, err)
+		assert.Equal(t, http.StatusServiceUnavailable, w.Code)
+		assert.Equal(t, "2", w.Header().Get("Retry-After"))
+	})
+
+	t.Run("latest read of a versioned entry keeps 503 retry", func(t *testing.T) {
+		freshClient := &fakeStreamRemoteClient{data: content}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: freshClient}
+		defer func() {
+			remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		}()
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-latest-versioned", stillCachingErr))
+		versionedEntry := entry()
+		versionedEntry.Extended = map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v456")}
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, versionedEntry, "", "mybucket", "dir/obj.bin", "")
+
+		require.Error(t, err)
+		assert.Equal(t, http.StatusServiceUnavailable, w.Code)
+		assert.Nil(t, freshClient.gotLoc, "the unversioned origin key must not be read for a versioned entry")
+	})
+
+	t.Run("local cache failure falls back to origin", func(t *testing.T) {
+		cacheErr := status.Error(codes.Internal, "assign: no free volumes")
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-localfail", cacheErr))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Equal(t, content, w.Body.Bytes())
+	})
+
+	t.Run("mount with a zero cache wait never asks the cache", func(t *testing.T) {
+		originClient := &fakeStreamRemoteClient{data: content}
+		remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: originClient}
+		defer func() {
+			remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: client}
+		}()
+		// a consulted cache would 404 this read, so a 200 proves it was skipped
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-nowait", status.Error(codes.NotFound, "entry vanished"), func(loc *remote_pb.RemoteStorageLocation) {
+			loc.CacheWaitMs = proto.Int32(0)
+		}))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Equal(t, content, w.Body.Bytes())
+		require.NotNil(t, originClient.gotLoc, "must read from the origin")
+	})
+
+	t.Run("zero cache wait still caches a version-specific read", func(t *testing.T) {
+		// the version has no origin key, so the cache stays its only source
+		s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-nowait-versioned", status.Error(codes.NotFound, "entry vanished"), func(loc *remote_pb.RemoteStorageLocation) {
+			loc.CacheWaitMs = proto.Int32(0)
+		}))
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin?versionId=v123", nil)
+
+		err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "v123")
+
+		require.Error(t, err)
+		assert.Equal(t, http.StatusNotFound, w.Code)
+	})
+
+	t.Run("entry not found stays 404", func(t *testing.T) {
+		notFoundForms := map[string]error{
+			"canonical status": status.Error(codes.NotFound, "entry vanished"),
+			// the filer returns the raw sentinel, which crosses gRPC as
+			// codes.Unknown with only the message surviving
+			"raw sentinel": filer_pb.ErrNotFound,
+		}
+		for name, cacheErr := range notFoundForms {
+			t.Run(name, func(t *testing.T) {
+				s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, "faketest-notfound-"+name[:3], cacheErr))
+				w := httptest.NewRecorder()
+				r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+				err := s3a.streamFromVolumeServers(w, r, entry(), "", "mybucket", "dir/obj.bin", "")
+
+				require.Error(t, err)
+				assert.Equal(t, http.StatusNotFound, w.Code)
+			})
+		}
+	})
+}
+
+// TestS3ReadOfObjectGoneFromRemote pins NoSuchKey for a remote-only entry whose
+// remote object was deleted outside the filer, whether the filer's cache or the
+// gateway's origin fallback learns it.
+func TestS3ReadOfObjectGoneFromRemote(t *testing.T) {
+	entry := &filer_pb.Entry{
+		Name:        "obj.bin",
+		Attributes:  &filer_pb.FuseAttributes{FileSize: 10},
+		RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 10},
+	}
+	noWait := func(loc *remote_pb.RemoteStorageLocation) { loc.CacheWaitMs = proto.Int32(0) }
+	tests := []struct {
+		name       string
+		cacheErr   error
+		originErr  error
+		mountOpts  []func(*remote_pb.RemoteStorageLocation)
+		wantStatus int
+	}{
+		{"cache reports it gone", status.Error(codes.NotFound, "remote object not found"), remote_storage.ErrRemoteObjectNotFound, nil, http.StatusNotFound},
+		{"cache still filling, origin reports it gone", stillCachingErr, remote_storage.ErrRemoteObjectNotFound, nil, http.StatusNotFound},
+		{"zero cache wait, origin reports it gone", nil, remote_storage.ErrRemoteObjectNotFound, []func(*remote_pb.RemoteStorageLocation){noWait}, http.StatusNotFound},
+		{"origin denied", status.Error(codes.Internal, "assign: no free volumes"), errors.New("googleapi: Error 403: forbidden"), nil, http.StatusInternalServerError},
+	}
+	for i, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prev := remote_storage.RemoteStorageClientMakers["faketest"]
+			remote_storage.RemoteStorageClientMakers["faketest"] = &fakeStreamRemoteMaker{client: &fakeStreamRemoteClient{openErr: tt.originErr}}
+			t.Cleanup(func() { remote_storage.RemoteStorageClientMakers["faketest"] = prev })
+			s3a := newRemoteCacheTestServer(startStreamThroughFiler(t, fmt.Sprintf("faketest-gone-%d", i), tt.cacheErr, tt.mountOpts...))
+			w := httptest.NewRecorder()
+			r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil)
+
+			require.Error(t, s3a.streamFromVolumeServers(w, r, entry, "", "mybucket", "dir/obj.bin", ""))
+			assert.Equal(t, tt.wantStatus, w.Code)
+		})
+	}
+}
diff --git a/weed/s3api/s3api_remote_versioned_path_test.go b/weed/s3api/s3api_remote_versioned_path_test.go
new file mode 100644
index 0000000000..75b7d7d31d
--- /dev/null
+++ b/weed/s3api/s3api_remote_versioned_path_test.go
@@ -0,0 +1,29 @@
+package s3api
+
+import "testing"
+
+func TestBuildVersionedRemoteObjectPathRejectsTraversal(t *testing.T) {
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+
+	tests := []struct {
+		name      string
+		versionId string
+		wantDir   string
+		wantName  string
+	}{
+		{"valid version", "opaque_123", "/buckets/mybkt/obj.versions", "v_opaque_123"},
+		{"traversal drops to unversioned", "v1/../../../buckets/victim/pwn", "/buckets/mybkt", "obj"},
+		{"backslash drops to unversioned", `v1\..\victim`, "/buckets/mybkt", "obj"},
+		{"empty is unversioned", "", "/buckets/mybkt", "obj"},
+		{"null is unversioned", "null", "/buckets/mybkt", "obj"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir, name := s3a.buildVersionedRemoteObjectPath("mybkt", "obj", tt.versionId)
+			if dir != tt.wantDir || name != tt.wantName {
+				t.Errorf("buildVersionedRemoteObjectPath(mybkt, obj, %q) = (%q, %q), want (%q, %q)",
+					tt.versionId, dir, name, tt.wantDir, tt.wantName)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_server.go b/weed/s3api/s3api_server.go
index 7b2e6c746f..dc9cb139a2 100644
--- a/weed/s3api/s3api_server.go
+++ b/weed/s3api/s3api_server.go
@@ -4,8 +4,10 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"math"
 	"net"
 	"net/http"
 	"os"
@@ -17,6 +19,8 @@ import (
 
 	"github.com/gorilla/mux"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/credential"
@@ -26,6 +30,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
 	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_lifecycle_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_pb"
@@ -52,6 +57,7 @@ type S3ApiServerOption struct {
 	BucketsPath               string
 	GrpcDialOption            grpc.DialOption
 	AllowDeleteBucketNotEmpty bool
+	AutoCreateBucket          bool // create the bucket on upload if it does not exist
 	LocalFilerSocket          string
 	DataCenter                string
 	FilerGroup                string
@@ -64,10 +70,22 @@ type S3ApiServerOption struct {
 	Ip                        string // address advertised to the cluster; empty falls back to BindIp
 	BindIp                    string
 	GrpcPort                  int
-	ExternalUrl               string // external URL clients use, for signature verification behind a reverse proxy
+	ExternalUrl               string // external URL clients use, tried first during signature verification behind a reverse proxy
 	DefaultFileMode           uint32 // default file permission mode for S3 uploads (e.g. 0660, 0644)
 	CacheSizeMB               int64  // in-memory chunk cache capacity in MB for the shared ReaderCache; 0 disables
+	ReaderCacheSizeMB         int64  // memory budget in MiB for downloaded and in-flight reader buffers across all S3 GETs; 0 means unlimited
 	MaxMB                     int32  // filer's -maxMB, read from the filer configuration at startup
+	// AllowUntrustedRemoteEndpoints lets a read of a remote-only object dial a
+	// mounted endpoint that resolves to a loopback / private / metadata host.
+	AllowUntrustedRemoteEndpoints bool
+	// AllowBackslashInKey keeps '\' a literal object-key character instead of
+	// normalizing it to '/', matching AWS S3 where the two are distinct keys.
+	AllowBackslashInKey bool
+	// IamSelfServiceRequiresGrant makes managing one's own access keys
+	// (CreateAccessKey, DeleteAccessKey, UpdateAccessKey, ListAccessKeys,
+	// GetUser) need an explicit iam: grant instead of being allowed to every
+	// authenticated identity.
+	IamSelfServiceRequiresGrant bool
 }
 
 // s3ChunkCacheChunkSizeMB is the assumed chunk size (in MiB) used to convert
@@ -87,6 +105,7 @@ type S3ApiServer struct {
 	randomClientId        int32
 	filerGuard            *security.Guard
 	filerClient           *wdclient.FilerClient
+	masterClient          *wdclient.MasterClient
 	client                util_http_client.HTTPClientInterface
 	bucketRegistry        *BucketRegistry
 	credentialManager     *credential.CredentialManager
@@ -97,8 +116,12 @@ type S3ApiServer struct {
 	inFlightDataLimitCond *sync.Cond
 	embeddedIam           *EmbeddedIamApi // Embedded IAM API server (when enabled)
 	stsHandlers           *STSHandlers    // STS HTTP handlers for AssumeRoleWithWebIdentity
-	cipher                bool            // encrypt data on volume servers
-	newObjectWriteLock    func(bucket, object string) objectWriteLock
+	// icebergCredentialRole is the role the Iceberg catalog assumes to vend
+	// table-scoped credentials; empty leaves vending off.
+	icebergCredentialRole     string
+	icebergCredentialDuration int64
+	cipher                    bool // encrypt data on volume servers
+	newObjectWriteLock        func(bucket, object string) (objectWriteLock, error)
 	// objectWriteLockClient resolves a key's owner filer for route-by-key.
 	objectWriteLockClient *cluster.LockClient
 	// unreachableOwners holds owners (pb.ServerAddress -> expiry time.Time) whose
@@ -215,15 +238,19 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 				}
 				objectWriteLockClient.SetRing(servers, update.Version)
 			})
+			masterClient.SetOnMasterChangeFn(func(previous, current pb.ServerAddress) {
+				objectWriteLockClient.ResetRing()
+			})
 		}
-		// Start the master client connection loop - required for GetMaster() to work
-		go masterClient.KeepConnectedToMaster(context.Background())
-
 		filerClient = wdclient.NewFilerClient(option.Filers, option.GrpcDialOption, option.DataCenter, &wdclient.FilerClientOption{
 			MasterClient:      masterClient,
 			FilerGroup:        option.FilerGroup,
 			DiscoveryInterval: 5 * time.Minute,
 		})
+		masterClient.SetOnPeerUpdateFn(filerClient.OnPeerUpdate)
+
+		// Start the master client connection loop - required for GetMaster() to work
+		go masterClient.KeepConnectedToMaster(context.Background())
 
 		glog.V(1).Infof("S3 API initialized FilerClient with %d filer(s) and discovery enabled (group: %s, masters: %v)",
 			len(option.Filers), option.FilerGroup, option.Masters)
@@ -274,7 +301,7 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 	//     assumed chunk size (s3ChunkCacheChunkSizeMB), clamped to a small
 	//     floor so tiny caches still function.
 	//
-	// Downloader slots: each slot holds one in-flight / recently-completed
+	// Downloader slots: each slot holds one in-flight or not-yet-consumed
 	// chunk buffer (~4 MiB by default), so this caps both peak memory for
 	// in-flight chunks (s3ReaderCacheDownloaderLimit × chunkSize) and the
 	// global fetch concurrency across all S3 GET requests. WebDAV uses 32
@@ -304,7 +331,14 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 	} else {
 		chunkCache = (*chunk_cache.TieredChunkCache)(nil)
 	}
-	readerCache := filer.NewReaderCache(s3ReaderCacheDownloaderLimit, chunkCache, filerClient.GetLookupFileIdFunction(), filerClient)
+	if option.ReaderCacheSizeMB < 0 || option.ReaderCacheSizeMB > math.MaxInt64>>20 {
+		return nil, fmt.Errorf("invalid readerCacheSizeMB %d: must be non-negative and fit in an int64 byte budget", option.ReaderCacheSizeMB)
+	}
+	var readerCacheBudget *filer.ReaderCacheBudget
+	if option.ReaderCacheSizeMB > 0 {
+		readerCacheBudget = filer.NewReaderCacheBudget(option.ReaderCacheSizeMB << 20)
+	}
+	readerCache := filer.NewReaderCache(s3ReaderCacheDownloaderLimit, chunkCache, filerClient.GetLookupFileIdFunction(), filerClient, readerCacheBudget)
 
 	s3ApiServer = &S3ApiServer{
 		option:                option,
@@ -312,6 +346,7 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 		randomClientId:        util.RandomInt32(),
 		filerGuard:            security.NewGuard([]string{}, signingKey, expiresAfterSec, readSigningKey, readExpiresAfterSec),
 		filerClient:           filerClient,
+		masterClient:          masterClient,
 		cb:                    NewCircuitBreaker(option),
 		credentialManager:     iam.credentialManager,
 		bucketConfigCache:     NewBucketConfigCache(60 * time.Minute), // Increased TTL since cache is now event-driven
@@ -328,16 +363,19 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 			objectWriteLockClient = cluster.NewLockClient(option.GrpcDialOption, option.Filers[0])
 		}
 		s3ApiServer.objectWriteLockClient = objectWriteLockClient
-		s3ApiServer.newObjectWriteLock = func(bucket, object string) objectWriteLock {
+		s3ApiServer.newObjectWriteLock = func(bucket, object string) (objectWriteLock, error) {
 			lockKey := objectWriteRouteKeyPrefix + s3ApiServer.toFilerPath(bucket, object)
 			owner := fmt.Sprintf("s3api-%d", s3ApiServer.randomClientId)
 			lock := objectWriteLockClient.NewShortLivedLock(lockKey, owner)
+			if lock == nil {
+				return nil, fmt.Errorf("objectWriteLock: failed to acquire lock for %s", lockKey)
+			}
 			if err := lock.AttemptToLock(objectWriteLockTTL); err != nil {
 				// The initial acquisition already succeeded with the default short TTL.
 				// Renewal to a longer TTL is opportunistic to cover slower metadata paths.
 				glog.Warningf("objectWriteLock: failed to extend lock TTL for %s: %v", lockKey, err)
 			}
-			return lock
+			return lock, nil
 		}
 	}
 
@@ -353,6 +391,15 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 	// policy conditions on s3:x-amz-server-side-encryption evaluate correctly.
 	policyEngine.MultipartSSELookup = s3ApiServer.getMultipartSSEAlgorithm
 
+	// Advanced-IAM authorization evaluates the bucket-policy:<bucket> mirror
+	// before any handler runs, so the auth path has to be what triggers the
+	// lazy bucket load (and with it the mirror backfill): a grant carried
+	// only by a not-yet-mirrored policy would otherwise deny forever, and
+	// the denied request never reaches the handlers that load the bucket.
+	iam.primeBucketForIAM = func(bucket string) {
+		s3ApiServer.getBucketConfig(bucket)
+	}
+
 	// Initialize advanced IAM system if config is provided or explicitly enabled
 	if option.IamConfig != "" || option.EnableIam {
 		configSource := "defaults"
@@ -409,6 +456,8 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 		}
 	}
 
+	s3ApiServer.applyTrustedProxies(util.GetViper())
+
 	// Initialize embedded IAM API if enabled
 	if option.EnableIam {
 		s3ApiServer.embeddedIam = NewEmbeddedIamApi(s3ApiServer.credentialManager, iam, option.IamReadOnly)
@@ -443,6 +492,7 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 			v.GetString("jwt.filer_signing.read.key"),
 			v.GetInt("jwt.filer_signing.read.expires_after_seconds"),
 		)
+		s3ApiServer.applyTrustedProxies(v)
 		util_http.ReloadJwtSigningReadConfig()
 	})
 	s3ApiServer.bucketRegistry = NewBucketRegistry(s3ApiServer)
@@ -457,8 +507,12 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 	} else {
 		s3ApiServer.client = &http.Client{
 			Transport: &http.Transport{
-				DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
-					return net.Dial("unix", option.LocalFilerSocket)
+				DialContext: func(ctx context.Context, _, addr string) (net.Conn, error) {
+					conn, err := (&net.Dialer{}).DialContext(ctx, "unix", option.LocalFilerSocket)
+					if err != nil {
+						return util.OutboundDialContext(ctx, "tcp", addr)
+					}
+					return conn, nil
 				},
 			},
 		}
@@ -466,7 +520,7 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 
 	s3ApiServer.registerRouter(router)
 
-	go s3ApiServer.subscribeMetaEvents("s3", startTsNs, filer.DirectoryEtcRoot, []string{
+	watched := []string{
 		option.BucketsPath,
 		filer.IamConfigDirectory,
 		filer.IamConfigDirectory + "/identities",
@@ -474,7 +528,13 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 		filer.IamConfigDirectory + "/service_accounts",
 		filer.IamConfigDirectory + "/groups",
 		filer.IamConfigDirectory + "/oidc-providers",
-	})
+		filer.IamConfigDirectory + "/roles",
+	}
+	// A role store configured with its own basePath is watched there too.
+	if dir := s3ApiServer.roleStoreDir(); !slices.Contains(watched, dir) {
+		watched = append(watched, dir)
+	}
+	go s3ApiServer.subscribeMetaEvents("s3", startTsNs, filer.DirectoryEtcRoot, watched)
 
 	// Start bucket size metrics collection in background
 	go s3ApiServer.startBucketSizeMetricsLoop(context.Background())
@@ -486,9 +546,29 @@ func NewS3ApiServerWithStore(router *mux.Router, option *S3ApiServerOption, expl
 	// pointer-to-missing-file states without waiting for a client GET.
 	s3ApiServer.versionsReconcilerStop = s3ApiServer.startVersioningReconciler()
 
+	// Publish the key mode only once the server is fully constructed so a
+	// failed construction cannot flip the mode of a running server.
+	SetAllowBackslashInObjectKey(option.AllowBackslashInKey)
+
 	return s3ApiServer, nil
 }
 
+// applyTrustedProxies reads [s3.trusted_proxies] from the security config and
+// propagates the allowlist to the bucket policy engine, the IAM policy
+// engine, and the IAM integration so aws:SourceIp honors forwarded headers
+// only from configured trusted proxies.
+func (s3a *S3ApiServer) applyTrustedProxies(v util.Configuration) {
+	whiteList := util.StringSplit(v.GetString("s3.trusted_proxies.white_list"), ",")
+	tp := policy_engine.NewTrustedProxies(whiteList)
+	if s3a.policyEngine != nil {
+		s3a.policyEngine.engine.SetTrustedProxies(tp)
+	}
+	s3a.iam.SetTrustedProxies(tp)
+	if s3a.iamIntegration != nil {
+		s3a.iamIntegration.SetTrustedProxies(tp)
+	}
+}
+
 func (s3a *S3ApiServer) Shutdown() {
 	if s3a.versionsReconcilerStop != nil {
 		s3a.versionsReconcilerStop()
@@ -550,6 +630,13 @@ func (s3a *S3ApiServer) checkPolicyWithEntry(r *http.Request, bucket, object, ac
 		return s3err.ErrNone, false
 	}
 
+	// Upload handler rechecks use the same effective ACL conditions as authentication without changing the signed request.
+	policyRequest, policyCode := putObjectACLPolicyRequest(r, Action(action), bucket, object)
+	if policyCode != s3err.ErrNone {
+		return policyCode, true
+	}
+	r = policyRequest
+
 	identityRaw := GetIdentityFromContext(r)
 	var identity *Identity
 	if identityRaw != nil {
@@ -591,6 +678,12 @@ func (s3a *S3ApiServer) checkPolicyWithEntry(r *http.Request, bucket, object, ac
 //
 // Returns s3err.ErrNone if allowed, or an error code if denied or on error.
 func (s3a *S3ApiServer) recheckPolicyWithObjectEntry(r *http.Request, bucket, object, action string, objectEntry map[string][]byte, handlerName string) s3err.ErrorCode {
+	if isAnonymousObjectRead(r) {
+		// Refined like writeAnonymousAwareNotFound's masked miss, so a denied
+		// existing key and a missing key answer alike on a malformed name.
+		identity, _ := GetIdentityFromContext(r).(*Identity)
+		return refineDenialForBucketName(r, identity, s3a.authorizeAnonymousObjectRead(r, bucket, object, objectEntry))
+	}
 	identityRaw := GetIdentityFromContext(r)
 	var identity *Identity
 	if identityRaw != nil {
@@ -606,6 +699,92 @@ func (s3a *S3ApiServer) recheckPolicyWithObjectEntry(r *http.Request, bucket, ob
 	return errCode
 }
 
+// checkVersionReadGrant enforces the version read grant AWS requires alongside
+// a version-scoped action such as s3:GetObjectVersionAttributes. The check runs
+// on a request shaped like a plain versioned GET so the s3:GetObjectVersion
+// action resolves from the request instead of the caller's subresource, and a
+// legacy Read grant still applies.
+func (s3a *S3ApiServer) checkVersionReadGrant(r *http.Request, bucket, object, versionId string, objectEntry map[string][]byte) s3err.ErrorCode {
+	versionReadReq := objectKeyPolicyRequest(r, http.MethodGet, bucket, object, versionId)
+	if identity, ok := GetIdentityFromContext(r).(*Identity); ok && identity != nil {
+		if errCode := s3a.iam.VerifyActionPermission(versionReadReq, identity, ACTION_READ, bucket, object); errCode != s3err.ErrNone {
+			return errCode
+		}
+	}
+	return s3a.recheckPolicyWithObjectEntry(versionReadReq, bucket, object, ACTION_READ, objectEntry, "checkVersionReadGrant")
+}
+
+// recheckCopySourcePolicy repeats the source object's policy check once its
+// entry is fetched, so conditions on the object's existing tags apply to a
+// CopyObject / UploadPartCopy / RenameObject source the same way they do to a
+// plain GET. The synthesized GET keeps the destination's request shape (PUT,
+// partNumber, ...) from resolving a different action.
+func (s3a *S3ApiServer) recheckCopySourcePolicy(r *http.Request, bucket, object, versionId string, objectEntry map[string][]byte, handlerName string) s3err.ErrorCode {
+	keyReq := objectKeyPolicyRequest(r, http.MethodGet, bucket, object, versionId)
+	return s3a.recheckPolicyWithObjectEntry(keyReq, bucket, object, string(ACTION_READ), objectEntry, handlerName)
+}
+
+// recheckTagConditionedPolicyWithLookup repeats policy evaluation with the
+// object's entry in hand so s3:ExistingObjectTag conditions apply to
+// operations that did not otherwise fetch the entry. It only does the extra
+// lookup when the bucket has a policy; entry misses return ErrNone because
+// the handler reports its own NoSuchKey.
+func (s3a *S3ApiServer) recheckTagConditionedPolicyWithLookup(r *http.Request, bucket, object, versionId, action, handlerName string) s3err.ErrorCode {
+	if s3a.policyEngine == nil || !s3a.policyEngine.HasPolicyForBucket(bucket) {
+		return s3err.ErrNone
+	}
+	entry, err := s3a.resolveObjectEntry(bucket, object, versionId)
+	if err != nil {
+		// The tag conditions cannot be evaluated without the entry; failing
+		// open would let a tag-gated Deny slip through a transient miss.
+		if errors.Is(err, filer_pb.ErrNotFound) || status.Code(err) == codes.NotFound {
+			return s3err.ErrNone
+		}
+		glog.Errorf("%s: recheck lookup for %s/%s failed: %v", handlerName, bucket, object, err)
+		return s3err.ErrInternalError
+	}
+	if entry == nil {
+		return s3err.ErrNone
+	}
+	return s3a.recheckPolicyWithObjectEntry(r, bucket, object, action, entry.Extended, handlerName)
+}
+
+// recheckPolicyForKeyWithLookup re-decides a first-phase deny on one key for a
+// synthesized method, resolving the entry the way the read path does (versions
+// included) so s3:ExistingObjectTag conditions see the object's real tags.
+// Unlike the deny-side rechecks, an indeterminate result does not grant: the
+// caller reports the original verdict either way, so only a statement that
+// matches with tags in hand can turn a deny into an allow, and a missed lookup
+// never widens access or reveals whether the key exists.
+func (s3a *S3ApiServer) recheckPolicyForKeyWithLookup(r *http.Request, method, bucket, object, versionId, action, handlerName string) s3err.ErrorCode {
+	if s3a.policyEngine == nil || !s3a.policyEngine.HasPolicyForBucket(bucket) {
+		return s3err.ErrAccessDenied
+	}
+	versioningState, err := s3a.getVersioningState(bucket)
+	if err != nil {
+		glog.Errorf("%s: recheck versioning state for %s: %v", handlerName, bucket, err)
+		return s3err.ErrAccessDenied
+	}
+	entry, err := s3a.resolveCopySourceEntry(bucket, object, versionId, versioningState)
+	entry = prefixObjectSource(entry)
+	if err != nil || entry == nil {
+		return s3err.ErrAccessDenied
+	}
+	keyReq := objectKeyPolicyRequest(r, method, bucket, object, versionId)
+	errCode, checked := s3a.checkPolicyWithEntry(keyReq, bucket, object, action, "", entry.Extended)
+	if errCode != s3err.ErrNone || !checked {
+		return s3err.ErrAccessDenied
+	}
+	// A bucket-policy Allow never overrides an explicit Deny in the caller's
+	// own attached or session policies — the first phase applied that veto,
+	// so the tag-aware recheck must too.
+	identity, _ := GetIdentityFromContext(r).(*Identity)
+	if s3a.iam != nil && s3a.iam.isActionExplicitlyDeniedByApplicablePolicies(keyReq, identity, Action(action), bucket, object) {
+		return s3err.ErrAccessDenied
+	}
+	return s3err.ErrNone
+}
+
 // classifyDomainNames classifies domains into path-style and virtual-host style domains.
 // A domain is considered path-style if:
 //  1. It contains a dot (has subdomains)
@@ -662,10 +841,21 @@ func (s3a *S3ApiServer) handleCORSOriginValidation(w http.ResponseWriter, r *htt
 // UnifiedPostHandler handles authenticated POST requests to the root path
 // It inspects the Action parameter to dispatch to either STS or IAM handlers
 func (s3a *S3ApiServer) UnifiedPostHandler(w http.ResponseWriter, r *http.Request) {
+	// Failures on this route answer in the IAM/STS query-protocol envelope
+	// unless the request was actually signed for s3.
+	r, reqID := request_id.Ensure(r)
+	writeQueryError := func(iamCode string, s3Code s3err.ErrorCode) {
+		if requestSigningService(r) == "s3" {
+			s3err.WriteErrorResponse(w, r, s3Code)
+			return
+		}
+		writeIamErrorResponse(w, r, reqID, &iamError{Code: iamCode, Error: errors.New(s3err.GetAPIError(s3Code).Description)})
+	}
+
 	// 1. Authenticate (preserves body)
 	identity, errCode := s3a.iam.AuthSignatureOnly(r)
 	if errCode != s3err.ErrNone {
-		s3err.WriteErrorResponse(w, r, errCode)
+		writeQueryError(iamAuthErrorCode(errCode), errCode)
 		return
 	}
 
@@ -673,13 +863,11 @@ func (s3a *S3ApiServer) UnifiedPostHandler(w http.ResponseWriter, r *http.Reques
 	// Save the body first so we can restore it for STS handler signature verification
 	var bodyBytes []byte
 	if r.Body != nil {
-		// Limit body size to prevent DoS attacks
-		r.Body = http.MaxBytesReader(w, r.Body, iamRequestBodyLimit)
 		var err error
-		bodyBytes, err = io.ReadAll(r.Body)
+		bodyBytes, err = readRequestBody(r, iamRequestBodyLimit)
 		if err != nil {
 			glog.Errorf("failed to read request body: %v", err)
-			s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+			writeQueryError("InvalidInput", s3err.ErrInvalidRequest)
 			return
 		}
 		r.Body.Close()
@@ -688,7 +876,7 @@ func (s3a *S3ApiServer) UnifiedPostHandler(w http.ResponseWriter, r *http.Reques
 	}
 
 	if err := r.ParseForm(); err != nil {
-		s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+		writeQueryError("InvalidInput", s3err.ErrInvalidRequest)
 		return
 	}
 
@@ -715,7 +903,7 @@ func (s3a *S3ApiServer) UnifiedPostHandler(w http.ResponseWriter, r *http.Reques
 		// IAM
 		// IAM API requests must be authenticated - reject nil identity
 		if identity == nil {
-			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+			writeQueryError("AccessDenied", s3err.ErrAccessDenied)
 			return
 		}
 
@@ -725,8 +913,8 @@ func (s3a *S3ApiServer) UnifiedPostHandler(w http.ResponseWriter, r *http.Reques
 
 		// UserName comes from the body only, the same place DoActions reads it
 		// from, so the authorized target and the acted-on target cannot differ.
-		if s3a.iam.AuthorizeIamAction(r, identity, action, r.PostForm.Get("UserName")) != s3err.ErrNone {
-			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+		if s3a.iam.AuthorizeIamAction(r, identity, action, iamTargetUserName(action, r)) != s3err.ErrNone {
+			writeQueryError("AccessDenied", s3err.ErrAccessDenied)
 			return
 		}
 
@@ -739,6 +927,9 @@ func (s3a *S3ApiServer) UnifiedPostHandler(w http.ResponseWriter, r *http.Reques
 func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 	// runs before subrouter matching so Queries() matchers see the fixed query
 	router.Use(util_http.EscapeSemicolonsInQuery)
+	// a request naming two subresources routes one way and authorizes another;
+	// reject it rather than guess
+	router.Use(rejectAmbiguousSubresource)
 	// API Router
 	apiRouter := router.PathPrefix("/").Subrouter()
 	apiRouter.Use(request_id.Middleware)
@@ -756,6 +947,17 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 	// Object path pattern with (?s) flag to match newlines in object keys
 	const objectPath = "/{object:(?s).+}"
 
+	// CORS preflight for service-level requests, answered from the global
+	// AllowedOrigins rather than a bucket's CORS configuration
+	serviceOptionsHandler := func(w http.ResponseWriter, r *http.Request) {
+		if s3a.handleCORSOriginValidation(w, r) {
+			writeSuccessResponseEmpty(w, r)
+		}
+	}
+	// A path-style bucket router would take the health probe paths as bucket
+	// names, so their preflight is registered ahead of each one
+	const healthProbePath = "/{probe:status|healthz|readyz}"
+
 	var routers []*mux.Router
 	if s3a.option.DomainName != "" {
 		domainNames := strings.Split(s3a.option.DomainName, ",")
@@ -763,6 +965,7 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 
 		// Register path-style domains
 		for _, domain := range pathStyleDomains {
+			apiRouter.Host(domain).Methods(http.MethodOptions).Path(healthProbePath).HandlerFunc(serviceOptionsHandler)
 			routers = append(routers, apiRouter.Host(domain).PathPrefix("/{bucket}").Subrouter())
 			apiRouter.Host(domain).
 				Methods(http.MethodGet).
@@ -780,6 +983,7 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 	// arrive via an IP, an unlisted hostname, or a reverse proxy that rewrites
 	// the Host header still match bucket routes. Host-specific routers above
 	// take precedence because they were registered first.
+	apiRouter.Methods(http.MethodOptions).Path(healthProbePath).HandlerFunc(serviceOptionsHandler)
 	routers = append(routers, apiRouter.PathPrefix("/{bucket}").Subrouter())
 
 	// Get CORS middleware instance with caching
@@ -795,8 +999,9 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 		bucket.Use(corsMiddleware.Handler)
 
 		// Bucket-specific OPTIONS handler for CORS preflight requests
-		// Use PathPrefix to catch all bucket-level preflight routes including /bucket/object
-		bucket.PathPrefix("/").Methods(http.MethodOptions).HandlerFunc(corsMiddleware.HandleOptionsRequest)
+		// No path matcher, so it also catches the path-style bucket root (/bucket),
+		// which PathPrefix("/") would miss, as well as /bucket/ and /bucket/object
+		bucket.Methods(http.MethodOptions).HandlerFunc(corsMiddleware.HandleOptionsRequest)
 
 		// each case should follow the next rule:
 		// - requesting object with query must precede any other methods
@@ -836,16 +1041,16 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 		// PutObjectACL
 		bucket.Methods(http.MethodPut).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutObjectAclHandler, ACTION_WRITE_ACP)), "PUT")).Queries("acl", "")
 		// PutObjectRetention
-		bucket.Methods(http.MethodPut).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutObjectRetentionHandler, ACTION_WRITE)), "PUT")).Queries("retention", "")
+		bucket.Methods(http.MethodPut).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutObjectRetentionHandler, ACTION_PUT_OBJECT_RETENTION)), "PUT")).Queries("retention", "")
 		// PutObjectLegalHold
-		bucket.Methods(http.MethodPut).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutObjectLegalHoldHandler, ACTION_WRITE)), "PUT")).Queries("legal-hold", "")
+		bucket.Methods(http.MethodPut).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutObjectLegalHoldHandler, ACTION_PUT_OBJECT_LEGAL_HOLD)), "PUT")).Queries("legal-hold", "")
 
 		// GetObjectACL
 		bucket.Methods(http.MethodGet).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectAclHandler, ACTION_READ_ACP)), "GET")).Queries("acl", "")
 		// GetObjectRetention
-		bucket.Methods(http.MethodGet).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectRetentionHandler, ACTION_READ)), "GET")).Queries("retention", "")
+		bucket.Methods(http.MethodGet).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectRetentionHandler, ACTION_GET_OBJECT_RETENTION)), "GET")).Queries("retention", "")
 		// GetObjectLegalHold
-		bucket.Methods(http.MethodGet).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectLegalHoldHandler, ACTION_READ)), "GET")).Queries("legal-hold", "")
+		bucket.Methods(http.MethodGet).Path(objectPath).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectLegalHoldHandler, ACTION_GET_OBJECT_LEGAL_HOLD)), "GET")).Queries("legal-hold", "")
 
 		// objects with query
 
@@ -918,14 +1123,20 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketAccelerateConfigurationHandler, ACTION_READ)), "GET")).Queries("accelerate", "")
 		// GetBucketLogging
 		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketLoggingHandler, ACTION_READ)), "GET")).Queries("logging", "")
+		// GetBucketNotificationConfiguration
+		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketNotificationConfigurationHandler, ACTION_READ)), "GET")).Queries("notification", "")
+		// GetBucketReplication
+		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketReplicationHandler, ACTION_READ)), "GET")).Queries("replication", "")
+		// GetBucketWebsite
+		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketWebsiteHandler, ACTION_READ)), "GET")).Queries("website", "")
 
 		// GetBucketVersioning
 		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketVersioningHandler, ACTION_READ)), "GET")).Queries("versioning", "")
 		bucket.Methods(http.MethodPut).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutBucketVersioningHandler, ACTION_WRITE)), "PUT")).Queries("versioning", "")
 
 		// GetObjectLockConfiguration / PutObjectLockConfiguration (bucket-level operations)
-		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectLockConfigurationHandler, ACTION_READ)), "GET")).Queries("object-lock", "")
-		bucket.Methods(http.MethodPut).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutObjectLockConfigurationHandler, ACTION_WRITE)), "PUT")).Queries("object-lock", "")
+		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetObjectLockConfigurationHandler, ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG)), "GET")).Queries("object-lock", "")
+		bucket.Methods(http.MethodPut).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutObjectLockConfigurationHandler, ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG)), "PUT")).Queries("object-lock", "")
 
 		// GetBucketTagging
 		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketTaggingHandler, ACTION_TAGGING)), "GET")).Queries("tagging", "")
@@ -971,6 +1182,13 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 		//DeleteBucketOwnershipControls
 		bucket.Methods(http.MethodDelete).HandlerFunc(track(s3a.iam.Auth(s3a.DeleteBucketOwnershipControls, ACTION_ADMIN), "DELETE")).Queries("ownershipControls", "")
 
+		// SeaweedFS extension: bucket quota subresource
+		// PUT /{bucket}?seaweedfs-quota — set bucket quota (s3:PutBucketQuota)
+		// GET /{bucket}?seaweedfs-quota — get bucket quota (s3:GetBucketQuota)
+		// Authenticated via SigV4, authorized via dedicated IAM permissions.
+		bucket.Methods(http.MethodPut).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.PutBucketQuotaHandler, ACTION_PUT_BUCKET_QUOTA)), "PUT")).Queries("seaweedfs-quota", "")
+		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.GetBucketQuotaHandler, ACTION_GET_BUCKET_QUOTA)), "GET")).Queries("seaweedfs-quota", "")
+
 		// raw buckets
 
 		// PostPolicy
@@ -988,8 +1206,14 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 		// DeleteBucket
 		bucket.Methods(http.MethodDelete).HandlerFunc(track(s3a.iam.Auth(s3a.cb.Limit(s3a.DeleteBucketHandler, ACTION_DELETE_BUCKET)), "DELETE"))
 
-		// ListObjectsV1 (Legacy)
+		// ListObjectsV1 (Legacy). This is the catch-all GET on a bucket, so a
+		// subresource with no route of its own would be answered with a listing.
 		bucket.Methods(http.MethodGet).HandlerFunc(track(s3a.AuthWithPublicRead(func(w http.ResponseWriter, r *http.Request) {
+			if subresource, found := unroutedBucketSubresource(r); found {
+				glog.V(1).Infof("unimplemented bucket subresource ?%s", subresource)
+				s3err.WriteErrorResponse(w, r, s3err.ErrNotImplemented)
+				return
+			}
 			limitedHandler, _ := s3a.cb.Limit(s3a.ListObjectsV1Handler, ACTION_LIST)
 			limitedHandler(w, r)
 		}, ACTION_LIST), "LIST"))
@@ -1012,9 +1236,7 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
 				return
 			}
 
-			if s3a.handleCORSOriginValidation(w, r) {
-				writeSuccessResponseEmpty(w, r)
-			}
+			serviceOptionsHandler(w, r)
 		})
 
 	// STS API endpoint for AssumeRoleWithWebIdentity
@@ -1100,6 +1322,12 @@ func loadIAMManagerFromConfig(configPath string, filerAddressProvider func() str
 		Policy    *policy.PolicyEngineConfig    `json:"policy"`
 		Providers []map[string]interface{}      `json:"providers"`
 		Roles     []*integration.RoleDefinition `json:"roles"`
+		// OIDCProviderStore selects where IAM-managed OIDC providers persist.
+		// Absent, they live in memory and are lost on restart.
+		OIDCProviderStore *integration.OIDCProviderStoreConfig `json:"oidcProviderStore"`
+		// RoleStore selects where roles persist. Absent, they live in memory and
+		// only the roles in this file exist.
+		RoleStore *integration.RoleStoreConfig `json:"roleStore"`
 		Policies  []struct {
 			Name     string                 `json:"name"`
 			Document *policy.PolicyDocument `json:"document"`
@@ -1145,13 +1373,30 @@ func loadIAMManagerFromConfig(configPath string, filerAddressProvider func() str
 		glog.V(1).Infof("Using policy defaults: DefaultEffect=%s, StoreType=%s", configRoot.Policy.DefaultEffect, configRoot.Policy.StoreType)
 	}
 
+	// With no IAM config file there is nothing static for a persisted
+	// provider or role to shadow or outlive, so those created at runtime
+	// default to the filer, where restarts and peer S3 servers see them. A
+	// config file keeps the in-memory defaults unless it sets
+	// oidcProviderStore / roleStore.
+	persistByDefault := configPath == "" && filerAddressProvider != nil
+	oidcProviderStore := configRoot.OIDCProviderStore
+	if oidcProviderStore == nil && persistByDefault {
+		oidcProviderStore = &integration.OIDCProviderStoreConfig{StoreType: "filer"}
+	}
+	roleStore := configRoot.RoleStore
+	if roleStore == nil {
+		roleStore = &integration.RoleStoreConfig{StoreType: sts.StoreTypeMemory}
+		if persistByDefault {
+			roleStore = &integration.RoleStoreConfig{StoreType: "filer"}
+		}
+	}
+
 	// Create IAM configuration
 	iamConfig := &integration.IAMConfig{
-		STS:    configRoot.STS,
-		Policy: configRoot.Policy,
-		Roles: &integration.RoleStoreConfig{
-			StoreType: sts.StoreTypeMemory, // Use memory store for JSON config-based setup
-		},
+		STS:           configRoot.STS,
+		Policy:        configRoot.Policy,
+		Roles:         roleStore,
+		OIDCProviders: oidcProviderStore,
 	}
 
 	// Apply default signing key if not present in config
@@ -1234,11 +1479,7 @@ func loadIAMManagerFromConfig(configPath string, filerAddressProvider func() str
 	}
 
 	// Load roles
-	for _, roleDef := range configRoot.Roles {
-		if err := iamManager.CreateRole(context.Background(), "", roleDef.RoleName, roleDef); err != nil {
-			glog.Warningf("Failed to create role %s: %v", roleDef.RoleName, err)
-		}
-	}
+	iamManager.LoadStaticRoles(context.Background(), configRoot.Roles)
 
 	glog.V(1).Infof("Loaded %d providers, %d policies and %d roles from config", len(configRoot.Providers), len(configRoot.Policies), len(configRoot.Roles))
 
diff --git a/weed/s3api/s3api_server_grpc.go b/weed/s3api/s3api_server_grpc.go
index 2aae60b748..3613d993de 100644
--- a/weed/s3api/s3api_server_grpc.go
+++ b/weed/s3api/s3api_server_grpc.go
@@ -2,10 +2,13 @@ package s3api
 
 import (
 	"context"
+	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
 )
 
@@ -13,11 +16,54 @@ import (
 // This interface is dedicated to UNIDIRECTIONAL updates from Filer to S3 Server.
 // S3 Server acts purely as a cache.
 
+// checkAdminAuth verifies the caller presented a Bearer token signed by the
+// filer write-signing key (jwt.filer_signing.key). It mirrors the filer's
+// IamGrpcServer.checkAdminAuth so the same operator knob that locks down the
+// filer IAM gRPC service also locks down this cache. With no key configured
+// remote callers cannot be told apart, so only local clients (unix socket,
+// loopback, or the server's own addresses) are allowed.
+func (s3a *S3ApiServer) checkAdminAuth(ctx context.Context) error {
+	var signingKey security.SigningKey
+	if s3a.filerGuard != nil {
+		signingKey = s3a.filerGuard.SigningKey()
+	}
+	if len(signingKey) == 0 {
+		return checkLocalPeer(ctx)
+	}
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return status.Error(codes.Unauthenticated, "missing metadata")
+	}
+	authHeaders := md.Get("authorization")
+	if len(authHeaders) == 0 {
+		return status.Error(codes.Unauthenticated, "missing authorization metadata")
+	}
+	raw := strings.TrimSpace(authHeaders[0])
+	parts := strings.Fields(raw)
+	if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") || parts[1] == "" {
+		return status.Error(codes.Unauthenticated, "authorization header must use Bearer scheme")
+	}
+	parsed, err := security.DecodeJwt(signingKey, security.EncodedJwt(parts[1]), &security.SeaweedFilerAdminClaims{})
+	if err != nil || parsed == nil || !parsed.Valid {
+		return status.Error(codes.Unauthenticated, "invalid admin token")
+	}
+	if claims, ok := parsed.Claims.(*security.SeaweedFilerAdminClaims); !ok || claims.SessionId != "" {
+		return status.Error(codes.Unauthenticated, "invalid admin token")
+	}
+	return nil
+}
+
+func checkLocalPeer(ctx context.Context) error {
+	return security.CheckLocalGrpcPeer(ctx)
+}
+
 func (s3a *S3ApiServer) PutIdentity(ctx context.Context, req *iam_pb.PutIdentityRequest) (*iam_pb.PutIdentityResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req.Identity == nil {
 		return nil, status.Errorf(codes.InvalidArgument, "identity is required")
 	}
-	// Direct in-memory cache update
 	glog.V(1).Infof("IAM: received identity update for %s", req.Identity.Name)
 	if err := s3a.iam.UpsertIdentity(req.Identity); err != nil {
 		glog.Errorf("failed to update identity cache for %s: %v", req.Identity.Name, err)
@@ -27,16 +73,21 @@ func (s3a *S3ApiServer) PutIdentity(ctx context.Context, req *iam_pb.PutIdentity
 }
 
 func (s3a *S3ApiServer) RemoveIdentity(ctx context.Context, req *iam_pb.RemoveIdentityRequest) (*iam_pb.RemoveIdentityResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req.Username == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "username is required")
 	}
-	// Direct in-memory cache update
 	glog.V(1).Infof("IAM: received identity removal for %s", req.Username)
 	s3a.iam.RemoveIdentity(req.Username)
 	return &iam_pb.RemoveIdentityResponse{}, nil
 }
 
 func (s3a *S3ApiServer) PutPolicy(ctx context.Context, req *iam_pb.PutPolicyRequest) (*iam_pb.PutPolicyResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req.Name == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "policy name is required")
 	}
@@ -44,7 +95,6 @@ func (s3a *S3ApiServer) PutPolicy(ctx context.Context, req *iam_pb.PutPolicyRequ
 		return nil, status.Errorf(codes.InvalidArgument, "policy content is required")
 	}
 
-	// Update IAM policy cache
 	glog.V(1).Infof("IAM: received policy update for %s", req.Name)
 	if s3a.iam == nil {
 		return nil, status.Errorf(codes.Internal, "IAM not initialized")
@@ -58,11 +108,13 @@ func (s3a *S3ApiServer) PutPolicy(ctx context.Context, req *iam_pb.PutPolicyRequ
 }
 
 func (s3a *S3ApiServer) DeletePolicy(ctx context.Context, req *iam_pb.DeletePolicyRequest) (*iam_pb.DeletePolicyResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req.Name == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "policy name is required")
 	}
 
-	// Delete from IAM policy cache
 	glog.V(1).Infof("IAM: received policy removal for %s", req.Name)
 	if s3a.iam == nil {
 		return nil, status.Errorf(codes.Internal, "IAM not initialized")
@@ -76,6 +128,9 @@ func (s3a *S3ApiServer) DeletePolicy(ctx context.Context, req *iam_pb.DeletePoli
 }
 
 func (s3a *S3ApiServer) GetPolicy(ctx context.Context, req *iam_pb.GetPolicyRequest) (*iam_pb.GetPolicyResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req.Name == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "policy name is required")
 	}
@@ -93,6 +148,9 @@ func (s3a *S3ApiServer) GetPolicy(ctx context.Context, req *iam_pb.GetPolicyRequ
 }
 
 func (s3a *S3ApiServer) PutGroup(ctx context.Context, req *iam_pb.PutGroupRequest) (*iam_pb.PutGroupResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req.Group == nil {
 		return nil, status.Errorf(codes.InvalidArgument, "group is required")
 	}
@@ -108,6 +166,9 @@ func (s3a *S3ApiServer) PutGroup(ctx context.Context, req *iam_pb.PutGroupReques
 }
 
 func (s3a *S3ApiServer) RemoveGroup(ctx context.Context, req *iam_pb.RemoveGroupRequest) (*iam_pb.RemoveGroupResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	if req.GroupName == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "group name is required")
 	}
@@ -120,6 +181,9 @@ func (s3a *S3ApiServer) RemoveGroup(ctx context.Context, req *iam_pb.RemoveGroup
 }
 
 func (s3a *S3ApiServer) ListPolicies(ctx context.Context, req *iam_pb.ListPoliciesRequest) (*iam_pb.ListPoliciesResponse, error) {
+	if err := s3a.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
 	resp := &iam_pb.ListPoliciesResponse{}
 	if s3a.iam == nil {
 		return nil, status.Errorf(codes.Internal, "IAM not initialized")
diff --git a/weed/s3api/s3api_server_grpc_test.go b/weed/s3api/s3api_server_grpc_test.go
new file mode 100644
index 0000000000..1b3cf89018
--- /dev/null
+++ b/weed/s3api/s3api_server_grpc_test.go
@@ -0,0 +1,288 @@
+package s3api
+
+import (
+	"context"
+	"net"
+	"testing"
+	"time"
+
+	jwt "github.com/golang-jwt/jwt/v5"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+)
+
+const testS3IamCacheSigningKey = "s3-iam-cache-test-key-do-not-use-in-prod"
+
+func newTestS3IamCacheServer(t *testing.T, signingKey string) *S3ApiServer {
+	t.Helper()
+	s3a := newTestS3ApiServerWithMemoryIAM(t, nil)
+	s3a.filerGuard = security.NewGuard(nil, signingKey, 10, "", 60)
+	return s3a
+}
+
+func s3IamCacheBearerCtx(token string) context.Context {
+	md := metadata.New(map[string]string{"authorization": "Bearer " + token})
+	return metadata.NewIncomingContext(context.Background(), md)
+}
+
+func s3LocalPeerCtx() context.Context {
+	return peer.NewContext(context.Background(),
+		&peer.Peer{Addr: &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 1}})
+}
+
+func TestS3IamCache_NoMetadata_Unauthenticated(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.PutIdentity(context.Background(), &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity without metadata: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_MissingAuthorizationHeader_Unauthenticated(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	ctx := metadata.NewIncomingContext(context.Background(), metadata.New(map[string]string{"other": "value"}))
+	_, err := s.PutIdentity(ctx, &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity with no authorization header: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_NonBearerAuthorization_Unauthenticated(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	md := metadata.New(map[string]string{"authorization": "Basic dXNlcjpwYXNz"})
+	ctx := metadata.NewIncomingContext(context.Background(), md)
+	_, err := s.PutIdentity(ctx, &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity with non-Bearer scheme: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_InvalidToken_Unauthenticated(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	bad := security.GenJwtForFilerAdmin(security.SigningKey("a-different-key"), 60)
+	if bad == "" {
+		t.Fatal("GenJwtForFilerAdmin returned empty")
+	}
+	_, err := s.PutIdentity(s3IamCacheBearerCtx(string(bad)), &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity with mis-signed token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_GarbageToken_Unauthenticated(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.PutIdentity(s3IamCacheBearerCtx("not.a.jwt"), &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity with garbage token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_ExpiredToken_Unauthenticated(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	claims := security.SeaweedFilerAdminClaims{
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(-time.Hour)),
+		},
+	}
+	tok := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	encoded, err := tok.SignedString([]byte(testS3IamCacheSigningKey))
+	if err != nil {
+		t.Fatalf("SignedString: %v", err)
+	}
+	_, err = s.PutIdentity(s3IamCacheBearerCtx(encoded), &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity with expired token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_ValidToken_WritesIdentity(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	good := security.GenJwtForFilerAdmin(security.SigningKey(testS3IamCacheSigningKey), 60)
+	if good == "" {
+		t.Fatal("GenJwtForFilerAdmin returned empty")
+	}
+	_, err := s.PutIdentity(s3IamCacheBearerCtx(string(good)), &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{
+			Name:    "pushed",
+			Actions: []string{"Admin"},
+			Credentials: []*iam_pb.Credential{
+				{AccessKey: "AKIAPUSHED", SecretKey: "s3cr3t"},
+			},
+		},
+	})
+	if err != nil {
+		t.Fatalf("PutIdentity with valid token: unexpected error %v", err)
+	}
+	s.iam.m.RLock()
+	id := s.iam.accessKeyIdent["AKIAPUSHED"]
+	s.iam.m.RUnlock()
+	if id == nil {
+		t.Fatalf("expected pushed identity to land in accessKeyIdent map")
+	}
+	if !id.isAdmin() {
+		t.Fatalf("expected pushed identity to be admin, actions=%v", id.Actions)
+	}
+}
+
+// Without a signing key remote callers cannot be authenticated, so admin
+// RPCs are restricted to local clients: unix socket, loopback, or the
+// server's own interface addresses. Remote peers and missing peer info are
+// denied.
+func TestS3IamCache_NoSigningKey_RemotePeer_Unauthenticated(t *testing.T) {
+	s := newTestS3IamCacheServer(t, "")
+	_, err := s.PutIdentity(context.Background(), &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity with no peer info: got code %v, want %v (err=%v)", got, want, err)
+	}
+	remoteCtx := peer.NewContext(context.Background(),
+		&peer.Peer{Addr: &net.TCPAddr{IP: net.ParseIP("203.0.113.7"), Port: 11111}})
+	_, err = s.PutIdentity(remoteCtx, &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity from remote peer without key: got code %v, want %v (err=%v)", got, want, err)
+	}
+
+	unguarded := &S3ApiServer{}
+	if _, err := unguarded.PutIdentity(remoteCtx, &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	}); status.Code(err) != codes.Unauthenticated {
+		t.Fatalf("PutIdentity from remote peer with nil guard: got code %v, want Unauthenticated", status.Code(err))
+	}
+}
+
+func TestS3IamCache_NoSigningKey_LocalPeer_Allowed(t *testing.T) {
+	s := newTestS3IamCacheServer(t, "")
+	for name, addr := range map[string]net.Addr{
+		"unix":       &net.UnixAddr{Name: "/tmp/x.sock", Net: "unix"},
+		"loopback":   &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 11111},
+		"loopbackV6": &net.TCPAddr{IP: net.ParseIP("::1"), Port: 11111},
+	} {
+		ctx := peer.NewContext(context.Background(), &peer.Peer{Addr: addr})
+		if _, err := s.PutIdentity(ctx, &iam_pb.PutIdentityRequest{
+			Identity: &iam_pb.Identity{Name: "pushed-" + name, Actions: []string{"Read"}},
+		}); err != nil {
+			t.Fatalf("PutIdentity from %s peer without key: unexpected error %v", name, err)
+		}
+	}
+	if own := firstLocalTCPAddr(t); own != nil {
+		ctx := peer.NewContext(context.Background(), &peer.Peer{Addr: own})
+		if _, err := s.PutIdentity(ctx, &iam_pb.PutIdentityRequest{
+			Identity: &iam_pb.Identity{Name: "pushed-own-ip", Actions: []string{"Read"}},
+		}); err != nil {
+			t.Fatalf("PutIdentity from own interface address: unexpected error %v", err)
+		}
+	}
+	good := security.GenJwtForFilerAdmin(security.SigningKey(testS3IamCacheSigningKey), 60)
+	loopbackCtx := peer.NewContext(context.Background(),
+		&peer.Peer{Addr: &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 11111}})
+	ctx := metadata.NewIncomingContext(loopbackCtx, metadata.New(map[string]string{"authorization": "Bearer " + string(good)}))
+	if _, err := s.PutIdentity(ctx, &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pushed2", Actions: []string{"Read"}},
+	}); err != nil {
+		t.Fatalf("PutIdentity with stray token but no server key: unexpected error %v", err)
+	}
+}
+
+// With a signing key only a valid Bearer token is accepted; being local does
+// not bypass it.
+func TestS3IamCache_WithKey_LocalPeerStillNeedsToken(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	ctx := peer.NewContext(context.Background(),
+		&peer.Peer{Addr: &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 11111}})
+	_, err := s.PutIdentity(ctx, &iam_pb.PutIdentityRequest{
+		Identity: &iam_pb.Identity{Name: "pwn", Actions: []string{"Admin"}},
+	})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutIdentity from loopback without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func firstLocalTCPAddr(t *testing.T) *net.TCPAddr {
+	t.Helper()
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		t.Logf("interface addresses unavailable, skipping own-address case: %v", err)
+		return nil
+	}
+	for _, a := range addrs {
+		if ipNet, ok := a.(*net.IPNet); ok && !ipNet.IP.IsLoopback() {
+			return &net.TCPAddr{IP: ipNet.IP, Port: 11111}
+		}
+	}
+	return nil
+}
+
+func TestS3IamCache_RemoveIdentity_RequiresAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.RemoveIdentity(context.Background(), &iam_pb.RemoveIdentityRequest{Username: "anyone"})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("RemoveIdentity without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_PutPolicy_RequiresAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.PutPolicy(context.Background(), &iam_pb.PutPolicyRequest{Name: "p", Content: "{}"})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutPolicy without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_DeletePolicy_RequiresAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.DeletePolicy(context.Background(), &iam_pb.DeletePolicyRequest{Name: "p"})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("DeletePolicy without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_GetPolicy_RequiresAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.GetPolicy(context.Background(), &iam_pb.GetPolicyRequest{Name: "p"})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("GetPolicy without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_ListPolicies_RequiresAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.ListPolicies(context.Background(), &iam_pb.ListPoliciesRequest{})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("ListPolicies without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_PutGroup_RequiresAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.PutGroup(context.Background(), &iam_pb.PutGroupRequest{Group: &iam_pb.Group{Name: "g"}})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("PutGroup without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
+
+func TestS3IamCache_RemoveGroup_RequiresAuth(t *testing.T) {
+	s := newTestS3IamCacheServer(t, testS3IamCacheSigningKey)
+	_, err := s.RemoveGroup(context.Background(), &iam_pb.RemoveGroupRequest{GroupName: "g"})
+	if got, want := status.Code(err), codes.Unauthenticated; got != want {
+		t.Fatalf("RemoveGroup without token: got code %v, want %v (err=%v)", got, want, err)
+	}
+}
diff --git a/weed/s3api/s3api_server_routing_test.go b/weed/s3api/s3api_server_routing_test.go
index 6194abf60e..9316174924 100644
--- a/weed/s3api/s3api_server_routing_test.go
+++ b/weed/s3api/s3api_server_routing_test.go
@@ -1,6 +1,7 @@
 package s3api
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -12,9 +13,15 @@ import (
 	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
 	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/cors"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 // routingTestAccessKey/routingTestSecretKey are the credentials seeded into
@@ -205,6 +212,106 @@ func TestRouting_AuthenticatedIAM(t *testing.T) {
 	assert.Contains(t, []int{http.StatusBadRequest, http.StatusForbidden}, rr.Code, "Should route to IAM handler (400/403 due to invalid signature)")
 }
 
+// setupRoutingTestServerWithCreator seeds two non-admin identities holding
+// iam:CreateServiceAccount — creator with the coarse (unscoped) action,
+// keymaker with a policy scoped to the team-parent identity ARN — plus a
+// victim identity, so SigV4-signed CreateServiceAccount requests can exercise
+// UnifiedPostHandler's authorization against the ParentUser target.
+func setupRoutingTestServerWithCreator(t *testing.T) *S3ApiServer {
+	s3a := setupRoutingTestServer(t)
+	const creatorAK, creatorSK = "creator-ak", "creator-sk"
+	const keymakerAK, keymakerSK = "keymaker-ak", "keymaker-sk"
+
+	// Policy-bearing identities route through the IAM integration.
+	mgr := integration.NewIAMManager()
+	require.NoError(t, mgr.Initialize(&integration.IAMConfig{
+		STS: &sts.STSConfig{
+			TokenDuration:    sts.FlexibleDuration{Duration: time.Hour},
+			MaxSessionLength: sts.FlexibleDuration{Duration: 12 * time.Hour},
+			Issuer:           "test",
+			SigningKey:       []byte("test-signing-key-32-characters!!"),
+			AccountId:        "111122223333",
+		},
+		Policy: &policy.PolicyEngineConfig{DefaultEffect: "Deny", StoreType: "memory"},
+		Roles:  &integration.RoleStoreConfig{StoreType: "memory"},
+	}, func() string { return "localhost:8888" }))
+	s3a.iam.SetIAMIntegration(NewS3IAMIntegration(mgr, ""))
+
+	const zonePolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["iam:CreateServiceAccount"],"Resource":["arn:aws:iam:::user/team-parent"]}]}`
+	require.NoError(t, s3a.iam.PutPolicy("CreateSvcAcctZonePolicy", zonePolicy))
+	// Store and memory must agree: SigV4 auth reads memory, the handler
+	// re-reads the store, and a successful creation reloads memory from it.
+	idents := []*iam_pb.Identity{
+		{Name: "creator", Actions: []string{"iam:CreateServiceAccount"},
+			Credentials: []*iam_pb.Credential{{AccessKey: creatorAK, SecretKey: creatorSK}}},
+		{Name: "keymaker", PolicyNames: []string{"CreateSvcAcctZonePolicy"},
+			Credentials: []*iam_pb.Credential{{AccessKey: keymakerAK, SecretKey: keymakerSK}}},
+		{Name: "victim"},
+		{Name: "team-parent"},
+	}
+	require.NoError(t, s3a.credentialManager.SaveConfiguration(context.Background(), &iam_pb.S3ApiConfiguration{
+		Identities: idents,
+		Policies:   []*iam_pb.Policy{{Name: "CreateSvcAcctZonePolicy", Content: zonePolicy}},
+	}))
+	for _, ident := range idents {
+		require.NoError(t, s3a.iam.UpsertIdentity(ident))
+	}
+	s3a.cb = NewCircuitBreaker(s3a.option)
+	return s3a
+}
+
+// TestRouting_CreateServiceAccountParentUserScopedByPolicy verifies that on
+// the S3-port IAM route a non-admin holding iam:CreateServiceAccount targets
+// the identities its grant covers: the coarse action is unscoped (like a
+// wildcard resource), a policy scoped to one parent identity's ARN confines
+// the grant to that parent.
+func TestRouting_CreateServiceAccountParentUserScopedByPolicy(t *testing.T) {
+	router := mux.NewRouter()
+	s3a := setupRoutingTestServerWithCreator(t)
+	s3a.registerRouter(router)
+
+	sign := func(t *testing.T, req *http.Request, body, ak, sk string) {
+		t.Helper()
+		creds := credentials.NewStaticCredentials(ak, sk, "")
+		if _, err := v4.NewSigner(creds).Sign(req, strings.NewReader(body), "iam", "us-east-1", time.Now()); err != nil {
+			t.Fatalf("sign request: %v", err)
+		}
+	}
+
+	makeReq := func(parentUser, ak, sk string) *http.Request {
+		data := url.Values{}
+		data.Set("Action", "CreateServiceAccount")
+		data.Set("Version", "2010-05-08")
+		data.Set("ParentUser", parentUser)
+		body := data.Encode()
+		req, _ := http.NewRequest("POST", "http://localhost/", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		sign(t, req, body, ak, sk)
+		return req
+	}
+
+	serve := func(req *http.Request) *httptest.ResponseRecorder {
+		rr := httptest.NewRecorder()
+		router.ServeHTTP(rr, req)
+		return rr
+	}
+
+	// Coarse (unscoped) action: any target passes authorization and the
+	// service account is actually created.
+	rr := serve(makeReq("victim", "creator-ak", "creator-sk"))
+	assert.Equal(t, http.StatusOK, rr.Code, "coarse grant is unscoped; got body=%s", rr.Body.String())
+
+	// Scoped policy: the named parent passes (200), any other identity is denied.
+	rr2 := serve(makeReq("team-parent", "keymaker-ak", "keymaker-sk"))
+	assert.Equal(t, http.StatusOK, rr2.Code, "scoped grant must cover its named parent; got body=%s", rr2.Body.String())
+
+	rr3 := serve(makeReq("victim", "keymaker-ak", "keymaker-sk"))
+	assert.Equal(t, http.StatusForbidden, rr3.Code, "target outside the scoped grant must be denied; got body=%s", rr3.Body.String())
+
+	rr4 := serve(makeReq("keymaker", "keymaker-ak", "keymaker-sk"))
+	assert.Equal(t, http.StatusForbidden, rr4.Code, "even self is denied when the scoped grant does not name it; got body=%s", rr4.Body.String())
+}
+
 // TestRouting_IAMMatcherLogic verifies the iamMatcher correctly distinguishes auth types
 func TestRouting_IAMMatcherLogic(t *testing.T) {
 	tests := []struct {
@@ -336,3 +443,89 @@ func TestRouting_BucketRouteMatchesAnyHost(t *testing.T) {
 		})
 	}
 }
+
+// TestRouting_BucketRootPreflightUsesBucketCORS is a regression test: a
+// path-style preflight for the bucket root without a trailing
+// slash must be evaluated against the bucket CORS rules like /bucket/, not
+// answered from the global AllowedOrigins. Service-level paths keep the
+// global answer, and virtual-host routing is unchanged.
+func TestRouting_BucketRootPreflightUsesBucketCORS(t *testing.T) {
+	const (
+		bucket        = "cors-bucket"
+		allowedOrigin = "https://app.example.com"
+		foreignOrigin = "https://untrusted.example"
+	)
+	pathStyleBucketPaths := []string{"/" + bucket, "/" + bucket + "/", "/" + bucket + "?list-type=2", "/" + bucket + "/key"}
+
+	cases := []struct {
+		name         string
+		domainName   string
+		host         string
+		bucketPaths  []string // evaluated against the bucket CORS rules
+		servicePaths []string // answered from the global AllowedOrigins
+	}{
+		{
+			name:         "path-style",
+			host:         "10.0.0.5:8333",
+			bucketPaths:  pathStyleBucketPaths,
+			servicePaths: []string{"/", "/status", "/healthz", "/readyz"},
+		},
+		{
+			name:         "path-style domain",
+			domainName:   "s3.example.com,api.s3.example.com",
+			host:         "api.s3.example.com",
+			bucketPaths:  pathStyleBucketPaths,
+			servicePaths: []string{"/status", "/healthz", "/readyz"},
+		},
+		{
+			name:        "virtual-host domain",
+			domainName:  "s3.example.com,api.s3.example.com",
+			host:        bucket + ".s3.example.com",
+			bucketPaths: []string{"/", "/?list-type=2", "/key", "/status"},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s3a := setupRoutingTestServer(t)
+			s3a.option.DomainName = tc.domainName
+			s3a.option.AllowedOrigins = []string{"*"}
+			s3a.bucketConfigCache = NewBucketConfigCache(time.Minute)
+			s3a.bucketConfigCache.Set(bucket, &BucketConfig{
+				Name: bucket,
+				CORS: &cors.CORSConfiguration{CORSRules: []cors.CORSRule{{
+					AllowedOrigins: []string{allowedOrigin},
+					AllowedMethods: []string{http.MethodGet, http.MethodPut},
+					AllowedHeaders: []string{"*"},
+				}}},
+			})
+			router := mux.NewRouter()
+			s3a.registerRouter(router)
+
+			preflight := func(path, origin string) *httptest.ResponseRecorder {
+				req := httptest.NewRequest(http.MethodOptions, "http://"+tc.host+path, nil)
+				req.Header.Set("Origin", origin)
+				req.Header.Set("Access-Control-Request-Method", http.MethodPut)
+				rr := httptest.NewRecorder()
+				router.ServeHTTP(rr, req)
+				return rr
+			}
+
+			for _, path := range tc.bucketPaths {
+				rr := preflight(path, foreignOrigin)
+				assert.Equal(t, http.StatusForbidden, rr.Code, "foreign origin on %s", path)
+				assert.Empty(t, rr.Header().Get("Access-Control-Allow-Origin"), "foreign origin on %s", path)
+
+				rr = preflight(path, allowedOrigin)
+				assert.Equal(t, http.StatusOK, rr.Code, "allowed origin on %s", path)
+				assert.Equal(t, allowedOrigin, rr.Header().Get("Access-Control-Allow-Origin"), "allowed origin on %s", path)
+			}
+
+			for _, path := range tc.servicePaths {
+				rr := preflight(path, foreignOrigin)
+				assert.Equal(t, http.StatusOK, rr.Code, "service-level %s", path)
+				assert.Equal(t, "*", rr.Header().Get("Access-Control-Allow-Origin"), "service-level %s", path)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/s3api_sosapi.go b/weed/s3api/s3api_sosapi.go
index e0594a6dcf..f1c635e7ae 100644
--- a/weed/s3api/s3api_sosapi.go
+++ b/weed/s3api/s3api_sosapi.go
@@ -156,9 +156,13 @@ func (s3a *S3ApiServer) getCapacityInfo(ctx context.Context, bucket string) (cap
 		masterMap[string(master)] = master
 	}
 
+	// Cluster capacity below is read from disk counters, which a filtered
+	// listing still reports in full.
+	collectionName := s3a.getCollectionName(bucket)
+
 	// Connect to any available master and get volume list (topology)
 	err = pb.WithOneOfGrpcMasterClients(false, masterMap, s3a.option.GrpcDialOption, func(client master_pb.SeaweedClient) error {
-		resp, vErr := client.VolumeList(ctx, &master_pb.VolumeListRequest{})
+		resp, vErr := client.VolumeList(ctx, &master_pb.VolumeListRequest{Collection: collectionName})
 		if vErr != nil {
 			return vErr
 		}
@@ -168,7 +172,7 @@ func (s3a *S3ApiServer) getCapacityInfo(ctx context.Context, bucket string) (cap
 		}
 
 		// Calculate used size for the bucket by summing up volumes in the collection
-		used = collectBucketUsageFromTopology(resp.TopologyInfo, s3a.getCollectionName(bucket))
+		used = collectBucketUsageFromTopology(resp.TopologyInfo, collectionName)
 
 		// Calculate cluster capacity if no quota
 		if quota > 0 {
diff --git a/weed/s3api/s3api_sse_stream_status_test.go b/weed/s3api/s3api_sse_stream_status_test.go
new file mode 100644
index 0000000000..5ef4138af2
--- /dev/null
+++ b/weed/s3api/s3api_sse_stream_status_test.go
@@ -0,0 +1,110 @@
+package s3api
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// the SSE mirror of the plain-path deferred commit: the 200 must not be
+// committed until the first fetched-and-decrypted byte is written
+func TestS3SSEStreamCommitsStatusOnFirstWrite(t *testing.T) {
+	plaintext := []byte("0123456789")
+	keyPair := GenerateTestSSECKey(1)
+
+	newSSECRequest := func(rangeHeader string) *http.Request {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		t.Cleanup(cancel)
+		r := httptest.NewRequest(http.MethodGet, "/mybucket/dir/obj.bin", nil).WithContext(ctx)
+		SetupTestSSECHeaders(r, keyPair)
+		if rangeHeader != "" {
+			r.Header.Set("Range", rangeHeader)
+		}
+		return r
+	}
+
+	encrypt := func(t *testing.T, r *http.Request) (ciphertext, iv []byte) {
+		customerKey, err := ParseSSECHeaders(r)
+		require.NoError(t, err)
+		encReader, iv, err := CreateSSECEncryptedReader(bytes.NewReader(plaintext), customerKey)
+		require.NoError(t, err)
+		ciphertext, err = io.ReadAll(encReader)
+		require.NoError(t, err)
+		return ciphertext, iv
+	}
+
+	t.Run("readable SSE-C object still streams a 200 with the plaintext", func(t *testing.T) {
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, "faketest-sseok", nil))
+		r := newSSECRequest("")
+		ciphertext, iv := encrypt(t, r)
+		entry := &filer_pb.Entry{
+			Name:       "obj.bin",
+			Attributes: &filer_pb.FuseAttributes{FileSize: uint64(len(plaintext))},
+			Content:    ciphertext,
+			Extended: map[string][]byte{
+				s3_constants.AmzServerSideEncryptionCustomerAlgorithm: []byte("AES256"),
+				s3_constants.AmzServerSideEncryptionCustomerKeyMD5:    []byte(keyPair.KeyMD5),
+				s3_constants.SeaweedFSSSEIV:                           iv,
+			},
+		}
+		w := httptest.NewRecorder()
+
+		err := s3a.streamFromVolumeServersWithSSE(w, r, entry, s3_constants.SSETypeC, "mybucket", "dir/obj.bin", "")
+
+		require.NoError(t, err)
+		assert.Equal(t, http.StatusOK, w.Code)
+		assert.Equal(t, plaintext, w.Body.Bytes())
+		assert.Equal(t, "AES256", w.Header().Get(s3_constants.AmzServerSideEncryptionCustomerAlgorithm))
+	})
+
+	unreadableEntry := func(t *testing.T, r *http.Request) *filer_pb.Entry {
+		_, iv := encrypt(t, r)
+		return &filer_pb.Entry{
+			Name:       "obj.bin",
+			Attributes: &filer_pb.FuseAttributes{FileSize: uint64(len(plaintext))},
+			Chunks:     []*filer_pb.FileChunk{{FileId: "1,0123456789ab", Size: uint64(len(plaintext))}},
+			Extended: map[string][]byte{
+				s3_constants.AmzServerSideEncryptionCustomerKeyMD5: []byte(keyPair.KeyMD5),
+				s3_constants.SeaweedFSSSEIV:                        iv,
+			},
+		}
+	}
+
+	assertNothingCommitted := func(t *testing.T, w *httptest.ResponseRecorder, err error) {
+		require.Error(t, err)
+		var streamErr *StreamError
+		assert.False(t, errors.As(err, &streamErr) && streamErr.ResponseWritten,
+			"the caller must still own the error response")
+		assert.Zero(t, w.Body.Len(), "no body bytes may precede the failure")
+	}
+
+	t.Run("unreadable SSE-C object leaves the response uncommitted", func(t *testing.T) {
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, "faketest-ssefail", nil))
+		r := newSSECRequest("")
+		w := httptest.NewRecorder()
+
+		err := s3a.streamFromVolumeServersWithSSE(w, r, unreadableEntry(t, r), s3_constants.SSETypeC, "mybucket", "dir/obj.bin", "")
+
+		assertNothingCommitted(t, w, err)
+	})
+
+	t.Run("unreadable SSE-C range leaves the response uncommitted", func(t *testing.T) {
+		s3a := newLocalReadFallbackServer(t, startStreamThroughFiler(t, "faketest-sserange", nil))
+		r := newSSECRequest("bytes=2-5")
+		w := httptest.NewRecorder()
+
+		err := s3a.streamFromVolumeServersWithSSE(w, r, unreadableEntry(t, r), s3_constants.SSETypeC, "mybucket", "dir/obj.bin", "")
+
+		assertNothingCommitted(t, w, err)
+	})
+}
diff --git a/weed/s3api/s3api_sts.go b/weed/s3api/s3api_sts.go
index e142d5f845..9daa1cacf7 100644
--- a/weed/s3api/s3api_sts.go
+++ b/weed/s3api/s3api_sts.go
@@ -131,9 +131,16 @@ func parseDurationSecondsWithBounds(r *http.Request, minSec, maxSec int64) (*int
 	return &ds, "", nil
 }
 
-// parseDurationSeconds parses DurationSeconds for AssumeRole (15 min to 12 hours)
-func parseDurationSeconds(r *http.Request) (*int64, STSErrorCode, error) {
-	return parseDurationSecondsWithBounds(r, minDurationSeconds, maxDurationSeconds)
+// parseDurationSeconds parses DurationSeconds for AssumeRole (15 min to MaxSessionLength)
+func (h *STSHandlers) parseDurationSeconds(r *http.Request) (*int64, STSErrorCode, error) {
+	maxSec := maxDurationSeconds
+	if h.stsService != nil && h.stsService.Config != nil && h.stsService.Config.MaxSessionLength.Duration > 0 {
+		configuredMax := int64(h.stsService.Config.MaxSessionLength.Duration / time.Second)
+		if configuredMax >= minDurationSeconds {
+			maxSec = configuredMax
+		}
+	}
+	return parseDurationSecondsWithBounds(r, minDurationSeconds, maxSec)
 }
 
 // Removed generateSecureCredentials - now using STS service's JWT token generation
@@ -253,7 +260,7 @@ func (h *STSHandlers) handleAssumeRoleWithWebIdentity(w http.ResponseWriter, r *
 	}
 
 	// Parse and validate DurationSeconds using helper
-	durationSeconds, errCode, err := parseDurationSeconds(r)
+	durationSeconds, errCode, err := h.parseDurationSeconds(r)
 	if err != nil {
 		h.writeSTSErrorResponse(w, r, errCode, err)
 		return
@@ -350,7 +357,7 @@ func (h *STSHandlers) handleAssumeRole(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Parse and validate DurationSeconds using helper
-	durationSeconds, errCode, err := parseDurationSeconds(r)
+	durationSeconds, errCode, err := h.parseDurationSeconds(r)
 	if err != nil {
 		h.writeSTSErrorResponse(w, r, errCode, err)
 		return
@@ -393,6 +400,9 @@ func (h *STSHandlers) handleAssumeRole(w http.ResponseWriter, r *http.Request) {
 		identity.Name, roleArn, roleSessionName)
 
 	assumesSelf := roleArn == ""
+	// trustedPrincipal is the caller a named role's trust policy admitted;
+	// issuance evaluates that trust again on the definition it binds.
+	var trustedPrincipal string
 
 	// A named role is authorized by its trust policy, which declares which
 	// principals may assume it, so no separate identity-side sts:AssumeRole allow
@@ -408,6 +418,7 @@ func (h *STSHandlers) handleAssumeRole(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 		callerArn := h.callerPrincipalArn(identity)
+		trustedPrincipal = callerArn
 		if err := h.iam.ValidateTrustPolicyForPrincipal(r.Context(), roleArn, callerArn); err != nil {
 			glog.V(2).Infof("AssumeRole: %s not authorized to assume %s: %v", identity.Name, roleArn, err)
 			h.writeSTSErrorResponse(w, r, STSErrAccessDenied,
@@ -454,7 +465,13 @@ func (h *STSHandlers) handleAssumeRole(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Generate common STS components
-	stsCreds, assumedUser, err := h.prepareSTSCredentials(r.Context(), roleArn, roleSessionName, durationSeconds, sessionPolicyJSON, modifyClaims)
+	stsCreds, assumedUser, err := h.prepareSTSCredentials(r.Context(), roleArn, trustedPrincipal, roleSessionName, durationSeconds, sessionPolicyJSON, modifyClaims)
+	if errors.Is(err, integration.ErrTrustPolicyDenied) {
+		// The role was replaced after its trust check by one that does not
+		// trust the caller.
+		h.writeSTSErrorResponse(w, r, STSErrAccessDenied, fmt.Errorf("trust policy denies access"))
+		return
+	}
 	if err != nil {
 		h.writeSTSErrorResponse(w, r, STSErrInternalError, err)
 		return
@@ -506,7 +523,7 @@ func (h *STSHandlers) handleAssumeRoleWithLDAPIdentity(w http.ResponseWriter, r
 	}
 
 	// Parse and validate DurationSeconds using helper
-	durationSeconds, errCode, err := parseDurationSeconds(r)
+	durationSeconds, errCode, err := h.parseDurationSeconds(r)
 	if err != nil {
 		h.writeSTSErrorResponse(w, r, errCode, err)
 		return
@@ -577,7 +594,8 @@ func (h *STSHandlers) handleAssumeRoleWithLDAPIdentity(w http.ResponseWriter, r
 
 	// Verify that the identity is allowed to assume the role by checking the Trust Policy
 	// The LDAP user doesn't have identity policies, so we strictly check if the Role trusts this principal.
-	if err := h.iam.ValidateTrustPolicyForPrincipal(r.Context(), roleArn, ldapUserIdentity.PrincipalArn); err != nil {
+	trustedPrincipal := ldapUserIdentity.PrincipalArn
+	if err := h.iam.ValidateTrustPolicyForPrincipal(r.Context(), roleArn, trustedPrincipal); err != nil {
 		glog.V(2).Infof("AssumeRoleWithLDAPIdentity: trust policy validation failed for %s to assume %s: %v", ldapUsername, roleArn, err)
 		h.writeSTSErrorResponse(w, r, STSErrAccessDenied, fmt.Errorf("trust policy denies access"))
 		return
@@ -595,7 +613,13 @@ func (h *STSHandlers) handleAssumeRoleWithLDAPIdentity(w http.ResponseWriter, r
 		claims.WithIdentityProvider("ldap", identity.UserID, identity.Provider)
 	}
 
-	stsCreds, assumedUser, err := h.prepareSTSCredentials(r.Context(), roleArn, roleSessionName, durationSeconds, sessionPolicyJSON, modifyClaims)
+	stsCreds, assumedUser, err := h.prepareSTSCredentials(r.Context(), roleArn, trustedPrincipal, roleSessionName, durationSeconds, sessionPolicyJSON, modifyClaims)
+	if errors.Is(err, integration.ErrTrustPolicyDenied) {
+		// The role was replaced after its trust check by one that does not
+		// trust the caller.
+		h.writeSTSErrorResponse(w, r, STSErrAccessDenied, fmt.Errorf("trust policy denies access"))
+		return
+	}
 	if err != nil {
 		h.writeSTSErrorResponse(w, r, STSErrInternalError, err)
 		return
@@ -647,19 +671,6 @@ func (h *STSHandlers) handleGetFederationToken(w http.ResponseWriter, r *http.Re
 		return
 	}
 
-	// Reject calls from temporary credentials (session tokens) early,
-	// before SigV4 verification — no need to authenticate first.
-	// GetFederationToken can only be called by long-term IAM users.
-	securityToken := r.Header.Get("X-Amz-Security-Token")
-	if securityToken == "" {
-		securityToken = r.URL.Query().Get("X-Amz-Security-Token")
-	}
-	if securityToken != "" {
-		h.writeSTSErrorResponse(w, r, STSErrAccessDenied,
-			fmt.Errorf("GetFederationToken cannot be called with temporary credentials"))
-		return
-	}
-
 	// Check if STS service is initialized
 	if h.stsService == nil || !h.stsService.IsInitialized() {
 		h.writeSTSErrorResponse(w, r, STSErrSTSNotReady,
@@ -689,6 +700,13 @@ func (h *STSHandlers) handleGetFederationToken(w http.ResponseWriter, r *http.Re
 		return
 	}
 
+	// GetFederationToken can only be called by long-term IAM users.
+	if extractSessionToken(r) != "" {
+		h.writeSTSErrorResponse(w, r, STSErrAccessDenied,
+			fmt.Errorf("GetFederationToken cannot be called with temporary credentials"))
+		return
+	}
+
 	r = r.WithContext(recordIdentityInContext(r, identity))
 
 	glog.V(2).Infof("GetFederationToken: caller identity=%s, name=%s", identity.Name, name)
@@ -795,7 +813,7 @@ func (h *STSHandlers) handleGetFederationToken(w http.ResponseWriter, r *http.Re
 	}
 
 	// Generate temporary credentials
-	stsCredGen := sts.NewCredentialGenerator()
+	stsCredGen := h.stsService.GetCredentialGenerator()
 	stsCredsDet, err := stsCredGen.GenerateTemporaryCredentials(sessionId, expiration)
 	if err != nil {
 		h.writeSTSErrorResponse(w, r, STSErrInternalError,
@@ -824,15 +842,59 @@ func (h *STSHandlers) handleGetFederationToken(w http.ResponseWriter, r *http.Re
 }
 
 // prepareSTSCredentials extracts common shared logic for credential generation
-func (h *STSHandlers) prepareSTSCredentials(ctx context.Context, roleArn, roleSessionName string,
+//
+// principalArn is the caller whose assumption of a named role was authorized
+// by its trust policy. The role is resolved once, with that trust evaluated
+// again on the definition resolved, and the session's role ID, duration cap
+// and embedded policies all come from that one definition: a role replaced
+// under the same name between the caller's trust check and here yields no
+// session rather than one for a role whose trust was never checked.
+func (h *STSHandlers) prepareSTSCredentials(ctx context.Context, roleArn, principalArn, roleSessionName string,
 	durationSeconds *int64, sessionPolicy string, modifyClaims func(*sts.STSSessionClaims)) (STSCredentials, *AssumedRoleUser, error) {
 
-	// Calculate duration
-	duration := time.Hour // Default 1 hour
-	if durationSeconds != nil {
+	duration := time.Hour
+	if h.stsService != nil && h.stsService.Config != nil {
+		duration = h.stsService.CalculateSessionDuration(durationSeconds)
+	} else if durationSeconds != nil {
 		duration = time.Duration(*durationSeconds) * time.Second
 	}
 
+	// A named role's MaxSessionDuration bounds the resolved duration the same
+	// way capDurationByRole does on the SDK paths; self-assumption has no role
+	// definition to consult. The role's ID binds the session to this role, so
+	// a named role that cannot be resolved here gets no session: one issued
+	// without the ID would be bound to no role at all.
+	var roleID string
+	var resolvedRole *integration.RoleDefinition
+	if h.iam != nil && h.iam.iamIntegration != nil {
+		if roleName := utils.ExtractRoleNameFromArn(roleArn); roleName != "" {
+			if provider, ok := h.iam.iamIntegration.(IAMManagerProvider); ok {
+				if mgr := provider.GetIAMManager(); mgr != nil {
+					var roleDef *integration.RoleDefinition
+					var roleErr error
+					if principalArn != "" {
+						roleDef, roleErr = mgr.ResolveRoleForPrincipal(ctx, roleArn, principalArn)
+					} else {
+						roleDef, roleErr = mgr.GetRole(ctx, roleName)
+					}
+					if roleErr != nil {
+						return STSCredentials{}, nil, fmt.Errorf("resolve role %s: %w", roleName, roleErr)
+					}
+					if roleDef == nil {
+						return STSCredentials{}, nil, fmt.Errorf("role %s not found", roleName)
+					}
+					resolvedRole = roleDef
+					roleID = roleDef.RoleId
+					if roleDef.MaxSessionDuration > 0 {
+						if roleMax := time.Duration(roleDef.MaxSessionDuration) * time.Second; duration > roleMax {
+							duration = roleMax
+						}
+					}
+				}
+			}
+		}
+	}
+
 	// Generate session ID
 	sessionId, err := sts.GenerateSessionId()
 	if err != nil {
@@ -869,7 +931,8 @@ func (h *STSHandlers) prepareSTSCredentials(ctx context.Context, roleArn, roleSe
 	// This ensures that subsequent requests using this token are correctly identified as the assumed role.
 	claims := sts.NewSTSSessionClaims(sessionId, h.stsService.Config.Issuer, expiration).
 		WithSessionName(roleSessionName).
-		WithRoleInfo(effectiveRoleArn, fmt.Sprintf("%s:%s", roleName, roleSessionName), assumedRoleArn)
+		WithRoleInfo(effectiveRoleArn, fmt.Sprintf("%s:%s", roleName, roleSessionName), assumedRoleArn).
+		WithRoleId(roleID)
 
 	// If IAM integration is available, embed the role's attached policies into the session token.
 	// This makes the token self-sufficient for authorization even when role lookup is unavailable.
@@ -887,7 +950,10 @@ func (h *STSHandlers) prepareSTSCredentials(ctx context.Context, roleArn, roleSe
 		}
 
 		if roleNameForPolicies != "" && len(claims.Policies) == 0 {
-			roleDef, err := policyManager.GetRole(ctx, roleNameForPolicies)
+			roleDef, err := resolvedRole, error(nil)
+			if roleDef == nil || roleDef.RoleName != roleNameForPolicies {
+				roleDef, err = policyManager.GetRole(ctx, roleNameForPolicies)
+			}
 			if err != nil {
 				glog.V(2).Infof("Failed to load role %q for policy embedding: %v", roleNameForPolicies, err)
 			} else if roleDef == nil {
@@ -914,7 +980,7 @@ func (h *STSHandlers) prepareSTSCredentials(ctx context.Context, roleArn, roleSe
 	}
 
 	// Generate temporary credentials (deterministic based on sessionId)
-	stsCredGen := sts.NewCredentialGenerator()
+	stsCredGen := h.stsService.GetCredentialGenerator()
 	stsCredsDet, err := stsCredGen.GenerateTemporaryCredentials(sessionId, expiration)
 	if err != nil {
 		return STSCredentials{}, nil, fmt.Errorf("failed to generate temporary credentials: %w", err)
diff --git a/weed/s3api/s3api_sts_assume_role_test.go b/weed/s3api/s3api_sts_assume_role_test.go
index 27e74a79d7..af7f62718b 100644
--- a/weed/s3api/s3api_sts_assume_role_test.go
+++ b/weed/s3api/s3api_sts_assume_role_test.go
@@ -78,7 +78,7 @@ func TestAssumeRole_CallerIdentityFallback(t *testing.T) {
 			}
 		}
 
-		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), fallbackRoleArn, "test-session", nil, "", modifyClaims)
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), fallbackRoleArn, "", "test-session", nil, "", modifyClaims)
 		require.NoError(t, err)
 
 		// Assertions
@@ -110,7 +110,7 @@ func TestAssumeRole_CallerIdentityFallback(t *testing.T) {
 
 		fallbackRoleArn := callerIdentity.PrincipalArn
 
-		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), fallbackRoleArn, "nested-session", nil, "", nil)
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), fallbackRoleArn, "", "nested-session", nil, "", nil)
 		require.NoError(t, err)
 
 		// The role name should be extracted from the assumed role ARN ("admin")
@@ -127,7 +127,7 @@ func TestAssumeRole_CallerIdentityFallback(t *testing.T) {
 	t.Run("Explicit RoleArn Provided", func(t *testing.T) {
 		explicitRoleArn := "arn:aws:iam::111122223333:role/TargetRole"
 
-		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), explicitRoleArn, "explicit-session", nil, "", nil)
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), explicitRoleArn, "", "explicit-session", nil, "", nil)
 		require.NoError(t, err)
 
 		// Role name should be "TargetRole"
@@ -143,7 +143,7 @@ func TestAssumeRole_CallerIdentityFallback(t *testing.T) {
 	t.Run("Malformed ARN", func(t *testing.T) {
 		malformedArn := "invalid-arn"
 
-		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), malformedArn, "bad-session", nil, "", nil)
+		stsCreds, assumedUser, err := stsHandlers.prepareSTSCredentials(context.Background(), malformedArn, "", "bad-session", nil, "", nil)
 		require.NoError(t, err)
 
 		// Fallback behavior: use full string as role name if extraction fails
@@ -187,7 +187,7 @@ func TestAssumeRole_EmbedsRolePolicies(t *testing.T) {
 		stsHandlers := NewSTSHandlers(manager.GetSTSService(), iam)
 
 		roleArn := fmt.Sprintf("arn:aws:iam::%s:role/%s", defaultAccountID, roleName)
-		stsCreds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, "test-session", nil, "", nil)
+		stsCreds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, "", "test-session", nil, "", nil)
 		require.NoError(t, err)
 
 		sessionInfo, err := manager.GetSTSService().ValidateSessionToken(ctx, stsCreds.SessionToken)
@@ -211,7 +211,7 @@ func TestAssumeRole_EmbedsRolePolicies(t *testing.T) {
 		stsHandlers := NewSTSHandlers(manager.GetSTSService(), iam)
 
 		roleArn := fmt.Sprintf("arn:aws:iam::%s:role/%s", defaultAccountID, roleName)
-		stsCreds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, "test-session", nil, "", nil)
+		stsCreds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, "", "test-session", nil, "", nil)
 		require.NoError(t, err)
 
 		sessionInfo, err := manager.GetSTSService().ValidateSessionToken(ctx, stsCreds.SessionToken)
@@ -241,3 +241,100 @@ func newTestSTSIntegrationManager(t *testing.T) *integration.IAMManager {
 	require.NoError(t, manager.Initialize(config, func() string { return "" }))
 	return manager
 }
+
+// AssumeRole derives its session length from the same default-then-cap rule as
+// the service layer (#11473): an omitted DurationSeconds yields TokenDuration,
+// and either path is capped at MaxSessionLength.
+func TestPrepareSTSCredentialsHonorsConfiguredDurations(t *testing.T) {
+	stsService := sts.NewSTSService()
+	require.NoError(t, stsService.Initialize(&sts.STSConfig{
+		TokenDuration:    sts.FlexibleDuration{Duration: 15 * time.Minute},
+		MaxSessionLength: sts.FlexibleDuration{Duration: 20 * time.Minute},
+		Issuer:           "test-issuer",
+		SigningKey:       []byte("test-signing-key-at-least-32-bytes-long-for-security"),
+	}))
+	stsHandlers := NewSTSHandlers(stsService, nil)
+	roleArn := fmt.Sprintf("arn:aws:iam::%s:role/test-role", defaultAccountID)
+
+	expiresIn := func(durationSeconds *int64) time.Duration {
+		stsCreds, _, err := stsHandlers.prepareSTSCredentials(context.Background(), roleArn, "", "test-session", durationSeconds, "", nil)
+		require.NoError(t, err)
+		exp, err := time.Parse(time.RFC3339, stsCreds.Expiration)
+		require.NoError(t, err)
+		return time.Until(exp)
+	}
+
+	oneHour := int64(3600)
+	assert.InDelta(t, (15 * time.Minute).Seconds(), expiresIn(nil).Seconds(), 60)
+	assert.InDelta(t, (20 * time.Minute).Seconds(), expiresIn(&oneHour).Seconds(), 60)
+}
+
+// A named role's MaxSessionDuration bounds the session however DurationSeconds
+// was resolved, matching the SDK paths' capDurationByRole.
+func TestPrepareSTSCredentialsCapsAtRoleMaxDuration(t *testing.T) {
+	ctx := context.Background()
+	manager := newTestSTSIntegrationManager(t)
+	require.NoError(t, manager.CreateRole(ctx, "", "ShortLivedRole", &integration.RoleDefinition{
+		RoleName:           "ShortLivedRole",
+		MaxSessionDuration: 3600,
+	}))
+
+	stsService := sts.NewSTSService()
+	require.NoError(t, stsService.Initialize(&sts.STSConfig{
+		TokenDuration:    sts.FlexibleDuration{Duration: 2 * time.Hour},
+		MaxSessionLength: sts.FlexibleDuration{Duration: 12 * time.Hour},
+		Issuer:           "test-issuer",
+		SigningKey:       []byte("test-signing-key-at-least-32-bytes-long-for-security"),
+	}))
+	iam := &IdentityAccessManagement{iamIntegration: NewS3IAMIntegration(manager, "")}
+	stsHandlers := NewSTSHandlers(stsService, iam)
+	roleArn := fmt.Sprintf("arn:aws:iam::%s:role/ShortLivedRole", defaultAccountID)
+
+	expiresIn := func(durationSeconds *int64) time.Duration {
+		stsCreds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, "", "test-session", durationSeconds, "", nil)
+		require.NoError(t, err)
+		exp, err := time.Parse(time.RFC3339, stsCreds.Expiration)
+		require.NoError(t, err)
+		return time.Until(exp)
+	}
+
+	twoHours := int64(7200)
+	assert.InDelta(t, float64(3600), expiresIn(nil).Seconds(), 60, "omitted duration resolves to the 2h default but the role caps it at 1h")
+	assert.InDelta(t, float64(3600), expiresIn(&twoHours).Seconds(), 60, "explicit duration above the role max is capped")
+}
+
+// A session is issued from the role definition whose trust admits the
+// caller. A role replaced after the caller's trust check by one that does
+// not trust the caller yields no session, not one bound to the replacement.
+func TestPrepareSTSCredentialsChecksTrustOnTheRoleItBinds(t *testing.T) {
+	ctx := context.Background()
+	manager := newTestSTSIntegrationManager(t)
+	trusting := func(principal string) *policy.PolicyDocument {
+		return &policy.PolicyDocument{Version: "2012-10-17", Statement: []policy.Statement{{
+			Effect: "Allow", Action: []string{"sts:AssumeRole"},
+			Principal: map[string]interface{}{"AWS": principal},
+		}}}
+	}
+	caller := fmt.Sprintf("arn:aws:iam::%s:user/alice", defaultAccountID)
+	roleName := "ReplacedRole"
+	roleArn := fmt.Sprintf("arn:aws:iam::%s:role/%s", defaultAccountID, roleName)
+	stsHandlers := NewSTSHandlers(manager.GetSTSService(), &IdentityAccessManagement{iamIntegration: NewS3IAMIntegration(manager, "")})
+
+	// The caller's trust check passed against a role since replaced by one
+	// trusting someone else.
+	require.NoError(t, manager.CreateRole(ctx, "", roleName, &integration.RoleDefinition{
+		RoleName: roleName, TrustPolicy: trusting(fmt.Sprintf("arn:aws:iam::%s:user/bob", defaultAccountID)),
+	}))
+	_, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, caller, "s", nil, "", nil)
+	require.ErrorIs(t, err, integration.ErrTrustPolicyDenied, "a session was issued for a role that does not trust the caller")
+
+	// A replacement that does trust the caller binds its own ID.
+	require.NoError(t, manager.CreateRole(ctx, "", roleName, &integration.RoleDefinition{RoleName: roleName, TrustPolicy: trusting(caller)}))
+	role, err := manager.GetRole(ctx, roleName)
+	require.NoError(t, err)
+	creds, _, err := stsHandlers.prepareSTSCredentials(ctx, roleArn, caller, "s", nil, "", nil)
+	require.NoError(t, err)
+	session, err := manager.GetSTSService().ValidateSessionToken(ctx, creds.SessionToken)
+	require.NoError(t, err)
+	assert.Equal(t, role.RoleId, session.RoleId)
+}
diff --git a/weed/s3api/s3api_sts_duration_test.go b/weed/s3api/s3api_sts_duration_test.go
new file mode 100644
index 0000000000..e19f24cc16
--- /dev/null
+++ b/weed/s3api/s3api_sts_duration_test.go
@@ -0,0 +1,105 @@
+package s3api
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newDurationSecondsRequest(t *testing.T, seconds string) *http.Request {
+	t.Helper()
+	form := url.Values{}
+	if seconds != "" {
+		form.Set("DurationSeconds", seconds)
+	}
+	req, err := http.NewRequest("POST", "/", strings.NewReader(form.Encode()))
+	require.NoError(t, err)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	require.NoError(t, req.ParseForm())
+	return req
+}
+
+func newSTSHandlersWithMaxSession(t *testing.T, maxSession time.Duration) *STSHandlers {
+	t.Helper()
+	s := sts.NewSTSService()
+	require.NoError(t, s.Initialize(&sts.STSConfig{
+		Issuer:           "test-issuer",
+		SigningKey:       []byte("test-signing-key-at-least-32-bytes-long-for-security"),
+		TokenDuration:    sts.FlexibleDuration{Duration: time.Hour},
+		MaxSessionLength: sts.FlexibleDuration{Duration: maxSession},
+	}))
+	return NewSTSHandlers(s, nil)
+}
+
+func TestParseDurationSeconds_RespectsConfiguredMaxSessionLength(t *testing.T) {
+	h := newSTSHandlersWithMaxSession(t, 168*time.Hour)
+
+	ds, errCode, err := h.parseDurationSeconds(newDurationSecondsRequest(t, "604800"))
+	require.NoError(t, err)
+	assert.Equal(t, STSErrorCode(""), errCode)
+	if assert.NotNil(t, ds) {
+		assert.Equal(t, int64(604800), *ds)
+	}
+}
+
+func TestParseDurationSeconds_RejectsAboveConfiguredMaxSessionLength(t *testing.T) {
+	h := newSTSHandlersWithMaxSession(t, 24*time.Hour)
+
+	ds, errCode, err := h.parseDurationSeconds(newDurationSecondsRequest(t, "90000"))
+	assert.Error(t, err)
+	assert.Equal(t, STSErrInvalidParameterValue, errCode)
+	assert.Nil(t, ds)
+}
+
+func TestParseDurationSeconds_FallsBackToDefaultWhenUnset(t *testing.T) {
+	h := &STSHandlers{stsService: nil}
+
+	ds, errCode, err := h.parseDurationSeconds(newDurationSecondsRequest(t, "43200"))
+	require.NoError(t, err)
+	assert.Equal(t, STSErrorCode(""), errCode)
+	if assert.NotNil(t, ds) {
+		assert.Equal(t, int64(43200), *ds)
+	}
+
+	_, errCode, err = h.parseDurationSeconds(newDurationSecondsRequest(t, "43201"))
+	assert.Error(t, err)
+	assert.Equal(t, STSErrInvalidParameterValue, errCode)
+}
+
+func TestParseDurationSeconds_EnforcesMinimum(t *testing.T) {
+	h := newSTSHandlersWithMaxSession(t, 168*time.Hour)
+
+	_, errCode, err := h.parseDurationSeconds(newDurationSecondsRequest(t, "899"))
+	assert.Error(t, err)
+	assert.Equal(t, STSErrInvalidParameterValue, errCode)
+}
+
+func TestParseDurationSeconds_EmptyReturnsNil(t *testing.T) {
+	h := newSTSHandlersWithMaxSession(t, 168*time.Hour)
+
+	ds, errCode, err := h.parseDurationSeconds(newDurationSecondsRequest(t, ""))
+	require.NoError(t, err)
+	assert.Equal(t, STSErrorCode(""), errCode)
+	assert.Nil(t, ds)
+}
+
+func TestParseDurationSeconds_SubMinimumMaxSessionLengthKeepsCapping(t *testing.T) {
+	h := newSTSHandlersWithMaxSession(t, 5*time.Minute)
+
+	ds, errCode, err := h.parseDurationSeconds(newDurationSecondsRequest(t, "900"))
+	require.NoError(t, err)
+	assert.Equal(t, STSErrorCode(""), errCode)
+	if assert.NotNil(t, ds) {
+		assert.Equal(t, int64(900), *ds)
+	}
+
+	_, errCode, err = h.parseDurationSeconds(newDurationSecondsRequest(t, "43201"))
+	assert.Error(t, err)
+	assert.Equal(t, STSErrInvalidParameterValue, errCode)
+}
diff --git a/weed/s3api/s3api_sts_get_federation_token_test.go b/weed/s3api/s3api_sts_get_federation_token_test.go
index 7375a18221..071c71613c 100644
--- a/weed/s3api/s3api_sts_get_federation_token_test.go
+++ b/weed/s3api/s3api_sts_get_federation_token_test.go
@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"sort"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -129,34 +130,46 @@ func TestGetFederationToken_WithSessionPolicy(t *testing.T) {
 	assert.Equal(t, []string{"S3FullAccess"}, sessionInfo.Policies)
 }
 
-// TestGetFederationToken_RejectTemporaryCredentials tests that requests with
-// session tokens are rejected.
+// TestGetFederationToken_RejectTemporaryCredentials tests that requests
+// authenticated with temporary credentials are rejected.
 func TestGetFederationToken_RejectTemporaryCredentials(t *testing.T) {
 	stsService, _ := setupTestSTSService(t)
-	stsHandlers := NewSTSHandlers(stsService, &IdentityAccessManagement{
-		iamIntegration: &MockIAMIntegration{},
-	})
+	iam := &IdentityAccessManagement{
+		iamIntegration: &MockIAMIntegration{
+			validateSessionFunc: func(context.Context, string) (*sts.SessionInfo, error) {
+				return &sts.SessionInfo{
+					AssumedRoleUser: "role/user",
+					Principal:       "arn:aws:sts:::assumed-role/role/user",
+					Credentials: &sts.Credentials{
+						AccessKeyId:     "STSACCESSKEY",
+						SecretAccessKey: "sts-secret-key",
+					},
+					ExpiresAt: time.Now().Add(time.Hour),
+				}, nil
+			},
+		},
+		hashes:       make(map[string]*sync.Pool),
+		hashCounters: make(map[string]*int32),
+	}
+	stsHandlers := NewSTSHandlers(stsService, iam)
 
 	tests := []struct {
-		name        string
-		setToken    func(r *http.Request)
-		description string
+		name     string
+		setToken func(r *http.Request)
 	}{
 		{
 			name: "SessionTokenInHeader",
 			setToken: func(r *http.Request) {
-				r.Header.Set("X-Amz-Security-Token", "some-session-token")
+				r.Header.Set("X-Amz-Security-Token", "session-token")
 			},
-			description: "Session token in X-Amz-Security-Token header should be rejected",
 		},
 		{
 			name: "SessionTokenInQuery",
 			setToken: func(r *http.Request) {
 				q := r.URL.Query()
-				q.Set("X-Amz-Security-Token", "some-session-token")
+				q.Set("X-Amz-Security-Token", "session-token")
 				r.URL.RawQuery = q.Encode()
 			},
-			description: "Session token in query string should be rejected",
 		},
 	}
 
@@ -167,28 +180,47 @@ func TestGetFederationToken_RejectTemporaryCredentials(t *testing.T) {
 			form.Set("Name", "TestUser")
 			form.Set("Version", "2011-06-15")
 
-			req := httptest.NewRequest("POST", "/", strings.NewReader(form.Encode()))
+			req := mustNewRequest(http.MethodPost, "http://sts.amazonaws.com/",
+				int64(len(form.Encode())), strings.NewReader(form.Encode()), t)
 			req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 			tt.setToken(req)
-
-			// Parse form so the handler can read it
-			require.NoError(t, req.ParseForm())
-			// Re-set values after parse
-			req.Form.Set("Action", "GetFederationToken")
-			req.Form.Set("Name", "TestUser")
-			req.Form.Set("Version", "2011-06-15")
+			require.NoError(t, signRequestV4(req, "STSACCESSKEY", "sts-secret-key"))
 
 			rr := httptest.NewRecorder()
 			stsHandlers.HandleSTSRequest(rr, req)
 
-			// The handler rejects temporary credentials before SigV4 verification
-			assert.Equal(t, http.StatusForbidden, rr.Code, tt.description)
+			assert.Equal(t, http.StatusForbidden, rr.Code)
 			assert.Contains(t, rr.Body.String(), "AccessDenied")
 			assert.Contains(t, rr.Body.String(), "cannot be called with temporary credentials")
 		})
 	}
 }
 
+// A session token attached to a statically configured credential (as credential
+// vendors emit) must not disqualify the caller as temporary.
+func TestGetFederationToken_VendedStaticCredential(t *testing.T) {
+	stsService, _ := setupTestSTSService(t)
+	iam := newTestIAMWithCreds()
+	stsHandlers := NewSTSHandlers(stsService, iam)
+
+	form := url.Values{}
+	form.Set("Action", "GetFederationToken")
+	form.Set("Name", "VendedApp")
+	form.Set("Version", "2011-06-15")
+
+	req := mustNewRequest(http.MethodPost, "http://sts.amazonaws.com/",
+		int64(len(form.Encode())), strings.NewReader(form.Encode()), t)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("X-Amz-Security-Token", "vendor-token")
+	require.NoError(t, signRequestV4(req, "access_key_1", "secret_key_1"))
+
+	rr := httptest.NewRecorder()
+	stsHandlers.HandleSTSRequest(rr, req)
+
+	assert.Equal(t, http.StatusOK, rr.Code, rr.Body.String())
+	assert.Contains(t, rr.Body.String(), "GetFederationTokenResponse")
+}
+
 // TestGetFederationToken_MissingName tests that a missing Name parameter returns an error
 func TestGetFederationToken_MissingName(t *testing.T) {
 	stsService, _ := setupTestSTSService(t)
diff --git a/weed/s3api/s3api_sts_web_identity_http_test.go b/weed/s3api/s3api_sts_web_identity_http_test.go
index 1c045261c3..ff05a11d9c 100644
--- a/weed/s3api/s3api_sts_web_identity_http_test.go
+++ b/weed/s3api/s3api_sts_web_identity_http_test.go
@@ -7,10 +7,12 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"encoding/xml"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -97,6 +99,7 @@ func TestAssumeRoleWithWebIdentityOverHTTP(t *testing.T) {
 	iam := &IdentityAccessManagement{iamIntegration: NewS3IAMIntegration(manager, "")}
 	handlers := NewSTSHandlers(manager.GetSTSService(), iam)
 
+	var jtiCounter atomic.Int64
 	signOIDCToken := func(t *testing.T, subject string) string {
 		t.Helper()
 		token := jwt.NewWithClaims(jwt.SigningMethodRS256, jwt.MapClaims{
@@ -105,6 +108,10 @@ func TestAssumeRoleWithWebIdentityOverHTTP(t *testing.T) {
 			"aud": "test-client",
 			"exp": time.Now().Add(time.Hour).Unix(),
 			"iat": time.Now().Unix(),
+			// a unique jti per token: the exchange consumes it, so two
+			// subtests minting the same claims in one second would otherwise
+			// collide on the token fingerprint and read as a replay
+			"jti": fmt.Sprintf("%s-%d", subject, jtiCounter.Add(1)),
 		})
 		token.Header["kid"] = "web-identity-test-key"
 		signed, err := token.SignedString(key)
diff --git a/weed/s3api/s3api_subresource_ambiguity.go b/weed/s3api/s3api_subresource_ambiguity.go
new file mode 100644
index 0000000000..34e326f4e3
--- /dev/null
+++ b/weed/s3api/s3api_subresource_ambiguity.go
@@ -0,0 +1,20 @@
+package s3api
+
+import (
+	"net/http"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// rejectAmbiguousSubresource applies the same one-operation-per-request rule
+// validateRequestPath enforces inside bucket routes to the routes outside them,
+// so the check runs once for every request the router serves.
+func rejectAmbiguousSubresource(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if hasAmbiguousSubresource(r.URL.Query()) {
+			s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
diff --git a/weed/s3api/s3api_subresource_ambiguity_test.go b/weed/s3api/s3api_subresource_ambiguity_test.go
new file mode 100644
index 0000000000..d461f9076a
--- /dev/null
+++ b/weed/s3api/s3api_subresource_ambiguity_test.go
@@ -0,0 +1,56 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestRejectAmbiguousSubresource(t *testing.T) {
+	passthrough := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) })
+	for _, query := range []string{
+		"policy",
+		"policy=",
+		"tagging&versionId=v1",
+		"list-type=2&prefix=a&continuation-token=x",
+		"uploadId=abc&partNumber=3",
+		"uploads",
+		"acl&X-Amz-Signature=x&X-Amz-Expires=900",
+		"analytics&id=weekly",
+		"delete",
+		"versions&versionId=",
+		"versioning",
+		"prefix=a&expected-bucket-owner=123",
+		"tagging&tagging=x",
+		"",
+	} {
+		r := httptest.NewRequest(http.MethodPut, "http://localhost/bucket?"+query, nil)
+		w := httptest.NewRecorder()
+		rejectAmbiguousSubresource(passthrough).ServeHTTP(w, r)
+		if w.Code != http.StatusTeapot {
+			t.Errorf("%q should pass through, got %d", query, w.Code)
+		}
+	}
+
+	for _, query := range []string{
+		"tagging&policy",
+		"policy&tagging",
+		"list-type=2&policy",
+		"versions&policy",
+		"versioning&policy",
+		"delete&policy",
+		"cors&policy",
+		"acl&tagging",
+		"tagging&seaweedfs-quota",
+		"uploadId=x&acl",
+		"retention&legal-hold",
+		"ownershipControls&encryption",
+	} {
+		r := httptest.NewRequest(http.MethodPut, "http://localhost/bucket?"+query, nil)
+		w := httptest.NewRecorder()
+		rejectAmbiguousSubresource(passthrough).ServeHTTP(w, r)
+		if w.Code != http.StatusBadRequest {
+			t.Errorf("%q should be rejected, got %d", query, w.Code)
+		}
+	}
+}
diff --git a/weed/s3api/s3api_tables.go b/weed/s3api/s3api_tables.go
index a1eb54d6f1..5a382d0f3f 100644
--- a/weed/s3api/s3api_tables.go
+++ b/weed/s3api/s3api_tables.go
@@ -52,6 +52,12 @@ func (st *S3TablesApiServer) SetIAMAuthorizer(authorizer s3tables.IAMAuthorizer)
 	st.handler.SetIAMAuthorizer(authorizer)
 }
 
+// SetLocalAccountChecker injects the predicate recognizing configured local
+// account IDs for S3 Tables legacy-owner checks.
+func (st *S3TablesApiServer) SetLocalAccountChecker(fn func(string) bool) {
+	st.handler.SetLocalAccountChecker(fn)
+}
+
 // S3TablesHandler handles S3 Tables API requests
 func (st *S3TablesApiServer) S3TablesHandler(w http.ResponseWriter, r *http.Request) {
 	st.handler.HandleRequest(w, r, st)
@@ -66,6 +72,9 @@ func (st *S3TablesApiServer) WithFilerClient(streamingMode bool, fn func(filer_p
 func (s3a *S3ApiServer) registerS3TablesRoutes(router *mux.Router) {
 	// Create S3 Tables handler
 	s3TablesApi := NewS3TablesApiServer(s3a)
+	if s3a.iam != nil {
+		s3TablesApi.SetLocalAccountChecker(s3a.iam.isConfiguredAccountID)
+	}
 	if s3a.iam != nil && s3a.iam.iamIntegration != nil {
 		s3TablesApi.SetDefaultAllow(s3a.iam.iamIntegration.DefaultAllow())
 		if s3Integration, ok := s3a.iam.iamIntegration.(*S3IAMIntegration); ok && s3Integration.iamManager != nil {
@@ -76,8 +85,9 @@ func (s3a *S3ApiServer) registerS3TablesRoutes(router *mux.Router) {
 		s3TablesApi.SetDefaultAllow(true)
 	}
 
-	// Regex for S3 Tables Bucket ARN
-	const tableBucketARNRegex = "arn:aws:s3tables:[^/:]*:[^/:]*:bucket/[^/]+"
+	// Regex for S3 Tables Bucket ARN. The partition is not fixed to "aws":
+	// aws-cn and aws-us-gov ARNs are valid and have to reach the handlers.
+	const tableBucketARNRegex = s3tables.ARNPrefixPatternStr + ":[^/:]*:[^/:]*:bucket/[^/]+"
 
 	// REST-style S3 Tables API routes (used by AWS CLI)
 	targetMatcher := func(r *http.Request, rm *mux.RouteMatch) bool {
@@ -133,11 +143,22 @@ func (s3a *S3ApiServer) registerS3TablesRoutes(router *mux.Router) {
 	router.Methods(http.MethodDelete).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/policy").MatcherFunc(serviceMatcher).
 		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("DeleteTablePolicy", buildDeleteTablePolicyRequest)), "S3Tables-DeleteTablePolicy"))
 
-	router.Methods(http.MethodPost).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").MatcherFunc(serviceMatcher).
+	router.Methods(http.MethodPut).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/maintenance/{type}").MatcherFunc(serviceMatcher).
+		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("PutTableBucketMaintenanceConfiguration", buildPutTableBucketMaintenanceConfigurationRequest)), "S3Tables-PutTableBucketMaintenanceConfiguration"))
+	router.Methods(http.MethodGet).Path("/buckets/{tableBucketARN:" + tableBucketARNRegex + "}/maintenance").MatcherFunc(serviceMatcher).
+		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetTableBucketMaintenanceConfiguration", buildGetTableBucketMaintenanceConfigurationRequest)), "S3Tables-GetTableBucketMaintenanceConfiguration"))
+	router.Methods(http.MethodPut).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/maintenance/{type}").MatcherFunc(serviceMatcher).
+		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("PutTableMaintenanceConfiguration", buildPutTableMaintenanceConfigurationRequest)), "S3Tables-PutTableMaintenanceConfiguration"))
+	router.Methods(http.MethodGet).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/maintenance").MatcherFunc(serviceMatcher).
+		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetTableMaintenanceConfiguration", buildGetTableMaintenanceConfigurationRequest)), "S3Tables-GetTableMaintenanceConfiguration"))
+	router.Methods(http.MethodGet).Path("/tables/{tableBucketARN:" + tableBucketARNRegex + "}/{namespace}/{name}/maintenance-job-status").MatcherFunc(serviceMatcher).
+		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("GetTableMaintenanceJobStatus", buildGetTableMaintenanceJobStatusRequest)), "S3Tables-GetTableMaintenanceJobStatus"))
+
+	router.Methods(http.MethodPost).Path("/tag/{resourceArn:" + s3tables.ARNPrefixPatternStr + ":.*}").MatcherFunc(serviceMatcher).
 		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("TagResource", buildTagResourceRequest)), "S3Tables-TagResource"))
-	router.Methods(http.MethodGet).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").MatcherFunc(serviceMatcher).
+	router.Methods(http.MethodGet).Path("/tag/{resourceArn:" + s3tables.ARNPrefixPatternStr + ":.*}").MatcherFunc(serviceMatcher).
 		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("ListTagsForResource", buildListTagsForResourceRequest)), "S3Tables-ListTagsForResource"))
-	router.Methods(http.MethodDelete).Path("/tag/{resourceArn:arn:aws:s3tables:.*}").MatcherFunc(serviceMatcher).
+	router.Methods(http.MethodDelete).Path("/tag/{resourceArn:" + s3tables.ARNPrefixPatternStr + ":.*}").MatcherFunc(serviceMatcher).
 		HandlerFunc(track(s3a.authenticateS3Tables(s3TablesApi.handleRestOperation("UntagResource", buildUntagResourceRequest)), "S3Tables-UntagResource"))
 
 	router.Methods(http.MethodGet).Path("/get-table").MatcherFunc(serviceMatcher).
@@ -689,20 +710,18 @@ func (s3a *S3ApiServer) authenticateS3Tables(f http.HandlerFunc) http.HandlerFun
 		// Use AuthSignatureOnly to authenticate the request without authorizing specific actions
 		identity, errCode := s3a.iam.AuthSignatureOnly(r)
 		if errCode != s3err.ErrNone {
-			// If IAM is enabled but DefaultAllow is true, we can proceed even if unauthenticated
-			// authorization checks in handlers will then use DefaultAllow logic.
-			if s3a.iam.iamIntegration != nil && s3a.iam.iamIntegration.DefaultAllow() {
-				glog.V(2).Infof("S3Tables: AuthSignatureOnly failed (%v), but DefaultAllow is true, proceeding", errCode)
-			} else {
-				glog.Errorf("S3Tables: AuthSignatureOnly failed: %v", errCode)
-				s3err.WriteErrorResponse(w, r, errCode)
-				return
-			}
+			glog.Errorf("S3Tables: AuthSignatureOnly failed: %v", errCode)
+			s3err.WriteErrorResponse(w, r, errCode)
+			return
 		}
 
 		// Store the authenticated identity in request context
 		if identity != nil && identity.Name != "" {
-			glog.V(2).Infof("S3Tables: authenticated identity Name=%s Account.Id=%s", identity.Name, identity.Account.Id)
+			accountId := ""
+			if identity.Account != nil {
+				accountId = identity.Account.Id
+			}
+			glog.V(2).Infof("S3Tables: authenticated identity Name=%s Account.Id=%s", identity.Name, accountId)
 			r = r.WithContext(recordIdentityInContext(r, identity))
 		} else {
 			glog.V(2).Infof("S3Tables: authenticated identity is nil or empty name")
@@ -711,3 +730,94 @@ func (s3a *S3ApiServer) authenticateS3Tables(f http.HandlerFunc) http.HandlerFun
 		f(w, r)
 	}
 }
+
+// maintenanceTableTarget pulls the bucket/namespace/table triple every
+// table-scoped maintenance route carries in its path.
+func maintenanceTableTarget(r *http.Request) (tableBucketARN string, namespace []string, name string, err error) {
+	if tableBucketARN, err = getDecodedPathParam(r, "tableBucketARN"); err != nil {
+		return "", nil, "", err
+	}
+	if namespace, err = parseRequiredNamespacePathParam(r, "namespace"); err != nil {
+		return "", nil, "", err
+	}
+	if name, err = getDecodedPathParam(r, "name"); err != nil {
+		return "", nil, "", err
+	}
+	if name == "" {
+		return "", nil, "", fmt.Errorf("name is required")
+	}
+	if _, err = s3tables.ValidateTableName(name); err != nil {
+		return "", nil, "", err
+	}
+	return tableBucketARN, namespace, name, nil
+}
+
+func buildPutTableBucketMaintenanceConfigurationRequest(r *http.Request) (interface{}, error) {
+	var req s3tables.PutTableBucketMaintenanceConfigurationRequest
+	if err := readS3TablesJSONBody(r, &req); err != nil {
+		return nil, err
+	}
+	tableBucketARN, err := getDecodedPathParam(r, "tableBucketARN")
+	if err != nil {
+		return nil, err
+	}
+	maintenanceType, err := getDecodedPathParam(r, "type")
+	if err != nil {
+		return nil, err
+	}
+	req.TableBucketARN = tableBucketARN
+	req.Type = maintenanceType
+	return &req, nil
+}
+
+func buildGetTableBucketMaintenanceConfigurationRequest(r *http.Request) (interface{}, error) {
+	tableBucketARN, err := getDecodedPathParam(r, "tableBucketARN")
+	if err != nil {
+		return nil, err
+	}
+	return &s3tables.GetTableBucketMaintenanceConfigurationRequest{TableBucketARN: tableBucketARN}, nil
+}
+
+func buildPutTableMaintenanceConfigurationRequest(r *http.Request) (interface{}, error) {
+	var req s3tables.PutTableMaintenanceConfigurationRequest
+	if err := readS3TablesJSONBody(r, &req); err != nil {
+		return nil, err
+	}
+	tableBucketARN, namespace, name, err := maintenanceTableTarget(r)
+	if err != nil {
+		return nil, err
+	}
+	maintenanceType, err := getDecodedPathParam(r, "type")
+	if err != nil {
+		return nil, err
+	}
+	req.TableBucketARN = tableBucketARN
+	req.Namespace = namespace
+	req.Name = name
+	req.Type = maintenanceType
+	return &req, nil
+}
+
+func buildGetTableMaintenanceConfigurationRequest(r *http.Request) (interface{}, error) {
+	tableBucketARN, namespace, name, err := maintenanceTableTarget(r)
+	if err != nil {
+		return nil, err
+	}
+	return &s3tables.GetTableMaintenanceConfigurationRequest{
+		TableBucketARN: tableBucketARN,
+		Namespace:      namespace,
+		Name:           name,
+	}, nil
+}
+
+func buildGetTableMaintenanceJobStatusRequest(r *http.Request) (interface{}, error) {
+	tableBucketARN, namespace, name, err := maintenanceTableTarget(r)
+	if err != nil {
+		return nil, err
+	}
+	return &s3tables.GetTableMaintenanceJobStatusRequest{
+		TableBucketARN: tableBucketARN,
+		Namespace:      namespace,
+		Name:           name,
+	}, nil
+}
diff --git a/weed/s3api/s3api_tables_auth_test.go b/weed/s3api/s3api_tables_auth_test.go
new file mode 100644
index 0000000000..6ab18d59d1
--- /dev/null
+++ b/weed/s3api/s3api_tables_auth_test.go
@@ -0,0 +1,171 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws/credentials"
+	v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/iceberg"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/lance"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// setupDefaultAllowAuthServer builds the wiring NewS3ApiServer produces when
+// S3 credentials are configured but no -iam.config file was given: auth is
+// enforced while the IAM policy engine still defaults to allow.
+func setupDefaultAllowAuthServer(t *testing.T) *S3ApiServer {
+	t.Helper()
+	s3a := setupRoutingTestServer(t)
+	manager, err := loadIAMManagerFromConfig("",
+		func() string { return "localhost:8888" },
+		func() string { return "test-signing-key" })
+	require.NoError(t, err)
+	require.True(t, manager.DefaultAllow())
+	s3a.iam.iamIntegration = NewS3IAMIntegration(manager, "")
+	return s3a
+}
+
+func forgedS3TablesRequest(t *testing.T, method, target string) *http.Request {
+	t.Helper()
+	req, err := http.NewRequest(method, "http://localhost"+target, nil)
+	require.NoError(t, err)
+	req.Header.Set("Authorization", "AWS4-HMAC-SHA256 Credential=AAAA/20260917/us-east-1/s3tables/aws4_request, SignedHeaders=host, Signature=00")
+	return req
+}
+
+func TestS3TablesAuthRejectsFailedSignature(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+
+	req := forgedS3TablesRequest(t, http.MethodGet, "/buckets")
+	req.Header.Set(s3_constants.AmzAccountId, "admin")
+
+	reached := false
+	rr := httptest.NewRecorder()
+	s3a.authenticateS3Tables(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	})(rr, req)
+
+	assert.False(t, reached, "failed authentication must not reach the S3 Tables handler")
+	assert.GreaterOrEqual(t, rr.Code, http.StatusBadRequest)
+	assert.Empty(t, req.Header.Get(s3_constants.AmzAccountId), "client-supplied account header must not survive authentication")
+}
+
+func TestS3TablesAuthControlDataPlane(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+
+	req := forgedS3TablesRequest(t, http.MethodGet, "/buckets")
+	reached := false
+	rr := httptest.NewRecorder()
+	s3a.iam.Auth(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+	}, s3_constants.ACTION_READ)(rr, req)
+
+	assert.False(t, reached, "control: data plane must reject the same forged request")
+	assert.GreaterOrEqual(t, rr.Code, http.StatusBadRequest)
+}
+
+func TestS3TablesAuthOpenWhenAuthDisabled(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+	s3a.iam.isAuthEnabled = false
+
+	req := forgedS3TablesRequest(t, http.MethodGet, "/buckets")
+	reached := false
+	rr := httptest.NewRecorder()
+	s3a.authenticateS3Tables(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	})(rr, req)
+
+	assert.True(t, reached, "zero-config gateway keeps serving unauthenticated requests")
+	assert.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestS3TablesAuthSignedRequestPassess(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+
+	req, err := http.NewRequest(http.MethodGet, "http://localhost/buckets", nil)
+	require.NoError(t, err)
+	creds := credentials.NewStaticCredentials(routingTestAccessKey, routingTestSecretKey, "")
+	_, err = v4.NewSigner(creds).Sign(req, strings.NewReader(""), "s3tables", "us-east-1", time.Now())
+	require.NoError(t, err)
+
+	reached := false
+	rr := httptest.NewRecorder()
+	s3a.authenticateS3Tables(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	})(rr, req)
+
+	assert.True(t, reached, "properly signed request must still pass; got %d %s", rr.Code, rr.Body.String())
+}
+
+func TestSignedAccountHeaderDoesNotReachHandler(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+
+	req, err := http.NewRequest(http.MethodGet, "http://localhost/buckets", nil)
+	require.NoError(t, err)
+	req.Header.Set(s3_constants.AmzAccountId, "admin")
+	signRoutingTestRequest(t, req, "", "s3tables")
+	require.Contains(t, req.Header.Get("Authorization"), "s3-account-id", "the header must be covered by the signature")
+
+	reached := false
+	rr := httptest.NewRecorder()
+	s3a.authenticateS3Tables(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	})(rr, req)
+
+	assert.True(t, reached, "a signature covering s3-account-id must still verify; got %d %s", rr.Code, rr.Body.String())
+	assert.Empty(t, req.Header.Get(s3_constants.AmzAccountId), "the signed-in header value must not survive authentication")
+}
+
+func TestIcebergAuthRejectsFailedSignature(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+	server := iceberg.NewServer(nil, s3a)
+
+	req := forgedS3TablesRequest(t, http.MethodGet, "/v1/namespaces")
+	reached := false
+	rr := httptest.NewRecorder()
+	server.Auth(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	})(rr, req)
+
+	assert.False(t, reached, "failed authentication must not reach the Iceberg handler")
+	assert.NotEqual(t, http.StatusOK, rr.Code)
+}
+
+func TestLanceAuthRejectsFailedSignature(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+	server := lance.NewServer(nil, s3a)
+
+	req := forgedS3TablesRequest(t, http.MethodGet, "/v1/namespace/list")
+	reached := false
+	rr := httptest.NewRecorder()
+	server.Auth(func(w http.ResponseWriter, r *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	})(rr, req)
+
+	assert.False(t, reached, "failed authentication must not reach the Lance handler")
+	assert.NotEqual(t, http.StatusOK, rr.Code)
+}
+
+func TestAuthSignatureOnlyScrubsAccountHeader(t *testing.T) {
+	s3a := setupDefaultAllowAuthServer(t)
+
+	req := forgedS3TablesRequest(t, http.MethodGet, "/buckets")
+	req.Header.Set(s3_constants.AmzAccountId, "admin")
+
+	_, errCode := s3a.iam.AuthSignatureOnly(req)
+	assert.NotEqual(t, s3err.ErrNone, errCode)
+	assert.Empty(t, req.Header.Get(s3_constants.AmzAccountId))
+}
diff --git a/weed/s3api/s3api_tables_maintenance_rest_test.go b/weed/s3api/s3api_tables_maintenance_rest_test.go
new file mode 100644
index 0000000000..0620db3369
--- /dev/null
+++ b/weed/s3api/s3api_tables_maintenance_rest_test.go
@@ -0,0 +1,137 @@
+package s3api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// The AWS CLI and SDK address these operations by REST path, not by
+// X-Amz-Target, so the paths have to match the published bindings exactly.
+func TestMaintenanceRestPathsMatchAWSBindings(t *testing.T) {
+	const arnPattern = "arn:aws:s3tables:[^/:]*:[^/:]*:bucket/[^/]+"
+
+	router := mux.NewRouter()
+	matched := ""
+	for _, route := range []struct {
+		method    string
+		path      string
+		operation string
+	}{
+		{http.MethodPut, "/buckets/{tableBucketARN:" + arnPattern + "}/maintenance/{type}", "PutTableBucketMaintenanceConfiguration"},
+		{http.MethodGet, "/buckets/{tableBucketARN:" + arnPattern + "}/maintenance", "GetTableBucketMaintenanceConfiguration"},
+		{http.MethodPut, "/tables/{tableBucketARN:" + arnPattern + "}/{namespace}/{name}/maintenance/{type}", "PutTableMaintenanceConfiguration"},
+		{http.MethodGet, "/tables/{tableBucketARN:" + arnPattern + "}/{namespace}/{name}/maintenance", "GetTableMaintenanceConfiguration"},
+		{http.MethodGet, "/tables/{tableBucketARN:" + arnPattern + "}/{namespace}/{name}/maintenance-job-status", "GetTableMaintenanceJobStatus"},
+	} {
+		operation := route.operation
+		router.Methods(route.method).Path(route.path).HandlerFunc(func(http.ResponseWriter, *http.Request) {
+			matched = operation
+		})
+	}
+
+	cases := []struct {
+		method string
+		path   string
+		want   string
+	}{
+		{http.MethodPut, "/buckets/" + testTableBucketARN + "/maintenance/icebergUnreferencedFileRemoval", "PutTableBucketMaintenanceConfiguration"},
+		{http.MethodGet, "/buckets/" + testTableBucketARN + "/maintenance", "GetTableBucketMaintenanceConfiguration"},
+		{http.MethodPut, "/tables/" + testTableBucketARN + "/sales/orders/maintenance/icebergCompaction", "PutTableMaintenanceConfiguration"},
+		{http.MethodGet, "/tables/" + testTableBucketARN + "/sales/orders/maintenance", "GetTableMaintenanceConfiguration"},
+		{http.MethodGet, "/tables/" + testTableBucketARN + "/sales/orders/maintenance-job-status", "GetTableMaintenanceJobStatus"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.want, func(t *testing.T) {
+			matched = ""
+			router.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(tc.method, tc.path, nil))
+			if matched != tc.want {
+				t.Errorf("path %s %s routed to %q, want %q", tc.method, tc.path, matched, tc.want)
+			}
+		})
+	}
+}
+
+func TestBuildPutTableMaintenanceConfigurationRequest(t *testing.T) {
+	body := `{"value":{"status":"enabled","settings":{"icebergCompaction":{"targetFileSizeMB":512}}}}`
+	req := httptest.NewRequest(http.MethodPut, "/tables/"+testTableBucketARN+"/sales/orders/maintenance/icebergCompaction", strings.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{
+		"tableBucketARN": testTableBucketARN,
+		"namespace":      "sales",
+		"name":           "orders",
+		"type":           "icebergCompaction",
+	})
+
+	built, err := buildPutTableMaintenanceConfigurationRequest(req)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	got, ok := built.(*s3tables.PutTableMaintenanceConfigurationRequest)
+	if !ok {
+		t.Fatalf("unexpected request type %T", built)
+	}
+	if got.TableBucketARN != testTableBucketARN || got.Name != "orders" {
+		t.Errorf("path params not applied: %+v", got)
+	}
+	if len(got.Namespace) != 1 || got.Namespace[0] != "sales" {
+		t.Errorf("expected namespace [sales], got %v", got.Namespace)
+	}
+	if got.Type != s3tables.MaintenanceTypeIcebergCompaction {
+		t.Errorf("expected type from the path, got %q", got.Type)
+	}
+	if got.Value == nil || got.Value.Settings == nil || got.Value.Settings.IcebergCompaction == nil {
+		t.Fatalf("expected the body value decoded, got %+v", got.Value)
+	}
+	if size := got.Value.Settings.IcebergCompaction.TargetFileSizeMB; size == nil || *size != 512 {
+		t.Errorf("expected targetFileSizeMB=512, got %v", size)
+	}
+}
+
+func TestBuildPutTableBucketMaintenanceConfigurationRequest(t *testing.T) {
+	body := `{"value":{"status":"disabled"}}`
+	req := httptest.NewRequest(http.MethodPut, "/buckets/"+testTableBucketARN+"/maintenance/icebergUnreferencedFileRemoval", strings.NewReader(body))
+	req = mux.SetURLVars(req, map[string]string{
+		"tableBucketARN": testTableBucketARN,
+		"type":           "icebergUnreferencedFileRemoval",
+	})
+
+	built, err := buildPutTableBucketMaintenanceConfigurationRequest(req)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	got := built.(*s3tables.PutTableBucketMaintenanceConfigurationRequest)
+	if got.TableBucketARN != testTableBucketARN {
+		t.Errorf("expected the ARN from the path, got %q", got.TableBucketARN)
+	}
+	if got.Type != s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval {
+		t.Errorf("expected the type from the path, got %q", got.Type)
+	}
+	if got.Value == nil || got.Value.Status != s3tables.MaintenanceStatusDisabled {
+		t.Errorf("expected the body value decoded, got %+v", got.Value)
+	}
+}
+
+func TestBuildMaintenanceRequestsRejectBadNamespace(t *testing.T) {
+	for _, build := range map[string]func(*http.Request) (interface{}, error){
+		"GetTableMaintenanceConfiguration": buildGetTableMaintenanceConfigurationRequest,
+		"GetTableMaintenanceJobStatus":     buildGetTableMaintenanceJobStatusRequest,
+	} {
+		req := httptest.NewRequest(http.MethodGet, "/tables/"+testTableBucketARN+"/Bad/orders/maintenance", nil)
+		req = mux.SetURLVars(req, map[string]string{
+			"tableBucketARN": testTableBucketARN,
+			"namespace":      "InvalidNamespace",
+			"name":           "orders",
+		})
+		if _, err := build(req); err == nil {
+			t.Error("expected an invalid namespace to be rejected")
+		}
+	}
+}
diff --git a/weed/s3api/s3api_versioning_reconciler_test.go b/weed/s3api/s3api_versioning_reconciler_test.go
index 34fc6cbd42..83adb69a7f 100644
--- a/weed/s3api/s3api_versioning_reconciler_test.go
+++ b/weed/s3api/s3api_versioning_reconciler_test.go
@@ -168,3 +168,78 @@ func TestRetryFilerOp_TerminalErrorsShortCircuit(t *testing.T) {
 		})
 	}
 }
+
+// TestFilerRetryBudget_ClampsToWhatIsLeft covers the allowance arithmetic:
+// a reservation larger than the remainder is trimmed, and once nothing is
+// left the caller is told to stop rather than handed a zero wait.
+func TestFilerRetryBudget_ClampsToWhatIsLeft(t *testing.T) {
+	b := &filerRetryBudget{remaining: 150 * time.Millisecond}
+
+	granted, ok := b.take(100 * time.Millisecond)
+	require.True(t, ok)
+	assert.Equal(t, 100*time.Millisecond, granted)
+
+	granted, ok = b.take(200 * time.Millisecond)
+	require.True(t, ok)
+	assert.Equal(t, 50*time.Millisecond, granted, "trimmed to the remainder")
+
+	_, ok = b.take(time.Millisecond)
+	assert.False(t, ok, "allowance spent")
+}
+
+// TestFilerRetryRequestBudget_MatchesOneOpWorstCase pins the request-wide
+// allowance to what a single retryFilerOp can sleep for, so a batch delete
+// adds the wait of one key rather than one per key.
+func TestFilerRetryRequestBudget_MatchesOneOpWorstCase(t *testing.T) {
+	var singleOp time.Duration
+	for attempt := 1; attempt < updateLatestRetryAttempts; attempt++ {
+		singleOp += retryFilerBackoff(attempt)
+	}
+	assert.Equal(t, singleOp, filerRetryRequestBudget)
+	assert.Equal(t, 3100*time.Millisecond, filerRetryRequestBudget)
+}
+
+// TestRetryFilerOp_SharedBudgetAcrossBatch is the batch-delete shape: many
+// keys, each driving its own retryFilerOp against a filer that always fails
+// retryably. Without a shared allowance every key pays the full per-op
+// backoff, so the wait scales with a key count the client picks. The
+// allowance here is deliberately small so the test never sleeps for the
+// production budget.
+func TestRetryFilerOp_SharedBudgetAcrossBatch(t *testing.T) {
+	const keys = 200
+	const allowance = 250 * time.Millisecond
+
+	ctx := withFilerRetryBudget(context.Background(), allowance)
+	calls := 0
+	start := time.Now()
+	for i := 0; i < keys; i++ {
+		err := retryFilerOp(ctx, "test", func() error {
+			calls++
+			return errors.New("transient")
+		})
+		require.Error(t, err)
+	}
+	elapsed := time.Since(start)
+
+	assert.LessOrEqual(t, calls, keys+updateLatestRetryAttempts, "only the keys that fit the allowance retry")
+	assert.Less(t, elapsed, 2*allowance, "the whole batch stays inside one allowance")
+}
+
+// TestRetryFilerOp_SpentBudgetStopsAfterFirstAttempt confirms a key that
+// arrives after the allowance is gone fails immediately, reporting why, and
+// still gets its one real attempt at the filer.
+func TestRetryFilerOp_SpentBudgetStopsAfterFirstAttempt(t *testing.T) {
+	ctx := withFilerRetryBudget(context.Background(), 0)
+	calls := 0
+	start := time.Now()
+	err := retryFilerOp(ctx, "test", func() error {
+		calls++
+		return errors.New("transient")
+	})
+
+	require.Error(t, err)
+	assert.Equal(t, 1, calls, "the op still runs once")
+	assert.Less(t, time.Since(start), 50*time.Millisecond, "no backoff once the allowance is spent")
+	assert.Contains(t, err.Error(), "retry allowance spent")
+	assert.Contains(t, err.Error(), "transient", "underlying error preserved")
+}
diff --git a/weed/s3api/s3api_xml_timestamp_test.go b/weed/s3api/s3api_xml_timestamp_test.go
new file mode 100644
index 0000000000..3fda18e9de
--- /dev/null
+++ b/weed/s3api/s3api_xml_timestamp_test.go
@@ -0,0 +1,56 @@
+package s3api
+
+import (
+	"encoding/xml"
+	"strings"
+	"testing"
+	"time"
+)
+
+// S3 clients such as minio-java parse LastModified with a fixed-width
+// "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'" pattern, so trailing zeros in the
+// fractional seconds must not be trimmed.
+func TestXMLTimestampsHaveFixedMilliseconds(t *testing.T) {
+	cases := []struct {
+		in   time.Time
+		want string
+	}{
+		{time.Date(2026, 9, 29, 20, 30, 4, 560_000_000, time.UTC), "2026-09-29T20:30:04.560Z"},
+		{time.Date(2026, 9, 29, 20, 30, 4, 500_000_000, time.UTC), "2026-09-29T20:30:04.500Z"},
+		{time.Date(2026, 9, 29, 20, 30, 4, 0, time.UTC), "2026-09-29T20:30:04.000Z"},
+		{time.Date(2026, 9, 29, 20, 30, 4, 123_456_789, time.UTC), "2026-09-29T20:30:04.123Z"},
+		{time.Date(2026, 9, 29, 14, 30, 4, 560_000_000, time.FixedZone("MDT", -6*3600)), "2026-09-29T20:30:04.560Z"},
+	}
+	for _, c := range cases {
+		for name, v := range map[string]any{
+			// by value, the way the handlers pass them to writeSuccessResponseXML
+			"CopyObjectResult":       CopyObjectResult{ETag: "e", LastModified: c.in},
+			"CopyPartResult":         CopyPartResult{ETag: "e", LastModified: c.in},
+			"CopyObjectResult (ptr)": &CopyObjectResult{ETag: "e", LastModified: c.in},
+			"CopyPartResult (ptr)":   &CopyPartResult{ETag: "e", LastModified: c.in},
+		} {
+			out, err := xml.Marshal(v)
+			if err != nil {
+				t.Fatalf("%s: %v", name, err)
+			}
+			if !strings.Contains(string(out), "<LastModified>"+c.want+"</LastModified>") {
+				t.Errorf("%s(%v): got %s, want LastModified %s", name, c.in, out, c.want)
+			}
+		}
+	}
+}
+
+func TestXMLTimestampRoundTrip(t *testing.T) {
+	in := CopyObjectResult{ETag: "e", LastModified: time.Date(2026, 9, 29, 20, 30, 4, 560_000_000, time.UTC)}
+	out, err := xml.Marshal(&in)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var back CopyObjectResult
+	if err := xml.Unmarshal(out, &back); err != nil {
+		t.Fatal(err)
+	}
+	if !back.LastModified.Equal(in.LastModified) {
+		t.Fatalf("round trip: got %v, want %v", back.LastModified, in.LastModified)
+	}
+}
diff --git a/weed/s3api/s3api_xsd_generated.go b/weed/s3api/s3api_xsd_generated.go
index acc8d78e76..aecf95f10c 100644
--- a/weed/s3api/s3api_xsd_generated.go
+++ b/weed/s3api/s3api_xsd_generated.go
@@ -623,13 +623,16 @@ type CopyObjectResult struct {
 	ETag         string    `xml:"ETag"`
 }
 
-func (t *CopyObjectResult) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+// MarshalXML has a value receiver: handlers pass CopyObjectResult by value, and
+// encoding/xml does not call a pointer-receiver MarshalXML on a non-addressable
+// value, which silently fell back to time.Time's RFC 3339 encoding.
+func (t CopyObjectResult) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	type T CopyObjectResult
 	var layout struct {
 		*T
 		LastModified *xsdDateTime `xml:"LastModified"`
 	}
-	layout.T = (*T)(t)
+	layout.T = (*T)(&t)
 	layout.LastModified = (*xsdDateTime)(&layout.T.LastModified)
 	return e.EncodeElement(layout, start)
 }
@@ -1512,8 +1515,15 @@ type xsdDateTime time.Time
 func (t *xsdDateTime) UnmarshalText(text []byte) error {
 	return _unmarshalTime(text, (*time.Time)(t), "2006-01-02T15:04:05.999999999")
 }
+
+// s3TimestampFormat is the timestamp layout AWS S3 uses in XML responses:
+// UTC with exactly three fractional digits. Trimming trailing zeros (".56Z",
+// or no fraction at all) breaks clients that parse with a fixed-width pattern,
+// e.g. minio-java's "yyyy-MM-dd'T'HH:mm:ss.SSS'Z'".
+const s3TimestampFormat = "2006-01-02T15:04:05.000Z"
+
 func (t xsdDateTime) MarshalText() ([]byte, error) {
-	return _marshalTime((time.Time)(t), "2006-01-02T15:04:05.999999999")
+	return []byte((time.Time)(t).UTC().Format(s3TimestampFormat)), nil
 }
 func (t xsdDateTime) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	if (time.Time)(t).IsZero() {
diff --git a/weed/s3api/s3err/audit_fluent.go b/weed/s3api/s3err/audit_fluent.go
index feac76b967..a8d28035be 100644
--- a/weed/s3api/s3err/audit_fluent.go
+++ b/weed/s3api/s3err/audit_fluent.go
@@ -23,20 +23,22 @@ type AccessLogExtend struct {
 }
 
 type AccessLog struct {
-	Bucket           string `msg:"bucket" json:"bucket"`                         // awsexamplebucket1
-	Time             int64  `msg:"time" json:"time"`                             // [06/Feb/2019:00:00:38 +0000]
-	RemoteIP         string `msg:"remote_ip" json:"remote_ip,omitempty"`         // 192.0.2.3
-	Requester        string `msg:"requester" json:"requester,omitempty"`         // IAM user id
-	RequesterArn     string `msg:"requester_arn" json:"requester_arn,omitempty"` // arn:aws:sts::0:assumed-role/Role/session
-	RequestID        string `msg:"request_id" json:"request_id,omitempty"`       // 3E57427F33A59F07
-	Operation        string `msg:"operation" json:"operation,omitempty"`         // REST.HTTP_method.resource_type REST.PUT.OBJECT
-	Key              string `msg:"key" json:"key,omitempty"`                     // /photos/2019/08/puppy.jpg
-	ErrorCode        string `msg:"error_code" json:"error_code,omitempty"`
-	HostId           string `msg:"host_id" json:"host_id,omitempty"`
-	HostHeader       string `msg:"host_header" json:"host_header,omitempty"` // s3.us-west-2.amazonaws.com
-	UserAgent        string `msg:"user_agent" json:"user_agent,omitempty"`
-	HTTPStatus       int    `msg:"status" json:"status,omitempty"`
-	SignatureVersion string `msg:"signature_version" json:"signature_version,omitempty"`
+	Bucket            string `msg:"bucket" json:"bucket"`                                   // awsexamplebucket1
+	Time              int64  `msg:"time" json:"time"`                                       // [06/Feb/2019:00:00:38 +0000]
+	RemoteIP          string `msg:"remote_ip" json:"remote_ip,omitempty"`                   // 192.0.2.3
+	Requester         string `msg:"requester" json:"requester,omitempty"`                   // IAM user id
+	RequesterArn      string `msg:"requester_arn" json:"requester_arn,omitempty"`           // arn:aws:sts::0:assumed-role/Role/session
+	RequesterIdentity string `msg:"requester_identity" json:"requester_identity,omitempty"` // authoritative OIDC identity claim (preferred_username/email/sub)
+	AccessKeyId       string `msg:"access_key_id" json:"access_key_id,omitempty"`           // the key the request was signed with; an STS session's temporary key id
+	RequestID         string `msg:"request_id" json:"request_id,omitempty"`                 // 3E57427F33A59F07
+	Operation         string `msg:"operation" json:"operation,omitempty"`                   // REST.HTTP_method.resource_type REST.PUT.OBJECT
+	Key               string `msg:"key" json:"key,omitempty"`                               // /photos/2019/08/puppy.jpg
+	ErrorCode         string `msg:"error_code" json:"error_code,omitempty"`
+	HostId            string `msg:"host_id" json:"host_id,omitempty"`
+	HostHeader        string `msg:"host_header" json:"host_header,omitempty"` // s3.us-west-2.amazonaws.com
+	UserAgent         string `msg:"user_agent" json:"user_agent,omitempty"`
+	HTTPStatus        int    `msg:"status" json:"status,omitempty"`
+	SignatureVersion  string `msg:"signature_version" json:"signature_version,omitempty"`
 }
 
 type AccessLogHTTP struct {
@@ -167,20 +169,22 @@ func GetAccessLog(r *http.Request, HTTPStatusCode int, s3errCode ErrorCode) *Acc
 		hostHeader = r.Host
 	}
 	return &AccessLog{
-		HostHeader:       hostHeader,
-		RequestID:        request_id.GetFromRequest(r),
-		RemoteIP:         remoteIP,
-		Requester:        s3_constants.GetIdentityNameFromContext(r), // Get from context, not header (secure)
-		RequesterArn:     s3_constants.GetPrincipalArnFromContext(r),
-		SignatureVersion: r.Header.Get(s3_constants.AmzAuthType),
-		UserAgent:        r.Header.Get("user-agent"),
-		HostId:           hostname,
-		Bucket:           bucket,
-		HTTPStatus:       HTTPStatusCode,
-		Time:             time.Now().Unix(),
-		Key:              key,
-		Operation:        getOperation(key, r),
-		ErrorCode:        errorCode,
+		HostHeader:        hostHeader,
+		RequestID:         request_id.GetFromRequest(r),
+		RemoteIP:          remoteIP,
+		Requester:         s3_constants.GetIdentityNameFromContext(r), // Get from context, not header (secure)
+		RequesterArn:      s3_constants.GetPrincipalArnFromContext(r),
+		RequesterIdentity: s3_constants.GetIdentityClaimFromContext(r),
+		AccessKeyId:       s3_constants.GetAccessKeyIdFromContext(r),
+		SignatureVersion:  r.Header.Get(s3_constants.AmzAuthType),
+		UserAgent:         r.Header.Get("user-agent"),
+		HostId:            hostname,
+		Bucket:            bucket,
+		HTTPStatus:        HTTPStatusCode,
+		Time:              time.Now().Unix(),
+		Key:               key,
+		Operation:         getOperation(key, r),
+		ErrorCode:         errorCode,
 	}
 }
 
diff --git a/weed/s3api/s3err/audit_fluent_test.go b/weed/s3api/s3err/audit_fluent_test.go
index bb5782d908..6e9792b37d 100644
--- a/weed/s3api/s3err/audit_fluent_test.go
+++ b/weed/s3api/s3err/audit_fluent_test.go
@@ -131,6 +131,21 @@ func TestGetAccessLogRequesterArnForAssumedRole(t *testing.T) {
 	assert.Equal(t, "arn:aws:sts::000000000000:assumed-role/ClientRole/dev-session", log.RequesterArn)
 }
 
+// An OIDC-federated session's opaque requester is useless for compliance
+// auditing, so the audit entry must also carry the authoritative identity claim
+// written by auth into the shared identity holder. See issue #11264.
+func TestGetAccessLogRequesterIdentityFromFallback(t *testing.T) {
+	outer := s3_constants.EnsureIdentityHolder(httptest.NewRequest(http.MethodGet, "/bucket/object", nil))
+
+	ctx := s3_constants.SetIdentityNameInContext(outer.Context(), "2a19e647c5d43a62a91ecf664d07dbe1")
+	s3_constants.SetIdentityClaimInContext(ctx, "grant.west")
+
+	log := GetAccessLog(outer, http.StatusOK, ErrNone)
+
+	assert.Equal(t, "2a19e647c5d43a62a91ecf664d07dbe1", log.Requester)
+	assert.Equal(t, "grant.west", log.RequesterIdentity)
+}
+
 func TestAuditTrackingFlag(t *testing.T) {
 	req := httptest.NewRequest(http.MethodGet, "/bucket/object", nil)
 	assert.False(t, AuditAlreadyLogged(req), "untracked request reports not logged")
diff --git a/weed/s3api/s3err/error_handler.go b/weed/s3api/s3err/error_handler.go
index 180546e439..d8f6b745c6 100644
--- a/weed/s3api/s3err/error_handler.go
+++ b/weed/s3api/s3err/error_handler.go
@@ -3,9 +3,11 @@ package s3err
 import (
 	"bytes"
 	"encoding/xml"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/private/protocol/xml/xmlutil"
 	"github.com/gorilla/mux"
@@ -18,6 +20,8 @@ type mimeType string
 const (
 	mimeNone mimeType = ""
 	MimeXML  mimeType = "application/xml"
+
+	errorResponseBodyDrainTimeout = 30 * time.Second
 )
 
 func WriteAwsXMLResponse(w http.ResponseWriter, r *http.Request, statusCode int, result interface{}) {
@@ -62,10 +66,22 @@ func WriteErrorResponseWithMessage(w http.ResponseWriter, r *http.Request, error
 	if message != "" {
 		errorResponse.Message = message
 	}
+	drainRequestBody(w, r)
 	WriteXMLResponse(w, r, apiError.HTTPStatusCode, errorResponse)
 	PostLog(r, apiError.HTTPStatusCode, errorCode)
 }
 
+func drainRequestBody(w http.ResponseWriter, r *http.Request) {
+	if r == nil || r.Body == nil || r.Body == http.NoBody {
+		return
+	}
+	rc := http.NewResponseController(w)
+	if err := rc.SetReadDeadline(time.Now().Add(errorResponseBodyDrainTimeout)); err == nil {
+		defer rc.SetReadDeadline(time.Time{})
+	}
+	_, _ = io.Copy(io.Discard, r.Body)
+}
+
 func getRESTErrorResponse(err APIError, resource string, bucket, object, requestID string) RESTErrorResponse {
 	return RESTErrorResponse{
 		Code:       err.Code,
@@ -121,16 +137,30 @@ func setCommonHeaders(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// bodyAllowedForStatus is a copy of http.bodyAllowedForStatus non-exported function.
+func bodyAllowedForStatus(status int) bool {
+	switch {
+	case status >= 100 && status <= 199:
+		return false
+	case status == http.StatusNoContent:
+		return false
+	case status == http.StatusNotModified:
+		return false
+	}
+	return true
+}
+
 func WriteResponse(w http.ResponseWriter, r *http.Request, statusCode int, response []byte, mType mimeType) {
 	setCommonHeaders(w, r)
-	if response != nil {
+	canHaveBody := bodyAllowedForStatus(statusCode)
+	if response != nil && canHaveBody {
 		w.Header().Set("Content-Length", strconv.Itoa(len(response)))
 	}
 	if mType != mimeNone {
 		w.Header().Set("Content-Type", string(mType))
 	}
 	w.WriteHeader(statusCode)
-	if response != nil {
+	if response != nil && canHaveBody && r.Method != http.MethodHead {
 		glog.V(4).Infof("status %d %s: %s", statusCode, mType, string(response))
 		_, err := w.Write(response)
 		if err != nil {
diff --git a/weed/s3api/s3err/error_handler_test.go b/weed/s3api/s3err/error_handler_test.go
index b2108e195c..2e611dfe89 100644
--- a/weed/s3api/s3err/error_handler_test.go
+++ b/weed/s3api/s3err/error_handler_test.go
@@ -1,10 +1,14 @@
 package s3err
 
 import (
+	"bytes"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"regexp"
+	"strconv"
 	"testing"
+	"time"
 
 	"github.com/gorilla/mux"
 	"github.com/seaweedfs/seaweedfs/weed/util/request_id"
@@ -26,6 +30,58 @@ func TestWriteErrorResponseReusesRequestID(t *testing.T) {
 	assert.Equal(t, "req-123", extractRequestIDFromBody(rr.Body.String()))
 }
 
+func TestWriteErrorResponseDrainsRequestBodyBeforeWriting(t *testing.T) {
+	body := &trackingReadCloser{data: bytes.Repeat([]byte("a"), 1024)}
+	req := httptest.NewRequest(http.MethodPut, "/bucket/object", nil)
+	req.Body = body
+	req.ContentLength = int64(body.remaining())
+	req = mux.SetURLVars(req, map[string]string{
+		"bucket": "bucket",
+		"object": "object",
+	})
+
+	rr := &drainCheckingResponseWriter{
+		header: make(http.Header),
+		body:   body,
+	}
+
+	WriteErrorResponse(rr, req, ErrInternalError)
+
+	assert.Empty(t, rr.writeHeaderErr)
+	assert.Equal(t, 0, body.remaining())
+	assert.Equal(t, http.StatusInternalServerError, rr.status)
+	assert.Len(t, rr.readDeadlines, 2)
+	assert.False(t, rr.readDeadlines[0].IsZero())
+	assert.True(t, rr.readDeadlines[1].IsZero())
+}
+
+func TestWriteResponseOmitsBodyWhenNotAllowed(t *testing.T) {
+	payload := []byte("<Error><Code>NoSuchKey</Code></Error>")
+	for _, tc := range []struct {
+		name              string
+		method            string
+		status            int
+		wantContentLength string
+	}{
+		{"head request", http.MethodHead, http.StatusNotFound, strconv.Itoa(len(payload))},
+		{"no content", http.MethodGet, http.StatusNoContent, ""},
+		{"not modified", http.MethodGet, http.StatusNotModified, ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := httptest.NewRequest(tc.method, "/bucket/object", nil)
+			rr := httptest.NewRecorder()
+			WriteResponse(rr, req, tc.status, payload, MimeXML)
+			assert.Empty(t, rr.Body.String())
+			assert.Equal(t, tc.wantContentLength, rr.Header().Get("Content-Length"))
+		})
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/bucket/object", nil)
+	rr := httptest.NewRecorder()
+	WriteResponse(rr, req, http.StatusOK, payload, MimeXML)
+	assert.Equal(t, string(payload), rr.Body.String())
+}
+
 func extractRequestIDFromBody(body string) string {
 	re := regexp.MustCompile(`<RequestId>([^<]+)</RequestId>`)
 	matches := re.FindStringSubmatch(body)
@@ -34,3 +90,57 @@ func extractRequestIDFromBody(body string) string {
 	}
 	return matches[1]
 }
+
+type trackingReadCloser struct {
+	data []byte
+}
+
+func (t *trackingReadCloser) Read(p []byte) (int, error) {
+	if len(t.data) == 0 {
+		return 0, io.EOF
+	}
+	n := copy(p, t.data)
+	t.data = t.data[n:]
+	return n, nil
+}
+
+func (t *trackingReadCloser) Close() error {
+	return nil
+}
+
+func (t *trackingReadCloser) remaining() int {
+	return len(t.data)
+}
+
+type drainCheckingResponseWriter struct {
+	header         http.Header
+	body           *trackingReadCloser
+	status         int
+	writeHeaderErr string
+	readDeadlines  []time.Time
+}
+
+func (d *drainCheckingResponseWriter) Header() http.Header {
+	return d.header
+}
+
+func (d *drainCheckingResponseWriter) Write(p []byte) (int, error) {
+	if d.status == 0 {
+		d.WriteHeader(http.StatusOK)
+	}
+	return len(p), nil
+}
+
+func (d *drainCheckingResponseWriter) WriteHeader(status int) {
+	d.status = status
+	if d.body.remaining() != 0 {
+		d.writeHeaderErr = "request body was not drained before WriteHeader"
+	}
+}
+
+func (d *drainCheckingResponseWriter) Flush() {}
+
+func (d *drainCheckingResponseWriter) SetReadDeadline(t time.Time) error {
+	d.readDeadlines = append(d.readDeadlines, t)
+	return nil
+}
diff --git a/weed/s3api/s3err/s3api_errors.go b/weed/s3api/s3err/s3api_errors.go
index f5ce20652a..f0c8bc9479 100644
--- a/weed/s3api/s3err/s3api_errors.go
+++ b/weed/s3api/s3err/s3api_errors.go
@@ -56,6 +56,8 @@ const (
 	ErrNoSuchBucketPolicy
 	ErrNoSuchCORSConfiguration
 	ErrNoSuchLifecycleConfiguration
+	ErrNoSuchWebsiteConfiguration
+	ErrReplicationConfigurationNotFound
 	ErrNoSuchKey
 	ErrNoSuchVersion
 	ErrNoSuchUpload
@@ -71,6 +73,7 @@ const (
 	ErrInvalidMaxDeleteObjects
 	ErrInvalidPartNumberMarker
 	ErrInvalidPart
+	ErrInvalidPartNumber
 	ErrInvalidPartOrder
 	ErrInvalidRange
 	ErrInternalError
@@ -93,8 +96,10 @@ const (
 	ErrMalformedCredentialDate
 	ErrMalformedPolicy
 	ErrInvalidPolicyDocument
+	ErrPolicyTooLarge
 	ErrMissingSignHeadersTag
 	ErrMissingSignTag
+	ErrAuthorizationHeaderMalformed
 	ErrUnsignedHeaders
 	ErrInvalidQueryParams
 	ErrInvalidQuerySignatureAlgo
@@ -110,6 +115,7 @@ const (
 	ErrRequestTimeTooSkewed
 	ErrMissingDateHeader
 	ErrInvalidRequest
+	ErrInvalidArgument
 	ErrAuthNotSetup
 	ErrNotImplemented
 	ErrPreconditionFailed
@@ -137,6 +143,8 @@ const (
 	ErrSSECustomerKeyMissing
 	ErrSSECustomerKeyNotNeeded
 	ErrSSEEncryptionTypeMismatch
+	ErrInvalidEncryptionMethod
+	ErrIncompatibleEncryptionMethod
 
 	// SSE-KMS related errors
 	ErrKMSKeyNotFound
@@ -166,10 +174,15 @@ const (
 
 	ErrInvalidRenameSource
 	ErrRenameDestinationSameAsSource
+	ErrIdempotentParameterMismatch
+	ErrAccessControlListNotSupported
+	// The request's snapshot changed during a conditional write; clients can retry.
+	ErrConditionalRequestConflict
 )
 
 // Error message constants for checksum validation
 const (
+	ErrMsgContentSha256Mismatch     = "the provided 'x-amz-content-sha256' header does not match what was computed"
 	ErrMsgPayloadChecksumMismatch   = "payload checksum does not match"
 	ErrMsgChunkSignatureMismatch    = "chunk signature does not match"
 	ErrMsgChecksumAlgorithmMismatch = "checksum algorithm mismatch"
@@ -298,6 +311,16 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "The lifecycle configuration does not exist",
 		HTTPStatusCode: http.StatusNotFound,
 	},
+	ErrNoSuchWebsiteConfiguration: {
+		Code:           "NoSuchWebsiteConfiguration",
+		Description:    "The specified bucket does not have a website configuration",
+		HTTPStatusCode: http.StatusNotFound,
+	},
+	ErrReplicationConfigurationNotFound: {
+		Code:           "ReplicationConfigurationNotFoundError",
+		Description:    "The replication configuration was not found",
+		HTTPStatusCode: http.StatusNotFound,
+	},
 	ErrNoSuchKey: {
 		Code:           "NoSuchKey",
 		Description:    "The specified key does not exist.",
@@ -336,6 +359,11 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "One or more of the specified parts could not be found.  The part may not have been uploaded, or the specified entity tag may not match the part's entity tag.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrInvalidPartNumber: {
+		Code:           "InvalidPartNumber",
+		Description:    "The requested partnumber is not satisfiable.",
+		HTTPStatusCode: http.StatusRequestedRangeNotSatisfiable,
+	},
 	ErrInvalidPartOrder: {
 		Code:           "InvalidPartOrder",
 		Description:    "The list of parts was not in ascending order. The parts list must be specified in order by part number.",
@@ -362,6 +390,13 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "This rename request is illegal because it is trying to rename an object to itself.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrIdempotentParameterMismatch: {
+		Code:        "IdempotentParameterMismatch",
+		Description: "The request uses the same client token as a previous, but non-identical request.",
+		// 400 Bad Request, matching the AWS S3 RenameObject API documentation
+		// for IdempotencyParameterMismatch.
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrInvalidTag: {
 		Code:           "InvalidTag",
 		Description:    "The Tag value you have provided is invalid",
@@ -377,6 +412,11 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "Policy has invalid resource.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrPolicyTooLarge: {
+		Code:           "PolicyTooLarge",
+		Description:    "Policy exceeds the maximum allowed document size.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrInvalidPolicyDocument: {
 		Code:           "InvalidPolicyDocument",
 		Description:    "The content of the policy document is invalid.",
@@ -448,10 +488,15 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		HTTPStatusCode: http.StatusBadRequest,
 	},
 	ErrMissingSignTag: {
-		Code:           "AccessDenied",
+		Code:           "AuthorizationHeaderMalformed",
 		Description:    "Signature header missing Signature field.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrAuthorizationHeaderMalformed: {
+		Code:           "AuthorizationHeaderMalformed",
+		Description:    "The authorization header is malformed.",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 
 	ErrUnsignedHeaders: {
 		Code:           "AccessDenied",
@@ -526,13 +571,23 @@ var errorCodeResponse = map[ErrorCode]APIError{
 	ErrMissingDateHeader: {
 		Code:           "AccessDenied",
 		Description:    "AWS authentication requires a valid Date or x-amz-date header",
-		HTTPStatusCode: http.StatusBadRequest,
+		HTTPStatusCode: http.StatusForbidden,
 	},
 	ErrInvalidRequest: {
 		Code:           "InvalidRequest",
 		Description:    "Invalid Request",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrInvalidArgument: {
+		Code:           "InvalidArgument",
+		Description:    "Invalid Argument",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrAccessControlListNotSupported: {
+		Code:           "AccessControlListNotSupported",
+		Description:    "The bucket does not allow ACLs",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 	ErrInvalidRange: {
 		Code:           "InvalidRange",
 		Description:    "The requested range is not satisfiable",
@@ -553,6 +608,11 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "At least one of the pre-conditions you specified did not hold",
 		HTTPStatusCode: http.StatusPreconditionFailed,
 	},
+	ErrConditionalRequestConflict: {
+		Code:           "ConditionalRequestConflict",
+		Description:    "A conflicting conditional operation is currently in progress against this resource. Please try again.",
+		HTTPStatusCode: http.StatusConflict,
+	},
 	ErrNotModified: {
 		Code:           "NotModified",
 		Description:    "The object was not modified since the specified time",
@@ -569,12 +629,12 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		HTTPStatusCode: http.StatusConflict,
 	},
 	ErrTooManyRequest: {
-		Code:           "ErrTooManyRequest",
+		Code:           "SlowDown",
 		Description:    "Too many simultaneous request count",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
 	ErrRequestBytesExceed: {
-		Code:           "ErrRequestBytesExceed",
+		Code:           "SlowDown",
 		Description:    "Simultaneous request bytes exceed limitations",
 		HTTPStatusCode: http.StatusServiceUnavailable,
 	},
@@ -631,6 +691,16 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "The encryption method specified in the request does not match the encryption method used to encrypt the object.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
+	ErrInvalidEncryptionMethod: {
+		Code:           "InvalidArgument",
+		Description:    "The encryption method specified is not supported",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
+	ErrIncompatibleEncryptionMethod: {
+		Code:           "InvalidArgument",
+		Description:    "Server Side Encryption with Customer provided key is incompatible with the encryption method specified",
+		HTTPStatusCode: http.StatusBadRequest,
+	},
 
 	// SSE-KMS error responses
 	ErrKMSKeyNotFound: {
diff --git a/weed/s3api/s3lifecycle/DESIGN.md b/weed/s3api/s3lifecycle/DESIGN.md
index c0cd9e4348..7ff33f707e 100644
--- a/weed/s3api/s3lifecycle/DESIGN.md
+++ b/weed/s3api/s3lifecycle/DESIGN.md
@@ -19,13 +19,16 @@ dailyrun.Run(ctx, cfg):
     rsh                = engine.ReplayContentHash(snap)
     maxTTL             = engine.MaxEffectiveTTL(snap)
 
+    cursors            = load every shard's persisted cursor
+    walks              = planWalks(cursors) → at most 2 shared walks (recovery, steady)
+
     if rsh != [32]byte{}:                                           // replay-eligible rules present
         globalStartTsNs = min over cfg.Shards of (persisted cursor or runNow - maxTTL)
         reader          = subscribeMeta(ShardPredicate ∈ cfg.Shards, StartTsNs = globalStartTsNs)
         fanOut(reader.Events → shardEvents[shardID]) until ev.TsNs > runNow
 
     spawn one goroutine per shard:
-        runShard(ctx, cfg, snap, runNow, shardID, shardEvents[shardID])
+        runShard(ctx, cfg, snap, runNow, shardID, shardEvents[shardID], walks)
 
     wait all
     teardown reader + fan-out
@@ -37,7 +40,7 @@ runShard(ctx, cfg, snap, runNow, shardID, events):
 
     if rsh == [32]byte{}:                                           // pure walker bucket
         if walkerDue and Walker:
-            cfg.Walker(walkView)                                    // RulesForShard.walk
+            walkForShard(walkView)                                // shared walk, per-shard fallback
             lastWalkedNs = runNow.UnixNano()
         save cursor (TsNs=0, rsh, promoted, lastWalkedNs)
         return
@@ -46,7 +49,7 @@ runShard(ctx, cfg, snap, runNow, shardID, events):
     mustWalkColdStart  = !found
 
     if mustWalkRecovery or mustWalkColdStart:
-        cfg.Walker(engine.RecoveryView(snap))                       // every rule, force-active
+        walkForShard(RecoveryView(snap))                          // every rule, force-active
         walkedThisPass = true
         lastWalkedNs   = runNow.UnixNano()
         if mustWalkRecovery:
@@ -54,15 +57,16 @@ runShard(ctx, cfg, snap, runNow, shardID, events):
             return
 
     if Walker and !walkedThisPass and walkerDue:
-        cfg.Walker(walkView)                                        // steady-state walker
+        walkForShard(walkView)                                    // steady-state walker
         lastWalkedNs = runNow.UnixNano()
 
     startTsNs = !found ? runNow - maxTTL : persisted.TsNs           // steady state honors cursor
-    lastOK, _, drainErr = drainShardEvents(ctx, cfg, runNow, shardID, snap, startTsNs, events)
+    replayView = snap.ReplayView(retentionWindow)                   // minus walk-bound rules
+    lastOK, _, drainErr = drainShardEvents(ctx, cfg, runNow, shardID, replayView, startTsNs, events)
     save cursor (TsNs = lastOK, rsh, promoted, lastWalkedNs)
 ```
 
-Walker invocations — three call sites, distinct conditions:
+Walker invocations — three call sites, distinct conditions. `cfg.Walker` takes a shard set, not a single shard: `planWalks` predicts each shard's branch from the pre-loaded cursors and runs one shared walk per group, so a pass lists each bucket at most twice (recovery group + steady group) instead of once per shard. `runShard` waits on its group's walk; a shard whose own freshly-loaded cursor disagrees with the plan falls back to a per-shard walk, so the plan can't under-cover a shard after a cursor is rewritten mid-pass.
 
 | Branch | View | Trigger | Throttle |
 |---|---|---|---|
@@ -78,6 +82,7 @@ Walker invocations — three call sites, distinct conditions:
 // In engine:
 func (e *Engine) Snapshot() *Snapshot
 func (s *Snapshot) RulesForShard(shardID int, retentionWindow time.Duration) (replay, walk *Snapshot)
+func (s *Snapshot) ReplayView(retentionWindow time.Duration) *Snapshot
 func RecoveryView(s *Snapshot) *Snapshot
 func ReplayContentHash(s *Snapshot) [32]byte
 func PromotedHash(s *Snapshot, retentionWindow time.Duration) [32]byte
@@ -99,6 +104,7 @@ Shared-by-pointer with the base: `Rule` definitions, predicate maps, `RuleHash`
 | View | Clone settings | Why |
 |---|---|---|
 | `replay` | `active = true`, `Mode = ModeEventDriven` | `router.Route` requires `ModeEventDriven`. Forced regardless of `prior.Mode`. |
+| `replayView` | `active` preserved, `Mode = ModeEventDriven` | The drain's routing set: `replay` partition minus promoted rules, but without force-activating pre-bootstrap actions. Walk-bound kinds are shared by pointer. |
 | `walk` | `active = true`, `Mode` preserved | Walker accepts any non-`ModeDisabled` Mode. |
 | `recovery` | `active = true`, `Mode` preserved | Walker iterates all action clones. |
 
@@ -230,9 +236,10 @@ The lifecycle evaluator uses `ev.TsNs` for current-version rules and `entry.Nonc
 | `evaluate.go`, `due_at.go`, `rule_hash.go`, `tags.go` | Engine-side rule evaluation |
 | `reader/` | Meta-log subscribe; one subscription per dailyrun.Run pass |
 | `router/router.go` | Per-event rule evaluation |
-| `bootstrap/walker.go` | Bucket walker with `RunForShard(view, shardID)` filter |
+| `bootstrap/walker.go` | Bucket walker; shard-set entry filter |
 | `dispatcher/filer_persister.go` | Filer-backed cursor I/O |
 | `dailyrun/run.go` | Main pass orchestrator: subscription, fan-out, per-shard `runShard` |
+| `dailyrun/walk_plan.go` | Groups shards into shared recovery/steady walks (one listing per group) |
 | `dailyrun/cursor.go` | Cursor type + filer JSON serializer |
 | `dailyrun/walker_dispatcher.go` | Adapter from walker to `LifecycleDelete` RPC |
 
@@ -265,6 +272,6 @@ Worker config:
 Tracked as optimizations rather than blockers:
 
 1. **Long-lived subscription across passes.** Today the subscription is rebuilt per `Run()`. Keeping it alive across passes would eliminate the 7s ctx-timeout per pass and the start/teardown overhead. Requires per-shard pending heap (events whose `DueTime > runNow` would be parked in-memory instead of replayed) and a hot-swappable snapshot for mid-pass config changes. Multi-day refactor; current model works.
-2. **Bucket-coordinated walker.** Phase 4 has each shard walk the full bucket and filter by `ShardID(bucket, key)` — simple but 16× the listing cost. A per-bucket coordinator (the worker owning shard 0 for that bucket lists once, routes matches to other shards) would cut listing cost. Worth doing if listing becomes the bottleneck for very large buckets.
+2. ~~Bucket-coordinated walker~~. Done: `planWalks` shares one listing across the recovery group and one across the steady group (issue #11791). Remaining headroom: directories could be pruned to rule prefixes, and per-shard views could partition work rather than fanning every entry to its shard's dispatcher.
 3. **Per-bucket dispatch lag metric.** Currently only per-shard lag is exposed. Per-bucket would require a per-bucket cursor or a derived metric from `s3_lifecycle_dispatch_total{bucket,kind,outcome}`. Punted on cardinality concerns; revisit when an operator asks for it.
 4. **Meta-log retention plumbing.** If the filer adds GC for `/topics/.system/log`, the `PromotedHash` partition flip needs to consume the filer's actual retention horizon (currently dormant because retention is effectively infinite).
diff --git a/weed/s3api/s3lifecycle/dailyrun/filer_list_func.go b/weed/s3api/s3lifecycle/dailyrun/filer_list_func.go
index aa251f809b..0a24d5c518 100644
--- a/weed/s3api/s3lifecycle/dailyrun/filer_list_func.go
+++ b/weed/s3api/s3lifecycle/dailyrun/filer_list_func.go
@@ -12,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/bootstrap"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/engine"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
@@ -31,40 +32,64 @@ func init() { listPageSize.Store(1024) }
 // MPU init records at .uploads/<id> with ExtMultipartObjectKey set
 // are emitted whole with IsMPUInit=true and DestKey carrying the
 // user's intended path.
-func FilerListFunc(client filer_pb.SeaweedFilerClient, bucketsPath string) bootstrap.ListFunc {
+//
+// view supplies per-bucket state: a bucket that never had versioning
+// enabled skips the .versions/ pre-pass entirely, and directories no
+// active rule prefix can reach are pruned rather than listed. A nil
+// view assumes the worst (versioned, unpruned), preserving the
+// two-pass behavior.
+func FilerListFunc(client filer_pb.SeaweedFilerClient, bucketsPath string, view *engine.Snapshot) bootstrap.ListFunc {
 	return func(ctx context.Context, bucket, start string, cb func(*bootstrap.Entry) error) error {
 		if client == nil {
 			return fmt.Errorf("FilerListFunc: nil client")
 		}
 		root := strings.TrimSuffix(bucketsPath, "/") + "/" + bucket
-		return walkBucketTree(ctx, client, root, root, start, cb)
+		versioned := view == nil || view.BucketVersioned(bucket)
+		var prefixes []string
+		if view != nil {
+			prefixes = view.BucketPrefixes(bucket)
+			if len(prefixes) == 0 {
+				return nil // no active rule can match anything in this bucket
+			}
+		}
+		return walkBucketTree(ctx, client, root, root, start, versioned, prefixes, cb)
 	}
 }
 
 // walkBucketTree recurses through dir in two passes per level. Pass 1
 // expands `.versions/` dirs (populating skipBare with the bare null-
-// version keys that pass 2 must suppress). Pass 2 emits regular files
-// and recurses into non-special subdirectories.
+// version keys that pass 2 must suppress) and only runs when the bucket
+// is versioned — on a never-versioned bucket it would re-list every
+// directory and find nothing. Pass 2 emits regular files and recurses
+// into non-special subdirectories.
 //
-// The two-pass shape mirrors scheduler/bootstrap.go's walkBucketDir
-// (see that file's comment for why `.versions/` has to be processed
-// before its bare sibling).
-func walkBucketTree(ctx context.Context, client filer_pb.SeaweedFilerClient, dir, bucketRoot, start string, cb func(*bootstrap.Entry) error) error {
+// `.versions/` dirs must be processed before their bare sibling so the
+// walk sees whether the bare entry is the null version of the same
+// logical object; hence the two passes on versioned buckets.
+func walkBucketTree(ctx context.Context, client filer_pb.SeaweedFilerClient, dir, bucketRoot, start string, versioned bool, prefixes []string, cb func(*bootstrap.Entry) error) error {
 	skipBare := map[string]bool{}
 
 	// Pass 1: .versions/ dirs only.
-	if err := listAll(ctx, client, dir, func(e *filer_pb.Entry) error {
-		if e == nil || e.Attributes == nil {
-			return nil
+	if versioned {
+		if err := listAll(ctx, client, dir, func(e *filer_pb.Entry) error {
+			if e == nil || e.Attributes == nil {
+				return nil
+			}
+			if !e.IsDirectory || !isVersionsDir(e) {
+				return nil
+			}
+			full := dir + "/" + e.Name
+			key := strings.TrimPrefix(full, bucketRoot+"/")
+			// The emitted logical key ("foo") is a string-prefix of the
+			// dir key ("foo.versions"), so dirInRuleScope is conservative
+			// here too.
+			if !dirInRuleScope(prefixes, key) {
+				return nil
+			}
+			return expandVersionsDir(ctx, client, bucketRoot, key, e, start, skipBare, versioned, prefixes, cb)
+		}); err != nil {
+			return err
 		}
-		if !e.IsDirectory || !isVersionsDir(e) {
-			return nil
-		}
-		full := dir + "/" + e.Name
-		key := strings.TrimPrefix(full, bucketRoot+"/")
-		return expandVersionsDir(ctx, client, bucketRoot, key, e, start, skipBare, cb)
-	}); err != nil {
-		return err
 	}
 
 	// Pass 2: everything else.
@@ -72,11 +97,19 @@ func walkBucketTree(ctx context.Context, client filer_pb.SeaweedFilerClient, dir
 		if e == nil || e.Attributes == nil {
 			return nil
 		}
-		if e.IsDirectory && isVersionsDir(e) {
-			return nil
-		}
 		full := dir + "/" + e.Name
 		key := strings.TrimPrefix(full, bucketRoot+"/")
+		if e.IsDirectory && isVersionsDir(e) {
+			if versioned {
+				return nil // handled in pass 1
+			}
+			// No versioning on this bucket: a *-suffixed user folder
+			// holds ordinary objects, not version files.
+			if !dirInRuleScope(prefixes, key) {
+				return nil
+			}
+			return walkBucketTree(ctx, client, full, bucketRoot, start, false, prefixes, cb)
+		}
 		if e.IsDirectory {
 			if isMPUInitDir(key, e) {
 				if start != "" && key <= start {
@@ -91,7 +124,12 @@ func walkBucketTree(ctx context.Context, client filer_pb.SeaweedFilerClient, dir
 					Size:      int64(e.Attributes.FileSize),
 				})
 			}
-			return walkBucketTree(ctx, client, full, bucketRoot, start, cb)
+			// .uploads is exempt: an AbortMPU rule's prefix applies to
+			// DestKey (the user's path), never to ".uploads/<id>".
+			if key != s3_constants.MultipartUploadsFolder && !dirInRuleScope(prefixes, key) {
+				return nil
+			}
+			return walkBucketTree(ctx, client, full, bucketRoot, start, versioned, prefixes, cb)
 		}
 		if skipBare[key] {
 			return nil
@@ -135,7 +173,7 @@ type versionItem struct {
 // resume after a mid-expansion failure rewalks the whole sibling
 // group. Acceptable today because Phase 4b doesn't persist a
 // Checkpoint between runs (start is always "" via runShard).
-func expandVersionsDir(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketRoot, versionsKey string, versionsEntry *filer_pb.Entry, start string, skipBare map[string]bool, cb func(*bootstrap.Entry) error) error {
+func expandVersionsDir(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketRoot, versionsKey string, versionsEntry *filer_pb.Entry, start string, skipBare map[string]bool, versioned bool, prefixes []string, cb func(*bootstrap.Entry) error) error {
 	logical := strings.TrimSuffix(versionsKey, s3_constants.VersionsFolder)
 	if logical == "" {
 		return nil
@@ -160,7 +198,7 @@ func expandVersionsDir(ctx context.Context, client filer_pb.SeaweedFilerClient,
 		// Coincidentally-named user folder, or an empty `.versions`
 		// container. Treat it as a regular subdirectory so user-named
 		// files inside still surface.
-		return walkBucketTree(ctx, client, versionsDir, bucketRoot, start, cb)
+		return walkBucketTree(ctx, client, versionsDir, bucketRoot, start, versioned, prefixes, cb)
 	}
 	if nullEntry, nullKey, explicit, ok := lookupNullVersion(ctx, client, bucketRoot, logical); ok {
 		items = append(items, versionItem{
@@ -304,6 +342,22 @@ func listAll(ctx context.Context, client filer_pb.SeaweedFilerClient, dir string
 	}
 }
 
+// dirInRuleScope reports whether any active rule prefix could match an
+// object under dir key. Objects under dir/ carry keys starting "dir/",
+// so a prefix p can match iff p is a prefix of "dir/" or "dir/" is a
+// prefix of p. An empty prefixes list means "no constraint" (nil view).
+func dirInRuleScope(prefixes []string, key string) bool {
+	if len(prefixes) == 0 {
+		return true
+	}
+	for _, p := range prefixes {
+		if p == "" || strings.HasPrefix(key+"/", p) || strings.HasPrefix(p, key+"/") {
+			return true
+		}
+	}
+	return false
+}
+
 func isVersionsDir(entry *filer_pb.Entry) bool {
 	return entry.IsDirectory && strings.HasSuffix(entry.Name, s3_constants.VersionsFolder)
 }
diff --git a/weed/s3api/s3lifecycle/dailyrun/filer_list_func_test.go b/weed/s3api/s3lifecycle/dailyrun/filer_list_func_test.go
index 2e3083c12c..aa94024356 100644
--- a/weed/s3api/s3lifecycle/dailyrun/filer_list_func_test.go
+++ b/weed/s3api/s3lifecycle/dailyrun/filer_list_func_test.go
@@ -10,7 +10,9 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/bootstrap"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/engine"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
@@ -55,8 +57,9 @@ func (s *fakeFilerStream) RecvMsg(any) error { return nil }
 type fakeFiler struct {
 	filer_pb.SeaweedFilerClient
 
-	mu   sync.Mutex
-	tree map[string][]*filer_pb.Entry
+	mu        sync.Mutex
+	tree      map[string][]*filer_pb.Entry
+	listCalls int
 }
 
 func (c *fakeFiler) LookupDirectoryEntry(_ context.Context, in *filer_pb.LookupDirectoryEntryRequest, _ ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
@@ -73,6 +76,7 @@ func (c *fakeFiler) LookupDirectoryEntry(_ context.Context, in *filer_pb.LookupD
 func (c *fakeFiler) ListEntries(ctx context.Context, in *filer_pb.ListEntriesRequest, _ ...grpc.CallOption) (grpc.ServerStreamingClient[filer_pb.ListEntriesResponse], error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
+	c.listCalls++
 	src := c.tree[in.Directory]
 	// Mirror the filer: sort by name, honor StartFromFileName exclusive,
 	// cap at Limit. listAll's pagination loop depends on these.
@@ -117,7 +121,7 @@ func TestFilerListFunc_EmitsFlatFiles(t *testing.T) {
 	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
 		"/buckets/bkt": {file("a.txt", mtime, 10), file("b.txt", mtime, 20)},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []string
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = append(got, e.Path)
@@ -135,7 +139,7 @@ func TestFilerListFunc_PropagatesTagsOnFlatFiles(t *testing.T) {
 	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
 		"/buckets/bkt": {tagged},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got *bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = e
@@ -152,7 +156,7 @@ func TestFilerListFunc_RecursesIntoSubdirs(t *testing.T) {
 		"/buckets/bkt/logs":      {dir("2026"), file("a.log", mtime, 5)},
 		"/buckets/bkt/logs/2026": {file("b.log", mtime, 7)},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var paths []string
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		paths = append(paths, e.Path)
@@ -179,7 +183,7 @@ func TestFilerListFunc_MPUInitEmitsWithDestKey(t *testing.T) {
 			mpuDir,
 		},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []*bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = append(got, e)
@@ -212,7 +216,7 @@ func TestFilerListFunc_MPUInitWithoutDestKeyIsSkipped(t *testing.T) {
 			mpuDir,
 		},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var paths []string
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		paths = append(paths, e.Path)
@@ -254,7 +258,7 @@ func TestFilerListFunc_VersionedExpansionMarksLatestByPointer(t *testing.T) {
 		"/buckets/bkt": {versionsDir("foo"+s3_constants.VersionsFolder, "v2")},
 		"/buckets/bkt/foo" + s3_constants.VersionsFolder: versions,
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []*bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = append(got, e)
@@ -291,7 +295,7 @@ func TestFilerListFunc_VersionedExpansionStalePointerFallsBackToNewestSibling(t
 		"/buckets/bkt": {versionsDir("foo"+s3_constants.VersionsFolder, "v_GHOST")},
 		"/buckets/bkt/foo" + s3_constants.VersionsFolder: versions,
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []*bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = append(got, e)
@@ -319,7 +323,7 @@ func TestFilerListFunc_VersionedExpansionNoPointerNewestSiblingWins(t *testing.T
 		"/buckets/bkt": {versionsDir("foo"+s3_constants.VersionsFolder, "")},
 		"/buckets/bkt/foo" + s3_constants.VersionsFolder: versions,
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []*bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = append(got, e)
@@ -349,7 +353,7 @@ func TestFilerListFunc_VersionedExpansionExplicitNullIsLatestWhenPointerMissing(
 			fileWithExt("v1", t1, 1, map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v1")}),
 		},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []*bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = append(got, e)
@@ -396,7 +400,7 @@ func TestFilerListFunc_VersionedExpansionExplicitNullBeatsNewerSiblingWhenPointe
 			fileWithExt("v1", tV1, 1, map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v1")}),
 		},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []*bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = append(got, e)
@@ -424,7 +428,7 @@ func TestFilerListFunc_VersionsDirWithoutMarkersRecursesAsRegular(t *testing.T)
 			file("inner.txt", mtime, 1),
 		},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var paths []string
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		paths = append(paths, e.Path)
@@ -445,7 +449,7 @@ func TestFilerListFunc_VersionedDeleteMarkerPropagates(t *testing.T) {
 		"/buckets/bkt": {versionsDir("foo"+s3_constants.VersionsFolder, "v1")},
 		"/buckets/bkt/foo" + s3_constants.VersionsFolder: versions,
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got *bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = e
@@ -461,7 +465,7 @@ func TestFilerListFunc_HonorsStart(t *testing.T) {
 	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
 		"/buckets/bkt": {file("a", mtime, 1), file("b", mtime, 1), file("c", mtime, 1)},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got []string
 	require.NoError(t, listFn(context.Background(), "bkt", "a", func(e *bootstrap.Entry) error {
 		got = append(got, e.Path)
@@ -471,16 +475,88 @@ func TestFilerListFunc_HonorsStart(t *testing.T) {
 }
 
 func TestFilerListFunc_NilClient(t *testing.T) {
-	listFn := FilerListFunc(nil, "/buckets")
+	listFn := FilerListFunc(nil, "/buckets", nil)
 	require.Error(t, listFn(context.Background(), "bkt", "", func(*bootstrap.Entry) error { return nil }))
 }
 
+func snapshotForBucketRuleVersioned(t *testing.T, bucket string, days int, versioned bool) *engine.Snapshot {
+	return snapshotForBucketRules(t, bucket, versioned,
+		&s3lifecycle.Rule{ID: "r", Status: s3lifecycle.StatusEnabled, ExpirationDays: days})
+}
+
+func snapshotForBucketRules(t *testing.T, bucket string, versioned bool, rules ...*s3lifecycle.Rule) *engine.Snapshot {
+	t.Helper()
+	e := engine.New()
+	e.Compile([]engine.CompileInput{
+		{Bucket: bucket, Versioned: versioned, Rules: rules},
+	}, engine.CompileOptions{})
+	snap := e.Snapshot()
+	for _, a := range snap.AllActions() {
+		snap.MarkActive(a.Key)
+	}
+	return snap
+}
+
+func TestFilerListFunc_SkipsVersionsPrePassOnNonVersionedBucket(t *testing.T) {
+	// The .versions/ pre-pass costs one listing per directory. On a
+	// never-versioned bucket it can only find user folders, so the
+	// whole pass is wasted; per directory the walk should list once.
+	mtime := time.Now()
+	newFiler := func() *fakeFiler {
+		return &fakeFiler{tree: map[string][]*filer_pb.Entry{
+			"/buckets/bkt":      {dir("logs"), file("root.txt", mtime, 1)},
+			"/buckets/bkt/logs": {file("a.log", mtime, 5)},
+		}}
+	}
+
+	unversioned := newFiler()
+	listFn := FilerListFunc(unversioned, "/buckets", snapshotForBucketRuleVersioned(t, "bkt", 7, false))
+	var paths []string
+	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
+		paths = append(paths, e.Path)
+		return nil
+	}))
+	sort.Strings(paths)
+	assert.Equal(t, []string{"logs/a.log", "root.txt"}, paths)
+	assert.Equal(t, 2, unversioned.listCalls, "non-versioned bucket must list each dir once")
+
+	versioned := newFiler()
+	listFn = FilerListFunc(versioned, "/buckets", snapshotForBucketRuleVersioned(t, "bkt", 7, true))
+	paths = nil
+	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
+		paths = append(paths, e.Path)
+		return nil
+	}))
+	sort.Strings(paths)
+	assert.Equal(t, []string{"logs/a.log", "root.txt"}, paths)
+	assert.Equal(t, 4, versioned.listCalls, "versioned bucket still pays the .versions/ pre-pass per dir")
+}
+
+func TestFilerListFunc_VersionsNamedUserDirOnNonVersionedBucket(t *testing.T) {
+	// On a never-versioned bucket a *-suffixed .versions folder is a
+	// coincidence: real user objects inside must still surface.
+	mtime := time.Now()
+	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
+		"/buckets/bkt": {versionsDir("user"+s3_constants.VersionsFolder, "")},
+		"/buckets/bkt/user" + s3_constants.VersionsFolder: {
+			file("inner.txt", mtime, 1),
+		},
+	}}
+	listFn := FilerListFunc(client, "/buckets", snapshotForBucketRuleVersioned(t, "bkt", 7, false))
+	var paths []string
+	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
+		paths = append(paths, e.Path)
+		return nil
+	}))
+	assert.Equal(t, []string{"user" + s3_constants.VersionsFolder + "/inner.txt"}, paths)
+}
+
 func TestFilerListFunc_AttributesPropagate(t *testing.T) {
 	mtime := time.Date(2026, 5, 11, 12, 0, 0, 1234, time.UTC)
 	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
 		"/buckets/bkt": {file("obj", mtime, 4096)},
 	}}
-	listFn := FilerListFunc(client, "/buckets")
+	listFn := FilerListFunc(client, "/buckets", nil)
 	var got *bootstrap.Entry
 	require.NoError(t, listFn(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
 		got = e
@@ -493,3 +569,127 @@ func TestFilerListFunc_AttributesPropagate(t *testing.T) {
 	assert.Equal(t, int64(4096), got.Size)
 	assert.True(t, got.IsLatest)
 }
+
+func TestDirInRuleScope(t *testing.T) {
+	cases := []struct {
+		prefixes []string
+		key      string
+		want     bool
+	}{
+		{nil, "any", true},                   // nil view: no constraint
+		{[]string{""}, "any", true},          // "" prefix matches all
+		{[]string{"logs/"}, "logs", true},    // dir holds the prefix
+		{[]string{"logs"}, "logs", true},     // exact
+		{[]string{"logs"}, "logs2", true},    // "logs" can match "logs2/x"
+		{[]string{"logs/"}, "logs2", false},  // "logs2/x" can't match "logs/"
+		{[]string{"tmp/deep/"}, "tmp", true}, // prefix descends into dir
+		{[]string{"tmp/deep/"}, "tmp/deep", true},
+		{[]string{"tmp/deep/"}, "tmp/dee", false},
+		{[]string{"tmp/deep/"}, "tmp/shallow", false},
+		{[]string{"a/", "b/"}, "b", true},
+		{[]string{"a/", "b/"}, "c", false},
+	}
+	for _, tc := range cases {
+		assert.Equal(t, tc.want, dirInRuleScope(tc.prefixes, tc.key), "prefixes=%v key=%q", tc.prefixes, tc.key)
+	}
+}
+
+func TestFilerListFunc_PrunesDirsOutsideRulePrefixes(t *testing.T) {
+	// Dirs no active rule prefix can reach are never listed. Files are
+	// always emitted (prefix matching is walkEntry's job, downstream).
+	mtime := time.Now()
+	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
+		"/buckets/bkt": {
+			dir("logs"), dir("tmp"), dir("other"), file("root.txt", mtime, 1),
+		},
+		"/buckets/bkt/logs":     {file("a.log", mtime, 1)},
+		"/buckets/bkt/tmp":      {dir("deep"), dir("shallow")},
+		"/buckets/bkt/tmp/deep": {file("d.txt", mtime, 1)},
+		"/buckets/bkt/other":    {file("o.txt", mtime, 1)},
+	}}
+	view := snapshotForBucketRules(t, "bkt", false,
+		&s3lifecycle.Rule{ID: "r1", Status: s3lifecycle.StatusEnabled, Prefix: "logs/", ExpirationDays: 1},
+		&s3lifecycle.Rule{ID: "r2", Status: s3lifecycle.StatusEnabled, Prefix: "tmp/deep/", ExpirationDays: 1},
+	)
+	var paths []string
+	require.NoError(t, FilerListFunc(client, "/buckets", view)(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
+		paths = append(paths, e.Path)
+		return nil
+	}))
+	sort.Strings(paths)
+	assert.Equal(t, []string{"logs/a.log", "root.txt", "tmp/deep/d.txt"}, paths)
+	assert.Equal(t, 4, client.listCalls, "bkt+logs+tmp+tmp/deep listed; other and tmp/shallow pruned")
+}
+
+func TestFilerListFunc_NoActiveActionsSkipsWalk(t *testing.T) {
+	// Every action inactive (e.g. bootstrap never completed): MatchPath
+	// could match nothing, so the whole bucket listing is wasted work.
+	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
+		"/buckets/bkt": {file("a", time.Now(), 1)},
+	}}
+	e := engine.New()
+	e.Compile([]engine.CompileInput{{Bucket: "bkt", Rules: []*s3lifecycle.Rule{
+		{ID: "r", Status: s3lifecycle.StatusEnabled, ExpirationDays: 1},
+	}}}, engine.CompileOptions{})
+	var paths []string
+	require.NoError(t, FilerListFunc(client, "/buckets", e.Snapshot())(context.Background(), "bkt", "", func(en *bootstrap.Entry) error {
+		paths = append(paths, en.Path)
+		return nil
+	}))
+	assert.Empty(t, paths)
+	assert.Equal(t, 0, client.listCalls)
+}
+
+func TestFilerListFunc_UploadsDirExemptFromPruning(t *testing.T) {
+	// AbortMPU rules match DestKey (the user's key), never
+	// ".uploads/<id>", so the uploads container stays in scope even
+	// when all rule prefixes point elsewhere.
+	mtime := time.Now()
+	mpuDir := dir("up-1")
+	mpuDir.Extended = map[string][]byte{
+		s3_constants.ExtMultipartObjectKey: []byte("logs/big.bin"),
+	}
+	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
+		"/buckets/bkt": {dir(s3_constants.MultipartUploadsFolder), dir("other")},
+		"/buckets/bkt/" + s3_constants.MultipartUploadsFolder: {mpuDir},
+		"/buckets/bkt/other": {file("o.txt", mtime, 1)},
+	}}
+	view := snapshotForBucketRules(t, "bkt", false,
+		&s3lifecycle.Rule{ID: "r", Status: s3lifecycle.StatusEnabled, Prefix: "logs/", AbortMPUDaysAfterInitiation: 3})
+	var paths []string
+	require.NoError(t, FilerListFunc(client, "/buckets", view)(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
+		paths = append(paths, e.Path)
+		return nil
+	}))
+	assert.Equal(t, []string{s3_constants.MultipartUploadsFolder + "/up-1"}, paths)
+}
+
+func TestFilerListFunc_PrunesVersionsDirsOutsidePrefixes(t *testing.T) {
+	// Versioned bucket: stray.versions is out of scope for prefix
+	// "data/" — its logical key "stray" can't match — so it is never
+	// listed. data.versions still expands to logical "data".
+	mtime := time.Now()
+	client := &fakeFiler{tree: map[string][]*filer_pb.Entry{
+		"/buckets/bkt": {
+			versionsDir("data"+s3_constants.VersionsFolder, "v1"),
+			versionsDir("stray"+s3_constants.VersionsFolder, "v1"),
+			dir("other"),
+		},
+		"/buckets/bkt/data" + s3_constants.VersionsFolder: {
+			fileWithExt("v1", mtime, 1, map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v1")}),
+		},
+		"/buckets/bkt/stray" + s3_constants.VersionsFolder: {
+			fileWithExt("v1", mtime, 1, map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v1")}),
+		},
+		"/buckets/bkt/other": {file("x.txt", mtime, 1)},
+	}}
+	view := snapshotForBucketRules(t, "bkt", true,
+		&s3lifecycle.Rule{ID: "r", Status: s3lifecycle.StatusEnabled, Prefix: "data", ExpirationDays: 1})
+	var paths []string
+	require.NoError(t, FilerListFunc(client, "/buckets", view)(context.Background(), "bkt", "", func(e *bootstrap.Entry) error {
+		paths = append(paths, e.Path)
+		return nil
+	}))
+	assert.Equal(t, []string{"data"}, paths)
+	assert.Equal(t, 3, client.listCalls, "bkt twice + data.versions; stray.versions and other pruned")
+}
diff --git a/weed/s3api/s3lifecycle/dailyrun/replay_view_test.go b/weed/s3api/s3lifecycle/dailyrun/replay_view_test.go
new file mode 100644
index 0000000000..1dc3475fc3
--- /dev/null
+++ b/weed/s3api/s3lifecycle/dailyrun/replay_view_test.go
@@ -0,0 +1,67 @@
+package dailyrun
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/engine"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/reader"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRunShard_WalkBoundRuleDoesNotPinCursor: a bucket with a 3-day and a
+// 30-day expiration rule and an 8-day retention window. The 30-day rule is
+// walk-bound, so its object's PUT must not hold the replay cursor back; the
+// cursor advances past it and the due 3-day objects on both sides dispatch.
+// The 3-day rule also carries a durable scan_only mode: the replay view
+// must rehabilitate it to event_driven the way RulesForShard does.
+func TestRunShard_WalkBoundRuleDoesNotPinCursor(t *testing.T) {
+	shortRule := &s3lifecycle.Rule{ID: "short", Status: s3lifecycle.StatusEnabled, Prefix: "short/", ExpirationDays: 3}
+	longRule := &s3lifecycle.Rule{ID: "long", Status: s3lifecycle.StatusEnabled, Prefix: "long/", ExpirationDays: 30}
+	e := engine.New()
+	e.Compile([]engine.CompileInput{
+		{Bucket: "b1", Rules: []*s3lifecycle.Rule{shortRule, longRule}},
+	}, engine.CompileOptions{PriorStates: map[s3lifecycle.ActionKey]engine.PriorState{
+		{Bucket: "b1", RuleHash: s3lifecycle.RuleHash(shortRule), ActionKind: s3lifecycle.ActionKindExpirationDays}: {
+			BootstrapComplete: true, Mode: engine.ModeScanOnly},
+		{Bucket: "b1", RuleHash: s3lifecycle.RuleHash(longRule), ActionKind: s3lifecycle.ActionKindExpirationDays}: {
+			BootstrapComplete: true},
+	}})
+	snap := e.Snapshot()
+	for _, a := range snap.AllActions() {
+		snap.MarkActive(a.Key)
+	}
+	runNow := time.Unix(1_700_000_000, 0).UTC()
+	retention := s3lifecycle.DaysToDuration(8)
+	startTsNs := runNow.Add(-retention).UnixNano()
+	p := newMemPersister()
+	require.NoError(t, p.Save(context.Background(), 0, Cursor{
+		TsNs:         startTsNs,
+		RuleSetHash:  engine.ReplayContentHash(snap),
+		PromotedHash: engine.PromotedHash(snap, retention),
+		LastWalkedNs: runNow.UnixNano(),
+	}))
+	put := func(key string, age time.Duration) *reader.Event {
+		at := runNow.Add(-age)
+		return &reader.Event{TsNs: at.UnixNano(), Bucket: "b1", Key: key, NewEntry: &filer_pb.Entry{
+			Name:       key,
+			Attributes: &filer_pb.FuseAttributes{Mtime: at.Unix(), FileSize: 1},
+		}}
+	}
+	events := make(chan *reader.Event, 3)
+	events <- put("short/a", s3lifecycle.DaysToDuration(7))
+	events <- put("long/a", s3lifecycle.DaysToDuration(6))
+	last := put("short/b", s3lifecycle.DaysToDuration(5))
+	events <- last
+	close(events)
+	client := &recordingClient{}
+	cfg := Config{Persister: p, Client: client, Lister: stubSiblingLister{}, RetentionWindow: retention}
+	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 0, events, nil))
+	assert.ElementsMatch(t, []string{"short/a", "short/b"}, client.seenObjects())
+	got, _, _ := p.Load(context.Background(), 0)
+	assert.Equal(t, last.TsNs, got.TsNs, "cursor must advance past the walk-bound object's PUT")
+}
diff --git a/weed/s3api/s3lifecycle/dailyrun/run.go b/weed/s3api/s3lifecycle/dailyrun/run.go
index f459b1bdde..beeacfa6d4 100644
--- a/weed/s3api/s3lifecycle/dailyrun/run.go
+++ b/weed/s3api/s3lifecycle/dailyrun/run.go
@@ -27,11 +27,10 @@ type LifecycleClient interface {
 	LifecycleDelete(ctx context.Context, req *s3_lifecycle_pb.LifecycleDeleteRequest) (*s3_lifecycle_pb.LifecycleDeleteResponse, error)
 }
 
-// WalkerFunc handles the per-shard bucket walk for a given engine view.
-// Phase 4b uses it on the recovery branch (rule-content edit / partition
-// flip) so already-due objects across the rewritten rule set get caught
-// before the cursor rewinds.
-type WalkerFunc func(ctx context.Context, view *engine.Snapshot, shardID int) error
+// WalkerFunc runs one bucket walk covering every shard in shards under
+// the given engine view, so a whole pass costs at most a couple of
+// bucket listings rather than one listing per shard.
+type WalkerFunc func(ctx context.Context, view *engine.Snapshot, shards []int) error
 
 type Config struct {
 	Shards      []int
@@ -58,9 +57,9 @@ type Config struct {
 	// Walker is invoked on the recovery branch (rule-content edit or
 	// partition flip) before the cursor rewind. It receives the
 	// engine.RecoveryView so only the rules that need bulk re-evaluation
-	// are walked, and the per-shard ID so the implementation can filter
-	// entries. nil disables walker invocation entirely — the cursor
-	// still rewinds, matching Phase 4a behavior.
+	// are walked, and the shard set the walk must cover. nil disables
+	// walker invocation entirely — the cursor still rewinds, matching
+	// Phase 4a behavior.
 	Walker WalkerFunc
 
 	// WalkerInterval throttles the steady-state and empty-replay walker
@@ -132,6 +131,21 @@ func Run(ctx context.Context, cfg Config) error {
 	// compatibility but otherwise inert.
 	_ = cfg.Workers
 
+	retentionWindow := cfg.RetentionWindow
+	if retentionWindow <= 0 {
+		retentionWindow = maxTTL
+	}
+
+	// One cursor scan feeds both the subscription floor and the walk
+	// plan. runShard re-loads its own cursor anyway, so a cursor
+	// rewritten between the two reads can't confuse it.
+	var cursors map[int]cursorLoad
+	if rsh != [32]byte{} || cfg.Walker != nil {
+		cursors = loadShardCursors(ctx, cfg)
+	}
+	promoted := engine.PromotedHash(snap, retentionWindow)
+	walks := planWalks(ctx, cfg, snap, runNow, cursors, rsh, promoted, retentionWindow)
+
 	// rsh==[32]byte{} means no replay-eligible rules — runShard's
 	// walker-only branch fires and saves; no subscription needed.
 	var (
@@ -151,7 +165,7 @@ func Run(ctx context.Context, cfg Config) error {
 		// events on shards whose cursor is older than the floor —
 		// exactly the case where a rule's TTL equals maxTTL and an
 		// older event still has DueTime <= runNow.
-		globalStartTsNs = computeGlobalStartTsNs(ctx, cfg, runNow, maxTTL)
+		globalStartTsNs = computeGlobalStartTsNs(cursors, cfg, runNow, maxTTL)
 		shardEvents, readerDone, fanoutDone, cancelRead = startSharedSubscription(ctx, cfg, runNow, globalStartTsNs, &stoppedOnPurpose)
 		defer cancelRead()
 	}
@@ -167,7 +181,7 @@ func Run(ctx context.Context, cfg Config) error {
 			if shardEvents != nil {
 				ch = shardEvents[sh]
 			}
-			if err := runShard(ctx, cfg, snap, runNow, sh, ch); err != nil {
+			if err := runShard(ctx, cfg, snap, runNow, sh, ch, walks); err != nil {
 				errCh <- err
 			}
 			// A halted dispatch returns runShard mid-stream. Keep
@@ -182,6 +196,18 @@ func Run(ctx context.Context, cfg Config) error {
 	wg.Wait()
 	close(errCh)
 
+	// Join every planned walk. A shard that exits early (cursor load
+	// failure, ctx cancel) never awaits pw.done, but planWalks already
+	// started the goroutine — Run must not return while it still lists
+	// or dispatches against connections the caller is about to close.
+	seenWalks := map[*pendingWalk]bool{}
+	for _, pw := range walks {
+		if !seenWalks[pw] {
+			seenWalks[pw] = true
+			<-pw.done
+		}
+	}
+
 	// Tear down the shared subscription. cancelRead unblocks both the
 	// reader's gRPC stream and the fan-out's send loop; we wait on both
 	// so their goroutines don't outlive Run.
@@ -272,20 +298,20 @@ func summarizeShardCursorLag(ctx context.Context, cfg Config, runNow time.Time)
 	return lagStr + " " + ageStr
 }
 
-// computeGlobalStartTsNs scans every shard's persisted cursor and
-// returns the minimum startTsNs the shared subscription must cover.
-// For each shard the start point is the persisted cursor (steady state)
-// or runNow - maxTTL (cold start, when no cursor exists). Load errors
-// downgrade to the cold-start floor for that shard — failing closed
-// would be worse than re-scanning maxTTL of events.
-func computeGlobalStartTsNs(ctx context.Context, cfg Config, runNow time.Time, maxTTL time.Duration) int64 {
+// computeGlobalStartTsNs returns the minimum startTsNs the shared
+// subscription must cover. For each shard the start point is the
+// persisted cursor (steady state) or runNow - maxTTL (cold start, when
+// no cursor exists). Load errors downgrade to the cold-start floor for
+// that shard — failing closed would be worse than re-scanning maxTTL
+// of events.
+func computeGlobalStartTsNs(cursors map[int]cursorLoad, cfg Config, runNow time.Time, maxTTL time.Duration) int64 {
 	floor := runNow.Add(-maxTTL).UnixNano()
 	min := int64(0)
 	first := true
 	for _, sh := range cfg.Shards {
 		var start int64
-		if persisted, found, err := cfg.Persister.Load(ctx, sh); err == nil && found {
-			start = persisted.TsNs
+		if cl := cursors[sh]; cl.err == nil && cl.found {
+			start = cl.cursor.TsNs
 		} else {
 			start = floor
 		}
@@ -443,6 +469,12 @@ func validate(cfg Config) error {
 	if cfg.SubscriptionReceiveTimeout < 0 {
 		return fmt.Errorf("daily_run: negative SubscriptionReceiveTimeout %v (0 = default %v)", cfg.SubscriptionReceiveTimeout, defaultSubscriptionReceiveTimeout)
 	}
+	// A declared retention window promotes long-TTL rules to the walk
+	// view; without a walker they lose their only dispatch path while
+	// the drain cursor still advances past their events.
+	if cfg.RetentionWindow > 0 && cfg.Walker == nil {
+		return errors.New("daily_run: RetentionWindow requires Walker (promoted rules would be silently skipped)")
+	}
 	for _, sh := range cfg.Shards {
 		if sh < 0 || sh >= s3lifecycle.ShardCount {
 			return fmt.Errorf("daily_run: shard %d out of [0, %d)", sh, s3lifecycle.ShardCount)
@@ -452,7 +484,9 @@ func validate(cfg Config) error {
 }
 
 // runShard executes one daily-replay pass; see DESIGN.md for algorithm.
-// Three walker invocation paths under cfg.Walker (when set):
+// Three walker invocation paths under cfg.Walker (when set); each waits
+// on the pass's shared walk via walkForShard rather than listing the
+// bucket itself:
 //   - cold start / recovery: RecoveryView. Unconditional — these are
 //     bounded events (first run for a shard, or rule-content edit / partition
 //     flip) and the walker must run once when the trigger condition is met.
@@ -462,7 +496,7 @@ func validate(cfg Config) error {
 //   - empty replay: same throttling — buckets with only walker-bound rules
 //     use the walk view, and a too-fast Run() driver would otherwise burn
 //     the filer with a full subtree scan per tick.
-func runShard(ctx context.Context, cfg Config, snap *engine.Snapshot, runNow time.Time, shardID int, events <-chan *reader.Event) error {
+func runShard(ctx context.Context, cfg Config, snap *engine.Snapshot, runNow time.Time, shardID int, events <-chan *reader.Event, walks map[int]*pendingWalk) error {
 	shardLabel := strconv.Itoa(shardID)
 	shardStart := time.Now()
 	defer func() {
@@ -522,7 +556,7 @@ func runShard(ctx context.Context, cfg Config, snap *engine.Snapshot, runNow tim
 		// the bug TestLifecycleExpirationDateInThePast caught.
 		if cfg.Walker != nil && walkerDue(lastWalkedNs, runNow, cfg.WalkerInterval) {
 			if _, walkView := snap.RulesForShard(shardID, retentionWindow); walkView != nil && len(walkView.AllActions()) > 0 {
-				if werr := cfg.Walker(ctx, walkView, shardID); werr != nil {
+				if werr := walkForShard(ctx, cfg.Walker, walks, shardID, false, walkView); werr != nil {
 					return fmt.Errorf("shard=%d: steady walk (empty replay): %w", shardID, werr)
 				}
 				lastWalkedNs = runNow.UnixNano()
@@ -551,7 +585,7 @@ func runShard(ctx context.Context, cfg Config, snap *engine.Snapshot, runNow tim
 	mustWalkColdStart := !found
 	if mustWalkRecovery || mustWalkColdStart {
 		if cfg.Walker != nil {
-			if werr := cfg.Walker(ctx, engine.RecoveryView(snap), shardID); werr != nil {
+			if werr := walkForShard(ctx, cfg.Walker, walks, shardID, true, engine.RecoveryView(snap)); werr != nil {
 				return fmt.Errorf("shard=%d: recovery walk: %w", shardID, werr)
 			}
 			lastWalkedNs = runNow.UnixNano()
@@ -586,7 +620,7 @@ func runShard(ctx context.Context, cfg Config, snap *engine.Snapshot, runNow tim
 	// where this is a normal pass that didn't trigger cold-start.
 	if cfg.Walker != nil && !walkedThisPass && walkerDue(lastWalkedNs, runNow, cfg.WalkerInterval) {
 		if _, walkView := snap.RulesForShard(shardID, retentionWindow); walkView != nil && len(walkView.AllActions()) > 0 {
-			if werr := cfg.Walker(ctx, walkView, shardID); werr != nil {
+			if werr := walkForShard(ctx, cfg.Walker, walks, shardID, false, walkView); werr != nil {
 				return fmt.Errorf("shard=%d: steady walk: %w", shardID, werr)
 			}
 			lastWalkedNs = runNow.UnixNano()
@@ -607,7 +641,10 @@ func runShard(ctx context.Context, cfg Config, snap *engine.Snapshot, runNow tim
 		startTsNs = runNow.Add(-maxTTL).UnixNano()
 	}
 
-	lastOK, _, drainErr := drainShardEvents(ctx, cfg, runNow, shardID, snap, startTsNs, events)
+	// Walk-bound rules are never due inside the retention window; keep them
+	// out of the drain so their matches don't pin the cursor.
+	replayView := snap.ReplayView(retentionWindow)
+	lastOK, _, drainErr := drainShardEvents(ctx, cfg, runNow, shardID, replayView, startTsNs, events)
 	// Fresh ctx: a wall-clock cap on the pass (the shell driver's
 	// -runtime) cancels the drain's, and saving with it would drop the
 	// cursor and re-replay from the same floor next pass.
diff --git a/weed/s3api/s3lifecycle/dailyrun/run_bounded_test.go b/weed/s3api/s3lifecycle/dailyrun/run_bounded_test.go
index cbf4b15607..ab241f1144 100644
--- a/weed/s3api/s3lifecycle/dailyrun/run_bounded_test.go
+++ b/weed/s3api/s3lifecycle/dailyrun/run_bounded_test.go
@@ -219,6 +219,19 @@ func TestValidate_RejectsNegativeSubscriptionReceiveTimeout(t *testing.T) {
 	require.NoError(t, validate(cfg))
 }
 
+// RetentionWindow without a Walker would drop promoted rules' only
+// dispatch path while the drain cursor still advances past their events.
+func TestValidate_RejectsRetentionWindowWithoutWalker(t *testing.T) {
+	cfg := validatableConfig()
+	cfg.RetentionWindow = 24 * time.Hour
+	require.ErrorContains(t, validate(cfg), "RetentionWindow")
+	cfg.Walker = func(context.Context, *engine.Snapshot, []int) error { return nil }
+	require.NoError(t, validate(cfg))
+	cfg.Walker = nil
+	cfg.RetentionWindow = 0
+	require.NoError(t, validate(cfg))
+}
+
 // slowSavePersister stretches teardown past the caller's deadline.
 type slowSavePersister struct {
 	*memPersister
diff --git a/weed/s3api/s3lifecycle/dailyrun/walk_buckets.go b/weed/s3api/s3lifecycle/dailyrun/walk_buckets.go
index bfd63afae6..2a0eac3589 100644
--- a/weed/s3api/s3lifecycle/dailyrun/walk_buckets.go
+++ b/weed/s3api/s3lifecycle/dailyrun/walk_buckets.go
@@ -12,14 +12,14 @@ import (
 )
 
 // WalkBuckets runs bootstrap.Walk for each bucket using a per-bucket
-// ListFunc wrapped to drop entries whose ShardID doesn't belong to
-// shardID. Returns the first bucket error; remaining buckets log and
-// continue so one bucket's filer error doesn't kill the whole walk.
+// ListFunc wrapped to drop entries whose ShardID isn't in shards.
+// Returns the first bucket error; remaining buckets log and continue
+// so one bucket's filer error doesn't kill the whole walk.
 //
 // Composable shape: callers (the worker handler) supply a real
 // filer-backed ListFunc and a real Dispatcher (WalkerDispatcher).
 // Tests pass bootstrap.EntryCallback and a stub Dispatcher.
-func WalkBuckets(ctx context.Context, view *engine.Snapshot, shardID int, buckets []string, list bootstrap.ListFunc, dispatch bootstrap.Dispatcher) error {
+func WalkBuckets(ctx context.Context, view *engine.Snapshot, shards []int, buckets []string, list bootstrap.ListFunc, dispatch bootstrap.Dispatcher) error {
 	if view == nil {
 		return errors.New("WalkBuckets: nil view")
 	}
@@ -29,7 +29,11 @@ func WalkBuckets(ctx context.Context, view *engine.Snapshot, shardID int, bucket
 	if dispatch == nil {
 		return errors.New("WalkBuckets: nil dispatch")
 	}
-	filtered := perShardListFunc(list, shardID)
+	shardSet := make(map[int]bool, len(shards))
+	for _, sh := range shards {
+		shardSet[sh] = true
+	}
+	filtered := perShardListFunc(list, shardSet)
 	var firstErr error
 	for _, b := range buckets {
 		if err := ctx.Err(); err != nil {
@@ -47,19 +51,19 @@ func WalkBuckets(ctx context.Context, view *engine.Snapshot, shardID int, bucket
 }
 
 // perShardListFunc wraps an inner ListFunc so only entries whose
-// logical-key shard matches shardID reach the callback. The walker
+// logical-key shard is in shardSet reach the callback. The walker
 // emits one entry per logical object — versioned siblings share the
 // same logical key so they're either all in-shard or all out — and
 // MPU init records carry the user's destination in DestKey, so the
 // shard predicate must use DestKey there to match what the dispatcher
 // will send.
-func perShardListFunc(inner bootstrap.ListFunc, shardID int) bootstrap.ListFunc {
+func perShardListFunc(inner bootstrap.ListFunc, shardSet map[int]bool) bootstrap.ListFunc {
 	return func(ctx context.Context, bucket, start string, cb func(*bootstrap.Entry) error) error {
 		return inner(ctx, bucket, start, func(e *bootstrap.Entry) error {
 			if e == nil {
 				return nil
 			}
-			if entryShardID(bucket, e) != shardID {
+			if !shardSet[entryShardID(bucket, e)] {
 				return nil
 			}
 			return cb(e)
diff --git a/weed/s3api/s3lifecycle/dailyrun/walk_buckets_test.go b/weed/s3api/s3lifecycle/dailyrun/walk_buckets_test.go
index 4f3f5b75c8..b311b4f5ff 100644
--- a/weed/s3api/s3lifecycle/dailyrun/walk_buckets_test.go
+++ b/weed/s3api/s3lifecycle/dailyrun/walk_buckets_test.go
@@ -104,7 +104,7 @@ func TestWalkBuckets_DispatchesOnlyShardMatchingEntries(t *testing.T) {
 
 	snap := snapshotForBucketRule(t, bucket, 7) // 30-day-old objects expire
 	d := &recordingDispatcher{}
-	err := WalkBuckets(context.Background(), snap, targetShard, []string{bucket},
+	err := WalkBuckets(context.Background(), snap, []int{targetShard}, []string{bucket},
 		bootstrap.EntryCallback(all), d)
 	require.NoError(t, err)
 
@@ -124,9 +124,9 @@ func TestWalkBuckets_DispatchesOnlyShardMatchingEntries(t *testing.T) {
 }
 
 func TestWalkBuckets_NilGuards(t *testing.T) {
-	require.Error(t, WalkBuckets(context.Background(), nil, 0, nil, bootstrap.EntryCallback(nil), &recordingDispatcher{}))
-	require.Error(t, WalkBuckets(context.Background(), snapshotForBucketRule(t, "b", 7), 0, nil, nil, &recordingDispatcher{}))
-	require.Error(t, WalkBuckets(context.Background(), snapshotForBucketRule(t, "b", 7), 0, nil, bootstrap.EntryCallback(nil), nil))
+	require.Error(t, WalkBuckets(context.Background(), nil, []int{0}, nil, bootstrap.EntryCallback(nil), &recordingDispatcher{}))
+	require.Error(t, WalkBuckets(context.Background(), snapshotForBucketRule(t, "b", 7), []int{0}, nil, nil, &recordingDispatcher{}))
+	require.Error(t, WalkBuckets(context.Background(), snapshotForBucketRule(t, "b", 7), []int{0}, nil, bootstrap.EntryCallback(nil), nil))
 }
 
 func TestWalkBuckets_OneBucketErrorDoesNotStopOthers(t *testing.T) {
@@ -141,7 +141,7 @@ func TestWalkBuckets_OneBucketErrorDoesNotStopOthers(t *testing.T) {
 	}
 
 	snap := snapshotForBucketRule(t, "good", 7)
-	err := WalkBuckets(context.Background(), snap, 0, []string{"bad", "good"}, list, &recordingDispatcher{})
+	err := WalkBuckets(context.Background(), snap, []int{0}, []string{"bad", "good"}, list, &recordingDispatcher{})
 	require.Error(t, err)
 	assert.ErrorIs(t, err, listErr)
 }
@@ -152,7 +152,7 @@ func TestWalkBuckets_HonorsContextCancellationBetweenBuckets(t *testing.T) {
 	// short-circuit.
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
-	err := WalkBuckets(ctx, snapshotForBucketRule(t, "b", 7), 0, []string{"b"},
+	err := WalkBuckets(ctx, snapshotForBucketRule(t, "b", 7), []int{0}, []string{"b"},
 		bootstrap.EntryCallback(nil), &recordingDispatcher{})
 	assert.ErrorIs(t, err, context.Canceled)
 }
diff --git a/weed/s3api/s3lifecycle/dailyrun/walk_plan.go b/weed/s3api/s3lifecycle/dailyrun/walk_plan.go
new file mode 100644
index 0000000000..dc51adfd9c
--- /dev/null
+++ b/weed/s3api/s3lifecycle/dailyrun/walk_plan.go
@@ -0,0 +1,105 @@
+package dailyrun
+
+import (
+	"context"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/engine"
+)
+
+// cursorLoad is the outcome of one shard's Persister.Load.
+type cursorLoad struct {
+	cursor Cursor
+	found  bool
+	err    error
+}
+
+func loadShardCursors(ctx context.Context, cfg Config) map[int]cursorLoad {
+	out := make(map[int]cursorLoad, len(cfg.Shards))
+	for _, sh := range cfg.Shards {
+		c, found, err := cfg.Persister.Load(ctx, sh)
+		out[sh] = cursorLoad{cursor: c, found: found, err: err}
+	}
+	return out
+}
+
+// pendingWalk is one shared bucket walk covering a group of shards.
+// runShard goroutines wait on done instead of running their own listing.
+type pendingWalk struct {
+	done     chan struct{}
+	err      error
+	recovery bool
+}
+
+// planWalks groups the shards runShard will send through the recovery
+// and steady-state walk branches — same cursor data, same hash and
+// walkerDue checks — and starts one shared walk per group, so a pass
+// lists each bucket at most twice instead of once per shard.
+//
+// The plan is only a prediction: runShard re-loads its own cursor and
+// keeps the authoritative decision. A shard whose fresh read disagrees
+// (a cursor rewritten by a concurrent pass between the two loads)
+// falls back to a per-shard walk in walkForShard.
+func planWalks(ctx context.Context, cfg Config, snap *engine.Snapshot, runNow time.Time, cursors map[int]cursorLoad, rsh, promoted [32]byte, retentionWindow time.Duration) map[int]*pendingWalk {
+	if cfg.Walker == nil || len(cfg.Shards) == 0 {
+		return nil
+	}
+	// RulesForShard ignores shardID today, so one view serves every
+	// shard. Revisit if it ever partitions rules per shard.
+	_, walkView := snap.RulesForShard(cfg.Shards[0], retentionWindow)
+	walkViewEmpty := walkView == nil || len(walkView.AllActions()) == 0
+
+	var recovery, steady []int
+	for _, sh := range cfg.Shards {
+		cl := cursors[sh]
+		if cl.err != nil {
+			continue
+		}
+		if rsh != [32]byte{} && (!cl.found || cl.cursor.RuleSetHash != rsh || cl.cursor.PromotedHash != promoted) {
+			recovery = append(recovery, sh)
+			continue
+		}
+		var lastWalkedNs int64
+		if cl.found {
+			lastWalkedNs = cl.cursor.LastWalkedNs
+		}
+		if !walkViewEmpty && walkerDue(lastWalkedNs, runNow, cfg.WalkerInterval) {
+			steady = append(steady, sh)
+		}
+	}
+
+	walks := make(map[int]*pendingWalk, len(recovery)+len(steady))
+	start := func(shards []int, recovery bool, view *engine.Snapshot) {
+		pw := &pendingWalk{done: make(chan struct{}), recovery: recovery}
+		for _, sh := range shards {
+			walks[sh] = pw
+		}
+		go func() {
+			defer close(pw.done)
+			pw.err = cfg.Walker(ctx, view, shards)
+		}()
+	}
+	if len(recovery) > 0 {
+		start(recovery, true, engine.RecoveryView(snap))
+	}
+	if len(steady) > 0 {
+		start(steady, false, walkView)
+	}
+	return walks
+}
+
+// walkForShard waits on the shard's planned shared walk when one covers
+// this branch (same recovery/steady kind), or runs a per-shard walk when
+// the plan missed — a cursor drift between the plan load and runShard's
+// own load — or no plan exists (direct runShard calls, tests).
+func walkForShard(ctx context.Context, walker WalkerFunc, walks map[int]*pendingWalk, shardID int, recovery bool, view *engine.Snapshot) error {
+	if pw := walks[shardID]; pw != nil && pw.recovery == recovery {
+		select {
+		case <-pw.done:
+			return pw.err
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+	return walker(ctx, view, []int{shardID})
+}
diff --git a/weed/s3api/s3lifecycle/dailyrun/walk_plan_test.go b/weed/s3api/s3lifecycle/dailyrun/walk_plan_test.go
new file mode 100644
index 0000000000..7b3ffdb981
--- /dev/null
+++ b/weed/s3api/s3lifecycle/dailyrun/walk_plan_test.go
@@ -0,0 +1,232 @@
+package dailyrun
+
+import (
+	"context"
+	"errors"
+	"sort"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/engine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// Issue #11791: a pass used to invoke the walker once per shard, so the
+// whole bucket tree was listed ShardCount times. The walker now gets
+// the full shard set in at most two calls per pass — one for the
+// recovery group, one for the steady group.
+func TestRun_SharesBucketWalkAcrossShards(t *testing.T) {
+	e := engine.New()
+	e.Compile([]engine.CompileInput{
+		{Bucket: "b1", Rules: []*s3lifecycle.Rule{
+			{ID: "r", Status: s3lifecycle.StatusEnabled,
+				ExpirationDate: time.Now().Add(24 * time.Hour)},
+		}},
+	}, engine.CompileOptions{})
+
+	shards := make([]int, 0, s3lifecycle.ShardCount)
+	for i := 0; i < s3lifecycle.ShardCount; i++ {
+		shards = append(shards, i)
+	}
+
+	var mu sync.Mutex
+	var calls [][]int
+	p := newMemPersister()
+	cfg := Config{
+		Shards:      shards,
+		BucketsPath: "/buckets",
+		Engine:      e,
+		FilerClient: stubFilerClient{},
+		Client:      stubLifecycleClient{},
+		Persister:   p,
+		Lister:      stubSiblingLister{},
+		Walker: func(_ context.Context, _ *engine.Snapshot, shards []int) error {
+			mu.Lock()
+			defer mu.Unlock()
+			calls = append(calls, append([]int{}, shards...))
+			return nil
+		},
+	}
+	runNow := time.Unix(1_700_000_000, 0).UTC()
+	cfg.Now = func() time.Time { return runNow }
+	require.NoError(t, Run(context.Background(), cfg))
+
+	require.LessOrEqual(t, len(calls), 2, "a pass must not list the bucket once per shard")
+	covered := map[int]bool{}
+	for _, c := range calls {
+		for _, sh := range c {
+			covered[sh] = true
+		}
+	}
+	for _, sh := range shards {
+		assert.True(t, covered[sh], "shard %d missed the shared walk", sh)
+		c, found, err := p.Load(context.Background(), sh)
+		require.NoError(t, err)
+		require.True(t, found)
+		assert.Equal(t, runNow.UnixNano(), c.LastWalkedNs,
+			"shard %d must credit the shared walk to its own cursor", sh)
+	}
+}
+
+// A recovery group and a steady group in the same pass share one walk
+// each: two walker calls total, each covering its own shard set and
+// its own view.
+func TestRun_RecoveryAndSteadyGroupsWalkSeparately(t *testing.T) {
+	e := engine.New()
+	e.Compile([]engine.CompileInput{
+		{Bucket: "b1", Rules: []*s3lifecycle.Rule{
+			{ID: "r", Status: s3lifecycle.StatusEnabled,
+				ExpirationDays: 30,
+				ExpirationDate: time.Now().Add(24 * time.Hour)},
+		}},
+	}, engine.CompileOptions{})
+	snap := e.Snapshot()
+	for _, a := range snap.AllActions() {
+		snap.MarkActive(a.Key)
+	}
+
+	p := newMemPersister()
+	var stale [32]byte
+	for i := range stale {
+		stale[i] = 0xAA
+	}
+	// Shard 0's stale rule hash sends it through the recovery walk.
+	// Shards 1 and 2 have matching hashes and a zero walk anchor, so
+	// the steady-state branch takes them.
+	require.NoError(t, p.Save(context.Background(), 0, Cursor{TsNs: 42, RuleSetHash: stale}))
+	matching := Cursor{
+		TsNs:         1234,
+		RuleSetHash:  engine.ReplayContentHash(snap),
+		PromotedHash: engine.PromotedHash(snap, engine.MaxEffectiveTTL(snap)),
+	}
+	for _, sh := range []int{1, 2} {
+		require.NoError(t, p.Save(context.Background(), sh, matching))
+	}
+
+	var mu sync.Mutex
+	var calls [][]int
+	var actions []int
+	cfg := Config{
+		Shards:      []int{0, 1, 2},
+		BucketsPath: "/buckets",
+		Engine:      e,
+		FilerClient: &idleSubscribeClient{},
+		Client:      stubLifecycleClient{},
+		Persister:   p,
+		Lister:      stubSiblingLister{},
+		Walker: func(_ context.Context, view *engine.Snapshot, shards []int) error {
+			mu.Lock()
+			defer mu.Unlock()
+			calls = append(calls, append([]int{}, shards...))
+			actions = append(actions, len(view.AllActions()))
+			return nil
+		},
+	}
+	require.NoError(t, Run(context.Background(), cfg))
+
+	require.Len(t, calls, 2, "one shared walk per group: recovery + steady")
+	for i, c := range calls {
+		sort.Ints(c)
+		switch {
+		case len(c) == 1 && c[0] == 0:
+			assert.Equal(t, 2, actions[i], "recovery view carries every non-disabled action")
+		case len(c) == 2 && c[0] == 1 && c[1] == 2:
+			assert.Equal(t, 1, actions[i], "walk view carries only the walker-bound action")
+		default:
+			t.Fatalf("unexpected walk group %v", c)
+		}
+	}
+}
+
+// A shared walk error must surface on every shard it covered, not just
+// the one that happened to run the listing.
+func TestRun_SharedWalkErrorFailsCoveredShards(t *testing.T) {
+	e := engine.New()
+	e.Compile([]engine.CompileInput{
+		{Bucket: "b1", Rules: []*s3lifecycle.Rule{
+			{ID: "r", Status: s3lifecycle.StatusEnabled,
+				ExpirationDate: time.Now().Add(24 * time.Hour)},
+		}},
+	}, engine.CompileOptions{})
+
+	cfg := Config{
+		Shards:      []int{0, 1},
+		BucketsPath: "/buckets",
+		Engine:      e,
+		FilerClient: stubFilerClient{},
+		Client:      stubLifecycleClient{},
+		Persister:   newMemPersister(),
+		Lister:      stubSiblingLister{},
+		Walker: func(_ context.Context, _ *engine.Snapshot, _ []int) error {
+			return errors.New("walk boom")
+		},
+	}
+	err := Run(context.Background(), cfg)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "walk boom")
+}
+
+// countingPersister fails Load after the first failAfter calls: call 1
+// feeds planWalks, the failing call 2 is runShard's authoritative read.
+type countingPersister struct {
+	inner     CursorPersister
+	calls     atomic.Int32
+	failAfter int32
+}
+
+func (p *countingPersister) Load(ctx context.Context, shardID int) (Cursor, bool, error) {
+	if p.calls.Add(1) > p.failAfter {
+		return Cursor{}, false, errors.New("transient load failure")
+	}
+	return p.inner.Load(ctx, shardID)
+}
+
+func (p *countingPersister) Save(ctx context.Context, shardID int, c Cursor) error {
+	return p.inner.Save(ctx, shardID, c)
+}
+
+// A shard whose second cursor load fails exits runShard without
+// awaiting the planned walk it was grouped into. The walk goroutine is
+// already running — Run must still join it, or the handler tears down
+// the filer connection while the walk is mid-listing.
+func TestRun_JoinsPlannedWalkWhenShardExitsEarly(t *testing.T) {
+	e := engine.New()
+	e.Compile([]engine.CompileInput{
+		{Bucket: "b1", Rules: []*s3lifecycle.Rule{
+			{ID: "r", Status: s3lifecycle.StatusEnabled,
+				ExpirationDate: time.Now().Add(24 * time.Hour)},
+		}},
+	}, engine.CompileOptions{})
+
+	walkStarted := make(chan struct{})
+	walkRelease := make(chan struct{})
+	cfg := Config{
+		Shards:      []int{0},
+		BucketsPath: "/buckets",
+		Engine:      e,
+		FilerClient: stubFilerClient{},
+		Client:      stubLifecycleClient{},
+		Persister:   &countingPersister{inner: newMemPersister(), failAfter: 1},
+		Lister:      stubSiblingLister{},
+		Walker: func(context.Context, *engine.Snapshot, []int) error {
+			close(walkStarted)
+			<-walkRelease
+			return nil
+		},
+	}
+	runDone := make(chan error, 1)
+	go func() { runDone <- Run(context.Background(), cfg) }()
+
+	<-walkStarted
+	select {
+	case <-runDone:
+		t.Fatal("Run returned while the planned walk was still running")
+	case <-time.After(200 * time.Millisecond):
+	}
+	close(walkRelease)
+	require.Error(t, <-runDone)
+}
diff --git a/weed/s3api/s3lifecycle/dailyrun/walker_interval_test.go b/weed/s3api/s3lifecycle/dailyrun/walker_interval_test.go
index e6af3d8752..27f9230d8a 100644
--- a/weed/s3api/s3lifecycle/dailyrun/walker_interval_test.go
+++ b/weed/s3api/s3lifecycle/dailyrun/walker_interval_test.go
@@ -84,7 +84,7 @@ func TestRunShard_WalkerThrottle(t *testing.T) {
 			calls := 0
 			cfg := Config{
 				Persister: p,
-				Walker: func(_ context.Context, _ *engine.Snapshot, _ int) error {
+				Walker: func(_ context.Context, _ *engine.Snapshot, _ []int) error {
 					calls++
 					return nil
 				},
@@ -127,7 +127,7 @@ func TestRunShard_WalkerThrottle(t *testing.T) {
 			close(closedEvents)
 
 			// Pass 1.
-			require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 0, closedEvents))
+			require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 0, closedEvents, nil))
 			afterPass1, _, _ := p.Load(context.Background(), 0)
 			require.Equal(t, 1, calls, "pass 1 must fire the walker (cold-start anchor)")
 			require.Equal(t, runNow.UnixNano(), afterPass1.LastWalkedNs)
@@ -136,7 +136,7 @@ func TestRunShard_WalkerThrottle(t *testing.T) {
 			runNow2 := runNow.Add(tc.secondPassAfter)
 			closedEvents2 := make(chan *readerEventAlias)
 			close(closedEvents2)
-			require.NoError(t, runShard(context.Background(), cfg, snap, runNow2, 0, closedEvents2))
+			require.NoError(t, runShard(context.Background(), cfg, snap, runNow2, 0, closedEvents2, nil))
 			afterPass2, _, _ := p.Load(context.Background(), 0)
 			assert.Equal(t, tc.wantTotalCalls, calls, "walker calls after 2 passes")
 			if tc.wantSecondAdvNs {
@@ -221,7 +221,7 @@ func TestRunShard_ColdStartDoesNotDoubleWalk(t *testing.T) {
 	calls := 0
 	cfg := Config{
 		Persister: p,
-		Walker: func(_ context.Context, _ *engine.Snapshot, _ int) error {
+		Walker: func(_ context.Context, _ *engine.Snapshot, _ []int) error {
 			calls++
 			return nil
 		},
@@ -231,7 +231,7 @@ func TestRunShard_ColdStartDoesNotDoubleWalk(t *testing.T) {
 
 	closedEvents := make(chan *readerEventAlias)
 	close(closedEvents)
-	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 0, closedEvents))
+	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 0, closedEvents, nil))
 
 	assert.Equal(t, 1, calls, "cold-start walker must fire exactly once per pass even with interval=0")
 }
@@ -256,14 +256,14 @@ func TestRunShard_RecoveryWalkerSetsLastWalkedAnchor(t *testing.T) {
 	calls := 0
 	cfg := Config{
 		Persister: p,
-		Walker: func(_ context.Context, _ *engine.Snapshot, _ int) error {
+		Walker: func(_ context.Context, _ *engine.Snapshot, _ []int) error {
 			calls++
 			return nil
 		},
 		WalkerInterval: time.Hour,
 	}
 	runNow := time.Unix(1_700_000_000, 0).UTC()
-	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 5, nil))
+	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 5, nil, nil))
 
 	require.Equal(t, 1, calls, "recovery branch fires the walker unconditionally")
 	got, ok, _ := p.Load(context.Background(), 5)
diff --git a/weed/s3api/s3lifecycle/dailyrun/walker_recovery_test.go b/weed/s3api/s3lifecycle/dailyrun/walker_recovery_test.go
index 1dbe068f16..245221cdfb 100644
--- a/weed/s3api/s3lifecycle/dailyrun/walker_recovery_test.go
+++ b/weed/s3api/s3lifecycle/dailyrun/walker_recovery_test.go
@@ -66,23 +66,23 @@ func TestRunShard_WalkerInvokedOnRecoveryBranch(t *testing.T) {
 	require.NoError(t, p.Save(context.Background(), 3, Cursor{TsNs: 1234, RuleSetHash: stale}))
 
 	var gotView *engine.Snapshot
-	var gotShard int
+	var gotShards []int
 	calls := 0
 	cfg := Config{
 		Persister: p,
-		Walker: func(_ context.Context, view *engine.Snapshot, shardID int) error {
+		Walker: func(_ context.Context, view *engine.Snapshot, shards []int) error {
 			calls++
 			gotView = view
-			gotShard = shardID
+			gotShards = shards
 			return nil
 		},
 	}
 	runNow := time.Unix(1_700_000_000, 0).UTC()
-	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 3, nil))
+	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 3, nil, nil))
 
 	assert.Equal(t, 1, calls, "walker must fire exactly once on recovery")
 	require.NotNil(t, gotView, "walker received the RecoveryView")
-	assert.Equal(t, 3, gotShard)
+	assert.Equal(t, []int{3}, gotShards)
 
 	// Cursor rewound to runNow - maxTTL with the new hashes persisted.
 	got, ok, err := p.Load(context.Background(), 3)
@@ -106,7 +106,7 @@ func TestRunShard_NilWalkerOnRecoveryIsNoop(t *testing.T) {
 
 	cfg := Config{Persister: p} // Walker nil
 	runNow := time.Unix(1_700_000_000, 0).UTC()
-	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 0, nil))
+	require.NoError(t, runShard(context.Background(), cfg, snap, runNow, 0, nil, nil))
 
 	got, ok, err := p.Load(context.Background(), 0)
 	require.NoError(t, err)
@@ -128,12 +128,12 @@ func TestRunShard_WalkerErrorPropagates(t *testing.T) {
 
 	cfg := Config{
 		Persister: p,
-		Walker: func(_ context.Context, _ *engine.Snapshot, _ int) error {
+		Walker: func(_ context.Context, _ *engine.Snapshot, _ []int) error {
 			return errors.New("walker boom")
 		},
 	}
 	runNow := time.Unix(1_700_000_000, 0).UTC()
-	err := runShard(context.Background(), cfg, snap, runNow, 7, nil)
+	err := runShard(context.Background(), cfg, snap, runNow, 7, nil, nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "walker boom")
 
diff --git a/weed/s3api/s3lifecycle/engine/compile.go b/weed/s3api/s3lifecycle/engine/compile.go
index 71bda62949..411b607bb2 100644
--- a/weed/s3api/s3lifecycle/engine/compile.go
+++ b/weed/s3api/s3lifecycle/engine/compile.go
@@ -80,6 +80,7 @@ func (e *Engine) Compile(inputs []CompileInput, opts CompileOptions) *Snapshot {
 					Delay:              s3lifecycle.MinTriggerAge(rule, kind),
 					PredicateSensitive: rulePredicateSensitive(rule),
 					Mode:               mode,
+					bootstrapComplete:  prior.BootstrapComplete,
 				}
 				if active {
 					ca.markActive()
diff --git a/weed/s3api/s3lifecycle/engine/engine.go b/weed/s3api/s3lifecycle/engine/engine.go
index 0c6b40f042..9695e46387 100644
--- a/weed/s3api/s3lifecycle/engine/engine.go
+++ b/weed/s3api/s3lifecycle/engine/engine.go
@@ -54,6 +54,7 @@ type CompiledAction struct {
 	Delay              time.Duration
 	PredicateSensitive bool
 	Mode               RuleMode
+	bootstrapComplete  bool
 	engineState        atomic.Uint32
 }
 
@@ -119,6 +120,30 @@ func (s *Snapshot) BucketVersioned(bucket string) bool {
 	return false
 }
 
+// BucketPrefixes returns the distinct rule prefixes of the bucket's
+// active actions in this view. An empty result means no active action
+// can match any entry in the bucket; a "" element means some rule
+// matches every key.
+func (s *Snapshot) BucketPrefixes(bucket string) []string {
+	bi := s.buckets[bucket]
+	if bi == nil {
+		return nil
+	}
+	seen := map[string]bool{}
+	var out []string
+	for _, k := range bi.actionKeys {
+		a := s.actions[k]
+		if a == nil || !a.IsActive() || a.Mode == ModeDisabled || a.Rule == nil {
+			continue
+		}
+		if !seen[a.Rule.Prefix] {
+			seen[a.Rule.Prefix] = true
+			out = append(out, a.Rule.Prefix)
+		}
+	}
+	return out
+}
+
 // BucketActionKeys returns a defensive copy of the action keys for bucket,
 // or nil if the bucket has no compiled actions in this snapshot.
 func (s *Snapshot) BucketActionKeys(bucket string) []s3lifecycle.ActionKey {
diff --git a/weed/s3api/s3lifecycle/engine/hashes.go b/weed/s3api/s3lifecycle/engine/hashes.go
index 42815a1e5f..169b62e566 100644
--- a/weed/s3api/s3lifecycle/engine/hashes.go
+++ b/weed/s3api/s3lifecycle/engine/hashes.go
@@ -152,11 +152,7 @@ func PromotedHash(s *Snapshot, retentionWindow time.Duration) [32]byte {
 		if !isReplayKind(k.ActionKind) {
 			continue
 		}
-		ttl := effectiveTTL(a)
-		// Mirror RulesForShard's partition predicate exactly: a replay
-		// kind lands in walk when ttl is 0 (malformed) or ttl >
-		// retentionWindow. PromotedHash hashes that walk-bound subset.
-		if ttl > 0 && ttl <= retentionWindow {
+		if !isPromoted(a, retentionWindow) {
 			continue
 		}
 		items = append(items, hashItem{key: k, action: a})
diff --git a/weed/s3api/s3lifecycle/engine/views.go b/weed/s3api/s3lifecycle/engine/views.go
index 7770ca668e..1c0d92802e 100644
--- a/weed/s3api/s3lifecycle/engine/views.go
+++ b/weed/s3api/s3lifecycle/engine/views.go
@@ -59,6 +59,7 @@ func cloneAction(src *CompiledAction, mode RuleMode, active bool) *CompiledActio
 		Delay:              src.Delay,
 		PredicateSensitive: src.PredicateSensitive,
 		Mode:               mode,
+		bootstrapComplete:  src.bootstrapComplete,
 	}
 	if active {
 		dst.markActive()
@@ -145,6 +146,17 @@ func effectiveTTL(a *CompiledAction) time.Duration {
 	return 0
 }
 
+// isPromoted reports whether a replay-kind action belongs to the walk
+// partition for retentionWindow. retentionWindow == 0 means "no retention
+// info supplied": treat the partition as walk-only — promoting every rule
+// into replay without retention proof would defeat the scan_only
+// protection. ttl == 0 is a malformed rule (kind says replay but no TTL):
+// also promoted so the walker can decide.
+func isPromoted(a *CompiledAction, retentionWindow time.Duration) bool {
+	ttl := effectiveTTL(a)
+	return ttl <= 0 || ttl > retentionWindow
+}
+
 // RulesForShard partitions the base snapshot's compiled actions into a
 // replay view and a walk view.
 //
@@ -187,14 +199,7 @@ func (s *Snapshot) RulesForShard(shardID int, retentionWindow time.Duration) (re
 			continue
 		}
 		if isReplayKind(key.ActionKind) {
-			ttl := effectiveTTL(a)
-			// retentionWindow == 0 means "no retention info supplied" — the
-			// caller should treat the partition as walk-only to stay safe,
-			// since promoting every rule into replay without retention
-			// proof would defeat the scan_only protection. ttl == 0 is a
-			// malformed rule (kind says replay but no TTL): also routes to
-			// walk so the walker can decide.
-			if ttl > 0 && ttl <= retentionWindow {
+			if !isPromoted(a, retentionWindow) {
 				replayActions[key] = cloneAction(a, ModeEventDriven, true)
 			} else {
 				walkActions[key] = cloneAction(a, a.Mode, true)
@@ -209,6 +214,45 @@ func (s *Snapshot) RulesForShard(shardID int, retentionWindow time.Duration) (re
 	return newView(s, replayActions), newView(s, walkActions)
 }
 
+// ReplayView returns the snapshot the meta-log drain routes events against:
+// the base snapshot minus the replay-kind actions promoted to the walk
+// partition for retentionWindow. Promoted matches are never due within the
+// replay window, and the drain holds a shard's cursor at the first event
+// with a not-yet-due match, so one promoted match would pin the cursor
+// until that object comes due; the walk view serves them instead.
+//
+// Actions are shared with the base by pointer so a MarkActive flip stays
+// observable mid-drain. The exception is a replay-kind action still
+// carrying ModeScanOnly: it is cloned as ModeEventDriven and reactivated
+// when its bootstrap rendezvous already completed, for the same reason
+// RulesForShard rewrites the mode — router.Route gates on event_driven,
+// and scan_only is a retention verdict, not a bootstrap state. Disabled
+// actions stay out.
+//
+// Returns nil when every action is promoted or disabled.
+func (s *Snapshot) ReplayView(retentionWindow time.Duration) *Snapshot {
+	if s == nil {
+		return nil
+	}
+	actions := map[s3lifecycle.ActionKey]*CompiledAction{}
+	for key, a := range s.actions {
+		if a == nil || a.Mode == ModeDisabled {
+			continue
+		}
+		if isReplayKind(key.ActionKind) {
+			if isPromoted(a, retentionWindow) {
+				continue
+			}
+			if a.Mode == ModeScanOnly {
+				actions[key] = cloneAction(a, ModeEventDriven, a.IsActive() || a.bootstrapComplete)
+				continue
+			}
+		}
+		actions[key] = a
+	}
+	return newView(s, actions)
+}
+
 // RecoveryView returns a *Snapshot that contains a clone of every action in
 // the base, with active=true regardless of compile-time IsActive/
 // BootstrapComplete and Mode preserved as-is. The recovery walker uses this
diff --git a/weed/s3api/s3lifecycle/engine/views_test.go b/weed/s3api/s3lifecycle/engine/views_test.go
index 7c2a9973bc..cd1e61774f 100644
--- a/weed/s3api/s3lifecycle/engine/views_test.go
+++ b/weed/s3api/s3lifecycle/engine/views_test.go
@@ -235,6 +235,70 @@ func TestRulesForShard_ZeroRetentionRoutesAllReplayKindsToWalk(t *testing.T) {
 	assert.Len(t, walk.actions, 1)
 }
 
+func TestReplayView_PartitionAndScanOnlyRehabilitation(t *testing.T) {
+	short := &s3lifecycle.Rule{ID: "short", Status: s3lifecycle.StatusEnabled, ExpirationDays: 3}
+	long := &s3lifecycle.Rule{ID: "long", Status: s3lifecycle.StatusEnabled, ExpirationDays: 30}
+	date := &s3lifecycle.Rule{ID: "date", Status: s3lifecycle.StatusEnabled, ExpirationDate: time.Now().Add(48 * time.Hour)}
+	off := &s3lifecycle.Rule{ID: "off", Status: s3lifecycle.StatusDisabled, ExpirationDays: 7}
+	pending := &s3lifecycle.Rule{ID: "pending", Status: s3lifecycle.StatusEnabled, ExpirationDays: 5}
+	locked := &s3lifecycle.Rule{ID: "locked", Status: s3lifecycle.StatusEnabled, ExpirationDays: 4}
+	shortKey := s3lifecycle.ActionKey{Bucket: "b1", RuleHash: s3lifecycle.RuleHash(short), ActionKind: s3lifecycle.ActionKindExpirationDays}
+	longKey := s3lifecycle.ActionKey{Bucket: "b1", RuleHash: s3lifecycle.RuleHash(long), ActionKind: s3lifecycle.ActionKindExpirationDays}
+	pendingKey := s3lifecycle.ActionKey{Bucket: "b1", RuleHash: s3lifecycle.RuleHash(pending), ActionKind: s3lifecycle.ActionKindExpirationDays}
+	lockedKey := s3lifecycle.ActionKey{Bucket: "b1", RuleHash: s3lifecycle.RuleHash(locked), ActionKind: s3lifecycle.ActionKindExpirationDays}
+	snap := New().Compile(
+		[]CompileInput{{Bucket: "b1", Rules: []*s3lifecycle.Rule{short, long, date, off, pending, locked}}},
+		CompileOptions{PriorStates: map[s3lifecycle.ActionKey]PriorState{
+			shortKey:  {BootstrapComplete: true, Mode: ModeScanOnly},
+			longKey:   {BootstrapComplete: true},
+			lockedKey: {Mode: ModeScanOnly}, // demoted before bootstrap finished
+		}},
+	)
+
+	rv := snap.ReplayView(s3lifecycle.DaysToDuration(8))
+	require.NotNil(t, rv)
+
+	// The 30d rule is promoted to walk; the drain must not route it.
+	assert.Nil(t, rv.actions[longKey])
+	// Disabled rules stay out entirely; short+date+pending+locked remain.
+	assert.Len(t, rv.actions, 4)
+	// ScanOnly lock-in rehabilitates to event_driven once bootstrap
+	// completed; the base is untouched.
+	clone := rv.actions[shortKey]
+	require.NotNil(t, clone)
+	assert.NotSame(t, snap.actions[shortKey], clone)
+	assert.Equal(t, ModeEventDriven, clone.Mode)
+	assert.True(t, clone.IsActive())
+	assert.Equal(t, ModeScanOnly, snap.actions[shortKey].Mode)
+	// ScanOnly without a completed bootstrap stays inactive — the drain
+	// must not dispatch rules whose rendezvous never ran.
+	lockedClone := rv.actions[lockedKey]
+	require.NotNil(t, lockedClone)
+	assert.Equal(t, ModeEventDriven, lockedClone.Mode)
+	assert.False(t, lockedClone.IsActive())
+	// Pre-bootstrap event-driven actions keep active=false and share the
+	// base pointer so a mid-pass MarkActive stays observable.
+	assert.Same(t, snap.actions[pendingKey], rv.actions[pendingKey])
+	assert.False(t, rv.actions[pendingKey].IsActive())
+	// Walk-bound kinds share the base pointer, Mode preserved.
+	dateKey := s3lifecycle.ActionKey{Bucket: "b1", RuleHash: s3lifecycle.RuleHash(date), ActionKind: s3lifecycle.ActionKindExpirationDate}
+	assert.Same(t, snap.actions[dateKey], rv.actions[dateKey])
+	assert.Equal(t, ModeScanAtDate, rv.actions[dateKey].Mode)
+}
+
+func TestReplayView_AllPromotedReturnsNil(t *testing.T) {
+	rule := &s3lifecycle.Rule{ID: "long", Status: s3lifecycle.StatusEnabled, ExpirationDays: 90}
+	snap := buildSnapshotForViews(t, "b1", rule)
+	assert.Nil(t, snap.ReplayView(s3lifecycle.DaysToDuration(8)))
+	assert.Nil(t, snap.ReplayView(0))
+	assert.Nil(t, snap.ReplayView(0))
+}
+
+func TestReplayView_NilSnapshot(t *testing.T) {
+	var s *Snapshot
+	assert.Nil(t, s.ReplayView(0))
+}
+
 func TestRecoveryView_ActivatesEveryNonDisabledAction(t *testing.T) {
 	// Base snapshot has no PriorState → event-driven actions land inactive
 	// (pre-BootstrapComplete). Recovery view must clone them with active=
diff --git a/weed/s3api/s3lifecycle/router/router.go b/weed/s3api/s3lifecycle/router/router.go
index 369172c9c7..81c084e5c1 100644
--- a/weed/s3api/s3lifecycle/router/router.go
+++ b/weed/s3api/s3lifecycle/router/router.go
@@ -109,11 +109,19 @@ func Route(ctx context.Context, snap *engine.Snapshot, ev *reader.Event, now tim
 	// EXP_DM can fire on two version-folder events: the marker create
 	// (sole survivor immediately) and a noncurrent hard-delete that
 	// leaves only the marker behind. Both reach routeSoleSurvivorMarker.
+	// A stamped version-file write is also the latest for its logical key
+	// at write time — the versioned layout emits no bare-key event the
+	// regular path could see, so ExpirationDays must schedule here or it
+	// only ever fires via a cold-start / rule-change recovery walk.
 	if versioned && isVersionFolderPath(ev.Key) {
-		if !hasActiveEventDrivenAction(snap, keys, s3lifecycle.ActionKindExpiredDeleteMarker) {
-			return nil
+		var matches []Match
+		if isVersionFileWrite(ev.NewEntry) {
+			matches = routeVersionFileExpiration(snap, ev, keys)
 		}
-		return routeSoleSurvivorMarker(ctx, snap, ev, keys, lister)
+		if hasActiveEventDrivenAction(snap, keys, s3lifecycle.ActionKindExpiredDeleteMarker) {
+			matches = append(matches, routeSoleSurvivorMarker(ctx, snap, ev, keys, lister)...)
+		}
+		return matches
 	}
 
 	if ev.NewEntry == nil {
@@ -517,6 +525,71 @@ func emitNoncurrentMatches(snap *engine.Snapshot, ev *reader.Event, keys []s3lif
 	return matches
 }
 
+// isVersionFileWrite reports whether the event's new entry is a genuine
+// version-file write: a non-marker file carrying ExtVersionIdKey. The
+// version id stamp is what separates it from a literal user file under a
+// *.versions/ parent.
+func isVersionFileWrite(entry *filer_pb.Entry) bool {
+	if entry == nil || entry.IsDirectory || isDeleteMarkerEntry(entry) {
+		return false
+	}
+	return len(entry.Extended[s3_constants.ExtVersionIdKey]) > 0
+}
+
+// routeVersionFileExpiration schedules current-version expiration from a
+// version-file write. The file is the latest at write time, and VersionID
+// stays empty so the dispatcher resolves the latest at due time — a
+// fresher PUT meanwhile resolves to STALE_IDENTITY there, and that PUT's
+// own event carried its own schedule. A write that turns out to be an
+// older version's metadata update no-ops the same way.
+func routeVersionFileExpiration(snap *engine.Snapshot, ev *reader.Event, keys []s3lifecycle.ActionKey) []Match {
+	logical, ok := logicalKeyFromVersionPath(ev.Key)
+	if !ok {
+		return nil
+	}
+	entry := ev.NewEntry
+	if entry.Attributes == nil {
+		return nil
+	}
+	info := &s3lifecycle.ObjectInfo{
+		Key:      logical,
+		ModTime:  time.Unix(entry.Attributes.Mtime, int64(entry.Attributes.MtimeNs)),
+		Size:     int64(entry.Attributes.FileSize),
+		IsLatest: true,
+	}
+	if tags := extractTags(entry.Extended); len(tags) > 0 {
+		info.Tags = tags
+	}
+	eventTime := time.Unix(0, ev.TsNs)
+	identity := buildIdentityFromEntry(entry)
+	var matches []Match
+	for _, key := range keys {
+		action := snap.Action(key)
+		if action == nil || !action.IsActive() || action.Mode != engine.ModeEventDriven {
+			continue
+		}
+		dueTime := s3lifecycle.ComputeDueAt(action.Rule, key.ActionKind, info)
+		if dueTime.IsZero() {
+			continue
+		}
+		res := s3lifecycle.EvaluateAction(action.Rule, key.ActionKind, info, dueTime)
+		if res.Action == s3lifecycle.ActionNone {
+			continue
+		}
+		matches = append(matches, Match{
+			Key:       key,
+			Action:    action,
+			Result:    res,
+			EventTs:   eventTime,
+			DueTime:   dueTime,
+			Bucket:    ev.Bucket,
+			ObjectKey: logical,
+			Identity:  identity,
+		})
+	}
+	return matches
+}
+
 // routeSoleSurvivorMarker emits an EXP_DM Match against the LOGICAL key
 // (so the dispatcher can call deleteSpecificObjectVersion) with the
 // marker's version_id. Handles two events: a marker create (the new
diff --git a/weed/s3api/s3lifecycle/router/router_test.go b/weed/s3api/s3lifecycle/router/router_test.go
index ddce9a6744..076b0eefb3 100644
--- a/weed/s3api/s3lifecycle/router/router_test.go
+++ b/weed/s3api/s3lifecycle/router/router_test.go
@@ -458,6 +458,65 @@ func TestRouteVersionedCurrentEventStaysLatest(t *testing.T) {
 	}
 }
 
+func TestRouteVersionedVersionFileWriteSchedulesExpiration(t *testing.T) {
+	// A versioned PUT shows up in the meta-log as the version file plus
+	// the .versions/ directory update — there is no bare-key event for
+	// the regular path to see. The version file is the latest at write
+	// time; the match carries its identity with an empty VersionID so
+	// dispatch CAS-checks the current latest at due time.
+	rule := &s3lifecycle.Rule{ID: "r", Status: s3lifecycle.StatusEnabled, ExpirationDays: 1}
+	snap := compileWithVersioned(rule, activatedPrior(rule))
+
+	now := time.Now()
+	old := now.AddDate(0, 0, -2)
+	ev := eventCreate("bk", "logs/foo"+s3_constants.VersionsFolder+"/v_v1", old.Unix(), 1, old.UnixNano())
+	ev.NewEntry.Extended = map[string][]byte{
+		s3_constants.ExtVersionIdKey: []byte("v1"),
+	}
+
+	matches := Route(context.Background(), snap, ev, now, nil)
+	if len(matches) != 1 {
+		t.Fatalf("expected 1 match (EXPIRATION_DAYS), got %v", matches)
+	}
+	m := matches[0]
+	if m.Key.ActionKind != s3lifecycle.ActionKindExpirationDays {
+		t.Fatalf("ActionKind=%v, want ExpirationDays", m.Key.ActionKind)
+	}
+	if m.ObjectKey != "logs/foo" {
+		t.Fatalf("ObjectKey=%q, want the logical key", m.ObjectKey)
+	}
+	if m.VersionID != "" {
+		t.Fatalf("VersionID=%q, want empty so dispatch resolves the current latest", m.VersionID)
+	}
+	if m.Identity == nil {
+		t.Fatal("Identity must fingerprint the version file for dispatch CAS")
+	}
+	if want := time.Unix(old.Unix(), 0).Add(s3lifecycle.DaysToDuration(1)); !m.DueTime.Equal(want) {
+		t.Fatalf("DueTime=%v, want %v", m.DueTime, want)
+	}
+}
+
+func TestRouteVersionedMarkerCreateDoesNotFireExpiration(t *testing.T) {
+	// A delete marker is a version file too, but ExpirationDays never
+	// applies to a marker — only EXP_DM, handled by the sole-survivor
+	// path. Without the marker gate, the expiration match would pin a
+	// marker identity and dispatch would stack a second marker on top.
+	rule := &s3lifecycle.Rule{ID: "r", Status: s3lifecycle.StatusEnabled, ExpirationDays: 1}
+	snap := compileWithVersioned(rule, activatedPrior(rule))
+
+	now := time.Now()
+	old := now.AddDate(0, 0, -2)
+	ev := markerEvent("bk", "logs/gone", "2026-05-09-abc", old.Unix(), old.UnixNano())
+
+	lister := &recordingLister{survivors: Survivors{Count: 1}}
+	if got := Route(context.Background(), snap, ev, now, lister); len(got) != 0 {
+		t.Fatalf("marker create must not fire EXPIRATION_DAYS, got %v", got)
+	}
+	if len(lister.calls) != 0 {
+		t.Fatalf("lister consulted without an EXP_DM rule: calls=%v", lister.calls)
+	}
+}
+
 func TestRouteNonVersionedBucketIgnoresVersionsSuffix(t *testing.T) {
 	// A non-versioned bucket happens to have an object literally named
 	// "logs/foo.versions/v1" — that's just a regular path. The router
@@ -796,13 +855,11 @@ func TestRouteVersionedDeleteMarkerNoExpDMRuleSkipsListing(t *testing.T) {
 }
 
 func TestRouteVersionedAllVersionFolderPathsSkipped(t *testing.T) {
-	// On a versioned bucket the router skips every event whose parent
-	// directory name ends with ".versions" — both the version files
-	// SeaweedFS itself writes (logs/foo.versions/v_v1) and any literal
-	// key the user happens to put under such a parent — because the
-	// current-vs-noncurrent classification needs the .versions/
-	// directory's latest pointer, which isn't carried by these events.
-	// Bootstrap covers retention for those entries.
+	// On a versioned bucket, events inside a *.versions/ parent that are
+	// not stamped version-file writes stay unrouted — current-vs-noncurrent
+	// classification needs the container's latest pointer, and the file's
+	// own ExtVersionIdKey is what marks it as a version write the
+	// expiration path can schedule from.
 	rule := &s3lifecycle.Rule{ID: "r", Status: s3lifecycle.StatusEnabled, ExpirationDays: 1}
 	snap := compileWithVersioned(rule, activatedPrior(rule))
 
@@ -815,9 +872,11 @@ func TestRouteVersionedAllVersionFolderPathsSkipped(t *testing.T) {
 		ext   map[string][]byte
 	}{
 		{
-			name: "tracked version file",
+			// A marker carries the version id but is a marker, not an
+			// expirable write — it routes to the sole-survivor path.
+			name: "delete marker",
 			key:  "logs/foo.versions/v_v1",
-			ext:  map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v1")},
+			ext:  map[string][]byte{s3_constants.ExtVersionIdKey: []byte("v1"), s3_constants.ExtDeleteMarkerKey: []byte("true")},
 		},
 		{
 			name: "literal-key collision",
diff --git a/weed/s3api/s3lifecycle/scheduler/configload.go b/weed/s3api/s3lifecycle/scheduler/configload.go
index 571b87b5b9..90c6e13ab1 100644
--- a/weed/s3api/s3lifecycle/scheduler/configload.go
+++ b/weed/s3api/s3lifecycle/scheduler/configload.go
@@ -11,7 +11,18 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3lifecycle/engine"
 )
 
-const BucketLifecycleConfigurationXMLKey = "s3-bucket-lifecycle-configuration-xml"
+// The bucket lifecycle configuration lives here rather than in weed/s3api so
+// callers outside the gateway (the admin dashboard, the scheduler itself) and
+// the gateway share one definition of the extended-attribute keys and the
+// size cap. weed/s3api aliases these; nothing redeclares the values.
+const (
+	BucketLifecycleConfigurationXMLKey            = "s3-bucket-lifecycle-configuration-xml"
+	BucketLifecycleTransitionMinimumObjectSizeKey = "s3-bucket-lifecycle-transition-default-minimum-object-size"
+
+	// MaxBucketLifecycleConfigurationSize caps the serialized XML, mirroring
+	// the S3 API's limit.
+	MaxBucketLifecycleConfigurationSize = 1 << 20
+)
 
 // ParseError is returned alongside successfully-loaded inputs so callers can
 // surface malformed bucket configs rather than silently dropping them.
@@ -71,14 +82,17 @@ func LoadCompileInputs(ctx context.Context, client filer_pb.SeaweedFilerClient,
 }
 
 // IsBucketVersioned returns true when the bucket's filer entry has the
-// versioning extended attribute set to Enabled or Suspended.
+// versioning extended attribute set to Enabled or Suspended, or when
+// Object Lock is on: lock requires versioning, so the gateway writes
+// version siblings even if the versioning attribute is absent.
 func IsBucketVersioned(entry *filer_pb.Entry) bool {
-	v, ok := entry.Extended[s3_constants.ExtVersioningKey]
-	if !ok {
-		return false
+	if v, ok := entry.Extended[s3_constants.ExtVersioningKey]; ok {
+		s := strings.ToLower(strings.TrimSpace(string(v)))
+		if s == "enabled" || s == "suspended" {
+			return true
+		}
 	}
-	s := strings.ToLower(strings.TrimSpace(string(v)))
-	return s == "enabled" || s == "suspended"
+	return string(entry.Extended[s3_constants.ExtObjectLockEnabledKey]) == s3_constants.ObjectLockEnabled
 }
 
 // AllActivePriorStates seeds every compiled action as bootstrap-complete +
diff --git a/weed/s3api/s3lifecycle/scheduler/configload_test.go b/weed/s3api/s3lifecycle/scheduler/configload_test.go
index 5929ea2ba7..0512adb1a8 100644
--- a/weed/s3api/s3lifecycle/scheduler/configload_test.go
+++ b/weed/s3api/s3lifecycle/scheduler/configload_test.go
@@ -63,6 +63,18 @@ func TestIsBucketVersioned_RejectsOtherValues(t *testing.T) {
 	}
 }
 
+func TestIsBucketVersioned_ObjectLockImpliesVersioned(t *testing.T) {
+	// Object Lock requires versioning; every writer sets both attrs,
+	// but a lock flag alone must still classify as versioned so a
+	// hand-mutated or legacy entry can't hide its version siblings.
+	e := &filer_pb.Entry{Extended: map[string][]byte{
+		s3_constants.ExtObjectLockEnabledKey: []byte(s3_constants.ObjectLockEnabled),
+	}}
+	assert.True(t, IsBucketVersioned(e))
+	e.Extended[s3_constants.ExtObjectLockEnabledKey] = []byte("false")
+	assert.False(t, IsBucketVersioned(e))
+}
+
 func TestAllActivePriorStates_EmptyInputs(t *testing.T) {
 	assert.Empty(t, AllActivePriorStates(nil))
 	assert.Empty(t, AllActivePriorStates([]engine.CompileInput{}))
diff --git a/weed/s3api/s3tables/filer_ops.go b/weed/s3api/s3tables/filer_ops.go
index d3b8c69167..4ed73cbc39 100644
--- a/weed/s3api/s3tables/filer_ops.go
+++ b/weed/s3api/s3tables/filer_ops.go
@@ -1,27 +1,49 @@
 package s3tables
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 var (
 	ErrAttributeNotFound = errors.New("attribute not found")
+	ErrConcurrentUpdate  = errors.New("attribute changed concurrently")
 )
 
+// extendedAttributeUpdateAttempts bounds the read-modify-write retry loop in
+// updateExtendedAttribute.
+const extendedAttributeUpdateAttempts = 5
+
 // Filer operations - Common functions for interacting with the filer
 
 // createDirectory creates a new directory at the specified path
 func (h *S3TablesHandler) createDirectory(ctx context.Context, client filer_pb.SeaweedFilerClient, path string) error {
+	return h.createDirectoryEntry(ctx, client, path, false, nil)
+}
+
+// createDirectoryExclusive creates a directory entry together with its
+// extended attributes in one CreateEntry that fails with
+// filer_pb.ErrEntryAlreadyExists when an entry is already there: nothing is
+// replaced and no reader sees the directory without its attributes.
+func (h *S3TablesHandler) createDirectoryExclusive(ctx context.Context, client filer_pb.SeaweedFilerClient, path string, extended map[string][]byte) error {
+	return h.createDirectoryEntry(ctx, client, path, true, extended)
+}
+
+func (h *S3TablesHandler) createDirectoryEntry(ctx context.Context, client filer_pb.SeaweedFilerClient, path string, exclusive bool, extended map[string][]byte) error {
 	dir, name := splitPath(path)
 	now := time.Now().Unix()
 	return filer_pb.CreateEntry(ctx, client, &filer_pb.CreateEntryRequest{
 		Directory: dir,
+		OExcl:     exclusive,
 		Entry: &filer_pb.Entry{
 			Name:        name,
 			IsDirectory: true,
@@ -30,6 +52,7 @@ func (h *S3TablesHandler) createDirectory(ctx context.Context, client filer_pb.S
 				Crtime:   now,
 				FileMode: uint32(0755 | os.ModeDir),
 			},
+			Extended: extended,
 		},
 	})
 }
@@ -56,87 +79,166 @@ func (h *S3TablesHandler) deleteEntryIfExists(ctx context.Context, client filer_
 	return filer_pb.DoRemove(ctx, client, dir, name, true, false, true, false, nil)
 }
 
-// setExtendedAttribute sets an extended attribute on an existing entry
-func (h *S3TablesHandler) setExtendedAttribute(ctx context.Context, client filer_pb.SeaweedFilerClient, path, key string, data []byte) error {
+// mutateEntryExtended applies mutate to an entry's extended attributes and
+// writes the entry back, asserting that nothing on it changed in between.
+// UpdateEntry rewrites the whole entry from the snapshot read here, so an
+// unconditional write would delete an attribute a concurrent writer created.
+func (h *S3TablesHandler) mutateEntryExtended(
+	ctx context.Context,
+	client filer_pb.SeaweedFilerClient,
+	path string,
+	mutate func(extended map[string][]byte) error,
+) error {
 	dir, name := splitPath(path)
 
-	// First, get the existing entry
-	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
-		Directory: dir,
-		Name:      name,
-	})
-	if err != nil {
-		return err
-	}
+	for attempt := 0; attempt < extendedAttributeUpdateAttempts; attempt++ {
+		resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: dir,
+			Name:      name,
+		})
+		if err != nil {
+			return err
+		}
 
-	entry := resp.Entry
+		entry := resp.Entry
+		expected := snapshotExtended(entry.Extended)
+		if entry.Extended == nil {
+			entry.Extended = make(map[string][]byte)
+		}
+		if err := mutate(entry.Extended); err != nil {
+			return err
+		}
 
-	// Update the extended attributes
-	if entry.Extended == nil {
-		entry.Extended = make(map[string][]byte)
-	}
-	entry.Extended[key] = data
-
-	// Save the updated entry
-	return filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
-		Directory: dir,
-		Entry:     entry,
-	})
-}
-
-// removeExtendedAttributes deletes the given extended attributes from an entry,
-// leaving the directory and its children intact.
-func (h *S3TablesHandler) removeExtendedAttributes(ctx context.Context, client filer_pb.SeaweedFilerClient, path string, keys ...string) error {
-	dir, name := splitPath(path)
-
-	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
-		Directory: dir,
-		Name:      name,
-	})
-	if err != nil {
-		return err
-	}
-
-	entry := resp.Entry
-	if entry.Extended != nil {
-		for _, key := range keys {
-			delete(entry.Extended, key)
+		_, err = client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{
+			Directory:        dir,
+			Entry:            entry,
+			ExpectedExtended: expected,
+		})
+		if err == nil {
+			return nil
+		}
+		if status.Code(err) != codes.FailedPrecondition {
+			return err
 		}
 	}
 
-	return filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
-		Directory: dir,
-		Entry:     entry,
+	return fmt.Errorf("%w: %s", ErrConcurrentUpdate, path)
+}
+
+// setExtendedAttribute sets an extended attribute on an existing entry
+func (h *S3TablesHandler) setExtendedAttribute(ctx context.Context, client filer_pb.SeaweedFilerClient, path, key string, data []byte) error {
+	return h.mutateEntryExtended(ctx, client, path, func(extended map[string][]byte) error {
+		extended[key] = data
+		return nil
 	})
 }
 
 // setExtendedAttributes sets multiple extended attributes on an existing entry
 // in a single UpdateEntry, so callers don't leave the entry partially tagged.
 func (h *S3TablesHandler) setExtendedAttributes(ctx context.Context, client filer_pb.SeaweedFilerClient, path string, attrs map[string][]byte) error {
-	dir, name := splitPath(path)
-
-	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
-		Directory: dir,
-		Name:      name,
+	return h.mutateEntryExtended(ctx, client, path, func(extended map[string][]byte) error {
+		for key, data := range attrs {
+			extended[key] = data
+		}
+		return nil
 	})
-	if err != nil {
-		return err
-	}
+}
 
-	entry := resp.Entry
-	if entry.Extended == nil {
-		entry.Extended = make(map[string][]byte)
-	}
-	for key, data := range attrs {
-		entry.Extended[key] = data
-	}
-
-	return filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
-		Directory: dir,
-		Entry:     entry,
+// removeExtendedAttributes deletes the given extended attributes from an entry,
+// leaving the directory and its children intact.
+func (h *S3TablesHandler) removeExtendedAttributes(ctx context.Context, client filer_pb.SeaweedFilerClient, path string, keys ...string) error {
+	return h.mutateEntryExtended(ctx, client, path, func(extended map[string][]byte) error {
+		for _, key := range keys {
+			delete(extended, key)
+		}
+		return nil
 	})
 }
 
+// removeExtendedAttributesIf drops the given attributes only while they still
+// hold the values the caller captured. A rename copies attributes to the
+// destination and then clears the source; without this, a write that landed in
+// between is deleted here and never reaches the new name.
+func (h *S3TablesHandler) removeExtendedAttributesIf(
+	ctx context.Context,
+	client filer_pb.SeaweedFilerClient,
+	path string,
+	expected map[string][]byte,
+	keys ...string,
+) error {
+	return h.mutateEntryExtended(ctx, client, path, func(extended map[string][]byte) error {
+		for key, want := range expected {
+			if !bytes.Equal(extended[key], want) {
+				return fmt.Errorf("%w: %s changed on %s", ErrConcurrentUpdate, key, path)
+			}
+		}
+		for _, key := range keys {
+			delete(extended, key)
+		}
+		return nil
+	})
+}
+
+// updateExtendedAttribute applies mutate to the current value of key and writes
+// the result back. mutate runs again on each retry, so it always sees the
+// current value.
+func (h *S3TablesHandler) updateExtendedAttribute(
+	ctx context.Context,
+	client filer_pb.SeaweedFilerClient,
+	path, key string,
+	mutate func(current []byte) ([]byte, error),
+) error {
+	return h.mutateEntryExtended(ctx, client, path, func(extended map[string][]byte) error {
+		updated, err := mutate(extended[key])
+		if err != nil {
+			return err
+		}
+		extended[key] = updated
+		return nil
+	})
+}
+
+// s3tablesExtendedKeys is every attribute this package stores on a bucket or
+// table entry. A whole-entry write has to assert the absent ones too: a key
+// missing from the precondition is a key a concurrent writer can create and
+// this write will then delete.
+var s3tablesExtendedKeys = []string{
+	ExtendedKeyTableBucket,
+	ExtendedKeyMetadata,
+	ExtendedKeyMetadataVersion,
+	ExtendedKeyPolicy,
+	ExtendedKeyTags,
+	ExtendedKeyMaintenance,
+	ExtendedKeyMaintenanceStatus,
+	ExtendedKeyEntryType,
+}
+
+// SnapshotExtended captures an entry's attributes as an UpdateEntry
+// precondition, so a whole-entry write cannot silently revert or delete an
+// attribute a concurrent writer touched. Attributes absent at read time are
+// asserted absent, which fails the precondition if someone creates one first.
+func SnapshotExtended(extended map[string][]byte, keys ...string) map[string][]byte {
+	return snapshotExtended(extended, keys...)
+}
+
+func snapshotExtended(extended map[string][]byte, keys ...string) map[string][]byte {
+	expected := make(map[string][]byte, len(extended)+len(s3tablesExtendedKeys))
+	for k, v := range extended {
+		expected[k] = v
+	}
+	for _, k := range s3tablesExtendedKeys {
+		if _, ok := expected[k]; !ok {
+			expected[k] = nil
+		}
+	}
+	for _, k := range keys {
+		if _, ok := expected[k]; !ok {
+			expected[k] = nil
+		}
+	}
+	return expected
+}
+
 // getExtendedAttribute gets an extended attribute from an entry
 func (h *S3TablesHandler) getExtendedAttribute(ctx context.Context, client filer_pb.SeaweedFilerClient, path, key string) ([]byte, error) {
 	dir, name := splitPath(path)
@@ -160,6 +262,31 @@ func (h *S3TablesHandler) getExtendedAttribute(ctx context.Context, client filer
 	return data, nil
 }
 
+// loadNamespaceMetadata resolves a namespace to its metadata. A directory that
+// carries no namespace metadata is not a namespace, so a missing attribute
+// reports the same absence as a missing entry and every caller tests one
+// condition instead of forgetting the second.
+func (h *S3TablesHandler) loadNamespaceMetadata(ctx context.Context, filerClient FilerClient, bucketName, namespaceName string) (*namespaceMetadata, error) {
+	var metadata namespaceMetadata
+	err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		data, err := h.getExtendedAttribute(ctx, client, GetNamespacePath(bucketName, namespaceName), ExtendedKeyMetadata)
+		if err != nil {
+			if errors.Is(err, ErrAttributeNotFound) {
+				return filer_pb.ErrNotFound
+			}
+			return err
+		}
+		if err := json.Unmarshal(data, &metadata); err != nil {
+			return fmt.Errorf("failed to unmarshal namespace metadata: %w", err)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &metadata, nil
+}
+
 // lookupEntry returns the filer entry at the given path.
 func (h *S3TablesHandler) lookupEntry(ctx context.Context, client filer_pb.SeaweedFilerClient, path string) (*filer_pb.Entry, error) {
 	dir, name := splitPath(path)
@@ -175,43 +302,16 @@ func (h *S3TablesHandler) lookupEntry(ctx context.Context, client filer_pb.Seawe
 
 // deleteExtendedAttribute deletes an extended attribute from an entry
 func (h *S3TablesHandler) deleteExtendedAttribute(ctx context.Context, client filer_pb.SeaweedFilerClient, path, key string) error {
-	dir, name := splitPath(path)
-
-	// Get the existing entry
-	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
-		Directory: dir,
-		Name:      name,
-	})
-	if err != nil {
-		return err
-	}
-
-	entry := resp.Entry
-
-	// Remove the extended attribute
-	if entry.Extended != nil {
-		delete(entry.Extended, key)
-	}
-
-	// Save the updated entry
-	return filer_pb.UpdateEntry(ctx, client, &filer_pb.UpdateEntryRequest{
-		Directory: dir,
-		Entry:     entry,
+	return h.mutateEntryExtended(ctx, client, path, func(extended map[string][]byte) error {
+		delete(extended, key)
+		return nil
 	})
 }
 
 // deleteDirectory deletes a directory and all its contents
-// Note: DeleteEntry RPC response doesn't have an Error field, so we only check the RPC err
 func (h *S3TablesHandler) deleteDirectory(ctx context.Context, client filer_pb.SeaweedFilerClient, path string) error {
 	dir, name := splitPath(path)
-	_, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-		Directory:            dir,
-		Name:                 name,
-		IsDeleteData:         true,
-		IsRecursive:          true,
-		IgnoreRecursiveError: true,
-	})
-	return err
+	return filer_pb.DoRemove(ctx, client, dir, name, true, true, true, false, nil)
 }
 
 // entryExists checks if an entry exists at the given path
diff --git a/weed/s3api/s3tables/filer_ops_race_test.go b/weed/s3api/s3tables/filer_ops_race_test.go
new file mode 100644
index 0000000000..a1f6533862
--- /dev/null
+++ b/weed/s3api/s3tables/filer_ops_race_test.go
@@ -0,0 +1,89 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+)
+
+// competingCreateClient lands a foreign entry where the handler's existence
+// check just answered "not there": the create that follows must lose to it
+// rather than replace it, the way a second caller's create wins the window in
+// a check-then-create race.
+type competingCreateClient struct {
+	filer_pb.SeaweedFilerClient
+	f     *s3tablestest.MemFiler
+	dir   string
+	name  string
+	plant bool
+}
+
+func (c *competingCreateClient) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest, opts ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	resp, err := c.SeaweedFilerClient.LookupDirectoryEntry(ctx, req, opts...)
+	if c.plant && err != nil && req.Directory == c.dir && req.Name == c.name {
+		c.plant = false
+		c.f.Put(c.dir, c.name, map[string][]byte{
+			ExtendedKeyTableBucket: []byte("true"),
+			ExtendedKeyMetadata:    []byte(`{"OwnerAccountID":"competitor"}`),
+		})
+	}
+	return resp, err
+}
+
+func runHandler(t *testing.T, m *Manager, client filer_pb.SeaweedFilerClient, operation string, input interface{}) (int, S3TablesError) {
+	t.Helper()
+	body, err := json.Marshal(input)
+	require.NoError(t, err)
+	req, err := newManagerRequest(context.Background(), operation, body, "admin")
+	require.NoError(t, err)
+	recorder := httptest.NewRecorder()
+	m.handler.HandleRequest(recorder, req, NewManagerClient(client))
+	result := recorder.Result()
+	defer result.Body.Close()
+	var response S3TablesError
+	json.NewDecoder(result.Body).Decode(&response)
+	return result.StatusCode, response
+}
+
+func TestCreateTableBucketLostRaceKeepsTheFirstCreate(t *testing.T) {
+	fs := s3tablestest.Start(t)
+	m := NewManager()
+	client := &competingCreateClient{SeaweedFilerClient: fs.Client, f: fs, dir: TablesPath, name: "bucket", plant: true}
+
+	status, resp := runHandler(t, m, client, "CreateTableBucket", &CreateTableBucketRequest{Name: "bucket"})
+	assert.Equal(t, http.StatusConflict, status)
+	assert.Equal(t, ErrCodeBucketAlreadyExists, resp.Type)
+
+	survivor := fs.Get(TablesPath, "bucket")
+	require.NotNil(t, survivor)
+	assert.Equal(t, `{"OwnerAccountID":"competitor"}`, string(survivor.Extended[ExtendedKeyMetadata]))
+}
+
+func TestCreateNamespaceLostRaceKeepsTheFirstCreate(t *testing.T) {
+	fs := s3tablestest.Start(t)
+	m := NewManager()
+	bucketMetadata, _ := json.Marshal(&tableBucketMetadata{Name: "bucket", OwnerAccountID: DefaultAccountID})
+	fs.Put(TablesPath, "bucket", map[string][]byte{ExtendedKeyTableBucket: []byte("true"), ExtendedKeyMetadata: bucketMetadata})
+
+	arn, err := BuildBucketARN(DefaultRegion, DefaultAccountID, "bucket")
+	require.NoError(t, err)
+	client := &competingCreateClient{SeaweedFilerClient: fs.Client, f: fs, dir: GetTableBucketPath("bucket"), name: "ns", plant: true}
+	status, resp := runHandler(t, m, client, "CreateNamespace", &CreateNamespaceRequest{
+		TableBucketARN: arn,
+		Namespace:      []string{"ns"},
+	})
+	assert.Equal(t, http.StatusConflict, status)
+	assert.Equal(t, ErrCodeNamespaceAlreadyExists, resp.Type)
+
+	survivor := fs.Get(GetTableBucketPath("bucket"), "ns")
+	require.NotNil(t, survivor)
+	assert.Equal(t, `{"OwnerAccountID":"competitor"}`, string(survivor.Extended[ExtendedKeyMetadata]))
+}
diff --git a/weed/s3api/s3tables/filer_ops_test.go b/weed/s3api/s3tables/filer_ops_test.go
new file mode 100644
index 0000000000..22f3e0c8f2
--- /dev/null
+++ b/weed/s3api/s3tables/filer_ops_test.go
@@ -0,0 +1,102 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// deleteEntryStub answers DeleteEntry the way the filer does: a rejected delete
+// comes back as a nil transport error with the reason in the response.
+type deleteEntryStub struct {
+	filer_pb.SeaweedFilerClient
+	resp *filer_pb.DeleteEntryResponse
+	err  error
+	req  *filer_pb.DeleteEntryRequest
+}
+
+func (s *deleteEntryStub) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest, _ ...grpc.CallOption) (*filer_pb.DeleteEntryResponse, error) {
+	s.req = req
+	return s.resp, s.err
+}
+
+func TestDeleteDirectoryReportsRejectedDelete(t *testing.T) {
+	stub := &deleteEntryStub{resp: &filer_pb.DeleteEntryResponse{Error: "fail to delete non-empty folder"}}
+
+	err := (&S3TablesHandler{}).deleteDirectory(context.Background(), stub, "/buckets/b/ns/t")
+
+	require.Error(t, err, "a delete the filer rejected must not be reported as success")
+	assert.Contains(t, err.Error(), "fail to delete non-empty folder")
+}
+
+func TestDeleteDirectoryToleratesMissingEntry(t *testing.T) {
+	t.Run("reported in the response", func(t *testing.T) {
+		stub := &deleteEntryStub{resp: &filer_pb.DeleteEntryResponse{Error: filer_pb.ErrNotFound.Error()}}
+		assert.NoError(t, (&S3TablesHandler{}).deleteDirectory(context.Background(), stub, "/buckets/b/ns/t"))
+	})
+	t.Run("reported as a transport error", func(t *testing.T) {
+		stub := &deleteEntryStub{err: status.Error(codes.NotFound, filer_pb.ErrNotFound.Error())}
+		assert.NoError(t, (&S3TablesHandler{}).deleteDirectory(context.Background(), stub, "/buckets/b/ns/t"))
+	})
+}
+
+func TestDeleteDirectoryPropagatesTransportError(t *testing.T) {
+	stub := &deleteEntryStub{err: errors.New("filer unreachable")}
+
+	err := (&S3TablesHandler{}).deleteDirectory(context.Background(), stub, "/buckets/b/ns/t")
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "filer unreachable")
+}
+
+// deleteDirectory drops a whole subtree, so the delete has to stay recursive and
+// take the data with it.
+func TestDeleteDirectoryDeletesTheSubtree(t *testing.T) {
+	stub := &deleteEntryStub{resp: &filer_pb.DeleteEntryResponse{}}
+
+	require.NoError(t, (&S3TablesHandler{}).deleteDirectory(context.Background(), stub, "/buckets/b/ns/t"))
+
+	require.NotNil(t, stub.req)
+	assert.Equal(t, "/buckets/b/ns", stub.req.Directory)
+	assert.Equal(t, "t", stub.req.Name)
+	assert.True(t, stub.req.IsDeleteData)
+	assert.True(t, stub.req.IsRecursive)
+	assert.True(t, stub.req.IgnoreRecursiveError)
+}
+
+// The bucket is the directory, so DeleteTableBucket must not answer success
+// when the filer refused to remove it.
+func TestDeleteTableBucketReportsRejectedDirectoryDelete(t *testing.T) {
+	fs := s3tablestest.Start(t)
+	bucketMeta, err := json.Marshal(tableBucketMetadata{Name: renameTestBucket, OwnerAccountID: DefaultAccountID})
+	require.NoError(t, err)
+	fs.Put(TablesPath, renameTestBucket, map[string][]byte{
+		ExtendedKeyTableBucket: []byte("{}"),
+		ExtendedKeyMetadata:    bucketMeta,
+	})
+
+	bucketPath := GetTableBucketPath(renameTestBucket)
+	fs.RejectDelete = func(dir, name string) string {
+		if dir+"/"+name == bucketPath {
+			return "fail to delete non-empty folder"
+		}
+		return ""
+	}
+
+	m := NewManager()
+	m.SetTrusted(true)
+	err = m.Execute(context.Background(), NewManagerClient(fs.Client), "DeleteTableBucket",
+		&DeleteTableBucketRequest{TableBucketARN: mustBucketARN(t)}, nil, "")
+
+	require.Error(t, err, "a bucket the filer refused to delete must not be reported as deleted")
+	assert.NotNil(t, fs.Get(TablesPath, renameTestBucket), "the bucket is still there")
+}
diff --git a/weed/s3api/s3tables/handler.go b/weed/s3api/s3tables/handler.go
index 6013a20b56..4bf960ca4f 100644
--- a/weed/s3api/s3tables/handler.go
+++ b/weed/s3api/s3tables/handler.go
@@ -21,12 +21,17 @@ const (
 	DefaultRegion    = "us-east-1"
 
 	// Extended entry attributes for metadata storage
-	ExtendedKeyTableBucket     = "s3tables.tableBucket"
-	ExtendedKeyMetadata        = "s3tables.metadata"
-	ExtendedKeyMetadataVersion = "s3tables.metadataVersion"
-	ExtendedKeyPolicy          = "s3tables.policy"
-	ExtendedKeyTags            = "s3tables.tags"
-	ExtendedKeyEntryType       = "s3tables.entryType"
+	ExtendedKeyTableBucket     = s3_constants.ExtS3TablesPrefix + "tableBucket"
+	ExtendedKeyMetadata        = s3_constants.ExtS3TablesPrefix + "metadata"
+	ExtendedKeyMetadataVersion = s3_constants.ExtS3TablesPrefix + "metadataVersion"
+	ExtendedKeyPolicy          = s3_constants.ExtS3TablesPrefix + "policy"
+	ExtendedKeyTags            = s3_constants.ExtS3TablesPrefix + "tags"
+	ExtendedKeyMaintenance     = s3_constants.ExtS3TablesPrefix + "maintenance"
+	// Written by the maintenance worker, read by GetTableMaintenanceJobStatus.
+	// Separate from ExtendedKeyMaintenance so worker and operator writes do not
+	// contend on the same attribute.
+	ExtendedKeyMaintenanceStatus = s3_constants.ExtS3TablesPrefix + "maintenanceStatus"
+	ExtendedKeyEntryType         = s3_constants.ExtS3TablesPrefix + "entryType"
 
 	// Entry-type marker values for ExtendedKeyEntryType. Absent or "table" means
 	// a table; views are stored like tables but tagged "view".
@@ -52,11 +57,12 @@ const (
 
 // S3TablesHandler handles S3 Tables API requests
 type S3TablesHandler struct {
-	region        string
-	accountID     string
-	defaultAllow  bool // Whether to allow access by default (for zero-config IAM)
-	trusted       bool // Trusted local tooling (shell/admin) bypasses authorization
-	iamAuthorizer IAMAuthorizer
+	region          string
+	accountID       string
+	defaultAllow    bool // Whether to allow access by default (for zero-config IAM)
+	trusted         bool // Trusted local tooling (shell/admin) bypasses authorization
+	iamAuthorizer   IAMAuthorizer
+	localAccountIDs func(string) bool
 }
 
 // NewS3TablesHandler creates a new S3 Tables handler
@@ -93,6 +99,13 @@ func (h *S3TablesHandler) SetTrusted(trusted bool) {
 	h.trusted = trusted
 }
 
+// SetLocalAccountChecker injects the predicate that recognizes account IDs of
+// configured local identities, so a stored owner that names one is never
+// re-anchored to an OIDC subject.
+func (h *S3TablesHandler) SetLocalAccountChecker(fn func(string) bool) {
+	h.localAccountIDs = fn
+}
+
 // FilerClient interface for filer operations
 type FilerClient interface {
 	WithFilerClient(streamingMode bool, fn func(client filer_pb.SeaweedFilerClient) error) error
@@ -114,6 +127,10 @@ func (h *S3TablesHandler) HandleRequest(w http.ResponseWriter, r *http.Request,
 
 	glog.V(3).Infof("S3Tables: handling operation %s", operation)
 
+	// the status the handler answers decides how its error is logged (logRequestError)
+	sw := &statusRecorder{ResponseWriter: w}
+	w = sw
+
 	var err error
 	switch operation {
 	// Table Bucket operations
@@ -173,6 +190,8 @@ func (h *S3TablesHandler) HandleRequest(w http.ResponseWriter, r *http.Request,
 		err = h.handleUpdateView(w, r, filerClient)
 	case "DeleteView":
 		err = h.handleDeleteView(w, r, filerClient)
+	case "RenameView":
+		err = h.handleRenameView(w, r, filerClient)
 
 	// Table Policy operations
 	case "PutTablePolicy":
@@ -182,6 +201,18 @@ func (h *S3TablesHandler) HandleRequest(w http.ResponseWriter, r *http.Request,
 	case "DeleteTablePolicy":
 		err = h.handleDeleteTablePolicy(w, r, filerClient)
 
+	// Maintenance configuration operations
+	case "PutTableBucketMaintenanceConfiguration":
+		err = h.handlePutTableBucketMaintenanceConfiguration(w, r, filerClient)
+	case "GetTableBucketMaintenanceConfiguration":
+		err = h.handleGetTableBucketMaintenanceConfiguration(w, r, filerClient)
+	case "PutTableMaintenanceConfiguration":
+		err = h.handlePutTableMaintenanceConfiguration(w, r, filerClient)
+	case "GetTableMaintenanceConfiguration":
+		err = h.handleGetTableMaintenanceConfiguration(w, r, filerClient)
+	case "GetTableMaintenanceJobStatus":
+		err = h.handleGetTableMaintenanceJobStatus(w, r, filerClient)
+
 	// Tagging operations
 	case "TagResource":
 		err = h.handleTagResource(w, r, filerClient)
@@ -196,10 +227,51 @@ func (h *S3TablesHandler) HandleRequest(w http.ResponseWriter, r *http.Request,
 	}
 
 	if err != nil {
-		glog.Errorf("S3Tables: error handling %s: %v", operation, err)
+		logRequestError(operation, sw.status, err)
 	}
 }
 
+// A refusal the handler answered with a 4xx (access denied, not authorized,
+// not found, already exists, not empty) is the API working as intended, not a
+// server fault; it is logged at V(1). A 5xx, or an error returned without any
+// status written, stays at ERROR.
+var (
+	logClientRefusal = func(format string, args ...interface{}) { glog.V(1).Infof(format, args...) }
+	logServerError   = glog.Errorf
+)
+
+func logRequestError(operation string, status int, err error) {
+	if status >= 400 && status < 500 {
+		logClientRefusal("S3Tables: %s refused (%d): %v", operation, status, err)
+		return
+	}
+	logServerError("S3Tables: error handling %s: %v", operation, err)
+}
+
+// statusRecorder remembers the first status written through it.
+type statusRecorder struct {
+	http.ResponseWriter
+	status int
+}
+
+func (s *statusRecorder) WriteHeader(code int) {
+	if s.status == 0 {
+		s.status = code
+	}
+	s.ResponseWriter.WriteHeader(code)
+}
+
+func (s *statusRecorder) Write(b []byte) (int, error) {
+	if s.status == 0 {
+		s.status = http.StatusOK
+	}
+	return s.ResponseWriter.Write(b)
+}
+
+// Unwrap lets http.NewResponseController reach the underlying writer, so it
+// flushes (or reports ErrNotSupported) exactly as that writer does.
+func (s *statusRecorder) Unwrap() http.ResponseWriter { return s.ResponseWriter }
+
 // Principal/authorization helpers
 
 // getAccountID returns a stable caller identifier for ownership and permission checks.
@@ -219,20 +291,12 @@ func (h *S3TablesHandler) getAccountID(r *http.Request) string {
 			// Prefer stable claims from JWT/STS identities. Only "sub" is guaranteed durable per OIDC;
 			// preferred_username is ergonomic but can rotate and may orphan ownership data, while email
 			// is explicitly excluded to avoid storing PII in metadata.
-			claimsField := val.FieldByName("Claims")
-			if claimsField.IsValid() && claimsField.Kind() == reflect.Map && !claimsField.IsNil() && claimsField.Type().Key().Kind() == reflect.String {
-				for _, claimKey := range []string{"sub", "preferred_username"} {
-					claimVal := claimsField.MapIndex(reflect.ValueOf(claimKey))
-					if !claimVal.IsValid() {
-						continue
-					}
-					if claimVal.Kind() == reflect.Interface && !claimVal.IsNil() {
-						claimVal = claimVal.Elem()
-					}
-					if claimVal.Kind() == reflect.String {
-						if principal := normalizePrincipalID(claimVal.String()); principal != "" {
-							return principal
-						}
+			if claims := identityClaimsMap(val); claims != nil {
+				// aws:userid is the issuer-namespaced (sub, iss) hash; a bare
+				// sub or preferred_username collides across providers.
+				for _, claimKey := range []string{"aws:userid", "sub", "preferred_username"} {
+					if principal := normalizePrincipalID(claimString(claims, claimKey)); principal != "" {
+						return principal
 					}
 				}
 			}
@@ -264,12 +328,54 @@ func (h *S3TablesHandler) getAccountID(r *http.Request) string {
 
 	if accountID := r.Header.Get(s3_constants.AmzAccountId); accountID != "" {
 		if principal := normalizePrincipalID(accountID); principal != "" {
-			return principal
+			if principal != s3_constants.AccountAdminId || hasAdminAction(getIdentityActions(r)) {
+				return principal
+			}
 		}
 	}
 	return h.accountID
 }
 
+// identityClaimsMap extracts the Claims map from an identity value, using
+// reflection to avoid an import cycle with the s3api identity type.
+func identityClaimsMap(val reflect.Value) map[string]interface{} {
+	claimsField := val.FieldByName("Claims")
+	if !claimsField.IsValid() || claimsField.Kind() != reflect.Map || claimsField.IsNil() || claimsField.Type().Key().Kind() != reflect.String {
+		return nil
+	}
+	claims, ok := claimsField.Interface().(map[string]interface{})
+	if !ok {
+		return nil
+	}
+	return claims
+}
+
+func claimString(claims map[string]interface{}, key string) string {
+	v, ok := claims[key]
+	if !ok || v == nil {
+		return ""
+	}
+	str, _ := v.(string)
+	return str
+}
+
+// trustedIssuers returns the OIDC issuers the auth layer asserted into the
+// identity's claims; they re-anchor legacy owner checks in checkPermission.
+func (h *S3TablesHandler) trustedIssuers(r *http.Request) []string {
+	identityRaw := s3_constants.GetIdentityFromContext(r)
+	if identityRaw == nil {
+		return nil
+	}
+	val := reflect.ValueOf(identityRaw)
+	if val.Kind() == reflect.Ptr {
+		val = val.Elem()
+	}
+	if val.Kind() != reflect.Struct {
+		return nil
+	}
+	return strings.Fields(claimString(identityClaimsMap(val), "seaweed:oidc-issuers"))
+}
+
 // normalizePrincipalID collapses ARN and identity strings to a key that is stable within a single account.
 // WARNING: this assumes identity names are unique per account; distinct principals such as
 // arn:aws:iam::111:user/alice and arn:aws:iam::222:user/alice will both normalize to "alice".
@@ -377,15 +483,20 @@ func (h *S3TablesHandler) writeError(w http.ResponseWriter, status int, code, me
 // ARN generation helpers
 
 func (h *S3TablesHandler) generateTableBucketARN(ownerAccountID, bucketName string) string {
-	return fmt.Sprintf("arn:aws:s3tables:%s:%s:bucket/%s", h.region, ownerAccountID, bucketName)
+	return buildARN(h.region, ownerAccountID, fmt.Sprintf("bucket/%s", bucketName))
 }
 
 func (h *S3TablesHandler) generateTableARN(ownerAccountID, bucketName, tableID string) string {
-	return fmt.Sprintf("arn:aws:s3tables:%s:%s:bucket/%s/table/%s", h.region, ownerAccountID, bucketName, tableID)
+	return buildARN(h.region, ownerAccountID, fmt.Sprintf("bucket/%s/table/%s", bucketName, tableID))
 }
 
 func (h *S3TablesHandler) generateViewARN(ownerAccountID, bucketName, viewID string) string {
-	return fmt.Sprintf("arn:aws:s3tables:%s:%s:bucket/%s/view/%s", h.region, ownerAccountID, bucketName, viewID)
+	return buildARN(h.region, ownerAccountID, fmt.Sprintf("bucket/%s/view/%s", bucketName, viewID))
+}
+
+// generateS3BucketARN builds the plain S3 ARN used for IAM resource matching.
+func (h *S3TablesHandler) generateS3BucketARN(bucketName string) string {
+	return fmt.Sprintf("arn:%s:s3:::%s", arnPartitionForRegion(h.region), bucketName)
 }
 
 func isAuthError(err error) bool {
@@ -393,6 +504,70 @@ func isAuthError(err error) bool {
 	return errors.As(err, &authErr) || errors.Is(err, ErrAccessDenied)
 }
 
+// authorizeAbsentTarget reports whether the caller may learn the target
+// resolved to nothing, so a caller without a grant gets the same response a
+// denied existing target would give. The bucket named by the target still
+// applies whatever metadata and policy load; with nothing readable to
+// evaluate, only an identity-level grant on the operation, the admin, or a
+// default-allow deployment passes.
+func (h *S3TablesHandler) authorizeAbsentTarget(r *http.Request, filerClient FilerClient, operation, bucketName, namespace, name, resourceARN string) bool {
+	principal := h.getAccountID(r)
+	if principal == "" {
+		return false
+	}
+
+	var bucketOwner, bucketPolicy string
+	var bucketTags map[string]string
+	if bucketName != "" {
+		bucketPath := GetTableBucketPath(bucketName)
+		_ = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+			if data, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata); err == nil {
+				var meta tableBucketMetadata
+				if json.Unmarshal(data, &meta) == nil {
+					bucketOwner = meta.OwnerAccountID
+				}
+			}
+			if policy, err := h.readPolicy(r, client, bucketPath); err == nil {
+				bucketPolicy = policy
+			}
+			bucketTags, _ = h.readTags(r.Context(), client, bucketPath)
+			return nil
+		})
+	}
+
+	bucketARN := h.generateTableBucketARN(bucketOwner, bucketName)
+	// Judge the target by the canonical ARN the surviving bucket resolves to:
+	// the request ARN's account and region are the caller's to choose and must
+	// not decide whether a policy Deny applies.
+	canonicalARN := resourceARN
+	if bucketOwner != "" {
+		if name != "" {
+			canonicalARN = h.generateTableARN(bucketOwner, bucketName, namespace+"/"+name)
+		} else {
+			canonicalARN = bucketARN
+		}
+	}
+	ctx := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespace,
+		TableName:        name,
+		TableBucketTags:  bucketTags,
+		IdentityActions:  getIdentityActions(r),
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	if resourceARN != "" &&
+		matchesDenyStatement(operation, principal, bucketPolicy, canonicalARN, ctx) {
+		return false
+	}
+	if CheckTableOrBucketPermission(operation, principal, "", "", canonicalARN,
+		bucketOwner, bucketPolicy, bucketARN, ctx) {
+		return true
+	}
+	return bucketOwner == "" && checkPermission(operation, principal, "", "", resourceARN, ctx)
+}
+
 func (h *S3TablesHandler) readTags(ctx context.Context, client filer_pb.SeaweedFilerClient, path string) (map[string]string, error) {
 	data, err := h.getExtendedAttribute(ctx, client, path, ExtendedKeyTags)
 	if err != nil {
diff --git a/weed/s3api/s3tables/handler_bucket_create.go b/weed/s3api/s3tables/handler_bucket_create.go
index 37d692780b..3ecd0f83d1 100644
--- a/weed/s3api/s3tables/handler_bucket_create.go
+++ b/weed/s3api/s3tables/handler_bucket_create.go
@@ -26,13 +26,26 @@ func (h *S3TablesHandler) handleCreateTableBucket(w http.ResponseWriter, r *http
 		return err
 	}
 
+	// A bucket is a catalog, and a catalog serves one protocol. Saying which one
+	// at creation is what lets everything downstream - the endpoint the UI
+	// shows, the tables the bucket accepts - be answered without opening a table.
+	bucketFormat := FormatIceberg
+	if req.Format != "" {
+		normalized, ok := NormalizeFormat(req.Format)
+		if !ok {
+			h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, fmt.Sprintf("unsupported format %q", req.Format))
+			return fmt.Errorf("invalid format")
+		}
+		bucketFormat = normalized
+	}
+
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	identityPolicyNames := getIdentityPolicyNames(r)
 	useIAM := h.shouldUseIAM(r, identityActions, identityPolicyNames)
 	useLegacy := !useIAM
 	if useIAM {
-		allowed, err := h.authorizeIAMAction(r, identityPolicyNames, "CreateTableBucket", h.generateTableBucketARN(principal, req.Name), fmt.Sprintf("arn:aws:s3:::%s", req.Name))
+		allowed, err := h.authorizeIAMAction(r, identityPolicyNames, "CreateTableBucket", h.generateTableBucketARN(principal, req.Name), h.generateS3BucketARN(req.Name))
 		if err != nil {
 			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create table buckets")
 			return NewAuthError("CreateTableBucket", principal, "not authorized to create table buckets")
@@ -52,8 +65,10 @@ func (h *S3TablesHandler) handleCreateTableBucket(w http.ResponseWriter, r *http
 			owner = DefaultAccountID
 		}
 		if !CheckPermissionWithContext("CreateTableBucket", principal, owner, "", "", &PolicyContext{
-			IdentityActions: identityActions,
-			DefaultAllow:    h.defaultAllowFor(r),
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
 		}) {
 			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create table buckets")
 			return NewAuthError("CreateTableBucket", principal, "not authorized to create table buckets")
@@ -115,6 +130,7 @@ func (h *S3TablesHandler) handleCreateTableBucket(w http.ResponseWriter, r *http
 		Name:           req.Name,
 		CreatedAt:      now,
 		OwnerAccountID: principal,
+		Format:         bucketFormat,
 	}
 
 	metadataBytes, err := json.Marshal(metadata)
@@ -124,6 +140,7 @@ func (h *S3TablesHandler) handleCreateTableBucket(w http.ResponseWriter, r *http
 		return err
 	}
 
+	var taken error
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		// Ensure root tables directory exists
 		if !h.entryExists(r.Context(), client, TablesPath) {
@@ -132,35 +149,35 @@ func (h *S3TablesHandler) handleCreateTableBucket(w http.ResponseWriter, r *http
 			}
 		}
 
-		// Create bucket directory
-		if err := h.createDirectory(r.Context(), client, bucketPath); err != nil {
-			return err
+		extended := map[string][]byte{
+			ExtendedKeyTableBucket: []byte("true"),
+			ExtendedKeyMetadata:    metadataBytes,
 		}
-
-		// Mark as a table bucket
-		if err := h.setExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyTableBucket, []byte("true")); err != nil {
-			return err
-		}
-
-		// Set metadata as extended attribute
-		if err := h.setExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata, metadataBytes); err != nil {
-			return err
-		}
-
-		// Set tags if provided
 		if len(req.Tags) > 0 {
 			tagsBytes, err := json.Marshal(req.Tags)
 			if err != nil {
 				return fmt.Errorf("failed to marshal tags: %w", err)
 			}
-			if err := h.setExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyTags, tagsBytes); err != nil {
-				return err
+			extended[ExtendedKeyTags] = tagsBytes
+		}
+		if err := h.createDirectoryExclusive(r.Context(), client, bucketPath, extended); err != nil {
+			if errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+				taken = err // an answer, not a filer failure
+				return nil
 			}
+			return err
 		}
 
 		return nil
 	})
+	if err == nil && taken != nil {
+		err = taken
+	}
 
+	if errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+		h.writeError(w, http.StatusConflict, ErrCodeBucketAlreadyExists, fmt.Sprintf("table bucket %s already exists", req.Name))
+		return err
+	}
 	if err != nil {
 		glog.Errorf("S3Tables: failed to create table bucket %s: %v", req.Name, err)
 		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to create table bucket")
diff --git a/weed/s3api/s3tables/handler_bucket_format_test.go b/weed/s3api/s3tables/handler_bucket_format_test.go
new file mode 100644
index 0000000000..b024314a76
--- /dev/null
+++ b/weed/s3api/s3tables/handler_bucket_format_test.go
@@ -0,0 +1,109 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+
+	"github.com/stretchr/testify/require"
+)
+
+const formatTestBucket = "formats"
+
+// bucketWithFormat lays down a table bucket holding one namespace, declared as
+// the given format. An empty format is a bucket from before the declaration
+// existed.
+func bucketWithFormat(t *testing.T, format string) (*s3tablestest.MemFiler, *Manager) {
+	t.Helper()
+	fs := s3tablestest.Start(t)
+	m := NewManager()
+
+	bucketMeta, _ := json.Marshal(tableBucketMetadata{
+		Name:           formatTestBucket,
+		OwnerAccountID: DefaultAccountID,
+		Format:         format,
+	})
+	fs.Put(TablesPath, formatTestBucket, map[string][]byte{
+		ExtendedKeyTableBucket: []byte("{}"),
+		ExtendedKeyMetadata:    bucketMeta,
+	})
+
+	nsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"ns"}, OwnerAccountID: DefaultAccountID})
+	fs.Put(GetTableBucketPath(formatTestBucket), "ns", map[string][]byte{ExtendedKeyMetadata: nsMeta})
+
+	return fs, m
+}
+
+func createTableOfFormat(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, name, format string) error {
+	t.Helper()
+	return m.Execute(context.Background(), NewManagerClient(fs.Client), "CreateTable", &CreateTableRequest{
+		TableBucketARN: "arn:aws:s3tables:::bucket/" + formatTestBucket,
+		Namespace:      []string{"ns"},
+		Name:           name,
+		Format:         format,
+	}, nil, "")
+}
+
+// The declaration is the point: a bucket that says it holds Lance cannot be
+// handed an Iceberg table, because the catalog serving it would never show one.
+func TestCreateTableRefusesAForeignFormat(t *testing.T) {
+	fs, m := bucketWithFormat(t, FormatLance)
+
+	require.NoError(t, createTableOfFormat(t, m, fs, "vectors", FormatLance))
+
+	err := createTableOfFormat(t, m, fs, "events", FormatIceberg)
+	require.Error(t, err, "an Iceberg table in a Lance bucket should be refused")
+	require.Contains(t, err.Error(), "holds LANCE")
+}
+
+func TestCreateTableRefusesLanceInAnIcebergBucket(t *testing.T) {
+	fs, m := bucketWithFormat(t, FormatIceberg)
+
+	err := createTableOfFormat(t, m, fs, "vectors", FormatLance)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "holds ICEBERG")
+}
+
+// A bucket made before formats were declared keeps taking anything. Nothing is
+// migrated, so nothing that worked stops working.
+func TestUndeclaredBucketAcceptsEitherFormat(t *testing.T) {
+	fs, m := bucketWithFormat(t, "")
+
+	require.NoError(t, createTableOfFormat(t, m, fs, "events", FormatIceberg))
+	require.NoError(t, createTableOfFormat(t, m, fs, "vectors", FormatLance))
+}
+
+// A view is Iceberg metadata, so it has no meaning in a bucket of another format.
+func TestCreateViewRefusedInALanceBucket(t *testing.T) {
+	fs, m := bucketWithFormat(t, FormatLance)
+
+	err := m.Execute(context.Background(), NewManagerClient(fs.Client), "CreateView", &CreateViewRequest{
+		TableBucketARN: "arn:aws:s3tables:::bucket/" + formatTestBucket,
+		Namespace:      []string{"ns"},
+		Name:           "v",
+	}, nil, "")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "cannot hold views")
+}
+
+func TestNormalizeFormat(t *testing.T) {
+	cases := []struct {
+		in   string
+		want string
+		ok   bool
+	}{
+		{"ICEBERG", FormatIceberg, true},
+		{"iceberg", FormatIceberg, true},
+		{" Lance ", FormatLance, true},
+		{"delta", "", false},
+		{"", "", false},
+	}
+	for _, c := range cases {
+		got, ok := NormalizeFormat(c.in)
+		if got != c.want || ok != c.ok {
+			t.Errorf("NormalizeFormat(%q) = %q,%v; want %q,%v", c.in, got, ok, c.want, c.ok)
+		}
+	}
+}
diff --git a/weed/s3api/s3tables/handler_bucket_get_list_delete.go b/weed/s3api/s3tables/handler_bucket_get_list_delete.go
index 18be86bf96..1645194ca5 100644
--- a/weed/s3api/s3tables/handler_bucket_get_list_delete.go
+++ b/weed/s3api/s3tables/handler_bucket_get_list_delete.go
@@ -58,7 +58,7 @@ func (h *S3TablesHandler) handleGetTableBucket(w http.ResponseWriter, r *http.Re
 	})
 
 	if err != nil {
-		if errors.Is(err, filer_pb.ErrNotFound) {
+		if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrAttributeNotFound) {
 			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
 		} else {
 			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to get table bucket: %v", err))
@@ -70,11 +70,13 @@ func (h *S3TablesHandler) handleGetTableBucket(w http.ResponseWriter, r *http.Re
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	if !CheckPermissionWithContext("GetTableBucket", principal, metadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to get table bucket details")
+		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
 		return ErrAccessDenied
 	}
 
@@ -83,6 +85,7 @@ func (h *S3TablesHandler) handleGetTableBucket(w http.ResponseWriter, r *http.Re
 		Name:           metadata.Name,
 		OwnerAccountID: metadata.OwnerAccountID,
 		CreatedAt:      metadata.CreatedAt,
+		Format:         metadata.Format,
 	}
 
 	h.writeJSON(w, http.StatusOK, resp)
@@ -191,9 +194,11 @@ func (h *S3TablesHandler) handleListTableBuckets(w http.ResponseWriter, r *http.
 				bucketARN := h.generateTableBucketARN(metadata.OwnerAccountID, entry.Entry.Name)
 				identityActions := getIdentityActions(r)
 				if !CheckPermissionWithContext("GetTableBucket", accountID, metadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-					TableBucketName: entry.Entry.Name,
-					IdentityActions: identityActions,
-					DefaultAllow:    h.defaultAllowFor(r),
+					TrustedIssuers:   h.trustedIssuers(r),
+					IsLocalAccountID: h.localAccountIDs,
+					TableBucketName:  entry.Entry.Name,
+					IdentityActions:  identityActions,
+					DefaultAllow:     h.defaultAllowFor(r),
 				}) {
 					continue
 				}
@@ -202,6 +207,7 @@ func (h *S3TablesHandler) handleListTableBuckets(w http.ResponseWriter, r *http.
 					ARN:       bucketARN,
 					Name:      entry.Entry.Name,
 					CreatedAt: metadata.CreatedAt,
+					Format:    metadata.Format,
 				})
 
 				if len(buckets) >= maxBuckets {
@@ -294,9 +300,11 @@ func (h *S3TablesHandler) handleDeleteTableBucket(w http.ResponseWriter, r *http
 		principal := h.getAccountID(r)
 		identityActions := getIdentityActions(r)
 		if !CheckPermissionWithContext("DeleteTableBucket", principal, metadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-			TableBucketName: bucketName,
-			IdentityActions: identityActions,
-			DefaultAllow:    h.defaultAllowFor(r),
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
 		}) {
 			return NewAuthError("DeleteTableBucket", principal, fmt.Sprintf("not authorized to delete bucket %s", bucketName))
 		}
@@ -331,7 +339,7 @@ func (h *S3TablesHandler) handleDeleteTableBucket(w http.ResponseWriter, r *http
 		if errors.Is(err, filer_pb.ErrNotFound) {
 			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
 		} else if isAuthError(err) {
-			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, err.Error())
+			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
 		} else {
 			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to delete table bucket: %v", err))
 		}
@@ -345,22 +353,13 @@ func (h *S3TablesHandler) handleDeleteTableBucket(w http.ResponseWriter, r *http
 
 	// Delete the bucket
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		// Delete table object entry first, then directory
-		// This ensures we clean up the leaf entry even if directory deletion fails
-		tableObjErr := h.deleteEntryIfExists(r.Context(), client, GetTableObjectBucketPath(bucketName))
-		dirErr := h.deleteDirectory(r.Context(), client, bucketPath)
-
-		// Log any errors but don't fail if one succeeds
-		if tableObjErr != nil && dirErr != nil {
-			return fmt.Errorf("delete table object failed: %w, delete directory failed: %w", tableObjErr, dirErr)
-		}
-		if tableObjErr != nil {
+		// Drop the leaf entry first, so it does not outlive the directory.
+		if tableObjErr := h.deleteEntryIfExists(r.Context(), client, GetTableObjectBucketPath(bucketName)); tableObjErr != nil {
 			glog.V(1).Infof("failed to delete table object for %s: %v", bucketName, tableObjErr)
 		}
-		if dirErr != nil {
-			glog.V(1).Infof("failed to delete table bucket dir for %s: %v", bucketName, dirErr)
-		}
-		return nil
+		// The bucket is the directory, so a refused delete leaves it in place
+		// and the caller must hear about it.
+		return h.deleteDirectory(r.Context(), client, bucketPath)
 	})
 
 	if err != nil {
diff --git a/weed/s3api/s3tables/handler_delete_decouple_test.go b/weed/s3api/s3tables/handler_delete_decouple_test.go
index 966d9b12e0..f574caf63f 100644
--- a/weed/s3api/s3tables/handler_delete_decouple_test.go
+++ b/weed/s3api/s3tables/handler_delete_decouple_test.go
@@ -3,15 +3,18 @@ package s3tables
 import (
 	"context"
 	"encoding/json"
+	"path"
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-func runDeleteTable(t *testing.T, m *Manager, fs *memFilerServer, namespace, name string) error {
+func runDeleteTable(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, namespace, name string) error {
 	t.Helper()
-	return m.Execute(context.Background(), NewManagerClient(fs.client), "DeleteTable", &DeleteTableRequest{
+	return m.Execute(context.Background(), NewManagerClient(fs.Client), "DeleteTable", &DeleteTableRequest{
 		TableBucketARN: mustBucketARN(t),
 		Namespace:      []string{namespace},
 		Name:           name,
@@ -33,24 +36,24 @@ func TestDeleteTableDecoupledKeepsReusedNamePath(t *testing.T) {
 		MetadataLocation: "s3://" + renameTestBucket + "/ns/newt-x/metadata/v1.metadata.json",
 	})
 	markerKeys := []string{ExtendedKeyMetadata, ExtendedKeyMetadataVersion, ExtendedKeyPolicy, ExtendedKeyTags, ExtendedKeyEntryType}
-	fs.putEntry(GetNamespacePath(renameTestBucket, "ns"), "newt", map[string][]byte{
+	fs.Put(GetNamespacePath(renameTestBucket, "ns"), "newt", map[string][]byte{
 		ExtendedKeyMetadata:        newtMeta,
 		ExtendedKeyMetadataVersion: []byte("v1"),
 		ExtendedKeyPolicy:          []byte(`{"Version":"2012-10-17"}`),
 		ExtendedKeyTags:            []byte(`{"k":"v"}`),
 		ExtendedKeyEntryType:       []byte(EntryTypeTable),
 	})
-	fs.putEntry(GetTablePath(renameTestBucket, "ns", "newt"), "leftover", nil) // another table's data under the name path
-	fs.putEntry(GetNamespacePath(renameTestBucket, "ns"), "newt-x", nil)       // this table's own (decoupled) data
-	fs.putEntry(GetTablePath(renameTestBucket, "ns", "newt-x"), "metadata", nil)
+	fs.Put(GetTablePath(renameTestBucket, "ns", "newt"), "leftover", nil) // another table's data under the name path
+	fs.Put(GetNamespacePath(renameTestBucket, "ns"), "newt-x", nil)       // this table's own (decoupled) data
+	fs.Put(GetTablePath(renameTestBucket, "ns", "newt-x"), "metadata", nil)
 
 	require.NoError(t, runDeleteTable(t, m, fs, "ns", "newt"))
 
-	assert.Nil(t, fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "newt-x"),
+	assert.Nil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "newt-x"),
 		"the table's own data location must be purged")
-	assert.NotNil(t, fs.getEntry(GetTablePath(renameTestBucket, "ns", "newt"), "leftover"),
+	assert.NotNil(t, fs.Get(GetTablePath(renameTestBucket, "ns", "newt"), "leftover"),
 		"data under the reused name path must survive")
-	marker := fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "newt")
+	marker := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "newt")
 	require.NotNil(t, marker)
 	for _, key := range markerKeys {
 		_, present := marker.Extended[key]
@@ -72,14 +75,14 @@ func TestDeleteTableRefusesAncestorDataPath(t *testing.T) {
 		OwnerAccountID:   DefaultAccountID,
 		MetadataLocation: "s3://" + renameTestBucket + "/ns/metadata/v1.metadata.json",
 	})
-	fs.putEntry(GetNamespacePath(renameTestBucket, "ns"), "badt", map[string][]byte{ExtendedKeyMetadata: badMeta})
+	fs.Put(GetNamespacePath(renameTestBucket, "ns"), "badt", map[string][]byte{ExtendedKeyMetadata: badMeta})
 
 	require.Error(t, runDeleteTable(t, m, fs, "ns", "badt"))
 
 	// The sibling table seeded by startRenameManager and its data must survive.
-	assert.NotNil(t, fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t"),
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"),
 		"sibling table marker must survive a refused delete")
-	assert.NotNil(t, fs.getEntry(GetTablePath(renameTestBucket, "ns", "t"), "data"),
+	assert.NotNil(t, fs.Get(GetTablePath(renameTestBucket, "ns", "t"), "data"),
 		"sibling table data must survive a refused delete")
 }
 
@@ -89,6 +92,79 @@ func TestDeleteTableColocatedRemovesData(t *testing.T) {
 
 	require.NoError(t, runDeleteTable(t, m, fs, "ns", "t"))
 
-	assert.Nil(t, fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t"), "colocated table entry must be deleted")
-	assert.Nil(t, fs.getEntry(GetTablePath(renameTestBucket, "ns", "t"), "metadata"), "colocated table data must be deleted")
+	assert.Nil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"), "colocated table entry must be deleted")
+	assert.Nil(t, fs.Get(GetTablePath(renameTestBucket, "ns", "t"), "metadata"), "colocated table data must be deleted")
+}
+
+// A table whose MetadataLocation points at a sibling that is still a live
+// catalog entry must not be deleted: only the named table was authorized, so a
+// recursive purge of that location would destroy another tenant's table.
+func TestDeleteTableRefusesLiveSiblingDataPath(t *testing.T) {
+	fs, m := startRenameManager(t)
+
+	nsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"attackerns"}, OwnerAccountID: DefaultAccountID})
+	fs.Put(GetTableBucketPath(renameTestBucket), "attackerns", map[string][]byte{ExtendedKeyMetadata: nsMeta})
+
+	decoyMeta, _ := json.Marshal(tableMetadataInternal{
+		Name:             "decoy",
+		Namespace:        "attackerns",
+		Format:           "ICEBERG",
+		OwnerAccountID:   DefaultAccountID,
+		MetadataLocation: "s3://" + renameTestBucket + "/ns/t/metadata/v3.metadata.json",
+	})
+	fs.Put(GetNamespacePath(renameTestBucket, "attackerns"), "decoy", map[string][]byte{ExtendedKeyMetadata: decoyMeta})
+
+	require.Error(t, runDeleteTable(t, m, fs, "attackerns", "decoy"))
+
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"),
+		"the targeted table's catalog entry must survive")
+	assert.NotNil(t, fs.Get(GetTablePath(renameTestBucket, "ns", "t"), "data"),
+		"the targeted table's data must survive")
+}
+
+// A location inside another table's directory carries no catalog marker of its
+// own — the marker lives on the name path. Dropping a table whose
+// MetadataLocation resolves into nsa/vtab/data must be refused by the ancestor
+// check, or the victim's marker-less data subdirectory is purged wholesale.
+func TestDeleteTableRefusesNestedSiblingDataPath(t *testing.T) {
+	fs, m := startRenameManager(t)
+
+	nsaMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"nsa"}, OwnerAccountID: DefaultAccountID})
+	fs.Put(GetTableBucketPath(renameTestBucket), "nsa", map[string][]byte{ExtendedKeyMetadata: nsaMeta})
+
+	victimMeta, _ := json.Marshal(tableMetadataInternal{
+		Name:             "vtab",
+		Namespace:        "nsa",
+		Format:           "ICEBERG",
+		OwnerAccountID:   DefaultAccountID,
+		MetadataLocation: "s3://" + renameTestBucket + "/nsa/vtab/metadata/v1.metadata.json",
+	})
+	victimTablePath := GetTablePath(renameTestBucket, "nsa", "vtab")
+	fs.Put(GetNamespacePath(renameTestBucket, "nsa"), "vtab", map[string][]byte{
+		ExtendedKeyMetadata:  victimMeta,
+		ExtendedKeyEntryType: []byte(EntryTypeTable),
+	})
+	fs.Put(victimTablePath, "data", nil)
+	fs.Put(path.Join(victimTablePath, "data"), "important-0001.parquet", nil)
+
+	evilMeta, _ := json.Marshal(tableMetadataInternal{
+		Name:             "evil",
+		Namespace:        "attackerns2",
+		Format:           "ICEBERG",
+		OwnerAccountID:   DefaultAccountID,
+		MetadataLocation: "s3://" + renameTestBucket + "/nsa/vtab/data/metadata/v1.metadata.json",
+	})
+	nsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"attackerns2"}, OwnerAccountID: DefaultAccountID})
+	fs.Put(GetTableBucketPath(renameTestBucket), "attackerns2", map[string][]byte{ExtendedKeyMetadata: nsMeta})
+	fs.Put(GetNamespacePath(renameTestBucket, "attackerns2"), "evil", map[string][]byte{
+		ExtendedKeyMetadata:  evilMeta,
+		ExtendedKeyEntryType: []byte(EntryTypeTable),
+	})
+
+	require.Error(t, runDeleteTable(t, m, fs, "attackerns2", "evil"))
+
+	assert.NotNil(t, fs.Get(path.Join(victimTablePath, "data"), "important-0001.parquet"),
+		"data inside another table's directory must survive")
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "nsa"), "vtab"),
+		"the victim table's catalog entry must survive")
 }
diff --git a/weed/s3api/s3tables/handler_existence_hiding_test.go b/weed/s3api/s3tables/handler_existence_hiding_test.go
new file mode 100644
index 0000000000..187ebf093e
--- /dev/null
+++ b/weed/s3api/s3tables/handler_existence_hiding_test.go
@@ -0,0 +1,376 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type s3TablesHTTPError struct {
+	status int
+	body   S3TablesError
+}
+
+func runUnauthorizedRequest(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, operation string, input interface{}) s3TablesHTTPError {
+	t.Helper()
+
+	body, err := json.Marshal(input)
+	require.NoError(t, err)
+	identity := &testIdentity{Name: "attacker", Account: &testIdentityAccount{Id: "attacker"}, Actions: []string{"Read"}}
+	ctx := s3_constants.SetIdentityInContext(context.Background(), identity)
+	req, err := newManagerRequest(ctx, operation, body, "attacker")
+	require.NoError(t, err)
+
+	recorder := httptest.NewRecorder()
+	m.handler.HandleRequest(recorder, req, NewManagerClient(fs.Client))
+	result := recorder.Result()
+	defer result.Body.Close()
+
+	var response S3TablesError
+	require.NoError(t, json.NewDecoder(result.Body).Decode(&response))
+	return s3TablesHTTPError{status: result.StatusCode, body: response}
+}
+
+func TestTableBucketAuthorizationDenialMatchesMissing(t *testing.T) {
+	existing, manager := startRenameManager(t)
+	missing := s3tablestest.Start(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	for _, operation := range []string{"GetTableBucket", "DeleteTableBucket"} {
+		t.Run(operation, func(t *testing.T) {
+			var request interface{} = &GetTableBucketRequest{TableBucketARN: mustBucketARN(t)}
+			if operation == "DeleteTableBucket" {
+				request = &DeleteTableBucketRequest{TableBucketARN: mustBucketARN(t)}
+			}
+
+			want := runUnauthorizedRequest(t, manager, missing, operation, request)
+			got := runUnauthorizedRequest(t, manager, existing, operation, request)
+			assert.Equal(t, want, got)
+			assert.Equal(t, 404, got.status)
+			assert.Equal(t, ErrCodeNoSuchBucket, got.body.Type)
+		})
+	}
+}
+
+func TestNamespaceAuthorizationDenialMatchesMissing(t *testing.T) {
+	existing, manager := startRenameManager(t)
+	missing := s3tablestest.Start(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	for _, operation := range []string{"GetNamespace", "UpdateNamespace", "DeleteNamespace"} {
+		t.Run(operation, func(t *testing.T) {
+			var request interface{} = &GetNamespaceRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}}
+			switch operation {
+			case "UpdateNamespace":
+				request = &UpdateNamespaceRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}}
+			case "DeleteNamespace":
+				request = &DeleteNamespaceRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}}
+			}
+
+			want := runUnauthorizedRequest(t, manager, missing, operation, request)
+			got := runUnauthorizedRequest(t, manager, existing, operation, request)
+			assert.Equal(t, want, got)
+			assert.Equal(t, 404, got.status)
+			assert.Equal(t, ErrCodeNoSuchNamespace, got.body.Type)
+		})
+	}
+}
+
+func TestTableAuthorizationDenialMatchesMissing(t *testing.T) {
+	existing, manager := startRenameManager(t)
+	missing := s3tablestest.Start(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	for _, operation := range []string{"GetTable", "UpdateTable", "DeleteTable", "RenameTable"} {
+		t.Run(operation, func(t *testing.T) {
+			var request interface{} = &GetTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "t"}
+			switch operation {
+			case "UpdateTable":
+				request = &UpdateTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "t", VersionToken: "wrong"}
+			case "DeleteTable":
+				request = &DeleteTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "t", VersionToken: "wrong"}
+			case "RenameTable":
+				request = &RenameTableRequest{TableBucketARN: mustBucketARN(t), SourceNamespace: []string{"ns"}, SourceName: "t", DestNamespace: []string{"ns"}, DestName: "t2"}
+			}
+
+			want := runUnauthorizedRequest(t, manager, missing, operation, request)
+			got := runUnauthorizedRequest(t, manager, existing, operation, request)
+			assert.Equal(t, want, got)
+			assert.Equal(t, 404, got.status)
+			assert.Equal(t, ErrCodeNoSuchTable, got.body.Type)
+		})
+	}
+}
+
+func TestDeleteTableAuthorizedVersionMismatchStillConflicts(t *testing.T) {
+	fs, manager := startRenameManager(t)
+	err := manager.Execute(context.Background(), NewManagerClient(fs.Client), "DeleteTable", &DeleteTableRequest{
+		TableBucketARN: mustBucketARN(t),
+		Namespace:      []string{"ns"},
+		Name:           "t",
+		VersionToken:   "wrong",
+	}, nil, "")
+
+	require.Error(t, err)
+	var s3Err *S3TablesError
+	require.ErrorAs(t, err, &s3Err)
+	assert.Equal(t, ErrCodeConflict, s3Err.Type)
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"))
+}
+
+func runRequestAs(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, operation string, input interface{}, actions []string) s3TablesHTTPError {
+	t.Helper()
+
+	body, err := json.Marshal(input)
+	require.NoError(t, err)
+	identity := &testIdentity{Name: "reader", Account: &testIdentityAccount{Id: "reader"}, Actions: actions}
+	ctx := s3_constants.SetIdentityInContext(context.Background(), identity)
+	req, err := newManagerRequest(ctx, operation, body, "reader")
+	require.NoError(t, err)
+
+	recorder := httptest.NewRecorder()
+	m.handler.HandleRequest(recorder, req, NewManagerClient(fs.Client))
+	result := recorder.Result()
+	defer result.Body.Close()
+
+	var response S3TablesError
+	if result.StatusCode >= 400 {
+		require.NoError(t, json.NewDecoder(result.Body).Decode(&response))
+	}
+	return s3TablesHTTPError{status: result.StatusCode, body: response}
+}
+
+// A principal that may read the table is told the write was refused; the
+// not-found veil only hides the entry from callers that cannot see it.
+func TestDeniedWritesReportForbiddenToReaders(t *testing.T) {
+	fs, manager := startRenameManager(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+	readActions := []string{"s3tables:GetTable"}
+
+	got := runRequestAs(t, manager, fs, "GetTable", &GetTableRequest{
+		TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "t"}, readActions)
+	assert.Equal(t, 200, got.status)
+
+	for _, tc := range []struct {
+		operation string
+		request   interface{}
+	}{
+		{"UpdateTable", &UpdateTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "t", VersionToken: "any"}},
+		{"DeleteTable", &DeleteTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "t"}},
+		{"RenameTable", &RenameTableRequest{TableBucketARN: mustBucketARN(t), SourceNamespace: []string{"ns"}, SourceName: "t", DestNamespace: []string{"ns"}, DestName: "t2"}},
+	} {
+		t.Run(tc.operation, func(t *testing.T) {
+			got := runRequestAs(t, manager, fs, tc.operation, tc.request, readActions)
+			assert.Equal(t, 403, got.status)
+			assert.Equal(t, ErrCodeAccessDenied, got.body.Type)
+		})
+	}
+}
+
+// A view stored at a table name is hidden from table operations: a principal
+// with only s3tables:GetTable must get the same not-found it would see for a
+// genuinely missing name, never a 403 that reveals the entry exists.
+func TestDeniedTableWritesDoNotRevealViews(t *testing.T) {
+	fs, manager := startRenameManager(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	viewMeta, _ := json.Marshal(tableMetadataInternal{
+		Name:           "v",
+		Namespace:      "ns",
+		OwnerAccountID: DefaultAccountID,
+	})
+	fs.Put(GetNamespacePath(renameTestBucket, "ns"), "v", map[string][]byte{
+		ExtendedKeyMetadata:  viewMeta,
+		ExtendedKeyEntryType: []byte(EntryTypeView),
+	})
+
+	readActions := []string{"s3tables:GetTable"}
+	for _, tc := range []struct {
+		operation string
+		request   interface{}
+	}{
+		{"GetTable", &GetTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "v"}},
+		{"UpdateTable", &UpdateTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "v", VersionToken: "any"}},
+		{"DeleteTable", &DeleteTableRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}, Name: "v"}},
+	} {
+		t.Run(tc.operation, func(t *testing.T) {
+			got := runRequestAs(t, manager, fs, tc.operation, tc.request, readActions)
+			assert.Equal(t, 404, got.status)
+			assert.Equal(t, ErrCodeNoSuchTable, got.body.Type)
+		})
+	}
+}
+
+// A caller without a grant must get the same answer whether a list target
+// exists or not, and whether the bucket behind it exists at all.
+func TestAbsentListTargetsMatchDeniedAnswers(t *testing.T) {
+	existing, manager := startRenameManager(t)
+	missing := s3tablestest.Start(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	for _, tc := range []struct {
+		name      string
+		fs        *s3tablestest.MemFiler
+		operation string
+		denied    interface{}
+		request   interface{}
+	}{
+		{"ListTables missing namespace", existing, "ListTables",
+			&ListTablesRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}},
+			&ListTablesRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ghost"}}},
+		{"ListTables missing bucket", missing, "ListTables",
+			&ListTablesRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}},
+			&ListTablesRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}}},
+		{"ListTables missing bucket, all namespaces", missing, "ListTables",
+			&ListTablesRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}},
+			&ListTablesRequest{TableBucketARN: mustBucketARN(t)}},
+		{"ListViews missing namespace", existing, "ListViews",
+			&ListViewsRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}},
+			&ListViewsRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"ghost"}}},
+		{"CreateNamespace missing bucket", missing, "CreateNamespace",
+			&CreateNamespaceRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"newns"}},
+			&CreateNamespaceRequest{TableBucketARN: mustBucketARN(t), Namespace: []string{"newns"}}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			denied := runUnauthorizedRequest(t, manager, existing, tc.operation, tc.denied)
+			assert.Equal(t, 403, denied.status)
+			got := runUnauthorizedRequest(t, manager, tc.fs, tc.operation, tc.request)
+			assert.Equal(t, denied, got)
+		})
+	}
+}
+
+// A denied tag operation and the same operation on a missing table must answer
+// alike; a granted caller still gets the truthful not-found.
+func TestAbsentTagTargetsMatchDeniedAnswers(t *testing.T) {
+	existing, manager := startRenameManager(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	existingARN, err := BuildTableARN(DefaultRegion, DefaultAccountID, renameTestBucket, "ns", "t")
+	require.NoError(t, err)
+	missingARN, err := BuildTableARN(DefaultRegion, DefaultAccountID, renameTestBucket, "ns", "ghost")
+	require.NoError(t, err)
+
+	requestFor := func(operation, arn string) interface{} {
+		switch operation {
+		case "TagResource":
+			return &TagResourceRequest{ResourceARN: arn, Tags: map[string]string{"k": "v"}}
+		case "UntagResource":
+			return &UntagResourceRequest{ResourceARN: arn, TagKeys: []string{"k"}}
+		}
+		return &ListTagsForResourceRequest{ResourceARN: arn}
+	}
+
+	for _, operation := range []string{"TagResource", "ListTagsForResource", "UntagResource"} {
+		t.Run(operation, func(t *testing.T) {
+			denied := runUnauthorizedRequest(t, manager, existing, operation, requestFor(operation, existingARN))
+			assert.Equal(t, 403, denied.status)
+			got := runUnauthorizedRequest(t, manager, existing, operation, requestFor(operation, missingARN))
+			assert.Equal(t, denied, got)
+		})
+	}
+}
+
+// A directory that holds a plain S3 bucket name is not a table bucket: every
+// caller gets the same 404 an absent name gets, not a 500 that reveals the
+// name resolves in the filer.
+func TestPlainBucketReadsAsAbsent(t *testing.T) {
+	existing, manager := startRenameManager(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+	existing.Put(TablesPath, "plainbkt", nil)
+
+	plainARN, err := BuildBucketARN(DefaultRegion, DefaultAccountID, "plainbkt")
+	require.NoError(t, err)
+
+	for _, tc := range []struct {
+		operation string
+		request   interface{}
+	}{
+		{"GetTableBucket", &GetTableBucketRequest{TableBucketARN: plainARN}},
+		{"ListNamespaces", &ListNamespacesRequest{TableBucketARN: plainARN}},
+	} {
+		t.Run(tc.operation, func(t *testing.T) {
+			got := runUnauthorizedRequest(t, manager, existing, tc.operation, tc.request)
+			assert.Equal(t, 404, got.status)
+			assert.Equal(t, ErrCodeNoSuchBucket, got.body.Type)
+		})
+	}
+}
+
+// A caller with an identity-level grant still learns that a name is absent.
+func TestGrantedCallerLearnsAbsence(t *testing.T) {
+	missing := s3tablestest.Start(t)
+	manager := NewManager()
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	got := runRequestAs(t, manager, missing, "ListTables", &ListTablesRequest{
+		TableBucketARN: mustBucketARN(t), Namespace: []string{"ns"}},
+		[]string{"s3tables:ListTables"})
+	assert.Equal(t, 200, got.status)
+
+	missingTableARN, err := BuildTableARN(DefaultRegion, DefaultAccountID, renameTestBucket, "ns", "ghost")
+	require.NoError(t, err)
+	got = runRequestAs(t, manager, missing, "ListTagsForResource",
+		&ListTagsForResourceRequest{ResourceARN: missingTableARN},
+		[]string{"s3tables:ListTagsForResource"})
+	assert.Equal(t, 404, got.status)
+	assert.Equal(t, ErrCodeNoSuchTable, got.body.Type)
+}
+
+// A request ARN that names a foreign account still resolves to the local
+// names, so the absent-target answer must match the denial the canonical ARN
+// gets; otherwise a reformatted ARN restores the existence oracle.
+func TestAbsentTagTargetDenySurvivesForeignAccountARN(t *testing.T) {
+	fs, manager := startRenameManager(t)
+	manager.SetTrusted(false)
+	manager.SetDefaultAllow(false)
+
+	bucketMeta, _ := json.Marshal(tableBucketMetadata{Name: renameTestBucket, OwnerAccountID: DefaultAccountID})
+	fs.Put(TablesPath, renameTestBucket, map[string][]byte{
+		ExtendedKeyTableBucket: []byte("{}"),
+		ExtendedKeyMetadata:    bucketMeta,
+		ExtendedKeyPolicy: []byte(fmt.Sprintf(
+			`{"Statement":[{"Effect":"Deny","Principal":"*","Action":"s3tables:*","Resource":%q}]}`,
+			mustBucketARN(t)+"/table/*")),
+	})
+
+	foreignARN := func(table string) string {
+		return fmt.Sprintf("arn:aws:s3tables:%s:999999999999:bucket/%s/table/ns/%s",
+			DefaultRegion, renameTestBucket, table)
+	}
+	requestFor := func(operation, arn string) interface{} {
+		switch operation {
+		case "TagResource":
+			return &TagResourceRequest{ResourceARN: arn, Tags: map[string]string{"k": "v"}}
+		case "UntagResource":
+			return &UntagResourceRequest{ResourceARN: arn, TagKeys: []string{"k"}}
+		}
+		return &ListTagsForResourceRequest{ResourceARN: arn}
+	}
+
+	for _, operation := range []string{"TagResource", "ListTagsForResource", "UntagResource"} {
+		t.Run(operation, func(t *testing.T) {
+			actions := []string{"s3tables:" + operation}
+			denied := runRequestAs(t, manager, fs, operation, requestFor(operation, foreignARN("t")), actions)
+			assert.Equal(t, 403, denied.status)
+			got := runRequestAs(t, manager, fs, operation, requestFor(operation, foreignARN("ghost")), actions)
+			assert.Equal(t, denied, got)
+		})
+	}
+}
diff --git a/weed/s3api/s3tables/handler_identity_test.go b/weed/s3api/s3tables/handler_identity_test.go
index 12122a81e2..b4ab8d9a04 100644
--- a/weed/s3api/s3tables/handler_identity_test.go
+++ b/weed/s3api/s3tables/handler_identity_test.go
@@ -171,3 +171,18 @@ func TestGetAccountIDNormalizesAccountIDARN(t *testing.T) {
 
 	assert.Equal(t, "bob", h.getAccountID(req), "expected ARN account ID to be normalized to the suffix")
 }
+
+func TestGetAccountIDPrefersIssuerScopedUserID(t *testing.T) {
+	h := NewS3TablesHandler()
+	id := &testIdentity{
+		Claims: map[string]interface{}{
+			"aws:userid":         "issuerA-hash",
+			"sub":                "alice-sub",
+			"preferred_username": "alice",
+		},
+	}
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req = req.WithContext(s3_constants.SetIdentityInContext(req.Context(), id))
+
+	assert.Equal(t, "issuerA-hash", h.getAccountID(req), "aws:userid should win over a bare sub")
+}
diff --git a/weed/s3api/s3tables/handler_log_level_test.go b/weed/s3api/s3tables/handler_log_level_test.go
new file mode 100644
index 0000000000..8efc3bd3cd
--- /dev/null
+++ b/weed/s3api/s3tables/handler_log_level_test.go
@@ -0,0 +1,123 @@
+package s3tables
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+)
+
+// captureLogs swaps the two log sinks for recorders and restores them when the test ends.
+func captureLogs(t *testing.T) (refusals, serverErrors *[]string) {
+	t.Helper()
+	var r, s []string
+	oldR, oldS := logClientRefusal, logServerError
+	logClientRefusal = func(f string, a ...interface{}) { r = append(r, fmt.Sprintf(f, a...)) }
+	logServerError = func(f string, a ...interface{}) { s = append(s, fmt.Sprintf(f, a...)) }
+	t.Cleanup(func() { logClientRefusal, logServerError = oldR, oldS })
+	return &r, &s
+}
+
+// A refusal the API answers with a 4xx is not a server error.
+func TestRequestRefusedWith4xxIsNotLoggedAsError(t *testing.T) {
+	refusals, serverErrors := captureLogs(t)
+	h := NewS3TablesHandler()
+	req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader("not json"))
+	req.Header.Set("X-Amz-Target", "S3Tables.ListNamespaces")
+	rec := httptest.NewRecorder()
+	h.HandleRequest(rec, req, nil)
+	if rec.Code < 400 || rec.Code >= 500 {
+		t.Fatalf("the probe request must be refused with a 4xx for this test to mean anything, got %d", rec.Code) // positive control
+	}
+	if len(*serverErrors) != 0 {
+		t.Fatalf("a %d refusal was logged at ERROR: %v", rec.Code, *serverErrors)
+	}
+	if len(*refusals) != 1 || !strings.Contains((*refusals)[0], "ListNamespaces refused") {
+		t.Fatalf("the refusal must still be logged once (at V(1)), got %v", *refusals)
+	}
+}
+
+func TestLogRequestErrorByStatus(t *testing.T) {
+	for _, c := range []struct {
+		status    int
+		wantError bool
+	}{{http.StatusForbidden, false}, {http.StatusNotFound, false}, {http.StatusConflict, false},
+		{http.StatusInternalServerError, true}, {http.StatusServiceUnavailable, true}, {0, true}} {
+		refusals, serverErrors := captureLogs(t)
+		logRequestError("Op", c.status, errors.New("boom"))
+		if gotError := len(*serverErrors) == 1 && len(*refusals) == 0; gotError != c.wantError {
+			t.Errorf("status %d: ERROR=%v, want %v (refusals %v, errors %v)", c.status, gotError, c.wantError, *refusals, *serverErrors)
+		}
+	}
+}
+
+func TestStatusRecorderKeepsTheFirstStatus(t *testing.T) {
+	rec := httptest.NewRecorder()
+	sw := &statusRecorder{ResponseWriter: rec}
+	_, _ = sw.Write([]byte("x"))
+	sw.WriteHeader(http.StatusInternalServerError)
+	if sw.status != http.StatusOK {
+		t.Fatalf("an implicit 200 by Write must win, got %d", sw.status)
+	}
+	sw2 := &statusRecorder{ResponseWriter: httptest.NewRecorder()}
+	sw2.WriteHeader(http.StatusForbidden)
+	if sw2.status != http.StatusForbidden {
+		t.Fatalf("got %d", sw2.status)
+	}
+}
+
+func TestStatusRecorderUnwrapsForResponseController(t *testing.T) {
+	sw := &statusRecorder{ResponseWriter: httptest.NewRecorder()}
+	if err := http.NewResponseController(sw).Flush(); err != nil {
+		t.Fatalf("ResponseController through the recorder: %v", err)
+	}
+	if sw.Unwrap() == nil {
+		t.Fatal("Unwrap must return the wrapped writer")
+	}
+}
+
+// A malformed CreateNamespace body is answered with a 400; neither the
+// dispatcher nor the handler itself may log it at ERROR.
+func TestMalformedCreateNamespaceIsNotLoggedAsError(t *testing.T) {
+	refusals, serverErrors := captureLogs(t)
+
+	before := glog.Stats.Error.Lines()
+	glog.Errorf("S3Tables test: positive control for the ERROR line counter")
+	if glog.Stats.Error.Lines() != before+1 {
+		t.Fatal("the ERROR line counter did not see a direct glog.Errorf") // positive control
+	}
+
+	h := NewS3TablesHandler()
+	req := httptest.NewRequest(http.MethodPost, "/", strings.NewReader("not json"))
+	req.Header.Set("X-Amz-Target", "S3Tables.CreateNamespace")
+	rec := httptest.NewRecorder()
+	before = glog.Stats.Error.Lines()
+	h.HandleRequest(rec, req, nil)
+	errorLines := glog.Stats.Error.Lines() - before
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("a malformed body must be refused with 400, got %d", rec.Code)
+	}
+	if errorLines != 0 || len(*serverErrors) != 0 {
+		t.Fatalf("a 400 refusal was logged at ERROR: %d direct line(s), dispatcher %v", errorLines, *serverErrors)
+	}
+	if len(*refusals) != 1 || !strings.Contains((*refusals)[0], "CreateNamespace refused") {
+		t.Fatalf("the refusal must still be logged once (at V(1)), got %v", *refusals)
+	}
+}
+
+// The recorder must not claim to flush a writer that cannot.
+func TestStatusRecorderFlushFollowsTheWrappedWriter(t *testing.T) {
+	type plainWriter struct{ http.ResponseWriter }
+	sw := &statusRecorder{ResponseWriter: plainWriter{httptest.NewRecorder()}}
+	if err := http.NewResponseController(sw).Flush(); !errors.Is(err, http.ErrNotSupported) {
+		t.Fatalf("Flush through a recorder over a non-flushing writer: %v, want ErrNotSupported", err)
+	}
+	rec := httptest.NewRecorder()
+	if err := http.NewResponseController(&statusRecorder{ResponseWriter: rec}).Flush(); err != nil || !rec.Flushed {
+		t.Fatalf("Flush through a recorder over a flushing writer: err=%v flushed=%v", err, rec.Flushed) // positive control
+	}
+}
diff --git a/weed/s3api/s3tables/handler_maintenance.go b/weed/s3api/s3tables/handler_maintenance.go
new file mode 100644
index 0000000000..34d42cba3d
--- /dev/null
+++ b/weed/s3api/s3tables/handler_maintenance.go
@@ -0,0 +1,547 @@
+package s3tables
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+// Maintenance types are scoped: AWS configures unreferenced file removal on the
+// table bucket and compaction and snapshot management on the table.
+var (
+	bucketMaintenanceTypes = map[string]bool{
+		MaintenanceTypeIcebergUnreferencedFileRemoval: true,
+	}
+	tableMaintenanceTypes = map[string]bool{
+		MaintenanceTypeIcebergCompaction:         true,
+		MaintenanceTypeIcebergSnapshotManagement: true,
+	}
+)
+
+// handlePutTableBucketMaintenanceConfiguration sets a maintenance configuration on a table bucket
+func (h *S3TablesHandler) handlePutTableBucketMaintenanceConfiguration(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	var req PutTableBucketMaintenanceConfigurationRequest
+	if err := h.readRequestBody(r, &req); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	if req.TableBucketARN == "" {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "tableBucketARN is required")
+		return fmt.Errorf("tableBucketARN is required")
+	}
+
+	bucketName, err := parseBucketNameFromARN(req.TableBucketARN)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	if err := validateMaintenanceValue(req.Type, bucketMaintenanceTypes, req.Value); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	if _, err := h.authorizeMaintenanceBucket(r, filerClient, "PutTableBucketMaintenanceConfiguration", bucketName); err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
+		return err
+	}
+
+	if err := h.putMaintenanceConfiguration(r, filerClient, GetTableBucketPath(bucketName), req.Type, req.Value); err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
+		return err
+	}
+
+	h.writeJSON(w, http.StatusOK, nil)
+	return nil
+}
+
+// handleGetTableBucketMaintenanceConfiguration gets the maintenance configuration of a table bucket
+func (h *S3TablesHandler) handleGetTableBucketMaintenanceConfiguration(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	var req GetTableBucketMaintenanceConfigurationRequest
+	if err := h.readRequestBody(r, &req); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	if req.TableBucketARN == "" {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "tableBucketARN is required")
+		return fmt.Errorf("tableBucketARN is required")
+	}
+
+	bucketName, err := parseBucketNameFromARN(req.TableBucketARN)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	bucketARN, err := h.authorizeMaintenanceBucket(r, filerClient, "GetTableBucketMaintenanceConfiguration", bucketName)
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
+		return err
+	}
+
+	config, err := h.readMaintenanceConfiguration(r, filerClient, GetTableBucketPath(bucketName))
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
+		return err
+	}
+
+	h.writeJSON(w, http.StatusOK, &GetTableBucketMaintenanceConfigurationResponse{
+		TableBucketARN: bucketARN,
+		Configuration:  config,
+	})
+	return nil
+}
+
+// handlePutTableMaintenanceConfiguration sets a maintenance configuration on a table
+func (h *S3TablesHandler) handlePutTableMaintenanceConfiguration(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	var req PutTableMaintenanceConfigurationRequest
+	if err := h.readRequestBody(r, &req); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	bucketName, namespaceName, tableName, err := h.parseTableTarget(req.TableBucketARN, req.Namespace, req.Name)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	if err := validateMaintenanceValue(req.Type, tableMaintenanceTypes, req.Value); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	if _, err := h.authorizeMaintenanceTable(r, filerClient, "PutTableMaintenanceConfiguration", bucketName, namespaceName, tableName); err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		return err
+	}
+
+	tablePath := GetTablePath(bucketName, namespaceName, tableName)
+	if err := h.putMaintenanceConfiguration(r, filerClient, tablePath, req.Type, req.Value); err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		return err
+	}
+
+	h.writeJSON(w, http.StatusOK, nil)
+	return nil
+}
+
+// handleGetTableMaintenanceConfiguration gets the maintenance configuration of a table
+func (h *S3TablesHandler) handleGetTableMaintenanceConfiguration(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	var req GetTableMaintenanceConfigurationRequest
+	if err := h.readRequestBody(r, &req); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	bucketName, namespaceName, tableName, err := h.parseTableTarget(req.TableBucketARN, req.Namespace, req.Name)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	tableARN, err := h.authorizeMaintenanceTable(r, filerClient, "GetTableMaintenanceConfiguration", bucketName, namespaceName, tableName)
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		return err
+	}
+
+	tablePath := GetTablePath(bucketName, namespaceName, tableName)
+	config, err := h.readMaintenanceConfiguration(r, filerClient, tablePath)
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		return err
+	}
+
+	h.writeJSON(w, http.StatusOK, &GetTableMaintenanceConfigurationResponse{
+		TableARN:      tableARN,
+		Namespace:     []string{namespaceName},
+		Name:          tableName,
+		Configuration: config,
+	})
+	return nil
+}
+
+// handleGetTableMaintenanceJobStatus reports the outcome of the last maintenance run on a table
+func (h *S3TablesHandler) handleGetTableMaintenanceJobStatus(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	var req GetTableMaintenanceJobStatusRequest
+	if err := h.readRequestBody(r, &req); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	bucketName, namespaceName, tableName, err := h.parseTableTarget(req.TableBucketARN, req.Namespace, req.Name)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	tableARN, err := h.authorizeMaintenanceTable(r, filerClient, "GetTableMaintenanceJobStatus", bucketName, namespaceName, tableName)
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		return err
+	}
+
+	tablePath := GetTablePath(bucketName, namespaceName, tableName)
+
+	// Unreferenced file removal is configured on the bucket, so a bucket-level
+	// disable has to show up here as Disabled rather than a stale table status.
+	bucketConfig, err := h.readMaintenanceConfiguration(r, filerClient, GetTableBucketPath(bucketName))
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
+		return err
+	}
+	tableConfig, err := h.readMaintenanceConfiguration(r, filerClient, tablePath)
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		return err
+	}
+	config := MergeMaintenanceConfiguration(bucketConfig, tableConfig)
+
+	recorded := MaintenanceJobStatus{}
+	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		data, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyMaintenanceStatus)
+		if err != nil {
+			if errors.Is(err, ErrAttributeNotFound) {
+				return nil
+			}
+			return err
+		}
+		return json.Unmarshal(data, &recorded)
+	})
+	if err != nil {
+		h.writeMaintenanceError(w, err, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		return err
+	}
+
+	h.writeJSON(w, http.StatusOK, &GetTableMaintenanceJobStatusResponse{
+		TableARN: tableARN,
+		Status:   buildJobStatusResponse(recorded, config),
+	})
+	return nil
+}
+
+// buildJobStatusResponse reports every job type: what the worker recorded, or
+// Disabled when the configuration switched the type off, or Not_Yet_Run.
+func buildJobStatusResponse(recorded MaintenanceJobStatus, config MaintenanceConfiguration) MaintenanceJobStatus {
+	jobTypes := []string{
+		MaintenanceTypeIcebergCompaction,
+		MaintenanceTypeIcebergSnapshotManagement,
+		MaintenanceTypeIcebergUnreferencedFileRemoval,
+	}
+
+	status := make(MaintenanceJobStatus, len(jobTypes))
+	for _, jobType := range jobTypes {
+		if value, ok := config[jobType]; ok && value != nil && value.Status == MaintenanceStatusDisabled {
+			status[jobType] = &MaintenanceJobStatusValue{Status: MaintenanceJobStatusDisabled}
+			continue
+		}
+		if value, ok := recorded[jobType]; ok && value != nil {
+			status[jobType] = value
+			continue
+		}
+		status[jobType] = &MaintenanceJobStatusValue{Status: MaintenanceJobStatusNotYetRun}
+	}
+	return status
+}
+
+// putMaintenanceConfiguration merges one maintenance type into the stored
+// configuration, leaving the other types alone. The write checks the catalog
+// identity in the same conditional mutation, so it cannot land on a name a
+// concurrent rename or delete has already soft-deleted.
+func (h *S3TablesHandler) putMaintenanceConfiguration(
+	r *http.Request,
+	filerClient FilerClient,
+	resourcePath, maintenanceType string,
+	value *MaintenanceConfigurationValue,
+) error {
+	return filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return h.mutateEntryExtended(r.Context(), client, resourcePath, func(extended map[string][]byte) error {
+			if len(extended[ExtendedKeyMetadata]) == 0 {
+				return fmt.Errorf("%w: %s", filer_pb.ErrNotFound, resourcePath)
+			}
+
+			config := MaintenanceConfiguration{}
+			if current := extended[ExtendedKeyMaintenance]; len(current) > 0 {
+				if err := json.Unmarshal(current, &config); err != nil {
+					return fmt.Errorf("failed to unmarshal maintenance configuration: %w", err)
+				}
+			}
+			config[maintenanceType] = value
+
+			data, err := json.Marshal(config)
+			if err != nil {
+				return err
+			}
+			extended[ExtendedKeyMaintenance] = data
+			return nil
+		})
+	})
+}
+
+// readMaintenanceConfiguration returns the stored configuration, or an empty
+// one when the resource has never been configured.
+func (h *S3TablesHandler) readMaintenanceConfiguration(r *http.Request, filerClient FilerClient, resourcePath string) (MaintenanceConfiguration, error) {
+	config := MaintenanceConfiguration{}
+
+	err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		data, err := h.getExtendedAttribute(r.Context(), client, resourcePath, ExtendedKeyMaintenance)
+		if err != nil {
+			if errors.Is(err, ErrAttributeNotFound) {
+				return nil
+			}
+			return err
+		}
+		return json.Unmarshal(data, &config)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return config, nil
+}
+
+// parseTableTarget validates the bucket/namespace/table triple every
+// table-scoped maintenance request carries.
+func (h *S3TablesHandler) parseTableTarget(tableBucketARN string, namespace []string, name string) (bucketName, namespaceName, tableName string, err error) {
+	if tableBucketARN == "" || len(namespace) == 0 || name == "" {
+		return "", "", "", fmt.Errorf("tableBucketARN, namespace, and name are required")
+	}
+	if namespaceName, err = validateNamespace(namespace); err != nil {
+		return "", "", "", err
+	}
+	if bucketName, err = parseBucketNameFromARN(tableBucketARN); err != nil {
+		return "", "", "", err
+	}
+	if tableName, err = validateTableName(name); err != nil {
+		return "", "", "", err
+	}
+	return bucketName, namespaceName, tableName, nil
+}
+
+// authorizeMaintenanceBucket checks the caller may perform operation on the
+// table bucket, returning the bucket ARN.
+func (h *S3TablesHandler) authorizeMaintenanceBucket(r *http.Request, filerClient FilerClient, operation, bucketName string) (string, error) {
+	bucketPath := GetTableBucketPath(bucketName)
+
+	var bucketMetadata tableBucketMetadata
+	var bucketPolicy string
+	err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		data, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata)
+		if err != nil {
+			return err
+		}
+		if err := json.Unmarshal(data, &bucketMetadata); err != nil {
+			return fmt.Errorf("failed to unmarshal bucket metadata: %w", err)
+		}
+		bucketPolicy, err = h.readPolicy(r, client, bucketPath)
+		return err
+	})
+	if err != nil {
+		return "", err
+	}
+
+	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
+	principal := h.getAccountID(r)
+	if !CheckPermissionWithContext(operation, principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		IdentityActions:  getIdentityActions(r),
+		DefaultAllow:     h.defaultAllowFor(r),
+	}) {
+		return "", NewAuthError(operation, principal, "not authorized to "+operation)
+	}
+
+	return bucketARN, nil
+}
+
+// authorizeMaintenanceTable checks the caller may perform operation on the
+// table, returning the table ARN.
+func (h *S3TablesHandler) authorizeMaintenanceTable(r *http.Request, filerClient FilerClient, operation, bucketName, namespaceName, tableName string) (string, error) {
+	tablePath := GetTablePath(bucketName, namespaceName, tableName)
+	bucketPath := GetTableBucketPath(bucketName)
+
+	var metadata tableMetadataInternal
+	var bucketPolicy, tablePolicy string
+	var bucketTags, tableTags map[string]string
+	err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		data, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyMetadata)
+		if err != nil {
+			return err
+		}
+		if err := json.Unmarshal(data, &metadata); err != nil {
+			return fmt.Errorf("failed to unmarshal table metadata: %w", err)
+		}
+		if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+			return err
+		}
+		if bucketTags, err = h.readTags(r.Context(), client, bucketPath); err != nil {
+			return err
+		}
+		if tablePolicy, err = h.readPolicy(r, client, tablePath); err != nil {
+			return err
+		}
+		tableTags, err = h.readTags(r.Context(), client, tablePath)
+		return err
+	})
+	if err != nil {
+		return "", err
+	}
+
+	tableARN := h.generateTableARN(metadata.OwnerAccountID, bucketName, namespaceName+"/"+tableName)
+	principal := h.getAccountID(r)
+	ctx := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableName:        tableName,
+		TableBucketTags:  bucketTags,
+		ResourceTags:     tableTags,
+		IdentityActions:  getIdentityActions(r),
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	if deniedByPolicy(operation, principal, tablePolicy, tableARN, ctx) ||
+		!CheckPermissionWithContext(operation, principal, metadata.OwnerAccountID, bucketPolicy, tableARN, ctx) {
+		return "", NewAuthError(operation, principal, "not authorized to "+operation)
+	}
+
+	return tableARN, nil
+}
+
+// readPolicy returns the policy stored on path, or an empty string when the
+// resource has none.
+func (h *S3TablesHandler) readPolicy(r *http.Request, client filer_pb.SeaweedFilerClient, path string) (string, error) {
+	data, err := h.getExtendedAttribute(r.Context(), client, path, ExtendedKeyPolicy)
+	if err != nil {
+		if errors.Is(err, ErrAttributeNotFound) {
+			return "", nil
+		}
+		return "", fmt.Errorf("failed to read policy: %w", err)
+	}
+	return string(data), nil
+}
+
+// writeMaintenanceError maps the shared failure modes of the maintenance
+// handlers onto responses.
+func (h *S3TablesHandler) writeMaintenanceError(w http.ResponseWriter, err error, notFoundCode, notFoundMessage string) {
+	switch {
+	case errors.Is(err, filer_pb.ErrNotFound):
+		h.writeError(w, http.StatusNotFound, notFoundCode, notFoundMessage)
+	case isAuthError(err):
+		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, err.Error())
+	case errors.Is(err, ErrConcurrentUpdate):
+		h.writeError(w, http.StatusConflict, ErrCodeConflict, "maintenance configuration changed concurrently, retry the request")
+	default:
+		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, err.Error())
+	}
+}
+
+// validateMaintenanceValue rejects a type that does not belong to the scope and
+// settings that do not name that same type.
+func validateMaintenanceValue(maintenanceType string, allowed map[string]bool, value *MaintenanceConfigurationValue) error {
+	if maintenanceType == "" {
+		return fmt.Errorf("type is required")
+	}
+	if !allowed[maintenanceType] {
+		return fmt.Errorf("unsupported maintenance type %q", maintenanceType)
+	}
+	if value == nil {
+		return fmt.Errorf("value is required")
+	}
+
+	switch value.Status {
+	case MaintenanceStatusEnabled, MaintenanceStatusDisabled:
+	case "":
+		return fmt.Errorf("value.status is required")
+	default:
+		return fmt.Errorf("invalid value.status %q, expected %q or %q", value.Status, MaintenanceStatusEnabled, MaintenanceStatusDisabled)
+	}
+
+	if value.Settings != nil && !settingsMatchType(maintenanceType, value.Settings) {
+		return fmt.Errorf("value.settings must only contain %s", maintenanceType)
+	}
+	return validateMaintenanceSettings(value.Settings)
+}
+
+// AWS bounds every maintenance setting to a positive 32-bit value. Accepting
+// anything else would store a number the worker then ignores or saturates, so
+// the configuration read back would not be the one that runs.
+const (
+	maintenanceSettingMin int64 = 1
+	maintenanceSettingMax int64 = 2147483647
+)
+
+func validateMaintenanceSettings(settings *MaintenanceSettings) error {
+	if settings == nil {
+		return nil
+	}
+
+	if c := settings.IcebergCompaction; c != nil {
+		if err := validateCompactionStrategy(c.Strategy); err != nil {
+			return err
+		}
+		if err := validateMaintenanceSetting("targetFileSizeMB", c.TargetFileSizeMB); err != nil {
+			return err
+		}
+	}
+	if m := settings.IcebergSnapshotManagement; m != nil {
+		if err := validateMaintenanceSetting("minSnapshotsToKeep", m.MinSnapshotsToKeep); err != nil {
+			return err
+		}
+		if err := validateMaintenanceSetting("maxSnapshotAgeHours", m.MaxSnapshotAgeHours); err != nil {
+			return err
+		}
+	}
+	if u := settings.IcebergUnreferencedFileRemoval; u != nil {
+		if err := validateMaintenanceSetting("unreferencedDays", u.UnreferencedDays); err != nil {
+			return err
+		}
+		if err := validateMaintenanceSetting("nonCurrentDays", u.NonCurrentDays); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateMaintenanceSetting(name string, value *int64) error {
+	if value == nil {
+		return nil
+	}
+	if *value < maintenanceSettingMin || *value > maintenanceSettingMax {
+		return fmt.Errorf("%s must be between %d and %d, got %d", name, maintenanceSettingMin, maintenanceSettingMax, *value)
+	}
+	return nil
+}
+
+// validateCompactionStrategy rejects a strategy the maintenance worker cannot
+// carry out, rather than accepting it and quietly compacting some other way.
+func validateCompactionStrategy(strategy string) error {
+	switch strategy {
+	case "", CompactionStrategyAuto, CompactionStrategyBinpack, CompactionStrategySort:
+		return nil
+	case CompactionStrategyZOrder:
+		return fmt.Errorf("compaction strategy %q is not supported", strategy)
+	default:
+		return fmt.Errorf("invalid compaction strategy %q, expected one of %q, %q, %q",
+			strategy, CompactionStrategyAuto, CompactionStrategyBinpack, CompactionStrategySort)
+	}
+}
+
+func settingsMatchType(maintenanceType string, settings *MaintenanceSettings) bool {
+	switch maintenanceType {
+	case MaintenanceTypeIcebergCompaction:
+		return settings.IcebergSnapshotManagement == nil && settings.IcebergUnreferencedFileRemoval == nil
+	case MaintenanceTypeIcebergSnapshotManagement:
+		return settings.IcebergCompaction == nil && settings.IcebergUnreferencedFileRemoval == nil
+	case MaintenanceTypeIcebergUnreferencedFileRemoval:
+		return settings.IcebergCompaction == nil && settings.IcebergSnapshotManagement == nil
+	}
+	return false
+}
diff --git a/weed/s3api/s3tables/handler_maintenance_test.go b/weed/s3api/s3tables/handler_maintenance_test.go
new file mode 100644
index 0000000000..4e427bdf74
--- /dev/null
+++ b/weed/s3api/s3tables/handler_maintenance_test.go
@@ -0,0 +1,476 @@
+package s3tables
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+func settingPtr(v int64) *int64 { return &v }
+
+func TestValidateMaintenanceValueAcceptsScopedTypes(t *testing.T) {
+	err := validateMaintenanceValue(MaintenanceTypeIcebergCompaction, tableMaintenanceTypes, &MaintenanceConfigurationValue{
+		Status:   MaintenanceStatusEnabled,
+		Settings: &MaintenanceSettings{IcebergCompaction: &IcebergCompactionSettings{TargetFileSizeMB: settingPtr(512)}},
+	})
+	if err != nil {
+		t.Errorf("expected compaction accepted on a table, got %v", err)
+	}
+
+	err = validateMaintenanceValue(MaintenanceTypeIcebergUnreferencedFileRemoval, bucketMaintenanceTypes, &MaintenanceConfigurationValue{
+		Status: MaintenanceStatusDisabled,
+	})
+	if err != nil {
+		t.Errorf("expected unreferenced file removal accepted on a bucket, got %v", err)
+	}
+}
+
+func TestValidateMaintenanceValueRejectsWrongScope(t *testing.T) {
+	if err := validateMaintenanceValue(MaintenanceTypeIcebergCompaction, bucketMaintenanceTypes, &MaintenanceConfigurationValue{
+		Status: MaintenanceStatusEnabled,
+	}); err == nil {
+		t.Error("expected compaction rejected on a table bucket")
+	}
+
+	if err := validateMaintenanceValue(MaintenanceTypeIcebergUnreferencedFileRemoval, tableMaintenanceTypes, &MaintenanceConfigurationValue{
+		Status: MaintenanceStatusEnabled,
+	}); err == nil {
+		t.Error("expected unreferenced file removal rejected on a table")
+	}
+}
+
+func TestValidateMaintenanceValueRejectsBadInput(t *testing.T) {
+	cases := map[string]struct {
+		maintenanceType string
+		value           *MaintenanceConfigurationValue
+	}{
+		"empty type":   {"", &MaintenanceConfigurationValue{Status: MaintenanceStatusEnabled}},
+		"unknown type": {"icebergSomethingElse", &MaintenanceConfigurationValue{Status: MaintenanceStatusEnabled}},
+		"nil value":    {MaintenanceTypeIcebergCompaction, nil},
+		"no status":    {MaintenanceTypeIcebergCompaction, &MaintenanceConfigurationValue{}},
+		"bad status":   {MaintenanceTypeIcebergCompaction, &MaintenanceConfigurationValue{Status: "Enabled"}},
+		"settings for another type": {MaintenanceTypeIcebergCompaction, &MaintenanceConfigurationValue{
+			Status:   MaintenanceStatusEnabled,
+			Settings: &MaintenanceSettings{IcebergSnapshotManagement: &IcebergSnapshotManagementSettings{MinSnapshotsToKeep: settingPtr(3)}},
+		}},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			if err := validateMaintenanceValue(tc.maintenanceType, tableMaintenanceTypes, tc.value); err == nil {
+				t.Error("expected rejection")
+			}
+		})
+	}
+}
+
+// The stored attribute is the wire shape, so Get can hand it straight back.
+func TestMaintenanceConfigurationRoundTrip(t *testing.T) {
+	original := MaintenanceConfiguration{
+		MaintenanceTypeIcebergCompaction: {
+			Status:   MaintenanceStatusEnabled,
+			Settings: &MaintenanceSettings{IcebergCompaction: &IcebergCompactionSettings{TargetFileSizeMB: settingPtr(512)}},
+		},
+		MaintenanceTypeIcebergSnapshotManagement: {
+			Status: MaintenanceStatusDisabled,
+			Settings: &MaintenanceSettings{IcebergSnapshotManagement: &IcebergSnapshotManagementSettings{
+				MinSnapshotsToKeep:  settingPtr(3),
+				MaxSnapshotAgeHours: settingPtr(120),
+			}},
+		},
+	}
+
+	data, err := json.Marshal(original)
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+
+	var decoded MaintenanceConfiguration
+	if err := json.Unmarshal(data, &decoded); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+
+	compaction := decoded[MaintenanceTypeIcebergCompaction]
+	if compaction == nil || compaction.Settings == nil || compaction.Settings.IcebergCompaction == nil {
+		t.Fatalf("expected compaction settings, got %s", data)
+	}
+	if got := compaction.Settings.IcebergCompaction.TargetFileSizeMB; got == nil || *got != 512 {
+		t.Errorf("expected targetFileSizeMB=512, got %v", got)
+	}
+
+	snapshots := decoded[MaintenanceTypeIcebergSnapshotManagement]
+	if snapshots == nil || snapshots.Status != MaintenanceStatusDisabled {
+		t.Fatalf("expected snapshot management disabled, got %s", data)
+	}
+	if got := snapshots.Settings.IcebergSnapshotManagement.MaxSnapshotAgeHours; got == nil || *got != 120 {
+		t.Errorf("expected maxSnapshotAgeHours=120, got %v", got)
+	}
+}
+
+// Putting one type must not drop the others already stored.
+func TestMaintenanceConfigurationMergeKeepsOtherTypes(t *testing.T) {
+	stored, err := json.Marshal(MaintenanceConfiguration{
+		MaintenanceTypeIcebergCompaction: {Status: MaintenanceStatusEnabled},
+	})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+
+	config := MaintenanceConfiguration{}
+	if err := json.Unmarshal(stored, &config); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	config[MaintenanceTypeIcebergSnapshotManagement] = &MaintenanceConfigurationValue{Status: MaintenanceStatusDisabled}
+
+	if len(config) != 2 {
+		t.Errorf("expected both types retained, got %+v", config)
+	}
+	if config[MaintenanceTypeIcebergCompaction].Status != MaintenanceStatusEnabled {
+		t.Error("expected the existing compaction entry preserved")
+	}
+}
+
+func TestParseTableTarget(t *testing.T) {
+	h := NewS3TablesHandler()
+	arn := h.generateTableBucketARN(DefaultAccountID, "analytics")
+
+	bucketName, namespaceName, tableName, err := h.parseTableTarget(arn, []string{"sales"}, "orders")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if bucketName != "analytics" || namespaceName != "sales" || tableName != "orders" {
+		t.Errorf("got %q/%q/%q", bucketName, namespaceName, tableName)
+	}
+
+	for name, tc := range map[string]struct {
+		arn       string
+		namespace []string
+		table     string
+	}{
+		"missing arn":       {"", []string{"sales"}, "orders"},
+		"missing namespace": {arn, nil, "orders"},
+		"missing name":      {arn, []string{"sales"}, ""},
+		"bad arn":           {"not-an-arn", []string{"sales"}, "orders"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if _, _, _, err := h.parseTableTarget(tc.arn, tc.namespace, tc.table); err == nil {
+				t.Error("expected rejection")
+			}
+		})
+	}
+}
+
+func TestBuildJobStatusResponseReportsEveryType(t *testing.T) {
+	status := buildJobStatusResponse(nil, nil)
+	if len(status) != 3 {
+		t.Fatalf("expected all three job types reported, got %v", status)
+	}
+	for jobType, value := range status {
+		if value.Status != MaintenanceJobStatusNotYetRun {
+			t.Errorf("expected %s not yet run, got %q", jobType, value.Status)
+		}
+	}
+}
+
+func TestBuildJobStatusResponseDisabledBeatsRecorded(t *testing.T) {
+	recorded := MaintenanceJobStatus{
+		MaintenanceTypeIcebergCompaction:         {Status: MaintenanceJobStatusSuccessful},
+		MaintenanceTypeIcebergSnapshotManagement: {Status: MaintenanceJobStatusFailed, FailureMessage: "boom"},
+	}
+	config := MaintenanceConfiguration{
+		MaintenanceTypeIcebergCompaction: {Status: MaintenanceStatusDisabled},
+	}
+
+	status := buildJobStatusResponse(recorded, config)
+	if status[MaintenanceTypeIcebergCompaction].Status != MaintenanceJobStatusDisabled {
+		t.Errorf("expected a disabled type reported as disabled, got %q", status[MaintenanceTypeIcebergCompaction].Status)
+	}
+	if status[MaintenanceTypeIcebergSnapshotManagement].FailureMessage != "boom" {
+		t.Error("expected the recorded failure preserved")
+	}
+	if status[MaintenanceTypeIcebergUnreferencedFileRemoval].Status != MaintenanceJobStatusNotYetRun {
+		t.Error("expected an unrun type reported as not yet run")
+	}
+}
+
+// A strategy the worker cannot carry out must be rejected, not accepted and
+// silently compacted some other way.
+func TestValidateMaintenanceValueCompactionStrategy(t *testing.T) {
+	for _, strategy := range []string{"", CompactionStrategyAuto, CompactionStrategyBinpack, CompactionStrategySort} {
+		if err := validateMaintenanceValue(MaintenanceTypeIcebergCompaction, tableMaintenanceTypes, &MaintenanceConfigurationValue{
+			Status:   MaintenanceStatusEnabled,
+			Settings: &MaintenanceSettings{IcebergCompaction: &IcebergCompactionSettings{Strategy: strategy}},
+		}); err != nil {
+			t.Errorf("expected strategy %q accepted, got %v", strategy, err)
+		}
+	}
+
+	for _, strategy := range []string{CompactionStrategyZOrder, "nonsense"} {
+		if err := validateMaintenanceValue(MaintenanceTypeIcebergCompaction, tableMaintenanceTypes, &MaintenanceConfigurationValue{
+			Status:   MaintenanceStatusEnabled,
+			Settings: &MaintenanceSettings{IcebergCompaction: &IcebergCompactionSettings{Strategy: strategy}},
+		}); err == nil {
+			t.Errorf("expected strategy %q rejected", strategy)
+		}
+	}
+}
+
+// Put then Get must return the strategy unchanged.
+func TestMaintenanceConfigurationPreservesStrategy(t *testing.T) {
+	data, err := json.Marshal(MaintenanceConfiguration{
+		MaintenanceTypeIcebergCompaction: {
+			Status:   MaintenanceStatusEnabled,
+			Settings: &MaintenanceSettings{IcebergCompaction: &IcebergCompactionSettings{Strategy: CompactionStrategySort, TargetFileSizeMB: settingPtr(512)}},
+		},
+	})
+	if err != nil {
+		t.Fatalf("marshal: %v", err)
+	}
+
+	var decoded MaintenanceConfiguration
+	if err := json.Unmarshal(data, &decoded); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if got := decoded[MaintenanceTypeIcebergCompaction].Settings.IcebergCompaction.Strategy; got != CompactionStrategySort {
+		t.Errorf("expected the strategy preserved, got %q", got)
+	}
+}
+
+// Unreferenced file removal is configured on the bucket, so a bucket-level
+// disable has to surface here rather than a stale table status.
+func TestBuildJobStatusResponseHonoursBucketDisable(t *testing.T) {
+	recorded := MaintenanceJobStatus{
+		MaintenanceTypeIcebergUnreferencedFileRemoval: {Status: MaintenanceJobStatusSuccessful},
+	}
+	bucketConfig := MaintenanceConfiguration{
+		MaintenanceTypeIcebergUnreferencedFileRemoval: {Status: MaintenanceStatusDisabled},
+	}
+
+	status := buildJobStatusResponse(recorded, MergeMaintenanceConfiguration(bucketConfig, nil))
+	if got := status[MaintenanceTypeIcebergUnreferencedFileRemoval].Status; got != MaintenanceJobStatusDisabled {
+		t.Errorf("expected Disabled from the bucket configuration, got %q", got)
+	}
+}
+
+func TestMergeMaintenanceConfiguration(t *testing.T) {
+	bucket := MaintenanceConfiguration{
+		MaintenanceTypeIcebergUnreferencedFileRemoval: {Status: MaintenanceStatusEnabled},
+		MaintenanceTypeIcebergCompaction:              {Status: MaintenanceStatusEnabled},
+	}
+	table := MaintenanceConfiguration{
+		MaintenanceTypeIcebergCompaction: {Status: MaintenanceStatusDisabled},
+	}
+
+	merged := MergeMaintenanceConfiguration(bucket, table)
+	if merged[MaintenanceTypeIcebergCompaction].Status != MaintenanceStatusDisabled {
+		t.Error("expected the table entry to win")
+	}
+	if merged[MaintenanceTypeIcebergUnreferencedFileRemoval].Status != MaintenanceStatusEnabled {
+		t.Error("expected the bucket-only entry retained")
+	}
+	if got := MergeMaintenanceConfiguration(nil, table); len(got) != 1 {
+		t.Errorf("expected the table configuration passed through, got %v", got)
+	}
+	if got := MergeMaintenanceConfiguration(bucket, nil); len(got) != 2 {
+		t.Errorf("expected the bucket configuration passed through, got %v", got)
+	}
+}
+
+// UpdateEntry rewrites the whole entry, so the precondition has to cover every
+// attribute this package stores — including the ones absent right now, which a
+// concurrent writer can create and this write would then delete.
+func TestSnapshotExtendedCoversEveryAttribute(t *testing.T) {
+	extended := map[string][]byte{
+		ExtendedKeyMetadata:    []byte(`{"a":1}`),
+		ExtendedKeyMaintenance: []byte(`{"icebergCompaction":{"status":"disabled"}}`),
+	}
+
+	expected := SnapshotExtended(extended, ExtendedKeyMaintenanceStatus)
+
+	for key, want := range extended {
+		if string(expected[key]) != string(want) {
+			t.Errorf("attribute %s not carried into the precondition", key)
+		}
+	}
+	for _, key := range s3tablesExtendedKeys {
+		if _, ok := expected[key]; !ok {
+			t.Errorf("attribute %s missing from the precondition", key)
+		}
+	}
+
+	// The absent ones are asserted absent, so a concurrent create fails the write.
+	for _, key := range []string{ExtendedKeyMaintenanceStatus, ExtendedKeyPolicy, ExtendedKeyTags} {
+		if got, ok := expected[key]; !ok || len(got) != 0 {
+			t.Errorf("expected %s asserted absent, got %v", key, got)
+		}
+	}
+
+	// Mutating the snapshot must not disturb the entry it came from.
+	expected[ExtendedKeyMetadata] = []byte("changed")
+	if string(extended[ExtendedKeyMetadata]) != `{"a":1}` {
+		t.Error("expected the source map left alone")
+	}
+}
+
+// The regression this closes: a maintenance configuration that did not exist
+// when the writer read the entry must still be asserted, or a first-time
+// disable lands between the read and the write and gets erased.
+func TestSnapshotExtendedAssertsAbsentMaintenanceKey(t *testing.T) {
+	expected := SnapshotExtended(map[string][]byte{ExtendedKeyMetadata: []byte(`{}`)})
+
+	value, ok := expected[ExtendedKeyMaintenance]
+	if !ok {
+		t.Fatal("expected the maintenance key asserted even when absent")
+	}
+	if len(value) != 0 {
+		t.Errorf("expected an absent assertion, got %v", value)
+	}
+}
+
+// AWS bounds every numeric setting to 1..2147483647. Accepting anything else
+// would store a value the worker ignores or saturates, so the configuration
+// read back would not be the one that runs.
+func TestValidateMaintenanceSettingRange(t *testing.T) {
+	compaction := func(v *int64) error {
+		return validateMaintenanceValue(MaintenanceTypeIcebergCompaction, tableMaintenanceTypes, &MaintenanceConfigurationValue{
+			Status:   MaintenanceStatusEnabled,
+			Settings: &MaintenanceSettings{IcebergCompaction: &IcebergCompactionSettings{TargetFileSizeMB: v}},
+		})
+	}
+
+	if err := compaction(nil); err != nil {
+		t.Errorf("expected an unset setting accepted, got %v", err)
+	}
+	for _, v := range []int64{1, 512, maintenanceSettingMax} {
+		if err := compaction(settingPtr(v)); err != nil {
+			t.Errorf("expected %d accepted, got %v", v, err)
+		}
+	}
+	for _, v := range []int64{0, -1, maintenanceSettingMax + 1, 1 << 62} {
+		if err := compaction(settingPtr(v)); err == nil {
+			t.Errorf("expected %d rejected", v)
+		}
+	}
+}
+
+func TestValidateMaintenanceSettingRangeCoversEveryField(t *testing.T) {
+	cases := map[string]*MaintenanceSettings{
+		"minSnapshotsToKeep":  {IcebergSnapshotManagement: &IcebergSnapshotManagementSettings{MinSnapshotsToKeep: settingPtr(0)}},
+		"maxSnapshotAgeHours": {IcebergSnapshotManagement: &IcebergSnapshotManagementSettings{MaxSnapshotAgeHours: settingPtr(-5)}},
+		"unreferencedDays":    {IcebergUnreferencedFileRemoval: &IcebergUnreferencedFileRemovalSettings{UnreferencedDays: settingPtr(maintenanceSettingMax + 1)}},
+		"nonCurrentDays":      {IcebergUnreferencedFileRemoval: &IcebergUnreferencedFileRemovalSettings{NonCurrentDays: settingPtr(0)}},
+	}
+
+	for name, settings := range cases {
+		t.Run(name, func(t *testing.T) {
+			if err := validateMaintenanceSettings(settings); err == nil {
+				t.Errorf("expected %s out of range to be rejected", name)
+			}
+		})
+	}
+}
+
+// An explicit zero has to be distinguishable from an omitted field, or it is
+// silently accepted and then ignored.
+func TestMaintenanceSettingsDistinguishZeroFromUnset(t *testing.T) {
+	var decoded MaintenanceSettings
+	if err := json.Unmarshal([]byte(`{"icebergCompaction":{"targetFileSizeMB":0}}`), &decoded); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if decoded.IcebergCompaction.TargetFileSizeMB == nil {
+		t.Fatal("expected an explicit zero to survive decoding")
+	}
+
+	var omitted MaintenanceSettings
+	if err := json.Unmarshal([]byte(`{"icebergCompaction":{}}`), &omitted); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if omitted.IcebergCompaction.TargetFileSizeMB != nil {
+		t.Error("expected an omitted field to stay unset")
+	}
+}
+
+// aws-cn and aws-us-gov ARNs are valid and must parse; the emitted ARN has to
+// use the partition its region belongs to so it round-trips.
+func TestARNPartitionsBeyondCommercial(t *testing.T) {
+	for _, arn := range []string{
+		"arn:aws:s3tables:us-east-1:123456789012:bucket/analytics",
+		"arn:aws-cn:s3tables:cn-north-1:123456789012:bucket/analytics",
+		"arn:aws-us-gov:s3tables:us-gov-west-1:123456789012:bucket/analytics",
+	} {
+		got, err := parseBucketNameFromARN(arn)
+		if err != nil {
+			t.Errorf("expected %s to parse, got %v", arn, err)
+			continue
+		}
+		if got != "analytics" {
+			t.Errorf("expected bucket analytics from %s, got %q", arn, got)
+		}
+	}
+
+	if _, err := parseBucketNameFromARN("arn:notaws:s3tables:us-east-1:123456789012:bucket/analytics"); err == nil {
+		t.Error("expected a non-AWS partition to be rejected")
+	}
+}
+
+func TestARNPartitionForRegion(t *testing.T) {
+	for region, want := range map[string]string{
+		"us-east-1":       "aws",
+		"eu-west-2":       "aws",
+		"cn-north-1":      "aws-cn",
+		"cn-northwest-1":  "aws-cn",
+		"us-gov-west-1":   "aws-us-gov",
+		"us-iso-east-1":   "aws-iso",
+		"us-isob-east-1":  "aws-iso-b",
+		"eu-isoe-west-1":  "aws-iso-e",
+		"us-isof-south-1": "aws-iso-f",
+		"eusc-de-east-1":  "aws-eusc",
+	} {
+		if got := arnPartitionForRegion(region); got != want {
+			t.Errorf("region %s: expected partition %q, got %q", region, want, got)
+		}
+	}
+}
+
+// An ARN this handler emits has to carry the partition its region belongs to,
+// not just parse back — a commercial ARN returned for a gov region still parses
+// but is wrong for IAM matching and for the caller.
+func TestGeneratedARNsUseTheRegionPartition(t *testing.T) {
+	for region, partition := range map[string]string{
+		"us-east-1":     "aws",
+		"cn-north-1":    "aws-cn",
+		"us-gov-west-1": "aws-us-gov",
+	} {
+		h := NewS3TablesHandler()
+		h.SetRegion(region)
+
+		bucketARN := h.generateTableBucketARN(DefaultAccountID, "analytics")
+		tableARN := h.generateTableARN(DefaultAccountID, "analytics", "sales/orders")
+		viewARN := h.generateViewARN(DefaultAccountID, "analytics", "sales/v1")
+		s3ARN := h.generateS3BucketARN("analytics")
+
+		for _, arn := range []string{bucketARN, tableARN, viewARN, s3ARN} {
+			if !strings.HasPrefix(arn, "arn:"+partition+":") {
+				t.Errorf("region %s: expected partition %q, got %s", region, partition, arn)
+			}
+		}
+
+		got, err := parseBucketNameFromARN(bucketARN)
+		if err != nil {
+			t.Errorf("generated ARN %s does not parse: %v", bucketARN, err)
+			continue
+		}
+		if got != "analytics" {
+			t.Errorf("expected analytics from %s, got %q", bucketARN, got)
+		}
+
+		bucket, namespace, table, err := parseTableFromARN(tableARN)
+		if err != nil {
+			t.Errorf("generated table ARN %s does not parse: %v", tableARN, err)
+			continue
+		}
+		if bucket != "analytics" || namespace != "sales" || table != "orders" {
+			t.Errorf("unexpected parse of %s: %s/%s/%s", tableARN, bucket, namespace, table)
+		}
+	}
+}
diff --git a/weed/s3api/s3tables/handler_namespace.go b/weed/s3api/s3tables/handler_namespace.go
index 8a825c510c..7aceece5ca 100644
--- a/weed/s3api/s3tables/handler_namespace.go
+++ b/weed/s3api/s3tables/handler_namespace.go
@@ -11,14 +11,34 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 )
 
+// errOwnerlessBucket marks a table bucket that has the marker but no
+// metadata: damaged, and answered with the operation's own denial rather than
+// letting the caller name itself the bucket's owner before any check runs.
+var errOwnerlessBucket = fmt.Errorf("table bucket has no owner metadata")
+
+// mayRepairOwnerlessBucket reports whether the caller may repair a bucket in
+// that state: the admin or a trusted internal handler. hasAdminAction also
+// answers s3tables:*, an operation grant, not administrator status.
+func (h *S3TablesHandler) mayRepairOwnerlessBucket(r *http.Request) bool {
+	if h.trusted || h.getAccountID(r) == s3_constants.AccountAdminId {
+		return true
+	}
+	for _, action := range getIdentityActions(r) {
+		if action == s3_constants.ACTION_ADMIN {
+			return true
+		}
+	}
+	return false
+}
+
 // handleCreateNamespace creates a new namespace in a table bucket
 func (h *S3TablesHandler) handleCreateNamespace(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
-	glog.Errorf("S3Tables: handleCreateNamespace called")
+	glog.V(3).Infof("S3Tables: handleCreateNamespace called")
 	var req CreateNamespaceRequest
 	if err := h.readRequestBody(r, &req); err != nil {
-		glog.Errorf("S3Tables: handleCreateNamespace failed to read request body: %v", err)
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
 		return err
 	}
@@ -66,16 +86,29 @@ func (h *S3TablesHandler) handleCreateNamespace(w http.ResponseWriter, r *http.R
 				if entryResp.Entry == nil || !IsTableBucketEntry(entryResp.Entry) {
 					return filer_pb.ErrNotFound
 				}
-				bucketMetadata = tableBucketMetadata{
-					Name:           bucketName,
-					CreatedAt:      time.Now(),
-					OwnerAccountID: ownerAccountID,
+				if !h.mayRepairOwnerlessBucket(r) {
+					return errOwnerlessBucket
 				}
-				metadataBytes, err := json.Marshal(&bucketMetadata)
-				if err != nil {
-					return fmt.Errorf("failed to marshal bucket metadata: %w", err)
-				}
-				if err := h.setExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata, metadataBytes); err != nil {
+				// Repair the marker-only entry under the entry lock so a
+				// creator finishing its own create in the meantime keeps its
+				// owner: adopt whatever metadata is there, write only when it
+				// is still absent.
+				if err := h.mutateEntryExtended(r.Context(), client, bucketPath, func(extended map[string][]byte) error {
+					if data, ok := extended[ExtendedKeyMetadata]; ok {
+						return json.Unmarshal(data, &bucketMetadata)
+					}
+					bucketMetadata = tableBucketMetadata{
+						Name:           bucketName,
+						CreatedAt:      time.Now(),
+						OwnerAccountID: ownerAccountID,
+					}
+					metadataBytes, err := json.Marshal(&bucketMetadata)
+					if err != nil {
+						return fmt.Errorf("failed to marshal bucket metadata: %w", err)
+					}
+					extended[ExtendedKeyMetadata] = metadataBytes
+					return nil
+				}); err != nil {
 					return err
 				}
 			} else {
@@ -101,7 +134,15 @@ func (h *S3TablesHandler) handleCreateNamespace(w http.ResponseWriter, r *http.R
 	})
 
 	if err != nil {
+		if errors.Is(err, errOwnerlessBucket) {
+			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create namespace in this bucket")
+			return ErrAccessDenied
+		}
 		if errors.Is(err, filer_pb.ErrNotFound) {
+			if !h.authorizeAbsentTarget(r, filerClient, "CreateNamespace", bucketName, namespaceName, "", "") {
+				h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create namespace in this bucket")
+				return ErrAccessDenied
+			}
 			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
 		} else {
 			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to check table bucket: %v", err))
@@ -114,11 +155,13 @@ func (h *S3TablesHandler) handleCreateNamespace(w http.ResponseWriter, r *http.R
 	identityActions := getIdentityActions(r)
 	glog.Infof("S3Tables: CreateNamespace permission check - principal=%s, owner=%s, actions=%v", principal, bucketMetadata.OwnerAccountID, identityActions)
 	if !CheckPermissionWithContext("CreateNamespace", principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableBucketTags:  bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
 		glog.Infof("S3Tables: Permission denied for CreateNamespace - principal=%s, owner=%s", principal, bucketMetadata.OwnerAccountID)
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create namespace in this bucket")
@@ -157,20 +200,22 @@ func (h *S3TablesHandler) handleCreateNamespace(w http.ResponseWriter, r *http.R
 		return fmt.Errorf("failed to marshal metadata: %w", err)
 	}
 
+	var taken error
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		// Create namespace directory
-		if err := h.createDirectory(r.Context(), client, namespacePath); err != nil {
-			return err
+		err := h.createDirectoryExclusive(r.Context(), client, namespacePath, map[string][]byte{ExtendedKeyMetadata: metadataBytes})
+		if errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+			taken = err // an answer, not a filer failure
+			return nil
 		}
-
-		// Set metadata as extended attribute
-		if err := h.setExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyMetadata, metadataBytes); err != nil {
-			return err
-		}
-
-		return nil
+		return err
 	})
-
+	if err == nil && taken != nil {
+		err = taken
+	}
+	if errors.Is(err, filer_pb.ErrEntryAlreadyExists) {
+		h.writeError(w, http.StatusConflict, ErrCodeNamespaceAlreadyExists, fmt.Sprintf("namespace %s already exists", namespaceName))
+		return err
+	}
 	if err != nil {
 		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to create namespace")
 		return err
@@ -255,13 +300,15 @@ func (h *S3TablesHandler) handleGetNamespace(w http.ResponseWriter, r *http.Requ
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	if !CheckPermissionWithContext("GetNamespace", principal, metadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableBucketTags:  bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
-		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, "namespace not found")
+		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", flattenNamespace(req.Namespace)))
 		return ErrAccessDenied
 	}
 
@@ -345,13 +392,15 @@ func (h *S3TablesHandler) handleUpdateNamespace(w http.ResponseWriter, r *http.R
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	if !CheckPermissionWithContext("UpdateNamespace", principal, metadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableBucketTags:  bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to update namespace")
+		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", flattenNamespace(req.Namespace)))
 		return ErrAccessDenied
 	}
 
@@ -435,7 +484,7 @@ func (h *S3TablesHandler) handleListNamespaces(w http.ResponseWriter, r *http.Re
 	})
 
 	if err != nil {
-		if errors.Is(err, filer_pb.ErrNotFound) {
+		if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrAttributeNotFound) {
 			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
 		} else {
 			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to list namespaces: %v", err))
@@ -447,10 +496,12 @@ func (h *S3TablesHandler) handleListNamespaces(w http.ResponseWriter, r *http.Re
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	if !CheckPermissionWithContext("ListNamespaces", principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		TableBucketTags:  bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
 		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchBucket, fmt.Sprintf("table bucket %s not found", bucketName))
 		return ErrAccessDenied
@@ -631,13 +682,15 @@ func (h *S3TablesHandler) handleDeleteNamespace(w http.ResponseWriter, r *http.R
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	if !CheckPermissionWithContext("DeleteNamespace", principal, metadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableBucketTags:  bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
-		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, "namespace not found")
+		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", flattenNamespace(req.Namespace)))
 		return ErrAccessDenied
 	}
 
diff --git a/weed/s3api/s3tables/handler_namespace_resolution_test.go b/weed/s3api/s3tables/handler_namespace_resolution_test.go
new file mode 100644
index 0000000000..be2ac9aa87
--- /dev/null
+++ b/weed/s3api/s3tables/handler_namespace_resolution_test.go
@@ -0,0 +1,45 @@
+package s3tables
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+)
+
+// A directory under a table bucket that carries no namespace metadata is not a
+// namespace. Reporting that as an internal error, which is what the three
+// callers of this did while each testing only for a missing entry, turns a
+// client mistake into a 500 and hides it behind "attribute not found".
+func TestLoadNamespaceMetadataTreatsMissingAttributeAsAbsent(t *testing.T) {
+	filer := s3tablestest.Start(t)
+	handler := NewS3TablesHandler()
+	client := NewManagerClient(filer.Client)
+	ctx := context.Background()
+
+	filer.Put(TablesPath, "bkt", map[string][]byte{ExtendedKeyTableBucket: []byte("{}")})
+
+	// A stray directory where a namespace would live, with no metadata on it.
+	filer.Put(GetTableBucketPath("bkt"), "stray", nil)
+
+	if _, err := handler.loadNamespaceMetadata(ctx, client, "bkt", "stray"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("loadNamespaceMetadata on a directory without metadata = %v, want ErrNotFound", err)
+	}
+
+	if _, err := handler.loadNamespaceMetadata(ctx, client, "bkt", "absent"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("loadNamespaceMetadata on a missing directory = %v, want ErrNotFound", err)
+	}
+
+	filer.Put(GetTableBucketPath("bkt"), "real", map[string][]byte{
+		ExtendedKeyMetadata: []byte(`{"namespace":["real"],"ownerAccountId":"000000000000"}`),
+	})
+	metadata, err := handler.loadNamespaceMetadata(ctx, client, "bkt", "real")
+	if err != nil {
+		t.Fatalf("loadNamespaceMetadata on a real namespace: %v", err)
+	}
+	if metadata.OwnerAccountID != "000000000000" {
+		t.Fatalf("owner = %q, want the stored one", metadata.OwnerAccountID)
+	}
+}
diff --git a/weed/s3api/s3tables/handler_no_trace_errorf_test.go b/weed/s3api/s3tables/handler_no_trace_errorf_test.go
new file mode 100644
index 0000000000..3f4f34bb2b
--- /dev/null
+++ b/weed/s3api/s3tables/handler_no_trace_errorf_test.go
@@ -0,0 +1,39 @@
+package s3tables
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// glog.Errorf with a constant message and no format verb is a trace, not an
+// error report: every CreateNamespace call logged
+// "S3Tables: handleCreateNamespace called" at ERROR.
+func TestNoTraceLoggedAtErrorLevel(t *testing.T) {
+	files, err := filepath.Glob("*.go")
+	if err != nil || len(files) == 0 {
+		t.Fatalf("no sources found (%v)", err) // positive control: the scan must see the package
+	}
+	re := regexp.MustCompile(`glog\.Errorf\("([^"]*)"\)`)
+	scanned := 0
+	for _, f := range files {
+		if strings.HasSuffix(f, "_test.go") {
+			continue
+		}
+		b, err := os.ReadFile(f)
+		if err != nil {
+			t.Fatal(err)
+		}
+		scanned++
+		for _, m := range re.FindAllStringSubmatch(string(b), -1) {
+			if !strings.Contains(m[1], "%") {
+				t.Errorf("%s: glog.Errorf(%q) logs a constant trace at ERROR; use glog.V(n).Infof", f, m[1])
+			}
+		}
+	}
+	if scanned < 5 {
+		t.Fatalf("scanned only %d source files", scanned)
+	}
+}
diff --git a/weed/s3api/s3tables/handler_ownerless_test.go b/weed/s3api/s3tables/handler_ownerless_test.go
new file mode 100644
index 0000000000..97c2079196
--- /dev/null
+++ b/weed/s3api/s3tables/handler_ownerless_test.go
@@ -0,0 +1,88 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A table bucket with the marker but no metadata is damaged, not ownerless for
+// the taking: an ordinary caller is answered with the operation's own denial,
+// and the admin or a trusted handler may repair it.
+func TestCreateNamespaceOnAnOwnerlessBucket(t *testing.T) {
+	const bucket = "broken"
+	plant := func(fs *s3tablestest.MemFiler) {
+		fs.Put(TablesPath, bucket, map[string][]byte{ExtendedKeyTableBucket: []byte("true")})
+	}
+	arn, err := BuildBucketARN(DefaultRegion, DefaultAccountID, bucket)
+	require.NoError(t, err)
+	request := &CreateNamespaceRequest{TableBucketARN: arn, Namespace: []string{"ns"}}
+
+	t.Run("an outsider gets the denial and writes nothing", func(t *testing.T) {
+		fs := s3tablestest.Start(t)
+		plant(fs)
+		m := NewManager()
+		body, err := json.Marshal(request)
+		require.NoError(t, err)
+		identity := &testIdentity{Name: "outsider", Account: &testIdentityAccount{Id: "outsider"}, Actions: []string{"Read"}}
+		req, err := newManagerRequest(s3_constants.SetIdentityInContext(context.Background(), identity), "CreateNamespace", body, "outsider")
+		require.NoError(t, err)
+
+		recorder := httptest.NewRecorder()
+		m.handler.HandleRequest(recorder, req, NewManagerClient(fs.Client))
+		assert.Equal(t, http.StatusForbidden, recorder.Code, recorder.Body.String())
+		entry := fs.Get(TablesPath, bucket)
+		require.NotNil(t, entry)
+		assert.Empty(t, entry.Extended[ExtendedKeyMetadata], "the denied caller wrote itself in as the bucket owner")
+		assert.Nil(t, fs.Get(GetTableBucketPath(bucket), "ns"))
+	})
+
+	t.Run("a trusted handler repairs it and owns it", func(t *testing.T) {
+		fs := s3tablestest.Start(t)
+		plant(fs)
+		m := NewManager()
+		m.SetTrusted(true)
+		body, err := json.Marshal(request)
+		require.NoError(t, err)
+		identity := &testIdentity{Name: "svc", Account: &testIdentityAccount{Id: "svc"}, Actions: []string{"Read"}}
+		req, err := newManagerRequest(s3_constants.SetIdentityInContext(context.Background(), identity), "CreateNamespace", body, "svc")
+		require.NoError(t, err)
+
+		recorder := httptest.NewRecorder()
+		m.handler.HandleRequest(recorder, req, NewManagerClient(fs.Client))
+		assert.Equal(t, http.StatusOK, recorder.Code, recorder.Body.String())
+		entry := fs.Get(TablesPath, bucket)
+		require.NotNil(t, entry)
+		var metadata tableBucketMetadata
+		require.NoError(t, json.Unmarshal(entry.Extended[ExtendedKeyMetadata], &metadata))
+		assert.Equal(t, "svc", metadata.OwnerAccountID)
+		require.NotNil(t, fs.Get(GetTableBucketPath(bucket), "ns"))
+	})
+
+	t.Run("an untrusted admin repairs it too", func(t *testing.T) {
+		fs := s3tablestest.Start(t)
+		plant(fs)
+		m := NewManager()
+		body, err := json.Marshal(request)
+		require.NoError(t, err)
+		identity := &testIdentity{Name: "admin", Account: &testIdentityAccount{Id: s3_constants.AccountAdminId}, Actions: []string{"Admin"}}
+		req, err := newManagerRequest(s3_constants.SetIdentityInContext(context.Background(), identity), "CreateNamespace", body, "admin")
+		require.NoError(t, err)
+
+		recorder := httptest.NewRecorder()
+		m.handler.HandleRequest(recorder, req, NewManagerClient(fs.Client))
+		assert.Equal(t, http.StatusOK, recorder.Code, recorder.Body.String())
+		entry := fs.Get(TablesPath, bucket)
+		require.NotNil(t, entry)
+		var metadata tableBucketMetadata
+		require.NoError(t, json.Unmarshal(entry.Extended[ExtendedKeyMetadata], &metadata))
+		assert.Equal(t, s3_constants.AccountAdminId, metadata.OwnerAccountID)
+	})
+}
diff --git a/weed/s3api/s3tables/handler_policy.go b/weed/s3api/s3tables/handler_policy.go
index c749412efd..c152b209a9 100644
--- a/weed/s3api/s3tables/handler_policy.go
+++ b/weed/s3api/s3tables/handler_policy.go
@@ -1,6 +1,7 @@
 package s3tables
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -68,6 +69,8 @@ func (h *S3TablesHandler) handlePutTableBucketPolicy(w http.ResponseWriter, r *h
 	// Check if bucket exists and get metadata for ownership check
 	bucketPath := GetTableBucketPath(bucketName)
 	var bucketMetadata tableBucketMetadata
+	var bucketPolicy string
+	var bucketTags map[string]string
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		data, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata)
 		if err != nil {
@@ -76,7 +79,11 @@ func (h *S3TablesHandler) handlePutTableBucketPolicy(w http.ResponseWriter, r *h
 		if err := json.Unmarshal(data, &bucketMetadata); err != nil {
 			return fmt.Errorf("failed to unmarshal bucket metadata: %w", err)
 		}
-		return nil
+		if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+			return err
+		}
+		bucketTags, err = h.readTags(r.Context(), client, bucketPath)
+		return err
 	})
 
 	if err != nil {
@@ -91,22 +98,39 @@ func (h *S3TablesHandler) handlePutTableBucketPolicy(w http.ResponseWriter, r *h
 	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
-	if !CheckPermissionWithContext("PutTableBucketPolicy", principal, bucketMetadata.OwnerAccountID, "", bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	}) {
+	ctx := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		TableBucketTags:  bucketTags,
+		ResourceTags:     bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	if deniedByPolicy("PutTableBucketPolicy", principal, bucketPolicy, bucketARN, ctx) ||
+		!CheckPermissionWithContext("PutTableBucketPolicy", principal, bucketMetadata.OwnerAccountID, "", bucketARN, ctx) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to put table bucket policy")
 		return NewAuthError("PutTableBucketPolicy", principal, "not authorized to put table bucket policy")
 	}
 
-	// Write policy
+	// Conditional on the policy this request was authorized against: a Deny
+	// landing mid-request sends the caller back through authorization.
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		return h.setExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy, []byte(req.ResourcePolicy))
+		return h.mutateEntryExtended(r.Context(), client, bucketPath, func(extended map[string][]byte) error {
+			if !bytes.Equal(extended[ExtendedKeyPolicy], []byte(bucketPolicy)) {
+				return fmt.Errorf("%w: %s", ErrConcurrentUpdate, ExtendedKeyPolicy)
+			}
+			extended[ExtendedKeyPolicy] = []byte(req.ResourcePolicy)
+			return nil
+		})
 	})
 
 	if err != nil {
-		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to put table bucket policy")
+		if errors.Is(err, ErrConcurrentUpdate) {
+			h.writeError(w, http.StatusConflict, ErrCodeConflict, "table bucket policy changed concurrently, retry the request")
+		} else {
+			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to put table bucket policy")
+		}
 		return err
 	}
 
@@ -170,9 +194,11 @@ func (h *S3TablesHandler) handleGetTableBucketPolicy(w http.ResponseWriter, r *h
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	if !CheckPermissionWithContext("GetTableBucketPolicy", principal, bucketMetadata.OwnerAccountID, string(policy), bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to get table bucket policy")
 		return NewAuthError("GetTableBucketPolicy", principal, "not authorized to get table bucket policy")
@@ -246,9 +272,11 @@ func (h *S3TablesHandler) handleDeleteTableBucketPolicy(w http.ResponseWriter, r
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 	if !CheckPermissionWithContext("DeleteTableBucketPolicy", principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to delete table bucket policy")
 		return NewAuthError("DeleteTableBucketPolicy", principal, "not authorized to delete table bucket policy")
@@ -308,7 +336,8 @@ func (h *S3TablesHandler) handlePutTablePolicy(w http.ResponseWriter, r *http.Re
 	bucketPath := GetTableBucketPath(bucketName)
 
 	var metadata tableMetadataInternal
-	var bucketPolicy string
+	var bucketPolicy, tablePolicy string
+	var bucketTags, tableTags map[string]string
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		data, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyMetadata)
 		if err != nil {
@@ -318,18 +347,17 @@ func (h *S3TablesHandler) handlePutTablePolicy(w http.ResponseWriter, r *http.Re
 			return fmt.Errorf("failed to unmarshal table metadata: %w", err)
 		}
 
-		// Fetch bucket policy if it exists
-		policyData, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-		if err != nil {
-			if !errors.Is(err, ErrAttributeNotFound) {
-				return fmt.Errorf("failed to read bucket policy: %w", err)
-			}
-			// Policy not found is not an error; bucketPolicy remains empty
-		} else {
-			bucketPolicy = string(policyData)
+		if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+			return err
 		}
-
-		return nil
+		if bucketTags, err = h.readTags(r.Context(), client, bucketPath); err != nil {
+			return err
+		}
+		if tablePolicy, err = h.readPolicy(r, client, tablePath); err != nil {
+			return err
+		}
+		tableTags, err = h.readTags(r.Context(), client, tablePath)
+		return err
 	})
 
 	if err != nil {
@@ -344,24 +372,39 @@ func (h *S3TablesHandler) handlePutTablePolicy(w http.ResponseWriter, r *http.Re
 	tableARN := h.generateTableARN(metadata.OwnerAccountID, bucketName, namespaceName+"/"+tableName)
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
-	if !CheckPermissionWithContext("PutTablePolicy", principal, metadata.OwnerAccountID, bucketPolicy, tableARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	}) {
+	ctx := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableName:        tableName,
+		TableBucketTags:  bucketTags,
+		ResourceTags:     tableTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	if deniedByPolicy("PutTablePolicy", principal, tablePolicy, tableARN, ctx) ||
+		!CheckPermissionWithContext("PutTablePolicy", principal, metadata.OwnerAccountID, bucketPolicy, tableARN, ctx) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to put table policy")
 		return NewAuthError("PutTablePolicy", principal, "not authorized to put table policy")
 	}
 
-	// Write policy
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		return h.setExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyPolicy, []byte(req.ResourcePolicy))
+		return h.mutateEntryExtended(r.Context(), client, tablePath, func(extended map[string][]byte) error {
+			if !bytes.Equal(extended[ExtendedKeyPolicy], []byte(tablePolicy)) {
+				return fmt.Errorf("%w: %s", ErrConcurrentUpdate, ExtendedKeyPolicy)
+			}
+			extended[ExtendedKeyPolicy] = []byte(req.ResourcePolicy)
+			return nil
+		})
 	})
 
 	if err != nil {
-		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to put table policy")
+		if errors.Is(err, ErrConcurrentUpdate) {
+			h.writeError(w, http.StatusConflict, ErrCodeConflict, "table policy changed concurrently, retry the request")
+		} else {
+			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to put table policy")
+		}
 		return err
 	}
 
@@ -405,6 +448,7 @@ func (h *S3TablesHandler) handleGetTablePolicy(w http.ResponseWriter, r *http.Re
 	var policy []byte
 	var metadata tableMetadataInternal
 	var bucketPolicy string
+	var bucketTags, tableTags map[string]string
 
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		// Get metadata for ownership check
@@ -422,18 +466,14 @@ func (h *S3TablesHandler) handleGetTablePolicy(w http.ResponseWriter, r *http.Re
 			return err
 		}
 
-		// Fetch bucket policy if it exists
-		policyData, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-		if err != nil {
-			if !errors.Is(err, ErrAttributeNotFound) {
-				return fmt.Errorf("failed to read bucket policy: %w", err)
-			}
-			// Policy not found is not an error; bucketPolicy remains empty
-		} else {
-			bucketPolicy = string(policyData)
+		if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+			return err
 		}
-
-		return nil
+		if bucketTags, err = h.readTags(r.Context(), client, bucketPath); err != nil {
+			return err
+		}
+		tableTags, err = h.readTags(r.Context(), client, tablePath)
+		return err
 	})
 
 	if err != nil {
@@ -452,13 +492,19 @@ func (h *S3TablesHandler) handleGetTablePolicy(w http.ResponseWriter, r *http.Re
 	tableARN := h.generateTableARN(metadata.OwnerAccountID, bucketName, namespaceName+"/"+tableName)
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
-	if !CheckPermissionWithContext("GetTablePolicy", principal, metadata.OwnerAccountID, bucketPolicy, tableARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	}) {
+	ctx := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableName:        tableName,
+		TableBucketTags:  bucketTags,
+		ResourceTags:     tableTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	if deniedByPolicy("GetTablePolicy", principal, string(policy), tableARN, ctx) ||
+		!CheckPermissionWithContext("GetTablePolicy", principal, metadata.OwnerAccountID, bucketPolicy, tableARN, ctx) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to get table policy")
 		return NewAuthError("GetTablePolicy", principal, "not authorized to get table policy")
 	}
@@ -507,7 +553,8 @@ func (h *S3TablesHandler) handleDeleteTablePolicy(w http.ResponseWriter, r *http
 
 	// Check if table exists
 	var metadata tableMetadataInternal
-	var bucketPolicy string
+	var bucketPolicy, tablePolicy string
+	var bucketTags, tableTags map[string]string
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		data, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyMetadata)
 		if err != nil {
@@ -517,18 +564,17 @@ func (h *S3TablesHandler) handleDeleteTablePolicy(w http.ResponseWriter, r *http
 			return fmt.Errorf("failed to unmarshal table metadata: %w", err)
 		}
 
-		// Fetch bucket policy if it exists
-		policyData, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-		if err != nil {
-			if !errors.Is(err, ErrAttributeNotFound) {
-				return fmt.Errorf("failed to read bucket policy: %w", err)
-			}
-			// Policy not found is not an error; bucketPolicy remains empty
-		} else {
-			bucketPolicy = string(policyData)
+		if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+			return err
 		}
-
-		return nil
+		if bucketTags, err = h.readTags(r.Context(), client, bucketPath); err != nil {
+			return err
+		}
+		if tablePolicy, err = h.readPolicy(r, client, tablePath); err != nil {
+			return err
+		}
+		tableTags, err = h.readTags(r.Context(), client, tablePath)
+		return err
 	})
 	if err != nil {
 		if errors.Is(err, filer_pb.ErrNotFound) {
@@ -542,23 +588,35 @@ func (h *S3TablesHandler) handleDeleteTablePolicy(w http.ResponseWriter, r *http
 	tableARN := h.generateTableARN(metadata.OwnerAccountID, bucketName, namespaceName+"/"+tableName)
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
-	if !CheckPermissionWithContext("DeleteTablePolicy", principal, metadata.OwnerAccountID, bucketPolicy, tableARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	}) {
+	ctx := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableName:        tableName,
+		TableBucketTags:  bucketTags,
+		ResourceTags:     tableTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	if deniedByPolicy("DeleteTablePolicy", principal, tablePolicy, tableARN, ctx) ||
+		!CheckPermissionWithContext("DeleteTablePolicy", principal, metadata.OwnerAccountID, bucketPolicy, tableARN, ctx) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to delete table policy")
 		return NewAuthError("DeleteTablePolicy", principal, "not authorized to delete table policy")
 	}
 
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		return h.deleteExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyPolicy)
+		return h.removeExtendedAttributesIf(r.Context(), client, tablePath,
+			map[string][]byte{ExtendedKeyPolicy: []byte(tablePolicy)},
+			ExtendedKeyPolicy)
 	})
 
 	if err != nil && !errors.Is(err, ErrAttributeNotFound) {
-		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to delete table policy")
+		if errors.Is(err, ErrConcurrentUpdate) {
+			h.writeError(w, http.StatusConflict, ErrCodeConflict, "table policy changed concurrently, retry the request")
+		} else {
+			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to delete table policy")
+		}
 		return err
 	}
 
@@ -593,13 +651,17 @@ func (h *S3TablesHandler) handleTagResource(w http.ResponseWriter, r *http.Reque
 
 	// Read existing tags and merge, AND check permissions based on metadata ownership
 	existingTags := make(map[string]string)
-	var bucketPolicy string
+	var bucketPolicy, tablePolicy string
 	var bucketTags map[string]string
+	var tableNamespace, tableName string
 	requestTagKeys := mapKeys(req.Tags)
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		// Read metadata for ownership check
 		data, err := h.getExtendedAttribute(r.Context(), client, resourcePath, ExtendedKeyMetadata)
 		if err != nil {
+			if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrAttributeNotFound) {
+				return h.absentTagTargetError(r, client, "TagResource", "not authorized to tag resource", req.ResourceARN, rType)
+			}
 			return err
 		}
 
@@ -611,14 +673,8 @@ func (h *S3TablesHandler) handleTagResource(w http.ResponseWriter, r *http.Reque
 		// Fetch bucket policy if we have a bucket name
 		if bucketName != "" {
 			bucketPath := GetTableBucketPath(bucketName)
-			policyData, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-			if err != nil {
-				if !errors.Is(err, ErrAttributeNotFound) {
-					return fmt.Errorf("failed to read bucket policy: %w", err)
-				}
-				// Policy not found is not an error; bucketPolicy remains empty
-			} else {
-				bucketPolicy = string(policyData)
+			if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+				return err
 			}
 			bucketTags, err = h.readTags(r.Context(), client, bucketPath)
 			if err != nil {
@@ -626,6 +682,15 @@ func (h *S3TablesHandler) handleTagResource(w http.ResponseWriter, r *http.Reque
 			}
 		}
 
+		if rType == ResourceTypeTable {
+			if _, tableNamespace, tableName, err = parseTableFromARN(req.ResourceARN); err != nil {
+				return err
+			}
+			if tablePolicy, err = h.readPolicy(r, client, resourcePath); err != nil {
+				return err
+			}
+		}
+
 		// Read existing tags
 		data, err = h.getExtendedAttribute(r.Context(), client, resourcePath, extendedKey)
 		if err != nil {
@@ -636,18 +701,29 @@ func (h *S3TablesHandler) handleTagResource(w http.ResponseWriter, r *http.Reque
 			return err
 		}
 
-		resourceARN := req.ResourceARN
+		var resourceARN string
+		if rType == ResourceTypeTable {
+			resourceARN = h.generateTableARN(ownerAccountID, bucketName, tableNamespace+"/"+tableName)
+		} else {
+			resourceARN = h.generateTableBucketARN(ownerAccountID, bucketName)
+		}
 		principal := h.getAccountID(r)
 		identityActions := getIdentityActions(r)
-		if !CheckPermissionWithContext("TagResource", principal, ownerAccountID, bucketPolicy, resourceARN, &PolicyContext{
-			TableBucketName: bucketName,
-			TableBucketTags: bucketTags,
-			RequestTags:     req.Tags,
-			TagKeys:         requestTagKeys,
-			ResourceTags:    existingTags,
-			IdentityActions: identityActions,
-			DefaultAllow:    h.defaultAllowFor(r),
-		}) {
+		ctx := &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        tableNamespace,
+			TableName:        tableName,
+			TableBucketTags:  bucketTags,
+			RequestTags:      req.Tags,
+			TagKeys:          requestTagKeys,
+			ResourceTags:     existingTags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		}
+		if deniedByPolicy("TagResource", principal, tablePolicy, resourceARN, ctx) ||
+			!CheckPermissionWithContext("TagResource", principal, ownerAccountID, bucketPolicy, resourceARN, ctx) {
 			return NewAuthError("TagResource", principal, "not authorized to tag resource")
 		}
 		return nil
@@ -713,12 +789,16 @@ func (h *S3TablesHandler) handleListTagsForResource(w http.ResponseWriter, r *ht
 	}
 
 	tags := make(map[string]string)
-	var bucketPolicy string
+	var bucketPolicy, tablePolicy string
 	var bucketTags map[string]string
+	var tableNamespace, tableName string
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		// Read metadata for ownership check
 		data, err := h.getExtendedAttribute(r.Context(), client, resourcePath, ExtendedKeyMetadata)
 		if err != nil {
+			if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrAttributeNotFound) {
+				return h.absentTagTargetError(r, client, "ListTagsForResource", "not authorized to list tags for resource", req.ResourceARN, rType)
+			}
 			return err
 		}
 
@@ -730,14 +810,8 @@ func (h *S3TablesHandler) handleListTagsForResource(w http.ResponseWriter, r *ht
 		// Fetch bucket policy if we have a bucket name
 		if bucketName != "" {
 			bucketPath := GetTableBucketPath(bucketName)
-			policyData, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-			if err != nil {
-				if !errors.Is(err, ErrAttributeNotFound) {
-					return fmt.Errorf("failed to read bucket policy: %w", err)
-				}
-				// Policy not found is not an error; bucketPolicy remains empty
-			} else {
-				bucketPolicy = string(policyData)
+			if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+				return err
 			}
 			bucketTags, err = h.readTags(r.Context(), client, bucketPath)
 			if err != nil {
@@ -745,27 +819,45 @@ func (h *S3TablesHandler) handleListTagsForResource(w http.ResponseWriter, r *ht
 			}
 		}
 
+		if rType == ResourceTypeTable {
+			if _, tableNamespace, tableName, err = parseTableFromARN(req.ResourceARN); err != nil {
+				return err
+			}
+			if tablePolicy, err = h.readPolicy(r, client, resourcePath); err != nil {
+				return err
+			}
+		}
+
 		data, err = h.getExtendedAttribute(r.Context(), client, resourcePath, extendedKey)
 		if err != nil {
-			if errors.Is(err, ErrAttributeNotFound) {
-				return nil // No tags is not an error.
+			if !errors.Is(err, ErrAttributeNotFound) {
+				return err
 			}
-			return err // Propagate other errors.
-		}
-		if err := json.Unmarshal(data, &tags); err != nil {
+		} else if err := json.Unmarshal(data, &tags); err != nil {
 			return err
 		}
 
-		resourceARN := req.ResourceARN
+		var resourceARN string
+		if rType == ResourceTypeTable {
+			resourceARN = h.generateTableARN(ownerAccountID, bucketName, tableNamespace+"/"+tableName)
+		} else {
+			resourceARN = h.generateTableBucketARN(ownerAccountID, bucketName)
+		}
 		principal := h.getAccountID(r)
 		identityActions := getIdentityActions(r)
-		if !CheckPermissionWithContext("ListTagsForResource", principal, ownerAccountID, bucketPolicy, resourceARN, &PolicyContext{
-			TableBucketName: bucketName,
-			TableBucketTags: bucketTags,
-			ResourceTags:    tags,
-			IdentityActions: identityActions,
-			DefaultAllow:    h.defaultAllowFor(r),
-		}) {
+		ctx := &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        tableNamespace,
+			TableName:        tableName,
+			TableBucketTags:  bucketTags,
+			ResourceTags:     tags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		}
+		if deniedByPolicy("ListTagsForResource", principal, tablePolicy, resourceARN, ctx) ||
+			!CheckPermissionWithContext("ListTagsForResource", principal, ownerAccountID, bucketPolicy, resourceARN, ctx) {
 			return NewAuthError("ListTagsForResource", principal, "not authorized to list tags for resource")
 		}
 		return nil
@@ -820,12 +912,16 @@ func (h *S3TablesHandler) handleUntagResource(w http.ResponseWriter, r *http.Req
 
 	// Read existing tags, check permission
 	tags := make(map[string]string)
-	var bucketPolicy string
+	var bucketPolicy, tablePolicy string
 	var bucketTags map[string]string
+	var tableNamespace, tableName string
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		// Read metadata for ownership check
 		data, err := h.getExtendedAttribute(r.Context(), client, resourcePath, ExtendedKeyMetadata)
 		if err != nil {
+			if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrAttributeNotFound) {
+				return h.absentTagTargetError(r, client, "UntagResource", "not authorized to untag resource", req.ResourceARN, rType)
+			}
 			return err
 		}
 
@@ -837,14 +933,8 @@ func (h *S3TablesHandler) handleUntagResource(w http.ResponseWriter, r *http.Req
 		// Fetch bucket policy if we have a bucket name
 		if bucketName != "" {
 			bucketPath := GetTableBucketPath(bucketName)
-			policyData, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-			if err != nil {
-				if !errors.Is(err, ErrAttributeNotFound) {
-					return fmt.Errorf("failed to read bucket policy: %w", err)
-				}
-				// Policy not found is not an error; bucketPolicy remains empty
-			} else {
-				bucketPolicy = string(policyData)
+			if bucketPolicy, err = h.readPolicy(r, client, bucketPath); err != nil {
+				return err
 			}
 			bucketTags, err = h.readTags(r.Context(), client, bucketPath)
 			if err != nil {
@@ -852,28 +942,46 @@ func (h *S3TablesHandler) handleUntagResource(w http.ResponseWriter, r *http.Req
 			}
 		}
 
+		if rType == ResourceTypeTable {
+			if _, tableNamespace, tableName, err = parseTableFromARN(req.ResourceARN); err != nil {
+				return err
+			}
+			if tablePolicy, err = h.readPolicy(r, client, resourcePath); err != nil {
+				return err
+			}
+		}
+
 		data, err = h.getExtendedAttribute(r.Context(), client, resourcePath, extendedKey)
 		if err != nil {
-			if errors.Is(err, ErrAttributeNotFound) {
-				return nil
+			if !errors.Is(err, ErrAttributeNotFound) {
+				return err
 			}
-			return err
-		}
-		if err := json.Unmarshal(data, &tags); err != nil {
+		} else if err := json.Unmarshal(data, &tags); err != nil {
 			return err
 		}
 
-		resourceARN := req.ResourceARN
+		var resourceARN string
+		if rType == ResourceTypeTable {
+			resourceARN = h.generateTableARN(ownerAccountID, bucketName, tableNamespace+"/"+tableName)
+		} else {
+			resourceARN = h.generateTableBucketARN(ownerAccountID, bucketName)
+		}
 		principal := h.getAccountID(r)
 		identityActions := getIdentityActions(r)
-		if !CheckPermissionWithContext("UntagResource", principal, ownerAccountID, bucketPolicy, resourceARN, &PolicyContext{
-			TableBucketName: bucketName,
-			TableBucketTags: bucketTags,
-			TagKeys:         req.TagKeys,
-			ResourceTags:    tags,
-			IdentityActions: identityActions,
-			DefaultAllow:    h.defaultAllowFor(r),
-		}) {
+		ctx := &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        tableNamespace,
+			TableName:        tableName,
+			TableBucketTags:  bucketTags,
+			TagKeys:          req.TagKeys,
+			ResourceTags:     tags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		}
+		if deniedByPolicy("UntagResource", principal, tablePolicy, resourceARN, ctx) ||
+			!CheckPermissionWithContext("UntagResource", principal, ownerAccountID, bucketPolicy, resourceARN, ctx) {
 			return NewAuthError("UntagResource", principal, "not authorized to untag resource")
 		}
 		return nil
@@ -918,6 +1026,22 @@ func (h *S3TablesHandler) handleUntagResource(w http.ResponseWriter, r *http.Req
 	return nil
 }
 
+// absentTagTargetError resolves a tag operation when the resource's catalog
+// metadata did not load: a caller the operation would refuse gets its denial,
+// everyone else the same not-found an absent name gets.
+func (h *S3TablesHandler) absentTagTargetError(r *http.Request, client filer_pb.SeaweedFilerClient, operation, deniedMessage, resourceARN string, rType ResourceType) error {
+	var bucketName, namespace, name string
+	if rType == ResourceTypeTable {
+		bucketName, namespace, name, _ = parseTableFromARN(resourceARN)
+	} else {
+		bucketName, _ = parseBucketNameFromARN(resourceARN)
+	}
+	if !h.authorizeAbsentTarget(r, &singleClient{client}, operation, bucketName, namespace, name, resourceARN) {
+		return NewAuthError(operation, h.getAccountID(r), deniedMessage)
+	}
+	return filer_pb.ErrNotFound
+}
+
 // resolveResourcePath determines the resource path and extended attribute key from a resource ARN
 func (h *S3TablesHandler) resolveResourcePath(resourceARN string) (path string, key string, rType ResourceType, err error) {
 	// Try parsing as table ARN first
diff --git a/weed/s3api/s3tables/handler_policy_deny_test.go b/weed/s3api/s3tables/handler_policy_deny_test.go
new file mode 100644
index 0000000000..3140559b55
--- /dev/null
+++ b/weed/s3api/s3tables/handler_policy_deny_test.go
@@ -0,0 +1,218 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const policyDenyBucket = "denybkt"
+const policyDenyWriter = "writer"
+
+func policyDenyBucketARN(t *testing.T) string {
+	t.Helper()
+	arn, err := BuildBucketARN(DefaultRegion, DefaultAccountID, policyDenyBucket)
+	require.NoError(t, err)
+	return arn
+}
+
+func policyDenyTableARN(t *testing.T) string {
+	t.Helper()
+	arn, err := BuildTableARN(DefaultRegion, DefaultAccountID, policyDenyBucket, "ns", "t")
+	require.NoError(t, err)
+	return arn
+}
+
+// startPolicyDenyManager seeds a bucket/namespace/table where the bucket policy
+// grants writer s3tables:* while the table policy denies writer everything.
+func startPolicyDenyManager(t *testing.T) (*s3tablestest.MemFiler, *Manager) {
+	t.Helper()
+	fs := s3tablestest.Start(t)
+
+	bucketMeta, _ := json.Marshal(tableBucketMetadata{Name: policyDenyBucket, OwnerAccountID: DefaultAccountID})
+	bucketAllow := fmt.Sprintf(`{"Statement":[{"Effect":"Allow","Principal":"%s","Action":"s3tables:*","Resource":"*"}]}`, policyDenyWriter)
+	fs.Put(TablesPath, policyDenyBucket, map[string][]byte{
+		ExtendedKeyTableBucket: []byte("{}"),
+		ExtendedKeyMetadata:    bucketMeta,
+		ExtendedKeyPolicy:      []byte(bucketAllow),
+	})
+
+	nsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"ns"}, OwnerAccountID: DefaultAccountID})
+	fs.Put(GetTableBucketPath(policyDenyBucket), "ns", map[string][]byte{ExtendedKeyMetadata: nsMeta})
+
+	tableMeta, _ := json.Marshal(tableMetadataInternal{
+		Name:             "t",
+		Namespace:        "ns",
+		Format:           "ICEBERG",
+		OwnerAccountID:   DefaultAccountID,
+		MetadataVersion:  3,
+		MetadataLocation: "s3://" + policyDenyBucket + "/ns/t/metadata/v3.metadata.json",
+	})
+	tableDeny := fmt.Sprintf(`{"Statement":[{"Effect":"Deny","Principal":"%s","Action":"s3tables:*","Resource":%q}]}`, policyDenyWriter, policyDenyTableARN(t))
+	fs.Put(GetNamespacePath(policyDenyBucket, "ns"), "t", map[string][]byte{
+		ExtendedKeyMetadata:        tableMeta,
+		ExtendedKeyMetadataVersion: []byte("3"),
+		ExtendedKeyPolicy:          []byte(tableDeny),
+	})
+
+	tablePath := GetTablePath(policyDenyBucket, "ns", "t")
+	fs.Put(tablePath, "metadata", nil)
+	fs.Put(tablePath, "data", nil)
+	fs.Put(path.Join(tablePath, "metadata"), "v3.metadata.json", nil)
+
+	return fs, NewManager()
+}
+
+func runPolicyOp(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, op string, req interface{}, identity string) error {
+	t.Helper()
+	return m.Execute(context.Background(), NewManagerClient(fs.Client), op, req, nil, identity)
+}
+
+func deniedTableReq(t *testing.T) (string, string, string) {
+	return policyDenyBucketARN(t), "ns", "t"
+}
+
+// A table policy Deny must hold even when the bucket policy allows the same
+// action: the writer may not strip or replace the policy guarding the table.
+func TestTablePolicyDenyProtectsPolicyOps(t *testing.T) {
+	fs, m := startPolicyDenyManager(t)
+	bucketARN, ns, name := deniedTableReq(t)
+
+	require.Error(t, runPolicyOp(t, m, fs, "GetTablePolicy", &GetTablePolicyRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+	}, policyDenyWriter), "writer must not read the table policy")
+
+	require.Error(t, runPolicyOp(t, m, fs, "PutTablePolicy", &PutTablePolicyRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+		ResourcePolicy: `{"Statement":[{"Effect":"Allow","Principal":"writer","Action":"s3tables:*","Resource":"*"}]}`,
+	}, policyDenyWriter), "writer must not replace the table policy")
+
+	require.Error(t, runPolicyOp(t, m, fs, "DeleteTablePolicy", &DeleteTablePolicyRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+	}, policyDenyWriter), "writer must not delete the table policy")
+
+	// The deny still holds, so the table cannot be read or deleted.
+	require.Error(t, runPolicyOp(t, m, fs, "GetTable", &GetTableRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+	}, policyDenyWriter))
+	require.Error(t, runPolicyOp(t, m, fs, "DeleteTable", &DeleteTableRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+	}, policyDenyWriter))
+
+	entry := fs.Get(GetNamespacePath(policyDenyBucket, "ns"), "t")
+	require.NotNil(t, entry)
+	_, ok := entry.Extended[ExtendedKeyPolicy]
+	assert.True(t, ok, "table policy must still be in place")
+	_, ok = entry.Extended[ExtendedKeyMetadata]
+	assert.True(t, ok, "table must still exist")
+}
+
+// Tag and maintenance operations on a table carry the table ARN as their
+// resource, so the table's own policy Deny applies to them as well.
+func TestTablePolicyDenyCoversTagAndMaintenanceOps(t *testing.T) {
+	fs, m := startPolicyDenyManager(t)
+	bucketARN, ns, name := deniedTableReq(t)
+	tableARN := policyDenyTableARN(t)
+
+	require.Error(t, runPolicyOp(t, m, fs, "TagResource", &TagResourceRequest{
+		ResourceARN: tableARN, Tags: map[string]string{"k": "v"},
+	}, policyDenyWriter), "writer must not tag the table")
+
+	require.Error(t, runPolicyOp(t, m, fs, "UntagResource", &UntagResourceRequest{
+		ResourceARN: tableARN, TagKeys: []string{"k"},
+	}, policyDenyWriter), "writer must not untag the table")
+
+	require.Error(t, runPolicyOp(t, m, fs, "ListTagsForResource", &ListTagsForResourceRequest{
+		ResourceARN: tableARN,
+	}, policyDenyWriter), "writer must not list the table's tags")
+
+	forged, err := BuildTableARN(DefaultRegion, "111111111111", policyDenyBucket, ns, name)
+	require.NoError(t, err)
+	require.Error(t, runPolicyOp(t, m, fs, "TagResource", &TagResourceRequest{
+		ResourceARN: forged, Tags: map[string]string{"k": "v"},
+	}, policyDenyWriter), "a forged account in the ARN must not bypass the table Deny")
+
+	require.Error(t, runPolicyOp(t, m, fs, "PutTableMaintenanceConfiguration", &PutTableMaintenanceConfigurationRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+		Type: MaintenanceTypeIcebergCompaction, Value: &MaintenanceConfigurationValue{Status: MaintenanceStatusEnabled},
+	}, policyDenyWriter), "writer must not change the table's maintenance configuration")
+
+	require.Error(t, runPolicyOp(t, m, fs, "GetTableMaintenanceJobStatus", &GetTableMaintenanceJobStatusRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+	}, policyDenyWriter), "writer must not read the table's maintenance status")
+}
+
+// A Deny conditioned on a resource tag applies only while the stored tag
+// matches, so the veto must evaluate the tags held on the table.
+func TestTablePolicyDenyHonorsTagCondition(t *testing.T) {
+	bucketARN, ns, name := deniedTableReq(t)
+	conditionalDeny := fmt.Sprintf(`{"Statement":[{"Effect":"Deny","Principal":%q,"Action":"s3tables:*","Resource":%q,"Condition":{"StringEquals":{"aws:ResourceTag/protected":"true"}}}]}`,
+		policyDenyWriter, policyDenyTableARN(t))
+
+	seed := func(t *testing.T, tags map[string]string) (*s3tablestest.MemFiler, *Manager) {
+		t.Helper()
+		fs, m := startPolicyDenyManager(t)
+		entry := fs.Get(GetNamespacePath(policyDenyBucket, ns), name)
+		require.NotNil(t, entry)
+		entry.Extended[ExtendedKeyPolicy] = []byte(conditionalDeny)
+		if tagData, err := json.Marshal(tags); err == nil {
+			entry.Extended[ExtendedKeyTags] = tagData
+		}
+		return fs, m
+	}
+
+	putPolicy := &PutTablePolicyRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+		ResourcePolicy: `{"Statement":[{"Effect":"Allow","Principal":"writer","Action":"s3tables:*","Resource":"*"}]}`,
+	}
+	putMaintenance := &PutTableMaintenanceConfigurationRequest{
+		TableBucketARN: bucketARN, Namespace: []string{ns}, Name: name,
+		Type: MaintenanceTypeIcebergCompaction, Value: &MaintenanceConfigurationValue{Status: MaintenanceStatusEnabled},
+	}
+
+	t.Run("matching tag", func(t *testing.T) {
+		fs, m := seed(t, map[string]string{"protected": "true"})
+		require.Error(t, runPolicyOp(t, m, fs, "PutTablePolicy", putPolicy, policyDenyWriter))
+		require.Error(t, runPolicyOp(t, m, fs, "PutTableMaintenanceConfiguration", putMaintenance, policyDenyWriter))
+	})
+
+	t.Run("other tag value", func(t *testing.T) {
+		fs, m := seed(t, map[string]string{"protected": "false"})
+		require.NoError(t, runPolicyOp(t, m, fs, "PutTablePolicy", putPolicy, policyDenyWriter))
+		require.NoError(t, runPolicyOp(t, m, fs, "PutTableMaintenanceConfiguration", putMaintenance, policyDenyWriter))
+	})
+}
+
+// The policy being replaced is still the resource's policy: a Deny on
+// PutTableBucketPolicy inside the existing bucket policy must veto the write
+// even for the bucket owner under the open fallback.
+func TestBucketPolicyDenyVetoesPolicyReplacement(t *testing.T) {
+	fs := s3tablestest.Start(t)
+
+	bucketMeta, _ := json.Marshal(tableBucketMetadata{Name: policyDenyBucket, OwnerAccountID: DefaultAccountID})
+	denyReplace := `{"Statement":[{"Effect":"Deny","Principal":"*","Action":"s3tables:PutTableBucketPolicy","Resource":"*"}]}`
+	fs.Put(TablesPath, policyDenyBucket, map[string][]byte{
+		ExtendedKeyTableBucket: []byte("{}"),
+		ExtendedKeyMetadata:    bucketMeta,
+		ExtendedKeyPolicy:      []byte(denyReplace),
+	})
+
+	m := NewManager()
+	m.SetDefaultAllow(true)
+
+	err := runPolicyOp(t, m, fs, "PutTableBucketPolicy", &PutTableBucketPolicyRequest{
+		TableBucketARN: policyDenyBucketARN(t),
+		ResourcePolicy: `{"Statement":[{"Effect":"Allow","Principal":"*","Action":"s3tables:*","Resource":"*"}]}`,
+	}, "")
+	require.Error(t, err, "existing bucket policy Deny must veto replacing it")
+
+	entry := fs.Get(TablesPath, policyDenyBucket)
+	require.NotNil(t, entry)
+	assert.Equal(t, denyReplace, string(entry.Extended[ExtendedKeyPolicy]), "bucket policy must be unchanged")
+}
diff --git a/weed/s3api/s3tables/handler_principal_test.go b/weed/s3api/s3tables/handler_principal_test.go
new file mode 100644
index 0000000000..28ac9c9ee8
--- /dev/null
+++ b/weed/s3api/s3tables/handler_principal_test.go
@@ -0,0 +1,33 @@
+package s3tables
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetAccountIDRejectsHeaderAdmin(t *testing.T) {
+	h := NewS3TablesHandler()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set(s3_constants.AmzAccountId, s3_constants.AccountAdminId)
+
+	assert.NotEqual(t, s3_constants.AccountAdminId, h.getAccountID(req),
+		"a client-supplied account header must not resolve to the admin principal")
+}
+
+func TestGetAccountIDHeaderBranchResolvesCaller(t *testing.T) {
+	h := NewS3TablesHandler()
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	req.Header.Set(s3_constants.AmzAccountId, "alice")
+
+	assert.Equal(t, "alice", h.getAccountID(req))
+}
+
+func TestCheckPermissionDenyPolicyBindsNonAdmin(t *testing.T) {
+	denyAll := `{"Statement":[{"Effect":"Deny","Principal":"*","Action":"s3tables:DeleteTableBucket"}]}`
+	assert.False(t, CheckPermissionWithContext("s3tables:DeleteTableBucket", "mallory", "owner123", denyAll, "arn:aws:s3tables:us-east-1:000000000000:bucket/victim",
+		&PolicyContext{DefaultAllow: true}))
+}
diff --git a/weed/s3api/s3tables/handler_rename_test.go b/weed/s3api/s3tables/handler_rename_test.go
index 4507a0b62a..326a3f3bb7 100644
--- a/weed/s3api/s3tables/handler_rename_test.go
+++ b/weed/s3api/s3tables/handler_rename_test.go
@@ -3,144 +3,16 @@ package s3tables
 import (
 	"context"
 	"encoding/json"
-	"net"
 	"path"
-	"sort"
-	"strings"
 	"testing"
-	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/status"
 )
 
-// memFilerServer is an in-memory filer used to drive Manager operations
-// end-to-end without a live cluster.
-type memFilerServer struct {
-	filer_pb.UnimplementedSeaweedFilerServer
-	entries map[string]map[string]*filer_pb.Entry // dir -> name -> entry
-	client  filer_pb.SeaweedFilerClient
-}
-
-func newMemFilerServer() *memFilerServer {
-	return &memFilerServer{entries: make(map[string]map[string]*filer_pb.Entry)}
-}
-
-func (f *memFilerServer) getEntry(dir, name string) *filer_pb.Entry {
-	if d, ok := f.entries[dir]; ok {
-		return d[name]
-	}
-	return nil
-}
-
-func (f *memFilerServer) putEntry(dir, name string, extended map[string][]byte) {
-	if _, ok := f.entries[dir]; !ok {
-		f.entries[dir] = make(map[string]*filer_pb.Entry)
-	}
-	f.entries[dir][name] = &filer_pb.Entry{Name: name, IsDirectory: true, Extended: extended}
-}
-
-func (f *memFilerServer) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
-	if e := f.getEntry(req.Directory, req.Name); e != nil {
-		return &filer_pb.LookupDirectoryEntryResponse{Entry: e}, nil
-	}
-	// Carry the sentinel text so filer_pb.LookupEntry maps it to ErrNotFound.
-	return nil, status.Errorf(codes.NotFound, "%s: %s/%s", filer_pb.ErrNotFound.Error(), req.Directory, req.Name)
-}
-
-func (f *memFilerServer) ListEntries(req *filer_pb.ListEntriesRequest, stream grpc.ServerStreamingServer[filer_pb.ListEntriesResponse]) error {
-	d, ok := f.entries[req.Directory]
-	if !ok {
-		return nil
-	}
-	names := make([]string, 0, len(d))
-	for name := range d {
-		names = append(names, name)
-	}
-	sort.Strings(names)
-	for _, name := range names {
-		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: d[name]}); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (f *memFilerServer) CreateEntry(_ context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
-	if _, ok := f.entries[req.Directory]; !ok {
-		f.entries[req.Directory] = make(map[string]*filer_pb.Entry)
-	}
-	f.entries[req.Directory][req.Entry.Name] = req.Entry
-	return &filer_pb.CreateEntryResponse{}, nil
-}
-
-func (f *memFilerServer) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
-	if _, ok := f.entries[req.Directory]; !ok {
-		f.entries[req.Directory] = make(map[string]*filer_pb.Entry)
-	}
-	f.entries[req.Directory][req.Entry.Name] = req.Entry
-	return &filer_pb.UpdateEntryResponse{}, nil
-}
-
-func (f *memFilerServer) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
-	if d, ok := f.entries[req.Directory]; ok {
-		delete(d, req.Name)
-	}
-	// Honor recursive data deletion so a regression that wipes the table directory
-	// also drops its metadata/ and data/ children (the data-loss this guards against).
-	if req.IsRecursive && req.IsDeleteData {
-		child := path.Join(req.Directory, req.Name)
-		for dir := range f.entries {
-			if dir == child || strings.HasPrefix(dir, child+"/") {
-				delete(f.entries, dir)
-			}
-		}
-	}
-	return &filer_pb.DeleteEntryResponse{}, nil
-}
-
-func (f *memFilerServer) Ping(_ context.Context, _ *filer_pb.PingRequest) (*filer_pb.PingResponse, error) {
-	now := time.Now().UnixNano()
-	return &filer_pb.PingResponse{StartTimeNs: now, RemoteTimeNs: now, StopTimeNs: now}, nil
-}
-
-func startMemFiler(t *testing.T) *memFilerServer {
-	t.Helper()
-	fs := newMemFilerServer()
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-
-	server := grpc.NewServer()
-	filer_pb.RegisterSeaweedFilerServer(server, fs)
-	go func() { _ = server.Serve(listener) }()
-	t.Cleanup(server.GracefulStop)
-
-	conn, err := grpc.NewClient(listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = conn.Close() })
-
-	fs.client = filer_pb.NewSeaweedFilerClient(conn)
-	deadline := time.Now().Add(5 * time.Second)
-	for {
-		pingCtx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
-		_, err := fs.client.Ping(pingCtx, &filer_pb.PingRequest{})
-		cancel()
-		if err == nil {
-			break
-		}
-		require.False(t, time.Now().After(deadline), "filer not ready: %v", err)
-		time.Sleep(10 * time.Millisecond)
-	}
-	return fs
-}
-
 const renameTestBucket = "renamebkt"
 
 func mustBucketARN(t *testing.T) string {
@@ -151,18 +23,18 @@ func mustBucketARN(t *testing.T) string {
 }
 
 // startRenameManager seeds a bucket/namespace/table and returns a trusted Manager.
-func startRenameManager(t *testing.T) (*memFilerServer, *Manager) {
+func startRenameManager(t *testing.T) (*s3tablestest.MemFiler, *Manager) {
 	t.Helper()
-	fs := startMemFiler(t)
+	fs := s3tablestest.Start(t)
 
 	bucketMeta, _ := json.Marshal(tableBucketMetadata{Name: renameTestBucket, OwnerAccountID: DefaultAccountID})
-	fs.putEntry(TablesPath, renameTestBucket, map[string][]byte{
+	fs.Put(TablesPath, renameTestBucket, map[string][]byte{
 		ExtendedKeyTableBucket: []byte("{}"),
 		ExtendedKeyMetadata:    bucketMeta,
 	})
 
 	nsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"ns"}, OwnerAccountID: DefaultAccountID})
-	fs.putEntry(GetTableBucketPath(renameTestBucket), "ns", map[string][]byte{ExtendedKeyMetadata: nsMeta})
+	fs.Put(GetTableBucketPath(renameTestBucket), "ns", map[string][]byte{ExtendedKeyMetadata: nsMeta})
 
 	tableMeta, _ := json.Marshal(tableMetadataInternal{
 		Name:             "t",
@@ -172,31 +44,31 @@ func startRenameManager(t *testing.T) (*memFilerServer, *Manager) {
 		MetadataVersion:  3,
 		MetadataLocation: "s3://" + renameTestBucket + "/ns/t/metadata/v3.metadata.json",
 	})
-	fs.putEntry(GetNamespacePath(renameTestBucket, "ns"), "t", map[string][]byte{
+	fs.Put(GetNamespacePath(renameTestBucket, "ns"), "t", map[string][]byte{
 		ExtendedKeyMetadata:        tableMeta,
 		ExtendedKeyMetadataVersion: []byte("3"),
 	})
 
 	// Physical metadata.json and data files live under the table directory.
 	tablePath := GetTablePath(renameTestBucket, "ns", "t")
-	fs.putEntry(tablePath, "metadata", nil)
-	fs.putEntry(tablePath, "data", nil)
-	fs.putEntry(path.Join(tablePath, "metadata"), "v3.metadata.json", nil)
+	fs.Put(tablePath, "metadata", nil)
+	fs.Put(tablePath, "data", nil)
+	fs.Put(path.Join(tablePath, "metadata"), "v3.metadata.json", nil)
 
 	m := NewManager()
 	m.SetTrusted(true)
 	return fs, m
 }
 
-func runRename(t *testing.T, m *Manager, fs *memFilerServer, req *RenameTableRequest) error {
+func runRename(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, req *RenameTableRequest) error {
 	t.Helper()
-	return m.Execute(context.Background(), NewManagerClient(fs.client), "RenameTable", req, nil, "")
+	return m.Execute(context.Background(), NewManagerClient(fs.Client), "RenameTable", req, nil, "")
 }
 
-func runGetTable(t *testing.T, m *Manager, fs *memFilerServer, namespace, name string) (*GetTableResponse, error) {
+func runGetTable(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, namespace, name string) (*GetTableResponse, error) {
 	t.Helper()
 	resp := &GetTableResponse{}
-	err := m.Execute(context.Background(), NewManagerClient(fs.client), "GetTable", &GetTableRequest{
+	err := m.Execute(context.Background(), NewManagerClient(fs.Client), "GetTable", &GetTableRequest{
 		TableBucketARN: mustBucketARN(t),
 		Namespace:      []string{namespace},
 		Name:           name,
@@ -219,12 +91,12 @@ func TestRenameTablePreservesData(t *testing.T) {
 	// The source directory and its metadata.json/data children must survive: rename
 	// is catalog-only and the destination still points at the original location.
 	srcPath := GetTablePath(renameTestBucket, "ns", "t")
-	assert.NotNil(t, fs.getEntry(srcPath, "metadata"), "source metadata dir must survive")
-	assert.NotNil(t, fs.getEntry(srcPath, "data"), "source data dir must survive")
-	assert.NotNil(t, fs.getEntry(path.Join(srcPath, "metadata"), "v3.metadata.json"), "metadata.json must survive")
+	assert.NotNil(t, fs.Get(srcPath, "metadata"), "source metadata dir must survive")
+	assert.NotNil(t, fs.Get(srcPath, "data"), "source data dir must survive")
+	assert.NotNil(t, fs.Get(path.Join(srcPath, "metadata"), "v3.metadata.json"), "metadata.json must survive")
 
 	// Source catalog xattrs are dropped so the name stops resolving.
-	src := fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t")
+	src := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
 	require.NotNil(t, src, "source directory must remain to hold the data children")
 	_, hasMeta := src.Extended[ExtendedKeyMetadata]
 	assert.False(t, hasMeta, "source table-metadata xattr must be removed")
@@ -241,7 +113,7 @@ func TestRenameTablePreservesData(t *testing.T) {
 	assert.Equal(t, "t2", got.Name)
 	assert.Equal(t, "s3://"+renameTestBucket+"/ns/t/metadata/v3.metadata.json", got.MetadataLocation)
 
-	dest := fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t2")
+	dest := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t2")
 	require.NotNil(t, dest)
 	assert.Equal(t, []byte("3"), dest.Extended[ExtendedKeyMetadataVersion])
 }
@@ -264,7 +136,7 @@ func TestRenameTableSourceMissing(t *testing.T) {
 func TestRenameTableDestExists(t *testing.T) {
 	fs, m := startRenameManager(t)
 	existing, _ := json.Marshal(tableMetadataInternal{Name: "t2", Namespace: "ns", OwnerAccountID: DefaultAccountID})
-	fs.putEntry(GetNamespacePath(renameTestBucket, "ns"), "t2", map[string][]byte{ExtendedKeyMetadata: existing})
+	fs.Put(GetNamespacePath(renameTestBucket, "ns"), "t2", map[string][]byte{ExtendedKeyMetadata: existing})
 
 	err := runRename(t, m, fs, &RenameTableRequest{
 		TableBucketARN:  mustBucketARN(t),
@@ -277,7 +149,7 @@ func TestRenameTableDestExists(t *testing.T) {
 	var s3Err *S3TablesError
 	require.ErrorAs(t, err, &s3Err)
 	assert.Equal(t, ErrCodeTableAlreadyExists, s3Err.Type)
-	assert.NotNil(t, fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched on conflict")
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched on conflict")
 }
 
 func TestRenameTableDestNamespaceMissing(t *testing.T) {
@@ -293,11 +165,13 @@ func TestRenameTableDestNamespaceMissing(t *testing.T) {
 	var s3Err *S3TablesError
 	require.ErrorAs(t, err, &s3Err)
 	assert.Equal(t, ErrCodeNoSuchNamespace, s3Err.Type)
-	assert.NotNil(t, fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched")
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched")
 }
 
 // A principal allowed to rename the source must still be denied when it cannot
-// create a table in the destination namespace.
+// create a table in the destination namespace. The denial reports the same
+// not-found as a missing destination namespace so the caller cannot probe for
+// namespaces it may not touch.
 func TestRenameTableDestNamespaceUnauthorized(t *testing.T) {
 	fs, m := startRenameManager(t)
 	m.SetTrusted(false)
@@ -313,16 +187,16 @@ func TestRenameTableDestNamespaceUnauthorized(t *testing.T) {
 			"Resource":  "*",
 		}},
 	})
-	srcEntry := fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t")
+	srcEntry := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
 	require.NotNil(t, srcEntry)
 	srcEntry.Extended[ExtendedKeyPolicy] = srcPolicy
 
 	destNsMeta, _ := json.Marshal(namespaceMetadata{Namespace: []string{"dest"}, OwnerAccountID: DefaultAccountID})
-	fs.putEntry(GetTableBucketPath(renameTestBucket), "dest", map[string][]byte{ExtendedKeyMetadata: destNsMeta})
+	fs.Put(GetTableBucketPath(renameTestBucket), "dest", map[string][]byte{ExtendedKeyMetadata: destNsMeta})
 
 	mover := &testIdentity{Name: "mover", Account: &testIdentityAccount{Id: "mover"}}
 	ctx := s3_constants.SetIdentityInContext(context.Background(), mover)
-	err := m.Execute(ctx, NewManagerClient(fs.client), "RenameTable", &RenameTableRequest{
+	err := m.Execute(ctx, NewManagerClient(fs.Client), "RenameTable", &RenameTableRequest{
 		TableBucketARN:  mustBucketARN(t),
 		SourceNamespace: []string{"ns"},
 		SourceName:      "t",
@@ -332,10 +206,10 @@ func TestRenameTableDestNamespaceUnauthorized(t *testing.T) {
 	require.Error(t, err)
 	var s3Err *S3TablesError
 	require.ErrorAs(t, err, &s3Err)
-	assert.Equal(t, ErrCodeAccessDenied, s3Err.Type)
+	assert.Equal(t, ErrCodeNoSuchNamespace, s3Err.Type)
 
-	assert.NotNil(t, fs.getEntry(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched")
-	assert.Nil(t, fs.getEntry(GetNamespacePath(renameTestBucket, "dest"), "t2"), "destination must not be written")
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t"), "source must be untouched")
+	assert.Nil(t, fs.Get(GetNamespacePath(renameTestBucket, "dest"), "t2"), "destination must not be written")
 }
 
 func TestRenameTableInvalidName(t *testing.T) {
@@ -352,3 +226,66 @@ func TestRenameTableInvalidName(t *testing.T) {
 	require.ErrorAs(t, err, &s3Err)
 	assert.Equal(t, ErrCodeInvalidRequest, s3Err.Type)
 }
+
+// A disabled maintenance configuration has to move with the table. Leaving it
+// behind re-enables maintenance under the new name, and leaks the old settings
+// onto whatever is created at the old one.
+func TestRenameTableCarriesMaintenanceConfiguration(t *testing.T) {
+	fs, m := startRenameManager(t)
+
+	src := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
+	require.NotNil(t, src)
+	config := []byte(`{"icebergSnapshotManagement":{"status":"disabled"}}`)
+	status := []byte(`{"icebergCompaction":{"status":"Successful"}}`)
+	src.Extended[ExtendedKeyMaintenance] = config
+	src.Extended[ExtendedKeyMaintenanceStatus] = status
+
+	require.NoError(t, runRename(t, m, fs, &RenameTableRequest{
+		TableBucketARN:  mustBucketARN(t),
+		SourceNamespace: []string{"ns"},
+		SourceName:      "t",
+		DestNamespace:   []string{"ns"},
+		DestName:        "t2",
+	}))
+
+	dest := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t2")
+	require.NotNil(t, dest)
+	assert.Equal(t, config, dest.Extended[ExtendedKeyMaintenance], "the disable must move with the table")
+	assert.Equal(t, status, dest.Extended[ExtendedKeyMaintenanceStatus])
+
+	// And must not linger on the old name, where a reused name would inherit it.
+	moved := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
+	require.NotNil(t, moved)
+	_, hasConfig := moved.Extended[ExtendedKeyMaintenance]
+	assert.False(t, hasConfig, "source maintenance configuration must be cleared")
+	_, hasStatus := moved.Extended[ExtendedKeyMaintenanceStatus]
+	assert.False(t, hasStatus, "source maintenance status must be cleared")
+}
+
+// A maintenance configuration written after the rename copied the source must
+// not be deleted by the source cleanup: it would vanish without ever reaching
+// the destination.
+func TestRenameTableRejectsConcurrentMaintenanceWrite(t *testing.T) {
+	fs, _ := startRenameManager(t)
+
+	src := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
+	require.NotNil(t, src)
+	copied := []byte(`{"icebergCompaction":{"status":"enabled"}}`)
+	src.Extended[ExtendedKeyMaintenance] = copied
+
+	// Stand in for the Put that lands between the copy and the cleanup.
+	landedLate := []byte(`{"icebergSnapshotManagement":{"status":"disabled"}}`)
+	expected := map[string][]byte{ExtendedKeyMaintenance: copied}
+
+	src.Extended[ExtendedKeyMaintenance] = landedLate
+
+	h := NewS3TablesHandler()
+	err := NewManagerClient(fs.Client).WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		return h.removeExtendedAttributesIf(context.Background(),
+			client, GetTablePath(renameTestBucket, "ns", "t"), expected, renamedTableAttributes...)
+	})
+
+	require.Error(t, err, "cleanup must refuse to delete a configuration written after the copy")
+	assert.ErrorIs(t, err, ErrConcurrentUpdate)
+	assert.Equal(t, landedLate, src.Extended[ExtendedKeyMaintenance], "the late write must survive")
+}
diff --git a/weed/s3api/s3tables/handler_table.go b/weed/s3api/s3tables/handler_table.go
index f3ff610c0a..5ee6f01391 100644
--- a/weed/s3api/s3tables/handler_table.go
+++ b/weed/s3api/s3tables/handler_table.go
@@ -1,11 +1,14 @@
 package s3tables
 
 import (
+	"bytes"
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"path"
 	"strconv"
 	"strings"
 	"time"
@@ -22,144 +25,30 @@ func (h *S3TablesHandler) handleCreateTable(w http.ResponseWriter, r *http.Reque
 		return err
 	}
 
-	if req.TableBucketARN == "" {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "tableBucketARN is required")
-		return fmt.Errorf("tableBucketARN is required")
-	}
-
-	namespaceName, err := validateNamespace(req.Namespace)
-	if err != nil {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
-	}
-
-	if req.Name == "" {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "name is required")
-		return fmt.Errorf("name is required")
-	}
-
 	if req.Format == "" {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "format is required")
 		return fmt.Errorf("format is required")
 	}
 
 	// Validate format
-	if req.Format != "ICEBERG" {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "only ICEBERG format is supported")
+	if req.Format != FormatIceberg && req.Format != FormatLance {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, fmt.Sprintf("unsupported format %q", req.Format))
 		return fmt.Errorf("invalid format")
 	}
 
-	bucketName, err := parseBucketNameFromARN(req.TableBucketARN)
+	target, err := h.authorizeCreateTable(w, r, filerClient, req.TableBucketARN, req.Namespace, req.Name, req.Tags)
 	if err != nil {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
 		return err
 	}
+	bucketName, namespaceName, tableName := target.bucketName, target.namespaceName, target.tableName
 
-	// Validate table name
-	tableName, err := validateTableName(req.Name)
-	if err != nil {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
-	}
-
-	// Check if namespace exists
-	namespacePath := GetNamespacePath(bucketName, namespaceName)
-	var namespaceMetadata namespaceMetadata
-	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		data, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyMetadata)
-		if err != nil {
-			return err
-		}
-		if err := json.Unmarshal(data, &namespaceMetadata); err != nil {
-			return fmt.Errorf("failed to unmarshal namespace metadata: %w", err)
-		}
-		return nil
-	})
-
-	if err != nil {
-		if errors.Is(err, filer_pb.ErrNotFound) {
-			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", namespaceName))
-		} else {
-			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to check namespace: %v", err))
-		}
-		return err
-	}
-
-	// Authorize table creation using policy framework (namespace + bucket policies)
-	accountID := h.getAccountID(r)
-	bucketPath := GetTableBucketPath(bucketName)
-	namespacePolicy := ""
-	bucketPolicy := ""
-	bucketTags := map[string]string{}
-	var data []byte
-	var bucketMetadata tableBucketMetadata
-
-	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		// Fetch bucket metadata to use correct owner for bucket policy evaluation
-		data, err = h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata)
-		if err == nil {
-			if err := json.Unmarshal(data, &bucketMetadata); err != nil {
-				return fmt.Errorf("failed to unmarshal bucket metadata: %w", err)
-			}
-		} else if !errors.Is(err, ErrAttributeNotFound) {
-			return fmt.Errorf("failed to fetch bucket metadata: %v", err)
-		}
-
-		// Fetch namespace policy if it exists
-		policyData, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyPolicy)
-		if err == nil {
-			namespacePolicy = string(policyData)
-		} else if !errors.Is(err, ErrAttributeNotFound) {
-			return fmt.Errorf("failed to fetch namespace policy: %v", err)
-		}
-
-		// Fetch bucket policy if it exists
-		policyData, err = h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-		if err == nil {
-			bucketPolicy = string(policyData)
-		} else if !errors.Is(err, ErrAttributeNotFound) {
-			return fmt.Errorf("failed to fetch bucket policy: %v", err)
-		}
-		if tags, err := h.readTags(r.Context(), client, bucketPath); err != nil {
-			return err
-		} else if tags != nil {
-			bucketTags = tags
-		}
-
-		return nil
-	})
-
-	if err != nil {
-		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to fetch policies: %v", err))
-		return err
-	}
-
-	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
-	identityActions := getIdentityActions(r)
-	nsAllowed := CheckPermissionWithContext("CreateTable", accountID, namespaceMetadata.OwnerAccountID, namespacePolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		RequestTags:     req.Tags,
-		TagKeys:         mapKeys(req.Tags),
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	bucketAllowed := CheckPermissionWithContext("CreateTable", accountID, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		RequestTags:     req.Tags,
-		TagKeys:         mapKeys(req.Tags),
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-
-	if !nsAllowed && !bucketAllowed {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create table in this namespace")
-		return ErrAccessDenied
+	// A bucket declares the format it holds, and a table of another format would
+	// be invisible to the catalog serving it. A bucket made before the
+	// declaration existed has none, and keeps taking anything.
+	if target.bucketFormat != "" && target.bucketFormat != req.Format {
+		message := fmt.Sprintf("table bucket %s holds %s tables", bucketName, target.bucketFormat)
+		h.writeError(w, http.StatusConflict, ErrCodeConflict, message)
+		return fmt.Errorf("%s", message)
 	}
 
 	tablePath := GetTablePath(bucketName, namespaceName, tableName)
@@ -173,7 +62,7 @@ func (h *S3TablesHandler) handleCreateTable(w http.ResponseWriter, r *http.Reque
 		if err != nil {
 			return err
 		}
-		if entryType(entry.Extended) == EntryTypeView {
+		if EntryType(entry.Extended) == EntryTypeView {
 			existingIsView = true
 			return nil
 		}
@@ -192,6 +81,14 @@ func (h *S3TablesHandler) handleCreateTable(w http.ResponseWriter, r *http.Reque
 			h.writeError(w, http.StatusConflict, ErrCodeTableAlreadyExists, fmt.Sprintf("a view named %s already exists", tableName))
 			return fmt.Errorf("view name conflict: %s", tableName)
 		}
+		// Creating a table that already exists is idempotent, but only for the
+		// same format. Handing a Lance client an Iceberg table's location, or the
+		// reverse, has it write one format's files into the other's directory.
+		if existingMetadata.Format != "" && existingMetadata.Format != req.Format {
+			h.writeError(w, http.StatusConflict, ErrCodeTableAlreadyExists,
+				fmt.Sprintf("a %s table named %s already exists", existingMetadata.Format, tableName))
+			return fmt.Errorf("format conflict: %s", tableName)
+		}
 		tableARN := h.generateTableARN(existingMetadata.OwnerAccountID, bucketName, namespaceName+"/"+tableName)
 		h.writeJSON(w, http.StatusOK, &CreateTableResponse{
 			TableARN:         tableARN,
@@ -204,6 +101,11 @@ func (h *S3TablesHandler) handleCreateTable(w http.ResponseWriter, r *http.Reque
 		return err
 	}
 
+	if err := ValidateMetadataLocation(req.MetadataLocation, bucketName, namespaceName); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
 	// Create the table
 	now := time.Now()
 	versionToken := generateVersionToken()
@@ -214,7 +116,7 @@ func (h *S3TablesHandler) handleCreateTable(w http.ResponseWriter, r *http.Reque
 		Format:           req.Format,
 		CreatedAt:        now,
 		ModifiedAt:       now,
-		OwnerAccountID:   namespaceMetadata.OwnerAccountID, // Inherit namespace owner for consistency
+		OwnerAccountID:   target.ownerAccountID, // Inherit namespace owner for consistency
 		VersionToken:     versionToken,
 		MetadataVersion:  max(req.MetadataVersion, 1),
 		MetadataLocation: req.MetadataLocation,
@@ -293,6 +195,14 @@ func metadataVersionFromLocation(metadataLocation string) int {
 	if v, err := strconv.Atoi(strings.TrimPrefix(name, "v")); err == nil && v > 0 {
 		return v
 	}
+	// v{N}-{unique} form, written when a commit finds v{N} already staged
+	if trimmed := strings.TrimPrefix(name, "v"); trimmed != name {
+		if idx := strings.IndexByte(trimmed, '-'); idx != -1 {
+			if v, err := strconv.Atoi(trimmed[:idx]); err == nil && v > 0 {
+				return v
+			}
+		}
+	}
 	// {NNNNN}-{uuid} form: the leading integer before the first '-'
 	if idx := strings.IndexByte(name, '-'); idx != -1 {
 		if v, err := strconv.Atoi(name[:idx]); err == nil && v > 0 {
@@ -313,128 +223,22 @@ func (h *S3TablesHandler) handleRegisterTable(w http.ResponseWriter, r *http.Req
 		return err
 	}
 
-	if req.TableBucketARN == "" {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "tableBucketARN is required")
-		return fmt.Errorf("tableBucketARN is required")
-	}
-
-	namespaceName, err := validateNamespace(req.Namespace)
-	if err != nil {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
-	}
-
-	if req.Name == "" {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "name is required")
-		return fmt.Errorf("name is required")
-	}
-
 	if req.MetadataLocation == "" {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "metadataLocation is required")
 		return fmt.Errorf("metadataLocation is required")
 	}
 
-	bucketName, err := parseBucketNameFromARN(req.TableBucketARN)
+	target, err := h.authorizeCreateTable(w, r, filerClient, req.TableBucketARN, req.Namespace, req.Name, nil)
 	if err != nil {
+		return err
+	}
+	bucketName, namespaceName, tableName := target.bucketName, target.namespaceName, target.tableName
+
+	if err := ValidateMetadataLocation(req.MetadataLocation, bucketName, namespaceName); err != nil {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
 		return err
 	}
 
-	tableName, err := validateTableName(req.Name)
-	if err != nil {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
-	}
-
-	// Namespace must exist.
-	namespacePath := GetNamespacePath(bucketName, namespaceName)
-	var namespaceMetadata namespaceMetadata
-	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		data, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyMetadata)
-		if err != nil {
-			return err
-		}
-		if err := json.Unmarshal(data, &namespaceMetadata); err != nil {
-			return fmt.Errorf("failed to unmarshal namespace metadata: %w", err)
-		}
-		return nil
-	})
-	if err != nil {
-		if errors.Is(err, filer_pb.ErrNotFound) {
-			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", namespaceName))
-		} else {
-			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to check namespace: %v", err))
-		}
-		return err
-	}
-
-	// Authorize using policy framework (namespace + bucket policies).
-	accountID := h.getAccountID(r)
-	bucketPath := GetTableBucketPath(bucketName)
-	namespacePolicy := ""
-	bucketPolicy := ""
-	bucketTags := map[string]string{}
-	var bucketMetadata tableBucketMetadata
-
-	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		data, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata)
-		if err == nil {
-			if err := json.Unmarshal(data, &bucketMetadata); err != nil {
-				return fmt.Errorf("failed to unmarshal bucket metadata: %w", err)
-			}
-		} else if !errors.Is(err, ErrAttributeNotFound) {
-			return fmt.Errorf("failed to fetch bucket metadata: %v", err)
-		}
-
-		policyData, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyPolicy)
-		if err == nil {
-			namespacePolicy = string(policyData)
-		} else if !errors.Is(err, ErrAttributeNotFound) {
-			return fmt.Errorf("failed to fetch namespace policy: %v", err)
-		}
-
-		policyData, err = h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
-		if err == nil {
-			bucketPolicy = string(policyData)
-		} else if !errors.Is(err, ErrAttributeNotFound) {
-			return fmt.Errorf("failed to fetch bucket policy: %v", err)
-		}
-		if tags, err := h.readTags(r.Context(), client, bucketPath); err != nil {
-			return err
-		} else if tags != nil {
-			bucketTags = tags
-		}
-
-		return nil
-	})
-	if err != nil {
-		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to fetch policies: %v", err))
-		return err
-	}
-
-	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
-	identityActions := getIdentityActions(r)
-	nsAllowed := CheckPermissionWithContext("CreateTable", accountID, namespaceMetadata.OwnerAccountID, namespacePolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	bucketAllowed := CheckPermissionWithContext("CreateTable", accountID, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	if !nsAllowed && !bucketAllowed {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to register table in this namespace")
-		return ErrAccessDenied
-	}
-
 	tablePath := GetTablePath(bucketName, namespaceName, tableName)
 
 	// Table must be absent.
@@ -459,10 +263,10 @@ func (h *S3TablesHandler) handleRegisterTable(w http.ResponseWriter, r *http.Req
 	metadata := &tableMetadataInternal{
 		Name:             tableName,
 		Namespace:        namespaceName,
-		Format:           "ICEBERG",
+		Format:           FormatIceberg,
 		CreatedAt:        now,
 		ModifiedAt:       now,
-		OwnerAccountID:   namespaceMetadata.OwnerAccountID,
+		OwnerAccountID:   target.ownerAccountID,
 		VersionToken:     versionToken,
 		MetadataVersion:  metadataVersionFromLocation(req.MetadataLocation),
 		MetadataLocation: req.MetadataLocation,
@@ -538,17 +342,10 @@ func (h *S3TablesHandler) handleGetTable(w http.ResponseWriter, r *http.Request,
 
 	var metadata tableMetadataInternal
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		entry, err := h.lookupEntry(r.Context(), client, tablePath)
+		data, err := h.readTableMetadata(r.Context(), client, tablePath)
 		if err != nil {
 			return err
 		}
-		if entryType(entry.Extended) == EntryTypeView {
-			return filer_pb.ErrNotFound
-		}
-		data, ok := entry.Extended[ExtendedKeyMetadata]
-		if !ok {
-			return fmt.Errorf("%w: %s", ErrAttributeNotFound, ExtendedKeyMetadata)
-		}
 		if err := json.Unmarshal(data, &metadata); err != nil {
 			return fmt.Errorf("failed to unmarshal table metadata: %w", err)
 		}
@@ -622,26 +419,21 @@ func (h *S3TablesHandler) handleGetTable(w http.ResponseWriter, r *http.Request,
 	tableARN := h.generateTableARN(metadata.OwnerAccountID, bucketName, namespace+"/"+tableName)
 	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
 	identityActions := getIdentityActions(r)
-	tableAllowed := CheckPermissionWithContext("GetTable", accountID, metadata.OwnerAccountID, tablePolicy, tableARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespace,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	bucketAllowed := CheckPermissionWithContext("GetTable", accountID, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespace,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
+	allowed := CheckTableOrBucketPermission("GetTable", accountID,
+		metadata.OwnerAccountID, tablePolicy, tableARN,
+		bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        namespace,
+			TableName:        tableName,
+			TableBucketTags:  bucketTags,
+			ResourceTags:     tableTags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		})
 
-	if !tableAllowed && !bucketAllowed {
+	if !allowed {
 		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
 		return ErrAccessDenied
 	}
@@ -723,11 +515,14 @@ func (h *S3TablesHandler) handleListTables(w http.ResponseWriter, r *http.Reques
 			bucketTags := map[string]string{}
 
 			// Fetch namespace metadata and policy
+			targetAbsent := false
 			data, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyMetadata)
 			if err != nil {
-				return err // Not Found handled by caller
-			}
-			if err := json.Unmarshal(data, &nsMeta); err != nil {
+				if !errors.Is(err, filer_pb.ErrNotFound) && !errors.Is(err, ErrAttributeNotFound) {
+					return err
+				}
+				targetAbsent = true
+			} else if err := json.Unmarshal(data, &nsMeta); err != nil {
 				return err
 			}
 
@@ -735,7 +530,7 @@ func (h *S3TablesHandler) handleListTables(w http.ResponseWriter, r *http.Reques
 			policyData, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyPolicy)
 			if err == nil {
 				namespacePolicy = string(policyData)
-			} else if !errors.Is(err, ErrAttributeNotFound) {
+			} else if !errors.Is(err, ErrAttributeNotFound) && !errors.Is(err, filer_pb.ErrNotFound) {
 				return fmt.Errorf("failed to fetch namespace policy: %w", err)
 			}
 
@@ -745,6 +540,8 @@ func (h *S3TablesHandler) handleListTables(w http.ResponseWriter, r *http.Reques
 				if err := json.Unmarshal(data, &bucketMeta); err != nil {
 					return fmt.Errorf("failed to unmarshal bucket metadata: %w", err)
 				}
+			} else if errors.Is(err, filer_pb.ErrNotFound) {
+				targetAbsent = true
 			} else if !errors.Is(err, ErrAttributeNotFound) {
 				return fmt.Errorf("failed to fetch bucket metadata: %w", err)
 			}
@@ -752,32 +549,37 @@ func (h *S3TablesHandler) handleListTables(w http.ResponseWriter, r *http.Reques
 			policyData, err = h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
 			if err == nil {
 				bucketPolicy = string(policyData)
-			} else if !errors.Is(err, ErrAttributeNotFound) {
+			} else if !errors.Is(err, ErrAttributeNotFound) && !errors.Is(err, filer_pb.ErrNotFound) {
 				return fmt.Errorf("failed to fetch bucket policy: %w", err)
 			}
 			if tags, err := h.readTags(r.Context(), client, bucketPath); err != nil {
-				return fmt.Errorf("failed to read bucket tags: %w", err)
+				if !errors.Is(err, filer_pb.ErrNotFound) {
+					return fmt.Errorf("failed to read bucket tags: %w", err)
+				}
 			} else if tags != nil {
 				bucketTags = tags
 			}
 
+			if targetAbsent {
+				if !h.authorizeAbsentTarget(r, &singleClient{client}, "ListTables", bucketName, namespaceName, "", "") {
+					return ErrAccessDenied
+				}
+				return filer_pb.ErrNotFound
+			}
+
 			bucketARN := h.generateTableBucketARN(bucketMeta.OwnerAccountID, bucketName)
 			identityActions := getIdentityActions(r)
-			nsAllowed := CheckPermissionWithContext("ListTables", accountID, nsMeta.OwnerAccountID, namespacePolicy, bucketARN, &PolicyContext{
-				TableBucketName: bucketName,
-				Namespace:       namespaceName,
-				TableBucketTags: bucketTags,
-				IdentityActions: identityActions,
-				DefaultAllow:    h.defaultAllowFor(r),
-			})
-			bucketAllowed := CheckPermissionWithContext("ListTables", accountID, bucketMeta.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-				TableBucketName: bucketName,
-				Namespace:       namespaceName,
-				TableBucketTags: bucketTags,
-				IdentityActions: identityActions,
-				DefaultAllow:    h.defaultAllowFor(r),
-			})
-			if !nsAllowed && !bucketAllowed {
+			if !CheckTableOrBucketPermission("ListTables", accountID,
+				nsMeta.OwnerAccountID, namespacePolicy, bucketARN,
+				bucketMeta.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
+					TrustedIssuers:   h.trustedIssuers(r),
+					IsLocalAccountID: h.localAccountIDs,
+					TableBucketName:  bucketName,
+					Namespace:        namespaceName,
+					TableBucketTags:  bucketTags,
+					IdentityActions:  identityActions,
+					DefaultAllow:     h.defaultAllowFor(r),
+				}) {
 				return ErrAccessDenied
 			}
 
@@ -795,7 +597,13 @@ func (h *S3TablesHandler) handleListTables(w http.ResponseWriter, r *http.Reques
 			// Fetch bucket metadata and policy
 			data, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata)
 			if err != nil {
-				return fmt.Errorf("failed to fetch bucket metadata: %w", err)
+				if !errors.Is(err, filer_pb.ErrNotFound) && !errors.Is(err, ErrAttributeNotFound) {
+					return fmt.Errorf("failed to fetch bucket metadata: %w", err)
+				}
+				if !h.authorizeAbsentTarget(r, &singleClient{client}, "ListTables", bucketName, "", "", "") {
+					return ErrAccessDenied
+				}
+				return filer_pb.ErrNotFound
 			}
 			if err := json.Unmarshal(data, &bucketMeta); err != nil {
 				return fmt.Errorf("failed to unmarshal bucket metadata: %w", err)
@@ -817,10 +625,12 @@ func (h *S3TablesHandler) handleListTables(w http.ResponseWriter, r *http.Reques
 			bucketARN := h.generateTableBucketARN(bucketMeta.OwnerAccountID, bucketName)
 			identityActions := getIdentityActions(r)
 			if !CheckPermissionWithContext("ListTables", accountID, bucketMeta.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-				TableBucketName: bucketName,
-				TableBucketTags: bucketTags,
-				IdentityActions: identityActions,
-				DefaultAllow:    h.defaultAllowFor(r),
+				TrustedIssuers:   h.trustedIssuers(r),
+				IsLocalAccountID: h.localAccountIDs,
+				TableBucketName:  bucketName,
+				TableBucketTags:  bucketTags,
+				IdentityActions:  identityActions,
+				DefaultAllow:     h.defaultAllowFor(r),
 			}) {
 				return ErrAccessDenied
 			}
@@ -914,7 +724,7 @@ func (h *S3TablesHandler) listTablesWithClient(r *http.Request, client filer_pb.
 			}
 
 			// Views share the table layout; exclude them from table listings.
-			if entryType(entry.Entry.Extended) == EntryTypeView {
+			if EntryType(entry.Entry.Extended) == EntryTypeView {
 				continue
 			}
 
@@ -936,11 +746,13 @@ func (h *S3TablesHandler) listTablesWithClient(r *http.Request, client filer_pb.
 			tableARN := h.generateTableARN(metadata.OwnerAccountID, bucketName, namespaceName+"/"+entry.Entry.Name)
 
 			tables = append(tables, TableSummary{
-				Name:       entry.Entry.Name,
-				TableARN:   tableARN,
-				Namespace:  expandNamespace(namespaceName),
-				CreatedAt:  metadata.CreatedAt,
-				ModifiedAt: metadata.ModifiedAt,
+				Name:             entry.Entry.Name,
+				TableARN:         tableARN,
+				Namespace:        expandNamespace(namespaceName),
+				Format:           metadata.Format,
+				CreatedAt:        metadata.CreatedAt,
+				ModifiedAt:       metadata.ModifiedAt,
+				MetadataLocation: metadata.MetadataLocation,
 			})
 
 			if len(tables) >= maxTables {
@@ -1085,7 +897,7 @@ func (h *S3TablesHandler) handleDeleteTable(w http.ResponseWriter, r *http.Reque
 	var tableTags map[string]string
 	var bucketMetadata tableBucketMetadata
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		data, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyMetadata)
+		data, err := h.readTableMetadata(r.Context(), client, tablePath)
 		if err != nil {
 			return err
 		}
@@ -1094,12 +906,6 @@ func (h *S3TablesHandler) handleDeleteTable(w http.ResponseWriter, r *http.Reque
 			return fmt.Errorf("failed to unmarshal table metadata: %w", err)
 		}
 
-		if req.VersionToken != "" {
-			if metadata.VersionToken != req.VersionToken {
-				return ErrVersionTokenMismatch
-			}
-		}
-
 		// Fetch table policy if it exists
 		policyData, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyPolicy)
 		if err != nil {
@@ -1157,28 +963,31 @@ func (h *S3TablesHandler) handleDeleteTable(w http.ResponseWriter, r *http.Reque
 	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
-	tableAllowed := CheckPermissionWithContext("DeleteTable", principal, metadata.OwnerAccountID, tablePolicy, tableARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	bucketAllowed := CheckPermissionWithContext("DeleteTable", principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	if !tableAllowed && !bucketAllowed {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to delete table")
+	allowed := CheckTableOrBucketPermission("DeleteTable", principal,
+		metadata.OwnerAccountID, tablePolicy, tableARN,
+		bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        namespaceName,
+			TableName:        tableName,
+			TableBucketTags:  bucketTags,
+			ResourceTags:     tableTags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		})
+	if !allowed {
+		if h.canReadEntry("GetTable", principal, metadata.OwnerAccountID, bucketMetadata.OwnerAccountID, tablePolicy, bucketPolicy, tableARN, bucketARN, bucketName, namespaceName, tableName, bucketTags, tableTags, identityActions, r) {
+			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to delete table")
+		} else {
+			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", tableName))
+		}
 		return NewAuthError("DeleteTable", principal, "not authorized to delete table")
 	}
+	if req.VersionToken != "" && metadata.VersionToken != req.VersionToken {
+		h.writeError(w, http.StatusConflict, ErrCodeConflict, "version token mismatch")
+		return ErrVersionTokenMismatch
+	}
 
 	// Delete the table
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
@@ -1192,6 +1001,36 @@ func (h *S3TablesHandler) handleDeleteTable(w http.ResponseWriter, r *http.Reque
 			if strings.HasPrefix(tablePath+"/", dataPath+"/") {
 				return fmt.Errorf("refusing to delete table %s: data path %q is an ancestor of catalog path %q", tableName, dataPath, tablePath)
 			}
+			// The location is caller-supplied, so it may name a sibling that is
+			// still a live catalog entry. Only this table's authorization was
+			// checked; a decoupled location has had its catalog attributes
+			// stripped, so a surviving marker means the path belongs elsewhere.
+			// The marker lives on the entry's name path, so ancestors of the
+			// data path are checked as well: a location inside another table's
+			// directory resolves above any marker the data path itself would
+			// carry.
+			for dir := path.Dir(dataPath); dir != GetTableBucketPath(bucketName) && strings.HasPrefix(dir, GetTableBucketPath(bucketName)+"/"); dir = path.Dir(dir) {
+				ancestor, lookupErr := h.lookupEntry(r.Context(), client, dir)
+				if lookupErr != nil {
+					if errors.Is(lookupErr, filer_pb.ErrNotFound) {
+						continue
+					}
+					return fmt.Errorf("refusing to delete table %s: cannot read data path %q: %w", tableName, dataPath, lookupErr)
+				}
+				if _, ok := ancestor.Extended[ExtendedKeyEntryType]; ok {
+					return fmt.Errorf("refusing to delete table %s: data path %q is inside another catalog entry", tableName, dataPath)
+				}
+				var ownerMeta tableMetadataInternal
+				if data := ancestor.Extended[ExtendedKeyMetadata]; json.Unmarshal(data, &ownerMeta) == nil && ownerMeta.Name != "" {
+					return fmt.Errorf("refusing to delete table %s: data path %q is inside another catalog entry", tableName, dataPath)
+				}
+			}
+			switch _, markerErr := h.getExtendedAttribute(r.Context(), client, dataPath, ExtendedKeyMetadata); {
+			case markerErr == nil:
+				return fmt.Errorf("refusing to delete table %s: data path %q is another catalog entry", tableName, dataPath)
+			case !errors.Is(markerErr, ErrAttributeNotFound) && !errors.Is(markerErr, filer_pb.ErrNotFound):
+				return fmt.Errorf("refusing to delete table %s: cannot read data path %q: %w", tableName, dataPath, markerErr)
+			}
 			// Decoupled table (renamed, or created over a leftover): its data
 			// lives elsewhere. Purge the data, then clear the catalog marker
 			// without deleting the name path -- it may still hold another
@@ -1200,7 +1039,8 @@ func (h *S3TablesHandler) handleDeleteTable(w http.ResponseWriter, r *http.Reque
 				return err
 			}
 			return h.removeExtendedAttributes(r.Context(), client, tablePath,
-				ExtendedKeyMetadata, ExtendedKeyMetadataVersion, ExtendedKeyPolicy, ExtendedKeyTags, ExtendedKeyEntryType)
+				ExtendedKeyMetadata, ExtendedKeyMetadataVersion, ExtendedKeyPolicy, ExtendedKeyTags, ExtendedKeyEntryType,
+				ExtendedKeyMaintenance, ExtendedKeyMaintenanceStatus)
 		}
 		// Colocated table: the name path holds the data.
 		return h.deleteDirectory(r.Context(), client, tablePath)
@@ -1215,11 +1055,120 @@ func (h *S3TablesHandler) handleDeleteTable(w http.ResponseWriter, r *http.Reque
 	return nil
 }
 
+// renamedTableAttributes are the catalog attributes a rename carries to the new
+// name and clears from the old one.
+var renamedTableAttributes = []string{
+	ExtendedKeyMetadata,
+	ExtendedKeyMetadataVersion,
+	ExtendedKeyPolicy,
+	ExtendedKeyTags,
+	ExtendedKeyMaintenance,
+	ExtendedKeyMaintenanceStatus,
+	ExtendedKeyEntryType,
+}
+
+// catalogEntryKind describes the entry a rename operates on, so tables and
+// views share one implementation of the catalog-only move.
+type catalogEntryKind struct {
+	entryType string
+	noun      string
+	renameOp  string
+	createOp  string
+	readOp    string
+	// tagsForRead mirrors whether the read handler supplies resource tags to
+	// the policy check, so the denied-write visibility test cannot accept a
+	// tag-conditioned allow the real read would not evaluate.
+	tagsForRead  bool
+	notFoundCode string
+	existsCode   string
+	// resourceARN builds the ARN a policy scoped to this entry would name, so a
+	// view is authorized against its view ARN and not a table ARN.
+	resourceARN func(h *S3TablesHandler, ownerAccountID, bucketName, id string) string
+}
+
+var (
+	tableEntryKind = catalogEntryKind{
+		entryType:    EntryTypeTable,
+		noun:         "table",
+		renameOp:     "RenameTable",
+		createOp:     "CreateTable",
+		readOp:       "GetTable",
+		tagsForRead:  true,
+		notFoundCode: ErrCodeNoSuchTable,
+		existsCode:   ErrCodeTableAlreadyExists,
+		resourceARN: func(h *S3TablesHandler, ownerAccountID, bucketName, id string) string {
+			return h.generateTableARN(ownerAccountID, bucketName, id)
+		},
+	}
+	viewEntryKind = catalogEntryKind{
+		entryType:    EntryTypeView,
+		noun:         "view",
+		renameOp:     "RenameView",
+		createOp:     "CreateView",
+		readOp:       "GetView",
+		tagsForRead:  false,
+		notFoundCode: ErrCodeNoSuchView,
+		existsCode:   ErrCodeViewAlreadyExists,
+		resourceARN: func(h *S3TablesHandler, ownerAccountID, bucketName, id string) string {
+			return h.generateViewARN(ownerAccountID, bucketName, id)
+		},
+	}
+)
+
+// readTableMetadata returns the entry's table-metadata xattr. A view stored at
+// the same name is reported absent, the way GetTable and the renamer's
+// entry-type check already treat kind mismatches.
+func (h *S3TablesHandler) readTableMetadata(ctx context.Context, client filer_pb.SeaweedFilerClient, tablePath string) ([]byte, error) {
+	entry, err := h.lookupEntry(ctx, client, tablePath)
+	if err != nil {
+		return nil, err
+	}
+	if EntryType(entry.Extended) == EntryTypeView {
+		return nil, filer_pb.ErrNotFound
+	}
+	data, ok := entry.Extended[ExtendedKeyMetadata]
+	if !ok {
+		return nil, fmt.Errorf("%w: %s", ErrAttributeNotFound, ExtendedKeyMetadata)
+	}
+	return data, nil
+}
+
+// canReadEntry reports whether the principal may read the catalog entry a
+// denied write would touch. A denied write is then answered with 403 — the
+// refusal leaks nothing a reader could not load anyway — while a caller that
+// cannot see the entry keeps the not-found veil.
+func (h *S3TablesHandler) canReadEntry(readOp, principal, tableOwner, bucketOwner, tablePolicy, bucketPolicy, tableARN, bucketARN, bucketName, namespace, name string, bucketTags, tableTags map[string]string, identityActions []string, r *http.Request) bool {
+	ctx := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespace,
+		TableName:        name,
+		TableBucketTags:  bucketTags,
+		ResourceTags:     tableTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	return CheckTableOrBucketPermission(readOp, principal,
+		tableOwner, tablePolicy, tableARN,
+		bucketOwner, bucketPolicy, bucketARN, ctx)
+}
+
 // handleRenameTable moves a table's catalog entry to a new namespace/name within
 // the same bucket. It is catalog-only: the metadata.json and data files stay put,
 // the destination keeps the source's MetadataLocation, and the source name is
 // soft-deleted in place (its catalog xattrs are dropped, its data is left intact).
 func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	return h.renameCatalogEntry(w, r, filerClient, tableEntryKind)
+}
+
+// handleRenameView is handleRenameTable for views, which live in the same
+// namespace directory under the same name rules.
+func (h *S3TablesHandler) handleRenameView(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	return h.renameCatalogEntry(w, r, filerClient, viewEntryKind)
+}
+
+func (h *S3TablesHandler) renameCatalogEntry(w http.ResponseWriter, r *http.Request, filerClient FilerClient, kind catalogEntryKind) error {
 	var req RenameTableRequest
 	if err := h.readRequestBody(r, &req); err != nil {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
@@ -1263,11 +1212,18 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 
 	var metadata tableMetadataInternal
 	var metadataVersionXattr []byte
+	var maintenanceXattr []byte
+	var maintenanceStatusXattr []byte
+	// The values the rename copies. The source is only cleared while it still
+	// holds exactly these, so a write that lands mid-rename is not deleted here
+	// after having missed the copy to the destination.
+	var copiedFromSource map[string][]byte
 	var tablePolicy string
 	var bucketPolicy string
 	var bucketTags map[string]string
 	var tableTags map[string]string
 	var bucketMetadata tableBucketMetadata
+	var srcExtended map[string][]byte
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		data, err := h.getExtendedAttribute(r.Context(), client, srcPath, ExtendedKeyMetadata)
 		if err != nil {
@@ -1294,6 +1250,35 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 			return err
 		}
 
+		srcEntry, err := h.lookupEntry(r.Context(), client, srcPath)
+		if err != nil {
+			return err
+		}
+		srcExtended = srcEntry.Extended
+		copiedFromSource = make(map[string][]byte, len(renamedTableAttributes))
+		for _, key := range renamedTableAttributes {
+			copiedFromSource[key] = srcEntry.Extended[key]
+		}
+
+		// The maintenance configuration and its last-run status belong to the
+		// table, so they move with it; leaving them behind re-enables
+		// maintenance under the new name and leaks the old settings onto
+		// whatever is created at the old one.
+		for _, attr := range []struct {
+			key  string
+			dest *[]byte
+		}{
+			{ExtendedKeyMaintenance, &maintenanceXattr},
+			{ExtendedKeyMaintenanceStatus, &maintenanceStatusXattr},
+		} {
+			data, err := h.getExtendedAttribute(r.Context(), client, srcPath, attr.key)
+			if err == nil {
+				*attr.dest = data
+			} else if !errors.Is(err, ErrAttributeNotFound) {
+				return fmt.Errorf("failed to fetch %s: %w", attr.key, err)
+			}
+		}
+
 		bucketPath := GetTableBucketPath(bucketName)
 		data, err = h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata)
 		if err == nil {
@@ -1318,45 +1303,58 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 	})
 
 	if err != nil {
-		if errors.Is(err, filer_pb.ErrNotFound) {
-			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchTable, fmt.Sprintf("table %s not found", srcName))
+		if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, ErrAttributeNotFound) {
+			h.writeError(w, http.StatusNotFound, kind.notFoundCode, fmt.Sprintf("%s %s not found", kind.noun, srcName))
 		} else {
-			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to check table: %v", err))
+			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to check %s: %v", kind.noun, err))
 		}
 		return err
 	}
 
-	tableARN := h.generateTableARN(metadata.OwnerAccountID, bucketName, srcNamespace+"/"+srcName)
+	// Tables and views share the namespace directory, so a rename must not pick
+	// up the other kind under the same name.
+	if EntryType(srcExtended) != kind.entryType {
+		h.writeError(w, http.StatusNotFound, kind.notFoundCode, fmt.Sprintf("%s %s not found", kind.noun, srcName))
+		return fmt.Errorf("%s %s not found", kind.noun, srcName)
+	}
+
+	tableARN := kind.resourceARN(h, metadata.OwnerAccountID, bucketName, srcNamespace+"/"+srcName)
 	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
-	tableAllowed := CheckPermissionWithContext("RenameTable", principal, metadata.OwnerAccountID, tablePolicy, tableARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       srcNamespace,
-		TableName:       srcName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	bucketAllowed := CheckPermissionWithContext("RenameTable", principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       srcNamespace,
-		TableName:       srcName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	if !tableAllowed && !bucketAllowed {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to rename table")
-		return NewAuthError("RenameTable", principal, "not authorized to rename table")
+	allowed := CheckTableOrBucketPermission(kind.renameOp, principal,
+		metadata.OwnerAccountID, tablePolicy, tableARN,
+		bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        srcNamespace,
+			TableName:        srcName,
+			TableBucketTags:  bucketTags,
+			ResourceTags:     tableTags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		})
+	if !allowed {
+		readTags := tableTags
+		if !kind.tagsForRead {
+			readTags = nil
+		}
+		if h.canReadEntry(kind.readOp, principal, metadata.OwnerAccountID, bucketMetadata.OwnerAccountID, tablePolicy, bucketPolicy, tableARN, bucketARN, bucketName, srcNamespace, srcName, bucketTags, readTags, identityActions, r) {
+			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to rename "+kind.noun)
+		} else {
+			h.writeError(w, http.StatusNotFound, kind.notFoundCode, fmt.Sprintf("%s %s not found", kind.noun, srcName))
+		}
+		return NewAuthError(kind.renameOp, principal, "not authorized to rename "+kind.noun)
 	}
 
-	// Require the destination namespace to exist and the destination table to be free.
+	// Require the destination namespace to exist. Whether the destination name
+	// is taken is only recorded here; reporting the conflict before the
+	// destination authorization check would disclose it to denied callers.
 	destNamespacePath := GetNamespacePath(bucketName, destNamespace)
 	var destNamespaceMetadata namespaceMetadata
 	var destNamespacePolicy string
+	var destExists bool
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		data, err := h.getExtendedAttribute(r.Context(), client, destNamespacePath, ExtendedKeyMetadata)
 		if err != nil {
@@ -1372,7 +1370,7 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 			return fmt.Errorf("failed to fetch destination namespace policy: %w", err)
 		}
 		if _, err := h.getExtendedAttribute(r.Context(), client, destPath, ExtendedKeyMetadata); err == nil {
-			return ErrTableAlreadyExists
+			destExists = true
 		} else if !errors.Is(err, filer_pb.ErrNotFound) && !errors.Is(err, ErrAttributeNotFound) {
 			return err
 		}
@@ -1380,9 +1378,7 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 	})
 
 	if err != nil {
-		if errors.Is(err, ErrTableAlreadyExists) {
-			h.writeError(w, http.StatusConflict, ErrCodeTableAlreadyExists, fmt.Sprintf("table %s already exists", destName))
-		} else if errors.Is(err, filer_pb.ErrNotFound) {
+		if errors.Is(err, filer_pb.ErrNotFound) {
 			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", destNamespace))
 		} else {
 			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to check destination: %v", err))
@@ -1392,26 +1388,27 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 
 	// Renaming places the table into the destination namespace, so the principal
 	// must also be allowed to create a table there (the source check alone lets a
-	// caller move tables into namespaces they don't control).
-	destNamespaceAllowed := CheckPermissionWithContext("CreateTable", principal, destNamespaceMetadata.OwnerAccountID, destNamespacePolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       destNamespace,
-		TableName:       destName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	destBucketAllowed := CheckPermissionWithContext("CreateTable", principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       destNamespace,
-		TableName:       destName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	if !destNamespaceAllowed && !destBucketAllowed {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create table in the destination namespace")
-		return NewAuthError("RenameTable", principal, "not authorized to create table in the destination namespace")
+	// caller move tables into namespaces they don't control). Denials report the
+	// same not-found as a missing destination namespace.
+	if !CheckTableOrBucketPermission(kind.createOp, principal,
+		destNamespaceMetadata.OwnerAccountID, destNamespacePolicy, bucketARN,
+		bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        destNamespace,
+			TableName:        destName,
+			TableBucketTags:  bucketTags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		}) {
+		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", destNamespace))
+		return NewAuthError(kind.renameOp, principal, "not authorized to create "+kind.noun+" in the destination namespace")
+	}
+
+	if destExists {
+		h.writeError(w, http.StatusConflict, kind.existsCode, fmt.Sprintf("%s %s already exists", kind.noun, destName))
+		return ErrTableAlreadyExists
 	}
 
 	metadata.Name = destName
@@ -1420,7 +1417,7 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 
 	metadataBytes, err := json.Marshal(&metadata)
 	if err != nil {
-		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to marshal table metadata")
+		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to marshal "+kind.noun+" metadata")
 		return fmt.Errorf("failed to marshal metadata: %w", err)
 	}
 
@@ -1433,6 +1430,9 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 		if err := h.setExtendedAttribute(r.Context(), client, destPath, ExtendedKeyMetadata, metadataBytes); err != nil {
 			return err
 		}
+		if err := h.setExtendedAttribute(r.Context(), client, destPath, ExtendedKeyEntryType, []byte(kind.entryType)); err != nil {
+			return err
+		}
 		if len(metadataVersionXattr) > 0 {
 			if err := h.setExtendedAttribute(r.Context(), client, destPath, ExtendedKeyMetadataVersion, metadataVersionXattr); err != nil {
 				return err
@@ -1452,60 +1452,92 @@ func (h *S3TablesHandler) handleRenameTable(w http.ResponseWriter, r *http.Reque
 				return err
 			}
 		}
+		if len(maintenanceXattr) > 0 {
+			if err := h.setExtendedAttribute(r.Context(), client, destPath, ExtendedKeyMaintenance, maintenanceXattr); err != nil {
+				return err
+			}
+		}
+		if len(maintenanceStatusXattr) > 0 {
+			if err := h.setExtendedAttribute(r.Context(), client, destPath, ExtendedKeyMaintenanceStatus, maintenanceStatusXattr); err != nil {
+				return err
+			}
+		}
 		// Soft-delete the source catalog identity in place: drop its catalog xattrs
 		// so the name stops resolving while the metadata/ and data/ children stay put
 		// (manifests embed absolute paths, so the data must not move).
-		return h.removeExtendedAttributes(r.Context(), client, srcPath,
-			ExtendedKeyMetadata, ExtendedKeyMetadataVersion, ExtendedKeyPolicy, ExtendedKeyTags)
+		return h.removeExtendedAttributesIf(r.Context(), client, srcPath, copiedFromSource,
+			renamedTableAttributes...)
 	})
 
 	if err != nil {
-		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to rename table")
+		if errors.Is(err, ErrConcurrentUpdate) {
+			h.writeError(w, http.StatusConflict, ErrCodeConflict, kind.noun+" changed during rename, retry the request")
+			return err
+		}
+		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to rename "+kind.noun)
 		return err
 	}
 
 	h.writeJSON(w, http.StatusOK, &RenameTableResponse{
-		TableARN:         h.generateTableARN(metadata.OwnerAccountID, bucketName, destNamespace+"/"+destName),
+		TableARN:         kind.resourceARN(h, metadata.OwnerAccountID, bucketName, destNamespace+"/"+destName),
 		MetadataLocation: metadata.MetadataLocation,
 	})
 	return nil
 }
 
-// handleUpdateTable updates table metadata
-func (h *S3TablesHandler) handleUpdateTable(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
-	var req UpdateTableRequest
-	if err := h.readRequestBody(r, &req); err != nil {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
-	}
+// updateTableTarget is the table state an update was authorized against: the
+// stored values the optimistic-concurrency check compares and the fields the
+// response echoes back.
+type updateTableTarget struct {
+	bucketName     string
+	namespaceName  string
+	tableName      string
+	tablePath      string
+	tableARN       string
+	metadata       tableMetadataInternal
+	storedMetadata []byte
+	storedPolicy   []byte
+}
 
+// authorizeUpdateTable validates the names an update names, loads the table
+// and the policies governing it, and checks the caller may update it, writing
+// the error response itself. Credential vending asks the same question without
+// updating anything, so it runs this gate through Manager.AuthorizeUpdateTable.
+func (h *S3TablesHandler) authorizeUpdateTable(w http.ResponseWriter, r *http.Request, filerClient FilerClient, req *UpdateTableRequest) (*updateTableTarget, error) {
 	if req.TableBucketARN == "" || len(req.Namespace) == 0 || req.Name == "" {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "tableBucketARN, namespace, and name are required")
-		return fmt.Errorf("missing required parameters")
+		return nil, fmt.Errorf("missing required parameters")
 	}
 
 	namespaceName, err := validateNamespace(req.Namespace)
 	if err != nil {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
+		return nil, err
 	}
 
 	bucketName, err := parseBucketNameFromARN(req.TableBucketARN)
 	if err != nil {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
+		return nil, err
 	}
 
 	tableName, err := validateTableName(req.Name)
 	if err != nil {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
+		return nil, err
+	}
+
+	if err := ValidateMetadataLocation(req.MetadataLocation, bucketName, namespaceName); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return nil, err
 	}
 
 	tablePath := GetTablePath(bucketName, namespaceName, tableName)
 
 	// Load existing metadata and policies for authorization
 	var metadata tableMetadataInternal
+	var storedMetadata []byte
+	var storedPolicy []byte
 	var tablePolicy string
 	var bucketPolicy string
 	var bucketTags map[string]string
@@ -1514,18 +1546,20 @@ func (h *S3TablesHandler) handleUpdateTable(w http.ResponseWriter, r *http.Reque
 
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		// 1. Get Table Metadata
-		data, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyMetadata)
+		data, err := h.readTableMetadata(r.Context(), client, tablePath)
 		if err != nil {
 			return err
 		}
 		if err := json.Unmarshal(data, &metadata); err != nil {
 			return fmt.Errorf("failed to unmarshal table metadata: %w", err)
 		}
+		storedMetadata = data
 
 		// 2. Get Table Policy & Tags
 		policyData, err := h.getExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyPolicy)
 		if err == nil {
 			tablePolicy = string(policyData)
+			storedPolicy = policyData
 		} else if !errors.Is(err, ErrAttributeNotFound) {
 			return fmt.Errorf("failed to fetch table policy: %w", err)
 		}
@@ -1564,7 +1598,7 @@ func (h *S3TablesHandler) handleUpdateTable(w http.ResponseWriter, r *http.Reque
 		} else {
 			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, err.Error())
 		}
-		return err
+		return nil, err
 	}
 
 	// Authorization Check
@@ -1573,30 +1607,55 @@ func (h *S3TablesHandler) handleUpdateTable(w http.ResponseWriter, r *http.Reque
 	principal := h.getAccountID(r)
 	identityActions := getIdentityActions(r)
 
-	tableAllowed := CheckPermissionWithContext("UpdateTable", principal, metadata.OwnerAccountID, tablePolicy, tableARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
-	bucketAllowed := CheckPermissionWithContext("UpdateTable", principal, bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespaceName,
-		TableName:       tableName,
-		TableBucketTags: bucketTags,
-		ResourceTags:    tableTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
-	})
+	allowed := CheckTableOrBucketPermission("UpdateTable", principal,
+		metadata.OwnerAccountID, tablePolicy, tableARN,
+		bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, &PolicyContext{
+			TrustedIssuers:   h.trustedIssuers(r),
+			IsLocalAccountID: h.localAccountIDs,
+			TableBucketName:  bucketName,
+			Namespace:        namespaceName,
+			TableName:        tableName,
+			TableBucketTags:  bucketTags,
+			ResourceTags:     tableTags,
+			IdentityActions:  identityActions,
+			DefaultAllow:     h.defaultAllowFor(r),
+		})
 
-	if !tableAllowed && !bucketAllowed {
-		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to update table")
-		return NewAuthError("UpdateTable", principal, "not authorized to update table")
+	if !allowed {
+		if h.canReadEntry("GetTable", principal, metadata.OwnerAccountID, bucketMetadata.OwnerAccountID, tablePolicy, bucketPolicy, tableARN, bucketARN, bucketName, namespaceName, tableName, bucketTags, tableTags, identityActions, r) {
+			h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to update table")
+		} else {
+			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchTable, "table not found")
+		}
+		return nil, NewAuthError("UpdateTable", principal, "not authorized to update table")
 	}
 
+	return &updateTableTarget{
+		bucketName:     bucketName,
+		namespaceName:  namespaceName,
+		tableName:      tableName,
+		tablePath:      tablePath,
+		tableARN:       tableARN,
+		metadata:       metadata,
+		storedMetadata: storedMetadata,
+		storedPolicy:   storedPolicy,
+	}, nil
+}
+
+// handleUpdateTable updates table metadata
+func (h *S3TablesHandler) handleUpdateTable(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	var req UpdateTableRequest
+	if err := h.readRequestBody(r, &req); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	target, err := h.authorizeUpdateTable(w, r, filerClient, &req)
+	if err != nil {
+		return err
+	}
+	metadata := target.metadata
+
 	// Check version token if provided
 	if req.VersionToken != "" && req.VersionToken != metadata.VersionToken {
 		h.writeError(w, http.StatusConflict, ErrCodeConflict, "Version token mismatch")
@@ -1637,22 +1696,175 @@ func (h *S3TablesHandler) handleUpdateTable(w http.ResponseWriter, r *http.Reque
 		return err
 	}
 
+	// Conditional on the metadata this request read and authorized against:
+	// two commits that both passed the version-token check would otherwise each
+	// write their own metadata and the later one would drop the earlier
+	// snapshot. mutateEntryExtended retries on a changed entry, so the check
+	// lives in the mutation, where it sees the value that is current now.
 	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		if err := h.setExtendedAttribute(r.Context(), client, tablePath, ExtendedKeyMetadata, metadataBytes); err != nil {
-			return err
-		}
-		return nil
+		return h.mutateEntryExtended(r.Context(), client, target.tablePath, func(extended map[string][]byte) error {
+			if !bytes.Equal(extended[ExtendedKeyMetadata], target.storedMetadata) {
+				return fmt.Errorf("%w: %s", ErrConcurrentUpdate, ExtendedKeyMetadata)
+			}
+			// The policy this request was authorized against must still be the
+			// one in force: an administrator restricting it mid-commit should
+			// send the caller back through authorization, not have its decision
+			// applied afterwards.
+			if !bytes.Equal(extended[ExtendedKeyPolicy], target.storedPolicy) {
+				return fmt.Errorf("%w: %s", ErrConcurrentUpdate, ExtendedKeyPolicy)
+			}
+			extended[ExtendedKeyMetadata] = metadataBytes
+			return nil
+		})
 	})
 
 	if err != nil {
+		if errors.Is(err, ErrConcurrentUpdate) {
+			h.writeError(w, http.StatusConflict, ErrCodeConflict, "table was updated concurrently")
+			return ErrVersionTokenMismatch
+		}
 		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, "failed to update metadata")
 		return err
 	}
 
 	h.writeJSON(w, http.StatusOK, &UpdateTableResponse{
-		TableARN:         tableARN,
+		TableARN:         target.tableARN,
 		MetadataLocation: metadata.MetadataLocation,
 		VersionToken:     metadata.VersionToken,
 	})
 	return nil
 }
+
+// createTableTarget is the namespace a create or register resolved to, once the
+// caller has been authorized to put a table there.
+type createTableTarget struct {
+	bucketName     string
+	namespaceName  string
+	tableName      string
+	bucketFormat   string
+	ownerAccountID string
+}
+
+// authorizeCreateTable validates the names a create names and checks the caller
+// may create a table in that namespace, writing the error response itself.
+// Deferred creates (Iceberg stage-create) write into the table bucket before any
+// table is registered, so they run this same gate first through
+// Manager.AuthorizeCreateTable.
+func (h *S3TablesHandler) authorizeCreateTable(w http.ResponseWriter, r *http.Request, filerClient FilerClient, tableBucketARN string, namespace []string, name string, requestTags map[string]string) (*createTableTarget, error) {
+	if tableBucketARN == "" {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "tableBucketARN is required")
+		return nil, fmt.Errorf("tableBucketARN is required")
+	}
+
+	namespaceName, err := validateNamespace(namespace)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return nil, err
+	}
+
+	if name == "" {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, "name is required")
+		return nil, fmt.Errorf("name is required")
+	}
+
+	bucketName, err := parseBucketNameFromARN(tableBucketARN)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return nil, err
+	}
+
+	tableName, err := validateTableName(name)
+	if err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return nil, err
+	}
+
+	// Check if namespace exists
+	namespacePath := GetNamespacePath(bucketName, namespaceName)
+	namespaceMetadata, err := h.loadNamespaceMetadata(r.Context(), filerClient, bucketName, namespaceName)
+	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", namespaceName))
+		} else {
+			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to check namespace: %v", err))
+		}
+		return nil, err
+	}
+
+	// Authorize table creation using policy framework (namespace + bucket policies)
+	accountID := h.getAccountID(r)
+	bucketPath := GetTableBucketPath(bucketName)
+	namespacePolicy := ""
+	bucketPolicy := ""
+	bucketTags := map[string]string{}
+	var bucketMetadata tableBucketMetadata
+
+	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		// Fetch bucket metadata to use correct owner for bucket policy evaluation
+		data, err := h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyMetadata)
+		if err == nil {
+			if err := json.Unmarshal(data, &bucketMetadata); err != nil {
+				return fmt.Errorf("failed to unmarshal bucket metadata: %w", err)
+			}
+		} else if !errors.Is(err, ErrAttributeNotFound) {
+			return fmt.Errorf("failed to fetch bucket metadata: %v", err)
+		}
+
+		// Fetch namespace policy if it exists
+		policyData, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyPolicy)
+		if err == nil {
+			namespacePolicy = string(policyData)
+		} else if !errors.Is(err, ErrAttributeNotFound) {
+			return fmt.Errorf("failed to fetch namespace policy: %v", err)
+		}
+
+		// Fetch bucket policy if it exists
+		policyData, err = h.getExtendedAttribute(r.Context(), client, bucketPath, ExtendedKeyPolicy)
+		if err == nil {
+			bucketPolicy = string(policyData)
+		} else if !errors.Is(err, ErrAttributeNotFound) {
+			return fmt.Errorf("failed to fetch bucket policy: %v", err)
+		}
+		if tags, err := h.readTags(r.Context(), client, bucketPath); err != nil {
+			return err
+		} else if tags != nil {
+			bucketTags = tags
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to fetch policies: %v", err))
+		return nil, err
+	}
+
+	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
+	identityActions := getIdentityActions(r)
+	policyContext := &PolicyContext{
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespaceName,
+		TableName:        tableName,
+		RequestTags:      requestTags,
+		TagKeys:          mapKeys(requestTags),
+		TableBucketTags:  bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
+	}
+	if !CheckTableOrBucketPermission("CreateTable", accountID,
+		namespaceMetadata.OwnerAccountID, namespacePolicy, bucketARN,
+		bucketMetadata.OwnerAccountID, bucketPolicy, bucketARN, policyContext) {
+		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create table in this namespace")
+		return nil, ErrAccessDenied
+	}
+
+	return &createTableTarget{
+		bucketName:     bucketName,
+		namespaceName:  namespaceName,
+		tableName:      tableName,
+		bucketFormat:   bucketMetadata.Format,
+		ownerAccountID: namespaceMetadata.OwnerAccountID,
+	}, nil
+}
diff --git a/weed/s3api/s3tables/handler_update_cas_test.go b/weed/s3api/s3tables/handler_update_cas_test.go
new file mode 100644
index 0000000000..aca6539fd9
--- /dev/null
+++ b/weed/s3api/s3tables/handler_update_cas_test.go
@@ -0,0 +1,98 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func updateTableRequest(t *testing.T, metadataLocation string, version int) *UpdateTableRequest {
+	t.Helper()
+	return &UpdateTableRequest{
+		TableBucketARN:   mustBucketARN(t),
+		Namespace:        []string{"ns"},
+		Name:             "t",
+		MetadataVersion:  version,
+		MetadataLocation: metadataLocation,
+	}
+}
+
+// A second commit that reads the same base must not overwrite the first one's
+// metadata pointer: the snapshot the first commit published would be lost.
+func TestUpdateTableRejectsLostUpdate(t *testing.T) {
+	fs, m := startRenameManager(t)
+
+	winnerLocation := "s3://" + renameTestBucket + "/ns/t/metadata/v4-winner.metadata.json"
+	fs.BeforeUpdate = func() {
+		winner, err := json.Marshal(tableMetadataInternal{
+			Name:             "t",
+			Namespace:        "ns",
+			Format:           "ICEBERG",
+			OwnerAccountID:   DefaultAccountID,
+			MetadataVersion:  4,
+			MetadataLocation: winnerLocation,
+			VersionToken:     generateVersionToken(),
+		})
+		require.NoError(t, err)
+		entry := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
+		require.NotNil(t, entry)
+		entry.Extended[ExtendedKeyMetadata] = winner
+	}
+
+	loserLocation := "s3://" + renameTestBucket + "/ns/t/metadata/v4-loser.metadata.json"
+	err := m.Execute(context.Background(), NewManagerClient(fs.Client), "UpdateTable",
+		updateTableRequest(t, loserLocation, 4), nil, "")
+
+	require.Error(t, err)
+	var s3Err *S3TablesError
+	require.ErrorAs(t, err, &s3Err)
+	assert.Equal(t, ErrCodeConflict, s3Err.Type)
+
+	got, err := runGetTable(t, m, fs, "ns", "t")
+	require.NoError(t, err)
+	assert.Equal(t, winnerLocation, got.MetadataLocation, "the first commit must survive")
+}
+
+// A policy written between the authorization check and the write decides
+// whether this caller may still commit, so the commit is rejected rather than
+// applied on a decision that has been overtaken - and the policy itself must
+// survive, not be reverted by the commit's stale copy of the entry.
+func TestUpdateTableRejectsWhenTheAuthorizingPolicyChanges(t *testing.T) {
+	fs, m := startRenameManager(t)
+
+	policy := []byte(`{"Version":"2012-10-17","Statement":[]}`)
+	fs.BeforeUpdate = func() {
+		entry := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
+		require.NotNil(t, entry)
+		entry.Extended[ExtendedKeyPolicy] = policy
+	}
+
+	location := "s3://" + renameTestBucket + "/ns/t/metadata/v4.metadata.json"
+	err := m.Execute(context.Background(), NewManagerClient(fs.Client), "UpdateTable",
+		updateTableRequest(t, location, 4), nil, "")
+
+	require.Error(t, err)
+	var s3Err *S3TablesError
+	require.ErrorAs(t, err, &s3Err)
+	assert.Equal(t, ErrCodeConflict, s3Err.Type)
+
+	entry := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "t")
+	require.NotNil(t, entry)
+	assert.Equal(t, policy, entry.Extended[ExtendedKeyPolicy], "the concurrent policy write must survive")
+}
+
+func TestUpdateTableAppliesWithoutContention(t *testing.T) {
+	fs, m := startRenameManager(t)
+
+	location := "s3://" + renameTestBucket + "/ns/t/metadata/v4.metadata.json"
+	require.NoError(t, m.Execute(context.Background(), NewManagerClient(fs.Client), "UpdateTable",
+		updateTableRequest(t, location, 4), nil, ""))
+
+	got, err := runGetTable(t, m, fs, "ns", "t")
+	require.NoError(t, err)
+	assert.Equal(t, location, got.MetadataLocation)
+	assert.Equal(t, 4, got.MetadataVersion)
+}
diff --git a/weed/s3api/s3tables/handler_view.go b/weed/s3api/s3tables/handler_view.go
index 79a4e8f0c7..57bad00c5c 100644
--- a/weed/s3api/s3tables/handler_view.go
+++ b/weed/s3api/s3tables/handler_view.go
@@ -52,14 +52,7 @@ func (h *S3TablesHandler) handleCreateView(w http.ResponseWriter, r *http.Reques
 
 	// Check if namespace exists
 	namespacePath := GetNamespacePath(bucketName, namespaceName)
-	var namespaceMetadata namespaceMetadata
-	err = filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		data, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyMetadata)
-		if err != nil {
-			return err
-		}
-		return json.Unmarshal(data, &namespaceMetadata)
-	})
+	namespaceMetadata, err := h.loadNamespaceMetadata(r.Context(), filerClient, bucketName, namespaceName)
 	if err != nil {
 		if errors.Is(err, filer_pb.ErrNotFound) {
 			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", namespaceName))
@@ -77,6 +70,14 @@ func (h *S3TablesHandler) handleCreateView(w http.ResponseWriter, r *http.Reques
 		return err
 	}
 
+	// A view is Iceberg metadata, so it belongs only in a bucket that holds
+	// Iceberg tables.
+	if bucketMetadata.Format != "" && bucketMetadata.Format != FormatIceberg {
+		message := fmt.Sprintf("table bucket %s holds %s tables and cannot hold views", bucketName, bucketMetadata.Format)
+		h.writeError(w, http.StatusConflict, ErrCodeConflict, message)
+		return fmt.Errorf("%s", message)
+	}
+
 	bucketARN := h.generateTableBucketARN(bucketMetadata.OwnerAccountID, bucketName)
 	if !h.authorizeViewOp(r, "CreateView", accountID, namespaceMetadata.OwnerAccountID, bucketMetadata.OwnerAccountID, namespacePolicy, bucketPolicy, bucketARN, bucketName, namespaceName, viewName, bucketTags) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to create view in this namespace")
@@ -93,7 +94,7 @@ func (h *S3TablesHandler) handleCreateView(w http.ResponseWriter, r *http.Reques
 		if err != nil {
 			return err
 		}
-		if entryType(entry.Extended) != EntryTypeView {
+		if EntryType(entry.Extended) != EntryTypeView {
 			existingIsTable = true
 			return nil
 		}
@@ -120,12 +121,17 @@ func (h *S3TablesHandler) handleCreateView(w http.ResponseWriter, r *http.Reques
 		return err
 	}
 
+	if err := ValidateMetadataLocation(req.MetadataLocation, bucketName, namespaceName); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
 	now := time.Now()
 	versionToken := generateVersionToken()
 	metadata := &tableMetadataInternal{
 		Name:             viewName,
 		Namespace:        namespaceName,
-		Format:           "ICEBERG",
+		Format:           FormatIceberg,
 		CreatedAt:        now,
 		ModifiedAt:       now,
 		OwnerAccountID:   namespaceMetadata.OwnerAccountID,
@@ -185,7 +191,7 @@ func (h *S3TablesHandler) handleGetView(w http.ResponseWriter, r *http.Request,
 		if err != nil {
 			return err
 		}
-		if entryType(entry.Extended) != EntryTypeView {
+		if EntryType(entry.Extended) != EntryTypeView {
 			return filer_pb.ErrNotFound
 		}
 		data, ok := entry.Extended[ExtendedKeyMetadata]
@@ -273,7 +279,13 @@ func (h *S3TablesHandler) handleListViews(w http.ResponseWriter, r *http.Request
 		var nsMeta namespaceMetadata
 		data, err := h.getExtendedAttribute(r.Context(), client, namespacePath, ExtendedKeyMetadata)
 		if err != nil {
-			return err
+			if !errors.Is(err, filer_pb.ErrNotFound) && !errors.Is(err, ErrAttributeNotFound) {
+				return err
+			}
+			if !h.authorizeAbsentTarget(r, &singleClient{client}, "ListViews", bucketName, namespaceName, "", "") {
+				return ErrAccessDenied
+			}
+			return filer_pb.ErrNotFound
 		}
 		if err := json.Unmarshal(data, &nsMeta); err != nil {
 			return err
@@ -354,7 +366,7 @@ func (h *S3TablesHandler) listViewsInNamespace(r *http.Request, client filer_pb.
 				continue
 			}
 			// Only include view entries; skip tables and untagged entries.
-			if entryType(entry.Entry.Extended) != EntryTypeView {
+			if EntryType(entry.Entry.Extended) != EntryTypeView {
 				continue
 			}
 			data, ok := entry.Entry.Extended[ExtendedKeyMetadata]
@@ -390,18 +402,31 @@ func (h *S3TablesHandler) listViewsInNamespace(r *http.Request, client filer_pb.
 	return views, lastFileName, nil
 }
 
-// handleUpdateView replaces the metadata pointer for a view, mirroring UpdateTable.
-func (h *S3TablesHandler) handleUpdateView(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
-	var req UpdateViewRequest
-	if err := h.readRequestBody(r, &req); err != nil {
-		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
-	}
+// updateViewTarget is the view state an update was authorized against: the
+// metadata the version-token check reads and the fields the response echoes.
+type updateViewTarget struct {
+	bucketName    string
+	namespaceName string
+	viewName      string
+	viewPath      string
+	viewARN       string
+	metadata      tableMetadataInternal
+}
 
+// authorizeUpdateView validates the names an update names, loads the view and
+// the policies governing it, and checks the caller may update it, writing the
+// error response itself. Credential vending asks the same question without
+// updating anything, so it runs this gate through Manager.AuthorizeUpdateView.
+func (h *S3TablesHandler) authorizeUpdateView(w http.ResponseWriter, r *http.Request, filerClient FilerClient, req *UpdateViewRequest) (*updateViewTarget, error) {
 	bucketName, namespaceName, viewName, err := h.parseViewRef(req.TableBucketARN, req.Namespace, req.Name)
 	if err != nil {
 		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
-		return err
+		return nil, err
+	}
+
+	if err := ValidateMetadataLocation(req.MetadataLocation, bucketName, namespaceName); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return nil, err
 	}
 
 	viewPath := GetTablePath(bucketName, namespaceName, viewName)
@@ -411,7 +436,7 @@ func (h *S3TablesHandler) handleUpdateView(w http.ResponseWriter, r *http.Reques
 		if err != nil {
 			return err
 		}
-		if entryType(entry.Extended) != EntryTypeView {
+		if EntryType(entry.Extended) != EntryTypeView {
 			return filer_pb.ErrNotFound
 		}
 		data, ok := entry.Extended[ExtendedKeyMetadata]
@@ -426,21 +451,46 @@ func (h *S3TablesHandler) handleUpdateView(w http.ResponseWriter, r *http.Reques
 		} else {
 			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, err.Error())
 		}
-		return err
+		return nil, err
 	}
 
 	accountID := h.getAccountID(r)
 	viewPolicy, bucketPolicy, bucketTags, bucketMetadata, err := h.loadAuthContext(r, filerClient, viewPath, GetTableBucketPath(bucketName))
 	if err != nil {
 		h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, err.Error())
-		return err
+		return nil, err
 	}
 	viewARN := h.generateViewARN(metadata.OwnerAccountID, bucketName, namespaceName+"/"+viewName)
 	if !h.authorizeViewOp(r, "UpdateView", accountID, metadata.OwnerAccountID, bucketMetadata.OwnerAccountID, viewPolicy, bucketPolicy, viewARN, bucketName, namespaceName, viewName, bucketTags) {
 		h.writeError(w, http.StatusForbidden, ErrCodeAccessDenied, "not authorized to update view")
-		return NewAuthError("UpdateView", accountID, "not authorized to update view")
+		return nil, NewAuthError("UpdateView", accountID, "not authorized to update view")
 	}
 
+	return &updateViewTarget{
+		bucketName:    bucketName,
+		namespaceName: namespaceName,
+		viewName:      viewName,
+		viewPath:      viewPath,
+		viewARN:       viewARN,
+		metadata:      metadata,
+	}, nil
+}
+
+// handleUpdateView replaces the metadata pointer for a view, mirroring UpdateTable.
+func (h *S3TablesHandler) handleUpdateView(w http.ResponseWriter, r *http.Request, filerClient FilerClient) error {
+	var req UpdateViewRequest
+	if err := h.readRequestBody(r, &req); err != nil {
+		h.writeError(w, http.StatusBadRequest, ErrCodeInvalidRequest, err.Error())
+		return err
+	}
+
+	target, err := h.authorizeUpdateView(w, r, filerClient, &req)
+	if err != nil {
+		return err
+	}
+	metadata := target.metadata
+	viewPath := target.viewPath
+
 	if req.VersionToken != "" && req.VersionToken != metadata.VersionToken {
 		h.writeError(w, http.StatusConflict, ErrCodeConflict, "Version token mismatch")
 		return ErrVersionTokenMismatch
@@ -488,7 +538,7 @@ func (h *S3TablesHandler) handleUpdateView(w http.ResponseWriter, r *http.Reques
 	}
 
 	h.writeJSON(w, http.StatusOK, &UpdateViewResponse{
-		ViewARN:          viewARN,
+		ViewARN:          target.viewARN,
 		MetadataLocation: metadata.MetadataLocation,
 		VersionToken:     metadata.VersionToken,
 	})
@@ -516,7 +566,7 @@ func (h *S3TablesHandler) handleDeleteView(w http.ResponseWriter, r *http.Reques
 		if err != nil {
 			return err
 		}
-		if entryType(entry.Extended) != EntryTypeView {
+		if EntryType(entry.Extended) != EntryTypeView {
 			return filer_pb.ErrNotFound
 		}
 		data, ok := entry.Extended[ExtendedKeyMetadata]
@@ -624,17 +674,19 @@ func (h *S3TablesHandler) loadAuthContext(r *http.Request, filerClient FilerClie
 func (h *S3TablesHandler) authorizeViewOp(r *http.Request, operation, principal, resourceOwner, bucketOwner, resourcePolicy, bucketPolicy, resourceARN, bucketName, namespace, viewName string, bucketTags map[string]string) bool {
 	identityActions := getIdentityActions(r)
 	ctx := &PolicyContext{
-		TableBucketName: bucketName,
-		Namespace:       namespace,
-		TableName:       viewName,
-		TableBucketTags: bucketTags,
-		IdentityActions: identityActions,
-		DefaultAllow:    h.defaultAllowFor(r),
+		TrustedIssuers:   h.trustedIssuers(r),
+		IsLocalAccountID: h.localAccountIDs,
+		TableBucketName:  bucketName,
+		Namespace:        namespace,
+		TableName:        viewName,
+		TableBucketTags:  bucketTags,
+		IdentityActions:  identityActions,
+		DefaultAllow:     h.defaultAllowFor(r),
 	}
-	resourceAllowed := CheckPermissionWithContext(operation, principal, resourceOwner, resourcePolicy, resourceARN, ctx)
 	bucketARN := h.generateTableBucketARN(bucketOwner, bucketName)
-	bucketAllowed := CheckPermissionWithContext(operation, principal, bucketOwner, bucketPolicy, bucketARN, ctx)
-	return resourceAllowed || bucketAllowed
+	return CheckTableOrBucketPermission(operation, principal,
+		resourceOwner, resourcePolicy, resourceARN,
+		bucketOwner, bucketPolicy, bucketARN, ctx)
 }
 
 // singleClient adapts a bound filer client to the FilerClient interface so the
diff --git a/weed/s3api/s3tables/handler_view_rename_test.go b/weed/s3api/s3tables/handler_view_rename_test.go
new file mode 100644
index 0000000000..0afd1be118
--- /dev/null
+++ b/weed/s3api/s3tables/handler_view_rename_test.go
@@ -0,0 +1,136 @@
+package s3tables
+
+import (
+	"context"
+	"encoding/json"
+	"path"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// seedView adds a view alongside the table the rename harness already creates.
+func seedView(t *testing.T, fs *s3tablestest.MemFiler, name string) {
+	t.Helper()
+
+	viewMeta, err := json.Marshal(tableMetadataInternal{
+		Name:             name,
+		Namespace:        "ns",
+		Format:           "ICEBERG",
+		OwnerAccountID:   DefaultAccountID,
+		MetadataVersion:  1,
+		MetadataLocation: "s3://" + renameTestBucket + "/ns/" + name + "/metadata/v1.metadata.json",
+	})
+	require.NoError(t, err)
+
+	fs.Put(GetNamespacePath(renameTestBucket, "ns"), name, map[string][]byte{
+		ExtendedKeyMetadata:        viewMeta,
+		ExtendedKeyMetadataVersion: []byte("1"),
+		ExtendedKeyEntryType:       []byte(EntryTypeView),
+	})
+	viewPath := GetTablePath(renameTestBucket, "ns", name)
+	fs.Put(viewPath, "metadata", nil)
+	fs.Put(path.Join(viewPath, "metadata"), "v1.metadata.json", nil)
+}
+
+func runRenameView(t *testing.T, m *Manager, fs *s3tablestest.MemFiler, sourceName, destName string) error {
+	t.Helper()
+	return m.Execute(context.Background(), NewManagerClient(fs.Client), "RenameView", &RenameTableRequest{
+		TableBucketARN:  mustBucketARN(t),
+		SourceNamespace: []string{"ns"},
+		SourceName:      sourceName,
+		DestNamespace:   []string{"ns"},
+		DestName:        destName,
+	}, nil, "")
+}
+
+func TestRenameViewMovesCatalogPointer(t *testing.T) {
+	fs, m := startRenameManager(t)
+	seedView(t, fs, "v")
+
+	require.NoError(t, runRenameView(t, m, fs, "v", "v2"))
+
+	dest := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "v2")
+	require.NotNil(t, dest)
+	assert.Equal(t, EntryTypeView, EntryType(dest.Extended), "destination must stay a view")
+
+	var moved tableMetadataInternal
+	require.NoError(t, json.Unmarshal(dest.Extended[ExtendedKeyMetadata], &moved))
+	assert.Equal(t, "v2", moved.Name)
+	assert.Equal(t, "s3://"+renameTestBucket+"/ns/v/metadata/v1.metadata.json", moved.MetadataLocation,
+		"rename is catalog-only, the metadata stays where it was written")
+
+	src := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "v")
+	require.NotNil(t, src)
+	_, stillListed := src.Extended[ExtendedKeyMetadata]
+	assert.False(t, stillListed, "source name must stop resolving")
+	assert.NotNil(t, fs.Get(path.Join(GetTablePath(renameTestBucket, "ns", "v"), "metadata"), "v1.metadata.json"),
+		"the view's metadata file must survive")
+}
+
+// Tables and views share one namespace directory, so each rename must refuse
+// the other kind rather than moving it.
+func TestRenameViewRejectsTable(t *testing.T) {
+	fs, m := startRenameManager(t)
+
+	err := runRenameView(t, m, fs, "t", "t2")
+	require.Error(t, err)
+	var s3Err *S3TablesError
+	require.ErrorAs(t, err, &s3Err)
+	assert.Equal(t, ErrCodeNoSuchView, s3Err.Type)
+}
+
+func TestRenameTableRejectsView(t *testing.T) {
+	fs, m := startRenameManager(t)
+	seedView(t, fs, "v")
+
+	err := runRename(t, m, fs, &RenameTableRequest{
+		TableBucketARN:  mustBucketARN(t),
+		SourceNamespace: []string{"ns"},
+		SourceName:      "v",
+		DestNamespace:   []string{"ns"},
+		DestName:        "v2",
+	})
+	require.Error(t, err)
+	var s3Err *S3TablesError
+	require.ErrorAs(t, err, &s3Err)
+	assert.Equal(t, ErrCodeNoSuchTable, s3Err.Type)
+}
+
+// A policy scoped to the view ARN must authorize renaming that view. Checking
+// the source against a table ARN would silently ignore it.
+func TestRenameViewAuthorizesAgainstTheViewARN(t *testing.T) {
+	fs, m := startRenameManager(t)
+	m.SetTrusted(false)
+	m.SetDefaultAllow(false)
+	seedView(t, fs, "v")
+
+	const principal = "analyst"
+	viewARN := "arn:aws:s3tables:" + DefaultRegion + ":" + DefaultAccountID + ":bucket/" + renameTestBucket + "/view/ns/v"
+	viewPolicy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"` + principal +
+		`","Action":"s3tables:RenameView","Resource":"` + viewARN + `"}]}`
+	view := fs.Get(GetNamespacePath(renameTestBucket, "ns"), "v")
+	require.NotNil(t, view)
+	view.Extended[ExtendedKeyPolicy] = []byte(viewPolicy)
+
+	// Landing in the namespace needs create permission there as well.
+	namespacePolicy := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"` + principal +
+		`","Action":"s3tables:CreateView","Resource":"` + mustBucketARN(t) + `"}]}`
+	namespace := fs.Get(GetTableBucketPath(renameTestBucket), "ns")
+	require.NotNil(t, namespace)
+	namespace.Extended[ExtendedKeyPolicy] = []byte(namespacePolicy)
+
+	err := m.Execute(context.Background(), NewManagerClient(fs.Client), "RenameView", &RenameTableRequest{
+		TableBucketARN:  mustBucketARN(t),
+		SourceNamespace: []string{"ns"},
+		SourceName:      "v",
+		DestNamespace:   []string{"ns"},
+		DestName:        "v2",
+	}, nil, principal)
+	require.NoError(t, err)
+
+	assert.NotNil(t, fs.Get(GetNamespacePath(renameTestBucket, "ns"), "v2"))
+}
diff --git a/weed/s3api/s3tables/handler_view_test.go b/weed/s3api/s3tables/handler_view_test.go
index 0a9cc0e5a2..8788cf5299 100644
--- a/weed/s3api/s3tables/handler_view_test.go
+++ b/weed/s3api/s3tables/handler_view_test.go
@@ -16,8 +16,8 @@ func TestEntryType(t *testing.T) {
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
-			if got := entryType(c.extended); got != c.want {
-				t.Fatalf("entryType() = %q, want %q", got, c.want)
+			if got := EntryType(c.extended); got != c.want {
+				t.Fatalf("EntryType() = %q, want %q", got, c.want)
 			}
 		})
 	}
diff --git a/weed/s3api/s3tables/iam.go b/weed/s3api/s3tables/iam.go
index c5cbef59d5..944d87ca88 100644
--- a/weed/s3api/s3tables/iam.go
+++ b/weed/s3api/s3tables/iam.go
@@ -97,6 +97,9 @@ func hasSessionToken(r *http.Request) bool {
 }
 
 func extractSessionToken(r *http.Request) string {
+	if s3_constants.IsSessionTokenIgnored(r.Context()) {
+		return ""
+	}
 	if token := r.Header.Get(s3_constants.SeaweedFSSessionTokenHeader); token != "" {
 		return token
 	}
diff --git a/weed/s3api/s3tables/iceberg_layout.go b/weed/s3api/s3tables/iceberg_layout.go
index c9083c20a3..1e21f8c41f 100644
--- a/weed/s3api/s3tables/iceberg_layout.go
+++ b/weed/s3api/s3tables/iceberg_layout.go
@@ -15,17 +15,35 @@ import (
 // - metadata/v*.metadata.json (table metadata)
 // - metadata/snap-*.avro (snapshot manifest lists)
 // - metadata/*.avro (manifest files)
-// - data/*.parquet, data/*.orc, data/*.avro (data files)
+// - metadata/*.stats, metadata/*.puffin (statistics files)
+// - data/*.parquet, *.orc, *.avro, *.puffin (data files)
 
 const uuidPattern = `[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`
 
 var (
-	// Allowed directories in an Iceberg table
-	icebergAllowedDirs = map[string]bool{
+	// Allowed directories in a table. The set is the union of what every
+	// supported format writes, because this runs on the S3 door where the
+	// table's format is not in hand: metadata/ and data/ for Iceberg,
+	// _versions/ and _indices/ for Lance, which also puts its fragments in
+	// data/.
+	tableAllowedDirs = map[string]bool{
 		"metadata": true,
 		"data":     true,
 	}
 
+	// A format's own bookkeeping lives in underscore-prefixed directories that
+	// the catalog does not interpret: Lance writes _versions, _transactions,
+	// _indices and _deletions, and enumerating them here would mean guessing at
+	// the next one. Iceberg writes none, so admitting them costs it nothing.
+	formatOwnedDirPattern = regexp.MustCompile(`^_[a-z][a-z0-9_]*$`)
+
+	// Marker files a Lance table keeps at its root to record that it is
+	// reserved but not yet written, or deregistered but still on storage.
+	lanceMarkerFiles = map[string]bool{
+		".lance-reserved":     true,
+		".lance-deregistered": true,
+	}
+
 	// Patterns for valid metadata files.
 	//
 	// Note: Iceberg engines (Flink/Spark/Trino, plus different Iceberg versions)
@@ -51,6 +69,9 @@ var (
 		// whose naming we can't anticipate across engines and versions.
 		regexp.MustCompile(`^[A-Za-z0-9._-]+\.avro$`),
 		regexp.MustCompile(`^[A-Za-z0-9._-]+\.metadata\.json$`),
+		// Table and partition statistics files listed in the table metadata
+		// are Puffin files; engines name them *.stats or *.puffin.
+		regexp.MustCompile(`^[A-Za-z0-9._-]+\.puffin$`),
 	}
 
 	// Patterns for valid data files
@@ -58,6 +79,8 @@ var (
 		regexp.MustCompile(`^[^/]+\.parquet$`), // Parquet files
 		regexp.MustCompile(`^[^/]+\.orc$`),     // ORC files
 		regexp.MustCompile(`^[^/]+\.avro$`),    // Avro files
+		regexp.MustCompile(`^[^/]+\.puffin$`),  // Iceberg v3 deletion vectors
+		regexp.MustCompile(`^[^/]+\.lance$`),   // Lance fragments
 	}
 
 	// Data file partition path pattern (e.g., year=2024/month=01/)
@@ -91,11 +114,16 @@ func (v *IcebergLayoutValidator) ValidateFilePath(relativePath string) error {
 
 	topDir := parts[0]
 
+	// A Lance table's marker files sit at its root rather than in a directory.
+	if len(parts) == 1 && lanceMarkerFiles[topDir] {
+		return nil
+	}
+
 	// Check if top-level directory is allowed
-	if !icebergAllowedDirs[topDir] {
+	if !tableAllowedDirs[topDir] && !formatOwnedDirPattern.MatchString(topDir) {
 		return &IcebergLayoutError{
 			Code:    ErrCodeInvalidIcebergLayout,
-			Message: "files must be placed in 'metadata/' or 'data/' directories",
+			Message: "files must be placed in 'metadata/', 'data/' or a format-owned '_' directory",
 		}
 	}
 
@@ -119,6 +147,28 @@ func (v *IcebergLayoutValidator) ValidateFilePath(relativePath string) error {
 		return v.validateDataFile(remainingPath)
 	}
 
+	// Everything else is a format-owned directory: the only guard is that the
+	// path stays inside the table.
+	return validateFileSegments(remainingPath)
+}
+
+// IsTableMarkerFile reports whether a name is one of the marker files a table
+// keeps at its root.
+func IsTableMarkerFile(name string) bool {
+	return lanceMarkerFiles[name]
+}
+
+// validateFileSegments rejects traversal and empty segments in a path whose
+// contents the catalog does not otherwise interpret.
+func validateFileSegments(path string) error {
+	for _, segment := range strings.Split(path, "/") {
+		if segment == "" || segment == "." || segment == ".." {
+			return &IcebergLayoutError{
+				Code:    ErrCodeInvalidIcebergLayout,
+				Message: "invalid path segment in: " + path,
+			}
+		}
+	}
 	return nil
 }
 
@@ -164,7 +214,7 @@ func validateFilePatterns(filename string, isMetadata bool) error {
 		errorMsg = "invalid metadata file format: must be a valid Iceberg metadata, manifest, or snapshot file"
 	} else {
 		patterns = dataFilePatterns
-		errorMsg = "invalid data file format: must be .parquet, .orc, or .avro"
+		errorMsg = "invalid data file format: must be .parquet, .orc, .avro, .puffin or .lance"
 	}
 
 	for _, pattern := range patterns {
diff --git a/weed/s3api/s3tables/iceberg_layout_test.go b/weed/s3api/s3tables/iceberg_layout_test.go
index 62e32c5185..88d97ee8a6 100644
--- a/weed/s3api/s3tables/iceberg_layout_test.go
+++ b/weed/s3api/s3tables/iceberg_layout_test.go
@@ -45,6 +45,10 @@ func TestIcebergLayoutValidator_AcceptsRealWorldManifestNames(t *testing.T) {
 			"trino/iceberg stats file",
 			"metadata/table.stats",
 		},
+		{
+			"puffin statistics file",
+			"metadata/20260928-1-0199a3c2-7d1e-7c55-9a0e-3b1f2c4d5e6f.puffin",
+		},
 	}
 
 	v := NewIcebergLayoutValidator()
@@ -70,6 +74,8 @@ func TestIcebergLayoutValidator_RejectsClearlyBadMetadataNames(t *testing.T) {
 		{"subdirectory under metadata is not allowed", "metadata/sub/file.avro"},
 		{"top-level dir other than metadata or data", "garbage/file.avro"},
 		{"catch-all anchors must reject trailing extension", "metadata/file.avro.txt"},
+		{"puffin with a trailing extension", "metadata/stats.puffin.txt"},
+		{"puffin in a subdirectory under metadata", "metadata/sub/stats.puffin"},
 	}
 
 	v := NewIcebergLayoutValidator()
@@ -90,6 +96,9 @@ func TestIcebergLayoutValidator_AcceptsRealWorldDataFiles(t *testing.T) {
 		"data/part-00000.parquet",
 		"data/some-file.orc",
 		"data/year=2026/month=05/00000-0-uuid.parquet",
+		"data/00000-2-c56b1e21-828c-40ad-8f7b-739c6cb82dcf-00001-deletes.puffin",
+		"data/82e3eec4-3aee-414f-a444-94c03c641d20-deletes.puffin",
+		"data/year=2026/month=05/00000-2-c56b1e21-828c-40ad-8f7b-739c6cb82dcf-00001-deletes.puffin",
 	}
 	v := NewIcebergLayoutValidator()
 	for _, p := range cases {
@@ -100,3 +109,65 @@ func TestIcebergLayoutValidator_AcceptsRealWorldDataFiles(t *testing.T) {
 		})
 	}
 }
+
+// A Lance dataset writes fragments into data/ and keeps its own bookkeeping in
+// underscore-prefixed directories. The validator runs on the S3 door, where the
+// table's format is not in hand, so it has to admit both formats' layouts.
+func TestValidateFilePathAcceptsLanceLayout(t *testing.T) {
+	v := NewIcebergLayoutValidator()
+	allowed := []string{
+		"data/01111110101110001101011164cadc43919eace9c608107bd9.lance",
+		"_versions/1.manifest",
+		"_versions/9223372036854775806.manifest",
+		"_transactions/0-ddb27ab7-2e5c-42c7-b4bf-265d8a3ff636.txn",
+		"_indices/85814508-ed9a-41f2-b939-2050bb7a0ed5-fts/index.idx",
+		"_deletions/_deletions-1.arrow",
+		".lance-reserved",
+		".lance-deregistered",
+	}
+	for _, path := range allowed {
+		if err := v.ValidateFilePath(path); err != nil {
+			t.Errorf("ValidateFilePath(%q) = %v, want nil", path, err)
+		}
+	}
+
+	rejected := []string{
+		"_versions/../../escape",
+		"_versions//empty",
+		"notadir/file.lance",
+		"random.txt",
+	}
+	for _, path := range rejected {
+		if err := v.ValidateFilePath(path); err == nil {
+			t.Errorf("ValidateFilePath(%q) = nil, want an error", path)
+		}
+	}
+}
+
+// Statistics files are referenced from the table metadata and kept by orphan
+// cleanup; the upload door has to admit them in the table's metadata/, and
+// only there.
+func TestTableBucketFileValidator_PuffinStatisticsOnlyInTableMetadata(t *testing.T) {
+	v := NewTableBucketFileValidator()
+	accepted := []string{
+		TablesPath + "/cat/ns/t/metadata/stats-1.puffin",
+		TablesPath + "/cat/ns/t/metadata/table.stats",
+		TablesPath + "/cat/ns/t/data/0199a3c2-deletes.puffin",
+	}
+	for _, p := range accepted {
+		if err := v.ValidateTableBucketUpload(p); err != nil {
+			t.Errorf("ValidateTableBucketUpload(%q) = %v, want nil", p, err)
+		}
+	}
+	rejected := []string{
+		TablesPath + "/cat/ns/t/stats-1.puffin",
+		TablesPath + "/cat/ns/t/other/stats-1.puffin",
+		TablesPath + "/cat/ns/t/metadata/sub/stats-1.puffin",
+		TablesPath + "/cat/ns/t/metadata/notes.txt",
+	}
+	for _, p := range rejected {
+		if err := v.ValidateTableBucketUpload(p); err == nil {
+			t.Errorf("ValidateTableBucketUpload(%q) = nil, want an error", p)
+		}
+	}
+}
diff --git a/weed/s3api/s3tables/iceberg_manifest.go b/weed/s3api/s3tables/iceberg_manifest.go
new file mode 100644
index 0000000000..7ed007964f
--- /dev/null
+++ b/weed/s3api/s3tables/iceberg_manifest.go
@@ -0,0 +1,193 @@
+package s3tables
+
+import (
+	"bytes"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/google/uuid"
+)
+
+const secondsPerDay = int64(24 * 60 * 60)
+
+// ReadManifest parses an Iceberg manifest and converts its partition values
+// while the manifest's own schema still describes them.
+//
+// iceberg-go converts what the Avro decoder returned for a logical type - a
+// time.Time for a date, a time.Duration for a time - to an Iceberg value
+// lazily, on the first Partition() call, using the logical types it read from
+// the manifest being parsed. ManifestWriter.addEntry rebinds those to the
+// logical types of the manifest it is about to write before it makes that
+// call, so an entry that is read and written again without anyone looking at
+// its partition converts against the wrong schema. A day partition is where
+// the two disagree: iceberg-go's day transform reports an int32 result type,
+// so the manifest it writes has no date logical type for that field, nothing
+// converts, and the time.Time reaches the encoder as "cannot use time.Time
+// with Avro type int".
+//
+// What survives that is a value iceberg-go never recognized on read either: it
+// takes a partition field's logical type from the last branch of its Avro
+// union, so a writer that spells an optional partition [<type>, null] rather
+// than [null, <type>] hides it, and a time partition is then worse than a
+// failed write - time.Duration converts to int64 nanoseconds and silently
+// records the wrong value. normalizePartitionValue puts those back.
+//
+// specs maps partition spec ID to spec the way the table metadata records them.
+func ReadManifest(m iceberg.ManifestFile, manifest []byte, discardDeleted bool, specs map[int]iceberg.PartitionSpec, schema *iceberg.Schema) ([]iceberg.ManifestEntry, error) {
+	entries, err := iceberg.ReadManifest(m, bytes.NewReader(manifest), discardDeleted)
+	if err != nil {
+		return nil, err
+	}
+
+	var partitionFields []iceberg.NestedField
+	var spec iceberg.PartitionSpec
+	var specFound bool
+	if schema != nil {
+		spec, specFound = specs[int(m.PartitionSpecID())]
+		if specFound {
+			if partitionType := spec.PartitionType(schema); partitionType != nil {
+				partitionFields = partitionType.FieldList
+			}
+		}
+	}
+
+	for i, entry := range entries {
+		partition := entry.DataFile().Partition()
+		changed := false
+		for _, field := range partitionFields {
+			value, ok := partition[field.ID]
+			if !ok {
+				continue
+			}
+			if normalized, ok := normalizePartitionValue(value, field.Type); ok {
+				partition[field.ID] = normalized
+				changed = true
+			}
+		}
+		if changed {
+			// iceberg-go returns a defensive copy from Partition(), so the
+			// in-place edits above never reach the underlying DataFile.
+			// Rebuild the entry with a DataFile that carries the normalized
+			// partition so a subsequent write encodes the Iceberg values.
+			entries[i] = rebuildManifestEntry(entry, spec, partition)
+		}
+	}
+	return entries, nil
+}
+
+// rebuildManifestEntry returns a copy of entry whose DataFile carries the
+// given partition map. It is used to persist partition values normalized
+// after a read, since iceberg-go's Partition() getter hands back a clone
+// rather than the live map. Only the partition changes; every other DataFile
+// field is copied through the builder so manifest round-trips are preserved.
+func rebuildManifestEntry(entry iceberg.ManifestEntry, spec iceberg.PartitionSpec, partition map[int]any) iceberg.ManifestEntry {
+	df := entry.DataFile()
+	builder, err := iceberg.NewDataFileBuilder(
+		spec,
+		df.ContentType(),
+		df.FilePath(),
+		df.FileFormat(),
+		partition,
+		nil, // logical types are derived from the spec at write time
+		nil,
+		df.Count(),
+		df.FileSizeBytes(),
+	)
+	if err != nil {
+		// The original DataFile already validated these fields, so the only
+		// ways to get here are a nil spec (which rebuildManifestEntry's caller
+		// guards against) or a zero-record / zero-byte file, which the builder
+		// rejects with recordCount <= 0 or fileSize <= 0. Fall back to the
+		// original entry rather than panic; the unnormalized partition survives
+		// but an empty file is unlikely to carry a logical partition value.
+		return entry
+	}
+
+	builder.BlockSizeInBytes(64 * 1024 * 1024) // v1 schema default; deprecated and omitted in v2+
+	if sizes := df.ColumnSizes(); sizes != nil {
+		builder.ColumnSizes(sizes)
+	}
+	if counts := df.ValueCounts(); counts != nil {
+		builder.ValueCounts(counts)
+	}
+	if counts := df.NullValueCounts(); counts != nil {
+		builder.NullValueCounts(counts)
+	}
+	if counts := df.NaNValueCounts(); counts != nil {
+		builder.NaNValueCounts(counts)
+	}
+	if counts := df.DistinctValueCounts(); counts != nil {
+		builder.DistinctValueCounts(counts)
+	}
+	if bounds := df.LowerBoundValues(); bounds != nil {
+		builder.LowerBoundValues(bounds)
+	}
+	if bounds := df.UpperBoundValues(); bounds != nil {
+		builder.UpperBoundValues(bounds)
+	}
+	if key := df.KeyMetadata(); key != nil {
+		builder.KeyMetadata(key)
+	}
+	if offsets := df.SplitOffsets(); offsets != nil {
+		builder.SplitOffsets(offsets)
+	}
+	if ids := df.EqualityFieldIDs(); ids != nil {
+		builder.EqualityFieldIDs(ids)
+	}
+	if id := df.SortOrderID(); id != nil {
+		builder.SortOrderID(*id)
+	}
+	if id := df.FirstRowID(); id != nil {
+		builder.FirstRowID(*id)
+	}
+	if ref := df.ReferencedDataFile(); ref != nil {
+		builder.ReferencedDataFile(*ref)
+	}
+	if off := df.ContentOffset(); off != nil {
+		builder.ContentOffset(*off)
+	}
+	if size := df.ContentSizeInBytes(); size != nil {
+		builder.ContentSizeInBytes(*size)
+	}
+
+	newEntry := iceberg.NewManifestEntryBuilder(entry.Status(), ptrInt64(entry.SnapshotID()), builder.Build())
+	if seq := entry.SequenceNum(); seq != -1 {
+		newEntry.SequenceNum(seq)
+	}
+	if fileSeq := entry.FileSequenceNum(); fileSeq != nil {
+		newEntry.FileSequenceNum(*fileSeq)
+	}
+	return newEntry.Build()
+}
+
+func ptrInt64(v int64) *int64 { return &v }
+
+// normalizePartitionValue converts one value the Avro decoder returned for a
+// logical type to the Iceberg representation the manifest writer expects,
+// mirroring what iceberg-go does itself for the unions it does recognize.
+func normalizePartitionValue(value any, fieldType iceberg.Type) (any, bool) {
+	switch v := value.(type) {
+	case time.Time:
+		utc := v.UTC()
+		switch fieldType.(type) {
+		case iceberg.DateType, iceberg.Int32Type:
+			// A day transform reports an int32 result type and an identity
+			// transform on a date column reports date; both hold days.
+			midnight := time.Date(utc.Year(), utc.Month(), utc.Day(), 0, 0, 0, 0, time.UTC)
+			return iceberg.Date(midnight.Unix() / secondsPerDay), true
+		case iceberg.TimestampType, iceberg.TimestampTzType:
+			return iceberg.Timestamp(utc.UnixMicro()), true
+		case iceberg.TimestampNsType, iceberg.TimestampTzNsType:
+			return iceberg.TimestampNano(utc.UnixNano()), true
+		}
+	case time.Duration:
+		if _, ok := fieldType.(iceberg.TimeType); ok {
+			return iceberg.Time(v.Microseconds()), true
+		}
+	case [16]byte:
+		if _, ok := fieldType.(iceberg.UUIDType); ok {
+			return uuid.UUID(v), true
+		}
+	}
+	return nil, false
+}
diff --git a/weed/s3api/s3tables/iceberg_manifest_list_test.go b/weed/s3api/s3tables/iceberg_manifest_list_test.go
index 820cc4d93e..d630ebdf20 100644
--- a/weed/s3api/s3tables/iceberg_manifest_list_test.go
+++ b/weed/s3api/s3tables/iceberg_manifest_list_test.go
@@ -69,19 +69,22 @@ func stripFormatVersion(t *testing.T, data []byte) []byte {
 	return append(stripped, data[terminator:]...)
 }
 
-// DuckDB writes manifest lists with no Avro header metadata, so iceberg-go
-// falls back to v1 and every v2 manifest below it fails to parse.
+// DuckDB writes manifest lists with no Avro header metadata. iceberg-go now
+// infers the format version from the embedded writer schema on its own, so a
+// stripped v2 list is read as v2 even without the header entry. ReadManifestList
+// still patches the header for older iceberg-go releases and for writers whose
+// schema carries none of the version-distinguishing fields.
 func TestReadManifestListWithoutFormatVersion(t *testing.T) {
 	stripped := stripFormatVersion(t, writeManifestList(t, 2))
 
-	// Baseline: iceberg-go alone reads the list as v1, which both mislabels
-	// the delete manifest and makes ReadManifest reject the v2 manifests.
+	// Baseline: iceberg-go reads the list as v2 by inferring the version from
+	// the record schema's fields (content / sequence_number were added in v2).
 	unpatched, err := iceberg.ReadManifestList(bytes.NewReader(stripped))
 	if err != nil {
 		t.Fatalf("iceberg.ReadManifestList: %v", err)
 	}
-	if got := unpatched[0].Version(); got != 1 {
-		t.Fatalf("expected iceberg-go to default to v1, got v%d", got)
+	if got := unpatched[0].Version(); got != 2 {
+		t.Fatalf("expected iceberg-go to infer v2, got v%d", got)
 	}
 
 	manifests, err := ReadManifestList(stripped)
diff --git a/weed/s3api/s3tables/iceberg_manifest_test.go b/weed/s3api/s3tables/iceberg_manifest_test.go
new file mode 100644
index 0000000000..0b66904989
--- /dev/null
+++ b/weed/s3api/s3tables/iceberg_manifest_test.go
@@ -0,0 +1,275 @@
+package s3tables
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+	"github.com/twmb/avro/ocf"
+)
+
+// A manifest whose partition union puts the value branch first hides the
+// logical type from iceberg-go, which then hands back whatever the Avro decoder
+// produced even once the partition is read. Rewriting such an entry fails when
+// the writer builds its partition summaries, or encodes the wrong number for a
+// time partition, so every logical type a partition field can carry has to come
+// back as an Iceberg value.
+func TestReadManifestNormalizesForeignPartitions(t *testing.T) {
+	day := time.Date(2026, time.October, 11, 0, 0, 0, 0, time.UTC)
+
+	cases := []struct {
+		name        string
+		sourceType  iceberg.PrimitiveType
+		transform   iceberg.Transform
+		logicalType string
+		// decoded is the value the foreign manifest carries, as the Avro
+		// decoder hands it back.
+		decoded any
+		want    any
+		// nullFirst spells the union the way Java and iceberg-rust do, which
+		// iceberg-go converts on its own once the partition is read.
+		nullFirst bool
+		// rawIsNormalized marks transforms iceberg-go now converts itself on
+		// read (day transforms), so the raw value already matches want.
+		rawIsNormalized bool
+	}{
+		{
+			name:        "day transform written null-first converts on read",
+			sourceType:  iceberg.PrimitiveTypes.Timestamp,
+			transform:   iceberg.DayTransform{},
+			logicalType: "date",
+			decoded:     day,
+			want:        iceberg.Date(20737),
+			nullFirst:   true,
+		},
+		{
+			name:        "day transform on a timestamp column",
+			sourceType:  iceberg.PrimitiveTypes.Timestamp,
+			transform:   iceberg.DayTransform{},
+			logicalType: "date",
+			decoded:     day,
+			want:        iceberg.Date(20737),
+			// iceberg-go now converts day-transform partitions to iceberg.Date
+			// itself (applyDayTransformDates), so the raw read already yields
+			// the Iceberg value regardless of union branch ordering.
+			rawIsNormalized: true,
+		},
+		{
+			name:        "identity transform on a date column",
+			sourceType:  iceberg.PrimitiveTypes.Date,
+			transform:   iceberg.IdentityTransform{},
+			logicalType: "date",
+			decoded:     day,
+			want:        iceberg.Date(20737),
+		},
+		{
+			name:        "identity transform on a timestamp column",
+			sourceType:  iceberg.PrimitiveTypes.Timestamp,
+			transform:   iceberg.IdentityTransform{},
+			logicalType: "timestamp-micros",
+			decoded:     day.Add(3 * time.Hour),
+			want:        iceberg.Timestamp(day.Add(3 * time.Hour).UnixMicro()),
+		},
+		{
+			name:        "identity transform on a time column",
+			sourceType:  iceberg.PrimitiveTypes.Time,
+			transform:   iceberg.IdentityTransform{},
+			logicalType: "time-micros",
+			decoded:     3 * time.Hour,
+			want:        iceberg.Time((3 * time.Hour).Microseconds()),
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			schema := iceberg.NewSchema(0,
+				iceberg.NestedField{ID: 1, Name: "source", Type: c.sourceType, Required: true},
+			)
+			spec := iceberg.NewPartitionSpec(iceberg.PartitionField{
+				SourceIDs: []int{1}, FieldID: 1000, Name: "part", Transform: c.transform,
+			})
+			specs := map[int]iceberg.PartitionSpec{spec.ID(): spec}
+
+			dfBuilder, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, "data/file.parquet",
+				iceberg.ParquetFile, map[int]any{1000: c.want}, nil, nil, 1, 1)
+			if err != nil {
+				t.Fatalf("build data file: %v", err)
+			}
+			snapshotID := int64(1)
+			entry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapshotID, nil, nil, dfBuilder.Build())
+
+			foreignBytes, foreignManifest := s3tablestest.ForeignPartitionManifest(t, schema, spec, entry,
+				"metadata/foreign-manifest.avro", c.logicalType, c.decoded, !c.nullFirst)
+
+			// iceberg-go reads the logical type off the union's last branch, so
+			// the ordering decides whether the entry arrives as an Iceberg value
+			// or as whatever the Avro decoder produced.
+			rawWant := any(c.decoded)
+			if c.nullFirst || c.rawIsNormalized {
+				rawWant = c.want
+			}
+			raw, err := iceberg.ReadManifest(foreignManifest, bytes.NewReader(foreignBytes), true)
+			if err != nil {
+				t.Fatalf("read foreign manifest: %v", err)
+			}
+			if got := raw[0].DataFile().Partition()[1000]; got != rawWant {
+				t.Fatalf("unnormalized partition value = %#v (%T), want %#v (%T)", got, got, rawWant, rawWant)
+			}
+
+			entries, err := ReadManifest(foreignManifest, foreignBytes, true, specs, schema)
+			if err != nil {
+				t.Fatalf("read foreign manifest: %v", err)
+			}
+			if got := entries[0].DataFile().Partition()[1000]; got != c.want {
+				t.Fatalf("normalized partition value = %#v (%T), want %#v (%T)", got, got, c.want, c.want)
+			}
+
+			// The point of normalizing: the entry can be written out again.
+			var buf bytes.Buffer
+			if _, err := iceberg.WriteManifest("metadata/manifest.avro", &buf, 2, spec, schema, snapshotID, entries); err != nil {
+				t.Fatalf("write normalized manifest: %v", err)
+			}
+		})
+	}
+}
+
+// A manifest written under a spec the table metadata no longer records is
+// returned as read rather than refused: the caller decides what to do with it.
+func TestReadManifestUnknownSpec(t *testing.T) {
+	schema := iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Name: "source", Type: iceberg.PrimitiveTypes.Date, Required: true},
+	)
+	spec := iceberg.NewPartitionSpec(iceberg.PartitionField{
+		SourceIDs: []int{1}, FieldID: 1000, Name: "part", Transform: iceberg.IdentityTransform{},
+	})
+	dfBuilder, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, "data/file.parquet",
+		iceberg.ParquetFile, map[int]any{1000: iceberg.Date(20737)}, nil, nil, 1, 1)
+	if err != nil {
+		t.Fatalf("build data file: %v", err)
+	}
+	snapshotID := int64(1)
+	entry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapshotID, nil, nil, dfBuilder.Build())
+	foreignBytes, foreignManifest := s3tablestest.ForeignPartitionManifest(t, schema, spec, entry,
+		"metadata/foreign-manifest.avro", "date", time.Date(2026, time.October, 11, 0, 0, 0, 0, time.UTC), true)
+
+	entries, err := ReadManifest(foreignManifest, foreignBytes, true, nil, schema)
+	if err != nil {
+		t.Fatalf("read foreign manifest: %v", err)
+	}
+	if _, ok := entries[0].DataFile().Partition()[1000].(time.Time); !ok {
+		t.Fatalf("partition value = %T, want it returned as read", entries[0].DataFile().Partition()[1000])
+	}
+}
+
+// iceberg-go now converts day-transform partitions to iceberg.Date during read
+// (applyDayTransformDates), so an entry nobody looked at between reading and
+// writing still carries an Iceberg value and writes cleanly. This used to fail
+// because conversion was lazy and ManifestWriter.addEntry rebound the logical
+// types to the output manifest — whose day transform carries no date logical
+// type — before the first Partition() call, leaving a time.Time that the
+// encoder rejected. The shim keeps the round-trip working for the identity
+// transforms iceberg-go still does not convert (see TestReadManifestNormalizesForeignPartitions).
+func TestReadManifestConvertsBeforeTheWriterRebindsLogicalTypes(t *testing.T) {
+	schema := iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Name: "event_time", Type: iceberg.PrimitiveTypes.Timestamp, Required: true},
+	)
+	spec := iceberg.NewPartitionSpec(iceberg.PartitionField{
+		SourceIDs: []int{1}, FieldID: 1000, Name: "event_time_day", Transform: iceberg.DayTransform{},
+	})
+	specs := map[int]iceberg.PartitionSpec{spec.ID(): spec}
+	dfBuilder, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, "data/file.parquet",
+		iceberg.ParquetFile, map[int]any{1000: iceberg.Date(20737)}, nil, nil, 1, 1)
+	if err != nil {
+		t.Fatalf("build data file: %v", err)
+	}
+	snapshotID := int64(1)
+	entry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapshotID, nil, nil, dfBuilder.Build())
+	foreignBytes, foreignManifest := s3tablestest.ForeignPartitionManifest(t, schema, spec, entry,
+		"metadata/foreign-manifest.avro", "date", time.Date(2026, time.October, 11, 0, 0, 0, 0, time.UTC), false)
+
+	untouched, err := iceberg.ReadManifest(foreignManifest, bytes.NewReader(foreignBytes), true)
+	if err != nil {
+		t.Fatalf("read foreign manifest: %v", err)
+	}
+	got := untouched[0].DataFile().Partition()[1000]
+	if _, ok := got.(iceberg.Date); !ok {
+		t.Fatalf("iceberg-go now converts day partitions on read; got %T, want iceberg.Date", got)
+	}
+	var buf bytes.Buffer
+	if _, err := iceberg.WriteManifest("metadata/manifest.avro", &buf, 2, spec, schema, snapshotID, untouched); err != nil {
+		t.Fatalf("write manifest read directly through iceberg-go: %v", err)
+	}
+
+	entries, err := ReadManifest(foreignManifest, foreignBytes, true, specs, schema)
+	if err != nil {
+		t.Fatalf("read foreign manifest: %v", err)
+	}
+	buf.Reset()
+	if _, err := iceberg.WriteManifest("metadata/manifest.avro", &buf, 2, spec, schema, snapshotID, entries); err != nil {
+		t.Fatalf("write manifest read through the shim: %v", err)
+	}
+}
+
+// rebuildManifestEntry rebuilds the DataFile through NewDataFileBuilder, which
+// has no setter for the original block_size_in_bytes (the field is not exposed
+// on DataFile). The v1 manifest schema includes block_size_in_bytes with a
+// default of 64 MiB and the spec says "Always write default in v1", so a
+// rebuilt entry written as v1 must carry that default — not 0.
+func TestReadManifestRebuiltEntryPreservesV1BlockSizeDefault(t *testing.T) {
+	schema := iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Name: "event_date", Type: iceberg.PrimitiveTypes.Date, Required: true},
+	)
+	spec := iceberg.NewPartitionSpec(iceberg.PartitionField{
+		SourceIDs: []int{1}, FieldID: 1000, Name: "part", Transform: iceberg.IdentityTransform{},
+	})
+	specs := map[int]iceberg.PartitionSpec{spec.ID(): spec}
+	dfBuilder, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, "data/file.parquet",
+		iceberg.ParquetFile, map[int]any{1000: iceberg.Date(20737)}, nil, nil, 1, 1)
+	if err != nil {
+		t.Fatalf("build data file: %v", err)
+	}
+	snapshotID := int64(1)
+	entry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapshotID, nil, nil, dfBuilder.Build())
+	// valueFirst=true spells the union [<type>, null], hiding the logical type
+	// from iceberg-go so the partition arrives as a time.Time. That triggers
+	// normalizePartitionValue → rebuildManifestEntry, which is the path that
+	// sets block_size_in_bytes.
+	foreignBytes, foreignManifest := s3tablestest.ForeignPartitionManifest(t, schema, spec, entry,
+		"metadata/foreign-manifest.avro", "date", time.Date(2026, time.October, 11, 0, 0, 0, 0, time.UTC), true)
+
+	entries, err := ReadManifest(foreignManifest, foreignBytes, true, specs, schema)
+	if err != nil {
+		t.Fatalf("read foreign manifest: %v", err)
+	}
+
+	var buf bytes.Buffer
+	if _, err := iceberg.WriteManifest("metadata/manifest.avro", &buf, 1, spec, schema, snapshotID, entries); err != nil {
+		t.Fatalf("write v1 manifest: %v", err)
+	}
+
+	reader, err := ocf.NewReader(bytes.NewReader(buf.Bytes()))
+	if err != nil {
+		t.Fatalf("open v1 manifest: %v", err)
+	}
+	var record map[string]any
+	if err := reader.Decode(&record); err != nil {
+		t.Fatalf("decode v1 manifest: %v", err)
+	}
+	if err := reader.Close(); err != nil {
+		t.Fatalf("close v1 manifest: %v", err)
+	}
+	dataFile, ok := record["data_file"].(map[string]any)
+	if !ok {
+		t.Fatalf("data_file = %T, want record", record["data_file"])
+	}
+	got, ok := dataFile["block_size_in_bytes"]
+	if !ok {
+		t.Fatal("block_size_in_bytes missing from v1 manifest")
+	}
+	const want = int64(64 * 1024 * 1024)
+	if got != want {
+		t.Fatalf("block_size_in_bytes = %v, want %d", got, want)
+	}
+}
diff --git a/weed/s3api/s3tables/manager.go b/weed/s3api/s3tables/manager.go
index 10d7856ff4..301be1eb59 100644
--- a/weed/s3api/s3tables/manager.go
+++ b/weed/s3api/s3tables/manager.go
@@ -52,19 +52,84 @@ func (m *Manager) Execute(ctx context.Context, filerClient FilerClient, operatio
 	if err != nil {
 		return err
 	}
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, "/", bytes.NewReader(body))
+	httpReq, err := newManagerRequest(ctx, operation, body, identity)
 	if err != nil {
 		return err
 	}
+	recorder := httptest.NewRecorder()
+	m.handler.HandleRequest(recorder, httpReq, filerClient)
+	return decodeS3TablesHTTPResponse(recorder, resp)
+}
+
+// AuthorizeCreateTable checks that identity may create the table the request
+// describes, without creating anything. A deferred create (Iceberg
+// stage-create) writes into the table bucket long before it registers the
+// table, so it passes this gate first.
+func (m *Manager) AuthorizeCreateTable(ctx context.Context, filerClient FilerClient, req *CreateTableRequest, identity string) error {
+	httpReq, err := newManagerRequest(ctx, "CreateTable", nil, identity)
+	if err != nil {
+		return err
+	}
+	recorder := httptest.NewRecorder()
+	_, authErr := m.handler.authorizeCreateTable(recorder, httpReq, filerClient, req.TableBucketARN, req.Namespace, req.Name, req.Tags)
+	if authErr == nil {
+		return nil
+	}
+	if decoded := decodeS3TablesHTTPResponse(recorder, nil); decoded != nil {
+		return decoded
+	}
+	return authErr
+}
+
+// AuthorizeUpdateTable checks that identity may update the table the request
+// describes, without updating anything. Credential vending gates on the same
+// permission a commit needs.
+func (m *Manager) AuthorizeUpdateTable(ctx context.Context, filerClient FilerClient, req *UpdateTableRequest, identity string) error {
+	httpReq, err := newManagerRequest(ctx, "UpdateTable", nil, identity)
+	if err != nil {
+		return err
+	}
+	recorder := httptest.NewRecorder()
+	_, authErr := m.handler.authorizeUpdateTable(recorder, httpReq, filerClient, req)
+	if authErr == nil {
+		return nil
+	}
+	if decoded := decodeS3TablesHTTPResponse(recorder, nil); decoded != nil {
+		return decoded
+	}
+	return authErr
+}
+
+// AuthorizeUpdateView checks that identity may update the view the request
+// describes, without updating anything.
+func (m *Manager) AuthorizeUpdateView(ctx context.Context, filerClient FilerClient, req *UpdateViewRequest, identity string) error {
+	httpReq, err := newManagerRequest(ctx, "UpdateView", nil, identity)
+	if err != nil {
+		return err
+	}
+	recorder := httptest.NewRecorder()
+	_, authErr := m.handler.authorizeUpdateView(recorder, httpReq, filerClient, req)
+	if authErr == nil {
+		return nil
+	}
+	if decoded := decodeS3TablesHTTPResponse(recorder, nil); decoded != nil {
+		return decoded
+	}
+	return authErr
+}
+
+func newManagerRequest(ctx context.Context, operation string, body []byte, identity string) (*http.Request, error) {
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, "/", bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
 	httpReq.Header.Set("Content-Type", "application/x-amz-json-1.1")
 	httpReq.Header.Set("X-Amz-Target", "S3Tables."+operation)
 	if identity != "" {
 		httpReq.Header.Set(s3_constants.AmzAccountId, identity)
 		httpReq = httpReq.WithContext(s3_constants.SetIdentityNameInContext(httpReq.Context(), identity))
 	}
-	recorder := httptest.NewRecorder()
-	m.handler.HandleRequest(recorder, httpReq, filerClient)
-	return decodeS3TablesHTTPResponse(recorder, resp)
+	return httpReq, nil
 }
 
 func decodeS3TablesHTTPResponse(recorder *httptest.ResponseRecorder, resp interface{}) error {
diff --git a/weed/s3api/s3tables/permissions.go b/weed/s3api/s3tables/permissions.go
index 08a666c83e..28e9a3dcf3 100644
--- a/weed/s3api/s3tables/permissions.go
+++ b/weed/s3api/s3tables/permissions.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
@@ -88,6 +89,16 @@ type PolicyContext struct {
 	KMSKeyArn       string
 	StorageClass    string
 	DefaultAllow    bool
+	// TrustedIssuers lists the OIDC issuers the deployment is configured to
+	// trust, used to re-anchor owners/principals written before issuer-scoped
+	// account IDs. A bare subject is only resolvable when exactly one issuer
+	// is configured; more than one leaves it ambiguous, so it must not match.
+	TrustedIssuers []string
+	// IsLocalAccountID reports whether an account ID belongs to a configured
+	// local identity. Such owner strings were never OIDC subjects and must not
+	// be re-anchored; a nil predicate exempts nothing beyond the built-in
+	// reserved, ARN, and scoped-id checks.
+	IsLocalAccountID func(string) bool
 }
 
 // CheckPermissionWithContext checks permission with optional resource and condition context.
@@ -107,10 +118,74 @@ func CheckPermissionWithContext(operation, principal, owner, resourcePolicy, res
 	return checkPermission(operation, principal, owner, resourcePolicy, resourceARN, ctx)
 }
 
+// CheckTableOrBucketPermission combines a table or namespace policy with its
+// table bucket's policy into one decision: a matching Deny on either policy
+// vetoes the request even when the other policy would allow it.
+func CheckTableOrBucketPermission(operation, principal, resourceOwner, resourcePolicy, resourceARN, bucketOwner, bucketPolicy, bucketARN string, ctx *PolicyContext) bool {
+	if principal == "" {
+		return false
+	}
+	if principal == s3_constants.AccountAdminId {
+		return true
+	}
+	if matchesDenyStatement(operation, principal, resourcePolicy, resourceARN, ctx) ||
+		matchesDenyStatement(operation, principal, bucketPolicy, bucketARN, ctx) {
+		return false
+	}
+	// Each side fails closed when its owner is unknown, matching
+	// CheckPermissionWithContext; an ownerless side contributes nothing.
+	resourceOK := resourceOwner != "" &&
+		checkPermission(operation, principal, resourceOwner, resourcePolicy, resourceARN, ctx)
+	bucketOK := bucketOwner != "" &&
+		checkPermission(operation, principal, bucketOwner, bucketPolicy, bucketARN, ctx)
+	return resourceOK || bucketOK
+}
+
+// deniedByPolicy reports whether another applicable resource policy vetoes the
+// request. The admin account is exempt, matching CheckPermissionWithContext.
+func deniedByPolicy(operation, principal, resourcePolicy, resourceARN string, ctx *PolicyContext) bool {
+	return principal != s3_constants.AccountAdminId &&
+		matchesDenyStatement(operation, principal, resourcePolicy, resourceARN, ctx)
+}
+
+// matchesDenyStatement reports whether the JSON policy carries a statement
+// matching this request with Effect Deny. Malformed policies return false;
+// the caller's normal evaluation still denies them.
+func matchesDenyStatement(operation, principal, resourcePolicy, resourceARN string, ctx *PolicyContext) bool {
+	if resourcePolicy == "" {
+		return false
+	}
+	fullAction := operation
+	if !strings.Contains(operation, ":") {
+		fullAction = "s3tables:" + operation
+	}
+	var policy PolicyDocument
+	if err := json.Unmarshal([]byte(resourcePolicy), &policy); err != nil {
+		return false
+	}
+	for _, stmt := range policy.Statement {
+		if stmt.Effect != "Deny" ||
+			!matchesCaller(stmt.Principal, principal, ctx) ||
+			!matchesAction(stmt.Action, fullAction) ||
+			(resourceARN != "" && !matchesResource(stmt.Resource, resourceARN)) ||
+			!matchesConditions(stmt.Condition, ctx) {
+			continue
+		}
+		return true
+	}
+	return false
+}
+
 func checkPermission(operation, principal, owner, resourcePolicy, resourceARN string, ctx *PolicyContext) bool {
 
-	// Owner always has permission
-	if principal == owner {
+	// An explicit Deny in the resource policy vetoes owner and identity
+	// grants as well as allows within the same document.
+	if matchesDenyStatement(operation, principal, resourcePolicy, resourceARN, ctx) {
+		return false
+	}
+
+	// Owner always has permission.
+	if principal == owner || matchesLegacySubject(owner, principal, ctx) {
 		return true
 	}
 
@@ -145,7 +220,7 @@ func checkPermission(operation, principal, owner, resourcePolicy, resourceARN st
 
 	for _, stmt := range policy.Statement {
 		// Check if principal matches
-		if !matchesPrincipal(stmt.Principal, principal) {
+		if !matchesCaller(stmt.Principal, principal, ctx) {
 			continue
 		}
 
@@ -225,6 +300,54 @@ func hasAdminAction(actions []string) bool {
 	return false
 }
 
+// matchesCaller matches a statement's Principal against the caller's scoped
+// principal or, for policies written before issuer scoping, a bare subject
+// that resolves to it under the deployment's single trusted issuer.
+func matchesCaller(principalSpec interface{}, principal string, ctx *PolicyContext) bool {
+	if matchesPrincipal(principalSpec, principal) {
+		return true
+	}
+	switch p := principalSpec.(type) {
+	case string:
+		return matchesLegacySubject(p, principal, ctx)
+	case []interface{}:
+		for _, item := range p {
+			if str, ok := item.(string); ok && matchesLegacySubject(str, principal, ctx) {
+				return true
+			}
+		}
+	case map[string]interface{}:
+		if aws, ok := p["AWS"]; ok {
+			return matchesCaller(aws, principal, ctx)
+		}
+	}
+	return false
+}
+
+// matchesLegacySubject reports whether a bare subject stored before issuer
+// scoping belongs to the caller. Re-anchoring is only sound when exactly one
+// OIDC issuer is configured: the stored subject is hashed under that issuer
+// and compared to the caller's scoped principal. With multiple issuers a bare
+// subject is ambiguous — matching it under the caller's own issuer would let
+// a same-sub identity from any configured issuer claim it.
+func matchesLegacySubject(legacy, principal string, ctx *PolicyContext) bool {
+	if ctx == nil || len(ctx.TrustedIssuers) != 1 {
+		return false
+	}
+	// The reserved accounts, ARN values, and already issuer-scoped ids are never
+	// OIDC subjects — or, for strings that could be either a legacy subject or a
+	// scoped id, resolving to scoped fails closed. A configured local account
+	// id is excluded the same way once the caller supplies the predicate. Any
+	// of them could otherwise be claimed by a token asserting that string as
+	// sub — including the admin account or a victim's scoped id.
+	if legacy == s3_constants.AccountAdminId || legacy == s3_constants.AccountAnonymousId ||
+		strings.HasPrefix(legacy, "arn:") || sts.IsParentUserID(legacy) ||
+		(ctx.IsLocalAccountID != nil && ctx.IsLocalAccountID(legacy)) {
+		return false
+	}
+	return sts.ComputeParentUser(legacy, ctx.TrustedIssuers[0]) == principal
+}
+
 // matchesPrincipal checks if the principal matches the statement's principal
 func matchesPrincipal(principalSpec interface{}, principal string) bool {
 	if principalSpec == nil {
diff --git a/weed/s3api/s3tables/permissions_test.go b/weed/s3api/s3tables/permissions_test.go
index 05233f56ff..62f67deabd 100644
--- a/weed/s3api/s3tables/permissions_test.go
+++ b/weed/s3api/s3tables/permissions_test.go
@@ -3,6 +3,8 @@ package s3tables
 import (
 	"encoding/json"
 	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/sts"
 )
 
 func TestMatchesActionPattern(t *testing.T) {
@@ -251,3 +253,178 @@ func TestCheckPermissionWithDefaultAllow(t *testing.T) {
 		})
 	}
 }
+
+func TestCheckTableOrBucketPermissionDenyVeto(t *testing.T) {
+	tablePolicy := `{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Deny",
+			"Principal": "*",
+			"Action": "s3tables:DeleteTable",
+			"Resource": "*"
+		}]
+	}`
+	bucketAllow := `{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Allow",
+			"Principal": "*",
+			"Action": "s3tables:*",
+			"Resource": "*"
+		}]
+	}`
+	tableARN := "arn:aws:s3tables:us-east-1:acct:bucket/b/table/ns/t"
+	bucketARN := "arn:aws:s3tables:us-east-1:acct:bucket/b"
+	ctx := &PolicyContext{TableBucketName: "b", Namespace: "ns", TableName: "t"}
+
+	// A Deny on the table policy vetoes the bucket Allow.
+	if CheckTableOrBucketPermission("DeleteTable", "user123", "owner", tablePolicy, tableARN, "owner", bucketAllow, bucketARN, ctx) {
+		t.Error("table Deny should veto bucket Allow")
+	}
+
+	// The same Deny in the bucket policy vetoes a table Allow.
+	if CheckTableOrBucketPermission("DeleteTable", "user123", "owner", bucketAllow, tableARN, "owner", tablePolicy, bucketARN, ctx) {
+		t.Error("bucket Deny should veto table Allow")
+	}
+
+	// A table Deny also vetoes ownership of the table.
+	if CheckTableOrBucketPermission("DeleteTable", "owner", "owner", tablePolicy, tableARN, "owner", "", bucketARN, ctx) {
+		t.Error("table Deny should veto the owner grant")
+	}
+
+	// No Deny anywhere: either policy may allow.
+	if !CheckTableOrBucketPermission("DeleteTable", "user123", "other-owner", "", tableARN, "owner", bucketAllow, bucketARN, ctx) {
+		t.Error("bucket Allow should grant when no policy denies")
+	}
+}
+
+func TestCheckTableOrBucketPermissionOwnerlessFailsClosed(t *testing.T) {
+	ctx := &PolicyContext{
+		IdentityActions: []string{"s3tables:*"},
+		DefaultAllow:    true,
+	}
+	allowPolicy := `{"Statement":[{"Effect":"Allow","Principal":"*","Action":"s3tables:*","Resource":"*"}]}`
+
+	if CheckTableOrBucketPermission("GetTable", "user1",
+		"", "", "arn:aws:s3tables:t",
+		"", "", "arn:aws:s3tables:b", ctx) {
+		t.Error("identity actions and default allow must not reach an ownerless resource")
+	}
+
+	// With no identity or default grants in play, an ownerless resource
+	// side contributes nothing even when its own policy allows.
+	plainCtx := &PolicyContext{}
+	if CheckTableOrBucketPermission("GetTable", "user1",
+		"", allowPolicy, "arn:aws:s3tables:t",
+		"owner", "", "arn:aws:s3tables:b", plainCtx) {
+		t.Error("an ownerless resource side must not grant even via an explicit allow")
+	}
+
+	if !CheckTableOrBucketPermission("GetTable", "user1",
+		"", "", "arn:aws:s3tables:t",
+		"owner", allowPolicy, "arn:aws:s3tables:b", plainCtx) {
+		t.Error("the bucket side can still grant when its owner is set")
+	}
+}
+
+// Owners written before issuer scoping hold a bare subject. Re-anchoring it
+// is only unambiguous when exactly one OIDC issuer is configured; under two
+// or more issuers a bare subject could belong to either, so it must not
+// match anyone.
+func TestCheckPermissionLegacyOwnerScopedToIssuer(t *testing.T) {
+	owner := "alice-sub"
+	principal := sts.ComputeParentUser(owner, "corp-idp")
+	noLocal := &PolicyContext{
+		TrustedIssuers:   []string{"corp-idp"},
+		IsLocalAccountID: func(string) bool { return false },
+	}
+
+	if !CheckPermissionWithContext("GetTable", principal, owner, "", "arn", noLocal) {
+		t.Error("single-issuer deployments must keep recognizing the legacy owner")
+	}
+
+	if CheckPermissionWithContext("GetTable", principal, owner, "", "arn", &PolicyContext{
+		TrustedIssuers:   []string{"corp-idp", "evil-idp"},
+		IsLocalAccountID: func(string) bool { return false },
+	}) {
+		t.Error("a bare subject is ambiguous across multiple issuers and must not match")
+	}
+
+	if CheckPermissionWithContext("GetTable", sts.ComputeParentUser(owner, "evil-idp"), owner, "", "arn", &PolicyContext{
+		TrustedIssuers:   []string{"corp-idp", "evil-idp"},
+		IsLocalAccountID: func(string) bool { return false },
+	}) {
+		t.Error("a same-sub caller from another issuer must not claim the legacy owner")
+	}
+
+	if CheckPermissionWithContext("GetTable", principal, owner, "", "arn", &PolicyContext{
+		IsLocalAccountID: func(string) bool { return false },
+	}) {
+		t.Error("legacy owner matching must not engage without a trusted issuer")
+	}
+
+	// With no local-account predicate only the unconditional exclusions apply;
+	// a plain legacy subject still re-anchors.
+	if !CheckPermissionWithContext("GetTable", principal, owner, "", "arn", &PolicyContext{
+		TrustedIssuers: []string{"corp-idp"},
+	}) {
+		t.Error("a missing local-account check keeps plain legacy subjects working")
+	}
+}
+
+// A stored owner that names a reserved or configured local account was never
+// an OIDC subject, and an already issuer-scoped id is not a legacy subject
+// either; re-anchoring them would let a caller pick sub=<stored owner> and
+// claim the resource.
+func TestCheckPermissionLegacyOwnerExcludesLocalAndScoped(t *testing.T) {
+	ctx := &PolicyContext{
+		TrustedIssuers:   []string{"corp-idp"},
+		IsLocalAccountID: func(id string) bool { return id == "admin" || id == "owner2" },
+	}
+
+	for _, owner := range []string{"admin", "owner2"} {
+		principal := sts.ComputeParentUser(owner, "corp-idp")
+		if CheckPermissionWithContext("GetTable", principal, owner, "", "arn", ctx) {
+			t.Errorf("sub=%q must not re-anchor onto the local account owner", owner)
+		}
+	}
+
+	scoped := sts.ComputeParentUser("victim-sub", "corp-idp")
+	if CheckPermissionWithContext("GetTable", sts.ComputeParentUser(scoped, "corp-idp"), scoped, "", "arn", ctx) {
+		t.Error("sub equal to a stored scoped id must not re-anchor")
+	}
+
+	// An ARN-shaped subject claims nothing; ARNs name IAM principals, not OIDC
+	// subjects, and this shape is what let a forged sub reach the admin account.
+	arn := "arn:aws:iam::123456789012:user/admin"
+	if CheckPermissionWithContext("GetTable", sts.ComputeParentUser(arn, "corp-idp"), arn, "", "arn", ctx) {
+		t.Error("an ARN-shaped stored owner must not re-anchor")
+	}
+}
+
+// Legacy policies can carry the bare subject in the AWS map or array forms,
+// not only as a top-level string; re-anchoring must reach all of them or a
+// pre-scoping Deny silently stops matching the caller.
+func TestCheckPermissionLegacyPolicyPrincipalShapes(t *testing.T) {
+	ctx := &PolicyContext{
+		TrustedIssuers:   []string{"corp-idp"},
+		IsLocalAccountID: func(string) bool { return false },
+	}
+	principal := sts.ComputeParentUser("alice-sub", "corp-idp")
+	other := "other-owner"
+
+	// The caller owns the resource, so only a matched Deny can veto it.
+	for _, policy := range []string{
+		`{"Statement":[{"Effect":"Deny","Principal":{"AWS":"alice-sub"},"Action":"s3tables:GetTable"}]}`,
+		`{"Statement":[{"Effect":"Deny","Principal":["alice-sub"],"Action":"s3tables:GetTable"}]}`,
+	} {
+		if CheckPermissionWithContext("GetTable", principal, principal, policy, "arn", ctx) {
+			t.Errorf("legacy Deny must veto the scoped caller's owner grant: %s", policy)
+		}
+	}
+
+	allow := `{"Statement":[{"Effect":"Allow","Principal":["alice-sub"],"Action":"s3tables:GetTable"}]}`
+	if !CheckPermissionWithContext("GetTable", principal, other, allow, "arn", ctx) {
+		t.Error("legacy Allow with array principal must still match the scoped caller")
+	}
+}
diff --git a/weed/s3api/s3tables/s3tablestest/foreign_manifest.go b/weed/s3api/s3tables/s3tablestest/foreign_manifest.go
new file mode 100644
index 0000000000..73a4ea112f
--- /dev/null
+++ b/weed/s3api/s3tables/s3tablestest/foreign_manifest.go
@@ -0,0 +1,150 @@
+package s3tablestest
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/twmb/avro"
+	"github.com/twmb/avro/ocf"
+)
+
+// ForeignPartitionManifest rewrites a manifest iceberg-go wrote so its
+// partition field carries the Avro union a foreign writer emits: [<type>, null]
+// rather than [null, <type>]. Both are valid Avro, but iceberg-go reads a
+// partition field's logical type from the union's last branch, so the ordering
+// decides whether it hands back an Iceberg value or the rich Go value the Avro
+// decoder produced.
+//
+// logicalType is stamped onto the value branch, since iceberg-go writes a day
+// partition as a bare int, and decoded replaces the partition value in the
+// record, standing in for what the foreign writer encoded. valueFirst orders
+// the union [<type>, null] rather than the [null, <type>] Java and iceberg-rust
+// emit.
+func ForeignPartitionManifest(
+	t *testing.T,
+	schema *iceberg.Schema,
+	spec iceberg.PartitionSpec,
+	entry iceberg.ManifestEntry,
+	manifestPath, logicalType string,
+	decoded any,
+	valueFirst bool,
+) ([]byte, iceberg.ManifestFile) {
+	t.Helper()
+
+	var original bytes.Buffer
+	manifest, err := iceberg.WriteManifest(manifestPath, &original, 2, spec, schema, 1, []iceberg.ManifestEntry{entry})
+	if err != nil {
+		t.Fatalf("write base manifest: %v", err)
+	}
+
+	reader, err := ocf.NewReader(bytes.NewReader(original.Bytes()))
+	if err != nil {
+		t.Fatalf("open base manifest: %v", err)
+	}
+	metadata := reader.Metadata()
+	var record map[string]any
+	if err := reader.Decode(&record); err != nil {
+		t.Fatalf("decode base manifest: %v", err)
+	}
+	if err := reader.Close(); err != nil {
+		t.Fatalf("close base manifest: %v", err)
+	}
+
+	fieldName := spec.Field(0).Name
+
+	var schemaDoc map[string]any
+	if err := json.Unmarshal(metadata["avro.schema"], &schemaDoc); err != nil {
+		t.Fatalf("decode manifest schema: %v", err)
+	}
+	dataFile := findAvroField(t, schemaDoc, "data_file")
+	partition := findAvroField(t, dataFile, "partition")
+	partitionFields, ok := partition["fields"].([]any)
+	if !ok {
+		t.Fatalf("partition schema fields have type %T", partition["fields"])
+	}
+	for _, rawField := range partitionFields {
+		field, ok := rawField.(map[string]any)
+		if !ok || field["name"] != fieldName {
+			continue
+		}
+		fieldType, ok := field["type"].([]any)
+		if !ok || len(fieldType) != 2 {
+			t.Fatalf("%s schema type = %#v, want nullable union", fieldName, field["type"])
+		}
+		valueType, ok := fieldType[1].(map[string]any)
+		if !ok {
+			primitive, primitiveOK := fieldType[1].(string)
+			if !primitiveOK {
+				t.Fatalf("%s value branch = %T, want Avro type", fieldName, fieldType[1])
+			}
+			valueType = map[string]any{"type": primitive}
+		}
+		valueType["logicalType"] = logicalType
+		if valueFirst {
+			field["type"] = []any{valueType, "null"}
+		} else {
+			field["type"] = []any{"null", valueType}
+		}
+		break
+	}
+
+	dataFileRecord, ok := record["data_file"].(map[string]any)
+	if !ok {
+		t.Fatalf("decoded data_file = %T, want record", record["data_file"])
+	}
+	partitionRecord, ok := dataFileRecord["partition"].(map[string]any)
+	if !ok {
+		t.Fatalf("decoded partition = %T, want record", dataFileRecord["partition"])
+	}
+	partitionRecord[fieldName] = decoded
+
+	foreignSchemaJSON, err := json.Marshal(schemaDoc)
+	if err != nil {
+		t.Fatalf("encode foreign manifest schema: %v", err)
+	}
+	foreignSchema, err := avro.Parse(string(foreignSchemaJSON))
+	if err != nil {
+		t.Fatalf("parse foreign manifest schema: %v", err)
+	}
+	userMetadata := make(map[string][]byte)
+	for key, value := range metadata {
+		if key != "avro.schema" && key != "avro.codec" {
+			userMetadata[key] = value
+		}
+	}
+	var foreign bytes.Buffer
+	writer, err := ocf.NewWriter(&foreign, foreignSchema, ocf.WithSchema(string(foreignSchemaJSON)), ocf.WithMetadata(userMetadata))
+	if err != nil {
+		t.Fatalf("create foreign manifest writer: %v", err)
+	}
+	if err := writer.Encode(record); err != nil {
+		t.Fatalf("encode foreign manifest: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close foreign manifest writer: %v", err)
+	}
+
+	return foreign.Bytes(), iceberg.NewManifestFile(2, manifest.FilePath(), int64(foreign.Len()), manifest.PartitionSpecID(), 1).AddedFiles(1).SequenceNum(1, 1).Build()
+}
+
+func findAvroField(t *testing.T, record map[string]any, name string) map[string]any {
+	t.Helper()
+	fields, ok := record["fields"].([]any)
+	if !ok {
+		t.Fatalf("Avro record fields have type %T", record["fields"])
+	}
+	for _, rawField := range fields {
+		field, ok := rawField.(map[string]any)
+		if ok && field["name"] == name {
+			fieldType, ok := field["type"].(map[string]any)
+			if ok {
+				return fieldType
+			}
+			t.Fatalf("Avro field %q type has type %T", name, field["type"])
+		}
+	}
+	t.Fatalf("Avro field %q not found", name)
+	return nil
+}
diff --git a/weed/s3api/s3tables/s3tablestest/memfiler.go b/weed/s3api/s3tables/s3tablestest/memfiler.go
new file mode 100644
index 0000000000..5d4540771e
--- /dev/null
+++ b/weed/s3api/s3tables/s3tablestest/memfiler.go
@@ -0,0 +1,242 @@
+// Package s3tablestest provides an in-memory filer for driving S3 Tables and
+// Lance namespace operations end-to-end without a live cluster.
+package s3tablestest
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"path"
+	"sort"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+// MemFiler is an in-memory filer used to drive Manager operations
+// end-to-end without a live cluster.
+type MemFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	// mu guards entries. The real filer serves concurrent RPCs, and a test that
+	// races writers against each other - the point of an exclusive create - hits
+	// this map from several goroutines at once.
+	mu      sync.RWMutex
+	entries map[string]map[string]*filer_pb.Entry // dir -> name -> entry
+	Client  filer_pb.SeaweedFilerClient
+	// BeforeUpdate runs once, at the start of the next UpdateEntry, so a test
+	// can land a competing write in a handler's read-to-write window.
+	BeforeUpdate func()
+	// RejectDelete returns the reason DeleteEntry refuses a path, answered the
+	// way the filer answers one: no transport error, the reason in the response.
+	RejectDelete func(dir, name string) string
+}
+
+func newMemFiler() *MemFiler {
+	return &MemFiler{entries: make(map[string]map[string]*filer_pb.Entry)}
+}
+
+func (f *MemFiler) Get(dir, name string) *filer_pb.Entry {
+	f.mu.RLock()
+	defer f.mu.RUnlock()
+	if d, ok := f.entries[dir]; ok {
+		return d[name]
+	}
+	return nil
+}
+
+func (f *MemFiler) Put(dir, name string, extended map[string][]byte) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if _, ok := f.entries[dir]; !ok {
+		f.entries[dir] = make(map[string]*filer_pb.Entry)
+	}
+	f.entries[dir][name] = &filer_pb.Entry{Name: name, IsDirectory: true, Extended: extended}
+}
+
+// PutFile adds a file entry with an explicit modification time, which callers
+// that age entries out (orphan cleanup, expiry) need in order to see them.
+func (f *MemFiler) PutFile(dir, name string, mtime time.Time) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if _, ok := f.entries[dir]; !ok {
+		f.entries[dir] = make(map[string]*filer_pb.Entry)
+	}
+	f.entries[dir][name] = &filer_pb.Entry{
+		Name:       name,
+		Attributes: &filer_pb.FuseAttributes{Mtime: mtime.Unix(), Crtime: mtime.Unix()},
+	}
+}
+
+func (f *MemFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if e := f.Get(req.Directory, req.Name); e != nil {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: e}, nil
+	}
+	// Carry the sentinel text so filer_pb.LookupEntry maps it to ErrNotFound.
+	return nil, status.Errorf(codes.NotFound, "%s: %s/%s", filer_pb.ErrNotFound.Error(), req.Directory, req.Name)
+}
+
+// ListEntries honours prefix, start-from and limit the way the real filer does.
+// A harness that ignores them makes a paginating caller re-read the first page
+// forever, which looks like duplicated entries rather than a broken listing.
+func (f *MemFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream grpc.ServerStreamingServer[filer_pb.ListEntriesResponse]) error {
+	f.mu.RLock()
+	d, ok := f.entries[req.Directory]
+	names := make([]string, 0, len(d))
+	snapshot := make(map[string]*filer_pb.Entry, len(d))
+	for name, entry := range d {
+		names = append(names, name)
+		snapshot[name] = entry
+	}
+	f.mu.RUnlock()
+	if !ok {
+		return nil
+	}
+	sort.Strings(names)
+
+	sent := uint32(0)
+	for _, name := range names {
+		if req.Prefix != "" && !strings.HasPrefix(name, req.Prefix) {
+			continue
+		}
+		if req.StartFromFileName != "" {
+			if name < req.StartFromFileName {
+				continue
+			}
+			if name == req.StartFromFileName && !req.InclusiveStartFrom {
+				continue
+			}
+		}
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: snapshot[name]}); err != nil {
+			return err
+		}
+		sent++
+		if req.Limit > 0 && sent >= req.Limit {
+			return nil
+		}
+	}
+	return nil
+}
+
+func (f *MemFiler) CreateEntry(_ context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if _, ok := f.entries[req.Directory]; !ok {
+		f.entries[req.Directory] = make(map[string]*filer_pb.Entry)
+	}
+	// O_EXCL is the filer's put-if-not-exists. Ignoring it here would let a test
+	// that races two writers see both of them win.
+	if _, exists := f.entries[req.Directory][req.Entry.Name]; exists && req.OExcl {
+		return &filer_pb.CreateEntryResponse{ErrorCode: filer_pb.FilerError_ENTRY_ALREADY_EXISTS}, nil
+	}
+	f.entries[req.Directory][req.Entry.Name] = req.Entry
+	return &filer_pb.CreateEntryResponse{}, nil
+}
+
+func (f *MemFiler) UpdateEntry(_ context.Context, req *filer_pb.UpdateEntryRequest) (*filer_pb.UpdateEntryResponse, error) {
+	// The hook runs before the lock is taken: its whole purpose is to land a
+	// competing write in the read-to-write window, and that write needs the lock.
+	if hook := f.BeforeUpdate; hook != nil {
+		f.BeforeUpdate = nil
+		hook()
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	// The real filer validates ExpectedExtended under the per-path lock; without
+	// it here a lost update would look like a success.
+	for key, expected := range req.ExpectedExtended {
+		var actual []byte
+		if d, ok := f.entries[req.Directory]; ok {
+			if existing := d[req.Entry.Name]; existing != nil {
+				actual = existing.Extended[key]
+			}
+		}
+		if !bytes.Equal(actual, expected) {
+			return nil, status.Errorf(codes.FailedPrecondition, "extended attribute %q changed", key)
+		}
+	}
+	if _, ok := f.entries[req.Directory]; !ok {
+		f.entries[req.Directory] = make(map[string]*filer_pb.Entry)
+	}
+	f.entries[req.Directory][req.Entry.Name] = req.Entry
+	return &filer_pb.UpdateEntryResponse{}, nil
+}
+
+func (f *MemFiler) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	if reject := f.RejectDelete; reject != nil {
+		if reason := reject(req.Directory, req.Name); reason != "" {
+			return &filer_pb.DeleteEntryResponse{Error: reason}, nil
+		}
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if d, ok := f.entries[req.Directory]; ok {
+		delete(d, req.Name)
+	}
+	// Honor recursive data deletion so a regression that wipes the table directory
+	// also drops its metadata/ and data/ children (the data-loss this guards against).
+	if req.IsRecursive && req.IsDeleteData {
+		child := path.Join(req.Directory, req.Name)
+		for dir := range f.entries {
+			if dir == child || strings.HasPrefix(dir, child+"/") {
+				delete(f.entries, dir)
+			}
+		}
+	}
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+// GetFilerConfiguration answers with the defaults, so operations that resolve
+// the buckets directory before touching an entry work against this filer.
+func (f *MemFiler) GetFilerConfiguration(_ context.Context, _ *filer_pb.GetFilerConfigurationRequest) (*filer_pb.GetFilerConfigurationResponse, error) {
+	return &filer_pb.GetFilerConfigurationResponse{DirBuckets: s3_constants.DefaultBucketsPath}, nil
+}
+
+func (f *MemFiler) Ping(_ context.Context, _ *filer_pb.PingRequest) (*filer_pb.PingResponse, error) {
+	now := time.Now().UnixNano()
+	return &filer_pb.PingResponse{StartTimeNs: now, RemoteTimeNs: now, StopTimeNs: now}, nil
+}
+
+func Start(t *testing.T) *MemFiler {
+	t.Helper()
+	fs := newMemFiler()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("start filer: %v", err)
+	}
+
+	server := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(server, fs)
+	go func() { _ = server.Serve(listener) }()
+	t.Cleanup(server.GracefulStop)
+
+	conn, err := grpc.NewClient(listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatalf("start filer: %v", err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+
+	fs.Client = filer_pb.NewSeaweedFilerClient(conn)
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		pingCtx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+		_, err := fs.Client.Ping(pingCtx, &filer_pb.PingRequest{})
+		cancel()
+		if err == nil {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("filer not ready: %v", err)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	return fs
+}
diff --git a/weed/s3api/s3tables/table_data_dir_test.go b/weed/s3api/s3tables/table_data_dir_test.go
index ffbcc3c793..c702f14e30 100644
--- a/weed/s3api/s3tables/table_data_dir_test.go
+++ b/weed/s3api/s3tables/table_data_dir_test.go
@@ -21,3 +21,17 @@ func TestTableDataDirFromMetadataLocation(t *testing.T) {
 		}
 	}
 }
+
+func TestMetadataVersionFromLocationUniqueSuffix(t *testing.T) {
+	cases := map[string]int{
+		"s3://bkt/ns/t/metadata/v4.metadata.json":                                      4,
+		"s3://bkt/ns/t/metadata/v4-0a1b2c3d-4e5f-6789-abcd-ef0123456789.metadata.json": 4,
+		"s3://bkt/ns/t/metadata/00007-0a1b2c3d.metadata.json":                          7,
+		"s3://bkt/ns/t/metadata/whatever.metadata.json":                                1,
+	}
+	for location, want := range cases {
+		if got := metadataVersionFromLocation(location); got != want {
+			t.Errorf("metadataVersionFromLocation(%q) = %d, want %d", location, got, want)
+		}
+	}
+}
diff --git a/weed/s3api/s3tables/types.go b/weed/s3api/s3tables/types.go
index 6416cf08f9..748abf62c8 100644
--- a/weed/s3api/s3tables/types.go
+++ b/weed/s3api/s3tables/types.go
@@ -2,6 +2,7 @@ package s3tables
 
 import (
 	"encoding/json"
+	"strings"
 	"time"
 )
 
@@ -12,11 +13,17 @@ type TableBucket struct {
 	Name           string    `json:"name"`
 	OwnerAccountID string    `json:"ownerAccountId"`
 	CreatedAt      time.Time `json:"createdAt"`
+	Format         string    `json:"format,omitempty"`
 }
 
 type CreateTableBucketRequest struct {
 	Name string            `json:"name"`
 	Tags map[string]string `json:"tags,omitempty"`
+	// Format is the table format this bucket holds. A bucket is a catalog and a
+	// catalog serves one protocol, so declaring it here is what lets a caller be
+	// told where to connect. Empty means ICEBERG, which is what AWS S3 Tables
+	// serves and therefore what an SDK that has never heard of this field means.
+	Format string `json:"format,omitempty"`
 }
 
 type CreateTableBucketResponse struct {
@@ -32,6 +39,9 @@ type GetTableBucketResponse struct {
 	Name           string    `json:"name"`
 	OwnerAccountID string    `json:"ownerAccountId"`
 	CreatedAt      time.Time `json:"createdAt"`
+	// Format is empty for a bucket created before formats were declared. Such a
+	// bucket accepts any format, which is what it did when it was made.
+	Format string `json:"format,omitempty"`
 }
 
 type ListTableBucketsRequest struct {
@@ -44,6 +54,7 @@ type TableBucketSummary struct {
 	ARN       string    `json:"arn"`
 	Name      string    `json:"name"`
 	CreatedAt time.Time `json:"createdAt"`
+	Format    string    `json:"format,omitempty"`
 }
 
 type ListTableBucketsResponse struct {
@@ -235,9 +246,12 @@ type ListTablesRequest struct {
 }
 
 type TableSummary struct {
-	Name             string    `json:"name"`
-	TableARN         string    `json:"tableARN"`
-	Namespace        []string  `json:"namespace"`
+	Name      string   `json:"name"`
+	TableARN  string   `json:"tableARN"`
+	Namespace []string `json:"namespace"`
+	// Format lets a caller tell an Iceberg table from a catalog-only one without
+	// a GetTable per row. AWS omits it; listing a mixed catalog needs it.
+	Format           string    `json:"format,omitempty"`
 	CreatedAt        time.Time `json:"createdAt"`
 	ModifiedAt       time.Time `json:"modifiedAt"`
 	MetadataLocation string    `json:"metadataLocation,omitempty"`
@@ -394,6 +408,143 @@ type DeleteTablePolicyRequest struct {
 	Name           string   `json:"name"`
 }
 
+// Maintenance configuration types
+
+const (
+	MaintenanceTypeIcebergCompaction              = "icebergCompaction"
+	MaintenanceTypeIcebergSnapshotManagement      = "icebergSnapshotManagement"
+	MaintenanceTypeIcebergUnreferencedFileRemoval = "icebergUnreferencedFileRemoval"
+
+	MaintenanceStatusEnabled  = "enabled"
+	MaintenanceStatusDisabled = "disabled"
+)
+
+type IcebergCompactionSettings struct {
+	Strategy         string `json:"strategy,omitempty"`
+	TargetFileSizeMB *int64 `json:"targetFileSizeMB,omitempty"`
+}
+
+// Compaction strategies. AWS also defines z-order, which the maintenance
+// worker cannot produce, so it is rejected rather than silently binpacked.
+const (
+	CompactionStrategyAuto    = "auto"
+	CompactionStrategyBinpack = "binpack"
+	CompactionStrategySort    = "sort"
+	CompactionStrategyZOrder  = "z-order"
+)
+
+type IcebergSnapshotManagementSettings struct {
+	MinSnapshotsToKeep  *int64 `json:"minSnapshotsToKeep,omitempty"`
+	MaxSnapshotAgeHours *int64 `json:"maxSnapshotAgeHours,omitempty"`
+}
+
+type IcebergUnreferencedFileRemovalSettings struct {
+	UnreferencedDays *int64 `json:"unreferencedDays,omitempty"`
+	NonCurrentDays   *int64 `json:"nonCurrentDays,omitempty"`
+}
+
+type MaintenanceSettings struct {
+	IcebergCompaction              *IcebergCompactionSettings              `json:"icebergCompaction,omitempty"`
+	IcebergSnapshotManagement      *IcebergSnapshotManagementSettings      `json:"icebergSnapshotManagement,omitempty"`
+	IcebergUnreferencedFileRemoval *IcebergUnreferencedFileRemovalSettings `json:"icebergUnreferencedFileRemoval,omitempty"`
+}
+
+type MaintenanceConfigurationValue struct {
+	Status   string               `json:"status,omitempty"`
+	Settings *MaintenanceSettings `json:"settings,omitempty"`
+}
+
+// MaintenanceConfiguration maps a maintenance type to its configuration. It is
+// stored verbatim as the maintenance extended attribute so Get is a passthrough.
+type MaintenanceConfiguration map[string]*MaintenanceConfigurationValue
+
+// MergeMaintenanceConfiguration overlays a table's configuration on its
+// bucket's. Unreferenced file removal is only configurable on the bucket, so
+// anything reading a table's effective configuration has to consult both.
+func MergeMaintenanceConfiguration(bucket, table MaintenanceConfiguration) MaintenanceConfiguration {
+	if len(bucket) == 0 {
+		return table
+	}
+	if len(table) == 0 {
+		return bucket
+	}
+
+	merged := make(MaintenanceConfiguration, len(bucket)+len(table))
+	for k, v := range bucket {
+		merged[k] = v
+	}
+	for k, v := range table {
+		merged[k] = v
+	}
+	return merged
+}
+
+type PutTableBucketMaintenanceConfigurationRequest struct {
+	TableBucketARN string                         `json:"tableBucketARN"`
+	Type           string                         `json:"type"`
+	Value          *MaintenanceConfigurationValue `json:"value"`
+}
+
+type GetTableBucketMaintenanceConfigurationRequest struct {
+	TableBucketARN string `json:"tableBucketARN"`
+}
+
+type GetTableBucketMaintenanceConfigurationResponse struct {
+	TableBucketARN string                   `json:"tableBucketARN"`
+	Configuration  MaintenanceConfiguration `json:"configuration"`
+}
+
+type PutTableMaintenanceConfigurationRequest struct {
+	TableBucketARN string                         `json:"tableBucketARN"`
+	Namespace      []string                       `json:"namespace"`
+	Name           string                         `json:"name"`
+	Type           string                         `json:"type"`
+	Value          *MaintenanceConfigurationValue `json:"value"`
+}
+
+type GetTableMaintenanceConfigurationRequest struct {
+	TableBucketARN string   `json:"tableBucketARN"`
+	Namespace      []string `json:"namespace"`
+	Name           string   `json:"name"`
+}
+
+type GetTableMaintenanceConfigurationResponse struct {
+	TableARN      string                   `json:"tableARN"`
+	Namespace     []string                 `json:"namespace"`
+	Name          string                   `json:"name"`
+	Configuration MaintenanceConfiguration `json:"configuration"`
+}
+
+// Maintenance job status types
+
+const (
+	MaintenanceJobStatusNotYetRun  = "Not_Yet_Run"
+	MaintenanceJobStatusSuccessful = "Successful"
+	MaintenanceJobStatusFailed     = "Failed"
+	MaintenanceJobStatusDisabled   = "Disabled"
+)
+
+type MaintenanceJobStatusValue struct {
+	Status           string     `json:"status"`
+	LastRunTimestamp *time.Time `json:"lastRunTimestamp,omitempty"`
+	FailureMessage   string     `json:"failureMessage,omitempty"`
+}
+
+// MaintenanceJobStatus maps a maintenance type to the outcome of its last run.
+// The worker writes it; the control plane only reads it.
+type MaintenanceJobStatus map[string]*MaintenanceJobStatusValue
+
+type GetTableMaintenanceJobStatusRequest struct {
+	TableBucketARN string   `json:"tableBucketARN"`
+	Namespace      []string `json:"namespace"`
+	Name           string   `json:"name"`
+}
+
+type GetTableMaintenanceJobStatusResponse struct {
+	TableARN string               `json:"tableARN"`
+	Status   MaintenanceJobStatus `json:"status"`
+}
+
 // Tagging types
 
 type TagResourceRequest struct {
@@ -425,6 +576,36 @@ func (e *S3TablesError) Error() string {
 	return e.Message
 }
 
+// Table formats a catalog entry may declare.
+//
+// ICEBERG tables carry metadata the catalog maintains and the maintenance
+// worker rewrites. LANCE is catalog-only: the entry records a name and the
+// dataset root in MetadataLocation, and the Lance client owns every byte under
+// it. Nothing in this package interprets a catalog-only table's files.
+const (
+	FormatIceberg = "ICEBERG"
+	FormatLance   = "LANCE"
+)
+
+// IsCatalogOnlyFormat reports whether the catalog only records where a table of
+// this format lives, without understanding its files.
+func IsCatalogOnlyFormat(format string) bool {
+	return format == FormatLance
+}
+
+// NormalizeFormat folds a caller's spelling onto the canonical one and reports
+// whether it names a format this catalog serves.
+func NormalizeFormat(format string) (string, bool) {
+	switch strings.ToUpper(strings.TrimSpace(format)) {
+	case FormatIceberg:
+		return FormatIceberg, true
+	case FormatLance:
+		return FormatLance, true
+	default:
+		return "", false
+	}
+}
+
 // Error codes
 const (
 	ErrCodeBucketAlreadyExists    = "BucketAlreadyExists"
diff --git a/weed/s3api/s3tables/utils.go b/weed/s3api/s3tables/utils.go
index d65c02de7e..8c76b189af 100644
--- a/weed/s3api/s3tables/utils.go
+++ b/weed/s3api/s3tables/utils.go
@@ -9,6 +9,7 @@ import (
 	"regexp"
 	"strings"
 	"time"
+	"unicode/utf8"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 )
@@ -23,9 +24,17 @@ const (
 	tableObjectRootDirName = ".objects"
 )
 
+// ARNPartitionPatternStr matches any AWS partition, not just the commercial
+// one: aws-cn and aws-us-gov ARNs are valid and must reach the handlers.
+const ARNPartitionPatternStr = `aws[-a-z0-9]*`
+
+// ARNPrefixPatternStr is the leading, partition-tolerant part of every S3
+// Tables ARN. The HTTP router shares it so routes and parsing agree.
+const ARNPrefixPatternStr = `arn:` + ARNPartitionPatternStr + `:s3tables`
+
 var (
-	bucketARNPattern = regexp.MustCompile(`^arn:aws:s3tables:[^:]*:[^:]*:bucket/(` + bucketNamePatternStr + `)$`)
-	tableARNPattern  = regexp.MustCompile(`^arn:aws:s3tables:[^:]*:[^:]*:bucket/(` + bucketNamePatternStr + `)/table/(` + tableNamespacePatternStr + `)/(` + tableNamePatternStr + `)$`)
+	bucketARNPattern = regexp.MustCompile(`^` + ARNPrefixPatternStr + `:[^:]*:[^:]*:bucket/(` + bucketNamePatternStr + `)$`)
+	tableARNPattern  = regexp.MustCompile(`^` + ARNPrefixPatternStr + `:[^:]*:[^:]*:bucket/(` + bucketNamePatternStr + `)/table/(` + tableNamespacePatternStr + `)/(` + tableNamePatternStr + `)$`)
 	tagPattern       = regexp.MustCompile(`^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$`)
 )
 
@@ -118,6 +127,63 @@ func TableDataDirFromMetadataLocation(metadataLocation string) string {
 	return path.Join(TablesPath, loc)
 }
 
+// ValidateMetadataLocation checks that an s3:// metadata location stays within
+// the authorized table bucket and inside the caller's own namespace subtree,
+// the boundary per-tenant policies are delegated on. Without the namespace
+// check a caller could register a location inside another tenant's data
+// directory and DeleteTable would purge it. Empty locations are allowed (the
+// catalog derives one). A non-empty location must include a table path so its
+// metadata directory is table-specific, not shared at the bucket level.
+func ValidateMetadataLocation(metadataLocation, bucketName, namespace string) error {
+	if metadataLocation == "" {
+		return nil
+	}
+	bucket, tablePath, err := parseS3Location(metadataLocation)
+	if err != nil {
+		return err
+	}
+	if bucket != bucketName {
+		return fmt.Errorf("metadata location must be within bucket %s", bucketName)
+	}
+	hasSegment := false
+	for _, segment := range strings.Split(tablePath, "/") {
+		if segment == "" {
+			continue
+		}
+		if segment == "." || segment == ".." || strings.ContainsAny(segment, "\\\x00") {
+			return fmt.Errorf("invalid metadata location path")
+		}
+		hasSegment = true
+	}
+	if !hasSegment {
+		return fmt.Errorf("metadata location must include a table path")
+	}
+	if !strings.HasPrefix(tablePath, namespace+"/") {
+		return fmt.Errorf("metadata location must be within namespace %s", namespace)
+	}
+	return nil
+}
+
+func parseS3Location(location string) (bucket, tablePath string, err error) {
+	if !strings.HasPrefix(location, "s3://") {
+		return "", "", fmt.Errorf("unsupported location: %s", location)
+	}
+	trimmed := strings.TrimPrefix(location, "s3://")
+	trimmed = strings.TrimSuffix(trimmed, "/")
+	if trimmed == "" {
+		return "", "", fmt.Errorf("invalid location: %s", location)
+	}
+	parts := strings.SplitN(trimmed, "/", 2)
+	bucket = parts[0]
+	if bucket == "" {
+		return "", "", fmt.Errorf("invalid location bucket: %s", location)
+	}
+	if len(parts) == 2 {
+		tablePath = parts[1]
+	}
+	return bucket, tablePath, nil
+}
+
 // GetTableObjectRootDir returns the root path for table bucket object storage
 func GetTableObjectRootDir() string {
 	return path.Join(TablesPath, tableObjectRootDirName)
@@ -134,6 +200,7 @@ type tableBucketMetadata struct {
 	Name           string    `json:"name"`
 	CreatedAt      time.Time `json:"createdAt"`
 	OwnerAccountID string    `json:"ownerAccountId"`
+	Format         string    `json:"format,omitempty"`
 }
 
 // namespaceMetadata stores metadata for a namespace
@@ -167,10 +234,10 @@ func IsTableBucketEntry(entry *filer_pb.Entry) bool {
 	return ok
 }
 
-// entryType returns the entry-type marker for a catalog entry. Tables and views
+// EntryType returns the entry-type marker for a catalog entry. Tables and views
 // share the same on-disk layout; the marker distinguishes them. An absent marker
 // means table for back-compat.
-func entryType(extended map[string][]byte) string {
+func EntryType(extended map[string][]byte) string {
 	if extended == nil {
 		return EntryTypeTable
 	}
@@ -278,22 +345,53 @@ func BuildTableARN(region, accountID, bucketName, namespace, tableName string) (
 }
 
 func buildARN(region, accountID, resourcePath string) string {
-	return fmt.Sprintf("arn:aws:s3tables:%s:%s:%s", region, accountID, resourcePath)
+	return fmt.Sprintf("arn:%s:s3tables:%s:%s:%s", arnPartitionForRegion(region), region, accountID, resourcePath)
+}
+
+// arnPartitionForRegion returns the ARN partition a region belongs to, so an
+// ARN this handler emits round-trips through a client in that partition.
+func arnPartitionForRegion(region string) string {
+	switch {
+	case strings.HasPrefix(region, "cn-"):
+		return "aws-cn"
+	case strings.HasPrefix(region, "us-gov-"):
+		return "aws-us-gov"
+	case strings.HasPrefix(region, "us-iso-"):
+		return "aws-iso"
+	case strings.HasPrefix(region, "us-isob-"):
+		return "aws-iso-b"
+	case strings.HasPrefix(region, "eu-isoe-"):
+		return "aws-iso-e"
+	case strings.HasPrefix(region, "us-isof-"):
+		return "aws-iso-f"
+	case strings.HasPrefix(region, "eusc-"):
+		return "aws-eusc"
+	default:
+		return "aws"
+	}
 }
 
 // ValidateTags validates tags for S3 Tables.
 func ValidateTags(tags map[string]string) error {
-	if len(tags) > 10 {
-		return fmt.Errorf("validate tags: %d tags more than 10", len(tags))
+	return ValidateTagsWithLimit(tags, 10)
+}
+
+// ValidateTagsWithLimit validates a tag set that may hold up to maxTags tags.
+func ValidateTagsWithLimit(tags map[string]string, maxTags int) error {
+	if len(tags) > maxTags {
+		return fmt.Errorf("validate tags: %d tags more than %d", len(tags), maxTags)
 	}
 	for k, v := range tags {
-		if len(k) > 128 {
+		if len(k) == 0 {
+			return fmt.Errorf("validate tags: empty tag key")
+		}
+		if utf8.RuneCountInString(k) > 128 {
 			return fmt.Errorf("validate tags: tag key longer than 128")
 		}
 		if !tagPattern.MatchString(k) {
 			return fmt.Errorf("validate tags key %s error, incorrect key", k)
 		}
-		if len(v) > 256 {
+		if utf8.RuneCountInString(v) > 256 {
 			return fmt.Errorf("validate tags: tag value longer than 256")
 		}
 		if !tagPattern.MatchString(v) {
diff --git a/weed/s3api/s3tables/utils_location_test.go b/weed/s3api/s3tables/utils_location_test.go
new file mode 100644
index 0000000000..756808a796
--- /dev/null
+++ b/weed/s3api/s3tables/utils_location_test.go
@@ -0,0 +1,40 @@
+package s3tables
+
+import "testing"
+
+func TestValidateMetadataLocation(t *testing.T) {
+	tests := []struct {
+		name      string
+		loc       string
+		bucket    string
+		namespace string
+		wantErr   bool
+	}{
+		{"empty allowed", "", "bkt", "ns", false},
+		{"own namespace", "s3://bkt/ns/t/metadata/v1.metadata.json", "bkt", "ns", false},
+		{"own namespace arbitrary layout", "s3://bkt/ns/warehouse/t/metadata/v1.metadata.json", "bkt", "ns", false},
+		{"cross bucket rejected", "s3://other/ns/t/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"cross namespace rejected", "s3://bkt/nsa/t/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"cross namespace data dir rejected", "s3://bkt/nsa/vtab/data/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"namespace prefix rejected", "s3://bkt/nsa/vtab/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"outside namespace tree rejected", "s3://bkt/shared/t/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"namespace dir without table path rejected", "s3://bkt/ns", "bkt", "ns", true},
+		{"bucket only rejected", "s3://bkt", "bkt", "ns", true},
+		{"bucket with trailing slash rejected", "s3://bkt/", "bkt", "ns", true},
+		{"slash-only path rejected", "s3://bkt///", "bkt", "ns", true},
+		{"dotdot in path rejected", "s3://bkt/../victim/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"dotdot mid path rejected", "s3://bkt/ns/../../victim/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"dot segment rejected", "s3://bkt/ns/./t/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"backslash segment rejected", "s3://bkt/ns/\\t/metadata/v1.metadata.json", "bkt", "ns", true},
+		{"non-s3 scheme rejected", "file:///bkt/ns/t", "bkt", "ns", true},
+		{"empty location string", "s3://", "bkt", "ns", true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateMetadataLocation(tt.loc, tt.bucket, tt.namespace)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("ValidateMetadataLocation(%q, %q, %q) err = %v, wantErr = %v", tt.loc, tt.bucket, tt.namespace, err, tt.wantErr)
+			}
+		})
+	}
+}
diff --git a/weed/s3api/stats.go b/weed/s3api/stats.go
index 5bd6b89d6b..95d20b703e 100644
--- a/weed/s3api/stats.go
+++ b/weed/s3api/stats.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/util/version"
 
+	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 	stats_collect "github.com/seaweedfs/seaweedfs/weed/stats"
@@ -31,10 +32,19 @@ func track(f http.HandlerFunc, action string) http.HandlerFunc {
 		r = s3_constants.EnsureIdentityHolder(r)
 		start := time.Now()
 		f(recorder, r)
+		elapsed := time.Since(start)
+		if glog.V(2) {
+			requester := s3_constants.GetIdentityNameFromContext(r)
+			if requester == "" {
+				requester = "-"
+			}
+			// %q keeps requester- and key-supplied bytes (e.g. newlines) on one line
+			glog.Infof("%q %s %q %d %s", requester, r.Method, r.URL.Path, recorder.Status, elapsed)
+		}
 		if recorder.Status == http.StatusForbidden {
 			bucket = ""
 		}
-		stats_collect.S3RequestHistogram.WithLabelValues(action, bucket).Observe(time.Since(start).Seconds())
+		stats_collect.S3RequestHistogram.WithLabelValues(action, bucket).Observe(elapsed.Seconds())
 		stats_collect.S3RequestCounter.WithLabelValues(action, strconv.Itoa(recorder.Status), bucket).Inc()
 		stats_collect.RecordBucketActiveTime(bucket)
 		if !s3err.AuditAlreadyLogged(r) {
diff --git a/weed/s3api/table_bucket_verify_object_test.go b/weed/s3api/table_bucket_verify_object_test.go
new file mode 100644
index 0000000000..789d51f377
--- /dev/null
+++ b/weed/s3api/table_bucket_verify_object_test.go
@@ -0,0 +1,163 @@
+package s3api
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+)
+
+const verifyTestBucket = "tables"
+
+// verifyTestNow is the server clock the tests pin; keys are dated around it.
+const verifyTestNow = 1790000000000
+
+func newVerifyTestServer(t *testing.T) *S3ApiServer {
+	t.Helper()
+	saved := volumeVerifyNow
+	volumeVerifyNow = func() time.Time { return time.UnixMilli(verifyTestNow) }
+	savedLookup := volumeVerifyLookup
+	volumeVerifyLookup = func(*S3ApiServer, string, string) (*filer_pb.Entry, error) { return nil, filer_pb.ErrNotFound }
+	t.Cleanup(func() { volumeVerifyNow, volumeVerifyLookup = saved, savedLookup })
+	s3a := &S3ApiServer{option: &S3ApiServerOption{BucketsPath: "/buckets"}}
+	s3a.bucketRegistry = NewBucketRegistry(s3a)
+	s3a.bucketRegistry.setMetadataCache(&BucketMetaData{Name: verifyTestBucket, IsTableBucket: true})
+	s3a.bucketRegistry.setMetadataCache(&BucketMetaData{Name: "plain", IsTableBucket: false})
+	return s3a
+}
+
+func TestTableBucketAcceptsExternalVolumeVerifyKey(t *testing.T) {
+	s3a := newVerifyTestServer(t)
+	for _, key := range []string{
+		"verify_1790000000000_1081846483",
+		"/verify_1790000000000_1",
+		"verify_1790003300000_42", // 55 minutes later: inside the window
+		"verify_1789996700000_42", // 55 minutes earlier
+		// reads and deletes take a key of any date (PUT limits it)
+		"verify_1789992000000_1",
+		"verify_1790008000000_1",
+	} {
+		isVerify, err := s3a.validateTableBucketObjectPathOrVerify(verifyTestBucket, key)
+		assert.True(t, isVerify, key)
+		assert.NoError(t, err, key)
+		// the handlers that keep the plain rule still refuse it
+		assert.Error(t, s3a.validateTableBucketObjectPath(verifyTestBucket, key), key)
+	}
+	// the Iceberg layout is unchanged: the positive control
+	isVerify, err := s3a.validateTableBucketObjectPathOrVerify(verifyTestBucket, "ns/t/data/part-00000.parquet")
+	assert.False(t, isVerify)
+	assert.NoError(t, err)
+}
+
+func TestTableBucketRefusesVerifyKeyLookalikes(t *testing.T) {
+	s3a := newVerifyTestServer(t)
+	for _, key := range []string{
+		// the bucket root only
+		"base/verify_1790000000000_1",
+		"ns/verify_1790000000000_1",
+		".uploads/verify_1790000000000_1",
+		".uploads/abc/verify_1790000000000_1",
+		// the exact shape only
+		"verify_1790000000000_1.txt",
+		"verify_1790000000000",
+		"verify_179000000000_1",            // 12-digit timestamp
+		"verify_1790000000000_12345678901", // 11-digit number
+		"verify_abc_123",
+		"verify_1790000000000_1/x",
+		"xverify_1790000000000_1",
+		// ordinary non-Iceberg keys
+		"notes.txt",
+		"ns/t/data/notes.txt",
+	} {
+		isVerify, err := s3a.validateTableBucketObjectPathOrVerify(verifyTestBucket, key)
+		assert.False(t, isVerify, key)
+		assert.Error(t, err, key)
+	}
+	// a bucket that is not a table bucket is unaffected
+	isVerify, err := s3a.validateTableBucketObjectPathOrVerify("plain", "verify_1790000000000_1")
+	assert.False(t, isVerify)
+	assert.NoError(t, err)
+}
+
+func verifyPutRequest(key string) *http.Request {
+	req := httptest.NewRequest(http.MethodPut, "/"+verifyTestBucket+"/"+key, strings.NewReader("x"))
+	return mux.SetURLVars(req, map[string]string{"bucket": verifyTestBucket, "object": key})
+}
+
+// A PUT to the verification key cannot store data: a small declared body and
+// nothing stored beside it.
+func TestTableBucketVerifyKeyPutLimits(t *testing.T) {
+	s3a := newVerifyTestServer(t)
+	const key = "verify_1790000000000_1081846483"
+	for name, mutate := range map[string]func(*http.Request){
+		"too large":                    func(r *http.Request) { r.ContentLength = volumeVerifyMaxBytes + 1 },
+		"content-language":             func(r *http.Request) { r.ContentLength = 0; r.Header.Set("Content-Language", "fr") },
+		"content-encoding":             func(r *http.Request) { r.ContentLength = 0; r.Header.Set("Content-Encoding", "gzip") },
+		"response-content-disposition": func(r *http.Request) { r.ContentLength = 0; r.Header.Set("Response-Content-Disposition", "attachment") },
+		"extract query":                func(r *http.Request) { r.ContentLength = 0; r.URL.RawQuery = "extract=zip" },
+		"extract header":               func(r *http.Request) { r.ContentLength = 0; r.Header.Set(s3_constants.SeaweedFSExtract, "zip") },
+		"undeclared length":            func(r *http.Request) { r.ContentLength = -1 },
+		"chunked":                      func(r *http.Request) { r.ContentLength = 0; r.TransferEncoding = []string{"chunked"} },
+		"user metadata":                func(r *http.Request) { r.ContentLength = 0; r.Header.Set("X-Amz-Meta-Note", "x") },
+		"tagging":                      func(r *http.Request) { r.ContentLength = 0; r.Header.Set("X-Amz-Tagging", "a=b") },
+		"content-disposition":          func(r *http.Request) { r.ContentLength = 0; r.Header.Set("Content-Disposition", "attachment") },
+		"website redirect":             func(r *http.Request) { r.ContentLength = 0; r.Header.Set("X-Amz-Website-Redirect-Location", "/x") },
+	} {
+		req := verifyPutRequest(key)
+		mutate(req)
+		assert.False(t, volumeVerifyPutAllowed(req, key), name)
+		rec := httptest.NewRecorder()
+		s3a.PutObjectHandler(rec, req)
+		assert.Equal(t, http.StatusForbidden, rec.Code, name)
+	}
+	ok := verifyPutRequest(key)
+	ok.ContentLength = 21
+	ok.Header.Set("Content-Type", "application/octet-stream")
+	ok.Header.Set("Content-Encoding", "aws-chunked")
+	assert.True(t, volumeVerifyPutAllowed(ok, key), "the verification object itself")
+
+	// a PUT is dated within the window of the server's clock
+	for _, old := range []string{"verify_1789992000000_1", "verify_1790008000000_1"} {
+		req := verifyPutRequest(old)
+		req.ContentLength = 21
+		assert.False(t, volumeVerifyPutAllowed(req, old), old)
+		rec := httptest.NewRecorder()
+		s3a.PutObjectHandler(rec, req)
+		assert.Equal(t, http.StatusForbidden, rec.Code, old)
+	}
+}
+
+// A namespace may carry a name of the key's shape; the key then names its
+// directory and gets the plain layout rule, as does a key whose entry cannot
+// be read.
+func TestTableBucketVerifyKeyNamingDirectoryIsRefused(t *testing.T) {
+	s3a := newVerifyTestServer(t)
+	const key = "verify_1790000000000_7"
+	for name, lookup := range map[string]func(*S3ApiServer, string, string) (*filer_pb.Entry, error){
+		"namespace directory": func(*S3ApiServer, string, string) (*filer_pb.Entry, error) {
+			return &filer_pb.Entry{Name: key, IsDirectory: true}, nil
+		},
+		"lookup failure": func(*S3ApiServer, string, string) (*filer_pb.Entry, error) {
+			return nil, errors.New("filer unavailable")
+		},
+	} {
+		volumeVerifyLookup = lookup
+		isVerify, err := s3a.validateTableBucketObjectPathOrVerify(verifyTestBucket, key)
+		assert.False(t, isVerify, name)
+		assert.Error(t, err, name)
+	}
+	// the control: an existing verification object is a file
+	volumeVerifyLookup = func(*S3ApiServer, string, string) (*filer_pb.Entry, error) {
+		return &filer_pb.Entry{Name: key}, nil
+	}
+	isVerify, err := s3a.validateTableBucketObjectPathOrVerify(verifyTestBucket, key)
+	assert.True(t, isVerify)
+	assert.NoError(t, err)
+}
diff --git a/weed/s3api/tags.go b/weed/s3api/tags.go
index 7b1654529d..49cde79f59 100644
--- a/weed/s3api/tags.go
+++ b/weed/s3api/tags.go
@@ -53,11 +53,19 @@ func FromTags(tags map[string]string) (t *Tagging) {
 func parseTagsHeader(tags string) (map[string]string, error) {
 	parsedTags := make(map[string]string)
 	for _, v := range util.StringSplit(tags, "&") {
+		// url.ParseQuery skips empty segments too, so a copy stores the
+		// same tag keys that PutObject and bucket policies see.
+		if v == "" {
+			continue
+		}
 		key, value, hasValue := strings.Cut(v, "=")
 		decodedKey, err := url.QueryUnescape(key)
 		if err != nil {
 			return nil, fmt.Errorf("failed to decode tag key '%s': %w", key, err)
 		}
+		if _, exists := parsedTags[decodedKey]; exists {
+			return nil, fmt.Errorf("duplicate tag key '%s'", decodedKey)
+		}
 		if !hasValue {
 			parsedTags[decodedKey] = ""
 			continue
@@ -74,3 +82,11 @@ func parseTagsHeader(tags string) (map[string]string, error) {
 func ValidateTags(tags map[string]string) error {
 	return s3tables.ValidateTags(tags)
 }
+
+// maxBucketTags is how many tags a bucket's tag set can hold; an object's
+// tag set holds 10.
+const maxBucketTags = 50
+
+func ValidateBucketTags(tags map[string]string) error {
+	return s3tables.ValidateTagsWithLimit(tags, maxBucketTags)
+}
diff --git a/weed/s3api/tags_test.go b/weed/s3api/tags_test.go
index 2002d65f28..f313806ae5 100644
--- a/weed/s3api/tags_test.go
+++ b/weed/s3api/tags_test.go
@@ -1,6 +1,7 @@
 package s3api
 
 import (
+	"strings"
 	"testing"
 )
 
@@ -62,6 +63,18 @@ func TestParseTagsHeader(t *testing.T) {
 			expected:    nil,
 			expectError: true,
 		},
+		{
+			name:        "duplicate key",
+			input:       "key1=value1&key1=value2",
+			expected:    nil,
+			expectError: true,
+		},
+		{
+			name:        "encoded duplicate key",
+			input:       "key1=value1&%6bey1=value2",
+			expected:    nil,
+			expectError: true,
+		},
 		{
 			name:  "plus signs and equals in values",
 			input: "formula=a%2Bb%3Dc&normal=test",
@@ -71,6 +84,15 @@ func TestParseTagsHeader(t *testing.T) {
 			},
 			expectError: false,
 		},
+		{
+			name:  "empty segments add no tag",
+			input: "&key1=value1&&key2=value2&",
+			expected: map[string]string{
+				"key1": "value1",
+				"key2": "value2",
+			},
+			expectError: false,
+		},
 		{
 			name:  "unescaped equals in value",
 			input: "token=part1=part2&normal=test",
@@ -111,3 +133,19 @@ func TestParseTagsHeader(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateTagsUnicodeLength(t *testing.T) {
+	// S3 counts tag length in characters, not bytes
+	multibyteKey := strings.Repeat("中", 128)
+	multibyteValue := strings.Repeat("中", 256)
+
+	if err := ValidateTags(map[string]string{multibyteKey: multibyteValue}); err != nil {
+		t.Errorf("Expected 128-char key and 256-char value to pass, got %v", err)
+	}
+	if err := ValidateTags(map[string]string{strings.Repeat("中", 129): "v"}); err == nil {
+		t.Error("Expected 129-char key to fail")
+	}
+	if err := ValidateTags(map[string]string{"k": strings.Repeat("中", 257)}); err == nil {
+		t.Error("Expected 257-char value to fail")
+	}
+}
diff --git a/weed/security/grpc_peer.go b/weed/security/grpc_peer.go
new file mode 100644
index 0000000000..a6b1fba95e
--- /dev/null
+++ b/weed/security/grpc_peer.go
@@ -0,0 +1,113 @@
+package security
+
+import (
+	"context"
+	"net"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+)
+
+// CheckGrpcAdminPeer authenticates the peer of an admin-plane gRPC handler:
+// a client certificate verified by the server's TLS config, or a Bearer token
+// signed by signingKey (jwt.filer_signing.key). With no key configured remote
+// callers cannot be told apart, so only local clients (unix socket, loopback,
+// or an address assigned to this host) are allowed.
+func CheckGrpcAdminPeer(ctx context.Context, signingKey SigningKey) error {
+	if isMtlsVerifiedPeer(ctx) {
+		return nil
+	}
+	if len(signingKey) == 0 {
+		return CheckLocalGrpcPeer(ctx)
+	}
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return status.Error(codes.Unauthenticated, "missing metadata")
+	}
+	authHeaders := md.Get("authorization")
+	if len(authHeaders) == 0 {
+		return status.Error(codes.Unauthenticated, "missing authorization metadata")
+	}
+	raw := strings.TrimSpace(authHeaders[0])
+	parts := strings.Fields(raw)
+	if len(parts) != 2 || !strings.EqualFold(parts[0], "Bearer") || parts[1] == "" {
+		return status.Error(codes.Unauthenticated, "authorization header must use Bearer scheme")
+	}
+	parsed, err := DecodeJwt(signingKey, EncodedJwt(parts[1]), &SeaweedFilerAdminClaims{})
+	if err != nil || parsed == nil || !parsed.Valid {
+		return status.Error(codes.Unauthenticated, "invalid admin token")
+	}
+	if claims, ok := parsed.Claims.(*SeaweedFilerAdminClaims); !ok || claims.SessionId != "" {
+		return status.Error(codes.Unauthenticated, "invalid admin token")
+	}
+	return nil
+}
+
+// GrpcAdminPeerCredentials returns outgoing metadata carrying a Bearer token
+// for admin-plane gRPC handlers, or nil when no signing key is configured.
+func GrpcAdminPeerCredentials(signingKey SigningKey, expiresAfterSec int) metadata.MD {
+	token := GenJwtForFilerAdmin(signingKey, expiresAfterSec)
+	if token == "" {
+		return nil
+	}
+	return metadata.Pairs("authorization", "Bearer "+string(token))
+}
+
+func isMtlsVerifiedPeer(ctx context.Context) bool {
+	pr, ok := peer.FromContext(ctx)
+	if !ok {
+		return false
+	}
+	tlsInfo, ok := pr.AuthInfo.(credentials.TLSInfo)
+	return ok && len(tlsInfo.State.VerifiedChains) > 0
+}
+
+// CheckLocalGrpcPeer admits only clients on this host: unix sockets, loopback,
+// or an address assigned to a local interface.
+func CheckLocalGrpcPeer(ctx context.Context) error {
+	if ctx == nil {
+		return status.Error(codes.Unauthenticated, "admin gRPC calls require jwt.filer_signing.key or a local client")
+	}
+	pr, ok := peer.FromContext(ctx)
+	if !ok {
+		return status.Error(codes.Unauthenticated, "admin gRPC calls require jwt.filer_signing.key or a local client")
+	}
+	if _, isUnix := pr.Addr.(*net.UnixAddr); isUnix {
+		return nil
+	}
+	var ip net.IP
+	if tcpAddr, ok := pr.Addr.(*net.TCPAddr); ok {
+		ip = tcpAddr.IP
+	} else if h, _, err := net.SplitHostPort(pr.Addr.String()); err == nil {
+		ip = net.ParseIP(h)
+	} else {
+		ip = net.ParseIP(pr.Addr.String())
+	}
+	if ip != nil && (ip.IsLoopback() || isLocalAddress(ip)) {
+		return nil
+	}
+	glog.V(1).Infof("rejected unauthenticated admin gRPC call from %s: no jwt.filer_signing.key configured", pr.Addr)
+	return status.Error(codes.Unauthenticated, "admin gRPC calls require jwt.filer_signing.key or a local client")
+}
+
+// isLocalAddress enumerates interfaces per call: only reachable for
+// non-loopback TCP peers on the no-key admin path, which is low-volume —
+// and a cached set would keep trusting an address after it is removed from
+// the host and reassigned.
+func isLocalAddress(ip net.IP) bool {
+	addrs, err := net.InterfaceAddrs()
+	if err != nil {
+		return false
+	}
+	for _, a := range addrs {
+		if ipNet, ok := a.(*net.IPNet); ok && ipNet.IP.Equal(ip) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/weed/security/grpc_peer_test.go b/weed/security/grpc_peer_test.go
new file mode 100644
index 0000000000..8a6127d072
--- /dev/null
+++ b/weed/security/grpc_peer_test.go
@@ -0,0 +1,68 @@
+package security
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+)
+
+func peerCtx(addr net.Addr) context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{Addr: addr})
+}
+
+func bearerCtx(addr net.Addr, signingKey SigningKey) context.Context {
+	ctx := peerCtx(addr)
+	token := GenJwtForFilerAdmin(signingKey, 0)
+	return metadata.NewIncomingContext(ctx, metadata.Pairs("authorization", "Bearer "+string(token)))
+}
+
+func TestCheckGrpcAdminPeer(t *testing.T) {
+	key := SigningKey("test-signing-key-0123456789abcdef")
+	loopback := &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 5000}
+	remote := &net.TCPAddr{IP: net.ParseIP("203.0.113.9"), Port: 5000}
+
+	for name, tc := range map[string]struct {
+		ctx        context.Context
+		signingKey SigningKey
+		wantCode   codes.Code
+	}{
+		"no peer info, no key":          {context.Background(), nil, codes.Unauthenticated},
+		"loopback, no key":             {peerCtx(loopback), nil, codes.OK},
+		"remote, no key":               {peerCtx(remote), nil, codes.Unauthenticated},
+		"remote + valid token":         {bearerCtx(remote, key), key, codes.OK},
+		"remote + no metadata, key set": {peerCtx(remote), key, codes.Unauthenticated},
+		"remote + bad token":           {metadata.NewIncomingContext(peerCtx(remote), metadata.Pairs("authorization", "Bearer wrong")), key, codes.Unauthenticated},
+		"unix socket, no key":          {peerCtx(&net.UnixAddr{Name: "/tmp/s.sock"}), nil, codes.OK},
+		"mtls verified peer": {peer.NewContext(context.Background(), &peer.Peer{
+			Addr:     remote,
+			AuthInfo: credentials.TLSInfo{State: tls.ConnectionState{VerifiedChains: [][]*x509.Certificate{{}}}},
+		}), nil, codes.OK},
+	} {
+		err := CheckGrpcAdminPeer(tc.ctx, tc.signingKey)
+		got := codes.OK
+		if err != nil {
+			got = status.Code(err)
+		}
+		if got != tc.wantCode {
+			t.Errorf("%s: got %v want %v (err=%v)", name, got, tc.wantCode, err)
+		}
+	}
+}
+
+func TestGrpcAdminPeerCredentials(t *testing.T) {
+	if md := GrpcAdminPeerCredentials(nil, 0); len(md) != 0 {
+		t.Errorf("expected nil metadata without signing key, got %v", md)
+	}
+	md := GrpcAdminPeerCredentials(SigningKey("key"), 60)
+	if len(md.Get("authorization")) != 1 {
+		t.Fatalf("expected one authorization entry, got %v", md)
+	}
+}
diff --git a/weed/security/jwt.go b/weed/security/jwt.go
index 22fbacf54e..30b02db3e1 100644
--- a/weed/security/jwt.go
+++ b/weed/security/jwt.go
@@ -8,6 +8,8 @@ import (
 
 	jwt "github.com/golang-jwt/jwt/v5"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/spf13/viper"
 )
 
 type EncodedJwt string
@@ -31,6 +33,9 @@ type SeaweedFileIdClaims struct {
 type SeaweedFilerClaims struct {
 	AllowedPrefixes []string `json:"allowed_prefixes,omitempty"`
 	AllowedMethods  []string `json:"allowed_methods,omitempty"`
+	// SessionId is present only on STS session tokens; a token carrying it is
+	// an S3 session credential, not a filer API credential.
+	SessionId string `json:"sid,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -44,6 +49,9 @@ type SeaweedFilerClaims struct {
 // RegisteredClaims. Extra JSON fields in the payload are silently ignored by
 // encoding/json, which is the desired behaviour here (forward-compat).
 type SeaweedFilerAdminClaims struct {
+	// SessionId is present only on STS session tokens; a token carrying it is
+	// an S3 session credential, not a filer admin credential.
+	SessionId string `json:"sid,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -145,3 +153,57 @@ func DecodeJwt(signingKey SigningKey, tokenString EncodedJwt, claims jwt.Claims)
 		return []byte(signingKey), nil
 	})
 }
+
+// FilerJwtProvider signs the credential a filer's HTTP API expects. A nil
+// provider means the process-wide jwt.filer_signing configuration applies.
+type FilerJwtProvider func(isWrite bool) EncodedJwt
+
+// LoadFilerJwtFromFile reads jwt.filer_signing from a security file the way
+// LoadClientTLSFromFile reads the TLS section, honoring the same WEED_
+// environment precedence. A nil provider means the file configures no filer
+// signing keys and the process-wide configuration applies. A file that sets
+// only one access level falls back to the process-wide key for the other.
+func LoadFilerJwtFromFile(configFile string) (FilerJwtProvider, error) {
+	v := viper.New()
+	v.SetConfigFile(configFile)
+	v.AutomaticEnv()
+	v.SetEnvPrefix("weed")
+	v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	if err := v.ReadInConfig(); err != nil {
+		return nil, fmt.Errorf("failed to read security config %s: %v", configFile, err)
+	}
+
+	signingKey := SigningKey(v.GetString("jwt.filer_signing.key"))
+	readSigningKey := SigningKey(v.GetString("jwt.filer_signing.read.key"))
+	if len(signingKey) == 0 && len(readSigningKey) == 0 {
+		return nil, nil
+	}
+	signingKeyExpires := v.GetInt("jwt.filer_signing.expires_after_seconds")
+	readSigningKeyExpires := v.GetInt("jwt.filer_signing.read.expires_after_seconds")
+	if len(signingKey) == 0 || len(readSigningKey) == 0 {
+		gv := util.GetViper()
+		if len(signingKey) == 0 {
+			signingKey = SigningKey(gv.GetString("jwt.filer_signing.key"))
+			signingKeyExpires = gv.GetInt("jwt.filer_signing.expires_after_seconds")
+		}
+		if len(readSigningKey) == 0 {
+			readSigningKey = SigningKey(gv.GetString("jwt.filer_signing.read.key"))
+			readSigningKeyExpires = gv.GetInt("jwt.filer_signing.read.expires_after_seconds")
+		}
+	}
+	if signingKeyExpires < 0 || readSigningKeyExpires < 0 {
+		return nil, fmt.Errorf("jwt.filer_signing lifetimes must not be negative")
+	}
+	if signingKeyExpires == 0 {
+		signingKeyExpires = 10
+	}
+	if readSigningKeyExpires == 0 {
+		readSigningKeyExpires = 60
+	}
+	return func(isWrite bool) EncodedJwt {
+		if isWrite {
+			return GenJwtForFilerServer(signingKey, signingKeyExpires)
+		}
+		return GenJwtForFilerServer(readSigningKey, readSigningKeyExpires)
+	}, nil
+}
diff --git a/weed/security/jwt_filer_provider_test.go b/weed/security/jwt_filer_provider_test.go
new file mode 100644
index 0000000000..8a4a6067b5
--- /dev/null
+++ b/weed/security/jwt_filer_provider_test.go
@@ -0,0 +1,146 @@
+package security
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestLoadFilerJwtFromFile(t *testing.T) {
+	configFile := filepath.Join(t.TempDir(), "security.toml")
+	config := `
+[jwt]
+[jwt.filer_signing]
+key = "side-write-key"
+expires_after_seconds = 30
+[jwt.filer_signing.read]
+key = "side-read-key"
+expires_after_seconds = 90
+`
+	if err := os.WriteFile(configFile, []byte(config), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	provider, err := LoadFilerJwtFromFile(configFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if provider == nil {
+		t.Fatal("config with filer signing keys gave a nil provider")
+	}
+
+	for _, tc := range []struct {
+		name     string
+		isWrite  bool
+		signedBy string
+		otherKey string
+		expires  int64
+	}{
+		{"read", false, "side-read-key", "side-write-key", 90},
+		{"write", true, "side-write-key", "side-read-key", 30},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			before := time.Now()
+			token := provider(tc.isWrite)
+			after := time.Now()
+			claims := &SeaweedFilerClaims{}
+			if _, err := DecodeJwt(SigningKey(tc.signedBy), token, claims); err != nil {
+				t.Fatalf("token does not validate against the %s key: %v", tc.name, err)
+			}
+			if claims.ExpiresAt == nil {
+				t.Fatal("token never expires")
+			}
+			expiresIn := claims.ExpiresAt.Time
+			if expiresIn.Before(before.Add(time.Duration(tc.expires-1)*time.Second)) || expiresIn.After(after.Add(time.Duration(tc.expires+1)*time.Second)) {
+				t.Fatalf("token expires at %v, want %ds after %v", expiresIn, tc.expires, before)
+			}
+			if _, err := DecodeJwt(SigningKey(tc.otherKey), token, &SeaweedFilerClaims{}); err == nil {
+				t.Fatal("token also validates against the other access level's key")
+			}
+		})
+	}
+}
+
+func TestLoadFilerJwtFromFileWithoutKeys(t *testing.T) {
+	configFile := filepath.Join(t.TempDir(), "security.toml")
+	if err := os.WriteFile(configFile, []byte("[grpc.client]\n"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	provider, err := LoadFilerJwtFromFile(configFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if provider != nil {
+		t.Fatal("config without filer signing keys gave a provider")
+	}
+}
+
+func TestLoadFilerJwtFromFileMissing(t *testing.T) {
+	if _, err := LoadFilerJwtFromFile(filepath.Join(t.TempDir(), "none.toml")); err == nil {
+		t.Fatal("missing config file loaded without error")
+	}
+}
+
+func TestLoadFilerJwtFromFilePartialKeys(t *testing.T) {
+	configFile := filepath.Join(t.TempDir(), "security.toml")
+	config := `
+[jwt.filer_signing.read]
+key = "side-read-key"
+`
+	if err := os.WriteFile(configFile, []byte(config), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	gv := util.GetViper()
+	priorKey := gv.GetString("jwt.filer_signing.key")
+	gv.Set("jwt.filer_signing.key", "global-write-key")
+	t.Cleanup(func() { gv.Set("jwt.filer_signing.key", priorKey) })
+
+	provider, err := LoadFilerJwtFromFile(configFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if provider == nil {
+		t.Fatal("config with a filer signing key gave a nil provider")
+	}
+
+	if _, err := DecodeJwt(SigningKey("global-write-key"), provider(true), &SeaweedFilerClaims{}); err != nil {
+		t.Fatalf("write token does not validate against the global write key: %v", err)
+	}
+	if _, err := DecodeJwt(SigningKey("side-read-key"), provider(false), &SeaweedFilerClaims{}); err != nil {
+		t.Fatalf("read token does not validate against the side read key: %v", err)
+	}
+}
+
+func TestLoadFilerJwtFromFileEnvOverride(t *testing.T) {
+	configFile := filepath.Join(t.TempDir(), "security.toml")
+	config := `
+[jwt.filer_signing]
+key = "side-write-key"
+[jwt.filer_signing.read]
+key = "side-read-key"
+`
+	if err := os.WriteFile(configFile, []byte(config), 0644); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("WEED_JWT_FILER_SIGNING_READ_KEY", "env-read-key")
+
+	provider, err := LoadFilerJwtFromFile(configFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if provider == nil {
+		t.Fatal("config with filer signing keys gave a nil provider")
+	}
+
+	if _, err := DecodeJwt(SigningKey("env-read-key"), provider(false), &SeaweedFilerClaims{}); err != nil {
+		t.Fatalf("read token does not validate against the env override key: %v", err)
+	}
+	if _, err := DecodeJwt(SigningKey("side-write-key"), provider(true), &SeaweedFilerClaims{}); err != nil {
+		t.Fatalf("write token does not validate against the side write key: %v", err)
+	}
+}
diff --git a/weed/security/tls.go b/weed/security/tls.go
index 07f5d5cba3..4bdf9e89e2 100644
--- a/weed/security/tls.go
+++ b/weed/security/tls.go
@@ -155,13 +155,13 @@ func LoadClientTLSFromFile(configFile string, component string) (grpc.DialOption
 	}
 	// Resolve relative PEM paths against the config file's directory.
 	configDir := filepath.Dir(configFile)
-	for _, key := range []string{"grpc.ca", component + ".cert", component + ".key"} {
+	for _, key := range []string{"grpc.ca", component + ".cert", component + ".key", component + ".client_cert", component + ".client_key"} {
 		p := v.GetString(key)
 		if p != "" && !filepath.IsAbs(p) {
 			v.Set(key, filepath.Join(configDir, p))
 		}
 	}
-	return LoadClientTLS(&util.ViperProxy{Viper: v}, component), nil
+	return LoadClientTLS(util.NewViperProxy(v), component), nil
 }
 
 func LoadClientTLS(config *util.ViperProxy, component string) grpc.DialOption {
@@ -169,7 +169,15 @@ func LoadClientTLS(config *util.ViperProxy, component string) grpc.DialOption {
 		return grpc.WithTransportCredentials(insecure.NewCredentials())
 	}
 
-	certFileName, keyFileName, caFileName := config.GetString(component+".cert"), config.GetString(component+".key"), config.GetString("grpc.ca")
+	// prefer a dedicated client certificate: CAs may issue certs with only one of the serverAuth/clientAuth EKUs
+	certFileName, keyFileName := config.GetString(component+".client_cert"), config.GetString(component+".client_key")
+	if certFileName == "" || keyFileName == "" {
+		if certFileName != "" || keyFileName != "" {
+			glog.Warningf("%s.client_cert and %s.client_key must both be set, falling back to %s.cert and %s.key", component, component, component, component)
+		}
+		certFileName, keyFileName = config.GetString(component+".cert"), config.GetString(component+".key")
+	}
+	caFileName := config.GetString("grpc.ca")
 	if certFileName == "" || keyFileName == "" || caFileName == "" {
 		return grpc.WithTransportCredentials(insecure.NewCredentials())
 	}
diff --git a/weed/security/tls_client_cert_test.go b/weed/security/tls_client_cert_test.go
new file mode 100644
index 0000000000..7147f2e32d
--- /dev/null
+++ b/weed/security/tls_client_cert_test.go
@@ -0,0 +1,183 @@
+package security
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/spf13/viper"
+
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/health"
+	healthpb "google.golang.org/grpc/health/grpc_health_v1"
+)
+
+type testCA struct {
+	cert *x509.Certificate
+	key  *ecdsa.PrivateKey
+	file string
+}
+
+func newTestCA(t *testing.T, dir string) *testCA {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	template := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "test-ca"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(time.Hour),
+		KeyUsage:              x509.KeyUsageCertSign,
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cert, err := x509.ParseCertificate(der)
+	if err != nil {
+		t.Fatal(err)
+	}
+	file := filepath.Join(dir, "ca.pem")
+	writePem(t, file, "CERTIFICATE", der)
+	return &testCA{cert: cert, key: key, file: file}
+}
+
+// issue creates a leaf certificate restricted to the given extended key usages.
+func (ca *testCA) issue(t *testing.T, dir, name string, ekus []x509.ExtKeyUsage) (certFile, keyFile string) {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(time.Now().UnixNano()),
+		Subject:      pkix.Name{CommonName: name},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		KeyUsage:     x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:  ekus,
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		DNSNames:     []string{"localhost"},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, ca.cert, &key.PublicKey, ca.key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyDer, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	certFile = filepath.Join(dir, name+".pem")
+	keyFile = filepath.Join(dir, name+".key")
+	writePem(t, certFile, "CERTIFICATE", der)
+	writePem(t, keyFile, "EC PRIVATE KEY", keyDer)
+	return certFile, keyFile
+}
+
+func writePem(t *testing.T, file, blockType string, der []byte) {
+	t.Helper()
+	if err := os.WriteFile(file, pem.EncodeToMemory(&pem.Block{Type: blockType, Bytes: der}), 0600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func startTestGrpcServer(t *testing.T, config *util.ViperProxy, component string) string {
+	t.Helper()
+	creds, _ := LoadServerTLS(config, component)
+	if creds == nil {
+		t.Fatal("LoadServerTLS returned nil")
+	}
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := grpc.NewServer(creds)
+	healthpb.RegisterHealthServer(server, health.NewServer())
+	go server.Serve(lis)
+	t.Cleanup(server.Stop)
+	return lis.Addr().String()
+}
+
+func healthCheck(t *testing.T, addr string, dialOption grpc.DialOption) error {
+	t.Helper()
+	conn, err := grpc.NewClient(addr, dialOption)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	_, err = healthpb.NewHealthClient(conn).Check(ctx, &healthpb.HealthCheckRequest{})
+	return err
+}
+
+// A component configured with a serverAuth-only serving cert plus a
+// clientAuth-only client_cert/client_key pair must dial with the client pair.
+func TestLoadClientTLSPrefersClientCert(t *testing.T) {
+	dir := t.TempDir()
+	ca := newTestCA(t, dir)
+	serverCert, serverKey := ca.issue(t, dir, "server", []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
+	clientCert, clientKey := ca.issue(t, dir, "client", []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth})
+
+	v := util.NewViperProxy(viper.New())
+	v.Set("grpc.ca", ca.file)
+	v.Set("grpc.master.cert", serverCert)
+	v.Set("grpc.master.key", serverKey)
+	v.Set("grpc.master.client_cert", clientCert)
+	v.Set("grpc.master.client_key", clientKey)
+
+	addr := startTestGrpcServer(t, v, "grpc.master")
+	if err := healthCheck(t, addr, LoadClientTLS(v, "grpc.master")); err != nil {
+		t.Fatalf("health check with split client cert failed: %v", err)
+	}
+}
+
+// Without client_cert, the component keeps presenting its serving cert.
+func TestLoadClientTLSFallsBackToServingCert(t *testing.T) {
+	dir := t.TempDir()
+	ca := newTestCA(t, dir)
+	dualCert, dualKey := ca.issue(t, dir, "dual", []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth, x509.ExtKeyUsageClientAuth})
+
+	v := util.NewViperProxy(viper.New())
+	v.Set("grpc.ca", ca.file)
+	v.Set("grpc.master.cert", dualCert)
+	v.Set("grpc.master.key", dualKey)
+
+	addr := startTestGrpcServer(t, v, "grpc.master")
+	if err := healthCheck(t, addr, LoadClientTLS(v, "grpc.master")); err != nil {
+		t.Fatalf("health check with dual-EKU cert failed: %v", err)
+	}
+}
+
+// A serverAuth-only cert presented as the client identity fails the peer's
+// clientAuth EKU verification — the failure mode client_cert exists to fix.
+func TestLoadClientTLSServerOnlyEkuRejected(t *testing.T) {
+	dir := t.TempDir()
+	ca := newTestCA(t, dir)
+	serverCert, serverKey := ca.issue(t, dir, "server", []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth})
+
+	v := util.NewViperProxy(viper.New())
+	v.Set("grpc.ca", ca.file)
+	v.Set("grpc.master.cert", serverCert)
+	v.Set("grpc.master.key", serverKey)
+
+	addr := startTestGrpcServer(t, v, "grpc.master")
+	if err := healthCheck(t, addr, LoadClientTLS(v, "grpc.master")); err == nil {
+		t.Fatal("expected handshake failure when presenting a serverAuth-only cert as client identity")
+	}
+}
diff --git a/weed/server/common.go b/weed/server/common.go
index b8058b2a9d..2749b4f3f7 100644
--- a/weed/server/common.go
+++ b/weed/server/common.go
@@ -12,6 +12,8 @@ import (
 	"mime"
 	"mime/multipart"
 	"net/http"
+	"net/url"
+	"path"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -107,7 +109,7 @@ func writeJson(w http.ResponseWriter, r *http.Request, httpStatus int, obj inter
 
 	if httpStatus >= 400 {
 		glog.V(0).Infof("response method:%s URL:%s with httpStatus:%d and JSON:%s",
-			r.Method, r.URL.String(), httpStatus, string(bytes))
+			r.Method, redactedURL(r), httpStatus, string(bytes))
 	}
 
 	w.Header().Set("Content-Type", "application/json")
@@ -117,10 +119,21 @@ func writeJson(w http.ResponseWriter, r *http.Request, httpStatus int, obj inter
 	return
 }
 
+func redactedURL(r *http.Request) string {
+	if _, ok := r.URL.Query()["jwt"]; !ok {
+		return r.URL.String()
+	}
+	u := *r.URL
+	q := u.Query()
+	q.Set("jwt", "[redacted]")
+	u.RawQuery = q.Encode()
+	return u.String()
+}
+
 // wrapper for writeJson - just logs errors
 func writeJsonQuiet(w http.ResponseWriter, r *http.Request, httpStatus int, obj interface{}) {
 	if err := writeJson(w, r, httpStatus, obj); err != nil {
-		glog.V(0).Infof("error writing JSON status %s %d: %v", r.URL, httpStatus, err)
+		glog.V(0).Infof("error writing JSON status %s %d: %v", redactedURL(r), httpStatus, err)
 		glog.V(1).Infof("JSON content: %+v", obj)
 	}
 }
@@ -135,7 +148,7 @@ func debug(params ...interface{}) {
 	glog.V(4).Infoln(params...)
 }
 
-func submitForClientHandler(w http.ResponseWriter, r *http.Request, masterFn operation.GetMasterFn, grpcDialOption grpc.DialOption) {
+func submitForClientHandler(w http.ResponseWriter, r *http.Request, masterFn operation.GetMasterFn, grpcDialOption grpc.DialOption, fileSizeLimitBytes int64) {
 	ctx := r.Context()
 	m := make(map[string]interface{})
 	if r.Method != http.MethodPost {
@@ -146,7 +159,7 @@ func submitForClientHandler(w http.ResponseWriter, r *http.Request, masterFn ope
 	debug("parsing upload file...")
 	bytesBuffer := bufPool.Get().(*bytes.Buffer)
 	defer bufPool.Put(bytesBuffer)
-	pu, pe := needle.ParseUpload(r, 256*1024*1024, bytesBuffer)
+	pu, pe := needle.ParseUpload(r, fileSizeLimitBytes, bytesBuffer)
 	if pe != nil {
 		writeJsonError(w, r, http.StatusBadRequest, pe)
 		return
@@ -286,12 +299,32 @@ func adjustHeaderContentDisposition(w http.ResponseWriter, r *http.Request, file
 	}
 }
 
+// responseBodyTracker records how many bytes have reached the ResponseWriter.
+// Bytes still sitting in the pooled bufio.Writer do not count: the status line
+// is not committed until the buffer flushes.
+type responseBodyTracker struct {
+	http.ResponseWriter
+	written int64
+}
+
+func (t *responseBodyTracker) Write(p []byte) (int, error) {
+	n, err := t.ResponseWriter.Write(p)
+	t.written += int64(n)
+	return n, err
+}
+
 func ProcessRangeRequest(r *http.Request, w http.ResponseWriter, totalSize int64, mimeType string, prepareWriteFn func(offset int64, size int64) (filer.DoStreamContent, error)) error {
 	rangeReq := r.Header.Get("Range")
+	sink := &responseBodyTracker{ResponseWriter: w}
 	bufferedWriter := writePool.Get().(*bufio.Writer)
-	bufferedWriter.Reset(w)
+	bufferedWriter.Reset(sink)
+	discardBuffered := false
 	defer func() {
-		bufferedWriter.Flush()
+		if discardBuffered {
+			bufferedWriter.Reset(io.Discard)
+		} else {
+			bufferedWriter.Flush()
+		}
 		writePool.Put(bufferedWriter)
 	}()
 
@@ -304,6 +337,13 @@ func ProcessRangeRequest(r *http.Request, w http.ResponseWriter, totalSize int64
 		}
 		if err = writeFn(bufferedWriter); err != nil {
 			glog.Errorf("ProcessRangeRequest: %v", err)
+			// Drop the unflushed tail: flushing it would finish a 200 whose
+			// Content-Length is already set, delivering corrupt bytes as a
+			// complete body.
+			discardBuffered = true
+			if sink.written > 0 {
+				panic(http.ErrAbortHandler)
+			}
 			w.Header().Del("Content-Length")
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 			return fmt.Errorf("ProcessRangeRequest: %w", err)
@@ -316,6 +356,9 @@ func ProcessRangeRequest(r *http.Request, w http.ResponseWriter, totalSize int64
 	ranges, err := parseRange(rangeReq, totalSize)
 	if err != nil {
 		glog.Errorf("ProcessRangeRequest headers: %+v err: %v", w.Header(), err)
+		if err == errNoOverlap {
+			w.Header().Set("Content-Range", fmt.Sprintf("bytes */%d", totalSize))
+		}
 		http.Error(w, err.Error(), http.StatusRequestedRangeNotSatisfiable)
 		return fmt.Errorf("ProcessRangeRequest header: %w", err)
 	}
@@ -354,8 +397,10 @@ func ProcessRangeRequest(r *http.Request, w http.ResponseWriter, totalSize int64
 		err = writeFn(bufferedWriter)
 		if err != nil {
 			glog.Errorf("ProcessRangeRequest range[0]: %+v err: %v", w.Header(), err)
-			// Cannot call http.Error() here because WriteHeader was already called
-			return fmt.Errorf("ProcessRangeRequest range[0]: %w", err)
+			// WriteHeader was already called: drop the unflushed tail and
+			// abort so the client does not read corrupt bytes as a full body.
+			discardBuffered = true
+			panic(http.ErrAbortHandler)
 		}
 		return nil
 	}
@@ -407,12 +452,56 @@ func ProcessRangeRequest(r *http.Request, w http.ResponseWriter, totalSize int64
 	w.WriteHeader(http.StatusPartialContent)
 	if _, err := io.CopyN(bufferedWriter, sendContent, sendSize); err != nil {
 		glog.Errorf("ProcessRangeRequest err: %v", err)
-		// Cannot call http.Error() here because WriteHeader was already called
-		return fmt.Errorf("ProcessRangeRequest err: %w", err)
+		// WriteHeader was already called: drop the unflushed tail and abort.
+		discardBuffered = true
+		panic(http.ErrAbortHandler)
 	}
 	return nil
 }
 
+// CleanPathHandler serves a request whose path is not canonical ("//", "." or
+// ".." segments) at the cleaned path instead of letting http.ServeMux redirect
+// to it. ServeMux builds that redirect from the already percent-encoded path, so
+// the Location header is encoded twice (golang/go#79897): a client following it
+// re-sends "/负极全景" as "/%25E8%25B4%259F...", and the filer then stores a
+// directory literally named "%E8%B4%9F...". Cleaning here mirrors the path
+// ServeMux would have redirected to, so the decoded name reaches the handler.
+func CleanPathHandler(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		escaped := r.URL.EscapedPath()
+		if cleaned := cleanPath(escaped); cleaned != escaped {
+			if p, err := url.PathUnescape(cleaned); err == nil {
+				r2 := new(http.Request)
+				*r2 = *r
+				r2.URL = new(url.URL)
+				*r2.URL = *r.URL
+				r2.URL.Path, r2.URL.RawPath = p, cleaned
+				// PostHandler picks storage rules and the bucket from RequestURI, so
+				// keep it in step with the path the entry is written to.
+				r2.RequestURI = r2.URL.RequestURI()
+				r = r2
+			}
+		}
+		h.ServeHTTP(w, r)
+	})
+}
+
+// cleanPath is the canonical form http.ServeMux redirects to: path.Clean plus
+// the trailing slash, which the filer relies on to tell a directory from a file.
+func cleanPath(p string) string {
+	if p == "" {
+		return "/"
+	}
+	if p[0] != '/' {
+		p = "/" + p
+	}
+	np := path.Clean(p)
+	if p[len(p)-1] == '/' && np != "/" {
+		np += "/"
+	}
+	return np
+}
+
 func requestIDMiddleware(h http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		request_id.Middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
diff --git a/weed/server/common_test.go b/weed/server/common_test.go
index 6c65ab1af8..caf960745f 100644
--- a/weed/server/common_test.go
+++ b/weed/server/common_test.go
@@ -2,12 +2,20 @@ package weed_server
 
 import (
 	"bytes"
+	"context"
+	"errors"
 	"io"
 	"mime/multipart"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 )
 
 func TestParseURL(t *testing.T) {
@@ -65,6 +73,105 @@ func TestWriteJsonNoJSONP(t *testing.T) {
 	}
 }
 
+// A POST to a path with a doubled slash must reach the handler at the cleaned,
+// still-decoded path. Without CleanPathHandler, http.ServeMux answers with a
+// redirect whose Location percent-encodes the already-escaped path a second
+// time (golang/go#79897), and a client following it creates directories
+// literally named "%E8%B4%9F..." (seaweedfs#11125).
+//
+// RequestURI must follow the cleaned path as well: PostHandler derives storage
+// rules, bucket and read-only checks from it, so it has to agree with URL.Path.
+// wantRequestURI defaults to wantEscaped.
+func TestCleanPathHandlerServesCleanedPathWithoutRedirect(t *testing.T) {
+	tests := []struct {
+		name           string
+		target         string
+		wantPath       string
+		wantEscaped    string
+		wantRequestURI string
+	}{
+		{
+			name:        "double slash before non-ascii segments",
+			target:      "/Image/2026-09-04//负极全景/OK渲染图/test123_残片正光_拼图_105525641.jpg",
+			wantPath:    "/Image/2026-09-04/负极全景/OK渲染图/test123_残片正光_拼图_105525641.jpg",
+			wantEscaped: "/Image/2026-09-04/%E8%B4%9F%E6%9E%81%E5%85%A8%E6%99%AF/OK%E6%B8%B2%E6%9F%93%E5%9B%BE/test123_%E6%AE%8B%E7%89%87%E6%AD%A3%E5%85%89_%E6%8B%BC%E5%9B%BE_105525641.jpg",
+		},
+		{
+			name:        "already percent-encoded by the client",
+			target:      "/Image//%E8%B4%9F%E6%9E%81%E5%85%A8%E6%99%AF/a.jpg",
+			wantPath:    "/Image/负极全景/a.jpg",
+			wantEscaped: "/Image/%E8%B4%9F%E6%9E%81%E5%85%A8%E6%99%AF/a.jpg",
+		},
+		{
+			name:        "trailing slash marks a directory and is kept",
+			target:      "/Image//负极全景/",
+			wantPath:    "/Image/负极全景/",
+			wantEscaped: "/Image/%E8%B4%9F%E6%9E%81%E5%85%A8%E6%99%AF/",
+		},
+		{
+			name:        "dot segments are resolved",
+			target:      "/Image/./tmp/../负极全景/a.jpg",
+			wantPath:    "/Image/负极全景/a.jpg",
+			wantEscaped: "/Image/%E8%B4%9F%E6%9E%81%E5%85%A8%E6%99%AF/a.jpg",
+		},
+		{
+			name:           "dot segments crossing a bucket move RequestURI to the written bucket, query kept",
+			target:         "/buckets/a/../b/f.jpg?collection=c&ttl=1d",
+			wantPath:       "/buckets/b/f.jpg",
+			wantEscaped:    "/buckets/b/f.jpg",
+			wantRequestURI: "/buckets/b/f.jpg?collection=c&ttl=1d",
+		},
+		{
+			name:           "canonical path is passed through untouched",
+			target:         "/Image/负极全景/a.jpg",
+			wantPath:       "/Image/负极全景/a.jpg",
+			wantEscaped:    "/Image/%E8%B4%9F%E6%9E%81%E5%85%A8%E6%99%AF/a.jpg",
+			wantRequestURI: "/Image/负极全景/a.jpg",
+		},
+		{
+			name:        "encoded slash is not a separator and is preserved",
+			target:      "/Image//a%2F%2Fb/c.jpg",
+			wantPath:    "/Image/a//b/c.jpg",
+			wantEscaped: "/Image/a%2F%2Fb/c.jpg",
+		},
+		{
+			name:        "root",
+			target:      "//",
+			wantPath:    "/",
+			wantEscaped: "/",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			var gotPath, gotEscaped, gotRequestURI string
+			mux := http.NewServeMux()
+			mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+				gotPath, gotEscaped, gotRequestURI = r.URL.Path, r.URL.EscapedPath(), r.RequestURI
+			})
+
+			w := httptest.NewRecorder()
+			CleanPathHandler(mux).ServeHTTP(w, httptest.NewRequest(http.MethodPost, tc.target, strings.NewReader("data")))
+
+			if w.Code != http.StatusOK {
+				t.Fatalf("status: got %d (Location %q), want 200 with no redirect", w.Code, w.Header().Get("Location"))
+			}
+			if gotPath != tc.wantPath {
+				t.Errorf("r.URL.Path: got %q want %q", gotPath, tc.wantPath)
+			}
+			if gotEscaped != tc.wantEscaped {
+				t.Errorf("r.URL.EscapedPath(): got %q want %q", gotEscaped, tc.wantEscaped)
+			}
+			wantRequestURI := tc.wantRequestURI
+			if wantRequestURI == "" {
+				wantRequestURI = tc.wantEscaped
+			}
+			if gotRequestURI != wantRequestURI {
+				t.Errorf("r.RequestURI: got %q want %q", gotRequestURI, wantRequestURI)
+			}
+		})
+	}
+}
+
 func TestWriteJsonPrettyDoesNotReadMultipartBody(t *testing.T) {
 	var form bytes.Buffer
 	mw := multipart.NewWriter(&form)
@@ -112,3 +219,199 @@ func (c *countingReadCloser) Read(p []byte) (int, error) {
 func (c *countingReadCloser) Close() error {
 	return nil
 }
+
+// A write error after the body has flushed must not complete as 200 with the
+// full Content-Length: the unflushed tail is discarded and the connection
+// aborted mid-body.
+func TestProcessRangeRequestWriteErrorAfterBodyStarted(t *testing.T) {
+	payload := bytes.Repeat([]byte("x"), 200*1024)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = ProcessRangeRequest(r, w, int64(len(payload)), "application/octet-stream", func(offset int64, size int64) (filer.DoStreamContent, error) {
+			return func(writer io.Writer) error {
+				// Page-sized writes, as readNeedleDataInto does. The tail sits
+				// in the 128KiB buffer; flushing it would finish the 200.
+				for off := 0; off < len(payload); off += 4096 {
+					end := off + 4096
+					if end > len(payload) {
+						end = len(payload)
+					}
+					if _, werr := writer.Write(payload[off:end]); werr != nil {
+						return werr
+					}
+				}
+				return errors.New("ReadNeedleData checksum mismatch")
+			}, nil
+		})
+	}))
+	defer srv.Close()
+
+	resp, err := srv.Client().Get(srv.URL)
+	if err != nil {
+		t.Fatalf("request: %v", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status %d, want the committed 200", resp.StatusCode)
+	}
+	body, readErr := io.ReadAll(resp.Body)
+	if readErr == nil {
+		t.Fatalf("body completed with %d bytes; the erroring tail must abort it", len(body))
+	}
+}
+
+func TestProcessRangeRequestWriteErrorBeforeBody(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/test.bin", nil)
+	w := httptest.NewRecorder()
+	err := ProcessRangeRequest(r, w, 100, "application/octet-stream", func(offset int64, size int64) (filer.DoStreamContent, error) {
+		return func(writer io.Writer) error {
+			return errors.New("ReadNeedleData checksum mismatch")
+		}, nil
+	})
+	if err == nil {
+		t.Fatal("expected write error")
+	}
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status %d, want 500, body %q", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "checksum") {
+		t.Fatalf("body %q, want the checksum error", w.Body.String())
+	}
+}
+
+func TestProcessRangeRequestLargeBody(t *testing.T) {
+	payload := bytes.Repeat([]byte("y"), 200*1024)
+	r := httptest.NewRequest(http.MethodGet, "/test.bin", nil)
+	w := httptest.NewRecorder()
+	err := ProcessRangeRequest(r, w, int64(len(payload)), "application/octet-stream", func(offset int64, size int64) (filer.DoStreamContent, error) {
+		return func(writer io.Writer) error {
+			_, werr := writer.Write(payload)
+			return werr
+		}, nil
+	})
+	if err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	if w.Code != http.StatusOK {
+		t.Fatalf("status %d, want 200", w.Code)
+	}
+	if !bytes.Equal(w.Body.Bytes(), payload) {
+		t.Fatalf("body len %d, want %d", w.Body.Len(), len(payload))
+	}
+}
+
+func TestProcessRangeRequestRanges(t *testing.T) {
+	data := []byte("0123456789")
+	serve := func(rangeHeader string) (*httptest.ResponseRecorder, error) {
+		r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/test.txt", nil)
+		r.Header.Set("Range", rangeHeader)
+		w := httptest.NewRecorder()
+		err := ProcessRangeRequest(r, w, int64(len(data)), "text/plain", func(offset int64, size int64) (filer.DoStreamContent, error) {
+			return func(writer io.Writer) error {
+				_, err := writer.Write(data[offset : offset+size])
+				return err
+			}, nil
+		})
+		return w, err
+	}
+
+	tests := []struct {
+		rangeHeader string
+		wantCode    int
+		wantRange   string
+		wantBody    string
+	}{
+		{"bytes=0-1", http.StatusPartialContent, "bytes 0-1/10", "01"},
+		{"bytes=5-100", http.StatusPartialContent, "bytes 5-9/10", "56789"},
+		{"bytes=10-", http.StatusRequestedRangeNotSatisfiable, "bytes */10", ""},
+		{"bytes=100-", http.StatusRequestedRangeNotSatisfiable, "bytes */10", ""},
+		{"bytes=10-,0-1", http.StatusPartialContent, "bytes 0-1/10", "01"},
+	}
+	for _, tt := range tests {
+		w, err := serve(tt.rangeHeader)
+		if wantErr := tt.wantCode == http.StatusRequestedRangeNotSatisfiable; (err != nil) != wantErr {
+			t.Errorf("%s: error = %v, want an error only for 416", tt.rangeHeader, err)
+		}
+		if w.Code != tt.wantCode {
+			t.Errorf("%s: status %d, want %d", tt.rangeHeader, w.Code, tt.wantCode)
+		}
+		if got := w.Header().Get("Content-Range"); got != tt.wantRange {
+			t.Errorf("%s: Content-Range %q, want %q", tt.rangeHeader, got, tt.wantRange)
+		}
+		if tt.wantBody != "" && w.Body.String() != tt.wantBody {
+			t.Errorf("%s: body %q, want %q", tt.rangeHeader, w.Body.String(), tt.wantBody)
+		}
+	}
+}
+
+// /submit must reject at the limit its master was given, not at a hardcoded
+// 256MB: weed server hands -volume.fileSizeLimitMB down to the master, and an
+// upload the volume server would store must not be turned away here (#6748).
+func TestSubmitForClientHandlerFileSizeLimit(t *testing.T) {
+	const fileSizeLimitBytes = int64(1 << 20)
+
+	submit := func(t *testing.T, dataSize int) *httptest.ResponseRecorder {
+		t.Helper()
+		var form bytes.Buffer
+		mw := multipart.NewWriter(&form)
+		part, err := mw.CreateFormFile("file", "test.bin")
+		if err != nil {
+			t.Fatalf("create form file: %v", err)
+		}
+		if _, err := part.Write(make([]byte, dataSize)); err != nil {
+			t.Fatalf("write form file: %v", err)
+		}
+		if err := mw.Close(); err != nil {
+			t.Fatalf("close multipart writer: %v", err)
+		}
+
+		// Assigning a file id is not under test, and there is no master to ask.
+		// A cancelled context fails that step at once for an accepted upload.
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		r := httptest.NewRequestWithContext(ctx, http.MethodPost, "/submit", bytes.NewReader(form.Bytes()))
+		r.Header.Set("Content-Type", mw.FormDataContentType())
+		w := httptest.NewRecorder()
+		masterFn := func(ctx context.Context) pb.ServerAddress { return pb.ServerAddress("localhost:9333") }
+		submitForClientHandler(w, r, masterFn, grpc.WithTransportCredentials(insecure.NewCredentials()), fileSizeLimitBytes)
+		return w
+	}
+
+	t.Run("over the limit", func(t *testing.T) {
+		w := submit(t, int(fileSizeLimitBytes)+1)
+		if w.Code != http.StatusBadRequest {
+			t.Fatalf("status: got %d want %d, body %q", w.Code, http.StatusBadRequest, w.Body.String())
+		}
+		if !strings.Contains(w.Body.String(), "over the limited") {
+			t.Errorf("body: got %q, want the file size limit error", w.Body.String())
+		}
+	})
+
+	t.Run("under the limit", func(t *testing.T) {
+		w := submit(t, int(fileSizeLimitBytes)-1)
+		if strings.Contains(w.Body.String(), "over the limited") {
+			t.Errorf("body: got %q, want no file size limit error", w.Body.String())
+		}
+		// Asserting on the message alone would still pass if the limit rejected
+		// this payload with different wording. Parser failures answer 400, and the
+		// cancelled assignment this request runs into answers 500, so a 400 here
+		// means the upload never got past parsing.
+		if w.Code == http.StatusBadRequest {
+			t.Errorf("status: got 400, want the request to reach assignment, body %q", w.Body.String())
+		}
+	})
+}
+
+func TestRedactedURLDropsTheJwt(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/1,abc?jwt=secret-token&size=5", nil)
+	if got := redactedURL(r); strings.Contains(got, "secret-token") || !strings.Contains(got, "size=5") {
+		t.Errorf("got %q, want jwt redacted and other params kept", got)
+	}
+	r = httptest.NewRequest(http.MethodGet, "/1,abc?jwt=&jwt=secret-token&size=5", nil)
+	if got := redactedURL(r); strings.Contains(got, "secret-token") {
+		t.Errorf("got %q, want every jwt value redacted", got)
+	}
+	r = httptest.NewRequest(http.MethodGet, "/1,abc?size=5", nil)
+	if got := redactedURL(r); got != "/1,abc?size=5" {
+		t.Errorf("got %q, want the URL unchanged without a jwt", got)
+	}
+}
diff --git a/weed/server/filer_grpc_server.go b/weed/server/filer_grpc_server.go
index 0e78b70460..c338e051c5 100644
--- a/weed/server/filer_grpc_server.go
+++ b/weed/server/filer_grpc_server.go
@@ -9,7 +9,6 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
-	"strings"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
@@ -19,6 +18,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
@@ -159,14 +159,19 @@ func (fs *FilerServer) LookupVolume(ctx context.Context, req *filer_pb.LookupVol
 	return resp, err
 }
 
+// wdclientLocationsToPb converts the wdclient's internal Location entries
+// (carrying DataInRemote and grpc-port metadata) to the protobuf form served
+// by the filer gRPC API, preserving the fields the lookup client uses to
+// prefer a local replica over a remote-tiered one.
 func wdclientLocationsToPb(locations []wdclient.Location) []*filer_pb.Location {
 	locs := make([]*filer_pb.Location, 0, len(locations))
 	for _, loc := range locations {
 		locs = append(locs, &filer_pb.Location{
-			Url:        loc.Url,
-			PublicUrl:  loc.PublicUrl,
-			GrpcPort:   uint32(loc.GrpcPort),
-			DataCenter: loc.DataCenter,
+			Url:          loc.Url,
+			PublicUrl:    loc.PublicUrl,
+			GrpcPort:     uint32(loc.GrpcPort),
+			DataCenter:   loc.DataCenter,
+			DataInRemote: loc.DataInRemote,
 		})
 	}
 	return locs
@@ -196,6 +201,41 @@ func (fs *FilerServer) CreateEntry(ctx context.Context, req *filer_pb.CreateEntr
 
 	resp = &filer_pb.CreateEntryResponse{}
 
+	// An exclusive or conditional create is a read-then-write that the per-path
+	// lock below only makes atomic on this filer, while the store's insert is an
+	// upsert. Route it to the entry's ring owner so one filer's lock arbitrates
+	// every creator cluster-wide; is_moved bounds this to one hop. Plain creates
+	// are upserts either way and stay local.
+	routed := req.OExcl || conditionIsSet(req.Condition)
+	if !req.IsMoved && routed {
+		fullpath := util.NewFullPath(req.Directory, req.Entry.Name)
+		// Held apart from the named resp, which the local path below writes into:
+		// a failed forward must not leave it nil.
+		var ownerResp *filer_pb.CreateEntryResponse
+		handled, forwardErr := fs.forwardToWriteOwner(ctx, entryRouteKey(fullpath), func(owner pb.ServerAddress) error {
+			glog.V(2).InfofCtx(ctx, "CreateEntry %s: forwarding to owner %s", fullpath, owner)
+			req.IsMoved = true
+			return pb.WithFilerClient(false, 0, owner, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+				forwarded, e := client.CreateEntry(ctx, req)
+				if e != nil {
+					return e
+				}
+				ownerResp = forwarded
+				return nil
+			})
+		})
+		if handled {
+			if forwardErr != nil {
+				return &filer_pb.CreateEntryResponse{}, forwardErr
+			}
+			return ownerResp, nil
+		}
+	} else if req.IsMoved && routed {
+		if err := fs.checkMovedMarker(ctx, req.IsMoved, fs.writeOwner(entryRouteKey(util.NewFullPath(req.Directory, req.Entry.Name)))); err != nil {
+			return &filer_pb.CreateEntryResponse{}, err
+		}
+	}
+
 	chunks, garbage, err2 := fs.cleanupChunks(ctx, util.Join(req.Directory, req.Entry.Name), nil, req.Entry)
 	if err2 != nil {
 		return &filer_pb.CreateEntryResponse{}, fmt.Errorf("CreateEntry cleanupChunks %s %s: %v", req.Directory, req.Entry.Name, err2)
@@ -287,27 +327,36 @@ func (fs *FilerServer) ObjectTransaction(ctx context.Context, req *filer_pb.Obje
 	// serialization point — even when the caller's ring view was stale. is_moved
 	// bounds this to one hop: a forwarded transaction is applied locally, so two
 	// filers that disagree on the owner during a ring change cannot loop.
-	if req.RouteKey != "" && !req.IsMoved && fs.filer.Dlm != nil {
-		if owner := fs.filer.Dlm.LockRing.GetPrimary(req.RouteKey); owner != "" && owner != fs.option.Host {
-			// Rebuild rather than copy the request struct (it carries a mutex);
-			// the pointer/slice fields are shared since the original is not mutated.
-			forwarded := &filer_pb.ObjectTransactionRequest{
-				LockKey:            req.LockKey,
-				Condition:          req.Condition,
-				Mutations:          req.Mutations,
-				IsFromOtherCluster: req.IsFromOtherCluster,
-				Signatures:         req.Signatures,
-				ConditionKey:       req.ConditionKey,
-				RouteKey:           req.RouteKey,
-				IsMoved:            true,
-			}
+	if req.RouteKey != "" {
+		if err := fs.checkMovedMarker(ctx, req.IsMoved, fs.writeOwner(req.RouteKey)); err != nil {
+			return &filer_pb.ObjectTransactionResponse{Error: err.Error()}, nil
+		}
+	}
+	if req.RouteKey != "" && !req.IsMoved {
+		// Rebuild rather than copy the request struct (it carries a mutex); the
+		// pointer/slice fields are shared since the original is not mutated.
+		forwarded := &filer_pb.ObjectTransactionRequest{
+			LockKey:            req.LockKey,
+			Condition:          req.Condition,
+			Mutations:          req.Mutations,
+			IsFromOtherCluster: req.IsFromOtherCluster,
+			Signatures:         req.Signatures,
+			ConditionKey:       req.ConditionKey,
+			RouteKey:           req.RouteKey,
+			IsMoved:            true,
+			RequestId:          req.RequestId,
+			ConditionAltKey:    req.ConditionAltKey,
+		}
+		var resp *filer_pb.ObjectTransactionResponse
+		handled, err := fs.forwardToWriteOwner(ctx, req.RouteKey, func(owner pb.ServerAddress) error {
 			glog.V(2).InfofCtx(ctx, "ObjectTransaction %s: forwarding to owner %s", req.LockKey, owner)
-			var resp *filer_pb.ObjectTransactionResponse
-			err := pb.WithFilerClient(false, 0, owner, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+			return pb.WithFilerClient(false, 0, owner, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
 				var e error
 				resp, e = client.ObjectTransaction(ctx, forwarded)
 				return e
 			})
+		})
+		if handled {
 			if err != nil {
 				return &filer_pb.ObjectTransactionResponse{}, err
 			}
@@ -319,6 +368,28 @@ func (fs *FilerServer) ObjectTransaction(ctx context.Context, req *filer_pb.Obje
 	pathLock := fs.entryLockTable.AcquireLock("ObjectTransaction", lockPath, util.ExclusiveLock)
 	defer fs.entryLockTable.ReleaseLock(lockPath, pathLock)
 
+	// Under the same lock the first application committed with, a failover
+	// replay of the same request replays its recorded outcome instead of
+	// re-applying mutations over whatever superseded it.
+	if resp, found := fs.recentObjectTxn(req.RequestId, lockPath); found {
+		glog.V(2).InfofCtx(ctx, "ObjectTransaction %s: replaying recorded outcome for request %s", req.LockKey, req.RequestId)
+		return resp, nil
+	}
+
+	resp := &filer_pb.ObjectTransactionResponse{}
+	// Outcomes are replayed rather than re-run: a mutation error may follow a
+	// partial apply, and a retry that re-runs could write the stale mutation
+	// over whatever superseded it, while replaying the recorded failure at
+	// least matches what the first attempt reported. The one exception is the
+	// condition lookup below: it fails before any mutation runs, so the retry
+	// must re-evaluate rather than replay an empty outcome.
+	record := true
+	defer func() {
+		if record {
+			fs.rememberObjectTxn(req.RequestId, lockPath, resp)
+		}
+	}()
+
 	if conditionIsSet(req.Condition) {
 		// The condition is evaluated against condition_key when set (e.g. a
 		// version entry whose WORM guards gate the delete), while the lock stays
@@ -328,29 +399,151 @@ func (fs *FilerServer) ObjectTransaction(ctx context.Context, req *filer_pb.Obje
 			conditionPath = util.FullPath(req.ConditionKey)
 		}
 		current, findErr := fs.filer.FindEntry(ctx, conditionPath)
+		if findErr == nil && current != nil && current.IsDirectory() && req.ConditionAltKey != "" {
+			// A directory is not the object: implicit directories can share a
+			// path with an S3 key, so treat it as an absent slot. Only the
+			// alt-key callers want object-slot semantics; an explicit
+			// condition_key may legitimately name a directory.
+			current, findErr = nil, filer_pb.ErrNotFound
+		}
+		// The caller can name a fallback evaluated when the primary is absent —
+		// a suspended-versioning write checks "the null slot if present, else
+		// the latest version" atomically under this lock. condition_alt_key is
+		// the object's .versions directory, and the latest it resolves to is
+		// read from the pointer maintained by the same lock, so a concurrent
+		// version delete cannot move which entry the condition sees.
+		if findErr == filer_pb.ErrNotFound && req.ConditionAltKey != "" {
+			current, conditionPath, findErr = fs.latestVersionedConditionEntry(ctx, util.FullPath(req.ConditionAltKey))
+		}
 		if findErr != nil && findErr != filer_pb.ErrNotFound {
-			return &filer_pb.ObjectTransactionResponse{}, fmt.Errorf("ObjectTransaction condition %s: %w", conditionPath, findErr)
+			record = false // a lookup error decides nothing; a retry must re-run, not replay
+			return nil, fmt.Errorf("ObjectTransaction condition %s: %w", conditionPath, findErr)
 		}
 		if findErr == filer_pb.ErrNotFound {
 			current = nil
 		}
 		if !writeConditionSatisfied(req.Condition, current) {
 			glog.V(3).InfofCtx(ctx, "ObjectTransaction %s: precondition failed", conditionPath)
-			return &filer_pb.ObjectTransactionResponse{
-				Error:     "precondition failed",
-				ErrorCode: filer_pb.FilerError_PRECONDITION_FAILED,
-			}, nil
+			resp.Error = "precondition failed"
+			resp.ErrorCode = filer_pb.FilerError_PRECONDITION_FAILED
+			return resp, nil
 		}
 	}
 
 	for i, m := range req.Mutations {
 		if err := fs.applyObjectMutation(ctx, m, req.IsFromOtherCluster, req.Signatures); err != nil {
 			glog.V(2).InfofCtx(ctx, "ObjectTransaction %s mutation %d (%v): %v", lockPath, i, m.Type, err)
-			return &filer_pb.ObjectTransactionResponse{Error: fmt.Sprintf("mutation %d: %v", i, err)}, nil
+			resp.Error = fmt.Sprintf("mutation %d: %v", i, err)
+			return resp, nil
 		}
 	}
 
-	return &filer_pb.ObjectTransactionResponse{}, nil
+	return resp, nil
+}
+
+const (
+	recentObjectTxnTTL         = 2 * time.Minute
+	recentObjectTxnSweepCap    = 10000
+	recentObjectTxnSweepPeriod = 30 * time.Second
+)
+
+type recentObjectTxn struct {
+	resp      *filer_pb.ObjectTransactionResponse
+	expiresAt time.Time
+}
+
+// recentObjectTxnKey scopes an idempotency token to the transaction's lock
+// path, so a token reused on a different object cannot replay this outcome.
+func recentObjectTxnKey(requestID string, lockPath util.FullPath) string {
+	return requestID + "\x00" + string(lockPath)
+}
+
+// recentObjectTxn returns the recorded outcome of an already-applied request,
+// so a failover replay of the same ObjectTransaction does not re-apply it.
+func (fs *FilerServer) recentObjectTxn(requestID string, lockPath util.FullPath) (*filer_pb.ObjectTransactionResponse, bool) {
+	if requestID == "" {
+		return nil, false
+	}
+	fs.recentObjectTxnsMu.Lock()
+	defer fs.recentObjectTxnsMu.Unlock()
+
+	key := recentObjectTxnKey(requestID, lockPath)
+	txn, found := fs.recentObjectTxns[key]
+	if !found {
+		return nil, false
+	}
+	if time.Now().After(txn.expiresAt) {
+		delete(fs.recentObjectTxns, key)
+		return nil, false
+	}
+	return txn.resp, true
+}
+
+func (fs *FilerServer) rememberObjectTxn(requestID string, lockPath util.FullPath, resp *filer_pb.ObjectTransactionResponse) {
+	if requestID == "" || resp == nil {
+		return
+	}
+	fs.recentObjectTxnsMu.Lock()
+	defer fs.recentObjectTxnsMu.Unlock()
+	if fs.recentObjectTxns == nil {
+		fs.recentObjectTxns = make(map[string]recentObjectTxn)
+	}
+	// A live record is never evicted early: a replay that misses re-applies the
+	// transaction. The sweep is amortized so a hot cache does not scan on every
+	// write; between sweeps the map may exceed the cap, still bounded by the
+	// insert rate over the TTL.
+	now := time.Now()
+	if len(fs.recentObjectTxns) >= recentObjectTxnSweepCap {
+		if now.After(fs.recentObjectTxnsSweepAt) {
+			fs.recentObjectTxnsSweepAt = now.Add(recentObjectTxnSweepPeriod)
+			for id, txn := range fs.recentObjectTxns {
+				if now.After(txn.expiresAt) {
+					delete(fs.recentObjectTxns, id)
+				}
+			}
+		}
+		if len(fs.recentObjectTxns) >= recentObjectTxnSweepCap {
+			// Full of unexpired records: drop the new one rather than evict
+			// an outcome a replay may still need.
+			return
+		}
+	}
+	fs.recentObjectTxns[recentObjectTxnKey(requestID, lockPath)] = recentObjectTxn{
+		resp:      resp,
+		expiresAt: now.Add(recentObjectTxnTTL),
+	}
+}
+
+// latestVersionedConditionEntry resolves the object a conditional write should
+// be checked against inside a .versions directory: the entry the latest-version
+// pointer names, or nothing when the pointer names a delete marker — a
+// tombstone is not a current version. A missing pointer or a pointer to a file
+// that is gone means the metadata cannot answer the question, which reports an
+// error rather than guessing at either branch.
+func (fs *FilerServer) latestVersionedConditionEntry(ctx context.Context, versionsDir util.FullPath) (*filer.Entry, util.FullPath, error) {
+	versionsEntry, err := fs.filer.FindEntry(ctx, versionsDir)
+	if err != nil {
+		return nil, versionsDir, err
+	}
+	if versionsEntry == nil {
+		return nil, versionsDir, filer_pb.ErrNotFound
+	}
+	latestName := string(versionsEntry.Extended[s3_constants.ExtLatestVersionFileNameKey])
+	if latestName == "" {
+		return nil, versionsDir, fmt.Errorf("%s has no latest-version pointer", versionsDir)
+	}
+	latestPath := util.NewFullPath(string(versionsDir), latestName)
+	entry, err := fs.filer.FindEntry(ctx, latestPath)
+	if err == filer_pb.ErrNotFound {
+		return nil, latestPath, fmt.Errorf("latest-version pointer %s names a missing entry", latestPath)
+	}
+	if err != nil {
+		return nil, latestPath, err
+	}
+	if string(entry.Extended[s3_constants.ExtDeleteMarkerKey]) == "true" {
+		return nil, latestPath, filer_pb.ErrNotFound
+	}
+	return entry, latestPath, nil
 }
 
 // ObjectTransactionBatch applies several object transactions in one round trip,
@@ -388,19 +581,17 @@ func (fs *FilerServer) ObjectTransactionBatch(ctx context.Context, req *filer_pb
 
 // applyStorageDefaultsToEntry enforces the path's storage rule (read-only
 // prefixes reject the write) and fills in the rule TTL when the entry carries
-// none. Remote entries never expire locally; the remote storage owns their
-// lifecycle.
+// none. The returned option carries the same TTL as the entry, so chunks a
+// caller still has to place expire with it.
 func (fs *FilerServer) applyStorageDefaultsToEntry(ctx context.Context, entry *filer.Entry) (*operation.StorageOption, error) {
-	so, err := fs.detectStorageOption(ctx, string(entry.FullPath), "", "", 0, "", "", "", "")
+	if entry.Remote != nil {
+		entry.TtlSec = 0
+	}
+	so, err := fs.detectStorageOption(ctx, string(entry.FullPath), "", "", entry.TtlSec, "", "", "", "")
 	if err != nil {
 		return nil, err
 	}
-	if entry.Remote != nil {
-		entry.TtlSec = 0
-	} else if entry.TtlSec == 0 {
-		entry.TtlSec = so.TtlSeconds
-	}
-	entry.ApplyS3ExpiryMetadata()
+	entry.ApplyStorageTtl(so.TtlSeconds)
 	return so, nil
 }
 
@@ -424,6 +615,9 @@ func (fs *FilerServer) applyObjectMutation(ctx context.Context, m *filer_pb.Obje
 
 	case filer_pb.ObjectMutation_DELETE:
 		fullpath := util.NewFullPath(m.Directory, m.Name)
+		if m.KeepRemoteObject {
+			ctx = filer.WithKeepRemoteObject(ctx)
+		}
 		err := fs.filer.DeleteEntryMetaAndData(ctx, fullpath, m.IsRecursive, false, m.IsDeleteData, fromOtherCluster, signatures, 0)
 		if err != nil && err != filer_pb.ErrNotFound {
 			return err
@@ -435,7 +629,7 @@ func (fs *FilerServer) applyObjectMutation(ctx context.Context, m *filer_pb.Obje
 			// the expected no-op, and a failed teardown must not fail the
 			// already-applied delete.
 			parentErr := fs.filer.DeleteEntryMetaAndData(ctx, util.FullPath(m.Directory), false, false, false, fromOtherCluster, signatures, 0)
-			if parentErr != nil && parentErr != filer_pb.ErrNotFound && !strings.Contains(parentErr.Error(), filer.MsgFailDelNonEmptyFolder) {
+			if parentErr != nil && parentErr != filer_pb.ErrNotFound && !errors.Is(parentErr, filer.ErrNonEmptyFolder) {
 				glog.V(1).InfofCtx(ctx, "remove empty parent %s: %v", m.Directory, parentErr)
 			}
 		}
@@ -474,7 +668,7 @@ func (fs *FilerServer) applyObjectMutation(ctx context.Context, m *filer_pb.Obje
 		if m.TouchMtime {
 			newEntry.Attr.Mtime = time.Now()
 		}
-		if err := fs.filer.UpdateEntry(ctx, oldEntry, newEntry); err != nil {
+		if err := fs.filer.UpdateEntry(ctx, oldEntry, newEntry, fromOtherCluster); err != nil {
 			return err
 		}
 		// Emit the metadata event so the update replicates and subscribers see it,
@@ -579,7 +773,7 @@ func (fs *FilerServer) applyRecomputeLatest(ctx context.Context, m *filer_pb.Obj
 		}
 	}
 
-	if err := fs.filer.UpdateEntry(ctx, oldPointer, pointer); err != nil {
+	if err := fs.filer.UpdateEntry(ctx, oldPointer, pointer, fromOtherCluster); err != nil {
 		return err
 	}
 	// Replicate the recomputed pointer to peer filers and subscribers. Without
@@ -609,7 +803,7 @@ func (fs *FilerServer) applyRecomputeLatest(ctx context.Context, m *filer_pb.Obj
 			priorEntry.Extended = make(map[string][]byte)
 		}
 		priorEntry.Extended[rc.DemoteKey] = rc.DemoteValue
-		if err := fs.filer.UpdateEntry(ctx, oldPrior, priorEntry); err != nil {
+		if err := fs.filer.UpdateEntry(ctx, oldPrior, priorEntry, fromOtherCluster); err != nil {
 			return err
 		}
 		fs.filer.NotifyUpdateEvent(ctx, oldPrior, priorEntry, false, fromOtherCluster, signatures)
@@ -628,6 +822,37 @@ func (fs *FilerServer) UpdateEntry(ctx context.Context, req *filer_pb.UpdateEntr
 
 	fullpath := util.Join(req.Directory, req.Entry.Name)
 
+	// A conditional or preconditioned update is a read-then-write that the
+	// per-path lock below only makes atomic on this filer. Route it to the
+	// entry's ring owner so one filer's lock arbitrates every writer
+	// cluster-wide; is_moved bounds this to one hop.
+	routed := conditionIsSet(req.Condition) || len(req.ExpectedExtended) > 0
+	if !req.IsMoved && routed {
+		var ownerResp *filer_pb.UpdateEntryResponse
+		handled, forwardErr := fs.forwardToWriteOwner(ctx, entryRouteKey(util.FullPath(fullpath)), func(owner pb.ServerAddress) error {
+			glog.V(2).InfofCtx(ctx, "UpdateEntry %s: forwarding to owner %s", fullpath, owner)
+			req.IsMoved = true
+			return pb.WithFilerClient(false, 0, owner, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+				forwarded, e := client.UpdateEntry(ctx, req)
+				if e != nil {
+					return e
+				}
+				ownerResp = forwarded
+				return nil
+			})
+		})
+		if handled {
+			if forwardErr != nil {
+				return &filer_pb.UpdateEntryResponse{}, forwardErr
+			}
+			return ownerResp, nil
+		}
+	} else if req.IsMoved && routed {
+		if err := fs.checkMovedMarker(ctx, req.IsMoved, fs.writeOwner(entryRouteKey(util.FullPath(fullpath)))); err != nil {
+			return &filer_pb.UpdateEntryResponse{}, err
+		}
+	}
+
 	// Serialize concurrent mutations to the same path on this filer so the
 	// read (preconditions, garbage diff) and the write are atomic. Callers
 	// route a key's writes to this owner filer, making this local lock
@@ -642,6 +867,9 @@ func (fs *FilerServer) UpdateEntry(ctx context.Context, req *filer_pb.UpdateEntr
 
 	entry, err := fs.filer.FindEntry(ctx, lockPath)
 	if err != nil {
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			return &filer_pb.UpdateEntryResponse{}, status.Errorf(codes.NotFound, "not found %s: %v", fullpath, err)
+		}
 		return &filer_pb.UpdateEntryResponse{}, fmt.Errorf("not found %s: %v", fullpath, err)
 	}
 	if err := validateUpdateEntryPreconditions(entry, req.ExpectedExtended); err != nil {
@@ -671,7 +899,7 @@ func (fs *FilerServer) UpdateEntry(ctx context.Context, req *filer_pb.UpdateEntr
 
 	ctx, eventSink := filer.WithMetadataEventSink(ctx)
 	resp := &filer_pb.UpdateEntryResponse{LogTsNs: logTsNs, LogSignature: fs.filer.Signature}
-	if err = fs.filer.UpdateEntry(ctx, entry, newEntry); err == nil {
+	if err = fs.filer.UpdateEntry(ctx, entry, newEntry, req.IsFromOtherCluster); err == nil {
 		fs.filer.DeleteChunksNotRecursive(garbage)
 
 		fs.filer.NotifyUpdateEvent(ctx, entry, newEntry, true, req.IsFromOtherCluster, req.Signatures)
@@ -713,7 +941,7 @@ func (fs *FilerServer) cleanupChunks(ctx context.Context, fullpath string, exist
 
 	// remove old chunks if not included in the new ones
 	if existingEntry != nil {
-		garbage, err = filer.MinusChunks(ctx, fs.lookupFileId, existingEntry.GetChunks(), newEntry.GetChunks())
+		garbage, err = filer.MinusChunks(ctx, fs.lookupFileId, existingEntry.GetChunks(), newEntry.GetChunks(), fs.filer.MasterClient)
 		if err != nil {
 			return newEntry.GetChunks(), nil, fmt.Errorf("MinusChunks: %w", err)
 		}
@@ -722,7 +950,10 @@ func (fs *FilerServer) cleanupChunks(ctx context.Context, fullpath string, exist
 	// files with manifest chunks are usually large and append only, skip calculating covered chunks
 	manifestChunks, nonManifestChunks := filer.SeparateManifestChunks(newEntry.GetChunks())
 
-	chunks, coveredChunks := filer.CompactFileChunks(ctx, fs.lookupFileId, nonManifestChunks)
+	chunks, coveredChunks, err := filer.CompactFileChunks(ctx, fs.lookupFileId, nonManifestChunks)
+	if err != nil {
+		return newEntry.GetChunks(), nil, fmt.Errorf("CompactFileChunks: %w", err)
+	}
 	garbage = append(garbage, coveredChunks...)
 
 	if newEntry.Attributes != nil {
@@ -735,11 +966,13 @@ func (fs *FilerServer) cleanupChunks(ctx context.Context, fullpath string, exist
 			"",
 			"",
 		) // ignore readonly error for capacity needed to manifestize
-		chunks, err = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), chunks)
-		if err != nil {
-			// not good, but should be ok
-			glog.V(0).InfofCtx(ctx, "MaybeManifestize: %v", err)
+		// A failed fold leaves a flat list, which is still a correct entry --
+		// and the store rejects it by name if it cannot hold one this size.
+		folded, manifestErr := filer.MaybeManifestize(fs.saveAsChunk(ctx, so), fs.filer.DeleteChunksNotRecursive, chunks)
+		if manifestErr != nil {
+			glog.V(0).InfofCtx(ctx, "MaybeManifestize %s: %v", fullpath, manifestErr)
 		}
+		chunks = folded
 	}
 
 	chunks = append(manifestChunks, chunks...)
@@ -754,6 +987,9 @@ func (fs *FilerServer) AppendToEntry(ctx context.Context, req *filer_pb.AppendTo
 
 	lockClient := cluster.NewLockClient(fs.grpcDialOption, fs.option.Host)
 	lock := lockClient.NewShortLivedLock(string(fullpath), string(fs.option.Host))
+	if lock == nil {
+		return nil, fmt.Errorf("failed to acquire lock for %s", fullpath)
+	}
 	defer lock.StopShortLivedLock()
 
 	// The cluster lock serializes appenders across filers; the path lock makes
@@ -785,15 +1021,15 @@ func (fs *FilerServer) AppendToEntry(ctx context.Context, req *filer_pb.AppendTo
 	}
 
 	entry.Chunks = append(entry.GetChunks(), req.Chunks...)
-	so, err := fs.detectStorageOption(ctx, string(fullpath), "", "", entry.TtlSec, "", "", "", "")
+	so, err := fs.applyStorageDefaultsToEntry(ctx, entry)
 	if err != nil {
-		glog.WarningfCtx(ctx, "detectStorageOption: %v", err)
+		glog.WarningfCtx(ctx, "applyStorageDefaultsToEntry: %v", err)
 		return &filer_pb.AppendToEntryResponse{}, err
 	}
-	entry.Chunks, err = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), entry.GetChunks())
+	entry.Chunks, err = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), fs.filer.DeleteChunksNotRecursive, entry.GetChunks())
 	if err != nil {
-		// not good, but should be ok
-		glog.V(0).InfofCtx(ctx, "MaybeManifestize: %v", err)
+		// the append is still correct with the flat list
+		glog.V(0).InfofCtx(ctx, "MaybeManifestize %s: %v", fullpath, err)
 	}
 
 	err = fs.filer.CreateEntry(context.Background(), entry, nil, false, false, nil, false, fs.filer.MaxFilenameLength)
@@ -813,6 +1049,9 @@ func (fs *FilerServer) DeleteEntry(ctx context.Context, req *filer_pb.DeleteEntr
 	pathLock := fs.entryLockTable.AcquireLock("DeleteEntry", fullpath, util.ExclusiveLock)
 	defer fs.entryLockTable.ReleaseLock(fullpath, pathLock)
 
+	if req.KeepRemoteObject {
+		ctx = filer.WithKeepRemoteObject(ctx)
+	}
 	ctx, eventSink := filer.WithMetadataEventSink(ctx)
 	err = fs.filer.DeleteEntryMetaAndData(ctx, fullpath, req.IsRecursive, req.IgnoreRecursiveError, req.IsDeleteData, req.IsFromOtherCluster, req.Signatures, req.IfNotModifiedAfter)
 	resp = &filer_pb.DeleteEntryResponse{}
@@ -829,7 +1068,13 @@ func (fs *FilerServer) AssignVolume(ctx context.Context, req *filer_pb.AssignVol
 	so, err := fs.resolveAssignStorageOption(ctx, req)
 	if err != nil {
 		glog.V(3).InfofCtx(ctx, "AssignVolume: %v", err)
-		return &filer_pb.AssignVolumeResponse{Error: fmt.Sprintf("assign volume: %v", err)}, nil
+		resp = &filer_pb.AssignVolumeResponse{Error: fmt.Sprintf("assign volume: %v", err)}
+		if errors.Is(err, ErrReadOnly) {
+			// Still a successful RPC: clients treat gRPC errors as transport
+			// failures and retry or fail over, but read-only is a verdict.
+			resp.ErrorCode = filer_pb.FilerError_READ_ONLY
+		}
+		return resp, nil
 	}
 
 	assignRequest, altRequest := so.ToAssignRequests(int(req.Count))
@@ -859,6 +1104,7 @@ func (fs *FilerServer) AssignVolume(ctx context.Context, req *filer_pb.AssignVol
 		Auth:        string(assignResult.Auth),
 		Collection:  so.Collection,
 		Replication: so.Replication,
+		Fsync:       so.Fsync,
 	}
 	// Forward the replica holders so a client can write all copies directly.
 	for _, replica := range assignResult.Replicas {
@@ -891,8 +1137,8 @@ func (fs *FilerServer) CollectionList(ctx context.Context, req *filer_pb.Collect
 	glog.V(4).InfofCtx(ctx, "CollectionList %v", req)
 	resp = &filer_pb.CollectionListResponse{}
 
-	err = fs.filer.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-		masterResp, err := client.CollectionList(context.Background(), &master_pb.CollectionListRequest{
+	err = fs.filer.MasterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+		masterResp, err := client.CollectionList(ctx, &master_pb.CollectionListRequest{
 			IncludeNormalVolumes: req.IncludeNormalVolumes,
 			IncludeEcVolumes:     req.IncludeEcVolumes,
 		})
@@ -912,7 +1158,7 @@ func (fs *FilerServer) DeleteCollection(ctx context.Context, req *filer_pb.Delet
 
 	glog.V(4).InfofCtx(ctx, "DeleteCollection %v", req)
 
-	err = fs.filer.DoDeleteCollection(req.GetCollection())
+	err = fs.filer.DoDeleteCollection(ctx, req.GetCollection())
 
 	return &filer_pb.DeleteCollectionResponse{}, err
 }
diff --git a/weed/server/filer_grpc_server_admin.go b/weed/server/filer_grpc_server_admin.go
index 0cef9e0c49..c013cff2e8 100644
--- a/weed/server/filer_grpc_server_admin.go
+++ b/weed/server/filer_grpc_server_admin.go
@@ -21,8 +21,8 @@ func (fs *FilerServer) Statistics(ctx context.Context, req *filer_pb.StatisticsR
 
 	var output *master_pb.StatisticsResponse
 
-	err = fs.filer.MasterClient.WithClient(false, func(masterClient master_pb.SeaweedClient) error {
-		grpcResponse, grpcErr := masterClient.Statistics(context.Background(), &master_pb.StatisticsRequest{
+	err = fs.filer.MasterClient.WithClient(ctx, false, func(masterClient master_pb.SeaweedClient) error {
+		grpcResponse, grpcErr := masterClient.Statistics(ctx, &master_pb.StatisticsRequest{
 			Replication: fs.statisticsReplication(req.Replication),
 			Collection:  req.Collection,
 			Ttl:         req.Ttl,
diff --git a/weed/server/filer_grpc_server_batch_lookup.go b/weed/server/filer_grpc_server_batch_lookup.go
new file mode 100644
index 0000000000..9590739705
--- /dev/null
+++ b/weed/server/filer_grpc_server_batch_lookup.go
@@ -0,0 +1,247 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const (
+	maxFilerBatchLookupRequests = 4096
+	maxFilerBatchLookupWorkers  = 32
+)
+
+type filerBatchEntryFinder func(context.Context, util.FullPath) (*filer.Entry, int64, error)
+type filerBatchVolumeLookup func(context.Context, []string) (map[string][]wdclient.Location, error)
+
+// LookupDirectoryEntries performs exact entry lookups concurrently while
+// preserving request order, then resolves every referenced volume in one
+// deduplicated master lookup.
+func (fs *FilerServer) LookupDirectoryEntries(ctx context.Context, req *filer_pb.LookupDirectoryEntriesRequest) (*filer_pb.LookupDirectoryEntriesResponse, error) {
+	lookupVolumes := selectFilerBatchVolumeLookup(req,
+		fs.filer.MasterClient.LookupVolumeIdsWithFallback,
+		fs.filer.MasterClient.LookupVolumeIdsAuthoritative)
+	response, err := lookupDirectoryEntries(ctx, req, fs.filer.Signature, fs.fencedFindEntry, lookupVolumes)
+	if err != nil {
+		return nil, err
+	}
+	if fs.volumeGuard != nil {
+		populateBatchReadAuth(response, fs.maybeGetVolumeReadJwtAuthorizationToken)
+	}
+	return response, nil
+}
+
+func selectFilerBatchVolumeLookup(req *filer_pb.LookupDirectoryEntriesRequest, cached, authoritative filerBatchVolumeLookup) filerBatchVolumeLookup {
+	if req != nil && req.GetUnavailableVolumeIsMiss() {
+		// DeletedVids is an asynchronous cache invalidation hint and its delivery
+		// is deliberately best-effort. Cache reads must therefore confirm the
+		// unique Volume IDs with Master before treating a location as live.
+		return authoritative
+	}
+	return cached
+}
+
+func populateBatchReadAuth(response *filer_pb.LookupDirectoryEntriesResponse, mint func(string) string) {
+	response.ReadAuth = make(map[string]string)
+	for _, result := range response.Results {
+		if result == nil || result.Entry == nil {
+			continue
+		}
+		for _, chunk := range result.Entry.Chunks {
+			fid := chunk.GetFileIdString()
+			if fid == "" {
+				continue
+			}
+			if token := mint(fid); token != "" {
+				response.ReadAuth[fid] = token
+			}
+		}
+	}
+}
+
+func lookupDirectoryEntries(
+	ctx context.Context,
+	req *filer_pb.LookupDirectoryEntriesRequest,
+	logSignature int32,
+	findEntry filerBatchEntryFinder,
+	lookupVolumes filerBatchVolumeLookup,
+) (*filer_pb.LookupDirectoryEntriesResponse, error) {
+	if err := validateFilerBatchLookupRequest(req); err != nil {
+		return nil, err
+	}
+
+	results := make([]*filer_pb.LookupDirectoryEntryResult, len(req.Requests))
+	resultVolumeIDs := make([]map[string]struct{}, len(req.Requests))
+	jobs := make(chan int)
+	workerCount := min(len(req.Requests), maxFilerBatchLookupWorkers)
+
+	var workers sync.WaitGroup
+	workers.Add(workerCount)
+	for range workerCount {
+		go func() {
+			defer workers.Done()
+			for index := range jobs {
+				request := req.Requests[index]
+				entry, logTsNs, err := findEntry(ctx, util.JoinPath(request.Directory, request.Name))
+				result := &filer_pb.LookupDirectoryEntryResult{
+					LogTsNs:      logTsNs,
+					LogSignature: logSignature,
+				}
+				switch {
+				case errors.Is(err, filer_pb.ErrNotFound):
+					results[index] = result
+				case err != nil:
+					result.Error = err.Error()
+					results[index] = result
+				case entry == nil:
+					result.Error = "entry lookup returned no entry"
+					results[index] = result
+				default:
+					pbEntry := entry.ToProtoEntry()
+					volumeIDs, volumeErr := filerBatchEntryVolumeIDs(pbEntry)
+					result.Found = true
+					result.Entry = pbEntry
+					if volumeErr != nil {
+						result.Error = volumeErr.Error()
+					}
+					results[index] = result
+					resultVolumeIDs[index] = volumeIDs
+				}
+			}
+		}()
+	}
+
+	for index := range req.Requests {
+		select {
+		case jobs <- index:
+		case <-ctx.Done():
+			close(jobs)
+			workers.Wait()
+			return nil, status.FromContextError(ctx.Err()).Err()
+		}
+	}
+	close(jobs)
+	workers.Wait()
+	if err := ctx.Err(); err != nil {
+		return nil, status.FromContextError(err).Err()
+	}
+
+	allVolumeIDs := make(map[string]struct{})
+	for _, volumeIDs := range resultVolumeIDs {
+		for volumeID := range volumeIDs {
+			allVolumeIDs[volumeID] = struct{}{}
+		}
+	}
+	volumeIDs := make([]string, 0, len(allVolumeIDs))
+	for volumeID := range allVolumeIDs {
+		volumeIDs = append(volumeIDs, volumeID)
+	}
+	sort.Strings(volumeIDs)
+
+	response := &filer_pb.LookupDirectoryEntriesResponse{
+		Results:      results,
+		LocationsMap: make(map[string]*filer_pb.Locations, len(volumeIDs)),
+	}
+	if len(volumeIDs) == 0 {
+		return response, nil
+	}
+
+	locationsByVolume, lookupErr := lookupVolumes(ctx, volumeIDs)
+	// The provider returns a nil map when it got no answer, and a populated map
+	// with the volumes the master does not serve reported as errors when it did,
+	// so a nil map is the only sign of an unanswered lookup. Only a volume the
+	// master itself left out may become a miss; anything else stays an error.
+	missIsAuthoritative := req.UnavailableVolumeIsMiss && locationsByVolume != nil
+	for _, volumeID := range volumeIDs {
+		locations := locationsByVolume[volumeID]
+		if len(locations) != 0 {
+			response.LocationsMap[volumeID] = &filer_pb.Locations{
+				Locations: wdclientLocationsToPb(locations),
+			}
+			continue
+		}
+		if !missIsAuthoritative {
+			response.LocationsMap[volumeID] = &filer_pb.Locations{}
+		}
+		for index, entryVolumeIDs := range resultVolumeIDs {
+			if _, affected := entryVolumeIDs[volumeID]; !affected {
+				continue
+			}
+			if missIsAuthoritative && results[index].Error == "" {
+				results[index].Found = false
+				results[index].Entry = nil
+				resultVolumeIDs[index] = nil
+				continue
+			}
+			message := fmt.Sprintf("volume %s has no locations", volumeID)
+			if lookupErr != nil {
+				message += ": " + lookupErr.Error()
+			}
+			results[index].Error = appendFilerBatchLookupError(results[index].Error, message)
+		}
+	}
+
+	return response, nil
+}
+
+func validateFilerBatchLookupRequest(req *filer_pb.LookupDirectoryEntriesRequest) error {
+	if req == nil || len(req.Requests) == 0 {
+		return status.Error(codes.InvalidArgument, "batch lookup requires at least one request")
+	}
+	if len(req.Requests) > maxFilerBatchLookupRequests {
+		return status.Errorf(codes.ResourceExhausted, "batch lookup has %d requests; maximum is %d", len(req.Requests), maxFilerBatchLookupRequests)
+	}
+	for index, request := range req.Requests {
+		if request == nil {
+			return status.Errorf(codes.InvalidArgument, "batch lookup request %d is missing", index)
+		}
+		if request.Directory == "" || !strings.HasPrefix(request.Directory, "/") || strings.ContainsRune(request.Directory, '\x00') {
+			return status.Errorf(codes.InvalidArgument, "batch lookup request %d has invalid directory", index)
+		}
+		if request.Name == "" || request.Name == "." || request.Name == ".." || strings.ContainsAny(request.Name, "/\x00") {
+			return status.Errorf(codes.InvalidArgument, "batch lookup request %d has invalid name", index)
+		}
+	}
+	return nil
+}
+
+func filerBatchEntryVolumeIDs(entry *filer_pb.Entry) (map[string]struct{}, error) {
+	volumeIDs := make(map[string]struct{})
+	for index, chunk := range entry.GetChunks() {
+		if chunk == nil {
+			return volumeIDs, fmt.Errorf("entry chunk %d is missing", index)
+		}
+		if chunk.Fid != nil {
+			volumeIDs[strconv.FormatUint(uint64(chunk.Fid.VolumeId), 10)] = struct{}{}
+			continue
+		}
+		if chunk.FileId == "" {
+			return volumeIDs, fmt.Errorf("entry chunk %d has no file id", index)
+		}
+		fid, err := needle.ParseFileIdFromString(chunk.FileId)
+		if err != nil {
+			return volumeIDs, fmt.Errorf("entry chunk %d has invalid file id: %w", index, err)
+		}
+		volumeIDs[strconv.FormatUint(uint64(fid.VolumeId), 10)] = struct{}{}
+	}
+	return volumeIDs, nil
+}
+
+func appendFilerBatchLookupError(existing, next string) string {
+	if existing == "" {
+		return next
+	}
+	return existing + "; " + next
+}
diff --git a/weed/server/filer_grpc_server_batch_lookup_test.go b/weed/server/filer_grpc_server_batch_lookup_test.go
new file mode 100644
index 0000000000..7bc099dfbc
--- /dev/null
+++ b/weed/server/filer_grpc_server_batch_lookup_test.go
@@ -0,0 +1,418 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestLookupDirectoryEntriesRejectsInvalidRequests(t *testing.T) {
+	valid := &filer_pb.LookupDirectoryEntryRequest{Directory: "/batch", Name: "key"}
+	tests := []struct {
+		name     string
+		req      *filer_pb.LookupDirectoryEntriesRequest
+		wantCode codes.Code
+	}{
+		{name: "nil request", wantCode: codes.InvalidArgument},
+		{name: "empty batch", req: &filer_pb.LookupDirectoryEntriesRequest{}, wantCode: codes.InvalidArgument},
+		{name: "oversized", req: repeatedBatchLookupRequest(maxFilerBatchLookupRequests+1, valid), wantCode: codes.ResourceExhausted},
+		{name: "nil item", req: &filer_pb.LookupDirectoryEntriesRequest{Requests: []*filer_pb.LookupDirectoryEntryRequest{nil}}, wantCode: codes.InvalidArgument},
+		{name: "relative directory", req: &filer_pb.LookupDirectoryEntriesRequest{Requests: []*filer_pb.LookupDirectoryEntryRequest{{Directory: "batch", Name: "key"}}}, wantCode: codes.InvalidArgument},
+		{name: "empty name", req: &filer_pb.LookupDirectoryEntriesRequest{Requests: []*filer_pb.LookupDirectoryEntryRequest{{Directory: "/batch"}}}, wantCode: codes.InvalidArgument},
+		{name: "nested name", req: &filer_pb.LookupDirectoryEntriesRequest{Requests: []*filer_pb.LookupDirectoryEntryRequest{{Directory: "/batch", Name: "a/b"}}}, wantCode: codes.InvalidArgument},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			called := false
+			_, err := lookupDirectoryEntries(context.Background(), tt.req, 17,
+				func(context.Context, util.FullPath) (*filer.Entry, int64, error) {
+					called = true
+					return nil, 0, nil
+				},
+				func(context.Context, []string) (map[string][]wdclient.Location, error) {
+					called = true
+					return nil, nil
+				},
+			)
+			if status.Code(err) != tt.wantCode {
+				t.Fatalf("error code = %v, want %v: %v", status.Code(err), tt.wantCode, err)
+			}
+			if called {
+				t.Fatal("invalid request reached lookup implementation")
+			}
+		})
+	}
+}
+
+func TestLookupDirectoryEntriesAcceptsMaximumBatch(t *testing.T) {
+	req := repeatedBatchLookupRequest(maxFilerBatchLookupRequests, &filer_pb.LookupDirectoryEntryRequest{
+		Directory: "/batch",
+		Name:      "key",
+	})
+	response, err := lookupDirectoryEntries(context.Background(), req, 13,
+		func(context.Context, util.FullPath) (*filer.Entry, int64, error) {
+			return nil, 99, filer_pb.ErrNotFound
+		},
+		func(context.Context, []string) (map[string][]wdclient.Location, error) {
+			t.Fatal("volume lookup called for an all-miss batch")
+			return nil, nil
+		},
+	)
+	if err != nil {
+		t.Fatalf("maximum-sized batch failed: %v", err)
+	}
+	if got := len(response.Results); got != maxFilerBatchLookupRequests {
+		t.Fatalf("result count = %d, want %d", got, maxFilerBatchLookupRequests)
+	}
+	for _, index := range []int{0, maxFilerBatchLookupRequests - 1} {
+		if got := response.Results[index]; got.LogTsNs != 99 || got.LogSignature != 13 {
+			t.Fatalf("miss fence[%d] = (%d,%d), want (99,13)", index, got.LogTsNs, got.LogSignature)
+		}
+	}
+}
+
+func TestLookupDirectoryEntriesUsesFilerSignatureForFoundAndMiss(t *testing.T) {
+	store := newRenameTestStore()
+	if err := store.InsertEntry(context.Background(), newFileEntry("/batch/found", 1)); err != nil {
+		t.Fatalf("seed entry: %v", err)
+	}
+	testFiler := newRenameTestFiler(t, store)
+	testFiler.Signature = 73
+	server := &FilerServer{
+		filer:          testFiler,
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+
+	response, err := server.LookupDirectoryEntries(context.Background(), &filer_pb.LookupDirectoryEntriesRequest{
+		Requests: []*filer_pb.LookupDirectoryEntryRequest{
+			{Directory: "/batch", Name: "found"},
+			{Directory: "/batch", Name: "missing"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("batch lookup: %v", err)
+	}
+	if !response.Results[0].Found || response.Results[1].Found {
+		t.Fatalf("unexpected found states: %v, %v", response.Results[0].Found, response.Results[1].Found)
+	}
+	for index, result := range response.Results {
+		if result.LogSignature != 73 || result.LogTsNs == 0 {
+			t.Fatalf("result[%d] fence = (%d,%d), want nonzero timestamp and signature 73", index, result.LogTsNs, result.LogSignature)
+		}
+	}
+}
+
+func TestPopulateBatchReadAuthMintsExactFidCapabilities(t *testing.T) {
+	response := &filer_pb.LookupDirectoryEntriesResponse{Results: []*filer_pb.LookupDirectoryEntryResult{
+		{Found: true, Entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{
+			{FileId: "7,abc"}, {FileId: "8,def"}, {FileId: "7,abc"},
+		}}},
+		{Found: false},
+	}}
+	populateBatchReadAuth(response, func(fid string) string { return "jwt:" + fid })
+	if !reflect.DeepEqual(response.ReadAuth, map[string]string{
+		"7,abc": "jwt:7,abc",
+		"8,def": "jwt:8,def",
+	}) {
+		t.Fatalf("read auth = %#v", response.ReadAuth)
+	}
+}
+
+func TestPopulateBatchReadAuthDoesNotInventCapabilitiesWhenSigningIsDisabled(t *testing.T) {
+	response := &filer_pb.LookupDirectoryEntriesResponse{Results: []*filer_pb.LookupDirectoryEntryResult{
+		{Found: true, Entry: &filer_pb.Entry{Chunks: []*filer_pb.FileChunk{{FileId: "7,abc"}}}},
+	}}
+	populateBatchReadAuth(response, func(string) string { return "" })
+	if len(response.ReadAuth) != 0 {
+		t.Fatalf("read auth must be empty without a signing key: %#v", response.ReadAuth)
+	}
+}
+
+func TestLookupDirectoryEntriesPreservesOrderBoundsParallelismAndDeduplicatesVolumes(t *testing.T) {
+	const requestCount = 96
+	requests := make([]*filer_pb.LookupDirectoryEntryRequest, requestCount)
+	for index := range requests {
+		requests[index] = &filer_pb.LookupDirectoryEntryRequest{
+			Directory: "/batch",
+			Name:      fmt.Sprintf("item-%03d", index),
+		}
+	}
+
+	var active atomic.Int32
+	var activeMax atomic.Int32
+	findEntry := func(_ context.Context, path util.FullPath) (*filer.Entry, int64, error) {
+		index, err := strconv.Atoi(strings.TrimPrefix(string(path), "/batch/item-"))
+		if err != nil {
+			return nil, 0, err
+		}
+		current := active.Add(1)
+		defer active.Add(-1)
+		for {
+			previous := activeMax.Load()
+			if current <= previous || activeMax.CompareAndSwap(previous, current) {
+				break
+			}
+		}
+		// Reverse completion order within each wave so append-based implementations fail.
+		time.Sleep(time.Duration(requestCount-index) * 50 * time.Microsecond)
+		if index == 7 {
+			return nil, int64(1000 + index), errors.New("lookup failed")
+		}
+		if index == 11 {
+			return nil, int64(1000 + index), filer_pb.ErrNotFound
+		}
+		volumeID := uint32(index%3 + 1)
+		chunk := &filer_pb.FileChunk{Fid: &filer_pb.FileId{VolumeId: volumeID, FileKey: uint64(index + 1), Cookie: 17}}
+		if index == 5 {
+			chunk = &filer_pb.FileChunk{FileId: "2,0294cbb9892b"}
+		}
+		return &filer.Entry{FullPath: path, Chunks: []*filer_pb.FileChunk{chunk, chunk}}, int64(1000 + index), nil
+	}
+
+	volumeLookupCalls := 0
+	var lookedUpVolumeIDs []string
+	lookupVolumes := func(_ context.Context, volumeIDs []string) (map[string][]wdclient.Location, error) {
+		volumeLookupCalls++
+		lookedUpVolumeIDs = append([]string(nil), volumeIDs...)
+		return map[string][]wdclient.Location{
+			"1": {{Url: "volume-1:8080"}},
+			"2": {{Url: "volume-2:8080"}},
+			"3": {{Url: "volume-3:8080"}},
+		}, nil
+	}
+
+	const logSignature = 0x1234
+	response, err := lookupDirectoryEntries(context.Background(), &filer_pb.LookupDirectoryEntriesRequest{Requests: requests}, logSignature, findEntry, lookupVolumes)
+	if err != nil {
+		t.Fatalf("batch lookup: %v", err)
+	}
+	if got := activeMax.Load(); got <= 1 || got > maxFilerBatchLookupWorkers {
+		t.Fatalf("parallel workers peaked at %d, want 2..%d", got, maxFilerBatchLookupWorkers)
+	}
+	if volumeLookupCalls != 1 {
+		t.Fatalf("volume lookup calls = %d, want 1", volumeLookupCalls)
+	}
+	if want := []string{"1", "2", "3"}; !reflect.DeepEqual(lookedUpVolumeIDs, want) {
+		t.Fatalf("volume IDs = %v, want %v", lookedUpVolumeIDs, want)
+	}
+	if got := len(response.LocationsMap); got != 3 {
+		t.Fatalf("location map size = %d, want 3", got)
+	}
+
+	for index, result := range response.Results {
+		if result.LogTsNs != int64(1000+index) || result.LogSignature != logSignature {
+			t.Fatalf("result[%d] fence = (%d,%d), want (%d,%d)", index, result.LogTsNs, result.LogSignature, 1000+index, logSignature)
+		}
+		switch index {
+		case 7:
+			if result.Found || result.Entry != nil || result.Error != "lookup failed" {
+				t.Fatalf("error result[%d] = %+v", index, result)
+			}
+		case 11:
+			if result.Found || result.Entry != nil || result.Error != "" {
+				t.Fatalf("not-found result[%d] = %+v", index, result)
+			}
+		default:
+			if !result.Found || result.Entry == nil || result.Error != "" {
+				t.Fatalf("found result[%d] = %+v", index, result)
+			}
+			if want := fmt.Sprintf("item-%03d", index); result.Entry.Name != want {
+				t.Fatalf("result[%d] name = %q, want %q", index, result.Entry.Name, want)
+			}
+		}
+	}
+}
+
+func TestLookupDirectoryEntriesMarksEntriesWithUnavailableVolumes(t *testing.T) {
+	response, err := lookupDirectoryEntries(context.Background(), &filer_pb.LookupDirectoryEntriesRequest{
+		Requests: []*filer_pb.LookupDirectoryEntryRequest{{Directory: "/batch", Name: "key"}},
+	}, 42, func(_ context.Context, path util.FullPath) (*filer.Entry, int64, error) {
+		return &filer.Entry{
+			FullPath: path,
+			Chunks: []*filer_pb.FileChunk{{
+				Fid: &filer_pb.FileId{VolumeId: 9, FileKey: 1, Cookie: 2},
+			}},
+		}, 123, nil
+	}, func(_ context.Context, volumeIDs []string) (map[string][]wdclient.Location, error) {
+		if !sort.StringsAreSorted(volumeIDs) {
+			t.Fatalf("volume IDs are not sorted: %v", volumeIDs)
+		}
+		return nil, errors.New("master unavailable")
+	})
+	if err != nil {
+		t.Fatalf("batch lookup: %v", err)
+	}
+	result := response.Results[0]
+	if result.LogTsNs != 123 || result.LogSignature != 42 {
+		t.Fatalf("result fence = (%d,%d), want (123,42)", result.LogTsNs, result.LogSignature)
+	}
+	if !result.Found || result.Entry == nil {
+		t.Fatalf("metadata result lost when volume lookup failed: %+v", result)
+	}
+	if !strings.Contains(result.Error, "volume 9 has no locations") || !strings.Contains(result.Error, "master unavailable") {
+		t.Fatalf("result error = %q", result.Error)
+	}
+	locations, ok := response.LocationsMap["9"]
+	if !ok || locations == nil || len(locations.Locations) != 0 {
+		t.Fatalf("missing volume map entry = %#v, present=%v", locations, ok)
+	}
+}
+
+func TestLookupDirectoryEntriesKeepsMalformedEntryError(t *testing.T) {
+	response, err := lookupDirectoryEntries(context.Background(), &filer_pb.LookupDirectoryEntriesRequest{
+		Requests: []*filer_pb.LookupDirectoryEntryRequest{{Directory: "/batch", Name: "key"}},
+	}, 42, func(_ context.Context, path util.FullPath) (*filer.Entry, int64, error) {
+		return &filer.Entry{
+			FullPath: path,
+			Chunks: []*filer_pb.FileChunk{
+				{Fid: &filer_pb.FileId{VolumeId: 9, FileKey: 1, Cookie: 2}},
+				{FileId: "not-a-file-id"},
+			},
+		}, 123, nil
+	}, func(context.Context, []string) (map[string][]wdclient.Location, error) {
+		return map[string][]wdclient.Location{}, nil
+	})
+	if err != nil {
+		t.Fatalf("batch lookup: %v", err)
+	}
+	result := response.Results[0]
+	if !result.Found || result.Entry == nil || !strings.Contains(result.Error, "invalid file id") {
+		t.Fatalf("malformed entry was reported as a clean miss: %+v", result)
+	}
+}
+
+func cacheVolumeEntry(_ context.Context, path util.FullPath) (*filer.Entry, int64, error) {
+	return &filer.Entry{
+		FullPath: path,
+		Chunks: []*filer_pb.FileChunk{{
+			Fid: &filer_pb.FileId{VolumeId: 9, FileKey: 1, Cookie: 2},
+		}},
+	}, 123, nil
+}
+
+func TestLookupDirectoryEntriesCanTreatRetiredCacheVolumeAsMiss(t *testing.T) {
+	response, err := lookupDirectoryEntries(context.Background(), &filer_pb.LookupDirectoryEntriesRequest{
+		Requests:                []*filer_pb.LookupDirectoryEntryRequest{{Directory: "/batch", Name: "key"}},
+		UnavailableVolumeIsMiss: true,
+	}, 42, cacheVolumeEntry, func(_ context.Context, volumeIDs []string) (map[string][]wdclient.Location, error) {
+		// The master answered and left volume 9 out.
+		return map[string][]wdclient.Location{}, errors.New("volume 9: volume id 9 not found")
+	})
+	if err != nil {
+		t.Fatalf("batch lookup: %v", err)
+	}
+	result := response.Results[0]
+	if result.Found || result.Entry != nil || result.Error != "" {
+		t.Fatalf("retired cache volume did not become a clean miss: %+v", result)
+	}
+	if result.LogTsNs != 123 || result.LogSignature != 42 {
+		t.Fatalf("miss fence = (%d,%d), want (123,42)", result.LogTsNs, result.LogSignature)
+	}
+	if _, exists := response.LocationsMap["9"]; exists {
+		t.Fatalf("cache miss returned an unusable location: %#v", response.LocationsMap["9"])
+	}
+}
+
+func TestLookupDirectoryEntriesKeepsCacheEntryWhenMasterIsUnreachable(t *testing.T) {
+	response, err := lookupDirectoryEntries(context.Background(), &filer_pb.LookupDirectoryEntriesRequest{
+		Requests:                []*filer_pb.LookupDirectoryEntryRequest{{Directory: "/batch", Name: "key"}},
+		UnavailableVolumeIsMiss: true,
+	}, 42, cacheVolumeEntry, func(context.Context, []string) (map[string][]wdclient.Location, error) {
+		return nil, errors.New("master unavailable")
+	})
+	if err != nil {
+		t.Fatalf("batch lookup: %v", err)
+	}
+	result := response.Results[0]
+	if !result.Found || result.Entry == nil {
+		t.Fatalf("unanswered lookup was reported as a miss: %+v", result)
+	}
+	if !strings.Contains(result.Error, "volume 9 has no locations") || !strings.Contains(result.Error, "master unavailable") {
+		t.Fatalf("result error = %q", result.Error)
+	}
+	locations, ok := response.LocationsMap["9"]
+	if !ok || locations == nil || len(locations.Locations) != 0 {
+		t.Fatalf("unresolved volume map entry = %#v, present=%v", locations, ok)
+	}
+}
+
+func TestLookupDirectoryEntriesKeepsMalformedEntryErrorInCacheMode(t *testing.T) {
+	response, err := lookupDirectoryEntries(context.Background(), &filer_pb.LookupDirectoryEntriesRequest{
+		Requests:                []*filer_pb.LookupDirectoryEntryRequest{{Directory: "/batch", Name: "key"}},
+		UnavailableVolumeIsMiss: true,
+	}, 42, func(_ context.Context, path util.FullPath) (*filer.Entry, int64, error) {
+		return &filer.Entry{
+			FullPath: path,
+			Chunks: []*filer_pb.FileChunk{
+				{Fid: &filer_pb.FileId{VolumeId: 9, FileKey: 1, Cookie: 2}},
+				{FileId: "not-a-file-id"},
+			},
+		}, 123, nil
+	}, func(context.Context, []string) (map[string][]wdclient.Location, error) {
+		return map[string][]wdclient.Location{}, nil
+	})
+	if err != nil {
+		t.Fatalf("batch lookup: %v", err)
+	}
+	result := response.Results[0]
+	if !result.Found || result.Entry == nil || !strings.Contains(result.Error, "invalid file id") {
+		t.Fatalf("malformed entry was reported as a clean miss: %+v", result)
+	}
+}
+
+func TestCacheBatchLookupSelectsAuthoritativeVolumeLocations(t *testing.T) {
+	cachedCalls, authoritativeCalls := 0, 0
+	cached := func(context.Context, []string) (map[string][]wdclient.Location, error) {
+		cachedCalls++
+		return map[string][]wdclient.Location{"9": {{Url: "retired-volume:8080"}}}, nil
+	}
+	authoritative := func(context.Context, []string) (map[string][]wdclient.Location, error) {
+		authoritativeCalls++
+		return nil, nil
+	}
+
+	lookup := selectFilerBatchVolumeLookup(&filer_pb.LookupDirectoryEntriesRequest{
+		UnavailableVolumeIsMiss: true,
+	}, cached, authoritative)
+	locations, err := lookup(context.Background(), []string{"9"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cachedCalls != 0 || authoritativeCalls != 1 || len(locations) != 0 {
+		t.Fatalf("cache lookup used stale path: cached=%d authoritative=%d locations=%v", cachedCalls, authoritativeCalls, locations)
+	}
+
+	lookup = selectFilerBatchVolumeLookup(&filer_pb.LookupDirectoryEntriesRequest{}, cached, authoritative)
+	if _, err := lookup(context.Background(), []string{"9"}); err != nil {
+		t.Fatal(err)
+	}
+	if cachedCalls != 1 || authoritativeCalls != 1 {
+		t.Fatalf("ordinary lookup did not keep cached path: cached=%d authoritative=%d", cachedCalls, authoritativeCalls)
+	}
+}
+
+func repeatedBatchLookupRequest(count int, request *filer_pb.LookupDirectoryEntryRequest) *filer_pb.LookupDirectoryEntriesRequest {
+	requests := make([]*filer_pb.LookupDirectoryEntryRequest, count)
+	for index := range requests {
+		requests[index] = &filer_pb.LookupDirectoryEntryRequest{
+			Directory: request.Directory,
+			Name:      request.Name,
+		}
+	}
+	return &filer_pb.LookupDirectoryEntriesRequest{Requests: requests}
+}
diff --git a/weed/server/filer_grpc_server_cleanup_chunks_test.go b/weed/server/filer_grpc_server_cleanup_chunks_test.go
new file mode 100644
index 0000000000..7aeef26fd4
--- /dev/null
+++ b/weed/server/filer_grpc_server_cleanup_chunks_test.go
@@ -0,0 +1,47 @@
+package weed_server
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A CreateEntry whose context is cancelled before its chunks are compacted must
+// fail the request and store nothing, rather than panic in CompactFileChunks.
+func TestCreateEntryCancelledContextFailsRequest(t *testing.T) {
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+
+	fs := &FilerServer{
+		filer:          f,
+		option:         &FilerOption{},
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	_, err := fs.CreateEntry(ctx, &filer_pb.CreateEntryRequest{
+		Directory:                "/test",
+		SkipCheckParentDirectory: true,
+		Entry: &filer_pb.Entry{
+			Name:       "obj",
+			Attributes: &filer_pb.FuseAttributes{Mtime: 1700000000, FileMode: 0644, Inode: 1},
+			Chunks: []*filer_pb.FileChunk{
+				{FileId: "1,01", Offset: 0, Size: 100, ModifiedTsNs: 1},
+			},
+		},
+	})
+	if err == nil || !strings.Contains(err.Error(), "CompactFileChunks: "+context.Canceled.Error()) {
+		t.Fatalf("err = %v, want CompactFileChunks to fail with context canceled", err)
+	}
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+	if _, found := store.entries["/test/obj"]; found {
+		t.Fatal("entry was stored despite the failed request")
+	}
+}
diff --git a/weed/server/filer_grpc_server_condition.go b/weed/server/filer_grpc_server_condition.go
index 82406c367e..dfb8039323 100644
--- a/weed/server/filer_grpc_server_condition.go
+++ b/weed/server/filer_grpc_server_condition.go
@@ -8,6 +8,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/protobuf/proto"
 )
 
 // conditionIsSet reports whether a condition asks for any check at all.
@@ -82,6 +83,18 @@ func clauseSatisfied(c *filer_pb.WriteCondition_Clause, current *filer.Entry) bo
 		return deadline <= time.Now().Unix()
 	case filer_pb.WriteCondition_IF_CHUNKS_EQUAL:
 		return chunkFidsEqual(current, c.Fids)
+	case filer_pb.WriteCondition_IF_ENTRY_EQUAL:
+		if !exists || c.ExpectedEntry == nil {
+			return !exists && c.ExpectedEntry == nil
+		}
+		// Compare both sides in serialized form on clones: chunks are matched
+		// by their fid only — the stored entry may carry the restored file_id
+		// while an expected one built from a metadata event does not.
+		expected := proto.Clone(c.ExpectedEntry).(*filer_pb.Entry)
+		filer_pb.BeforeEntrySerialization(expected.Chunks)
+		actual := proto.Clone(current.ToProtoEntry()).(*filer_pb.Entry)
+		filer_pb.BeforeEntrySerialization(actual.Chunks)
+		return proto.Equal(actual, filer.FromPbEntry("", expected).ToProtoEntry())
 	default:
 		// An unrecognized clause kind (e.g. from a newer client) must not be
 		// treated as satisfied, which would silently bypass the guard. Fail
diff --git a/weed/server/filer_grpc_server_condition_test.go b/weed/server/filer_grpc_server_condition_test.go
index 66906fafba..89086a5645 100644
--- a/weed/server/filer_grpc_server_condition_test.go
+++ b/weed/server/filer_grpc_server_condition_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
 )
 
 func entryWithETag(etag string, mtime time.Time) *filer.Entry {
@@ -193,6 +194,58 @@ func TestWriteConditionUnknownKindFailsClosed(t *testing.T) {
 	}
 }
 
+// IF_ENTRY_EQUAL compares the expected entry after the same normalization
+// FindEntry applied to the stored one: a raw event entry whose FileSize is
+// still zero must match a stored entry grown to its chunk extent.
+func TestIfEntryEqualNormalizesExpected(t *testing.T) {
+	raw := &filer_pb.Entry{
+		Name:       "f",
+		Attributes: &filer_pb.FuseAttributes{Mtime: 42},
+		Chunks: []*filer_pb.FileChunk{
+			{Fid: &filer_pb.FileId{VolumeId: 3, FileKey: 1, Cookie: 2}, Size: 100},
+		},
+	}
+	stored := filer.FromPbEntry("/d", raw)
+	if stored.FileSize != 100 {
+		t.Fatalf("stored FileSize = %d, want chunk extent 100", stored.FileSize)
+	}
+	cond := one(&filer_pb.WriteCondition_Clause{
+		Kind:          filer_pb.WriteCondition_IF_ENTRY_EQUAL,
+		ExpectedEntry: raw,
+	})
+	if !writeConditionSatisfied(cond, stored) {
+		t.Error("raw expected entry must equal its normalized stored form")
+	}
+	raw.Attributes.Mtime = 43
+	if writeConditionSatisfied(cond, stored) {
+		t.Error("changed expected entry must not equal the stored entry")
+	}
+}
+
+// A stamp built from the metadata-log event carries chunks in serialized
+// form (file_id moved into fid), while the stored entry came through
+// FindEntry which restores file_id. The comparison must still match.
+func TestIfEntryEqualSerializedExpected(t *testing.T) {
+	serialized := &filer_pb.Entry{
+		Name:       "f",
+		Attributes: &filer_pb.FuseAttributes{Mtime: 42},
+		Chunks: []*filer_pb.FileChunk{
+			{Fid: &filer_pb.FileId{VolumeId: 3, FileKey: 1, Cookie: 2}, Size: 100},
+		},
+	}
+	storedProto := proto.Clone(serialized).(*filer_pb.Entry)
+	filer_pb.AfterEntryDeserialization(storedProto.Chunks)
+	stored := filer.FromPbEntry("/d", storedProto)
+
+	cond := one(&filer_pb.WriteCondition_Clause{
+		Kind:          filer_pb.WriteCondition_IF_ENTRY_EQUAL,
+		ExpectedEntry: serialized,
+	})
+	if !writeConditionSatisfied(cond, stored) {
+		t.Error("serialized expected entry must equal the deserialized stored entry")
+	}
+}
+
 // storedEntryETag prefers the stored Seaweed ETag attribute and falls back to
 // the Md5-derived ETag, matching the S3 gateway.
 func TestStoredEntryETag(t *testing.T) {
diff --git a/weed/server/filer_grpc_server_create_route_test.go b/weed/server/filer_grpc_server_create_route_test.go
new file mode 100644
index 0000000000..0c266c5397
--- /dev/null
+++ b/weed/server/filer_grpc_server_create_route_test.go
@@ -0,0 +1,234 @@
+package weed_server
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// createRouteServer builds a filer whose ring holds two unreachable peers, so a
+// forwarded create fails at the dial and is distinguishable from a local apply.
+func createRouteServer(t *testing.T) (*FilerServer, *renameTestStore) {
+	t.Helper()
+	const self = pb.ServerAddress("127.0.0.1:18888")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	f.DirBucketsPath = "/buckets"
+	f.Dlm = lock_manager.NewDistributedLockManager(self)
+	f.Dlm.LockRing.SetSnapshot([]pb.ServerAddress{self, "127.0.0.1:18889"}, 1)
+	return &FilerServer{
+		filer:          f,
+		option:         &FilerOption{Host: self},
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}, store
+}
+
+// peerOwnedName returns a child name under /test whose entry the ring assigns to
+// the peer, so a routed create must leave this filer.
+func peerOwnedName(t *testing.T, fs *FilerServer) string {
+	t.Helper()
+	for i := 0; i < 4000; i++ {
+		name := fmt.Sprintf("obj-%d", i)
+		key := entryRouteKey(util.NewFullPath("/test", name))
+		if fs.filer.Dlm.LockRing.GetPrimary(key) != fs.option.Host {
+			return name
+		}
+	}
+	t.Skip("no name owned by the peer")
+	return ""
+}
+
+func createReq(name string, oExcl bool) *filer_pb.CreateEntryRequest {
+	return &filer_pb.CreateEntryRequest{
+		Directory:                "/test",
+		OExcl:                    oExcl,
+		SkipCheckParentDirectory: true,
+		Entry: &filer_pb.Entry{
+			Name:       name,
+			Attributes: &filer_pb.FuseAttributes{Mtime: 1700000000, FileMode: 0644, Inode: 1},
+		},
+	}
+}
+
+// An exclusive create for a peer-owned path must leave this filer rather than
+// take the local lock, whose arbitration would not bind the other filers.
+func TestCreateEntryExclusiveLeavesNonOwner(t *testing.T) {
+	fs, store := createRouteServer(t)
+	name := peerOwnedName(t, fs)
+
+	_, err := fs.CreateEntry(context.Background(), createReq(name, true))
+	if err == nil {
+		t.Fatal("exclusive create on a non-owner must not be applied locally")
+	}
+	if _, found := store.entries[string(util.NewFullPath("/test", name))]; found {
+		t.Fatal("forwarded create must not also write locally")
+	}
+}
+
+// Plain creates are upserts whichever filer applies them, so routing them would
+// buy nothing and cost a hop.
+func TestCreateEntryPlainStaysLocal(t *testing.T) {
+	fs, store := createRouteServer(t)
+	name := peerOwnedName(t, fs)
+
+	resp, err := fs.CreateEntry(context.Background(), createReq(name, false))
+	if err != nil || resp.Error != "" {
+		t.Fatalf("plain create must be applied locally, got err=%v resp=%v", err, resp.Error)
+	}
+	if _, found := store.entries[string(util.NewFullPath("/test", name))]; !found {
+		t.Fatal("plain create must reach the local store")
+	}
+}
+
+// ringPeerCtx simulates a request arriving over a connection from a ring
+// member, the provenance an is_moved marker needs before it is trusted.
+func ringPeerCtx() context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{
+		Addr: &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 49999},
+	})
+}
+
+// is_moved bounds forwarding to one hop: the owner applies it even if its own
+// ring view says someone else owns the key.
+func TestCreateEntryMovedAppliesLocally(t *testing.T) {
+	fs, store := createRouteServer(t)
+	name := peerOwnedName(t, fs)
+
+	req := createReq(name, true)
+	req.IsMoved = true
+	resp, err := fs.CreateEntry(ringPeerCtx(), req)
+	if err != nil || resp.Error != "" {
+		t.Fatalf("forwarded create must be applied locally, got err=%v resp=%v", err, resp.Error)
+	}
+	if _, found := store.entries[string(util.NewFullPath("/test", name))]; !found {
+		t.Fatal("forwarded create must reach the local store")
+	}
+}
+
+// A caller can set is_moved, but without a ring member's connection it is not
+// trusted: on a non-owner the request is refused rather than evaluated under
+// the wrong lock or forwarded again, where it could cycle while rings disagree.
+func TestCreateEntryMovedFromClientIsNotTrusted(t *testing.T) {
+	fs, store := createRouteServer(t)
+	name := peerOwnedName(t, fs)
+
+	req := createReq(name, true)
+	req.IsMoved = true
+	_, err := fs.CreateEntry(context.Background(), req)
+	if status.Code(err) != codes.PermissionDenied {
+		t.Fatalf("a forged is_moved must be refused, got err=%v", err)
+	}
+	if _, found := store.entries[string(util.NewFullPath("/test", name))]; found {
+		t.Fatal("a forged is_moved must not cause a local write")
+	}
+}
+
+// Forwarding an unlock to an unreachable owner must surface the RPC error, not
+// panic dereferencing the nil response of the failed call.
+func TestDistributedUnlockFailedForwardReturnsError(t *testing.T) {
+	fs, _ := createRouteServer(t)
+
+	var name string
+	for i := 0; i < 4000; i++ {
+		candidate := fmt.Sprintf("lock-%d", i)
+		if fs.filer.Dlm.LockRing.GetPrimary(candidate) != fs.option.Host {
+			name = candidate
+			break
+		}
+	}
+	if name == "" {
+		t.Skip("no lock owned by the peer")
+	}
+
+	resp, err := fs.DistributedUnlock(context.Background(), &filer_pb.UnlockRequest{
+		Name:       name,
+		RenewToken: "tok",
+	})
+	if err != nil {
+		t.Fatalf("unlock forward should report via resp.Error, not err: %v", err)
+	}
+	if resp.Error == "" {
+		t.Fatal("a failed forward must surface an error")
+	}
+}
+
+// An exclusive create this filer owns is applied locally, under its per-path lock.
+func TestCreateEntryExclusiveAppliedByOwner(t *testing.T) {
+	fs, store := createRouteServer(t)
+	var name string
+	for i := 0; i < 4000 && name == ""; i++ {
+		candidate := fmt.Sprintf("obj-%d", i)
+		key := entryRouteKey(util.NewFullPath("/test", candidate))
+		if fs.filer.Dlm.LockRing.GetPrimary(key) == fs.option.Host {
+			name = candidate
+		}
+	}
+	if name == "" {
+		t.Skip("no name owned by this filer")
+	}
+
+	resp, err := fs.CreateEntry(context.Background(), createReq(name, true))
+	if err != nil || resp.Error != "" {
+		t.Fatalf("owner must apply the create, got err=%v resp=%v", err, resp.Error)
+	}
+	if _, found := store.entries[string(util.NewFullPath("/test", name))]; !found {
+		t.Fatal("owner's create must reach the local store")
+	}
+}
+
+// A key still inside the cooling-off window belongs to its prior owner. If that
+// filer cannot be reached the create fails: it may be partitioned rather than
+// down, and applying here would be the second serialization point on the key.
+func TestCreateEntryFailsWhenPriorOwnerIsUnreachable(t *testing.T) {
+	const self = pb.ServerAddress("127.0.0.1:28888")
+	const peer = pb.ServerAddress("127.0.0.1:28889")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	f.DirBucketsPath = "/buckets"
+	f.Dlm = lock_manager.NewDistributedLockManager(self)
+	// Dropping the peer moves every key it owned to this filer, with the peer as
+	// their prior owner — and nothing is listening on it.
+	f.Dlm.LockRing.SetSnapshot([]pb.ServerAddress{self, peer}, 1)
+	f.Dlm.LockRing.SetSnapshot([]pb.ServerAddress{self}, 2)
+	fs := &FilerServer{
+		filer:          f,
+		option:         &FilerOption{Host: self},
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+
+	var name string
+	for i := 0; i < 4000 && name == ""; i++ {
+		candidate := fmt.Sprintf("obj-%d", i)
+		if fs.filer.Dlm.LockRing.PriorOwner(entryRouteKey(util.NewFullPath("/test", candidate))) == peer {
+			name = candidate
+		}
+	}
+	if name == "" {
+		t.Skip("no key whose prior owner is the departed peer")
+	}
+
+	resp, err := fs.CreateEntry(context.Background(), createReq(name, true))
+	if err == nil {
+		t.Fatalf("unreachable prior owner must fail the create, got resp=%v", resp)
+	}
+	if resp == nil {
+		t.Fatal("a failed create must still answer with a response, not nil")
+	}
+	if _, found := store.entries[string(util.NewFullPath("/test", name))]; found {
+		t.Fatal("a create routed away must not also write locally")
+	}
+}
diff --git a/weed/server/filer_grpc_server_dlm.go b/weed/server/filer_grpc_server_dlm.go
index 3ff9b5f44f..dc2864818d 100644
--- a/weed/server/filer_grpc_server_dlm.go
+++ b/weed/server/filer_grpc_server_dlm.go
@@ -29,8 +29,10 @@ func (fs *FilerServer) DistributedLock(ctx context.Context, req *filer_pb.LockRe
 	glog.V(4).Infof("FILER LOCK: LockWithTimeout result - name=%s lockOwner=%s renewToken=%s movedTo=%s err=%v",
 		req.Name, resp.LockOwner, resp.RenewToken, movedTo, err)
 	glog.V(4).Infof("lock %s %v %v %v, isMoved=%v %v", req.Name, req.SecondsToLock, req.RenewToken, req.Owner, req.IsMoved, movedTo)
-	if movedTo != "" && movedTo != fs.option.Host && !req.IsMoved {
-		glog.V(0).Infof("FILER LOCK: Forwarding to correct filer - from=%s to=%s", fs.option.Host, movedTo)
+	if mErr := fs.checkMovedMarker(ctx, req.IsMoved, movedTo); mErr != nil {
+		err = mErr
+	} else if !req.IsMoved && movedTo != "" && movedTo != fs.option.Host {
+		glog.V(3).Infof("FILER LOCK: Forwarding to correct filer - from=%s to=%s", fs.option.Host, movedTo)
 		err = pb.WithFilerClient(false, 0, movedTo, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
 			secondResp, err := client.DistributedLock(ctx, &filer_pb.LockRequest{
 				Name:          req.Name,
@@ -44,7 +46,9 @@ func (fs *FilerServer) DistributedLock(ctx context.Context, req *filer_pb.LockRe
 				resp.LockOwner = secondResp.LockOwner
 				resp.Error = secondResp.Error
 				resp.Generation = secondResp.Generation
-				glog.V(0).Infof("FILER LOCK: Forwarded lock acquired - name=%s renewToken=%s", req.Name, resp.RenewToken)
+				if forwardedLockAcquired(secondResp) {
+					glog.V(3).Infof("FILER LOCK: Forwarded lock acquired - name=%s renewToken=%s", req.Name, resp.RenewToken)
+				}
 			} else {
 				glog.V(0).Infof("FILER LOCK: Forward failed - name=%s err=%v", req.Name, err)
 			}
@@ -68,6 +72,10 @@ func (fs *FilerServer) DistributedLock(ctx context.Context, req *filer_pb.LockRe
 	return resp, nil
 }
 
+func forwardedLockAcquired(resp *filer_pb.LockResponse) bool {
+	return resp != nil && resp.Error == "" && resp.RenewToken != ""
+}
+
 // Unlock is a grpc handler to handle FilerServer's UnlockRequest
 func (fs *FilerServer) DistributedUnlock(ctx context.Context, req *filer_pb.UnlockRequest) (resp *filer_pb.UnlockResponse, err error) {
 
@@ -76,15 +84,20 @@ func (fs *FilerServer) DistributedUnlock(ctx context.Context, req *filer_pb.Unlo
 	var movedTo pb.ServerAddress
 	movedTo, err = fs.filer.Dlm.Unlock(req.Name, req.RenewToken)
 
-	if !req.IsMoved && movedTo != "" {
+	if mErr := fs.checkMovedMarker(ctx, req.IsMoved, movedTo); mErr != nil {
+		err = mErr
+	} else if !req.IsMoved && movedTo != "" {
 		err = pb.WithFilerClient(false, 0, movedTo, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
 			secondResp, err := client.DistributedUnlock(ctx, &filer_pb.UnlockRequest{
 				Name:       req.Name,
 				RenewToken: req.RenewToken,
 				IsMoved:    true,
 			})
+			if err != nil {
+				return err
+			}
 			resp.Error = secondResp.Error
-			return err
+			return nil
 		})
 	}
 
@@ -101,6 +114,9 @@ func (fs *FilerServer) DistributedUnlock(ctx context.Context, req *filer_pb.Unlo
 
 func (fs *FilerServer) FindLockOwner(ctx context.Context, req *filer_pb.FindLockOwnerRequest) (*filer_pb.FindLockOwnerResponse, error) {
 	owner, movedTo, err := fs.filer.Dlm.FindLockOwner(req.Name)
+	if mErr := fs.checkMovedMarker(ctx, req.IsMoved, movedTo); mErr != nil {
+		return nil, mErr
+	}
 	if !req.IsMoved && movedTo != "" {
 		err = pb.WithFilerClient(false, 0, movedTo, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
 			secondResp, err := client.FindLockOwner(ctx, &filer_pb.FindLockOwnerRequest{
diff --git a/weed/server/filer_grpc_server_dlm_test.go b/weed/server/filer_grpc_server_dlm_test.go
index 5713a9959e..7c82e9faac 100644
--- a/weed/server/filer_grpc_server_dlm_test.go
+++ b/weed/server/filer_grpc_server_dlm_test.go
@@ -34,3 +34,22 @@ func TestFindLockOwnerExpiredLockReturnsNotFound(t *testing.T) {
 	require.True(t, ok)
 	require.Equal(t, codes.NotFound, st.Code())
 }
+
+func TestForwardedLockAcquired(t *testing.T) {
+	tests := []struct {
+		name string
+		resp *filer_pb.LockResponse
+		want bool
+	}{
+		{name: "nil response"},
+		{name: "empty token", resp: &filer_pb.LockResponse{}},
+		{name: "application error", resp: &filer_pb.LockResponse{RenewToken: "token", Error: "lock already owned"}},
+		{name: "acquired", resp: &filer_pb.LockResponse{RenewToken: "token"}, want: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			require.Equal(t, tt.want, forwardedLockAcquired(tt.resp))
+		})
+	}
+}
diff --git a/weed/server/filer_grpc_server_object_txn_test.go b/weed/server/filer_grpc_server_object_txn_test.go
index 2aaa47e7ac..c73badd7a3 100644
--- a/weed/server/filer_grpc_server_object_txn_test.go
+++ b/weed/server/filer_grpc_server_object_txn_test.go
@@ -2,8 +2,11 @@ package weed_server
 
 import (
 	"context"
+	"fmt"
 	"net"
+	"os"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -769,10 +772,11 @@ func TestObjectTransactionRouteKeyOwnerAppliesLocally(t *testing.T) {
 	}
 }
 
-// A forwarded transaction (is_moved) applies locally even when the ring names a
-// different owner: is_moved bounds forwarding to a single hop, so two filers that
-// disagree on the owner during a ring change cannot loop. If is_moved were
-// ignored, this would attempt to dial the bogus owner instead of applying.
+// A forwarded transaction (is_moved over a ring member's connection) applies
+// locally even when the ring names a different owner: is_moved bounds
+// forwarding to a single hop, so two filers that disagree on the owner during
+// a ring change cannot loop. Without the marker this would attempt to dial
+// the bogus owner instead of applying.
 func TestObjectTransactionIsMovedSkipsForward(t *testing.T) {
 	self := pb.ServerAddress("localhost:1")
 	other := pb.ServerAddress("localhost:2")
@@ -781,7 +785,7 @@ func TestObjectTransactionIsMovedSkipsForward(t *testing.T) {
 	})
 	withRing(fs, self, other) // ring owner is "other", not self
 
-	resp, err := fs.ObjectTransaction(context.Background(), &filer_pb.ObjectTransactionRequest{
+	resp, err := fs.ObjectTransaction(ringPeerCtx(), &filer_pb.ObjectTransactionRequest{
 		LockKey:  "/buckets/b/obj",
 		RouteKey: "s3.object.write:/buckets/b/obj",
 		IsMoved:  true,
@@ -851,3 +855,243 @@ func TestObjectTransactionForwardsToOwner(t *testing.T) {
 		t.Errorf("non-owner must forward, not apply locally")
 	}
 }
+
+// A failover replay carries the same request_id. Under the path lock the owner
+// replays the recorded outcome instead of re-applying the mutations over a
+// newer entry.
+func TestObjectTransactionRequestIdDedupesReplay(t *testing.T) {
+	now := time.Unix(1700000000, 0)
+	fs, store := newTxnTestServer(t, nil)
+
+	put := func(etag string) *filer_pb.ObjectMutation {
+		return &filer_pb.ObjectMutation{
+			Type:      filer_pb.ObjectMutation_PUT,
+			Directory: "/buckets/bkt",
+			Entry: &filer_pb.Entry{
+				Name:       "obj",
+				Attributes: &filer_pb.FuseAttributes{Mtime: now.Unix(), FileMode: 0644, Inode: 1},
+				Extended:   map[string][]byte{"etag": []byte(etag)},
+			},
+		}
+	}
+	txn := func(requestID, etag string) *filer_pb.ObjectTransactionRequest {
+		return &filer_pb.ObjectTransactionRequest{
+			LockKey:   "/buckets/bkt/obj",
+			RequestId: requestID,
+			Mutations: []*filer_pb.ObjectMutation{put(etag)},
+		}
+	}
+
+	respA, err := fs.ObjectTransaction(context.Background(), txn("req-a", "A"))
+	if err != nil || respA.Error != "" {
+		t.Fatalf("first put: err=%v resp=%q", err, respA.Error)
+	}
+
+	// a newer writer lands the same path
+	respB, err := fs.ObjectTransaction(context.Background(), txn("req-b", "B"))
+	if err != nil || respB.Error != "" {
+		t.Fatalf("second put: err=%v resp=%q", err, respB.Error)
+	}
+
+	// the replayed request replays A's outcome; the stored entry stays B
+	respReplay, err := fs.ObjectTransaction(context.Background(), txn("req-a", "A"))
+	if err != nil || respReplay.Error != "" {
+		t.Fatalf("replayed put: err=%v resp=%q", err, respReplay.Error)
+	}
+	entry := store.entries["/buckets/bkt/obj"]
+	if entry == nil {
+		t.Fatal("entry missing after replay")
+	}
+	if got := string(entry.Extended["etag"]); got != "B" {
+		t.Fatalf("replayed transaction re-applied the stale entry: etag = %q, want B", got)
+	}
+}
+
+// A recorded application-level failure replays to the retried request even
+// after the world changes enough for the condition to pass, and its mutation
+// still does not run.
+func TestObjectTransactionRequestIdReplaysRecordedError(t *testing.T) {
+	now := time.Unix(1700000000, 0)
+	fs, store := newTxnTestServer(t, nil)
+
+	req := &filer_pb.ObjectTransactionRequest{
+		LockKey:   "/buckets/bkt/obj",
+		RequestId: "req-fail",
+		Condition: &filer_pb.WriteCondition{
+			Clauses: []*filer_pb.WriteCondition_Clause{{Kind: filer_pb.WriteCondition_IF_EXISTS}},
+		},
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type:      filer_pb.ObjectMutation_PUT,
+			Directory: "/buckets/bkt",
+			Entry: &filer_pb.Entry{
+				Name:       "obj",
+				Attributes: &filer_pb.FuseAttributes{Mtime: now.Unix(), FileMode: 0644, Inode: 1},
+				Extended:   map[string][]byte{"etag": []byte("stale")},
+			},
+		}},
+	}
+
+	resp, err := fs.ObjectTransaction(context.Background(), req)
+	if err != nil || resp.ErrorCode != filer_pb.FilerError_PRECONDITION_FAILED {
+		t.Fatalf("precondition: err=%v code=%v", err, resp.GetErrorCode())
+	}
+
+	// another writer lands the object the precondition wanted
+	other := &filer_pb.ObjectTransactionRequest{
+		LockKey:   "/buckets/bkt/obj",
+		RequestId: "req-other",
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type:      filer_pb.ObjectMutation_PUT,
+			Directory: "/buckets/bkt",
+			Entry: &filer_pb.Entry{
+				Name:       "obj",
+				Attributes: &filer_pb.FuseAttributes{Mtime: now.Unix(), FileMode: 0644, Inode: 2},
+				Extended:   map[string][]byte{"etag": []byte("live")},
+			},
+		}},
+	}
+	respOther, err := fs.ObjectTransaction(context.Background(), other)
+	if err != nil || respOther.Error != "" {
+		t.Fatalf("other put: err=%v resp=%q", err, respOther.Error)
+	}
+
+	// the retry replays the recorded failure instead of re-evaluating and
+	// overwriting the live entry
+	resp2, err := fs.ObjectTransaction(context.Background(), req)
+	if err != nil || resp2.ErrorCode != filer_pb.FilerError_PRECONDITION_FAILED {
+		t.Fatalf("replayed precondition: err=%v code=%v", err, resp2.GetErrorCode())
+	}
+	if got := string(store.entries["/buckets/bkt/obj"].Extended["etag"]); got != "live" {
+		t.Fatalf("replayed transaction overwrote the live entry: etag = %q", got)
+	}
+}
+
+// At capacity the cache drops new recordings rather than evicting a live
+// outcome a replay may still need.
+func TestObjectTransactionReplayCacheDropsNewAtCap(t *testing.T) {
+	fs, _ := newTxnTestServer(t, nil)
+	path := util.FullPath("/buckets/bkt/obj")
+	resp := &filer_pb.ObjectTransactionResponse{}
+
+	for i := 0; i < recentObjectTxnSweepCap; i++ {
+		fs.rememberObjectTxn(fmt.Sprintf("req-%d", i), path, resp)
+	}
+	fs.rememberObjectTxn("req-overflow", path, resp)
+
+	if _, found := fs.recentObjectTxn("req-0", path); !found {
+		t.Fatal("a live record was evicted to admit a new one")
+	}
+	if _, found := fs.recentObjectTxn("req-overflow", path); found {
+		t.Fatal("overflow record was recorded instead of dropped")
+	}
+	if len(fs.recentObjectTxns) > recentObjectTxnSweepCap {
+		t.Fatalf("cache exceeded cap: %d", len(fs.recentObjectTxns))
+	}
+}
+
+// A suspended-versioning conditional write falls back to the latest version
+// under the transaction lock: a real latest satisfies existence checks, and a
+// delete marker reads as absent.
+func TestObjectTransactionConditionFallbackResolvesLatestPointer(t *testing.T) {
+	now := time.Unix(1700000000, 0)
+	seed := func(latestName, marker string) map[string]*filer.Entry {
+		entries := map[string]*filer.Entry{
+			"/buckets/bkt/obj/.versions": {
+				Attr:     filer.Attr{Inode: 2, Mtime: now, Crtime: now, Mode: 0755},
+				Extended: map[string][]byte{s3_constants.ExtLatestVersionFileNameKey: []byte(latestName)},
+			},
+		}
+		ext := map[string][]byte{s3_constants.ExtETagKey: []byte("abc")}
+		if marker != "" {
+			ext[s3_constants.ExtDeleteMarkerKey] = []byte(marker)
+		}
+		entries["/buckets/bkt/obj/.versions/"+latestName] = &filer.Entry{
+			Attr:     filer.Attr{Inode: 3, Mtime: now, Crtime: now, Mode: 0644},
+			Extended: ext,
+		}
+		return entries
+	}
+	req := func() *filer_pb.ObjectTransactionRequest {
+		return &filer_pb.ObjectTransactionRequest{
+			LockKey:         "/buckets/bkt/obj",
+			ConditionAltKey: "/buckets/bkt/obj/.versions",
+			Condition: &filer_pb.WriteCondition{
+				Clauses: []*filer_pb.WriteCondition_Clause{{Kind: filer_pb.WriteCondition_IF_NOT_EXISTS}},
+			},
+			Mutations: []*filer_pb.ObjectMutation{{
+				Type:      filer_pb.ObjectMutation_PUT,
+				Directory: "/buckets/bkt",
+				Entry:     &filer_pb.Entry{Name: "obj", Attributes: &filer_pb.FuseAttributes{Mtime: now.Unix(), FileMode: 0644, Inode: 9}},
+			}},
+		}
+	}
+
+	fs, store := newTxnTestServer(t, seed("v_live", ""))
+	resp, err := fs.ObjectTransaction(context.Background(), req())
+	if err != nil || resp.ErrorCode != filer_pb.FilerError_PRECONDITION_FAILED {
+		t.Fatalf("latest version present: err=%v code=%v, want precondition failed", err, resp.GetErrorCode())
+	}
+
+	fs, store = newTxnTestServer(t, seed("v_gone", "true"))
+	resp, err = fs.ObjectTransaction(context.Background(), req())
+	if err != nil || resp.Error != "" {
+		t.Fatalf("delete-marker latest: err=%v resp=%q, want applied", err, resp.Error)
+	}
+	if store.entries["/buckets/bkt/obj"] == nil {
+		t.Fatal("mutation did not apply over a delete-marker latest")
+	}
+}
+
+// A bare directory at the object path — left over when /bkt/obj/child was
+// created — is not the object, so the condition must fall back to the
+// .versions resolution instead of counting the directory as an existing key.
+func TestObjectTransactionConditionIgnoresDirectory(t *testing.T) {
+	now := time.Unix(1700000000, 0)
+	seed := func(marker string) map[string]*filer.Entry {
+		return map[string]*filer.Entry{
+			"/buckets/bkt/obj": {
+				Attr: filer.Attr{Inode: 1, Mtime: now, Crtime: now, Mode: 0755 | os.ModeDir},
+			},
+			"/buckets/bkt/obj/.versions": {
+				Attr:     filer.Attr{Inode: 2, Mtime: now, Crtime: now, Mode: 0755},
+				Extended: map[string][]byte{s3_constants.ExtLatestVersionFileNameKey: []byte("v1")},
+			},
+			"/buckets/bkt/obj/.versions/v1": {
+				Attr:     filer.Attr{Inode: 3, Mtime: now, Crtime: now, Mode: 0644},
+				Extended: map[string][]byte{s3_constants.ExtETagKey: []byte("abc"), s3_constants.ExtDeleteMarkerKey: []byte(marker)},
+			},
+		}
+	}
+	req := &filer_pb.ObjectTransactionRequest{
+		LockKey:         "/buckets/bkt/obj",
+		ConditionAltKey: "/buckets/bkt/obj/.versions",
+		Condition: &filer_pb.WriteCondition{
+			Clauses: []*filer_pb.WriteCondition_Clause{{Kind: filer_pb.WriteCondition_IF_NOT_EXISTS}},
+		},
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type:      filer_pb.ObjectMutation_PUT,
+			Directory: "/buckets/bkt",
+			Entry:     &filer_pb.Entry{Name: "obj", Attributes: &filer_pb.FuseAttributes{Mtime: now.Unix(), FileMode: 0644, Inode: 9}},
+		}},
+	}
+
+	fs, _ := newTxnTestServer(t, seed("true"))
+	resp, err := fs.ObjectTransaction(context.Background(), req)
+	if err != nil {
+		t.Fatalf("directory at key with delete-marker latest: %v", err)
+	}
+	// The condition must pass so the write reaches the type-conflict path;
+	// the directory itself rejects the PUT, which is the caller's business.
+	if resp.ErrorCode == filer_pb.FilerError_PRECONDITION_FAILED {
+		t.Fatalf("condition must not fail on a bare directory: resp=%q", resp.Error)
+	}
+	if !strings.Contains(resp.Error, "is a directory") {
+		t.Fatalf("want the dir/file type-conflict error, got %q", resp.Error)
+	}
+
+	fs, _ = newTxnTestServer(t, seed(""))
+	resp, err = fs.ObjectTransaction(context.Background(), req)
+	if err != nil || resp.ErrorCode != filer_pb.FilerError_PRECONDITION_FAILED {
+		t.Fatalf("directory at key with live latest: err=%v code=%v, want precondition failed", err, resp.GetErrorCode())
+	}
+}
diff --git a/weed/server/filer_grpc_server_posix_lock.go b/weed/server/filer_grpc_server_posix_lock.go
index c7024a8831..869606ac8b 100644
--- a/weed/server/filer_grpc_server_posix_lock.go
+++ b/weed/server/filer_grpc_server_posix_lock.go
@@ -63,26 +63,31 @@ func (fs *FilerServer) PosixLock(ctx context.Context, req *filer_pb.PosixLockReq
 		return &filer_pb.PosixLockResponse{}, fmt.Errorf("lock is required")
 	}
 
-	if !req.IsMoved && fs.filer.Dlm != nil {
+	if fs.filer.Dlm != nil {
 		if owner := fs.filer.Dlm.LockRing.GetPrimary(req.Key); owner != "" && owner != fs.option.Host {
-			forwarded := &filer_pb.PosixLockRequest{
-				Key:     req.Key,
-				IsMoved: true,
-				Op:      req.Op,
-				Lock:    req.Lock,
-				Locks:   req.Locks,
-			}
-			glog.V(4).InfofCtx(ctx, "PosixLock %s op=%v: forwarding to owner %s", req.Key, req.Op, owner)
-			var resp *filer_pb.PosixLockResponse
-			err := pb.WithFilerClient(false, 0, owner, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
-				var e error
-				resp, e = client.PosixLock(ctx, forwarded)
-				return e
-			})
-			if err != nil {
+			if err := fs.checkMovedMarker(ctx, req.IsMoved, owner); err != nil {
 				return &filer_pb.PosixLockResponse{}, err
 			}
-			return resp, nil
+			if !req.IsMoved {
+				forwarded := &filer_pb.PosixLockRequest{
+					Key:     req.Key,
+					IsMoved: true,
+					Op:      req.Op,
+					Lock:    req.Lock,
+					Locks:   req.Locks,
+				}
+				glog.V(4).InfofCtx(ctx, "PosixLock %s op=%v: forwarding to owner %s", req.Key, req.Op, owner)
+				var resp *filer_pb.PosixLockResponse
+				err := pb.WithFilerClient(false, 0, owner, fs.grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
+					var e error
+					resp, e = client.PosixLock(ctx, forwarded)
+					return e
+				})
+				if err != nil {
+					return &filer_pb.PosixLockResponse{}, err
+				}
+				return resp, nil
+			}
 		}
 	}
 
diff --git a/weed/server/filer_grpc_server_remote.go b/weed/server/filer_grpc_server_remote.go
index 930d5c4551..892789fb7f 100644
--- a/weed/server/filer_grpc_server_remote.go
+++ b/weed/server/filer_grpc_server_remote.go
@@ -2,6 +2,7 @@ package weed_server
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"sort"
 	"strings"
@@ -15,8 +16,13 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_objectlock"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -48,7 +54,7 @@ func (fs *FilerServer) CacheRemoteObjectToLocalCluster(ctx context.Context, req
 			glog.V(2).Infof("CacheRemoteObjectToLocalCluster: shared result for %s", cacheKey)
 		}
 		if res.Err != nil {
-			return nil, res.Err
+			return nil, cacheRemoteObjectError(res.Err)
 		}
 		if res.Val == nil {
 			return nil, fmt.Errorf("unexpected nil result from singleflight")
@@ -90,37 +96,11 @@ func (fs *FilerServer) doCacheRemoteObjectToLocalCluster(ctx context.Context, re
 
 	glog.V(1).Infof("CacheRemoteObjectToLocalCluster: caching %s/%s (remote size: %d)", req.Directory, req.Name, entry.Remote.RemoteSize)
 
-	// load all mappings
-	mappingEntry, err := fs.filer.FindEntry(ctx, util.JoinPath(filer.DirectoryEtcRemote, filer.REMOTE_STORAGE_MOUNT_FILE))
+	readDir, readName := fs.filer.RemoteReadPath(entry, req.Directory, req.Name)
+	storageConf, remoteLocation, err := fs.resolveMountedRemote(ctx, readDir, readName)
 	if err != nil {
 		return nil, err
 	}
-	mappings, err := filer.UnmarshalRemoteStorageMappings(mappingEntry.Content)
-	if err != nil {
-		return nil, err
-	}
-
-	// find mapping
-	var remoteStorageMountedLocation *remote_pb.RemoteStorageLocation
-	var localMountedDir string
-	for k, loc := range mappings.Mappings {
-		if strings.HasPrefix(req.Directory, k) {
-			localMountedDir, remoteStorageMountedLocation = k, loc
-		}
-	}
-	if localMountedDir == "" {
-		return nil, fmt.Errorf("%s is not mounted", req.Directory)
-	}
-
-	// find storage configuration
-	storageConfEntry, err := fs.filer.FindEntry(ctx, util.JoinPath(filer.DirectoryEtcRemote, remoteStorageMountedLocation.Name+filer.REMOTE_STORAGE_CONF_SUFFIX))
-	if err != nil {
-		return nil, err
-	}
-	storageConf := &remote_pb.RemoteConf{}
-	if unMarshalErr := proto.Unmarshal(storageConfEntry.Content, storageConf); unMarshalErr != nil {
-		return nil, fmt.Errorf("unmarshal remote storage conf %s/%s: %v", filer.DirectoryEtcRemote, remoteStorageMountedLocation.Name+filer.REMOTE_STORAGE_CONF_SUFFIX, unMarshalErr)
-	}
 
 	// detect storage option
 	so, err := fs.detectStorageOption(ctx, req.Directory, "", "", 0, "", "", "", "")
@@ -156,8 +136,6 @@ func (fs *FilerServer) doCacheRemoteObjectToLocalCluster(ctx context.Context, re
 		altRequest.ExpectedDataSize = uint64(chunkSize)
 	}
 
-	dest := util.FullPath(remoteStorageMountedLocation.Path).Child(string(util.FullPath(req.Directory).Child(req.Name))[len(localMountedDir):])
-
 	var chunks []*filer_pb.FileChunk
 	var chunksMu sync.Mutex
 	var fetchAndWriteErr error
@@ -239,14 +217,10 @@ func (fs *FilerServer) doCacheRemoteObjectToLocalCluster(ctx context.Context, re
 					Auth:                string(assignResult.Auth),
 					DownloadConcurrency: downloadConcurrency,
 					RemoteConf:          storageConf,
-					RemoteLocation: &remote_pb.RemoteStorageLocation{
-						Name:   remoteStorageMountedLocation.Name,
-						Bucket: remoteStorageMountedLocation.Bucket,
-						Path:   string(dest),
-					},
+					RemoteLocation:      remoteLocation,
 				})
 				if fetchErr != nil {
-					return fmt.Errorf("volume server %s fetchAndWrite %s: %v", assignResult.Url, dest, fetchErr)
+					return fetchAndWriteError(assignResult.Url, remoteLocation.Path, fetchErr)
 				}
 				etag = resp.ETag
 				return nil
@@ -295,6 +269,15 @@ func (fs *FilerServer) doCacheRemoteObjectToLocalCluster(ctx context.Context, re
 		if len(chunks) > 0 {
 			fs.filer.DeleteUncommittedChunks(ctx, chunks)
 		}
+		if fs.option.RemoteCacheEvictThreshold > 0 && isRemoteCacheCapacityError(err) {
+			fileIds := make([]string, 0, len(chunks))
+			for _, chunk := range chunks {
+				fileIds = append(fileIds, chunk.GetFileIdString())
+			}
+			fs.notePendingRemoteCacheVids(fileIds)
+			go fs.reclaimRemoteCacheSpace(fs.evictCtx(), entry.Remote.RemoteSize, nil)
+		}
+		fs.pruneEntryMissingFromRemote(ctx, lockPath, entry, err)
 		return nil, err
 	}
 
@@ -352,3 +335,107 @@ func (fs *FilerServer) doCacheRemoteObjectToLocalCluster(ctx context.Context, re
 	return resp, nil
 
 }
+
+// resolveMountedRemote reads /etc/remote fresh (so conf changes need no restart)
+// and maps dir/name to its remote storage conf and remote location.
+func (fs *FilerServer) resolveMountedRemote(ctx context.Context, dir, name string) (*remote_pb.RemoteConf, *remote_pb.RemoteStorageLocation, error) {
+	mappingEntry, err := fs.filer.FindEntry(ctx, util.JoinPath(filer.DirectoryEtcRemote, filer.REMOTE_STORAGE_MOUNT_FILE))
+	if err != nil {
+		return nil, nil, err
+	}
+	mappings, err := filer.UnmarshalRemoteStorageMappings(mappingEntry.Content)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	localMountedDir, remoteStorageMountedLocation, err := filer.FindMountedRemoteMapping(mappings, dir)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	storageConfEntry, err := fs.filer.FindEntry(ctx, util.JoinPath(filer.DirectoryEtcRemote, remoteStorageMountedLocation.Name+filer.REMOTE_STORAGE_CONF_SUFFIX))
+	if err != nil {
+		return nil, nil, err
+	}
+	storageConf := &remote_pb.RemoteConf{}
+	if unMarshalErr := proto.Unmarshal(storageConfEntry.Content, storageConf); unMarshalErr != nil {
+		return nil, nil, fmt.Errorf("unmarshal remote storage conf %s/%s: %v", filer.DirectoryEtcRemote, remoteStorageMountedLocation.Name+filer.REMOTE_STORAGE_CONF_SUFFIX, unMarshalErr)
+	}
+
+	remoteLocation := filer.MapFullPathToRemoteStorageLocation(util.FullPath(localMountedDir), remoteStorageMountedLocation, util.FullPath(dir).Child(name))
+	return storageConf, remoteLocation, nil
+}
+
+// fetchAndWriteError restores the remote's not-found sentinel from the volume
+// server's answer, so it is told apart from failures worth retrying.
+func fetchAndWriteError(volumeServer, path string, err error) error {
+	if st, ok := status.FromError(err); ok && st.Code() == codes.NotFound && strings.Contains(st.Message(), remote_storage.ErrRemoteObjectNotFound.Error()) {
+		return fmt.Errorf("volume server %s fetchAndWrite %s: %w", volumeServer, path, remote_storage.ErrRemoteObjectNotFound)
+	}
+	return fmt.Errorf("volume server %s fetchAndWrite %s: %v", volumeServer, path, err)
+}
+
+// cacheRemoteObjectError makes the not-found sentinels canonical: they would
+// cross gRPC as codes.Unknown, and remote callers classify a vanished entry or
+// remote object by codes.NotFound.
+func cacheRemoteObjectError(err error) error {
+	if errors.Is(err, filer_pb.ErrNotFound) || errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return status.Error(codes.NotFound, err.Error())
+	}
+	return err
+}
+
+// pruneEntryMissingFromRemote converges the filer on the remote once the remote
+// confirms the object is gone. It removes the entry only while it is still the
+// one the failed fetch read: any write since then owns the path. The check and
+// delete run as an object transaction so they land on the path's write owner,
+// under the lock the S3 object writes take.
+func (fs *FilerServer) pruneEntryMissingFromRemote(ctx context.Context, p util.FullPath, fetched *filer.Entry, fetchErr error) bool {
+	if !errors.Is(fetchErr, remote_storage.ErrRemoteObjectNotFound) || !isPrunableRemoteEntry(fetched) {
+		return false
+	}
+	dir, name := p.DirAndName()
+	resp, err := fs.ObjectTransaction(ctx, &filer_pb.ObjectTransactionRequest{
+		LockKey:  string(p),
+		RouteKey: entryRouteKey(p),
+		Condition: &filer_pb.WriteCondition{Clauses: []*filer_pb.WriteCondition_Clause{{
+			Kind:          filer_pb.WriteCondition_IF_ENTRY_EQUAL,
+			ExpectedEntry: fetched.ToProtoEntry(),
+		}}},
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type:             filer_pb.ObjectMutation_DELETE,
+			Directory:        dir,
+			Name:             name,
+			KeepRemoteObject: true,
+		}},
+	})
+	if err != nil {
+		glog.WarningfCtx(ctx, "prune %s missing from remote: %v", p, err)
+		return false
+	}
+	if resp.Error != "" {
+		if resp.ErrorCode != filer_pb.FilerError_PRECONDITION_FAILED {
+			glog.WarningfCtx(ctx, "prune %s missing from remote: %s", p, resp.Error)
+		}
+		return false
+	}
+	glog.V(0).InfofCtx(ctx, "pruned %s: its remote object no longer exists", p)
+	return true
+}
+
+// isPrunableRemoteEntry admits only a file whose content lives solely on the
+// remote. Version entries are left alone because their parent's latest-version
+// pointer would dangle, and locked objects because pruning would bypass the
+// lock.
+func isPrunableRemoteEntry(entry *filer.Entry) bool {
+	if entry == nil || entry.IsDirectory() || !entry.IsInRemoteOnly() {
+		return false
+	}
+	if len(entry.Content) > 0 || len(entry.HardLinkId) > 0 {
+		return false
+	}
+	if dir, _ := entry.FullPath.DirAndName(); strings.HasSuffix(dir, s3_constants.VersionsFolder) {
+		return false
+	}
+	return !s3_objectlock.EntryHasActiveLock(entry.ToProtoEntry(), time.Now())
+}
diff --git a/weed/server/filer_grpc_server_remote_test.go b/weed/server/filer_grpc_server_remote_test.go
new file mode 100644
index 0000000000..0d7659c119
--- /dev/null
+++ b/weed/server/filer_grpc_server_remote_test.go
@@ -0,0 +1,229 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestRemoteNotFoundCrossesTheVolumeServerHop(t *testing.T) {
+	loc := &remote_pb.RemoteStorageLocation{Name: "gcs1", Bucket: "bucket", Path: "/obj.bin"}
+	tests := map[string]struct {
+		volumeErr error
+		notFound  bool
+	}{
+		"remote object gone":       {volumeRemoteReadError(loc, fmt.Errorf("read: %w", remote_storage.ErrRemoteObjectNotFound)), true},
+		"remote read failure":      {volumeRemoteReadError(loc, errors.New("googleapi: Error 403: forbidden")), false},
+		"not found for other uses": {status.Error(codes.NotFound, "volume not found"), false},
+		"deadline":                 {status.Error(codes.DeadlineExceeded, "context deadline exceeded"), false},
+		"unavailable":              {status.Error(codes.Unavailable, "connection refused"), false},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			filerErr := fetchAndWriteError("volume:8080", loc.Path, tt.volumeErr)
+			assert.Equal(t, tt.notFound, errors.Is(filerErr, remote_storage.ErrRemoteObjectNotFound))
+			assert.Equal(t, tt.notFound, status.Code(cacheRemoteObjectError(filerErr)) == codes.NotFound)
+		})
+	}
+}
+
+// mountTestRemoteClient is a remote where every object is gone; it records
+// every DeleteFile.
+type mountTestRemoteClient struct {
+	remote_storage.RemoteStorageClient
+	mu      sync.Mutex
+	deleted []string
+}
+
+func (c *mountTestRemoteClient) StatFile(*remote_pb.RemoteStorageLocation) (*filer_pb.RemoteEntry, error) {
+	return nil, remote_storage.ErrRemoteObjectNotFound
+}
+
+func (c *mountTestRemoteClient) DeleteFile(loc *remote_pb.RemoteStorageLocation) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.deleted = append(c.deleted, loc.Path)
+	return nil
+}
+
+func (c *mountTestRemoteClient) deletedPaths() []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return append([]string(nil), c.deleted...)
+}
+
+// newRemoteMountTestServer mounts /buckets/b on a fresh mountTestRemoteClient.
+func newRemoteMountTestServer(t *testing.T) (*FilerServer, *renameTestStore, *mountTestRemoteClient) {
+	t.Helper()
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	client := &mountTestRemoteClient{}
+	f.BuildGuardedRemoteClient = func(context.Context, *remote_pb.RemoteConf, bool) (remote_storage.RemoteStorageClient, error) {
+		return client, nil
+	}
+	mapping, err := proto.Marshal(&remote_pb.RemoteStorageMapping{Mappings: map[string]*remote_pb.RemoteStorageLocation{
+		"/buckets/b": {Name: "r1", Bucket: "origin", Path: "/"},
+	}})
+	require.NoError(t, err)
+	conf, err := proto.Marshal(&remote_pb.RemoteConf{Name: "r1", Type: "s3"})
+	require.NoError(t, err)
+	for i, c := range map[string][]byte{filer.REMOTE_STORAGE_MOUNT_FILE: mapping, "r1" + filer.REMOTE_STORAGE_CONF_SUFFIX: conf} {
+		entry := newFileEntry(filer.DirectoryEtcRemote+"/"+i, 1)
+		entry.Content = c
+		store.entries[string(entry.FullPath)] = entry
+	}
+	require.NoError(t, f.RemoteStorage.LoadRemoteStorageConfigurationsAndMapping(f))
+	return &FilerServer{filer: f, option: &FilerOption{}, entryLockTable: util.NewLockTable[util.FullPath]()}, store, client
+}
+
+func remoteOnlyFileEntry(path string) *filer.Entry {
+	entry := newFileEntry(path, 10)
+	entry.FileSize = 10
+	entry.Remote = &filer_pb.RemoteEntry{RemoteSize: 10, RemoteMtime: 1700000000}
+	dir, _ := entry.FullPath.DirAndName()
+	return filer.FromPbEntry(dir, entry.ToProtoEntry())
+}
+
+func TestPruneEntryMissingFromRemote(t *testing.T) {
+	gone := fmt.Errorf("volume server v fetchAndWrite /obj.bin: %w", remote_storage.ErrRemoteObjectNotFound)
+	retainUntil := func(d time.Duration) []byte { return []byte(strconv.FormatInt(time.Now().Add(d).Unix(), 10)) }
+	tests := []struct {
+		name     string
+		fetchErr error
+		mutate   func(stored *filer.Entry)
+		pruned   bool
+	}{
+		{"remote confirms the object gone", gone, nil, true},
+		{"expired retention", gone, func(e *filer.Entry) {
+			e.Extended = map[string][]byte{s3_constants.ExtObjectLockModeKey: []byte(s3_constants.RetentionModeGovernance), s3_constants.ExtRetentionUntilDateKey: retainUntil(-time.Hour)}
+		}, true},
+		{"deadline", context.DeadlineExceeded, nil, false},
+		{"unavailable", fmt.Errorf("fetchAndWrite: %v", status.Error(codes.Unavailable, "connection refused")), nil, false},
+		{"permission denied", errors.New("googleapi: Error 403: forbidden"), nil, false},
+		{"entry vanished", filer_pb.ErrNotFound, nil, false},
+		{"cached locally", gone, func(e *filer.Entry) { e.Chunks = []*filer_pb.FileChunk{{FileId: "3,01637037d6", Size: 10}} }, false},
+		{"inline content", gone, func(e *filer.Entry) { e.Content = []byte("0123456789") }, false},
+		{"hard link", gone, func(e *filer.Entry) { e.HardLinkId = filer.HardLinkId([]byte("link")) }, false},
+		{"directory", gone, func(e *filer.Entry) { e.Mode |= os.ModeDir }, false},
+		{"object version", gone, func(e *filer.Entry) {
+			e.FullPath = util.FullPath("/buckets/b/obj.bin" + s3_constants.VersionsFolder + "/v_1")
+		}, false},
+		{"active retention", gone, func(e *filer.Entry) {
+			e.Extended = map[string][]byte{s3_constants.ExtObjectLockModeKey: []byte(s3_constants.RetentionModeGovernance), s3_constants.ExtRetentionUntilDateKey: retainUntil(time.Hour)}
+		}, false},
+		{"legal hold", gone, func(e *filer.Entry) {
+			e.Extended = map[string][]byte{s3_constants.ExtLegalHoldKey: []byte(s3_constants.LegalHoldOn)}
+		}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs, store, client := newRemoteMountTestServer(t)
+			entry := remoteOnlyFileEntry("/buckets/b/obj.bin")
+			if tt.mutate != nil {
+				tt.mutate(entry)
+			}
+			store.entries[string(entry.FullPath)] = entry.ShallowClone()
+
+			assert.Equal(t, tt.pruned, fs.pruneEntryMissingFromRemote(context.Background(), entry.FullPath, entry, tt.fetchErr))
+
+			_, err := fs.filer.FindEntry(context.Background(), entry.FullPath)
+			assert.Equal(t, tt.pruned, errors.Is(err, filer_pb.ErrNotFound), "find: %v", err)
+			assert.Empty(t, client.deletedPaths())
+		})
+	}
+
+	t.Run("entry rewritten since the fetch", func(t *testing.T) {
+		fs, store, _ := newRemoteMountTestServer(t)
+		fetched := remoteOnlyFileEntry("/buckets/b/obj.bin")
+		rewritten := fetched.ShallowClone()
+		rewritten.Remote = nil
+		rewritten.Chunks = []*filer_pb.FileChunk{{FileId: "3,01637037d6", Size: 10}}
+		store.entries[string(fetched.FullPath)] = rewritten
+
+		assert.False(t, fs.pruneEntryMissingFromRemote(context.Background(), fetched.FullPath, fetched, gone))
+	})
+}
+
+// TestPruneLeavesTheRemoteAlone also deletes an entry the ordinary way, so a
+// harness that never reached the remote could not pass it.
+func TestPruneLeavesTheRemoteAlone(t *testing.T) {
+	fs, store, client := newRemoteMountTestServer(t)
+	pruned := remoteOnlyFileEntry("/buckets/b/pruned.bin")
+	deleted := remoteOnlyFileEntry("/buckets/b/deleted.bin")
+	store.entries[string(pruned.FullPath)] = pruned.ShallowClone()
+	store.entries[string(deleted.FullPath)] = deleted.ShallowClone()
+	queue := &captureQueue{}
+	swapNotificationQueue(t, queue)
+
+	require.True(t, fs.pruneEntryMissingFromRemote(context.Background(), pruned.FullPath, pruned, remote_storage.ErrRemoteObjectNotFound))
+	events := queue.snapshot()
+	require.Len(t, events, 1)
+	assert.False(t, events[0].notification.IsFromOtherCluster, "filer.sync must replicate the prune")
+	assert.Contains(t, events[0].notification.OldEntry.Extended, filer.ExtKeepRemoteObjectKey, "filer.remote.sync must not delete the remote object")
+
+	require.NoError(t, fs.filer.DeleteEntryMetaAndData(context.Background(), deleted.FullPath, false, false, false, false, nil, 0))
+	assert.Equal(t, []string{"/deleted.bin"}, client.deletedPaths())
+}
+
+func TestReplicatedMetadataOnlyDeleteStaysMarked(t *testing.T) {
+	for _, keep := range []bool{true, false} {
+		t.Run(fmt.Sprintf("keep_remote_object=%v", keep), func(t *testing.T) {
+			fs, store, client := newRemoteMountTestServer(t)
+			entry := remoteOnlyFileEntry("/buckets/b/obj.bin")
+			store.entries[string(entry.FullPath)] = entry.ShallowClone()
+
+			resp, err := fs.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
+				Directory:          "/buckets/b",
+				Name:               "obj.bin",
+				IsFromOtherCluster: true,
+				KeepRemoteObject:   keep,
+			})
+			require.NoError(t, err)
+			require.Empty(t, resp.Error)
+			assert.Equal(t, keep, filer.IsMetadataOnlyDelete(resp.MetadataEvent.EventNotification.OldEntry))
+			assert.Empty(t, client.deletedPaths())
+		})
+	}
+}
+
+func TestPruneOnANonOwnerLeavesTheDeleteToTheOwner(t *testing.T) {
+	fs, store, _ := newRemoteMountTestServer(t)
+	const self = pb.ServerAddress("127.0.0.1:18888")
+	fs.option.Host = self
+	fs.grpcDialOption = grpc.WithTransportCredentials(insecure.NewCredentials())
+	fs.filer.Dlm = lock_manager.NewDistributedLockManager(self)
+	fs.filer.Dlm.LockRing.SetSnapshot([]pb.ServerAddress{self, "127.0.0.1:18889"}, 1)
+	var entry *filer.Entry
+	for i := 0; i < 4000 && entry == nil; i++ {
+		p := util.FullPath(fmt.Sprintf("/buckets/b/obj-%d.bin", i))
+		if fs.filer.Dlm.LockRing.WriteOwner(entryRouteKey(p)) != self {
+			entry = remoteOnlyFileEntry(string(p))
+		}
+	}
+	require.NotNil(t, entry, "no path owned by the peer")
+	store.entries[string(entry.FullPath)] = entry.ShallowClone()
+
+	assert.False(t, fs.pruneEntryMissingFromRemote(context.Background(), entry.FullPath, entry, remote_storage.ErrRemoteObjectNotFound))
+	assert.Contains(t, store.entries, string(entry.FullPath), "only the write owner may delete the entry")
+}
diff --git a/weed/server/filer_grpc_server_rename.go b/weed/server/filer_grpc_server_rename.go
index d44bad2832..a1a6c682cc 100644
--- a/weed/server/filer_grpc_server_rename.go
+++ b/weed/server/filer_grpc_server_rename.go
@@ -2,7 +2,9 @@ package weed_server
 
 import (
 	"context"
+	"errors"
 	"fmt"
+	"maps"
 	"path/filepath"
 	"time"
 
@@ -45,6 +47,9 @@ func (fs *FilerServer) AtomicRenameEntry(ctx context.Context, req *filer_pb.Atom
 
 	defer fs.acquireRenamePathLocks("AtomicRenameEntry", oldParent.Child(req.OldName), newParent.Child(req.NewName))()
 
+	// a SQL store keeps the transaction in the context and refuses calls
+	// through it once committed; the work after the commit uses this one
+	afterCommitCtx := ctx
 	ctx, err := fs.filer.BeginTransaction(ctx)
 	if err != nil {
 		return nil, err
@@ -56,9 +61,22 @@ func (fs *FilerServer) AtomicRenameEntry(ctx context.Context, req *filer_pb.Atom
 		return nil, fmt.Errorf("%s/%s not found: %v", req.OldDirectory, req.OldName, err)
 	}
 
+	// The check runs under the rename path locks, which CreateEntry on the same
+	// filer also takes, so a target created concurrently cannot slip through.
+	if req.FailIfTargetExists && newParent.Child(req.NewName) != oldParent.Child(req.OldName) {
+		if _, findErr := fs.filer.FindEntry(ctx, newParent.Child(req.NewName)); findErr == nil {
+			fs.filer.RollbackTransaction(ctx)
+			return nil, fmt.Errorf("%s/%s: %w", req.NewDirectory, req.NewName, filer_pb.ErrEntryAlreadyExists)
+		} else if findErr != filer_pb.ErrNotFound {
+			fs.filer.RollbackTransaction(ctx)
+			return nil, findErr
+		}
+	}
+
 	var metadataEvents []metadataEvent
 	var pendingChunkDeletes []*filer_pb.FileChunk
-	moveErr := fs.moveEntry(ctx, nil, oldParent, oldEntry, newParent, req.NewName, req.Signatures, false, &metadataEvents, &pendingChunkDeletes)
+	var pendingRemoteCopies []*pendingRemoteCopy
+	moveErr := fs.moveEntry(ctx, nil, oldParent, oldEntry, newParent, req.NewName, req.Signatures, false, &metadataEvents, &pendingChunkDeletes, &pendingRemoteCopies)
 	if moveErr != nil {
 		fs.filer.RollbackTransaction(ctx)
 		return nil, fmt.Errorf("%s/%s move error: %v", req.OldDirectory, req.OldName, moveErr)
@@ -75,8 +93,10 @@ func (fs *FilerServer) AtomicRenameEntry(ctx context.Context, req *filer_pb.Atom
 	if len(pendingChunkDeletes) > 0 {
 		fs.filer.DeleteChunksNotRecursive(pendingChunkDeletes)
 	}
+	fs.finishRemoteCopies(afterCommitCtx, pendingRemoteCopies)
+	applyRemoteCopies(metadataEvents, pendingRemoteCopies)
 	for _, event := range metadataEvents {
-		event.notify(fs.filer, ctx, req.Signatures)
+		event.notify(fs.filer, afterCommitCtx, req.Signatures)
 	}
 
 	return &filer_pb.AtomicRenameEntryResponse{}, nil
@@ -97,6 +117,7 @@ func (fs *FilerServer) StreamRenameEntry(req *filer_pb.StreamRenameEntryRequest,
 
 	ctx := context.Background()
 
+	afterCommitCtx := ctx
 	ctx, err = fs.filer.BeginTransaction(ctx)
 	if err != nil {
 		return err
@@ -125,7 +146,8 @@ func (fs *FilerServer) StreamRenameEntry(req *filer_pb.StreamRenameEntryRequest,
 
 	var metadataEvents []metadataEvent
 	var pendingChunkDeletes []*filer_pb.FileChunk
-	moveErr := fs.moveEntry(ctx, stream, oldParent, oldEntry, newParent, req.NewName, req.Signatures, false, &metadataEvents, &pendingChunkDeletes)
+	var pendingRemoteCopies []*pendingRemoteCopy
+	moveErr := fs.moveEntry(ctx, stream, oldParent, oldEntry, newParent, req.NewName, req.Signatures, false, &metadataEvents, &pendingChunkDeletes, &pendingRemoteCopies)
 	if moveErr != nil {
 		fs.filer.RollbackTransaction(ctx)
 		return fmt.Errorf("%s/%s move error: %v", req.OldDirectory, req.OldName, moveErr)
@@ -138,8 +160,10 @@ func (fs *FilerServer) StreamRenameEntry(req *filer_pb.StreamRenameEntryRequest,
 	if len(pendingChunkDeletes) > 0 {
 		fs.filer.DeleteChunksNotRecursive(pendingChunkDeletes)
 	}
+	fs.finishRemoteCopies(afterCommitCtx, pendingRemoteCopies)
+	applyRemoteCopies(metadataEvents, pendingRemoteCopies)
 	for _, event := range metadataEvents {
-		event.notify(fs.filer, ctx, req.Signatures)
+		event.notify(fs.filer, afterCommitCtx, req.Signatures)
 	}
 
 	return nil
@@ -149,29 +173,119 @@ type metadataEvent struct {
 	oldEntry     *filer.Entry
 	newEntry     *filer.Entry
 	deleteChunks bool
+	// the old entry's remote object is deleted once the rename has committed:
+	// it was copied to the new key, and a rename that fails must not lose it
+	deleteOldRemote bool
+}
+
+// pendingRemoteCopy is a remote-only rename over a remote-only target whose
+// copy runs after the commit: the store transaction cannot roll a remote
+// write back, so the new entry keeps the old key's stamp until the copy lands.
+type pendingRemoteCopy struct {
+	source  *filer.Entry
+	oldPath util.FullPath
+	newPath util.FullPath
+	failed  bool
+	copied  *filer_pb.RemoteEntry
+}
+
+// finishRemoteCopies runs the deferred remote copies after the commit. A
+// failure leaves the new entry pointing at the old key, whose object the
+// caller then keeps: remote.sync completes the copy the same way it does a
+// rename whose event it finds unfinished.
+func (fs *FilerServer) finishRemoteCopies(ctx context.Context, pendings []*pendingRemoteCopy) {
+	for _, pending := range pendings {
+		remoteEntry, err := fs.filer.CopyRemoteOnlyEntry(ctx, pending.source, pending.oldPath, pending.newPath)
+		if err != nil {
+			glog.WarningfCtx(ctx, "remote rename copy of %s: %v", pending.newPath, err)
+			pending.failed = true
+			continue
+		}
+		entry, findErr := fs.filer.FindEntry(ctx, pending.newPath)
+		if findErr != nil {
+			glog.WarningfCtx(ctx, "stamp remote rename copy of %s: %v", pending.newPath, findErr)
+			pending.failed = true
+			continue
+		}
+		entry.Remote = remoteEntry
+		delete(entry.Extended, filer.ExtRemoteRenameSourceKey)
+		if updateErr := fs.filer.UpdateEntry(ctx, entry, entry, false); updateErr != nil {
+			glog.WarningfCtx(ctx, "stamp remote rename copy of %s: %v", pending.newPath, updateErr)
+			pending.failed = true
+			continue
+		}
+		pending.copied = remoteEntry
+	}
+}
+
+// applyRemoteCopies brings the queued rename events in line with the deferred
+// copies. The stamp is written with a plain UpdateEntry, which publishes no
+// event, so the rename event carries it, without the pending-source marker,
+// to peer filers and subscribers. A failed copy keeps the old object, which
+// the entry still reads through the marker.
+func applyRemoteCopies(events []metadataEvent, pendings []*pendingRemoteCopy) {
+	for i := range events {
+		event := &events[i]
+		for _, pending := range pendings {
+			if event.oldEntry.FullPath != pending.oldPath {
+				continue
+			}
+			if pending.failed {
+				event.deleteOldRemote = false
+			} else if pending.copied != nil && event.newEntry != nil {
+				newEntry := event.newEntry.ShallowClone()
+				newEntry.Remote = pending.copied
+				newEntry.Extended = maps.Clone(newEntry.Extended)
+				delete(newEntry.Extended, filer.ExtRemoteRenameSourceKey)
+				event.newEntry = newEntry
+			}
+		}
+	}
 }
 
 func (event metadataEvent) notify(f *filer.Filer, ctx context.Context, signatures []int32) {
+	if event.deleteOldRemote {
+		deleteRenamedRemoteObject(f, ctx, event.oldEntry)
+	}
 	f.NotifyUpdateEvent(ctx, event.oldEntry, event.newEntry, event.deleteChunks, false, signatures)
 }
 
-func (fs *FilerServer) moveEntry(ctx context.Context, stream filer_pb.SeaweedFiler_StreamRenameEntryServer, oldParent util.FullPath, entry *filer.Entry, newParent util.FullPath, newName string, signatures []int32, skipTargetLookup bool, metadataEvents *[]metadataEvent, pendingChunkDeletes *[]*filer_pb.FileChunk) error {
+// deleteRenamedRemoteObject deletes the remote object a committed rename no
+// longer needs. A child path is not locked by its directory's rename, so
+// another rename may have put a remote-only entry at the key meanwhile; the
+// store is asked directly, a lazy fetch would revive the key. When in doubt
+// the object stays: an extra object loses nothing.
+func deleteRenamedRemoteObject(f *filer.Filer, ctx context.Context, entry *filer.Entry) {
+	current, findErr := f.Store.FindEntry(ctx, entry.FullPath)
+	switch {
+	case findErr != nil && !errors.Is(findErr, filer_pb.ErrNotFound):
+		glog.WarningfCtx(ctx, "keep remote object of renamed %s: look up its old path: %v", entry.FullPath, findErr)
+	case findErr == nil && current.IsInRemoteOnly():
+		glog.V(0).InfofCtx(ctx, "keep remote object of renamed %s: a remote-only entry has taken its path", entry.FullPath)
+	default:
+		if err := f.DeleteFromRemote(ctx, entry); err != nil {
+			glog.WarningfCtx(ctx, "delete remote object of renamed %s: %v", entry.FullPath, err)
+		}
+	}
+}
+
+func (fs *FilerServer) moveEntry(ctx context.Context, stream filer_pb.SeaweedFiler_StreamRenameEntryServer, oldParent util.FullPath, entry *filer.Entry, newParent util.FullPath, newName string, signatures []int32, skipTargetLookup bool, metadataEvents *[]metadataEvent, pendingChunkDeletes *[]*filer_pb.FileChunk, pendingRemoteCopies *[]*pendingRemoteCopy) error {
 
 	if err := fs.moveSelfEntry(ctx, stream, oldParent, entry, newParent, newName, func() error {
 		if entry.IsDirectory() {
-			if err := fs.moveFolderSubEntries(ctx, stream, oldParent, entry, newParent, newName, signatures, metadataEvents, pendingChunkDeletes); err != nil {
+			if err := fs.moveFolderSubEntries(ctx, stream, oldParent, entry, newParent, newName, signatures, metadataEvents, pendingChunkDeletes, pendingRemoteCopies); err != nil {
 				return err
 			}
 		}
 		return nil
-	}, signatures, skipTargetLookup, metadataEvents, pendingChunkDeletes); err != nil {
+	}, signatures, skipTargetLookup, metadataEvents, pendingChunkDeletes, pendingRemoteCopies); err != nil {
 		return fmt.Errorf("fail to move %s => %s: %v", oldParent.Child(entry.Name()), newParent.Child(newName), err)
 	}
 
 	return nil
 }
 
-func (fs *FilerServer) moveFolderSubEntries(ctx context.Context, stream filer_pb.SeaweedFiler_StreamRenameEntryServer, oldParent util.FullPath, entry *filer.Entry, newParent util.FullPath, newName string, signatures []int32, metadataEvents *[]metadataEvent, pendingChunkDeletes *[]*filer_pb.FileChunk) error {
+func (fs *FilerServer) moveFolderSubEntries(ctx context.Context, stream filer_pb.SeaweedFiler_StreamRenameEntryServer, oldParent util.FullPath, entry *filer.Entry, newParent util.FullPath, newName string, signatures []int32, metadataEvents *[]metadataEvent, pendingChunkDeletes *[]*filer_pb.FileChunk, pendingRemoteCopies *[]*pendingRemoteCopy) error {
 
 	currentDirPath := oldParent.Child(entry.Name())
 	newDirPath := newParent.Child(newName)
@@ -194,7 +308,7 @@ func (fs *FilerServer) moveFolderSubEntries(ctx context.Context, stream filer_pb
 			// println("processing", lastFileName)
 			newChildPath := newDirPath.Child(item.Name())
 			skipTarget := fs.filer.Store.SameActualStore(newDirPath, newChildPath)
-			err := fs.moveEntry(ctx, stream, currentDirPath, item, newDirPath, item.Name(), signatures, skipTarget, metadataEvents, pendingChunkDeletes)
+			err := fs.moveEntry(ctx, stream, currentDirPath, item, newDirPath, item.Name(), signatures, skipTarget, metadataEvents, pendingChunkDeletes, pendingRemoteCopies)
 			if err != nil {
 				return err
 			}
@@ -206,7 +320,7 @@ func (fs *FilerServer) moveFolderSubEntries(ctx context.Context, stream filer_pb
 	return nil
 }
 
-func (fs *FilerServer) moveSelfEntry(ctx context.Context, stream filer_pb.SeaweedFiler_StreamRenameEntryServer, oldParent util.FullPath, entry *filer.Entry, newParent util.FullPath, newName string, moveFolderSubEntries func() error, signatures []int32, skipTargetLookup bool, metadataEvents *[]metadataEvent, pendingChunkDeletes *[]*filer_pb.FileChunk) error {
+func (fs *FilerServer) moveSelfEntry(ctx context.Context, stream filer_pb.SeaweedFiler_StreamRenameEntryServer, oldParent util.FullPath, entry *filer.Entry, newParent util.FullPath, newName string, moveFolderSubEntries func() error, signatures []int32, skipTargetLookup bool, metadataEvents *[]metadataEvent, pendingChunkDeletes *[]*filer_pb.FileChunk, pendingRemoteCopies *[]*pendingRemoteCopy) error {
 
 	oldPath, newPath := oldParent.Child(entry.Name()), newParent.Child(newName)
 
@@ -235,8 +349,48 @@ func (fs *FilerServer) moveSelfEntry(ctx context.Context, stream filer_pb.Seawee
 		case !existingTarget.IsDirectory() && entry.IsDirectory():
 			return fmt.Errorf("%s: %w", existingTarget.FullPath, filer_pb.ErrExistingIsFile)
 		}
+	}
+
+	// a remote-only entry is copied on the remote before anything changes:
+	// deleting the old entry deletes the old object. Over a remote-only
+	// target the copy runs after the commit instead — it overwrites the
+	// target's only content, which a rolled-back commit cannot restore —
+	// and the new entry reads the old key until the copy stamps it.
+	deferredCopy := false
+	var copiedRemote *filer_pb.RemoteEntry
+	if existingTarget != nil && existingTarget.IsInRemoteOnly() && entry.IsInRemoteOnly() {
+		if _, _, copier, copyErr := fs.filer.RemoteCopyLocations(ctx, entry, oldPath, newPath); copyErr != nil {
+			return copyErr
+		} else if copier != nil {
+			deferredCopy = true
+			*pendingRemoteCopies = append(*pendingRemoteCopies, &pendingRemoteCopy{source: sourceEntry, oldPath: oldPath, newPath: newPath})
+		}
+	}
+	if !deferredCopy {
+		var copyErr error
+		copiedRemote, copyErr = fs.filer.CopyRemoteOnlyEntry(ctx, entry, oldPath, newPath)
+		if copyErr != nil {
+			return copyErr
+		}
+	}
+	remoteEntry := entry.Remote
+	if copiedRemote != nil {
+		remoteEntry = copiedRemote
+	}
+
+	if existingTarget != nil {
+		targetCtx := filer.WithSuppressedMetadataEvents(ctx)
+		if copiedRemote != nil || deferredCopy {
+			// the copy has replaced or still needs the target's object; keep it
+			targetCtx = filer.WithKeepRemoteObject(targetCtx)
+			existingTarget.Extended = maps.Clone(existingTarget.Extended)
+			if existingTarget.Extended == nil {
+				existingTarget.Extended = map[string][]byte{}
+			}
+			existingTarget.Extended[filer.ExtKeepRemoteObjectKey] = []byte("true")
+		}
 		if deleteErr := fs.filer.DeleteEntryMetaAndData(
-			filer.WithSuppressedMetadataEvents(ctx),
+			targetCtx,
 			newPath,
 			false,
 			false,
@@ -258,9 +412,23 @@ func (fs *FilerServer) moveSelfEntry(ctx context.Context, stream filer_pb.Seawee
 		Content:         entry.Content,
 		HardLinkCounter: entry.HardLinkCounter,
 		HardLinkId:      entry.HardLinkId,
-		Remote:          entry.Remote,
+		Remote:          remoteEntry,
 		Quota:           entry.Quota,
 	}
+	if deferredCopy {
+		// a pending entry renamed again still reads its original source
+		newEntry.Extended = maps.Clone(newEntry.Extended)
+		if newEntry.Extended == nil {
+			newEntry.Extended = map[string][]byte{}
+		}
+		newEntry.Extended[filer.ExtRemoteRenameSourceKey] = []byte(fs.filer.RemoteSourcePath(entry, oldPath))
+	} else if copiedRemote != nil && len(newEntry.Extended[filer.ExtRemoteRenameSourceKey]) > 0 {
+		// the copy came from the pending source; the new key holds it now.
+		// The source itself is left to remote.sync, which deletes it only
+		// while it is still the object the rename event recorded
+		newEntry.Extended = maps.Clone(newEntry.Extended)
+		delete(newEntry.Extended, filer.ExtRemoteRenameSourceKey)
+	}
 	if skipTargetLookup {
 		if newEntry.FullPath.IsLongerFileName(fs.filer.MaxFilenameLength) {
 			return filer_pb.ErrEntryNameTooLong
@@ -274,7 +442,7 @@ func (fs *FilerServer) moveSelfEntry(ctx context.Context, stream filer_pb.Seawee
 		}
 	}
 	if existingTarget != nil {
-		toDelete, err := filer.MinusChunks(ctx, fs.filer.MasterClient.GetLookupFileIdFunction(), existingTarget.GetChunks(), newEntry.GetChunks())
+		toDelete, err := filer.MinusChunks(ctx, fs.filer.MasterClient.GetLookupFileIdFunction(), existingTarget.GetChunks(), newEntry.GetChunks(), fs.filer.MasterClient)
 		if err != nil {
 			glog.ErrorfCtx(ctx, "Failed to resolve overwrite target chunks during rename. new: %v, old: %v", newEntry.GetChunks(), existingTarget.GetChunks())
 		} else if len(toDelete) > 0 {
@@ -311,19 +479,36 @@ func (fs *FilerServer) moveSelfEntry(ctx context.Context, stream filer_pb.Seawee
 		})
 	}
 	*metadataEvents = append(*metadataEvents, metadataEvent{
-		oldEntry: sourceEntry,
-		newEntry: newEntry,
+		oldEntry:        sourceEntry,
+		newEntry:        newEntry,
+		deleteOldRemote: copiedRemote != nil || deferredCopy,
 	})
+	selfEvent := len(*metadataEvents) - 1
+	keepOldRemote := copiedRemote != nil || deferredCopy
 
 	if moveFolderSubEntries != nil {
 		if moveChildrenErr := moveFolderSubEntries(); moveChildrenErr != nil {
 			return moveChildrenErr
 		}
+		// removing the old directory on the remote removes every object under
+		// its prefix, the copied children's old keys included, which must wait
+		// for the commit. Those are deleted one by one after it instead, and
+		// nothing else under the prefix is touched.
+		for _, event := range (*metadataEvents)[selfEvent+1:] {
+			if event.deleteOldRemote {
+				keepOldRemote = true
+				break
+			}
+		}
 	}
 
 	// delete old entry
 	ctx = context.WithValue(ctx, "OP", "MV")
-	deleteErr := fs.filer.DeleteEntryMetaAndData(filer.WithSuppressedMetadataEvents(ctx), oldPath, false, false, false, false, signatures, 0)
+	deleteCtx := filer.WithSuppressedMetadataEvents(ctx)
+	if keepOldRemote {
+		deleteCtx = filer.WithKeepRemoteObject(deleteCtx)
+	}
+	deleteErr := fs.filer.DeleteEntryMetaAndData(deleteCtx, oldPath, false, false, false, false, signatures, 0)
 	if deleteErr != nil {
 		return deleteErr
 	}
diff --git a/weed/server/filer_grpc_server_rename_remote_test.go b/weed/server/filer_grpc_server_rename_remote_test.go
new file mode 100644
index 0000000000..445b1b9acb
--- /dev/null
+++ b/weed/server/filer_grpc_server_rename_remote_test.go
@@ -0,0 +1,430 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+// renameRemoteClient records the remote calls a rename makes. It cannot copy;
+// copyingRenameRemoteClient adds CopyFile.
+type renameRemoteClient struct {
+	remote_storage.RemoteStorageClient
+	mu      sync.Mutex
+	calls   []string
+	copyErr error
+}
+
+func (c *renameRemoteClient) record(call string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.calls = append(c.calls, call)
+}
+
+func (c *renameRemoteClient) recorded() []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return append([]string(nil), c.calls...)
+}
+
+func (c *renameRemoteClient) StatFile(*remote_pb.RemoteStorageLocation) (*filer_pb.RemoteEntry, error) {
+	return nil, remote_storage.ErrRemoteObjectNotFound
+}
+
+func (c *renameRemoteClient) ListDirectory(context.Context, *remote_pb.RemoteStorageLocation, remote_storage.VisitFunc) error {
+	return nil
+}
+
+func (c *renameRemoteClient) DeleteFile(loc *remote_pb.RemoteStorageLocation) error {
+	c.record("delete " + loc.Bucket + loc.Path)
+	return nil
+}
+
+func (c *renameRemoteClient) RemoveDirectory(loc *remote_pb.RemoteStorageLocation) error {
+	c.record("rmdir " + loc.Bucket + loc.Path)
+	return nil
+}
+
+type copyingRenameRemoteClient struct {
+	*renameRemoteClient
+}
+
+func (c copyingRenameRemoteClient) CopyFile(src, dst *remote_pb.RemoteStorageLocation) (*filer_pb.RemoteEntry, error) {
+	if c.copyErr != nil {
+		return nil, c.copyErr
+	}
+	c.record("copy " + src.Bucket + src.Path + " " + dst.Bucket + dst.Path)
+	return &filer_pb.RemoteEntry{StorageName: "r1", RemoteSize: 10, RemoteMtime: 1800000000, RemoteETag: `"copy"`}, nil
+}
+
+// newRenameRemoteTestServer mounts /buckets/b, /buckets/c and /data/m on r1,
+// through client.
+func newRenameRemoteTestServer(t *testing.T, client remote_storage.RemoteStorageClient) (*FilerServer, *renameTestStore) {
+	t.Helper()
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	f.BuildGuardedRemoteClient = func(context.Context, *remote_pb.RemoteConf, bool) (remote_storage.RemoteStorageClient, error) {
+		return client, nil
+	}
+	mapping, err := proto.Marshal(&remote_pb.RemoteStorageMapping{Mappings: map[string]*remote_pb.RemoteStorageLocation{
+		"/buckets/b": {Name: "r1", Bucket: "origin", Path: "/"},
+		"/buckets/c": {Name: "r1", Bucket: "other", Path: "/"},
+		"/data/m":    {Name: "r1", Bucket: "origin", Path: "/m"},
+	}})
+	require.NoError(t, err)
+	conf, err := proto.Marshal(&remote_pb.RemoteConf{Name: "r1", Type: "s3"})
+	require.NoError(t, err)
+	for name, content := range map[string][]byte{filer.REMOTE_STORAGE_MOUNT_FILE: mapping, "r1" + filer.REMOTE_STORAGE_CONF_SUFFIX: conf} {
+		entry := newFileEntry(filer.DirectoryEtcRemote+"/"+name, 1)
+		entry.Content = content
+		store.entries[string(entry.FullPath)] = entry
+	}
+	require.NoError(t, f.RemoteStorage.LoadRemoteStorageConfigurationsAndMapping(f))
+	for _, dir := range []string{"/buckets", "/buckets/b", "/buckets/b/src", "/buckets/b/dst", "/buckets/c", "/data", "/data/m"} {
+		store.entries[dir] = newDirectoryEntry(dir, 2)
+	}
+	return &FilerServer{filer: f, option: &FilerOption{}, entryLockTable: util.NewLockTable[util.FullPath]()}, store
+}
+
+func remoteOnlyRenameEntry(path string, inode uint64) *filer.Entry {
+	entry := newFileEntry(path, inode)
+	entry.FileSize = 10
+	entry.Remote = &filer_pb.RemoteEntry{StorageName: "r1", RemoteSize: 10, RemoteMtime: 1700000000, RemoteETag: `"orig"`}
+	return entry
+}
+
+func renameFile(server *FilerServer, oldPath, newPath util.FullPath) error {
+	oldDir, oldName := oldPath.DirAndName()
+	newDir, newName := newPath.DirAndName()
+	_, err := server.AtomicRenameEntry(context.Background(), &filer_pb.AtomicRenameEntryRequest{
+		OldDirectory: oldDir,
+		OldName:      oldName,
+		NewDirectory: newDir,
+		NewName:      newName,
+	})
+	return err
+}
+
+func TestRenameRemoteOnlyEntryCopiesBeforeDeletingTheOldObject(t *testing.T) {
+	client := copyingRenameRemoteClient{&renameRemoteClient{}}
+	server, store := newRenameRemoteTestServer(t, client)
+	store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+
+	require.NoError(t, renameFile(server, "/buckets/b/src/a.jpg", "/buckets/b/dst/a.jpg"))
+
+	assert.Equal(t, []string{"copy origin/src/a.jpg origin/dst/a.jpg", "delete origin/src/a.jpg"}, client.recorded())
+	_, err := store.FindEntry(context.Background(), "/buckets/b/src/a.jpg")
+	assert.ErrorIs(t, err, filer_pb.ErrNotFound)
+	dst, err := store.FindEntry(context.Background(), "/buckets/b/dst/a.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, `"copy"`, dst.Remote.RemoteETag)
+	assert.Equal(t, uint64(101), dst.Attr.Inode)
+}
+
+func TestRenameRemoteOnlyEntryOverTargetKeepsTheCopy(t *testing.T) {
+	client := copyingRenameRemoteClient{&renameRemoteClient{}}
+	server, store := newRenameRemoteTestServer(t, client)
+	store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+	store.entries["/buckets/b/dst/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/dst/a.jpg", 202)
+	queue := &captureQueue{}
+	swapNotificationQueue(t, queue)
+
+	require.NoError(t, renameFile(server, "/buckets/b/src/a.jpg", "/buckets/b/dst/a.jpg"))
+
+	// the target's delete must not take the copy that replaced its object
+	assert.Equal(t, []string{"copy origin/src/a.jpg origin/dst/a.jpg", "delete origin/src/a.jpg"}, client.recorded())
+	events := queue.snapshot()
+	require.Len(t, events, 2)
+	assert.True(t, filer.IsMetadataOnlyDelete(events[0].notification.OldEntry), "the target's delete event must leave the remote object alone")
+	assert.False(t, filer.IsMetadataOnlyDelete(events[1].notification.OldEntry))
+	// the copy lands after the commit; the rename event still carries its stamp
+	assert.Equal(t, `"copy"`, events[1].notification.NewEntry.RemoteEntry.GetRemoteETag())
+	dst, err := store.FindEntry(context.Background(), "/buckets/b/dst/a.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, uint64(101), dst.Attr.Inode)
+	assert.Equal(t, `"copy"`, dst.Remote.RemoteETag)
+	assert.Empty(t, dst.Extended[filer.ExtRemoteRenameSourceKey])
+	// peers replay the post-copy state, not the source's stamp the entry
+	// committed with
+	newEvent := events[1].notification.NewEntry
+	assert.Equal(t, `"copy"`, newEvent.RemoteEntry.RemoteETag)
+	assert.Empty(t, newEvent.Extended[filer.ExtRemoteRenameSourceKey])
+}
+
+func TestRenameRemoteOnlyEntryCopyFailureKeepsTheOldObject(t *testing.T) {
+	client := copyingRenameRemoteClient{&renameRemoteClient{copyErr: errors.New("copy refused")}}
+	server, store := newRenameRemoteTestServer(t, client)
+	store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+	store.entries["/buckets/b/dst/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/dst/a.jpg", 202)
+
+	require.NoError(t, renameFile(server, "/buckets/b/src/a.jpg", "/buckets/b/dst/a.jpg"))
+
+	// the copy runs after the commit over a remote-only target, so its
+	// failure cannot roll anything back: the entry still stamps the old
+	// object, which is kept for remote.sync to finish the copy
+	assert.Empty(t, client.recorded())
+	_, err := store.FindEntry(context.Background(), "/buckets/b/src/a.jpg")
+	assert.ErrorIs(t, err, filer_pb.ErrNotFound)
+	dst, err := store.FindEntry(context.Background(), "/buckets/b/dst/a.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, `"orig"`, dst.Remote.RemoteETag)
+	// reads keep resolving the source's key until the copy stamps the entry:
+	// its own key still holds the target's old object
+	assert.Equal(t, "/buckets/b/src/a.jpg", string(dst.Extended[filer.ExtRemoteRenameSourceKey]))
+	readDir, readName := server.filer.RemoteReadPath(dst, "/buckets/b/dst", "a.jpg")
+	assert.Equal(t, "/buckets/b/src", readDir)
+	assert.Equal(t, "a.jpg", readName)
+}
+
+func TestRenameRemoteOnlyEntryWithoutCopierIsRefused(t *testing.T) {
+	client := &renameRemoteClient{}
+	server, store := newRenameRemoteTestServer(t, client)
+	store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+
+	err := renameFile(server, "/buckets/b/src/a.jpg", "/buckets/b/dst/a.jpg")
+	require.ErrorContains(t, err, "cannot copy")
+
+	assert.Empty(t, client.recorded())
+	_, err = store.FindEntry(context.Background(), "/buckets/b/src/a.jpg")
+	require.NoError(t, err)
+	_, err = store.FindEntry(context.Background(), "/buckets/b/dst/a.jpg")
+	assert.ErrorIs(t, err, filer_pb.ErrNotFound)
+}
+
+func TestRenameRemoteOnlyEntryOutOfItsMountIsRefused(t *testing.T) {
+	for _, paths := range [][2]util.FullPath{
+		{"/buckets/b/src/a.jpg", "/buckets/c/a.jpg"},
+		{"/data/m/a.jpg", "/data/a.jpg"},
+	} {
+		t.Run(string(paths[1]), func(t *testing.T) {
+			client := copyingRenameRemoteClient{&renameRemoteClient{}}
+			server, store := newRenameRemoteTestServer(t, client)
+			store.entries[string(paths[0])] = remoteOnlyRenameEntry(string(paths[0]), 101)
+
+			err := renameFile(server, paths[0], paths[1])
+			require.ErrorContains(t, err, "cannot be renamed out of it")
+
+			assert.Empty(t, client.recorded())
+			_, err = store.FindEntry(context.Background(), paths[0])
+			require.NoError(t, err)
+			_, err = store.FindEntry(context.Background(), paths[1])
+			assert.ErrorIs(t, err, filer_pb.ErrNotFound)
+		})
+	}
+}
+
+func TestRenameEmptyRemoteEntryDoesNotCopy(t *testing.T) {
+	// nothing to lose: no copy, and no refusal even out of the mount or
+	// without a copier; the sync writes an empty object at a new key
+	client := &renameRemoteClient{}
+	server, store := newRenameRemoteTestServer(t, client)
+	for _, path := range []string{"/buckets/b/src/empty", "/data/m/empty"} {
+		entry := remoteOnlyRenameEntry(path, 101)
+		entry.FileSize = 0
+		entry.Remote.RemoteSize = 0
+		store.entries[path] = entry
+	}
+
+	require.NoError(t, renameFile(server, "/buckets/b/src/empty", "/buckets/b/dst/empty"))
+	require.NoError(t, renameFile(server, "/data/m/empty", "/data/empty"))
+
+	assert.Equal(t, []string{"delete origin/src/empty", "delete origin/m/empty"}, client.recorded())
+}
+
+func TestRenameRemoteOnlyEntryFailingAfterTheCopyKeepsTheSource(t *testing.T) {
+	for _, src := range []util.FullPath{"/buckets/b/src/a.jpg", "/buckets/b/src"} {
+		t.Run(string(src), func(t *testing.T) {
+			client := copyingRenameRemoteClient{&renameRemoteClient{}}
+			server, store := newRenameRemoteTestServer(t, client)
+			store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+			store.commitErr = errors.New("commit failed")
+
+			err := renameFile(server, src, "/buckets/b/moved")
+			require.ErrorContains(t, err, "commit failed")
+
+			// the old object, and the old directory holding it, are deleted
+			// only once the rename has committed
+			dst := "origin/moved"
+			if src == "/buckets/b/src" {
+				dst = "origin/moved/a.jpg"
+			}
+			assert.Equal(t, []string{"copy origin/src/a.jpg " + dst}, client.recorded())
+		})
+	}
+}
+
+func TestRenameEntryWithLocalDataDoesNotCopy(t *testing.T) {
+	client := copyingRenameRemoteClient{&renameRemoteClient{}}
+	server, store := newRenameRemoteTestServer(t, client)
+	entry := remoteOnlyRenameEntry("/data/m/a.jpg", 101)
+	entry.Chunks = []*filer_pb.FileChunk{{FileId: "1,0123456789", Size: 10}}
+	store.entries["/data/m/a.jpg"] = entry
+
+	// even out of the mount: the old object goes, the content stays local
+	require.NoError(t, renameFile(server, "/data/m/a.jpg", "/data/a.jpg"))
+
+	assert.Equal(t, []string{"delete origin/m/a.jpg"}, client.recorded())
+	dst, err := store.FindEntry(context.Background(), "/data/a.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, `"orig"`, dst.Remote.RemoteETag)
+	assert.Len(t, dst.GetChunks(), 1)
+}
+
+func TestRenameDirectoryCopiesRemoteOnlyChildren(t *testing.T) {
+	client := copyingRenameRemoteClient{&renameRemoteClient{}}
+	server, store := newRenameRemoteTestServer(t, client)
+	store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+	local := remoteOnlyRenameEntry("/buckets/b/src/b.jpg", 102)
+	local.Content = []byte("0123456789")
+	store.entries["/buckets/b/src/b.jpg"] = local
+
+	require.NoError(t, renameFile(server, "/buckets/b/src", "/buckets/b/moved"))
+
+	// b.jpg's old object goes with its entry, a.jpg's waits for the commit,
+	// and the old prefix is not swept: it could hold a newer object by then
+	assert.Equal(t, []string{
+		"copy origin/src/a.jpg origin/moved/a.jpg",
+		"delete origin/src/b.jpg",
+		"delete origin/src/a.jpg",
+	}, client.recorded())
+	moved, err := store.FindEntry(context.Background(), "/buckets/b/moved/a.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, `"copy"`, moved.Remote.RemoteETag)
+	moved, err = store.FindEntry(context.Background(), "/buckets/b/moved/b.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, `"orig"`, moved.Remote.RemoteETag)
+}
+
+func TestDeferredOldKeyDeleteKeepsAKeyRetakenSince(t *testing.T) {
+	client := copyingRenameRemoteClient{&renameRemoteClient{}}
+	server, store := newRenameRemoteTestServer(t, client)
+	event := metadataEvent{
+		oldEntry:        remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101),
+		newEntry:        remoteOnlyRenameEntry("/buckets/b/moved/a.jpg", 101),
+		deleteOldRemote: true,
+	}
+
+	// another rename put a remote-only entry at the old path after the commit
+	store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 303)
+	event.notify(server.filer, context.Background(), nil)
+	assert.Empty(t, client.recorded())
+
+	// a lookup that fails says nothing about the path
+	delete(store.entries, "/buckets/b/src/a.jpg")
+	store.findErr = errors.New("store unavailable")
+	event.notify(server.filer, context.Background(), nil)
+	assert.Empty(t, client.recorded())
+
+	store.findErr = nil
+	event.notify(server.filer, context.Background(), nil)
+	assert.Equal(t, []string{"delete origin/src/a.jpg"}, client.recorded())
+}
+
+func TestRenameRemoteOnlyEntryFinishesAfterTheCommitOnASQLStore(t *testing.T) {
+	// a SQL store keeps the transaction in the context and refuses calls
+	// through it once committed, so the work after the commit must not use it
+	for _, overTarget := range []bool{false, true} {
+		t.Run(map[bool]string{false: "new path", true: "over a remote-only target"}[overTarget], func(t *testing.T) {
+			client := copyingRenameRemoteClient{&renameRemoteClient{}}
+			server, store := newRenameRemoteTestServer(t, client)
+			store.strictTx = true
+			store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+			if overTarget {
+				store.entries["/buckets/b/dst/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/dst/a.jpg", 202)
+			}
+
+			require.NoError(t, renameFile(server, "/buckets/b/src/a.jpg", "/buckets/b/dst/a.jpg"))
+
+			// the copy is stamped and the old key deleted by the filer itself
+			assert.Equal(t, []string{"copy origin/src/a.jpg origin/dst/a.jpg", "delete origin/src/a.jpg"}, client.recorded())
+			dst, err := store.FindEntry(context.Background(), "/buckets/b/dst/a.jpg")
+			require.NoError(t, err)
+			assert.Equal(t, `"copy"`, dst.Remote.RemoteETag)
+		})
+	}
+}
+
+func TestRenamePendingEntryAgainCopiesFromItsSource(t *testing.T) {
+	client := copyingRenameRemoteClient{&renameRemoteClient{copyErr: errors.New("copy refused")}}
+	server, store := newRenameRemoteTestServer(t, client)
+	store.entries["/buckets/b/src/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/src/a.jpg", 101)
+	store.entries["/buckets/b/dst/a.jpg"] = remoteOnlyRenameEntry("/buckets/b/dst/a.jpg", 202)
+	store.entries["/buckets/b/dst/d.jpg"] = remoteOnlyRenameEntry("/buckets/b/dst/d.jpg", 303)
+
+	// the deferred copy fails: dst/a.jpg reads src/a.jpg's object
+	require.NoError(t, renameFile(server, "/buckets/b/src/a.jpg", "/buckets/b/dst/a.jpg"))
+
+	// renamed again over another remote-only file, failing again: the marker
+	// keeps naming the original source, not dst/a.jpg's old object
+	require.NoError(t, renameFile(server, "/buckets/b/dst/a.jpg", "/buckets/b/dst/d.jpg"))
+	d, err := store.FindEntry(context.Background(), "/buckets/b/dst/d.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, "/buckets/b/src/a.jpg", string(d.Extended[filer.ExtRemoteRenameSourceKey]))
+
+	// renamed to a new path, the copy comes from the source and clears the marker
+	client.copyErr = nil
+	require.NoError(t, renameFile(server, "/buckets/b/dst/d.jpg", "/buckets/b/dst/c.jpg"))
+	assert.Contains(t, client.recorded(), "copy origin/src/a.jpg origin/dst/c.jpg")
+	// the source is left to remote.sync: a concurrent rename may have copied
+	// onto that key before its entry is visible
+	assert.NotContains(t, client.recorded(), "delete origin/src/a.jpg")
+	c, err := store.FindEntry(context.Background(), "/buckets/b/dst/c.jpg")
+	require.NoError(t, err)
+	assert.Empty(t, c.Extended[filer.ExtRemoteRenameSourceKey])
+	assert.Equal(t, `"copy"`, c.Remote.RemoteETag)
+}
+
+func TestRemoteSourcePathStaysInTheMount(t *testing.T) {
+	server, _ := newRenameRemoteTestServer(t, &renameRemoteClient{})
+	entry := remoteOnlyRenameEntry("/buckets/b/x.jpg", 101)
+	for marker, want := range map[string]util.FullPath{
+		"/buckets/b/src/y.jpg": "/buckets/b/src/y.jpg", // same mount: the pending source
+		"/buckets/c/y.jpg":     "/buckets/b/x.jpg",     // another mount: ignored
+		"/tmp/y.jpg":           "/buckets/b/x.jpg",     // no mount: ignored
+	} {
+		entry.Extended = map[string][]byte{filer.ExtRemoteRenameSourceKey: []byte(marker)}
+		assert.Equal(t, want, server.filer.RemoteSourcePath(entry, "/buckets/b/x.jpg"), marker)
+	}
+}
+
+func TestTaggingCannotSetThePendingSourceMarker(t *testing.T) {
+	server, store := newRenameRemoteTestServer(t, &renameRemoteClient{})
+	store.entries["/buckets/b/x.jpg"] = remoteOnlyRenameEntry("/buckets/b/x.jpg", 101)
+
+	r := httptest.NewRequest(http.MethodPut, "/buckets/b/x.jpg?tagging", nil)
+	r.Header.Set("Seaweed-X-Remote-Rename-Source", "/buckets/b/other.jpg")
+	r.Header.Set("Seaweed-Album", "2026")
+	server.PutTaggingHandler(httptest.NewRecorder(), r)
+
+	x, err := store.FindEntry(context.Background(), "/buckets/b/x.jpg")
+	require.NoError(t, err)
+	assert.Equal(t, "2026", string(x.Extended["Seaweed-Album"]))
+	assert.Empty(t, x.Extended[filer.ExtRemoteRenameSourceKey], "only the filer sets the pending source")
+}
+
+func TestDeletingTagsKeepsThePendingSourceMarker(t *testing.T) {
+	server, store := newRenameRemoteTestServer(t, &renameRemoteClient{})
+	entry := remoteOnlyRenameEntry("/buckets/b/x.jpg", 101)
+	entry.Extended = map[string][]byte{"Seaweed-Album": []byte("2026"), filer.ExtRemoteRenameSourceKey: []byte("/buckets/b/src/x.jpg")}
+	store.entries["/buckets/b/x.jpg"] = entry
+
+	// no tag names: delete every tag
+	server.DeleteTaggingHandler(httptest.NewRecorder(), httptest.NewRequest(http.MethodDelete, "/buckets/b/x.jpg?tagging", nil))
+
+	x, err := store.FindEntry(context.Background(), "/buckets/b/x.jpg")
+	require.NoError(t, err)
+	assert.Empty(t, x.Extended["Seaweed-Album"])
+	assert.Equal(t, "/buckets/b/src/x.jpg", string(x.Extended[filer.ExtRemoteRenameSourceKey]), "the marker is not a tag")
+}
diff --git a/weed/server/filer_grpc_server_rename_test.go b/weed/server/filer_grpc_server_rename_test.go
index be5a4476ab..1a36bc45d3 100644
--- a/weed/server/filer_grpc_server_rename_test.go
+++ b/weed/server/filer_grpc_server_rename_test.go
@@ -29,7 +29,23 @@ type renameTestStore struct {
 	findCalls map[string]int
 	commitErr error
 	deleteErr error
+	listErr   error         // simulates a transient store/RPC failure from a directory listing
 	findDelay time.Duration // optional: widen check-then-act windows in tests
+	findErr   error         // simulates a failing entry lookup
+	strictTx  bool          // like a SQL store: calls through a committed transaction fail
+}
+
+type renameTestTxKey struct{}
+
+type renameTestTx struct{ done bool }
+
+// txDone reports a call through a transaction that has already committed or
+// rolled back, which a SQL store refuses.
+func (s *renameTestStore) txDone(ctx context.Context) error {
+	if tx, ok := ctx.Value(renameTestTxKey{}).(*renameTestTx); ok && tx.done {
+		return errors.New("sql: transaction has already been committed or rolled back")
+	}
+	return nil
 }
 
 func newRenameTestStore() *renameTestStore {
@@ -43,10 +59,23 @@ func (s *renameTestStore) GetName() string                             { return
 func (s *renameTestStore) Initialize(util.Configuration, string) error { return nil }
 func (s *renameTestStore) Shutdown()                                   {}
 func (s *renameTestStore) BeginTransaction(ctx context.Context) (context.Context, error) {
+	if s.strictTx {
+		return context.WithValue(ctx, renameTestTxKey{}, &renameTestTx{}), nil
+	}
 	return ctx, nil
 }
-func (s *renameTestStore) CommitTransaction(context.Context) error   { return s.commitErr }
-func (s *renameTestStore) RollbackTransaction(context.Context) error { return nil }
+func (s *renameTestStore) CommitTransaction(ctx context.Context) error {
+	if tx, ok := ctx.Value(renameTestTxKey{}).(*renameTestTx); ok {
+		tx.done = true
+	}
+	return s.commitErr
+}
+func (s *renameTestStore) RollbackTransaction(ctx context.Context) error {
+	if tx, ok := ctx.Value(renameTestTxKey{}).(*renameTestTx); ok {
+		tx.done = true
+	}
+	return nil
+}
 func (s *renameTestStore) KvPut(context.Context, []byte, []byte) error {
 	return nil
 }
@@ -55,27 +84,39 @@ func (s *renameTestStore) KvGet(context.Context, []byte) ([]byte, error) {
 }
 func (s *renameTestStore) KvDelete(context.Context, []byte) error { return nil }
 
-func (s *renameTestStore) InsertEntry(_ context.Context, entry *filer.Entry) error {
+func (s *renameTestStore) InsertEntry(ctx context.Context, entry *filer.Entry) error {
+	if err := s.txDone(ctx); err != nil {
+		return err
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.entries[string(entry.FullPath)] = entry.ShallowClone()
 	return nil
 }
 
-func (s *renameTestStore) UpdateEntry(_ context.Context, entry *filer.Entry) error {
+func (s *renameTestStore) UpdateEntry(ctx context.Context, entry *filer.Entry) error {
+	if err := s.txDone(ctx); err != nil {
+		return err
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.entries[string(entry.FullPath)] = entry.ShallowClone()
 	return nil
 }
 
-func (s *renameTestStore) FindEntry(_ context.Context, p util.FullPath) (*filer.Entry, error) {
+func (s *renameTestStore) FindEntry(ctx context.Context, p util.FullPath) (*filer.Entry, error) {
+	if err := s.txDone(ctx); err != nil {
+		return nil, err
+	}
 	if s.findDelay > 0 {
 		time.Sleep(s.findDelay)
 	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.findCalls[string(p)]++
+	if s.findErr != nil {
+		return nil, s.findErr
+	}
 	entry, found := s.entries[string(p)]
 	if !found {
 		return nil, filer_pb.ErrNotFound
@@ -83,7 +124,10 @@ func (s *renameTestStore) FindEntry(_ context.Context, p util.FullPath) (*filer.
 	return entry.ShallowClone(), nil
 }
 
-func (s *renameTestStore) DeleteEntry(_ context.Context, p util.FullPath) error {
+func (s *renameTestStore) DeleteEntry(ctx context.Context, p util.FullPath) error {
+	if err := s.txDone(ctx); err != nil {
+		return err
+	}
 	if s.deleteErr != nil {
 		return s.deleteErr
 	}
@@ -107,6 +151,11 @@ func (s *renameTestStore) DeleteFolderChildren(_ context.Context, p util.FullPat
 
 func (s *renameTestStore) listDirectoryEntries(dirPath util.FullPath, startFileName string, includeStartFile bool, limit int64, prefix string, eachEntryFunc filer.ListEachEntryFunc) (string, error) {
 	s.mu.Lock()
+	if s.listErr != nil {
+		err := s.listErr
+		s.mu.Unlock()
+		return "", err
+	}
 	var entries []*filer.Entry
 	for path, entry := range s.entries {
 		if path == string(dirPath) {
@@ -250,12 +299,13 @@ func newRenameTestFiler(t *testing.T, store *renameTestStore) *filer.Filer {
 	t.Cleanup(logBuffer.ShutdownLogBuffer)
 
 	return &filer.Filer{
-		Store:              filer.NewFilerStoreWrapper(store),
-		MasterClient:       masterClient,
-		FilerConf:          filer.NewFilerConf(),
-		RemoteStorage:      filer.NewFilerRemoteStorage(),
-		MaxFilenameLength:  255,
-		LocalMetaLogBuffer: logBuffer,
+		Store:               filer.NewFilerStoreWrapper(store),
+		MasterClient:        masterClient,
+		FilerConf:           filer.NewFilerConf(),
+		RemoteStorage:       filer.NewFilerRemoteStorage(),
+		MaxFilenameLength:   255,
+		LocalMetaLogBuffer:  logBuffer,
+		FileIdDeletionQueue: util.NewUnboundedQueue(),
 	}
 }
 
diff --git a/weed/server/filer_grpc_server_route.go b/weed/server/filer_grpc_server_route.go
new file mode 100644
index 0000000000..18126eaff4
--- /dev/null
+++ b/weed/server/filer_grpc_server_route.go
@@ -0,0 +1,180 @@
+package weed_server
+
+import (
+	"context"
+	"net"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+)
+
+// writeOwner returns the filer that serializes writes to key, or "" when this
+// filer is the serialization point — because it owns the key, or because there
+// is no ring and every filer applies locally.
+//
+// A ring change hands a key to its new owner before that owner has rebuilt the
+// locks the prior owner still holds, so the prior owner keeps the key until the
+// cooling-off window closes.
+func (fs *FilerServer) writeOwner(key string) pb.ServerAddress {
+	if fs.filer.Dlm == nil {
+		return ""
+	}
+	owner := fs.filer.Dlm.LockRing.WriteOwner(key)
+	if owner == fs.option.Host {
+		return ""
+	}
+	return owner
+}
+
+// forwardToWriteOwner sends the request to key's write owner so a single filer's
+// per-path lock arbitrates every writer of that key. handled=false means this
+// filer is the owner and the caller should apply the request locally.
+//
+// An unreachable owner fails the request; it is never re-sent to another filer.
+// gRPC reports a response lost in transit as Unavailable, indistinguishable from
+// one the owner never saw, so a retry elsewhere could re-apply what the owner
+// already committed — and an owner unreachable from here may be partitioned
+// rather than down, still serving the key to everyone else. The ring hands the
+// key on when the cooling-off window closes, so the outage is bounded.
+func (fs *FilerServer) forwardToWriteOwner(ctx context.Context, key string, send func(owner pb.ServerAddress) error) (handled bool, err error) {
+	owner := fs.writeOwner(key)
+	if owner == "" {
+		return false, nil
+	}
+	if err := send(owner); err != nil {
+		glog.V(1).InfofCtx(ctx, "route %s to owner %s: %v", key, owner, err)
+		return true, err
+	}
+	return true, nil
+}
+
+// entryRouteKey is the ring key for an entry's writes. It shares the S3
+// gateway's namespace so an object's ObjectTransaction and its CreateEntry
+// resolve to the same owner, and land on that filer's one per-path lock.
+func entryRouteKey(fullpath util.FullPath) string {
+	return s3_constants.ObjectWriteRouteKeyPrefix + string(fullpath)
+}
+
+// movedFromPeer reports whether an is_moved marker arrived on a connection
+// from a ring member, i.e. it marks a genuine forwarded hop.
+func (fs *FilerServer) movedFromPeer(ctx context.Context, isMoved bool) bool {
+	if !isMoved || fs.filer.Dlm == nil {
+		return false
+	}
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return false
+	}
+	peerHost, _, err := net.SplitHostPort(p.Addr.String())
+	if err != nil {
+		return false
+	}
+	peerIP := net.ParseIP(peerHost)
+	if peerIP == nil {
+		return false
+	}
+	for _, ip := range fs.ringMemberIPs(ctx) {
+		if ip.Equal(peerIP) {
+			return true
+		}
+	}
+	return false
+}
+
+// ringPeerIPs caches resolved member addresses of one ring membership. A
+// member's hostname may re-resolve under the same ring address, so the cache
+// expires rather than trusting the resolution forever.
+type ringPeerIPs struct {
+	members string
+	ips     []net.IP
+	expires time.Time
+}
+
+const ringPeerIPTTL = 5 * time.Minute
+
+// ringMemberIPs returns the ring members' addresses as IPs. Members can
+// advertise hostnames, so resolution is cached per membership to keep DNS off
+// each forwarded request; a failed lookup is not cached, so a DNS blip does
+// not keep rejecting genuine forwards until the next ring change.
+func (fs *FilerServer) ringMemberIPs(ctx context.Context) []net.IP {
+	members := fs.filer.Dlm.LockRing.GetSnapshot()
+	var sb strings.Builder
+	for _, member := range members {
+		sb.WriteString(string(member))
+		sb.WriteByte(' ')
+	}
+	key := sb.String()
+	if cached := fs.ringPeerIPs.Load(); cached != nil && cached.members == key && time.Now().Before(cached.expires) {
+		return cached.ips
+	}
+	resolved, _, _ := fs.ringResolveGroup.Do(key, func() (any, error) {
+		if cached := fs.ringPeerIPs.Load(); cached != nil && cached.members == key && time.Now().Before(cached.expires) {
+			return cached.ips, nil
+		}
+		// Shared by every caller waiting on this key: the lookups outlive the
+		// first request's cancellation, and run in parallel so one slow member
+		// cannot starve the rest of the shared deadline.
+		var ips []net.IP
+		var hosts []string
+		for _, member := range members {
+			host, _, err := net.SplitHostPort(string(member))
+			if err != nil {
+				continue
+			}
+			if ip := net.ParseIP(host); ip != nil {
+				ips = append(ips, ip)
+				continue
+			}
+			hosts = append(hosts, host)
+		}
+		var wg sync.WaitGroup
+		var mu sync.Mutex
+		failed := false
+		for _, host := range hosts {
+			wg.Add(1)
+			go func(host string) {
+				defer wg.Done()
+				lookupCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 3*time.Second)
+				defer cancel()
+				found, err := net.DefaultResolver.LookupIP(lookupCtx, "ip", host)
+				mu.Lock()
+				defer mu.Unlock()
+				if err != nil {
+					failed = true
+					return
+				}
+				ips = append(ips, found...)
+			}(host)
+		}
+		wg.Wait()
+		if !failed {
+			fs.ringPeerIPs.Store(&ringPeerIPs{members: key, ips: ips, expires: time.Now().Add(ringPeerIPTTL)})
+		}
+		return ips, nil
+	})
+	return resolved.([]net.IP)
+}
+
+// checkMovedMarker refuses a request whose is_moved marker did not arrive from
+// a ring member while this filer is not the key's owner. The marker is
+// caller-controlled: applying it would evaluate a conditional mutation under a
+// non-owner's lock, and re-forwarding a claimed hop can cycle while rings
+// disagree — so an unverifiable marker on a non-owner is refused instead.
+// PermissionDenied keeps the refusal distinct from a write condition's
+// FailedPrecondition, which callers use to detect a stale stamp.
+// owner=="" means this filer is the serialization point and the request can
+// be applied locally.
+func (fs *FilerServer) checkMovedMarker(ctx context.Context, isMoved bool, owner pb.ServerAddress) error {
+	if !isMoved || owner == "" || owner == fs.option.Host || fs.movedFromPeer(ctx, isMoved) {
+		return nil
+	}
+	return status.Errorf(codes.PermissionDenied, "is_moved not sent by a ring member; the key's owner is %s", owner)
+}
diff --git a/weed/server/filer_grpc_server_route_test.go b/weed/server/filer_grpc_server_route_test.go
new file mode 100644
index 0000000000..bf9098677a
--- /dev/null
+++ b/weed/server/filer_grpc_server_route_test.go
@@ -0,0 +1,108 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+)
+
+// routeTestServer builds a filer whose ring holds the given snapshots, newest
+// last. Host is deliberately outside the ring in the forwarding tests so no key
+// is ever owned locally.
+func routeTestServer(host pb.ServerAddress, snapshots ...[]pb.ServerAddress) *FilerServer {
+	dlm := lock_manager.NewDistributedLockManager(host)
+	for i, servers := range snapshots {
+		dlm.LockRing.SetSnapshot(servers, int64(i+1))
+	}
+	return &FilerServer{
+		filer:  &filer.Filer{Dlm: dlm},
+		option: &FilerOption{Host: host},
+	}
+}
+
+var (
+	routeSetA = []pb.ServerAddress{"f1:8888", "f2:8888", "f3:8888"}
+	routeSetB = []pb.ServerAddress{"f1:8888", "f2:8888", "f3:8888", "f4:8888"}
+)
+
+// firstKey returns the first synthetic path the ring answers match for.
+func firstKey(t *testing.T, match func(key string) bool) string {
+	t.Helper()
+	for i := 0; i < 4000; i++ {
+		key := fmt.Sprintf("/buckets/b/key-%d", i)
+		if match(key) {
+			return key
+		}
+	}
+	t.Skip("no key satisfying the ring condition")
+	return ""
+}
+
+func TestWriteOwnerNoRing(t *testing.T) {
+	fs := routeTestServer("f9:8888")
+	if got := fs.writeOwner("/any"); got != "" {
+		t.Fatalf("no ring snapshot must leave the write local, got %v", got)
+	}
+}
+
+func TestWriteOwnerStableKeyUsesPrimary(t *testing.T) {
+	fs := routeTestServer("f9:8888", routeSetA, routeSetB)
+	ring := fs.filer.Dlm.LockRing
+
+	stable := firstKey(t, func(key string) bool { return ring.PriorOwner(key) == "" })
+	if got := fs.writeOwner(stable); got != ring.GetPrimary(stable) {
+		t.Fatalf("stable key must route to the primary, got %v want %v", got, ring.GetPrimary(stable))
+	}
+}
+
+// A key whose ownership just moved must keep going to the prior owner: the new
+// owner has not rebuilt the locks the prior one still holds.
+func TestWriteOwnerMovedKeyUsesPriorOwner(t *testing.T) {
+	fs := routeTestServer("f9:8888", routeSetA, routeSetB)
+	ring := fs.filer.Dlm.LockRing
+
+	moved := firstKey(t, func(key string) bool { return ring.PriorOwner(key) != "" })
+	if got := fs.writeOwner(moved); got != ring.PriorOwner(moved) {
+		t.Fatalf("moved key must route to the prior owner, got %v want %v", got, ring.PriorOwner(moved))
+	}
+}
+
+func TestForwardToWriteOwnerAppliesLocallyWhenOwned(t *testing.T) {
+	fs := routeTestServer("f2:8888", routeSetA)
+	ring := fs.filer.Dlm.LockRing
+
+	key := firstKey(t, func(key string) bool { return ring.GetPrimary(key) == "f2:8888" })
+	handled, err := fs.forwardToWriteOwner(context.Background(), key, func(pb.ServerAddress) error {
+		t.Fatal("must not forward a key this filer owns")
+		return nil
+	})
+	if handled || err != nil {
+		t.Fatalf("owned key must be applied locally, got handled=%v err=%v", handled, err)
+	}
+}
+
+// A failed forward must surface, never re-send to a second filer: gRPC cannot
+// tell a lost response from an unsent request, and an owner unreachable from
+// here may be partitioned rather than down.
+func TestForwardToWriteOwnerNeverTriesASecondFiler(t *testing.T) {
+	fs := routeTestServer("f9:8888", routeSetA, routeSetB)
+	ring := fs.filer.Dlm.LockRing
+
+	moved := firstKey(t, func(key string) bool { return ring.PriorOwner(key) != "" })
+	var tried []pb.ServerAddress
+	handled, err := fs.forwardToWriteOwner(context.Background(), moved, func(owner pb.ServerAddress) error {
+		tried = append(tried, owner)
+		return errors.New("dial tcp: connection refused")
+	})
+	if !handled || err == nil {
+		t.Fatalf("unreachable owner must surface an error, got handled=%v err=%v", handled, err)
+	}
+	if len(tried) != 1 || tried[0] != ring.PriorOwner(moved) {
+		t.Fatalf("expected exactly the prior owner, tried %v", tried)
+	}
+}
diff --git a/weed/server/filer_grpc_server_self_copy_condition_test.go b/weed/server/filer_grpc_server_self_copy_condition_test.go
new file mode 100644
index 0000000000..dafd66d94f
--- /dev/null
+++ b/weed/server/filer_grpc_server_self_copy_condition_test.go
@@ -0,0 +1,87 @@
+package weed_server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Exercise the native condition and UpdateEntry commit, independently of the
+// S3 handler's fake filer: same-content changes must invalidate a whole snapshot.
+func TestSelfCopyEntryCondition(t *testing.T) {
+	tests := []struct {
+		name   string
+		change func(*filer_pb.Entry)
+	}{
+		{name: "unchanged control"},
+		{name: "mode", change: func(e *filer_pb.Entry) { e.Attributes.FileMode = 0644 }},
+		{name: "mime", change: func(e *filer_pb.Entry) { e.Attributes.Mime = "image/png" }},
+		{name: "legal hold", change: func(e *filer_pb.Entry) { e.Extended[s3_constants.ExtLegalHoldKey] = []byte("ON") }},
+		{name: "content", change: func(e *filer_pb.Entry) {
+			e.Content = []byte("next")
+			e.Extended[s3_constants.ExtETagKey] = []byte("next-etag")
+		}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs, store := newTxnTestServer(t, map[string]*filer.Entry{
+				"/buckets/b/obj": {
+					Attr:     filer.Attr{Inode: 1, Mtime: time.Unix(1700000000, 0), Crtime: time.Unix(1700000000, 0), Ctime: time.Unix(1700000000, 0), Atime: time.Unix(1700000000, 0), Mode: 0660, Mime: "text/plain", FileSize: 4},
+					Content:  []byte("data"),
+					Extended: map[string][]byte{s3_constants.ExtETagKey: []byte("same-etag"), s3_constants.ExtAmzAclKey: []byte("original grants")},
+				},
+			})
+			expected := store.entries["/buckets/b/obj"].ToProtoEntry()
+			updated := proto.Clone(expected).(*filer_pb.Entry)
+			updated.Extended[s3_constants.ExtAmzAclKey] = []byte("private grants")
+			req := &filer_pb.UpdateEntryRequest{
+				Directory: "/buckets/b", Entry: updated,
+				Condition: one(&filer_pb.WriteCondition_Clause{Kind: filer_pb.WriteCondition_IF_ENTRY_EQUAL, ExpectedEntry: expected}),
+			}
+			if tt.change != nil {
+				concurrent := proto.Clone(expected).(*filer_pb.Entry)
+				tt.change(concurrent)
+				if _, err := fs.UpdateEntry(context.Background(), &filer_pb.UpdateEntryRequest{Directory: "/buckets/b", Entry: concurrent}); err != nil {
+					t.Fatal(err)
+				}
+			}
+			_, err := fs.UpdateEntry(context.Background(), req)
+			if tt.change != nil {
+				if status.Code(err) != codes.FailedPrecondition {
+					t.Fatalf("stale self-copy: want FailedPrecondition, got %v", err)
+				}
+				current := store.entries["/buckets/b/obj"].ToProtoEntry()
+				if string(current.Extended[s3_constants.ExtAmzAclKey]) != "original grants" {
+					t.Fatal("failed condition changed grants")
+				}
+				// A fresh retry preserves the intervening content and unmanaged keys
+				// while setting the desired mode and grants in the same update.
+				req.Condition.Clauses[0].ExpectedEntry = current
+				req.Entry = proto.Clone(current).(*filer_pb.Entry)
+				req.Entry.Attributes.FileMode = 0660
+				req.Entry.Extended[s3_constants.ExtAmzAclKey] = []byte("private grants")
+				_, err = fs.UpdateEntry(context.Background(), req)
+			}
+			if err != nil {
+				t.Fatalf("fresh self-copy: %v", err)
+			}
+			stored := store.entries["/buckets/b/obj"].ToProtoEntry()
+			if stored.Attributes.FileMode != 0660 || string(stored.Extended[s3_constants.ExtAmzAclKey]) != "private grants" {
+				t.Fatal("mode and grants did not commit together")
+			}
+			if tt.name == "legal hold" && string(stored.Extended[s3_constants.ExtLegalHoldKey]) != "ON" {
+				t.Fatal("retry lost legal hold")
+			}
+			if tt.name == "content" && string(stored.Content) != "next" {
+				t.Fatal("retry resurrected stale content")
+			}
+		})
+	}
+}
diff --git a/weed/server/filer_grpc_server_sub_meta.go b/weed/server/filer_grpc_server_sub_meta.go
index f57b3dba6b..9db11ec09c 100644
--- a/weed/server/filer_grpc_server_sub_meta.go
+++ b/weed/server/filer_grpc_server_sub_meta.go
@@ -11,6 +11,8 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/proto"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -27,6 +29,11 @@ var (
 	// (possibly-unflushed) gap, in case the flush notification is missed.
 	unflushedGapRetryInterval = 2 * time.Second
 
+	// aggDiskReprobeInterval paces the aggregated persisted-log re-listing for
+	// files no watermark signals: a peer past the flush low-watermark can land
+	// a file without moving the minimum.
+	aggDiskReprobeInterval = 2 * time.Second
+
 	// gapStallWarnInterval paces the warning for a subscriber that stays parked.
 	gapStallWarnInterval = time.Minute
 
@@ -34,8 +41,20 @@ var (
 	// and logged: a dead peer makes the wait permanent, and failing the stream
 	// only moves the loop into a client that reconnects to the same wall.
 	maxGapStall = 15 * time.Minute
+
+	// metadataGapSettledHorizon is the liveness escape for the peer-watermark
+	// holds: a watermark stalled further than this stops holding reads back.
+	// Twice the flush interval so a healthy peer's flush always lands within.
+	metadataGapSettledHorizon = 2 * filer.LogFlushInterval
 )
 
+// errAggregationUpgrade ends a delegated local stream when remote peers
+// appear, so the client reconnects to the aggregated stream. It is an
+// error, not a clean end: RetryUntil-driven followers treat a clean end as
+// "following finished" and stop reconnecting. It wraps StopReadingError so
+// LoopProcessLogData does not log it.
+var errAggregationUpgrade = fmt.Errorf("remote filer peers discovered after subscription started; reconnect for aggregated metadata: %w", log_buffer.StopReadingError)
+
 const (
 	// MaxUnsyncedEvents send empty notification with timestamp when certain amount of events have been filtered
 	MaxUnsyncedEvents = 1e3
@@ -45,6 +64,21 @@ const (
 	// newer. It keeps freshness signals such as filer.sync's sync_offset metric
 	// from looking stuck during read-only periods on the source.
 	idleHeartbeatInterval = 5 * time.Second
+
+	// peerDeliveryClaimInterval paces that heartbeat on the local stream of a
+	// filer with peers, where it is not a keepalive but a delivery claim: the
+	// peer aggregator turns it into its delivery low-watermark, and every
+	// aggregated subscriber in the cluster holds at the minimum across peers.
+	// So this, not idleHeartbeatInterval, is how far behind live writes a
+	// quiet filer leaves them. Rounded up to the reader's own poll interval.
+	peerDeliveryClaimInterval = 200 * time.Millisecond
+
+	// heldWakeFloor coalesces hold releases. Peers advance their watermarks
+	// per event they stream, and each release costs a whole pass - a log file
+	// listing included - so releasing on every advance turns a busy cluster
+	// into a listing storm. It is added to delivery latency, so it stays well
+	// under the claim interval that already bounds it.
+	heldWakeFloor = 20 * time.Millisecond
 )
 
 // metadataStreamSender is satisfied by both gRPC stream types and pipelinedSender.
@@ -52,6 +86,13 @@ type metadataStreamSender interface {
 	Send(*filer_pb.SubscribeMetadataResponse) error
 }
 
+// metadataLocalStream is the subset of the local-subscribe gRPC server stream
+// the local loop uses, so the aggregated stream type can delegate to it.
+type metadataLocalStream interface {
+	Send(*filer_pb.SubscribeMetadataResponse) error
+	Context() context.Context
+}
+
 const (
 	// batchBehindThreshold: when an event's timestamp is older than this
 	// relative to wall clock, the sender switches to batch mode for throughput.
@@ -70,14 +111,16 @@ const (
 // current time (backlog catch-up), multiple events are packed into a single
 // stream.Send() using the Events field. Otherwise events are sent one-by-one.
 type pipelinedSender struct {
+	ctx      context.Context
 	sendCh   chan *filer_pb.SubscribeMetadataResponse
 	errCh    chan error
 	done     chan struct{}
 	canBatch bool // true only if client set ClientSupportsBatching
 }
 
-func newPipelinedSender(stream metadataStreamSender, bufSize int, clientSupportsBatching bool) *pipelinedSender {
+func newPipelinedSender(ctx context.Context, stream metadataStreamSender, bufSize int, clientSupportsBatching bool) *pipelinedSender {
 	s := &pipelinedSender{
+		ctx:      ctx,
 		sendCh:   make(chan *filer_pb.SubscribeMetadataResponse, bufSize),
 		errCh:    make(chan error, 1),
 		done:     make(chan struct{}),
@@ -89,19 +132,36 @@ func newPipelinedSender(stream metadataStreamSender, bufSize int, clientSupports
 
 func (s *pipelinedSender) sendLoop(stream metadataStreamSender) {
 	defer close(s.done)
+	// No Send may start after the subscription context ends: the handler is
+	// returning, and gRPC tears the stream down behind it. A Send already in
+	// flight is released by that teardown (the stream context unblocks it).
+	send := func(msg *filer_pb.SubscribeMetadataResponse) bool {
+		if s.ctx.Err() != nil {
+			return false
+		}
+		if err := stream.Send(msg); err != nil {
+			if s.ctx.Err() == nil {
+				s.reportErr(err)
+			}
+			return false
+		}
+		return true
+	}
 	for msg := range s.sendCh {
 		// LogFileRefs messages are unbatchable: the client recognizes them by
 		// the top-level field and skips the rest of the response, so a refs
 		// envelope would drop its Events tail and refs inside Events would be
 		// applied as an (empty) event. Their TsNs is 0, which the batch
 		// heuristic would misread as far behind. Always send them solo.
-		shouldBatch := s.canBatch && len(msg.LogFileRefs) == 0 &&
+		// Control messages (nil EventNotification: heartbeats, flush reports)
+		// are unbatchable too - nested in an Events tail their watermark
+		// state is invisible to receivers.
+		shouldBatch := s.canBatch && len(msg.LogFileRefs) == 0 && msg.EventNotification != nil &&
 			time.Now().UnixNano()-msg.TsNs > int64(batchBehindThreshold)
 
 		if !shouldBatch {
 			// Real-time: send immediately for low latency
-			if err := stream.Send(msg); err != nil {
-				s.reportErr(err)
+			if !send(msg) {
 				return
 			}
 			continue
@@ -112,7 +172,7 @@ func (s *pipelinedSender) sendLoop(stream metadataStreamSender) {
 		// go in the Events slice. Old clients ignore the Events field.
 		batch := make([]*filer_pb.SubscribeMetadataResponse, 0, maxBatchSize)
 		batch = append(batch, msg)
-		var trailingRefs *filer_pb.SubscribeMetadataResponse
+		var trailingSolo *filer_pb.SubscribeMetadataResponse
 	drain:
 		for len(batch) < maxBatchSize {
 			select {
@@ -120,9 +180,9 @@ func (s *pipelinedSender) sendLoop(stream metadataStreamSender) {
 				if !ok {
 					break drain
 				}
-				if len(next.LogFileRefs) > 0 {
+				if len(next.LogFileRefs) > 0 || next.EventNotification == nil {
 					// already consumed; send it solo right after the batch
-					trailingRefs = next
+					trailingSolo = next
 					break drain
 				}
 				batch = append(batch, next)
@@ -139,18 +199,14 @@ func (s *pipelinedSender) sendLoop(stream metadataStreamSender) {
 			toSend = batch[0]
 			toSend.Events = batch[1:]
 		}
-		if err := stream.Send(toSend); err != nil {
-			s.reportErr(err)
+		if !send(toSend) {
 			return
 		}
 		if toSend.Events != nil {
 			toSend.Events = nil
 		}
-		if trailingRefs != nil {
-			if err := stream.Send(trailingRefs); err != nil {
-				s.reportErr(err)
-				return
-			}
+		if trailingSolo != nil && !send(trailingSolo) {
+			return
 		}
 	}
 }
@@ -165,11 +221,16 @@ func (s *pipelinedSender) reportErr(err error) {
 }
 
 func (s *pipelinedSender) Send(msg *filer_pb.SubscribeMetadataResponse) error {
+	if err := s.ctx.Err(); err != nil {
+		return err
+	}
 	select {
 	case s.sendCh <- msg:
 		return nil
 	case err := <-s.errCh:
 		return err
+	case <-s.ctx.Done():
+		return s.ctx.Err()
 	case <-s.done:
 		// Sender goroutine exited (stream error or shutdown).
 		select {
@@ -183,7 +244,12 @@ func (s *pipelinedSender) Send(msg *filer_pb.SubscribeMetadataResponse) error {
 
 func (s *pipelinedSender) Close() error {
 	close(s.sendCh)
-	<-s.done
+	// A sendLoop stuck in stream.Send only unblocks once the handler's return
+	// ends the stream, so stop waiting when the subscription ends.
+	select {
+	case <-s.done:
+	case <-s.ctx.Done():
+	}
 	select {
 	case err := <-s.errCh:
 		return err
@@ -192,15 +258,18 @@ func (s *pipelinedSender) Close() error {
 	}
 }
 
-// reportUnprovenAggregatedCrossing records the residual hole: a disk read that
-// crosses the eviction watermark may have advanced on one peer's log while a
-// lagging peer still holds unflushed events in the crossed range. Locally
-// undecidable (log files carry random filer ids, peers are tracked by address);
-// closing it needs each peer's flush watermark on the subscribe stream.
-func reportUnprovenAggregatedCrossing(cursorBeforeTsNs, cursorAfterTsNs, evictedTsNs int64, clientName, pathPrefix string) {
+// reportUnprovenAggregatedCrossing counts a disk read crossing the eviction
+// watermark without proof. A crossing at or below provenThroughTsNs (the
+// flush low-watermark frozen before the pass listed files) is proven and not
+// reported, so what remains is exactly what the settled-horizon escape
+// allowed past a stalled peer.
+func reportUnprovenAggregatedCrossing(cursorBeforeTsNs, cursorAfterTsNs, evictedTsNs, provenThroughTsNs int64, clientName, pathPrefix string) {
 	if evictedTsNs == 0 || cursorBeforeTsNs >= evictedTsNs || cursorAfterTsNs < evictedTsNs {
 		return
 	}
+	if provenThroughTsNs >= evictedTsNs {
+		return
+	}
 	stats.FilerSubscribeUnprovenGapCrossings.WithLabelValues("aggregated").Inc()
 	glog.Warningf("aggregated subscriber %s %s crossed an evicted range (%v..%v] on peer disk reads; a peer that flushes into it later will not be re-read",
 		clientName, pathPrefix, time.Unix(0, cursorBeforeTsNs), time.Unix(0, evictedTsNs))
@@ -232,6 +301,45 @@ func memoryHoldsGap(currentTsNs, lastEvictedTsNs int64) bool {
 	return currentTsNs >= lastEvictedTsNs
 }
 
+// errHeldByPeerWatermark aborts a read at an entry beyond the hold point; the
+// caller rewinds to the last delivered entry, waits, and re-reads (the
+// re-listing is what picks up a late-landing log file). Holding is the normal
+// state on a cluster that keeps writing, hence the quiet stop.
+var errHeldByPeerWatermark = fmt.Errorf("held by aggregated peer watermark: %w", log_buffer.StopReadingError)
+
+// resolveAggReadHoldTsNs bounds how far an aggregated subscriber may read: a
+// cursor that passes T before every source has provably made T visible loses
+// whatever arrives late. The hold is the peers' low-watermark (delivery for
+// memory reads, flush for persisted reads), relaxed by the settled horizon so
+// a stalled peer delays subscribers by at most the horizon.
+func resolveAggReadHoldTsNs(peerLowWatermarkTsNs, nowTsNs int64, settledHorizon time.Duration) int64 {
+	horizonTsNs := nowTsNs - int64(settledHorizon)
+	if peerLowWatermarkTsNs > horizonTsNs {
+		return peerLowWatermarkTsNs
+	}
+	return horizonTsNs
+}
+
+// previousMinuteEndTsNs returns the last nanosecond of the minute before
+// tsNs: log files are named per minute, so a ref listing bounded here cannot
+// include a file whose window crosses tsNs.
+func previousMinuteEndTsNs(tsNs int64) int64 {
+	return tsNs - tsNs%int64(time.Minute) - 1
+}
+
+// chunkRefsStopTsNs bounds the ref listing so no shipped file holds an entry
+// past the hold: clients apply shipped files whole and may checkpoint from a
+// tail. A file's window starts in its name's minute and spans up to a flush
+// interval, hence the double back-off; a frozen peer's freeze-spanning window
+// can still overshoot by its freeze.
+func chunkRefsStopTsNs(holdTsNs, untilNs int64) int64 {
+	stopTsNs := previousMinuteEndTsNs(holdTsNs - int64(filer.LogFlushInterval))
+	if untilNs != 0 && untilNs < stopTsNs {
+		stopTsNs = untilNs
+	}
+	return stopTsNs
+}
+
 // gapStallReporter makes a parked subscriber visible: a flush that never lands
 // stalls the stream for good, and filer.sync and mount followers just stop
 // advancing with no error on either side.
@@ -338,17 +446,17 @@ func (r *gapStallReporter) close() {
 // corresponds to the event being waited for. The park is where a stalled
 // subscriber spends all its time, so every exit the read loop relies on has to
 // be checked here too.
-func (fs *FilerServer) parkOnGap(ctx context.Context, req *filer_pb.SubscribeMetadataRequest, gapStall *gapStallReporter, evictedTsNs func() int64, cursor log_buffer.MessagePosition, notifyChan <-chan struct{}, reason string) (skipToTsNs int64, skip bool, done bool) {
+func (fs *FilerServer) parkOnGap(ctx context.Context, req *filer_pb.SubscribeMetadataRequest, gapStall *gapStallReporter, evictedTsNs func() int64, cursor log_buffer.MessagePosition, notifyChan <-chan struct{}, reason string, upgradeOnRemotePeer <-chan struct{}) (skipToTsNs int64, skip bool, done bool, upgrade bool) {
 	// Done exits run before park(): a finished stream was never parked, and
 	// marking it so leaves a false "still behind" trace. A cursor at UntilNs is
 	// finished - the bound is inclusive, cursors are exclusive, and
 	// LoopProcessLogData (the only place UntilNs ends a stream) is unreachable
 	// from a park.
 	if req.UntilNs != 0 && cursor.Time.UnixNano() >= req.UntilNs {
-		return 0, false, true
+		return 0, false, true, false
 	}
 	if !fs.hasClient(req.ClientId, req.ClientEpoch) {
-		return 0, false, true
+		return 0, false, true, false
 	}
 	gapStall.park(cursor.Time, reason)
 	if gapStall.stalledFor() >= maxGapStall {
@@ -356,7 +464,7 @@ func (fs *FilerServer) parkOnGap(ctx context.Context, req *filer_pb.SubscribeMet
 		// strictly after it, so the recorded loss is exactly (cursor, skipTo].
 		if evicted := evictedTsNs(); evicted > cursor.Time.UnixNano() {
 			gapStall.gaveUp(cursor.Time, evicted, reason)
-			return evicted, true, false
+			return evicted, true, false, false
 		}
 		// Nothing was withheld past the cursor - nothing to skip, nothing being
 		// lost; keep waiting on a fresh stall cycle.
@@ -380,13 +488,15 @@ func (fs *FilerServer) parkOnGap(ctx context.Context, req *filer_pb.SubscribeMet
 				continue
 			}
 		case <-ctx.Done():
-			return 0, false, true
+			return 0, false, true, false
+		case <-upgradeOnRemotePeer:
+			return 0, false, false, true
 		case <-retry:
 		}
 		if !fs.hasClient(req.ClientId, req.ClientEpoch) {
-			return 0, false, true
+			return 0, false, true, false
 		}
-		return 0, false, false
+		return 0, false, false, false
 	}
 }
 
@@ -395,8 +505,9 @@ func (fs *FilerServer) parkOnGap(ctx context.Context, req *filer_pb.SubscribeMet
 // so memory still holds the whole gap; or the flush watermark observed before
 // the read had already passed the earliest in-memory timestamp, so every event
 // in the gap would have been on disk when the read ran and the miss is
-// authoritative. The aggregated ring never flushes - peers persist their own
-// logs - so it passes flushedTsNs 0 and only the eviction proof can hold.
+// authoritative. The aggregated loop passes its peers' proven-covered
+// watermark as flushedTsNs (everything at or below it was flushed and inside
+// the pass's listing), the local loop its own flush watermark.
 func resolveGapResume(currentTsNs, currentOffset, earliestMemTsNs, flushedTsNs, lastEvictedTsNs int64) (advanceToTsNs int64, advance bool) {
 	// No in-memory data (zero time → negative UnixNano), or memory not ahead of us.
 	if earliestMemTsNs <= 0 || earliestMemTsNs <= currentTsNs {
@@ -431,15 +542,16 @@ func resolveGapResume(currentTsNs, currentOffset, earliestMemTsNs, flushedTsNs,
 // the two subscribe loops; everything else about them must stay identical, and
 // this PR's history shows they drift when edited separately.
 type gapPass struct {
-	fs        *FilerServer
-	req       *filer_pb.SubscribeMetadataRequest
-	gapStall  *gapStallReporter
-	earliest  func() time.Time
-	evicted   func() int64 // gap-proof watermark; aggregated uses the received-ts space
-	flushed   func() int64 // flush watermark the last disk read observed; aggregated: 0
-	gapChan   <-chan struct{}
-	dataChan  <-chan struct{}
-	gapReason func(earliest time.Time, evictedTsNs int64) string
+	fs                  *FilerServer
+	req                 *filer_pb.SubscribeMetadataRequest
+	gapStall            *gapStallReporter
+	earliest            func() time.Time
+	evicted             func() int64 // gap-proof watermark; aggregated uses the received-ts space
+	flushed             func() int64 // what the last disk read proved covered: flushed AND inside its listing
+	gapChan             <-chan struct{}
+	dataChan            <-chan struct{}
+	gapReason           func(earliest time.Time, evictedTsNs int64) string
+	upgradeOnRemotePeer <-chan struct{}
 }
 
 type gapOutcome int
@@ -448,6 +560,7 @@ const (
 	gapProceed  gapOutcome = iota // read memory
 	gapContinue                   // restart the pass
 	gapDone                       // the stream is over
+	gapUpgrade                    // remote peer arrived; end for reconnect
 )
 
 // resolve is the gap decision both loops run between the disk pass and the
@@ -471,6 +584,16 @@ func (p *gapPass) resolve(ctx context.Context, cursor *log_buffer.MessagePositio
 			*latch = nil
 			return gapProceed
 		}
+		// The last empty disk read proved coverage through the eviction
+		// watermark itself: the rest of the gap holds nothing - cross without
+		// parking or counting. The ring's pre-subscription mark is never
+		// proven by rotation, so this is its only exit.
+		if p.flushed() >= evictedTsNs {
+			p.gapStall.resumed()
+			*cursor = log_buffer.NewMessagePosition(evictedTsNs, gapResumeCursorOffset)
+			*latch = nil
+			return gapContinue
+		}
 		return p.park(ctx, cursor, latch, p.gapChan, p.gapReason(earliest, evictedTsNs))
 	}
 	if !diskAdvanced && errors.Is(*latch, log_buffer.ResumeFromDiskError) {
@@ -489,10 +612,13 @@ func (p *gapPass) resolve(ctx context.Context, cursor *log_buffer.MessagePositio
 }
 
 func (p *gapPass) park(ctx context.Context, cursor *log_buffer.MessagePosition, latch *error, notifyChan <-chan struct{}, reason string) gapOutcome {
-	skipTo, skip, done := p.fs.parkOnGap(ctx, p.req, p.gapStall, p.evicted, *cursor, notifyChan, reason)
+	skipTo, skip, done, upgrade := p.fs.parkOnGap(ctx, p.req, p.gapStall, p.evicted, *cursor, notifyChan, reason, p.upgradeOnRemotePeer)
 	if done {
 		return gapDone
 	}
+	if upgrade {
+		return gapUpgrade
+	}
 	if skip {
 		*cursor = log_buffer.NewMessagePosition(skipTo, gapResumeCursorOffset)
 		*latch = nil
@@ -500,12 +626,23 @@ func (p *gapPass) park(ctx context.Context, cursor *log_buffer.MessagePosition,
 	return gapContinue
 }
 
-func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest, stream filer_pb.SeaweedFiler_SubscribeMetadataServer) error {
-	if fs.filer.MetaAggregator == nil || !fs.filer.MetaAggregator.HasRemotePeers() {
-		return fs.SubscribeLocalMetadata(req, stream)
+func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest, stream filer_pb.SeaweedFiler_SubscribeMetadataServer) (err error) {
+	// A filer that has not learned remote peers yet serves the local log and
+	// upgrades when the first one appears. RemotePeerArrivedChan takes the
+	// arrival channel under the same lock as the peer check, so a peer
+	// learned in between returns nil and the stream goes straight to the
+	// aggregated path.
+	if fs.filer.MetaAggregator != nil {
+		if arrival := fs.filer.MetaAggregator.RemotePeerArrivedChan(); arrival != nil {
+			return fs.subscribeLocalMetadata(req, stream, arrival)
+		}
+	} else {
+		return fs.subscribeLocalMetadata(req, stream, nil)
 	}
 
-	ctx := stream.Context()
+	ctx, cancelSubscription := fs.subscriptionContext(stream.Context())
+	defer cancelSubscription()
+	defer func() { err = fs.endOfSubscription(stream.Context(), err) }()
 	peerAddress := findClientAddress(ctx, 0)
 
 	isReplacing, alreadyKnown, clientName := fs.addClient("", req.ClientName, peerAddress, req.PathPrefix, req.ClientId, req.ClientEpoch)
@@ -521,7 +658,18 @@ func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest,
 	lastReadTime := log_buffer.NewMessagePosition(req.SinceNs, gapResumeCursorOffset)
 	glog.V(0).Infof(" %v starts to subscribe %s from %+v", clientName, req.PathPrefix, lastReadTime)
 
-	sender := newPipelinedSender(stream, 1024, req.ClientSupportsBatching)
+	// diskAnchorTsNs is the newest ORIGINAL-timestamp position this stream is
+	// proven complete through. Memory reads advance the cursor in the ring's
+	// bumped (arrival) space while persisted logs keep original timestamps,
+	// so a reader that falls off the ring must resume the disk pass here, not
+	// at its bumped cursor - that would skip original-space entries memory
+	// never delivered. Disk passes advance the anchor directly; contiguous
+	// memory reads advance it to the delivery low-watermark observed before
+	// the read (per-peer streams are ordered, so everything at or below it
+	// had already arrived and been delivered).
+	diskAnchorTsNs := req.SinceNs
+
+	sender := newPipelinedSender(ctx, stream, 1024, req.ClientSupportsBatching)
 	defer sender.Close()
 
 	// Register for instant notification when new data arrives in the aggregated log buffer.
@@ -547,16 +695,88 @@ func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest,
 	// written from this single goroutine, so no synchronization is needed.
 	var lastSeenTsNs int64
 	var lastHeartbeatNs int64
-	baseEachLogEntryFn := eachLogEntryFn(req, sender, eachEventNotificationFn, &unsyncedEvents)
-	eachLogEntryFn := func(logEntry *filer_pb.LogEntry) (bool, error) {
-		lastSeenTsNs = logEntry.TsNs
-		return baseEachLogEntryFn(logEntry)
+	baseEachLogEntryFn := eachLogEntryFn(ctx, req, sender, eachEventNotificationFn, &unsyncedEvents)
+	// heldAtTsNs remembers the entry a read was held at (for the log line);
+	// diskHeldAtTsNs is the same marker for the disk pass alone: a pending
+	// disk hold keeps the pass re-reading until the entry is served.
+	var heldAtTsNs, diskHeldAtTsNs int64
+	// Each read path holds at its own watermark: persisted logs are complete
+	// only up to every peer's flush watermark, the ring only up to every
+	// peer's delivery watermark.
+	holdMemTsNs := func() int64 {
+		return resolveAggReadHoldTsNs(fs.filer.MetaAggregator.PeerLowWatermarkTsNs(), time.Now().UnixNano(), metadataGapSettledHorizon)
+	}
+	// deliveredUpToTsNs tracks the newest position actually handed to the
+	// sender (or intentionally skipped by the gap machinery), so a held read
+	// can rewind to a position that skips nothing.
+	var deliveredUpToTsNs int64
+	guardedEachLogEntryFn := func(holdFn func() int64) log_buffer.EachLogEntryFuncType {
+		return func(logEntry *filer_pb.LogEntry) (bool, error) {
+			if logEntry.TsNs > holdFn() {
+				heldAtTsNs = logEntry.TsNs
+				return false, errHeldByPeerWatermark
+			}
+			lastSeenTsNs = logEntry.TsNs
+			deliveredUpToTsNs = logEntry.TsNs
+			return baseEachLogEntryFn(logEntry)
+		}
+	}
+	// Frozen BEFORE each pass lists the log files: per-source flushes are
+	// ts-ordered, so everything at or below the frozen value is in the
+	// listing; a live value could rise mid-pass and admit entries past files
+	// this pass cannot see.
+	var diskPassFlushLowTsNs int64
+	var diskPassHoldTsNs int64
+	// What the last disk pass proved covered: flushed on every peer AND inside
+	// the pass's listing, so an empty pass proves (cursor, proven] empty.
+	var diskPassProvenTsNs int64
+	diskBaseEachLogEntryFn := guardedEachLogEntryFn(func() int64 { return diskPassHoldTsNs })
+	diskEachLogEntryFn := func(logEntry *filer_pb.LogEntry) (bool, error) {
+		isDone, err := diskBaseEachLogEntryFn(logEntry)
+		if errors.Is(err, errHeldByPeerWatermark) {
+			diskHeldAtTsNs = logEntry.TsNs
+		}
+		return isDone, err
+	}
+	memEachLogEntryFn := guardedEachLogEntryFn(holdMemTsNs)
+	// waitHeld pauses a held read until a peer reports further progress, or
+	// the retry interval elapses (a peer dropped past its grace, or a log file
+	// landing that no watermark covers). Arriving data is deliberately not a
+	// wake-up: on a cluster that keeps writing there is always an entry past
+	// the hold, so waking on it spins the loop without ever releasing the
+	// hold. The channel is the one for this read's own watermark - a delivery
+	// advance cannot release a flush-held read - and was taken before the pass
+	// sampled it, so a rise in between wakes us here instead of being missed.
+	// False: context ended.
+	waitHeld := func(scope string, watermarkChan <-chan struct{}) bool {
+		stats.FilerSubscribeWatermarkHolds.WithLabelValues(scope).Inc()
+		glog.V(3).Infof("held at %v (deliveredUpTo %v, flushLow %v, deliveryLow %v) for %v",
+			time.Unix(0, heldAtTsNs), time.Unix(0, deliveredUpToTsNs),
+			time.Unix(0, fs.filer.MetaAggregator.PeerLowFlushWatermarkTsNs()),
+			time.Unix(0, fs.filer.MetaAggregator.PeerLowWatermarkTsNs()), clientName)
+		select {
+		case <-ctx.Done():
+			return false
+		case <-time.After(heldWakeFloor):
+		}
+		select {
+		case <-watermarkChan:
+		case <-ctx.Done():
+			return false
+		case <-time.After(unflushedGapRetryInterval):
+		}
+		return true
 	}
 
 	var processedTsNs int64
 	var readPersistedLogErr error
 	var readInMemoryLogErr error
 	var isDone bool
+	var lastCheckedFlushTsNs int64 = -1    // Track the last local flush we read the disk under
+	var lastCheckedFlushLowTsNs int64 = -1 // Track the last peer flush low-watermark we read the disk under
+	var lastDiskReadTsNs int64 = -1        // Track the last read position we used for disk read
+	var lastDiskRefsStopTsNs int64 = -1    // Track the last chunk listing bound we read the disk under
+	var lastDiskPassAt time.Time           // Paces re-probes for files no watermark signals
 	sentRefs := make(map[string]sentRefState)
 
 	aggBuffer := fs.filer.MetaAggregator.MetaLogBuffer
@@ -566,8 +786,8 @@ func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest,
 		gapStall: gapStall,
 		earliest: aggBuffer.GetEarliestTime,
 		evicted:  aggBuffer.GetLastEvictedOriginalTsNs,
-		flushed:  func() int64 { return 0 }, // the aggregated ring never flushes
-		gapChan:  nil,                       // nothing local signals a peer's flush; the timer paces it
+		flushed:  func() int64 { return diskPassProvenTsNs },
+		gapChan:  nil, // nothing local signals a peer's flush; the timer paces it
 		dataChan: aggNotifyChan,
 		gapReason: func(earliest time.Time, evictedTsNs int64) string {
 			return fmt.Sprintf("gap evicted through %v is not on a peer's disk yet (earliest memory %v)",
@@ -579,56 +799,151 @@ func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest,
 
 		glog.V(4).Infof("read on disk %v aggregated subscribe %s from %+v", clientName, req.PathPrefix, lastReadTime)
 
+		// Taken before either read samples its watermark, so a rise mid-pass
+		// cannot land between the sample and the park below.
+		flushChan := fs.filer.MetaAggregator.FlushWatermarkAdvancedChan()
+		deliveryChan := fs.filer.MetaAggregator.DeliveryWatermarkAdvancedChan()
 		cursorBeforeDiskTsNs := lastReadTime.Time.UnixNano()
 
+		// Observe the flush low-watermark before the pass lists files (see
+		// diskPassHoldTsNs above).
+		diskPassFlushLowTsNs = fs.filer.MetaAggregator.PeerLowFlushWatermarkTsNs()
+		diskPassHoldTsNs = resolveAggReadHoldTsNs(diskPassFlushLowTsNs, time.Now().UnixNano(), metadataGapSettledHorizon)
+
+		// Re-read the disk only when something changed it cannot miss: a local
+		// flush landed, the peers' flush low-watermark moved in either
+		// direction (a joining peer invalidates what an earlier pass proved),
+		// the cursor moved, or a disk hold is pending (the ring read after an
+		// empty pass parks internally, so skipping would strand the held
+		// entry). A peer past the low-watermark can still land a file without
+		// moving it, so the listing is also re-probed at a slow cadence;
+		// chunk listings re-arm as soon as their read bound admits more files.
+		currentFlushTsNs := fs.filer.LocalMetaLogBuffer.GetLastFlushTsNs()
+		currentReadTsNs := lastReadTime.Time.UnixNano()
+		var currentRefsStopTsNs int64
 		if req.ClientSupportsMetadataChunks {
-			processedTsNs, isDone, readPersistedLogErr = fs.chunkDiskPass(ctx, sender, lastReadTime, req.UntilNs, sentRefs)
-		} else {
-			processedTsNs, isDone, readPersistedLogErr = fs.filer.ReadPersistedLogBuffer(ctx, lastReadTime, req.UntilNs, eachLogEntryFn)
-		}
-		if readPersistedLogErr != nil {
-			return fmt.Errorf("reading from persisted logs: %w", readPersistedLogErr)
-		}
-		if isDone {
-			return nil
+			currentRefsStopTsNs = chunkRefsStopTsNs(diskPassHoldTsNs, req.UntilNs)
 		}
+		shouldReadFromDisk := lastCheckedFlushTsNs == -1 ||
+			currentFlushTsNs > lastCheckedFlushTsNs ||
+			diskPassFlushLowTsNs != lastCheckedFlushLowTsNs ||
+			currentReadTsNs != lastDiskReadTsNs ||
+			currentRefsStopTsNs > lastDiskRefsStopTsNs ||
+			diskHeldAtTsNs != 0 ||
+			time.Since(lastDiskPassAt) >= aggDiskReprobeInterval
 
-		glog.V(4).Infof("processed to %v: %v", clientName, processedTsNs)
-		diskAdvanced := diskReadAdvanced(processedTsNs, lastReadTime)
-		// Read after the disk read (an eviction landing mid-read must count) and
-		// in received-ts space: the ring's bumped stopTimes exceed anything on
-		// any peer's disk, and gating disk cursors on them parks subscribers
-		// that drained every peer's log.
-		lastEvictedTsNs := fs.filer.MetaAggregator.MetaLogBuffer.GetLastEvictedOriginalTsNs()
-		if diskAdvanced {
-			gapStall.resumed()
-			reportUnprovenAggregatedCrossing(cursorBeforeDiskTsNs, processedTsNs, lastEvictedTsNs, clientName, req.PathPrefix)
-			lastReadTime = log_buffer.NewMessagePosition(processedTsNs, gapResumeCursorOffset)
-		} else if readInMemoryLogErr == nil {
-			// Nothing on disk and memory never spoke: scan forward for the next
-			// day that has logs.
-			nextDayTs := util.GetNextDayTsNano(lastReadTime.Time.UnixNano())
-			position := log_buffer.NewMessagePosition(nextDayTs, gapResumeCursorOffset)
-			found, err := fs.filer.HasPersistedLogFiles(position)
-			if err != nil {
-				return fmt.Errorf("checking persisted log files: %w", err)
+		diskAdvanced := false
+		if shouldReadFromDisk {
+			lastCheckedFlushTsNs = currentFlushTsNs
+			lastCheckedFlushLowTsNs = diskPassFlushLowTsNs
+			lastDiskReadTsNs = currentReadTsNs
+			lastDiskRefsStopTsNs = currentRefsStopTsNs
+			lastDiskPassAt = time.Now()
+			diskHeldAtTsNs = 0
+			diskPassProvenTsNs = diskPassFlushLowTsNs
+
+			if req.ClientSupportsMetadataChunks {
+				refsStopTsNs := currentRefsStopTsNs
+				// Nothing above the listing bound is proven by this pass.
+				if refsStopTsNs < diskPassProvenTsNs {
+					diskPassProvenTsNs = refsStopTsNs
+				}
+				if refsStopTsNs > lastReadTime.Time.UnixNano() {
+					processedTsNs, isDone, readPersistedLogErr = fs.chunkDiskPass(ctx, sender, lastReadTime, refsStopTsNs, sentRefs, nil)
+				} else {
+					processedTsNs, isDone, readPersistedLogErr = 0, false, nil
+				}
+			} else {
+				processedTsNs, isDone, readPersistedLogErr = fs.filer.ReadPersistedLogBuffer(ctx, lastReadTime, req.UntilNs, diskEachLogEntryFn)
 			}
-			if found {
+			if errors.Is(readPersistedLogErr, errHeldByPeerWatermark) {
+				// Stay at the last delivered entry; the held entry is re-read (and
+				// re-checked) by the next pass.
+				if processedTsNs > 0 {
+					lastReadTime = log_buffer.NewMessagePosition(processedTsNs, gapResumeCursorOffset)
+					if processedTsNs > diskAnchorTsNs {
+						diskAnchorTsNs = processedTsNs
+					}
+				}
+				// A hold is not a gap: clear any stale ResumeFromDiskError so the
+				// next pass's disk-miss handling cannot skip past the held entry.
+				readInMemoryLogErr = nil
+				if !waitHeld("disk", flushChan) {
+					return nil
+				}
+				continue
+			}
+			if readPersistedLogErr != nil {
+				return fmt.Errorf("reading from persisted logs: %w", readPersistedLogErr)
+			}
+			if isDone {
+				return nil
+			}
+
+			glog.V(4).Infof("processed to %v: %v", clientName, processedTsNs)
+			diskAdvanced = diskReadAdvanced(processedTsNs, lastReadTime)
+			// Read after the disk read (an eviction landing mid-read must count) and
+			// in received-ts space: the ring's bumped stopTimes exceed anything on
+			// any peer's disk, and gating disk cursors on them parks subscribers
+			// that drained every peer's log.
+			lastEvictedTsNs := fs.filer.MetaAggregator.MetaLogBuffer.GetLastEvictedOriginalTsNs()
+			if diskAdvanced {
 				gapStall.resumed()
-				reportUnprovenAggregatedCrossing(cursorBeforeDiskTsNs, nextDayTs, lastEvictedTsNs, clientName, req.PathPrefix)
-				lastReadTime = position
+				reportUnprovenAggregatedCrossing(cursorBeforeDiskTsNs, processedTsNs, lastEvictedTsNs, diskPassFlushLowTsNs, clientName, req.PathPrefix)
+				lastReadTime = log_buffer.NewMessagePosition(processedTsNs, gapResumeCursorOffset)
+				if processedTsNs > diskAnchorTsNs {
+					diskAnchorTsNs = processedTsNs
+				}
+			} else if readInMemoryLogErr == nil {
+				// Nothing on disk and memory never spoke: scan forward for the next
+				// day that has logs.
+				nextDayTs := util.GetNextDayTsNano(lastReadTime.Time.UnixNano())
+				// The day jump delivers nothing; stay put until the hold point
+				// covers the skipped range.
+				if nextDayTs <= diskPassHoldTsNs {
+					position := log_buffer.NewMessagePosition(nextDayTs, gapResumeCursorOffset)
+					found, err := fs.filer.HasPersistedLogFiles(position)
+					if err != nil {
+						return fmt.Errorf("checking persisted log files: %w", err)
+					}
+					if found {
+						gapStall.resumed()
+						reportUnprovenAggregatedCrossing(cursorBeforeDiskTsNs, nextDayTs, lastEvictedTsNs, diskPassFlushLowTsNs, clientName, req.PathPrefix)
+						lastReadTime = position
+						if nextDayTs > diskAnchorTsNs {
+							diskAnchorTsNs = nextDayTs
+						}
+					}
+				}
 			}
 		}
 
+		cursorBeforeResolveTsNs := lastReadTime.Time.UnixNano()
 		switch gaps.resolve(ctx, &lastReadTime, &readInMemoryLogErr, diskAdvanced) {
 		case gapDone:
 			return nil
 		case gapContinue:
+			// A cursor move here is a give-up or proven-empty skip (original space);
+			// anchor it so a later eviction rewind cannot undo the decision.
+			if ts := lastReadTime.Time.UnixNano(); ts != cursorBeforeResolveTsNs && ts > diskAnchorTsNs {
+				diskAnchorTsNs = ts
+			}
 			continue
 		}
 
+		// A held rewind must not re-park below the gap machinery's
+		// intentional skips.
+		if lastReadTime.Time.UnixNano() > deliveredUpToTsNs {
+			deliveredUpToTsNs = lastReadTime.Time.UnixNano()
+		}
+
 		glog.V(4).Infof("read in memory %v aggregated subscribe %s from %+v", clientName, req.PathPrefix, lastReadTime)
 
+		// Sampled before the read: a contiguous (unrefused) read delivers
+		// every event whose original timestamp is at or below this.
+		preMemDeliveryLowTsNs := fs.filer.MetaAggregator.PeerLowWatermarkTsNs()
+
+		diskReprobeDue := false
 		lastReadTime, isDone, readInMemoryLogErr = fs.filer.MetaAggregator.MetaLogBuffer.LoopProcessLogData(aggReaderName, lastReadTime, req.UntilNs, func() bool {
 			select {
 			case <-ctx.Done():
@@ -638,13 +953,48 @@ func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest,
 			if !fs.hasClient(req.ClientId, req.ClientEpoch) {
 				return false
 			}
+			// Caught-up readers park in the inner wait loop; the outer disk
+			// gate never runs again unless this read returns, so unwind to
+			// re-probe the persisted logs on the slow cadence.
+			if time.Since(lastDiskPassAt) >= aggDiskReprobeInterval {
+				diskReprobeDue = true
+				return false
+			}
+			// Contiguous and caught up: advance the anchor to the delivery
+			// low-watermark so long live tails keep eviction rewinds short.
+			// Only once the run is connected to the ring - the empty-ring
+			// wait lands here too, with disk files still unshipped below the
+			// cursor.
+			if memoryHoldsGap(lastReadTime.Time.UnixNano(), aggBuffer.GetLastEvictedOriginalTsNs()) {
+				if dl := fs.filer.MetaAggregator.PeerLowWatermarkTsNs(); dl > diskAnchorTsNs {
+					diskAnchorTsNs = dl
+				}
+			}
 			lastHeartbeatNs = fs.maybeSendIdleHeartbeat(req, sender, fs.filer.MetaAggregator.MetaLogBuffer, lastReadTime.Time.UnixNano(), lastSeenTsNs, lastHeartbeatNs)
 			return true
-		}, eachLogEntryFn)
+		}, memEachLogEntryFn)
 		if readInMemoryLogErr != nil {
+			if errors.Is(readInMemoryLogErr, errHeldByPeerWatermark) {
+				// The read was contiguous up to the hold: credit the anchor.
+				if preMemDeliveryLowTsNs > diskAnchorTsNs {
+					diskAnchorTsNs = preMemDeliveryLowTsNs
+				}
+				// The cursor already advanced onto the held entry; rewind to
+				// the last delivered entry so nothing in between is skipped.
+				lastReadTime = log_buffer.NewMessagePosition(deliveredUpToTsNs, gapResumeCursorOffset)
+				readInMemoryLogErr = nil
+				if !waitHeld("memory", deliveryChan) {
+					return nil
+				}
+				continue
+			}
 			if errors.Is(readInMemoryLogErr, log_buffer.ResumeFromDiskError) {
-				// Fell behind the ring: back to the disk pass, and from there to
-				// the gap resolution above if the disk has nothing either.
+				// Fell off the ring: resume the disk pass from the anchor, not
+				// the (possibly bumped) cursor - redelivery is within the
+				// at-least-once contract, skipping is not. For an anchored
+				// cursor this is a no-op, so the gap machinery's re-arm onto
+				// the retained window stays reachable.
+				lastReadTime = log_buffer.NewMessagePosition(diskAnchorTsNs, gapResumeCursorOffset)
 				continue
 			}
 			glog.Errorf("processed to %v: %v", lastReadTime, readInMemoryLogErr)
@@ -653,6 +1003,9 @@ func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest,
 			}
 		}
 		if isDone {
+			if diskReprobeDue {
+				continue
+			}
 			return nil
 		}
 		if !fs.hasClient(req.ClientId, req.ClientEpoch) {
@@ -677,9 +1030,72 @@ func (fs *FilerServer) SubscribeMetadata(req *filer_pb.SubscribeMetadataRequest,
 
 }
 
-func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataRequest, stream filer_pb.SeaweedFiler_SubscribeLocalMetadataServer) error {
+// StopSubscriptions ends every metadata subscription and any started later.
+// Shutdown calls it before gRPC GracefulStop, which waits on open streams;
+// subscribers living in this process - the filer's own MetaAggregator and an
+// in-process S3 gateway - are otherwise torn down only by the later
+// fs.Shutdown, so every stop waited out the graceful-stop timeout. Ended
+// subscribers get codes.Unavailable (see endOfSubscription) and reconnect
+// with their usual retry.
+//
+// A subscriber blocked in stream.Send is released once its handler returns:
+// the sender's Send and Close honor the subscription context, so the handler
+// exits and gRPC tears the stream down.
+func (fs *FilerServer) StopSubscriptions() {
+	if fs.stopSubscriptions != nil {
+		fs.stopSubscriptions()
+	}
+}
 
-	ctx := stream.Context()
+// subscriptionContext ends with the stream or with StopSubscriptions,
+// whichever comes first. It keeps the stream's values (peer address).
+func (fs *FilerServer) subscriptionContext(stream context.Context) (context.Context, context.CancelFunc) {
+	ctx, cancel := context.WithCancel(stream)
+	if fs.subscriptionsStopped == nil {
+		return ctx, cancel
+	}
+	stop := context.AfterFunc(fs.subscriptionsStopped, cancel)
+	return ctx, func() {
+		stop()
+		cancel()
+	}
+}
+
+// endOfSubscription turns the end of a subscription that StopSubscriptions
+// cut short into codes.Unavailable. Followers read a clean end as "caught up,
+// done": the client returns nil on io.EOF, and util.RetryUntil - which the S3
+// gateway and mount follow with - stops on nil. A context.Canceled from the
+// subscription context is the stop signal surfacing, not a real error, and
+// reads as non-retryable to transient-error classifiers. Unavailable is what
+// a dropped connection looks like, so followers reconnect with their usual
+// retry. Handler errors pass through, and so does the end of a stream the
+// client closed.
+func (fs *FilerServer) endOfSubscription(stream context.Context, err error) error {
+	if stream.Err() != nil {
+		return err
+	}
+	if fs.subscriptionsStopped == nil || fs.subscriptionsStopped.Err() == nil {
+		return err
+	}
+	if err == nil || errors.Is(err, context.Canceled) {
+		return status.Error(codes.Unavailable, "filer is shutting down")
+	}
+	return err
+}
+
+func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataRequest, stream filer_pb.SeaweedFiler_SubscribeLocalMetadataServer) error {
+	return fs.subscribeLocalMetadata(req, stream, nil)
+}
+
+// subscribeLocalMetadata serves the filer's own log to the stream. Peer
+// aggregation streams pass upgradeOnRemotePeer == nil; the SubscribeMetadata
+// delegation passes the aggregator's arrival channel so the stream ends
+// when a remote peer appears and the client reconnects to the aggregated path.
+func (fs *FilerServer) subscribeLocalMetadata(req *filer_pb.SubscribeMetadataRequest, stream metadataLocalStream, upgradeOnRemotePeer <-chan struct{}) (err error) {
+
+	ctx, cancelSubscription := fs.subscriptionContext(stream.Context())
+	defer cancelSubscription()
+	defer func() { err = fs.endOfSubscription(stream.Context(), err) }()
 	peerAddress := findClientAddress(ctx, 0)
 
 	// use negative client id to differentiate from addClient()/deleteClient() used in SubscribeMetadata()
@@ -698,7 +1114,7 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 	lastReadTime := log_buffer.NewMessagePosition(req.SinceNs, gapResumeCursorOffset)
 	glog.V(0).Infof(" + %v local subscribe %s from %+v clientId:%d", clientName, req.PathPrefix, lastReadTime, req.ClientId)
 
-	sender := newPipelinedSender(stream, 1024, req.ClientSupportsBatching)
+	sender := newPipelinedSender(ctx, stream, 1024, req.ClientSupportsBatching)
 	defer sender.Close()
 
 	// Bounded gap waits use the buffer's subscriber notification plus a retry
@@ -723,8 +1139,16 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 	// written from this single goroutine, so no synchronization is needed.
 	var lastSeenTsNs int64
 	var lastHeartbeatNs int64
-	baseEachLogEntryFn := eachLogEntryFn(req, sender, eachEventNotificationFn, &unsyncedEvents)
+	var lastFlushReportNs int64
+	baseEachLogEntryFn := eachLogEntryFn(ctx, req, sender, eachEventNotificationFn, &unsyncedEvents)
 	eachLogEntryFn := func(logEntry *filer_pb.LogEntry) (bool, error) {
+		if upgradeOnRemotePeer != nil {
+			select {
+			case <-upgradeOnRemotePeer:
+				return false, errAggregationUpgrade
+			default:
+			}
+		}
 		lastSeenTsNs = logEntry.TsNs
 		return baseEachLogEntryFn(logEntry)
 	}
@@ -737,16 +1161,19 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 	var lastDiskReadTsNs int64 = -1     // Track the last read position we used for disk read
 	sentRefs := make(map[string]sentRefState)
 
+	var upgradedToAggregation bool
+
 	localBuffer := fs.filer.LocalMetaLogBuffer
 	gaps := &gapPass{
-		fs:       fs,
-		req:      req,
-		gapStall: gapStall,
-		earliest: localBuffer.GetEarliestTime,
-		evicted:  localBuffer.GetLastEvictedTsNs, // local disk carries the ring's own timestamps
-		flushed:  func() int64 { return lastCheckedFlushTsNs },
-		gapChan:  localFlushChan,
-		dataChan: localFlushChan,
+		fs:                  fs,
+		req:                 req,
+		gapStall:            gapStall,
+		earliest:            localBuffer.GetEarliestTime,
+		evicted:             localBuffer.GetLastEvictedTsNs, // local disk carries the ring's own timestamps
+		flushed:             func() int64 { return lastCheckedFlushTsNs },
+		gapChan:             localFlushChan,
+		dataChan:            localFlushChan,
+		upgradeOnRemotePeer: upgradeOnRemotePeer,
 		gapReason: func(earliest time.Time, evictedTsNs int64) string {
 			return fmt.Sprintf("gap is not flushed yet (earliest memory %v, flushed through %v)",
 				earliest, time.Unix(0, lastCheckedFlushTsNs))
@@ -754,6 +1181,15 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 	}
 
 	for {
+		if upgradeOnRemotePeer != nil {
+			select {
+			case <-upgradeOnRemotePeer:
+				glog.V(0).Infof("remote peer discovered after local subscribe %s started: ending stream so the client reconnects to the aggregated stream", clientName)
+				return errAggregationUpgrade
+			default:
+			}
+		}
+
 		// Check if new data has been flushed to disk since last check, or if read position advanced
 		currentFlushTsNs := fs.filer.LocalMetaLogBuffer.GetLastFlushTsNs()
 		currentReadTsNs := lastReadTime.Time.UnixNano()
@@ -768,11 +1204,14 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 			lastDiskReadTsNs = currentReadTsNs
 			glog.V(4).Infof("read on disk %v local subscribe %s from %+v (lastFlushed: %v)", clientName, req.PathPrefix, lastReadTime, time.Unix(0, currentFlushTsNs))
 			if req.ClientSupportsMetadataChunks {
-				processedTsNs, isDone, readPersistedLogErr = fs.chunkDiskPass(ctx, sender, lastReadTime, req.UntilNs, sentRefs)
+				processedTsNs, isDone, readPersistedLogErr = fs.chunkDiskPass(ctx, sender, lastReadTime, req.UntilNs, sentRefs, upgradeOnRemotePeer)
 			} else {
 				processedTsNs, isDone, readPersistedLogErr = fs.filer.ReadPersistedLogBuffer(ctx, lastReadTime, req.UntilNs, eachLogEntryFn)
 			}
 			if readPersistedLogErr != nil {
+				if errors.Is(readPersistedLogErr, errAggregationUpgrade) {
+					return errAggregationUpgrade
+				}
 				glog.V(0).Infof("read on disk %v local subscribe %s from %+v: %v", clientName, req.PathPrefix, lastReadTime, readPersistedLogErr)
 				return fmt.Errorf("reading from persisted logs: %w", readPersistedLogErr)
 			}
@@ -806,6 +1245,8 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 		switch gaps.resolve(ctx, &lastReadTime, &readInMemoryLogErr, diskAdvanced) {
 		case gapDone:
 			return nil
+		case gapUpgrade:
+			return errAggregationUpgrade
 		case gapContinue:
 			continue
 		}
@@ -818,13 +1259,29 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 				return false
 			default:
 			}
+			if upgradeOnRemotePeer != nil {
+				select {
+				case <-upgradeOnRemotePeer:
+					upgradedToAggregation = true
+					return false
+				default:
+				}
+			}
 			if !fs.hasClient(req.ClientId, req.ClientEpoch) {
 				return false
 			}
 			lastHeartbeatNs = fs.maybeSendIdleHeartbeat(req, sender, fs.filer.LocalMetaLogBuffer, lastReadTime.Time.UnixNano(), lastSeenTsNs, lastHeartbeatNs)
+			lastFlushReportNs = fs.maybeSendFlushReport(req, sender, lastFlushReportNs)
 			return true
 		}, eachLogEntryFn)
+		if upgradedToAggregation {
+			glog.V(0).Infof("remote peer discovered after local subscribe %s started: ending stream so the client reconnects to the aggregated stream", clientName)
+			return errAggregationUpgrade
+		}
 		if readInMemoryLogErr != nil {
+			if errors.Is(readInMemoryLogErr, errAggregationUpgrade) {
+				return errAggregationUpgrade
+			}
 			if errors.Is(readInMemoryLogErr, log_buffer.ResumeFromDiskError) {
 				// Fell behind the ring: back to the disk pass (it re-runs when
 				// the flush or the cursor moved), and from there to the gap
@@ -848,12 +1305,17 @@ func (fs *FilerServer) SubscribeLocalMetadata(req *filer_pb.SubscribeMetadataReq
 
 }
 
-func eachLogEntryFn(req *filer_pb.SubscribeMetadataRequest, sender metadataStreamSender, eachEventNotificationFn func(dirPath string, eventNotification *filer_pb.EventNotification, tsNs int64) error, filtered *int64) log_buffer.EachLogEntryFuncType {
+func eachLogEntryFn(ctx context.Context, req *filer_pb.SubscribeMetadataRequest, sender metadataStreamSender, eachEventNotificationFn func(dirPath string, eventNotification *filer_pb.EventNotification, tsNs int64) error, filtered *int64) log_buffer.EachLogEntryFuncType {
 	// A shallow scan of the path fields skips unmarshaling chunk-heavy events
 	// this subscriber would filter out anyway; scan surprises fall back to the
 	// full decode. Only a delivery resets the shared unsynced-events counter.
 	prefilter := req.PathPrefix != "" || len(req.PathPrefixes) > 0 || len(req.Directories) > 0
 	return func(logEntry *filer_pb.LogEntry) (bool, error) {
+		// A cancelled context ends the pass here: neither loop checks it
+		// per entry, and the send path alone cannot cover filtered entries.
+		if ctx.Err() != nil {
+			return true, nil
+		}
 		if prefilter {
 			if skeleton, ok := filer_pb.ScanMetadataEventSkeleton(logEntry.Data); ok &&
 				!filer_pb.MetadataEventMatchesSubscription(skeleton, req.PathPrefix, req.PathPrefixes, req.Directories) {
@@ -887,6 +1349,25 @@ func eachLogEntryFn(req *filer_pb.SubscribeMetadataRequest, sender metadataStrea
 	}
 }
 
+// maybeSendFlushReport reports the local flush watermark to a subscriber that
+// opted into idle heartbeats (peer aggregators). Unlike heartbeats it is sent
+// regardless of catch-up state, and its TsNs stays zero so it never advances
+// delivery freshness.
+func (fs *FilerServer) maybeSendFlushReport(req *filer_pb.SubscribeMetadataRequest, sender metadataStreamSender, lastFlushReportNs int64) int64 {
+	if !req.ClientSupportsIdleHeartbeat || fs.filer == nil {
+		return lastFlushReportNs
+	}
+	now := time.Now().UnixNano()
+	if now-lastFlushReportNs < int64(idleHeartbeatInterval) {
+		return lastFlushReportNs
+	}
+	if err := sender.Send(&filer_pb.SubscribeMetadataResponse{FlushedTsNs: fs.filer.LocalFlushedThroughTsNs(now)}); err != nil {
+		glog.V(0).Infof("=> flush report to %s: %v", req.ClientName, err)
+		return lastFlushReportNs
+	}
+	return now
+}
+
 // maybeSendIdleHeartbeat emits an empty response carrying the current time when
 // the subscriber has consumed everything up to the buffer head. The client uses
 // it to advance freshness signals (e.g. filer.sync's sync_offset) without moving
@@ -915,11 +1396,32 @@ func (fs *FilerServer) maybeSendIdleHeartbeat(req *filer_pb.SubscribeMetadataReq
 		// the buffer holds data the subscriber has not reached yet
 		return lastHeartbeatNs
 	}
+	isLocalStream := fs.filer != nil && logBuffer == fs.filer.LocalMetaLogBuffer
+	interval := idleHeartbeatInterval
+	if isLocalStream && fs.filer.MetaAggregator != nil && fs.filer.MetaAggregator.HasRemotePeers() {
+		interval = peerDeliveryClaimInterval
+	}
 	now := time.Now().UnixNano()
-	if now-lastHeartbeatNs < int64(idleHeartbeatInterval) {
+	if now-lastHeartbeatNs < int64(interval) {
 		return lastHeartbeatNs
 	}
-	if err := sender.Send(&filer_pb.SubscribeMetadataResponse{TsNs: now}); err != nil {
+	// On the local stream the heartbeat is a delivery claim to a peer
+	// aggregator and piggybacks the flush watermark; the aggregated ring
+	// never flushes, so its heartbeats carry neither. The claims are capped
+	// by the in-flight floor and fence later stamps above themselves, so
+	// re-checking the buffer head afterwards closes the append race: an
+	// event at or below the claim was in flight (capping it), stamped later
+	// (fenced above it), or already appended here - and then the head check
+	// proves this stream has sent it before the heartbeat.
+	heartbeat := &filer_pb.SubscribeMetadataResponse{TsNs: now}
+	if isLocalStream {
+		heartbeat.TsNs = fs.filer.LocalDeliveredThroughTsNs(now)
+		heartbeat.FlushedTsNs = fs.filer.LocalFlushedThroughTsNs(now)
+		if logBuffer.LastTsNs.Load() > floorTsNs {
+			return lastHeartbeatNs
+		}
+	}
+	if err := sender.Send(heartbeat); err != nil {
 		glog.V(0).Infof("=> idle heartbeat to %s: %v", req.ClientName, err)
 		return lastHeartbeatNs
 	}
@@ -945,7 +1447,7 @@ func (fs *FilerServer) maybeSendIdleHeartbeat(req *filer_pb.SubscribeMetadataReq
 // empty-notification marker: both chunk consumers buffer refs until a non-ref
 // message, so an idle source would otherwise strand the backlog in the
 // client's pending list until the next mutation.
-func (fs *FilerServer) chunkDiskPass(ctx context.Context, sender metadataStreamSender, startPos log_buffer.MessagePosition, untilNs int64, sent map[string]sentRefState) (processedTsNs int64, isDone bool, err error) {
+func (fs *FilerServer) chunkDiskPass(ctx context.Context, sender metadataStreamSender, startPos log_buffer.MessagePosition, untilNs int64, sent map[string]sentRefState, upgradeOnRemotePeer <-chan struct{}) (processedTsNs int64, isDone bool, err error) {
 	collected, _, err := fs.filer.CollectLogFileRefs(ctx, startPos, untilNs)
 	if err != nil {
 		return 0, false, err
@@ -954,9 +1456,16 @@ func (fs *FilerServer) chunkDiskPass(ctx context.Context, sender metadataStreamS
 	if len(refs) == 0 {
 		return startPos.Time.UnixNano(), false, nil
 	}
-	if err := fs.sendRefsBatched(sender, refs); err != nil {
+	if err := fs.sendRefsBatched(ctx, sender, refs, upgradeOnRemotePeer); err != nil {
 		return 0, false, err
 	}
+	if upgradeOnRemotePeer != nil {
+		select {
+		case <-upgradeOnRemotePeer:
+			return 0, false, errAggregationUpgrade
+		default:
+		}
+	}
 
 	// Shipped content end, read from the shipped chunks alone - a fresh
 	// listing here could see a concurrent append and move the cursor past
@@ -1007,9 +1516,19 @@ func (fs *FilerServer) chunkDiskPass(ctx context.Context, sender metadataStreamS
 // sendRefsBatched sends refs through the pipelined sender, which keeps them
 // out of Events batches; gRPC allows one sending goroutine per stream and the
 // sender's goroutine is it.
-func (fs *FilerServer) sendRefsBatched(sender metadataStreamSender, refs []*filer_pb.LogFileChunkRef) error {
+func (fs *FilerServer) sendRefsBatched(ctx context.Context, sender metadataStreamSender, refs []*filer_pb.LogFileChunkRef, upgradeOnRemotePeer <-chan struct{}) error {
 	const maxRefsPerMessage = 64
 	for i := 0; i < len(refs); i += maxRefsPerMessage {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		if upgradeOnRemotePeer != nil {
+			select {
+			case <-upgradeOnRemotePeer:
+				return errAggregationUpgrade
+			default:
+			}
+		}
 		end := i + maxRefsPerMessage
 		if end > len(refs) {
 			end = len(refs)
diff --git a/weed/server/filer_grpc_server_sub_meta_gap_test.go b/weed/server/filer_grpc_server_sub_meta_gap_test.go
index 8d5d1286da..9628719747 100644
--- a/weed/server/filer_grpc_server_sub_meta_gap_test.go
+++ b/weed/server/filer_grpc_server_sub_meta_gap_test.go
@@ -7,6 +7,7 @@ import (
 
 	dto "github.com/prometheus/client_model/go"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
@@ -15,8 +16,8 @@ import (
 // TestResolveGapResume pins the one decision both subscribe paths share: a gap
 // the disk read found empty may be skipped only when it is provably so - the
 // ring never evicted past the cursor, or the flush watermark observed before
-// the read had already passed the earliest in-memory time. The aggregated ring
-// never flushes, so it is the flushedTsNs=0 column of this table.
+// the read had already passed the earliest in-memory time. The flushedTsNs=0
+// column models an aggregated pass whose peers have not proven anything yet.
 func TestResolveGapResume(t *testing.T) {
 	now := time.Date(2026, 6, 29, 12, 0, 0, 0, time.UTC).UnixNano()
 	ago := func(d time.Duration) int64 { return now - int64(d) }
@@ -160,6 +161,81 @@ func TestResolveGapResume(t *testing.T) {
 	}
 }
 
+// TestGapPassProvenEmptyCrossing pins the crossing that needs no memory to
+// land in: an empty disk pass proven through the eviction watermark crosses to
+// it silently - no park, no loss counter. This is the only exit past the
+// aggregated ring's pre-subscription mark, which no rotation ever proves.
+func TestGapPassProvenEmptyCrossing(t *testing.T) {
+	now := time.Date(2026, 6, 29, 12, 0, 0, 0, time.UTC).UnixNano()
+	evicted := now - int64(time.Minute) // the ring's startFrom mark
+	cursorTs := evicted - int64(2*time.Minute)
+
+	crossings := func() float64 {
+		m := &dto.Metric{}
+		if err := stats.FilerSubscribeUnprovenGapCrossings.WithLabelValues("aggregated").Write(m); err != nil {
+			t.Fatal(err)
+		}
+		return m.GetCounter().GetValue()
+	}
+
+	proven := evicted
+	p := &gapPass{
+		gapStall: &gapStallReporter{scope: "aggregated", clientName: "c", pathPrefix: "/"},
+		earliest: func() time.Time { return time.Time{} }, // ring still empty
+		evicted:  func() int64 { return evicted },
+		flushed:  func() int64 { return proven },
+	}
+
+	cursor := log_buffer.NewMessagePosition(cursorTs, gapResumeCursorOffset)
+	latch := error(log_buffer.ResumeFromDiskError) // stale latch must not survive the move
+	start := crossings()
+	if got := p.resolve(context.Background(), &cursor, &latch, false); got != gapContinue {
+		t.Fatalf("outcome = %v, want gapContinue", got)
+	}
+	if got := cursor.Time.UnixNano(); got != evicted {
+		t.Fatalf("cursor = %v, want the proven watermark %v", time.Unix(0, got), time.Unix(0, evicted))
+	}
+	if latch != nil {
+		t.Fatalf("latch not cleared: %v", latch)
+	}
+	if got := crossings(); got != start {
+		t.Fatalf("proven crossing moved the loss counter by %v", got-start)
+	}
+
+	// diskAdvanced defers everything: the disk may hold more of the gap.
+	cursor = log_buffer.NewMessagePosition(cursorTs, gapResumeCursorOffset)
+	if got := p.resolve(context.Background(), &cursor, &latch, true); got != gapContinue {
+		t.Fatalf("diskAdvanced: outcome = %v, want gapContinue", got)
+	}
+	if got := cursor.Time.UnixNano(); got != cursorTs {
+		t.Fatalf("diskAdvanced: cursor moved to %v", time.Unix(0, got))
+	}
+}
+
+// TestChunkRefsStopTsNs pins the chunk listing bound: the newest admitted file
+// name sits a minute plus a flush interval below the hold; UntilNs caps it.
+func TestChunkRefsStopTsNs(t *testing.T) {
+	hold := time.Date(2026, 6, 29, 12, 10, 45, 500, time.UTC).UnixNano()
+
+	stop := chunkRefsStopTsNs(hold, 0)
+	newestFileTsNs := stop - stop%int64(time.Minute)
+	if newestFileTsNs+int64(time.Minute)+int64(filer.LogFlushInterval) > hold {
+		t.Fatalf("file named %v may hold entries past the hold %v",
+			time.Unix(0, newestFileTsNs), time.Unix(0, hold))
+	}
+	want := time.Date(2026, 6, 29, 12, 8, 59, 999999999, time.UTC).UnixNano()
+	if stop != want {
+		t.Fatalf("stop = %v, want %v", time.Unix(0, stop), time.Unix(0, want))
+	}
+
+	if got := chunkRefsStopTsNs(hold, want-5); got != want-5 {
+		t.Fatalf("UntilNs cap: got %v, want %v", time.Unix(0, got), time.Unix(0, want-5))
+	}
+	if got := chunkRefsStopTsNs(hold, want+5); got != want {
+		t.Fatalf("UntilNs above the bound must not widen it: got %v", time.Unix(0, got))
+	}
+}
+
 // TestInclusiveDiskCursorOnWatermarkStillAdvances pins the disk-to-memory
 // handoff. A cursor built from a disk position stays inclusive, because memory
 // above the eviction watermark may hold a different entry sharing that
@@ -209,7 +285,7 @@ func TestParkOnGapExits(t *testing.T) {
 		gapStall := newStall()
 		defer gapStall.resumed()
 		start := time.Now()
-		_, skip, done := fs.parkOnGap(context.Background(), req, gapStall, noEviction, cursor, nil, "test")
+		_, skip, done, _ := fs.parkOnGap(context.Background(), req, gapStall, noEviction, cursor, nil, "test", nil)
 		if skip || done {
 			t.Fatalf("skip=%v done=%v, want a plain retry", skip, done)
 		}
@@ -223,7 +299,7 @@ func TestParkOnGapExits(t *testing.T) {
 		// old one keeps scanning the filer store until its TCP connection dies.
 		gapStall := newStall()
 		superseded := &filer_pb.SubscribeMetadataRequest{ClientId: 7, ClientEpoch: 2}
-		if _, _, done := fs.parkOnGap(context.Background(), superseded, gapStall, noEviction, cursor, nil, "test"); !done {
+		if _, _, done, _ := fs.parkOnGap(context.Background(), superseded, gapStall, noEviction, cursor, nil, "test", nil); !done {
 			t.Fatal("want done")
 		}
 		if !gapStall.since.IsZero() {
@@ -234,7 +310,7 @@ func TestParkOnGapExits(t *testing.T) {
 	t.Run("a bounded subscription past its window ends without parking", func(t *testing.T) {
 		gapStall := newStall()
 		bounded := &filer_pb.SubscribeMetadataRequest{ClientId: 7, ClientEpoch: 3, UntilNs: cursorTs - 1}
-		if _, _, done := fs.parkOnGap(context.Background(), bounded, gapStall, noEviction, cursor, nil, "test"); !done {
+		if _, _, done, _ := fs.parkOnGap(context.Background(), bounded, gapStall, noEviction, cursor, nil, "test", nil); !done {
 			t.Fatal("want done")
 		}
 		if !gapStall.since.IsZero() {
@@ -248,7 +324,7 @@ func TestParkOnGapExits(t *testing.T) {
 		// everything <= UntilNs delivered. Parking would make fs.verify hang.
 		gapStall := newStall()
 		bounded := &filer_pb.SubscribeMetadataRequest{ClientId: 7, ClientEpoch: 3, UntilNs: cursorTs}
-		if _, _, done := fs.parkOnGap(context.Background(), bounded, gapStall, noEviction, cursor, nil, "test"); !done {
+		if _, _, done, _ := fs.parkOnGap(context.Background(), bounded, gapStall, noEviction, cursor, nil, "test", nil); !done {
 			t.Fatal("want done")
 		}
 		if !gapStall.since.IsZero() {
@@ -262,7 +338,7 @@ func TestParkOnGapExits(t *testing.T) {
 		ctx, cancel := context.WithCancel(context.Background())
 		cancel()
 		start := time.Now()
-		if _, _, done := fs.parkOnGap(ctx, req, gapStall, noEviction, cursor, nil, "test"); !done {
+		if _, _, done, _ := fs.parkOnGap(ctx, req, gapStall, noEviction, cursor, nil, "test", nil); !done {
 			t.Fatal("want done")
 		}
 		if elapsed := time.Since(start); elapsed >= unflushedGapRetryInterval {
@@ -278,7 +354,7 @@ func TestParkOnGapExits(t *testing.T) {
 		closed := make(chan struct{})
 		close(closed)
 		start := time.Now()
-		_, skip, done := fs.parkOnGap(context.Background(), req, gapStall, noEviction, cursor, closed, "test")
+		_, skip, done, _ := fs.parkOnGap(context.Background(), req, gapStall, noEviction, cursor, closed, "test", nil)
 		if skip || done {
 			t.Fatalf("skip=%v done=%v, want a plain retry", skip, done)
 		}
@@ -293,7 +369,7 @@ func TestParkOnGapExits(t *testing.T) {
 		notify := make(chan struct{}, 1)
 		notify <- struct{}{}
 		start := time.Now()
-		_, skip, done := fs.parkOnGap(context.Background(), req, gapStall, noEviction, cursor, notify, "test")
+		_, skip, done, _ := fs.parkOnGap(context.Background(), req, gapStall, noEviction, cursor, notify, "test", nil)
 		if skip || done {
 			t.Fatalf("skip=%v done=%v, want a plain retry", skip, done)
 		}
@@ -361,17 +437,21 @@ func TestReportUnprovenAggregatedCrossing(t *testing.T) {
 
 	start := crossings()
 	// Nothing evicted: no range to cross.
-	reportUnprovenAggregatedCrossing(before, after, 0, "c", "/")
+	reportUnprovenAggregatedCrossing(before, after, 0, 0, "c", "/")
 	// Cursor already past the watermark: the evicted range was behind it.
-	reportUnprovenAggregatedCrossing(evicted, after, evicted, "c", "/")
+	reportUnprovenAggregatedCrossing(evicted, after, evicted, 0, "c", "/")
 	// Cursor still short of the watermark: the gap is open, not crossed.
-	reportUnprovenAggregatedCrossing(before, evicted-1, evicted, "c", "/")
+	reportUnprovenAggregatedCrossing(before, evicted-1, evicted, 0, "c", "/")
+	// Crossed, but every peer's flush watermark already passed the eviction
+	// boundary: the crossed range was fully on peer disks — proven, not counted.
+	reportUnprovenAggregatedCrossing(before, after, evicted, evicted, "c", "/")
 	if got := crossings(); got != start {
 		t.Fatalf("counter moved by %v on advances that cross nothing", got-start)
 	}
 
-	// From below the watermark to above it: unproven.
-	reportUnprovenAggregatedCrossing(before, after, evicted, "c", "/")
+	// From below the watermark to above it, flush watermark short of the
+	// boundary: unproven.
+	reportUnprovenAggregatedCrossing(before, after, evicted, evicted-1, "c", "/")
 	if got := crossings(); got != start+1 {
 		t.Fatalf("counter = %v, want %v after one unproven crossing", got, start+1)
 	}
@@ -427,7 +507,7 @@ func TestParkOnGapStallOutcomes(t *testing.T) {
 		gapStall.since = time.Now().Add(-maxGapStall)
 
 		before := crossings()
-		skipTo, skip, done := fs.parkOnGap(context.Background(), req, gapStall, lb.GetLastEvictedTsNs, cursor, nil, "test")
+		skipTo, skip, done, _ := fs.parkOnGap(context.Background(), req, gapStall, lb.GetLastEvictedTsNs, cursor, nil, "test", nil)
 		if done || !skip {
 			t.Fatalf("skip=%v done=%v, want a forced skip", skip, done)
 		}
@@ -450,7 +530,7 @@ func TestParkOnGapStallOutcomes(t *testing.T) {
 		defer gapStall.close() // release the gauge this test's park holds
 
 		before := crossings()
-		_, skip, done := fs.parkOnGap(context.Background(), req, gapStall, lb.GetLastEvictedTsNs, cursor, nil, "test")
+		_, skip, done, _ := fs.parkOnGap(context.Background(), req, gapStall, lb.GetLastEvictedTsNs, cursor, nil, "test", nil)
 		if skip || done {
 			t.Fatalf("skip=%v done=%v, want neither: nothing is being lost", skip, done)
 		}
diff --git a/weed/server/filer_grpc_server_sub_meta_prefilter_test.go b/weed/server/filer_grpc_server_sub_meta_prefilter_test.go
index 10652bf6b2..5630a9179f 100644
--- a/weed/server/filer_grpc_server_sub_meta_prefilter_test.go
+++ b/weed/server/filer_grpc_server_sub_meta_prefilter_test.go
@@ -1,6 +1,7 @@
 package weed_server
 
 import (
+	"context"
 	"testing"
 
 	"google.golang.org/protobuf/proto"
@@ -37,7 +38,7 @@ func TestEachLogEntryFnPrefilterSkipsDecode(t *testing.T) {
 	sender := &recordingSender{}
 	var decoded int
 	var unsyncedEvents int64
-	fn := eachLogEntryFn(req, sender, func(dirPath string, eventNotification *filer_pb.EventNotification, tsNs int64) error {
+	fn := eachLogEntryFn(context.Background(), req, sender, func(dirPath string, eventNotification *filer_pb.EventNotification, tsNs int64) error {
 		decoded++
 		unsyncedEvents = 0 // emulate a delivery, like the notification fn after a send
 		return nil
@@ -83,7 +84,7 @@ func TestEachLogEntryFnNoFilterDecodesEverything(t *testing.T) {
 	req := &filer_pb.SubscribeMetadataRequest{}
 	var decoded int
 	var unsyncedEvents int64
-	fn := eachLogEntryFn(req, &recordingSender{}, func(dirPath string, eventNotification *filer_pb.EventNotification, tsNs int64) error {
+	fn := eachLogEntryFn(context.Background(), req, &recordingSender{}, func(dirPath string, eventNotification *filer_pb.EventNotification, tsNs int64) error {
 		decoded++
 		return nil
 	}, &unsyncedEvents)
diff --git a/weed/server/filer_grpc_server_sub_meta_test.go b/weed/server/filer_grpc_server_sub_meta_test.go
index 072cf3cbf6..a0a8162a25 100644
--- a/weed/server/filer_grpc_server_sub_meta_test.go
+++ b/weed/server/filer_grpc_server_sub_meta_test.go
@@ -1,6 +1,8 @@
 package weed_server
 
 import (
+	"context"
+
 	"fmt"
 	"sync"
 	"sync/atomic"
@@ -131,7 +133,7 @@ func TestPipelinedSenderThroughput(t *testing.T) {
 	var batchedRate float64
 	t.Run("pipelined_batched_send", func(t *testing.T) {
 		stream := &slowStream{sendDelay: sendDelay}
-		sender := newPipelinedSender(stream, 1024, true)
+		sender := newPipelinedSender(context.Background(), stream, 1024, true)
 
 		start := time.Now()
 		for _, file := range files {
@@ -217,7 +219,7 @@ func TestBatchingAdaptive(t *testing.T) {
 
 	t.Run("old_events_are_batched", func(t *testing.T) {
 		stream := &slowStream{sendDelay: 10 * time.Microsecond}
-		sender := newPipelinedSender(stream, 1024, true)
+		sender := newPipelinedSender(context.Background(), stream, 1024, true)
 
 		// Push all events at once (no read delay) so the sender can batch aggressively
 		for _, ev := range makeOldEvents(numEvents) {
@@ -237,7 +239,7 @@ func TestBatchingAdaptive(t *testing.T) {
 
 	t.Run("recent_events_sent_individually", func(t *testing.T) {
 		stream := &slowStream{sendDelay: 10 * time.Microsecond}
-		sender := newPipelinedSender(stream, 1024, true)
+		sender := newPipelinedSender(context.Background(), stream, 1024, true)
 
 		for _, ev := range makeRecentEvents(numEvents) {
 			sender.Send(ev)
@@ -281,7 +283,7 @@ func TestPipelinedSenderErrorPropagation(t *testing.T) {
 	t.Run("send_returns_error", func(t *testing.T) {
 		// Stream fails after 5 successful sends
 		stream := &errorStreamImpl{failAfter: 5, err: sendErr}
-		sender := newPipelinedSender(stream, 4, true)
+		sender := newPipelinedSender(context.Background(), stream, 4, true)
 
 		var lastErr error
 		for i := 0; i < 100; i++ {
@@ -303,7 +305,7 @@ func TestPipelinedSenderErrorPropagation(t *testing.T) {
 		// since Send may have already returned before the sender goroutine
 		// processes the message.
 		stream := &errorStreamImpl{failAfter: 0, err: sendErr}
-		sender := newPipelinedSender(stream, 1024, true)
+		sender := newPipelinedSender(context.Background(), stream, 1024, true)
 
 		ev := makeOldEvents(1)[0]
 		sender.Send(ev)
@@ -352,7 +354,7 @@ func TestPipelinedSingleVsParallelStreams(t *testing.T) {
 	// simulatePipeline: read files with I/O delay, push events, send via pipelinedSender
 	simulatePipeline := func(files []logFile) (eventsSent, sends int64, elapsed time.Duration, err error) {
 		stream := &slowStream{sendDelay: sendDelay}
-		sender := newPipelinedSender(stream, 1024, true)
+		sender := newPipelinedSender(context.Background(), stream, 1024, true)
 
 		start := time.Now()
 	outer:
diff --git a/weed/server/filer_grpc_server_sub_meta_watermark_test.go b/weed/server/filer_grpc_server_sub_meta_watermark_test.go
new file mode 100644
index 0000000000..6b76a3da23
--- /dev/null
+++ b/weed/server/filer_grpc_server_sub_meta_watermark_test.go
@@ -0,0 +1,273 @@
+package weed_server
+
+import (
+	"context"
+
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util/log_buffer"
+)
+
+// sentRecord snapshots what a Send delivered at call time - the sender clears
+// the envelope's Events after a batched Send, so asserting on the retained
+// pointer would miss the nesting.
+type sentRecord struct {
+	hasNotification bool
+	tsNs            int64
+	flushedTsNs     int64
+	nested          int
+	nestedControl   int
+}
+
+// gatedRecordingStream blocks its first Send until the gate opens, letting a
+// test queue several messages into the pipelined sender deterministically.
+type gatedRecordingStream struct {
+	gate     chan struct{}
+	gateOnce sync.Once
+	records  []sentRecord
+}
+
+func (s *gatedRecordingStream) Send(msg *filer_pb.SubscribeMetadataResponse) error {
+	rec := sentRecord{
+		hasNotification: msg.EventNotification != nil,
+		tsNs:            msg.TsNs,
+		flushedTsNs:     msg.FlushedTsNs,
+		nested:          len(msg.Events),
+	}
+	for _, nested := range msg.Events {
+		if nested.EventNotification == nil || nested.FlushedTsNs != 0 {
+			rec.nestedControl++
+		}
+	}
+	s.records = append(s.records, rec)
+	s.gateOnce.Do(func() { <-s.gate })
+	return nil
+}
+
+// TestPipelinedSenderControlMessagesNeverNested pins the batching rule flush
+// reports rely on: a control message (nil EventNotification - a flush report
+// or an idle heartbeat) must never ride in a batch's Events tail, where the
+// peer aggregator's nil-guard would drop its watermark state. A starved flush
+// watermark looks stalled, and the settled-horizon escape would then allow
+// reads past it.
+func TestPipelinedSenderControlMessagesNeverNested(t *testing.T) {
+	stream := &gatedRecordingStream{gate: make(chan struct{})}
+	sender := newPipelinedSender(context.Background(), stream, 16, true)
+
+	oldTs := time.Now().Add(-time.Hour).UnixNano()
+	if err := sender.Send(makeEvent("/d", "e1", oldTs)); err != nil {
+		t.Fatalf("send e1: %v", err)
+	}
+	// While the stream is blocked on e1, queue a batchable backlog event, a
+	// flush report, and another event - the drain loop sees them together.
+	if err := sender.Send(makeEvent("/d", "e2", oldTs+1)); err != nil {
+		t.Fatalf("send e2: %v", err)
+	}
+	if err := sender.Send(&filer_pb.SubscribeMetadataResponse{FlushedTsNs: 123}); err != nil {
+		t.Fatalf("send flush report: %v", err)
+	}
+	if err := sender.Send(makeEvent("/d", "e3", oldTs+2)); err != nil {
+		t.Fatalf("send e3: %v", err)
+	}
+	close(stream.gate)
+	if err := sender.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	events, flushReports := 0, 0
+	for _, rec := range stream.records {
+		if rec.nestedControl > 0 {
+			t.Fatalf("control message nested in a batch: %+v", rec)
+		}
+		if rec.hasNotification {
+			events += 1 + rec.nested
+		}
+		if rec.flushedTsNs != 0 {
+			flushReports++
+			if rec.hasNotification || rec.nested != 0 {
+				t.Fatalf("flush report not sent solo: %+v", rec)
+			}
+			if rec.flushedTsNs != 123 {
+				t.Fatalf("flush report watermark = %d, want 123", rec.flushedTsNs)
+			}
+		}
+	}
+	if events != 3 {
+		t.Fatalf("delivered %d events, want 3", events)
+	}
+	if flushReports != 1 {
+		t.Fatalf("delivered %d flush reports, want 1", flushReports)
+	}
+}
+
+// TestIdleHeartbeatCappedByInflightStamp pins the delivery-claim cap: an idle
+// heartbeat on the LOCAL stream is a delivery-completeness claim the peer
+// aggregator turns into its delivery low-watermark, so it must not claim past
+// an event that is stamped but not yet appended to the local buffer.
+func TestIdleHeartbeatCappedByInflightStamp(t *testing.T) {
+	lb := log_buffer.NewLogBuffer("hb-cap-test", time.Minute, nil, nil, nil)
+	defer lb.ShutdownLogBuffer()
+	f := &filer.Filer{LocalMetaLogBuffer: lb}
+	fs := &FilerServer{filer: f}
+	req := &filer_pb.SubscribeMetadataRequest{ClientSupportsIdleHeartbeat: true}
+
+	// Caught up, nothing in flight: heartbeat carries a current timestamp.
+	s := &collectingStream{}
+	got := fs.maybeSendIdleHeartbeat(req, s, lb, 0, 0, 0)
+	if len(s.messages) != 1 || s.messages[0].TsNs <= 0 {
+		t.Fatalf("baseline heartbeat missing: msgs=%d", len(s.messages))
+	}
+	if got != s.messages[0].TsNs {
+		// pacing returns the wall time it sent at; the claim may be lower
+		// only when something is in flight, which it is not here
+		t.Fatalf("baseline: returned %d, sent claim %d", got, s.messages[0].TsNs)
+	}
+
+	// An in-flight stamp caps the claim just below the stamp.
+	stampTsNs := f.StampMetaLogInflightForTest()
+	s = &collectingStream{}
+	fs.maybeSendIdleHeartbeat(req, s, lb, 0, 0, 0)
+	if len(s.messages) != 1 {
+		t.Fatalf("capped heartbeat missing: msgs=%d", len(s.messages))
+	}
+	if s.messages[0].TsNs != stampTsNs-1 {
+		t.Fatalf("heartbeat claim=%d, want in-flight floor %d", s.messages[0].TsNs, stampTsNs-1)
+	}
+	if s.messages[0].FlushedTsNs != stampTsNs-1 {
+		t.Fatalf("flush claim=%d, want in-flight floor %d", s.messages[0].FlushedTsNs, stampTsNs-1)
+	}
+	f.DoneMetaLogInflightForTest(stampTsNs)
+}
+
+// TestResolveAggReadHoldTsNs pins the aggregated delivery hold point: a
+// subscriber may not read past the peers' delivery low-watermark (a source
+// that is still catching up may merge older events in late), except that a
+// watermark stalled beyond the settled horizon stops holding delivery back.
+func TestResolveAggReadHoldTsNs(t *testing.T) {
+	now := time.Date(2026, 7, 29, 12, 0, 0, 0, time.UTC).UnixNano()
+	horizon := metadataGapSettledHorizon
+	ago := func(d time.Duration) int64 { return now - int64(d) }
+
+	cases := []struct {
+		name        string
+		watermarkNs int64
+		wantHoldNs  int64
+	}{
+		{
+			// Healthy: all peers signalled recently → deliver up to the watermark.
+			name:        "healthy watermark ahead of horizon",
+			watermarkNs: ago(2 * time.Second),
+			wantHoldNs:  ago(2 * time.Second),
+		},
+		{
+			// A peer stalled long ago: liveness escape takes over at the horizon.
+			name:        "stalled watermark falls back to horizon",
+			watermarkNs: ago(30 * time.Minute),
+			wantHoldNs:  ago(horizon),
+		},
+		{
+			// No signal from some peer yet (fresh cluster join): completeness
+			// unknown → horizon bounds the hold.
+			name:        "unknown watermark falls back to horizon",
+			watermarkNs: 0,
+			wantHoldNs:  ago(horizon),
+		},
+		{
+			// Watermark exactly at the horizon: either bound gives the same
+			// answer; pin the equality behavior.
+			name:        "watermark exactly at horizon",
+			watermarkNs: ago(horizon),
+			wantHoldNs:  ago(horizon),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := resolveAggReadHoldTsNs(tc.watermarkNs, now, horizon)
+			if got != tc.wantHoldNs {
+				t.Fatalf("hold=%d want %d", got, tc.wantHoldNs)
+			}
+		})
+	}
+}
+
+func TestPreviousMinuteEndTsNs(t *testing.T) {
+	ts := time.Date(2026, 7, 29, 12, 34, 56, 789, time.UTC)
+	want := time.Date(2026, 7, 29, 12, 33, 59, 999999999, time.UTC).UnixNano()
+	if got := previousMinuteEndTsNs(ts.UnixNano()); got != want {
+		t.Fatalf("got %d want %d", got, want)
+	}
+	// A timestamp exactly on a minute boundary bounds to the end of the
+	// preceding minute.
+	onBoundary := time.Date(2026, 7, 29, 12, 34, 0, 0, time.UTC)
+	wantBoundary := time.Date(2026, 7, 29, 12, 33, 59, 999999999, time.UTC).UnixNano()
+	if got := previousMinuteEndTsNs(onBoundary.UnixNano()); got != wantBoundary {
+		t.Fatalf("boundary: got %d want %d", got, wantBoundary)
+	}
+}
+
+// TestAggWatermarkHoldRewindRedelivers pins the rewind invariant SubscribeMetadata
+// relies on: when a read is held at an entry (errHeldByPeerWatermark), resuming
+// from heldAtTsNs-1 re-delivers exactly the held entry and nothing before it —
+// positions are exclusive, so the -1 keeps the held entry ahead of the cursor.
+func TestAggWatermarkHoldRewindRedelivers(t *testing.T) {
+	lb := log_buffer.NewLogBuffer("agg-hold", 10*time.Minute,
+		func(logBuffer *log_buffer.LogBuffer, startTime, stopTime time.Time, buf []byte, minOffset, maxOffset int64) {
+		},
+		func(startPosition log_buffer.MessagePosition, stopTsNs int64, eachLogEntryFn log_buffer.EachLogEntryFuncType) (log_buffer.MessagePosition, bool, error) {
+			return startPosition, false, nil
+		},
+		func() {})
+	defer lb.ShutdownLogBuffer()
+
+	base := time.Now().Add(-time.Second)
+	ts1 := base.UnixNano()
+	ts2 := base.Add(100 * time.Millisecond).UnixNano()
+	for i, ts := range []int64{ts1, ts2} {
+		if err := lb.AddLogEntryToBuffer(&filer_pb.LogEntry{TsNs: ts, Data: []byte{byte(i)}, Key: []byte("k"), Offset: int64(i)}); err != nil {
+			t.Fatalf("add %d: %v", i, err)
+		}
+	}
+
+	holdTsNs := ts1 // ts2 is beyond the hold point
+	var heldAtTsNs int64
+	var delivered []int64
+	guarded := func(logEntry *filer_pb.LogEntry) (bool, error) {
+		if logEntry.TsNs > holdTsNs {
+			heldAtTsNs = logEntry.TsNs
+			return false, errHeldByPeerWatermark
+		}
+		delivered = append(delivered, logEntry.TsNs)
+		return false, nil
+	}
+
+	start := log_buffer.NewMessagePosition(ts1-1, -2)
+	_, _, err := lb.LoopProcessLogData("hold-test", start, 0, func() bool { return false }, guarded)
+	if !errors.Is(err, errHeldByPeerWatermark) {
+		t.Fatalf("want held error, got %v", err)
+	}
+	if len(delivered) != 1 || delivered[0] != ts1 {
+		t.Fatalf("before hold: delivered %v, want [%d]", delivered, ts1)
+	}
+	if heldAtTsNs != ts2 {
+		t.Fatalf("heldAt=%d want %d", heldAtTsNs, ts2)
+	}
+
+	// Release the hold and resume from just below the held entry: it must be
+	// re-delivered exactly once, without re-delivering ts1.
+	holdTsNs = ts2
+	delivered = nil
+	resume := log_buffer.NewMessagePosition(heldAtTsNs-1, -2)
+	_, _, err = lb.LoopProcessLogData("hold-test-resume", resume, 0, func() bool { return false }, guarded)
+	if err != nil && !errors.Is(err, log_buffer.ResumeFromDiskError) {
+		t.Fatalf("resume: %v", err)
+	}
+	if len(delivered) != 1 || delivered[0] != ts2 {
+		t.Fatalf("after release: delivered %v, want [%d]", delivered, ts2)
+	}
+}
diff --git a/weed/server/filer_grpc_server_test.go b/weed/server/filer_grpc_server_test.go
index 31a83a5410..c289f04836 100644
--- a/weed/server/filer_grpc_server_test.go
+++ b/weed/server/filer_grpc_server_test.go
@@ -2,12 +2,27 @@ package weed_server
 
 import (
 	"context"
+	"errors"
+	"strings"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 )
 
+func newAssignTestServer(fc *filer.FilerConf, diskType string) *FilerServer {
+	return &FilerServer{
+		option: &FilerOption{
+			DiskType: diskType,
+		},
+		filer: &filer.Filer{
+			DirBucketsPath:    "/buckets",
+			FilerConf:         fc,
+			MaxFilenameLength: 255,
+		},
+	}
+}
+
 func TestResolveAssignStorageOptionUsesBucketRuleBeforeFilerDiskDefault(t *testing.T) {
 	fc := filer.NewFilerConf()
 	if err := fc.SetLocationConf(&filer_pb.FilerConf_PathConf{
@@ -17,16 +32,7 @@ func TestResolveAssignStorageOptionUsesBucketRuleBeforeFilerDiskDefault(t *testi
 		t.Fatalf("set location conf: %v", err)
 	}
 
-	fs := &FilerServer{
-		option: &FilerOption{
-			DiskType: "hdd",
-		},
-		filer: &filer.Filer{
-			DirBucketsPath:    "/buckets",
-			FilerConf:         fc,
-			MaxFilenameLength: 255,
-		},
-	}
+	fs := newAssignTestServer(fc, "hdd")
 
 	so, err := fs.resolveAssignStorageOption(context.Background(), &filer_pb.AssignVolumeRequest{
 		Path: "/buckets/zot/.uploads/upload-id/0001_part.part",
@@ -44,16 +50,7 @@ func TestResolveAssignStorageOptionUsesBucketRuleBeforeFilerDiskDefault(t *testi
 }
 
 func TestResolveAssignStorageOptionFallsBackToFilerDiskDefault(t *testing.T) {
-	fs := &FilerServer{
-		option: &FilerOption{
-			DiskType: "hdd",
-		},
-		filer: &filer.Filer{
-			DirBucketsPath:    "/buckets",
-			FilerConf:         filer.NewFilerConf(),
-			MaxFilenameLength: 255,
-		},
-	}
+	fs := newAssignTestServer(filer.NewFilerConf(), "hdd")
 
 	so, err := fs.resolveAssignStorageOption(context.Background(), &filer_pb.AssignVolumeRequest{
 		Path: "/tmp/unmatched/file.bin",
@@ -66,3 +63,34 @@ func TestResolveAssignStorageOptionFallsBackToFilerDiskDefault(t *testing.T) {
 		t.Fatalf("disk type = %q, want %q", got, want)
 	}
 }
+
+// A read-only path is a verdict, not a transport failure: it must come back as a
+// successful RPC (so clients neither retry nor fail over) carrying READ_ONLY.
+func TestAssignVolumeReadOnlyReturnsErrorCode(t *testing.T) {
+	fc := filer.NewFilerConf()
+	if err := fc.SetLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/overquota",
+		ReadOnly:       true,
+	}); err != nil {
+		t.Fatalf("set location conf: %v", err)
+	}
+
+	fs := newAssignTestServer(fc, "")
+
+	resp, err := fs.AssignVolume(context.Background(), &filer_pb.AssignVolumeRequest{
+		Path: "/buckets/overquota/x",
+	})
+	if err != nil {
+		t.Fatalf("AssignVolume err = %v, want a response", err)
+	}
+	if resp.ErrorCode != filer_pb.FilerError_READ_ONLY {
+		t.Fatalf("AssignVolume error_code = %v, want %v", resp.ErrorCode, filer_pb.FilerError_READ_ONLY)
+	}
+	// Clients that predate error_code still get the old message.
+	if want := "assign volume: read only: /buckets/overquota"; !strings.HasPrefix(resp.Error, want) {
+		t.Fatalf("AssignVolume error = %q, want prefix %q", resp.Error, want)
+	}
+	if err := filer_pb.AssignVolumeResponseError(resp); !errors.Is(err, ErrReadOnly) {
+		t.Fatalf("AssignVolumeResponseError = %v, want ErrReadOnly", err)
+	}
+}
diff --git a/weed/server/filer_grpc_server_traverse_meta.go b/weed/server/filer_grpc_server_traverse_meta.go
index 2ebf33d05d..7ad1014f81 100644
--- a/weed/server/filer_grpc_server_traverse_meta.go
+++ b/weed/server/filer_grpc_server_traverse_meta.go
@@ -2,6 +2,7 @@ package weed_server
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
@@ -9,8 +10,16 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/viant/ptrie"
+	"google.golang.org/grpc/metadata"
 )
 
+// TraverseBfsMetadata streams every entry at and below req.Directory: by
+// default a breadth-first walk, parents first, each response stamped with the
+// path's commit timestamp. With request metadata TraverseModeHeaderKey=snapshot
+// the entries come from one store snapshot instead (filer.EntryScanner), in any
+// order, and the response header of the same name says which happened. Snapshot
+// responses leave entry_ts_ns at 0: that lookup is one store round trip per
+// entry, and the consumers that order by it use the walk.
 func (fs *FilerServer) TraverseBfsMetadata(req *filer_pb.TraverseBfsMetadataRequest, stream filer_pb.SeaweedFiler_TraverseBfsMetadataServer) error {
 
 	glog.V(0).Infof("TraverseBfsMetadata %v", req)
@@ -40,16 +49,27 @@ func (fs *FilerServer) TraverseBfsMetadata(req *filer_pb.TraverseBfsMetadataRequ
 	// descend into. Queuing the entries themselves would hold the whole
 	// subtree in memory, including every file's chunk list, and can exhaust
 	// the filer on large trees (e.g. during a peer's first-time bootstrap).
-	sendEntry := func(entry *filer.Entry) error {
+	send := func(entry *filer.Entry, entryTsNs int64) error {
 		parent, _ := entry.FullPath.DirAndName()
 		if err := stream.Send(&filer_pb.TraverseBfsMetadataResponse{
 			Directory: parent,
 			Entry:     entry.ToProtoEntry(),
+			EntryTsNs: entryTsNs,
 		}); err != nil {
 			return fmt.Errorf("send traverse bfs metadata response: %w", err)
 		}
 		return nil
 	}
+	sendEntry := func(entry *filer.Entry) error {
+		entryTsNs, err := fs.filer.CommitTsNs(ctx, entry.FullPath, entry.Mtime.UnixNano())
+		if err != nil {
+			return fmt.Errorf("commit timestamp of %s: %w", entry.FullPath, err)
+		}
+		return send(entry, entryTsNs)
+	}
+	sendEntryUnstamped := func(entry *filer.Entry) error {
+		return send(entry, 0)
+	}
 
 	dirEntry, err := fs.filer.FindEntry(ctx, util.FullPath(req.Directory))
 	if err != nil {
@@ -58,6 +78,22 @@ func (fs *FilerServer) TraverseBfsMetadata(req *filer_pb.TraverseBfsMetadataRequ
 	if isExcluded(dirEntry.FullPath) {
 		return nil
 	}
+
+	if traverseSnapshotRequested(ctx) {
+		if scanner, ok := fs.filer.Store.(filer.EntryScanner); ok && dirEntry.IsDirectory() {
+			served, scanErr := traverseFromSnapshot(ctx, scanner, dirEntry, isExcluded, stream.SendHeader, sendEntryUnstamped)
+			if scanErr != nil {
+				return scanErr
+			}
+			if served {
+				return nil
+			}
+		}
+		if err := stream.SendHeader(metadata.Pairs(filer_pb.TraverseModeHeaderKey, filer_pb.TraverseModeBfs)); err != nil {
+			return fmt.Errorf("send traverse mode header: %w", err)
+		}
+	}
+
 	if err := sendEntry(dirEntry); err != nil {
 		return err
 	}
@@ -88,6 +124,62 @@ func (fs *FilerServer) TraverseBfsMetadata(req *filer_pb.TraverseBfsMetadataRequ
 	return nil
 }
 
+// traverseSnapshotRequested reports whether the client asked for the entries
+// from one store snapshot rather than a breadth-first walk.
+func traverseSnapshotRequested(ctx context.Context) bool {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return false
+	}
+	modes := md.Get(filer_pb.TraverseModeHeaderKey)
+	return len(modes) > 0 && modes[0] == filer_pb.TraverseModeSnapshot
+}
+
+// traverseFromSnapshot serves the traversal from the store's snapshot scan,
+// root included: the scan yields the root's own row, so it is as current as
+// its descendants (only "/" has no row and is sent as the synthetic root).
+// It returns served=false, nothing sent, when the store declines before
+// yielding anything; once the first entry is out, any failure is an error.
+func traverseFromSnapshot(ctx context.Context, scanner filer.EntryScanner, dirEntry *filer.Entry, isExcluded func(util.FullPath) bool, sendHeader func(metadata.MD) error, sendEntry func(*filer.Entry) error) (served bool, err error) {
+	started := false
+	start := func() error {
+		if started {
+			return nil
+		}
+		started = true
+		if err := sendHeader(metadata.Pairs(filer_pb.TraverseModeHeaderKey, filer_pb.TraverseModeSnapshot)); err != nil {
+			return fmt.Errorf("send traverse mode header: %w", err)
+		}
+		if dirEntry.FullPath == "/" {
+			return sendEntry(dirEntry)
+		}
+		return nil
+	}
+
+	scanErr := scanner.ScanEntries(ctx, dirEntry.FullPath, func(_ context.Context, entry *filer.Entry) error {
+		if isExcluded(entry.FullPath) {
+			return nil
+		}
+		if err := start(); err != nil {
+			return err
+		}
+		return sendEntry(entry)
+	})
+	if scanErr != nil {
+		if !started && errors.Is(scanErr, filer.ErrUnsupportedEntryScan) {
+			glog.V(1).Infof("TraverseBfsMetadata %s: %v, walking instead", dirEntry.FullPath, scanErr)
+			return false, nil
+		}
+		glog.V(0).Infof("TraverseBfsMetadata %s: snapshot scan failed: %v", dirEntry.FullPath, scanErr)
+		return started, fmt.Errorf("snapshot scan of %s: %w", dirEntry.FullPath, scanErr)
+	}
+	// Nothing yielded (root gone since the lookup): still commit to the mode.
+	if err := start(); err != nil {
+		return true, err
+	}
+	return true, nil
+}
+
 func (fs *FilerServer) iterateDirectory(ctx context.Context, dirPath util.FullPath, fn func(entry *filer.Entry) error) (err error) {
 	var lastFileName string
 	var listErr error
diff --git a/weed/server/filer_grpc_server_traverse_meta_test.go b/weed/server/filer_grpc_server_traverse_meta_test.go
index cb20951111..f6205bb235 100644
--- a/weed/server/filer_grpc_server_traverse_meta_test.go
+++ b/weed/server/filer_grpc_server_traverse_meta_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/stretchr/testify/assert"
@@ -37,8 +38,9 @@ func TestPtrie(t *testing.T) {
 
 type captureTraverseStream struct {
 	grpc.ServerStream
-	ctx     context.Context
-	visited []string
+	ctx       context.Context
+	visited   []string
+	entryTsNs map[string]int64
 }
 
 func (s *captureTraverseStream) Context() context.Context { return s.ctx }
@@ -48,7 +50,12 @@ func (s *captureTraverseStream) Send(resp *filer_pb.TraverseBfsMetadataResponse)
 	if dir != "/" {
 		dir += "/"
 	}
-	s.visited = append(s.visited, dir+resp.Entry.Name)
+	path := dir + resp.Entry.Name
+	s.visited = append(s.visited, path)
+	if s.entryTsNs == nil {
+		s.entryTsNs = make(map[string]int64)
+	}
+	s.entryTsNs[path] = resp.EntryTsNs
 	return nil
 }
 
@@ -89,6 +96,16 @@ func TestTraverseBfsMetadata(t *testing.T) {
 		}
 		seen[path] = true
 	}
+
+	// Every response carries a commit timestamp for ordering; with no
+	// recorded commit it falls back to the entry's mtime.
+	for path, tsNs := range stream.entryTsNs {
+		if path == "/" {
+			assert.Equal(t, filer.Root.Attr.Mtime.UnixNano(), tsNs)
+			continue
+		}
+		assert.Equalf(t, store.entries[path].Attr.Mtime.UnixNano(), tsNs, "entry_ts_ns for %s", path)
+	}
 }
 
 var _ filer_pb.SeaweedFiler_TraverseBfsMetadataServer = (*captureTraverseStream)(nil)
diff --git a/weed/server/filer_grpc_server_traverse_snapshot_test.go b/weed/server/filer_grpc_server_traverse_snapshot_test.go
new file mode 100644
index 0000000000..14eb6fdfcc
--- /dev/null
+++ b/weed/server/filer_grpc_server_traverse_snapshot_test.go
@@ -0,0 +1,170 @@
+package weed_server
+
+import (
+	"context"
+	"sort"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/grpc/metadata"
+)
+
+// ScanEntries makes the rename test store an EntryScanner: every entry at and
+// below dirPath, straight from the map, like a store reading one snapshot.
+func (s *renameTestStore) ScanEntries(ctx context.Context, dirPath util.FullPath, fn func(ctx context.Context, entry *filer.Entry) error) error {
+	s.mu.Lock()
+	var paths []string
+	for p := range s.entries {
+		if p == "/" {
+			continue
+		}
+		if dirPath == "/" || p == string(dirPath) || len(p) > len(dirPath) && p[:len(dirPath)+1] == string(dirPath)+"/" {
+			paths = append(paths, p)
+		}
+	}
+	s.mu.Unlock()
+	// Deliberately not top-down: children before their parents.
+	sort.Sort(sort.Reverse(sort.StringSlice(paths)))
+	for _, p := range paths {
+		s.mu.Lock()
+		e := s.entries[p]
+		s.mu.Unlock()
+		if err := fn(ctx, e); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+var _ filer.EntryScanner = (*renameTestStore)(nil)
+
+// headerTraverseStream records the response header along with the entries.
+type headerTraverseStream struct {
+	captureTraverseStream
+	headers []metadata.MD
+}
+
+func (s *headerTraverseStream) SendHeader(md metadata.MD) error {
+	s.headers = append(s.headers, md)
+	return nil
+}
+
+func snapshotRequestCtx() context.Context {
+	return metadata.NewIncomingContext(context.Background(), metadata.Pairs(filer_pb.TraverseModeHeaderKey, filer_pb.TraverseModeSnapshot))
+}
+
+func newTraverseTestStore() *renameTestStore {
+	store := newRenameTestStore()
+	for _, dir := range []string{"/", "/a", "/a/sub", "/b", "/.system"} {
+		store.entries[dir] = newDirectoryEntry(dir, 1)
+	}
+	for _, file := range []string{"/a/f1", "/a/sub/f2", "/b/f3", "/.system/secret"} {
+		store.entries[file] = newFileEntry(file, 2)
+	}
+	return store
+}
+
+func TestTraverseBfsMetadataSnapshotMode(t *testing.T) {
+	store := newTraverseTestStore()
+	server := &FilerServer{filer: newRenameTestFiler(t, store)}
+	stream := &headerTraverseStream{captureTraverseStream: captureTraverseStream{ctx: snapshotRequestCtx()}}
+
+	err := server.TraverseBfsMetadata(&filer_pb.TraverseBfsMetadataRequest{
+		Directory:        "/",
+		ExcludedPrefixes: []string{"/.system"},
+	}, stream)
+	assert.NoError(t, err)
+
+	if assert.Len(t, stream.headers, 1) {
+		assert.Equal(t, []string{filer_pb.TraverseModeSnapshot}, stream.headers[0].Get(filer_pb.TraverseModeHeaderKey))
+	}
+	// The root comes first so a consumer knows what it asked for; everything
+	// else is complete but in the store's order, with the exclusion honored.
+	assert.Equal(t, "/", stream.visited[0])
+	assert.ElementsMatch(t, []string{"/", "/a", "/a/f1", "/a/sub", "/a/sub/f2", "/b", "/b/f3"}, stream.visited)
+
+	// No per-entry commit timestamp lookup in snapshot mode: entry_ts_ns is
+	// left "unrecorded" (0), which consumers already treat as "use the mtime".
+	for path, tsNs := range stream.entryTsNs {
+		assert.Zerof(t, tsNs, "entry_ts_ns for %s", path)
+	}
+}
+
+// Without the request metadata the walk is unchanged: no header, parents first.
+func TestTraverseBfsMetadataDefaultStillWalks(t *testing.T) {
+	store := newTraverseTestStore()
+	server := &FilerServer{filer: newRenameTestFiler(t, store)}
+	stream := &headerTraverseStream{captureTraverseStream: captureTraverseStream{ctx: context.Background()}}
+
+	err := server.TraverseBfsMetadata(&filer_pb.TraverseBfsMetadataRequest{Directory: "/"}, stream)
+	assert.NoError(t, err)
+	assert.Empty(t, stream.headers)
+	seen := make(map[string]bool)
+	for _, path := range stream.visited {
+		if path != "/" {
+			parent, _ := util.FullPath(path).DirAndName()
+			assert.Truef(t, seen[parent], "parent %s of %s not streamed first", parent, path)
+		}
+		seen[path] = true
+	}
+}
+
+// A store that cannot scan (here: path-specific stores are configured, so one
+// snapshot per store is not one snapshot) makes the filer walk and say so.
+func TestTraverseBfsMetadataSnapshotRequestedButUnsupported(t *testing.T) {
+	store := newTraverseTestStore()
+	f := newRenameTestFiler(t, store)
+	f.Store.AddPathSpecificStore("/elsewhere", "elsewhere", newRenameTestStore())
+	server := &FilerServer{filer: f}
+	stream := &headerTraverseStream{captureTraverseStream: captureTraverseStream{ctx: snapshotRequestCtx()}}
+
+	err := server.TraverseBfsMetadata(&filer_pb.TraverseBfsMetadataRequest{Directory: "/a"}, stream)
+	assert.NoError(t, err)
+	if assert.Len(t, stream.headers, 1) {
+		assert.Equal(t, []string{filer_pb.TraverseModeBfs}, stream.headers[0].Get(filer_pb.TraverseModeHeaderKey))
+	}
+	assert.Equal(t, []string{"/a", "/a/f1", "/a/sub", "/a/sub/f2"}, stream.visited)
+}
+
+type fakeScanner struct {
+	entries []*filer.Entry
+	err     error // returned after the entries
+}
+
+func (s *fakeScanner) ScanEntries(ctx context.Context, dirPath util.FullPath, fn func(ctx context.Context, entry *filer.Entry) error) error {
+	for _, e := range s.entries {
+		if err := fn(ctx, e); err != nil {
+			return err
+		}
+	}
+	return s.err
+}
+
+type traverseRecorder struct {
+	headers []metadata.MD
+	sent    []string
+}
+
+func (r *traverseRecorder) sendHeader(md metadata.MD) error {
+	r.headers = append(r.headers, md)
+	return nil
+}
+func (r *traverseRecorder) sendEntry(e *filer.Entry) error {
+	r.sent = append(r.sent, string(e.FullPath))
+	return nil
+}
+
+func noExclusion(util.FullPath) bool { return false }
+
+// A store that only decides it cannot scan after yielding rows must not make
+// the stream fall back to a walk: entries are already out under the snapshot header.
+func TestTraverseFromSnapshotLateUnsupportedIsAnError(t *testing.T) {
+	rec := &traverseRecorder{}
+	scanner := &fakeScanner{entries: []*filer.Entry{newFileEntry("/ckpt/x", 2)}, err: filer.ErrUnsupportedEntryScan}
+	served, err := traverseFromSnapshot(context.Background(), scanner, newDirectoryEntry("/ckpt", 1), noExclusion, rec.sendHeader, rec.sendEntry)
+	assert.Error(t, err)
+	assert.True(t, served)
+}
diff --git a/weed/server/filer_jwt_test.go b/weed/server/filer_jwt_test.go
index 69a96cb500..74f5bb9bcc 100644
--- a/weed/server/filer_jwt_test.go
+++ b/weed/server/filer_jwt_test.go
@@ -114,19 +114,27 @@ func TestFilerServer_maybeCheckJwtAuthorization_Scoped(t *testing.T) {
 			expectAuthorized: true,
 		},
 		{
-			name:             "root path with prefix restriction",
+			name:             "root listing denied to a prefix restricted token",
 			token:            genToken([]string{"/data"}, nil),
 			method:           "GET",
 			path:             "/",
 			isWrite:          false,
-			expectAuthorized: true,
+			expectAuthorized: false,
 		},
 		{
-			name:             "root path without token",
+			name:             "root listing denied without token",
 			token:            "",
 			method:           "GET",
 			path:             "/",
 			isWrite:          false,
+			expectAuthorized: false,
+		},
+		{
+			name:             "root listing allowed with an unrestricted token",
+			token:            genToken(nil, nil),
+			method:           "GET",
+			path:             "/",
+			isWrite:          false,
 			expectAuthorized: true,
 		},
 		{
diff --git a/weed/server/filer_pipelined_sender_test.go b/weed/server/filer_pipelined_sender_test.go
index b504555010..aeada1b67c 100644
--- a/weed/server/filer_pipelined_sender_test.go
+++ b/weed/server/filer_pipelined_sender_test.go
@@ -1,6 +1,9 @@
 package weed_server
 
 import (
+	"context"
+	"sync/atomic"
+
 	"fmt"
 	"sync"
 	"testing"
@@ -46,7 +49,7 @@ func (s *recordingStream) snapshot() []*filer_pb.SubscribeMetadataResponse {
 // event. Everything must arrive, in order, whatever the batcher does.
 func TestPipelinedSenderRefsNeverBatched(t *testing.T) {
 	stream := &recordingStream{slow: 2 * time.Millisecond} // let the queue back up so batching engages
-	sender := newPipelinedSender(stream, 64, true)
+	sender := newPipelinedSender(context.Background(), stream, 64, true)
 
 	oldTs := time.Now().Add(-time.Hour).UnixNano() // far behind: the batch heuristic fires
 	var wantOrder []string
@@ -102,3 +105,89 @@ func TestPipelinedSenderRefsNeverBatched(t *testing.T) {
 		t.Fatalf("delivery order/count changed:\n got %v\nwant %v", gotOrder, wantOrder)
 	}
 }
+
+type blockedStream struct {
+	release chan struct{}
+	entered chan struct{}
+	sends   atomic.Int32
+}
+
+func (s *blockedStream) Send(*filer_pb.SubscribeMetadataResponse) error {
+	s.sends.Add(1)
+	select {
+	case s.entered <- struct{}{}:
+	default:
+	}
+	<-s.release
+	return nil
+}
+
+// A subscriber that stops reading wedges stream.Send. The subscription
+// context must release Send and Close, so the handler can return and end the
+// stream during filer shutdown.
+func TestPipelinedSenderUnblocksOnCancel(t *testing.T) {
+	stream := &blockedStream{release: make(chan struct{})}
+	defer close(stream.release)
+	ctx, cancel := context.WithCancel(context.Background())
+	sender := newPipelinedSender(ctx, stream, 1, false)
+
+	msg := &filer_pb.SubscribeMetadataResponse{EventNotification: &filer_pb.EventNotification{}}
+	if err := sender.Send(msg); err != nil { // consumed by the blocked sendLoop
+		t.Fatal(err)
+	}
+	if err := sender.Send(msg); err != nil { // fills the one-deep queue
+		t.Fatal(err)
+	}
+
+	cancel()
+
+	done := make(chan error, 1)
+	go func() { done <- sender.Send(msg) }()
+	select {
+	case err := <-done:
+		if err != context.Canceled {
+			t.Fatalf("Send returned %v, want context.Canceled", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("Send still blocked after cancel")
+	}
+	if err := sender.Close(); err != nil {
+		t.Fatalf("Close returned %v", err)
+	}
+}
+
+// Once the subscription context ends, sendLoop must not start another
+// stream.Send: the handler returns and gRPC ends the stream behind it, so a
+// send started then would race the stream's teardown. The one Send already
+// in flight is released by that teardown.
+func TestPipelinedSenderStopsSendingOnCancel(t *testing.T) {
+	stream := &blockedStream{release: make(chan struct{}), entered: make(chan struct{}, 1)}
+	ctx, cancel := context.WithCancel(context.Background())
+	sender := newPipelinedSender(ctx, stream, 4, false)
+
+	msg := &filer_pb.SubscribeMetadataResponse{EventNotification: &filer_pb.EventNotification{}}
+	if err := sender.Send(msg); err != nil {
+		t.Fatal(err)
+	}
+	<-stream.entered         // sendLoop is inside stream.Send
+	for i := 0; i < 2; i++ { // queued behind the blocked send
+		if err := sender.Send(msg); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	cancel()
+	close(stream.release)
+
+	if err := sender.Close(); err != nil {
+		t.Fatalf("Close returned %v", err)
+	}
+	select {
+	case <-sender.done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("sendLoop did not exit after cancel")
+	}
+	if n := stream.sends.Load(); n != 1 {
+		t.Fatalf("stream.Send ran %d times, want 1; a new send started after cancel", n)
+	}
+}
diff --git a/weed/server/filer_server.go b/weed/server/filer_server.go
index 11b1c080bc..8e09191723 100644
--- a/weed/server/filer_server.go
+++ b/weed/server/filer_server.go
@@ -5,11 +5,13 @@ import (
 	"fmt"
 	"net/http"
 	"os"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"golang.org/x/sync/singleflight"
@@ -22,6 +24,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 
@@ -88,6 +91,16 @@ type FilerOption struct {
 	TusSessionExpiry          time.Duration
 	S3ConfigFile              string // optional path to static S3 identity config file
 	CredentialManager         *credential.CredentialManager
+	// AnnounceCh, when set, must be closed before the filer registers on the
+	// master; it joins the filer list only once the gRPC port is serving and
+	// the metadata replay has caught up with the peers found at startup.
+	AnnounceCh chan struct{}
+	// AllowUntrustedRemoteEndpoints lets a read of a remote-only entry dial a
+	// mounted endpoint that resolves to a loopback / private / metadata host.
+	AllowUntrustedRemoteEndpoints bool
+	// RemoteCacheEvictThreshold is the disk usage fraction at which the filer
+	// evicts remote-mounted cached chunks; 0 disables eviction.
+	RemoteCacheEvictThreshold float64
 }
 
 type FilerServer struct {
@@ -117,9 +130,25 @@ type FilerServer struct {
 	// deduplicates concurrent remote object caching operations
 	remoteCacheGroup singleflight.Group
 
+	// serializes remote-cache eviction passes; lastVacuum rate-limits the
+	// compaction trigger that reclaims evicted chunks.
+	remoteCacheEvictMu       sync.Mutex
+	remoteCacheLastVacuum    atomic.Pointer[time.Time]
+	remoteCacheEvictCtx      context.Context
+	remoteCacheEvictCancel   context.CancelFunc
+	remoteCachePendingVidsMu sync.Mutex
+	remoteCachePendingVids   map[uint32]int
+
 	recentCopyRequestsMu sync.Mutex
 	recentCopyRequests   map[string]recentCopyRequest
 
+	// outcomes of recently applied object transactions keyed by request_id, so
+	// a failover replay of the same transaction replays its outcome instead of
+	// re-applying its mutations over a newer entry
+	recentObjectTxnsMu      sync.Mutex
+	recentObjectTxns        map[string]recentObjectTxn
+	recentObjectTxnsSweepAt time.Time
+
 	// credential manager for IAM operations
 	CredentialManager *credential.CredentialManager
 
@@ -127,6 +156,32 @@ type FilerServer struct {
 	// chunk sharing (tier 1). Always populated.
 	mountPeerRegistry *filer.MountPeerRegistry
 
+	// tusActiveUploads marks TUS sessions with a mutating request in flight, so
+	// a concurrent PATCH or DELETE is refused instead of recording duplicate
+	// chunks behind the first request's back.
+	tusActiveUploads sync.Map
+
+	// ringPeerIPs caches resolved ring member addresses per ring version so
+	// verifying a forwarded request's peer does not pay a DNS lookup per hop.
+	ringPeerIPs      atomic.Pointer[ringPeerIPs]
+	ringResolveGroup singleflight.Group
+
+	// masterCtx drives KeepConnectedToMaster; cancelling it ends the stream
+	// so the master drops this filer from its list before gRPC stops.
+	masterCtx    context.Context
+	masterCancel context.CancelFunc
+
+	// startupPeers are the filers discovered during NewFilerServer, before
+	// this filer announced itself; AnnounceOnceCaughtUp waits for their
+	// replayed backlogs before the filer joins the master's list.
+	startupPeers []pb.ServerAddress
+
+	// peerBootstrapPending marks a fresh store whose startup peer scan came
+	// back empty: an empty answer during a master restart can just mean the
+	// existing filers have not reconnected yet, so AnnounceOnceCaughtUp
+	// re-checks membership before registering.
+	peerBootstrapPending bool
+
 	// entryLockTable serializes mutations to the same entry path on this filer.
 	// CreateEntry takes it today; UpdateEntry and DeleteEntry are intended to take
 	// it too as their callers route a key's writes to this node, making it the
@@ -142,6 +197,12 @@ type FilerServer struct {
 	posixLocks *posixlock.Manager
 	// posixLockSweeperStop stops the lease-reaping sweeper goroutine on Shutdown.
 	posixLockSweeperStop chan struct{}
+
+	// subscriptionsStopped is cancelled by StopSubscriptions when the filer
+	// starts shutting down; every metadata subscription derives its context
+	// from it as well as from its stream.
+	subscriptionsStopped context.Context
+	stopSubscriptions    context.CancelFunc
 	// posixLockReadyAt is the unix-nanos when this filer began serving POSIX
 	// locks. For posixLockWarmup after it, the owner defers would-be grants while
 	// mounts re-assert, so a (re)started owner does not double-grant from empty
@@ -175,9 +236,11 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption)
 	domains := strings.Split(allowedOrigins, ",")
 	option.AllowedOrigins = domains
 
+	// -exposeDirectoryData and filer.expose_directory_metadata both default to
+	// on, and either one turning it off has to hold: this is what keeps the
+	// directory listing off a filer whose reads are otherwise unauthenticated.
 	v.SetDefault("filer.expose_directory_metadata.enabled", true)
-	returnDirMetadata := v.GetBool("filer.expose_directory_metadata.enabled")
-	option.ExposeDirectoryData = returnDirMetadata
+	option.ExposeDirectoryData = option.ExposeDirectoryData && v.GetBool("filer.expose_directory_metadata.enabled")
 
 	fs = &FilerServer{
 		option:                option,
@@ -186,13 +249,16 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption)
 		subscribers:           make(map[int32]*metadataSubscriber),
 		inFlightDataLimitCond: sync.NewCond(new(sync.Mutex)),
 		recentCopyRequests:    make(map[string]recentCopyRequest),
+		recentObjectTxns:      make(map[string]recentObjectTxn),
 		CredentialManager:     option.CredentialManager,
 		entryLockTable:        util.NewLockTable[util.FullPath](),
 		posixLocks:            posixlock.NewManager(),
 	}
+	fs.subscriptionsStopped, fs.stopSubscriptions = context.WithCancel(context.Background())
 	fs.startPosixLockSweeper()
 	fs.mountPeerRegistry = filer.NewMountPeerRegistry()
 	go fs.runMountPeerRegistrySweeper()
+	fs.remoteCacheEvictCtx, fs.remoteCacheEvictCancel = context.WithCancel(context.Background())
 
 	option.Masters.RefreshBySrvIfAvailable()
 	if len(option.Masters.GetInstances()) == 0 {
@@ -216,8 +282,17 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption)
 	maxFilenameLength := v.GetUint32("filer.options.max_file_name_length")
 	glog.V(0).Infof("max_file_name_length %d", maxFilenameLength)
 	fs.filer = filer.NewFiler(*option.Masters, fs.grpcDialOption, option.Host, option.FilerGroup, option.Collection, option.DefaultReplication, option.DataCenter, maxFilenameLength, nil)
+	// Peer metadata replay takes the same per-path locks, so a replayed change
+	// cannot split a local mutation's read-modify-write.
+	fs.entryLockTable = fs.filer.EntryLockTable
 	fs.filer.Cipher = option.Cipher
 	fs.filer.DefaultDiskType = option.DiskType
+	fs.filer.BuildGuardedRemoteClient = BuildGuardedRemoteStorageClient
+	fs.filer.AllowUntrustedRemoteEndpoints = option.AllowUntrustedRemoteEndpoints
+	fs.filer.RemoteStorage.SetConfValidator(func(ctx context.Context, conf *remote_pb.RemoteConf) error {
+		return ValidateRemoteConfForLoad(ctx, conf, option.AllowUntrustedRemoteEndpoints)
+	})
+	go fs.runRemoteCacheEviction()
 	// we do not support IP whitelist right now https://github.com/seaweedfs/seaweedfs/issues/7094
 	if v.GetString("guard.white_list") != "" {
 		glog.Warningf("filer: guard.white_list is configured but the IP whitelist feature is currently disabled. See https://github.com/seaweedfs/seaweedfs/issues/7094")
@@ -228,7 +303,11 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption)
 	fs.checkWithMaster()
 
 	go stats.LoopPushingMetric("filer", string(fs.option.Host), fs.metricsAddress, fs.metricsIntervalSec)
-	go fs.filer.MasterClient.KeepConnectedToMaster(context.Background())
+	if option.AnnounceCh != nil {
+		fs.filer.MasterClient.SetAnnounceCh(option.AnnounceCh)
+	}
+	fs.masterCtx, fs.masterCancel = context.WithCancel(context.Background())
+	go fs.filer.MasterClient.KeepConnectedToMaster(fs.masterCtx)
 
 	fs.option.recursiveDelete = v.GetBool("filer.options.recursive_delete")
 	v.SetDefault("filer.options.buckets_folder", "/buckets")
@@ -277,13 +356,29 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption)
 		readonlyMux.HandleFunc("/", fs.filerGuard.WhiteList(requestIDMiddleware(fs.readonlyFilerHandler)))
 	}
 
-	existingNodes := fs.filer.ListExistingPeerUpdates(context.Background())
+	// A failed peer scan is not an empty cluster: a fresh filer that skipped
+	// bootstrap here would serve without the existing files, so retry until a
+	// master answers. This runs before the announce gate opens, so the filer
+	// is not yet advertised.
+	var existingNodes []*master_pb.ClusterNodeUpdate
+	for {
+		var listErr error
+		existingNodes, listErr = fs.filer.ListExistingPeerUpdates(context.Background())
+		if listErr == nil {
+			break
+		}
+		glog.Warningf("%s cannot list existing peers: %v; retrying", option.Host, listErr)
+		time.Sleep(2 * time.Second)
+	}
 	startFromTime := time.Now().Add(-filer.LogFlushInterval)
 	if isFresh {
 		glog.V(0).Infof("%s bootstrap from peers %+v", option.Host, existingNodes)
-		if err := fs.filer.MaybeBootstrapFromOnePeer(option.Host, existingNodes, startFromTime); err != nil {
+		if err := fs.filer.MaybeBootstrapFromOnePeer(context.Background(), option.Host, existingNodes, startFromTime); err != nil {
 			glog.Fatalf("%s bootstrap from %+v: %v", option.Host, existingNodes, err)
 		}
+		// An empty scan can be a settling master rather than an empty cluster;
+		// the announce gate then re-checks membership before registering.
+		fs.peerBootstrapPending = len(existingNodes) == 0
 	}
 	v.SetDefault("filer.options.s3.empty_folder_cleanup_delay", "2m")
 	if d, err := time.ParseDuration(v.GetString("filer.options.s3.empty_folder_cleanup_delay")); err == nil {
@@ -291,10 +386,21 @@ func NewFilerServer(defaultMux, readonlyMux *http.ServeMux, option *FilerOption)
 	}
 	fs.filer.AggregateFromPeers(option.Host, existingNodes, startFromTime)
 
+	// A peer replaying its backlog applies the old owner's events over this
+	// filer's fresh writes if it takes lock-ring ownership before the replay
+	// finishes, so the announce gate waits for these peers to catch up.
+	for _, node := range existingNodes {
+		if addr := pb.ServerAddress(node.Address); !addr.Equals(option.Host) {
+			fs.startupPeers = append(fs.startupPeers, addr)
+		}
+	}
+
 	fs.filer.LoadFilerConf()
 
 	fs.filer.LoadRemoteStorageConfAndMapping()
 
+	fs.filer.RebuildRemoteDeletionTombstones(context.Background())
+
 	grace.OnReload(fs.Reload)
 
 	fs.SetupDlmReplication()
@@ -340,7 +446,237 @@ func (fs *FilerServer) Shutdown() {
 	if fs.posixLockSweeperStop != nil {
 		close(fs.posixLockSweeperStop)
 	}
+	if fs.remoteCacheEvictCancel != nil {
+		fs.remoteCacheEvictCancel()
+	}
 	fs.filer.Shutdown()
+	// LeaveLockRing already ended the master stream in the normal path; this
+	// covers callers that skip it, and runs after the filer's own shutdown so
+	// the final metadata-log flush can still reach the master.
+	if fs.masterCancel != nil {
+		fs.masterCancel()
+	}
+}
+
+// priorOwnerWindowSkew covers peers and gateways that start their prior-owner
+// window after this filer, since each times it from its own ring update.
+const priorOwnerWindowSkew = time.Second
+
+// leaveLockRingBudget bounds the leave: installing the ring update runs lock
+// transfers under the ring lock, which can outlast the removal timeout.
+const leaveLockRingBudget = 10 * time.Second
+
+// LeaveLockRing hands this filer's lock-ring keys to its peers while its own
+// servers still accept the lock transfers and prior-owner writes that follow.
+func (fs *FilerServer) LeaveLockRing() {
+	fs.leaveLockRingWithin(3*cluster.LockRingStabilizationInterval, leaveLockRingBudget)
+}
+
+func (fs *FilerServer) leaveLockRingWithin(removalTimeout, budget time.Duration) {
+	left := make(chan struct{})
+	go func() {
+		defer close(left)
+		fs.leaveLockRing(removalTimeout)
+	}()
+	select {
+	case <-left:
+	case <-time.After(budget):
+		glog.Warningf("LockRing: %s did not finish leaving within %v, shutting down anyway", fs.option.Host, budget)
+	}
+	// End the master stream so the master drops this filer from the cluster
+	// list before gRPC stops accepting connections.
+	if fs.masterCancel != nil {
+		fs.masterCancel()
+	}
+	fs.waitForClusterRemoval()
+}
+
+// announceCatchUpCap bounds how long startup holds the master registration
+// while the metadata replay catches up with the peers found at startup. Past
+// it the filer announces anyway, as it did when the gate opened on serve.
+const announceCatchUpCap = time.Minute
+
+// AnnounceOnceCaughtUp closes announce once every peer found at startup has
+// replayed its backlog. Each peer's stream advances a watermark per event or
+// idle heartbeat, so a watermark past waitStart means nothing older can still
+// land on top of this filer's fresh writes. Called once gRPC is serving, so
+// routed traffic is answerable the moment the filer is listed.
+func (fs *FilerServer) AnnounceOnceCaughtUp(announce chan struct{}, waitStart time.Time) {
+	defer close(announce)
+	ma := fs.filer.MetaAggregator
+	if ma == nil {
+		return
+	}
+	// The bootstrap re-check and the catch-up wait share one deadline so a
+	// late peer cannot stretch the registration hold past the cap.
+	deadline := time.Now().Add(announceCatchUpCap)
+	peers := fs.startupPeers
+	if fs.peerBootstrapPending {
+		peers = append(peers, fs.awaitPeerBootstrap(deadline)...)
+	}
+	if len(peers) == 0 {
+		return
+	}
+	for {
+		// Take the channel before reading the watermarks so a rise in
+		// between still wakes this wait (see DeliveryWatermarkAdvancedChan).
+		advanced := ma.DeliveryWatermarkAdvancedChan()
+		if ma.PeersCaughtUpTo(peers, waitStart.UnixNano()) {
+			glog.V(0).Infof("%s caught up with %d startup peers, announcing to masters", fs.option.Host, len(peers))
+			return
+		}
+		remaining := time.Until(deadline)
+		if remaining <= 0 {
+			glog.Warningf("%s metadata replay not caught up after %v, announcing anyway", fs.option.Host, announceCatchUpCap)
+			return
+		}
+		select {
+		case <-advanced:
+		case <-time.After(min(remaining, time.Second)):
+		}
+	}
+}
+
+// emptyMembershipConfirmTimeout bounds the announce hold for a peer to
+// disprove an empty startup scan on a fresh store. This runs after the ports
+// already serve, so a genuinely empty cluster pays a delayed master listing,
+// not a stalled startup.
+const emptyMembershipConfirmTimeout = 10 * time.Second
+
+// awaitPeerBootstrap re-polls membership while a fresh store's empty startup
+// scan can still be disproved: masters restarted or re-elected report no
+// filers until the existing ones reconnect. Peers found late are backfilled
+// from before their streams start, then reported so the caller waits for
+// their catch-up like startup peers. The whole wait — including each peer
+// metadata copy — is bounded by the shared announce deadline.
+func (fs *FilerServer) awaitPeerBootstrap(deadline time.Time) (peers []pb.ServerAddress) {
+	confirmBy := time.Now().Add(emptyMembershipConfirmTimeout)
+	for time.Now().Before(deadline) {
+		ctx, cancel := context.WithDeadline(context.Background(), deadline)
+		nodes, listErr := fs.filer.ListExistingPeerUpdates(ctx)
+		cancel()
+		if listErr != nil {
+			glog.Warningf("%s cannot re-check existing peers: %v; announcing anyway", fs.option.Host, listErr)
+			return nil
+		}
+		var remotes []*master_pb.ClusterNodeUpdate
+		for _, node := range nodes {
+			if !pb.ServerAddress(node.Address).Equals(fs.option.Host) {
+				remotes = append(remotes, node)
+			}
+		}
+		if len(remotes) == 0 {
+			if !time.Now().Before(confirmBy) {
+				return nil
+			}
+			time.Sleep(time.Second)
+			continue
+		}
+		bootstrapFrom := time.Now().Add(-filer.LogFlushInterval)
+		ctx, cancel = context.WithDeadline(context.Background(), deadline)
+		err := fs.filer.MaybeBootstrapFromOnePeer(ctx, fs.option.Host, remotes, bootstrapFrom)
+		cancel()
+		if err != nil {
+			glog.Warningf("%s bootstrap from late peers %+v: %v; retrying", fs.option.Host, remotes, err)
+			time.Sleep(2 * time.Second)
+			continue
+		}
+		glog.V(0).Infof("%s bootstrap from late-arriving peers %+v", fs.option.Host, remotes)
+		for _, node := range remotes {
+			peers = append(peers, pb.ServerAddress(node.Address))
+			fs.filer.MetaAggregator.OnPeerUpdate(node, bootstrapFrom)
+		}
+		return peers
+	}
+	return nil
+}
+
+// masterRemovalWaitBudget bounds how long shutdown waits for masters to
+// drop this filer before gRPC drains anyway.
+const masterRemovalWaitBudget = 5 * time.Second
+
+// waitForClusterRemoval polls the configured masters until none still lists
+// this filer. The master removes membership when the KeepConnected handler
+// unwinds, which is asynchronous to cancel, so new requests could otherwise
+// route to this filer after its gRPC listener has already closed.
+func (fs *FilerServer) waitForClusterRemoval() {
+	ctx, cancel := context.WithTimeout(context.Background(), masterRemovalWaitBudget)
+	defer cancel()
+	confirmedAbsent := make(map[pb.ServerAddress]struct{})
+	for ctx.Err() == nil {
+		pending := false
+		// The cached list keeps a slow SRV lookup from stretching the
+		// removal-wait budget.
+		for _, master := range fs.filer.MasterClient.ListCachedMasters() {
+			if _, ok := confirmedAbsent[master]; ok {
+				continue
+			}
+			if ctx.Err() != nil {
+				return
+			}
+			// The per-query timeout shares the overall deadline, so a stalled
+			// master cannot stretch the wait past the budget.
+			queryCtx, queryCancel := context.WithTimeout(ctx, 2*time.Second)
+			nodes, err := cluster.ListExistingPeerUpdates(queryCtx, master, fs.grpcDialOption, fs.filer.MasterClient.FilerGroup, cluster.FilerType)
+			queryCancel()
+			if err != nil {
+				// A failed query is not confirmed removal; retry until the
+				// master answers or the overall deadline expires.
+				pending = true
+				continue
+			}
+			listed := false
+			for _, node := range nodes {
+				if node.Address == string(fs.option.Host) {
+					listed = true
+					break
+				}
+			}
+			if listed {
+				pending = true
+			} else {
+				confirmedAbsent[master] = struct{}{}
+			}
+		}
+		if !pending {
+			return
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(200 * time.Millisecond):
+		}
+	}
+}
+
+func (fs *FilerServer) leaveLockRing(removalTimeout time.Duration) {
+	if fs.filer.Dlm == nil {
+		return
+	}
+	ring := fs.filer.Dlm.LockRing
+	self := fs.option.Host
+	members := ring.GetSnapshot()
+	// A lone filer has no peer to take its keys: leaving would strand lock
+	// requests arriving during the drain without an owner.
+	if len(members) < 2 || !slices.Contains(members, self) {
+		return
+	}
+	// A failed send still leaves: the broken stream's close drops this filer
+	// from the ring and the reconnect registers without it.
+	if err := fs.filer.MasterClient.LeaveLockRing(); err != nil {
+		glog.Warningf("LockRing: %s leave request failed, waiting for reconnect: %v", self, err)
+	}
+	deadline := time.Now().Add(removalTimeout)
+	for slices.Contains(ring.GetSnapshot(), self) {
+		if time.Now().After(deadline) {
+			glog.Warningf("LockRing: %s still in the ring after %v, shutting down anyway", self, removalTimeout)
+			return
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+	until := ring.PriorOwnerWindowEnd().Add(priorOwnerWindowSkew)
+	glog.V(0).Infof("LockRing: %s left, serving prior-owner requests until %v", self, until)
+	time.Sleep(time.Until(until))
 }
 
 func (fs *FilerServer) Reload() {
diff --git a/weed/server/filer_server_format.go b/weed/server/filer_server_format.go
index b2350e0c81..eccabb1171 100644
--- a/weed/server/filer_server_format.go
+++ b/weed/server/filer_server_format.go
@@ -217,7 +217,7 @@ func (fs *FilerServer) formatIngest(ctx context.Context, w http.ResponseWriter,
 		return
 	}
 
-	fileChunks, err = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), fileChunks)
+	fileChunks, err = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), fs.filer.DeleteChunksNotRecursive, fileChunks)
 	if err != nil {
 		cleanup()
 		writeJsonError(w, r, http.StatusInternalServerError, err)
@@ -367,7 +367,11 @@ func (fs *FilerServer) formatRepack(ctx context.Context, w http.ResponseWriter,
 	}
 	size := int64(entry.FileSize)
 	lookup := fs.filer.MasterClient.GetLookupFileIdFunction()
-	chunkViews := filer.ViewFromChunks(ctx, lookup, oldChunks, 0, size)
+	chunkViews, err := filer.ViewFromChunks(ctx, lookup, oldChunks, 0, size)
+	if err != nil {
+		writeJsonError(w, r, http.StatusInternalServerError, err)
+		return
+	}
 	readerCache := filer.NewReaderCache(8, chunk_cache.NewChunkCacheInMemory(16), lookup, nil)
 	readerAt := filer.NewChunkReaderAtFromClient(ctx, readerCache, chunkViews, size, filer.DefaultPrefetchCount)
 	// Close releases the private reader cache and its in-flight prefetches.
@@ -420,7 +424,7 @@ func (fs *FilerServer) formatRepack(ctx context.Context, w http.ResponseWriter,
 		writeJsonError(w, r, http.StatusInternalServerError, fmt.Errorf("read %d of %d bytes", written, size))
 		return
 	}
-	newChunks, err = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), newChunks)
+	newChunks, err = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), fs.filer.DeleteChunksNotRecursive, newChunks)
 	if err != nil {
 		cleanup()
 		writeJsonError(w, r, http.StatusInternalServerError, err)
@@ -478,7 +482,7 @@ func (fs *FilerServer) formatRepack(ctx context.Context, w http.ResponseWriter,
 	if len(newEntry.Md5) == 0 {
 		newEntry.Md5 = md5Hash.Sum(nil)
 	}
-	if err := fs.filer.UpdateEntry(context.WithoutCancel(ctx), current, &newEntry); err != nil {
+	if err := fs.filer.UpdateEntry(context.WithoutCancel(ctx), current, &newEntry, false); err != nil {
 		cleanup()
 		writeJsonError(w, r, http.StatusInternalServerError, err)
 		return
diff --git a/weed/server/filer_server_handlers.go b/weed/server/filer_server_handlers.go
index 7050aee1fb..6fd9bfbf3e 100644
--- a/weed/server/filer_server_handlers.go
+++ b/weed/server/filer_server_handlers.go
@@ -15,6 +15,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
 	"github.com/seaweedfs/seaweedfs/weed/util/version"
 )
 
@@ -56,17 +57,6 @@ func (fs *FilerServer) filerHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// proxy to volume servers
-	var fileId string
-	if r.URL.Path == "/" {
-		fileId = r.URL.Query().Get("proxyChunkId")
-	}
-	if fileId != "" {
-		fs.proxyToVolumeServer(w, r, fileId)
-		stats.FilerHandlerCounter.WithLabelValues(stats.ChunkProxy).Inc()
-		stats.FilerRequestHistogram.WithLabelValues(stats.ChunkProxy).Observe(time.Since(start).Seconds())
-		return
-	}
 	requestMethod := r.Method
 	defer func(method *string) {
 		stats.FilerRequestCounter.WithLabelValues(*method, strconv.Itoa(statusRecorder.Status)).Inc()
@@ -79,6 +69,19 @@ func (fs *FilerServer) filerHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// proxy to volume servers, after the gate: this is the one port operators
+	// expose, and the branch reaches any needle in the cluster by file id.
+	if r.URL.Path == "/" {
+		if fileId := r.URL.Query().Get(util_http.ProxyChunkIdParam); fileId != "" {
+			fs.proxyToVolumeServer(w, r, fileId)
+			stats.FilerHandlerCounter.WithLabelValues(stats.ChunkProxy).Inc()
+			// Name the deferred observation after the proxy rather than
+			// observing a second time, which would count the request twice.
+			requestMethod = stats.ChunkProxy
+			return
+		}
+	}
+
 	w.Header().Set("Server", "SeaweedFS "+version.VERSION)
 
 	switch r.Method {
@@ -211,11 +214,6 @@ func OptionsHandler(w http.ResponseWriter, r *http.Request, isReadOnly bool) {
 
 // maybeCheckJwtAuthorization returns true if access should be granted, false if it should be denied
 func (fs *FilerServer) maybeCheckJwtAuthorization(r *http.Request, isWrite bool) bool {
-
-	if !isWrite && r.URL.Path == "/" {
-		return true
-	}
-
 	return fs.checkJwtAuthorization(r, isWrite, jwtScopedRequestPaths(r))
 }
 
@@ -267,6 +265,10 @@ func (fs *FilerServer) authenticateFilerJwt(r *http.Request, isWrite bool) (*sec
 		glog.V(1).Infof("jwt claims not of type *SeaweedFilerClaims from %s", r.RemoteAddr)
 		return nil, false
 	}
+	if claims.SessionId != "" {
+		glog.V(1).Infof("jwt is an STS session token, not a filer credential, from %s", r.RemoteAddr)
+		return nil, false
+	}
 
 	if len(claims.AllowedMethods) > 0 {
 		hasMethod := false
diff --git a/weed/server/filer_server_handlers_copy.go b/weed/server/filer_server_handlers_copy.go
index 35a5d11089..9db334b1de 100644
--- a/weed/server/filer_server_handlers_copy.go
+++ b/weed/server/filer_server_handlers_copy.go
@@ -157,6 +157,21 @@ func (fs *FilerServer) copy(ctx context.Context, w http.ResponseWriter, r *http.
 		return
 	}
 
+	// The copy is remote-backed when a data-only copy restores the destination's
+	// remote pointer, otherwise when the source carries one. Such an entry never
+	// expires locally, so its cached chunks must not land on a TTL volume either:
+	// the entry keeps listing them once they are gone, which reads as cached
+	// rather than remote-only, and nothing re-fetches.
+	remoteBacked := srcEntry.Remote != nil
+	if dataOnly && existingDstEntry != nil {
+		remoteBacked = existingDstEntry.Remote != nil
+	}
+	if remoteBacked && so.TtlSeconds != 0 {
+		withoutTtl := *so
+		withoutTtl.TtlSeconds = 0
+		so = &withoutTtl
+	}
+
 	// Copy the file content and chunks
 	newEntry, err := fs.copyEntry(ctx, srcEntry, finalDstPath, so)
 	if err != nil {
@@ -168,6 +183,11 @@ func (fs *FilerServer) copy(ctx context.Context, w http.ResponseWriter, r *http.
 		preserveDestinationMetadataForDataCopy(existingDstEntry, newEntry)
 	}
 
+	// The chunks above were placed under the destination's storage option, so the
+	// entry has to carry its TTL and not the source's (or, for a data-only copy,
+	// the destination's older one) - otherwise the entry and its data expire apart.
+	newEntry.ApplyStorageTtl(so.TtlSeconds)
+
 	// Pass o_excl = !overwrite so the default copy refuses to replace an
 	// existing destination, while overwrite=true updates the pre-created target.
 	if createErr := fs.filer.CreateEntry(ctx, newEntry, nil, !overwrite, false, nil, false, fs.filer.MaxFilenameLength); createErr != nil {
@@ -580,7 +600,7 @@ func (fs *FilerServer) copyChunksWithManifest(ctx context.Context, srcChunks []*
 			return fs.filer.MasterClient.GetLookupFileIdFunction()(ctx, fileId)
 		}
 
-		resolvedChunks, err := filer.ResolveOneChunkManifest(ctx, lookupFileIdFn, manifestChunk)
+		resolvedChunks, err := filer.ResolveOneChunkManifest(ctx, lookupFileIdFn, manifestChunk, fs.filer.MasterClient)
 		if err != nil {
 			return nil, fmt.Errorf("failed to resolve manifest chunk %s: %w", manifestChunk.GetFileIdString(), err)
 		}
diff --git a/weed/server/filer_server_handlers_extract.go b/weed/server/filer_server_handlers_extract.go
new file mode 100644
index 0000000000..c51d7b9c6f
--- /dev/null
+++ b/weed/server/filer_server_handlers_extract.go
@@ -0,0 +1,339 @@
+package weed_server
+
+import (
+	"archive/zip"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"os"
+	"path"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/constants"
+)
+
+type FilerExtractResult struct {
+	Name      string             `json:"name,omitempty"`
+	Extracted []*FilerPostResult `json:"extracted,omitempty"`
+	Errors    []string           `json:"errors,omitempty"`
+}
+
+func isExtractZip(r *http.Request) bool {
+	return r.URL.Query().Get("extract") == "zip" ||
+		r.Header.Get(s3_constants.SeaweedFSExtract) == "zip"
+}
+
+// extractZipArchive writes a posted archive's members as individual entries
+// under the target directory, like AWS Snowball's auto-extract. The archive
+// itself is only stored when ?extract.keep=true.
+func (fs *FilerServer) extractZipArchive(ctx context.Context, w http.ResponseWriter, r *http.Request) {
+	var reader io.Reader = r.Body
+	archiveName := path.Base(r.URL.Path)
+	if r.Method == http.MethodPost {
+		if mediaType, _, _ := mime.ParseMediaType(r.Header.Get("Content-Type")); strings.HasPrefix(mediaType, "multipart/") {
+			multipartReader, multipartReaderErr := r.MultipartReader()
+			if multipartReaderErr != nil {
+				writeJsonError(w, r, http.StatusBadRequest, multipartReaderErr)
+				return
+			}
+			part1, part1Err := multipartReader.NextPart()
+			if part1Err != nil {
+				writeJsonError(w, r, http.StatusBadRequest, part1Err)
+				return
+			}
+			defer part1.Close()
+			reader = part1
+			if fileName := part1.FileName(); fileName != "" {
+				archiveName = path.Base(fileName)
+			}
+		}
+	}
+
+	ra, size, cleanup, err := filer.SpoolZipReader(reader, fs.option.TusMaxSize)
+	if err != nil {
+		code := http.StatusInternalServerError
+		if errors.Is(err, filer.ErrZipTooLarge) {
+			code = http.StatusRequestEntityTooLarge
+		}
+		writeJsonError(w, r, code, fmt.Errorf("read input: %w", err))
+		return
+	}
+	defer cleanup()
+	zr, err := zip.NewReader(ra, size)
+	if err != nil {
+		writeJsonError(w, r, http.StatusBadRequest, fmt.Errorf("extract zip: %w", err))
+		return
+	}
+	if err = filer.CheckZipLimits(zr); err != nil {
+		writeJsonError(w, r, http.StatusBadRequest, err)
+		return
+	}
+
+	root := r.URL.Path
+	if !strings.HasSuffix(root, "/") {
+		root = path.Dir(root)
+	}
+	root = strings.TrimSuffix(root, "/")
+
+	query := r.URL.Query()
+	chunkSize := fs.requestChunkSize(query)
+
+	// x-seaweedfs-destination picks storage rules for a logical destination
+	// while members land under the request path, mirroring PostHandler. The
+	// actual write path keeps its own read-only enforcement in
+	// saveExtractedEntry and mkdirExtracted.
+	ruleRoot := root
+	if headerDestination := r.Header.Get(s3_constants.SeaweedStorageDestinationHeader); headerDestination != "" {
+		ruleRoot = strings.TrimSuffix(headerDestination, "/")
+	}
+
+	// Members may land under storage rules different from the request path;
+	// resolve options per destination, keeping the request's explicit overrides.
+	memberStorageOption := func(rulePath, writePath string) (*operation.StorageOption, error) {
+		memberSO, detectErr := fs.detectStorageOption0(ctx, rulePath,
+			query.Get("collection"),
+			query.Get("replication"),
+			query.Get("ttl"),
+			query.Get("disk"),
+			query.Get("fsync"),
+			query.Get("dataCenter"),
+			query.Get("rack"),
+			query.Get("dataNode"),
+			query.Get("saveInside"),
+		)
+		if detectErr != nil {
+			return nil, detectErr
+		}
+		if memberSO.DiskType == "" {
+			memberSO.DiskType = fs.option.DiskType
+		}
+		if strings.HasPrefix(writePath, "/etc") {
+			memberSO.SaveInside = true
+		}
+		return memberSO, nil
+	}
+
+	result := &FilerExtractResult{Name: archiveName}
+	writeMember := func(rel string, memberReader io.Reader, memberSize int64, mtime time.Time, mode os.FileMode) {
+		destPath := root + "/" + rel
+		memberSO, soErr := memberStorageOption(ruleRoot+"/"+rel, destPath)
+		if soErr != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("%s: %v", rel, soErr))
+			return
+		}
+		memberResult, memberErr := fs.saveExtractedEntry(ctx, destPath, memberReader, memberSize, path.Base(rel), chunkSize, memberSO, mtime, mode)
+		if memberErr != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("%s: %v", rel, memberErr))
+			return
+		}
+		memberResult.Name = rel
+		result.Extracted = append(result.Extracted, memberResult)
+	}
+	mkdirMember := func(rel string, zf *zip.File) {
+		destPath := root + "/" + rel
+		memberSO, soErr := memberStorageOption(ruleRoot+"/"+rel, destPath)
+		if soErr != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("%s: %v", rel, soErr))
+			return
+		}
+		if dirErr := fs.mkdirExtracted(ctx, destPath, zf, memberSO); dirErr != nil {
+			result.Errors = append(result.Errors, fmt.Sprintf("%s: %v", rel, dirErr))
+		}
+	}
+
+	if query.Get("extract.keep") == "true" && archiveName != "." && archiveName != "/" {
+		mode := os.FileMode(0660)
+		if modeStr := query.Get("mode"); modeStr != "" {
+			if parsed, parseErr := strconv.ParseUint(modeStr, 8, 32); parseErr == nil {
+				mode = os.FileMode(parsed)
+			}
+		}
+		writeMember(archiveName, io.NewSectionReader(ra, 0, size), size, time.Now(), mode)
+	}
+
+	// Directory members first so their stored metadata is not overwritten by
+	// parents auto-created for an earlier file member.
+	for _, dirsOnly := range []bool{true, false} {
+		for _, zf := range zr.File {
+			if ctxErr := ctx.Err(); ctxErr != nil {
+				result.Errors = append(result.Errors, ctxErr.Error())
+				writeJsonQuiet(w, r, http.StatusCreated, result)
+				return
+			}
+			rel, ok := filer.SanitizeZipMemberName(zf)
+			if !ok {
+				if !dirsOnly {
+					result.Errors = append(result.Errors, fmt.Sprintf("%s: unsafe member name", zf.Name))
+				}
+				continue
+			}
+			if zf.FileInfo().IsDir() != dirsOnly {
+				continue
+			}
+			if dirsOnly {
+				mkdirMember(rel, zf)
+				continue
+			}
+			memberReader, openErr := zf.Open()
+			if openErr != nil {
+				result.Errors = append(result.Errors, fmt.Sprintf("%s: %v", rel, openErr))
+				continue
+			}
+			mode := os.FileMode(0660)
+			if perm := zf.Mode().Perm(); perm != 0 {
+				mode = perm
+			}
+			writeMember(rel, memberReader, int64(zf.UncompressedSize64), zf.Modified, mode)
+			memberReader.Close()
+		}
+	}
+
+	writeJsonQuiet(w, r, http.StatusCreated, result)
+}
+
+func (fs *FilerServer) mkdirExtracted(ctx context.Context, destPath string, zf *zip.File, so *operation.StorageOption) error {
+	if fs.filer.FilerConf.MatchStorageRule(destPath).ReadOnly {
+		return ErrReadOnly
+	}
+	existing, findErr := fs.filer.FindEntry(ctx, util.FullPath(destPath))
+	if findErr == nil {
+		if existing.IsDirectory() {
+			return nil
+		}
+		return fmt.Errorf("%s already exists as a file", destPath)
+	}
+	if !errors.Is(findErr, filer_pb.ErrNotFound) {
+		return findErr
+	}
+	mode := os.FileMode(0660)
+	if perm := zf.Mode().Perm(); perm != 0 {
+		mode = perm
+	}
+	mtime := zf.Modified
+	if mtime.IsZero() {
+		mtime = time.Now()
+	}
+	return fs.filer.CreateEntry(context.WithoutCancel(ctx), &filer.Entry{
+		FullPath: util.FullPath(destPath),
+		Attr: filer.Attr{
+			Mtime:  mtime,
+			Crtime: time.Now(),
+			Mode:   mode | os.ModeDir,
+			Uid:    OS_UID,
+			Gid:    OS_GID,
+			TtlSec: so.TtlSeconds,
+		},
+	}, nil, false, false, nil, false, so.MaxFileNameLength)
+}
+
+func (fs *FilerServer) saveExtractedEntry(ctx context.Context, destPath string, reader io.Reader, memberSize int64, fileName string, chunkSize int32, so *operation.StorageOption, mtime time.Time, mode os.FileMode) (*FilerPostResult, error) {
+	if fs.filer.FilerConf.MatchStorageRule(destPath).ReadOnly {
+		return nil, ErrReadOnly
+	}
+	wormEnforced, err := fs.wormEnforcedForEntry(ctx, destPath)
+	if err != nil {
+		return nil, err
+	}
+	if wormEnforced {
+		return nil, errors.New(constants.ErrMsgOperationNotPermitted)
+	}
+	if util.FullPath(destPath).IsLongerFileName(so.MaxFileNameLength) {
+		return nil, filer_pb.ErrEntryNameTooLong
+	}
+
+	contentType := mime.TypeByExtension(path.Ext(fileName))
+
+	// saveInside stores members as inline entry content like a normal
+	// multipart upload; the declared size keeps a corrupt archive from
+	// buffering more than it advertised.
+	if so.SaveInside {
+		if memberSize < 0 || memberSize > filer.ZipExtractMaxBytes {
+			return nil, fmt.Errorf("zip member %s size %d out of bounds", fileName, memberSize)
+		}
+		var buf bytes.Buffer
+		if _, err := buf.ReadFrom(io.LimitReader(reader, memberSize+1)); err != nil {
+			return nil, fmt.Errorf("read member: %w", err)
+		}
+		if int64(buf.Len()) > memberSize {
+			return nil, fmt.Errorf("zip member %s is larger than its declared size", fileName)
+		}
+		if mtime.IsZero() {
+			mtime = time.Now()
+		}
+		entry := &filer.Entry{
+			FullPath: util.FullPath(destPath),
+			Attr: filer.Attr{
+				Mtime:    mtime,
+				Crtime:   time.Now(),
+				Mode:     mode,
+				Uid:      OS_UID,
+				Gid:      OS_GID,
+				TtlSec:   so.TtlSeconds,
+				Mime:     contentType,
+				Md5:      util.Md5(buf.Bytes()),
+				FileSize: uint64(buf.Len()),
+			},
+			Content: buf.Bytes(),
+		}
+		if err := fs.filer.CreateEntry(context.WithoutCancel(ctx), entry, nil, false, false, nil, false, so.MaxFileNameLength); err != nil {
+			return nil, err
+		}
+		return &FilerPostResult{Name: fileName, Size: int64(buf.Len())}, nil
+	}
+
+	fileChunks, md5Hash, chunkOffset, uploadErr, smallContent := fs.uploadReaderToChunks(ctx, nil, reader, 0, chunkSize, fileName, contentType, false, so)
+	if uploadErr != nil {
+		return nil, uploadErr
+	}
+	if chunkOffset == 0 {
+		smallContent = []byte{}
+	}
+
+	mergedChunks, mergeErr := fs.maybeMergeChunks(ctx, so, fileChunks)
+	if mergeErr != nil {
+		glog.V(0).InfofCtx(ctx, "merge chunks %s: %v", destPath, mergeErr)
+		mergedChunks = fileChunks
+	}
+	mergedChunks, manifestErr := filer.MaybeManifestize(fs.saveAsChunk(ctx, so), fs.filer.DeleteChunksNotRecursive, mergedChunks)
+	if manifestErr != nil {
+		fs.filer.DeleteUncommittedChunks(ctx, mergedChunks)
+		return nil, manifestErr
+	}
+
+	if mtime.IsZero() {
+		mtime = time.Now()
+	}
+	entry := &filer.Entry{
+		FullPath: util.FullPath(destPath),
+		Attr: filer.Attr{
+			Mtime:    mtime,
+			Crtime:   time.Now(),
+			Mode:     mode,
+			Uid:      OS_UID,
+			Gid:      OS_GID,
+			TtlSec:   so.TtlSeconds,
+			Mime:     contentType,
+			Md5:      md5Hash.Sum(nil),
+			FileSize: uint64(chunkOffset),
+		},
+		Content: smallContent,
+		Chunks:  mergedChunks,
+	}
+	if err := fs.filer.CreateEntry(context.WithoutCancel(ctx), entry, nil, false, false, nil, false, so.MaxFileNameLength); err != nil {
+		fs.filer.DeleteUncommittedChunks(ctx, mergedChunks)
+		return nil, err
+	}
+	return &FilerPostResult{Name: fileName, Size: chunkOffset}, nil
+}
diff --git a/weed/server/filer_server_handlers_extract_test.go b/weed/server/filer_server_handlers_extract_test.go
new file mode 100644
index 0000000000..9461e79e5a
--- /dev/null
+++ b/weed/server/filer_server_handlers_extract_test.go
@@ -0,0 +1,274 @@
+package weed_server
+
+import (
+	"archive/zip"
+	"bytes"
+	"encoding/json"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func buildTestZip(t *testing.T, members map[string]string, dirs []string, unsafe []string) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	for _, dir := range dirs {
+		h := &zip.FileHeader{Name: dir, Method: zip.Store, Modified: time.Unix(1700000000, 0)}
+		h.SetMode(0755 | 1<<31)
+		if _, err := zw.CreateHeader(h); err != nil {
+			t.Fatalf("create dir %s: %v", dir, err)
+		}
+	}
+	write := func(name, content string) {
+		w, err := zw.Create(name)
+		if err != nil {
+			t.Fatalf("create %s: %v", name, err)
+		}
+		if _, err := w.Write([]byte(content)); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+	for name, content := range members {
+		write(name, content)
+	}
+	for _, name := range unsafe {
+		write(name, "evil")
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatalf("close zip: %v", err)
+	}
+	return buf.Bytes()
+}
+
+func newExtractTestServer(t *testing.T) (*FilerServer, *filer.Filer) {
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	return &FilerServer{
+		filer: f,
+		option: &FilerOption{
+			MaxMB:            1,
+			SaveToFilerLimit: 1 << 20,
+		},
+	}, f
+}
+
+func TestExtractZipArchivePut(t *testing.T) {
+	fs, f := newExtractTestServer(t)
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	dirHeader := &zip.FileHeader{Name: "empty/", Method: zip.Store, Modified: time.Unix(1700000000, 0)}
+	dirHeader.SetMode(0755 | 1<<31)
+	if _, err := zw.CreateHeader(dirHeader); err != nil {
+		t.Fatal(err)
+	}
+	fileHeader := &zip.FileHeader{Name: "a/b.txt", Modified: time.Unix(1600000000, 0)}
+	fileHeader.SetMode(0600)
+	fw, err := zw.CreateHeader(fileHeader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := fw.Write([]byte("hello")); err != nil {
+		t.Fatal(err)
+	}
+	pngW, err := zw.Create("c.png")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pngW.Write([]byte("\x89png")); err != nil {
+		t.Fatal(err)
+	}
+	evil, err := zw.Create("../evil.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := evil.Write([]byte("evil")); err != nil {
+		t.Fatal(err)
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	zipBytes := buf.Bytes()
+
+	r := httptest.NewRequest(http.MethodPut, "/dst/archive.zip?extract=zip", bytes.NewReader(zipBytes))
+	w := httptest.NewRecorder()
+	fs.PostHandler(w, r, int64(len(zipBytes)))
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201, body: %s", w.Code, w.Body.String())
+	}
+	var result FilerExtractResult
+	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
+		t.Fatalf("decode result: %v", err)
+	}
+	if len(result.Extracted) != 2 {
+		t.Fatalf("extracted %d members, want 2: %+v", len(result.Extracted), result)
+	}
+	if len(result.Errors) != 1 {
+		t.Fatalf("errors = %v, want 1 unsafe-name entry", result.Errors)
+	}
+
+	entry, err := f.FindEntry(r.Context(), util.FullPath("/dst/a/b.txt"))
+	if err != nil {
+		t.Fatalf("find extracted member: %v", err)
+	}
+	if string(entry.Content) != "hello" {
+		t.Fatalf("member content = %q", entry.Content)
+	}
+	if entry.Mtime.Unix() != 1600000000 {
+		t.Fatalf("member mtime = %v, want %v", entry.Mtime, time.Unix(1600000000, 0))
+	}
+	if entry.Mode.Perm() != 0600 {
+		t.Fatalf("member mode = %v, want 0600", entry.Mode.Perm())
+	}
+
+	dirEntry, err := f.FindEntry(r.Context(), util.FullPath("/dst/empty"))
+	if err != nil || !dirEntry.IsDirectory() {
+		t.Fatalf("dir member missing: %v %+v", err, dirEntry)
+	}
+	if dirEntry.Mtime.Unix() != 1700000000 {
+		t.Fatalf("dir mtime = %v, want %v", dirEntry.Mtime, time.Unix(1700000000, 0))
+	}
+	if _, err := f.FindEntry(r.Context(), util.FullPath("/dst/archive.zip")); err == nil {
+		t.Fatal("archive should not be stored without extract.keep")
+	}
+	if _, err := f.FindEntry(r.Context(), util.FullPath("/dst/../evil.txt")); err == nil {
+		t.Fatal("unsafe member should not be extracted")
+	}
+	if _, err := f.FindEntry(r.Context(), util.FullPath("/evil.txt")); err == nil {
+		t.Fatal("zip-slip member escaped the extraction root")
+	}
+}
+
+func TestExtractZipArchiveKeep(t *testing.T) {
+	fs, f := newExtractTestServer(t)
+	zipBytes := buildTestZip(t, map[string]string{"x.txt": "data"}, nil, nil)
+
+	r := httptest.NewRequest(http.MethodPut, "/dst/pack.zip?extract=zip&extract.keep=true", bytes.NewReader(zipBytes))
+	w := httptest.NewRecorder()
+	fs.PostHandler(w, r, int64(len(zipBytes)))
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("status = %d, body: %s", w.Code, w.Body.String())
+	}
+	archive, err := f.FindEntry(r.Context(), util.FullPath("/dst/pack.zip"))
+	if err != nil {
+		t.Fatalf("archive not stored with extract.keep: %v", err)
+	}
+	if int64(len(archive.Content)) != int64(len(zipBytes)) {
+		t.Fatalf("archive size = %d, want %d", len(archive.Content), len(zipBytes))
+	}
+	if _, err := f.FindEntry(r.Context(), util.FullPath("/dst/x.txt")); err != nil {
+		t.Fatalf("member missing: %v", err)
+	}
+}
+
+func TestExtractZipArchiveNotAZip(t *testing.T) {
+	fs, _ := newExtractTestServer(t)
+	r := httptest.NewRequest(http.MethodPut, "/dst/notzip.bin?extract=zip", bytes.NewReader([]byte("not a zip")))
+	w := httptest.NewRecorder()
+	fs.PostHandler(w, r, 9)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", w.Code)
+	}
+}
+
+// A member larger than chunkSize must not take the inline fast path when
+// SaveToFilerLimit exceeds chunkSize — the first chunk is not the whole member.
+func TestExtractZipArchiveMemberLargerThanChunk(t *testing.T) {
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	fs, _ := newInlineAppendUploadServer(t, f, 4<<20, 1) // inline limit exceeds the 1 MiB chunkSize
+	member := bytes.Repeat([]byte("z"), (1<<20)+1)
+	zipBytes := buildTestZip(t, map[string]string{"big.bin": string(member)}, nil, nil)
+
+	r := httptest.NewRequest(http.MethodPut, "/dst/pack.zip?extract=zip", bytes.NewReader(zipBytes))
+	w := httptest.NewRecorder()
+	fs.PostHandler(w, r, int64(len(zipBytes)))
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("status = %d, body: %s", w.Code, w.Body.String())
+	}
+	var result FilerExtractResult
+	if err := json.Unmarshal(w.Body.Bytes(), &result); err != nil {
+		t.Fatalf("decode result: %v", err)
+	}
+	if len(result.Errors) != 0 {
+		t.Fatalf("member errors: %v", result.Errors)
+	}
+	entry, err := f.FindEntry(r.Context(), util.FullPath("/dst/big.bin"))
+	if err != nil {
+		t.Fatalf("member missing: %v", err)
+	}
+	if int64(entry.Attr.FileSize) != int64(len(member)) {
+		t.Fatalf("member stored truncated: %d bytes, want %d", entry.Attr.FileSize, len(member))
+	}
+}
+
+func TestExtractZipArchiveRawPost(t *testing.T) {
+	fs, f := newExtractTestServer(t)
+	zipBytes := buildTestZip(t, map[string]string{"raw.txt": "raw"}, nil, nil)
+
+	r := httptest.NewRequest(http.MethodPost, "/dst/?extract=zip", bytes.NewReader(zipBytes))
+	r.Header.Set("Content-Type", "application/zip")
+	w := httptest.NewRecorder()
+	fs.PostHandler(w, r, int64(len(zipBytes)))
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("status = %d, body: %s", w.Code, w.Body.String())
+	}
+	entry, err := f.FindEntry(r.Context(), util.FullPath("/dst/raw.txt"))
+	if err != nil {
+		t.Fatalf("member missing: %v", err)
+	}
+	if string(entry.Content) != "raw" {
+		t.Fatalf("member content = %q", entry.Content)
+	}
+}
+
+func TestExtractZipArchiveMultipartPost(t *testing.T) {
+	fs, f := newExtractTestServer(t)
+	zipBytes := buildTestZip(t, map[string]string{"img/1.png": "png-bytes"}, nil, nil)
+
+	var body bytes.Buffer
+	mw := multipartWriter(t, &body, "bundle.zip", zipBytes)
+	r := httptest.NewRequest(http.MethodPost, "/assets/?extract=zip", &body)
+	r.Header.Set("Content-Type", mw)
+	w := httptest.NewRecorder()
+	fs.PostHandler(w, r, int64(body.Len()))
+
+	if w.Code != http.StatusCreated {
+		t.Fatalf("status = %d, body: %s", w.Code, w.Body.String())
+	}
+	entry, err := f.FindEntry(r.Context(), util.FullPath("/assets/img/1.png"))
+	if err != nil {
+		t.Fatalf("member missing: %v", err)
+	}
+	if string(entry.Content) != "png-bytes" {
+		t.Fatalf("member content = %q", entry.Content)
+	}
+	if _, err := f.FindEntry(r.Context(), util.FullPath("/assets/bundle.zip")); err == nil {
+		t.Fatal("archive should not be stored")
+	}
+}
+
+func multipartWriter(t *testing.T, buf *bytes.Buffer, fileName string, data []byte) string {
+	t.Helper()
+	mw := multipart.NewWriter(buf)
+	part, err := mw.CreateFormFile("file", fileName)
+	if err != nil {
+		t.Fatalf("create form file: %v", err)
+	}
+	if _, err := part.Write(data); err != nil {
+		t.Fatalf("write part: %v", err)
+	}
+	if err := mw.Close(); err != nil {
+		t.Fatalf("close multipart: %v", err)
+	}
+	return mw.FormDataContentType()
+}
diff --git a/weed/server/filer_server_handlers_iam_grpc.go b/weed/server/filer_server_handlers_iam_grpc.go
index 175ce9ade0..be98356614 100644
--- a/weed/server/filer_server_handlers_iam_grpc.go
+++ b/weed/server/filer_server_handlers_iam_grpc.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
 	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
 	"github.com/seaweedfs/seaweedfs/weed/security"
@@ -25,6 +26,8 @@ type IamGrpcServer struct {
 	iam_pb.UnimplementedSeaweedIdentityAccessManagementServer
 	credentialManager *credential.CredentialManager
 	adminSigningKey   security.SigningKey
+	oidcProviderStore integration.OIDCProviderStore
+	roleStore         integration.RoleStore
 }
 
 // NewIamGrpcServer creates a new IAM gRPC server. If adminSigningKey is empty
@@ -65,6 +68,9 @@ func (s *IamGrpcServer) checkAdminAuth(ctx context.Context) error {
 	if err != nil || parsed == nil || !parsed.Valid {
 		return status.Error(codes.Unauthenticated, "invalid admin token")
 	}
+	if claims, ok := parsed.Claims.(*security.SeaweedFilerAdminClaims); !ok || claims.SessionId != "" {
+		return status.Error(codes.Unauthenticated, "invalid admin token")
+	}
 	return nil
 }
 
@@ -476,6 +482,18 @@ func (s *IamGrpcServer) DeletePolicy(ctx context.Context, req *iam_pb.DeletePoli
 		return nil, status.Errorf(codes.FailedPrecondition, "credential manager is not configured")
 	}
 
+	// Roles attach policies by name; deleting one still attached would let a
+	// policy created later under that name take effect on the role.
+	if s.roleStore != nil {
+		roles, err := integration.RolesAttachingPolicy(ctx, s.roleStore, req.Name)
+		if err != nil {
+			return nil, status.Errorf(codes.Unavailable, "check role attachments: %v", err)
+		}
+		if len(roles) > 0 {
+			return nil, status.Errorf(codes.FailedPrecondition, "policy %s is attached to role %s", req.Name, roles[0])
+		}
+	}
+
 	err := s.credentialManager.DeletePolicy(ctx, req.Name)
 	if err != nil {
 		glog.Errorf("Failed to delete policy %s: %v", req.Name, err)
diff --git a/weed/server/filer_server_handlers_iam_grpc_sts.go b/weed/server/filer_server_handlers_iam_grpc_sts.go
new file mode 100644
index 0000000000..fff0a0874c
--- /dev/null
+++ b/weed/server/filer_server_handlers_iam_grpc_sts.go
@@ -0,0 +1,457 @@
+package weed_server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/iam/utils"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// SetSTSStores gives the IAM service the stores that S3 servers read when they
+// run with a filer-typed "oidcProviderStore" and "roleStore". Records written
+// here are the ones their STS trusts; the S3 servers pick up changes through
+// their /etc/iam metadata subscription. Without the stores, the OIDC provider
+// and role RPCs return FailedPrecondition.
+func (s *IamGrpcServer) SetSTSStores(oidcProviders integration.OIDCProviderStore, roles integration.RoleStore) {
+	s.oidcProviderStore = oidcProviders
+	s.roleStore = roles
+}
+
+// errSTSRequiresAuth refuses the OIDC provider and role RPCs on a filer whose
+// IAM service runs unauthenticated. Unlike users and policies, which keep the
+// service's opt-in auth, these grant STS access outright: with them, anyone
+// who can reach the port could register an issuer they control, create a role
+// trusting it, and exchange a token for S3 credentials.
+var errSTSRequiresAuth = status.Error(codes.FailedPrecondition,
+	"OIDC provider and role management requires admin authentication: set jwt.filer_signing.key in security.toml")
+
+func (s *IamGrpcServer) requireOIDCProviderStore() (integration.OIDCProviderStore, error) {
+	if len(s.adminSigningKey) == 0 {
+		return nil, errSTSRequiresAuth
+	}
+	if s.oidcProviderStore == nil {
+		return nil, status.Error(codes.FailedPrecondition, "OIDC provider store not configured on this filer")
+	}
+	return s.oidcProviderStore, nil
+}
+
+func (s *IamGrpcServer) requireRoleStore() (integration.RoleStore, error) {
+	if len(s.adminSigningKey) == 0 {
+		return nil, errSTSRequiresAuth
+	}
+	if s.roleStore == nil {
+		return nil, status.Error(codes.FailedPrecondition, "role store not configured on this filer")
+	}
+	return s.roleStore, nil
+}
+
+func toPbOIDCProvider(rec *integration.OIDCProviderRecord) *iam_pb.OIDCProvider {
+	return &iam_pb.OIDCProvider{
+		IssuerUrl:   rec.URL,
+		ClientIds:   rec.ClientIDs,
+		Thumbprints: rec.Thumbprints,
+		AccountId:   rec.AccountID,
+		Arn:         rec.ARN,
+	}
+}
+
+// lookupOIDCProvider returns the stored record, nil when there is none, or an
+// error when the store could not be read.
+func lookupOIDCProvider(ctx context.Context, store integration.OIDCProviderStore, arn string) (*integration.OIDCProviderRecord, error) {
+	rec, err := store.GetProviderByARN(ctx, "", arn)
+	if errors.Is(err, integration.ErrOIDCProviderNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "read OIDC provider %s: %v", arn, err)
+	}
+	return rec, nil
+}
+
+func (s *IamGrpcServer) PutOIDCProvider(ctx context.Context, req *iam_pb.PutOIDCProviderRequest) (*iam_pb.PutOIDCProviderResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireOIDCProviderStore()
+	if err != nil {
+		return nil, err
+	}
+	if err := requireSecureIssuer(req.IssuerUrl); err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+	rec, err := integration.PrepareOIDCProviderRecord(req.AccountId, req.IssuerUrl, req.ClientIds, req.Thumbprints)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+	// Put replaces what the request carries and keeps what it cannot. The
+	// store's atomic update decides which against the record as it is when
+	// written, so a delete racing the put is not merged back from a stale read.
+	err = store.UpdateProvider(ctx, "", rec.ARN, func(existing *integration.OIDCProviderRecord) (*integration.OIDCProviderRecord, error) {
+		next := *rec
+		next.ClientIDs = append([]string(nil), rec.ClientIDs...)
+		next.Thumbprints = append([]string(nil), rec.Thumbprints...)
+		now := time.Now().UTC()
+		next.CreatedAt, next.UpdatedAt = now, now
+		if existing != nil {
+			next.CreatedAt = existing.CreatedAt
+			next.Tags = existing.Tags
+			next.AllowedPrincipalTagKeys = existing.AllowedPrincipalTagKeys
+			next.PolicyClaim = existing.PolicyClaim
+		}
+		return &next, nil
+	})
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "store OIDC provider: %v", err)
+	}
+	return &iam_pb.PutOIDCProviderResponse{Arn: rec.ARN}, nil
+}
+
+// requireSecureIssuer refuses an issuer served over plain HTTP, as AWS does:
+// STS fetches the issuer's signing keys from it, so over HTTP anyone on the
+// network path could substitute their own and mint tokens STS accepts. A
+// loopback issuer is allowed for local testing.
+func requireSecureIssuer(issuerURL string) error {
+	u, err := url.Parse(issuerURL)
+	if err != nil {
+		return fmt.Errorf("invalid issuer URL: %w", err)
+	}
+	// STS matches a token's iss claim against the stored URL exactly, and the
+	// provider's ARN is derived from host and path alone: an issuer with
+	// userinfo, a query or a fragment would share its ARN with the bare
+	// issuer and match no token.
+	if u.User != nil || u.RawQuery != "" || u.ForceQuery || u.Fragment != "" {
+		return fmt.Errorf("issuer URL must not contain userinfo, a query or a fragment: %s", issuerURL)
+	}
+	switch u.Scheme {
+	case "https":
+		return nil
+	case "http":
+		host := u.Hostname()
+		if strings.EqualFold(host, "localhost") {
+			return nil
+		}
+		if ip := net.ParseIP(host); ip != nil && ip.IsLoopback() {
+			return nil
+		}
+		return fmt.Errorf("issuer URL must use https (http is allowed only for a loopback host): %s", issuerURL)
+	default:
+		return fmt.Errorf("issuer URL must use https: %s", issuerURL)
+	}
+}
+
+func (s *IamGrpcServer) GetOIDCProvider(ctx context.Context, req *iam_pb.GetOIDCProviderRequest) (*iam_pb.GetOIDCProviderResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireOIDCProviderStore()
+	if err != nil {
+		return nil, err
+	}
+	arn, err := integration.DeriveOIDCProviderARN(req.AccountId, req.IssuerUrl)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+	rec, err := lookupOIDCProvider(ctx, store, arn)
+	if err != nil {
+		return nil, err
+	}
+	if rec == nil {
+		return nil, status.Errorf(codes.NotFound, "OIDC provider %s not found", arn)
+	}
+	return &iam_pb.GetOIDCProviderResponse{Provider: toPbOIDCProvider(rec)}, nil
+}
+
+// DeleteOIDCProvider returns NotFound for a provider that does not exist, as
+// DeleteUser does for a user; callers treat that as already deleted.
+func (s *IamGrpcServer) DeleteOIDCProvider(ctx context.Context, req *iam_pb.DeleteOIDCProviderRequest) (*iam_pb.DeleteOIDCProviderResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireOIDCProviderStore()
+	if err != nil {
+		return nil, err
+	}
+	arn, err := integration.DeriveOIDCProviderARN(req.AccountId, req.IssuerUrl)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+	// Delete the provider as this request first saw it. The store's delete is
+	// conditional (OIDCProviderStore.UpdateProvider), and a retry that finds
+	// the record replaced by a PutOIDCProvider in between refuses rather than
+	// delete the newer record: the caller decides again against it.
+	var seen []byte
+	err = store.UpdateProvider(ctx, "", arn, func(existing *integration.OIDCProviderRecord) (*integration.OIDCProviderRecord, error) {
+		if existing == nil {
+			return nil, integration.ErrOIDCProviderNotFound
+		}
+		current, err := json.Marshal(existing)
+		if err != nil {
+			return nil, err
+		}
+		if seen == nil {
+			seen = current
+		} else if !bytes.Equal(seen, current) {
+			return nil, errProviderReplacedDuringDelete
+		}
+		return nil, nil
+	})
+	if errors.Is(err, integration.ErrOIDCProviderNotFound) {
+		return nil, status.Errorf(codes.NotFound, "OIDC provider %s not found", arn)
+	}
+	if errors.Is(err, errProviderReplacedDuringDelete) {
+		return nil, status.Errorf(codes.Aborted, "OIDC provider %s changed while it was being deleted; retry", arn)
+	}
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "delete OIDC provider: %v", err)
+	}
+	return &iam_pb.DeleteOIDCProviderResponse{}, nil
+}
+
+func (s *IamGrpcServer) ListOIDCProviders(ctx context.Context, req *iam_pb.ListOIDCProvidersRequest) (*iam_pb.ListOIDCProvidersResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireOIDCProviderStore()
+	if err != nil {
+		return nil, err
+	}
+	records, err := store.ListProviders(ctx, "")
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "list OIDC providers: %v", err)
+	}
+	resp := &iam_pb.ListOIDCProvidersResponse{}
+	for _, rec := range records {
+		resp.Providers = append(resp.Providers, toPbOIDCProvider(rec))
+	}
+	return resp, nil
+}
+
+func toPbRole(role *integration.RoleDefinition) (*iam_pb.Role, error) {
+	out := &iam_pb.Role{
+		RoleName:           role.RoleName,
+		RoleArn:            role.RoleArn,
+		AttachedPolicies:   role.AttachedPolicies,
+		Description:        role.Description,
+		MaxSessionDuration: role.MaxSessionDuration,
+	}
+	if role.TrustPolicy != nil {
+		doc, err := json.Marshal(role.TrustPolicy)
+		if err != nil {
+			return nil, status.Errorf(codes.Internal, "encode trust policy of role %s: %v", role.RoleName, err)
+		}
+		out.TrustPolicy = string(doc)
+	}
+	return out, nil
+}
+
+// lookupRole returns the stored role, nil when there is none, or an error when
+// the store could not be read.
+func lookupRole(ctx context.Context, store integration.RoleStore, name string) (*integration.RoleDefinition, error) {
+	role, err := store.GetRole(ctx, "", name)
+	if errors.Is(err, integration.ErrRoleNotFound) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "read role %s: %v", name, err)
+	}
+	return role, nil
+}
+
+// PutRole creates or replaces a role in the filer's role store. A stored role
+// takes precedence over a same-named role in an S3 server's IAM config file;
+// deleting the stored one restores the config-file role.
+func (s *IamGrpcServer) PutRole(ctx context.Context, req *iam_pb.PutRoleRequest) (*iam_pb.PutRoleResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireRoleStore()
+	if err != nil {
+		return nil, err
+	}
+	in := req.GetRole()
+	if in == nil || in.RoleName == "" {
+		return nil, status.Error(codes.InvalidArgument, "role.role_name is required")
+	}
+	if err := integration.ValidateRoleName(in.RoleName); err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+	if len(in.AttachedPolicies) > integration.MaxManagedPoliciesPerRole {
+		return nil, status.Errorf(codes.InvalidArgument, "at most %d managed policies may be attached to a role", integration.MaxManagedPoliciesPerRole)
+	}
+	if in.TrustPolicy == "" {
+		return nil, status.Error(codes.InvalidArgument, "role.trust_policy is required")
+	}
+	var trust policy.PolicyDocument
+	if err := json.Unmarshal([]byte(in.TrustPolicy), &trust); err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "parse trust policy: %v", err)
+	}
+	// STS finds a role by the name in the ARN a caller presents, so a stored
+	// ARN naming another role would be honoured for neither name correctly.
+	if in.RoleArn != "" && utils.ExtractRoleNameFromArn(in.RoleArn) != in.RoleName {
+		return nil, status.Errorf(codes.InvalidArgument, "role.role_arn %s does not name role %s", in.RoleArn, in.RoleName)
+	}
+	role := &integration.RoleDefinition{
+		RoleName:           in.RoleName,
+		RoleArn:            in.RoleArn,
+		TrustPolicy:        &trust,
+		AttachedPolicies:   in.AttachedPolicies,
+		Description:        in.Description,
+		MaxSessionDuration: in.MaxSessionDuration,
+	}
+	if err := integration.PrepareRoleDefinition(in.RoleName, role); err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+	if len(role.AttachedPolicies) > 0 && s.credentialManager == nil {
+		return nil, status.Errorf(codes.FailedPrecondition, "credential manager is not configured")
+	}
+	for _, name := range role.AttachedPolicies {
+		existing, err := s.credentialManager.GetPolicy(ctx, name)
+		if err != nil {
+			return nil, status.Errorf(codes.Unavailable, "read policy %s: %v", name, err)
+		}
+		if existing == nil {
+			return nil, status.Errorf(codes.NotFound, "attached policy %s not found", name)
+		}
+	}
+	// A replaced role keeps its ID, so its sessions stay valid; a role created
+	// anew — including after a delete — gets a new one, so sessions of an
+	// earlier role of the same name do not carry over. The store's atomic
+	// update decides which, against the role as it is when written: a Put
+	// racing a DeleteRole cannot write the deleted role back with its old ID.
+	err = store.UpdateRole(ctx, "", in.RoleName, func(existing *integration.RoleDefinition) (*integration.RoleDefinition, error) {
+		next := *role
+		next.CreatedAt = time.Now().UTC()
+		next.RoleId = integration.NewRoleID()
+		if existing != nil {
+			next.CreatedAt = existing.CreatedAt
+			if existing.RoleId != "" {
+				next.RoleId = existing.RoleId
+			}
+		}
+		return &next, nil
+	})
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "store role: %v", err)
+	}
+	return &iam_pb.PutRoleResponse{RoleArn: role.RoleArn}, nil
+}
+
+func (s *IamGrpcServer) GetRole(ctx context.Context, req *iam_pb.GetRoleRequest) (*iam_pb.GetRoleResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireRoleStore()
+	if err != nil {
+		return nil, err
+	}
+	if req.RoleName == "" {
+		return nil, status.Error(codes.InvalidArgument, "role_name is required")
+	}
+	role, err := lookupRole(ctx, store, req.RoleName)
+	if err != nil {
+		return nil, err
+	}
+	if role == nil {
+		return nil, status.Errorf(codes.NotFound, "role %s not found", req.RoleName)
+	}
+	out, err := toPbRole(role)
+	if err != nil {
+		return nil, err
+	}
+	return &iam_pb.GetRoleResponse{Role: out}, nil
+}
+
+// DeleteRole returns NotFound for a role that does not exist, like
+// DeleteOIDCProvider. Unlike the IAM API's DeleteRole it does not require the
+// policies to be detached first: this API is declarative, and the role and its
+// attachments are one object here.
+// errRoleReplacedDuringDelete aborts a DeleteRole whose role was replaced
+// between the request's read and its delete. errProviderReplacedDuringDelete
+// is the same for a DeleteOIDCProvider.
+var errRoleReplacedDuringDelete = errors.New("role replaced during delete")
+var errProviderReplacedDuringDelete = errors.New("OIDC provider replaced during delete")
+
+func (s *IamGrpcServer) DeleteRole(ctx context.Context, req *iam_pb.DeleteRoleRequest) (*iam_pb.DeleteRoleResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireRoleStore()
+	if err != nil {
+		return nil, err
+	}
+	if req.RoleName == "" {
+		return nil, status.Error(codes.InvalidArgument, "role_name is required")
+	}
+	// Delete the role as this request first saw it. The store's delete is
+	// conditional (RoleStore.UpdateRole), and a retry that finds the role
+	// replaced by a PutRole in between refuses rather than delete the newer
+	// definition: the caller decides again against it.
+	var seen []byte
+	err = store.UpdateRole(ctx, "", req.RoleName, func(existing *integration.RoleDefinition) (*integration.RoleDefinition, error) {
+		if existing == nil {
+			return nil, integration.ErrRoleNotFound
+		}
+		current, err := json.Marshal(existing)
+		if err != nil {
+			return nil, err
+		}
+		if seen == nil {
+			seen = current
+		} else if !bytes.Equal(seen, current) {
+			return nil, errRoleReplacedDuringDelete
+		}
+		return nil, nil
+	})
+	if errors.Is(err, integration.ErrRoleNotFound) {
+		return nil, status.Errorf(codes.NotFound, "role %s not found", req.RoleName)
+	}
+	if errors.Is(err, errRoleReplacedDuringDelete) {
+		return nil, status.Errorf(codes.Aborted, "role %s was replaced while it was being deleted; retry", req.RoleName)
+	}
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "delete role: %v", err)
+	}
+	return &iam_pb.DeleteRoleResponse{}, nil
+}
+
+func (s *IamGrpcServer) ListRoles(ctx context.Context, req *iam_pb.ListRolesRequest) (*iam_pb.ListRolesResponse, error) {
+	if err := s.checkAdminAuth(ctx); err != nil {
+		return nil, err
+	}
+	store, err := s.requireRoleStore()
+	if err != nil {
+		return nil, err
+	}
+	names, err := store.ListRoles(ctx, "")
+	if err != nil {
+		return nil, status.Errorf(codes.Unavailable, "list roles: %v", err)
+	}
+	resp := &iam_pb.ListRolesResponse{}
+	for _, name := range names {
+		role, err := lookupRole(ctx, store, name)
+		if err != nil {
+			return nil, err
+		}
+		if role == nil {
+			continue // deleted between list and read
+		}
+		out, err := toPbRole(role)
+		if err != nil {
+			return nil, err
+		}
+		resp.Roles = append(resp.Roles, out)
+	}
+	return resp, nil
+}
diff --git a/weed/server/filer_server_handlers_iam_grpc_sts_test.go b/weed/server/filer_server_handlers_iam_grpc_sts_test.go
new file mode 100644
index 0000000000..c45865be71
--- /dev/null
+++ b/weed/server/filer_server_handlers_iam_grpc_sts_test.go
@@ -0,0 +1,499 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const stsTestTrust = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow",` +
+	`"Principal":{"Federated":"https://oidc.example"},"Action":["sts:AssumeRoleWithWebIdentity"],` +
+	`"Condition":{"StringEquals":{"oidc:sub":"spiffe://example.org/ns/app/sa/app"}}}]}`
+
+func newSTSTestServer(t *testing.T) (*IamGrpcServer, context.Context, *integration.MemoryOIDCProviderStore, *integration.MemoryRoleStore) {
+	t.Helper()
+	s := newTestIamGrpcServer(t)
+	providers, roles := integration.NewMemoryOIDCProviderStore(), integration.NewMemoryRoleStore()
+	s.SetSTSStores(providers, roles)
+	doc := policy_engine.PolicyDocument{Version: "2012-10-17", Statement: []policy_engine.PolicyStatement{{
+		Effect:   policy_engine.PolicyEffectAllow,
+		Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+		Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::bucket/*"),
+	}}}
+	require.NoError(t, s.credentialManager.CreatePolicy(context.Background(), "read-bucket", doc))
+	ctx := ctxWithBearer(string(security.GenJwtForFilerAdmin(security.SigningKey(testIamSigningKey), 60)))
+	return s, ctx, providers, roles
+}
+
+func requireCode(t *testing.T, err error, code codes.Code) {
+	t.Helper()
+	require.Error(t, err, "expected %s", code)
+	assert.Equal(t, code, status.Code(err), "error: %v", err)
+}
+
+func TestIamGrpc_OIDCProviderPutGetListDelete(t *testing.T) {
+	s, ctx, _, _ := newSTSTestServer(t)
+	put, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{
+		IssuerUrl: "https://oidc.example", ClientIds: []string{"aud"}, AccountId: "111122223333",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "arn:aws:iam::111122223333:oidc-provider/oidc.example", put.Arn)
+
+	got, err := s.GetOIDCProvider(ctx, &iam_pb.GetOIDCProviderRequest{IssuerUrl: "https://oidc.example", AccountId: "111122223333"})
+	require.NoError(t, err)
+	assert.Equal(t, []string{"aud"}, got.Provider.ClientIds)
+
+	list, err := s.ListOIDCProviders(ctx, &iam_pb.ListOIDCProvidersRequest{})
+	require.NoError(t, err)
+	require.Len(t, list.Providers, 1)
+
+	_, err = s.DeleteOIDCProvider(ctx, &iam_pb.DeleteOIDCProviderRequest{IssuerUrl: "https://oidc.example", AccountId: "111122223333"})
+	require.NoError(t, err)
+	_, err = s.GetOIDCProvider(ctx, &iam_pb.GetOIDCProviderRequest{IssuerUrl: "https://oidc.example", AccountId: "111122223333"})
+	requireCode(t, err, codes.NotFound)
+	_, err = s.DeleteOIDCProvider(ctx, &iam_pb.DeleteOIDCProviderRequest{IssuerUrl: "https://oidc.example", AccountId: "111122223333"})
+	requireCode(t, err, codes.NotFound)
+}
+
+// Put replaces what the request carries and keeps what it cannot express.
+func TestIamGrpc_PutOIDCProviderKeepsWhatTheRequestCannotCarry(t *testing.T) {
+	s, ctx, providers, _ := newSTSTestServer(t)
+	created := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+	arn, err := integration.DeriveOIDCProviderARN("", "https://oidc.example")
+	require.NoError(t, err)
+	require.NoError(t, providers.StoreProvider(context.Background(), "", &integration.OIDCProviderRecord{
+		ARN: arn, URL: "https://oidc.example", ClientIDs: []string{"old"},
+		Tags: map[string]string{"team": "infra"}, PolicyClaim: "policy", CreatedAt: created,
+	}))
+
+	_, err = s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{IssuerUrl: "https://oidc.example", ClientIds: []string{"new"}})
+	require.NoError(t, err)
+	rec, err := providers.GetProviderByARN(context.Background(), "", arn)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"new"}, rec.ClientIDs)
+	assert.Equal(t, map[string]string{"team": "infra"}, rec.Tags)
+	assert.Equal(t, "policy", rec.PolicyClaim)
+	assert.True(t, rec.CreatedAt.Equal(created))
+}
+
+func TestIamGrpc_RolePutGetListDelete(t *testing.T) {
+	s, ctx, _, roles := newSTSTestServer(t)
+	put, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{
+		RoleName: "app", TrustPolicy: stsTestTrust, AttachedPolicies: []string{"read-bucket"}, MaxSessionDuration: 3600,
+	}})
+	require.NoError(t, err)
+	assert.Equal(t, "arn:aws:iam::role/app", put.RoleArn)
+
+	stored, err := roles.GetRole(context.Background(), "", "app")
+	require.NoError(t, err)
+	assert.Equal(t, []string{"read-bucket"}, stored.AttachedPolicies)
+	assert.False(t, stored.CreatedAt.IsZero())
+
+	got, err := s.GetRole(ctx, &iam_pb.GetRoleRequest{RoleName: "app"})
+	require.NoError(t, err)
+	assert.Contains(t, got.Role.TrustPolicy, "spiffe://example.org/ns/app/sa/app")
+
+	// Replacing keeps CreatedAt.
+	_, err = s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust}})
+	require.NoError(t, err)
+	replaced, err := roles.GetRole(context.Background(), "", "app")
+	require.NoError(t, err)
+	assert.True(t, replaced.CreatedAt.Equal(stored.CreatedAt))
+	assert.Empty(t, replaced.AttachedPolicies)
+	assert.NotEmpty(t, stored.RoleId, "a created role has an ID")
+	assert.Equal(t, stored.RoleId, replaced.RoleId, "replacing a role changed its ID")
+
+	list, err := s.ListRoles(ctx, &iam_pb.ListRolesRequest{})
+	require.NoError(t, err)
+	require.Len(t, list.Roles, 1)
+
+	_, err = s.DeleteRole(ctx, &iam_pb.DeleteRoleRequest{RoleName: "app"})
+	require.NoError(t, err)
+	_, err = s.GetRole(ctx, &iam_pb.GetRoleRequest{RoleName: "app"})
+	requireCode(t, err, codes.NotFound)
+	_, err = s.DeleteRole(ctx, &iam_pb.DeleteRoleRequest{RoleName: "app"})
+	requireCode(t, err, codes.NotFound)
+
+	_, err = s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust}})
+	require.NoError(t, err)
+	recreated, err := roles.GetRole(context.Background(), "", "app")
+	require.NoError(t, err)
+	assert.NotEqual(t, stored.RoleId, recreated.RoleId, "a role created again under a deleted role's name reuses its ID")
+}
+
+func TestIamGrpc_STSRefusals(t *testing.T) {
+	s, ctx, _, _ := newSTSTestServer(t)
+	cases := []struct {
+		name string
+		call func() error
+		code codes.Code
+	}{
+		{"provider without client IDs", func() error {
+			_, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{IssuerUrl: "https://oidc.example"})
+			return err
+		}, codes.InvalidArgument},
+		{"provider with bad thumbprint", func() error {
+			_, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{IssuerUrl: "https://oidc.example", ClientIds: []string{"a"}, Thumbprints: []string{"nope"}})
+			return err
+		}, codes.InvalidArgument},
+		{"role without trust policy", func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app"}})
+			return err
+		}, codes.InvalidArgument},
+		{"role with malformed trust policy", func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: "{"}})
+			return err
+		}, codes.InvalidArgument},
+		{"role with session out of bounds", func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust, MaxSessionDuration: 60}})
+			return err
+		}, codes.InvalidArgument},
+		{"role name leaving the role store", func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "../identities/admin", TrustPolicy: stsTestTrust}})
+			return err
+		}, codes.InvalidArgument},
+		{"role over the policy quota", func() error {
+			policies := make([]string, integration.MaxManagedPoliciesPerRole+1)
+			for i := range policies {
+				policies[i] = "read-bucket"
+			}
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust, AttachedPolicies: policies}})
+			return err
+		}, codes.InvalidArgument},
+		{"role whose ARN names another role", func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", RoleArn: "arn:aws:iam::role/admin", TrustPolicy: stsTestTrust}})
+			return err
+		}, codes.InvalidArgument},
+		{"role whose ARN is not a role ARN", func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", RoleArn: "arn:aws:iam::user/app", TrustPolicy: stsTestTrust}})
+			return err
+		}, codes.InvalidArgument},
+		{"role attaching a missing policy", func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust, AttachedPolicies: []string{"nope"}}})
+			return err
+		}, codes.NotFound},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) { requireCode(t, tc.call(), tc.code) })
+	}
+}
+
+type unreadableProviders struct {
+	*integration.MemoryOIDCProviderStore
+}
+
+func (unreadableProviders) GetProviderByARN(context.Context, string, string) (*integration.OIDCProviderRecord, error) {
+	return nil, errors.New("lookup OIDC provider: filer unavailable")
+}
+
+// UpdateProvider reads the record first, as the filer store's does.
+func (unreadableProviders) UpdateProvider(context.Context, string, string, integration.OIDCProviderUpdate) error {
+	return errors.New("lookup OIDC provider: filer unavailable")
+}
+
+type unreadableRoles struct{ *integration.MemoryRoleStore }
+
+func (unreadableRoles) GetRole(context.Context, string, string) (*integration.RoleDefinition, error) {
+	return nil, errors.New("lookup role: filer unavailable")
+}
+
+// UpdateRole reads the role first, as the filer store's does.
+func (unreadableRoles) UpdateRole(context.Context, string, string, integration.RoleUpdate) error {
+	return errors.New("lookup role: filer unavailable")
+}
+
+// An unreadable store is not an absent entry: Put must not write over what it
+// could not see (a config-file entry included), and Delete must not report
+// success.
+func TestIamGrpc_UnreadableStoreIsUnavailableNotAbsent(t *testing.T) {
+	s, ctx, _, _ := newSTSTestServer(t)
+	providers, roles := unreadableProviders{integration.NewMemoryOIDCProviderStore()}, unreadableRoles{integration.NewMemoryRoleStore()}
+	s.SetSTSStores(providers, roles)
+
+	_, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{IssuerUrl: "https://oidc.example", ClientIds: []string{"aud"}})
+	requireCode(t, err, codes.Unavailable)
+	_, err = s.DeleteOIDCProvider(ctx, &iam_pb.DeleteOIDCProviderRequest{IssuerUrl: "https://oidc.example"})
+	requireCode(t, err, codes.Unavailable)
+	_, err = s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust}})
+	requireCode(t, err, codes.Unavailable)
+	_, err = s.DeleteRole(ctx, &iam_pb.DeleteRoleRequest{RoleName: "app"})
+	requireCode(t, err, codes.Unavailable)
+
+	recs, err := providers.ListProviders(context.Background(), "")
+	require.NoError(t, err)
+	assert.Empty(t, recs, "PutOIDCProvider wrote through a store it could not read")
+	names, err := roles.ListRoles(context.Background(), "")
+	require.NoError(t, err)
+	assert.Empty(t, names, "PutRole wrote through a store it could not read")
+}
+
+func TestIamGrpc_STSRPCsWithoutStoresAreFailedPrecondition(t *testing.T) {
+	s := newTestIamGrpcServer(t)
+	ctx := ctxWithBearer(string(security.GenJwtForFilerAdmin(security.SigningKey(testIamSigningKey), 60)))
+	_, err := s.ListOIDCProviders(ctx, &iam_pb.ListOIDCProvidersRequest{})
+	requireCode(t, err, codes.FailedPrecondition)
+	_, err = s.ListRoles(ctx, &iam_pb.ListRolesRequest{})
+	requireCode(t, err, codes.FailedPrecondition)
+}
+
+func TestIamGrpc_STSRPCsRequireAuth(t *testing.T) {
+	s, _, _, _ := newSTSTestServer(t)
+	ctx := context.Background()
+	calls := map[string]func() error{
+		"PutOIDCProvider": func() error { _, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{}); return err },
+		"GetOIDCProvider": func() error { _, err := s.GetOIDCProvider(ctx, &iam_pb.GetOIDCProviderRequest{}); return err },
+		"DeleteOIDCProvider": func() error {
+			_, err := s.DeleteOIDCProvider(ctx, &iam_pb.DeleteOIDCProviderRequest{})
+			return err
+		},
+		"ListOIDCProviders": func() error { _, err := s.ListOIDCProviders(ctx, &iam_pb.ListOIDCProvidersRequest{}); return err },
+		"PutRole":           func() error { _, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{}); return err },
+		"GetRole":           func() error { _, err := s.GetRole(ctx, &iam_pb.GetRoleRequest{}); return err },
+		"DeleteRole":        func() error { _, err := s.DeleteRole(ctx, &iam_pb.DeleteRoleRequest{}); return err },
+		"ListRoles":         func() error { _, err := s.ListRoles(ctx, &iam_pb.ListRolesRequest{}); return err },
+	}
+	for name, call := range calls {
+		t.Run(name, func(t *testing.T) { requireCode(t, call(), codes.Unauthenticated) })
+	}
+}
+
+func TestIamGrpc_DeletePolicyAttachedToARoleIsRefused(t *testing.T) {
+	s, ctx, _, _ := newSTSTestServer(t)
+	_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{
+		RoleName: "app", TrustPolicy: stsTestTrust, AttachedPolicies: []string{"read-bucket"},
+	}})
+	require.NoError(t, err)
+
+	_, err = s.DeletePolicy(ctx, &iam_pb.DeletePolicyRequest{Name: "read-bucket"})
+	requireCode(t, err, codes.FailedPrecondition)
+
+	_, err = s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust}})
+	require.NoError(t, err)
+	_, err = s.DeletePolicy(ctx, &iam_pb.DeletePolicyRequest{Name: "read-bucket"})
+	assert.NoError(t, err, "a policy no role attaches could not be deleted")
+}
+
+func TestIamGrpc_PutOIDCProviderRequiresHTTPSExceptOnLoopback(t *testing.T) {
+	s, ctx, _, _ := newSTSTestServer(t)
+	for issuer, ok := range map[string]bool{
+		"https://oidc.example":              true,
+		"http://localhost:8080":             true,
+		"http://127.0.0.1:18999":            true,
+		"http://[::1]:8080":                 true,
+		"http://oidc.example":               false,
+		"http://10.0.0.5":                   false,
+		"ftp://oidc.example":                false,
+		"http://localhost.attacker.example": false,
+		"http://LOCALHOST:8080":             true,
+		"https://oidc.example?x=1":          false,
+		"https://oidc.example?":             false,
+		"https://oidc.example#frag":         false,
+		"https://user@oidc.example":         false,
+	} {
+		_, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{IssuerUrl: issuer, ClientIds: []string{"aud"}})
+		if ok {
+			assert.NoError(t, err, issuer)
+		} else {
+			requireCode(t, err, codes.InvalidArgument)
+		}
+	}
+}
+
+// Without an admin signing key the IAM service accepts any caller. Users and
+// policies keep that opt-in behaviour, but the OIDC provider and role RPCs
+// grant STS access outright, so they refuse to run unauthenticated.
+func TestIamGrpc_STSRPCsRefuseAnUnauthenticatedService(t *testing.T) {
+	cm, err := credential.NewCredentialManager(credential.StoreTypeMemory, nil, "")
+	require.NoError(t, err)
+	s := NewIamGrpcServer(cm, nil)
+	s.SetSTSStores(integration.NewMemoryOIDCProviderStore(), integration.NewMemoryRoleStore())
+	ctx := context.Background()
+	calls := map[string]func() error{
+		"PutOIDCProvider": func() error {
+			_, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{IssuerUrl: "https://oidc.example", ClientIds: []string{"aud"}})
+			return err
+		},
+		"GetOIDCProvider": func() error {
+			_, err := s.GetOIDCProvider(ctx, &iam_pb.GetOIDCProviderRequest{IssuerUrl: "https://oidc.example"})
+			return err
+		},
+		"DeleteOIDCProvider": func() error {
+			_, err := s.DeleteOIDCProvider(ctx, &iam_pb.DeleteOIDCProviderRequest{IssuerUrl: "https://oidc.example"})
+			return err
+		},
+		"ListOIDCProviders": func() error { _, err := s.ListOIDCProviders(ctx, &iam_pb.ListOIDCProvidersRequest{}); return err },
+		"PutRole": func() error {
+			_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust}})
+			return err
+		},
+		"GetRole":    func() error { _, err := s.GetRole(ctx, &iam_pb.GetRoleRequest{RoleName: "app"}); return err },
+		"DeleteRole": func() error { _, err := s.DeleteRole(ctx, &iam_pb.DeleteRoleRequest{RoleName: "app"}); return err },
+		"ListRoles":  func() error { _, err := s.ListRoles(ctx, &iam_pb.ListRolesRequest{}); return err },
+	}
+	for name, call := range calls {
+		t.Run(name, func(t *testing.T) { requireCode(t, call(), codes.FailedPrecondition) })
+	}
+
+	// Users keep the service's opt-in auth.
+	_, err = s.ListUsers(ctx, &iam_pb.ListUsersRequest{})
+	assert.NoError(t, err)
+}
+
+// deletedDuringPutRoles has UpdateRole behave as the filer store's does when
+// a DeleteRole lands between its read and its write: the conditional write
+// fails, and the update is applied again to the role as it now is — absent.
+type deletedDuringPutRoles struct {
+	*integration.MemoryRoleStore
+	earlier *integration.RoleDefinition
+}
+
+// GetRole is a read made before the delete landed.
+func (s deletedDuringPutRoles) GetRole(context.Context, string, string) (*integration.RoleDefinition, error) {
+	return s.earlier, nil
+}
+
+func (s deletedDuringPutRoles) UpdateRole(ctx context.Context, addr, name string, update integration.RoleUpdate) error {
+	if _, err := update(s.earlier); err != nil { // the write that loses to the delete
+		return err
+	}
+	next, err := update(nil)
+	if err != nil {
+		return err
+	}
+	return s.MemoryRoleStore.StoreRole(ctx, addr, name, next)
+}
+
+// A PutRole racing a DeleteRole must not write the deleted role back under
+// its old ID, which would revive the deleted role's sessions.
+func TestIamGrpc_PutRoleRacingADeleteDoesNotReviveTheOldRoleID(t *testing.T) {
+	s, ctx, providers, _ := newSTSTestServer(t)
+	store := deletedDuringPutRoles{MemoryRoleStore: integration.NewMemoryRoleStore(), earlier: &integration.RoleDefinition{RoleName: "app", RoleId: "AROA-DELETED"}}
+	s.SetSTSStores(providers, store)
+
+	_, err := s.PutRole(ctx, &iam_pb.PutRoleRequest{Role: &iam_pb.Role{RoleName: "app", TrustPolicy: stsTestTrust}})
+	require.NoError(t, err)
+	role, err := store.MemoryRoleStore.GetRole(context.Background(), "", "app")
+	require.NoError(t, err)
+	assert.NotEqual(t, "AROA-DELETED", role.RoleId, "the deleted role's ID was written back")
+	assert.NotEmpty(t, role.RoleId)
+}
+
+// replacedDuringDeleteRoles has UpdateRole behave as the filer store's does
+// when a PutRole replaces the role between the delete's read and its write:
+// the conditional delete fails and the update runs again on the replacement.
+type replacedDuringDeleteRoles struct {
+	*integration.MemoryRoleStore
+	earlier *integration.RoleDefinition
+}
+
+func (s replacedDuringDeleteRoles) UpdateRole(ctx context.Context, addr, name string, update integration.RoleUpdate) error {
+	if _, err := update(s.earlier); err != nil { // the delete that loses to the PutRole
+		return err
+	}
+	return s.MemoryRoleStore.UpdateRole(ctx, addr, name, update)
+}
+
+// A DeleteRole racing a PutRole does not delete the definition the PutRole
+// wrote: it is refused as Aborted, and the caller decides again.
+func TestIamGrpc_DeleteRoleDoesNotDeleteARoleReplacedMeanwhile(t *testing.T) {
+	s, ctx, providers, _ := newSTSTestServer(t)
+	store := replacedDuringDeleteRoles{MemoryRoleStore: integration.NewMemoryRoleStore(), earlier: &integration.RoleDefinition{RoleName: "app", RoleId: "AROA-OLD"}}
+	require.NoError(t, store.StoreRole(context.Background(), "", "app", &integration.RoleDefinition{RoleName: "app", RoleId: "AROA-NEW"}))
+	s.SetSTSStores(providers, store)
+
+	_, err := s.DeleteRole(ctx, &iam_pb.DeleteRoleRequest{RoleName: "app"})
+	requireCode(t, err, codes.Aborted)
+	role, err := store.GetRole(context.Background(), "", "app")
+	require.NoError(t, err, "the replacement role was deleted")
+	assert.Equal(t, "AROA-NEW", role.RoleId)
+}
+
+// deletedDuringPutProviders has UpdateProvider behave as the filer store's
+// does when a delete lands between its read and its write: the conditional
+// write fails, and the update is applied again to the record as it now
+// is — absent.
+type deletedDuringPutProviders struct {
+	*integration.MemoryOIDCProviderStore
+	earlier *integration.OIDCProviderRecord
+}
+
+func (s deletedDuringPutProviders) UpdateProvider(ctx context.Context, addr, arn string, update integration.OIDCProviderUpdate) error {
+	if _, err := update(s.earlier); err != nil { // the write that loses to the delete
+		return err
+	}
+	next, err := update(nil)
+	if err != nil {
+		return err
+	}
+	return s.MemoryOIDCProviderStore.StoreProvider(ctx, addr, next)
+}
+
+// A PutOIDCProvider racing a DeleteOIDCProvider must not carry the deleted
+// record's fields over to the new one — the request decides them.
+func TestIamGrpc_PutOIDCProviderRacingADeleteKeepsNoOldFields(t *testing.T) {
+	s, ctx, _, roles := newSTSTestServer(t)
+	arn := "arn:aws:iam::111122223333:oidc-provider/oidc.example"
+	store := deletedDuringPutProviders{
+		MemoryOIDCProviderStore: integration.NewMemoryOIDCProviderStore(),
+		earlier: &integration.OIDCProviderRecord{
+			ARN: arn, URL: "https://oidc.example", Tags: map[string]string{"env": "deleted"}, PolicyClaim: "stale",
+		},
+	}
+	s.SetSTSStores(store, roles)
+
+	_, err := s.PutOIDCProvider(ctx, &iam_pb.PutOIDCProviderRequest{
+		IssuerUrl: "https://oidc.example", ClientIds: []string{"aud"}, AccountId: "111122223333",
+	})
+	require.NoError(t, err)
+	rec, err := store.MemoryOIDCProviderStore.GetProviderByARN(context.Background(), "", arn)
+	require.NoError(t, err)
+	assert.Empty(t, rec.Tags, "the deleted record's tags were carried over")
+	assert.Empty(t, rec.PolicyClaim, "the deleted record's policy claim was carried over")
+	assert.Equal(t, []string{"aud"}, rec.ClientIDs)
+}
+
+// replacedDuringDeleteProviders has UpdateProvider behave as the filer
+// store's does when a PutOIDCProvider replaces the record between the
+// delete's read and its write: the conditional delete fails and the update
+// runs again on the replacement.
+type replacedDuringDeleteProviders struct {
+	*integration.MemoryOIDCProviderStore
+	earlier *integration.OIDCProviderRecord
+}
+
+func (s replacedDuringDeleteProviders) UpdateProvider(ctx context.Context, addr, arn string, update integration.OIDCProviderUpdate) error {
+	if _, err := update(s.earlier); err != nil { // the delete that loses to the put
+		return err
+	}
+	return s.MemoryOIDCProviderStore.UpdateProvider(ctx, addr, arn, update)
+}
+
+// A DeleteOIDCProvider racing a PutOIDCProvider does not delete the record
+// the put wrote: it is refused as Aborted, and the caller decides again.
+func TestIamGrpc_DeleteOIDCProviderDoesNotDeleteAProviderReplacedMeanwhile(t *testing.T) {
+	s, ctx, _, roles := newSTSTestServer(t)
+	arn := "arn:aws:iam::111122223333:oidc-provider/oidc.example"
+	store := replacedDuringDeleteProviders{
+		MemoryOIDCProviderStore: integration.NewMemoryOIDCProviderStore(),
+		earlier:                 &integration.OIDCProviderRecord{ARN: arn, URL: "https://oidc.example", ClientIDs: []string{"old"}},
+	}
+	require.NoError(t, store.StoreProvider(context.Background(), "", &integration.OIDCProviderRecord{ARN: arn, URL: "https://oidc.example", ClientIDs: []string{"new"}}))
+	s.SetSTSStores(store, roles)
+
+	_, err := s.DeleteOIDCProvider(ctx, &iam_pb.DeleteOIDCProviderRequest{IssuerUrl: "https://oidc.example", AccountId: "111122223333"})
+	requireCode(t, err, codes.Aborted)
+	rec, err := store.GetProviderByARN(context.Background(), "", arn)
+	require.NoError(t, err, "the replacement record was deleted")
+	assert.Equal(t, []string{"new"}, rec.ClientIDs)
+}
diff --git a/weed/server/filer_server_handlers_proxy.go b/weed/server/filer_server_handlers_proxy.go
index 66a76a6c17..cf6766533f 100644
--- a/weed/server/filer_server_handlers_proxy.go
+++ b/weed/server/filer_server_handlers_proxy.go
@@ -127,15 +127,12 @@ func (fs *FilerServer) proxyToVolumeServerURL(w http.ResponseWriter, r *http.Req
 	// (e.g. http://server:8080/6,08136bdce4). Forward the caller's query params
 	// (e.g. readDeleted=true from weed mount) but drop the internal proxyChunkId.
 	query := r.URL.Query()
-	query.Del("proxyChunkId")
-	if isProxyReadMethod(r.Method) {
-		// On a read the filer decides the volume credential below, and
-		// security.GetJwt reads the "jwt" query parameter before the
-		// Authorization header -- so leaving a caller-supplied one in place
-		// would silently outrank the token we attach. Writes keep theirs: the
-		// proxy forwards a writer's own credential either way.
-		query.Del("jwt")
-	}
+	query.Del(util_http.ProxyChunkIdParam)
+	// "jwt" here is the filer credential that got the caller past the gate, and
+	// a volume server has no business seeing one. security.GetJwt reads that
+	// parameter before the Authorization header, so relaying it would also
+	// hide the volume credential the filer attaches below.
+	query.Del("jwt")
 	if encoded := query.Encode(); encoded != "" {
 		targetURL += "?" + encoded
 	}
@@ -148,10 +145,9 @@ func (fs *FilerServer) proxyToVolumeServerURL(w http.ResponseWriter, r *http.Req
 	}
 
 	// Limit concurrent reads per volume server to prevent overload. Writes are
-	// deliberately exempt: a proxied write carries the caller's AssignVolume
-	// token, which expires 10s after the assign by default, so queueing one here
-	// can push it past expiry and turn it into a 401 the uploader does not
-	// re-assign on.
+	// deliberately exempt: the bursts this exists to contain are replication
+	// reads, and an upload queued behind them stalls a caller that is holding a
+	// volume assignment open.
 	if isProxyReadMethod(r.Method) {
 		volumeHost := proxyReq.URL.Host
 		if err := acquireProxySemaphore(ctx, volumeHost); err != nil {
@@ -173,23 +169,15 @@ func (fs *FilerServer) proxyToVolumeServerURL(w http.ResponseWriter, r *http.Req
 	}
 
 	// Decide the volume credential explicitly rather than letting the copied
-	// header stand, because the two directions need opposite handling.
-	//
-	// Reads: the volume server may require a read JWT even though the proxy
-	// endpoint doesn't, so mint one. When there is nothing to mint, drop the
-	// caller's Authorization instead of relaying it -- on this path it is a
-	// filer credential, and a volume server has no business seeing one.
-	//
-	// Writes: never mint. This branch runs ahead of the filer's JWT gate, so a
-	// token minted here would be signed for an unauthenticated caller. A
-	// legitimate writer already carries its own volume JWT from AssignVolume,
-	// so that one is forwarded untouched.
-	if isProxyReadMethod(r.Method) {
-		if jwt := fs.maybeGetVolumeReadJwtAuthorizationToken(fileId); jwt != "" {
-			proxyReq.Header.Set("Authorization", security.BearerPrefix+jwt)
-		} else {
-			proxyReq.Header.Del("Authorization")
-		}
+	// header stand. The caller's Authorization is the filer credential that got
+	// them past the gate: a volume server has no business seeing one, and it
+	// would not honour it anyway. Mint the credential the volume server does
+	// ask for, at the access level this request needs, and drop the caller's
+	// when there is nothing to mint.
+	if jwt := fs.maybeGetVolumeJwtAuthorizationToken(fileId, !isProxyReadMethod(r.Method)); jwt != "" {
+		proxyReq.Header.Set("Authorization", security.BearerPrefix+jwt)
+	} else {
+		proxyReq.Header.Del("Authorization")
 	}
 
 	proxyResponse, postErr := util_http.GetGlobalHttpClient().Do(proxyReq)
diff --git a/weed/server/filer_server_handlers_proxy_test.go b/weed/server/filer_server_handlers_proxy_test.go
index d6babddade..30fd18c031 100644
--- a/weed/server/filer_server_handlers_proxy_test.go
+++ b/weed/server/filer_server_handlers_proxy_test.go
@@ -117,31 +117,50 @@ func TestProxyReadDropsCallerJwtQueryParam(t *testing.T) {
 	}
 }
 
-// A writer's credential is its own either way, so the query parameter is left
-// alone on writes -- stripping it would break a caller that presents its volume
-// JWT that way.
-func TestProxyWriteKeepsCallerJwtQueryParam(t *testing.T) {
+// On a write the query parameter carries the filer credential that got the
+// caller past the gate. Relaying it would hand a volume server a filer token
+// and, since security.GetJwt reads it first, hide the minted volume token
+// behind one the volume server cannot validate.
+func TestProxyWriteDropsCallerJwtQueryParam(t *testing.T) {
 	volume := newProxyTestVolume(t)
 	fs := &FilerServer{volumeGuard: security.NewGuard([]string{}, proxyTestWriteKey, 10, proxyTestReadKey, 10)}
 
 	r := httptest.NewRequest(http.MethodPost,
-		"http://filer:8888/?proxyChunkId="+proxyTestFileId+"&jwt=caller-supplied", nil)
+		"http://filer:8888/?proxyChunkId="+proxyTestFileId+"&jwt=filer-credential", nil)
 	fs.proxyToVolumeServerURL(httptest.NewRecorder(), r, proxyTestFileId, volume.URL+"/"+proxyTestFileId)
 
 	volume.requireReached(t)
-	if got := volume.seenEffectiveJwt(); got != "caller-supplied" {
-		t.Fatalf("writer's own jwt query param was altered: got %q", got)
+	if q := volume.seenRawQuery(); strings.Contains(q, "jwt=") {
+		t.Fatalf("filer credential survived in the forwarded query: %q", q)
+	}
+	claims := &security.SeaweedFileIdClaims{}
+	if _, err := security.DecodeJwt(security.SigningKey(proxyTestWriteKey),
+		security.EncodedJwt(volume.seenEffectiveJwt()), claims); err != nil {
+		t.Fatalf("volume server would evaluate %q, which does not validate against the write key: %v",
+			volume.seenEffectiveJwt(), err)
 	}
 }
 
-// Everything the filer can hand a caller on the proxy path is reachable without
-// authentication, because the branch runs ahead of the filer's JWT gate. With
-// only a write key configured it must therefore mint nothing at all.
-func TestProxyMintsNothingWithoutReadKey(t *testing.T) {
-	fs := &FilerServer{volumeGuard: security.NewGuard([]string{}, proxyTestWriteKey, 10, "", 10)}
+// The token is minted for the caller only once the filer has authorized them,
+// so a key that is not configured means no token: on a read that is the write
+// key, which would hand out more authority than the read needs.
+func TestProxyMintsNothingWithoutKey(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		isWrite  bool
+		writeKey string
+		readKey  string
+	}{
+		{"read with only a write key", false, proxyTestWriteKey, ""},
+		{"write with only a read key", true, "", proxyTestReadKey},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fs := &FilerServer{volumeGuard: security.NewGuard([]string{}, tc.writeKey, 10, tc.readKey, 10)}
 
-	if jwt := fs.maybeGetVolumeReadJwtAuthorizationToken(proxyTestFileId); jwt != "" {
-		t.Fatalf("minted %q with no read key configured", jwt)
+			if jwt := fs.maybeGetVolumeJwtAuthorizationToken(proxyTestFileId, tc.isWrite); jwt != "" {
+				t.Fatalf("minted %q with no key configured for that access level", jwt)
+			}
+		})
 	}
 }
 
@@ -169,40 +188,31 @@ func TestProxyReadTokenIsReadOnly(t *testing.T) {
 	}
 }
 
-// Writes must reach the volume server carrying the caller's own AssignVolume
-// token and nothing else. POST is the method every in-tree proxied uploader
-// actually sends, so it leads the table.
-func TestProxyWriteCarriesOnlyCallerCredential(t *testing.T) {
-	callerToken := security.BearerPrefix + string(security.GenJwtForVolumeServer(security.SigningKey(proxyTestWriteKey), 10, proxyTestFileId))
+// A proxied write reaches the volume server on a token the filer minted for
+// this file id, never on the caller's own Authorization -- that one is the
+// filer credential the caller was authorized with. POST is the method every
+// in-tree proxied uploader actually sends, so it leads the table.
+func TestProxyWriteCarriesMintedWriteToken(t *testing.T) {
+	vs := &VolumeServer{guard: security.NewGuard([]string{}, proxyTestWriteKey, 10, proxyTestReadKey, 10)}
 
-	for _, tc := range []struct {
-		name    string
-		method  string
-		readKey string
-		sent    string
-		want    string
-	}{
-		{"anonymous post", http.MethodPost, "", "", ""},
-		{"anonymous post with read key", http.MethodPost, proxyTestReadKey, "", ""},
-		{"anonymous delete", http.MethodDelete, "", "", ""},
-		{"anonymous delete with read key", http.MethodDelete, proxyTestReadKey, "", ""},
-		{"anonymous put with read key", http.MethodPut, proxyTestReadKey, "", ""},
-		{"caller token forwarded on post", http.MethodPost, proxyTestReadKey, callerToken, callerToken},
-		{"caller token forwarded on delete", http.MethodDelete, "", callerToken, callerToken},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
+	for _, method := range []string{http.MethodPost, http.MethodPut, http.MethodDelete} {
+		t.Run(method, func(t *testing.T) {
 			volume := newProxyTestVolume(t)
-			fs := &FilerServer{volumeGuard: security.NewGuard([]string{}, proxyTestWriteKey, 10, tc.readKey, 10)}
+			fs := &FilerServer{volumeGuard: security.NewGuard([]string{}, proxyTestWriteKey, 10, proxyTestReadKey, 10)}
 
-			r := httptest.NewRequest(tc.method, "http://filer:8888/?proxyChunkId="+proxyTestFileId, nil)
-			if tc.sent != "" {
-				r.Header.Set("Authorization", tc.sent)
-			}
+			r := httptest.NewRequest(method, "http://filer:8888/?proxyChunkId="+proxyTestFileId, nil)
+			r.Header.Set("Authorization", security.BearerPrefix+"filer-credential")
 			fs.proxyToVolumeServerURL(httptest.NewRecorder(), r, proxyTestFileId, volume.URL+"/"+proxyTestFileId)
 
 			volume.requireReached(t)
-			if got := volume.seenAuth(); got != tc.want {
-				t.Fatalf("volume server saw Authorization %q, want %q", got, tc.want)
+			seen := volume.seenAuth()
+			if seen == security.BearerPrefix+"filer-credential" {
+				t.Fatal("caller's filer credential reached the volume server")
+			}
+			check := httptest.NewRequest(method, "http://volume:8080/"+proxyTestFileId, nil)
+			check.Header.Set("Authorization", seen)
+			if !vs.maybeCheckJwtAuthorization(check, proxyTestVid, proxyTestFid, true) {
+				t.Fatalf("forwarded token %q did not authorize the write", seen)
 			}
 		})
 	}
@@ -233,14 +243,14 @@ func TestProxyReadReplacesCallerCredential(t *testing.T) {
 	}
 }
 
-// With no read key there is nothing to mint, and the caller's Authorization on
-// the read path is a filer credential -- it must be dropped, not relayed to a
-// volume server that has no business seeing it.
-func TestProxyReadDropsCallerCredentialWhenNothingMinted(t *testing.T) {
-	for _, method := range []string{http.MethodGet, http.MethodHead} {
+// With no volume key there is nothing to mint, and the caller's Authorization
+// is a filer credential -- it must be dropped, not relayed to a volume server
+// that has no business seeing it.
+func TestProxyDropsCallerCredentialWhenNothingMinted(t *testing.T) {
+	for _, method := range []string{http.MethodGet, http.MethodHead, http.MethodPost, http.MethodDelete} {
 		t.Run(method, func(t *testing.T) {
 			volume := newProxyTestVolume(t)
-			fs := &FilerServer{volumeGuard: security.NewGuard([]string{}, proxyTestWriteKey, 10, "", 10)}
+			fs := &FilerServer{volumeGuard: security.NewGuard([]string{}, "", 10, "", 10)}
 
 			r := httptest.NewRequest(method, "http://filer:8888/?proxyChunkId="+proxyTestFileId, nil)
 			r.Header.Set("Authorization", security.BearerPrefix+"filer-credential")
@@ -378,6 +388,54 @@ func TestProxyRejectsTraversalBeforeLookup(t *testing.T) {
 	}
 }
 
+// The proxy branch reaches any needle in the cluster by file id, on the filer
+// port jwt.filer_signing exists to make safe to expose, so it has to sit behind
+// the same gate as every other request.
+func TestFilerHandlerGatesChunkProxy(t *testing.T) {
+	signingKey := "secret"
+	fs := &FilerServer{
+		option:     &FilerOption{},
+		filerGuard: security.NewGuard(nil, signingKey, 0, signingKey, 0),
+	}
+
+	for _, method := range []string{http.MethodGet, http.MethodHead, http.MethodPut, http.MethodPost, http.MethodDelete} {
+		t.Run(method, func(t *testing.T) {
+			r := httptest.NewRequest(method, "http://filer:8888/?proxyChunkId="+proxyTestFileId, nil)
+			w := httptest.NewRecorder()
+
+			// fs.filer is nil: reaching the lookup would panic, so surviving
+			// this call is itself proof the request was refused first.
+			fs.filerHandler(w, r)
+
+			if w.Code != http.StatusUnauthorized {
+				t.Errorf("anonymous %s of a chunk returned %d, want 401", method, w.Code)
+			}
+		})
+	}
+}
+
+// ... and once past it the branch still runs. A malformed fid is refused by
+// validateProxyChunkId ahead of any lookup, which is as far as this can go
+// without a cluster behind the filer.
+func TestFilerHandlerProxiesChunkForAuthorizedCaller(t *testing.T) {
+	signingKey := "secret"
+	fs := &FilerServer{
+		option:     &FilerOption{},
+		filerGuard: security.NewGuard(nil, signingKey, 0, signingKey, 0),
+	}
+	token := security.GenJwtForFilerServer(security.SigningKey(signingKey), 60)
+
+	r := httptest.NewRequest(http.MethodGet, "http://filer:8888/?proxyChunkId=3,not-a-fid", nil)
+	r.Header.Set("Authorization", security.BearerPrefix+string(token))
+	w := httptest.NewRecorder()
+
+	fs.filerHandler(w, r)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("authorized chunk proxy returned %d, want 400 from the fid check", w.Code)
+	}
+}
+
 func TestProxySemaphore_LimitsConcurrency(t *testing.T) {
 	host := "test-volume:8080"
 	defer proxySemaphores.Delete(host)
diff --git a/weed/server/filer_server_handlers_read.go b/weed/server/filer_server_handlers_read.go
index 1eb5debc13..db243599c4 100644
--- a/weed/server/filer_server_handlers_read.go
+++ b/weed/server/filer_server_handlers_read.go
@@ -11,16 +11,21 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/format"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 // Validates the preconditions. Returns true if GET/HEAD operation should not proceed.
@@ -46,10 +51,10 @@ func checkPreconditions(w http.ResponseWriter, r *http.Request, entry *filer.Ent
 	}
 	w.Header().Set("Last-Modified", entry.Attr.Mtime.UTC().Format(http.TimeFormat))
 
-	ifMatchETagHeader := r.Header.Get("If-Match")
+	ifMatchValues := r.Header.Values("If-Match")
 	ifUnmodifiedSinceHeader := r.Header.Get("If-Unmodified-Since")
-	if ifMatchETagHeader != "" {
-		if util.CanonicalizeETag(etag) != util.CanonicalizeETag(ifMatchETagHeader) {
+	if len(ifMatchValues) != 0 {
+		if !etagListMatches(strings.Join(ifMatchValues, ","), etag, false) {
 			w.WriteHeader(http.StatusPreconditionFailed)
 			return true
 		}
@@ -62,10 +67,10 @@ func checkPreconditions(w http.ResponseWriter, r *http.Request, entry *filer.Ent
 		}
 	}
 
-	ifNoneMatchETagHeader := r.Header.Get("If-None-Match")
+	ifNoneMatchValues := r.Header.Values("If-None-Match")
 	ifModifiedSinceHeader := r.Header.Get("If-Modified-Since")
-	if ifNoneMatchETagHeader != "" {
-		if util.CanonicalizeETag(etag) == util.CanonicalizeETag(ifNoneMatchETagHeader) {
+	if len(ifNoneMatchValues) != 0 {
+		if etagListMatches(strings.Join(ifNoneMatchValues, ","), etag, true) {
 			SetEtag(w, etag)
 			w.WriteHeader(http.StatusNotModified)
 			return true
@@ -83,6 +88,52 @@ func checkPreconditions(w http.ResponseWriter, r *http.Request, entry *filer.Ent
 	return false
 }
 
+// etagListMatches reports whether an If-Match or If-None-Match value, "*" or a
+// list of entity tags, matches etag (RFC 9110 13.1.1, 13.1.2). If-Match uses the
+// strong comparison, so a weak tag never matches; If-None-Match the weak one.
+func etagListMatches(header, etag string, weak bool) bool {
+	if strings.TrimSpace(header) == "*" {
+		return true
+	}
+	for _, tag := range splitETagList(header) {
+		tag = strings.TrimSpace(tag)
+		if strings.HasPrefix(tag, "W/") {
+			if !weak {
+				continue
+			}
+			tag = tag[len("W/"):]
+		}
+		// Empty list elements are ignored, so padding like a trailing
+		// comma cannot match an empty opaque tag.
+		if tag == "" {
+			continue
+		}
+		if util.CanonicalizeETag(tag) == util.CanonicalizeETag(etag) {
+			return true
+		}
+	}
+	return false
+}
+
+// splitETagList splits an entity-tag list on the commas between tags; a comma
+// inside a quoted opaque tag does not split.
+func splitETagList(header string) []string {
+	var tags []string
+	start, quoted := 0, false
+	for i := 0; i < len(header); i++ {
+		switch header[i] {
+		case '"':
+			quoted = !quoted
+		case ',':
+			if !quoted {
+				tags = append(tags, header[start:i])
+				start = i + 1
+			}
+		}
+	}
+	return append(tags, header[start:])
+}
+
 func (fs *FilerServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	path := r.URL.Path
@@ -130,7 +181,7 @@ func (fs *FilerServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request)
 			if entry.Chunks, _, err = filer.ResolveChunkManifest(
 				ctx,
 				fs.filer.MasterClient.GetLookupFileIdFunction(),
-				entry.GetChunks(), 0, math.MaxInt64); err != nil {
+				entry.GetChunks(), 0, math.MaxInt64, fs.filer.MasterClient); err != nil {
 				err = fmt.Errorf("failed to resolve chunk manifest, err: %s", err.Error())
 				writeJsonError(w, r, http.StatusInternalServerError, err)
 				return
@@ -205,6 +256,21 @@ func (fs *FilerServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request)
 		stats.RecordRemoteCacheRead(stats.RemoteCacheSourceFiler, fs.filer.DetectBucket(entry.FullPath), hit)
 	}
 
+	// Every part of a multipart Range is prepared on its own, so the origin
+	// preflight below is memoized to one stat per request.
+	statOriginAt := func(readDir, readName string) func() error {
+		return sync.OnceValue(func() error {
+			client, remoteLocation, err := fs.mountedRemoteClient(ctx, readDir, readName)
+			if err != nil {
+				return err
+			}
+			_, err = client.StatFile(remoteLocation)
+			return err
+		})
+	}
+	entryDir, entryName := entry.FullPath.DirAndName()
+	statOrigin := statOriginAt(fs.filer.RemoteReadPath(entry, entryDir, entryName))
+
 	ProcessRangeRequest(r, w, totalSize, mimeType, func(offset int64, size int64) (filer.DoStreamContent, error) {
 		if offset+size <= int64(len(entry.Content)) {
 			return func(writer io.Writer) error {
@@ -219,26 +285,61 @@ func (fs *FilerServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request)
 		chunks := entry.GetChunks()
 		if entry.IsInRemoteOnly() {
 			dir, name := entry.FullPath.DirAndName()
-			if resp, err := fs.CacheRemoteObjectToLocalCluster(ctx, &filer_pb.CacheRemoteObjectToLocalClusterRequest{
+			readDir, readName := fs.filer.RemoteReadPath(entry, dir, name)
+			var mountedLocation *remote_pb.RemoteStorageLocation
+			if fs.filer.RemoteStorage != nil {
+				_, mountedLocation = fs.filer.RemoteStorage.FindMountDirectory(entry.FullPath)
+			}
+			cacheWait := remote_storage.CacheWaitTimeout(entry.Remote.RemoteSize, mountedLocation)
+			if cacheWait <= 0 {
+				streamFn, err := fs.streamFromRemoteOnly(ctx, r, readDir, readName, offset, size, statOrigin)
+				if errors.Is(err, filer_pb.ErrNotFound) && (readDir != dir || readName != name) {
+					// the pending copy finished and its source went away since
+					// the entry was read; serve what the entry names now
+					if fresh, findErr := fs.filer.FindEntry(ctx, entry.FullPath); findErr == nil {
+						freshDir, freshName := fs.filer.RemoteReadPath(fresh, dir, name)
+						return fs.streamFromRemoteOnly(ctx, r, freshDir, freshName, offset, size, statOriginAt(freshDir, freshName))
+					}
+				}
+				return streamFn, err
+			}
+			// Bounded wait: a large download outlasts any client timeout, so
+			// serve straight from the origin once the wait expires while the
+			// detached cache keeps filling for later reads.
+			cacheCtx, cancelCache := context.WithTimeout(ctx, cacheWait)
+			resp, err := fs.CacheRemoteObjectToLocalCluster(cacheCtx, &filer_pb.CacheRemoteObjectToLocalClusterRequest{
 				Directory: dir,
 				Name:      name,
-			}); err != nil {
+			})
+			cancelCache()
+			if err != nil {
 				stats.FilerHandlerCounter.WithLabelValues(stats.ErrorReadCache).Inc()
 				// Client disconnected: surface ctx error so caller stays silent.
 				if ctxErr := ctx.Err(); ctxErr != nil {
 					return nil, ctxErr
 				}
-				// Entry vanished mid-cache: forward NotFound so caller maps to 404,
-				// not the 503 retry-loop.
-				if errors.Is(err, filer_pb.ErrNotFound) {
-					return nil, err
+				// Entry vanished mid-cache: forward the sentinel so caller maps to
+				// 404, not the 503 retry-loop. The cache RPC returns it as a
+				// canonical status, which errors.Is cannot see.
+				if errors.Is(err, filer_pb.ErrNotFound) || status.Code(err) == codes.NotFound {
+					return nil, filer_pb.ErrNotFound
 				}
-				// Cache still filling: tag with sentinel so caller maps to 503 + Retry-After.
+				// A multipart Range prepares every part before writing any, which
+				// would hold one open origin connection per part and leak them
+				// when a later prepare fails; keep those on the 503 retry path.
+				if !strings.Contains(r.Header.Get("Range"), ",") {
+					glog.V(1).InfofCtx(ctx, "stream %s from remote while caching: %v", entry.FullPath, err)
+					if streamFn, remoteErr := fs.streamFromRemote(ctx, readDir, readName, offset, size); remoteErr == nil {
+						return streamFn, nil
+					} else {
+						glog.WarningfCtx(ctx, "stream %s from remote: %v", entry.FullPath, remoteErr)
+					}
+				}
+				// Origin unreadable: tag with sentinel so caller maps to 503 + Retry-After.
 				glog.WarningfCtx(ctx, "CacheRemoteObjectToLocalCluster %s: %v", entry.FullPath, err)
 				return nil, fmt.Errorf("cache %s: %w", entry.FullPath, ErrCacheNotReady)
-			} else {
-				chunks = resp.Entry.GetChunks()
 			}
+			chunks = resp.Entry.GetChunks()
 		}
 
 		// Use a detached context for streaming so client disconnects/cancellations don't abort volume server operations,
@@ -265,16 +366,122 @@ func (fs *FilerServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request)
 	})
 }
 
+// streamFromRemoteOnly serves a byte range of an entry whose mount opted out of
+// caching, leaving the origin as its only source. A multipart Range prepares
+// every part before writing any, so those open the origin at write time instead
+// of holding one connection per part through the whole preparation.
+func (fs *FilerServer) streamFromRemoteOnly(ctx context.Context, r *http.Request, dir, name string, offset, size int64, statOrigin func() error) (filer.DoStreamContent, error) {
+	fullPath := util.FullPath(dir).Child(name)
+	if strings.Contains(r.Header.Get("Range"), ",") {
+		// Stat first so a missing or unreachable origin still picks the response
+		// status, which the multipart body would otherwise have committed.
+		if err := statOrigin(); err != nil {
+			return nil, fs.remoteReadError(ctx, fullPath, err)
+		}
+		return func(writer io.Writer) error {
+			streamFn, remoteErr := fs.streamFromRemote(ctx, dir, name, offset, size)
+			if remoteErr != nil {
+				stats.FilerHandlerCounter.WithLabelValues(stats.ErrorReadStream).Inc()
+				return remoteErr
+			}
+			return streamFn(writer)
+		}, nil
+	}
+	streamFn, remoteErr := fs.streamFromRemote(ctx, dir, name, offset, size)
+	if remoteErr != nil {
+		return nil, fs.remoteReadError(ctx, fullPath, remoteErr)
+	}
+	return streamFn, nil
+}
+
+// remoteReadError maps a failed origin read of an uncachable entry onto the
+// sentinel the caller turns into a response: a vanished object is final, since
+// no cache can resurrect it, while anything else may pass.
+func (fs *FilerServer) remoteReadError(ctx context.Context, fullPath util.FullPath, err error) error {
+	stats.FilerHandlerCounter.WithLabelValues(stats.ErrorReadStream).Inc()
+	glog.WarningfCtx(ctx, "read %s from remote: %v", fullPath, err)
+	if errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return filer_pb.ErrNotFound
+	}
+	return fmt.Errorf("read %s: %w", fullPath, ErrCacheNotReady)
+}
+
+// mountedRemoteClient resolves the origin of dir/name into a client that can
+// stream it.
+func (fs *FilerServer) mountedRemoteClient(ctx context.Context, dir, name string) (remote_storage.RemoteStorageClient, *remote_pb.RemoteStorageLocation, error) {
+	storageConf, remoteLocation, err := fs.resolveMountedRemote(ctx, dir, name)
+	if err != nil {
+		return nil, nil, err
+	}
+	client, err := BuildGuardedRemoteStorageClient(ctx, storageConf, fs.option.AllowUntrustedRemoteEndpoints)
+	if err != nil {
+		return nil, nil, err
+	}
+	if _, ok := client.(remote_storage.RemoteStorageStreamReader); !ok {
+		return nil, nil, fmt.Errorf("remote storage type %s does not support streaming reads", storageConf.Type)
+	}
+	return client, remoteLocation, nil
+}
+
+// streamFromRemote serves a byte range of a remote-only entry straight from the
+// mounted origin, so a first read is not blocked by the full local caching.
+func (fs *FilerServer) streamFromRemote(ctx context.Context, dir, name string, offset, size int64) (filer.DoStreamContent, error) {
+	client, remoteLocation, err := fs.mountedRemoteClient(ctx, dir, name)
+	if err != nil {
+		return nil, err
+	}
+	reader, err := client.(remote_storage.RemoteStorageStreamReader).ReadFileAsStream(ctx, remoteLocation, offset, size)
+	if err != nil {
+		return nil, err
+	}
+	downloadThrottler := util.NewWriteThrottler(fs.option.DownloadMaxBytesPs)
+	return func(writer io.Writer) error {
+		defer reader.Close()
+		var written int64
+		buf := make([]byte, 128*1024)
+		for {
+			n, readErr := reader.Read(buf)
+			if n > 0 {
+				if _, writeErr := writer.Write(buf[:n]); writeErr != nil {
+					return writeErr
+				}
+				written += int64(n)
+				downloadThrottler.MaybeSlowdown(int64(n))
+			}
+			if readErr == io.EOF {
+				if written != size {
+					// the origin returned fewer bytes than the entry's RemoteSize
+					return fmt.Errorf("origin stream %s: %w after %d of %d bytes", remoteLocation.Path, io.ErrUnexpectedEOF, written, size)
+				}
+				return nil
+			}
+			if readErr != nil {
+				return readErr
+			}
+		}
+	}, nil
+}
+
 func (fs *FilerServer) maybeGetVolumeReadJwtAuthorizationToken(fileId string) string {
 	// Only ever sign with the read key. A volume server enforces read JWTs
 	// solely when jwt.signing.read.key is set, so falling back to the write key
 	// buys no access on a read -- it only hands out a token that would authorize
 	// a write.
-	key := fs.volumeGuard.ReadSigningKey()
+	return fs.maybeGetVolumeJwtAuthorizationToken(fileId, false)
+}
+
+// maybeGetVolumeJwtAuthorizationToken mints the volume credential for one file
+// id at the requested access level, empty when that key is unset -- which is
+// also when the volume server asks for nothing.
+func (fs *FilerServer) maybeGetVolumeJwtAuthorizationToken(fileId string, isWrite bool) string {
+	key, expiresAfterSec := fs.volumeGuard.ReadSigningKey(), fs.volumeGuard.ReadExpiresAfterSec()
+	if isWrite {
+		key, expiresAfterSec = fs.volumeGuard.SigningKey(), fs.volumeGuard.ExpiresAfterSec()
+	}
 	if len(key) == 0 {
 		return ""
 	}
 	// Claim the base fid: the volume server strips a _N delta suffix before
 	// comparing, so a token claiming the suffixed form never matches.
-	return string(security.GenJwtForVolumeServer(key, fs.volumeGuard.ReadExpiresAfterSec(), baseFileId(fileId)))
+	return string(security.GenJwtForVolumeServer(key, expiresAfterSec, baseFileId(fileId)))
 }
diff --git a/weed/server/filer_server_handlers_read_precondition_test.go b/weed/server/filer_server_handlers_read_precondition_test.go
new file mode 100644
index 0000000000..053056a130
--- /dev/null
+++ b/weed/server/filer_server_handlers_read_precondition_test.go
@@ -0,0 +1,115 @@
+package weed_server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+func TestCheckPreconditionsETagLists(t *testing.T) {
+	entry := &filer.Entry{Attr: filer.Attr{Mtime: time.Unix(1700000000, 0), Md5: []byte{0xb1, 0x94}}}
+	const etag = `"b194"`
+
+	tests := []struct {
+		header string
+		values []string
+		want   int
+	}{
+		{"If-None-Match", []string{etag}, http.StatusNotModified},
+		{"If-None-Match", []string{`*`}, http.StatusNotModified},
+		{"If-None-Match", []string{`W/` + etag}, http.StatusNotModified},
+		{"If-None-Match", []string{`"x", ` + etag}, http.StatusNotModified},
+		{"If-None-Match", []string{`"x"`, etag}, http.StatusNotModified},
+		{"If-None-Match", []string{`"x"`}, http.StatusOK},
+		{"If-None-Match", []string{`"b194,old"`}, http.StatusOK},
+		{"If-Match", []string{etag}, http.StatusOK},
+		{"If-Match", []string{`*`}, http.StatusOK},
+		{"If-Match", []string{`"x", ` + etag}, http.StatusOK},
+		{"If-Match", []string{`"x"`, etag}, http.StatusOK},
+		{"If-Match", []string{`W/` + etag}, http.StatusPreconditionFailed},
+		{"If-Match", []string{`"x"`}, http.StatusPreconditionFailed},
+		{"If-Match", []string{`"b194,old"`}, http.StatusPreconditionFailed},
+	}
+	for _, tt := range tests {
+		r := httptest.NewRequest(http.MethodGet, "/d/f.txt", nil)
+		for _, v := range tt.values {
+			r.Header.Add(tt.header, v)
+		}
+		w := httptest.NewRecorder()
+		got := http.StatusOK
+		if checkPreconditions(w, r, entry) {
+			got = w.Code
+		}
+		if got != tt.want {
+			t.Errorf("%s: %q -> %d, want %d", tt.header, tt.values, got, tt.want)
+		}
+	}
+}
+
+func TestCheckPreconditionsPresentButEmptyHeaders(t *testing.T) {
+	entry := &filer.Entry{Attr: filer.Attr{Mtime: time.Unix(1700000000, 0), Md5: []byte{0xb1, 0x94}}}
+	before := time.Unix(1700000000-60, 0).UTC().Format(http.TimeFormat)
+	after := time.Unix(1700000000+60, 0).UTC().Format(http.TimeFormat)
+
+	// An empty If-Match line is still an If-Match: it matches nothing, and
+	// If-Unmodified-Since stays ignored.
+	r := httptest.NewRequest(http.MethodGet, "/d/f.txt", nil)
+	r.Header.Set("If-Match", "")
+	r.Header.Set("If-Unmodified-Since", after)
+	if w := httptest.NewRecorder(); !checkPreconditions(w, r, entry) || w.Code != http.StatusPreconditionFailed {
+		t.Errorf("empty If-Match -> %d, want 412", w.Code)
+	}
+
+	// An empty If-None-Match line matches nothing and suppresses
+	// If-Modified-Since, so the request proceeds.
+	r = httptest.NewRequest(http.MethodGet, "/d/f.txt", nil)
+	r.Header.Set("If-None-Match", "")
+	r.Header.Set("If-Modified-Since", after)
+	if checkPreconditions(httptest.NewRecorder(), r, entry) {
+		t.Error("empty If-None-Match with matching If-Modified-Since -> 304, want 200")
+	}
+
+	r = httptest.NewRequest(http.MethodGet, "/d/f.txt", nil)
+	r.Header.Set("If-Modified-Since", before)
+	if checkPreconditions(httptest.NewRecorder(), r, entry) {
+		t.Error("old If-Modified-Since alone -> 304, want 200")
+	}
+}
+
+func TestCheckPreconditionsIgnoresEmptyETagListElements(t *testing.T) {
+	entry := &filer.Entry{
+		Attr:   filer.Attr{Mtime: time.Unix(1700000000, 0)},
+		Remote: &filer_pb.RemoteEntry{RemoteSize: 1},
+	}
+
+	tests := []struct {
+		header string
+		values []string
+		want   int
+	}{
+		{"If-None-Match", []string{`"x",`}, http.StatusOK},
+		{"If-None-Match", []string{`"x",,"y"`}, http.StatusOK},
+		{"If-None-Match", []string{`""`}, http.StatusNotModified},
+		{"If-None-Match", []string{`W/""`}, http.StatusNotModified},
+		{"If-Match", []string{`"x",`}, http.StatusPreconditionFailed},
+		{"If-Match", []string{`""`}, http.StatusOK},
+	}
+	for _, tt := range tests {
+		r := httptest.NewRequest(http.MethodGet, "/d/f.txt", nil)
+		for _, v := range tt.values {
+			r.Header.Add(tt.header, v)
+		}
+		w := httptest.NewRecorder()
+		got := http.StatusOK
+		if checkPreconditions(w, r, entry) {
+			got = w.Code
+		}
+		if got != tt.want {
+			t.Errorf("%s: %q -> %d, want %d", tt.header, tt.values, got, tt.want)
+		}
+	}
+}
diff --git a/weed/server/filer_server_handlers_tagging.go b/weed/server/filer_server_handlers_tagging.go
index 06cd1295e9..d2ef239f9b 100644
--- a/weed/server/filer_server_handlers_tagging.go
+++ b/weed/server/filer_server_handlers_tagging.go
@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/util"
@@ -35,7 +36,7 @@ func (fs *FilerServer) PutTaggingHandler(w http.ResponseWriter, r *http.Request)
 	}
 
 	for header, values := range r.Header {
-		if strings.HasPrefix(header, needle.PairNamePrefix) {
+		if strings.HasPrefix(header, needle.PairNamePrefix) && header != filer.ExtRemoteRenameSourceKey {
 			for _, value := range values {
 				existingEntry.Extended[header] = []byte(value)
 			}
@@ -89,7 +90,7 @@ func (fs *FilerServer) DeleteTaggingHandler(w http.ResponseWriter, r *http.Reque
 	// delete all tags or specific tags
 	hasDeletion := false
 	for header, _ := range existingEntry.Extended {
-		if strings.HasPrefix(header, needle.PairNamePrefix) {
+		if strings.HasPrefix(header, needle.PairNamePrefix) && header != filer.ExtRemoteRenameSourceKey {
 			if len(deletions) == 0 {
 				delete(existingEntry.Extended, header)
 				hasDeletion = true
diff --git a/weed/server/filer_server_handlers_write.go b/weed/server/filer_server_handlers_write.go
index e3b1663e25..5970b8d176 100644
--- a/weed/server/filer_server_handlers_write.go
+++ b/weed/server/filer_server_handlers_write.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -26,7 +27,9 @@ var (
 	OS_UID = uint32(os.Getuid())
 	OS_GID = uint32(os.Getgid())
 
-	ErrReadOnly = errors.New("read only")
+	// ErrReadOnly is filer_pb.ErrReadOnly so errors.Is matches on either side
+	// of the gRPC boundary.
+	ErrReadOnly = filer_pb.ErrReadOnly
 )
 
 type FilerPostResult struct {
@@ -80,7 +83,10 @@ func (fs *FilerServer) assignNewFileInfo(ctx context.Context, so *operation.Stor
 func (fs *FilerServer) PostHandler(w http.ResponseWriter, r *http.Request, contentLength int64) {
 	ctx := r.Context()
 
-	destination := r.RequestURI
+	// Match storage rules on the decoded path the entry is written to. The raw
+	// request-target is percent-encoded on the wire, so a rule on "/只读/" would
+	// never see "/%E5%8F%AA%E8%AF%BB/".
+	destination := r.URL.Path
 	headerDestination := r.Header.Get(s3_constants.SeaweedStorageDestinationHeader)
 	if headerDestination != "" {
 		destination = headerDestination
@@ -117,6 +123,10 @@ func (fs *FilerServer) PostHandler(w http.ResponseWriter, r *http.Request, conte
 		return
 	}
 
+	if so.Fsync {
+		ctx = filer.WithSyncWrite(ctx)
+	}
+
 	if util.FullPath(r.URL.Path).IsLongerFileName(so.MaxFileNameLength) {
 		glog.V(1).InfolnCtx(ctx, "post", r.RequestURI, ": ", "entry name too long")
 		w.WriteHeader(http.StatusRequestURITooLong)
@@ -144,6 +154,8 @@ func (fs *FilerServer) PostHandler(w http.ResponseWriter, r *http.Request, conte
 		fs.formatIngest(ctx, w, r, so)
 	} else if query.Get(formatRepackParam) != "" {
 		fs.formatRepack(ctx, w, r, so)
+	} else if isExtractZip(r) {
+		fs.extractZipArchive(ctx, w, r)
 	} else {
 		fs.autoChunk(ctx, w, r, contentLength, so)
 	}
@@ -258,7 +270,15 @@ func (fs *FilerServer) DeleteHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = fs.filer.DeleteEntryMetaAndData(context.Background(), util.FullPath(objectPath), isRecursive, ignoreRecursiveError, !skipChunkDeletion, false, nil, 0)
+	// The delete and the commit record it emits must serialize with peer
+	// replay of this path, same as the gRPC DeleteEntry handler.
+	fullPath := util.FullPath(objectPath)
+	if fs.entryLockTable != nil {
+		pathLock := fs.entryLockTable.AcquireLock("DeleteHandler", fullPath, util.ExclusiveLock)
+		defer fs.entryLockTable.ReleaseLock(fullPath, pathLock)
+	}
+
+	err = fs.filer.DeleteEntryMetaAndData(context.Background(), fullPath, isRecursive, ignoreRecursiveError, !skipChunkDeletion, false, nil, 0)
 	if err != nil && err != filer_pb.ErrNotFound {
 		glog.V(1).Infoln("deleting", objectPath, ":", err.Error())
 		writeJsonError(w, r, http.StatusInternalServerError, err)
@@ -277,8 +297,7 @@ func (fs *FilerServer) detectStorageOption(ctx context.Context, requestURI, qCol
 		// MatchStorageRule leaves LocationPrefix empty when several rules merge; fall back to the request path.
 		prefix := rule.LocationPrefix
 		if prefix == "" {
-			// requestURI may carry a query string on the HTTP path; keep only the path.
-			prefix, _, _ = strings.Cut(requestURI, "?")
+			prefix = requestURI
 		}
 		return nil, fmt.Errorf("%w: %s (e.g. bucket over quota)", ErrReadOnly, prefix)
 	}
@@ -326,9 +345,14 @@ func (fs *FilerServer) detectStorageOption(ctx context.Context, requestURI, qCol
 		DataNode:          util.Nvl(dataNode, rule.DataNode, fs.option.DataNode),
 		TtlSeconds:        ttlSeconds,
 		DiskType:          util.Nvl(diskType, overlayDisk, rule.DiskType),
-		Fsync:             rule.Fsync,
+		Fsync:             rule.GetFsync(),
 		VolumeGrowthCount: rule.VolumeGrowthCount,
 		MaxFileNameLength: maxFileNameLength,
+		// A location that survives from a request parameter, a placement
+		// overlay, or the path rule is a contract; only a bare filer default
+		// is a preference that may still be widened.
+		EnforceLocation: dataCenter != "" || overlayDataCenter != "" || rule.DataCenter != "" ||
+			rack != "" || rule.Rack != "" || dataNode != "" || rule.DataNode != "",
 	}, nil
 }
 
diff --git a/weed/server/filer_server_handlers_write_autochunk.go b/weed/server/filer_server_handlers_write_autochunk.go
index bc379639d5..a1d1550b5d 100644
--- a/weed/server/filer_server_handlers_write_autochunk.go
+++ b/weed/server/filer_server_handlers_write_autochunk.go
@@ -6,13 +6,16 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"net/http"
+	"net/url"
 	"os"
 	"path"
 	"strconv"
 	"strings"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
@@ -20,6 +23,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/constants"
+	"google.golang.org/protobuf/proto"
 )
 
 func (fs *FilerServer) autoChunk(ctx context.Context, w http.ResponseWriter, r *http.Request, contentLength int64, so *operation.StorageOption) {
@@ -27,13 +31,7 @@ func (fs *FilerServer) autoChunk(ctx context.Context, w http.ResponseWriter, r *
 	// autoChunking can be set at the command-line level or as a query param. Query param overrides command-line
 	query := r.URL.Query()
 
-	parsedMaxMB, _ := strconv.ParseInt(query.Get("maxMB"), 10, 32)
-	maxMB := int32(parsedMaxMB)
-	if maxMB <= 0 && fs.option.MaxMB > 0 {
-		maxMB = int32(fs.option.MaxMB)
-	}
-
-	chunkSize := 1024 * 1024 * maxMB
+	chunkSize := fs.requestChunkSize(query)
 
 	var reply *FilerPostResult
 	var err error
@@ -56,7 +54,10 @@ func (fs *FilerServer) autoChunk(ctx context.Context, w http.ResponseWriter, r *
 			writeJsonError(w, r, util.HttpStatusCancelled, err)
 		case strings.HasSuffix(errStr, "is a file") || strings.HasSuffix(errStr, "already exists"):
 			writeJsonError(w, r, http.StatusConflict, err)
-		case errStr == constants.ErrMsgBadDigest:
+		case errStr == constants.ErrMsgBadDigest,
+			errStr == constants.ErrMsgAppendSaveInsideChunked,
+			errStr == constants.ErrMsgAppendInlineMode,
+			errStr == constants.ErrMsgOffsetWriteInline:
 			writeJsonError(w, r, http.StatusBadRequest, err)
 		default:
 			writeJsonError(w, r, http.StatusInternalServerError, err)
@@ -97,8 +98,17 @@ func (fs *FilerServer) doPostAutoChunk(ctx context.Context, w http.ResponseWrite
 	if so.SaveInside {
 		buf := bufPool.Get().(*bytes.Buffer)
 		buf.Reset()
-		buf.ReadFrom(part1)
-		filerResult, replyerr = fs.saveMetaData(ctx, r, fileName, contentType, so, nil, nil, 0, buf.Bytes())
+		if _, err := buf.ReadFrom(part1); err != nil {
+			bufPool.Put(buf)
+			return nil, nil, fmt.Errorf("read input: %w", err)
+		}
+		md5bytes = util.Md5(buf.Bytes())
+		headerMd5 := r.Header.Get("Content-Md5")
+		if headerMd5 != "" && !(util.Base64Encode(md5bytes) == headerMd5 || fmt.Sprintf("%x", md5bytes) == headerMd5) {
+			bufPool.Put(buf)
+			return nil, nil, errors.New(constants.ErrMsgBadDigest)
+		}
+		filerResult, replyerr, _ = fs.saveMetaData(ctx, r, fileName, contentType, so, chunkSize, md5bytes, nil, int64(buf.Len()), buf.Bytes())
 		bufPool.Put(buf)
 		return
 	}
@@ -114,9 +124,10 @@ func (fs *FilerServer) doPostAutoChunk(ctx context.Context, w http.ResponseWrite
 		fs.filer.DeleteUncommittedChunks(ctx, fileChunks)
 		return nil, nil, errors.New(constants.ErrMsgBadDigest)
 	}
-	filerResult, replyerr = fs.saveMetaData(ctx, r, fileName, contentType, so, md5bytes, fileChunks, chunkOffset, smallContent)
+	var uncommittedChunks []*filer_pb.FileChunk
+	filerResult, replyerr, uncommittedChunks = fs.saveMetaData(ctx, r, fileName, contentType, so, chunkSize, md5bytes, fileChunks, chunkOffset, smallContent)
 	if replyerr != nil {
-		fs.filer.DeleteUncommittedChunks(ctx, fileChunks)
+		fs.filer.DeleteUncommittedChunks(ctx, uncommittedChunks)
 	}
 
 	return
@@ -146,9 +157,10 @@ func (fs *FilerServer) doPutAutoChunk(ctx context.Context, w http.ResponseWriter
 		fs.filer.DeleteUncommittedChunks(ctx, fileChunks)
 		return nil, nil, errors.New(constants.ErrMsgBadDigest)
 	}
-	filerResult, replyerr = fs.saveMetaData(ctx, r, fileName, contentType, so, md5bytes, fileChunks, chunkOffset, smallContent)
+	var uncommittedChunks []*filer_pb.FileChunk
+	filerResult, replyerr, uncommittedChunks = fs.saveMetaData(ctx, r, fileName, contentType, so, chunkSize, md5bytes, fileChunks, chunkOffset, smallContent)
 	if replyerr != nil {
-		fs.filer.DeleteUncommittedChunks(ctx, fileChunks)
+		fs.filer.DeleteUncommittedChunks(ctx, uncommittedChunks)
 	}
 
 	return
@@ -162,6 +174,22 @@ func skipCheckParentDirEntry(r *http.Request) bool {
 	return r.URL.Query().Get("skipCheckParentDir") == "true"
 }
 
+// requestChunkSize resolves the auto-chunking size from the maxMB query param
+// or the server default, clamped so the int32 chunk size cannot overflow into
+// a non-positive value that would drop the upload's contents.
+func (fs *FilerServer) requestChunkSize(query url.Values) int32 {
+	parsedMaxMB, _ := strconv.ParseInt(query.Get("maxMB"), 10, 32)
+	maxMB := parsedMaxMB
+	if maxMB <= 0 {
+		maxMB = int64(fs.option.MaxMB)
+	}
+	const maxChunkSizeMB = math.MaxInt32 / (1024 * 1024) // 2047
+	if maxMB > maxChunkSizeMB {
+		maxMB = maxChunkSizeMB
+	}
+	return int32(maxMB) * 1024 * 1024
+}
+
 func (fs *FilerServer) checkPermissions(ctx context.Context, r *http.Request, fileName string) error {
 	fullPath := fs.fixFilePath(ctx, r, fileName)
 	enforced, err := fs.wormEnforcedForEntry(ctx, fullPath)
@@ -230,7 +258,8 @@ func (fs *FilerServer) fixFilePath(ctx context.Context, r *http.Request, fileNam
 	return fullPath
 }
 
-func (fs *FilerServer) saveMetaData(ctx context.Context, r *http.Request, fileName string, contentType string, so *operation.StorageOption, md5bytes []byte, fileChunks []*filer_pb.FileChunk, chunkOffset int64, content []byte) (filerResult *FilerPostResult, replyerr error) {
+func (fs *FilerServer) saveMetaData(ctx context.Context, r *http.Request, fileName string, contentType string, so *operation.StorageOption, chunkSize int32, md5bytes []byte, fileChunks []*filer_pb.FileChunk, chunkOffset int64, content []byte) (filerResult *FilerPostResult, replyerr error, uncommittedChunks []*filer_pb.FileChunk) {
+	uncommittedChunks = fileChunks
 
 	// detect file mode
 	modeStr := r.URL.Query().Get("mode")
@@ -245,20 +274,7 @@ func (fs *FilerServer) saveMetaData(ctx context.Context, r *http.Request, fileNa
 
 	// fix the path
 	path := fs.fixFilePath(ctx, r, fileName)
-
-	// Commit under the entry lock so plain HTTP overwrites serialize with
-	// gRPC writers, renames, and format repack on this filer; cross-filer
-	// serialization needs owner routing.
 	fullPath := util.FullPath(path)
-	pathLock := fs.entryLockTable.AcquireLock("saveMetaData", fullPath, util.ExclusiveLock)
-	defer fs.entryLockTable.ReleaseLock(fullPath, pathLock)
-
-	// recheck under the lock: WORM may have been enabled during the upload
-	if enforced, wormErr := fs.wormEnforcedForEntry(ctx, path); wormErr != nil {
-		return nil, wormErr
-	} else if enforced {
-		return nil, errors.New(constants.ErrMsgOperationNotPermitted)
-	}
 
 	var entry *filer.Entry
 	var newChunks []*filer_pb.FileChunk
@@ -266,33 +282,175 @@ func (fs *FilerServer) saveMetaData(ctx context.Context, r *http.Request, fileNa
 
 	isAppend := isAppend(r)
 	isOffsetWrite := len(fileChunks) > 0 && fileChunks[0].Offset > 0
+	var existingEntry *filer.Entry
+	var existingSnapshot *filer_pb.Entry
+	var distributedLock *cluster.LiveLock
 	// when it is an append
 	if isAppend || isOffsetWrite {
-		existingEntry, findErr := fs.filer.FindEntry(ctx, util.FullPath(path))
-		if findErr != nil && findErr != filer_pb.ErrNotFound {
-			glog.V(0).InfofCtx(ctx, "failing to find %s: %v", path, findErr)
-		}
-		entry = existingEntry
-	}
-	if entry != nil {
-		entry.Mtime = time.Now()
-		entry.Md5 = nil
-		// adjust chunk offsets
-		if isAppend {
-			for _, chunk := range fileChunks {
-				chunk.Offset += int64(entry.FileSize)
+		if fs.filer.Dlm != nil && len(fs.filer.Dlm.LockRing.GetSnapshot()) > 1 {
+			lockClient := cluster.NewLockClient(fs.grpcDialOption, fs.option.Host)
+			distributedLock = lockClient.NewBlockingLongLivedLock(path, string(fs.option.Host), 0)
+			if distributedLock == nil {
+				replyerr = fmt.Errorf("failed to acquire lock for %s; retry the request", path)
+				return
 			}
-			entry.FileSize += uint64(chunkOffset)
+			defer distributedLock.Stop()
 		}
-		newChunks = append(entry.GetChunks(), fileChunks...)
+		if fs.entryLockTable != nil {
+			pathLock := fs.entryLockTable.AcquireLock("appendEntry", fullPath, util.ExclusiveLock)
+			defer fs.entryLockTable.ReleaseLock(fullPath, pathLock)
+		}
+		var findErr error
+		existingEntry, findErr = fs.filer.FindEntry(ctx, fullPath)
+		if findErr != nil && !errors.Is(findErr, filer_pb.ErrNotFound) {
+			glog.V(0).InfofCtx(ctx, "failing to find %s: %v", path, findErr)
+			replyerr = fmt.Errorf("find entry %q: %w", path, findErr)
+			return
+		}
+		if existingEntry != nil {
+			existingSnapshot = existingEntry.ToProtoEntry()
+			entry = cloneEntryForAppend(existingEntry)
+		}
+	} else if fs.entryLockTable != nil {
+		// Commit under the entry lock so plain HTTP overwrites serialize with
+		// gRPC writers, renames, and format repack on this filer; cross-filer
+		// serialization needs owner routing. The lock table is not reentrant,
+		// so appends take it above under the append intention instead.
+		pathLock := fs.entryLockTable.AcquireLock("saveMetaData", fullPath, util.ExclusiveLock)
+		defer fs.entryLockTable.ReleaseLock(fullPath, pathLock)
+	}
 
-		// TODO
-		if len(entry.Content) > 0 {
-			replyerr = fmt.Errorf("append to small file is not supported yet")
+	// recheck under the lock: WORM may have been enabled during the upload
+	if enforced, wormErr := fs.wormEnforcedForEntry(ctx, path); wormErr != nil {
+		return nil, wormErr, nil
+	} else if enforced {
+		return nil, errors.New(constants.ErrMsgOperationNotPermitted), nil
+	}
+
+	inlineAppendHandled := false
+	inlineAppendConverted := false
+	if entry != nil {
+		inlineCandidate := len(entry.Content) > 0 ||
+			(isAppend && entry.FileSize == 0 && entry.Remote == nil && len(entry.HardLinkId) == 0 && len(entry.GetChunks()) == 0)
+		if isAppend && content != nil && !inlineCandidate {
+			if so.SaveInside {
+				replyerr = errors.New(constants.ErrMsgAppendSaveInsideChunked)
+				return
+			}
+			replyerr = fmt.Errorf("inline file changed while preparing append; retry the request")
 			return
 		}
 
+		if inlineCandidate {
+			if isOffsetWrite {
+				// TODO: support inline offset writes separately from append semantics.
+				replyerr = errors.New(constants.ErrMsgOffsetWriteInline)
+				return
+			}
+			if !isAppend || so.SaveInside || entry.Remote != nil || len(entry.HardLinkId) != 0 || len(entry.GetChunks()) != 0 {
+				replyerr = errors.New(constants.ErrMsgAppendInlineMode)
+				return
+			}
+			if entry.FileSize > uint64(len(entry.Content)) {
+				replyerr = fmt.Errorf("inline file %q has inconsistent size: metadata=%d content=%d", path, entry.FileSize, len(entry.Content))
+				return
+			}
+
+			entry.Mtime = time.Now()
+			entry.Md5 = nil
+			oldContentSize := int64(len(entry.Content))
+
+			switch {
+			case content != nil:
+				if int64(len(content)) != chunkOffset || len(fileChunks) != 0 {
+					replyerr = fmt.Errorf("invalid buffered inline append: size=%d offset=%d chunks=%d", len(content), chunkOffset, len(fileChunks))
+					return
+				}
+				combinedSize := oldContentSize + int64(len(content))
+				if len(content) == 0 || (fs.option.SaveToFilerLimit > 0 && combinedSize < fs.option.SaveToFilerLimit) {
+					combinedContent := make([]byte, 0, combinedSize)
+					combinedContent = append(combinedContent, entry.Content...)
+					combinedContent = append(combinedContent, content...)
+					entry.Content = combinedContent
+					entry.Chunks = nil
+					entry.FileSize = uint64(combinedSize)
+					entry.Md5 = util.Md5(combinedContent)
+					newChunks = nil
+					inlineAppendHandled = true
+				} else {
+					// The file grew after the upload path chose inline buffering. Promote
+					// the complete current file and this append as one chunk stream.
+					combinedContent := make([]byte, 0, combinedSize)
+					combinedContent = append(combinedContent, entry.Content...)
+					combinedContent = append(combinedContent, content...)
+					fileChunks, _, chunkOffset, replyerr, _ = fs.uploadReaderToChunks(ctx, r, bytes.NewReader(combinedContent), 0, chunkSize, fileName, contentType, true, so)
+					if replyerr != nil {
+						return
+					}
+					if chunkOffset != combinedSize {
+						uncommittedChunks = fileChunks
+						replyerr = fmt.Errorf("promoted inline append size mismatch: uploaded=%d expected=%d", chunkOffset, combinedSize)
+						return
+					}
+					entry.Content = nil
+					entry.FileSize = uint64(chunkOffset)
+					newChunks = fileChunks
+					uncommittedChunks = fileChunks
+					inlineAppendHandled = true
+					inlineAppendConverted = true
+				}
+			case len(fileChunks) > 0:
+				prefixChunks, _, prefixOffset, uploadErr, _ := fs.uploadReaderToChunks(ctx, r, bytes.NewReader(entry.Content), 0, chunkSize, fileName, contentType, true, so)
+				if uploadErr != nil {
+					replyerr = uploadErr
+					return
+				}
+				uncommittedChunks = append(append([]*filer_pb.FileChunk(nil), fileChunks...), prefixChunks...)
+				if prefixOffset != oldContentSize {
+					replyerr = fmt.Errorf("converted inline content size mismatch: uploaded=%d expected=%d", prefixOffset, oldContentSize)
+					return
+				}
+				for _, chunk := range fileChunks {
+					chunk.Offset += oldContentSize
+				}
+				newChunks = append(append([]*filer_pb.FileChunk(nil), prefixChunks...), fileChunks...)
+				entry.Content = nil
+				entry.FileSize = uint64(oldContentSize) + uint64(chunkOffset)
+				inlineAppendHandled = true
+				inlineAppendConverted = true
+				uncommittedChunks = newChunks
+			case chunkOffset == 0:
+				// An empty append must not migrate an inline file, even if the
+				// current threshold is disabled or lower than the file's size.
+				entry.FileSize = uint64(oldContentSize)
+				entry.Md5 = util.Md5(entry.Content)
+				newChunks = nil
+				inlineAppendHandled = true
+			default:
+				replyerr = fmt.Errorf("inline append has no content or uploaded chunks")
+				return
+			}
+		}
+
+		if !inlineAppendHandled {
+			entry.Mtime = time.Now()
+			entry.Md5 = nil
+			// New request chunks start at offset zero; append them after the
+			// existing chunk-backed file.
+			if isAppend {
+				for _, chunk := range fileChunks {
+					chunk.Offset += int64(entry.FileSize)
+				}
+				entry.FileSize += uint64(chunkOffset)
+			}
+			newChunks = append(append([]*filer_pb.FileChunk(nil), entry.GetChunks()...), fileChunks...)
+		}
+
 	} else {
+		if isAppend && !so.SaveInside && content != nil {
+			replyerr = fmt.Errorf("inline append target disappeared while uploading; retry the request")
+			return
+		}
 		glog.V(4).InfolnCtx(ctx, "saving", path)
 		newChunks = fileChunks
 		entry = &filer.Entry{
@@ -318,13 +476,22 @@ func (fs *FilerServer) saveMetaData(ctx context.Context, r *http.Request, fileNa
 		glog.V(0).InfofCtx(ctx, "merge chunks %s: %v", r.RequestURI, replyerr)
 		mergedChunks = newChunks
 	}
+	if inlineAppendConverted {
+		uncommittedChunks = mergedChunks
+	}
 
 	// maybe compact entry chunks
-	mergedChunks, replyerr = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), mergedChunks)
+	mergedChunks, replyerr = filer.MaybeManifestize(fs.saveAsChunk(ctx, so), fs.filer.DeleteChunksNotRecursive, mergedChunks)
 	if replyerr != nil {
 		glog.V(0).InfofCtx(ctx, "manifestize %s: %v", r.RequestURI, replyerr)
+		if inlineAppendConverted {
+			uncommittedChunks = mergedChunks
+		}
 		return
 	}
+	if inlineAppendConverted {
+		uncommittedChunks = mergedChunks
+	}
 	entry.Chunks = mergedChunks
 	if isOffsetWrite {
 		entry.Md5 = nil
@@ -344,6 +511,9 @@ func (fs *FilerServer) saveMetaData(ctx context.Context, r *http.Request, fileNa
 	}
 	for k, v := range r.Header {
 		if len(v) > 0 && len(v[0]) > 0 {
+			if k == filer.ExtRemoteRenameSourceKey {
+				continue // set by the filer only: it picks the remote key reads serve
+			}
 			if strings.HasPrefix(k, needle.PairNamePrefix) || k == "Cache-Control" || k == "Expires" || k == "Content-Disposition" {
 				entry.Extended[k] = []byte(v[0])
 			}
@@ -353,13 +523,79 @@ func (fs *FilerServer) saveMetaData(ctx context.Context, r *http.Request, fileNa
 		}
 	}
 
+	if isAppend || isOffsetWrite {
+		if distributedLock != nil && !distributedLock.IsLocked() {
+			replyerr = fmt.Errorf("lost distributed lock for %s; retry the request", path)
+			return
+		}
+		freshEntry, freshErr := fs.filer.FindEntry(ctx, util.FullPath(path))
+		if freshErr != nil && !errors.Is(freshErr, filer_pb.ErrNotFound) {
+			replyerr = fmt.Errorf("failed to recheck entry %q before write: %w", path, freshErr)
+			return
+		}
+		sameEntry := freshEntry == nil && existingSnapshot == nil ||
+			freshEntry != nil && existingSnapshot != nil &&
+				proto.Equal(existingSnapshot, freshEntry.ToProtoEntry())
+		if !sameEntry {
+			replyerr = fmt.Errorf("entry %s changed during append; retry the request", path)
+			return
+		}
+	}
+
 	dbErr := fs.filer.CreateEntry(context.WithoutCancel(ctx), entry, nil, false, false, nil, skipCheckParentDirEntry(r), so.MaxFileNameLength)
 	if dbErr != nil {
 		replyerr = dbErr
 		filerResult.Error = dbErr.Error()
 		glog.V(0).InfofCtx(ctx, "failing to write %s to filer server : %v", path, dbErr)
+		if inlineAppendConverted {
+			uncommittedChunks = fs.inlineAppendChunksNotReferenced(ctx, util.FullPath(path), mergedChunks)
+		}
+	} else {
+		uncommittedChunks = nil
 	}
-	return filerResult, replyerr
+	return
+}
+
+func cloneEntryForAppend(entry *filer.Entry) *filer.Entry {
+	cloned := entry.ShallowClone()
+	cloned.Attr.Md5 = append([]byte(nil), entry.Md5...)
+	cloned.Attr.GroupNames = append([]string(nil), entry.GroupNames...)
+	cloned.Chunks = append([]*filer_pb.FileChunk(nil), entry.GetChunks()...)
+	cloned.Content = append([]byte(nil), entry.Content...)
+	cloned.WORMEnforcedAtTsNs = entry.WORMEnforcedAtTsNs
+	if entry.Extended != nil {
+		cloned.Extended = make(map[string][]byte, len(entry.Extended))
+		for key, value := range entry.Extended {
+			cloned.Extended[key] = append([]byte(nil), value...)
+		}
+	}
+	return cloned
+}
+
+func (fs *FilerServer) inlineAppendChunksNotReferenced(ctx context.Context, path util.FullPath, chunks []*filer_pb.FileChunk) []*filer_pb.FileChunk {
+	verifyCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+	defer cancel()
+
+	entry, err := fs.filer.FindEntry(verifyCtx, path)
+	if err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		glog.V(0).InfofCtx(verifyCtx, "cannot verify inline append chunks for %s after metadata write failure: %v; retaining them", path, err)
+		return nil
+	}
+
+	referenced := make(map[string]struct{})
+	if entry != nil {
+		for _, chunk := range entry.GetChunks() {
+			referenced[chunk.GetFileIdString()] = struct{}{}
+		}
+	}
+
+	var unreferenced []*filer_pb.FileChunk
+	for _, chunk := range chunks {
+		if _, found := referenced[chunk.GetFileIdString()]; !found {
+			unreferenced = append(unreferenced, chunk)
+		}
+	}
+	return unreferenced
 }
 
 func (fs *FilerServer) saveAsChunk(ctx context.Context, so *operation.StorageOption) filer.SaveDataAsChunkFunctionType {
diff --git a/weed/server/filer_server_handlers_write_autochunk_inline_append_test.go b/weed/server/filer_server_handlers_write_autochunk_inline_append_test.go
new file mode 100644
index 0000000000..21cb9358e6
--- /dev/null
+++ b/weed/server/filer_server_handlers_write_autochunk_inline_append_test.go
@@ -0,0 +1,1218 @@
+package weed_server
+
+import (
+	"bytes"
+	"context"
+	"crypto/md5"
+	"errors"
+	"fmt"
+	"io"
+	"math/rand"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"sort"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func TestFilerInlineAppendStaysInlineBelowLimit(t *testing.T) {
+	ctx := context.Background()
+	const (
+		filePath = "/append.txt"
+		limit    = int64(12)
+	)
+	oldContent := []byte("old-")
+	appendContent := []byte("new-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	originalExtended := map[string][]byte{"X-Existing": []byte("preserved")}
+	entry := &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			Mode:     0640,
+			Uid:      123,
+			Gid:      456,
+			FileSize: uint64(len(oldContent)),
+		},
+		Extended: originalExtended,
+		Content:  append([]byte(nil), oldContent...),
+	}
+	if err := store.InsertEntry(ctx, entry); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+
+	fs := &FilerServer{
+		filer: f,
+		option: &FilerOption{
+			SaveToFilerLimit: limit,
+			MaxMB:            1,
+		},
+	}
+	so := &operation.StorageOption{}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", bytes.NewReader(appendContent))
+	r.ContentLength = -1 // The inline decision must be based on the stream, not Content-Length.
+	r.Header.Set("Cache-Control", "max-age=60")
+
+	fileChunks, md5Hash, chunkOffset, err, smallContent := fs.uploadRequestToChunks(
+		ctx, httptest.NewRecorder(), r, r.Body, 4, "append.txt", "", -1, so,
+	)
+	if err != nil {
+		t.Fatalf("prepare append: %v", err)
+	}
+	if len(fileChunks) != 0 {
+		t.Fatalf("inline append uploaded %d chunks, want none", len(fileChunks))
+	}
+	if md5Hash == nil {
+		t.Fatal("append digest is nil")
+	}
+	if chunkOffset != int64(len(appendContent)) {
+		t.Fatalf("append size = %d, want %d", chunkOffset, len(appendContent))
+	}
+	if !bytes.Equal(smallContent, appendContent) {
+		t.Fatalf("buffered append = %q, want %q", smallContent, appendContent)
+	}
+
+	result, err, cleanupChunks := fs.saveMetaData(ctx, r, "append.txt", "", so, 4, md5Hash.Sum(nil), fileChunks, chunkOffset, smallContent)
+	if err != nil {
+		t.Fatalf("save appended entry: %v", err)
+	}
+	if len(cleanupChunks) != 0 {
+		t.Fatalf("successful append returned uncommitted chunks: %#v", cleanupChunks)
+	}
+	if result == nil || result.Size != int64(len(oldContent)+len(appendContent)) {
+		t.Fatalf("result = %#v, want size %d", result, len(oldContent)+len(appendContent))
+	}
+
+	updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find updated entry: %v", err)
+	}
+	wantContent := append(append([]byte(nil), oldContent...), appendContent...)
+	if !bytes.Equal(updated.Content, wantContent) {
+		t.Fatalf("stored content = %q, want %q", updated.Content, wantContent)
+	}
+	if len(updated.Chunks) != 0 {
+		t.Fatalf("stored %d chunks for below-limit append, want inline content", len(updated.Chunks))
+	}
+	if updated.FileSize != uint64(len(wantContent)) {
+		t.Fatalf("file size = %d, want %d", updated.FileSize, len(wantContent))
+	}
+	if string(updated.Extended["X-Existing"]) != "preserved" {
+		t.Fatalf("existing extended attribute was lost: %#v", updated.Extended)
+	}
+	if string(updated.Extended["Cache-Control"]) != "max-age=60" {
+		t.Fatalf("request extended attribute was not saved: %#v", updated.Extended)
+	}
+	if _, mutated := originalExtended["Cache-Control"]; mutated {
+		t.Fatalf("the original entry's extended attributes were mutated: %#v", originalExtended)
+	}
+	if updated.Mtime.Equal(time.Unix(1, 0)) {
+		t.Fatal("mtime was not updated")
+	}
+}
+
+func TestFilerInlineAppendEmptyKeepsInlineContent(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	oldContent := []byte("old-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+
+	// The current threshold is below the existing file size. An empty append
+	// must not migrate the file merely because it is now over that threshold.
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 3, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", bytes.NewReader(nil))
+	fileChunks, md5Hash, chunkOffset, err, smallContent := fs.uploadRequestToChunks(
+		ctx, httptest.NewRecorder(), r, r.Body, 4, "append.txt", "", 0, &operation.StorageOption{},
+	)
+	if err != nil {
+		t.Fatalf("prepare empty append: %v", err)
+	}
+	if len(fileChunks) != 0 || smallContent == nil || len(smallContent) != 0 {
+		t.Fatalf("empty append upload state: chunks=%d content=%#v", len(fileChunks), smallContent)
+	}
+	if md5Hash == nil || chunkOffset != 0 {
+		t.Fatalf("empty append digest/size = %v/%d, want non-nil digest and size 0", md5Hash, chunkOffset)
+	}
+
+	if _, err, cleanupChunks := fs.saveMetaData(ctx, r, "append.txt", "", &operation.StorageOption{}, 4, md5Hash.Sum(nil), fileChunks, chunkOffset, smallContent); err != nil {
+		t.Fatalf("save empty append: %v", err)
+	} else if len(cleanupChunks) != 0 {
+		t.Fatalf("empty append returned cleanup chunks: %#v", cleanupChunks)
+	}
+	updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find updated entry: %v", err)
+	}
+	if !bytes.Equal(updated.Content, oldContent) || len(updated.Chunks) != 0 || updated.FileSize != uint64(len(oldContent)) {
+		t.Fatalf("empty append changed storage representation: content=%q chunks=%d size=%d", updated.Content, len(updated.Chunks), updated.FileSize)
+	}
+}
+
+func TestFilerInlineAppendRejectsPromotionWithoutChunkSize(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	oldContent := []byte("old-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 8, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", strings.NewReader("new-"))
+	chunks, _, _, err, smallContent := fs.uploadRequestToChunks(
+		ctx, httptest.NewRecorder(), r, r.Body, 0, "append.txt", "", -1, &operation.StorageOption{},
+	)
+	if err == nil || !strings.Contains(err.Error(), "invalid chunk size 0") {
+		t.Fatalf("promotion error = %v, want invalid chunk size", err)
+	}
+	if len(chunks) != 0 || smallContent != nil {
+		t.Fatalf("invalid promotion returned data: chunks=%d inline=%q", len(chunks), smallContent)
+	}
+	unchanged, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find original entry: %v", err)
+	}
+	if !bytes.Equal(unchanged.Content, oldContent) {
+		t.Fatalf("invalid promotion changed original content: %q", unchanged.Content)
+	}
+}
+
+func TestFilerInlineAppendMultipartPostStaysInline(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	oldContent := []byte("old-")
+	appendContent := []byte("new-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+
+	var body bytes.Buffer
+	multipartWriter := multipart.NewWriter(&body)
+	part, err := multipartWriter.CreateFormFile("file", "append.txt")
+	if err != nil {
+		t.Fatalf("create multipart file part: %v", err)
+	}
+	if _, err = part.Write(appendContent); err != nil {
+		t.Fatalf("write multipart file part: %v", err)
+	}
+	if err = multipartWriter.Close(); err != nil {
+		t.Fatalf("close multipart body: %v", err)
+	}
+	r := httptest.NewRequest(http.MethodPost, "/?op=append", &body)
+	r.Header.Set("Content-Type", multipartWriter.FormDataContentType())
+	recorder := httptest.NewRecorder()
+	result, requestMD5, err := fs.doPostAutoChunk(ctx, recorder, r, 4, int64(body.Len()), &operation.StorageOption{})
+	if err != nil {
+		t.Fatalf("POST inline append: %v", err)
+	}
+	if result == nil || result.Size != int64(len(oldContent)+len(appendContent)) {
+		t.Fatalf("result = %#v, want size %d", result, len(oldContent)+len(appendContent))
+	}
+	wantMD5 := md5.Sum(appendContent)
+	if !bytes.Equal(requestMD5, wantMD5[:]) {
+		t.Fatalf("request MD5 = %x, want %x", requestMD5, wantMD5)
+	}
+	updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find updated entry: %v", err)
+	}
+	wantContent := append(append([]byte(nil), oldContent...), appendContent...)
+	if !bytes.Equal(updated.Content, wantContent) || len(updated.Chunks) != 0 {
+		t.Fatalf("multipart append result: content=%q chunks=%d, want inline %q", updated.Content, len(updated.Chunks), wantContent)
+	}
+}
+
+func TestFilerSaveInsideMultipartPostRecordsSize(t *testing.T) {
+	ctx := context.Background()
+	content := []byte(`{"identities":[]}`)
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	fs := &FilerServer{filer: f, option: &FilerOption{MaxMB: 1}}
+
+	var body bytes.Buffer
+	multipartWriter := multipart.NewWriter(&body)
+	part, err := multipartWriter.CreateFormFile("file", "identity.json")
+	if err != nil {
+		t.Fatalf("create multipart file part: %v", err)
+	}
+	if _, err = part.Write(content); err != nil {
+		t.Fatalf("write multipart file part: %v", err)
+	}
+	if err = multipartWriter.Close(); err != nil {
+		t.Fatalf("close multipart body: %v", err)
+	}
+	r := httptest.NewRequest(http.MethodPost, "/", &body)
+	r.Header.Set("Content-Type", multipartWriter.FormDataContentType())
+	result, requestMD5, err := fs.doPostAutoChunk(ctx, httptest.NewRecorder(), r, 4, int64(body.Len()), &operation.StorageOption{SaveInside: true})
+	if err != nil {
+		t.Fatalf("POST saveInside: %v", err)
+	}
+	if result == nil || result.Size != int64(len(content)) {
+		t.Fatalf("result = %#v, want size %d", result, len(content))
+	}
+	wantMD5 := md5.Sum(content)
+	if !bytes.Equal(requestMD5, wantMD5[:]) {
+		t.Fatalf("request MD5 = %x, want %x", requestMD5, wantMD5)
+	}
+	saved, err := f.FindEntry(ctx, "/identity.json")
+	if err != nil {
+		t.Fatalf("find saved entry: %v", err)
+	}
+	if !bytes.Equal(saved.Content, content) || saved.FileSize != uint64(len(content)) {
+		t.Fatalf("saved entry: content=%q size=%d, want %q size %d", saved.Content, saved.FileSize, content, len(content))
+	}
+	if !bytes.Equal(saved.Md5, wantMD5[:]) {
+		t.Fatalf("saved MD5 = %x, want %x", saved.Md5, wantMD5)
+	}
+}
+
+func saveInsideMultipartRequest(t *testing.T, target, fileName string, content []byte) *http.Request {
+	t.Helper()
+	var body bytes.Buffer
+	multipartWriter := multipart.NewWriter(&body)
+	part, err := multipartWriter.CreateFormFile("file", fileName)
+	if err != nil {
+		t.Fatalf("create multipart file part: %v", err)
+	}
+	if _, err = part.Write(content); err != nil {
+		t.Fatalf("write multipart file part: %v", err)
+	}
+	if err = multipartWriter.Close(); err != nil {
+		t.Fatalf("close multipart body: %v", err)
+	}
+	r := httptest.NewRequest(http.MethodPost, target, &body)
+	r.Header.Set("Content-Type", multipartWriter.FormDataContentType())
+	return r
+}
+
+func TestFilerSaveInsideMultipartPostRejectsBadDigest(t *testing.T) {
+	ctx := context.Background()
+	content := []byte(`{"identities":[]}`)
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	fs := &FilerServer{filer: f, option: &FilerOption{MaxMB: 1}}
+
+	r := saveInsideMultipartRequest(t, "/", "identity.json", content)
+	r.Header.Set("Content-Md5", util.Base64Encode([]byte("not the digest")))
+	if _, _, err := fs.doPostAutoChunk(ctx, httptest.NewRecorder(), r, 4, r.ContentLength, &operation.StorageOption{SaveInside: true}); err == nil || !strings.Contains(err.Error(), "Content-Md5") {
+		t.Fatalf("POST saveInside error = %v, want bad Content-MD5 error", err)
+	}
+	if _, err := f.FindEntry(ctx, "/identity.json"); !errors.Is(err, filer_pb.ErrNotFound) {
+		t.Fatalf("bad digest still saved the entry: %v", err)
+	}
+}
+
+func TestFilerSaveInsideMultipartAppendRejected(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append-target.txt"
+	appendContent := []byte("new")
+
+	t.Run("chunk backed target", func(t *testing.T) {
+		oldChunk := &filer_pb.FileChunk{FileId: "1,00000001", Offset: 0, Size: 4}
+		store := newRenameTestStore()
+		f := newRenameTestFiler(t, store)
+		if err := store.InsertEntry(ctx, &filer.Entry{
+			FullPath: util.FullPath(filePath),
+			Attr: filer.Attr{
+				Mtime:    time.Unix(1, 0),
+				Crtime:   time.Unix(1, 0),
+				FileSize: 4,
+			},
+			Chunks: []*filer_pb.FileChunk{oldChunk},
+		}); err != nil {
+			t.Fatalf("insert chunk-backed entry: %v", err)
+		}
+
+		fs := &FilerServer{filer: f, option: &FilerOption{MaxMB: 1}}
+		r := saveInsideMultipartRequest(t, filePath+"?op=append", "append-target.txt", appendContent)
+		if _, _, err := fs.doPostAutoChunk(ctx, httptest.NewRecorder(), r, 4, r.ContentLength, &operation.StorageOption{SaveInside: true}); err == nil {
+			t.Fatal("saveInside append to chunk-backed entry succeeded")
+		}
+		recorder := httptest.NewRecorder()
+		r = saveInsideMultipartRequest(t, filePath+"?op=append", "append-target.txt", appendContent)
+		fs.autoChunk(ctx, recorder, r, r.ContentLength, &operation.StorageOption{SaveInside: true})
+		if recorder.Code != http.StatusBadRequest {
+			t.Fatalf("rejected saveInside append status = %d, want %d", recorder.Code, http.StatusBadRequest)
+		}
+		unchanged, err := f.FindEntry(ctx, util.FullPath(filePath))
+		if err != nil {
+			t.Fatalf("find entry after rejected append: %v", err)
+		}
+		if unchanged.FileSize != 4 || len(unchanged.Chunks) != 1 || len(unchanged.Content) != 0 {
+			t.Fatalf("rejected append changed entry: size=%d chunks=%d content=%q", unchanged.FileSize, len(unchanged.Chunks), unchanged.Content)
+		}
+	})
+
+	t.Run("inline target", func(t *testing.T) {
+		oldContent := []byte("old-")
+		store := newRenameTestStore()
+		f := newRenameTestFiler(t, store)
+		if err := store.InsertEntry(ctx, &filer.Entry{
+			FullPath: util.FullPath(filePath),
+			Attr: filer.Attr{
+				Mtime:    time.Unix(1, 0),
+				Crtime:   time.Unix(1, 0),
+				FileSize: uint64(len(oldContent)),
+			},
+			Content: append([]byte(nil), oldContent...),
+		}); err != nil {
+			t.Fatalf("insert inline entry: %v", err)
+		}
+
+		fs := &FilerServer{filer: f, option: &FilerOption{MaxMB: 1}}
+		r := saveInsideMultipartRequest(t, filePath+"?op=append", "append-target.txt", appendContent)
+		if _, _, err := fs.doPostAutoChunk(ctx, httptest.NewRecorder(), r, 4, r.ContentLength, &operation.StorageOption{SaveInside: true}); err == nil {
+			t.Fatal("saveInside append to inline entry succeeded")
+		}
+		recorder := httptest.NewRecorder()
+		r = saveInsideMultipartRequest(t, filePath+"?op=append", "append-target.txt", appendContent)
+		fs.autoChunk(ctx, recorder, r, r.ContentLength, &operation.StorageOption{SaveInside: true})
+		if recorder.Code != http.StatusBadRequest {
+			t.Fatalf("rejected saveInside append status = %d, want %d", recorder.Code, http.StatusBadRequest)
+		}
+		unchanged, err := f.FindEntry(ctx, util.FullPath(filePath))
+		if err != nil {
+			t.Fatalf("find entry after rejected append: %v", err)
+		}
+		if !bytes.Equal(unchanged.Content, oldContent) || unchanged.FileSize != uint64(len(oldContent)) {
+			t.Fatalf("rejected append changed entry: content=%q size=%d", unchanged.Content, unchanged.FileSize)
+		}
+	})
+}
+
+func TestFilerInlineOffsetWriteRemainsUnsupported(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/offset.txt"
+	oldContent := []byte("keep")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?offset=1", bytes.NewReader([]byte("X")))
+	_, err, _ := fs.saveMetaData(ctx, r, "offset.txt", "", &operation.StorageOption{}, 4, nil, []*filer_pb.FileChunk{{Offset: 1, Size: 1}}, 2, nil)
+	if err == nil || !strings.Contains(err.Error(), "offset write to inline small file is not supported") {
+		t.Fatalf("offset write error = %v, want explicit unsupported error", err)
+	}
+	unchanged, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find original entry: %v", err)
+	}
+	if !bytes.Equal(unchanged.Content, oldContent) || unchanged.FileSize != uint64(len(oldContent)) {
+		t.Fatalf("unsupported offset write changed entry: content=%q size=%d", unchanged.Content, unchanged.FileSize)
+	}
+}
+
+func TestFilerInlineAppendReadErrorKeepsOriginalEntry(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	oldContent := []byte("old-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", nil)
+	fileChunks, _, _, err, smallContent := fs.uploadRequestToChunks(
+		ctx, httptest.NewRecorder(), r, &inlineAppendReadError{}, 4, "append.txt", "", -1, &operation.StorageOption{},
+	)
+	if err == nil || !strings.Contains(err.Error(), "read input: injected read failure") {
+		t.Fatalf("read error = %v, want propagated input read failure", err)
+	}
+	if len(fileChunks) != 0 || smallContent != nil {
+		t.Fatalf("failed read produced chunks/content: chunks=%d content=%q", len(fileChunks), smallContent)
+	}
+	unchanged, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find original entry: %v", err)
+	}
+	if !bytes.Equal(unchanged.Content, oldContent) {
+		t.Fatalf("failed read changed original content: %q", unchanged.Content)
+	}
+}
+
+type inlineAppendReadError struct {
+	readData bool
+}
+
+func (r *inlineAppendReadError) Read(p []byte) (int, error) {
+	if r.readData {
+		return 0, errors.New("injected read failure")
+	}
+	r.readData = true
+	return copy(p, []byte("new-")), nil
+}
+
+func TestFilerInlineAppendBadDigestKeepsOriginalEntry(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	oldContent := []byte("old-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", strings.NewReader("new-"))
+	r.Header.Set("Content-MD5", "not-the-correct-digest")
+	_, _, err := fs.doPutAutoChunk(ctx, httptest.NewRecorder(), r, 4, 4, &operation.StorageOption{})
+	if err == nil || !strings.Contains(err.Error(), "Content-Md5") {
+		t.Fatalf("PUT error = %v, want bad Content-MD5 error", err)
+	}
+	unchanged, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find original entry: %v", err)
+	}
+	if !bytes.Equal(unchanged.Content, oldContent) || len(unchanged.Chunks) != 0 {
+		t.Fatalf("bad digest changed original entry: content=%q chunks=%d", unchanged.Content, len(unchanged.Chunks))
+	}
+}
+
+func TestFilerChunkAppendStillOffsetsNewChunks(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/chunked.txt"
+	oldChunk := &filer_pb.FileChunk{FileId: "1,00000001", Offset: 0, Size: 4}
+	newChunk := &filer_pb.FileChunk{FileId: "1,00000002", Offset: 0, Size: 3}
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: 4,
+		},
+		Chunks: []*filer_pb.FileChunk{oldChunk},
+	}); err != nil {
+		t.Fatalf("insert chunk-backed entry: %v", err)
+	}
+
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", strings.NewReader("new"))
+	result, err, cleanupChunks := fs.saveMetaData(ctx, r, "chunked.txt", "", &operation.StorageOption{}, 4, nil, []*filer_pb.FileChunk{newChunk}, 3, nil)
+	if err != nil {
+		t.Fatalf("append to chunk-backed entry: %v", err)
+	}
+	if len(cleanupChunks) != 0 {
+		t.Fatalf("successful chunk append returned cleanup chunks: %#v", cleanupChunks)
+	}
+	updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find updated entry: %v", err)
+	}
+	if result == nil || result.Size != 7 || updated.FileSize != 7 || len(updated.Chunks) != 2 {
+		t.Fatalf("append result=%#v entry-size=%d chunks=%d, want size 7 and two chunks", result, updated.FileSize, len(updated.Chunks))
+	}
+	if updated.Chunks[0].Offset != 0 || updated.Chunks[0].GetFileIdString() != oldChunk.GetFileIdString() || updated.Chunks[1].Offset != 4 || updated.Chunks[1].GetFileIdString() != newChunk.GetFileIdString() {
+		t.Fatalf("chunk append metadata = %#v, want offsets 0 and 4 with old and new file IDs", updated.Chunks)
+	}
+}
+
+func TestFilerInlineAppendPromotesAtLimit(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		appendContent string
+		failStore     bool
+		failVerify    bool
+	}{
+		{name: "exactly reaches limit", appendContent: "new-"},
+		{name: "crosses limit", appendContent: "new!!"},
+		{name: "metadata write fails", appendContent: "new-", failStore: true},
+		{name: "metadata result cannot be verified", appendContent: "new-", failStore: true, failVerify: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := context.Background()
+			const (
+				filePath = "/append.txt"
+				limit    = int64(8)
+			)
+			oldContent := []byte("old-")
+			appendContent := []byte(tc.appendContent)
+			store := newRenameTestStore()
+			f := newRenameTestFiler(t, store)
+			if err := store.InsertEntry(ctx, &filer.Entry{
+				FullPath: util.FullPath(filePath),
+				Attr: filer.Attr{
+					Mtime:    time.Unix(1, 0),
+					Crtime:   time.Unix(1, 0),
+					Mode:     0640,
+					FileSize: uint64(len(oldContent)),
+				},
+				Content: append([]byte(nil), oldContent...),
+			}); err != nil {
+				t.Fatalf("insert inline entry: %v", err)
+			}
+
+			fs, uploadedChunks := newInlineAppendUploadServer(t, f, limit, 4)
+			r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", bytes.NewReader(appendContent))
+			r.ContentLength = -1
+			fileChunks, md5Hash, chunkOffset, err, smallContent := fs.uploadRequestToChunks(
+				ctx, httptest.NewRecorder(), r, r.Body, 4, "append.txt", "", -1, &operation.StorageOption{},
+			)
+			if err != nil {
+				t.Fatalf("prepare append: %v", err)
+			}
+			if len(fileChunks) == 0 {
+				t.Fatal("append reaching the inline limit was not uploaded as chunks")
+			}
+			if smallContent != nil {
+				t.Fatalf("append reaching the inline limit was buffered as inline content: %q", smallContent)
+			}
+			if chunkOffset != int64(len(appendContent)) {
+				t.Fatalf("append size = %d, want %d", chunkOffset, len(appendContent))
+			}
+			wantAppendMD5 := md5.Sum(appendContent)
+			if got := md5Hash.Sum(nil); !bytes.Equal(got, wantAppendMD5[:]) {
+				t.Fatalf("append MD5 = %x, want %x", got, wantAppendMD5)
+			}
+
+			if tc.failVerify {
+				f.Store = filer.NewFilerStoreWrapper(&inlineAppendUncertainUpdateStore{
+					renameTestStore: store,
+					err:             errors.New("injected ambiguous metadata update failure"),
+				})
+			} else if tc.failStore {
+				f.Store = filer.NewFilerStoreWrapper(&inlineAppendFailUpdateStore{
+					renameTestStore: store,
+					err:             errors.New("injected metadata update failure"),
+				})
+			}
+
+			result, err, cleanupChunks := fs.saveMetaData(ctx, r, "append.txt", "", &operation.StorageOption{}, 4, md5Hash.Sum(nil), fileChunks, chunkOffset, smallContent)
+			if tc.failStore {
+				if err == nil {
+					t.Fatal("save appended entry succeeded despite injected metadata failure")
+				}
+				if tc.failVerify {
+					if len(cleanupChunks) != 0 {
+						t.Fatalf("unverified metadata state returned %d chunks for deletion, want retain all", len(cleanupChunks))
+					}
+				} else if len(cleanupChunks) != len(fileChunks)+1 {
+					t.Fatalf("cleanup chunk count = %d, want uploaded append chunks %d plus one converted prefix chunk", len(cleanupChunks), len(fileChunks))
+				}
+				for _, chunk := range cleanupChunks {
+					if _, found := uploadedChunks.get(chunk.GetFileIdString()); !found {
+						t.Fatalf("cleanup includes chunk %s without uploaded data", chunk.GetFileIdString())
+					}
+				}
+				unchanged, findErr := store.FindEntry(ctx, util.FullPath(filePath))
+				if findErr != nil {
+					t.Fatalf("find original entry after failed update: %v", findErr)
+				}
+				if !bytes.Equal(unchanged.Content, oldContent) || len(unchanged.Chunks) != 0 {
+					t.Fatalf("failed update changed original entry: content=%q chunks=%d", unchanged.Content, len(unchanged.Chunks))
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("save appended entry: %v", err)
+			}
+			if len(cleanupChunks) != 0 {
+				t.Fatalf("successful append returned uncommitted chunks: %#v", cleanupChunks)
+			}
+
+			updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+			if err != nil {
+				t.Fatalf("find updated entry: %v", err)
+			}
+			if len(updated.Content) != 0 {
+				t.Fatalf("promoted entry still has inline content %q", updated.Content)
+			}
+			if len(updated.Chunks) == 0 {
+				t.Fatal("promoted entry has no chunks")
+			}
+			wantContent := append(append([]byte(nil), oldContent...), appendContent...)
+			if result == nil || result.Size != int64(len(wantContent)) {
+				t.Fatalf("result = %#v, want size %d", result, len(wantContent))
+			}
+			if updated.FileSize != uint64(len(wantContent)) {
+				t.Fatalf("file size = %d, want %d", updated.FileSize, len(wantContent))
+			}
+
+			sort.Slice(updated.Chunks, func(i, j int) bool {
+				return updated.Chunks[i].Offset < updated.Chunks[j].Offset
+			})
+			var gotContent []byte
+			for _, chunk := range updated.Chunks {
+				if chunk.Offset != int64(len(gotContent)) {
+					t.Fatalf("chunk %s starts at %d, want contiguous offset %d", chunk.FileId, chunk.Offset, len(gotContent))
+				}
+				data, found := uploadedChunks.get(chunk.GetFileIdString())
+				if !found {
+					t.Fatalf("no uploaded data for chunk %s", chunk.GetFileIdString())
+				}
+				if uint64(len(data)) != chunk.Size {
+					t.Fatalf("chunk %s metadata size = %d, uploaded size = %d", chunk.FileId, chunk.Size, len(data))
+				}
+				gotContent = append(gotContent, data...)
+			}
+			if !bytes.Equal(gotContent, wantContent) {
+				t.Fatalf("chunk data = %q, want %q", gotContent, wantContent)
+			}
+		})
+	}
+}
+
+func TestFilerInlineAppendRealThresholdBoundaries(t *testing.T) {
+	const (
+		filePath = "/append-boundary.bin"
+		limit    = 65536
+		oldSize  = 4096
+	)
+	for _, finalSize := range []int{limit - 1, limit, limit + 1} {
+		t.Run(fmt.Sprintf("final_size_%d", finalSize), func(t *testing.T) {
+			ctx := context.Background()
+			oldContent := inlineAppendTestBytes(oldSize, 1)
+			appendContent := inlineAppendTestBytes(finalSize-oldSize, 2)
+			store := newRenameTestStore()
+			f := newRenameTestFiler(t, store)
+			if err := store.InsertEntry(ctx, &filer.Entry{
+				FullPath: util.FullPath(filePath),
+				Attr: filer.Attr{
+					Mtime:    time.Unix(1, 0),
+					Crtime:   time.Unix(1, 0),
+					FileSize: uint64(len(oldContent)),
+				},
+				Content: oldContent,
+			}); err != nil {
+				t.Fatalf("insert inline entry: %v", err)
+			}
+
+			fs, uploaded := newInlineAppendUploadServer(t, f, limit, 1)
+			r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", bytes.NewReader(appendContent))
+			r.ContentLength = -1
+			fileChunks, md5Hash, chunkOffset, err, smallContent := fs.uploadRequestToChunks(
+				ctx, httptest.NewRecorder(), r, r.Body, limit, "append-boundary.bin", "", -1, &operation.StorageOption{},
+			)
+			if err != nil {
+				t.Fatalf("prepare append: %v", err)
+			}
+			if md5Hash == nil || chunkOffset != int64(len(appendContent)) {
+				t.Fatalf("append digest/size = %v/%d, want non-nil digest and %d", md5Hash, chunkOffset, len(appendContent))
+			}
+
+			result, saveErr, cleanupChunks := fs.saveMetaData(ctx, r, "append-boundary.bin", "", &operation.StorageOption{}, limit, md5Hash.Sum(nil), fileChunks, chunkOffset, smallContent)
+			if saveErr != nil {
+				t.Fatalf("save appended entry: %v", saveErr)
+			}
+			if len(cleanupChunks) != 0 {
+				t.Fatalf("successful append returned cleanup chunks: %#v", cleanupChunks)
+			}
+			updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+			if err != nil {
+				t.Fatalf("find updated entry: %v", err)
+			}
+			if result == nil || result.Size != int64(finalSize) || updated.FileSize != uint64(finalSize) {
+				t.Fatalf("result=%#v entry size=%d, want %d", result, updated.FileSize, finalSize)
+			}
+
+			wantContent := append(append([]byte(nil), oldContent...), appendContent...)
+			if finalSize < limit {
+				if len(fileChunks) != 0 || smallContent == nil || uploaded.count() != 0 {
+					t.Fatalf("below-limit path uploaded data: chunks=%d inline=%d volume uploads=%d", len(fileChunks), len(smallContent), uploaded.count())
+				}
+				if !bytes.Equal(updated.Content, wantContent) || len(updated.Chunks) != 0 {
+					t.Fatalf("below-limit entry: content size=%d chunks=%d", len(updated.Content), len(updated.Chunks))
+				}
+				return
+			}
+
+			if smallContent != nil || len(updated.Content) != 0 || len(updated.Chunks) == 0 {
+				t.Fatalf("at/above-limit entry: inline=%d chunks=%d", len(updated.Content), len(updated.Chunks))
+			}
+			sort.Slice(updated.Chunks, func(i, j int) bool {
+				return updated.Chunks[i].Offset < updated.Chunks[j].Offset
+			})
+			var reconstructed []byte
+			for _, chunk := range updated.Chunks {
+				if chunk.Offset != int64(len(reconstructed)) {
+					t.Fatalf("chunk offset = %d, want %d", chunk.Offset, len(reconstructed))
+				}
+				data, found := uploaded.get(chunk.GetFileIdString())
+				if !found {
+					t.Fatalf("missing Volume data for %s", chunk.GetFileIdString())
+				}
+				if chunk.IsCompressed {
+					data, err = util.DecompressData(data)
+					if err != nil {
+						t.Fatalf("decompress uploaded chunk %s: %v", chunk.GetFileIdString(), err)
+					}
+				}
+				if uint64(len(data)) != chunk.Size {
+					t.Fatalf("chunk size = %d, want %d", len(data), chunk.Size)
+				}
+				reconstructed = append(reconstructed, data...)
+			}
+			if !bytes.Equal(reconstructed, wantContent) {
+				t.Fatalf("reconstructed %d bytes, want %d", len(reconstructed), len(wantContent))
+			}
+		})
+	}
+}
+
+func TestFilerInlineAppendEmptyFileStaysInline(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	appendContent := []byte("new-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:  time.Unix(1, 0),
+			Crtime: time.Unix(1, 0),
+		},
+	}); err != nil {
+		t.Fatalf("insert empty entry: %v", err)
+	}
+
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", bytes.NewReader(appendContent))
+	r.ContentLength = -1
+	fileChunks, md5Hash, chunkOffset, err, smallContent := fs.uploadRequestToChunks(
+		ctx, httptest.NewRecorder(), r, r.Body, 4, "append.txt", "", -1, &operation.StorageOption{},
+	)
+	if err != nil {
+		t.Fatalf("prepare append to empty file: %v", err)
+	}
+	if len(fileChunks) != 0 || !bytes.Equal(smallContent, appendContent) {
+		t.Fatalf("append to empty file uploaded instead of inline: chunks=%d inline=%q", len(fileChunks), smallContent)
+	}
+
+	result, err, cleanupChunks := fs.saveMetaData(ctx, r, "append.txt", "", &operation.StorageOption{}, 4, md5Hash.Sum(nil), fileChunks, chunkOffset, smallContent)
+	if err != nil {
+		t.Fatalf("save append to empty file: %v", err)
+	}
+	if len(cleanupChunks) != 0 || result == nil || result.Size != int64(len(appendContent)) {
+		t.Fatalf("append result=%#v cleanup=%d", result, len(cleanupChunks))
+	}
+	updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find updated entry: %v", err)
+	}
+	if !bytes.Equal(updated.Content, appendContent) || len(updated.Chunks) != 0 || updated.FileSize != uint64(len(appendContent)) {
+		t.Fatalf("append to empty file: content=%q chunks=%d size=%d", updated.Content, len(updated.Chunks), updated.FileSize)
+	}
+}
+
+func TestFilerInlineAppendKeepsETag(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	oldContent := []byte("old-")
+	appendContent := []byte("new-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", bytes.NewReader(appendContent))
+	r.ContentLength = -1
+	if _, err, cleanupChunks := fs.saveMetaData(ctx, r, "append.txt", "", &operation.StorageOption{}, 4, nil, nil, int64(len(appendContent)), appendContent); err != nil {
+		t.Fatalf("save inline append: %v", err)
+	} else if len(cleanupChunks) != 0 {
+		t.Fatalf("inline append returned cleanup chunks: %#v", cleanupChunks)
+	}
+	updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find updated entry: %v", err)
+	}
+	wantContent := append(append([]byte(nil), oldContent...), appendContent...)
+	wantMD5 := md5.Sum(wantContent)
+	if !bytes.Equal(updated.Md5, wantMD5[:]) {
+		t.Fatalf("entry MD5 = %x, want %x", updated.Md5, wantMD5)
+	}
+	if got, want := filer.ETagEntry(updated), fmt.Sprintf("%x", wantMD5); got != want {
+		t.Fatalf("entry ETag = %q, want %q", got, want)
+	}
+}
+
+func TestFilerInlineAppendConcurrentKeepsAllData(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	oldContent := []byte("old-")
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	f.Store = filer.NewFilerStoreWrapper(&inlineAppendSlowFindStore{renameTestStore: store, delay: 2 * time.Millisecond})
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: uint64(len(oldContent)),
+		},
+		Content: append([]byte(nil), oldContent...),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+
+	fs := &FilerServer{
+		filer:          f,
+		option:         &FilerOption{SaveToFilerLimit: 64, MaxMB: 1},
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+	markers := []string{"A1", "B2", "C3", "D4", "E5", "F6", "G7", "H8"}
+	var wg sync.WaitGroup
+	errs := make(chan error, len(markers))
+	for _, marker := range markers {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", strings.NewReader(marker))
+			_, err, _ := fs.saveMetaData(ctx, r, "append.txt", "", &operation.StorageOption{}, 4, nil, nil, int64(len(marker)), []byte(marker))
+			errs <- err
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatalf("concurrent append failed: %v", err)
+		}
+	}
+
+	updated, err := f.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find updated entry: %v", err)
+	}
+	if len(updated.Chunks) != 0 {
+		t.Fatalf("concurrent appends promoted the entry to %d chunks", len(updated.Chunks))
+	}
+	got := string(updated.Content)
+	if !strings.HasPrefix(got, string(oldContent)) {
+		t.Fatalf("concurrent append content = %q, want prefix %q", got, oldContent)
+	}
+	for _, marker := range markers {
+		if !strings.Contains(got, marker) {
+			t.Fatalf("concurrent append lost marker %q: content = %q", marker, got)
+		}
+	}
+	if updated.FileSize != uint64(len(oldContent)+len(markers)*2) {
+		t.Fatalf("final size = %d, want %d", updated.FileSize, len(oldContent)+len(markers)*2)
+	}
+}
+
+type inlineAppendSlowFindStore struct {
+	*renameTestStore
+	delay time.Duration
+}
+
+func (s *inlineAppendSlowFindStore) FindEntry(ctx context.Context, path util.FullPath) (*filer.Entry, error) {
+	time.Sleep(s.delay)
+	return s.renameTestStore.FindEntry(ctx, path)
+}
+
+type inlineAppendFailUpdateStore struct {
+	*renameTestStore
+	err error
+}
+
+func (s *inlineAppendFailUpdateStore) UpdateEntry(context.Context, *filer.Entry) error {
+	return s.err
+}
+
+type inlineAppendUncertainUpdateStore struct {
+	*renameTestStore
+	err          error
+	updateFailed atomic.Bool
+}
+
+func (s *inlineAppendUncertainUpdateStore) UpdateEntry(context.Context, *filer.Entry) error {
+	s.updateFailed.Store(true)
+	return s.err
+}
+
+func (s *inlineAppendUncertainUpdateStore) FindEntry(ctx context.Context, path util.FullPath) (*filer.Entry, error) {
+	if s.updateFailed.Load() {
+		return nil, errors.New("injected verification lookup failure")
+	}
+	return s.renameTestStore.FindEntry(ctx, path)
+}
+
+type inlineAppendVolumeData struct {
+	mu   sync.Mutex
+	data map[string][]byte
+}
+
+func (d *inlineAppendVolumeData) get(fileID string) ([]byte, bool) {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	data, ok := d.data[fileID]
+	return append([]byte(nil), data...), ok
+}
+
+func (d *inlineAppendVolumeData) count() int {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return len(d.data)
+}
+
+func inlineAppendTestBytes(length int, seed int64) []byte {
+	data := make([]byte, length)
+	_, _ = rand.New(rand.NewSource(seed)).Read(data)
+	return data
+}
+
+type inlineAppendFakeMaster struct {
+	master_pb.UnimplementedSeaweedServer
+	volumeHost string
+	nextFileID atomic.Uint32
+}
+
+func (m *inlineAppendFakeMaster) KeepConnected(stream grpc.BidiStreamingServer[master_pb.KeepConnectedRequest, master_pb.KeepConnectedResponse]) error {
+	if _, err := stream.Recv(); err != nil {
+		return err
+	}
+	if err := stream.Send(&master_pb.KeepConnectedResponse{}); err != nil {
+		return err
+	}
+	<-stream.Context().Done()
+	return stream.Context().Err()
+}
+
+func (m *inlineAppendFakeMaster) Assign(_ context.Context, _ *master_pb.AssignRequest) (*master_pb.AssignResponse, error) {
+	n := m.nextFileID.Add(1)
+	return &master_pb.AssignResponse{
+		Fid:   fmt.Sprintf("1,%08x", n),
+		Count: 1,
+		Location: &master_pb.Location{
+			Url:       m.volumeHost,
+			PublicUrl: m.volumeHost,
+		},
+	}, nil
+}
+
+func newInlineAppendUploadServer(t *testing.T, f *filer.Filer, saveToFilerLimit int64, maxMB int) (*FilerServer, *inlineAppendVolumeData) {
+	t.Helper()
+
+	uploaded := &inlineAppendVolumeData{data: make(map[string][]byte)}
+	volumeServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		multipartReader, err := r.MultipartReader()
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		part, err := multipartReader.NextPart()
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		data, err := io.ReadAll(part)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		fileID := strings.TrimPrefix(r.URL.Path, "/")
+		uploaded.mu.Lock()
+		uploaded.data[fileID] = append([]byte(nil), data...)
+		uploaded.mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusCreated)
+		_, _ = fmt.Fprintf(w, `{"name":"chunk","size":%d}`, len(data))
+	}))
+	t.Cleanup(volumeServer.Close)
+
+	volumeHost := strings.TrimPrefix(volumeServer.URL, "http://")
+	masterAddr := startFakeMasterServerForLeaderLookup(t, &inlineAppendFakeMaster{volumeHost: volumeHost})
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	masterClient := wdclient.NewMasterClient(
+		dialOption,
+		"test",
+		cluster.FilerType,
+		pb.ServerAddress("localhost:0"),
+		"",
+		"",
+		*pb.NewServiceDiscoveryFromMap(map[string]pb.ServerAddress{"master": masterAddr}),
+	)
+	f.MasterClient = masterClient
+	masterCtx, cancelMaster := context.WithCancel(context.Background())
+	t.Cleanup(cancelMaster)
+	go masterClient.KeepConnectedToMaster(masterCtx)
+
+	waitCtx, cancelWait := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancelWait()
+	if masterClient.GetMaster(waitCtx) == "" {
+		t.Fatal("fake master did not become available")
+	}
+
+	return &FilerServer{
+		filer:          f,
+		option:         &FilerOption{SaveToFilerLimit: saveToFilerLimit, MaxMB: maxMB},
+		grpcDialOption: dialOption,
+	}, uploaded
+}
+
+// inlineAppendDriftingStore commits a competing update right after the read
+// that prepares an append, before the recheck ahead of the metadata commit.
+type inlineAppendDriftingStore struct {
+	*renameTestStore
+	reads   int
+	drifted bool
+}
+
+func (s *inlineAppendDriftingStore) FindEntry(ctx context.Context, path util.FullPath) (*filer.Entry, error) {
+	entry, err := s.renameTestStore.FindEntry(ctx, path)
+	if err == nil && entry != nil {
+		s.reads++
+		if s.reads == 2 && !s.drifted {
+			s.drifted = true
+			competing := entry.ShallowClone()
+			competing.Content = append([]byte(nil), append(competing.Content, '!')...)
+			competing.FileSize = uint64(len(competing.Content))
+			if updateErr := s.renameTestStore.UpdateEntry(ctx, competing); updateErr != nil {
+				return nil, updateErr
+			}
+		}
+	}
+	return entry, err
+}
+
+func TestFilerInlineAppendRejectsEntryChangedMidWrite(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/append.txt"
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	drifting := &inlineAppendDriftingStore{renameTestStore: store}
+	f.Store = filer.NewFilerStoreWrapper(drifting)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: 4,
+		},
+		Content: []byte("old-"),
+	}); err != nil {
+		t.Fatalf("insert inline entry: %v", err)
+	}
+
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 64, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", strings.NewReader("new"))
+	if _, err, _ := fs.saveMetaData(ctx, r, "append.txt", "", &operation.StorageOption{}, 4, nil, nil, 3, []byte("new")); err == nil {
+		t.Fatal("append succeeded despite the entry changing before commit")
+	}
+
+	unchanged, err := store.FindEntry(ctx, util.FullPath(filePath))
+	if err != nil {
+		t.Fatalf("find entry after rejected append: %v", err)
+	}
+	if string(unchanged.Content) != "old-!" {
+		t.Fatalf("rejected append overwrote the competing write: %q", unchanged.Content)
+	}
+}
+
+func TestFilerChunkAppendWithExtendedHeaders(t *testing.T) {
+	ctx := context.Background()
+	const filePath = "/chunked.txt"
+	oldChunk := &filer_pb.FileChunk{FileId: "1,00000001", Offset: 0, Size: 4}
+	newChunk := &filer_pb.FileChunk{FileId: "1,00000002", Offset: 0, Size: 3}
+	store := newRenameTestStore()
+	f := newRenameTestFiler(t, store)
+	if err := store.InsertEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(filePath),
+		Attr: filer.Attr{
+			Mtime:    time.Unix(1, 0),
+			Crtime:   time.Unix(1, 0),
+			FileSize: 4,
+		},
+		Chunks:   []*filer_pb.FileChunk{oldChunk},
+		Extended: map[string][]byte{"existing": []byte("value")},
+	}); err != nil {
+		t.Fatalf("insert chunk-backed entry: %v", err)
+	}
+
+	fs := &FilerServer{filer: f, option: &FilerOption{SaveToFilerLimit: 12, MaxMB: 1}}
+	r := httptest.NewRequest(http.MethodPut, filePath+"?op=append", strings.NewReader("new"))
+	r.Header.Set("Cache-Control", "max-age=60")
+	result, err, _ := fs.saveMetaData(ctx, r, "chunked.txt", "", &operation.StorageOption{}, 4, nil, []*filer_pb.FileChunk{newChunk}, 3, nil)
+	if err != nil {
+		t.Fatalf("append with extended-attribute header: %v", err)
+	}
+	if result == nil || result.Size != 7 {
+		t.Fatalf("append result=%#v, want size 7", result)
+	}
+}
diff --git a/weed/server/filer_server_handlers_write_merge.go b/weed/server/filer_server_handlers_write_merge.go
index 24e642bd60..157d96c797 100644
--- a/weed/server/filer_server_handlers_write_merge.go
+++ b/weed/server/filer_server_handlers_write_merge.go
@@ -64,7 +64,7 @@ func (fs *FilerServer) mergeChunks(ctx context.Context, so *operation.StorageOpt
 		}
 	}
 
-	garbage, err := filer.MinusChunks(ctx, fs.lookupFileId, inputChunks, mergedChunks)
+	garbage, err := filer.MinusChunks(ctx, fs.lookupFileId, inputChunks, mergedChunks, fs.filer.MasterClient)
 	if err != nil {
 		glog.ErrorfCtx(ctx, "Failed to resolve old entry chunks when delete old entry chunks. new: %s, old: %s",
 			mergedChunks, inputChunks)
diff --git a/weed/server/filer_server_handlers_write_upload.go b/weed/server/filer_server_handlers_write_upload.go
index 3799e69b44..50647498c1 100644
--- a/weed/server/filer_server_handlers_write_upload.go
+++ b/weed/server/filer_server_handlers_write_upload.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"crypto/md5"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"hash"
 	"io"
@@ -59,6 +60,56 @@ func (fs *FilerServer) uploadRequestToChunks(ctx context.Context, w http.Respons
 		chunkOffset = offsetInt
 	}
 
+	if isAppend && !so.SaveInside {
+		fullPath := fs.fixFilePath(ctx, r, fileName)
+		entry, findErr := fs.filer.FindEntry(ctx, util.FullPath(fullPath))
+		if findErr != nil && !errors.Is(findErr, filer_pb.ErrNotFound) {
+			return nil, nil, 0, fmt.Errorf("find entry for append %q: %w", fullPath, findErr), nil
+		}
+		if findErr == nil && entry != nil && !entry.IsDirectory() && entry.Remote == nil && len(entry.HardLinkId) == 0 && len(entry.GetChunks()) == 0 && (len(entry.Content) > 0 || entry.FileSize == 0) {
+			if entry.FileSize > uint64(len(entry.Content)) {
+				return nil, nil, 0, fmt.Errorf("inline file %q has inconsistent size: metadata=%d content=%d", fullPath, entry.FileSize, len(entry.Content)), nil
+			}
+
+			remainingInlineBudget := fs.option.SaveToFilerLimit - int64(len(entry.Content))
+			if remainingInlineBudget > 0 {
+				// Read at most the remaining inline budget. Reaching the limit means
+				// the resulting file must be chunked, even if this is also EOF.
+				prefix, readErr := io.ReadAll(io.LimitReader(reader, remainingInlineBudget))
+				if readErr != nil {
+					return nil, nil, 0, fmt.Errorf("read input: %w", readErr), nil
+				}
+				if int64(len(prefix)) < remainingInlineBudget {
+					inlineAppend := append([]byte{}, prefix...)
+					md5Hash = md5.New()
+					_, _ = md5Hash.Write(inlineAppend)
+					if len(inlineAppend) > 0 {
+						stats.FilerHandlerCounter.WithLabelValues(stats.ContentSaveToFiler).Inc()
+					}
+					return nil, md5Hash, int64(len(inlineAppend)), nil, inlineAppend
+				}
+				if chunkSize <= 0 {
+					return nil, nil, 0, fmt.Errorf("invalid chunk size %d for inline append promotion", chunkSize), nil
+				}
+				reader = io.MultiReader(bytes.NewReader(prefix), reader)
+			} else {
+				// Probe one byte so an empty append can preserve the inline entry
+				// even when the configured threshold is disabled or below its size.
+				prefix, readErr := io.ReadAll(io.LimitReader(reader, 1))
+				if readErr != nil {
+					return nil, nil, 0, fmt.Errorf("read input: %w", readErr), nil
+				}
+				if len(prefix) == 0 {
+					return nil, md5.New(), 0, nil, []byte{}
+				}
+				if chunkSize <= 0 {
+					return nil, nil, 0, fmt.Errorf("invalid chunk size %d for inline append promotion", chunkSize), nil
+				}
+				reader = io.MultiReader(bytes.NewReader(prefix), reader)
+			}
+		}
+	}
+
 	return fs.uploadReaderToChunks(ctx, r, reader, chunkOffset, chunkSize, fileName, contentType, isAppend, so)
 }
 
@@ -71,7 +122,7 @@ func (fs *FilerServer) uploadReaderToChunks(ctx context.Context, r *http.Request
 // chunking: it must stay off when chunk boundaries carry meaning.
 func (fs *FilerServer) uploadReaderToBoundedChunks(ctx context.Context, r *http.Request, reader io.Reader, startOffset int64, boundaries ChunkBoundaries, fileName, contentType string, isAppend bool, so *operation.StorageOption) (fileChunks []*filer_pb.FileChunk, md5Hash hash.Hash, chunkOffset int64, uploadErr error, smallContent []byte) {
 
-	_, allowInline := boundaries.(fixedChunkSize)
+	fixedSize, allowInline := boundaries.(fixedChunkSize)
 	md5Hash = md5.New()
 	chunkOffset = startOffset
 	var partReader = io.NopCloser(io.TeeReader(reader, md5Hash))
@@ -123,7 +174,9 @@ func (fs *FilerServer) uploadReaderToBoundedChunks(ctx context.Context, r *http.
 			break
 		}
 		if chunkOffset == 0 && !isAppend && allowInline {
-			if dataSize < fs.option.SaveToFilerLimit {
+			// A short first read proves EOF, so the buffer holds the whole file.
+			// A full chunk may have more data behind it — store it chunked.
+			if dataSize < fs.option.SaveToFilerLimit && dataSize < int64(fixedSize) {
 				chunkOffset += dataSize
 				smallContent = make([]byte, dataSize)
 				bytesBuffer.Read(smallContent)
@@ -231,7 +284,12 @@ func (fs *FilerServer) dataToChunkWithSSE(ctx context.Context, r *http.Request,
 	var uploadResult *operation.UploadResult
 	var failedFileChunks []*filer_pb.FileChunk
 
-	err := util.Retry("filerDataToChunk", func() error {
+	// Each attempt assigns anew, so also retry the errors a fresh volume dodges:
+	// a target gone read-only or full mid-write 5xxs until the master notices.
+	shouldRetry := func(err error) bool {
+		return util.IsTransientError(err) || operation.ShouldReassignUpload(err)
+	}
+	err := util.RetryOnError("filerDataToChunk", shouldRetry, func() error {
 		// assign one file id for one chunk
 		fileId, urlLocation, auth, uploadErr = fs.assignNewFileInfo(ctx, so, uint64(len(data)))
 		if uploadErr != nil {
@@ -262,6 +320,13 @@ func (fs *FilerServer) dataToChunkWithSSE(ctx context.Context, r *http.Request,
 		return failedFileChunks, err
 	}
 
+	// A retry that lands elsewhere strands the earlier attempts: a volume server
+	// 5xxs after storing the needle locally when replication fails, and each
+	// attempt used its own file id, so nothing references them now.
+	if len(failedFileChunks) > 0 {
+		fs.filer.DeleteUncommittedChunks(ctx, failedFileChunks)
+	}
+
 	// if last chunk exhausted the reader exactly at the border
 	if uploadResult.Size == 0 {
 		return nil, nil
diff --git a/weed/server/filer_server_leave_test.go b/weed/server/filer_server_leave_test.go
new file mode 100644
index 0000000000..b2bee6dcc4
--- /dev/null
+++ b/weed/server/filer_server_leave_test.go
@@ -0,0 +1,90 @@
+package weed_server
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster/lock_manager"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"google.golang.org/grpc"
+)
+
+func newLeaveTestFilerServer(priorOwnerWindow time.Duration, ring ...pb.ServerAddress) *FilerServer {
+	const self = pb.ServerAddress("filer1:18888")
+	dlm := lock_manager.NewDistributedLockManager(self)
+	dlm.LockRing = lock_manager.NewLockRing(priorOwnerWindow)
+	dlm.LockRing.SetSnapshot(ring, 1)
+	return &FilerServer{
+		option: &FilerOption{Host: self},
+		filer: &filer.Filer{
+			Dlm:          dlm,
+			MasterClient: wdclient.NewMasterClient(grpc.EmptyDialOption{}, "", "filer", self, "", "", pb.ServerDiscovery{}),
+		},
+	}
+}
+
+func TestLeaveLockRingWaitsForRemovalThenPriorOwnerWindow(t *testing.T) {
+	const window = 300 * time.Millisecond
+	fs := newLeaveTestFilerServer(window, "filer1:18888", "filer2:18888")
+
+	removed := make(chan time.Time, 1)
+	go func() {
+		time.Sleep(100 * time.Millisecond)
+		before := time.Now()
+		fs.filer.Dlm.LockRing.SetSnapshot([]pb.ServerAddress{"filer2:18888"}, 2)
+		removed <- before
+	}()
+
+	fs.leaveLockRing(5 * time.Second)
+	returned := time.Now()
+
+	select {
+	case removedAt := <-removed:
+		if want := window + priorOwnerWindowSkew; returned.Sub(removedAt) < want-20*time.Millisecond {
+			t.Errorf("returned %v after the ring dropped this filer, want the %v prior-owner window plus peer skew", returned.Sub(removedAt), want)
+		}
+	default:
+		t.Fatal("returned before the master dropped this filer from the lock ring")
+	}
+}
+
+func TestLeaveLockRingGivesUpWhenTheMasterKeepsTheFiler(t *testing.T) {
+	fs := newLeaveTestFilerServer(5*time.Second, "filer1:18888", "filer2:18888")
+
+	start := time.Now()
+	fs.leaveLockRing(200 * time.Millisecond)
+	if elapsed := time.Since(start); elapsed < 200*time.Millisecond || elapsed > 2*time.Second {
+		t.Errorf("leave took %v, want about the 200ms removal timeout", elapsed)
+	}
+}
+
+func TestLeaveLockRingSkipsALoneFiler(t *testing.T) {
+	fs := newLeaveTestFilerServer(5*time.Second, "filer1:18888")
+
+	start := time.Now()
+	fs.leaveLockRing(5 * time.Second)
+	if elapsed := time.Since(start); elapsed > time.Second {
+		t.Errorf("a lone filer waited %v to leave a ring with no peer to take its keys", elapsed)
+	}
+}
+
+func TestLeaveLockRingIsBoundedBySlowLockTransfers(t *testing.T) {
+	fs := newLeaveTestFilerServer(5*time.Second, "filer1:18888", "filer2:18888")
+	transferring := make(chan struct{})
+	release := make(chan struct{})
+	t.Cleanup(func() { close(release) })
+	fs.filer.Dlm.LockRing.SetTakeSnapshotCallback(func([]pb.ServerAddress) {
+		close(transferring)
+		<-release
+	})
+	go fs.filer.Dlm.LockRing.SetSnapshot([]pb.ServerAddress{"filer2:18888"}, 2)
+	<-transferring
+
+	start := time.Now()
+	fs.leaveLockRingWithin(5*time.Second, 300*time.Millisecond)
+	if elapsed := time.Since(start); elapsed > 2*time.Second {
+		t.Errorf("leave blocked %v behind lock transfers, want the 300ms budget", elapsed)
+	}
+}
diff --git a/weed/server/filer_server_remote_evict.go b/weed/server/filer_server_remote_evict.go
new file mode 100644
index 0000000000..1c11f5d460
--- /dev/null
+++ b/weed/server/filer_server_remote_evict.go
@@ -0,0 +1,300 @@
+package weed_server
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/protobuf/proto"
+)
+
+const (
+	remoteCacheEvictInterval      = 30 * time.Second
+	remoteCacheEvictMinAge        = time.Minute
+	remoteCacheVacuumCooldown     = time.Minute
+	remoteCacheMasterRpcTime      = 30 * time.Second
+	remoteCachePendingVidAttempts = 10
+)
+
+// uncacheRemoteEntry drops the local chunks of one remote-mounted entry, the
+// same state transition remote.uncache applies through UpdateEntry. Cleared
+// chunks go to the deletion queue and are reclaimed by the next compaction.
+// When vids is set, only entries holding chunks on those volumes count toward
+// the freed bytes, and entries contributing nothing are left untouched.
+func (fs *FilerServer) uncacheRemoteEntry(ctx context.Context, fullPath util.FullPath, minCacheAge time.Duration, vids map[uint32]struct{}) (freedBytes int64, err error) {
+	pathLock := fs.entryLockTable.AcquireLock("uncacheRemoteEntry", fullPath, util.ExclusiveLock)
+	defer fs.entryLockTable.ReleaseLock(fullPath, pathLock)
+
+	current, err := fs.filer.FindEntry(ctx, fullPath)
+	if err != nil {
+		return 0, err
+	}
+	if !filer.IsEvictableRemoteEntry(current) {
+		return 0, nil
+	}
+	if time.Since(time.Unix(0, current.Remote.LastLocalSyncTsNs)) < minCacheAge {
+		return 0, nil
+	}
+
+	freedBytes = remoteEntryBytesOnVids(current, vids)
+	if freedBytes == 0 {
+		return 0, nil
+	}
+
+	newEntry := current.ShallowClone()
+	newEntry.Chunks = nil
+	newEntry.Remote = proto.Clone(current.Remote).(*filer_pb.RemoteEntry)
+	newEntry.Remote.LastLocalSyncTsNs = 0
+
+	if err := fs.filer.CreateEntry(ctx, newEntry, current, false, false, nil, true, fs.filer.MaxFilenameLength); err != nil {
+		return 0, err
+	}
+	fileIds := make([]string, 0, len(current.Chunks))
+	for _, chunk := range current.Chunks {
+		fileIds = append(fileIds, chunk.GetFileIdString())
+	}
+	fs.notePendingRemoteCacheVids(fileIds)
+	stats.RemoteCacheEvictedCounter.Inc()
+	glog.V(1).InfofCtx(ctx, "uncacheRemoteEntry %s freed %d bytes", fullPath, freedBytes)
+	return freedBytes, nil
+}
+
+// remoteEntryBytesOnVids sums the entry's chunk bytes on the given volumes; a
+// nil set counts the whole object.
+func remoteEntryBytesOnVids(entry *filer.Entry, vids map[uint32]struct{}) int64 {
+	if vids == nil {
+		return int64(entry.Size())
+	}
+	var bytes int64
+	for _, chunk := range entry.Chunks {
+		fid, err := needle.ParseFileIdFromString(chunk.GetFileIdString())
+		if err != nil {
+			continue
+		}
+		if _, ok := vids[uint32(fid.VolumeId)]; ok {
+			bytes += int64(chunk.Size)
+		}
+	}
+	return bytes
+}
+
+// evictRemoteCachedEntries drops local chunks of remote-mounted entries
+// oldest-cached first until bytesNeeded is met or candidates run out. The
+// first pass honors a minimum cache age so a just-fetched hot object is not
+// dropped under a reader; when aged candidates cannot cover the request a
+// second pass accepts any synchronized cached entry. When pressuredVids is
+// set, only bytes on those volumes count and entries elsewhere are skipped.
+func (fs *FilerServer) evictRemoteCachedEntries(ctx context.Context, bytesNeeded int64, pressuredVids map[uint32]struct{}) (freed int64) {
+	if fs.filer.RemoteStorage == nil {
+		return 0
+	}
+	mounts := fs.filer.RemoteStorage.MountedDirectories()
+	for _, minCacheAge := range []time.Duration{remoteCacheEvictMinAge, 0} {
+		for _, entry := range fs.filer.ListEvictableRemoteEntries(ctx, mounts, minCacheAge) {
+			if bytesNeeded > 0 && freed >= bytesNeeded {
+				return freed
+			}
+			n, err := fs.uncacheRemoteEntry(ctx, entry.FullPath, minCacheAge, pressuredVids)
+			if err != nil {
+				glog.WarningfCtx(ctx, "evict remote cache %s: %v", entry.FullPath, err)
+				continue
+			}
+			freed += n
+		}
+	}
+	return freed
+}
+
+// remoteCacheDiskPressure reports per-disk usage across the cluster: the total
+// bytes to reclaim and the volumes hosted on disks over the eviction threshold.
+func (fs *FilerServer) remoteCacheDiskPressure(ctx context.Context) (bytesToFree int64, pressuredVids map[uint32]struct{}, over bool) {
+	threshold := fs.option.RemoteCacheEvictThreshold
+	if threshold <= 0 {
+		return 0, nil, false
+	}
+	pressuredVids = make(map[uint32]struct{})
+	rpcCtx, cancel := context.WithTimeout(ctx, remoteCacheMasterRpcTime)
+	defer cancel()
+	err := fs.filer.MasterClient.WithClient(rpcCtx, false, func(client master_pb.SeaweedClient) error {
+		resp, err := client.VolumeList(rpcCtx, &master_pb.VolumeListRequest{})
+		if err != nil {
+			return err
+		}
+		for _, dc := range resp.TopologyInfo.DataCenterInfos {
+			for _, rack := range dc.RackInfos {
+				for _, dn := range rack.DataNodeInfos {
+					for _, disk := range dn.DiskInfos {
+						for _, pd := range disk.SplitByPhysicalDisk() {
+							if pd.DiskTotalBytes == 0 {
+								continue
+							}
+							used := pd.DiskTotalBytes - pd.DiskFreeBytes
+							if float64(used) < float64(pd.DiskTotalBytes)*threshold {
+								continue
+							}
+							over = true
+							bytesToFree += int64(used) - int64(float64(pd.DiskTotalBytes)*threshold*0.95)
+							for _, vi := range pd.VolumeInfos {
+								pressuredVids[vi.Id] = struct{}{}
+							}
+						}
+					}
+				}
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		glog.WarningfCtx(ctx, "remote cache disk pressure check: %v", err)
+		return 0, nil, false
+	}
+	return bytesToFree, pressuredVids, over
+}
+
+// flushAndVacuumRemoteCacheVolumes forces the deletion queue down to the volume
+// servers so fresh tombstones land, then compacts the volumes carrying them.
+// The flush survives shutdown cancellation: an interrupted delete would be
+// requeued into the in-memory retry queue that exits with the process,
+// stranding bytes whose metadata the eviction already dropped.
+func (fs *FilerServer) flushAndVacuumRemoteCacheVolumes(ctx context.Context) {
+	if len(fs.pendingRemoteCacheVids()) == 0 {
+		return
+	}
+	flushCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), remoteCacheMasterRpcTime)
+	fs.filer.FlushFileIdDeletionQueue(flushCtx, filer.LookupByMasterClientFn(fs.filer.MasterClient))
+	cancel()
+	fs.vacuumPendingRemoteCacheVids(ctx)
+}
+
+// vacuumPendingRemoteCacheVids compacts every volume still owed a vacuum. The
+// master does not report whether a request actually compacted, so a vid keeps
+// roughly ten minutes of attempts: tombstones that land late or compaction
+// losses to another vacuum are retried by later passes instead of stranded.
+func (fs *FilerServer) vacuumPendingRemoteCacheVids(ctx context.Context) {
+	pending := fs.pendingRemoteCacheVids()
+	if len(pending) == 0 {
+		return
+	}
+	if last := fs.remoteCacheLastVacuum.Load(); last != nil && time.Since(*last) < remoteCacheVacuumCooldown {
+		return
+	}
+	now := time.Now()
+	fs.remoteCacheLastVacuum.Store(&now)
+	if err := fs.filer.MasterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+		for vid := range pending {
+			vCtx, cancel := context.WithTimeout(ctx, remoteCacheMasterRpcTime)
+			_, err := client.VacuumVolume(vCtx, &master_pb.VacuumVolumeRequest{VolumeId: vid})
+			cancel()
+			if err != nil {
+				glog.WarningfCtx(ctx, "remote cache vacuum volume %d: %v", vid, err)
+				continue
+			}
+			fs.completePendingRemoteCacheVid(vid)
+		}
+		return nil
+	}); err != nil {
+		glog.WarningfCtx(ctx, "remote cache vacuum: %v", err)
+	}
+}
+
+func (fs *FilerServer) notePendingRemoteCacheVids(fileIds []string) {
+	fs.remoteCachePendingVidsMu.Lock()
+	defer fs.remoteCachePendingVidsMu.Unlock()
+	if fs.remoteCachePendingVids == nil {
+		fs.remoteCachePendingVids = make(map[uint32]int)
+	}
+	for _, fid := range fileIds {
+		if parsed, err := needle.ParseFileIdFromString(fid); err == nil {
+			fs.remoteCachePendingVids[uint32(parsed.VolumeId)] = remoteCachePendingVidAttempts
+		}
+	}
+}
+
+func (fs *FilerServer) pendingRemoteCacheVids() map[uint32]struct{} {
+	fs.remoteCachePendingVidsMu.Lock()
+	defer fs.remoteCachePendingVidsMu.Unlock()
+	out := make(map[uint32]struct{}, len(fs.remoteCachePendingVids))
+	for vid := range fs.remoteCachePendingVids {
+		out[vid] = struct{}{}
+	}
+	return out
+}
+
+func (fs *FilerServer) completePendingRemoteCacheVid(vid uint32) {
+	fs.remoteCachePendingVidsMu.Lock()
+	defer fs.remoteCachePendingVidsMu.Unlock()
+	if fs.remoteCachePendingVids[vid] <= 1 {
+		delete(fs.remoteCachePendingVids, vid)
+	} else {
+		fs.remoteCachePendingVids[vid]--
+	}
+}
+
+// reclaimRemoteCacheSpace evicts remote-cached content and compacts volumes to
+// release disk space under capacity pressure. A pass already in flight is
+// enough; callers that would queue behind it just fall back to remote reads.
+func (fs *FilerServer) reclaimRemoteCacheSpace(ctx context.Context, bytesNeeded int64, pressuredVids map[uint32]struct{}) {
+	if !fs.remoteCacheEvictMu.TryLock() {
+		return
+	}
+	defer fs.remoteCacheEvictMu.Unlock()
+	freed := fs.evictRemoteCachedEntries(ctx, bytesNeeded, pressuredVids)
+	if freed > 0 {
+		glog.V(0).InfofCtx(ctx, "remote cache eviction freed %d bytes", freed)
+	}
+	fs.flushAndVacuumRemoteCacheVolumes(ctx)
+}
+
+func isRemoteCacheCapacityError(err error) bool {
+	msg := err.Error()
+	return strings.Contains(msg, "writable volumes") ||
+		strings.Contains(msg, "free volumes") ||
+		strings.Contains(msg, "no space left") ||
+		strings.Contains(msg, "out of space")
+}
+
+// runRemoteCacheEviction periodically evicts remote-cached entries once any
+// disk crosses the configured usage threshold, with a vacuum pass to reclaim
+// the deleted chunks.
+func (fs *FilerServer) evictCtx() context.Context {
+	if fs.remoteCacheEvictCtx == nil {
+		return context.Background()
+	}
+	return fs.remoteCacheEvictCtx
+}
+
+func (fs *FilerServer) runRemoteCacheEviction() {
+	if fs.option.RemoteCacheEvictThreshold <= 0 || fs.remoteCacheEvictCtx == nil {
+		return
+	}
+	ctx := fs.remoteCacheEvictCtx
+	ticker := time.NewTicker(remoteCacheEvictInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+		if fs.remoteCacheEvictMu.TryLock() {
+			fs.vacuumPendingRemoteCacheVids(ctx)
+			fs.remoteCacheEvictMu.Unlock()
+		}
+		if fs.filer.RemoteStorage == nil || len(fs.filer.RemoteStorage.MountedDirectories()) == 0 {
+			continue
+		}
+		bytesToFree, pressuredVids, over := fs.remoteCacheDiskPressure(ctx)
+		if !over {
+			continue
+		}
+		glog.V(0).Infof("remote cache: disk usage over %.0f%%, evicting %d bytes", fs.option.RemoteCacheEvictThreshold*100, bytesToFree)
+		fs.reclaimRemoteCacheSpace(ctx, bytesToFree, pressuredVids)
+	}
+}
diff --git a/weed/server/filer_server_storage_rule_ttl_test.go b/weed/server/filer_server_storage_rule_ttl_test.go
new file mode 100644
index 0000000000..b5d507cead
--- /dev/null
+++ b/weed/server/filer_server_storage_rule_ttl_test.go
@@ -0,0 +1,246 @@
+package weed_server
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+const ttlRulePrefix = "/buckets/ttl/"
+
+// addTtlRule gives ttlRulePrefix a 3 minute volume TTL, the fs.configure setting
+// whose effect every write path below has to reproduce on the entries it stores.
+func addTtlRule(t *testing.T, f *filer.Filer) {
+	t.Helper()
+	if err := f.FilerConf.AddLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: ttlRulePrefix,
+		Ttl:            "3m",
+	}); err != nil {
+		t.Fatalf("AddLocationConf: %v", err)
+	}
+}
+
+// The native LMCache path allocates chunks and publishes the Filer Entry in
+// separate RPCs. Both RPCs must resolve the same storage rule, or metadata can
+// expire while its Volume remains permanent (or the reverse).
+func TestNativeCacheWriteUsesOneTtlForAllocationAndEntry(t *testing.T) {
+	store := newRenameTestStore()
+	store.entries[ttlRulePrefix] = newDirectoryEntry(ttlRulePrefix, 10)
+	server := &FilerServer{
+		filer:          newRenameTestFiler(t, store),
+		option:         &FilerOption{},
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+	addTtlRule(t, server.filer)
+
+	allocation, err := server.resolveAssignStorageOption(context.Background(), &filer_pb.AssignVolumeRequest{
+		Path:       ttlRulePrefix + "cache-key",
+		Collection: "lmcache",
+	})
+	if err != nil {
+		t.Fatalf("resolveAssignStorageOption: %v", err)
+	}
+	if allocation.Collection != "lmcache" {
+		t.Fatalf("allocation collection = %q, want lmcache", allocation.Collection)
+	}
+	if allocation.TtlSeconds != 180 {
+		t.Fatalf("allocation TTL = %d, want 180", allocation.TtlSeconds)
+	}
+
+	if _, err := server.CreateEntry(context.Background(), &filer_pb.CreateEntryRequest{
+		Directory: "/buckets/ttl",
+		Entry: &filer_pb.Entry{
+			Name:       "cache-key",
+			Attributes: &filer_pb.FuseAttributes{FileMode: 0644},
+		},
+	}); err != nil {
+		t.Fatalf("CreateEntry: %v", err)
+	}
+
+	entry, err := store.FindEntry(context.Background(), ttlRulePrefix+"cache-key")
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if entry.TtlSec != allocation.TtlSeconds {
+		t.Fatalf("entry TTL = %d, allocation TTL = %d", entry.TtlSec, allocation.TtlSeconds)
+	}
+}
+
+// An object written through ObjectTransaction (the routed S3 write path) must
+// pick up the path's TTL rule, the same as one written through CreateEntry.
+func TestObjectTransactionPutAppliesRuleTtl(t *testing.T) {
+	store := newRenameTestStore()
+	store.entries[ttlRulePrefix] = newDirectoryEntry(ttlRulePrefix, 10)
+
+	server := &FilerServer{
+		filer:          newRenameTestFiler(t, store),
+		option:         &FilerOption{},
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+	addTtlRule(t, server.filer)
+
+	if _, err := server.ObjectTransaction(context.Background(), &filer_pb.ObjectTransactionRequest{
+		LockKey: ttlRulePrefix + "obj",
+		Mutations: []*filer_pb.ObjectMutation{{
+			Type:      filer_pb.ObjectMutation_PUT,
+			Directory: "/buckets/ttl",
+			Entry: &filer_pb.Entry{
+				Name:       "obj",
+				Attributes: &filer_pb.FuseAttributes{FileMode: 0644},
+			},
+		}},
+	}); err != nil {
+		t.Fatalf("ObjectTransaction: %v", err)
+	}
+
+	entry, err := store.FindEntry(context.Background(), ttlRulePrefix+"obj")
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if entry.TtlSec != 180 {
+		t.Errorf("entry TtlSec = %d, want 180", entry.TtlSec)
+	}
+}
+
+// A copy landing in a TTL path re-uploads its chunks under that path's rule, so
+// the entry has to carry the rule's TTL too - whatever TTL the source had.
+func TestCopyAppliesRuleTtl(t *testing.T) {
+	for _, sourceTtlSec := range []int32{0, 600} {
+		t.Run(fmt.Sprintf("source ttl %d", sourceTtlSec), func(t *testing.T) {
+			store := newRenameTestStore()
+			source := newFileEntry("/src.txt", 11)
+			source.Content = []byte("hello")
+			source.TtlSec = sourceTtlSec
+			source.Crtime = time.Now() // a TTL entry older than its TTL reads back as expired
+			store.entries["/src.txt"] = source
+			store.entries[ttlRulePrefix] = newDirectoryEntry(ttlRulePrefix, 10)
+
+			server := &FilerServer{
+				filer:          newRenameTestFiler(t, store),
+				option:         &FilerOption{},
+				entryLockTable: util.NewLockTable[util.FullPath](),
+			}
+			addTtlRule(t, server.filer)
+
+			req := httptest.NewRequest(http.MethodPost, ttlRulePrefix+"dst.txt?cp.from=/src.txt", http.NoBody)
+			rec := httptest.NewRecorder()
+			server.PostHandler(rec, req, 0)
+			if rec.Code != http.StatusNoContent {
+				t.Fatalf("copy = %d, want %d; body=%q", rec.Code, http.StatusNoContent, rec.Body.String())
+			}
+
+			entry, err := store.FindEntry(context.Background(), ttlRulePrefix+"dst.txt")
+			if err != nil {
+				t.Fatalf("FindEntry: %v", err)
+			}
+			if entry.TtlSec != 180 {
+				t.Errorf("entry TtlSec = %d, want 180", entry.TtlSec)
+			}
+		})
+	}
+}
+
+// A remote-backed entry copied into a TTL path must not expire locally: the
+// remote storage owns its lifecycle, so a local expiry would drop the pointer
+// to an object that is still there.
+func TestCopyKeepsRemoteEntryUnexpiring(t *testing.T) {
+	store := newRenameTestStore()
+	source := newFileEntry("/src.txt", 11)
+	source.Remote = &filer_pb.RemoteEntry{StorageName: "s3-remote", RemoteSize: 5}
+	store.entries["/src.txt"] = source
+	store.entries[ttlRulePrefix] = newDirectoryEntry(ttlRulePrefix, 10)
+
+	server := &FilerServer{
+		filer:          newRenameTestFiler(t, store),
+		option:         &FilerOption{},
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+	addTtlRule(t, server.filer)
+
+	req := httptest.NewRequest(http.MethodPost, ttlRulePrefix+"dst.txt?cp.from=/src.txt", http.NoBody)
+	rec := httptest.NewRecorder()
+	server.PostHandler(rec, req, 0)
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("copy = %d, want %d; body=%q", rec.Code, http.StatusNoContent, rec.Body.String())
+	}
+
+	entry, err := store.FindEntry(context.Background(), ttlRulePrefix+"dst.txt")
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if entry.TtlSec != 0 {
+		t.Errorf("remote entry TtlSec = %d, want 0", entry.TtlSec)
+	}
+}
+
+// Clients percent-encode non-ASCII path segments on the wire, so a rule has to
+// be matched against the decoded path the entry is written to, not the raw
+// request-target: a read-only rule on "/data/只读/" must still refuse a POST to
+// "/data/%E5%8F%AA%E8%AF%BB/".
+func TestPostHandlerMatchesStorageRuleOnDecodedPath(t *testing.T) {
+	const readOnlyPrefix = "/data/只读/"
+	store := newRenameTestStore()
+	source := newFileEntry("/src.txt", 11)
+	source.Content = []byte("hello")
+	store.entries["/src.txt"] = source
+	store.entries[readOnlyPrefix] = newDirectoryEntry(readOnlyPrefix, 10)
+
+	server := &FilerServer{
+		filer:          newRenameTestFiler(t, store),
+		option:         &FilerOption{},
+		entryLockTable: util.NewLockTable[util.FullPath](),
+	}
+	if err := server.filer.FilerConf.AddLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: readOnlyPrefix,
+		ReadOnly:       true,
+	}); err != nil {
+		t.Fatalf("AddLocationConf: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPost, "/data/%E5%8F%AA%E8%AF%BB/dst.txt?cp.from=/src.txt", http.NoBody)
+	rec := httptest.NewRecorder()
+	server.PostHandler(rec, req, 0)
+	if rec.Code != http.StatusInsufficientStorage {
+		t.Fatalf("copy into read-only path = %d, want %d; body=%q", rec.Code, http.StatusInsufficientStorage, rec.Body.String())
+	}
+	if _, err := store.FindEntry(context.Background(), readOnlyPrefix+"dst.txt"); err == nil {
+		t.Fatal("copy landed in the read-only path")
+	}
+}
+
+// A completed TUS upload uploads its chunks under the target path's rule, so the
+// entry it lands has to expire with them.
+func TestCompleteTusUploadAppliesRuleTtl(t *testing.T) {
+	fs, store := newTusTestServer(t, nil)
+	addTtlRule(t, fs.filer)
+
+	targetPath := ttlRulePrefix + "upload.bin"
+	seedTusSession(t, fs, store, TusSession{ID: tusTestUploadID, TargetPath: targetPath, Size: 8})
+	seedTusChunk(t, fs, store, tusTestUploadID, 0, 8, "3,01637037d6")
+
+	req := tusRequest(http.MethodPatch, "/.tus/.uploads/"+tusTestUploadID, map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+		"Content-Type":  "application/offset+octet-stream",
+		"Upload-Offset": "8",
+	}, "")
+	rec := httptest.NewRecorder()
+	fs.tusHandler(rec, req)
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("PATCH = %d, want %d; body=%q", rec.Code, http.StatusNoContent, rec.Body.String())
+	}
+
+	entry, err := store.FindEntry(context.Background(), util.FullPath(targetPath))
+	if err != nil {
+		t.Fatalf("FindEntry: %v", err)
+	}
+	if entry.TtlSec != 180 {
+		t.Errorf("entry TtlSec = %d, want 180", entry.TtlSec)
+	}
+}
diff --git a/weed/server/filer_server_subscription_stop_test.go b/weed/server/filer_server_subscription_stop_test.go
new file mode 100644
index 0000000000..7bf97ddcfa
--- /dev/null
+++ b/weed/server/filer_server_subscription_stop_test.go
@@ -0,0 +1,150 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func newStoppableFilerServer() *FilerServer {
+	fs := &FilerServer{}
+	fs.subscriptionsStopped, fs.stopSubscriptions = context.WithCancel(context.Background())
+	return fs
+}
+
+func TestStopSubscriptionsEndsOpenSubscriptions(t *testing.T) {
+	fs := newStoppableFilerServer()
+	ctx, cancel := fs.subscriptionContext(context.Background())
+	defer cancel()
+
+	select {
+	case <-ctx.Done():
+		t.Fatal("subscription ended before StopSubscriptions")
+	default:
+	}
+	fs.StopSubscriptions()
+	select {
+	case <-ctx.Done():
+	case <-time.After(5 * time.Second):
+		t.Fatal("subscription still open after StopSubscriptions")
+	}
+}
+
+func TestSubscriptionStartedAfterStopEndsAtOnce(t *testing.T) {
+	fs := newStoppableFilerServer()
+	fs.StopSubscriptions()
+	ctx, cancel := fs.subscriptionContext(context.Background())
+	defer cancel()
+	select {
+	case <-ctx.Done():
+	case <-time.After(5 * time.Second):
+		t.Fatal("a subscription started during shutdown stayed open")
+	}
+}
+
+func TestSubscriptionStillEndsWithItsStream(t *testing.T) {
+	fs := newStoppableFilerServer()
+	stream, closeStream := context.WithCancel(context.WithValue(context.Background(), struct{}{}, "peer"))
+	ctx, cancel := fs.subscriptionContext(stream)
+	defer cancel()
+	if ctx.Value(struct{}{}) != "peer" {
+		t.Error("subscription context lost the stream's values")
+	}
+	closeStream()
+	select {
+	case <-ctx.Done():
+	case <-time.After(5 * time.Second):
+		t.Fatal("subscription outlived its stream")
+	}
+}
+
+func TestSubscriptionContextWithoutStopSignal(t *testing.T) {
+	fs := &FilerServer{}
+	fs.StopSubscriptions()
+	ctx, cancel := fs.subscriptionContext(context.Background())
+	select {
+	case <-ctx.Done():
+		t.Fatal("subscription ended although nothing stopped it")
+	default:
+	}
+	cancel()
+	<-ctx.Done()
+}
+
+// A follower reads a clean end as "done" and stops for good (util.RetryUntil
+// returns on nil), so a subscription that StopSubscriptions ended must not
+// end cleanly.
+func TestStoppedSubscriptionEndsUnavailable(t *testing.T) {
+	fs := newStoppableFilerServer()
+	fs.StopSubscriptions()
+	err := fs.endOfSubscription(context.Background(), nil)
+	if status.Code(err) != codes.Unavailable {
+		t.Fatalf("stopped subscription ended with %v, want Unavailable", err)
+	}
+}
+
+func TestSubscriptionEndsCleanlyWithoutStop(t *testing.T) {
+	fs := newStoppableFilerServer()
+	if err := fs.endOfSubscription(context.Background(), nil); err != nil {
+		t.Fatalf("subscription without shutdown ended with %v, want nil", err)
+	}
+	if err := (&FilerServer{}).endOfSubscription(context.Background(), nil); err != nil {
+		t.Fatalf("server without stop signal ended with %v, want nil", err)
+	}
+}
+
+func TestSubscriptionErrorPassesThroughStop(t *testing.T) {
+	fs := newStoppableFilerServer()
+	fs.StopSubscriptions()
+	want := errors.New("reading from persisted logs")
+	if err := fs.endOfSubscription(context.Background(), want); !errors.Is(err, want) {
+		t.Fatalf("got %v, want the handler's own error", err)
+	}
+}
+
+func TestClosedStreamEndsCleanlyDuringStop(t *testing.T) {
+	fs := newStoppableFilerServer()
+	fs.StopSubscriptions()
+	stream, closeStream := context.WithCancel(context.Background())
+	closeStream()
+	if err := fs.endOfSubscription(stream, nil); err != nil {
+		t.Fatalf("stream the client closed ended with %v, want nil", err)
+	}
+}
+
+// A read pass surfaces StopSubscriptions as a wrapped context.Canceled; on the
+// wire that must still read as Unavailable so followers retry.
+func TestCanceledReadEndsUnavailableDuringStop(t *testing.T) {
+	fs := newStoppableFilerServer()
+	fs.StopSubscriptions()
+	canceled := fmt.Errorf("reading from persisted logs: %w", context.Canceled)
+	if err := fs.endOfSubscription(context.Background(), canceled); status.Code(err) != codes.Unavailable {
+		t.Fatalf("stopped read ended with %v, want Unavailable", err)
+	}
+}
+
+func TestCanceledReadPassesThroughWithoutStop(t *testing.T) {
+	fs := newStoppableFilerServer()
+	canceled := fmt.Errorf("reading from persisted logs: %w", context.Canceled)
+	if err := fs.endOfSubscription(context.Background(), canceled); !errors.Is(err, context.Canceled) {
+		t.Fatalf("got %v, want the handler's own error", err)
+	}
+}
+
+// Neither read loop checks ctx per entry; the entry callback does.
+func TestEachLogEntryFnEndsOnCancel(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	var filtered int64
+	fn := eachLogEntryFn(ctx, &filer_pb.SubscribeMetadataRequest{}, nil, nil, &filtered)
+	done, err := fn(&filer_pb.LogEntry{})
+	if !done || err != nil {
+		t.Fatalf("cancelled subscription returned done=%v err=%v, want a clean end", done, err)
+	}
+}
diff --git a/weed/server/filer_server_tus_complete_test.go b/weed/server/filer_server_tus_complete_test.go
new file mode 100644
index 0000000000..9c30beecb4
--- /dev/null
+++ b/weed/server/filer_server_tus_complete_test.go
@@ -0,0 +1,157 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// TestFilerServer_completeTusUpload_OverlappingRecords verifies a session whose
+// chunk records overlap - a PATCH retried while its predecessor was still
+// storing a sub-chunk - still completes: coverage is validated the way HEAD
+// computes the offset, and only records extending coverage join the entry.
+func TestFilerServer_completeTusUpload_OverlappingRecords(t *testing.T) {
+	fidA, fidB, fidDup := "3,01637037d6", "4,02637037d6", "5,03637037d6"
+
+	tests := []struct {
+		name       string
+		chunks     [][3]int64 // offset, size, fid index into fids
+		wantChunks [][2]int64 // offset, size expected on the entry
+	}{
+		{
+			name:       "exact duplicate dropped",
+			chunks:     [][3]int64{{0, 8, 0}, {0, 8, 2}, {8, 4, 1}},
+			wantChunks: [][2]int64{{0, 8}, {8, 4}},
+		},
+		{
+			name:       "partial overlap kept",
+			chunks:     [][3]int64{{0, 8, 0}, {6, 6, 2}},
+			wantChunks: [][2]int64{{0, 8}, {6, 6}},
+		},
+		{
+			// a covered record naming a file id the entry keeps must not free it
+			name:       "duplicate sharing a kept file id",
+			chunks:     [][3]int64{{0, 8, 0}, {0, 4, 0}, {8, 4, 1}},
+			wantChunks: [][2]int64{{0, 8}, {8, 4}},
+		},
+	}
+
+	fids := []string{fidA, fidB, fidDup}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs, store := newTusTestServer(t, nil)
+			targetPath := "/buckets/data/raced.bin"
+			size := int64(12)
+			seedTusSession(t, fs, store, TusSession{ID: tusTestUploadID, TargetPath: targetPath, Size: size})
+			for _, c := range tt.chunks {
+				seedTusChunk(t, fs, store, tusTestUploadID, c[0], c[1], fids[c[2]])
+			}
+
+			// a zero-length PATCH at the reported offset triggers completion
+			req := tusRequest(http.MethodPatch, "/.tus/.uploads/"+tusTestUploadID, map[string]string{
+				"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+				"Content-Type":  "application/offset+octet-stream",
+				"Upload-Offset": "12",
+			}, "")
+			rec := httptest.NewRecorder()
+			fs.tusHandler(rec, req)
+
+			if rec.Code != http.StatusNoContent {
+				t.Fatalf("PATCH = %d, want %d; body=%q", rec.Code, http.StatusNoContent, rec.Body.String())
+			}
+			entry, err := store.FindEntry(context.Background(), util.FullPath(targetPath))
+			if err != nil {
+				t.Fatalf("final entry not created: %v", err)
+			}
+			chunks := entry.GetChunks()
+			if len(chunks) != len(tt.wantChunks) {
+				t.Fatalf("entry chunks = %d, want %d", len(chunks), len(tt.wantChunks))
+			}
+			for i, want := range tt.wantChunks {
+				if chunks[i].Offset != want[0] || int64(chunks[i].Size) != want[1] {
+					t.Errorf("chunk[%d] = @%d+%d, want @%d+%d", i, chunks[i].Offset, chunks[i].Size, want[0], want[1])
+				}
+			}
+
+			var freed []string
+			fs.filer.FileIdDeletionQueue.Consume(func(fileIds []string) {
+				freed = append(freed, fileIds...)
+			})
+			for _, chunk := range chunks {
+				for _, fileId := range freed {
+					if fileId == chunk.FileId {
+						t.Errorf("file id %s is referenced by the entry but was freed", fileId)
+					}
+				}
+			}
+			if _, err := store.FindEntry(context.Background(), util.FullPath(fs.tusSessionInfoPath(tusTestUploadID))); err == nil {
+				t.Errorf("session still present after completion")
+			}
+		})
+	}
+}
+
+// TestFilerServer_completeTusUpload_GapRejected verifies records that do not
+// cover the full size still fail completion.
+func TestFilerServer_completeTusUpload_GapRejected(t *testing.T) {
+	fs, store := newTusTestServer(t, nil)
+	targetPath := "/buckets/data/gap.bin"
+	seedTusSession(t, fs, store, TusSession{ID: tusTestUploadID, TargetPath: targetPath, Size: 12})
+
+	session := &TusSession{
+		ID:         tusTestUploadID,
+		TargetPath: targetPath,
+		Size:       12,
+		Offset:     12,
+		Chunks: []*TusChunkInfo{
+			{Offset: 0, Size: 8, FileId: "3,01637037d6"},
+			{Offset: 9, Size: 3, FileId: "4,02637037d6"},
+		},
+	}
+	err := fs.completeTusUpload(context.Background(), session)
+	if err == nil || !strings.Contains(err.Error(), "chunk gap") {
+		t.Fatalf("completeTusUpload err = %v, want a chunk gap error", err)
+	}
+	if _, findErr := store.FindEntry(context.Background(), util.FullPath(targetPath)); findErr == nil {
+		t.Fatalf("entry created despite gap")
+	}
+}
+
+// TestFilerServer_completeTusUpload_ReadOnlyTarget verifies a read-only prefix
+// still refuses the completing upload, before the session's chunks are claimed.
+func TestFilerServer_completeTusUpload_ReadOnlyTarget(t *testing.T) {
+	fs, store := newTusTestServer(t, nil)
+	if err := fs.filer.FilerConf.AddLocationConf(&filer_pb.FilerConf_PathConf{
+		LocationPrefix: "/buckets/frozen/",
+		ReadOnly:       true,
+	}); err != nil {
+		t.Fatalf("AddLocationConf: %v", err)
+	}
+
+	targetPath := "/buckets/frozen/upload.bin"
+	session := &TusSession{
+		ID:         tusTestUploadID,
+		TargetPath: targetPath,
+		Size:       8,
+		Offset:     8,
+		Chunks:     []*TusChunkInfo{{Offset: 0, Size: 8, FileId: "3,01637037d6"}},
+	}
+	seedTusSession(t, fs, store, *session)
+
+	err := fs.completeTusUpload(context.Background(), session)
+	if !errors.Is(err, ErrReadOnly) {
+		t.Fatalf("completeTusUpload err = %v, want %v", err, ErrReadOnly)
+	}
+	if _, findErr := store.FindEntry(context.Background(), util.FullPath(targetPath)); findErr == nil {
+		t.Fatalf("entry created under a read-only prefix")
+	}
+	if consumed, checkErr := fs.isTusSessionConsumed(context.Background(), tusTestUploadID); checkErr != nil || consumed {
+		t.Fatalf("session consumed = %v (err %v), want false", consumed, checkErr)
+	}
+}
diff --git a/weed/server/filer_server_tus_concat_test.go b/weed/server/filer_server_tus_concat_test.go
new file mode 100644
index 0000000000..a361f3d04a
--- /dev/null
+++ b/weed/server/filer_server_tus_concat_test.go
@@ -0,0 +1,345 @@
+package weed_server
+
+import (
+	"context"
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+const (
+	tusTestPartialAID = "11111111-1111-1111-1111-111111111111"
+	tusTestPartialBID = "22222222-2222-2222-2222-222222222222"
+)
+
+// seedTusChunk writes a chunk marker entry into a session directory.
+func seedTusChunk(t *testing.T, fs *FilerServer, store *renameTestStore, uploadID string, offset, size int64, fileId string) {
+	t.Helper()
+	entry := &filer.Entry{
+		FullPath: util.FullPath(fs.tusChunkPath(uploadID, offset, size, fileId)),
+		Attr:     filer.Attr{Crtime: time.Unix(1700000000, 0)},
+	}
+	if err := store.InsertEntry(context.Background(), entry); err != nil {
+		t.Fatalf("seed chunk for %s: %v", uploadID, err)
+	}
+}
+
+func tusRequest(method, path string, headers map[string]string, body string) *http.Request {
+	var req *http.Request
+	if body == "" {
+		req = httptest.NewRequest(method, path, http.NoBody)
+	} else {
+		req = httptest.NewRequest(method, path, strings.NewReader(body))
+	}
+	req.Header.Set("Tus-Resumable", TusVersion)
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	return req
+}
+
+// TestFilerServer_tusPatchHandler_PartialSkipsCompletion verifies a completed
+// partial upload keeps its session and does not land at the target path, while
+// the same flow without Upload-Concat completes normally.
+func TestFilerServer_tusPatchHandler_PartialSkipsCompletion(t *testing.T) {
+	tests := []struct {
+		name        string
+		concat      string
+		expectEntry bool
+	}{
+		{"plain upload completes", "", true},
+		{"partial upload retained", TusConcatPartial, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs, store := newTusTestServer(t, nil)
+			targetPath := "/buckets/data/file.bin"
+			seedTusSession(t, fs, store, TusSession{ID: tusTestUploadID, TargetPath: targetPath, Size: 0, Concat: tt.concat})
+
+			req := tusRequest(http.MethodPatch, "/.tus/.uploads/"+tusTestUploadID, map[string]string{
+				"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+				"Content-Type":  "application/offset+octet-stream",
+				"Upload-Offset": "0",
+			}, "")
+			rec := httptest.NewRecorder()
+			fs.tusHandler(rec, req)
+
+			if rec.Code != http.StatusNoContent {
+				t.Fatalf("PATCH = %d, want %d; body=%q", rec.Code, http.StatusNoContent, rec.Body.String())
+			}
+			_, entryErr := store.FindEntry(context.Background(), util.FullPath(targetPath))
+			_, sessionErr := store.FindEntry(context.Background(), util.FullPath(fs.tusSessionInfoPath(tusTestUploadID)))
+			if tt.expectEntry && (entryErr != nil || sessionErr == nil) {
+				t.Fatalf("plain upload: entry err=%v, session err=%v; want entry present and session removed", entryErr, sessionErr)
+			}
+			if !tt.expectEntry && (entryErr == nil || sessionErr != nil) {
+				t.Fatalf("partial upload: entry err=%v, session err=%v; want no entry and session retained", entryErr, sessionErr)
+			}
+		})
+	}
+}
+
+// TestFilerServer_tusHeadHandler_EchoesUploadConcat verifies HEAD reports the
+// stored Upload-Concat value for partial sessions and omits it otherwise.
+func TestFilerServer_tusHeadHandler_EchoesUploadConcat(t *testing.T) {
+	fs, store := newTusTestServer(t, map[string]string{tusTestUploadID: "/buckets/data/plain.bin"})
+	seedTusSession(t, fs, store, TusSession{ID: tusTestPartialAID, TargetPath: "/buckets/data/part.bin", Size: 1, Concat: TusConcatPartial})
+
+	head := func(uploadID string) *httptest.ResponseRecorder {
+		req := tusRequest(http.MethodHead, "/.tus/.uploads/"+uploadID, map[string]string{
+			"Authorization": "Bearer " + signFilerToken(t, tusTestReadKey, nil, nil),
+		}, "")
+		rec := httptest.NewRecorder()
+		fs.tusHandler(rec, req)
+		return rec
+	}
+
+	partialRec := head(tusTestPartialAID)
+	if partialRec.Code != http.StatusOK || partialRec.Header().Get("Upload-Concat") != TusConcatPartial {
+		t.Fatalf("partial HEAD = %d, Upload-Concat=%q; want 200 with %q", partialRec.Code, partialRec.Header().Get("Upload-Concat"), TusConcatPartial)
+	}
+	plainRec := head(tusTestUploadID)
+	if plainRec.Code != http.StatusOK || plainRec.Header().Get("Upload-Concat") != "" {
+		t.Fatalf("plain HEAD = %d, Upload-Concat=%q; want 200 without the header", plainRec.Code, plainRec.Header().Get("Upload-Concat"))
+	}
+}
+
+// TestFilerServer_tusConcatFinal_AssemblesPartials drives a full concatenation:
+// two completed partials, referenced as a path and as an absolute URL, land as
+// one entry with re-based chunks, and the consumed sessions are removed.
+func TestFilerServer_tusConcatFinal_AssemblesPartials(t *testing.T) {
+	fs, store := newTusTestServer(t, nil)
+	targetPath := "/buckets/data/final.bin"
+	fidA, fidB := "3,01637037d6", "4,02637037d6"
+	seedTusSession(t, fs, store, TusSession{ID: tusTestPartialAID, TargetPath: targetPath, Size: 8, Concat: TusConcatPartial})
+	seedTusChunk(t, fs, store, tusTestPartialAID, 0, 8, fidA)
+	seedTusSession(t, fs, store, TusSession{ID: tusTestPartialBID, TargetPath: targetPath, Size: 4, Concat: TusConcatPartial})
+	seedTusChunk(t, fs, store, tusTestPartialBID, 0, 4, fidB)
+
+	req := tusRequest(http.MethodPost, "/.tus"+targetPath, map[string]string{
+		"Authorization":   "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+		"Upload-Concat":   "final;/.tus/.uploads/" + tusTestPartialAID + " http://example.com/.tus/.uploads/" + tusTestPartialBID,
+		"Upload-Metadata": "content-type " + base64.StdEncoding.EncodeToString([]byte("text/plain")),
+	}, "")
+	rec := httptest.NewRecorder()
+	fs.tusHandler(rec, req)
+
+	if rec.Code != http.StatusCreated {
+		t.Fatalf("final POST = %d, want %d; body=%q", rec.Code, http.StatusCreated, rec.Body.String())
+	}
+	if location := rec.Header().Get("Location"); !strings.HasPrefix(location, "/.tus/.uploads/") {
+		t.Fatalf("Location = %q, want an upload URL", location)
+	}
+
+	entry, err := store.FindEntry(context.Background(), util.FullPath(targetPath))
+	if err != nil {
+		t.Fatalf("final entry not created: %v", err)
+	}
+	if entry.Mime != "text/plain" {
+		t.Errorf("entry mime = %q, want %q", entry.Mime, "text/plain")
+	}
+	chunks := entry.GetChunks()
+	if len(chunks) != 2 {
+		t.Fatalf("entry chunks = %d, want 2", len(chunks))
+	}
+	if chunks[0].FileId != fidA || chunks[0].Offset != 0 || chunks[0].Size != 8 {
+		t.Errorf("chunk[0] = %s@%d+%d, want %s@0+8", chunks[0].FileId, chunks[0].Offset, chunks[0].Size, fidA)
+	}
+	if chunks[1].FileId != fidB || chunks[1].Offset != 8 || chunks[1].Size != 4 {
+		t.Errorf("chunk[1] = %s@%d+%d, want %s@8+4", chunks[1].FileId, chunks[1].Offset, chunks[1].Size, fidB)
+	}
+
+	for _, uploadID := range []string{tusTestPartialAID, tusTestPartialBID} {
+		if _, err := store.FindEntry(context.Background(), util.FullPath(fs.tusSessionInfoPath(uploadID))); err == nil {
+			t.Errorf("partial session %s still present after concatenation", uploadID)
+		}
+	}
+}
+
+// TestFilerServer_tusConcatFinal_Validation covers the final upload request
+// guards: header misuse, unusable references, unfinished or foreign partials.
+func TestFilerServer_tusConcatFinal_Validation(t *testing.T) {
+	uploadsRef := func(uploadID string) string { return "/.tus/.uploads/" + uploadID }
+	completePartial := func(fs *FilerServer, store *renameTestStore, t *testing.T, uploadID, targetPath string, size int64) {
+		seedTusSession(t, fs, store, TusSession{ID: uploadID, TargetPath: targetPath, Size: size, Concat: TusConcatPartial})
+		seedTusChunk(t, fs, store, uploadID, 0, size, "3,01637037d6")
+	}
+
+	tests := []struct {
+		name         string
+		seed         func(t *testing.T, fs *FilerServer, store *renameTestStore)
+		headers      map[string]string
+		body         string
+		prefixes     []string
+		expectStatus int
+	}{
+		{
+			name:         "upload length rejected",
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID), "Upload-Length": "12"},
+			expectStatus: http.StatusBadRequest,
+		},
+		{
+			name:         "body rejected",
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID)},
+			body:         "x",
+			expectStatus: http.StatusForbidden,
+		},
+		{
+			name:         "reference outside uploads prefix",
+			headers:      map[string]string{"Upload-Concat": "final;/elsewhere/" + tusTestPartialAID},
+			expectStatus: http.StatusBadRequest,
+		},
+		{
+			name:         "duplicate reference",
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID) + " " + uploadsRef(tusTestPartialAID)},
+			expectStatus: http.StatusBadRequest,
+		},
+		{
+			name:         "empty reference list",
+			headers:      map[string]string{"Upload-Concat": "final;"},
+			expectStatus: http.StatusBadRequest,
+		},
+		{
+			name:         "missing partial",
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID)},
+			expectStatus: http.StatusNotFound,
+		},
+		{
+			name: "non-partial session rejected",
+			seed: func(t *testing.T, fs *FilerServer, store *renameTestStore) {
+				seedTusSession(t, fs, store, TusSession{ID: tusTestPartialAID, TargetPath: "/buckets/data/a.bin", Size: 1})
+			},
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID)},
+			expectStatus: http.StatusBadRequest,
+		},
+		{
+			name: "unfinished partial rejected",
+			seed: func(t *testing.T, fs *FilerServer, store *renameTestStore) {
+				seedTusSession(t, fs, store, TusSession{ID: tusTestPartialAID, TargetPath: "/buckets/data/a.bin", Size: 4, Concat: TusConcatPartial})
+			},
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID)},
+			expectStatus: http.StatusBadRequest,
+		},
+		{
+			name: "cross-prefix partial denied",
+			seed: func(t *testing.T, fs *FilerServer, store *renameTestStore) {
+				completePartial(fs, store, t, tusTestPartialAID, "/buckets/secret/victim.bin", 4)
+			},
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID)},
+			prefixes:     []string{"/buckets/data"},
+			expectStatus: http.StatusUnauthorized,
+		},
+		{
+			name: "combined size over maximum",
+			seed: func(t *testing.T, fs *FilerServer, store *renameTestStore) {
+				completePartial(fs, store, t, tusTestPartialAID, "/buckets/data/a.bin", TusDefaultMaxSize)
+				seedTusSession(t, fs, store, TusSession{ID: tusTestPartialBID, TargetPath: "/buckets/data/b.bin", Size: 1, Concat: TusConcatPartial})
+			},
+			headers:      map[string]string{"Upload-Concat": "final;" + uploadsRef(tusTestPartialAID) + " " + uploadsRef(tusTestPartialBID)},
+			expectStatus: http.StatusRequestEntityTooLarge,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs, store := newTusTestServer(t, nil)
+			if tt.seed != nil {
+				tt.seed(t, fs, store)
+			}
+			headers := map[string]string{
+				"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, tt.prefixes, nil),
+			}
+			for k, v := range tt.headers {
+				headers[k] = v
+			}
+			req := tusRequest(http.MethodPost, "/.tus/buckets/data/final.bin", headers, tt.body)
+			rec := httptest.NewRecorder()
+			fs.tusHandler(rec, req)
+
+			if rec.Code != tt.expectStatus {
+				t.Fatalf("final POST = %d, want %d; body=%q", rec.Code, tt.expectStatus, rec.Body.String())
+			}
+			if _, err := store.FindEntry(context.Background(), util.FullPath("/buckets/data/final.bin")); err == nil {
+				t.Fatal("rejected concatenation still created the target entry")
+			}
+		})
+	}
+}
+
+// TestFilerServer_tusConcatFinal_ClaimedPartialRejected verifies a partial
+// already claimed by a concurrent final cannot be consumed again, and that the
+// foreign claim is left in place.
+func TestFilerServer_tusConcatFinal_ClaimedPartialRejected(t *testing.T) {
+	fs, store := newTusTestServer(t, nil)
+	seedTusSession(t, fs, store, TusSession{ID: tusTestPartialAID, TargetPath: "/buckets/data/a.bin", Size: 4, Concat: TusConcatPartial})
+	seedTusChunk(t, fs, store, tusTestPartialAID, 0, 4, "3,01637037d6")
+	markerPath := util.FullPath(fs.tusSessionConsumedPath(tusTestPartialAID))
+	if err := store.InsertEntry(context.Background(), &filer.Entry{FullPath: markerPath}); err != nil {
+		t.Fatalf("seed consumed marker: %v", err)
+	}
+
+	req := tusRequest(http.MethodPost, "/.tus/buckets/data/final.bin", map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+		"Upload-Concat": "final;/.tus/.uploads/" + tusTestPartialAID,
+	}, "")
+	rec := httptest.NewRecorder()
+	fs.tusHandler(rec, req)
+
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("final POST = %d, want %d; body=%q", rec.Code, http.StatusConflict, rec.Body.String())
+	}
+	if _, err := store.FindEntry(context.Background(), markerPath); err != nil {
+		t.Fatal("foreign claim was released by the losing request")
+	}
+}
+
+// TestFilerServer_tusDeleteHandler_ConsumedSessionKeepsChunks verifies deleting
+// a consumed session removes its metadata without freeing its chunks. The test
+// filer has no chunk deletion queue, so an attempt to free chunks would panic.
+func TestFilerServer_tusDeleteHandler_ConsumedSessionKeepsChunks(t *testing.T) {
+	fs, store := newTusTestServer(t, nil)
+	seedTusSession(t, fs, store, TusSession{ID: tusTestPartialAID, TargetPath: "/buckets/data/a.bin", Size: 4, Concat: TusConcatPartial})
+	seedTusChunk(t, fs, store, tusTestPartialAID, 0, 4, "3,01637037d6")
+	if err := store.InsertEntry(context.Background(), &filer.Entry{FullPath: util.FullPath(fs.tusSessionConsumedPath(tusTestPartialAID))}); err != nil {
+		t.Fatalf("seed consumed marker: %v", err)
+	}
+
+	req := tusRequest(http.MethodDelete, "/.tus/.uploads/"+tusTestPartialAID, map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+	}, "")
+	rec := httptest.NewRecorder()
+	fs.tusHandler(rec, req)
+
+	if rec.Code != http.StatusNoContent {
+		t.Fatalf("DELETE = %d, want %d; body=%q", rec.Code, http.StatusNoContent, rec.Body.String())
+	}
+	if _, err := store.FindEntry(context.Background(), util.FullPath(fs.tusSessionInfoPath(tusTestPartialAID))); err == nil {
+		t.Fatal("consumed session metadata still present after DELETE")
+	}
+}
+
+// TestFilerServer_tusPatchHandler_FinalRejected verifies PATCH against a final
+// upload URL is refused, per the concatenation extension.
+func TestFilerServer_tusPatchHandler_FinalRejected(t *testing.T) {
+	fs, store := newTusTestServer(t, nil)
+	seedTusSession(t, fs, store, TusSession{ID: tusTestUploadID, TargetPath: "/buckets/data/final.bin", Size: 4, Concat: "final;/.tus/.uploads/" + tusTestPartialAID})
+
+	req := tusRequest(http.MethodPatch, "/.tus/.uploads/"+tusTestUploadID, map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+		"Content-Type":  "application/offset+octet-stream",
+		"Upload-Offset": "0",
+	}, "")
+	rec := httptest.NewRecorder()
+	fs.tusHandler(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("PATCH final = %d, want %d; body=%q", rec.Code, http.StatusForbidden, rec.Body.String())
+	}
+}
diff --git a/weed/server/filer_server_tus_handlers.go b/weed/server/filer_server_tus_handlers.go
index 5b72e45a8b..a48ad142c1 100644
--- a/weed/server/filer_server_tus_handlers.go
+++ b/weed/server/filer_server_tus_handlers.go
@@ -8,14 +8,13 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"path"
 	"strconv"
 	"strings"
-	"time"
 
 	"github.com/google/uuid"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
@@ -86,8 +85,24 @@ func (fs *FilerServer) tusHandler(w http.ResponseWriter, r *http.Request) {
 			writeJsonError(w, r, http.StatusUnauthorized, errors.New("wrong jwt"))
 			return
 		}
+		// One mutating request per session at a time, like tusd: a PATCH retried
+		// while its predecessor is still storing a sub-chunk would otherwise
+		// record the same range twice, and a DELETE would race the writer. The
+		// chunk state is loaded under this claim so the offset check sees every
+		// record the previous request left behind. 423 tells the client to retry.
+		if r.Method != http.MethodHead {
+			if !fs.lockTusUpload(uploadID) {
+				http.Error(w, "Upload is locked by another request", http.StatusLocked)
+				return
+			}
+			defer fs.unlockTusUpload(uploadID)
+		}
 		if err := fs.loadTusSessionChunks(ctx, session); err != nil {
 			glog.Errorf("Failed to load TUS session %s chunks: %v", uploadID, err)
+			if !errors.Is(err, filer_pb.ErrNotFound) {
+				http.Error(w, "Failed to load upload state", http.StatusInternalServerError)
+				return
+			}
 			writeTusSessionNotFound(w, r.Method)
 			return
 		}
@@ -112,12 +127,23 @@ func (fs *FilerServer) tusHandler(w http.ResponseWriter, r *http.Request) {
 			writeJsonError(w, r, http.StatusUnauthorized, errors.New("wrong jwt"))
 			return
 		}
-		fs.tusCreateHandler(w, r)
+		fs.tusCreateHandler(w, r, claims)
 	default:
 		w.WriteHeader(http.StatusMethodNotAllowed)
 	}
 }
 
+// lockTusUpload claims a session for one mutating request; it reports false
+// while another request holds the claim.
+func (fs *FilerServer) lockTusUpload(uploadID string) bool {
+	_, loaded := fs.tusActiveUploads.LoadOrStore(uploadID, struct{}{})
+	return !loaded
+}
+
+func (fs *FilerServer) unlockTusUpload(uploadID string) {
+	fs.tusActiveUploads.Delete(uploadID)
+}
+
 // writeTusSessionNotFound answers a request whose session cannot be resolved.
 // DELETE is idempotent and returns 204 for a missing session; other verbs 404.
 func writeTusSessionNotFound(w http.ResponseWriter, method string) {
@@ -180,12 +206,22 @@ func (fs *FilerServer) tusOptionsHandler(w http.ResponseWriter, r *http.Request)
 }
 
 // tusCreateHandler handles POST requests to create new uploads
-func (fs *FilerServer) tusCreateHandler(w http.ResponseWriter, r *http.Request) {
+func (fs *FilerServer) tusCreateHandler(w http.ResponseWriter, r *http.Request, claims *security.SeaweedFilerClaims) {
 	// Use a context that ignores cancellation from the request context.
 	// Internal operations (creating TUS session, writing data, completing uploads)
 	// may exceed the filer's client connection inactivity timeout.
 	ctx := context.WithoutCancel(r.Context())
 
+	concat := r.Header.Get("Upload-Concat")
+	if strings.HasPrefix(concat, TusConcatFinalPrefix) {
+		fs.tusConcatFinalHandler(w, r, claims, concat)
+		return
+	}
+	if concat != "" && concat != TusConcatPartial {
+		http.Error(w, "Invalid Upload-Concat", http.StatusBadRequest)
+		return
+	}
+
 	// Parse Upload-Length header (required)
 	uploadLengthStr := r.Header.Get("Upload-Length")
 	if uploadLengthStr == "" {
@@ -205,9 +241,6 @@ func (fs *FilerServer) tusCreateHandler(w http.ResponseWriter, r *http.Request)
 	// Parse Upload-Metadata header (optional)
 	metadata := parseTusMetadata(r.Header.Get("Upload-Metadata"))
 
-	// TusBasePath is pre-normalized in filer_server.go (leading slash, no trailing slash)
-	tusPrefix := fs.option.TusBasePath
-
 	// Determine target path from request URL (leading slash guaranteed)
 	targetPath := fs.tusTargetPath(r)
 	if targetPath == "" || targetPath == "/" {
@@ -226,18 +259,14 @@ func (fs *FilerServer) tusCreateHandler(w http.ResponseWriter, r *http.Request)
 	uploadID := uuid.New().String()
 
 	// Create upload session
-	session, err := fs.createTusSession(ctx, uploadID, targetPath, uploadLength, metadata)
+	session, err := fs.createTusSession(ctx, uploadID, targetPath, uploadLength, metadata, concat)
 	if err != nil {
 		glog.Errorf("Failed to create TUS session: %v", err)
 		http.Error(w, "Failed to create upload", http.StatusInternalServerError)
 		return
 	}
 
-	// Build upload location URL (ensure it starts with single /)
-	uploadLocation := path.Clean(fmt.Sprintf("%s/.uploads/%s", tusPrefix, uploadID))
-	if !strings.HasPrefix(uploadLocation, "/") {
-		uploadLocation = "/" + uploadLocation
-	}
+	uploadLocation := fs.tusUploadLocation(uploadID)
 
 	// Handle creation-with-upload extension
 	// TUS requires Content-Length for uploads; reject chunked encoding
@@ -249,7 +278,7 @@ func (fs *FilerServer) tusCreateHandler(w http.ResponseWriter, r *http.Request)
 		}
 		if r.ContentLength > 0 {
 			// Upload data in the creation request
-			bytesWritten, uploadErr := fs.tusWriteData(ctx, session, 0, r.Body, r.ContentLength)
+			bytesWritten, uploadErr := fs.tusWriteData(ctx, r, session, 0, r.Body, r.ContentLength)
 			if uploadErr != nil {
 				// Cleanup session on failure
 				fs.deleteTusSession(ctx, uploadID)
@@ -265,8 +294,9 @@ func (fs *FilerServer) tusCreateHandler(w http.ResponseWriter, r *http.Request)
 			// Update offset in response header
 			w.Header().Set("Upload-Offset", strconv.FormatInt(bytesWritten, 10))
 
-			// Check if upload is complete
-			if bytesWritten == session.Size {
+			// Check if upload is complete; a partial upload keeps its chunks for
+			// a later concatenation instead of landing at the target path.
+			if bytesWritten == session.Size && !session.isPartial() {
 				// Ensure the pinned session still exists, then refresh its chunks.
 				if err = fs.refreshTusSessionChunks(ctx, session); err != nil {
 					glog.Errorf("Failed to get updated TUS session: %v", err)
@@ -287,8 +317,185 @@ func (fs *FilerServer) tusCreateHandler(w http.ResponseWriter, r *http.Request)
 	w.WriteHeader(http.StatusCreated)
 }
 
+// tusUploadLocation builds the upload URL path for a session id (single leading /)
+func (fs *FilerServer) tusUploadLocation(uploadID string) string {
+	// TusBasePath is pre-normalized in filer_server.go (leading slash, no trailing slash)
+	uploadLocation := path.Clean(fmt.Sprintf("%s/.uploads/%s", fs.option.TusBasePath, uploadID))
+	if !strings.HasPrefix(uploadLocation, "/") {
+		uploadLocation = "/" + uploadLocation
+	}
+	return uploadLocation
+}
+
+// parseTusConcatFinal extracts the partial upload ids from an Upload-Concat
+// final header. Each reference may be an absolute URL or a path, must point at
+// this server's upload location, and may appear only once since concatenation
+// consumes the partial.
+func (fs *FilerServer) parseTusConcatFinal(concat string) ([]string, error) {
+	uploadsPrefix := fs.option.TusBasePath + "/.uploads/"
+	var partialIDs []string
+	seen := make(map[string]bool)
+	for _, ref := range strings.Fields(strings.TrimPrefix(concat, TusConcatFinalPrefix)) {
+		refURL, err := url.Parse(ref)
+		if err != nil {
+			return nil, fmt.Errorf("invalid partial upload reference %q", ref)
+		}
+		partialID := strings.TrimPrefix(refURL.Path, uploadsPrefix)
+		if partialID == refURL.Path || !isCanonicalTusUploadID(partialID) {
+			return nil, fmt.Errorf("invalid partial upload reference %q", ref)
+		}
+		if seen[partialID] {
+			return nil, fmt.Errorf("duplicate partial upload reference %q", ref)
+		}
+		seen[partialID] = true
+		partialIDs = append(partialIDs, partialID)
+	}
+	if len(partialIDs) == 0 {
+		return nil, errors.New("no partial uploads listed")
+	}
+	return partialIDs, nil
+}
+
+// tusConcatFinalHandler handles POST requests carrying Upload-Concat final. It
+// stitches the listed completed partial uploads, in order, into one entry at
+// the request's target path.
+func (fs *FilerServer) tusConcatFinalHandler(w http.ResponseWriter, r *http.Request, claims *security.SeaweedFilerClaims, concat string) {
+	ctx := context.WithoutCancel(r.Context())
+
+	// The final upload's length is the sum of the partial lengths.
+	if r.Header.Get("Upload-Length") != "" {
+		http.Error(w, "Upload-Length not allowed for a final upload", http.StatusBadRequest)
+		return
+	}
+	if r.ContentLength > 0 {
+		http.Error(w, "Cannot upload data to a final upload", http.StatusForbidden)
+		return
+	}
+
+	partialIDs, err := fs.parseTusConcatFinal(concat)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	targetPath := fs.tusTargetPath(r)
+	if targetPath == "" || targetPath == "/" {
+		http.Error(w, "Target path required", http.StatusBadRequest)
+		return
+	}
+	if fs.filer.FilerConf.MatchStorageRule(targetPath).ReadOnly {
+		http.Error(w, ErrReadOnly.Error(), http.StatusInsufficientStorage)
+		return
+	}
+
+	// Every partial must exist, be authorized for this credential, and be
+	// complete; concatenation-unfinished is not offered. Each one is claimed
+	// with an exclusive consumed marker before its chunks are read, so a
+	// concurrent final cannot consume the same partial and a concurrent DELETE
+	// or expiry cleanup cannot free chunks that move to the final entry.
+	var partials []*TusSession
+	var claimedIDs []string
+	var totalSize int64
+	releaseClaims := func() {
+		for _, claimedID := range claimedIDs {
+			fs.rollbackTusSessionConsumed(ctx, claimedID)
+		}
+	}
+	for _, partialID := range partialIDs {
+		partial, err := fs.readTusSessionInfo(ctx, partialID)
+		if err != nil {
+			glog.V(1).Infof("TUS partial %s not resolved: %v", partialID, err)
+			releaseClaims()
+			http.Error(w, "Partial upload not found", http.StatusNotFound)
+			return
+		}
+		if !authorizeFilerJwtPaths(r, claims, []string{partial.TargetPath}) {
+			releaseClaims()
+			writeJsonError(w, r, http.StatusUnauthorized, errors.New("wrong jwt"))
+			return
+		}
+		if !partial.isPartial() {
+			releaseClaims()
+			http.Error(w, "Not a partial upload: "+partialID, http.StatusBadRequest)
+			return
+		}
+		totalSize += partial.Size
+		if totalSize > fs.option.TusMaxSize {
+			releaseClaims()
+			http.Error(w, "Combined upload size exceeds maximum", http.StatusRequestEntityTooLarge)
+			return
+		}
+		if err := fs.claimTusPartial(ctx, partial); err != nil {
+			releaseClaims()
+			switch {
+			case errors.Is(err, filer_pb.ErrEntryAlreadyExists):
+				http.Error(w, "Partial upload already consumed: "+partialID, http.StatusConflict)
+			case errors.Is(err, filer_pb.ErrNotFound):
+				glog.V(1).Infof("TUS partial %s changed before concatenation: %v", partialID, err)
+				http.Error(w, "Partial upload not found", http.StatusNotFound)
+			default:
+				glog.Errorf("Failed to claim TUS partial %s: %v", partialID, err)
+				http.Error(w, "Failed to create upload", http.StatusInternalServerError)
+			}
+			return
+		}
+		claimedIDs = append(claimedIDs, partialID)
+		if partial.Offset != partial.Size {
+			releaseClaims()
+			http.Error(w, "Partial upload not finished: "+partialID, http.StatusBadRequest)
+			return
+		}
+		partials = append(partials, partial)
+	}
+
+	metadata := parseTusMetadata(r.Header.Get("Upload-Metadata"))
+	uploadID := uuid.New().String()
+	session, err := fs.createTusSession(ctx, uploadID, targetPath, totalSize, metadata, concat)
+	if err != nil {
+		glog.Errorf("Failed to create TUS session: %v", err)
+		releaseClaims()
+		http.Error(w, "Failed to create upload", http.StatusInternalServerError)
+		return
+	}
+
+	// Re-base each partial's chunks onto the final upload's offset space.
+	for _, partial := range partials {
+		for _, chunk := range partial.Chunks {
+			session.Chunks = append(session.Chunks, &TusChunkInfo{
+				Offset:   session.Offset + chunk.Offset,
+				Size:     chunk.Size,
+				FileId:   chunk.FileId,
+				UploadAt: chunk.UploadAt,
+			})
+		}
+		session.Offset += partial.Size
+	}
+
+	if err := fs.completeTusUpload(ctx, session); err != nil {
+		fs.deleteTusSession(ctx, uploadID)
+		releaseClaims()
+		glog.Errorf("Failed to complete TUS concatenation: %v", err)
+		writeTusCompleteError(w, err)
+		return
+	}
+
+	// The chunks now belong to the final entry, so remove only the partials'
+	// session metadata.
+	for _, partial := range partials {
+		if err := fs.filer.DeleteEntryMetaAndData(ctx, util.FullPath(fs.tusSessionPath(partial.ID)), true, false, false, false, nil, 0); err != nil {
+			glog.V(1).Infof("Failed to cleanup TUS partial session %s: %v", partial.ID, err)
+		}
+	}
+
+	w.Header().Set("Location", fs.tusUploadLocation(uploadID))
+	w.WriteHeader(http.StatusCreated)
+}
+
 // tusHeadHandler handles HEAD requests to get current upload offset
 func (fs *FilerServer) tusHeadHandler(w http.ResponseWriter, session *TusSession) {
+	if session.Concat != "" {
+		w.Header().Set("Upload-Concat", session.Concat)
+	}
 	w.Header().Set("Upload-Offset", strconv.FormatInt(session.Offset, 10))
 	w.Header().Set("Upload-Length", strconv.FormatInt(session.Size, 10))
 	w.Header().Set("Cache-Control", "no-store")
@@ -297,6 +504,11 @@ func (fs *FilerServer) tusHeadHandler(w http.ResponseWriter, session *TusSession
 
 // tusPatchHandler handles PATCH requests to upload data
 func (fs *FilerServer) tusPatchHandler(w http.ResponseWriter, r *http.Request, session *TusSession) {
+	if session.isFinal() {
+		http.Error(w, "Cannot PATCH a final upload", http.StatusForbidden)
+		return
+	}
+
 	// Use a context that ignores cancellation from the request context.
 	// The filer's connection has an inactivity timeout: after the request body is fully read,
 	// internal operations (assigning file IDs, uploading to volume servers, completing uploads)
@@ -335,7 +547,7 @@ func (fs *FilerServer) tusPatchHandler(w http.ResponseWriter, r *http.Request, s
 	}
 
 	// Write data
-	bytesWritten, err := fs.tusWriteData(ctx, session, uploadOffset, r.Body, r.ContentLength)
+	bytesWritten, err := fs.tusWriteData(ctx, r, session, uploadOffset, r.Body, r.ContentLength)
 	if err != nil {
 		if errors.Is(err, ErrContentTooLarge) {
 			http.Error(w, "Content-Length exceeds remaining upload size", http.StatusRequestEntityTooLarge)
@@ -348,8 +560,9 @@ func (fs *FilerServer) tusPatchHandler(w http.ResponseWriter, r *http.Request, s
 
 	newOffset := uploadOffset + bytesWritten
 
-	// Check if upload is complete
-	if newOffset == session.Size {
+	// Check if upload is complete; a partial upload keeps its chunks for a later
+	// concatenation instead of landing at the target path.
+	if newOffset == session.Size && !session.isPartial() {
 		// Ensure the authorized session still exists, then refresh its chunks.
 		if err = fs.refreshTusSessionChunks(ctx, session); err != nil {
 			glog.Errorf("Failed to get updated TUS session: %v", err)
@@ -392,7 +605,7 @@ var ErrContentTooLarge = fmt.Errorf("content length exceeds remaining upload siz
 
 // tusWriteData uploads data to volume servers in streaming chunks and updates session
 // It reads data in fixed-size sub-chunks to avoid buffering large TUS chunks entirely in memory
-func (fs *FilerServer) tusWriteData(ctx context.Context, session *TusSession, offset int64, reader io.Reader, contentLength int64) (int64, error) {
+func (fs *FilerServer) tusWriteData(ctx context.Context, r *http.Request, session *TusSession, offset int64, reader io.Reader, contentLength int64) (int64, error) {
 	if contentLength == 0 {
 		return 0, nil
 	}
@@ -444,13 +657,6 @@ func (fs *FilerServer) tusWriteData(ctx context.Context, session *TusSession, of
 	// Upload in streaming chunks to avoid buffering entire content in memory
 	var totalWritten int64
 	var uploadErr error
-	var uploadedChunks []*TusChunkInfo
-
-	// Create one uploader for all sub-chunks to reuse HTTP client connections
-	uploader, uploaderErr := operation.NewUploader()
-	if uploaderErr != nil {
-		return 0, fmt.Errorf("create uploader: %w", uploaderErr)
-	}
 
 	chunkBuf := make([]byte, tusChunkSize)
 	currentOffset := offset
@@ -471,67 +677,42 @@ func (fs *FilerServer) tusWriteData(ctx context.Context, session *TusSession, of
 			break
 		}
 
-		chunkData := chunkBuf[:n]
-
-		// Assign file ID from master for this sub-chunk
-		fileId, urlLocation, auth, assignErr := fs.assignNewFileInfo(ctx, so, uint64(n))
-		if assignErr != nil {
-			uploadErr = fmt.Errorf("assign volume: %w", assignErr)
+		// Store the sub-chunk through the regular write path's chunk writer,
+		// which assigns a fresh file id per attempt; a failed attempt's needle
+		// is returned so it can be freed instead of lingering unreferenced.
+		chunks, chunkErr := fs.dataToChunkWithSSE(ctx, r, "", mimeType, chunkBuf[:n], currentOffset, so)
+		if chunkErr != nil {
+			fs.filer.DeleteUncommittedChunks(ctx, chunks)
+			uploadErr = fmt.Errorf("upload data: %w", chunkErr)
 			break
 		}
-
-		// Upload to volume server using BytesReader (avoids double buffering in uploader)
-		uploadResult, uploadResultErr, _ := uploader.Upload(ctx, util.NewBytesReader(chunkData), &operation.UploadOption{
-			UploadUrl:         urlLocation,
-			Filename:          "",
-			Cipher:            fs.option.Cipher,
-			IsInputCompressed: false,
-			MimeType:          mimeType,
-			PairMap:           nil,
-			Jwt:               auth,
-		})
-		if uploadResultErr != nil {
-			uploadErr = fmt.Errorf("upload data: %w", uploadResultErr)
+		if len(chunks) == 0 {
+			uploadErr = fmt.Errorf("no chunk stored at offset %d", currentOffset)
 			break
 		}
+		stored := chunks[0]
 
-		// Create chunk info and save it
 		chunk := &TusChunkInfo{
-			Offset:   currentOffset,
-			Size:     int64(uploadResult.Size),
-			FileId:   fileId,
-			UploadAt: time.Now().UnixNano(),
+			Offset:   stored.Offset,
+			Size:     int64(stored.Size),
+			FileId:   stored.FileId,
+			UploadAt: stored.ModifiedTsNs,
 		}
 
 		if saveErr := fs.saveTusChunk(ctx, session.ID, chunk); saveErr != nil {
-			// Cleanup this chunk on failure
-			fs.filer.DeleteChunks(ctx, util.FullPath(session.TargetPath), []*filer_pb.FileChunk{
-				{FileId: fileId},
-			})
+			fs.deleteTusChunk(ctx, session, chunk)
 			uploadErr = fmt.Errorf("update session: %w", saveErr)
 			break
 		}
 
-		uploadedChunks = append(uploadedChunks, chunk)
-
-		totalWritten += int64(uploadResult.Size)
-		currentOffset += int64(uploadResult.Size)
+		totalWritten += chunk.Size
+		currentOffset += chunk.Size
 		stats.FilerHandlerCounter.WithLabelValues("tusUploadChunk").Inc()
 	}
 
-	if uploadErr != nil {
-		// Cleanup all uploaded chunks on error
-		if len(uploadedChunks) > 0 {
-			var chunksToDelete []*filer_pb.FileChunk
-			for _, c := range uploadedChunks {
-				chunksToDelete = append(chunksToDelete, &filer_pb.FileChunk{FileId: c.FileId})
-			}
-			fs.filer.DeleteChunks(ctx, util.FullPath(session.TargetPath), chunksToDelete)
-		}
-		return 0, uploadErr
-	}
-
-	return totalWritten, nil
+	// Sub-chunks already recorded stay: the session offset a resuming client
+	// reads back covers them, and the completed entry is assembled from them.
+	return totalWritten, uploadErr
 }
 
 // parseTusMetadata parses the Upload-Metadata header
diff --git a/weed/server/filer_server_tus_jwt_test.go b/weed/server/filer_server_tus_jwt_test.go
index c8291ed2b6..875a3ef84f 100644
--- a/weed/server/filer_server_tus_jwt_test.go
+++ b/weed/server/filer_server_tus_jwt_test.go
@@ -46,9 +46,10 @@ func newTusTestServer(t *testing.T, sessions map[string]string) (*FilerServer, *
 	t.Helper()
 	store := newRenameTestStore()
 	fs := &FilerServer{
-		filer:      newRenameTestFiler(t, store),
-		filerGuard: security.NewGuard(nil, tusTestWriteKey, 0, tusTestReadKey, 0),
-		option:     &FilerOption{TusBasePath: "/.tus", TusMaxSize: TusDefaultMaxSize},
+		filer:          newRenameTestFiler(t, store),
+		filerGuard:     security.NewGuard(nil, tusTestWriteKey, 0, tusTestReadKey, 0),
+		option:         &FilerOption{TusBasePath: "/.tus", TusMaxSize: TusDefaultMaxSize},
+		entryLockTable: util.NewLockTable[util.FullPath](),
 	}
 	for uploadID, targetPath := range sessions {
 		seedTusSession(t, fs, store, TusSession{ID: uploadID, TargetPath: targetPath, Size: 1})
diff --git a/weed/server/filer_server_tus_lock_test.go b/weed/server/filer_server_tus_lock_test.go
new file mode 100644
index 0000000000..9ca53273a4
--- /dev/null
+++ b/weed/server/filer_server_tus_lock_test.go
@@ -0,0 +1,51 @@
+package weed_server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// TestFilerServer_tusHandler_ConcurrentMutationLocked verifies a session with a
+// mutating request in flight refuses a second PATCH or DELETE with 423 while
+// HEAD still answers, and accepts the retry once the first request finishes.
+func TestFilerServer_tusHandler_ConcurrentMutationLocked(t *testing.T) {
+	fs, _ := newTusTestServer(t, map[string]string{tusTestUploadID: "/buckets/data/file.bin"})
+
+	if !fs.lockTusUpload(tusTestUploadID) {
+		t.Fatal("lockTusUpload failed on an idle session")
+	}
+
+	do := func(method string, headers map[string]string) int {
+		req := tusRequest(method, "/.tus/.uploads/"+tusTestUploadID, headers, "")
+		rec := httptest.NewRecorder()
+		fs.tusHandler(rec, req)
+		return rec.Code
+	}
+	patchHeaders := map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+		"Content-Type":  "application/offset+octet-stream",
+		"Upload-Offset": "0",
+	}
+	deleteHeaders := map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+	}
+	headHeaders := map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestReadKey, nil, nil),
+	}
+
+	if code := do(http.MethodPatch, patchHeaders); code != http.StatusLocked {
+		t.Errorf("PATCH while locked = %d, want %d", code, http.StatusLocked)
+	}
+	if code := do(http.MethodDelete, deleteHeaders); code != http.StatusLocked {
+		t.Errorf("DELETE while locked = %d, want %d", code, http.StatusLocked)
+	}
+	if code := do(http.MethodHead, headHeaders); code != http.StatusOK {
+		t.Errorf("HEAD while locked = %d, want %d", code, http.StatusOK)
+	}
+
+	fs.unlockTusUpload(tusTestUploadID)
+	if code := do(http.MethodPatch, patchHeaders); code != http.StatusNoContent {
+		t.Errorf("PATCH after unlock = %d, want %d", code, http.StatusNoContent)
+	}
+}
diff --git a/weed/server/filer_server_tus_session.go b/weed/server/filer_server_tus_session.go
index 5c0494d44c..e9d32c2526 100644
--- a/weed/server/filer_server_tus_session.go
+++ b/weed/server/filer_server_tus_session.go
@@ -25,8 +25,11 @@ const (
 	TusDefaultSessionExpiry = 24 * time.Hour
 	TusUploadsFolder        = ".uploads.tus"
 	TusInfoFileName         = ".info"
+	TusConsumedFileName     = ".consumed"
 	TusChunkExt             = ".chunk"
-	TusExtensions           = "creation,creation-with-upload,termination"
+	TusExtensions           = "creation,creation-with-upload,termination,concatenation"
+	TusConcatPartial        = "partial"
+	TusConcatFinalPrefix    = "final;"
 )
 
 // ErrWormEnforced marks a TUS completion rejected because the target entry is
@@ -43,9 +46,20 @@ type TusSession struct {
 	Metadata   map[string]string `json:"metadata,omitempty"`
 	CreatedAt  time.Time         `json:"created_at"`
 	ExpiresAt  time.Time         `json:"expires_at,omitempty"`
+	Concat     string            `json:"concat,omitempty"`
 	Chunks     []*TusChunkInfo   `json:"chunks,omitempty"`
 }
 
+// isPartial reports whether the session is a concatenation partial upload: it
+// holds chunks for a later final upload instead of landing at its target path.
+func (session *TusSession) isPartial() bool {
+	return session.Concat == TusConcatPartial
+}
+
+func (session *TusSession) isFinal() bool {
+	return strings.HasPrefix(session.Concat, TusConcatFinalPrefix)
+}
+
 // TusChunkInfo tracks individual chunk uploads within a session
 type TusChunkInfo struct {
 	Offset   int64  `json:"offset"`
@@ -69,6 +83,68 @@ func (fs *FilerServer) tusSessionInfoPath(uploadID string) string {
 	return fmt.Sprintf("/%s/%s/%s", TusUploadsFolder, uploadID, TusInfoFileName)
 }
 
+// tusSessionConsumedPath returns the path of the marker recording that a
+// session's chunks belong to a completed upload and must not be freed with it.
+func (fs *FilerServer) tusSessionConsumedPath(uploadID string) string {
+	return fmt.Sprintf("/%s/%s/%s", TusUploadsFolder, uploadID, TusConsumedFileName)
+}
+
+// markTusSessionConsumed claims a session's chunks for a completed upload. With
+// exclusive set, a session already claimed by a concurrent request fails with
+// filer_pb.ErrEntryAlreadyExists so one partial cannot be consumed twice.
+func (fs *FilerServer) markTusSessionConsumed(ctx context.Context, uploadID string, exclusive bool) error {
+	return fs.filer.CreateEntry(ctx, &filer.Entry{
+		FullPath: util.FullPath(fs.tusSessionConsumedPath(uploadID)),
+		Attr: filer.Attr{
+			Mode:   0644,
+			Crtime: time.Now(),
+			Mtime:  time.Now(),
+			Uid:    OS_UID,
+			Gid:    OS_GID,
+		},
+	}, nil, exclusive, false, nil, true, fs.filer.MaxFilenameLength)
+}
+
+// isTusSessionConsumed fails closed: when the marker cannot be looked up, the
+// caller must not treat the session's chunks as free.
+// claimTusPartial claims a partial for one final upload, serialized per session
+// on this filer, and re-verifies the pinned session under the claim. A failed
+// verification releases the claim before returning.
+func (fs *FilerServer) claimTusPartial(ctx context.Context, partial *TusSession) error {
+	sessionPath := util.FullPath(fs.tusSessionPath(partial.ID))
+	pathLock := fs.entryLockTable.AcquireLock("tusClaim", sessionPath, util.ExclusiveLock)
+	defer fs.entryLockTable.ReleaseLock(sessionPath, pathLock)
+
+	if err := fs.markTusSessionConsumed(ctx, partial.ID, true); err != nil {
+		return err
+	}
+	if err := fs.refreshTusSessionChunks(ctx, partial); err != nil {
+		fs.rollbackTusSessionConsumed(ctx, partial.ID)
+		return err
+	}
+	return nil
+}
+
+// rollbackTusSessionConsumed releases a consumed marker after a failed claim or
+// completion. A failed rollback wedges the session as consumed: DELETE and
+// expiry then preserve its chunks, which leak until removed by fsck.
+func (fs *FilerServer) rollbackTusSessionConsumed(ctx context.Context, uploadID string) {
+	if err := fs.filer.DeleteEntryMetaAndData(ctx, util.FullPath(fs.tusSessionConsumedPath(uploadID)), false, false, false, false, nil, 0); err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		glog.Errorf("TUS session %s wedged as consumed, marker rollback failed: %v", uploadID, err)
+	}
+}
+
+func (fs *FilerServer) isTusSessionConsumed(ctx context.Context, uploadID string) (bool, error) {
+	_, err := fs.filer.FindEntry(ctx, util.FullPath(fs.tusSessionConsumedPath(uploadID)))
+	if err == nil {
+		return true, nil
+	}
+	if errors.Is(err, filer_pb.ErrNotFound) {
+		return false, nil
+	}
+	return false, err
+}
+
 // tusChunkPath returns the path to store a chunk info file
 // Format: /{TusUploadsFolder}/{uploadID}/chunk_{offset}_{size}_{encodedFileId}
 func (fs *FilerServer) tusChunkPath(uploadID string, offset, size int64, fileId string) string {
@@ -117,7 +193,7 @@ func parseTusChunkPath(entry *filer.Entry) (*TusChunkInfo, error) {
 }
 
 // createTusSession creates a new TUS upload session
-func (fs *FilerServer) createTusSession(ctx context.Context, uploadID, targetPath string, size int64, metadata map[string]string) (*TusSession, error) {
+func (fs *FilerServer) createTusSession(ctx context.Context, uploadID, targetPath string, size int64, metadata map[string]string, concat string) (*TusSession, error) {
 	session := &TusSession{
 		ID:         uploadID,
 		TargetPath: targetPath,
@@ -126,6 +202,7 @@ func (fs *FilerServer) createTusSession(ctx context.Context, uploadID, targetPat
 		Metadata:   metadata,
 		CreatedAt:  time.Now(),
 		ExpiresAt:  time.Now().Add(fs.option.TusSessionExpiry),
+		Concat:     concat,
 		Chunks:     []*TusChunkInfo{},
 	}
 
@@ -288,11 +365,9 @@ func (fs *FilerServer) loadTusSessionChunks(ctx context.Context, session *TusSes
 	return nil
 }
 
-// refreshTusSessionChunks verifies the pinned session still exists and still
-// identifies the same upload before refreshing its chunk state, so a PATCH
-// cannot complete after a concurrent DELETE or metadata replacement and land at
-// a TargetPath other than the one that was authorized.
-func (fs *FilerServer) refreshTusSessionChunks(ctx context.Context, session *TusSession) error {
+// verifyTusSessionUnchanged confirms the stored .info still identifies the same
+// pinned session.
+func (fs *FilerServer) verifyTusSessionUnchanged(ctx context.Context, session *TusSession) error {
 	stored, err := fs.readTusSessionInfo(ctx, session.ID)
 	if err != nil {
 		return err
@@ -300,6 +375,17 @@ func (fs *FilerServer) refreshTusSessionChunks(ctx context.Context, session *Tus
 	if stored.TargetPath != session.TargetPath || stored.Size != session.Size || !stored.CreatedAt.Equal(session.CreatedAt) {
 		return fmt.Errorf("TUS session identity changed: %s", session.ID)
 	}
+	return nil
+}
+
+// refreshTusSessionChunks verifies the pinned session still exists and still
+// identifies the same upload before refreshing its chunk state, so a PATCH
+// cannot complete after a concurrent DELETE or metadata replacement and land at
+// a TargetPath other than the one that was authorized.
+func (fs *FilerServer) refreshTusSessionChunks(ctx context.Context, session *TusSession) error {
+	if err := fs.verifyTusSessionUnchanged(ctx, session); err != nil {
+		return err
+	}
 	return fs.loadTusSessionChunks(ctx, session)
 }
 
@@ -331,8 +417,23 @@ func (fs *FilerServer) saveTusChunk(ctx context.Context, uploadID string, chunk
 	return nil
 }
 
+// deleteTusChunk drops a chunk's record before freeing its data, so a save that
+// failed after the record landed cannot leave the session pointing at a needle
+// that is about to be deleted. Data outliving a lost record only leaks.
+func (fs *FilerServer) deleteTusChunk(ctx context.Context, session *TusSession, chunk *TusChunkInfo) {
+	chunkPath := util.FullPath(fs.tusChunkPath(session.ID, chunk.Offset, chunk.Size, chunk.FileId))
+	if err := fs.filer.DeleteEntryMetaAndData(ctx, chunkPath, false, false, false, false, nil, 0); err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		glog.Errorf("TUS chunk %s record kept, its data leaks: %v", chunkPath, err)
+		return
+	}
+	fs.filer.DeleteChunks(ctx, util.FullPath(session.TargetPath), []*filer_pb.FileChunk{{FileId: chunk.FileId}})
+}
+
 // deleteTusSession removes a TUS upload session and all its data
 func (fs *FilerServer) deleteTusSession(ctx context.Context, uploadID string) error {
+	sessionPath := util.FullPath(fs.tusSessionPath(uploadID))
+	pathLock := fs.entryLockTable.AcquireLock("tusDelete", sessionPath, util.ExclusiveLock)
+	defer fs.entryLockTable.ReleaseLock(sessionPath, pathLock)
 
 	session, err := fs.getTusSession(ctx, uploadID)
 	if err != nil {
@@ -341,8 +442,21 @@ func (fs *FilerServer) deleteTusSession(ctx context.Context, uploadID string) er
 		return nil
 	}
 
-	// Batch delete all uploaded chunks from volume servers
-	if len(session.Chunks) > 0 {
+	// Remove the .info before deciding about chunk data: a final request claims
+	// its consumed marker before re-verifying the .info, so once the .info is
+	// gone no new claim can pass verification, and a claim that did pass was
+	// created earlier and is visible at the check below.
+	if err := fs.filer.DeleteEntryMetaAndData(ctx, util.FullPath(fs.tusSessionInfoPath(uploadID)), false, false, false, false, nil, 0); err != nil && !errors.Is(err, filer_pb.ErrNotFound) {
+		return fmt.Errorf("delete session info: %w", err)
+	}
+
+	// Batch delete all uploaded chunks from volume servers, unless the session
+	// was consumed: then the chunks belong to a completed upload's entry.
+	consumed, err := fs.isTusSessionConsumed(ctx, uploadID)
+	if err != nil {
+		return fmt.Errorf("check consumed marker: %w", err)
+	}
+	if len(session.Chunks) > 0 && !consumed {
 		var chunksToDelete []*filer_pb.FileChunk
 		for _, chunk := range session.Chunks {
 			if chunk.FileId != "" {
@@ -370,40 +484,55 @@ func (fs *FilerServer) completeTusUpload(ctx context.Context, session *TusSessio
 		return fmt.Errorf("upload incomplete: offset=%d, expected=%d", session.Offset, session.Size)
 	}
 
-	// Sort chunks by offset to ensure correct order
+	// Serialize the ownership transition with deleteTusSession on this filer;
+	// the marker/.info handshake below covers a delete served by another filer.
+	sessionPath := util.FullPath(fs.tusSessionPath(session.ID))
+	pathLock := fs.entryLockTable.AcquireLock("tusComplete", sessionPath, util.ExclusiveLock)
+	defer fs.entryLockTable.ReleaseLock(sessionPath, pathLock)
+
+	// Sort by offset, widest record first among equals, so a duplicate sorts
+	// behind the record that covers it
 	sort.Slice(session.Chunks, func(i, j int) bool {
-		return session.Chunks[i].Offset < session.Chunks[j].Offset
+		if session.Chunks[i].Offset != session.Chunks[j].Offset {
+			return session.Chunks[i].Offset < session.Chunks[j].Offset
+		}
+		return session.Chunks[i].Size > session.Chunks[j].Size
 	})
 
-	// Validate chunks are contiguous with no gaps or overlaps
-	expectedOffset := int64(0)
-	for _, chunk := range session.Chunks {
-		if chunk.Offset != expectedOffset {
-			return fmt.Errorf("chunk gap or overlap detected: expected offset %d, got %d", expectedOffset, chunk.Offset)
-		}
-		expectedOffset = chunk.Offset + chunk.Size
-	}
-	if expectedOffset != session.Size {
-		return fmt.Errorf("chunks do not cover full file: chunks end at %d, expected %d", expectedOffset, session.Size)
-	}
-
-	// Assemble file chunks in order
+	// A PATCH retried while its predecessor was still storing a sub-chunk can
+	// record one range twice. The records must cover the full size with no gap,
+	// the same watermark HEAD reports the offset from; a record extending
+	// coverage joins the entry (the read path resolves a partial overlap by
+	// ModifiedTsNs, and the raced copies carry identical bytes), while a fully
+	// covered duplicate is freed once the entry lands.
 	var fileChunks []*filer_pb.FileChunk
-
+	var duplicateChunks []*filer_pb.FileChunk
+	covered := int64(0)
 	for _, chunk := range session.Chunks {
+		if chunk.Offset > covered {
+			return fmt.Errorf("chunk gap detected: covered up to %d, next chunk at %d", covered, chunk.Offset)
+		}
+		if chunk.Offset+chunk.Size <= covered {
+			duplicateChunks = append(duplicateChunks, &filer_pb.FileChunk{FileId: chunk.FileId})
+			continue
+		}
+		covered = chunk.Offset + chunk.Size
+
 		fid, fidErr := filer_pb.ToFileIdObject(chunk.FileId)
 		if fidErr != nil {
 			return fmt.Errorf("invalid file ID %s at offset %d: %w", chunk.FileId, chunk.Offset, fidErr)
 		}
 
-		fileChunk := &filer_pb.FileChunk{
+		fileChunks = append(fileChunks, &filer_pb.FileChunk{
 			FileId:       chunk.FileId,
 			Offset:       chunk.Offset,
 			Size:         uint64(chunk.Size),
 			ModifiedTsNs: chunk.UploadAt,
 			Fid:          fid,
-		}
-		fileChunks = append(fileChunks, fileChunk)
+		})
+	}
+	if covered != session.Size {
+		return fmt.Errorf("chunks do not cover full file: chunks end at %d, expected %d", covered, session.Size)
 	}
 
 	// Determine content type from metadata
@@ -416,18 +545,6 @@ func (fs *FilerServer) completeTusUpload(ctx context.Context, session *TusSessio
 
 	// Create the final file entry
 	targetPath := util.FullPath(session.TargetPath)
-
-	// Apply the same read-only / WORM protections the normal write path enforces
-	// before landing the entry at the client-chosen target path.
-	if fs.filer.FilerConf.MatchStorageRule(string(targetPath)).ReadOnly {
-		return fmt.Errorf("%w: %s", ErrReadOnly, targetPath)
-	}
-	if wormEnforced, err := fs.wormEnforcedForEntry(ctx, string(targetPath)); err != nil {
-		return fmt.Errorf("check worm: %w", err)
-	} else if wormEnforced {
-		return ErrWormEnforced
-	}
-
 	entry := &filer.Entry{
 		FullPath: targetPath,
 		Attr: filer.Attr{
@@ -441,11 +558,60 @@ func (fs *FilerServer) completeTusUpload(ctx context.Context, session *TusSessio
 		Chunks: fileChunks,
 	}
 
+	// Apply the same storage rule (read-only prefixes, TTL) and WORM protections
+	// the normal write path enforces before landing the entry at the
+	// client-chosen target path.
+	so, err := fs.applyStorageDefaultsToEntry(ctx, entry)
+	if err != nil {
+		return err
+	}
+	if wormEnforced, err := fs.wormEnforcedForEntry(ctx, string(targetPath)); err != nil {
+		return fmt.Errorf("check worm: %w", err)
+	} else if wormEnforced {
+		return ErrWormEnforced
+	}
+
+	// Claim the chunks for the entry before creating it: once the marker is
+	// durable, a failed cleanup below cannot lead DELETE or expiry to free the
+	// entry's chunks. If the entry creation then fails, the client retry re-runs
+	// completion; an abandoned marked session leaks its chunks instead of
+	// corrupting a live entry.
+	if err := fs.markTusSessionConsumed(ctx, session.ID, false); err != nil {
+		return fmt.Errorf("mark session consumed: %w", err)
+	}
+
+	// Handshake with deleteTusSession, which removes the .info before checking
+	// the marker: a session whose .info is still present here cannot have its
+	// chunks freed by a delete that missed the marker just made durable.
+	if err := fs.verifyTusSessionUnchanged(ctx, session); err != nil {
+		fs.rollbackTusSessionConsumed(ctx, session.ID)
+		return fmt.Errorf("session deleted before completion: %w", err)
+	}
+
 	// Ensure parent directory exists
-	if err := fs.filer.CreateEntry(ctx, entry, nil, false, false, nil, false, fs.filer.MaxFilenameLength); err != nil {
+	if err := fs.filer.CreateEntry(ctx, entry, nil, false, false, nil, false, so.MaxFileNameLength); err != nil {
 		return fmt.Errorf("create final file entry: %w", err)
 	}
 
+	// Free the duplicates' data; their records go with the session directory
+	// below. A file id the entry still references is never freed: coverage is
+	// computed from ranges, so a malformed record could name one.
+	if len(duplicateChunks) > 0 {
+		referenced := make(map[string]bool, len(fileChunks))
+		for _, chunk := range fileChunks {
+			referenced[chunk.FileId] = true
+		}
+		var chunksToDelete []*filer_pb.FileChunk
+		for _, chunk := range duplicateChunks {
+			if !referenced[chunk.FileId] {
+				chunksToDelete = append(chunksToDelete, chunk)
+			}
+		}
+		if len(chunksToDelete) > 0 {
+			fs.filer.DeleteChunks(ctx, targetPath, chunksToDelete)
+		}
+	}
+
 	// Delete the session (but keep the chunks since they're now part of the final file)
 	sessionDirPath := util.FullPath(fs.tusSessionPath(session.ID))
 	if err := fs.filer.DeleteEntryMetaAndData(ctx, sessionDirPath, true, false, false, false, nil, 0); err != nil {
diff --git a/weed/server/filer_server_tus_transient_test.go b/weed/server/filer_server_tus_transient_test.go
new file mode 100644
index 0000000000..b10dc0249b
--- /dev/null
+++ b/weed/server/filer_server_tus_transient_test.go
@@ -0,0 +1,86 @@
+package weed_server
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// TestFilerServer_tusHandler_TransientChunkLoadFailure reproduces #11151: a
+// transient failure listing a session's chunk directory (volume timeout,
+// canceled context) must not be reported as 404/204, since readTusSessionInfo
+// already proved the session exists. A false "not found" makes a compliant
+// client discard a live session and orphan every chunk it committed.
+func TestFilerServer_tusHandler_TransientChunkLoadFailure(t *testing.T) {
+	tests := []struct {
+		name   string
+		method string
+	}{
+		{"HEAD", http.MethodHead},
+		{"PATCH", http.MethodPatch},
+		{"DELETE", http.MethodDelete},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs, store := newTusTestServer(t, map[string]string{tusTestUploadID: "/buckets/data/file.bin"})
+			store.listErr = context.Canceled
+
+			headers := map[string]string{"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil)}
+			if tt.method == http.MethodHead {
+				headers["Authorization"] = "Bearer " + signFilerToken(t, tusTestReadKey, nil, nil)
+			}
+			if tt.method == http.MethodPatch {
+				headers["Content-Type"] = "application/offset+octet-stream"
+				headers["Upload-Offset"] = "0"
+			}
+			req := tusRequest(tt.method, "/.tus/.uploads/"+tusTestUploadID, headers, "")
+			rec := httptest.NewRecorder()
+			fs.tusHandler(rec, req)
+
+			if rec.Code == http.StatusNotFound || rec.Code == http.StatusNoContent {
+				t.Fatalf("%s on a transient chunk-load failure = %d, want a server error, not a not-found status", tt.method, rec.Code)
+			}
+			if rec.Code < 500 {
+				t.Errorf("%s on a transient chunk-load failure = %d, want a 5xx status", tt.method, rec.Code)
+			}
+
+			store.listErr = nil
+			if _, err := store.FindEntry(context.Background(), util.FullPath(fs.tusSessionInfoPath(tusTestUploadID))); err != nil {
+				t.Errorf("session removed after a transient %s failure: %v", tt.method, err)
+			}
+		})
+	}
+}
+
+// TestFilerServer_tusHandler_ChunkLoadNotFoundStillNotFound verifies a chunk
+// listing failure that genuinely means "not found" is still reported as such,
+// so the fix for #11151 does not mask a real absence.
+func TestFilerServer_tusHandler_ChunkLoadNotFoundStillNotFound(t *testing.T) {
+	fs, store := newTusTestServer(t, map[string]string{tusTestUploadID: "/buckets/data/file.bin"})
+	store.listErr = filer_pb.ErrNotFound
+
+	req := tusRequest(http.MethodHead, "/.tus/.uploads/"+tusTestUploadID, map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestReadKey, nil, nil),
+	}, "")
+	rec := httptest.NewRecorder()
+	fs.tusHandler(rec, req)
+
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("HEAD on a genuinely missing session = %d, want %d", rec.Code, http.StatusNotFound)
+	}
+
+	deleteReq := tusRequest(http.MethodDelete, "/.tus/.uploads/"+tusTestUploadID, map[string]string{
+		"Authorization": "Bearer " + signFilerToken(t, tusTestWriteKey, nil, nil),
+	}, "")
+	deleteRec := httptest.NewRecorder()
+	fs.tusHandler(deleteRec, deleteReq)
+
+	if deleteRec.Code != http.StatusNoContent {
+		t.Fatalf("DELETE on a genuinely missing session = %d, want %d", deleteRec.Code, http.StatusNoContent)
+	}
+}
diff --git a/weed/server/filer_subscribe_agg_test.go b/weed/server/filer_subscribe_agg_test.go
new file mode 100644
index 0000000000..9d7a422f28
--- /dev/null
+++ b/weed/server/filer_subscribe_agg_test.go
@@ -0,0 +1,318 @@
+package weed_server
+
+// End-to-end tests for the aggregated (SubscribeMetadata) loop's peer
+// watermark holds. Peers report their progress at their own pace, so on a
+// cluster that keeps writing there is almost always an entry newer than the
+// low-watermark: a hold is the normal state, and has to be quiet and paced
+// rather than logged and retried per arriving event.
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"google.golang.org/grpc/peer"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+)
+
+const (
+	testSelfAddress = pb.ServerAddress("self:8888")
+	testPeerAddress = pb.ServerAddress("peer:8888")
+)
+
+// startAggregator gives the harness a meta aggregator with one remote peer, so
+// SubscribeMetadata takes the aggregated path instead of delegating to
+// SubscribeLocalMetadata.
+func (h *subscribeHarness) startAggregator() *filer.MetaAggregator {
+	ma := filer.NewMetaAggregator(h.f, testSelfAddress, nil)
+	ma.TrackPeerForTesting(testSelfAddress)
+	ma.TrackPeerForTesting(testPeerAddress)
+	h.f.MetaAggregator = ma
+	h.t.Cleanup(ma.MetaLogBuffer.ShutdownLogBuffer)
+	return ma
+}
+
+// reportPeers stands in for both peers' streams reporting through tsNs.
+func reportPeers(ma *filer.MetaAggregator, tsNs int64) {
+	reportPeersAt(ma, tsNs, tsNs)
+}
+
+// reportPeersAt is reportPeers with the two watermarks apart: a peer streams
+// an event well before it flushes it, so they advance independently.
+func reportPeersAt(ma *filer.MetaAggregator, deliveredTsNs, flushedTsNs int64) {
+	ma.ReportPeerWatermarksForTesting(testSelfAddress, deliveredTsNs, flushedTsNs)
+	ma.ReportPeerWatermarksForTesting(testPeerAddress, deliveredTsNs, flushedTsNs)
+}
+
+func (h *subscribeHarness) appendAggregated(tsNs int64) {
+	if err := h.f.MetaAggregator.MetaLogBuffer.AddLogEntryToBuffer(testEvent(tsNs, fmt.Sprintf("a-%d", tsNs))); err != nil {
+		h.t.Fatalf("append aggregated: %v", err)
+	}
+}
+
+func (h *subscribeHarness) subscribeAggregated(sinceNs int64) *runningSubscribe {
+	// A peer in the context keeps findClientAddress quiet, so an ERROR count
+	// across the run sees only what the subscribe loop itself writes.
+	ctx, cancel := context.WithCancel(peer.NewContext(context.Background(),
+		&peer.Peer{Addr: &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 12345}}))
+	stream := &fakeSubscribeStream{ctx: ctx}
+	req := &filer_pb.SubscribeMetadataRequest{
+		ClientName:  "agg-loop-test",
+		ClientId:    11,
+		ClientEpoch: 1,
+		SinceNs:     sinceNs,
+	}
+	r := &runningSubscribe{stream: stream, cancel: cancel, done: make(chan error, 1), finished: make(chan struct{})}
+	go func() {
+		r.done <- h.fs.SubscribeMetadata(req, stream)
+		close(r.finished)
+	}()
+	h.t.Cleanup(func() {
+		cancel()
+		select {
+		case <-r.finished:
+		case <-time.After(5 * time.Second):
+			h.t.Error("aggregated subscribe loop did not exit on cancel")
+		}
+	})
+	return r
+}
+
+// heldSubscriber starts a subscriber whose peers reported a moment ago and
+// then went quiet - the hold sits just behind live writes, exactly where a
+// quiet peer's idle heartbeat leaves it - and returns it with the write
+// timestamp the peers last reported.
+func (h *subscribeHarness) heldSubscriber() (*filer.MetaAggregator, *runningSubscribe, int64) {
+	ma := h.startAggregator()
+	frozen := time.Now().Add(-500 * time.Millisecond).UnixNano()
+	reportPeers(ma, frozen)
+	return ma, h.subscribeAggregated(frozen), frozen
+}
+
+// writeFor appends an entry every 2ms for d, reporting the peers through the
+// PREVIOUS entry each time when report is set: the live-cluster shape, where
+// the low-watermark keeps moving but always trails the newest entry, so every
+// read ends held.
+func (h *subscribeHarness) writeFor(ma *filer.MetaAggregator, d time.Duration, report bool) (written []int64, elapsed time.Duration) {
+	start := time.Now()
+	for stop := time.After(d); ; {
+		select {
+		case <-stop:
+			if report && len(written) > 0 {
+				reportPeers(ma, written[len(written)-1])
+			}
+			return written, time.Since(start)
+		default:
+		}
+		ts := time.Now().UnixNano()
+		h.appendAggregated(ts)
+		if report && len(written) > 0 {
+			reportPeers(ma, written[len(written)-1])
+		}
+		written = append(written, ts)
+		time.Sleep(2 * time.Millisecond)
+	}
+}
+
+// heldReads reads back the hold counter the loop keeps in place of the log
+// line, which is also how an operator sees a held subscriber now.
+func heldReads(scopes ...string) int {
+	if len(scopes) == 0 {
+		scopes = []string{"memory", "disk"}
+	}
+	var total int
+	for _, scope := range scopes {
+		total += int(testutil.ToFloat64(stats.FilerSubscribeWatermarkHolds.WithLabelValues(scope)))
+	}
+	return total
+}
+
+// waitForEventsAtLeastOnce asserts every want arrives, in order. The cursor a
+// hold rewinds to is inclusive of the last delivered entry, so each cycle
+// repeats it - at-least-once, which is the contract; a skip is not.
+func waitForEventsAtLeastOnce(t *testing.T, r *runningSubscribe, want []int64, timeout time.Duration) {
+	t.Helper()
+	last := want[len(want)-1]
+	deadline := time.Now().Add(timeout)
+	var got []int64
+	for time.Now().Before(deadline) {
+		got = eventTimestamps(r.stream.snapshot())
+		if len(got) > 0 && got[len(got)-1] >= last {
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	seen := make(map[int64]bool, len(got))
+	var prev int64
+	for _, ts := range got {
+		if ts < prev {
+			t.Fatalf("delivered %v after %v: out of order", time.Unix(0, ts), time.Unix(0, prev))
+		}
+		prev, seen[ts] = ts, true
+	}
+	for i, ts := range want {
+		if !seen[ts] {
+			t.Fatalf("event %d of %d (%v) never delivered", i+1, len(want), time.Unix(0, ts))
+		}
+	}
+}
+
+// TestSubscribeLoop_AggregatedHoldIsQuiet: every held read used to log an
+// ERROR, so a busy cluster wrote one line per arriving event.
+func TestSubscribeLoop_AggregatedHoldIsQuiet(t *testing.T) {
+	h := newSubscribeHarness(t)
+	ma, r, _ := h.heldSubscriber()
+
+	errorsBefore := glog.Stats.Error.Lines()
+	written, elapsed := h.writeFor(ma, time.Second, false)
+	errorLines := glog.Stats.Error.Lines() - errorsBefore
+
+	t.Logf("%d writes over %v produced %d ERROR lines", len(written), elapsed, errorLines)
+	if errorLines > 0 {
+		t.Fatalf("a held read logged %d ERROR lines over %d writes; holds are control flow", errorLines, len(written))
+	}
+	if got := eventTimestamps(r.stream.snapshot()); len(got) > 0 {
+		t.Fatalf("delivered %d events past the peers' watermark", len(got))
+	}
+}
+
+// TestSubscribeLoop_AggregatedHoldIsPaced is the other half: a held read used
+// to wait on the buffer's data channel, which the very next write signalled,
+// so the loop re-ran a whole pass - a log file listing in it - per event.
+// Arriving data cannot release a hold; only peer progress can.
+func TestSubscribeLoop_AggregatedHoldIsPaced(t *testing.T) {
+	h := newSubscribeHarness(t)
+	// Long enough that a hold paced by the retry interval alone is far below
+	// one hold per write, short enough to keep the test quick.
+	prevRetry := unflushedGapRetryInterval
+	unflushedGapRetryInterval = 200 * time.Millisecond
+	t.Cleanup(func() { unflushedGapRetryInterval = prevRetry })
+	ma, _, _ := h.heldSubscriber()
+
+	holdsBefore := heldReads()
+	written, elapsed := h.writeFor(ma, time.Second, false)
+	holds := heldReads() - holdsBefore
+
+	t.Logf("%d writes over %v produced %d holds", len(written), elapsed, holds)
+	// The watermarks never moved, so the retry interval alone paces the holds.
+	if maxHolds := int(elapsed/unflushedGapRetryInterval) + 2; holds > maxHolds {
+		t.Fatalf("held %d times in %v, want at most %d: a hold must wait for peer progress, not for the next write",
+			holds, elapsed, maxHolds)
+	}
+}
+
+// TestSubscribeLoop_AggregatedHoldReleasesOnPeerProgress pins what pacing the
+// hold may not cost: once the peers report through the held entry it must be
+// delivered, without waiting out the retry interval.
+func TestSubscribeLoop_AggregatedHoldReleasesOnPeerProgress(t *testing.T) {
+	h := newSubscribeHarness(t)
+	// Far longer than this test runs: only the watermark signal can deliver.
+	prevRetry := unflushedGapRetryInterval
+	unflushedGapRetryInterval = 30 * time.Second
+	t.Cleanup(func() { unflushedGapRetryInterval = prevRetry })
+	ma, r, _ := h.heldSubscriber()
+
+	ts := time.Now().UnixNano()
+	h.appendAggregated(ts)
+	assertNoEventsFor(t, r, 200*time.Millisecond)
+
+	reportPeers(ma, ts)
+	waitForEvents(t, r, []int64{ts}, 3*time.Second)
+}
+
+// TestSubscribeLoop_AggregatedHoldCoalescesPeerProgress covers the rest of the
+// cost: peers advance their watermark on every event they stream, so releasing
+// a hold per advance is the same pass-per-event storm as releasing per write,
+// just without the log lines.
+func TestSubscribeLoop_AggregatedHoldCoalescesPeerProgress(t *testing.T) {
+	h := newSubscribeHarness(t)
+	ma, r, _ := h.heldSubscriber()
+
+	holdsBefore := heldReads()
+	written, elapsed := h.writeFor(ma, time.Second, true)
+	holds := heldReads() - holdsBefore
+
+	t.Logf("%d writes over %v produced %d holds", len(written), elapsed, holds)
+	if maxHolds := int(elapsed/heldWakeFloor) + 2; holds > maxHolds {
+		t.Fatalf("held %d times in %v, want at most %d: releases must coalesce", holds, elapsed, maxHolds)
+	}
+	// Coalescing may not lose anything the peers reported through.
+	waitForEventsAtLeastOnce(t, r, written, 3*time.Second)
+}
+
+// TestPeerDeliveryClaimPacing pins what a filer with peers owes them: the idle
+// heartbeat on its local stream is a delivery claim every aggregated
+// subscriber in the cluster holds at, so it refreshes at the claim interval,
+// not at the keepalive interval that used to park them ~5s behind live writes.
+func TestPeerDeliveryClaimPacing(t *testing.T) {
+	h := newSubscribeHarness(t)
+	req := &filer_pb.SubscribeMetadataRequest{ClientSupportsIdleHeartbeat: true}
+	lb := h.f.LocalMetaLogBuffer
+	// Claimed a second ago: stale for a delivery claim, fresh for a keepalive.
+	claimedAtNs := time.Now().Add(-time.Second).UnixNano()
+
+	s := &collectingStream{}
+	if got := h.fs.maybeSendIdleHeartbeat(req, s, lb, 0, 0, claimedAtNs); got != claimedAtNs || len(s.messages) != 0 {
+		t.Fatalf("standalone filer sent %d heartbeats early", len(s.messages))
+	}
+
+	h.startAggregator()
+	s = &collectingStream{}
+	if got := h.fs.maybeSendIdleHeartbeat(req, s, lb, 0, 0, claimedAtNs); got == claimedAtNs || len(s.messages) != 1 {
+		t.Fatalf("filer with peers sent %d delivery claims, want 1", len(s.messages))
+	}
+	if s.messages[0].TsNs <= claimedAtNs {
+		t.Fatalf("claim ts %d did not advance past %d", s.messages[0].TsNs, claimedAtNs)
+	}
+}
+
+// TestSubscribeLoop_AggregatedDiskHoldIgnoresDeliveryProgress pins that each
+// hold parks on its own watermark. A persisted-log read is held by what the
+// peers have FLUSHED, and peers advance their DELIVERY watermark on every
+// event they stream, so waking it on delivery progress would re-list a day of
+// log files per event and re-park on the same entry.
+func TestSubscribeLoop_AggregatedDiskHoldIgnoresDeliveryProgress(t *testing.T) {
+	h := newSubscribeHarness(t)
+	prevRetry := unflushedGapRetryInterval
+	unflushedGapRetryInterval = 500 * time.Millisecond
+	t.Cleanup(func() { unflushedGapRetryInterval = prevRetry })
+
+	// Recent enough that the settled horizon does not take the hold over.
+	onDisk := time.Now().Add(-30 * time.Second).UnixNano()
+	h.append(onDisk)
+	h.f.LocalMetaLogBuffer.ForceFlush()
+	waitForFlushedFiles(t, h, onDisk)
+
+	ma := h.startAggregator()
+	// Flushed below the entry on disk, delivered well past it: only the disk
+	// pass is held.
+	reportPeersAt(ma, time.Now().UnixNano(), onDisk-int64(time.Second))
+	r := h.subscribeAggregated(onDisk - int64(5*time.Second))
+	assertNoEventsFor(t, r, 200*time.Millisecond)
+
+	holdsBefore := heldReads("disk")
+	start := time.Now()
+	for deadline := start.Add(time.Second); time.Now().Before(deadline); {
+		reportPeersAt(ma, time.Now().UnixNano(), 0)
+		time.Sleep(2 * time.Millisecond)
+	}
+	holds, elapsed := heldReads("disk")-holdsBefore, time.Since(start)
+
+	t.Logf("%v of delivery-only progress produced %d disk holds", elapsed, holds)
+	if maxHolds := int(elapsed/unflushedGapRetryInterval) + 2; holds > maxHolds {
+		t.Fatalf("held on disk %d times in %v, want at most %d: delivery progress cannot release a flush hold",
+			holds, elapsed, maxHolds)
+	}
+
+	// The flush watermark reaching the entry is what delivers it.
+	reportPeersAt(ma, 0, onDisk)
+	waitForEvents(t, r, []int64{onDisk}, 3*time.Second)
+}
diff --git a/weed/server/filer_subscribe_loop_test.go b/weed/server/filer_subscribe_loop_test.go
index acfe911321..f44b7ead20 100644
--- a/weed/server/filer_subscribe_loop_test.go
+++ b/weed/server/filer_subscribe_loop_test.go
@@ -524,6 +524,31 @@ func TestSubscribeLoop_BoundedSubscriptionTerminates(t *testing.T) {
 	}
 }
 
+// A bounded subscription against a filer whose meta-log buffer has never taken
+// a write - fresh restart, zero metadata traffic since - must still terminate.
+// The empty ring makes every memory read return ResumeFromDiskError, and with
+// no gap to resolve the loop used to park inside LoopProcessLogData forever,
+// its idle heartbeats keeping the stream looking healthy to the client.
+func TestSubscribeLoop_BoundedEmptyFilerTerminates(t *testing.T) {
+	h := newSubscribeHarness(t)
+
+	r := h.subscribe(h.base, func(req *filer_pb.SubscribeMetadataRequest) {
+		req.UntilNs = time.Now().UnixNano()
+	})
+
+	select {
+	case err := <-r.done:
+		if err != nil {
+			t.Fatalf("bounded subscription failed: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("bounded subscription on an idle filer did not terminate")
+	}
+	if got := eventTimestamps(r.stream.snapshot()); len(got) > 0 {
+		t.Fatalf("delivered %v from an empty filer", got)
+	}
+}
+
 // Vacuumed logs: the flush watermark proves a gap empty even though the files
 // are gone - the resolver must skip to the retained ring and deliver its
 // earliest window intact, including a single-entry window whose start and stop
diff --git a/weed/server/filer_subscribe_spin_test.go b/weed/server/filer_subscribe_spin_test.go
new file mode 100644
index 0000000000..4cbcd91ce3
--- /dev/null
+++ b/weed/server/filer_subscribe_spin_test.go
@@ -0,0 +1,79 @@
+package weed_server
+
+// The persisted log may end before a subscriber's start position (a filer
+// whose own journal is older than the position a backup client resumes from).
+// With nothing on disk and every ring entry held by a peer watermark, the
+// aggregated loop used to re-list and re-read the persisted log on every wake
+// - about a full CPU core per such subscriber. The disk pass may only re-run
+// when something it cannot miss has changed.
+
+import (
+	"context"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+type countingStore struct {
+	filer.FilerStore
+	logLists *atomic.Int64
+}
+
+func (s *countingStore) ListDirectoryPrefixedEntries(ctx context.Context, dirPath util.FullPath, startFileName string, includeStartFile bool, limit int64, prefix string, eachEntryFunc filer.ListEachEntryFunc) (lastFileName string, err error) {
+	if strings.HasPrefix(string(dirPath), filer.SystemLogDir) {
+		s.logLists.Add(1)
+	}
+	return s.FilerStore.ListDirectoryPrefixedEntries(ctx, dirPath, startFileName, includeStartFile, limit, prefix, eachEntryFunc)
+}
+
+func TestSubscribeLoop_AggregatedNoPersistedEntryAfterStart(t *testing.T) {
+	h := newSubscribeHarness(t)
+
+	lists := &atomic.Int64{}
+	h.f.SetStore(&countingStore{FilerStore: h.f.GetStore(), logLists: lists})
+
+	// Persisted log ends at T1: one flushed window, nothing after.
+	h.append(h.tsAt(0, 0))
+	h.append(h.tsAt(0, 1))
+	h.f.LocalMetaLogBuffer.ForceFlush()
+	waitForFlushedFiles(t, h, h.tsAt(0, 1))
+
+	// Client cursor sits just past the last persisted entry.
+	cursor := h.tsAt(0, 1) + int64(time.Millisecond)
+
+	ma := h.startAggregator()
+
+	// Aggregated ring holds only much newer entries (peer events).
+	recent := time.Now().UnixNano()
+	h.appendAggregated(recent)
+	h.appendAggregated(recent + int64(time.Millisecond))
+
+	// Peers' watermarks are stuck at the old log tail.
+	reportPeersAt(ma, h.tsAt(0, 1), h.tsAt(0, 1))
+
+	r := h.subscribeAggregated(cursor)
+
+	// Warm up: the first pass plus the cursor-move re-read after the gap
+	// machinery re-arms the cursor are legitimate.
+	time.Sleep(150 * time.Millisecond)
+
+	before := lists.Load()
+	time.Sleep(500 * time.Millisecond)
+	rate := float64(lists.Load()-before) / 0.5
+	if rate > 4 {
+		t.Fatalf("%.1f persisted-log listings per second while parked; the disk pass re-ran on every wake", rate)
+	}
+
+	// Peer progress through the held entries releases the read: the held
+	// events are delivered without another disk pass.
+	lists.Store(0)
+	reportPeersAt(ma, recent+int64(time.Millisecond), h.tsAt(0, 1))
+	waitForEvents(t, r, []int64{recent, recent + int64(time.Millisecond)}, 3*time.Second)
+	if got := lists.Load(); got > 4 {
+		t.Fatalf("%d listings while draining held entries; delivery should come from the ring", got)
+	}
+}
diff --git a/weed/server/filer_subscribe_upgrade_test.go b/weed/server/filer_subscribe_upgrade_test.go
new file mode 100644
index 0000000000..1d39b693a1
--- /dev/null
+++ b/weed/server/filer_subscribe_upgrade_test.go
@@ -0,0 +1,116 @@
+package weed_server
+
+// Regression tests for the aggregated-subscribe entrypoint's peer-discovery
+// window. SubscribeMetadata delegates to the local loop when the aggregator
+// knows no remote peers yet; these tests pin the upgrade: the local stream
+// ends when a remote peer appears, so the client reconnects into the
+// aggregated stream.
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+)
+
+// startAggregatorWithoutPeers gives the harness an aggregator that tracks
+// only self, the state of a filer whose gRPC server is up but whose master
+// connection has not announced the other filers yet.
+func (h *subscribeHarness) startAggregatorWithoutPeers() *filer.MetaAggregator {
+	ma := filer.NewMetaAggregator(h.f, testSelfAddress, nil)
+	ma.TrackPeerForTesting(testSelfAddress)
+	h.f.MetaAggregator = ma
+	h.t.Cleanup(ma.MetaLogBuffer.ShutdownLogBuffer)
+	return ma
+}
+
+// TestSubscribeMetadataLocalStreamEndsWhenRemotePeerAppears pins the upgrade
+// path: a stream that started local-only must end when the first remote peer
+// appears, so the client reconnects into the aggregated stream.
+func TestSubscribeMetadataLocalStreamEndsWhenRemotePeerAppears(t *testing.T) {
+	h := newSubscribeHarness(t)
+
+	ma := h.startAggregatorWithoutPeers()
+	if ma.HasRemotePeers() {
+		t.Fatal("test setup: aggregator must start without remote peers")
+	}
+
+	localTs := time.Now().UnixNano()
+	h.append(localTs)
+
+	// The subscriber connects inside the discovery window.
+	r := h.subscribeAggregated(0)
+	waitForEvents(t, r, []int64{localTs}, 3*time.Second)
+
+	// The master announces a second filer, as OnPeerUpdate does in production.
+	ma.TrackPeerForTesting(testPeerAddress)
+
+	// The local stream must end so the client reconnects to the aggregated path.
+	select {
+	case err := <-r.done:
+		if err == nil {
+			t.Fatal("local stream ended cleanly; the upgrade must surface as an error so RetryUntil-driven followers reconnect")
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("local-only stream stayed alive after a remote peer appeared; the subscriber is pinned to a partial cluster view")
+	}
+}
+
+// TestSubscribeMetadataAggregatedPathAfterPeerArrival pins the other half:
+// after the upgrade, a re-subscribe from the last delivered offset takes the
+// aggregated path and receives the peer's events.
+func TestSubscribeMetadataAggregatedPathAfterPeerArrival(t *testing.T) {
+	h := newSubscribeHarness(t)
+
+	ma := h.startAggregatorWithoutPeers()
+	if ma.HasRemotePeers() {
+		t.Fatal("test setup: aggregator must start without remote peers")
+	}
+
+	localTs := time.Now().UnixNano()
+	h.append(localTs)
+	r := h.subscribeAggregated(0)
+	waitForEvents(t, r, []int64{localTs}, 3*time.Second)
+
+	ma.TrackPeerForTesting(testPeerAddress)
+	select {
+	case <-r.done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("local-only stream stayed alive after a remote peer appeared")
+	}
+
+	// The client reconnects from the last delivered offset; the aggregated
+	// path now serves the peer's events.
+	peerTs := time.Now().UnixNano()
+	h.appendAggregated(peerTs)
+	reportPeers(ma, peerTs)
+	r2 := h.subscribeAggregated(localTs)
+	waitForEvents(t, r2, []int64{peerTs}, 3*time.Second)
+}
+
+// TestSubscribeMetadataLocalStreamPersistsWithoutPeers pins the boundary: on
+// a standalone filer the local stream keeps serving indefinitely.
+func TestSubscribeMetadataLocalStreamPersistsWithoutPeers(t *testing.T) {
+	h := newSubscribeHarness(t)
+
+	ma := h.startAggregatorWithoutPeers()
+	if ma.HasRemotePeers() {
+		t.Fatal("test setup: aggregator must start without remote peers")
+	}
+
+	localTs := time.Now().UnixNano()
+	h.append(localTs)
+	r := h.subscribeAggregated(0)
+	waitForEvents(t, r, []int64{localTs}, 3*time.Second)
+
+	// No peer ever appears; the stream must still be alive and still deliver.
+	moreTs := time.Now().UnixNano()
+	h.append(moreTs)
+	waitForEventsAtLeastOnce(t, r, []int64{localTs, moreTs}, 3*time.Second)
+
+	select {
+	case err := <-r.done:
+		t.Fatalf("local stream ended (%v) on a standalone filer; it must keep serving", err)
+	case <-time.After(200 * time.Millisecond):
+	}
+}
diff --git a/weed/server/master_grpc_server.go b/weed/server/master_grpc_server.go
index 623682b28b..dcba381e6d 100644
--- a/weed/server/master_grpc_server.go
+++ b/weed/server/master_grpc_server.go
@@ -12,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster/maintenance"
+
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
@@ -45,6 +46,8 @@ func (ms *MasterServer) heartbeatResponse() *master_pb.HeartbeatResponse {
 	return &master_pb.HeartbeatResponse{
 		VolumeSizeLimit: uint64(ms.option.VolumeSizeLimitMB) * 1024 * 1024,
 		Preallocate:     ms.preallocateSize > 0,
+		MaxVolumeId:     uint32(ms.Topo.GetMaxVolumeId()),
+		TopologyId:      ms.Topo.GetTopologyId(),
 	}
 }
 
@@ -83,6 +86,23 @@ func (ms *MasterServer) UnRegisterUuids(ip string, port int) {
 	glog.V(0).Infof("remove volume server %v, online volume server: %v", key, ms.Topo.UuidMap)
 }
 
+// announceVolume records vid on the broadcast message. A remote-tier volume
+// goes on both lists: RemoteVids carries the classification, and NewVids keeps
+// a client too old to read RemoteVids from losing the volume altogether during
+// a rolling upgrade.
+func announceVolume(message *master_pb.VolumeLocation, vid uint32, isRemote, isReadOnly, readOnlyCanDelete bool) {
+	message.NewVids = append(message.NewVids, vid)
+	if isRemote {
+		message.RemoteVids = append(message.RemoteVids, vid)
+	}
+	if isReadOnly {
+		message.ReadOnlyVids = append(message.ReadOnlyVids, vid)
+		if readOnlyCanDelete {
+			message.ReadOnlyCanDeleteVids = append(message.ReadOnlyCanDeleteVids, vid)
+		}
+	}
+}
+
 func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServer) error {
 	var dn *topology.DataNode
 
@@ -119,6 +139,8 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 		}
 	}()
 
+	var echoedVid needle.VolumeId
+	var echoedTopoId string
 	for {
 		heartbeat, err := stream.Recv()
 		if err != nil {
@@ -139,10 +161,12 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 		}
 
 		if !ms.Topo.IsLeader() {
-			// tell the volume servers about the leader
-			newLeader, err := ms.Topo.Leader()
-			if err != nil {
-				glog.Warningf("SendHeartbeat find leader: %v", err)
+			// tell the volume servers about the leader we know of right now, so
+			// that a follower without one hands the heartbeat back immediately
+			// instead of holding it through an election
+			newLeader, err := ms.Topo.MaybeLeader()
+			if err != nil || newLeader == "" {
+				glog.V(1).Infof("SendHeartbeat find leader: %v", err)
 				return raft.NotLeaderError
 			}
 			if err := stream.Send(&master_pb.HeartbeatResponse{
@@ -159,6 +183,10 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 		}
 
 		ms.Topo.Sequence.SetMax(heartbeat.MaxFileKey)
+		ms.Topo.UpAdjustMaxVolumeId(needle.VolumeId(heartbeat.MaxVolumeIdSeen))
+		if len(heartbeat.Volumes) > 0 {
+			ms.Topo.CheckReportedTopologyId(heartbeat.LastSeenTopologyId)
+		}
 		if dn == nil {
 			// Skip delta heartbeat for volume server versions  better than 3.28 https://github.com/seaweedfs/seaweedfs/pull/3630
 			if heartbeat.Ip == "" {
@@ -186,6 +214,7 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 				glog.Warningf("SendHeartbeat.Send volume size to %s:%d %v", dn.Ip, dn.Port, err)
 				return err
 			}
+			echoedVid, echoedTopoId = needle.VolumeId(response.MaxVolumeId), response.TopologyId
 			stats.MasterReceivedHeartbeatCounter.WithLabelValues("dataNode").Inc()
 			dn.Counter++
 		}
@@ -197,20 +226,11 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 		glog.V(4).Infof("master received heartbeat %s", heartbeat.String())
 		stats.MasterReceivedHeartbeatCounter.WithLabelValues("total").Inc()
 
-		if heartbeat.State != nil {
+		// Every heartbeat may carry the state, so a master that just took over
+		// learns about a server already in maintenance from the first one.
+		if heartbeat.State != nil && ms.Topo.SetDataNodeMaintenanceMode(dn, heartbeat.State.GetMaintenance()) {
 			stats.MasterReceivedHeartbeatCounter.WithLabelValues("stateUpdates").Inc()
-
-			updated := false
-			dn.Lock()
-			if dn.MaintenanceMode != heartbeat.State.GetMaintenance() {
-				updated = true
-				dn.MaintenanceMode = heartbeat.State.GetMaintenance()
-			}
-			dn.Unlock()
-
-			if updated {
-				glog.V(1).Infof("master sees state update from %s: %v", dn.Url(), heartbeat.State)
-			}
+			glog.V(1).Infof("master sees state update from %s: %v", dn.Url(), heartbeat.State)
 		}
 
 		message := &master_pb.VolumeLocation{
@@ -231,7 +251,9 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 
 			// process delta volume ids if exists for fast volume id updates
 			for _, volInfo := range heartbeat.NewVolumes {
-				message.NewVids = append(message.NewVids, volInfo.Id)
+				// The short form carries no remote-storage name, so the volume
+				// reads as local until a changed or full report names its tier.
+				announceVolume(message, volInfo.Id, false, volInfo.ReadOnly, volInfo.ReadOnlyCanDelete)
 			}
 			for _, volInfo := range heartbeat.DeletedVolumes {
 				if !shouldBroadcastVolumeRemoval(dn, needle.VolumeId(volInfo.Id)) {
@@ -244,7 +266,10 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 		if len(heartbeat.ChangedVolumes) > 0 {
 			stats.MasterReceivedHeartbeatCounter.WithLabelValues("changedVolumes").Inc()
 			for _, v := range ms.Topo.ApplyVolumeChanges(heartbeat.ChangedVolumes, dn) {
-				message.NewVids = append(message.NewVids, uint32(v.Id))
+				// Changed volumes include both newly-added replicas and existing
+				// replicas whose tier classification flipped, which the client
+				// has to be told about to refresh its replica priority.
+				announceVolume(message, uint32(v.Id), v.IsRemote(), v.ReadOnly, v.ReadOnlyCanDelete)
 			}
 		}
 
@@ -256,11 +281,19 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 
 			// process heartbeat.Volumes
 			stats.MasterReceivedHeartbeatCounter.WithLabelValues("Volumes").Inc()
-			newVolumes, deletedVolumes := ms.Topo.SyncDataNodeRegistration(heartbeat.Volumes, dn)
+			newVolumes, deletedVolumes, changedVolumes := ms.Topo.SyncDataNodeRegistration(heartbeat.Volumes, dn)
 
 			for _, v := range newVolumes {
 				glog.V(1).Infof("master see new volume %d from %s", uint32(v.Id), dn.Url())
-				message.NewVids = append(message.NewVids, uint32(v.Id))
+				announceVolume(message, uint32(v.Id), v.IsRemote(), v.ReadOnly, v.ReadOnlyCanDelete)
+			}
+			// A full reconciliation is the digest mismatch recovery path, and
+			// the only way a re-tiered replica reaches the master without a
+			// separate ChangedVolumes heartbeat. Announcing the changed set
+			// too is what stops the client keeping the old classification.
+			for _, v := range changedVolumes {
+				glog.V(1).Infof("master see tier/readonly change on volume %d from %s", uint32(v.Id), dn.Url())
+				announceVolume(message, uint32(v.Id), v.IsRemote(), v.ReadOnly, v.ReadOnlyCanDelete)
 			}
 			for _, v := range deletedVolumes {
 				glog.V(1).Infof("master see deleted volume %d from %s", uint32(v.Id), dn.Url())
@@ -318,6 +351,19 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 				glog.Warningf("SendHeartbeat.Send resend request to %s:%d %v", dn.Ip, dn.Port, err)
 				return err
 			}
+			echoedVid, echoedTopoId = needle.VolumeId(response.MaxVolumeId), response.TopologyId
+		}
+
+		// Every connected server keeps a durable copy of the bound. Echo it
+		// whenever it moved so one veteran can restore it after state loss,
+		// even while the offline server that held the high ids never rejoins.
+		if vid, topoId := ms.Topo.GetMaxVolumeId(), ms.Topo.GetTopologyId(); vid != echoedVid || topoId != echoedTopoId {
+			response := ms.heartbeatResponse()
+			if err := stream.Send(response); err != nil {
+				glog.Warningf("SendHeartbeat.Send bound echo %v", err)
+				return err
+			}
+			echoedVid, echoedTopoId = needle.VolumeId(response.MaxVolumeId), response.TopologyId
 		}
 	}
 }
@@ -398,9 +444,16 @@ func (ms *MasterServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServ
 		glog.V(1).Infof("Cluster: %s node %s added to group '%s'", req.ClientType, peerAddress, req.FilerGroup)
 		ms.broadcastToClients(update)
 	}
-	if req.ClientType == cluster.FilerType {
+	if req.ClientType == cluster.FilerType && !req.LeaveLockRing {
 		ms.LockRingManager.AddServer(cluster.FilerGroupName(req.FilerGroup), peerAddress)
 	}
+	if req.ClientType == cluster.MasterType {
+		// Only the leader gets this far, and a master that starts with no raft
+		// state cannot campaign its way in, so this registration is where it
+		// joins the quorum. The broadcast below is not enough: it only reaches
+		// masters already connected to us.
+		ms.AdmitRaftPeer(peerAddress)
+	}
 
 	defer func() {
 		for _, update := range ms.Cluster.RemoveClusterNode(req.FilerGroup, req.ClientType, peerAddress) {
@@ -409,7 +462,7 @@ func (ms *MasterServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServ
 		if req.ClientType == cluster.FilerType {
 			ms.LockRingManager.RemoveServer(cluster.FilerGroupName(req.FilerGroup), peerAddress)
 		}
-		ms.deleteClient(clientName)
+		ms.deleteClient(clientName, messageChan)
 	}()
 
 	// Send volume locations to the client
@@ -453,7 +506,7 @@ func (ms *MasterServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServ
 
 	go func() {
 		for {
-			_, err := stream.Recv()
+			message, err := stream.Recv()
 			if err != nil {
 				glog.V(2).Infof("- client %v: %v", clientName, err)
 				go func() {
@@ -465,6 +518,7 @@ func (ms *MasterServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServ
 				close(stopChan)
 				return
 			}
+			ms.onKeepConnectedMessage(req, peerAddress, message)
 		}
 	}()
 
@@ -472,9 +526,17 @@ func (ms *MasterServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServ
 	defer ticker.Stop()
 	for {
 		select {
-		case message := <-messageChan:
+		case message, ok := <-messageChan:
+			if !ok {
+				// a closed channel receives nil forever; without this check the
+				// loop would flood the client with empty messages at wire speed
+				return nil
+			}
 			if err := stream.Send(message); err != nil {
-				glog.V(0).Infof("=> client %v: %+v", clientName, message)
+				// The error, not the message: it carries every volume id on a
+				// newly connected node, and formatting a proto that size to
+				// say a client went away costs more than the send did.
+				glog.V(0).Infof("=> client %v: %v", clientName, err)
 				return err
 			}
 		case <-ticker.C:
@@ -493,6 +555,13 @@ func (ms *MasterServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServ
 
 }
 
+func (ms *MasterServer) onKeepConnectedMessage(registered *master_pb.KeepConnectedRequest, peerAddress pb.ServerAddress, message *master_pb.KeepConnectedRequest) {
+	if registered.ClientType == cluster.FilerType && message.LeaveLockRing {
+		glog.V(0).Infof("LockRing: filer %s leaving group '%s'", peerAddress, registered.FilerGroup)
+		ms.LockRingManager.RemoveServer(cluster.FilerGroupName(registered.FilerGroup), peerAddress)
+	}
+}
+
 func (ms *MasterServer) initialLockRingUpdate(clientType string, filerGroup string) *master_pb.KeepConnectedResponse {
 	if ms.LockRingManager == nil {
 		return nil
@@ -536,9 +605,12 @@ func (ms *MasterServer) broadcastVolumeLocationsToClients(locations []*master_pb
 }
 
 func (ms *MasterServer) informNewLeader(stream master_pb.Seaweed_KeepConnectedServer) error {
-	leader, err := ms.Topo.Leader()
-	if err != nil {
-		glog.Errorf("topo leader: %v", err)
+	// Answer from what raft knows now. Waiting out an election here pins the
+	// client to a master that cannot serve it, right when it should be moving
+	// on to the next peer to find the one that can.
+	leader, err := ms.Topo.MaybeLeader()
+	if err != nil || leader == "" {
+		glog.V(1).Infof("topo leader: %v", err)
 		return raft.NotLeaderError
 	}
 	if err := stream.Send(&master_pb.KeepConnectedResponse{
@@ -567,14 +639,18 @@ func (ms *MasterServer) addClient(filerGroup, clientType string, clientAddress p
 	return
 }
 
-func (ms *MasterServer) deleteClient(clientName string) {
+func (ms *MasterServer) deleteClient(clientName string, messageChan chan *master_pb.KeepConnectedResponse) {
 	glog.V(0).Infof("- client %v", clientName)
 	ms.clientChansLock.Lock()
-	// close message chan, so that the KeepConnected go routine can exit
-	if clientChan, ok := ms.clientChans[clientName]; ok {
-		close(clientChan)
+	// a client that reconnects before the old handler exits re-registers the
+	// same name, so the map may already hold the new stream's channel: close
+	// only our own, and leave the entry alone unless it is still ours
+	if ms.clientChans[clientName] == messageChan {
 		delete(ms.clientChans, clientName)
 	}
+	// safe under the write lock: broadcasters send while holding the read
+	// lock and only to channels found in the map
+	close(messageChan)
 	ms.clientChansLock.Unlock()
 }
 
@@ -603,7 +679,7 @@ func findClientAddress(ctx context.Context, grpcPort uint32) string {
 func (ms *MasterServer) GetMasterConfiguration(ctx context.Context, req *master_pb.GetMasterConfigurationRequest) (*master_pb.GetMasterConfigurationResponse, error) {
 
 	// tell the volume servers about the leader
-	leader, _ := ms.Topo.Leader()
+	leader, _ := ms.Topo.MaybeLeader()
 
 	// MIGRATION: expose maintenance scripts for admin server seeding. Remove after March 2027.
 	v := util.GetViper()
diff --git a/weed/server/master_grpc_server_assign.go b/weed/server/master_grpc_server_assign.go
index 0f037dcd18..703a6ab3a9 100644
--- a/weed/server/master_grpc_server_assign.go
+++ b/weed/server/master_grpc_server_assign.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -91,6 +92,12 @@ func (ms *MasterServer) Assign(ctx context.Context, req *master_pb.AssignRequest
 	if !ms.Topo.DataCenterExists(option.DataCenter) {
 		return nil, fmt.Errorf("data center %v not found in topology", option.DataCenter)
 	}
+	if !ms.Topo.RackExists(option.DataCenter, option.Rack) {
+		return nil, fmt.Errorf("rack %v not found in topology", option.Rack)
+	}
+	if !ms.Topo.DataNodeExists(option.DataCenter, option.Rack, option.DataNode) {
+		return nil, fmt.Errorf("data node %v not found in topology", option.DataNode)
+	}
 
 	vl := ms.Topo.GetVolumeLayout(option.Collection, option.ReplicaPlacement, option.Ttl, option.DiskType)
 	if req.DiskType == "" {
@@ -106,18 +113,19 @@ func (ms *MasterServer) Assign(ctx context.Context, req *master_pb.AssignRequest
 	vl.SetLastGrowCount(req.WritableVolumeCount)
 
 	var (
-		lastErr           error
-		maxTimeout        = time.Second * 10
-		startTime         = time.Now()
-		initiatedGrow     bool
-		repickedAfterGrow bool
+		lastErr              error
+		maxTimeout           = time.Second * 10
+		startTime            = time.Now()
+		initiatedGrow        bool
+		repickedAfterGrow    bool
+		unservedLayoutLogged bool
 	)
 
 	for time.Now().Sub(startTime) < maxTimeout {
 		fid, count, dnList, shouldGrow, err := ms.Topo.PickForWrite(req.Count, option, vl, req.ExpectedDataSize)
 		if shouldGrow && !initiatedGrow && !ms.option.VolumeGrowthDisabled && vl.AddGrowRequestIfAbsent() {
 			initiatedGrow = true
-			if err != nil && ms.Topo.AvailableSpaceFor(option) <= 0 {
+			if err != nil && ms.Topo.AvailableSpaceFor(option) <= 0 && ms.Topo.CapacityFor(option) > 0 {
 				err = fmt.Errorf("%s and no free volumes left for %s", err.Error(), option.String())
 			}
 			ms.volumeGrowthRequestChan <- &topology.VolumeGrowRequest{
@@ -136,7 +144,30 @@ func (ms *MasterServer) Assign(ctx context.Context, req *master_pb.AssignRequest
 			}
 			if shouldGrow {
 				if ms.Topo.AvailableSpaceFor(option) <= 0 {
-					break // out of space: surface the real error, not a retryable shed
+					// Fail fast whenever any capacity is registered: full for
+					// this medium, or a medium no volume server serves — a
+					// state a heartbeat won't change, so a retryable shed
+					// would loop until the client's deadline. Shed retryably
+					// only while nothing at all has registered, a just-started
+					// cluster whose volume servers have not heartbeated, so
+					// the first write rides out the startup window instead of
+					// failing outright.
+					if ms.Topo.CapacityForAnyDisk() > 0 {
+						if ms.Topo.CapacityFor(option) <= 0 {
+							// Wrapped here, not beside the "no free volumes left"
+							// wrap above, so followers and growth-disabled
+							// masters name the unserved medium too — the
+							// initiator block is skipped for both.
+							// The empty disk type is the legacy unlabeled
+							// layout; naming it "hdd" here sends operators
+							// looking for servers that were never labeled.
+							lastErr = fmt.Errorf("%s and no volume server carries the %s disk layout for %s", err.Error(), describeDiskLayout(req.DiskType), option.String())
+							assignUnservedLayoutWarning.Do(option.String(), lastErr)
+							unservedLayoutLogged = true
+						}
+						break // surface the real error, not a retryable shed
+					}
+					return nil, status.Errorf(codes.ResourceExhausted, "no volume server capacity registered yet for %s", option.String())
 				}
 				// Only the initiator waits, and only while the growth it triggered
 				// is still pending: followers shed fast so a herd doesn't pin a
@@ -195,8 +226,68 @@ func (ms *MasterServer) Assign(ctx context.Context, req *master_pb.AssignRequest
 	if initiatedGrow && vl.HasGrowRequest() && ms.Topo.AvailableSpaceFor(option) > 0 {
 		return nil, status.Errorf(codes.ResourceExhausted, "no writable volumes for %s, volume growth in progress", option.String())
 	}
-	if lastErr != nil {
+	if lastErr != nil && !unservedLayoutLogged {
+		// The unserved-layout branch already logged this once per option via
+		// assignUnservedLayoutWarning; repeating it here would flood the log
+		// on every retry of a state a retry cannot change.
 		glog.V(0).Infof("assign %v %v: %v", req, option.String(), lastErr)
 	}
 	return nil, lastErr
 }
+
+// describeDiskLayout names the disk layout an assign targets. The empty disk
+// type is the legacy unlabeled layout on servers that were never started with
+// -disk; naming it "hdd" sends operators looking for servers that were never
+// labeled.
+//
+// Pass the original request disk type, not the canonicalized option.DiskType:
+// ToDiskType folds both "" and "hdd" into HardDriveType, so only the request
+// string can tell an unlabeled request from an explicit hdd one.
+func describeDiskLayout(reqDiskType string) string {
+	if reqDiskType == "" {
+		return "default (unlabeled)"
+	}
+	return fmt.Sprintf("%q", strings.ToLower(reqDiskType))
+}
+
+// assignUnservedLayoutWarning logs a repeated assign failure at most once per
+// option per interval instead of once per write attempt: a layout no volume
+// server serves is a state a retry cannot change, so repeating it only buries
+// the actionable first warning.
+//
+// The remembered set is bounded and expires: option keys embed
+// request-derived fields (collection, disk type), so an unbounded, permanent
+// dedupe map would let a client grow master memory at will and would also
+// suppress the warning if the same option goes unserved again after the
+// topology recovers.
+const (
+	unservedLayoutWarnInterval = time.Hour
+	unservedLayoutWarnMaxKeys  = 1024
+)
+
+type unservedLayoutWarning struct {
+	mu   sync.Mutex
+	now  func() time.Time
+	last map[string]time.Time
+}
+
+var assignUnservedLayoutWarning = &unservedLayoutWarning{
+	now:  time.Now,
+	last: make(map[string]time.Time),
+}
+
+func (w *unservedLayoutWarning) Do(optionKey string, lastErr error) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	now := w.now()
+	if t, ok := w.last[optionKey]; ok && now.Sub(t) < unservedLayoutWarnInterval {
+		return
+	}
+	if len(w.last) >= unservedLayoutWarnMaxKeys {
+		// Client-driven keys must never grow the map without bound; a full
+		// reset trades a burst of repeated warnings for bounded memory.
+		w.last = make(map[string]time.Time)
+	}
+	w.last[optionKey] = now
+	glog.Warningf("assign requests for %s will keep failing until a volume server registers that disk layout or clients change their assignment disk type: %v", optionKey, lastErr)
+}
diff --git a/weed/server/master_grpc_server_assign_test.go b/weed/server/master_grpc_server_assign_test.go
index 7b65002f8a..a6f99fc625 100644
--- a/weed/server/master_grpc_server_assign_test.go
+++ b/weed/server/master_grpc_server_assign_test.go
@@ -2,6 +2,7 @@ package weed_server
 
 import (
 	"context"
+	"fmt"
 	"testing"
 	"time"
 
@@ -175,9 +176,24 @@ func TestAssignAbortsOnCancel(t *testing.T) {
 // Out of space, Assign fails fast with the real error rather than masking it as
 // a retryable "growth in progress".
 func TestAssignFailsFastWhenOutOfSpace(t *testing.T) {
-	ms := newLeaderMaster() // no data nodes -> no free space
+	ms := newLeaderMaster()
+	// One slot, already taken by another collection's volume: capacity is
+	// registered but genuinely exhausted.
+	dn := ms.Topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, 18080, "127.0.0.1", "dn1", map[string]uint32{"": 1})
+	rp, err := super_block.NewReplicaPlacementFromString("000")
+	require.NoError(t, err)
+	v := storage.VolumeInfo{
+		Id:               needle.VolumeId(1),
+		Collection:       "other",
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: rp,
+		Ttl:              needle.EMPTY_TTL,
+	}
+	dn.UpdateVolumes([]storage.VolumeInfo{v})
+	ms.Topo.RegisterVolumeLayout(v, dn)
 
-	req := &master_pb.AssignRequest{Count: 1, Replication: "000"}
+	req := &master_pb.AssignRequest{Count: 1, Replication: "000", Collection: "fresh"}
 
 	start := time.Now()
 	resp, err := ms.Assign(context.Background(), req)
@@ -187,7 +203,137 @@ func TestAssignFailsFastWhenOutOfSpace(t *testing.T) {
 	require.Nil(t, resp)
 	if st, ok := status.FromError(err); ok {
 		assert.NotEqual(t, codes.Unavailable, st.Code())
+		assert.NotEqual(t, codes.ResourceExhausted, st.Code())
 	}
 	assert.Contains(t, err.Error(), "no free volumes left")
 	assert.Less(t, elapsed, 2*time.Second)
 }
+
+// A topology with no registered capacity is a cluster whose volume servers have
+// not heartbeated yet, not one that is full: the first write to a fresh bucket
+// races the volume server registration at startup, so Assign must shed with a
+// retryable code instead of failing the write outright.
+func TestAssignShedsRetryablyBeforeCapacityRegisters(t *testing.T) {
+	ms := newLeaderMaster() // no data nodes: nothing has heartbeated yet
+
+	req := &master_pb.AssignRequest{Count: 1, Replication: "000"}
+
+	start := time.Now()
+	resp, err := ms.Assign(context.Background(), req)
+	elapsed := time.Since(start)
+
+	require.Error(t, err)
+	require.Nil(t, resp)
+	st, ok := status.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.ResourceExhausted, st.Code())
+	assert.Less(t, elapsed, 2*time.Second)
+}
+
+// A cluster serving only other media is not one still starting up: capacity for
+// the requested disk type will never register, so the startup shed would loop
+// until the client's deadline. Assign must fail fast with the real error and
+// name the unserved medium — for the growth initiator, for a follower whose
+// growth is already in flight, and when growth is disabled outright.
+func TestAssignFailsFastWhenDiskTypeUnserved(t *testing.T) {
+	tests := []struct {
+		name  string
+		setup func(t *testing.T, ms *MasterServer, req *master_pb.AssignRequest)
+	}{
+		{"initiator", func(t *testing.T, ms *MasterServer, req *master_pb.AssignRequest) {}},
+		{"follower joins growth in flight", func(t *testing.T, ms *MasterServer, req *master_pb.AssignRequest) {
+			markGrowthInFlight(t, ms.Topo, req)
+		}},
+		{"growth disabled", func(t *testing.T, ms *MasterServer, req *master_pb.AssignRequest) {
+			ms.option.VolumeGrowthDisabled = true
+		}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			ms := newLeaderMaster()
+			// ssd capacity registered, but the request asks for the default (hdd).
+			ms.Topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+				GetOrCreateDataNode("127.0.0.1", 8080, 18080, "127.0.0.1", "dn1", map[string]uint32{"ssd": 1})
+
+			req := &master_pb.AssignRequest{Count: 1, Replication: "000", Collection: "fresh"}
+			tc.setup(t, ms, req)
+
+			start := time.Now()
+			resp, err := ms.Assign(context.Background(), req)
+			elapsed := time.Since(start)
+
+			require.Error(t, err)
+			require.Nil(t, resp)
+			if st, ok := status.FromError(err); ok {
+				assert.NotEqual(t, codes.Unavailable, st.Code())
+				assert.NotEqual(t, codes.ResourceExhausted, st.Code())
+			}
+			assert.Contains(t, err.Error(), topology.NoWritableVolumes)
+			assert.Contains(t, err.Error(), `no volume server carries the default (unlabeled) disk layout`)
+			assert.Less(t, elapsed, 2*time.Second)
+		})
+	}
+}
+
+// An explicit disk=hdd request is not the unlabeled default: the error must
+// name "hdd" so an operator reading it connects it to their hdd configuration.
+// ToDiskType folds both "" and "hdd" into HardDriveType, so the formatter must
+// look at the original request string, not the canonicalized option.DiskType.
+func TestAssignFailsFastNamesExplicitHdd(t *testing.T) {
+	ms := newLeaderMaster()
+	// ssd capacity registered, but the request explicitly asks for hdd.
+	ms.Topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, 18080, "127.0.0.1", "dn1", map[string]uint32{"ssd": 1})
+
+	req := &master_pb.AssignRequest{Count: 1, Replication: "000", Collection: "fresh", DiskType: "hdd"}
+
+	start := time.Now()
+	resp, err := ms.Assign(context.Background(), req)
+	elapsed := time.Since(start)
+
+	require.Error(t, err)
+	require.Nil(t, resp)
+	assert.Contains(t, err.Error(), topology.NoWritableVolumes)
+	assert.Contains(t, err.Error(), `no volume server carries the "hdd" disk layout`)
+	assert.NotContains(t, err.Error(), "default (unlabeled)")
+	assert.Less(t, elapsed, 2*time.Second)
+}
+
+func TestUnservedLayoutWarningBoundedAndExpiring(t *testing.T) {
+	w := &unservedLayoutWarning{
+		now:  func() time.Time { return time.Unix(0, 0) },
+		last: make(map[string]time.Time),
+	}
+
+	// Dedupes within the interval.
+	w.Do("opt", fmt.Errorf("e1"))
+	w.Do("opt", fmt.Errorf("e2"))
+	if len(w.last) != 1 {
+		t.Fatalf("same option logged twice: %v", w.last)
+	}
+
+	// Re-warns after the interval expires.
+	base := time.Unix(0, 0)
+	w.now = func() time.Time { return base.Add(unservedLayoutWarnInterval) }
+	w.Do("opt", fmt.Errorf("e3"))
+	if len(w.last) != 1 || !w.last["opt"].Equal(base.Add(unservedLayoutWarnInterval)) {
+		t.Fatalf("expected refreshed timestamp after interval, got %v", w.last)
+	}
+
+	// Hard cap: a client-driven key flood cannot grow the map without bound.
+	w.now = func() time.Time { return base.Add(2 * unservedLayoutWarnInterval) }
+	flood := &unservedLayoutWarning{
+		now:  w.now,
+		last: make(map[string]time.Time),
+	}
+	for i := 0; i < unservedLayoutWarnMaxKeys; i++ {
+		flood.Do(fmt.Sprintf("opt-%d", i), fmt.Errorf("e"))
+	}
+	if len(flood.last) != unservedLayoutWarnMaxKeys {
+		t.Fatalf("expected exactly cap entries, got %d", len(flood.last))
+	}
+	flood.Do("opt-flood", fmt.Errorf("e"))
+	if len(flood.last) != 1 {
+		t.Fatalf("expected full reset at cap, got %d entries", len(flood.last))
+	}
+}
diff --git a/weed/server/master_grpc_server_changed_volumes_test.go b/weed/server/master_grpc_server_changed_volumes_test.go
index 3770732ab1..0ed15aa132 100644
--- a/weed/server/master_grpc_server_changed_volumes_test.go
+++ b/weed/server/master_grpc_server_changed_volumes_test.go
@@ -118,7 +118,7 @@ func TestRepairedLookupEntryIsAnnounced(t *testing.T) {
 			return topo.ApplyVolumeChanges([]*master_pb.VolumeInformationMessage{v}, dn)
 		}},
 		{"ViaFullList", func(topo *topology.Topology, dn *topology.DataNode, v *master_pb.VolumeInformationMessage) []storage.VolumeInfo {
-			announced, _ := topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{v}, dn)
+			announced, _, _ := topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{v}, dn)
 			return announced
 		}},
 	} {
@@ -203,3 +203,33 @@ func TestStaleFullListDoesNotEraseAFreshGrow(t *testing.T) {
 		t.Fatal("a confirmed volume survived a list that dropped it")
 	}
 }
+
+// A registration can resolve a collection's layout just before the collection
+// is deleted. Bits it sets afterwards would never be released, and the node's
+// held and servable digests would disagree forever.
+func TestRegistrationRacingCollectionDeleteDoesNotLeak(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{changedTestVolume(1, 1024)}, dn)
+
+	vi, err := storage.NewVolumeInfo(changedTestVolume(1, 1024))
+	if err != nil {
+		t.Fatal(err)
+	}
+	stale := topo.GetVolumeLayout("c", vi.ReplicaPlacement, vi.Ttl, types.ToDiskType(vi.DiskType))
+
+	topo.DeleteCollection("c")
+
+	// the interleaved registration must refuse the dropped layout
+	if stale.RegisterVolume(&vi, dn, nil) {
+		t.Fatal("registered into a layout dropped with its collection")
+	}
+
+	// the node prunes its copy when the departure is named
+	topo.IncrementalSyncDataNodeRegistration(nil, []*master_pb.VolumeShortInformationMessage{
+		{Id: 1, Collection: "c", Version: 3},
+	}, dn)
+
+	if !dn.HasConsistentVolumeIndex() {
+		t.Fatal("the racing registration leaked lookup ownership")
+	}
+}
diff --git a/weed/server/master_grpc_server_changed_volumes_tier_test.go b/weed/server/master_grpc_server_changed_volumes_tier_test.go
new file mode 100644
index 0000000000..c77f912dd8
--- /dev/null
+++ b/weed/server/master_grpc_server_changed_volumes_tier_test.go
@@ -0,0 +1,224 @@
+package weed_server
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/topology"
+)
+
+// changedTierVolume returns a VolumeInformationMessage that mirrors
+// changedTestVolume plus a remote-storage name, so a heartbeat can flip a
+// replica's tier classification.
+func changedTierVolume(id uint32, size uint64, remoteStorageName string) *master_pb.VolumeInformationMessage {
+	v := changedTestVolume(id, size)
+	v.RemoteStorageName = remoteStorageName
+	return v
+}
+
+// announceChangedVolumes drives the message SendHeartbeat builds on a
+// ChangedVolumes heartbeat through announceVolume, the routing the server
+// itself uses, so the tests below assert what would really be broadcast
+// without standing up a gRPC stream.
+func announceChangedVolumes(topo *topology.Topology, dn *topology.DataNode, changed []*master_pb.VolumeInformationMessage) (newVids, remoteVids, readOnlyVids []uint32) {
+	message := &master_pb.VolumeLocation{}
+	for _, v := range topo.ApplyVolumeChanges(changed, dn) {
+		announceVolume(message, uint32(v.Id), v.IsRemote(), v.ReadOnly, v.ReadOnlyCanDelete)
+	}
+	return message.NewVids, message.RemoteVids, message.ReadOnlyVids
+}
+
+// A replica that the heartbeat says has just been tiered to remote storage is
+// still servable from the same node, but every connected client is holding
+// stale DataInRemote=false and would prefer it over a real local replica. The
+// master must rebroadcast it on RemoteVids so the wdclient replaces the entry.
+func TestChangedVolumesAnnounceLocalToRemoteTierTransition(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 1024),
+	}, dn)
+
+	v := changedTierVolume(1, 1024, "s3-bucket")
+	v.ReadOnly = true
+	newVids, remoteVids, readOnlyVids := announceChangedVolumes(topo, dn, []*master_pb.VolumeInformationMessage{v})
+	if !containsUint32(remoteVids, 1) {
+		t.Errorf("a local-to-remote transition was not announced as RemoteVids: %v", remoteVids)
+	}
+	if !containsUint32(newVids, 1) {
+		t.Errorf("a remote volume must stay on NewVids for clients that cannot read RemoteVids: %v", newVids)
+	}
+	if !containsUint32(readOnlyVids, 1) {
+		t.Errorf("a read-only transition was not announced as ReadOnlyVids: %v", readOnlyVids)
+	}
+}
+
+// A replica restored from remote storage back to a local disk flips the other
+// way. The wdclient is currently demoting it behind same-DC remote replicas;
+// the master must announce it on NewVids so the wdclient hoists it back to
+// the front of the read order.
+func TestChangedVolumesAnnounceRemoteToLocalTierTransition(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		changedTierVolume(1, 1024, "s3-bucket"),
+	}, dn)
+
+	newVids, remoteVids, readOnlyVids := announceChangedVolumes(topo, dn, []*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 1024),
+	})
+	if !containsUint32(newVids, 1) {
+		t.Errorf("a remote-to-local transition was not announced as NewVids: %v", newVids)
+	}
+	if containsUint32(remoteVids, 1) {
+		t.Errorf("a remote-to-local transition was routed as RemoteVids: %v", remoteVids)
+	}
+	if containsUint32(readOnlyVids, 1) {
+		t.Errorf("a writable transition was routed as ReadOnlyVids: %v", readOnlyVids)
+	}
+}
+
+// A heartbeat that re-reports an existing replica with the same tier
+// classification is not a change worth broadcasting. Volumes grow constantly
+// and a steady stream of those would flood every client's bounded queue.
+func TestChangedVolumesSuppressNoOpTierReport(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 1024),
+	}, dn)
+
+	newVids, remoteVids, readOnlyVids := announceChangedVolumes(topo, dn, []*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 4096),
+	})
+	if containsUint32(newVids, 1) || containsUint32(remoteVids, 1) || containsUint32(readOnlyVids, 1) {
+		t.Errorf("a no-op tier report was broadcast: newVids=%v remoteVids=%v", newVids, remoteVids)
+	}
+}
+
+func TestChangedVolumesAnnounceSameTierReadOnlyTransition(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{changedTestVolume(1, 1024)}, dn)
+
+	readOnly := changedTestVolume(1, 1024)
+	readOnly.ReadOnly = true
+	_, _, readOnlyVids := announceChangedVolumes(topo, dn, []*master_pb.VolumeInformationMessage{readOnly})
+	if !containsUint32(readOnlyVids, 1) {
+		t.Fatalf("writable-to-read-only transition was not announced: %v", readOnlyVids)
+	}
+	_, _, readOnlyVids = announceChangedVolumes(topo, dn, []*master_pb.VolumeInformationMessage{changedTestVolume(1, 1024)})
+	if containsUint32(readOnlyVids, 1) {
+		t.Fatalf("read-only-to-writable transition retained ReadOnlyVids: %v", readOnlyVids)
+	}
+}
+
+func TestChangedVolumesAnnounceReadOnlyDeleteCapabilityTransition(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	initial := changedTestVolume(1, 1024)
+	initial.ReadOnly, initial.ReadOnlyCanDelete = true, true
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{initial}, dn)
+	next := changedTestVolume(1, 1024)
+	next.ReadOnly = true
+	_, _, readOnlyVids := announceChangedVolumes(topo, dn, []*master_pb.VolumeInformationMessage{next})
+	if !containsUint32(readOnlyVids, 1) {
+		t.Fatalf("read-only delete-capability transition was not announced: %v", readOnlyVids)
+	}
+}
+
+// A heartbeat that mixes a pure growth with a tier transition only announces
+// the tier-transitioned replica: a growth is local state, not a re-route, and
+// must not push other topology updates out of a bounded client queue.
+func TestChangedVolumesAnnounceOnlyTierTransitions(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 1024),
+		changedTestVolume(2, 1024),
+	}, dn)
+
+	newVids, remoteVids, _ := announceChangedVolumes(topo, dn, []*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 4096),              // pure growth
+		changedTierVolume(2, 1024, "s3-bucket"), // tier transition
+	})
+	if containsUint32(newVids, 1) || containsUint32(remoteVids, 1) {
+		t.Errorf("a volume that only grew was broadcast: newVids=%v remoteVids=%v", newVids, remoteVids)
+	}
+	if !containsUint32(remoteVids, 2) {
+		t.Errorf("the tier-transitioned replica was missing from RemoteVids: newVids=%v remoteVids=%v", newVids, remoteVids)
+	}
+	if _, err := dn.GetVolumesById(needle.VolumeId(1)); err != nil {
+		t.Errorf("a pure-growth heartbeat should not have removed the volume: %v", err)
+	}
+}
+
+func containsUint32(haystack []uint32, needle uint32) bool {
+	for _, v := range haystack {
+		if v == needle {
+			return true
+		}
+	}
+	return false
+}
+
+// A full Volumes reconciliation (the digest mismatch recovery path) is the
+// only way a re-tiered replica reaches the master without a separate
+// ChangedVolumes heartbeat. The routing in master_grpc_server.go has to
+// re-announce it on NewVids/RemoteVids or the wdclient keeps the stale
+// DataInRemote classification forever.
+func TestFullReconciliationAnnouncesTierTransition(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 1024),
+	}, dn)
+
+	v := changedTierVolume(1, 1024, "s3-bucket")
+	v.ReadOnly = true
+	newVids, remoteVids, readOnlyVids := announceFullReconciliation(topo, dn, []*master_pb.VolumeInformationMessage{v})
+	if !containsUint32(remoteVids, 1) {
+		t.Errorf("a tier transition reported in a full reconciliation was not announced: newVids=%v remoteVids=%v", newVids, remoteVids)
+	}
+	if !containsUint32(newVids, 1) {
+		t.Errorf("a remote volume must stay on NewVids for clients that cannot read RemoteVids: %v", newVids)
+	}
+	if !containsUint32(readOnlyVids, 1) {
+		t.Errorf("a read-only transition was not announced as ReadOnlyVids: %v", readOnlyVids)
+	}
+}
+
+func TestFullReconciliationAnnounceSameTierReadOnlyTransition(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{changedTestVolume(1, 1024)}, dn)
+
+	readOnly := changedTestVolume(1, 1024)
+	readOnly.ReadOnly = true
+	_, _, readOnlyVids := announceFullReconciliation(topo, dn, []*master_pb.VolumeInformationMessage{readOnly})
+	if !containsUint32(readOnlyVids, 1) {
+		t.Fatalf("writable-to-read-only reconciliation was not announced: %v", readOnlyVids)
+	}
+	_, _, readOnlyVids = announceFullReconciliation(topo, dn, []*master_pb.VolumeInformationMessage{changedTestVolume(1, 1024)})
+	if containsUint32(readOnlyVids, 1) {
+		t.Fatalf("read-only-to-writable reconciliation retained ReadOnlyVids: %v", readOnlyVids)
+	}
+}
+
+func TestFullReconciliationAnnounceReadOnlyDeleteCapabilityTransition(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	initial := changedTestVolume(1, 1024)
+	initial.ReadOnly, initial.ReadOnlyCanDelete = true, true
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{initial}, dn)
+	next := changedTestVolume(1, 1024)
+	next.ReadOnly = true
+	_, _, readOnlyVids := announceFullReconciliation(topo, dn, []*master_pb.VolumeInformationMessage{next})
+	if !containsUint32(readOnlyVids, 1) {
+		t.Fatalf("read-only delete-capability reconciliation was not announced: %v", readOnlyVids)
+	}
+}
+
+// announceFullReconciliation runs the same routing loop master_grpc_server's
+// SendHeartbeat does on a full Volumes heartbeat, including the changed-set
+// re-route added so digest-mismatch recovery propagates tier transitions.
+func announceFullReconciliation(topo *topology.Topology, dn *topology.DataNode, volumes []*master_pb.VolumeInformationMessage) (newVids, remoteVids, readOnlyVids []uint32) {
+	message := &master_pb.VolumeLocation{}
+	newOnes, _, changedOnes := topo.SyncDataNodeRegistration(volumes, dn)
+	for _, v := range append(newOnes, changedOnes...) {
+		announceVolume(message, uint32(v.Id), v.IsRemote(), v.ReadOnly, v.ReadOnlyCanDelete)
+	}
+	return message.NewVids, message.RemoteVids, message.ReadOnlyVids
+}
diff --git a/weed/server/master_grpc_server_collection.go b/weed/server/master_grpc_server_collection.go
index 3a3f084f21..d85dd61f21 100644
--- a/weed/server/master_grpc_server_collection.go
+++ b/weed/server/master_grpc_server_collection.go
@@ -2,14 +2,25 @@ package weed_server
 
 import (
 	"context"
+	"time"
 
 	"github.com/seaweedfs/raft"
 
+	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 )
 
+// deleteCollectionTimeout bounds one DeleteCollection RPC to a volume server, so
+// a server that accepts the connection and then stops answering cannot hold the
+// fan-out open with nothing to end it. Same bound as allocateVolumeTimeout, the
+// other master-to-volume-server admin RPC. The volume server runs the delete to
+// completion regardless of the request context, so giving up costs the
+// confirmation and not the deletion.
+const deleteCollectionTimeout = 1 * time.Minute
+
 func (ms *MasterServer) CollectionList(ctx context.Context, req *master_pb.CollectionListRequest) (*master_pb.CollectionListResponse, error) {
 
 	if !ms.Topo.IsLeader() {
@@ -33,63 +44,100 @@ func (ms *MasterServer) CollectionDelete(ctx context.Context, req *master_pb.Col
 		return nil, raft.NotLeaderError
 	}
 
-	resp := &master_pb.CollectionDeleteResponse{}
-
-	err := ms.doDeleteNormalCollection(req.Name)
-
-	if err != nil {
+	if err := ms.deleteCollection(ctx, req.Name); err != nil {
 		return nil, err
 	}
 
-	err = ms.doDeleteEcCollection(req.Name)
-
-	if err != nil {
-		return nil, err
-	}
-
-	return resp, nil
+	return &master_pb.CollectionDeleteResponse{}, nil
 }
 
-func (ms *MasterServer) doDeleteNormalCollection(collectionName string) error {
+// deleteCollection removes a collection's normal volumes and its EC shards. Both
+// passes run: one collection can hold both, and returning after a failed normal
+// pass left the shards in place with no request left to come back for them. The
+// normal pass keeps precedence in what is reported, as it did before.
+func (ms *MasterServer) deleteCollection(ctx context.Context, collectionName string) error {
+
+	// Values only, no deadline: a caller that hangs up must not abandon a
+	// destructive fan-out part-done, with volumes left behind and no request still
+	// running to come back for them. Each RPC is bounded on its own.
+	ctx = context.WithoutCancel(ctx)
+
+	normalErr := ms.doDeleteNormalCollection(ctx, collectionName)
+	ecErr := ms.doDeleteEcCollection(ctx, collectionName)
+
+	if normalErr != nil {
+		if ecErr != nil {
+			glog.ErrorfCtx(ctx, "delete collection %s ec shards: %v", collectionName, ecErr)
+		}
+		return normalErr
+	}
+
+	return ecErr
+}
+
+func (ms *MasterServer) doDeleteNormalCollection(ctx context.Context, collectionName string) error {
 
 	collection, ok := ms.Topo.FindCollection(collectionName)
 	if !ok {
 		return nil
 	}
 
-	for _, server := range collection.ListVolumeServers() {
-		err := operation.WithVolumeServerClient(false, server.ServerAddress(), ms.grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
-			_, deleteErr := client.DeleteCollection(context.Background(), &volume_server_pb.DeleteCollectionRequest{
-				Collection: collectionName,
-			})
-			return deleteErr
-		})
-		if err != nil {
-			return err
+	// One RPC per server, not one per replica: ListVolumeServers reports a node
+	// once for every replica it holds, while DeleteCollection removes the whole
+	// collection from the server it reaches. ListEcServersByCollection already
+	// returns each server once.
+	var servers []pb.ServerAddress
+	seen := make(map[pb.ServerAddress]struct{})
+	for _, node := range collection.ListVolumeServers() {
+		address := node.ServerAddress()
+		if _, done := seen[address]; done {
+			continue
 		}
+		seen[address] = struct{}{}
+		servers = append(servers, address)
+	}
+
+	if err := ms.deleteCollectionFrom(ctx, collectionName, servers); err != nil {
+		return err
 	}
 	ms.Topo.DeleteCollection(collectionName)
 
 	return nil
 }
 
-func (ms *MasterServer) doDeleteEcCollection(collectionName string) error {
+func (ms *MasterServer) doDeleteEcCollection(ctx context.Context, collectionName string) error {
 
-	listOfEcServers := ms.Topo.ListEcServersByCollection(collectionName)
+	if err := ms.deleteCollectionFrom(ctx, collectionName, ms.Topo.ListEcServersByCollection(collectionName)); err != nil {
+		return err
+	}
+	ms.Topo.DeleteEcCollection(collectionName)
 
-	for _, server := range listOfEcServers {
+	return nil
+}
+
+// deleteCollectionFrom asks every server to drop the collection and keeps going
+// past a failure, so one server that is down does not leave the collection on
+// every server after it in the list. The first failure is what is reported, and
+// the collection stays in the topology so a later delete comes back for the rest.
+func (ms *MasterServer) deleteCollectionFrom(ctx context.Context, collectionName string, servers []pb.ServerAddress) error {
+
+	var firstErr error
+	for _, server := range servers {
 		err := operation.WithVolumeServerClient(false, server, ms.grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
-			_, deleteErr := client.DeleteCollection(context.Background(), &volume_server_pb.DeleteCollectionRequest{
+			rpcCtx, cancel := context.WithTimeout(ctx, deleteCollectionTimeout)
+			defer cancel()
+			_, deleteErr := client.DeleteCollection(rpcCtx, &volume_server_pb.DeleteCollectionRequest{
 				Collection: collectionName,
 			})
 			return deleteErr
 		})
 		if err != nil {
-			return err
+			glog.ErrorfCtx(ctx, "delete collection %s on %s: %v", collectionName, server, err)
+			if firstErr == nil {
+				firstErr = err
+			}
 		}
 	}
 
-	ms.Topo.DeleteEcCollection(collectionName)
-
-	return nil
+	return firstErr
 }
diff --git a/weed/server/master_grpc_server_collection_test.go b/weed/server/master_grpc_server_collection_test.go
new file mode 100644
index 0000000000..49a6719447
--- /dev/null
+++ b/weed/server/master_grpc_server_collection_test.go
@@ -0,0 +1,287 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/topology"
+)
+
+// recordingVolumeServer reports what each DeleteCollection arrived carrying.
+// failWith answers an error at once; hang holds the call until the caller gives
+// up or the test releases it, the way a server that is still reachable but
+// wedged behaves.
+type recordingVolumeServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+
+	hang     bool
+	failWith error
+
+	calls       chan deleteCollectionCall
+	release     chan struct{}
+	releaseOnce sync.Once
+}
+
+type deleteCollectionCall struct {
+	collection string
+	// budget is the time the RPC arrived with, or 0 when it carried no deadline.
+	budget time.Duration
+}
+
+func newRecordingVolumeServer() *recordingVolumeServer {
+	return &recordingVolumeServer{
+		calls:   make(chan deleteCollectionCall, 8),
+		release: make(chan struct{}),
+	}
+}
+
+func (s *recordingVolumeServer) DeleteCollection(ctx context.Context, req *volume_server_pb.DeleteCollectionRequest) (*volume_server_pb.DeleteCollectionResponse, error) {
+	call := deleteCollectionCall{collection: req.Collection}
+	if deadline, ok := ctx.Deadline(); ok {
+		call.budget = time.Until(deadline)
+	}
+	s.calls <- call
+
+	if s.failWith != nil {
+		return nil, s.failWith
+	}
+	if s.hang {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-s.release:
+		}
+	}
+	return &volume_server_pb.DeleteCollectionResponse{}, nil
+}
+
+// Release unblocks every held DeleteCollection. Safe to call more than once.
+func (s *recordingVolumeServer) Release() {
+	s.releaseOnce.Do(func() { close(s.release) })
+}
+
+// addVolumeServer publishes stub on a fresh listener and registers it as a data
+// node of topo. Only the grpc port is dialed; the http port just has to stay
+// distinct per server so the topology does not treat two nodes as one address.
+func addVolumeServer(t *testing.T, topo *topology.Topology, id string, stub *recordingVolumeServer) *topology.DataNode {
+	t.Helper()
+	t.Cleanup(stub.Release)
+	grpcPort := serveGrpc(t, func(s *grpc.Server) {
+		volume_server_pb.RegisterVolumeServerServer(s, stub)
+	})
+	return topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", grpcPort-10000, grpcPort, "", id, map[string]uint32{"": 10})
+}
+
+func newCollectionTestMaster(topo *topology.Topology) *MasterServer {
+	return &MasterServer{
+		Topo:           topo,
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+}
+
+// awaitCall waits for one DeleteCollection to reach the stub.
+func awaitCall(t *testing.T, stub *recordingVolumeServer, what string) deleteCollectionCall {
+	t.Helper()
+	select {
+	case call := <-stub.calls:
+		return call
+	case <-time.After(15 * time.Second):
+		t.Fatalf("%s: the volume server never received DeleteCollection", what)
+		return deleteCollectionCall{}
+	}
+}
+
+// A caller with no deadline of its own must still not wait forever: the master
+// has to bound each RPC, or one wedged volume server holds the fan-out open with
+// nothing to end it.
+func TestDoDeleteNormalCollectionBoundsEachVolumeServerRPC(t *testing.T) {
+	const collection = "bucket-a"
+
+	stub := newRecordingVolumeServer()
+	stub.hang = true
+
+	topo := topology.NewTopology("test", nil, 32*1024, 5, false)
+	dn := addVolumeServer(t, topo, "vs1", stub)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: collection, Version: 3},
+	}, dn)
+	ms := newCollectionTestMaster(topo)
+
+	done := make(chan error, 1)
+	go func() { done <- ms.doDeleteNormalCollection(context.Background(), collection) }()
+
+	call := awaitCall(t, stub, "bounded RPC")
+	if call.budget <= 0 {
+		t.Fatal("DeleteCollection reached the volume server with no deadline: a wedged server holds the fan-out open with nothing to end it")
+	}
+	if call.budget > deleteCollectionTimeout {
+		t.Errorf("DeleteCollection budget = %v, want at most deleteCollectionTimeout %v", call.budget, deleteCollectionTimeout)
+	}
+
+	stub.Release()
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Errorf("doDeleteNormalCollection returned %v, want nil once the volume server answers", err)
+		}
+	case <-time.After(15 * time.Second):
+		t.Fatal("doDeleteNormalCollection did not return after the volume server answered")
+	}
+}
+
+// The fan-out must outlive the caller. A collection can span many servers and
+// the deletes are sequential, so letting an inbound cancellation end the loop
+// would abandon a large delete part-done, with volumes left behind and no
+// request still running to come back for them.
+func TestDeleteCollectionOutlivesTheCallersCancellation(t *testing.T) {
+	const collection = "bucket-b"
+
+	normal := newRecordingVolumeServer()
+	ec := newRecordingVolumeServer()
+
+	topo := topology.NewTopology("test", nil, 32*1024, 5, false)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: collection, Version: 3},
+	}, addVolumeServer(t, topo, "vs-normal", normal))
+	topo.SyncDataNodeEcShards([]*master_pb.VolumeEcShardInformationMessage{
+		{Id: 9, Collection: collection, EcIndexBits: 0x1f},
+	}, addVolumeServer(t, topo, "vs-ec", ec))
+	ms := newCollectionTestMaster(topo)
+
+	// The caller is already gone by the time the delete starts.
+	expired, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	if err := ms.deleteCollection(expired, collection); err != nil {
+		t.Fatalf("deleteCollection returned %v; a cancelled caller must not fail the fan-out", err)
+	}
+
+	// The EC pass runs second, so it is the one most likely to find the caller
+	// already gone.
+	for _, tc := range []struct {
+		stub *recordingVolumeServer
+		what string
+	}{{normal, "normal pass"}, {ec, "ec pass"}} {
+		call := awaitCall(t, tc.stub, "cancelled caller, "+tc.what)
+		if call.collection != collection {
+			t.Errorf("%s: server was told to delete %q, want %q", tc.what, call.collection, collection)
+		}
+		if call.budget <= 0 {
+			t.Errorf("%s: DeleteCollection arrived with no deadline; each RPC should still be bounded", tc.what)
+		}
+	}
+
+	if _, found := topo.FindCollection(collection); found {
+		t.Error("the collection was left in the topology; the delete did not run to completion")
+	}
+}
+
+// ListVolumeServers reports a node once per replica it holds. DeleteCollection
+// removes the whole collection from the server it reaches, so the master must
+// send it once per server, not once per replica.
+func TestDoDeleteNormalCollectionSendsOneRPCPerVolumeServer(t *testing.T) {
+	const collection = "bucket-c"
+
+	stub := newRecordingVolumeServer()
+
+	topo := topology.NewTopology("test", nil, 32*1024, 5, false)
+	dn := addVolumeServer(t, topo, "vs1", stub)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: collection, Version: 3},
+		{Id: 2, Collection: collection, Version: 3},
+		{Id: 3, Collection: collection, Version: 3},
+	}, dn)
+
+	collectionInTopology, found := topo.FindCollection(collection)
+	if !found {
+		t.Fatalf("test setup: collection %s was not registered", collection)
+	}
+	if listed := len(collectionInTopology.ListVolumeServers()); listed < 2 {
+		t.Fatalf("test setup: the one node is listed %d times, expected once per replica", listed)
+	}
+
+	ms := newCollectionTestMaster(topo)
+	if err := ms.doDeleteNormalCollection(context.Background(), collection); err != nil {
+		t.Fatalf("doDeleteNormalCollection: %v", err)
+	}
+
+	awaitCall(t, stub, "one RPC per server")
+	select {
+	case extra := <-stub.calls:
+		t.Errorf("the same server was told to delete %q more than once", extra.collection)
+	default:
+	}
+}
+
+// One server refusing must not leave the collection on every server after it in
+// the list: returning at the first failure meant a single node that was down
+// stranded the rest, and the failure is reported either way.
+func TestDoDeleteNormalCollectionKeepsGoingPastAFailingServer(t *testing.T) {
+	const collection = "bucket-d"
+
+	failing := newRecordingVolumeServer()
+	failing.failWith = errors.New("volume server is out of disk")
+	healthy := newRecordingVolumeServer()
+
+	topo := topology.NewTopology("test", nil, 32*1024, 5, false)
+	failingNode := addVolumeServer(t, topo, "vs-failing", failing)
+	healthyNode := addVolumeServer(t, topo, "vs-healthy", healthy)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: collection, Version: 3},
+	}, failingNode)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: collection, Version: 3},
+	}, healthyNode)
+
+	ms := newCollectionTestMaster(topo)
+	if err := ms.doDeleteNormalCollection(context.Background(), collection); err == nil {
+		t.Fatal("doDeleteNormalCollection reported success while a server refused")
+	}
+
+	awaitCall(t, failing, "failing server")
+	awaitCall(t, healthy, "server behind the failing one")
+
+	if _, found := topo.FindCollection(collection); !found {
+		t.Error("the collection was dropped from the topology despite failing; nothing would come back for the rest")
+	}
+}
+
+// A collection can hold normal volumes and EC shards at once. Returning after a
+// failed normal pass left the EC shards in place with no request left to come
+// back for them, so both passes have to run.
+func TestDeleteCollectionRunsTheEcPassWhenTheNormalPassFails(t *testing.T) {
+	const collection = "bucket-e"
+
+	normal := newRecordingVolumeServer()
+	normal.failWith = errors.New("volume server is out of disk")
+	ec := newRecordingVolumeServer()
+
+	topo := topology.NewTopology("test", nil, 32*1024, 5, false)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: collection, Version: 3},
+	}, addVolumeServer(t, topo, "vs-normal", normal))
+	topo.SyncDataNodeEcShards([]*master_pb.VolumeEcShardInformationMessage{
+		{Id: 9, Collection: collection, EcIndexBits: 0x1f},
+	}, addVolumeServer(t, topo, "vs-ec", ec))
+
+	ms := newCollectionTestMaster(topo)
+	if err := ms.deleteCollection(context.Background(), collection); err == nil {
+		t.Fatal("deleteCollection reported success while the normal pass failed")
+	}
+
+	// The failure is reported, and the EC shards are cleaned up anyway.
+	awaitCall(t, ec, "ec pass after a failed normal pass")
+
+	if _, found := topo.FindCollection(collection); !found {
+		t.Error("the normal collection was dropped from the topology despite failing; nothing would retry it")
+	}
+}
diff --git a/weed/server/master_grpc_server_digest_test.go b/weed/server/master_grpc_server_digest_test.go
index 2736f4189a..9f878edcd1 100644
--- a/weed/server/master_grpc_server_digest_test.go
+++ b/weed/server/master_grpc_server_digest_test.go
@@ -132,7 +132,11 @@ func TestDigestCheckAsksForTheListWhenTheLookupIndexDrifts(t *testing.T) {
 // preallocate is a bare bool with no way to tell "off" from "not mentioned". A
 // response that left it out would turn preallocation off until reconnect.
 func TestHeartbeatResponsesCarryTheVolumeOptions(t *testing.T) {
-	ms := &MasterServer{option: &MasterOption{VolumeSizeLimitMB: 1024}, preallocateSize: 1}
+	ms := &MasterServer{
+		option:          &MasterOption{VolumeSizeLimitMB: 1024},
+		preallocateSize: 1,
+		Topo:            topology.NewTopology("test", sequence.NewMemorySequencer(), 32*1024, 5, false),
+	}
 
 	resend := ms.heartbeatResponse()
 	resend.ResendFullVolumeList = true
diff --git a/weed/server/master_grpc_server_raft.go b/weed/server/master_grpc_server_raft.go
index f4bf859881..1dcfac4e0f 100644
--- a/weed/server/master_grpc_server_raft.go
+++ b/weed/server/master_grpc_server_raft.go
@@ -6,6 +6,7 @@ import (
 	"net"
 
 	"github.com/hashicorp/raft"
+	goraft "github.com/seaweedfs/raft"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/peer"
 	"google.golang.org/grpc/status"
@@ -96,6 +97,62 @@ func (ms *MasterServer) RaftListClusterServers(ctx context.Context, req *master_
 	return resp, nil
 }
 
+// raftAddServer admits a master into the quorum. A master that starts with no
+// raft state cannot elect on its own, so the leader has to pull it in; this is
+// the one place that knows how to do that for either raft implementation.
+// goraft has no non-voting members, so an admitted peer always votes there.
+func (ms *MasterServer) raftAddServer(id string, grpcAddress string, voter bool) error {
+	ms.Topo.RaftServerAccessLock.RLock()
+	defer ms.Topo.RaftServerAccessLock.RUnlock()
+
+	if ms.Topo.HashicorpRaft != nil {
+		if ms.Topo.HashicorpRaft.State() != raft.Leader {
+			return fmt.Errorf("raft add server %s failed: %s is no current leader", id, ms.Topo.HashicorpRaft.String())
+		}
+		var idxFuture raft.IndexFuture
+		if voter {
+			idxFuture = ms.Topo.HashicorpRaft.AddVoter(raft.ServerID(id), raft.ServerAddress(grpcAddress), 0, 0)
+		} else {
+			idxFuture = ms.Topo.HashicorpRaft.AddNonvoter(raft.ServerID(id), raft.ServerAddress(grpcAddress), 0, 0)
+		}
+		return idxFuture.Error()
+	}
+
+	if ms.Topo.RaftServer == nil {
+		return nil
+	}
+	if ms.Topo.RaftServer.State() != goraft.Leader {
+		return fmt.Errorf("raft add server %s failed: %s is no current leader", id, ms.Topo.RaftServer.Name())
+	}
+	_, err := ms.Topo.RaftServer.Do(&goraft.DefaultJoinCommand{
+		Name:             id,
+		ConnectionString: grpcAddress,
+	})
+	return err
+}
+
+// raftRemoveServer drops a master from the quorum.
+func (ms *MasterServer) raftRemoveServer(id string) error {
+	ms.Topo.RaftServerAccessLock.RLock()
+	defer ms.Topo.RaftServerAccessLock.RUnlock()
+
+	if ms.Topo.HashicorpRaft != nil {
+		if ms.Topo.HashicorpRaft.State() != raft.Leader {
+			return fmt.Errorf("raft remove server %s failed: %s is no current leader", id, ms.Topo.HashicorpRaft.String())
+		}
+		return ms.Topo.HashicorpRaft.RemoveServer(raft.ServerID(id), 0, 0).Error()
+	}
+
+	if ms.Topo.RaftServer == nil {
+		return nil
+	}
+	if ms.Topo.RaftServer.State() != goraft.Leader {
+		return fmt.Errorf("raft remove server %s failed: %s is no current leader", id, ms.Topo.RaftServer.Name())
+	}
+	_, err := ms.Topo.RaftServer.Do(&goraft.DefaultLeaveCommand{Name: id})
+	return err
+}
+
 func (ms *MasterServer) RaftAddServer(ctx context.Context, req *master_pb.RaftAddServerRequest) (*master_pb.RaftAddServerResponse, error) {
 	resp := &master_pb.RaftAddServerResponse{}
 
@@ -103,25 +160,7 @@ func (ms *MasterServer) RaftAddServer(ctx context.Context, req *master_pb.RaftAd
 		return resp, err
 	}
 
-	ms.Topo.RaftServerAccessLock.RLock()
-	defer ms.Topo.RaftServerAccessLock.RUnlock()
-
-	if ms.Topo.HashicorpRaft == nil {
-		return resp, nil
-	}
-
-	if ms.Topo.HashicorpRaft.State() != raft.Leader {
-		return nil, fmt.Errorf("raft add server %s failed: %s is no current leader", req.Id, ms.Topo.HashicorpRaft.String())
-	}
-
-	var idxFuture raft.IndexFuture
-	if req.Voter {
-		idxFuture = ms.Topo.HashicorpRaft.AddVoter(raft.ServerID(req.Id), raft.ServerAddress(req.Address), 0, 0)
-	} else {
-		idxFuture = ms.Topo.HashicorpRaft.AddNonvoter(raft.ServerID(req.Id), raft.ServerAddress(req.Address), 0, 0)
-	}
-
-	if err := idxFuture.Error(); err != nil {
+	if err := ms.raftAddServer(req.Id, req.Address, req.Voter); err != nil {
 		return nil, err
 	}
 	return resp, nil
@@ -134,17 +173,6 @@ func (ms *MasterServer) RaftRemoveServer(ctx context.Context, req *master_pb.Raf
 		return resp, err
 	}
 
-	ms.Topo.RaftServerAccessLock.RLock()
-	defer ms.Topo.RaftServerAccessLock.RUnlock()
-
-	if ms.Topo.HashicorpRaft == nil {
-		return resp, nil
-	}
-
-	if ms.Topo.HashicorpRaft.State() != raft.Leader {
-		return nil, fmt.Errorf("raft remove server %s failed: %s is no current leader", req.Id, ms.Topo.HashicorpRaft.String())
-	}
-
 	if !req.Force {
 		ms.clientChansLock.RLock()
 		_, ok := ms.clientChans[fmt.Sprintf("%s@%s", cluster.MasterType, req.Id)]
@@ -154,8 +182,7 @@ func (ms *MasterServer) RaftRemoveServer(ctx context.Context, req *master_pb.Raf
 		}
 	}
 
-	idxFuture := ms.Topo.HashicorpRaft.RemoveServer(raft.ServerID(req.Id), 0, 0)
-	if err := idxFuture.Error(); err != nil {
+	if err := ms.raftRemoveServer(req.Id); err != nil {
 		return nil, err
 	}
 	return resp, nil
diff --git a/weed/server/master_grpc_server_statistics_test.go b/weed/server/master_grpc_server_statistics_test.go
index 6a8ba1daf1..1e78ea9599 100644
--- a/weed/server/master_grpc_server_statistics_test.go
+++ b/weed/server/master_grpc_server_statistics_test.go
@@ -122,3 +122,52 @@ func TestStatisticsReplicaCopyCount(t *testing.T) {
 		})
 	}
 }
+
+// reportDiskBytes has the first nodeCount nodes report the same filesystem
+// capacity, the way a volume server does in its heartbeat.
+func reportDiskBytes(ms *MasterServer, nodeCount int, totalBytes, freeBytes uint64) {
+	rack := ms.Topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+	for _, node := range rack.Children()[:nodeCount] {
+		node.(*topology.DataNode).AdjustDiskUsageBytes(
+			map[string]uint64{"": totalBytes}, map[string]uint64{"": freeBytes})
+	}
+}
+
+// TestStatisticsPhysicalCapacity covers a cluster configured with more volume
+// slots than its disks hold. Slots promise 40MB here; what the disks can still
+// take is what gets reported.
+func TestStatisticsPhysicalCapacity(t *testing.T) {
+	ms := newStatisticsMaster(t)
+
+	slotCapacity := uint64(40 * 1024 * 1024)
+	statistics := func() *master_pb.StatisticsResponse {
+		t.Helper()
+		resp, err := ms.Statistics(context.Background(), &master_pb.StatisticsRequest{})
+		if err != nil {
+			t.Fatalf("Statistics: %v", err)
+		}
+		return resp
+	}
+
+	if got := statistics().TotalSize; got != slotCapacity {
+		t.Fatalf("disks that report nothing: got %d, want %d", got, slotCapacity)
+	}
+
+	// a volume server too old to report leaves the whole cluster on its slots,
+	// since the room it holds would otherwise go missing
+	reportDiskBytes(ms, 3, 8<<20, 1<<20)
+	if got := statistics().TotalSize; got != slotCapacity {
+		t.Errorf("one disk of four reporting nothing: got %d, want %d", got, slotCapacity)
+	}
+
+	reportDiskBytes(ms, 4, 8<<20, 1<<20)
+	resp := statistics()
+	if want := resp.UsedSize + (4 << 20); resp.TotalSize != want {
+		t.Errorf("four disks with 1MB free: got %d, want %d", resp.TotalSize, want)
+	}
+
+	reportDiskBytes(ms, 4, 1<<30, 1<<30)
+	if got := statistics().TotalSize; got != slotCapacity {
+		t.Errorf("disks roomier than the slots: got %d, want %d", got, slotCapacity)
+	}
+}
diff --git a/weed/server/master_grpc_server_test.go b/weed/server/master_grpc_server_test.go
index fb12f5dc90..b692c14b04 100644
--- a/weed/server/master_grpc_server_test.go
+++ b/weed/server/master_grpc_server_test.go
@@ -27,6 +27,29 @@ func TestInitialLockRingUpdateReturnsLastBroadcastForFilers(t *testing.T) {
 	assert.Greater(t, resp.LockRingUpdate.Version, int64(0))
 }
 
+func TestLeaveLockRingDropsOnlyTheLeavingFiler(t *testing.T) {
+	ms := &MasterServer{
+		LockRingManager: cluster.NewLockRingManager(nil),
+	}
+	ms.LockRingManager.AddServer("group-a", "filer1:8888")
+	ms.LockRingManager.AddServer("group-a", "filer2:8888")
+	ms.LockRingManager.FlushPending("group-a")
+
+	registered := &master_pb.KeepConnectedRequest{ClientType: cluster.FilerType, FilerGroup: "group-a"}
+	ms.onKeepConnectedMessage(registered, "filer1:8888", &master_pb.KeepConnectedRequest{})
+	ms.LockRingManager.FlushPending("group-a")
+	assert.ElementsMatch(t, []string{"filer1:8888", "filer2:8888"}, ms.LockRingManager.GetServers("group-a"))
+
+	ms.onKeepConnectedMessage(registered, "filer1:8888", &master_pb.KeepConnectedRequest{LeaveLockRing: true})
+	ms.LockRingManager.FlushPending("group-a")
+	assert.ElementsMatch(t, []string{"filer2:8888"}, ms.LockRingManager.GetServers("group-a"))
+
+	s3 := &master_pb.KeepConnectedRequest{ClientType: cluster.S3Type, FilerGroup: "group-a"}
+	ms.onKeepConnectedMessage(s3, "filer2:8888", &master_pb.KeepConnectedRequest{LeaveLockRing: true})
+	ms.LockRingManager.FlushPending("group-a")
+	assert.ElementsMatch(t, []string{"filer2:8888"}, ms.LockRingManager.GetServers("group-a"))
+}
+
 func TestInitialLockRingUpdateSkipsNonFilers(t *testing.T) {
 	ms := &MasterServer{
 		LockRingManager: cluster.NewLockRingManager(nil),
@@ -38,6 +61,50 @@ func TestInitialLockRingUpdateSkipsNonFilers(t *testing.T) {
 	assert.Nil(t, ms.initialLockRingUpdate(cluster.BrokerType, "group-a"))
 }
 
+// TestReconnectedClientSurvivesOldHandlerCleanup covers a client reconnecting
+// KeepConnected under the same name before the old handler has exited: the old
+// handler's deferred cleanup must not close the channel the reconnected stream
+// registered, or that stream reads nil from its closed channel forever and
+// floods the client with empty responses.
+func TestReconnectedClientSurvivesOldHandlerCleanup(t *testing.T) {
+	ms := &MasterServer{
+		clientChans: make(map[string]chan *master_pb.KeepConnectedResponse),
+	}
+
+	clientName, oldChan := ms.addClient("", cluster.MasterType, "peer:19333")
+	_, newChan := ms.addClient("", cluster.MasterType, "peer:19333")
+
+	// the old handler's deferred cleanup runs after the reconnect registered
+	ms.deleteClient(clientName, oldChan)
+
+	// the old channel is closed so its drain goroutine can exit
+	select {
+	case _, ok := <-oldChan:
+		assert.False(t, ok, "old channel should be closed")
+	default:
+		t.Fatal("old channel left open")
+	}
+
+	// the reconnected stream's channel is untouched and still receives broadcasts
+	ms.broadcastToClients(&master_pb.KeepConnectedResponse{
+		VolumeLocation: &master_pb.VolumeLocation{Url: "volume-a:8080"},
+	})
+	select {
+	case message, ok := <-newChan:
+		require.True(t, ok, "reconnected client's channel was closed by the old handler's cleanup")
+		require.NotNil(t, message.GetVolumeLocation())
+	default:
+		t.Fatal("no broadcast reached the reconnected client")
+	}
+
+	// the reconnected handler's own cleanup still removes the registration
+	ms.deleteClient(clientName, newChan)
+	ms.clientChansLock.RLock()
+	_, found := ms.clientChans[clientName]
+	ms.clientChansLock.RUnlock()
+	assert.False(t, found)
+}
+
 // TestBroadcastVolumeLocationsToClients verifies grown volume locations are sent to registered clients.
 func TestBroadcastVolumeLocationsToClients(t *testing.T) {
 	clientChan := make(chan *master_pb.KeepConnectedResponse, 2)
diff --git a/weed/server/master_grpc_server_volume.go b/weed/server/master_grpc_server_volume.go
index 2b95ad94fc..de1e54333c 100644
--- a/weed/server/master_grpc_server_volume.go
+++ b/weed/server/master_grpc_server_volume.go
@@ -45,6 +45,23 @@ func (ms *MasterServer) DoAutomaticVolumeGrow(req *topology.VolumeGrowRequest) {
 	ms.broadcastVolumeLocationsToClients(newVidLocations)
 }
 
+// periodicGrowCount decides how many volumes the periodic growth scan adds to
+// a layout ahead of its rack-aware pass, from the writableVolumeCount clients
+// last asked for (lastGrowCount) and the layout's writable and crowded counts.
+// mustGrow reports a refill back up to lastGrowCount writable volumes, which
+// the caller only grows when there is room for all of it. A layout that never
+// received a writableVolumeCount (lastGrowCount 0) is left to the rack-aware
+// pass.
+func periodicGrowCount(lastGrowCount uint32, writable, crowded int) (count uint32, mustGrow bool) {
+	if n := int(lastGrowCount) - writable; n > 0 {
+		return uint32(n), true
+	}
+	if lastGrowCount > 0 && writable < int(lastGrowCount*2) && float64(crowded+volumeGrowStepCount) > float64(writable)*topology.VolumeGrowStrategy.Threshold {
+		return volumeGrowStepCount, false
+	}
+	return 0, false
+}
+
 func (ms *MasterServer) ProcessGrowRequest() {
 	go func() {
 		ctx := context.Background()
@@ -67,25 +84,25 @@ func (ms *MasterServer) ProcessGrowRequest() {
 					continue
 				}
 				writable, crowded := vl.GetWritableVolumeCount()
-				mustGrow := int(lastGrowCount) - writable
 				vgr := vlc.ToVolumeGrowRequest()
 				underReplicated := vl.CountUnderReplicatedVolumes()
 				stats.MasterVolumeLayoutWritable.WithLabelValues(vlc.Collection, vgr.DiskType, vgr.Replication, vgr.Ttl).Set(float64(writable))
 				stats.MasterVolumeLayoutCrowded.WithLabelValues(vlc.Collection, vgr.DiskType, vgr.Replication, vgr.Ttl).Set(float64(crowded))
 				stats.MasterUnderReplicatedVolumes.WithLabelValues(vlc.Collection, vgr.DiskType, vgr.Replication, vgr.Ttl).Set(float64(underReplicated))
 
+				growCount, mustGrow := periodicGrowCount(lastGrowCount, writable, crowded)
 				switch {
-				case mustGrow > 0:
+				case mustGrow:
 					if rp, rpErr := super_block.NewReplicaPlacementFromString(vgr.Replication); rpErr != nil {
 						glog.V(0).Infof("failed to parse replica placement %s: %v", vgr.Replication, rpErr)
 					} else {
-						vgr.WritableVolumeCount = uint32(mustGrow)
+						vgr.WritableVolumeCount = growCount
 						if ms.Topo.AvailableSpaceFor(&topology.VolumeGrowOption{DiskType: types.ToDiskType(vgr.DiskType)}) >= int64(vgr.WritableVolumeCount*uint32(rp.GetCopyCount())) {
 							_, err = ms.VolumeGrow(ctx, vgr)
 						}
 					}
-				case lastGrowCount > 0 && writable < int(lastGrowCount*2) && float64(crowded+volumeGrowStepCount) > float64(writable)*topology.VolumeGrowStrategy.Threshold:
-					vgr.WritableVolumeCount = volumeGrowStepCount
+				case growCount > 0:
+					vgr.WritableVolumeCount = growCount
 					_, err = ms.VolumeGrow(ctx, vgr)
 				}
 				if err != nil {
@@ -151,6 +168,11 @@ func (ms *MasterServer) ProcessGrowRequest() {
 	}()
 }
 
+// LookupVolume resolves one or more volume ids (or "<vid>,<cookie>" file ids)
+// to their current replica locations on the volume servers. Each returned
+// entry carries DataInRemote per replica so the caller can prefer a local
+// replica; entries carrying a file id also receive a freshly generated read
+// jwt the volume server will accept.
 func (ms *MasterServer) LookupVolume(ctx context.Context, req *master_pb.LookupVolumeRequest) (*master_pb.LookupVolumeResponse, error) {
 
 	resp := &master_pb.LookupVolumeResponse{}
@@ -167,10 +189,13 @@ func (ms *MasterServer) LookupVolume(ctx context.Context, req *master_pb.LookupV
 			var locations []*master_pb.Location
 			for _, loc := range result.Locations {
 				locations = append(locations, &master_pb.Location{
-					Url:        loc.Url,
-					PublicUrl:  loc.PublicUrl,
-					DataCenter: loc.DataCenter,
-					GrpcPort:   uint32(loc.GrpcPort),
+					Url:               loc.Url,
+					PublicUrl:         loc.PublicUrl,
+					DataCenter:        loc.DataCenter,
+					GrpcPort:          uint32(loc.GrpcPort),
+					DataInRemote:      loc.DataInRemote,
+					ReadOnly:          loc.ReadOnly,
+					ReadOnlyCanDelete: loc.ReadOnlyCanDelete,
 				})
 			}
 			var auth string
@@ -189,9 +214,12 @@ func (ms *MasterServer) LookupVolume(ctx context.Context, req *master_pb.LookupV
 		}
 	}
 
-	// Only return Unavailable during warmup when every requested ID was a transient not-found
-	if len(req.VolumeOrFileIds) > 0 && notFoundCount == len(req.VolumeOrFileIds) && ms.Topo.IsLeader() && ms.Topo.IsWarmingUp() {
-		glog.V(0).Infof("lookup volume warming up: topology is still loading (%d not found)", notFoundCount)
+	// While warming up, a not-found may only mean the volume server has not
+	// reported yet, so no part of the answer can be treated as authoritative.
+	// Callers retry Unavailable; a partial answer would let them take a
+	// missing volume as gone.
+	if notFoundCount > 0 && ms.Topo.IsLeader() && ms.Topo.IsWarmingUp() {
+		glog.V(0).Infof("lookup volume warming up: topology is still loading (%d of %d not found)", notFoundCount, len(req.VolumeOrFileIds))
 		return nil, status.Errorf(codes.Unavailable, "master is warming up, topology is still loading")
 	}
 
@@ -239,6 +267,13 @@ func (ms *MasterServer) Statistics(ctx context.Context, req *master_pb.Statistic
 	if req.Collection != "" {
 		clusterUsedSize = ms.Topo.CollectionVolumeStats("").UsedSize
 	}
+	// volume slots are provisioning, not capacity: a cluster configured with
+	// more of them than its disks hold would report space it can never take.
+	// What the disks still have free, on top of what the cluster already wrote,
+	// is the real ceiling.
+	if freeBytes, reported := ms.Topo.FreeBytes(); reported {
+		totalSize = min(totalSize, clusterUsedSize+freeBytes)
+	}
 	// and the free space holds that many copies fewer of whatever the caller writes
 	var freeSize uint64
 	if totalSize > clusterUsedSize {
@@ -279,14 +314,47 @@ func (ms *MasterServer) VolumeList(ctx context.Context, req *master_pb.VolumeLis
 		return nil, raft.NotLeaderError
 	}
 
+	filter, err := topology.NewVolumeFilter(req)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
 	resp := &master_pb.VolumeListResponse{
-		TopologyInfo:      ms.Topo.ToTopologyInfo(),
+		TopologyInfo:      ms.Topo.ToTopologyInfo(filter),
 		VolumeSizeLimitMb: uint64(ms.option.VolumeSizeLimitMB),
 	}
 
 	return resp, nil
 }
 
+// VolumeListStream answers VolumeList without building the whole reply first.
+// The topology goes out on its own, then the volumes in batches, so the master
+// holds one batch rather than every volume in the cluster.
+func (ms *MasterServer) VolumeListStream(req *master_pb.VolumeListRequest, stream master_pb.Seaweed_VolumeListStreamServer) error {
+
+	if !ms.Topo.IsLeader() {
+		return raft.NotLeaderError
+	}
+
+	filter, err := topology.NewVolumeFilter(req)
+	if err != nil {
+		return status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	listed := ms.Topo.ToTopologyInfo(topology.NoVolumes())
+	err = stream.Send(&master_pb.VolumeListStreamResponse{
+		Header: &master_pb.VolumeListResponse{
+			TopologyInfo:      listed,
+			VolumeSizeLimitMb: uint64(ms.option.VolumeSizeLimitMB),
+		},
+	})
+	if err != nil {
+		return err
+	}
+
+	return ms.Topo.StreamVolumes(listed, filter, 0, stream.Send)
+}
+
 func (ms *MasterServer) LookupEcVolume(ctx context.Context, req *master_pb.LookupEcVolumeRequest) (*master_pb.LookupEcVolumeResponse, error) {
 
 	if !ms.Topo.IsLeader() {
@@ -331,7 +399,7 @@ func (ms *MasterServer) VacuumVolume(ctx context.Context, req *master_pb.VacuumV
 
 	resp := &master_pb.VacuumVolumeResponse{}
 
-	ms.Topo.Vacuum(ms.grpcDialOption, float64(req.GarbageThreshold), ms.option.MaxParallelVacuumPerServer, req.VolumeId, req.Collection, ms.preallocateSize, false)
+	ms.Topo.Vacuum(ms.grpcDialOption, float64(req.GarbageThreshold), ms.option.MaxParallelVacuumPerServer, ms.option.MaxParallelVacuumPerRack, req.VolumeId, req.Collection, ms.preallocateSize, false, 0)
 
 	return resp, nil
 }
@@ -403,6 +471,13 @@ func (ms *MasterServer) VolumeMarkReadonly(ctx context.Context, req *master_pb.V
 	return resp, nil
 }
 
+func (ms *MasterServer) ResumeVolumeGrowth(ctx context.Context, req *master_pb.ResumeVolumeGrowthRequest) (*master_pb.ResumeVolumeGrowthResponse, error) {
+	if !ms.Topo.IsLeader() {
+		return nil, raft.NotLeaderError
+	}
+	return &master_pb.ResumeVolumeGrowthResponse{WasFrozen: ms.Topo.ResumeVolumeGrowth()}, nil
+}
+
 func (ms *MasterServer) VolumeGrow(ctx context.Context, req *master_pb.VolumeGrowRequest) (*master_pb.VolumeGrowResponse, error) {
 	if !ms.Topo.IsLeader() {
 		return nil, raft.NotLeaderError
@@ -441,6 +516,27 @@ func (ms *MasterServer) VolumeGrow(ctx context.Context, req *master_pb.VolumeGro
 		Force:  true,
 		Reason: "grpc volume grow",
 	}
+
+	// Report the layout's fill observed at request time whether or not
+	// growth was triggered, so callers can tell an empty layout from a
+	// skipped one. A missing collection/layout reports zeros.
+	var avgFill float64
+	var writableCount int
+	if vl := ms.Topo.FindVolumeLayout(req.Collection, replicaPlacement, ttl, types.ToDiskType(req.DiskType)); vl != nil {
+		avgFill, writableCount = vl.WritableAvgFill(&volumeGrowOption)
+	}
+
+	// Conditional grow: with a threshold set, grow only when the layout's
+	// writable volumes have reached this average fill. A layout with no
+	// writable volumes (none yet, or all just filled) skips the check — that
+	// is the case growth exists to fix.
+	if req.GrowAvgFillThreshold > 0 && writableCount > 0 && avgFill < float64(req.GrowAvgFillThreshold) {
+		return &master_pb.VolumeGrowResponse{
+			AvgFill:       float32(avgFill),
+			WritableCount: uint32(writableCount),
+		}, nil
+	}
+
 	replicaCount := int64(req.WritableVolumeCount * uint32(replicaPlacement.GetCopyCount()))
 
 	if ms.Topo.AvailableSpaceFor(&volumeGrowOption) < replicaCount {
@@ -449,5 +545,8 @@ func (ms *MasterServer) VolumeGrow(ctx context.Context, req *master_pb.VolumeGro
 
 	ms.DoAutomaticVolumeGrow(&volumeGrowRequest)
 
-	return &master_pb.VolumeGrowResponse{}, nil
+	return &master_pb.VolumeGrowResponse{
+		AvgFill:       float32(avgFill),
+		WritableCount: uint32(writableCount),
+	}, nil
 }
diff --git a/weed/server/master_grpc_server_volume_move_test.go b/weed/server/master_grpc_server_volume_move_test.go
index 46ae5bbbd1..5feb8b5bf9 100644
--- a/weed/server/master_grpc_server_volume_move_test.go
+++ b/weed/server/master_grpc_server_volume_move_test.go
@@ -29,7 +29,7 @@ func TestVolumeMovedBetweenDisksIsNotBroadcastAsRemoved(t *testing.T) {
 	topo, dn := moveTestNode(t)
 	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{moveTestVolume("", 0)}, dn)
 
-	_, deleted := topo.SyncDataNodeRegistration(
+	_, deleted, _ := topo.SyncDataNodeRegistration(
 		[]*master_pb.VolumeInformationMessage{moveTestVolume("ssd", 1)}, dn)
 
 	if len(deleted) != 1 {
@@ -44,7 +44,7 @@ func TestVolumeGoneFromTheNodeIsBroadcastAsRemoved(t *testing.T) {
 	topo, dn := moveTestNode(t)
 	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{moveTestVolume("", 0)}, dn)
 
-	if _, deleted := topo.SyncDataNodeRegistration(nil, dn); len(deleted) != 1 {
+	if _, deleted, _ := topo.SyncDataNodeRegistration(nil, dn); len(deleted) != 1 {
 		t.Fatalf("expected the volume to be removed, got %d removals", len(deleted))
 	}
 	if !shouldBroadcastVolumeRemoval(dn, needle.VolumeId(1)) {
@@ -89,7 +89,7 @@ func TestVolumeReplacedByEcShardsIsBroadcastAsRemoved(t *testing.T) {
 		{Id: 1, Collection: "c", EcIndexBits: 0x3fff},
 	}, dn)
 
-	if _, deleted := topo.SyncDataNodeRegistration(nil, dn); len(deleted) != 1 {
+	if _, deleted, _ := topo.SyncDataNodeRegistration(nil, dn); len(deleted) != 1 {
 		t.Fatalf("expected the normal volume to be removed, got %d removals", len(deleted))
 	}
 	if !shouldBroadcastVolumeRemoval(dn, needle.VolumeId(1)) {
diff --git a/weed/server/master_grpc_server_volume_warmup_test.go b/weed/server/master_grpc_server_volume_warmup_test.go
new file mode 100644
index 0000000000..b62d4a32d7
--- /dev/null
+++ b/weed/server/master_grpc_server_volume_warmup_test.go
@@ -0,0 +1,63 @@
+package weed_server
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// A leader that already knew volumes at the leader change is warming up until
+// every volume server has had time to report again.
+func newWarmingUpMaster(t *testing.T) *MasterServer {
+	t.Helper()
+	ms := newLeaderMaster()
+	node := ms.Topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, 18080, "127.0.0.1", "node1", map[string]uint32{"": 10})
+	ms.Topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{{Id: 7, Size: 100}}, node)
+	ms.Topo.SetLastLeaderChangeTime(time.Now())
+	if !ms.Topo.IsWarmingUp() {
+		t.Fatal("precondition: master is not warming up")
+	}
+	return ms
+}
+
+func TestLookupVolumeDuringWarmupRefusesPartialNotFound(t *testing.T) {
+	ms := newWarmingUpMaster(t)
+	_, err := ms.LookupVolume(context.Background(), &master_pb.LookupVolumeRequest{VolumeOrFileIds: []string{"7", "8"}})
+	if status.Code(err) != codes.Unavailable {
+		t.Fatalf("partial not-found during warmup = %v, want Unavailable", err)
+	}
+}
+
+func TestLookupVolumeDuringWarmupAnswersFullyKnownBatch(t *testing.T) {
+	ms := newWarmingUpMaster(t)
+	resp, err := ms.LookupVolume(context.Background(), &master_pb.LookupVolumeRequest{VolumeOrFileIds: []string{"7"}})
+	if err != nil {
+		t.Fatalf("known volume during warmup: %v", err)
+	}
+	if len(resp.VolumeIdLocations) != 1 || len(resp.VolumeIdLocations[0].Locations) != 1 || resp.VolumeIdLocations[0].Error != "" {
+		t.Fatalf("known volume answer = %+v", resp.VolumeIdLocations)
+	}
+}
+
+func TestLookupVolumeAfterWarmupReportsNotFoundPerVolume(t *testing.T) {
+	ms := newWarmingUpMaster(t)
+	ms.Topo.SetLastLeaderChangeTime(time.Now().Add(-time.Hour))
+	resp, err := ms.LookupVolume(context.Background(), &master_pb.LookupVolumeRequest{VolumeOrFileIds: []string{"7", "8"}})
+	if err != nil {
+		t.Fatalf("lookup after warmup: %v", err)
+	}
+	if len(resp.VolumeIdLocations) != 2 {
+		t.Fatalf("answers = %+v, want two", resp.VolumeIdLocations)
+	}
+	if len(resp.VolumeIdLocations[0].Locations) != 1 || resp.VolumeIdLocations[0].Error != "" {
+		t.Fatalf("known volume answer = %+v", resp.VolumeIdLocations[0])
+	}
+	if len(resp.VolumeIdLocations[1].Locations) != 0 || resp.VolumeIdLocations[1].Error == "" {
+		t.Fatalf("absent volume answer = %+v", resp.VolumeIdLocations[1])
+	}
+}
diff --git a/weed/server/master_server.go b/weed/server/master_server.go
index 4677c69da7..595259c7b1 100644
--- a/weed/server/master_server.go
+++ b/weed/server/master_server.go
@@ -15,7 +15,9 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster/maintenance"
+	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/telemetry"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
@@ -28,6 +30,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/sequence"
 	"github.com/seaweedfs/seaweedfs/weed/shell"
@@ -45,11 +48,16 @@ const (
 )
 
 type MasterOption struct {
-	Master                     pb.ServerAddress
-	MetaFolder                 string
-	VolumeSizeLimitMB          uint32
-	VolumePreallocate          bool
-	MaxParallelVacuumPerServer int
+	Master                        pb.ServerAddress
+	MetaFolder                    string
+	VolumeSizeLimitMB             uint32
+	FileSizeLimitMB               int
+	VolumePreallocate             bool
+	MaxParallelVacuumPerServer    int
+	MaxParallelVacuumPerRack      int
+	MaxWritableVolumes            int
+	VacuumIntervalSeconds         int
+	VacuumDeleteEmptyAfterSeconds int
 	// PulseSeconds            int
 	DefaultReplicaPlacement string
 	GarbageThreshold        float64
@@ -58,6 +66,7 @@ type MasterOption struct {
 	MetricsAddress          string
 	MetricsIntervalSec      int
 	IsFollower              bool
+	SingleMaster            bool
 	TelemetryUrl            string
 	TelemetryEnabled        bool
 	VolumeGrowthDisabled    bool
@@ -82,6 +91,9 @@ type MasterServer struct {
 
 	topologyIdGenLock sync.Mutex
 
+	// masters currently being admitted into the raft quorum, keyed by raft id
+	raftPeerAdmissions sync.Map
+
 	MasterClient *wdclient.MasterClient
 
 	adminLocks *AdminLocks
@@ -95,7 +107,6 @@ type MasterServer struct {
 }
 
 func NewMasterServer(r *mux.Router, option *MasterOption, peers map[string]pb.ServerAddress) *MasterServer {
-
 	v := util.GetViper()
 	signingKey := v.GetString("jwt.signing.key")
 	v.SetDefault("jwt.signing.expires_after_seconds", 10)
@@ -113,14 +124,25 @@ func NewMasterServer(r *mux.Router, option *MasterOption, peers map[string]pb.Se
 	v.SetDefault("master.volume_growth.copy_3", topology.VolumeGrowStrategy.Copy3Count)
 	v.SetDefault("master.volume_growth.copy_other", topology.VolumeGrowStrategy.CopyOtherCount)
 	v.SetDefault("master.volume_growth.threshold", topology.VolumeGrowStrategy.Threshold)
+	v.SetDefault("master.volume_growth.reservation_timeout", "5m")
 	v.SetDefault("master.volume_growth.disable", false)
 	option.VolumeGrowthDisabled = v.GetBool("master.volume_growth.disable")
+	v.SetDefault("master.volume_growth.freeze_on_topology_mismatch", true)
+	v.SetDefault("master.volume_growth.state_loss_recovery_wait", "0s")
+	v.SetDefault("master.vacuum.max_parallel_per_rack", 0)
+	option.MaxParallelVacuumPerRack = v.GetInt("master.vacuum.max_parallel_per_rack")
+	if v.IsSet("master.vacuum.max_parallel_per_server") {
+		option.MaxParallelVacuumPerServer = v.GetInt("master.vacuum.max_parallel_per_server")
+	}
+	v.SetDefault("master.max_writable_volumes_per_layout", option.MaxWritableVolumes)
+	option.MaxWritableVolumes = v.GetInt("master.max_writable_volumes_per_layout")
 
 	topology.VolumeGrowStrategy.Copy1Count = v.GetUint32("master.volume_growth.copy_1")
 	topology.VolumeGrowStrategy.Copy2Count = v.GetUint32("master.volume_growth.copy_2")
 	topology.VolumeGrowStrategy.Copy3Count = v.GetUint32("master.volume_growth.copy_3")
 	topology.VolumeGrowStrategy.CopyOtherCount = v.GetUint32("master.volume_growth.copy_other")
 	topology.VolumeGrowStrategy.Threshold = v.GetFloat64("master.volume_growth.threshold")
+	topology.VolumeGrowStrategy.ReservationTimeout = parseReservationTimeout(v)
 	whiteList := util.StringSplit(v.GetString("guard.white_list"), ",")
 
 	var preallocateSize int64
@@ -149,6 +171,26 @@ func NewMasterServer(r *mux.Router, option *MasterOption, peers map[string]pb.Se
 		glog.Fatalf("create sequencer failed.")
 	}
 	ms.Topo = topology.NewTopology("topo", seq, uint64(ms.option.VolumeSizeLimitMB)*1024*1024, 5, replicationAsMin)
+	ms.Topo.SetMaxWritableVolumes(ms.option.MaxWritableVolumes)
+	ms.Topo.SetGrowthFreezeConfig(
+		v.GetBool("master.volume_growth.freeze_on_topology_mismatch"),
+		v.GetDuration("master.volume_growth.state_loss_recovery_wait"))
+	ms.Topo.QuarantineVolumeFn = func(dn *topology.DataNode, vid needle.VolumeId, readOnly bool) error {
+		err := operation.WithVolumeServerClient(false, dn.ServerAddress(), ms.grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			if readOnly {
+				_, err := client.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{VolumeId: uint32(vid), CanDelete: true})
+				return err
+			}
+			_, err := client.VolumeMarkWritable(ctx, &volume_server_pb.VolumeMarkWritableRequest{VolumeId: uint32(vid)})
+			return err
+		})
+		if err != nil {
+			glog.Warningf("quarantine volume %d on %s readOnly=%v: %v", vid, dn.Id(), readOnly, err)
+		}
+		return err
+	}
 	ms.vg = topology.NewDefaultVolumeGrowth()
 	glog.V(0).Infoln("Volume Size Limit is", ms.option.VolumeSizeLimitMB, "MB")
 
@@ -196,8 +238,11 @@ func NewMasterServer(r *mux.Router, option *MasterOption, peers map[string]pb.Se
 		ms.grpcDialOption,
 		ms.option.GarbageThreshold,
 		ms.option.MaxParallelVacuumPerServer,
+		ms.option.MaxParallelVacuumPerRack,
 		topology.VolumeGrowStrategy.Threshold,
 		ms.preallocateSize,
+		time.Duration(ms.option.VacuumIntervalSeconds)*time.Second,
+		time.Duration(ms.option.VacuumDeleteEmptyAfterSeconds)*time.Second,
 	)
 
 	ms.ProcessGrowRequest()
@@ -216,9 +261,10 @@ func (ms *MasterServer) healthzHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func (ms *MasterServer) readyzHandler(w http.ResponseWriter, r *http.Request) {
-	// Readiness: check we can serve traffic.
-	leader, err := ms.Topo.Leader()
-	if err != nil {
+	// Readiness: check we can serve traffic. Answer from what raft knows now
+	// rather than waiting out an election, so the probe's own timeout decides.
+	leader, err := ms.Topo.MaybeLeader()
+	if err != nil || leader == "" {
 		w.WriteHeader(http.StatusServiceUnavailable)
 		return
 	}
@@ -469,6 +515,11 @@ func processEachCmd(reg *regexp.Regexp, line string, commandEnv *shell.CommandEn
 				continue
 			}
 			glog.V(0).Infof("executing: %s %v", cmd, args)
+			// noLock belongs to the invocation that set it, not to the
+			// CommandEnv this loop reuses for every line of the script. Without
+			// this, a dry run earlier in the script leaves the mutations after
+			// it unlocked.
+			commandEnv.SetNoLock(false)
 			if err := c.Do(args, commandEnv, os.Stdout); err != nil {
 				glog.V(0).Infof("error: %v", err)
 			}
@@ -499,61 +550,146 @@ func (ms *MasterServer) createSequencer(option *MasterOption) sequence.Sequencer
 }
 
 func (ms *MasterServer) OnPeerUpdate(update *master_pb.ClusterNodeUpdate, startFrom time.Time) {
-	ms.Topo.RaftServerAccessLock.RLock()
-	defer ms.Topo.RaftServerAccessLock.RUnlock()
-
-	if update.NodeType != cluster.MasterType || ms.Topo.HashicorpRaft == nil {
+	if update.NodeType != cluster.MasterType {
 		return
 	}
 	glog.V(4).Infof("OnPeerUpdate: %+v", update)
 
 	peerAddress := pb.ServerAddress(update.Address)
-	peerName := raftServerID(peerAddress)
-	if ms.Topo.HashicorpRaft.State() != hashicorpRaft.Leader {
+	if update.IsAdd {
+		ms.AdmitRaftPeer(peerAddress)
 		return
 	}
-	if update.IsAdd {
-		raftServerFound := false
-		for _, server := range ms.Topo.HashicorpRaft.GetConfiguration().Configuration().Servers {
-			if string(server.ID) == peerName {
-				raftServerFound = true
-			}
-		}
-		if !raftServerFound {
-			glog.V(0).Infof("adding new raft server: %s", peerName)
-			ms.Topo.HashicorpRaft.AddVoter(
-				hashicorpRaft.ServerID(peerName),
-				hashicorpRaft.ServerAddress(peerAddress.ToGrpcAddress()), 0, 0)
-		}
-	} else {
-		pb.WithMasterClient(context.Background(), false, peerAddress, ms.grpcDialOption, true, func(client master_pb.SeaweedClient) error {
-			ctx, cancel := context.WithTimeout(context.TODO(), 15*time.Second)
-			defer cancel()
-			if _, err := client.Ping(ctx, &master_pb.PingRequest{Target: string(peerAddress), TargetType: cluster.MasterType}); err != nil {
-				glog.V(0).Infof("master %s didn't respond to pings. remove raft server", peerName)
-				// We are the leader here, so drop the dead peer through the local
-				// raft handle, mirroring the AddVoter branch above, instead of
-				// dialing our own RaftRemoveServer RPC.
-				if err := ms.Topo.HashicorpRaft.RemoveServer(hashicorpRaft.ServerID(peerName), 0, 0).Error(); err != nil {
-					glog.Warningf("failed removing old raft server: %v", err)
-					return err
-				}
-			} else {
-				glog.V(0).Infof("master %s successfully responded to ping", peerName)
-			}
-			return nil
-		})
+
+	ms.Topo.RaftServerAccessLock.RLock()
+	defer ms.Topo.RaftServerAccessLock.RUnlock()
+
+	// goraft rebuilds its peer set from -peers on every start, so a departed
+	// master is already out of the list there and would come back on the next
+	// restart anyway; only hashicorp raft carries membership across restarts.
+	if ms.Topo.HashicorpRaft == nil || ms.Topo.HashicorpRaft.State() != hashicorpRaft.Leader {
+		return
 	}
+	// A master that is merely down is still a member: -peers is what declares
+	// membership, and updatePeers reconciles the configuration against it on
+	// every leadership change. Evicting one here would shrink the quorum behind
+	// the operator's back, and a restart then races the eviction — the master
+	// gets re-admitted, the removal lands after it, and it is left out of the
+	// configuration with nobody left to vote it back in.
+	for _, peer := range ms.MasterClient.GetMasters(context.Background()) {
+		if peer.ToHttpAddress() == peerAddress.ToHttpAddress() {
+			return
+		}
+	}
+
+	peerName := raftServerID(peerAddress)
+	pb.WithMasterClient(context.Background(), false, peerAddress, ms.grpcDialOption, true, func(client master_pb.SeaweedClient) error {
+		ctx, cancel := context.WithTimeout(context.TODO(), 15*time.Second)
+		defer cancel()
+		if _, err := client.Ping(ctx, &master_pb.PingRequest{Target: string(peerAddress), TargetType: cluster.MasterType}); err != nil {
+			glog.V(0).Infof("master %s didn't respond to pings. remove raft server", peerName)
+			// We are the leader here, so drop the dead peer through the local
+			// raft handle instead of dialing our own RaftRemoveServer RPC.
+			if err := ms.Topo.HashicorpRaft.RemoveServer(hashicorpRaft.ServerID(peerName), 0, 0).Error(); err != nil {
+				glog.Warningf("failed removing old raft server: %v", err)
+				return err
+			}
+		} else {
+			glog.V(0).Infof("master %s successfully responded to ping", peerName)
+		}
+		return nil
+	})
+}
+
+// AdmitRaftPeer pulls a master into the raft quorum, if we are the leader and
+// do not have it yet. A master that starts with no raft state cannot campaign
+// under either implementation, so this is its only way in. The returned
+// channel resolves with the admission result, or nil when no admission ran.
+func (ms *MasterServer) AdmitRaftPeer(peerAddress pb.ServerAddress) <-chan error {
+	if ms.option.SingleMaster || peerAddress.ToHttpAddress() == ms.option.Master.ToHttpAddress() {
+		return nil
+	}
+
+	peerName, ok := ms.missingRaftPeerName(peerAddress)
+	if !ok {
+		return nil
+	}
+	admission := make(chan error, 1)
+	if inFlight, alreadyAdmitting := ms.raftPeerAdmissions.LoadOrStore(peerName, admission); alreadyAdmitting {
+		return inFlight.(chan error)
+	}
+	glog.V(0).Infof("adding new raft server: %s", peerName)
+	// The join commits through raft, which waits on the other peers, so keep it
+	// off the caller: this runs on the peer update stream and on the grpc
+	// handler that a joining master is still blocked in.
+	go func() {
+		defer ms.raftPeerAdmissions.Delete(peerName)
+		defer close(admission)
+		if err := ms.raftAddServer(peerName, peerAddress.ToGrpcAddress(), true); err != nil {
+			glog.Warningf("failed adding raft server %s: %v", peerName, err)
+			admission <- err
+			return
+		}
+		admission <- nil
+	}()
+	return admission
+}
+
+// missingRaftPeerName returns the raft id to admit peerAddress under, and
+// whether this master is the leader and is missing that peer.
+func (ms *MasterServer) missingRaftPeerName(peerAddress pb.ServerAddress) (string, bool) {
+	ms.Topo.RaftServerAccessLock.RLock()
+	defer ms.Topo.RaftServerAccessLock.RUnlock()
+
+	if ms.Topo.RaftServer != nil {
+		if ms.Topo.RaftServer.State() != raft.Leader {
+			return "", false
+		}
+		// Peers are keyed by the name a master calls itself, which carries the
+		// grpc port; match on the http address so a peer already known under
+		// another spelling is not added twice.
+		for name := range ms.Topo.RaftServer.Peers() {
+			if pb.ServerAddress(name).ToHttpAddress() == peerAddress.ToHttpAddress() {
+				return "", false
+			}
+		}
+		return string(peerAddress), true
+	}
+
+	if ms.Topo.HashicorpRaft == nil || ms.Topo.HashicorpRaft.State() != hashicorpRaft.Leader {
+		return "", false
+	}
+	peerName := raftServerID(peerAddress)
+	for _, server := range ms.Topo.HashicorpRaft.GetConfiguration().Configuration().Servers {
+		if string(server.ID) == peerName {
+			return "", false
+		}
+	}
+	return peerName, true
 }
 
 func (ms *MasterServer) Shutdown() {
-	if ms.Topo == nil || ms.Topo.HashicorpRaft == nil {
+	if ms.Topo == nil {
 		return
 	}
-	if ms.Topo.HashicorpRaft.State() == hashicorpRaft.Leader {
-		ms.Topo.HashicorpRaft.LeadershipTransfer()
+	ms.Topo.RaftServerAccessLock.RLock()
+	raftServer := ms.Topo.RaftServer
+	hashRaft := ms.Topo.HashicorpRaft
+	ms.Topo.RaftServerAccessLock.RUnlock()
+
+	if hashRaft != nil {
+		if hashRaft.State() == hashicorpRaft.Leader {
+			hashRaft.LeadershipTransfer()
+		}
+		hashRaft.Shutdown()
+	}
+	// Stop the goraft server too. Without this, the raft event loop
+	// goroutine (leaderLoop/followerLoop) keeps running after the master
+	// shuts down, leaking goroutines across test runs and occasionally
+	// processing stale events that trigger safety assertions.
+	if raftServer != nil {
+		raftServer.Stop()
 	}
-	ms.Topo.HashicorpRaft.Shutdown()
 }
 
 func (ms *MasterServer) Reload() {
@@ -571,3 +707,16 @@ func (ms *MasterServer) Reload() {
 		v.GetInt("jwt.signing.read.expires_after_seconds"),
 	)
 }
+
+func parseReservationTimeout(v *util.ViperProxy) time.Duration {
+	if str := strings.TrimSpace(v.GetString("master.volume_growth.reservation_timeout")); str != "" {
+		if d, err := time.ParseDuration(str); err == nil && d > 0 {
+			return d
+		}
+	}
+	// A bare number in the config means seconds; GetDuration would read it as nanoseconds.
+	if sec := v.GetInt("master.volume_growth.reservation_timeout"); sec > 0 {
+		return time.Duration(sec) * time.Second
+	}
+	return topology.DefaultReservationTimeout
+}
diff --git a/weed/server/master_server_admit_test.go b/weed/server/master_server_admit_test.go
new file mode 100644
index 0000000000..012985b5cf
--- /dev/null
+++ b/weed/server/master_server_admit_test.go
@@ -0,0 +1,119 @@
+package weed_server
+
+import (
+	"testing"
+	"time"
+
+	hashicorpRaft "github.com/hashicorp/raft"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/topology"
+)
+
+func TestSingleMasterNeverAdmitsRaftPeers(t *testing.T) {
+	ms := &MasterServer{option: &MasterOption{SingleMaster: true, Master: "localhost:9333"}}
+
+	// A foreign master announcing itself must not touch the admission path:
+	// ms.Topo is deliberately nil so any admission attempt panics the test.
+	if done := ms.AdmitRaftPeer("10.0.0.1:9333"); done != nil {
+		t.Fatal("single-master mode admitted a foreign raft peer")
+	}
+}
+
+func TestClusteredLeaderAdmitsMissingPeer(t *testing.T) {
+	topo := topology.NewTopology("topo", nil, 128*1024*1024, 0, false)
+	leader, leaderTransport := newInmemRaftLeader(t, "localhost:9333")
+	topo.HashicorpRaft = leader
+	ms := &MasterServer{
+		option: &MasterOption{Master: "localhost:9333"},
+		Topo:   topo,
+	}
+
+	peer := pb.ServerAddress("10.0.0.1:9333")
+	name, missing := ms.missingRaftPeerName(peer)
+	if !missing || name != "10.0.0.1:9333" {
+		t.Fatalf("clustered leader did not report the missing raft peer: %q %v", name, missing)
+	}
+	peerRaft := newInmemRaftFollower(t, peer, leaderTransport)
+
+	done := ms.AdmitRaftPeer(peer)
+	if done == nil {
+		t.Fatal("clustered leader skipped admission of a missing raft peer")
+	}
+	if err := <-done; err != nil {
+		t.Fatalf("raft peer admission failed: %v", err)
+	}
+
+	// The joined node's own configuration is the committed view: it only
+	// learns the quorum it was admitted into through replication.
+	for deadline := time.Now().Add(10 * time.Second); ; {
+		if raftHasVoter(peerRaft, string(peer)) {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("admitted peer never saw itself in the quorum: %v",
+				peerRaft.GetConfiguration().Configuration().Servers)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func raftHasVoter(r *hashicorpRaft.Raft, id string) bool {
+	for _, server := range r.GetConfiguration().Configuration().Servers {
+		if server.Suffrage == hashicorpRaft.Voter && string(server.ID) == id {
+			return true
+		}
+	}
+	return false
+}
+
+func newInmemRaftFollower(t *testing.T, self pb.ServerAddress, peerTransport *hashicorpRaft.InmemTransport) *hashicorpRaft.Raft {
+	t.Helper()
+	conf := hashicorpRaft.DefaultConfig()
+	conf.LocalID = hashicorpRaft.ServerID(self)
+	addr, transport := hashicorpRaft.NewInmemTransport(hashicorpRaft.ServerAddress(self.ToGrpcAddress()))
+	transport.Connect(peerTransport.LocalAddr(), peerTransport)
+	peerTransport.Connect(addr, transport)
+	r, err := hashicorpRaft.NewRaft(conf,
+		&StateMachine{topo: topology.NewTopology("fsm", nil, 128*1024*1024, 0, false)},
+		hashicorpRaft.NewInmemStore(), hashicorpRaft.NewInmemStore(),
+		hashicorpRaft.NewInmemSnapshotStore(), transport)
+	if err != nil {
+		t.Fatalf("new raft: %v", err)
+	}
+	t.Cleanup(func() { r.Shutdown() })
+	return r
+}
+
+func newInmemRaftLeader(t *testing.T, self string) (*hashicorpRaft.Raft, *hashicorpRaft.InmemTransport) {
+	t.Helper()
+	conf := hashicorpRaft.DefaultConfig()
+	conf.LocalID = hashicorpRaft.ServerID(self)
+	conf.HeartbeatTimeout = 50 * time.Millisecond
+	conf.ElectionTimeout = 50 * time.Millisecond
+	conf.LeaderLeaseTimeout = 25 * time.Millisecond
+	conf.CommitTimeout = 5 * time.Millisecond
+	addr, transport := hashicorpRaft.NewInmemTransport(hashicorpRaft.ServerAddress(self))
+	r, err := hashicorpRaft.NewRaft(conf,
+		&StateMachine{topo: topology.NewTopology("fsm", nil, 128*1024*1024, 0, false)},
+		hashicorpRaft.NewInmemStore(), hashicorpRaft.NewInmemStore(),
+		hashicorpRaft.NewInmemSnapshotStore(), transport)
+	if err != nil {
+		t.Fatalf("new raft: %v", err)
+	}
+	t.Cleanup(func() { r.Shutdown() })
+
+	if err := r.BootstrapCluster(hashicorpRaft.Configuration{
+		Servers: []hashicorpRaft.Server{{Suffrage: hashicorpRaft.Voter, ID: conf.LocalID, Address: addr}},
+	}).Error(); err != nil {
+		t.Fatalf("bootstrap cluster: %v", err)
+	}
+	for deadline := time.Now().Add(10 * time.Second); ; {
+		if r.State() == hashicorpRaft.Leader {
+			return r, transport
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("in-memory raft did not elect a leader")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
diff --git a/weed/server/master_server_handlers.go b/weed/server/master_server_handlers.go
index f028a5a044..4bb583dc7b 100644
--- a/weed/server/master_server_handlers.go
+++ b/weed/server/master_server_handlers.go
@@ -81,26 +81,24 @@ func (ms *MasterServer) findVolumeLocation(collection, vid string) operation.Loo
 	if ms.Topo.IsLeader() {
 		volumeId, newVolumeIdErr := needle.NewVolumeId(vid)
 		if newVolumeIdErr != nil {
-			err = fmt.Errorf("Unknown volume id %s", vid)
+			err = fmt.Errorf("unknown volume id %s", vid)
 		} else {
 			machines := ms.Topo.Lookup(collection, volumeId)
 			for _, loc := range machines {
-				locations = append(locations, operation.Location{
-					Url:        loc.Url(),
-					PublicUrl:  loc.PublicUrl,
-					DataCenter: loc.GetDataCenterId(),
-					GrpcPort:   loc.GrpcPort,
-				})
+				locations = append(locations, topologyLocation(loc, volumeId))
 			}
 		}
 	} else {
 		machines, getVidLocationsErr := ms.MasterClient.GetVidLocations(vid)
 		for _, loc := range machines {
 			locations = append(locations, operation.Location{
-				Url:        loc.Url,
-				PublicUrl:  loc.PublicUrl,
-				DataCenter: loc.DataCenter,
-				GrpcPort:   loc.GrpcPort,
+				Url:               loc.Url,
+				PublicUrl:         loc.PublicUrl,
+				DataCenter:        loc.DataCenter,
+				GrpcPort:          loc.GrpcPort,
+				DataInRemote:      loc.DataInRemote,
+				ReadOnly:          loc.ReadOnly,
+				ReadOnlyCanDelete: loc.ReadOnlyCanDelete,
 			})
 		}
 		err = getVidLocationsErr
@@ -121,6 +119,27 @@ func (ms *MasterServer) findVolumeLocation(collection, vid string) operation.Loo
 	return ret
 }
 
+// topologyLocation describes one node holding vid. A node that answers for an
+// EC volume holds shards rather than a volume record, so an absent record means
+// the read is local, never that the node should be left out of the answer.
+func topologyLocation(dn *topology.DataNode, vid needle.VolumeId) operation.Location {
+	dataInRemote, readOnly, readOnlyCanDelete := false, false, false
+	if volInfo, lookupErr := dn.GetVolumesById(vid); lookupErr == nil {
+		dataInRemote = volInfo.IsRemote()
+		readOnly = volInfo.ReadOnly
+		readOnlyCanDelete = volInfo.ReadOnlyCanDelete
+	}
+	return operation.Location{
+		Url:               dn.Url(),
+		PublicUrl:         dn.PublicUrl,
+		DataCenter:        dn.GetDataCenterId(),
+		GrpcPort:          dn.GrpcPort,
+		DataInRemote:      dataInRemote,
+		ReadOnly:          readOnly,
+		ReadOnlyCanDelete: readOnlyCanDelete,
+	}
+}
+
 func (ms *MasterServer) dirAssignHandler(w http.ResponseWriter, r *http.Request) {
 	if ms.Topo.IsLeader() && ms.Topo.IsWarmingUp() {
 		remaining := ms.Topo.RemainingWarmupDuration()
@@ -171,6 +190,22 @@ func (ms *MasterServer) dirAssignHandler(w http.ResponseWriter, r *http.Request)
 		})
 		return
 	}
+	if !ms.Topo.RackExists(option.DataCenter, option.Rack) {
+		writeJsonQuiet(w, r, http.StatusBadRequest, operation.AssignResult{
+			Error: fmt.Sprintf("rack %v not found in topology", option.Rack),
+		})
+		return
+	}
+	if !ms.Topo.DataNodeExists(option.DataCenter, option.Rack, option.DataNode) {
+		writeJsonQuiet(w, r, http.StatusBadRequest, operation.AssignResult{
+			Error: fmt.Sprintf("data node %v not found in topology", option.DataNode),
+		})
+		return
+	}
+
+	// As in gRPC Assign: the periodic growth scan keeps this layout topped up
+	// to the writableVolumeCount clients ask for. 0 (not sent) is ignored.
+	vl.SetLastGrowCount(uint32(writableVolumeCount))
 
 	for time.Since(startTime) < maxTimeout {
 		fid, count, dnList, shouldGrow, err := ms.Topo.PickForWrite(requestedCount, option, vl, expectedDataSize)
diff --git a/weed/server/master_server_handlers_admin.go b/weed/server/master_server_handlers_admin.go
index 76e4ebc595..e6479ea49a 100644
--- a/weed/server/master_server_handlers_admin.go
+++ b/weed/server/master_server_handlers_admin.go
@@ -13,8 +13,6 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/operation"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend/memory_map"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
@@ -25,24 +23,18 @@ import (
 
 func (ms *MasterServer) collectionDeleteHandler(w http.ResponseWriter, r *http.Request) {
 	collectionName := r.FormValue("collection")
-	collection, ok := ms.Topo.FindCollection(collectionName)
-	if !ok {
+	if _, ok := ms.Topo.FindCollection(collectionName); !ok {
 		writeJsonError(w, r, http.StatusBadRequest, fmt.Errorf("collection %s does not exist", collectionName))
 		return
 	}
-	for _, server := range collection.ListVolumeServers() {
-		err := operation.WithVolumeServerClient(false, server.ServerAddress(), ms.grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
-			_, deleteErr := client.DeleteCollection(context.Background(), &volume_server_pb.DeleteCollectionRequest{
-				Collection: collection.Name,
-			})
-			return deleteErr
-		})
-		if err != nil {
-			writeJsonError(w, r, http.StatusInternalServerError, err)
-			return
-		}
+
+	// The same two passes the gRPC CollectionDelete runs, rather than a second
+	// copy of the volume-server walk: this handler deleted only the normal
+	// volumes and left the collection's EC shards behind.
+	if err := ms.deleteCollection(r.Context(), collectionName); err != nil {
+		writeJsonError(w, r, http.StatusInternalServerError, err)
+		return
 	}
-	ms.Topo.DeleteCollection(collectionName)
 
 	w.WriteHeader(http.StatusNoContent)
 	return
@@ -69,7 +61,7 @@ func (ms *MasterServer) volumeVacuumHandler(w http.ResponseWriter, r *http.Reque
 		}
 	}
 	// glog.Infoln("garbageThreshold =", gcThreshold)
-	ms.Topo.Vacuum(ms.grpcDialOption, gcThreshold, ms.option.MaxParallelVacuumPerServer, 0, "", ms.preallocateSize, false)
+	ms.Topo.Vacuum(ms.grpcDialOption, gcThreshold, ms.option.MaxParallelVacuumPerServer, ms.option.MaxParallelVacuumPerRack, 0, "", ms.preallocateSize, false, 0)
 	ms.dirStatusHandler(w, r)
 }
 
@@ -133,14 +125,15 @@ func (ms *MasterServer) redirectHandler(w http.ResponseWriter, r *http.Request)
 }
 
 func (ms *MasterServer) submitFromMasterServerHandler(w http.ResponseWriter, r *http.Request) {
+	fileSizeLimitBytes := int64(ms.option.FileSizeLimitMB) * 1024 * 1024
 	if ms.Topo.IsLeader() {
-		submitForClientHandler(w, r, func(ctx context.Context) pb.ServerAddress { return ms.option.Master }, ms.grpcDialOption)
+		submitForClientHandler(w, r, func(ctx context.Context) pb.ServerAddress { return ms.option.Master }, ms.grpcDialOption, fileSizeLimitBytes)
 	} else {
 		masterUrl, err := ms.Topo.Leader()
 		if err != nil {
 			writeJsonError(w, r, http.StatusInternalServerError, err)
 		} else {
-			submitForClientHandler(w, r, func(ctx context.Context) pb.ServerAddress { return masterUrl }, ms.grpcDialOption)
+			submitForClientHandler(w, r, func(ctx context.Context) pb.ServerAddress { return masterUrl }, ms.grpcDialOption, fileSizeLimitBytes)
 		}
 	}
 }
diff --git a/weed/server/master_server_handlers_assign_test.go b/weed/server/master_server_handlers_assign_test.go
new file mode 100644
index 0000000000..93b87e3379
--- /dev/null
+++ b/weed/server/master_server_handlers_assign_test.go
@@ -0,0 +1,209 @@
+package weed_server
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/sequence"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/topology"
+)
+
+const assignTestVolumeSizeLimit = 1 << 30
+
+// assignTestCluster is a leader master over one data center with one volume
+// server per rack, like a production cluster spreading "010" replicas.
+type assignTestCluster struct {
+	ms      *MasterServer
+	nodes   []*topology.DataNode
+	rp      *super_block.ReplicaPlacement
+	nextVid uint32
+}
+
+func newAssignTestCluster(t *testing.T, racks int, replication string) *assignTestCluster {
+	t.Helper()
+	rp, err := super_block.NewReplicaPlacementFromString(replication)
+	require.NoError(t, err)
+	c := &assignTestCluster{ms: newLeaderMaster(), rp: rp}
+	// Room for the per-assign size estimate, which would fill newLeaderMaster's
+	// tiny volumes on the first assign.
+	c.ms.Topo = topology.NewTopology("test", sequence.NewMemorySequencer(), assignTestVolumeSizeLimit, 5, false)
+	c.ms.Topo.RaftServer = leaderRaftServer{}
+	dc := c.ms.Topo.GetOrCreateDataCenter("dc1")
+	for i := 0; i < racks; i++ {
+		c.nodes = append(c.nodes, dc.GetOrCreateRack(fmt.Sprintf("rack%d", i)).
+			GetOrCreateDataNode("127.0.0.1", 8080+i, 18080+i, "127.0.0.1", fmt.Sprintf("dn%d", i), map[string]uint32{"": 1000}))
+	}
+	return c
+}
+
+// grow registers n new empty volumes, each with its copies on consecutive
+// racks, the way a finished volume grow lands in the topology.
+func (c *assignTestCluster) grow(collection string, n uint32) {
+	for i := uint32(0); i < n; i++ {
+		c.nextVid++
+		v := storage.VolumeInfo{
+			Id:               needle.VolumeId(c.nextVid),
+			Collection:       collection,
+			ReplicaPlacement: c.rp,
+			Ttl:              needle.EMPTY_TTL,
+			Version:          needle.GetCurrentVersion(),
+		}
+		for r := 0; r < c.rp.GetCopyCount(); r++ {
+			dn := c.nodes[(int(c.nextVid)+r)%len(c.nodes)]
+			dn.AddOrUpdateVolume(v)
+			c.ms.Topo.RegisterVolumeLayout(v, dn)
+		}
+	}
+}
+
+func (c *assignTestCluster) layout(collection string) *topology.VolumeLayout {
+	return c.ms.Topo.GetVolumeLayout(collection, c.rp, needle.EMPTY_TTL, "")
+}
+
+func (c *assignTestCluster) httpAssign(t *testing.T, query string) {
+	t.Helper()
+	w := httptest.NewRecorder()
+	c.ms.dirAssignHandler(w, httptest.NewRequest(http.MethodGet, "/dir/assign?"+query, nil))
+	require.Equal(t, http.StatusOK, w.Code, w.Body.String())
+}
+
+// A client's writableVolumeCount is what the periodic growth scan keeps a
+// layout topped up to. gRPC Assign has recorded it since the scan was added;
+// HTTP /dir/assign parsed it but dropped it, so HTTP-only writers never got
+// proactive growth. Both entry points must leave the layout in the same state.
+func TestDirAssignRecordsWritableVolumeCountLikeGrpcAssign(t *testing.T) {
+	tests := []struct {
+		name   string
+		counts []uint32 // writableVolumeCount per assign, 0 = not sent
+		want   uint32
+	}{
+		{name: "sent", counts: []uint32{30}, want: 30},
+		{name: "not sent", counts: []uint32{0}, want: 0},
+		{name: "later assign without it keeps the last value", counts: []uint32{30, 0}, want: 30},
+		{name: "latest value wins", counts: []uint32{30, 12}, want: 12},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			httpCluster := newAssignTestCluster(t, 1, "000")
+			httpCluster.grow("c", 1)
+			for _, n := range tt.counts {
+				query := "collection=c&replication=000"
+				if n > 0 {
+					query += fmt.Sprintf("&writableVolumeCount=%d", n)
+				}
+				httpCluster.httpAssign(t, query)
+			}
+
+			grpcCluster := newAssignTestCluster(t, 1, "000")
+			grpcCluster.grow("c", 1)
+			for _, n := range tt.counts {
+				_, err := grpcCluster.ms.Assign(context.Background(), &master_pb.AssignRequest{
+					Count: 1, Collection: "c", Replication: "000", WritableVolumeCount: n,
+				})
+				require.NoError(t, err)
+			}
+
+			assert.Equal(t, tt.want, grpcCluster.layout("c").GetLastGrowCount(), "gRPC Assign")
+			assert.Equal(t, tt.want, httpCluster.layout("c").GetLastGrowCount(), "HTTP /dir/assign")
+		})
+	}
+}
+
+// An assign naming a placement the topology cannot serve must fail before it
+// records a growth target: the periodic scan drops the requested placement, so
+// the volumes it would keep growing could never serve the requester.
+func TestDirAssignRejectsUnknownPlacementBeforeGrowCount(t *testing.T) {
+	c := newAssignTestCluster(t, 1, "000")
+	c.grow("c", 1)
+	vl := c.layout("c")
+
+	// A rack and data node that exist, but in a different data center: the
+	// requester named dc1, so these placements can never be served either.
+	c.ms.Topo.GetOrCreateDataCenter("dc2").GetOrCreateRack("rackX").
+		GetOrCreateDataNode("127.0.0.2", 8090, 18090, "127.0.0.2", "dnX", map[string]uint32{"": 1000})
+
+	for _, query := range []string{
+		"collection=c&replication=000&writableVolumeCount=30&rack=missing",
+		"collection=c&replication=000&writableVolumeCount=30&dataNode=missing",
+		"collection=c&replication=000&writableVolumeCount=30&dataCenter=dc1&rack=rackX",
+		"collection=c&replication=000&writableVolumeCount=30&dataCenter=dc1&dataNode=dnX",
+		"collection=c&replication=000&writableVolumeCount=30&dataCenter=dc1&rack=rack0&dataNode=dnX",
+	} {
+		w := httptest.NewRecorder()
+		c.ms.dirAssignHandler(w, httptest.NewRequest(http.MethodGet, "/dir/assign?"+query, nil))
+		assert.Equal(t, http.StatusBadRequest, w.Code, w.Body.String())
+	}
+	assert.Zero(t, vl.GetLastGrowCount())
+
+	for _, req := range []*master_pb.AssignRequest{
+		{Count: 1, Collection: "c", Replication: "000", WritableVolumeCount: 30, Rack: "missing"},
+		{Count: 1, Collection: "c", Replication: "000", WritableVolumeCount: 30, DataCenter: "dc1", Rack: "rackX"},
+		{Count: 1, Collection: "c", Replication: "000", WritableVolumeCount: 30, DataCenter: "dc1", Rack: "rack0", DataNode: "dnX"},
+	} {
+		_, err := c.ms.Assign(context.Background(), req)
+		assert.Error(t, err)
+	}
+	assert.Zero(t, vl.GetLastGrowCount())
+}
+
+// Replays the outage of an HTTP-only writer with writableVolumeCount=30 on a
+// "010" collection across 5 racks. Writes are spread by remaining capacity, so
+// the 30 volumes fill in lockstep. Before the fix the periodic scan only ever
+// saw lastGrowCount 0: it added the rack-aware step of 2 when everything was
+// crowded and nothing more while those 2 stayed uncrowded. When the old batch
+// went full, the 2 volumes took every write, filled before the next scan, and
+// assigns failed until an emergency grow landed.
+func TestPeriodicGrowthKeepsHTTPAssignLayoutWritable(t *testing.T) {
+	const n = 30
+	c := newAssignTestCluster(t, 5, "010")
+	c.grow("photo", n)
+	vl := c.layout("photo")
+	c.httpAssign(t, fmt.Sprintf("collection=photo&replication=010&writableVolumeCount=%d", n))
+
+	const limit = int64(assignTestVolumeSizeLimit)
+	batch := vl.CloneWritableVolumes()
+	writeTo := func(vids []needle.VolumeId, size int64) {
+		for _, vid := range vids {
+			vl.RecordAssign(vid, size)
+		}
+	}
+	// scan runs the per-layout steps of ProcessGrowRequest, with a grow that
+	// lands at once.
+	scan := func() {
+		writable, crowded := vl.GetWritableVolumeCount()
+		count, _ := periodicGrowCount(vl.GetLastGrowCount(), writable, crowded)
+		c.grow("photo", count)
+		for _, plan := range vl.PlanRackAwareGrowth(c.ms.Topo.ListDCAndRacks(), vl.GetLastGrowCount(), volumeGrowStepCount) {
+			c.grow("photo", plan.WritableVolumeCount)
+		}
+		writable, _ = vl.GetWritableVolumeCount()
+		require.LessOrEqual(t, writable, 2*n, "growth must stay bounded by twice the requested writable count")
+	}
+
+	// The batch crosses the crowded threshold together, and stays crowded
+	// over two scans.
+	writeTo(batch, limit*95/100)
+	_, crowded := vl.GetWritableVolumeCount()
+	require.Equal(t, n, crowded)
+	scan()
+	scan()
+
+	// The batch goes full; whatever the scans added is all that is left.
+	writeTo(batch, limit)
+	scan()
+
+	writable, crowded := vl.GetWritableVolumeCount()
+	assert.Zero(t, crowded)
+	assert.GreaterOrEqual(t, writable, n,
+		"after the batch went full the scan must restore the %d writable volumes the client asked for, not leave %d to take every write", n, writable)
+}
diff --git a/weed/server/master_server_handlers_lookup_test.go b/weed/server/master_server_handlers_lookup_test.go
new file mode 100644
index 0000000000..438830f838
--- /dev/null
+++ b/weed/server/master_server_handlers_lookup_test.go
@@ -0,0 +1,59 @@
+package weed_server
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// The nodes answering for an EC volume hold shards, not a volume record, so
+// asking them for one fails. Dropping them would empty the lookup and turn
+// every EC read through the master into a 404.
+func TestEcVolumeLocationsSurviveTheLookup(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeEcShards([]*master_pb.VolumeEcShardInformationMessage{
+		{Id: 7, Collection: "c", EcIndexBits: 0x3fff},
+	}, dn)
+
+	machines := topo.Lookup("c", needle.VolumeId(7))
+	if len(machines) == 0 {
+		t.Fatalf("topology lost the EC volume")
+	}
+	for _, node := range machines {
+		loc := topologyLocation(node, needle.VolumeId(7))
+		if loc.Url == "" {
+			t.Errorf("EC location came back empty: %+v", loc)
+		}
+		if loc.DataInRemote {
+			t.Errorf("an EC shard holder was reported as remote-tier: %+v", loc)
+		}
+	}
+}
+
+// A volume the node really does hold keeps its tier classification.
+func TestVolumeLocationCarriesTheRemoteTier(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		changedTestVolume(1, 1024),
+		changedTierVolume(2, 1024, "s3-bucket"),
+	}, dn)
+
+	if loc := topologyLocation(dn, needle.VolumeId(1)); loc.DataInRemote {
+		t.Errorf("a local volume was reported as remote-tier: %+v", loc)
+	}
+	if loc := topologyLocation(dn, needle.VolumeId(2)); !loc.DataInRemote {
+		t.Errorf("a tiered volume was reported as local: %+v", loc)
+	}
+}
+
+func TestVolumeLocationCarriesReadOnly(t *testing.T) {
+	topo, dn := changedTestCluster(t)
+	v := changedTestVolume(1, 1024)
+	v.ReadOnly = true
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{v}, dn)
+
+	if !topologyLocation(dn, needle.VolumeId(1)).ReadOnly {
+		t.Fatal("a read-only volume was reported as writable")
+	}
+}
diff --git a/weed/server/master_server_reservation_timeout_test.go b/weed/server/master_server_reservation_timeout_test.go
new file mode 100644
index 0000000000..ca9aecc820
--- /dev/null
+++ b/weed/server/master_server_reservation_timeout_test.go
@@ -0,0 +1,85 @@
+package weed_server
+
+import (
+	"testing"
+	"time"
+
+	"github.com/spf13/viper"
+
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestParseReservationTimeout(t *testing.T) {
+	tests := []struct {
+		name     string
+		setup    func(v *util.ViperProxy)
+		expected time.Duration
+	}{
+		{
+			name:     "unset defaults to 5 minutes",
+			setup:    func(v *util.ViperProxy) {},
+			expected: 5 * time.Minute,
+		},
+		{
+			name: "duration string 10m",
+			setup: func(v *util.ViperProxy) {
+				v.Set("master.volume_growth.reservation_timeout", "10m")
+			},
+			expected: 10 * time.Minute,
+		},
+		{
+			name: "duration string 30s",
+			setup: func(v *util.ViperProxy) {
+				v.Set("master.volume_growth.reservation_timeout", "30s")
+			},
+			expected: 30 * time.Second,
+		},
+		{
+			name: "integer seconds 300",
+			setup: func(v *util.ViperProxy) {
+				v.Set("master.volume_growth.reservation_timeout", 300)
+			},
+			expected: 300 * time.Second,
+		},
+		{
+			name: "large integer stays seconds not nanoseconds",
+			setup: func(v *util.ViperProxy) {
+				v.Set("master.volume_growth.reservation_timeout", 1000000000)
+			},
+			expected: 1000000000 * time.Second,
+		},
+		{
+			name: "non-positive zero defaults to 5 minutes",
+			setup: func(v *util.ViperProxy) {
+				v.Set("master.volume_growth.reservation_timeout", 0)
+			},
+			expected: 5 * time.Minute,
+		},
+		{
+			name: "negative seconds defaults to 5 minutes",
+			setup: func(v *util.ViperProxy) {
+				v.Set("master.volume_growth.reservation_timeout", -10)
+			},
+			expected: 5 * time.Minute,
+		},
+		{
+			name: "invalid string defaults to 5 minutes",
+			setup: func(v *util.ViperProxy) {
+				v.Set("master.volume_growth.reservation_timeout", "invalid")
+			},
+			expected: 5 * time.Minute,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rawViper := viper.New()
+			vp := util.NewViperProxy(rawViper)
+			tt.setup(vp)
+			actual := parseReservationTimeout(vp)
+			if actual != tt.expected {
+				t.Errorf("expected %v, got %v", tt.expected, actual)
+			}
+		})
+	}
+}
diff --git a/weed/server/raft_common.go b/weed/server/raft_common.go
index 9a87a9952b..2d13124698 100644
--- a/weed/server/raft_common.go
+++ b/weed/server/raft_common.go
@@ -30,9 +30,15 @@ func recoverTopologyIdFromState(fsmState []byte, topo *topology.Topology) {
 // It uses the provided checkLeaderFn to verify leadership and persistFn to save the new ID.
 func EnsureTopologyId(topo *topology.Topology, checkLeaderFn func() bool, persistFn func(string) error) {
 	if topo.GetTopologyId() != "" {
+		// The id arrived through raft replay or the mirror file; reports
+		// stashed while it was unknown can now be checked.
+		topo.SetTopologyInitPending(false)
 		return
 	}
 
+	topo.SetTopologyInitPending(true)
+	defer topo.SetTopologyInitPending(false)
+
 	topologyId := uuid.New().String()
 	for {
 		if !checkLeaderFn() {
@@ -59,6 +65,7 @@ func EnsureTopologyId(topo *topology.Topology, checkLeaderFn func() bool, persis
 		} else {
 			glog.V(0).Infof("TopologyId generated: %s", topologyId)
 		}
+		topo.DeferAllocation(topo.WarmupDuration())
 		break
 	}
 }
diff --git a/weed/server/raft_hashicorp.go b/weed/server/raft_hashicorp.go
index 575478aeca..9d1d601920 100644
--- a/weed/server/raft_hashicorp.go
+++ b/weed/server/raft_hashicorp.go
@@ -6,12 +6,10 @@ package weed_server
 import (
 	"encoding/json"
 	"fmt"
-	"io"
 	"math/rand/v2"
 	"os"
 	"path"
 	"path/filepath"
-	"sort"
 	"time"
 
 	transport "github.com/Jille/raft-grpc-transport"
@@ -33,52 +31,10 @@ const (
 	updatePeersTimeout = 15 * time.Minute
 )
 
-func getPeerIdx(self pb.ServerAddress, mapPeers map[string]pb.ServerAddress) int {
-	peerIDs := make([]string, 0, len(mapPeers))
-	seen := make(map[string]struct{}, len(mapPeers))
-	for _, peer := range mapPeers {
-		id := raftServerID(peer)
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		peerIDs = append(peerIDs, id)
-	}
-	sort.Strings(peerIDs)
-	selfID := raftServerID(self)
-	idx := sort.SearchStrings(peerIDs, selfID)
-	if idx < len(peerIDs) && peerIDs[idx] == selfID {
-		return idx
-	}
-	return -1
-}
-
 func raftServerID(server pb.ServerAddress) string {
 	return server.ToHttpAddress()
 }
 
-// recoverTopologyIdFromHashicorpSnapshot reads the TopologyId from the latest
-// hashicorp raft snapshot before state cleanup.
-func recoverTopologyIdFromHashicorpSnapshot(dataDir string, topo *topology.Topology) {
-	fss, err := raft.NewFileSnapshotStore(dataDir, 1, io.Discard)
-	if err != nil {
-		return
-	}
-	snapshots, err := fss.List()
-	if err != nil || len(snapshots) == 0 {
-		return
-	}
-	_, rc, err := fss.Open(snapshots[0].ID)
-	if err != nil {
-		return
-	}
-	defer rc.Close()
-
-	if b, err := io.ReadAll(rc); err == nil {
-		recoverTopologyIdFromState(b, topo)
-	}
-}
-
 func (s *RaftServer) AddPeersConfiguration() (cfg raft.Configuration) {
 	for _, peer := range s.peers {
 		cfg.Servers = append(cfg.Servers, raft.Server{
@@ -190,16 +146,10 @@ func NewHashicorpRaftServer(option *RaftServerOption) (*RaftServer, error) {
 		return nil, fmt.Errorf("raft.ValidateConfig: %w", err)
 	}
 
-	if option.RaftBootstrap {
-		recoverTopologyIdFromHashicorpSnapshot(s.dataDir, option.Topo)
-
-		os.RemoveAll(path.Join(s.dataDir, ldbFile))
-		os.RemoveAll(path.Join(s.dataDir, sdbFile))
-		os.RemoveAll(path.Join(s.dataDir, "snapshots"))
-	}
 	if err := os.MkdirAll(path.Join(s.dataDir, "snapshots"), os.ModePerm); err != nil {
 		return nil, err
 	}
+	option.Topo.SetMaxVolumeIdFile(filepath.Join(s.dataDir, "max_volume_id"))
 	baseDir := s.dataDir
 
 	ldb, err := boltdb.NewBoltStore(filepath.Join(baseDir, ldbFile))
@@ -225,21 +175,10 @@ func NewHashicorpRaftServer(option *RaftServerOption) (*RaftServer, error) {
 		return nil, fmt.Errorf("raft.NewRaft: %w", err)
 	}
 
-	updatePeers := false
-	if option.RaftBootstrap || len(s.RaftHashicorp.GetConfiguration().Configuration().Servers) == 0 {
-		cfg := s.AddPeersConfiguration()
-		// Need to get lock, in case all servers do this at the same time.
-		peerIdx := getPeerIdx(s.serverAddr, s.peers)
-		timeSleep := time.Duration(float64(c.LeaderLeaseTimeout) * (rand.Float64()*0.25 + 1) * float64(peerIdx))
-		glog.V(0).Infof("Bootstrapping idx: %d sleep: %v new cluster: %+v", peerIdx, timeSleep, cfg)
-		time.Sleep(timeSleep)
-		f := s.RaftHashicorp.BootstrapCluster(cfg)
-		if err := f.Error(); err != nil {
-			return nil, fmt.Errorf("raft.Raft.BootstrapCluster: %w", err)
-		}
-	} else {
-		updatePeers = true
-	}
+	// The caller bootstraps, once it has confirmed no peer already has a
+	// leader: bootstrapping next to a live leader forms a second cluster
+	// instead of joining the first one.
+	updatePeers := len(s.RaftHashicorp.GetConfiguration().Configuration().Servers) > 0
 
 	go s.monitorLeaderLoop(updatePeers)
 
diff --git a/weed/server/raft_hashicorp_test.go b/weed/server/raft_hashicorp_test.go
index e9261e3ac6..a33c93f3ed 100644
--- a/weed/server/raft_hashicorp_test.go
+++ b/weed/server/raft_hashicorp_test.go
@@ -35,19 +35,6 @@ func TestRaftServerID(t *testing.T) {
 	}
 }
 
-func TestGetPeerIdxUsesCanonicalID(t *testing.T) {
-	peers := map[string]pb.ServerAddress{
-		"master-0:9333": pb.ServerAddress("master-0:9333"),
-		"master-1:9333": pb.ServerAddress("master-1:9333"),
-		"master-2:9333": pb.ServerAddress("master-2:9333"),
-	}
-	self := pb.NewServerAddress("master-2", 9333, 19333)
-
-	if got := getPeerIdx(self, peers); got != 2 {
-		t.Fatalf("getPeerIdx(%q) = %d, want 2", self, got)
-	}
-}
-
 func TestAddPeersConfigurationUsesCanonicalIDs(t *testing.T) {
 	rs := &RaftServer{
 		peers: map[string]pb.ServerAddress{
diff --git a/weed/server/raft_server.go b/weed/server/raft_server.go
index c98d43250b..f274a821d2 100644
--- a/weed/server/raft_server.go
+++ b/weed/server/raft_server.go
@@ -35,7 +35,6 @@ type RaftServerOption struct {
 	SingleMaster      bool
 	HeartbeatInterval time.Duration
 	ElectionTimeout   time.Duration
-	RaftBootstrap     bool
 }
 
 type RaftServer struct {
@@ -61,6 +60,10 @@ func (s StateMachine) Save() ([]byte, error) {
 		MaxVolumeId: s.topo.GetMaxVolumeId(),
 		TopologyId:  s.topo.GetTopologyId(),
 	}
+	if s.topo.IsGrowthFrozen() {
+		state.GrowthFrozen = new(bool)
+		*state.GrowthFrozen = true
+	}
 	glog.V(1).Infof("Save raft state %+v", state)
 	return json.Marshal(state)
 }
@@ -77,6 +80,12 @@ func (s StateMachine) Recovery(data []byte) error {
 		s.topo.SetTopologyId(state.TopologyId)
 		glog.V(0).Infof("Recovered TopologyId: %s", state.TopologyId)
 	}
+	if state.GrowthFrozen != nil {
+		s.topo.SetGrowthFrozen(*state.GrowthFrozen)
+	}
+	if err := s.topo.PersistMaxVolumeId(state.MaxVolumeId); err != nil {
+		glog.Warningf("persist max volume id %d: %v", state.MaxVolumeId, err)
+	}
 	return nil
 }
 
@@ -96,16 +105,25 @@ func (s *StateMachine) Apply(l *hashicorpRaft.Log) interface{} {
 			glog.V(0).Infof("Set TopologyId from raft log: %s", state.TopologyId)
 		}
 	}
+	if state.GrowthFrozen != nil {
+		s.topo.SetGrowthFrozen(*state.GrowthFrozen)
+	}
+	if err := s.topo.PersistMaxVolumeId(state.MaxVolumeId); err != nil {
+		glog.Warningf("persist max volume id %d: %v", state.MaxVolumeId, err)
+	}
 
 	glog.V(1).Infoln("max volume id", before, "==>", s.topo.GetMaxVolumeId())
 	return nil
 }
 
 func (s *StateMachine) Snapshot() (hashicorpRaft.FSMSnapshot, error) {
-	return &topology.MaxVolumeIdCommand{
-		MaxVolumeId: s.topo.GetMaxVolumeId(),
-		TopologyId:  s.topo.GetTopologyId(),
-	}, nil
+	frozen := s.topo.IsGrowthFrozen()
+	state := &topology.MaxVolumeIdCommand{
+		MaxVolumeId:  s.topo.GetMaxVolumeId(),
+		TopologyId:   s.topo.GetTopologyId(),
+		GrowthFrozen: &frozen,
+	}
+	return state, nil
 }
 
 func (s *StateMachine) Restore(r io.ReadCloser) error {
@@ -164,6 +182,7 @@ func NewRaftServer(option *RaftServerOption) (*RaftServer, error) {
 	if err := os.MkdirAll(path.Join(s.dataDir, "snapshot"), os.ModePerm); err != nil {
 		return nil, err
 	}
+	option.Topo.SetMaxVolumeIdFile(path.Join(s.dataDir, "max_volume_id"))
 
 	stateMachine := StateMachine{topo: option.Topo}
 	s.raftServer, err = raft.NewServer(string(s.serverAddr), s.dataDir, transporter, stateMachine, option.Topo, s.serverAddr.ToGrpcAddress())
@@ -303,15 +322,23 @@ func (s *RaftServer) HasExistingState() bool {
 	return false
 }
 
-func (s *RaftServer) DoJoinCommand() {
-
+// Bootstrap mints a new raft cluster out of the configured peers. Only call it
+// when no leader exists anywhere: a master that starts with no raft state and
+// finds a leader must be admitted by that leader instead, or the two clusters
+// never merge. Committed state is never bootstrapped over — hashicorp refuses,
+// and goraft callers reach here only past HasExistingState.
+func (s *RaftServer) Bootstrap() error {
 	glog.V(0).Infoln("Initializing new cluster")
 
-	if _, err := s.raftServer.Do(&raft.DefaultJoinCommand{
+	if s.RaftHashicorp != nil {
+		return s.RaftHashicorp.BootstrapCluster(s.AddPeersConfiguration()).Error()
+	}
+	if s.raftServer == nil {
+		return nil
+	}
+	_, err := s.raftServer.Do(&raft.DefaultJoinCommand{
 		Name:             s.raftServer.Name(),
 		ConnectionString: s.serverAddr.ToGrpcAddress(),
-	}); err != nil {
-		glog.Errorf("fail to send join command: %v", err)
-	}
-
+	})
+	return err
 }
diff --git a/weed/server/raft_server_handlers.go b/weed/server/raft_server_handlers.go
index 0ce7e632b8..40eae45ca2 100644
--- a/weed/server/raft_server_handlers.go
+++ b/weed/server/raft_server_handlers.go
@@ -24,15 +24,18 @@ func (s *RaftServer) StatusHandler(w http.ResponseWriter, r *http.Request) {
 		MaxVolumeId: s.topo.GetMaxVolumeId(),
 	}
 
-	if leader, e := s.topo.Leader(); e == nil {
+	// Report the leader raft knows right now. Waiting for one to be elected
+	// holds the response past every health probe's timeout, which is exactly
+	// when a master is most likely to still be joining.
+	if leader, e := s.topo.MaybeLeader(); e == nil {
 		ret.Leader = leader
 	}
 	writeJsonQuiet(w, r, http.StatusOK, ret)
 }
 
 func (s *RaftServer) HealthzHandler(w http.ResponseWriter, r *http.Request) {
-	leader, err := s.topo.Leader()
-	if err != nil {
+	leader, err := s.topo.MaybeLeader()
+	if err != nil || leader == "" {
 		w.WriteHeader(http.StatusServiceUnavailable)
 		return
 	}
diff --git a/weed/server/volume_grpc_admin.go b/weed/server/volume_grpc_admin.go
index 31b43cd2c1..d4d96c4124 100644
--- a/weed/server/volume_grpc_admin.go
+++ b/weed/server/volume_grpc_admin.go
@@ -2,6 +2,7 @@ package weed_server
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"path/filepath"
@@ -23,9 +24,11 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
 )
 
 // checkGrpcAdminAuth verifies the gRPC caller is authorized for destructive
@@ -79,9 +82,9 @@ func (vs *VolumeServer) DeleteCollection(ctx context.Context, req *volume_server
 
 	if err != nil {
 		glog.Errorf("delete collection %s: %v", req.Collection, err)
-	} else {
-		glog.V(2).Infof("delete collection %v", req)
+		return resp, volumeStatusError(fmt.Errorf("delete collection %s: %w", req.Collection, err))
 	}
+	glog.V(2).Infof("delete collection %v", req)
 
 	return resp, err
 
@@ -129,7 +132,7 @@ func (vs *VolumeServer) VolumeMount(ctx context.Context, req *volume_server_pb.V
 		return resp, err
 	}
 
-	err := vs.store.MountVolume(needle.VolumeId(req.VolumeId))
+	err := vs.store.MountVolume(needle.VolumeId(req.VolumeId), req.Collection)
 
 	if err != nil {
 		glog.Errorf("volume mount %v: %v", req, err)
@@ -185,6 +188,9 @@ func (vs *VolumeServer) VolumeConsolidateIndex(ctx context.Context, req *volume_
 
 }
 
+// VolumeDelete is allowed in maintenance mode: it removes data from the server
+// rather than adding any, and evacuating a server in maintenance mode ends each
+// move by deleting the source copy (issue #11066).
 func (vs *VolumeServer) VolumeDelete(ctx context.Context, req *volume_server_pb.VolumeDeleteRequest) (*volume_server_pb.VolumeDeleteResponse, error) {
 	resp := &volume_server_pb.VolumeDeleteResponse{}
 
@@ -192,14 +198,11 @@ func (vs *VolumeServer) VolumeDelete(ctx context.Context, req *volume_server_pb.
 		return resp, err
 	}
 
-	if err := vs.CheckMaintenanceMode(); err != nil {
-		return resp, err
-	}
-
-	err := vs.store.DeleteVolume(needle.VolumeId(req.VolumeId), req.OnlyEmpty, req.KeepRemoteData)
+	err := vs.store.DeleteVolume(needle.VolumeId(req.VolumeId), req.OnlyEmpty, req.OnlyGarbage, req.KeepRemoteData)
 
 	if err != nil {
 		glog.Errorf("volume delete %v: %v", req, err)
+		return resp, volumeStatusError(err)
 	} else {
 		// V(0) so destructive RPCs are always traceable.
 		glog.Infof("volume delete %v", req)
@@ -209,6 +212,22 @@ func (vs *VolumeServer) VolumeDelete(ctx context.Context, req *volume_server_pb.
 
 }
 
+// volumeStatusError keeps the store's message so callers matching on
+// "not found" or "volume not empty" keep working, and adds the status code so
+// new callers do not have to.
+func volumeStatusError(err error) error {
+	if errors.Is(err, storage.ErrVolumeNotFound) {
+		return status.Error(codes.NotFound, err.Error())
+	}
+	if errors.Is(err, storage.ErrVolumeNotEmpty) {
+		return status.Error(codes.FailedPrecondition, err.Error())
+	}
+	if errors.Is(err, storage.ErrInsufficientSpace) {
+		return status.Error(codes.ResourceExhausted, err.Error())
+	}
+	return err
+}
+
 func (vs *VolumeServer) VolumeConfigure(ctx context.Context, req *volume_server_pb.VolumeConfigureRequest) (*volume_server_pb.VolumeConfigureResponse, error) {
 	resp := &volume_server_pb.VolumeConfigureResponse{}
 
@@ -238,7 +257,7 @@ func (vs *VolumeServer) VolumeConfigure(ctx context.Context, req *volume_server_
 		glog.Errorf("volume configure %v: %v", req, err)
 		resp.Error = fmt.Sprintf("volume configure %v: %v", req, err)
 		// Try to re-mount to restore the volume state
-		if mountErr := vs.store.MountVolume(needle.VolumeId(req.VolumeId)); mountErr != nil {
+		if mountErr := vs.store.MountVolume(needle.VolumeId(req.VolumeId), nil); mountErr != nil {
 			glog.Errorf("volume configure failed to restore mount %v: %v", req, mountErr)
 			resp.Error += fmt.Sprintf(". Also failed to restore mount: %v", mountErr)
 		}
@@ -246,7 +265,7 @@ func (vs *VolumeServer) VolumeConfigure(ctx context.Context, req *volume_server_
 	}
 
 	// mount
-	if err := vs.store.MountVolume(needle.VolumeId(req.VolumeId)); err != nil {
+	if err := vs.store.MountVolume(needle.VolumeId(req.VolumeId), nil); err != nil {
 		glog.Errorf("volume configure mount %v: %v", req, err)
 		resp.Error = fmt.Sprintf("volume configure mount %v: %v", req, err)
 		return resp, nil
@@ -256,11 +275,10 @@ func (vs *VolumeServer) VolumeConfigure(ctx context.Context, req *volume_server_
 
 }
 
-func (vs *VolumeServer) makeVolumeReadonly(ctx context.Context, v *storage.Volume, persist bool) error {
-	if err := vs.CheckMaintenanceMode(); err != nil {
-		return err
-	}
-
+// makeVolumeReadonly is not gated on maintenance mode: marking a volume readonly
+// only restricts a server that is already meant to be read-only, and it is the
+// first step of moving a volume off a server under evacuation (issue #11066).
+func (vs *VolumeServer) makeVolumeReadonly(ctx context.Context, v *storage.Volume, canDelete bool, persist bool) error {
 	// step 1: stop master from redirecting traffic here
 	if err := vs.notifyMasterVolumeReadonly(ctx, v, true); err != nil {
 		return err
@@ -269,9 +287,18 @@ func (vs *VolumeServer) makeVolumeReadonly(ctx context.Context, v *storage.Volum
 	// rare case 1.5: it will be unlucky if heartbeat happened between step 1 and 2.
 
 	// step 2: mark local volume as readonly
-	if err := vs.store.MarkVolumeReadonly(v.Id, persist); err != nil {
-		glog.Errorf("mark volume %d readonly: %v", v.Id, err)
-		return err
+	var persistErr error
+	if err := vs.store.MarkVolumeReadonly(v.Id, canDelete, persist); err != nil {
+		var ndErr *volume_info.NotCrashDurableError
+		if !errors.As(err, &ndErr) {
+			glog.Errorf("mark volume %d readonly: %v", v.Id, err)
+			return err
+		}
+		// Post-rename durability failure: the .vif already holds the new
+		// mode. Continue with step 3 so the master reflects the change,
+		// then propagate the durability warning.
+		glog.Warningf("mark volume %d readonly: %v", v.Id, err)
+		persistErr = err
 	} else {
 		glog.V(2).Infof("volume %d marked readonly", v.Id)
 	}
@@ -281,7 +308,7 @@ func (vs *VolumeServer) makeVolumeReadonly(ctx context.Context, v *storage.Volum
 		return err
 	}
 
-	return nil
+	return persistErr
 }
 
 func (vs *VolumeServer) makeVolumeWritable(ctx context.Context, v *storage.Volume) error {
@@ -289,9 +316,18 @@ func (vs *VolumeServer) makeVolumeWritable(ctx context.Context, v *storage.Volum
 		return err
 	}
 
+	var persistErr error
 	if err := vs.store.MarkVolumeWritable(v.Id); err != nil {
-		glog.Errorf("mark volume %d writable: %v", v.Id, err)
-		return err
+		var ndErr *volume_info.NotCrashDurableError
+		if !errors.As(err, &ndErr) {
+			glog.Errorf("mark volume %d writable: %v", v.Id, err)
+			return err
+		}
+		// Post-rename durability failure: the .vif already holds the new
+		// mode. Continue notifying the master so traffic is redirected,
+		// then propagate the durability warning.
+		glog.Warningf("mark volume %d writable: %v", v.Id, err)
+		persistErr = err
 	} else {
 		glog.V(2).Infof("volume %d marked writable", v.Id)
 	}
@@ -301,7 +337,7 @@ func (vs *VolumeServer) makeVolumeWritable(ctx context.Context, v *storage.Volum
 		return err
 	}
 
-	return nil
+	return persistErr
 }
 
 func isNotLeaderErr(err error) bool {
@@ -357,7 +393,7 @@ func (vs *VolumeServer) VolumeMarkReadonly(ctx context.Context, req *volume_serv
 		return resp, fmt.Errorf("volume %d not found", req.VolumeId)
 	}
 
-	if err := vs.makeVolumeReadonly(ctx, v, req.GetPersist()); err != nil {
+	if err := vs.makeVolumeReadonly(ctx, v, req.GetCanDelete(), req.GetPersist()); err != nil {
 		return resp, err
 	}
 
@@ -465,10 +501,13 @@ func (vs *VolumeServer) VolumeNeedleStatus(ctx context.Context, req *volume_serv
 		count, err = vs.store.ReadVolumeNeedle(volumeId, n, nil, nil)
 	}
 	if err != nil {
+		if errors.Is(err, storage.ErrorNotFound) || errors.Is(err, erasure_coding.NotFoundError) {
+			return nil, status.Errorf(codes.NotFound, "needle not found %d", n.Id)
+		}
 		return nil, err
 	}
 	if count < 0 {
-		return nil, fmt.Errorf("needle not found %d", n.Id)
+		return nil, status.Errorf(codes.NotFound, "needle not found %d", n.Id)
 	}
 
 	resp.NeedleId = uint64(n.Id)
diff --git a/weed/server/volume_grpc_admin_delete_test.go b/weed/server/volume_grpc_admin_delete_test.go
new file mode 100644
index 0000000000..72c35fdb6f
--- /dev/null
+++ b/weed/server/volume_grpc_admin_delete_test.go
@@ -0,0 +1,41 @@
+package weed_server
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestVolumeStatusErrorDistinguishesAbsentFromTransportFailure(t *testing.T) {
+	notFound := volumeStatusError(fmt.Errorf("delete volume 17 not found on disk: %w", storage.ErrVolumeNotFound))
+	assert.Equal(t, codes.NotFound, status.Code(notFound))
+	assert.Contains(t, notFound.Error(), "not found", "the store message must survive for callers that match on it")
+
+	transport := errors.New("connection reset")
+	require.ErrorIs(t, volumeStatusError(transport), transport)
+	assert.NotEqual(t, codes.NotFound, status.Code(transport))
+
+	notEmpty := volumeStatusError(storage.ErrVolumeNotEmpty)
+	assert.Equal(t, codes.FailedPrecondition, status.Code(notEmpty))
+	assert.Contains(t, notEmpty.Error(), "volume not empty")
+
+	noSpace := volumeStatusError(fmt.Errorf("compact volume 17: %w", storage.ErrInsufficientSpace))
+	assert.Equal(t, codes.ResourceExhausted, status.Code(noSpace))
+	assert.Contains(t, noSpace.Error(), "insufficient free space")
+}
+
+func TestVolumeDeleteMapsAbsentStoreVolumeToNotFound(t *testing.T) {
+	vs := &VolumeServer{store: newTraversalTestStore(t.TempDir())}
+
+	_, err := vs.VolumeDelete(context.Background(), &volume_server_pb.VolumeDeleteRequest{VolumeId: 17})
+	assert.Equal(t, codes.NotFound, status.Code(err), err)
+}
diff --git a/weed/server/volume_grpc_batch_delete.go b/weed/server/volume_grpc_batch_delete.go
index 72d8402eff..06a2eeb3ea 100644
--- a/weed/server/volume_grpc_batch_delete.go
+++ b/weed/server/volume_grpc_batch_delete.go
@@ -2,11 +2,13 @@ package weed_server
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 )
 
@@ -58,7 +60,7 @@ func (vs *VolumeServer) BatchDelete(ctx context.Context, req *volume_server_pb.B
 		if !req.SkipCookieCheck {
 			cookie := n.Cookie
 			if !isEcVolume {
-				if _, err := vs.store.ReadVolumeNeedle(volumeId, n, nil, nil); err != nil {
+				if _, err := vs.store.ReadVolumeNeedle(volumeId, n, deleteReadOption(), nil); err != nil {
 					resp.Results = append(resp.Results, &volume_server_pb.DeleteResult{
 						FileId: fid,
 						Status: http.StatusNotFound,
@@ -116,7 +118,15 @@ func (vs *VolumeServer) BatchDelete(ctx context.Context, req *volume_server_pb.B
 				)
 			}
 		} else {
-			if size, err := vs.store.DeleteEcShardNeedle(ecVolume, n, n.Cookie); err != nil {
+			size, err := vs.store.DeleteEcShardNeedle(ecVolume, n, n.Cookie)
+			if errors.Is(err, storage.ErrorDeleted) {
+				// Already gone, which is what the caller asked for. The
+				// non-EC branch above reports that as StatusNotModified.
+				resp.Results = append(resp.Results, &volume_server_pb.DeleteResult{
+					FileId: fid,
+					Status: http.StatusNotModified},
+				)
+			} else if err != nil {
 				resp.Results = append(resp.Results, &volume_server_pb.DeleteResult{
 					FileId: fid,
 					Status: http.StatusInternalServerError,
diff --git a/weed/server/volume_grpc_batch_delete_ec_test.go b/weed/server/volume_grpc_batch_delete_ec_test.go
new file mode 100644
index 0000000000..cf20709d55
--- /dev/null
+++ b/weed/server/volume_grpc_batch_delete_ec_test.go
@@ -0,0 +1,132 @@
+package weed_server
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"google.golang.org/grpc/peer"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// ecVolumeWithDeletedNeedle mounts an EC volume holding one needle that has
+// already been deleted. A runtime EC delete is recorded in the .ecj journal
+// rather than by rewriting the sealed .ecx, and the load reads .ecj back into
+// the in-memory deleted set, so locating the needle is enough to see it is
+// gone -- no shard payload is needed.
+func ecVolumeWithDeletedNeedle(t *testing.T, vid needle.VolumeId, id types.NeedleId) *storage.Store {
+	t.Helper()
+	dir := t.TempDir()
+	base := filepath.Join(dir, vid.String())
+
+	entry := make([]byte, types.NeedleIdSize+types.OffsetSize+types.SizeSize)
+	types.NeedleIdToBytes(entry[0:types.NeedleIdSize], id)
+	types.OffsetToBytes(entry[types.NeedleIdSize:types.NeedleIdSize+types.OffsetSize], types.Offset{})
+	types.SizeToBytes(entry[types.NeedleIdSize+types.OffsetSize:], types.Size(100))
+
+	journal := make([]byte, types.NeedleIdSize)
+	types.NeedleIdToBytes(journal, id)
+
+	for name, content := range map[string][]byte{
+		base + ".ecx":  entry,
+		base + ".ecj":  journal,
+		base + ".ec00": make([]byte, 8),
+		base + ".vif":  {},
+	} {
+		if err := os.WriteFile(name, content, 0o644); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+
+	location := storage.NewDiskLocation(dir, 100, util.MinFreeSpace{}, dir, types.HardDriveType, nil, stats.DiskIOProbeConfig{})
+	// Close stops the location's disk-space goroutine and releases the mounted
+	// EC volume's file handles. Registered before the mount so it also covers a
+	// failure there.
+	t.Cleanup(location.Close)
+	if _, err := location.LoadEcShard("", vid, erasure_coding.ShardId(0)); err != nil {
+		t.Fatalf("load ec shard: %v", err)
+	}
+
+	state, err := storage.NewState(dir)
+	if err != nil {
+		t.Fatalf("new store state: %v", err)
+	}
+	return &storage.Store{Locations: []*storage.DiskLocation{location}, State: state}
+}
+
+// Deleting a needle that is already gone is not a failure. The non-EC branch
+// has always answered StatusNotModified; the EC branch used to answer 500,
+// so a duplicate or replayed delete was booked as a server error.
+func TestBatchDelete_AlreadyDeletedEcNeedleIsNotAnError(t *testing.T) {
+	const vid = needle.VolumeId(7)
+	const needleId = types.NeedleId(1)
+
+	vs := &VolumeServer{
+		store: ecVolumeWithDeletedNeedle(t, vid, needleId),
+		guard: security.NewGuard(nil, "", 0, "", 0),
+	}
+
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		Addr: &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 12345},
+	})
+
+	resp, err := vs.BatchDelete(ctx, &volume_server_pb.BatchDeleteRequest{
+		FileIds:         []string{"7,0100000000"},
+		SkipCookieCheck: true,
+	})
+	if err != nil {
+		t.Fatalf("BatchDelete: %v", err)
+	}
+	if len(resp.Results) != 1 {
+		t.Fatalf("got %d results, want 1: %+v", len(resp.Results), resp.Results)
+	}
+
+	got := resp.Results[0]
+	if got.Status != http.StatusNotModified {
+		t.Fatalf("status = %d (error %q), want %d — an already-deleted needle is not a server error",
+			got.Status, got.Error, http.StatusNotModified)
+	}
+	if got.Error != "" {
+		t.Fatalf("error = %q, want empty", got.Error)
+	}
+}
+
+// The HTTP delete handler has the same asymmetry, and one extra consequence:
+// writeDeleteResult counts a failed delete in VolumeServerFileWriteFailures, so
+// a replayed delete of an EC needle used to inflate a failure metric. The
+// non-EC path answers 404 from its ReadVolumeNeedle pre-check instead.
+func TestDeleteHandler_AlreadyDeletedEcNeedleIsNotAWriteFailure(t *testing.T) {
+	const vid = needle.VolumeId(8)
+	const needleId = types.NeedleId(1)
+
+	vs := &VolumeServer{
+		store: ecVolumeWithDeletedNeedle(t, vid, needleId),
+		guard: security.NewGuard(nil, "", 0, "", 0),
+	}
+
+	before := testutil.ToFloat64(stats.VolumeServerFileWriteFailures)
+
+	w := httptest.NewRecorder()
+	vs.DeleteHandler(w, httptest.NewRequest(http.MethodDelete, "/8,0100000000", nil))
+
+	if w.Code != http.StatusNotFound {
+		t.Fatalf("status = %d (%s), want %d — an already-deleted needle is not a server error",
+			w.Code, w.Body.String(), http.StatusNotFound)
+	}
+	if after := testutil.ToFloat64(stats.VolumeServerFileWriteFailures); after != before {
+		t.Fatalf("VolumeServerFileWriteFailures moved %v -> %v; a delete that found nothing to do is not a write failure", before, after)
+	}
+}
diff --git a/weed/server/volume_grpc_client_to_master.go b/weed/server/volume_grpc_client_to_master.go
index 13700fb802..639bb5ef23 100644
--- a/weed/server/volume_grpc_client_to_master.go
+++ b/weed/server/volume_grpc_client_to_master.go
@@ -19,6 +19,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
@@ -53,6 +54,22 @@ func (vs *VolumeServer) lookupRaftLeaderMaster(ctx context.Context) (pb.ServerAd
 	return leader, nil
 }
 
+// refreshLeaderFromPeers publishes the leader the configured masters report,
+// so lookups stop going to a master the heartbeat just lost while the loop
+// retries. Without an answer within timeout no leader is published: the lost
+// master is dead or no longer leader, and a follower answers lookups from its
+// own cache rather than refusing them, so failing fast is the safer answer.
+func (vs *VolumeServer) refreshLeaderFromPeers(timeout time.Duration) {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	leader, err := vs.lookupRaftLeaderMaster(ctx)
+	if err != nil {
+		vs.setCurrentMaster("")
+		return
+	}
+	vs.setCurrentMaster(leader)
+}
+
 func isContextDoneErr(err error) bool {
 	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 		return true
@@ -73,7 +90,10 @@ func (vs *VolumeServer) getCurrentMaster() pb.ServerAddress {
 }
 
 // setCurrentMaster updates vs.currentMaster under a write lock. The
-// heartbeat goroutine calls this whenever it (re)connects to a master.
+// heartbeat goroutine calls this only with a master known to be the leader:
+// one that answered a heartbeat as leader, or the one a follower named, on
+// the heartbeat stream or, after the stream failed, in its configuration.
+// After a failed stream with no leader named, it is cleared to "".
 func (vs *VolumeServer) setCurrentMaster(master pb.ServerAddress) {
 	vs.currentMasterLock.Lock()
 	vs.currentMaster = master
@@ -121,7 +141,6 @@ func (vs *VolumeServer) heartbeat() {
 				time.Sleep(3 * time.Second)
 				master = newLeader
 			}
-			vs.store.MasterAddress = master
 			newLeader, err = vs.doHeartbeatWithRetry(master, grpcDialOption, vs.pulsePeriod, duplicateRetryCount)
 			if err != nil {
 				glog.V(0).Infof("heartbeat to %s error: %v", master, err)
@@ -135,12 +154,15 @@ func (vs *VolumeServer) heartbeat() {
 				} else {
 					// Regular error, reset duplicate retry count
 					duplicateRetryCount = 0
-					time.Sleep(vs.pulsePeriod)
+					// The lookup spends part of the retry delay rather than
+					// adding to it.
+					retryAt := time.Now().Add(vs.pulsePeriod)
+					vs.refreshLeaderFromPeers(vs.pulsePeriod)
+					time.Sleep(time.Until(retryAt))
 				}
 
 				stats.VolumeServerMasterDisconnections.WithLabelValues(master.String()).Inc()
 				newLeader = ""
-				vs.store.MasterAddress = ""
 			} else {
 				// Successful connection, reset retry count
 				duplicateRetryCount = 0
@@ -179,17 +201,42 @@ func (vs *VolumeServer) doHeartbeatWithRetry(masterAddress pb.ServerAddress, grp
 		return "", err
 	}
 	glog.V(0).Infof("Heartbeat to: %v", masterAddress)
-	vs.setCurrentMaster(masterAddress)
 
 	doneChan := make(chan error, 1)
+	// The receiver asks for a fresh heartbeat here rather than sending it,
+	// since a gRPC stream allows only one sender at a time.
+	resendChan := make(chan struct{}, 1)
 
 	go func() {
+		confirmedLeader := false
 		for {
 			in, err := stream.Recv()
 			if err != nil {
 				doneChan <- err
 				return
 			}
+			// A reply names the leader or comes from it, so it settles where
+			// lookups go before anything else on the reply is handled: a
+			// follower reply carries no other fields, and a leader stays the
+			// lookup target even when it rejects this registration.
+			if in.GetLeader() != "" {
+				// Only a follower names the leader. Publish the named leader right
+				// away, so lookups stop landing on this follower while the loop
+				// reconnects.
+				leader := pb.ServerAddress(in.GetLeader())
+				if !masterAddress.Equals(leader) {
+					glog.V(0).Infof("Volume Server found a new master newLeader: %v instead of %v", leader, masterAddress)
+					vs.setCurrentMaster(leader)
+					newLeader = leader
+					doneChan <- nil
+					return
+				}
+			} else if !confirmedLeader {
+				// The leader answers every new heartbeat stream without naming a
+				// leader, so this peer is the one lookups should go to.
+				confirmedLeader = true
+				vs.setCurrentMaster(masterAddress)
+			}
 			if len(in.DuplicatedUuids) > 0 {
 				var duplicateDir []string
 				for _, loc := range vs.store.Locations {
@@ -217,6 +264,8 @@ func (vs *VolumeServer) doHeartbeatWithRetry(masterAddress pb.ServerAddress, grp
 					os.Exit(1)
 				}
 			}
+			vs.store.UpdateMaxVolumeIdSeen(needle.VolumeId(in.MaxVolumeId))
+			vs.store.UpdateLastSeenTopologyId(in.TopologyId)
 			volumeOptsChanged := false
 			if vs.store.GetPreallocate() != in.GetPreallocate() {
 				vs.store.SetPreallocate(in.GetPreallocate())
@@ -228,9 +277,9 @@ func (vs *VolumeServer) doHeartbeatWithRetry(masterAddress pb.ServerAddress, grp
 			}
 			if volumeOptsChanged {
 				if vs.store.MaybeAdjustVolumeMax() {
-					if err = stream.Send(vs.store.CollectHeartbeat()); err != nil {
-						glog.V(0).Infof("Volume Server Failed to talk with master %s: %v", vs.getCurrentMaster(), err)
-						return
+					select {
+					case resendChan <- struct{}{}:
+					default:
 					}
 				}
 			}
@@ -241,15 +290,6 @@ func (vs *VolumeServer) doHeartbeatWithRetry(masterAddress pb.ServerAddress, grp
 				glog.V(0).Infof("master %s asked for the full volume list", masterAddress)
 				vs.store.RequestFullVolumeList()
 			}
-			if in.GetLeader() != "" {
-				current := vs.getCurrentMaster()
-				if !current.Equals(pb.ServerAddress(in.GetLeader())) {
-					glog.V(0).Infof("Volume Server found a new master newLeader: %v instead of %v", in.GetLeader(), current)
-					newLeader = pb.ServerAddress(in.GetLeader())
-					doneChan <- nil
-					return
-				}
-			}
 		}
 	}()
 
@@ -356,6 +396,11 @@ func (vs *VolumeServer) doHeartbeatWithRetry(masterAddress pb.ServerAddress, grp
 				glog.V(0).Infof("Volume Server Failed to update to master %s: %v", masterAddress, err)
 				return "", err
 			}
+		case <-resendChan:
+			if err = stream.Send(vs.store.CollectHeartbeat()); err != nil {
+				glog.V(0).Infof("Volume Server Failed to talk with master %s: %v", masterAddress, err)
+				return "", err
+			}
 		case <-volumeTickChan.C:
 			glog.V(4).Infof("volume server %s:%d heartbeat", vs.store.Ip, vs.store.Port)
 			vs.store.MaybeAdjustVolumeMax()
diff --git a/weed/server/volume_grpc_client_to_master_test.go b/weed/server/volume_grpc_client_to_master_test.go
index 90d1ba18f4..b235e66ca5 100644
--- a/weed/server/volume_grpc_client_to_master_test.go
+++ b/weed/server/volume_grpc_client_to_master_test.go
@@ -4,11 +4,17 @@ import (
 	"context"
 	"fmt"
 	"net"
+	"strings"
+	"sync"
 	"testing"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
 )
@@ -60,3 +66,279 @@ func startFakeMasterServerForLeaderLookup(t *testing.T, srv master_pb.SeaweedSer
 	_, port, _ := net.SplitHostPort(lis.Addr().String())
 	return pb.ServerAddress(fmt.Sprintf("127.0.0.1:0.%s", port))
 }
+
+// fakeHeartbeatMaster answers SendHeartbeat the way a master does: a follower
+// names the leader on every heartbeat, the leader answers the first one with
+// its volume options and never names itself.
+type fakeHeartbeatMaster struct {
+	master_pb.UnimplementedSeaweedServer
+	leader     string        // set on a follower
+	release    chan struct{} // a follower waits on it before answering
+	heartbeats chan *master_pb.Heartbeat
+}
+
+func (m *fakeHeartbeatMaster) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServer) error {
+	answered := false
+	for {
+		hb, err := stream.Recv()
+		if err != nil {
+			return err
+		}
+		if m.heartbeats != nil {
+			m.heartbeats <- hb
+		}
+		if m.leader != "" {
+			if m.release != nil {
+				<-m.release
+			}
+			if err := stream.Send(&master_pb.HeartbeatResponse{Leader: m.leader}); err != nil {
+				return err
+			}
+			continue
+		}
+		if !answered {
+			answered = true
+			if err := stream.Send(&master_pb.HeartbeatResponse{VolumeSizeLimit: 1 << 30}); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func newHeartbeatTestVolumeServer(t *testing.T) *VolumeServer {
+	t.Helper()
+	store := storage.NewStore(nil, "127.0.0.1", 8080, 18080, "http://127.0.0.1:8080", "store-id",
+		[]string{t.TempDir()},
+		[]int32{0},
+		[]util.MinFreeSpace{{}},
+		"",
+		storage.NeedleMapInMemory,
+		[]types.DiskType{types.HardDriveType},
+		nil,
+		3,
+		stats.DefaultDiskIOProbeConfig(),
+	)
+	t.Cleanup(store.Close)
+	vs := &VolumeServer{
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		store:          store,
+		stopChan:       make(chan bool),
+		isHeartbeating: true,
+	}
+	store.MasterFn = vs.getCurrentMaster
+	return vs
+}
+
+func waitForCurrentMaster(t *testing.T, vs *VolumeServer, want pb.ServerAddress) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for !vs.getCurrentMaster().Equals(want) {
+		if time.Now().After(deadline) {
+			t.Fatalf("currentMaster = %q, want %q", vs.getCurrentMaster(), want)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+// heartbeatRun is one doHeartbeatWithRetry call running in the background.
+type heartbeatRun struct {
+	done   chan heartbeatResult // receives the call's result once
+	exited chan struct{}
+	stop   func()
+}
+
+type heartbeatResult struct {
+	newLeader pb.ServerAddress
+	err       error
+}
+
+// startHeartbeat runs doHeartbeatWithRetry against master until it returns or
+// is stopped. Its cleanup stops the heartbeat and waits for it, and runs before
+// the cleanups registered earlier, so a failed assertion cannot leave the stream
+// open for the fake master's GracefulStop to wait on.
+func startHeartbeat(t *testing.T, vs *VolumeServer, master pb.ServerAddress) *heartbeatRun {
+	t.Helper()
+	var stopOnce sync.Once
+	run := &heartbeatRun{
+		done:   make(chan heartbeatResult, 1),
+		exited: make(chan struct{}),
+		stop:   func() { stopOnce.Do(func() { close(vs.stopChan) }) },
+	}
+	go func() {
+		defer close(run.exited)
+		newLeader, err := vs.doHeartbeatWithRetry(master, vs.grpcDialOption, time.Hour, 0)
+		run.done <- heartbeatResult{newLeader, err}
+	}()
+	t.Cleanup(func() {
+		run.stop()
+		select {
+		case <-run.exited:
+		case <-time.After(5 * time.Second):
+			t.Error("heartbeat did not stop")
+		}
+	})
+	return run
+}
+
+// A follower must never become the master lookups go to: until it names the
+// leader the previous one stays, and then the named leader takes over before
+// the heartbeat loop has reconnected.
+func TestHeartbeatToFollowerPublishesNamedLeaderOnly(t *testing.T) {
+	const leader = pb.ServerAddress("leader.example.com:9333.19333")
+	follower := &fakeHeartbeatMaster{
+		leader:     string(leader),
+		release:    make(chan struct{}),
+		heartbeats: make(chan *master_pb.Heartbeat, 8),
+	}
+	followerAddr := startFakeMasterServerForLeaderLookup(t, follower)
+	// cleanups run last-in first-out, so a failed assertion still lets the
+	// follower answer before its server stops gracefully
+	var releaseOnce sync.Once
+	release := func() { releaseOnce.Do(func() { close(follower.release) }) }
+	t.Cleanup(release)
+
+	vs := newHeartbeatTestVolumeServer(t)
+	previous := pb.ServerAddress("previous.example.com:9333.19333")
+	vs.setCurrentMaster(previous)
+	run := startHeartbeat(t, vs, followerAddr)
+
+	select {
+	case <-follower.heartbeats:
+	case <-time.After(5 * time.Second):
+		t.Fatal("follower got no heartbeat")
+	}
+	if got := vs.getCurrentMaster(); got != previous {
+		t.Fatalf("currentMaster = %q while connected to follower %q, want unchanged %q", string(got), string(followerAddr), string(previous))
+	}
+	if got := vs.store.MasterFn(); got != previous {
+		t.Fatalf("store master = %q, want %q", got, previous)
+	}
+	release()
+
+	select {
+	case r := <-run.done:
+		if r.err != nil {
+			t.Fatalf("heartbeat: %v", r.err)
+		}
+		if r.newLeader != leader {
+			t.Fatalf("newLeader = %q, want %q", r.newLeader, leader)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("heartbeat did not return after the follower named the leader")
+	}
+	if got := vs.getCurrentMaster(); got != leader {
+		t.Fatalf("currentMaster = %q, want named leader %q", got, leader)
+	}
+}
+
+// The leader's first answer confirms it, and the size limit that answer carries
+// makes the receiver ask for a fresh heartbeat, which the send loop delivers.
+func TestHeartbeatToLeaderPublishesItAndResendsFromSendLoop(t *testing.T) {
+	leader := &fakeHeartbeatMaster{heartbeats: make(chan *master_pb.Heartbeat, 8)}
+	leaderAddr := startFakeMasterServerForLeaderLookup(t, leader)
+
+	vs := newHeartbeatTestVolumeServer(t)
+	run := startHeartbeat(t, vs, leaderAddr)
+
+	waitForCurrentMaster(t, vs, leaderAddr)
+	if got := vs.store.MasterFn(); got != leaderAddr {
+		t.Fatalf("store master = %q, want %q", got, leaderAddr)
+	}
+
+	// the initial volume and ec heartbeats, then the resend
+	for i := 0; i < 3; i++ {
+		select {
+		case <-leader.heartbeats:
+		case <-time.After(5 * time.Second):
+			t.Fatalf("leader got %d heartbeats, want 3", i)
+		}
+	}
+
+	run.stop()
+	select {
+	case r := <-run.done:
+		if r.err != nil {
+			t.Fatalf("heartbeat: %v", r.err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("heartbeat did not stop")
+	}
+}
+
+// duplicateUUIDMaster answers every heartbeat the way a leader holding a stale
+// registration does: a duplicate-uuid response and nothing else.
+type duplicateUUIDMaster struct {
+	master_pb.UnimplementedSeaweedServer
+}
+
+func (m *duplicateUUIDMaster) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServer) error {
+	for {
+		if _, err := stream.Recv(); err != nil {
+			return err
+		}
+		if err := stream.Send(&master_pb.HeartbeatResponse{DuplicatedUuids: []string{"uuid-1"}}); err != nil {
+			return err
+		}
+	}
+}
+
+// A leader that rejects the registration over duplicate uuids still answers
+// lookups, so it is published before the retry error goes out.
+func TestHeartbeatPublishesLeaderBeforeDuplicateUuidError(t *testing.T) {
+	masterAddr := startFakeMasterServerForLeaderLookup(t, &duplicateUUIDMaster{})
+	vs := newHeartbeatTestVolumeServer(t)
+	vs.setCurrentMaster("previous.example.com:9333.19333")
+
+	_, err := vs.doHeartbeatWithRetry(masterAddr, vs.grpcDialOption, time.Hour, 0)
+	if err == nil || !strings.Contains(err.Error(), "duplicate UUIDs") {
+		t.Fatalf("err = %v, want duplicate UUIDs", err)
+	}
+	if got := vs.getCurrentMaster(); got != masterAddr {
+		t.Fatalf("currentMaster = %q, want the answering leader %q", got, masterAddr)
+	}
+}
+
+// After the heartbeat loses its master, lookups move to the leader the other
+// masters report instead of dialing the lost one until a new stream answers.
+func TestRefreshLeaderFromPeersPublishesReportedLeader(t *testing.T) {
+	const leader = pb.ServerAddress("leader.example.com:9333.19333")
+	peer := startFakeMasterServerForLeaderLookup(t, &fakeLeaderConfigServer{leader: string(leader)})
+	vs := &VolumeServer{
+		SeedMasterNodes: []pb.ServerAddress{peer},
+		grpcDialOption:  grpc.WithTransportCredentials(insecure.NewCredentials()),
+		store:           &storage.Store{Ip: "127.0.0.1", Port: 8080},
+	}
+	vs.store.MasterFn = vs.getCurrentMaster
+	vs.setCurrentMaster("lost.example.com:9333.19333")
+
+	vs.refreshLeaderFromPeers(5 * time.Second)
+
+	if got := vs.getCurrentMaster(); got != leader {
+		t.Fatalf("currentMaster = %q, want reported leader %q", string(got), string(leader))
+	}
+	if got := vs.store.MasterFn(); got != leader {
+		t.Fatalf("store master = %q, want %q", string(got), string(leader))
+	}
+}
+
+// Mid-election no master names a leader. The lost master is dead or now a
+// follower that would answer lookups from its own cache, so none is published.
+func TestRefreshLeaderFromPeersClearsLeaderWithoutAnswer(t *testing.T) {
+	peer := startFakeMasterServerForLeaderLookup(t, &fakeLeaderConfigServer{})
+	vs := &VolumeServer{
+		SeedMasterNodes: []pb.ServerAddress{peer},
+		grpcDialOption:  grpc.WithTransportCredentials(insecure.NewCredentials()),
+		store:           &storage.Store{Ip: "127.0.0.1", Port: 8080},
+	}
+	vs.store.MasterFn = vs.getCurrentMaster
+	vs.setCurrentMaster("lost.example.com:9333.19333")
+
+	vs.refreshLeaderFromPeers(5 * time.Second)
+
+	if got := vs.getCurrentMaster(); got != "" {
+		t.Fatalf("currentMaster = %q, want none", string(got))
+	}
+	if got := vs.store.MasterFn(); got != "" {
+		t.Fatalf("store master = %q, want none", string(got))
+	}
+}
diff --git a/weed/server/volume_grpc_copy.go b/weed/server/volume_grpc_copy.go
index a33be5a423..110759f19e 100644
--- a/weed/server/volume_grpc_copy.go
+++ b/weed/server/volume_grpc_copy.go
@@ -34,6 +34,11 @@ func (vs *VolumeServer) VolumeCopy(req *volume_server_pb.VolumeCopyRequest, stre
 	if err := vs.CheckMaintenanceMode(); err != nil {
 		return err
 	}
+	if !vs.AllowUntrustedRemoteEndpoints {
+		if err := validateReplicaTarget(stream.Context(), req.SourceDataNode); err != nil {
+			return fmt.Errorf("invalid source data node %s: %w", req.SourceDataNode, err)
+		}
+	}
 
 	// A pre-existing local replica is NOT deleted up front. Deleting before the
 	// source is confirmed reachable destroys a healthy copy on a transient
@@ -50,11 +55,21 @@ func (vs *VolumeServer) VolumeCopy(req *volume_server_pb.VolumeCopyRequest, stre
 	//   send .dat file
 	//   confirm size and timestamp
 	var volFileInfoResp *volume_server_pb.ReadVolumeFileStatusResponse
+	var sourceVolumeStatus *volume_server_pb.VolumeStatusResponse
+	var sourceVolumeStatusAfterCopy *volume_server_pb.VolumeStatusResponse
 	var dataBaseFileName, indexBaseFileName, idxFileName, datFileName string
 	var hasRemoteDatFile bool
-	err := operation.WithVolumeServerClient(true, pb.ServerAddress(req.SourceDataNode), vs.grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+	err := operation.WithVolumeServerClientOptions(true, pb.ServerAddress(req.SourceDataNode), func(client volume_server_pb.VolumeServerClient) error {
 		var err error
-		volFileInfoResp, err = client.ReadVolumeFileStatus(context.Background(),
+		sourceVolumeStatus, err = client.VolumeStatus(stream.Context(), &volume_server_pb.VolumeStatusRequest{
+			VolumeId: req.VolumeId,
+		})
+		if err != nil {
+			glog.Warningf("failed to read source volume %d status before copy; skip record count validation: %v", req.VolumeId, err)
+			sourceVolumeStatus = nil
+		}
+
+		volFileInfoResp, err = client.ReadVolumeFileStatus(stream.Context(),
 			&volume_server_pb.ReadVolumeFileStatusRequest{
 				VolumeId: req.VolumeId,
 			})
@@ -62,18 +77,6 @@ func (vs *VolumeServer) VolumeCopy(req *volume_server_pb.VolumeCopyRequest, stre
 			return fmt.Errorf("read volume file status failed, %w", err)
 		}
 
-		// Source is reachable and holds the volume: only now is it safe to drop
-		// an existing local replica before overwriting its files.
-		if hasExistingVolume {
-			glog.V(0).Infof("volume %d already exists. deleting before copying from %s...", req.VolumeId, req.SourceDataNode)
-			// keep remote data: the inbound copy carries a .vif that may point at
-			// the same cloud-tier object the existing volume references.
-			if delErr := vs.store.DeleteVolume(needle.VolumeId(req.VolumeId), false, true); delErr != nil {
-				return fmt.Errorf("failed to delete existing volume %d: %v", req.VolumeId, delErr)
-			}
-			glog.V(0).Infof("deleted existing volume %d before copying.", req.VolumeId)
-		}
-
 		diskType := volFileInfoResp.DiskType
 		if req.DiskType != "" {
 			diskType = req.DiskType
@@ -87,11 +90,23 @@ func (vs *VolumeServer) VolumeCopy(req *volume_server_pb.VolumeCopyRequest, stre
 		location := vs.store.FindFreeLocation(func(location *storage.DiskLocation) bool {
 			return location.DiskType == types.ToDiskType(diskType) &&
 				location.AvailableSpace.Load() > neededSpace
-		})
+		}, needle.VolumeId(req.VolumeId))
 		if location == nil {
 			return fmt.Errorf("%s %s", util.ErrVolumeNoSpaceLeft, types.ToDiskType(diskType).ReadableString())
 		}
 
+		// Source is reachable and a destination is reserved: only now is it
+		// safe to drop an existing local replica before overwriting its files.
+		if hasExistingVolume {
+			glog.V(0).Infof("volume %d already exists. deleting before copying from %s...", req.VolumeId, req.SourceDataNode)
+			// keep remote data: the inbound copy carries a .vif that may point at
+			// the same cloud-tier object the existing volume references.
+			if delErr := vs.store.DeleteVolume(needle.VolumeId(req.VolumeId), false, false, true); delErr != nil {
+				return fmt.Errorf("failed to delete existing volume %d: %v", req.VolumeId, delErr)
+			}
+			glog.V(0).Infof("deleted existing volume %d before copying.", req.VolumeId)
+		}
+
 		dataBaseFileName = storage.VolumeFileName(location.Directory, volFileInfoResp.Collection, int(req.VolumeId))
 		indexBaseFileName = storage.VolumeFileName(location.IdxDirectory, volFileInfoResp.Collection, int(req.VolumeId))
 
@@ -189,8 +204,17 @@ func (vs *VolumeServer) VolumeCopy(req *volume_server_pb.VolumeCopyRequest, stre
 			return fmt.Errorf("remove .note for volume %d: %w", req.VolumeId, noteErr)
 		}
 
+		var statusErr error
+		sourceVolumeStatusAfterCopy, statusErr = client.VolumeStatus(stream.Context(), &volume_server_pb.VolumeStatusRequest{
+			VolumeId: req.VolumeId,
+		})
+		if statusErr != nil {
+			err = fmt.Errorf("read source volume %d status after copy failed: %w", req.VolumeId, statusErr)
+			return err
+		}
+
 		return nil
-	})
+	}, vs.grpcDialOption, vs.guardedGrpcDialOption(req.SourceDataNode))
 
 	if err != nil {
 		return err
@@ -223,10 +247,28 @@ func (vs *VolumeServer) VolumeCopy(req *volume_server_pb.VolumeCopyRequest, stre
 		}
 	}
 
-	// mount the volume
-	err = vs.store.MountVolume(needle.VolumeId(req.VolumeId))
+	shouldValidateCopyCounts := copyCountsStable(sourceVolumeStatus, sourceVolumeStatusAfterCopy)
+	if !shouldValidateCopyCounts {
+		glog.V(1).Infof("source volume %d changed during copy; skip record count validation", req.VolumeId)
+	}
+
+	// Load and validate the volume before announcing it to the master. A failed
+	// validation is unloaded by the store without ever making the replica
+	// routable.
+	err = vs.store.MountVolume(needle.VolumeId(req.VolumeId), &req.Collection, func(targetVolume *storage.Volume) error {
+		if !shouldValidateCopyCounts {
+			return nil
+		}
+		// Counter drift (bloom-filter estimates, rows appended between the
+		// status snapshots) is not proof of a bad copy; the byte sizes
+		// already match. Warn instead of rejecting the copy.
+		if countErr := checkCopyCounts(sourceVolumeStatusAfterCopy, targetVolume.FileCount(), targetVolume.DeletedCount()); countErr != nil {
+			glog.Warningf("copied volume %d counts differ from source in-memory counters (counter drift): %v", req.VolumeId, countErr)
+		}
+		return nil
+	})
 	if err != nil {
-		return fmt.Errorf("failed to mount volume %d: %v", req.VolumeId, err)
+		return fmt.Errorf("failed to mount or validate volume %d: %w", req.VolumeId, err)
 	}
 
 	if err = stream.Send(&volume_server_pb.VolumeCopyResponse{
@@ -266,11 +308,8 @@ func (vs *VolumeServer) doCopyFileWithThrottler(client volume_server_pb.VolumeSe
 
 }
 
-/*
-*
-only check the differ of the file size
-todo: maybe should check the received count and deleted count of the volume
-*/
+// checkCopyFiles verifies the copied file sizes. Record counts are compared
+// after the target volume is mounted, when the target needle map is available.
 func checkCopyFiles(originFileInf *volume_server_pb.ReadVolumeFileStatusResponse, hasRemoteDatFile bool, idxFileName, datFileName string) error {
 	stat, err := os.Stat(idxFileName)
 	if err != nil {
@@ -300,6 +339,25 @@ func checkCopyFiles(originFileInf *volume_server_pb.ReadVolumeFileStatusResponse
 	return nil
 }
 
+func checkCopyCounts(origin *volume_server_pb.VolumeStatusResponse, targetFileCount, targetDeletedCount uint64) error {
+	if origin.FileCount != targetFileCount {
+		return fmt.Errorf("target file count [%d] is not same as origin file count [%d]", targetFileCount, origin.FileCount)
+	}
+	if origin.FileDeletedCount != targetDeletedCount {
+		return fmt.Errorf("target deleted count [%d] is not same as origin deleted count [%d]", targetDeletedCount, origin.FileDeletedCount)
+	}
+	return nil
+}
+
+func copyCountsStable(before, after *volume_server_pb.VolumeStatusResponse) bool {
+	// A writable source may receive writes or deletions while its files are
+	// copied. In that case the before/after counts do not describe one stable
+	// snapshot, so strict target-count validation would report a false error.
+	return before != nil && after != nil &&
+		before.FileCount == after.FileCount &&
+		before.FileDeletedCount == after.FileDeletedCount
+}
+
 func findLastAppendAtNsFromCopiedFiles(idxFileName, datFileName string, version needle.Version) (uint64, error) {
 	if version < needle.Version3 {
 		return 0, nil
@@ -478,6 +536,7 @@ func (vs *VolumeServer) ReadVolumeFileStatus(ctx context.Context, req *volume_se
 	resp.DiskType = string(v.DiskType())
 	resp.VolumeInfo = v.GetVolumeInfo()
 	resp.Version = uint32(v.Version())
+	resp.ExpireAtSec = v.ExpireAtSec()
 	return resp, nil
 }
 
@@ -658,11 +717,17 @@ func (vs *VolumeServer) ReceiveFile(stream volume_server_pb.VolumeServer_Receive
 	var targetFile *os.File
 	var filePath string
 	var bytesWritten uint64
+	// Set while an EC .ecj is being received; released only after the file is
+	// closed and any partial copy removed.
+	var ecjWriteDone func()
 
 	defer func() {
 		if targetFile != nil {
 			targetFile.Close()
 		}
+		if ecjWriteDone != nil {
+			ecjWriteDone()
+		}
 	}()
 
 	for {
@@ -751,6 +816,13 @@ func (vs *VolumeServer) ReceiveFile(stream volume_server_pb.VolumeServer_Receive
 				// Create EC shard file path
 				baseFileName := erasure_coding.EcShardBaseFileName(fileInfo.Collection, int(fileInfo.VolumeId))
 				filePath = util.Join(targetLocation.Directory, baseFileName+fileInfo.Ext)
+				// The mounted check above runs once; a volume can still mount on
+				// this journal while the stream writes it. Registered as a writer
+				// before the file is created, that mount cannot compact the
+				// journal and leave the rest of the stream in an unlinked inode.
+				if fileInfo.Ext == ".ecj" && ecjWriteDone == nil {
+					ecjWriteDone = erasure_coding.BeginEcjWrite(filePath)
+				}
 			} else {
 				// Regular volume file
 				v := vs.store.GetVolume(needle.VolumeId(fileInfo.VolumeId))
diff --git a/weed/server/volume_grpc_copy_count_test.go b/weed/server/volume_grpc_copy_count_test.go
new file mode 100644
index 0000000000..5c3d01be21
--- /dev/null
+++ b/weed/server/volume_grpc_copy_count_test.go
@@ -0,0 +1,148 @@
+package weed_server
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+)
+
+func TestCheckCopyCounts(t *testing.T) {
+	tests := []struct {
+		name              string
+		sourceFileCount   uint64
+		sourceDeleteCount uint64
+		targetFileCount   uint64
+		targetDeleteCount uint64
+		wantErr           string
+	}{
+		{
+			name: "empty volume counts match",
+		},
+		{
+			name:              "file and deleted counts match",
+			sourceFileCount:   10,
+			sourceDeleteCount: 3,
+			targetFileCount:   10,
+			targetDeleteCount: 3,
+		},
+		{
+			name:              "file count differs",
+			sourceFileCount:   10,
+			sourceDeleteCount: 3,
+			targetFileCount:   9,
+			targetDeleteCount: 3,
+			wantErr:           "file count",
+		},
+		{
+			name:              "deleted count differs",
+			sourceFileCount:   10,
+			sourceDeleteCount: 3,
+			targetFileCount:   10,
+			targetDeleteCount: 2,
+			wantErr:           "deleted count",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := checkCopyCounts(
+				&volume_server_pb.VolumeStatusResponse{
+					FileCount:        tt.sourceFileCount,
+					FileDeletedCount: tt.sourceDeleteCount,
+				},
+				tt.targetFileCount,
+				tt.targetDeleteCount,
+			)
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("checkCopyCounts() error = %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("checkCopyCounts() error = %v, want substring %q", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestCopyCountsStable(t *testing.T) {
+	tests := []struct {
+		name   string
+		before *volume_server_pb.VolumeStatusResponse
+		after  *volume_server_pb.VolumeStatusResponse
+		want   bool
+	}{
+		{
+			name:   "empty volume is stable",
+			before: &volume_server_pb.VolumeStatusResponse{},
+			after:  &volume_server_pb.VolumeStatusResponse{},
+			want:   true,
+		},
+		{
+			name: "matching file and deleted counts are stable",
+			before: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        10,
+				FileDeletedCount: 3,
+			},
+			after: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        10,
+				FileDeletedCount: 3,
+			},
+			want: true,
+		},
+		{
+			name: "read-only state changes without count changes are stable",
+			before: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        10,
+				FileDeletedCount: 3,
+				IsReadOnly:       true,
+			},
+			after: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        10,
+				FileDeletedCount: 3,
+				IsReadOnly:       false,
+			},
+			want: true,
+		},
+		{
+			name: "changed file count is not stable",
+			before: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        10,
+				FileDeletedCount: 3,
+			},
+			after: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        9,
+				FileDeletedCount: 3,
+			},
+		},
+		{
+			name: "changed deleted count is not stable",
+			before: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        10,
+				FileDeletedCount: 3,
+			},
+			after: &volume_server_pb.VolumeStatusResponse{
+				FileCount:        10,
+				FileDeletedCount: 2,
+			},
+		},
+		{
+			name:  "missing before status is not stable",
+			after: &volume_server_pb.VolumeStatusResponse{},
+		},
+		{
+			name:   "missing after status is not stable",
+			before: &volume_server_pb.VolumeStatusResponse{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := copyCountsStable(tt.before, tt.after); got != tt.want {
+				t.Fatalf("copyCountsStable() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/weed/server/volume_grpc_copy_incremental.go b/weed/server/volume_grpc_copy_incremental.go
index 449adb9338..335b5c63ef 100644
--- a/weed/server/volume_grpc_copy_incremental.go
+++ b/weed/server/volume_grpc_copy_incremental.go
@@ -6,7 +6,7 @@ import (
 	"io"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
-	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 )
 
@@ -16,6 +16,9 @@ func (vs *VolumeServer) VolumeIncrementalCopy(req *volume_server_pb.VolumeIncrem
 	if v == nil {
 		return fmt.Errorf("not found volume id %d", req.VolumeId)
 	}
+	if err := v.UnavailableError(); err != nil {
+		return err
+	}
 
 	stopOffset, _, _ := v.FileStat()
 	foundOffset, isLastOne, err := v.BinarySearchByAppendAtNs(req.SinceNs)
@@ -30,7 +33,7 @@ func (vs *VolumeServer) VolumeIncrementalCopy(req *volume_server_pb.VolumeIncrem
 	startOffset := foundOffset.ToActualOffset()
 
 	buf := make([]byte, 1024*1024*2)
-	return sendFileContent(v.DataBackend, buf, startOffset, int64(stopOffset), stream)
+	return sendFileContent(v, buf, startOffset, int64(stopOffset), stream)
 
 }
 
@@ -47,10 +50,13 @@ func (vs *VolumeServer) VolumeSyncStatus(ctx context.Context, req *volume_server
 
 }
 
-func sendFileContent(datBackend backend.BackendStorageFile, buf []byte, startOffset, stopOffset int64, stream volume_server_pb.VolumeServer_VolumeIncrementalCopyServer) error {
+func sendFileContent(v *storage.Volume, buf []byte, startOffset, stopOffset int64, stream volume_server_pb.VolumeServer_VolumeIncrementalCopyServer) error {
 	var blockSizeLimit = int64(len(buf))
 	for i := int64(0); i < stopOffset-startOffset; i += blockSizeLimit {
-		n, readErr := datBackend.ReadAt(buf, startOffset+i)
+		if err := v.UnavailableError(); err != nil {
+			return err
+		}
+		n, readErr := v.DataBackend.ReadAt(buf, startOffset+i)
 		if readErr == nil || readErr == io.EOF {
 			resp := &volume_server_pb.VolumeIncrementalCopyResponse{}
 			resp.FileContent = buf[:int64(n)]
diff --git a/weed/server/volume_grpc_copy_traversal_test.go b/weed/server/volume_grpc_copy_traversal_test.go
index 89ada05e6f..73fa4db588 100644
--- a/weed/server/volume_grpc_copy_traversal_test.go
+++ b/weed/server/volume_grpc_copy_traversal_test.go
@@ -30,15 +30,20 @@ func newTraversalTestStore(dir string) *storage.Store {
 }
 
 // fakeReceiveFileStream scripts a ReceiveFile request sequence and records the
-// final response returned via SendAndClose.
+// final response returned via SendAndClose. onRecv, when set, runs before
+// request i is handed over, i.e. after the handler processed requests 0..i-1.
 type fakeReceiveFileStream struct {
 	grpc.ServerStream
-	reqs  []*volume_server_pb.ReceiveFileRequest
-	index int
-	resp  *volume_server_pb.ReceiveFileResponse
+	reqs   []*volume_server_pb.ReceiveFileRequest
+	index  int
+	resp   *volume_server_pb.ReceiveFileResponse
+	onRecv func(i int)
 }
 
 func (s *fakeReceiveFileStream) Recv() (*volume_server_pb.ReceiveFileRequest, error) {
+	if s.onRecv != nil {
+		s.onRecv(s.index)
+	}
 	if s.index >= len(s.reqs) {
 		return nil, io.EOF
 	}
diff --git a/weed/server/volume_grpc_copy_verify_test.go b/weed/server/volume_grpc_copy_verify_test.go
index ef10832abc..415c29d0ee 100644
--- a/weed/server/volume_grpc_copy_verify_test.go
+++ b/weed/server/volume_grpc_copy_verify_test.go
@@ -2,6 +2,11 @@ package weed_server
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"sync/atomic"
 	"testing"
 
 	"google.golang.org/grpc"
@@ -16,6 +21,194 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
+type volumeCopyStatusServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	delegate       *VolumeServer
+	failStatusCall int32
+	statusErr      error
+	statusCalls    atomic.Int32
+}
+
+func (s *volumeCopyStatusServer) VolumeStatus(ctx context.Context, req *volume_server_pb.VolumeStatusRequest) (*volume_server_pb.VolumeStatusResponse, error) {
+	if s.statusCalls.Add(1) == s.failStatusCall {
+		return nil, s.statusErr
+	}
+	return s.delegate.VolumeStatus(ctx, req)
+}
+
+func (s *volumeCopyStatusServer) ReadVolumeFileStatus(ctx context.Context, req *volume_server_pb.ReadVolumeFileStatusRequest) (*volume_server_pb.ReadVolumeFileStatusResponse, error) {
+	return s.delegate.ReadVolumeFileStatus(ctx, req)
+}
+
+func (s *volumeCopyStatusServer) CopyFile(req *volume_server_pb.CopyFileRequest, stream volume_server_pb.VolumeServer_CopyFileServer) error {
+	return s.delegate.CopyFile(req, stream)
+}
+
+func newVolumeCopyTestStore(t *testing.T, dir string) *storage.Store {
+	t.Helper()
+	store := storage.NewStore(
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		"127.0.0.1", 0, 0, "", "test-store",
+		[]string{dir}, []int32{10}, []util.MinFreeSpace{{}},
+		dir, storage.NeedleMapInMemory,
+		[]types.DiskType{types.HardDriveType}, [][]string{nil},
+		0, stats.DefaultDiskIOProbeConfig(),
+	)
+	store.Locations[0].AvailableSpace.Store(^uint64(0))
+	t.Cleanup(store.Close)
+	return store
+}
+
+func runVolumeCopyWithStatusFailure(t *testing.T, failStatusCall int32) (error, *storage.Store) {
+	t.Helper()
+	const vid = needle.VolumeId(43)
+
+	sourceStore := newVolumeCopyTestStore(t, t.TempDir())
+	if err := sourceStore.AddVolume(vid, "", storage.NeedleMapInMemory, "000", "", 0,
+		needle.GetCurrentVersion(), 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add source volume: %v", err)
+	}
+	source := &volumeCopyStatusServer{
+		delegate:       &VolumeServer{store: sourceStore},
+		failStatusCall: failStatusCall,
+		statusErr:      errors.New("source volume status unavailable"),
+	}
+	port := serveGrpc(t, func(server *grpc.Server) {
+		volume_server_pb.RegisterVolumeServerServer(server, source)
+	})
+
+	targetStore := newVolumeCopyTestStore(t, t.TempDir())
+	target := &VolumeServer{
+		store:                         targetStore,
+		grpcDialOption:                grpc.WithTransportCredentials(insecure.NewCredentials()),
+		AllowUntrustedRemoteEndpoints: true,
+	}
+	err := target.VolumeCopy(&volume_server_pb.VolumeCopyRequest{
+		VolumeId:       uint32(vid),
+		SourceDataNode: fmt.Sprintf("127.0.0.1:%d.%d", port-10000, port),
+	}, &fakeVolumeCopyStream{})
+	return err, targetStore
+}
+
+func TestVolumeCopyContinuesWhenInitialStatusUnavailable(t *testing.T) {
+	err, targetStore := runVolumeCopyWithStatusFailure(t, 1)
+	if err != nil {
+		t.Fatalf("VolumeCopy should continue when the initial status is unavailable: %v", err)
+	}
+	if targetStore.GetVolume(43) == nil {
+		t.Fatal("copied volume was not mounted")
+	}
+}
+
+func TestVolumeCopyFailsWhenFinalStatusUnavailable(t *testing.T) {
+	err, targetStore := runVolumeCopyWithStatusFailure(t, 2)
+	if err == nil || !strings.Contains(err.Error(), "status after copy") {
+		t.Fatalf("VolumeCopy error = %v, want final status error", err)
+	}
+	if targetStore.GetVolume(43) != nil {
+		t.Fatal("volume was mounted after final status validation failed")
+	}
+	select {
+	case message := <-targetStore.NewVolumesChan:
+		t.Fatalf("volume was announced after final status validation failed: %+v", message)
+	default:
+	}
+	dataBaseFileName := storage.VolumeFileName(targetStore.Locations[0].Directory, "", 43)
+	indexBaseFileName := storage.VolumeFileName(targetStore.Locations[0].IdxDirectory, "", 43)
+	for _, fileName := range []string{
+		dataBaseFileName + ".dat",
+		indexBaseFileName + ".idx",
+		dataBaseFileName + ".vif",
+		dataBaseFileName + ".note",
+	} {
+		if _, statErr := os.Stat(fileName); !os.IsNotExist(statErr) {
+			t.Fatalf("copy artifact %s remains after final status validation failed: %v", fileName, statErr)
+		}
+	}
+}
+
+func TestVolumeCopyKeepsExistingReplicaWhenDestinationFull(t *testing.T) {
+	const vid = needle.VolumeId(44)
+
+	sourceStore := newVolumeCopyTestStore(t, t.TempDir())
+	if err := sourceStore.AddVolume(vid, "", storage.NeedleMapInMemory, "000", "", 0,
+		needle.GetCurrentVersion(), 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add source volume: %v", err)
+	}
+	source := &volumeCopyStatusServer{
+		delegate:       &VolumeServer{store: sourceStore},
+		failStatusCall: 1,
+		statusErr:      errors.New("source volume status unavailable"),
+	}
+	port := serveGrpc(t, func(server *grpc.Server) {
+		volume_server_pb.RegisterVolumeServerServer(server, source)
+	})
+
+	targetStore := newVolumeCopyTestStore(t, t.TempDir())
+	if err := targetStore.AddVolume(vid, "", storage.NeedleMapInMemory, "000", "", 0,
+		needle.GetCurrentVersion(), 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add target volume: %v", err)
+	}
+	targetStore.Locations[0].AvailableSpace.Store(0)
+
+	target := &VolumeServer{
+		store:                         targetStore,
+		grpcDialOption:                grpc.WithTransportCredentials(insecure.NewCredentials()),
+		AllowUntrustedRemoteEndpoints: true,
+	}
+	err := target.VolumeCopy(&volume_server_pb.VolumeCopyRequest{
+		VolumeId:       uint32(vid),
+		SourceDataNode: fmt.Sprintf("127.0.0.1:%d.%d", port-10000, port),
+	}, &fakeVolumeCopyStream{})
+	if err == nil {
+		t.Fatal("VolumeCopy should fail when no destination location is available")
+	}
+	if targetStore.GetVolume(vid) == nil {
+		t.Fatal("existing replica was destroyed before a destination was reserved")
+	}
+}
+
+func TestVolumeCopyReplacesReplicaAtSlotLimit(t *testing.T) {
+	const vid = needle.VolumeId(45)
+
+	sourceStore := newVolumeCopyTestStore(t, t.TempDir())
+	if err := sourceStore.AddVolume(vid, "", storage.NeedleMapInMemory, "000", "", 0,
+		needle.GetCurrentVersion(), 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add source volume: %v", err)
+	}
+	source := &volumeCopyStatusServer{
+		delegate:       &VolumeServer{store: sourceStore},
+		failStatusCall: 1,
+		statusErr:      errors.New("source volume status unavailable"),
+	}
+	port := serveGrpc(t, func(server *grpc.Server) {
+		volume_server_pb.RegisterVolumeServerServer(server, source)
+	})
+
+	targetStore := newVolumeCopyTestStore(t, t.TempDir())
+	if err := targetStore.AddVolume(vid, "", storage.NeedleMapInMemory, "000", "", 0,
+		needle.GetCurrentVersion(), 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add target volume: %v", err)
+	}
+	targetStore.Locations[0].MaxVolumeCount = 1
+
+	target := &VolumeServer{
+		store:                         targetStore,
+		grpcDialOption:                grpc.WithTransportCredentials(insecure.NewCredentials()),
+		AllowUntrustedRemoteEndpoints: true,
+	}
+	err := target.VolumeCopy(&volume_server_pb.VolumeCopyRequest{
+		VolumeId:       uint32(vid),
+		SourceDataNode: fmt.Sprintf("127.0.0.1:%d.%d", port-10000, port),
+	}, &fakeVolumeCopyStream{})
+	if err != nil {
+		t.Fatalf("VolumeCopy should replace the replica at the slot limit: %v", err)
+	}
+	if targetStore.GetVolume(vid) == nil {
+		t.Fatal("replaced volume was not mounted")
+	}
+}
+
 // fakeVolumeCopyStream is a no-op VolumeServer_VolumeCopyServer; VolumeCopy
 // errors out before sending anything in this test.
 type fakeVolumeCopyStream struct {
@@ -55,8 +248,9 @@ func TestVolumeCopy_KeepsExistingReplicaWhenSourceUnreachable(t *testing.T) {
 	}
 
 	vs := &VolumeServer{
-		store:          store,
-		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		store:                         store,
+		grpcDialOption:                grpc.WithTransportCredentials(insecure.NewCredentials()),
+		AllowUntrustedRemoteEndpoints: true,
 	}
 
 	// 127.0.0.1:1 is unreachable, so ReadVolumeFileStatus on the source fails.
@@ -73,3 +267,24 @@ func TestVolumeCopy_KeepsExistingReplicaWhenSourceUnreachable(t *testing.T) {
 		t.Fatalf("existing replica %d was destroyed before the source was verified", vid)
 	}
 }
+
+// The copy and tail handlers dial a caller-supplied source address. With the
+// default posture (AllowUntrustedRemoteEndpoints unset) a source on a blocked
+// address must be rejected before any dial; the opt-out flag restores the old
+// behavior for operators whose sources legitimately sit on those ranges.
+func TestCopyTailHandlersRejectUntrustedSources(t *testing.T) {
+	for _, source := range []string{"127.0.0.1:1.10001", "169.254.169.254:0.80"} {
+		vs := &VolumeServer{
+			grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		}
+		if err := vs.VolumeCopy(&volume_server_pb.VolumeCopyRequest{VolumeId: 1, SourceDataNode: source}, &fakeVolumeCopyStream{}); err == nil {
+			t.Errorf("VolumeCopy accepted source %q", source)
+		}
+		if _, err := vs.VolumeEcShardsCopy(context.Background(), &volume_server_pb.VolumeEcShardsCopyRequest{VolumeId: 1, SourceDataNode: source}); err == nil {
+			t.Errorf("VolumeEcShardsCopy accepted source %q", source)
+		}
+		if _, err := vs.VolumeTailReceiver(context.Background(), &volume_server_pb.VolumeTailReceiverRequest{VolumeId: 1, SourceVolumeServer: source}); err == nil {
+			t.Errorf("VolumeTailReceiver accepted source %q", source)
+		}
+	}
+}
diff --git a/weed/server/volume_grpc_ec_generation_fence_test.go b/weed/server/volume_grpc_ec_generation_fence_test.go
index 2b6c8b1e9d..6ec9edff72 100644
--- a/weed/server/volume_grpc_ec_generation_fence_test.go
+++ b/weed/server/volume_grpc_ec_generation_fence_test.go
@@ -149,6 +149,92 @@ func TestUnmountEcShardsFencedByGeneration(t *testing.T) {
 	require.False(t, mountedEcShardIds(t, vs, vid)[1], "a strictly-older generation shard must be unmounted")
 }
 
+// TestTeardownRemovesStagedGenerations pins that a full teardown wipes the
+// 2PC-staged <base>.*.v<N> files together with the canonical ones: they are
+// invisible to EC bookkeeping, so anything left behind leaks forever.
+func TestTeardownRemovesStagedGenerations(t *testing.T) {
+	const collection = "ec-gen-leak"
+	vid := needle.VolumeId(57)
+	dir := t.TempDir()
+	vs := &VolumeServer{store: buildEcStoreWithGeneration(t, dir, collection, vid, 100, []erasure_coding.ShardId{0, 1})}
+
+	base := erasure_coding.EcShardFileName(collection, dir, int(vid))
+	for _, name := range []string{
+		base + ".ec00.v3", base + ".ec01.v3", base + ".ecx.v3", base + ".vif.v3", base + ".ecsum.v3",
+	} {
+		require.NoError(t, os.WriteFile(name, []byte("staged"), 0o644))
+	}
+
+	_, err := vs.VolumeEcShardsDelete(context.Background(), &volume_server_pb.VolumeEcShardsDeleteRequest{
+		VolumeId:     uint32(vid),
+		Collection:   collection,
+		FullTeardown: true,
+		EncodeTsNs:   200,
+	})
+	require.NoError(t, err)
+	left, err := filepath.Glob(base + "*")
+	require.NoError(t, err)
+	require.Empty(t, left, "teardown must leave no EC files, staged generations included: %v", left)
+}
+
+// TestDeleteGenerationsOlderThan covers the post-commit cleanup: staged
+// generations below the threshold are removed while the committed generation
+// and the live canonical files stay untouched.
+func TestDeleteGenerationsOlderThan(t *testing.T) {
+	const collection = "ec-gen-gc"
+	vid := needle.VolumeId(58)
+	dir := t.TempDir()
+	vs := &VolumeServer{store: buildEcStoreWithGeneration(t, dir, collection, vid, 100, []erasure_coding.ShardId{0, 1})}
+
+	base := erasure_coding.EcShardFileName(collection, dir, int(vid))
+	stale := []string{base + ".ec00.v3", base + ".ecx.v3", base + ".vif.v3"}
+	fresh := []string{base + ".ec00.v7", base + ".vif.v7"}
+	for _, name := range append(stale, fresh...) {
+		require.NoError(t, os.WriteFile(name, []byte("staged"), 0o644))
+	}
+
+	_, err := vs.VolumeEcShardsDelete(context.Background(), &volume_server_pb.VolumeEcShardsDeleteRequest{
+		VolumeId:                   uint32(vid),
+		Collection:                 collection,
+		DeleteGenerationsOlderThan: 5,
+	})
+	require.NoError(t, err)
+	for _, name := range stale {
+		require.False(t, util.FileExists(name), "%s must be removed", name)
+	}
+	for _, name := range fresh {
+		require.True(t, util.FileExists(name), "%s must be preserved", name)
+	}
+	require.True(t, util.FileExists(base+".ec00"), "canonical shards must be preserved")
+	require.True(t, util.FileExists(base+".ecx"))
+	require.True(t, util.FileExists(base+".vif"))
+	require.True(t, mountedEcShardIds(t, vs, vid)[0], "mounted shards must stay mounted")
+}
+
+// TestShardDeleteRemovesStagedGenerations pins that deleting a shard removes
+// its staged generations too: a shard evicted off a disk leaves nothing.
+func TestShardDeleteRemovesStagedGenerations(t *testing.T) {
+	const collection = "ec-shard-gen"
+	vid := needle.VolumeId(59)
+	dir := t.TempDir()
+	vs := &VolumeServer{store: buildEcStoreWithGeneration(t, dir, collection, vid, 100, []erasure_coding.ShardId{0, 5})}
+
+	base := erasure_coding.EcShardFileName(collection, dir, int(vid))
+	require.NoError(t, os.WriteFile(base+".ec05.v2", []byte("staged"), 0o644))
+	require.NoError(t, vs.store.UnmountEcShards(vid, 5, 0))
+
+	_, err := vs.VolumeEcShardsDelete(context.Background(), &volume_server_pb.VolumeEcShardsDeleteRequest{
+		VolumeId:   uint32(vid),
+		Collection: collection,
+		ShardIds:   []uint32{5},
+	})
+	require.NoError(t, err)
+	require.False(t, util.FileExists(base+".ec05"))
+	require.False(t, util.FileExists(base+".ec05.v2"))
+	require.True(t, util.FileExists(base+".ec00"), "sibling shards must be preserved")
+	require.True(t, util.FileExists(base+".ecx"), "index must survive while shards remain")
+}
+
 // TestReadEcGenerationTsNs covers the per-disk .vif generation read used by the
 // fenced teardown: a present .vif yields its generation (or 0 when it has no EC
 // config), and a missing .vif is reported unreadable (preserved, fail-safe).
diff --git a/weed/server/volume_grpc_erasure_coding.go b/weed/server/volume_grpc_erasure_coding.go
index 086808d01d..91d4bd9f43 100644
--- a/weed/server/volume_grpc_erasure_coding.go
+++ b/weed/server/volume_grpc_erasure_coding.go
@@ -2,8 +2,10 @@ package weed_server
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"math"
 	"os"
 	"path"
@@ -122,9 +124,6 @@ func (vs *VolumeServer) VolumeEcShardsGenerate(ctx context.Context, req *volume_
 		return nil, fmt.Errorf("WriteSortedFileFromIdx %s: %v", v.IndexFileName(), err)
 	}
 
-	// snapshot .dat file size before encoding — must match what .ecx references
-	datSize, _, _ := v.FileStat()
-
 	// write .ec00 ~ .ec[TotalShards-1] files using context
 	ecBitrot, err := erasure_coding.WriteEcFiles(baseFileName, ecCtx)
 	if err != nil {
@@ -142,16 +141,12 @@ func (vs *VolumeServer) VolumeEcShardsGenerate(ctx context.Context, req *volume_
 	}
 
 	// write .vif files
-	var expireAtSec uint64
-	if v.Ttl != nil {
-		ttlSecond := v.Ttl.ToSeconds()
-		if ttlSecond > 0 {
-			expireAtSec = uint64(time.Now().Unix()) + ttlSecond //calculated expiration time
-		}
-	}
 	volumeInfo := &volume_server_pb.VolumeInfo{Version: uint32(v.Version())}
-	volumeInfo.ExpireAtSec = expireAtSec
-	volumeInfo.DatFileSize = int64(datSize)
+	volumeInfo.ExpireAtSec = v.ExpireAtSec()
+	// The size the encode actually read, not a separate stat: a replica-sync
+	// write can land between two stats of a live .dat, and the .vif would then
+	// record a DatFileSize and a BlockSize describing different files.
+	volumeInfo.DatFileSize = ecCtx.DatFileSize
 
 	// Validate EC configuration before saving to .vif
 	if ecCtx.DataShards <= 0 || ecCtx.ParityShards <= 0 || ecCtx.Total() > erasure_coding.MaxShardCount {
@@ -165,12 +160,20 @@ func (vs *VolumeServer) VolumeEcShardsGenerate(ctx context.Context, req *volume_
 		DataShards:   uint32(ecCtx.DataShards),
 		ParityShards: uint32(ecCtx.ParityShards),
 		EncodeTsNs:   time.Now().UnixNano(),
+		BlockSize:    ecCtx.BlockSize,
 	}
 	glog.V(1).Infof("Saving EC config to .vif for volume %d: %d+%d (total: %d)",
 		req.VolumeId, ecCtx.DataShards, ecCtx.ParityShards, ecCtx.Total())
 
 	if err := volume_info.SaveVolumeInfo(baseFileName+".vif", volumeInfo); err != nil {
-		return nil, fmt.Errorf("SaveVolumeInfo %s: %v", baseFileName, err)
+		var ndErr *volume_info.NotCrashDurableError
+		if !errors.As(err, &ndErr) {
+			return nil, fmt.Errorf("SaveVolumeInfo %s: %v", baseFileName, err)
+		}
+		// The .vif is committed but may not be crash-durable. The EC
+		// config is already on disk, so do not clean up the generated
+		// shard files; a restart will find them and the matching metadata.
+		glog.Warningf("SaveVolumeInfo %s saved but not crash-durable: %v", baseFileName, err)
 	}
 
 	shouldCleanup = false
@@ -239,17 +242,22 @@ func (vs *VolumeServer) VolumeEcShardsRebuild(ctx context.Context, req *volume_s
 	// On multi-disk servers, existing local shards may be on a different disk
 	// than where copied shards were placed during ec.rebuild.
 	rebuildDataDir := rebuildLocation.Directory
-	var additionalDirs []string
-	for _, otherLocation := range otherLocationsWithShards {
-		additionalDirs = append(additionalDirs, otherLocation.Directory)
-	}
+	additionalDirs := rebuildSearchDirs(rebuildLocation, otherLocationsWithShards)
 
 	// Rebuild missing EC files, searching all disk locations for input shards.
 	// Present input shards are verified against the bitrot sidecar (when present)
 	// and corrupt ones are regenerated; unsafe_ignore_sidecar bypasses the guard.
 	start := time.Now()
 	dataBaseFileName := path.Join(rebuildDataDir, baseFileName)
-	generatedShardIds, err := erasure_coding.RebuildEcFiles(dataBaseFileName, erasure_coding.BackgroundECContext(), req.UnsafeIgnoreSidecar, additionalDirs...)
+	// Resolve the layout ONCE and use that same answer for the rebuild and for
+	// the backfill below: a manifest describing these shards has to record the
+	// geometry they were actually reconstructed with.
+	rebuildCtx, resolveErr := erasure_coding.ResolveRebuildECContext(dataBaseFileName, erasure_coding.BackgroundECContext(), additionalDirs)
+	if resolveErr != nil {
+		recordEcRebuild("failure", time.Since(start))
+		return nil, fmt.Errorf("resolve rebuild layout for %s: %v", dataBaseFileName, resolveErr)
+	}
+	generatedShardIds, err := erasure_coding.RebuildEcFiles(dataBaseFileName, rebuildCtx, req.UnsafeIgnoreSidecar, additionalDirs...)
 	if err != nil {
 		recordEcRebuild("failure", time.Since(start))
 		return nil, fmt.Errorf("RebuildEcFiles %s: %v", dataBaseFileName, err)
@@ -260,7 +268,23 @@ func (vs *VolumeServer) VolumeEcShardsRebuild(ctx context.Context, req *volume_s
 	if !util.FileExists(indexBaseFileName+".ecx") && rebuildLocation.IdxDirectory != rebuildLocation.Directory {
 		indexBaseFileName = path.Join(rebuildLocation.Directory, baseFileName)
 	}
-	if err := erasure_coding.RebuildEcxFile(indexBaseFileName); err != nil {
+	if ev, found := rebuildLocation.FindEcVolume(needle.VolumeId(req.VolumeId)); found {
+		// A mounted volume appends runtime deletes through ev.ecjFile, so the
+		// fold runs under its journal lock on the journal's own base, and the
+		// handle is repointed: otherwise RebuildEcxFile's unlink strands later
+		// appends on the detached inode.
+		indexBaseFileName = ev.EcIndexBaseFileName()
+		unlockJournal := ev.LockDeletionJournal()
+		err := erasure_coding.RebuildEcxFile(indexBaseFileName)
+		if err == nil {
+			err = ev.ReopenDeletionJournal()
+		}
+		unlockJournal()
+		if err != nil {
+			recordEcRebuild("failure", time.Since(start))
+			return nil, fmt.Errorf("RebuildEcxFile %s: %v", indexBaseFileName, err)
+		}
+	} else if err := erasure_coding.RebuildEcxFile(indexBaseFileName); err != nil {
 		recordEcRebuild("failure", time.Since(start))
 		return nil, fmt.Errorf("RebuildEcxFile %s: %v", indexBaseFileName, err)
 	}
@@ -273,14 +297,19 @@ func (vs *VolumeServer) VolumeEcShardsRebuild(ctx context.Context, req *volume_s
 	// blesses current bytes; ComputeProtectionFromShards refuses a partial
 	// manifest, so a multi-server rebuild that cannot reach all shards just skips.
 	if erasure_coding.BitrotProtectionEnabled {
-		sidecarPath := erasure_coding.BitrotSidecarPath(dataBaseFileName, 0)
-		if _, statErr := os.Stat(sidecarPath); os.IsNotExist(statErr) {
-			ctx := erasure_coding.NewDefaultECContext("", 0)
-			if vi, _, found, _ := volume_info.MaybeLoadVolumeInfo(dataBaseFileName + ".vif"); found && vi.EcShardConfig != nil {
-				if ds, ps := int(vi.EcShardConfig.DataShards), int(vi.EcShardConfig.ParityShards); ds > 0 && ps > 0 && ds+ps <= erasure_coding.MaxShardCount {
-					ctx = &erasure_coding.ECContext{DataShards: ds, ParityShards: ps}
-				}
-			}
+		// "No sidecar yet" has to be asked of every place one could be, not
+		// just this directory. A split -dir/-dir.idx layout keeps it with the
+		// index and a sibling disk may hold it, and answering from the data
+		// base alone would write a fresh TOFU baseline over a volume that
+		// already has a manifest — blessing whatever the shards currently say
+		// and shadowing the real record, since the data base is searched first.
+		if erasure_coding.FindBitrotSidecar(0, dataBaseFileName, indexBaseFileName, additionalDirs...) == "" {
+			sidecarPath := erasure_coding.BitrotSidecarPath(dataBaseFileName, 0)
+			// The manifest must describe the shards as rebuilt, so it takes the
+			// context the rebuild resolved — not a narrower re-derivation that
+			// reads only this directory's .vif and drops the block size, which
+			// records the legacy layout for shards written with a uniform one.
+			ctx := rebuildCtx
 			if prot, berr := erasure_coding.ComputeProtectionFromShards(dataBaseFileName, ctx, 0, additionalDirs); berr != nil {
 				glog.V(2).Infof("bitrot backfill skipped for %s: %v", dataBaseFileName, berr)
 			} else if werr := erasure_coding.SaveBitrotSidecar(sidecarPath, prot); werr != nil {
@@ -304,6 +333,11 @@ func (vs *VolumeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_serv
 	if err := vs.CheckMaintenanceMode(); err != nil {
 		return nil, err
 	}
+	if !vs.AllowUntrustedRemoteEndpoints {
+		if err := validateReplicaTarget(ctx, req.SourceDataNode); err != nil {
+			return nil, fmt.Errorf("invalid source data node %s: %w", req.SourceDataNode, err)
+		}
+	}
 
 	glog.V(0).Infof("VolumeEcShardsCopy: %v", req)
 
@@ -332,28 +366,54 @@ func (vs *VolumeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_serv
 		location = vs.store.Locations[req.DiskId]
 		glog.V(1).Infof("Using disk %d for EC shard copy: %s", req.DiskId, location.Directory)
 	} else {
-		// Auto-select the target disk: prefer a disk that already has the
-		// EC volume mounted, then a disk that owns the .ecx on disk (the
-		// volume hasn't been mounted yet — relevant for ec.rebuild, where
-		// only the first shard carries .ecx and subsequent shards must
-		// land on the same disk; see #9212), then any HDD, then any disk.
-		// Pass the build's default data-shard count for free-slot maths;
-		// the helper takes it as a parameter so custom-ratio builds (e.g.
-		// enterprise) can swap it without touching this file.
-		location = vs.store.FindEcShardTargetLocation(req.Collection, needle.VolumeId(req.VolumeId), erasure_coding.DataShardsCount)
+		// Auto-select the target disk: prefer a disk that already owns one
+		// of the shards being copied (a retried move must overwrite in
+		// place, not leave two disks of this server claiming the same
+		// shard), then a disk that already has the EC volume mounted, then
+		// a disk that owns the .ecx on disk (the volume hasn't been mounted
+		// yet — relevant for ec.rebuild, where only the first shard carries
+		// .ecx and subsequent shards must land on the same disk; see
+		// #9212), then any HDD, then any disk. Pass the build's default
+		// data-shard count for free-slot maths; the helper takes it as a
+		// parameter so custom-ratio builds (e.g. enterprise) can swap it
+		// without touching this file.
+		shardIds := make([]erasure_coding.ShardId, 0, len(req.ShardIds))
+		for _, shardId := range req.ShardIds {
+			shardIds = append(shardIds, erasure_coding.ShardId(shardId))
+		}
+		// A batch whose requested shards are already owned by different local
+		// disks has no single correct destination: writing them all to one
+		// disk would duplicate the other disks' claims. Refuse so the caller
+		// splits the batch per shard (or chooses explicitly via disk_id).
+		if owners := vs.store.EcShardOwnerDisks(needle.VolumeId(req.VolumeId), shardIds); len(owners) > 1 {
+			dirs := make([]string, 0, len(owners))
+			for _, owner := range owners {
+				dirs = append(dirs, owner.Directory)
+			}
+			return nil, fmt.Errorf("volume %d shards %v are already owned by multiple local disks %v: no single destination; copy per shard or pass disk_id", req.VolumeId, req.ShardIds, dirs)
+		}
+		location = vs.store.FindEcShardTargetLocation(req.Collection, needle.VolumeId(req.VolumeId), erasure_coding.DataShardsCount, shardIds...)
 		if location == nil {
-			return nil, fmt.Errorf("no space left")
+			return nil, status.Error(codes.ResourceExhausted, "no space left")
 		}
 	}
 
 	dataBaseFileName := storage.VolumeFileName(location.Directory, req.Collection, int(req.VolumeId))
 	indexBaseFileName := storage.VolumeFileName(location.IdxDirectory, req.Collection, int(req.VolumeId))
 
-	err := operation.WithVolumeServerClient(true, pb.ServerAddress(req.SourceDataNode), vs.grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+	// One throttler for the whole request, so the limit caps the transfer as a
+	// whole rather than each file separately — same shape as VolumeCopy.
+	ioBytePerSecond := vs.maintenanceBytePerSecond
+	if req.IoBytePerSecond > 0 {
+		ioBytePerSecond = req.IoBytePerSecond
+	}
+	throttler := util.NewWriteThrottler(ioBytePerSecond)
+
+	err := operation.WithVolumeServerClientOptions(true, pb.ServerAddress(req.SourceDataNode), func(client volume_server_pb.VolumeServerClient) error {
 
 		// copy ec data slices
 		for _, shardId := range req.ShardIds {
-			if _, err := vs.doCopyFile(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, dataBaseFileName, erasure_coding.ToExt(int(shardId)), false, false, nil); err != nil {
+			if _, err := vs.doCopyFileWithThrottler(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, dataBaseFileName, erasure_coding.ToExt(int(shardId)), false, false, nil, throttler); err != nil {
 				return err
 			}
 		}
@@ -361,7 +421,7 @@ func (vs *VolumeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_serv
 		if req.CopyEcxFile {
 
 			// copy ecx file
-			if _, err := vs.doCopyFile(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, indexBaseFileName, ".ecx", false, false, nil); err != nil {
+			if _, err := vs.doCopyFileWithThrottler(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, indexBaseFileName, ".ecx", false, false, nil, throttler); err != nil {
 				return err
 			}
 			// Defense in depth: writeToFile now removes partial files on
@@ -393,15 +453,16 @@ func (vs *VolumeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_serv
 		}
 
 		if req.CopyEcjFile {
-			// copy ecj file
-			if _, err := vs.doCopyFile(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, indexBaseFileName, ".ecj", true, true, nil); err != nil {
+			// The journal is a *set* of ids: merge the source's into the
+			// local one as a union, never append it whole.
+			if err := vs.copyEcjAndMerge(client, req.Collection, req.VolumeId, location.Directory, indexBaseFileName, throttler); err != nil {
 				return err
 			}
 		}
 
 		if req.CopyVifFile {
 			// copy vif file
-			if _, err := vs.doCopyFile(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, dataBaseFileName, ".vif", false, true, nil); err != nil {
+			if _, err := vs.doCopyFileWithThrottler(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, dataBaseFileName, ".vif", false, true, nil, throttler); err != nil {
 				return err
 			}
 		}
@@ -412,12 +473,12 @@ func (vs *VolumeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_serv
 			// distribution) has no Prepare backstop, and fresh-encode sidecar
 			// writes are best-effort, so a missing source sidecar is a no-op
 			// (ignore-not-found): the holder is simply unprotected.
-			if _, err := vs.doCopyFile(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, dataBaseFileName, erasure_coding.BitrotSidecarExt, false, true, nil); err != nil {
+			if _, err := vs.doCopyFileWithThrottler(client, true, req.Collection, req.VolumeId, math.MaxUint32, math.MaxInt64, dataBaseFileName, erasure_coding.BitrotSidecarExt, false, true, nil, throttler); err != nil {
 				return fmt.Errorf("VolumeEcShardsCopy volume %d: copy %s sidecar: %w", req.VolumeId, erasure_coding.BitrotSidecarExt, err)
 			}
 		}
 		return nil
-	})
+	}, vs.grpcDialOption, vs.guardedGrpcDialOption(req.SourceDataNode))
 	if err != nil {
 		return nil, fmt.Errorf("VolumeEcShardsCopy volume %d: %v", req.VolumeId, err)
 	}
@@ -425,15 +486,69 @@ func (vs *VolumeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_serv
 	return &volume_server_pb.VolumeEcShardsCopyResponse{}, nil
 }
 
+// copyEcjAndMerge folds the source peer's .ecj into the local journal of vid
+// as a set union: only ids the local journal lacks are appended, so a
+// shard bounced between servers cannot grow it. The source journal streams
+// straight into memory — no staging file — and a source without one is not an
+// error. destDir is the receiving disk's data directory and destBase its index
+// base name.
+func (vs *VolumeServer) copyEcjAndMerge(client volume_server_pb.VolumeServerClient, collection string, vid uint32, destDir, destBase string, throttler *util.WriteThrottler) error {
+	stream, err := client.CopyFile(context.Background(), &volume_server_pb.CopyFileRequest{
+		VolumeId:                 vid,
+		Ext:                      ".ecj",
+		CompactionRevision:       math.MaxUint32,
+		StopOffset:               math.MaxInt64,
+		Collection:               collection,
+		IsEcVolume:               true,
+		IgnoreSourceFileNotFound: true,
+	})
+	if err != nil {
+		return fmt.Errorf("volume %d: start copying .ecj: %w", vid, err)
+	}
+	ids, found, err := receiveEcjIds(stream, throttler)
+	if err != nil {
+		return fmt.Errorf("volume %d: copy .ecj: %w", vid, err)
+	}
+	if !found {
+		return nil
+	}
+	if _, err := vs.store.MergeEcJournal(needle.VolumeId(vid), destDir, destBase+".ecj", ids); err != nil {
+		return fmt.Errorf("volume %d: merge .ecj: %w", vid, err)
+	}
+	return nil
+}
+
+// receiveEcjIds decodes a CopyFile stream of an .ecj into its distinct ids.
+// found is false only when the source has no journal, which the source
+// signals with neither a modified time nor any bytes; an empty journal still
+// carries its modified time.
+func receiveEcjIds(stream volume_server_pb.VolumeServer_CopyFileClient, throttler *util.WriteThrottler) (ids map[types.NeedleId]struct{}, found bool, err error) {
+	decoder := erasure_coding.NewEcjIdDecoder()
+	for {
+		resp, recvErr := stream.Recv()
+		if recvErr == io.EOF {
+			break
+		}
+		if recvErr != nil {
+			return nil, false, recvErr
+		}
+		if resp.ModifiedTsNs != 0 || len(resp.FileContent) > 0 {
+			found = true
+		}
+		decoder.Write(resp.FileContent)
+		throttler.MaybeSlowdown(int64(len(resp.FileContent)))
+	}
+	return decoder.Ids(), found, nil
+}
+
 // VolumeEcShardsDelete local delete the .ecx and some ec data slices if not needed
 // the shard should not be mounted before calling this.
+// Allowed in maintenance mode: like VolumeDelete it only removes data, and
+// evacuating EC shards off a server in maintenance mode ends here (issue #11066).
 func (vs *VolumeServer) VolumeEcShardsDelete(ctx context.Context, req *volume_server_pb.VolumeEcShardsDeleteRequest) (*volume_server_pb.VolumeEcShardsDeleteResponse, error) {
 	if err := vs.checkGrpcAdminAuth(ctx); err != nil {
 		return nil, err
 	}
-	if err := vs.CheckMaintenanceMode(); err != nil {
-		return nil, err
-	}
 
 	bName := erasure_coding.EcShardBaseFileName(req.Collection, int(req.VolumeId))
 
@@ -475,6 +590,27 @@ func (vs *VolumeServer) VolumeEcShardsDelete(ctx context.Context, req *volume_se
 		return &volume_server_pb.VolumeEcShardsDeleteResponse{FullTeardownDone: true}, nil
 	}
 
+	if req.DeleteGenerationsOlderThan > 0 {
+		// Post-commit cleanup of a 2PC generation switch: the committed
+		// generation has been promoted to the canonical names, so only the
+		// staged <base>.*.v<N> files strictly older than the threshold are
+		// superseded and safe to remove. Versioned files are never mounted,
+		// so nothing needs to be unloaded first.
+		for _, location := range vs.store.Locations {
+			dataBase := storage.VolumeFileName(location.Directory, req.Collection, int(req.VolumeId))
+			idxBase := storage.VolumeFileName(location.IdxDirectory, req.Collection, int(req.VolumeId))
+			if err := erasure_coding.RemoveEcGenerationFiles(dataBase, req.DeleteGenerationsOlderThan); err != nil {
+				return nil, fmt.Errorf("ec generation cleanup of volume %d on %s: %w", req.VolumeId, location.Directory, err)
+			}
+			if dataBase != idxBase {
+				if err := erasure_coding.RemoveEcGenerationFiles(idxBase, req.DeleteGenerationsOlderThan); err != nil {
+					return nil, fmt.Errorf("ec generation cleanup of volume %d on %s: %w", req.VolumeId, location.IdxDirectory, err)
+				}
+			}
+		}
+		return &volume_server_pb.VolumeEcShardsDeleteResponse{}, nil
+	}
+
 	glog.V(0).Infof("ec volume %s shard delete %v", bName, req.ShardIds)
 
 	// Pass 1: delete the requested shard files (and any now-orphaned per-disk bitrot
@@ -527,14 +663,37 @@ func deleteEcShardIdsForEachLocation(bName string, location *storage.DiskLocatio
 	// Delete the requested shard files unconditionally. Gating on a local .ecx
 	// (still used for index-file routing below) would leak an orphan shard left
 	// by a failed copy that reconciliation later mounts under a foreign index.
+	shardFileNames := make([]string, 0, len(shardIds))
 	for _, shardId := range shardIds {
-		shardFileName := dataBaseFilename + erasure_coding.ToExt(int(shardId))
-		if util.FileExists(shardFileName) {
-			found = true
-			if err := removeFileIfExists(shardFileName); err != nil {
-				return fmt.Errorf("remove ec shard %s: %w", shardFileName, err)
+		shardFileNames = append(shardFileNames, dataBaseFilename+erasure_coding.ToExt(int(shardId)))
+	}
+	// The shard and every 2PC generation of it (<name>.v<N>) are removed:
+	// the shard must not live on this disk at all. Names match literally —
+	// a glob would let glob metacharacters in the collection part of bName
+	// leak into another volume's files.
+	entries, readErr := os.ReadDir(location.Directory)
+	switch {
+	case readErr == nil:
+		for _, entry := range entries {
+			for _, shardFileName := range shardFileNames {
+				name := filepath.Join(location.Directory, entry.Name())
+				if name != shardFileName && erasure_coding.EcFileGeneration(entry.Name(), filepath.Base(shardFileName)) < 0 {
+					continue
+				}
+				if util.FileExists(name) {
+					found = true
+					if err := removeFileIfExists(name); err != nil {
+						return fmt.Errorf("remove ec shard %s: %w", name, err)
+					}
+				}
 			}
 		}
+	case errors.Is(readErr, fs.ErrNotExist):
+		// No such directory means no shard files on this disk.
+	default:
+		// A listing failure must not fall back to canonical names only:
+		// staged .v<N> files would survive while the RPC reports success.
+		return fmt.Errorf("list %s for ec shards of %s: %w", location.Directory, bName, readErr)
 	}
 
 	if !found {
@@ -592,13 +751,13 @@ func removeEcSharedIndexFiles(bName string, location *storage.DiskLocation, hasE
 	dataBaseFilename := path.Join(location.Directory, bName)
 	if hasEcxFile {
 		// .ecx/.ecj may be in either dir depending on when -dir.idx was configured.
-		for _, p := range []string{indexBaseFilename + ".ecx", indexBaseFilename + ".ecj"} {
+		for _, p := range []string{indexBaseFilename + ".ecx", indexBaseFilename + ".ecj", indexBaseFilename + erasure_coding.EcjCompactTmpExt} {
 			if err := removeFileIfExists(p); err != nil {
 				return err
 			}
 		}
 		if location.IdxDirectory != location.Directory {
-			for _, p := range []string{dataBaseFilename + ".ecx", dataBaseFilename + ".ecj"} {
+			for _, p := range []string{dataBaseFilename + ".ecx", dataBaseFilename + ".ecj", dataBaseFilename + erasure_coding.EcjCompactTmpExt} {
 				if err := removeFileIfExists(p); err != nil {
 					return err
 				}
@@ -662,13 +821,22 @@ func removeStaleEcArtifacts(dataBaseFileName, indexBaseFileName string, total in
 	// .ecx/.ecj/.ecsum may sit in either dir depending on -dir.idx; clear both.
 	record(removeFileIfExists(indexBaseFileName + ".ecx"))
 	record(removeFileIfExists(indexBaseFileName + ".ecj"))
+	record(removeFileIfExists(indexBaseFileName + erasure_coding.EcjCompactTmpExt))
 	record(removeBitrotSidecars(indexBaseFileName))
 	if dataBaseFileName != indexBaseFileName {
 		record(removeFileIfExists(dataBaseFileName + ".ecx"))
 		record(removeFileIfExists(dataBaseFileName + ".ecj"))
+		record(removeFileIfExists(dataBaseFileName + erasure_coding.EcjCompactTmpExt))
 		record(removeBitrotSidecars(dataBaseFileName))
 	}
 
+	// Generations staged by the 2PC switch are <base>.ecNN.v<N> plus the
+	// versioned .ecx/.ecj/.vif/.ecsum: a teardown of this disk leaves none.
+	record(erasure_coding.RemoveEcGenerationFiles(dataBaseFileName, 0))
+	if dataBaseFileName != indexBaseFileName {
+		record(erasure_coding.RemoveEcGenerationFiles(indexBaseFileName, 0))
+	}
+
 	// Canonical <base>.vif. A shard copy installs shards + .ecx before .vif, so an
 	// interrupted copy can leave a stale .vif whose run identity / shard ratio /
 	// dat_file_size a fresh generation would inherit. Remove it only on a shard-only
@@ -702,6 +870,36 @@ func removeBitrotSidecars(baseFilename string) error {
 	return firstErr
 }
 
+// rebuildSearchDirs lists every directory besides the rebuild's own data
+// directory that a rebuild may have to read from. Shards are only half of it:
+// a split -dir/-dir.idx layout keeps .ecx/.ecj/.vif with the index, and on a
+// multi-disk server the chosen disk may hold nothing but shards while the
+// volume's .vif or generation-0 .ecsum sits on a sibling. Miss those and the
+// layout resolution falls back to the default ratio and the legacy block
+// size, reconstructing through the wrong matrix. The rebuild's own INDEX
+// directory belongs here too — callers pass the data-directory base name, so
+// it is not otherwise searched. Empty and duplicate entries are dropped.
+func rebuildSearchDirs(rebuildLocation *storage.DiskLocation, otherLocations []*storage.DiskLocation) []string {
+	var dirs []string
+	appendDir := func(dir string) {
+		if dir == "" || dir == rebuildLocation.Directory {
+			return
+		}
+		for _, existing := range dirs {
+			if existing == dir {
+				return
+			}
+		}
+		dirs = append(dirs, dir)
+	}
+	appendDir(rebuildLocation.IdxDirectory)
+	for _, otherLocation := range otherLocations {
+		appendDir(otherLocation.Directory)
+		appendDir(otherLocation.IdxDirectory)
+	}
+	return dirs
+}
+
 func checkEcVolumeStatus(bName string, location *storage.DiskLocation) (hasEcxFile bool, hasIdxFile bool, existingShardCount int, err error) {
 	// check whether to delete the .ecx and .ecj file also
 	fileInfos, err := os.ReadDir(location.Directory)
@@ -774,6 +972,27 @@ func (vs *VolumeServer) VolumeEcShardsMount(ctx context.Context, req *volume_ser
 		}
 	}
 
+	// A shard delivery can bring the checksum manifest with it, but the receive
+	// path only writes the file. When this server already had the volume
+	// mounted, the EcVolume in memory keeps whatever protection state it
+	// resolved at mount — off, for a volume whose sidecar arrives now — until a
+	// remount. Re-resolve it here, where the shards it describes were added.
+	// Every per-disk runtime, not just the first: a vid mounts as one EcVolume
+	// per disk, the delivery lands the .ecsum on one of them, and the
+	// first-match FindEcVolume would leave the siblings reporting no protection
+	// until a remount. Each re-resolves against its own data and index base, so
+	// a shared -dir.idx reaches all of them.
+	//
+	// Resolving across every EC metadata directory is what makes that reload
+	// mean something. Startup mirroring gives each shard-bearing disk its own
+	// .ecx/.ecj/.vif but deliberately not the sidecar, so a runtime restricted
+	// to its own two directories would find nothing however often it reloaded.
+	// One delivered copy, reachable from all of them.
+	ecMetadataDirs := vs.store.EcMetadataDirs()
+	for _, v := range vs.store.FindAllEcVolumes(needle.VolumeId(req.VolumeId)) {
+		v.ReloadBitrotSidecar(ecMetadataDirs...)
+	}
+
 	return &volume_server_pb.VolumeEcShardsMountResponse{}, nil
 }
 
@@ -845,6 +1064,12 @@ func (vs *VolumeServer) VolumeEcShardRead(req *volume_server_pb.VolumeEcShardRea
 		}
 		bytesread, err := ecShard.ReadAt(buffer[0:bufferSize], startOffset)
 
+		if err != nil && err != io.EOF {
+			ecVolume.CheckReadWriteError(err)
+		} else {
+			ecVolume.CheckReadWriteError(nil)
+		}
+
 		// println("read", ecShard.FileName(), "startOffset", startOffset, bytesread, "bytes, with target", bufferSize)
 		if bytesread > 0 {
 
@@ -929,6 +1154,11 @@ func (vs *VolumeServer) VolumeEcShardsToVolume(ctx context.Context, req *volume_
 		return vs.adoptStagedVolume(req)
 	}
 
+	if _, loaded := vs.ecDecodesInFlight.LoadOrStore(req.VolumeId, struct{}{}); loaded {
+		return nil, status.Errorf(codes.Unavailable, "ec volume %d is already being decoded", req.VolumeId)
+	}
+	defer vs.ecDecodesInFlight.Delete(req.VolumeId)
+
 	// Collect all EC shards (NewEcVolume will load EC config from .vif into v.ECContext)
 	// Use MaxShardCount (32) to support custom EC ratios up to 32 total shards
 	tempShards := make([]string, erasure_coding.MaxShardCount)
@@ -959,18 +1189,50 @@ func (vs *VolumeServer) VolumeEcShardsToVolume(ctx context.Context, req *volume_
 		}
 	}
 
-	dataBaseFileName, indexBaseFileName := v.DataBaseFileName(), v.IndexBaseFileName()
-	if !util.FileExists(indexBaseFileName + ".ecx") {
-		indexBaseFileName = dataBaseFileName
+	dataBaseFileName := v.DataBaseFileName()
+	// The fold and the index write must work on the same .ecj that runtime
+	// deletes append to through ecjFile — the volume's resolved index dir,
+	// which can differ from IndexBaseFileName when an .ecx copy exists in
+	// both the data and index directories.
+	indexBaseFileName := v.EcIndexBaseFileName()
+
+	// Resolve the offline-compaction location before taking the journal
+	// lock: FindEcVolume takes the ec-volume map lock, and acquiring it inside
+	// the journal lock inverts DestroyEcVolume's map->journal order — a decode
+	// holding the journal lock while waiting on the map deadlocks a destroy
+	// holding the map lock while waiting on the journal.
+	var volumeLocation *storage.DiskLocation
+	for _, location := range vs.store.Locations {
+		if candidate, found := location.FindEcVolume(needle.VolumeId(req.VolumeId)); found && candidate == v {
+			volumeLocation = location
+			break
+		}
+	}
+	if volumeLocation == nil {
+		return nil, fmt.Errorf("ec volume %d location not found for offline compaction", req.VolumeId)
 	}
 
 	// Merge .ecj deletions into .ecx so that HasLiveNeedles and FindDatFileSize
 	// see the full set of deleted needles. Without this, needles deleted after the
 	// last ecx rebuild would still appear live, causing the decoded .dat to include
 	// data that should be skipped and HasLiveNeedles to return a false positive.
+	//
+	// The journal lock is held across the fold: RebuildEcxFile unlinks .ecj,
+	// and a delete committed between its read and the unlink would land on the
+	// detached inode that ecjFile keeps open — synced, successful, and
+	// invisible to every path-based reader. ReopenDeletionJournal then points
+	// the handle back at a fresh journal, so deletes committed during the .dat
+	// rebuild stay durable and reach the index write below.
+	unlockJournal := v.LockDeletionJournal()
 	if err := erasure_coding.RebuildEcxFile(indexBaseFileName); err != nil {
+		unlockJournal()
 		return nil, fmt.Errorf("RebuildEcxFile %s: %v", indexBaseFileName, err)
 	}
+	if err := v.ReopenDeletionJournal(); err != nil {
+		unlockJournal()
+		return nil, fmt.Errorf("reopen deletion journal %s: %v", indexBaseFileName, err)
+	}
+	unlockJournal()
 
 	// If the EC index contains no live entries, decoding should be a no-op:
 	// just allow the caller to purge EC shards and do not generate an empty normal volume.
@@ -982,10 +1244,12 @@ func (vs *VolumeServer) VolumeEcShardsToVolume(ctx context.Context, req *volume_
 		return nil, status.Errorf(codes.FailedPrecondition, "ec volume %d %s", req.VolumeId, erasure_coding.EcNoLiveEntriesSubstring)
 	}
 
-	// calculate .dat file size
-	datFileSize, err := erasure_coding.FindDatFileSize(dataBaseFileName, indexBaseFileName)
+	// calculate .dat file size. Pass shard 0's resolved path: on a multi-disk
+	// server the volume's shards can sit on several disks, so the .ec00 is not
+	// necessarily beside the EcVolume's own base path.
+	datFileSize, err := erasure_coding.FindDatFileSize(shardFileNames[0], indexBaseFileName)
 	if err != nil {
-		return nil, fmt.Errorf("FindDatFileSize %s: %v", dataBaseFileName, err)
+		return nil, fmt.Errorf("FindDatFileSize %s: %v", shardFileNames[0], err)
 	}
 
 	// The shard block layout was fixed by the .dat size at encode time (recorded
@@ -993,10 +1257,22 @@ func (vs *VolumeServer) VolumeEcShardsToVolume(ctx context.Context, req *volume_
 	// boundary, so the layout must not be derived from datFileSize. WriteDatFile
 	// infers the layout from the shard size when .vif does not record it.
 	// write .dat file from .ec00 ~ .ec09 files
-	if err := erasure_coding.WriteDatFile(dataBaseFileName, datFileSize, v.DatFileSize(), shardFileNames); err != nil {
+	if err := erasure_coding.WriteDatFile(dataBaseFileName, datFileSize, v.DatFileSize(), shardFileNames, v.ECContext.LargeBlockSize(), v.ECContext.SmallBlockSize()); err != nil {
 		return nil, fmt.Errorf("WriteDatFile %s: %v", dataBaseFileName, err)
 	}
 
+	// Fail the decode rather than report a short volume: the caller deletes the
+	// shards once this call returns, and today its only check is that the files
+	// are non-empty.
+	if err := erasure_coding.VerifyDecodedDatFile(dataBaseFileName, datFileSize); err != nil {
+		return nil, err
+	}
+
+	// Runtime deletes serialize on the volume's journal lock; holding it from
+	// the journal-consuming index write through the offline compaction keeps a
+	// committed delete from slipping past the rebuilt .idx.
+	defer v.LockDeletionJournal()()
+
 	// write .idx file from .ecx and .ecj files
 	if err := erasure_coding.WriteIdxFileFromEcIndex(indexBaseFileName); err != nil {
 		return nil, fmt.Errorf("WriteIdxFileFromEcIndex %s: %v", v.IndexBaseFileName(), err)
@@ -1009,17 +1285,6 @@ func (vs *VolumeServer) VolumeEcShardsToVolume(ctx context.Context, req *volume_
 		removeBitrotSidecars(indexBaseFileName)
 	}
 
-	var volumeLocation *storage.DiskLocation
-	for _, location := range vs.store.Locations {
-		if candidate, found := location.FindEcVolume(needle.VolumeId(req.VolumeId)); found && candidate == v {
-			volumeLocation = location
-			break
-		}
-	}
-	if volumeLocation == nil {
-		return nil, fmt.Errorf("ec volume %d location not found for offline compaction", req.VolumeId)
-	}
-
 	if err := vs.store.CompactVolumeFiles(
 		needle.VolumeId(req.VolumeId),
 		v.Collection,
@@ -1029,6 +1294,13 @@ func (vs *VolumeServer) VolumeEcShardsToVolume(ctx context.Context, req *volume_
 		0,
 		vs.compactionBytePerSecond,
 	); err != nil {
+		// Benign only when the swap never started or was settled: a surviving
+		// .cpc marker means the commit was decided but the renames could not
+		// be reconciled, so .dat/.idx may be a mismatched pair — fail the
+		// decode and let the caller keep the shards.
+		if util.FileExists(dataBaseFileName + ".cpc") {
+			return nil, fmt.Errorf("CompactVolumeFiles %s: %w", dataBaseFileName, err)
+		}
 		glog.Errorf("CompactVolumeFiles %s: %v", dataBaseFileName, err)
 	}
 
@@ -1103,7 +1375,7 @@ func (vs *VolumeServer) adoptStagedVolume(req *volume_server_pb.VolumeEcShardsTo
 	}
 	os.Remove(noteFile)
 
-	if err := vs.store.MountVolume(vid); err != nil {
+	if err := vs.store.MountVolume(vid, &req.Collection); err != nil {
 		return nil, fmt.Errorf("mount staged volume %d: %w", req.VolumeId, err)
 	}
 	glog.V(0).Infof("VolumeEcShardsToVolume: adopted decoded volume %d from staging (%s)", req.VolumeId, base)
@@ -1162,11 +1434,25 @@ func (vs *VolumeServer) VolumeEcShardsInfo(ctx context.Context, req *volume_serv
 		return nil, err
 	}
 
+	// Report the layout this holder will actually serve reads through. It is
+	// the only way a coordinator can tell a holder that understands the
+	// uniform block layout from one that dropped the unknown .vif field on the
+	// floor and mounted the volume as legacy.
+	var ecShardConfig *volume_server_pb.EcShardConfig
+	if primary.ECContext != nil {
+		ecShardConfig = &volume_server_pb.EcShardConfig{
+			DataShards:   uint32(primary.ECContext.DataShards),
+			ParityShards: uint32(primary.ECContext.ParityShards),
+			BlockSize:    primary.ECContext.BlockSize,
+		}
+	}
+
 	res := &volume_server_pb.VolumeEcShardsInfoResponse{
 		EcShardInfos:     shardInfos,
 		FileCount:        files,
 		FileDeletedCount: filesDeleted,
 		VolumeSize:       totalSize,
+		EcShardConfig:    ecShardConfig,
 	}
 
 	return res, nil
diff --git a/weed/server/volume_grpc_erasure_coding_dirs_test.go b/weed/server/volume_grpc_erasure_coding_dirs_test.go
new file mode 100644
index 0000000000..4516fca6fa
--- /dev/null
+++ b/weed/server/volume_grpc_erasure_coding_dirs_test.go
@@ -0,0 +1,73 @@
+package weed_server
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+)
+
+func loc(dir, idxDir string) *storage.DiskLocation {
+	return &storage.DiskLocation{Directory: dir, IdxDirectory: idxDir}
+}
+
+// The rebuild reads its shards from one directory but resolves the volume's
+// layout — ratio and uniform block size — from the .vif or the generation-0
+// .ecsum, which on a multi-disk server may sit anywhere. Every directory that
+// could hold one has to be in the search list, or the resolution silently
+// falls back to 10+4 with the legacy striping and reconstructs through the
+// wrong matrix.
+func TestRebuildSearchDirs(t *testing.T) {
+	tests := []struct {
+		name    string
+		rebuild *storage.DiskLocation
+		others  []*storage.DiskLocation
+		want    []string
+	}{
+		{
+			name:    "the rebuild's own index directory is searched",
+			rebuild: loc("/data1", "/idx1"),
+			want:    []string{"/idx1"},
+		},
+		{
+			name:    "an unsplit rebuild location contributes nothing",
+			rebuild: loc("/data1", "/data1"),
+			want:    nil,
+		},
+		{
+			// The case two reviewers flagged: a sibling holding only shards
+			// while its index directory holds this volume's .vif.
+			name:    "a sibling's index directory is searched, not just its data directory",
+			rebuild: loc("/data1", "/data1"),
+			others:  []*storage.DiskLocation{loc("/data2", "/idx2")},
+			want:    []string{"/data2", "/idx2"},
+		},
+		{
+			name:    "shared index directories are listed once",
+			rebuild: loc("/data1", "/shared-idx"),
+			others:  []*storage.DiskLocation{loc("/data2", "/shared-idx"), loc("/data3", "/shared-idx")},
+			want:    []string{"/shared-idx", "/data2", "/data3"},
+		},
+		{
+			name:    "the rebuild's data directory is never repeated",
+			rebuild: loc("/data1", "/idx1"),
+			others:  []*storage.DiskLocation{loc("/data1", "/idx1"), loc("/data2", "/data1")},
+			want:    []string{"/idx1", "/data2"},
+		},
+		{
+			name:    "empty directories are dropped",
+			rebuild: loc("/data1", ""),
+			others:  []*storage.DiskLocation{loc("/data2", "")},
+			want:    []string{"/data2"},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := rebuildSearchDirs(tc.rebuild, tc.others)
+			if !reflect.DeepEqual(got, tc.want) {
+				t.Errorf("rebuildSearchDirs() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/weed/server/volume_grpc_erasure_coding_ecj_test.go b/weed/server/volume_grpc_erasure_coding_ecj_test.go
new file mode 100644
index 0000000000..a4a61508fc
--- /dev/null
+++ b/weed/server/volume_grpc_erasure_coding_ecj_test.go
@@ -0,0 +1,80 @@
+package weed_server
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func ecjStreamBytes(ids ...types.NeedleId) []byte {
+	b := make([]byte, len(ids)*types.NeedleIdSize)
+	for i, id := range ids {
+		types.NeedleIdToBytes(b[i*types.NeedleIdSize:], id)
+	}
+	return b
+}
+
+func TestReceiveEcjIds(t *testing.T) {
+	journal := ecjStreamBytes(1, 2, 3, 2)
+	tests := []struct {
+		name      string
+		responses []*volume_server_pb.CopyFileResponse
+		wantIds   []types.NeedleId
+		wantFound bool
+	}{
+		{
+			name:      "source has no journal",
+			responses: nil,
+		},
+		{
+			name:      "empty journal still carries its modified time",
+			responses: []*volume_server_pb.CopyFileResponse{{ModifiedTsNs: 42}},
+			wantFound: true,
+		},
+		{
+			// A source that cannot read its journal's mtime reports 0; its
+			// bytes still count (the Rust server sends unwrap_or(0)).
+			name:      "bytes without a modified time",
+			responses: []*volume_server_pb.CopyFileResponse{{FileContent: journal}},
+			wantIds:   []types.NeedleId{1, 2, 3},
+			wantFound: true,
+		},
+		{
+			name: "records split across chunks",
+			responses: []*volume_server_pb.CopyFileResponse{
+				{FileContent: journal[:5], ModifiedTsNs: 7},
+				{FileContent: journal[5:19]},
+				{FileContent: journal[19:]},
+			},
+			wantIds:   []types.NeedleId{1, 2, 3},
+			wantFound: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			stream := &fakeCopyFileStream{responses: tt.responses}
+			ids, found, err := receiveEcjIds(stream, util.NewWriteThrottler(0))
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantFound, found)
+			got := make([]types.NeedleId, 0, len(ids))
+			for id := range ids {
+				got = append(got, id)
+			}
+			assert.ElementsMatch(t, tt.wantIds, got)
+		})
+	}
+}
+
+func TestReceiveEcjIds_StreamError(t *testing.T) {
+	stream := &fakeCopyFileStream{
+		responses: []*volume_server_pb.CopyFileResponse{{FileContent: ecjStreamBytes(1), ModifiedTsNs: 1}},
+		finalErr:  errors.New("peer went away"),
+	}
+	_, _, err := receiveEcjIds(stream, util.NewWriteThrottler(0))
+	assert.Error(t, err)
+}
diff --git a/weed/server/volume_grpc_erasure_coding_recover.go b/weed/server/volume_grpc_erasure_coding_recover.go
index c05def22fc..3e28b4ae81 100644
--- a/weed/server/volume_grpc_erasure_coding_recover.go
+++ b/weed/server/volume_grpc_erasure_coding_recover.go
@@ -13,6 +13,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 // ecRecoveryLookupTimeout bounds the master LookupEcVolume call so a slow or
@@ -119,7 +120,6 @@ func (vs *VolumeServer) fetchEcIndexFromPeers(peers []pb.ServerAddress, m storag
 	idxBaseFileName := storage.VolumeFileName(m.IdxDir, m.Collection, int(m.VolumeId))
 	dataBaseFileName := storage.VolumeFileName(m.DataDir, m.Collection, int(m.VolumeId))
 	ecxPath := idxBaseFileName + ".ecx"
-	ecjPath := idxBaseFileName + ".ecj"
 
 	removePartial := func(path string) {
 		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
@@ -145,12 +145,12 @@ func (vs *VolumeServer) fetchEcIndexFromPeers(peers []pb.ServerAddress, m storag
 			}
 			// .ecj is the source peer's deletion journal; .vif carries EC params
 			// and EncodeTsNs. Both are best-effort: a missing .ecj is recreated at
-			// mount and a missing .vif falls back to default EC parameters. A failed
-			// .ecj copy is an in-place append, so drop the partial file; the .vif
-			// copy stages and renames, leaving nothing to clean up.
-			if _, err := vs.doCopyFile(client, true, m.Collection, uint32(m.VolumeId), math.MaxUint32, math.MaxInt64, idxBaseFileName, ".ecj", true, true, nil); err != nil {
+			// mount and a missing .vif falls back to default EC parameters. The
+			// journal is a *set*: merge it as a union so a bounced volume
+			// cannot double it. The merge only appends whole records, and the
+			// .vif copy stages and renames, so a failure leaves nothing to clean.
+			if err := vs.copyEcjAndMerge(client, m.Collection, uint32(m.VolumeId), m.DataDir, idxBaseFileName, util.NewWriteThrottler(vs.maintenanceBytePerSecond)); err != nil {
 				glog.Warningf("ec volume %d: copy .ecj from %s: %v", m.VolumeId, peer, err)
-				removePartial(ecjPath)
 			}
 			if _, err := vs.doCopyFile(client, true, m.Collection, uint32(m.VolumeId), math.MaxUint32, math.MaxInt64, dataBaseFileName, ".vif", false, true, nil); err != nil {
 				glog.Warningf("ec volume %d: copy .vif from %s: %v", m.VolumeId, peer, err)
diff --git a/weed/server/volume_grpc_erasure_coding_recover_test.go b/weed/server/volume_grpc_erasure_coding_recover_test.go
index 9f21edc94e..36689cd747 100644
--- a/weed/server/volume_grpc_erasure_coding_recover_test.go
+++ b/weed/server/volume_grpc_erasure_coding_recover_test.go
@@ -1,6 +1,7 @@
 package weed_server
 
 import (
+	"bytes"
 	"context"
 	"net"
 	"os"
@@ -18,6 +19,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
@@ -108,10 +110,15 @@ func TestFetchEcIndexFromPeers_CopiesIndexOverGrpc(t *testing.T) {
 	if err := os.WriteFile(srcBase+".ecx", ecxBytes, 0o644); err != nil {
 		t.Fatalf("write source .ecx: %v", err)
 	}
-	if err := os.WriteFile(srcBase+".ecj", []byte("journal"), 0o644); err != nil {
+	if err := os.WriteFile(srcBase+".ecj", ecjStreamBytes(3, 5, 3), 0o644); err != nil {
 		t.Fatalf("write source .ecj: %v", err)
 	}
-	if err := os.WriteFile(srcBase+".vif", []byte("volinfo"), 0o644); err != nil {
+	// A real .vif: the receiver MOUNTS the volume from the copied files, and a
+	// mount refuses a .vif it cannot parse rather than guessing the layout.
+	if err := volume_info.SaveVolumeInfo(srcBase+".vif", &volume_server_pb.VolumeInfo{
+		Version:       uint32(needle.Version3),
+		EcShardConfig: &volume_server_pb.EcShardConfig{DataShards: 10, ParityShards: 4},
+	}); err != nil {
 		t.Fatalf("write source .vif: %v", err)
 	}
 
@@ -154,8 +161,11 @@ func TestFetchEcIndexFromPeers_CopiesIndexOverGrpc(t *testing.T) {
 	if len(got) != len(ecxBytes) {
 		t.Errorf("copied .ecx size = %d, want %d", len(got), len(ecxBytes))
 	}
-	if _, err := os.Stat(dstBase + ".ecj"); err != nil {
+	// The journal is merged as a set: the duplicate record collapses.
+	if got, err := os.ReadFile(dstBase + ".ecj"); err != nil {
 		t.Errorf("copied .ecj missing: %v", err)
+	} else if want := ecjStreamBytes(3, 5); !bytes.Equal(got, want) {
+		t.Errorf("copied .ecj = %x, want %x", got, want)
 	}
 	if _, err := os.Stat(dstBase + ".vif"); err != nil {
 		t.Errorf("copied .vif missing: %v", err)
@@ -223,7 +233,12 @@ func TestVolumeEcShardsMount_RecoverMissingIndex(t *testing.T) {
 	if err := os.WriteFile(srcBase+".ecj", nil, 0o644); err != nil {
 		t.Fatalf("write source .ecj: %v", err)
 	}
-	if err := os.WriteFile(srcBase+".vif", []byte("volinfo"), 0o644); err != nil {
+	// A real .vif: the receiver MOUNTS the volume from the copied files, and a
+	// mount refuses a .vif it cannot parse rather than guessing the layout.
+	if err := volume_info.SaveVolumeInfo(srcBase+".vif", &volume_server_pb.VolumeInfo{
+		Version:       uint32(needle.Version3),
+		EcShardConfig: &volume_server_pb.EcShardConfig{DataShards: 10, ParityShards: 4},
+	}); err != nil {
 		t.Fatalf("write source .vif: %v", err)
 	}
 	srcGrpcPort := serveGrpc(t, func(s *grpc.Server) {
diff --git a/weed/server/volume_grpc_maintenance_test.go b/weed/server/volume_grpc_maintenance_test.go
new file mode 100644
index 0000000000..2f1f33093d
--- /dev/null
+++ b/weed/server/volume_grpc_maintenance_test.go
@@ -0,0 +1,111 @@
+package weed_server
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newMaintenanceModeServer builds a volume server whose store holds volume vid
+// in collection and has maintenance mode switched on.
+func newMaintenanceModeServer(t *testing.T, vid needle.VolumeId, collection string) (*VolumeServer, string) {
+	t.Helper()
+	dir := t.TempDir()
+	store := newTraversalTestStore(dir)
+	t.Cleanup(store.Close)
+	require.NoError(t, store.AddVolume(vid, collection, storage.NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+	require.NoError(t, store.State.Update(&volume_server_pb.VolumeServerState{Maintenance: true}))
+
+	vs := &VolumeServer{
+		store:          store,
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+	require.True(t, vs.MaintenanceMode())
+	return vs, dir
+}
+
+type fakeReadonlyAcceptingMaster struct {
+	master_pb.UnimplementedSeaweedServer
+}
+
+func (s *fakeReadonlyAcceptingMaster) VolumeMarkReadonly(context.Context, *master_pb.VolumeMarkReadonlyRequest) (*master_pb.VolumeMarkReadonlyResponse, error) {
+	return &master_pb.VolumeMarkReadonlyResponse{}, nil
+}
+
+// Evacuating a server in maintenance mode marks each volume readonly on the
+// source, copies it, then deletes the source (issue #11066). Those source-side
+// RPCs remove data or restrict the server further, so maintenance mode must
+// let them through — otherwise the mode defeats the evacuation it exists for.
+func TestMaintenanceModeAllowsVolumeMarkReadonly(t *testing.T) {
+	vid := needle.VolumeId(1)
+	vs, _ := newMaintenanceModeServer(t, vid, "")
+	vs.setCurrentMaster(startFakeMasterServerForLeaderLookup(t, &fakeReadonlyAcceptingMaster{}))
+
+	_, err := vs.VolumeMarkReadonly(context.Background(), &volume_server_pb.VolumeMarkReadonlyRequest{VolumeId: uint32(vid)})
+	require.NoError(t, err)
+	assert.True(t, vs.store.GetVolume(vid).IsReadOnly())
+}
+
+func TestMaintenanceModeAllowsVolumeDelete(t *testing.T) {
+	vid := needle.VolumeId(2)
+	vs, _ := newMaintenanceModeServer(t, vid, "")
+
+	_, err := vs.VolumeDelete(context.Background(), &volume_server_pb.VolumeDeleteRequest{VolumeId: uint32(vid)})
+	require.NoError(t, err)
+	assert.Nil(t, vs.store.GetVolume(vid), "volume should be gone from the store")
+}
+
+func TestMaintenanceModeAllowsVolumeEcShardsDelete(t *testing.T) {
+	const collection = "ec-maint"
+	vid := needle.VolumeId(3)
+	vs, dir := newMaintenanceModeServer(t, needle.VolumeId(99), "")
+
+	base := erasure_coding.EcShardFileName(collection, dir, int(vid))
+	require.NoError(t, os.WriteFile(base+".ecx", make([]byte, 16), 0o644))
+	for _, id := range []int{0, 1} {
+		require.NoError(t, os.WriteFile(base+erasure_coding.ToExt(id), []byte("s"), 0o644))
+	}
+
+	_, err := vs.VolumeEcShardsDelete(context.Background(), &volume_server_pb.VolumeEcShardsDeleteRequest{
+		VolumeId:   uint32(vid),
+		Collection: collection,
+		ShardIds:   []uint32{0, 1},
+	})
+	require.NoError(t, err)
+	assert.False(t, util.FileExists(base+erasure_coding.ToExt(0)))
+	assert.False(t, util.FileExists(base+erasure_coding.ToExt(1)))
+}
+
+// Maintenance mode keeps rejecting RPCs that add data to the server or reopen
+// it for writes; only the removal/restriction path above is exempt.
+func TestMaintenanceModeStillBlocksWrites(t *testing.T) {
+	vid := needle.VolumeId(4)
+	vs, _ := newMaintenanceModeServer(t, vid, "")
+	wantErr := vs.CheckMaintenanceMode().Error()
+	ctx := context.Background()
+
+	_, err := vs.AllocateVolume(ctx, &volume_server_pb.AllocateVolumeRequest{VolumeId: 5, Replication: "000", DiskType: string(types.HardDriveType)})
+	assert.EqualError(t, err, wantErr, "AllocateVolume")
+
+	_, err = vs.WriteNeedleBlob(ctx, &volume_server_pb.WriteNeedleBlobRequest{VolumeId: uint32(vid), NeedleId: 1, Size: 1, NeedleBlob: []byte{0}})
+	assert.EqualError(t, err, wantErr, "WriteNeedleBlob")
+
+	_, err = vs.BatchDelete(ctx, &volume_server_pb.BatchDeleteRequest{FileIds: []string{"4,01637037d6"}})
+	assert.EqualError(t, err, wantErr, "BatchDelete")
+
+	_, err = vs.VolumeMarkWritable(ctx, &volume_server_pb.VolumeMarkWritableRequest{VolumeId: uint32(vid)})
+	assert.EqualError(t, err, wantErr, "VolumeMarkWritable")
+}
diff --git a/weed/server/volume_grpc_read_all.go b/weed/server/volume_grpc_read_all.go
index 43334d7add..5a40eeb39c 100644
--- a/weed/server/volume_grpc_read_all.go
+++ b/weed/server/volume_grpc_read_all.go
@@ -29,6 +29,9 @@ func (vs *VolumeServer) streamReadOneVolume(vid needle.VolumeId, stream volume_s
 	if v == nil {
 		return fmt.Errorf("not found volume id %d", vid)
 	}
+	if err := v.UnavailableError(); err != nil {
+		return err
+	}
 
 	scanner := &storage.VolumeFileScanner4ReadAll{
 		Stream: stream,
diff --git a/weed/server/volume_grpc_receive_file_ecj_test.go b/weed/server/volume_grpc_receive_file_ecj_test.go
new file mode 100644
index 0000000000..bbcfba0181
--- /dev/null
+++ b/weed/server/volume_grpc_receive_file_ecj_test.go
@@ -0,0 +1,88 @@
+package weed_server
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// A volume that mounts on a journal ReceiveFile is still writing must not
+// compact it: the rest of the stream would land in the replaced inode and be
+// gone at the next mount.
+func TestReceiveFile_EcjStreamBlocksMountCompaction(t *testing.T) {
+	storeDir := t.TempDir()
+	// The store first, so its startup scan finds no volume to mount and
+	// ReceiveFile's mounted check lets the .ecj through.
+	vs := &VolumeServer{store: newTraversalTestStore(storeDir)}
+
+	base := filepath.Join(storeDir, "4")
+	ecx := make([]byte, types.NeedleMapEntrySize)
+	types.NeedleIdToBytes(ecx[0:types.NeedleIdSize], 7)
+	types.OffsetToBytes(ecx[types.NeedleIdSize:types.NeedleIdSize+types.OffsetSize], types.ToOffset(8))
+	types.SizeToBytes(ecx[types.NeedleIdSize+types.OffsetSize:], types.Size(10))
+	if err := os.WriteFile(base+".ecx", ecx, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(base+".vif", nil, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	// A bloated prefix (100 ids, 4096 times over) the mount would compact,
+	// then an id only the second chunk carries.
+	one := make([]byte, 100*types.NeedleIdSize)
+	for i := 0; i < 100; i++ {
+		types.NeedleIdToBytes(one[i*types.NeedleIdSize:], types.NeedleId(1000+i))
+	}
+	bloated := bytes.Repeat(one, 4096)
+	tail := make([]byte, types.NeedleIdSize)
+	types.NeedleIdToBytes(tail, 5000)
+
+	var mounted *erasure_coding.EcVolume
+	stream := &fakeReceiveFileStream{
+		reqs: []*volume_server_pb.ReceiveFileRequest{
+			infoReq(&volume_server_pb.ReceiveFileInfo{
+				VolumeId:   4,
+				Ext:        ".ecj",
+				IsEcVolume: true,
+				FileSize:   uint64(len(bloated) + len(tail)),
+			}),
+			contentReq(bloated),
+			contentReq(tail),
+		},
+		onRecv: func(i int) {
+			if i != 2 {
+				return
+			}
+			// The first chunk is on disk and the second is not yet sent.
+			ev, err := erasure_coding.NewEcVolume(types.HardDriveType, storeDir, storeDir, "", 4)
+			if err != nil {
+				t.Fatalf("mount during the stream: %v", err)
+			}
+			mounted = ev
+		},
+	}
+
+	if err := vs.ReceiveFile(stream); err != nil {
+		t.Fatalf("ReceiveFile: %v", err)
+	}
+	if stream.resp == nil || stream.resp.Error != "" {
+		t.Fatalf("ReceiveFile rejected the journal: %+v", stream.resp)
+	}
+	if mounted == nil {
+		t.Fatal("the mount hook never ran")
+	}
+	mounted.Close()
+
+	got, err := os.ReadFile(base + ".ecj")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := append(bloated, tail...); !bytes.Equal(got, want) {
+		t.Fatalf("journal on disk is %d bytes, want the %d the stream sent", len(got), len(want))
+	}
+}
diff --git a/weed/server/volume_grpc_remote.go b/weed/server/volume_grpc_remote.go
index 6519523006..de82b65eee 100644
--- a/weed/server/volume_grpc_remote.go
+++ b/weed/server/volume_grpc_remote.go
@@ -2,21 +2,32 @@ package weed_server
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"net/http"
 	"net/url"
+	"os"
+	"slices"
 	"strings"
 	"sync"
 	"time"
 
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/remote_storage"
+	azureremote "github.com/seaweedfs/seaweedfs/weed/remote_storage/azure"
+	gcsremote "github.com/seaweedfs/seaweedfs/weed/remote_storage/gcs"
 	s3remote "github.com/seaweedfs/seaweedfs/weed/remote_storage/s3"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 // lookupIPAddrFunc resolves a host to one or more IP addresses. It is a
@@ -87,6 +98,15 @@ var imdsIPv4 = net.ParseIP("169.254.169.254")
 var cgnatNet = &net.IPNet{IP: net.IPv4(100, 64, 0, 0), Mask: net.CIDRMask(10, 32)}
 
 func checkBlockedIP(endpoint string, ip net.IP) error {
+	return checkBlockedIPPolicy(endpoint, ip, false)
+}
+
+// checkBlockedIPPolicy rejects addresses that must never be dialed from a
+// server with cluster-internal reach. allowPrivate keeps RFC 1918 / CGNAT
+// reachable for callers whose target legitimately sits on an internal network
+// (peer volume servers), while still blocking loopback, link-local (IMDS) and
+// unspecified.
+func checkBlockedIPPolicy(endpoint string, ip net.IP, allowPrivate bool) error {
 	if ip == nil {
 		return nil
 	}
@@ -102,14 +122,100 @@ func checkBlockedIP(endpoint string, ip net.IP) error {
 		return fmt.Errorf("remote endpoint %q resolves to link-local address %s", endpoint, ip)
 	case ip.IsInterfaceLocalMulticast():
 		return fmt.Errorf("remote endpoint %q resolves to interface-local address %s", endpoint, ip)
-	case ip.IsPrivate():
-		return fmt.Errorf("remote endpoint %q resolves to private address %s", endpoint, ip)
-	case cgnatNet.Contains(ip):
-		return fmt.Errorf("remote endpoint %q resolves to CGNAT address %s", endpoint, ip)
+	}
+	if !allowPrivate {
+		switch {
+		case ip.IsPrivate():
+			return fmt.Errorf("remote endpoint %q resolves to private address %s", endpoint, ip)
+		case cgnatNet.Contains(ip):
+			return fmt.Errorf("remote endpoint %q resolves to CGNAT address %s", endpoint, ip)
+		}
+	}
+	// IPv6 transition addresses embed an IPv4 destination that routes to the
+	// same host wherever the matching relay exists (common in IPv6-only cloud).
+	// net.IP only normalizes ::ffff: mapped addresses, so pull the embedded
+	// IPv4 out of the other forms and re-check it against the deny list.
+	if embedded := embeddedTransitionIPv4(ip); embedded != nil {
+		return checkBlockedIPPolicy(endpoint, embedded, allowPrivate)
 	}
 	return nil
 }
 
+// validateReplicaTarget rejects a peer volume server address that could
+// redirect a dial away from the cluster: replica upload targets and the
+// copy/tail source addresses are all caller-supplied. The target must be a
+// bare host:port -- a scheme, userinfo, path, query or fragment can smuggle a
+// different destination through fmt.Sprintf -- whose host is not loopback,
+// link-local (IMDS) or unspecified. Cluster peers legitimately sit on private
+// networks, so RFC 1918 / CGNAT are allowed.
+func validateReplicaTarget(ctx context.Context, target string) error {
+	if strings.TrimSpace(target) == "" {
+		return fmt.Errorf("replica target is empty")
+	}
+	if strings.Contains(target, "://") || strings.ContainsAny(target, "/?#@\\") {
+		return fmt.Errorf("replica target %q must be a bare host:port", target)
+	}
+	host, _, splitErr := net.SplitHostPort(target)
+	if splitErr != nil {
+		return fmt.Errorf("replica target %q must be a bare host:port: %w", target, splitErr)
+	}
+	if host == "" {
+		return fmt.Errorf("replica target %q has no host", target)
+	}
+	if _, ok := blockedIMDSHosts[strings.ToLower(host)]; ok {
+		return fmt.Errorf("replica target %q targets instance metadata service", target)
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		return checkBlockedIPPolicy(target, ip, true)
+	}
+	resolveCtx, cancel := context.WithTimeout(ctx, 2*time.Second)
+	defer cancel()
+	addrs, lookupErr := lookupIPAddrFunc(resolveCtx, host)
+	if lookupErr != nil {
+		return fmt.Errorf("resolve replica target host %q: %w", host, lookupErr)
+	}
+	for _, addr := range addrs {
+		if err := checkBlockedIPPolicy(target, addr.IP, true); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// embeddedTransitionIPv4 returns the IPv4 address carried by an IPv6 transition
+// address -- NAT64 64:ff9b::/96 (RFC 6052), 6to4 2002::/16 (RFC 3056), Teredo
+// 2001:0000::/32 (RFC 4380), and the deprecated IPv4-compatible ::/96 (RFC
+// 4291) -- or nil when ip is not one of those. IPv4-mapped ::ffff:0:0/96 is
+// excluded because net.IP already normalizes it via To4.
+func embeddedTransitionIPv4(ip net.IP) net.IP {
+	v6 := ip.To16()
+	if v6 == nil || ip.To4() != nil {
+		return nil
+	}
+	switch {
+	case v6[0] == 0x00 && v6[1] == 0x64 && v6[2] == 0xff && v6[3] == 0x9b && allZero(v6[4:12]):
+		return net.IPv4(v6[12], v6[13], v6[14], v6[15])
+	case v6[0] == 0x20 && v6[1] == 0x02:
+		return net.IPv4(v6[2], v6[3], v6[4], v6[5])
+	case v6[0] == 0x20 && v6[1] == 0x01 && v6[2] == 0x00 && v6[3] == 0x00:
+		// Teredo obfuscates the client IPv4 as its ones' complement.
+		return net.IPv4(v6[12]^0xff, v6[13]^0xff, v6[14]^0xff, v6[15]^0xff)
+	case allZero(v6[:12]):
+		// IPv4-compatible ::a.b.c.d; :: and ::1 are already handled above.
+		return net.IPv4(v6[12], v6[13], v6[14], v6[15])
+	}
+	return nil
+}
+
+func allZero(b []byte) bool {
+	for _, c := range b {
+		if c != 0 {
+			return false
+		}
+	}
+	return true
+}
+
 // guardedDialer returns a DialContext that resolves the host itself and
 // re-applies checkBlockedIP to every resolved address immediately before
 // dialing. This closes the DNS-rebinding window between
@@ -117,7 +223,14 @@ func checkBlockedIP(endpoint string, ip net.IP) error {
 // client: even if the attacker's DNS flips to 127.0.0.1 (or any other
 // blocked range) after the up-front check, the dial is refused.
 func guardedDialer(endpoint string) func(ctx context.Context, network, addr string) (net.Conn, error) {
-	dialer := &net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}
+	return guardedDialerPolicy(endpoint, false)
+}
+
+// guardedDialerPolicy is guardedDialer with the same allowPrivate knob as
+// checkBlockedIPPolicy, so the replica upload path can keep dialing private
+// peers while still refusing loopback / link-local / unspecified at connect
+// time (closing the rebinding window for replica hostnames too).
+func guardedDialerPolicy(endpoint string, allowPrivate bool) func(ctx context.Context, network, addr string) (net.Conn, error) {
 	return func(ctx context.Context, network, addr string) (net.Conn, error) {
 		host, port, splitErr := net.SplitHostPort(addr)
 		if splitErr != nil {
@@ -125,10 +238,10 @@ func guardedDialer(endpoint string) func(ctx context.Context, network, addr stri
 		}
 		// If the host is already a literal IP just validate and dial it.
 		if ip := net.ParseIP(host); ip != nil {
-			if err := checkBlockedIP(endpoint, ip); err != nil {
+			if err := checkBlockedIPPolicy(endpoint, ip, allowPrivate); err != nil {
 				return nil, err
 			}
-			return dialer.DialContext(ctx, network, addr)
+			return util.OutboundDialContext(ctx, network, addr)
 		}
 		// Otherwise resolve, validate every answer, and dial the first IP
 		// that passes the deny list. Using a literal-IP target prevents the
@@ -140,13 +253,13 @@ func guardedDialer(endpoint string) func(ctx context.Context, network, addr stri
 		}
 		var firstBlockErr error
 		for _, a := range addrs {
-			if err := checkBlockedIP(endpoint, a.IP); err != nil {
+			if err := checkBlockedIPPolicy(endpoint, a.IP, allowPrivate); err != nil {
 				if firstBlockErr == nil {
 					firstBlockErr = err
 				}
 				continue
 			}
-			return dialer.DialContext(ctx, network, net.JoinHostPort(a.IP.String(), port))
+			return util.OutboundDialContext(ctx, network, net.JoinHostPort(a.IP.String(), port))
 		}
 		if firstBlockErr != nil {
 			return nil, firstBlockErr
@@ -155,14 +268,40 @@ func guardedDialer(endpoint string) func(ctx context.Context, network, addr stri
 	}
 }
 
+// guardedGrpcDialOption returns a grpc.DialOption that re-applies the replica
+// deny list to every resolved address at connect time, pinning a validated
+// copy/tail source against DNS rebinding. It is nil when the operator opted
+// out with AllowUntrustedRemoteEndpoints; pb skips nil dial options.
+func (vs *VolumeServer) guardedGrpcDialOption(endpoint string) grpc.DialOption {
+	if vs.AllowUntrustedRemoteEndpoints {
+		return nil
+	}
+	dial := guardedDialerPolicy(endpoint, true)
+	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
+		return dial(ctx, "tcp", addr)
+	})
+}
+
 // newGuardedHTTPClient returns an *http.Client whose transport refuses to
 // dial addresses that fail checkBlockedIP at connect time. It is meant for
 // per-request use; do not share across remote configs.
 func newGuardedHTTPClient(endpoint string) *http.Client {
+	return newGuardedHTTPClientPolicy(endpoint, false)
+}
+
+// newGuardedHTTPClientPolicy is newGuardedHTTPClient with the allowPrivate knob
+// for the replica upload path, whose targets are cluster peers on private
+// networks.
+func newGuardedHTTPClientPolicy(endpoint string, allowPrivate bool) *http.Client {
 	return &http.Client{
 		Transport: &http.Transport{
-			Proxy:                 http.ProxyFromEnvironment,
-			DialContext:           guardedDialer(endpoint),
+			// No proxy: guardedDialer must see the real target address. Through
+			// a proxy it would only validate the proxy's IP while the proxy
+			// re-resolves the endpoint host, reopening the rebinding window the
+			// dialer exists to close. Operators that need a proxy can opt out
+			// with -volume.allowUntrustedRemoteEndpoints.
+			Proxy:                 nil,
+			DialContext:           guardedDialerPolicy(endpoint, allowPrivate),
 			ForceAttemptHTTP2:     true,
 			MaxIdleConns:          16,
 			IdleConnTimeout:       60 * time.Second,
@@ -172,6 +311,185 @@ func newGuardedHTTPClient(endpoint string) *http.Client {
 	}
 }
 
+// guardedRemoteClient reports the caller-supplied endpoint a backend dials
+// directly and a constructor that routes through the given HTTP client, or
+// ok=false when nothing in the conf steers a destination. The S3-SDK family,
+// azure (once AzureEndpoint is set) and the gcs token exchange all honor a
+// caller-supplied endpoint, so each must pass the SSRF deny-list and the
+// rebinding-safe dialer.
+func guardedRemoteClient(remoteConf *remote_pb.RemoteConf) (endpoint string, makeClient func(*http.Client) (remote_storage.RemoteStorageClient, error), ok bool) {
+	if remoteConf == nil {
+		return "", nil, false
+	}
+	if ep, isS3 := s3remote.S3CompatibleEndpoint(remoteConf); isS3 {
+		if ep == "" && remoteConf.Type == "s3" {
+			return "", nil, false
+		}
+		return ep, func(httpClient *http.Client) (remote_storage.RemoteStorageClient, error) {
+			return s3remote.MakeWithHTTPClient(remoteConf, httpClient)
+		}, true
+	}
+	if remoteConf.Type == "azure" && remoteConf.AzureEndpoint != "" {
+		return remoteConf.AzureEndpoint, func(httpClient *http.Client) (remote_storage.RemoteStorageClient, error) {
+			return azureremote.MakeWithHTTPClient(remoteConf, httpClient)
+		}, true
+	}
+	// gcs reaches a fixed object host, but the token exchange goes wherever the
+	// supplied credentials say, so guard that endpoint instead.
+	if remoteConf.Type == "gcs" && remoteConf.GcsGoogleApplicationCredentials != "" {
+		if data, err := loadGcsCredentialsContent(remoteConf.GcsGoogleApplicationCredentials); err == nil {
+			if _, tokenURL, parseErr := gcsremote.ParseInlineCredentials(string(data)); parseErr == nil {
+				return tokenURL, func(httpClient *http.Client) (remote_storage.RemoteStorageClient, error) {
+					return gcsremote.MakeWithHTTPClient(remoteConf, httpClient, gcsremote.StaticKeyCredentialTypes...)
+				}, true
+			}
+		}
+	}
+	return "", nil, false
+}
+
+// gcsCredentialsArePath reports whether a gcs credentials value is a filesystem
+// path rather than inline JSON, matching the gcs client's own inline detection.
+func gcsCredentialsArePath(creds string) bool {
+	return creds != "" && !strings.HasPrefix(creds, "{")
+}
+
+var errGcsCredentialsUnreadable = errors.New("gcs credentials file is not readable or does not contain valid credentials")
+
+// loadGcsCredentialsContent returns the credential JSON for a gcs credentials
+// value, reading from disk when it is a filesystem path (as written by
+// remote.configure -gcs.appCredentialsFile). This mirrors what the gcs client
+// itself does in MakeWithHTTPClient, so the guard validates the same content
+// the client will eventually load.
+func loadGcsCredentialsContent(creds string) ([]byte, error) {
+	if creds == "" {
+		return nil, nil
+	}
+	if strings.HasPrefix(creds, "{") {
+		return []byte(creds), nil
+	}
+	data, err := os.ReadFile(util.ResolvePath(creds))
+	if err != nil {
+		return nil, errGcsCredentialsUnreadable
+	}
+	return data, nil
+}
+
+// checkGcsCredentials rejects a caller-supplied gcs credentials value that
+// would make the SDK read from somewhere other than the credentials themselves,
+// so the request fails before any client is built.
+func checkGcsCredentials(creds string) error {
+	if creds == "" {
+		return nil
+	}
+	data, err := loadGcsCredentialsContent(creds)
+	if err != nil {
+		return err
+	}
+	credType, _, parseErr := gcsremote.ParseInlineCredentials(string(data))
+	if parseErr != nil {
+		return parseErr
+	}
+	if !slices.Contains(gcsremote.StaticKeyCredentialTypes, credType) {
+		return fmt.Errorf("gcs credential type %q is not accepted here", credType)
+	}
+	return nil
+}
+
+// BuildGuardedRemoteStorageClient builds a remote storage client whose dial
+// path is validated against the SSRF deny-list and pinned against DNS
+// rebinding, unless allowUntrusted is set. It is the single builder for every
+// caller that dials a caller-influenced RemoteConf endpoint: the volume
+// FetchAndWriteNeedle write path and the filer and S3 gateway remote-mount read
+// paths, which otherwise reach the same s3manager sink unguarded.
+func BuildGuardedRemoteStorageClient(ctx context.Context, remoteConf *remote_pb.RemoteConf, allowUntrusted bool) (remote_storage.RemoteStorageClient, error) {
+	if !allowUntrusted {
+		if remoteConf.GetType() == "gcs" {
+			if credsErr := checkGcsCredentials(remoteConf.GetGcsGoogleApplicationCredentials()); credsErr != nil {
+				return nil, fmt.Errorf("reject remote credentials: %w", credsErr)
+			}
+		}
+		if endpoint, makeClient, ok := guardedRemoteClient(remoteConf); ok {
+			if validateErr := validateRemoteEndpoint(ctx, endpoint); validateErr != nil {
+				return nil, fmt.Errorf("reject remote endpoint: %w", validateErr)
+			}
+			// Build a one-shot client whose dial path re-validates the resolved
+			// IP every time. This pins the validated endpoint against DNS
+			// rebinding (a hostname that resolves to a public IP for
+			// validateRemoteEndpoint and then flips to 127.0.0.1 / 169.254.x.x
+			// when the SDK dials).
+			client, err := makeClient(newGuardedHTTPClient(endpoint))
+			if err != nil {
+				return nil, fmt.Errorf("get remote client: %w", err)
+			}
+			return client, nil
+		}
+	}
+	client, err := remote_storage.GetRemoteStorage(remoteConf)
+	if err != nil {
+		return nil, fmt.Errorf("get remote client: %w", err)
+	}
+	return client, nil
+}
+
+// ValidateRemoteConfForLoad applies the same SSRF deny-list and gcs credential
+// checks BuildGuardedRemoteStorageClient enforces at dial time, but without
+// building a client. It is injected into the filer's FilerRemoteStorage so a
+// RemoteConf planted under /etc/remote is rejected at load — before the
+// lazy-fetch / lazy-list / remote-delete paths can resolve and dial it. A conf
+// whose type does not steer a caller-supplied endpoint (and so dials a fixed
+// provider host) passes; allowUntrusted skips the check to mirror the volume
+// server opt-out.
+func ValidateRemoteConfForLoad(ctx context.Context, remoteConf *remote_pb.RemoteConf, allowUntrusted bool) error {
+	if remoteConf == nil {
+		return nil
+	}
+	if allowUntrusted {
+		return nil
+	}
+	if remoteConf.GetType() == "gcs" {
+		if credsErr := checkGcsCredentials(remoteConf.GetGcsGoogleApplicationCredentials()); credsErr != nil {
+			return fmt.Errorf("reject remote credentials: %w", credsErr)
+		}
+	}
+	if endpoint, _, ok := guardedRemoteClient(remoteConf); ok {
+		if validateErr := validateRemoteEndpointForLoad(endpoint); validateErr != nil {
+			return fmt.Errorf("reject remote endpoint: %w", validateErr)
+		}
+	}
+	return nil
+}
+
+// validateRemoteEndpointForLoad applies the static parts of the SSRF deny-list
+// (scheme, IMDS hostnames, IP-literal blocked addresses) without resolving
+// hostnames. DNS resolution is left to BuildGuardedRemoteStorageClient at dial
+// time, so a transient DNS failure during /etc/remote reload cannot drop a
+// working mount from the live map.
+func validateRemoteEndpointForLoad(endpoint string) error {
+	if strings.TrimSpace(endpoint) == "" {
+		return fmt.Errorf("remote endpoint is empty")
+	}
+	u, parseErr := url.Parse(endpoint)
+	if parseErr != nil {
+		return fmt.Errorf("parse remote endpoint %q: %w", endpoint, parseErr)
+	}
+	scheme := strings.ToLower(u.Scheme)
+	if scheme != "http" && scheme != "https" {
+		return fmt.Errorf("remote endpoint %q must use http or https, got %q", endpoint, u.Scheme)
+	}
+	host := u.Hostname()
+	if host == "" {
+		return fmt.Errorf("remote endpoint %q has no host", endpoint)
+	}
+	if _, ok := blockedIMDSHosts[strings.ToLower(host)]; ok {
+		return fmt.Errorf("remote endpoint %q targets instance metadata service", endpoint)
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		return checkBlockedIP(endpoint, ip)
+	}
+	return nil
+}
+
 func (vs *VolumeServer) FetchAndWriteNeedle(ctx context.Context, req *volume_server_pb.FetchAndWriteNeedleRequest) (resp *volume_server_pb.FetchAndWriteNeedleResponse, err error) {
 	if err := vs.checkGrpcAdminAuth(ctx); err != nil {
 		return nil, err
@@ -188,27 +506,9 @@ func (vs *VolumeServer) FetchAndWriteNeedle(ctx context.Context, req *volume_ser
 
 	remoteConf := req.RemoteConf
 
-	var client remote_storage.RemoteStorageClient
-	var getClientErr error
-	if !vs.AllowUntrustedRemoteEndpoints && remoteConf != nil && remoteConf.Type == "s3" {
-		// Endpoint validation is S3-specific: only RemoteConf.S3Endpoint
-		// is a URL the volume server dials directly. Other backends
-		// (gcs, azure, ...) authenticate against their own SDKs and
-		// don't accept an attacker-controlled host.
-		if validateErr := validateRemoteEndpoint(ctx, remoteConf.S3Endpoint); validateErr != nil {
-			return nil, fmt.Errorf("reject remote endpoint: %w", validateErr)
-		}
-		// Build a one-shot S3 client whose dial path re-validates the
-		// resolved IP every time. This pins the validated endpoint against
-		// DNS rebinding (a hostname that resolves to a public IP for
-		// validateRemoteEndpoint and then flips to 127.0.0.1 / 169.254.x.x
-		// when the AWS SDK dials).
-		client, getClientErr = s3remote.MakeWithHTTPClient(remoteConf, newGuardedHTTPClient(remoteConf.S3Endpoint))
-	} else {
-		client, getClientErr = remote_storage.GetRemoteStorage(remoteConf)
-	}
+	client, getClientErr := BuildGuardedRemoteStorageClient(ctx, remoteConf, vs.AllowUntrustedRemoteEndpoints)
 	if getClientErr != nil {
-		return nil, fmt.Errorf("get remote client: %w", getClientErr)
+		return nil, getClientErr
 	}
 
 	remoteStorageLocation := req.RemoteLocation
@@ -227,7 +527,7 @@ func (vs *VolumeServer) FetchAndWriteNeedle(ctx context.Context, req *volume_ser
 		data, readRemoteErr = client.ReadFile(remoteStorageLocation, req.Offset, req.Size)
 	}
 	if readRemoteErr != nil {
-		return nil, fmt.Errorf("read from remote %+v: %w", remoteStorageLocation, readRemoteErr)
+		return nil, volumeRemoteReadError(remoteStorageLocation, readRemoteErr)
 	}
 	// The chunk is recorded with the requested size, so a short read would be
 	// cached as a full-size chunk with a zero-padded or truncated tail. Fail
@@ -236,6 +536,16 @@ func (vs *VolumeServer) FetchAndWriteNeedle(ctx context.Context, req *volume_ser
 		return nil, fmt.Errorf("read from remote %+v: got %d bytes, want %d", remoteStorageLocation, len(data), req.Size)
 	}
 
+	// Validate every replica target before writing anything, so a malformed or
+	// internal target fails the request instead of leaving a local write behind.
+	if !vs.AllowUntrustedRemoteEndpoints {
+		for _, replica := range req.Replicas {
+			if validateErr := validateReplicaTarget(ctx, replica.Url); validateErr != nil {
+				return nil, fmt.Errorf("reject replica target: %w", validateErr)
+			}
+		}
+	}
+
 	var wg sync.WaitGroup
 	var localErr error
 	replicaErrs := make([]error, len(req.Replicas))
@@ -274,10 +584,20 @@ func (vs *VolumeServer) FetchAndWriteNeedle(ctx context.Context, req *volume_ser
 					Jwt:               security.EncodedJwt(req.Auth),
 				}
 
-				uploader, uploaderErr := operation.NewUploader()
-				if uploaderErr != nil {
-					replicaErrs[idx] = fmt.Errorf("remote write needle %d size %d: %v", req.NeedleId, req.Size, uploaderErr)
-					return
+				// Upload through a client that re-checks the target at connect
+				// time, so a replica hostname cannot rebind to a blocked address
+				// after validateReplicaTarget. Peers may be private, so allow
+				// private here; the opt-out uses the shared global client.
+				var uploader *operation.Uploader
+				if vs.AllowUntrustedRemoteEndpoints {
+					var uploaderErr error
+					uploader, uploaderErr = operation.NewUploader()
+					if uploaderErr != nil {
+						replicaErrs[idx] = fmt.Errorf("remote write needle %d size %d: %v", req.NeedleId, req.Size, uploaderErr)
+						return
+					}
+				} else {
+					uploader = operation.NewUploaderWithHttpClient(newGuardedHTTPClientPolicy(targetVolumeServer, true))
 				}
 
 				if _, replicaWriteErr := uploader.UploadData(ctx, data, uploadOption); replicaWriteErr != nil {
@@ -299,3 +619,14 @@ func (vs *VolumeServer) FetchAndWriteNeedle(ctx context.Context, req *volume_ser
 
 	return resp, err
 }
+
+// volumeRemoteReadError keeps a confirmed missing object distinguishable across
+// gRPC, where a wrapped sentinel would arrive as codes.Unknown text. The
+// sentinel's text in the message is what the filer matches, so a NotFound for
+// any other reason cannot pass for it.
+func volumeRemoteReadError(loc *remote_pb.RemoteStorageLocation, err error) error {
+	if errors.Is(err, remote_storage.ErrRemoteObjectNotFound) {
+		return status.Errorf(codes.NotFound, "read from remote %+v: %v", loc, remote_storage.ErrRemoteObjectNotFound)
+	}
+	return fmt.Errorf("read from remote %+v: %w", loc, err)
+}
diff --git a/weed/server/volume_grpc_remote_test.go b/weed/server/volume_grpc_remote_test.go
index 9992bebc03..03bcf150d7 100644
--- a/weed/server/volume_grpc_remote_test.go
+++ b/weed/server/volume_grpc_remote_test.go
@@ -4,9 +4,14 @@ import (
 	"context"
 	"errors"
 	"net"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync/atomic"
 	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/remote_pb"
+	s3remote "github.com/seaweedfs/seaweedfs/weed/remote_storage/s3"
 )
 
 // stubLookup returns a resolver func that maps the supplied hostnames to
@@ -166,6 +171,61 @@ func TestValidateRemoteEndpoint(t *testing.T) {
 			wantErr:  true,
 			wantSub:  "CGNAT",
 		},
+		{
+			name:     "nat64 imds",
+			endpoint: "http://[64:ff9b::a9fe:a9fe]/",
+			wantErr:  true,
+			wantSub:  "metadata",
+		},
+		{
+			name:     "nat64 loopback",
+			endpoint: "http://[64:ff9b::7f00:1]/",
+			wantErr:  true,
+			wantSub:  "loopback",
+		},
+		{
+			name:     "6to4 private",
+			endpoint: "http://[2002:a00:1::]/",
+			wantErr:  true,
+			wantSub:  "private",
+		},
+		{
+			name:     "teredo loopback",
+			endpoint: "http://[2001:0:4136:e378:8000:63bf:80ff:fffe]/",
+			wantErr:  true,
+			wantSub:  "loopback",
+		},
+		{
+			name:     "ipv4-compatible loopback",
+			endpoint: "http://[::7f00:1]/",
+			wantErr:  true,
+			wantSub:  "loopback",
+		},
+		{
+			name:     "nat64 public passes",
+			endpoint: "http://[64:ff9b::808:808]/",
+			wantErr:  false,
+		},
+		{
+			name:     "6to4 public passes",
+			endpoint: "http://[2002:808:808::]/",
+			wantErr:  false,
+		},
+		{
+			name:     "teredo public passes",
+			endpoint: "http://[2001::f7f7:f7f7]/",
+			wantErr:  false,
+		},
+		{
+			name:     "ipv4-compatible public passes",
+			endpoint: "http://[::808:808]/",
+			wantErr:  false,
+		},
+		{
+			name:     "nat64 non-wellknown-prefix not decoded",
+			endpoint: "http://[64:ff9b:1::a9fe:a9fe]/",
+			wantErr:  false,
+		},
 		{
 			name:     "public s3",
 			endpoint: "https://s3.us-east-1.amazonaws.com/",
@@ -248,6 +308,275 @@ func TestGuardedDialerRebind(t *testing.T) {
 	}
 }
 
+// TestRemoteEndpointGuardCoversS3CompatibleSiblings confirms the SSRF guard
+// reaches every S3-SDK-backed provider, not just type "s3". It replays the two
+// steps FetchAndWriteNeedle performs before building the client: resolve the
+// endpoint the type would dial, then validate it against the deny-list. A
+// sibling type pointed at an internal address must be rejected.
+func TestRemoteEndpointGuardCoversS3CompatibleSiblings(t *testing.T) {
+	cases := []struct {
+		conf    *remote_pb.RemoteConf
+		wantSub string
+	}{
+		{&remote_pb.RemoteConf{Type: "wasabi", WasabiEndpoint: "http://169.254.169.254/"}, "metadata"},
+		{&remote_pb.RemoteConf{Type: "b2", BackblazeEndpoint: "http://127.0.0.1/"}, "loopback"},
+		{&remote_pb.RemoteConf{Type: "aliyun", AliyunEndpoint: "http://192.168.0.1/"}, "private"},
+		{&remote_pb.RemoteConf{Type: "tencent", TencentEndpoint: "http://100.64.0.1/"}, "CGNAT"},
+		{&remote_pb.RemoteConf{Type: "baidu", BaiduEndpoint: "http://169.254.169.254/"}, "metadata"},
+		{&remote_pb.RemoteConf{Type: "filebase", FilebaseEndpoint: "http://172.16.0.1/"}, "private"},
+		{&remote_pb.RemoteConf{Type: "storj", StorjEndpoint: "http://10.0.0.5/"}, "private"},
+		{&remote_pb.RemoteConf{Type: "contabo", ContaboEndpoint: "http://[::1]/"}, "loopback"},
+	}
+	for _, tc := range cases {
+		endpoint, ok := s3remote.S3CompatibleEndpoint(tc.conf)
+		if !ok {
+			t.Errorf("type %q: not recognized as S3-compatible, guard would be skipped", tc.conf.Type)
+			continue
+		}
+		err := validateRemoteEndpoint(context.Background(), endpoint)
+		if err == nil {
+			t.Errorf("type %q: expected endpoint %q to be rejected", tc.conf.Type, endpoint)
+			continue
+		}
+		if !strings.Contains(err.Error(), tc.wantSub) {
+			t.Errorf("type %q: error %q missing %q", tc.conf.Type, err, tc.wantSub)
+		}
+	}
+}
+
+// TestRemoteEndpointGuardCoversAzure confirms the SSRF guard reaches the azure
+// backend, which dials a caller-supplied AzureEndpoint. It replays the two
+// steps FetchAndWriteNeedle performs before building the client: resolve the
+// endpoint the type would dial via guardedRemoteClient, then validate it. An
+// azure conf pointed at an internal address must be rejected.
+func TestRemoteEndpointGuardCoversAzure(t *testing.T) {
+	cases := []struct {
+		name    string
+		conf    *remote_pb.RemoteConf
+		wantSub string
+	}{
+		{"imds", &remote_pb.RemoteConf{Type: "azure", AzureEndpoint: "https://169.254.169.254/"}, "metadata"},
+		{"loopback", &remote_pb.RemoteConf{Type: "azure", AzureEndpoint: "https://127.0.0.1/"}, "loopback"},
+		{"private", &remote_pb.RemoteConf{Type: "azure", AzureEndpoint: "https://10.0.0.5/"}, "private"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			endpoint, _, ok := guardedRemoteClient(tc.conf)
+			if !ok {
+				t.Fatalf("azure endpoint %q not guarded, the SSRF check would be skipped", tc.conf.AzureEndpoint)
+			}
+			err := validateRemoteEndpoint(context.Background(), endpoint)
+			if err == nil {
+				t.Fatalf("expected endpoint %q to be rejected", endpoint)
+			}
+			if !strings.Contains(err.Error(), tc.wantSub) {
+				t.Fatalf("error %q missing %q", err, tc.wantSub)
+			}
+		})
+	}
+}
+
+// TestValidateReplicaTarget covers the replica upload leg of
+// FetchAndWriteNeedle. Replica targets are peer volume servers, so unlike the
+// remote endpoint they may sit on a private network; the guard still rejects
+// loopback / link-local / unspecified hosts and any target that is not a bare
+// host:port, since a scheme, path or query would move the upload to a different
+// URL through the format string.
+func TestValidateReplicaTarget(t *testing.T) {
+	originalLookup := lookupIPAddrFunc
+	t.Cleanup(func() { lookupIPAddrFunc = originalLookup })
+
+	lookupIPAddrFunc = stubLookup(t, map[string][]net.IP{
+		"peer.example.com":      {net.ParseIP("10.0.0.7")},
+		"loop.example.com":      {net.ParseIP("127.0.0.1")},
+		"linklocal.example.com": {net.ParseIP("169.254.169.254")},
+	})
+
+	cases := []struct {
+		name    string
+		target  string
+		wantErr bool
+		wantSub string
+	}{
+		// A path plus a trailing "?a=" would otherwise swallow ?type=replicate.
+		{"embedded path and query", "127.0.0.1:7000/status/x/?a=", true, "bare host:port"},
+		{"loopback literal", "127.0.0.1:8080", true, "loopback"},
+		{"ipv6 loopback", "[::1]:8080", true, "loopback"},
+		{"metadata literal", "169.254.169.254:80", true, "metadata"},
+		{"unspecified", "0.0.0.0:8080", true, "unspecified"},
+		{"metadata hostname", "metadata:80", true, "metadata"},
+		{"scheme rejected", "http://10.0.0.7:8080", true, "bare host:port"},
+		{"path rejected", "10.0.0.7:8080/x", true, "bare host:port"},
+		{"query rejected", "10.0.0.7:8080?a=b", true, "bare host:port"},
+		{"userinfo rejected", "user@10.0.0.7:8080", true, "bare host:port"},
+		{"missing port literal", "10.0.0.7", true, "bare host:port"},
+		{"missing port hostname", "peer.example.com", true, "bare host:port"},
+		{"empty", "", true, "empty"},
+		{"resolves to loopback", "loop.example.com:8080", true, "loopback"},
+		{"resolves to link-local", "linklocal.example.com:8080", true, "metadata"},
+		// Legitimate peer volume servers on private networks must pass.
+		{"private peer literal", "10.0.0.7:8080", false, ""},
+		{"private 192 peer", "192.168.1.5:8080", false, ""},
+		{"private peer hostname", "peer.example.com:8080", false, ""},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateReplicaTarget(context.Background(), tc.target)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error for %q, got nil", tc.target)
+				}
+				if tc.wantSub != "" && !strings.Contains(err.Error(), tc.wantSub) {
+					t.Fatalf("expected error to contain %q, got %v", tc.wantSub, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error for %q: %v", tc.target, err)
+			}
+		})
+	}
+}
+
+// TestGuardedRemoteClientSkipsFixedHostBackends confirms backends that only
+// reach a fixed provider host bypass the endpoint guard: azure with no explicit
+// endpoint (public cloud, host derived from the account) and unrelated types.
+func TestGuardedRemoteClientSkipsFixedHostBackends(t *testing.T) {
+	for _, conf := range []*remote_pb.RemoteConf{
+		{Type: "azure", AzureAccountName: "acct"},
+		{Type: "gcs"},
+		nil,
+	} {
+		if _, _, ok := guardedRemoteClient(conf); ok {
+			t.Errorf("conf %+v should not be guarded", conf)
+		}
+	}
+}
+
+// TestGuardedRemoteClientAzureBuildsGuardedClient exercises the whole azure
+// path: a public endpoint passes validation and the constructor builds a client
+// through the guarded HTTP transport.
+func TestGuardedRemoteClientAzureBuildsGuardedClient(t *testing.T) {
+	conf := &remote_pb.RemoteConf{
+		Type:             "azure",
+		AzureAccountName: "testaccount",
+		AzureAccountKey:  "aW52YWxpZGtleQ==",
+		AzureEndpoint:    "https://testaccount.blob.core.usgovcloudapi.net/",
+	}
+	endpoint, makeClient, ok := guardedRemoteClient(conf)
+	if !ok {
+		t.Fatal("azure with an endpoint should be guarded")
+	}
+	client, err := makeClient(newGuardedHTTPClient(endpoint))
+	if err != nil {
+		t.Fatalf("build guarded azure client: %v", err)
+	}
+	if client == nil {
+		t.Fatal("expected a client")
+	}
+}
+
+// TestGcsCredentialsArePath confirms a caller-supplied gcs credentials value is
+// only accepted as inline JSON. A filesystem path would otherwise be read from
+// disk by the SDK when handling the request.
+func TestGcsCredentialsArePath(t *testing.T) {
+	paths := []string{
+		"/etc/hostname",
+		"/etc/shadow",
+		"/nope/nothere",
+		"~/creds.json",
+		"relative/creds.json",
+	}
+	for _, p := range paths {
+		if !gcsCredentialsArePath(p) {
+			t.Errorf("expected %q to be treated as a path", p)
+		}
+	}
+	inlineOrEmpty := []string{
+		"",
+		`{"type":"service_account"}`,
+		`{}`,
+	}
+	for _, c := range inlineOrEmpty {
+		if gcsCredentialsArePath(c) {
+			t.Errorf("expected %q to be accepted (inline or empty)", c)
+		}
+	}
+}
+
+// TestGuardedRemoteClientGuardsGcsTokenURL confirms the token endpoint named by
+// inline gcs credentials is the endpoint the guard validates, so a loopback
+// token_uri is refused while the Google default passes.
+func TestGuardedRemoteClientGuardsGcsTokenURL(t *testing.T) {
+	originalLookup := lookupIPAddrFunc
+	t.Cleanup(func() { lookupIPAddrFunc = originalLookup })
+	lookupIPAddrFunc = stubLookup(t, map[string][]net.IP{
+		"oauth2.googleapis.com": {net.ParseIP("142.250.72.10")},
+	})
+
+	endpoint, makeClient, ok := guardedRemoteClient(&remote_pb.RemoteConf{
+		Type:                            "gcs",
+		GcsGoogleApplicationCredentials: `{"type":"service_account","token_uri":"http://127.0.0.1:9/token"}`,
+	})
+	if !ok {
+		t.Fatal("gcs conf with inline credentials should be guarded")
+	}
+	if endpoint != "http://127.0.0.1:9/token" {
+		t.Errorf("endpoint = %q, want the credential token_uri", endpoint)
+	}
+	if err := validateRemoteEndpoint(context.Background(), endpoint); err == nil {
+		t.Error("expected the loopback token endpoint to be rejected")
+	}
+	if makeClient == nil {
+		t.Error("expected a constructor")
+	}
+
+	endpoint, _, ok = guardedRemoteClient(&remote_pb.RemoteConf{
+		Type:                            "gcs",
+		GcsGoogleApplicationCredentials: `{"type":"service_account"}`,
+	})
+	if !ok {
+		t.Fatal("gcs conf with inline credentials should be guarded")
+	}
+	if err := validateRemoteEndpoint(context.Background(), endpoint); err != nil {
+		t.Errorf("default token endpoint %q should pass: %v", endpoint, err)
+	}
+}
+
+// TestCheckGcsCredentials confirms only inline credentials that carry their own
+// key material are accepted. The federated types name a url, file or executable
+// that the SDK reads the token from, none of which the endpoint guard sees.
+func TestCheckGcsCredentials(t *testing.T) {
+	rejected := []string{
+		"/etc/hostname",
+		"~/creds.json",
+		`{`,
+		`{}`,
+		`{"type":"external_account","token_url":"http://127.0.0.1:9/v1/token","credential_source":{"url":"http://169.254.169.254/latest/meta-data/"}}`,
+		`{"type":"external_account","token_url":"http://127.0.0.1:9/v1/token","credential_source":{"file":"/etc/shadow"}}`,
+		`{"type":"external_account","credential_source":{"executable":{"command":"/bin/sh"}}}`,
+		`{"type":"external_account_authorized_user","token_url":"http://127.0.0.1:9/v1/token"}`,
+		`{"type":"impersonated_service_account","service_account_impersonation_url":"http://127.0.0.1:9/x"}`,
+	}
+	for _, creds := range rejected {
+		if err := checkGcsCredentials(creds); err == nil {
+			t.Errorf("expected %q to be rejected", creds)
+		}
+	}
+	accepted := []string{
+		"",
+		`{"type":"service_account","client_email":"a@b.com","private_key":"k"}`,
+		`{"type":"service_account","token_uri":"https://oauth2.googleapis.com/token"}`,
+		`{"type":"authorized_user","refresh_token":"r"}`,
+	}
+	for _, creds := range accepted {
+		if err := checkGcsCredentials(creds); err != nil {
+			t.Errorf("expected %q to be accepted, got %v", creds, err)
+		}
+	}
+}
+
 // TestGuardedDialerLiteralBlocked confirms that a literal blocked IP target
 // is refused without any DNS lookup.
 func TestGuardedDialerLiteralBlocked(t *testing.T) {
@@ -268,3 +597,185 @@ func TestGuardedDialerLiteralBlocked(t *testing.T) {
 		t.Fatalf("guarded dialer should fail with private-address error, got %v", err)
 	}
 }
+
+// TestGuardedReplicaDialerRebind confirms the replica upload's dial-time guard
+// refuses a hostname that rebinds to loopback after validateReplicaTarget, yet
+// keeps letting private peers through (allowPrivate).
+func TestGuardedReplicaDialerRebind(t *testing.T) {
+	originalLookup := lookupIPAddrFunc
+	t.Cleanup(func() { lookupIPAddrFunc = originalLookup })
+
+	const host = "replica.example.com"
+	var calls atomic.Int32
+	lookupIPAddrFunc = func(_ context.Context, name string) ([]net.IPAddr, error) {
+		if name != host {
+			return nil, &net.DNSError{Err: "no such host", Name: name, IsNotFound: true}
+		}
+		if calls.Add(1) == 1 {
+			return []net.IPAddr{{IP: net.ParseIP("52.216.10.10")}}, nil
+		}
+		return []net.IPAddr{{IP: net.ParseIP("127.0.0.1")}}, nil
+	}
+
+	// Up-front validation sees the public answer and accepts the target.
+	if err := validateReplicaTarget(context.Background(), host+":8080"); err != nil {
+		t.Fatalf("public replica target should validate, got %v", err)
+	}
+	// The dial then re-resolves to loopback and must refuse it.
+	dial := guardedDialerPolicy(host+":8080", true)
+	conn, err := dial(context.Background(), "tcp", host+":8080")
+	if conn != nil {
+		conn.Close()
+		t.Fatalf("guarded replica dialer must refuse loopback rebind, got conn")
+	}
+	if err == nil || !strings.Contains(err.Error(), "loopback") {
+		t.Fatalf("expected loopback refusal, got %v", err)
+	}
+
+	// A private literal peer is allowed through: the dial is attempted (and here
+	// fails on the already-cancelled context) rather than blocked as private.
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if _, perr := guardedDialerPolicy("10.0.0.5:80", true)(ctx, "tcp", "10.0.0.5:80"); perr != nil && strings.Contains(perr.Error(), "private") {
+		t.Fatalf("private peer must be allowed by the replica dialer, got %v", perr)
+	}
+}
+
+// TestBuildGuardedRemoteStorageClient confirms the shared builder refuses a
+// caller-influenced endpoint that resolves to a blocked address, and a gcs
+// credentials path, while allowUntrusted falls back to the plain builder.
+func TestBuildGuardedRemoteStorageClient(t *testing.T) {
+	loopbackS3 := &remote_pb.RemoteConf{
+		Name:        "poc",
+		Type:        "s3",
+		S3Endpoint:  "http://127.0.0.1:8000",
+		S3AccessKey: "k",
+		S3SecretKey: "s",
+		S3Region:    "us-east-1",
+	}
+	if _, err := BuildGuardedRemoteStorageClient(context.Background(), loopbackS3, false); err == nil {
+		t.Error("expected a loopback s3 endpoint to be rejected")
+	} else if !strings.Contains(err.Error(), "reject remote endpoint") {
+		t.Errorf("error = %v, want reject remote endpoint", err)
+	}
+	if _, err := BuildGuardedRemoteStorageClient(context.Background(), loopbackS3, true); err != nil {
+		t.Errorf("allowUntrusted should build the client: %v", err)
+	}
+
+	gcsPathCreds := &remote_pb.RemoteConf{
+		Name:                            "poc",
+		Type:                            "gcs",
+		GcsGoogleApplicationCredentials: "/etc/hostname",
+	}
+	if _, err := BuildGuardedRemoteStorageClient(context.Background(), gcsPathCreds, false); err == nil {
+		t.Error("expected a non-credentials file path to be rejected")
+	} else if !strings.Contains(err.Error(), "reject remote credentials") {
+		t.Errorf("error = %v, want reject remote credentials", err)
+	} else if strings.Contains(err.Error(), "/etc/hostname") {
+		t.Errorf("error must not leak the file path: %v", err)
+	}
+
+	// A file path that points to valid GCS credentials should be accepted.
+	credsFile := filepath.Join(t.TempDir(), "service-account.json")
+	validCreds := `{"type":"service_account","token_uri":"https://oauth2.googleapis.com/token","client_email":"sa@example.iam.gserviceaccount.com","private_key":"-----BEGIN PRIVATE KEY-----\nMIIBVwIBADANBgkqhkiG9w0BAQEFAASCAUEwggE9AgEAAkEAxY\n-----END PRIVATE KEY-----\n","private_key_id":"key1"}`
+	if err := os.WriteFile(credsFile, []byte(validCreds), 0600); err != nil {
+		t.Fatalf("write creds file: %v", err)
+	}
+	gcsFileCreds := &remote_pb.RemoteConf{
+		Name:                            "good",
+		Type:                            "gcs",
+		GcsGoogleApplicationCredentials: credsFile,
+	}
+	if err := checkGcsCredentials(credsFile); err != nil {
+		t.Errorf("valid gcs credentials file should pass: %v", err)
+	}
+	if _, err := BuildGuardedRemoteStorageClient(context.Background(), gcsFileCreds, false); err != nil {
+		t.Errorf("valid gcs credentials file should build: %v", err)
+	}
+
+	// A nonexistent path must be rejected without leaking the path in the error.
+	gcsMissingCreds := &remote_pb.RemoteConf{
+		Name:                            "missing",
+		Type:                            "gcs",
+		GcsGoogleApplicationCredentials: filepath.Join(t.TempDir(), "does-not-exist.json"),
+	}
+	if _, err := BuildGuardedRemoteStorageClient(context.Background(), gcsMissingCreds, false); err == nil {
+		t.Error("expected a nonexistent credentials file to be rejected")
+	} else if strings.Contains(err.Error(), "does-not-exist") {
+		t.Errorf("error must not leak the file path: %v", err)
+	}
+}
+
+// TestValidateRemoteConfForLoad confirms the load-time validator (injected into
+// the filer's FilerRemoteStorage) rejects a RemoteConf whose endpoint resolves
+// to a blocked address, while allowUntrusted skips the check. A conf whose type
+// dials a fixed provider host (no caller-supplied endpoint) passes.
+func TestValidateRemoteConfForLoad(t *testing.T) {
+	loopbackS3 := &remote_pb.RemoteConf{
+		Name:       "poc",
+		Type:       "s3",
+		S3Endpoint: "http://127.0.0.1:8000",
+		S3Region:   "us-east-1",
+	}
+	if err := ValidateRemoteConfForLoad(context.Background(), loopbackS3, false); err == nil {
+		t.Error("expected a loopback s3 endpoint to be rejected at load")
+	} else if !strings.Contains(err.Error(), "reject remote endpoint") {
+		t.Errorf("error = %v, want reject remote endpoint", err)
+	}
+	// allowUntrusted mirrors the volume server opt-out.
+	if err := ValidateRemoteConfForLoad(context.Background(), loopbackS3, true); err != nil {
+		t.Errorf("allowUntrusted should accept the conf: %v", err)
+	}
+	// A non-S3-compatible type with no caller-supplied endpoint dials a fixed
+	// provider host, so there is nothing caller-influenced to deny.
+	fixedHost := &remote_pb.RemoteConf{Name: "fixed", Type: "gcs"}
+	if err := ValidateRemoteConfForLoad(context.Background(), fixedHost, false); err != nil {
+		t.Errorf("fixed-host provider should pass: %v", err)
+	}
+	// nil conf is a no-op.
+	if err := ValidateRemoteConfForLoad(context.Background(), nil, false); err != nil {
+		t.Errorf("nil conf should be a no-op: %v", err)
+	}
+	// A hostname endpoint is not resolved at load time (DNS is left to the
+	// build-time guard at dial), so it must pass even if it would resolve to a
+	// blocked address. This prevents transient DNS failures from disabling
+	// working mounts during /etc/remote reload.
+	hostnameS3 := &remote_pb.RemoteConf{
+		Name:       "host",
+		Type:       "s3",
+		S3Endpoint: "http://internal.example.com",
+		S3Region:   "us-east-1",
+	}
+	if err := ValidateRemoteConfForLoad(context.Background(), hostnameS3, false); err != nil {
+		t.Errorf("hostname endpoint should pass at load (DNS deferred to dial): %v", err)
+	}
+	// A standard AWS S3 config with no custom endpoint (empty S3Endpoint) has
+	// no caller-supplied endpoint to guard — the AWS SDK derives the regional
+	// endpoint. Both the load-time validator and the build-time guard must
+	// accept it so standard AWS S3 mounts keep working.
+	standardS3 := &remote_pb.RemoteConf{
+		Name:     "aws",
+		Type:     "s3",
+		S3Region: "us-east-1",
+	}
+	if err := ValidateRemoteConfForLoad(context.Background(), standardS3, false); err != nil {
+		t.Errorf("standard AWS S3 (empty endpoint) should pass: %v", err)
+	}
+	if _, err := BuildGuardedRemoteStorageClient(context.Background(), standardS3, false); err != nil {
+		t.Errorf("standard AWS S3 (empty endpoint) should build: %v", err)
+	}
+	// A non-s3 S3-compatible type with an empty endpoint is a misconfiguration
+	// (the AWS SDK would derive an AWS endpoint). The guard must reject it
+	// rather than fall through to the unguarded cache.
+	aliyunNoEndpoint := &remote_pb.RemoteConf{
+		Name:         "aliyun",
+		Type:         "aliyun",
+		AliyunRegion: "cn-hangzhou",
+	}
+	if err := ValidateRemoteConfForLoad(context.Background(), aliyunNoEndpoint, false); err == nil {
+		t.Error("aliyun with empty endpoint should be rejected at load")
+	}
+	if _, err := BuildGuardedRemoteStorageClient(context.Background(), aliyunNoEndpoint, false); err == nil {
+		t.Error("aliyun with empty endpoint should be rejected by the guard")
+	}
+}
diff --git a/weed/server/volume_grpc_scrub.go b/weed/server/volume_grpc_scrub.go
index 412f0bbd2f..cfd8aafaf8 100644
--- a/weed/server/volume_grpc_scrub.go
+++ b/weed/server/volume_grpc_scrub.go
@@ -7,9 +7,11 @@ import (
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 )
 
@@ -18,7 +20,8 @@ func (vs *VolumeServer) ScrubVolume(ctx context.Context, req *volume_server_pb.S
 		return nil, err
 	}
 	vids := []needle.VolumeId{}
-	if len(req.GetVolumeIds()) == 0 {
+	explicit := len(req.GetVolumeIds()) != 0
+	if !explicit {
 		for _, l := range vs.store.Locations {
 			vids = append(vids, l.VolumeIds()...)
 		}
@@ -28,6 +31,22 @@ func (vs *VolumeServer) ScrubVolume(ctx context.Context, req *volume_server_pb.S
 		}
 	}
 
+	return vs.scrubVolumes(ctx, req, vids, explicit)
+}
+
+// scrubVolumes walks an already-resolved volume list. Split out from
+// ScrubVolume so the vanished-volume handling below is reachable from a test:
+// the list and the store are read under the same lock nowhere, so a test
+// cannot otherwise arrange for an id to disappear between the two.
+//
+// explicit says the caller named the volumes. A named volume that is absent is
+// a caller error and still fails the request; an id that came from the node's
+// own listing is not, because nothing holds a lock across the scan and the
+// volume set is free to change under it — the heartbeat drops a volume with an
+// I/O error, and a delete or an unmount can land at any point. Failing there
+// would discard every result accumulated so far and leave every later volume
+// unscrubbed, which is the opposite of what a node-wide scrub is for.
+func (vs *VolumeServer) scrubVolumes(ctx context.Context, req *volume_server_pb.ScrubVolumeRequest, vids []needle.VolumeId, explicit bool) (*volume_server_pb.ScrubVolumeResponse, error) {
 	var details []string
 	var totalVolumes, totalFiles uint64
 	var brokenVolumes []*storage.Volume
@@ -35,7 +54,11 @@ func (vs *VolumeServer) ScrubVolume(ctx context.Context, req *volume_server_pb.S
 	for _, vid := range vids {
 		v := vs.store.GetVolume(vid)
 		if v == nil {
-			return nil, fmt.Errorf("volume id %d not found", vid)
+			if explicit {
+				return nil, fmt.Errorf("volume id %d not found", vid)
+			}
+			glog.V(0).Infof("scrub: volume %d is no longer mounted, skipping", vid)
+			continue
 		}
 
 		var files int64
@@ -43,8 +66,9 @@ func (vs *VolumeServer) ScrubVolume(ctx context.Context, req *volume_server_pb.S
 		switch m := req.GetMode(); m {
 		case volume_server_pb.VolumeScrubMode_INDEX:
 			files, serrs = v.ScrubIndex()
-		case volume_server_pb.VolumeScrubMode_LOCAL:
-			// LOCAL is equivalent to FULL for regular volumes
+		case volume_server_pb.VolumeScrubMode_LOCAL, volume_server_pb.VolumeScrubMode_READS:
+			// both are equivalent to FULL for regular volumes: there are no shards to
+			// stay local to, and nothing to reconstruct from
 			fallthrough
 		case volume_server_pb.VolumeScrubMode_FULL:
 			files, serrs = v.Scrub()
@@ -66,7 +90,7 @@ func (vs *VolumeServer) ScrubVolume(ctx context.Context, req *volume_server_pb.S
 	errs := []error{}
 	if req.GetMarkBrokenVolumesReadonly() {
 		for _, v := range brokenVolumes {
-			if err := vs.makeVolumeReadonly(ctx, v, true); err != nil {
+			if err := vs.makeVolumeReadonly(ctx, v, false, true); err != nil {
 				errs = append(errs, err)
 				details = append(details, err.Error())
 			} else {
@@ -96,14 +120,26 @@ func (vs *VolumeServer) ScrubEcVolume(ctx context.Context, req *volume_server_pb
 	if err := vs.checkGrpcAdminAuth(ctx); err != nil {
 		return nil, err
 	}
-	if req.GetForceDeletedNeedlesCheck() && req.GetMode() != volume_server_pb.VolumeScrubMode_FULL {
-		return nil, fmt.Errorf("deleted needle checks are only supported for FULL scrubs")
+	if m := req.GetMode(); req.GetForceDeletedNeedlesCheck() &&
+		m != volume_server_pb.VolumeScrubMode_FULL && m != volume_server_pb.VolumeScrubMode_READS {
+		return nil, fmt.Errorf("deleted needle checks are only supported for FULL and READS scrubs")
 	}
 
 	vids := []needle.VolumeId{}
-	if len(req.GetVolumeIds()) == 0 {
+	explicit := len(req.GetVolumeIds()) != 0
+	if !explicit {
+		// A split-disk volume is mounted once per disk, so a node-wide
+		// listing would otherwise scrub it once per location. Dedupe in
+		// location order so the merged view still sees every runtime.
+		seen := map[needle.VolumeId]struct{}{}
 		for _, l := range vs.store.Locations {
-			vids = append(vids, l.EcVolumeIds()...)
+			for _, vid := range l.EcVolumeIds() {
+				if _, ok := seen[vid]; ok {
+					continue
+				}
+				seen[vid] = struct{}{}
+				vids = append(vids, vid)
+			}
 		}
 	} else {
 		for _, vid := range req.GetVolumeIds() {
@@ -111,14 +147,30 @@ func (vs *VolumeServer) ScrubEcVolume(ctx context.Context, req *volume_server_pb
 		}
 	}
 
+	return vs.scrubEcVolumes(req, vids, explicit)
+}
+
+// scrubEcVolumes walks an already-resolved EC volume list. Same split, and same
+// vanished-volume rule, as scrubVolumes — see its comment.
+func (vs *VolumeServer) scrubEcVolumes(req *volume_server_pb.ScrubEcVolumeRequest, vids []needle.VolumeId, explicit bool) (*volume_server_pb.ScrubEcVolumeResponse, error) {
 	var details []string
 	var totalVolumes, totalFiles uint64
 	var brokenVolumeIds []uint32
 	var brokenShardInfos []*volume_server_pb.EcShardInfo
 	for _, vid := range vids {
-		v, found := vs.store.FindEcVolume(vid)
-		if !found {
-			return nil, fmt.Errorf("EC volume id %d not found", vid)
+		// Resolve every per-disk runtime, not just the first: a reconciled
+		// volume's shards are split across runtimes, and a scrub that only
+		// sees the first disk misses the rest. The merged view fences on
+		// encode generation and geometry so incompatible runtimes are
+		// reported rather than verified together.
+		runtimes := vs.store.FindAllEcVolumes(vid)
+		merged := erasure_coding.MergeEcRuntimes(runtimes)
+		if merged == nil {
+			if explicit {
+				return nil, fmt.Errorf("EC volume id %d not found", vid)
+			}
+			glog.V(0).Infof("ec scrub: volume %d is no longer mounted, skipping", vid)
+			continue
 		}
 
 		var files int64
@@ -126,18 +178,20 @@ func (vs *VolumeServer) ScrubEcVolume(ctx context.Context, req *volume_server_pb
 		var serrs []error
 		switch m := req.GetMode(); m {
 		case volume_server_pb.VolumeScrubMode_INDEX:
-			// index scrubs do not verify individual EC shards
-			files, serrs = v.ScrubIndex()
+			files, serrs = merged.Anchor.ScrubIndex()
+			for _, sk := range merged.Skipped {
+				serrs = append(serrs, fmt.Errorf("%s", sk))
+			}
 		case volume_server_pb.VolumeScrubMode_LOCAL:
-			files, shardInfos, serrs = v.ScrubLocal()
-		case volume_server_pb.VolumeScrubMode_FULL:
-			files, shardInfos, serrs = vs.store.ScrubEcVolume(v.VolumeId, req.GetForceDeletedNeedlesCheck())
+			files, shardInfos, serrs = merged.ScrubLocal()
+		case volume_server_pb.VolumeScrubMode_FULL, volume_server_pb.VolumeScrubMode_READS:
+			files, shardInfos, serrs = vs.store.ScrubEcVolumeMerged(merged, m, req.GetForceDeletedNeedlesCheck())
 		case volume_server_pb.VolumeScrubMode_CHECKSUM:
 			// Verify each local shard's raw bytes against the bitrot sidecar,
-			// exercising cold parity shards. Read-only. ChecksumScrub's first
-			// return is blocks scanned, not files — discard it so TotalFiles
-			// (a needle/file count) isn't inflated by the block count.
-			_, shardInfos, serrs = v.ChecksumScrub()
+			// exercising cold parity shards. Read-only. The first return is
+			// blocks scanned, not files — discard it so TotalFiles (a
+			// needle/file count) isn't inflated by the block count.
+			_, shardInfos, serrs = merged.ChecksumScrub()
 		default:
 			return nil, fmt.Errorf("unsupported EC volume scrub mode %d", m)
 		}
@@ -145,7 +199,7 @@ func (vs *VolumeServer) ScrubEcVolume(ctx context.Context, req *volume_server_pb
 		totalVolumes += 1
 		totalFiles += uint64(files)
 		if len(serrs) != 0 || len(shardInfos) != 0 {
-			brokenVolumeIds = append(brokenVolumeIds, uint32(v.VolumeId))
+			brokenVolumeIds = append(brokenVolumeIds, uint32(vid))
 			brokenShardInfos = append(brokenShardInfos, shardInfos...)
 			for _, err := range serrs {
 				details = append(details, err.Error())
diff --git a/weed/server/volume_grpc_scrub_ec_merge_test.go b/weed/server/volume_grpc_scrub_ec_merge_test.go
new file mode 100644
index 0000000000..b113a5c5cd
--- /dev/null
+++ b/weed/server/volume_grpc_scrub_ec_merge_test.go
@@ -0,0 +1,178 @@
+package weed_server
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// newMultiDiskEcScrubStore builds a store with one DiskLocation per dir, so a
+// volume whose shards are split across dirs mounts as one EcVolume per disk.
+func newMultiDiskEcScrubStore(t *testing.T, dirs ...string) *storage.Store {
+	t.Helper()
+	max := make([]int32, len(dirs))
+	minFree := make([]util.MinFreeSpace, len(dirs))
+	diskTypes := make([]types.DiskType, len(dirs))
+	tags := make([][]string, len(dirs))
+	for i := range dirs {
+		max[i] = 10
+		diskTypes[i] = types.HardDriveType
+	}
+	// idxFolder shared so .ecx/.ecj resolve from any disk's index dir.
+	s := storage.NewStore(
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		"127.0.0.1", 0, 0, "", "test-store",
+		dirs, max, minFree,
+		dirs[0], storage.NeedleMapInMemory,
+		diskTypes, tags,
+		0, stats.DiskIOProbeConfig{},
+	)
+	t.Cleanup(s.Close)
+	return s
+}
+
+// seedEcShardOnDisk writes the minimal files for one shard id on one disk and
+// mounts it. The .ecx is shared (one entry) so ScrubIndex/ScrubLocal can run.
+func seedEcShardOnDisk(t *testing.T, store *storage.Store, vid needle.VolumeId, collection, dir string, shardId int, encodeTs int64, dataShards, parityShards int, blockSize int64) {
+	t.Helper()
+	base := erasure_coding.EcShardFileName(collection, dir, int(vid))
+	require.NoError(t, os.WriteFile(base+".ecx", make([]byte, types.NeedleMapEntrySize), 0o644))
+	require.NoError(t, os.WriteFile(base+".ecj", nil, 0o644))
+	require.NoError(t, os.WriteFile(base+erasure_coding.ToExt(shardId), []byte("s"), 0o644))
+	vif := &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.Version3),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards:   uint32(dataShards),
+			ParityShards: uint32(parityShards),
+			BlockSize:    blockSize,
+			EncodeTsNs:   encodeTs,
+		},
+	}
+	require.NoError(t, volume_info.SaveVolumeInfo(base+".vif", vif))
+	require.NoError(t, store.MountEcShards(collection, vid, erasure_coding.ShardId(shardId), types.HardDriveType.String()))
+}
+
+// TestScrubEcVolume_DedupesSplitDiskVolume: a volume mounted on two disks must
+// be scrubbed once (TotalVolumes == 1), not once per location.
+func TestScrubEcVolume_DedupesSplitDiskVolume(t *testing.T) {
+	diskA, diskB := t.TempDir(), t.TempDir()
+	store := newMultiDiskEcScrubStore(t, diskA, diskB)
+	const vid = needle.VolumeId(900)
+	seedEcShardOnDisk(t, store, vid, "split", diskA, 0, 0, 10, 4, 0)
+	seedEcShardOnDisk(t, store, vid, "split", diskB, 1, 0, 10, 4, 0)
+
+	vs := &VolumeServer{store: store}
+	res, err := vs.scrubEcVolumes(
+		&volume_server_pb.ScrubEcVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_INDEX},
+		[]needle.VolumeId{vid}, true)
+	require.NoError(t, err)
+	assert.Equal(t, uint64(1), res.GetTotalVolumes(), "a split-disk volume must be scrubbed once, not once per disk")
+}
+
+// TestScrubEcVolume_FencesOnEncodeGeneration: a runtime from an older encode
+// run must be excluded and reported, not merged into the scrub.
+func TestScrubEcVolume_FencesOnEncodeGeneration(t *testing.T) {
+	diskA, diskB := t.TempDir(), t.TempDir()
+	store := newMultiDiskEcScrubStore(t, diskA, diskB)
+	const vid = needle.VolumeId(901)
+	seedEcShardOnDisk(t, store, vid, "gen", diskA, 0, 1000, 10, 4, 0)
+	seedEcShardOnDisk(t, store, vid, "gen", diskB, 1, 500, 10, 4, 0)
+
+	vs := &VolumeServer{store: store}
+	res, err := vs.scrubEcVolumes(
+		&volume_server_pb.ScrubEcVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_INDEX},
+		[]needle.VolumeId{vid}, true)
+	require.NoError(t, err)
+	assert.Equal(t, uint64(1), res.GetTotalVolumes())
+	var foundSkip bool
+	for _, d := range res.GetDetails() {
+		if strings.Contains(d, "belong to encode run 500") {
+			foundSkip = true
+		}
+	}
+	assert.True(t, foundSkip, "older encode-generation runtime must be reported as skipped, got details: %v", res.GetDetails())
+}
+
+// TestScrubEcVolume_FencesOnGeometry: same encode timestamp but disagreeing
+// geometry must exclude and report the incompatible runtime.
+func TestScrubEcVolume_FencesOnGeometry(t *testing.T) {
+	diskA, diskB := t.TempDir(), t.TempDir()
+	store := newMultiDiskEcScrubStore(t, diskA, diskB)
+	const vid = needle.VolumeId(902)
+	seedEcShardOnDisk(t, store, vid, "geo", diskA, 0, 1000, 10, 4, 3*1024*1024)
+	seedEcShardOnDisk(t, store, vid, "geo", diskB, 1, 1000, 12, 4, 3*1024*1024)
+
+	vs := &VolumeServer{store: store}
+	res, err := vs.scrubEcVolumes(
+		&volume_server_pb.ScrubEcVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_INDEX},
+		[]needle.VolumeId{vid}, true)
+	require.NoError(t, err)
+	assert.Equal(t, uint64(1), res.GetTotalVolumes())
+	var foundGeoSkip bool
+	for _, d := range res.GetDetails() {
+		if strings.Contains(d, "disagree on geometry") {
+			foundGeoSkip = true
+		}
+	}
+	assert.True(t, foundGeoSkip, "geometry-mismatched runtime must be reported as skipped, got details: %v", res.GetDetails())
+}
+
+// TestScrubEcVolume_LocalReachesSiblingDisk: LOCAL mode over a split-disk
+// volume must see shards from both disks (the merged view), not just the
+// first. With both shards local, the index walk has no missing-shard error.
+func TestScrubEcVolume_LocalReachesSiblingDisk(t *testing.T) {
+	diskA, diskB := t.TempDir(), t.TempDir()
+	store := newMultiDiskEcScrubStore(t, diskA, diskB)
+	const vid = needle.VolumeId(903)
+	seedEcShardOnDisk(t, store, vid, "sib", diskA, 0, 0, 10, 4, 0)
+	seedEcShardOnDisk(t, store, vid, "sib", diskB, 1, 0, 10, 4, 0)
+
+	vs := &VolumeServer{store: store}
+	res, err := vs.scrubEcVolumes(
+		&volume_server_pb.ScrubEcVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_LOCAL},
+		[]needle.VolumeId{vid}, true)
+	require.NoError(t, err)
+	assert.Equal(t, uint64(1), res.GetTotalVolumes())
+}
+
+// TestMergeEcRuntimes_ReportsAnchorGeneration: the anchor is the maximum
+// encode generation, and a single-runtime volume anchors on itself.
+func TestMergeEcRuntimes_ReportsAnchorGeneration(t *testing.T) {
+	dir := t.TempDir()
+	store := newMultiDiskEcScrubStore(t, dir)
+	const vid = needle.VolumeId(904)
+	seedEcShardOnDisk(t, store, vid, "anchor", dir, 0, 7777, 10, 4, 0)
+
+	runtimes := store.FindAllEcVolumes(vid)
+	require.Len(t, runtimes, 1)
+	merged := erasure_coding.MergeEcRuntimes(runtimes)
+	require.NotNil(t, merged)
+	assert.Equal(t, int64(7777), merged.Anchor.EncodeTsNs)
+	assert.Empty(t, merged.Skipped)
+	assert.Len(t, merged.Merged, 1)
+}
+
+// TestMergeEcRuntimes_NilForEmptyInput: an empty runtime slice (vanished
+// volume) yields a nil merged view.
+func TestMergeEcRuntimes_NilForEmptyInput(t *testing.T) {
+	assert.Nil(t, erasure_coding.MergeEcRuntimes(nil))
+	assert.Nil(t, erasure_coding.MergeEcRuntimes([]*erasure_coding.EcVolume{}))
+}
+
+// Ensure filepath import is used (helper for future multi-disk tests).
+var _ = filepath.Join
diff --git a/weed/server/volume_grpc_scrub_test.go b/weed/server/volume_grpc_scrub_test.go
new file mode 100644
index 0000000000..8b32e22c98
--- /dev/null
+++ b/weed/server/volume_grpc_scrub_test.go
@@ -0,0 +1,85 @@
+package weed_server
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// A node-wide scrub reads the volume list without holding anything across the
+// scan, so the set is free to change under it: the heartbeat drops a volume
+// that reported an I/O error, and a delete or an unmount can land between two
+// volumes. Failing the RPC there discards every result gathered so far and
+// leaves every later volume unscrubbed, so an id that came from the node's own
+// listing is skipped instead.
+func TestScrubVolumeSkipsVanishedVolumeAndScrubsTheRest(t *testing.T) {
+	present := needle.VolumeId(1)
+	vs, _ := newMaintenanceModeServer(t, present, "")
+
+	// Absent first: if the handler still aborted, the present volume behind it
+	// would never be scrubbed.
+	res, err := vs.scrubVolumes(context.Background(),
+		&volume_server_pb.ScrubVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_INDEX},
+		[]needle.VolumeId{needle.VolumeId(17), present}, false)
+	require.NoError(t, err, "a volume that disappeared from the node's own listing must not fail the scrub")
+	assert.Equal(t, uint64(1), res.GetTotalVolumes(), "the volume behind the vanished one must still be scrubbed")
+}
+
+// A caller who names a volume that is not here gets told, unchanged.
+func TestScrubVolumeFailsOnExplicitlyRequestedMissingVolume(t *testing.T) {
+	vs, _ := newMaintenanceModeServer(t, needle.VolumeId(1), "")
+
+	_, err := vs.scrubVolumes(context.Background(),
+		&volume_server_pb.ScrubVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_INDEX},
+		[]needle.VolumeId{needle.VolumeId(17)}, true)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "volume id 17 not found")
+}
+
+// newEcScrubServer mounts one EC shard (plus the shared index) so FindEcVolume
+// resolves, which is all an INDEX-mode scrub needs.
+func newEcScrubServer(t *testing.T, vid needle.VolumeId, collection string) *VolumeServer {
+	t.Helper()
+	dir := t.TempDir()
+	store := newTraversalTestStore(dir)
+	t.Cleanup(store.Close)
+
+	base := erasure_coding.EcShardFileName(collection, dir, int(vid))
+	require.NoError(t, os.WriteFile(base+".ecx", make([]byte, types.NeedleMapEntrySize), 0o644))
+	require.NoError(t, os.WriteFile(base+".ecj", nil, 0o644))
+	require.NoError(t, os.WriteFile(base+erasure_coding.ToExt(0), []byte("s"), 0o644))
+	require.NoError(t, store.MountEcShards(collection, vid, 0, types.HardDriveType.String()))
+
+	return &VolumeServer{store: store}
+}
+
+// Same rule for EC volumes, which the heartbeat also expires under a store
+// write: delete_expired_ec_volumes destroys a volume whose destroy time has
+// passed, and volume_ec_shards_delete unmounts one on demand.
+func TestScrubEcVolumeSkipsVanishedVolumeAndScrubsTheRest(t *testing.T) {
+	present := needle.VolumeId(77)
+	vs := newEcScrubServer(t, present, "ec-scrub")
+
+	res, err := vs.scrubEcVolumes(
+		&volume_server_pb.ScrubEcVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_INDEX},
+		[]needle.VolumeId{needle.VolumeId(17), present}, false)
+	require.NoError(t, err, "an EC volume that disappeared from the node's own listing must not fail the scrub")
+	assert.Equal(t, uint64(1), res.GetTotalVolumes(), "the EC volume behind the vanished one must still be scrubbed")
+}
+
+func TestScrubEcVolumeFailsOnExplicitlyRequestedMissingVolume(t *testing.T) {
+	vs := newEcScrubServer(t, needle.VolumeId(77), "ec-scrub")
+
+	_, err := vs.scrubEcVolumes(
+		&volume_server_pb.ScrubEcVolumeRequest{Mode: volume_server_pb.VolumeScrubMode_INDEX},
+		[]needle.VolumeId{needle.VolumeId(17)}, true)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "EC volume id 17 not found")
+}
diff --git a/weed/server/volume_grpc_tail.go b/weed/server/volume_grpc_tail.go
index 552fea2b7e..2c42d314e4 100644
--- a/weed/server/volume_grpc_tail.go
+++ b/weed/server/volume_grpc_tail.go
@@ -20,6 +20,9 @@ func (vs *VolumeServer) VolumeTailSender(req *volume_server_pb.VolumeTailSenderR
 	if v == nil {
 		return fmt.Errorf("not found volume id %d", req.VolumeId)
 	}
+	if err := v.UnavailableError(); err != nil {
+		return err
+	}
 
 	defer glog.V(1).Infof("tailing volume %d finished", v.Id)
 
@@ -27,6 +30,9 @@ func (vs *VolumeServer) VolumeTailSender(req *volume_server_pb.VolumeTailSenderR
 	drainingSeconds := req.IdleTimeoutSeconds
 
 	for {
+		if err := v.UnavailableError(); err != nil {
+			return err
+		}
 		lastProcessedTimestampNs, err := sendNeedlesSince(stream, v, lastTimestampNs)
 		if err != nil {
 			glog.Infof("sendNeedlesSince: %v", err)
@@ -64,6 +70,9 @@ func sendNeedlesSince(stream volume_server_pb.VolumeServer_VolumeTailSenderServe
 	// log.Printf("reading ts %d offset %d isLast %v", lastTimestampNs, foundOffset, isLastOne)
 
 	if isLastOne {
+		if err := v.UnavailableError(); err != nil {
+			return 0, err
+		}
 		// need to heart beat to the client to ensure the connection health
 		sendErr := stream.Send(&volume_server_pb.VolumeTailSenderResponse{IsLastChunk: true, Version: uint32(v.Version())})
 		return lastTimestampNs, sendErr
@@ -72,6 +81,7 @@ func sendNeedlesSince(stream volume_server_pb.VolumeServer_VolumeTailSenderServe
 	scanner := &VolumeFileScanner4Tailing{
 		stream:  stream,
 		version: uint32(v.Version()),
+		v:       v,
 	}
 
 	err = storage.ScanVolumeFileFrom(v.Version(), v.DataBackend, foundOffset.ToActualOffset(), scanner)
@@ -87,6 +97,12 @@ func (vs *VolumeServer) VolumeTailReceiver(ctx context.Context, req *volume_serv
 
 	resp := &volume_server_pb.VolumeTailReceiverResponse{}
 
+	if !vs.AllowUntrustedRemoteEndpoints {
+		if err := validateReplicaTarget(ctx, req.SourceVolumeServer); err != nil {
+			return resp, fmt.Errorf("invalid source volume server %s: %w", req.SourceVolumeServer, err)
+		}
+	}
+
 	v := vs.store.GetVolume(needle.VolumeId(req.VolumeId))
 	if v == nil {
 		return resp, fmt.Errorf("receiver not found volume id %d", req.VolumeId)
@@ -94,10 +110,10 @@ func (vs *VolumeServer) VolumeTailReceiver(ctx context.Context, req *volume_serv
 
 	defer glog.V(1).Infof("receive tailing volume %d finished", v.Id)
 
-	return resp, operation.TailVolumeFromSource(pb.ServerAddress(req.SourceVolumeServer), vs.grpcDialOption, v.Id, req.SinceNs, int(req.IdleTimeoutSeconds), func(n *needle.Needle) error {
+	return resp, operation.TailVolumeFromSource(pb.ServerAddress(req.SourceVolumeServer), v.Id, req.SinceNs, int(req.IdleTimeoutSeconds), func(n *needle.Needle) error {
 		_, err := vs.store.WriteVolumeNeedle(v.Id, n, false, false)
 		return err
-	})
+	}, vs.grpcDialOption, vs.guardedGrpcDialOption(req.SourceVolumeServer))
 
 }
 
@@ -106,6 +122,7 @@ type VolumeFileScanner4Tailing struct {
 	stream                   volume_server_pb.VolumeServer_VolumeTailSenderServer
 	lastProcessedTimestampNs uint64
 	version                  uint32
+	v                        *storage.Volume
 }
 
 func (scanner *VolumeFileScanner4Tailing) VisitSuperBlock(superBlock super_block.SuperBlock) error {
@@ -117,6 +134,9 @@ func (scanner *VolumeFileScanner4Tailing) ReadNeedleBody() bool {
 }
 
 func (scanner *VolumeFileScanner4Tailing) VisitNeedle(n *needle.Needle, offset int64, needleHeader, needleBody []byte) error {
+	if err := scanner.v.UnavailableError(); err != nil {
+		return err
+	}
 	isLastChunk := false
 
 	// need to send body by chunks
diff --git a/weed/server/volume_grpc_tier_download.go b/weed/server/volume_grpc_tier_download.go
index 5860f859a4..16461b7576 100644
--- a/weed/server/volume_grpc_tier_download.go
+++ b/weed/server/volume_grpc_tier_download.go
@@ -1,6 +1,7 @@
 package weed_server
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -12,6 +13,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
 )
 
 // VolumeTierMoveDatFromRemote copy dat file from a remote tier to local volume server
@@ -68,7 +70,7 @@ func (vs *VolumeServer) VolumeTierMoveDatFromRemote(req *volume_server_pb.Volume
 	}
 	// copy the data file (DownloadFile opens, fsyncs, and closes the .dat internally)
 	datFileName := v.FileName(".dat")
-	_, err := backendStorage.DownloadFile(datFileName, storageKey, fn)
+	_, err := backendStorage.DownloadFile(datFileName, storageKey, fn, clampTierConcurrency(int(req.Concurrency)))
 	if err != nil {
 		return fmt.Errorf("backend %s copy file %s: %v", storageName, datFileName, err)
 	}
@@ -94,7 +96,14 @@ func (vs *VolumeServer) VolumeTierMoveDatFromRemote(req *volume_server_pb.Volume
 	// with a .vif referencing the remote object while that object is deleted.
 	v.GetVolumeInfo().Files = v.GetVolumeInfo().Files[1:]
 	if err := v.SaveVolumeInfo(); err != nil {
-		return fmt.Errorf("volume %d failed to save remote file info: %v", v.Id, err)
+		var ndErr *volume_info.NotCrashDurableError
+		if !errors.As(err, &ndErr) {
+			return fmt.Errorf("volume %d failed to save remote file info: %v", v.Id, err)
+		}
+		// The .vif is committed but may not be crash-durable. Continue
+		// with the backend switch and remote deletion since the metadata
+		// already reflects the local-only state.
+		glog.Warningf("volume %d saved remote file info but not crash-durable: %v", v.Id, err)
 	}
 
 	// fsync the directory again so the rewritten .vif is durable.
@@ -125,7 +134,7 @@ func (vs *VolumeServer) VolumeTierMoveDatFromRemote(req *volume_server_pb.Volume
 // swapToLocalDatBackend closes the remote data backend and opens the downloaded
 // local .dat as a DiskFile so reads are served from local disk.
 func swapToLocalDatBackend(v *storage.Volume, datFileName string) error {
-	dataFile, err := os.OpenFile(datFileName, os.O_RDWR, 0644)
+	dataFile, err := backend.OpenVolumeFile(datFileName, os.O_RDWR)
 	if err != nil {
 		return err
 	}
diff --git a/weed/server/volume_grpc_tier_download_test.go b/weed/server/volume_grpc_tier_download_test.go
index 378ca13f18..29aee51e6c 100644
--- a/weed/server/volume_grpc_tier_download_test.go
+++ b/weed/server/volume_grpc_tier_download_test.go
@@ -32,6 +32,9 @@ type tierTestBackend struct {
 
 	mu      sync.Mutex
 	deletes []string
+
+	lastUploadConcurrency   int
+	lastDownloadConcurrency int
 }
 
 func (b *tierTestBackend) ToProperties() map[string]string { return map[string]string{"root": b.root} }
@@ -40,7 +43,10 @@ func (b *tierTestBackend) NewStorageFile(key string, tierInfo *volume_server_pb.
 	return &tierTestBackendFile{backend: b, key: key, tierInfo: tierInfo}
 }
 
-func (b *tierTestBackend) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error) (key string, size int64, err error) {
+func (b *tierTestBackend) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error, concurrency int) (key string, size int64, err error) {
+	b.mu.Lock()
+	b.lastUploadConcurrency = concurrency
+	b.mu.Unlock()
 	key = fmt.Sprintf("obj-%d", time.Now().UnixNano())
 	dst := filepath.Join(b.root, key)
 	out, err := os.Create(dst)
@@ -58,7 +64,10 @@ func (b *tierTestBackend) CopyFile(f *os.File, fn func(progressed int64, percent
 	return key, written, nil
 }
 
-func (b *tierTestBackend) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error) (size int64, err error) {
+func (b *tierTestBackend) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error, concurrency int) (size int64, err error) {
+	b.mu.Lock()
+	b.lastDownloadConcurrency = concurrency
+	b.mu.Unlock()
 	in, err := os.Open(filepath.Join(b.root, key))
 	if err != nil {
 		return 0, err
@@ -105,6 +114,12 @@ func (b *tierTestBackend) objectExists(key string) bool {
 	return err == nil
 }
 
+func (b *tierTestBackend) concurrencySeen() (upload, download int) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.lastUploadConcurrency, b.lastDownloadConcurrency
+}
+
 type tierTestBackendFile struct {
 	backend  *tierTestBackend
 	key      string
@@ -201,7 +216,7 @@ func tierUpVolumeOnDisk(t *testing.T, dir string, vid needle.VolumeId, b *tierTe
 		t.Fatalf("expected on-disk backend before tier-up, got %T", v.DataBackend)
 	}
 	datPath := v.FileName(".dat")
-	key, size, err := b.CopyFile(diskFile.File, nil)
+	key, size, err := b.CopyFile(diskFile.File, nil, 0)
 	if err != nil {
 		t.Fatalf("upload to fake backend: %v", err)
 	}
@@ -297,7 +312,7 @@ func TestTierMoveDatFromRemote_KeepRemote_LeavesReplicaLocal(t *testing.T) {
 	if err := store.UnmountVolume(vid); err != nil {
 		t.Fatalf("unmount after download: %v", err)
 	}
-	if err := store.MountVolume(vid); err != nil {
+	if err := store.MountVolume(vid, &req.Collection); err != nil {
 		t.Fatalf("remount after download: %v", err)
 	}
 	v2 := store.GetVolume(vid)
@@ -326,3 +341,44 @@ func TestTierMoveDatFromRemote_KeepRemote_LeavesReplicaLocal(t *testing.T) {
 		t.Fatalf("local .dat content mismatch: got %d bytes, want %d", len(gotDat), len(localDat))
 	}
 }
+
+// TestTierMoveConcurrencyPlumbing verifies the -concurrency value travels the
+// whole tier-move path to CopyFile and DownloadFile.
+func TestTierMoveConcurrencyPlumbing(t *testing.T) {
+	b := &tierTestBackend{root: t.TempDir()}
+	backend.BackendStorages[tierTestBackendName] = b
+	t.Cleanup(func() { delete(backend.BackendStorages, tierTestBackendName) })
+
+	dir := t.TempDir()
+	const vid = needle.VolumeId(72)
+	tierUpVolumeOnDisk(t, dir, vid, b)
+
+	// download path: request concurrency must reach DownloadFile
+	store := newTierTestStore(t, dir)
+	v := store.GetVolume(vid)
+	if v == nil {
+		t.Fatal("tiered volume not loaded by store")
+	}
+	vs := &VolumeServer{store: store}
+	if err := vs.VolumeTierMoveDatFromRemote(&volume_server_pb.VolumeTierMoveDatFromRemoteRequest{
+		VolumeId:    uint32(vid),
+		Concurrency: 4,
+	}, &fakeTierStream{}); err != nil {
+		t.Fatalf("VolumeTierMoveDatFromRemote: %v", err)
+	}
+	if up, down := b.concurrencySeen(); down != 4 {
+		t.Fatalf("DownloadFile concurrency = %d (upload=%d), want 4", down, up)
+	}
+
+	// upload path: the volume is local again after the download
+	if err := vs.VolumeTierMoveDatToRemote(&volume_server_pb.VolumeTierMoveDatToRemoteRequest{
+		VolumeId:               uint32(vid),
+		DestinationBackendName: tierTestBackendName,
+		Concurrency:            3,
+	}, &discardServerStream[volume_server_pb.VolumeTierMoveDatToRemoteResponse]{}); err != nil {
+		t.Fatalf("VolumeTierMoveDatToRemote: %v", err)
+	}
+	if up, down := b.concurrencySeen(); up != 3 || down != 4 {
+		t.Fatalf("CopyFile concurrency = %d (download=%d), want 3/4", up, down)
+	}
+}
diff --git a/weed/server/volume_grpc_tier_test.go b/weed/server/volume_grpc_tier_test.go
index f042948dec..ee41d619ef 100644
--- a/weed/server/volume_grpc_tier_test.go
+++ b/weed/server/volume_grpc_tier_test.go
@@ -52,7 +52,7 @@ func (b *tierTimestampTestBackend) NewStorageFile(key string, volumeInfo *volume
 	}
 }
 
-func (b *tierTimestampTestBackend) CopyFile(file *os.File, fn func(progressed int64, percentage float32) error) (key string, size int64, err error) {
+func (b *tierTimestampTestBackend) CopyFile(file *os.File, fn func(progressed int64, percentage float32) error, concurrency int) (key string, size int64, err error) {
 	key = "remote.dat"
 	fileInfo, err := file.Stat()
 	if err != nil {
@@ -72,7 +72,7 @@ func (b *tierTimestampTestBackend) CopyFile(file *os.File, fn func(progressed in
 	return key, size, err
 }
 
-func (b *tierTimestampTestBackend) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error) (size int64, err error) {
+func (b *tierTimestampTestBackend) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error, concurrency int) (size int64, err error) {
 	input, err := os.Open(filepath.Join(b.root, key))
 	if err != nil {
 		return 0, err
diff --git a/weed/server/volume_grpc_tier_upload.go b/weed/server/volume_grpc_tier_upload.go
index c6355c8c11..cd60cae528 100644
--- a/weed/server/volume_grpc_tier_upload.go
+++ b/weed/server/volume_grpc_tier_upload.go
@@ -5,11 +5,26 @@ import (
 	"os"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 )
 
+// clampTierConcurrency bounds a per-request transfer concurrency so a direct
+// gRPC caller cannot spawn an unbounded number of network workers.
+const maxTierConcurrency = 1024
+
+func clampTierConcurrency(n int) int {
+	if n < 0 {
+		return 0
+	}
+	if n > maxTierConcurrency {
+		return maxTierConcurrency
+	}
+	return n
+}
+
 // VolumeTierMoveDatToRemote copy dat file to a remote tier
 func (vs *VolumeServer) VolumeTierMoveDatToRemote(req *volume_server_pb.VolumeTierMoveDatToRemoteRequest, stream volume_server_pb.VolumeServer_VolumeTierMoveDatToRemoteServer) error {
 	if err := vs.checkGrpcAdminAuth(stream.Context()); err != nil {
@@ -73,13 +88,14 @@ func (vs *VolumeServer) VolumeTierMoveDatToRemote(req *volume_server_pb.VolumeTi
 	}
 
 	// copy the data file
-	key, size, err := backendStorage.CopyFile(diskFile.File, fn)
+	key, size, err := backendStorage.CopyFile(diskFile.File, fn, clampTierConcurrency(int(req.Concurrency)))
 	if err != nil {
 		return fmt.Errorf("backend %s copy file %s: %v", req.DestinationBackendName, diskFile.Name(), err)
 	}
 
-	// save the remote file to volume tier info
-	v.GetVolumeInfo().Files = append(v.GetVolumeInfo().GetFiles(), &volume_server_pb.RemoteFile{
+	// record the remote file and switch to it, unless a compaction commit
+	// replaced the .dat while it was being copied
+	if err := v.AttachRemoteDatFile(diskFile, &volume_server_pb.RemoteFile{
 		BackendType:  backendType,
 		BackendId:    backendId,
 		Key:          key,
@@ -87,15 +103,23 @@ func (vs *VolumeServer) VolumeTierMoveDatToRemote(req *volume_server_pb.VolumeTi
 		FileSize:     uint64(size),
 		ModifiedTime: uint64(modTime.Unix()),
 		Extension:    ".dat",
-	})
-
-	if err := v.SaveVolumeInfo(); err != nil {
-		return fmt.Errorf("volume %d failed to save remote file info: %v", v.Id, err)
-	}
-
-	if err := v.LoadRemoteFile(); err != nil {
-		return fmt.Errorf("volume %d failed to load remote file: %v", v.Id, err)
+	}); err != nil {
+		// Remove the copy unless the .vif already names it.
+		recorded := false
+		for _, f := range v.GetVolumeInfo().GetFiles() {
+			if f.Key == key && f.BackendType == backendType && f.BackendId == backendId {
+				recorded = true
+			}
+		}
+		if !recorded {
+			if delErr := backendStorage.DeleteFile(key); delErr != nil {
+				glog.Warningf("volume %d: remove unused remote copy %s: %v", v.Id, key, delErr)
+			}
+		}
+		return fmt.Errorf("volume %d failed to attach remote file: %v", v.Id, err)
 	}
+	// Deletes must reach the index now, not only after the next restart.
+	v.MarkTieredDeletable()
 
 	if !req.KeepLocalDatFile {
 		os.Remove(v.FileName(".dat"))
diff --git a/weed/server/volume_grpc_tier_upload_compact_test.go b/weed/server/volume_grpc_tier_upload_compact_test.go
new file mode 100644
index 0000000000..9295ed81e6
--- /dev/null
+++ b/weed/server/volume_grpc_tier_upload_compact_test.go
@@ -0,0 +1,107 @@
+package weed_server
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// afterCopyBackend runs a hook once the .dat has been copied, before the
+// upload handler records the remote file.
+type afterCopyBackend struct {
+	tierTimestampTestBackend
+	afterCopy func()
+}
+
+func (b *afterCopyBackend) CopyFile(file *os.File, fn func(progressed int64, percentage float32) error, concurrency int) (string, int64, error) {
+	key, size, err := b.tierTimestampTestBackend.CopyFile(file, fn, concurrency)
+	if err == nil && b.afterCopy != nil {
+		b.afterCopy()
+	}
+	return key, size, err
+}
+
+// A compaction committed after the tier upload copied the .dat, but before the
+// upload switched the volume to the remote object, leaves that object with the
+// old layout and the volume with the compacted index. The upload must not
+// attach it.
+func TestTierUploadRefusesADatReplacedByACompactionCommit(t *testing.T) {
+	root := t.TempDir()
+	b := &afterCopyBackend{tierTimestampTestBackend: tierTimestampTestBackend{root: root}}
+	backend.BackendStorages[tierTimestampTestBackendName] = b
+	t.Cleanup(func() { delete(backend.BackendStorages, tierTimestampTestBackendName) })
+
+	store := storage.NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		[]string{t.TempDir()}, []int32{10}, []util.MinFreeSpace{{}}, "", storage.NeedleMapInMemory,
+		[]types.DiskType{types.HardDriveType}, nil, 0, stats.DefaultDiskIOProbeConfig())
+	t.Cleanup(store.Close)
+	if err := store.AddVolume(1, "", storage.NeedleMapInMemory, "000", "", 0, needle.Version3, 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add volume: %v", err)
+	}
+	written := map[uint64][]byte{}
+	for i := uint64(1); i <= 10; i++ {
+		n := &needle.Needle{Id: types.Uint64ToNeedleId(i), Cookie: 7, Data: bytes.Repeat([]byte{byte(i)}, 1024)}
+		n.Checksum = needle.NewCRC(n.Data)
+		if _, err := store.WriteVolumeNeedle(1, n, false, false); err != nil {
+			t.Fatalf("write %d: %v", i, err)
+		}
+		written[i] = n.Data
+	}
+	for i := uint64(1); i <= 5; i++ {
+		if _, err := store.DeleteVolumeNeedle(1, &needle.Needle{Id: types.Uint64ToNeedleId(i)}); err != nil {
+			t.Fatalf("delete %d: %v", i, err)
+		}
+	}
+	v := store.GetVolume(1)
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("compact: %v", err)
+	}
+	if err := store.MarkVolumeReadonly(1, false, false); err != nil {
+		t.Fatalf("mark read-only: %v", err)
+	}
+
+	committed := false
+	b.afterCopy = func() {
+		if err := v.CommitCompact(); err != nil {
+			t.Errorf("commit: %v", err)
+			return
+		}
+		committed = true
+	}
+	vs := &VolumeServer{store: store}
+	err := vs.VolumeTierMoveDatToRemote(&volume_server_pb.VolumeTierMoveDatToRemoteRequest{
+		VolumeId: 1, DestinationBackendName: tierTimestampTestBackendName,
+	}, &discardServerStream[volume_server_pb.VolumeTierMoveDatToRemoteResponse]{})
+	if !committed {
+		t.Fatal("the compaction did not commit between the copy and the attach") // positive control
+	}
+	if err == nil {
+		t.Errorf("the upload attached a remote copy of a .dat that a compaction had replaced")
+	}
+	if v.HasRemoteFile() {
+		t.Errorf("the volume is tiered to the stale remote copy")
+	}
+	if entries, _ := os.ReadDir(root); len(entries) != 0 {
+		t.Errorf("the abandoned remote copy was left behind: %v", entries)
+	}
+	if !util.FileExists(filepath.Join(v.FileName(".dat"))) {
+		t.Fatalf("the local .dat is gone")
+	}
+	for i := uint64(6); i <= 10; i++ {
+		n := &needle.Needle{Id: types.Uint64ToNeedleId(i), Cookie: 7}
+		if _, err := store.ReadVolumeNeedle(1, n, nil, nil); err != nil {
+			t.Errorf("needle %d does not read after the upload: %v", i, err)
+		} else if !bytes.Equal(n.Data, written[i]) {
+			t.Errorf("needle %d reads different data", i)
+		}
+	}
+}
diff --git a/weed/server/volume_grpc_tier_upload_deletes_test.go b/weed/server/volume_grpc_tier_upload_deletes_test.go
new file mode 100644
index 0000000000..ebd73a244a
--- /dev/null
+++ b/weed/server/volume_grpc_tier_upload_deletes_test.go
@@ -0,0 +1,77 @@
+package weed_server
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// tierUploadForDeletes writes 10 needles into volume 1 of a new store, marks it
+// read-only as volume.tier.upload does, and moves its .dat to the tier.
+func tierUploadForDeletes(t *testing.T, replication string) *storage.Store {
+	t.Helper()
+	backend.BackendStorages[tierTimestampTestBackendName] = &tierTimestampTestBackend{root: t.TempDir()}
+	t.Cleanup(func() { delete(backend.BackendStorages, tierTimestampTestBackendName) })
+	store := storage.NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		[]string{t.TempDir()}, []int32{10}, []util.MinFreeSpace{{}}, "", storage.NeedleMapInMemory,
+		[]types.DiskType{types.HardDriveType}, nil, 0, stats.DefaultDiskIOProbeConfig())
+	t.Cleanup(store.Close)
+	if err := store.AddVolume(1, "", storage.NeedleMapInMemory, replication, "", 0, needle.Version3, 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add volume: %v", err)
+	}
+	for i := 1; i <= 10; i++ {
+		n := &needle.Needle{Id: types.Uint64ToNeedleId(uint64(i)), Cookie: 7, Data: bytes.Repeat([]byte{byte(i)}, 1024)}
+		n.Checksum = needle.NewCRC(n.Data)
+		if _, err := store.WriteVolumeNeedle(1, n, false, false); err != nil {
+			t.Fatalf("write %d: %v", i, err)
+		}
+	}
+	if err := store.MarkVolumeReadonly(1, false, false); err != nil {
+		t.Fatalf("mark read-only: %v", err)
+	}
+	vs := &VolumeServer{store: store}
+	if err := vs.VolumeTierMoveDatToRemote(&volume_server_pb.VolumeTierMoveDatToRemoteRequest{
+		VolumeId: 1, DestinationBackendName: tierTimestampTestBackendName,
+	}, &discardServerStream[volume_server_pb.VolumeTierMoveDatToRemoteResponse]{}); err != nil {
+		t.Fatalf("tier upload: %v", err)
+	}
+	return store
+}
+
+// A single-copy volume takes deletes as soon as it is tiered, as it would
+// after a restart. Before, they were refused ("volume 1 is read only") until
+// then, leaving the needles live in the index.
+func TestTierUploadAcceptsDeletesOnASingleCopyVolume(t *testing.T) {
+	store := tierUploadForDeletes(t, "000")
+	if _, err := store.DeleteVolumeNeedle(1, &needle.Needle{Id: 2}); err != nil {
+		t.Fatalf("delete on the freshly tiered volume: %v", err)
+	}
+	if _, err := store.ReadVolumeNeedle(1, &needle.Needle{Id: 2}, nil, nil); err == nil {
+		t.Fatalf("the deleted needle still reads")
+	}
+	if _, err := store.ReadVolumeNeedle(1, &needle.Needle{Id: 3}, nil, nil); err != nil {
+		t.Fatalf("a live needle does not read: %v", err)
+	}
+	n := &needle.Needle{Id: 99, Cookie: 7, Data: []byte("x")}
+	n.Checksum = needle.NewCRC(n.Data)
+	if _, err := store.WriteVolumeNeedle(1, n, false, false); err == nil {
+		t.Fatalf("a write to a tiered volume succeeded")
+	}
+}
+
+// A replicated volume keeps refusing deletes: the shell copies the uploaded
+// replica's .idx and .vif to the others after the upload, and a tombstone
+// written before that copy would reach one replica only.
+func TestTierUploadKeepsRefusingDeletesOnAReplicatedVolume(t *testing.T) {
+	store := tierUploadForDeletes(t, "001")
+	if _, err := store.DeleteVolumeNeedle(1, &needle.Needle{Id: 2}); err == nil {
+		t.Fatalf("a replicated volume accepted a delete right after the tier upload")
+	}
+}
diff --git a/weed/server/volume_grpc_vacuum.go b/weed/server/volume_grpc_vacuum.go
index 9ee88d6f8e..5401a11080 100644
--- a/weed/server/volume_grpc_vacuum.go
+++ b/weed/server/volume_grpc_vacuum.go
@@ -2,6 +2,7 @@ package weed_server
 
 import (
 	"context"
+	"fmt"
 	"strconv"
 	"time"
 
@@ -13,6 +14,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"google.golang.org/grpc/status"
 )
 
 var numCPU = runtime.NumCPU()
@@ -21,15 +23,17 @@ func (vs *VolumeServer) VacuumVolumeCheck(ctx context.Context, req *volume_serve
 
 	resp := &volume_server_pb.VacuumVolumeCheckResponse{}
 
-	garbageRatio, err := vs.store.CheckCompactVolume(needle.VolumeId(req.VolumeId))
+	garbageRatio, diskSpaceLow, err := vs.store.CheckCompactVolume(needle.VolumeId(req.VolumeId))
 
 	resp.GarbageRatio = garbageRatio
+	resp.DiskSpaceLow = diskSpaceLow
 
 	if err != nil {
 		glog.V(3).Infof("check volume %d: %v", req.VolumeId, err)
+		return resp, volumeStatusError(err)
 	}
 
-	return resp, err
+	return resp, nil
 
 }
 
@@ -52,6 +56,9 @@ func (vs *VolumeServer) VacuumVolumeCompact(req *volume_server_pb.VacuumVolumeCo
 	fs, fsErr := procfs.NewDefaultFS()
 	var sendErr error
 	err := vs.store.CompactVolume(needle.VolumeId(req.VolumeId), req.Preallocate, vs.compactionBytePerSecond, func(processed int64) bool {
+		if stream.Context().Err() != nil {
+			return false
+		}
 		if processed > nextReportTarget {
 			resp.ProcessedBytes = processed
 			if fsErr == nil && numCPU > 0 {
@@ -70,7 +77,7 @@ func (vs *VolumeServer) VacuumVolumeCompact(req *volume_server_pb.VacuumVolumeCo
 	stats.VolumeServerVacuumingCompactCounter.WithLabelValues(strconv.FormatBool(err == nil && sendErr == nil)).Inc()
 	if err != nil {
 		glog.Errorf("failed compact volume %d: %v", req.VolumeId, err)
-		return err
+		return volumeStatusError(fmt.Errorf("compact volume %d: %w", req.VolumeId, err))
 	}
 	if sendErr != nil {
 		glog.Errorf("failed compact volume %d report progress: %v", req.VolumeId, sendErr)
@@ -90,6 +97,16 @@ func (vs *VolumeServer) VacuumVolumeCommit(ctx context.Context, req *volume_serv
 		return nil, err
 	}
 
+	release, err := vs.acquireVacuumCommitSlot(ctx)
+	if err != nil {
+		glog.Warningf("commit volume %d not started: %v", req.VolumeId, err)
+		return nil, status.FromContextError(err).Err()
+	}
+	defer release()
+	if err := vs.CheckMaintenanceMode(); err != nil {
+		return nil, err
+	}
+
 	start := time.Now()
 	defer func(start time.Time) {
 		stats.VolumeServerVacuumingHistogram.WithLabelValues("commit").Observe(time.Since(start).Seconds())
@@ -99,18 +116,43 @@ func (vs *VolumeServer) VacuumVolumeCommit(ctx context.Context, req *volume_serv
 
 	readOnly, volumeSize, err := vs.store.CommitCompactVolume(needle.VolumeId(req.VolumeId))
 
-	if err != nil {
-		glog.Errorf("failed commit volume %d: %v", req.VolumeId, err)
-	} else {
-		glog.V(1).Infof("commit volume %d", req.VolumeId)
-	}
 	stats.VolumeServerVacuumingCommitCounter.WithLabelValues(strconv.FormatBool(err == nil)).Inc()
 	resp.IsReadOnly = readOnly
 	resp.VolumeSize = uint64(volumeSize)
-	return resp, err
+	if err != nil {
+		glog.Errorf("failed commit volume %d: %v", req.VolumeId, err)
+		return resp, volumeStatusError(fmt.Errorf("commit compact volume %d: %w", req.VolumeId, err))
+	}
+	glog.V(1).Infof("commit volume %d", req.VolumeId)
+	return resp, nil
 
 }
 
+// acquireVacuumCommitSlot waits for a commit slot holding no volume lock; the
+// wait counts against the caller's deadline.
+func (vs *VolumeServer) acquireVacuumCommitSlot(ctx context.Context) (release func(), err error) {
+	if vs.vacuumCommitSlots == nil {
+		return func() {}, nil
+	}
+	vs.vacuumCommitsWaiting.Add(1)
+	select {
+	case vs.vacuumCommitSlots <- struct{}{}:
+	case <-ctx.Done():
+		err = ctx.Err()
+	}
+	vs.vacuumCommitsWaiting.Add(-1)
+	if err != nil {
+		return nil, err
+	}
+	release = func() { <-vs.vacuumCommitSlots }
+	// select picks randomly when the slot and the deadline are ready together.
+	if err := ctx.Err(); err != nil {
+		release()
+		return nil, err
+	}
+	return release, nil
+}
+
 func (vs *VolumeServer) VacuumVolumeCleanup(ctx context.Context, req *volume_server_pb.VacuumVolumeCleanupRequest) (*volume_server_pb.VacuumVolumeCleanupResponse, error) {
 	if err := vs.checkGrpcAdminAuth(ctx); err != nil {
 		return nil, err
@@ -124,10 +166,10 @@ func (vs *VolumeServer) VacuumVolumeCleanup(ctx context.Context, req *volume_ser
 
 	if err != nil {
 		glog.Errorf("failed cleanup volume %d: %v", req.VolumeId, err)
-	} else {
-		glog.V(1).Infof("cleanup volume %d", req.VolumeId)
+		return resp, volumeStatusError(fmt.Errorf("cleanup volume %d: %w", req.VolumeId, err))
 	}
+	glog.V(1).Infof("cleanup volume %d", req.VolumeId)
 
-	return resp, err
+	return resp, nil
 
 }
diff --git a/weed/server/volume_grpc_vacuum_test.go b/weed/server/volume_grpc_vacuum_test.go
new file mode 100644
index 0000000000..60c00e355c
--- /dev/null
+++ b/weed/server/volume_grpc_vacuum_test.go
@@ -0,0 +1,225 @@
+package weed_server
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type fakeVacuumCompactStream struct {
+	grpc.ServerStream
+	ctx context.Context
+}
+
+func (s *fakeVacuumCompactStream) Context() context.Context { return s.ctx }
+
+func (s *fakeVacuumCompactStream) Send(*volume_server_pb.VacuumVolumeCompactResponse) error {
+	return nil
+}
+
+func newVacuumCommitTestServer(t *testing.T, maxParallelCommits int, vids ...needle.VolumeId) *VolumeServer {
+	t.Helper()
+	store := newTraversalTestStore(t.TempDir())
+	t.Cleanup(store.Close)
+	for _, vid := range vids {
+		require.NoError(t, store.AddVolume(vid, "", storage.NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+		for i := 1; i <= 3; i++ {
+			n := new(needle.Needle)
+			n.Id = types.Uint64ToNeedleId(uint64(i))
+			n.Cookie = 0x1234
+			n.Data = []byte(fmt.Sprintf("volume-%d-needle-%d", vid, i))
+			n.Checksum = needle.NewCRC(n.Data)
+			_, err := store.WriteVolumeNeedle(vid, n, true, false)
+			require.NoError(t, err)
+		}
+	}
+	vs := &VolumeServer{store: store}
+	if maxParallelCommits > 0 {
+		vs.vacuumCommitSlots = make(chan struct{}, maxParallelCommits)
+	}
+	return vs
+}
+
+func compactForTest(vs *VolumeServer, vid needle.VolumeId) error {
+	stream := &fakeVacuumCompactStream{ctx: context.Background()}
+	return vs.VacuumVolumeCompact(&volume_server_pb.VacuumVolumeCompactRequest{VolumeId: uint32(vid)}, stream)
+}
+
+func maxConcurrentHolders(vs *VolumeServer, workers int) int32 {
+	var current, peak int32
+	var wg sync.WaitGroup
+	for i := 0; i < workers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			release, err := vs.acquireVacuumCommitSlot(context.Background())
+			if err != nil {
+				return
+			}
+			n := atomic.AddInt32(&current, 1)
+			for {
+				p := atomic.LoadInt32(&peak)
+				if n <= p || atomic.CompareAndSwapInt32(&peak, p, n) {
+					break
+				}
+			}
+			time.Sleep(5 * time.Millisecond)
+			atomic.AddInt32(&current, -1)
+			release()
+		}()
+	}
+	wg.Wait()
+	return atomic.LoadInt32(&peak)
+}
+
+func TestVacuumCommitSlotsBoundConcurrentCommits(t *testing.T) {
+	assert.Equal(t, int32(1), maxConcurrentHolders(&VolumeServer{vacuumCommitSlots: make(chan struct{}, 1)}, 8))
+	assert.LessOrEqual(t, maxConcurrentHolders(&VolumeServer{vacuumCommitSlots: make(chan struct{}, 3)}, 8), int32(3))
+}
+
+func TestVacuumCommitSlotsUnlimitedByDefault(t *testing.T) {
+	vs := &VolumeServer{}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	for i := 0; i < 8; i++ {
+		_, err := vs.acquireVacuumCommitSlot(ctx)
+		require.NoError(t, err, "acquisition %d must not wait when no limit is configured", i)
+	}
+}
+
+func TestVacuumCommitSlotNotGrantedToExpiredContext(t *testing.T) {
+	vs := &VolumeServer{vacuumCommitSlots: make(chan struct{}, 1)}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	for i := 0; i < 100; i++ {
+		release, err := vs.acquireVacuumCommitSlot(ctx)
+		require.ErrorIs(t, err, context.Canceled)
+		require.Nil(t, release)
+		require.Empty(t, vs.vacuumCommitSlots, "a refused acquisition must not keep the slot")
+	}
+}
+
+func TestVacuumCommitLimitLeavesCompactionAndOtherServersAlone(t *testing.T) {
+	vids := []needle.VolumeId{1, 2, 3, 4}
+	vs := newVacuumCommitTestServer(t, 1, vids...)
+	other := newVacuumCommitTestServer(t, 1, 9)
+	vs.vacuumCommitSlots <- struct{}{}
+
+	errs := make(chan error, len(vids))
+	for _, vid := range vids {
+		go func(vid needle.VolumeId) {
+			errs <- compactForTest(vs, vid)
+		}(vid)
+	}
+	for range vids {
+		require.NoError(t, <-errs)
+	}
+
+	require.NoError(t, compactForTest(other, 9))
+	_, err := other.VacuumVolumeCommit(context.Background(), &volume_server_pb.VacuumVolumeCommitRequest{VolumeId: 9})
+	require.NoError(t, err, "a busy commit slot on one server must not block another server")
+}
+
+func TestQueuedVacuumCommitHoldsNoVolumeLockAndHonoursDeadline(t *testing.T) {
+	vid := needle.VolumeId(1)
+	vs := newVacuumCommitTestServer(t, 1, vid)
+	require.NoError(t, compactForTest(vs, vid))
+	vs.vacuumCommitSlots <- struct{}{}
+
+	committed := make(chan error, 1)
+	go func() {
+		_, err := vs.VacuumVolumeCommit(context.Background(), &volume_server_pb.VacuumVolumeCommitRequest{VolumeId: uint32(vid)})
+		committed <- err
+	}()
+	require.Eventually(t, func() bool { return vs.vacuumCommitsWaiting.Load() == 1 }, 5*time.Second, time.Millisecond,
+		"the commit must pass the entry checks and wait for a slot")
+
+	readDone := make(chan error, 1)
+	go func() {
+		n := &needle.Needle{Id: types.Uint64ToNeedleId(1), Cookie: 0x1234}
+		_, err := vs.store.ReadVolumeNeedle(vid, n, nil, nil)
+		readDone <- err
+	}()
+	select {
+	case err := <-readDone:
+		require.NoError(t, err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("read blocked behind a queued commit")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+	defer cancel()
+	_, err := vs.VacuumVolumeCommit(ctx, &volume_server_pb.VacuumVolumeCommitRequest{VolumeId: uint32(vid)})
+	assert.Equal(t, codes.DeadlineExceeded, status.Code(err))
+
+	select {
+	case err := <-committed:
+		t.Fatalf("commit ran while the only slot was taken: %v", err)
+	default:
+	}
+
+	<-vs.vacuumCommitSlots
+	select {
+	case err := <-committed:
+		require.NoError(t, err)
+	case <-time.After(5 * time.Second):
+		t.Fatal("queued commit did not run after the slot freed")
+	}
+	assert.Empty(t, vs.vacuumCommitSlots, "the commit must return its slot")
+}
+
+func TestVacuumCommitReleasesSlotOnError(t *testing.T) {
+	vs := newVacuumCommitTestServer(t, 1)
+	_, err := vs.VacuumVolumeCommit(context.Background(), &volume_server_pb.VacuumVolumeCommitRequest{VolumeId: 42})
+	require.Error(t, err)
+	assert.Empty(t, vs.vacuumCommitSlots, "a failed commit must return its slot")
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	release, err := vs.acquireVacuumCommitSlot(ctx)
+	require.NoError(t, err)
+	release()
+}
+
+func TestQueuedVacuumCommitDoesNotStartInMaintenanceMode(t *testing.T) {
+	vid := needle.VolumeId(1)
+	vs := newVacuumCommitTestServer(t, 1, vid)
+	require.NoError(t, compactForTest(vs, vid))
+	revisionBefore := vs.store.GetVolume(vid).SuperBlock.CompactionRevision
+	vs.vacuumCommitSlots <- struct{}{}
+
+	committed := make(chan error, 1)
+	go func() {
+		_, err := vs.VacuumVolumeCommit(context.Background(), &volume_server_pb.VacuumVolumeCommitRequest{VolumeId: uint32(vid)})
+		committed <- err
+	}()
+	require.Eventually(t, func() bool { return vs.vacuumCommitsWaiting.Load() == 1 }, 5*time.Second, time.Millisecond,
+		"the commit must pass the entry maintenance check and wait for a slot")
+
+	require.NoError(t, vs.store.State.Update(&volume_server_pb.VolumeServerState{Maintenance: true}))
+	<-vs.vacuumCommitSlots
+
+	select {
+	case err := <-committed:
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "maintenance mode")
+	case <-time.After(5 * time.Second):
+		t.Fatal("queued commit did not return after the slot freed")
+	}
+	assert.Equal(t, revisionBefore, vs.store.GetVolume(vid).SuperBlock.CompactionRevision, "the volume must not be committed")
+	assert.Empty(t, vs.vacuumCommitSlots, "the refused commit must return its slot")
+}
diff --git a/weed/server/volume_server.go b/weed/server/volume_server.go
index 1b6feeac4b..93351eca44 100644
--- a/weed/server/volume_server.go
+++ b/weed/server/volume_server.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net/http"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
@@ -55,11 +56,18 @@ type VolumeServer struct {
 	AllowUntrustedRemoteEndpoints bool
 	compactionBytePerSecond       int64
 	maintenanceBytePerSecond      int64
+	vacuumCommitSlots             chan struct{}
+	vacuumCommitsWaiting          atomic.Int32
 	metricsAddress                string
 	metricsIntervalSec            int
 	fileSizeLimitBytes            int64
 	isHeartbeating                bool
 	stopChan                      chan bool
+
+	// Volumes with an EC decode in flight. A cancelled request does not
+	// stop the handler; this keeps a retry from racing it on the same
+	// volume files.
+	ecDecodesInFlight sync.Map
 }
 
 func NewVolumeServer(adminMux, publicMux *http.ServeMux, ip string,
@@ -74,6 +82,7 @@ func NewVolumeServer(adminMux, publicMux *http.ServeMux, ip string,
 	readMode string,
 	compactionMBPerSecond int,
 	maintenanceMBPerSecond int,
+	maxParallelVacuumCommits int,
 	fileSizeLimitMB int,
 	concurrentUploadLimit int64,
 	concurrentDownloadLimit int64,
@@ -84,6 +93,7 @@ func NewVolumeServer(adminMux, publicMux *http.ServeMux, ip string,
 	ldbTimeout int64,
 	allowUntrustedRemoteEndpoints bool,
 	diskProbeConfig stats.DiskIOProbeConfig,
+	syncBatch storage.SyncBatchOption,
 ) *VolumeServer {
 
 	v := util.GetViper()
@@ -121,6 +131,9 @@ func NewVolumeServer(adminMux, publicMux *http.ServeMux, ip string,
 		whiteList:                     whiteList,
 		AllowUntrustedRemoteEndpoints: allowUntrustedRemoteEndpoints,
 	}
+	if maxParallelVacuumCommits > 0 {
+		vs.vacuumCommitSlots = make(chan struct{}, maxParallelVacuumCommits)
+	}
 
 	whiteList = append(whiteList, util.StringSplit(v.GetString("guard.white_list"), ",")...)
 	// Copy the caller's slice so subsequent external mutation cannot desync
@@ -136,6 +149,8 @@ func NewVolumeServer(adminMux, publicMux *http.ServeMux, ip string,
 	vs.checkWithMaster()
 
 	vs.store = storage.NewStore(vs.grpcDialOption, ip, port, grpcPort, publicUrl, id, folders, maxCounts, minFreeSpaces, idxFolder, vs.needleMapKind, diskTypes, diskTags, ldbTimeout, diskProbeConfig)
+	vs.store.MasterFn = vs.getCurrentMaster
+	vs.store.SetSyncBatchOption(syncBatch)
 	vs.guard = security.NewGuard(whiteList, signingKey, expiresAfterSec, readSigningKey, readExpiresAfterSec)
 
 	handleStaticResources(adminMux)
diff --git a/weed/server/volume_server_handlers_admin.go b/weed/server/volume_server_handlers_admin.go
index dfb90befd0..c1eaa5c30d 100644
--- a/weed/server/volume_server_handlers_admin.go
+++ b/weed/server/volume_server_handlers_admin.go
@@ -31,6 +31,13 @@ func (vs *VolumeServer) healthzHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// A server with quarantined local replicas has faulty storage media;
+	// report degraded so a load balancer can drain it.
+	if vs.store.HasIoQuarantine() {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		return
+	}
+
 	w.WriteHeader(http.StatusOK)
 }
 
diff --git a/weed/server/volume_server_handlers_helper.go b/weed/server/volume_server_handlers_helper.go
index 2bab35e458..b161b1eca5 100644
--- a/weed/server/volume_server_handlers_helper.go
+++ b/weed/server/volume_server_handlers_helper.go
@@ -27,7 +27,11 @@ func (r httpRange) mimeHeader(contentType string, size int64) textproto.MIMEHead
 	}
 }
 
-// parseRange parses a Range header string as per RFC 2616.
+// errNoOverlap is returned by parseRange if first-byte-pos of
+// all of the byte-range-spec values is at or beyond the content size.
+var errNoOverlap = errors.New("invalid range: failed to overlap")
+
+// parseRange parses a Range header string as per RFC 7233.
 func parseRange(s string, size int64) ([]httpRange, error) {
 	if s == "" {
 		return nil, nil // header not present
@@ -37,6 +41,7 @@ func parseRange(s string, size int64) ([]httpRange, error) {
 		return nil, errors.New("invalid range")
 	}
 	var ranges []httpRange
+	noOverlap := false
 	for _, ra := range strings.Split(s[len(b):], ",") {
 		ra = strings.TrimSpace(ra)
 		if ra == "" {
@@ -62,9 +67,15 @@ func parseRange(s string, size int64) ([]httpRange, error) {
 			r.length = size - r.start
 		} else {
 			i, err := strconv.ParseInt(start, 10, 64)
-			if err != nil || i > size || i < 0 {
+			if err != nil || i < 0 {
 				return nil, errors.New("invalid range")
 			}
+			if i >= size {
+				// If the range begins after the size of the content,
+				// then it does not overlap.
+				noOverlap = true
+				continue
+			}
 			r.start = i
 			if end == "" {
 				// If no end is specified, range extends to end of the file.
@@ -82,6 +93,10 @@ func parseRange(s string, size int64) ([]httpRange, error) {
 		}
 		ranges = append(ranges, r)
 	}
+	if noOverlap && len(ranges) == 0 {
+		// The specified ranges did not overlap with the content.
+		return nil, errNoOverlap
+	}
 	return ranges, nil
 }
 
diff --git a/weed/server/volume_server_handlers_helper_test.go b/weed/server/volume_server_handlers_helper_test.go
new file mode 100644
index 0000000000..29b38ac9d0
--- /dev/null
+++ b/weed/server/volume_server_handlers_helper_test.go
@@ -0,0 +1,55 @@
+package weed_server
+
+import "testing"
+
+func TestParseRange(t *testing.T) {
+	const size = int64(10)
+
+	tests := []struct {
+		name      string
+		rangeSpec string
+		wantErr   bool
+		wantStart int64
+		wantLen   int64
+	}{
+		{name: "start within bounds", rangeSpec: "bytes=0-", wantStart: 0, wantLen: 10},
+		{name: "start at last valid byte", rangeSpec: "bytes=9-", wantStart: 9, wantLen: 1},
+		{name: "start equal to size is not satisfiable", rangeSpec: "bytes=10-", wantErr: true},
+		{name: "start past size is not satisfiable", rangeSpec: "bytes=11-", wantErr: true},
+		{name: "start with explicit end within bounds", rangeSpec: "bytes=2-5", wantStart: 2, wantLen: 4},
+		{name: "end clamped to the last byte", rangeSpec: "bytes=2-100", wantStart: 2, wantLen: 8},
+		{name: "suffix range within bounds", rangeSpec: "bytes=-3", wantStart: 7, wantLen: 3},
+		{name: "suffix range larger than size is clamped, not rejected", rangeSpec: "bytes=-100", wantStart: 0, wantLen: 10},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ranges, err := parseRange(tt.rangeSpec, size)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("parseRange(%q, %d) = %+v, want an error", tt.rangeSpec, size, ranges)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("parseRange(%q, %d) returned unexpected error: %v", tt.rangeSpec, size, err)
+			}
+			if len(ranges) != 1 {
+				t.Fatalf("parseRange(%q, %d) = %d ranges, want 1", tt.rangeSpec, size, len(ranges))
+			}
+			if ranges[0].start != tt.wantStart || ranges[0].length != tt.wantLen {
+				t.Fatalf("parseRange(%q, %d) = {start:%d length:%d}, want {start:%d length:%d}",
+					tt.rangeSpec, size, ranges[0].start, ranges[0].length, tt.wantStart, tt.wantLen)
+			}
+		})
+	}
+}
+
+func TestParseRangeOnEmptyFile(t *testing.T) {
+	// A zero-length file has no valid byte offsets at all, not even 0, so any
+	// range request against it must be rejected rather than satisfied with an
+	// empty range.
+	if _, err := parseRange("bytes=0-", 0); err == nil {
+		t.Fatal("parseRange(\"bytes=0-\", 0) = nil error, want an error")
+	}
+}
diff --git a/weed/server/volume_server_handlers_read.go b/weed/server/volume_server_handlers_read.go
index 581fb5f9bd..16ab5bf96a 100644
--- a/weed/server/volume_server_handlers_read.go
+++ b/weed/server/volume_server_handlers_read.go
@@ -40,10 +40,20 @@ func NotFound(w http.ResponseWriter) {
 	w.WriteHeader(http.StatusNotFound)
 }
 
-func InternalError(w http.ResponseWriter) {
+func InternalError(w http.ResponseWriter, r *http.Request, err error) {
 	stats.VolumeServerFileReadFailures.Inc()
 	stats.VolumeServerHandlerCounter.WithLabelValues(stats.ErrorGetInternal).Inc()
-	w.WriteHeader(http.StatusInternalServerError)
+	if err == nil {
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	if r.Method == http.MethodHead {
+		glog.V(0).Infof("response method:%s URL:%s with httpStatus:%d and error:%v",
+			r.Method, redactedURL(r), http.StatusInternalServerError, err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	writeJsonError(w, r, http.StatusInternalServerError, err)
 }
 
 func (vs *VolumeServer) proxyReqToTargetServer(w http.ResponseWriter, r *http.Request) {
@@ -92,8 +102,8 @@ func (vs *VolumeServer) proxyReqToTargetServer(w http.ResponseWriter, r *http.Re
 		r.URL.RawQuery = query.Encode()
 		request, err := http.NewRequest(http.MethodGet, r.URL.String(), nil)
 		if err != nil {
-			glog.V(0).Infof("failed to instance http request of url %s: %v", r.URL.String(), err)
-			InternalError(w)
+			glog.V(0).Infof("failed to instance http request of url %s: %v", redactedURL(r), err)
+			InternalError(w, r, nil)
 			return
 		}
 		for k, vv := range r.Header {
@@ -105,8 +115,8 @@ func (vs *VolumeServer) proxyReqToTargetServer(w http.ResponseWriter, r *http.Re
 		response, err := util_http.GetGlobalHttpClient().Do(request)
 		if err != nil {
 			stats.VolumeServerHandlerCounter.WithLabelValues(stats.FailedReadProxyReq).Inc()
-			glog.V(0).Infof("request remote url %s: %v", r.URL.String(), err)
-			InternalError(w)
+			glog.V(0).Infof("request remote url %s: %v", redactedURL(r), err)
+			InternalError(w, r, nil)
 			return
 		}
 		defer util_http.CloseResponse(response)
@@ -139,6 +149,20 @@ func (vs *VolumeServer) proxyReqToTargetServer(w http.ResponseWriter, r *http.Re
 	}
 }
 
+// notModified checks If-Modified-Since only when there is no If-None-Match
+// (RFC 9110 13.2.2).
+func notModified(r *http.Request, etag string, lastModified uint64) bool {
+	if inm := r.Header.Values("If-None-Match"); len(inm) != 0 {
+		return etagListMatches(strings.Join(inm, ","), etag, true)
+	}
+	ims := r.Header.Get("If-Modified-Since")
+	if ims == "" || lastModified == 0 {
+		return false
+	}
+	t, err := time.Parse(http.TimeFormat, ims)
+	return err == nil && t.Unix() >= int64(lastModified)
+}
+
 func (vs *VolumeServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request) {
 	n := new(needle.Needle)
 	vid, fid, filename, ext, _ := parseURLPath(r.URL.Path)
@@ -217,31 +241,34 @@ func (vs *VolumeServer) GetOrHeadHandler(w http.ResponseWriter, r *http.Request)
 		if invalid_needle || err == storage.ErrorDeleted {
 			NotFound(w)
 		} else {
-			InternalError(w)
+			InternalError(w, r, err)
 		}
 		return
 	}
 	if n.Cookie != cookie {
+		// A meta-only read ended the request; record its success.
+		if readOption.IsMetaOnly {
+			if v := vs.store.GetVolume(volumeId); v != nil {
+				v.NoteMetaOnlySuccess()
+			}
+		}
 		glog.V(0).Infof("request %s with cookie:%x expected:%x from %s agent %s", r.URL.Path, cookie, n.Cookie, r.RemoteAddr, r.UserAgent())
 		NotFound(w)
 		return
 	}
 	if n.LastModified != 0 {
 		w.Header().Set("Last-Modified", time.Unix(int64(n.LastModified), 0).UTC().Format(http.TimeFormat))
-		if r.Header.Get("If-Modified-Since") != "" {
-			if t, parseError := time.Parse(http.TimeFormat, r.Header.Get("If-Modified-Since")); parseError == nil {
-				if t.Unix() >= int64(n.LastModified) {
-					w.WriteHeader(http.StatusNotModified)
-					return
-				}
+	}
+	SetEtag(w, n.Etag())
+	if notModified(r, n.Etag(), n.LastModified) {
+		if readOption.IsMetaOnly {
+			if v := vs.store.GetVolume(volumeId); v != nil {
+				v.NoteMetaOnlySuccess()
 			}
 		}
-	}
-	if inm := r.Header.Get("If-None-Match"); inm == "\""+n.Etag()+"\"" {
 		w.WriteHeader(http.StatusNotModified)
 		return
 	}
-	SetEtag(w, n.Etag())
 
 	if n.HasPairs() {
 		pairMap := make(map[string]string)
@@ -308,14 +335,19 @@ func shouldAttemptStreamWrite(hasLocalVolume bool, ext string, r *http.Request)
 	if len(ext) > 0 {
 		ext = strings.ToLower(ext)
 	}
-	if r.Method == http.MethodHead {
-		return true, true
-	}
 	_, _, _, shouldResize := shouldResizeImages(ext, r)
 	_, _, _, _, shouldCrop := shouldCropImages(ext, r)
 	if shouldResize || shouldCrop {
+		// A transformed image's length is not the needle's; the payload is
+		// needed to answer — also true for HEAD, which reports it.
 		return false, false
 	}
+	if r.Method == http.MethodHead {
+		// Attempt only, so a needle up to PagedReadLimit is still read whole:
+		// on a spinning disk one read is cheaper than a header read followed
+		// by a trailer read.
+		return true, false
+	}
 	return true, false
 }
 
@@ -464,6 +496,10 @@ func (vs *VolumeServer) streamWriteResponseContent(filename string, mimeType str
 	AdjustPassthroughHeaders(w, r, filename)
 
 	if r.Method == http.MethodHead {
+		// HEAD ends at the metadata read; record its success.
+		if v := vs.store.GetVolume(volumeId); v != nil {
+			v.NoteMetaOnlySuccess()
+		}
 		w.Header().Set("Content-Length", strconv.FormatInt(totalSize, 10))
 		return
 	}
diff --git a/weed/server/volume_server_handlers_read_test.go b/weed/server/volume_server_handlers_read_test.go
new file mode 100644
index 0000000000..1402a9954d
--- /dev/null
+++ b/weed/server/volume_server_handlers_read_test.go
@@ -0,0 +1,98 @@
+package weed_server
+
+import (
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestInternalErrorWritesTheReadError(t *testing.T) {
+	readErr := errors.New("invalid CRC for needle 2a (got 0a1b2c3d, want 4e5f6071), data on disk corrupted: needle data corrupted")
+	w := httptest.NewRecorder()
+	InternalError(w, httptest.NewRequest(http.MethodGet, "/1,abc", nil), readErr)
+	if w.Code != http.StatusInternalServerError {
+		t.Fatalf("status %d, want 500", w.Code)
+	}
+	if body := strings.TrimSpace(w.Body.String()); body != `{"error":"`+readErr.Error()+`"}` {
+		t.Fatalf("body %q", body)
+	}
+
+	w = httptest.NewRecorder()
+	InternalError(w, httptest.NewRequest(http.MethodGet, "/1,abc", nil), nil)
+	if w.Code != http.StatusInternalServerError || w.Body.Len() != 0 {
+		t.Fatalf("without an error: status %d body %q, want a bare 500", w.Code, w.Body.String())
+	}
+
+	w = httptest.NewRecorder()
+	InternalError(w, httptest.NewRequest(http.MethodHead, "/1,abc", nil), readErr)
+	if w.Code != http.StatusInternalServerError || w.Body.Len() != 0 {
+		t.Fatalf("on a HEAD request: status %d body %q, want a bare 500", w.Code, w.Body.String())
+	}
+}
+
+// A HEAD only attempts a metadata-only read, like a GET: a needle up to
+// PagedReadLimit is read whole. Demanding metadata only would turn that one
+// read into a header read followed by a trailer read.
+func TestShouldAttemptStreamWrite(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		method       string
+		target       string
+		ext          string
+		hasVolume    bool
+		wantAttempt  bool
+		wantMustMeta bool
+	}{
+		{"HEAD", http.MethodHead, "/1,abc.jpg", ".jpg", true, true, false},
+		{"GET", http.MethodGet, "/1,abc.jpg", ".jpg", true, true, false},
+		{"GET of a resized image", http.MethodGet, "/1,abc.jpg?width=100", ".jpg", true, false, false},
+		{"HEAD of a resized image", http.MethodHead, "/1,abc.jpg?width=100", ".jpg", true, false, false},
+		{"HEAD of a cropped image", http.MethodHead, "/1,abc.jpg?crop_x1=0&crop_y1=0&crop_x2=100&crop_y2=100", ".jpg", true, false, false},
+		{"HEAD without a local volume", http.MethodHead, "/1,abc.jpg", ".jpg", false, false, false},
+	} {
+		r := httptest.NewRequest(tc.method, tc.target, nil)
+		attempt, mustMeta := shouldAttemptStreamWrite(tc.hasVolume, tc.ext, r)
+		if attempt != tc.wantAttempt || mustMeta != tc.wantMustMeta {
+			t.Errorf("%s: attempt %v, must be metadata only %v; want %v, %v", tc.name, attempt, mustMeta, tc.wantAttempt, tc.wantMustMeta)
+		}
+	}
+}
+
+func TestNotModifiedChecksIfNoneMatchFirst(t *testing.T) {
+	const etag = "353dd8be"
+	const lastModified = 1700000000
+	before := time.Unix(lastModified-60, 0).UTC().Format(http.TimeFormat)
+	after := time.Unix(lastModified+60, 0).UTC().Format(http.TimeFormat)
+
+	tests := []struct {
+		name    string
+		headers [][2]string
+		want    bool
+	}{
+		{"matching etag", [][2]string{{"If-None-Match", `"353dd8be"`}}, true},
+		{"weak etag", [][2]string{{"If-None-Match", `W/"353dd8be"`}}, true},
+		{"etag in a list", [][2]string{{"If-None-Match", `"x", "353dd8be"`}}, true},
+		{"star", [][2]string{{"If-None-Match", `*`}}, true},
+		{"other etag", [][2]string{{"If-None-Match", `"x"`}}, false},
+		{"etag across repeated lines", [][2]string{{"If-None-Match", `"x"`}, {"If-None-Match", `"353dd8be"`}}, true},
+		{"comma inside quotes", [][2]string{{"If-None-Match", `"353dd8be,old"`}}, false},
+		{"other etag ignores If-Modified-Since", [][2]string{{"If-None-Match", `"x"`}, {"If-Modified-Since", after}}, false},
+		{"empty If-None-Match ignores If-Modified-Since", [][2]string{{"If-None-Match", ``}, {"If-Modified-Since", after}}, false},
+		{"not modified since", [][2]string{{"If-Modified-Since", after}}, true},
+		{"modified since", [][2]string{{"If-Modified-Since", before}}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/3,01637037d6", nil)
+			for _, kv := range tt.headers {
+				r.Header.Add(kv[0], kv[1])
+			}
+			if got := notModified(r, etag, lastModified); got != tt.want {
+				t.Errorf("notModified = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/weed/server/volume_server_handlers_ui.go b/weed/server/volume_server_handlers_ui.go
index a8dabf5072..d5a78a98a9 100644
--- a/weed/server/volume_server_handlers_ui.go
+++ b/weed/server/volume_server_handlers_ui.go
@@ -15,6 +15,13 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage"
 )
 
+// remoteVolumeRow carries the remote key the store no longer keeps per volume,
+// read from the volume this server holds rather than relayed by a master.
+type remoteVolumeRow struct {
+	*storage.VolumeInfo
+	RemoteStorageKey string
+}
+
 func (vs *VolumeServer) uiStatusHandler(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Server", "SeaweedFS Volume "+version.VERSION)
 	infos := make(map[string]interface{})
@@ -28,13 +35,18 @@ func (vs *VolumeServer) uiStatusHandler(w http.ResponseWriter, r *http.Request)
 		}
 	}
 	volumeInfos := vs.store.VolumeInfos()
-	var normalVolumeInfos, remoteVolumeInfos []*storage.VolumeInfo
+	var normalVolumeInfos []*storage.VolumeInfo
+	var remoteVolumeInfos []remoteVolumeRow
 	for _, vinfo := range volumeInfos {
-		if vinfo.IsRemote() {
-			remoteVolumeInfos = append(remoteVolumeInfos, vinfo)
-		} else {
+		if !vinfo.IsRemote() {
 			normalVolumeInfos = append(normalVolumeInfos, vinfo)
+			continue
 		}
+		row := remoteVolumeRow{VolumeInfo: vinfo}
+		if v := vs.store.GetVolume(vinfo.Id); v != nil {
+			_, row.RemoteStorageKey = v.RemoteStorageNameKey()
+		}
+		remoteVolumeInfos = append(remoteVolumeInfos, row)
 	}
 	args := struct {
 		Version       string
diff --git a/weed/server/volume_server_handlers_write.go b/weed/server/volume_server_handlers_write.go
index e18fcc6d2c..149409fc09 100644
--- a/weed/server/volume_server_handlers_write.go
+++ b/weed/server/volume_server_handlers_write.go
@@ -12,6 +12,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/topology"
 	"github.com/seaweedfs/seaweedfs/weed/util/buffer_pool"
@@ -101,11 +102,20 @@ func (vs *VolumeServer) DeleteHandler(w http.ResponseWriter, r *http.Request) {
 
 	if hasEcVolume {
 		count, err := vs.store.DeleteEcShardNeedle(ecVolume, n, cookie)
+		if errors.Is(err, storage.ErrorDeleted) {
+			// Already gone. The non-EC path below answers 404 from its
+			// ReadVolumeNeedle pre-check rather than counting a write failure,
+			// and callers fold that 404 into success.
+			m := make(map[string]uint32)
+			m["size"] = 0
+			writeJsonQuiet(w, r, http.StatusNotFound, m)
+			return
+		}
 		writeDeleteResult(err, count, w, r)
 		return
 	}
 
-	_, ok := vs.store.ReadVolumeNeedle(volumeId, n, nil, nil)
+	_, ok := vs.store.ReadVolumeNeedle(volumeId, n, deleteReadOption(), nil)
 	if ok != nil {
 		m := make(map[string]uint32)
 		m["size"] = 0
@@ -151,6 +161,17 @@ func (vs *VolumeServer) DeleteHandler(w http.ResponseWriter, r *http.Request) {
 
 }
 
+// deleteReadOption returns the read option used by deletes: read only the
+// needle's header and trailer.
+//
+// A delete needs to know that the needle exists, what its cookie is, and
+// whether it is a chunk manifest. None of that requires the payload. If the
+// needle turns out to be a chunk manifest, the read loads its data as well,
+// because the delete needs the manifest to delete the chunks.
+func deleteReadOption() *storage.ReadOption {
+	return &storage.ReadOption{AttemptMetaOnly: true, MustMetaOnly: true}
+}
+
 func writeDeleteResult(err error, count int64, w http.ResponseWriter, r *http.Request) {
 	if err == nil {
 		m := make(map[string]int64)
diff --git a/weed/server/webdav_server.go b/weed/server/webdav_server.go
index f9c818353a..508a95d128 100644
--- a/weed/server/webdav_server.go
+++ b/weed/server/webdav_server.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"path"
 	"strings"
@@ -20,6 +21,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/chunk_cache"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
@@ -73,9 +75,12 @@ func NewWebDavServer(option *WebDavOption) (ws *WebDavServer, err error) {
 		option:         option,
 		grpcDialOption: security.LoadClientTLS(util.GetViper(), "grpc.filer"),
 		Handler: listedEntriesHandler{
-			next: &webdav.Handler{
-				FileSystem: fs,
-				LockSystem: webdav.NewMemLS(),
+			next: copyMoveGuardHandler{
+				fs: fs,
+				next: &webdav.Handler{
+					FileSystem: fs,
+					LockSystem: webdav.NewMemLS(),
+				},
 			},
 		},
 	}
@@ -83,12 +88,47 @@ func NewWebDavServer(option *WebDavOption) (ws *WebDavServer, err error) {
 	return ws, nil
 }
 
+// an overwriting MOVE or COPY removes the destination before reading the
+// source, so a destination that contains the source removes it too; a
+// destination under the source copies itself unless the copy is shallow
+type copyMoveGuardHandler struct {
+	fs   webdav.FileSystem
+	next http.Handler
+}
+
+func (h copyMoveGuardHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Method == "MOVE" || r.Method == "COPY" {
+		if u, err := url.Parse(r.Header.Get("Destination")); err == nil {
+			src := strings.Trim(path.Clean(r.URL.Path), "/")
+			dst := strings.Trim(path.Clean(u.Path), "/")
+			above := dst == "" || src == dst || strings.HasPrefix(src, dst+"/")
+			below := src == "" || strings.HasPrefix(dst, src+"/")
+			if above || below && (r.Method == "MOVE" || r.Header.Get("Depth") != "0") {
+				w.WriteHeader(http.StatusForbidden)
+				return
+			}
+		}
+		// a source that cannot be read makes the operation fail after the
+		// destination is already gone — reject it before that
+		if _, err := h.fs.Stat(r.Context(), r.URL.Path); err != nil {
+			if os.IsNotExist(err) {
+				w.WriteHeader(http.StatusNotFound)
+			} else {
+				w.WriteHeader(http.StatusInternalServerError)
+			}
+			return
+		}
+	}
+	h.next.ServeHTTP(w, r)
+}
+
 // adapted from https://github.com/mattn/davfs/blob/master/plugin/mysql/mysql.go
 
 type WebDavFileSystem struct {
 	option      *WebDavOption
 	chunkCache  *chunk_cache.TieredChunkCache
 	readerCache *filer.ReaderCache
+	filerClient *wdclient.FilerClient
 	signature   int32
 }
 
@@ -99,7 +139,6 @@ type FileInfo struct {
 	modifiedTime time.Time
 	etag         string
 	isDirectory  bool
-	err          error
 }
 
 func (fi *FileInfo) Name() string       { return fi.name }
@@ -110,8 +149,9 @@ func (fi *FileInfo) IsDir() bool        { return fi.isDirectory }
 func (fi *FileInfo) Sys() interface{}   { return nil }
 
 func (fi *FileInfo) ETag(ctx context.Context) (string, error) {
-	if fi.err != nil {
-		return "", fi.err
+	if fi.etag == "" {
+		// an empty DAV:getetag is not a valid entity-tag; let webdav derive one
+		return "", webdav.ErrNotImplemented
 	}
 	return fi.etag, nil
 }
@@ -123,7 +163,7 @@ type WebDavFile struct {
 	off              int64
 	entry            *filer_pb.Entry
 	visibleIntervals *filer.IntervalList[*filer.VisibleInterval]
-	reader           io.ReaderAt
+	reader           *filer.ChunkReadAt
 	bufWriter        *buffered_writer.BufferedWriteCloser
 	ctx              context.Context
 }
@@ -140,7 +180,13 @@ func NewWebDavFileSystem(option *WebDavOption) (webdav.FileSystem, error) {
 		chunkCache: chunkCache,
 		signature:  util.RandomInt32(),
 	}
-	t.readerCache = filer.NewReaderCache(32, chunkCache, filer.LookupFn(t), nil)
+	// FilerClient rather than filer.LookupFn: its cache is bounded, which the
+	// LookupFn doc asks long-running processes to prefer, and it can invalidate
+	// a volume's locations, so a read that failed against every cached location
+	// looks the volume up again instead of retrying a server that has moved or
+	// died.
+	t.filerClient = wdclient.NewFilerClient([]pb.ServerAddress{option.Filer}, option.GrpcDialOption, "")
+	t.readerCache = filer.NewReaderCache(32, chunkCache, t.filerClient.GetLookupFileIdFunction(), t.filerClient)
 	return t, nil
 }
 
@@ -190,9 +236,12 @@ func (fs *WebDavFileSystem) Mkdir(ctx context.Context, fullDirPath string, perm
 	if err == nil {
 		return os.ErrExist
 	}
+	if err != os.ErrNotExist {
+		return err
+	}
 
 	return fs.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-		dir, name := util.FullPath(fullDirPath).DirAndName()
+		dir, name := util.NormalizePath(fullDirPath).DirAndName()
 		request := &filer_pb.CreateEntryRequest{
 			Directory: dir,
 			Entry: &filer_pb.Entry{
@@ -231,12 +280,14 @@ func (fs *WebDavFileSystem) OpenFile(ctx context.Context, fullFilePath string, f
 		if strings.HasSuffix(fullFilePath, "/") {
 			return nil, os.ErrInvalid
 		}
-		_, err = fs.stat(ctx, fullFilePath)
+		fi, err := fs.stat(ctx, fullFilePath)
 		if err == nil {
-			if flag&os.O_EXCL != 0 {
+			if flag&os.O_EXCL != 0 || fi.IsDir() {
 				return nil, os.ErrExist
 			}
-			fs.removeAll(ctx, fullFilePath)
+			fs.removeAll(ctx, fullFilePath, false)
+		} else if err != os.ErrNotExist {
+			return nil, err
 		}
 
 		dir, name := util.FullPath(fullFilePath).DirAndName()
@@ -294,15 +345,19 @@ func (fs *WebDavFileSystem) OpenFile(ctx context.Context, fullFilePath string, f
 
 }
 
-func (fs *WebDavFileSystem) removeAll(ctx context.Context, fullFilePath string) error {
+func (fs *WebDavFileSystem) removeAll(ctx context.Context, fullFilePath string, recursive bool) error {
 	var err error
 	if fullFilePath, err = clearName(fullFilePath); err != nil {
 		return err
 	}
 
-	dir, name := util.FullPath(fullFilePath).DirAndName()
+	fullpath := util.NormalizePath(fullFilePath)
+	if fullpath == "/" {
+		return os.ErrInvalid
+	}
+	dir, name := fullpath.DirAndName()
 
-	return filer_pb.Remove(context.Background(), fs, dir, name, true, false, false, false, []int32{fs.signature})
+	return filer_pb.Remove(context.Background(), fs, dir, name, true, recursive, false, false, []int32{fs.signature})
 
 }
 
@@ -310,7 +365,7 @@ func (fs *WebDavFileSystem) RemoveAll(ctx context.Context, name string) error {
 
 	glog.V(2).Infof("WebDavFileSystem.RemoveAll %v", name)
 
-	return fs.removeAll(ctx, name)
+	return fs.removeAll(ctx, name, true)
 }
 
 func (fs *WebDavFileSystem) Rename(ctx context.Context, oldName, newName string) error {
@@ -325,23 +380,22 @@ func (fs *WebDavFileSystem) Rename(ctx context.Context, oldName, newName string)
 		return err
 	}
 
-	of, err := fs.stat(ctx, oldName)
-	if err != nil {
+	if _, err = fs.stat(ctx, oldName); err != nil {
 		return os.ErrExist
 	}
-	if of.IsDir() {
-		if strings.HasSuffix(oldName, "/") {
-			oldName = strings.TrimRight(oldName, "/")
-		}
-		if strings.HasSuffix(newName, "/") {
-			newName = strings.TrimRight(newName, "/")
-		}
+	oldName = string(util.NormalizePath(oldName))
+	newName = string(util.NormalizePath(newName))
+	if oldName == "/" || newName == "/" {
+		return os.ErrInvalid
 	}
 
 	_, err = fs.stat(ctx, newName)
 	if err == nil {
 		return os.ErrExist
 	}
+	if err != os.ErrNotExist {
+		return err
+	}
 
 	oldDir, oldBaseName := util.FullPath(oldName).DirAndName()
 	newDir, newBaseName := util.FullPath(newName).DirAndName()
@@ -374,11 +428,7 @@ func (fs *WebDavFileSystem) stat(ctx context.Context, fullFilePath string) (os.F
 	fullpath := util.FullPath(fullFilePath)
 
 	if listedFi := listedEntriesFrom(ctx).get(string(fullpath)); listedFi != nil {
-		// the caller's spelling of the path, trailing slash and all, is what a
-		// lookup would have reported back
-		fi := *listedFi
-		fi.name = string(fullpath)
-		return &fi, nil
+		return listedFi, nil
 	}
 
 	entry, _, _, err := filer_pb.GetEntry(ctx, fs, fullpath)
@@ -386,7 +436,7 @@ func (fs *WebDavFileSystem) stat(ctx context.Context, fullFilePath string) (os.F
 		if err == filer_pb.ErrNotFound {
 			return nil, os.ErrNotExist
 		}
-		return &FileInfo{err: err}, nil
+		return nil, err
 	}
 	if entry == nil {
 		return nil, os.ErrNotExist
@@ -396,16 +446,19 @@ func (fs *WebDavFileSystem) stat(ctx context.Context, fullFilePath string) (os.F
 }
 
 func toFileInfo(fullpath util.FullPath, entry *filer_pb.Entry) *FileInfo {
+	// Name is what WebDAV publishes as DAV:displayname; clients that build a
+	// child URL from it reach nothing when it carries the whole path.
+	fp := util.FullPath(listedEntryKey(string(fullpath)))
 	fi := &FileInfo{
 		size:         int64(filer.FileSize(entry)),
-		name:         string(fullpath),
+		name:         fp.Name(),
 		mode:         os.FileMode(entry.Attributes.FileMode),
 		modifiedTime: time.Unix(entry.Attributes.Mtime, 0),
 		etag:         filer.ETag(entry),
 		isDirectory:  entry.IsDirectory,
 	}
 
-	if fi.name == "/" {
+	if fp == "/" {
 		fi.modifiedTime = time.Now()
 		fi.isDirectory = true
 	}
@@ -469,7 +522,7 @@ func (f *WebDavFile) Write(buf []byte) (int, error) {
 
 			if flushErr != nil {
 				if f.entry.Attributes.Mtime == 0 {
-					if err := f.fs.removeAll(ctx, f.name); err != nil {
+					if err := f.fs.removeAll(ctx, f.name, false); err != nil {
 						glog.Errorf("bufWriter.Flush remove file error: %+v", f.name)
 					}
 				}
@@ -483,7 +536,8 @@ func (f *WebDavFile) Write(buf []byte) (int, error) {
 		}
 		f.bufWriter.CloseFunc = func() error {
 
-			manifestedChunks, manifestErr := filer.MaybeManifestize(f.saveDataAsChunk, f.entry.GetChunks())
+			// no chunk deleter here: a failed fold reports the blobs it saved
+			manifestedChunks, manifestErr := filer.MaybeManifestize(f.saveDataAsChunk, nil, f.entry.GetChunks())
 			if manifestErr != nil {
 				// not good, but should be ok
 				glog.V(0).Infof("file %s close MaybeManifestize: %v", f.name, manifestErr)
@@ -524,6 +578,9 @@ func (f *WebDavFile) Write(buf []byte) (int, error) {
 func (f *WebDavFile) Close() error {
 
 	glog.V(2).Infof("WebDavFileSystem.Close %v", f.name)
+	if f.reader != nil {
+		f.reader.ReleaseStream()
+	}
 	if f.bufWriter == nil {
 		return nil
 	}
@@ -554,8 +611,19 @@ func (f *WebDavFile) Read(p []byte) (readSize int, err error) {
 	if fileSize == 0 {
 		return 0, io.EOF
 	}
+	if len(f.entry.Content) > 0 {
+		if f.off >= int64(len(f.entry.Content)) {
+			return 0, io.EOF
+		}
+		readSize = copy(p, f.entry.Content[f.off:])
+		f.off += int64(readSize)
+		return readSize, nil
+	}
 	if f.visibleIntervals == nil {
-		f.visibleIntervals, _ = filer.NonOverlappingVisibleIntervals(f.ctx, filer.LookupFn(f.fs), f.entry.GetChunks(), 0, fileSize)
+		f.visibleIntervals, err = filer.NonOverlappingVisibleIntervals(f.ctx, f.fs.filerClient.GetLookupFileIdFunction(), f.entry.GetChunks(), 0, fileSize)
+		if err != nil {
+			return 0, err
+		}
 		f.reader = nil
 	}
 	if f.reader == nil {
@@ -586,24 +654,14 @@ func (f *WebDavFile) Readdir(count int) (ret []os.FileInfo, err error) {
 	listed := listedEntriesFrom(ctx)
 
 	err = filer_pb.ReadDirAllEntries(ctx, f.fs, util.FullPath(dir), "", func(entry *filer_pb.Entry, isLast bool) error {
-		fi := FileInfo{
-			size:         int64(filer.FileSize(entry)),
-			name:         entry.Name,
-			mode:         os.FileMode(entry.Attributes.FileMode),
-			modifiedTime: time.Unix(entry.Attributes.Mtime, 0),
-			isDirectory:  entry.IsDirectory,
-		}
-
-		if !strings.HasSuffix(fi.name, "/") && fi.IsDir() {
-			fi.name += "/"
-		}
+		childPath := util.NewFullPath(dir, entry.Name)
+		fi := toFileInfo(childPath, entry)
 
 		glog.V(4).Infof("entry: %v", fi.name)
 
-		childPath := util.NewFullPath(dir, entry.Name)
-		listed.put(string(childPath), toFileInfo(childPath, entry))
+		listed.put(string(childPath), fi)
 
-		ret = append(ret, &fi)
+		ret = append(ret, fi)
 		return nil
 	})
 	if err != nil {
diff --git a/weed/server/webdav_server_test.go b/weed/server/webdav_server_test.go
new file mode 100644
index 0000000000..e747745207
--- /dev/null
+++ b/weed/server/webdav_server_test.go
@@ -0,0 +1,347 @@
+package weed_server
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path"
+	"testing"
+
+	"golang.org/x/net/webdav"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestToFileInfoName(t *testing.T) {
+	tests := []struct {
+		fullpath string
+		want     string
+	}{
+		{"/photo.jpg", "photo.jpg"},
+		{"/Images/photo.jpg", "photo.jpg"},
+		{"/Images/2026/photo.jpg", "photo.jpg"},
+		{"/Images", "Images"},
+		{"/Images/", "Images"},
+		{"/", ""},
+	}
+	for _, tt := range tests {
+		entry := &filer_pb.Entry{Name: "photo.jpg", Attributes: &filer_pb.FuseAttributes{}}
+		fi := toFileInfo(util.FullPath(tt.fullpath), entry)
+		if fi.Name() != tt.want {
+			t.Errorf("toFileInfo(%q).Name() = %q, want %q (DAV:displayname must not carry the path)", tt.fullpath, fi.Name(), tt.want)
+		}
+	}
+}
+
+func TestToFileInfoRootIsDirectory(t *testing.T) {
+	entry := &filer_pb.Entry{Attributes: &filer_pb.FuseAttributes{}}
+	if !toFileInfo("/", entry).IsDir() {
+		t.Error("root is not a directory")
+	}
+}
+
+func TestFileInfoETag(t *testing.T) {
+	ctx := context.Background()
+
+	if _, err := (&FileInfo{}).ETag(ctx); err != webdav.ErrNotImplemented {
+		t.Errorf("empty etag returned %v, want ErrNotImplemented so webdav derives one", err)
+	}
+	if etag, err := (&FileInfo{etag: "abc"}).ETag(ctx); err != nil || etag != "abc" {
+		t.Errorf("ETag() = %q, %v, want \"abc\", nil", etag, err)
+	}
+}
+
+type noVolumeFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+}
+
+func (f *noVolumeFiler) LookupVolume(_ context.Context, _ *filer_pb.LookupVolumeRequest) (*filer_pb.LookupVolumeResponse, error) {
+	return &filer_pb.LookupVolumeResponse{LocationsMap: map[string]*filer_pb.Locations{}}, nil
+}
+
+type createRecordingFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	req *filer_pb.CreateEntryRequest
+}
+
+func (f *createRecordingFiler) LookupDirectoryEntry(_ context.Context, _ *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	return nil, filer_pb.ErrNotFound
+}
+
+func (f *createRecordingFiler) CreateEntry(_ context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+	f.req = req
+	return &filer_pb.CreateEntryResponse{}, nil
+}
+
+type deleteRecordingFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	req      *filer_pb.DeleteEntryRequest
+	existing *filer_pb.Entry
+}
+
+func (f *deleteRecordingFiler) LookupDirectoryEntry(_ context.Context, _ *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if f.existing == nil {
+		return nil, filer_pb.ErrNotFound
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: f.existing}, nil
+}
+
+func (f *deleteRecordingFiler) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	f.req = req
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+func startFakeWebDavFiler(t *testing.T, impl filer_pb.SeaweedFilerServer) pb.ServerAddress {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(srv, impl)
+	go srv.Serve(lis)
+	t.Cleanup(srv.Stop)
+	port := lis.Addr().(*net.TCPAddr).Port
+	return pb.ServerAddress(fmt.Sprintf("127.0.0.1:1.%d", port))
+}
+
+// WebDavFile.Read must fail when chunk manifest resolution fails, instead of streaming zeros.
+func TestWebDavFile_Read_ManifestResolveFailure(t *testing.T) {
+	filerAddr := startFakeWebDavFiler(t, &noVolumeFiler{})
+	fc := wdclient.NewFilerClient([]pb.ServerAddress{filerAddr}, grpc.WithTransportCredentials(insecure.NewCredentials()), "")
+	t.Cleanup(fc.Close)
+
+	fs := &WebDavFileSystem{filerClient: fc}
+	entry := &filer_pb.Entry{
+		Name:       "file",
+		Attributes: &filer_pb.FuseAttributes{FileSize: 1 << 20},
+		Chunks: []*filer_pb.FileChunk{
+			{FileId: "1,1679011dc64abd40", IsChunkManifest: true, Offset: 0, Size: 1 << 20},
+		},
+	}
+	f := &WebDavFile{fs: fs, name: "/file", entry: entry, ctx: context.Background()}
+
+	n, err := f.Read(make([]byte, 16))
+	assert.Error(t, err)
+	assert.Equal(t, 0, n)
+}
+
+// Small files stored inline in the entry have no chunks to read from.
+func TestWebDavFile_Read_InlineContent(t *testing.T) {
+	content := []byte("hello inline")
+	entry := &filer_pb.Entry{
+		Name:       "small.txt",
+		Attributes: &filer_pb.FuseAttributes{FileSize: uint64(len(content))},
+		Content:    content,
+	}
+	filerAddr := startFakeWebDavFiler(t, &noVolumeFiler{})
+	fc := wdclient.NewFilerClient([]pb.ServerAddress{filerAddr}, grpc.WithTransportCredentials(insecure.NewCredentials()), "")
+	t.Cleanup(fc.Close)
+	f := &WebDavFile{fs: &WebDavFileSystem{filerClient: fc}, name: "/small.txt", entry: entry, ctx: context.Background()}
+
+	got, err := io.ReadAll(f)
+	assert.NoError(t, err)
+	assert.Equal(t, content, got)
+
+	_, err = f.Seek(6, io.SeekStart)
+	assert.NoError(t, err)
+	buf := make([]byte, 3)
+	n, err := f.Read(buf)
+	assert.NoError(t, err)
+	assert.Equal(t, "inl", string(buf[:n]))
+}
+
+// MKCOL paths end in "/"; the entry must be created under its own name, not as "" inside itself.
+func TestWebDavFileSystem_Mkdir_EntryName(t *testing.T) {
+	filer := &createRecordingFiler{}
+	filerAddr := startFakeWebDavFiler(t, filer)
+	fs := &WebDavFileSystem{option: &WebDavOption{
+		Filer:          filerAddr,
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}}
+
+	assert.NoError(t, fs.Mkdir(context.Background(), "/dir/sub/", 0755))
+	if assert.NotNil(t, filer.req) {
+		assert.Equal(t, "/dir", filer.req.Directory)
+		assert.Equal(t, "sub", filer.req.Entry.Name)
+		assert.True(t, filer.req.Entry.IsDirectory)
+	}
+}
+
+// DELETE, and MOVE or COPY with Overwrite: T, remove a collection through RemoveAll, which must take its contents too.
+func TestWebDavFileSystem_RemoveAll_Recursive(t *testing.T) {
+	filer := &deleteRecordingFiler{}
+	filerAddr := startFakeWebDavFiler(t, filer)
+	fs := &WebDavFileSystem{option: &WebDavOption{
+		Filer:          filerAddr,
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}}
+
+	assert.NoError(t, fs.RemoveAll(context.Background(), "/dir/sub"))
+	if assert.NotNil(t, filer.req) {
+		assert.Equal(t, "/dir", filer.req.Directory)
+		assert.Equal(t, "sub", filer.req.Name)
+		assert.True(t, filer.req.IsRecursive)
+	}
+
+	filer.req = nil
+	assert.NoError(t, fs.RemoveAll(context.Background(), "/dir/sub/"))
+	if assert.NotNil(t, filer.req) {
+		assert.Equal(t, "/dir", filer.req.Directory)
+		assert.Equal(t, "sub", filer.req.Name)
+	}
+
+	filer.req = nil
+	wrapped := NewWrappedFs(fs, "/served")
+	assert.Equal(t, os.ErrInvalid, fs.RemoveAll(context.Background(), "/"))
+	assert.Equal(t, os.ErrInvalid, wrapped.RemoveAll(context.Background(), "/../"))
+	assert.Equal(t, os.ErrInvalid, wrapped.Rename(context.Background(), "/", "/x"))
+	assert.Nil(t, filer.req)
+}
+
+// MOVE or COPY into an ancestor destination is refused before the
+// destination is removed: removing it first would delete the source too.
+func TestCopyMoveGuardHandler(t *testing.T) {
+	called := false
+	h := copyMoveGuardHandler{
+		fs: &stubDavFs{present: map[string]bool{"/dir": true, "/dir/sub": true, "/dirs": true, "/dir/other": true, "/anywhere": true}},
+		next: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			called = true
+		}),
+	}
+
+	for _, tc := range []struct{ method, src, dst string }{
+		{"MOVE", "/dir/sub", "/dir"},
+		{"MOVE", "/dir/sub", "/dir/"},
+		{"MOVE", "/dir", "/dir"},
+		{"MOVE", "/dir", "/dir/sub"},
+		{"MOVE", "/", "/anywhere"},
+		{"COPY", "/dir/sub", "/dir"},
+		{"COPY", "/dir", "/dir/sub"},
+	} {
+		called = false
+		req := httptest.NewRequest(tc.method, "http://x"+tc.src, nil)
+		req.Header.Set("Destination", "http://x"+tc.dst)
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+		assert.Equal(t, http.StatusForbidden, w.Code, "%s %s -> %s", tc.method, tc.src, tc.dst)
+		assert.False(t, called)
+	}
+
+	for _, tc := range []struct{ method, src, dst, depth string }{
+		{"COPY", "/dir/sub", "/dir/other", ""},
+		{"COPY", "/dirs", "/dir", ""},
+		{"COPY", "/dir", "/dir/sub", "0"},
+	} {
+		called = false
+		req := httptest.NewRequest(tc.method, "http://x"+tc.src, nil)
+		req.Header.Set("Destination", "http://x"+tc.dst)
+		if tc.depth != "" {
+			req.Header.Set("Depth", tc.depth)
+		}
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+		assert.True(t, called, "%s %s -> %s depth=%q", tc.method, tc.src, tc.dst, tc.depth)
+	}
+
+	// a source that fails to stat must not reach the handler either — the
+	// destination would be deleted before the operation fails anyway; only
+	// confirmed absence is a 404
+	errFs := copyMoveGuardHandler{
+		fs:   &stubDavFs{errPaths: map[string]bool{"/broken": true}},
+		next: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { called = true }),
+	}
+	for _, tc := range []struct {
+		method, src, dst string
+		want             int
+	}{
+		{"MOVE", "/missing", "/dir", http.StatusNotFound},
+		{"COPY", "/missing", "/dir", http.StatusNotFound},
+		{"MOVE", "/broken", "/dir", http.StatusInternalServerError},
+	} {
+		called = false
+		req := httptest.NewRequest(tc.method, "http://x"+tc.src, nil)
+		req.Header.Set("Destination", "http://x"+tc.dst)
+		w := httptest.NewRecorder()
+		errFs.ServeHTTP(w, req)
+		assert.Equal(t, tc.want, w.Code, "%s %s -> %s", tc.method, tc.src, tc.dst)
+		assert.False(t, called)
+	}
+}
+
+type stubDavFs struct {
+	webdav.FileSystem
+	present  map[string]bool
+	errPaths map[string]bool
+}
+
+func (f *stubDavFs) Stat(_ context.Context, name string) (os.FileInfo, error) {
+	if f.errPaths[path.Clean(name)] {
+		return nil, fmt.Errorf("filer unavailable")
+	}
+	if f.present[path.Clean(name)] {
+		return &FileInfo{name: path.Base(name)}, nil
+	}
+	return nil, os.ErrNotExist
+}
+
+// A PUT onto a folder must not delete the folder to make room for the file.
+func TestWebDavFileSystem_OpenFile_DoesNotReplaceFolder(t *testing.T) {
+	filer := &deleteRecordingFiler{existing: &filer_pb.Entry{
+		Name:        "sub",
+		IsDirectory: true,
+		Attributes:  &filer_pb.FuseAttributes{FileMode: uint32(os.ModeDir | 0755)},
+	}}
+	filerAddr := startFakeWebDavFiler(t, filer)
+	fs := &WebDavFileSystem{option: &WebDavOption{
+		Filer:          filerAddr,
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}}
+
+	_, err := fs.OpenFile(context.Background(), "/dir/sub", os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+	assert.Equal(t, os.ErrExist, err)
+	assert.Nil(t, filer.req)
+}
+
+type renameRecordingFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	req *filer_pb.AtomicRenameEntryRequest
+}
+
+func (f *renameRecordingFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if req.Name != "file.txt" {
+		return nil, filer_pb.ErrNotFound
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: &filer_pb.Entry{Name: "file.txt", Attributes: &filer_pb.FuseAttributes{}}}, nil
+}
+
+func (f *renameRecordingFiler) AtomicRenameEntry(_ context.Context, req *filer_pb.AtomicRenameEntryRequest) (*filer_pb.AtomicRenameEntryResponse, error) {
+	f.req = req
+	return &filer_pb.AtomicRenameEntryResponse{}, nil
+}
+
+// MOVE of a file onto an existing folder removes the folder, then renames onto "/dir/coll/".
+func TestWebDavFileSystem_Rename_FileOntoSlashedPath(t *testing.T) {
+	filer := &renameRecordingFiler{}
+	filerAddr := startFakeWebDavFiler(t, filer)
+	fs := &WebDavFileSystem{option: &WebDavOption{
+		Filer:          filerAddr,
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}}
+
+	assert.NoError(t, fs.Rename(context.Background(), "/dir/file.txt", "/dir/coll/"))
+	if assert.NotNil(t, filer.req) {
+		assert.Equal(t, "/dir", filer.req.NewDirectory)
+		assert.Equal(t, "coll", filer.req.NewName)
+	}
+}
diff --git a/weed/server/wrapped_webdav_fs.go b/weed/server/wrapped_webdav_fs.go
index 86de33e0f3..16e40c1883 100644
--- a/weed/server/wrapped_webdav_fs.go
+++ b/weed/server/wrapped_webdav_fs.go
@@ -2,10 +2,8 @@ package weed_server
 
 import (
 	"context"
-	"io/fs"
 	"os"
 	"path"
-	"strings"
 
 	"golang.org/x/net/webdav"
 )
@@ -23,10 +21,8 @@ func (w wrappedFs) confine(name string) string {
 	return w.subFolder + path.Clean("/"+name)
 }
 
-// NewWrappedFs returns a webdav.FileSystem identical to fs, except it
-// provides access to a sub-folder of fs that is denominated by subFolder.
-// It transparently handles renaming paths and filenames so that the outer part of the wrapped filesystem
-// does not leak out.
+// NewWrappedFs returns a webdav.FileSystem identical to fs, except that it
+// serves only the subFolder sub-tree of fs.
 func NewWrappedFs(fs webdav.FileSystem, subFolder string) webdav.FileSystem {
 	return wrappedFs{
 		subFolder:  subFolder,
@@ -41,21 +37,21 @@ func (w wrappedFs) Mkdir(ctx context.Context, name string, perm os.FileMode) err
 
 func (w wrappedFs) OpenFile(ctx context.Context, name string, flag int, perm os.FileMode) (webdav.File, error) {
 	name = w.confine(name)
-	file, err := w.FileSystem.OpenFile(ctx, name, flag, perm)
-	file = wrappedFile{
-		File:      file,
-		subFolder: &w.subFolder,
-	}
-
-	return file, err
+	return w.FileSystem.OpenFile(ctx, name, flag, perm)
 }
 
 func (w wrappedFs) RemoveAll(ctx context.Context, name string) error {
+	if path.Clean("/"+name) == "/" {
+		return os.ErrInvalid
+	}
 	name = w.confine(name)
 	return w.FileSystem.RemoveAll(ctx, name)
 }
 
 func (w wrappedFs) Rename(ctx context.Context, oldName, newName string) error {
+	if path.Clean("/"+oldName) == "/" || path.Clean("/"+newName) == "/" {
+		return os.ErrInvalid
+	}
 	oldName = w.confine(oldName)
 	newName = w.confine(newName)
 	return w.FileSystem.Rename(ctx, oldName, newName)
@@ -63,53 +59,5 @@ func (w wrappedFs) Rename(ctx context.Context, oldName, newName string) error {
 
 func (w wrappedFs) Stat(ctx context.Context, name string) (os.FileInfo, error) {
 	name = w.confine(name)
-	info, err := w.FileSystem.Stat(ctx, name)
-	info = wrappedFileInfo{
-		subFolder: &w.subFolder,
-		FileInfo:  info,
-	}
-	return info, err
-}
-
-type wrappedFile struct {
-	webdav.File
-	subFolder *string
-}
-
-func (w wrappedFile) Readdir(count int) ([]fs.FileInfo, error) {
-	infos, err := w.File.Readdir(count)
-	for i, info := range infos {
-		infos[i] = wrappedFileInfo{
-			subFolder: w.subFolder,
-			FileInfo:  info,
-		}
-	}
-	return infos, err
-}
-
-func (w wrappedFile) Stat() (fs.FileInfo, error) {
-	info, err := w.File.Stat()
-	info = wrappedFileInfo{
-		subFolder: w.subFolder,
-		FileInfo:  info,
-	}
-	return info, err
-}
-
-type wrappedFileInfo struct {
-	subFolder *string
-	fs.FileInfo
-}
-
-func (w wrappedFileInfo) Name() string {
-	name := w.FileInfo.Name()
-	return strings.TrimPrefix(name, *w.subFolder)
-}
-
-func (w wrappedFileInfo) ETag(ctx context.Context) (string, error) {
-	etag, _ := w.FileInfo.(webdav.ETager).ETag(ctx)
-	if len(etag) == 0 {
-		return etag, webdav.ErrNotImplemented
-	}
-	return etag, nil
+	return w.FileSystem.Stat(ctx, name)
 }
diff --git a/weed/sftpd/auth/password.go b/weed/sftpd/auth/password.go
index 21216d3ff8..7498adc7e0 100644
--- a/weed/sftpd/auth/password.go
+++ b/weed/sftpd/auth/password.go
@@ -37,8 +37,9 @@ func (a *PasswordAuthenticator) Authenticate(conn ssh.ConnMetadata, password []b
 		return nil, fmt.Errorf("password authentication disabled")
 	}
 
-	// Validate password against user store
-	if a.userStore.ValidatePassword(username, password) {
+	// An empty password is never valid; skip the store so a store without its
+	// own empty-secret check cannot match on zero-length input.
+	if len(password) != 0 && a.userStore.ValidatePassword(username, password) {
 		return &ssh.Permissions{
 			Extensions: map[string]string{
 				"username": username,
diff --git a/weed/sftpd/auth/password_test.go b/weed/sftpd/auth/password_test.go
new file mode 100644
index 0000000000..b54f6d29ce
--- /dev/null
+++ b/weed/sftpd/auth/password_test.go
@@ -0,0 +1,43 @@
+package auth
+
+import "testing"
+
+// acceptAllStore records whether the store was consulted and accepts any password.
+type acceptAllStore struct {
+	stubStore
+	called bool
+}
+
+func (s *acceptAllStore) ValidatePassword(string, []byte) bool {
+	s.called = true
+	return true
+}
+
+// An empty password must be rejected before the store is consulted, so a store
+// without its own empty-secret check cannot authenticate on zero-length input.
+func TestPasswordAuthenticatorRejectsEmptyPassword(t *testing.T) {
+	store := &acceptAllStore{}
+	a := NewPasswordAuthenticator(store, true)
+
+	for _, password := range [][]byte{nil, {}} {
+		if _, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, password); err == nil {
+			t.Fatalf("expected empty password %v to be rejected", password)
+		}
+	}
+	if store.called {
+		t.Fatal("store must not be consulted for an empty password")
+	}
+}
+
+func TestPasswordAuthenticatorConsultsStore(t *testing.T) {
+	store := &acceptAllStore{}
+	a := NewPasswordAuthenticator(store, true)
+
+	perms, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, []byte("s3cret"))
+	if err != nil {
+		t.Fatalf("expected non-empty password to reach the store: %v", err)
+	}
+	if perms.Extensions["username"] != "alice" {
+		t.Fatalf("expected username extension alice, got %q", perms.Extensions["username"])
+	}
+}
diff --git a/weed/sftpd/sftp_copy_existing_test.go b/weed/sftpd/sftp_copy_existing_test.go
new file mode 100644
index 0000000000..5f603107a7
--- /dev/null
+++ b/weed/sftpd/sftp_copy_existing_test.go
@@ -0,0 +1,210 @@
+package sftpd
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+type copyTestFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entries   map[string]*filer_pb.Entry
+	volumeUrl string
+}
+
+func (f *copyTestFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if entry, ok := f.entries[req.Directory+"/"+req.Name]; ok {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: entry}, nil
+	}
+	return nil, status.Error(codes.NotFound, "no entry is found")
+}
+
+func (f *copyTestFiler) LookupVolume(_ context.Context, req *filer_pb.LookupVolumeRequest) (*filer_pb.LookupVolumeResponse, error) {
+	resp := &filer_pb.LookupVolumeResponse{LocationsMap: make(map[string]*filer_pb.Locations)}
+	for _, vid := range req.VolumeIds {
+		resp.LocationsMap[vid] = &filer_pb.Locations{Locations: []*filer_pb.Location{{Url: f.volumeUrl}}}
+	}
+	return resp, nil
+}
+
+func newCopyTestServer(t *testing.T, volumeUrl string, entries map[string]*filer_pb.Entry) *SftpServer {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, &copyTestFiler{entries: entries, volumeUrl: volumeUrl})
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	return &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user:           &user.User{Username: "alice", Uid: 1000, HomeDir: "/"},
+	}
+}
+
+func chunkedEntry(size int64, chunks ...*filer_pb.FileChunk) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Attributes:  &filer_pb.FuseAttributes{FileSize: uint64(size)},
+		Chunks:      chunks,
+		IsDirectory: false,
+	}
+}
+
+func fileChunk(fileId string, offset, size int64) *filer_pb.FileChunk {
+	return &filer_pb.FileChunk{FileId: fileId, Offset: offset, Size: uint64(size), ModifiedTsNs: 1}
+}
+
+// A non-truncating write must keep untouched bytes, including a sparse file's
+// zeros between chunks. Stopping at the first gap would drop the tail.
+func TestCopyExistingContentFillsSparseGaps(t *testing.T) {
+	chunkA := []byte("AAAAAAAAAA")
+	chunkB := []byte("BBBBBBBBBB")
+	objects := map[string][]byte{"3,01": chunkA, "3,02": chunkB}
+	volume := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		data, ok := objects[r.URL.Path[1:]]
+		if !ok {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		_, _ = w.Write(data)
+	}))
+	t.Cleanup(volume.Close)
+
+	entries := map[string]*filer_pb.Entry{
+		"/home/sparse.bin": chunkedEntry(100, fileChunk("3,01", 0, 10), fileChunk("3,02", 90, 10)),
+	}
+	fs := newCopyTestServer(t, volume.Listener.Addr().String(), entries)
+
+	var dst bytes.Buffer
+	if err := fs.copyExistingContent("/home/sparse.bin", &dst); err != nil {
+		t.Fatalf("copyExistingContent: %v", err)
+	}
+	want := append(append(append([]byte{}, chunkA...), make([]byte, 80)...), chunkB...)
+	if !bytes.Equal(dst.Bytes(), want) {
+		t.Fatalf("copied %d bytes, want %d with a zero-filled gap; tail present: %v", dst.Len(), len(want), bytes.Contains(dst.Bytes(), chunkB))
+	}
+}
+
+// A remote-only file has no local chunks: copying nothing would upload an
+// empty replacement on close. Refusing the read keeps the remote object.
+func TestCopyExistingContentRejectsUnreadableEntry(t *testing.T) {
+	remoteOnly := chunkedEntry(0)
+	remoteOnly.RemoteEntry = &filer_pb.RemoteEntry{RemoteSize: 100}
+	entries := map[string]*filer_pb.Entry{
+		"/home/remote.bin": remoteOnly,
+	}
+	fs := newCopyTestServer(t, "", entries)
+
+	var dst bytes.Buffer
+	if err := fs.copyExistingContent("/home/remote.bin", &dst); err == nil {
+		t.Fatal("expected refusal when no local bytes exist")
+	}
+}
+
+// A locally shortened file still names its older, larger remote object. Once
+// the local entry is newer the remote size is stale: copying must not pad the
+// file back out to it.
+func TestCopyExistingContentIgnoresStaleRemoteSize(t *testing.T) {
+	chunkA := []byte("AAAAAAAAAA")
+	volume := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/3,01" {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		_, _ = w.Write(chunkA)
+	}))
+	t.Cleanup(volume.Close)
+
+	entries := map[string]*filer_pb.Entry{
+		"/home/short.bin": {
+			Attributes:  &filer_pb.FuseAttributes{FileSize: 10, Mtime: 200},
+			Chunks:      []*filer_pb.FileChunk{fileChunk("3,01", 0, 10)},
+			RemoteEntry: &filer_pb.RemoteEntry{RemoteSize: 100, RemoteMtime: 100},
+		},
+	}
+	fs := newCopyTestServer(t, volume.Listener.Addr().String(), entries)
+
+	var dst bytes.Buffer
+	if err := fs.copyExistingContent("/home/short.bin", &dst); err != nil {
+		t.Fatalf("copyExistingContent: %v", err)
+	}
+	if !bytes.Equal(dst.Bytes(), chunkA) {
+		t.Fatalf("copied %d bytes, want the %d local bytes only", dst.Len(), len(chunkA))
+	}
+}
+
+// A file whose size is all holes still keeps its zeros.
+func TestCopyExistingContentAllHoles(t *testing.T) {
+	entries := map[string]*filer_pb.Entry{
+		"/home/holes.bin": chunkedEntry(10),
+	}
+	fs := newCopyTestServer(t, "", entries)
+
+	var dst bytes.Buffer
+	if err := fs.copyExistingContent("/home/holes.bin", &dst); err != nil {
+		t.Fatalf("all-holes file: %v", err)
+	}
+	if dst.Len() != 10 || !bytes.Equal(dst.Bytes(), make([]byte, 10)) {
+		t.Fatalf("wrote %d bytes, want 10 zeros", dst.Len())
+	}
+}
+
+func TestCopyExistingContentInlineAndMissing(t *testing.T) {
+	entries := map[string]*filer_pb.Entry{
+		"/home/inline.txt": {Attributes: &filer_pb.FuseAttributes{FileSize: 5}, Content: []byte("hello")},
+	}
+	fs := newCopyTestServer(t, "", entries)
+
+	var dst bytes.Buffer
+	if err := fs.copyExistingContent("/home/inline.txt", &dst); err != nil {
+		t.Fatalf("inline content: %v", err)
+	}
+	if got := dst.String(); got != "hello" {
+		t.Fatalf("inline content = %q, want %q", got, "hello")
+	}
+
+	dst.Reset()
+	if err := fs.copyExistingContent("/home/missing.txt", &dst); err != nil || dst.Len() != 0 {
+		t.Fatalf("missing file: err=%v written=%d", err, dst.Len())
+	}
+}
+
+func TestCopyExistingContentTrailingGap(t *testing.T) {
+	chunkA := []byte("AAAAAAAAAA")
+	volume := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/3,01" {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		_, _ = w.Write(chunkA)
+	}))
+	t.Cleanup(volume.Close)
+
+	entries := map[string]*filer_pb.Entry{
+		"/home/trailing.bin": chunkedEntry(50, fileChunk("3,01", 0, 10)),
+	}
+	fs := newCopyTestServer(t, volume.Listener.Addr().String(), entries)
+
+	var dst bytes.Buffer
+	if err := fs.copyExistingContent("/home/trailing.bin", &dst); err != nil {
+		t.Fatalf("copyExistingContent: %v", err)
+	}
+	want := append(append([]byte{}, chunkA...), make([]byte, 40)...)
+	if !bytes.Equal(dst.Bytes(), want) {
+		t.Fatalf("copied %d bytes, want %d with a zero-filled tail", dst.Len(), len(want))
+	}
+}
diff --git a/weed/sftpd/sftp_filer.go b/weed/sftpd/sftp_filer.go
index 718290ea4c..70ff8669bf 100644
--- a/weed/sftpd/sftp_filer.go
+++ b/weed/sftpd/sftp_filer.go
@@ -5,15 +5,18 @@ import (
 	"context"
 	"crypto/md5"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"path"
 	"strings"
 	"time"
 
 	"github.com/pkg/sftp"
+	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -22,6 +25,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 	"google.golang.org/grpc"
 )
 
@@ -149,9 +153,8 @@ func (fs *SftpServer) newFileWriter(r *sftp.Request) (io.WriterAt, error) {
 	if err != nil {
 		return nil, err
 	}
-	dir, _ := util.FullPath(absPath).DirAndName()
-	if err := fs.checkFilePermission(dir, "write"); err != nil {
-		glog.Errorf("Permission denied for %s", dir)
+	if err := fs.checkFilePermission(absPath, "write"); err != nil {
+		glog.Errorf("Permission denied for %s", absPath)
 		return nil, err
 	}
 	// Create a temporary file to buffer writes
@@ -159,6 +162,14 @@ func (fs *SftpServer) newFileWriter(r *sftp.Request) (io.WriterAt, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to create temp file: %w", err)
 	}
+	// Without O_TRUNC the client writes into the existing file, so start from its current bytes.
+	if !r.Pflags().Trunc {
+		if err := fs.copyExistingContent(absPath, tmpFile); err != nil {
+			tmpFile.Close()
+			os.Remove(tmpFile.Name())
+			return nil, err
+		}
+	}
 
 	return &SeaweedSftpFileWriter{
 		fs:          *fs,
@@ -172,6 +183,75 @@ func (fs *SftpServer) newFileWriter(r *sftp.Request) (io.WriterAt, error) {
 	}, nil
 }
 
+func (fs *SftpServer) copyExistingContent(absPath string, dst io.Writer) error {
+	entry, err := fs.getEntry(absPath)
+	if err == os.ErrNotExist {
+		return nil
+	}
+	if err != nil {
+		return err
+	}
+	if entry.IsDirectory {
+		return nil
+	}
+	size := int64(filer.FileSize(entry))
+	remote := entry.GetRemoteEntry()
+	if len(entry.Content) == 0 && len(entry.GetChunks()) == 0 {
+		if remote != nil && remote.RemoteSize > 0 {
+			return fmt.Errorf("existing content of %s is not readable", absPath)
+		}
+		if size == 0 {
+			return nil
+		}
+		return writeZeros(dst, size)
+	}
+	if size == 0 {
+		return nil
+	}
+	if len(entry.Content) > 0 {
+		if _, err := dst.Write(entry.Content); err != nil {
+			return err
+		}
+		if remaining := size - int64(len(entry.Content)); remaining > 0 {
+			return writeZeros(dst, remaining)
+		}
+		return nil
+	}
+	streamFn, err := filer.PrepareStreamContent(lookupFileIdFn(filer.LookupFn(fs)), filer.JwtForVolumeServer, entry.GetChunks(), 0, size)
+	if err != nil {
+		return fmt.Errorf("read existing content of %s: %w", absPath, err)
+	}
+	if err := streamFn(dst); err != nil {
+		return fmt.Errorf("read existing content of %s: %w", absPath, err)
+	}
+	return nil
+}
+
+// lookupFileIdFn adapts a filer LookupFn to the chunk streamer's provider
+// interface. PrepareStreamContent fills unstored gaps with zeros, so a sparse
+// file's tail survives the copy.
+type lookupFileIdFn wdclient.LookupFileIdFunctionType
+
+func (fn lookupFileIdFn) GetLookupFileIdFunction() wdclient.LookupFileIdFunctionType {
+	return wdclient.LookupFileIdFunctionType(fn)
+}
+
+func writeZeros(w io.Writer, size int64) error {
+	zeros := make([]byte, 8192)
+	for size > 0 {
+		n := int64(len(zeros))
+		if size < n {
+			n = size
+		}
+		written, err := w.Write(zeros[:n])
+		size -= int64(written)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (fs *SftpServer) removeEntry(absPath string) error {
 	return fs.deleteEntry(absPath, false)
 }
@@ -184,17 +264,148 @@ func (fs *SftpServer) renameEntry(absPath, absTarget string) error {
 	if err := fs.checkFilePermission(targetDir, "write"); err != nil {
 		return err
 	}
+	requireAbsentTarget := false
+	if path.Clean(absPath) != path.Clean(absTarget) {
+		var err error
+		requireAbsentTarget, err = fs.checkRenameTargetDelete(absTarget, targetDir)
+		if err != nil {
+			return err
+		}
+	}
+	if err := fs.checkRenameKeepsAcl(absPath, absTarget); err != nil {
+		return err
+	}
 	oldDir, oldName := util.FullPath(absPath).DirAndName()
 	newDir, newName := util.FullPath(absTarget).DirAndName()
 	return fs.callWithClient(false, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 		_, err := client.AtomicRenameEntry(ctx, &filer_pb.AtomicRenameEntryRequest{
 			OldDirectory: oldDir, OldName: oldName,
 			NewDirectory: newDir, NewName: newName,
+			// A target the user may not delete must stay absent: the filer
+			// checks it again under the rename locks, where a create cannot
+			// slip in.
+			FailIfTargetExists: requireAbsentTarget,
 		})
 		return err
 	})
 }
 
+// checkRenameTargetDelete enforces delete access where a rename can destroy an
+// entry. Overwriting an existing target deletes it, so it needs delete access
+// on the target itself. A name that does not exist yet needs no delete check
+// unless a configured ACL restricts that name itself: enforcing such an ACL
+// even while the entry is absent keeps a concurrent create from slipping a
+// protected target under the rename. When the target name simply inherits its
+// directory's ACL and the user could not delete an entry there, the rename is
+// still allowed for a new name but the caller is told to require the target to
+// stay absent, so the filer rejects the overwrite of one created in the gap.
+// Lookup failures other than not-found fail closed.
+func (fs *SftpServer) checkRenameTargetDelete(absTarget, targetDir string) (requireAbsentTarget bool, err error) {
+	if _, err := fs.getEntry(absTarget); err == nil {
+		return false, fs.checkFilePermission(absTarget, "delete")
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return false, err
+	}
+	if fs.user == nil || fs.user.Username == "root" || fs.user.Uid == 0 {
+		return false, nil
+	}
+	if matchingAclPrefix(fs.user, absTarget) != matchingAclPrefix(fs.user, targetDir) {
+		if !HasExplicitPermission(fs.user, absTarget, PermDelete, false) {
+			glog.V(0).Infof("permission denied for user %s: rename target %s carries a delete-protected ACL", fs.user.Username, absTarget)
+			return false, os.ErrPermission
+		}
+		return false, nil
+	}
+	if err := fs.checkFilePermission(absTarget, "delete"); err != nil {
+		if errors.Is(err, os.ErrPermission) {
+			return true, nil
+		}
+		return false, err
+	}
+	return false, nil
+}
+
+// matchingAclPrefix returns the longest configured ACL path that applies to p,
+// or "" when no configured path covers it.
+func matchingAclPrefix(user *user.User, p string) string {
+	best := ""
+	for aclPath := range user.Permissions {
+		cleaned := path.Clean(aclPath)
+		if pathWithin(cleaned, p) && len(cleaned) > len(best) {
+			best = cleaned
+		}
+	}
+	return best
+}
+
+// checkRenameKeepsAcl denies a rename that would move entries to locations
+// where ACLs grant the user read, list, write, or delete access the source
+// side lacked. It compares the moved root and every configured ACL path under
+// either the source or the target (mapped back to the source) so both
+// inherited restrictions and deeper destination grants are caught.
+func (fs *SftpServer) checkRenameKeepsAcl(absPath, absTarget string) error {
+	if fs.user == nil || fs.user.Username == "root" || fs.user.Uid == 0 {
+		return nil
+	}
+	type aclPair struct {
+		src, dst string
+		isDir    bool
+	}
+	srcEntry, err := fs.getEntry(absPath)
+	if err != nil {
+		return err
+	}
+	pairs := []aclPair{{absPath, absTarget, srcEntry.IsDirectory}}
+	seen := map[string]bool{absPath: true}
+	for p := range fs.user.Permissions {
+		cleaned := path.Clean(p)
+		var src string
+		switch {
+		case pathWithin(absPath, cleaned):
+			src = cleaned
+		case pathWithin(absTarget, cleaned):
+			src = path.Join(absPath, strings.TrimPrefix(cleaned, absTarget))
+		default:
+			continue
+		}
+		if seen[src] {
+			continue
+		}
+		seen[src] = true
+		// A rule only protects an entry that actually moves; a path reserved
+		// for a missing child must not block the rename. A lookup error is not
+		// proof that the child is missing, so only os.ErrNotExist may skip.
+		entry, err := fs.getEntry(src)
+		if err != nil {
+			if errors.Is(err, os.ErrNotExist) {
+				continue
+			}
+			return err
+		}
+		relocated := path.Join(absTarget, strings.TrimPrefix(src, absPath))
+		pairs = append(pairs, aclPair{src, relocated, entry.IsDirectory})
+	}
+	for _, pair := range pairs {
+		// A moved directory carries file children whose ACLs resolve with
+		// isDirectory=false, where list no longer counts as read. Comparing
+		// only the directory shape would miss children gaining read, so a
+		// directory is checked in the file shape too.
+		shapes := []bool{pair.isDir}
+		if pair.isDir {
+			shapes = append(shapes, false)
+		}
+		for _, isDir := range shapes {
+			for _, perm := range []string{PermRead, PermList, PermWrite, PermDelete} {
+				if !HasExplicitPermission(fs.user, pair.src, perm, isDir) && HasExplicitPermission(fs.user, pair.dst, perm, isDir) {
+					glog.V(0).Infof("permission denied for user %s: rename of %s to %s would drop the ACL on %s", fs.user.Username, absPath, absTarget, pair.src)
+					return os.ErrPermission
+				}
+			}
+		}
+	}
+	return nil
+}
+
 func (fs *SftpServer) setFileStatWithRequest(absPath string, r *sftp.Request) error {
 	if err := fs.checkFilePermission(absPath, "write"); err != nil {
 		return err
@@ -246,21 +457,24 @@ func (fs *SftpServer) listAllPages(dirPath string) (sftp.ListerAt, error) {
 	var all []os.FileInfo
 	last := ""
 	for {
-		page, err := fs.fetchDirectoryPage(dirPath, last)
+		page, lastName, received, err := fs.fetchDirectoryPage(dirPath, last)
 		if err != nil {
 			return nil, err
 		}
 		all = append(all, page...)
-		if len(page) < defaultListLimit {
+		if received < defaultListLimit {
 			break
 		}
-		last = page[len(page)-1].Name()
+		last = lastName
 	}
 	return listerat(all), nil
 }
 
-func (fs *SftpServer) fetchDirectoryPage(dirPath, start string) ([]os.FileInfo, error) {
+// fetchDirectoryPage returns the entries the user may list, plus the last name and count the filer sent.
+func (fs *SftpServer) fetchDirectoryPage(dirPath, start string) ([]os.FileInfo, string, int, error) {
 	var list []os.FileInfo
+	lastName := ""
+	received := 0
 	err := fs.callWithClient(true, func(ctx context.Context, client filer_pb.SeaweedFilerClient) error {
 		stream, err := client.ListEntries(ctx, &filer_pb.ListEntriesRequest{Directory: dirPath, StartFromFileName: start, Limit: defaultListLimit})
 		if err != nil {
@@ -271,9 +485,14 @@ func (fs *SftpServer) fetchDirectoryPage(dirPath, start string) ([]os.FileInfo,
 			if err == io.EOF {
 				break
 			}
-			if err != nil || r.Entry == nil {
+			if err != nil {
+				return err
+			}
+			if r.Entry == nil {
 				continue
 			}
+			received++
+			lastName = r.Entry.Name
 			p := path.Join(dirPath, r.Entry.Name)
 			if err := fs.checkFilePermission(p, "list"); err != nil {
 				continue
@@ -282,7 +501,7 @@ func (fs *SftpServer) fetchDirectoryPage(dirPath, start string) ([]os.FileInfo,
 		}
 		return nil
 	})
-	return list, err
+	return list, lastName, received, err
 }
 
 // makeDir creates a new directory with proper permissions.
@@ -322,7 +541,8 @@ func (fs *SftpServer) removeDir(absPath string) error {
 
 func (fs *SftpServer) putFile(filepath string, reader io.Reader, user *user.User) error {
 	dir, filename := util.FullPath(filepath).DirAndName()
-	uploadUrl := fmt.Sprintf("http://%s%s", fs.filerAddr, filepath)
+	// Escape the path so a "?" in the filename cannot inject filer query commands like cp.from/mv.from.
+	uploadUrl := (&url.URL{Scheme: "http", Host: fs.filerAddr.ToHttpAddress(), Path: filepath}).String()
 	// Let the global HTTP client normalize the scheme to https:// when TLS is configured
 	normalizedUrl, err := util_http.NormalizeUrl(uploadUrl)
 	if err != nil {
diff --git a/weed/sftpd/sftp_filer_test.go b/weed/sftpd/sftp_filer_test.go
new file mode 100644
index 0000000000..c4dd7e183e
--- /dev/null
+++ b/weed/sftpd/sftp_filer_test.go
@@ -0,0 +1,180 @@
+package sftpd
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/pkg/sftp"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+// TestPutFileEscapesQueryInjection ensures a filename containing "?" cannot be
+// reinterpreted by the filer as a query string that injects cp.from/mv.from
+// commands, which would let an SFTP user escape their home directory.
+func TestPutFileEscapesQueryInjection(t *testing.T) {
+	var gotPath, gotRawQuery string
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotRawQuery = r.URL.RawQuery
+		if _, err := w.Write([]byte(`{}`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
+	}))
+	defer ts.Close()
+
+	fs := &SftpServer{filerAddr: pb.ServerAddress(strings.TrimPrefix(ts.URL, "http://"))}
+
+	malicious := "/home/alice/steal?cp.from=/home/bob/secret.txt"
+	if err := fs.putFile(malicious, strings.NewReader("dummy"), nil); err != nil {
+		t.Fatalf("putFile: %v", err)
+	}
+
+	if gotRawQuery != "" {
+		t.Errorf("filename leaked into query string: RawQuery=%q", gotRawQuery)
+	}
+	if gotPath != malicious {
+		t.Errorf("path not delivered literally: got %q, want %q", gotPath, malicious)
+	}
+}
+
+type fakeListFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	names    []string
+	failFrom int // ListEntries fails after sending this many entries, when > 0
+}
+
+func (f *fakeListFiler) ListEntries(req *filer_pb.ListEntriesRequest, stream grpc.ServerStreamingServer[filer_pb.ListEntriesResponse]) error {
+	sent := 0
+	for _, name := range f.names {
+		if name <= req.StartFromFileName || sent >= int(req.Limit) {
+			continue
+		}
+		if f.failFrom > 0 && sent == f.failFrom {
+			return status.Error(codes.Unavailable, "filer went away")
+		}
+		if err := stream.Send(&filer_pb.ListEntriesResponse{Entry: &filer_pb.Entry{Name: name, Attributes: &filer_pb.FuseAttributes{}}}); err != nil {
+			return err
+		}
+		sent++
+	}
+	return nil
+}
+
+func (f *fakeListFiler) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: &filer_pb.Entry{Name: req.Name, Attributes: &filer_pb.FuseAttributes{}}}, nil
+}
+
+func newListTestServer(t *testing.T, filer *fakeListFiler) *SftpServer {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(srv, filer)
+	go srv.Serve(lis)
+	t.Cleanup(srv.Stop)
+	return &SftpServer{
+		filerAddr:      pb.ServerAddress(fmt.Sprintf("127.0.0.1:1.%d", lis.Addr().(*net.TCPAddr).Port)),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice",
+			HomeDir:  "/",
+			Uid:      1001,
+			Gid:      1001,
+			// every entry under /d is listable except f00000
+			Permissions: map[string][]string{"/d": {"list"}, "/d/f00000": {}},
+		},
+	}
+}
+
+func listNames(t *testing.T, fs *SftpServer) ([]string, error) {
+	t.Helper()
+	type result struct {
+		lister sftp.ListerAt
+		err    error
+	}
+	done := make(chan result, 1)
+	go func() {
+		lister, err := fs.listAllPages("/d")
+		done <- result{lister, err}
+	}()
+	select {
+	case r := <-done:
+		if r.err != nil {
+			return nil, r.err
+		}
+		infos := make([]os.FileInfo, 10000)
+		n, _ := r.lister.ListAt(infos, 0)
+		var names []string
+		for _, fi := range infos[:n] {
+			names = append(names, fi.Name())
+		}
+		return names, nil
+	case <-time.After(10 * time.Second):
+		t.Fatal("listing did not return")
+		return nil, nil
+	}
+}
+
+func fileNames(n int) []string {
+	names := make([]string, n)
+	for i := range names {
+		names[i] = fmt.Sprintf("f%05d", i)
+	}
+	return names
+}
+
+func TestListAllPagesReturnsStreamError(t *testing.T) {
+	fs := newListTestServer(t, &fakeListFiler{names: fileNames(10), failFrom: 3})
+	_, err := listNames(t, fs)
+	if status.Code(err) != codes.Unavailable {
+		t.Fatalf("expected the stream error, got %v", err)
+	}
+}
+
+func TestListAllPagesContinuesPastHiddenEntries(t *testing.T) {
+	fs := newListTestServer(t, &fakeListFiler{names: fileNames(defaultListLimit + 500)})
+	names, err := listNames(t, fs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(names) != defaultListLimit+499 {
+		t.Fatalf("expected %d entries, got %d", defaultListLimit+499, len(names))
+	}
+	if names[0] != "f00001" || names[len(names)-1] != fmt.Sprintf("f%05d", defaultListLimit+499) {
+		t.Fatalf("unexpected first/last entries %q, %q", names[0], names[len(names)-1])
+	}
+}
+
+func TestListAllPagesContinuesPastFullyHiddenPage(t *testing.T) {
+	const tail = 10
+	fs := newListTestServer(t, &fakeListFiler{names: fileNames(defaultListLimit + tail)})
+	// The whole first page is hidden from the user; only the tail is listable.
+	for i := 0; i < defaultListLimit; i++ {
+		fs.user.Permissions[fmt.Sprintf("/d/f%05d", i)] = []string{}
+	}
+	names, err := listNames(t, fs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(names) != tail {
+		t.Fatalf("expected the %d entries after the hidden page, got %d", tail, len(names))
+	}
+	if names[0] != fmt.Sprintf("f%05d", defaultListLimit) {
+		t.Fatalf("unexpected first entry %q", names[0])
+	}
+}
diff --git a/weed/sftpd/sftp_permissions.go b/weed/sftpd/sftp_permissions.go
index 8eea53f60a..1a32107839 100644
--- a/weed/sftpd/sftp_permissions.go
+++ b/weed/sftpd/sftp_permissions.go
@@ -67,6 +67,9 @@ func (fs *SftpServer) CheckFilePermission(path string, perm string) error {
 		// check permissions on the parent directory instead
 		if err == os.ErrNotExist {
 			parentPath := stdpath.Dir(path)
+			if parentPath == path {
+				return os.ErrPermission
+			}
 			// Check if user can write to the parent directory
 			return fs.CheckFilePermission(parentPath, perm)
 		}
diff --git a/weed/sftpd/sftp_permissions_test.go b/weed/sftpd/sftp_permissions_test.go
index 7390728941..e9dbc70132 100644
--- a/weed/sftpd/sftp_permissions_test.go
+++ b/weed/sftpd/sftp_permissions_test.go
@@ -1,9 +1,20 @@
 package sftpd
 
 import (
+	"context"
+	"errors"
+	"net"
+	"os"
 	"testing"
 
+	"github.com/pkg/sftp"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
 )
 
 func TestPathWithin(t *testing.T) {
@@ -62,3 +73,482 @@ func TestIsPathInHomeDirectorySiblingPrefix(t *testing.T) {
 		t.Error("home /tenants/alice must not match sibling /tenants/alice-archive")
 	}
 }
+
+// newFileWriter must honor a more specific ACL on the target file, not just
+// the parent directory's: a file the user cannot write stays read-only even
+// in a writable directory. Missing paths still defer to the parent directory.
+func TestNewFileWriterChecksTargetFile(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/":                       {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{FileMode: 0755}},
+		"/home":                   {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{FileMode: 0755}},
+		"/home/alice":             {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/locked.txt":  {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		"/home/alice/ok.txt":      {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		"/home/alice/nested":      {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/nested/ok.f": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+	}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":            {"readwrite"},
+				"/home/alice/locked.txt": {"read"},
+			},
+		},
+	}
+
+	write := func(path string) error {
+		w, err := fs.newFileWriter(&sftp.Request{Filepath: path})
+		if writer, ok := w.(*SeaweedSftpFileWriter); ok {
+			_ = os.Remove(writer.tmpFile.Name())
+			_ = writer.tmpFile.Close()
+		}
+		return err
+	}
+
+	if err := write("/locked.txt"); err == nil {
+		t.Error("expected write denial on a file with an explicit read-only ACL")
+	}
+	if err := write("/ok.txt"); err != nil {
+		t.Errorf("expected write under the directory ACL, got %v", err)
+	}
+	if err := write("/new.txt"); err != nil {
+		t.Errorf("expected write on a new file in a writable dir, got %v", err)
+	}
+	if err := write("/nested/new.txt"); err != nil {
+		t.Errorf("expected write on a new file under a missing intermediate check, got %v", err)
+	}
+	delete(filer.entries, "/home/alice/nested")
+	delete(filer.entries, "/home/alice/nested/ok.f")
+	if err := write("/gone/deeper.txt"); err != nil {
+		t.Errorf("expected write when ancestors resolve to the writable dir, got %v", err)
+	}
+}
+
+// renameEntry must honor a more specific ACL on an existing target: renaming
+// over a read-only file deletes it, so it requires delete permission on the
+// target file itself, not only write permission on the target directory.
+func TestRenameEntryChecksTargetFile(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/home/alice":            {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/own.txt":    {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		"/home/alice/ok.txt":     {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		"/home/alice/locked.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+	}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":            {"read", "write", "list", "delete", "rename"},
+				"/home/alice/locked.txt": {"read", "list"},
+			},
+		},
+	}
+
+	renameDenied := func(src, dst string) bool {
+		return errors.Is(fs.renameEntry(src, dst), os.ErrPermission)
+	}
+
+	if !renameDenied("/home/alice/own.txt", "/home/alice/locked.txt") {
+		t.Error("expected rename over a read-only file to be denied")
+	}
+	if err := fs.renameEntry("/home/alice/own.txt", "/home/alice/ok.txt"); err != nil {
+		t.Errorf("expected rename over a writable file to succeed, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/ok.txt", "/home/alice/new.txt"); err != nil {
+		t.Errorf("expected rename onto a new path in a writable dir to succeed, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/new.txt", "/home/alice/new.txt"); err != nil {
+		t.Errorf("expected a no-op rename to skip the target delete check, got %v", err)
+	}
+}
+
+// Renaming a directory must not strand a more specific ACL configured under
+// it: after /sub moves to /sub2, /sub/ro.txt no longer matches its read-only
+// ACL, so the move is denied unless the destination grants no new access.
+func TestRenameEntryKeepsNestedAcl(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/home/alice":            {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/sub":        {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/sub/ro.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+	}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":            {"read", "write", "list", "delete", "rename"},
+				"/home/alice/sub/ro.txt": {"read", "list"},
+			},
+		},
+	}
+
+	if err := fs.renameEntry("/home/alice/sub", "/home/alice/sub2"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename that strands the /sub/ro.txt ACL to be denied, got %v", err)
+	}
+	delete(fs.user.Permissions, "/home/alice/sub/ro.txt")
+	if err := fs.renameEntry("/home/alice/sub", "/home/alice/sub2"); err != nil {
+		t.Errorf("expected rename without a nested carve-out to succeed, got %v", err)
+	}
+}
+
+func TestCheckFilePermissionMissingAncestorsTerminates(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user:           &user.User{Username: "alice", Uid: 1000, HomeDir: "/home/alice"},
+	}
+	if err := fs.checkFilePermission("/a/b/c", "write"); err == nil {
+		t.Error("expected denial when no ancestor exists")
+	}
+}
+
+type permissionTestFiler struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entries   map[string]*filer_pb.Entry
+	lookupErr map[string]error
+	// createBeforeRename inserts an entry at the rename target inside the RPC,
+	// simulating a file a concurrent connection creates after the checks ran.
+	createBeforeRename map[string]*filer_pb.Entry
+}
+
+func (f *permissionTestFiler) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	key := req.Directory + "/" + req.Name
+	if err, ok := f.lookupErr[key]; ok {
+		return nil, err
+	}
+	if entry, ok := f.entries[key]; ok {
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: entry}, nil
+	}
+	return nil, status.Error(codes.NotFound, "no entry is found")
+}
+
+func (f *permissionTestFiler) AtomicRenameEntry(_ context.Context, req *filer_pb.AtomicRenameEntryRequest) (*filer_pb.AtomicRenameEntryResponse, error) {
+	oldKey := req.OldDirectory + "/" + req.OldName
+	entry, ok := f.entries[oldKey]
+	if !ok {
+		return nil, status.Error(codes.NotFound, "no entry is found")
+	}
+	newKey := req.NewDirectory + "/" + req.NewName
+	if created, ok := f.createBeforeRename[newKey]; ok {
+		f.entries[newKey] = created
+	}
+	if req.FailIfTargetExists {
+		if _, exists := f.entries[newKey]; exists && newKey != oldKey {
+			return nil, status.Error(codes.AlreadyExists, "entry already exists")
+		}
+	}
+	delete(f.entries, oldKey)
+	f.entries[newKey] = entry
+	return &filer_pb.AtomicRenameEntryResponse{}, nil
+}
+
+// checkRenameKeepsAcl also compares the moved root (inherited restrictions) and
+// ACL paths configured under the destination (deeper grants), while configured
+// paths without a real entry do not block the rename.
+func TestRenameEntryKeepsInheritedAndDestinationAcl(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/home/alice":                   {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/restricted":        {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/restricted/sub":    {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/sub":               {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/sub/locked":        {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/sub/locked/secret": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		"/home/alice/sub3":              {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+	}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":                    {"read", "write", "list", "delete", "rename"},
+				"/home/alice/restricted":         {"read", "list", "rename"},
+				"/home/alice/sub/locked":         {"read", "list"},
+				"/home/alice/sub2/locked":        {"read", "list"},
+				"/home/alice/sub2/locked/secret": {"read", "write", "list", "delete"},
+				"/home/alice/sub3/ghost.txt":     {"read", "list"},
+			},
+		},
+	}
+
+	if err := fs.renameEntry("/home/alice/restricted/sub", "/home/alice/sub5"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename escaping the inherited restricted ACL to be denied, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/sub", "/home/alice/sub2"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename into a deeper destination grant to be denied, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/sub3", "/home/alice/sub4"); err != nil {
+		t.Errorf("expected rename with a missing reserved ACL child to succeed, got %v", err)
+	}
+}
+
+// A rename onto a name that does not exist needs no delete access unless a
+// configured ACL restricts that name itself. Without the scoped check a user
+// holding write+rename but not delete could no longer move files to new names.
+func TestRenameEntryNewNameNeedsNoDelete(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/home/alice":               {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/own.txt":       {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		"/home/alice/existing.txt":  {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		"/home/alice/removable.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+	}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":               {"read", "write", "list", "rename"},
+				"/home/alice/reserved.txt":  {"read", "list"},
+				"/home/alice/managed.txt":   {"read", "write", "list", "delete"},
+				"/home/alice/removable.txt": {"read", "write", "list", "delete", "rename"},
+			},
+		},
+	}
+
+	if err := fs.renameEntry("/home/alice/own.txt", "/home/alice/new.txt"); err != nil {
+		t.Errorf("expected rename to a new name without delete access to succeed, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/new.txt", "/home/alice/existing.txt"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename over an existing file without delete access to be denied, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/new.txt", "/home/alice/reserved.txt"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename onto a delete-protected configured name to be denied, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/removable.txt", "/home/alice/managed.txt"); err != nil {
+		t.Errorf("expected rename onto a configured name that grants delete to succeed, got %v", err)
+	}
+}
+
+// checkRenameKeepsAcl fails closed: a lookup error on a configured ACL path is
+// not proof that the entry is missing, so it must stop the rename instead of
+// skipping the comparison.
+func TestRenameEntryFailsClosedOnLookupError(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{
+		entries: map[string]*filer_pb.Entry{
+			"/home/alice":            {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+			"/home/alice/sub":        {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+			"/home/alice/sub/ro.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		},
+		lookupErr: map[string]error{
+			"/home/alice/sub/ro.txt": status.Error(codes.Unavailable, "filer unavailable"),
+		},
+	}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":            {"read", "write", "list", "delete", "rename"},
+				"/home/alice/sub/ro.txt": {"read", "list"},
+			},
+		},
+	}
+
+	err = fs.renameEntry("/home/alice/sub", "/home/alice/sub2")
+	if err == nil || errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename to fail closed on a lookup error, got %v", err)
+	}
+	delete(filer.lookupErr, "/home/alice/sub/ro.txt")
+	if err := fs.renameEntry("/home/alice/sub", "/home/alice/sub2"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected the stranded ACL check to deny the rename once the lookup succeeds, got %v", err)
+	}
+}
+
+// A rename must not grant access the source side lacked, including read and
+// directory listing: moving a subtree whose ACL withholds read/list into a
+// readable destination would expose its contents.
+func TestRenameEntryKeepsReadAndListAcl(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/home/alice":              {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/noread":       {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/noread/f.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+	}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":        {"read", "write", "list", "delete", "rename"},
+				"/home/alice/noread": {"write", "delete", "rename"},
+			},
+		},
+	}
+
+	if err := fs.renameEntry("/home/alice/noread", "/home/alice/visible"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename that grants read/list on the moved directory to be denied, got %v", err)
+	}
+}
+
+// A moved directory carries file children whose ACLs resolve with
+// isDirectory=false, where list does not count as read. Moving a directory
+// that grants list but not read into a readable destination must be denied:
+// its file children would become readable even though the directory check
+// passes.
+func TestRenameEntryKeepsFileChildAcl(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{entries: map[string]*filer_pb.Entry{
+		"/home/alice":                    {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/private":            {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+		"/home/alice/private/secret.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+	}}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice":         {"read", "write", "list", "delete", "rename"},
+				"/home/alice/private": {"list", "write", "delete", "rename"},
+			},
+		},
+	}
+
+	if err := fs.renameEntry("/home/alice/private", "/home/alice/public"); !errors.Is(err, os.ErrPermission) {
+		t.Errorf("expected rename that grants read on file children to be denied, got %v", err)
+	}
+	fs.user.Permissions["/home/alice/public"] = []string{"list", "write", "delete", "rename"}
+	if err := fs.renameEntry("/home/alice/private", "/home/alice/public"); err != nil {
+		t.Errorf("expected rename onto an equally restricted ACL to succeed, got %v", err)
+	}
+}
+
+// A rename onto a new name needs no delete access, but a target created in the
+// gap between the check and the move must not be silently overwritten: the
+// filer is asked to fail the rename when the target appears.
+func TestRenameEntryRejectsConcurrentTarget(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	filer := &permissionTestFiler{
+		entries: map[string]*filer_pb.Entry{
+			"/home/alice":         {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0755}},
+			"/home/alice/own.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		},
+		createBeforeRename: map[string]*filer_pb.Entry{
+			"/home/alice/taken.txt": {Attributes: &filer_pb.FuseAttributes{Uid: 1000, FileMode: 0644}},
+		},
+	}
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filer)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.Stop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	fs := &SftpServer{
+		filerAddr:      pb.ServerAddress("127.0.0.1:0." + port),
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		user: &user.User{
+			Username: "alice", Uid: 1000, Gid: 1000, HomeDir: "/home/alice",
+			Permissions: map[string][]string{
+				"/home/alice": {"read", "write", "list", "rename"},
+			},
+		},
+	}
+
+	if err := fs.renameEntry("/home/alice/own.txt", "/home/alice/free.txt"); err != nil {
+		t.Errorf("expected rename to a name that stays absent to succeed, got %v", err)
+	}
+	if err := fs.renameEntry("/home/alice/free.txt", "/home/alice/taken.txt"); err == nil {
+		t.Error("expected rename to fail when the target appears concurrently and the user lacks delete access")
+	}
+}
diff --git a/weed/sftpd/user/filestore.go b/weed/sftpd/user/filestore.go
index 5bd0b05133..24723fe8d8 100644
--- a/weed/sftpd/user/filestore.go
+++ b/weed/sftpd/user/filestore.go
@@ -154,6 +154,11 @@ func (s *FileStore) ValidatePassword(username string, password []byte) bool {
 		return false
 	}
 
+	// An empty stored or supplied password is never a match: a public-key-only
+	// user has no password, and equal-length zero slices would otherwise compare equal.
+	if len(user.Password) == 0 || len(password) == 0 {
+		return false
+	}
 	// Compare plaintext password using constant time comparison for security
 	return subtle.ConstantTimeCompare([]byte(user.Password), password) == 1
 }
diff --git a/weed/sftpd/user/filestore_test.go b/weed/sftpd/user/filestore_test.go
new file mode 100644
index 0000000000..9c097c420b
--- /dev/null
+++ b/weed/sftpd/user/filestore_test.go
@@ -0,0 +1,36 @@
+package user
+
+import "testing"
+
+func newTestStore(users ...*User) *FileStore {
+	s := &FileStore{users: make(map[string]*User)}
+	for _, u := range users {
+		s.users[u.Username] = u
+	}
+	return s
+}
+
+func TestValidatePasswordRejectsEmpty(t *testing.T) {
+	s := newTestStore(
+		&User{Username: "keyonly", Password: "", PublicKeys: []string{"ssh-ed25519 AAAA"}},
+		&User{Username: "haspass", Password: "s3cret"},
+	)
+
+	cases := []struct {
+		username string
+		password string
+		want     bool
+	}{
+		{"keyonly", "", false}, // public-key-only user must not accept an empty password
+		{"keyonly", "wrong", false},
+		{"haspass", "", false}, // a real password is never matched by an empty one
+		{"haspass", "s3cret", true},
+		{"haspass", "wrong", false},
+		{"missing", "", false},
+	}
+	for _, c := range cases {
+		if got := s.ValidatePassword(c.username, []byte(c.password)); got != c.want {
+			t.Errorf("ValidatePassword(%q, %q) = %v, want %v", c.username, c.password, got, c.want)
+		}
+	}
+}
diff --git a/weed/shell/command_cluster_check.go b/weed/shell/command_cluster_check.go
index ca94ab7bea..18e4232a38 100644
--- a/weed/shell/command_cluster_check.go
+++ b/weed/shell/command_cluster_check.go
@@ -62,7 +62,7 @@ func (c *commandClusterCheck) Do(args []string, commandEnv *CommandEnv, writer i
 
 	// collect filers
 	var filers []pb.ServerAddress
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		resp, err := client.ListClusterNodes(context.Background(), &master_pb.ListClusterNodesRequest{
 			ClientType: cluster.FilerType,
 			FilerGroup: *commandEnv.option.FilerGroup,
diff --git a/weed/shell/command_cluster_ps.go b/weed/shell/command_cluster_ps.go
index a2fa8dc194..0c1e04fa8f 100644
--- a/weed/shell/command_cluster_ps.go
+++ b/weed/shell/command_cluster_ps.go
@@ -49,7 +49,7 @@ func (c *commandClusterPs) Do(args []string, commandEnv *CommandEnv, writer io.W
 
 	listClusterNodes := func(clientType string) ([]*master_pb.ListClusterNodesResponse_ClusterNode, error) {
 		var nodes []*master_pb.ListClusterNodesResponse_ClusterNode
-		err := commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+		err := commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 			resp, err := client.ListClusterNodes(context.Background(), &master_pb.ListClusterNodesRequest{
 				ClientType: clientType,
 				FilerGroup: *commandEnv.option.FilerGroup,
diff --git a/weed/shell/command_cluster_raft_add.go b/weed/shell/command_cluster_raft_add.go
index a957d7c44f..f540831803 100644
--- a/weed/shell/command_cluster_raft_add.go
+++ b/weed/shell/command_cluster_raft_add.go
@@ -46,7 +46,7 @@ func (c *commandRaftServerAdd) Do(args []string, commandEnv *CommandEnv, writer
 		return fmt.Errorf("empty server id or address")
 	}
 
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		_, err := client.RaftAddServer(context.Background(), &master_pb.RaftAddServerRequest{
 			Id:      *serverId,
 			Address: *serverAddress,
diff --git a/weed/shell/command_cluster_raft_leader_transfer.go b/weed/shell/command_cluster_raft_leader_transfer.go
index 32dc83f515..0047d8efc9 100644
--- a/weed/shell/command_cluster_raft_leader_transfer.go
+++ b/weed/shell/command_cluster_raft_leader_transfer.go
@@ -67,7 +67,7 @@ func (c *commandRaftLeaderTransfer) Do(args []string, commandEnv *CommandEnv, wr
 	fmt.Fprintf(writer, "Checking current raft cluster status...\n")
 
 	var currentLeader string
-	err := commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err := commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 		defer cancel()
 
@@ -107,7 +107,7 @@ func (c *commandRaftLeaderTransfer) Do(args []string, commandEnv *CommandEnv, wr
 	}
 	fmt.Fprintf(writer, "\nTransferring leadership from %s to %s...\n", currentLeader, targetDesc)
 
-	err = commandEnv.MasterClient.WithClient(true, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), true, func(client master_pb.SeaweedClient) error {
 		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer cancel()
 
diff --git a/weed/shell/command_cluster_raft_ps.go b/weed/shell/command_cluster_raft_ps.go
index 714e176497..d97272b42d 100644
--- a/weed/shell/command_cluster_raft_ps.go
+++ b/weed/shell/command_cluster_raft_ps.go
@@ -38,7 +38,7 @@ func (c *commandRaftClusterPs) Do(args []string, commandEnv *CommandEnv, writer
 		return nil
 	}
 
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		resp, err := client.RaftListClusterServers(context.Background(), &master_pb.RaftListClusterServersRequest{})
 		if err != nil {
 			return fmt.Errorf("raft list cluster: %w", err)
diff --git a/weed/shell/command_cluster_raft_remove.go b/weed/shell/command_cluster_raft_remove.go
index 6f53247319..bc18fc05ac 100644
--- a/weed/shell/command_cluster_raft_remove.go
+++ b/weed/shell/command_cluster_raft_remove.go
@@ -44,7 +44,7 @@ func (c *commandRaftServerRemove) Do(args []string, commandEnv *CommandEnv, writ
 		return fmt.Errorf("empty server id")
 	}
 
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		_, err := client.RaftRemoveServer(context.Background(), &master_pb.RaftRemoveServerRequest{
 			Id:    *serverId,
 			Force: true,
diff --git a/weed/shell/command_collection_delete.go b/weed/shell/command_collection_delete.go
index 92473e8e3b..f80c3d9a52 100644
--- a/weed/shell/command_collection_delete.go
+++ b/weed/shell/command_collection_delete.go
@@ -35,7 +35,7 @@ func (c *commandCollectionDelete) HasTag(CommandTag) bool {
 func (c *commandCollectionDelete) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
 
 	colDeleteCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
-	collectionName := colDeleteCommand.String("collection", "", "collection to delete. Use '_default_' for the empty-named collection.")
+	collectionName := colDeleteCommand.String("collection", "", "collection to delete. Use '"+CollectionDefault+"' for the empty-named collection.")
 	applyBalancing := colDeleteCommand.Bool("apply", false, "apply the collection")
 	// TODO: remove this alias
 	applyBalancingAlias := colDeleteCommand.Bool("force", false, "apply the collection (alias for -apply)")
@@ -55,16 +55,20 @@ func (c *commandCollectionDelete) Do(args []string, commandEnv *CommandEnv, writ
 		return fmt.Errorf("empty collection name is not allowed")
 	}
 
-	if *collectionName == "_default_" {
+	// The legacy "_default_" spelling stays accepted for compatibility;
+	// CollectionDefault is the shared keyword every other -collection flag
+	// uses for the empty-named collection.
+	if *collectionName == CollectionDefault+"_" {
 		*collectionName = ""
 	}
+	*collectionName = resolveCollectionName(*collectionName)
 
 	if !*applyBalancing {
 		fmt.Fprintf(writer, "collection '%s' will be deleted. Use -apply to apply the change.\n", *collectionName)
 		return nil
 	}
 
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		_, err = client.CollectionDelete(context.Background(), &master_pb.CollectionDeleteRequest{
 			Name: *collectionName,
 		})
diff --git a/weed/shell/command_collection_list.go b/weed/shell/command_collection_list.go
index 0287b1e96c..4114f73d6d 100644
--- a/weed/shell/command_collection_list.go
+++ b/weed/shell/command_collection_list.go
@@ -79,7 +79,7 @@ func (c *commandCollectionList) Do(args []string, commandEnv *CommandEnv, writer
 
 func ListCollectionNames(commandEnv *CommandEnv, includeNormalVolumes, includeEcVolumes bool) (collections []string, err error) {
 	var resp *master_pb.CollectionListResponse
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		resp, err = client.CollectionList(context.Background(), &master_pb.CollectionListRequest{
 			IncludeNormalVolumes: includeNormalVolumes,
 			IncludeEcVolumes:     includeEcVolumes,
diff --git a/weed/shell/command_ec_balance.go b/weed/shell/command_ec_balance.go
index 71169bb88b..27cf0eaf96 100644
--- a/weed/shell/command_ec_balance.go
+++ b/weed/shell/command_ec_balance.go
@@ -5,7 +5,9 @@ import (
 	"io"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 )
 
 func init() {
@@ -22,10 +24,14 @@ func (c *commandEcBalance) Name() string {
 func (c *commandEcBalance) Help() string {
 	return `balance all ec shards among all racks and volume servers
 
-	ec.balance [-c EACH_COLLECTION|<collection_name>] [-apply] [-dataCenter <data_center>] [-shardReplicaPlacement <replica_placement>] [-diskType <disk_type>]
+	ec.balance [-c EACH_COLLECTION|<collection_name>] [-apply] [-dataCenter <data_center>] [-shardReplicaPlacement <replica_placement>] [-diskType <disk_type>] [-volumeIds <id>[,<id>...]]
 
 	Options:
 	  -diskType: the disk type for EC shards (hdd, ssd, or empty for default hdd)
+	  -volumeIds: only balance these ec volume ids, e.g. -volumeIds 123,456. The plan is
+	    built as if no other ec volume existed, so nothing else is moved or deduplicated.
+	    Ids without any ec shard in the selected collection, dataCenter and disk type are
+	    an error.
 
 	Algorithm:
 	` + ecBalanceAlgorithmDescription
@@ -37,11 +43,13 @@ func (c *commandEcBalance) HasTag(CommandTag) bool {
 
 func (c *commandEcBalance) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
 	balanceCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
-	collection := balanceCommand.String("collection", "EACH_COLLECTION", "collection name, or \"EACH_COLLECTION\" for each collection")
+	collection := balanceCommand.String("collection", string(wildcard.CollectionFilterEach), "comma-separated collection names, wildcards, or regex patterns, \""+CollectionDefault+"\" for the collection with no name, or \""+string(wildcard.CollectionFilterEach)+"\" for each collection")
 	dc := balanceCommand.String("dataCenter", "", "only apply the balancing for this dataCenter")
 	shardReplicaPlacement := balanceCommand.String("shardReplicaPlacement", "", "replica placement for EC shards, or master default if empty")
 	diskTypeStr := balanceCommand.String("diskType", "", "the disk type for EC shards (hdd, ssd, or empty for default hdd)")
+	volumeIdsStr := balanceCommand.String("volumeIds", "", "optional comma-separated list of ec volume ids to balance; defaults to all")
 	maxParallelization := balanceCommand.Int("maxParallelization", DefaultMaxParallelization, "run up to X tasks in parallel, whenever possible")
+	ioBytePerSecond := balanceCommand.Int64("ioBytePerSecond", 0, "limit the speed of each shard copy; 0 falls back to the volume server's maintenance rate")
 	applyBalancing := balanceCommand.Bool("apply", false, "apply the balancing plan")
 	// TODO: remove this alias
 	applyBalancingAlias := balanceCommand.Bool("force", false, "apply the balancing plan (alias for -apply)")
@@ -53,18 +61,20 @@ func (c *commandEcBalance) Do(args []string, commandEnv *CommandEnv, writer io.W
 	handleDeprecatedForceFlag(writer, balanceCommand, applyBalancingAlias, applyBalancing)
 	infoAboutSimulationMode(writer, *applyBalancing, "-apply")
 
+	var volumeIds []needle.VolumeId
+	if *volumeIdsStr != "" {
+		if volumeIds, err = parseVolumeIdsFlag(*volumeIdsStr); err != nil {
+			return err
+		}
+	}
+
 	if err = commandEnv.confirmIsLocked(args); err != nil {
 		return
 	}
 
-	var collections []string
-	if *collection == "EACH_COLLECTION" {
-		collections, err = ListCollectionNames(commandEnv, false, true)
-		if err != nil {
-			return err
-		}
-	} else {
-		collections = append(collections, *collection)
+	collections, err := resolveEcCollections(commandEnv, *collection)
+	if err != nil {
+		return err
 	}
 	glog.V(1).Infof("balanceEcVolumes collections %+v\n", len(collections))
 
@@ -75,5 +85,5 @@ func (c *commandEcBalance) Do(args []string, commandEnv *CommandEnv, writer io.W
 
 	diskType := types.ToDiskType(*diskTypeStr)
 
-	return EcBalance(commandEnv, collections, *dc, rp, diskType, *maxParallelization, *applyBalancing, nil)
+	return EcBalance(commandEnv, collections, *dc, rp, diskType, *maxParallelization, *ioBytePerSecond, *applyBalancing, nil, volumeIds)
 }
diff --git a/weed/shell/command_ec_check_replication.go b/weed/shell/command_ec_check_replication.go
index 953650deac..a5a8b8ff82 100644
--- a/weed/shell/command_ec_check_replication.go
+++ b/weed/shell/command_ec_check_replication.go
@@ -4,12 +4,10 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"slices"
 	"strconv"
 	"strings"
 
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 )
 
 func init() {
@@ -63,13 +61,7 @@ func (c *commandEcCheckReplication) Do(args []string, commandEnv *CommandEnv, wr
 		return
 	}
 
-	// Keep execution state in a per-run runner rather than on the long-lived
-	// command singleton, so concurrent or repeated invocations don't share state.
-	runner := &ecCheckReplicationRunner{
-		writer:      writer,
-		volumeIDMap: map[uint32]bool{},
-	}
-
+	volumeIDMap := map[uint32]bool{}
 	if *volumeIDsStr != "" {
 		for _, vids := range strings.Split(*volumeIDsStr, ",") {
 			vids = strings.TrimSpace(vids)
@@ -77,207 +69,19 @@ func (c *commandEcCheckReplication) Do(args []string, commandEnv *CommandEnv, wr
 				continue
 			}
 			if vid, err := strconv.ParseUint(vids, 10, 32); err == nil {
-				runner.volumeIDMap[uint32(vid)] = true
+				volumeIDMap[uint32(vid)] = true
 			} else {
 				return fmt.Errorf("invalid volume ID %q", vids)
 			}
 		}
 	}
 
-	runner.dataNodes, err = collectDataNodes(commandEnv, 0)
+	dataNodes, err := collectDataNodes(commandEnv, 0)
 	if err != nil {
 		return err
 	}
 
-	return runner.checkEcVolumes(*showDetails)
+	return ec.CheckEcVolumeReplication(writer, dataNodes, volumeIDMap, *showDetails)
 }
 
 // ecCheckReplicationRunner holds the state for a single ec.check.replication invocation.
-type ecCheckReplicationRunner struct {
-	writer      io.Writer
-	dataNodes   []*master_pb.DataNodeInfo
-	volumeIDMap map[uint32]bool
-}
-
-func (r *ecCheckReplicationRunner) write(format string, a ...any) {
-	fmt.Fprintf(r.writer, format, a...)
-}
-
-func (r *ecCheckReplicationRunner) isVolumeIDValid(vid uint32) bool {
-	if len(r.volumeIDMap) == 0 {
-		return true
-	}
-	return r.volumeIDMap[vid]
-}
-
-// ecVolumeShardReplication aggregates the observed shards for a single EC volume,
-// together with the data+parity ratio the volume was encoded with. The ratio is
-// taken per volume (via erasure_coding.EcShardsVolume*Shards) so custom EC
-// ratios are checked against their own expected shard count.
-type ecVolumeShardReplication struct {
-	dataShards   int
-	parityShards int
-	// shardAddresses maps a shard id to the sorted node addresses hosting it.
-	shardAddresses map[erasure_coding.ShardId][]string
-}
-
-func (h *ecVolumeShardReplication) totalShards() int {
-	return h.dataShards + h.parityShards
-}
-
-// replicaCount is the total number of shard copies observed, counting each
-// over-replicated shard once per hosting node.
-func (h *ecVolumeShardReplication) replicaCount() int {
-	n := 0
-	for _, addrs := range h.shardAddresses {
-		n += len(addrs)
-	}
-	return n
-}
-
-// unexpectedShardIds returns, in ascending order, any observed shard ids that
-// fall outside the volume's expected data+parity range. These are anomalies
-// (e.g. a stray shard) and are treated as over-replication.
-func (h *ecVolumeShardReplication) unexpectedShardIds() []erasure_coding.ShardId {
-	var ids []erasure_coding.ShardId
-	for sid := range h.shardAddresses {
-		if int(sid) >= h.totalShards() {
-			ids = append(ids, sid)
-		}
-	}
-	slices.Sort(ids)
-	return ids
-}
-
-// TODO: check shard sizes?
-func (r *ecCheckReplicationRunner) checkEcVolumes(showDetails bool) error {
-	// collect EC shard placement, keyed by volume id
-	volumes := map[uint32]*ecVolumeShardReplication{}
-	for _, dni := range r.dataNodes {
-		nodeAddress := dni.GetAddress()
-		for _, di := range dni.GetDiskInfos() {
-			for _, eci := range di.GetEcShardInfos() {
-				vid := eci.GetId()
-				if !r.isVolumeIDValid(vid) {
-					continue
-				}
-
-				h, ok := volumes[vid]
-				if !ok {
-					// all shards of a volume share one ratio; take it from the
-					// first shard message seen for the volume.
-					h = &ecVolumeShardReplication{
-						dataShards:     erasure_coding.EcShardsVolumeDataShards(eci),
-						parityShards:   erasure_coding.EcShardsVolumeParityShards(eci),
-						shardAddresses: map[erasure_coding.ShardId][]string{},
-					}
-					volumes[vid] = h
-				}
-
-				sinfo := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
-				for _, sid := range sinfo.Ids() {
-					h.shardAddresses[sid] = append(h.shardAddresses[sid], nodeAddress)
-				}
-			}
-		}
-	}
-
-	if len(volumes) == 0 {
-		// Asking about specific volume IDs that turn out not to be EC volumes is
-		// an error; an unfiltered run over a cluster with no EC volumes is a
-		// legitimate, healthy state rather than a failure.
-		if len(r.volumeIDMap) > 0 {
-			return fmt.Errorf("no EC volumes found")
-		}
-		r.write("No EC volumes found.\n")
-		return nil
-	}
-
-	// keep the shard address lists nicely sorted, for the sake of readability.
-	for _, h := range volumes {
-		for _, addrs := range h.shardAddresses {
-			slices.Sort(addrs)
-		}
-	}
-
-	// classify each volume against its own expected shard count
-	underreplicatedVolumeIDs := []uint32{}
-	overreplicatedVolumeIDs := []uint32{}
-	for vid, h := range volumes {
-		under := false
-		over := false
-		for sid := 0; sid < h.totalShards(); sid++ {
-			switch len(h.shardAddresses[erasure_coding.ShardId(sid)]) {
-			case 0:
-				under = true
-			case 1:
-			default:
-				over = true
-			}
-		}
-		// shard ids beyond the expected data+parity range are unexpected extras,
-		// i.e. redundant data the ratio doesn't call for.
-		if len(h.unexpectedShardIds()) > 0 {
-			over = true
-		}
-
-		// under- and over-replication are independent problems (missing shards risk
-		// data loss, redundant shards waste space), so a volume exhibiting both is
-		// reported in both lists.
-		if under {
-			underreplicatedVolumeIDs = append(underreplicatedVolumeIDs, vid)
-		}
-		if over {
-			overreplicatedVolumeIDs = append(overreplicatedVolumeIDs, vid)
-		}
-	}
-	slices.Sort(underreplicatedVolumeIDs)
-	slices.Sort(overreplicatedVolumeIDs)
-
-	// ...and display results
-	if len(underreplicatedVolumeIDs) == 0 && len(overreplicatedVolumeIDs) == 0 {
-		r.write("EC volumes are healthy.\n")
-		return nil
-	}
-
-	if len(underreplicatedVolumeIDs) != 0 {
-		r.write("Found %d/%d under-replicated EC volumes: %v\n", len(underreplicatedVolumeIDs), len(volumes), underreplicatedVolumeIDs)
-	}
-	if len(overreplicatedVolumeIDs) != 0 {
-		r.write("Found %d/%d over-replicated EC volumes: %v\n", len(overreplicatedVolumeIDs), len(volumes), overreplicatedVolumeIDs)
-	}
-
-	if showDetails {
-		if len(underreplicatedVolumeIDs) != 0 {
-			r.write("\n")
-			r.writeShardMaps("under-replicated", underreplicatedVolumeIDs, volumes)
-		}
-		if len(overreplicatedVolumeIDs) != 0 {
-			r.write("\n")
-			r.writeShardMaps("over-replicated", overreplicatedVolumeIDs, volumes)
-		}
-	}
-
-	return nil
-}
-
-func (r *ecCheckReplicationRunner) writeShardMaps(kind string, volumeIDs []uint32, volumes map[uint32]*ecVolumeShardReplication) {
-	for _, vid := range volumeIDs {
-		h := volumes[vid]
-		r.write("Shards map for %s EC volume %v (%d/%d shards):\n", kind, vid, h.replicaCount(), h.totalShards())
-		for sid := 0; sid < h.totalShards(); sid++ {
-			shardTypeDesc := ""
-			if sid >= h.dataShards {
-				shardTypeDesc = " (parity)"
-			}
-			if addrs, ok := h.shardAddresses[erasure_coding.ShardId(sid)]; ok {
-				r.write("\t%02d%s => %v\n", sid, shardTypeDesc, addrs)
-			} else {
-				r.write("\t%02d%s is missing\n", sid, shardTypeDesc)
-			}
-		}
-		for _, sid := range h.unexpectedShardIds() {
-			r.write("\t%02d (unexpected) => %v\n", int(sid), h.shardAddresses[sid])
-		}
-	}
-}
diff --git a/weed/shell/command_ec_common.go b/weed/shell/command_ec_common.go
index fefaba3cbf..ea7a9fd9e2 100644
--- a/weed/shell/command_ec_common.go
+++ b/weed/shell/command_ec_common.go
@@ -2,136 +2,61 @@ package shell
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"regexp"
-	"slices"
-	"sort"
+	"strings"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding/ecbalancer"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
-	"github.com/seaweedfs/seaweedfs/weed/topology/balancer"
-	"google.golang.org/grpc"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 )
 
-type DataCenterId string
-type EcNodeId string
-type RackId string
-
-// EcDisk represents a single disk on a volume server
-type EcDisk struct {
-	diskId       uint32
-	diskType     string
-	freeEcSlots  int
-	ecShardCount int // Total EC shards on this disk
-	// Map of volumeId -> ShardsInfo for shards on this disk
-	ecShards map[needle.VolumeId]*erasure_coding.ShardsInfo
-}
-
-type EcNode struct {
-	info       *master_pb.DataNodeInfo
-	dc         DataCenterId
-	rack       RackId
-	freeEcSlot int
-	// disks maps diskId -> EcDisk for disk-level balancing
-	disks map[uint32]*EcDisk
-}
-
-type CandidateEcNode struct {
-	ecNode     *EcNode
-	shardCount int
-}
-
-type EcRack struct {
-	ecNodes    map[EcNodeId]*EcNode
-	freeEcSlot int
-}
+// The EC orchestration logic lives in weed/ec so the shell commands and the
+// maintenance workers share it. The aliases below keep the shell-internal
+// names working for the command files that still use them.
+type DataCenterId = ec.DataCenterId
+type RackId = ec.RackId
+type EcNode = ec.EcNode
 
 var (
-	ecBalanceAlgorithmDescription = `
-	func EcBalance() {
-		for each collection:
-			balanceEcVolumes(collectionName)
-		for each rack:
-			balanceEcRack(rack)
-	}
-
-	func balanceEcVolumes(collectionName){
-		for each volume:
-			doDeduplicateEcShards(volumeId)
-
-		tracks rack~shardCount mapping
-		for each volume:
-			doBalanceEcShardsAcrossRacks(volumeId)
-
-		for each volume:
-			doBalanceEcShardsWithinRacks(volumeId)
-	}
-
-	// spread ec shards into more racks
-	func doBalanceEcShardsAcrossRacks(volumeId){
-		tracks rack~volumeIdShardCount mapping
-		averageShardsPerEcRack = totalShardNumber / numRacks  // totalShardNumber is 14 for now, later could varies for each dc
-		ecShardsToMove = select overflown ec shards from racks with ec shard counts > averageShardsPerEcRack
-		for each ecShardsToMove {
-			destRack = pickOneRack(rack~shardCount, rack~volumeIdShardCount, ecShardReplicaPlacement)
-			destVolumeServers = volume servers on the destRack
-			pickOneEcNodeAndMoveOneShard(destVolumeServers)
-		}
-	}
-
-	func doBalanceEcShardsWithinRacks(volumeId){
-		racks = collect all racks that the volume id is on
-		for rack, shards := range racks
-			doBalanceEcShardsWithinOneRack(volumeId, shards, rack)
-	}
-
-	// move ec shards
-	func doBalanceEcShardsWithinOneRack(volumeId, shards, rackId){
-		tracks volumeServer~volumeIdShardCount mapping
-		averageShardCount = len(shards) / numVolumeServers
-		volumeServersOverAverage = volume servers with volumeId's ec shard counts > averageShardsPerEcRack
-		ecShardsToMove = select overflown ec shards from volumeServersOverAverage
-		for each ecShardsToMove {
-			destVolumeServer = pickOneVolumeServer(volumeServer~shardCount, volumeServer~volumeIdShardCount, ecShardReplicaPlacement)
-			pickOneEcNodeAndMoveOneShard(destVolumeServers)
-		}
-	}
-
-	// move ec shards while keeping shard distribution for the same volume unchanged or more even
-	func balanceEcRack(rack){
-		averageShardCount = total shards / numVolumeServers
-		for hasMovedOneEcShard {
-			sort all volume servers ordered by the number of local ec shards
-			pick the volume server A with the lowest number of ec shards x
-			pick the volume server B with the highest number of ec shards y
-			if y > averageShardCount and x +1 <= averageShardCount {
-				if B has a ec shard with volume id v that A does not have {
-					move one ec shard v from B to A
-					hasMovedOneEcShard = true
-				}
-			}
-		}
-	}
-	`
-	// Overridable functions for testing.
-	getDefaultReplicaPlacement = _getDefaultReplicaPlacement
+	ecBalanceAlgorithmDescription = ec.BalanceAlgorithmDescription
+	eachDataNode                  = ec.EachDataNode
+	collectEcVolumeServersByDc    = ec.CollectEcVolumeServersByDc
+	pickBestDiskOnNode            = ec.PickBestDiskOnNode
+	collectVolumeIdToCollection   = ec.CollectVolumeIdToCollection
+	parseVolumeIdsFlag            = ec.ParseVolumeIdsFlag
+	chunkVolumeIds                = ec.ChunkVolumeIds
 )
 
+// ecEnv adapts a CommandEnv to the cluster access hooks the ec package needs.
+func (ce *CommandEnv) ecEnv() *ec.Env {
+	return &ec.Env{
+		GrpcDialOption: ce.option.GrpcDialOption,
+		FetchTopology: func(delay time.Duration) (*master_pb.TopologyInfo, uint64, error) {
+			return collectTopologyInfo(ce, delay)
+		},
+		GetVolumeLocations: func(vid uint32) ([]wdclient.Location, bool) {
+			return ce.MasterClient.GetLocationsClone(vid)
+		},
+		IsLocked: ce.isLocked,
+	}
+}
+
+// Overridable functions for testing.
+var getDefaultReplicaPlacement = _getDefaultReplicaPlacement
+
 func _getDefaultReplicaPlacement(commandEnv *CommandEnv) (*super_block.ReplicaPlacement, error) {
 	var resp *master_pb.GetMasterConfigurationResponse
 	var err error
 
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		resp, err = client.GetMasterConfiguration(context.Background(), &master_pb.GetMasterConfigurationRequest{})
 		return err
 	})
@@ -170,8 +95,8 @@ func collectTopologyInfo(commandEnv *CommandEnv, delayBeforeCollecting time.Dura
 	}
 
 	var resp *master_pb.VolumeListResponse
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-		resp, err = client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
+		resp, err = pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		return err
 	})
 	if err != nil {
@@ -201,912 +126,54 @@ func collectDataNodes(commandEnv *CommandEnv, delayBeforeCollecting time.Duratio
 }
 
 func collectEcNodesForDC(commandEnv *CommandEnv, selectedDataCenter string, diskType types.DiskType) (ecNodes []*EcNode, totalFreeEcSlots int, err error) {
-	// list all possible locations
-	// collect topology information
-	topologyInfo, _, err := collectTopologyInfo(commandEnv, 0)
-	if err != nil {
-		return
-	}
-
-	// find out all volume servers with one slot left.
-	ecNodes, totalFreeEcSlots = collectEcVolumeServersByDc(topologyInfo, selectedDataCenter, diskType)
-
-	sortEcNodesByFreeslotsDescending(ecNodes)
-
-	return
+	return ec.CollectEcNodesForDC(commandEnv.ecEnv(), selectedDataCenter, diskType)
 }
 
 func collectEcNodes(commandEnv *CommandEnv, diskType types.DiskType) (ecNodes []*EcNode, totalFreeEcSlots int, err error) {
-	return collectEcNodesForDC(commandEnv, "", diskType)
-}
-
-// assertEncodableRegularVolumes rejects volume ids that are not encodable
-// regular volumes in the topology snapshot: an already-EC volume (present only
-// as EC shards, with no .dat) or an id absent from the cluster. Encoding an
-// already-EC volume would clear its shards before failing, destroying the only
-// copy. A volume present as BOTH a regular .dat and stale orphan shards (a
-// failed-encode retry) passes, so the retry + orphan sweep still works.
-func assertEncodableRegularVolumes(t *master_pb.TopologyInfo, vids []needle.VolumeId) error {
-	want := make(map[needle.VolumeId]bool, len(vids))
-	for _, vid := range vids {
-		want[vid] = true
-	}
-	regular := make(map[needle.VolumeId]bool)
-	hasEcShards := make(map[needle.VolumeId]bool)
-	for _, dc := range t.DataCenterInfos {
-		for _, r := range dc.RackInfos {
-			for _, dn := range r.DataNodeInfos {
-				for _, diskInfo := range dn.DiskInfos {
-					if diskInfo == nil {
-						continue
-					}
-					for _, vi := range diskInfo.VolumeInfos {
-						if want[needle.VolumeId(vi.Id)] {
-							regular[needle.VolumeId(vi.Id)] = true
-						}
-					}
-					for _, ec := range diskInfo.EcShardInfos {
-						if want[needle.VolumeId(ec.Id)] {
-							hasEcShards[needle.VolumeId(ec.Id)] = true
-						}
-					}
-				}
-			}
-		}
-	}
-	for _, vid := range vids {
-		if regular[vid] {
-			continue
-		}
-		if hasEcShards[vid] {
-			return fmt.Errorf("volume %d is already EC-encoded (no .dat replica); refusing to re-encode, which would destroy its shards", vid)
-		}
-		return fmt.Errorf("volume %d not found as a regular volume in the cluster; refusing to encode", vid)
-	}
-	return nil
-}
-
-// collectVolumeIdToCollection returns a map from volume ID to its collection name
-func collectVolumeIdToCollection(t *master_pb.TopologyInfo, vids []needle.VolumeId) map[needle.VolumeId]string {
-	result := make(map[needle.VolumeId]string)
-	if len(vids) == 0 {
-		return result
-	}
-
-	vidSet := make(map[needle.VolumeId]bool)
-	for _, vid := range vids {
-		vidSet[vid] = true
-	}
-
-	for _, dc := range t.DataCenterInfos {
-		for _, r := range dc.RackInfos {
-			for _, dn := range r.DataNodeInfos {
-				for _, diskInfo := range dn.DiskInfos {
-					for _, vi := range diskInfo.VolumeInfos {
-						vid := needle.VolumeId(vi.Id)
-						if vidSet[vid] {
-							result[vid] = vi.Collection
-						}
-					}
-				}
-			}
-		}
-	}
-	return result
-}
-
-func collectCollectionsForVolumeIds(t *master_pb.TopologyInfo, vids []needle.VolumeId) []string {
-	if len(vids) == 0 {
-		return nil
-	}
-
-	found := map[string]bool{}
-	for _, dc := range t.DataCenterInfos {
-		for _, r := range dc.RackInfos {
-			for _, dn := range r.DataNodeInfos {
-				for _, diskInfo := range dn.DiskInfos {
-					for _, vi := range diskInfo.VolumeInfos {
-						for _, vid := range vids {
-							if needle.VolumeId(vi.Id) == vid {
-								found[vi.Collection] = true
-							}
-						}
-					}
-					for _, ecs := range diskInfo.EcShardInfos {
-						for _, vid := range vids {
-							if needle.VolumeId(ecs.Id) == vid {
-								found[ecs.Collection] = true
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-	if len(found) == 0 {
-		return nil
-	}
-
-	collections := []string{}
-	for k, _ := range found {
-		collections = append(collections, k)
-	}
-	sort.Strings(collections)
-	return collections
+	return ec.CollectEcNodes(commandEnv.ecEnv(), diskType)
 }
 
 func moveMountedShardToEcNode(commandEnv *CommandEnv, existingLocation *EcNode, collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, destinationEcNode *EcNode, destDiskId uint32, applyBalancing bool, diskType types.DiskType) (err error) {
-
-	if !commandEnv.isLocked() {
-		return fmt.Errorf("lock is lost")
-	}
-
-	copiedShardIds := []erasure_coding.ShardId{shardId}
-
-	if applyBalancing {
-
-		existingServerAddress := pb.NewServerAddressFromDataNode(existingLocation.info)
-
-		// ask destination node to copy shard and the ecx file from source node, and mount it
-		copiedShardIds, err = oneServerCopyAndMountEcShardsFromSource(commandEnv.option.GrpcDialOption, destinationEcNode, []erasure_coding.ShardId{shardId}, vid, collection, existingServerAddress, destDiskId)
-		if err != nil {
-			return err
-		}
-
-		// unmount the to be deleted shards
-		err = unmountEcShards(commandEnv.option.GrpcDialOption, vid, existingServerAddress, copiedShardIds)
-		if err != nil {
-			return err
-		}
-
-		// ask source node to delete the shard, and maybe the ecx file
-		err = sourceServerDeleteEcShards(commandEnv.option.GrpcDialOption, collection, vid, existingServerAddress, copiedShardIds)
-		if err != nil {
-			return err
-		}
-
-		if destDiskId > 0 {
-			fmt.Printf("moved ec shard %d.%d %s => %s (disk %d)\n", vid, shardId, existingLocation.info.Id, destinationEcNode.info.Id, destDiskId)
-		} else {
-			fmt.Printf("moved ec shard %d.%d %s => %s\n", vid, shardId, existingLocation.info.Id, destinationEcNode.info.Id)
-		}
-
-	}
-
-	destinationEcNode.addEcVolumeShards(vid, collection, copiedShardIds, diskType)
-	existingLocation.deleteEcVolumeShards(vid, copiedShardIds, diskType)
-
-	return nil
-
+	return ec.MoveMountedShardToEcNode(commandEnv.ecEnv(), existingLocation, collection, vid, shardId, destinationEcNode, destDiskId, applyBalancing, diskType)
 }
 
-func oneServerCopyAndMountEcShardsFromSource(grpcDialOption grpc.DialOption,
-	targetServer *EcNode, shardIdsToCopy []erasure_coding.ShardId,
-	volumeId needle.VolumeId, collection string, existingLocation pb.ServerAddress, destDiskId uint32) (copiedShardIds []erasure_coding.ShardId, err error) {
+// EcBalance balances EC shards across the cluster; see ec.EcBalance for the
+// excludeNodes and volumeIds semantics.
+func EcBalance(commandEnv *CommandEnv, collections []string, dc string, ecReplicaPlacement *super_block.ReplicaPlacement, diskType types.DiskType, maxParallelization int, ioBytePerSecond int64, applyBalancing bool, excludeNodes map[pb.ServerAddress]struct{}, volumeIds []needle.VolumeId) (err error) {
+	return ec.EcBalance(commandEnv.ecEnv(), collections, dc, ecReplicaPlacement, diskType, maxParallelization, ioBytePerSecond, applyBalancing, excludeNodes, volumeIds, nil)
+}
 
-	fmt.Printf("allocate %d.%v %s => %s\n", volumeId, shardIdsToCopy, existingLocation, targetServer.info.Id)
-
-	targetAddress := pb.NewServerAddressFromDataNode(targetServer.info)
-	err = operation.WithVolumeServerClient(false, targetAddress, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-
-		if targetAddress != existingLocation {
-			fmt.Printf("copy %d.%v %s => %s\n", volumeId, shardIdsToCopy, existingLocation, targetServer.info.Id)
-			_, copyErr := volumeServerClient.VolumeEcShardsCopy(context.Background(), &volume_server_pb.VolumeEcShardsCopyRequest{
-				VolumeId:       uint32(volumeId),
-				Collection:     collection,
-				ShardIds:       erasure_coding.ShardIdsToUint32(shardIdsToCopy),
-				CopyEcxFile:    true,
-				CopyEcjFile:    true,
-				CopyVifFile:    true,
-				CopyEcsumFile:  true, // propagate the bitrot sidecar with the shards (no-op if the source has none)
-				SourceDataNode: string(existingLocation),
-				DiskId:         destDiskId,
-			})
-			if copyErr != nil {
-				return fmt.Errorf("copy %d.%v %s => %s : %v\n", volumeId, shardIdsToCopy, existingLocation, targetServer.info.Id, copyErr)
-			}
-		}
-
-		fmt.Printf("mount %d.%v on %s\n", volumeId, shardIdsToCopy, targetServer.info.Id)
-		_, mountErr := volumeServerClient.VolumeEcShardsMount(context.Background(), &volume_server_pb.VolumeEcShardsMountRequest{
-			VolumeId:   uint32(volumeId),
-			Collection: collection,
-			ShardIds:   erasure_coding.ShardIdsToUint32(shardIdsToCopy),
-		})
-		if mountErr != nil {
-			return fmt.Errorf("mount %d.%v on %s : %v\n", volumeId, shardIdsToCopy, targetServer.info.Id, mountErr)
-		}
-
-		if targetAddress != existingLocation {
-			copiedShardIds = shardIdsToCopy
-			glog.V(0).Infof("%s ec volume %d deletes shards %+v", existingLocation, volumeId, copiedShardIds)
-		}
-
-		return nil
-	})
+// compileCollectionPattern compiles the -collection value shared by commands
+// where an empty value means the collection with no name: a comma-separated
+// list of collection names, wildcards, and regex patterns, or CollectionDefault
+// for the empty-named collection.
+func compileCollectionPattern(pattern string) (*wildcard.CollectionMatcher, error) {
+	if strings.TrimSpace(pattern) == "" {
+		pattern = CollectionDefault
+	}
+	return wildcard.CompileCollectionMatcher(pattern)
+}
 
+// resolveEcCollections expands the ec commands' -collection value into
+// collection names. An empty value means the empty-named collection, the same
+// as CollectionDefault. Literal names pass through even when the master does
+// not list them — the listing only contains collections with registered
+// volumes, and ec.rebuild exists to bring back a collection whose volumes all
+// lost their index. Wildcard and regex entries resolve against the listing.
+func resolveEcCollections(commandEnv *CommandEnv, filter string) (collections []string, err error) {
+	if strings.TrimSpace(filter) == "" {
+		filter = CollectionDefault
+	}
+	names, err := ListCollectionNames(commandEnv, false, true)
 	if err != nil {
-		return
+		return nil, err
 	}
-
-	return
-}
-
-func eachDataNode(topo *master_pb.TopologyInfo, fn func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo)) {
-	for _, dc := range topo.DataCenterInfos {
-		for _, rack := range dc.RackInfos {
-			for _, dn := range rack.DataNodeInfos {
-				fn(DataCenterId(dc.Id), RackId(rack.Id), dn)
-			}
-		}
-	}
-}
-
-func sortEcNodesByFreeslotsDescending(ecNodes []*EcNode) {
-	slices.SortFunc(ecNodes, func(a, b *EcNode) int {
-		return b.freeEcSlot - a.freeEcSlot
-	})
-}
-
-func sortEcNodesByFreeslotsAscending(ecNodes []*EcNode) {
-	slices.SortFunc(ecNodes, func(a, b *EcNode) int {
-		return a.freeEcSlot - b.freeEcSlot
-	})
-}
-
-func countShards(ecShardInfos []*master_pb.VolumeEcShardInformationMessage) (count int) {
-	for _, eci := range ecShardInfos {
-		count += erasure_coding.GetShardCount(eci)
-	}
-	return
-}
-
-func countFreeShardSlots(dn *master_pb.DataNodeInfo, diskType types.DiskType) (count int) {
-	if dn.DiskInfos == nil {
-		return 0
-	}
-	diskInfo := dn.DiskInfos[string(diskType)]
-	if diskInfo == nil {
-		return 0
-	}
-
-	// A physically near-full disk has no room for more EC shards regardless of
-	// slot math (an over-set maxVolumeCount hides real fullness; statfs free bytes
-	// already include EC shard files). No-opinion when the server reports no bytes.
-	if balancer.DiskTooFullAfter(diskInfo.DiskTotalBytes, diskInfo.DiskFreeBytes, 0, balancer.DefaultMaxDiskUsagePercent) {
-		return 0
-	}
-
-	slots := int(diskInfo.MaxVolumeCount-diskInfo.VolumeCount)*erasure_coding.DataShardsCount - countShards(diskInfo.EcShardInfos)
-	if slots < 0 {
-		return 0
-	}
-
-	return slots
-}
-
-func (ecNode *EcNode) localShardIdCount(vid uint32) int {
-	for _, diskInfo := range ecNode.info.DiskInfos {
-		for _, eci := range diskInfo.EcShardInfos {
-			if vid == eci.Id {
-				return erasure_coding.GetShardCount(eci)
-			}
-		}
-	}
-	return 0
-}
-
-func collectEcVolumeServersByDc(topo *master_pb.TopologyInfo, selectedDataCenter string, diskType types.DiskType) (ecNodes []*EcNode, totalFreeEcSlots int) {
-	eachDataNode(topo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		if selectedDataCenter != "" && selectedDataCenter != string(dc) {
-			return
-		}
-
-		freeEcSlots := countFreeShardSlots(dn, diskType)
-		ecNode := &EcNode{
-			info:       dn,
-			dc:         dc,
-			rack:       rack,
-			freeEcSlot: int(freeEcSlots),
-			disks:      make(map[uint32]*EcDisk),
-		}
-
-		// Build disk-level information from volumes and EC shards
-		// First, discover all unique disk IDs from VolumeInfos (includes empty disks)
-		allDiskIds := make(map[uint32]string) // diskId -> diskType
-		for diskTypeKey, diskInfo := range dn.DiskInfos {
-			if diskInfo == nil {
-				continue
-			}
-			// Get all disk IDs from volumes
-			for _, vi := range diskInfo.VolumeInfos {
-				allDiskIds[vi.DiskId] = diskTypeKey
-			}
-			// Also get disk IDs from EC shards
-			for _, ecShardInfo := range diskInfo.EcShardInfos {
-				allDiskIds[ecShardInfo.DiskId] = diskTypeKey
-			}
-		}
-
-		// Group EC shards by disk_id
-		diskShards := make(map[uint32]map[needle.VolumeId]*erasure_coding.ShardsInfo)
-		for _, diskInfo := range dn.DiskInfos {
-			if diskInfo == nil {
-				continue
-			}
-			for _, eci := range diskInfo.EcShardInfos {
-				diskId := eci.DiskId
-				if diskShards[diskId] == nil {
-					diskShards[diskId] = make(map[needle.VolumeId]*erasure_coding.ShardsInfo)
-				}
-				vid := needle.VolumeId(eci.Id)
-				diskShards[diskId][vid] = erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
-			}
-		}
-
-		// Create EcDisk for each discovered disk
-		diskCount := len(allDiskIds)
-		if diskCount == 0 {
-			diskCount = 1
-		}
-		freePerDisk := int(freeEcSlots) / diskCount
-
-		for diskId, diskTypeStr := range allDiskIds {
-			shards := diskShards[diskId]
-			if shards == nil {
-				shards = make(map[needle.VolumeId]*erasure_coding.ShardsInfo)
-			}
-			totalShardCount := 0
-			for _, shardsInfo := range shards {
-				totalShardCount += shardsInfo.Count()
-			}
-
-			ecNode.disks[diskId] = &EcDisk{
-				diskId:       diskId,
-				diskType:     diskTypeStr,
-				freeEcSlots:  freePerDisk,
-				ecShardCount: totalShardCount,
-				ecShards:     shards,
-			}
-		}
-
-		ecNodes = append(ecNodes, ecNode)
-		totalFreeEcSlots += freeEcSlots
-	})
-	return
-}
-
-func sourceServerDeleteEcShards(grpcDialOption grpc.DialOption, collection string, volumeId needle.VolumeId, sourceLocation pb.ServerAddress, toBeDeletedShardIds []erasure_coding.ShardId) error {
-
-	fmt.Printf("delete %d.%v from %s\n", volumeId, toBeDeletedShardIds, sourceLocation)
-
-	return operation.WithVolumeServerClient(false, sourceLocation, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, deleteErr := volumeServerClient.VolumeEcShardsDelete(context.Background(), &volume_server_pb.VolumeEcShardsDeleteRequest{
-			VolumeId:   uint32(volumeId),
-			Collection: collection,
-			ShardIds:   erasure_coding.ShardIdsToUint32(toBeDeletedShardIds),
-		})
-		return deleteErr
-	})
-
-}
-
-// errFullTeardownNotAcked marks a reachable server that completed the delete RPC
-// but did not report full_teardown_done (a pre-upgrade volume server). The orphan
-// sweep must treat this as fatal: the node may still hold an orphan that a later
-// copy would re-stamp into the new generation.
-var errFullTeardownNotAcked = errors.New("delete did not perform full teardown (pre-upgrade volume server?); a stale EC generation may remain")
-
-// pingVolumeServer probes node liveness with an empty-target Ping, which is never
-// maintenance-gated, and returns the raw Ping error (nil on success). It lets the
-// orphan sweep disambiguate a delete codes.Unavailable: a Rust volume server in
-// maintenance mode fails the maintenance-gated delete with Unavailable yet answers
-// Ping, whereas a genuinely-down node fails Ping with a transport Unavailable too.
-// A Go server returns Unknown for maintenance, which isNodeUnreachable already
-// treats as fatal. The caller classifies the result with classifyNodeLiveness:
-// only a Ping that itself transport-failed (codes.Unavailable) confirms the node
-// is down; a nil error (reachable) or any other Ping error (inconclusive — e.g. a
-// pre-Ping server returning Unimplemented, which means the node is up) is fatal.
-func pingVolumeServer(grpcDialOption grpc.DialOption, location pb.ServerAddress) error {
-	return operation.WithVolumeServerClient(false, location, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
-		_, pingErr := client.Ping(context.Background(), &volume_server_pb.PingRequest{})
-		return pingErr
-	})
-}
-
-// unmountAndDeleteEcShardsQuiet unmounts then deletes shards on one server in a
-// single connection, without the per-call logging the interactive helpers emit.
-// Used by the orphan sweep, which fans out to every node x volume and would
-// otherwise flood the shell with no-op lines.
-func unmountAndDeleteEcShardsQuiet(grpcDialOption grpc.DialOption, collection string, volumeId needle.VolumeId, location pb.ServerAddress, shardIds []erasure_coding.ShardId) error {
-	ids := erasure_coding.ShardIdsToUint32(shardIds)
-	return operation.WithVolumeServerClient(false, location, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		if _, err := volumeServerClient.VolumeEcShardsUnmount(context.Background(), &volume_server_pb.VolumeEcShardsUnmountRequest{
-			VolumeId: uint32(volumeId),
-			ShardIds: ids,
-		}); err != nil {
-			return fmt.Errorf("unmount: %w", err)
-		}
-		resp, err := volumeServerClient.VolumeEcShardsDelete(context.Background(), &volume_server_pb.VolumeEcShardsDeleteRequest{
-			VolumeId:     uint32(volumeId),
-			Collection:   collection,
-			ShardIds:     ids,
-			FullTeardown: true,
-		})
-		if err != nil {
-			return fmt.Errorf("delete: %w", err)
-		}
-		if !resp.GetFullTeardownDone() {
-			return fmt.Errorf("delete on %s: %w", location, errFullTeardownNotAcked)
-		}
-		return nil
-	})
-}
-
-func unmountEcShards(grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceLocation pb.ServerAddress, toBeUnmountedShardIds []erasure_coding.ShardId) error {
-
-	fmt.Printf("unmount %d.%v from %s\n", volumeId, toBeUnmountedShardIds, sourceLocation)
-
-	return operation.WithVolumeServerClient(false, sourceLocation, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, deleteErr := volumeServerClient.VolumeEcShardsUnmount(context.Background(), &volume_server_pb.VolumeEcShardsUnmountRequest{
-			VolumeId: uint32(volumeId),
-			ShardIds: erasure_coding.ShardIdsToUint32(toBeUnmountedShardIds),
-		})
-		return deleteErr
-	})
-}
-
-func mountEcShards(grpcDialOption grpc.DialOption, collection string, volumeId needle.VolumeId, sourceLocation pb.ServerAddress, toBeMountedShardIds []erasure_coding.ShardId) error {
-
-	fmt.Printf("mount %d.%v on %s\n", volumeId, toBeMountedShardIds, sourceLocation)
-
-	return operation.WithVolumeServerClient(false, sourceLocation, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, mountErr := volumeServerClient.VolumeEcShardsMount(context.Background(), &volume_server_pb.VolumeEcShardsMountRequest{
-			VolumeId:   uint32(volumeId),
-			Collection: collection,
-			ShardIds:   erasure_coding.ShardIdsToUint32(toBeMountedShardIds),
-		})
-		return mountErr
-	})
-}
-
-func ceilDivide(a, b int) int {
-	var r int
-	if (a % b) != 0 {
-		r = 1
-	}
-	return (a / b) + r
-}
-
-func findEcVolumeShardsInfo(ecNode *EcNode, vid needle.VolumeId, diskType types.DiskType) *erasure_coding.ShardsInfo {
-	if diskInfo, found := ecNode.info.DiskInfos[string(diskType)]; found {
-		for _, shardInfo := range diskInfo.EcShardInfos {
-			if needle.VolumeId(shardInfo.Id) == vid {
-				return erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(shardInfo)
-			}
-		}
-	}
-
-	// Returns an empty ShardsInfo struct on failure, to avoid potential nil dereferences.
-	return erasure_coding.NewShardsInfo()
-}
-
-// TODO: simplify me
-func (ecNode *EcNode) addEcVolumeShards(vid needle.VolumeId, collection string, shardIds []erasure_coding.ShardId, diskType types.DiskType) *EcNode {
-
-	foundVolume := false
-	diskInfo, found := ecNode.info.DiskInfos[string(diskType)]
-	if found {
-		for _, ecsi := range diskInfo.EcShardInfos {
-			if needle.VolumeId(ecsi.Id) == vid {
-				si := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecsi)
-				oldShardCount := si.Count()
-				for _, shardId := range shardIds {
-					si.Set(erasure_coding.NewShardInfo(shardId, 0))
-				}
-				ecsi.EcIndexBits = si.Bitmap()
-				ecsi.ShardSizes = si.SizesInt64()
-				ecNode.freeEcSlot -= si.Count() - oldShardCount
-				foundVolume = true
-				break
-			}
-		}
-	} else {
-		diskInfo = &master_pb.DiskInfo{
-			Type: string(diskType),
-		}
-		ecNode.info.DiskInfos[string(diskType)] = diskInfo
-	}
-
-	if !foundVolume {
-		si := erasure_coding.NewShardsInfo()
-		for _, id := range shardIds {
-			si.Set(erasure_coding.NewShardInfo(id, 0))
-		}
-		diskInfo.EcShardInfos = append(diskInfo.EcShardInfos, &master_pb.VolumeEcShardInformationMessage{
-			Id:          uint32(vid),
-			Collection:  collection,
-			EcIndexBits: si.Bitmap(),
-			ShardSizes:  si.SizesInt64(),
-			DiskType:    string(diskType),
-		})
-		ecNode.freeEcSlot -= si.Count()
-	}
-
-	return ecNode
-}
-
-func (ecNode *EcNode) deleteEcVolumeShards(vid needle.VolumeId, shardIds []erasure_coding.ShardId, diskType types.DiskType) *EcNode {
-
-	if diskInfo, found := ecNode.info.DiskInfos[string(diskType)]; found {
-		for _, eci := range diskInfo.EcShardInfos {
-			if needle.VolumeId(eci.Id) == vid {
-				si := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
-				oldCount := si.Count()
-				for _, shardId := range shardIds {
-					si.Delete(shardId)
-				}
-				eci.EcIndexBits = si.Bitmap()
-				eci.ShardSizes = si.SizesInt64()
-				ecNode.freeEcSlot -= si.Count() - oldCount
-			}
-		}
-	}
-
-	return ecNode
-}
-
-// pickBestDiskOnNode selects the best disk on a node for placing a new EC shard
-// It prefers disks of the specified type with fewer shards and more free slots
-// When shardId is provided and dataShardCount > 0, it applies anti-affinity:
-// - For data shards (shardId < dataShardCount): prefer disks without parity shards
-// - For parity shards (shardId >= dataShardCount): prefer disks without data shards
-// If strictDiskType is false, it will fall back to other disk types if no matching disk is found
-func pickBestDiskOnNode(ecNode *EcNode, vid needle.VolumeId, diskType types.DiskType, strictDiskType bool, shardId erasure_coding.ShardId, dataShardCount int) uint32 {
-	if len(ecNode.disks) == 0 {
-		return 0 // No disk info available, let the server decide
-	}
-
-	var bestDiskId uint32
-	bestScore := -1
-	var fallbackDiskId uint32
-	fallbackScore := -1
-
-	// Determine if we're placing a data or parity shard
-	isDataShard := dataShardCount > 0 && int(shardId) < dataShardCount
-
-	for diskId, disk := range ecNode.disks {
-		if disk.freeEcSlots <= 0 {
-			continue
-		}
-
-		// Check existing shards on this disk for this volume
-		existingShards := 0
-		hasDataShards := false
-		hasParityShards := false
-		if si, ok := disk.ecShards[vid]; ok {
-			existingShards = si.Count()
-			// Check what type of shards are on this disk
-			if dataShardCount > 0 {
-				for _, existingShardId := range si.Ids() {
-					if int(existingShardId) < dataShardCount {
-						hasDataShards = true
-					} else {
-						hasParityShards = true
-					}
-				}
-			}
-		}
-
-		// Score: prefer disks with fewer total shards and fewer shards of this volume
-		// Lower score is better
-		score := disk.ecShardCount*10 + existingShards*100
-
-		// Apply anti-affinity penalty if applicable
-		if dataShardCount > 0 {
-			if isDataShard && hasParityShards {
-				// Penalize placing data shard on disk with parity shards
-				score += 1000
-			} else if !isDataShard && hasDataShards {
-				// Penalize placing parity shard on disk with data shards
-				score += 1000
-			}
-		}
-
-		if disk.diskType == string(diskType) {
-			// Matching disk type - this is preferred
-			if bestScore == -1 || score < bestScore {
-				bestScore = score
-				bestDiskId = diskId
-			}
-		} else if !strictDiskType {
-			// Non-matching disk type - use as fallback if allowed
-			if fallbackScore == -1 || score < fallbackScore {
-				fallbackScore = score
-				fallbackDiskId = diskId
-			}
-		}
-	}
-
-	// Return matching disk type if found, otherwise fallback. Gate on bestScore,
-	// not bestDiskId: physical disk 0 is a valid target and 0 is also the "no
-	// match" zero value, so testing bestDiskId would never select disk 0.
-	if bestScore != -1 {
-		return bestDiskId
-	}
-	return fallbackDiskId
-}
-
-// ecBalancer drives an EC balance run: it collects the cluster's EC nodes, hands
-// them to the shared ecbalancer planner, and executes the planned shard moves.
-// The balancing policy lives in weed/storage/erasure_coding/ecbalancer, shared
-// with the EC balance worker so the two cannot drift.
-type ecBalancer struct {
-	commandEnv         *CommandEnv
-	ecNodes            []*EcNode
-	replicaPlacement   *super_block.ReplicaPlacement
-	applyBalancing     bool
-	maxParallelization int
-	diskType           types.DiskType
-}
-
-// excludeNodes is a set of server addresses kept out of the balance as copy/move
-// targets and sources. ec.encode passes the nodes its orphan sweep could not
-// reach: such a node may still hold a stale-generation shard orphan, and pairing
-// it with a new-generation shard from a balance copy would mix generations on one
-// node. The standalone ec.balance command passes nil.
-func EcBalance(commandEnv *CommandEnv, collections []string, dc string, ecReplicaPlacement *super_block.ReplicaPlacement, diskType types.DiskType, maxParallelization int, applyBalancing bool, excludeNodes map[pb.ServerAddress]struct{}) (err error) {
-	// collect all ec nodes
-	allEcNodes, totalFreeEcSlots, err := collectEcNodesForDC(commandEnv, dc, diskType)
+	collections, err = wildcard.ExpandCollectionFilter(filter, names)
 	if err != nil {
-		return err
+		return nil, fmt.Errorf("invalid collection pattern %q: %w", filter, err)
 	}
-
-	// Drop excluded nodes (and the slots they contribute) before planning so they
-	// can be neither a target nor a source for any move this balance plans.
-	if len(excludeNodes) > 0 {
-		kept := allEcNodes[:0]
-		var excludedFreeSlots int
-		for _, en := range allEcNodes {
-			if _, skip := excludeNodes[pb.NewServerAddressFromDataNode(en.info)]; skip {
-				excludedFreeSlots += en.freeEcSlot
-				glog.V(0).Infof("EC balance excluding node %s: skipped as unreachable by the encode orphan sweep", en.info.Id)
-				continue
-			}
-			kept = append(kept, en)
-		}
-		allEcNodes = kept
-		totalFreeEcSlots -= excludedFreeSlots
-	}
-
-	if totalFreeEcSlots < 1 {
-		return fmt.Errorf("no free ec shard slots. only %d left", totalFreeEcSlots)
-	}
-
-	ecb := &ecBalancer{
-		commandEnv:         commandEnv,
-		ecNodes:            allEcNodes,
-		replicaPlacement:   ecReplicaPlacement,
-		applyBalancing:     applyBalancing,
-		maxParallelization: maxParallelization,
-		diskType:           diskType,
-	}
-
 	if len(collections) == 0 {
-		glog.V(1).Infof("WARNING: No collections to balance EC volumes across.\n")
+		return nil, fmt.Errorf("no collections match %q", filter)
 	}
-	return ecb.balance(collections)
-}
-
-// shellECRatio resolves a collection's EC data/parity counts, defaulting to the
-// standard scheme. This is the shell's plug-in point for custom ratios.
-func shellECRatio(_ string) (int, int) {
-	// Custom EC ratios are an enterprise feature; OSS uses the standard scheme.
-	return erasure_coding.DataShardsCount, erasure_coding.ParityShardsCount
-}
-
-// balance plans EC shard moves with the shared planner and executes them. When
-// collections is empty all collections present are balanced.
-func (ecb *ecBalancer) balance(collections []string) error {
-	topo, volumeRatio := toBalancerTopology(ecb.ecNodes, collections, ecb.diskType)
-	moves := ecbalancer.Plan(topo, ecbalancer.Options{
-		DiskType:           string(ecb.diskType),
-		ImbalanceThreshold: 0, // the shell balances to an even distribution
-		ReplicaPlacement:   ecb.replicaPlacement,
-		Ratio:              shellECRatio,
-		// Prefer each volume's own heartbeat-reported ratio over the collection
-		// default so a mixed-ratio collection is spread per volume; 0 defers to
-		// shellECRatio (and is the always-0 OSS case).
-		VolumeRatio: volumeRatio,
-		// Balance the global phase by fractional fullness so heterogeneous-capacity
-		// nodes fill proportionally (matching the worker). This is identical to raw
-		// shard count when capacities are uniform.
-		GlobalUtilizationBased: true,
-	})
-	return ecb.executeMoves(moves)
-}
-
-// toBalancerTopology builds an ecbalancer.Topology from the shell's EcNode model,
-// including the shards of the requested collections (all collections when empty).
-// It also returns a per-volume ratio lookup built from each shard's heartbeat
-// (0,0 when unreported, e.g. always in OSS), which Plan prefers over the
-// collection ratio for mixed-ratio clusters.
-func toBalancerTopology(ecNodes []*EcNode, collections []string, diskType types.DiskType) (*ecbalancer.Topology, func(collection string, vid uint32) (int, int)) {
-	allowed := make(map[string]bool, len(collections))
-	for _, c := range collections {
-		allowed[c] = true
-	}
-
-	type volRatioKey struct {
-		collection string
-		vid        uint32
-	}
-	volRatios := make(map[volRatioKey][2]int)
-
-	topo := ecbalancer.NewTopology()
-	for _, en := range ecNodes {
-		rackKey := string(en.dc) + ":" + string(en.rack)
-		node := topo.AddNode(en.info.Id, string(en.dc), rackKey, en.freeEcSlot)
-		// Group by physical machine (host) so shards spread across machines, not just
-		// nodes; the id stays the node identity used for moves.
-		node.SetHost(pb.NewServerAddressFromDataNode(en.info).ToHost())
-		for diskId, d := range en.disks {
-			node.AddDisk(diskId, d.diskType, d.freeEcSlots, d.ecShardCount)
-		}
-		diskInfo, found := en.info.DiskInfos[string(diskType)]
-		if !found {
-			continue
-		}
-		for _, eci := range diskInfo.EcShardInfos {
-			if len(allowed) > 0 && !allowed[eci.Collection] {
-				continue
-			}
-			node.AddShards(eci.Id, eci.Collection, eci.DiskId, erasure_coding.ShardBits(eci.EcIndexBits))
-			if d, p := ecbalancer.VolumeShardRatio(eci); d > 0 || p > 0 {
-				volRatios[volRatioKey{eci.Collection, eci.Id}] = [2]int{d, p}
-			}
-		}
-	}
-
-	volumeRatio := func(collection string, vid uint32) (int, int) {
-		r := volRatios[volRatioKey{collection, vid}]
-		return r[0], r[1]
-	}
-	return topo, volumeRatio
-}
-
-// executeMoves carries out the planned moves. Phases run in order (a within-rack
-// move can depend on a cross-rack move's result), and the independent moves
-// within a phase run with up to maxParallelization concurrency. Apply mode does
-// only the RPCs; dry-run mode runs sequentially and mutates the in-memory EcNode
-// model so callers/tests can inspect the planned end state.
-func (ecb *ecBalancer) executeMoves(moves []ecbalancer.Move) error {
-	byID := make(map[string]*EcNode, len(ecb.ecNodes))
-	for _, en := range ecb.ecNodes {
-		byID[en.info.Id] = en
-	}
-
-	// Plan emits moves grouped by phase; run each contiguous same-phase group
-	// together, waiting before the next so cross-phase dependencies hold.
-	for i := 0; i < len(moves); {
-		j := i
-		for j < len(moves) && moves[j].Phase == moves[i].Phase {
-			j++
-		}
-		if err := ecb.executePhase(byID, moves[i:j]); err != nil {
-			return err
-		}
-		i = j
-	}
-	return nil
-}
-
-func (ecb *ecBalancer) executePhase(byID map[string]*EcNode, moves []ecbalancer.Move) error {
-	if !ecb.applyBalancing {
-		// Dry-run: sequential so the in-memory model updates are race-free and
-		// reflect the full plan for inspection.
-		for _, m := range moves {
-			if err := ecb.executeMove(byID, m); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-	// Apply mode: parallelize across volumes, but run one volume's moves within a
-	// phase sequentially. Concurrent moves of the same volume to a node can race
-	// on its shared .ecx/.ecj/.vif sidecar files.
-	var order []uint32
-	byVol := make(map[uint32][]ecbalancer.Move)
-	for _, m := range moves {
-		if _, ok := byVol[m.VolumeID]; !ok {
-			order = append(order, m.VolumeID)
-		}
-		byVol[m.VolumeID] = append(byVol[m.VolumeID], m)
-	}
-	ewg := NewErrorWaitGroup(ecb.maxParallelization)
-	for _, vid := range order {
-		group := byVol[vid]
-		ewg.Add(func() error {
-			for _, m := range group {
-				if err := ecb.executeMove(byID, m); err != nil {
-					return err
-				}
-			}
-			return nil
-		})
-	}
-	return ewg.Wait()
-}
-
-func (ecb *ecBalancer) executeMove(byID map[string]*EcNode, m ecbalancer.Move) error {
-	src := byID[m.SourceNode]
-	if src == nil {
-		return nil
-	}
-	vid := needle.VolumeId(m.VolumeID)
-	shardId := erasure_coding.ShardId(m.ShardID)
-	shardIds := []erasure_coding.ShardId{shardId}
-
-	if m.Phase == "dedup" {
-		fmt.Printf("dedup: delete ec shard %d.%d on %s\n", vid, shardId, m.SourceNode)
-		if !ecb.applyBalancing {
-			src.deleteEcVolumeShards(vid, shardIds, ecb.diskType)
-			return nil
-		}
-		grpcDialOption := ecb.commandEnv.option.GrpcDialOption
-		addr := pb.NewServerAddressFromDataNode(src.info)
-		if err := unmountEcShards(grpcDialOption, vid, addr, shardIds); err != nil {
-			return err
-		}
-		return sourceServerDeleteEcShards(grpcDialOption, m.Collection, vid, addr, shardIds)
-	}
-
-	dst := byID[m.TargetNode]
-	if dst == nil {
-		return nil
-	}
-	if m.TargetDisk > 0 {
-		fmt.Printf("%s moves ec shard %d.%d to %s (disk %d)\n", m.SourceNode, vid, shardId, m.TargetNode, m.TargetDisk)
-	} else {
-		fmt.Printf("%s moves ec shard %d.%d to %s\n", m.SourceNode, vid, shardId, m.TargetNode)
-	}
-	if !ecb.applyBalancing {
-		// Dry-run: update the in-memory model only.
-		return moveMountedShardToEcNode(ecb.commandEnv, src, m.Collection, vid, shardId, dst, m.TargetDisk, false, ecb.diskType)
-	}
-	return ecb.applyShardMoveRPC(src, dst, m.Collection, vid, shardId, m.TargetDisk)
-}
-
-// applyShardMoveRPC copies a shard to the destination disk, then unmounts and
-// deletes it on the source. It does not touch the in-memory model, so it is safe
-// to run concurrently across the moves of a phase.
-func (ecb *ecBalancer) applyShardMoveRPC(src, dst *EcNode, collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, destDiskId uint32) error {
-	grpcDialOption := ecb.commandEnv.option.GrpcDialOption
-	srcAddr := pb.NewServerAddressFromDataNode(src.info)
-	copiedShardIds, err := oneServerCopyAndMountEcShardsFromSource(grpcDialOption, dst, []erasure_coding.ShardId{shardId}, vid, collection, srcAddr, destDiskId)
-	if err != nil {
-		return err
-	}
-	if len(copiedShardIds) == 0 {
-		return nil
-	}
-	if err := unmountEcShards(grpcDialOption, vid, srcAddr, copiedShardIds); err != nil {
-		return err
-	}
-	return sourceServerDeleteEcShards(grpcDialOption, collection, vid, srcAddr, copiedShardIds)
-}
-
-// compileCollectionPattern compiles a regex pattern for collection matching.
-// Empty patterns match empty collections only.
-// The special keyword CollectionDefault ("_default") matches empty collections.
-func compileCollectionPattern(pattern string) (*regexp.Regexp, error) {
-	if pattern == "" {
-		// empty pattern matches empty collection
-		return regexp.Compile("^$")
-	}
-	if pattern == CollectionDefault {
-		// CollectionDefault keyword matches empty collection
-		return regexp.Compile("^$")
-	}
-	return regexp.Compile(pattern)
+	return collections, nil
 }
diff --git a/weed/shell/command_ec_common_test.go b/weed/shell/command_ec_common_test.go
index 2ec0600e57..22a0c1a1a7 100644
--- a/weed/shell/command_ec_common_test.go
+++ b/weed/shell/command_ec_common_test.go
@@ -1,37 +1,39 @@
 package shell
 
-import (
-	"testing"
+import "testing"
 
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/storage/types"
-)
+// The ec and tier commands read an empty -collection as the collection with no
+// name, unlike -collectionPattern, where empty means every collection.
+func TestCompileCollectionPattern(t *testing.T) {
+	tests := []struct {
+		pattern string
+		matches []string
+		misses  []string
+	}{
+		{pattern: "", matches: []string{""}, misses: []string{"pictures"}},
+		{pattern: CollectionDefault, matches: []string{""}, misses: []string{"pictures"}},
+		{pattern: "pictures", matches: []string{"pictures"}, misses: []string{"", "pictures-backup"}},
+		{pattern: "pictures,videos", matches: []string{"pictures", "videos"}, misses: []string{"", "clips"}},
+		{pattern: "pictures," + CollectionDefault, matches: []string{"pictures", ""}, misses: []string{"clips"}},
+		{pattern: "pictures*", matches: []string{"pictures", "pictures-backup"}, misses: []string{"clips"}},
+		{pattern: "^pictures", matches: []string{"pictures", "pictures-backup"}, misses: []string{"clips"}},
+		{pattern: "*", matches: []string{"", "pictures"}},
+	}
 
-// countFreeShardSlots must report zero for a physically near-full disk even
-// though its slot math (MaxVolumeCount - VolumeCount) says it has room, so EC
-// placement never piles shards onto a full disk. Mirrors the volume #10160 gate.
-func TestCountFreeShardSlotsPhysicalDiskGate(t *testing.T) {
-	const gb = uint64(1) << 30
-
-	mk := func(total, free uint64) *master_pb.DataNodeInfo {
-		return &master_pb.DataNodeInfo{
-			Id: "n1",
-			DiskInfos: map[string]*master_pb.DiskInfo{
-				"": {MaxVolumeCount: 100, VolumeCount: 0, DiskTotalBytes: total, DiskFreeBytes: free},
-			},
+	for _, tt := range tests {
+		matcher, err := compileCollectionPattern(tt.pattern)
+		if err != nil {
+			t.Fatalf("compileCollectionPattern(%q): %v", tt.pattern, err)
+		}
+		for _, collection := range tt.matches {
+			if !matcher.Matches(collection) {
+				t.Errorf("pattern %q should match collection %q", tt.pattern, collection)
+			}
+		}
+		for _, collection := range tt.misses {
+			if matcher.Matches(collection) {
+				t.Errorf("pattern %q should not match collection %q", tt.pattern, collection)
+			}
 		}
 	}
-
-	// Physically empty: slot math applies, positive free slots.
-	if got := countFreeShardSlots(mk(1000*gb, 900*gb), types.HardDriveType); got <= 0 {
-		t.Errorf("physically empty disk free shard slots = %d, want > 0", got)
-	}
-	// Physically 96% full: gated to zero regardless of slot room.
-	if got := countFreeShardSlots(mk(1000*gb, 40*gb), types.HardDriveType); got != 0 {
-		t.Errorf("physically full disk free shard slots = %d, want 0", got)
-	}
-	// No byte report (older server): fall back to slot math, positive.
-	if got := countFreeShardSlots(mk(0, 0), types.HardDriveType); got <= 0 {
-		t.Errorf("unreported-bytes disk free shard slots = %d, want > 0 (slot fallback)", got)
-	}
 }
diff --git a/weed/shell/command_ec_decode.go b/weed/shell/command_ec_decode.go
index a7135efc25..33e640d182 100644
--- a/weed/shell/command_ec_decode.go
+++ b/weed/shell/command_ec_decode.go
@@ -5,21 +5,11 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"strings"
 
-	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/storage/types"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
-	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
 
 func init() {
@@ -65,7 +55,7 @@ func (c *commandEcDecode) HasTag(CommandTag) bool {
 func (c *commandEcDecode) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
 	decodeCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeId := decodeCommand.Int("volumeId", 0, "the volume id")
-	collection := decodeCommand.String("collection", "", "the collection name")
+	collection := decodeCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; empty matches the collection with no name")
 	diskTypeStr := decodeCommand.String("diskType", "", "source disk type where EC shards are stored (hdd, ssd, or empty for default hdd)")
 	checkMinFreeSpace := decodeCommand.Bool("checkMinFreeSpace", true, "check min free space when selecting the decode target")
 	batchSize := decodeCommand.Int("batchSize", DefaultEcBatchSize, "decode up to this many volumes per topology refresh (0 = one snapshot for all volumes)")
@@ -82,27 +72,29 @@ func (c *commandEcDecode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 
 	vid := needle.VolumeId(*volumeId)
 	diskType := types.ToDiskType(*diskTypeStr)
+	env := commandEnv.ecEnv()
 
 	// collect topology information
 	topologyInfo, _, err := collectTopologyInfo(commandEnv, 0)
 	if err != nil {
 		return err
 	}
-	var diskUsageState *decodeDiskUsageState
+	var diskUsageState *ec.DecodeDiskUsageState
 	if *checkMinFreeSpace {
-		diskUsageState = newDecodeDiskUsageState(topologyInfo, diskType)
+		diskUsageState = ec.NewDecodeDiskUsageState(topologyInfo, diskType)
 	}
 
 	// volumeId is provided
 	if vid != 0 {
-		return doEcDecode(commandEnv, topologyInfo, *collection, vid, diskType, *checkMinFreeSpace, diskUsageState)
+		return ec.DoEcDecode(env, topologyInfo, *collection, vid, diskType, *checkMinFreeSpace, diskUsageState)
 	}
 
 	// apply to all volumes in the collection
-	volumeIds, err := collectEcShardIds(topologyInfo, *collection, diskType)
+	collectionMatcher, err := compileCollectionPattern(*collection)
 	if err != nil {
-		return err
+		return fmt.Errorf("invalid collection pattern '%s': %v", *collection, err)
 	}
+	volumeIds := ec.CollectEcShardIds(topologyInfo, collectionMatcher, diskType)
 	fmt.Printf("ec decode volumes: %v\n", volumeIds)
 	batches := chunkVolumeIds(volumeIds, *batchSize)
 	for i, batch := range batches {
@@ -114,14 +106,14 @@ func (c *commandEcDecode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 				return err
 			}
 			if *checkMinFreeSpace {
-				diskUsageState = newDecodeDiskUsageState(topologyInfo, diskType)
+				diskUsageState = ec.NewDecodeDiskUsageState(topologyInfo, diskType)
 			}
 		}
 		if len(batches) > 1 {
 			fmt.Printf("ec decode batch %d/%d: %v\n", i+1, len(batches), batch)
 		}
 		for _, vid := range batch {
-			if err = doEcDecode(commandEnv, topologyInfo, *collection, vid, diskType, *checkMinFreeSpace, diskUsageState); err != nil {
+			if err = ec.DoEcDecode(env, topologyInfo, *collection, vid, diskType, *checkMinFreeSpace, diskUsageState); err != nil {
 				return err
 			}
 		}
@@ -130,265 +122,9 @@ func (c *commandEcDecode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 	return nil
 }
 
-func doEcDecode(commandEnv *CommandEnv, topoInfo *master_pb.TopologyInfo, collection string, vid needle.VolumeId, diskType types.DiskType, checkMinFreeSpace bool, diskUsageState *decodeDiskUsageState) (err error) {
-
-	if !commandEnv.isLocked() {
-		return fmt.Errorf("lock is lost")
-	}
-
-	// find volume location
-	nodeToEcShardsInfo, dataShards := collectEcNodeShardsInfo(topoInfo, vid, diskType)
-
-	fmt.Printf("ec volume %d shard locations: %+v\n", vid, nodeToEcShardsInfo)
-
-	if len(nodeToEcShardsInfo) == 0 {
-		return fmt.Errorf("no EC shards found for volume %d (diskType %s)", vid, diskType.ReadableString())
-	}
-
-	var originalShardCounts map[pb.ServerAddress]int
-	if diskUsageState != nil {
-		originalShardCounts = make(map[pb.ServerAddress]int, len(nodeToEcShardsInfo))
-		for location, si := range nodeToEcShardsInfo {
-			originalShardCounts[location] = si.Count()
-		}
-	}
-
-	var eligibleTargets map[pb.ServerAddress]struct{}
-	if checkMinFreeSpace {
-		if diskUsageState == nil {
-			return fmt.Errorf("min free space checking requires disk usage state")
-		}
-		eligibleTargets = make(map[pb.ServerAddress]struct{})
-		for location := range nodeToEcShardsInfo {
-			if freeCount, found := diskUsageState.freeVolumeCount(location); found && freeCount > 0 {
-				eligibleTargets[location] = struct{}{}
-			}
-		}
-		if len(eligibleTargets) == 0 {
-			return fmt.Errorf("no eligible target datanodes with free volume slots for volume %d (diskType %s); use -checkMinFreeSpace=false to override", vid, diskType.ReadableString())
-		}
-	}
-
-	// collect ec shards to the server with most space
-	targetNodeLocation, err := collectEcShards(commandEnv, nodeToEcShardsInfo, collection, vid, eligibleTargets, dataShards)
-	if err != nil {
-		return fmt.Errorf("collectEcShards for volume %d: %v", vid, err)
-	}
-
-	// generate a normal volume
-	err = generateNormalVolume(commandEnv.option.GrpcDialOption, vid, collection, targetNodeLocation)
-	if err != nil {
-		// Special case: if the EC index has no live entries, decoding is a no-op.
-		// Just purge EC shards and return success without generating/mounting an empty volume.
-		if isEcDecodeEmptyVolumeErr(err) {
-			if err := unmountAndDeleteEcShards(commandEnv.option.GrpcDialOption, collection, nodeToEcShardsInfo, vid); err != nil {
-				return err
-			}
-			if diskUsageState != nil {
-				diskUsageState.applyDecode(targetNodeLocation, originalShardCounts, false)
-			}
-			return nil
-		}
-		return fmt.Errorf("generate normal volume %d on %s: %v", vid, targetNodeLocation, err)
-	}
-
-	// mount the decoded volume after server-side offline compaction succeeded
-	err = mountDecodedVolume(commandEnv.option.GrpcDialOption, targetNodeLocation, vid)
-	if err != nil {
-		return fmt.Errorf("mount decoded volume %d on %s: %v", vid, targetNodeLocation, err)
-	}
-
-	// Confirm the regenerated .dat is present and non-empty before destroying
-	// the shards. Without this gate, a silent failure in generate/mount could
-	// leave the cluster with neither shards nor volume.
-	if err := verifyDecodedVolumeBeforeDelete(commandEnv.option.GrpcDialOption, targetNodeLocation, vid); err != nil {
-		return fmt.Errorf("verify decoded volume %d on %s before deleting shards: %w", vid, targetNodeLocation, err)
-	}
-
-	// delete the previous ec shards
-	err = unmountAndDeleteEcShardsWithPrefix("deleteDecodedEcShards", commandEnv.option.GrpcDialOption, collection, nodeToEcShardsInfo, vid)
-	if err != nil {
-		return fmt.Errorf("delete ec shards for volume %d: %v", vid, err)
-	}
-	if diskUsageState != nil {
-		diskUsageState.applyDecode(targetNodeLocation, originalShardCounts, true)
-	}
-
-	return nil
-}
-
-func isEcDecodeEmptyVolumeErr(err error) bool {
-	st, ok := status.FromError(err)
-	if !ok {
-		return false
-	}
-	if st.Code() != codes.FailedPrecondition {
-		return false
-	}
-	// Keep this robust against wording tweaks while still being specific.
-	return strings.Contains(st.Message(), erasure_coding.EcNoLiveEntriesSubstring)
-}
-
-func unmountAndDeleteEcShards(grpcDialOption grpc.DialOption, collection string, nodeToShardsInfo map[pb.ServerAddress]*erasure_coding.ShardsInfo, vid needle.VolumeId) error {
-	return unmountAndDeleteEcShardsWithPrefix("unmountAndDeleteEcShards", grpcDialOption, collection, nodeToShardsInfo, vid)
-}
-
-func unmountAndDeleteEcShardsWithPrefix(prefix string, grpcDialOption grpc.DialOption, collection string, nodeToShardsInfo map[pb.ServerAddress]*erasure_coding.ShardsInfo, vid needle.VolumeId) error {
-	ewg := NewErrorWaitGroup(len(nodeToShardsInfo))
-
-	// unmount and delete ec shards in parallel (one goroutine per location)
-	for location, si := range nodeToShardsInfo {
-		location, si := location, si // capture loop variables for goroutine
-		ewg.Add(func() error {
-			fmt.Printf("unmount ec volume %d on %s has shards: %+v\n", vid, location, si.Ids())
-			if err := unmountEcShards(grpcDialOption, vid, location, si.Ids()); err != nil {
-				return fmt.Errorf("%s unmount ec volume %d on %s: %w", prefix, vid, location, err)
-			}
-
-			fmt.Printf("delete ec volume %d on %s has shards: %+v\n", vid, location, si.Ids())
-			if err := sourceServerDeleteEcShards(grpcDialOption, collection, vid, location, si.Ids()); err != nil {
-				return fmt.Errorf("%s delete ec volume %d on %s: %w", prefix, vid, location, err)
-			}
-			return nil
-		})
-	}
-	return ewg.Wait()
-}
-
-func verifyDecodedVolumeBeforeDelete(grpcDialOption grpc.DialOption, target pb.ServerAddress, vid needle.VolumeId) error {
-	var resp *volume_server_pb.ReadVolumeFileStatusResponse
-	if err := operation.WithVolumeServerClient(false, target, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
-		r, e := client.ReadVolumeFileStatus(context.Background(), &volume_server_pb.ReadVolumeFileStatusRequest{
-			VolumeId: uint32(vid),
-		})
-		if e != nil {
-			return e
-		}
-		resp = r
-		return nil
-	}); err != nil {
-		return fmt.Errorf("read volume file status: %w", err)
-	}
-	if resp.DatFileSize == 0 {
-		return fmt.Errorf("decoded .dat is 0 bytes")
-	}
-	if resp.IdxFileSize == 0 {
-		return fmt.Errorf("decoded .idx is 0 bytes")
-	}
-	glog.V(0).Infof("ec decode verification ok for volume %d on %s: dat=%d idx=%d", vid, target, resp.DatFileSize, resp.IdxFileSize)
-	return nil
-}
-
-func mountDecodedVolume(grpcDialOption grpc.DialOption, targetNodeLocation pb.ServerAddress, vid needle.VolumeId) error {
-	return operation.WithVolumeServerClient(false, targetNodeLocation, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, mountErr := volumeServerClient.VolumeMount(context.Background(), &volume_server_pb.VolumeMountRequest{
-			VolumeId: uint32(vid),
-		})
-		return mountErr
-	})
-}
-
-func generateNormalVolume(grpcDialOption grpc.DialOption, vid needle.VolumeId, collection string, sourceVolumeServer pb.ServerAddress) error {
-	fmt.Printf("generateNormalVolume from ec volume %d on %s\n", vid, sourceVolumeServer)
-
-	err := operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, genErr := volumeServerClient.VolumeEcShardsToVolume(context.Background(), &volume_server_pb.VolumeEcShardsToVolumeRequest{
-			VolumeId:   uint32(vid),
-			Collection: collection,
-		})
-		return genErr
-	})
-
-	return err
-
-}
-
-func collectEcShards(commandEnv *CommandEnv, nodeToShardsInfo map[pb.ServerAddress]*erasure_coding.ShardsInfo, collection string, vid needle.VolumeId, eligibleTargets map[pb.ServerAddress]struct{}, dataShards int) (targetNodeLocation pb.ServerAddress, err error) {
-
-	maxShardCount := -1
-	existingShardsInfo := erasure_coding.NewShardsInfo()
-	for loc, si := range nodeToShardsInfo {
-		if eligibleTargets != nil {
-			if _, ok := eligibleTargets[loc]; !ok {
-				continue
-			}
-		}
-		toBeCopiedShardCount := si.MinusParityShards(dataShards).Count()
-		if toBeCopiedShardCount > maxShardCount {
-			maxShardCount = toBeCopiedShardCount
-			targetNodeLocation = loc
-			existingShardsInfo = si
-		}
-	}
-	if targetNodeLocation == "" {
-		return "", fmt.Errorf("no eligible target datanodes available to decode volume %d", vid)
-	}
-
-	fmt.Printf("collectEcShards: ec volume %d collect shards to %s from: %+v\n", vid, targetNodeLocation, nodeToShardsInfo)
-
-	copiedShardsInfo := erasure_coding.NewShardsInfo()
-	for loc, si := range nodeToShardsInfo {
-		if loc == targetNodeLocation {
-			continue
-		}
-
-		needToCopyShardsInfo := si.Minus(existingShardsInfo).MinusParityShards(dataShards)
-
-		err = operation.WithVolumeServerClient(false, targetNodeLocation, commandEnv.option.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-
-			// Always collect .ecj from every shard location. Each server's .ecj
-			// only contains deletions for needles whose data resides in shards
-			// held by that server. Without merging all .ecj files, deletions
-			// recorded on other servers would be lost during decode.
-			if needToCopyShardsInfo.Count() > 0 {
-				fmt.Printf("copy %d.%v %s => %s\n", vid, needToCopyShardsInfo.Ids(), loc, targetNodeLocation)
-			} else {
-				fmt.Printf("collect ecj %d %s => %s\n", vid, loc, targetNodeLocation)
-			}
-
-			_, copyErr := volumeServerClient.VolumeEcShardsCopy(context.Background(), &volume_server_pb.VolumeEcShardsCopyRequest{
-				VolumeId:       uint32(vid),
-				Collection:     collection,
-				ShardIds:       needToCopyShardsInfo.IdsUint32(),
-				CopyEcxFile:    false,
-				CopyEcjFile:    true,
-				CopyVifFile:    needToCopyShardsInfo.Count() > 0,
-				SourceDataNode: string(loc),
-			})
-			if copyErr != nil {
-				return fmt.Errorf("copy %d.%v %s => %s : %v\n", vid, needToCopyShardsInfo.Ids(), loc, targetNodeLocation, copyErr)
-			}
-
-			if needToCopyShardsInfo.Count() > 0 {
-				fmt.Printf("mount %d.%v on %s\n", vid, needToCopyShardsInfo.Ids(), targetNodeLocation)
-				_, mountErr := volumeServerClient.VolumeEcShardsMount(context.Background(), &volume_server_pb.VolumeEcShardsMountRequest{
-					VolumeId:   uint32(vid),
-					Collection: collection,
-					ShardIds:   needToCopyShardsInfo.IdsUint32(),
-				})
-				if mountErr != nil {
-					return fmt.Errorf("mount %d.%v on %s : %v\n", vid, needToCopyShardsInfo.Ids(), targetNodeLocation, mountErr)
-				}
-			}
-
-			return nil
-		})
-
-		if err != nil {
-			break
-		}
-
-		copiedShardsInfo.Add(needToCopyShardsInfo)
-	}
-
-	nodeToShardsInfo[targetNodeLocation] = existingShardsInfo.Plus(copiedShardsInfo)
-
-	return targetNodeLocation, err
-}
-
 func lookupVolumeIds(commandEnv *CommandEnv, volumeIds []string) (volumeIdLocations []*master_pb.LookupVolumeResponse_VolumeIdLocation, err error) {
 	var resp *master_pb.LookupVolumeResponse
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		resp, err = client.LookupVolume(context.Background(), &master_pb.LookupVolumeRequest{VolumeOrFileIds: volumeIds})
 		return err
 	})
@@ -397,109 +133,3 @@ func lookupVolumeIds(commandEnv *CommandEnv, volumeIds []string) (volumeIdLocati
 	}
 	return resp.VolumeIdLocations, nil
 }
-
-func collectEcShardIds(topoInfo *master_pb.TopologyInfo, collectionPattern string, diskType types.DiskType) (vids []needle.VolumeId, err error) {
-	// compile regex pattern for collection matching
-	collectionRegex, err := compileCollectionPattern(collectionPattern)
-	if err != nil {
-		return nil, fmt.Errorf("invalid collection pattern '%s': %v", collectionPattern, err)
-	}
-
-	vidMap := make(map[uint32]bool)
-	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		if diskInfo, found := dn.DiskInfos[string(diskType)]; found {
-			for _, v := range diskInfo.EcShardInfos {
-				if collectionRegex.MatchString(v.Collection) {
-					vidMap[v.Id] = true
-				}
-			}
-		}
-	})
-
-	for vid := range vidMap {
-		vids = append(vids, needle.VolumeId(vid))
-	}
-
-	return
-}
-
-func collectEcNodeShardsInfo(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId, diskType types.DiskType) (map[pb.ServerAddress]*erasure_coding.ShardsInfo, int) {
-	res := make(map[pb.ServerAddress]*erasure_coding.ShardsInfo)
-	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		if diskInfo, found := dn.DiskInfos[string(diskType)]; found {
-			// A node may report several EcShardInfos for one volume — one per
-			// physical disk holding shards of it (multi-disk nodes). Union them
-			// rather than overwriting, or only the last disk's shards survive and
-			// the node looks like it is missing shards it actually has.
-			for _, v := range diskInfo.EcShardInfos {
-				if v.Id == uint32(vid) {
-					addr := pb.NewServerAddressFromDataNode(dn)
-					si := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(v)
-					if existing, ok := res[addr]; ok {
-						existing.Add(si)
-					} else {
-						res[addr] = si
-					}
-				}
-			}
-		}
-	})
-
-	// OSS is always 10+4; the per-volume ratio override lives in the enterprise build.
-	return res, erasure_coding.DataShardsCount
-}
-
-type decodeDiskUsageState struct {
-	byNode map[pb.ServerAddress]*decodeDiskUsageCounts
-}
-
-type decodeDiskUsageCounts struct {
-	maxVolumeCount    int64
-	volumeCount       int64
-	remoteVolumeCount int64
-	ecShardCount      int64
-}
-
-func newDecodeDiskUsageState(topoInfo *master_pb.TopologyInfo, diskType types.DiskType) *decodeDiskUsageState {
-	state := &decodeDiskUsageState{byNode: make(map[pb.ServerAddress]*decodeDiskUsageCounts)}
-	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		if diskInfo, found := dn.DiskInfos[string(diskType)]; found {
-			state.byNode[pb.NewServerAddressFromDataNode(dn)] = &decodeDiskUsageCounts{
-				maxVolumeCount:    diskInfo.MaxVolumeCount,
-				volumeCount:       diskInfo.VolumeCount,
-				remoteVolumeCount: diskInfo.RemoteVolumeCount,
-				ecShardCount:      int64(countShards(diskInfo.EcShardInfos)),
-			}
-		}
-	})
-	return state
-}
-
-func (state *decodeDiskUsageState) freeVolumeCount(location pb.ServerAddress) (int64, bool) {
-	if state == nil {
-		return 0, false
-	}
-	usage, found := state.byNode[location]
-	if !found {
-		return 0, false
-	}
-	free := usage.maxVolumeCount - (usage.volumeCount - usage.remoteVolumeCount)
-	free -= (usage.ecShardCount + int64(erasure_coding.DataShardsCount) - 1) / int64(erasure_coding.DataShardsCount)
-	return free, true
-}
-
-func (state *decodeDiskUsageState) applyDecode(targetNodeLocation pb.ServerAddress, shardCounts map[pb.ServerAddress]int, createdVolume bool) {
-	if state == nil {
-		return
-	}
-	for location, shardCount := range shardCounts {
-		if usage, found := state.byNode[location]; found {
-			usage.ecShardCount -= int64(shardCount)
-		}
-	}
-	if createdVolume {
-		if usage, found := state.byNode[targetNodeLocation]; found {
-			usage.volumeCount++
-		}
-	}
-}
diff --git a/weed/shell/command_ec_encode.go b/weed/shell/command_ec_encode.go
index c9dcce0ea3..15a10fe516 100644
--- a/weed/shell/command_ec_encode.go
+++ b/weed/shell/command_ec_encode.go
@@ -1,36 +1,19 @@
 package shell
 
 import (
-	"context"
-	"errors"
 	"flag"
 	"fmt"
 	"io"
-	"regexp"
-	"slices"
-	"sort"
-	"strconv"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/wdclient"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
-	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
-	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
-	"github.com/seaweedfs/seaweedfs/weed/storage/volume_replica"
 )
 
 func init() {
@@ -64,10 +47,23 @@ func (c *commandEcEncode) Help() string {
 	If you only have less than 4 volume servers, with erasure coding, at least you can afford to
 	have 4 corrupted shard files.
 
-	The -collection parameter supports regular expressions for pattern matching:
-	  - Use exact match: ec.encode -collection="^mybucket$"
-	  - Match multiple buckets: ec.encode -collection="bucket.*"
-	  - Match all collections: ec.encode -collection=".*"
+	The guarantee follows from where shards land: a volume survives the loss of any
+	nodes (or racks) that hold at most parityShards (4) shards between them. Spread
+	is best-effort; -shardReplicaPlacement requests limits: its rack digit
+	sets the requested shards per rack, and its node digit the requested shards
+	per node (the data-center digit is not used for EC). For example
+	-shardReplicaPlacement=021 requests at most 1 shard per node and 2 per rack.
+	Only when the final placement meets these limits does losing one rack cost
+	at most 2 shards, so the encode fails (and keeps the original volumes)
+	when the cluster cannot honor them.
+
+	The -collection parameter is a comma-separated list of collection names, with
+	"*" and "?" wildcards, and regex patterns:
+	  - One collection: ec.encode -collection="mybucket"
+	  - Several collections: ec.encode -collection="mybucket,otherbucket"
+	  - Match by prefix: ec.encode -collection="bucket*"
+	  - Match all collections: ec.encode -collection="*"
+	  - The empty-named collection: ec.encode -collection="` + CollectionDefault + `"
 
 	Options:
 	  -verbose: show detailed reasons why volumes are not selected for encoding
@@ -105,7 +101,7 @@ func (c *commandEcEncode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 	encodeCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeId := encodeCommand.Int("volumeId", 0, "the volume id")
 	volumeIdsStr := encodeCommand.String("volumeIds", "", "comma-separated volume ids")
-	collection := encodeCommand.String("collection", "", "collection name or regex pattern")
+	collection := encodeCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; empty matches the collection with no name")
 	fullPercentage := encodeCommand.Float64("fullPercent", 95, "the volume reaches the percentage of max volume size")
 	quietPeriod := encodeCommand.Duration("quietFor", time.Hour, "select volumes without no writes for this period")
 	maxParallelization := encodeCommand.Int("maxParallelization", DefaultMaxParallelization, "run up to X tasks in parallel, whenever possible")
@@ -163,7 +159,7 @@ func (c *commandEcEncode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 		if *volumeId != 0 {
 			volumeIds = append(volumeIds, needle.VolumeId(*volumeId))
 		} else {
-			volumeIds, err = parseEcEncodeVolumeIds(*volumeIdsStr)
+			volumeIds, err = parseVolumeIdsFlag(*volumeIdsStr)
 			if err != nil {
 				return err
 			}
@@ -183,7 +179,7 @@ func (c *commandEcEncode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 		return fmt.Errorf("-batchSize must be >= 0")
 	}
 
-	batches := chunkVolumeIds(volumeIds, *batchSize)
+	batches := ec.ChunkVolumeIds(volumeIds, *batchSize)
 	if len(batches) > 1 {
 		fmt.Printf("Processing %d volumes in %d batch(es), batchSize=%d\n", len(volumeIds), len(batches), *batchSize)
 	}
@@ -191,7 +187,7 @@ func (c *commandEcEncode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 		if len(batches) > 1 {
 			fmt.Printf("Starting EC encoding batch %d/%d with %d volumes: %v\n", i+1, len(batches), len(batchVolumeIds), batchVolumeIds)
 		}
-		if err := processEcEncodeBatch(commandEnv, writer, batchVolumeIds, rp, diskType, *maxParallelization, *applyBalancing, *collection); err != nil {
+		if err := ec.ProcessEcEncodeBatch(commandEnv.ecEnv(), writer, batchVolumeIds, rp, diskType, *maxParallelization, *applyBalancing, *collection); err != nil {
 			return fmt.Errorf("ec encode batch %d/%d for volumes %v: %w", i+1, len(batches), batchVolumeIds, err)
 		}
 	}
@@ -201,757 +197,9 @@ func (c *commandEcEncode) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 
 	return nil
 }
-
-func parseEcEncodeVolumeIds(volumeIdsStr string) ([]needle.VolumeId, error) {
-	var volumeIds []needle.VolumeId
-	seen := make(map[needle.VolumeId]bool)
-	for _, part := range strings.Split(volumeIdsStr, ",") {
-		part = strings.TrimSpace(part)
-		if part == "" {
-			continue
-		}
-		vidValue, err := strconv.ParseUint(part, 10, 32)
-		if err != nil || vidValue == 0 {
-			return nil, fmt.Errorf("invalid volume id %q in -volumeIds", part)
-		}
-		// ParseUint with bitSize 32 bounds the value; convert through uint32
-		// (matching the rest of the codebase) so the narrowing is provably safe.
-		vid := needle.VolumeId(uint32(vidValue))
-		if seen[vid] {
-			continue
-		}
-		seen[vid] = true
-		volumeIds = append(volumeIds, vid)
-	}
-	if len(volumeIds) == 0 {
-		return nil, fmt.Errorf("-volumeIds does not contain any valid volume id")
-	}
-	return volumeIds, nil
-}
-
-func chunkVolumeIds(volumeIds []needle.VolumeId, batchSize int) [][]needle.VolumeId {
-	if batchSize <= 0 || len(volumeIds) == 0 {
-		return [][]needle.VolumeId{volumeIds}
-	}
-	var batches [][]needle.VolumeId
-	for start := 0; start < len(volumeIds); start += batchSize {
-		end := start + batchSize
-		if end > len(volumeIds) {
-			end = len(volumeIds)
-		}
-		batches = append(batches, volumeIds[start:end])
-	}
-	return batches
-}
-
-func processEcEncodeBatch(commandEnv *CommandEnv, writer io.Writer, volumeIds []needle.VolumeId, rp *super_block.ReplicaPlacement, diskType types.DiskType, maxParallelization int, applyBalancing bool, collectionForMessage string) error {
-	topologyInfo, _, err := collectTopologyInfo(commandEnv, 0)
-	if err != nil {
-		return err
-	}
-
-	// Refuse to encode a volume that is already EC (present only as shards):
-	// an EC volume has no .dat, so re-encoding it would tear down its only
-	// copy before failing. A regular volume (with a .dat) passes. This closes
-	// the operator-rerun / script-retry path; a worker racing the snapshot is
-	// handled by encode fencing, not here.
-	if err := assertEncodableRegularVolumes(topologyInfo, volumeIds); err != nil {
-		return err
-	}
-
-	volumeIdToCollection := collectVolumeIdToCollection(topologyInfo, volumeIds)
-	balanceCollections := collectCollectionsForVolumeIds(topologyInfo, volumeIds)
-
-	fmt.Printf("Collecting volume locations for %d volumes before EC encoding...\n", len(volumeIds))
-	volumeLocationsMap, err := volumeLocations(commandEnv, volumeIds)
-	if err != nil {
-		return fmt.Errorf("failed to collect volume locations before EC encoding: %w", err)
-	}
-
-	if err := checkEcEncodeCapacity(topologyInfo, len(volumeIds), diskType, collectionForMessage); err != nil {
-		return err
-	}
-
-	skippedNodes, err := doEcEncode(commandEnv, writer, volumeIdToCollection, volumeIds, maxParallelization, topologyInfo)
-	if err != nil {
-		return fmt.Errorf("ec encode for volumes %v: %w", volumeIds, err)
-	}
-	// Mounting the new shards notifies the master asynchronously, and EcBalance
-	// plans from a fresh topology snapshot: one taken before the mounts land
-	// shows no shards for these volumes, so the balance plans no moves and
-	// silently leaves every shard on the generation host.
-	if err := waitForEcShardsToRegister(commandEnv, volumeIds); err != nil {
-		return fmt.Errorf("wait for ec shards to register with the master: %w", err)
-	}
-	// EcBalance works at collection scope. In batch mode this intentionally
-	// rebalances each collection after every batch so source volumes can be
-	// safely verified and deleted without waiting for all batches to finish.
-	// skippedNodes are excluded so a recovered node's stale orphan is never
-	// paired with a new-generation shard.
-	if err := EcBalance(commandEnv, balanceCollections, "", rp, diskType, maxParallelization, applyBalancing, skippedNodes); err != nil {
-		return fmt.Errorf("re-balance ec shards for collection(s) %v: %w", balanceCollections, err)
-	}
-	if err := verifyEcShardsBeforeDelete(commandEnv, volumeIds, diskType, applyBalancing); err != nil {
-		return fmt.Errorf("verify EC shards before deleting originals: %w", err)
-	}
-	fmt.Printf("Deleting original volumes after EC encoding...\n")
-	if err := doDeleteVolumesWithLocations(commandEnv, volumeIds, volumeLocationsMap, maxParallelization); err != nil {
-		return fmt.Errorf("delete original volumes after EC encoding: %w", err)
-	}
-	fmt.Printf("Successfully completed EC encoding for %d volumes\n", len(volumeIds))
-	return nil
-}
-
-func checkEcEncodeCapacity(topologyInfo *master_pb.TopologyInfo, volumeCount int, diskType types.DiskType, collectionForMessage string) error {
-	// Pre-flight check: verify the target disk type has capacity for EC shards.
-	// This prevents encoding shards only to fail during rebalance. Reuse the
-	// caller's topology snapshot instead of issuing another VolumeList to the
-	// master per batch.
-	_, totalFreeEcSlots := collectEcVolumeServersByDc(topologyInfo, "", diskType)
-
-	// Each volume needs TotalShardsCount (14) shards distributed.
-	requiredSlots := volumeCount * erasure_coding.TotalShardsCount
-	if totalFreeEcSlots < 1 {
-		if diskType != types.HardDriveType {
-			tryDiskTypeMessage := "Try passing -diskType=hdd, or omit -diskType to use the default (hdd)"
-			if collectionForMessage != "" {
-				tryDiskTypeMessage = fmt.Sprintf("Try:\n  ec.encode -collection=%s -diskType=hdd\nOr omit -diskType to use the default (hdd)", collectionForMessage)
-			}
-			return fmt.Errorf("no free ec shard slots on disk type '%s'. The target disk type has no capacity.\n"+
-				"Your volumes are likely on a different disk type. %s", diskType, tryDiskTypeMessage)
-		}
-		return fmt.Errorf("no free ec shard slots. only %d left on disk type '%s'", totalFreeEcSlots, diskType)
-	}
-
-	if totalFreeEcSlots < requiredSlots {
-		fmt.Printf("Warning: limited EC shard capacity. Need %d slots for %d volumes, but only %d slots available on disk type '%s'.\n",
-			requiredSlots, volumeCount, totalFreeEcSlots, diskType)
-		fmt.Printf("Rebalancing may not achieve optimal distribution.\n")
-	}
-	return nil
-}
-
-func volumeLocations(commandEnv *CommandEnv, volumeIds []needle.VolumeId) (map[needle.VolumeId][]wdclient.Location, error) {
-	res := map[needle.VolumeId][]wdclient.Location{}
-	for _, vid := range volumeIds {
-		ls, ok := commandEnv.MasterClient.GetLocationsClone(uint32(vid))
-		if !ok {
-			return nil, fmt.Errorf("volume %d not found", vid)
-		}
-		res[vid] = ls
-	}
-
-	return res, nil
-}
-
-func doEcEncode(commandEnv *CommandEnv, writer io.Writer, volumeIdToCollection map[needle.VolumeId]string, volumeIds []needle.VolumeId, maxParallelization int, topologyInfo *master_pb.TopologyInfo) (skippedNodes map[pb.ServerAddress]struct{}, err error) {
-	if !commandEnv.isLocked() {
-		return nil, fmt.Errorf("lock is lost")
-	}
-	locations, err := volumeLocations(commandEnv, volumeIds)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get volume locations for EC encoding: %w", err)
-	}
-
-	// Clear EC shards left by a previous failed/partial encode so a retry
-	// starts clean and never mixes two encode runs. A node skipped here as
-	// unreachable is excluded from the later balance: it may still hold a stale
-	// orphan that, paired with a new-generation shard from a balance copy, would
-	// mix generations on that node.
-	skippedNodes, err = clearPreexistingEcShards(commandEnv, topologyInfo, volumeIds, volumeIdToCollection, maxParallelization)
-	if err != nil {
-		return nil, fmt.Errorf("clear pre-existing ec shards before encoding: %w", err)
-	}
-
-	// Build a map of (volumeId, serverAddress) -> freeVolumeCount.
-	// Key by dn.Address so it matches wdclient.Location.Url. In deployments
-	// where dn.Id is a short name (e.g. Kubernetes StatefulSet pod name)
-	// while dn.Address is a FQDN:port, keying by dn.Id would never match the
-	// location Url during the health-check lookup below.
-	freeVolumeCountMap := make(map[string]int) // key: volumeId-serverAddress
-	eachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		addr := dn.Address
-		if addr == "" {
-			addr = dn.Id // older nodes use ip:port as id
-		}
-		for _, diskInfo := range dn.DiskInfos {
-			for _, v := range diskInfo.VolumeInfos {
-				key := fmt.Sprintf("%d-%s", v.Id, addr)
-				freeVolumeCountMap[key] = int(diskInfo.FreeVolumeCount)
-			}
-		}
-	})
-
-	// Filter replicas by free capacity BEFORE marking volumes readonly so that
-	// a failed health check does not strand volumes in readonly state.
-	filteredLocations := make(map[needle.VolumeId][]wdclient.Location)
-	for _, vid := range volumeIds {
-		var filteredLocs []wdclient.Location
-		for _, l := range locations[vid] {
-			key := fmt.Sprintf("%d-%s", vid, l.Url)
-			if freeCount, found := freeVolumeCountMap[key]; found && freeCount >= 2 {
-				filteredLocs = append(filteredLocs, l)
-			}
-		}
-		if len(filteredLocs) == 0 {
-			return nil, fmt.Errorf("no healthy replicas (FreeVolumeCount >= 2) found for volume %d to use as source for EC encoding", vid)
-		}
-		filteredLocations[vid] = filteredLocs
-	}
-
-	// mark volumes as readonly
-	ewg := NewErrorWaitGroup(maxParallelization)
-	for _, vid := range volumeIds {
-		for _, l := range locations[vid] {
-			ewg.Add(func() error {
-				if err := markVolumeReplicaWritable(context.Background(), commandEnv.option.GrpcDialOption, vid, l, false, false); err != nil {
-					return fmt.Errorf("mark volume %d as readonly on %s: %v", vid, l.Url, err)
-				}
-				return nil
-			})
-		}
-	}
-	if err := ewg.Wait(); err != nil {
-		return nil, err
-	}
-
-	// Sync replicas and select the best one for each volume (with highest file count)
-	// This addresses data inconsistency risk in multi-replica volumes (issue #7797)
-	// by syncing missing entries between replicas before encoding
-	bestReplicas := make(map[needle.VolumeId]wdclient.Location)
-	for _, vid := range volumeIds {
-		collection := volumeIdToCollection[vid]
-
-		// Sync missing entries between replicas, then select the best one
-		bestLoc, selectErr := volume_replica.SyncAndSelectBestReplica(commandEnv.option.GrpcDialOption, vid, collection, filteredLocations[vid], "", writer)
-		if selectErr != nil {
-			return nil, fmt.Errorf("failed to sync and select replica for volume %d: %v", vid, selectErr)
-		}
-		bestReplicas[vid] = bestLoc
-	}
-
-	// Re-attempt the orphan sweep on the nodes skipped as unreachable, now that
-	// any node that recovered during readonly-marking and replica sync answers
-	// again. A node whose teardown now succeeds is clean (and the generation host
-	// re-wipes its own disks regardless), so it leaves the skipped set and can be
-	// a balance source/target — otherwise its shards would never distribute off
-	// it. A node that is still down stays skipped and excluded, preserving the
-	// leniency for a genuinely-down node; such a node also cannot be the
-	// generation host below, since VolumeEcShardsGenerate would fail to read .dat.
-	if err := resweepSkippedNodes(commandEnv, skippedNodes, volumeIds, volumeIdToCollection, maxParallelization); err != nil {
-		return nil, err
-	}
-
-	// A selected generation host still in skippedNodes after the re-sweep was
-	// transport-down when we tried to clean it, so its stale orphans were never
-	// removed and EcBalance excludes it as both source and target. If it recovers
-	// just in time for generation, all shards land on a node we can neither clean
-	// nor balance off — a single point of failure that union-only verification
-	// still accepts, after which the originals are deleted. Abort instead.
-	for _, vid := range volumeIds {
-		genHost := bestReplicas[vid].ServerAddress()
-		if _, stillSkipped := skippedNodes[genHost]; stillSkipped {
-			return nil, fmt.Errorf("generate ec shards for volume %d aborted: selected source %s is still skipped after the orphan re-sweep", vid, genHost)
-		}
-	}
-
-	// generate ec shards using the best replica for each volume
-	ewg.Reset()
-	for _, vid := range volumeIds {
-		target := bestReplicas[vid]
-		collection := volumeIdToCollection[vid]
-		ewg.Add(func() error {
-			if err := generateEcShards(commandEnv.option.GrpcDialOption, vid, collection, target.ServerAddress()); err != nil {
-				return fmt.Errorf("generate ec shards for volume %d on %s: %v", vid, target.Url, err)
-			}
-			return nil
-		})
-	}
-	if err := ewg.Wait(); err != nil {
-		return nil, err
-	}
-
-	// mount all ec shards for the converted volume
-	shardIds := erasure_coding.AllShardIds()
-
-	ewg.Reset()
-	for _, vid := range volumeIds {
-		target := bestReplicas[vid]
-		collection := volumeIdToCollection[vid]
-		ewg.Add(func() error {
-			if err := mountEcShards(commandEnv.option.GrpcDialOption, collection, vid, target.ServerAddress(), shardIds); err != nil {
-				return fmt.Errorf("mount ec shards for volume %d on %s: %v", vid, target.Url, err)
-			}
-			return nil
-		})
-	}
-	if err := ewg.Wait(); err != nil {
-		return nil, err
-	}
-
-	return skippedNodes, nil
-}
-
-// clearPreexistingEcShards removes EC shards and index files left over from a
-// previous (failed or partial) encode of the given volume ids, on every node
-// that still reports them, so a fresh encode regenerates from a clean slate.
-// Scans all disk types. The normal .dat/.idx — the source of truth for this
-// encode — is untouched; only orphaned EC artifacts are deleted.
-//
-// Returns the set of nodes skipped as unreachable. A skipped node may still hold
-// an un-deleted orphan from a prior run; if it recovers it must be kept out of
-// this encode's shard distribution, or the balance could install the new
-// generation alongside the stale orphan and mix generations on one node.
-func clearPreexistingEcShards(commandEnv *CommandEnv, topologyInfo *master_pb.TopologyInfo, volumeIds []needle.VolumeId, volumeIdToCollection map[needle.VolumeId]string, maxParallelization int) (skipped map[pb.ServerAddress]struct{}, err error) {
-	wanted := make(map[uint32]bool, len(volumeIds))
-	for _, vid := range volumeIds {
-		wanted[uint32(vid)] = true
-	}
-
-	// Note which (node, vid) pairs the topology already reports EC shards for:
-	// those are mounted leftovers and cleaning them is required (fatal on
-	// error). Every other (node, vid) is swept best-effort to catch UNMOUNTED
-	// orphans left by a failed copy — invisible to the heartbeat, so absent
-	// here. A node that is down or holds nothing is a harmless no-op; a node
-	// unreachable now also cannot receive this encode's new generation, so a
-	// surviving orphan there keeps its old identity and the read guard rejects
-	// it. Always delete the full shard-id range so a wider custom ratio's
-	// leftovers are covered too.
-	reportedKey := func(addr pb.ServerAddress, vid uint32) string {
-		return string(addr) + "\x00" + strconv.Itoa(int(vid))
-	}
-	reported := make(map[string]struct{})
-	var nodes []pb.ServerAddress
-	eachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		addr := pb.NewServerAddressFromDataNode(dn)
-		nodes = append(nodes, addr)
-		for _, diskInfo := range dn.DiskInfos {
-			for _, ecInfo := range diskInfo.EcShardInfos {
-				if wanted[ecInfo.Id] {
-					reported[reportedKey(addr, ecInfo.Id)] = struct{}{}
-				}
-			}
-		}
-	})
-
-	allShardIds := make([]erasure_coding.ShardId, erasure_coding.MaxShardCount)
-	for i := range allShardIds {
-		allShardIds[i] = erasure_coding.ShardId(i)
-	}
-
-	if len(reported) > 0 {
-		fmt.Printf("clearing stale EC shards reported for %d (node,volume) pair(s) before regenerating...\n", len(reported))
-	}
-	// Nodes skipped as unreachable, accumulated across the concurrent sweep tasks.
-	skipped = make(map[pb.ServerAddress]struct{})
-	var skippedMu sync.Mutex
-	ewg := NewErrorWaitGroup(maxParallelization)
-	for _, addr := range nodes {
-		for _, vid := range volumeIds {
-			fatal := false
-			if _, ok := reported[reportedKey(addr, uint32(vid))]; ok {
-				fatal = true
-			}
-			collection := volumeIdToCollection[vid]
-			ewg.Add(func() error {
-				if err := unmountAndDeleteEcShardsQuiet(commandEnv.option.GrpcDialOption, collection, vid, addr, allShardIds); err != nil {
-					// Surface a reachable node whose delete genuinely failed (its orphan would
-					// be re-stamped by a later copy installing the new .vif). A missing
-					// full_teardown ack from a reachable pre-upgrade node is fatal too: it may
-					// still hold an orphan a later copy would re-stamp into the new generation.
-					// Stay best-effort only for a node that is truly unreachable: codes.Unavailable
-					// alone is ambiguous — a genuinely-down node and a reachable Rust volume
-					// server in maintenance mode both return it (a Go server returns Unknown for
-					// maintenance, already fatal above). Confirm with a non-maintenance-gated Ping
-					// before skipping; skip only when the Ping itself transport-failed (nodeDown).
-					// A reachable maintenance node (nodeUp) CAN receive this generation, and an
-					// inconclusive Ping (nodeLivenessUnknown, e.g. a pre-Ping server returning
-					// Unimplemented — which means the node is up) does not prove the node is down,
-					// so both stay fatal rather than silently leaving a stale EC generation.
-					if fatal || errors.Is(err, errFullTeardownNotAcked) || !isNodeUnreachable(err) ||
-						classifyNodeLiveness(pingVolumeServer(commandEnv.option.GrpcDialOption, addr)) != nodeDown {
-						return fmt.Errorf("clear stale ec shards for volume %d on %s: %w", vid, addr, err)
-					}
-					glog.V(1).Infof("orphan sweep: volume %d on %s skipped (unreachable): %v", vid, addr, err)
-					skippedMu.Lock()
-					skipped[addr] = struct{}{}
-					skippedMu.Unlock()
-				}
-				return nil
-			})
-		}
-	}
-	if err := ewg.Wait(); err != nil {
-		return nil, err
-	}
-	return skipped, nil
-}
-
-// resweepSkippedNodes re-attempts the orphan teardown on the nodes that the
-// initial sweep skipped as unreachable, just before shard generation. A node
-// that recovered in the meantime — and is therefore eligible to host this
-// encode's generation — has its teardown retried; if it now fully succeeds it is
-// removed from skipped so the rebalance can use it as a source and move its
-// shards off, instead of stranding all shards on the single generation host and
-// collapsing fault tolerance. A node still transport-down stays skipped (the
-// same leniency the initial sweep grants), and a node that came back reachable
-// but whose delete genuinely failed is fatal, exactly as in the initial sweep,
-// so a stale generation is never silently left behind. Mutates skipped in place.
-func resweepSkippedNodes(commandEnv *CommandEnv, skipped map[pb.ServerAddress]struct{}, volumeIds []needle.VolumeId, volumeIdToCollection map[needle.VolumeId]string, maxParallelization int) error {
-	if len(skipped) == 0 {
-		return nil
-	}
-
-	allShardIds := make([]erasure_coding.ShardId, erasure_coding.MaxShardCount)
-	for i := range allShardIds {
-		allShardIds[i] = erasure_coding.ShardId(i)
-	}
-
-	addrs := make([]pb.ServerAddress, 0, len(skipped))
-	for addr := range skipped {
-		addrs = append(addrs, addr)
-	}
-
-	fmt.Printf("re-checking %d node(s) skipped by the orphan sweep before generating shards...\n", len(addrs))
-
-	// A node still down on every retried vid stays skipped; one that fully
-	// succeeds is un-skipped. Track per-node whether any retry still failed
-	// (down) so a node whose state is mixed across vids never gets un-skipped.
-	stillDown := make(map[pb.ServerAddress]struct{})
-	var mu sync.Mutex
-	ewg := NewErrorWaitGroup(maxParallelization)
-	for _, addr := range addrs {
-		for _, vid := range volumeIds {
-			collection := volumeIdToCollection[vid]
-			ewg.Add(func() error {
-				if err := unmountAndDeleteEcShardsQuiet(commandEnv.option.GrpcDialOption, collection, vid, addr, allShardIds); err != nil {
-					// Same decision as the initial sweep: a reachable node whose delete
-					// genuinely failed (or did not ack a full teardown, or whose liveness is
-					// inconclusive) is fatal, since it could hold an orphan a later copy
-					// re-stamps into this generation. Only a node still transport-down stays
-					// skipped.
-					if errors.Is(err, errFullTeardownNotAcked) || !isNodeUnreachable(err) ||
-						classifyNodeLiveness(pingVolumeServer(commandEnv.option.GrpcDialOption, addr)) != nodeDown {
-						return fmt.Errorf("re-clear stale ec shards for volume %d on %s: %w", vid, addr, err)
-					}
-					glog.V(1).Infof("orphan re-sweep: volume %d on %s still skipped (unreachable): %v", vid, addr, err)
-					mu.Lock()
-					stillDown[addr] = struct{}{}
-					mu.Unlock()
-				}
-				return nil
-			})
-		}
-	}
-	if err := ewg.Wait(); err != nil {
-		return err
-	}
-
-	for _, addr := range addrs {
-		if _, down := stillDown[addr]; !down {
-			delete(skipped, addr)
-			glog.V(0).Infof("orphan re-sweep: node %s recovered and was cleaned; it will participate in the EC rebalance", addr)
-		}
-	}
-	return nil
-}
-
-// isNodeUnreachable reports whether err means the volume server could not be
-// reached at all, as opposed to an RPC that reached the node and failed. Only an
-// unreachable node is safe to skip in the orphan sweep. A dead peer surfaces as
-// a gRPC codes.Unavailable from the RPC (the dial is lazy, so it never fails at
-// connect time); any non-status error reached node logic and is treated as
-// reachable, so the sweep stays fatal rather than silently leaving stale state.
-func isNodeUnreachable(err error) bool {
-	if err == nil {
-		return false
-	}
-	st, ok := status.FromError(err)
-	return ok && st.Code() == codes.Unavailable
-}
-
-// nodeLiveness is the tri-state result of a pingVolumeServer probe.
-type nodeLiveness int
-
-const (
-	// nodeUp: Ping succeeded — the node is reachable (e.g. a Rust volume server
-	// in maintenance mode that fails the delete but answers Ping).
-	nodeUp nodeLiveness = iota
-	// nodeDown: Ping itself transport-failed with codes.Unavailable — the node is
-	// confirmed unreachable. The only state the orphan sweep may skip.
-	nodeDown
-	// nodeLivenessUnknown: Ping reached failing logic with any non-Unavailable
-	// code (Internal, ResourceExhausted, Unimplemented from a pre-Ping server, …)
-	// or a non-status error. This does NOT prove the node is down, so it is fatal.
-	nodeLivenessUnknown
-)
-
-// classifyNodeLiveness maps a pingVolumeServer error into the tri-state. A nil
-// error is nodeUp, a transport codes.Unavailable is nodeDown (reusing the same
-// rule as isNodeUnreachable), and every other Ping failure is nodeLivenessUnknown.
-func classifyNodeLiveness(pingErr error) nodeLiveness {
-	if pingErr == nil {
-		return nodeUp
-	}
-	if isNodeUnreachable(pingErr) {
-		return nodeDown
-	}
-	return nodeLivenessUnknown
-}
-
-// collectEcShardBitsByNode returns, for one volume, the EC shard bits each node
-// reports, unioned across all its disk types. Freshly generated shards sit on
-// the disk that held the source .dat, which may differ from the balance target
-// disk type, so visibility questions ("has the master heard about these shards
-// at all?") must not filter by disk type. Only the newest encode generation
-// (largest EncodeTsNs) counts: an orphaned older generation — a failed earlier
-// encode on a node the pre-encode sweep could not reach but the master still
-// hears from — must neither satisfy the registration wait nor pose as a second
-// holder in the clump check. Entries without a timestamp form the legacy
-// generation zero, so they only count when no stamped generation exists;
-// dropping them otherwise errs toward keeping the source volume.
-func collectEcShardBitsByNode(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId) map[pb.ServerAddress]erasure_coding.ShardBits {
-	type shardEntry struct {
-		addr pb.ServerAddress
-		ts   int64
-		bits erasure_coding.ShardBits
-	}
-	var entries []shardEntry
-	var newestTs int64
-	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		for _, diskInfo := range dn.DiskInfos {
-			for _, ecInfo := range diskInfo.EcShardInfos {
-				if ecInfo.Id != uint32(vid) {
-					continue
-				}
-				entries = append(entries, shardEntry{pb.NewServerAddressFromDataNode(dn), ecInfo.EncodeTsNs, erasure_coding.ShardBits(ecInfo.EcIndexBits)})
-				if ecInfo.EncodeTsNs > newestTs {
-					newestTs = ecInfo.EncodeTsNs
-				}
-			}
-		}
-	})
-	res := make(map[pb.ServerAddress]erasure_coding.ShardBits)
-	for _, e := range entries {
-		if e.ts == newestTs {
-			res[e.addr] |= e.bits
-		}
-	}
-	return res
-}
-
-// waitForEcShardsToRegister polls the master topology until every given volume
-// reports a full EC shard set. Mounting shards notifies the master
-// asynchronously (mount -> NewEcShardsChan -> delta heartbeat), so a topology
-// snapshot taken right after doEcEncode can predate the mounts. Failing after
-// the retries keeps the source volumes, and a re-run of ec.encode starts clean.
-func waitForEcShardsToRegister(commandEnv *CommandEnv, volumeIds []needle.VolumeId) error {
-	const maxAttempts = 10
-	const retryInterval = 2 * time.Second
-
-	var lastMissing []string
-	for attempt := 0; attempt < maxAttempts; attempt++ {
-		if attempt > 0 {
-			time.Sleep(retryInterval)
-		}
-		topoInfo, _, err := collectTopologyInfo(commandEnv, 0)
-		if err != nil {
-			return fmt.Errorf("fetch topology while waiting for ec shards to register: %w", err)
-		}
-		lastMissing = lastMissing[:0]
-		for _, vid := range volumeIds {
-			var union erasure_coding.ShardBits
-			for _, bits := range collectEcShardBitsByNode(topoInfo, vid) {
-				union |= bits
-			}
-			if union.Count() < erasure_coding.TotalShardsCount {
-				lastMissing = append(lastMissing, fmt.Sprintf("volume %d: %d/%d shards", vid, union.Count(), erasure_coding.TotalShardsCount))
-			}
-		}
-		if len(lastMissing) == 0 {
-			return nil
-		}
-		glog.V(0).Infof("waiting for newly generated ec shards to register with the master (attempt %d/%d): %v",
-			attempt+1, maxAttempts, lastMissing)
-	}
-	return fmt.Errorf("newly generated ec shards did not register with the master after %d attempts: %v", maxAttempts, lastMissing)
-}
-
-// ecShardsClumpedOnOneNode reports whether every EC shard the master sees for
-// vid sits on a single node while at least one other node has free EC shard
-// slots on the target disk type — i.e. the preceding rebalance could have
-// spread the shards but did not. Zero visible shards is not a clump; the
-// recoverability check owns that case.
-func ecShardsClumpedOnOneNode(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId, diskType types.DiskType) (holder pb.ServerAddress, clumped bool) {
-	byNode := collectEcShardBitsByNode(topoInfo, vid)
-	if len(byNode) != 1 {
-		return "", false
-	}
-	for addr := range byNode {
-		holder = addr
-	}
-	ecNodes, _ := collectEcVolumeServersByDc(topoInfo, "", diskType)
-	for _, en := range ecNodes {
-		if pb.NewServerAddressFromDataNode(en.info) == holder {
-			continue
-		}
-		if en.freeEcSlot > 0 {
-			return holder, true
-		}
-	}
-	return "", false
-}
-
-// ecShardSummaryByNode says where a volume's shards are, one entry per node,
-// sorted so the message is stable. It names the ids and not just the count: a
-// set holding shards 0-9 and one holding 4-13 are both "10 shards", and which
-// ones survived is what says whether the set is recoverable and from where.
-func ecShardSummaryByNode(byNode map[pb.ServerAddress]erasure_coding.ShardBits) []string {
-	summary := make([]string, 0, len(byNode))
-	for node, bits := range byNode {
-		summary = append(summary, fmt.Sprintf("%s=%d shards %v", node, bits.Count(), slices.Collect(bits.All())))
-	}
-	sort.Strings(summary)
-	return summary
-}
-
-func verifyEcShardsBeforeDelete(commandEnv *CommandEnv, volumeIds []needle.VolumeId, diskType types.DiskType, expectSpread bool) error {
-	// Shard relocations from the preceding EC balance reach the master via
-	// volume-server heartbeats, so freshly distributed shards may not all be
-	// visible in the master topology immediately. Poll a few times before
-	// concluding the shard set is incomplete, so a heartbeat-propagation lag is
-	// not mistaken for missing data. After the retries: a volume below the
-	// recoverable threshold (dataShards) aborts the deletion; a recoverable
-	// but degraded set proceeds with a warning, since the missing shards can
-	// be rebuilt from the survivors while keeping the source next to live
-	// shards is the more dangerous mixed state. When expectSpread is set (the
-	// rebalance ran in apply mode), a volume whose shards all still sit on one
-	// node while another node has free slots also aborts the deletion: losing
-	// that node would lose the volume, so the original is the safer copy.
-	const maxAttempts = 10
-	const retryInterval = 2 * time.Second
-
-	var lastErr error
-	var lastDegraded []string
-	var lastClumped []string
-	for attempt := 0; attempt < maxAttempts; attempt++ {
-		topoInfo, _, err := collectTopologyInfo(commandEnv, 0)
-		if err != nil {
-			return fmt.Errorf("fetch topology for shard verification: %w", err)
-		}
-
-		lastErr = nil
-		lastDegraded = lastDegraded[:0]
-		lastClumped = lastClumped[:0]
-		for _, vid := range volumeIds {
-			// Count the shards wherever they landed, as waitForEcShardsToRegister
-			// above already does. generateEcShards writes them beside the source
-			// volume, so encoding a volume that lives on a non-default medium
-			// puts them on that medium while -diskType still says hdd. Counting
-			// only the -diskType bucket then reports a complete set as entirely
-			// missing and aborts an encode that in fact succeeded, leaving the
-			// volume as both a .dat and a full set of shards.
-			byNode := collectEcShardBitsByNode(topoInfo, vid)
-
-			var union erasure_coding.ShardBits
-			for _, bits := range byNode {
-				union |= bits
-			}
-
-			totalShards := erasure_coding.TotalShardsCount
-			degraded, err := erasure_coding.RequireRecoverableShardSet(uint32(vid), union, erasure_coding.DataShardsCount, totalShards)
-			if err != nil {
-				lastErr = fmt.Errorf("volume %d: %w (observed: %v)", vid, err, ecShardSummaryByNode(byNode))
-				break
-			}
-			if expectSpread {
-				if holder, clumped := ecShardsClumpedOnOneNode(topoInfo, vid, diskType); clumped {
-					lastClumped = append(lastClumped, fmt.Sprintf("volume %d: all shards on %s", vid, holder))
-					continue
-				}
-			}
-			if degraded {
-				lastDegraded = append(lastDegraded, fmt.Sprintf("volume %d: %d/%d shards", vid, union.Count(), totalShards))
-				continue
-			}
-
-			glog.V(0).Infof("EC shard verification ok for volume %d: %d/%d shards present across %d nodes",
-				vid, union.Count(), totalShards, len(byNode))
-		}
-
-		if lastErr == nil && len(lastDegraded) == 0 && len(lastClumped) == 0 {
-			return nil
-		}
-		if attempt < maxAttempts-1 {
-			glog.V(0).Infof("EC shard verification incomplete (attempt %d/%d), waiting for shard locations to propagate: %v %v %v",
-				attempt+1, maxAttempts, lastErr, lastDegraded, lastClumped)
-			time.Sleep(retryInterval)
-		}
-	}
-
-	if lastErr != nil {
-		glog.Errorf("EC shard verification failed after %d attempts: %v", maxAttempts, lastErr)
-		return lastErr
-	}
-	if len(lastClumped) > 0 {
-		return fmt.Errorf("EC shards still sit on a single node after rebalance even though other nodes have free slots (%v); keeping the original volumes. Run ec.balance -apply, verify the spread, then delete the originals or re-run ec.encode", lastClumped)
-	}
-	glog.Warningf("EC shard set incomplete but recoverable after %d attempts, proceeding with source deletion (rebuild missing shards with ec.rebuild): %v",
-		maxAttempts, lastDegraded)
-	return nil
-}
-
-// doDeleteVolumesWithLocations deletes volumes using pre-collected location information
-// This avoids race conditions where master metadata is updated after EC encoding
-func doDeleteVolumesWithLocations(commandEnv *CommandEnv, volumeIds []needle.VolumeId, volumeLocationsMap map[needle.VolumeId][]wdclient.Location, maxParallelization int) error {
-	if !commandEnv.isLocked() {
-		return fmt.Errorf("lock is lost")
-	}
-
-	ewg := NewErrorWaitGroup(maxParallelization)
-	for _, vid := range volumeIds {
-		locations, found := volumeLocationsMap[vid]
-		if !found {
-			fmt.Printf("warning: no locations found for volume %d, skipping deletion\n", vid)
-			continue
-		}
-
-		for _, l := range locations {
-			ewg.Add(func() error {
-				if err := deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, vid, l.ServerAddress(), false, false); err != nil {
-					return fmt.Errorf("deleteVolume %s volume %d: %v", l.Url, vid, err)
-				}
-				fmt.Printf("deleted volume %d from %s\n", vid, l.Url)
-				return nil
-			})
-		}
-	}
-	if err := ewg.Wait(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func generateEcShards(grpcDialOption grpc.DialOption, volumeId needle.VolumeId, collection string, sourceVolumeServer pb.ServerAddress) error {
-
-	fmt.Printf("generateEcShards %d (collection %q) on %s ...\n", volumeId, collection, sourceVolumeServer)
-
-	err := operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, genErr := volumeServerClient.VolumeEcShardsGenerate(context.Background(), &volume_server_pb.VolumeEcShardsGenerateRequest{
-			VolumeId:   uint32(volumeId),
-			Collection: collection,
-		})
-		return genErr
-	})
-
-	return err
-
-}
-
 func collectVolumeIdsForEcEncode(commandEnv *CommandEnv, collectionPattern string, sourceDiskType *types.DiskType, fullPercentage float64, quietPeriod time.Duration, verbose bool) (vids []needle.VolumeId, matchedCollections []string, err error) {
 	// compile regex pattern for collection matching
-	collectionRegex, err := compileCollectionPattern(collectionPattern)
+	collectionMatcher, err := compileCollectionPattern(collectionPattern)
 	if err != nil {
 		return nil, nil, fmt.Errorf("invalid collection pattern '%s': %v", collectionPattern, err)
 	}
@@ -967,151 +215,6 @@ func collectVolumeIdsForEcEncode(commandEnv *CommandEnv, collectionPattern strin
 
 	fmt.Printf("collect volumes with collection pattern '%s', quiet for: %d seconds and %.1f%% full\n", collectionPattern, quietSeconds, fullPercentage)
 
-	vids, matchedCollections = selectVolumeIdsFromTopology(topologyInfo, volumeSizeLimitMb, collectionRegex, sourceDiskType, quietSeconds, nowUnixSeconds, fullPercentage, verbose)
-	return
-}
-
-func selectVolumeIdsFromTopology(topologyInfo *master_pb.TopologyInfo, volumeSizeLimitMb uint64, collectionRegex *regexp.Regexp, sourceDiskType *types.DiskType, quietSeconds int64, nowUnixSeconds int64, fullPercentage float64, verbose bool) (vids []needle.VolumeId, matchedCollections []string) {
-	// Statistics for verbose mode
-	var (
-		totalVolumes    int
-		remoteVolumes   int
-		wrongCollection int
-		wrongDiskType   int
-		tooRecent       int
-		tooSmall        int
-		noFreeDisk      int
-	)
-
-	vidMap := make(map[uint32]bool)
-	collectionSet := make(map[string]bool)
-	eachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
-		for _, diskInfo := range dn.DiskInfos {
-			for _, v := range diskInfo.VolumeInfos {
-				totalVolumes++
-
-				// ignore remote volumes
-				if v.RemoteStorageName != "" && v.RemoteStorageKey != "" {
-					remoteVolumes++
-					if verbose {
-						fmt.Printf("skip volume %d on %s: remote volume (storage: %s, key: %s)\n",
-							v.Id, dn.Id, v.RemoteStorageName, v.RemoteStorageKey)
-					}
-					continue
-				}
-
-				// check collection against regex pattern
-				if !collectionRegex.MatchString(v.Collection) {
-					wrongCollection++
-					if verbose {
-						fmt.Printf("skip volume %d on %s: collection doesn't match pattern (pattern: %s, actual: %s)\n",
-							v.Id, dn.Id, collectionRegex.String(), v.Collection)
-					}
-					continue
-				}
-
-				// track matched collection
-				collectionSet[v.Collection] = true
-
-				// check disk type
-				if sourceDiskType != nil && types.ToDiskType(v.DiskType) != *sourceDiskType {
-					wrongDiskType++
-					if verbose {
-						fmt.Printf("skip volume %d on %s: wrong disk type (expected: %s, actual: %s)\n",
-							v.Id, dn.Id, sourceDiskType.ReadableString(), types.ToDiskType(v.DiskType).ReadableString())
-					}
-					continue
-				}
-
-				// check quiet period
-				if v.ModifiedAtSecond+quietSeconds >= nowUnixSeconds {
-					tooRecent++
-					if verbose {
-						fmt.Printf("skip volume %d on %s: too recently modified (last modified: %d seconds ago, required: %d seconds)\n",
-							v.Id, dn.Id, nowUnixSeconds-v.ModifiedAtSecond, quietSeconds)
-					}
-					continue
-				}
-
-				// check size
-				sizeThreshold := fullPercentage / 100 * float64(volumeSizeLimitMb) * 1024 * 1024
-				if float64(v.Size) <= sizeThreshold {
-					tooSmall++
-					if verbose {
-						fmt.Printf("skip volume %d on %s: too small (size: %.1f MB, threshold: %.1f MB, %.1f%% full)\n",
-							v.Id, dn.Id, float64(v.Size)/(1024*1024), sizeThreshold/(1024*1024),
-							float64(v.Size)*100/(float64(volumeSizeLimitMb)*1024*1024))
-					}
-					continue
-				}
-
-				// check free disk space
-				if diskInfo.FreeVolumeCount < 2 {
-					glog.V(0).Infof("replica %s %d on %s has no free disk", v.Collection, v.Id, dn.Id)
-					if verbose {
-						fmt.Printf("skip replica of volume %d on %s: insufficient free disk space (free volumes: %d, required: 2)\n",
-							v.Id, dn.Id, diskInfo.FreeVolumeCount)
-					}
-					if _, found := vidMap[v.Id]; !found {
-						vidMap[v.Id] = false
-					}
-				} else {
-					if verbose {
-						fmt.Printf("selected volume %d on %s: size %.1f MB (%.1f%% full), last modified %d seconds ago, free volumes: %d\n",
-							v.Id, dn.Id, float64(v.Size)/(1024*1024),
-							float64(v.Size)*100/(float64(volumeSizeLimitMb)*1024*1024),
-							nowUnixSeconds-v.ModifiedAtSecond, diskInfo.FreeVolumeCount)
-					}
-					vidMap[v.Id] = true
-				}
-			}
-		}
-	})
-
-	for vid, good := range vidMap {
-		if good {
-			vids = append(vids, needle.VolumeId(vid))
-		} else {
-			noFreeDisk++
-		}
-	}
-
-	// Convert collection set to slice
-	for collection := range collectionSet {
-		matchedCollections = append(matchedCollections, collection)
-	}
-	sort.Strings(matchedCollections)
-
-	// Print summary statistics in verbose mode or when no volumes selected
-	if verbose || len(vids) == 0 {
-		fmt.Printf("\nVolume selection summary:\n")
-		fmt.Printf("  Total volumes examined: %d\n", totalVolumes)
-		fmt.Printf("  Selected for encoding: %d\n", len(vids))
-		fmt.Printf("  Collections matched: %v\n", matchedCollections)
-
-		if totalVolumes > 0 {
-			fmt.Printf("\nReasons for exclusion:\n")
-			if remoteVolumes > 0 {
-				fmt.Printf("  Remote volumes: %d\n", remoteVolumes)
-			}
-			if wrongCollection > 0 {
-				fmt.Printf("  Collection doesn't match pattern: %d\n", wrongCollection)
-			}
-			if wrongDiskType > 0 {
-				fmt.Printf("  Wrong disk type: %d\n", wrongDiskType)
-			}
-			if tooRecent > 0 {
-				fmt.Printf("  Too recently modified: %d\n", tooRecent)
-			}
-			if tooSmall > 0 {
-				fmt.Printf("  Too small (< %.1f%% full): %d\n", fullPercentage, tooSmall)
-			}
-			if noFreeDisk > 0 {
-				fmt.Printf("  Insufficient free disk space: %d\n", noFreeDisk)
-			}
-		}
-		fmt.Println()
-	}
-
+	vids, matchedCollections = ec.SelectVolumeIdsFromTopology(topologyInfo, volumeSizeLimitMb, collectionMatcher, sourceDiskType, quietSeconds, nowUnixSeconds, fullPercentage, verbose)
 	return
 }
diff --git a/weed/shell/command_ec_rebuild.go b/weed/shell/command_ec_rebuild.go
index a18bcddc6e..51f810a56a 100644
--- a/weed/shell/command_ec_rebuild.go
+++ b/weed/shell/command_ec_rebuild.go
@@ -1,40 +1,22 @@
 package shell
 
 import (
-	"context"
 	"flag"
 	"fmt"
 	"io"
-	"slices"
 	"strconv"
 	"strings"
-	"sync"
 
-	"github.com/seaweedfs/seaweedfs/weed/operation"
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 )
 
 func init() {
 	Commands = append(Commands, &commandEcRebuild{})
 }
 
-type ecRebuilder struct {
-	commandEnv   *CommandEnv
-	ecNodes      []*EcNode
-	writer       io.Writer
-	applyChanges bool
-	collections  []string
-	volumeIds    []needle.VolumeId
-	diskType     types.DiskType
-
-	ewg       *ErrorWaitGroup
-	ecNodesMu sync.Mutex
-}
-
 type commandEcRebuild struct {
 }
 
@@ -92,7 +74,7 @@ func (c *commandEcRebuild) HasTag(CommandTag) bool {
 func (c *commandEcRebuild) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
 
 	fixCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
-	collection := fixCommand.String("collection", "EACH_COLLECTION", "collection name, or \"EACH_COLLECTION\" for each collection")
+	collection := fixCommand.String("collection", string(wildcard.CollectionFilterEach), "comma-separated collection names, wildcards, or regex patterns, \""+CollectionDefault+"\" for the collection with no name, or \""+string(wildcard.CollectionFilterEach)+"\" for each collection")
 	volumeIdsStr := fixCommand.String("volumeIds", "", "optional comma-separated list of volume ID to process; defaults to all volumes in the collection")
 	maxParallelization := fixCommand.Int("maxParallelization", DefaultMaxParallelization, "run up to X tasks in parallel, whenever possible")
 	applyChanges := fixCommand.Bool("apply", false, "apply the changes")
@@ -117,14 +99,9 @@ func (c *commandEcRebuild) Do(args []string, commandEnv *CommandEnv, writer io.W
 		return err
 	}
 
-	var collections []string
-	if *collection == "EACH_COLLECTION" {
-		collections, err = ListCollectionNames(commandEnv, false, true)
-		if err != nil {
-			return err
-		}
-	} else {
-		collections = []string{*collection}
+	collections, err := resolveEcCollections(commandEnv, *collection)
+	if err != nil {
+		return err
 	}
 
 	var volumeIds []needle.VolumeId
@@ -142,401 +119,5 @@ func (c *commandEcRebuild) Do(args []string, commandEnv *CommandEnv, writer io.W
 		}
 	}
 
-	erb := &ecRebuilder{
-		commandEnv:   commandEnv,
-		ecNodes:      allEcNodes,
-		writer:       writer,
-		applyChanges: *applyChanges,
-		collections:  collections,
-		volumeIds:    volumeIds,
-		diskType:     diskType,
-
-		ewg: NewErrorWaitGroup(*maxParallelization),
-	}
-
-	// Recover shards left unmounted by a missing .ecx index before planning: such
-	// shards never register with the master, so the rebuild below would treat the
-	// volume as short or unrepairable even though its data is intact (issue #10104).
-	erb.recoverMissingIndexes()
-
-	fmt.Printf("rebuildEcVolumes for %d collection(s)\n", len(collections))
-	for _, c := range collections {
-		erb.rebuildEcVolumes(c)
-	}
-
-	return erb.ewg.Wait()
-}
-
-func (erb *ecRebuilder) write(format string, a ...any) {
-	fmt.Fprintf(erb.writer, format, a...)
-}
-
-func (erb *ecRebuilder) isLocked() bool {
-	return erb.commandEnv.isLocked()
-}
-
-// matchesVolumeId verifies whether the rebuilder is targeted at a given volume ID.
-func (erb *ecRebuilder) matchesVolumeId(vid needle.VolumeId) bool {
-	if len(erb.volumeIds) == 0 {
-		return true
-	}
-
-	return slices.Contains(erb.volumeIds, vid)
-}
-
-// countLocalShards returns the number of shards already present locally on the node for the given volume.
-// Unions across all of the node's disks, like prepareDataToRecover, so slot
-// accounting matches what the rebuild will actually treat as local.
-func (erb *ecRebuilder) countLocalShards(node *EcNode, collection string, volumeId needle.VolumeId) int {
-	localShardsInfo := erasure_coding.NewShardsInfo()
-	for _, diskInfo := range node.info.DiskInfos {
-		for _, ecShardInfo := range diskInfo.EcShardInfos {
-			if ecShardInfo.Collection == collection && needle.VolumeId(ecShardInfo.Id) == volumeId {
-				localShardsInfo.Add(erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecShardInfo))
-			}
-		}
-	}
-	return localShardsInfo.Count()
-}
-
-// selectAndReserveRebuilder atomically selects a rebuilder node with sufficient free slots
-// and reserves slots only for the non-local shards that need to be copied/generated.
-func (erb *ecRebuilder) selectAndReserveRebuilder(collection string, volumeId needle.VolumeId) (*EcNode, int, error) {
-	erb.ecNodesMu.Lock()
-	defer erb.ecNodesMu.Unlock()
-
-	if len(erb.ecNodes) == 0 {
-		return nil, 0, fmt.Errorf("no ec nodes available")
-	}
-
-	// Find the node with the most free slots, considering local shards
-	var bestNode *EcNode
-	var bestSlotsNeeded int
-	var maxAvailableSlots int
-	var minSlotsNeeded int = erasure_coding.TotalShardsCount // Start with maximum possible
-	for _, node := range erb.ecNodes {
-		localShards := erb.countLocalShards(node, collection, volumeId)
-		slotsNeeded := erasure_coding.TotalShardsCount - localShards
-		if slotsNeeded < 0 {
-			slotsNeeded = 0
-		}
-
-		if node.freeEcSlot > maxAvailableSlots {
-			maxAvailableSlots = node.freeEcSlot
-		}
-
-		if slotsNeeded < minSlotsNeeded {
-			minSlotsNeeded = slotsNeeded
-		}
-
-		if node.freeEcSlot >= slotsNeeded {
-			if bestNode == nil || node.freeEcSlot > bestNode.freeEcSlot {
-				bestNode = node
-				bestSlotsNeeded = slotsNeeded
-			}
-		}
-	}
-
-	if bestNode == nil {
-		return nil, 0, fmt.Errorf("no node has sufficient free slots for volume %d (need at least %d slots, max available: %d)",
-			volumeId, minSlotsNeeded, maxAvailableSlots)
-	}
-
-	// Reserve slots only for non-local shards
-	bestNode.freeEcSlot -= bestSlotsNeeded
-
-	return bestNode, bestSlotsNeeded, nil
-}
-
-// releaseRebuilder releases the reserved slots back to the rebuilder node.
-func (erb *ecRebuilder) releaseRebuilder(node *EcNode, slotsToRelease int) {
-	erb.ecNodesMu.Lock()
-	defer erb.ecNodesMu.Unlock()
-
-	// Release slots by incrementing the free slot count
-	node.freeEcSlot += slotsToRelease
-}
-
-func (erb *ecRebuilder) rebuildEcVolumes(collection string) {
-	fmt.Printf("rebuildEcVolumes for %q\n", collection)
-
-	// collect vid => each shard locations, similar to ecShardMap in topology.go
-	ecShardMap := make(EcShardMap)
-	erb.ecNodesMu.Lock()
-	for _, ecNode := range erb.ecNodes {
-		ecShardMap.registerEcNode(ecNode, collection)
-	}
-	erb.ecNodesMu.Unlock()
-
-	for vid, locations := range ecShardMap {
-		if !erb.matchesVolumeId(vid) {
-			continue
-		}
-		shardCount := locations.shardCount()
-		if shardCount == erasure_coding.TotalShardsCount {
-			continue
-		}
-		if shardCount < erasure_coding.DataShardsCount {
-			erb.write("ec volume %d is unrepairable with %d shards (need %d), skipping\n", vid, shardCount, erasure_coding.DataShardsCount)
-			continue
-		}
-
-		// Capture variables for closure
-		vid := vid
-		locations := locations
-
-		erb.ewg.Add(func() error {
-			// Select rebuilder and reserve slots atomically per volume
-			rebuilder, slotsToReserve, err := erb.selectAndReserveRebuilder(collection, vid)
-			if err != nil {
-				return fmt.Errorf("failed to select rebuilder for volume %d: %v", vid, err)
-			}
-			defer erb.releaseRebuilder(rebuilder, slotsToReserve)
-
-			return erb.rebuildOneEcVolume(collection, vid, locations, rebuilder)
-		})
-	}
-}
-
-// recoverMissingIndexes asks every ec node to fetch a missing .ecx index from a
-// peer and mount the on-disk shards it could not load on its own. Shards
-// orphaned this way (index only on another server) are absent from the master
-// topology, so without this pass ec.rebuild would regenerate or give up on
-// shards whose data is actually present — and a volume whose every holder lacks
-// the index would not appear in the topology at all. Each node therefore
-// recovers all of its on-disk orphans (volume_id 0); an explicit -volumeIds
-// list narrows that to the requested volumes. On apply it refreshes the topology
-// so the rebuild planning sees the recovered shards (issue #10104).
-func (erb *ecRebuilder) recoverMissingIndexes() {
-	erb.ecNodesMu.Lock()
-	nodes := append([]*EcNode(nil), erb.ecNodes...)
-	erb.ecNodesMu.Unlock()
-	if len(nodes) == 0 {
-		return
-	}
-
-	// volume_id 0 means "recover every orphan on the node"; a -volumeIds list
-	// narrows recovery to those ids (each scanned across collections server-side).
-	vids := erb.volumeIds
-	if len(vids) == 0 {
-		vids = []needle.VolumeId{0}
-	}
-
-	if !erb.applyChanges {
-		erb.write("would ask %d ec node(s) to recover EC shards left unmounted by a missing .ecx index\n", len(nodes))
-		return
-	}
-
-	for _, node := range nodes {
-		for _, vid := range vids {
-			err := operation.WithVolumeServerClient(false, pb.NewServerAddressFromDataNode(node.info), erb.commandEnv.option.GrpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
-				_, mountErr := client.VolumeEcShardsMount(context.Background(), &volume_server_pb.VolumeEcShardsMountRequest{
-					VolumeId:            uint32(vid),
-					RecoverMissingIndex: true,
-				})
-				return mountErr
-			})
-			if err != nil {
-				erb.write("%s recover missing index (volume %d): %v\n", node.info.Id, vid, err)
-			}
-		}
-	}
-
-	// Refresh topology so the rebuild planning sees shards the recovery registered.
-	refreshed, _, err := collectEcNodes(erb.commandEnv, erb.diskType)
-	if err != nil {
-		erb.write("failed to refresh ec nodes after index recovery: %v\n", err)
-		return
-	}
-	erb.ecNodesMu.Lock()
-	erb.ecNodes = refreshed
-	erb.ecNodesMu.Unlock()
-}
-
-func (erb *ecRebuilder) rebuildOneEcVolume(collection string, volumeId needle.VolumeId, locations EcShardLocations, rebuilder *EcNode) error {
-	if !erb.isLocked() {
-		return fmt.Errorf("lock is lost")
-	}
-
-	fmt.Printf("rebuildOneEcVolume %s %d\n", collection, volumeId)
-
-	// collect shard files to rebuilder local disk
-	var generatedShardIds []erasure_coding.ShardId
-	copiedShardIds, _, err := erb.prepareDataToRecover(rebuilder, collection, volumeId, locations)
-	defer func() {
-		// Clean up the working copies this run actually made, even when the
-		// recoverability gate failed after some copies already succeeded:
-		// they are temp files on the rebuilder nothing else reclaims. Dry-run
-		// copies nothing (copiedShardIds is empty), so this issues no delete
-		// RPC. Use a local error so a cleanup failure cannot mask the return.
-		if !erb.applyChanges || len(copiedShardIds) == 0 {
-			return
-		}
-		if derr := sourceServerDeleteEcShards(erb.commandEnv.option.GrpcDialOption, collection, volumeId, pb.NewServerAddressFromDataNode(rebuilder.info), copiedShardIds); derr != nil {
-			erb.write("%s delete copied ec shards %s %d.%v: %v\n", rebuilder.info.Id, collection, volumeId, copiedShardIds, derr)
-		}
-	}()
-	if err != nil {
-		return err
-	}
-
-	if !erb.applyChanges {
-		return nil
-	}
-
-	// generate ec shards, and maybe ecx file
-	generatedShardIds, err = erb.generateMissingShards(collection, volumeId, pb.NewServerAddressFromDataNode(rebuilder.info))
-	if err != nil {
-		return err
-	}
-
-	// mount the generated shards
-	err = mountEcShards(erb.commandEnv.option.GrpcDialOption, collection, volumeId, pb.NewServerAddressFromDataNode(rebuilder.info), generatedShardIds)
-	if err != nil {
-		return err
-	}
-
-	// ensure ECNode updates are atomic
-	erb.ecNodesMu.Lock()
-	defer erb.ecNodesMu.Unlock()
-	rebuilder.addEcVolumeShards(volumeId, collection, generatedShardIds, erb.diskType)
-
-	return nil
-}
-
-func (erb *ecRebuilder) generateMissingShards(collection string, volumeId needle.VolumeId, sourceLocation pb.ServerAddress) (rebuiltShardIds []erasure_coding.ShardId, err error) {
-
-	err = operation.WithVolumeServerClient(false, sourceLocation, erb.commandEnv.option.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		resp, rebuildErr := volumeServerClient.VolumeEcShardsRebuild(context.Background(), &volume_server_pb.VolumeEcShardsRebuildRequest{
-			VolumeId:   uint32(volumeId),
-			Collection: collection,
-		})
-		if rebuildErr == nil {
-			rebuiltShardIds = erasure_coding.Uint32ToShardIds(resp.RebuiltShardIds)
-		}
-		return rebuildErr
-	})
-	return
-}
-
-func (erb *ecRebuilder) prepareDataToRecover(rebuilder *EcNode, collection string, volumeId needle.VolumeId, locations EcShardLocations) (copiedShardIds []erasure_coding.ShardId, localShardIds []erasure_coding.ShardId, err error) {
-
-	needEcxFile := true
-	localShardsInfo := erasure_coding.NewShardsInfo()
-	for _, diskInfo := range rebuilder.info.DiskInfos {
-		for _, ecShardInfo := range diskInfo.EcShardInfos {
-			if ecShardInfo.Collection == collection && needle.VolumeId(ecShardInfo.Id) == volumeId {
-				needEcxFile = false
-				// Union across disks: the rebuilder may hold this volume's
-				// shards on more than one disk. Overwriting per-disk would
-				// make a shard on a non-last disk look remote and get copied
-				// onto itself (O_TRUNC) and then node-wide deleted.
-				localShardsInfo.Add(erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(ecShardInfo))
-			}
-		}
-	}
-
-	targetShardCount := erasure_coding.TotalShardsCount
-	for i := erasure_coding.TotalShardsCount; i < len(locations); i++ {
-		if len(locations[i]) > 0 {
-			targetShardCount = i + 1
-		}
-	}
-
-	// recoverableRemoteShards counts remote shards that can contribute to the
-	// rebuild. Dry-run counts the plan; apply mode counts only successful copies.
-	recoverableRemoteShards := 0
-	for i := 0; i < targetShardCount; i++ {
-		ecNodes := locations[i]
-		shardId := erasure_coding.ShardId(i)
-		if len(ecNodes) == 0 {
-			erb.write("missing shard %d.%d\n", volumeId, shardId)
-			continue
-		}
-
-		if localShardsInfo.Has(shardId) {
-			localShardIds = append(localShardIds, shardId)
-			erb.write("use existing shard %d.%d\n", volumeId, shardId)
-			continue
-		}
-
-		// The rebuilder is itself the only listed holder: never copy a shard
-		// onto itself (the in-place O_TRUNC would destroy it) nor schedule it
-		// for the post-rebuild delete. Treat it as already local.
-		if ecNodes[0].info.Id == rebuilder.info.Id {
-			localShardIds = append(localShardIds, shardId)
-			erb.write("use existing shard %d.%d (already on rebuilder)\n", volumeId, shardId)
-			continue
-		}
-
-		if !erb.applyChanges {
-			recoverableRemoteShards++
-			erb.write("would copy %d.%d from %s\n", volumeId, shardId, ecNodes[0].info.Id)
-			continue
-		}
-
-		copyErr := operation.WithVolumeServerClient(false, pb.NewServerAddressFromDataNode(rebuilder.info), erb.commandEnv.option.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-			_, copyErr := volumeServerClient.VolumeEcShardsCopy(context.Background(), &volume_server_pb.VolumeEcShardsCopyRequest{
-				VolumeId:       uint32(volumeId),
-				Collection:     collection,
-				ShardIds:       []uint32{uint32(shardId)},
-				CopyEcxFile:    needEcxFile,
-				CopyEcjFile:    true,
-				CopyVifFile:    needEcxFile,
-				SourceDataNode: string(pb.NewServerAddressFromDataNode(ecNodes[0].info)),
-			})
-			return copyErr
-		})
-		if copyErr != nil {
-			erb.write("%s failed to copy %d.%d from %s: %v\n", rebuilder.info.Id, volumeId, shardId, ecNodes[0].info.Id, copyErr)
-			continue
-		}
-		recoverableRemoteShards++
-		if needEcxFile {
-			needEcxFile = false
-		}
-		erb.write("%s copied %d.%d from %s\n", rebuilder.info.Id, volumeId, shardId, ecNodes[0].info.Id)
-		// Only shards this run actually copied are temp working files to be
-		// deleted afterward; never a pre-existing local or remote shard.
-		copiedShardIds = append(copiedShardIds, shardId)
-	}
-
-	if len(localShardIds)+recoverableRemoteShards >= erasure_coding.DataShardsCount {
-		return copiedShardIds, localShardIds, nil
-	}
-
-	// Hand back what was copied so the caller deletes these orphaned working
-	// shards: recovery failed, but the temp files are already on the rebuilder.
-	return copiedShardIds, localShardIds, fmt.Errorf("%d shards are not enough to recover volume %d", len(localShardIds)+recoverableRemoteShards, volumeId)
-
-}
-
-type EcShardMap map[needle.VolumeId]EcShardLocations
-type EcShardLocations [][]*EcNode
-
-func (ecShardMap EcShardMap) registerEcNode(ecNode *EcNode, collection string) {
-	for _, diskInfo := range ecNode.info.DiskInfos {
-		for _, shardInfo := range diskInfo.EcShardInfos {
-			if shardInfo.Collection == collection {
-				existing, found := ecShardMap[needle.VolumeId(shardInfo.Id)]
-				if !found {
-					// Use MaxShardCount (32) to support custom EC ratios
-					existing = make([][]*EcNode, erasure_coding.MaxShardCount)
-					ecShardMap[needle.VolumeId(shardInfo.Id)] = existing
-				}
-				for _, shardId := range erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(shardInfo).Ids() {
-					existing[shardId] = append(existing[shardId], ecNode)
-				}
-			}
-		}
-	}
-}
-
-func (ecShardLocations EcShardLocations) shardCount() (count int) {
-	for _, locations := range ecShardLocations {
-		if len(locations) > 0 {
-			count++
-		}
-	}
-	return
+	return ec.RebuildEcVolumes(commandEnv.ecEnv(), allEcNodes, writer, collections, volumeIds, diskType, *maxParallelization, *applyChanges)
 }
diff --git a/weed/shell/command_ec_scrub.go b/weed/shell/command_ec_scrub.go
index 13b6897ab8..13414fba3e 100644
--- a/weed/shell/command_ec_scrub.go
+++ b/weed/shell/command_ec_scrub.go
@@ -1,18 +1,15 @@
 package shell
 
 import (
-	"context"
 	"flag"
 	"fmt"
 	"io"
 	"strconv"
 	"strings"
-	"sync"
 
-	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
-	"google.golang.org/grpc"
 )
 
 func init() {
@@ -20,12 +17,6 @@ func init() {
 }
 
 type commandEcVolumeScrub struct {
-	env                      *CommandEnv
-	volumeServerAddrs        []pb.ServerAddress
-	volumeIDs                []uint32
-	mode                     volume_server_pb.VolumeScrubMode
-	forceDeletedNeedlesCheck bool
-	grpcDialOption           grpc.DialOption
 }
 
 func (c *commandEcVolumeScrub) Name() string {
@@ -50,10 +41,10 @@ func (c *commandEcVolumeScrub) Do(args []string, commandEnv *CommandEnv, writer
 	volScrubCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	nodesStr := volScrubCommand.String("node", "", "comma-separated list of volume server <host>:<port> (optional)")
 	volumeIDsStr := volScrubCommand.String("volumeId", "", "comma-separated EC volume IDs to process (optional)")
-	mode := volScrubCommand.String("mode", "local", "scrubbing mode (index/local/full/checksum)")
+	mode := volScrubCommand.String("mode", "local", "scrubbing mode (index/local/full/reads/checksum)")
 	maxParallelization := volScrubCommand.Int("maxParallelization", DefaultMaxParallelization, "run up to X tasks in parallel, whenever possible")
 	showDetails := volScrubCommand.Bool("details", false, "display scrub result details, if available")
-	forceDeletedNeedlesCheck := volScrubCommand.Bool("forceDeletedNeedlesCheck", false, "force strict verification of deleted needles (full mode only); may report false positives when EC indexes disagree")
+	forceDeletedNeedlesCheck := volScrubCommand.Bool("forceDeletedNeedlesCheck", false, "force strict verification of deleted needles (full and reads modes only); may report false positives when EC indexes disagree")
 
 	if err = volScrubCommand.Parse(args); err != nil {
 		return err
@@ -62,10 +53,14 @@ func (c *commandEcVolumeScrub) Do(args []string, commandEnv *CommandEnv, writer
 		return
 	}
 
-	c.volumeServerAddrs = []pb.ServerAddress{}
+	volumeServerAddrs := []pb.ServerAddress{}
 	if *nodesStr != "" {
 		for _, addr := range strings.Split(*nodesStr, ",") {
-			c.volumeServerAddrs = append(c.volumeServerAddrs, pb.ServerAddress(addr))
+			addr = strings.TrimSpace(addr)
+			if addr == "" {
+				continue
+			}
+			volumeServerAddrs = append(volumeServerAddrs, pb.ServerAddress(addr))
 		}
 	} else {
 		dns, err := collectDataNodes(commandEnv, 0)
@@ -73,11 +68,11 @@ func (c *commandEcVolumeScrub) Do(args []string, commandEnv *CommandEnv, writer
 			return err
 		}
 		for _, dn := range dns {
-			c.volumeServerAddrs = append(c.volumeServerAddrs, pb.ServerAddress(dn.Address))
+			volumeServerAddrs = append(volumeServerAddrs, pb.ServerAddress(dn.Address))
 		}
 	}
 
-	c.volumeIDs = []uint32{}
+	volumeIDs := []uint32{}
 	if *volumeIDsStr != "" {
 		for _, vids := range strings.Split(*volumeIDsStr, ",") {
 			vids = strings.TrimSpace(vids)
@@ -85,96 +80,33 @@ func (c *commandEcVolumeScrub) Do(args []string, commandEnv *CommandEnv, writer
 				continue
 			}
 			if vid, err := strconv.ParseUint(vids, 10, 32); err == nil {
-				c.volumeIDs = append(c.volumeIDs, uint32(vid))
+				volumeIDs = append(volumeIDs, uint32(vid))
 			} else {
 				return fmt.Errorf("invalid volume ID %q", vids)
 			}
 		}
 	}
 
+	var scrubMode volume_server_pb.VolumeScrubMode
 	switch strings.ToUpper(*mode) {
 	case "INDEX":
-		c.mode = volume_server_pb.VolumeScrubMode_INDEX
+		scrubMode = volume_server_pb.VolumeScrubMode_INDEX
 	case "LOCAL":
-		c.mode = volume_server_pb.VolumeScrubMode_LOCAL
+		scrubMode = volume_server_pb.VolumeScrubMode_LOCAL
 	case "FULL":
-		c.mode = volume_server_pb.VolumeScrubMode_FULL
+		scrubMode = volume_server_pb.VolumeScrubMode_FULL
 	case "CHECKSUM":
-		c.mode = volume_server_pb.VolumeScrubMode_CHECKSUM
+		scrubMode = volume_server_pb.VolumeScrubMode_CHECKSUM
+	case "READS":
+		scrubMode = volume_server_pb.VolumeScrubMode_READS
 	default:
 		return fmt.Errorf("unsupported scrubbing mode %q", *mode)
 	}
-	fmt.Fprintf(writer, "using %s mode\n", c.mode.String())
-	c.env = commandEnv
-	c.forceDeletedNeedlesCheck = *forceDeletedNeedlesCheck
-	if c.forceDeletedNeedlesCheck && c.mode != volume_server_pb.VolumeScrubMode_FULL {
-		return fmt.Errorf("deleted needle checks are only supported for FULL scrubs")
+	fmt.Fprintf(writer, "using %s mode\n", scrubMode.String())
+	if *forceDeletedNeedlesCheck &&
+		scrubMode != volume_server_pb.VolumeScrubMode_FULL && scrubMode != volume_server_pb.VolumeScrubMode_READS {
+		return fmt.Errorf("deleted needle checks are only supported for FULL and READS scrubs")
 	}
 
-	return c.scrubEcVolumes(writer, *maxParallelization, *showDetails)
-}
-
-func (c *commandEcVolumeScrub) scrubEcVolumes(writer io.Writer, maxParallelization int, showDetails bool) error {
-	var brokenVolumesStr, brokenShardsStr []string
-	var details []string
-	var totalVolumes, brokenVolumes, brokenShards, totalFiles uint64
-	var mu sync.Mutex
-
-	ewg := NewErrorWaitGroup(maxParallelization)
-	count := 0
-	for _, addr := range c.volumeServerAddrs {
-		ewg.Add(func() error {
-			mu.Lock()
-			count++
-			fmt.Fprintf(writer, "Scrubbing %s (%d/%d)...\n", addr.String(), count, len(c.volumeServerAddrs))
-			mu.Unlock()
-
-			err := operation.WithVolumeServerClient(false, addr, c.env.option.GrpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-				res, err := volumeServerClient.ScrubEcVolume(context.Background(), &volume_server_pb.ScrubEcVolumeRequest{
-					Mode:                     c.mode,
-					VolumeIds:                c.volumeIDs,
-					ForceDeletedNeedlesCheck: c.forceDeletedNeedlesCheck,
-				})
-				if err != nil {
-					return err
-				}
-
-				mu.Lock()
-				defer mu.Unlock()
-
-				totalVolumes += res.GetTotalVolumes()
-				totalFiles += res.GetTotalFiles()
-				brokenVolumes += uint64(len(res.GetBrokenVolumeIds()))
-				brokenShards += uint64(len(res.GetBrokenShardInfos()))
-				for _, d := range res.GetDetails() {
-					details = append(details, fmt.Sprintf("[%s] %s", addr, d))
-				}
-				for _, vid := range res.GetBrokenVolumeIds() {
-					brokenVolumesStr = append(brokenVolumesStr, fmt.Sprintf("%s:%v", addr, vid))
-				}
-				for _, si := range res.GetBrokenShardInfos() {
-					brokenShardsStr = append(brokenShardsStr, fmt.Sprintf("%s:%v:%v", addr, si.VolumeId, si.ShardId))
-				}
-
-				return nil
-			})
-			return err
-		})
-	}
-	if err := ewg.Wait(); err != nil {
-		return err
-	}
-
-	fmt.Fprintf(writer, "Scrubbed %d EC files and %d volumes on %d nodes\n", totalFiles, totalVolumes, len(c.volumeServerAddrs))
-	if brokenVolumes != 0 {
-		fmt.Fprintf(writer, "\nGot scrub failures on %d EC volumes and %d EC shards :(\n", brokenVolumes, brokenShards)
-		fmt.Fprintf(writer, "Affected volumes: %s\n", strings.Join(brokenVolumesStr, ", "))
-		if len(brokenShardsStr) != 0 {
-			fmt.Fprintf(writer, "Affected shards:  %s\n", strings.Join(brokenShardsStr, ", "))
-		}
-		if showDetails && len(details) != 0 {
-			fmt.Fprintf(writer, "Details:\n\t%s\n", strings.Join(details, "\n\t"))
-		}
-	}
-	return nil
+	return ec.ScrubEcVolumes(commandEnv.ecEnv(), writer, volumeServerAddrs, volumeIDs, scrubMode, *forceDeletedNeedlesCheck, *maxParallelization, *showDetails)
 }
diff --git a/weed/shell/command_ec_shard_unmount.go b/weed/shell/command_ec_shard_unmount.go
index ee2659049a..debffee547 100644
--- a/weed/shell/command_ec_shard_unmount.go
+++ b/weed/shell/command_ec_shard_unmount.go
@@ -1,76 +1,19 @@
 package shell
 
 import (
-	"context"
 	"flag"
 	"fmt"
 	"io"
 	"math"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
 
-	"github.com/seaweedfs/seaweedfs/weed/operation"
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 )
 
-const (
-	ecShardActionTimeout = 1 * time.Minute
-)
-
-type ecShard struct {
-	ShardID     uint32
-	Collection  string
-	NodeAddress string
-}
-
-func (s *ecShard) String() string {
-	if s.NodeAddress == "" {
-		return fmt.Sprintf("%d", s.ShardID)
-	}
-	return fmt.Sprintf("%d@%s", s.ShardID, s.NodeAddress)
-}
-
-func ecShardsFromString(shards string) ([]*ecShard, error) {
-	res := []*ecShard{}
-
-	for _, s := range strings.Split(shards, ",") {
-		s = strings.TrimSpace(s)
-		if s == "" {
-			return nil, fmt.Errorf("empty shard ID in %q", shards)
-		}
-
-		// optional <shard ID>@<node address> to pick one copy
-		idStr, addr, _ := strings.Cut(s, "@")
-
-		id, err := strconv.Atoi(idStr)
-		if err != nil || id < 0 || id >= erasure_coding.MaxShardCount {
-			return nil, fmt.Errorf("invalid shard ID %q", s)
-		}
-
-		res = append(res, &ecShard{ShardID: uint32(id), NodeAddress: addr})
-	}
-
-	return res, nil
-}
-
 func init() {
 	Commands = append(Commands, &commandEcShardUnmount{})
 }
 
 type commandEcShardUnmount struct {
-	env           *CommandEnv
-	writer        io.Writer
-	topology      *master_pb.TopologyInfo
-	volumeID      uint32
-	delete        bool
-	ignoreInvalid bool
-	apply         bool
-	shards        []*ecShard
 }
 
 func (c *commandEcShardUnmount) Name() string {
@@ -107,7 +50,6 @@ func (c *commandEcShardUnmount) Do(args []string, commandEnv *CommandEnv, writer
 	if handleHelpRequest(c, args, writer) {
 		return nil
 	}
-
 	ecShardUnmountCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeID := ecShardUnmountCommand.Uint("volumeId", 0, "volume ID for the shards to process")
 	shardIDsStr := ecShardUnmountCommand.String("shardId", "", "comma-separated EC shard IDs for the volume")
@@ -133,7 +75,7 @@ func (c *commandEcShardUnmount) Do(args []string, commandEnv *CommandEnv, writer
 	if *shardIDsStr == "" {
 		return fmt.Errorf("missing shardId")
 	}
-	shards, err := ecShardsFromString(*shardIDsStr)
+	shards, err := ec.ShardRefsFromString(*shardIDsStr)
 	if err != nil {
 		return err
 	}
@@ -144,136 +86,12 @@ func (c *commandEcShardUnmount) Do(args []string, commandEnv *CommandEnv, writer
 		return err
 	}
 
-	c.env = commandEnv
-	c.writer = writer
-	c.topology = topology
-	c.volumeID = uint32(*volumeID)
-	c.delete = *delete
-	c.ignoreInvalid = *ignoreInvalid
-	c.apply = *apply || *applyAlias
-	c.shards = shards
-
-	return c.doShardsUnmount()
-}
-
-func (c *commandEcShardUnmount) write(format string, a ...any) {
-	fmt.Fprintf(c.writer, format, a...)
-}
-
-func (c *commandEcShardUnmount) liveShardsForVolume() []*ecShard {
-	shards := []*ecShard{}
-
-	for _, dci := range c.topology.GetDataCenterInfos() {
-		for _, ri := range dci.GetRackInfos() {
-			for _, dni := range ri.GetDataNodeInfos() {
-				nodeAddress := dni.GetAddress()
-				for _, di := range dni.GetDiskInfos() {
-					for _, eci := range di.GetEcShardInfos() {
-						if eci.GetId() == c.volumeID {
-							sinfo := erasure_coding.ShardsInfoFromVolumeEcShardInformationMessage(eci)
-							for _, sid := range sinfo.Ids() {
-								shards = append(shards, &ecShard{
-									ShardID:     uint32(sid),
-									Collection:  eci.GetCollection(),
-									NodeAddress: nodeAddress,
-								})
-							}
-						}
-					}
-				}
-			}
-		}
-	}
-
-	sort.SliceStable(shards, func(i, j int) bool { return shards[i].ShardID < shards[j].ShardID })
-	return shards
-}
-
-func (c *commandEcShardUnmount) printShards(ss []*ecShard) {
-	for _, s := range ss {
-		c.write("\t%v\n", s)
-	}
-	c.write("\n")
-}
-
-func (c *commandEcShardUnmount) doShardsUnmount() error {
-	liveShards := c.liveShardsForVolume()
-	c.write("Live shard topology for volume ID %d (%d shards):\n", c.volumeID, len(liveShards))
-	c.printShards(liveShards)
-
-	// resolve target shards against the live topology
-	targetShards := []*ecShard{}
-	for _, ps := range c.shards {
-		var result *ecShard
-		for _, ts := range liveShards {
-			if ts.ShardID == ps.ShardID {
-				if ps.NodeAddress == "" || ps.NodeAddress == ts.NodeAddress {
-					if result != nil {
-						return fmt.Errorf("shard %v is ambiguous", ps)
-					}
-					result = ts
-				}
-			}
-		}
-		if result == nil {
-			if !c.ignoreInvalid {
-				return fmt.Errorf("shard %v is invalid", ps)
-			}
-			c.write("!!! ignoring invalid shard %v\n", ps)
-		} else {
-			targetShards = append(targetShards, result)
-		}
-	}
-	if len(targetShards) == 0 {
-		return fmt.Errorf("got no shards to process")
-	}
-
-	mode := "unmount"
-	if c.delete {
-		mode = "unmount + delete"
-	}
-	c.write("Will %s %d shard(s):\n", mode, len(targetShards))
-	c.printShards(targetShards)
-
-	if !c.apply {
-		c.write("Not proceeding in dry-run mode\n")
-		return nil
-	}
-
-	for _, s := range targetShards {
-		if err := c.unmountShard(s); err != nil {
-			return err
-		}
-	}
-
-	c.write("\nAll done!\n")
-	return nil
-}
-
-func (c *commandEcShardUnmount) unmountShard(s *ecShard) error {
-	ctx, cancel := context.WithTimeout(context.Background(), ecShardActionTimeout)
-	defer cancel()
-
-	return operation.WithVolumeServerClient(false, pb.ServerAddress(s.NodeAddress), c.env.option.GrpcDialOption, func(vsc volume_server_pb.VolumeServerClient) error {
-		c.write("Unmounting shard %v for volume ID %d...\n", s, c.volumeID)
-		if _, err := vsc.VolumeEcShardsUnmount(ctx, &volume_server_pb.VolumeEcShardsUnmountRequest{
-			VolumeId: c.volumeID,
-			ShardIds: []uint32{s.ShardID},
-		}); err != nil {
-			return err
-		}
-
-		if c.delete {
-			c.write("Deleting shard %v for volume ID %d...\n", s, c.volumeID)
-			if _, err := vsc.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
-				VolumeId:   c.volumeID,
-				Collection: s.Collection,
-				ShardIds:   []uint32{s.ShardID},
-			}); err != nil {
-				return err
-			}
-		}
-
-		return nil
+	return ec.UnmountShards(commandEnv.ecEnv(), writer, ec.ShardUnmountRequest{
+		Topology:      topology,
+		VolumeID:      uint32(*volumeID),
+		Shards:        shards,
+		Delete:        *delete,
+		IgnoreInvalid: *ignoreInvalid,
+		Apply:         *apply || *applyAlias,
 	})
 }
diff --git a/weed/shell/command_ec_shard_unmount_test.go b/weed/shell/command_ec_shard_unmount_test.go
deleted file mode 100644
index 3d522cea0a..0000000000
--- a/weed/shell/command_ec_shard_unmount_test.go
+++ /dev/null
@@ -1,102 +0,0 @@
-package shell
-
-import (
-	"testing"
-
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestEcShardsFromString(t *testing.T) {
-	tests := []struct {
-		name    string
-		in      string
-		want    []*ecShard
-		wantErr bool
-	}{
-		{
-			name: "single id",
-			in:   "2",
-			want: []*ecShard{{ShardID: 2}},
-		},
-		{
-			name: "list of ids",
-			in:   "0, 3 ,5",
-			want: []*ecShard{{ShardID: 0}, {ShardID: 3}, {ShardID: 5}},
-		},
-		{
-			name: "qualified keeps host:port",
-			in:   "3@10.200.18.88:9007",
-			want: []*ecShard{{ShardID: 3, NodeAddress: "10.200.18.88:9007"}},
-		},
-		{
-			name: "mixed bare and qualified",
-			in:   "2,3@10.200.18.88:9007",
-			want: []*ecShard{{ShardID: 2}, {ShardID: 3, NodeAddress: "10.200.18.88:9007"}},
-		},
-		{
-			name:    "colon without node marker is not a shard ID",
-			in:      "3:10.200.18.88:9007",
-			wantErr: true,
-		},
-		{
-			// shard IDs beyond the default 10+4 total are valid on custom-ratio volumes.
-			name: "shard id within MaxShardCount",
-			in:   "20",
-			want: []*ecShard{{ShardID: 20}},
-		},
-		{
-			name:    "shard id at MaxShardCount is rejected",
-			in:      "32",
-			wantErr: true,
-		},
-		{
-			name:    "negative shard id",
-			in:      "-1",
-			wantErr: true,
-		},
-		{
-			// must not wrap through uint32 into a valid-looking shard ID (4294967301 -> 5)
-			name:    "out-of-range shard id does not wrap",
-			in:      "4294967301",
-			wantErr: true,
-		},
-		{
-			name:    "non-numeric shard id",
-			in:      "abc",
-			wantErr: true,
-		},
-		{
-			name:    "empty element",
-			in:      "1,,2",
-			wantErr: true,
-		},
-	}
-
-	// guard the assumption the bound test relies on
-	assert.Equal(t, uint32(32), uint32(erasure_coding.MaxShardCount))
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := ecShardsFromString(tt.in)
-			if tt.wantErr {
-				assert.Error(t, err)
-				return
-			}
-			assert.NoError(t, err)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
-
-// the printed topology form must parse back, so entries can be copied verbatim.
-func TestEcShardStringRoundTrips(t *testing.T) {
-	for _, s := range []*ecShard{
-		{ShardID: 2},
-		{ShardID: 3, NodeAddress: "10.200.18.88:9007"},
-	} {
-		got, err := ecShardsFromString(s.String())
-		assert.NoError(t, err)
-		assert.Equal(t, []*ecShard{s}, got)
-	}
-}
diff --git a/weed/shell/command_fs_configure.go b/weed/shell/command_fs_configure.go
index 3edd2a5b4e..165e0b8e65 100644
--- a/weed/shell/command_fs_configure.go
+++ b/weed/shell/command_fs_configure.go
@@ -67,7 +67,7 @@ func (c *commandFsConfigure) Do(args []string, commandEnv *CommandEnv, writer io
 	replication := fsConfigureCommand.String("replication", "", "assign writes with this replication")
 	ttl := fsConfigureCommand.String("ttl", "", "assign writes with this ttl (e.g., 1m, 1h, 1d, 1w, 1y)")
 	diskType := fsConfigureCommand.String("disk", "", "[hdd|ssd|<tag>] hard drive or solid state drive or any tag")
-	fsync := fsConfigureCommand.Bool("fsync", false, "fsync for the writes")
+	fsync := fsConfigureCommand.Bool("fsync", false, "fsync for the writes; unset inherits from the parent path")
 	isReadOnly := fsConfigureCommand.Bool("readOnly", false, "disable writes")
 	worm := fsConfigureCommand.Bool("worm", false, "write-once-read-many, written files are readonly; unset inherits from the parent path")
 	wormGracePeriod := fsConfigureCommand.Uint64("wormGracePeriod", 0, "grace period before worm is enforced, in seconds")
@@ -83,19 +83,24 @@ func (c *commandFsConfigure) Do(args []string, commandEnv *CommandEnv, writer io
 		return nil
 	}
 
-	fc, err := filer.ReadFilerConf(commandEnv.option.FilerAddress, commandEnv.option.GrpcDialOption, commandEnv.MasterClient)
+	fc, err := filer.ReadFilerConf(commandEnv.FilerAddress(), commandEnv.option.GrpcDialOption, commandEnv.MasterClient)
 	if err != nil {
 		return err
 	}
 
 	if *locationPrefix != "" {
 		infoAboutSimulationMode(writer, *apply, "-apply")
+		// A path rule cannot express "the collection with no name": an empty
+		// Collection means "unset" and merges as inherit, so the keyword would
+		// be silently ignored.
+		if *collection == CollectionDefault {
+			return fmt.Errorf("path rules cannot select the collection with no name; omit -collection to inherit")
+		}
 		locConf := &filer_pb.FilerConf_PathConf{
 			LocationPrefix:           *locationPrefix,
 			Collection:               *collection,
 			Replication:              *replication,
 			Ttl:                      *ttl,
-			Fsync:                    *fsync,
 			MaxFileNameLength:        uint32(*maxFileNameLength),
 			DiskType:                 *diskType,
 			VolumeGrowthCount:        uint32(*volumeGrowthCount),
@@ -107,10 +112,13 @@ func (c *commandFsConfigure) Do(args []string, commandEnv *CommandEnv, writer io
 			WormRetentionTimeSeconds: *wormRetentionTime,
 		}
 
-		// worm is only carried when the flag is passed, so a rule that says nothing
-		// about it keeps inheriting from the enclosing path
+		// fsync and worm are only carried when the flag is passed, so a rule that
+		// says nothing about them keeps inheriting from the enclosing path
 		fsConfigureCommand.Visit(func(f *flag.Flag) {
-			if f.Name == "worm" {
+			switch f.Name {
+			case "fsync":
+				locConf.Fsync = proto.Bool(*fsync)
+			case "worm":
 				locConf.Worm = proto.Bool(*worm)
 			}
 		})
@@ -146,17 +154,15 @@ func (c *commandFsConfigure) Do(args []string, commandEnv *CommandEnv, writer io
 			fc.DeleteLocationConf(*locationPrefix)
 		} else {
 			fc.AddLocationConf(locConf)
-			// AddLocationConf merges these boolean fields with OR, which can never
-			// turn a flag off; let an explicitly passed false win, e.g. -readOnly=false
-			// to reopen a bucket that quota enforcement locked. worm does not belong
-			// here: it merges on presence, so the value set above already wins.
+			// AddLocationConf merges this boolean field with OR, which can never
+			// turn it off; let an explicitly passed false win, e.g. -readOnly=false
+			// to reopen a bucket that quota enforcement locked. fsync and worm do
+			// not belong here: they merge on presence, so the values set above
+			// already win.
 			if mergedConf, found := fc.GetLocationConf(*locationPrefix); found {
 				fsConfigureCommand.Visit(func(f *flag.Flag) {
-					switch f.Name {
-					case "readOnly":
+					if f.Name == "readOnly" {
 						mergedConf.ReadOnly = *isReadOnly
-					case "fsync":
-						mergedConf.Fsync = *fsync
 					}
 				})
 			}
diff --git a/weed/shell/command_fs_distribute_chunks.go b/weed/shell/command_fs_distribute_chunks.go
index a9b41db8c4..17c6f4fdd9 100644
--- a/weed/shell/command_fs_distribute_chunks.go
+++ b/weed/shell/command_fs_distribute_chunks.go
@@ -6,9 +6,9 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"maps"
 	"math"
 	"net/http"
-	"maps"
 	"slices"
 	"sort"
 	"strings"
@@ -87,7 +87,6 @@ type chunkMove struct {
 	toNode     string
 }
 
-
 func (c *commandFsDistributeChunks) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
 
 	fsDistributeCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
@@ -192,7 +191,8 @@ func (c *commandFsDistributeChunks) Do(args []string, commandEnv *CommandEnv, wr
 
 	finalChunks := chunks
 	if hadManifest {
-		remanifested, manErr := filer.MaybeManifestize(newShellSaveAsChunk(commandEnv), chunks)
+		// no chunk deleter here: a failed fold reports the blobs it saved
+		remanifested, manErr := filer.MaybeManifestize(newShellSaveAsChunk(commandEnv), nil, chunks)
 		if manErr != nil {
 			fmt.Fprintf(writer, "WARNING: re-manifestize failed: %v. Writing flat chunk list.\n", manErr)
 		} else {
@@ -256,7 +256,7 @@ func resolveEntryDataChunks(commandEnv *CommandEnv, entry *filer_pb.Entry) (data
 	if !filer.HasChunkManifest(chunks) {
 		return chunks, false, nil
 	}
-	dataChunks, _, err = filer.ResolveChunkManifest(context.Background(), filer.LookupFn(commandEnv), chunks, 0, math.MaxInt64)
+	dataChunks, _, err = filer.ResolveChunkManifest(context.Background(), filer.LookupFn(commandEnv), chunks, 0, math.MaxInt64, nil)
 	if err != nil {
 		return nil, true, fmt.Errorf("resolve chunk manifest: %v", err)
 	}
@@ -692,6 +692,7 @@ func executeChunkMoves(
 			var resp *http.Response
 			var reader io.ReadCloser
 			var readErr error
+			readJwt := filer.JwtForVolumeServer(oldFidStr)
 			for _, serverURL := range downloadURLs {
 				var dlReq *http.Request
 				dlReq, readErr = http.NewRequestWithContext(dlCtx, http.MethodGet, fmt.Sprintf("http://%s/%s", serverURL, oldFidStr), nil)
@@ -699,6 +700,9 @@ func executeChunkMoves(
 					continue
 				}
 				dlReq.Header.Add("Accept-Encoding", "gzip")
+				if readJwt != "" {
+					dlReq.Header.Set("Authorization", security.BearerPrefix+readJwt)
+				}
 				resp, readErr = util_http.GetGlobalHttpClient().Do(dlReq)
 				if readErr == nil && resp.StatusCode >= 400 {
 					util_http.CloseResponse(resp)
diff --git a/weed/shell/command_fs_merge_volumes.go b/weed/shell/command_fs_merge_volumes.go
index 4bc256a35c..99b6140943 100644
--- a/weed/shell/command_fs_merge_volumes.go
+++ b/weed/shell/command_fs_merge_volumes.go
@@ -8,6 +8,7 @@ import (
 	"io"
 	"net/http"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -17,11 +18,13 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/security"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 	"golang.org/x/exp/maps"
 	"google.golang.org/protobuf/proto"
 
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
@@ -46,7 +49,11 @@ func (c *commandFsMergeVolumes) Help() string {
 
 	This would help clear half-full volumes and let vacuum system to delete them later.
 
-	fs.mergeVolumes [-toVolumeId=y] [-fromVolumeId=x] [-collection="*"] [-dir=/] [-apply]
+	fs.mergeVolumes [-toVolumeId=y[,z]] [-fromVolumeId=x] [-collection="*"] [-dir=/] [-apply]
+
+	-toVolumeId accepts a comma-separated list. With -fromVolumeId, the source
+	chunks are distributed across the listed volumes by remaining capacity, so a
+	volume that does not fit into any single target can still be cleared.
 `
 }
 
@@ -59,8 +66,8 @@ func (c *commandFsMergeVolumes) Do(args []string, commandEnv *CommandEnv, writer
 	fsMergeVolumesCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	dirArg := fsMergeVolumesCommand.String("dir", "/", "base directory to find and update files")
 	fromVolumeArg := fsMergeVolumesCommand.Uint("fromVolumeId", 0, "move chunks with this volume id")
-	toVolumeArg := fsMergeVolumesCommand.Uint("toVolumeId", 0, "change chunks to this volume id")
-	collectionArg := fsMergeVolumesCommand.String("collection", "*", "Name of collection to merge")
+	toVolumeArg := fsMergeVolumesCommand.String("toVolumeId", "", "change chunks to this volume id, or distribute across a comma-separated list of volume ids")
+	collectionArg := fsMergeVolumesCommand.String("collection", "*", "comma-separated collection names, wildcards, or regex patterns; \""+CollectionDefault+"\" for the collection with no name")
 	apply := fsMergeVolumesCommand.Bool("apply", false, "applying the metadata changes")
 	if err = fsMergeVolumesCommand.Parse(args); err != nil {
 		return err
@@ -78,12 +85,12 @@ func (c *commandFsMergeVolumes) Do(args []string, commandEnv *CommandEnv, writer
 	if *fromVolumeArg > maxVolumeID {
 		return fmt.Errorf("fromVolumeId %d exceeds max volume id %d", *fromVolumeArg, maxVolumeID)
 	}
-	if *toVolumeArg > maxVolumeID {
-		return fmt.Errorf("toVolumeId %d exceeds max volume id %d", *toVolumeArg, maxVolumeID)
-	}
 
 	fromVolumeId := needle.VolumeId(*fromVolumeArg)
-	toVolumeId := needle.VolumeId(*toVolumeArg)
+	toVolumeIds, err := parseTargetVolumeIds(*toVolumeArg)
+	if err != nil {
+		return err
+	}
 
 	if err = c.reloadVolumesInfo(commandEnv.MasterClient); err != nil {
 		return fmt.Errorf("reload volumes info: %w", err)
@@ -98,43 +105,20 @@ func (c *commandFsMergeVolumes) Do(args []string, commandEnv *CommandEnv, writer
 			return fmt.Errorf("fromVolumeId %d not found on master", fromVolumeId)
 		}
 	}
-	if toVolumeId != 0 {
+	for _, toVolumeId := range toVolumeIds {
 		if _, err := c.getVolumeInfoById(toVolumeId); err != nil {
 			return fmt.Errorf("toVolumeId %d not found on master", toVolumeId)
 		}
 	}
 
-	if fromVolumeId != 0 && toVolumeId != 0 {
-		if fromVolumeId == toVolumeId {
-			return fmt.Errorf("no volume id changes, %d == %d", fromVolumeId, toVolumeId)
-		}
-		compatible, err := c.volumesAreCompatible(fromVolumeId, toVolumeId)
-		if err != nil {
-			return fmt.Errorf("cannot determine volumes are compatible: %d and %d", fromVolumeId, toVolumeId)
-		}
-		if !compatible {
-			return fmt.Errorf("volume %d is not compatible with volume %d", fromVolumeId, toVolumeId)
-		}
-		fromSize := c.getVolumeSizeById(fromVolumeId)
-		toSize := c.getVolumeSizeById(toVolumeId)
-		if fromSize+toSize > c.volumeSizeLimit {
-			return fmt.Errorf(
-				"volume %d (%d MB) cannot merge into volume %d (%d MB_ due to volume size limit (%d MB)",
-				fromVolumeId, fromSize/1024/1024,
-				toVolumeId, toSize/1024/1024,
-				c.volumeSizeLimit/1024/1024,
-			)
-		}
-	}
-
-	plan, err := c.createMergePlan(*collectionArg, toVolumeId, fromVolumeId)
+	plan, err := c.createMergePlan(*collectionArg, toVolumeIds, fromVolumeId)
 
 	if err != nil {
 		return err
 	}
 	c.printPlan(plan)
 
-	if len(plan) == 0 {
+	if len(plan.targets) == 0 {
 		return nil
 	}
 
@@ -156,7 +140,16 @@ func (c *commandFsMergeVolumes) Do(args []string, commandEnv *CommandEnv, writer
 	// synchronize without a global lock.
 	var processedHardLinks sync.Map
 
-	return commandEnv.WithFilerClient(false, func(filerClient filer_pb.SeaweedFilerClient) error {
+	planCollections := make(map[string]bool)
+	for src := range plan.targets {
+		if info := c.volumes[src]; info != nil {
+			planCollections[info.Collection] = true
+		}
+	}
+
+	seen := newSourceNeedleCounter()
+
+	if err := commandEnv.WithFilerClient(false, func(filerClient filer_pb.SeaweedFilerClient) error {
 		return filer_pb.TraverseBfs(context.Background(), commandEnv, util.FullPath(dir), func(parentPath util.FullPath, entry *filer_pb.Entry) error {
 			if entry.IsDirectory {
 				return nil
@@ -178,12 +171,18 @@ func (c *commandFsMergeVolumes) Do(args []string, commandEnv *CommandEnv, writer
 			// look like mergeVolumes hadn't done anything. Track the old fids
 			// and delete them below after the filer update commits, so the
 			// filer never points at a fid we already deleted.
-			var movedSources []movedSourceNeedle
+			var movedSources []orphanedNeedle
 			for i, chunk := range entry.Chunks {
 				if chunk.IsChunkManifest {
+					if !c.manifestMayReferencePlan(plan, planCollections, needle.VolumeId(chunk.Fid.VolumeId)) {
+						continue
+					}
 					oldManifestFid := chunk.GetFileIdString()
 					oldManifestVid := chunk.Fid.VolumeId
-					newChunk, changed, subSources, mErr := c.rewriteManifestChunk(context.Background(), commandEnv, lookupFn, plan, entryPath, chunk, *apply)
+					if vid := needle.VolumeId(oldManifestVid); plan.isSource(vid) {
+						seen.record(vid)
+					}
+					newChunk, changed, rewritten, mErr := c.rewriteManifestChunk(context.Background(), commandEnv, lookupFn, plan, entryPath, chunk, *apply, seen.record)
 					if mErr != nil {
 						fmt.Printf("failed to rewrite manifest %s(%s): %v\n", entryPath, oldManifestFid, mErr)
 						continue
@@ -193,33 +192,39 @@ func (c *commandFsMergeVolumes) Do(args []string, commandEnv *CommandEnv, writer
 					}
 					entry.Chunks[i] = newChunk
 					entryChanged = true
-					movedSources = append(movedSources, subSources...)
+					movedSources = append(movedSources, rewritten.sources...)
 					// The old manifest needle is always orphaned when we
 					// replace it with a freshly uploaded one, even when the
 					// rewrite was triggered by sub-chunk moves rather than the
 					// manifest volume itself being in the plan.
-					movedSources = append(movedSources, movedSourceNeedle{volumeId: oldManifestVid, fileId: oldManifestFid})
+					movedSources = append(movedSources, orphanedNeedle{volumeId: oldManifestVid, fileId: oldManifestFid})
 					continue
 				}
 
 				chunkVolumeId := needle.VolumeId(chunk.Fid.VolumeId)
-				toVolumeId, found := plan[chunkVolumeId]
-				if !found {
+				if !plan.isSource(chunkVolumeId) {
 					continue
 				}
+				seen.record(chunkVolumeId)
 
 				oldFid := chunk.GetFileIdString()
 				oldVid := chunk.Fid.VolumeId
-				fmt.Printf("move %s(%s)\n", entryPath, oldFid)
+				toVolumeId, ok := plan.allocate(chunkVolumeId, chunk.Size)
+				if !ok {
+					fmt.Printf("skip %s(%s): no target volume has room\n", entryPath, oldFid)
+					continue
+				}
+				fmt.Printf("move %s(%s) => volume %d\n", entryPath, oldFid, toVolumeId)
 				if !*apply {
 					continue
 				}
-				if mvErr := moveChunk(chunk, toVolumeId, commandEnv.MasterClient); mvErr != nil {
+				if mvErr := moveChunk(commandEnv, entryPath, chunk, toVolumeId); mvErr != nil {
 					fmt.Printf("failed to move %s(%s): %v\n", entryPath, oldFid, mvErr)
+					plan.release(chunkVolumeId, toVolumeId, chunk.Size)
 					continue
 				}
 				entryChanged = true
-				movedSources = append(movedSources, movedSourceNeedle{volumeId: oldVid, fileId: oldFid})
+				movedSources = append(movedSources, orphanedNeedle{volumeId: oldVid, fileId: oldFid})
 			}
 			if entryChanged {
 				if uErr := filer_pb.UpdateEntry(context.Background(), filerClient, &filer_pb.UpdateEntryRequest{
@@ -232,42 +237,110 @@ func (c *commandFsMergeVolumes) Do(args []string, commandEnv *CommandEnv, writer
 					// entry and let fsck reconcile later.
 					return nil
 				}
-				c.deleteMovedSourceNeedles(commandEnv, entryPath, movedSources)
+				deleteOrphanedNeedles(commandEnv, entryPath, movedSources, false)
 			}
 			return nil
 		})
-	})
+	}); err != nil {
+		return err
+	}
+
+	c.warnUnreferencedSources(writer, plan, seen, dir)
+	return nil
 }
 
-// movedSourceNeedle is a needle that was copied out of its source volume by
-// a move/rewrite operation and is safe to delete once the filer update that
-// re-pointed references to the new location has committed.
-type movedSourceNeedle struct {
+// warnUnreferencedSources warns when a plan source's index still holds needles
+// but no filer entry referenced any during traversal — the merge moves nothing
+// and the real cleanup is volume.fsck.
+func (c *commandFsMergeVolumes) warnUnreferencedSources(writer io.Writer, plan *mergePlan, seen *sourceNeedleCounter, dir string) {
+	for src := range plan.targets {
+		if seen.count(src) > 0 {
+			continue
+		}
+		info := c.volumes[src]
+		if info == nil || info.FileCount == 0 {
+			continue
+		}
+		fmt.Fprintf(writer, "warning: volume %d has %d needle(s) in its index but no filer entries reference them under %s — nothing merged (orphan needles? run volume.fsck)\n", src, info.FileCount, dir)
+	}
+}
+
+// sourceNeedleCounter records plan-source needles seen during filer traversal.
+// TraverseBfs runs callbacks on concurrent workers, so record is mutex-guarded.
+type sourceNeedleCounter struct {
+	mu   sync.Mutex
+	seen map[needle.VolumeId]int
+}
+
+func newSourceNeedleCounter() *sourceNeedleCounter {
+	return &sourceNeedleCounter{seen: make(map[needle.VolumeId]int)}
+}
+
+func (s *sourceNeedleCounter) record(vid needle.VolumeId) {
+	s.mu.Lock()
+	s.seen[vid]++
+	s.mu.Unlock()
+}
+
+func (s *sourceNeedleCounter) count(vid needle.VolumeId) int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.seen[vid]
+}
+
+// orphanedNeedle is a needle no filer entry references any more: either a
+// source needle whose references have been re-pointed at the new location, or
+// a copy left on a target volume by a write that failed before the filer could
+// be updated.
+type orphanedNeedle struct {
 	volumeId uint32
 	fileId   string
 }
 
-// deleteMovedSourceNeedles fans out BatchDelete RPCs to every replica of each
-// source volume. Errors are logged but never returned — the source data is
-// already orphan at this point, so a failed cleanup just leaves work for a
-// later fsck. Propagating an error here would abort TraverseBfs and strand
-// the remaining entries mid-merge, which is strictly worse.
-func (c *commandFsMergeVolumes) deleteMovedSourceNeedles(commandEnv *CommandEnv, entryPath util.FullPath, sources []movedSourceNeedle) {
-	if len(sources) == 0 {
+// reservation is the plan capacity a successful move consumed, remembered so
+// an abandoned rewrite can hand it back with the copy it deletes.
+type reservation struct {
+	src, dst needle.VolumeId
+	size     uint64
+}
+
+// rewrittenNeedles is the bookkeeping a manifest rewrite hands back: sources
+// whose references have moved, deletable once the filer commits, and the new
+// copies on the target volumes, which orphan if it never does.
+type rewrittenNeedles struct {
+	sources      []orphanedNeedle
+	targets      []orphanedNeedle
+	reservations []reservation
+}
+
+// deleteOrphanedNeedles fans out BatchDelete RPCs to every replica of each
+// needle's volume. Errors are logged but never returned — the data is already
+// orphan at this point, so a failed cleanup just leaves work for a later fsck.
+// Propagating an error here would abort TraverseBfs and strand the remaining
+// entries mid-merge, which is strictly worse.
+//
+// includeCookie makes the volume server verify the needle is the one we mean
+// before deleting it. Source needles are the ones the filer just pointed at,
+// so they delete by id like every other filer-driven delete. A target needle
+// is one an upload may or may not have written, and the id alone would also
+// match a same-key needle that a restored or re-sequenced volume put there
+// first, so those always verify.
+func deleteOrphanedNeedles(commandEnv *CommandEnv, entryPath util.FullPath, needles []orphanedNeedle, includeCookie bool) {
+	if len(needles) == 0 {
 		return
 	}
 	byVolume := make(map[uint32][]string)
-	for _, s := range sources {
-		byVolume[s.volumeId] = append(byVolume[s.volumeId], s.fileId)
+	for _, n := range needles {
+		byVolume[n.volumeId] = append(byVolume[n.volumeId], n.fileId)
 	}
 	for vid, fids := range byVolume {
 		locations, found := commandEnv.MasterClient.GetLocations(vid)
 		if !found {
-			fmt.Printf("source cleanup %s: no locations for volume %d\n", entryPath, vid)
+			fmt.Printf("orphan cleanup %s: no locations for volume %d\n", entryPath, vid)
 			continue
 		}
 		for _, loc := range locations {
-			results := operation.DeleteFileIdsAtOneVolumeServer(loc.ServerAddress(), commandEnv.option.GrpcDialOption, fids, false)
+			results := operation.DeleteFileIdsAtOneVolumeServer(context.Background(), loc.ServerAddress(), commandEnv.option.GrpcDialOption, fids, includeCookie)
 			// Summarize per server: an unreachable volume server returns one
 			// error per needle, which for manifest-heavy files can mean
 			// hundreds of near-identical lines. Keep the first error as the
@@ -295,15 +368,27 @@ func (c *commandFsMergeVolumes) deleteMovedSourceNeedles(commandEnv *CommandEnv,
 				errCount++
 			}
 			if errCount == 1 {
-				fmt.Printf("source cleanup %s: delete %s on %v: %s\n", entryPath, firstFid, loc.ServerAddress(), firstErr)
+				fmt.Printf("orphan cleanup %s: delete %s on %v: %s\n", entryPath, firstFid, loc.ServerAddress(), firstErr)
 			} else if errCount > 1 {
-				fmt.Printf("source cleanup %s: %d/%d needles failed on %v (e.g. %s: %s)\n",
+				fmt.Printf("orphan cleanup %s: %d/%d needles failed on %v (e.g. %s: %s)\n",
 					entryPath, errCount, len(fids), loc.ServerAddress(), firstFid, firstErr)
 			}
 		}
 	}
 }
 
+// Sub-chunks are assigned in the manifest's own collection, so a manifest on
+// a volume in a collection the plan does not touch cannot reference any plan
+// volume — resolving it would just download manifest needles across the whole
+// namespace for nothing.
+func (c *commandFsMergeVolumes) manifestMayReferencePlan(plan *mergePlan, planCollections map[string]bool, vid needle.VolumeId) bool {
+	if plan.isSource(vid) {
+		return true
+	}
+	info := c.volumes[vid]
+	return info == nil || planCollections[info.Collection]
+}
+
 func (c *commandFsMergeVolumes) getVolumeInfoById(vid needle.VolumeId) (*master_pb.VolumeInformationMessage, error) {
 	info := c.volumes[vid]
 	var err error
@@ -330,8 +415,8 @@ func (c *commandFsMergeVolumes) volumesAreCompatible(src needle.VolumeId, dest n
 func (c *commandFsMergeVolumes) reloadVolumesInfo(masterClient *wdclient.MasterClient) error {
 	c.volumes = make(map[needle.VolumeId]*master_pb.VolumeInformationMessage)
 
-	return masterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-		volumes, err := client.VolumeList(context.Background(), &master_pb.VolumeListRequest{})
+	return masterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
+		volumes, err := pb.CollectVolumeList(context.Background(), client, &master_pb.VolumeListRequest{})
 		if err != nil {
 			return err
 		}
@@ -356,16 +441,112 @@ func (c *commandFsMergeVolumes) reloadVolumesInfo(masterClient *wdclient.MasterC
 	})
 }
 
-func (c *commandFsMergeVolumes) createMergePlan(collection string, toVolumeId needle.VolumeId, fromVolumeId needle.VolumeId) (map[needle.VolumeId]needle.VolumeId, error) {
+// mergePlan maps each source volume to candidate targets: a single-target
+// source sends every chunk there (historic behavior), a multi-target source
+// allocates per chunk under mu since TraverseBfs callbacks run in parallel.
+type mergePlan struct {
+	mu              sync.Mutex
+	targets         map[needle.VolumeId][]needle.VolumeId
+	plannedSize     map[needle.VolumeId]uint64
+	volumeSizeLimit uint64
+}
+
+func newMergePlan(volumeSizeLimit uint64) *mergePlan {
+	return &mergePlan{
+		targets:         make(map[needle.VolumeId][]needle.VolumeId),
+		plannedSize:     make(map[needle.VolumeId]uint64),
+		volumeSizeLimit: volumeSizeLimit,
+	}
+}
+
+func (p *mergePlan) isSource(vid needle.VolumeId) bool {
+	_, found := p.targets[vid]
+	return found
+}
+
+// allocate picks the candidate with the most remaining capacity that still
+// fits the chunk, and reserves the chunk size against it.
+func (p *mergePlan) allocate(src needle.VolumeId, size uint64) (needle.VolumeId, bool) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	candidates := p.targets[src]
+	if len(candidates) == 0 {
+		return 0, false
+	}
+	if len(candidates) == 1 {
+		return candidates[0], true
+	}
+	var best needle.VolumeId
+	var bestRemaining uint64
+	found := false
+	for _, t := range candidates {
+		used := p.plannedSize[t]
+		if used+size > p.volumeSizeLimit {
+			continue
+		}
+		if remaining := p.volumeSizeLimit - used; !found || remaining > bestRemaining {
+			best, bestRemaining, found = t, remaining, true
+		}
+	}
+	if !found {
+		return 0, false
+	}
+	p.plannedSize[best] += size
+	return best, true
+}
+
+// release returns a failed move's reservation so later chunks can use it.
+// Single-target sources reserve at plan time, not per chunk.
+func (p *mergePlan) release(src, target needle.VolumeId, size uint64) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if len(p.targets[src]) <= 1 {
+		return
+	}
+	if p.plannedSize[target] >= size {
+		p.plannedSize[target] -= size
+	}
+}
+
+// Empty or "0" means unset, matching the old numeric flag's default.
+func parseTargetVolumeIds(arg string) ([]needle.VolumeId, error) {
+	arg = strings.TrimSpace(arg)
+	if arg == "" || arg == "0" {
+		return nil, nil
+	}
+	var ids []needle.VolumeId
+	seen := make(map[needle.VolumeId]bool)
+	for _, part := range strings.Split(arg, ",") {
+		part = strings.TrimSpace(part)
+		v, err := strconv.ParseUint(part, 10, 32)
+		if err != nil || v == 0 {
+			return nil, fmt.Errorf("invalid toVolumeId %q", part)
+		}
+		vid := needle.VolumeId(v)
+		if seen[vid] {
+			return nil, fmt.Errorf("duplicate toVolumeId %d", vid)
+		}
+		seen[vid] = true
+		ids = append(ids, vid)
+	}
+	return ids, nil
+}
+
+func (c *commandFsMergeVolumes) createMergePlan(collection string, toVolumeIds []needle.VolumeId, fromVolumeId needle.VolumeId) (*mergePlan, error) {
+	collectionMatcher, err := compileCollectionPattern(collection)
+	if err != nil {
+		return nil, fmt.Errorf("invalid collection pattern %q: %w", collection, err)
+	}
+
 	// When the user names both endpoints, honor that exact direction. The
 	// heuristic below only ever merges a smaller volume into a larger one, so
 	// an explicit "merge larger into smaller" request would otherwise yield an
 	// empty plan and silently do nothing.
-	if fromVolumeId != 0 && toVolumeId != 0 {
-		return c.createDirectedMergePlan(collection, fromVolumeId, toVolumeId)
+	if fromVolumeId != 0 && len(toVolumeIds) > 0 {
+		return c.createDirectedMergePlan(collectionMatcher, collection, fromVolumeId, toVolumeIds)
 	}
 
-	plan := make(map[needle.VolumeId]needle.VolumeId)
+	plan := newMergePlan(c.volumeSizeLimit)
 	volumeIds := maps.Keys(c.volumes)
 	sort.Slice(volumeIds, func(a, b int) bool {
 		return c.volumes[volumeIds[b]].Size < c.volumes[volumeIds[a]].Size
@@ -374,9 +555,9 @@ func (c *commandFsMergeVolumes) createMergePlan(collection string, toVolumeId ne
 	l := len(volumeIds)
 	for i := 0; i < l; i++ {
 		volume := c.volumes[volumeIds[i]]
-		if volume.GetReadOnly() || c.getVolumeSize(volume) == 0 || (collection != "*" && collection != volume.GetCollection()) {
+		if volume.GetReadOnly() || c.getVolumeSize(volume) == 0 || !collectionMatcher.Matches(volume.GetCollection()) {
 
-			if fromVolumeId != 0 && volumeIds[i] == fromVolumeId || toVolumeId != 0 && volumeIds[i] == toVolumeId {
+			if fromVolumeId != 0 && volumeIds[i] == fromVolumeId || slices.Contains(toVolumeIds, volumeIds[i]) {
 				if volume.GetReadOnly() {
 					return nil, fmt.Errorf("volume %d is readonly", volumeIds[i])
 				}
@@ -396,10 +577,10 @@ func (c *commandFsMergeVolumes) createMergePlan(collection string, toVolumeId ne
 		}
 		for j := 0; j < i; j++ {
 			candidate := volumeIds[j]
-			if toVolumeId != 0 && candidate != toVolumeId {
+			if len(toVolumeIds) > 0 && !slices.Contains(toVolumeIds, candidate) {
 				continue
 			}
-			if _, moving := plan[candidate]; moving {
+			if _, moving := plan.targets[candidate]; moving {
 				continue
 			}
 			compatible, err := c.volumesAreCompatible(src, candidate)
@@ -410,7 +591,10 @@ func (c *commandFsMergeVolumes) createMergePlan(collection string, toVolumeId ne
 				fmt.Printf("volume %d is not compatible with volume %d\n", src, candidate)
 				continue
 			}
-			candidatePlannedSize := c.getVolumeSizeBasedOnPlan(plan, candidate)
+			if _, tracked := plan.plannedSize[candidate]; !tracked {
+				plan.plannedSize[candidate] = c.getVolumeSizeById(candidate)
+			}
+			candidatePlannedSize := plan.plannedSize[candidate]
 			if candidatePlannedSize+c.getVolumeSizeById(src) > c.volumeSizeLimit {
 				fmt.Printf("volume %d (%d MB) merge into volume %d (%d MB, %d MB with plan) exceeds volume size limit (%d MB)\n",
 					src, c.getVolumeSizeById(src)/1024/1024,
@@ -418,7 +602,8 @@ func (c *commandFsMergeVolumes) createMergePlan(collection string, toVolumeId ne
 					c.volumeSizeLimit/1024/1024)
 				continue
 			}
-			plan[src] = candidate
+			plan.targets[src] = []needle.VolumeId{candidate}
+			plan.plannedSize[candidate] += c.getVolumeSizeById(src)
 			break
 		}
 	}
@@ -426,16 +611,13 @@ func (c *commandFsMergeVolumes) createMergePlan(collection string, toVolumeId ne
 	return plan, nil
 }
 
-// createDirectedMergePlan builds the single-pair plan {from: to} exactly as the
-// user requested, skipping the smaller-into-larger ordering the heuristic
-// planner uses. Compatibility and the combined size limit are already checked
-// by Do before this runs; here we only reject endpoints that cannot
-// participate (read-only, empty, or outside the requested collection).
-func (c *commandFsMergeVolumes) createDirectedMergePlan(collection string, from, to needle.VolumeId) (map[needle.VolumeId]needle.VolumeId, error) {
-	if from == to {
-		return nil, fmt.Errorf("no volume id changes, %d == %d", from, to)
+// createDirectedMergePlan honors the exact direction the user named, skipping
+// the heuristic planner's smaller-into-larger ordering.
+func (c *commandFsMergeVolumes) createDirectedMergePlan(collectionMatcher *wildcard.CollectionMatcher, collection string, from needle.VolumeId, toIds []needle.VolumeId) (*mergePlan, error) {
+	if slices.Contains(toIds, from) {
+		return nil, fmt.Errorf("no volume id changes, %d is both source and target", from)
 	}
-	for _, vid := range []needle.VolumeId{from, to} {
+	for _, vid := range append([]needle.VolumeId{from}, toIds...) {
 		volume, err := c.getVolumeInfoById(vid)
 		if err != nil {
 			return nil, err
@@ -443,26 +625,45 @@ func (c *commandFsMergeVolumes) createDirectedMergePlan(collection string, from,
 		if volume.GetReadOnly() {
 			return nil, fmt.Errorf("volume %d is readonly", vid)
 		}
-		if collection != "*" && collection != volume.GetCollection() {
-			return nil, fmt.Errorf("volume %d is not in collection %q", vid, collection)
+		if !collectionMatcher.Matches(volume.GetCollection()) {
+			return nil, fmt.Errorf("volume %d does not match collection filter %q", vid, collection)
 		}
 		// Merging into an empty target is valid (e.g. a freshly vacuumed
 		// volume); only an empty source has nothing to move.
 		if vid == from && c.getVolumeSize(volume) == 0 {
 			return nil, fmt.Errorf("volume %d is empty", vid)
 		}
-	}
-	return map[needle.VolumeId]needle.VolumeId{from: to}, nil
-}
-
-func (c *commandFsMergeVolumes) getVolumeSizeBasedOnPlan(plan map[needle.VolumeId]needle.VolumeId, vid needle.VolumeId) uint64 {
-	size := c.getVolumeSizeById(vid)
-	for src, dest := range plan {
-		if dest == vid {
-			size += c.getVolumeSizeById(src)
+		if vid != from {
+			compatible, err := c.volumesAreCompatible(from, vid)
+			if err != nil {
+				return nil, err
+			}
+			if !compatible {
+				return nil, fmt.Errorf("volume %d is not compatible with volume %d", from, vid)
+			}
 		}
 	}
-	return size
+
+	plan := newMergePlan(c.volumeSizeLimit)
+	fromSize := c.getVolumeSizeById(from)
+	var totalFree uint64
+	for _, to := range toIds {
+		toSize := c.getVolumeSizeById(to)
+		plan.plannedSize[to] = toSize
+		if toSize < c.volumeSizeLimit {
+			totalFree += c.volumeSizeLimit - toSize
+		}
+	}
+	if fromSize > totalFree {
+		return nil, fmt.Errorf(
+			"volume %d (%d MB) cannot merge into volumes %v (%d MB free) due to volume size limit (%d MB)",
+			from, fromSize/1024/1024,
+			toIds, totalFree/1024/1024,
+			c.volumeSizeLimit/1024/1024,
+		)
+	}
+	plan.targets[from] = toIds
+	return plan, nil
 }
 
 // getVolumeSize is the volume's live data size, clamped since
@@ -478,11 +679,16 @@ func (c *commandFsMergeVolumes) getVolumeSizeById(vid needle.VolumeId) uint64 {
 	return c.getVolumeSize(c.volumes[vid])
 }
 
-func (c *commandFsMergeVolumes) printPlan(plan map[needle.VolumeId]needle.VolumeId) {
+func (c *commandFsMergeVolumes) printPlan(plan *mergePlan) {
 	fmt.Printf("max volume size: %d MB\n", c.volumeSizeLimit/1024/1024)
 	reversePlan := make(map[needle.VolumeId][]needle.VolumeId)
-	for src, dest := range plan {
-		reversePlan[dest] = append(reversePlan[dest], src)
+	for src, dests := range plan.targets {
+		if len(dests) > 1 {
+			fmt.Printf("volume %d (%d MB) distribute across volumes %v by remaining capacity\n",
+				src, c.getVolumeSizeById(src)/1024/1024, dests)
+			continue
+		}
+		reversePlan[dests[0]] = append(reversePlan[dests[0]], src)
 	}
 	for dest, srcs := range reversePlan {
 		currentSize := c.getVolumeSizeById(dest)
@@ -517,67 +723,94 @@ func (c *commandFsMergeVolumes) rewriteManifestChunk(
 	ctx context.Context,
 	commandEnv *CommandEnv,
 	lookupFn wdclient.LookupFileIdFunctionType,
-	plan map[needle.VolumeId]needle.VolumeId,
+	plan *mergePlan,
 	entryPath util.FullPath,
 	chunk *filer_pb.FileChunk,
 	apply bool,
-) (*filer_pb.FileChunk, bool, []movedSourceNeedle, error) {
+	recordSeen func(needle.VolumeId),
+) (*filer_pb.FileChunk, bool, rewrittenNeedles, error) {
 	if !chunk.IsChunkManifest {
-		return chunk, false, nil, fmt.Errorf("not a manifest chunk: %s", chunk.GetFileIdString())
+		return chunk, false, rewrittenNeedles{}, fmt.Errorf("not a manifest chunk: %s", chunk.GetFileIdString())
 	}
 
-	subChunks, err := filer.ResolveOneChunkManifest(ctx, lookupFn, chunk)
+	subChunks, err := filer.ResolveOneChunkManifest(ctx, lookupFn, chunk, nil)
 	if err != nil {
-		return chunk, false, nil, err
+		return chunk, false, rewrittenNeedles{}, err
 	}
 
-	var movedSources []movedSourceNeedle
+	var rewritten rewrittenNeedles
+	// Every path out of here that is not the successful return abandons the
+	// rewrite with the filer still pointing at the old manifest, so whatever
+	// already landed on the target volumes belongs to nobody. Give the plan
+	// back the room those copies were holding, or a multi-target merge keeps
+	// counting bytes it just deleted and skips later chunks for no reason.
+	abandon := func() {
+		deleteOrphanedNeedles(commandEnv, entryPath, rewritten.targets, true)
+		for _, r := range rewritten.reservations {
+			plan.release(r.src, r.dst, r.size)
+		}
+	}
 	anySubChanged := false
 	for i, sub := range subChunks {
 		if sub.IsChunkManifest {
 			oldSubManifestFid := sub.GetFileIdString()
 			oldSubManifestVid := sub.Fid.VolumeId
-			newSub, changed, nestedSources, rErr := c.rewriteManifestChunk(ctx, commandEnv, lookupFn, plan, entryPath, sub, apply)
+			if vid := needle.VolumeId(oldSubManifestVid); plan.isSource(vid) {
+				recordSeen(vid)
+			}
+			newSub, changed, nested, rErr := c.rewriteManifestChunk(ctx, commandEnv, lookupFn, plan, entryPath, sub, apply, recordSeen)
 			if rErr != nil {
-				return chunk, false, nil, rErr
+				abandon()
+				return chunk, false, rewrittenNeedles{}, rErr
 			}
 			if changed {
 				subChunks[i] = newSub
 				anySubChanged = true
 				if apply {
-					movedSources = append(movedSources, nestedSources...)
+					rewritten.sources = append(rewritten.sources, nested.sources...)
 					// Nested manifest got replaced — its old needle is now
 					// orphan on the same volume it used to live on.
-					movedSources = append(movedSources, movedSourceNeedle{volumeId: oldSubManifestVid, fileId: oldSubManifestFid})
+					rewritten.sources = append(rewritten.sources, orphanedNeedle{volumeId: oldSubManifestVid, fileId: oldSubManifestFid})
+					rewritten.targets = append(rewritten.targets, nested.targets...)
+					rewritten.targets = append(rewritten.targets, orphanedNeedle{volumeId: newSub.Fid.VolumeId, fileId: newSub.GetFileIdString()})
+					rewritten.reservations = append(rewritten.reservations, nested.reservations...)
 				}
 			}
 			continue
 		}
 		subVid := needle.VolumeId(sub.Fid.VolumeId)
-		toVid, ok := plan[subVid]
-		if !ok {
+		if !plan.isSource(subVid) {
 			continue
 		}
+		recordSeen(subVid)
 		oldSubFid := sub.GetFileIdString()
 		oldSubVid := sub.Fid.VolumeId
-		fmt.Printf("move %s(%s) [inside manifest %s]\n", entryPath, oldSubFid, chunk.GetFileIdString())
+		toVid, ok := plan.allocate(subVid, sub.Size)
+		if !ok {
+			fmt.Printf("skip %s(%s) [inside manifest %s]: no target volume has room\n", entryPath, oldSubFid, chunk.GetFileIdString())
+			continue
+		}
+		fmt.Printf("move %s(%s) => volume %d [inside manifest %s]\n", entryPath, oldSubFid, toVid, chunk.GetFileIdString())
 		if !apply {
 			anySubChanged = true
 			continue
 		}
-		if mErr := moveChunk(sub, toVid, commandEnv.MasterClient); mErr != nil {
+		if mErr := moveChunk(commandEnv, entryPath, sub, toVid); mErr != nil {
 			fmt.Printf("failed to move %s(%s): %v\n", entryPath, oldSubFid, mErr)
+			plan.release(subVid, toVid, sub.Size)
 			continue
 		}
 		anySubChanged = true
-		movedSources = append(movedSources, movedSourceNeedle{volumeId: oldSubVid, fileId: oldSubFid})
+		rewritten.sources = append(rewritten.sources, orphanedNeedle{volumeId: oldSubVid, fileId: oldSubFid})
+		rewritten.targets = append(rewritten.targets, orphanedNeedle{volumeId: uint32(toVid), fileId: sub.GetFileIdString()})
+		rewritten.reservations = append(rewritten.reservations, reservation{src: subVid, dst: toVid, size: sub.Size})
 	}
 
 	manifestVid := needle.VolumeId(chunk.Fid.VolumeId)
-	_, manifestMustMove := plan[manifestVid]
+	manifestMustMove := plan.isSource(manifestVid)
 
 	if !anySubChanged && !manifestMustMove {
-		return chunk, false, nil, nil
+		return chunk, false, rewrittenNeedles{}, nil
 	}
 
 	fmt.Printf("rewrite manifest %s(%s)\n", entryPath, chunk.GetFileIdString())
@@ -585,14 +818,15 @@ func (c *commandFsMergeVolumes) rewriteManifestChunk(
 		// Propagate "would change" so nested callers also announce their
 		// rewrites in dry-run mode. The top-level caller gates any actual
 		// filer writes on *apply, so returning true here is safe.
-		return chunk, true, nil, nil
+		return chunk, true, rewrittenNeedles{}, nil
 	}
 
 	filer_pb.BeforeEntrySerialization(subChunks)
 	defer filer_pb.AfterEntryDeserialization(subChunks)
 	data, err := proto.Marshal(&filer_pb.FileChunkManifest{Chunks: subChunks})
 	if err != nil {
-		return chunk, false, nil, fmt.Errorf("marshal manifest: %w", err)
+		abandon()
+		return chunk, false, rewrittenNeedles{}, fmt.Errorf("marshal manifest: %w", err)
 	}
 
 	collection := ""
@@ -601,7 +835,8 @@ func (c *commandFsMergeVolumes) rewriteManifestChunk(
 	}
 	newChunk, err := c.uploadManifestChunk(ctx, commandEnv, entryPath, collection, plan, data)
 	if err != nil {
-		return chunk, false, nil, fmt.Errorf("upload new manifest: %w", err)
+		abandon()
+		return chunk, false, rewrittenNeedles{}, fmt.Errorf("upload new manifest: %w", err)
 	}
 
 	newChunk.IsChunkManifest = true
@@ -612,7 +847,7 @@ func (c *commandFsMergeVolumes) rewriteManifestChunk(
 	}
 	newChunk.FileId = ""
 
-	return newChunk, true, movedSources, nil
+	return newChunk, true, rewritten, nil
 }
 
 // uploadManifestChunk assigns a fresh file id via the filer and uploads the
@@ -625,11 +860,12 @@ func (c *commandFsMergeVolumes) uploadManifestChunk(
 	commandEnv *CommandEnv,
 	entryPath util.FullPath,
 	collection string,
-	plan map[needle.VolumeId]needle.VolumeId,
+	plan *mergePlan,
 	data []byte,
 ) (*filer_pb.FileChunk, error) {
 	const manifestAssignAttempts = 10
 	var assignResp *filer_pb.AssignVolumeResponse
+	var assignedVid uint32
 	if err := commandEnv.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 		for attempt := 1; attempt <= manifestAssignAttempts; attempt++ {
 			resp, err := client.AssignVolume(ctx, &filer_pb.AssignVolumeRequest{
@@ -652,8 +888,9 @@ func (c *commandFsMergeVolumes) uploadManifestChunk(
 			if parseErr != nil {
 				return fmt.Errorf("parse assigned fid %q: %w", resp.FileId, parseErr)
 			}
-			if _, isSource := plan[needle.VolumeId(fid.VolumeId)]; !isSource {
+			if !plan.isSource(needle.VolumeId(fid.VolumeId)) {
 				assignResp = resp
+				assignedVid = fid.VolumeId
 				return nil
 			}
 			fmt.Printf("rejecting manifest assignment to merge-source volume %d (attempt %d/%d)\n",
@@ -687,17 +924,22 @@ func (c *commandFsMergeVolumes) uploadManifestChunk(
 		UploadUrl: uploadUrl,
 		Jwt:       jwt,
 	})
-	if err != nil {
-		return nil, err
+	if err == nil && uploadResult.Error != "" {
+		err = fmt.Errorf("upload: %s", uploadResult.Error)
 	}
-	if uploadResult.Error != "" {
-		return nil, fmt.Errorf("upload: %s", uploadResult.Error)
+	if err != nil {
+		// Same partial-write window as moveChunk: the needle can be on the
+		// volume even though the upload reported failure, and the caller drops
+		// this manifest instead of pointing the filer at it.
+		deleteOrphanedNeedles(commandEnv, entryPath, []orphanedNeedle{{volumeId: assignedVid, fileId: assignResp.FileId}}, true)
+		return nil, err
 	}
 
 	return uploadResult.ToPbFileChunk(assignResp.FileId, 0, time.Now().UnixNano()), nil
 }
 
-func moveChunk(chunk *filer_pb.FileChunk, toVolumeId needle.VolumeId, masterClient *wdclient.MasterClient) error {
+func moveChunk(commandEnv *CommandEnv, entryPath util.FullPath, chunk *filer_pb.FileChunk, toVolumeId needle.VolumeId) error {
+	masterClient := commandEnv.MasterClient
 	fromFid := needle.NewFileId(needle.VolumeId(chunk.Fid.VolumeId), chunk.Fid.FileKey, chunk.Fid.Cookie)
 	toFid := needle.NewFileId(toVolumeId, chunk.Fid.FileKey, chunk.Fid.Cookie)
 
@@ -714,7 +956,7 @@ func moveChunk(chunk *filer_pb.FileChunk, toVolumeId needle.VolumeId, masterClie
 	}
 	uploadURL := fmt.Sprintf("http://%s/%s", uploadURLs[0], toFid.String())
 
-	resp, reader, err := readUrl(downloadURL)
+	resp, reader, err := readUrl(downloadURL, filer.JwtForVolumeServer(fromFid.String()))
 	if err != nil {
 		return err
 	}
@@ -760,6 +1002,11 @@ func moveChunk(chunk *filer_pb.FileChunk, toVolumeId needle.VolumeId, masterClie
 		Jwt:               security.EncodedJwt(jwt),
 	})
 	if err != nil {
+		// A replicated write commits the needle to the local volume before it
+		// fans out to the other replicas, so an upload that reports failure can
+		// still have left a copy on the target. The caller skips the filer
+		// update for this chunk, so nothing will ever reference that copy.
+		deleteOrphanedNeedles(commandEnv, entryPath, []orphanedNeedle{{volumeId: uint32(toVolumeId), fileId: toFid.String()}}, true)
 		return err
 	}
 	chunk.Fid.VolumeId = uint32(toVolumeId)
@@ -768,13 +1015,16 @@ func moveChunk(chunk *filer_pb.FileChunk, toVolumeId needle.VolumeId, masterClie
 	return nil
 }
 
-func readUrl(fileUrl string) (*http.Response, io.ReadCloser, error) {
+func readUrl(fileUrl string, jwt string) (*http.Response, io.ReadCloser, error) {
 
 	req, err := http.NewRequest(http.MethodGet, fileUrl, nil)
 	if err != nil {
 		return nil, nil, err
 	}
 	req.Header.Add("Accept-Encoding", "gzip")
+	if jwt != "" {
+		req.Header.Set("Authorization", security.BearerPrefix+jwt)
+	}
 
 	r, err := util_http.GetGlobalHttpClient().Do(req)
 	if err != nil {
diff --git a/weed/shell/command_fs_merge_volumes_test.go b/weed/shell/command_fs_merge_volumes_test.go
index 21a71a377a..d02dd60b71 100644
--- a/weed/shell/command_fs_merge_volumes_test.go
+++ b/weed/shell/command_fs_merge_volumes_test.go
@@ -2,6 +2,7 @@ package shell
 
 import (
 	"strings"
+	"sync"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
@@ -28,21 +29,21 @@ func TestCreateMergePlan_HonorsExplicitDirection(t *testing.T) {
 	smaller := &master_pb.VolumeInformationMessage{Id: 83, Size: 7088822248}
 	c := newMergeCmd(250000, larger, smaller)
 
-	plan, err := c.createMergePlan("*", needle.VolumeId(83), needle.VolumeId(87))
+	plan, err := c.createMergePlan("*", []needle.VolumeId{83}, needle.VolumeId(87))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if got := plan[needle.VolumeId(87)]; got != needle.VolumeId(83) {
-		t.Fatalf("expected 87->83, got plan=%v", plan)
+	if got := plan.targets[needle.VolumeId(87)]; len(got) != 1 || got[0] != needle.VolumeId(83) {
+		t.Fatalf("expected 87->83, got plan=%v", plan.targets)
 	}
 
 	// The reverse direction keeps working too.
-	plan, err = c.createMergePlan("*", needle.VolumeId(87), needle.VolumeId(83))
+	plan, err = c.createMergePlan("*", []needle.VolumeId{87}, needle.VolumeId(83))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if got := plan[needle.VolumeId(83)]; got != needle.VolumeId(87) {
-		t.Fatalf("expected 83->87, got plan=%v", plan)
+	if got := plan.targets[needle.VolumeId(83)]; len(got) != 1 || got[0] != needle.VolumeId(87) {
+		t.Fatalf("expected 83->87, got plan=%v", plan.targets)
 	}
 }
 
@@ -53,12 +54,12 @@ func TestCreateMergePlan_DirectedAllowsEmptyTarget(t *testing.T) {
 	emptyTo := &master_pb.VolumeInformationMessage{Id: 83, Size: 0}
 	c := newMergeCmd(250000, from, emptyTo)
 
-	plan, err := c.createMergePlan("*", needle.VolumeId(83), needle.VolumeId(87))
+	plan, err := c.createMergePlan("*", []needle.VolumeId{83}, needle.VolumeId(87))
 	if err != nil {
 		t.Fatalf("unexpected error merging into empty target: %v", err)
 	}
-	if got := plan[needle.VolumeId(87)]; got != needle.VolumeId(83) {
-		t.Fatalf("expected 87->83, got plan=%v", plan)
+	if got := plan.targets[needle.VolumeId(87)]; len(got) != 1 || got[0] != needle.VolumeId(83) {
+		t.Fatalf("expected 87->83, got plan=%v", plan.targets)
 	}
 }
 
@@ -68,7 +69,7 @@ func TestCreateMergePlan_DirectedRejectsSelfMap(t *testing.T) {
 	v := &master_pb.VolumeInformationMessage{Id: 87, Size: 100}
 	c := newMergeCmd(250000, v)
 
-	_, err := c.createMergePlan("*", needle.VolumeId(87), needle.VolumeId(87))
+	_, err := c.createMergePlan("*", []needle.VolumeId{87}, needle.VolumeId(87))
 	if err == nil || !strings.Contains(err.Error(), "no volume id changes") {
 		t.Fatalf("expected self-map rejection, got %v", err)
 	}
@@ -107,13 +108,13 @@ func TestCreateMergePlan_DirectedRejectsIneligible(t *testing.T) {
 			from:    &master_pb.VolumeInformationMessage{Id: 87, Size: 100, Collection: "other"},
 			to:      &master_pb.VolumeInformationMessage{Id: 83, Size: 100, Collection: "other"},
 			coll:    "wanted",
-			wantErr: "volume 87 is not in collection",
+			wantErr: "volume 87 does not match collection filter",
 		},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			c := newMergeCmd(250000, tc.from, tc.to)
-			_, err := c.createMergePlan(tc.coll, needle.VolumeId(tc.to.Id), needle.VolumeId(tc.from.Id))
+			_, err := c.createMergePlan(tc.coll, []needle.VolumeId{needle.VolumeId(tc.to.Id)}, needle.VolumeId(tc.from.Id))
 			if err == nil {
 				t.Fatalf("expected error %q, got nil", tc.wantErr)
 			}
@@ -124,6 +125,162 @@ func TestCreateMergePlan_DirectedRejectsIneligible(t *testing.T) {
 	}
 }
 
+// A source that fits into no single target distributes across several, each
+// chunk going to the target with the most remaining capacity.
+func TestCreateMergePlan_DistributesAcrossMultipleTargets(t *testing.T) {
+	mb := uint64(1024 * 1024)
+	from := &master_pb.VolumeInformationMessage{Id: 112, Size: 60 * mb}
+	to1 := &master_pb.VolumeInformationMessage{Id: 111, Size: 60 * mb}
+	to2 := &master_pb.VolumeInformationMessage{Id: 107, Size: 70 * mb}
+	c := newMergeCmd(100, from, to1, to2)
+
+	plan, err := c.createMergePlan("*", []needle.VolumeId{111, 107}, needle.VolumeId(112))
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got := plan.targets[needle.VolumeId(112)]; len(got) != 2 {
+		t.Fatalf("expected two targets, got %v", got)
+	}
+
+	// 111 has 40 MB free, 107 has 30 MB free. The first chunk goes to the
+	// emptier 111; allocations keep balancing remaining capacity after that.
+	vid, ok := plan.allocate(needle.VolumeId(112), 5*mb)
+	if !ok || vid != needle.VolumeId(111) {
+		t.Fatalf("expected first chunk on 111, got %v ok=%v", vid, ok)
+	}
+	vid, ok = plan.allocate(needle.VolumeId(112), 10*mb)
+	if !ok || vid != needle.VolumeId(111) {
+		t.Fatalf("expected second chunk on 111 (35 MB free vs 30), got %v ok=%v", vid, ok)
+	}
+	vid, ok = plan.allocate(needle.VolumeId(112), 5*mb)
+	if !ok || vid != needle.VolumeId(107) {
+		t.Fatalf("expected third chunk on 107 (30 MB free vs 25), got %v ok=%v", vid, ok)
+	}
+	// A chunk larger than any remaining capacity is refused.
+	if vid, ok = plan.allocate(needle.VolumeId(112), 45*mb); ok {
+		t.Fatalf("expected no room for oversized chunk, got %v", vid)
+	}
+	// Smaller chunks still fit afterwards.
+	if _, ok = plan.allocate(needle.VolumeId(112), 20*mb); !ok {
+		t.Fatal("expected room for 20 MB chunk")
+	}
+
+	// A failed move's release makes the reservation reusable.
+	vid2, ok := plan.allocate(needle.VolumeId(112), 20*mb)
+	if !ok {
+		t.Fatal("expected room for second 20 MB chunk")
+	}
+	plan.release(needle.VolumeId(112), vid2, 20*mb)
+	if vid3, ok := plan.allocate(needle.VolumeId(112), 20*mb); !ok || vid3 != vid2 {
+		t.Fatalf("released capacity must be reusable, got %v ok=%v", vid3, ok)
+	}
+}
+
+// The combined free capacity of all targets must cover the source's live data.
+func TestCreateMergePlan_MultiTargetRejectsInsufficientCapacity(t *testing.T) {
+	mb := uint64(1024 * 1024)
+	from := &master_pb.VolumeInformationMessage{Id: 112, Size: 90 * mb}
+	to1 := &master_pb.VolumeInformationMessage{Id: 111, Size: 60 * mb}
+	to2 := &master_pb.VolumeInformationMessage{Id: 107, Size: 60 * mb}
+	c := newMergeCmd(100, from, to1, to2)
+
+	_, err := c.createMergePlan("*", []needle.VolumeId{111, 107}, needle.VolumeId(112))
+	if err == nil || !strings.Contains(err.Error(), "cannot merge into volumes") {
+		t.Fatalf("expected capacity rejection, got %v", err)
+	}
+}
+
+// Without -fromVolumeId, a -toVolumeId list restricts the heuristic planner's
+// target candidates to the listed volumes.
+func TestCreateMergePlan_TargetListRestrictsHeuristic(t *testing.T) {
+	mb := uint64(1024 * 1024)
+	big := &master_pb.VolumeInformationMessage{Id: 1, Size: 80 * mb}
+	mid := &master_pb.VolumeInformationMessage{Id: 2, Size: 50 * mb}
+	small := &master_pb.VolumeInformationMessage{Id: 3, Size: 10 * mb}
+	c := newMergeCmd(100, big, mid, small)
+
+	plan, err := c.createMergePlan("*", []needle.VolumeId{2}, 0)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got := plan.targets[needle.VolumeId(3)]; len(got) != 1 || got[0] != needle.VolumeId(2) {
+		t.Fatalf("expected 3->2, got %v", plan.targets)
+	}
+	if plan.isSource(needle.VolumeId(1)) {
+		t.Fatalf("volume 1 must not merge anywhere, got %v", plan.targets)
+	}
+}
+
+func TestParseTargetVolumeIds(t *testing.T) {
+	if ids, err := parseTargetVolumeIds(""); err != nil || ids != nil {
+		t.Fatalf("empty arg: got %v, %v", ids, err)
+	}
+	if ids, err := parseTargetVolumeIds("0"); err != nil || ids != nil {
+		t.Fatalf("zero arg: got %v, %v", ids, err)
+	}
+	ids, err := parseTargetVolumeIds("111, 107")
+	if err != nil || len(ids) != 2 || ids[0] != needle.VolumeId(111) || ids[1] != needle.VolumeId(107) {
+		t.Fatalf("list arg: got %v, %v", ids, err)
+	}
+	if _, err = parseTargetVolumeIds("111,111"); err == nil {
+		t.Fatal("expected duplicate rejection")
+	}
+	if _, err = parseTargetVolumeIds("111,x"); err == nil {
+		t.Fatal("expected invalid id rejection")
+	}
+	if _, err = parseTargetVolumeIds("4294967297"); err == nil {
+		t.Fatal("expected uint32 overflow rejection")
+	}
+}
+
+// The collection filter speaks the shared vocabulary: "_default" selects the
+// empty-named collection, a name or pattern only its matches, and "*" (or no
+// flag) every collection.
+func TestCreateMergePlan_CollectionFilter(t *testing.T) {
+	mb := uint64(1024 * 1024)
+	mk := func(id uint32, sizeMB uint64, collection string) *master_pb.VolumeInformationMessage {
+		return &master_pb.VolumeInformationMessage{Id: id, Size: sizeMB * mb, Collection: collection}
+	}
+	newCmd := func() *commandFsMergeVolumes {
+		return newMergeCmd(250000, mk(1, 10, ""), mk(2, 80, ""), mk(3, 10, "x"), mk(4, 80, "x"))
+	}
+
+	// "_default" merges only the unnamed-collection volumes.
+	plan, err := newCmd().createMergePlan(CollectionDefault, nil, 0)
+	if err != nil {
+		t.Fatalf("%s: %v", CollectionDefault, err)
+	}
+	if got := plan.targets[needle.VolumeId(1)]; len(got) != 1 || got[0] != needle.VolumeId(2) {
+		t.Fatalf("expected 1->2, got %v", plan.targets)
+	}
+	if plan.isSource(needle.VolumeId(3)) {
+		t.Fatalf("named-collection volume must not merge under _default, got %v", plan.targets)
+	}
+
+	// A literal name still selects its collection.
+	plan, err = newCmd().createMergePlan("x", nil, 0)
+	if err != nil {
+		t.Fatalf("x: %v", err)
+	}
+	if got := plan.targets[needle.VolumeId(3)]; len(got) != 1 || got[0] != needle.VolumeId(4) {
+		t.Fatalf("expected 3->4, got %v", plan.targets)
+	}
+	if plan.isSource(needle.VolumeId(1)) {
+		t.Fatalf("unnamed volume must not merge under x, got %v", plan.targets)
+	}
+
+	// "*" keeps covering every collection.
+	plan, err = newCmd().createMergePlan("*", nil, 0)
+	if err != nil {
+		t.Fatalf("*: %v", err)
+	}
+	for src, dest := range map[needle.VolumeId]needle.VolumeId{1: 2, 3: 4} {
+		if got := plan.targets[src]; len(got) != 1 || got[0] != dest {
+			t.Fatalf("expected %d->%d, got %v", src, dest, plan.targets)
+		}
+	}
+}
+
 // A volume reporting more deleted bytes than it holds must read as empty.
 func TestGetVolumeSize_ClampsDeletedOverSize(t *testing.T) {
 	c := newMergeCmd(250000)
@@ -138,3 +295,102 @@ func TestGetVolumeSize_ClampsDeletedOverSize(t *testing.T) {
 		t.Errorf("expected 2000, got %d", got)
 	}
 }
+
+// Manifests on volumes in a foreign collection cannot reference plan volumes
+// and must be skipped instead of downloaded; plan sources and unknown volumes
+// must still be resolved.
+func TestManifestMayReferencePlan(t *testing.T) {
+	src := &master_pb.VolumeInformationMessage{Id: 1, Size: 100, Collection: "x"}
+	same := &master_pb.VolumeInformationMessage{Id: 2, Size: 100, Collection: "x"}
+	foreign := &master_pb.VolumeInformationMessage{Id: 3, Size: 100, Collection: "y"}
+	c := newMergeCmd(250000, src, same, foreign)
+
+	plan := newMergePlan(c.volumeSizeLimit)
+	plan.targets[needle.VolumeId(1)] = []needle.VolumeId{2}
+	planCollections := map[string]bool{"x": true}
+
+	for vid, want := range map[needle.VolumeId]bool{
+		1: true,  // plan source
+		2: true,  // same collection
+		3: false, // foreign collection
+		9: true,  // unknown volume, resolve conservatively
+	} {
+		if got := c.manifestMayReferencePlan(plan, planCollections, vid); got != want {
+			t.Fatalf("volume %d: got %v, want %v", vid, got, want)
+		}
+	}
+}
+
+// A source whose index still holds needles but that the traversal never saw is
+// made entirely of orphan needles — the merge moves nothing, but the operator
+// must be told the real cleanup is fsck.
+func TestWarnUnreferencedSources(t *testing.T) {
+	vol := &master_pb.VolumeInformationMessage{Id: 203, FileCount: 18}
+	c := newMergeCmd(250000, vol)
+	plan := &mergePlan{targets: map[needle.VolumeId][]needle.VolumeId{
+		needle.VolumeId(203): {needle.VolumeId(187)},
+	}}
+
+	var sb strings.Builder
+	c.warnUnreferencedSources(&sb, plan, newSourceNeedleCounter(), "/buckets/test")
+	out := sb.String()
+	if !strings.Contains(out, "volume 203") || !strings.Contains(out, "orphan needles") {
+		t.Fatalf("expected orphan warning, got %q", out)
+	}
+
+	// Needles seen during traversal: no warning.
+	seen := newSourceNeedleCounter()
+	for i := 0; i < 7; i++ {
+		seen.record(needle.VolumeId(203))
+	}
+	sb.Reset()
+	c.warnUnreferencedSources(&sb, plan, seen, "/buckets/test")
+	if sb.Len() != 0 {
+		t.Fatalf("expected no warning when needles were seen, got %q", sb.String())
+	}
+
+	// Zero FileCount (truly empty volume): nothing to report.
+	emptyVol := &master_pb.VolumeInformationMessage{Id: 204}
+	c2 := newMergeCmd(250000, emptyVol)
+	plan2 := &mergePlan{targets: map[needle.VolumeId][]needle.VolumeId{
+		needle.VolumeId(204): {needle.VolumeId(187)},
+	}}
+	sb.Reset()
+	c2.warnUnreferencedSources(&sb, plan2, newSourceNeedleCounter(), "/buckets/test")
+	if sb.Len() != 0 {
+		t.Fatalf("expected no warning for empty volume, got %q", sb.String())
+	}
+}
+
+// Concurrent BFS workers increment the production counter through record — the
+// count must stay correct under -race with source-heavy inputs.
+func TestWarnUnreferencedSources_ConcurrentRecording(t *testing.T) {
+	vol := &master_pb.VolumeInformationMessage{Id: 203, FileCount: 1000}
+	c := newMergeCmd(250000, vol)
+	plan := &mergePlan{targets: map[needle.VolumeId][]needle.VolumeId{
+		needle.VolumeId(203): {needle.VolumeId(187)},
+	}}
+
+	seen := newSourceNeedleCounter()
+	var wg sync.WaitGroup
+	for w := 0; w < 5; w++ { // TraverseBfs worker count
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < 200; i++ {
+				seen.record(needle.VolumeId(203))
+			}
+		}()
+	}
+	wg.Wait()
+
+	if got := seen.count(needle.VolumeId(203)); got != 1000 {
+		t.Fatalf("lost increments under concurrency: %d", got)
+	}
+
+	var sb strings.Builder
+	c.warnUnreferencedSources(&sb, plan, seen, "/buckets/test")
+	if sb.Len() != 0 {
+		t.Fatalf("expected no warning when all needles were seen, got %q", sb.String())
+	}
+}
diff --git a/weed/shell/command_fs_meta_load.go b/weed/shell/command_fs_meta_load.go
index 93426ce516..a8ff28a383 100644
--- a/weed/shell/command_fs_meta_load.go
+++ b/weed/shell/command_fs_meta_load.go
@@ -11,10 +11,9 @@ import (
 	"sync"
 	"time"
 
-	"google.golang.org/protobuf/proto"
-
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/protobuf/proto"
 )
 
 func init() {
@@ -88,83 +87,11 @@ func (c *commandFsMetaLoad) Do(args []string, commandEnv *CommandEnv, writer io.
 	}
 
 	var dirCount, fileCount uint64
-	lastLogTime := time.Now()
 
 	err = commandEnv.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
-
-		sizeBuf := make([]byte, 4)
-		waitChan := make(chan struct{}, *concurrency)
-		defer close(waitChan)
-		var wg sync.WaitGroup
-
-		for {
-			if _, err := io.ReadFull(dst, sizeBuf); err != nil {
-				if err == io.EOF {
-					return nil
-				}
-				return err
-			}
-
-			size := util.BytesToUint32(sizeBuf)
-
-			data := make([]byte, int(size))
-
-			if _, err := io.ReadFull(dst, data); err != nil {
-				return err
-			}
-
-			fullEntry := &filer_pb.FullEntry{}
-			if err = proto.Unmarshal(data, fullEntry); err != nil {
-				return err
-			}
-
-			// check collection name pattern
-			entryFullName := string(util.FullPath(fullEntry.Dir).Child(fullEntry.Entry.Name))
-			if *c.dirPrefix != "" {
-				if !strings.HasPrefix(fullEntry.Dir, *c.dirPrefix) {
-					if *verbose {
-						fmt.Fprintf(writer, "not match dir prefix %s\n", entryFullName)
-					}
-					continue
-				}
-			}
-
-			if *verbose || lastLogTime.Add(time.Second).Before(time.Now()) {
-				if !*verbose {
-					lastLogTime = time.Now()
-				}
-				fmt.Fprintf(writer, "load %s\n", entryFullName)
-			}
-
-			fullEntry.Entry.Name = strings.ReplaceAll(fullEntry.Entry.Name, "/", "x")
-			if fullEntry.Entry.IsDirectory {
-				wg.Wait()
-				if errEntry := filer_pb.CreateEntry(context.Background(), client, &filer_pb.CreateEntryRequest{
-					Directory: fullEntry.Dir,
-					Entry:     fullEntry.Entry,
-				}); errEntry != nil {
-					return errEntry
-				}
-				dirCount++
-			} else {
-				wg.Add(1)
-				waitChan <- struct{}{}
-				go func(entry *filer_pb.FullEntry) {
-					if errEntry := filer_pb.CreateEntry(context.Background(), client, &filer_pb.CreateEntryRequest{
-						Directory: entry.Dir,
-						Entry:     entry.Entry,
-					}); errEntry != nil {
-						err = errEntry
-					}
-					defer wg.Done()
-					<-waitChan
-				}(fullEntry)
-				if err != nil {
-					return err
-				}
-				fileCount++
-			}
-		}
+		var loadErr error
+		dirCount, fileCount, loadErr = c.loadEntries(dst, client, *c.dirPrefix, *concurrency, *verbose, writer)
+		return loadErr
 	})
 
 	if err == nil {
@@ -174,3 +101,111 @@ func (c *commandFsMetaLoad) Do(args []string, commandEnv *CommandEnv, writer io.
 
 	return err
 }
+
+func (c *commandFsMetaLoad) loadEntries(dst io.Reader, client filer_pb.SeaweedFilerClient, dirPrefix string, concurrency int, verbose bool, writer io.Writer) (dirCount, fileCount uint64, err error) {
+
+	lastLogTime := time.Now()
+	sizeBuf := make([]byte, 4)
+	waitChan := make(chan struct{}, concurrency)
+	defer close(waitChan)
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	var loadErr error
+	getErr := func() error {
+		mu.Lock()
+		defer mu.Unlock()
+		return loadErr
+	}
+	setErr := func(e error) {
+		mu.Lock()
+		if loadErr == nil {
+			loadErr = e
+		}
+		mu.Unlock()
+	}
+
+	for {
+		if _, err := io.ReadFull(dst, sizeBuf); err != nil {
+			wg.Wait()
+			if loadErr := getErr(); loadErr != nil {
+				return dirCount, fileCount, loadErr
+			}
+			if err == io.EOF {
+				return dirCount, fileCount, nil
+			}
+			return dirCount, fileCount, err
+		}
+
+		size := util.BytesToUint32(sizeBuf)
+
+		data := make([]byte, int(size))
+
+		if _, err := io.ReadFull(dst, data); err != nil {
+			wg.Wait()
+			if loadErr := getErr(); loadErr != nil {
+				return dirCount, fileCount, loadErr
+			}
+			return dirCount, fileCount, err
+		}
+
+		fullEntry := &filer_pb.FullEntry{}
+		if err = proto.Unmarshal(data, fullEntry); err != nil {
+			wg.Wait()
+			if loadErr := getErr(); loadErr != nil {
+				return dirCount, fileCount, loadErr
+			}
+			return dirCount, fileCount, err
+		}
+
+		// check collection name pattern
+		entryFullName := string(util.FullPath(fullEntry.Dir).Child(fullEntry.Entry.Name))
+		if dirPrefix != "" {
+			if !strings.HasPrefix(fullEntry.Dir, dirPrefix) {
+				if verbose {
+					fmt.Fprintf(writer, "not match dir prefix %s\n", entryFullName)
+				}
+				continue
+			}
+		}
+
+		if verbose || lastLogTime.Add(time.Second).Before(time.Now()) {
+			if !verbose {
+				lastLogTime = time.Now()
+			}
+			fmt.Fprintf(writer, "load %s\n", entryFullName)
+		}
+
+		fullEntry.Entry.Name = strings.ReplaceAll(fullEntry.Entry.Name, "/", "x")
+		if fullEntry.Entry.IsDirectory {
+			wg.Wait()
+			if loadErr := getErr(); loadErr != nil {
+				return dirCount, fileCount, loadErr
+			}
+			if errEntry := filer_pb.CreateEntry(context.Background(), client, &filer_pb.CreateEntryRequest{
+				Directory: fullEntry.Dir,
+				Entry:     fullEntry.Entry,
+			}); errEntry != nil {
+				return dirCount, fileCount, errEntry
+			}
+			dirCount++
+		} else {
+			wg.Add(1)
+			waitChan <- struct{}{}
+			go func(entry *filer_pb.FullEntry) {
+				if errEntry := filer_pb.CreateEntry(context.Background(), client, &filer_pb.CreateEntryRequest{
+					Directory: entry.Dir,
+					Entry:     entry.Entry,
+				}); errEntry != nil {
+					setErr(errEntry)
+				}
+				defer wg.Done()
+				<-waitChan
+			}(fullEntry)
+			if loadErr := getErr(); loadErr != nil {
+				wg.Wait()
+				return dirCount, fileCount, loadErr
+			}
+			fileCount++
+		}
+	}
+}
diff --git a/weed/shell/command_fs_meta_load_test.go b/weed/shell/command_fs_meta_load_test.go
new file mode 100644
index 0000000000..a3c3f36e66
--- /dev/null
+++ b/weed/shell/command_fs_meta_load_test.go
@@ -0,0 +1,247 @@
+package shell
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"sync"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+type stubMetaLoadClient struct {
+	filer_pb.SeaweedFilerClient
+	createEntry func(ctx context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error)
+}
+
+func (s *stubMetaLoadClient) CreateEntry(ctx context.Context, req *filer_pb.CreateEntryRequest, opts ...grpc.CallOption) (*filer_pb.CreateEntryResponse, error) {
+	return s.createEntry(ctx, req)
+}
+
+func writeMetaEntry(t *testing.T, buf *bytes.Buffer, dir, name string, isDir bool) {
+	t.Helper()
+	data, err := proto.Marshal(&filer_pb.FullEntry{
+		Dir:   dir,
+		Entry: &filer_pb.Entry{Name: name, IsDirectory: isDir},
+	})
+	if err != nil {
+		t.Fatalf("marshal entry %s/%s: %v", dir, name, err)
+	}
+	sizeBuf := make([]byte, 4)
+	util.Uint32toBytes(sizeBuf, uint32(len(data)))
+	buf.Write(sizeBuf)
+	buf.Write(data)
+}
+
+func runLoadEntries(c *commandFsMetaLoad, buf *bytes.Buffer, client filer_pb.SeaweedFilerClient) (dirCount, fileCount uint64, err error) {
+	return c.loadEntries(buf, client, "", 4, false, io.Discard)
+}
+
+func TestFsMetaLoadCreatesAllEntries(t *testing.T) {
+	var buf bytes.Buffer
+	writeMetaEntry(t, &buf, "/dir", "sub", true)
+	writeMetaEntry(t, &buf, "/dir", "file1", false)
+	writeMetaEntry(t, &buf, "/dir", "file2", false)
+
+	var mu sync.Mutex
+	var created []string
+	client := &stubMetaLoadClient{createEntry: func(ctx context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+		mu.Lock()
+		created = append(created, req.Directory+"/"+req.Entry.Name)
+		mu.Unlock()
+		return &filer_pb.CreateEntryResponse{}, nil
+	}}
+
+	c := &commandFsMetaLoad{}
+	dirCount, fileCount, err := runLoadEntries(c, &buf, client)
+	if err != nil {
+		t.Fatalf("loadEntries: %v", err)
+	}
+	if dirCount != 1 || fileCount != 2 {
+		t.Fatalf("got %d dirs %d files, want 1 dir 2 files", dirCount, fileCount)
+	}
+	if len(created) != 3 {
+		t.Fatalf("got %d CreateEntry calls, want 3", len(created))
+	}
+}
+
+func TestFsMetaLoadWaitsForInflightCreateAtEOF(t *testing.T) {
+	var buf bytes.Buffer
+	writeMetaEntry(t, &buf, "/dir", "file1", false)
+
+	started := make(chan struct{})
+	release := make(chan struct{})
+	client := &stubMetaLoadClient{createEntry: func(ctx context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+		close(started)
+		<-release
+		return &filer_pb.CreateEntryResponse{}, nil
+	}}
+
+	c := &commandFsMetaLoad{}
+	done := make(chan error, 1)
+	go func() {
+		_, _, err := runLoadEntries(c, &buf, client)
+		done <- err
+	}()
+
+	select {
+	case <-started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("CreateEntry was not called")
+	}
+
+	select {
+	case err := <-done:
+		t.Fatalf("loadEntries returned %v while CreateEntry was still in flight", err)
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	close(release)
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatalf("loadEntries: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("loadEntries did not return after CreateEntry completed")
+	}
+}
+
+func TestFsMetaLoadWaitsForInflightCreateOnCorruptData(t *testing.T) {
+	var buf bytes.Buffer
+	writeMetaEntry(t, &buf, "/dir", "file1", false)
+	writeCorruptTail(&buf)
+
+	started := make(chan struct{})
+	release := make(chan struct{})
+	client := &stubMetaLoadClient{createEntry: func(ctx context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+		close(started)
+		<-release
+		return &filer_pb.CreateEntryResponse{}, nil
+	}}
+
+	c := &commandFsMetaLoad{}
+	done := make(chan error, 1)
+	go func() {
+		_, _, err := runLoadEntries(c, &buf, client)
+		done <- err
+	}()
+
+	select {
+	case <-started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("CreateEntry was not called")
+	}
+
+	select {
+	case err := <-done:
+		t.Fatalf("loadEntries returned %v while CreateEntry was still in flight", err)
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	close(release)
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("loadEntries returned nil on truncated input")
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("loadEntries did not return after CreateEntry completed")
+	}
+}
+
+func TestFsMetaLoadReturnsWorkerError(t *testing.T) {
+	var buf bytes.Buffer
+	writeMetaEntry(t, &buf, "/dir", "file1", false)
+
+	workerErr := errors.New("create entry rejected")
+	client := &stubMetaLoadClient{createEntry: func(ctx context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+		return nil, workerErr
+	}}
+
+	c := &commandFsMetaLoad{}
+	_, _, err := runLoadEntries(c, &buf, client)
+	if !errors.Is(err, workerErr) {
+		t.Fatalf("got %v, want wrapped %v", err, workerErr)
+	}
+}
+
+func TestFsMetaLoadPrefersWorkerErrorOverReadError(t *testing.T) {
+	var buf bytes.Buffer
+	writeMetaEntry(t, &buf, "/dir", "file1", false)
+	writeCorruptTail(&buf)
+
+	workerErr := errors.New("create entry rejected")
+	started := make(chan struct{})
+	release := make(chan struct{})
+	client := &stubMetaLoadClient{createEntry: func(ctx context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+		close(started)
+		<-release
+		return nil, workerErr
+	}}
+
+	c := &commandFsMetaLoad{}
+	done := make(chan error, 1)
+	go func() {
+		_, _, err := runLoadEntries(c, &buf, client)
+		done <- err
+	}()
+
+	select {
+	case <-started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("CreateEntry was not called")
+	}
+	close(release)
+
+	select {
+	case err := <-done:
+		if !errors.Is(err, workerErr) {
+			t.Fatalf("got %v, want wrapped %v", err, workerErr)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("loadEntries did not return")
+	}
+}
+
+func TestFsMetaLoadReturnsErrorOnCorruptData(t *testing.T) {
+	client := &stubMetaLoadClient{createEntry: func(ctx context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+		return &filer_pb.CreateEntryResponse{}, nil
+	}}
+	c := &commandFsMetaLoad{}
+
+	t.Run("truncated entry data", func(t *testing.T) {
+		var buf bytes.Buffer
+		writeMetaEntry(t, &buf, "/dir", "file1", false)
+		writeCorruptTail(&buf)
+		if _, _, err := runLoadEntries(c, &buf, client); err == nil {
+			t.Fatal("loadEntries returned nil on truncated input")
+		}
+	})
+
+	t.Run("malformed proto", func(t *testing.T) {
+		var buf bytes.Buffer
+		writeMetaEntry(t, &buf, "/dir", "file1", false)
+		sizeBuf := make([]byte, 4)
+		util.Uint32toBytes(sizeBuf, 4)
+		buf.Write(sizeBuf)
+		buf.Write([]byte{0xff, 0xff, 0xff, 0xff})
+		if _, _, err := runLoadEntries(c, &buf, client); err == nil {
+			t.Fatal("loadEntries returned nil on malformed proto")
+		}
+	})
+}
+
+func writeCorruptTail(buf *bytes.Buffer) {
+	sizeBuf := make([]byte, 4)
+	util.Uint32toBytes(sizeBuf, 100)
+	buf.Write(sizeBuf)
+	buf.Write([]byte{1, 2, 3})
+}
diff --git a/weed/shell/command_fs_meta_save.go b/weed/shell/command_fs_meta_save.go
index da88bf34e7..c52cc421dc 100644
--- a/weed/shell/command_fs_meta_save.go
+++ b/weed/shell/command_fs_meta_save.go
@@ -20,6 +20,9 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
 )
 
 func init() {
@@ -72,7 +75,7 @@ func (c *commandFsMetaSave) Do(args []string, commandEnv *CommandEnv, writer io.
 	if fileName == "" {
 		t := time.Now()
 		fileName = fmt.Sprintf("%s-%4d%02d%02d-%02d%02d%02d.meta.gz",
-			commandEnv.option.FilerAddress.ToHttpAddress(), t.Year(), t.Month(), t.Day(), t.Hour(), t.Minute(), t.Second())
+			commandEnv.FilerAddress().ToHttpAddress(), t.Year(), t.Month(), t.Day(), t.Hour(), t.Minute(), t.Second())
 	}
 
 	var dst io.Writer
@@ -140,7 +143,7 @@ func (c *commandFsMetaSave) Do(args []string, commandEnv *CommandEnv, writer io.
 	})
 
 	if err == nil {
-		fmt.Fprintf(writer, "meta data for http://%s%s is saved to %s\n", commandEnv.option.FilerAddress.ToHttpAddress(), path, fileName)
+		fmt.Fprintf(writer, "meta data for http://%s%s is saved to %s\n", commandEnv.FilerAddress().ToHttpAddress(), path, fileName)
 	}
 
 	return err
@@ -152,6 +155,133 @@ func (c *commandFsMetaSave) Do(args []string, commandEnv *CommandEnv, writer io.
 // log; volume.fsck and fs.verify must leave it false so the live log-file
 // chunks are accounted for — otherwise fsck reports them as orphans and could
 // delete referenced needles.
+// doTraverseAndSaving feeds every entry at and below path through genFn and
+// saveFn: from one snapshot of the filer store when the filer can provide it
+// (so a file renamed during the traversal is not missed), by walking otherwise.
+func doTraverseAndSaving(filerClient filer_pb.FilerClient, writer io.Writer, path string, verbose bool, skipSystemLog bool, genFn func(ctx context.Context, entry *filer_pb.FullEntry, outputChan chan interface{}) error, saveFn func(outputChan chan interface{}) error) error {
+	if used, err := doTraverseSnapshotAndSaving(filerClient, writer, path, verbose, skipSystemLog, genFn, saveFn); used || err != nil {
+		return err
+	}
+	return doTraverseBfsAndSaving(filerClient, writer, path, verbose, skipSystemLog, genFn, saveFn)
+}
+
+// doTraverseSnapshotAndSaving asks the filer to traverse path itself and
+// consumes the stream only when the filer serves it from a store snapshot
+// (filer_pb.TraverseModeHeaderKey). Otherwise it returns used=false having
+// read nothing, and the caller walks as before.
+func doTraverseSnapshotAndSaving(filerClient filer_pb.FilerClient, writer io.Writer, path string, verbose bool, skipSystemLog bool, genFn func(ctx context.Context, entry *filer_pb.FullEntry, outputChan chan interface{}) error, saveFn func(outputChan chan interface{}) error) (used bool, err error) {
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	var excludedPrefixes []string
+	if skipSystemLog {
+		excludedPrefixes = append(excludedPrefixes, filer.SystemLogDir)
+	}
+
+	// The walk tolerates a path that does not exist (it saves nothing); the
+	// filer-side traversal reports it as an error, so let the walk have it.
+	// Any other failure must stop here: a walk that could then reach the filer
+	// reads renamed-away entries as absent, and fsck would purge their chunks.
+	if _, _, _, getErr := filer_pb.GetEntry(ctx, filerClient, util.FullPath(path)); getErr != nil {
+		if errors.Is(getErr, filer_pb.ErrNotFound) {
+			return false, nil
+		}
+		return false, fmt.Errorf("traverse %s: %w", path, getErr)
+	}
+
+	err = filerClient.WithFilerClient(true, func(client filer_pb.SeaweedFilerClient) error {
+		ctx := metadata.AppendToOutgoingContext(ctx, filer_pb.TraverseModeHeaderKey, filer_pb.TraverseModeSnapshot)
+		stream, err := client.TraverseBfsMetadata(ctx, &filer_pb.TraverseBfsMetadataRequest{
+			Directory:        path,
+			ExcludedPrefixes: excludedPrefixes,
+		})
+		if err != nil {
+			return err
+		}
+		header, err := stream.Header()
+		if err != nil {
+			if status.Code(err) == codes.Unimplemented {
+				return nil // a filer without the RPC at all: walk
+			}
+			return fmt.Errorf("traverse %s: %w", path, err)
+		}
+		if modes := header.Get(filer_pb.TraverseModeHeaderKey); len(modes) == 0 || modes[0] != filer_pb.TraverseModeSnapshot {
+			// An older filer (no header), a store that cannot scan ("bfs"), or
+			// a stream that failed before any header, which Header() reports
+			// as no header and nil: only Recv tells, and a failure is no
+			// licence to walk instead.
+			if _, recvErr := stream.Recv(); recvErr != nil && !errors.Is(recvErr, io.EOF) && status.Code(recvErr) != codes.Unimplemented {
+				return fmt.Errorf("traverse %s: %w", path, recvErr)
+			}
+			return nil
+		}
+		used = true
+
+		var wg sync.WaitGroup
+		wg.Add(1)
+		outputChan := make(chan interface{}, 1024)
+		saveErrChan := make(chan error, 1)
+		go func() {
+			saveErr := saveFn(outputChan)
+			saveErrChan <- saveErr
+			if saveErr != nil {
+				cancel()
+			}
+			wg.Done()
+		}()
+
+		var dirCount, fileCount uint64
+		var recvErr error
+		for {
+			resp, err := stream.Recv()
+			if err != nil {
+				if !errors.Is(err, io.EOF) {
+					recvErr = fmt.Errorf("traverse %s: %w", path, err)
+				}
+				break
+			}
+			if resp.Entry == nil {
+				continue
+			}
+			protoMessage := &filer_pb.FullEntry{
+				Dir:   resp.Directory,
+				Entry: resp.Entry,
+			}
+			if genErr := genFn(ctx, protoMessage, outputChan); genErr != nil {
+				recvErr = genErr
+				cancel()
+				break
+			}
+			if resp.Entry.IsDirectory {
+				dirCount++
+			} else {
+				fileCount++
+			}
+			if verbose {
+				println(util.NewFullPath(resp.Directory, resp.Entry.Name))
+			}
+		}
+
+		close(outputChan)
+		wg.Wait()
+		saveErr := <-saveErrChan
+
+		if recvErr != nil {
+			return recvErr
+		}
+		if saveErr != nil {
+			return saveErr
+		}
+		if writer != nil {
+			fmt.Fprintf(writer, "collected filer entries from a consistent store snapshot\n")
+			fmt.Fprintf(writer, "total %d directories, %d files\n", dirCount, fileCount)
+		}
+		return nil
+	})
+	return used, err
+}
+
 func doTraverseBfsAndSaving(filerClient filer_pb.FilerClient, writer io.Writer, path string, verbose bool, skipSystemLog bool, genFn func(ctx context.Context, entry *filer_pb.FullEntry, outputChan chan interface{}) error, saveFn func(outputChan chan interface{}) error) error {
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -193,6 +323,9 @@ func doTraverseBfsAndSaving(filerClient filer_pb.FilerClient, writer io.Writer,
 				firstErr = genErr
 				hasErr.Store(true)
 			})
+			close(outputChan)
+			wg.Wait()
+			<-saveErrChan
 			return genErr
 		} else {
 			if e.IsDirectory {
diff --git a/weed/shell/command_fs_verify.go b/weed/shell/command_fs_verify.go
index a96fc09d1c..24007793f0 100644
--- a/weed/shell/command_fs_verify.go
+++ b/weed/shell/command_fs_verify.go
@@ -22,6 +22,8 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"go.uber.org/atomic"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 func init() {
@@ -34,6 +36,7 @@ type commandFsVerify struct {
 	volumeIds          map[uint32][]pb.ServerAddress
 	verbose            *bool
 	metadataFromLog    *bool
+	pruneEntries       *bool
 	concurrency        *int
 	modifyTimeAgoAtSec int64
 	writer             io.Writer
@@ -48,7 +51,12 @@ func (c *commandFsVerify) Name() string {
 func (c *commandFsVerify) Help() string {
 	return `recursively verify all files under a directory
 
-	fs.verify [-v] [-modifyTimeAgo 1h] /buckets/dir
+	fs.verify [-v] [-modifyTimeAgo 1h] [-pruneEntries] [-concurrency 4] /buckets/dir
+
+	-pruneEntries deletes filer entries whose needles are missing from every
+	volume location holding the volume (data lost, e.g. after a volume
+	truncation). The delete only applies when the entry is unchanged since
+	verification, so a re-uploaded file is never pruned.
 
 `
 }
@@ -65,6 +73,7 @@ func (c *commandFsVerify) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 	modifyTimeAgo := fsVerifyCommand.Duration("modifyTimeAgo", 0, "only include files after this modify time to verify")
 	c.concurrency = fsVerifyCommand.Int("concurrency", 0, "number of parallel verification per volume server")
 	c.metadataFromLog = fsVerifyCommand.Bool("metadataFromLog", false, "Using  filer log to get metadata")
+	c.pruneEntries = fsVerifyCommand.Bool("pruneEntries", false, "delete filer entries whose needles are missing from all volume locations (data lost); a changed entry is never deleted")
 	if err = fsVerifyCommand.Parse(args); err != nil {
 		return err
 	}
@@ -96,18 +105,15 @@ func (c *commandFsVerify) Do(args []string, commandEnv *CommandEnv, writer io.Wr
 			defer close(c.waitChan[volumeServerStr])
 		}
 	}
-	var fCount, eCount uint64
+	var fCount, eCount, pCount uint64
 	if *c.metadataFromLog {
 		var wg sync.WaitGroup
-		fCount, eCount, err = c.verifyProcessMetadata(path, &wg)
+		fCount, eCount, pCount, err = c.verifyProcessMetadata(path, &wg)
 		wg.Wait()
-		if err != nil {
-			return err
-		}
 	} else {
-		fCount, eCount, err = c.verifyTraverseBfs(path)
+		fCount, eCount, pCount, err = c.verifyTraverseBfs(path)
 	}
-	fmt.Fprintf(writer, "verified %d files, error %d files \n", fCount, eCount)
+	fmt.Fprintf(writer, "verified %d files, error %d files, pruned %d entries \n", fCount, eCount, pCount)
 	return err
 }
 
@@ -154,11 +160,35 @@ func (c *commandFsVerify) verifyChunk(volumeServer pb.ServerAddress, fileId *fil
 }
 
 type ItemEntry struct {
-	chunks []*filer_pb.FileChunk
-	path   util.FullPath
+	chunks    []*filer_pb.FileChunk
+	rawChunks []*filer_pb.FileChunk
+	path      util.FullPath
+	mtimeSec  int64
+	md5       []byte
 }
 
-func (c *commandFsVerify) verifyProcessMetadata(path string, wg *sync.WaitGroup) (fileCount uint64, errCount uint64, err error) {
+// resolveAndVerify expands chunk manifests and verifies the entry's needles.
+// An unresolvable manifest is an entry-level failure even when raw chunks are
+// healthy; raw chunks are still checked so a missing manifest needle can be pruned.
+func (c *commandFsVerify) resolveAndVerify(entryPath string, chunks []*filer_pb.FileChunk, errorChunksCount *atomic.Uint64, wg *sync.WaitGroup) (verified bool, hasMissingNeedles bool) {
+	dataChunks := chunks
+	manifestResolveFailed := false
+	if resolved, manifestChunks, resolveErr := filer.ResolveChunkManifest(context.Background(), filer.LookupFn(c.env), chunks, 0, math.MaxInt64, nil); resolveErr == nil {
+		dataChunks = append(resolved, manifestChunks...)
+	} else {
+		manifestResolveFailed = true
+		fmt.Fprintf(c.writer, "file: %s failed to resolve chunk manifest (%v), verifying raw chunks\n", entryPath, resolveErr)
+	}
+	verified, hasMissingNeedles = c.verifyEntry(entryPath, dataChunks, errorChunksCount, wg)
+	if manifestResolveFailed && verified {
+		// an unreadable manifest is an entry-level failure even with healthy raw needles
+		verified = false
+		errorChunksCount.CompareAndSwap(0, 1)
+	}
+	return verified, hasMissingNeedles
+}
+
+func (c *commandFsVerify) verifyProcessMetadata(path string, wg *sync.WaitGroup) (fileCount uint64, errCount uint64, prunedCount uint64, err error) {
 	processEventFn := func(resp *filer_pb.SubscribeMetadataResponse) error {
 		message := resp.EventNotification
 		if resp.EventNotification.NewEntry == nil {
@@ -170,7 +200,8 @@ func (c *commandFsVerify) verifyProcessMetadata(path string, wg *sync.WaitGroup)
 		}
 		entryPath := fmt.Sprintf("%s/%s", message.NewParentPath, message.NewEntry.Name)
 		errorChunksCount := atomic.NewUint64(0)
-		if !c.verifyEntry(entryPath, message.NewEntry.Chunks, errorChunksCount, wg) {
+		verified, hasMissingNeedles := c.resolveAndVerify(entryPath, message.NewEntry.Chunks, errorChunksCount, wg)
+		if !verified {
 			if err = c.env.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 				entryResp, errReq := client.LookupDirectoryEntry(context.Background(), &filer_pb.LookupDirectoryEntryRequest{
 					Directory: message.NewParentPath,
@@ -186,6 +217,18 @@ func (c *commandFsVerify) verifyProcessMetadata(path string, wg *sync.WaitGroup)
 					bytes.Equal(entryResp.Entry.Attributes.Md5, message.NewEntry.Attributes.Md5) {
 					fmt.Fprintf(c.writer, "file: %s needles:%d failed:%d\n", entryPath, chunkCount, errorChunksCount.Load())
 					errCount++
+					if *c.pruneEntries && hasMissingNeedles {
+						pruned, pruneErr := c.pruneEntry(
+							util.NewFullPath(message.NewParentPath, message.NewEntry.Name),
+							message.NewEntry.Attributes.Mtime,
+							message.NewEntry.Attributes.Md5,
+							message.NewEntry.Chunks)
+						if pruneErr != nil {
+							fmt.Fprintf(c.writer, "prune %s failed: %v\n", entryPath, pruneErr)
+						} else if pruned {
+							prunedCount++
+						}
+					}
 				}
 				return nil
 			}); err != nil {
@@ -211,17 +254,58 @@ func (c *commandFsVerify) verifyProcessMetadata(path string, wg *sync.WaitGroup)
 		StopTsNs:               time.Now().UnixNano(),
 		EventErrorType:         pb.DontLogError,
 	}
-	return fileCount, errCount, pb.FollowMetadata(c.env.option.FilerAddress, c.env.option.GrpcDialOption, metadataFollowOption, processEventFn)
+	err = pb.FollowMetadata(c.env.FilerAddress(), c.env.option.GrpcDialOption, metadataFollowOption, processEventFn)
+	return fileCount, errCount, prunedCount, err
 }
 
-func (c *commandFsVerify) verifyEntry(path string, chunks []*filer_pb.FileChunk, errorCount *atomic.Uint64, wg *sync.WaitGroup) bool {
+// isNeedleMissingError reports whether a VolumeNeedleStatus error means the
+// needle data is lost at that location. It must NOT match "volume not found".
+// Newer Go servers and the Rust server return codes.NotFound; older Go
+// servers return codes.Unknown with "needle not found <id>" or "EOF" (and EC
+// volumes wrap it as "locate in local ec volume: ... needle not found").
+// Legacy shapes are matched anchored so unrelated errors don't classify as missing.
+func isNeedleMissingError(err error) bool {
+	if err == nil {
+		return false
+	}
+	msg := err.Error()
+	if st, ok := status.FromError(err); ok {
+		switch st.Code() {
+		case codes.NotFound:
+			return strings.HasPrefix(st.Message(), "needle not found ")
+		case codes.Unknown:
+			if st.Message() != "" {
+				msg = st.Message()
+			}
+		default:
+			return false
+		}
+	}
+	return strings.HasPrefix(msg, "needle not found ") || msg == "EOF" ||
+		strings.Contains(msg, "locate in local ec volume:") && strings.HasSuffix(msg, "needle not found")
+}
+
+// verifyEntry verifies all chunks of an entry. It returns verified=false when
+// any chunk failed. hasMissingNeedles is true when at least one needle is
+// missing from every volume location holding its volume, i.e. the data is
+// lost rather than a transient or routing error.
+func (c *commandFsVerify) verifyEntry(path string, chunks []*filer_pb.FileChunk, errorCount *atomic.Uint64, wg *sync.WaitGroup) (verified bool, hasMissingNeedles bool) {
 	fileMsg := fmt.Sprintf("file:%s", path)
 	itemIsVerifed := atomic.NewBool(true)
+	hasMissingNeedlesFlag := atomic.NewBool(false)
+	// tracks this entry's in-flight verifications so the missing-needle
+	// decision at the end of each chunk is deterministic
+	itemWg := &sync.WaitGroup{}
+
 	for _, chunk := range chunks {
 		if volumeIds, ok := c.volumeIds[chunk.Fid.VolumeId]; ok {
+			chunkMissingLocations := atomic.NewUint64(0)
 			for _, volumeServer := range volumeIds {
 				if *c.concurrency == 0 {
 					if err := c.verifyChunk(volumeServer, chunk.Fid); err != nil {
+						if isNeedleMissingError(err) {
+							chunkMissingLocations.Add(1)
+						}
 						if !(*c.metadataFromLog && strings.HasSuffix(err.Error(), "not found")) {
 							fmt.Fprintf(c.writer, "%s failed verify fileId %s: %+v, at volume server %v\n",
 								fileMsg, chunk.GetFileIdString(), err, volumeServer)
@@ -246,10 +330,15 @@ func (c *commandFsVerify) verifyEntry(path string, chunks []*filer_pb.FileChunk,
 					continue
 				}
 				wg.Add(1)
+				itemWg.Add(1)
 				waitChan <- struct{}{}
-				go func(fChunk *filer_pb.FileChunk, path string, volumeServer pb.ServerAddress, msg string) {
+				go func(fChunk *filer_pb.FileChunk, path string, volumeServer pb.ServerAddress, msg string, chunkMissingLocations *atomic.Uint64) {
 					defer wg.Done()
+					defer itemWg.Done()
 					if err := c.verifyChunk(volumeServer, fChunk.Fid); err != nil {
+						if isNeedleMissingError(err) {
+							chunkMissingLocations.Add(1)
+						}
 						if !(*c.metadataFromLog && strings.HasSuffix(err.Error(), "not found")) {
 							fmt.Fprintf(c.writer, "%s failed verify fileId %s: %+v, at volume server %v\n",
 								msg, fChunk.GetFileIdString(), err, volumeServer)
@@ -260,7 +349,11 @@ func (c *commandFsVerify) verifyEntry(path string, chunks []*filer_pb.FileChunk,
 						}
 					}
 					<-waitChan
-				}(chunk, path, volumeServer, fileMsg)
+				}(chunk, path, volumeServer, fileMsg, chunkMissingLocations)
+			}
+			itemWg.Wait()
+			if chunkMissingLocations.Load() == uint64(len(volumeIds)) {
+				hasMissingNeedlesFlag.Store(true)
 			}
 		} else {
 			if !*c.metadataFromLog {
@@ -275,19 +368,115 @@ func (c *commandFsVerify) verifyEntry(path string, chunks []*filer_pb.FileChunk,
 			break
 		}
 	}
-	return itemIsVerifed.Load()
+	return itemIsVerifed.Load(), hasMissingNeedlesFlag.Load()
 }
 
-func (c *commandFsVerify) verifyTraverseBfs(path string) (fileCount uint64, errCount uint64, err error) {
+// pruneEntry deletes an entry whose needles are gone, unless the entry
+// changed since verification. Three guards protect a concurrent repair:
+// re-lookup with mtime/md5 comparison, an identity check of the chunk set
+// (an append or rewrite in the same second as the original mtime changes the
+// chunks but not the timestamps), and IfNotModifiedAfter on the delete. The
+// entry is only counted as pruned when a follow-up lookup confirms it is gone.
+func (c *commandFsVerify) pruneEntry(path util.FullPath, mtimeSec int64, md5 []byte, expectedChunks []*filer_pb.FileChunk) (pruned bool, err error) {
+	dir, name := path.DirAndName()
+	expectedIds := chunkFingerprints(expectedChunks)
+	lookupErr := c.env.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		lookupResp, err := client.LookupDirectoryEntry(context.Background(), &filer_pb.LookupDirectoryEntryRequest{
+			Directory: dir,
+			Name:      name,
+		})
+		if err != nil {
+			if strings.Contains(err.Error(), "no entry is found in filer store") {
+				return nil // already gone
+			}
+			return err
+		}
+		att := lookupResp.Entry.GetAttributes()
+		if att.GetMtime() != mtimeSec {
+			fmt.Fprintf(c.writer, "skip pruning %s: entry changed since verification\n", path)
+			return nil
+		}
+		if len(md5) > 0 && !bytes.Equal(att.GetMd5(), md5) {
+			fmt.Fprintf(c.writer, "skip pruning %s: entry changed since verification\n", path)
+			return nil
+		}
+		if !chunksEqual(chunkFingerprints(lookupResp.Entry.GetChunks()), expectedIds) {
+			fmt.Fprintf(c.writer, "skip pruning %s: entry changed since verification\n", path)
+			return nil
+		}
+		deleteResp, err := client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
+			Directory:          dir,
+			Name:               name,
+			IfNotModifiedAfter: mtimeSec,
+		})
+		if err != nil {
+			return err
+		}
+		if deleteResp.Error != "" {
+			return fmt.Errorf("delete entry %s: %s", path, deleteResp.Error)
+		}
+		// the filer silently skips the delete when the entry advanced past
+		// IfNotModifiedAfter between our lookup and the delete; confirm
+		confirm, err := client.LookupDirectoryEntry(context.Background(), &filer_pb.LookupDirectoryEntryRequest{
+			Directory: dir,
+			Name:      name,
+		})
+		if err != nil {
+			if strings.Contains(err.Error(), "no entry is found in filer store") {
+				pruned = true
+				fmt.Fprintf(c.writer, "pruned entry with missing needles: %s\n", path)
+				return nil
+			}
+			// the delete outcome is unknown — never count it as pruned
+			fmt.Fprintf(c.writer, "skip pruning %s: delete not confirmed (%v)\n", path, err)
+			return nil
+		}
+		if confirm.Entry != nil {
+			fmt.Fprintf(c.writer, "skip pruning %s: entry changed since verification\n", path)
+			return nil
+		}
+		pruned = true
+		fmt.Fprintf(c.writer, "pruned entry with missing needles: %s\n", path)
+		return nil
+	})
+	return pruned, lookupErr
+}
+
+// chunkFingerprints maps the file id of every chunk to a set, so two chunk
+// lists count as identical when they reference the same needles.
+func chunkFingerprints(chunks []*filer_pb.FileChunk) map[string]struct{} {
+	ids := make(map[string]struct{}, len(chunks))
+	for _, chunk := range chunks {
+		if chunk == nil || chunk.Fid == nil {
+			continue
+		}
+		ids[chunk.GetFileIdString()] = struct{}{}
+	}
+	return ids
+}
+
+func chunksEqual(a, b map[string]struct{}) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for id := range a {
+		if _, ok := b[id]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
+func (c *commandFsVerify) verifyTraverseBfs(path string) (fileCount uint64, errCount uint64, prunedCount uint64, err error) {
 	timeNowAtSec := time.Now().Unix()
-	return fileCount, errCount, doTraverseBfsAndSaving(c.env, c.writer, path, false, false,
+	return fileCount, errCount, prunedCount, doTraverseBfsAndSaving(c.env, c.writer, path, false, false,
 		func(ctx context.Context, entry *filer_pb.FullEntry, outputChan chan interface{}) (err error) {
 			if c.modifyTimeAgoAtSec > 0 {
 				if entry.Entry.Attributes != nil && c.modifyTimeAgoAtSec < timeNowAtSec-entry.Entry.Attributes.Mtime {
 					return nil
 				}
 			}
-			dataChunks, manifestChunks, resolveErr := filer.ResolveChunkManifest(context.Background(), filer.LookupFn(c.env), entry.Entry.GetChunks(), 0, math.MaxInt64)
+			dataChunks, manifestChunks, resolveErr := filer.ResolveChunkManifest(context.Background(), filer.LookupFn(c.env), entry.Entry.GetChunks(), 0, math.MaxInt64, nil)
 			if resolveErr != nil {
 				return fmt.Errorf("failed to ResolveChunkManifest: %+v", resolveErr)
 			}
@@ -295,8 +484,11 @@ func (c *commandFsVerify) verifyTraverseBfs(path string) (fileCount uint64, errC
 			if len(dataChunks) > 0 {
 				select {
 				case outputChan <- &ItemEntry{
-					chunks: dataChunks,
-					path:   util.NewFullPath(entry.Dir, entry.Entry.Name),
+					chunks:    dataChunks,
+					rawChunks: entry.Entry.GetChunks(),
+					path:      util.NewFullPath(entry.Dir, entry.Entry.Name),
+					mtimeSec:  entry.Entry.GetAttributes().GetMtime(),
+					md5:       entry.Entry.GetAttributes().GetMd5(),
 				}:
 				case <-ctx.Done():
 					return ctx.Err()
@@ -310,11 +502,18 @@ func (c *commandFsVerify) verifyTraverseBfs(path string) (fileCount uint64, errC
 			for itemEntry := range outputChan {
 				i := itemEntry.(*ItemEntry)
 				itemPath := string(i.path)
-				if c.verifyEntry(itemPath, i.chunks, itemErrCount, &wg) {
+				if verified, hasMissingNeedles := c.verifyEntry(itemPath, i.chunks, itemErrCount, &wg); verified {
 					if *c.verbose {
 						fmt.Fprintf(c.writer, "file: %s needles:%d verified\n", itemPath, len(i.chunks))
 					}
 					fileCount++
+				} else if *c.pruneEntries && hasMissingNeedles {
+					pruned, pruneErr := c.pruneEntry(i.path, i.mtimeSec, i.md5, i.rawChunks)
+					if pruneErr != nil {
+						fmt.Fprintf(c.writer, "prune %s failed: %v\n", itemPath, pruneErr)
+					} else if pruned {
+						prunedCount++
+					}
 				}
 			}
 			wg.Wait()
diff --git a/weed/shell/command_fs_verify_test.go b/weed/shell/command_fs_verify_test.go
new file mode 100644
index 0000000000..5c997ff229
--- /dev/null
+++ b/weed/shell/command_fs_verify_test.go
@@ -0,0 +1,348 @@
+package shell
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"go.uber.org/atomic"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+type fsVerifyTestVolumeServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	missingNeedles map[uint64]bool
+}
+
+func (s *fsVerifyTestVolumeServer) VolumeNeedleStatus(_ context.Context, req *volume_server_pb.VolumeNeedleStatusRequest) (*volume_server_pb.VolumeNeedleStatusResponse, error) {
+	if s.missingNeedles[req.NeedleId] {
+		return nil, fmt.Errorf("needle not found %d", req.NeedleId)
+	}
+	return &volume_server_pb.VolumeNeedleStatusResponse{NeedleId: req.NeedleId}, nil
+}
+
+type fsVerifyTestFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entry   *filer_pb.Entry
+	deleted []*filer_pb.DeleteEntryRequest
+}
+
+func (s *fsVerifyTestFilerServer) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	if s.entry == nil {
+		return nil, fmt.Errorf("no entry is found in filer store")
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: s.entry}, nil
+}
+
+func (s *fsVerifyTestFilerServer) DeleteEntry(_ context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	s.deleted = append(s.deleted, req)
+	// mirror the real filer: an entry newer than IfNotModifiedAfter is
+	// silently skipped, no error and no Error field
+	if s.entry != nil && req.IfNotModifiedAfter > 0 && s.entry.Attributes.GetMtime() > req.IfNotModifiedAfter {
+		return &filer_pb.DeleteEntryResponse{}, nil
+	}
+	s.entry = nil
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+var fsVerifyTestPortCounter atomic.Int64
+
+func newFsVerifyTestCommandEnv(t *testing.T, filerServer filer_pb.SeaweedFilerServer, volumeServer volume_server_pb.VolumeServerServer) (*CommandEnv, pb.ServerAddress, func()) {
+	t.Helper()
+
+	socketDir, err := os.MkdirTemp("", "swverify-")
+	if err != nil {
+		t.Fatalf("create socket dir: %v", err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(socketDir) })
+
+	filerListener, err := net.Listen("unix", filepath.Join(socketDir, "filer.sock"))
+	if err != nil {
+		t.Fatalf("listen filer socket: %v", err)
+	}
+	filerGrpc := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(filerGrpc, filerServer)
+	go func() { _ = filerGrpc.Serve(filerListener) }()
+
+	volumeListener, err := net.Listen("unix", filepath.Join(socketDir, "volume.sock"))
+	if err != nil {
+		t.Fatalf("listen volume socket: %v", err)
+	}
+	volumeGrpc := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(volumeGrpc, volumeServer)
+	go func() { _ = volumeGrpc.Serve(volumeListener) }()
+
+	// unique ports per env: pb caches gRPC connections by address, so
+	// reusing a port across envs would dial a dead cached connection
+	filerPort := int(fsVerifyTestPortCounter.Add(1))
+	volumePort := int(fsVerifyTestPortCounter.Add(1))
+	pb.RegisterLocalGrpcSocket("127.0.0.1", filerPort, filepath.Join(socketDir, "filer.sock"))
+	pb.RegisterLocalGrpcSocket("127.0.0.1", volumePort, filepath.Join(socketDir, "volume.sock"))
+
+	cleanup := func() {
+		filerGrpc.Stop()
+		volumeGrpc.Stop()
+		_ = filerListener.Close()
+		_ = volumeListener.Close()
+	}
+
+	commandEnv := &CommandEnv{
+		option: &ShellOptions{
+			FilerAddress:   pb.ServerAddress(fmt.Sprintf("127.0.0.1:8888.%d", filerPort)),
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+			Directory:      "/",
+		},
+	}
+	volumeLocation := pb.NewServerAddress("127.0.0.1", 19080, volumePort)
+	return commandEnv, volumeLocation, cleanup
+}
+
+func newFsVerifyTestCommand(t *testing.T, commandEnv *CommandEnv, output *bytes.Buffer, volumeLocations ...pb.ServerAddress) *commandFsVerify {
+	t.Helper()
+	pruneEntries := false
+	metadataFromLog := false
+	verbose := false
+	concurrency := 0
+	c := &commandFsVerify{
+		env:             commandEnv,
+		writer:          output,
+		volumeIds:       make(map[uint32][]pb.ServerAddress),
+		verbose:         &verbose,
+		metadataFromLog: &metadataFromLog,
+		pruneEntries:    &pruneEntries,
+		concurrency:     &concurrency,
+		waitChan:        make(map[string]chan struct{}),
+	}
+	for _, loc := range volumeLocations {
+		c.volumeIds[7] = append(c.volumeIds[7], loc)
+		c.waitChan[string(loc)] = make(chan struct{}, 4)
+	}
+	return c
+}
+
+func TestFsVerifyIsNeedleMissingError(t *testing.T) {
+	if !isNeedleMissingError(fmt.Errorf("needle not found 42")) {
+		t.Error("needle not found must classify as missing")
+	}
+	// truncated volume files surface as EOF wrapped in gRPC code Unknown
+	if !isNeedleMissingError(status.Error(codes.Unknown, "EOF")) {
+		t.Error("EOF must classify as missing (truncated needle data)")
+	}
+	// anchored matching: unrelated errors merely containing the substrings
+	// must not classify as missing
+	if isNeedleMissingError(status.Error(codes.Unknown, "unexpected EOF while reading trailer")) {
+		t.Error("unrelated EOF-containing errors must NOT classify as missing")
+	}
+	if isNeedleMissingError(fmt.Errorf("rpc error: code = Unknown desc = read needle: context deadline exceeded, stream EOF")) {
+		t.Error("deadline errors mentioning EOF must NOT classify as missing")
+	}
+	if isNeedleMissingError(status.Error(codes.NotFound, "needle not foundxyz")) {
+		t.Error("malformed needle-not-found prefix must NOT classify as missing")
+	}
+	// new Go servers and the Rust volume server answer with code NotFound
+	if !isNeedleMissingError(status.Error(codes.NotFound, "needle not found 42")) {
+		t.Error("NotFound needle-not-found must classify as missing")
+	}
+	// a NotFound for the volume itself says nothing about the needle
+	if isNeedleMissingError(status.Error(codes.NotFound, "volume 7 not found")) {
+		t.Error("NotFound volume-not-found must NOT classify as missing")
+	}
+	if isNeedleMissingError(status.Error(codes.Unavailable, "connection refused")) {
+		t.Error("transport errors must NOT classify as missing")
+	}
+	if isNeedleMissingError(fmt.Errorf("volume not found 7")) {
+		t.Error("volume not found must NOT classify as missing (it says nothing about the needle)")
+	}
+	// older Go servers wrap EC's NotFoundError as code Unknown
+	if !isNeedleMissingError(status.Error(codes.Unknown, "locate in local ec volume: FindNeedleFromEcx: needle not found")) {
+		t.Error("EC wrapped needle-not-found must classify as missing")
+	}
+	if isNeedleMissingError(status.Error(codes.Unknown, "locate in local ec volume: ReadEcShardIntervals: shard 3 missing")) {
+		t.Error("EC errors that do not end in needle not found must NOT classify as missing")
+	}
+	if isNeedleMissingError(nil) {
+		t.Error("nil error must not classify as missing")
+	}
+}
+
+// A needle gone from every location holding the volume means the data is lost,
+// so the entry is prunable. One healthy location keeps it (reads can still
+// succeed there).
+func TestFsVerifyVerifyEntryPrunability(t *testing.T) {
+	deadChunk := &filer_pb.FileChunk{Fid: &filer_pb.FileId{VolumeId: 7, FileKey: 42}}
+
+	t.Run("missing on all locations", func(t *testing.T) {
+		commandEnv, loc, cleanup := newFsVerifyTestCommandEnv(t,
+			&fsVerifyTestFilerServer{},
+			&fsVerifyTestVolumeServer{missingNeedles: map[uint64]bool{42: true}})
+		defer cleanup()
+		c := newFsVerifyTestCommand(t, commandEnv, &bytes.Buffer{}, loc)
+
+		verified, prunable := c.verifyEntry("/buckets/b/file", []*filer_pb.FileChunk{deadChunk}, atomic.NewUint64(0), &sync.WaitGroup{})
+		if verified {
+			t.Error("expected verification failure for missing needle")
+		}
+		if !prunable {
+			t.Error("needle missing on the only location must be prunable")
+		}
+	})
+
+	t.Run("healthy on one of two locations", func(t *testing.T) {
+		commandEnv, loc, cleanup := newFsVerifyTestCommandEnv(t,
+			&fsVerifyTestFilerServer{},
+			&fsVerifyTestVolumeServer{})
+		defer cleanup()
+		c := newFsVerifyTestCommand(t, commandEnv, &bytes.Buffer{}, loc, loc)
+
+		verified, prunable := c.verifyEntry("/buckets/b/file", []*filer_pb.FileChunk{deadChunk}, atomic.NewUint64(0), &sync.WaitGroup{})
+		if !verified {
+			t.Error("needle present on one location should not fail verification")
+		}
+		if prunable {
+			t.Error("needle present somewhere must not be prunable")
+		}
+	})
+
+	t.Run("concurrent path matches sequential", func(t *testing.T) {
+		commandEnv, loc, cleanup := newFsVerifyTestCommandEnv(t,
+			&fsVerifyTestFilerServer{},
+			&fsVerifyTestVolumeServer{missingNeedles: map[uint64]bool{42: true}})
+		defer cleanup()
+		c := newFsVerifyTestCommand(t, commandEnv, &bytes.Buffer{}, loc)
+		concurrency := 2
+		c.concurrency = &concurrency
+
+		verified, prunable := c.verifyEntry("/buckets/b/file", []*filer_pb.FileChunk{deadChunk}, atomic.NewUint64(0), &sync.WaitGroup{})
+		if verified || !prunable {
+			t.Errorf("concurrent verification = (%v, %v), want (false, true)", verified, prunable)
+		}
+	})
+}
+
+// Pruning must only delete the entry when it did not change since the
+// verification pass — a re-upload fixes the file and must survive.
+func TestFsVerifyPruneEntryGuards(t *testing.T) {
+	filer := &fsVerifyTestFilerServer{entry: &filer_pb.Entry{
+		Name: "file",
+		Attributes: &filer_pb.FuseAttributes{
+			Mtime: 100,
+			Md5:   []byte("md5"),
+		},
+		Chunks: []*filer_pb.FileChunk{{Fid: &filer_pb.FileId{VolumeId: 7, FileKey: 42}}},
+	}}
+	commandEnv, _, cleanup := newFsVerifyTestCommandEnv(t, filer, &fsVerifyTestVolumeServer{})
+	defer cleanup()
+	c := newFsVerifyTestCommand(t, commandEnv, &bytes.Buffer{})
+
+	chunks := []*filer_pb.FileChunk{{Fid: &filer_pb.FileId{VolumeId: 7, FileKey: 42}}}
+
+	// unchanged entry: deleted
+	pruned, err := c.pruneEntry(util.NewFullPath("/buckets/b", "file"), 100, []byte("md5"), chunks)
+	if err != nil || !pruned {
+		t.Fatalf("expected prune of unchanged entry, got pruned=%v err=%v", pruned, err)
+	}
+
+	// re-uploaded entry (new mtime/md5): must survive
+	filer.entry = &filer_pb.Entry{Name: "file", Attributes: &filer_pb.FuseAttributes{Mtime: 200, Md5: []byte("new")}}
+	pruned, err = c.pruneEntry(util.NewFullPath("/buckets/b", "file"), 100, []byte("md5"), chunks)
+	if err != nil || pruned {
+		t.Fatalf("changed entry must not be pruned, got pruned=%v err=%v", pruned, err)
+	}
+
+	// same-second rewrite: timestamps identical but the chunk set differs —
+	// the new upload must survive
+	filer.entry = &filer_pb.Entry{
+		Name:       "file",
+		Attributes: &filer_pb.FuseAttributes{Mtime: 100, Md5: []byte("md5")},
+		Chunks:     []*filer_pb.FileChunk{{Fid: &filer_pb.FileId{VolumeId: 7, FileKey: 999}}},
+	}
+	pruned, err = c.pruneEntry(util.NewFullPath("/buckets/b", "file"), 100, []byte("md5"), chunks)
+	if err != nil || pruned {
+		t.Fatalf("same-second rewrite must not be pruned, got pruned=%v err=%v", pruned, err)
+	}
+
+	// identical chunk set (order-insensitive): prunes
+	filer.entry = &filer_pb.Entry{
+		Name:       "file",
+		Attributes: &filer_pb.FuseAttributes{Mtime: 100, Md5: []byte("md5")},
+		Chunks:     []*filer_pb.FileChunk{{Fid: &filer_pb.FileId{VolumeId: 7, FileKey: 42}}},
+	}
+	pruned, err = c.pruneEntry(util.NewFullPath("/buckets/b", "file"), 100, []byte("md5"), chunks)
+	if err != nil || !pruned {
+		t.Fatalf("expected prune when chunk set matches, got pruned=%v err=%v", pruned, err)
+	}
+
+	// entry already gone: no error, no delete
+	filer.entry = nil
+	pruned, err = c.pruneEntry(util.NewFullPath("/buckets/b", "file"), 100, nil, chunks)
+	if err != nil || pruned {
+		t.Fatalf("missing entry must be a no-op, got pruned=%v err=%v", pruned, err)
+	}
+}
+
+// An unresolvable chunk manifest is an entry-level verification failure even
+// when the raw manifest needle is healthy; raw chunks are still checked so a
+// missing manifest needle can be pruned.
+func TestFsVerifyManifestResolutionFailure(t *testing.T) {
+	t.Run("healthy raw needle but unresolvable manifest is not verified", func(t *testing.T) {
+		// IsChunkManifest forces ResolveChunkManifest to read children via
+		// LookupFn; the test filer does not implement LookupVolume, so
+		// resolution fails. Needle 100 is present, so verifyEntry alone
+		// would report verified=true — the manifest failure must override.
+		manifestChunk := &filer_pb.FileChunk{
+			Fid:             &filer_pb.FileId{VolumeId: 7, FileKey: 100},
+			IsChunkManifest: true,
+			Size:            100,
+		}
+		commandEnv, loc, cleanup := newFsVerifyTestCommandEnv(t,
+			&fsVerifyTestFilerServer{},
+			&fsVerifyTestVolumeServer{})
+		defer cleanup()
+		c := newFsVerifyTestCommand(t, commandEnv, &bytes.Buffer{}, loc)
+
+		verified, hasMissing := c.resolveAndVerify("/buckets/b/file",
+			[]*filer_pb.FileChunk{manifestChunk}, atomic.NewUint64(0), &sync.WaitGroup{})
+		if verified {
+			t.Error("entry with an unresolvable manifest must not count as verified")
+		}
+		if hasMissing {
+			t.Error("healthy raw manifest needle must not be classified as missing")
+		}
+	})
+
+	t.Run("missing manifest needle is prunable", func(t *testing.T) {
+		// The manifest needle itself is gone: resolution fails AND verifyEntry
+		// classifies the raw needle as missing, so the entry is prunable.
+		manifestChunk := &filer_pb.FileChunk{
+			Fid:             &filer_pb.FileId{VolumeId: 7, FileKey: 100},
+			IsChunkManifest: true,
+			Size:            100,
+		}
+		commandEnv, loc, cleanup := newFsVerifyTestCommandEnv(t,
+			&fsVerifyTestFilerServer{},
+			&fsVerifyTestVolumeServer{missingNeedles: map[uint64]bool{100: true}})
+		defer cleanup()
+		c := newFsVerifyTestCommand(t, commandEnv, &bytes.Buffer{}, loc)
+
+		verified, hasMissing := c.resolveAndVerify("/buckets/b/file",
+			[]*filer_pb.FileChunk{manifestChunk}, atomic.NewUint64(0), &sync.WaitGroup{})
+		if verified {
+			t.Error("entry with a missing manifest needle must not count as verified")
+		}
+		if !hasMissing {
+			t.Error("missing manifest needle must be classified as prunable")
+		}
+	})
+}
diff --git a/weed/shell/command_mq_topic_compact.go b/weed/shell/command_mq_topic_compact.go
index 79d8a45f81..8171144b1f 100644
--- a/weed/shell/command_mq_topic_compact.go
+++ b/weed/shell/command_mq_topic_compact.go
@@ -2,6 +2,7 @@ package shell
 
 import (
 	"flag"
+	"fmt"
 	"io"
 	"time"
 
@@ -55,6 +56,13 @@ func (c *commandMqTopicCompact) Do(args []string, commandEnv *CommandEnv, writer
 		return err
 	}
 
+	// The AssignVolumeRequest collection falls back to the path rule and the
+	// filer default when empty, so the empty-named collection cannot be
+	// requested explicitly.
+	if *collection == CollectionDefault {
+		return fmt.Errorf("%s is not a usable collection name here; omit -collection to inherit the configured collection", CollectionDefault)
+	}
+
 	storagePreference := &operation.StoragePreference{
 		Replication: *replication,
 		Collection:  *collection,
@@ -65,7 +73,7 @@ func (c *commandMqTopicCompact) Do(args []string, commandEnv *CommandEnv, writer
 
 	// read topic configuration
 	fca := filer_client.NewFilerClientAccessor(
-		[]pb.ServerAddress{commandEnv.option.FilerAddress},
+		[]pb.ServerAddress{commandEnv.FilerAddress()},
 		commandEnv.option.GrpcDialOption,
 	)
 	t := topic.NewTopic(*namespace, *topicName)
diff --git a/weed/shell/command_remote_cache.go b/weed/shell/command_remote_cache.go
index ca78f2c2c7..69ff9bcfec 100644
--- a/weed/shell/command_remote_cache.go
+++ b/weed/shell/command_remote_cache.go
@@ -230,14 +230,7 @@ func (c *commandRemoteCache) doComprehensiveSync(commandEnv *CommandEnv, writer
 				fmt.Fprintf(writer, "Deleting %s... ", pathToDelete)
 
 				dir, name := util.FullPath(pathToDelete).DirAndName()
-				_, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-					Directory:            dir,
-					Name:                 name,
-					IgnoreRecursiveError: false,
-					IsDeleteData:         true,
-					IsRecursive:          false,
-					IsFromOtherCluster:   false,
-				})
+				err := filer_pb.DoRemove(ctx, client, dir, name, true, false, false, false, nil)
 				if err != nil {
 					fmt.Fprintf(writer, "failed: %v\n", err)
 					return err
diff --git a/weed/shell/command_remote_configure.go b/weed/shell/command_remote_configure.go
index 2189a408f3..0abceb1553 100644
--- a/weed/shell/command_remote_configure.go
+++ b/weed/shell/command_remote_configure.go
@@ -2,6 +2,7 @@ package shell
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -45,6 +46,9 @@ func (c *commandRemoteConfigure) Help() string {
 	remote.configure -name=cloud7 -type=storj -storj.access_key=xxx -storj.secret_key=yyy -storj.endpoint=https://gateway.us1.storjshare.io
 	remote.configure -name=cloud8 -type=filebase -filebase.access_key=xxx -filebase.secret_key=yyy -filebase.endpoint=https://s3.filebase.com
 
+	# tune transfer concurrency (applies to s3-compatible and azure storage)
+	remote.configure -name=cloud1 -upload_concurrency=4 -download_concurrency=8
+
 	# delete one configuration
 	remote.configure -delete -name=cloud1
 
@@ -63,71 +67,11 @@ func (c *commandRemoteConfigure) Do(args []string, commandEnv *CommandEnv, write
 
 	conf := &remote_pb.RemoteConf{}
 
-	remoteConfigureCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
-	isDelete := remoteConfigureCommand.Bool("delete", false, "delete one remote storage by its name")
-
-	remoteConfigureCommand.StringVar(&conf.Name, "name", "", "a short name to identify the remote storage")
-	remoteConfigureCommand.StringVar(&conf.Type, "type", "s3", fmt.Sprintf("[%s] storage type", remote_storage.GetAllRemoteStorageNames()))
-
-	remoteConfigureCommand.StringVar(&conf.S3AccessKey, "s3.access_key", "", "s3 access key")
-	remoteConfigureCommand.StringVar(&conf.S3SecretKey, "s3.secret_key", "", "s3 secret key")
-	remoteConfigureCommand.StringVar(&conf.S3Region, "s3.region", "us-east-2", "s3 region")
-	remoteConfigureCommand.StringVar(&conf.S3Endpoint, "s3.endpoint", "", "endpoint for s3-compatible local object store")
-	remoteConfigureCommand.StringVar(&conf.S3StorageClass, "s3.storage_class", "", "s3 storage class")
-	remoteConfigureCommand.BoolVar(&conf.S3ForcePathStyle, "s3.force_path_style", true, "s3 force path style")
-	remoteConfigureCommand.BoolVar(&conf.S3V4Signature, "s3.v4_signature", false, "s3 V4 signature")
-	remoteConfigureCommand.BoolVar(&conf.S3SupportTagging, "s3.support_tagging", true, "s3 supportTagging")
-
-	remoteConfigureCommand.StringVar(&conf.GcsGoogleApplicationCredentials, "gcs.appCredentialsFile", "", "google cloud storage credentials file, default to use env GOOGLE_APPLICATION_CREDENTIALS")
-	remoteConfigureCommand.StringVar(&conf.GcsProjectId, "gcs.projectId", "", "google cloud storage project id, default to use env GOOGLE_CLOUD_PROJECT")
-
-	remoteConfigureCommand.StringVar(&conf.AzureAccountName, "azure.account_name", "", "azure account name, default to use env AZURE_STORAGE_ACCOUNT")
-	remoteConfigureCommand.StringVar(&conf.AzureAccountKey, "azure.account_key", "", "azure account key, default to use env AZURE_STORAGE_ACCESS_KEY. Leave empty to authenticate with Entra ID")
-	remoteConfigureCommand.StringVar(&conf.AzureClientId, "azure.client_id", "", "azure user-assigned identity to authenticate, when no account key is given. Workload identity also reads env AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE")
-	remoteConfigureCommand.StringVar(&conf.AzureEndpoint, "azure.endpoint", "", "azure blob service url, for accounts outside the public cloud, e.g. https://xxx.blob.core.usgovcloudapi.net/")
-
-	remoteConfigureCommand.StringVar(&conf.BackblazeKeyId, "b2.key_id", "", "backblaze keyID")
-	remoteConfigureCommand.StringVar(&conf.BackblazeApplicationKey, "b2.application_key", "", "backblaze applicationKey. Note that your Master Application Key will not work with the S3 Compatible API. You must create a new key that is eligible for use. For more information: https://help.backblaze.com/hc/en-us/articles/360047425453")
-	remoteConfigureCommand.StringVar(&conf.BackblazeEndpoint, "b2.endpoint", "", "backblaze endpoint")
-	remoteConfigureCommand.StringVar(&conf.BackblazeRegion, "b2.region", "us-west-002", "backblaze region")
-
-	remoteConfigureCommand.StringVar(&conf.AliyunAccessKey, "aliyun.access_key", "", "Aliyun access key, default to use env ALICLOUD_ACCESS_KEY_ID")
-	remoteConfigureCommand.StringVar(&conf.AliyunSecretKey, "aliyun.secret_key", "", "Aliyun secret key, default to use env ALICLOUD_ACCESS_KEY_SECRET")
-	remoteConfigureCommand.StringVar(&conf.AliyunEndpoint, "aliyun.endpoint", "", "Aliyun endpoint")
-	remoteConfigureCommand.StringVar(&conf.AliyunRegion, "aliyun.region", "", "Aliyun region")
-
-	remoteConfigureCommand.StringVar(&conf.TencentSecretId, "tencent.secret_id", "", "Tencent Secret Id, default to use env COS_SECRETID")
-	remoteConfigureCommand.StringVar(&conf.TencentSecretKey, "tencent.secret_key", "", "Tencent secret key, default to use env COS_SECRETKEY")
-	remoteConfigureCommand.StringVar(&conf.TencentEndpoint, "tencent.endpoint", "", "Tencent endpoint")
-
-	remoteConfigureCommand.StringVar(&conf.BaiduAccessKey, "baidu.access_key", "", "Baidu access key, default to use env BDCLOUD_ACCESS_KEY")
-	remoteConfigureCommand.StringVar(&conf.BaiduSecretKey, "baidu.secret_key", "", "Baidu secret key, default to use env BDCLOUD_SECRET_KEY")
-	remoteConfigureCommand.StringVar(&conf.BaiduEndpoint, "baidu.endpoint", "", "Baidu endpoint")
-	remoteConfigureCommand.StringVar(&conf.BaiduRegion, "baidu.region", "", "Baidu region")
-
-	remoteConfigureCommand.StringVar(&conf.WasabiAccessKey, "wasabi.access_key", "", "Wasabi access key")
-	remoteConfigureCommand.StringVar(&conf.WasabiSecretKey, "wasabi.secret_key", "", "Wasabi secret key")
-	remoteConfigureCommand.StringVar(&conf.WasabiEndpoint, "wasabi.endpoint", "", "Wasabi endpoint, see https://wasabi.com/wp-content/themes/wasabi/docs/API_Guide/index.html#t=topics%2Fapidiff-intro.htm")
-	remoteConfigureCommand.StringVar(&conf.WasabiRegion, "wasabi.region", "", "Wasabi region")
-
-	remoteConfigureCommand.StringVar(&conf.FilebaseAccessKey, "filebase.access_key", "", "Filebase access key")
-	remoteConfigureCommand.StringVar(&conf.FilebaseSecretKey, "filebase.secret_key", "", "Filebase secret key")
-	remoteConfigureCommand.StringVar(&conf.FilebaseEndpoint, "filebase.endpoint", "", "Filebase endpoint, https://s3.filebase.com")
-
-	remoteConfigureCommand.StringVar(&conf.StorjAccessKey, "storj.access_key", "", "Storj access key")
-	remoteConfigureCommand.StringVar(&conf.StorjSecretKey, "storj.secret_key", "", "Storj secret key")
-	remoteConfigureCommand.StringVar(&conf.StorjEndpoint, "storj.endpoint", "", "Storj endpoint")
-
-	if err = remoteConfigureCommand.Parse(args); err != nil {
+	fs, isDelete, uploadConcurrency, downloadConcurrency := c.configureFlagSet(conf, false)
+	if err = fs.Parse(args); err != nil {
 		return nil
 	}
 
-	if conf.Type != "s3" {
-		// clear out the default values
-		conf.S3Region = ""
-		conf.S3ForcePathStyle = false
-	}
-
 	if conf.Name == "" {
 		return c.listExistingRemoteStorages(commandEnv, writer)
 	}
@@ -140,10 +84,183 @@ func (c *commandRemoteConfigure) Do(args []string, commandEnv *CommandEnv, write
 		return c.deleteRemoteStorage(commandEnv, writer, conf.Name)
 	}
 
+	// Merge with an existing configuration so a partial update preserves
+	// previously stored credentials and endpoints. Only treat a confirmed
+	// missing entry as a new configuration; propagate all other load errors
+	// so a transient filer failure does not overwrite stored credentials.
+	typeExplicit := false
+	fs.Visit(func(f *flag.Flag) {
+		if f.Name == "type" {
+			typeExplicit = true
+		}
+	})
+	requestedType := conf.Type
+	existing, loadErr := c.loadRemoteStorageConf(commandEnv, conf.Name)
+	if loadErr != nil && !errors.Is(loadErr, filer_pb.ErrNotFound) {
+		return fmt.Errorf("load existing configuration %s: %v", conf.Name, loadErr)
+	}
+	if existing != nil {
+		conf = existing
+		// On an explicit type transition, reset backend-specific fields to
+		// the destination defaults before re-parsing so explicit flags
+		// override. An omitted -type keeps the stored backend.
+		if typeExplicit && requestedType != existing.Type {
+			conf.Type = requestedType
+			c.applyTypeDefaults(conf)
+		}
+		fs, isDelete, uploadConcurrency, downloadConcurrency = c.configureFlagSet(conf, true)
+		if err = fs.Parse(args); err != nil {
+			return nil
+		}
+	}
+
+	if err = applyConcurrency(conf, *uploadConcurrency, *downloadConcurrency); err != nil {
+		return err
+	}
+
+	if conf.Type != "s3" {
+		conf.S3Region = ""
+		conf.S3ForcePathStyle = false
+	}
+
 	return c.saveRemoteStorage(commandEnv, writer, conf)
 
 }
 
+// configureFlagSet builds the remote.configure flag set bound to conf. When
+// existing is true, flag defaults are taken from conf so omitted flags preserve
+// prior values instead of being reset to the hard-coded new-config defaults.
+func (c *commandRemoteConfigure) configureFlagSet(conf *remote_pb.RemoteConf, existing bool) (fs *flag.FlagSet, isDelete *bool, uploadConcurrency *int, downloadConcurrency *int) {
+	fs = flag.NewFlagSet(c.Name(), flag.ContinueOnError)
+	isDelete = fs.Bool("delete", false, "delete one remote storage by its name")
+
+	fs.StringVar(&conf.Name, "name", conf.Name, "a short name to identify the remote storage")
+	typeDefault := "s3"
+	if existing {
+		typeDefault = conf.Type
+	}
+	fs.StringVar(&conf.Type, "type", typeDefault, fmt.Sprintf("[%s] storage type", remote_storage.GetAllRemoteStorageNames()))
+
+	uploadConcurrency = fs.Int("upload_concurrency", int(conf.UploadConcurrency), "concurrent part uploads per file (0 = client default: s3 1, azure 16)")
+	downloadConcurrency = fs.Int("download_concurrency", int(conf.DownloadConcurrency), "concurrent part downloads per read (0 = client default: s3 5, azure 16)")
+
+	fs.StringVar(&conf.S3AccessKey, "s3.access_key", conf.S3AccessKey, "s3 access key")
+	fs.StringVar(&conf.S3SecretKey, "s3.secret_key", conf.S3SecretKey, "s3 secret key")
+	s3RegionDefault := "us-east-2"
+	if existing {
+		s3RegionDefault = conf.S3Region
+	}
+	fs.StringVar(&conf.S3Region, "s3.region", s3RegionDefault, "s3 region")
+	fs.StringVar(&conf.S3Endpoint, "s3.endpoint", conf.S3Endpoint, "endpoint for s3-compatible local object store")
+	fs.StringVar(&conf.S3StorageClass, "s3.storage_class", conf.S3StorageClass, "s3 storage class")
+	s3ForcePathStyleDefault := true
+	if existing {
+		s3ForcePathStyleDefault = conf.S3ForcePathStyle
+	}
+	fs.BoolVar(&conf.S3ForcePathStyle, "s3.force_path_style", s3ForcePathStyleDefault, "s3 force path style")
+	fs.BoolVar(&conf.S3V4Signature, "s3.v4_signature", conf.S3V4Signature, "s3 V4 signature")
+	s3SupportTaggingDefault := true
+	if existing {
+		s3SupportTaggingDefault = conf.S3SupportTagging
+	}
+	fs.BoolVar(&conf.S3SupportTagging, "s3.support_tagging", s3SupportTaggingDefault, "s3 supportTagging")
+
+	fs.StringVar(&conf.GcsGoogleApplicationCredentials, "gcs.appCredentialsFile", conf.GcsGoogleApplicationCredentials, "google cloud storage credentials file, default to use env GOOGLE_APPLICATION_CREDENTIALS")
+	fs.StringVar(&conf.GcsProjectId, "gcs.projectId", conf.GcsProjectId, "google cloud storage project id, default to use env GOOGLE_CLOUD_PROJECT")
+
+	fs.StringVar(&conf.AzureAccountName, "azure.account_name", conf.AzureAccountName, "azure account name, default to use env AZURE_STORAGE_ACCOUNT")
+	fs.StringVar(&conf.AzureAccountKey, "azure.account_key", conf.AzureAccountKey, "azure account key, default to use env AZURE_STORAGE_ACCESS_KEY. Leave empty to authenticate with Entra ID")
+	fs.StringVar(&conf.AzureClientId, "azure.client_id", conf.AzureClientId, "azure user-assigned identity to authenticate, when no account key is given. Workload identity also reads env AZURE_TENANT_ID and AZURE_FEDERATED_TOKEN_FILE")
+	fs.StringVar(&conf.AzureEndpoint, "azure.endpoint", conf.AzureEndpoint, "azure blob service url, for accounts outside the public cloud, e.g. https://xxx.blob.core.usgovcloudapi.net/")
+
+	fs.StringVar(&conf.BackblazeKeyId, "b2.key_id", conf.BackblazeKeyId, "backblaze keyID")
+	fs.StringVar(&conf.BackblazeApplicationKey, "b2.application_key", conf.BackblazeApplicationKey, "backblaze applicationKey. Note that your Master Application Key will not work with the S3 Compatible API. You must create a new key that is eligible for use. For more information: https://help.backblaze.com/hc/en-us/articles/360047425453")
+	fs.StringVar(&conf.BackblazeEndpoint, "b2.endpoint", conf.BackblazeEndpoint, "backblaze endpoint")
+	b2RegionDefault := "us-west-002"
+	if existing {
+		b2RegionDefault = conf.BackblazeRegion
+	}
+	fs.StringVar(&conf.BackblazeRegion, "b2.region", b2RegionDefault, "backblaze region")
+
+	fs.StringVar(&conf.AliyunAccessKey, "aliyun.access_key", conf.AliyunAccessKey, "Aliyun access key, default to use env ALICLOUD_ACCESS_KEY_ID")
+	fs.StringVar(&conf.AliyunSecretKey, "aliyun.secret_key", conf.AliyunSecretKey, "Aliyun secret key, default to use env ALICLOUD_ACCESS_KEY_SECRET")
+	fs.StringVar(&conf.AliyunEndpoint, "aliyun.endpoint", conf.AliyunEndpoint, "Aliyun endpoint")
+	fs.StringVar(&conf.AliyunRegion, "aliyun.region", conf.AliyunRegion, "Aliyun region")
+
+	fs.StringVar(&conf.TencentSecretId, "tencent.secret_id", conf.TencentSecretId, "Tencent Secret Id, default to use env COS_SECRETID")
+	fs.StringVar(&conf.TencentSecretKey, "tencent.secret_key", conf.TencentSecretKey, "Tencent secret key, default to use env COS_SECRETKEY")
+	fs.StringVar(&conf.TencentEndpoint, "tencent.endpoint", conf.TencentEndpoint, "Tencent endpoint")
+
+	fs.StringVar(&conf.BaiduAccessKey, "baidu.access_key", conf.BaiduAccessKey, "Baidu access key, default to use env BDCLOUD_ACCESS_KEY")
+	fs.StringVar(&conf.BaiduSecretKey, "baidu.secret_key", conf.BaiduSecretKey, "Baidu secret key, default to use env BDCLOUD_SECRET_KEY")
+	fs.StringVar(&conf.BaiduEndpoint, "baidu.endpoint", conf.BaiduEndpoint, "Baidu endpoint")
+	fs.StringVar(&conf.BaiduRegion, "baidu.region", conf.BaiduRegion, "Baidu region")
+
+	fs.StringVar(&conf.WasabiAccessKey, "wasabi.access_key", conf.WasabiAccessKey, "Wasabi access key")
+	fs.StringVar(&conf.WasabiSecretKey, "wasabi.secret_key", conf.WasabiSecretKey, "Wasabi secret key")
+	fs.StringVar(&conf.WasabiEndpoint, "wasabi.endpoint", conf.WasabiEndpoint, "Wasabi endpoint, see https://wasabi.com/wp-content/themes/wasabi/docs/API_Guide/index.html#t=topics%2Fapidiff-intro.htm")
+	fs.StringVar(&conf.WasabiRegion, "wasabi.region", conf.WasabiRegion, "Wasabi region")
+
+	fs.StringVar(&conf.FilebaseAccessKey, "filebase.access_key", conf.FilebaseAccessKey, "Filebase access key")
+	fs.StringVar(&conf.FilebaseSecretKey, "filebase.secret_key", conf.FilebaseSecretKey, "Filebase secret key")
+	fs.StringVar(&conf.FilebaseEndpoint, "filebase.endpoint", conf.FilebaseEndpoint, "Filebase endpoint, https://s3.filebase.com")
+
+	fs.StringVar(&conf.StorjAccessKey, "storj.access_key", conf.StorjAccessKey, "Storj access key")
+	fs.StringVar(&conf.StorjSecretKey, "storj.secret_key", conf.StorjSecretKey, "Storj secret key")
+	fs.StringVar(&conf.StorjEndpoint, "storj.endpoint", conf.StorjEndpoint, "Storj endpoint")
+
+	return
+}
+
+// maxRemoteConcurrency caps configured remote transfer concurrency so one
+// configuration cannot request an unbounded number of network workers.
+const maxRemoteConcurrency = 1024
+
+// applyTypeDefaults resets backend-specific fields to their new-config defaults
+// for conf.Type, used when the storage type changes on update.
+func (c *commandRemoteConfigure) applyTypeDefaults(conf *remote_pb.RemoteConf) {
+	conf.S3Region = ""
+	conf.S3ForcePathStyle = false
+	conf.S3SupportTagging = false
+	conf.S3V4Signature = false
+	conf.BackblazeRegion = ""
+	if conf.Type == "s3" {
+		conf.S3Region = "us-east-2"
+		conf.S3ForcePathStyle = true
+		conf.S3SupportTagging = true
+	} else if conf.Type == "b2" {
+		conf.BackblazeRegion = "us-west-002"
+	}
+}
+
+func applyConcurrency(conf *remote_pb.RemoteConf, upload, download int) error {
+	if upload < 0 || upload > maxRemoteConcurrency {
+		return fmt.Errorf("upload_concurrency must be between 0 and %d", maxRemoteConcurrency)
+	}
+	if download < 0 || download > maxRemoteConcurrency {
+		return fmt.Errorf("download_concurrency must be between 0 and %d", maxRemoteConcurrency)
+	}
+	conf.UploadConcurrency = uint32(upload)
+	conf.DownloadConcurrency = uint32(download)
+	return nil
+}
+
+func (c *commandRemoteConfigure) loadRemoteStorageConf(commandEnv *CommandEnv, name string) (*remote_pb.RemoteConf, error) {
+	var conf *remote_pb.RemoteConf
+	err := commandEnv.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		content, readErr := filer.ReadInsideFiler(context.Background(), client, filer.DirectoryEtcRemote, name+filer.REMOTE_STORAGE_CONF_SUFFIX)
+		if readErr != nil {
+			return readErr
+		}
+		conf = &remote_pb.RemoteConf{}
+		if unmarshalErr := proto.Unmarshal(content, conf); unmarshalErr != nil {
+			return fmt.Errorf("unmarshal %s/%s: %v", filer.DirectoryEtcRemote, name, unmarshalErr)
+		}
+		return nil
+	})
+	return conf, err
+}
+
 func (c *commandRemoteConfigure) listExistingRemoteStorages(commandEnv *CommandEnv, writer io.Writer) error {
 
 	return filer_pb.ReadDirAllEntries(context.Background(), commandEnv, util.FullPath(filer.DirectoryEtcRemote), "", func(entry *filer_pb.Entry, isLast bool) error {
@@ -179,16 +296,8 @@ func (c *commandRemoteConfigure) deleteRemoteStorage(commandEnv *CommandEnv, wri
 
 	return commandEnv.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
 
-		request := &filer_pb.DeleteEntryRequest{
-			Directory:            filer.DirectoryEtcRemote,
-			Name:                 storageName + filer.REMOTE_STORAGE_CONF_SUFFIX,
-			IgnoreRecursiveError: false,
-			IsDeleteData:         true,
-			IsRecursive:          true,
-			IsFromOtherCluster:   false,
-			Signatures:           nil,
-		}
-		_, err := client.DeleteEntry(context.Background(), request)
+		name := storageName + filer.REMOTE_STORAGE_CONF_SUFFIX
+		err := filer_pb.DoRemove(context.Background(), client, filer.DirectoryEtcRemote, name, true, true, false, false, nil)
 
 		if err == nil {
 			fmt.Fprintf(writer, "removed: %s\n", storageName)
diff --git a/weed/shell/command_remote_meta_sync.go b/weed/shell/command_remote_meta_sync.go
index 2f270b4351..ca9320d3f5 100644
--- a/weed/shell/command_remote_meta_sync.go
+++ b/weed/shell/command_remote_meta_sync.go
@@ -84,7 +84,7 @@ func (c *commandRemoteMetaSync) Do(args []string, commandEnv *CommandEnv, writer
 }
 
 func detectMountInfo(commandEnv *CommandEnv, writer io.Writer, dir string) (*remote_pb.RemoteStorageMapping, string, *remote_pb.RemoteStorageLocation, *remote_pb.RemoteConf, error) {
-	return filer.DetectMountInfo(commandEnv.option.GrpcDialOption, commandEnv.option.FilerAddress, dir)
+	return filer.DetectMountInfo(commandEnv.option.GrpcDialOption, commandEnv.FilerAddress(), dir)
 }
 
 /*
@@ -326,12 +326,7 @@ func deleteRemoteBackedEntry(ctx context.Context, client filer_pb.SeaweedFilerCl
 }
 
 func deleteLocalEntry(ctx context.Context, client filer_pb.SeaweedFilerClient, localDir util.FullPath, name string) error {
-	_, err := client.DeleteEntry(ctx, &filer_pb.DeleteEntryRequest{
-		Directory:    string(localDir),
-		Name:         name,
-		IsDeleteData: true,
-	})
-	return err
+	return filer_pb.DoRemove(ctx, client, string(localDir), name, true, false, false, false, nil)
 }
 
 func isLocalDirectoryEmpty(ctx context.Context, client filer_pb.SeaweedFilerClient, dir util.FullPath) (bool, error) {
diff --git a/weed/shell/command_remote_mount.go b/weed/shell/command_remote_mount.go
index 60c1c93e0d..debfa27a63 100644
--- a/weed/shell/command_remote_mount.go
+++ b/weed/shell/command_remote_mount.go
@@ -6,6 +6,7 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"math"
 	"os"
 	"strings"
 	"time"
@@ -50,6 +51,8 @@ func (c *commandRemoteMount) Help() string {
 	remote.mount -dir=/xxx -remote=cloud1/bucket/dir1
 	# mount with on-demand directory listing cached for 5 minutes
 	remote.mount -dir=/xxx -remote=cloud1/bucket -listingCacheTTL=300
+	# mount as a streaming source: reads go to the remote instead of waiting for the local cache
+	remote.mount -dir=/xxx -remote=cloud1/bucket -cacheWait=0
 
 	# after mount, start a separate process to write updates to remote storage
 	weed filer.remote.sync -filer=<filerHost>:<filerPort> -dir=/xxx
@@ -70,6 +73,7 @@ func (c *commandRemoteMount) Do(args []string, commandEnv *CommandEnv, writer io
 	metadataStrategy := remoteMountCommand.String("metadataStrategy", string(MetadataCacheEager), "lazy: skip upfront metadata pull; eager: full metadata pull (default)")
 	remote := remoteMountCommand.String("remote", "", "a directory in remote storage, ex. <storageName>/<bucket>/path/to/dir")
 	listingCacheTTL := remoteMountCommand.Int("listingCacheTTL", 0, "seconds to cache remote directory listings (0 = disabled)")
+	cacheWait := remoteMountCommand.Duration("cacheWait", -1, "how long a read of an uncached object waits for the local cache, ex. 0 or 500ms (default: by object size)")
 
 	if err = remoteMountCommand.Parse(args); err != nil {
 		return nil
@@ -81,7 +85,7 @@ func (c *commandRemoteMount) Do(args []string, commandEnv *CommandEnv, writer io
 	}
 
 	// find configuration for remote storage
-	remoteConf, err := filer.ReadRemoteStorageConf(commandEnv.option.GrpcDialOption, commandEnv.option.FilerAddress, remote_storage.ParseLocationName(*remote))
+	remoteConf, err := filer.ReadRemoteStorageConf(commandEnv.option.GrpcDialOption, commandEnv.FilerAddress(), remote_storage.ParseLocationName(*remote))
 	if err != nil {
 		return fmt.Errorf("find configuration for %s: %v", *remote, err)
 	}
@@ -91,6 +95,17 @@ func (c *commandRemoteMount) Do(args []string, commandEnv *CommandEnv, writer io
 		return err
 	}
 	remoteStorageLocation.ListingCacheTtlSeconds = int32(*listingCacheTTL)
+	if *cacheWait >= 0 {
+		waitMs := cacheWait.Milliseconds()
+		if waitMs > math.MaxInt32 {
+			return fmt.Errorf("cacheWait %v is too long", *cacheWait)
+		}
+		// truncating to 0 would read as "never wait" instead of the asked-for wait
+		if waitMs == 0 && *cacheWait > 0 {
+			return fmt.Errorf("cacheWait %v is shorter than 1ms", *cacheWait)
+		}
+		remoteStorageLocation.CacheWaitMs = proto.Int32(int32(waitMs))
+	}
 
 	strategy := MetadataCacheStrategy(strings.ToLower(*metadataStrategy))
 	if strategy != MetadataCacheLazy && strategy != MetadataCacheEager {
@@ -118,7 +133,7 @@ func (c *commandRemoteMount) Do(args []string, commandEnv *CommandEnv, writer io
 func listExistingRemoteStorageMounts(commandEnv *CommandEnv, writer io.Writer) (mappings *remote_pb.RemoteStorageMapping, err error) {
 
 	// read current mapping
-	mappings, err = filer.ReadMountMappings(commandEnv.option.GrpcDialOption, commandEnv.option.FilerAddress)
+	mappings, err = filer.ReadMountMappings(commandEnv.option.GrpcDialOption, commandEnv.FilerAddress())
 	if err != nil {
 		return mappings, err
 	}
diff --git a/weed/shell/command_remote_mount_buckets.go b/weed/shell/command_remote_mount_buckets.go
index 1fa464141c..c011a15e57 100644
--- a/weed/shell/command_remote_mount_buckets.go
+++ b/weed/shell/command_remote_mount_buckets.go
@@ -62,7 +62,7 @@ func (c *commandRemoteMountBuckets) Do(args []string, commandEnv *CommandEnv, wr
 	}
 
 	// find configuration for remote storage
-	remoteConf, err := filer.ReadRemoteStorageConf(commandEnv.option.GrpcDialOption, commandEnv.option.FilerAddress, *remote)
+	remoteConf, err := filer.ReadRemoteStorageConf(commandEnv.option.GrpcDialOption, commandEnv.FilerAddress(), *remote)
 	if err != nil {
 		return fmt.Errorf("find configuration for %s: %v", *remote, err)
 	}
diff --git a/weed/shell/command_remote_uncache.go b/weed/shell/command_remote_uncache.go
index d3d4371b34..20383a8f40 100644
--- a/weed/shell/command_remote_uncache.go
+++ b/weed/shell/command_remote_uncache.go
@@ -57,7 +57,7 @@ func (c *commandRemoteUncache) Do(args []string, commandEnv *CommandEnv, writer
 		return nil
 	}
 
-	mappings, listErr := filer.ReadMountMappings(commandEnv.option.GrpcDialOption, commandEnv.option.FilerAddress)
+	mappings, listErr := filer.ReadMountMappings(commandEnv.option.GrpcDialOption, commandEnv.FilerAddress())
 	if listErr != nil {
 		return listErr
 	}
@@ -102,7 +102,7 @@ func (c *commandRemoteUncache) uncacheContentData(commandEnv *CommandEnv, writer
 			return true
 		}
 
-		if entry.RemoteEntry.LastLocalSyncTsNs/1e9 < entry.Attributes.Mtime {
+		if entry.RemoteEntry.LastLocalSyncTsNs < entry.Attributes.Mtime*1e9+int64(entry.Attributes.MtimeNs) {
 			return true // should not uncache an entry that is not synchronized with remote
 		}
 
diff --git a/weed/shell/command_remote_unmount.go b/weed/shell/command_remote_unmount.go
index bb70744c69..fd905d00ee 100644
--- a/weed/shell/command_remote_unmount.go
+++ b/weed/shell/command_remote_unmount.go
@@ -52,7 +52,7 @@ func (c *commandRemoteUnmount) Do(args []string, commandEnv *CommandEnv, writer
 		return nil
 	}
 
-	mappings, listErr := filer.ReadMountMappings(commandEnv.option.GrpcDialOption, commandEnv.option.FilerAddress)
+	mappings, listErr := filer.ReadMountMappings(commandEnv.option.GrpcDialOption, commandEnv.FilerAddress())
 	if listErr != nil {
 		return listErr
 	}
@@ -65,7 +65,8 @@ func (c *commandRemoteUnmount) Do(args []string, commandEnv *CommandEnv, writer
 		return fmt.Errorf("directory %s is not mounted", *dir)
 	}
 
-	// store a mount configuration in filer
+	// delete the mount mapping first: the filer reloads it on the spot, so the
+	// purge below stays local instead of deleting the remote objects
 	fmt.Fprintf(writer, "deleting mount for %s ...\n", *dir)
 	if err = filer.DeleteMountMapping(commandEnv, *dir); err != nil {
 		return fmt.Errorf("delete mount mapping: %w", err)
@@ -78,7 +79,7 @@ func (c *commandRemoteUnmount) Do(args []string, commandEnv *CommandEnv, writer
 	}
 
 	// reset remote sync offset in case the folder is mounted again
-	if err = remote_storage.SetSyncOffset(commandEnv.option.GrpcDialOption, commandEnv.option.FilerAddress, *dir, time.Now().UnixNano()); err != nil {
+	if err = remote_storage.SetSyncOffset(commandEnv.option.GrpcDialOption, commandEnv.FilerAddress(), *dir, time.Now().UnixNano()); err != nil {
 		return fmt.Errorf("reset remote.sync offset for %s: %v", *dir, err)
 	}
 
diff --git a/weed/shell/command_s3_bucket_allow_empty_folders.go b/weed/shell/command_s3_bucket_allow_empty_folders.go
new file mode 100644
index 0000000000..b29f7f68ad
--- /dev/null
+++ b/weed/shell/command_s3_bucket_allow_empty_folders.go
@@ -0,0 +1,130 @@
+package shell
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"io"
+	"strings"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3bucket"
+)
+
+func init() {
+	Commands = append(Commands, &commandS3BucketAllowEmptyFolders{})
+}
+
+type commandS3BucketAllowEmptyFolders struct {
+}
+
+func (c *commandS3BucketAllowEmptyFolders) Name() string {
+	return "s3.bucket.allowEmptyFolders"
+}
+
+func (c *commandS3BucketAllowEmptyFolders) Help() string {
+	return `view or toggle whether a bucket keeps empty folders
+
+	When enabled, the empty folder cleaner skips this bucket, so empty
+	directories persist (POSIX semantics). weed mount sets this when
+	mounting a bucket root.
+
+	When disabled, folders emptied by object deletes are removed
+	asynchronously and stop appearing as CommonPrefix in S3 listings.
+	The explicit "false" marker is kept by weed mount.
+
+	Example:
+		# Show the current setting
+		s3.bucket.allowEmptyFolders -name <bucket_name>
+
+		# Keep empty folders (skip the cleaner for this bucket)
+		s3.bucket.allowEmptyFolders -name <bucket_name> -enable
+
+		# Let the cleaner remove empty folders
+		s3.bucket.allowEmptyFolders -name <bucket_name> -disable
+`
+}
+
+func (c *commandS3BucketAllowEmptyFolders) HasTag(CommandTag) bool {
+	return false
+}
+
+func (c *commandS3BucketAllowEmptyFolders) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
+	bucketCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
+	bucketName := bucketCommand.String("name", "", "bucket name")
+	enable := bucketCommand.Bool("enable", false, "keep empty folders in the bucket")
+	disable := bucketCommand.Bool("disable", false, "remove empty folders asynchronously")
+	if err = bucketCommand.Parse(args); err != nil {
+		return err
+	}
+
+	if *bucketName == "" {
+		return fmt.Errorf("empty bucket name")
+	}
+	if err := s3bucket.VerifyS3BucketName(*bucketName); err != nil {
+		return fmt.Errorf("invalid bucket name %q: %w", *bucketName, err)
+	}
+	if *enable && *disable {
+		return fmt.Errorf("only one of -enable or -disable can be set")
+	}
+
+	filerBucketsPath, err := readFilerBucketsPath(commandEnv)
+	if err != nil {
+		return fmt.Errorf("read buckets: %w", err)
+	}
+
+	return commandEnv.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		for attempt := 0; attempt < 5; attempt++ {
+			lookupResp, err := client.LookupDirectoryEntry(context.Background(), &filer_pb.LookupDirectoryEntryRequest{
+				Directory: filerBucketsPath,
+				Name:      *bucketName,
+			})
+			if err != nil {
+				return fmt.Errorf("lookup bucket %s: %w", *bucketName, err)
+			}
+			entry := lookupResp.Entry
+
+			if !*enable && !*disable {
+				state := "disabled"
+				if strings.EqualFold(strings.TrimSpace(string(entry.Extended[s3_constants.ExtAllowEmptyFolders])), "true") {
+					state = "enabled"
+				}
+				fmt.Fprintf(writer, "Bucket: %s\n", *bucketName)
+				fmt.Fprintf(writer, "Allow empty folders: %s\n", state)
+				return nil
+			}
+
+			expected := filer_pb.SnapshotExtended(entry.Extended, s3_constants.ExtAllowEmptyFolders)
+
+			if entry.Extended == nil {
+				entry.Extended = make(map[string][]byte)
+			}
+			state := "disabled"
+			if *enable {
+				entry.Extended[s3_constants.ExtAllowEmptyFolders] = []byte("true")
+				state = "enabled"
+			} else {
+				entry.Extended[s3_constants.ExtAllowEmptyFolders] = []byte("false")
+			}
+
+			if _, err := client.UpdateEntry(context.Background(), &filer_pb.UpdateEntryRequest{
+				Directory:        filerBucketsPath,
+				Entry:            entry,
+				ExpectedExtended: expected,
+			}); err != nil {
+				if status.Code(err) == codes.FailedPrecondition {
+					continue
+				}
+				return fmt.Errorf("failed to update bucket: %w", err)
+			}
+
+			fmt.Fprintf(writer, "Bucket %s allow empty folders %s\n", *bucketName, state)
+			return nil
+		}
+		return fmt.Errorf("bucket %s changed concurrently; please retry", *bucketName)
+	})
+}
diff --git a/weed/shell/command_s3_bucket_create.go b/weed/shell/command_s3_bucket_create.go
index 5fcc7e7fbb..07f0eab1db 100644
--- a/weed/shell/command_s3_bucket_create.go
+++ b/weed/shell/command_s3_bucket_create.go
@@ -2,6 +2,7 @@ package shell
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
@@ -112,11 +113,16 @@ func (c *commandS3BucketCreate) Do(args []string, commandEnv *CommandEnv, writer
 			entry.Extended[s3_constants.ExtObjectLockEnabledKey] = []byte(s3_constants.ObjectLockEnabled)
 		}
 
-		if _, err := client.CreateEntry(context.Background(), &filer_pb.CreateEntryRequest{
+		createErr := filer_pb.CreateEntry(context.Background(), client, &filer_pb.CreateEntryRequest{
 			Directory: filerBucketsPath,
 			Entry:     entry,
-		}); err != nil {
-			return err
+			OExcl:     true,
+		})
+		if errors.Is(createErr, filer_pb.ErrEntryAlreadyExists) {
+			return fmt.Errorf("bucket %s already exists", *bucketName)
+		}
+		if createErr != nil {
+			return createErr
 		}
 
 		fmt.Fprintln(writer, "created bucket", *bucketName)
diff --git a/weed/shell/command_s3_bucket_create_test.go b/weed/shell/command_s3_bucket_create_test.go
new file mode 100644
index 0000000000..c409585fa3
--- /dev/null
+++ b/weed/shell/command_s3_bucket_create_test.go
@@ -0,0 +1,97 @@
+package shell
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+type bucketCreateTestFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+
+	mu         sync.Mutex
+	createReqs []*filer_pb.CreateEntryRequest
+}
+
+func (s *bucketCreateTestFilerServer) GetFilerConfiguration(context.Context, *filer_pb.GetFilerConfigurationRequest) (*filer_pb.GetFilerConfigurationResponse, error) {
+	return &filer_pb.GetFilerConfigurationResponse{DirBuckets: "/buckets"}, nil
+}
+
+func (s *bucketCreateTestFilerServer) CreateEntry(_ context.Context, req *filer_pb.CreateEntryRequest) (*filer_pb.CreateEntryResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.createReqs = append(s.createReqs, req)
+	return &filer_pb.CreateEntryResponse{
+		ErrorCode: filer_pb.FilerError_ENTRY_ALREADY_EXISTS,
+		Error:     "entry already exists",
+	}, nil
+}
+
+func (s *bucketCreateTestFilerServer) createRequests() []*filer_pb.CreateEntryRequest {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]*filer_pb.CreateEntryRequest(nil), s.createReqs...)
+}
+
+func TestS3BucketCreateRequestsExclusiveCreate(t *testing.T) {
+	filerServer := &bucketCreateTestFilerServer{}
+	commandEnv, cleanup := newBucketCreateTestCommandEnv(t, filerServer)
+	defer cleanup()
+
+	var output bytes.Buffer
+	err := (&commandS3BucketCreate{}).Do([]string{"-name", "my-bucket"}, commandEnv, &output)
+	require.EqualError(t, err, "bucket my-bucket already exists")
+
+	reqs := filerServer.createRequests()
+	require.Len(t, reqs, 1)
+	req := reqs[0]
+	assert.True(t, req.OExcl, "bucket create must not replace an existing entry")
+	assert.Equal(t, "/buckets", req.Directory)
+	assert.Equal(t, "my-bucket", req.Entry.Name)
+}
+
+func newBucketCreateTestCommandEnv(t *testing.T, filerServer filer_pb.SeaweedFilerServer) (*CommandEnv, func()) {
+	t.Helper()
+
+	socketDir, err := os.MkdirTemp("", "swbucket-")
+	require.NoError(t, err)
+	t.Cleanup(func() { _ = os.RemoveAll(socketDir) })
+
+	socketPath := filepath.Join(socketDir, "filer.sock")
+	listener, err := net.Listen("unix", socketPath)
+	require.NoError(t, err)
+
+	grpcServer := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(grpcServer, filerServer)
+	go func() {
+		_ = grpcServer.Serve(listener)
+	}()
+
+	grpcPort := 48000 + os.Getpid()%1000
+	pb.RegisterLocalGrpcSocket("127.0.0.1", grpcPort, socketPath)
+
+	cleanup := func() {
+		grpcServer.Stop()
+		_ = listener.Close()
+	}
+
+	return &CommandEnv{
+		option: &ShellOptions{
+			FilerAddress:   pb.ServerAddress(fmt.Sprintf("127.0.0.1:8888.%d", grpcPort)),
+			GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+			Directory:      "/",
+		},
+	}, cleanup
+}
diff --git a/weed/shell/command_s3_bucket_delete.go b/weed/shell/command_s3_bucket_delete.go
index ddd3201e97..026e671d1f 100644
--- a/weed/shell/command_s3_bucket_delete.go
+++ b/weed/shell/command_s3_bucket_delete.go
@@ -7,7 +7,6 @@ import (
 	"io"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_objectlock"
 )
 
@@ -65,17 +64,6 @@ func (c *commandS3BucketDelete) Do(args []string, commandEnv *CommandEnv, writer
 		return err
 	}
 
-	// delete the collection directly first
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-		_, err = client.CollectionDelete(ctx, &master_pb.CollectionDeleteRequest{
-			Name: getCollectionName(commandEnv, *bucketName),
-		})
-		return err
-	})
-	if err != nil {
-		return
-	}
-
 	return filer_pb.Remove(ctx, commandEnv, filerBucketsPath, *bucketName, false, true, true, false, nil)
 
 }
diff --git a/weed/shell/command_s3_bucket_quota_check.go b/weed/shell/command_s3_bucket_quota_check.go
index 7313514ec2..eda0c42842 100644
--- a/weed/shell/command_s3_bucket_quota_check.go
+++ b/weed/shell/command_s3_bucket_quota_check.go
@@ -60,7 +60,7 @@ func (c *commandS3BucketQuotaEnforce) Do(args []string, commandEnv *CommandEnv,
 	}
 
 	// read existing filer configuration
-	fc, err := filer.ReadFilerConf(commandEnv.option.FilerAddress, commandEnv.option.GrpcDialOption, commandEnv.MasterClient)
+	fc, err := filer.ReadFilerConf(commandEnv.FilerAddress(), commandEnv.option.GrpcDialOption, commandEnv.MasterClient)
 	if err != nil {
 		return err
 	}
diff --git a/weed/shell/command_s3_clean_uploads.go b/weed/shell/command_s3_clean_uploads.go
index b9d9bea5e8..1d7bf986c0 100644
--- a/weed/shell/command_s3_clean_uploads.go
+++ b/weed/shell/command_s3_clean_uploads.go
@@ -2,10 +2,13 @@ package shell
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
 	"io"
 	"math"
+	"path"
+	"strings"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
@@ -74,12 +77,12 @@ func (c *commandS3CleanUploads) Do(args []string, commandEnv *CommandEnv, writer
 
 func (c *commandS3CleanUploads) cleanupUploads(commandEnv *CommandEnv, writer io.Writer, filerBucketsPath string, bucket string, timeAgo time.Duration, signingKey string) error {
 	uploadsDir := filerBucketsPath + "/" + bucket + "/" + s3_constants.MultipartUploadsFolder
-	var staleUploads []string
+	var staleUploads []*filer_pb.Entry
 	now := time.Now()
 	err := filer_pb.List(context.Background(), commandEnv, uploadsDir, "", func(entry *filer_pb.Entry, isLast bool) error {
 		ctime := time.Unix(entry.Attributes.Crtime, 0)
 		if ctime.Add(timeAgo).Before(now) {
-			staleUploads = append(staleUploads, entry.Name)
+			staleUploads = append(staleUploads, entry)
 		}
 		return nil
 	}, "", false, math.MaxUint32)
@@ -93,14 +96,75 @@ func (c *commandS3CleanUploads) cleanupUploads(commandEnv *CommandEnv, writer io
 	}
 
 	for _, staleUpload := range staleUploads {
-		deleteUrl := fmt.Sprintf("http://%s%s/%s?recursive=true&ignoreRecursiveError=true", commandEnv.option.FilerAddress.ToHttpAddress(), uploadsDir, staleUpload)
+		// A completed upload's part entries share chunks with the finished
+		// object, so purging their data corrupts it. Completion normally
+		// removes this directory itself; a survivor means that cleanup failed
+		// and only the metadata should go. An undecidable lookup is left for
+		// the next run rather than risk live chunks.
+		completed, checkErr := c.uploadCompleted(commandEnv, filerBucketsPath+"/"+bucket, staleUpload)
+		if checkErr != nil {
+			fmt.Fprintf(writer, "skip %s: %v\n", staleUpload.Name, checkErr)
+			continue
+		}
+		deleteUrl := fmt.Sprintf("http://%s%s/%s?recursive=true&ignoreRecursiveError=true", commandEnv.FilerAddress().ToHttpAddress(), uploadsDir, staleUpload.Name)
+		if completed {
+			deleteUrl += "&skipChunkDeletion=true"
+		}
 		fmt.Fprintf(writer, "purge %s\n", deleteUrl)
 
 		err = util_http.Delete(deleteUrl, string(encodedJwt))
 		if err != nil && err.Error() != "" {
-			return fmt.Errorf("purge %s/%s: %v", uploadsDir, staleUpload, err)
+			return fmt.Errorf("purge %s/%s: %v", uploadsDir, staleUpload.Name, err)
 		}
 	}
 
 	return nil
 }
+
+// uploadCompleted reports whether the upload assembled into an object: the
+// object entry, or any version file under <key>.versions, still carries the
+// upload id completion stamps on it.
+func (c *commandS3CleanUploads) uploadCompleted(filerClient filer_pb.FilerClient, bucketDir string, upload *filer_pb.Entry) (bool, error) {
+	objectKey := string(upload.Extended[s3_constants.ExtMultipartObjectKey])
+	if objectKey == "" {
+		return false, nil
+	}
+	// Derive the object location the same way completion's getEntryNameAndDir
+	// does: a trailing-slash key stores the object inside the directory it
+	// names, so FullPath+DirAndName would look one level too high.
+	name := path.Base(objectKey)
+	dir := path.Dir(objectKey)
+	if dir == "." {
+		dir = ""
+	}
+	objectDir := util.FullPath(bucketDir + "/" + dir)
+
+	completed := false
+	err := filerClient.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := filer_pb.LookupEntry(context.Background(), client, &filer_pb.LookupDirectoryEntryRequest{Directory: string(objectDir), Name: name})
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			return nil
+		}
+		if err != nil {
+			return err
+		}
+		if resp.Entry != nil && string(resp.Entry.Extended[s3_constants.SeaweedFSUploadId]) == upload.Name {
+			completed = true
+		}
+		return nil
+	})
+	if err != nil || completed {
+		return completed, err
+	}
+
+	err = filer_pb.List(context.Background(), filerClient, string(objectDir)+"/"+name+s3_constants.VersionsFolder, "", func(entry *filer_pb.Entry, isLast bool) error {
+		if string(entry.Extended[s3_constants.SeaweedFSUploadId]) == upload.Name {
+			completed = true
+		}
+		return nil
+	}, "", false, math.MaxUint32)
+	if err != nil && (errors.Is(err, filer_pb.ErrNotFound) || strings.Contains(err.Error(), filer_pb.ErrNotFound.Error())) {
+		return false, nil
+	}
+	return completed, err
+}
diff --git a/weed/shell/command_s3_clean_uploads_test.go b/weed/shell/command_s3_clean_uploads_test.go
new file mode 100644
index 0000000000..6da4ff1e76
--- /dev/null
+++ b/weed/shell/command_s3_clean_uploads_test.go
@@ -0,0 +1,171 @@
+package shell
+
+import (
+	"context"
+	"errors"
+	"io"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+type stubFilerClient struct {
+	client filer_pb.SeaweedFilerClient
+}
+
+func (s stubFilerClient) WithFilerClient(_ bool, fn func(filer_pb.SeaweedFilerClient) error) error {
+	return fn(s.client)
+}
+
+func (s stubFilerClient) AdjustedUrl(location *filer_pb.Location) string { return "" }
+
+func (s stubFilerClient) GetDataCenter() string { return "" }
+
+type stubFilerSvc struct {
+	filer_pb.SeaweedFilerClient
+	lookupResp *filer_pb.LookupDirectoryEntryResponse
+	lookupErr  error
+	listResp   []*filer_pb.Entry
+	listErr    error
+	lookupReq  *filer_pb.LookupDirectoryEntryRequest
+	listReq    *filer_pb.ListEntriesRequest
+}
+
+func (s *stubFilerSvc) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest, opts ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	s.lookupReq = req
+	return s.lookupResp, s.lookupErr
+}
+
+func (s *stubFilerSvc) ListEntries(ctx context.Context, req *filer_pb.ListEntriesRequest, opts ...grpc.CallOption) (filer_pb.SeaweedFiler_ListEntriesClient, error) {
+	s.listReq = req
+	if s.listErr != nil {
+		return nil, s.listErr
+	}
+	return &stubListStream{entries: s.listResp}, nil
+}
+
+type stubListStream struct {
+	entries []*filer_pb.Entry
+	idx     int
+}
+
+func (s *stubListStream) Header() (metadata.MD, error) { return nil, nil }
+func (s *stubListStream) Trailer() metadata.MD         { return nil }
+func (s *stubListStream) CloseSend() error             { return nil }
+func (s *stubListStream) Context() context.Context     { return context.Background() }
+func (s *stubListStream) SendMsg(m any) error          { return nil }
+func (s *stubListStream) RecvMsg(m any) error          { return nil }
+
+func (s *stubListStream) Recv() (*filer_pb.ListEntriesResponse, error) {
+	if s.idx >= len(s.entries) {
+		return nil, io.EOF
+	}
+	entry := s.entries[s.idx]
+	s.idx++
+	return &filer_pb.ListEntriesResponse{Entry: entry}, nil
+}
+
+func uploadEntry(uploadId, objectKey string) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Name:     uploadId,
+		Extended: map[string][]byte{s3_constants.ExtMultipartObjectKey: []byte(objectKey)},
+	}
+}
+
+func completedEntry(uploadId string) *filer_pb.Entry {
+	return &filer_pb.Entry{
+		Extended: map[string][]byte{s3_constants.SeaweedFSUploadId: []byte(uploadId)},
+	}
+}
+
+func TestUploadCompleted(t *testing.T) {
+	c := &commandS3CleanUploads{}
+
+	t.Run("object entry carries the upload id", func(t *testing.T) {
+		fc := stubFilerClient{client: &stubFilerSvc{
+			lookupResp: &filer_pb.LookupDirectoryEntryResponse{Entry: completedEntry("up1")},
+		}}
+		completed, err := c.uploadCompleted(fc, "/buckets/b", uploadEntry("up1", "obj"))
+		if err != nil || !completed {
+			t.Fatalf("got (%v, %v), want (true, nil)", completed, err)
+		}
+	})
+
+	t.Run("object entry has a different upload id", func(t *testing.T) {
+		fc := stubFilerClient{client: &stubFilerSvc{
+			lookupResp: &filer_pb.LookupDirectoryEntryResponse{Entry: completedEntry("up2")},
+		}}
+		completed, err := c.uploadCompleted(fc, "/buckets/b", uploadEntry("up1", "obj"))
+		if err != nil || completed {
+			t.Fatalf("got (%v, %v), want (false, nil)", completed, err)
+		}
+	})
+
+	t.Run("a version file carries the upload id", func(t *testing.T) {
+		fc := stubFilerClient{client: &stubFilerSvc{
+			lookupErr: filer_pb.ErrNotFound,
+			listResp: []*filer_pb.Entry{
+				completedEntry("up0"),
+				completedEntry("up1"),
+			},
+		}}
+		completed, err := c.uploadCompleted(fc, "/buckets/b", uploadEntry("up1", "obj"))
+		if err != nil || !completed {
+			t.Fatalf("got (%v, %v), want (true, nil)", completed, err)
+		}
+	})
+
+	t.Run("no object and no versions", func(t *testing.T) {
+		fc := stubFilerClient{client: &stubFilerSvc{
+			lookupErr: filer_pb.ErrNotFound,
+		}}
+		completed, err := c.uploadCompleted(fc, "/buckets/b", uploadEntry("up1", "obj"))
+		if err != nil || completed {
+			t.Fatalf("got (%v, %v), want (false, nil)", completed, err)
+		}
+	})
+
+	t.Run("upload dir without an object key", func(t *testing.T) {
+		completed, err := c.uploadCompleted(stubFilerClient{}, "/buckets/b", &filer_pb.Entry{Name: "up1"})
+		if err != nil || completed {
+			t.Fatalf("got (%v, %v), want (false, nil)", completed, err)
+		}
+	})
+
+	t.Run("lookup error propagates", func(t *testing.T) {
+		fc := stubFilerClient{client: &stubFilerSvc{
+			lookupErr: errors.New("store unavailable"),
+		}}
+		completed, err := c.uploadCompleted(fc, "/buckets/b", uploadEntry("up1", "obj"))
+		if err == nil || completed {
+			t.Fatalf("got (%v, %v), want (false, error)", completed, err)
+		}
+	})
+
+	t.Run("versions list not found means no completed object", func(t *testing.T) {
+		fc := stubFilerClient{client: &stubFilerSvc{
+			lookupErr: filer_pb.ErrNotFound,
+			listErr:   filer_pb.ErrNotFound,
+		}}
+		completed, err := c.uploadCompleted(fc, "/buckets/b", uploadEntry("up1", "obj"))
+		if err != nil || completed {
+			t.Fatalf("got (%v, %v), want (false, nil)", completed, err)
+		}
+	})
+
+	t.Run("trailing slash key resolves inside its directory", func(t *testing.T) {
+		svc := &stubFilerSvc{
+			lookupResp: &filer_pb.LookupDirectoryEntryResponse{Entry: completedEntry("up1")},
+		}
+		completed, err := c.uploadCompleted(stubFilerClient{client: svc}, "/buckets/b", uploadEntry("up1", "dir/"))
+		if err != nil || !completed {
+			t.Fatalf("got (%v, %v), want (true, nil)", completed, err)
+		}
+		if svc.lookupReq.Directory != "/buckets/b/dir" || svc.lookupReq.Name != "dir" {
+			t.Fatalf("lookup = %s/%s, want /buckets/b/dir/dir", svc.lookupReq.Directory, svc.lookupReq.Name)
+		}
+	})
+}
diff --git a/weed/shell/command_s3_iam_client.go b/weed/shell/command_s3_iam_client.go
index eb619100a1..832471d0bf 100644
--- a/weed/shell/command_s3_iam_client.go
+++ b/weed/shell/command_s3_iam_client.go
@@ -28,7 +28,7 @@ func (ce *CommandEnv) withIamClient(fn func(ctx context.Context, client iam_pb.S
 		ctx, cancel := context.WithTimeout(iamAdminAuthContext(context.Background()), iamRequestTimeout)
 		defer cancel()
 		return fn(ctx, iam_pb.NewSeaweedIdentityAccessManagementClient(conn))
-	}, ce.option.FilerAddress.ToGrpcAddress(), false, ce.option.GrpcDialOption)
+	}, ce.FilerAddress().ToGrpcAddress(), false, ce.option.GrpcDialOption)
 }
 
 func iamAdminAuthContext(ctx context.Context) context.Context {
diff --git a/weed/shell/command_s3_lifecycle_run_shard.go b/weed/shell/command_s3_lifecycle_run_shard.go
index e53b56c53c..47025bf8c2 100644
--- a/weed/shell/command_s3_lifecycle_run_shard.go
+++ b/weed/shell/command_s3_lifecycle_run_shard.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/s3_lifecycle_pb"
@@ -116,7 +117,6 @@ func (c *commandS3LifecycleRunShard) Do(args []string, env *CommandEnv, writer i
 			defer cancel()
 		}
 		client := &lifecycleClientCallable{c: rpcClient}
-		listFn := dailyrun.FilerListFunc(filerClient, bucketsPath)
 		walkerDispatch := &dailyrun.WalkerDispatcher{Client: client}
 
 		fmt.Fprintf(writer, "running shards %s (event budget=%d, runtime=%s, refresh=%s)…\n",
@@ -165,8 +165,9 @@ func (c *commandS3LifecycleRunShard) Do(args []string, env *CommandEnv, writer i
 					buckets = append(buckets, in.Bucket)
 				}
 			}
-			walker := dailyrun.WalkerFunc(func(walkCtx context.Context, view *engine.Snapshot, shardID int) error {
-				return dailyrun.WalkBuckets(walkCtx, view, shardID, buckets, listFn, walkerDispatch)
+			walker := dailyrun.WalkerFunc(func(walkCtx context.Context, view *engine.Snapshot, shards []int) error {
+				return dailyrun.WalkBuckets(walkCtx, view, shards, buckets,
+					dailyrun.FilerListFunc(filerClient, bucketsPath, view), walkerDispatch)
 			})
 			return dailyrun.Run(passCtx, dailyrun.Config{
 				Shards:      shards,
@@ -180,7 +181,7 @@ func (c *commandS3LifecycleRunShard) Do(args []string, env *CommandEnv, writer i
 				// integration tests and CI. Fan out across the selected shards
 				// so recovery walks do not serialize 16 shard scans into a 10s
 				// timeout budget.
-				Workers: len(shards),
+				Workers:     len(shards),
 				Walker:      walker,
 				EventBudget: *eventBudget,
 				ClientName:  fmt.Sprintf("shell-lifecycle-%s", formatShardLabel(shards)),
@@ -314,6 +315,7 @@ type lifecycleClientCallable struct {
 }
 
 func (l *lifecycleClientCallable) LifecycleDelete(ctx context.Context, req *s3_lifecycle_pb.LifecycleDeleteRequest) (*s3_lifecycle_pb.LifecycleDeleteResponse, error) {
+	ctx, _ = credential.WithS3InternalAdminAuth(ctx)
 	return l.c.LifecycleDelete(ctx, req)
 }
 
diff --git a/weed/shell/command_s3tables_bucket.go b/weed/shell/command_s3tables_bucket.go
index d24a80599c..26153440b7 100644
--- a/weed/shell/command_s3tables_bucket.go
+++ b/weed/shell/command_s3tables_bucket.go
@@ -67,6 +67,7 @@ func (c *commandS3TablesBucket) Do(args []string, commandEnv *CommandEnv, writer
 	tags := cmd.String("tags", "", "comma separated tags key=value")
 	policyFile := cmd.String("file", "", "policy file (json)")
 	account := cmd.String("account", "", "owner account id")
+	format := cmd.String("format", "", "table format the bucket holds: ICEBERG (default) or LANCE")
 
 	if err := cmd.Parse(args); err != nil {
 		return err
@@ -95,6 +96,13 @@ func (c *commandS3TablesBucket) Do(args []string, commandEnv *CommandEnv, writer
 			return err
 		}
 		req := &s3tables.CreateTableBucketRequest{Name: *name}
+		if *format != "" {
+			normalized, ok := s3tables.NormalizeFormat(*format)
+			if !ok {
+				return fmt.Errorf("unsupported format %q", *format)
+			}
+			req.Format = normalized
+		}
 		if *tags != "" {
 			parsed, err := parseS3TablesTags(*tags)
 			if err != nil {
diff --git a/weed/shell/command_volume_balance.go b/weed/shell/command_volume_balance.go
index ed7222f425..60baebcf4f 100644
--- a/weed/shell/command_volume_balance.go
+++ b/weed/shell/command_volume_balance.go
@@ -7,10 +7,11 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"regexp"
 	"strings"
+	"sync"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 
 	"slices"
@@ -20,6 +21,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/seaweedfs/seaweedfs/weed/topology/balancer"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
@@ -32,13 +34,16 @@ func init() {
 }
 
 type commandVolumeBalance struct {
-	volumeSizeLimitMb uint64
-	commandEnv        *CommandEnv
-	volumeByActive    *bool
-	applyBalancing    bool
-	volumesPerExec    int
-	movedCount        int
-	byDiskUsage       bool
+	volumeSizeLimitMb  uint64
+	commandEnv         *CommandEnv
+	volumeByActive     *bool
+	applyBalancing     bool
+	volumesPerExec     int
+	ioBytePerSecond    int64
+	maxParallelization int
+	movedCount         int
+	byDiskUsage        bool
+	balanceMu          sync.Mutex
 
 	// diskUsageHighWaterPercent skips a move target whose physical disk used%
 	// is at or above this mark. 0 or >=100 disables the gate.
@@ -52,7 +57,7 @@ func (c *commandVolumeBalance) Name() string {
 func (c *commandVolumeBalance) Help() string {
 	return `balance all volumes among volume servers
 
-	volume.balance [-collection ALL_COLLECTIONS|EACH_COLLECTION|<collection_name>] [-apply] [-dataCenter=<data_center_name>] [-racks=rack_name_one,rack_name_two] [-nodes=192.168.0.1:8080,192.168.0.2:8080] [-volumesPerExec=5] [-byDiskUsage] [-maxDiskUsagePercent=90]
+	volume.balance [-collection ALL_COLLECTIONS|EACH_COLLECTION|<collection_name>] [-apply] [-dataCenter=<data_center_name>] [-racks=rack_name_one,rack_name_two] [-nodes=192.168.0.1:8080,192.168.0.2:8080] [-volumesPerExec=5] [-maxParallelization=1] [-ioBytePerSecond=<bytes>] [-byDiskUsage] [-maxDiskUsagePercent=90]
 
 	The -collection parameter supports:
 	  - ALL_COLLECTIONS: balance across all collections
@@ -65,6 +70,9 @@ func (c *commandVolumeBalance) Help() string {
 	The -volumesPerExec parameter limits the maximum number of volume moves in one command execution.
 	If unset - the command will try to balance all volumes at once.
 	It might be beneficial to set, if your cluster has lots of volumes growing and topology changes faster than balancing can occur.
+	The -maxParallelization parameter limits the number of volume moves running at the same time.
+	The default value of 1 keeps the original sequential behavior.
+	The -ioBytePerSecond parameter limits copy throughput for each volume move. The default value of 0 is unlimited.
 
 	The -maxDiskUsagePercent flag (default 90) skips any move target whose physical disk is already used at
 	or above that percentage, using the real filesystem capacity each volume server reports. This is the
@@ -123,15 +131,17 @@ func (c *commandVolumeBalance) Do(args []string, commandEnv *CommandEnv, writer
 	*allowedVolumeBy["ACTIVE"] = true
 	balanceCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	verbose := balanceCommand.Bool("v", false, "verbose mode")
-	collection := balanceCommand.String("collection", "ALL_COLLECTIONS", "collection name, or use \"ALL_COLLECTIONS\" across collections, \"EACH_COLLECTION\" for each collection")
+	collection := balanceCommand.String("collection", "ALL_COLLECTIONS", "comma-separated collection names, wildcards, or regex patterns, or \"ALL_COLLECTIONS\" across collections, \"EACH_COLLECTION\" for each collection")
 	dc := balanceCommand.String("dataCenter", "", "only apply the balancing for this dataCenter")
 	racks := balanceCommand.String("racks", "", "only apply the balancing for this racks")
 	nodes := balanceCommand.String("nodes", "", "only apply the balancing for this nodes")
+	ioBytePerSecond := balanceCommand.Int64("ioBytePerSecond", 0, "limit volume-move copy speed in bytes per second (default 0 is unlimited)")
 	noLock := balanceCommand.Bool("noLock", false, "do not lock the admin shell at one's own risk")
 	applyBalancing := balanceCommand.Bool("apply", false, "apply the balancing plan.")
 	// TODO: remove this alias
 	applyBalancingAlias := balanceCommand.Bool("force", false, "apply the balancing plan (alias for -apply)")
 	volumesPerExec := balanceCommand.Int("volumesPerExec", 0, "how many volumes to move in one run (default is 0 for unlimited)")
+	maxParallelization := balanceCommand.Int("maxParallelization", 1, "run up to X volume moves in parallel, whenever possible")
 	byDiskUsage := balanceCommand.Bool("byDiskUsage", false, "rank servers by reported physical disk used percent instead of slot density; falls back to sum of volume sizes for all servers when any server does not report disk bytes. Use when maxVolumeCount is set too high for the disk.")
 	maxDiskUsagePercent := balanceCommand.Int("maxDiskUsagePercent", balancer.DefaultMaxDiskUsagePercent, "skip a move target whose physical disk used%% is at/above this; judged per server against its own disk, so heterogeneous disk sizes are fine. 0 or >=100 disables. Auto-skipped for servers that do not report disk bytes.")
 
@@ -155,7 +165,12 @@ func (c *commandVolumeBalance) Do(args []string, commandEnv *CommandEnv, writer
 	if *volumesPerExec < 0 {
 		return fmt.Errorf("volumesPerExec must be >= 0")
 	}
+	if *maxParallelization < 1 {
+		return fmt.Errorf("maxParallelization must be >= 1")
+	}
+	c.ioBytePerSecond = *ioBytePerSecond
 	c.volumesPerExec = *volumesPerExec
+	c.maxParallelization = *maxParallelization
 	c.movedCount = 0
 	c.byDiskUsage = *byDiskUsage
 	c.diskUsageHighWaterPercent = *maxDiskUsagePercent
@@ -183,7 +198,7 @@ func (c *commandVolumeBalance) Do(args []string, commandEnv *CommandEnv, writer
 	volumeReplicas, _ := collectVolumeReplicaLocations(topologyInfo)
 	diskTypes := collectVolumeDiskTypes(topologyInfo)
 
-	if *collection == "EACH_COLLECTION" {
+	if *collection == string(wildcard.CollectionFilterEach) {
 		collections, err := ListCollectionNames(commandEnv, true, false)
 		if err != nil {
 			return err
@@ -197,18 +212,18 @@ func (c *commandVolumeBalance) Do(args []string, commandEnv *CommandEnv, writer
 				return err
 			}
 		}
-	} else if *collection == "ALL_COLLECTIONS" {
-		// Pass nil pattern for all collections
-		if err = c.balanceVolumeServers(diskTypes, volumeReplicas, volumeServers, nil, *collection); err != nil {
+	} else if *collection == string(wildcard.CollectionFilterAll) || *collection == "*" {
+		// Pass nil matcher for all collections
+		if err = c.balanceVolumeServers(diskTypes, volumeReplicas, volumeServers, nil, string(wildcard.CollectionFilterAll)); err != nil {
 			return err
 		}
 	} else {
 		// Compile user-provided pattern
-		collectionPattern, err := compileCollectionPattern(*collection)
+		collectionMatcher, err := compileCollectionPattern(*collection)
 		if err != nil {
 			return fmt.Errorf("invalid collection pattern '%s': %v", *collection, err)
 		}
-		if err = c.balanceVolumeServers(diskTypes, volumeReplicas, volumeServers, collectionPattern, *collection); err != nil {
+		if err = c.balanceVolumeServers(diskTypes, volumeReplicas, volumeServers, collectionMatcher, *collection); err != nil {
 			return err
 		}
 	}
@@ -216,25 +231,24 @@ func (c *commandVolumeBalance) Do(args []string, commandEnv *CommandEnv, writer
 	return nil
 }
 
-func (c *commandVolumeBalance) balanceVolumeServers(diskTypes []types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodes []*Node, collectionPattern *regexp.Regexp, collectionName string) error {
+func (c *commandVolumeBalance) balanceVolumeServers(diskTypes []types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodes []*Node, collectionMatcher *wildcard.CollectionMatcher, collectionName string) error {
 	for _, diskType := range diskTypes {
 		if c.volumesPerExec > 0 && c.movedCount >= c.volumesPerExec {
 			break
 		}
-		if err := c.balanceVolumeServersByDiskType(diskType, volumeReplicas, nodes, collectionPattern, collectionName); err != nil {
+		if err := c.balanceVolumeServersByDiskType(diskType, volumeReplicas, nodes, collectionMatcher, collectionName); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func (c *commandVolumeBalance) balanceVolumeServersByDiskType(diskType types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodes []*Node, collectionPattern *regexp.Regexp, collectionName string) error {
+func (c *commandVolumeBalance) balanceVolumeServersByDiskType(diskType types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodes []*Node, collectionMatcher *wildcard.CollectionMatcher, collectionName string) error {
 	for _, n := range nodes {
 		n.selectVolumes(func(v *master_pb.VolumeInformationMessage) bool {
-			if collectionName != "ALL_COLLECTIONS" {
-				if collectionPattern != nil {
-					// Use regex pattern matching
-					if !collectionPattern.MatchString(v.Collection) {
+			if collectionName != string(wildcard.CollectionFilterAll) {
+				if collectionMatcher != nil {
+					if !collectionMatcher.Matches(v.Collection) {
 						return false
 					}
 				} else {
@@ -322,6 +336,12 @@ type Node struct {
 	rack            string
 }
 
+type volumeBalanceMove struct {
+	volume *master_pb.VolumeInformationMessage
+	source *Node
+	target *Node
+}
+
 type CapacityFunc func(*master_pb.DataNodeInfo) float64
 type DensityFunc func(*master_pb.DataNodeInfo) (float64, uint64)
 
@@ -496,14 +516,15 @@ func selectVolumesByActive(volumeSize uint64, volumeByActive *bool, volumeSizeLi
 	}
 }
 
-func (c *commandVolumeBalance) balanceSelectedVolume(diskType types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodes []*Node, sortCandidatesFn func(volumes []*master_pb.VolumeInformationMessage)) (err error) {
+// planBalance computes the state shared by sequential and parallel execution:
+// eligible nodes, the density function used to rank them, and the ideal ratio.
+func (c *commandVolumeBalance) planBalance(diskType types.DiskType, nodes []*Node) (nodesWithCapacity []*Node, capacityFunc DensityFunc, idealVolumeRatio float64, volumeSizeLimitMb uint64, ok bool) {
 	selectedVolumeCount, volumeCapacities := uint64(0), float64(0)
-	var nodesWithCapacity []*Node
-	volumeSizeLimitMb := c.volumeSizeLimitMb
+	volumeSizeLimitMb = c.volumeSizeLimitMb
 	if volumeSizeLimitMb == 0 {
 		volumeSizeLimitMb = util.VolumeSizeLimitGB * util.KiByte
 	}
-	capacityFunc := capacityByMinVolumeDensity(diskType, volumeSizeLimitMb)
+	capacityFunc = capacityByMinVolumeDensity(diskType, volumeSizeLimitMb)
 	if c.byDiskUsage {
 		capacityFunc = capacityByDiskUsage(diskType, volumeSizeLimitMb, nodes)
 	}
@@ -516,121 +537,219 @@ func (c *commandVolumeBalance) balanceSelectedVolume(diskType types.DiskType, vo
 		selectedVolumeCount += volumeCount
 	}
 	if volumeCapacities == 0 {
-		return nil
+		return nil, nil, 0, volumeSizeLimitMb, false
 	}
-	idealVolumeRatio := float64(selectedVolumeCount) / volumeCapacities
-
-	hasMoved := true
+	idealVolumeRatio = float64(selectedVolumeCount) / volumeCapacities
 
 	if c.commandEnv != nil && c.commandEnv.verbose {
 		fmt.Fprintf(os.Stdout, "selected nodes %d, volumes:%d, cap:%d, idealVolumeRatio %f\n", len(nodesWithCapacity), selectedVolumeCount, int64(volumeCapacities), idealVolumeRatio*100)
 	}
-	for hasMoved {
-		hasMoved = false
-		if c.volumesPerExec > 0 && c.movedCount >= c.volumesPerExec {
+	return nodesWithCapacity, capacityFunc, idealVolumeRatio, volumeSizeLimitMb, true
+}
+
+// planBalanceMove selects one volume move without mutating the topology. The
+// caller reserves the returned move before handing it to the shared executor.
+func (c *commandVolumeBalance) planBalanceMove(diskType types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodesWithCapacity []*Node, sortCandidatesFn func(volumes []*master_pb.VolumeInformationMessage), capacityFunc DensityFunc, idealVolumeRatio float64, volumeSizeLimitMb uint64, failedTargets map[string]struct{}) *volumeBalanceMove {
+	slices.SortFunc(nodesWithCapacity, func(a, b *Node) int {
+		return cmp.Compare(a.localVolumeDensityRatio(capacityFunc), b.localVolumeDensityRatio(capacityFunc))
+	})
+	if len(nodesWithCapacity) == 0 {
+		return nil
+	}
+
+	var fullNode *Node
+	var fullNodeIndex int
+	for fullNodeIndex = len(nodesWithCapacity) - 1; fullNodeIndex >= 0; fullNodeIndex-- {
+		fullNode = nodesWithCapacity[fullNodeIndex]
+		if len(fullNode.selectedVolumes) == 0 {
+			continue
+		}
+		if !fullNode.isOneVolumeOnly() {
 			break
 		}
-		slices.SortFunc(nodesWithCapacity, func(a, b *Node) int {
-			return cmp.Compare(a.localVolumeDensityRatio(capacityFunc), b.localVolumeDensityRatio(capacityFunc))
-		})
-		if len(nodesWithCapacity) == 0 {
+	}
+	if fullNodeIndex == -1 {
+		return nil
+	}
+
+	var candidateVolumes []*master_pb.VolumeInformationMessage
+	for _, v := range fullNode.selectedVolumes {
+		if v.RemoteStorageName != "" {
+			continue
+		}
+		candidateVolumes = append(candidateVolumes, v)
+	}
+	sortCandidatesFn(candidateVolumes)
+
+	for _, emptyNode := range nodesWithCapacity[:fullNodeIndex] {
+		if _, failed := failedTargets[emptyNode.info.Id]; failed {
+			continue
+		}
+		if c.byDiskUsage && !emptyNode.hasFreeVolumeSlot(diskType) {
+			continue
+		}
+		if c.targetDiskTooFull(emptyNode, diskType, volumeSizeLimitMb) {
 			if c.commandEnv != nil && c.commandEnv.verbose {
-				fmt.Fprintf(os.Stdout, "no volume server found with capacity for %s", diskType.ReadableString())
+				fmt.Fprintf(os.Stdout, "skip target %s: disk used%% >= %d%%\n", emptyNode.info.Id, c.diskUsageHighWaterPercent)
 			}
-			return nil
+			continue
+		}
+		if !(fullNode.localVolumeDensityNextRatio(capacityFunc) > idealVolumeRatio && emptyNode.localVolumeDensityNextRatio(capacityFunc) <= idealVolumeRatio) {
+			if c.commandEnv != nil && c.commandEnv.verbose {
+				fmt.Printf("no more volume servers with empty slots %s, idealVolumeRatio %f\n", emptyNode.info.Id, idealVolumeRatio)
+			}
+			break
 		}
 
-		var fullNode *Node
-		var fullNodeIndex int
-		for fullNodeIndex = len(nodesWithCapacity) - 1; fullNodeIndex >= 0; fullNodeIndex-- {
-			fullNode = nodesWithCapacity[fullNodeIndex]
-			if len(fullNode.selectedVolumes) == 0 {
+		for _, v := range candidateVolumes {
+			if _, found := emptyNode.selectedVolumes[v.Id]; found {
 				continue
 			}
-			if !fullNode.isOneVolumeOnly() {
-				break
-			}
-		}
-		var candidateVolumes []*master_pb.VolumeInformationMessage
-		for _, v := range fullNode.selectedVolumes {
-			candidateVolumes = append(candidateVolumes, v)
-		}
-		if fullNodeIndex == -1 {
-			if c.commandEnv != nil && c.commandEnv.verbose {
-				fmt.Fprintf(os.Stdout, "no nodes with capacity found for %s, nodes %d", diskType.ReadableString(), len(nodesWithCapacity))
-			}
-			return nil
-		}
-		sortCandidatesFn(candidateVolumes)
-		for _, emptyNode := range nodesWithCapacity[:fullNodeIndex] {
-			// In byte-usage mode the ranking ignores volume slots, so skip targets
-			// that are already at MaxVolumeCount so balancing never exceeds the
-			// slot limit.
-			if c.byDiskUsage && !emptyNode.hasFreeVolumeSlot(diskType) {
-				continue
-			}
-			// Never move onto a server whose physical disk is already near full,
-			// even if the slot-density metric ranks it as the emptiest node. This is
-			// the root-cause guard for an over-configured maxVolumeCount making a
-			// full disk look empty; it is judged per server against its own disk.
-			if c.targetDiskTooFull(emptyNode, diskType, volumeSizeLimitMb) {
-				if c.commandEnv != nil && c.commandEnv.verbose {
-					fmt.Fprintf(os.Stdout, "skip target %s: disk used%% >= %d%%\n", emptyNode.info.Id, c.diskUsageHighWaterPercent)
-				}
-				continue
-			}
-			if !(fullNode.localVolumeDensityNextRatio(capacityFunc) > idealVolumeRatio && emptyNode.localVolumeDensityNextRatio(capacityFunc) <= idealVolumeRatio) {
-				if c.commandEnv != nil && c.commandEnv.verbose {
-					fmt.Printf("no more volume servers with empty slots %s, idealVolumeRatio %f\n", emptyNode.info.Id, idealVolumeRatio)
-				}
-				break
-			}
-			fmt.Fprintf(os.Stdout, "%s %.2f %.2f:%.2f\t", diskType.ReadableString(), idealVolumeRatio,
-				fullNode.localVolumeDensityRatio(capacityFunc), emptyNode.localVolumeDensityNextRatio(capacityFunc))
-			if c.commandEnv != nil && c.commandEnv.verbose {
-				fmt.Fprintf(os.Stdout, "%s %.1f %.1f:%.1f\t", diskType.ReadableString(), idealVolumeRatio*100,
-					fullNode.localVolumeDensityRatio(capacityFunc)*100, emptyNode.localVolumeDensityNextRatio(capacityFunc)*100)
-			}
-			hasMoved, err = attemptToMoveOneVolume(c.commandEnv, volumeReplicas, fullNode, candidateVolumes, emptyNode, c.applyBalancing)
-			if err != nil {
-				if c.commandEnv != nil && c.commandEnv.verbose {
-					fmt.Fprintf(os.Stdout, "attempt to move one volume error %+v\n", err)
-				}
-				if strings.Contains(err.Error(), util.ErrVolumeNoSpaceLeft) {
+			if v.ReplicaPlacement > 0 {
+				replicaPlacement, _ := super_block.NewReplicaPlacementFromByte(byte(v.ReplicaPlacement))
+				if !isGoodMove(replicaPlacement, volumeReplicas[v.Id], fullNode, emptyNode) {
 					continue
 				}
-				return
-			}
-			if hasMoved {
-				c.movedCount++
-				break
 			}
+			return &volumeBalanceMove{volume: v, source: fullNode, target: emptyNode}
 		}
 	}
 	return nil
 }
 
-func attemptToMoveOneVolume(commandEnv *CommandEnv, volumeReplicas map[uint32][]*VolumeReplica, fullNode *Node, candidateVolumes []*master_pb.VolumeInformationMessage, emptyNode *Node, applyBalancing bool) (hasMoved bool, err error) {
+func (c *commandVolumeBalance) printBalanceMove(diskType types.DiskType, move volumeBalanceMove, capacityFunc DensityFunc, idealVolumeRatio float64) {
+	fullRatio := move.source.localVolumeDensityRatio(capacityFunc)
+	emptyNextRatio := move.target.localVolumeDensityNextRatio(capacityFunc)
+	fmt.Fprintf(os.Stdout, "%s %.2f %.2f:%.2f\t", diskType.ReadableString(), idealVolumeRatio, fullRatio, emptyNextRatio)
+	if c.commandEnv != nil && c.commandEnv.verbose {
+		fmt.Fprintf(os.Stdout, "%s %.1f %.1f:%.1f\t", diskType.ReadableString(), idealVolumeRatio*100,
+			fullRatio*100, emptyNextRatio*100)
+	}
+}
 
-	for _, v := range candidateVolumes {
-		hasMoved, err = maybeMoveOneVolume(commandEnv, volumeReplicas, fullNode, v, emptyNode, applyBalancing)
-		if err != nil {
-			return
+func (c *commandVolumeBalance) balanceSelectedVolume(diskType types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodes []*Node, sortCandidatesFn func(volumes []*master_pb.VolumeInformationMessage)) error {
+	nodesWithCapacity, capacityFunc, idealVolumeRatio, volumeSizeLimitMb, ok := c.planBalance(diskType, nodes)
+	if !ok {
+		return nil
+	}
+	maxParallelization := c.maxParallelization
+	if maxParallelization < 1 {
+		maxParallelization = 1
+	}
+	failedTargets := make(map[string]struct{})
+
+	for {
+		moves := c.reserveBalanceMoves(maxParallelization, diskType, volumeReplicas, nodesWithCapacity,
+			sortCandidatesFn, capacityFunc, idealVolumeRatio, volumeSizeLimitMb, failedTargets)
+		if len(moves) == 0 {
+			return nil
 		}
-		if hasMoved {
-			break
+		if err := c.executeBalanceMoves(maxParallelization, moves, volumeReplicas, failedTargets); err != nil {
+			return err
 		}
 	}
-	return
+}
+
+func (c *commandVolumeBalance) reserveBalanceMoves(maxMoves int, diskType types.DiskType, volumeReplicas map[uint32][]*VolumeReplica, nodesWithCapacity []*Node, sortCandidatesFn func(volumes []*master_pb.VolumeInformationMessage), capacityFunc DensityFunc, idealVolumeRatio float64, volumeSizeLimitMb uint64, failedTargets map[string]struct{}) []volumeBalanceMove {
+	c.balanceMu.Lock()
+	defer c.balanceMu.Unlock()
+
+	moves := make([]volumeBalanceMove, 0, maxMoves)
+	for len(moves) < maxMoves && (c.volumesPerExec == 0 || c.movedCount < c.volumesPerExec) {
+		move := c.planBalanceMove(diskType, volumeReplicas, nodesWithCapacity, sortCandidatesFn,
+			capacityFunc, idealVolumeRatio, volumeSizeLimitMb, failedTargets)
+		if move == nil {
+			break
+		}
+		c.printBalanceMove(diskType, *move, capacityFunc, idealVolumeRatio)
+		// Reserve before releasing balanceMu so the next planner iteration observes
+		// the updated source, target, replica, and disk accounting.
+		adjustAfterMove(move.volume, volumeReplicas, move.source, move.target)
+		c.movedCount++
+		moves = append(moves, *move)
+	}
+	return moves
+}
+
+func (c *commandVolumeBalance) executeBalanceMoves(maxParallelization int, moves []volumeBalanceMove, volumeReplicas map[uint32][]*VolumeReplica, failedTargets map[string]struct{}) error {
+	taskGroups := make([][]ErrorWaitGroupTask, 0, len(moves))
+	for _, move := range moves {
+		move := move
+		taskGroups = append(taskGroups, []ErrorWaitGroupTask{func() error {
+			return c.executeBalanceMove(move, volumeReplicas, failedTargets)
+		}})
+	}
+	return executeParallelTaskGroups(maxParallelization, taskGroups)
+}
+
+func (c *commandVolumeBalance) executeBalanceMove(move volumeBalanceMove, volumeReplicas map[uint32][]*VolumeReplica, failedTargets map[string]struct{}) error {
+	if err := validateVolumeMove(c.commandEnv, move.volume); err != nil {
+		return c.failBalanceMove(move, volumeReplicas, failedTargets, err)
+	}
+
+	if err := moveVolume(c.commandEnv, move.volume, move.source, move.target, c.ioBytePerSecond, c.applyBalancing); err != nil {
+		return c.failBalanceMove(move, volumeReplicas, failedTargets, err)
+	}
+	return nil
+}
+
+func (c *commandVolumeBalance) failBalanceMove(move volumeBalanceMove, volumeReplicas map[uint32][]*VolumeReplica, failedTargets map[string]struct{}, err error) error {
+	if c.commandEnv != nil && c.commandEnv.verbose {
+		// Keep the error visible before a no-space failure blacklists its target.
+		fmt.Fprintf(os.Stdout, "attempt to move one volume error %+v\n", err)
+	}
+	c.balanceMu.Lock()
+	defer c.balanceMu.Unlock()
+
+	rollbackBalanceMove(move, volumeReplicas)
+	c.movedCount--
+	if strings.Contains(err.Error(), util.ErrVolumeNoSpaceLeft) {
+		failedTargets[move.target.info.Id] = struct{}{}
+		return nil
+	}
+	return err
+}
+
+func rollbackBalanceMove(move volumeBalanceMove, volumeReplicas map[uint32][]*VolumeReplica) {
+	delete(move.target.selectedVolumes, move.volume.Id)
+	if move.source.selectedVolumes == nil {
+		move.source.selectedVolumes = make(map[uint32]*master_pb.VolumeInformationMessage)
+	}
+	move.source.selectedVolumes[move.volume.Id] = move.volume
+
+	for _, replica := range volumeReplicas[move.volume.Id] {
+		if replica.location.dataNode.Id != move.target.info.Id || replica.location.rack != move.target.rack || replica.location.dc != move.target.dc {
+			continue
+		}
+		loc := newLocation(move.source.dc, move.source.rack, move.source.info)
+		replica.location = &loc
+		if targetDisk, found := move.target.info.DiskInfos[move.volume.DiskType]; found {
+			removeVolumeInfo(targetDisk, move.volume.Id)
+			addVolumeCount(targetDisk, -1)
+			addDiskFreeBytes(targetDisk, int64(move.volume.Size))
+		}
+		if sourceDisk, found := move.source.info.DiskInfos[move.volume.DiskType]; found {
+			sourceDisk.VolumeInfos = append(sourceDisk.VolumeInfos, move.volume)
+			addVolumeCount(sourceDisk, 1)
+			addDiskFreeBytes(sourceDisk, -int64(move.volume.Size))
+		}
+		return
+	}
+}
+
+func validateVolumeMove(commandEnv *CommandEnv, volume *master_pb.VolumeInformationMessage) error {
+	if !commandEnv.isLocked() {
+		return fmt.Errorf("lock is lost")
+	}
+	if volume.RemoteStorageName != "" {
+		return fmt.Errorf("does not move volume in remote storage")
+	}
+	return nil
 }
 
 func maybeMoveOneVolume(commandEnv *CommandEnv, volumeReplicas map[uint32][]*VolumeReplica, fullNode *Node, candidateVolume *master_pb.VolumeInformationMessage, emptyNode *Node, applyChange bool) (hasMoved bool, err error) {
-	if !commandEnv.isLocked() {
-		return false, fmt.Errorf("lock is lost")
-	}
-
-	if candidateVolume.RemoteStorageName != "" {
-		return false, fmt.Errorf("does not move volume in remote storage")
+	if err = validateVolumeMove(commandEnv, candidateVolume); err != nil {
+		return false, err
 	}
 
 	if candidateVolume.ReplicaPlacement > 0 {
@@ -640,7 +759,7 @@ func maybeMoveOneVolume(commandEnv *CommandEnv, volumeReplicas map[uint32][]*Vol
 		}
 	}
 	if _, found := emptyNode.selectedVolumes[candidateVolume.Id]; !found {
-		if err = moveVolume(commandEnv, candidateVolume, fullNode, emptyNode, applyChange); err == nil {
+		if err = moveVolume(commandEnv, candidateVolume, fullNode, emptyNode, 0, applyChange); err == nil {
 			adjustAfterMove(candidateVolume, volumeReplicas, fullNode, emptyNode)
 			return true, nil
 		} else {
@@ -650,18 +769,28 @@ func maybeMoveOneVolume(commandEnv *CommandEnv, volumeReplicas map[uint32][]*Vol
 	return
 }
 
-func moveVolume(commandEnv *CommandEnv, v *master_pb.VolumeInformationMessage, fullNode *Node, emptyNode *Node, applyChange bool) error {
+func moveVolume(commandEnv *CommandEnv, v *master_pb.VolumeInformationMessage, fullNode *Node, emptyNode *Node, ioBytePerSecond int64, applyChange bool) error {
 	collectionPrefix := v.Collection + "_"
 	if v.Collection == "" {
 		collectionPrefix = ""
 	}
 	fmt.Fprintf(os.Stdout, "  moving %s volume %s%d %s => %s\n", v.DiskType, collectionPrefix, v.Id, fullNode.info.Id, emptyNode.info.Id)
 	if applyChange {
-		return LiveMoveVolume(context.Background(), commandEnv.option.GrpcDialOption, os.Stderr, needle.VolumeId(v.Id), pb.NewServerAddressFromDataNode(fullNode.info), pb.NewServerAddressFromDataNode(emptyNode.info), 5*time.Second, v.DiskType, 0, v.ReadOnly)
+		return volume_move.NewMover(commandEnv.option.GrpcDialOption).LiveMoveVolume(context.Background(), needle.VolumeId(v.Id),
+			pb.NewServerAddressFromDataNode(fullNode.info), pb.NewServerAddressFromDataNode(emptyNode.info), volumeBalanceMoveOptions(v, ioBytePerSecond))
 	}
 	return nil
 }
 
+func volumeBalanceMoveOptions(v *master_pb.VolumeInformationMessage, ioBytePerSecond int64) volume_move.VolumeMoveOptions {
+	return volume_move.VolumeMoveOptions{
+		DiskType:        v.DiskType,
+		IoBytePerSecond: ioBytePerSecond,
+		IdleTimeout:     5 * time.Second,
+		Writer:          os.Stderr,
+	}
+}
+
 // toBalancerLocation converts a shell replica location to the shared placement
 // abstraction, resolving the physical host for machine anti-affinity.
 func toBalancerLocation(loc *location) balancer.Location {
diff --git a/weed/shell/command_volume_balance_test.go b/weed/shell/command_volume_balance_test.go
index 1491033349..56ffe70f82 100644
--- a/weed/shell/command_volume_balance_test.go
+++ b/weed/shell/command_volume_balance_test.go
@@ -297,6 +297,138 @@ func TestBalance(t *testing.T) {
 
 }
 
+func TestBalanceParallel(t *testing.T) {
+	const mb = 1024 * 1024
+	volumeSizeLimitMb := uint64(100)
+
+	volumes := make([]*master_pb.VolumeInformationMessage, 0, 8)
+	for id := uint32(1); id <= 8; id++ {
+		volumes = append(volumes, &master_pb.VolumeInformationMessage{Id: id, Size: 95 * mb})
+	}
+	fullNode := &Node{
+		info: &master_pb.DataNodeInfo{
+			Id: "full",
+			DiskInfos: map[string]*master_pb.DiskInfo{
+				"": {MaxVolumeCount: 10, VolumeCount: int64(len(volumes)), VolumeInfos: volumes},
+			},
+		},
+		dc: "dc1", rack: "rack1",
+	}
+	emptyNode := &Node{
+		info: &master_pb.DataNodeInfo{
+			Id: "empty",
+			DiskInfos: map[string]*master_pb.DiskInfo{
+				"": {MaxVolumeCount: 10},
+			},
+		},
+		dc: "dc1", rack: "rack1",
+	}
+
+	c := &commandVolumeBalance{
+		volumeSizeLimitMb:  volumeSizeLimitMb,
+		maxParallelization: 3,
+	}
+	runBalance(t, c, []*Node{fullNode, emptyNode})
+
+	if c.movedCount == 0 {
+		t.Fatal("expected parallel balance to move at least one volume")
+	}
+	if diff := len(fullNode.info.DiskInfos[""].VolumeInfos) - len(emptyNode.info.DiskInfos[""].VolumeInfos); diff > 1 || diff < -1 {
+		t.Fatalf("expected balanced distribution, got full=%d empty=%d", len(fullNode.info.DiskInfos[""].VolumeInfos), len(emptyNode.info.DiskInfos[""].VolumeInfos))
+	}
+
+	seen := make(map[uint32]int)
+	for _, node := range []*Node{fullNode, emptyNode} {
+		for _, volume := range node.info.DiskInfos[""].VolumeInfos {
+			seen[volume.Id]++
+		}
+	}
+	for id, count := range seen {
+		if count != 1 {
+			t.Fatalf("volume %d appears %d times after parallel balance", id, count)
+		}
+	}
+}
+
+func TestBalanceSkipsRemoteStorageVolumes(t *testing.T) {
+	const mb = 1024 * 1024
+
+	for _, maxParallelization := range []int{0, 2} {
+		t.Run(fmt.Sprintf("maxParallelization=%d", maxParallelization), func(t *testing.T) {
+			volumes := make([]*master_pb.VolumeInformationMessage, 0, 8)
+			for id := uint32(1); id <= 8; id++ {
+				volume := &master_pb.VolumeInformationMessage{Id: id, Size: 95 * mb}
+				if id <= 4 {
+					// Make remote volumes sort before ordinary volumes. Without the
+					// planner filter, this is the volume that would abort balancing.
+					volume.Size = mb
+					volume.RemoteStorageName = "remote"
+				}
+				volumes = append(volumes, volume)
+			}
+			fullNode := &Node{
+				info: &master_pb.DataNodeInfo{
+					Id: "full",
+					DiskInfos: map[string]*master_pb.DiskInfo{
+						"": {MaxVolumeCount: 10, VolumeCount: int64(len(volumes)), VolumeInfos: volumes},
+					},
+				},
+				dc: "dc1", rack: "rack1",
+			}
+			emptyNode := &Node{
+				info: &master_pb.DataNodeInfo{
+					Id: "empty",
+					DiskInfos: map[string]*master_pb.DiskInfo{
+						"": {MaxVolumeCount: 10},
+					},
+				},
+				dc: "dc1", rack: "rack1",
+			}
+			volumeReplicas := make(map[uint32][]*VolumeReplica, len(volumes))
+			for _, volume := range volumes {
+				loc := newLocation("dc1", "rack1", fullNode.info)
+				volumeReplicas[volume.Id] = []*VolumeReplica{{location: &loc, info: volume}}
+			}
+			for _, node := range []*Node{fullNode, emptyNode} {
+				node.selectVolumes(func(*master_pb.VolumeInformationMessage) bool { return true })
+			}
+
+			c := &commandVolumeBalance{
+				volumeSizeLimitMb:  100,
+				maxParallelization: maxParallelization,
+			}
+			if err := c.balanceSelectedVolume(types.HardDriveType, volumeReplicas, []*Node{fullNode, emptyNode}, sortWritableVolumes); err != nil {
+				t.Fatalf("balanceSelectedVolume: %v", err)
+			}
+			if c.movedCount == 0 {
+				t.Fatal("expected ordinary volumes to be moved")
+			}
+			remoteOnSource := 0
+			for _, volume := range fullNode.info.DiskInfos[""].VolumeInfos {
+				if volume.RemoteStorageName != "" {
+					remoteOnSource++
+				}
+			}
+			if remoteOnSource != 4 {
+				t.Fatalf("expected all remote volumes to remain on source, got %d", remoteOnSource)
+			}
+			if got := len(emptyNode.info.DiskInfos[""].VolumeInfos); got == 0 {
+				t.Fatal("expected target to receive ordinary volumes")
+			}
+			for _, volume := range emptyNode.info.DiskInfos[""].VolumeInfos {
+				if volume.RemoteStorageName != "" {
+					t.Fatalf("remote volume %d must remain on source", volume.Id)
+				}
+			}
+		})
+	}
+}
+
+func TestVolumeBalanceMoveOptions(t *testing.T) {
+	options := volumeBalanceMoveOptions(&master_pb.VolumeInformationMessage{DiskType: "ssd"}, 1234)
+	assert.Equal(t, int64(1234), options.IoBytePerSecond)
+}
+
 // Regression test: a freshly added empty volume server must end up sharing the
 // data roughly evenly, not having every volume drained onto it. Before the fix,
 // adjustAfterMove never updated the per-disk VolumeInfos that the density-based
diff --git a/weed/shell/command_volume_check_disk.go b/weed/shell/command_volume_check_disk.go
index ded05c3014..d819290657 100644
--- a/weed/shell/command_volume_check_disk.go
+++ b/weed/shell/command_volume_check_disk.go
@@ -549,9 +549,127 @@ func (vcd *volumeCheckDisk) checkBoth(source, target *VolumeReplica, bidi bool)
 		return sourceHasChanges, targetHasChanges, errors.Join(errs...)
 	}
 
+	// When nothing was repaired — typically because resurrection is gated off
+	// since both replicas have been vacuumed (compaction revision > 0), which is
+	// the normal state of any production cluster — doVolumeCheckDisk only logged
+	// "cannot prove they are missing writes vs vacuumed deletes" and stopped.
+	// That dead-end leaves a diverged replica with no actionable path, so classify
+	// the divergence and print the exact repair. This is report-only: it changes
+	// no data and does not bypass the resurrection safety gate.
+	if !targetHasChanges && !sourceHasChanges {
+		sourceOnly, targetOnly := vcd.liveDivergence(sourceDB, targetDB)
+		if sourceOnly > 0 || targetOnly > 0 {
+			vcd.reportDivergenceVerdict(source, target, sourceOnly, targetOnly,
+				sourceRevision, targetRevision,
+				vcd.resurrectMissingNeedles && bidi, vcd.resurrectMissingNeedles, vcd.resurrectMissingNeedles)
+		}
+	}
+
 	return sourceHasChanges, targetHasChanges, nil
 }
 
+// liveDivergence counts live (non-deleted) needles present on a's index but
+// entirely absent from b's, and the reverse. It is used to classify a diverged
+// replica pair: one-sided (the lagging replica holds no unique live data, so a
+// re-copy of the complete side converges it — subject to the deletion caveat
+// reportDivergenceVerdict states, since the absent needles may be valid
+// deletions on a vacuumed replica) versus two-sided (true split-brain — do
+// not auto-repair). Tombstones are excluded, so vacuum asymmetry (a compacted
+// replica that has dropped deleted entries) does not create a false
+// difference.
+func (vcd *volumeCheckDisk) liveDivergence(a, b *needle_map.MemDb) (aOnly, bOnly int) {
+	a.DescendingVisit(func(v needle_map.NeedleValue) error {
+		if v.Size.IsDeleted() {
+			return nil
+		}
+		if _, found := b.Get(v.Key); !found {
+			aOnly++
+		}
+		return nil
+	})
+	b.DescendingVisit(func(v needle_map.NeedleValue) error {
+		if v.Size.IsDeleted() {
+			return nil
+		}
+		if _, found := a.Get(v.Key); !found {
+			bOnly++
+		}
+		return nil
+	})
+	return
+}
+
+// reportDivergenceVerdict prints the actionable outcome for a diverged replica
+// pair that check.disk could not repair in place. revSrc/revTgt are the
+// replicas' compaction revisions (0 = never vacuumed; >0 = at least one
+// vacuum dropped deleted entries from the index); srcRevKnown/tgtRevKnown
+// report whether each revision was actually read (target is read even in
+// unidirectional mode; source only under -bidirectional). resurrectFlag is
+// the command line's -resurrectMissingNeedles.
+//
+// The verdict is tombstone-aware: when the lagging replica has been vacuumed,
+// a needle that is live on the complete side but absent on the lagging side is
+// ambiguous — either a missing write, or a valid deletion whose tombstone the
+// lagging side's vacuum already dropped. A whole-volume re-copy converges the
+// divergence either way, but in the latter case it resurrects deleted data, so
+// the volume.copy command is only emitted when the lagging side is proven
+// never-vacuumed; otherwise the verdict points at a non-destructive
+// needle-level repair instead.
+func (vcd *volumeCheckDisk) reportDivergenceVerdict(source, target *VolumeReplica, sourceOnly, targetOnly int, revSrc, revTgt uint32, srcRevKnown, tgtRevKnown, resurrectFlag bool) {
+	// Raw string form, NOT String(): ServerAddress.String() drops the custom
+	// gRPC port suffix, and volume.copy's dialer accepts the host:port.grpcPort
+	// form (see checkDialable in weed/operation/volume_move).
+	srcAddr := string(pb.NewServerAddressFromDataNode(source.location.dataNode))
+	tgtAddr := string(pb.NewServerAddressFromDataNode(target.location.dataNode))
+	vid := source.info.Id
+	switch {
+	case sourceOnly > 0 && targetOnly == 0:
+		// target is lagging: it holds no unique live data.
+		safe := deletionCaveat(resurrectFlag, tgtRevKnown, revTgt == 0)
+		if safe {
+			vcd.write("volume %d: ONE-SIDED divergence — %s is missing %d live needle(s) that exist on %s; %s holds no unique live data. Safe repair (whole-volume re-copy, complete -> lagging; verify-before-destroy is enforced): volume.copy -source %s -target %s -volumeId %d",
+				vid, tgtAddr, sourceOnly, srcAddr, tgtAddr, srcAddr, tgtAddr, vid)
+		} else {
+			vcd.write("volume %d: ONE-SIDED divergence — %s is missing %d live needle(s) that exist on %s; %s holds no unique live data. Do NOT re-copy the whole volume: the absent needles may be valid deletions already vacuumed away on the lagging side, which a re-copy would resurrect. Restore only the confirmed-missing needles (volume.fsck -collection <c> -volumeId %d -findMissingChunksInFiler, then needle-level repair), or re-copy only after accepting that risk.",
+				vid, tgtAddr, sourceOnly, srcAddr, tgtAddr, vid)
+		}
+	case targetOnly > 0 && sourceOnly == 0:
+		// source is lagging: it holds no unique live data.
+		safe := deletionCaveat(resurrectFlag, srcRevKnown, revSrc == 0)
+		if safe {
+			vcd.write("volume %d: ONE-SIDED divergence — %s is missing %d live needle(s) that exist on %s; %s holds no unique live data. Safe repair (whole-volume re-copy, complete -> lagging; verify-before-destroy is enforced): volume.copy -source %s -target %s -volumeId %d",
+				vid, srcAddr, targetOnly, tgtAddr, srcAddr, tgtAddr, srcAddr, vid)
+		} else {
+			vcd.write("volume %d: ONE-SIDED divergence — %s is missing %d live needle(s) that exist on %s; %s holds no unique live data. Do NOT re-copy the whole volume: the absent needles may be valid deletions already vacuumed away on the lagging side, which a re-copy would resurrect. Restore only the confirmed-missing needles (volume.fsck -collection <c> -volumeId %d -findMissingChunksInFiler, then needle-level repair), or re-copy only after accepting that risk.",
+				vid, srcAddr, targetOnly, tgtAddr, srcAddr, vid)
+		}
+	case sourceOnly > 0 && targetOnly > 0:
+		if resurrectFlag && srcRevKnown && tgtRevKnown && revSrc == 0 && revTgt == 0 {
+			// Both replicas proven never-vacuumed: the mutually missing
+			// needles are provably missing writes on both sides (the same
+			// proof the resurrection gate uses), not split-brain. The two
+			// doVolumeCheckDisk passes above already queued them for
+			// in-place resurrection but this was a simulation run, so
+			// nothing was applied.
+			vcd.write("volume %d: TWO-SIDED divergence, both replicas never vacuumed — %s is missing %d live needle(s) that exist on %s AND %s is missing %d that exist on %s. These are mutually missed writes, not split-brain: re-run this command with -apply to resurrect them in place (both directions).",
+				vid, tgtAddr, sourceOnly, srcAddr, srcAddr, targetOnly, tgtAddr)
+		} else {
+			vcd.write("volume %d: TWO-SIDED (split-brain) divergence — %s has %d unique live needle(s) AND %s has %d. Do NOT auto-repair: each side may hold data the other lacks. Confirm orphans with volume.fsck -collection <c> -volumeId %d -findMissingChunksInFiler before re-copying the complete replica, or restore the missing needles manually.",
+				vid, srcAddr, sourceOnly, tgtAddr, targetOnly, vid)
+		}
+	}
+}
+
+// deletionCaveat reports whether a one-sided divergence's complete -> lagging
+// re-copy is safe: the lagging side is proven never-vacuumed (compaction
+// revision 0) and that proof was actually taken under the
+// -resurrectMissingNeedles flag, so its absent live needles are missing
+// writes by the same proof the resurrection gate uses — not vacuumed
+// deletions.
+func deletionCaveat(resurrectFlag, laggingRevKnown, laggingNeverVacuumed bool) bool {
+	return resurrectFlag && laggingRevKnown && laggingNeverVacuumed
+}
+
 func (vcd *volumeCheckDisk) doVolumeCheckDisk(minuend, subtrahend *needle_map.MemDb, source, target *VolumeReplica, resurrectAbsent bool, targetRevision uint32) (hasChanges bool, err error) {
 
 	// find missing keys
@@ -641,6 +759,7 @@ func (vcd *volumeCheckDisk) doVolumeCheckDisk(minuend, subtrahend *needle_map.Me
 			vcd.writeVerbose("delete %s %s => %s", needleValue.Key.FileId(source.info.Id), source.location.dataNode.Id, target.location.dataNode.Id)
 		}
 		deleteResults := operation.DeleteFileIdsAtOneVolumeServer(
+			context.Background(),
 			pb.NewServerAddressFromDataNode(target.location.dataNode),
 			vcd.grpcDialOption(), fidList, false)
 
diff --git a/weed/shell/command_volume_check_disk_test.go b/weed/shell/command_volume_check_disk_test.go
index 2615b0b260..243f03a6c0 100644
--- a/weed/shell/command_volume_check_disk_test.go
+++ b/weed/shell/command_volume_check_disk_test.go
@@ -2,6 +2,7 @@ package shell
 
 import (
 	"bytes"
+	"strings"
 	"testing"
 	"time"
 
@@ -12,6 +13,201 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 )
 
+// TestLiveDivergenceClassifiesOneSidedVsTwoSided verifies the divergence
+// classifier used to turn check.disk's dead-end "cannot prove" no-op into an
+// actionable verdict: one-sided (safe to re-copy) vs two-sided (split-brain).
+func TestLiveDivergenceClassifiesOneSidedVsTwoSided(t *testing.T) {
+	// one-sided: source has an extra live needle; target has none unique.
+	src, tgt := needle_map.NewMemDb(), needle_map.NewMemDb()
+	defer src.Close()
+	defer tgt.Close()
+	if err := src.Set(types.NeedleId(1001), types.ToOffset(8), types.Size(123)); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	if err := tgt.Set(types.NeedleId(1002), types.ToOffset(8), types.Size(45)); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	// a shared live needle (should NOT count as divergence either way)
+	if err := src.Set(types.NeedleId(2000), types.ToOffset(8), types.Size(9)); err != nil {
+		t.Fatalf("seed shared: %v", err)
+	}
+	if err := tgt.Set(types.NeedleId(2000), types.ToOffset(8), types.Size(9)); err != nil {
+		t.Fatalf("seed shared: %v", err)
+	}
+	vcd := &volumeCheckDisk{writer: &bytes.Buffer{}, now: time.Now()}
+	sOnly, tOnly := vcd.liveDivergence(src, tgt)
+	if sOnly != 1 || tOnly != 1 {
+		t.Fatalf("one-sided: got sOnly=%d tOnly=%d, want 1/1 (1001 only on src, 1002 only on tgt)", sOnly, tOnly)
+	}
+
+	// strict subset: target has no unique needles -> tOnly must be 0.
+	subset, full := needle_map.NewMemDb(), needle_map.NewMemDb()
+	defer subset.Close()
+	defer full.Close()
+	if err := subset.Set(types.NeedleId(2000), types.ToOffset(8), types.Size(9)); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	for _, id := range []types.NeedleId{2000, 2001, 2002} {
+		if err := full.Set(id, types.ToOffset(8), types.Size(9)); err != nil {
+			t.Fatalf("seed: %v", err)
+		}
+	}
+	aOnly, bOnly := vcd.liveDivergence(full, subset) // full->subset
+	if aOnly != 2 || bOnly != 0 {
+		t.Fatalf("subset: full is superset; want aOnly=2 (2001,2002) bOnly=0, got %d/%d", aOnly, bOnly)
+	}
+
+	// tombstones must be excluded: a deleted-only difference is not divergence.
+	delSrc, delTgt := needle_map.NewMemDb(), needle_map.NewMemDb()
+	defer delSrc.Close()
+	defer delTgt.Close()
+	if err := delSrc.Set(types.NeedleId(3000), types.ToOffset(8), types.Size(9)); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	if err := delTgt.Set(types.NeedleId(3000), types.ToOffset(8), types.Size(9)); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	// delete 3000 on the source as a real tombstone (negative size), leave it
+	// live on target. liveDivergence must skip the tombstone on the source and
+	// must not count 3000 on the target either, because Get still finds the
+	// tombstone entry — so the expected answer is 0/0, not 0/1.
+	if err := delSrc.Set(types.NeedleId(3000), types.ToOffset(8), types.Size(-9)); err != nil {
+		t.Fatalf("tombstone: %v", err)
+	}
+	x, y := vcd.liveDivergence(delSrc, delTgt)
+	if x != 0 || y != 0 {
+		t.Fatalf("tombstone: deleted needle on src should not count; want src-only=0, tgt-only=0, got %d/%d", x, y)
+	}
+}
+
+// TestReportDivergenceVerdictEmitsCopyCommand checks that a one-sided verdict
+// prints the exact volume.copy command (complete -> lagging, dialable address),
+// that the command never uses the logical node Id, that a vacuumed (or
+// unproven) lagging replica gets the no-re-copy warning instead of a copy
+// command, that a proven never-vacuumed lagging replica gets the safe copy
+// command — including in unidirectional mode where only the target's revision
+// is known — and that a two-sided verdict warns instead of auto-repairing.
+func TestReportDivergenceVerdictEmitsCopyCommand(t *testing.T) {
+	// Id is a logical node identifier (NOT dialable); Address is the real
+	// ip:port the copy command must use.
+	src := &VolumeReplica{location: &location{"dc1", "r1", &master_pb.DataNodeInfo{Id: "node-1", Address: "10.0.0.1:8081"}}, info: &master_pb.VolumeInformationMessage{Id: 42}}
+	tgt := &VolumeReplica{location: &location{"dc1", "r2", &master_pb.DataNodeInfo{Id: "node-2", Address: "10.0.0.2:8083"}}, info: &master_pb.VolumeInformationMessage{Id: 42}}
+
+	// Case A: source has 5 unique live, target has none -> target is lagging.
+	// Revisions were not read (both known flags false), so no copy command.
+	var one bytes.Buffer
+	vcd := &volumeCheckDisk{writer: &one, now: time.Now()}
+	vcd.reportDivergenceVerdict(src, tgt, 5, 0, 0, 0, false, false, false)
+	got := one.String()
+	if !strings.Contains(got, "ONE-SIDED") {
+		t.Fatalf("expected ONE-SIDED verdict, got: %s", got)
+	}
+	if strings.Contains(got, "volume.copy") {
+		t.Fatalf("unproven lagging replica must not get a volume.copy command, got: %s", got)
+	}
+	if !strings.Contains(got, "Do NOT re-copy the whole volume") {
+		t.Fatalf("expected no-re-copy warning for unproven lagging replica, got: %s", got)
+	}
+	if !strings.Contains(got, "10.0.0.1:8081") || !strings.Contains(got, "10.0.0.2:8083") {
+		t.Fatalf("expected dialable addresses in verdict, got: %s", got)
+	}
+	if strings.Contains(got, "node-1") || strings.Contains(got, "node-2") {
+		t.Fatalf("verdict must use dialable Address, not logical node Id, got: %s", got)
+	}
+	if !strings.Contains(got, "5") {
+		t.Fatalf("expected missing-needle count 5, got: %s", got)
+	}
+
+	// Case B: source is lagging (target complete). The safe command must go
+	// complete -> lagging, i.e. -source <target> -target <source>.
+	var safeRev bytes.Buffer
+	vcdSafeRev := &volumeCheckDisk{writer: &safeRev, now: time.Now()}
+	vcdSafeRev.reportDivergenceVerdict(src, tgt, 0, 5, 0, 0, true, false, true)
+	gotRev := safeRev.String()
+	if !strings.Contains(gotRev, "volume.copy -source 10.0.0.2:8083 -target 10.0.0.1:8081 -volumeId 42") {
+		t.Fatalf("expected copy complete(10.0.0.2:8083)->lagging(10.0.0.1:8081), got: %s", gotRev)
+	}
+	if strings.Contains(gotRev, "volume.copy -source 10.0.0.1:8081 -target 10.0.0.2:8083") {
+		t.Fatalf("reversed direction: must not copy lagging source over complete target, got: %s", gotRev)
+	}
+
+	// Case C: target-lagging, unidirectional run (-resurrectMissingNeedles,
+	// not -bidirectional): sourceRevision was never read (srcRevKnown=false)
+	// but targetRevision was (tgtRevKnown=true) and is 0. The safe copy
+	// command must still be emitted — the false-warning regression.
+	var uni bytes.Buffer
+	vcdUni := &volumeCheckDisk{writer: &uni, now: time.Now()}
+	vcdUni.reportDivergenceVerdict(src, tgt, 5, 0, 0, 0, false, true, true)
+	gotUni := uni.String()
+	if !strings.Contains(gotUni, "ONE-SIDED") {
+		t.Fatalf("expected ONE-SIDED verdict, got: %s", gotUni)
+	}
+	if !strings.Contains(gotUni, "volume.copy -source 10.0.0.1:8081 -target 10.0.0.2:8083 -volumeId 42") {
+		t.Fatalf("unidirectional run with proven never-vacuumed target must emit the safe copy command, got: %s", gotUni)
+	}
+	if strings.Contains(gotUni, "Do NOT re-copy the whole volume") {
+		t.Fatalf("false warning: proven never-vacuumed lagging target must not get the no-re-copy warning, got: %s", gotUni)
+	}
+
+	// Case D: target-lagging but the lagging side was vacuumed (rev 17) ->
+	// no copy command, even though the proof was taken under the flag.
+	var vac bytes.Buffer
+	vcdVac := &volumeCheckDisk{writer: &vac, now: time.Now()}
+	vcdVac.reportDivergenceVerdict(src, tgt, 5, 0, 17, 17, true, true, true)
+	gotVac := vac.String()
+	if strings.Contains(gotVac, "volume.copy") {
+		t.Fatalf("vacuumed lagging replica must not get a volume.copy command, got: %s", gotVac)
+	}
+	if !strings.Contains(gotVac, "Do NOT re-copy the whole volume") {
+		t.Fatalf("expected no-re-copy warning for vacuumed lagging replica, got: %s", gotVac)
+	}
+
+	// Case E: two-sided, unproven (revisions not read) -> split-brain warning.
+	var two bytes.Buffer
+	vcd2 := &volumeCheckDisk{writer: &two, now: time.Now()}
+	vcd2.reportDivergenceVerdict(src, tgt, 3, 4, 0, 0, false, false, false)
+	got2 := two.String()
+	if !strings.Contains(got2, "TWO-SIDED") || !strings.Contains(got2, "split-brain") {
+		t.Fatalf("expected TWO-SIDED split-brain warning, got: %s", got2)
+	}
+	if strings.Contains(got2, "volume.copy") {
+		t.Fatalf("two-sided must not emit an auto volume.copy command, got: %s", got2)
+	}
+
+	// Case F: two-sided with BOTH replicas proven never-vacuumed under the
+	// resurrection flag (bidirectional simulation): mutually missing writes,
+	// not split-brain — the in-place -apply repair must be recommended and
+	// the split-brain warning must not appear.
+	var both bytes.Buffer
+	vcdBoth := &volumeCheckDisk{writer: &both, now: time.Now()}
+	vcdBoth.reportDivergenceVerdict(src, tgt, 3, 4, 0, 0, true, true, true)
+	gotBoth := both.String()
+	if !strings.Contains(gotBoth, "TWO-SIDED") {
+		t.Fatalf("expected TWO-SIDED verdict, got: %s", gotBoth)
+	}
+	if strings.Contains(gotBoth, "Do NOT auto-repair") {
+		t.Fatalf("proven never-vacuumed both sides must not get the split-brain warning, got: %s", gotBoth)
+	}
+	if !strings.Contains(gotBoth, "mutually missed writes") || !strings.Contains(gotBoth, "-apply") {
+		t.Fatalf("expected mutually-missed-writes verdict recommending -apply, got: %s", gotBoth)
+	}
+	if strings.Contains(gotBoth, "volume.copy") {
+		t.Fatalf("two-sided must not emit an auto volume.copy command, got: %s", gotBoth)
+	}
+
+	// Case G: custom gRPC ports must survive into the emitted addresses
+	// (ServerAddress.String() would drop the .grpcPort suffix).
+	srcGrpc := &VolumeReplica{location: &location{"dc1", "r1", &master_pb.DataNodeInfo{Id: "node-1", Address: "10.0.0.1:8081", GrpcPort: 18081}}, info: &master_pb.VolumeInformationMessage{Id: 42}}
+	tgtGrpc := &VolumeReplica{location: &location{"dc1", "r2", &master_pb.DataNodeInfo{Id: "node-2", Address: "10.0.0.2:8083", GrpcPort: 18083}}, info: &master_pb.VolumeInformationMessage{Id: 42}}
+	var grpc bytes.Buffer
+	vcdGrpc := &volumeCheckDisk{writer: &grpc, now: time.Now()}
+	vcdGrpc.reportDivergenceVerdict(srcGrpc, tgtGrpc, 5, 0, 0, 0, false, true, true)
+	gotGrpc := grpc.String()
+	if !strings.Contains(gotGrpc, "10.0.0.1:8081.18081") || !strings.Contains(gotGrpc, "10.0.0.2:8083.18083") {
+		t.Fatalf("custom gRPC port must be preserved in emitted addresses, got: %s", gotGrpc)
+	}
+}
+
 // TestDoVolumeCheckDiskDoesNotResurrectAbsentNeedle verifies that a needle
 // present-and-live on the source but entirely absent on the target is NOT
 // pushed back by default. Such an absence is indistinguishable from a needle
diff --git a/weed/shell/command_volume_check_duplicate_ids.go b/weed/shell/command_volume_check_duplicate_ids.go
new file mode 100644
index 0000000000..d60474ff9e
--- /dev/null
+++ b/weed/shell/command_volume_check_duplicate_ids.go
@@ -0,0 +1,140 @@
+package shell
+
+import (
+	"fmt"
+	"io"
+	"slices"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+)
+
+func init() {
+	Commands = append(Commands, &commandVolumeCheckDuplicateIds{})
+}
+
+type commandVolumeCheckDuplicateIds struct {
+}
+
+func (c *commandVolumeCheckDuplicateIds) Name() string {
+	return "volume.check.duplicate_ids"
+}
+
+func (c *commandVolumeCheckDuplicateIds) Help() string {
+	return `find volume ids registered under more than one layout
+
+	volume.check.duplicate_ids
+
+	Volume ids are global. The same id under two collections, replica
+	placements, TTLs, or disk types means the allocator reused an id, for
+	example after master state loss. See volume.growth.resume.
+
+`
+}
+
+func (c *commandVolumeCheckDuplicateIds) HasTag(CommandTag) bool {
+	return false
+}
+
+func (c *commandVolumeCheckDuplicateIds) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
+	topoInfo, _, err := collectTopologyInfo(commandEnv, 0)
+	if err != nil {
+		return err
+	}
+
+	// vid -> layout key -> locations; ec shards tracked per collection since
+	// shards plus regular copies of the same encoded volume are legitimate
+	seen := make(map[needle.VolumeId]map[string][]string)
+	ecSeen := make(map[needle.VolumeId]map[string][]string)
+	collections := make(map[needle.VolumeId]map[string]bool)
+	ecCollections := make(map[needle.VolumeId]map[string]bool)
+	add := func(m map[needle.VolumeId]map[string][]string, id uint32, key, location string) {
+		layouts := m[needle.VolumeId(id)]
+		if layouts == nil {
+			layouts = make(map[string][]string)
+			m[needle.VolumeId(id)] = layouts
+		}
+		layouts[key] = append(layouts[key], location)
+	}
+	addCollection := func(m map[needle.VolumeId]map[string]bool, id uint32, collection string) {
+		if m[needle.VolumeId(id)] == nil {
+			m[needle.VolumeId(id)] = make(map[string]bool)
+		}
+		m[needle.VolumeId(id)][collection] = true
+	}
+	for _, dc := range topoInfo.DataCenterInfos {
+		for _, r := range dc.RackInfos {
+			for _, dn := range r.DataNodeInfos {
+				for diskKey, di := range dn.DiskInfos {
+					for _, vi := range di.VolumeInfos {
+						rp, _ := super_block.NewReplicaPlacementFromByte(byte(vi.ReplicaPlacement))
+						add(seen, vi.Id, fmt.Sprintf("collection=%q replication=%s ttl=%s disk=%s",
+							vi.Collection, rp.String(), needle.LoadTTLFromUint32(vi.Ttl), vi.DiskType),
+							fmt.Sprintf("%s %s", dn.Id, diskKey))
+						addCollection(collections, vi.Id, vi.Collection)
+					}
+					for _, si := range di.EcShardInfos {
+						add(ecSeen, si.Id, fmt.Sprintf("collection=%q ec_shards", si.Collection),
+							fmt.Sprintf("%s %s disk=%s", dn.Id, diskKey, si.DiskType))
+						addCollection(ecCollections, si.Id, si.Collection)
+					}
+				}
+			}
+		}
+	}
+
+	vids := make(map[needle.VolumeId]struct{}, len(seen)+len(ecSeen))
+	for vid := range seen {
+		vids[vid] = struct{}{}
+	}
+	for vid := range ecSeen {
+		vids[vid] = struct{}{}
+	}
+
+	duplicates := 0
+	for _, vid := range sortedKeys(vids) {
+		layouts := seen[vid]
+		shardLayouts := ecSeen[vid]
+		ecForeign := false
+		if len(collections[vid]) > 0 {
+			for collection := range ecCollections[vid] {
+				if !collections[vid][collection] {
+					ecForeign = true
+				}
+			}
+		}
+		if len(layouts) < 2 && len(shardLayouts) < 2 && !ecForeign {
+			continue
+		}
+		duplicates++
+		fmt.Fprintf(writer, "volume %d is registered under %d layouts:\n", vid, len(layouts)+len(shardLayouts))
+		for _, key := range sortedKeysString(layouts) {
+			fmt.Fprintf(writer, "  %-60s %v\n", key, layouts[key])
+		}
+		for _, key := range sortedKeysString(shardLayouts) {
+			fmt.Fprintf(writer, "  %-60s %v\n", key, shardLayouts[key])
+		}
+	}
+	if duplicates == 0 {
+		fmt.Fprintf(writer, "no duplicate volume ids found\n")
+	}
+	return nil
+}
+
+func sortedKeys[V any](m map[needle.VolumeId]V) []needle.VolumeId {
+	keys := make([]needle.VolumeId, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	return keys
+}
+
+func sortedKeysString[V any](m map[string]V) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	slices.Sort(keys)
+	return keys
+}
diff --git a/weed/shell/command_volume_configure_replication.go b/weed/shell/command_volume_configure_replication.go
index 74d20eb93d..8add4aad80 100644
--- a/weed/shell/command_volume_configure_replication.go
+++ b/weed/shell/command_volume_configure_replication.go
@@ -6,7 +6,6 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"path/filepath"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 
@@ -15,6 +14,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 )
 
 func init() {
@@ -45,7 +45,7 @@ func (c *commandVolumeConfigureReplication) Do(args []string, commandEnv *Comman
 	configureReplicationCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeIdInt := configureReplicationCommand.Int("volumeId", 0, "the volume id")
 	replicationString := configureReplicationCommand.String("replication", "", "the intended replication value")
-	collectionPattern := configureReplicationCommand.String("collectionPattern", "", "match with wildcard characters '*' and '?'")
+	collectionPattern := configureReplicationCommand.String("collectionPattern", "", "comma-separated collection names, with '*' and '?' wildcards; empty matches all")
 	if err = configureReplicationCommand.Parse(args); err != nil {
 		return nil
 	}
@@ -70,7 +70,10 @@ func (c *commandVolumeConfigureReplication) Do(args []string, commandEnv *Comman
 	}
 
 	vid := needle.VolumeId(*volumeIdInt)
-	volumeFilter := getVolumeFilter(replicaPlacement, uint32(vid), *collectionPattern)
+	volumeFilter, err := getVolumeFilter(replicaPlacement, uint32(vid), *collectionPattern)
+	if err != nil {
+		return err
+	}
 
 	// find all data nodes with volumes that needs replication change
 	eachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
@@ -108,27 +111,18 @@ func (c *commandVolumeConfigureReplication) Do(args []string, commandEnv *Comman
 	return err
 }
 
-func getVolumeFilter(replicaPlacement *super_block.ReplicaPlacement, volumeId uint32, collectionPattern string) func(message *master_pb.VolumeInformationMessage) bool {
+func getVolumeFilter(replicaPlacement *super_block.ReplicaPlacement, volumeId uint32, collectionPattern string) (func(message *master_pb.VolumeInformationMessage) bool, error) {
 	replicaPlacementInt32 := uint32(replicaPlacement.Byte())
 	if volumeId > 0 {
 		return func(v *master_pb.VolumeInformationMessage) bool {
 			return v.Id == volumeId && v.ReplicaPlacement != replicaPlacementInt32
-		}
+		}, nil
+	}
+	collectionMatcher, err := wildcard.CompileCollectionMatcher(collectionPattern)
+	if err != nil {
+		return nil, err
 	}
 	return func(v *master_pb.VolumeInformationMessage) bool {
-		var collectionMatched bool
-		if collectionPattern == "" {
-			// Empty pattern matches all collections
-			collectionMatched = true
-		} else if collectionPattern == CollectionDefault {
-			collectionMatched = v.Collection == ""
-		} else {
-			m, err := filepath.Match(collectionPattern, v.Collection)
-			if err != nil {
-				return false
-			}
-			collectionMatched = m
-		}
-		return collectionMatched && v.ReplicaPlacement != replicaPlacementInt32
-	}
+		return collectionMatcher.Matches(v.Collection) && v.ReplicaPlacement != replicaPlacementInt32
+	}, nil
 }
diff --git a/weed/shell/command_volume_delete.go b/weed/shell/command_volume_delete.go
index f69a2997ab..e6a1180736 100644
--- a/weed/shell/command_volume_delete.go
+++ b/weed/shell/command_volume_delete.go
@@ -24,8 +24,10 @@ func (c *commandVolumeDelete) Help() string {
 	return `delete a live volume from one volume server
 
 	volume.delete -node <volume server host:port> -volumeId <volume id>
+	volume.delete -node <volume server host:port> -volumeId <volume id> -timeout 30s
 
 	This command deletes a volume from one volume server.
+	The option "-timeout" fails the command if the volume server does not respond in time.
 
 `
 }
@@ -39,6 +41,7 @@ func (c *commandVolumeDelete) Do(args []string, commandEnv *CommandEnv, writer i
 	volDeleteCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeIdInt := volDeleteCommand.Int("volumeId", 0, "the volume id")
 	nodeStr := volDeleteCommand.String("node", "", "the volume server <host>:<port>")
+	timeout := volDeleteCommand.Duration("timeout", 0, "wall-clock cap on the deletion; 0 = no timeout")
 	if err = volDeleteCommand.Parse(args); err != nil {
 		return nil
 	}
@@ -51,6 +54,13 @@ func (c *commandVolumeDelete) Do(args []string, commandEnv *CommandEnv, writer i
 
 	volumeId := needle.VolumeId(*volumeIdInt)
 
-	return deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, volumeId, sourceVolumeServer, false, false)
+	ctx := context.Background()
+	if *timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, *timeout)
+		defer cancel()
+	}
+
+	return deleteVolume(ctx, commandEnv.option.GrpcDialOption, volumeId, sourceVolumeServer, false, false, false)
 
 }
diff --git a/weed/shell/command_volume_delete_empty.go b/weed/shell/command_volume_delete_empty.go
index 2ff79a2481..b0874467ea 100644
--- a/weed/shell/command_volume_delete_empty.go
+++ b/weed/shell/command_volume_delete_empty.go
@@ -11,6 +11,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 )
 
 func init() {
@@ -31,6 +32,9 @@ func (c *commandVolumeDeleteEmpty) Help() string {
 	volume.deleteEmpty -collectionPattern=important* -quietFor=24h -apply
 
 	This command deletes all empty volumes from one volume server.
+	A volume with no live needles left is empty too, even when its
+	.dat file is still large: compacting it first would only rewrite
+	bytes that are all deleted already.
 
 `
 }
@@ -43,7 +47,7 @@ func (c *commandVolumeDeleteEmpty) Do(args []string, commandEnv *CommandEnv, wri
 
 	volDeleteCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	quietPeriod := volDeleteCommand.Duration("quietFor", 24*time.Hour, "select empty volumes with no recent writes, avoid newly created ones")
-	collectionPattern := volDeleteCommand.String("collectionPattern", "", "match with wildcard characters '*' and '?'")
+	collectionPattern := volDeleteCommand.String("collectionPattern", "", "comma-separated collection names, with '*' and '?' wildcards; empty matches all")
 	applyBalancing := volDeleteCommand.Bool("apply", false, "apply to delete empty volumes")
 	// TODO: remove this alias
 	applyBalancingAlias := volDeleteCommand.Bool("force", false, "apply to delete empty volumes (alias for -apply)")
@@ -64,17 +68,25 @@ func (c *commandVolumeDeleteEmpty) Do(args []string, commandEnv *CommandEnv, wri
 		return err
 	}
 
+	collectionMatcher, err := wildcard.CompileCollectionMatcher(*collectionPattern)
+	if err != nil {
+		return err
+	}
+
 	quietSeconds := int64(*quietPeriod / time.Second)
 	nowUnixSeconds := time.Now().Unix()
 
 	eachDataNode(topologyInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
 		for _, diskInfo := range dn.DiskInfos {
 			for _, v := range diskInfo.VolumeInfos {
-				if isEmptyVolumeDeleteCandidate(v, quietSeconds, nowUnixSeconds, *collectionPattern) {
+				if isEmptyVolumeDeleteCandidate(v, quietSeconds, nowUnixSeconds, collectionMatcher) {
 					if *applyBalancing {
 						log.Printf("deleting empty volume %d from %s", v.Id, dn.Id)
+						onlyGarbage := v.FileCount > 0 && v.FileCount <= v.DeleteCount
+						// onlyEmpty stays set so a pre-upgrade server checks
+						// emptiness and refuses instead of deleting unseen.
 						if deleteErr := deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, needle.VolumeId(v.Id),
-							pb.NewServerAddressFromDataNode(dn), true, false); deleteErr != nil {
+							pb.NewServerAddressFromDataNode(dn), true, onlyGarbage, false); deleteErr != nil {
 							err = deleteErr
 						}
 						continue
@@ -89,9 +101,13 @@ func (c *commandVolumeDeleteEmpty) Do(args []string, commandEnv *CommandEnv, wri
 	return
 }
 
-func isEmptyVolumeDeleteCandidate(v *master_pb.VolumeInformationMessage, quietSeconds, nowUnixSeconds int64, collectionPattern string) bool {
-	return matchesVolumeCollectionPattern(collectionPattern, v.Collection) &&
-		v.Size <= super_block.SuperBlockSize &&
+func isEmptyVolumeDeleteCandidate(v *master_pb.VolumeInformationMessage, quietSeconds, nowUnixSeconds int64, collectionMatcher *wildcard.CollectionMatcher) bool {
+	return collectionMatcher.Matches(v.Collection) &&
+		// A remote-backed replica shares its cloud object with the others, so
+		// deleting one cannot drop it without hurting the survivors.
+		v.RemoteStorageName == "" &&
+		(!v.ReadOnly || v.ReadOnlyCanDelete) &&
+		(v.Size <= super_block.SuperBlockSize || v.FileCount > 0 && v.FileCount <= v.DeleteCount) &&
 		v.ModifiedAtSecond > 0 &&
 		v.ModifiedAtSecond+quietSeconds < nowUnixSeconds
 }
diff --git a/weed/shell/command_volume_delete_empty_test.go b/weed/shell/command_volume_delete_empty_test.go
index 7150244e4b..c831858d0e 100644
--- a/weed/shell/command_volume_delete_empty_test.go
+++ b/weed/shell/command_volume_delete_empty_test.go
@@ -4,38 +4,38 @@ import (
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+	"github.com/stretchr/testify/assert"
 )
 
-func TestIsEmptyVolumeDeleteCandidateCollectionPattern(t *testing.T) {
-	now := int64(1000)
-	quietSeconds := int64(100)
-	quietEmptyVolume := &master_pb.VolumeInformationMessage{
-		Size:             0,
-		ModifiedAtSecond: now - quietSeconds - 1,
-		Collection:       "important-logs",
-	}
+func TestIsEmptyVolumeDeleteCandidate(t *testing.T) {
+	matcher, err := wildcard.CompileCollectionMatcher("")
+	assert.NoError(t, err)
+
+	const quietSeconds = int64(60)
+	const now = int64(1_000_000)
+	old := now - quietSeconds - 1
 
 	tests := []struct {
-		name       string
-		pattern    string
-		collection string
-		want       bool
+		name string
+		v    *master_pb.VolumeInformationMessage
+		want bool
 	}{
-		{name: "empty pattern matches named collection", pattern: "", collection: "important-logs", want: true},
-		{name: "wildcard matches collection", pattern: "important*", collection: "important-logs", want: true},
-		{name: "wildcard rejects collection", pattern: "important*", collection: "other-logs", want: false},
-		{name: "default pattern matches empty collection", pattern: CollectionDefault, collection: "", want: true},
-		{name: "default pattern rejects named collection", pattern: CollectionDefault, collection: "important-logs", want: false},
+		{"small .dat is empty", &master_pb.VolumeInformationMessage{Size: super_block.SuperBlockSize, ModifiedAtSecond: old}, true},
+		{"all needles deleted is empty", &master_pb.VolumeInformationMessage{Size: 1 << 30, FileCount: 100, DeleteCount: 100, ModifiedAtSecond: old}, true},
+		{"live needles keep the volume", &master_pb.VolumeInformationMessage{Size: 1 << 30, FileCount: 100, DeleteCount: 99, ModifiedAtSecond: old}, false},
+		{"overwrites alone are not empty", &master_pb.VolumeInformationMessage{Size: 1 << 30, FileCount: 200, DeleteCount: 100, ModifiedAtSecond: old}, false},
+		{"recent all-deleted volume is kept", &master_pb.VolumeInformationMessage{Size: 1 << 30, FileCount: 100, DeleteCount: 100, ModifiedAtSecond: now}, false},
+		{"never written volume is kept", &master_pb.VolumeInformationMessage{Size: super_block.SuperBlockSize, ModifiedAtSecond: 0}, false},
+		{"remote-backed replica is kept", &master_pb.VolumeInformationMessage{Size: super_block.SuperBlockSize, RemoteStorageName: "s3", RemoteStorageKey: "v", ModifiedAtSecond: old}, false},
+		{"remote-backed garbage is kept", &master_pb.VolumeInformationMessage{Size: 1 << 30, FileCount: 100, DeleteCount: 100, RemoteStorageName: "s3", ModifiedAtSecond: old}, false},
+		{"protected read-only volume is kept", &master_pb.VolumeInformationMessage{Size: super_block.SuperBlockSize, ReadOnly: true, ModifiedAtSecond: old}, false},
+		{"deletable read-only volume can go", &master_pb.VolumeInformationMessage{Size: super_block.SuperBlockSize, ReadOnly: true, ReadOnlyCanDelete: true, ModifiedAtSecond: old}, true},
 	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			v := *quietEmptyVolume
-			v.Collection = tt.collection
-			if got := isEmptyVolumeDeleteCandidate(&v, quietSeconds, now, tt.pattern); got != tt.want {
-				t.Fatalf("isEmptyVolumeDeleteCandidate(collection=%q, pattern=%q) = %v, want %v",
-					tt.collection, tt.pattern, got, tt.want)
-			}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, isEmptyVolumeDeleteCandidate(tc.v, quietSeconds, now, matcher))
 		})
 	}
 }
diff --git a/weed/shell/command_volume_fix_replication.go b/weed/shell/command_volume_fix_replication.go
index 21e05d583a..7cb38fd3ba 100644
--- a/weed/shell/command_volume_fix_replication.go
+++ b/weed/shell/command_volume_fix_replication.go
@@ -29,7 +29,7 @@ func init() {
 }
 
 type commandVolumeFixReplication struct {
-	collectionPattern *string
+	collectionMatcher *wildcard.CollectionMatcher
 	// TODO: move parameter flags here so we don't shuffle them around via function calls.
 }
 
@@ -71,7 +71,7 @@ func (c *commandVolumeFixReplication) HasTag(tag CommandTag) bool {
 func (c *commandVolumeFixReplication) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
 
 	volFixReplicationCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
-	c.collectionPattern = volFixReplicationCommand.String("collectionPattern", "", "match with wildcard characters '*' and '?'")
+	collectionPattern := volFixReplicationCommand.String("collectionPattern", "", "comma-separated collection names, with '*' and '?' wildcards; empty matches all")
 	applyChanges := volFixReplicationCommand.Bool("apply", false, "apply the fix")
 	// TODO: remove this alias
 	applyChangesAlias := volFixReplicationCommand.Bool("force", false, "apply the fix (alias for -apply)")
@@ -87,6 +87,10 @@ func (c *commandVolumeFixReplication) Do(args []string, commandEnv *CommandEnv,
 		return nil
 	}
 
+	if c.collectionMatcher, err = wildcard.CompileCollectionMatcher(*collectionPattern); err != nil {
+		return err
+	}
+
 	handleDeprecatedForceFlag(writer, volFixReplicationCommand, applyChangesAlias, applyChanges)
 	infoAboutSimulationMode(writer, *applyChanges, "-apply")
 	commandEnv.noLock = !*applyChanges
@@ -127,7 +131,7 @@ func (c *commandVolumeFixReplication) Do(args []string, commandEnv *CommandEnv,
 			replica := replicas[0]
 
 			// Filter here so the termination counter matches what gets fixed; else -apply loops forever.
-			if !c.matchCollectionPattern(replica.info.Collection) {
+			if !c.collectionMatcher.Matches(replica.info.Collection) {
 				continue
 			}
 
@@ -330,18 +334,6 @@ func checkOneVolume(a *VolumeReplica, b *VolumeReplica, writer io.Writer, comman
 	return
 }
 
-// matchCollectionPattern reports whether collection matches -collectionPattern:
-// empty matches everything, CollectionDefault matches the unnamed collection.
-func (c *commandVolumeFixReplication) matchCollectionPattern(collection string) bool {
-	if *c.collectionPattern == "" {
-		return true
-	}
-	if *c.collectionPattern == CollectionDefault {
-		return collection == ""
-	}
-	return wildcard.MatchesWildcard(*c.collectionPattern, collection)
-}
-
 // deleteOneVolume trims one replica from each of the given volumes, and
 // reports how many replicas it actually deleted.
 func (c *commandVolumeFixReplication) deleteOneVolume(commandEnv *CommandEnv, writer io.Writer, applyChanges bool, doCheck bool, volumeIds []uint32, volumeReplicas map[uint32][]*VolumeReplica, selectOneVolumeFn SelectOneVolumeFunc) (deleted int, err error) {
@@ -398,7 +390,7 @@ func (c *commandVolumeFixReplication) deleteOneVolume(commandEnv *CommandEnv, wr
 		// Surplus replica being trimmed; keep the remote object since other
 		// replicas of the same .vif still reference it.
 		if err := deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, needle.VolumeId(replica.info.Id),
-			pb.NewServerAddressFromDataNode(replica.location.dataNode), false, true); err != nil {
+			pb.NewServerAddressFromDataNode(replica.location.dataNode), false, false, true); err != nil {
 			fmt.Fprintf(writer, "deleting volume %d from %s : %v", replica.info.Id, replica.location.dataNode.Id, err)
 		} else {
 			deleted++
@@ -542,7 +534,7 @@ func (c *commandVolumeFixReplication) fixOneUnderReplicatedVolume(commandEnv *Co
 	err := replicateVolumeToServer(context.Background(), commandEnv.option.GrpcDialOption, writer, needle.VolumeId(replica.info.Id),
 		pb.NewServerAddressFromDataNode(replica.location.dataNode),
 		pb.NewServerAddressFromDataNode(dst.dataNode),
-		replica.info.DiskType)
+		replica.info.DiskType, 0)
 	scheduler.releaseTarget(dst, replica.info.DiskType, err == nil)
 	if err != nil {
 		return false, err
diff --git a/weed/shell/command_volume_fix_replication_collection_test.go b/weed/shell/command_volume_fix_replication_collection_test.go
index c304a9e57f..23dc9effe4 100644
--- a/weed/shell/command_volume_fix_replication_collection_test.go
+++ b/weed/shell/command_volume_fix_replication_collection_test.go
@@ -1,8 +1,12 @@
 package shell
 
-import "testing"
+import (
+	"testing"
 
-func TestMatchCollectionPattern(t *testing.T) {
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+)
+
+func TestFixReplicationCollectionPattern(t *testing.T) {
 	tests := []struct {
 		name       string
 		pattern    string
@@ -19,14 +23,19 @@ func TestMatchCollectionPattern(t *testing.T) {
 		{name: "prefix wildcard mismatch", pattern: "smart*", collection: "jfs-hdfs-test", expected: false},
 		{name: "single char wildcard match", pattern: "vol?", collection: "vol1", expected: true},
 		{name: "single char wildcard mismatch", pattern: "vol?", collection: "vol42", expected: false},
+		{name: "list matches a listed collection", pattern: "smart-highlevel-test,jfs-hdfs-test", collection: "jfs-hdfs-test", expected: true},
+		{name: "list rejects an unlisted collection", pattern: "smart-highlevel-test,jfs-hdfs-test", collection: "other", expected: false},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			pattern := tt.pattern
-			c := &commandVolumeFixReplication{collectionPattern: &pattern}
-			if got := c.matchCollectionPattern(tt.collection); got != tt.expected {
-				t.Errorf("matchCollectionPattern(pattern=%q, collection=%q) = %v, want %v",
+			matcher, err := wildcard.CompileCollectionMatcher(tt.pattern)
+			if err != nil {
+				t.Fatalf("CompileCollectionMatcher(%q): %v", tt.pattern, err)
+			}
+			c := &commandVolumeFixReplication{collectionMatcher: matcher}
+			if got := c.collectionMatcher.Matches(tt.collection); got != tt.expected {
+				t.Errorf("collection pattern %q against collection %q = %v, want %v",
 					tt.pattern, tt.collection, got, tt.expected)
 			}
 		})
diff --git a/weed/shell/command_volume_fix_replication_parallel_test.go b/weed/shell/command_volume_fix_replication_parallel_test.go
index 4eeaaf7fc0..7b5ec239ce 100644
--- a/weed/shell/command_volume_fix_replication_parallel_test.go
+++ b/weed/shell/command_volume_fix_replication_parallel_test.go
@@ -120,7 +120,7 @@ func TestFixUnderReplicatedVolumesInParallel(t *testing.T) {
 		volumeIds = append(volumeIds, vid)
 	}
 
-	c := &commandVolumeFixReplication{collectionPattern: new(string)}
+	c := &commandVolumeFixReplication{}
 	fixedVolumes, err := c.fixUnderReplicatedVolumes(nil, io.Discard, false, volumeIds, volumeReplicas, allLocations, 0, 0, 8, 1)
 	if err != nil {
 		t.Fatalf("fixUnderReplicatedVolumes: %v", err)
diff --git a/weed/shell/command_volume_fsck.go b/weed/shell/command_volume_fsck.go
index eb75e30c9f..ef6b61bfab 100644
--- a/weed/shell/command_volume_fsck.go
+++ b/weed/shell/command_volume_fsck.go
@@ -34,6 +34,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	util_http "github.com/seaweedfs/seaweedfs/weed/util/http"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -44,6 +45,10 @@ func init() {
 const (
 	readbufferSize                 = 16
 	jwtFilerTokenExpirationSeconds = 300
+	// mtime is only second resolution, so a directory touched this recently is
+	// left for the next run rather than compared against a timestamp a
+	// concurrent write could share
+	directoryQuietPeriod = 5 * time.Second
 )
 
 type commandVolumeFsck struct {
@@ -51,16 +56,21 @@ type commandVolumeFsck struct {
 	writer                    io.Writer
 	bucketsPath               string
 	collection                *string
+	collectionMatcher         *wildcard.CollectionMatcher
+	knownVolumeIds            map[uint32]bool
 	volumeIds                 map[uint32]bool
 	scopedFilerPath           string
 	tempFolder                string
 	verbose                   *bool
 	forcePurging              *bool
+	purgeConcurrency          *int
 	skipEcVolumes             *bool
 	findMissingChunksInFiler  *bool
 	verifyNeedle              *bool
 	filerSigningKey           string
 	unresolvedManifestEntries atomic.Int64
+	purgedDirsLock            sync.Mutex
+	purgedDirs                map[util.FullPath]struct{}
 }
 
 func (c *commandVolumeFsck) Name() string {
@@ -90,6 +100,12 @@ func (c *commandVolumeFsck) Help() string {
 		A newly uploaded chunk may appear as orphan if metadata commit is still pending.
 		The default 5h cutoff provides sufficient buffer for metadata commits.
 
+	Step 2 reads the filer from one consistent snapshot when its store supports
+	that (the SQL stores do), so a file renamed while the filer is being read is
+	still counted and its chunks are not mistaken for orphans. Other stores are
+	walked directory by directory; there, avoid running with -reallyDeleteFromVolume
+	while files are being renamed or moved.
+
 `
 }
 
@@ -103,11 +119,12 @@ func (c *commandVolumeFsck) Do(args []string, commandEnv *CommandEnv, writer io.
 	c.verbose = fsckCommand.Bool("v", false, "verbose mode")
 	c.skipEcVolumes = fsckCommand.Bool("skipEcVolumes", false, "skip erasure coded volumes")
 	c.findMissingChunksInFiler = fsckCommand.Bool("findMissingChunksInFiler", false, "see \"help volume.fsck\"")
-	c.collection = fsckCommand.String("collection", "", "the collection name")
+	c.collection = fsckCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; empty or \"*\" matches all, \""+CollectionDefault+"\" the collection with no name")
 	volumeIds := fsckCommand.String("volumeId", "", "comma separated the volume id")
 	applyPurging := fsckCommand.Bool("reallyDeleteFromVolume", false, "<expert only!> after detection, delete missing data from volumes / delete missing file entries from filer. Currently this only works with default filerGroup.")
 	c.forcePurging = fsckCommand.Bool("forcePurging", false, "delete missing data from volumes in one replica used together with applyPurging")
 	purgeAbsent := fsckCommand.Bool("reallyDeleteFilerEntries", false, "<expert only!> delete missing file entries from filer if the corresponding volume is missing for any reason, please ensure all still existing/expected volumes are connected! used together with findMissingChunksInFiler")
+	c.purgeConcurrency = fsckCommand.Int("purgeConcurrency", 16, "parallel filer deletes for -reallyDeleteFilerEntries")
 	tempPath := fsckCommand.String("tempPath", path.Join(os.TempDir()), "path for temporary idx files")
 	cutoffTimeAgo := fsckCommand.Duration("cutoffTimeAgo", 5*time.Hour, "only include entries on volume servers before this cutoff time to check orphan chunks")
 	modifyTimeAgo := fsckCommand.Duration("modifyTimeAgo", 0, "only include entries after this modify time to check orphan chunks")
@@ -122,6 +139,7 @@ func (c *commandVolumeFsck) Do(args []string, commandEnv *CommandEnv, writer io.
 	// unresolved-manifest counter so a previous failed run can't permanently
 	// suppress -reallyDeleteFromVolume in this session.
 	c.unresolvedManifestEntries.Store(0)
+	c.purgedDirs = make(map[util.FullPath]struct{})
 
 	if err = commandEnv.confirmIsLocked(args); err != nil {
 		return
@@ -138,7 +156,11 @@ func (c *commandVolumeFsck) Do(args []string, commandEnv *CommandEnv, writer io.
 		}
 	}
 	c.env = commandEnv
-	c.writer = writer
+	c.writer = &lockedWriter{w: writer}
+
+	if c.collectionMatcher, err = wildcard.CompileCollectionMatcher(*c.collection); err != nil {
+		return fmt.Errorf("invalid collection pattern %q: %w", *c.collection, err)
+	}
 
 	c.bucketsPath, err = readFilerBucketsPath(commandEnv)
 	if err != nil {
@@ -163,6 +185,16 @@ func (c *commandVolumeFsck) Do(args []string, commandEnv *CommandEnv, writer io.
 		return fmt.Errorf("failed to collect all volume locations: %w", err)
 	}
 
+	// Every volume the master knows about, before any filtering: a filer
+	// entry pointing at a volume that was filtered out of this run is
+	// excluded, not missing — it must never be reported or purged.
+	c.knownVolumeIds = make(map[uint32]bool)
+	for _, vidMap := range dataNodeVolumeIdToVInfo {
+		for vid := range vidMap {
+			c.knownVolumeIds[vid] = true
+		}
+	}
+
 	// If the operator specified -volumeId, reject unknown ids up front instead
 	// of silently filtering them out and reporting "no orphan data". A silent
 	// success on a missing volume looks identical to a clean volume and hides
@@ -215,7 +247,7 @@ func (c *commandVolumeFsck) Do(args []string, commandEnv *CommandEnv, writer io.
 						continue
 					}
 				}
-				if *c.collection != "" && vinfo.collection != *c.collection {
+				if !c.collectionMatcher.Matches(vinfo.collection) {
 					delete(volumeIdToVInfo, volumeId)
 					continue
 				}
@@ -239,18 +271,33 @@ func (c *commandVolumeFsck) Do(args []string, commandEnv *CommandEnv, writer io.
 	if *c.findMissingChunksInFiler {
 		// collect all filer file ids and paths
 
-		if err = c.collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo, *purgeAbsent, collectModifyFromAtNs, collectCutoffFromAtNs); err != nil {
-			return fmt.Errorf("collectFilerFileIdAndPaths: %w", err)
+		var queuePurge func(purgeItem)
+		var finishPurge func()
+		if *applyPurging || *purgeAbsent {
+			queuePurge, finishPurge = startPurgeWorkers(*c.purgeConcurrency, c.httpDelete)
 		}
-		for dataNodeId, volumeIdToVInfo := range dataNodeVolumeIdToVInfo {
-			// for each volume, check filer file ids
-			if err = c.findFilerChunksMissingInVolumeServers(volumeIdToVInfo, dataNodeId, *applyPurging || *purgeAbsent); err != nil {
-				return fmt.Errorf("findFilerChunksMissingInVolumeServers: %w", err)
+		err = func() error {
+			if err := c.collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo, *purgeAbsent, queuePurge, collectModifyFromAtNs, collectCutoffFromAtNs); err != nil {
+				return fmt.Errorf("collectFilerFileIdAndPaths: %w", err)
 			}
+			for dataNodeId, volumeIdToVInfo := range dataNodeVolumeIdToVInfo {
+				// for each volume, check filer file ids
+				if err := c.findFilerChunksMissingInVolumeServers(volumeIdToVInfo, dataNodeId, queuePurge); err != nil {
+					return fmt.Errorf("findFilerChunksMissingInVolumeServers: %w", err)
+				}
+			}
+			return nil
+		}()
+		if finishPurge != nil {
+			finishPurge()
 		}
+		if err != nil {
+			return err
+		}
+		c.purgeEmptyDirectories()
 	} else {
 		// collect all filer file ids
-		if err = c.collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo, false, 0, 0); err != nil {
+		if err = c.collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo, false, nil, 0, 0); err != nil {
 			return fmt.Errorf("failed to collect file ids from filer: %w", err)
 		}
 		// If any entry's manifest could not be resolved, our in-use fid set
@@ -273,7 +320,7 @@ func (c *commandVolumeFsck) Do(args []string, commandEnv *CommandEnv, writer io.
 	return nil
 }
 
-func (c *commandVolumeFsck) collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo map[string]map[uint32]VInfo, purgeAbsent bool, collectModifyFromAtNs int64, cutoffFromAtNs int64) error {
+func (c *commandVolumeFsck) collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo map[string]map[uint32]VInfo, purgeAbsent bool, queuePurge func(purgeItem), collectModifyFromAtNs int64, cutoffFromAtNs int64) error {
 	if *c.verbose {
 		fmt.Fprintf(c.writer, "checking each file from filer path %s...\n", c.getCollectFilerFilePath())
 	}
@@ -297,12 +344,12 @@ func (c *commandVolumeFsck) collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo m
 		}
 	}()
 
-	return doTraverseBfsAndSaving(c.env, c.writer, c.getCollectFilerFilePath(), false, false,
+	return doTraverseAndSaving(c.env, c.writer, c.getCollectFilerFilePath(), false, false,
 		func(ctx context.Context, entry *filer_pb.FullEntry, outputChan chan interface{}) (err error) {
 			if *c.verbose && entry.Entry.IsDirectory {
 				fmt.Fprintf(c.writer, "checking directory %s\n", util.NewFullPath(entry.Dir, entry.Entry.Name))
 			}
-			dataChunks, manifestChunks, resolveErr := filer.ResolveChunkManifest(ctx, filer.LookupFn(c.env), entry.Entry.GetChunks(), 0, math.MaxInt64)
+			dataChunks, manifestChunks, resolveErr := filer.ResolveChunkManifest(ctx, filer.LookupFn(c.env), entry.Entry.GetChunks(), 0, math.MaxInt64, nil)
 			if resolveErr != nil {
 				// Cancellation/deadline isn't manifest corruption; surface it
 				// so the BFS bails out cleanly without polluting the
@@ -335,10 +382,11 @@ func (c *commandVolumeFsck) collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo m
 				}
 				select {
 				case outputChan <- &Item{
-					vid:     chunk.Fid.VolumeId,
-					fileKey: chunk.Fid.FileKey,
-					cookie:  chunk.Fid.Cookie,
-					path:    util.NewFullPath(entry.Dir, entry.Entry.Name),
+					vid:        chunk.Fid.VolumeId,
+					fileKey:    chunk.Fid.FileKey,
+					cookie:     chunk.Fid.Cookie,
+					path:       util.NewFullPath(entry.Dir, entry.Entry.Name),
+					hardLinkId: entry.Entry.GetHardLinkId(),
 				}:
 				case <-ctx.Done():
 					return ctx.Err()
@@ -360,6 +408,13 @@ func (c *commandVolumeFsck) collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo m
 					if _, err := f.Write([]byte(i.path)); err != nil {
 						return err
 					}
+					util.Uint32toBytes(buffer[:4], uint32(len(i.hardLinkId)))
+					if _, err := f.Write(buffer[:4]); err != nil {
+						return err
+					}
+					if _, err := f.Write(i.hardLinkId); err != nil {
+						return err
+					}
 				} else if *c.findMissingChunksInFiler {
 					// check if the volume matches the filter
 					if len(c.volumeIds) > 0 {
@@ -367,10 +422,15 @@ func (c *commandVolumeFsck) collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo m
 							continue
 						}
 					}
+					// A volume the master knows but this run filtered out is not a
+					// missing volume: its files are healthy and stay untouched.
+					if c.knownVolumeIds[i.vid] {
+						continue
+					}
 					fmt.Fprintf(c.writer, "%d,%x%08x %s volume not found\n", i.vid, i.fileKey, i.cookie, i.path)
 					if purgeAbsent {
 						fmt.Fprintf(c.writer, "deleting path %s after volume not found\n", i.path)
-						c.httpDelete(i.path)
+						queuePurge(purgeItem{path: i.path, hardLinkId: i.hardLinkId})
 					}
 				}
 			}
@@ -378,10 +438,10 @@ func (c *commandVolumeFsck) collectFilerFileIdAndPaths(dataNodeVolumeIdToVInfo m
 		})
 }
 
-func (c *commandVolumeFsck) findFilerChunksMissingInVolumeServers(volumeIdToVInfo map[uint32]VInfo, dataNodeId string, applyPurging bool) error {
+func (c *commandVolumeFsck) findFilerChunksMissingInVolumeServers(volumeIdToVInfo map[uint32]VInfo, dataNodeId string, queuePurge func(purgeItem)) error {
 
 	for volumeId, vinfo := range volumeIdToVInfo {
-		checkErr := c.oneVolumeFileIdsCheckOneVolume(dataNodeId, volumeId, applyPurging)
+		checkErr := c.oneVolumeFileIdsCheckOneVolume(dataNodeId, volumeId, queuePurge)
 		if checkErr != nil {
 			return fmt.Errorf("failed to collect file ids from volume %d on %s: %v", volumeId, vinfo.server, checkErr)
 		}
@@ -585,13 +645,27 @@ func (c *commandVolumeFsck) collectOneVolumeFileIds(dataNodeId string, volumeId
 }
 
 type Item struct {
-	vid     uint32
-	fileKey uint64
-	cookie  uint32
-	path    util.FullPath
+	vid        uint32
+	fileKey    uint64
+	cookie     uint32
+	path       util.FullPath
+	hardLinkId []byte
 }
 
-func (c *commandVolumeFsck) readFilerFileIdFile(volumeId uint32, fn func(needleId types.NeedleId, itemPath util.FullPath)) error {
+// lockedWriter serializes concurrent writers — the traversal, the consumer,
+// and the purge workers all log through c.writer at the same time.
+type lockedWriter struct {
+	mu sync.Mutex
+	w  io.Writer
+}
+
+func (lw *lockedWriter) Write(p []byte) (int, error) {
+	lw.mu.Lock()
+	defer lw.mu.Unlock()
+	return lw.w.Write(p)
+}
+
+func (c *commandVolumeFsck) readFilerFileIdFile(volumeId uint32, fn func(needleId types.NeedleId, itemPath util.FullPath, hardLinkId []byte)) error {
 	fp, err := os.Open(getFilerFileIdFile(c.tempFolder, volumeId))
 	if err != nil {
 		return err
@@ -626,13 +700,23 @@ func (c *commandVolumeFsck) readFilerFileIdFile(volumeId uint32, fn func(needleI
 			return fmt.Errorf("read fid path size mismatch for volume %d,%x%08x: got %d want %d", volumeId, item.fileKey, item.cookie, n, pathSize)
 		}
 		item.path = util.FullPath(pathBytes)
+		item.hardLinkId = nil
+		if _, err := io.ReadFull(br, buffer[:4]); err != nil {
+			return fmt.Errorf("read fid hard link id size for volume %d,%x%08x: %w", volumeId, item.fileKey, item.cookie, err)
+		}
+		if hardLinkIdSize := util.BytesToUint32(buffer[:4]); hardLinkIdSize > 0 {
+			item.hardLinkId = make([]byte, int(hardLinkIdSize))
+			if _, err := io.ReadFull(br, item.hardLinkId); err != nil {
+				return fmt.Errorf("read fid hard link id for volume %d,%x%08x: %w", volumeId, item.fileKey, item.cookie, err)
+			}
+		}
 		needleId := types.NeedleId(item.fileKey)
-		fn(needleId, item.path)
+		fn(needleId, item.path, item.hardLinkId)
 	}
 	return nil
 }
 
-func (c *commandVolumeFsck) oneVolumeFileIdsCheckOneVolume(dataNodeId string, volumeId uint32, applyPurging bool) (err error) {
+func (c *commandVolumeFsck) oneVolumeFileIdsCheckOneVolume(dataNodeId string, volumeId uint32, queuePurge func(purgeItem)) (err error) {
 	if *c.verbose {
 		fmt.Fprintf(c.writer, "find missing file chunks in dataNodeId %s volume %d ...\n", dataNodeId, volumeId)
 	}
@@ -643,11 +727,11 @@ func (c *commandVolumeFsck) oneVolumeFileIdsCheckOneVolume(dataNodeId string, vo
 	if err = db.LoadFromIdx(getVolumeFileIdFile(c.tempFolder, dataNodeId, volumeId)); err != nil {
 		return
 	}
-	if err = c.readFilerFileIdFile(volumeId, func(needleId types.NeedleId, itemPath util.FullPath) {
+	if err = c.readFilerFileIdFile(volumeId, func(needleId types.NeedleId, itemPath util.FullPath, hardLinkId []byte) {
 		if _, found := db.Get(needleId); !found {
 			fmt.Fprintf(c.writer, "%s\n", itemPath)
-			if applyPurging {
-				c.httpDelete(itemPath)
+			if queuePurge != nil {
+				queuePurge(purgeItem{path: itemPath, hardLinkId: hardLinkId})
 			}
 		}
 	}); err != nil {
@@ -656,6 +740,47 @@ func (c *commandVolumeFsck) oneVolumeFileIdsCheckOneVolume(dataNodeId string, vo
 	return nil
 }
 
+type purgeItem struct {
+	path       util.FullPath
+	hardLinkId []byte
+}
+
+// startPurgeWorkers fans deletes across at least one worker and returns a
+// queue function plus a finish function that closes the channels and waits
+// for in-flight deletes. Paths that share a hard link id always land on the
+// same worker, so their shared hard-link counter updates stay serialized —
+// concurrent deletes of the same id could both read count N and write N-1,
+// leaving the shared record behind after every path is gone.
+func startPurgeWorkers(workers int, deleteFn func(util.FullPath)) (queue func(purgeItem), finish func()) {
+	if workers < 1 {
+		workers = 1
+	}
+	chans := make([]chan purgeItem, workers)
+	var wg sync.WaitGroup
+	for w := range chans {
+		chans[w] = make(chan purgeItem, 128)
+		wg.Add(1)
+		go func(ch <-chan purgeItem) {
+			defer wg.Done()
+			for it := range ch {
+				deleteFn(it.path)
+			}
+		}(chans[w])
+	}
+	return func(it purgeItem) {
+			key := []byte(it.path)
+			if len(it.hardLinkId) > 0 {
+				key = it.hardLinkId
+			}
+			chans[int(uint32(util.HashToInt32(key))%uint32(workers))] <- it
+		}, func() {
+			for _, ch := range chans {
+				close(ch)
+			}
+			wg.Wait()
+		}
+}
+
 func (c *commandVolumeFsck) httpDelete(path util.FullPath) {
 	req, err := http.NewRequest(http.MethodDelete, "", nil)
 	if err != nil {
@@ -665,7 +790,7 @@ func (c *commandVolumeFsck) httpDelete(path util.FullPath) {
 
 	req.URL = &url.URL{
 		Scheme: "http",
-		Host:   c.env.option.FilerAddress.ToHttpAddress(),
+		Host:   c.env.FilerAddress().ToHttpAddress(),
 		Path:   string(path),
 	}
 
@@ -694,6 +819,89 @@ func (c *commandVolumeFsck) httpDelete(path util.FullPath) {
 		fmt.Fprintln(c.writer, "delete response Status : ", resp.Status)
 		fmt.Fprintln(c.writer, "delete response Headers : ", resp.Header)
 	}
+
+	if resp.StatusCode < http.StatusBadRequest {
+		dir, _ := path.DirAndName()
+		c.purgedDirsLock.Lock()
+		c.purgedDirs[util.FullPath(dir)] = struct{}{}
+		c.purgedDirsLock.Unlock()
+	}
+}
+
+// purgeEmptyDirectories removes the directories emptied by the purged entries, walking up while each parent is empty too.
+func (c *commandVolumeFsck) purgeEmptyDirectories() {
+	candidates := make(map[util.FullPath]struct{})
+	c.purgedDirsLock.Lock()
+	for dir := range c.purgedDirs {
+		for d := dir; c.canPurgeDirectory(d); {
+			candidates[d] = struct{}{}
+			parent, _ := d.DirAndName()
+			d = util.FullPath(parent)
+		}
+	}
+	c.purgedDirsLock.Unlock()
+
+	dirs := make([]util.FullPath, 0, len(candidates))
+	for dir := range candidates {
+		dirs = append(dirs, dir)
+	}
+	// deepest first, so a directory is only tried once its children are gone
+	sort.Slice(dirs, func(i, j int) bool { return len(dirs[i]) > len(dirs[j]) })
+
+	for _, dir := range dirs {
+		entry, _, _, lookupErr := filer_pb.GetEntry(context.Background(), c.env, dir)
+		if lookupErr != nil && !errors.Is(lookupErr, filer_pb.ErrNotFound) {
+			fmt.Fprintf(c.writer, "lookup directory %s: %v\n", dir, lookupErr)
+			continue
+		}
+		// a directory key object is an S3 object of its own
+		if entry == nil || entry.IsDirectoryKeyObject() {
+			continue
+		}
+		// a zero mtime turns the delete's condition off, leaving nothing to hold it to
+		mtime := entry.Attributes.GetMtime()
+		if mtime <= 0 || mtime >= time.Now().Add(-directoryQuietPeriod).Unix() {
+			continue
+		}
+		if err := c.deleteEmptyDirectory(dir, mtime); err != nil {
+			if !errors.Is(err, filer.ErrNonEmptyFolder) {
+				fmt.Fprintf(c.writer, "delete empty directory %s: %v\n", dir, err)
+			}
+			continue
+		}
+		fmt.Fprintf(c.writer, "deleted empty directory %s\n", dir)
+	}
+}
+
+// deleteEmptyDirectory deletes dir unless it changed since it was looked up at mtime,
+// so a directory promoted to an S3 object meanwhile survives. The delete is not
+// recursive, leaving the filer to reject a directory that is not empty.
+func (c *commandVolumeFsck) deleteEmptyDirectory(dir util.FullPath, mtime int64) error {
+	parent, name := dir.DirAndName()
+	return c.env.WithFilerClient(false, func(client filer_pb.SeaweedFilerClient) error {
+		resp, err := client.DeleteEntry(context.Background(), &filer_pb.DeleteEntryRequest{
+			Directory:          parent,
+			Name:               name,
+			IfNotModifiedAfter: mtime,
+		})
+		if err != nil {
+			return err
+		}
+		if resp.Error != "" {
+			return filer.DeleteEntryError(resp.Error)
+		}
+		return nil
+	})
+}
+
+func (c *commandVolumeFsck) canPurgeDirectory(dir util.FullPath) bool {
+	root := c.getCollectFilerFilePath()
+	if string(dir) == root || !strings.HasPrefix(string(dir), strings.TrimSuffix(root, "/")+"/") {
+		return false
+	}
+	// deleting a bucket drops its whole collection
+	parent, _ := dir.DirAndName()
+	return string(dir) != c.bucketsPath && parent != c.bucketsPath
 }
 
 func (c *commandVolumeFsck) oneVolumeFileIdsSubtractFilerFileIds(dataNodeId string, volumeId uint32, vinfo *VInfo, modifyFrom, cutoffFrom uint64) (inUseCount uint64, orphanFileIds []string, orphanDataSize uint64, err error) {
@@ -706,7 +914,7 @@ func (c *commandVolumeFsck) oneVolumeFileIdsSubtractFilerFileIds(dataNodeId stri
 		return
 	}
 
-	if err = c.readFilerFileIdFile(volumeId, func(filerNeedleId types.NeedleId, itemPath util.FullPath) {
+	if err = c.readFilerFileIdFile(volumeId, func(filerNeedleId types.NeedleId, itemPath util.FullPath, _ []byte) {
 		inUseCount++
 		if *c.verifyNeedle && !vinfo.isEcVolume {
 			if needleValue, ok := volumeFileIdDb.Get(filerNeedleId); ok && !needleValue.Size.IsDeleted() {
@@ -848,7 +1056,7 @@ func (c *commandVolumeFsck) purgeFileIdsForOneVolume(volumeId uint32, fileIds []
 		go func(server pb.ServerAddress, fidList []string) {
 			defer wg.Done()
 
-			deleteResults := operation.DeleteFileIdsAtOneVolumeServer(server, c.env.option.GrpcDialOption, fidList, false)
+			deleteResults := operation.DeleteFileIdsAtOneVolumeServer(context.Background(), server, c.env.option.GrpcDialOption, fidList, false)
 			if deleteResults != nil {
 				resultChan <- deleteResults
 			}
@@ -875,7 +1083,11 @@ func (c *commandVolumeFsck) getCollectFilerFilePath() string {
 
 func (c *commandVolumeFsck) resolveScopedFilerPath(dataNodeVolumeIdToVInfo map[string]map[uint32]VInfo) string {
 	if *c.collection != "" {
-		return fmt.Sprintf("%s/%s", c.bucketsPath, *c.collection)
+		// fs.configure can bind a collection to any path prefix, so files
+		// referencing the filtered volumes may live anywhere. A bucket-dir
+		// walk could miss them and report their live chunks as orphans;
+		// only a full walk is safe for a collection filter.
+		return "/"
 	}
 	if len(c.volumeIds) == 0 {
 		return "/"
diff --git a/weed/shell/command_volume_fsck_test.go b/weed/shell/command_volume_fsck_test.go
new file mode 100644
index 0000000000..7804b85224
--- /dev/null
+++ b/weed/shell/command_volume_fsck_test.go
@@ -0,0 +1,422 @@
+package shell
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"sort"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/filer"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle_map"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func TestVolumeFsckCanPurgeDirectory(t *testing.T) {
+	testCases := []struct {
+		scopedFilerPath string
+		dir             util.FullPath
+		expected        bool
+	}{
+		{"/", "/orphan/dir/deep", true},
+		{"/", "/orphan", true},
+		{"/", "/", false},
+		{"/", "/buckets", false},
+		{"/", "/buckets/bucket1", false},
+		{"/", "/buckets/bucket1/dir", true},
+		{"/buckets/bucket1", "/buckets/bucket1", false},
+		{"/buckets/bucket1", "/buckets/bucket1/dir", true},
+		{"/buckets/bucket1", "/buckets/bucket11/dir", false},
+		{"/buckets/bucket1", "/orphan/dir", false},
+	}
+	for _, tc := range testCases {
+		c := &commandVolumeFsck{bucketsPath: "/buckets", scopedFilerPath: tc.scopedFilerPath}
+		if actual := c.canPurgeDirectory(tc.dir); actual != tc.expected {
+			t.Errorf("scope %s: canPurgeDirectory(%s) = %v, expected %v", tc.scopedFilerPath, tc.dir, actual, tc.expected)
+		}
+	}
+}
+
+func TestVolumeFsckHttpDeleteRecordsParentDirectory(t *testing.T) {
+	filer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasPrefix(r.URL.Path, "/locked/") {
+			w.WriteHeader(http.StatusForbidden)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	defer filer.Close()
+
+	verbose := false
+	c := &commandVolumeFsck{
+		verbose:    &verbose,
+		writer:     io.Discard,
+		purgedDirs: make(map[util.FullPath]struct{}),
+		env:        &CommandEnv{option: &ShellOptions{FilerAddress: pb.ServerAddress(strings.TrimPrefix(filer.URL, "http://"))}},
+	}
+
+	c.httpDelete("/orphan/dir/deep/file.txt")
+	c.httpDelete("/locked/dir/file.txt")
+
+	if _, found := c.purgedDirs["/orphan/dir/deep"]; !found {
+		t.Errorf("expected /orphan/dir/deep to be recorded, got %v", c.purgedDirs)
+	}
+	if _, found := c.purgedDirs["/locked/dir"]; found {
+		t.Errorf("expected a rejected delete not to be recorded, got %v", c.purgedDirs)
+	}
+}
+
+// stubFilerServer keeps a flat set of full paths and enforces the same delete
+// rules as the filer: a directory with children is kept, and so is one modified
+// after the caller looked it up. A path in writtenAfterLookup is modified by a
+// client right after fsck reads it.
+type stubFilerServer struct {
+	filer_pb.UnimplementedSeaweedFilerServer
+	entries            map[string]*filer_pb.Entry
+	writtenAfterLookup map[string]bool
+	deleted            []string
+}
+
+func (s *stubFilerServer) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	fullPath := string(util.NewFullPath(req.Directory, req.Name))
+	entry := s.entries[fullPath]
+	if entry != nil && s.writtenAfterLookup[fullPath] {
+		seen := &filer_pb.Entry{IsDirectory: entry.IsDirectory, Attributes: &filer_pb.FuseAttributes{Mtime: entry.Attributes.GetMtime()}}
+		entry.Attributes.Mtime++
+		return &filer_pb.LookupDirectoryEntryResponse{Entry: seen}, nil
+	}
+	return &filer_pb.LookupDirectoryEntryResponse{Entry: entry}, nil
+}
+
+func (s *stubFilerServer) DeleteEntry(ctx context.Context, req *filer_pb.DeleteEntryRequest) (*filer_pb.DeleteEntryResponse, error) {
+	fullPath := string(util.NewFullPath(req.Directory, req.Name))
+	entry, found := s.entries[fullPath]
+	if !found {
+		return &filer_pb.DeleteEntryResponse{Error: filer_pb.ErrNotFound.Error()}, nil
+	}
+	if req.IfNotModifiedAfter > 0 && entry.Attributes.GetMtime() > req.IfNotModifiedAfter {
+		return &filer_pb.DeleteEntryResponse{}, nil
+	}
+	for path := range s.entries {
+		if strings.HasPrefix(path, fullPath+"/") {
+			return &filer_pb.DeleteEntryResponse{Error: filer.MsgFailDelNonEmptyFolder + ": " + fullPath}, nil
+		}
+	}
+	delete(s.entries, fullPath)
+	s.deleted = append(s.deleted, fullPath)
+	return &filer_pb.DeleteEntryResponse{}, nil
+}
+
+// startStubFiler serves stub on a random localhost port and returns the shell
+// environment whose filer client reaches it.
+func startStubFiler(t *testing.T, stub *stubFilerServer) *CommandEnv {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := grpc.NewServer()
+	filer_pb.RegisterSeaweedFilerServer(srv, stub)
+	go srv.Serve(lis)
+	t.Cleanup(srv.Stop)
+	return &CommandEnv{option: &ShellOptions{
+		FilerAddress:   pb.ServerAddress(fmt.Sprintf("127.0.0.1:1.%d", lis.Addr().(*net.TCPAddr).Port)),
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}}
+}
+
+func TestVolumeFsckPurgeEmptyDirectories(t *testing.T) {
+	settled := &filer_pb.FuseAttributes{Mtime: time.Now().Add(-time.Hour).Unix()}
+	directory := &filer_pb.Entry{IsDirectory: true, Attributes: settled}
+	stub := &stubFilerServer{entries: map[string]*filer_pb.Entry{
+		"/orphan":                 directory,
+		"/orphan/dir":             directory,
+		"/orphan/dir/deep":        directory,
+		"/orphan/dir/wide":        directory,
+		"/keep":                   directory,
+		"/keep/file.txt":          {},
+		"/buckets":                directory,
+		"/buckets/bucket1":        directory,
+		"/buckets/bucket1/folder": {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mime: "application/octet-stream", Mtime: settled.Mtime}},
+		// no mtime to condition a delete on, so it stays
+		"/nomtime":     {IsDirectory: true},
+		"/nomtime/dir": {IsDirectory: true},
+	}}
+
+	verbose := false
+	c := &commandVolumeFsck{
+		verbose:         &verbose,
+		writer:          io.Discard,
+		bucketsPath:     "/buckets",
+		scopedFilerPath: "/",
+		purgedDirs: map[util.FullPath]struct{}{
+			"/orphan/dir/deep":        {},
+			"/orphan/dir/wide":        {},
+			"/keep":                   {},
+			"/buckets/bucket1/folder": {},
+			"/nomtime/dir":            {},
+		},
+		env: startStubFiler(t, stub),
+	}
+
+	c.purgeEmptyDirectories()
+
+	// the two emptied leaves, then the parent they shared, then its own parent
+	expected := []string{"/orphan/dir/deep", "/orphan/dir/wide", "/orphan/dir", "/orphan"}
+	sort.Strings(expected)
+	sort.Strings(stub.deleted)
+	if strings.Join(stub.deleted, ",") != strings.Join(expected, ",") {
+		t.Errorf("deleted %v, expected %v", stub.deleted, expected)
+	}
+}
+
+func TestVolumeFsckPurgeEmptyDirectoriesKeepsFreshDirectory(t *testing.T) {
+	stub := &stubFilerServer{entries: map[string]*filer_pb.Entry{
+		"/fresh":     {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()}},
+		"/fresh/dir": {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()}},
+	}}
+
+	verbose := false
+	c := &commandVolumeFsck{
+		verbose:         &verbose,
+		writer:          io.Discard,
+		bucketsPath:     "/buckets",
+		scopedFilerPath: "/",
+		purgedDirs:      map[util.FullPath]struct{}{"/fresh/dir": {}},
+		env:             startStubFiler(t, stub),
+	}
+
+	c.purgeEmptyDirectories()
+
+	if len(stub.deleted) > 0 {
+		t.Errorf("deleted %v, expected a directory modified within the quiet period to be kept", stub.deleted)
+	}
+}
+
+func TestVolumeFsckPurgeEmptyDirectoriesKeepsChangedDirectory(t *testing.T) {
+	stub := &stubFilerServer{
+		entries: map[string]*filer_pb.Entry{
+			"/race":     {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: 100}},
+			"/race/dir": {IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: 100}},
+		},
+		writtenAfterLookup: map[string]bool{"/race/dir": true},
+	}
+
+	verbose := false
+	c := &commandVolumeFsck{
+		verbose:         &verbose,
+		writer:          io.Discard,
+		bucketsPath:     "/buckets",
+		scopedFilerPath: "/",
+		purgedDirs:      map[util.FullPath]struct{}{"/race/dir": {}},
+		env:             startStubFiler(t, stub),
+	}
+
+	c.purgeEmptyDirectories()
+
+	if len(stub.deleted) > 0 {
+		t.Errorf("deleted %v, expected a directory written to after the lookup to be kept", stub.deleted)
+	}
+}
+
+// The purge pool may run at most `workers` deletes at once, and at least one
+// even when the flag is set to zero.
+func TestVolumeFsckPurgeWorkerLimit(t *testing.T) {
+	gate := make(chan struct{})
+	var inFlight, maxSeen, processed atomic.Int32
+	queue, finish := startPurgeWorkers(3, func(util.FullPath) {
+		n := inFlight.Add(1)
+		for {
+			m := maxSeen.Load()
+			if n <= m || maxSeen.CompareAndSwap(m, n) {
+				break
+			}
+		}
+		<-gate
+		inFlight.Add(-1)
+		processed.Add(1)
+	})
+
+	for i := 0; i < 10; i++ {
+		queue(purgeItem{path: util.FullPath(fmt.Sprintf("/p/%d", i))})
+	}
+	deadline := time.Now().Add(5 * time.Second)
+	for inFlight.Load() < 3 && time.Now().Before(deadline) {
+		time.Sleep(time.Millisecond)
+	}
+	if got := inFlight.Load(); got != 3 {
+		t.Fatalf("in-flight deletes %d, want the 3-worker limit", got)
+	}
+	time.Sleep(10 * time.Millisecond)
+	if got := maxSeen.Load(); got > 3 {
+		t.Fatalf("saw %d concurrent deletes, want at most 3", got)
+	}
+	close(gate)
+	finish()
+	if got := processed.Load(); got != 10 {
+		t.Fatalf("processed %d deletes, want all 10 drained", got)
+	}
+}
+
+func TestVolumeFsckPurgeWorkersAtLeastOne(t *testing.T) {
+	var processed atomic.Int32
+	queue, finish := startPurgeWorkers(0, func(util.FullPath) { processed.Add(1) })
+	for i := 0; i < 5; i++ {
+		queue(purgeItem{path: util.FullPath(fmt.Sprintf("/p/%d", i))})
+	}
+	finish()
+	if got := processed.Load(); got != 5 {
+		t.Fatalf("processed %d deletes, want 5", got)
+	}
+}
+
+// Deletes of paths sharing a hard link id must never overlap: the filer
+// decrements a shared counter non-atomically, so concurrent deletes of the
+// same id would both read N and write back N-1.
+func TestVolumeFsckPurgeHardLinksSerialized(t *testing.T) {
+	var inFlight, maxSeen, processed atomic.Int32
+	gate := make(chan struct{})
+	queue, finish := startPurgeWorkers(8, func(util.FullPath) {
+		n := inFlight.Add(1)
+		for {
+			m := maxSeen.Load()
+			if n <= m || maxSeen.CompareAndSwap(m, n) {
+				break
+			}
+		}
+		<-gate
+		inFlight.Add(-1)
+		processed.Add(1)
+	})
+	for i := 0; i < 8; i++ {
+		queue(purgeItem{path: util.FullPath(fmt.Sprintf("/hl/%d", i)), hardLinkId: []byte{9, 9, 9}})
+	}
+	time.Sleep(50 * time.Millisecond)
+	if got := maxSeen.Load(); got > 1 {
+		t.Fatalf("saw %d concurrent deletes on one hard link id, want 1", got)
+	}
+	close(gate)
+	finish()
+	if got := processed.Load(); got != 8 {
+		t.Fatalf("processed %d deletes, want 8", got)
+	}
+}
+
+// Orphans found by the per-volume check go through the same purge queue as
+// the missing-volume path, and the fid file keeps each entry's hard link id
+// so same-id deletes still land on one worker.
+func TestVolumeFsckCheckOneVolumeQueuesOrphansWithHardLinkId(t *testing.T) {
+	tempDir := t.TempDir()
+	var verbose bool
+	var buf bytes.Buffer
+	c := &commandVolumeFsck{tempFolder: tempDir, verbose: &verbose, writer: &buf}
+
+	volumeId := uint32(7)
+	db := needle_map.NewMemDb()
+	if err := db.Set(types.NeedleId(11), types.ToOffset(16), types.Size(1)); err != nil {
+		t.Fatalf("seed volume idx: %v", err)
+	}
+	if err := db.SaveToIdx(getVolumeFileIdFile(tempDir, "dn1", volumeId)); err != nil {
+		t.Fatalf("write volume idx: %v", err)
+	}
+	db.Close()
+
+	f, err := os.Create(getFilerFileIdFile(tempDir, volumeId))
+	if err != nil {
+		t.Fatalf("create fid file: %v", err)
+	}
+	writeFid := func(fileKey uint64, cookie uint32, p string, hardLinkId []byte) {
+		buffer := make([]byte, readbufferSize)
+		util.Uint64toBytes(buffer, fileKey)
+		util.Uint32toBytes(buffer[8:], cookie)
+		util.Uint32toBytes(buffer[12:], uint32(len(p)))
+		if _, err := f.Write(buffer); err != nil {
+			t.Fatalf("write fid header: %v", err)
+		}
+		if _, err := f.Write([]byte(p)); err != nil {
+			t.Fatalf("write fid path: %v", err)
+		}
+		util.Uint32toBytes(buffer[:4], uint32(len(hardLinkId)))
+		if _, err := f.Write(buffer[:4]); err != nil {
+			t.Fatalf("write fid hard link id size: %v", err)
+		}
+		if _, err := f.Write(hardLinkId); err != nil {
+			t.Fatalf("write fid hard link id: %v", err)
+		}
+	}
+	writeFid(11, 1, "/keep/a", nil)
+	writeFid(22, 2, "/orphan/b", []byte{1, 2, 3})
+	writeFid(33, 3, "/orphan/c", nil)
+	if err := f.Close(); err != nil {
+		t.Fatalf("close fid file: %v", err)
+	}
+
+	var queued []purgeItem
+	if err := c.oneVolumeFileIdsCheckOneVolume("dn1", volumeId, func(it purgeItem) {
+		queued = append(queued, it)
+	}); err != nil {
+		t.Fatalf("check volume: %v", err)
+	}
+	if len(queued) != 2 {
+		t.Fatalf("queued %d purges, want 2 (the two orphans): %v", len(queued), queued)
+	}
+	if queued[0].path != "/orphan/b" || queued[1].path != "/orphan/c" {
+		t.Fatalf("queued paths %v, want /orphan/b then /orphan/c", queued)
+	}
+	if !bytes.Equal(queued[0].hardLinkId, []byte{1, 2, 3}) {
+		t.Fatalf("queued hardLinkId %v, want [1 2 3]", queued[0].hardLinkId)
+	}
+	if queued[1].hardLinkId != nil {
+		t.Fatalf("queued hardLinkId %v, want nil", queued[1].hardLinkId)
+	}
+}
+
+// A .fid file cut short inside the hard link id field is corrupt input, not a
+// record without a link id: the reader must fail instead of emitting the entry
+// with a nil id.
+func TestReadFilerFileIdFileRejectsTruncatedHardLinkId(t *testing.T) {
+	tempDir := t.TempDir()
+	var verbose bool
+	c := &commandVolumeFsck{tempFolder: tempDir, verbose: &verbose, writer: io.Discard}
+
+	f, err := os.Create(getFilerFileIdFile(tempDir, 7))
+	if err != nil {
+		t.Fatalf("create fid file: %v", err)
+	}
+	buffer := make([]byte, readbufferSize)
+	util.Uint64toBytes(buffer, 11)
+	util.Uint32toBytes(buffer[8:], 1)
+	util.Uint32toBytes(buffer[12:], uint32(len("/orphan/b")))
+	if _, err := f.Write(buffer); err != nil {
+		t.Fatalf("write fid header: %v", err)
+	}
+	if _, err := f.Write([]byte("/orphan/b")); err != nil {
+		t.Fatalf("write fid path: %v", err)
+	}
+	if _, err := f.Write([]byte{0, 0}); err != nil {
+		t.Fatalf("write partial hard link id size: %v", err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatalf("close fid file: %v", err)
+	}
+
+	err = c.readFilerFileIdFile(7, func(types.NeedleId, util.FullPath, []byte) {
+		t.Fatal("callback fired for a truncated record")
+	})
+	if err == nil {
+		t.Fatal("expected an error for a truncated hard link id size")
+	}
+}
diff --git a/weed/shell/command_volume_grow.go b/weed/shell/command_volume_grow.go
index 1a9a043d72..b1f11d8694 100644
--- a/weed/shell/command_volume_grow.go
+++ b/weed/shell/command_volume_grow.go
@@ -39,7 +39,7 @@ func (c *commandGrow) Do(args []string, commandEnv *CommandEnv, writer io.Writer
 
 	volumeVacuumCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	growCount := volumeVacuumCommand.Uint("count", 2, "")
-	collection := volumeVacuumCommand.String("collection", "", "grow this collection")
+	collection := volumeVacuumCommand.String("collection", "", "grow this collection; \""+CollectionDefault+"\" for the collection with no name")
 	dataCenter := volumeVacuumCommand.String("dataCenter", "", "grow volumes only from the specified data center")
 	rack := volumeVacuumCommand.String("rack", "", "grow volumes only from the specified rack")
 	dataNode := volumeVacuumCommand.String("dataNode", "", "grow volumes only from the specified data node")
@@ -51,6 +51,7 @@ func (c *commandGrow) Do(args []string, commandEnv *CommandEnv, writer io.Writer
 	if *collection == "" {
 		return fmt.Errorf("collection option is required")
 	}
+	*collection = resolveCollectionName(*collection)
 	t, _, err := collectTopologyInfo(commandEnv, 0)
 	if err != nil {
 		return err
@@ -115,7 +116,7 @@ func (c *commandGrow) Do(args []string, commandEnv *CommandEnv, writer io.Writer
 	if !collectionFound {
 		return fmt.Errorf("collection not found")
 	}
-	if err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	if err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		if _, err := client.VolumeGrow(context.Background(), volumeGrowRequest); err != nil {
 			return err
 		}
diff --git a/weed/shell/command_volume_growth_resume.go b/weed/shell/command_volume_growth_resume.go
new file mode 100644
index 0000000000..7cad7c71ab
--- /dev/null
+++ b/weed/shell/command_volume_growth_resume.go
@@ -0,0 +1,52 @@
+package shell
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+func init() {
+	Commands = append(Commands, &commandVolumeGrowthResume{})
+}
+
+type commandVolumeGrowthResume struct {
+}
+
+func (c *commandVolumeGrowthResume) Name() string {
+	return "volume.growth.resume"
+}
+
+func (c *commandVolumeGrowthResume) Help() string {
+	return `resume volume growth frozen after detected master state loss
+
+	volume.growth.resume
+
+	Volume growth freezes automatically when a volume server reports a
+	topology id that differs from this cluster's, which means the master
+	state was rebuilt and max volume id knowledge may be incomplete. Run
+	this after verifying the cluster inventory so new ids are not reused.
+
+`
+}
+
+func (c *commandVolumeGrowthResume) HasTag(CommandTag) bool {
+	return false
+}
+
+func (c *commandVolumeGrowthResume) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
+	return commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
+		resp, err := client.ResumeVolumeGrowth(context.Background(), &master_pb.ResumeVolumeGrowthRequest{})
+		if err != nil {
+			return err
+		}
+		if resp.WasFrozen {
+			fmt.Fprintf(writer, "volume growth resumed\n")
+		} else {
+			fmt.Fprintf(writer, "volume growth was not frozen\n")
+		}
+		return nil
+	})
+}
diff --git a/weed/shell/command_volume_list.go b/weed/shell/command_volume_list.go
index a9912356cd..32e8c59355 100644
--- a/weed/shell/command_volume_list.go
+++ b/weed/shell/command_volume_list.go
@@ -24,7 +24,7 @@ func init() {
 }
 
 type commandVolumeList struct {
-	collectionPattern *string
+	collectionMatcher *wildcard.CollectionMatcher
 	dataCenter        *string
 	rack              *string
 	dataNode          *string
@@ -54,7 +54,7 @@ func (c *commandVolumeList) Do(args []string, commandEnv *CommandEnv, writer io.
 
 	volumeListCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	verbosityLevel := volumeListCommand.Int("v", 5, "verbose mode: 0, 1, 2, 3, 4, 5")
-	c.collectionPattern = volumeListCommand.String("collectionPattern", "", "match with wildcard characters '*' and '?'")
+	collectionPattern := volumeListCommand.String("collectionPattern", "", "comma-separated collection names, with '*' and '?' wildcards; empty matches all")
 	c.readonly = volumeListCommand.Bool("readonly", false, "show only readonly volumes")
 	c.writable = volumeListCommand.Bool("writable", false, "show only writable volumes")
 	c.volumeId = volumeListCommand.Uint64("volumeId", 0, "show only volume id")
@@ -66,6 +66,10 @@ func (c *commandVolumeList) Do(args []string, commandEnv *CommandEnv, writer io.
 		return nil
 	}
 
+	if c.collectionMatcher, err = wildcard.CompileCollectionMatcher(*collectionPattern); err != nil {
+		return err
+	}
+
 	// collect topology information
 	var topologyInfo *master_pb.TopologyInfo
 	topologyInfo, c.volumeSizeLimitMb, err = collectTopologyInfo(commandEnv, 0)
@@ -319,7 +323,7 @@ func (c *commandVolumeList) isNotMatchDiskInfo(readOnly bool, collection string,
 	if *c.writable && (readOnly || volumeSize == -1 || (c.volumeSizeLimitMb > 0 && uint64(volumeSize) >= c.volumeSizeLimitMb*util.MiByte)) {
 		return true
 	}
-	if !matchesVolumeCollectionPattern(*c.collectionPattern, collection) {
+	if !c.collectionMatcher.Matches(collection) {
 		return true
 	}
 	if *c.volumeId > 0 && *c.volumeId != uint64(volumeId) {
@@ -328,16 +332,6 @@ func (c *commandVolumeList) isNotMatchDiskInfo(readOnly bool, collection string,
 	return false
 }
 
-func matchesVolumeCollectionPattern(pattern, collection string) bool {
-	if pattern == "" {
-		return true
-	}
-	if pattern == CollectionDefault {
-		return collection == ""
-	}
-	return wildcard.MatchesWildcard(pattern, collection)
-}
-
 func (c *commandVolumeList) writeDiskInfo(writer io.Writer, t *master_pb.DiskInfo, verbosityLevel int, outNodeInfo func()) statistics {
 	var s statistics
 	diskType := t.Type
diff --git a/weed/shell/command_volume_list_test.go b/weed/shell/command_volume_list_test.go
index be211787d1..1fd32378e5 100644
--- a/weed/shell/command_volume_list_test.go
+++ b/weed/shell/command_volume_list_test.go
@@ -160,7 +160,6 @@ func TestWriteDataNodeInfo_SplitsCollapsedDisksByPhysicalDiskId(t *testing.T) {
 
 	c := &commandVolumeList{}
 	fs := flag.NewFlagSet("volume.list", flag.ContinueOnError)
-	c.collectionPattern = fs.String("collection", "", "")
 	c.dataCenter = fs.String("dataCenter", "", "")
 	c.rack = fs.String("rack", "", "")
 	c.dataNode = fs.String("dataNode", "", "")
@@ -205,7 +204,6 @@ func TestWriteTopologyInfo_PrintsParentHeadersOnce(t *testing.T) {
 
 	c := &commandVolumeList{}
 	fs := flag.NewFlagSet("volume.list", flag.ContinueOnError)
-	c.collectionPattern = fs.String("collection", "", "")
 	c.dataCenter = fs.String("dataCenter", "", "")
 	c.rack = fs.String("rack", "", "")
 	c.dataNode = fs.String("dataNode", "", "")
diff --git a/weed/shell/command_volume_mark.go b/weed/shell/command_volume_mark.go
index 80e0e90fbe..443a7a943a 100644
--- a/weed/shell/command_volume_mark.go
+++ b/weed/shell/command_volume_mark.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 )
@@ -27,10 +28,14 @@ func (c *commandVolumeMark) Name() string {
 func (c *commandVolumeMark) Help() string {
 	return `Mark volume writable or readonly from one volume server, or all volume replicas in one collection
 
-	volume.mark -node <volume server host:port> -volumeId <volume id> -writable or -readonly
-	volume.mark -collection <collection> -writable or -readonly
+	volume.mark -node <volume server host:port> -volumeId <volume id> -writable, -readonly or -readonlyCanDelete
+	volume.mark -collection <collection> -writable, -readonly or -readonlyCanDelete
 
 	Use -collection ` + CollectionDefault + ` to target volumes that belong to no named collection.
+
+	-readonlyCanDelete rejects new writes but keeps accepting deletes, so a
+	volume holding expiring data drains over time until it can be vacuumed
+	away or merged into other volumes with fs.mergeVolumes.
 `
 }
 
@@ -43,9 +48,10 @@ func (c *commandVolumeMark) Do(args []string, commandEnv *CommandEnv, writer io.
 	volMarkCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeIdInt := volMarkCommand.Int("volumeId", 0, "the volume id")
 	nodeStr := volMarkCommand.String("node", "", "the volume server <host>:<port>")
-	collection := volMarkCommand.String("collection", "", "the collection name")
+	collection := volMarkCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; \""+CollectionDefault+"\" for the collection with no name")
 	writable := volMarkCommand.Bool("writable", false, "volume mark writable")
 	readonly := volMarkCommand.Bool("readonly", false, "volume mark readonly")
+	readonlyCanDelete := volMarkCommand.Bool("readonlyCanDelete", false, "volume mark readonly but still accepting deletes")
 	if err = volMarkCommand.Parse(args); err != nil {
 		return nil
 	}
@@ -60,12 +66,16 @@ func (c *commandVolumeMark) Do(args []string, commandEnv *CommandEnv, writer io.
 			volumeIdSet = true
 		}
 	})
-	markWritable := false
-	if (*writable && *readonly) || (!*writable && !*readonly) {
-		return fmt.Errorf("use -readonly or -writable")
-	} else if *writable {
-		markWritable = true
+	modeCount := 0
+	for _, set := range []bool{*writable, *readonly, *readonlyCanDelete} {
+		if set {
+			modeCount++
+		}
 	}
+	if modeCount != 1 {
+		return fmt.Errorf("use exactly one of -writable, -readonly or -readonlyCanDelete")
+	}
+	markWritable := *writable
 
 	if collectionSet {
 		if *collection == "" {
@@ -94,10 +104,12 @@ func (c *commandVolumeMark) Do(args []string, commandEnv *CommandEnv, writer io.
 		state := "readonly"
 		if markWritable {
 			state = "writable"
+		} else if *readonlyCanDelete {
+			state = "readonly (can delete)"
 		}
 		var failures []error
 		for _, target := range targets {
-			if err := markVolumeWritable(context.Background(), commandEnv.option.GrpcDialOption, target.volumeId, target.sourceVolumeServer, markWritable, true); err != nil {
+			if err := markVolumeState(context.Background(), commandEnv.option.GrpcDialOption, target.volumeId, target.sourceVolumeServer, markWritable, *readonlyCanDelete, true); err != nil {
 				failures = append(failures, fmt.Errorf("mark volume %d on %s: %w", target.volumeId, target.sourceVolumeServer, err))
 				fmt.Fprintf(writer, "volume %d on %s: %v\n", target.volumeId, target.sourceVolumeServer, err)
 				continue
@@ -114,7 +126,7 @@ func (c *commandVolumeMark) Do(args []string, commandEnv *CommandEnv, writer io.
 
 	volumeId := needle.VolumeId(*volumeIdInt)
 
-	return markVolumeWritable(context.Background(), commandEnv.option.GrpcDialOption, volumeId, sourceVolumeServer, markWritable, true)
+	return markVolumeState(context.Background(), commandEnv.option.GrpcDialOption, volumeId, sourceVolumeServer, markWritable, *readonlyCanDelete, true)
 }
 
 type volumeMarkTarget struct {
@@ -126,11 +138,9 @@ func collectVolumeMarkTargetsByCollection(topoInfo *master_pb.TopologyInfo, coll
 	if collection == "" {
 		return nil, fmt.Errorf("collection is required")
 	}
-
-	// _default targets volumes that belong to no named collection.
-	matchCollection := collection
-	if matchCollection == CollectionDefault {
-		matchCollection = ""
+	collectionMatcher, err := wildcard.CompileCollectionMatcher(collection)
+	if err != nil {
+		return nil, fmt.Errorf("invalid collection pattern %q: %w", collection, err)
 	}
 
 	var targets []volumeMarkTarget
@@ -141,7 +151,7 @@ func collectVolumeMarkTargetsByCollection(topoInfo *master_pb.TopologyInfo, coll
 		sourceVolumeServer := pb.NewServerAddressFromDataNode(dn)
 		for _, diskInfo := range dn.GetDiskInfos() {
 			for _, v := range diskInfo.GetVolumeInfos() {
-				if v.GetCollection() == matchCollection {
+				if collectionMatcher.Matches(v.GetCollection()) {
 					targets = append(targets, volumeMarkTarget{
 						volumeId:           needle.VolumeId(v.GetId()),
 						sourceVolumeServer: sourceVolumeServer,
@@ -151,7 +161,7 @@ func collectVolumeMarkTargetsByCollection(topoInfo *master_pb.TopologyInfo, coll
 		}
 	})
 	if len(targets) == 0 {
-		return nil, fmt.Errorf("collection %s has no volumes", collection)
+		return nil, fmt.Errorf("no volumes match collection %s", collection)
 	}
 	return targets, nil
 }
diff --git a/weed/shell/command_volume_mark_test.go b/weed/shell/command_volume_mark_test.go
index 8251ca926e..47a19cbb3b 100644
--- a/weed/shell/command_volume_mark_test.go
+++ b/weed/shell/command_volume_mark_test.go
@@ -122,7 +122,7 @@ func TestCollectVolumeMarkTargetsByCollectionRejectsEmptyCollection(t *testing.T
 
 func TestCollectVolumeMarkTargetsByCollectionReportsMissingCollection(t *testing.T) {
 	_, err := collectVolumeMarkTargetsByCollection(&master_pb.TopologyInfo{}, "missing")
-	if err == nil || !strings.Contains(err.Error(), "collection missing has no volumes") {
+	if err == nil || !strings.Contains(err.Error(), "no volumes match collection missing") {
 		t.Fatalf("expected missing collection error, got %v", err)
 	}
 }
diff --git a/weed/shell/command_volume_merge.go b/weed/shell/command_volume_merge.go
index 5605ae632a..003af4d042 100644
--- a/weed/shell/command_volume_merge.go
+++ b/weed/shell/command_volume_merge.go
@@ -120,7 +120,7 @@ func (c *commandVolumeMerge) Do(args []string, commandEnv *CommandEnv, writer io
 		if !cleanupTarget {
 			return
 		}
-		if delErr := deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, volumeId, targetServer, false, false); delErr != nil {
+		if delErr := deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, volumeId, targetServer, false, false, false); delErr != nil {
 			glog.Warningf("failed to clean up temporary merge volume %d on %s: %v", volumeId, targetServer, delErr)
 		}
 	}()
@@ -192,7 +192,7 @@ func (c *commandVolumeMerge) Do(args []string, commandEnv *CommandEnv, writer io
 		}
 	}
 
-	if err = deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, volumeId, targetServer, false, false); err != nil {
+	if err = deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, volumeId, targetServer, false, false, false); err != nil {
 		return err
 	}
 
@@ -232,14 +232,14 @@ func startTailNeedleStream(grpcDialOption grpc.DialOption, volumeId needle.Volum
 	ch := make(chan *needle.Needle, 32)
 	stream := &tailNeedleStream{ch: ch}
 	go func() {
-		err := operation.TailVolumeFromSource(server, grpcDialOption, volumeId, 0, mergeIdleTimeoutSeconds, func(n *needle.Needle) error {
+		err := operation.TailVolumeFromSource(server, volumeId, 0, mergeIdleTimeoutSeconds, func(n *needle.Needle) error {
 			select {
 			case ch <- n:
 			case <-done:
 				return fmt.Errorf("merge cancelled")
 			}
 			return nil
-		})
+		}, grpcDialOption)
 		close(ch)
 		stream.setErr(err)
 	}()
diff --git a/weed/shell/command_volume_move.go b/weed/shell/command_volume_move.go
index 541aa98b70..3486f413a4 100644
--- a/weed/shell/command_volume_move.go
+++ b/weed/shell/command_volume_move.go
@@ -2,20 +2,18 @@ package shell
 
 import (
 	"context"
-	"errors"
 	"flag"
 	"fmt"
 	"io"
-	"log"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 
 	"google.golang.org/grpc"
 )
@@ -42,9 +40,10 @@ func (c *commandVolumeMove) Help() string {
 	1. This command marks the source volume as read-only, copies it to the target volume server, and records the last entry timestamp.
 	2. This command asks the target volume server to mount the new volume.
 	3. This command asks the target volume server to tail the source volume for updates after the timestamp, for 1 minutes to drain any in-flight requests.
-	4. This command asks the source volume server to delete the source volume.
+	4. This command verifies the target volume matches the source, then asks the source volume server to delete the source volume.
 
 	The option "-disk [hdd|ssd|<tag>]" can be used to change the volume disk type.
+	The option "-timeout" fails the whole move if it does not finish in time.
 
 `
 }
@@ -61,6 +60,7 @@ func (c *commandVolumeMove) Do(args []string, commandEnv *CommandEnv, writer io.
 	targetNodeStr := volMoveCommand.String("target", "", "the target volume server <host>:<port>")
 	diskTypeStr := volMoveCommand.String("disk", "", "[hdd|ssd|<tag>] hard drive or solid state drive or any tag")
 	ioBytePerSecond := volMoveCommand.Int64("ioBytePerSecond", 0, "limit the speed of move")
+	timeout := volMoveCommand.Duration("timeout", 0, "wall-clock cap on the whole move; 0 = no timeout")
 	noLock := volMoveCommand.Bool("noLock", false, "do not lock the admin shell at one's own risk")
 
 	if err = volMoveCommand.Parse(args); err != nil {
@@ -79,149 +79,51 @@ func (c *commandVolumeMove) Do(args []string, commandEnv *CommandEnv, writer io.
 
 	volumeId := needle.VolumeId(*volumeIdInt)
 
-	if sourceVolumeServer == targetVolumeServer {
+	if volume_move.SameServer(sourceVolumeServer, targetVolumeServer) {
 		return fmt.Errorf("source and target volume servers are the same!")
 	}
 
-	return LiveMoveVolume(context.Background(), commandEnv.option.GrpcDialOption, writer, volumeId, sourceVolumeServer, targetVolumeServer, 5*time.Second, *diskTypeStr, *ioBytePerSecond, false)
+	ctx := context.Background()
+	if *timeout > 0 {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithTimeout(ctx, *timeout)
+		defer cancel()
+	}
+
+	return LiveMoveVolume(ctx, commandEnv.option.GrpcDialOption, writer, volumeId, sourceVolumeServer, targetVolumeServer, 5*time.Second, *diskTypeStr, *ioBytePerSecond)
 }
 
 // LiveMoveVolume moves one volume from one source volume server to one target volume server, with idleTimeout to drain the incoming requests.
-func LiveMoveVolume(ctx context.Context, grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, sourceVolumeServer, targetVolumeServer pb.ServerAddress, idleTimeout time.Duration, diskType string, ioBytePerSecond int64, skipTailError bool) (err error) {
-
-	log.Printf("copying volume %d from %s to %s", volumeId, sourceVolumeServer, targetVolumeServer)
-	lastAppendAtNs, err := copyVolume(ctx, grpcDialOption, writer, volumeId, sourceVolumeServer, targetVolumeServer, diskType, ioBytePerSecond, false)
-	if err != nil {
-		return fmt.Errorf("copy volume %d from %s to %s: %v", volumeId, sourceVolumeServer, targetVolumeServer, err)
-	}
-
-	log.Printf("tailing volume %d from %s to %s", volumeId, sourceVolumeServer, targetVolumeServer)
-	if err = tailVolume(ctx, grpcDialOption, volumeId, sourceVolumeServer, targetVolumeServer, lastAppendAtNs, idleTimeout); err != nil {
-		if skipTailError {
-			fmt.Fprintf(writer, "tail volume %d from %s to %s: %v\n", volumeId, sourceVolumeServer, targetVolumeServer, err)
-		} else {
-			return fmt.Errorf("tail volume %d from %s to %s: %v", volumeId, sourceVolumeServer, targetVolumeServer, err)
-		}
-	}
-
-	log.Printf("deleting volume %d from %s", volumeId, sourceVolumeServer)
-	if err = deleteVolume(ctx, grpcDialOption, volumeId, sourceVolumeServer, false, true); err != nil {
-		return fmt.Errorf("delete volume %d from %s: %v", volumeId, sourceVolumeServer, err)
-	}
-
-	log.Printf("moved volume %d from %s to %s", volumeId, sourceVolumeServer, targetVolumeServer)
-	return nil
+func LiveMoveVolume(ctx context.Context, grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, sourceVolumeServer, targetVolumeServer pb.ServerAddress, idleTimeout time.Duration, diskType string, ioBytePerSecond int64) (err error) {
+	return volume_move.NewMover(grpcDialOption).LiveMoveVolume(ctx, volumeId, sourceVolumeServer, targetVolumeServer, volume_move.VolumeMoveOptions{
+		DiskType:        diskType,
+		IoBytePerSecond: ioBytePerSecond,
+		IdleTimeout:     idleTimeout,
+		Writer:          writer,
+	})
 }
 
 func copyVolume(ctx context.Context, grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, sourceVolumeServer, targetVolumeServer pb.ServerAddress, diskType string, ioBytePerSecond int64, restoreWritable bool) (lastAppendAtNs uint64, err error) {
-
-	// check to see if the volume is already read-only and if its not then we need
-	// to mark it as read-only and then before we return we need to undo what we
-	// did
-	var shouldMarkWritable bool
-	defer func() {
-		if !shouldMarkWritable {
-			return
-		}
-		if !restoreWritable && err == nil {
-			return
-		}
-
-		// Restoring writability must outlive a cancelled copy, or the source
-		// is left permanently readonly on abort, as balance_task.go already
-		// guards against.
-		restoreCtx, restoreCancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
-		defer restoreCancel()
-		clientErr := operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-			_, writableErr := volumeServerClient.VolumeMarkWritable(restoreCtx, &volume_server_pb.VolumeMarkWritableRequest{
-				VolumeId: uint32(volumeId),
-			})
-			return writableErr
-		})
-		if clientErr != nil {
-			log.Printf("failed to mark volume %d as writable after copy from %s: %v", volumeId, sourceVolumeServer, clientErr)
-		}
-	}()
-
-	err = operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		resp, statusErr := volumeServerClient.VolumeStatus(ctx, &volume_server_pb.VolumeStatusRequest{
-			VolumeId: uint32(volumeId),
-		})
-		if statusErr == nil && !resp.IsReadOnly {
-			shouldMarkWritable = true
-			_, readonlyErr := volumeServerClient.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{
-				VolumeId: uint32(volumeId),
-				Persist:  false,
-			})
-			return readonlyErr
-		}
-		return statusErr
-	})
-	if err != nil {
-		return
-	}
-
-	err = operation.WithVolumeServerClient(true, targetVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		stream, replicateErr := volumeServerClient.VolumeCopy(ctx, &volume_server_pb.VolumeCopyRequest{
-			VolumeId:        uint32(volumeId),
-			SourceDataNode:  string(sourceVolumeServer),
-			DiskType:        diskType,
-			IoBytePerSecond: ioBytePerSecond,
-		})
-		if replicateErr != nil {
-			return replicateErr
-		}
-		for {
-			resp, recvErr := stream.Recv()
-			if recvErr != nil {
-				if recvErr == io.EOF {
-					break
-				} else {
-					return recvErr
-				}
-			}
-			if resp.LastAppendAtNs != 0 {
-				lastAppendAtNs = resp.LastAppendAtNs
-			} else {
-				fmt.Fprintf(writer, "%s => %s volume %d processed %s\n", sourceVolumeServer, targetVolumeServer, volumeId, util.BytesToHumanReadable(uint64(resp.ProcessedBytes)))
-			}
-		}
-
-		return nil
-	})
-
-	return
+	return volume_move.NewMover(grpcDialOption).CopyVolume(ctx, volumeId, sourceVolumeServer, targetVolumeServer, diskType, ioBytePerSecond, restoreWritable, writer)
 }
 
 func tailVolume(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceVolumeServer, targetVolumeServer pb.ServerAddress, lastAppendAtNs uint64, idleTimeout time.Duration) (err error) {
-
-	return operation.WithVolumeServerClient(true, targetVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, replicateErr := volumeServerClient.VolumeTailReceiver(ctx, &volume_server_pb.VolumeTailReceiverRequest{
-			VolumeId:           uint32(volumeId),
-			SinceNs:            lastAppendAtNs,
-			IdleTimeoutSeconds: uint32(idleTimeout.Seconds()),
-			SourceVolumeServer: string(sourceVolumeServer),
-		})
-		return replicateErr
-	})
-
+	return volume_move.NewMover(grpcDialOption).TailVolume(ctx, volumeId, sourceVolumeServer, targetVolumeServer, lastAppendAtNs, idleTimeout)
 }
 
 // deleteVolume removes the volume from sourceVolumeServer. When keepRemoteData
 // is true, the cloud-tier object backing the volume is left intact — used on
 // the source side of a move where another server is taking over the same .vif.
-func deleteVolume(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceVolumeServer pb.ServerAddress, onlyEmpty bool, keepRemoteData bool) (err error) {
-	return operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		_, deleteErr := volumeServerClient.VolumeDelete(ctx, &volume_server_pb.VolumeDeleteRequest{
-			VolumeId:       uint32(volumeId),
-			OnlyEmpty:      onlyEmpty,
-			KeepRemoteData: keepRemoteData,
-		})
-		return deleteErr
-	})
+func deleteVolume(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceVolumeServer pb.ServerAddress, onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) (err error) {
+	return volume_move.NewMover(grpcDialOption).DeleteVolume(ctx, volumeId, sourceVolumeServer, onlyEmpty, onlyGarbage, keepRemoteData)
 }
 
 func markVolumeWritable(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceVolumeServer pb.ServerAddress, writable, persist bool) (err error) {
+	return markVolumeState(ctx, grpcDialOption, volumeId, sourceVolumeServer, writable, false, persist)
+}
+
+// canDelete: readonly that still accepts deletes, so expiring data drains the volume.
+func markVolumeState(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, sourceVolumeServer pb.ServerAddress, writable, canDelete, persist bool) (err error) {
 	return operation.WithVolumeServerClient(false, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
 		if writable {
 			_, err = volumeServerClient.VolumeMarkWritable(ctx, &volume_server_pb.VolumeMarkWritableRequest{
@@ -229,8 +131,9 @@ func markVolumeWritable(ctx context.Context, grpcDialOption grpc.DialOption, vol
 			})
 		} else {
 			_, err = volumeServerClient.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{
-				VolumeId: uint32(volumeId),
-				Persist:  persist,
+				VolumeId:  uint32(volumeId),
+				Persist:   persist,
+				CanDelete: canDelete,
 			})
 		}
 		return err
@@ -246,55 +149,24 @@ func markVolumeReplicaWritable(ctx context.Context, grpcDialOption grpc.DialOpti
 	return markVolumeWritable(ctx, grpcDialOption, volumeId, location.ServerAddress(), writable, persist)
 }
 
-func markVolumeReplicasWritable(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, locations []wdclient.Location, writable, persist bool) error {
+// markVolumeReplicasWritable marks each replica and returns the ones that
+// took the mark, so a caller can roll back or report a partial operation.
+func markVolumeReplicasWritable(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, locations []wdclient.Location, writable, persist bool) (marked []wdclient.Location, err error) {
 	for _, location := range locations {
-		if err := markVolumeReplicaWritable(ctx, grpcDialOption, volumeId, location, writable, persist); err != nil {
-			return err
+		if err = markVolumeReplicaWritable(ctx, grpcDialOption, volumeId, location, writable, persist); err != nil {
+			return
 		}
+		marked = append(marked, location)
 	}
-	return nil
+	return
 }
 
 // replicateVolumeToServer copies a volume from sourceAddress to targetAddress via the VolumeCopy gRPC stream.
-func replicateVolumeToServer(ctx context.Context, grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, sourceAddress, targetAddress pb.ServerAddress, diskType string) error {
-	return operation.WithVolumeServerClient(false, targetAddress, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		stream, replicateErr := volumeServerClient.VolumeCopy(ctx, &volume_server_pb.VolumeCopyRequest{
-			VolumeId:       uint32(volumeId),
-			SourceDataNode: string(sourceAddress),
-			DiskType:       diskType,
-		})
-		if replicateErr != nil {
-			return replicateErr
-		}
-		for {
-			resp, recvErr := stream.Recv()
-			if recvErr != nil {
-				if recvErr == io.EOF {
-					break
-				}
-				return recvErr
-			}
-			if resp.ProcessedBytes > 0 {
-				fmt.Fprintf(writer, "volume %d processed %s bytes\n", volumeId, util.BytesToHumanReadable(uint64(resp.ProcessedBytes)))
-			}
-		}
-		return nil
-	})
+func replicateVolumeToServer(ctx context.Context, grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, sourceAddress, targetAddress pb.ServerAddress, diskType string, ioBytePerSecond int64) error {
+	return volume_move.NewMover(grpcDialOption).ReplicateVolume(ctx, volumeId, sourceAddress, targetAddress, diskType, ioBytePerSecond, writer)
 }
 
 // configureVolumeReplication sets the replication setting on a volume at the given server.
 func configureVolumeReplication(ctx context.Context, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, targetAddress pb.ServerAddress, replicationString string) error {
-	return operation.WithVolumeServerClient(false, targetAddress, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-		resp, configureErr := volumeServerClient.VolumeConfigure(ctx, &volume_server_pb.VolumeConfigureRequest{
-			VolumeId:    uint32(volumeId),
-			Replication: replicationString,
-		})
-		if configureErr != nil {
-			return configureErr
-		}
-		if resp.Error != "" {
-			return errors.New(resp.Error)
-		}
-		return nil
-	})
+	return volume_move.NewMover(grpcDialOption).ConfigureVolumeReplication(ctx, volumeId, targetAddress, replicationString)
 }
diff --git a/weed/shell/command_volume_scrub.go b/weed/shell/command_volume_scrub.go
index dfac142945..95afd3a329 100644
--- a/weed/shell/command_volume_scrub.go
+++ b/weed/shell/command_volume_scrub.go
@@ -50,7 +50,7 @@ func (c *commandVolumeScrub) Do(args []string, commandEnv *CommandEnv, writer io
 	volScrubCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	nodesStr := volScrubCommand.String("node", "", "comma-separated list of volume server <host>:<port> (optional)")
 	volumeIDsStr := volScrubCommand.String("volumeId", "", "comma-separated volume IDs to process (optional)")
-	mode := volScrubCommand.String("mode", "full", "scrubbing mode (index/local/full)")
+	mode := volScrubCommand.String("mode", "full", "scrubbing mode (index/local/full/reads)")
 	markBrokenReadonly := volScrubCommand.Bool("markBrokenReadonly", false, "whether to flag volumes with scrub failures as read-only")
 	maxParallelization := volScrubCommand.Int("maxParallelization", DefaultMaxParallelization, "run up to X tasks in parallel, whenever possible")
 	showDetails := volScrubCommand.Bool("details", false, "display scrub result details, if available")
@@ -99,6 +99,9 @@ func (c *commandVolumeScrub) Do(args []string, commandEnv *CommandEnv, writer io
 		c.mode = volume_server_pb.VolumeScrubMode_LOCAL
 	case "FULL":
 		c.mode = volume_server_pb.VolumeScrubMode_FULL
+	case "READS":
+		// only meaningful for EC volumes; accepted here so one mode name works on both commands
+		c.mode = volume_server_pb.VolumeScrubMode_READS
 	default:
 		return fmt.Errorf("unsupported scrubbing mode %q", *mode)
 	}
diff --git a/weed/shell/command_volume_server_evacuate.go b/weed/shell/command_volume_server_evacuate.go
index e8a9b885af..cd62bf0eda 100644
--- a/weed/shell/command_volume_server_evacuate.go
+++ b/weed/shell/command_volume_server_evacuate.go
@@ -1,6 +1,7 @@
 package shell
 
 import (
+	"cmp"
 	"flag"
 	"fmt"
 	"io"
@@ -177,7 +178,7 @@ func (c *commandVolumeServerEvacuate) evacuateEcVolumes(commandEnv *CommandEnv,
 
 		// move away ec volumes for this disk type
 		for _, thisNode := range thisNodes {
-			diskInfo, found := thisNode.info.DiskInfos[string(diskType)]
+			diskInfo, found := thisNode.Info.DiskInfos[string(diskType)]
 			if !found {
 				continue
 			}
@@ -205,12 +206,12 @@ func (c *commandVolumeServerEvacuate) moveAwayOneEcVolume(commandEnv *CommandEnv
 		// Sort by: 1) fewest shards of this volume, 2) most free EC slots
 		// This ensures we prefer nodes with capacity and balanced shard distribution
 		slices.SortFunc(otherNodes, func(a, b *EcNode) int {
-			aShards := a.localShardIdCount(ecShardInfo.Id)
-			bShards := b.localShardIdCount(ecShardInfo.Id)
+			aShards := a.LocalShardIdCount(ecShardInfo.Id)
+			bShards := b.LocalShardIdCount(ecShardInfo.Id)
 			if aShards != bShards {
 				return aShards - bShards // Prefer fewer shards
 			}
-			return b.freeEcSlot - a.freeEcSlot // Then prefer more free slots
+			return b.FreeEcSlot - a.FreeEcSlot // Then prefer more free slots
 		})
 
 		shardMoved := false
@@ -219,7 +220,7 @@ func (c *commandVolumeServerEvacuate) moveAwayOneEcVolume(commandEnv *CommandEnv
 			emptyNode := otherNodes[i]
 
 			// Skip nodes with no free EC slots
-			if emptyNode.freeEcSlot <= 0 {
+			if emptyNode.FreeEcSlot <= 0 {
 				skippedNodes++
 				continue
 			}
@@ -233,9 +234,9 @@ func (c *commandVolumeServerEvacuate) moveAwayOneEcVolume(commandEnv *CommandEnv
 			// No anti-affinity needed for evacuation (dataShardCount=0)
 			destDiskId := pickBestDiskOnNode(emptyNode, vid, diskType, false, shardId, 0)
 			if destDiskId > 0 {
-				fmt.Fprintf(writer, "moving ec volume %s%d.%d %s => %s (disk %d)\n", collectionPrefix, ecShardInfo.Id, shardId, thisNode.info.Id, emptyNode.info.Id, destDiskId)
+				fmt.Fprintf(writer, "moving ec volume %s%d.%d %s => %s (disk %d)\n", collectionPrefix, ecShardInfo.Id, shardId, thisNode.Info.Id, emptyNode.Info.Id, destDiskId)
 			} else {
-				fmt.Fprintf(writer, "moving ec volume %s%d.%d %s => %s\n", collectionPrefix, ecShardInfo.Id, shardId, thisNode.info.Id, emptyNode.info.Id)
+				fmt.Fprintf(writer, "moving ec volume %s%d.%d %s => %s\n", collectionPrefix, ecShardInfo.Id, shardId, thisNode.Info.Id, emptyNode.Info.Id)
 			}
 			err = moveMountedShardToEcNode(commandEnv, thisNode, ecShardInfo.Collection, vid, shardId, emptyNode, destDiskId, applyChange, diskType)
 			if err != nil {
@@ -245,7 +246,7 @@ func (c *commandVolumeServerEvacuate) moveAwayOneEcVolume(commandEnv *CommandEnv
 				hasMoved = true
 				shardMoved = true
 				// Update the node's free slot count after successful move
-				emptyNode.freeEcSlot--
+				emptyNode.FreeEcSlot--
 				break
 			}
 		}
@@ -273,7 +274,7 @@ func moveAwayOneNormalVolume(commandEnv *CommandEnv, volumeReplicas map[uint32][
 	}
 	// most empty one is in the front
 	slices.SortFunc(otherNodes, func(a, b *Node) int {
-		return int(a.localVolumeRatio(maxVolumeCountFn) - b.localVolumeRatio(maxVolumeCountFn))
+		return cmp.Compare(a.localVolumeRatio(maxVolumeCountFn), b.localVolumeRatio(maxVolumeCountFn))
 	})
 	for i := 0; i < len(otherNodes); i++ {
 		emptyNode := otherNodes[i]
@@ -310,14 +311,14 @@ func (c *commandVolumeServerEvacuate) nodesOtherThan(volumeServers []*Node, this
 
 func (c *commandVolumeServerEvacuate) ecNodesOtherThan(volumeServers []*EcNode, thisServer string) (thisNodes []*EcNode, otherNodes []*EcNode) {
 	for _, node := range volumeServers {
-		if node.info.Id == thisServer || (*c.volumeRack != "" && string(node.rack) == *c.volumeRack) {
+		if node.Info.Id == thisServer || (*c.volumeRack != "" && string(node.Rack) == *c.volumeRack) {
 			thisNodes = append(thisNodes, node)
 			continue
 		}
-		if *c.volumeRack != "" && *c.volumeRack == string(node.rack) {
+		if *c.volumeRack != "" && *c.volumeRack == string(node.Rack) {
 			continue
 		}
-		if *c.targetServer != "" && *c.targetServer != node.info.Id {
+		if *c.targetServer != "" && *c.targetServer != node.Info.Id {
 			continue
 		}
 		otherNodes = append(otherNodes, node)
diff --git a/weed/shell/command_volume_server_evacuate_test.go b/weed/shell/command_volume_server_evacuate_test.go
index 3983c62e1f..ba03323987 100644
--- a/weed/shell/command_volume_server_evacuate_test.go
+++ b/weed/shell/command_volume_server_evacuate_test.go
@@ -5,6 +5,22 @@ import (
 	"testing"
 )
 
+func TestEvacuatePrefersLowerVolumeRatio(t *testing.T) {
+	volumes := mkByteVolumes(1, 1, 1)
+	source := makeByteNode("source", 10, 0, 0, volumes)
+	fuller := makeByteNode("fuller", 10, 0, 0, mkByteVolumes(10, 4, 1))
+	emptier := makeByteNode("emptier", 10, 0, 0, mkByteVolumes(20, 2, 1))
+
+	// Put the 40%-full server first: truncating 0.2 - 0.4 to int makes the ratios tie.
+	moved, err := moveAwayOneNormalVolume(nil, nil, volumes[0], source, []*Node{fuller, emptier}, false)
+	if err != nil || !moved {
+		t.Fatalf("evacuate: moved=%v, err=%v", moved, err)
+	}
+	if _, found := emptier.selectedVolumes[volumes[0].Id]; !found {
+		t.Fatal("expected evacuation to choose the server with lower occupancy")
+	}
+}
+
 func TestVolumeServerEvacuate(t *testing.T) {
 	targetServer := ""
 	volumeRack := "rack1"
diff --git a/weed/shell/command_volume_tier_compact.go b/weed/shell/command_volume_tier_compact.go
index f26af60a61..282b437340 100644
--- a/weed/shell/command_volume_tier_compact.go
+++ b/weed/shell/command_volume_tier_compact.go
@@ -9,10 +9,12 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 )
 
 func init() {
@@ -29,8 +31,8 @@ func (c *commandVolumeTierCompact) Name() string {
 func (c *commandVolumeTierCompact) Help() string {
 	return `compact remote volumes to reclaim space on cloud storage
 
-	volume.tier.compact [-volumeId=<volume_id>]
-	volume.tier.compact [-collection=""] [-garbageThreshold=0.3]
+	volume.tier.compact [-volumeId=<volume_id>] [-concurrency=<n>]
+	volume.tier.compact [-collection=""] [-garbageThreshold=0.3] [-concurrency=<n>]
 
 	e.g.:
 	volume.tier.compact -volumeId=7
@@ -62,12 +64,17 @@ func (c *commandVolumeTierCompact) Do(args []string, commandEnv *CommandEnv, wri
 
 	tierCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeId := tierCommand.Int("volumeId", 0, "the volume id")
-	collection := tierCommand.String("collection", "", "the collection name (supports regex)")
+	collection := tierCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; empty matches the collection with no name")
 	garbageThreshold := tierCommand.Float64("garbageThreshold", 0.3, "compact when garbage ratio exceeds this value")
+	concurrency := tierCommand.Int("concurrency", 0, "multipart transfer concurrency (0 = backend default)")
 	if err = tierCommand.Parse(args); err != nil {
 		return nil
 	}
 
+	if err = validateTierConcurrency(*concurrency); err != nil {
+		return err
+	}
+
 	if err = commandEnv.confirmIsLocked(args); err != nil {
 		return
 	}
@@ -107,7 +114,7 @@ func (c *commandVolumeTierCompact) Do(args []string, commandEnv *CommandEnv, wri
 
 	var failedCount int
 	for _, rv := range remoteVolumes {
-		if err = doVolumeTierCompact(commandEnv, writer, rv, *garbageThreshold); err != nil {
+		if err = doVolumeTierCompact(commandEnv, writer, topologyInfo, rv, *garbageThreshold, *concurrency); err != nil {
 			fmt.Fprintf(writer, "error compacting volume %d: %v\n", rv.vid, err)
 			failedCount++
 		}
@@ -119,15 +126,47 @@ func (c *commandVolumeTierCompact) Do(args []string, commandEnv *CommandEnv, wri
 	return nil
 }
 
-func findRemoteVolumeInTopology(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId, collectionPattern string) (remoteVolumeInfo, bool, error) {
-	// when collectionPattern is provided, compile and use as regex filter
+// findVolumeCollection resolves the collection a volume actually lives in,
+// honoring the -collection filter: an empty pattern matches any collection, a
+// non-empty one compiles like the rest of the tier commands. The volume server
+// verifies the collection name on tier requests, so callers need the real
+// name, not the pattern.
+func findVolumeCollection(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId, collectionPattern string) (collection string, found bool, err error) {
 	var matchesCollection func(string) bool
 	if collectionPattern != "" {
-		collectionRegex, err := compileCollectionPattern(collectionPattern)
+		collectionMatcher, compileErr := compileCollectionPattern(collectionPattern)
+		if compileErr != nil {
+			return "", false, fmt.Errorf("invalid collection pattern '%s': %v", collectionPattern, compileErr)
+		}
+		matchesCollection = collectionMatcher.Matches
+	} else {
+		matchesCollection = func(string) bool { return true }
+	}
+
+	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		if found {
+			return
+		}
+		for _, diskInfo := range dn.DiskInfos {
+			for _, v := range diskInfo.VolumeInfos {
+				if needle.VolumeId(v.Id) == vid && matchesCollection(v.Collection) {
+					collection, found = v.Collection, true
+					return
+				}
+			}
+		}
+	})
+	return
+}
+
+func findRemoteVolumeInTopology(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId, collectionPattern string) (remoteVolumeInfo, bool, error) {
+	var matchesCollection func(string) bool
+	if collectionPattern != "" {
+		collectionMatcher, err := compileCollectionPattern(collectionPattern)
 		if err != nil {
 			return remoteVolumeInfo{}, false, fmt.Errorf("invalid collection pattern '%s': %v", collectionPattern, err)
 		}
-		matchesCollection = collectionRegex.MatchString
+		matchesCollection = collectionMatcher.Matches
 	} else {
 		matchesCollection = func(string) bool { return true }
 	}
@@ -140,7 +179,7 @@ func findRemoteVolumeInTopology(topoInfo *master_pb.TopologyInfo, vid needle.Vol
 		}
 		for _, diskInfo := range dn.DiskInfos {
 			for _, v := range diskInfo.VolumeInfos {
-				if needle.VolumeId(v.Id) == vid && v.RemoteStorageName != "" && v.RemoteStorageKey != "" {
+				if needle.VolumeId(v.Id) == vid && v.RemoteStorageName != "" {
 					if !matchesCollection(v.Collection) {
 						continue
 					}
@@ -161,7 +200,7 @@ func findRemoteVolumeInTopology(topoInfo *master_pb.TopologyInfo, vid needle.Vol
 }
 
 func collectRemoteVolumesWithInfo(topoInfo *master_pb.TopologyInfo, collectionPattern string) ([]remoteVolumeInfo, error) {
-	collectionRegex, err := compileCollectionPattern(collectionPattern)
+	collectionMatcher, err := compileCollectionPattern(collectionPattern)
 	if err != nil {
 		return nil, fmt.Errorf("invalid collection pattern '%s': %v", collectionPattern, err)
 	}
@@ -171,10 +210,10 @@ func collectRemoteVolumesWithInfo(topoInfo *master_pb.TopologyInfo, collectionPa
 	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
 		for _, diskInfo := range dn.DiskInfos {
 			for _, v := range diskInfo.VolumeInfos {
-				if v.RemoteStorageName == "" || v.RemoteStorageKey == "" {
+				if v.RemoteStorageName == "" {
 					continue
 				}
-				if !collectionRegex.MatchString(v.Collection) {
+				if !collectionMatcher.Matches(v.Collection) {
 					continue
 				}
 				if seen[v.Id] {
@@ -195,11 +234,49 @@ func collectRemoteVolumesWithInfo(topoInfo *master_pb.TopologyInfo, collectionPa
 	return result, nil
 }
 
-func doVolumeTierCompact(commandEnv *CommandEnv, writer io.Writer, rv remoteVolumeInfo, garbageThreshold float64) error {
+// collectVolumeTierCompactLocations returns the volume's tiered replicas first
+// followed by any local ones. Every tiered replica references the same remote
+// object, so the source is always a tiered replica and the last tiered replica
+// doubles as the one that can retire the old object after the resync.
+func collectVolumeTierCompactLocations(topoInfo *master_pb.TopologyInfo, vid needle.VolumeId, collection string) (tiered, local []wdclient.Location) {
+	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
+		for _, disk := range dn.DiskInfos {
+			for _, vi := range disk.VolumeInfos {
+				if needle.VolumeId(vi.Id) != vid || vi.Collection != collection {
+					continue
+				}
+				loc := wdclient.Location{
+					Url:        dn.Id,
+					PublicUrl:  dn.Id,
+					GrpcPort:   int(dn.GrpcPort),
+					DataCenter: string(dc),
+				}
+				if vi.RemoteStorageName != "" {
+					tiered = append(tiered, loc)
+				} else {
+					local = append(local, loc)
+				}
+			}
+		}
+	})
+	return
+}
+
+func doVolumeTierCompact(commandEnv *CommandEnv, writer io.Writer, topoInfo *master_pb.TopologyInfo, rv remoteVolumeInfo, garbageThreshold float64, concurrency int) error {
 	grpcDialOption := commandEnv.option.GrpcDialOption
+	ctx := context.Background()
+
+	tieredLocations, localLocations := collectVolumeTierCompactLocations(topoInfo, rv.vid, rv.collection)
+	if len(tieredLocations) == 0 {
+		return fmt.Errorf("volume %d has no remote replica", rv.vid)
+	}
+	source := tieredLocations[0].ServerAddress()
+	// all replicas of the volume: tiered ones share one remote object, and any
+	// local copy is re-pointed at the new object during the resync below
+	locations := append(append([]wdclient.Location{}, tieredLocations...), localLocations...)
 
 	// step 1: check garbage level
-	garbageRatio, err := checkVolumeGarbage(grpcDialOption, rv.vid, rv.serverAddress)
+	garbageRatio, err := checkVolumeGarbage(grpcDialOption, rv.vid, source)
 	if err != nil {
 		return fmt.Errorf("check garbage for volume %d: %v", rv.vid, err)
 	}
@@ -212,43 +289,209 @@ func doVolumeTierCompact(commandEnv *CommandEnv, writer io.Writer, rv remoteVolu
 
 	fmt.Fprintf(writer, "volume %d garbage ratio %.4f, starting compaction...\n", rv.vid, garbageRatio)
 
-	// step 2: download .dat from remote to local
-	// this deletes the remote file and reloads the volume as local, then re-uploads below
-	fmt.Fprintf(writer, "  downloading volume %d from %s to local...\n", rv.vid, rv.remoteStorageName)
-	err = downloadDatFromRemoteTier(grpcDialOption, writer, rv.vid, rv.collection, rv.serverAddress, false)
+	// step 2: freeze every replica. The mark is persisted because the download
+	// remounts the volume into a fresh in-memory state, and a local .dat with no
+	// persisted readonly flag would load writable while its siblings stay readonly.
+	frozen, err := markVolumeReplicasWritable(ctx, grpcDialOption, rv.vid, locations, false, true)
 	if err != nil {
-		return fmt.Errorf("download volume %d from remote: %v", rv.vid, err)
+		// nothing changed yet: thaw the replicas already marked
+		if _, thawErr := markVolumeReplicasWritable(ctx, grpcDialOption, rv.vid, frozen, true, false); thawErr != nil {
+			return fmt.Errorf("mark volume %d readonly: %v (thawing the %d marked replicas also failed: %v)",
+				rv.vid, err, len(frozen), thawErr)
+		}
+		return fmt.Errorf("mark volume %d readonly: %v", rv.vid, err)
+	}
+	// Past this point a failure keeps every replica frozen on purpose: a replica
+	// mid-transition may hold divergent data, and thawing it would expose that.
+	// Re-running volume.tier.compact completes the resync and releases the marks.
+	stillFrozen := func(stageErr error) error {
+		return fmt.Errorf("%v (volume %d replicas stay readonly; rerun volume.tier.compact to resume)", stageErr, rv.vid)
 	}
 
-	// step 3: compact the local volume
-	fmt.Fprintf(writer, "  compacting volume %d...\n", rv.vid)
-	err = compactVolumeOnServer(grpcDialOption, writer, rv.vid, rv.serverAddress)
+	// step 3: download .dat from remote to local; the shared object stays while
+	// sibling replicas still reference it
+	fmt.Fprintf(writer, "  downloading volume %d from %s to local...\n", rv.vid, rv.remoteStorageName)
+	err = downloadDatFromRemoteTier(grpcDialOption, writer, rv.vid, rv.collection, source, len(tieredLocations) > 1, concurrency)
 	if err != nil {
-		// compaction failed, but volume is now local without remote reference
-		// upload the uncompacted volume back to restore cloud tier state
-		fmt.Fprintf(writer, "  compaction failed: %v\n", err)
+		return stillFrozen(fmt.Errorf("download volume %d from remote: %v", rv.vid, err))
+	}
+
+	// step 4: compact the local volume; on failure re-upload what is there so
+	// the replica returns to the tier and the resync below can still proceed
+	compactErr := compactVolumeOnServer(grpcDialOption, writer, rv.vid, source)
+	if compactErr != nil {
+		fmt.Fprintf(writer, "  compaction failed: %v\n", compactErr)
 		fmt.Fprintf(writer, "  re-uploading volume %d to %s without compaction...\n", rv.vid, rv.remoteStorageName)
-		uploadErr := uploadDatToRemoteTier(grpcDialOption, writer, rv.vid, rv.collection, rv.serverAddress, rv.remoteStorageName, false)
-		if uploadErr != nil {
-			return fmt.Errorf("compaction failed (%v) and re-upload also failed (%v), volume %d remains local",
-				err, uploadErr, rv.vid)
+	}
+
+	// step 5: upload the (possibly uncompacted) volume back to remote under a new key
+	fmt.Fprintf(writer, "  uploading volume %d to %s...\n", rv.vid, rv.remoteStorageName)
+	uploadErr := uploadDatToRemoteTier(grpcDialOption, writer, rv.vid, rv.collection, source, rv.remoteStorageName, false, concurrency)
+	if uploadErr != nil {
+		if compactErr != nil {
+			return stillFrozen(fmt.Errorf("compaction failed (%v) and re-upload also failed (%v), volume %d remains local",
+				compactErr, uploadErr, rv.vid))
+		}
+		return stillFrozen(fmt.Errorf("upload compacted volume %d to %s: %v (volume remains local with compacted data)",
+			rv.vid, rv.remoteStorageName, uploadErr))
+	}
+
+	// step 6: push the new .idx/.vif to every sibling so all replicas reference
+	// the new remote object; the last tiered replica goes last so the old shared
+	// object still has a holder until then. Replicas stay frozen until every
+	// copy lands, so a delete cannot slip past a sibling's index snapshot; a
+	// copied readonly mark is inert on a remote-backed volume anyway.
+	syncErr := syncVolumeTierCompactReplicas(ctx, grpcDialOption, writer, rv, tieredLocations, localLocations)
+	if compactErr != nil {
+		if syncErr != nil {
+			return stillFrozen(fmt.Errorf("compaction failed (%v), volume %d re-uploaded without compaction but resync failed: %v",
+				compactErr, rv.vid, syncErr))
 		}
 		return fmt.Errorf("compaction failed (%v), volume %d re-uploaded to %s without compaction",
-			err, rv.vid, rv.remoteStorageName)
+			compactErr, rv.vid, rv.remoteStorageName)
+	}
+	if syncErr != nil {
+		return stillFrozen(syncErr)
 	}
 
-	// step 4: upload compacted volume back to remote
-	fmt.Fprintf(writer, "  uploading compacted volume %d to %s...\n", rv.vid, rv.remoteStorageName)
-	err = uploadDatToRemoteTier(grpcDialOption, writer, rv.vid, rv.collection, rv.serverAddress, rv.remoteStorageName, false)
+	// step 7: unfreeze every replica, clearing the persisted readonly mark on
+	// each. Remote volumes refuse writes regardless; this re-enables deletes.
+	thawed, err := markVolumeReplicasWritable(ctx, grpcDialOption, rv.vid, locations, true, false)
 	if err != nil {
-		return fmt.Errorf("upload compacted volume %d to %s: %v (volume remains local with compacted data)",
-			rv.vid, rv.remoteStorageName, err)
+		return fmt.Errorf("unfreeze volume %d replicas: %v (%d of %d released)", rv.vid, err, len(thawed), len(locations))
 	}
 
 	fmt.Fprintf(writer, "volume %d compacted and uploaded to %s successfully\n", rv.vid, rv.remoteStorageName)
 	return nil
 }
 
+// planTierCompactResync orders the sibling resyncs. The last tiered replica is
+// held out for last: the resync retires a remote object only once its final
+// holder is re-pointed, so processing the old object's expected last holder at
+// the end keeps it alive for every sibling still referencing it. A
+// single-replica volume has no such holder: its download already removed the
+// object.
+func planTierCompactResync(tieredLocations, localLocations []wdclient.Location) (order, deleter []wdclient.Location) {
+	rest := append(append([]wdclient.Location{}, tieredLocations[1:]...), localLocations...)
+	if len(tieredLocations) > 1 {
+		last := tieredLocations[len(tieredLocations)-1]
+		for _, loc := range rest {
+			if loc.ServerAddress() == last.ServerAddress() {
+				deleter = append(deleter, loc)
+				continue
+			}
+			order = append(order, loc)
+		}
+		return
+	}
+	return rest, nil
+}
+
+func syncVolumeTierCompactReplicas(ctx context.Context, grpcDialOption grpc.DialOption, writer io.Writer, rv remoteVolumeInfo, tieredLocations, localLocations []wdclient.Location) error {
+	source := tieredLocations[0].ServerAddress()
+	mover := volume_move.NewMover(grpcDialOption)
+
+	resync := func(loc wdclient.Location) error {
+		fmt.Fprintf(writer, "  replicating volume %d metadata from %s to %s\n", rv.vid, tieredLocations[0].Url, loc.Url)
+		return replicateVolumeToServer(ctx, grpcDialOption, writer, rv.vid, source, loc.ServerAddress(), "", 0)
+	}
+
+	order, deleter := planTierCompactResync(tieredLocations, localLocations)
+
+	// Every replica's current remote objects, so a resynced-over replica can
+	// retire an object once it is the last holder — covers the shared object
+	// and any object a previous interrupted run left referenced. The source
+	// counts as a holder of the new object so a replica already sharing it is
+	// never mistaken for the last holder.
+	allLocations := append(append([]wdclient.Location{}, tieredLocations...), localLocations...)
+	holders, readErr := readRemoteObjectHolders(ctx, grpcDialOption, rv.vid, allLocations)
+	if readErr != nil {
+		// Fall back to the explicit last-replica deleter when a replica's
+		// remote files cannot be read.
+		for _, loc := range order {
+			if err := resync(loc); err != nil {
+				return fmt.Errorf("replicate volume %d from %s to %s: %v", rv.vid, tieredLocations[0].Url, loc.Url, err)
+			}
+		}
+		if len(deleter) == 0 {
+			return nil
+		}
+		fmt.Fprintf(writer, "  removing old remote copy of volume %d on %s\n", rv.vid, deleter[0].Url)
+		if err := mover.DeleteVolume(ctx, rv.vid, deleter[0].ServerAddress(), false, false, false); err != nil {
+			return fmt.Errorf("delete old copy of volume %d on %s: %v", rv.vid, deleter[0].Url, err)
+		}
+		return resync(deleter[0])
+	}
+
+	for _, loc := range append(append([]wdclient.Location{}, order...), deleter...) {
+		files := holders.files[loc.ServerAddress()]
+		soleHolder := len(files) > 0
+		for _, f := range files {
+			if holders.count[remoteFileKey(f)] > 1 {
+				soleHolder = false
+				break
+			}
+		}
+		if soleHolder {
+			// This replica is the only holder of its remote objects: removing
+			// its copy retires them, and the resync restores the replica on the
+			// new object.
+			fmt.Fprintf(writer, "  removing old remote copy of volume %d on %s\n", rv.vid, loc.Url)
+			if err := mover.DeleteVolume(ctx, rv.vid, loc.ServerAddress(), false, false, false); err != nil {
+				return fmt.Errorf("delete old copy of volume %d on %s: %v", rv.vid, loc.Url, err)
+			}
+		}
+		for _, f := range files {
+			holders.count[remoteFileKey(f)]--
+		}
+		if err := resync(loc); err != nil {
+			return fmt.Errorf("replicate volume %d from %s to %s: %v", rv.vid, tieredLocations[0].Url, loc.Url, err)
+		}
+	}
+	return nil
+}
+
+// remoteObjectHolders reads every replica's remote file list and counts how
+// many replicas reference each remote object.
+type remoteObjectHolders struct {
+	files map[pb.ServerAddress][]*volume_server_pb.RemoteFile
+	count map[string]int
+}
+
+func remoteFileKey(f *volume_server_pb.RemoteFile) string {
+	return f.BackendType + "/" + f.BackendId + "/" + f.Key
+}
+
+func readRemoteObjectHolders(ctx context.Context, grpcDialOption grpc.DialOption, vid needle.VolumeId, locations []wdclient.Location) (*remoteObjectHolders, error) {
+	h := &remoteObjectHolders{
+		files: make(map[pb.ServerAddress][]*volume_server_pb.RemoteFile),
+		count: make(map[string]int),
+	}
+	for _, loc := range locations {
+		addr := loc.ServerAddress()
+		err := operation.WithVolumeServerClient(false, addr, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+			resp, reqErr := client.ReadVolumeFileStatus(ctx, &volume_server_pb.ReadVolumeFileStatusRequest{
+				VolumeId: uint32(vid),
+			})
+			if reqErr != nil {
+				return reqErr
+			}
+			if resp == nil || resp.VolumeInfo == nil {
+				return fmt.Errorf("volume %d status has no remote file info", vid)
+			}
+			h.files[addr] = resp.VolumeInfo.GetFiles()
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+		for _, f := range h.files[addr] {
+			h.count[remoteFileKey(f)]++
+		}
+	}
+	return h, nil
+}
+
 func checkVolumeGarbage(grpcDialOption grpc.DialOption, vid needle.VolumeId, server pb.ServerAddress) (float64, error) {
 	var garbageRatio float64
 	err := operation.WithVolumeServerClient(false, server, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
diff --git a/weed/shell/command_volume_tier_compact_test.go b/weed/shell/command_volume_tier_compact_test.go
index 1de7802e32..67177b997a 100644
--- a/weed/shell/command_volume_tier_compact_test.go
+++ b/weed/shell/command_volume_tier_compact_test.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -253,3 +254,89 @@ func TestCollectRemoteVolumesWithInfoInvalidPattern(t *testing.T) {
 	_, err := collectRemoteVolumesWithInfo(topo, "[invalid")
 	assert.Error(t, err)
 }
+
+func buildTestTopologyWithReplicas() *master_pb.TopologyInfo {
+	mkDn := func(id string, volumes ...*master_pb.VolumeInformationMessage) *master_pb.DataNodeInfo {
+		return &master_pb.DataNodeInfo{
+			Id:       id,
+			GrpcPort: 18080,
+			DiskInfos: map[string]*master_pb.DiskInfo{
+				"": {VolumeInfos: volumes},
+			},
+		}
+	}
+	remote := func(vid uint32) *master_pb.VolumeInformationMessage {
+		return &master_pb.VolumeInformationMessage{
+			Id:                vid,
+			Collection:        "col1",
+			RemoteStorageName: "s3.default",
+			RemoteStorageKey:  "col1/vid.dat",
+		}
+	}
+	local := func(vid uint32) *master_pb.VolumeInformationMessage {
+		return &master_pb.VolumeInformationMessage{Id: vid, Collection: "col1"}
+	}
+	return &master_pb.TopologyInfo{
+		DataCenterInfos: []*master_pb.DataCenterInfo{
+			{
+				RackInfos: []*master_pb.RackInfo{
+					{
+						DataNodeInfos: []*master_pb.DataNodeInfo{
+							mkDn("n1:8080", remote(1)),
+							mkDn("n2:8080", remote(1), local(2)),
+							mkDn("n3:8080", remote(1)),
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func TestCollectVolumeTierCompactLocations(t *testing.T) {
+	topo := buildTestTopologyWithReplicas()
+
+	tiered, local := collectVolumeTierCompactLocations(topo, needle.VolumeId(1), "col1")
+	assert.Equal(t, 3, len(tiered))
+	assert.Equal(t, 0, len(local))
+
+	tiered, local = collectVolumeTierCompactLocations(topo, needle.VolumeId(2), "col1")
+	assert.Equal(t, 0, len(tiered))
+	assert.Equal(t, 1, len(local))
+
+	// a different collection or volume id matches nothing
+	tiered, local = collectVolumeTierCompactLocations(topo, needle.VolumeId(1), "other")
+	assert.Equal(t, 0, len(tiered))
+	assert.Equal(t, 0, len(local))
+}
+
+func TestPlanTierCompactResync(t *testing.T) {
+	loc := func(url string) wdclient.Location {
+		return wdclient.Location{Url: url, GrpcPort: 1}
+	}
+	urls := func(locs []wdclient.Location) (out []string) {
+		for _, l := range locs {
+			out = append(out, l.Url)
+		}
+		return
+	}
+
+	// single replica: nothing to resync, nothing to delete (its download
+	// already removed the object)
+	order, deleter := planTierCompactResync([]wdclient.Location{loc("a")}, nil)
+	assert.Empty(t, order)
+	assert.Empty(t, deleter)
+
+	// two tiered replicas: the sibling is the last holder and goes last
+	order, deleter = planTierCompactResync([]wdclient.Location{loc("a"), loc("b")}, nil)
+	assert.Empty(t, order)
+	assert.Equal(t, []string{"b"}, urls(deleter))
+
+	// three tiered replicas plus one local copy: middle replicas resync in
+	// order, the last tiered replica deletes and is resynced last
+	order, deleter = planTierCompactResync(
+		[]wdclient.Location{loc("a"), loc("b"), loc("c")},
+		[]wdclient.Location{loc("d")})
+	assert.Equal(t, []string{"b", "d"}, urls(order))
+	assert.Equal(t, []string{"c"}, urls(deleter))
+}
diff --git a/weed/shell/command_volume_tier_download.go b/weed/shell/command_volume_tier_download.go
index d261747c32..12f4fead3c 100644
--- a/weed/shell/command_volume_tier_download.go
+++ b/weed/shell/command_volume_tier_download.go
@@ -32,7 +32,7 @@ func (c *commandVolumeTierDownload) Help() string {
 	return `download the dat file of a volume from a remote tier
 
 	volume.tier.download [-collection=""]
-	volume.tier.download [-collection=""] -volumeId=<volume_id>
+	volume.tier.download [-collection=""] -volumeId=<volume_id> [-concurrency=<n>]
 
 	The -collection parameter supports regular expressions for pattern matching:
 	  - Use exact match: volume.tier.download -collection="^mybucket$"
@@ -41,6 +41,7 @@ func (c *commandVolumeTierDownload) Help() string {
 
 	e.g.:
 	volume.tier.download -volumeId=7
+	volume.tier.download -volumeId=7 -concurrency=1
 
 	This command will download the dat file of a volume from a remote tier to a volume server in local cluster.
 
@@ -55,11 +56,16 @@ func (c *commandVolumeTierDownload) Do(args []string, commandEnv *CommandEnv, wr
 
 	tierCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeId := tierCommand.Int("volumeId", 0, "the volume id")
-	collection := tierCommand.String("collection", "", "the collection name")
+	collection := tierCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; empty matches the collection with no name")
+	concurrency := tierCommand.Int("concurrency", 0, "multipart download concurrency (0 = backend default)")
 	if err = tierCommand.Parse(args); err != nil {
 		return nil
 	}
 
+	if err = validateTierConcurrency(*concurrency); err != nil {
+		return err
+	}
+
 	if err = commandEnv.confirmIsLocked(args); err != nil {
 		return
 	}
@@ -74,7 +80,7 @@ func (c *commandVolumeTierDownload) Do(args []string, commandEnv *CommandEnv, wr
 
 	// volumeId is provided
 	if vid != 0 {
-		return doVolumeTierDownload(commandEnv, writer, *collection, vid)
+		return doVolumeTierDownload(commandEnv, writer, topologyInfo, *collection, vid, *concurrency)
 	}
 
 	// apply to all volumes in the collection
@@ -85,7 +91,7 @@ func (c *commandVolumeTierDownload) Do(args []string, commandEnv *CommandEnv, wr
 	}
 	fmt.Printf("tier download volumes: %v\n", volumeIds)
 	for _, vid := range volumeIds {
-		if err = doVolumeTierDownload(commandEnv, writer, *collection, vid); err != nil {
+		if err = doVolumeTierDownload(commandEnv, writer, topologyInfo, *collection, vid, *concurrency); err != nil {
 			return err
 		}
 	}
@@ -95,7 +101,7 @@ func (c *commandVolumeTierDownload) Do(args []string, commandEnv *CommandEnv, wr
 
 func collectRemoteVolumes(topoInfo *master_pb.TopologyInfo, collectionPattern string) (vids []needle.VolumeId, err error) {
 	// compile regex pattern for collection matching
-	collectionRegex, err := compileCollectionPattern(collectionPattern)
+	collectionMatcher, err := compileCollectionPattern(collectionPattern)
 	if err != nil {
 		return nil, fmt.Errorf("invalid collection pattern '%s': %v", collectionPattern, err)
 	}
@@ -104,7 +110,7 @@ func collectRemoteVolumes(topoInfo *master_pb.TopologyInfo, collectionPattern st
 	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
 		for _, diskInfo := range dn.DiskInfos {
 			for _, v := range diskInfo.VolumeInfos {
-				if collectionRegex.MatchString(v.Collection) && v.RemoteStorageKey != "" && v.RemoteStorageName != "" {
+				if collectionMatcher.Matches(v.Collection) && v.RemoteStorageName != "" {
 					vidMap[v.Id] = true
 				}
 			}
@@ -118,20 +124,30 @@ func collectRemoteVolumes(topoInfo *master_pb.TopologyInfo, collectionPattern st
 	return
 }
 
-func doVolumeTierDownload(commandEnv *CommandEnv, writer io.Writer, collection string, vid needle.VolumeId) (err error) {
+func doVolumeTierDownload(commandEnv *CommandEnv, writer io.Writer, topoInfo *master_pb.TopologyInfo, collectionPattern string, vid needle.VolumeId, concurrency int) (err error) {
 	// find volume location
 	locations, found := commandEnv.MasterClient.GetLocationsClone(uint32(vid))
 	if !found {
 		return fmt.Errorf("volume %d not found", vid)
 	}
 
+	// The volume server verifies the request's collection against the volume's
+	// own, so the pattern must resolve to the actual collection here.
+	collection, found, err := findVolumeCollection(topoInfo, vid, collectionPattern)
+	if err != nil {
+		return err
+	}
+	if !found {
+		return fmt.Errorf("volume %d not found in collections matching %q", vid, collectionPattern)
+	}
+
 	// All replicas point at the same remote object; only the final download may delete
 	// it. Every earlier replica keeps it so the survivors are not left dangling.
 	// TODO parallelize this
 	for i, loc := range locations {
 		keepRemote := i < len(locations)-1
 		// copy the .dat file from remote tier to local
-		err = downloadDatFromRemoteTier(commandEnv.option.GrpcDialOption, writer, needle.VolumeId(vid), collection, loc.ServerAddress(), keepRemote)
+		err = downloadDatFromRemoteTier(commandEnv.option.GrpcDialOption, writer, needle.VolumeId(vid), collection, loc.ServerAddress(), keepRemote, concurrency)
 		if err != nil {
 			// A replica already made local by a prior interrupted run is not a
 			// failure; skip it so the remaining remote replicas still download.
@@ -146,13 +162,14 @@ func doVolumeTierDownload(commandEnv *CommandEnv, writer io.Writer, collection s
 	return nil
 }
 
-func downloadDatFromRemoteTier(grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, collection string, targetVolumeServer pb.ServerAddress, keepRemote bool) error {
+func downloadDatFromRemoteTier(grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, collection string, targetVolumeServer pb.ServerAddress, keepRemote bool, concurrency int) error {
 
 	err := operation.WithVolumeServerClient(true, targetVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
 		stream, downloadErr := volumeServerClient.VolumeTierMoveDatFromRemote(context.Background(), &volume_server_pb.VolumeTierMoveDatFromRemoteRequest{
 			VolumeId:          uint32(volumeId),
 			Collection:        collection,
 			KeepRemoteDatFile: keepRemote,
+			Concurrency:       int32(concurrency),
 		})
 
 		var lastProcessed int64
diff --git a/weed/shell/command_volume_tier_move.go b/weed/shell/command_volume_tier_move.go
index 3115c26d68..11a8481a9a 100644
--- a/weed/shell/command_volume_tier_move.go
+++ b/weed/shell/command_volume_tier_move.go
@@ -2,19 +2,22 @@ package shell
 
 import (
 	"context"
+	"errors"
 	"flag"
 	"fmt"
-	"github.com/seaweedfs/seaweedfs/weed/placement"
 	"io"
-	"path/filepath"
 	"sync"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/placement"
+
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
@@ -63,8 +66,9 @@ func (c *commandVolumeTierMove) Help() string {
 	replication setting. Otherwise, the volume's existing replication is preserved.
 
 	Note:
-		Use -collectionPattern="_default" to match only the default collection (volumes with no collection name).
-		Empty collectionPattern matches all collections.
+		-collectionPattern is a comma-separated list of collection names, with "*" and "?"
+		wildcards, and regex patterns. Use "` + CollectionDefault + `" to match only the default collection
+		(volumes with no collection name). An empty pattern matches all collections.
 
 `
 }
@@ -76,7 +80,7 @@ func (c *commandVolumeTierMove) HasTag(CommandTag) bool {
 func (c *commandVolumeTierMove) Do(args []string, commandEnv *CommandEnv, writer io.Writer) (err error) {
 
 	tierCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
-	collectionPattern := tierCommand.String("collectionPattern", "", "match with wildcard characters '*' and '?'")
+	collectionPattern := tierCommand.String("collectionPattern", "", "comma-separated collection names, with '*' and '?' wildcards; empty matches all")
 	fullPercentage := tierCommand.Float64("fullPercent", 95, "the volume reaches the percentage of max volume size")
 	quietPeriod := tierCommand.Duration("quietFor", 24*time.Hour, "select volumes without no writes for this period")
 	source := tierCommand.String("fromDiskType", "", "the source disk type")
@@ -318,7 +322,7 @@ func (c *commandVolumeTierMove) doMoveOneVolume(commandEnv *CommandEnv, writer i
 	}
 
 	// mark all replicas as read only
-	if err = markVolumeReplicasWritable(context.Background(), commandEnv.option.GrpcDialOption, vid, locations, false, false); err != nil {
+	if _, err = markVolumeReplicasWritable(context.Background(), commandEnv.option.GrpcDialOption, vid, locations, false, false); err != nil {
 		return fmt.Errorf("mark volume %d as readonly on %s: %v", vid, locations[0].Url, err)
 	}
 	newAddress := pb.NewServerAddressFromDataNode(dst.dataNode)
@@ -327,13 +331,18 @@ func (c *commandVolumeTierMove) doMoveOneVolume(commandEnv *CommandEnv, writer i
 	deletedSource := sourceVolumeServer
 	if alreadyPlaced {
 		deletedSource = ""
-	} else if err = LiveMoveVolume(context.Background(), commandEnv.option.GrpcDialOption, writer, vid, sourceVolumeServer, newAddress, 5*time.Second, toDiskType.ReadableString(), ioBytePerSecond, true); err != nil {
-		// mark all replicas as writable
-		if err = markVolumeReplicasWritable(context.Background(), commandEnv.option.GrpcDialOption, vid, locations, true, false); err != nil {
-			glog.Errorf("mark volume %d as writable on %s: %v", vid, locations[0].Url, err)
+	} else if moveErr := LiveMoveVolume(context.Background(), commandEnv.option.GrpcDialOption, writer, vid, sourceVolumeServer, newAddress, 5*time.Second, toDiskType.ReadableString(), ioBytePerSecond); moveErr != nil {
+		// A move that deliberately kept the source readonly (its delete may
+		// have happened, leaving the target authoritative) must not be thawed
+		// — reopening the replicas beside that copy would fork the volume.
+		if !errors.Is(moveErr, volume_move.ErrSourceKeptReadonly) {
+			// mark all replicas as writable
+			if _, err = markVolumeReplicasWritable(context.Background(), commandEnv.option.GrpcDialOption, vid, locations, true, false); err != nil {
+				glog.Errorf("mark volume %d as writable on %s: %v", vid, locations[0].Url, err)
+			}
 		}
 
-		return fmt.Errorf("move volume %d %s => %s : %v", vid, locations[0].Url, dst.dataNode.Id, err)
+		return fmt.Errorf("move volume %d %s => %s : %v", vid, locations[0].Url, dst.dataNode.Id, moveErr)
 	}
 
 	// If move is successful and replication is not empty, alter moved volume's replication setting
@@ -350,7 +359,7 @@ func (c *commandVolumeTierMove) doMoveOneVolume(commandEnv *CommandEnv, writer i
 	// deleting old replicas to avoid data-loss risk.
 	// Use the explicit -toReplication if given, otherwise preserve the volume's
 	// existing replication from the source tier.
-	preserveServers, replicateErr := c.ensureReplicationFulfilled(commandEnv, writer, vid, toDiskType, toDataCenter, dst, *replicationString)
+	preserveServers, replicateErr := c.ensureReplicationFulfilled(commandEnv, writer, vid, toDiskType, toDataCenter, dst, *replicationString, ioBytePerSecond)
 	if replicateErr != nil {
 		// Replication not fully achieved — do NOT delete old replicas.
 		restoreSurvivingReplicasWritable(commandEnv, vid, locations, deletedSource)
@@ -380,7 +389,7 @@ func (c *commandVolumeTierMove) doMoveOneVolume(commandEnv *CommandEnv, writer i
 		}
 		// keepRemoteData=true: remote-tiered replicas share one cloud object, so
 		// deleting a replica must not delete the object the survivors still point at.
-		if err = deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, vid, loc.ServerAddress(), false, true); err != nil {
+		if err = deleteVolume(context.Background(), commandEnv.option.GrpcDialOption, vid, loc.ServerAddress(), false, false, true); err != nil {
 			fmt.Fprintf(writer, "failed to delete volume %d on %s: %v\n", vid, loc.Url, err)
 		}
 	}
@@ -405,7 +414,7 @@ func restoreSurvivingReplicasWritable(commandEnv *CommandEnv, vid needle.VolumeI
 // move so it can see the newly placed volume and find suitable destinations for additional copies.
 // It returns a set of server URLs (from the original locations) that host target-tier replicas
 // counted toward fulfillment, so the caller can avoid deleting them during cleanup.
-func (c *commandVolumeTierMove) ensureReplicationFulfilled(commandEnv *CommandEnv, writer io.Writer, vid needle.VolumeId, toDiskType types.DiskType, toDataCenter string, movedDst location, replicationString string) (preserveServers map[string]bool, err error) {
+func (c *commandVolumeTierMove) ensureReplicationFulfilled(commandEnv *CommandEnv, writer io.Writer, vid needle.VolumeId, toDiskType types.DiskType, toDataCenter string, movedDst location, replicationString string, ioBytePerSecond int64) (preserveServers map[string]bool, err error) {
 	preserveServers = make(map[string]bool)
 	// keeps an anchored pre-existing replica writable on the early-return paths
 	preserveServers[movedDst.dataNode.Id] = true
@@ -521,7 +530,7 @@ func (c *commandVolumeTierMove) ensureReplicationFulfilled(commandEnv *CommandEn
 		candidateDst := placeOf[dst.Id]
 		candidateAddress := pb.NewServerAddressFromDataNode(dst)
 
-		if copyErr := replicateVolumeToServer(context.Background(), commandEnv.option.GrpcDialOption, writer, vid, sourceAddress, candidateAddress, toDiskType.ReadableString()); copyErr != nil {
+		if copyErr := replicateVolumeToServer(context.Background(), commandEnv.option.GrpcDialOption, writer, vid, sourceAddress, candidateAddress, toDiskType.ReadableString(), ioBytePerSecond); copyErr != nil {
 			return nil, fmt.Errorf("replicate volume %d to %s: %v", vid, candidateDst.dataNode.Id, copyErr)
 		}
 
@@ -553,6 +562,11 @@ func (c *commandVolumeTierMove) ensureReplicationFulfilled(commandEnv *CommandEn
 
 func collectVolumeIdsForTierChange(topologyInfo *master_pb.TopologyInfo, volumeSizeLimitMb uint64, sourceTier types.DiskType, sourceDataCenter string, collectionPattern string, fullPercentage float64, quietPeriod time.Duration) (vids []needle.VolumeId, err error) {
 
+	collectionMatcher, err := wildcard.CompileCollectionMatcher(collectionPattern)
+	if err != nil {
+		return nil, err
+	}
+
 	quietSeconds := int64(quietPeriod / time.Second)
 	nowUnixSeconds := time.Now().Unix()
 
@@ -565,22 +579,8 @@ func collectVolumeIdsForTierChange(topologyInfo *master_pb.TopologyInfo, volumeS
 		}
 		for _, diskInfo := range dn.DiskInfos {
 			for _, v := range diskInfo.VolumeInfos {
-				// check collection name pattern
-				if collectionPattern != "" {
-					var matched bool
-					if collectionPattern == CollectionDefault {
-						matched = v.Collection == ""
-					} else {
-						var matchErr error
-						matched, matchErr = filepath.Match(collectionPattern, v.Collection)
-						if matchErr != nil {
-							err = fmt.Errorf("collection pattern %q failed to match: %w", collectionPattern, matchErr)
-							return
-						}
-					}
-					if !matched {
-						continue
-					}
+				if !collectionMatcher.Matches(v.Collection) {
+					continue
 				}
 
 				if v.ModifiedAtSecond+quietSeconds < nowUnixSeconds && types.ToDiskType(v.DiskType) == sourceTier {
diff --git a/weed/shell/command_volume_tier_upload.go b/weed/shell/command_volume_tier_upload.go
index eda04884c0..962d55f47c 100644
--- a/weed/shell/command_volume_tier_upload.go
+++ b/weed/shell/command_volume_tier_upload.go
@@ -5,6 +5,7 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"math"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
@@ -21,6 +22,21 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 )
 
+// maxTierConcurrency caps per-request multipart transfer concurrency.
+const maxTierConcurrency = 1024
+
+// validateTierConcurrency rejects values that would wrap when narrowed to the
+// int32 proto field or exhaust volume-server resources. 0 means backend default.
+func validateTierConcurrency(n int) error {
+	if n < 0 || n > math.MaxInt32 {
+		return fmt.Errorf("concurrency must be between 0 and %d, got %d", math.MaxInt32, n)
+	}
+	if n > maxTierConcurrency {
+		return fmt.Errorf("concurrency must be at most %d, got %d", maxTierConcurrency, n)
+	}
+	return nil
+}
+
 func init() {
 	Commands = append(Commands, &commandVolumeTierUpload{})
 }
@@ -36,11 +52,12 @@ func (c *commandVolumeTierUpload) Help() string {
 	return `upload the dat file of a volume to a remote tier
 
 	volume.tier.upload [-collection=""] [-fullPercent=95] [-quietFor=1h]
-	volume.tier.upload [-collection=""] -volumeId=<volume_id> -dest=<storage_backend> [-keepLocalDatFile]
+	volume.tier.upload [-collection=""] -volumeId=<volume_id> -dest=<storage_backend> [-keepLocalDatFile] [-concurrency=<n>]
 
 	e.g.:
 	volume.tier.upload -volumeId=7 -dest=s3
 	volume.tier.upload -volumeId=7 -dest=s3.default
+	volume.tier.upload -volumeId=7 -dest=s3.telegram -concurrency=1
 
 	The <storage_backend> is defined in master.toml.
 	For example, "s3.default" in [storage.backend.s3.default]
@@ -72,16 +89,21 @@ func (c *commandVolumeTierUpload) Do(args []string, commandEnv *CommandEnv, writ
 
 	tierCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	volumeId := tierCommand.Int("volumeId", 0, "the volume id")
-	collection := tierCommand.String("collection", "", "the collection name")
+	collection := tierCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; empty matches the collection with no name")
 	fullPercentage := tierCommand.Float64("fullPercent", 95, "the volume reaches the percentage of max volume size")
 	quietPeriod := tierCommand.Duration("quietFor", 24*time.Hour, "select volumes without no writes for this period")
 	dest := tierCommand.String("dest", "", "the target tier name")
 	keepLocalDatFile := tierCommand.Bool("keepLocalDatFile", false, "whether keep local dat file")
 	disk := tierCommand.String("disk", "", "[hdd|ssd|<tag>] hard drive or solid state drive or any tag")
+	concurrency := tierCommand.Int("concurrency", 0, "multipart upload concurrency (0 = backend default)")
 	if err = tierCommand.Parse(args); err != nil {
 		return nil
 	}
 
+	if err = validateTierConcurrency(*concurrency); err != nil {
+		return err
+	}
+
 	if err = commandEnv.confirmIsLocked(args); err != nil {
 		return
 	}
@@ -90,7 +112,7 @@ func (c *commandVolumeTierUpload) Do(args []string, commandEnv *CommandEnv, writ
 
 	// volumeId is provided
 	if vid != 0 {
-		return doVolumeTierUpload(commandEnv, writer, *collection, vid, *dest, *keepLocalDatFile)
+		return doVolumeTierUpload(commandEnv, writer, *collection, vid, *dest, *keepLocalDatFile, *concurrency)
 	}
 
 	var diskType *types.DiskType
@@ -107,7 +129,7 @@ func (c *commandVolumeTierUpload) Do(args []string, commandEnv *CommandEnv, writ
 	}
 	fmt.Printf("tier upload volumes: %v\n", volumeIds)
 	for _, vid := range volumeIds {
-		if err = doVolumeTierUpload(commandEnv, writer, *collection, vid, *dest, *keepLocalDatFile); err != nil {
+		if err = doVolumeTierUpload(commandEnv, writer, *collection, vid, *dest, *keepLocalDatFile, *concurrency); err != nil {
 			return err
 		}
 	}
@@ -115,29 +137,39 @@ func (c *commandVolumeTierUpload) Do(args []string, commandEnv *CommandEnv, writ
 	return nil
 }
 
-func doVolumeTierUpload(commandEnv *CommandEnv, writer io.Writer, collection string, vid needle.VolumeId, dest string, keepLocalDatFile bool) (err error) {
+func doVolumeTierUpload(commandEnv *CommandEnv, writer io.Writer, collectionPattern string, vid needle.VolumeId, dest string, keepLocalDatFile bool, concurrency int) (err error) {
 	// find volume location
 	topoInfo, _, err := collectTopologyInfo(commandEnv, 0)
 	if err != nil {
 		return fmt.Errorf("collect topology info: %v", err)
 	}
 
+	// The volume server verifies the request's collection against the volume's
+	// own, so the pattern must resolve to the actual collection here.
+	collection, found, err := findVolumeCollection(topoInfo, vid, collectionPattern)
+	if err != nil {
+		return err
+	}
+	if !found {
+		if collectionPattern == "" {
+			return fmt.Errorf("volume %d not found", vid)
+		}
+		return fmt.Errorf("volume %d not found in collections matching %s", vid, collectionPattern)
+	}
+
 	existingLocations := collectVolumeTierUploadLocations(topoInfo, vid, collection, writer)
 
 	if len(existingLocations) == 0 {
-		if collection == "" {
-			return fmt.Errorf("volume %d not found", vid)
-		}
-		return fmt.Errorf("volume %d not found in collection %s", vid, collection)
+		return fmt.Errorf("volume %d has no replicas in collection %s", vid, collection)
 	}
 
-	err = markVolumeReplicasWritable(context.Background(), commandEnv.option.GrpcDialOption, vid, existingLocations, false, false)
+	_, err = markVolumeReplicasWritable(context.Background(), commandEnv.option.GrpcDialOption, vid, existingLocations, false, false)
 	if err != nil {
 		return fmt.Errorf("mark volume %d as readonly on %s: %v", vid, existingLocations[0].Url, err)
 	}
 
 	// copy the .dat file to remote tier
-	err = uploadDatToRemoteTier(commandEnv.option.GrpcDialOption, writer, vid, collection, existingLocations[0].ServerAddress(), dest, keepLocalDatFile)
+	err = uploadDatToRemoteTier(commandEnv.option.GrpcDialOption, writer, vid, collection, existingLocations[0].ServerAddress(), dest, keepLocalDatFile, concurrency)
 	if err != nil {
 		return fmt.Errorf("copy dat file for volume %d on %s to %s: %v", vid, existingLocations[0].Url, dest, err)
 	}
@@ -153,7 +185,7 @@ func doVolumeTierUpload(commandEnv *CommandEnv, writer io.Writer, collection str
 			continue
 		}
 		fmt.Fprintf(writer, "replicate remote volume %d metadata from %s to %s\n", vid, existingLocations[0].Url, location.Url)
-		err = replicateVolumeToServer(context.Background(), commandEnv.option.GrpcDialOption, writer, vid, existingLocations[0].ServerAddress(), location.ServerAddress(), "")
+		err = replicateVolumeToServer(context.Background(), commandEnv.option.GrpcDialOption, writer, vid, existingLocations[0].ServerAddress(), location.ServerAddress(), "", 0)
 		if err != nil {
 			return fmt.Errorf("replicate volume %d from %s to %s: %v", vid, existingLocations[0].Url, location.Url, err)
 		}
@@ -170,7 +202,7 @@ func collectVolumeTierUploadLocations(topoInfo *master_pb.TopologyInfo, vid need
 	eachDataNode(topoInfo, func(dc DataCenterId, rack RackId, dn *master_pb.DataNodeInfo) {
 		for _, disk := range dn.DiskInfos {
 			for _, vi := range disk.VolumeInfos {
-				if needle.VolumeId(vi.Id) == vid && (collection == "" || vi.Collection == collection) {
+				if needle.VolumeId(vi.Id) == vid && vi.Collection == collection {
 					fmt.Fprintf(writer, "find volume %d from Url:%s, GrpcPort:%d, DC:%s\n", vid, dn.Id, dn.GrpcPort, string(dc))
 					loc := wdclient.Location{
 						Url:        dn.Id,
@@ -178,7 +210,7 @@ func collectVolumeTierUploadLocations(topoInfo *master_pb.TopologyInfo, vid need
 						GrpcPort:   int(dn.GrpcPort),
 						DataCenter: string(dc),
 					}
-					if vi.RemoteStorageKey != "" {
+					if vi.RemoteStorageName != "" {
 						tiered = append(tiered, loc)
 					} else {
 						local = append(local, loc)
@@ -190,7 +222,7 @@ func collectVolumeTierUploadLocations(topoInfo *master_pb.TopologyInfo, vid need
 	return append(tiered, local...)
 }
 
-func uploadDatToRemoteTier(grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, collection string, sourceVolumeServer pb.ServerAddress, dest string, keepLocalDatFile bool) error {
+func uploadDatToRemoteTier(grpcDialOption grpc.DialOption, writer io.Writer, volumeId needle.VolumeId, collection string, sourceVolumeServer pb.ServerAddress, dest string, keepLocalDatFile bool, concurrency int) error {
 
 	err := operation.WithVolumeServerClient(true, sourceVolumeServer, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
 		stream, copyErr := volumeServerClient.VolumeTierMoveDatToRemote(context.Background(), &volume_server_pb.VolumeTierMoveDatToRemoteRequest{
@@ -198,6 +230,7 @@ func uploadDatToRemoteTier(grpcDialOption grpc.DialOption, writer io.Writer, vol
 			Collection:             collection,
 			DestinationBackendName: dest,
 			KeepLocalDatFile:       keepLocalDatFile,
+			Concurrency:            int32(concurrency),
 		})
 
 		if stream == nil {
diff --git a/weed/shell/command_volume_vacuum.go b/weed/shell/command_volume_vacuum.go
index 34f7870d9b..c1ee55d0c3 100644
--- a/weed/shell/command_volume_vacuum.go
+++ b/weed/shell/command_volume_vacuum.go
@@ -5,11 +5,18 @@ import (
 	"flag"
 	"fmt"
 	"io"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
+	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+	"google.golang.org/grpc"
 )
 
 func init() {
@@ -28,6 +35,9 @@ func (c *commandVacuum) Help() string {
 
 	volume.vacuum [-garbageThreshold=0.3] [-collection=<collection name>] [-volumeId=<volume id>]
 
+	Without -volumeId this runs the same sweep as the automatic vacuum, which skips
+	read-only volumes. Name a read-only volume with -volumeId to vacuum it anyway.
+
 `
 }
 
@@ -39,12 +49,17 @@ func (c *commandVacuum) Do(args []string, commandEnv *CommandEnv, writer io.Writ
 
 	volumeVacuumCommand := flag.NewFlagSet(c.Name(), flag.ContinueOnError)
 	garbageThreshold := volumeVacuumCommand.Float64("garbageThreshold", 0.3, "vacuum when garbage is more than this limit")
-	collection := volumeVacuumCommand.String("collection", "", "vacuum this collection")
+	collection := volumeVacuumCommand.String("collection", "", "comma-separated collection names, wildcards, or regex patterns; empty or \"*\" matches all, \""+CollectionDefault+"\" the collection with no name")
 	volumeIds := volumeVacuumCommand.String("volumeId", "", "comma-separated list of volume IDs")
 	if err = volumeVacuumCommand.Parse(args); err != nil {
 		return nil
 	}
 
+	collectionMatcher, err := wildcard.CompileCollectionMatcher(*collection)
+	if err != nil {
+		return fmt.Errorf("invalid collection pattern %q: %w", *collection, err)
+	}
+
 	if err = commandEnv.confirmIsLocked(args); err != nil {
 		return
 	}
@@ -63,15 +78,20 @@ func (c *commandVacuum) Do(args []string, commandEnv *CommandEnv, writer io.Writ
 		volumeIdInts = append(volumeIdInts, 0)
 	}
 
+	topo, _, err := collectTopologyInfo(commandEnv, 0)
+	if err != nil {
+		if *volumeIds != "" {
+			return fmt.Errorf("collect topology: %w", err)
+		}
+		// The hint below is a courtesy; a sweep must not depend on it.
+		fmt.Fprintf(writer, "could not list volumes to check for read-only ones: %v\n", err)
+	}
+
 	// Reject unknown ids up front. The master's VacuumVolume RPC silently
 	// iterates matching volumes, so a typo or an already-deleted volume just
 	// returns success — making this command look like it worked when nothing
 	// happened.
 	if *volumeIds != "" {
-		topo, _, err := collectTopologyInfo(commandEnv, 0)
-		if err != nil {
-			return fmt.Errorf("collect topology: %w", err)
-		}
 		known := make(map[uint32]bool)
 		eachDataNode(topo, func(_ DataCenterId, _ RackId, dn *master_pb.DataNodeInfo) {
 			for _, disk := range dn.DiskInfos {
@@ -96,15 +116,44 @@ func (c *commandVacuum) Do(args []string, commandEnv *CommandEnv, writer io.Writ
 			sort.Slice(missing, func(i, j int) bool { return missing[i] < missing[j] })
 			return fmt.Errorf("volume(s) not found on master: %v", missing)
 		}
+	} else if topo != nil {
+		// The sweep says nothing about the volumes it leaves alone, so an
+		// operator on a full disk sees the command return and nothing change.
+		if skipped := readOnlyVolumesAboveThreshold(topo, collectionMatcher, *garbageThreshold); len(skipped) > 0 {
+			fmt.Fprintf(writer, "%d read-only volume(s) hold garbage above %g and are skipped by the sweep: %v\n", len(skipped), *garbageThreshold, skipped)
+			fmt.Fprintf(writer, "vacuum them explicitly with -volumeId\n")
+		}
 	}
 
-	for _, volumeId := range volumeIdInts {
-		err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-			_, err = client.VacuumVolume(context.Background(), &master_pb.VacuumVolumeRequest{
-				GarbageThreshold: float32(*garbageThreshold),
-				VolumeId:         volumeId,
-				Collection:       *collection,
+	// The VacuumVolume RPC takes one exact collection name per call and reads
+	// "" as "all collections", so a filter has to be resolved here: one request
+	// per matched named collection, and per-volume requests for the unnamed
+	// collection, which no Collection value selects on its own.
+	var requests []*master_pb.VacuumVolumeRequest
+	if collectionMatcher == nil {
+		for _, volumeId := range volumeIdInts {
+			requests = append(requests, &master_pb.VacuumVolumeRequest{
+				VolumeId: volumeId,
 			})
+		}
+	} else {
+		if topo == nil {
+			return fmt.Errorf("cannot resolve collection pattern %q: topology unavailable", *collection)
+		}
+		if *volumeIds != "" {
+			requests, err = vacuumRequestsForVolumeIds(topo, collectionMatcher, volumeIdInts)
+		} else {
+			requests, err = vacuumRequestsForPattern(commandEnv.option.GrpcDialOption, writer, topo, collectionMatcher)
+		}
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, req := range requests {
+		req.GarbageThreshold = float32(*garbageThreshold)
+		err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
+			_, err = client.VacuumVolume(context.Background(), req)
 			return err
 		})
 		if err != nil {
@@ -114,3 +163,175 @@ func (c *commandVacuum) Do(args []string, commandEnv *CommandEnv, writer io.Writ
 
 	return nil
 }
+
+// vidReplica pairs a volume replica's read-only state with the server that
+// reports it, so the unnamed-collection sweep can reproduce the master's
+// low-disk-space exception client-side.
+type vidReplica struct {
+	server   pb.ServerAddress
+	readOnly bool
+}
+
+// vacuumRequestsForPattern resolves a collection filter to the sweep requests
+// that cover it: one per matched named collection, which keeps the server's
+// read-only skip, plus per-volume requests for the unnamed collection — no
+// Collection value scopes the RPC to it alone.
+func vacuumRequestsForPattern(grpcDialOption grpc.DialOption, writer io.Writer, topo *master_pb.TopologyInfo, collectionMatcher *wildcard.CollectionMatcher) ([]*master_pb.VacuumVolumeRequest, error) {
+	collections := make(map[string]bool)
+	defaultReplicas := make(map[uint32][]vidReplica)
+	eachDataNode(topo, func(_ DataCenterId, _ RackId, dn *master_pb.DataNodeInfo) {
+		for _, disk := range dn.DiskInfos {
+			for _, v := range disk.VolumeInfos {
+				if !collectionMatcher.Matches(v.Collection) {
+					continue
+				}
+				collections[v.Collection] = true
+				if v.Collection == "" {
+					defaultReplicas[v.Id] = append(defaultReplicas[v.Id], vidReplica{
+						server:   pb.NewServerAddressFromDataNode(dn),
+						readOnly: v.ReadOnly,
+					})
+				}
+			}
+		}
+	})
+	if len(collections) == 0 {
+		return nil, fmt.Errorf("no volumes found in collections matching the filter")
+	}
+
+	var requests []*master_pb.VacuumVolumeRequest
+	for name := range collections {
+		if name != "" {
+			requests = append(requests, &master_pb.VacuumVolumeRequest{Collection: name})
+		}
+	}
+	// The unnamed collection has no scoping name, so each of its volumes gets
+	// a per-volume request — which also vacuums any other collection sharing
+	// the id. A volume whose every replica is read-only is skipped unless a
+	// replica reports low disk space, the sweep's own exception.
+	var defaultVids []uint32
+	for vid, replicas := range defaultReplicas {
+		writable := false
+		for _, r := range replicas {
+			if !r.readOnly {
+				writable = true
+				break
+			}
+		}
+		if !writable && !anyReplicaDiskSpaceLow(grpcDialOption, replicas, vid, writer) {
+			continue
+		}
+		defaultVids = append(defaultVids, vid)
+	}
+	sort.Slice(defaultVids, func(i, j int) bool { return defaultVids[i] < defaultVids[j] })
+	for _, vid := range defaultVids {
+		requests = append(requests, &master_pb.VacuumVolumeRequest{VolumeId: vid})
+	}
+	return requests, nil
+}
+
+// anyReplicaDiskSpaceLow probes read-only replicas for the low-disk condition
+// under which the master's sweep still vacuums a read-only volume.
+func anyReplicaDiskSpaceLow(grpcDialOption grpc.DialOption, replicas []vidReplica, vid uint32, writer io.Writer) bool {
+	for _, r := range replicas {
+		diskSpaceLow := false
+		err := operation.WithVolumeServerClient(false, r.server, grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			resp, checkErr := client.VacuumVolumeCheck(ctx, &volume_server_pb.VacuumVolumeCheckRequest{VolumeId: vid})
+			if checkErr != nil {
+				return checkErr
+			}
+			diskSpaceLow = resp.DiskSpaceLow
+			return nil
+		})
+		if err != nil {
+			fmt.Fprintf(writer, "volume %d on %s: cannot check disk space: %v\n", vid, r.server, err)
+			continue
+		}
+		if diskSpaceLow {
+			return true
+		}
+	}
+	return false
+}
+
+// vacuumRequestsForVolumeIds scopes each requested volume to the collections
+// it lives in that the filter matches, so -volumeId and a pattern narrow each
+// other the same way the server narrows an exact -collection name.
+func vacuumRequestsForVolumeIds(topo *master_pb.TopologyInfo, collectionMatcher *wildcard.CollectionMatcher, volumeIdInts []uint32) ([]*master_pb.VacuumVolumeRequest, error) {
+	collectionsByVid := make(map[uint32]map[string]bool)
+	eachDataNode(topo, func(_ DataCenterId, _ RackId, dn *master_pb.DataNodeInfo) {
+		for _, disk := range dn.DiskInfos {
+			for _, v := range disk.VolumeInfos {
+				if collectionsByVid[v.Id] == nil {
+					collectionsByVid[v.Id] = make(map[string]bool)
+				}
+				collectionsByVid[v.Id][v.Collection] = true
+			}
+		}
+	})
+
+	var requests []*master_pb.VacuumVolumeRequest
+	for _, vid := range volumeIdInts {
+		var matched []string
+		for name := range collectionsByVid[vid] {
+			if collectionMatcher.Matches(name) {
+				matched = append(matched, name)
+			}
+		}
+		if len(matched) == 0 {
+			return nil, fmt.Errorf("volume %d is not in a collection matching the filter", vid)
+		}
+		// The unnamed collection has no scoping name; a volume-id-only request
+		// covers it (and any other collection the id is shared into).
+		if slices.Contains(matched, "") {
+			requests = append(requests, &master_pb.VacuumVolumeRequest{VolumeId: vid})
+			continue
+		}
+		sort.Strings(matched)
+		for _, name := range matched {
+			requests = append(requests, &master_pb.VacuumVolumeRequest{VolumeId: vid, Collection: name})
+		}
+	}
+	return requests, nil
+}
+
+// readOnlyVolumesAboveThreshold lists the volumes a sweep leaves alone: any
+// replica read-only (that is what the sweep checks), in the collection when one
+// is given, and some replica with a garbage ratio at or above the threshold.
+// The ratio uses the sizes the master reports, which is deleted bytes over the
+// .dat size rather than over the content size the volume server divides by, so
+// it can only understate, and a converted index that reports deletes without
+// their sizes is left out because its ratio is not knowable here. This is a
+// hint; the volume server's own check decides.
+func readOnlyVolumesAboveThreshold(topo *master_pb.TopologyInfo, collectionMatcher *wildcard.CollectionMatcher, garbageThreshold float64) []uint32 {
+	readOnly := make(map[uint32]bool)
+	garbage := make(map[uint32]float64) // the highest ratio any replica reports
+	eachDataNode(topo, func(_ DataCenterId, _ RackId, dn *master_pb.DataNodeInfo) {
+		for _, disk := range dn.DiskInfos {
+			for _, v := range disk.VolumeInfos {
+				if !collectionMatcher.Matches(v.Collection) {
+					continue
+				}
+				if v.ReadOnly {
+					readOnly[v.Id] = true
+				}
+				if v.Size == 0 {
+					continue
+				}
+				if ratio := float64(v.DeletedByteCount) / float64(v.Size); ratio > garbage[v.Id] {
+					garbage[v.Id] = ratio
+				}
+			}
+		}
+	})
+	vids := make([]uint32, 0, len(readOnly))
+	for vid := range readOnly {
+		if garbage[vid] >= garbageThreshold {
+			vids = append(vids, vid)
+		}
+	}
+	sort.Slice(vids, func(i, j int) bool { return vids[i] < vids[j] })
+	return vids
+}
diff --git a/weed/shell/command_volume_vacuum_disable.go b/weed/shell/command_volume_vacuum_disable.go
index 15897ddb0c..436e963ff7 100644
--- a/weed/shell/command_volume_vacuum_disable.go
+++ b/weed/shell/command_volume_vacuum_disable.go
@@ -36,7 +36,7 @@ func (c *commandDisableVacuum) Do(args []string, commandEnv *CommandEnv, writer
 		return
 	}
 
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		_, err = client.DisableVacuum(context.Background(), &master_pb.DisableVacuumRequest{})
 		return err
 	})
diff --git a/weed/shell/command_volume_vacuum_enable.go b/weed/shell/command_volume_vacuum_enable.go
index b8f779b143..0d5104e9d7 100644
--- a/weed/shell/command_volume_vacuum_enable.go
+++ b/weed/shell/command_volume_vacuum_enable.go
@@ -36,7 +36,7 @@ func (c *commandEnableVacuum) Do(args []string, commandEnv *CommandEnv, writer i
 		return
 	}
 
-	err = commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	err = commandEnv.MasterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 		_, err = client.EnableVacuum(context.Background(), &master_pb.EnableVacuumRequest{})
 		return err
 	})
diff --git a/weed/shell/command_volume_vacuum_test.go b/weed/shell/command_volume_vacuum_test.go
new file mode 100644
index 0000000000..dba71cf933
--- /dev/null
+++ b/weed/shell/command_volume_vacuum_test.go
@@ -0,0 +1,158 @@
+package shell
+
+import (
+	"io"
+	"reflect"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+)
+
+func vacuumTestTopology(nodes ...*master_pb.DataNodeInfo) *master_pb.TopologyInfo {
+	return &master_pb.TopologyInfo{
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			RackInfos: []*master_pb.RackInfo{{DataNodeInfos: nodes}},
+		}},
+	}
+}
+
+func vacuumTestNode(volumes ...*master_pb.VolumeInformationMessage) *master_pb.DataNodeInfo {
+	return &master_pb.DataNodeInfo{
+		DiskInfos: map[string]*master_pb.DiskInfo{"": {VolumeInfos: volumes}},
+	}
+}
+
+func TestReadOnlyVolumesAboveThreshold(t *testing.T) {
+	readOnlyHalfGarbage := &master_pb.VolumeInformationMessage{Id: 1, Collection: "a", Size: 100, DeletedByteCount: 50, ReadOnly: true}
+	writableMostlyGarbage := &master_pb.VolumeInformationMessage{Id: 2, Collection: "a", Size: 100, DeletedByteCount: 90}
+	readOnlyLittleGarbage := &master_pb.VolumeInformationMessage{Id: 3, Collection: "a", Size: 100, DeletedByteCount: 10, ReadOnly: true}
+	readOnlyOtherCollection := &master_pb.VolumeInformationMessage{Id: 4, Collection: "b", Size: 100, DeletedByteCount: 100, ReadOnly: true}
+	readOnlyEmpty := &master_pb.VolumeInformationMessage{Id: 5, Collection: "a", Size: 0, DeletedByteCount: 0, ReadOnly: true}
+	readOnlyAtThreshold := &master_pb.VolumeInformationMessage{Id: 6, Collection: "a", Size: 100, DeletedByteCount: 30, ReadOnly: true}
+	// the sweep skips a volume when any replica is read-only, and the garbage
+	// may sit on the other replica
+	mixedReadOnlyReplica := &master_pb.VolumeInformationMessage{Id: 7, Collection: "a", Size: 100, DeletedByteCount: 5, ReadOnly: true}
+	mixedWritableReplica := &master_pb.VolumeInformationMessage{Id: 7, Collection: "a", Size: 100, DeletedByteCount: 60}
+	// a converted index reports deletes without their sizes; the ratio is not
+	// knowable from here, so it is not listed
+	readOnlyConvertedIndex := &master_pb.VolumeInformationMessage{Id: 8, Collection: "a", Size: 100, DeleteCount: 2, DeletedByteCount: 0, ReadOnly: true}
+
+	topo := vacuumTestTopology(
+		vacuumTestNode(readOnlyHalfGarbage, writableMostlyGarbage, readOnlyLittleGarbage, readOnlyEmpty, readOnlyAtThreshold, mixedReadOnlyReplica, readOnlyConvertedIndex),
+		// the second replica of volume 1 must not list it twice
+		vacuumTestNode(readOnlyHalfGarbage, readOnlyOtherCollection, mixedWritableReplica),
+	)
+
+	matcherA, err := wildcard.CompileCollectionMatcher("a")
+	if err != nil {
+		t.Fatalf("compile matcher: %v", err)
+	}
+
+	got := readOnlyVolumesAboveThreshold(topo, matcherA, 0.3)
+	if want := []uint32{1, 6, 7}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("collection a, threshold 0.3: got %v, want %v", got, want)
+	}
+
+	got = readOnlyVolumesAboveThreshold(topo, nil, 0.3)
+	if want := []uint32{1, 4, 6, 7}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("all collections, threshold 0.3: got %v, want %v", got, want)
+	}
+
+	if got := readOnlyVolumesAboveThreshold(topo, matcherA, 0.95); len(got) != 0 {
+		t.Fatalf("threshold 0.95: got %v, want none", got)
+	}
+}
+
+func mustMatcher(t *testing.T, filter string) *wildcard.CollectionMatcher {
+	t.Helper()
+	m, err := wildcard.CompileCollectionMatcher(filter)
+	if err != nil {
+		t.Fatalf("compile %q: %v", filter, err)
+	}
+	return m
+}
+
+func TestVacuumRequestsForPattern(t *testing.T) {
+	node := vacuumTestNode(
+		&master_pb.VolumeInformationMessage{Id: 1, Collection: "a", Size: 100},
+		&master_pb.VolumeInformationMessage{Id: 2, Collection: "", Size: 100},
+		// read-only volumes stay out of the unnamed-collection sweep, the
+		// same as the server skips them on a named-collection sweep — the
+		// unreachable address keeps the low-disk probe a fast miss
+		&master_pb.VolumeInformationMessage{Id: 3, Collection: "", Size: 100, ReadOnly: true},
+		&master_pb.VolumeInformationMessage{Id: 4, Collection: "b", Size: 100},
+	)
+	node.Id = "localhost:1"
+	topo := vacuumTestTopology(node)
+
+	// A named collection sweeps as a single collection-scoped request.
+	reqs, err := vacuumRequestsForPattern(nil, io.Discard, topo, mustMatcher(t, "a"))
+	if err != nil {
+		t.Fatalf("pattern a: %v", err)
+	}
+	if len(reqs) != 1 || reqs[0].Collection != "a" || reqs[0].VolumeId != 0 {
+		t.Fatalf("pattern a: got %v, want one collection-a sweep request", reqs)
+	}
+
+	// Patterns cover several named collections.
+	reqs, err = vacuumRequestsForPattern(nil, io.Discard, topo, mustMatcher(t, "a,b"))
+	if err != nil {
+		t.Fatalf("pattern a,b: %v", err)
+	}
+	names := map[string]bool{}
+	for _, r := range reqs {
+		names[r.Collection] = true
+	}
+	if len(reqs) != 2 || !names["a"] || !names["b"] {
+		t.Fatalf("pattern a,b: got %v, want sweeps for a and b", reqs)
+	}
+
+	// The unnamed collection resolves to per-volume requests — no Collection
+	// value selects it alone, and the read-only volume is skipped because the
+	// probe cannot confirm low disk space.
+	reqs, err = vacuumRequestsForPattern(nil, io.Discard, topo, mustMatcher(t, CollectionDefault))
+	if err != nil {
+		t.Fatalf("%s: %v", CollectionDefault, err)
+	}
+	if len(reqs) != 1 || reqs[0].VolumeId != 2 || reqs[0].Collection != "" {
+		t.Fatalf("%s: got %v, want one per-volume request for volume 2", CollectionDefault, reqs)
+	}
+
+	// A filter hitting nothing is an error, not a silent no-op.
+	if _, err = vacuumRequestsForPattern(nil, io.Discard, topo, mustMatcher(t, "missing")); err == nil {
+		t.Fatal("expected an error for a filter matching no collection")
+	}
+}
+
+func TestVacuumRequestsForVolumeIds(t *testing.T) {
+	topo := vacuumTestTopology(
+		vacuumTestNode(
+			&master_pb.VolumeInformationMessage{Id: 1, Collection: "a"},
+			&master_pb.VolumeInformationMessage{Id: 2, Collection: ""},
+		),
+	)
+
+	// A matching name scopes the request to that collection.
+	reqs, err := vacuumRequestsForVolumeIds(topo, mustMatcher(t, "a"), []uint32{1})
+	if err != nil {
+		t.Fatalf("vid 1 in a: %v", err)
+	}
+	if len(reqs) != 1 || reqs[0].VolumeId != 1 || reqs[0].Collection != "a" {
+		t.Fatalf("vid 1 in a: got %v, want {VolumeId:1, Collection:a}", reqs)
+	}
+
+	// The unnamed collection sends a volume-id-only request.
+	reqs, err = vacuumRequestsForVolumeIds(topo, mustMatcher(t, CollectionDefault), []uint32{2})
+	if err != nil {
+		t.Fatalf("vid 2 in default: %v", err)
+	}
+	if len(reqs) != 1 || reqs[0].VolumeId != 2 || reqs[0].Collection != "" {
+		t.Fatalf("vid 2 in default: got %v, want {VolumeId:2}", reqs)
+	}
+
+	// A volume outside the filter is an error.
+	if _, err = vacuumRequestsForVolumeIds(topo, mustMatcher(t, "a"), []uint32{2}); err == nil {
+		t.Fatal("expected an error for a volume outside the filter")
+	}
+}
diff --git a/weed/shell/commands.go b/weed/shell/commands.go
index 896a2d81b4..43b681d4d7 100644
--- a/weed/shell/commands.go
+++ b/weed/shell/commands.go
@@ -4,7 +4,10 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"math/rand/v2"
+	"os"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/cluster"
@@ -26,12 +29,13 @@ type ShellOptions struct {
 	Masters        *string
 	GrpcDialOption grpc.DialOption
 	// shell transient context
-	FilerHost    string
-	FilerPort    int64
-	FilerGroup   *string
-	FilerAddress pb.ServerAddress
-	Directory    string
-	Debug        bool
+	FilerHost      string
+	FilerPort      int64
+	FilerGroup     *string
+	FilerAddress   pb.ServerAddress
+	Directory      string
+	Debug          bool
+	ConnectTimeout time.Duration
 }
 
 type CommandEnv struct {
@@ -42,6 +46,7 @@ type CommandEnv struct {
 	noLock       bool
 	forceNoLock  bool
 	verbose      bool
+	filerMu      sync.Mutex
 }
 
 func NewCommandEnv(options *ShellOptions) *CommandEnv {
@@ -112,11 +117,11 @@ func (ce *CommandEnv) isLocked() bool {
 
 // shellLockHolder asks the master who currently holds the cluster-wide shell
 // lock. Best effort: masters without GetAdminLockStatus report no holder, and
-// each attempt is bounded so an unresponsive master cannot hang the shell.
+// the lookup is bounded so an unresponsive master cannot hang the shell.
 func (ce *CommandEnv) shellLockHolder() (clientName string, message string, held bool) {
-	ce.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-		attemptCtx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
-		defer cancel()
+	attemptCtx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	ce.MasterClient.WithClient(attemptCtx, false, func(client master_pb.SeaweedClient) error {
 		resp, err := client.GetAdminLockStatus(attemptCtx, &master_pb.GetAdminLockStatusRequest{
 			LockName: cluster.AdminShellLockName,
 		})
@@ -146,10 +151,75 @@ var _ = filer_pb.FilerClient(&CommandEnv{})
 
 func (ce *CommandEnv) WithFilerClient(streamingMode bool, fn func(filer_pb.SeaweedFilerClient) error) error {
 
-	return pb.WithGrpcFilerClient(streamingMode, 0, ce.option.FilerAddress, ce.option.GrpcDialOption, fn)
+	return pb.WithGrpcFilerClient(streamingMode, 0, ce.FilerAddress(), ce.option.GrpcDialOption, fn)
 
 }
 
+// FilerAddress returns the discovered or configured filer, running discovery
+// on first use so commands that never need a filer skip the wait entirely.
+// A failed or empty discovery is not cached: each later call retries until a
+// filer registers, so a long-lived shell can still find one.
+func (ce *CommandEnv) FilerAddress() pb.ServerAddress {
+	ce.filerMu.Lock()
+	defer ce.filerMu.Unlock()
+	ce.discoverFiler()
+	return ce.option.FilerAddress
+}
+
+func (ce *CommandEnv) discoverFiler() {
+	if ce.option.FilerAddress != "" || ce.MasterClient == nil || ce.option.FilerGroup == nil {
+		return
+	}
+	connectTimeout := ce.option.ConnectTimeout
+	if connectTimeout <= 0 {
+		connectTimeout = 30 * time.Second
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), connectTimeout)
+	defer cancel()
+	var filers []pb.ServerAddress
+	var listErr error
+	for len(filers) == 0 && ctx.Err() == nil {
+		filers = filers[:0]
+		listErr = ce.MasterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+			resp, err := client.ListClusterNodes(ctx, &master_pb.ListClusterNodesRequest{
+				ClientType: cluster.FilerType,
+				FilerGroup: *ce.option.FilerGroup,
+			})
+			if err != nil {
+				return err
+			}
+
+			for _, clusterNode := range resp.ClusterNodes {
+				filers = append(filers, pb.ServerAddress(clusterNode.Address))
+			}
+			return nil
+		})
+		if len(filers) == 0 {
+			if listErr != nil && !util.IsTransientError(listErr) {
+				break
+			}
+			select {
+			case <-ctx.Done():
+			case <-time.After(time.Second):
+			}
+		}
+	}
+	if len(filers) > 0 {
+		ce.option.FilerAddress = filers[rand.IntN(len(filers))]
+	} else if listErr != nil {
+		fmt.Fprintf(os.Stderr, "cannot list filers from master %s: %v\n", *ce.option.Masters, listErr)
+	} else {
+		fmt.Fprintf(os.Stderr, "no filer registered with master %s within %s\n", *ce.option.Masters, connectTimeout)
+	}
+	if ce.option.Debug {
+		if len(filers) > 0 {
+			fmt.Fprintf(os.Stderr, "master: %s filers: %v\n", *ce.option.Masters, filers)
+		} else {
+			fmt.Fprintf(os.Stderr, "master: %s\n", *ce.option.Masters)
+		}
+	}
+}
+
 func (ce *CommandEnv) AdjustedUrl(location *filer_pb.Location) string {
 	return location.Url
 }
diff --git a/weed/shell/commands_test.go b/weed/shell/commands_test.go
new file mode 100644
index 0000000000..8456413b7a
--- /dev/null
+++ b/weed/shell/commands_test.go
@@ -0,0 +1,159 @@
+package shell
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+)
+
+type fakeDiscoveryServer struct {
+	master_pb.UnimplementedSeaweedServer
+	leader  string
+	filers  atomic.Int32
+	listErr atomic.Value
+}
+
+func (s *fakeDiscoveryServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServer) error {
+	if _, err := stream.Recv(); err != nil {
+		return err
+	}
+	if err := stream.Send(&master_pb.KeepConnectedResponse{
+		VolumeLocation: &master_pb.VolumeLocation{Leader: s.leader},
+	}); err != nil {
+		return err
+	}
+	<-stream.Context().Done()
+	return nil
+}
+
+func (s *fakeDiscoveryServer) ListClusterNodes(context.Context, *master_pb.ListClusterNodesRequest) (*master_pb.ListClusterNodesResponse, error) {
+	if err, _ := s.listErr.Load().(error); err != nil {
+		return nil, err
+	}
+	resp := &master_pb.ListClusterNodesResponse{}
+	for i := int32(0); i < s.filers.Load(); i++ {
+		resp.ClusterNodes = append(resp.ClusterNodes, &master_pb.ListClusterNodesResponse_ClusterNode{
+			Address: fmt.Sprintf("127.0.0.1:88%02d", i),
+		})
+	}
+	return resp, nil
+}
+
+func startFakeDiscoveryMaster(t *testing.T, srv *fakeDiscoveryServer) string {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	grpcServer := grpc.NewServer()
+	master_pb.RegisterSeaweedServer(grpcServer, srv)
+	go func() { _ = grpcServer.Serve(lis) }()
+	t.Cleanup(grpcServer.GracefulStop)
+
+	_, port, _ := net.SplitHostPort(lis.Addr().String())
+	return fmt.Sprintf("127.0.0.1:0.%s", port)
+}
+
+func discoveryEnv(addr string, timeout time.Duration) (*CommandEnv, context.CancelFunc) {
+	masters := addr
+	filerGroup := ""
+	options := &ShellOptions{
+		Masters:        &masters,
+		GrpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+		FilerGroup:     &filerGroup,
+		Directory:      "/",
+		ConnectTimeout: timeout,
+	}
+	ce := NewCommandEnv(options)
+	ctx, cancel := context.WithCancel(context.Background())
+	go ce.MasterClient.KeepConnectedToMaster(ctx)
+	ce.MasterClient.WaitUntilConnected(ctx)
+	return ce, cancel
+}
+
+func TestFilerDiscoveryRetriesUntilFilerAppears(t *testing.T) {
+	srv := &fakeDiscoveryServer{}
+	addr := startFakeDiscoveryMaster(t, srv)
+	srv.leader = addr
+
+	ce, cancel := discoveryEnv(addr, 10*time.Second)
+	defer cancel()
+
+	go func() {
+		time.Sleep(1200 * time.Millisecond)
+		srv.filers.Store(1)
+	}()
+
+	got := ce.FilerAddress()
+	if got != "127.0.0.1:8800" {
+		t.Fatalf("expected the late-registering filer, got %q", got)
+	}
+}
+
+func TestFilerDiscoveryReturnsEmptyAtDeadline(t *testing.T) {
+	srv := &fakeDiscoveryServer{}
+	addr := startFakeDiscoveryMaster(t, srv)
+	srv.leader = addr
+
+	ce, cancel := discoveryEnv(addr, 1500*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	if got := ce.FilerAddress(); got != "" {
+		t.Fatalf("expected no filer, got %q", got)
+	}
+	if elapsed := time.Since(start); elapsed < time.Second {
+		t.Fatalf("discovery returned after %v, expected it to poll until the deadline", elapsed)
+	}
+}
+
+func TestFilerDiscoveryRetriesAfterEmptyResult(t *testing.T) {
+	srv := &fakeDiscoveryServer{}
+	addr := startFakeDiscoveryMaster(t, srv)
+	srv.leader = addr
+
+	ce, cancel := discoveryEnv(addr, 1500*time.Millisecond)
+	defer cancel()
+
+	if got := ce.FilerAddress(); got != "" {
+		t.Fatalf("expected no filer, got %q", got)
+	}
+	srv.filers.Store(1)
+	if got := ce.FilerAddress(); got != "127.0.0.1:8800" {
+		t.Fatalf("expected the late-registered filer on retry, got %q", got)
+	}
+}
+
+func TestFilerDiscoveryStopsOnNonTransientError(t *testing.T) {
+	srv := &fakeDiscoveryServer{}
+	addr := startFakeDiscoveryMaster(t, srv)
+	srv.leader = addr
+	srv.listErr.Store(status.Error(codes.PermissionDenied, "denied"))
+
+	ce, cancel := discoveryEnv(addr, 30*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	if got := ce.FilerAddress(); got != "" {
+		t.Fatalf("expected no filer, got %q", got)
+	}
+	if elapsed := time.Since(start); elapsed > 10*time.Second {
+		t.Fatalf("discovery kept polling a non-transient error for %v", elapsed)
+	}
+}
+
+func TestFilerAddressConfiguredSkipsDiscovery(t *testing.T) {
+	ce := &CommandEnv{option: &ShellOptions{FilerAddress: "127.0.0.1:8888"}}
+	if got := ce.FilerAddress(); got != "127.0.0.1:8888" {
+		t.Fatalf("expected the configured filer, got %q", got)
+	}
+}
diff --git a/weed/shell/common.go b/weed/shell/common.go
index 4357cdcde1..76d0b28ade 100644
--- a/weed/shell/common.go
+++ b/weed/shell/common.go
@@ -1,9 +1,8 @@
 package shell
 
 import (
-	"errors"
-	"fmt"
-	"sync"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 )
 
 var (
@@ -12,73 +11,22 @@ var (
 	// Default number of volumes EC encode/decode process per batch.
 	DefaultEcBatchSize = 10
 	// CollectionDefault is the special keyword to match empty collection names.
-	// Use "_default" to avoid collision with a literal collection named "default".
-	CollectionDefault = "_default"
+	CollectionDefault = wildcard.CollectionDefault
 )
 
-// ErrorWaitGroup implements a goroutine wait group which aggregates errors, if any.
-type ErrorWaitGroup struct {
-	maxConcurrency int
-	wg             *sync.WaitGroup
-	wgSem          chan bool
-	errors         []error
-	errorsMu       sync.Mutex
-}
-
-type ErrorWaitGroupTask func() error
-
-func NewErrorWaitGroup(maxConcurrency int) *ErrorWaitGroup {
-	if maxConcurrency <= 0 {
-		// no concurrency = one task at the time
-		maxConcurrency = 1
-	}
-	return &ErrorWaitGroup{
-		maxConcurrency: maxConcurrency,
-		wg:             &sync.WaitGroup{},
-		wgSem:          make(chan bool, maxConcurrency),
+// resolveCollectionName maps the shared "_default" keyword to the empty-named
+// collection for commands whose -collection flag names one collection rather
+// than filtering by a pattern.
+func resolveCollectionName(name string) string {
+	if name == CollectionDefault {
+		return ""
 	}
+	return name
 }
 
-// Reset restarts an ErrorWaitGroup, keeping original settings. Errors and pending goroutines, if any, are flushed.
-func (ewg *ErrorWaitGroup) Reset() {
-	close(ewg.wgSem)
+// ErrorWaitGroup lives in weed/util so packages outside the shell can share it.
+type ErrorWaitGroup = util.ErrorWaitGroup
+type ErrorWaitGroupTask = util.ErrorWaitGroupTask
 
-	ewg.wg = &sync.WaitGroup{}
-	ewg.wgSem = make(chan bool, ewg.maxConcurrency)
-	ewg.errors = nil
-}
-
-// Add queues an ErrorWaitGroupTask to be executed as a goroutine.
-func (ewg *ErrorWaitGroup) Add(f ErrorWaitGroupTask) {
-	if ewg.maxConcurrency <= 1 {
-		// keep run order deterministic when parallelization is off
-		ewg.errors = append(ewg.errors, f())
-		return
-	}
-
-	ewg.wg.Add(1)
-	go func() {
-		ewg.wgSem <- true
-
-		err := f()
-		ewg.errorsMu.Lock()
-		ewg.errors = append(ewg.errors, err)
-		ewg.errorsMu.Unlock()
-
-		<-ewg.wgSem
-		ewg.wg.Done()
-	}()
-}
-
-// AddErrorf adds an error to an ErrorWaitGroupTask result, without queueing any goroutines.
-func (ewg *ErrorWaitGroup) AddErrorf(format string, a ...interface{}) {
-	ewg.errorsMu.Lock()
-	ewg.errors = append(ewg.errors, fmt.Errorf(format, a...))
-	ewg.errorsMu.Unlock()
-}
-
-// Wait sleeps until all ErrorWaitGroupTasks are completed, then returns errors for them.
-func (ewg *ErrorWaitGroup) Wait() error {
-	ewg.wg.Wait()
-	return errors.Join(ewg.errors...)
-}
+var NewErrorWaitGroup = util.NewErrorWaitGroup
+var executeParallelTaskGroups = util.ExecuteParallelTaskGroups
diff --git a/weed/shell/ec_proportional_rebalance.go b/weed/shell/ec_proportional_rebalance.go
deleted file mode 100644
index 8d6b1c1b71..0000000000
--- a/weed/shell/ec_proportional_rebalance.go
+++ /dev/null
@@ -1,38 +0,0 @@
-package shell
-
-import (
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
-	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding/distribution"
-	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
-	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
-	"github.com/seaweedfs/seaweedfs/weed/storage/types"
-)
-
-// ECDistribution is an alias to the distribution package type for backward compatibility
-type ECDistribution = distribution.ECDistribution
-
-// TopologyDistributionAnalysis holds the current shard distribution analysis
-// This wraps the distribution package's TopologyAnalysis with shell-specific EcNode handling
-type TopologyDistributionAnalysis struct {
-	inner *distribution.TopologyAnalysis
-
-	// Shell-specific mappings
-	nodeMap map[string]*EcNode // nodeID -> EcNode
-}
-
-// ECShardMove represents a planned shard move (shell-specific with EcNode references)
-type ECShardMove struct {
-	VolumeId   needle.VolumeId
-	ShardId    erasure_coding.ShardId
-	SourceNode *EcNode
-	DestNode   *EcNode
-	Reason     string
-}
-
-// ProportionalECRebalancer implements proportional shard distribution for shell commands
-type ProportionalECRebalancer struct {
-	ecNodes          []*EcNode
-	replicaPlacement *super_block.ReplicaPlacement
-	diskType         types.DiskType
-	ecConfig         distribution.ECConfig
-}
diff --git a/weed/shell/s3tables_helpers.go b/weed/shell/s3tables_helpers.go
index d595a5af74..18c5f90a72 100644
--- a/weed/shell/s3tables_helpers.go
+++ b/weed/shell/s3tables_helpers.go
@@ -20,7 +20,7 @@ func withFilerClient(commandEnv *CommandEnv, fn func(client filer_pb.SeaweedFile
 	return pb.WithGrpcClient(context.Background(), false, 0, func(conn *grpc.ClientConn) error {
 		client := filer_pb.NewSeaweedFilerClient(conn)
 		return fn(client)
-	}, commandEnv.option.FilerAddress.ToGrpcAddress(), false, commandEnv.option.GrpcDialOption)
+	}, commandEnv.FilerAddress().ToGrpcAddress(), false, commandEnv.option.GrpcDialOption)
 }
 
 func executeS3Tables(commandEnv *CommandEnv, operation string, req interface{}, resp interface{}, accountID string) error {
diff --git a/weed/shell/shell_liner.go b/weed/shell/shell_liner.go
index aaeaf6ae25..303f2ab2ad 100644
--- a/weed/shell/shell_liner.go
+++ b/weed/shell/shell_liner.go
@@ -5,15 +5,12 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"math/rand/v2"
 	"os"
 	"path"
 	"slices"
 	"strings"
+	"time"
 
-	"github.com/seaweedfs/seaweedfs/weed/cluster"
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/util/grace"
 
@@ -24,7 +21,9 @@ import (
 
 var historyPath = path.Join(os.TempDir(), "weed-shell")
 
-func RunShell(options ShellOptions) {
+// Piped stdin returns the last command failure; an interactive session shows
+// the error to the operator and keeps going.
+func RunShell(options ShellOptions) error {
 	slices.SortFunc(Commands, func(a, b command) int {
 		return strings.Compare(a.Name(), b.Name())
 	})
@@ -55,36 +54,20 @@ func RunShell(options ShellOptions) {
 
 	commandEnv := NewCommandEnv(&options)
 
+	connectTimeout := options.ConnectTimeout
+	if connectTimeout <= 0 {
+		connectTimeout = 30 * time.Second
+	}
 	ctx := context.Background()
-	go commandEnv.MasterClient.KeepConnectedToMaster(ctx)
-	commandEnv.MasterClient.WaitUntilConnected(ctx)
-
-	if commandEnv.option.FilerAddress == "" {
-		var filers []pb.ServerAddress
-		commandEnv.MasterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
-			resp, err := client.ListClusterNodes(context.Background(), &master_pb.ListClusterNodesRequest{
-				ClientType: cluster.FilerType,
-				FilerGroup: *options.FilerGroup,
-			})
-			if err != nil {
-				return err
-			}
-
-			for _, clusterNode := range resp.ClusterNodes {
-				filers = append(filers, pb.ServerAddress(clusterNode.Address))
-			}
-			return nil
-		})
-		if len(filers) > 0 {
-			commandEnv.option.FilerAddress = filers[rand.IntN(len(filers))]
-		}
-		if options.Debug {
-			if len(filers) > 0 {
-				fmt.Fprintf(os.Stderr, "master: %s filers: %v\n", *options.Masters, filers)
-			} else {
-				fmt.Fprintf(os.Stderr, "master: %s\n", *options.Masters)
-			}
-		}
+	connectCtx, cancel := context.WithTimeout(ctx, connectTimeout)
+	defer cancel()
+	reconnectCtx, cancelReconnect := context.WithCancel(ctx)
+	defer cancelReconnect()
+	go commandEnv.MasterClient.KeepConnectedToMaster(reconnectCtx)
+	if commandEnv.MasterClient.GetMaster(connectCtx) == "" {
+		err := fmt.Errorf("cannot connect to master %s within %s", *options.Masters, connectTimeout)
+		fmt.Fprintln(os.Stderr, err)
+		return err
 	}
 
 	if interactive {
@@ -94,7 +77,7 @@ func RunShell(options ShellOptions) {
 				if err != io.EOF {
 					fmt.Fprintf(os.Stderr, "%v\n", err)
 				}
-				return
+				return nil
 			}
 
 			if strings.TrimSpace(cmd) != "" {
@@ -102,32 +85,39 @@ func RunShell(options ShellOptions) {
 			}
 
 			for _, c := range util.StringSplit(cmd, ";") {
-				if processEachCmd(c, commandEnv) {
-					return
+				if exit, _ := processEachCmd(c, commandEnv); exit {
+					return nil
 				}
 			}
 		}
 	} else {
+		var lastErr error
 		scanner := bufio.NewScanner(os.Stdin)
 		for scanner.Scan() {
 			cmd := scanner.Text()
 			for _, c := range util.StringSplit(cmd, ";") {
-				if processEachCmd(c, commandEnv) {
-					return
+				exit, err := processEachCmd(c, commandEnv)
+				if err != nil {
+					lastErr = err
+				}
+				if exit {
+					return lastErr
 				}
 			}
 		}
 		if err := scanner.Err(); err != nil {
 			fmt.Fprintf(os.Stderr, "error reading stdin: %v\n", err)
+			lastErr = err
 		}
+		return lastErr
 	}
 }
 
-func processEachCmd(cmd string, commandEnv *CommandEnv) bool {
+func processEachCmd(cmd string, commandEnv *CommandEnv) (exit bool, cmdErr error) {
 	cmds := splitCommandLine(cmd)
 
 	if len(cmds) == 0 {
-		return false
+		return false, nil
 	} else {
 
 		args := cmds[1:]
@@ -136,24 +126,32 @@ func processEachCmd(cmd string, commandEnv *CommandEnv) bool {
 		if cmd == "help" || cmd == "?" {
 			printHelp(cmds)
 		} else if cmd == "exit" || cmd == "quit" {
-			return true
+			return true, nil
 		} else {
 			foundCommand := false
 			for _, c := range Commands {
 				if c.Name() == cmd || c.Name() == "fs."+cmd {
+					// noLock says "this invocation changes nothing", which is a
+					// property of the invocation and not of the session. A
+					// command that set it for a dry run would otherwise leave
+					// every later command in the session unlocked, so a real
+					// mutation right after a simulation would skip its lock.
+					commandEnv.SetNoLock(false)
 					if err := c.Do(args, commandEnv, os.Stdout); err != nil {
 						fmt.Fprintf(os.Stderr, "error: %v\n", err)
+						cmdErr = err
 					}
 					foundCommand = true
 				}
 			}
 			if !foundCommand {
 				fmt.Fprintf(os.Stderr, "unknown command: %v\n", cmd)
+				cmdErr = fmt.Errorf("unknown command: %v", cmd)
 			}
 		}
 
 	}
-	return false
+	return false, cmdErr
 }
 
 func splitCommandLine(line string) []string {
diff --git a/weed/shell/shell_liner_test.go b/weed/shell/shell_liner_test.go
new file mode 100644
index 0000000000..21a707ac8a
--- /dev/null
+++ b/weed/shell/shell_liner_test.go
@@ -0,0 +1,85 @@
+package shell
+
+import (
+	"errors"
+	"io"
+	"strings"
+	"testing"
+	"time"
+)
+
+type fakeCommand struct {
+	name string
+	err  error
+}
+
+func (c *fakeCommand) Name() string                              { return c.name }
+func (c *fakeCommand) Help() string                              { return "test helper" }
+func (c *fakeCommand) HasTag(CommandTag) bool                    { return false }
+func (c *fakeCommand) Do([]string, *CommandEnv, io.Writer) error { return c.err }
+
+func TestProcessEachCmdReturnsErrors(t *testing.T) {
+
+	exit, err := processEachCmd("definitely.not.a.command", nil)
+	if exit {
+		t.Errorf("unknown command must not request exit")
+	}
+	if err == nil {
+		t.Errorf("unknown command must return an error")
+	}
+	if err != nil && !strings.Contains(err.Error(), "unknown command") {
+		t.Errorf("unexpected error for unknown command: %v", err)
+	}
+
+	exit, err = processEachCmd("exit", nil)
+	if !exit {
+		t.Errorf("exit must request exit")
+	}
+	if err != nil {
+		t.Errorf("exit must not return an error, got: %v", err)
+	}
+
+	exit, err = processEachCmd("   ", nil)
+	if exit || err != nil {
+		t.Errorf("blank input must be a no-op, got exit=%v err=%v", exit, err)
+	}
+}
+
+func TestRunShellConnectTimeout(t *testing.T) {
+	masters := "127.0.0.1:1"
+	filerGroup := ""
+
+	start := time.Now()
+	err := RunShell(ShellOptions{
+		Masters:        &masters,
+		FilerGroup:     &filerGroup,
+		ConnectTimeout: 200 * time.Millisecond,
+	})
+	if err == nil || !strings.Contains(err.Error(), "cannot connect to master") {
+		t.Fatalf("expected a master connection timeout, got: %v", err)
+	}
+	if elapsed := time.Since(start); elapsed > 10*time.Second {
+		t.Fatalf("RunShell should give up near the connect timeout, took %v", elapsed)
+	}
+}
+
+func TestProcessEachCmdPreservesRegisteredCommandError(t *testing.T) {
+	doErr := errors.New("daily_run: shard=3: recovery walk failed")
+	failing := &fakeCommand{name: "test.failing.command", err: doErr}
+	succeeding := &fakeCommand{name: "test.succeeding.command"}
+	Commands = append(Commands, failing, succeeding)
+	t.Cleanup(func() { Commands = Commands[:len(Commands)-2] })
+
+	exit, err := processEachCmd("test.failing.command -some -args", nil)
+	if exit {
+		t.Errorf("a failing command must not request exit")
+	}
+	if !errors.Is(err, doErr) {
+		t.Errorf("the command's own error must be preserved, got: %v", err)
+	}
+
+	exit, err = processEachCmd("test.succeeding.command", nil)
+	if exit || err != nil {
+		t.Errorf("a succeeding command must return no error, got exit=%v err=%v", exit, err)
+	}
+}
diff --git a/weed/shell/shell_nolock_scope_test.go b/weed/shell/shell_nolock_scope_test.go
new file mode 100644
index 0000000000..c8c0d85e5d
--- /dev/null
+++ b/weed/shell/shell_nolock_scope_test.go
@@ -0,0 +1,48 @@
+package shell
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient/exclusive_locks"
+)
+
+// noLock says "this invocation changes nothing" -- volume.balance,
+// volume.fix.replication and others set it for a dry run. It is a property of
+// the invocation, not of the session: the CommandEnv is reused across every
+// command, so without a reset a simulation leaves later commands unlocked and a
+// real mutation run straight after one skips its lock silently.
+func TestNoLockDoesNotOutliveTheCommandThatSetIt(t *testing.T) {
+	env := &CommandEnv{locker: exclusive_locks.NewExclusiveLocker(nil, cluster.AdminShellLockName)}
+
+	env.SetNoLock(true)
+	if err := env.confirmIsLocked([]string{"volume.balance"}); err != nil {
+		t.Fatalf("a dry run needs no lock: %v", err)
+	}
+
+	env.SetNoLock(false)
+
+	if err := env.confirmIsLocked([]string{"volume.move"}); err == nil {
+		t.Error("the next command mutates and must require the lock again")
+	}
+}
+
+// Both dispatchers reuse one CommandEnv: the interactive shell across the lines
+// an operator types, and the master's maintenance script runner across the lines
+// of a script. Resetting has to restore the lock requirement however many
+// invocations share the environment.
+func TestNoLockResetRestoresTheRequirementForEveryInvocation(t *testing.T) {
+	env := &CommandEnv{locker: exclusive_locks.NewExclusiveLocker(nil, cluster.AdminShellLockName)}
+
+	for i := 0; i < 3; i++ {
+		env.SetNoLock(true)
+		if err := env.confirmIsLocked([]string{"dry run"}); err != nil {
+			t.Fatalf("run %d: a dry run needs no lock: %v", i, err)
+		}
+
+		env.SetNoLock(false)
+		if err := env.confirmIsLocked([]string{"mutation"}); err == nil {
+			t.Fatalf("run %d: the mutation after it must require the lock again", i)
+		}
+	}
+}
diff --git a/weed/stats/disk.go b/weed/stats/disk.go
index 260901ef81..67bc06fb86 100644
--- a/weed/stats/disk.go
+++ b/weed/stats/disk.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"google.golang.org/protobuf/proto"
 )
 
 type DiskIOProbeConfig struct {
@@ -27,6 +28,9 @@ type DiskIOProbeConfig struct {
 	// latency above this threshold is considered slow
 	SlowLatency time.Duration
 
+	// per disk type overrides for SlowLatency, keyed by the -disk tag
+	SlowLatencyByDiskType map[string]time.Duration
+
 	// rolling observation window
 	Window time.Duration
 
@@ -64,6 +68,15 @@ func DefaultDiskIOProbeConfig() DiskIOProbeConfig {
 	}
 }
 
+// SlowLatencyFor returns the slow threshold configured for a disk type,
+// falling back to SlowLatency when the type has no entry of its own.
+func (config DiskIOProbeConfig) SlowLatencyFor(diskType string) time.Duration {
+	if slowLatency, found := config.SlowLatencyByDiskType[diskType]; found {
+		return slowLatency
+	}
+	return config.SlowLatency
+}
+
 type ioSample struct {
 	ts      time.Time
 	latency time.Duration
@@ -79,7 +92,7 @@ type diskState struct {
 	statFailureCount int
 	statSuccessCount int
 	lastStatErr      error
-	lastGoodStatus   volume_server_pb.DiskStatus
+	lastGoodStatus   *volume_server_pb.DiskStatus
 	hasLastGood      bool
 
 	samples []ioSample
@@ -485,7 +498,7 @@ func (s *diskState) updateErrorLocked(disk *volume_server_pb.DiskStatus, config
 }
 
 func (s *diskState) rememberGoodStatusLocked(disk *volume_server_pb.DiskStatus) {
-	s.lastGoodStatus = *disk
+	s.lastGoodStatus = proto.Clone(disk).(*volume_server_pb.DiskStatus)
 	s.hasLastGood = true
 }
 
@@ -496,7 +509,8 @@ func (s *diskState) applyLastGoodStatusLocked(disk *volume_server_pb.DiskStatus)
 
 	dir := disk.Dir
 	errorMessage := disk.Error
-	*disk = s.lastGoodStatus
+	proto.Reset(disk)
+	proto.Merge(disk, s.lastGoodStatus)
 	disk.Dir = dir
 	disk.Error = errorMessage
 }
diff --git a/weed/stats/disk_test.go b/weed/stats/disk_test.go
index cc34573563..abbe26dea9 100644
--- a/weed/stats/disk_test.go
+++ b/weed/stats/disk_test.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 )
@@ -67,3 +68,29 @@ func TestSetDiskStatusRequiresRepeatedSuccessesToRecover(t *testing.T) {
 		t.Fatalf("expected disk error to recover after %d successful checks: %s", recoveryChecks, disk.Error)
 	}
 }
+
+func TestSlowLatencyForFallsBackToDefault(t *testing.T) {
+	config := DiskIOProbeConfig{
+		SlowLatency: 500 * time.Millisecond,
+		SlowLatencyByDiskType: map[string]time.Duration{
+			"hdd":  500 * time.Millisecond,
+			"nvme": 50 * time.Millisecond,
+		},
+	}
+
+	for diskType, want := range map[string]time.Duration{
+		"hdd":       500 * time.Millisecond,
+		"nvme":      50 * time.Millisecond,
+		"ssd":       500 * time.Millisecond,
+		"nvme-gen5": 500 * time.Millisecond,
+	} {
+		if got := config.SlowLatencyFor(diskType); got != want {
+			t.Errorf("disk type %q: got %v, want %v", diskType, got, want)
+		}
+	}
+
+	empty := DiskIOProbeConfig{SlowLatency: 100 * time.Millisecond}
+	if got := empty.SlowLatencyFor("nvme"); got != 100*time.Millisecond {
+		t.Errorf("unconfigured table: got %v, want %v", got, 100*time.Millisecond)
+	}
+}
diff --git a/weed/stats/metrics.go b/weed/stats/metrics.go
index b6161709ec..4678c227d5 100644
--- a/weed/stats/metrics.go
+++ b/weed/stats/metrics.go
@@ -101,6 +101,22 @@ var (
 			Help:      "admin lock",
 		}, []string{"client"})
 
+	MasterVolumeGrowthFrozen = prometheus.NewGauge(
+		prometheus.GaugeOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemMaster,
+			Name:      "volume_growth_frozen",
+			Help:      "1 while volume growth is frozen after detected master state loss",
+		})
+
+	MasterDuplicateVolumeIds = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemMaster,
+			Name:      "duplicate_volume_ids",
+			Help:      "volume id registered under two different layouts",
+		}, []string{"collection", "volumeId"})
+
 	MasterReceivedHeartbeatCounter = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
 			Namespace: Namespace,
@@ -242,6 +258,14 @@ var (
 			Help:      "Times a metadata subscriber moved past a log range without proof it was persisted: scope=aggregated means a peer may not have flushed it, scope=local means this filer's own log flush was wedged past the give-up bound.",
 		}, []string{"scope"})
 
+	FilerSubscribeWatermarkHolds = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFiler,
+			Name:      "subscribe_watermark_holds",
+			Help:      "Times an aggregated metadata read stopped at an entry newer than the peers' low-watermark and waited for a peer to report further progress: scope=memory held at the delivery watermark, scope=disk at the flush watermark.",
+		}, []string{"scope"})
+
 	FilerSubscribeGapStalledGauge = prometheus.NewGaugeVec(
 		prometheus.GaugeOpts{
 			Namespace: Namespace,
@@ -250,6 +274,14 @@ var (
 			Help:      "Number of metadata subscribers currently parked waiting to read past a gap in the metadata log.",
 		}, []string{"scope"})
 
+	FilerMetaAggregatorReplayFailures = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFiler,
+			Name:      "meta_aggregator_replay_failures",
+			Help:      "Number of peer metadata events skipped after replay retries were exhausted, leaving that entry diverged from the peer.",
+		}, []string{"peer"})
+
 	// Sampled only on first creation, so counts track distinct objects.
 	FilerObjectSizeBytesHistogram = prometheus.NewHistogram(
 		prometheus.HistogramOpts{
@@ -285,6 +317,78 @@ var (
 			Help:      "The offset of the filer synchronization service.",
 		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
 
+	FilerSyncEventsReceivedCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "events_received_total",
+			Help:      "Counter of metadata events read off the source subscription stream.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncEventsProcessedCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "events_processed_total",
+			Help:      "Counter of metadata events successfully replicated to the target.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncEventsFailedCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "events_failed_total",
+			Help:      "Counter of metadata events that failed after retries; the sync offset is held at the oldest failure so it is replayed on restart.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncInFlightJobsGauge = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "in_flight_jobs",
+			Help:      "Number of sync jobs currently being replicated; pinned at the concurrency limit means the sync itself is the bottleneck.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncReceivedBytesCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "received_bytes_total",
+			Help:      "Counter of chunk data bytes carried by received events: new chunks the old entry does not already have, so deletes, renames, and attribute-only updates count zero.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncProcessedBytesCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "processed_bytes_total",
+			Help:      "Counter of chunk data bytes carried by successfully replicated events.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncFailedBytesCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "failed_bytes_total",
+			Help:      "Counter of chunk data bytes carried by events that failed after retries.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncInFlightBytesGauge = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "in_flight_bytes",
+			Help:      "Chunk data bytes carried by the jobs currently being replicated; distinguishes workers stuck on a few large files from many small ones.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
+	FilerSyncLagSecondsGauge = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemFilerSync,
+			Name:      "lag_seconds",
+			Help:      "How far the replicated watermark trails the source filer, in seconds.",
+		}, []string{"sourceFiler", "targetFiler", "clientName", "path"})
+
 	VolumeServerStartTimeSeconds = prometheus.NewGauge(
 		prometheus.GaugeOpts{
 			Namespace: Namespace,
@@ -399,6 +503,22 @@ var (
 			Help:      "Disk error status",
 		}, []string{"name", "type"})
 
+	VolumeServerStorageIoErrorCounter = prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemVolumeServer,
+			Name:      "storage_io_error_total",
+			Help:      "Counter of storage read/write EIO errors on volumes and EC shards.",
+		})
+
+	VolumeServerIoQuarantineGauge = prometheus.NewGaugeVec(
+		prometheus.GaugeOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemVolumeServer,
+			Name:      "io_quarantine",
+			Help:      "Number of volumes or EC shards quarantined due to storage IO errors.",
+		}, []string{"kind"})
+
 	VolumeServerConcurrentDownloadLimit = prometheus.NewGauge(
 		prometheus.GaugeOpts{
 			Namespace: Namespace,
@@ -685,6 +805,14 @@ var (
 			Help:      "Remote-mount object read attempts by source, bucket and cache result. A cold object retried before caching completes records a miss per attempt; paths outside the buckets folder use bucket \"_other\".",
 		}, []string{"source", "bucket", "result"})
 
+	RemoteCacheEvictedCounter = prometheus.NewCounter(
+		prometheus.CounterOpts{
+			Namespace: Namespace,
+			Subsystem: subsystemRemote,
+			Name:      "cache_evicted_total",
+			Help:      "Remote-mounted objects whose local chunks were evicted under disk pressure.",
+		})
+
 	UploadErrorCounter = prometheus.NewCounterVec(
 		prometheus.CounterOpts{
 			Namespace: Namespace,
@@ -879,6 +1007,8 @@ func init() {
 	Gather.MustRegister(MasterClientConnectCounter)
 	Gather.MustRegister(MasterRaftIsleader)
 	Gather.MustRegister(MasterAdminLock)
+	Gather.MustRegister(MasterVolumeGrowthFrozen)
+	Gather.MustRegister(MasterDuplicateVolumeIds)
 	Gather.MustRegister(MasterReceivedHeartbeatCounter)
 	Gather.MustRegister(MasterLeaderChangeCounter)
 	Gather.MustRegister(MasterReplicaPlacementMismatch)
@@ -896,9 +1026,20 @@ func init() {
 	Gather.MustRegister(FilerStoreCounter)
 	Gather.MustRegister(FilerStoreHistogram)
 	Gather.MustRegister(FilerSyncOffsetGauge)
+	Gather.MustRegister(FilerSyncEventsReceivedCounter)
+	Gather.MustRegister(FilerSyncEventsProcessedCounter)
+	Gather.MustRegister(FilerSyncEventsFailedCounter)
+	Gather.MustRegister(FilerSyncInFlightJobsGauge)
+	Gather.MustRegister(FilerSyncLagSecondsGauge)
+	Gather.MustRegister(FilerSyncReceivedBytesCounter)
+	Gather.MustRegister(FilerSyncProcessedBytesCounter)
+	Gather.MustRegister(FilerSyncFailedBytesCounter)
+	Gather.MustRegister(FilerSyncInFlightBytesGauge)
 	Gather.MustRegister(FilerServerLastSendTsOfSubscribeGauge)
 	Gather.MustRegister(FilerSubscribeGapStalledGauge)
 	Gather.MustRegister(FilerSubscribeUnprovenGapCrossings)
+	Gather.MustRegister(FilerSubscribeWatermarkHolds)
+	Gather.MustRegister(FilerMetaAggregatorReplayFailures)
 	Gather.MustRegister(FilerObjectSizeBytesHistogram)
 	Gather.MustRegister(collectors.NewGoCollector())
 	Gather.MustRegister(collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}))
@@ -917,6 +1058,8 @@ func init() {
 	Gather.MustRegister(VolumeServerDiskSizeGauge)
 	Gather.MustRegister(VolumeServerResourceGauge)
 	Gather.MustRegister(VolumeServerDiskErrorGauge)
+	Gather.MustRegister(VolumeServerStorageIoErrorCounter)
+	Gather.MustRegister(VolumeServerIoQuarantineGauge)
 	Gather.MustRegister(VolumeServerConcurrentDownloadLimit)
 	Gather.MustRegister(VolumeServerConcurrentUploadLimit)
 	Gather.MustRegister(VolumeServerInFlightDownloadSize)
@@ -955,6 +1098,7 @@ func init() {
 	Gather.MustRegister(S3BucketReadOnlyGauge)
 
 	Gather.MustRegister(RemoteCacheReadCounter)
+	Gather.MustRegister(RemoteCacheEvictedCounter)
 
 	Gather.MustRegister(S3LifecycleDispatchCounter)
 	Gather.MustRegister(S3LifecycleScheduleDepthGauge)
@@ -1083,6 +1227,16 @@ func DeleteCollectionMetrics(collection string) {
 	glog.V(0).Infof("delete collection metrics, %s: %d", collection, c)
 }
 
+// DeleteVolumeServerCollectionMetrics drops a collection's volume server series
+// once its last volume leaves this server. These gauges are only ever set for
+// collections still present, so the values from the heartbeat that saw the last
+// volume would otherwise stand until the process restarts.
+func DeleteVolumeServerCollectionMetrics(collection string) {
+	VolumeServerDiskSizeGauge.DeleteLabelValues(collection, "normal")
+	VolumeServerDiskSizeGauge.DeleteLabelValues(collection, "deleted_bytes")
+	VolumeServerReadOnlyVolumeGauge.DeletePartialMatch(prometheus.Labels{"collection": collection})
+}
+
 func bucketMetricTTLControl() {
 	ttlNs := bucketAtiveTTL.Nanoseconds()
 	for {
diff --git a/weed/stats/metrics_names.go b/weed/stats/metrics_names.go
index 956e8df8c9..a6fd629485 100644
--- a/weed/stats/metrics_names.go
+++ b/weed/stats/metrics_names.go
@@ -10,6 +10,7 @@ const (
 	UploadLimitCond    = "uploadLimitCondition"
 	ReadProxyReq       = "readProxyRequest"
 	ReadRedirectReq    = "readRedirectRequest"
+	ReadDeletedNeedle  = "readDeletedNeedle"
 	EmptyReadProxyLoc  = "emptyReadProxyLocaction"
 	FailedReadProxyReq = "failedReadProxyRequest"
 
diff --git a/weed/storage/backend/backend.go b/weed/storage/backend/backend.go
index 539867f8f6..632adb6c30 100644
--- a/weed/storage/backend/backend.go
+++ b/weed/storage/backend/backend.go
@@ -25,8 +25,9 @@ type BackendStorageFile interface {
 type BackendStorage interface {
 	ToProperties() map[string]string
 	NewStorageFile(key string, tierInfo *volume_server_pb.VolumeInfo) BackendStorageFile
-	CopyFile(f *os.File, fn func(progressed int64, percentage float32) error) (key string, size int64, err error)
-	DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error) (size int64, err error)
+	// concurrency > 0 caps concurrent network transfers; <= 0 uses the backend default.
+	CopyFile(f *os.File, fn func(progressed int64, percentage float32) error, concurrency int) (key string, size int64, err error)
+	DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error, concurrency int) (size int64, err error)
 	DeleteFile(key string) (err error)
 }
 
diff --git a/weed/storage/backend/rclone_backend/rclone_backend.go b/weed/storage/backend/rclone_backend/rclone_backend.go
index 1fe7aca768..daeaac0ea1 100644
--- a/weed/storage/backend/rclone_backend/rclone_backend.go
+++ b/weed/storage/backend/rclone_backend/rclone_backend.go
@@ -103,7 +103,7 @@ func (s *RcloneBackendStorage) NewStorageFile(key string, tierInfo *volume_serve
 	return f
 }
 
-func (s *RcloneBackendStorage) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error) (key string, size int64, err error) {
+func (s *RcloneBackendStorage) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error, concurrency int) (key string, size int64, err error) {
 	randomUuid, err := uuid.NewRandom()
 	if err != nil {
 		return key, 0, err
@@ -154,7 +154,7 @@ func uploadViaRclone(rfs fs.Fs, filename string, key string, fn func(progressed
 	return obj.Size(), err
 }
 
-func (s *RcloneBackendStorage) DownloadFile(filename string, key string, fn func(progressed int64, percentage float32) error) (size int64, err error) {
+func (s *RcloneBackendStorage) DownloadFile(filename string, key string, fn func(progressed int64, percentage float32) error, concurrency int) (size int64, err error) {
 	glog.V(1).Infof("download dat file of %s from remote rclone.%s as %s", filename, s.id, key)
 
 	util.Retry("download via Rclone", func() error {
diff --git a/weed/storage/backend/s3_backend/s3_backend.go b/weed/storage/backend/s3_backend/s3_backend.go
index 1e0b21700b..08651dedea 100644
--- a/weed/storage/backend/s3_backend/s3_backend.go
+++ b/weed/storage/backend/s3_backend/s3_backend.go
@@ -3,7 +3,9 @@ package s3_backend
 import (
 	"fmt"
 	"io"
+	"math"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -41,6 +43,9 @@ type S3BackendStorage struct {
 	endpoint              string
 	storageClass          string
 	forcePathStyle        bool
+	uploadConcurrency     int
+	downloadConcurrency   int
+	httpOptions           httpOptions
 	conn                  s3iface.S3API
 }
 
@@ -54,11 +59,18 @@ func newS3BackendStorage(configuration backend.StringProperties, configPrefix st
 	s.endpoint = configuration.GetString(configPrefix + "endpoint")
 	s.storageClass = configuration.GetString(configPrefix + "storage_class")
 	s.forcePathStyle = util.ParseBool(configuration.GetString(configPrefix+"force_path_style"), true)
+	s.uploadConcurrency = parseConcurrency(configuration.GetString(configPrefix+"upload_concurrency"), defaultUploadConcurrency)
+	s.downloadConcurrency = parseConcurrency(configuration.GetString(configPrefix+"download_concurrency"), defaultDownloadConcurrency)
+	s.httpOptions = httpOptions{
+		disableHTTP2:    util.ParseBool(configuration.GetString(configPrefix+"disable_http2"), false),
+		maxConnsPerHost: parseNonNegative(configuration.GetString(configPrefix+"max_connections"), "max_connections"),
+		idleConnTimeout: parseIdleConnTimeout(configuration.GetString(configPrefix + "idle_connection_timeout_seconds")),
+	}
 	if s.storageClass == "" {
 		s.storageClass = "STANDARD_IA"
 	}
 
-	s.conn, err = createSession(s.aws_access_key_id, s.aws_secret_access_key, s.region, s.endpoint, s.forcePathStyle)
+	s.conn, err = createSession(s.aws_access_key_id, s.aws_secret_access_key, s.region, s.endpoint, s.forcePathStyle, s.httpOptions)
 
 	glog.V(0).Infof("created backend storage s3.%s for region %s bucket %s", s.id, s.region, s.bucket)
 	return
@@ -73,9 +85,66 @@ func (s *S3BackendStorage) ToProperties() map[string]string {
 	m["endpoint"] = s.endpoint
 	m["storage_class"] = s.storageClass
 	m["force_path_style"] = util.BoolToString(s.forcePathStyle)
+	m["upload_concurrency"] = strconv.Itoa(s.uploadConcurrency)
+	m["download_concurrency"] = strconv.Itoa(s.downloadConcurrency)
+	m["disable_http2"] = util.BoolToString(s.httpOptions.disableHTTP2)
+	m["max_connections"] = strconv.Itoa(s.httpOptions.maxConnsPerHost)
+	m["idle_connection_timeout_seconds"] = strconv.FormatInt(int64(s.httpOptions.idleConnTimeout/time.Second), 10)
 	return m
 }
 
+const (
+	defaultUploadConcurrency   = 5
+	defaultDownloadConcurrency = 5
+)
+
+func parseConcurrency(value string, def int) int {
+	if value == "" {
+		return def
+	}
+	if n, err := strconv.Atoi(value); err == nil && n > 0 {
+		return n
+	}
+	glog.Warningf("invalid concurrency value %q, using default %d", value, def)
+	return def
+}
+
+// parseNonNegative reads an optional non-negative integer setting; empty or
+// invalid means 0 (the default).
+func parseNonNegative(value, name string) int {
+	if value == "" {
+		return 0
+	}
+	if n, err := strconv.Atoi(value); err == nil && n >= 0 {
+		return n
+	}
+	glog.Warningf("invalid %s value %q, using the default", name, value)
+	return 0
+}
+
+// maxIdleConnTimeoutSeconds is the largest number of seconds a time.Duration
+// can hold.
+const maxIdleConnTimeoutSeconds = math.MaxInt64 / int64(time.Second)
+
+// parseIdleConnTimeout reads idle_connection_timeout_seconds; empty, invalid
+// or too large to represent as a time.Duration means 0 (the default). It
+// parses 64-bit seconds so the range is the same on 32-bit platforms.
+func parseIdleConnTimeout(value string) time.Duration {
+	if value == "" {
+		return 0
+	}
+	seconds, err := strconv.ParseInt(value, 10, 64)
+	if err != nil || seconds < 0 {
+		glog.Warningf("invalid idle_connection_timeout_seconds value %q, using the default", value)
+		return 0
+	}
+	if seconds > maxIdleConnTimeoutSeconds {
+		glog.Warningf("idle_connection_timeout_seconds %q is out of range, using the default", value)
+		return 0
+	}
+	return time.Duration(seconds) * time.Second
+}
+
 func (s *S3BackendStorage) NewStorageFile(key string, tierInfo *volume_server_pb.VolumeInfo) backend.BackendStorageFile {
 	if strings.HasPrefix(key, "/") {
 		key = key[1:]
@@ -90,25 +159,32 @@ func (s *S3BackendStorage) NewStorageFile(key string, tierInfo *volume_server_pb
 	return f
 }
 
-func (s *S3BackendStorage) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error) (key string, size int64, err error) {
+func (s *S3BackendStorage) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error, concurrency int) (key string, size int64, err error) {
 	randomUuid, _ := uuid.NewRandom()
 	key = randomUuid.String()
 
+	if concurrency <= 0 {
+		concurrency = s.uploadConcurrency
+	}
+
 	glog.V(1).Infof("copying dat file of %s to remote s3.%s as %s", f.Name(), s.id, key)
 
 	util.Retry("upload to S3", func() error {
-		size, err = uploadToS3(s.conn, f.Name(), s.bucket, key, s.storageClass, fn)
+		size, err = uploadToS3(s.conn, f.Name(), s.bucket, key, s.storageClass, fn, concurrency)
 		return err
 	})
 
 	return
 }
 
-func (s *S3BackendStorage) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error) (size int64, err error) {
+func (s *S3BackendStorage) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error, concurrency int) (size int64, err error) {
+	if concurrency <= 0 {
+		concurrency = s.downloadConcurrency
+	}
 
 	glog.V(1).Infof("download dat file of %s from remote s3.%s as %s", fileName, s.id, key)
 
-	size, err = downloadFromS3(s.conn, fileName, s.bucket, key, fn)
+	size, err = downloadFromS3(s.conn, fileName, s.bucket, key, fn, concurrency)
 
 	return
 }
diff --git a/weed/storage/backend/s3_backend/s3_backend_test.go b/weed/storage/backend/s3_backend/s3_backend_test.go
index 35537a6d34..347c379820 100644
--- a/weed/storage/backend/s3_backend/s3_backend_test.go
+++ b/weed/storage/backend/s3_backend/s3_backend_test.go
@@ -12,6 +12,12 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 )
 
+type testProperties map[string]string
+
+func (m testProperties) GetString(key string) string {
+	return m[key]
+}
+
 type stubS3Client struct {
 	s3iface.S3API
 	getObject func(*s3.GetObjectInput) (*s3.GetObjectOutput, error)
@@ -101,3 +107,50 @@ func TestReadAtRejectsInvalidRequestsLocally(t *testing.T) {
 		})
 	}
 }
+
+func TestParseConcurrency(t *testing.T) {
+	cases := []struct {
+		value    string
+		def      int
+		expected int
+	}{
+		{"", 5, 5},    // unset -> default
+		{"0", 5, 5},   // explicit zero means default
+		{"-3", 5, 5},  // invalid -> default
+		{"abc", 5, 5}, // invalid -> default
+		{"1", 5, 1},   // override
+		{"64", 5, 64}, // override
+	}
+	for _, tt := range cases {
+		if got := parseConcurrency(tt.value, tt.def); got != tt.expected {
+			t.Errorf("parseConcurrency(%q, %d) = %d, want %d", tt.value, tt.def, got, tt.expected)
+		}
+	}
+}
+
+func TestS3BackendStorageConcurrencyConfigRoundTrip(t *testing.T) {
+	s, err := newS3BackendStorage(testProperties{}, "", "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.uploadConcurrency != defaultUploadConcurrency || s.downloadConcurrency != defaultDownloadConcurrency {
+		t.Fatalf("defaults: upload=%d download=%d, want %d/%d",
+			s.uploadConcurrency, s.downloadConcurrency, defaultUploadConcurrency, defaultDownloadConcurrency)
+	}
+
+	s, err = newS3BackendStorage(testProperties{
+		"upload_concurrency":   "1",
+		"download_concurrency": "17",
+	}, "", "test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if s.uploadConcurrency != 1 || s.downloadConcurrency != 17 {
+		t.Fatalf("configured: upload=%d download=%d, want 1/17", s.uploadConcurrency, s.downloadConcurrency)
+	}
+
+	props := s.ToProperties()
+	if props["upload_concurrency"] != "1" || props["download_concurrency"] != "17" {
+		t.Fatalf("ToProperties: %v", props)
+	}
+}
diff --git a/weed/storage/backend/s3_backend/s3_download.go b/weed/storage/backend/s3_backend/s3_download.go
index 82d73d71b1..b0928e9be1 100644
--- a/weed/storage/backend/s3_backend/s3_download.go
+++ b/weed/storage/backend/s3_backend/s3_download.go
@@ -14,7 +14,10 @@ import (
 )
 
 func downloadFromS3(sess s3iface.S3API, destFileName string, sourceBucket string, sourceKey string,
-	fn func(progressed int64, percentage float32) error) (fileSize int64, err error) {
+	fn func(progressed int64, percentage float32) error, concurrency int) (fileSize int64, err error) {
+	if concurrency <= 0 {
+		concurrency = defaultDownloadConcurrency
+	}
 
 	fileSize, err = getFileSize(sess, sourceBucket, sourceKey)
 	if err != nil {
@@ -31,7 +34,7 @@ func downloadFromS3(sess s3iface.S3API, destFileName string, sourceBucket string
 	// Create a downloader with the session and custom options
 	downloader := s3manager.NewDownloaderWithClient(sess, func(u *s3manager.Downloader) {
 		u.PartSize = int64(64 * 1024 * 1024)
-		u.Concurrency = 5
+		u.Concurrency = concurrency
 	})
 
 	fileWriter := &s3DownloadProgressedWriter{
diff --git a/weed/storage/backend/s3_backend/s3_sessions.go b/weed/storage/backend/s3_backend/s3_sessions.go
index 999dc6fe51..bdadb56118 100644
--- a/weed/storage/backend/s3_backend/s3_sessions.go
+++ b/weed/storage/backend/s3_backend/s3_sessions.go
@@ -1,8 +1,11 @@
 package s3_backend
 
 import (
+	"crypto/tls"
 	"fmt"
+	"net/http"
 	"sync"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
@@ -18,12 +21,49 @@ var (
 	sessionsLock sync.Mutex
 )
 
-func createSession(awsAccessKeyId, awsSecretAccessKey, region, endpoint string, forcePathStyle bool) (s3iface.S3API, error) {
+// httpOptions tunes the HTTP transport of the tier backend's S3 client. The
+// zero value keeps the SDK's default client.
+type httpOptions struct {
+	// disableHTTP2 keeps the client on HTTP/1.1. Over HTTP/2 every upload and
+	// range read to the endpoint shares one connection and its flow-control
+	// window, which some S3-compatible services keep small.
+	disableHTTP2 bool
+	// maxConnsPerHost caps the connections to the endpoint (0 = no cap), for
+	// services that limit parallel connections per client address.
+	maxConnsPerHost int
+	// idleConnTimeout closes idle connections sooner than Go's default 90s,
+	// for services that drop idle connections earlier (0 = default).
+	idleConnTimeout time.Duration
+}
+
+// newTransport returns the transport for the options, or nil for the default.
+func (o httpOptions) newTransport() *http.Transport {
+	if o == (httpOptions{}) {
+		return nil
+	}
+	t := http.DefaultTransport.(*http.Transport).Clone()
+	if o.disableHTTP2 {
+		t.ForceAttemptHTTP2 = false
+		t.TLSNextProto = map[string]func(string, *tls.Conn) http.RoundTripper{}
+	}
+	if o.maxConnsPerHost > 0 {
+		t.MaxConnsPerHost = o.maxConnsPerHost
+	}
+	if o.idleConnTimeout > 0 {
+		t.IdleConnTimeout = o.idleConnTimeout
+	}
+	return t
+}
+
+func createSession(awsAccessKeyId, awsSecretAccessKey, region, endpoint string, forcePathStyle bool, httpOpts httpOptions) (s3iface.S3API, error) {
 
 	sessionsLock.Lock()
 	defer sessionsLock.Unlock()
 
 	cacheKey := fmt.Sprintf("%s|%s", region, endpoint)
+	if httpOpts != (httpOptions{}) {
+		cacheKey = fmt.Sprintf("%s|%+v", cacheKey, httpOpts)
+	}
 	if t, found := s3Sessions[cacheKey]; found {
 		return t, nil
 	}
@@ -34,6 +74,9 @@ func createSession(awsAccessKeyId, awsSecretAccessKey, region, endpoint string,
 		S3ForcePathStyle:              aws.Bool(forcePathStyle),
 		S3DisableContentMD5Validation: aws.Bool(true),
 	}
+	if t := httpOpts.newTransport(); t != nil {
+		config.HTTPClient = &http.Client{Transport: t}
+	}
 	if awsAccessKeyId != "" && awsSecretAccessKey != "" {
 		config.Credentials = credentials.NewStaticCredentials(awsAccessKeyId, awsSecretAccessKey, "")
 	}
diff --git a/weed/storage/backend/s3_backend/s3_sessions_test.go b/weed/storage/backend/s3_backend/s3_sessions_test.go
new file mode 100644
index 0000000000..eb9f621c4d
--- /dev/null
+++ b/weed/storage/backend/s3_backend/s3_sessions_test.go
@@ -0,0 +1,129 @@
+package s3_backend
+
+import (
+	"math"
+	"net/http"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go/service/s3"
+)
+
+func backendTransport(t *testing.T, s *S3BackendStorage) *http.Transport {
+	t.Helper()
+	client, ok := s.conn.(*s3.S3)
+	if !ok {
+		t.Fatalf("unexpected client type %T", s.conn)
+	}
+	httpClient := client.Client.Config.HTTPClient
+	if httpClient == nil {
+		return nil
+	}
+	transport, _ := httpClient.Transport.(*http.Transport)
+	return transport
+}
+
+func TestS3BackendHTTPOptionsReachTheClient(t *testing.T) {
+	s, err := newS3BackendStorage(testProperties{
+		"endpoint":                        "http://127.0.0.1:1",
+		"disable_http2":                   "true",
+		"max_connections":                 "64",
+		"idle_connection_timeout_seconds": "50",
+	}, "", "http-options")
+	if err != nil {
+		t.Fatal(err)
+	}
+	transport := backendTransport(t, s)
+	if transport == nil {
+		t.Fatal("configured HTTP options did not reach the S3 client")
+	}
+	if transport.ForceAttemptHTTP2 || transport.TLSNextProto == nil || len(transport.TLSNextProto) != 0 {
+		t.Errorf("HTTP/2 not disabled: ForceAttemptHTTP2=%v TLSNextProto=%v", transport.ForceAttemptHTTP2, transport.TLSNextProto)
+	}
+	if transport.MaxConnsPerHost != 64 {
+		t.Errorf("MaxConnsPerHost = %d, want 64", transport.MaxConnsPerHost)
+	}
+	if transport.IdleConnTimeout != 50*time.Second {
+		t.Errorf("IdleConnTimeout = %v, want 50s", transport.IdleConnTimeout)
+	}
+
+	props := s.ToProperties()
+	if props["disable_http2"] != "true" || props["max_connections"] != "64" || props["idle_connection_timeout_seconds"] != "50" {
+		t.Errorf("ToProperties: %v", props)
+	}
+}
+
+func TestS3BackendDefaultHTTPClientUnchanged(t *testing.T) {
+	s, err := newS3BackendStorage(testProperties{"endpoint": "http://127.0.0.1:2"}, "", "http-defaults")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if transport := backendTransport(t, s); transport != nil && transport != http.DefaultTransport {
+		t.Fatalf("no options set, yet the client got a custom transport %+v", transport)
+	}
+	if (httpOptions{}).newTransport() != nil {
+		t.Fatal("zero options must keep the default client")
+	}
+}
+
+func TestS3BackendSessionsDifferByHTTPOptions(t *testing.T) {
+	a, err := createSession("", "", "us-east-1", "http://127.0.0.1:3", true, httpOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b, err := createSession("", "", "us-east-1", "http://127.0.0.1:3", true, httpOptions{disableHTTP2: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if a == b {
+		t.Fatal("backends with different HTTP options share one client")
+	}
+	c, err := createSession("", "", "us-east-1", "http://127.0.0.1:3", true, httpOptions{disableHTTP2: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if b != c {
+		t.Fatal("the same endpoint and options must reuse the cached client")
+	}
+}
+
+func TestParseNonNegative(t *testing.T) {
+	for _, c := range []struct {
+		in   string
+		want int
+	}{{"", 0}, {"0", 0}, {"12", 12}, {"-1", 0}, {"x", 0}} {
+		if got := parseNonNegative(c.in, "test"); got != c.want {
+			t.Errorf("parseNonNegative(%q) = %d, want %d", c.in, got, c.want)
+		}
+	}
+}
+
+func TestS3BackendIdleTimeoutOverflowFallsBackToDefault(t *testing.T) {
+	maxSeconds := int64(math.MaxInt64 / int64(time.Second))
+	for i, c := range []struct {
+		in   string
+		want time.Duration
+	}{
+		{strconv.FormatInt(maxSeconds, 10), time.Duration(maxSeconds) * time.Second},
+		{strconv.FormatInt(maxSeconds+1, 10), 0},
+		{"10000000000", 0},
+		{"-1", 0},
+		{"x", 0},
+	} {
+		s, err := newS3BackendStorage(testProperties{
+			"endpoint":                        "http://127.0.0.1:4",
+			"idle_connection_timeout_seconds": c.in,
+		}, "", "idle-overflow-"+strconv.Itoa(i))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if s.httpOptions.idleConnTimeout != c.want {
+			t.Errorf("idle_connection_timeout_seconds=%s: timeout %v, want %v", c.in, s.httpOptions.idleConnTimeout, c.want)
+		}
+		want := strconv.FormatInt(int64(c.want/time.Second), 10)
+		if got := s.ToProperties()["idle_connection_timeout_seconds"]; got != want {
+			t.Errorf("idle_connection_timeout_seconds=%s: ToProperties exports %s, want %s", c.in, got, want)
+		}
+	}
+}
diff --git a/weed/storage/backend/s3_backend/s3_upload.go b/weed/storage/backend/s3_backend/s3_upload.go
index 1392ad23a2..61bcbe5a82 100644
--- a/weed/storage/backend/s3_backend/s3_upload.go
+++ b/weed/storage/backend/s3_backend/s3_upload.go
@@ -12,7 +12,10 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 )
 
-func uploadToS3(sess s3iface.S3API, filename string, destBucket string, destKey string, storageClass string, fn func(progressed int64, percentage float32) error) (fileSize int64, err error) {
+func uploadToS3(sess s3iface.S3API, filename string, destBucket string, destKey string, storageClass string, fn func(progressed int64, percentage float32) error, concurrency int) (fileSize int64, err error) {
+	if concurrency <= 0 {
+		concurrency = defaultUploadConcurrency
+	}
 
 	//open the file
 	f, err := os.Open(filename)
@@ -36,7 +39,7 @@ func uploadToS3(sess s3iface.S3API, filename string, destBucket string, destKey
 	// Create an uploader with the session and custom options
 	uploader := s3manager.NewUploaderWithClient(sess, func(u *s3manager.Uploader) {
 		u.PartSize = partSize
-		u.Concurrency = 5
+		u.Concurrency = concurrency
 	})
 
 	fileReader := &s3UploadProgressedReader{
diff --git a/weed/storage/backend/volume_create.go b/weed/storage/backend/volume_create.go
index 4f26f86940..6a9e09ef89 100644
--- a/weed/storage/backend/volume_create.go
+++ b/weed/storage/backend/volume_create.go
@@ -9,7 +9,7 @@ import (
 )
 
 func CreateVolumeFile(fileName string, preallocate int64, memoryMapSizeMB uint32) (BackendStorageFile, error) {
-	file, e := os.OpenFile(fileName, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+	file, e := OpenVolumeFile(fileName, os.O_RDWR|os.O_CREATE|os.O_TRUNC)
 	if e != nil {
 		return nil, e
 	}
diff --git a/weed/storage/backend/volume_create_linux.go b/weed/storage/backend/volume_create_linux.go
index ab3481fd67..28aeb6ed1d 100644
--- a/weed/storage/backend/volume_create_linux.go
+++ b/weed/storage/backend/volume_create_linux.go
@@ -4,19 +4,23 @@ package backend
 
 import (
 	"os"
-	"syscall"
+
+	"golang.org/x/sys/unix"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 )
 
 func CreateVolumeFile(fileName string, preallocate int64, memoryMapSizeMB uint32) (BackendStorageFile, error) {
-	file, e := os.OpenFile(fileName, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0644)
+	file, e := OpenVolumeFile(fileName, os.O_RDWR|os.O_CREATE|os.O_TRUNC)
 	if e != nil {
 		return nil, e
 	}
 	if preallocate != 0 {
-		syscall.Fallocate(int(file.Fd()), 1, 0, preallocate)
-		glog.V(1).Infof("Preallocated %d bytes disk space for %s", preallocate, fileName)
+		if err := unix.Fallocate(int(file.Fd()), unix.FALLOC_FL_KEEP_SIZE, 0, preallocate); err != nil {
+			glog.Warningf("Preallocate %d bytes disk space for %s: %v", preallocate, fileName, err)
+		} else {
+			glog.V(1).Infof("Preallocated %d bytes disk space for %s", preallocate, fileName)
+		}
 	}
 	return NewDiskFile(file), nil
 }
diff --git a/weed/storage/backend/volume_create_linux_test.go b/weed/storage/backend/volume_create_linux_test.go
new file mode 100644
index 0000000000..14eeffd178
--- /dev/null
+++ b/weed/storage/backend/volume_create_linux_test.go
@@ -0,0 +1,50 @@
+//go:build linux
+
+package backend
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+func TestCreateVolumeFilePreallocateKeepsSize(t *testing.T) {
+	dir := t.TempDir()
+	const preallocate = 1 << 20
+
+	probe, err := os.Create(filepath.Join(dir, "probe"))
+	if err != nil {
+		t.Fatalf("create probe: %v", err)
+	}
+	err = unix.Fallocate(int(probe.Fd()), unix.FALLOC_FL_KEEP_SIZE, 0, preallocate)
+	probe.Close()
+	if err != nil {
+		t.Skipf("fallocate not supported in %s: %v", dir, err)
+	}
+
+	fileName := filepath.Join(dir, "1.dat")
+	f, err := CreateVolumeFile(fileName, preallocate, 0)
+	if err != nil {
+		t.Fatalf("CreateVolumeFile: %v", err)
+	}
+	defer f.Close()
+
+	size, _, err := f.GetStat()
+	if err != nil {
+		t.Fatalf("GetStat: %v", err)
+	}
+	if size != 0 {
+		t.Errorf("file size = %d, want 0", size)
+	}
+
+	var st syscall.Stat_t
+	if err := syscall.Stat(fileName, &st); err != nil {
+		t.Fatalf("stat: %v", err)
+	}
+	if st.Blocks*512 < preallocate {
+		t.Errorf("allocated %d bytes, want at least %d", st.Blocks*512, preallocate)
+	}
+}
diff --git a/weed/storage/backend/volume_open.go b/weed/storage/backend/volume_open.go
new file mode 100644
index 0000000000..85f90a7ff1
--- /dev/null
+++ b/weed/storage/backend/volume_open.go
@@ -0,0 +1,11 @@
+//go:build !linux
+
+package backend
+
+import "os"
+
+// OpenVolumeFile opens a volume data or index file. Only Linux can suppress
+// atime updates per file descriptor; elsewhere this is a plain open.
+func OpenVolumeFile(fileName string, flag int) (*os.File, error) {
+	return os.OpenFile(fileName, flag, 0644)
+}
diff --git a/weed/storage/backend/volume_open_linux.go b/weed/storage/backend/volume_open_linux.go
new file mode 100644
index 0000000000..3915abdaf0
--- /dev/null
+++ b/weed/storage/backend/volume_open_linux.go
@@ -0,0 +1,22 @@
+//go:build linux
+
+package backend
+
+import (
+	"errors"
+	"os"
+	"syscall"
+)
+
+// OpenVolumeFile opens a volume data or index file with O_NOATIME. Nothing
+// reads these files' atime, but without the flag every needle read dirties
+// the inode — even relatime writes atime on the first read after each write,
+// so an actively written volume pays a metadata write per read/write cycle.
+func OpenVolumeFile(fileName string, flag int) (*os.File, error) {
+	file, err := os.OpenFile(fileName, flag|syscall.O_NOATIME, 0644)
+	if err != nil && errors.Is(err, syscall.EPERM) {
+		// O_NOATIME is refused unless we own the file or hold CAP_FOWNER.
+		return os.OpenFile(fileName, flag, 0644)
+	}
+	return file, err
+}
diff --git a/weed/storage/dir_scan.go b/weed/storage/dir_scan.go
new file mode 100644
index 0000000000..9be14fe611
--- /dev/null
+++ b/weed/storage/dir_scan.go
@@ -0,0 +1,40 @@
+package storage
+
+import (
+	"errors"
+	"io"
+	"os"
+)
+
+// dirScanBatch bounds how many entries a directory walk holds at once. A disk
+// holding millions of volumes has a file per volume for each of .dat, .idx and
+// .vif, and os.ReadDir builds — and sorts — a slice of all of them before the
+// caller sees the first entry. Every startup scan then costs hundreds of MB of
+// peak heap that the runtime is slow to hand back, which is most of the gap
+// between a volume server's live heap and its resident set.
+const dirScanBatch = 1024
+
+// eachDirEntry calls visit for every entry in dir, in whatever order the
+// filesystem returns them, and stops early once visit returns false. Callers
+// that need a defined order sort the few entries they keep.
+func eachDirEntry(dir string, visit func(entry os.DirEntry) bool) error {
+	f, err := os.Open(dir)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	for {
+		entries, readErr := f.ReadDir(dirScanBatch)
+		for _, entry := range entries {
+			if !visit(entry) {
+				return nil
+			}
+		}
+		if readErr != nil {
+			if errors.Is(readErr, io.EOF) {
+				return nil
+			}
+			return readErr
+		}
+	}
+}
diff --git a/weed/storage/dir_scan_test.go b/weed/storage/dir_scan_test.go
new file mode 100644
index 0000000000..7045714e77
--- /dev/null
+++ b/weed/storage/dir_scan_test.go
@@ -0,0 +1,70 @@
+package storage
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// The walk reads in batches, so it has to keep going past the first one and
+// stop at the end without repeating or dropping an entry.
+func TestEachDirEntrySeesEveryEntry(t *testing.T) {
+	dir := t.TempDir()
+	want := make(map[string]bool, dirScanBatch*2+3)
+	for i := 0; i < dirScanBatch*2+3; i++ {
+		name := fmt.Sprintf("%d.dat", i)
+		if err := os.WriteFile(filepath.Join(dir, name), nil, 0644); err != nil {
+			t.Fatal(err)
+		}
+		want[name] = true
+	}
+
+	seen := make(map[string]bool, len(want))
+	if err := eachDirEntry(dir, func(entry os.DirEntry) bool {
+		if seen[entry.Name()] {
+			t.Errorf("entry %s visited twice", entry.Name())
+		}
+		seen[entry.Name()] = true
+		return true
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if len(seen) != len(want) {
+		t.Fatalf("walked %d entries, want %d", len(seen), len(want))
+	}
+	for name := range want {
+		if !seen[name] {
+			t.Errorf("entry %s was never visited", name)
+		}
+	}
+}
+
+func TestEachDirEntryStopsWhenAsked(t *testing.T) {
+	dir := t.TempDir()
+	for i := 0; i < dirScanBatch+10; i++ {
+		if err := os.WriteFile(filepath.Join(dir, fmt.Sprintf("%d.dat", i)), nil, 0644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	visited := 0
+	if err := eachDirEntry(dir, func(entry os.DirEntry) bool {
+		visited++
+		return visited < 5
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if visited != 5 {
+		t.Errorf("walk visited %d entries after being asked to stop at 5", visited)
+	}
+}
+
+func TestEachDirEntryReportsAMissingDirectory(t *testing.T) {
+	if err := eachDirEntry(filepath.Join(t.TempDir(), "absent"), func(os.DirEntry) bool {
+		t.Error("visited an entry of a directory that does not exist")
+		return true
+	}); err == nil {
+		t.Error("walking a missing directory reported no error")
+	}
+}
diff --git a/weed/storage/disk_location.go b/weed/storage/disk_location.go
index 4eadb03f73..e904bae7dc 100644
--- a/weed/storage/disk_location.go
+++ b/weed/storage/disk_location.go
@@ -48,11 +48,17 @@ type DiskLocation struct {
 	// erasure coding
 	ecVolumes     map[needle.VolumeId]*erasure_coding.EcVolume
 	ecVolumesLock sync.RWMutex
+	// vids whose EcVolume was removed from ecVolumes but is still being
+	// destroyed off-lock; the channel closes when Destroy returns. A remount
+	// of the vid must wait for it, or the dying volume could unlink files
+	// the new one just opened.
+	ecVolumesDestroying map[needle.VolumeId]chan struct{}
 
 	ecShardNotifyHandler func(collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, ecVolume *erasure_coding.EcVolume)
 
 	isDiskSpaceLow    atomic.Bool
 	isDiskUnavailable atomic.Bool
+	syncBatch         SyncBatchOption
 	closeCh           chan struct{}
 }
 
@@ -91,6 +97,9 @@ func NewDiskLocation(dir string, maxVolumeCount int32, minFreeSpace util.MinFree
 		idxDir = dir
 	} else {
 		idxDir = util.ResolvePath(idxDir)
+		if err := os.MkdirAll(idxDir, 0755); err != nil {
+			glog.Fatalf("cannot create idx dir %s: %v", idxDir, err)
+		}
 	}
 	dirUuid, err := GenerateDirUuid(dir)
 	if err != nil {
@@ -111,9 +120,11 @@ func NewDiskLocation(dir string, maxVolumeCount int32, minFreeSpace util.MinFree
 		MaxVolumeCount:         maxVolumeCount,
 		OriginalMaxVolumeCount: maxVolumeCount,
 		MinFreeSpace:           minFreeSpace,
+		syncBatch:              DefaultSyncBatchOption,
 	}
 	location.volumes = make(map[needle.VolumeId]*Volume)
 	location.ecVolumes = make(map[needle.VolumeId]*erasure_coding.EcVolume)
+	location.ecVolumesDestroying = make(map[needle.VolumeId]chan struct{})
 	location.closeCh = make(chan struct{})
 	go func() {
 		location.CheckDiskSpace(config)
@@ -202,11 +213,7 @@ func vifIsEcVolume(vifPath string) bool {
 	return err == nil && vi.GetEcShardConfig() != nil
 }
 
-func (l *DiskLocation) loadExistingVolume(dirEntry os.DirEntry, needleMapKind NeedleMapKind, skipIfEcVolumesExists bool, ldbTimeout int64, diskId uint32) bool {
-	basename := dirEntry.Name()
-	if dirEntry.IsDir() {
-		return false
-	}
+func (l *DiskLocation) loadExistingVolume(basename string, needleMapKind NeedleMapKind, skipIfEcVolumesExists bool, ldbTimeout int64, diskId uint32) bool {
 	volumeName := getValidVolumeName(basename)
 	if volumeName == "" {
 		return false
@@ -227,9 +234,13 @@ func (l *DiskLocation) loadExistingVolume(dirEntry os.DirEntry, needleMapKind Ne
 		return false
 	}
 
-	// .vif next to .ecx is EC shard metadata, not a regular volume.
-	// Without this guard NewVolume below would create a phantom empty .dat.
-	if strings.HasSuffix(basename, ".vif") && l.hasEcxFile(volumeName) {
+	// A .vif next to an .ecx with no .idx beside it is EC shard metadata, not a
+	// regular volume. Without this guard NewVolume below would create a phantom
+	// empty .dat. Ask for the .idx rather than trust which of a volume's two
+	// entries the scan handed over: an .idx next to the .ecx is an interrupted
+	// encode, and validateEcVolume below is what decides that one.
+	if strings.HasSuffix(basename, ".vif") && l.hasEcxFile(volumeName) &&
+		!util.FileExists(l.Directory+"/"+volumeName+".idx") {
 		glog.V(1).Infof("loadExistingVolume: skipping .vif-only entry for volume %d (collection=%q); .ecx present", vid, collection)
 		return false
 	}
@@ -307,20 +318,32 @@ func (l *DiskLocation) loadExistingVolume(dirEntry os.DirEntry, needleMapKind Ne
 
 func (l *DiskLocation) concurrentLoadingVolumes(needleMapKind NeedleMapKind, concurrency int, ldbTimeout int64, diskId uint32) {
 
-	task_queue := make(chan os.DirEntry, 10*concurrency)
+	// Read the directory to its end before the workers start writing into it:
+	// loading a volume creates .sdx, .vif and .ldb files in the same directory,
+	// and a stream left open across those writes is not guaranteed to hand back
+	// every entry it has not reached yet. Only the names are kept, one per
+	// volume, which is what the dedup here always held.
+	foundVolumeNames := make(map[string]string)
+	if err := eachDirEntry(l.Directory, func(entry os.DirEntry) bool {
+		if entry.IsDir() {
+			return true
+		}
+		volumeName := getValidVolumeName(entry.Name())
+		if volumeName == "" {
+			return true
+		}
+		if _, found := foundVolumeNames[volumeName]; !found {
+			foundVolumeNames[volumeName] = entry.Name()
+		}
+		return true
+	}); err != nil {
+		glog.Warningf("scan volume directory %s: %v", l.Directory, err)
+	}
+
+	task_queue := make(chan string, 10*concurrency)
 	go func() {
-		foundVolumeNames := make(map[string]bool)
-		if dirEntries, err := os.ReadDir(l.Directory); err == nil {
-			for _, entry := range dirEntries {
-				volumeName := getValidVolumeName(entry.Name())
-				if volumeName == "" {
-					continue
-				}
-				if _, found := foundVolumeNames[volumeName]; !found {
-					foundVolumeNames[volumeName] = true
-					task_queue <- entry
-				}
-			}
+		for _, basename := range foundVolumeNames {
+			task_queue <- basename
 		}
 		close(task_queue)
 	}()
@@ -330,8 +353,8 @@ func (l *DiskLocation) concurrentLoadingVolumes(needleMapKind NeedleMapKind, con
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			for fi := range task_queue {
-				_ = l.loadExistingVolume(fi, needleMapKind, true, ldbTimeout, diskId)
+			for basename := range task_queue {
+				_ = l.loadExistingVolume(basename, needleMapKind, true, ldbTimeout, diskId)
 			}
 		}()
 	}
@@ -385,23 +408,22 @@ func (l *DiskLocation) reconcileCompactStates() {
 	}
 	pending := make(map[volKey]bool)
 	collect := func(dir string) {
-		entries, err := os.ReadDir(dir)
-		if err != nil {
-			return
-		}
-		for _, entry := range entries {
+		if err := eachDirEntry(dir, func(entry os.DirEntry) bool {
 			if entry.IsDir() {
-				continue
+				return true
 			}
 			name := entry.Name()
 			if !strings.HasSuffix(name, ".cpc") && !strings.HasSuffix(name, ".cpd") && !strings.HasSuffix(name, ".cpx") {
-				continue
+				return true
 			}
 			collection, vid, err := parseCollectionVolumeId(name[:len(name)-4])
 			if err != nil {
-				continue
+				return true
 			}
 			pending[volKey{collection, vid}] = true
+			return true
+		}); err != nil {
+			glog.Warningf("scan %s for interrupted compactions: %v", dir, err)
 		}
 	}
 	collect(l.Directory)
@@ -447,7 +469,7 @@ func (l *DiskLocation) DeleteCollectionFromDiskLocation(collection string) (dele
 	wg.Add(2)
 	go func() {
 		for k, v := range delVolsMap {
-			if err := v.Destroy(false, false); err != nil {
+			if err := v.Destroy(false, false, false); err != nil {
 				errChain <- err
 			} else {
 				l.volumesLock.Lock()
@@ -460,8 +482,12 @@ func (l *DiskLocation) DeleteCollectionFromDiskLocation(collection string) (dele
 	}()
 
 	go func() {
-		for _, v := range delEcVolsMap {
+		for k, v := range delEcVolsMap {
 			v.Destroy()
+			l.ecVolumesLock.Lock()
+			done := l.ecVolumesDestroying[k]
+			l.ecVolumesLock.Unlock()
+			close(done)
 		}
 		wg.Done()
 	}()
@@ -483,12 +509,12 @@ func (l *DiskLocation) DeleteCollectionFromDiskLocation(collection string) (dele
 	return
 }
 
-func (l *DiskLocation) deleteVolumeById(vid needle.VolumeId, onlyEmpty bool, keepRemoteData bool) (found bool, e error) {
+func (l *DiskLocation) deleteVolumeById(vid needle.VolumeId, onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) (found bool, e error) {
 	v, ok := l.volumes[vid]
 	if !ok {
 		return
 	}
-	e = v.Destroy(onlyEmpty, keepRemoteData)
+	e = v.Destroy(onlyEmpty, onlyGarbage, keepRemoteData)
 	if e != nil {
 		return
 	}
@@ -497,16 +523,24 @@ func (l *DiskLocation) deleteVolumeById(vid needle.VolumeId, onlyEmpty bool, kee
 	return
 }
 
-func (l *DiskLocation) LoadVolume(diskId uint32, vid needle.VolumeId, needleMapKind NeedleMapKind) bool {
+func (l *DiskLocation) LoadVolume(diskId uint32, vid needle.VolumeId, needleMapKind NeedleMapKind, collection *string) bool {
+	if collection != nil {
+		for _, ext := range []string{".vif", ".idx"} {
+			filename := VolumeFileName(l.Directory, *collection, int(vid)) + ext
+			if fi, err := os.Stat(filename); err == nil && !fi.IsDir() {
+				return l.loadExistingVolume(fi.Name(), needleMapKind, false, 0, diskId)
+			}
+		}
+	}
 	if fileInfo, found := l.LocateVolume(vid); found {
-		return l.loadExistingVolume(fileInfo, needleMapKind, false, 0, diskId)
+		return l.loadExistingVolume(fileInfo.Name(), needleMapKind, false, 0, diskId)
 	}
 	return false
 }
 
 var ErrVolumeNotFound = fmt.Errorf("volume not found")
 
-func (l *DiskLocation) DeleteVolume(vid needle.VolumeId, onlyEmpty bool, keepRemoteData bool) error {
+func (l *DiskLocation) DeleteVolume(vid needle.VolumeId, onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) error {
 	l.volumesLock.Lock()
 	defer l.volumesLock.Unlock()
 
@@ -514,7 +548,7 @@ func (l *DiskLocation) DeleteVolume(vid needle.VolumeId, onlyEmpty bool, keepRem
 	if !ok {
 		return ErrVolumeNotFound
 	}
-	_, err := l.deleteVolumeById(vid, onlyEmpty, keepRemoteData)
+	_, err := l.deleteVolumeById(vid, onlyEmpty, onlyGarbage, keepRemoteData)
 	return err
 }
 
@@ -627,29 +661,40 @@ func (l *DiskLocation) Close() {
 	l.volumesLock.Unlock()
 
 	l.ecVolumesLock.Lock()
-	for _, ecVolume := range l.ecVolumes {
-		ecVolume.Close()
+	ecVolumes := make([]*erasure_coding.EcVolume, 0, len(l.ecVolumes))
+	for vid, ecVolume := range l.ecVolumes {
+		ecVolumes = append(ecVolumes, ecVolume)
+		delete(l.ecVolumes, vid)
 	}
 	l.ecVolumesLock.Unlock()
 
+	// Close outside the write lock: EcVolume.Close takes the deletion-journal
+	// lock, which a running ec.decode can hold — closing under the map lock
+	// would stall every EC lookup and invert the map->journal lock order.
+	for _, ecVolume := range ecVolumes {
+		ecVolume.Close()
+	}
+
 	close(l.closeCh)
 	return
 }
 
 func (l *DiskLocation) LocateVolume(vid needle.VolumeId) (os.DirEntry, bool) {
-	// println("LocateVolume", vid, "on", l.Directory)
-	if dirEntries, err := os.ReadDir(l.Directory); err == nil {
-		for _, entry := range dirEntries {
-			// println("checking", entry.Name(), "...")
-			volId, _, err := volumeIdFromFileName(entry.Name())
-			// println("volId", volId, "err", err)
-			if vid == volId && err == nil {
-				return entry, true
-			}
+	var found os.DirEntry
+	if err := eachDirEntry(l.Directory, func(entry os.DirEntry) bool {
+		if entry.IsDir() {
+			return true
 		}
+		volId, _, err := volumeIdFromFileName(entry.Name())
+		if vid == volId && err == nil {
+			found = entry
+			return false
+		}
+		return true
+	}); err != nil {
+		glog.Warningf("locate volume %d in %s: %v", vid, l.Directory, err)
 	}
-
-	return nil, false
+	return found, found != nil
 }
 
 func (l *DiskLocation) UnUsedSpace(volumeSizeLimit uint64) (unUsedSpace uint64) {
@@ -661,6 +706,8 @@ func (l *DiskLocation) UnUsedSpace(volumeSizeLimit uint64) (unUsedSpace uint64)
 			continue
 		}
 		datSize, idxSize, _ := vol.FileStat()
+		// A preallocated volume already holds its space on disk.
+		datSize = max(datSize, vol.datAllocatedSize())
 		unUsedSpaceVolume := int64(volumeSizeLimit) - int64(datSize+idxSize)
 		glog.V(4).Infof("Volume stats for %d: volumeSizeLimit=%d, datSize=%d idxSize=%d unused=%d", vol.Id, volumeSizeLimit, datSize, idxSize, unUsedSpaceVolume)
 		if unUsedSpaceVolume >= 0 {
@@ -671,9 +718,13 @@ func (l *DiskLocation) UnUsedSpace(volumeSizeLimit uint64) (unUsedSpace uint64)
 	return
 }
 
+// newDiskStatus is a seam letting a test observe the config CheckDiskSpace probes with.
+var newDiskStatus = stats.NewDiskStatusOnStart
+
 func (l *DiskLocation) CheckDiskSpace(config stats.DiskIOProbeConfig) {
+	config.SlowLatency = config.SlowLatencyFor(l.DiskType.ReadableString())
 	if dir, e := filepath.Abs(l.Directory); e == nil {
-		s := stats.NewDiskStatusOnStart(dir, config)
+		s := newDiskStatus(dir, config)
 		if len(s.Error) != 0 {
 			l.isDiskUnavailable.Store(true)
 			stats.VolumeServerDiskErrorGauge.WithLabelValues(l.Directory, "error").Set(1)
diff --git a/weed/storage/disk_location_ec.go b/weed/storage/disk_location_ec.go
index 40b7ec9872..8205ede9c6 100644
--- a/weed/storage/disk_location_ec.go
+++ b/weed/storage/disk_location_ec.go
@@ -7,6 +7,7 @@ import (
 	"regexp"
 	"strconv"
 	"strings"
+	"time"
 
 	"slices"
 
@@ -23,6 +24,17 @@ var (
 	re = regexp.MustCompile(`\.ec\d{2,3}`)
 )
 
+// markEcDestroying records a pending destroy for vid and returns the channel
+// closed when it finishes. Callers must hold ecVolumesLock for writing.
+func (l *DiskLocation) markEcDestroying(vid needle.VolumeId) chan struct{} {
+	if l.ecVolumesDestroying == nil {
+		l.ecVolumesDestroying = make(map[needle.VolumeId]chan struct{})
+	}
+	done := make(chan struct{})
+	l.ecVolumesDestroying[vid] = done
+	return done
+}
+
 func (l *DiskLocation) FindEcVolume(vid needle.VolumeId) (*erasure_coding.EcVolume, bool) {
 	l.ecVolumesLock.RLock()
 	defer l.ecVolumesLock.RUnlock()
@@ -36,13 +48,27 @@ func (l *DiskLocation) FindEcVolume(vid needle.VolumeId) (*erasure_coding.EcVolu
 
 func (l *DiskLocation) DestroyEcVolume(vid needle.VolumeId) {
 	l.ecVolumesLock.Lock()
-	defer l.ecVolumesLock.Unlock()
-
 	ecVolume, found := l.ecVolumes[vid]
+	var done chan struct{}
 	if found {
-		ecVolume.Destroy()
+		done = l.markEcDestroying(vid)
 		delete(l.ecVolumes, vid)
 	}
+	l.ecVolumesLock.Unlock()
+
+	if !found {
+		return
+	}
+	// Destroy outside the write lock: EcVolume.Destroy's Close waits on the
+	// deletion-journal lock, which a running ec.decode can hold — under the
+	// map lock that wait would stall every EC lookup and invert the
+	// map->journal lock order.
+	ecVolume.Destroy()
+
+	// The tombstone stays after close() as this vid's destroy generation: a
+	// remount compares it before and after opening files to spot a destroy
+	// that ran inside the window. The next successful mount clears it.
+	close(done)
 }
 
 // UnloadEcVolume drops the in-memory EcVolume for vid from this one disk without
@@ -140,17 +166,57 @@ func (l *DiskLocation) LoadEcShard(collection string, vid needle.VolumeId, shard
 // (issue #9212).
 func (l *DiskLocation) loadEcShardWithIdxDir(collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, idxDir string) (*erasure_coding.EcVolume, error) {
 
-	ecVolumeShard, err := erasure_coding.NewEcVolumeShard(l.DiskType, l.Directory, collection, vid, shardId)
-	if err != nil {
-		if err == os.ErrNotExist {
-			return nil, os.ErrNotExist
+	// A destroy-in-progress or already-finished one leaves a tombstone; it
+	// stays in the map until a mount clears it, so comparing the channel
+	// before and after opening the shard detects any destroy that could have
+	// unlinked the files in between — including one that ran to completion
+	// inside the window.
+	var ecVolumeShard *erasure_coding.EcVolumeShard
+	for {
+		l.ecVolumesLock.Lock()
+		gen := l.ecVolumesDestroying[vid]
+		l.ecVolumesLock.Unlock()
+		if gen != nil {
+			select {
+			case <-gen:
+				// Destroy already finished; the closed tombstone is the
+				// generation token the post-open recheck compares against.
+			default:
+				// Destroy in flight: its unlinks could detach anything this
+				// mount opens, so wait it out and take a fresh generation.
+				<-gen
+				continue
+			}
 		}
-		return nil, fmt.Errorf("failed to create ec shard %d.%d: %w", vid, shardId, err)
+
+		var err error
+		ecVolumeShard, err = erasure_coding.NewEcVolumeShard(l.DiskType, l.Directory, collection, vid, shardId)
+		if err != nil {
+			if err == os.ErrNotExist {
+				return nil, os.ErrNotExist
+			}
+			return nil, fmt.Errorf("failed to create ec shard %d.%d: %w", vid, shardId, err)
+		}
+
+		l.ecVolumesLock.Lock()
+		if cur := l.ecVolumesDestroying[vid]; cur != gen {
+			// A destroy intervened while the shard was being opened; its
+			// unlink may have detached the file. Drop the handle, wait for
+			// the destroy, and retry on a clean slate.
+			l.ecVolumesLock.Unlock()
+			ecVolumeShard.Unmount() // release the gauge the constructor's Mount took
+			ecVolumeShard.Close()
+			if cur != nil {
+				<-cur
+			}
+			continue
+		}
+		break
 	}
-	l.ecVolumesLock.Lock()
 	defer l.ecVolumesLock.Unlock()
 	ecVolume, found := l.ecVolumes[vid]
 	if !found {
+		var err error
 		ecVolume, err = erasure_coding.NewEcVolume(l.DiskType, l.Directory, idxDir, collection, vid)
 		if err != nil {
 			// Wrap with %w so MountEcShards / startup reconcile can use
@@ -159,8 +225,32 @@ func (l *DiskLocation) loadEcShardWithIdxDir(collection string, vid needle.Volum
 			return nil, fmt.Errorf("failed to create ec volume %d: %w", vid, err)
 		}
 		l.ecVolumes[vid] = ecVolume
+		// Fresh generation for this vid: the next destroy sets a new
+		// tombstone rather than matching the cleared one.
+		delete(l.ecVolumesDestroying, vid)
+	}
+	added, err := ecVolume.AddEcVolumeShard(ecVolumeShard)
+	if err != nil {
+		// The shard could not be registered (e.g. a 0-byte file beside an
+		// index with entries). Leave nothing behind: close the opened shard,
+		// and remove the EcVolume if this call just created it and it holds
+		// no shards — a zero-shard registration would advertise a mount that
+		// serves no data while pinning its descriptors.
+		ecVolumeShard.Unmount() // release the gauge the constructor's Mount took
+		ecVolumeShard.Close()
+		if !found && len(ecVolume.Shards) == 0 {
+			delete(l.ecVolumes, vid)
+			ecVolume.Close()
+		}
+		return nil, err
+	}
+	if !added {
+		// Already registered on this disk (a mount retry): the existing
+		// shard keeps serving; release the duplicate's fd and gauge so
+		// repeated LoadEcShard calls don't leak either.
+		ecVolumeShard.Unmount()
+		ecVolumeShard.Close()
 	}
-	ecVolume.AddEcVolumeShard(ecVolumeShard)
 
 	return ecVolume, nil
 }
@@ -210,21 +300,48 @@ func (l *DiskLocation) loadEcShards(shards []string, collection string, vid need
 	return nil
 }
 
+// staleZeroShardAge guards the zero-sized-shard cleanup in loadAllEcShards: a
+// just-created file of an in-flight VolumeEcShardsCopy is legitimately empty
+// for a moment, while failed-operation residue is old by the next scan.
+const staleZeroShardAge = time.Hour
+
 func (l *DiskLocation) loadAllEcShards(onShardLoad func(collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, ecVolume *erasure_coding.EcVolume)) (err error) {
 
-	dirEntries, err := os.ReadDir(l.Directory)
-	if err != nil {
+	// Keep only the shard and index files this scan acts on: a disk of regular
+	// volumes has millions of .dat/.idx/.vif entries that would otherwise each
+	// cost a slot in the sorted slice below and a stat() for its size.
+	type ecDirEntry struct {
+		name string
+		size int64
+	}
+	var dirEntries []ecDirEntry
+	collect := func(dir string) error {
+		return eachDirEntry(dir, func(entry os.DirEntry) bool {
+			if entry.IsDir() {
+				return true
+			}
+			ext := path.Ext(entry.Name())
+			if !re.MatchString(ext) && ext != ".ecx" {
+				return true
+			}
+			info, infoErr := entry.Info()
+			if infoErr != nil {
+				return true
+			}
+			dirEntries = append(dirEntries, ecDirEntry{name: entry.Name(), size: info.Size()})
+			return true
+		})
+	}
+	if err := collect(l.Directory); err != nil {
 		return fmt.Errorf("load all ec shards in dir %s: %v", l.Directory, err)
 	}
 	if l.IdxDirectory != l.Directory {
-		indexDirEntries, err := os.ReadDir(l.IdxDirectory)
-		if err != nil {
+		if err := collect(l.IdxDirectory); err != nil {
 			return fmt.Errorf("load all ec shards in dir %s: %v", l.IdxDirectory, err)
 		}
-		dirEntries = append(dirEntries, indexDirEntries...)
 	}
-	slices.SortFunc(dirEntries, func(a, b os.DirEntry) int {
-		return strings.Compare(a.Name(), b.Name())
+	slices.SortFunc(dirEntries, func(a, b ecDirEntry) int {
+		return strings.Compare(a.name, b.name)
 	})
 
 	var sameVolumeShards []string
@@ -239,11 +356,8 @@ func (l *DiskLocation) loadAllEcShards(onShardLoad func(collection string, vid n
 	}
 
 	for _, fileInfo := range dirEntries {
-		if fileInfo.IsDir() {
-			continue
-		}
-		ext := path.Ext(fileInfo.Name())
-		name := fileInfo.Name()
+		name := fileInfo.name
+		ext := path.Ext(name)
 		baseName := name[:len(name)-len(ext)]
 
 		collection, volumeId, err := parseCollectionVolumeId(baseName)
@@ -251,22 +365,44 @@ func (l *DiskLocation) loadAllEcShards(onShardLoad func(collection string, vid n
 			continue
 		}
 
-		info, err := fileInfo.Info()
-
-		if err != nil {
+		// A zero-sized shard file is residue of a failed operation (never
+		// loaded, but its presence poisons later rebuilds, which select
+		// inputs from the directory). Delete it once it is old enough that
+		// it cannot be an in-flight copy's just-created file — this scan
+		// also runs from LoadNewVolumes while the server is serving. The
+		// scan merges the Directory and IdxDirectory listings, so the entry
+		// and a candidate path can be different files with one name: each
+		// candidate's own age decides, and a same-named fresh file (possibly
+		// an in-flight copy's just-created one) always survives.
+		if re.MatchString(ext) && fileInfo.size == 0 {
+			for _, dir := range []string{l.Directory, l.IdxDirectory} {
+				p := path.Join(dir, name)
+				fi, statErr := os.Stat(p)
+				if statErr != nil || fi.IsDir() || fi.Size() != 0 {
+					continue
+				}
+				if time.Since(fi.ModTime()) <= staleZeroShardAge {
+					continue
+				}
+				if rmErr := os.Remove(p); rmErr != nil {
+					glog.Warningf("remove zero-sized ec shard %s: %v", p, rmErr)
+				} else {
+					glog.Warningf("removed zero-sized ec shard %s (residue of a failed operation)", p)
+				}
+			}
 			continue
 		}
 
 		// 0 byte files should be only appearing erroneously for ec data files
 		// so we ignore them
-		if re.MatchString(ext) && info.Size() > 0 {
+		if re.MatchString(ext) && fileInfo.size > 0 {
 			// Group shards by both collection and volumeId to avoid mixing collections
 			if prevVolumeId == 0 || (volumeId == prevVolumeId && collection == prevCollection) {
-				sameVolumeShards = append(sameVolumeShards, fileInfo.Name())
+				sameVolumeShards = append(sameVolumeShards, name)
 			} else {
 				// Before starting a new group, check if previous group had orphaned shards
 				l.checkOrphanedShards(sameVolumeShards, prevCollection, prevVolumeId)
-				sameVolumeShards = []string{fileInfo.Name()}
+				sameVolumeShards = []string{name}
 			}
 			prevVolumeId = volumeId
 			prevCollection = collection
@@ -321,16 +457,21 @@ func (l *DiskLocation) loadEcShardsWithIdxDir(shards []string, collection string
 }
 
 func (l *DiskLocation) deleteEcVolumeById(vid needle.VolumeId) (e error) {
-	// Add write lock since we're modifying the ecVolumes map
 	l.ecVolumesLock.Lock()
-	defer l.ecVolumesLock.Unlock()
-
 	ecVolume, ok := l.ecVolumes[vid]
+	var done chan struct{}
+	if ok {
+		done = l.markEcDestroying(vid)
+		delete(l.ecVolumes, vid)
+	}
+	l.ecVolumesLock.Unlock()
+
 	if !ok {
 		return
 	}
+	// Destroy outside the map lock — see DestroyEcVolume.
 	ecVolume.Destroy()
-	delete(l.ecVolumes, vid)
+	close(done)
 	return
 }
 
@@ -342,8 +483,11 @@ func (l *DiskLocation) unmountEcVolumeByCollection(collectionName string) map[ne
 		}
 	}
 
-	for k, _ := range deltaVols {
+	for k := range deltaVols {
 		delete(l.ecVolumes, k)
+		// Caller destroys these outside the lock; tombstone until then so a
+		// remount can't open files the destroy is about to unlink.
+		l.markEcDestroying(k)
 	}
 	return deltaVols
 }
@@ -437,26 +581,17 @@ func (l *DiskLocation) checkOrphanedShards(shards []string, collection string, v
 // erasure_coding.DataShardsCount so that tests writing a custom layout
 // to .vif compute the matching shard size, and so custom-ratio builds
 // (e.g. enterprise) can swap the default without touching this helper.
+// The padded shard length is the same number under both layouts —
+// TestUniformBlockSizeMatchesLegacyShardSize asserts the equivalence for every
+// input — so defer to the encoder's own helper instead of keeping a second copy
+// of the padding rule that a future change would have to be made in twice. An
+// empty .dat keeps its historic answer: the legacy encoder emits no block for
+// it, where UniformBlockSize floors at one.
 func calculateExpectedShardSize(datFileSize int64, dataShardCount int) int64 {
-	if dataShardCount <= 0 {
+	if dataShardCount <= 0 || datFileSize <= 0 {
 		return 0
 	}
-	var shardSize int64
-
-	// Process large blocks (1GB * dataShardCount per batch)
-	largeBatchSize := int64(erasure_coding.ErasureCodingLargeBlockSize) * int64(dataShardCount)
-	numLargeBatches := datFileSize / largeBatchSize
-	shardSize = numLargeBatches * int64(erasure_coding.ErasureCodingLargeBlockSize)
-	remainingSize := datFileSize - (numLargeBatches * largeBatchSize)
-
-	// Process remaining data in small blocks (1MB * dataShardCount per batch)
-	if remainingSize > 0 {
-		smallBatchSize := int64(erasure_coding.ErasureCodingSmallBlockSize) * int64(dataShardCount)
-		numSmallBatches := (remainingSize + smallBatchSize - 1) / smallBatchSize // Ceiling division
-		shardSize += numSmallBatches * int64(erasure_coding.ErasureCodingSmallBlockSize)
-	}
-
-	return shardSize
+	return erasure_coding.UniformBlockSize(datFileSize, dataShardCount)
 }
 
 // validateEcVolume reports whether the EC files for (collection, vid) on this
@@ -580,10 +715,12 @@ func (l *DiskLocation) removeEcVolumeFiles(collection string, vid needle.VolumeI
 	// EC loading for incomplete/missing shards on next startup
 	removeFile(indexBaseFileName+".ecx", "EC index file")
 	removeFile(indexBaseFileName+".ecj", "EC journal file")
+	removeFile(indexBaseFileName+erasure_coding.EcjCompactTmpExt, "EC journal compaction tmp")
 	// Also try the data directory in case .ecx/.ecj were created before -dir.idx was configured
 	if l.IdxDirectory != l.Directory {
 		removeFile(baseFileName+".ecx", "EC index file (fallback)")
 		removeFile(baseFileName+".ecj", "EC journal file (fallback)")
+		removeFile(baseFileName+erasure_coding.EcjCompactTmpExt, "EC journal compaction tmp (fallback)")
 	}
 
 	// Remove all EC shard files (.ec00 ~ .ec31) from data directory
@@ -591,4 +728,12 @@ func (l *DiskLocation) removeEcVolumeFiles(collection string, vid needle.VolumeI
 	for i := 0; i < erasure_coding.MaxShardCount; i++ {
 		removeFile(baseFileName+erasure_coding.ToExt(i), "EC shard file")
 	}
+
+	// Staged 2PC generations (<base>.ecNN.v<N>, versioned .ecx/.ecj/.vif)
+	// belong to this volume's EC state too; leaving them orphans the files.
+	for _, dir := range []string{indexBaseFileName, baseFileName} {
+		if err := erasure_coding.RemoveEcGenerationFiles(dir, 0); err != nil {
+			glog.Warningf("Failed to remove EC generation files for %s: %v", dir, err)
+		}
+	}
 }
diff --git a/weed/storage/disk_location_ec_realworld_test.go b/weed/storage/disk_location_ec_realworld_test.go
index 42ce29bd78..f54682a47d 100644
--- a/weed/storage/disk_location_ec_realworld_test.go
+++ b/weed/storage/disk_location_ec_realworld_test.go
@@ -5,9 +5,24 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 )
 
+// requireDiskSpaceForEncoding skips the subtest when dir's filesystem cannot
+// hold the .dat file plus the shards EC encoding writes for it, so ENOSPC on
+// space-constrained runners doesn't surface as a test failure.
+func requireDiskSpaceForEncoding(t *testing.T, dir string, datFileSize int64, expectedShardSize int64) {
+	t.Helper()
+	needBytes := uint64(datFileSize) +
+		uint64(expectedShardSize)*erasure_coding.TotalShardsCount +
+		16*erasure_coding.ErasureCodingSmallBlockSize
+	if free := stats.NewDiskStatus(dir).Free; free < needBytes {
+		t.Skipf("insufficient free space in %s: have %d bytes, need ~%d to encode a %d-byte volume",
+			dir, free, needBytes, datFileSize)
+	}
+}
+
 // TestCalculateExpectedShardSizeWithRealEncoding validates our shard size calculation
 // by actually running EC encoding on real files and comparing the results
 func TestCalculateExpectedShardSizeWithRealEncoding(t *testing.T) {
@@ -52,6 +67,10 @@ func TestCalculateExpectedShardSizeWithRealEncoding(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			// Calculate expected shard size using our function
+			expectedShardSize := calculateExpectedShardSize(tt.datFileSize, erasure_coding.DataShardsCount)
+			requireDiskSpaceForEncoding(t, tempDir, tt.datFileSize, expectedShardSize)
+
 			// Create a test .dat file with the specified size
 			baseFileName := filepath.Join(tempDir, "test_volume")
 			datFileName := baseFileName + ".dat"
@@ -82,9 +101,6 @@ func TestCalculateExpectedShardSizeWithRealEncoding(t *testing.T) {
 			}
 			datFile.Close()
 
-			// Calculate expected shard size using our function
-			expectedShardSize := calculateExpectedShardSize(tt.datFileSize, erasure_coding.DataShardsCount)
-
 			// Run actual EC encoding
 			_, err = erasure_coding.WriteEcFiles(baseFileName, erasure_coding.BackgroundECContext())
 			if err != nil {
@@ -146,6 +162,9 @@ func TestCalculateExpectedShardSizeEdgeCases(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			expectedShardSize := calculateExpectedShardSize(tt.datFileSize, erasure_coding.DataShardsCount)
+			requireDiskSpaceForEncoding(t, tempDir, tt.datFileSize, expectedShardSize)
+
 			baseFileName := filepath.Join(tempDir, tt.name)
 			datFileName := baseFileName + ".dat"
 
@@ -163,9 +182,6 @@ func TestCalculateExpectedShardSizeEdgeCases(t *testing.T) {
 			datFile.Write(data)
 			datFile.Close()
 
-			// Calculate expected
-			expectedShardSize := calculateExpectedShardSize(tt.datFileSize, erasure_coding.DataShardsCount)
-
 			// Run actual EC encoding
 			_, err = erasure_coding.WriteEcFiles(baseFileName, erasure_coding.BackgroundECContext())
 			if err != nil {
diff --git a/weed/storage/disk_location_ec_test.go b/weed/storage/disk_location_ec_test.go
index f62c9beb68..4c3e77a758 100644
--- a/weed/storage/disk_location_ec_test.go
+++ b/weed/storage/disk_location_ec_test.go
@@ -3,12 +3,17 @@ package storage
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 
+	"github.com/prometheus/client_golang/prometheus/testutil"
+
+	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/seaweedfs/seaweedfs/weed/util"
+	"time"
 )
 
 // closeEcVolumes closes all EC volumes in the given DiskLocation to release file handles.
@@ -718,22 +723,7 @@ func TestLoadExistingVolumeSkipsVifWhenEcxPresent(t *testing.T) {
 				t.Fatalf("write .ecx: %v", err)
 			}
 
-			entries, err := os.ReadDir(dataDir)
-			if err != nil {
-				t.Fatalf("read dir: %v", err)
-			}
-			var vifEntry os.DirEntry
-			for _, e := range entries {
-				if filepath.Ext(e.Name()) == ".vif" {
-					vifEntry = e
-					break
-				}
-			}
-			if vifEntry == nil {
-				t.Fatalf(".vif entry missing from dir listing")
-			}
-
-			loaded := diskLocation.loadExistingVolume(vifEntry, NeedleMapInMemory, false, 0, 0)
+			loaded := diskLocation.loadExistingVolume(filepath.Base(vifPath), NeedleMapInMemory, false, 0, 0)
 			if loaded {
 				t.Fatalf("loadExistingVolume should refuse to load a .vif-only entry when .ecx is present (volume %d)", vid)
 			}
@@ -747,3 +737,255 @@ func TestLoadExistingVolumeSkipsVifWhenEcxPresent(t *testing.T) {
 		})
 	}
 }
+
+// TestLoadAllEcShardsDeletesStaleZeroSizedShards: zero-sized shard files that
+// are old enough to be failed-operation residue (issue 10730) are deleted by
+// the scan; a fresh zero-sized file (possibly an in-flight copy's just-created
+// file) is left alone.
+func TestLoadAllEcShardsDeletesStaleZeroSizedShards(t *testing.T) {
+	dir := t.TempDir()
+	diskLocation := NewDiskLocation(dir, 10, util.MinFreeSpace{}, dir, types.HardDriveType, nil, stats.DefaultDiskIOProbeConfig())
+
+	stale := filepath.Join(dir, "123.ec00")
+	fresh := filepath.Join(dir, "123.ec01")
+	for _, p := range []string{stale, fresh} {
+		if f, err := os.Create(p); err != nil {
+			t.Fatalf("create %s: %v", p, err)
+		} else {
+			f.Close()
+		}
+	}
+	oldTime := time.Now().Add(-2 * staleZeroShardAge)
+	if err := os.Chtimes(stale, oldTime, oldTime); err != nil {
+		t.Fatalf("chtimes: %v", err)
+	}
+
+	if err := diskLocation.loadAllEcShards(nil); err != nil {
+		t.Fatalf("loadAllEcShards: %v", err)
+	}
+
+	if _, err := os.Stat(stale); !os.IsNotExist(err) {
+		t.Errorf("stale zero-sized shard %s not deleted (err=%v)", stale, err)
+	}
+	if _, err := os.Stat(fresh); err != nil {
+		t.Errorf("fresh zero-sized shard %s must survive the scan: %v", fresh, err)
+	}
+}
+
+// TestLoadEcShardRefusesEmptyShardFile: the startup scan skips 0-byte shard
+// files, but the mount RPC path (MountEcShards -> LoadEcShard) opens the file
+// directly. A 0-byte shard beside an index WITH entries is residue of a
+// failed copy — registering it would advertise a size-0 claim that serves
+// nothing and, with placement pinned to the owning disk, would keep
+// attracting re-copies to a file that was never valid. AddEcVolumeShard must
+// refuse it and the loader must leave nothing registered. (A 0-byte shard
+// beside a 0-byte index is the legitimate empty-volume layout and keeps
+// mounting — TestMountEcShards_EmptyEcxMountsSuccessfully.)
+func TestLoadEcShardRefusesEmptyShardFile(t *testing.T) {
+	dir := t.TempDir()
+	diskLocation := NewDiskLocation(dir, 10, util.MinFreeSpace{}, dir, types.HardDriveType, nil, stats.DefaultDiskIOProbeConfig())
+	defer diskLocation.Close() // also stops NewDiskLocation's background goroutine
+
+	// A usable .ecx sits alongside, so without the size gate the load would
+	// succeed and register the empty shard — the .ecx must not mask the gate.
+	empty := filepath.Join(dir, "123.ec00")
+	if f, err := os.Create(empty); err != nil {
+		t.Fatalf("create %s: %v", empty, err)
+	} else {
+		f.Close()
+	}
+	if err := os.WriteFile(filepath.Join(dir, "123.ecx"), make([]byte, 16), 0o644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+
+	_, err := diskLocation.LoadEcShard("", needle.VolumeId(123), erasure_coding.ShardId(0))
+	if err == nil {
+		t.Fatalf("loading a 0-byte shard file must fail")
+	}
+	if !strings.Contains(err.Error(), "empty (0 bytes)") {
+		t.Fatalf("a 0-byte shard should be refused as empty, got: %v", err)
+	}
+	if _, found := diskLocation.FindEcShard(needle.VolumeId(123), erasure_coding.ShardId(0)); found {
+		t.Errorf("a 0-byte shard file must not register a shard claim")
+	}
+	if _, found := diskLocation.FindEcVolume(needle.VolumeId(123)); found {
+		t.Errorf("a refused shard load must not leave an empty EcVolume registered")
+	}
+}
+
+// TestLoadEcShardDuplicateReleasesTheNewShard: a mount retry re-loads a shard
+// this disk already registered. AddEcVolumeShard keeps the existing shard and
+// reports added=false — the loader must then release the duplicate it just
+// opened (fd + mount gauge), or every retry leaks both.
+func TestLoadEcShardDuplicateReleasesTheNewShard(t *testing.T) {
+	dir := t.TempDir()
+	diskLocation := NewDiskLocation(dir, 10, util.MinFreeSpace{}, dir, types.HardDriveType, nil, stats.DefaultDiskIOProbeConfig())
+	defer diskLocation.Close() // also stops NewDiskLocation's background goroutine
+
+	if err := os.WriteFile(filepath.Join(dir, "124.ec00"), []byte("shard bytes"), 0o644); err != nil {
+		t.Fatalf("seed .ec00: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "124.ecx"), make([]byte, 16), 0o644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+
+	gauge := stats.VolumeServerVolumeGauge.WithLabelValues("", "ec_shards")
+	before := testutil.ToFloat64(gauge)
+
+	if _, err := diskLocation.LoadEcShard("", needle.VolumeId(124), erasure_coding.ShardId(0)); err != nil {
+		t.Fatalf("first LoadEcShard: %v", err)
+	}
+	ecVolume, err := diskLocation.LoadEcShard("", needle.VolumeId(124), erasure_coding.ShardId(0))
+	if err != nil {
+		t.Fatalf("duplicate LoadEcShard must succeed as a no-op: %v", err)
+	}
+	if len(ecVolume.Shards) != 1 {
+		t.Errorf("duplicate load registered %d shards; want 1", len(ecVolume.Shards))
+	}
+	if after := testutil.ToFloat64(gauge); after != before+1 {
+		t.Errorf("mount gauge at %v after a duplicate load; want %v (the duplicate's Mount must be released)", after, before+1)
+	}
+}
+
+// TestLoadEcShardWaitsForPendingDestroy: DestroyEcVolume deletes the map entry
+// and destroys files outside ecVolumesLock, so a remount could otherwise open
+// shard files mid-unlink. The ecVolumesDestroying tombstone must hold the mount
+// until the destroy closes it, and the mount must then proceed and clear it.
+func TestLoadEcShardWaitsForPendingDestroy(t *testing.T) {
+	dir := t.TempDir()
+	diskLocation := NewDiskLocation(dir, 10, util.MinFreeSpace{}, dir, types.HardDriveType, nil, stats.DefaultDiskIOProbeConfig())
+	defer diskLocation.Close()
+
+	if err := os.WriteFile(filepath.Join(dir, "125.ec00"), []byte("shard bytes"), 0o644); err != nil {
+		t.Fatalf("seed .ec00: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "125.ecx"), make([]byte, 16), 0o644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+
+	done := make(chan struct{})
+	diskLocation.ecVolumesLock.Lock()
+	diskLocation.ecVolumesDestroying[needle.VolumeId(125)] = done
+	diskLocation.ecVolumesLock.Unlock()
+
+	mounted := make(chan error, 1)
+	go func() {
+		_, err := diskLocation.LoadEcShard("", needle.VolumeId(125), erasure_coding.ShardId(0))
+		mounted <- err
+	}()
+
+	select {
+	case <-mounted:
+		t.Fatal("LoadEcShard returned while a destroy generation was still in flight")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	close(done)
+	select {
+	case err := <-mounted:
+		if err != nil {
+			t.Fatalf("LoadEcShard after destroy completion: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("LoadEcShard did not proceed after the destroy finished")
+	}
+
+	if _, found := diskLocation.FindEcShard(needle.VolumeId(125), erasure_coding.ShardId(0)); !found {
+		t.Fatal("shard must be registered once the pending destroy is over")
+	}
+	diskLocation.ecVolumesLock.RLock()
+	_, tombstoneLeft := diskLocation.ecVolumesDestroying[needle.VolumeId(125)]
+	diskLocation.ecVolumesLock.RUnlock()
+	if tombstoneLeft {
+		t.Error("a successful remount must clear the vid's destroy tombstone")
+	}
+}
+
+// TestDestroyEcVolumeClosesTombstone: once DestroyEcVolume returns, the
+// tombstone is closed so waits unblock, and a fresh remount re-opens the
+// regenerated files rather than anything the destroy unlinked.
+func TestDestroyEcVolumeClosesTombstone(t *testing.T) {
+	dir := t.TempDir()
+	diskLocation := NewDiskLocation(dir, 10, util.MinFreeSpace{}, dir, types.HardDriveType, nil, stats.DefaultDiskIOProbeConfig())
+	defer diskLocation.Close()
+
+	seedShard := func() {
+		if err := os.WriteFile(filepath.Join(dir, "126.ec00"), []byte("shard bytes"), 0o644); err != nil {
+			t.Fatalf("seed .ec00: %v", err)
+		}
+		if err := os.WriteFile(filepath.Join(dir, "126.ecx"), make([]byte, 16), 0o644); err != nil {
+			t.Fatalf("seed .ecx: %v", err)
+		}
+	}
+	seedShard()
+
+	if _, err := diskLocation.LoadEcShard("", needle.VolumeId(126), erasure_coding.ShardId(0)); err != nil {
+		t.Fatalf("initial LoadEcShard: %v", err)
+	}
+	diskLocation.DestroyEcVolume(needle.VolumeId(126))
+
+	if _, found := diskLocation.FindEcVolume(needle.VolumeId(126)); found {
+		t.Fatal("destroyed volume must not stay in ecVolumes")
+	}
+	diskLocation.ecVolumesLock.RLock()
+	done, ok := diskLocation.ecVolumesDestroying[needle.VolumeId(126)]
+	diskLocation.ecVolumesLock.RUnlock()
+	if !ok {
+		t.Fatal("destroy must leave a tombstone behind for remounts to compare against")
+	}
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("tombstone must be closed once DestroyEcVolume returns")
+	}
+	if util.FileExists(filepath.Join(dir, "126.ec00")) {
+		t.Fatal("destroy must have removed the shard file")
+	}
+
+	seedShard()
+	if _, err := diskLocation.LoadEcShard("", needle.VolumeId(126), erasure_coding.ShardId(0)); err != nil {
+		t.Fatalf("remount after destroy: %v", err)
+	}
+	diskLocation.ecVolumesLock.RLock()
+	_, tombstoneLeft := diskLocation.ecVolumesDestroying[needle.VolumeId(126)]
+	diskLocation.ecVolumesLock.RUnlock()
+	if tombstoneLeft {
+		t.Error("remount must clear the stale destroy tombstone")
+	}
+}
+
+// TestLoadAllEcShardsSplitDirZeroSizedCleanup: the scan merges Directory and
+// IdxDirectory listings, so a stale zero-sized file in one directory and a
+// fresh same-named file in the other are different files behind one entry
+// name. Each candidate's own age must decide: the stale one is deleted, the
+// fresh one (possibly an in-flight copy's just-created file) survives.
+func TestLoadAllEcShardsSplitDirZeroSizedCleanup(t *testing.T) {
+	dataDir := t.TempDir()
+	idxDir := t.TempDir()
+	diskLocation := NewDiskLocation(dataDir, 10, util.MinFreeSpace{}, idxDir, types.HardDriveType, nil, stats.DefaultDiskIOProbeConfig())
+
+	fresh := filepath.Join(dataDir, "124.ec00")
+	stale := filepath.Join(idxDir, "124.ec00")
+	for _, p := range []string{fresh, stale} {
+		if f, err := os.Create(p); err != nil {
+			t.Fatalf("create %s: %v", p, err)
+		} else {
+			f.Close()
+		}
+	}
+	oldTime := time.Now().Add(-2 * staleZeroShardAge)
+	if err := os.Chtimes(stale, oldTime, oldTime); err != nil {
+		t.Fatalf("chtimes: %v", err)
+	}
+
+	if err := diskLocation.loadAllEcShards(nil); err != nil {
+		t.Fatalf("loadAllEcShards: %v", err)
+	}
+
+	if _, err := os.Stat(fresh); err != nil {
+		t.Errorf("fresh zero-sized shard %s must survive the scan: %v", fresh, err)
+	}
+	if _, err := os.Stat(stale); !os.IsNotExist(err) {
+		t.Errorf("stale zero-sized shard %s not deleted (err=%v)", stale, err)
+	}
+}
diff --git a/weed/storage/disk_location_linux_test.go b/weed/storage/disk_location_linux_test.go
new file mode 100644
index 0000000000..7815142c40
--- /dev/null
+++ b/weed/storage/disk_location_linux_test.go
@@ -0,0 +1,53 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+func TestUnUsedSpaceCountsPreallocatedVolumesAsFull(t *testing.T) {
+	const volumeSizeLimit = 1 << 20
+	dir := t.TempDir()
+
+	preallocated, err := backend.CreateVolumeFile(filepath.Join(dir, "1.dat"), volumeSizeLimit, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer preallocated.Close()
+	fi, err := preallocated.(*backend.DiskFile).File.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if allocatedSize(fi) < volumeSizeLimit {
+		t.Skipf("filesystem at %s does not support fallocate", dir)
+	}
+
+	plainFile, err := os.Create(filepath.Join(dir, "2.dat"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := plainFile.Write(make([]byte, 4096)); err != nil {
+		t.Fatal(err)
+	}
+	plain := backend.NewDiskFile(plainFile)
+	defer plain.Close()
+	fi, err = plainFile.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The filesystem may round a small file up to a larger allocation unit.
+	plainSize := max(uint64(fi.Size()), allocatedSize(fi))
+
+	diskLocation := DiskLocation{Directory: dir, IdxDirectory: dir}
+	diskLocation.volumes = make(map[needle.VolumeId]*Volume)
+	diskLocation.SetVolume(1, &Volume{Id: 1, dir: dir, dirIdx: dir, DataBackend: preallocated, nm: &mockNeedleMapper{}})
+	diskLocation.SetVolume(2, &Volume{Id: 2, dir: dir, dirIdx: dir, DataBackend: plain, nm: &mockNeedleMapper{}})
+
+	if got, want := diskLocation.UnUsedSpace(volumeSizeLimit), volumeSizeLimit-plainSize; got != want {
+		t.Errorf("unUsedSpace = %d, want %d", got, want)
+	}
+}
diff --git a/weed/storage/disk_location_scan_order_test.go b/weed/storage/disk_location_scan_order_test.go
new file mode 100644
index 0000000000..10724fa1ec
--- /dev/null
+++ b/weed/storage/disk_location_scan_order_test.go
@@ -0,0 +1,42 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// A volume has both an .idx and a .vif, and the scan hands over whichever the
+// filesystem returned first. Which one it was must not decide whether the
+// volume loads -- it used to, through the .vif guard, and only a sorted
+// listing kept the .idx in front.
+func TestScanOrderDoesNotDecideWhetherAVolumeLoads(t *testing.T) {
+	loaded := make(map[string]bool)
+	for _, ext := range []string{".idx", ".vif"} {
+		store := newTestStore(t, 1)
+		location := store.Locations[0]
+		mountTestVolume(t, location, 9, "")
+		location.UnloadVolume(needle.VolumeId(9))
+		// A .dat with data in it and a stray .ecx with no shards beside it: an
+		// interrupted encode, which the EC validation below the guard reclaims.
+		if err := os.Truncate(filepath.Join(location.Directory, "9.dat"), 4096); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(location.Directory, "9.ecx"), make([]byte, 20), 0644); err != nil {
+			t.Fatal(err)
+		}
+
+		location.loadExistingVolume("9"+ext, NeedleMapInMemory, true, 0, 0)
+		_, found := location.FindVolume(needle.VolumeId(9))
+		loaded[ext] = found
+	}
+
+	if loaded[".idx"] != loaded[".vif"] {
+		t.Errorf("scanning the .idx loaded=%v but scanning the .vif loaded=%v", loaded[".idx"], loaded[".vif"])
+	}
+	if !loaded[".idx"] {
+		t.Error("a volume with an .idx beside its .vif did not load")
+	}
+}
diff --git a/weed/storage/disk_location_test.go b/weed/storage/disk_location_test.go
index 554aec6a82..e26939d53a 100644
--- a/weed/storage/disk_location_test.go
+++ b/weed/storage/disk_location_test.go
@@ -1,10 +1,14 @@
 package storage
 
 import (
+	"os"
+	"path/filepath"
 	"reflect"
 	"testing"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
@@ -100,3 +104,54 @@ func TestResolveVolumeIDs(t *testing.T) {
 		t.Errorf("wanted EC volume IDs %v, got %v", want, got)
 	}
 }
+
+// The threshold a disk is probed against is picked from that disk's own type,
+// so a server mixing media holds each of them to its own latency.
+func TestCheckDiskSpaceProbesWithTheDiskTypeThreshold(t *testing.T) {
+	original := newDiskStatus
+	defer func() { newDiskStatus = original }()
+
+	config := stats.DiskIOProbeConfig{
+		SlowLatency: 500 * time.Millisecond,
+		SlowLatencyByDiskType: map[string]time.Duration{
+			types.HddType:  500 * time.Millisecond,
+			types.SsdType:  100 * time.Millisecond,
+			types.NvmeType: 50 * time.Millisecond,
+		},
+	}
+
+	for diskType, want := range map[string]time.Duration{
+		"hdd":       500 * time.Millisecond,
+		"":          500 * time.Millisecond,
+		"ssd":       100 * time.Millisecond,
+		"nvme":      50 * time.Millisecond,
+		"nvme-gen5": 500 * time.Millisecond,
+	} {
+		var probed time.Duration
+		newDiskStatus = func(path string, probeConfig stats.DiskIOProbeConfig) *volume_server_pb.DiskStatus {
+			probed = probeConfig.SlowLatency
+			return &volume_server_pb.DiskStatus{Dir: path}
+		}
+
+		location := &DiskLocation{Directory: t.TempDir(), DiskType: types.ToDiskType(diskType)}
+		location.CheckDiskSpace(config)
+
+		if probed != want {
+			t.Errorf("-disk %q: probed with %v, want %v", diskType, probed, want)
+		}
+	}
+}
+
+// -dir.idx naming a directory that does not exist yet used to leave every
+// volume unable to open its index.
+func TestNewDiskLocation_CreatesIdxDirectory(t *testing.T) {
+	root := t.TempDir()
+	idxDir := filepath.Join(root, "idx", "nested")
+
+	loc := NewDiskLocation(root, 1, util.MinFreeSpace{}, idxDir, types.HardDriveType, nil, stats.DiskIOProbeConfig{})
+	defer loc.Close()
+
+	if _, err := os.Stat(idxDir); err != nil {
+		t.Fatalf("idx dir not created: %v", err)
+	}
+}
diff --git a/weed/storage/erasure_coding/distribution/README.md b/weed/storage/erasure_coding/distribution/README.md
index 91cfd8fe8a..dbd2dfe096 100644
--- a/weed/storage/erasure_coding/distribution/README.md
+++ b/weed/storage/erasure_coding/distribution/README.md
@@ -30,8 +30,8 @@ fmt.Println(dist.Summary())
 // Replication: replication=110 (DCs:2, Racks/DC:2, Nodes/Rack:1)
 // Distribution Plan:
 //   Data Centers: 2 (target 7 shards each, max 9)
-//   Racks per DC: 2 (target 4 shards each, max 6)
-//   Nodes per Rack: 1 (target 4 shards each, max 6)
+//   Racks per DC: 2 (target 4 shards each, max 4)
+//   Nodes per Rack: 1 (target 4 shards each, max 4)
 ```
 
 ### Custom EC Ratios (seaweed-enterprise)
diff --git a/weed/storage/erasure_coding/distribution/analysis.go b/weed/storage/erasure_coding/distribution/analysis.go
index b939df53ee..e19d4624a0 100644
--- a/weed/storage/erasure_coding/distribution/analysis.go
+++ b/weed/storage/erasure_coding/distribution/analysis.go
@@ -1,5 +1,103 @@
 package distribution
 
+// NewTopologyAnalysis creates an empty topology analysis.
+func NewTopologyAnalysis() *TopologyAnalysis {
+	return &TopologyAnalysis{
+		ShardsByDC:   make(map[string]int),
+		ShardsByRack: make(map[string]int),
+		ShardsByNode: make(map[string]int),
+		DCToShards:   make(map[string][]int),
+		RackToShards: make(map[string][]int),
+		NodeToShards: make(map[string][]int),
+		DCToRacks:    make(map[string][]string),
+		RackToNodes:  make(map[string][]*TopologyNode),
+		AllNodes:     make(map[string]*TopologyNode),
+	}
+}
+
+// AddNode registers a node in the topology, including any shards it already
+// holds for the volume being analyzed. A node id may only register once;
+// registering it again updates its capacity and adds any new shards. The
+// first registration wins for the node's place in the topology.
+func (a *TopologyAnalysis) AddNode(node *TopologyNode) {
+	registered, ok := a.AllNodes[node.NodeID]
+	if !ok {
+		registered = node
+		a.AllNodes[node.NodeID] = node
+		a.RackToNodes[rackKey(node.DataCenter, node.Rack)] = append(a.RackToNodes[rackKey(node.DataCenter, node.Rack)], node)
+		if !contains(a.DCToRacks[node.DataCenter], node.Rack) {
+			a.DCToRacks[node.DataCenter] = append(a.DCToRacks[node.DataCenter], node.Rack)
+		}
+	} else {
+		registered.FreeSlots = node.FreeSlots
+		registered.TotalShards = node.TotalShards
+	}
+	seen := node.ShardIDs[:0]
+	for _, shardID := range node.ShardIDs {
+		if !contains(seen, shardID) {
+			seen = append(seen, shardID)
+		}
+	}
+	node.ShardIDs = seen
+	for _, shardID := range node.ShardIDs {
+		a.AddShardLocation(ShardLocation{
+			ShardID:    shardID,
+			NodeID:     registered.NodeID,
+			DataCenter: registered.DataCenter,
+			Rack:       registered.Rack,
+		})
+	}
+}
+
+// AddShardLocation records one shard's placement in the topology. Repeated
+// calls for a shard already known to its node are ignored, so callers may
+// either set ShardIDs on the TopologyNode or register each shard here. A
+// location naming an unregistered node registers that node so the rebalancer
+// can see the shard; for a registered node the node's own dc/rack win.
+func (a *TopologyAnalysis) AddShardLocation(loc ShardLocation) {
+	node, ok := a.AllNodes[loc.NodeID]
+	if !ok {
+		node = &TopologyNode{NodeID: loc.NodeID, DataCenter: loc.DataCenter, Rack: loc.Rack}
+		a.AddNode(node)
+	}
+	if contains(a.NodeToShards[loc.NodeID], loc.ShardID) {
+		return
+	}
+	a.ShardsByDC[node.DataCenter]++
+	a.ShardsByRack[rackKey(node.DataCenter, node.Rack)]++
+	a.ShardsByNode[loc.NodeID]++
+	a.DCToShards[node.DataCenter] = append(a.DCToShards[node.DataCenter], loc.ShardID)
+	a.RackToShards[rackKey(node.DataCenter, node.Rack)] = append(a.RackToShards[rackKey(node.DataCenter, node.Rack)], loc.ShardID)
+	a.NodeToShards[loc.NodeID] = append(a.NodeToShards[loc.NodeID], loc.ShardID)
+	a.TotalShards++
+	if !contains(node.ShardIDs, loc.ShardID) {
+		node.ShardIDs = append(node.ShardIDs, loc.ShardID)
+	}
+}
+
+// rackKey qualifies a rack name with its data center: rack names are only
+// unique within a DC, so two DCs can both hold a "rack1". NUL separates the
+// parts so a "/" inside either name cannot merge distinct racks.
+func rackKey(dc, rack string) string {
+	return dc + "\x00" + rack
+}
+
+// Finalize computes topology statistics after all nodes and shards are added.
+func (a *TopologyAnalysis) Finalize() {
+	a.TotalNodes = len(a.AllNodes)
+	a.TotalRacks = len(a.RackToNodes)
+	a.TotalDCs = len(a.DCToRacks)
+}
+
+func contains[T comparable](list []T, s T) bool {
+	for _, item := range list {
+		if item == s {
+			return true
+		}
+	}
+	return false
+}
+
 // ShardLocation represents where a shard is located in the topology
 type ShardLocation struct {
 	ShardID    int
diff --git a/weed/storage/erasure_coding/distribution/config.go b/weed/storage/erasure_coding/distribution/config.go
index b4935b0c71..4a0402d754 100644
--- a/weed/storage/erasure_coding/distribution/config.go
+++ b/weed/storage/erasure_coding/distribution/config.go
@@ -1,6 +1,14 @@
 // Package distribution provides EC shard distribution algorithms with configurable EC ratios.
 package distribution
 
+import (
+	"fmt"
+	"sort"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+)
+
 // ECConfig holds erasure coding configuration parameters.
 // This replaces hard-coded constants like DataShardsCount=10, ParityShardsCount=4.
 type ECConfig struct {
@@ -17,3 +25,76 @@ type ReplicationConfig struct {
 	// Original replication string (for logging/debugging)
 	Original string
 }
+
+// NewECConfig creates an erasure coding configuration with the given shard counts.
+func NewECConfig(dataShards, parityShards int) (ECConfig, error) {
+	if dataShards < 1 || parityShards < 1 {
+		return ECConfig{}, fmt.Errorf("data and parity shard counts must be positive, got %d+%d", dataShards, parityShards)
+	}
+	return ECConfig{DataShards: dataShards, ParityShards: parityShards}, nil
+}
+
+// DefaultECConfig returns the standard 10+4 erasure coding configuration.
+func DefaultECConfig() ECConfig {
+	return ECConfig{DataShards: erasure_coding.DataShardsCount, ParityShards: erasure_coding.ParityShardsCount}
+}
+
+// NewReplicationConfig parses a replication policy string like "110".
+func NewReplicationConfigFromString(s string) (ReplicationConfig, error) {
+	rp, err := super_block.NewReplicaPlacementFromString(s)
+	if err != nil {
+		return ReplicationConfig{}, err
+	}
+	return NewReplicationConfig(rp), nil
+}
+
+// NewReplicationConfig converts a replica placement into a replication config.
+func NewReplicationConfig(rp *super_block.ReplicaPlacement) ReplicationConfig {
+	if rp == nil {
+		rp = &super_block.ReplicaPlacement{}
+	}
+	return ReplicationConfig{
+		MinDataCenters:  rp.DiffDataCenterCount + 1,
+		MinRacksPerDC:   rp.DiffRackCount + 1,
+		MinNodesPerRack: rp.SameRackCount + 1,
+		Original:        rp.String(),
+	}
+}
+
+// TotalShards returns the number of shards each volume splits into.
+func (ec ECConfig) TotalShards() int {
+	return ec.DataShards + ec.ParityShards
+}
+
+// CanLoseShards returns how many shards of a volume can be missing before the
+// volume is no longer readable.
+func (ec ECConfig) CanLoseShards() int {
+	return ec.ParityShards
+}
+
+// IsDataShard reports whether the shard id is a data shard, which serves reads.
+func (ec ECConfig) IsDataShard(shardID int) bool {
+	return shardID >= 0 && shardID < ec.DataShards
+}
+
+// IsParityShard reports whether the shard id is a parity shard, which is only
+// used for reconstruction.
+func (ec ECConfig) IsParityShard(shardID int) bool {
+	return shardID >= ec.DataShards && shardID < ec.TotalShards()
+}
+
+// SortShardsDataFirst orders shard ids so data shards come before parity
+// shards, for initial placement.
+func (ec ECConfig) SortShardsDataFirst(shards []int) []int {
+	sorted := append([]int(nil), shards...)
+	sort.Ints(sorted)
+	return sorted
+}
+
+// SortShardsParityFirst orders shard ids so parity shards come before data
+// shards, for picking which shards to move away first when rebalancing.
+func (ec ECConfig) SortShardsParityFirst(shards []int) []int {
+	sorted := append([]int(nil), shards...)
+	sort.Sort(sort.Reverse(sort.IntSlice(sorted)))
+	return sorted
+}
diff --git a/weed/storage/erasure_coding/distribution/distribution.go b/weed/storage/erasure_coding/distribution/distribution.go
index 1ef05c55d6..3cf38c5bdc 100644
--- a/weed/storage/erasure_coding/distribution/distribution.go
+++ b/weed/storage/erasure_coding/distribution/distribution.go
@@ -1,5 +1,10 @@
 package distribution
 
+import (
+	"fmt"
+	"strings"
+)
+
 // ECDistribution represents the target distribution of EC shards
 // based on EC configuration and replication policy.
 type ECDistribution struct {
@@ -20,3 +25,97 @@ type ECDistribution struct {
 	MaxShardsPerRack int
 	MaxShardsPerNode int
 }
+
+// CalculateDistribution computes the balanced shard counts each topology level
+// should hold for the given EC ratio spread over the minimum topology the
+// replication policy describes.
+func CalculateDistribution(ec ECConfig, rep ReplicationConfig) *ECDistribution {
+	total := ec.TotalShards()
+	rep.MinDataCenters = max(rep.MinDataCenters, 1)
+	rep.MinRacksPerDC = max(rep.MinRacksPerDC, 1)
+	rep.MinNodesPerRack = max(rep.MinNodesPerRack, 1)
+	dcUnits := rep.MinDataCenters
+	rackUnits := dcUnits * rep.MinRacksPerDC
+	nodeUnits := rackUnits * rep.MinNodesPerRack
+	return &ECDistribution{
+		ECConfig:            ec,
+		ReplicationConfig:   rep,
+		TargetShardsPerDC:   evenShare(total, dcUnits),
+		TargetShardsPerRack: evenShare(total, rackUnits),
+		TargetShardsPerNode: evenShare(total, nodeUnits),
+		MaxShardsPerDC:      maxShare(total, dcUnits, ec.CanLoseShards()),
+		MaxShardsPerRack:    maxShare(total, rackUnits, ec.CanLoseShards()),
+		MaxShardsPerNode:    maxShare(total, nodeUnits, ec.CanLoseShards()),
+	}
+}
+
+// evenShare is the balanced shard count per unit at one topology level.
+func evenShare(total, units int) int {
+	return ceilDivide(total, units)
+}
+
+// maxShare bounds how many shards a single failure domain may hold: the even
+// share plus the slack that would pad the total to the next multiple of the
+// unit count. When the even share is survivable on its own, the loss budget
+// caps the bound so the fault tolerance report stays true even at the max.
+func maxShare(total, units, lossBudget int) int {
+	if units < 1 {
+		units = 1
+	}
+	m := ceilDivide(total, units) + units - total%units
+	if m > total {
+		m = total
+	}
+	if evenShare(total, units) <= lossBudget && m > lossBudget {
+		m = lossBudget
+	}
+	return m
+}
+
+func ceilDivide(a, b int) int {
+	if b < 1 {
+		return a
+	}
+	return (a + b - 1) / b
+}
+
+// Summary describes the distribution plan in human-readable form.
+func (d *ECDistribution) Summary() string {
+	var sb strings.Builder
+	ec := d.ECConfig
+	rep := d.ReplicationConfig
+	fmt.Fprintf(&sb, "EC Configuration: %d+%d (total: %d, can lose: %d)\n",
+		ec.DataShards, ec.ParityShards, ec.TotalShards(), ec.CanLoseShards())
+	fmt.Fprintf(&sb, "Replication: replication=%s (DCs:%d, Racks/DC:%d, Nodes/Rack:%d)\n",
+		rep.Original, rep.MinDataCenters, rep.MinRacksPerDC, rep.MinNodesPerRack)
+	sb.WriteString("Distribution Plan:\n")
+	fmt.Fprintf(&sb, "  Data Centers: %d (target %d shards each, max %d)\n",
+		rep.MinDataCenters, d.TargetShardsPerDC, d.MaxShardsPerDC)
+	fmt.Fprintf(&sb, "  Racks per DC: %d (target %d shards each, max %d)\n",
+		rep.MinRacksPerDC, d.TargetShardsPerRack, d.MaxShardsPerRack)
+	fmt.Fprintf(&sb, "  Nodes per Rack: %d (target %d shards each, max %d)\n",
+		rep.MinNodesPerRack, d.TargetShardsPerNode, d.MaxShardsPerNode)
+	return sb.String()
+}
+
+// FaultToleranceAnalysis reports whether losing one unit at each topology
+// level still leaves enough shards to reconstruct the volume.
+func (d *ECDistribution) FaultToleranceAnalysis() string {
+	var sb strings.Builder
+	ec := d.ECConfig
+	fmt.Fprintf(&sb, "Fault Tolerance Analysis for %d+%d:\n", ec.DataShards, ec.ParityShards)
+	writeLevel := func(name string, target int) {
+		remaining := ec.TotalShards() - target
+		status := "SURVIVABLE ✓"
+		if remaining < ec.DataShards {
+			status = "NOT SURVIVABLE ✗"
+		}
+		fmt.Fprintf(&sb, "  %s Failure: %s\n", name, status)
+		fmt.Fprintf(&sb, "    - Losing one %s loses ~%d shards\n", name, target)
+		fmt.Fprintf(&sb, "    - Remaining: %d shards (need %d)\n", remaining, ec.DataShards)
+	}
+	writeLevel("DC", d.TargetShardsPerDC)
+	writeLevel("Rack", d.TargetShardsPerRack)
+	writeLevel("Node", d.TargetShardsPerNode)
+	return sb.String()
+}
diff --git a/weed/storage/erasure_coding/distribution/distribution_test.go b/weed/storage/erasure_coding/distribution/distribution_test.go
new file mode 100644
index 0000000000..fe6962dccf
--- /dev/null
+++ b/weed/storage/erasure_coding/distribution/distribution_test.go
@@ -0,0 +1,500 @@
+package distribution
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDefaultECConfig(t *testing.T) {
+	ec := DefaultECConfig()
+	assert.Equal(t, 10, ec.DataShards)
+	assert.Equal(t, 4, ec.ParityShards)
+	assert.Equal(t, 14, ec.TotalShards())
+	assert.Equal(t, 4, ec.CanLoseShards())
+	assert.True(t, ec.IsDataShard(0))
+	assert.True(t, ec.IsDataShard(9))
+	assert.False(t, ec.IsDataShard(10))
+	assert.True(t, ec.IsParityShard(13))
+	assert.False(t, ec.IsParityShard(14))
+	assert.Equal(t, []int{0, 1, 10, 11}, ec.SortShardsDataFirst([]int{11, 1, 10, 0}))
+	assert.Equal(t, []int{13, 12, 2, 1}, ec.SortShardsParityFirst([]int{2, 13, 1, 12}))
+}
+
+func TestNewECConfig(t *testing.T) {
+	ec, err := NewECConfig(8, 4)
+	require.NoError(t, err)
+	assert.Equal(t, 12, ec.TotalShards())
+
+	for _, bad := range [][2]int{{0, 4}, {8, 0}, {-1, 4}} {
+		_, err := NewECConfig(bad[0], bad[1])
+		assert.Error(t, err, "config %v must be rejected", bad)
+	}
+}
+
+func TestNewReplicationConfigFromString(t *testing.T) {
+	rep, err := NewReplicationConfigFromString("110")
+	require.NoError(t, err)
+	assert.Equal(t, 2, rep.MinDataCenters)
+	assert.Equal(t, 2, rep.MinRacksPerDC)
+	assert.Equal(t, 1, rep.MinNodesPerRack)
+	assert.Equal(t, "110", rep.Original)
+
+	rep, err = NewReplicationConfigFromString("000")
+	require.NoError(t, err)
+	assert.Equal(t, 1, rep.MinDataCenters)
+	assert.Equal(t, 1, rep.MinRacksPerDC)
+	assert.Equal(t, 1, rep.MinNodesPerRack)
+
+	_, err = NewReplicationConfigFromString("abc")
+	assert.Error(t, err)
+}
+
+func TestCalculateDistribution(t *testing.T) {
+	rep, err := NewReplicationConfigFromString("110")
+	require.NoError(t, err)
+	dist := CalculateDistribution(DefaultECConfig(), rep)
+
+	assert.Equal(t, 7, dist.TargetShardsPerDC)
+	assert.Equal(t, 4, dist.TargetShardsPerRack)
+	assert.Equal(t, 4, dist.TargetShardsPerNode)
+	assert.Equal(t, 9, dist.MaxShardsPerDC)
+	assert.Equal(t, 4, dist.MaxShardsPerRack)
+	assert.Equal(t, 4, dist.MaxShardsPerNode)
+
+	expected := "EC Configuration: 10+4 (total: 14, can lose: 4)\n" +
+		"Replication: replication=110 (DCs:2, Racks/DC:2, Nodes/Rack:1)\n" +
+		"Distribution Plan:\n" +
+		"  Data Centers: 2 (target 7 shards each, max 9)\n" +
+		"  Racks per DC: 2 (target 4 shards each, max 4)\n" +
+		"  Nodes per Rack: 1 (target 4 shards each, max 4)\n"
+	assert.Equal(t, expected, dist.Summary())
+}
+
+// The reported max may not exceed the loss budget at a survivable level:
+// 8+4 over "200" lets a domain drift to 7 of 12 shards, but losing that domain
+// would leave 5 < 8 — capping the max at the budget keeps SURVIVABLE true.
+func TestCalculateDistributionMaxWithinLossBudget(t *testing.T) {
+	ec, err := NewECConfig(8, 4)
+	require.NoError(t, err)
+	rep, err := NewReplicationConfigFromString("200")
+	require.NoError(t, err)
+	dist := CalculateDistribution(ec, rep)
+
+	assert.Equal(t, 4, dist.TargetShardsPerDC)
+	assert.Equal(t, 4, dist.MaxShardsPerDC)
+	assert.Equal(t, 4, dist.MaxShardsPerRack)
+	assert.Equal(t, 4, dist.MaxShardsPerNode)
+
+	// a level whose even share already exceeds the budget keeps the slack bound
+	dist = CalculateDistribution(DefaultECConfig(), rep)
+	assert.Equal(t, 6, dist.MaxShardsPerDC) // even 5 > 4: DC loss is not survivable anyway
+}
+
+func TestCalculateDistributionSingleDomain(t *testing.T) {
+	rep, err := NewReplicationConfigFromString("000")
+	require.NoError(t, err)
+	dist := CalculateDistribution(DefaultECConfig(), rep)
+	assert.Equal(t, 14, dist.TargetShardsPerDC)
+	assert.Equal(t, 14, dist.MaxShardsPerDC)
+}
+
+func TestFaultToleranceAnalysis(t *testing.T) {
+	ec, err := NewECConfig(8, 4)
+	require.NoError(t, err)
+	rep, err := NewReplicationConfigFromString("200")
+	require.NoError(t, err)
+	dist := CalculateDistribution(ec, rep)
+
+	analysis := dist.FaultToleranceAnalysis()
+	assert.Contains(t, analysis, "Fault Tolerance Analysis for 8+4:")
+	assert.Contains(t, analysis, "DC Failure: SURVIVABLE")
+	assert.Contains(t, analysis, "- Losing one DC loses ~4 shards")
+	assert.Contains(t, analysis, "- Remaining: 8 shards (need 8)")
+}
+
+func TestFaultToleranceAnalysisNotSurvivable(t *testing.T) {
+	rep, err := NewReplicationConfigFromString("000")
+	require.NoError(t, err)
+	dist := CalculateDistribution(DefaultECConfig(), rep)
+	analysis := dist.FaultToleranceAnalysis()
+	assert.Contains(t, analysis, "DC Failure: NOT SURVIVABLE")
+	assert.Contains(t, analysis, "Rack Failure: NOT SURVIVABLE")
+	assert.Contains(t, analysis, "Node Failure: NOT SURVIVABLE")
+}
+
+func makeNode(id, dc, rack string, freeSlots int, shards ...int) *TopologyNode {
+	return &TopologyNode{NodeID: id, DataCenter: dc, Rack: rack, FreeSlots: freeSlots, ShardIDs: shards}
+}
+
+func TestTopologyAnalysis(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 5, 0, 1))
+	a.AddNode(makeNode("n2", "dc1", "r1", 5, 2))
+	a.AddNode(makeNode("n3", "dc2", "r2", 5))
+	a.Finalize()
+
+	assert.Equal(t, 3, a.TotalShards)
+	assert.Equal(t, 3, a.TotalNodes)
+	assert.Equal(t, 2, a.TotalRacks)
+	assert.Equal(t, 2, a.TotalDCs)
+	assert.Equal(t, 3, a.ShardsByDC["dc1"])
+	assert.Equal(t, 0, a.ShardsByDC["dc2"])
+	assert.Equal(t, []string{"r1"}, a.DCToRacks["dc1"])
+	assert.Equal(t, []int{0, 1, 2}, a.RackToShards[rackKey("dc1", "r1")])
+}
+
+// A node registered twice must still count once in rack and shard totals.
+func TestTopologyAnalysisDuplicateNode(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 5, 0, 1))
+	a.AddNode(makeNode("n1", "dc1", "r1", 5, 0, 1))
+	a.Finalize()
+
+	assert.Equal(t, 1, a.TotalNodes)
+	assert.Len(t, a.RackToNodes[rackKey("dc1", "r1")], 1)
+	assert.Equal(t, 2, a.ShardsByNode["n1"])
+}
+
+// A node auto-registered by a shard location gets its real capacity when the
+// node itself registers later, plus any shards the location did not mention.
+func TestTopologyAnalysisNodeCapacityLateRegistration(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddShardLocation(ShardLocation{ShardID: 0, NodeID: "n1", DataCenter: "dc1", Rack: "r1"})
+	a.AddNode(makeNode("n1", "dc1", "r1", 10, 1))
+	a.Finalize()
+
+	assert.Equal(t, 10, a.AllNodes["n1"].FreeSlots)
+	assert.Equal(t, []int{0, 1}, a.AllNodes["n1"].ShardIDs)
+	assert.Equal(t, 2, a.ShardsByNode["n1"])
+	assert.Len(t, a.RackToNodes[rackKey("dc1", "r1")], 1)
+}
+
+// Shards may be registered either through TopologyNode.ShardIDs or through
+// AddShardLocation — both must leave the node holding the shards.
+func TestTopologyAnalysisAddShardLocation(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 5))
+	a.AddShardLocation(ShardLocation{ShardID: 0, NodeID: "n1", DataCenter: "dc1", Rack: "r1"})
+	a.AddShardLocation(ShardLocation{ShardID: 1, NodeID: "n1", DataCenter: "dc1", Rack: "r1"})
+	a.AddShardLocation(ShardLocation{ShardID: 1, NodeID: "n1", DataCenter: "dc1", Rack: "r1"})
+	a.Finalize()
+
+	assert.Equal(t, 2, a.TotalShards)
+	assert.Equal(t, 2, a.ShardsByNode["n1"])
+	assert.Equal(t, []int{0, 1}, a.AllNodes["n1"].ShardIDs)
+}
+
+// Rack names are only unique within a DC, so dc1/rack1 and dc2/rack1 are
+// distinct domains.
+func TestTopologyAnalysisSameRackNameAcrossDCs(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "rack1", 5, 0, 1))
+	a.AddNode(makeNode("n2", "dc2", "rack1", 5, 2))
+	a.Finalize()
+
+	assert.Equal(t, 2, a.TotalDCs)
+	assert.Equal(t, 2, a.TotalRacks)
+	assert.Equal(t, 2, a.ShardsByRack[rackKey("dc1", "rack1")])
+	assert.Equal(t, 1, a.ShardsByRack[rackKey("dc2", "rack1")])
+}
+
+// A "/" inside a data-center or rack name must not merge distinct racks.
+func TestTopologyAnalysisSlashInNames(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "a", "b/c", 5, 0))
+	a.AddNode(makeNode("n2", "a/b", "c", 5, 1))
+	a.Finalize()
+
+	assert.Equal(t, 2, a.TotalRacks)
+	assert.Equal(t, 1, a.ShardsByRack[rackKey("a", "b/c")])
+	assert.Equal(t, 1, a.ShardsByRack[rackKey("a/b", "c")])
+}
+
+func TestPlanRebalanceAcrossDCs(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("a1", "dcA", "rA1", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("a2", "dcA", "rA2", 10, 4, 5, 6, 7))
+	a.AddNode(makeNode("a3", "dcA", "rA3", 10, 8, 9, 10, 11))
+	a.AddNode(makeNode("a4", "dcA", "rA4", 10, 12, 13))
+	a.AddNode(makeNode("b1", "dcB", "rB1", 10))
+	a.AddNode(makeNode("b2", "dcB", "rB2", 10))
+	a.Finalize()
+
+	rep, err := NewReplicationConfigFromString("110")
+	require.NoError(t, err)
+	plan, err := NewRebalancer(DefaultECConfig(), rep).PlanRebalance(a)
+	require.NoError(t, err)
+
+	assert.Equal(t, 7, plan.MovesAcrossDC)
+	assert.Equal(t, 7, plan.Analysis.ShardsByDC["dcA"])
+	assert.Equal(t, 7, plan.Analysis.ShardsByDC["dcB"])
+
+	// the given analysis still describes the un-moved layout
+	assert.Equal(t, 14, a.ShardsByDC["dcA"])
+	assert.Equal(t, 0, a.ShardsByDC["dcB"])
+	assert.Equal(t, []int{0, 1, 2, 3}, a.AllNodes["a1"].ShardIDs)
+
+	// parity shards (10-13) move before data shards
+	assert.True(t, plan.Moves[0].ShardID >= 10)
+	assert.Equal(t, "b1", plan.Moves[0].DestNode.NodeID)
+}
+
+func TestPlanRebalanceAcrossRacks(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("n2", "dc1", "r2", 10))
+	a.Finalize()
+
+	rep, err := NewReplicationConfigFromString("110")
+	require.NoError(t, err)
+	plan, err := NewRebalancer(DefaultECConfig(), rep).PlanRebalance(a)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, plan.TotalMoves)
+	assert.Equal(t, 2, plan.MovesAcrossRack)
+	assert.Equal(t, 2, plan.Analysis.ShardsByRack[rackKey("dc1", "r1")])
+	assert.Equal(t, 2, plan.Analysis.ShardsByRack[rackKey("dc1", "r2")])
+	// parity-first ordering: shards 3 then 2 move out of r1
+	assert.Equal(t, 3, plan.Moves[0].ShardID)
+	assert.Equal(t, 2, plan.Moves[1].ShardID)
+}
+
+func TestPlanRebalanceWithinRack(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("n2", "dc1", "r1", 10))
+	a.Finalize()
+
+	rep, err := NewReplicationConfigFromString("001")
+	require.NoError(t, err)
+	plan, err := NewRebalancer(DefaultECConfig(), rep).PlanRebalance(a)
+	require.NoError(t, err)
+
+	assert.Equal(t, 2, plan.TotalMoves)
+	assert.Equal(t, 2, plan.MovesWithinRack)
+	assert.Equal(t, 2, plan.Analysis.ShardsByNode["n1"])
+	assert.Equal(t, 2, plan.Analysis.ShardsByNode["n2"])
+	assert.Equal(t, []int{3, 2}, plan.Analysis.AllNodes["n2"].ShardIDs)
+	assert.Equal(t, []int{0, 1, 2, 3}, a.AllNodes["n1"].ShardIDs)
+}
+
+func TestPlanRebalanceRespectsFreeSlots(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("n2", "dc1", "r1", 1))
+	a.Finalize()
+
+	plan, err := NewRebalancer(DefaultECConfig(), ReplicationConfig{MinDataCenters: 1, MinRacksPerDC: 1, MinNodesPerRack: 2}).PlanRebalance(a)
+	require.NoError(t, err)
+
+	assert.Equal(t, 1, plan.TotalMoves, "only one slot is free on the destination")
+	assert.Equal(t, 3, plan.Analysis.ShardsByNode["n1"])
+	assert.Equal(t, 1, plan.Analysis.ShardsByNode["n2"])
+	assert.Equal(t, 0, plan.Analysis.AllNodes["n2"].FreeSlots)
+	assert.Equal(t, 1, a.AllNodes["n2"].FreeSlots)
+}
+
+func TestPlanRebalanceNoopWhenBalanced(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 10, 0, 1))
+	a.AddNode(makeNode("n2", "dc1", "r1", 10, 2, 3))
+	a.Finalize()
+
+	plan, err := NewRebalancer(DefaultECConfig(), ReplicationConfig{MinDataCenters: 1, MinRacksPerDC: 1, MinNodesPerRack: 2}).PlanRebalance(a)
+	require.NoError(t, err)
+	assert.Equal(t, 0, plan.TotalMoves)
+}
+
+func TestPlanRebalanceNilAnalysis(t *testing.T) {
+	_, err := NewRebalancer(DefaultECConfig(), ReplicationConfig{}).PlanRebalance(nil)
+	assert.Error(t, err)
+}
+
+// Node balancing inside a rack must aim for the rack's count after
+// DC- and rack-level moves, not the count the rack started with.
+func TestPlanRebalanceNodeTargetAfterMoves(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 10, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13))
+	a.AddNode(makeNode("n2", "dc1", "r1", 10))
+	a.AddNode(makeNode("n3", "dc1", "r2", 10))
+	a.Finalize()
+
+	rep, err := NewReplicationConfigFromString("010")
+	require.NoError(t, err)
+	plan, err := NewRebalancer(DefaultECConfig(), rep).PlanRebalance(a)
+	require.NoError(t, err)
+
+	assert.Equal(t, 7, plan.Analysis.ShardsByRack[rackKey("dc1", "r1")])
+	assert.Equal(t, 7, plan.Analysis.ShardsByRack[rackKey("dc1", "r2")])
+	assert.Equal(t, 4, plan.Analysis.ShardsByNode["n1"])
+	assert.Equal(t, 3, plan.Analysis.ShardsByNode["n2"])
+	assert.Equal(t, []int{0, 1, 2, 3}, plan.Analysis.AllNodes["n1"].ShardIDs)
+	assert.Equal(t, []int{6, 5, 4}, plan.Analysis.AllNodes["n2"].ShardIDs)
+}
+
+// A shard that already has a copy anywhere in the destination domain must not
+// be moved there again — the second copy adds no redundancy.
+func TestPlanRebalanceNoDuplicateShardInDomain(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("a1", "dcA", "rA1", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("b1", "dcB", "rB1", 10, 3))
+	a.AddNode(makeNode("b2", "dcB", "rB2", 10))
+	a.Finalize()
+
+	rep, err := NewReplicationConfigFromString("100")
+	require.NoError(t, err)
+	plan, err := NewRebalancer(DefaultECConfig(), rep).PlanRebalance(a)
+	require.NoError(t, err)
+
+	// dcA holds 4, dcB holds 1, target 3 each: one move, and it cannot be shard 3
+	require.Len(t, plan.Moves, 1)
+	assert.Equal(t, 2, plan.Moves[0].ShardID)
+	assert.Equal(t, []int{2}, plan.Analysis.AllNodes["b2"].ShardIDs)
+	assert.Equal(t, []int{3}, plan.Analysis.AllNodes["b1"].ShardIDs)
+}
+
+// Shard locations may be registered without registering the node first; the
+// rebalancer must still see the shard, counted under the node's own dc/rack.
+func TestPlanRebalanceShardForUnregisteredNode(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddShardLocation(ShardLocation{ShardID: 0, NodeID: "n1", DataCenter: "dc1", Rack: "r1"})
+	a.AddShardLocation(ShardLocation{ShardID: 1, NodeID: "n1", DataCenter: "dc1", Rack: "r1"})
+	a.AddNode(makeNode("n2", "dc1", "r1", 10))
+	a.Finalize()
+
+	assert.Equal(t, 1, a.TotalDCs)
+	assert.Equal(t, 2, a.ShardsByNode["n1"])
+	assert.Equal(t, []int{0, 1}, a.AllNodes["n1"].ShardIDs)
+
+	plan, err := NewRebalancer(DefaultECConfig(), ReplicationConfig{MinDataCenters: 1, MinRacksPerDC: 1, MinNodesPerRack: 2}).PlanRebalance(a)
+	require.NoError(t, err)
+	assert.Equal(t, 1, plan.TotalMoves)
+	assert.Equal(t, 1, plan.Analysis.ShardsByNode["n1"])
+	assert.Equal(t, 1, plan.Analysis.ShardsByNode["n2"])
+}
+
+// When the most overloaded domain can only offer duplicates, balancing must
+// fall through to the next overloaded source rather than stop.
+func TestPlanRebalanceSkipsBlockedSource(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("a1", "dcA", "rA", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("a2", "dcA", "rA", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("a3", "dcA", "rA", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("b1", "dcB", "rB", 10, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13))
+	a.AddNode(makeNode("c1", "dcC", "rC", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("c2", "dcC", "rC", 10))
+	a.AddNode(makeNode("d1", "dcD", "rD", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("d2", "dcD", "rD", 10))
+	a.Finalize()
+
+	plan, err := NewRebalancer(DefaultECConfig(), ReplicationConfig{MinDataCenters: 4, MinRacksPerDC: 1, MinNodesPerRack: 1}).PlanRebalance(a)
+	require.NoError(t, err)
+
+	// dcA is stuck on duplicates (target 8), but dcB still sheds two shards
+	assert.Equal(t, 12, plan.Analysis.ShardsByDC["dcA"])
+	assert.Equal(t, 8, plan.Analysis.ShardsByDC["dcB"])
+	assert.Equal(t, 5, plan.Analysis.ShardsByDC["dcC"])
+	assert.Equal(t, 5, plan.Analysis.ShardsByDC["dcD"])
+}
+
+// A shard that dc-level balancing lands on a node can be shed again at rack or
+// node level; its moves must collapse to one transfer to the final holder.
+func TestPlanRebalanceCollapsesChainedMoves(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("a1", "dcA", "rA", 20, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13))
+	a.AddNode(makeNode("b1", "dcB", "rB1", 20))
+	a.AddNode(makeNode("c1", "dcB", "rB2", 20))
+	a.AddNode(makeNode("c2", "dcB", "rB2", 20))
+	a.AddNode(makeNode("c3", "dcB", "rB2", 20))
+	a.Finalize()
+
+	rep, err := NewReplicationConfigFromString("100")
+	require.NoError(t, err)
+	plan, err := NewRebalancer(DefaultECConfig(), rep).PlanRebalance(a)
+	require.NoError(t, err)
+
+	moved := make(map[int]string)
+	for _, m := range plan.Moves {
+		_, twice := moved[m.ShardID]
+		assert.False(t, twice, "shard %d moves more than once", m.ShardID)
+		moved[m.ShardID] = m.DestNode.NodeID
+		assert.Contains(t, m.DestNode.ShardIDs, m.ShardID)
+	}
+	assert.Equal(t, 7, plan.TotalMoves)
+	assert.Equal(t, 7, plan.MovesAcrossDC)
+	// shard 12 reached b1 through c1 in simulation; the plan moves it directly
+	assert.Equal(t, "b1", moved[12])
+	assert.Equal(t, []int{13, 9, 12}, plan.Analysis.AllNodes["b1"].ShardIDs)
+}
+
+// A collapsed move must not be scheduled before the departures that free its
+// destination: applying the plan in order may never target a full node.
+func TestPlanRebalanceMovesRespectSlots(t *testing.T) {
+	ec, err := NewECConfig(20, 4)
+	require.NoError(t, err)
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("a1", "dcA", "rA", 20, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16))
+	a.AddNode(makeNode("b1", "dcB", "rB1", 10))
+	a.AddNode(makeNode("b2", "dcB", "rB1", 0, 20, 21, 22, 23))
+	a.AddNode(makeNode("c1", "dcB", "rB2", 10, 17, 18, 19))
+	a.Finalize()
+
+	rep, err := NewReplicationConfigFromString("100")
+	require.NoError(t, err)
+	plan, err := NewRebalancer(ec, rep).PlanRebalance(a)
+	require.NoError(t, err)
+
+	free := make(map[string]int)
+	for _, n := range a.AllNodes {
+		free[n.NodeID] = n.FreeSlots
+	}
+	firstDeparture, firstArrival := -1, -1
+	for i, m := range plan.Moves {
+		assert.Greater(t, free[m.DestNode.NodeID], 0, "move %d targets a full node", i)
+		free[m.DestNode.NodeID]--
+		free[m.SourceNode.NodeID]++
+		if m.DestNode.NodeID == "b2" && firstArrival < 0 {
+			firstArrival = i
+		}
+		if m.SourceNode.NodeID == "b2" && firstDeparture < 0 {
+			firstDeparture = i
+		}
+	}
+	moved := make(map[int]string)
+	for _, m := range plan.Moves {
+		moved[m.ShardID] = m.DestNode.NodeID
+	}
+	// shard 16 reaches full-at-start b2 through b1; the plan moves it directly,
+	// but only after the departures that free b2's slots
+	assert.Equal(t, "b2", moved[16])
+	assert.Equal(t, "c1", moved[23])
+	assert.Greater(t, firstArrival, firstDeparture)
+}
+
+func TestPlanRebalanceNoDuplicateShardOnNode(t *testing.T) {
+	a := NewTopologyAnalysis()
+	a.AddNode(makeNode("n1", "dc1", "r1", 10, 0, 1, 2, 3))
+	a.AddNode(makeNode("n2", "dc1", "r1", 10, 3))
+	a.Finalize()
+
+	plan, err := NewRebalancer(DefaultECConfig(), ReplicationConfig{MinDataCenters: 1, MinRacksPerDC: 1, MinNodesPerRack: 2}).PlanRebalance(a)
+	require.NoError(t, err)
+
+	// n2 already holds 3, so the balancing move brings a different shard
+	assert.Equal(t, 3, plan.Analysis.ShardsByNode["n1"])
+	assert.Equal(t, 2, plan.Analysis.ShardsByNode["n2"])
+	assert.Equal(t, []int{3, 2}, plan.Analysis.AllNodes["n2"].ShardIDs)
+	for _, move := range plan.Moves {
+		assert.NotContains(t, move.DestNode.ShardIDs[:len(move.DestNode.ShardIDs)-1], move.ShardID,
+			"shard %d must not be moved onto a node already holding it", move.ShardID)
+	}
+}
+
+func TestCalculateDistributionZeroReplication(t *testing.T) {
+	dist := CalculateDistribution(DefaultECConfig(), ReplicationConfig{})
+	assert.Equal(t, 14, dist.TargetShardsPerDC)
+	assert.Contains(t, dist.Summary(), "Data Centers: 1")
+	assert.NotPanics(t, func() { dist.FaultToleranceAnalysis() })
+}
diff --git a/weed/storage/erasure_coding/distribution/rebalancer.go b/weed/storage/erasure_coding/distribution/rebalancer.go
index 2442e59a97..7ee178783b 100644
--- a/weed/storage/erasure_coding/distribution/rebalancer.go
+++ b/weed/storage/erasure_coding/distribution/rebalancer.go
@@ -1,5 +1,10 @@
 package distribution
 
+import (
+	"fmt"
+	"sort"
+)
+
 // ShardMove represents a planned shard move
 type ShardMove struct {
 	ShardID    int
@@ -12,7 +17,7 @@ type ShardMove struct {
 type RebalancePlan struct {
 	Moves        []ShardMove
 	Distribution *ECDistribution
-	Analysis     *TopologyAnalysis
+	Analysis     *TopologyAnalysis // simulated layout once every move applies; move endpoints reference its nodes
 
 	// Statistics
 	TotalMoves      int
@@ -26,3 +31,305 @@ type Rebalancer struct {
 	ecConfig  ECConfig
 	repConfig ReplicationConfig
 }
+
+// NewRebalancer creates a rebalancer for the given EC ratio and replication policy.
+func NewRebalancer(ec ECConfig, rep ReplicationConfig) *Rebalancer {
+	return &Rebalancer{ecConfig: ec, repConfig: rep}
+}
+
+// PlanRebalance generates shard moves that bring the volume's shard layout to
+// the balanced distribution: first across data centers, then racks within each
+// data center, then nodes within each rack. Moves stop when source and
+// destination both reach their even share, or when destination nodes have no
+// free slots. The moves are planned on a copy of the topology, so the given
+// analysis still describes the cluster as it is; plan.Analysis shows the
+// layout the moves would produce.
+func (r *Rebalancer) PlanRebalance(analysis *TopologyAnalysis) (*RebalancePlan, error) {
+	if analysis == nil {
+		return nil, fmt.Errorf("cannot plan rebalancing without a topology analysis")
+	}
+	sim := NewTopologyAnalysis()
+	for _, id := range sortedKeys(analysis.AllNodes) {
+		node := *analysis.AllNodes[id]
+		node.ShardIDs = append([]int(nil), node.ShardIDs...)
+		sim.AddNode(&node)
+	}
+	sim.Finalize()
+	plan := &RebalancePlan{
+		Distribution: CalculateDistribution(r.ecConfig, r.repConfig),
+		Analysis:     sim,
+	}
+
+	recordMove := func(shardID int, src, dst *TopologyNode, level, domain string) {
+		src.ShardIDs = removeShard(src.ShardIDs, shardID)
+		dst.ShardIDs = append(dst.ShardIDs, shardID)
+		src.FreeSlots++
+		dst.FreeSlots--
+		sim.ShardsByDC[src.DataCenter]--
+		sim.ShardsByDC[dst.DataCenter]++
+		sim.ShardsByRack[rackKey(src.DataCenter, src.Rack)]--
+		sim.ShardsByRack[rackKey(dst.DataCenter, dst.Rack)]++
+		sim.ShardsByNode[src.NodeID]--
+		sim.ShardsByNode[dst.NodeID]++
+		sim.DCToShards[src.DataCenter] = removeShard(sim.DCToShards[src.DataCenter], shardID)
+		sim.DCToShards[dst.DataCenter] = append(sim.DCToShards[dst.DataCenter], shardID)
+		sim.RackToShards[rackKey(src.DataCenter, src.Rack)] = removeShard(sim.RackToShards[rackKey(src.DataCenter, src.Rack)], shardID)
+		sim.RackToShards[rackKey(dst.DataCenter, dst.Rack)] = append(sim.RackToShards[rackKey(dst.DataCenter, dst.Rack)], shardID)
+		sim.NodeToShards[src.NodeID] = removeShard(sim.NodeToShards[src.NodeID], shardID)
+		sim.NodeToShards[dst.NodeID] = append(sim.NodeToShards[dst.NodeID], shardID)
+		plan.Moves = append(plan.Moves, ShardMove{
+			ShardID:    shardID,
+			SourceNode: src,
+			DestNode:   dst,
+			Reason:     fmt.Sprintf("%s balance: %s above target", level, domain),
+		})
+	}
+
+	moveOut := func(level, srcDomain string, srcNodes, dstNodes []*TopologyNode) bool {
+		var shardIDs []int
+		for _, n := range srcNodes {
+			shardIDs = append(shardIDs, n.ShardIDs...)
+		}
+		for _, shardID := range r.ecConfig.SortShardsParityFirst(shardIDs) {
+			var src *TopologyNode
+			for _, n := range srcNodes {
+				if contains(n.ShardIDs, shardID) {
+					src = n
+					break
+				}
+			}
+			if src == nil {
+				continue
+			}
+			// a shard already inside the destination domain gains nothing there
+			duplicate := false
+			for _, n := range dstNodes {
+				if contains(n.ShardIDs, shardID) {
+					duplicate = true
+					break
+				}
+			}
+			if duplicate {
+				continue
+			}
+			var dst *TopologyNode
+			for _, n := range dstNodes {
+				if n.FreeSlots > 0 && (dst == nil || nodeLess(n, dst)) {
+					dst = n
+				}
+			}
+			if dst == nil {
+				continue
+			}
+			recordMove(shardID, src, dst, level, srcDomain)
+			return true
+		}
+		return false
+	}
+
+	// balance moves shards between domains of one level until every domain
+	// holds at most its even share or no destination can take a shard. A
+	// source that cannot shed any shard is set aside rather than stopping
+	// the level, so other overloaded sources still get to move.
+	balance := func(level string, domains []string, countOf func(string) int, target int, nodesOf func(string) []*TopologyNode, dstDomains func(string) []string) {
+		blocked := make(map[string]bool)
+		for {
+			src := ""
+			srcFound := false
+			for _, d := range domains {
+				if blocked[d] {
+					continue
+				}
+				if countOf(d) > target && (!srcFound || countOf(d) > countOf(src)) {
+					src, srcFound = d, true
+				}
+			}
+			if !srcFound {
+				return
+			}
+			dsts := append([]string(nil), dstDomains(src)...)
+			sort.Slice(dsts, func(i, j int) bool {
+				if countOf(dsts[i]) != countOf(dsts[j]) {
+					return countOf(dsts[i]) < countOf(dsts[j])
+				}
+				return dsts[i] < dsts[j]
+			})
+			moved := false
+			for _, dst := range dsts {
+				if countOf(dst) < target && moveOut(level, src, nodesOf(src), nodesOf(dst)) {
+					moved = true
+					break
+				}
+			}
+			if !moved {
+				blocked[src] = true
+			}
+		}
+	}
+
+	dcList := sortedKeys(sim.DCToRacks)
+	dcRackKeys := func(dc string) []string {
+		racks := sim.DCToRacks[dc]
+		keys := make([]string, 0, len(racks))
+		for _, rack := range racks {
+			keys = append(keys, rackKey(dc, rack))
+		}
+		return keys
+	}
+	totalShards := 0
+	for _, dc := range dcList {
+		totalShards += shardCount(dcRackKeys(dc), sim.RackToNodes)
+	}
+	dcCount := func(dc string) int { return shardCount(dcRackKeys(dc), sim.RackToNodes) }
+	balance("dc", dcList, dcCount, ceilDivide(totalShards, len(dcList)),
+		func(dc string) []*TopologyNode { return nodesOfRacks(dcRackKeys(dc), sim.RackToNodes) },
+		func(string) []string { return dcList })
+
+	for _, dc := range dcList {
+		racks := sim.DCToRacks[dc]
+		rackCount := func(rack string) int { return shardCount([]string{rackKey(dc, rack)}, sim.RackToNodes) }
+		balance("rack", racks, rackCount, ceilDivide(dcCount(dc), len(racks)),
+			func(rack string) []*TopologyNode { return sim.RackToNodes[rackKey(dc, rack)] },
+			func(string) []string { return racks })
+	}
+
+	for _, rack := range sortedKeys(sim.RackToNodes) {
+		nodes := sim.RackToNodes[rack]
+		nodeCount := func(nodeID string) int {
+			for _, n := range nodes {
+				if n.NodeID == nodeID {
+					return len(n.ShardIDs)
+				}
+			}
+			return 0
+		}
+		nodeIDs := make([]string, 0, len(nodes))
+		for _, n := range nodes {
+			nodeIDs = append(nodeIDs, n.NodeID)
+		}
+		sort.Strings(nodeIDs)
+		balance("node", nodeIDs, nodeCount, ceilDivide(shardCount([]string{rack}, sim.RackToNodes), len(nodes)),
+			func(nodeID string) []*TopologyNode {
+				for _, n := range nodes {
+					if n.NodeID == nodeID {
+						return []*TopologyNode{n}
+					}
+				}
+				return nil
+			},
+			func(string) []string { return nodeIDs })
+	}
+
+	// A copy of a shard moves at most once per level, and each finer level only
+	// moves it deeper inside the domain the previous level sent it to, so its
+	// moves form a chain from the first source to the final destination.
+	// Collapse each chain into one transfer — intermediate hops would copy the
+	// shard over the network only to move it again. Chains are keyed by where
+	// the copy sits, so duplicate copies of a shard still move independently.
+	pending := make(map[ShardLocation]int)
+	moves := plan.Moves[:0]
+	for _, m := range plan.Moves {
+		key := ShardLocation{ShardID: m.ShardID, NodeID: m.SourceNode.NodeID}
+		if i, ok := pending[key]; ok {
+			delete(pending, key)
+			moves[i].DestNode = m.DestNode
+			pending[ShardLocation{ShardID: m.ShardID, NodeID: m.DestNode.NodeID}] = i
+			continue
+		}
+		pending[ShardLocation{ShardID: m.ShardID, NodeID: m.DestNode.NodeID}] = len(moves)
+		moves = append(moves, m)
+	}
+	// Order the collapsed moves so each destination has a free slot when its
+	// move is applied: a chain's final destination may only gain a slot from a
+	// later move's departure, so the early position the collapse kept can be
+	// wrong. Emit every move whose destination has room first; a source gains
+	// its slot back as soon as its move is emitted.
+	free := make(map[string]int)
+	for _, n := range sim.AllNodes {
+		free[n.NodeID] = n.FreeSlots
+	}
+	for _, m := range moves {
+		free[m.DestNode.NodeID]++
+		free[m.SourceNode.NodeID]--
+	}
+	ordered := make([]ShardMove, 0, len(moves))
+	for len(moves) > 0 {
+		kept := moves[:0]
+		for _, m := range moves {
+			if free[m.DestNode.NodeID] > 0 {
+				free[m.DestNode.NodeID]--
+				free[m.SourceNode.NodeID]++
+				ordered = append(ordered, m)
+			} else {
+				kept = append(kept, m)
+			}
+		}
+		if len(kept) == len(moves) {
+			ordered = append(ordered, kept...)
+			break
+		}
+		moves = kept
+	}
+	plan.Moves = ordered
+	for _, m := range ordered {
+		switch {
+		case m.SourceNode.DataCenter != m.DestNode.DataCenter:
+			plan.MovesAcrossDC++
+		case m.SourceNode.Rack != m.DestNode.Rack:
+			plan.MovesAcrossRack++
+		default:
+			plan.MovesWithinRack++
+		}
+	}
+	plan.TotalMoves = len(ordered)
+	return plan, nil
+}
+
+// nodeLess prefers the node holding fewer of the volume's shards, then the one
+// with more free slots, for a stable destination choice.
+func nodeLess(a, b *TopologyNode) bool {
+	if len(a.ShardIDs) != len(b.ShardIDs) {
+		return len(a.ShardIDs) < len(b.ShardIDs)
+	}
+	if a.FreeSlots != b.FreeSlots {
+		return a.FreeSlots > b.FreeSlots
+	}
+	return a.NodeID < b.NodeID
+}
+
+// shardCount sums the shards the given racks currently hold for the volume.
+func shardCount(racks []string, rackToNodes map[string][]*TopologyNode) int {
+	total := 0
+	for _, rack := range racks {
+		for _, n := range rackToNodes[rack] {
+			total += len(n.ShardIDs)
+		}
+	}
+	return total
+}
+
+func nodesOfRacks(racks []string, rackToNodes map[string][]*TopologyNode) []*TopologyNode {
+	var nodes []*TopologyNode
+	for _, rack := range racks {
+		nodes = append(nodes, rackToNodes[rack]...)
+	}
+	return nodes
+}
+
+func removeShard(shards []int, shardID int) []int {
+	for i, s := range shards {
+		if s == shardID {
+			return append(shards[:i], shards[i+1:]...)
+		}
+	}
+	return shards
+}
+
+func sortedKeys[V any](m map[string]V) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
diff --git a/weed/storage/erasure_coding/ec_bitrot.go b/weed/storage/erasure_coding/ec_bitrot.go
index 5aef042c75..dfe78a5f2c 100644
--- a/weed/storage/erasure_coding/ec_bitrot.go
+++ b/weed/storage/erasure_coding/ec_bitrot.go
@@ -195,6 +195,7 @@ func buildProtectionFromBuilders(ctx *ECContext, builders []*shardChecksumBuilde
 		EcShardConfig: &volume_server_pb.EcShardConfig{
 			DataShards:   uint32(ctx.DataShards),
 			ParityShards: uint32(ctx.ParityShards),
+			BlockSize:    ctx.BlockSize,
 		},
 		Shards:     shards,
 		EncodeUuid: NewEncodeUUID(),
@@ -431,6 +432,7 @@ func ComputeProtectionFromShards(baseFileName string, ctx *ECContext, generation
 		EcShardConfig: &volume_server_pb.EcShardConfig{
 			DataShards:   uint32(ctx.DataShards),
 			ParityShards: uint32(ctx.ParityShards),
+			BlockSize:    ctx.BlockSize,
 		},
 		Shards:     shards,
 		EncodeUuid: NewEncodeUUID(),
@@ -474,53 +476,141 @@ func (ev *EcVolume) BitrotProtection() (*volume_server_pb.EcBitrotProtection, Bi
 	return ev.bitrot, ev.bitrotStatus
 }
 
+// ReloadBitrotSidecar re-resolves the checksum sidecar for a volume that is
+// already mounted — a shard delivery can bring the manifest with it, and the
+// receive path only writes the file, so without this the in-memory volume
+// keeps the protection state it resolved at mount (off) until a remount.
+func (ev *EcVolume) ReloadBitrotSidecar(additionalDirs ...string) {
+	if err := ev.loadActiveBitrotSidecar(additionalDirs...); err != nil {
+		glog.Warningf("ec volume %d: reload bitrot sidecar: %v", ev.VolumeId, err)
+	}
+}
+
 // loadActiveBitrotSidecar loads the generation-0 checksum sidecar into the
 // volume. Best-effort: any failure leaves protection off/invalid without
 // failing the mount. OSS only produces generation-0 (fresh-encode) sidecars.
-func (ev *EcVolume) loadActiveBitrotSidecar() {
-	ev.loadBitrotForGeneration(0)
+func (ev *EcVolume) loadActiveBitrotSidecar(additionalDirs ...string) error {
+	return ev.loadBitrotForGeneration(0, additionalDirs...)
 }
 
 // loadBitrotForGeneration loads and validates the sidecar describing generation
 // `generation`, setting ev.bitrot/ev.bitrotStatus. Called at mount. Absent or
-// generation/config-mismatched => BitrotOff; self-integrity/manifest failure =>
+// generation-mismatched => BitrotOff; self-integrity/manifest failure =>
 // BitrotInvalid; usable => BitrotOn.
-func (ev *EcVolume) loadBitrotForGeneration(generation uint32) {
+//
+// A sidecar written FOR THIS generation that disagrees with the volume's shard
+// geometry is different in kind from those: both files record the layout the
+// generation was encoded with, so a disagreement means one of them is wrong and
+// reads through the other would land at the wrong shard offsets. That returns
+// an error and fails the mount instead of quietly dropping to unprotected
+// reads.
+func (ev *EcVolume) loadBitrotForGeneration(generation uint32, additionalDirs ...string) error {
 	ev.bitrotLock.Lock()
 	defer ev.bitrotLock.Unlock()
 	ev.bitrot = nil
 	ev.bitrotStatus = BitrotOff
 
 	if ev.ECContext == nil {
-		return
+		return nil
 	}
-	path := findBitrotSidecar(generation, ev.DataBaseFileName(), ev.IndexBaseFileName())
+	path := findBitrotSidecar(generation, ev.DataBaseFileName(), ev.IndexBaseFileName(), additionalDirs...)
 	if path == "" {
-		return
+		return nil
 	}
 	prot, err := LoadBitrotSidecar(path)
 	if err != nil {
 		glog.Warningf("ec volume %d: bitrot sidecar %s self-integrity failed: %v", ev.VolumeId, path, err)
 		ev.bitrotStatus = BitrotInvalid
-		return
+		return nil
 	}
 	if prot.Generation != generation {
-		return // not for this generation -> off, not corruption
+		return nil // not for this generation -> off, not corruption
 	}
-	if prot.EcShardConfig == nil ||
-		int(prot.EcShardConfig.DataShards) != ev.ECContext.DataShards ||
-		int(prot.EcShardConfig.ParityShards) != ev.ECContext.ParityShards {
-		return
+	if prot.EcShardConfig == nil {
+		return nil // records no geometry -> nothing to contradict
+	}
+	if int(prot.EcShardConfig.DataShards) != ev.ECContext.DataShards ||
+		int(prot.EcShardConfig.ParityShards) != ev.ECContext.ParityShards ||
+		prot.EcShardConfig.BlockSize != ev.ECContext.BlockSize {
+		return fmt.Errorf("ec volume %d generation %d: %s records layout %d+%d block %d but the volume is mounted as %d+%d block %d; refusing to serve one of the two layouts",
+			ev.VolumeId, generation, path,
+			prot.EcShardConfig.DataShards, prot.EcShardConfig.ParityShards, prot.EcShardConfig.BlockSize,
+			ev.ECContext.DataShards, ev.ECContext.ParityShards, ev.ECContext.BlockSize)
 	}
 	if err := ValidateBitrotManifest(prot, ev.ECContext.DataShards, ev.ECContext.ParityShards); err != nil {
 		glog.Warningf("ec volume %d: bitrot sidecar %s manifest invalid: %v", ev.VolumeId, path, err)
 		ev.bitrotStatus = BitrotInvalid
-		return
+		return nil
 	}
 	ev.bitrot = prot
 	ev.bitrotStatus = BitrotOn
 	glog.V(1).Infof("ec volume %d: loaded bitrot protection generation %d (%d shards, block_size %d)",
 		ev.VolumeId, generation, len(prot.Shards), prot.BlockSize)
+	return nil
+}
+
+// layoutFromSidecar resolves a volume's EC layout from its generation-0
+// checksum sidecar, searching the data base and then the index base. A split
+// -dir/-dir.idx layout keeps the sidecar with the index, so probing the data
+// base alone reports "absent" for a volume that has the record right there —
+// and absent is the one answer that selects the legacy 10+4 layout.
+//
+// The three answers stay distinct: (nil, false, nil) means genuinely absent
+// and the caller may fall back to the defaults; a non-nil error means the
+// record exists but cannot establish the layout, which must fail rather than
+// default; otherwise the config is usable.
+func layoutFromSidecar(dataBaseFileName, indexBaseFileName string) (cfg *volume_server_pb.EcShardConfig, found bool, err error) {
+	path := findBitrotSidecar(0, dataBaseFileName, indexBaseFileName)
+	if path == "" {
+		return nil, false, nil
+	}
+	cfg, err = EcShardConfigFromSidecarPath(path)
+	return cfg, true, err
+}
+
+// EcShardConfigFromSidecar reads the generation-0 bitrot sidecar's record of a
+// volume's EC config. The three answers are distinct on purpose: absent means
+// the volume may genuinely predate the sidecar, which is the only case a caller
+// may answer with the legacy layout; present-but-unusable means the one
+// surviving record of the geometry is corrupt, and guessing from there returns
+// wrong bytes rather than no bytes.
+func EcShardConfigFromSidecar(baseFileName string) (cfg *volume_server_pb.EcShardConfig, found bool, err error) {
+	path := BitrotSidecarPath(baseFileName, 0)
+	if _, statErr := os.Stat(path); statErr != nil {
+		if os.IsNotExist(statErr) {
+			return nil, false, nil
+		}
+		return nil, false, fmt.Errorf("stat %s: %w", path, statErr)
+	}
+	cfg, err = EcShardConfigFromSidecarPath(path)
+	return cfg, true, err
+}
+
+// EcShardConfigFromSidecarPath is EcShardConfigFromSidecar for a sidecar whose
+// path the caller already resolved — the rebuild finds it across a multi-disk
+// server's directories, not only next to the base name.
+func EcShardConfigFromSidecarPath(path string) (*volume_server_pb.EcShardConfig, error) {
+	prot, loadErr := LoadBitrotSidecar(path)
+	if loadErr != nil {
+		return nil, fmt.Errorf("read %s: %w", path, loadErr)
+	}
+	// The un-suffixed sidecar describes generation 0 and nothing else; one
+	// stamped for another generation is not a record of these shards.
+	if prot.GetGeneration() != 0 {
+		return nil, fmt.Errorf("%s records generation %d, not generation 0", path, prot.GetGeneration())
+	}
+	cfg := prot.GetEcShardConfig()
+	if cfg == nil {
+		return nil, fmt.Errorf("%s records no EC config", path)
+	}
+	if !ValidEcShardCounts(cfg.GetDataShards(), cfg.GetParityShards()) {
+		return nil, fmt.Errorf("%s records invalid shard counts %d+%d",
+			path, cfg.GetDataShards(), cfg.GetParityShards())
+	}
+	if bsErr := ValidateBlockSize(cfg.GetBlockSize()); bsErr != nil {
+		return nil, fmt.Errorf("%s: %w", path, bsErr)
+	}
+	return cfg, nil
 }
 
 // RemoveBitrotSidecars removes the legacy <base>.ecsum and any versioned
@@ -534,6 +624,15 @@ func RemoveBitrotSidecars(base string) {
 	}
 }
 
+// FindBitrotSidecar is findBitrotSidecar for callers outside this package. It
+// answers "does this volume already have a manifest, and where" — a question
+// that cannot be settled from one base name, because a split -dir/-dir.idx
+// layout keeps the sidecar with the index and a multi-disk server may keep it
+// on a sibling. Returns "" when no candidate exists.
+func FindBitrotSidecar(generation uint32, dataBase, indexBase string, additionalDirs ...string) string {
+	return findBitrotSidecar(generation, dataBase, indexBase, additionalDirs...)
+}
+
 // findBitrotSidecar resolves the sidecar path for a generation, searching the
 // data base, the index base, and any additional directories — mirroring how
 // shard/.vif lookups handle split data/idx layouts and per-disk mirrors.
diff --git a/weed/storage/erasure_coding/ec_context.go b/weed/storage/erasure_coding/ec_context.go
index 9fc352d83b..ac77f688b5 100644
--- a/weed/storage/erasure_coding/ec_context.go
+++ b/weed/storage/erasure_coding/ec_context.go
@@ -13,6 +13,16 @@ type ECContext struct {
 	ParityShards int
 	Collection   string
 	VolumeId     needle.VolumeId
+	// BlockSize > 0 selects the uniform block layout: every shard is a single
+	// contiguous block of this many bytes, so consecutive .dat ranges stay on
+	// one shard instead of striping across all of them at 1MiB granularity.
+	// 0 is the legacy two-tier 1GiB/1MiB layout.
+	BlockSize int64
+	// DatFileSize is the length of the .dat the encode actually read, set by
+	// WriteEcFiles from the same measurement it derives BlockSize from. The
+	// .vif must record the two together: they describe one file, and a live
+	// volume can grow between two separate stats.
+	DatFileSize int64
 }
 
 // Total returns the total number of shards (data + parity)
@@ -20,6 +30,33 @@ func (ctx *ECContext) Total() int {
 	return ctx.DataShards + ctx.ParityShards
 }
 
+// ValidEcShardCounts reports whether a recorded (data, parity) pair could
+// describe a real EC volume. The sum is taken in uint64 deliberately: on a
+// 32-bit build `int` is 32 bits, so converting each count first and adding
+// them wraps for values near the uint32 ceiling — 0x7fffffff + 0x7fffffff
+// lands at -2, which slips under the MaxShardCount bound.
+func ValidEcShardCounts(dataShards, parityShards uint32) bool {
+	return dataShards > 0 && parityShards > 0 &&
+		uint64(dataShards)+uint64(parityShards) <= uint64(MaxShardCount)
+}
+
+// LargeBlockSize returns the large-block length of this context's shard
+// layout; nil-safe so callers can pass an unset context for the legacy layout.
+func (ctx *ECContext) LargeBlockSize() int64 {
+	if ctx != nil && ctx.BlockSize > 0 {
+		return ctx.BlockSize
+	}
+	return ErasureCodingLargeBlockSize
+}
+
+// SmallBlockSize returns the small-block length of this context's shard layout.
+func (ctx *ECContext) SmallBlockSize() int64 {
+	if ctx != nil && ctx.BlockSize > 0 {
+		return ctx.BlockSize
+	}
+	return ErasureCodingSmallBlockSize
+}
+
 // NewDefaultECContext creates a context with default 10+4 shard configuration
 func NewDefaultECContext(collection string, volumeId needle.VolumeId) *ECContext {
 	return &ECContext{
diff --git a/weed/storage/erasure_coding/ec_decoder.go b/weed/storage/erasure_coding/ec_decoder.go
index 6d7c9d9b6a..96494c4a5a 100644
--- a/weed/storage/erasure_coding/ec_decoder.go
+++ b/weed/storage/erasure_coding/ec_decoder.go
@@ -93,11 +93,15 @@ func WriteIdxFileFromEcIndex(baseFileName string) (err error) {
 // FindDatFileSize calculate .dat file size from max offset entry
 // there may be extra deletions after that entry
 // but they are deletions anyway
-func FindDatFileSize(dataBaseFileName, indexBaseFileName string) (datSize int64, err error) {
+// shard0FileName is the actual path of the .ec00 shard file, which on a
+// multi-disk server may sit on a different disk than the EcVolume's own base
+// path — the store registers shards per disk, so the caller must pass the
+// path CollectEcShards resolved rather than deriving it from a base name.
+func FindDatFileSize(shard0FileName, indexBaseFileName string) (datSize int64, err error) {
 
-	version, err := readEcVolumeVersion(dataBaseFileName)
+	version, err := readEcVolumeVersion(shard0FileName)
 	if err != nil {
-		return 0, fmt.Errorf("read ec volume %s version: %v", dataBaseFileName, err)
+		return 0, fmt.Errorf("read ec volume %s version: %v", shard0FileName, err)
 	}
 
 	// Safety: ensure datSize is at least SuperBlockSize. While the caller typically
@@ -122,19 +126,37 @@ func FindDatFileSize(dataBaseFileName, indexBaseFileName string) (datSize int64,
 	return
 }
 
-func readEcVolumeVersion(baseFileName string) (version needle.Version, err error) {
+// VerifyDecodedDatFile checks that a reconstructed .dat is long enough to hold
+// every needle its index references. datFileSize is the extent the EC index
+// describes (see FindDatFileSize), so a shorter file cannot serve the needles
+// past the cut -- and the caller is about to delete the shards that are their
+// only other copy, which turns a short write into data loss rather than a
+// failed decode.
+func VerifyDecodedDatFile(dataBaseFileName string, datFileSize int64) error {
+	datPath := dataBaseFileName + ".dat"
+	stat, err := os.Stat(datPath)
+	if err != nil {
+		return fmt.Errorf("stat decoded %s: %w", datPath, err)
+	}
+	if stat.Size() < datFileSize {
+		return fmt.Errorf("decoded %s is %d bytes, short of the %d its ec index references", datPath, stat.Size(), datFileSize)
+	}
+	return nil
+}
+
+func readEcVolumeVersion(shard0FileName string) (version needle.Version, err error) {
 
 	// find volume version
-	datFile, err := os.OpenFile(baseFileName+".ec00", os.O_RDONLY, 0644)
+	datFile, err := os.OpenFile(shard0FileName, os.O_RDONLY, 0644)
 	if err != nil {
-		return 0, fmt.Errorf("open ec volume %s superblock: %v", baseFileName, err)
+		return 0, fmt.Errorf("open ec volume %s superblock: %v", shard0FileName, err)
 	}
 	datBackend := backend.NewDiskFile(datFile)
 
 	superBlock, err := super_block.ReadSuperBlock(datBackend)
 	datBackend.Close()
 	if err != nil {
-		return 0, fmt.Errorf("read ec volume %s superblock: %v", baseFileName, err)
+		return 0, fmt.Errorf("read ec volume %s superblock: %v", shard0FileName, err)
 	}
 
 	return superBlock.Version, nil
@@ -211,8 +233,10 @@ func iterateEcjFile(baseFileName string, processNeedleFn func(key types.NeedleId
 // large-block row boundary, and deriving the layout from the shrunk extent
 // would read the shards in the wrong block order. Pass zero when the .vif does
 // not record the encode-time size to infer the layout from the shard size.
-func WriteDatFile(baseFileName string, datFileSize int64, encodedDatFileSize int64, shardFileNames []string) error {
-	return writeDatFile(baseFileName, datFileSize, encodedDatFileSize, shardFileNames, ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize)
+// largeBlockSize/smallBlockSize are the volume's shard block layout, e.g.
+// ctx.LargeBlockSize()/ctx.SmallBlockSize() from its .vif EC config.
+func WriteDatFile(baseFileName string, datFileSize int64, encodedDatFileSize int64, shardFileNames []string, largeBlockSize int64, smallBlockSize int64) error {
+	return writeDatFile(baseFileName, datFileSize, encodedDatFileSize, shardFileNames, largeBlockSize, smallBlockSize)
 }
 
 func writeDatFile(baseFileName string, datFileSize int64, encodedDatFileSize int64, shardFileNames []string, largeBlockSize int64, smallBlockSize int64) error {
@@ -266,7 +290,11 @@ func writeDatFile(baseFileName string, datFileSize int64, encodedDatFileSize int
 		// A shard size that is an exact multiple of the large block size is
 		// ambiguous: N large rows, or N-1 large rows plus a full small-block
 		// region. The two layouts only agree below the last large row.
-		if shardSize%largeBlockSize == 0 && datFileSize > (shardSize/largeBlockSize-1)*largeBlockSize*int64(dataShards) {
+		// A uniform layout has no such ambiguity — its large and small blocks
+		// are the same size, so every reading of the shard is the same one, and
+		// without this precondition the check fires on every volume.
+		if largeBlockSize != smallBlockSize &&
+			shardSize%largeBlockSize == 0 && datFileSize > (shardSize/largeBlockSize-1)*largeBlockSize*int64(dataShards) {
 			return fmt.Errorf("shard size %d of %s does not identify the block layout; re-encode to record the dat size in .vif", shardSize, baseFileName)
 		}
 		encodedDatFileSize = int64(dataShards) * shardSize
diff --git a/weed/storage/erasure_coding/ec_decoder_completeness_test.go b/weed/storage/erasure_coding/ec_decoder_completeness_test.go
new file mode 100644
index 0000000000..50ec85359d
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_decoder_completeness_test.go
@@ -0,0 +1,90 @@
+package erasure_coding
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// A decode hands the caller a volume and the caller then deletes the shards it
+// came from. VerifyDecodedDatFile is what stands between a reconstruction that
+// came up short -- a truncated shard, a partial write, a full disk -- and the
+// deletion of the only other copy of the needles past the cut.
+func TestVerifyDecodedDatFile(t *testing.T) {
+	tests := []struct {
+		name        string
+		written     int64
+		referenced  int64
+		wantErr     bool
+		errContains string
+	}{
+		{
+			name:       "exactly the referenced extent is complete",
+			written:    4096,
+			referenced: 4096,
+		},
+		{
+			name:       "longer than referenced is fine: padding is not missing data",
+			written:    8192,
+			referenced: 4096,
+		},
+		{
+			name:        "one byte short still loses the last needle",
+			written:     4095,
+			referenced:  4096,
+			wantErr:     true,
+			errContains: "short of the 4096",
+		},
+		{
+			name:        "an empty file is short of everything",
+			written:     0,
+			referenced:  4096,
+			wantErr:     true,
+			errContains: "is 0 bytes",
+		},
+		{
+			name:       "an index referencing nothing accepts an empty file",
+			written:    0,
+			referenced: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			base := filepath.Join(t.TempDir(), "5")
+			if err := os.WriteFile(base+".dat", make([]byte, tt.written), 0644); err != nil {
+				t.Fatal(err)
+			}
+
+			err := VerifyDecodedDatFile(base, tt.referenced)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("wrote %d bytes against a %d-byte extent, want an error", tt.written, tt.referenced)
+				}
+				if !strings.Contains(err.Error(), tt.errContains) {
+					t.Errorf("error %q does not mention %q", err, tt.errContains)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("wrote %d bytes against a %d-byte extent: %v", tt.written, tt.referenced, err)
+			}
+		})
+	}
+}
+
+// A missing .dat is not a short one, and the two want different answers: the
+// caller cannot tell whether the decode wrote nothing or wrote elsewhere, so
+// the error has to name the file rather than a byte count.
+func TestVerifyDecodedDatFileMissing(t *testing.T) {
+	base := filepath.Join(t.TempDir(), "7")
+
+	err := VerifyDecodedDatFile(base, 4096)
+	if err == nil {
+		t.Fatal("a missing .dat must not verify")
+	}
+	if !strings.Contains(err.Error(), "stat decoded") {
+		t.Errorf("error %q does not say the file could not be read", err)
+	}
+}
diff --git a/weed/storage/erasure_coding/ec_decoder_multidisk_test.go b/weed/storage/erasure_coding/ec_decoder_multidisk_test.go
new file mode 100644
index 0000000000..6a3631eef9
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_decoder_multidisk_test.go
@@ -0,0 +1,54 @@
+package erasure_coding
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestFindDatFileSizeWithRelocatedShard0: on a multi-disk server a volume's
+// shards can sit on several disks, so the .ec00 is not necessarily beside the
+// EcVolume's base path. FindDatFileSize takes the resolved shard-0 path; it
+// must work when that path points to a different directory than the index.
+func TestFindDatFileSizeWithRelocatedShard0(t *testing.T) {
+	diskA := t.TempDir()
+	diskB := t.TempDir()
+
+	for _, ext := range []string{".dat", ".idx"} {
+		data, err := os.ReadFile("1" + ext)
+		if err != nil {
+			t.Fatalf("read fixture 1%s: %v", ext, err)
+		}
+		if err := os.WriteFile(filepath.Join(diskA, "1"+ext), data, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	base := filepath.Join(diskA, "1")
+	ctx := NewDefaultECContext("", 0)
+	if _, err := generateEcFiles(base, 50, largeBlockSize, smallBlockSize, ctx); err != nil {
+		t.Fatalf("generateEcFiles: %v", err)
+	}
+	if err := WriteSortedFileFromIdx(base, ".ecx"); err != nil {
+		t.Fatalf("WriteSortedFileFromIdx: %v", err)
+	}
+
+	wantSize, err := FindDatFileSize(base+".ec00", base)
+	if err != nil {
+		t.Fatalf("FindDatFileSize with co-located shard 0: %v", err)
+	}
+
+	// Relocate shard 0 to a sibling disk, as a balance or copy can leave it.
+	moved := filepath.Join(diskB, "1.ec00")
+	if err := os.Rename(base+".ec00", moved); err != nil {
+		t.Fatal(err)
+	}
+
+	gotSize, err := FindDatFileSize(moved, base)
+	if err != nil {
+		t.Fatalf("FindDatFileSize with relocated shard 0: %v", err)
+	}
+	if gotSize != wantSize {
+		t.Fatalf("dat size changed with relocated shard 0: got %d want %d", gotSize, wantSize)
+	}
+}
diff --git a/weed/storage/erasure_coding/ec_decoder_test.go b/weed/storage/erasure_coding/ec_decoder_test.go
index bbdbb353d0..b09fed9479 100644
--- a/weed/storage/erasure_coding/ec_decoder_test.go
+++ b/weed/storage/erasure_coding/ec_decoder_test.go
@@ -217,7 +217,7 @@ func TestDecodeAtomicPublish(t *testing.T) {
 	// final .dat nor a partial .dat.tmp behind.
 	datBase := filepath.Join(dir, "bar_2")
 	missingShards := []string{filepath.Join(dir, "does_not_exist.ec00")}
-	if err := erasure_coding.WriteDatFile(datBase, 100, 100, missingShards); err == nil {
+	if err := erasure_coding.WriteDatFile(datBase, 100, 100, missingShards, erasure_coding.ErasureCodingLargeBlockSize, erasure_coding.ErasureCodingSmallBlockSize); err == nil {
 		t.Fatalf("expected WriteDatFile to fail on missing shard")
 	}
 	if _, err := os.Stat(datBase + ".dat"); !os.IsNotExist(err) {
@@ -542,13 +542,13 @@ func TestEcxFileDeletionWithSeparateHandles(t *testing.T) {
 // are journaled to .ecj and tracked in an in-memory set — so the
 // durability chain decode relies on is:
 //
-//   1. DeleteNeedleFromEcx appends the needle id to .ecj and fsyncs it.
-//   2. Runtime reads via FindNeedleFromEcx consult the in-memory set and
-//      return TombstoneFileSize even though the sealed .ecx record on
-//      disk still shows the original size.
-//   3. ec.decode later closes the EcVolume and calls RebuildEcxFile on
-//      the now-quiescent files, which walks .ecj and writes tombstones
-//      into .ecx. CopyFile then reads the rebuilt .ecx.
+//  1. DeleteNeedleFromEcx appends the needle id to .ecj and fsyncs it.
+//  2. Runtime reads via FindNeedleFromEcx consult the in-memory set and
+//     return TombstoneFileSize even though the sealed .ecx record on
+//     disk still shows the original size.
+//  3. ec.decode later closes the EcVolume and calls RebuildEcxFile on
+//     the now-quiescent files, which walks .ecj and writes tombstones
+//     into .ecx. CopyFile then reads the rebuilt .ecx.
 //
 // This test exercises the full chain on a tempdir fixture.
 func TestEcVolumeDeleteDurableToJournal(t *testing.T) {
diff --git a/weed/storage/erasure_coding/ec_encoder.go b/weed/storage/erasure_coding/ec_encoder.go
index 8167c567ed..1b28fddf16 100644
--- a/weed/storage/erasure_coding/ec_encoder.go
+++ b/weed/storage/erasure_coding/ec_encoder.go
@@ -62,12 +62,126 @@ func WriteSortedFileFromIdx(baseFileName string, ext string) (e error) {
 // BackgroundECContext for the default ratio, or an explicit ctx for a configured
 // (e.g. custom-ratio) layout. It returns the bitrot protection (per-shard block
 // CRC32C) computed during the single encode pass; the caller persists it as a
-// <base>.ecsum sidecar.
+// <base>.ecsum sidecar, and persists ctx.BlockSize and ctx.DatFileSize (both
+// set here, from one measurement of the .dat) to the .vif so readers resolve
+// the shard block layout.
 func WriteEcFiles(baseFileName string, ctx *ECContext) (*volume_server_pb.EcBitrotProtection, error) {
-	if ctx == nil || ctx.Total() == 0 {
+	if ctx == nil {
 		ctx = NewDefaultECContext("", 0)
+	} else if ctx.Total() == 0 {
+		// Fill the placeholder in place rather than swapping the pointer: the
+		// caller reads BlockSize and DatFileSize back off the context it
+		// passed, and a replacement leaves it holding the zero values.
+		ctx.DataShards, ctx.ParityShards = DataShardsCount, ParityShardsCount
 	}
-	return generateEcFiles(baseFileName, 256*1024, ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize, ctx)
+	// Always encode with the uniform block layout, sized for this .dat. Both
+	// the block size and the .dat length it was derived from are left on ctx,
+	// so the caller persists a .vif whose two fields describe one measurement
+	// — a second stat could see a different size on a volume still taking
+	// writes.
+	fi, err := os.Stat(baseFileName + ".dat")
+	if err != nil {
+		return nil, fmt.Errorf("failed to stat dat file: %w", err)
+	}
+	ctx.DatFileSize = fi.Size()
+	ctx.BlockSize = UniformBlockSize(fi.Size(), ctx.DataShards)
+	return generateEcFiles(baseFileName, 256*1024, ctx.BlockSize, ctx.BlockSize, ctx)
+}
+
+// ValidateBlockSize reports whether a `.vif`-recorded shard block size is one
+// an encoder could have produced. 0 means the legacy two-tier layout, which is
+// always valid; anything positive must be a whole number of small blocks,
+// because that is what UniformBlockSize rounds to. A negative or unaligned
+// value is corruption, and using it would map every read to the wrong shard
+// offset.
+func ValidateBlockSize(blockSize int64) error {
+	if blockSize == 0 {
+		return nil
+	}
+	if blockSize < 0 || blockSize%ErasureCodingSmallBlockSize != 0 {
+		return fmt.Errorf("invalid shard block size %d: expected 0 (legacy) or a multiple of %d",
+			blockSize, ErasureCodingSmallBlockSize)
+	}
+	return nil
+}
+
+// UniformBlockSize returns the per-shard block size of the uniform layout for
+// a .dat of the given size: ceil(datFileSize/dataShards) rounded up to a whole
+// small block. For every input this equals the legacy layout's padded shard
+// size, so only the byte placement differs between the two layouts, never the
+// shard length.
+func UniformBlockSize(datFileSize int64, dataShards int) int64 {
+	perShard := (datFileSize + int64(dataShards) - 1) / int64(dataShards)
+	blocks := (perShard + ErasureCodingSmallBlockSize - 1) / ErasureCodingSmallBlockSize
+	if blocks < 1 {
+		blocks = 1
+	}
+	return blocks * ErasureCodingSmallBlockSize
+}
+
+// ResolveRebuildECContext answers which shard layout a rebuild of baseFileName
+// will use: the caller's context when it already states one, else the volume's
+// own metadata — its `.vif` in any of the directories the rebuild can read,
+// then the generation-0 bitrot sidecar, and only then the build defaults.
+// Exported so a caller that must agree with the rebuild (the post-rebuild
+// bitrot backfill writes a manifest describing these very shards) resolves
+// once and uses the same answer, instead of re-deriving it from a narrower
+// search and recording a layout the rebuild did not use.
+func ResolveRebuildECContext(baseFileName string, ctx *ECContext, additionalDirs []string) (*ECContext, error) {
+	if ctx == nil || ctx.Total() == 0 {
+		// Resolve the layout from the .vif to preserve the original configuration.
+		vifPath := findVifPath(baseFileName, additionalDirs)
+		volumeInfo, _, foundVif, vifErr := volume_info.MaybeLoadVolumeInfo(vifPath)
+		if vifErr != nil {
+			// The .vif exists but cannot be read or parsed. Fail closed rather
+			// than silently falling back to the default ratio, which would
+			// rebuild a custom-ratio volume with the wrong layout. Pass an
+			// explicit ctx to override.
+			return nil, fmt.Errorf("RebuildEcFiles %s: cannot load .vif: %w", baseFileName, vifErr)
+		}
+		switch {
+		case foundVif && volumeInfo.EcShardConfig != nil &&
+			ValidEcShardCounts(volumeInfo.EcShardConfig.DataShards, volumeInfo.EcShardConfig.ParityShards):
+			if bsErr := ValidateBlockSize(volumeInfo.EcShardConfig.GetBlockSize()); bsErr != nil {
+				return nil, fmt.Errorf("RebuildEcFiles %s: %s: %w", baseFileName, vifPath, bsErr)
+			}
+			ctx = &ECContext{
+				DataShards:   int(volumeInfo.EcShardConfig.DataShards),
+				ParityShards: int(volumeInfo.EcShardConfig.ParityShards),
+				BlockSize:    volumeInfo.EcShardConfig.GetBlockSize(),
+			}
+			glog.V(0).Infof("Rebuilding EC files for %s with config from .vif: %s", baseFileName, ctx.String())
+		case foundVif && volumeInfo.EcShardConfig != nil:
+			// A recorded-but-impossible ratio is corruption, not a reason to
+			// substitute the default one: a 12+4 volume rebuilt as 10+4
+			// reconstructs from the wrong matrix and never regenerates shards
+			// 14-15. Pass an explicit ctx to override.
+			return nil, fmt.Errorf("RebuildEcFiles %s: %s records invalid shard counts %d+%d",
+				baseFileName, vifPath, volumeInfo.EcShardConfig.DataShards, volumeInfo.EcShardConfig.ParityShards)
+		default:
+			// No usable .vif: the bitrot sidecar records the same config at
+			// encode time and is then the surviving authority. Reading the
+			// default ratio and the legacy block size instead would rebuild
+			// from the wrong geometry AND make the sidecar look like it
+			// disagrees, which silently skips every checksum check below.
+			if sidecarPath := findBitrotSidecar(0, baseFileName, baseFileName, additionalDirs...); sidecarPath != "" {
+				cfg, cfgErr := EcShardConfigFromSidecarPath(sidecarPath)
+				if cfgErr != nil {
+					return nil, fmt.Errorf("RebuildEcFiles %s: no usable .vif and %w", baseFileName, cfgErr)
+				}
+				ctx = &ECContext{
+					DataShards:   int(cfg.GetDataShards()),
+					ParityShards: int(cfg.GetParityShards()),
+					BlockSize:    cfg.GetBlockSize(),
+				}
+				glog.V(0).Infof("Rebuilding EC files for %s with config from the bitrot sidecar: %s", baseFileName, ctx.String())
+				break
+			}
+			glog.V(0).Infof("Rebuilding EC files for %s with default config", baseFileName)
+			ctx = NewDefaultECContext("", 0)
+		}
+	}
+	return ctx, nil
 }
 
 // RebuildEcFiles rebuilds missing EC shard files. Pass BackgroundECContext to
@@ -79,38 +193,11 @@ func WriteEcFiles(baseFileName string, ctx *ECContext) (*volume_server_pb.EcBitr
 // present input shards are verified against it and corrupt ones are excluded
 // from Reed-Solomon and regenerated; unsafeIgnoreSidecar bypasses that guard.
 func RebuildEcFiles(baseFileName string, ctx *ECContext, unsafeIgnoreSidecar bool, additionalDirs ...string) ([]uint32, error) {
-	if ctx == nil || ctx.Total() == 0 {
-		// Resolve the layout from the .vif to preserve the original configuration.
-		volumeInfo, _, foundVif, vifErr := volume_info.MaybeLoadVolumeInfo(baseFileName + ".vif")
-		if vifErr != nil {
-			// The .vif exists but cannot be read or parsed. Fail closed rather
-			// than silently falling back to the default ratio, which would
-			// rebuild a custom-ratio volume with the wrong layout. Pass an
-			// explicit ctx to override.
-			return nil, fmt.Errorf("RebuildEcFiles %s: cannot load .vif: %w", baseFileName, vifErr)
-		}
-		if foundVif && volumeInfo.EcShardConfig != nil {
-			ds := int(volumeInfo.EcShardConfig.DataShards)
-			ps := int(volumeInfo.EcShardConfig.ParityShards)
-
-			// Validate EC config before using it
-			if ds > 0 && ps > 0 && ds+ps <= MaxShardCount {
-				ctx = &ECContext{
-					DataShards:   ds,
-					ParityShards: ps,
-				}
-				glog.V(0).Infof("Rebuilding EC files for %s with config from .vif: %s", baseFileName, ctx.String())
-			} else {
-				glog.Warningf("Invalid EC config in .vif for %s (data=%d, parity=%d), using default", baseFileName, ds, ps)
-				ctx = NewDefaultECContext("", 0)
-			}
-		} else {
-			glog.V(0).Infof("Rebuilding EC files for %s with default config", baseFileName)
-			ctx = NewDefaultECContext("", 0)
-		}
+	ctx, err := ResolveRebuildECContext(baseFileName, ctx, additionalDirs)
+	if err != nil {
+		return nil, err
 	}
-
-	return generateMissingEcFiles(baseFileName, 256*1024, ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize, ctx, unsafeIgnoreSidecar, additionalDirs)
+	return generateMissingEcFiles(baseFileName, 256*1024, ctx, unsafeIgnoreSidecar, additionalDirs)
 }
 
 func ToExt(ecIndex int) string {
@@ -159,7 +246,10 @@ func findShardFile(baseFileName string, ext string, additionalDirs []string) str
 	return ""
 }
 
-func generateMissingEcFiles(baseFileName string, bufferSize int, largeBlockSize int64, smallBlockSize int64, ctx *ECContext, unsafeIgnoreSidecar bool, additionalDirs []string) (generatedShardIds []uint32, err error) {
+// generateMissingEcFiles takes no block sizes: Reed-Solomon reconstruction is
+// layout-agnostic — it rebuilds a missing shard from the same offsets of the
+// survivors — so the shard layout only ever reaches it through ctx.
+func generateMissingEcFiles(baseFileName string, bufferSize int, ctx *ECContext, unsafeIgnoreSidecar bool, additionalDirs []string) (generatedShardIds []uint32, err error) {
 
 	// Pass 1: discover which shards exist and which are missing,
 	// opening input files but NOT creating output files yet.
@@ -167,21 +257,33 @@ func generateMissingEcFiles(baseFileName string, bufferSize int, largeBlockSize
 	shardPaths := make([]string, ctx.Total()) // non-empty for present shards (also the in-place output for a reclassified-corrupt shard)
 	inputFiles := make([]*os.File, ctx.Total())
 	presentCount := 0
+	var zeroSized []int
 	for shardId := 0; shardId < ctx.Total(); shardId++ {
 		ext := ctx.ToExt(shardId)
 		shardPath := findShardFile(baseFileName, ext, additionalDirs)
-		if shardPath != "" {
-			shardHasData[shardId] = true
-			shardPaths[shardId] = shardPath
-			inputFiles[shardId], err = os.OpenFile(shardPath, os.O_RDONLY, 0)
-			if err != nil {
-				return nil, err
-			}
-			defer inputFiles[shardId].Close()
-			presentCount++
-		} else {
+		if shardPath == "" {
 			generatedShardIds = append(generatedShardIds, uint32(shardId))
+			continue
 		}
+		if fi, statErr := os.Stat(shardPath); statErr == nil && fi.Size() == 0 {
+			// A zero-sized shard file is residue of a failed operation, not a
+			// shard; feeding it to Reed-Solomon fails the whole rebuild with a
+			// size mismatch. Treat it as missing and regenerate over it in
+			// place, like a reclassified-corrupt shard.
+			glog.Warningf("shard %d for %s is zero-sized at %s; excluding from rebuild inputs and regenerating", shardId, baseFileName, shardPath)
+			shardPaths[shardId] = shardPath
+			zeroSized = append(zeroSized, shardId)
+			generatedShardIds = append(generatedShardIds, uint32(shardId))
+			continue
+		}
+		shardHasData[shardId] = true
+		shardPaths[shardId] = shardPath
+		inputFiles[shardId], err = os.OpenFile(shardPath, os.O_RDONLY, 0)
+		if err != nil {
+			return nil, err
+		}
+		defer inputFiles[shardId].Close()
+		presentCount++
 	}
 
 	// Bitrot verify-and-exclude: when a generation-0 checksum sidecar is present
@@ -190,6 +292,9 @@ func generateMissingEcFiles(baseFileName string, bufferSize int, largeBlockSize
 	// silently consuming corrupt bytes. corruptOwned marks shards whose
 	// (corrupt) original file must be replaced in place at its discovered path.
 	corruptOwned := make([]bool, ctx.Total())
+	for _, shardId := range zeroSized {
+		corruptOwned[shardId] = true
+	}
 	prot, status := loadRebuildSidecar(baseFileName, ctx, additionalDirs)
 	switch status {
 	case BitrotInvalid:
@@ -348,6 +453,30 @@ func cleanupRebuildOutputs(outputFiles []*os.File, writePaths []string) {
 	}
 }
 
+// findVifPath locates the volume's `.vif` for a rebuild: next to the shards
+// first, then in every directory the caller also handed us — the index
+// directory of a split `-dir`/`-dir.idx` layout, and the sibling disks of a
+// multi-disk server, where `.ecx`/`.ecj`/`.vif` may live while this disk holds
+// only shards. Returns the data-base path when nothing exists, so the caller's
+// "not found" handling stays on the canonical name.
+func findVifPath(baseFileName string, additionalDirs []string) string {
+	dataPath := baseFileName + ".vif"
+	candidates := []string{dataPath}
+	base := filepath.Base(baseFileName)
+	for _, dir := range additionalDirs {
+		if dir == "" {
+			continue
+		}
+		candidates = append(candidates, filepath.Join(dir, base)+".vif")
+	}
+	for _, c := range candidates {
+		if _, err := os.Stat(c); err == nil {
+			return c
+		}
+	}
+	return dataPath
+}
+
 // loadRebuildSidecar loads and validates the generation-0 checksum sidecar for a
 // rebuild. RebuildEcFiles operates on the un-suffixed (generation 0) shard
 // names, so only the legacy sidecar is relevant here. Returns BitrotOff when
@@ -366,10 +495,20 @@ func loadRebuildSidecar(baseFileName string, ctx *ECContext, additionalDirs []st
 	if prot.Generation != 0 {
 		return nil, BitrotOff
 	}
-	if prot.EcShardConfig == nil ||
-		int(prot.EcShardConfig.DataShards) != ctx.DataShards ||
-		int(prot.EcShardConfig.ParityShards) != ctx.ParityShards {
-		return nil, BitrotOff
+	if prot.EcShardConfig == nil {
+		return nil, BitrotOff // records no geometry -> nothing to contradict
+	}
+	if int(prot.EcShardConfig.DataShards) != ctx.DataShards ||
+		int(prot.EcShardConfig.ParityShards) != ctx.ParityShards ||
+		prot.EcShardConfig.BlockSize != ctx.BlockSize {
+		// Both records describe the same encode, so a disagreement means the
+		// rebuild is about to reconstruct under a geometry the checksums do not
+		// cover. Treating that as "no protection" skipped every input and
+		// output check exactly when they matter most.
+		glog.Warningf("bitrot: sidecar %s records layout %d+%d block %d but the rebuild uses %d+%d block %d",
+			path, prot.EcShardConfig.DataShards, prot.EcShardConfig.ParityShards, prot.EcShardConfig.BlockSize,
+			ctx.DataShards, ctx.ParityShards, ctx.BlockSize)
+		return nil, BitrotInvalid
 	}
 	if err := ValidateBitrotManifest(prot, ctx.DataShards, ctx.ParityShards); err != nil {
 		glog.Warningf("bitrot: sidecar %s manifest invalid: %v", path, err)
diff --git a/weed/storage/erasure_coding/ec_rebuild_safety_test.go b/weed/storage/erasure_coding/ec_rebuild_safety_test.go
index 6184ec72bd..3ccb4a77bb 100644
--- a/weed/storage/erasure_coding/ec_rebuild_safety_test.go
+++ b/weed/storage/erasure_coding/ec_rebuild_safety_test.go
@@ -5,7 +5,10 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
 )
 
 // readEcxSizeField returns the size field of the .ecx entry for needleId, or
@@ -215,6 +218,51 @@ func TestRebuildEcFiles_HappyPathRebuildsByteIdentical(t *testing.T) {
 	}
 }
 
+// TestRebuildEcFiles_ZeroSizedShardRegeneratedInPlace: a zero-sized shard file
+// (residue of a failed operation, issue 10730) must be excluded from the
+// rebuild inputs and regenerated byte-identical over the empty file, instead
+// of failing the whole rebuild with an input size mismatch.
+func TestRebuildEcFiles_ZeroSizedShardRegeneratedInPlace(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "vol")
+	ctx := NewDefaultECContext("", 0)
+	writeRandomDat(t, base, 7000)
+
+	if _, err := generateEcFiles(base, 256*1024, ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize, ctx); err != nil {
+		t.Fatalf("generateEcFiles: %v", err)
+	}
+
+	const emptied = 2
+	want, err := os.ReadFile(base + ToExt(emptied))
+	if err != nil {
+		t.Fatalf("read shard %d: %v", emptied, err)
+	}
+	if err := os.Truncate(base+ToExt(emptied), 0); err != nil {
+		t.Fatalf("truncate shard: %v", err)
+	}
+
+	generated, err := RebuildEcFiles(base, ctx, true)
+	if err != nil {
+		t.Fatalf("RebuildEcFiles with a zero-sized shard: %v", err)
+	}
+	found := false
+	for _, id := range generated {
+		if id == emptied {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("shard %d not reported as regenerated: %v", emptied, generated)
+	}
+	got, err := os.ReadFile(base + ToExt(emptied))
+	if err != nil {
+		t.Fatalf("read regenerated shard: %v", err)
+	}
+	if string(got) != string(want) {
+		t.Errorf("regenerated shard %d differs from original (%d vs %d bytes)", emptied, len(got), len(want))
+	}
+}
+
 // TestRebuildEcFiles_CustomRatioRebuildsByteIdentical: the same for a 9+3 ratio,
 // confirming no 10+4 assumption leaks into the destructive rebuild path.
 func TestRebuildEcFiles_CustomRatioRebuildsByteIdentical(t *testing.T) {
@@ -250,3 +298,101 @@ func TestRebuildEcFiles_CustomRatioRebuildsByteIdentical(t *testing.T) {
 		t.Errorf("unexpected shard .ec12 for a 9+3 volume")
 	}
 }
+
+// With no .vif, the bitrot sidecar is the surviving record of the volume's
+// geometry. Defaulting to 10+4 and the legacy block layout instead would
+// reconstruct a custom-ratio volume from the wrong matrix — and would make the
+// sidecar look like it disagrees, silently skipping every checksum check.
+func TestRebuildEcFiles_ResolvesGeometryFromSidecarWithoutVif(t *testing.T) {
+	if !BitrotProtectionEnabled {
+		t.Skip("bitrot protection is compiled out")
+	}
+	dir := t.TempDir()
+	base := filepath.Join(dir, "vol")
+	ctx := &ECContext{DataShards: 12, ParityShards: 4}
+	writeRandomDat(t, base, 7000)
+
+	prot, err := WriteEcFiles(base, ctx)
+	if err != nil {
+		t.Fatalf("WriteEcFiles: %v", err)
+	}
+	if err := SaveBitrotSidecar(BitrotSidecarPath(base, 0), prot); err != nil {
+		t.Fatalf("save sidecar: %v", err)
+	}
+	// No .vif at all: the sidecar has to answer.
+	const dropped = 11
+	want, err := os.ReadFile(base + ToExt(dropped))
+	if err != nil {
+		t.Fatalf("read shard: %v", err)
+	}
+	if err := os.Remove(base + ToExt(dropped)); err != nil {
+		t.Fatalf("remove shard: %v", err)
+	}
+
+	// nil ctx: the production RPC's BackgroundECContext path.
+	if _, err := RebuildEcFiles(base, nil, false); err != nil {
+		t.Fatalf("RebuildEcFiles: %v", err)
+	}
+	got, err := os.ReadFile(base + ToExt(dropped))
+	if err != nil {
+		t.Fatalf("read rebuilt shard: %v", err)
+	}
+	if string(got) != string(want) {
+		t.Errorf("rebuilt shard %d differs; the rebuild used the wrong geometry", dropped)
+	}
+	// The 12+4 shards past the default ratio must still be there.
+	for _, id := range []int{14, 15} {
+		if _, err := os.Stat(base + ToExt(id)); err != nil {
+			t.Errorf("shard %d missing after rebuild: %v", id, err)
+		}
+	}
+}
+
+// A split -dir/-dir.idx layout keeps the .vif with the index, and a multi-disk
+// server may leave this disk holding only shards. Probing just the data base
+// resolves such a volume to the default ratio and the legacy block layout.
+func TestRebuildEcFiles_FindsVifInAnAdditionalDir(t *testing.T) {
+	dataDir := t.TempDir()
+	idxDir := t.TempDir()
+	base := filepath.Join(dataDir, "vol")
+	ctx := &ECContext{DataShards: 12, ParityShards: 4}
+	writeRandomDat(t, base, 7000)
+
+	if _, err := WriteEcFiles(base, ctx); err != nil {
+		t.Fatalf("WriteEcFiles: %v", err)
+	}
+	// The volume's .vif lives with the index, not the shards.
+	if err := volume_info.SaveVolumeInfo(filepath.Join(idxDir, "vol")+".vif", &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.GetCurrentVersion()),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards: 12, ParityShards: 4, BlockSize: ctx.BlockSize,
+		},
+	}); err != nil {
+		t.Fatalf("save .vif: %v", err)
+	}
+
+	const dropped = 11
+	want, err := os.ReadFile(base + ToExt(dropped))
+	if err != nil {
+		t.Fatalf("read shard: %v", err)
+	}
+	if err := os.Remove(base + ToExt(dropped)); err != nil {
+		t.Fatalf("remove shard: %v", err)
+	}
+
+	if _, err := RebuildEcFiles(base, nil, true, idxDir); err != nil {
+		t.Fatalf("RebuildEcFiles: %v", err)
+	}
+	got, err := os.ReadFile(base + ToExt(dropped))
+	if err != nil {
+		t.Fatalf("read rebuilt shard: %v", err)
+	}
+	if string(got) != string(want) {
+		t.Errorf("rebuilt shard %d differs; the rebuild used the wrong geometry", dropped)
+	}
+	for _, id := range []int{14, 15} {
+		if _, err := os.Stat(base + ToExt(id)); err != nil {
+			t.Errorf("shard %d missing after rebuild: %v", id, err)
+		}
+	}
+}
diff --git a/weed/storage/erasure_coding/ec_roundtrip_test.go b/weed/storage/erasure_coding/ec_roundtrip_test.go
index 8c07a338d1..f70c239708 100644
--- a/weed/storage/erasure_coding/ec_roundtrip_test.go
+++ b/weed/storage/erasure_coding/ec_roundtrip_test.go
@@ -326,7 +326,7 @@ func testDecodeDat(t *testing.T, datSize int64) {
 		shardFileNames[i] = fmt.Sprintf("%s%s", baseFileName, ctx.ToExt(i))
 	}
 
-	err = WriteDatFile(decodedBase, datSize, datSize, shardFileNames)
+	err = WriteDatFile(decodedBase, datSize, datSize, shardFileNames, ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize)
 	require.NoError(t, err, "WriteDatFile")
 
 	// The atomic publish must rename the temp file away, never leaving it behind.
diff --git a/weed/storage/erasure_coding/ec_scrub_local_test.go b/weed/storage/erasure_coding/ec_scrub_local_test.go
index af6ccf42c8..bd9c5229a2 100644
--- a/weed/storage/erasure_coding/ec_scrub_local_test.go
+++ b/weed/storage/erasure_coding/ec_scrub_local_test.go
@@ -40,7 +40,9 @@ func setupScrubLocalVolume(t *testing.T, shard0 []byte) *erasure_coding.EcVolume
 	if err != nil {
 		t.Fatalf("NewEcVolumeShard: %v", err)
 	}
-	ecv.AddEcVolumeShard(shard)
+	if _, err := ecv.AddEcVolumeShard(shard); err != nil {
+		t.Fatalf("AddEcVolumeShard: %v", err)
+	}
 	return ecv
 }
 
diff --git a/weed/storage/erasure_coding/ec_shard.go b/weed/storage/erasure_coding/ec_shard.go
index 5004916e9f..99a950a2c9 100644
--- a/weed/storage/erasure_coding/ec_shard.go
+++ b/weed/storage/erasure_coding/ec_shard.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
@@ -77,7 +78,7 @@ func NewEcVolumeShard(diskType types.DiskType, dirname string, collection string
 	baseFileName := v.FileName()
 
 	// open ecd file
-	if v.ecdFile, e = os.OpenFile(baseFileName+ToExt(int(shardId)), os.O_RDONLY, 0644); e != nil {
+	if v.ecdFile, e = backend.OpenVolumeFile(baseFileName+ToExt(int(shardId)), os.O_RDONLY); e != nil {
 		if e == os.ErrNotExist || strings.Contains(e.Error(), "no such file or directory") {
 			return nil, os.ErrNotExist
 		}
diff --git a/weed/storage/erasure_coding/ec_shards_info.go b/weed/storage/erasure_coding/ec_shards_info.go
index dc8775dbb2..74ab72fc1d 100644
--- a/weed/storage/erasure_coding/ec_shards_info.go
+++ b/weed/storage/erasure_coding/ec_shards_info.go
@@ -104,6 +104,13 @@ func GetShardCount(vi *master_pb.VolumeEcShardInformationMessage) int {
 	return ShardBits(vi.EcIndexBits).Count()
 }
 
+// VolumeSlots converts an EC shard count to the number of volume slots those
+// shards occupy: every DataShardsCount shards hold one volume's worth of data,
+// rounded up.
+func VolumeSlots(ecShardCount int64) int64 {
+	return (ecShardCount + DataShardsCount - 1) / DataShardsCount
+}
+
 // EcShardsTotalSize returns the sum of all shard sizes (data + parity) in
 // the message. Walks vi.ShardSizes directly rather than materializing a
 // ShardsInfo, which is significantly cheaper for callers that only need the
diff --git a/weed/storage/erasure_coding/ec_teardown.go b/weed/storage/erasure_coding/ec_teardown.go
new file mode 100644
index 0000000000..72c74584cc
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_teardown.go
@@ -0,0 +1,134 @@
+package erasure_coding
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"google.golang.org/grpc"
+)
+
+// ErrFullTeardownNotAcked marks a reachable server that completed the delete
+// RPC but did not report a full teardown (e.g. a pre-upgrade volume server), so
+// a stale EC generation may remain on it. Callers distinguish this from an
+// unreachable node (which may recover and be re-swept) with errors.Is.
+var ErrFullTeardownNotAcked = errors.New("delete did not perform full teardown (pre-upgrade volume server?); a stale EC generation may remain")
+
+// UnmountAndDeleteEcShards unmounts then tears down the named EC shards for a
+// volume on one server. Unmount must precede delete (delete requires the shard
+// be unmounted); both RPCs are idempotent against missing shards.
+//
+// encodeTsNs fences both RPCs:
+//   - 0 selects the server's blanket, generation-independent teardown. This is
+//     the correct choice for a pre-encode or rollback wipe: it clears same-
+//     generation shards (a retried encode's prior attempt shares the job's
+//     generation) and shards whose .vif generation is unreadable (an
+//     interrupted distribute never landed the sidecar) — both of which a fenced
+//     teardown preserves. The blanket path aborts rather than clobber a live
+//     newer mount, and the caller must guarantee no concurrent newer encode of
+//     this volume (e.g. the admin dedupe key, or an operator lock).
+//   - a non-zero value fences the teardown to strictly-older generations,
+//     preserving same-or-newer, generation 0, and an unreadable .vif — for a
+//     stale-worker cleanup that must never wipe a newer run's live shards.
+//
+// Returns ErrFullTeardownNotAcked (wrapped, so errors.Is matches) when a
+// reachable server does not ack the full teardown.
+//
+// This is the single teardown primitive shared by the plugin-worker EC task
+// and the shell ec.encode pre-cleanup, so the fence semantics cannot drift
+// between the two paths.
+func UnmountAndDeleteEcShards(
+	ctx context.Context,
+	dialOption grpc.DialOption,
+	server pb.ServerAddress,
+	collection string,
+	volumeID uint32,
+	shardIds []uint32,
+	encodeTsNs int64,
+) error {
+	return operation.WithVolumeServerClient(false, server, dialOption,
+		func(client volume_server_pb.VolumeServerClient) error {
+			if _, err := client.VolumeEcShardsUnmount(ctx, &volume_server_pb.VolumeEcShardsUnmountRequest{
+				VolumeId:   volumeID,
+				ShardIds:   shardIds,
+				EncodeTsNs: encodeTsNs,
+			}); err != nil {
+				return fmt.Errorf("unmount: %w", err)
+			}
+			resp, err := client.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
+				VolumeId:     volumeID,
+				Collection:   collection,
+				ShardIds:     shardIds,
+				FullTeardown: true,
+				EncodeTsNs:   encodeTsNs,
+			})
+			if err != nil {
+				return fmt.Errorf("delete: %w", err)
+			}
+			if !resp.GetFullTeardownDone() {
+				return fmt.Errorf("delete on %s: %w", server, ErrFullTeardownNotAcked)
+			}
+			return nil
+		})
+}
+
+// EcFileGeneration parses the generation of a 2PC-staged <base>.v<N> file:
+// -1 means the name is not a generation file of base.
+func EcFileGeneration(name, base string) int64 {
+	suffix, ok := strings.CutPrefix(name, base+".v")
+	if !ok {
+		return -1
+	}
+	generation, err := strconv.ParseInt(suffix, 10, 64)
+	if err != nil || generation <= 0 {
+		return -1
+	}
+	return generation
+}
+
+// RemoveEcGenerationFiles removes 2PC generation files staged under base:
+// <base>.ecNN.v<N>, <base>.ecx.v<N>, <base>.ecj.v<N>, <base>.ecsum.v<N> and
+// <base>.vif.v<N>. generationsOlderThan == 0 removes every generation;
+// otherwise only generations strictly below it. Returns the first real
+// removal failure.
+func RemoveEcGenerationFiles(baseFileName string, generationsOlderThan uint32) error {
+	var firstErr error
+	record := func(err error) {
+		if err != nil && firstErr == nil {
+			firstErr = err
+		}
+	}
+	dir, fileName := filepath.Dir(baseFileName), filepath.Base(baseFileName)
+	ecPrefix, vifName := fileName+".ec", fileName+".vif"
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		// A generation file is <artifact>.v<N>; the last dot separates the
+		// staged-generation suffix from the artifact name.
+		artifact := name[:max(strings.LastIndexByte(name, '.'), 0)]
+		if artifact != vifName && !strings.HasPrefix(artifact, ecPrefix) {
+			continue
+		}
+		generation := EcFileGeneration(name, artifact)
+		if generation < 0 || (generationsOlderThan > 0 && generation >= int64(generationsOlderThan)) {
+			continue
+		}
+		if err := os.Remove(filepath.Join(dir, name)); err != nil && !os.IsNotExist(err) {
+			record(err)
+		}
+	}
+	return firstErr
+}
diff --git a/weed/storage/erasure_coding/ec_uniform_layout_test.go b/weed/storage/erasure_coding/ec_uniform_layout_test.go
new file mode 100644
index 0000000000..ee5f16b76a
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_uniform_layout_test.go
@@ -0,0 +1,252 @@
+package erasure_coding
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"os"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+// legacyShardSize is the padded shard length the two-tier layout produces:
+// whole 1GiB rows, then the remainder in 1MiB rows.
+func legacyShardSize(datFileSize int64, dataShards int) int64 {
+	largeRow := int64(ErasureCodingLargeBlockSize) * int64(dataShards)
+	nLarge := datFileSize / largeRow
+	size := nLarge * ErasureCodingLargeBlockSize
+	if rem := datFileSize - nLarge*largeRow; rem > 0 {
+		smallRow := int64(ErasureCodingSmallBlockSize) * int64(dataShards)
+		size += (rem + smallRow - 1) / smallRow * ErasureCodingSmallBlockSize
+	}
+	return size
+}
+
+// The uniform layout must never change a shard's length, only the byte
+// placement — capacity math and shard-size credibility checks depend on it.
+func TestUniformBlockSizeMatchesLegacyShardSize(t *testing.T) {
+	sizes := []int64{
+		8, 1000, ErasureCodingSmallBlockSize,
+		10 * ErasureCodingSmallBlockSize,
+		10*ErasureCodingSmallBlockSize + 1,
+		25 * 1024 * 1024,
+		10 * ErasureCodingLargeBlockSize,
+		10*ErasureCodingLargeBlockSize + 1,
+		10*ErasureCodingLargeBlockSize - ErasureCodingSmallBlockSize,
+		30 * 1024 * 1024 * 1024,
+		30*1024*1024*1024 + 12345,
+	}
+	for _, datSize := range sizes {
+		for _, ds := range []int{10, 9, 5, 1} {
+			if got, want := UniformBlockSize(datSize, ds), legacyShardSize(datSize, ds); got != want {
+				t.Errorf("UniformBlockSize(%d, %d) = %d, legacy shard size %d", datSize, ds, got, want)
+			}
+		}
+	}
+	if got := UniformBlockSize(0, 10); got != ErasureCodingSmallBlockSize {
+		t.Errorf("UniformBlockSize(0, 10) = %d, want one small block", got)
+	}
+}
+
+// encodeLayoutFixture writes a random .dat and encodes it with the given block
+// sizes, returning the .dat content.
+func encodeLayoutFixture(t *testing.T, baseFileName string, datSize int64, large, small int64, ctx *ECContext) []byte {
+	t.Helper()
+	data := make([]byte, datSize)
+	rand.New(rand.NewSource(datSize)).Read(data)
+	if err := os.WriteFile(baseFileName+".dat", data, 0o644); err != nil {
+		t.Fatalf("write .dat: %v", err)
+	}
+	if _, err := generateEcFiles(baseFileName, 256*1024, large, small, ctx); err != nil {
+		t.Fatalf("generateEcFiles: %v", err)
+	}
+	return data
+}
+
+// readIntervals assembles a byte range from the shard files the way the read
+// path does.
+func readIntervals(t *testing.T, baseFileName string, ctx *ECContext, intervals []Interval) []byte {
+	t.Helper()
+	var assembled []byte
+	for _, iv := range intervals {
+		shardId, shardOffset := iv.ToShardIdAndOffset(ctx.LargeBlockSize(), ctx.SmallBlockSize())
+		f, err := os.Open(baseFileName + ctx.ToExt(int(shardId)))
+		if err != nil {
+			t.Fatalf("open shard %d: %v", shardId, err)
+		}
+		buf := make([]byte, iv.Size)
+		if _, err := f.ReadAt(buf, shardOffset); err != nil {
+			t.Fatalf("read shard %d at %d: %v", shardId, shardOffset, err)
+		}
+		f.Close()
+		assembled = append(assembled, buf...)
+	}
+	return assembled
+}
+
+// Encode 25MB — large enough that the uniform and legacy layouts place bytes
+// differently — under both layouts and verify LocateData maps every probed
+// range back to the original bytes.
+func TestLocateDataMatchesEncoderForBothLayouts(t *testing.T) {
+	const datSize = 25*1024*1024 + 12345
+	dir := t.TempDir()
+
+	uniformCtx := NewDefaultECContext("", 1)
+	uniformCtx.BlockSize = UniformBlockSize(datSize, uniformCtx.DataShards)
+	legacyCtx := NewDefaultECContext("", 2)
+
+	for name, ctx := range map[string]*ECContext{"uniform": uniformCtx, "legacy": legacyCtx} {
+		t.Run(name, func(t *testing.T) {
+			base := fmt.Sprintf("%s/%s", dir, name)
+			data := encodeLayoutFixture(t, base, datSize, ctx.LargeBlockSize(), ctx.SmallBlockSize(), ctx)
+
+			shardSize := datSize / int64(ctx.DataShards)
+			for _, probe := range []struct{ offset, size int64 }{
+				{0, 1000},
+				{ctx.SmallBlockSize() - 100, 200}, // straddles a block boundary
+				{5 * 1024 * 1024, 4 * 1024 * 1024},
+				{datSize - 2000, 2000},
+			} {
+				intervals := LocateData(ctx.LargeBlockSize(), ctx.SmallBlockSize(), shardSize, probe.offset, types.Size(probe.size))
+				got := readIntervals(t, base, ctx, intervals)
+				if !bytes.Equal(got, data[probe.offset:probe.offset+probe.size]) {
+					t.Fatalf("%s layout: bytes at [%d,+%d) do not round-trip", name, probe.offset, probe.size)
+				}
+			}
+
+			// The point of the uniform layout: a 2MB range inside one 3MB
+			// block is a single interval instead of three 1MB stripes.
+			intervals := LocateData(ctx.LargeBlockSize(), ctx.SmallBlockSize(), shardSize, 6*1024*1024+512*1024, types.Size(2*1024*1024))
+			if name == "uniform" && len(intervals) != 1 {
+				t.Errorf("uniform layout reads 2MB in %d intervals, want 1", len(intervals))
+			}
+			if name == "legacy" && len(intervals) != 3 {
+				t.Errorf("legacy layout reads 2MB in %d intervals, want 3", len(intervals))
+			}
+		})
+	}
+}
+
+// Encode under both layouts and verify WriteDatFile reconstructs the original
+// .dat byte for byte — and that decoding a uniform volume with the legacy
+// geometry does NOT, i.e. the recorded block size is load-bearing.
+func TestUniformDecodeRoundTrip(t *testing.T) {
+	const datSize = 25 * 1024 * 1024
+	dir := t.TempDir()
+	base := dir + "/1"
+
+	ctx := NewDefaultECContext("", 1)
+	ctx.BlockSize = UniformBlockSize(datSize, ctx.DataShards)
+	data := encodeLayoutFixture(t, base, datSize, ctx.BlockSize, ctx.BlockSize, ctx)
+
+	shardFileNames := make([]string, ctx.DataShards)
+	for i := range shardFileNames {
+		shardFileNames[i] = base + ctx.ToExt(i)
+	}
+
+	if err := WriteDatFile(dir+"/decoded", datSize, datSize, shardFileNames, ctx.LargeBlockSize(), ctx.SmallBlockSize()); err != nil {
+		t.Fatalf("WriteDatFile: %v", err)
+	}
+	decoded, err := os.ReadFile(dir + "/decoded.dat")
+	if err != nil {
+		t.Fatalf("read decoded: %v", err)
+	}
+	if !bytes.Equal(decoded, data) {
+		t.Fatal("uniform decode with recorded geometry does not round-trip")
+	}
+
+	if err := WriteDatFile(dir+"/wrong", datSize, datSize, shardFileNames, ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize); err != nil {
+		t.Fatalf("WriteDatFile legacy geometry: %v", err)
+	}
+	wrong, err := os.ReadFile(dir + "/wrong.dat")
+	if err != nil {
+		t.Fatalf("read wrong: %v", err)
+	}
+	if bytes.Equal(wrong, data) {
+		t.Fatal("decoding a uniform volume with legacy geometry should scramble it; the layouts did not diverge")
+	}
+}
+
+// Mount fixtures through NewEcVolume and read a large extent back through
+// LocateEcShardNeedleInterval, proving the .vif block size steers the read
+// path: a legacy .vif (no block size) keeps the legacy interpretation, a
+// uniform .vif reads uniform shards.
+func TestEcVolumeGeometryFromVif(t *testing.T) {
+	const datSize = 25 * 1024 * 1024
+
+	for _, layout := range []string{"legacy", "uniform"} {
+		t.Run(layout, func(t *testing.T) {
+			dir := t.TempDir()
+			vid := needle.VolumeId(7)
+			base := EcShardFileName("", dir, int(vid))
+
+			ctx := NewDefaultECContext("", vid)
+			if layout == "uniform" {
+				ctx.BlockSize = UniformBlockSize(datSize, ctx.DataShards)
+			}
+			data := encodeLayoutFixture(t, base, datSize, ctx.LargeBlockSize(), ctx.SmallBlockSize(), ctx)
+
+			if err := os.WriteFile(base+".ecx", nil, 0o644); err != nil {
+				t.Fatalf("write .ecx: %v", err)
+			}
+			if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+				Version:     uint32(needle.GetCurrentVersion()),
+				DatFileSize: datSize,
+				EcShardConfig: &volume_server_pb.EcShardConfig{
+					DataShards:   uint32(ctx.DataShards),
+					ParityShards: uint32(ctx.ParityShards),
+					BlockSize:    ctx.BlockSize,
+				},
+			}); err != nil {
+				t.Fatalf("save .vif: %v", err)
+			}
+
+			ev, err := NewEcVolume(types.HardDriveType, dir, dir, "", vid)
+			if err != nil {
+				t.Fatalf("NewEcVolume: %v", err)
+			}
+			defer ev.Close()
+			if ev.ECContext.BlockSize != ctx.BlockSize {
+				t.Fatalf("loaded BlockSize = %d, want %d", ev.ECContext.BlockSize, ctx.BlockSize)
+			}
+			for i := 0; i < ctx.DataShards; i++ {
+				shard, err := NewEcVolumeShard(types.HardDriveType, dir, "", vid, ShardId(i))
+				if err != nil {
+					t.Fatalf("NewEcVolumeShard %d: %v", i, err)
+				}
+				if _, err := ev.AddEcVolumeShard(shard); err != nil {
+					t.Fatalf("AddEcVolumeShard: %v", err)
+				}
+			}
+
+			// Sweep a large extent through the volume's own interval mapping.
+			// LocateEcShardNeedleInterval expands the size by the needle
+			// overhead, so compare only the probed prefix.
+			const probeSize = datSize - 64*1024
+			intervals := ev.LocateEcShardNeedleInterval(needle.GetCurrentVersion(), 0, types.Size(probeSize))
+			var assembled []byte
+			for _, iv := range intervals {
+				shardId, shardOffset := ev.IntervalToShardIdAndOffset(iv)
+				shard, found := ev.FindEcVolumeShard(shardId)
+				if !found {
+					t.Fatalf("shard %d not mounted", shardId)
+				}
+				buf := make([]byte, iv.Size)
+				if _, err := shard.ReadAt(buf, shardOffset); err != nil {
+					t.Fatalf("read shard %d at %d: %v", shardId, shardOffset, err)
+				}
+				assembled = append(assembled, buf...)
+			}
+			if len(assembled) < probeSize {
+				t.Fatalf("assembled %d bytes, want at least %d", len(assembled), probeSize)
+			}
+			if !bytes.Equal(assembled[:probeSize], data[:probeSize]) {
+				t.Fatalf("%s layout: full-extent read through the %s .vif does not match the .dat", layout, layout)
+			}
+		})
+	}
+}
diff --git a/weed/storage/erasure_coding/ec_volume.go b/weed/storage/erasure_coding/ec_volume.go
index 2884afb8fe..d3607c6f20 100644
--- a/weed/storage/erasure_coding/ec_volume.go
+++ b/weed/storage/erasure_coding/ec_volume.go
@@ -1,21 +1,27 @@
 package erasure_coding
 
 import (
+	"bufio"
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 	"slices"
 	"sync"
+	"syscall"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/idx"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 var (
@@ -23,6 +29,26 @@ var (
 	destroyDelaySeconds int64 = 0
 )
 
+// ecjLoadChunkBytes bounds each positional read when seeding deletedNeedles
+// from .ecj. A multiple of NeedleIdSize; 1 MiB is 131072 entries per syscall,
+// which keeps a bloated journal from spending mount in per-entry reads.
+const ecjLoadChunkBytes = 1 << 20
+
+// A .ecj smaller than this is never rewritten, however redundant. Below a
+// megabyte the duplication costs nothing and the rewrite is pure churn.
+const ecjCompactMinBytes = 1 << 20
+
+// Rewrite only when the journal is at least this many times larger than the
+// set it encodes. A journal holds one entry per delete, so a healthy one is
+// close to 1x; four times the set means most of the file is repeats.
+const ecjCompactRatio = 4
+
+// EcjCompactTmpExt names the staging file for a compacted journal, next to the
+// .ecj it replaces. Listed with the other EC index files wherever those are
+// removed, so a tmp left by a crash between write and rename does not outlive
+// its volume.
+const EcjCompactTmpExt = ".ecj.compact.tmp"
+
 type EcVolume struct {
 	VolumeId                  needle.VolumeId
 	Collection                string
@@ -35,23 +61,31 @@ type EcVolume struct {
 	Shards                    []*EcVolumeShard
 	ShardLocations            map[ShardId][]pb.ServerAddress
 	ShardLocationsRefreshTime time.Time
-	ShardLocationsLock        sync.RWMutex
-	Version                   needle.Version
-	ecjFile                   *os.File
-	ecjFileAccessLock         sync.Mutex
-	diskType                  types.DiskType
-	datFileSize               int64
-	ExpireAtSec               uint64     //ec volume destroy time, calculated from the ec volume was created
-	ECContext                 *ECContext // EC encoding parameters
+	// ShardLocationsStale marks the map for a prompt re-check: a read that failed
+	// against a cached location has disproved what the map claims, and the normal
+	// freshness window is far too long to serve from a map known to be wrong.
+	ShardLocationsStale bool
+	ShardLocationsLock  sync.RWMutex
+	Version             needle.Version
+	ecjFile             *os.File
+	ecjFileAccessLock   sync.Mutex
+	// ecjHold registers this volume as a holder of its .ecj path for as long
+	// as ecjFile may be open; see ecj_registry.go.
+	ecjHold     *ecjHold
+	diskType    types.DiskType
+	datFileSize int64
+	ExpireAtSec uint64     //ec volume destroy time, calculated from the ec volume was created
+	ECContext   *ECContext // EC encoding parameters
 
 	// EncodeTsNs is the encode time (unix nanos) loaded from .vif; reads carry it
 	// so a shard from a different encode run is rejected. 0 for pre-upgrade volumes.
 	EncodeTsNs int64
 
 	// ecjFileSize mirrors the on-disk size of the .ecj deletion journal and
-	// is maintained under ecjFileAccessLock. It is only used by IO helpers
-	// (seek/truncate) — the authoritative runtime delete count comes from
-	// deletedNeedles.
+	// is maintained under ecjFileAccessLock: the write offset for appends, and
+	// the size mount-time compaction compares against the id set and re-checks
+	// on disk before replacing the file. The runtime delete count comes from
+	// deletedNeedles, not from this.
 	ecjFileSize int64
 
 	// deletedNeedles is the in-memory set of needle ids that have been
@@ -70,6 +104,58 @@ type EcVolume struct {
 	bitrotLock   sync.RWMutex
 	bitrot       *volume_server_pb.EcBitrotProtection
 	bitrotStatus BitrotStatus
+
+	lastIoError        error
+	lastIoErrorCount   int32
+	ioErrorQuarantined bool
+	lastIoErrorLock    sync.RWMutex
+}
+
+func (ev *EcVolume) CheckReadWriteError(err error) {
+	if err == nil {
+		ev.clearIoError()
+		return
+	}
+	if errors.Is(err, syscall.EIO) {
+		ev.noteIoError(err)
+		return
+	}
+	ev.clearIoError()
+}
+
+func (ev *EcVolume) noteIoError(err error) {
+	ev.lastIoErrorLock.Lock()
+	defer ev.lastIoErrorLock.Unlock()
+	ev.lastIoError = err
+	ev.lastIoErrorCount++
+	stats.VolumeServerStorageIoErrorCounter.Inc()
+}
+
+func (ev *EcVolume) clearIoError() {
+	ev.lastIoErrorLock.Lock()
+	defer ev.lastIoErrorLock.Unlock()
+	ev.lastIoError = nil
+	ev.lastIoErrorCount = 0
+}
+
+func (ev *EcVolume) ResetIoErrorState() {
+	ev.lastIoErrorLock.Lock()
+	defer ev.lastIoErrorLock.Unlock()
+	ev.lastIoError = nil
+	ev.lastIoErrorCount = 0
+	ev.ioErrorQuarantined = false
+}
+
+func (ev *EcVolume) MarkIoQuarantined() {
+	ev.lastIoErrorLock.Lock()
+	defer ev.lastIoErrorLock.Unlock()
+	ev.ioErrorQuarantined = true
+}
+
+func (ev *EcVolume) GetIoErrorState() (error, int32, bool) {
+	ev.lastIoErrorLock.RLock()
+	defer ev.lastIoErrorLock.RUnlock()
+	return ev.lastIoError, ev.lastIoErrorCount, ev.ioErrorQuarantined
 }
 
 // statEcxSize returns the size of an .ecx file, os.ErrNotExist when it is absent
@@ -86,6 +172,13 @@ func statEcxSize(path string) (int64, error) {
 }
 
 func NewEcVolume(diskType types.DiskType, dir string, dirIdx string, collection string, vid needle.VolumeId) (ev *EcVolume, err error) {
+	return newEcVolumeWith(diskType, dir, dirIdx, collection, vid, realEcjFsOps)
+}
+
+// newEcVolumeWith is NewEcVolume with the journal-compaction filesystem steps
+// supplied, so tests can drive a failing load or publish through the real
+// mount.
+func newEcVolumeWith(diskType types.DiskType, dir string, dirIdx string, collection string, vid needle.VolumeId, ecjOps ecjFsOps) (ev *EcVolume, err error) {
 	ev = &EcVolume{dir: dir, dirIdx: dirIdx, Collection: collection, VolumeId: vid, diskType: diskType}
 
 	dataBaseFileName := EcShardFileName(collection, dir, int(vid))
@@ -128,7 +221,7 @@ func NewEcVolume(diskType types.DiskType, dir string, dirIdx string, collection
 	default:
 		return nil, fmt.Errorf("cannot open ec volume index %s.ecx (or %s.ecx): %w", localBaseFileName, sharedBaseFileName, os.ErrNotExist)
 	}
-	if ev.ecxFile, err = os.OpenFile(indexBaseFileName+".ecx", os.O_RDWR, 0644); err != nil {
+	if ev.ecxFile, err = backend.OpenVolumeFile(indexBaseFileName+".ecx", os.O_RDWR); err != nil {
 		return nil, fmt.Errorf("cannot open ec volume index %s.ecx: %w", indexBaseFileName, err)
 	}
 	ecxFi, statErr := ev.ecxFile.Stat()
@@ -140,7 +233,14 @@ func NewEcVolume(diskType types.DiskType, dir string, dirIdx string, collection
 	ev.ecxCreatedAt = ecxFi.ModTime()
 
 	// open ecj file and seed the in-memory deleted set from it.
-	if ev.ecjFile, err = os.OpenFile(indexBaseFileName+".ecj", os.O_RDWR|os.O_CREATE, 0644); err != nil {
+	//
+	// Register as a holder first: this waits out a compaction another disk's
+	// volume may be running on the same path, so the handle below is on the
+	// final inode, and it stops any compaction from replacing the file under
+	// this handle.
+	ev.ecjHold = acquireEcjHold(indexBaseFileName + ".ecj")
+	if ev.ecjFile, err = openEcjFile(indexBaseFileName + ".ecj"); err != nil {
+		ev.Close()
 		return nil, fmt.Errorf("cannot open ec volume journal %s.ecj: %v", indexBaseFileName, err)
 	}
 	if ecjFi, statErr := ev.ecjFile.Stat(); statErr == nil {
@@ -148,8 +248,25 @@ func NewEcVolume(diskType types.DiskType, dir string, dirIdx string, collection
 	} else {
 		glog.Warningf("stat ec volume journal %s.ecj: %v", indexBaseFileName, statErr)
 	}
+	// Truncate a torn tail before the loader runs: appends land at the
+	// physical end, so a trailing partial record would misalign every later
+	// delete and lose it on the next mount.
+	if ragged := ev.ecjFileSize % int64(types.NeedleIdSize); ragged != 0 {
+		whole := ev.ecjFileSize - ragged
+		glog.Warningf("ec volume %d: truncating torn .ecj tail %d -> %d bytes", vid, ev.ecjFileSize, whole)
+		if truncErr := ev.ecjFile.Truncate(whole); truncErr != nil {
+			ev.Close()
+			return nil, fmt.Errorf("ec volume %d: repair torn .ecj tail: %w", vid, truncErr)
+		}
+		if syncErr := ev.ecjFile.Sync(); syncErr != nil {
+			ev.Close()
+			return nil, fmt.Errorf("ec volume %d: sync .ecj after tail repair: %w", vid, syncErr)
+		}
+		ev.ecjFileSize = whole
+	}
 	ev.deletedNeedles = make(map[types.NeedleId]struct{})
-	if loadErr := ev.loadDeletedNeedlesFromEcj(); loadErr != nil {
+	loadErr := ev.loadDeletedNeedlesFromEcj(ecjOps.readAt)
+	if loadErr != nil {
 		glog.Warningf("ec volume %d: load deleted needles from .ecj: %v", vid, loadErr)
 	}
 
@@ -169,7 +286,16 @@ func NewEcVolume(diskType types.DiskType, dir string, dirIdx string, collection
 		}
 	}
 	ev.Version = needle.Version3
-	if volumeInfo, _, found, _ := volume_info.MaybeLoadVolumeInfo(vifFileName); found {
+	// A present-but-unreadable or malformed .vif FAILS the mount: every new
+	// encode records a positive uniform block size there, and defaulting to
+	// the legacy layout would serve those shards with the wrong offset math.
+	// Absent stays legal — legacy volumes predate the sidecar.
+	volumeInfo, _, found, vifErr := volume_info.MaybeLoadVolumeInfo(vifFileName)
+	if vifErr != nil {
+		ev.Close()
+		return nil, fmt.Errorf("ec volume %d: load %s: %w", vid, vifFileName, vifErr)
+	}
+	if found {
 		ev.Version = needle.Version(volumeInfo.Version)
 		ev.datFileSize = volumeInfo.DatFileSize
 		ev.ExpireAtSec = volumeInfo.ExpireAtSec
@@ -180,21 +306,56 @@ func NewEcVolume(diskType types.DiskType, dir string, dirIdx string, collection
 			ps := int(volumeInfo.EcShardConfig.ParityShards)
 			ev.EncodeTsNs = volumeInfo.EcShardConfig.GetEncodeTsNs()
 
-			// Validate shard counts to prevent zero or invalid values
-			if ds <= 0 || ps <= 0 || ds+ps > MaxShardCount {
-				glog.Warningf("Invalid EC config in VolumeInfo for volume %d (data=%d, parity=%d), using defaults", vid, ds, ps)
-				ev.ECContext = NewDefaultECContext(collection, vid)
+			// A config that is PRESENT but records an impossible ratio is not
+			// a volume to fall back on: substituting the default 10+4 with the
+			// legacy layout would read uniform shards with the wrong offset
+			// math and answer with the wrong bytes. Only an ENTIRELY absent
+			// config means "this predates the record", which the else-branch
+			// below serves with the legacy defaults.
+			if !ValidEcShardCounts(volumeInfo.EcShardConfig.DataShards, volumeInfo.EcShardConfig.ParityShards) {
+				ev.Close()
+				return nil, fmt.Errorf("ec volume %d: %s records invalid shard counts %d+%d",
+					vid, vifFileName, volumeInfo.EcShardConfig.DataShards, volumeInfo.EcShardConfig.ParityShards)
+			} else if blockErr := ValidateBlockSize(volumeInfo.EcShardConfig.GetBlockSize()); blockErr != nil {
+				// A recorded block size that no encoder could have produced maps
+				// every read to the wrong shard offset. Refuse the mount rather
+				// than serve those bytes or silently pick a layout.
+				ev.Close()
+				return nil, fmt.Errorf("ec volume %d: %s: %w", vid, vifFileName, blockErr)
 			} else {
 				ev.ECContext = &ECContext{
 					Collection:   collection,
 					VolumeId:     vid,
 					DataShards:   ds,
 					ParityShards: ps,
+					BlockSize:    volumeInfo.EcShardConfig.GetBlockSize(),
 				}
 				glog.V(1).Infof("Loaded EC config from VolumeInfo for volume %d: %s", vid, ev.ECContext.String())
 			}
 		} else {
-			ev.ECContext = NewDefaultECContext(collection, vid)
+			// A vif that carries no ecShardConfig answers nothing about the
+			// layout — it is no more informative than an absent one, so it
+			// must not skip the sidecar. Going straight to the defaults here
+			// read a uniform volume with the legacy offset math.
+			cfg, sidecarFound, sidecarErr := layoutFromSidecar(dataBaseFileName, indexBaseFileName)
+			if sidecarErr != nil {
+				ev.Close()
+				return nil, fmt.Errorf("ec volume %d: %s records no EC config and the bitrot sidecar cannot establish the layout: %w", vid, vifFileName, sidecarErr)
+			}
+			if sidecarFound {
+				ev.ECContext = &ECContext{
+					Collection:   collection,
+					VolumeId:     vid,
+					DataShards:   int(cfg.GetDataShards()),
+					ParityShards: int(cfg.GetParityShards()),
+					BlockSize:    cfg.GetBlockSize(),
+				}
+				ev.EncodeTsNs = cfg.GetEncodeTsNs()
+				glog.V(0).Infof("ec volume %d: .vif records no EC config; took it from the bitrot sidecar: %s",
+					vid, ev.ECContext.String())
+			} else {
+				ev.ECContext = NewDefaultECContext(collection, vid)
+			}
 		}
 	} else {
 		// Don't fabricate a stub .vif here: a version-only stub implies the
@@ -203,24 +364,79 @@ func NewEcVolume(diskType types.DiskType, dir string, dirIdx string, collection
 		// mistake for an authoritative config. Mount with in-memory defaults and
 		// leave the real .vif to the encoder or a recovery tool (the Rust volume
 		// server already behaves this way).
-		glog.Warningf("vif file not found, using defaults, volumeId:%d, filename:%s", vid, vifFileName)
+		//
+		// The bitrot sidecar records the same EC config at encode time, so when
+		// it is present it answers the layout question the missing .vif cannot:
+		// defaulting a uniform-layout volume to the legacy block sizes maps
+		// every read to the wrong shard offset. `weed fix -ecx` reads the
+		// sidecar for the same reason.
 		ev.ECContext = NewDefaultECContext(collection, vid)
+		cfg, sidecarFound, sidecarErr := layoutFromSidecar(dataBaseFileName, indexBaseFileName)
+		if sidecarErr != nil {
+			// With no .vif the sidecar is the ONLY record of this volume's
+			// layout. Present but unusable is not "assume legacy" — that
+			// answers reads with the wrong shard offsets, which is worse than
+			// not answering at all.
+			ev.Close()
+			return nil, fmt.Errorf("ec volume %d: no .vif and the bitrot sidecar cannot establish the layout: %w", vid, sidecarErr)
+		}
+		if sidecarFound {
+			ev.ECContext = &ECContext{
+				Collection:   collection,
+				VolumeId:     vid,
+				DataShards:   int(cfg.GetDataShards()),
+				ParityShards: int(cfg.GetParityShards()),
+				BlockSize:    cfg.GetBlockSize(),
+			}
+			ev.EncodeTsNs = cfg.GetEncodeTsNs()
+			glog.V(0).Infof("ec volume %d: .vif missing; took EC config from the bitrot sidecar: %s",
+				vid, ev.ECContext.String())
+		} else {
+			// Only now are the defaults what the volume actually mounted on;
+			// logging this after the sidecar answered would send an operator
+			// triaging wrong bytes after the legacy layout instead.
+			glog.Warningf("vif file not found, using defaults, volumeId:%d, filename:%s", vid, vifFileName)
+		}
 	}
 
 	ev.ShardLocations = make(map[ShardId][]pb.ServerAddress)
 
 	// Load the active-generation bitrot checksum sidecar (optional).
-	ev.loadActiveBitrotSidecar()
+	if err := ev.loadActiveBitrotSidecar(); err != nil {
+		ev.Close()
+		return nil, err
+	}
+
+	// Fold a bloated journal back down to the set it encodes. Last, once every
+	// check that can refuse the mount has passed, so a volume the server
+	// declines to serve keeps its files as they were.
+	if compactErr := ev.compactEcjAfterLoad(loadErr, ecjOps); compactErr != nil {
+		ev.Close()
+		return nil, fmt.Errorf("ec volume %d: .ecj compaction left no usable journal handle: %w", vid, compactErr)
+	}
 
 	return
 }
 
-func (ev *EcVolume) AddEcVolumeShard(ecVolumeShard *EcVolumeShard) bool {
+func (ev *EcVolume) AddEcVolumeShard(ecVolumeShard *EcVolumeShard) (bool, error) {
 	for _, s := range ev.Shards {
 		if s.ShardId == ecVolumeShard.ShardId {
-			return false
+			return false, nil
 		}
 	}
+	// A 0-byte shard file beside an index with entries is residue of a
+	// failed copy or a truncation, not a mountable shard: registering it
+	// would advertise a size-0 claim that serves nothing and, since
+	// placement pins re-copies to the owning disk, would keep attracting
+	// repairs to a file that was never valid. A 0-byte shard beside a
+	// 0-byte index is different — that is the legitimate layout of a
+	// volume encoded with no live needles, and it must keep mounting.
+	// The startup scan already skips 0-byte shard files; this covers the
+	// mount RPC path, which opens the file directly.
+	if ecVolumeShard.Size() == 0 && ev.ecxFileSize > 0 {
+		return false, fmt.Errorf("ec volume %d shard %d: shard file is empty (0 bytes) but the index has %d entries: residue of a failed copy, not a mountable shard",
+			ev.VolumeId, ecVolumeShard.ShardId, ev.ecxFileSize/types.NeedleMapEntrySize)
+	}
 	ev.Shards = append(ev.Shards, ecVolumeShard)
 	slices.SortFunc(ev.Shards, func(a, b *EcVolumeShard) int {
 		if a.VolumeId != b.VolumeId {
@@ -228,7 +444,7 @@ func (ev *EcVolume) AddEcVolumeShard(ecVolumeShard *EcVolumeShard) bool {
 		}
 		return int(a.ShardId - b.ShardId)
 	})
-	return true
+	return true, nil
 }
 
 func (ev *EcVolume) DeleteEcVolumeShard(shardId ShardId) (ecVolumeShard *EcVolumeShard, deleted bool) {
@@ -266,6 +482,10 @@ func (ev *EcVolume) Close() {
 		_ = ev.ecjFile.Close()
 		ev.ecjFile = nil
 	}
+	if ev.ecjHold != nil {
+		ev.ecjHold.release()
+		ev.ecjHold = nil
+	}
 	ev.ecjFileAccessLock.Unlock()
 	if ev.ecxFile != nil {
 		_ = ev.ecxFile.Sync()
@@ -309,6 +529,7 @@ func (ev *EcVolume) Destroy() {
 	for _, base := range ev.ecIndexBaseNames() {
 		os.Remove(base + ".ecx")
 		os.Remove(base + ".ecj")
+		os.Remove(base + EcjCompactTmpExt)
 	}
 	// The .vif is shared with a coexisting normal volume (e.g. mid-decode), so
 	// only remove the active copy, not both.
@@ -366,6 +587,15 @@ func (ev *EcVolume) IndexBaseFileName() string {
 	return EcShardFileName(ev.Collection, ev.dirIdx, int(ev.VolumeId))
 }
 
+// EcIndexBaseFileName returns the base path of the volume's live .ecx/.ecj
+// pair — where NewEcVolume actually found them (ecxActualDir), which can
+// differ from IndexBaseFileName when an .ecx copy exists in both the data
+// and index directories. Anything that must agree with the live journal
+// handle (ecjFile) uses this, not the configured index dir.
+func (ev *EcVolume) EcIndexBaseFileName() string {
+	return EcShardFileName(ev.Collection, ev.ecxActualDir, int(ev.VolumeId))
+}
+
 func (ev *EcVolume) ShardSize() uint64 {
 	if len(ev.Shards) > 0 {
 		return uint64(ev.Shards[0].Size())
@@ -482,21 +712,268 @@ func (ev *EcVolume) markNeedleDeletedInMemory(needleId types.NeedleId) {
 // loadDeletedNeedlesFromEcj walks the .ecj journal and populates the
 // in-memory deleted set. Called once from NewEcVolume under the exclusive
 // ownership of the just-constructed (and not yet shared) EcVolume.
-func (ev *EcVolume) loadDeletedNeedlesFromEcj() error {
+func (ev *EcVolume) loadDeletedNeedlesFromEcj(readAt func(f *os.File, b []byte, off int64) (int, error)) error {
 	if ev.ecjFile == nil || ev.ecjFileSize < int64(types.NeedleIdSize) {
 		return nil
 	}
-	buf := make([]byte, types.NeedleIdSize)
-	for off := int64(0); off+int64(types.NeedleIdSize) <= ev.ecjFileSize; off += int64(types.NeedleIdSize) {
-		if _, err := ev.ecjFile.ReadAt(buf, off); err != nil {
+	buf := make([]byte, ecjLoadChunkBytes)
+	for off := int64(0); off+int64(types.NeedleIdSize) <= ev.ecjFileSize; {
+		want := min(int64(ecjLoadChunkBytes), ev.ecjFileSize-off)
+		want -= want % int64(types.NeedleIdSize)
+		if want == 0 {
+			break
+		}
+		if _, err := readAt(ev.ecjFile, buf[:want], off); err != nil {
 			return fmt.Errorf("read ecj at %d: %w", off, err)
 		}
-		id := types.BytesToNeedleId(buf)
-		ev.deletedNeedles[id] = struct{}{}
+		for i := int64(0); i+int64(types.NeedleIdSize) <= want; i += int64(types.NeedleIdSize) {
+			ev.deletedNeedles[types.BytesToNeedleId(buf[i:i+types.NeedleIdSize])] = struct{}{}
+		}
+		off += want
 	}
 	return nil
 }
 
+// openEcjFile opens path as the deletion journal handle, creating it if
+// absent. Both the mount and the reopen after compaction go through here, so
+// the handle a compacted volume appends through behaves like the original.
+func openEcjFile(path string) (*os.File, error) {
+	return backend.OpenVolumeFile(path, os.O_RDWR|os.O_CREATE)
+}
+
+// ecjFsOps are the filesystem steps of a mount's journal compaction: the
+// reads that load the set it compacts from, and the steps that publish the
+// compacted file. Production uses realEcjFsOps; tests substitute failing steps
+// to cover the failure paths through the real mount.
+type ecjFsOps struct {
+	readAt   func(f *os.File, b []byte, off int64) (int, error)
+	rename   func(oldpath, newpath string) error
+	fsyncDir func(path string) error
+	reopen   func(path string) (*os.File, error)
+}
+
+var realEcjFsOps = ecjFsOps{
+	readAt:   (*os.File).ReadAt,
+	rename:   os.Rename,
+	fsyncDir: func(p string) error { return util.FsyncDir(filepath.Dir(p)) },
+	reopen:   openEcjFile,
+}
+
+// ecjHandleLostError marks a compaction failure that left the volume without a
+// usable journal handle, so the mount must fail: deletes would error, or land
+// in an inode no longer at the journal's path. Decided where the failure
+// happens rather than inferred afterwards from ecjFile.
+type ecjHandleLostError struct{ err error }
+
+func (e *ecjHandleLostError) Error() string { return e.err.Error() }
+func (e *ecjHandleLostError) Unwrap() error { return e.err }
+
+// compactEcjAfterLoad compacts the journal unless its load failed. After a
+// failed load the set holds only the part of the journal read before the
+// error, and rewriting the file from it would delete the rest for good.
+func (ev *EcVolume) compactEcjAfterLoad(loadErr error, ops ecjFsOps) error {
+	if loadErr != nil {
+		glog.Warningf("ec volume %d: not compacting .ecj: its load failed, so the in-memory set may be partial", ev.VolumeId)
+		return nil
+	}
+	return ev.maybeCompactEcj(ops)
+}
+
+// maybeCompactEcj rewrites a bloated .ecj from the set just loaded out of it.
+//
+// The journal is semantically a SET of deleted needle ids, written as an
+// append-only log that nothing dedupes. VolumeEcShardsCopy, EC index recovery
+// and ec_decode's merge append a peer's whole journal onto this one, so a
+// volume whose shards are balanced back and forth grows the file
+// geometrically (1.51 TB for ~100 distinct ids in production).
+//
+// Compaction is safe because the set IS the journal's meaning, provided
+// nothing else can write the file between the load and the rename. The
+// ecj_registry reservation and the on-disk re-check establish that: this
+// volume is the only holder of the path, no copy is writing to it, and the file
+// is still the inode and size that was loaded.
+//
+// Returns an error only when the volume is left without a usable journal
+// handle, which must fail the mount. Every other failure leaves the original
+// journal in place and is logged here.
+func (ev *EcVolume) maybeCompactEcj(ops ecjFsOps) error {
+	ecjPath := ev.FileName(".ecj")
+	tmpPath := EcShardFileName(ev.Collection, ev.ecxActualDir, int(ev.VolumeId)) + EcjCompactTmpExt
+	wanted := ev.ecjNeedsCompaction()
+	_, tmpStatErr := os.Stat(tmpPath)
+	staleTmp := tmpStatErr == nil
+	if (!wanted && !staleTmp) || ev.ecjHold == nil {
+		return nil
+	}
+	end, ok := ev.ecjHold.tryBeginCompaction()
+	if !ok {
+		glog.V(1).Infof("ec volume %d: skipping .ecj compaction: another holder or a copy can reach %s", ev.VolumeId, ecjPath)
+		return nil
+	}
+	defer end()
+	// A tmp left by a crash between its write and the rename. Removed under the
+	// reservation, so it cannot be another holder's compaction in flight.
+	if staleTmp {
+		_ = os.Remove(tmpPath)
+	}
+	if !wanted {
+		return nil
+	}
+	return ev.compactEcjReserved(ecjPath, tmpPath, ops)
+}
+
+// compactEcjReserved is the part of maybeCompactEcj that runs under the path
+// reservation: re-check the file, write the compacted tmp, publish it. Same
+// error contract: an error only when no usable journal handle is left.
+func (ev *EcVolume) compactEcjReserved(ecjPath, tmpPath string, ops ecjFsOps) error {
+	unchanged, err := ev.ecjUnchangedSinceLoad(ecjPath)
+	if err != nil {
+		glog.Warningf("ec volume %d: compact .ecj: stat journal: %v", ev.VolumeId, err)
+		return nil
+	}
+	if !unchanged {
+		glog.Warningf("ec volume %d: skipping .ecj compaction: %s changed on disk after it was loaded", ev.VolumeId, ecjPath)
+		return nil
+	}
+	ids := ev.sortedDeletedIds()
+	glog.Warningf("ec volume %d: compacting bloated .ecj deletion journal on-disk=%d unique=%d compacted=%d",
+		ev.VolumeId, ev.ecjFileSize, len(ids), len(ids)*types.NeedleIdSize)
+	if err := writeCompactedEcjTmp(tmpPath, ids); err != nil {
+		// A partial tmp would pin its bytes, and the likeliest cause here is
+		// ENOSPC, where those bytes are exactly what is scarce.
+		_ = os.Remove(tmpPath)
+		glog.Warningf("ec volume %d: compact .ecj: write compacted journal: %v", ev.VolumeId, err)
+		return nil
+	}
+	if err := ev.publishCompactedEcj(ecjPath, tmpPath, ops); err != nil {
+		var lost *ecjHandleLostError
+		if errors.As(err, &lost) {
+			return err
+		}
+		glog.Warningf("ec volume %d: compact .ecj: journal left as it was: %v", ev.VolumeId, err)
+	}
+	return nil
+}
+
+// ecjNeedsCompaction reports whether the loaded journal is bloated enough to
+// rewrite: file_bytes >= max(ecjCompactMinBytes, ecjCompactRatio * set_bytes).
+// The 1 MiB floor keeps a small healthy journal from ever being rewritten. It
+// reads only the set's length, so the common no-op mount copies nothing.
+func (ev *EcVolume) ecjNeedsCompaction() bool {
+	ev.deletedNeedlesLock.RLock()
+	distinct := int64(len(ev.deletedNeedles))
+	ev.deletedNeedlesLock.RUnlock()
+	compactedLen := distinct * int64(types.NeedleIdSize)
+	return ev.ecjFileSize >= ecjCompactMinBytes && ev.ecjFileSize >= compactedLen*ecjCompactRatio
+}
+
+// sortedDeletedIds returns the deleted set sorted, so the rewritten file is
+// deterministic and two holders compacting one set write identical bytes.
+func (ev *EcVolume) sortedDeletedIds() []types.NeedleId {
+	ev.deletedNeedlesLock.RLock()
+	ids := make([]types.NeedleId, 0, len(ev.deletedNeedles))
+	for id := range ev.deletedNeedles {
+		ids = append(ids, id)
+	}
+	ev.deletedNeedlesLock.RUnlock()
+	slices.Sort(ids)
+	return ids
+}
+
+// ecjUnchangedSinceLoad reports whether the file at ecjPath is still the one
+// this volume loaded: the same file as the open handle and the size the set
+// was read from. A copy that appended, or replaced the file, after the load
+// fails this, and compacting then would drop what it wrote.
+func (ev *EcVolume) ecjUnchangedSinceLoad(ecjPath string) (bool, error) {
+	if ev.ecjFile == nil {
+		return false, nil
+	}
+	held, err := ev.ecjFile.Stat()
+	if err != nil {
+		return false, err
+	}
+	onPath, err := os.Stat(ecjPath)
+	if err != nil {
+		return false, err
+	}
+	return os.SameFile(held, onPath) && held.Size() == onPath.Size() && onPath.Size() == ev.ecjFileSize, nil
+}
+
+// writeCompactedEcjTmp writes sorted ids to tmpPath through a buffer and
+// fsyncs it. Opened like every other volume file, so the journal it becomes
+// has the same mode and open flags as one that was never compacted.
+func writeCompactedEcjTmp(tmpPath string, ids []types.NeedleId) error {
+	f, err := backend.OpenVolumeFile(tmpPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC)
+	if err != nil {
+		return err
+	}
+	w := bufio.NewWriterSize(f, ecjLoadChunkBytes)
+	var rec [types.NeedleIdSize]byte
+	for _, id := range ids {
+		types.NeedleIdToBytes(rec[:], id)
+		if _, err := w.Write(rec[:]); err != nil {
+			_ = f.Close()
+			return err
+		}
+	}
+	if err := w.Flush(); err != nil {
+		_ = f.Close()
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		_ = f.Close()
+		return err
+	}
+	return f.Close()
+}
+
+// publishCompactedEcj replaces the live journal with the compacted tmp file:
+// drop the handle (Windows cannot rename over an open file), rename, fsync the
+// directory, reopen the handle.
+//
+// A failed rename publishes nothing: the tmp is removed and the handle to the
+// original journal restored, and the rename error is returned as is. If that
+// restore fails too, or anything fails after the rename, the volume has no
+// usable handle and the error is an *ecjHandleLostError carrying every error
+// involved.
+func (ev *EcVolume) publishCompactedEcj(ecjPath, tmpPath string, ops ecjFsOps) error {
+	if ev.ecjFile != nil {
+		_ = ev.ecjFile.Close()
+		ev.ecjFile = nil
+	}
+	if renameErr := ops.rename(tmpPath, ecjPath); renameErr != nil {
+		_ = os.Remove(tmpPath)
+		reopened, reopenErr := ops.reopen(ecjPath)
+		if reopenErr != nil {
+			return &ecjHandleLostError{fmt.Errorf("rename %s over %s: %w; reopening the original journal then failed: %w",
+				tmpPath, ecjPath, renameErr, reopenErr)}
+		}
+		ev.ecjFile = reopened
+		return renameErr
+	}
+	lost := func(what string, err error) error {
+		return &ecjHandleLostError{fmt.Errorf("replaced %s but could not %s: %w", ecjPath, what, err)}
+	}
+	// The tmp sync persisted contents, not the directory entry. Without this a
+	// power loss can restore the old journal and discard deletes acknowledged
+	// against the replacement.
+	if err := ops.fsyncDir(ecjPath); err != nil {
+		return lost("fsync its directory", err)
+	}
+	reopened, err := ops.reopen(ecjPath)
+	if err != nil {
+		return lost("reopen it", err)
+	}
+	fi, err := reopened.Stat()
+	if err != nil {
+		_ = reopened.Close()
+		return lost("stat it", err)
+	}
+	ev.ecjFile = reopened
+	ev.ecjFileSize = fi.Size()
+	return nil
+}
+
 func (ev *EcVolume) LocateEcShardNeedle(needleId types.NeedleId, version needle.Version) (offset types.Offset, size types.Size, intervals []Interval, err error) {
 
 	// find the needle from ecx file
@@ -505,7 +982,7 @@ func (ev *EcVolume) LocateEcShardNeedle(needleId types.NeedleId, version needle.
 		return types.Offset{}, 0, nil, fmt.Errorf("FindNeedleFromEcx: %w", err)
 	}
 
-	intervals = ev.LocateEcShardNeedleInterval(version, offset.ToActualOffset(), types.Size(needle.GetActualSize(size, version)))
+	intervals = ev.LocateEcShardNeedleInterval(version, offset.ToActualOffset(), size)
 	return
 }
 
@@ -524,17 +1001,24 @@ func (ev *EcVolume) LocateEcShardNeedleInterval(version needle.Version, offset i
 		shardSize = shard.ecdFileSize - 1
 	}
 	// calculate the locations in the ec shards
-	intervals = LocateData(ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize, shardSize, offset, types.Size(needle.GetActualSize(size, version)))
+	intervals = LocateData(ev.ECContext.LargeBlockSize(), ev.ECContext.SmallBlockSize(), shardSize, offset, types.Size(needle.GetActualSize(size, version)))
 
 	return
 }
 
+// IntervalToShardIdAndOffset resolves an interval against this volume's shard
+// block layout.
+func (ev *EcVolume) IntervalToShardIdAndOffset(interval Interval) (ShardId, int64) {
+	return interval.ToShardIdAndOffset(ev.ECContext.LargeBlockSize(), ev.ECContext.SmallBlockSize())
+}
+
 func (ev *EcVolume) FindNeedleFromEcx(needleId types.NeedleId) (offset types.Offset, size types.Size, err error) {
 	offset, size, err = SearchNeedleFromSortedIndex(ev.ecxFile, ev.ecxFileSize, needleId, nil)
 	if err != nil {
+		ev.CheckReadWriteError(err)
 		return
 	}
-	// Apply runtime deletion state on top of the sealed .ecx lookup.
+	ev.CheckReadWriteError(nil)
 	if ev.IsNeedleDeleted(needleId) {
 		size = types.TombstoneFileSize
 	}
@@ -549,7 +1033,7 @@ func SearchNeedleFromSortedIndex(ecxFile *os.File, ecxFileSize int64, needleId t
 		m := (l + h) / 2
 		if n, err := ecxFile.ReadAt(buf, m*types.NeedleMapEntrySize); err != nil {
 			if n != types.NeedleMapEntrySize {
-				return types.Offset{}, types.TombstoneFileSize, fmt.Errorf("ecx file %d read at %d: %v", ecxFileSize, m*types.NeedleMapEntrySize, err)
+				return types.Offset{}, types.TombstoneFileSize, fmt.Errorf("ecx file %d read at %d: %w", ecxFileSize, m*types.NeedleMapEntrySize, err)
 			}
 		}
 		key, offset, size = idx.IdxFileEntry(buf)
diff --git a/weed/storage/erasure_coding/ec_volume_delete.go b/weed/storage/erasure_coding/ec_volume_delete.go
index 1bf4b9c2ad..abb951d74d 100644
--- a/weed/storage/erasure_coding/ec_volume_delete.go
+++ b/weed/storage/erasure_coding/ec_volume_delete.go
@@ -6,6 +6,7 @@ import (
 	"os"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
@@ -74,7 +75,21 @@ func (ev *EcVolume) DeleteNeedleFromEcx(needleId types.NeedleId) (err error) {
 
 	b := make([]byte, types.NeedleIdSize)
 	types.NeedleIdToBytes(b, needleId)
+	if err := ev.appendJournalLocked(b); err != nil {
+		return err
+	}
 
+	// Publish into the in-memory set only after the journal is durable.
+	ev.markNeedleDeletedInMemory(needleId)
+
+	return nil
+}
+
+// appendJournalLocked appends whole records to .ecj and syncs them. A partial
+// write is truncated back to the known-good size so the on-disk journal and
+// deletedNeedles cannot drift. Callers hold ecjFileAccessLock and have checked
+// that ecjFile is open.
+func (ev *EcVolume) appendJournalLocked(b []byte) error {
 	prevEcjSize := ev.ecjFileSize
 	if _, seekErr := ev.ecjFile.Seek(0, io.SeekEnd); seekErr != nil {
 		return fmt.Errorf("seek ecj: %w", seekErr)
@@ -93,10 +108,41 @@ func (ev *EcVolume) DeleteNeedleFromEcx(needleId types.NeedleId) (err error) {
 		return fmt.Errorf("sync ecj: %w", syncErr)
 	}
 	ev.ecjFileSize += int64(n)
+	return nil
+}
 
-	// Publish into the in-memory set only after the journal is durable.
-	ev.markNeedleDeletedInMemory(needleId)
+// LockDeletionJournal serializes the caller against runtime .ecj appends
+// (DeleteNeedleFromEcx) until the returned func is called. Decode holds it
+// while consuming the journal into the rebuilt index so a committed delete
+// cannot slip past the publish.
+func (ev *EcVolume) LockDeletionJournal() func() {
+	ev.ecjFileAccessLock.Lock()
+	return ev.ecjFileAccessLock.Unlock
+}
 
+// ReopenDeletionJournal repoints ecjFile at the live .ecj path after
+// RebuildEcxFile unlinked it. Without this, later DeleteNeedleFromEcx
+// appends keep landing on the detached inode — synced, successful, and
+// invisible to every path-based reader. Caller must hold the journal lock
+// (see LockDeletionJournal).
+func (ev *EcVolume) ReopenDeletionJournal() error {
+	if ev.ecjFile != nil {
+		_ = ev.ecjFile.Close()
+		ev.ecjFile = nil
+	}
+	ecjFile, err := backend.OpenVolumeFile(ev.FileName(".ecj"), os.O_RDWR|os.O_CREATE)
+	if err != nil {
+		return fmt.Errorf("reopen ec volume journal %s: %w", ev.FileName(".ecj"), err)
+	}
+	ev.ecjFile = ecjFile
+	// A successful RebuildEcxFile leaves the path unlinked, so this is a
+	// fresh empty file — but track whatever is actually there so the
+	// rollback truncate in DeleteNeedleFromEcx can never wipe real records.
+	if fi, statErr := ecjFile.Stat(); statErr == nil {
+		ev.ecjFileSize = fi.Size()
+	} else {
+		ev.ecjFileSize = 0
+	}
 	return nil
 }
 
diff --git a/weed/storage/erasure_coding/ec_volume_ecj_compact_test.go b/weed/storage/erasure_coding/ec_volume_ecj_compact_test.go
new file mode 100644
index 0000000000..5b233c0a6b
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_volume_ecj_compact_test.go
@@ -0,0 +1,415 @@
+package erasure_coding
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// compactTestIds are the 100 distinct ids the bloated journals below repeat.
+func compactTestIds() []types.NeedleId {
+	ids := make([]types.NeedleId, 0, 100)
+	for i := 0; i < 100; i++ {
+		ids = append(ids, types.NeedleId(1000+i))
+	}
+	return ids
+}
+
+func compactEcjBytes(ids []types.NeedleId, repeats int) []byte {
+	one := make([]byte, len(ids)*types.NeedleIdSize)
+	for i, id := range ids {
+		types.NeedleIdToBytes(one[i*types.NeedleIdSize:], id)
+	}
+	b := make([]byte, 0, len(one)*repeats)
+	for i := 0; i < repeats; i++ {
+		b = append(b, one...)
+	}
+	return b
+}
+
+// compactEcxEntry is one .ecx entry for a live needle, so it can be deleted.
+func compactEcxEntry(id types.NeedleId) []byte {
+	b := make([]byte, types.NeedleMapEntrySize)
+	types.NeedleIdToBytes(b[0:types.NeedleIdSize], id)
+	types.OffsetToBytes(b[types.NeedleIdSize:types.NeedleIdSize+types.OffsetSize], types.ToOffset(8))
+	types.SizeToBytes(b[types.NeedleIdSize+types.OffsetSize:], types.Size(10))
+	return b
+}
+
+// writeCompactTestVolume lays down .ecx (holding needle 7), .ecj and an empty
+// .vif for volume vid in dir, returning the base file name.
+func writeCompactTestVolume(t *testing.T, dir string, vid needle.VolumeId, ecj []byte) string {
+	t.Helper()
+	base := EcShardFileName("", dir, int(vid))
+	require.NoError(t, os.WriteFile(base+".ecx", compactEcxEntry(7), 0644))
+	require.NoError(t, os.WriteFile(base+".ecj", ecj, 0644))
+	require.NoError(t, os.WriteFile(base+".vif", []byte{}, 0644))
+	return base
+}
+
+func fileSize(t *testing.T, path string) int64 {
+	t.Helper()
+	fi, err := os.Stat(path)
+	require.NoError(t, err)
+	return fi.Size()
+}
+
+var errInjectedRename = errors.New("injected rename failure")
+var errInjectedReopen = errors.New("injected reopen failure")
+
+func failingRename(string, string) error     { return errInjectedRename }
+func failingReopen(string) (*os.File, error) { return nil, errInjectedReopen }
+func failingFsync(string) error              { return errors.New("injected fsync failure") }
+func withEcjOps(f func(*ecjFsOps)) ecjFsOps  { ops := realEcjFsOps; f(&ops); return ops }
+func mountCompactTest(dir string, vid needle.VolumeId, ops ecjFsOps) (*EcVolume, error) {
+	return newEcVolumeWith("hdd", dir, dir, "", vid, ops)
+}
+
+// A load error leaves only part of the journal in the set. Compacting from it
+// would delete the unread records from disk for good. The read fails inside the
+// real mount, after the first chunk, so the mount goes on with a set missing
+// the id that only the rest of the journal holds.
+func TestEcjNotCompactedAfterLoadError(t *testing.T) {
+	dir := t.TempDir()
+	journal := append(compactEcjBytes(compactTestIds(), 4096), compactEcjBytes([]types.NeedleId{5000}, 1)...)
+	base := writeCompactTestVolume(t, dir, 60, journal)
+
+	ops := withEcjOps(func(o *ecjFsOps) {
+		o.readAt = func(f *os.File, b []byte, off int64) (int, error) {
+			if off >= ecjLoadChunkBytes {
+				return 0, errors.New("injected read failure")
+			}
+			return f.ReadAt(b, off)
+		}
+	})
+	ev, err := mountCompactTest(dir, 60, ops)
+	require.NoError(t, err)
+	require.False(t, ev.IsNeedleDeleted(5000), "the failed read must have left the set partial")
+	ev.Close()
+
+	got, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, journal, got, "a partial set must never be written over the journal")
+
+	// A full load compacts, and keeps the id only the tail held.
+	ev, err = mountCompactTest(dir, 60, realEcjFsOps)
+	require.NoError(t, err)
+	defer ev.Close()
+	assert.Equal(t, int64(101*types.NeedleIdSize), fileSize(t, base+".ecj"))
+	assert.True(t, ev.IsNeedleDeleted(5000))
+}
+
+// A shard mount can give disk B a volume whose .ecj is disk A's. When A's own
+// volume mounts later it must not replace the file under B, whose deletes
+// would go to an unlinked inode and vanish at the next mount.
+func TestEcjSiblingHolderBlocksCompaction(t *testing.T) {
+	root := t.TempDir()
+	a, b := filepath.Join(root, "a"), filepath.Join(root, "b")
+	require.NoError(t, os.MkdirAll(a, 0755))
+	require.NoError(t, os.MkdirAll(b, 0755))
+	ids := compactTestIds()
+	base := writeCompactTestVolume(t, a, 61, compactEcjBytes(ids, 1))
+
+	// B has no index of its own, so it resolves A's and holds A's journal.
+	onB, err := NewEcVolume("hdd", b, a, "", 61)
+	require.NoError(t, err)
+	require.Equal(t, base+".ecj", onB.FileName(".ecj"))
+
+	// The journal bloats (say, a copy appended to it) and A mounts.
+	require.NoError(t, os.WriteFile(base+".ecj", compactEcjBytes(ids, 4096), 0644))
+	bloated := fileSize(t, base+".ecj")
+	onA, err := NewEcVolume("hdd", a, a, "", 61)
+	require.NoError(t, err)
+	assert.Equal(t, bloated, fileSize(t, base+".ecj"), "compaction must not replace a journal another volume holds open")
+
+	// B's delete must land in the file at the journal's path.
+	require.NoError(t, onB.DeleteNeedleFromEcx(7))
+	assert.Equal(t, bloated+types.NeedleIdSize, fileSize(t, base+".ecj"))
+	onB.Close()
+	onA.Close()
+
+	// Sole holder now: the next mount compacts and keeps B's delete.
+	ev, err := NewEcVolume("hdd", a, a, "", 61)
+	require.NoError(t, err)
+	defer ev.Close()
+	assert.Equal(t, int64((len(ids)+1)*types.NeedleIdSize), fileSize(t, base+".ecj"))
+	assert.True(t, ev.IsNeedleDeleted(7))
+}
+
+// A copy appending to the journal by path must not have its bytes dropped by
+// a compaction renaming over the file.
+func TestEcjActiveCopyBlocksCompaction(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 62, compactEcjBytes(compactTestIds(), 4096))
+	bloated := fileSize(t, base+".ecj")
+
+	done := BeginEcjWrite(base + ".ecj")
+	ev, err := NewEcVolume("hdd", dir, dir, "", 62)
+	require.NoError(t, err)
+	assert.Equal(t, bloated, fileSize(t, base+".ecj"))
+	ev.Close()
+	done()
+
+	ev, err = NewEcVolume("hdd", dir, dir, "", 62)
+	require.NoError(t, err)
+	defer ev.Close()
+	assert.Equal(t, int64(100*types.NeedleIdSize), fileSize(t, base+".ecj"))
+}
+
+// A copy that starts while a compaction holds the path waits for it to end,
+// then appends to the compacted file.
+func TestEcjWriterWaitsForCompaction(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "1.ecj")
+	hold := acquireEcjHold(path)
+	defer hold.release()
+	end, ok := hold.tryBeginCompaction()
+	require.True(t, ok)
+
+	started := make(chan struct{})
+	go func() {
+		done := BeginEcjWrite(path)
+		close(started)
+		done()
+	}()
+	select {
+	case <-started:
+		t.Fatal("a writer must not start while a compaction holds the path")
+	case <-time.After(100 * time.Millisecond):
+	}
+	end()
+	select {
+	case <-started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("writer must proceed once the compaction ends")
+	}
+}
+
+// A writer that ran after the hold was taken, or was already running then,
+// may have changed the journal the holder loaded, even though it has finished
+// by the time compaction asks.
+func TestEcjFinishedWriterSinceHoldBlocksCompaction(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "1.ecj")
+	// End a wrongly granted reservation, or the next writer waits on it forever.
+	refused := func(hold *ecjHold) bool {
+		end, ok := hold.tryBeginCompaction()
+		if ok {
+			end()
+		}
+		return !ok
+	}
+
+	hold := acquireEcjHold(path)
+	BeginEcjWrite(path)()
+	assert.True(t, refused(hold), "a writer that started after the hold")
+	hold.release()
+
+	done := BeginEcjWrite(path)
+	hold = acquireEcjHold(path)
+	done()
+	assert.True(t, refused(hold), "a writer active when the hold was taken")
+	hold.release()
+
+	hold = acquireEcjHold(path)
+	defer hold.release()
+	end, ok := hold.tryBeginCompaction()
+	require.True(t, ok, "no writer since the hold")
+	end()
+}
+
+// A ReceiveFile truncates the journal and refills it. One that runs during the
+// mount's load and finishes before compaction can leave the same inode at the
+// same length with different ids, which the inode-and-size re-check accepts;
+// compacting would then overwrite the received ids with the stale set.
+func TestEcjInPlaceRewriteDuringLoadBlocksCompaction(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 66, compactEcjBytes(compactTestIds(), 4096))
+	received := make([]types.NeedleId, 0, 100)
+	for i := 0; i < 100; i++ {
+		received = append(received, types.NeedleId(2000+i))
+	}
+	rewrite := compactEcjBytes(received, 4096)
+
+	rewritten := false
+	ops := withEcjOps(func(o *ecjFsOps) {
+		o.readAt = func(f *os.File, b []byte, off int64) (int, error) {
+			n, err := f.ReadAt(b, off)
+			if !rewritten && off+int64(len(b)) >= int64(len(rewrite)) {
+				// The last chunk is read: a stream truncates and refills the
+				// journal in place, start to finish, before compaction.
+				rewritten = true
+				done := BeginEcjWrite(base + ".ecj")
+				w, openErr := os.OpenFile(base+".ecj", os.O_WRONLY|os.O_TRUNC, 0644)
+				require.NoError(t, openErr)
+				_, writeErr := w.Write(rewrite)
+				require.NoError(t, writeErr)
+				require.NoError(t, w.Close())
+				done()
+			}
+			return n, err
+		}
+	})
+	ev, err := mountCompactTest(dir, 66, ops)
+	require.NoError(t, err)
+	defer ev.Close()
+	require.True(t, rewritten)
+
+	got, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, rewrite, got, "the received journal must not be compacted from the set loaded before it")
+}
+
+// Two spellings of one directory must meet in the registry.
+func TestEcjRegistryKeysResolveDirectories(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.Mkdir(filepath.Join(dir, "sub"), 0755))
+	a := acquireEcjHold(filepath.Join(dir, "1.ecj"))
+	defer a.release()
+	b := acquireEcjHold(filepath.Join(dir, "sub", "..", "1.ecj"))
+	_, ok := a.tryBeginCompaction()
+	assert.False(t, ok)
+	b.release()
+	end, ok := a.tryBeginCompaction()
+	require.True(t, ok)
+	end()
+}
+
+// A journal that grew, or was replaced, after it was loaded must not be
+// compacted from the stale set.
+func TestEcjChangedAfterLoadIsDetected(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 63, compactEcjBytes([]types.NeedleId{1}, 1))
+	ev, err := NewEcVolume("hdd", dir, dir, "", 63)
+	require.NoError(t, err)
+	defer ev.Close()
+
+	unchanged, err := ev.ecjUnchangedSinceLoad(base + ".ecj")
+	require.NoError(t, err)
+	assert.True(t, unchanged)
+
+	f, err := os.OpenFile(base+".ecj", os.O_APPEND|os.O_WRONLY, 0644)
+	require.NoError(t, err)
+	_, err = f.Write(make([]byte, types.NeedleIdSize))
+	require.NoError(t, err)
+	require.NoError(t, f.Close())
+	unchanged, err = ev.ecjUnchangedSinceLoad(base + ".ecj")
+	require.NoError(t, err)
+	assert.False(t, unchanged)
+
+	// Same size as loaded, different file: a copy that replaced the journal.
+	require.NoError(t, os.WriteFile(base+".replacement", make([]byte, types.NeedleIdSize), 0644))
+	require.NoError(t, os.Rename(base+".replacement", base+".ecj"))
+	unchanged, err = ev.ecjUnchangedSinceLoad(base + ".ecj")
+	require.NoError(t, err)
+	assert.False(t, unchanged)
+}
+
+// A failed rename publishes nothing: the mount succeeds on the original
+// journal, byte for byte, with no tmp left, and deletes still reach the file
+// at the journal's path.
+func TestEcjRenameFailureKeepsOriginalJournal(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 64, compactEcjBytes(compactTestIds(), 4096))
+	before, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+
+	ev, err := mountCompactTest(dir, 64, withEcjOps(func(o *ecjFsOps) { o.rename = failingRename }))
+	require.NoError(t, err, "a failed rename must not fail the mount")
+	defer ev.Close()
+
+	after, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+	assert.NoFileExists(t, base+EcjCompactTmpExt)
+
+	require.NoError(t, ev.DeleteNeedleFromEcx(7))
+	assert.Equal(t, int64(len(before)+types.NeedleIdSize), fileSize(t, base+".ecj"),
+		"the restored handle must append to the original journal")
+}
+
+// A failed rename whose handle restore also fails leaves no usable handle:
+// the mount fails, reports both errors, and the journal is untouched.
+func TestEcjRenameAndRestoreFailureIsMountError(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 65, compactEcjBytes(compactTestIds(), 4096))
+	before, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+
+	_, err = mountCompactTest(dir, 65, withEcjOps(func(o *ecjFsOps) {
+		o.rename = failingRename
+		o.reopen = failingReopen
+	}))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, errInjectedRename)
+	assert.ErrorIs(t, err, errInjectedReopen)
+	assert.Contains(t, err.Error(), "no usable journal handle")
+	assert.Contains(t, err.Error(), "reopening the original journal")
+
+	after, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+	assert.NoFileExists(t, base+EcjCompactTmpExt)
+}
+
+// A reopen failure after the rename fails the mount: the journal was replaced
+// and the volume has no handle to it.
+func TestEcjPostRenameReopenFailureIsMountError(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 66, compactEcjBytes(compactTestIds(), 4096))
+
+	_, err := mountCompactTest(dir, 66, withEcjOps(func(o *ecjFsOps) { o.reopen = failingReopen }))
+	require.Error(t, err)
+	assert.ErrorIs(t, err, errInjectedReopen)
+	assert.Contains(t, err.Error(), "could not reopen it")
+	assert.Equal(t, int64(100*types.NeedleIdSize), fileSize(t, base+".ecj"), "the rename had published the compacted journal")
+}
+
+// A directory fsync failure after the rename fails the mount too.
+func TestEcjPostRenameFsyncFailureIsMountError(t *testing.T) {
+	dir := t.TempDir()
+	writeCompactTestVolume(t, dir, 67, compactEcjBytes(compactTestIds(), 4096))
+
+	_, err := mountCompactTest(dir, 67, withEcjOps(func(o *ecjFsOps) { o.fsyncDir = failingFsync }))
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "could not fsync its directory")
+}
+
+// A compaction tmp left by a crash between its write and the rename is removed
+// at the next mount, even when the journal needs no compaction, and by
+// Destroy.
+func TestEcjStaleCompactionTmpRemoved(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 68, compactEcjBytes([]types.NeedleId{1}, 1))
+	require.NoError(t, os.WriteFile(base+EcjCompactTmpExt, make([]byte, 64), 0644))
+
+	ev, err := NewEcVolume("hdd", dir, dir, "", 68)
+	require.NoError(t, err)
+	assert.NoFileExists(t, base+EcjCompactTmpExt)
+
+	require.NoError(t, os.WriteFile(base+EcjCompactTmpExt, make([]byte, 64), 0644))
+	ev.Destroy()
+	assert.NoFileExists(t, base+EcjCompactTmpExt)
+}
+
+// A mount refused by a later check must leave the journal as it was:
+// compaction runs only after every check that can fail the mount.
+func TestEcjRefusedMountDoesNotCompact(t *testing.T) {
+	dir := t.TempDir()
+	base := writeCompactTestVolume(t, dir, 69, compactEcjBytes(compactTestIds(), 4096))
+	require.NoError(t, os.WriteFile(base+".vif", []byte("{not a volume info"), 0644))
+	before, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+
+	_, err = NewEcVolume("hdd", dir, dir, "", 69)
+	require.Error(t, err, "a malformed .vif must refuse the mount")
+
+	after, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+}
diff --git a/weed/storage/erasure_coding/ec_volume_ecj_test.go b/weed/storage/erasure_coding/ec_volume_ecj_test.go
new file mode 100644
index 0000000000..d7643803a2
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_volume_ecj_test.go
@@ -0,0 +1,167 @@
+package erasure_coding_test
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	erasure_coding "github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func ecjBytes(ids ...types.NeedleId) []byte {
+	b := make([]byte, 0, len(ids)*types.NeedleIdSize)
+	rec := make([]byte, types.NeedleIdSize)
+	for _, id := range ids {
+		types.NeedleIdToBytes(rec, id)
+		b = append(b, rec...)
+	}
+	return b
+}
+
+func mountEcVolume(t *testing.T, dir string, ecx, ecj []byte) (*erasure_coding.EcVolume, string) {
+	t.Helper()
+	base := erasure_coding.EcShardFileName("", dir, 7)
+	require.NoError(t, os.WriteFile(base+".ecx", ecx, 0644))
+	if ecj != nil {
+		require.NoError(t, os.WriteFile(base+".ecj", ecj, 0644))
+	}
+	require.NoError(t, os.WriteFile(base+".vif", []byte{}, 0644))
+	ev, err := erasure_coding.NewEcVolume("hdd", dir, dir, "", 7)
+	require.NoError(t, err)
+	return ev, base
+}
+
+// A crash mid-append leaves a partial record at the end of .ecj. Mount must
+// drop it: deletes append at the physical end, so keeping the fragment would
+// misalign every later record and lose those deletes on the next mount.
+func TestEcjTornTailTruncatedOnMount(t *testing.T) {
+	dir := t.TempDir()
+
+	ecx := append(makeNeedleMapEntry(types.NeedleId(1), types.ToOffset(0), types.Size(100)),
+		makeNeedleMapEntry(types.NeedleId(4), types.ToOffset(8), types.Size(100))...)
+	ecj := append(ecjBytes(1, 2, 3), []byte{1, 2, 3, 4, 5}...)
+
+	ev, base := mountEcVolume(t, dir, ecx, ecj)
+
+	fi, err := os.Stat(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, int64(3*types.NeedleIdSize), fi.Size())
+	for _, id := range []types.NeedleId{1, 2, 3} {
+		assert.True(t, ev.IsNeedleDeleted(id), "id %d", id)
+	}
+	assert.False(t, ev.IsNeedleDeleted(4))
+
+	require.NoError(t, ev.DeleteNeedleFromEcx(4))
+	ev.Close()
+
+	ev, _ = mountEcVolume(t, dir, ecx, nil)
+	defer ev.Close()
+	for _, id := range []types.NeedleId{1, 2, 3, 4} {
+		assert.True(t, ev.IsNeedleDeleted(id), "id %d", id)
+	}
+}
+
+// A journal larger than one load chunk must seed every record, including the
+// ones straddling and following the chunk boundary.
+func TestEcjLoadsAcrossChunkBoundary(t *testing.T) {
+	dir := t.TempDir()
+
+	const count = types.NeedleId(200_000) // 1.6 MiB > 1 MiB chunk
+	ecj := make([]byte, 0, int(count)*types.NeedleIdSize)
+	for id := types.NeedleId(1); id <= count; id++ {
+		rec := make([]byte, types.NeedleIdSize)
+		types.NeedleIdToBytes(rec, id)
+		ecj = append(ecj, rec...)
+	}
+
+	ev, _ := mountEcVolume(t, dir, nil, ecj)
+	defer ev.Close()
+
+	for _, id := range []types.NeedleId{1, 131072, 131073, count} {
+		assert.True(t, ev.IsNeedleDeleted(id), "id %d", id)
+	}
+	assert.False(t, ev.IsNeedleDeleted(count+1))
+}
+
+// A journal of 1M records over 100 distinct ids must mount to those 100 ids
+// and be folded down to 100*8 bytes. Mirrors the Rust bloated-compaction test
+// and the production 1.51 TB failure.
+func TestEcjBloatedJournalCompactedOnMount(t *testing.T) {
+	dir := t.TempDir()
+
+	const distinct = 100
+	const repeats = 10_000 // 1M records = 8 MiB
+	ids := make([]types.NeedleId, 0, distinct)
+	for i := 0; i < distinct; i++ {
+		ids = append(ids, types.NeedleId(1000+i))
+	}
+	ecj := make([]byte, 0, distinct*repeats*types.NeedleIdSize)
+	one := ecjBytes(ids...)
+	for i := 0; i < repeats; i++ {
+		ecj = append(ecj, one...)
+	}
+
+	ev, base := mountEcVolume(t, dir, nil, ecj)
+	for _, id := range ids {
+		assert.True(t, ev.IsNeedleDeleted(id), "id %d", id)
+	}
+	ev.Close()
+
+	fi, err := os.Stat(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, int64(distinct*types.NeedleIdSize), fi.Size(), "journal should have been folded down to one entry per id")
+
+	// No temp file left behind, and remount is stable.
+	_, err = os.Stat(base + ".ecj.compact.tmp")
+	assert.True(t, os.IsNotExist(err))
+	ev2, _ := mountEcVolume(t, dir, nil, nil)
+	defer ev2.Close()
+	for _, id := range ids {
+		assert.True(t, ev2.IsNeedleDeleted(id), "id %d", id)
+	}
+	fi2, err := os.Stat(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, int64(distinct*types.NeedleIdSize), fi2.Size())
+}
+
+// A healthy small journal must never be rewritten, however redundant.
+func TestEcjHealthySmallJournalNotRewritten(t *testing.T) {
+	dir := t.TempDir()
+
+	ids := make([]types.NeedleId, 0, 100)
+	for i := 1; i <= 100; i++ {
+		ids = append(ids, types.NeedleId(i))
+	}
+	// Duplicated 3x, but only 2.4 KB — under ecjCompactMinBytes.
+	ecj := append(append(ecjBytes(ids...), ecjBytes(ids...)...), ecjBytes(ids...)...)
+
+	// Lay the files down and take the baseline BEFORE mounting, so a rewrite
+	// during the mount shows up as a difference. The mtime is pushed into the
+	// past so a rewrite within the filesystem's timestamp granularity still
+	// changes it.
+	base := erasure_coding.EcShardFileName("", dir, 7)
+	require.NoError(t, os.WriteFile(base+".ecx", nil, 0644))
+	require.NoError(t, os.WriteFile(base+".ecj", ecj, 0644))
+	require.NoError(t, os.WriteFile(base+".vif", []byte{}, 0644))
+	past := time.Now().Add(-time.Hour).Truncate(time.Second)
+	require.NoError(t, os.Chtimes(base+".ecj", past, past))
+	before, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+
+	ev, err := erasure_coding.NewEcVolume("hdd", dir, dir, "", 7)
+	require.NoError(t, err)
+	for _, id := range ids {
+		assert.True(t, ev.IsNeedleDeleted(id), "id %d", id)
+	}
+	ev.Close()
+
+	after, err := os.ReadFile(base + ".ecj")
+	require.NoError(t, err)
+	assert.Equal(t, before, after, "small journal must not be rewritten")
+	afterFi, err := os.Stat(base + ".ecj")
+	require.NoError(t, err)
+	assert.True(t, afterFi.ModTime().Equal(past), "small journal mtime must be unchanged, got %v", afterFi.ModTime())
+}
diff --git a/weed/storage/erasure_coding/ec_volume_info.go b/weed/storage/erasure_coding/ec_volume_info.go
index 4d71d90121..29f19348b2 100644
--- a/weed/storage/erasure_coding/ec_volume_info.go
+++ b/weed/storage/erasure_coding/ec_volume_info.go
@@ -55,3 +55,15 @@ func (evi *EcVolumeInfo) ToVolumeEcShardInformationMessage() (ret *master_pb.Vol
 		EncodeTsNs:  evi.EncodeTsNs,
 	}
 }
+
+func (evi *EcVolumeInfo) GetCollection() string {
+	return evi.Collection
+}
+
+func (evi *EcVolumeInfo) GetVolumeId() needle.VolumeId {
+	return evi.VolumeId
+}
+
+func (evi *EcVolumeInfo) GetRemoteStorageName() string {
+	return ""
+}
diff --git a/weed/storage/erasure_coding/ec_volume_merge.go b/weed/storage/erasure_coding/ec_volume_merge.go
new file mode 100644
index 0000000000..d031264b45
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_volume_merge.go
@@ -0,0 +1,301 @@
+package erasure_coding
+
+import (
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+)
+
+// MergedEcRuntimes resolves one volume id's per-disk runtimes into a single
+// scrubbable view. Every scrub mode builds from this, so there is exactly one
+// answer to "which disks count" per volume.
+//
+// Two fences admit a runtime into Merged: the anchor's EncodeTsNs (the
+// maximum, so 0 implies every runtime is 0 and nothing is excluded — legacy
+// leniency), and the anchor's geometry (DataShards, ParityShards, BlockSize).
+// Equal timestamps do not guarantee equal layouts, so a same-generation
+// runtime whose .vif disagrees is excluded and reported rather than merged
+// into a plan that would apply the anchor's offsets and checksums to
+// incompatible shards.
+type MergedEcRuntimes struct {
+	// Anchor is the volume-level metadata source: geometry, .ecx handles,
+	// version. It is NOT the bitrot protection source — the .ecsum sidecar is
+	// per-DISK state, so ChecksumScrubMerged sources it from the first Merged
+	// runtime that has any.
+	Anchor *EcVolume
+	// Merged holds the runtimes whose shards are safe to verify together.
+	Merged []*EcVolume
+	// Slots is indexed BY SHARD ID. A nil entry is a shard no merged runtime
+	// holds. The volume's shard-id range is the anchor's geometry
+	// (0..DataShards+ParityShards); consumers truncate to it.
+	Slots []*EcVolumeShard
+	// Skipped holds one line per runtime excluded by the identity or geometry
+	// fence. Reported, never dropped.
+	Skipped []string
+}
+
+// MergeEcRuntimes resolves runtimes (one vid's mounts, in location order) into
+// a merged view. Returns nil for an empty slice (the vanished-volume case).
+func MergeEcRuntimes(runtimes []*EcVolume) *MergedEcRuntimes {
+	if len(runtimes) == 0 {
+		return nil
+	}
+
+	anchorGen := int64(0)
+	for _, v := range runtimes {
+		if v.EncodeTsNs > anchorGen {
+			anchorGen = v.EncodeTsNs
+		}
+	}
+
+	var genMatches []*EcVolume
+	for _, v := range runtimes {
+		if v.EncodeTsNs == anchorGen {
+			genMatches = append(genMatches, v)
+		}
+	}
+
+	anchor := genMatches[0]
+	for _, v := range genMatches {
+		if len(v.Shards) > 0 {
+			anchor = v
+			break
+		}
+	}
+
+	var merged []*EcVolume
+	for _, v := range genMatches {
+		if geometryMatches(v, anchor) {
+			merged = append(merged, v)
+		}
+	}
+
+	total := ecDataShards(anchor) + ecParityShards(anchor)
+	width := total
+	for _, v := range merged {
+		if n := int(v.Shards[len(v.Shards)-1].ShardId) + 1; n > width {
+			width = n
+		}
+	}
+	slots := make([]*EcVolumeShard, width)
+	for _, v := range merged {
+		for _, shard := range v.Shards {
+			id := int(shard.ShardId)
+			if id >= len(slots) {
+				continue
+			}
+			if slots[id] == nil {
+				slots[id] = shard
+			}
+		}
+	}
+
+	var skipped []string
+	for pos, v := range runtimes {
+		if v.EncodeTsNs != anchorGen {
+			skipped = append(skipped, fmt.Sprintf(
+				"EC volume %d shards at %s (position %d) belong to encode run %d but the scrub anchors on %d; they were not verified",
+				v.VolumeId, v.dir, pos, v.EncodeTsNs, anchorGen))
+			continue
+		}
+		if !geometryMatches(v, anchor) {
+			skipped = append(skipped, fmt.Sprintf(
+				"EC volume %d shards at %s (position %d) share encode run %d but disagree on geometry (%d+%d bs %d vs %d+%d bs %d); they were not verified",
+				v.VolumeId, v.dir, pos, v.EncodeTsNs,
+				ecDataShards(v), ecParityShards(v), ecBlockSize(v),
+				ecDataShards(anchor), ecParityShards(anchor), ecBlockSize(anchor)))
+		}
+	}
+
+	return &MergedEcRuntimes{
+		Anchor:  anchor,
+		Merged:  merged,
+		Slots:   slots,
+		Skipped: skipped,
+	}
+}
+
+func geometryMatches(a, b *EcVolume) bool {
+	return ecDataShards(a) == ecDataShards(b) &&
+		ecParityShards(a) == ecParityShards(b) &&
+		ecBlockSize(a) == ecBlockSize(b)
+}
+
+func ecDataShards(v *EcVolume) int {
+	if v.ECContext != nil {
+		return v.ECContext.DataShards
+	}
+	return 0
+}
+
+func ecParityShards(v *EcVolume) int {
+	if v.ECContext != nil {
+		return v.ECContext.ParityShards
+	}
+	return 0
+}
+
+func ecBlockSize(v *EcVolume) int64 {
+	if v.ECContext != nil {
+		return v.ECContext.BlockSize
+	}
+	return 0
+}
+
+// asVolume returns a synthetic EcVolume that shares the anchor's volume-level
+// state (ecx handles, version, geometry, bitrot protection) but presents the
+// merged shard set. ScrubLocal/ChecksumScrub read Shards, FindEcVolumeShard,
+// ECContext, ecxFile, BitrotProtection and Version — all of which the anchor
+// supplies except Shards, which is rebuilt from the merged slots.
+//
+// For legacy volumes (no datFileSize in .vif), LocateEcShardNeedleInterval
+// derives the shard size from Shards[0].ecdFileSize. The merged shard set is
+// compacted in shard-ID order, so a truncated lowest-ID shard would shrink
+// every interval and misread intact sibling shards. To prevent that, asVolume
+// synthesizes a datFileSize from the maximum mounted shard size when the
+// anchor lacks one, so the datFileSize>0 path in LocateEcShardNeedleInterval
+// uses the largest shard's size across all merged runtimes.
+func (m *MergedEcRuntimes) asVolume() *EcVolume {
+	anchor := m.Anchor
+	shards := make([]*EcVolumeShard, 0, len(m.Slots))
+	for _, s := range m.Slots {
+		if s != nil {
+			shards = append(shards, s)
+		}
+	}
+	datFileSize := anchor.datFileSize
+	if datFileSize == 0 && anchor.ECContext != nil && anchor.ECContext.DataShards > 0 {
+		var maxShardSize int64
+		for _, s := range shards {
+			if s.ecdFileSize > maxShardSize {
+				maxShardSize = s.ecdFileSize
+			}
+		}
+		// Subtract 1 to match the legacy fallback in LocateEcShardNeedleInterval
+		// (ecdFileSize - 1): an exact large-block boundary is ambiguous, and
+		// the unadjusted size would select an extra large row.
+		if maxShardSize > 0 {
+			datFileSize = (maxShardSize - 1) * int64(anchor.ECContext.DataShards)
+		}
+	}
+	return &EcVolume{
+		VolumeId:     anchor.VolumeId,
+		Collection:   anchor.Collection,
+		dir:          anchor.dir,
+		dirIdx:       anchor.dirIdx,
+		ecxActualDir: anchor.ecxActualDir,
+		ecxFile:      anchor.ecxFile,
+		ecxFileSize:  anchor.ecxFileSize,
+		ecxCreatedAt: anchor.ecxCreatedAt,
+		Shards:       shards,
+		Version:      anchor.Version,
+		diskType:     anchor.diskType,
+		datFileSize:  datFileSize,
+		ECContext:    anchor.ECContext,
+		EncodeTsNs:   anchor.EncodeTsNs,
+		bitrot:       anchor.bitrot,
+		bitrotStatus: anchor.bitrotStatus,
+	}
+}
+
+// ScrubLocal checks the integrity of local shards across every merged
+// runtime, mirroring EcVolume.ScrubLocal over the merged shard set. Skipped
+// runtimes are reported alongside any scrub errors.
+func (m *MergedEcRuntimes) ScrubLocal() (int64, []*volume_server_pb.EcShardInfo, []error) {
+	files, shardInfos, errs := m.asVolume().ScrubLocal()
+	for _, s := range m.Skipped {
+		errs = append(errs, fmt.Errorf("%s", s))
+	}
+	return files, shardInfos, errs
+}
+
+// ChecksumScrub verifies every merged runtime's local shards against the
+// bitrot sidecar, mirroring EcVolume.ChecksumScrub. The sidecar is per-DISK
+// state: protection is taken from the first merged runtime that has any (On,
+// else Invalid, else the anchor's Off), and every merged runtime whose
+// sidecar resolved Invalid is reported even when protection is taken from a
+// sibling that is On. Skipped runtimes are reported alongside any scrub
+// errors.
+func (m *MergedEcRuntimes) ChecksumScrub() (int64, []*volume_server_pb.EcShardInfo, []error) {
+	// Pick the protection source: first On, else first Invalid, else anchor.
+	var protectionSource *EcVolume
+	for _, v := range m.Merged {
+		if _, status := v.BitrotProtection(); status == BitrotOn {
+			protectionSource = v
+			break
+		}
+	}
+	if protectionSource == nil {
+		for _, v := range m.Merged {
+			if _, status := v.BitrotProtection(); status == BitrotInvalid {
+				protectionSource = v
+				break
+			}
+		}
+	}
+	if protectionSource == nil {
+		protectionSource = m.Anchor
+	}
+
+	prot, status := protectionSource.BitrotProtection()
+
+	// Fence the sidecar's encode generation: a merged runtime can load a
+	// sidecar from a sibling metadata directory (ReloadBitrotSidecar), and
+	// the merge fence may then exclude the runtime owning that directory.
+	// Generation-0 sidecars do not identify the encode run, so geometry
+	// validation alone cannot prove the borrowed manifest describes the
+	// anchor's shards. If the sidecar records a non-zero EncodeTsNs that
+	// disagrees with the anchor's, scanning would apply stale checksums to
+	// current shards and report false corruption. Refuse instead.
+	if status == BitrotOn && prot != nil && prot.EcShardConfig != nil {
+		sidecarGen := prot.EcShardConfig.EncodeTsNs
+		if sidecarGen != 0 && m.Anchor.EncodeTsNs != 0 && sidecarGen != m.Anchor.EncodeTsNs {
+			errs := []error{fmt.Errorf(
+				"ec volume %d: bitrot sidecar at %s records encode run %d but the scrub anchors on %d; protection is unverifiable",
+				m.Anchor.VolumeId, protectionSource.dir, sidecarGen, m.Anchor.EncodeTsNs)}
+			for _, rt := range m.Merged {
+				if rt == protectionSource {
+					continue
+				}
+				if _, s := rt.BitrotProtection(); s == BitrotInvalid {
+					errs = append(errs, fmt.Errorf(
+						"ec volume %d bitrot sidecar at %s is malformed/unverifiable (sidecar integrity)",
+						rt.VolumeId, rt.dir))
+				}
+			}
+			for _, s := range m.Skipped {
+				errs = append(errs, fmt.Errorf("%s", s))
+			}
+			return 0, nil, errs
+		}
+	}
+
+	// Run the byte scan against the protection source's sidecar, but over
+	// the merged shard set. The synthetic volume inherits the protection
+	// source's bitrot state so ChecksumScrub's BitrotOff/Invalid arms fire.
+	v := m.asVolume()
+	v.bitrot = prot
+	v.bitrotStatus = status
+
+	blocks, broken, errs := v.ChecksumScrub()
+
+	// Collect Invalid-sidecar errors from every merged runtime except the
+	// protection source (whose error the Invalid arm already reports), so a
+	// malformed sidecar is never silently discarded when a sibling is On.
+	if status != BitrotInvalid {
+		for _, rt := range m.Merged {
+			if rt == protectionSource {
+				continue
+			}
+			if _, s := rt.BitrotProtection(); s == BitrotInvalid {
+				errs = append(errs, fmt.Errorf(
+					"ec volume %d bitrot sidecar at %s is malformed/unverifiable (sidecar integrity)",
+					rt.VolumeId, rt.dir))
+			}
+		}
+	}
+	for _, s := range m.Skipped {
+		errs = append(errs, fmt.Errorf("%s", s))
+	}
+	return blocks, broken, errs
+}
diff --git a/weed/storage/erasure_coding/ec_volume_scrub.go b/weed/storage/erasure_coding/ec_volume_scrub.go
index 8cb33297eb..40457f58e2 100644
--- a/weed/storage/erasure_coding/ec_volume_scrub.go
+++ b/weed/storage/erasure_coding/ec_volume_scrub.go
@@ -238,7 +238,7 @@ func (ecv *EcVolume) ScrubLocal() (int64, []*volume_server_pb.EcShardInfo, []err
 		localShardIds := []ShardId{}
 
 		for i, iv := range locations {
-			sid, soffset := iv.ToShardIdAndOffset(ErasureCodingLargeBlockSize, ErasureCodingSmallBlockSize)
+			sid, soffset := ecv.IntervalToShardIdAndOffset(iv)
 			ssize := int64(iv.Size.Raw())
 			shard, found := ecv.FindEcVolumeShard(sid)
 
diff --git a/weed/storage/erasure_coding/ec_volume_sidecar_layout_test.go b/weed/storage/erasure_coding/ec_volume_sidecar_layout_test.go
new file mode 100644
index 0000000000..34e992416e
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_volume_sidecar_layout_test.go
@@ -0,0 +1,246 @@
+package erasure_coding
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+func uniformSidecar(t *testing.T, base string, ds, ps uint32, blockSize int64) {
+	t.Helper()
+	prot := &volume_server_pb.EcBitrotProtection{
+		Algorithm:  volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+		BlockSize:  uint32(BitrotBlockSize),
+		Generation: 0,
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards: ds, ParityShards: ps, BlockSize: blockSize,
+		},
+	}
+	if err := SaveBitrotSidecar(BitrotSidecarPath(base, 0), prot); err != nil {
+		t.Fatalf("seed .ecsum: %v", err)
+	}
+}
+
+// The sidecar records the layout at encode time, so it answers what a .vif
+// cannot. A .vif that merely omits ecShardConfig is no more informative than an
+// absent one — going straight to the defaults reads a uniform volume with the
+// legacy offset math and returns the wrong bytes.
+func TestNewEcVolumeTakesLayoutFromSidecarWhenVifHasNoConfig(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "1")
+	if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	// A config-free .vif: version and dat size only, as a legacy encode left it.
+	if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.Version3),
+	}); err != nil {
+		t.Fatalf("seed .vif: %v", err)
+	}
+	uniformSidecar(t, base, 12, 4, 3*1024*1024)
+
+	ev, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(1))
+	if err != nil {
+		t.Fatalf("mount: %v", err)
+	}
+	defer ev.Close()
+	if got := ev.ECContext; got.DataShards != 12 || got.ParityShards != 4 || got.BlockSize != 3*1024*1024 {
+		t.Errorf("layout = %d+%d block %d, want 12+4 block 3MiB", got.DataShards, got.ParityShards, got.BlockSize)
+	}
+}
+
+// A split -dir/-dir.idx layout keeps the sidecar with the INDEX. Probing only
+// the data base reports "absent", and absent is the one answer that selects the
+// legacy layout.
+func TestNewEcVolumeFindsSidecarInTheIndexDirectory(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		writeVif bool
+	}{
+		{name: "no vif at all"},
+		{name: "vif without ec config", writeVif: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dataDir, idxDir := t.TempDir(), t.TempDir()
+			idxBase := filepath.Join(idxDir, "2")
+			if err := os.WriteFile(idxBase+".ecx", []byte{}, 0644); err != nil {
+				t.Fatalf("seed .ecx: %v", err)
+			}
+			if tc.writeVif {
+				if err := volume_info.SaveVolumeInfo(idxBase+".vif", &volume_server_pb.VolumeInfo{
+					Version: uint32(needle.Version3),
+				}); err != nil {
+					t.Fatalf("seed .vif: %v", err)
+				}
+			}
+			uniformSidecar(t, idxBase, 12, 4, 3*1024*1024)
+
+			ev, err := NewEcVolume(types.HardDriveType, dataDir, idxDir, "", needle.VolumeId(2))
+			if err != nil {
+				t.Fatalf("mount: %v", err)
+			}
+			defer ev.Close()
+			if got := ev.ECContext; got.DataShards != 12 || got.ParityShards != 4 || got.BlockSize != 3*1024*1024 {
+				t.Errorf("layout = %d+%d block %d, want 12+4 block 3MiB", got.DataShards, got.ParityShards, got.BlockSize)
+			}
+		})
+	}
+}
+
+// Absence stays legal — a volume encoded before either record exists is a
+// genuine legacy volume, and only that case may select the legacy layout.
+func TestNewEcVolumeConfigFreeVifWithNoSidecarUsesDefaults(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "3")
+	if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.Version3),
+	}); err != nil {
+		t.Fatalf("seed .vif: %v", err)
+	}
+	ev, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(3))
+	if err != nil {
+		t.Fatalf("mount: %v", err)
+	}
+	defer ev.Close()
+	if got := ev.ECContext; got.DataShards != DataShardsCount || got.ParityShards != ParityShardsCount || got.BlockSize != 0 {
+		t.Errorf("layout = %d+%d block %d, want the legacy defaults", got.DataShards, got.ParityShards, got.BlockSize)
+	}
+}
+
+// Present but unusable must fail the mount rather than default, in the
+// config-free-vif branch exactly as in the absent-vif one.
+func TestNewEcVolumeConfigFreeVifWithUnusableSidecarFails(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "4")
+	if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.Version3),
+	}); err != nil {
+		t.Fatalf("seed .vif: %v", err)
+	}
+	// Stamped for another generation: not a record of these shards.
+	if err := SaveBitrotSidecar(BitrotSidecarPath(base, 0), &volume_server_pb.EcBitrotProtection{
+		Algorithm:     volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+		BlockSize:     uint32(BitrotBlockSize),
+		Generation:    5,
+		EcShardConfig: &volume_server_pb.EcShardConfig{DataShards: 12, ParityShards: 4},
+	}); err != nil {
+		t.Fatalf("seed .ecsum: %v", err)
+	}
+	if _, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(4)); err == nil {
+		t.Fatal("an unusable sole layout record must fail the mount")
+	}
+}
+
+// Startup mirroring gives each shard-bearing disk its own .ecx/.ecj/.vif but
+// deliberately not the .ecsum, and a repair delivers exactly one copy. A
+// runtime restricted to its own two directories therefore reports no
+// protection no matter how often it reloads — so the resolution has to reach
+// the sibling disk that actually received the manifest.
+func TestReloadBitrotSidecarFindsItOnASiblingDisk(t *testing.T) {
+	mine, sibling := t.TempDir(), t.TempDir()
+	myBase := filepath.Join(mine, "7")
+	if err := os.WriteFile(myBase+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(myBase+".vif", &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.Version3),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards: 10, ParityShards: 4, BlockSize: 0,
+		},
+	}); err != nil {
+		t.Fatalf("seed .vif: %v", err)
+	}
+
+	ev, err := NewEcVolume(types.HardDriveType, mine, mine, "", needle.VolumeId(7))
+	if err != nil {
+		t.Fatalf("mount: %v", err)
+	}
+	defer ev.Close()
+	if got := ev.bitrotStatus; got != BitrotOff {
+		t.Fatalf("precondition: status = %v, want BitrotOff before the delivery", got)
+	}
+
+	// The delivery lands the manifest on the sibling disk only.
+	prot := &volume_server_pb.EcBitrotProtection{
+		Algorithm:  volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+		BlockSize:  uint32(BitrotBlockSize),
+		Generation: 0,
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards: 10, ParityShards: 4, BlockSize: 0,
+		},
+	}
+	for i := 0; i < 14; i++ {
+		prot.Shards = append(prot.Shards, &volume_server_pb.EcShardChecksums{
+			ShardId: uint32(i), CoveredSize: 1, BlockCrc32C: make([]byte, 4),
+		})
+	}
+	if err := SaveBitrotSidecar(BitrotSidecarPath(filepath.Join(sibling, "7"), 0), prot); err != nil {
+		t.Fatalf("seed sibling .ecsum: %v", err)
+	}
+
+	// Reloading against only its own directories still finds nothing.
+	ev.ReloadBitrotSidecar()
+	if got := ev.bitrotStatus; got != BitrotOff {
+		t.Errorf("own-directories reload: status = %v, want BitrotOff", got)
+	}
+
+	ev.ReloadBitrotSidecar(mine, sibling)
+	if got := ev.bitrotStatus; got != BitrotOn {
+		t.Errorf("cross-disk reload: status = %v, want BitrotOn", got)
+	}
+}
+
+// "Does this volume already have a manifest" cannot be answered from one base
+// name. The rebuild's opportunistic backfill asks it before writing a TOFU
+// baseline, and a false "no" there writes a second sidecar at the data base
+// that then shadows the real one — blessing whatever the shards currently say.
+func TestFindBitrotSidecarSearchesEveryCandidate(t *testing.T) {
+	dataDir, idxDir, sibling := t.TempDir(), t.TempDir(), t.TempDir()
+	dataBase := filepath.Join(dataDir, "8")
+	idxBase := filepath.Join(idxDir, "8")
+	siblingBase := filepath.Join(sibling, "8")
+
+	if got := FindBitrotSidecar(0, dataBase, idxBase, sibling); got != "" {
+		t.Errorf("no sidecar anywhere should answer empty, got %q", got)
+	}
+
+	// Each location on its own: any one of them is enough to answer "yes".
+	for _, tc := range []struct{ name, base string }{
+		{"data directory", dataBase},
+		{"index directory", idxBase},
+		{"sibling disk", siblingBase},
+	} {
+		want := BitrotSidecarPath(tc.base, 0)
+		if err := os.WriteFile(want, []byte("x"), 0644); err != nil {
+			t.Fatalf("%s: seed: %v", tc.name, err)
+		}
+		if got := FindBitrotSidecar(0, dataBase, idxBase, sibling); got != want {
+			t.Errorf("%s: got %q, want %q", tc.name, got, want)
+		}
+		if err := os.Remove(want); err != nil {
+			t.Fatalf("%s: cleanup: %v", tc.name, err)
+		}
+	}
+
+	// With copies everywhere the data base wins, which is the order every
+	// resolver uses — so a stray copy there shadows the others.
+	for _, base := range []string{siblingBase, idxBase, dataBase} {
+		if err := os.WriteFile(BitrotSidecarPath(base, 0), []byte("x"), 0644); err != nil {
+			t.Fatalf("seed %s: %v", base, err)
+		}
+	}
+	if got, want := FindBitrotSidecar(0, dataBase, idxBase, sibling), BitrotSidecarPath(dataBase, 0); got != want {
+		t.Errorf("precedence: got %q, want the data base %q", got, want)
+	}
+}
diff --git a/weed/storage/erasure_coding/ec_volume_test.go b/weed/storage/erasure_coding/ec_volume_test.go
index b87a662cf6..556fc1abab 100644
--- a/weed/storage/erasure_coding/ec_volume_test.go
+++ b/weed/storage/erasure_coding/ec_volume_test.go
@@ -256,3 +256,30 @@ func TestEcVolumeDestroySweepsBothDirs(t *testing.T) {
 		}
 	}
 }
+
+func TestLocateEcShardNeedleMatchesInterval(t *testing.T) {
+	ecxFile, err := os.OpenFile("./test_files/389.ecx", os.O_RDONLY, 0)
+	assert.NoError(t, err)
+	defer ecxFile.Close()
+
+	stat, err := ecxFile.Stat()
+	assert.NoError(t, err)
+	fileSize := stat.Size()
+
+	ev := &EcVolume{
+		VolumeId:    needle.VolumeId(389),
+		ecxFile:     ecxFile,
+		ecxFileSize: fileSize,
+		Shards: []*EcVolumeShard{
+			{ecdFileSize: 1118830592},
+		},
+		ECContext: NewDefaultECContext("", 389),
+	}
+
+	needleId, _ := types.ParseNeedleId("0f0edb92")
+	offset, size, intervals, err := ev.LocateEcShardNeedle(needleId, needle.GetCurrentVersion())
+	assert.NoError(t, err)
+
+	expectedIntervals := ev.LocateEcShardNeedleInterval(needle.GetCurrentVersion(), offset.ToActualOffset(), size)
+	assert.Equal(t, expectedIntervals, intervals)
+}
diff --git a/weed/storage/erasure_coding/ec_volume_vif_test.go b/weed/storage/erasure_coding/ec_volume_vif_test.go
new file mode 100644
index 0000000000..e054d7612a
--- /dev/null
+++ b/weed/storage/erasure_coding/ec_volume_vif_test.go
@@ -0,0 +1,187 @@
+package erasure_coding
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+// A present-but-malformed .vif must FAIL the mount: every new encode
+// records a positive uniform block size there, and silently defaulting
+// to the legacy layout would serve those shards with the wrong offset
+// math. Absence stays legal — legacy volumes predate the sidecar.
+func TestNewEcVolumeFailsOnMalformedVif(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "1")
+	if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	if err := os.WriteFile(base+".vif", []byte("not json"), 0644); err != nil {
+		t.Fatalf("seed .vif: %v", err)
+	}
+	_, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(1))
+	if err == nil {
+		t.Fatal("mount over a malformed .vif must fail")
+	}
+	if !strings.Contains(err.Error(), ".vif") {
+		t.Errorf("error should name the vif: %v", err)
+	}
+}
+
+func TestNewEcVolumeAbsentVifMountsWithDefaults(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "1")
+	if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	ev, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(1))
+	if err != nil {
+		t.Fatalf("legacy mount without .vif must succeed: %v", err)
+	}
+	defer ev.Close()
+	if ev.ECContext.BlockSize != 0 {
+		t.Errorf("legacy mount must use the legacy layout: BlockSize=%d", ev.ECContext.BlockSize)
+	}
+}
+
+// A block size no encoder could have produced (negative, or not a whole
+// number of small blocks) maps every read to the wrong shard offset, so the
+// mount refuses it rather than serving those bytes.
+func TestNewEcVolumeRejectsImplausibleBlockSize(t *testing.T) {
+	for _, blockSize := range []int64{1, -1, 3*1024*1024 + 1} {
+		dir := t.TempDir()
+		base := filepath.Join(dir, "1")
+		if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+			t.Fatalf("seed .ecx: %v", err)
+		}
+		if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+			Version: uint32(needle.Version3),
+			EcShardConfig: &volume_server_pb.EcShardConfig{
+				DataShards: 10, ParityShards: 4, BlockSize: blockSize,
+			},
+		}); err != nil {
+			t.Fatalf("seed .vif: %v", err)
+		}
+		if _, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(1)); err == nil {
+			t.Errorf("block size %d must fail the mount", blockSize)
+		}
+	}
+}
+
+func TestNewEcVolumeAcceptsAlignedBlockSize(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "1")
+	if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.Version3),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards: 10, ParityShards: 4, BlockSize: 3 * 1024 * 1024,
+		},
+	}); err != nil {
+		t.Fatalf("seed .vif: %v", err)
+	}
+	ev, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(1))
+	if err != nil {
+		t.Fatalf("aligned block size must mount: %v", err)
+	}
+	defer ev.Close()
+	if ev.ECContext.BlockSize != 3*1024*1024 {
+		t.Errorf("BlockSize = %d, want 3MiB", ev.ECContext.BlockSize)
+	}
+}
+
+// The .vif and the .ecsum both record the layout their generation was encoded
+// with. When a generation-matching sidecar disagrees, one of them is wrong and
+// reads through the other land at the wrong shard offsets — so the mount must
+// refuse rather than quietly drop to unprotected reads.
+func TestNewEcVolumeRejectsSidecarGeometryDisagreement(t *testing.T) {
+	dir := t.TempDir()
+	base := filepath.Join(dir, "1")
+	if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+		t.Fatalf("seed .ecx: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+		Version: uint32(needle.Version3),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards: 10, ParityShards: 4, BlockSize: 0, // says legacy
+		},
+	}); err != nil {
+		t.Fatalf("seed .vif: %v", err)
+	}
+	// The sidecar for the same generation says uniform.
+	prot := &volume_server_pb.EcBitrotProtection{
+		Algorithm:  volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+		BlockSize:  uint32(BitrotBlockSize),
+		Generation: 0,
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards: 10, ParityShards: 4, BlockSize: 3 * 1024 * 1024,
+		},
+	}
+	if err := SaveBitrotSidecar(BitrotSidecarPath(base, 0), prot); err != nil {
+		t.Fatalf("seed .ecsum: %v", err)
+	}
+
+	_, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(1))
+	if err == nil {
+		t.Fatal("a generation-matching layout disagreement must fail the mount")
+	}
+	if !strings.Contains(err.Error(), "block") {
+		t.Errorf("the error should name the disagreement: %v", err)
+	}
+}
+
+// With no .vif the bitrot sidecar is the ONLY record of the volume's layout.
+// Present but unusable — unreadable, stamped for another generation, or
+// carrying an incomplete ratio — must fail the mount: answering reads from a
+// guessed layout returns wrong bytes rather than none. Genuine absence stays
+// legal, and is covered by TestNewEcVolumeAbsentVifMountsWithDefaults.
+func TestNewEcVolumeRejectsUnusableSoleSidecar(t *testing.T) {
+	seed := map[string]*volume_server_pb.EcBitrotProtection{
+		"another generation": {
+			Algorithm:     volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+			BlockSize:     uint32(BitrotBlockSize),
+			Generation:    5,
+			EcShardConfig: &volume_server_pb.EcShardConfig{DataShards: 10, ParityShards: 4},
+		},
+		"no ec config": {
+			Algorithm:  volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+			BlockSize:  uint32(BitrotBlockSize),
+			Generation: 0,
+		},
+		"incomplete ratio": {
+			Algorithm:     volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+			BlockSize:     uint32(BitrotBlockSize),
+			Generation:    0,
+			EcShardConfig: &volume_server_pb.EcShardConfig{DataShards: 10},
+		},
+		"invalid block size": {
+			Algorithm:  volume_server_pb.ChecksumAlgorithm_CHECKSUM_CRC32C,
+			BlockSize:  uint32(BitrotBlockSize),
+			Generation: 0,
+			EcShardConfig: &volume_server_pb.EcShardConfig{
+				DataShards: 10, ParityShards: 4, BlockSize: 3*1024*1024 + 1,
+			},
+		},
+	}
+	for name, prot := range seed {
+		dir := t.TempDir()
+		base := filepath.Join(dir, "1")
+		if err := os.WriteFile(base+".ecx", []byte{}, 0644); err != nil {
+			t.Fatalf("%s: seed .ecx: %v", name, err)
+		}
+		if err := SaveBitrotSidecar(BitrotSidecarPath(base, 0), prot); err != nil {
+			t.Fatalf("%s: seed .ecsum: %v", name, err)
+		}
+		if _, err := NewEcVolume(types.HardDriveType, dir, dir, "", needle.VolumeId(1)); err == nil {
+			t.Errorf("%s: an unusable sole layout record must fail the mount", name)
+		}
+	}
+}
diff --git a/weed/storage/erasure_coding/ecbalancer/balancer.go b/weed/storage/erasure_coding/ecbalancer/balancer.go
index 83fcd8f6aa..2e8ad0ffa5 100644
--- a/weed/storage/erasure_coding/ecbalancer/balancer.go
+++ b/weed/storage/erasure_coding/ecbalancer/balancer.go
@@ -38,6 +38,10 @@ type Node struct {
 	rack string // composite rack key (e.g. "dc1:rack1")
 
 	freeSlots int
+	// noReceive marks a node that refused shards (e.g. answered "no space
+	// left"): it stays usable as a move source but is never picked as a target,
+	// regardless of what its freeSlots say.
+	noReceive bool
 	disks     map[uint32]*disk
 	shards    map[volKey]*volumeShards
 }
@@ -47,7 +51,8 @@ type disk struct {
 	diskType   string
 	tags       []string // placement tags, for preferred-tag tiering
 	freeSlots  int
-	shardCount int // total EC shards on this disk across all volumes
+	shardCount int  // total EC shards on this disk across all volumes
+	noReceive  bool // this disk refused a shard; siblings may still receive
 }
 
 type volumeShards struct {
@@ -74,6 +79,10 @@ type Move struct {
 	TargetDisk uint32
 	TargetRack string
 	Phase      string // "dedup", "cross_rack", "within_rack", "global"
+	// KeepNode is set for dedup moves: the node the plan chose to keep the
+	// shard on. The executor confirms it really holds the shard before
+	// deleting the copy.
+	KeepNode string
 }
 
 // Options tunes a Plan run.
@@ -102,6 +111,12 @@ type Options struct {
 	// heterogeneous-capacity racks; when false, by raw shard count. Both the worker
 	// and the shell enable it; the two metrics agree when capacities are uniform.
 	GlobalUtilizationBased bool
+	// RackTotalCapRaised, when set, is called for each volume whose
+	// total-shards-per-rack cap had to be raised above ceil(shards/racks)
+	// because the racks lack room for an even spread. Losing a rack then loses
+	// more shards than an even spread would, so callers log it as a degraded
+	// durability floor. It is called on every Plan while the condition holds.
+	RackTotalCapRaised func(collection string, vid uint32, rackCap, evenCap int)
 }
 
 // move is the internal form carrying node pointers; converted to Move at the end.
@@ -114,6 +129,7 @@ type move struct {
 	target     *Node
 	targetDisk uint32
 	phase      string
+	keepNode   string
 }
 
 // NewTopology returns an empty topology to populate.
@@ -145,6 +161,39 @@ func (n *Node) SetHost(host string) {
 	}
 }
 
+// SetNoReceive marks the node ineligible as a move destination. Use when the
+// node itself refused shards (e.g. answered "no space left") so the heartbeat's
+// free-slot count cannot be trusted; the node can still shed shards as a source.
+func (n *Node) SetNoReceive() {
+	n.noReceive = true
+}
+
+// SetDiskNoReceive marks one disk on the node ineligible as a move destination.
+// An explicit-disk copy can be refused while the node's other disks still have
+// room; a disk_id 0 refusal means the server searched every disk and is a
+// whole-node refusal (SetNoReceive) instead.
+func (n *Node) SetDiskNoReceive(diskID uint32) {
+	if d, ok := n.disks[diskID]; ok {
+		d.noReceive = true
+	}
+}
+
+// receiveSlots is the node's receiving capacity: its aggregate free slots with
+// refused disks subtracted, and 0 for a refused node. Slots a disk just
+// refused are phantom capacity whatever the snapshot reported.
+func (n *Node) receiveSlots() int {
+	if n.noReceive {
+		return 0
+	}
+	free := n.freeSlots
+	for _, d := range n.disks {
+		if d.noReceive {
+			free -= d.freeSlots
+		}
+	}
+	return max(free, 0)
+}
+
 // AddDisk registers a physical disk. shardCount is the disk's total EC shard
 // count across all volumes (used for disk scoring); freeSlots is the per-disk
 // free EC shard slots.
@@ -244,7 +293,7 @@ func Plan(topo *Topology, opts Options) []Move {
 			all = append(all, m...)
 		}
 		for _, vk := range byCollection[collection] {
-			m := detectCrossRackImbalance(vk, nodes, racks, opts.DiskType, opts.ImbalanceThreshold, dataShardsByVolume[vk], parityShardsByVolume[vk], opts.ReplicaPlacement)
+			m := detectCrossRackImbalance(vk, nodes, racks, opts.DiskType, opts.ImbalanceThreshold, dataShardsByVolume[vk], parityShardsByVolume[vk], opts.ReplicaPlacement, opts.RackTotalCapRaised)
 			applyMovesToTopology(m, racks)
 			all = append(all, m...)
 		}
@@ -270,6 +319,7 @@ func Plan(topo *Topology, opts Options) []Move {
 			TargetDisk: m.targetDisk,
 			TargetRack: m.target.rack,
 			Phase:      m.phase,
+			KeepNode:   m.keepNode,
 		})
 	}
 	return out
@@ -284,7 +334,7 @@ func buildRacks(nodes map[string]*Node) map[string]*rack {
 			racks[n.rack] = r
 		}
 		r.nodes[n.id] = n
-		r.freeSlots += n.freeSlots
+		r.freeSlots += n.receiveSlots()
 	}
 	return racks
 }
@@ -318,6 +368,7 @@ func detectDuplicateShards(vk volKey, nodes map[string]*Node) []*move {
 			}
 			return locs[i].id < locs[j].id
 		})
+		keep := locs[len(locs)-1]
 		for _, node := range locs[:len(locs)-1] {
 			moves = append(moves, &move{
 				volumeID:   vk.vid,
@@ -328,6 +379,7 @@ func detectDuplicateShards(vk volKey, nodes map[string]*Node) []*move {
 				target:     node,
 				targetDisk: shardDiskID(node, vk, shardID),
 				phase:      "dedup",
+				keepNode:   keep.id,
 			})
 		}
 	}
@@ -335,82 +387,179 @@ func detectDuplicateShards(vk volKey, nodes map[string]*Node) []*move {
 }
 
 // detectCrossRackImbalance spreads a volume's shards across racks in two passes
-// (data, then parity with anti-affinity to data-bearing racks). Returns nil if
-// the overall distribution is below the imbalance threshold.
-func detectCrossRackImbalance(vk volKey, nodes map[string]*Node, racks map[string]*rack, diskType string, threshold float64, dataShards, parityShards int, rp *super_block.ReplicaPlacement) []*move {
+// (data, then parity with anti-affinity to data-bearing racks), keeping each
+// rack's total within planRackTotalCap. Returns nil if the overall distribution
+// is below the imbalance threshold and no rack is above the total cap.
+func detectCrossRackImbalance(vk volKey, nodes map[string]*Node, racks map[string]*rack, diskType string, threshold float64, dataShards, parityShards int, rp *super_block.ReplicaPlacement, onCapRaised func(collection string, vid uint32, rackCap, evenCap int)) []*move {
 	numRacks := len(racks)
 	if numRacks <= 1 {
 		return nil
 	}
 
+	// The per-type caps below spread data and parity independently, so together
+	// they can still stack e.g. 2 data + 1 parity on one rack. Cap the TOTAL per
+	// rack too, at the lowest value the racks' capacity allows.
+	rackShardCount := countShardsByRack(vk, nodes)
+	totalShards := 0
+	for _, n := range rackShardCount {
+		totalShards += n
+	}
+	totalCap := planRackTotalCap(vk, racks, rackShardCount, totalShards, rp)
+	if evenCap := ceilDivide(totalShards, numRacks); totalCap > evenCap && onCapRaised != nil {
+		onCapRaised(vk.collection, vk.vid, totalCap, evenCap)
+	}
+	aboveTotalCap := func() bool {
+		for _, n := range rackShardCount {
+			if n > totalCap {
+				return true
+			}
+		}
+		return false
+	}
+
 	// Gate on per-type spread: act when data OR parity shards are unevenly
 	// distributed across racks, even if the per-rack totals happen to be even.
+	// A rack above the total cap is a durability bound, not skew, so it bypasses
+	// the threshold.
 	gateData, gateParity := shardsByGroup(vk, nodes, dataShards, func(n *Node) string { return n.rack })
-	if !typeImbalanced(gateData, numRacks, threshold) && !typeImbalanced(gateParity, numRacks, threshold) {
+	if !aboveTotalCap() && !typeImbalanced(gateData, numRacks, threshold) && !typeImbalanced(gateParity, numRacks, threshold) {
 		return nil
 	}
 
-	rackShardCount := countShardsByRack(vk, nodes)
 	var moves []*move
+	// A shard moves at most once per plan: each move runs as its own task,
+	// possibly in parallel with the others, so a second hop could start before
+	// the first has landed.
+	moved := make(map[int]bool)
+	for {
+		before := len(moves)
 
-	dataPerRack, _ := shardsByGroup(vk, nodes, dataShards, func(n *Node) string { return n.rack })
-	moves = append(moves, balanceShardTypeAcrossRacks(vk, nodes, racks, diskType, dataShards,
-		dataPerRack, rackShardCount, ceilDivide(dataShards, numRacks), nil, rp)...)
+		// The data pass leaves the total cap out (0): ceil(data/racks) <= totalCap
+		// already bounds data, and rackShardCount still includes parity that the
+		// parity pass is about to shed, so a total bound here would block data
+		// moves that fit once that parity has gone.
+		dataPerRack, _ := shardsByGroup(vk, nodes, dataShards, func(n *Node) string { return n.rack })
+		moves = append(moves, balanceShardTypeAcrossRacks(vk, nodes, racks, diskType, dataShards,
+			dataPerRack, rackShardCount, ceilDivide(dataShards, numRacks), 0, nil, rp, moved)...)
 
-	dataPerRack, parityPerRack := shardsByGroup(vk, nodes, dataShards, func(n *Node) string { return n.rack })
-	antiAffinity := make(map[string]bool)
-	for rackID, shards := range dataPerRack {
-		if len(shards) > 0 {
-			antiAffinity[rackID] = true
+		dataPerRack, parityPerRack := shardsByGroup(vk, nodes, dataShards, func(n *Node) string { return n.rack })
+		antiAffinity := make(map[string]bool)
+		for rackID, shards := range dataPerRack {
+			if len(shards) > 0 {
+				antiAffinity[rackID] = true
+			}
+		}
+		moves = append(moves, balanceShardTypeAcrossRacks(vk, nodes, racks, diskType, dataShards,
+			parityPerRack, rackShardCount, ceilDivide(parityShards, numRacks), totalCap, antiAffinity, rp, moved)...)
+
+		// The data pass can run out of destinations before the parity pass frees
+		// slots on other racks. While a rack is still above the total cap, run
+		// another round over the shards not moved yet. A round that continues
+		// moved at least one more shard, so this ends.
+		if len(moves) == before || !aboveTotalCap() {
+			return moves
 		}
 	}
-	moves = append(moves, balanceShardTypeAcrossRacks(vk, nodes, racks, diskType, dataShards,
-		parityPerRack, rackShardCount, ceilDivide(parityShards, numRacks), antiAffinity, rp)...)
-
-	return moves
 }
 
-func balanceShardTypeAcrossRacks(vk volKey, nodes map[string]*Node, racks map[string]*rack, diskType string, dataShards int, shardsPerRack map[string][]int, rackShardCount map[string]int, maxPerRack int, antiAffinity map[string]bool, rp *super_block.ReplicaPlacement) []*move {
+// planRackTotalCap returns the lowest per-rack total that the racks can hold a
+// volume's totalShards under (see rackTotalCap). Plan may move any shard, so a
+// rack's shards of the volume count as room there rather than as held in place.
+// Moves of the volume shift slots between racks without changing a rack's
+// shards-plus-free-slots, so the cap holds for the whole cross-rack phase.
+// Under SameRackCount a node's free slots count only up to the shards of the
+// volume it may still take, the limit pickBestNodeForVolume enforces.
+func planRackTotalCap(vk volKey, racks map[string]*rack, rackShardCount map[string]int, totalShards int, rp *super_block.ReplicaPlacement) int {
+	room := make(map[string]int, len(racks))
+	for rk, r := range racks {
+		room[rk] = rackShardCount[rk]
+		if rp == nil || rp.SameRackCount <= 0 {
+			room[rk] += max(r.freeSlots, 0)
+			continue
+		}
+		for _, n := range r.nodes {
+			room[rk] += min(n.receiveSlots(), max(rp.SameRackCount-volumeShardCount(n, vk), 0))
+		}
+	}
+	return rackTotalCap(sortedKeys(racks), nil, room, totalShards)
+}
+
+// balanceShardTypeAcrossRacks spreads one shard type across racks, at most
+// maxPerRack of the type per rack. A totalCap > 0 also bounds each rack's TOTAL
+// shards of the volume: racks above it shed this type, and no move lands on a
+// rack at it. Shards in moved stay put; the ones it moves are added to it.
+func balanceShardTypeAcrossRacks(vk volKey, nodes map[string]*Node, racks map[string]*rack, diskType string, dataShards int, shardsPerRack map[string][]int, rackShardCount map[string]int, maxPerRack, totalCap int, antiAffinity map[string]bool, rp *super_block.ReplicaPlacement, moved map[int]bool) []*move {
 	if maxPerRack < 1 {
 		maxPerRack = 1
 	}
 	rackKeys := sortedKeys(racks)
 
 	type pending struct {
-		shardID int
-		src     *Node
+		shardID       int
+		src           *Node
+		avoidDataRack bool
 	}
 	var toMove []pending
 	for _, rackID := range rackKeys {
 		shards := append([]int(nil), shardsPerRack[rackID]...)
-		if len(shards) <= maxPerRack {
-			continue
+		// Shards this plan already moved go last, so the shed takes the others.
+		sort.Slice(shards, func(i, j int) bool {
+			if moved[shards[i]] != moved[shards[j]] {
+				return !moved[shards[i]]
+			}
+			return shards[i] < shards[j]
+		})
+		overflow := max(0, len(shards)-maxPerRack)
+		if totalCap > 0 {
+			// A rack above the total cap sheds this type until it fits, even
+			// when the type is within its own cap there.
+			overflow = max(overflow, min(len(shards), rackShardCount[rackID]-totalCap))
 		}
-		sort.Ints(shards)
-		for i := 0; i < len(shards)-maxPerRack; i++ {
+		for i := 0; i < len(shards); i++ {
+			// A parity shard can fit the per-type cap yet share a rack with
+			// data while a data-free rack is empty; such candidates may only
+			// move to a rack without data.
+			avoidDataRack := i >= overflow
+			if moved[shards[i]] || (avoidDataRack && !antiAffinity[rackID]) {
+				continue
+			}
 			if src := nodeInRackHoldingShard(nodes, rackID, vk, shards[i]); src != nil {
-				toMove = append(toMove, pending{shards[i], src})
+				toMove = append(toMove, pending{shards[i], src, avoidDataRack})
 			}
 		}
 	}
 
+	withinLimit := func(r string) bool {
+		if totalCap > 0 && rackShardCount[r] >= totalCap {
+			return false
+		}
+		if rp != nil && rp.DiffRackCount > 0 && rackShardCount[r] >= rp.DiffRackCount {
+			return false
+		}
+		return true
+	}
+
 	var moves []*move
 	for _, pm := range toMove {
-		destRack, ok := pickTarget(rackKeys, shardsPerRack, maxPerRack, antiAffinity,
-			func(r string) bool { return racks[r].freeSlots > 0 },
-			func(r string) bool {
-				if rp == nil {
-					return true
-				}
-				if rp.DiffRackCount > 0 && rackShardCount[r] >= rp.DiffRackCount {
-					return false
-				}
-				return true
-			})
+		hasRoom := func(r string) bool {
+			return r != pm.src.rack && rackFreeForType(racks[r], diskType) > 0 &&
+				(!pm.avoidDataRack || !antiAffinity[r])
+		}
+		rackFree := func(r string) int { return rackFreeForType(racks[r], diskType) }
+		destRack, ok := pickTarget(rackKeys, shardsPerRack, maxPerRack, antiAffinity, hasRoom, withinLimit, rackFree)
+		if !ok && totalCap > 0 && rackShardCount[pm.src.rack] > totalCap {
+			// No rack is under the per-type cap. A shard must not stay on a rack
+			// above the total cap while another rack is under it, so relax the
+			// per-type cap up to the total cap; anti-affinity stays a preference
+			// inside pickTarget. Only a source above the total cap may relax:
+			// otherwise the destination just takes over the per-type overflow
+			// and the next Plan moves it back.
+			destRack, ok = pickTarget(rackKeys, shardsPerRack, totalCap, antiAffinity, hasRoom, withinLimit, rackFree)
+		}
 		if !ok {
 			continue
 		}
-		destNode := pickNodeInRack(racks[destRack], vk, rp)
+		destNode := pickNodeInRack(racks[destRack], vk, rp, diskType)
 		if destNode == nil {
 			continue
 		}
@@ -438,29 +587,85 @@ func balanceShardTypeAcrossRacks(vk volKey, nodes map[string]*Node, racks map[st
 		// limited-capacity destination across successive moves.
 		destNode.freeSlots--
 		pm.src.freeSlots++
+		moved[pm.shardID] = true
 	}
 	return moves
 }
 
-func pickNodeInRack(r *rack, vk volKey, rp *super_block.ReplicaPlacement) *Node {
-	return pickBestNodeForVolume(sortedNodeSlice(r.nodes), vk, rp)
+func pickNodeInRack(r *rack, vk volKey, rp *super_block.ReplicaPlacement, diskType string) *Node {
+	return pickBestNodeForVolumeOnDisk(sortedNodeSlice(r.nodes), vk, rp, diskType)
 }
 
-// pickBestNodeForVolume returns the node with the fewest shards of the volume that
-// has a free slot and is under the SameRackCount cap, or nil.
+// pickBestNodeForVolumeOnDisk is pickBestNodeForVolume restricted to nodes with
+// free capacity on a disk of diskType, so the pick cannot land on a node whose
+// room sits on another type.
+func pickBestNodeForVolumeOnDisk(nodes []*Node, vk volKey, rp *super_block.ReplicaPlacement, diskType string) *Node {
+	eligible := make([]*Node, 0, len(nodes))
+	for _, node := range nodes {
+		if freeSlotsForType(node, diskType) > 0 {
+			eligible = append(eligible, node)
+		}
+	}
+	return pickBestNodeForVolume(eligible, vk, rp)
+}
+
+// freeSlotsForType is the node's free EC slots usable by diskType. Per-disk
+// metadata is authoritative when present; without it the node's aggregate
+// stands in so the volume server's own disk selection can place the shard.
+func freeSlotsForType(n *Node, diskType string) int {
+	if n.noReceive {
+		return 0
+	}
+	if len(n.disks) == 0 {
+		return n.freeSlots
+	}
+	free := 0
+	for _, d := range n.disks {
+		if d.freeSlots > 0 && !d.noReceive && (diskType == "" || d.diskType == diskType) {
+			free += d.freeSlots
+		}
+	}
+	return free
+}
+
+func rackFreeForType(r *rack, diskType string) int {
+	free := 0
+	for _, n := range r.nodes {
+		free += freeSlotsForType(n, diskType)
+	}
+	return free
+}
+
+// pickBestNodeForVolume spreads this volume evenly first. Remainders: higher
+// freeSlots, then lower liveShards+assignedThisPlace. SameRackCount is a hard
+// cap (no +1 for debt).
 func pickBestNodeForVolume(nodes []*Node, vk volKey, rp *super_block.ReplicaPlacement) *Node {
 	var best *Node
 	bestCount := -1
+	bestFree := -1
+	bestScore := -1
 	for _, node := range nodes {
-		if node.freeSlots <= 0 {
+		if node.receiveSlots() <= 0 {
 			continue
 		}
 		count := volumeShardCount(node, vk)
 		if rp != nil && rp.SameRackCount > 0 && count >= rp.SameRackCount {
 			continue
 		}
-		if best == nil || count < bestCount {
-			best, bestCount = node, count
+		score := nodeLiveShardCount(node)
+		better := false
+		switch {
+		case best == nil:
+			better = true
+		case count != bestCount:
+			better = count < bestCount
+		case node.freeSlots != bestFree:
+			better = node.freeSlots > bestFree
+		default:
+			better = score < bestScore
+		}
+		if better {
+			best, bestCount, bestFree, bestScore = node, count, node.freeSlots, score
 		}
 	}
 	return best
@@ -551,12 +756,21 @@ func withinRackMachineSpread(vk volKey, r *rack, machines map[string][]*Node, di
 		// shard (free slot, under SameRackCount), so a capped machine is skipped
 		// rather than settled on and the move dropped.
 		destHost, ok := pickTarget(machineKeys, shardsPerMachine, maxPerMachine, nil,
-			func(h string) bool { return h != pm.src.host && pickBestNodeForVolume(machines[h], vk, rp) != nil },
-			func(string) bool { return true })
+			func(h string) bool {
+				return h != pm.src.host && pickBestNodeForVolumeOnDisk(machines[h], vk, rp, diskType) != nil
+			},
+			func(string) bool { return true },
+			func(h string) int {
+				n := 0
+				for _, node := range machines[h] {
+					n += freeSlotsForType(node, diskType)
+				}
+				return n
+			})
 		if !ok {
 			continue
 		}
-		destNode := pickBestNodeForVolume(machines[destHost], vk, rp)
+		destNode := pickBestNodeForVolumeOnDisk(machines[destHost], vk, rp, diskType)
 		if destNode == nil {
 			continue
 		}
@@ -638,13 +852,14 @@ func balanceShardTypeAcrossNodes(vk volKey, r *rack, diskType string, dataShards
 	var moves []*move
 	for _, pm := range toMove {
 		destID, ok := pickTarget(nodeKeys, shardsPerNode, maxPerNode, antiAffinity,
-			func(n string) bool { return n != pm.src.id && r.nodes[n].freeSlots > 0 },
+			func(n string) bool { return n != pm.src.id && freeSlotsForType(r.nodes[n], diskType) > 0 },
 			func(n string) bool {
 				if rp != nil && rp.SameRackCount > 0 {
 					return nodeShardCount[n] < rp.SameRackCount
 				}
 				return true
-			})
+			},
+			func(n string) int { return freeSlotsForType(r.nodes[n], diskType) })
 		if !ok {
 			continue
 		}
@@ -735,7 +950,7 @@ func detectGlobalImbalance(nodes map[string]*Node, racks map[string]*rack, diskT
 					continue
 				}
 				util := float64(count) / float64(capacity)
-				if util < minUtil && node.freeSlots > 0 {
+				if util < minUtil && node.receiveSlots() > 0 {
 					minUtil, minCount, minNode = util, count, node
 				}
 				if util > maxUtil {
@@ -856,12 +1071,17 @@ func shardsByGroup(vk volKey, nodes map[string]*Node, dataShards int, key func(*
 
 // pickTarget selects a destination key with room for another shard of a type, in
 // two passes: first excluding anti-affinity targets, then any valid target. Among
-// valid targets it prefers the fewest shards of this type; ties break on sorted
-// key order, so selection is deterministic.
-func pickTarget(candidates []string, shardsPerTarget map[string][]int, maxPerTarget int, antiAffinity map[string]bool, hasFreeSlots, withinLimit func(string) bool) (string, bool) {
+// valid targets it prefers the fewest shards of this type (even spread). Count
+// ties break on remaining freeSlots, not sorted key order: otherwise 14/4
+// leftovers always land on the first rack/machine/node ids and the extra shards
+// of 4+4+3+3 never walk. Equal freeSlots still keep the first seen key so a
+// single run stays deterministic. Node-in-rack Place remainders (after even) are
+// freeSlots then liveShards — see pickNodeInRackEligible.
+func pickTarget(candidates []string, shardsPerTarget map[string][]int, maxPerTarget int, antiAffinity map[string]bool, hasFreeSlots, withinLimit func(string) bool, freeSlots func(string) int) (string, bool) {
 	try := func(skipAnti bool) (string, bool) {
 		best := ""
 		bestCount := maxPerTarget + 1
+		bestFree := -1
 		for _, c := range candidates {
 			if skipAnti && antiAffinity[c] {
 				continue
@@ -875,8 +1095,13 @@ func pickTarget(candidates []string, shardsPerTarget map[string][]int, maxPerTar
 			if !withinLimit(c) {
 				continue
 			}
-			if cnt := len(shardsPerTarget[c]); cnt < bestCount {
-				best, bestCount = c, cnt
+			cnt := len(shardsPerTarget[c])
+			free := 0
+			if freeSlots != nil {
+				free = freeSlots(c)
+			}
+			if best == "" || cnt < bestCount || (cnt == bestCount && free > bestFree) {
+				best, bestCount, bestFree = c, cnt, free
 			}
 		}
 		return best, best != ""
@@ -907,7 +1132,7 @@ func pickBestDiskOnNode(node *Node, vk volKey, diskType string, shardID, dataSha
 		if diskType != "" && d.diskType != diskType {
 			continue
 		}
-		if d.freeSlots <= 0 {
+		if d.freeSlots <= 0 || d.noReceive {
 			continue
 		}
 
@@ -1058,6 +1283,20 @@ func volumeShardCount(node *Node, vk volKey) int {
 	return 0
 }
 
+// nodeLiveShardCount is the disk-level EC shard cardinality (master EcShards),
+// not the UI "EC volumes" count (len of the volume map). Place uses it as the
+// remainder after even-this-volume and freeSlots (with deadband).
+func nodeLiveShardCount(n *Node) int {
+	if n == nil {
+		return 0
+	}
+	total := 0
+	for _, d := range n.disks {
+		total += d.shardCount
+	}
+	return total
+}
+
 func nodeInRackHoldingShard(nodes map[string]*Node, rackID string, vk volKey, shardID int) *Node {
 	var inRack []*Node
 	for _, id := range sortedNodeKeys(nodes) {
diff --git a/weed/storage/erasure_coding/ecbalancer/balancer_rack_cap_test.go b/weed/storage/erasure_coding/ecbalancer/balancer_rack_cap_test.go
new file mode 100644
index 0000000000..b83a616ddb
--- /dev/null
+++ b/weed/storage/erasure_coding/ecbalancer/balancer_rack_cap_test.go
@@ -0,0 +1,314 @@
+package ecbalancer
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+)
+
+// Total-shards-per-rack cap for Plan.
+//
+// The per-type caps (ceil(data/racks) data, ceil(parity/racks) parity) spread
+// each type evenly on their own, but together they allow e.g. 2 data + 1 parity
+// on one rack. When a rack is one physical disk, losing two such racks loses 6
+// of a 10+4 volume's shards. Plan also caps the TOTAL per rack, sized like
+// Place's rackTotalCap: ceil(shards/racks) unless the racks' capacity forces it
+// higher.
+
+const capTestVid = uint32(1)
+
+var capTestVk = volKey{collection: "c1", vid: capTestVid}
+
+// rackCapThresholds are the imbalance thresholds of the shell (0) and the
+// worker's default (0.2); both reach Plan.
+var rackCapThresholds = []float64{0, 0.2}
+
+// addCapNode adds a node with one disk of `free` slots, before its shards.
+func addCapNode(topo *Topology, id, rackKey string, free int) *Node {
+	n := topo.AddNode(id, "dc1", rackKey, free)
+	n.AddDisk(0, "", free, 0)
+	return n
+}
+
+// putShards places the volume's shards on the node's disk 0 and takes their slots.
+func putShards(n *Node, ids ...int) {
+	n.AddShards(capTestVid, "c1", 0, bits(ids...))
+	n.freeSlots -= len(ids)
+	n.disks[0].freeSlots -= len(ids)
+	n.disks[0].shardCount += len(ids)
+}
+
+func shardTotalsPerRack(topo *Topology) map[string]int {
+	totals := map[string]int{}
+	for _, n := range topo.nodes {
+		totals[n.rack] += volumeShardCount(n, capTestVk)
+	}
+	return totals
+}
+
+// planAndCheckRackTotals runs Plan, then checks every shard is still placed,
+// that no rack holds more than maxPerRack, and that a second Plan is a no-op.
+func planAndCheckRackTotals(t *testing.T, topo *Topology, opts Options, maxPerRack int) {
+	t.Helper()
+	Plan(topo, opts)
+	totals := shardTotalsPerRack(topo)
+	t.Logf("total shards per rack: %v", totals)
+	sum := 0
+	for rk, n := range totals {
+		sum += n
+		if n > maxPerRack {
+			t.Errorf("rack %s holds %d shards, want at most %d", rk, n, maxPerRack)
+		}
+	}
+	if sum != erasure_coding.TotalShardsCount {
+		t.Errorf("%d shards placed, want %d", sum, erasure_coding.TotalShardsCount)
+	}
+	if again := Plan(topo, opts); len(again) != 0 {
+		t.Errorf("second Plan is not a no-op: %+v", again)
+	}
+}
+
+// raisedCaps records Options.RackTotalCapRaised reports.
+type raisedCaps []string
+
+func (r *raisedCaps) record(collection string, vid uint32, rackCap, evenCap int) {
+	*r = append(*r, fmt.Sprintf("%s/%d cap=%d even=%d", collection, vid, rackCap, evenCap))
+}
+
+func forEachThreshold(t *testing.T, run func(t *testing.T, threshold float64)) {
+	for _, th := range rackCapThresholds {
+		t.Run(fmt.Sprintf("threshold=%v", th), func(t *testing.T) { run(t, th) })
+	}
+}
+
+// TestPlanTotalShardsPerRackCap: 10+4 encoded onto one of 8 racks spreads to at
+// most ceil(14/8) = 2 shards per rack, not 2 data + 1 parity.
+func TestPlanTotalShardsPerRackCap(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		putShards(addCapNode(topo, "n1", "dc1:rack1", 100), 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
+		for r := 2; r <= 8; r++ {
+			addCapNode(topo, fmt.Sprintf("n%d", r), fmt.Sprintf("dc1:rack%d", r), 100)
+		}
+		planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4)}, 2)
+	})
+}
+
+// TestPlanTotalShardsPerRackCapTwoNodesPerRack: the cap is per rack, not per
+// node, so two volume servers sharing a rack (one physical disk) hold at most 2
+// between them.
+func TestPlanTotalShardsPerRackCapTwoNodesPerRack(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		for r := 1; r <= 8; r++ {
+			for i := 0; i < 2; i++ {
+				n := addCapNode(topo, fmt.Sprintf("n%d-%d", r, i), fmt.Sprintf("dc1:rack%d", r), 100)
+				if r == 1 && i == 0 {
+					putShards(n, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
+				}
+			}
+		}
+		planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4)}, 2)
+	})
+}
+
+// TestPlanTotalCapFromClumpedStart: data 2,2,2,2,2,0,0,0 with all parity on
+// rack1. Racks 6-8 take one parity each, after which no rack is under the parity
+// cap of 1; the last parity must still leave rack1 (2 data + 1 parity) for a
+// data-bearing rack under the total cap rather than stay put.
+func TestPlanTotalCapFromClumpedStart(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		layout := [][]int{{0, 1, 10, 11, 12, 13}, {2, 3}, {4, 5}, {6, 7}, {8, 9}, nil, nil, nil}
+		for r, ids := range layout {
+			n := addCapNode(topo, fmt.Sprintf("n%d", r+1), fmt.Sprintf("dc1:rack%d", r+1), 100)
+			if len(ids) > 0 {
+				putShards(n, ids...)
+			}
+		}
+		planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4)}, 2)
+	})
+}
+
+// TestPlanTotalCapAllRacksBearData: every rack holds data, so parity has to
+// share a rack with data. Anti-affinity stays a preference and the plan still
+// reaches at most 2 per rack.
+func TestPlanTotalCapAllRacksBearData(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		layout := [][]int{{0, 1, 10, 11, 12, 13}, {2, 3}, {4}, {5}, {6}, {7}, {8}, {9}}
+		for r, ids := range layout {
+			putShards(addCapNode(topo, fmt.Sprintf("n%d", r+1), fmt.Sprintf("dc1:rack%d", r+1), 100), ids...)
+		}
+		planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4)}, 2)
+	})
+}
+
+// TestPlanTotalCapParityOnDataRacks: each type is within its own cap (2 data,
+// 1 parity per rack) yet four racks hold 3. The non-overflow parity shards that
+// may only move to a data-free rack find just two of those; the over-cap ones
+// that remain must go to a data-bearing rack under the total cap.
+func TestPlanTotalCapParityOnDataRacks(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		layout := [][]int{{0, 1, 10}, {2, 3, 11}, {4, 5, 12}, {6, 7, 13}, {8}, {9}, nil, nil}
+		for r, ids := range layout {
+			n := addCapNode(topo, fmt.Sprintf("n%d", r+1), fmt.Sprintf("dc1:rack%d", r+1), 100)
+			if len(ids) > 0 {
+				putShards(n, ids...)
+			}
+		}
+		planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4)}, 2)
+	})
+}
+
+// TestPlanTotalCapIgnoresImbalanceThreshold: a rack above the total cap is a
+// durability problem, so a threshold high enough to pass both per-type checks
+// must not stop Plan from fixing it.
+func TestPlanTotalCapIgnoresImbalanceThreshold(t *testing.T) {
+	topo := NewTopology()
+	layout := [][]int{{0, 1, 10}, {2, 3, 11}, {4, 5}, {6, 7}, {8}, {9}, {12}, {13}}
+	for r, ids := range layout {
+		putShards(addCapNode(topo, fmt.Sprintf("n%d", r+1), fmt.Sprintf("dc1:rack%d", r+1), 100), ids...)
+	}
+	planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: 100, Ratio: ratio(10, 4)}, 2)
+}
+
+// TestPlanTotalCapWithNearlyFullRack: 8 racks of two volume servers each, plus
+// a small, nearly full SSD rack already holding one shard. The SSD rack's lack
+// of room must not raise the cap above ceil(14/9) = 2 for the HDD racks. The
+// start is the layout Place produced before it capped the total per rack.
+func TestPlanTotalCapWithNearlyFullRack(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		layout := [][]int{{0, 1, 10}, {2, 3, 11}, {4, 5}, {6, 7}, {8}, {9}, {12}, nil}
+		for r, ids := range layout {
+			for i := 0; i < 2; i++ {
+				n := addCapNode(topo, fmt.Sprintf("n%d-%d", r, i), fmt.Sprintf("dc1:hdd%d", r), 100)
+				if i == 0 && len(ids) > 0 {
+					putShards(n, ids...)
+				}
+			}
+		}
+		putShards(addCapNode(topo, "nvme", "dc1:ssd", 2), 13)
+		var raised raisedCaps
+		planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4), RackTotalCapRaised: raised.record}, 2)
+		if len(raised) != 0 {
+			t.Errorf("cap reported as raised: %v", raised)
+		}
+	})
+}
+
+// TestPlanTotalCapRisesWhenRacksAreFull: two of 8 racks are full, so the other
+// six can hold at best 3 each. A cap fixed at ceil(14/8) = 2 would block every
+// destination and leave all four parity shards on rack1; the capacity-sized cap
+// of 3 lets them spread as far as the room allows.
+func TestPlanTotalCapRisesWhenRacksAreFull(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		layout := [][]int{{10, 11, 12, 13}, {0, 1}, {2, 3}, {4, 5}, {6, 7}, {8, 9}}
+		for r, ids := range layout {
+			putShards(addCapNode(topo, fmt.Sprintf("n%d", r+1), fmt.Sprintf("dc1:rack%d", r+1), 100), ids...)
+		}
+		addCapNode(topo, "full7", "dc1:rack7", 0)
+		addCapNode(topo, "full8", "dc1:rack8", 0)
+		var raised raisedCaps
+		planAndCheckRackTotals(t, topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4), RackTotalCapRaised: raised.record}, 3)
+		// Reported on every Plan (two here) while the cap stays raised.
+		want := "c1/1 cap=3 even=2"
+		if len(raised) != 2 || raised[0] != want || raised[1] != want {
+			t.Errorf("raised-cap reports = %v, want [%s %s]", raised, want, want)
+		}
+	})
+}
+
+// TestPlanRackTotalCap: Plan may move every shard, so shards already on a rack
+// count as room there, not as held in place. All 14 on one rack still gives 2.
+func TestPlanRackTotalCap(t *testing.T) {
+	build := func(free []int, held map[int]int) (map[string]*rack, map[string]int) {
+		topo := NewTopology()
+		next := 0
+		for r, f := range free {
+			n := addCapNode(topo, fmt.Sprintf("n%d", r), fmt.Sprintf("dc1:rack%d", r), f)
+			for i := 0; i < held[r]; i++ {
+				n.AddShards(capTestVid, "c1", 0, bits(next))
+				next++
+			}
+		}
+		return buildRacks(topo.nodes), countShardsByRack(capTestVk, topo.nodes)
+	}
+	cases := []struct {
+		name string
+		free []int
+		held map[int]int
+		want int
+	}{
+		{name: "all on one rack", free: []int{0, 50, 50, 50, 50, 50, 50, 50}, held: map[int]int{0: 14}, want: 2},
+		{name: "even over 5", free: []int{50, 50, 50, 50, 50}, held: map[int]int{0: 14}, want: 3},
+		{name: "two full empty racks", free: []int{50, 50, 50, 50, 50, 50, 0, 0}, held: map[int]int{0: 14}, want: 3},
+		{name: "small nearly full ninth rack", free: []int{50, 50, 50, 50, 50, 50, 50, 50, 1}, held: map[int]int{0: 13, 8: 1}, want: 2},
+		{name: "only the holding rack has room", free: []int{0, 0}, held: map[int]int{0: 14}, want: 14},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			racks, held := build(tc.free, tc.held)
+			if got := planRackTotalCap(capTestVk, racks, held, erasure_coding.TotalShardsCount, nil); got != tc.want {
+				t.Errorf("planRackTotalCap = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
+
+// TestPlanTotalCapDataRackWaitsForParitySlot: the data pass runs out of
+// destinations, and the only slots left for rack5's surplus data open up when
+// the parity pass moves parity off rack3 and rack4. One Plan must still bring
+// every rack within the cap (3), using those freed slots, without moving any
+// shard twice.
+func TestPlanTotalCapDataRackWaitsForParitySlot(t *testing.T) {
+	forEachThreshold(t, func(t *testing.T, th float64) {
+		topo := NewTopology()
+		layout := [][]int{{0, 1, 2}, {3, 4}, {10, 11}, {12}, {5, 6, 7, 8, 9, 13}}
+		free := []int{0, 4, 1, 1, 4}
+		for r, ids := range layout {
+			n := addCapNode(topo, fmt.Sprintf("n%d", r+1), fmt.Sprintf("dc1:rack%d", r+1), free[r]+len(ids))
+			putShards(n, ids...)
+		}
+		moves := Plan(topo, Options{ImbalanceThreshold: th, Ratio: ratio(10, 4)})
+		seen := map[int]bool{}
+		for _, m := range moves {
+			if seen[m.ShardID] {
+				t.Errorf("shard %d moved twice in one plan: %+v", m.ShardID, moves)
+			}
+			seen[m.ShardID] = true
+		}
+		totals := shardTotalsPerRack(topo)
+		t.Logf("total shards per rack: %v", totals)
+		for rk, n := range totals {
+			if n > 3 {
+				t.Errorf("rack %s holds %d shards, want at most 3", rk, n)
+			}
+		}
+	})
+}
+
+// TestPlanTotalCapCountsSameRackCount: with SameRackCount=1 a node takes at
+// most one shard of the volume, so racks of one node that already hold a shard
+// have no room however many free slots they report. Rack A's seven shards can't
+// spread, the cap is 7, and Plan reports it as raised.
+func TestPlanTotalCapCountsSameRackCount(t *testing.T) {
+	topo := NewTopology()
+	for i := 0; i < 7; i++ {
+		putShards(addCapNode(topo, fmt.Sprintf("a%d", i), "dc1:rackA", 100), i)
+	}
+	for i, rk := range []string{"B", "C", "D", "E", "F", "G", "H"} {
+		putShards(addCapNode(topo, "n"+rk, "dc1:rack"+rk, 100), 7+i)
+	}
+	var raised raisedCaps
+	rp := &super_block.ReplicaPlacement{SameRackCount: 1}
+	Plan(topo, Options{ReplicaPlacement: rp, Ratio: ratio(10, 4), RackTotalCapRaised: raised.record})
+	if want := "c1/1 cap=7 even=2"; len(raised) != 1 || raised[0] != want {
+		t.Errorf("raised-cap reports = %v, want [%s]", raised, want)
+	}
+}
diff --git a/weed/storage/erasure_coding/ecbalancer/balancer_test.go b/weed/storage/erasure_coding/ecbalancer/balancer_test.go
index a7ffee955b..0bb2ddc95f 100644
--- a/weed/storage/erasure_coding/ecbalancer/balancer_test.go
+++ b/weed/storage/erasure_coding/ecbalancer/balancer_test.go
@@ -90,6 +90,71 @@ func TestPickBestDiskOnNode(t *testing.T) {
 	})
 }
 
+func TestPickBestNodeForVolume(t *testing.T) {
+	const vid = uint32(100)
+	vk := volKey{collection: "c", vid: vid}
+
+	t.Run("more free slots wins the count tie", func(t *testing.T) {
+		topo := NewTopology()
+		thin := topo.AddNode("n1", "dc1", "dc1:r1", 5)
+		thin.AddDisk(1, "", 5, 0)
+		fat := topo.AddNode("n2", "dc1", "dc1:r1", 50)
+		fat.AddDisk(1, "", 50, 0)
+		if got := pickBestNodeForVolume([]*Node{thin, fat}, vk, nil); got != fat {
+			t.Errorf("got %v, want n2 (more free slots)", got.id)
+		}
+	})
+
+	t.Run("fewer live shards wins the free tie", func(t *testing.T) {
+		topo := NewTopology()
+		idle := topo.AddNode("n1", "dc1", "dc1:r1", 10)
+		idle.AddDisk(1, "", 10, 0)
+		busy := topo.AddNode("n2", "dc1", "dc1:r1", 10)
+		busy.AddDisk(1, "", 10, 9)
+		if got := pickBestNodeForVolume([]*Node{busy, idle}, vk, nil); got != idle {
+			t.Errorf("got %v, want n1 (fewer live shards)", got.id)
+		}
+	})
+
+	t.Run("volume spread beats free slots", func(t *testing.T) {
+		topo := NewTopology()
+		holding := topo.AddNode("n1", "dc1", "dc1:r1", 100)
+		holding.AddDisk(1, "", 100, 1)
+		holding.AddShards(vid, "c", 1, bits(0))
+		empty := topo.AddNode("n2", "dc1", "dc1:r1", 1)
+		empty.AddDisk(1, "", 1, 0)
+		if got := pickBestNodeForVolume([]*Node{holding, empty}, vk, nil); got != empty {
+			t.Errorf("got %v, want n2 (volume spread first)", got.id)
+		}
+	})
+}
+
+func TestPlanSkipsDestinationsWithoutMatchingDiskType(t *testing.T) {
+	topo := NewTopology()
+	src := topo.AddNode("node1", "dc1", "dc1:rack1", 0)
+	src.AddDisk(0, "ssd", 0, 14)
+	src.AddShards(100, "col1", 0, bits(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13))
+	// Aggregate capacity alone would make the hdd-only node look like the
+	// roomiest destination; none of its slots can take an ssd shard.
+	wrong := topo.AddNode("node2", "dc1", "dc1:rack2", 600)
+	wrong.AddDisk(1, "hdd", 600, 0)
+	right := topo.AddNode("node3", "dc1", "dc1:rack3", 600)
+	right.AddDisk(1, "ssd", 600, 0)
+
+	moves := Plan(topo, Options{ImbalanceThreshold: 0.01, DiskType: "ssd", Ratio: ratio(10, 4)})
+	if len(moves) == 0 {
+		t.Fatal("expected moves")
+	}
+	for _, m := range moves {
+		if m.TargetNode == wrong.id {
+			t.Errorf("shard %d targeted the hdd-only node", m.ShardID)
+		}
+		if m.TargetNode == right.id && m.TargetDisk != 1 {
+			t.Errorf("shard %d landed on disk %d, want 1", m.ShardID, m.TargetDisk)
+		}
+	}
+}
+
 func TestPlanSourceDiskAttribution(t *testing.T) {
 	shardsByDisk := map[uint32][]int{0: {0, 1, 2}, 1: {3, 4, 5}, 2: {6, 7}, 3: {8, 9}, 4: {10, 11}, 5: {12, 13}}
 	shardToDisk := map[int]uint32{}
@@ -861,3 +926,67 @@ func TestGlobalPrefersVolumeAbsentFromDestinationMachine(t *testing.T) {
 		t.Errorf("first global move is volume %d, want 200 (vol100 already on the destination machine)", moves[0].volumeID)
 	}
 }
+
+// TestNoReceiveNodeNeverTargeted: a node that refused a copy ("no space left")
+// must not be picked as a destination no matter how many free slots it reports,
+// but it still sheds its own over-cap shards as a source.
+func TestNoReceiveNodeNeverTargeted(t *testing.T) {
+	const vid = uint32(1)
+	topo := NewTopology()
+	src := topo.AddNode("n1", "dc1", "dc1:r1", 50)
+	src.AddShards(vid, "c", 0, bits(0, 1, 2, 3, 4, 5, 6, 7, 8, 9))
+	full := topo.AddNode("n2", "dc1", "dc1:r1", 50)
+	full.AddShards(vid, "c", 0, bits(10, 11, 12, 13)) // all parity, over the 2/node cap
+	full.SetNoReceive()
+	topo.AddNode("n3", "dc1", "dc1:r1", 50)
+
+	moves := Plan(topo, Options{Ratio: ratio(10, 4)})
+	if len(moves) == 0 {
+		t.Fatal("expected moves off the over-cap nodes")
+	}
+	shed := false
+	for _, m := range moves {
+		if m.TargetNode == "n2" {
+			t.Fatalf("move targets the refusing node: %+v", m)
+		}
+		if m.SourceNode == "n2" {
+			shed = true
+		}
+	}
+	if !shed {
+		t.Error("the refusing node should still shed its over-cap shards as a source")
+	}
+}
+
+// TestNoReceiveDiskLeavesSiblingsEligible: an explicit-disk refusal marks only
+// that disk, not the node — the planner may still target the node's other
+// disks, but never the refused one.
+func TestNoReceiveDiskLeavesSiblingsEligible(t *testing.T) {
+	const vid = uint32(1)
+	topo := NewTopology()
+	src := topo.AddNode("n1", "dc1", "dc1:r1", 50)
+	src.AddShards(vid, "c", 0, bits(0, 1, 2, 3, 4, 5, 6, 7, 8, 9))
+	n2 := topo.AddNode("n2", "dc1", "dc1:r1", 50)
+	// The refused disk scores better (empty); without the noReceive check the
+	// picker would choose it again.
+	n2.AddDisk(1, "hdd", 50, 0)
+	n2.AddDisk(2, "hdd", 50, 50)
+	n2.AddShards(vid, "c", 2, bits(10, 11, 12, 13))
+	n2.SetDiskNoReceive(1)
+	topo.AddNode("n3", "dc1", "dc1:r1", 50)
+
+	moves := Plan(topo, Options{Ratio: ratio(10, 4)})
+	targeted := false
+	for _, m := range moves {
+		if m.TargetNode != "n2" {
+			continue
+		}
+		targeted = true
+		if m.TargetDisk == 1 {
+			t.Fatalf("move targets the refused disk: %+v", m)
+		}
+	}
+	if !targeted {
+		t.Fatal("a node with one refused disk should still receive on its other disks")
+	}
+}
diff --git a/weed/storage/erasure_coding/ecbalancer/place.go b/weed/storage/erasure_coding/ecbalancer/place.go
index 84a43c6329..6ea7e84a72 100644
--- a/weed/storage/erasure_coding/ecbalancer/place.go
+++ b/weed/storage/erasure_coding/ecbalancer/place.go
@@ -2,6 +2,7 @@ package ecbalancer
 
 import (
 	"fmt"
+	"math"
 	"sort"
 	"strings"
 
@@ -28,6 +29,11 @@ type Constraints struct {
 	PreferredTags    []string
 	ReplicaPlacement *super_block.ReplicaPlacement
 	Ratio            func(collection string) (dataShards, parityShards int)
+	// FreeSlotsDeadband (M) is free volume slots. After even-this-volume,
+	// Place ranks that evenness class by maxFree, keeps |free−maxFree| ≤
+	// M×dataShards, then lower liveShards. 0 is only maxFree then live
+	// (old strict freeSlots; liveShards only on an exact free tie).
+	FreeSlotsDeadband int
 }
 
 // DiskTypePolicy controls how Constraints.DiskType constrains placement.
@@ -81,15 +87,17 @@ type PlaceResult struct {
 type PlacementMode int
 
 const (
-	// PlaceStrict: caps and ReplicaPlacement are hard. Place fails rather than
-	// violate them, so the caller can defer (leave the volume as-is and retry).
+	// PlaceStrict: caps, the total-shards-per-rack cap and ReplicaPlacement are
+	// hard. Place fails rather than violate them, so the caller can defer (leave
+	// the volume as-is and retry).
 	PlaceStrict PlacementMode = iota
 	// PlaceDurabilityFirst (used by both encode and repair): relax per-type caps ->
-	// data/parity anti-affinity -> ReplicaPlacement, in that order, until each shard
-	// lands, reporting what was relaxed in PlaceResult.Relaxed. The per-disk
-	// durability cap (<= parityShards per disk) is never relaxed. Fails only if no
-	// disk has free capacity. Encode places best-effort this way and rebalancing
-	// tightens the spread afterward.
+	// data/parity anti-affinity -> ReplicaPlacement -> the total-shards-per-rack
+	// cap, in that order, until each shard lands, reporting what was relaxed in
+	// PlaceResult.Relaxed. The per-disk durability cap (<= parityShards per disk)
+	// is never relaxed. Fails only if no eligible disk has room for another shard
+	// of the volume. Encode places best-effort this way and rebalancing tightens
+	// the spread afterward.
 	PlaceDurabilityFirst
 )
 
@@ -101,6 +109,7 @@ type relaxation struct {
 	caps         bool
 	antiAffinity bool
 	rp           bool
+	rackTotal    bool
 }
 
 func (r relaxation) relaxedNames() []string {
@@ -114,16 +123,23 @@ func (r relaxation) relaxedNames() []string {
 	if !r.rp {
 		n = append(n, "replica-placement")
 	}
+	if !r.rackTotal {
+		n = append(n, "rack-total-cap")
+	}
 	return n
 }
 
-var strictAttempts = []relaxation{{caps: true, antiAffinity: true, rp: true}}
+var strictAttempts = []relaxation{{caps: true, antiAffinity: true, rp: true, rackTotal: true}}
 
+// The total-shards-per-rack cap is sized from real capacity (see rackTotalCap),
+// so it is relaxed last and only as a safety net; with it dropped, the per-disk
+// cap is the only constraint left.
 var durabilityAttempts = []relaxation{
-	{caps: true, antiAffinity: true, rp: true},
-	{caps: false, antiAffinity: true, rp: true},
-	{caps: false, antiAffinity: false, rp: true},
-	{caps: false, antiAffinity: false, rp: false},
+	{caps: true, antiAffinity: true, rp: true, rackTotal: true},
+	{caps: false, antiAffinity: true, rp: true, rackTotal: true},
+	{caps: false, antiAffinity: false, rp: true, rackTotal: true},
+	{caps: false, antiAffinity: false, rp: false, rackTotal: true},
+	{caps: false, antiAffinity: false, rp: false, rackTotal: false},
 }
 
 type placedEntry struct {
@@ -183,7 +199,7 @@ func (t *Topology) Place(vid uint32, collection string, need []int, c Constraint
 		eligible := func(d *disk) bool {
 			return typeEligible(d) && (len(tt) == 0 || diskHasAnyTag(d, tt))
 		}
-		res, err := t.tryPlace(vk, need, dataShards, parityShards, racks, rackKeys, mode, c.ReplicaPlacement, eligible, prefer)
+		res, err := t.tryPlace(vk, need, dataShards, parityShards, racks, rackKeys, mode, c.ReplicaPlacement, eligible, prefer, volumeDeadbandToShardSlots(c.FreeSlotsDeadband, dataShards))
 		if err != nil {
 			lastErr = err
 			continue
@@ -213,7 +229,7 @@ func tagTiers(preferredTags []string) [][]string {
 // `eligible`, with `prefer` (may be nil) ranking soft-preferred disks first. It
 // journals reservations and rolls them all back if any shard cannot be placed, so
 // a failed tier leaves the snapshot unchanged for the next attempt.
-func (t *Topology) tryPlace(vk volKey, need []int, dataShards, parityShards int, racks map[string]*rack, rackKeys []string, mode PlacementMode, rp *super_block.ReplicaPlacement, eligible func(*disk) bool, prefer func(*disk) bool) (*PlaceResult, error) {
+func (t *Topology) tryPlace(vk volKey, need []int, dataShards, parityShards int, racks map[string]*rack, rackKeys []string, mode PlacementMode, rp *super_block.ReplicaPlacement, eligible func(*disk) bool, prefer func(*disk) bool, freeSlotsDeadband int) (*PlaceResult, error) {
 	result := &PlaceResult{Destinations: make(map[int]Destination, len(need))}
 
 	// Per-type shard ids per rack (even caps), total shard count per rack
@@ -236,12 +252,17 @@ func (t *Topology) tryPlace(vk volKey, need []int, dataShards, parityShards int,
 		}
 	}
 
-	// Even per-rack caps divide by racks that actually have an eligible free disk,
-	// not all racks (the snapshot keeps every disk type/tag), so a valid tiered
-	// cluster — e.g. SSDs in only 2 of 4 racks — is not capped impossibly low.
+	// Even per-rack caps divide by racks that can actually take another shard of
+	// the volume, not all racks (the snapshot keeps every disk type/tag), so a
+	// valid tiered cluster — e.g. SSDs in only 2 of 4 racks — is not capped
+	// impossibly low.
+	rackRoom := make(map[string]int, len(rackKeys))
+	rackRoomRP := make(map[string]int, len(rackKeys))
 	numEligibleRacks := 0
 	for _, rk := range rackKeys {
-		if rackHasFreeDisk(racks[rk], eligible) {
+		rackRoom[rk] = rackShardRoom(racks[rk], vk, eligible, parityShards)
+		rackRoomRP[rk] = rackShardRoomUnderRP(racks[rk], vk, eligible, parityShards, rp)
+		if rackRoom[rk] > 0 {
 			numEligibleRacks++
 		}
 	}
@@ -249,6 +270,24 @@ func (t *Topology) tryPlace(vk volKey, need []int, dataShards, parityShards int,
 		numEligibleRacks = 1
 	}
 
+	// The per-type caps spread data and parity independently, so together they
+	// can still stack e.g. 2 data + 1 parity on one rack. Cap the TOTAL per rack
+	// as well, at the lowest value the racks' free capacity allows. Attempts that
+	// enforce ReplicaPlacement size it from the room left under SameRackCount, so
+	// a rack of few nodes does not count disk room its nodes may not use.
+	totalShards := len(need)
+	for _, n := range rackShardCount {
+		totalShards += n
+	}
+	maxTotalPerRack := rackTotalCap(rackKeys, rackShardCount, rackRoom, totalShards)
+	maxTotalPerRackRP := rackTotalCap(rackKeys, rackShardCount, rackRoomRP, totalShards)
+	rackCap := func(rl relaxation) int {
+		if rl.rp {
+			return maxTotalPerRackRP
+		}
+		return maxTotalPerRack
+	}
+
 	attempts := strictAttempts
 	if mode == PlaceDurabilityFirst {
 		attempts = durabilityAttempts
@@ -264,7 +303,7 @@ func (t *Topology) tryPlace(vk volKey, need []int, dataShards, parityShards int,
 			typeTotal = parityShards
 		}
 		for _, rl := range attempts {
-			node, diskID, spilled, ok := chooseShardDest(vk, sid, isData, dataShards, typeTotal, numEligibleRacks, parityShards, racks, rackKeys, rp, eligible, prefer, shardsPerRack[isData], rackShardCount, bearing, rl)
+			node, diskID, spilled, ok := chooseShardDest(vk, sid, isData, dataShards, typeTotal, numEligibleRacks, parityShards, rackCap(rl), racks, rackKeys, rp, eligible, prefer, shardsPerRack[isData], rackShardCount, bearing, rl, freeSlotsDeadband)
 			if !ok {
 				continue
 			}
@@ -303,7 +342,7 @@ func (t *Topology) tryPlace(vk volKey, need []int, dataShards, parityShards int,
 				e.node.freeSlots++
 				racks[e.rackKey].freeSlots++
 			}
-			return nil, fmt.Errorf("cannot place EC shard %d of volume %d (collection %q)", sid, vk.vid, vk.collection)
+			return nil, fmt.Errorf("cannot place EC shard %d of volume %d (collection %q) (rack total cap %d, per-disk cap %d)", sid, vk.vid, vk.collection, rackCap(attempts[len(attempts)-1]), parityShards)
 		}
 	}
 
@@ -316,11 +355,14 @@ func (t *Topology) tryPlace(vk volKey, need []int, dataShards, parityShards int,
 }
 
 // chooseShardDest selects a (node, disk) for one shard at the given relaxation
-// level: pick a rack (even per-type cap + ReplicaPlacement caps + two-pass
-// anti-affinity to the opposite type), then the least-loaded eligible node, then
-// the best eligible disk. The third return reports whether the disk spilled off
-// the soft-preferred type. ok=false when no rack/node/disk fits.
-func chooseShardDest(vk volKey, sid int, isData bool, dataShards, typeTotal, numEligibleRacks, maxPerDisk int, racks map[string]*rack, rackKeys []string, rp *super_block.ReplicaPlacement, eligible func(*disk) bool, prefer func(*disk) bool, shardsPerRackType map[string][]int, rackShardCount map[string]int, bearing map[bool]map[string]bool, rl relaxation) (*Node, uint32, bool, bool) {
+// level: pick a rack (total-shards-per-rack cap + even per-type cap +
+// ReplicaPlacement caps + two-pass anti-affinity to the opposite type, then
+// freeSlots deadband / liveShards), then the least-loaded eligible node, then
+// the best eligible disk. If no node in the chosen rack fits (e.g. every node
+// is at SameRackCount), the next-best rack is tried. The third return reports
+// whether the disk spilled off the soft-preferred type. ok=false when no
+// rack/node/disk fits.
+func chooseShardDest(vk volKey, sid int, isData bool, dataShards, typeTotal, numEligibleRacks, maxPerDisk, maxTotalPerRack int, racks map[string]*rack, rackKeys []string, rp *super_block.ReplicaPlacement, eligible func(*disk) bool, prefer func(*disk) bool, shardsPerRackType map[string][]int, rackShardCount map[string]int, bearing map[bool]map[string]bool, rl relaxation, freeSlotsDeadband int) (*Node, uint32, bool, bool) {
 	maxPerRack := numEligibleRacks*typeTotal + 1 // effectively unlimited when caps are relaxed
 	if rl.caps {
 		if maxPerRack = ceilDivide(typeTotal, numEligibleRacks); maxPerRack < 1 {
@@ -336,101 +378,265 @@ func chooseShardDest(vk volKey, sid int, isData bool, dataShards, typeTotal, num
 	if !rl.rp {
 		rp = nil
 	}
-	// A rack is eligible only if it is under the per-rack shard cap (DiffRackCount),
-	// enforced only when set (and relaxed with rp).
+	// A rack is eligible only if it is under the total-shards-per-rack cap and,
+	// when set, the per-rack shard cap (DiffRackCount). The total cap does not
+	// depend on ReplicaPlacement, so it also holds when rp is nil.
 	withinLimit := func(r string) bool {
-		if rp == nil {
-			return true
+		if rl.rackTotal && rackShardCount[r] >= maxTotalPerRack {
+			return false
 		}
-		if rp.DiffRackCount > 0 && rackShardCount[r] >= rp.DiffRackCount {
+		if rp != nil && rp.DiffRackCount > 0 && rackShardCount[r] >= rp.DiffRackCount {
 			return false
 		}
 		return true
 	}
 
-	destRack, ok := pickTarget(rackKeys, shardsPerRackType, maxPerRack, anti,
-		func(r string) bool { return racks[r].freeSlots > 0 && rackHasFreeDisk(racks[r], eligible) },
-		withinLimit)
-	if !ok {
-		return nil, 0, false, false
+	tried := map[string]bool{}
+	hasRoom := func(r string) bool {
+		return !tried[r] && racks[r].freeSlots > 0 && rackShardRoom(racks[r], vk, eligible, maxPerDisk) > 0
 	}
-	node := pickNodeInRackEligible(racks[destRack], vk, rp, eligible)
-	if node == nil {
-		return nil, 0, false, false
-	}
-	diskID, ok, spilled := pickBestDiskEligible(node, vk, eligible, prefer, sid, dataShards, maxPerDisk)
-	if !ok {
-		return nil, 0, false, false
-	}
-	return node, diskID, spilled, true
-}
-
-// nodeHasFreeDisk reports whether the node has a free disk satisfying eligible.
-func nodeHasFreeDisk(n *Node, eligible func(*disk) bool) bool {
-	for _, d := range n.disks {
-		if d.freeSlots > 0 && eligible(d) {
-			return true
+	for {
+		destRack, ok := pickRackEligible(rackKeys, shardsPerRackType, maxPerRack, anti, hasRoom, withinLimit, racks, freeSlotsDeadband)
+		if !ok {
+			return nil, 0, false, false
 		}
-	}
-	return false
-}
-
-// rackHasFreeDisk reports whether any node in the rack has a free eligible disk.
-func rackHasFreeDisk(r *rack, eligible func(*disk) bool) bool {
-	for _, n := range r.nodes {
-		if n.freeSlots > 0 && nodeHasFreeDisk(n, eligible) {
-			return true
+		if node := pickNodeInRackEligible(racks[destRack], vk, rp, eligible, maxPerDisk, freeSlotsDeadband); node != nil {
+			if diskID, ok, spilled := pickBestDiskEligible(node, vk, eligible, prefer, sid, dataShards, maxPerDisk); ok {
+				return node, diskID, spilled, true
+			}
 		}
+		tried[destRack] = true
 	}
-	return false
 }
 
-// pickNodeInRackEligible is pickNodeInRack restricted to nodes that have a free
-// eligible disk. FromActiveTopology keeps all disk types/tags in the snapshot, so
-// without this a node with free volume slots but no eligible disk could be chosen.
+// rackTotalCap returns the smallest per-rack total c such that the racks can
+// hold totalShards shards of the volume with none above c, given each rack's
+// shards already placed (held) and its room for more. On a uniform cluster this
+// is ceil(totalShards/racks); a nearly full rack raises it just enough for the
+// other racks to absorb its share, so the cap alone never makes a feasible
+// placement fail.
 //
-// Among eligible nodes it ranks by fewest shards of the volume per machine, then per
-// node, with free capacity breaking ties. The free-capacity tie-break (not sorted id)
-// keeps the lowest-id machine from winning every volume's first shard against the
-// shared encode snapshot and piling up load.
-func pickNodeInRackEligible(r *rack, vk volKey, rp *super_block.ReplicaPlacement, eligible func(*disk) bool) *Node {
+// It is the most even spread the free capacity allows, not a durability
+// guarantee: losing k racks loses up to k*c shards, which the volume survives
+// only while k*c <= parityShards. With few racks no placement can achieve that.
+func rackTotalCap(rackKeys []string, held, room map[string]int, totalShards int) int {
+	for c := 1; c < totalShards; c++ {
+		fits := 0
+		for _, rk := range rackKeys {
+			fits += max(held[rk], min(c, held[rk]+room[rk]))
+		}
+		if fits >= totalShards {
+			return c
+		}
+	}
+	return totalShards
+}
+
+// diskShardRoom returns how many more shards of the volume the disk can take:
+// its free slots, bounded by the per-disk durability cap (maxPerDisk shards of
+// one volume per disk; <= 0 disables it).
+func diskShardRoom(n *Node, d *disk, vk volKey, maxPerDisk int) int {
+	if d.noReceive {
+		return 0
+	}
+	room := d.freeSlots
+	if maxPerDisk > 0 {
+		held := 0
+		if info := n.shards[vk]; info != nil {
+			held = info.diskShardBits[d.diskID].Count()
+		}
+		room = min(room, maxPerDisk-held)
+	}
+	return max(room, 0)
+}
+
+// nodeShardRoom returns how many more shards of the volume the node's eligible
+// disks can take, bounded by the node's free slots.
+func nodeShardRoom(n *Node, vk volKey, eligible func(*disk) bool, maxPerDisk int) int {
+	if n.noReceive {
+		return 0
+	}
+	room := 0
+	for _, d := range n.disks {
+		if eligible(d) {
+			room += diskShardRoom(n, d, vk, maxPerDisk)
+		}
+	}
+	return max(min(room, n.receiveSlots()), 0)
+}
+
+// rackShardRoom returns how many more shards of the volume the rack can take.
+func rackShardRoom(r *rack, vk volKey, eligible func(*disk) bool, maxPerDisk int) int {
+	room := 0
+	for _, n := range r.nodes {
+		room += nodeShardRoom(n, vk, eligible, maxPerDisk)
+	}
+	return room
+}
+
+// rackShardRoomUnderRP is rackShardRoom with each node further bounded by the
+// shards it may still take under ReplicaPlacement's SameRackCount (max shards of
+// the volume per node), which pickNodeInRackEligible enforces.
+func rackShardRoomUnderRP(r *rack, vk volKey, eligible func(*disk) bool, maxPerDisk int, rp *super_block.ReplicaPlacement) int {
+	if rp == nil || rp.SameRackCount <= 0 {
+		return rackShardRoom(r, vk, eligible, maxPerDisk)
+	}
+	room := 0
+	for _, n := range r.nodes {
+		room += min(nodeShardRoom(n, vk, eligible, maxPerDisk), max(rp.SameRackCount-volumeShardCount(n, vk), 0))
+	}
+	return room
+}
+
+// pickRackEligible is pickTarget for Place racks. Even this-type / cap /
+// two-pass anti-affinity stay. Among that evenness class the remainder is
+// max rack freeSlots, keep |free−maxFree| ≤ shard-slot deadband, then
+// lower liveShards (sum of nodeLiveShardCount). M=0 is only maxFree then
+// live (old strict freeSlots). pickTarget itself is unchanged so balancer
+// / DC paths stay without M.
+func pickRackEligible(candidates []string, shardsPerTarget map[string][]int, maxPerTarget int, antiAffinity map[string]bool, hasFreeSlots, withinLimit func(string) bool, racks map[string]*rack, freeSlotsDeadband int) (string, bool) {
+	try := func(skipAnti bool) (string, bool) {
+		var keys []string
+		var free, live []int
+		bestCount := maxPerTarget + 1
+		for _, c := range candidates {
+			if skipAnti && antiAffinity[c] {
+				continue
+			}
+			if !hasFreeSlots(c) {
+				continue
+			}
+			if len(shardsPerTarget[c]) >= maxPerTarget {
+				continue
+			}
+			if !withinLimit(c) {
+				continue
+			}
+			cnt := len(shardsPerTarget[c])
+			if len(keys) == 0 || cnt < bestCount {
+				keys, free, live = keys[:0], free[:0], live[:0]
+				bestCount = cnt
+			} else if cnt > bestCount {
+				continue
+			}
+			f := 0
+			if r := racks[c]; r != nil {
+				f = r.freeSlots
+			}
+			keys = append(keys, c)
+			free = append(free, f)
+			live = append(live, rackLiveShardCount(racks[c]))
+		}
+		if len(keys) == 0 {
+			return "", false
+		}
+		return keys[pickDeadbandRemainder(free, live, freeSlotsDeadband)], true
+	}
+	if len(antiAffinity) > 0 {
+		if t, ok := try(true); ok {
+			return t, true
+		}
+	}
+	return try(false)
+}
+
+func rackLiveShardCount(r *rack) int {
+	if r == nil {
+		return 0
+	}
+	total := 0
+	for _, n := range r.nodes {
+		total += nodeLiveShardCount(n)
+	}
+	return total
+}
+
+// pickNodeInRackEligible is pickNodeInRack restricted to nodes with an eligible
+// disk that can take another shard of the volume (free slot, under maxPerDisk).
+// FromActiveTopology keeps all disk types/tags in the snapshot, so without this a
+// node with free volume slots but no eligible disk could be chosen.
+//
+// Even first (this volume, machine then node). Among that class: max node
+// freeSlots, keep |free−maxFree| ≤ shard-slot deadband, then lower
+// liveShards. Machine freeSlots (mFree) stays dropped as on origin/master.
+// SameRackCount / 2+2 unchanged. M=0 is only maxFree then live. Callers
+// convert UI volume M via volumeDeadbandToShardSlots.
+func pickNodeInRackEligible(r *rack, vk volKey, rp *super_block.ReplicaPlacement, eligible func(*disk) bool, maxPerDisk, freeSlotsDeadband int) *Node {
 	machineShards := countShardsByHost(vk, r.nodes)
-	machineFree := freeSlotsByHost(r.nodes)
-	var best *Node
-	var bestMCount, bestMFree, bestNCount, bestNFree int
+	var nodes []*Node
+	var bestMCount, bestNCount int
 	for _, id := range sortedNodeKeys(r.nodes) {
 		node := r.nodes[id]
-		if node.freeSlots <= 0 {
-			continue
-		}
-		if !nodeHasFreeDisk(node, eligible) {
+		if nodeShardRoom(node, vk, eligible, maxPerDisk) <= 0 {
 			continue
 		}
 		count := volumeShardCount(node, vk)
 		if rp != nil && rp.SameRackCount > 0 && count >= rp.SameRackCount {
 			continue
 		}
-		mCount, mFree := machineShards[node.host], machineFree[node.host]
-		better := false
-		switch {
-		case best == nil:
-			better = true
-		case mCount != bestMCount:
-			better = mCount < bestMCount
-		case mFree != bestMFree:
-			better = mFree > bestMFree
-		case count != bestNCount:
-			better = count < bestNCount
-		default:
-			better = node.freeSlots > bestNFree
+		mCount := machineShards[node.host]
+		if len(nodes) == 0 || mCount < bestMCount || (mCount == bestMCount && count < bestNCount) {
+			nodes = nodes[:0]
+			bestMCount, bestNCount = mCount, count
+		} else if mCount != bestMCount || count != bestNCount {
+			continue
 		}
-		if better {
-			best, bestMCount, bestMFree, bestNCount, bestNFree = node, mCount, mFree, count, node.freeSlots
+		nodes = append(nodes, node)
+	}
+	if len(nodes) == 0 {
+		return nil
+	}
+	free := make([]int, len(nodes))
+	live := make([]int, len(nodes))
+	for i, n := range nodes {
+		free[i] = n.freeSlots
+		live[i] = nodeLiveShardCount(n)
+	}
+	return nodes[pickDeadbandRemainder(free, live, freeSlotsDeadband)]
+}
+
+// pickDeadbandRemainder ranks same-evenness candidates: maxFree of the
+// class, keep |free−maxFree|≤m, then min live. Ties keep the earlier
+// index (scan order). M=0 keeps only maxFree then live. Shared by node
+// and rack so the band cannot drift.
+func pickDeadbandRemainder(free, live []int, m int) int {
+	maxFree := free[0]
+	for _, f := range free[1:] {
+		if f > maxFree {
+			maxFree = f
+		}
+	}
+	best := -1
+	for i, f := range free {
+		if absIntDiff(f, maxFree) > m {
+			continue
+		}
+		if best < 0 || live[i] < live[best] {
+			best = i
 		}
 	}
 	return best
 }
 
+func absIntDiff(a, b int) int {
+	if a > b {
+		return a - b
+	}
+	return b - a
+}
+
+// volumeDeadbandToShardSlots converts UI volume-slot M to the shard-slot
+// deadband Place compares against node.freeSlots. OSS 10+4 uses dataShards=10.
+func volumeDeadbandToShardSlots(volumes, dataShards int) int {
+	if volumes <= 0 || dataShards <= 0 {
+		return 0
+	}
+	if volumes > math.MaxInt/dataShards {
+		return math.MaxInt
+	}
+	return volumes * dataShards
+}
+
 // pickBestDiskEligible chooses the best eligible disk on a node, ranking
 // soft-preferred disks (prefer != nil && prefer(d)) ahead of others so disk-type
 // Prefer uses the preferred type when available but spills otherwise. Returns the
@@ -444,7 +650,7 @@ func pickBestDiskEligible(node *Node, vk volKey, eligible func(*disk) bool, pref
 	bestPreferred := false
 	for _, diskID := range sortedDiskKeys(node.disks) {
 		d := node.disks[diskID]
-		if !eligible(d) || d.freeSlots <= 0 {
+		if !eligible(d) || d.freeSlots <= 0 || d.noReceive {
 			continue
 		}
 		existingShards := 0
@@ -538,6 +744,9 @@ func (t *Topology) ClearShardAccounting(nodeID, collection string, vid uint32, s
 // distributing the new shards) neither occupy capacity nor skew anti-affinity /
 // per-disk caps during planning. Unlike repair's ClearShardAccounting, it credits
 // freeSlots because the deletes run before the new writes.
+//
+// Other volumes' disk.shardCount stay put: zeroing the snapshot here is what
+// made within-rack Place see a green field and 50/50 the current volume only.
 func (t *Topology) ReleaseVolumeShards(collection string, vid uint32) {
 	vk := volKey{collection: collection, vid: vid}
 	for _, n := range t.nodes {
diff --git a/weed/storage/erasure_coding/ecbalancer/place_rack_cap_test.go b/weed/storage/erasure_coding/ecbalancer/place_rack_cap_test.go
new file mode 100644
index 0000000000..f3ca0d780f
--- /dev/null
+++ b/weed/storage/erasure_coding/ecbalancer/place_rack_cap_test.go
@@ -0,0 +1,301 @@
+package ecbalancer
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+)
+
+// Total-shards-per-rack cap for Place / PlaceDurabilityFirst.
+//
+// The per-type caps (ceil(data/racks) data, ceil(parity/racks) parity) spread
+// each type evenly on their own, but together they allow e.g. 2 data + 1 parity
+// on one rack. Place also caps the TOTAL per rack at the lowest value the racks'
+// free capacity allows (rackTotalCap), under both modes and with a nil
+// ReplicaPlacement.
+
+// placedTotalsPerRack checks every shard was placed and returns the number of
+// shards per rack.
+func placedTotalsPerRack(t *testing.T, res *PlaceResult) map[string]int {
+	t.Helper()
+	if len(res.Destinations) != erasure_coding.TotalShardsCount {
+		t.Fatalf("placed %d shards, want %d", len(res.Destinations), erasure_coding.TotalShardsCount)
+	}
+	totals := map[string]int{}
+	for _, d := range res.Destinations {
+		totals[d.Rack]++
+	}
+	t.Logf("total shards per rack: %v", totals)
+	return totals
+}
+
+func assertMaxPerRack(t *testing.T, totals map[string]int, maxAllowed int) {
+	t.Helper()
+	for rk, n := range totals {
+		if n > maxAllowed {
+			t.Errorf("rack %s holds %d shards, want at most %d", rk, n, maxAllowed)
+		}
+	}
+}
+
+func assertNotRelaxed(t *testing.T, res *PlaceResult, name string) {
+	t.Helper()
+	for _, r := range res.Relaxed {
+		if r == name {
+			t.Errorf("unexpected %q relaxation, got %v", name, res.Relaxed)
+		}
+	}
+}
+
+// setRackFreeSlots leaves the rack with `slots` free slots, all on the first
+// node's disk 0 (buildPlaceTopo gives each node one disk). Node and disk free
+// slots are kept consistent, since rack capacity is derived from them.
+func setRackFreeSlots(topo *Topology, rackKey string, slots int) {
+	first := true
+	for _, id := range sortedNodeKeys(topo.nodes) {
+		n := topo.nodes[id]
+		if n.rack != rackKey {
+			continue
+		}
+		free := 0
+		if first {
+			free, first = slots, false
+		}
+		for _, d := range n.disks {
+			d.freeSlots = free
+		}
+		n.freeSlots = free
+	}
+}
+
+// TestPlaceTotalShardsPerRackCap: 10+4 over 8 racks of two nodes each places at
+// most ceil(14/8) = 2 shards per rack, in both modes. Before the cap this was
+// 3,3,2,2,1,1,1,1: two racks with 3 each.
+func TestPlaceTotalShardsPerRackCap(t *testing.T) {
+	modes := []struct {
+		name string
+		mode PlacementMode
+	}{{"strict", PlaceStrict}, {"durability-first", PlaceDurabilityFirst}}
+	for _, m := range modes {
+		t.Run(m.name, func(t *testing.T) {
+			topo := buildPlaceTopo(8, 2, 50)
+			res, err := topo.Place(1, "c1", allShards(), Constraints{}, m.mode)
+			if err != nil {
+				t.Fatalf("Place: %v", err)
+			}
+			assertMaxPerRack(t, placedTotalsPerRack(t, res), 2)
+		})
+	}
+}
+
+// TestPlaceTotalCapWithStarvedRack: a rack with a single free slot still takes
+// one shard and the other seven racks keep to 2 each.
+func TestPlaceTotalCapWithStarvedRack(t *testing.T) {
+	topo := buildPlaceTopo(8, 2, 50)
+	setRackFreeSlots(topo, "dc1:rack0", 1)
+
+	res, err := topo.Place(1, "c1", allShards(), Constraints{}, PlaceDurabilityFirst)
+	if err != nil {
+		t.Fatalf("Place: %v", err)
+	}
+	totals := placedTotalsPerRack(t, res)
+	assertMaxPerRack(t, totals, 2)
+	assertNotRelaxed(t, res, "rack-total-cap")
+}
+
+// TestPlaceTotalCapRisesForNearlyFullRacks: when nearly full racks cannot take
+// an even share, the cap rises so the roomy racks absorb it instead of failing.
+// A plain ceil(14/eligibleRacks) cap failed both cases.
+func TestPlaceTotalCapRisesForNearlyFullRacks(t *testing.T) {
+	cases := []struct {
+		name     string
+		racks    int
+		starved  map[string]int // rack -> free slots
+		wantCap  int
+		wantHeld map[string]int // exact shard count expected on starved racks
+	}{
+		{
+			// ceil(14/3) = 5 would fit only 5+5+1 = 11.
+			name:     "3 racks, one with 1 slot",
+			racks:    3,
+			starved:  map[string]int{"dc1:rack2": 1},
+			wantCap:  7,
+			wantHeld: map[string]int{"rack2": 1},
+		},
+		{
+			// ceil(14/8) = 2 would fit only 2+7 = 9.
+			name:  "8 racks, seven with 1 slot",
+			racks: 8,
+			starved: map[string]int{
+				"dc1:rack1": 1, "dc1:rack2": 1, "dc1:rack3": 1, "dc1:rack4": 1,
+				"dc1:rack5": 1, "dc1:rack6": 1, "dc1:rack7": 1,
+			},
+			wantCap: 7,
+			wantHeld: map[string]int{
+				"rack1": 1, "rack2": 1, "rack3": 1, "rack4": 1,
+				"rack5": 1, "rack6": 1, "rack7": 1,
+			},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			topo := buildPlaceTopo(tc.racks, 2, 50)
+			for rk, slots := range tc.starved {
+				setRackFreeSlots(topo, rk, slots)
+			}
+			res, err := topo.Place(1, "c1", allShards(), Constraints{}, PlaceDurabilityFirst)
+			if err != nil {
+				t.Fatalf("Place: %v", err)
+			}
+			totals := placedTotalsPerRack(t, res)
+			assertMaxPerRack(t, totals, tc.wantCap)
+			for rk, want := range tc.wantHeld {
+				if totals[rk] != want {
+					t.Errorf("rack %s holds %d shards, want %d", rk, totals[rk], want)
+				}
+			}
+			assertNotRelaxed(t, res, "rack-total-cap")
+		})
+	}
+}
+
+// TestPlaceTotalCapKeepsPreferredTagTier: a preferred-tag tier whose racks have
+// uneven room must still place the whole volume on the tagged disks rather than
+// spill to untagged ones.
+func TestPlaceTotalCapKeepsPreferredTagTier(t *testing.T) {
+	topo := NewTopology()
+	for r := 0; r < 3; r++ {
+		for n := 0; n < 2; n++ {
+			taggedFree := 50
+			if r == 2 {
+				taggedFree = 0
+				if n == 0 {
+					taggedFree = 2
+				}
+			}
+			node := topo.AddNode(fmt.Sprintf("10.0.%d.%d:8080", r, n), "dc1", fmt.Sprintf("dc1:rack%d", r), taggedFree+50)
+			node.AddDisk(0, "", taggedFree, 0)
+			node.AddDiskTags(0, []string{"ec-pool"})
+			node.AddDisk(1, "", 50, 0)
+		}
+	}
+
+	res, err := topo.Place(1, "c1", allShards(), Constraints{PreferredTags: []string{"ec-pool"}}, PlaceDurabilityFirst)
+	if err != nil {
+		t.Fatalf("Place: %v", err)
+	}
+	if res.SpilledOutsidePreferredTags {
+		t.Fatal("placement spilled outside the preferred tags although the tagged disks can hold every shard")
+	}
+	for sid, d := range res.Destinations {
+		if d.DiskID != 0 {
+			t.Errorf("shard %d landed on untagged disk %d of %s", sid, d.DiskID, d.Node)
+		}
+	}
+	placedTotalsPerRack(t, res)
+}
+
+// TestPlaceSkipsRackWithFullDisks: once a rack's disks hit the per-disk cap
+// (parityShards shards of the volume), Place moves on to a rack that still has
+// room instead of failing the shard.
+func TestPlaceSkipsRackWithFullDisks(t *testing.T) {
+	topo := buildPlaceTopo(1, 3, 50) // rack0: 3 nodes
+	small := topo.AddNode("10.0.1.0:8080", "dc1", "dc1:rack1", 50)
+	small.AddDisk(0, "", 50, 0) // rack1: a single disk, so at most 4 shards
+
+	res, err := topo.Place(1, "c1", allShards(), Constraints{}, PlaceDurabilityFirst)
+	if err != nil {
+		t.Fatalf("Place: %v", err)
+	}
+	totals := placedTotalsPerRack(t, res)
+	if totals["rack1"] > erasure_coding.ParityShardsCount {
+		t.Errorf("rack1 holds %d shards on one disk, want at most %d", totals["rack1"], erasure_coding.ParityShardsCount)
+	}
+}
+
+// TestPlaceTotalCapCountsSameRackCount: with SameRackCount=1, a one-node rack
+// takes a single shard however much disk room it has, so the cap must be sized
+// from the room left under that limit. Four one-node racks and four three-node
+// racks fit 10+4 as 1 per small rack and up to 3 per large rack; a cap sized from
+// disk room alone is 2, which fits only 4 + 4*2 = 12, so strict placement failed
+// and durability-first relaxed replica placement.
+func TestPlaceTotalCapCountsSameRackCount(t *testing.T) {
+	rp := &super_block.ReplicaPlacement{SameRackCount: 1} // <=1 shard per node
+	modes := []struct {
+		name string
+		mode PlacementMode
+	}{{"strict", PlaceStrict}, {"durability-first", PlaceDurabilityFirst}}
+	for _, m := range modes {
+		t.Run(m.name, func(t *testing.T) {
+			topo := NewTopology()
+			for r := 0; r < 8; r++ {
+				nodes := 1
+				if r >= 4 {
+					nodes = 3
+				}
+				for n := 0; n < nodes; n++ {
+					node := topo.AddNode(fmt.Sprintf("10.0.%d.%d:8080", r, n), "dc1", fmt.Sprintf("dc1:rack%d", r), 50)
+					node.AddDisk(0, "", 50, 0)
+				}
+			}
+			res, err := topo.Place(1, "c1", allShards(), Constraints{ReplicaPlacement: rp}, m.mode)
+			if err != nil {
+				t.Fatalf("Place: %v", err)
+			}
+			assertMaxPerRack(t, placedTotalsPerRack(t, res), 3)
+			assertNotRelaxed(t, res, "replica-placement")
+			assertNotRelaxed(t, res, "rack-total-cap")
+			perNode := map[string]int{}
+			for _, d := range res.Destinations {
+				perNode[d.Node]++
+			}
+			for node, n := range perNode {
+				if n > rp.SameRackCount {
+					t.Errorf("node %s holds %d shards, want at most %d", node, n, rp.SameRackCount)
+				}
+			}
+		})
+	}
+}
+
+func TestRackTotalCap(t *testing.T) {
+	keys := func(n int) []string {
+		out := make([]string, n)
+		for i := range out {
+			out[i] = fmt.Sprintf("r%d", i)
+		}
+		return out
+	}
+	uniform := func(n, room int) map[string]int {
+		out := map[string]int{}
+		for _, k := range keys(n) {
+			out[k] = room
+		}
+		return out
+	}
+	cases := []struct {
+		name  string
+		racks int
+		held  map[string]int
+		room  map[string]int
+		total int
+		want  int
+	}{
+		{name: "even over 8", racks: 8, room: uniform(8, 50), total: 14, want: 2},
+		{name: "even over 5", racks: 5, room: uniform(5, 50), total: 14, want: 3},
+		{name: "one rack with 1 slot", racks: 3, room: map[string]int{"r0": 50, "r1": 50, "r2": 1}, total: 14, want: 7},
+		{name: "one rack full", racks: 3, room: map[string]int{"r0": 50, "r1": 50}, total: 14, want: 7},
+		// Repair: r0 already holds 5 survivors; the other racks share the rest.
+		{name: "held above even share", racks: 3, held: map[string]int{"r0": 5}, room: uniform(3, 50), total: 14, want: 5},
+		{name: "not enough room", racks: 2, room: uniform(2, 3), total: 14, want: 14},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := rackTotalCap(keys(tc.racks), tc.held, tc.room, tc.total); got != tc.want {
+				t.Errorf("rackTotalCap = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/weed/storage/erasure_coding/ecbalancer/place_test.go b/weed/storage/erasure_coding/ecbalancer/place_test.go
index e6f625a94d..32eef6edba 100644
--- a/weed/storage/erasure_coding/ecbalancer/place_test.go
+++ b/weed/storage/erasure_coding/ecbalancer/place_test.go
@@ -2,6 +2,8 @@ package ecbalancer
 
 import (
 	"fmt"
+	"math"
+	"sort"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
@@ -500,3 +502,648 @@ func TestPlaceStrictCapsCountEligibleRacks(t *testing.T) {
 		}
 	}
 }
+
+// TestPlaceRotatesExtraRackShardsAcrossVolumes: 10+4 onto 4 equal racks is
+// always 4+4+3+3. Sorted-id tie-breaks pinned the two fours on the first rack
+// ids every volume. Free-slot tie-breaks must walk the extra shards so every
+// rack is in the "4" set across a short series.
+func TestPlaceRotatesExtraRackShardsAcrossVolumes(t *testing.T) {
+	topo := buildPlaceTopo(4, 2, 200)
+	const volumes = 8
+	gotFour := map[string]int{}
+	for v := 0; v < volumes; v++ {
+		res, err := topo.Place(uint32(v+1), "c1", allShards(), Constraints{}, PlaceStrict)
+		if err != nil {
+			t.Fatalf("Place volume %d: %v", v+1, err)
+		}
+		perRack := map[string]int{}
+		for _, d := range res.Destinations {
+			perRack[d.Rack]++
+		}
+		if len(perRack) != 4 {
+			t.Fatalf("volume %d racks %v, want 4", v+1, perRack)
+		}
+		counts := make([]int, 0, 4)
+		for rack, n := range perRack {
+			counts = append(counts, n)
+			if n != 3 && n != 4 {
+				t.Errorf("volume %d rack %s has %d shards, want 3 or 4", v+1, rack, n)
+			}
+			if n == 4 {
+				gotFour[rack]++
+			}
+		}
+		sort.Ints(counts)
+		if counts[0] != 3 || counts[3] != 4 {
+			t.Errorf("volume %d rack counts %v, want 3,3,4,4", v+1, perRack)
+		}
+	}
+	if len(gotFour) < 4 {
+		t.Errorf("extra (4-shard) racks did not rotate; hit %v over %d volumes", gotFour, volumes)
+	}
+}
+
+func twoDiskRackRP() *super_block.ReplicaPlacement {
+	return &super_block.ReplicaPlacement{DiffRackCount: 4, SameRackCount: 2}
+}
+
+func placeNeed(t *testing.T, topo *Topology, vid uint32, n int, rp *super_block.ReplicaPlacement) map[string]int {
+	t.Helper()
+	need := make([]int, n)
+	for i := range need {
+		need[i] = i
+	}
+	res, err := topo.Place(vid, "c1", need, Constraints{
+		ReplicaPlacement: rp,
+		Ratio:            func(string) (int, int) { return 10, 4 },
+	}, PlaceDurabilityFirst)
+	if err != nil {
+		t.Fatalf("Place vid=%d: %v", vid, err)
+	}
+	got := map[string]int{}
+	for _, d := range res.Destinations {
+		got[d.Node]++
+	}
+	return got
+}
+
+// TestWithinRackPaysDownShardDebt3: 2 VS, same disk cap, live 100 vs 135,
+// 3 shards, cap 2. freeSlots = cap−shards so the thinner also has more
+// remaining slots; extras pay the debt — not 50/50 from vol 1.
+// Equal remaining slots (same free, different shards) are the liveShards
+// tie-break; see TestEcVolumeCountIsNotScore.
+func TestWithinRackPaysDownShardDebt3(t *testing.T) {
+	topo := NewTopology()
+	a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 4900)
+	a.AddDisk(0, "", 4900, 100)
+	b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 4865)
+	b.AddDisk(0, "", 4865, 135)
+	rp := twoDiskRackRP()
+
+	got := placeNeed(t, topo, 1, 3, rp)
+	if got["a:8080"] != 2 || got["b:8081"] != 1 {
+		t.Fatalf("first volume %v, want a=2 b=1 (pair on thinner)", got)
+	}
+
+	const rounds = 35
+	for v := uint32(2); v <= rounds; v++ {
+		beforeA, beforeB := nodeLiveShardCount(a), nodeLiveShardCount(b)
+		got = placeNeed(t, topo, v, 3, rp)
+		if beforeA+2 <= beforeB && (got["a:8080"] != 2 || got["b:8081"] != 1) {
+			t.Fatalf("volume %d %v before A=%d B=%d; debt≥2 must stay 2+1 on A",
+				v, got, beforeA, beforeB)
+		}
+	}
+	if ga, gb := nodeLiveShardCount(a), nodeLiveShardCount(b); ga != 170 || gb != 170 {
+		t.Errorf("after %d×(2+1) live A=%d B=%d, want 170/170", rounds, ga, gb)
+	}
+}
+
+// TestWithinRackFourShardsStayEven: 4 shards / 2 disks is always 2+2.
+// Remainder is 0 — packing 3+1 would put 3 shards on one disk.
+func TestWithinRackFourShardsStayEven(t *testing.T) {
+	topo := NewTopology()
+	a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 5000)
+	a.AddDisk(0, "", 5000, 100)
+	b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 5000)
+	b.AddDisk(0, "", 5000, 130)
+	rp := twoDiskRackRP()
+
+	got := placeNeed(t, topo, 1, 4, rp)
+	if got["a:8080"] != 2 || got["b:8081"] != 2 {
+		t.Fatalf("first volume %v, want 2+2 (no 3+1)", got)
+	}
+	if ga, gb := nodeLiveShardCount(a), nodeLiveShardCount(b); ga != 102 || gb != 132 {
+		t.Fatalf("after 2+2 live A=%d B=%d, want 102/132 (gap frozen)", ga, gb)
+	}
+	got = placeNeed(t, topo, 2, 4, rp)
+	if got["a:8080"] != 2 || got["b:8081"] != 2 {
+		t.Fatalf("second volume %v, want 2+2", got)
+	}
+}
+
+// TestEcVolumeCountIsNotScore: both VS show the same "EC volumes" cardinality;
+// the pair still goes to the lower shard count.
+func TestEcVolumeCountIsNotScore(t *testing.T) {
+	topo := NewTopology()
+	a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 5000)
+	a.AddDisk(0, "", 5000, 2528)
+	b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 5000)
+	b.AddDisk(0, "", 5000, 2563)
+	for i := uint32(1); i <= 1000; i++ {
+		a.AddShards(i, "other", 0, erasure_coding.ShardBits(1))
+		b.AddShards(i, "other", 0, erasure_coding.ShardBits(1))
+	}
+	got := placeNeed(t, topo, 2000, 3, twoDiskRackRP())
+	if got["a:8080"] != 2 || got["b:8081"] != 1 {
+		t.Fatalf("got %v; score must be shard count (2528 vs 2563), not 1000 EC volumes", got)
+	}
+}
+
+// TestFreeSlotsWinsAsymmetricExtras: more freeSlots on the fatter disk takes
+// the remainder even if that disk already has more live shards. 4 shards stay
+// 2+2 (remainder 0; no 3+1).
+func TestFreeSlotsWinsAsymmetricExtras(t *testing.T) {
+	topo := NewTopology()
+	a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 100)
+	a.AddDisk(0, "", 100, 100)
+	b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 200)
+	b.AddDisk(0, "", 200, 135)
+	rp := twoDiskRackRP()
+	got := placeNeed(t, topo, 1, 3, rp)
+	if got["a:8080"] != 1 || got["b:8081"] != 2 {
+		t.Fatalf("3 shards %v, want 2+1 on B (more freeSlots) even though B has more shards", got)
+	}
+
+	topo = NewTopology()
+	a = topo.AddNode("a:8080", "dc1", "dc1:rack0", 100)
+	a.AddDisk(0, "", 100, 100)
+	b = topo.AddNode("b:8081", "dc1", "dc1:rack0", 200)
+	b.AddDisk(0, "", 200, 135)
+	got = placeNeed(t, topo, 1, 4, rp)
+	if got["a:8080"] != 2 || got["b:8081"] != 2 {
+		t.Fatalf("4 shards %v, want 2+2 (remainder 0; freeSlots must not pack 3+1)", got)
+	}
+}
+
+// TestReleaseVolumeShardsKeepsOtherLiveCounts: encode's ReleaseVolumeShards
+// must not zero disk.shardCount for other volumes (that was the green-field bug).
+func TestReleaseVolumeShardsKeepsOtherLiveCounts(t *testing.T) {
+	topo := NewTopology()
+	n := topo.AddNode("n0:8080", "dc1", "dc1:rack0", 100)
+	n.AddDisk(0, "", 90, 10)
+	n.AddShards(1, "c1", 0, erasure_coding.ShardBits(1<<0))
+	n.AddShards(2, "c1", 0, erasure_coding.ShardBits(1<<1|1<<2))
+	n.disks[0].shardCount = 10
+	n.disks[0].freeSlots = 90
+
+	topo.ReleaseVolumeShards("c1", 1)
+
+	if nodeLiveShardCount(n) != 9 {
+		t.Errorf("live shardCount = %d after releasing 1 of 10, want 9 (must not zero the snapshot)", nodeLiveShardCount(n))
+	}
+	if _, ok := n.shards[volKey{collection: "c1", vid: 2}]; !ok {
+		t.Error("other volume shards were dropped")
+	}
+}
+
+const imbalanceLiveBase = 200
+const imbalanceDiskCap = 5000
+
+// buildImbalancedTopo is racks × machines × disks: one VS per machine, disk
+// ids 0..D-1. Earlier (rack, machine, disk) ids are fatter — more liveShards,
+// fewer freeSlots (cap−live). Sorted-id extras would pile on those first ids;
+// freeSlots-then-liveShards extras must walk the other way.
+func buildImbalancedTopo(racks, machines, disks int) *Topology {
+	topo := NewTopology()
+	idx := 0
+	for r := 0; r < racks; r++ {
+		rackKey := fmt.Sprintf("dc1:rack%d", r)
+		for m := 0; m < machines; m++ {
+			host := fmt.Sprintf("10.0.%d.%d", r, m)
+			lives := make([]int, disks)
+			frees := make([]int, disks)
+			nodeFree := 0
+			for d := 0; d < disks; d++ {
+				lives[d] = imbalanceLiveBase - idx
+				idx++
+				frees[d] = imbalanceDiskCap - lives[d]
+				nodeFree += frees[d]
+			}
+			n := topo.AddNode(host+":8080", "dc1", rackKey, nodeFree)
+			n.SetHost(host)
+			for d := 0; d < disks; d++ {
+				n.AddDisk(uint32(d), "", frees[d], lives[d])
+			}
+		}
+	}
+	return topo
+}
+
+type diskKey struct {
+	node   string
+	diskID uint32
+}
+
+func snapshotDiskLive(topo *Topology) map[diskKey]int {
+	out := make(map[diskKey]int)
+	for _, n := range topo.nodes {
+		for id, d := range n.disks {
+			out[diskKey{n.id, id}] = d.shardCount
+		}
+	}
+	return out
+}
+
+func snapshotRackLive(topo *Topology) map[string]int {
+	out := make(map[string]int)
+	for _, n := range topo.nodes {
+		out[n.rack] += nodeLiveShardCount(n)
+	}
+	return out
+}
+
+func place104Counts(t *testing.T, topo *Topology) (perDisk map[diskKey]int, perRack map[string]int) {
+	t.Helper()
+	res, err := topo.Place(1, "c1", allShards(), Constraints{}, PlaceStrict)
+	if err != nil {
+		t.Fatalf("Place: %v", err)
+	}
+	if len(res.Destinations) != erasure_coding.TotalShardsCount {
+		t.Fatalf("placed %d shards, want %d", len(res.Destinations), erasure_coding.TotalShardsCount)
+	}
+	perDisk = map[diskKey]int{}
+	perRack = map[string]int{}
+	for _, d := range res.Destinations {
+		perDisk[diskKey{d.Node, d.DiskID}]++
+		perRack[topo.nodes[d.Node].rack]++
+	}
+	return perDisk, perRack
+}
+
+func assertTailsPreferThinDisks(t *testing.T, topo *Topology, before map[diskKey]int, got map[diskKey]int) {
+	t.Helper()
+	for _, n := range topo.nodes {
+		type row struct {
+			live int
+			got  int
+			id   uint32
+		}
+		rows := make([]row, 0, len(n.disks))
+		for id := range n.disks {
+			k := diskKey{n.id, id}
+			rows = append(rows, row{live: before[k], got: got[k], id: id})
+		}
+		sort.Slice(rows, func(i, j int) bool {
+			if rows[i].live != rows[j].live {
+				return rows[i].live > rows[j].live
+			}
+			return rows[i].id < rows[j].id
+		})
+		for i := 1; i < len(rows); i++ {
+			if rows[i-1].got > rows[i].got {
+				t.Errorf("node %s: fatter disk %d (live=%d) got %d of this volume, thinner disk %d (live=%d) got %d; remainder tails must prefer thin disks, not first ids",
+					n.id, rows[i-1].id, rows[i-1].live, rows[i-1].got, rows[i].id, rows[i].live, rows[i].got)
+			}
+		}
+	}
+}
+
+func assertRackExtrasWalkThin(t *testing.T, before map[string]int, got map[string]int) {
+	t.Helper()
+	type row struct {
+		rack string
+		live int
+		got  int
+	}
+	rows := make([]row, 0, len(before))
+	for rk, live := range before {
+		rows = append(rows, row{rack: rk, live: live, got: got[rk]})
+	}
+	sort.Slice(rows, func(i, j int) bool {
+		if rows[i].live != rows[j].live {
+			return rows[i].live > rows[j].live
+		}
+		return rows[i].rack < rows[j].rack
+	})
+	for i := 1; i < len(rows); i++ {
+		if rows[i-1].got > rows[i].got {
+			t.Errorf("fatter rack %s (live=%d) got %d, thinner rack %s (live=%d) got %d; extras must walk to thinner racks",
+				rows[i-1].rack, rows[i-1].live, rows[i-1].got, rows[i].rack, rows[i].live, rows[i].got)
+		}
+	}
+}
+
+func assertLiveGapFrozen(t *testing.T, before, after map[diskKey]int, placed map[diskKey]int) {
+	t.Helper()
+	keys := make([]diskKey, 0, len(before))
+	for k := range before {
+		keys = append(keys, k)
+	}
+	sort.Slice(keys, func(i, j int) bool {
+		if keys[i].node != keys[j].node {
+			return keys[i].node < keys[j].node
+		}
+		return keys[i].diskID < keys[j].diskID
+	})
+	for i := 0; i < len(keys); i++ {
+		for j := i + 1; j < len(keys); j++ {
+			a, b := keys[i], keys[j]
+			if before[a]-before[b] != after[a]-after[b] {
+				t.Errorf("live gap %s/%d vs %s/%d changed %d → %d (placed %d vs %d); remainder 0 must not close the gap",
+					a.node, a.diskID, b.node, b.diskID, before[a]-before[b], after[a]-after[b], placed[a], placed[b])
+			}
+		}
+	}
+}
+
+// TestPlace10Plus4ImbalanceTiebreak: 10+4 onto seeded liveShards/freeSlots
+// skew. Remainder tails pay thin disks/racks, not sorted-first ids. Remainder
+// 0 (1-1-7, 7-1-2) is a no-op on the live gap — that is the contract.
+// Existing 4-1-2 / within-rack 2-disk cases stay in the tests above.
+func TestPlace10Plus4ImbalanceTiebreak(t *testing.T) {
+	cases := []struct {
+		name              string
+		racks, machines, disks int
+		remainderZero     bool
+		fatFirstGetsZero  bool
+		rackExtras        bool
+		fatRacksTwoPlusOne bool
+	}{
+		{name: "1-1-4", racks: 1, machines: 1, disks: 4},
+		{name: "1-1-6", racks: 1, machines: 1, disks: 6},
+		{name: "1-1-8", racks: 1, machines: 1, disks: 8},
+		{name: "1-1-15", racks: 1, machines: 1, disks: 15, fatFirstGetsZero: true},
+		{name: "1-1-7", racks: 1, machines: 1, disks: 7, remainderZero: true},
+		{name: "7-1-2", racks: 7, machines: 1, disks: 2, remainderZero: true},
+		{name: "4-2-3", racks: 4, machines: 2, disks: 3, rackExtras: true},
+		{name: "5-2-2", racks: 5, machines: 2, disks: 2, rackExtras: true},
+		{name: "6-1-2", racks: 6, machines: 1, disks: 2, rackExtras: true, fatRacksTwoPlusOne: true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			topo := buildImbalancedTopo(tc.racks, tc.machines, tc.disks)
+			beforeDisk := snapshotDiskLive(topo)
+			beforeRack := snapshotRackLive(topo)
+
+			gotDisk, gotRack := place104Counts(t, topo)
+
+			if tc.fatFirstGetsZero {
+				var zero []diskKey
+				for _, n := range topo.nodes {
+					for id := range n.disks {
+						k := diskKey{n.id, id}
+						if gotDisk[k] == 0 {
+							zero = append(zero, k)
+						}
+					}
+				}
+				if len(zero) != 1 {
+					t.Fatalf("want exactly one disk with 0 shards of this volume, got %v (placed %v)", zero, gotDisk)
+				}
+				if zero[0].diskID != 0 {
+					t.Fatalf("zero-of-this-volume disk is %s/%d; must be the fat first-id disk, not the last sorted id", zero[0].node, zero[0].diskID)
+				}
+			}
+
+			assertTailsPreferThinDisks(t, topo, beforeDisk, gotDisk)
+
+			if tc.rackExtras || tc.remainderZero && tc.racks > 1 {
+				assertRackExtrasWalkThin(t, beforeRack, gotRack)
+			}
+
+			if tc.fatRacksTwoPlusOne {
+				for _, n := range topo.nodes {
+					if gotRack[n.rack] != 3 {
+						continue
+					}
+					counts := make([]int, 0, len(n.disks))
+					for id := range n.disks {
+						counts = append(counts, gotDisk[diskKey{n.id, id}])
+					}
+					sort.Ints(counts)
+					if len(counts) != 2 || counts[0] != 1 || counts[1] != 2 {
+						t.Errorf("rack %s has 3 shards on disks %v, want 2+1", n.rack, counts)
+					}
+				}
+			}
+
+			if tc.remainderZero {
+				after := snapshotDiskLive(topo)
+				assertLiveGapFrozen(t, beforeDisk, after, gotDisk)
+			}
+		})
+	}
+}
+
+func TestVolumeDeadbandToShardSlots(t *testing.T) {
+	if got := volumeDeadbandToShardSlots(0, 10); got != 0 {
+		t.Fatalf("M=0 → %d, want 0", got)
+	}
+	if got := volumeDeadbandToShardSlots(1, 10); got != 10 {
+		t.Fatalf("M=1 at 10+4 → %d, want 10", got)
+	}
+	if got := volumeDeadbandToShardSlots(1, 8); got != 8 {
+		t.Fatalf("M=1 at 8+4 → %d, want 8", got)
+	}
+	if got := volumeDeadbandToShardSlots(50, 10); got != 500 {
+		t.Fatalf("M=50 at 10+4 → %d, want 500", got)
+	}
+	if got := volumeDeadbandToShardSlots(-3, 10); got != 0 {
+		t.Fatalf("negative M → %d, want 0", got)
+	}
+}
+
+func TestAbsIntDiff(t *testing.T) {
+	if got := absIntDiff(105, 100); got != 5 {
+		t.Fatalf("absIntDiff(105, 100)=%d, want 5", got)
+	}
+	if got := absIntDiff(100, 105); got != 5 {
+		t.Fatalf("absIntDiff(100, 105)=%d, want 5", got)
+	}
+	if got := absIntDiff(100, 100); got != 0 {
+		t.Fatalf("absIntDiff(100, 100)=%d, want 0", got)
+	}
+	if got := absIntDiff(math.MaxInt, math.MaxInt-5); got != 5 {
+		t.Fatalf("absIntDiff(MaxInt, MaxInt-5)=%d, want 5", got)
+	}
+	if got := absIntDiff(math.MaxInt-5, math.MaxInt); got != 5 {
+		t.Fatalf("absIntDiff(MaxInt-5, MaxInt)=%d, want 5", got)
+	}
+	if got := absIntDiff(math.MinInt+5, math.MinInt); got != 5 {
+		t.Fatalf("absIntDiff(MinInt+5, MinInt)=%d, want 5", got)
+	}
+	if got := absIntDiff(math.MinInt, math.MinInt+5); got != 5 {
+		t.Fatalf("absIntDiff(MinInt, MinInt+5)=%d, want 5", got)
+	}
+}
+
+func placeFirstShardNode(t *testing.T, topo *Topology, m int) string {
+	t.Helper()
+	res, err := topo.Place(1, "c1", []int{0}, Constraints{FreeSlotsDeadband: m}, PlaceStrict)
+	if err != nil {
+		t.Fatalf("Place M=%d: %v", m, err)
+	}
+	d, ok := res.Destinations[0]
+	if !ok {
+		t.Fatal("missing shard 0")
+	}
+	return d.Node
+}
+
+// TestFreeSlotsDeadbandDefersToLiveShards: two nodes, empty this-volume.
+// b has slightly more freeSlots but more live shards. M=0 follows freeSlots
+// (b); M=1 volume (×10 shard slots at 10+4) covers the gap and follows
+// liveShards (a). Sorted-id would always pick a.
+func TestFreeSlotsDeadbandDefersToLiveShards(t *testing.T) {
+	build := func() *Topology {
+		topo := NewTopology()
+		a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 100)
+		a.AddDisk(0, "", 100, 10)
+		b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 105)
+		b.AddDisk(0, "", 105, 50)
+		return topo
+	}
+	if got := placeFirstShardNode(t, build(), 0); got != "b:8081" {
+		t.Fatalf("M=0: got %s, want b (strict freeSlots)", got)
+	}
+	if got := placeFirstShardNode(t, build(), 1); got != "a:8080" {
+		t.Fatalf("M=1 volume: got %s, want a (liveShards remainder)", got)
+	}
+}
+
+// TestFreeSlotsDeadbandZeroExactTieUsesLiveShards: equal freeSlots, M=0
+// remainder is liveShards, not the lower sorted id.
+func TestFreeSlotsDeadbandZeroExactTieUsesLiveShards(t *testing.T) {
+	topo := NewTopology()
+	a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 100)
+	a.AddDisk(0, "", 100, 50)
+	b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 100)
+	b.AddDisk(0, "", 100, 10)
+	if got := placeFirstShardNode(t, topo, 0); got != "b:8081" {
+		t.Fatalf("equal freeSlots M=0: got %s, want b (lower liveShards)", got)
+	}
+}
+
+// TestFreeSlotsDeadbandStillHonorsLargeGap: gap above M still follows freeSlots
+// even if that node is fatter on liveShards.
+func TestFreeSlotsDeadbandStillHonorsLargeGap(t *testing.T) {
+	topo := NewTopology()
+	a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 100)
+	a.AddDisk(0, "", 100, 10)
+	b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 200)
+	b.AddDisk(0, "", 200, 80)
+	if got := placeFirstShardNode(t, topo, 1); got != "b:8081" {
+		t.Fatalf("M=1 volume gap=100 shards: got %s, want b (freeSlots still wins)", got)
+	}
+}
+
+// TestFreeSlotsDeadbandScalesWithRatio: M=1 volume is 8 shard slots at 8+4
+// and 10 at default 10+4. Gap of 9 shards: 8+4 still follows freeSlots; 10+4
+// ties and follows liveShards.
+func TestFreeSlotsDeadbandScalesWithRatio(t *testing.T) {
+	build := func() *Topology {
+		topo := NewTopology()
+		a := topo.AddNode("a:8080", "dc1", "dc1:rack0", 100)
+		a.AddDisk(0, "", 100, 10)
+		b := topo.AddNode("b:8081", "dc1", "dc1:rack0", 109)
+		b.AddDisk(0, "", 109, 50)
+		return topo
+	}
+	place := func(topo *Topology, ratio func(string) (int, int)) string {
+		t.Helper()
+		res, err := topo.Place(1, "c1", []int{0}, Constraints{FreeSlotsDeadband: 1, Ratio: ratio}, PlaceStrict)
+		if err != nil {
+			t.Fatalf("Place: %v", err)
+		}
+		d, ok := res.Destinations[0]
+		if !ok {
+			t.Fatal("missing shard 0")
+		}
+		return d.Node
+	}
+	if got := place(build(), func(string) (int, int) { return 8, 4 }); got != "b:8081" {
+		t.Fatalf("8+4 M=1 gap=9: got %s, want b (deadband 8, freeSlots)", got)
+	}
+	if got := place(build(), nil); got != "a:8080" {
+		t.Fatalf("10+4 M=1 gap=9: got %s, want a (deadband 10, liveShards)", got)
+	}
+}
+
+func rackExtraTopo(thinFree, thinLive, fatFree, fatLive int) *Topology {
+	topo := NewTopology()
+	add := func(rack, id string, free, live int) {
+		n := topo.AddNode(id, "dc1", rack, free)
+		n.AddDisk(0, "", free, live)
+	}
+	add("dc1:rack0", "thin:8080", thinFree, thinLive)
+	add("dc1:rack1", "fat1:8080", fatFree, fatLive)
+	add("dc1:rack2", "fat2:8080", fatFree, fatLive)
+	add("dc1:rack3", "fat3:8080", fatFree, fatLive)
+	return topo
+}
+
+func place104PerRack(t *testing.T, topo *Topology, m int) map[string]int {
+	t.Helper()
+	res, err := topo.Place(1, "c1", allShards(), Constraints{FreeSlotsDeadband: m}, PlaceStrict)
+	if err != nil {
+		t.Fatalf("Place M=%d: %v", m, err)
+	}
+	got := map[string]int{}
+	for _, d := range res.Destinations {
+		got[d.Rack]++
+	}
+	return got
+}
+
+// TestRackDeadbandDefersToLiveShards: 10+4 extras are 4+4+3+3. Thin rack has
+// fewer freeSlots (gap 5) but fewer liveShards. M=1 volume is 10 shard slots,
+// so the gap is a tie and extras go to the thinner live rack.
+func TestRackDeadbandDefersToLiveShards(t *testing.T) {
+	got := place104PerRack(t, rackExtraTopo(100, 10, 105, 50), 1)
+	if got["rack0"] != 4 {
+		t.Fatalf("M=1 gap=5: thin rack0 got %d, want 4 (liveShards remainder); per-rack %v", got["rack0"], got)
+	}
+}
+
+// TestRackDeadbandStillHonorsLargeGap: same thin-vs-fat live, but freeSlots
+// gap 100 is above M=1 (10 shard slots), so extras still follow freeSlots.
+func TestRackDeadbandStillHonorsLargeGap(t *testing.T) {
+	got := place104PerRack(t, rackExtraTopo(100, 10, 200, 50), 1)
+	if got["rack0"] != 3 {
+		t.Fatalf("M=1 gap=100: thin rack0 got %d, want 3 (freeSlots still wins); per-rack %v", got["rack0"], got)
+	}
+}
+
+// Greptile chain at M=1 volume (10 shard slots): 120/300, 110/200, 100/100.
+// Pairwise vs the current winner walks 120→110→100 or 100→110→120 depending
+// on scan order. maxFree=120 keeps |Δ|≤10, so 110 wins — not 100 (out of
+// band) and not 120 (fatter live).
+func TestNodeDeadbandAnchorsOnMaxFree(t *testing.T) {
+	run := func(t *testing.T, frees, lives [3]int, want string) {
+		t.Helper()
+		topo := NewTopology()
+		ids := [3]string{"n0:8080", "n1:8081", "n2:8082"}
+		for i, id := range ids {
+			n := topo.AddNode(id, "dc1", "dc1:rack0", frees[i])
+			n.AddDisk(0, "", frees[i], lives[i])
+		}
+		if got := placeFirstShardNode(t, topo, 1); got != want {
+			t.Fatalf("got %s, want %s (110 in-band, not 100/120)", got, want)
+		}
+	}
+	t.Run("high-to-low", func(t *testing.T) {
+		run(t, [3]int{120, 110, 100}, [3]int{300, 200, 100}, "n1:8081")
+	})
+	t.Run("low-to-high", func(t *testing.T) {
+		run(t, [3]int{100, 110, 120}, [3]int{100, 200, 300}, "n1:8081")
+	})
+}
+
+func TestRackDeadbandAnchorsOnMaxFree(t *testing.T) {
+	run := func(t *testing.T, frees, lives [3]int, want string) {
+		t.Helper()
+		topo := NewTopology()
+		for i := 0; i < 3; i++ {
+			n := topo.AddNode(fmt.Sprintf("n%d:8080", i), "dc1", fmt.Sprintf("dc1:rack%d", i), frees[i])
+			n.AddDisk(0, "", frees[i], lives[i])
+		}
+		res, err := topo.Place(1, "c1", []int{0}, Constraints{FreeSlotsDeadband: 1}, PlaceStrict)
+		if err != nil {
+			t.Fatalf("Place: %v", err)
+		}
+		d, ok := res.Destinations[0]
+		if !ok {
+			t.Fatal("missing shard 0")
+		}
+		if d.Rack != want {
+			t.Fatalf("got rack %s, want %s (110 in-band, not 100/120)", d.Rack, want)
+		}
+	}
+	t.Run("high-to-low", func(t *testing.T) {
+		run(t, [3]int{120, 110, 100}, [3]int{300, 200, 100}, "rack1")
+	})
+	t.Run("low-to-high", func(t *testing.T) {
+		run(t, [3]int{100, 110, 120}, [3]int{100, 200, 300}, "rack1")
+	})
+}
diff --git a/weed/storage/erasure_coding/ecbalancer/small_ratio_regression_test.go b/weed/storage/erasure_coding/ecbalancer/small_ratio_regression_test.go
new file mode 100644
index 0000000000..948632756a
--- /dev/null
+++ b/weed/storage/erasure_coding/ecbalancer/small_ratio_regression_test.go
@@ -0,0 +1,87 @@
+package ecbalancer
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+)
+
+// Test every initial assignment of the three unique shards to three healthy DCs.
+// This includes all shards on the encoder and the already-balanced-but-unsafe
+// state with data+parity in one DC, data in another, and the third empty.
+func TestSmallRatioAcrossThreeDCs(t *testing.T) {
+	for _, placement := range []string{"000", "200", "211", "011"} {
+		for a := 0; a < 3; a++ {
+			for b := 0; b < 3; b++ {
+				for p := 0; p < 3; p++ {
+					t.Run(fmt.Sprintf("%s/%d%d%d", placement, a, b, p), func(t *testing.T) {
+						topo := NewTopology()
+						for i := 0; i < 3; i++ {
+							id := fmt.Sprintf("node%d", i)
+							dc := fmt.Sprintf("dc%d", i)
+							n := topo.AddNode(id, dc, dc+":rack1", 100)
+							n.AddDisk(0, "ssd", 100, 0)
+						}
+						for shard, node := range []int{a, b, p} {
+							topo.nodes[fmt.Sprintf("node%d", node)].AddShards(7, "test", 0, bits(shard))
+						}
+						for _, node := range topo.nodes {
+							occupied := volumeShardCount(node, volKey{collection: "test", vid: 7})
+							node.freeSlots -= occupied
+							node.disks[0].freeSlots -= occupied
+							node.disks[0].shardCount = occupied
+						}
+						rp, err := super_block.NewReplicaPlacementFromString(placement)
+						if err != nil {
+							t.Fatal(err)
+						}
+						// Use the volume-specific ratio reported by Enterprise, even
+						// when the collection fallback has the OSS default of 10+4.
+						opts := Options{DiskType: "ssd", ReplicaPlacement: rp, Ratio: ratio(10, 4),
+							VolumeRatio: func(string, uint32) (int, int) { return 2, 1 }}
+						moves := Plan(topo, opts)
+						vk := volKey{collection: "test", vid: 7}
+						for id, node := range topo.nodes {
+							if got := volumeShardCount(node, vk); got != 1 {
+								t.Errorf("%s holds %d shards, want 1; moves=%+v", id, got, moves)
+							}
+							if node.freeSlots != 99 || node.disks[0].freeSlots != 99 || node.disks[0].shardCount != 1 {
+								t.Errorf("%s: inconsistent capacity after placement: node=%d disk=%+v", id, node.freeSlots, node.disks[0])
+							}
+						}
+						for shard := 0; shard < 3; shard++ {
+							copies := 0
+							for _, node := range topo.nodes {
+								if node.shards[vk] != nil && node.shards[vk].shardBits&bits(shard) != 0 {
+									copies++
+								}
+							}
+							if copies != 1 {
+								t.Errorf("shard %d: got %d copies, want 1", shard, copies)
+							}
+						}
+						if next := Plan(topo, opts); len(next) != 0 {
+							t.Errorf("placement did not converge: %+v", next)
+						}
+					})
+				}
+			}
+		}
+	}
+}
+
+func TestSmallRatioDoesNotMoveParityToFullRack(t *testing.T) {
+	topo := NewTopology()
+	a := topo.AddNode("a", "a", "a:r", 100)
+	a.AddDisk(0, "ssd", 100, 2)
+	a.AddShards(1, "test", 0, bits(0, 2))
+	b := topo.AddNode("b", "b", "b:r", 100)
+	b.AddDisk(0, "ssd", 100, 1)
+	b.AddShards(1, "test", 0, bits(1))
+	c := topo.AddNode("c", "c", "c:r", 0)
+	c.AddDisk(0, "ssd", 0, 0)
+	if moves := Plan(topo, Options{DiskType: "ssd", Ratio: ratio(2, 1)}); len(moves) != 0 {
+		t.Fatalf("no eligible third rack: must not churn or move into a full destination: %+v", moves)
+	}
+}
diff --git a/weed/storage/erasure_coding/ecj_merge.go b/weed/storage/erasure_coding/ecj_merge.go
new file mode 100644
index 0000000000..0cc11517a6
--- /dev/null
+++ b/weed/storage/erasure_coding/ecj_merge.go
@@ -0,0 +1,335 @@
+package erasure_coding
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// An EC volume's deletion journal (<vid>.ecj) is a *set* of deleted needle ids
+// stored as 8-byte big-endian records. Shard copy and index recovery fold a
+// peer's journal into the local one; they must append only the ids the local
+// journal lacks, or every ec_balance round trip doubles the file.
+//
+// The journal is only ever appended to, never replaced: a mounted EcVolume
+// holds it open, and a rename would leave that handle writing to an unlinked
+// inode, losing every later delete at the next mount.
+
+// ErrEcjChanged reports that a journal's length moved between the read that
+// computed a merge delta and the append that would publish it.
+var ErrEcjChanged = errors.New("ec journal changed during merge")
+
+// EcjIdDecoder decodes .ecj records from a byte stream split at arbitrary
+// boundaries (a CopyFile stream, chunked reads), collecting the distinct ids.
+// Memory follows the number of distinct ids, not the journal's length. A
+// trailing partial record is never decoded.
+type EcjIdDecoder struct {
+	ids     map[types.NeedleId]struct{}
+	partial [types.NeedleIdSize]byte
+	pending int
+}
+
+func NewEcjIdDecoder() *EcjIdDecoder {
+	return &EcjIdDecoder{ids: make(map[types.NeedleId]struct{})}
+}
+
+func (d *EcjIdDecoder) Write(p []byte) {
+	if d.pending > 0 {
+		n := copy(d.partial[d.pending:], p)
+		d.pending += n
+		p = p[n:]
+		if d.pending < types.NeedleIdSize {
+			return
+		}
+		d.ids[types.BytesToNeedleId(d.partial[:])] = struct{}{}
+		d.pending = 0
+	}
+	whole := len(p) - len(p)%types.NeedleIdSize
+	for i := 0; i < whole; i += types.NeedleIdSize {
+		d.ids[types.BytesToNeedleId(p[i:i+types.NeedleIdSize])] = struct{}{}
+	}
+	d.pending = copy(d.partial[:], p[whole:])
+}
+
+func (d *EcjIdDecoder) Ids() map[types.NeedleId]struct{} {
+	return d.ids
+}
+
+// ReadEcjIds reads the distinct ids of the journal at path in bounded chunks.
+// A missing file reads as empty. size is the whole-record length read; a torn
+// trailing partial record is excluded from it.
+func ReadEcjIds(path string) (ids map[types.NeedleId]struct{}, size int64, err error) {
+	f, err := os.Open(path)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return make(map[types.NeedleId]struct{}), 0, nil
+		}
+		return nil, 0, err
+	}
+	defer f.Close()
+	fi, err := f.Stat()
+	if err != nil {
+		return nil, 0, err
+	}
+	size = fi.Size() - fi.Size()%int64(types.NeedleIdSize)
+	d := NewEcjIdDecoder()
+	buf := make([]byte, min(int64(ecjLoadChunkBytes), size))
+	for off := int64(0); off < size; {
+		want := min(int64(len(buf)), size-off)
+		if _, err := f.ReadAt(buf[:want], off); err != nil {
+			return nil, 0, fmt.Errorf("read %s at %d: %w", path, off, err)
+		}
+		d.Write(buf[:want])
+		off += want
+	}
+	return d.Ids(), size, nil
+}
+
+// ecjDelta returns the ids of incoming that has does not report, ascending,
+// so a merge appends deterministic output.
+func ecjDelta(incoming map[types.NeedleId]struct{}, has func(types.NeedleId) bool) []types.NeedleId {
+	var delta []types.NeedleId
+	for id := range incoming {
+		if !has(id) {
+			delta = append(delta, id)
+		}
+	}
+	slices.Sort(delta)
+	return delta
+}
+
+func encodeEcjIds(ids []types.NeedleId) []byte {
+	b := make([]byte, len(ids)*types.NeedleIdSize)
+	for i, id := range ids {
+		types.NeedleIdToBytes(b[i*types.NeedleIdSize:], id)
+	}
+	return b
+}
+
+// AppendEcjIds appends to the journal at path the ids of incoming that local
+// lacks, in one write and one fsync, rolling the write back if the fsync
+// fails. It is WriteEcjIds followed by EcjAppend.Sync; see WriteEcjIds for the
+// contract.
+func AppendEcjIds(path string, local, incoming map[types.NeedleId]struct{}, size int64) (added int, err error) {
+	a, err := WriteEcjIds(path, local, incoming, size)
+	if a == nil || err != nil {
+		return 0, err
+	}
+	if err := a.Sync(); err != nil {
+		a.Rollback()
+		return 0, err
+	}
+	a.Close()
+	return a.Added, nil
+}
+
+// EcjAppend is a journal append WriteEcjIds wrote but did not sync. The owner
+// must end it with Close (after a successful Sync) or Rollback.
+type EcjAppend struct {
+	Added   int
+	f       *os.File
+	path    string
+	size    int64 // whole-record length before the append
+	delta   []types.NeedleId
+	created bool
+}
+
+// WriteEcjIds appends to the journal at path the ids of incoming that local
+// lacks, in one write, without syncing; it returns nil when there is nothing
+// to add. It is for a journal no EcVolume has open; a mounted volume merges
+// through EcVolume.MergeJournal instead. local and size come from ReadEcjIds
+// on the same path: if the journal's whole-record length is no longer size,
+// it returns ErrEcjChanged so the caller re-reads. A torn tail past size is
+// truncated first so the new records stay aligned.
+func WriteEcjIds(path string, local, incoming map[types.NeedleId]struct{}, size int64) (*EcjAppend, error) {
+	delta := ecjDelta(incoming, func(id types.NeedleId) bool {
+		_, ok := local[id]
+		return ok
+	})
+	if len(delta) == 0 {
+		return nil, nil
+	}
+	_, statErr := os.Stat(path)
+	created := os.IsNotExist(statErr)
+	f, err := backend.OpenVolumeFile(path, os.O_RDWR|os.O_CREATE)
+	if err != nil {
+		return nil, fmt.Errorf("open %s: %w", path, err)
+	}
+	a := &EcjAppend{Added: len(delta), f: f, path: path, size: size, delta: delta, created: created}
+	fi, err := f.Stat()
+	if err != nil {
+		a.Close()
+		return nil, fmt.Errorf("stat %s: %w", path, err)
+	}
+	if fi.Size()-fi.Size()%int64(types.NeedleIdSize) != size {
+		a.Close()
+		return nil, ErrEcjChanged
+	}
+	if fi.Size() != size {
+		if err := f.Truncate(size); err != nil {
+			a.Close()
+			return nil, fmt.Errorf("truncate torn tail of %s: %w", path, err)
+		}
+	}
+	if _, err := f.WriteAt(encodeEcjIds(delta), size); err != nil {
+		_ = f.Truncate(size)
+		a.Close()
+		return nil, fmt.Errorf("append %s: %w", path, err)
+	}
+	return a, nil
+}
+
+// Sync makes the append durable, including the journal's directory entry if
+// the append created it.
+func (a *EcjAppend) Sync() error {
+	if err := a.f.Sync(); err != nil {
+		return fmt.Errorf("sync %s: %w", a.path, err)
+	}
+	if a.created {
+		if err := util.FsyncDir(filepath.Dir(a.path)); err != nil {
+			return fmt.Errorf("fsync dir for %s: %w", a.path, err)
+		}
+	}
+	return nil
+}
+
+// Rollback removes the append, for a journal no EcVolume has open, and closes
+// it. See RollbackUnsynced.
+func (a *EcjAppend) Rollback() {
+	a.RollbackUnsynced(nil)
+	a.Close()
+}
+
+// RollbackUnsynced removes an append whose fsync failed and reports whether it
+// did. holders are the mounted volumes that opened the journal since the write
+// (none can predate it: the write happens only while none is mounted); each
+// loaded the append's records, and they leave its in-memory set too, so disk
+// and memory agree the merge did not happen and a retried merge appends and
+// syncs them again. The caller must exclude new mounts and other unmounted
+// merges into the path.
+//
+// Invariant: only the journal's actual length decides, never a holder's cached
+// ecjFileSize, which another holder's appends leave stale. With every holder's
+// ecjFileAccessLock held nothing can append, so if the length is still this
+// append's end, its records are the tail and removing them loses nothing. If
+// anything follows them, it changes nothing and returns false; the caller then
+// keeps the records and rewrites and syncs them (Rewrite, Sync), or, if that
+// fails too, takes the ids back out of the holders' sets with Unpublish.
+func (a *EcjAppend) RollbackUnsynced(holders []*EcVolume) bool {
+	for _, ev := range holders {
+		ev.ecjFileAccessLock.Lock()
+		defer ev.ecjFileAccessLock.Unlock()
+	}
+	if fi, err := a.f.Stat(); err != nil || fi.Size() != a.end() {
+		return false
+	}
+	if err := a.f.Truncate(a.size); err != nil {
+		return false
+	}
+	for _, ev := range holders {
+		if ev.ecjFile != nil { // closed: it serves nothing and journals nothing
+			ev.ecjFileSize = a.size
+		}
+	}
+	a.forget(holders)
+	return true
+}
+
+// Unpublish takes the append's ids back out of the holders' deleted sets, for
+// records that could neither be removed nor made durable. The records stay in
+// the file, where they are legitimate deletes, but as in DeleteNeedleFromEcx a
+// set only claims ids whose record is known durable: a retried merge then
+// sees them missing and appends and syncs them again.
+func (a *EcjAppend) Unpublish(holders []*EcVolume) {
+	for _, ev := range holders {
+		ev.ecjFileAccessLock.Lock()
+		defer ev.ecjFileAccessLock.Unlock()
+	}
+	a.forget(holders)
+}
+
+// forget removes the append's ids from the holders' deleted sets. Each holder
+// loaded exactly the ids read before the append, which exclude the delta, plus
+// the delta; it cannot have journaled a delta id itself, as it already held
+// them all. So every delta id in a holder's set came from this append. Callers
+// hold every holder's ecjFileAccessLock.
+func (a *EcjAppend) forget(holders []*EcVolume) {
+	for _, ev := range holders {
+		ev.deletedNeedlesLock.Lock()
+		for _, id := range a.delta {
+			delete(ev.deletedNeedles, id)
+		}
+		ev.deletedNeedlesLock.Unlock()
+	}
+}
+
+// Rewrite writes the append's records again in place, for records that later
+// ones now follow and so cannot be removed; a Sync after it makes them
+// durable. A bare second fsync would prove nothing: after a failed writeback
+// the kernel may have dropped the pages or marked them clean and still report
+// the next fsync as clean. Rewriting the same bytes dirties them again.
+// Writing outside the locks is safe: appends land past these records, and
+// every other truncate (a holder's failed append, a mount's torn-tail repair)
+// lands at or past their end, since each holder loaded at least that much.
+func (a *EcjAppend) Rewrite() error {
+	if fi, err := a.f.Stat(); err != nil {
+		return fmt.Errorf("stat %s: %w", a.path, err)
+	} else if fi.Size() < a.end() {
+		return fmt.Errorf("%s shrank below the merged records", a.path)
+	}
+	if _, err := a.f.WriteAt(encodeEcjIds(a.delta), a.size); err != nil {
+		return fmt.Errorf("rewrite %s: %w", a.path, err)
+	}
+	return nil
+}
+
+func (a *EcjAppend) end() int64 {
+	return a.size + int64(len(a.delta)*types.NeedleIdSize)
+}
+
+// Close releases the journal, keeping whatever the append wrote.
+func (a *EcjAppend) Close() {
+	_ = a.f.Close()
+}
+
+// MergeJournal folds a peer's deletion journal into this mounted volume. Under
+// ecjFileAccessLock it appends only the ids not already deleted here, in one
+// write and one fsync, then publishes them into the in-memory set — the same
+// commit order as DeleteNeedleFromEcx, which it serializes with. The live
+// handle is appended to in place, so no delete can land in an orphaned file.
+func (ev *EcVolume) MergeJournal(ids map[types.NeedleId]struct{}) (added int, err error) {
+	ev.ecjFileAccessLock.Lock()
+	defer ev.ecjFileAccessLock.Unlock()
+	if ev.ecjFile == nil {
+		return 0, fmt.Errorf("ec volume %d closed", ev.VolumeId)
+	}
+	delta := ecjDelta(ids, ev.IsNeedleDeleted)
+	if len(delta) == 0 {
+		return 0, nil
+	}
+	if err := ev.appendJournalLocked(encodeEcjIds(delta)); err != nil {
+		return 0, err
+	}
+	ev.deletedNeedlesLock.Lock()
+	for _, id := range delta {
+		ev.deletedNeedles[id] = struct{}{}
+	}
+	ev.deletedNeedlesLock.Unlock()
+	return len(delta), nil
+}
+
+// PublishMergedIds marks ids deleted in memory only, for runtimes sharing a
+// journal another runtime already appended them to.
+func (ev *EcVolume) PublishMergedIds(ids map[types.NeedleId]struct{}) {
+	ev.deletedNeedlesLock.Lock()
+	for id := range ids {
+		ev.deletedNeedles[id] = struct{}{}
+	}
+	ev.deletedNeedlesLock.Unlock()
+}
diff --git a/weed/storage/erasure_coding/ecj_merge_test.go b/weed/storage/erasure_coding/ecj_merge_test.go
new file mode 100644
index 0000000000..d845762c08
--- /dev/null
+++ b/weed/storage/erasure_coding/ecj_merge_test.go
@@ -0,0 +1,262 @@
+package erasure_coding_test
+
+import (
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	erasure_coding "github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func idSet(ids ...types.NeedleId) map[types.NeedleId]struct{} {
+	s := make(map[types.NeedleId]struct{}, len(ids))
+	for _, id := range ids {
+		s[id] = struct{}{}
+	}
+	return s
+}
+
+func readEcjRecords(t *testing.T, path string) []types.NeedleId {
+	t.Helper()
+	data, err := os.ReadFile(path)
+	require.NoError(t, err)
+	require.Zero(t, len(data)%types.NeedleIdSize, "journal must stay aligned")
+	var ids []types.NeedleId
+	for i := 0; i+types.NeedleIdSize <= len(data); i += types.NeedleIdSize {
+		ids = append(ids, types.BytesToNeedleId(data[i:i+types.NeedleIdSize]))
+	}
+	return ids
+}
+
+// mergeFile runs the unmounted merge the way the store does: read, then append.
+func mergeFile(t *testing.T, path string, incoming map[types.NeedleId]struct{}) int {
+	t.Helper()
+	local, size, err := erasure_coding.ReadEcjIds(path)
+	require.NoError(t, err)
+	added, err := erasure_coding.AppendEcjIds(path, local, incoming, size)
+	require.NoError(t, err)
+	return added
+}
+
+// A CopyFile stream splits records at arbitrary byte boundaries.
+func TestEcjIdDecoder_RecordsSplitAcrossChunks(t *testing.T) {
+	stream := append(ecjBytes(1, 2, 3, 2, 0x0102030405060708), 9, 9, 9)
+	for chunk := 1; chunk <= len(stream); chunk++ {
+		d := erasure_coding.NewEcjIdDecoder()
+		for off := 0; off < len(stream); off += chunk {
+			d.Write(stream[off:min(off+chunk, len(stream))])
+		}
+		assert.Equal(t, idSet(1, 2, 3, 0x0102030405060708), d.Ids(), "chunk size %d", chunk)
+	}
+}
+
+func TestReadEcjIds(t *testing.T) {
+	dir := t.TempDir()
+
+	ids, size, err := erasure_coding.ReadEcjIds(filepath.Join(dir, "missing.ecj"))
+	require.NoError(t, err)
+	assert.Empty(t, ids)
+	assert.Zero(t, size)
+
+	torn := filepath.Join(dir, "torn.ecj")
+	require.NoError(t, os.WriteFile(torn, append(ecjBytes(1, 2, 1), 7, 7, 7), 0644))
+	ids, size, err = erasure_coding.ReadEcjIds(torn)
+	require.NoError(t, err)
+	assert.Equal(t, idSet(1, 2), ids)
+	assert.Equal(t, int64(3*types.NeedleIdSize), size, "size covers whole records only")
+
+	// A bloated journal repeating a few ids across several read chunks keeps
+	// only the distinct ids.
+	bloated := filepath.Join(dir, "bloated.ecj")
+	var data []byte
+	for i := 0; i < 300_000; i++ {
+		data = append(data, ecjBytes(types.NeedleId(i%3))...)
+	}
+	require.NoError(t, os.WriteFile(bloated, data, 0644))
+	ids, size, err = erasure_coding.ReadEcjIds(bloated)
+	require.NoError(t, err)
+	assert.Equal(t, idSet(0, 1, 2), ids)
+	assert.Equal(t, int64(len(data)), size)
+}
+
+// Local {1,2,3} + source {3,4} => {1,2,3,4}: only the missing id is appended.
+func TestAppendEcjIds_AppendsOnlyMissingIds(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "vol.ecj")
+	require.NoError(t, os.WriteFile(path, ecjBytes(1, 2, 3), 0644))
+
+	assert.Equal(t, 1, mergeFile(t, path, idSet(3, 4)))
+	assert.Equal(t, []types.NeedleId{1, 2, 3, 4}, readEcjRecords(t, path))
+}
+
+// Copying the same shard A->B->A->B keeps the journal size constant; the old
+// append path doubled it on every trip.
+func TestAppendEcjIds_RoundTripStaysConstant(t *testing.T) {
+	dir := t.TempDir()
+	a := filepath.Join(dir, "a.ecj")
+	b := filepath.Join(dir, "b.ecj")
+	require.NoError(t, os.WriteFile(a, ecjBytes(1, 2), 0644))
+	require.NoError(t, os.WriteFile(b, ecjBytes(2, 3), 0644))
+	for i := 0; i < 20; i++ {
+		src, dst := a, b
+		if i%2 == 1 {
+			src, dst = b, a
+		}
+		ids, _, err := erasure_coding.ReadEcjIds(src)
+		require.NoError(t, err)
+		mergeFile(t, dst, ids)
+	}
+	for _, path := range []string{a, b} {
+		assert.ElementsMatch(t, []types.NeedleId{1, 2, 3}, readEcjRecords(t, path))
+	}
+}
+
+func TestAppendEcjIds_NothingNewLeavesJournalAlone(t *testing.T) {
+	dir := t.TempDir()
+	missing := filepath.Join(dir, "missing.ecj")
+	assert.Zero(t, mergeFile(t, missing, idSet()))
+	assert.NoFileExists(t, missing, "an empty merge must not create a journal")
+
+	path := filepath.Join(dir, "vol.ecj")
+	require.NoError(t, os.WriteFile(path, ecjBytes(1, 2), 0644))
+	assert.Zero(t, mergeFile(t, path, idSet(2, 1)))
+	assert.Equal(t, []types.NeedleId{1, 2}, readEcjRecords(t, path))
+}
+
+func TestAppendEcjIds_RepairsTornTail(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "vol.ecj")
+	require.NoError(t, os.WriteFile(path, append(ecjBytes(1, 2), 9, 9, 9), 0644))
+
+	assert.Equal(t, 1, mergeFile(t, path, idSet(3)))
+	assert.Equal(t, []types.NeedleId{1, 2, 3}, readEcjRecords(t, path))
+}
+
+// A journal that grew after the read must not receive a delta computed
+// against its old contents.
+func TestAppendEcjIds_RejectsChangedJournal(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "vol.ecj")
+	require.NoError(t, os.WriteFile(path, ecjBytes(1), 0644))
+	local, size, err := erasure_coding.ReadEcjIds(path)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(path, ecjBytes(1, 5), 0644))
+
+	_, err = erasure_coding.AppendEcjIds(path, local, idSet(2), size)
+	assert.ErrorIs(t, err, erasure_coding.ErrEcjChanged)
+	assert.Equal(t, []types.NeedleId{1, 5}, readEcjRecords(t, path))
+}
+
+// Rolling back an unsynced append removes exactly its records, but leaves the
+// journal alone once something has been appended after them.
+func TestWriteEcjIds_Rollback(t *testing.T) {
+	for _, appendedAfter := range []bool{false, true} {
+		path := filepath.Join(t.TempDir(), "vol.ecj")
+		require.NoError(t, os.WriteFile(path, ecjBytes(1), 0644))
+		local, size, err := erasure_coding.ReadEcjIds(path)
+		require.NoError(t, err)
+
+		a, err := erasure_coding.WriteEcjIds(path, local, idSet(1, 2), size)
+		require.NoError(t, err)
+		require.Equal(t, 1, a.Added)
+		want := []types.NeedleId{1}
+		if appendedAfter {
+			f, err := os.OpenFile(path, os.O_WRONLY|os.O_APPEND, 0644)
+			require.NoError(t, err)
+			_, err = f.Write(ecjBytes(3))
+			require.NoError(t, err)
+			require.NoError(t, f.Close())
+			want = []types.NeedleId{1, 2, 3}
+		}
+		a.Rollback()
+		assert.Equal(t, want, readEcjRecords(t, path), "appended after: %v", appendedAfter)
+	}
+}
+
+// A mounted volume merges through its own handle: the journal keeps its inode,
+// the in-memory set follows, and later deletes land in the same live file.
+func TestMergeJournal_MountedVolumeAppendsInPlace(t *testing.T) {
+	dir := t.TempDir()
+	var ecx []byte
+	for id := types.NeedleId(1); id <= 5; id++ {
+		ecx = append(ecx, makeNeedleMapEntry(id, types.ToOffset(int64(id)*8), types.Size(100))...)
+	}
+	ev, base := mountEcVolume(t, dir, ecx, ecjBytes(1))
+	before, err := os.Stat(base + ".ecj")
+	require.NoError(t, err)
+
+	added, err := ev.MergeJournal(idSet(1, 2, 3))
+	require.NoError(t, err)
+	assert.Equal(t, 2, added)
+	for _, id := range []types.NeedleId{1, 2, 3} {
+		assert.True(t, ev.IsNeedleDeleted(id), "id %d", id)
+	}
+	_, deleteCount := ev.FileAndDeleteCount()
+	assert.Equal(t, uint64(3), deleteCount)
+
+	added, err = ev.MergeJournal(idSet(2, 3))
+	require.NoError(t, err)
+	assert.Zero(t, added, "a repeated merge appends nothing")
+
+	require.NoError(t, ev.DeleteNeedleFromEcx(4))
+	after, err := os.Stat(base + ".ecj")
+	require.NoError(t, err)
+	assert.True(t, os.SameFile(before, after), "the journal must never be replaced under the open handle")
+	assert.Equal(t, []types.NeedleId{1, 2, 3, 4}, readEcjRecords(t, base+".ecj"))
+	ev.Close()
+
+	ev, _ = mountEcVolume(t, dir, ecx, nil)
+	defer ev.Close()
+	for _, id := range []types.NeedleId{1, 2, 3, 4} {
+		assert.True(t, ev.IsNeedleDeleted(id), "id %d survives remount", id)
+	}
+}
+
+// Deletes racing a merge must all reach the journal, and each id only once.
+func TestMergeJournal_ConcurrentDeletesPersist(t *testing.T) {
+	dir := t.TempDir()
+	const n = 200
+	var ecx []byte
+	for id := types.NeedleId(1); id <= 2*n; id++ {
+		ecx = append(ecx, makeNeedleMapEntry(id, types.ToOffset(int64(id)*8), types.Size(100))...)
+	}
+	ev, base := mountEcVolume(t, dir, ecx, nil)
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for id := types.NeedleId(1); id <= n; id++ {
+			assert.NoError(t, ev.DeleteNeedleFromEcx(id))
+		}
+	}()
+	for id := types.NeedleId(n/2 + 1); id <= 2*n; id += 10 {
+		batch := idSet()
+		for k := id; k < id+10 && k <= 2*n; k++ {
+			batch[k] = struct{}{}
+		}
+		_, err := ev.MergeJournal(batch)
+		require.NoError(t, err)
+	}
+	wg.Wait()
+	ev.Close()
+
+	records := readEcjRecords(t, base+".ecj")
+	assert.Len(t, records, 2*n, "every id journaled exactly once")
+	ids, _, err := erasure_coding.ReadEcjIds(base + ".ecj")
+	require.NoError(t, err)
+	assert.Len(t, ids, 2*n)
+}
+
+// A merge that loses a race with unmount must fail cleanly and must not bring
+// a destroyed journal back.
+func TestMergeJournal_ClosedVolume(t *testing.T) {
+	dir := t.TempDir()
+	ev, base := mountEcVolume(t, dir, makeNeedleMapEntry(1, types.ToOffset(8), types.Size(100)), nil)
+	ev.Destroy()
+
+	_, err := ev.MergeJournal(idSet(1))
+	assert.Error(t, err)
+	assert.NoFileExists(t, base+".ecj")
+}
diff --git a/weed/storage/erasure_coding/ecj_registry.go b/weed/storage/erasure_coding/ecj_registry.go
new file mode 100644
index 0000000000..f676aeccda
--- /dev/null
+++ b/weed/storage/erasure_coding/ecj_registry.go
@@ -0,0 +1,183 @@
+package erasure_coding
+
+import (
+	"path/filepath"
+	"sync"
+)
+
+// Process-wide coordination of everything that touches one .ecj path.
+//
+// Mount-time compaction replaces a deletion journal with a new inode. That is
+// only safe while nothing else in this process can write the old one:
+//
+//   - Holders are mounted EcVolumes with a handle on the path. A store keeps one
+//     EcVolume per disk location, and a shard mount or a cross-disk reconcile
+//     can point one disk's volume at another disk's .ecj, so several holders of
+//     one path are normal. A holder that keeps appending to a replaced inode
+//     acknowledges deletes that are gone at the next mount.
+//   - Writers append to or replace the path by name without holding it open
+//     across calls: ReceiveFile of an EC .ecj, and the unmounted append in
+//     Store.MergeEcJournal, which VolumeEcShardsCopy and EC index recovery
+//     funnel a peer's journal through.
+//     Bytes they write after the compactor sized the journal would be dropped
+//     by the rename.
+//
+// Compaction therefore runs only while its caller is the sole holder and no
+// writer is active, and while it runs no holder may open the path and no writer
+// may start. Both wait instead; a compaction rewrites only the distinct id set,
+// so the wait is short.
+//
+// No writer active at the reservation is not enough: one that ran while the
+// holder loaded the journal, or after, and has finished may have rewritten it
+// in place to the same length (ReceiveFile truncates and refills), which the
+// inode-and-size re-check cannot see. So each writer bumps the path's write
+// generation as it starts, and a holder may compact only if no writer was
+// active when it registered and the generation has not moved since.
+//
+// Paths are keyed by their resolved parent directory, so two disk locations
+// that spell one directory differently still meet here.
+
+type ecjPathState struct {
+	holders    int
+	writers    int
+	compacting bool
+	// writeGen counts writers that have started on the path. It survives as
+	// long as the entry does, and a registered holder keeps the entry.
+	writeGen uint64
+}
+
+var ecjPaths = struct {
+	sync.Mutex
+	changed *sync.Cond
+	state   map[string]*ecjPathState
+}{state: map[string]*ecjPathState{}}
+
+func init() {
+	ecjPaths.changed = sync.NewCond(&ecjPaths.Mutex)
+}
+
+// ecjPathKey resolves the parent directory of path. The file itself may not
+// exist yet (a copy creates it), so only the directory is resolved.
+func ecjPathKey(path string) string {
+	dir, name := filepath.Split(path)
+	if dir == "" {
+		dir = "."
+	}
+	if abs, err := filepath.Abs(dir); err == nil {
+		dir = abs
+	}
+	if resolved, err := filepath.EvalSymlinks(dir); err == nil {
+		dir = resolved
+	}
+	return filepath.Join(dir, name)
+}
+
+// ecjUpdateWhenNotCompacting blocks until no compaction is running on key,
+// then applies f to its state.
+func ecjUpdateWhenNotCompacting(key string, f func(*ecjPathState)) {
+	ecjPaths.Lock()
+	defer ecjPaths.Unlock()
+	for {
+		st := ecjPaths.state[key]
+		if st == nil {
+			st = &ecjPathState{}
+			ecjPaths.state[key] = st
+		}
+		if !st.compacting {
+			f(st)
+			return
+		}
+		ecjPaths.changed.Wait()
+	}
+}
+
+func ecjRelease(key string, f func(*ecjPathState)) {
+	ecjPaths.Lock()
+	if st := ecjPaths.state[key]; st != nil {
+		f(st)
+		if st.holders == 0 && st.writers == 0 && !st.compacting {
+			delete(ecjPaths.state, key)
+		}
+	}
+	ecjPaths.Unlock()
+	ecjPaths.changed.Broadcast()
+}
+
+// ecjHold is a mounted EcVolume's registration as a holder of its .ecj.
+type ecjHold struct {
+	key  string
+	once sync.Once
+	// The path's write generation when the hold was taken, and whether a
+	// writer was active then. Taken before the journal is opened and loaded,
+	// so they cover every write the load might have missed.
+	writeGen      uint64
+	writerAtStart bool
+}
+
+// acquireEcjHold registers a holder of ecjPath, first waiting out any
+// compaction in progress so the handle opened afterwards is on the final inode.
+func acquireEcjHold(ecjPath string) *ecjHold {
+	h := &ecjHold{key: ecjPathKey(ecjPath)}
+	ecjUpdateWhenNotCompacting(h.key, func(st *ecjPathState) {
+		st.holders++
+		h.writeGen = st.writeGen
+		h.writerAtStart = st.writers > 0
+	})
+	return h
+}
+
+func (h *ecjHold) release() {
+	h.once.Do(func() {
+		ecjRelease(h.key, func(st *ecjPathState) {
+			if st.holders > 0 {
+				st.holders--
+			}
+		})
+	})
+}
+
+// tryBeginCompaction reserves the path for a compaction, or reports false when
+// another holder or an active writer could still reach the current inode, or
+// when a writer has run on the path since the hold was taken, so the journal
+// may no longer be what the holder loaded. The returned func ends the
+// reservation.
+func (h *ecjHold) tryBeginCompaction() (end func(), ok bool) {
+	ecjPaths.Lock()
+	defer ecjPaths.Unlock()
+	st := ecjPaths.state[h.key]
+	if st == nil || st.holders != 1 || st.writers != 0 || st.compacting {
+		return nil, false
+	}
+	if h.writerAtStart || st.writeGen != h.writeGen {
+		return nil, false
+	}
+	st.compacting = true
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			ecjRelease(h.key, func(st *ecjPathState) { st.compacting = false })
+		})
+	}, true
+}
+
+// BeginEcjWrite registers an out-of-band writer (shard copy, index recovery,
+// ReceiveFile) of ecjPath, waiting out any compaction in progress. Compaction
+// does not start until the returned func is called, so call it once the write,
+// and any cleanup of a partial file, is done.
+func BeginEcjWrite(ecjPath string) (done func()) {
+	key := ecjPathKey(ecjPath)
+	ecjUpdateWhenNotCompacting(key, func(st *ecjPathState) {
+		st.writers++
+		st.writeGen++
+	})
+	var once sync.Once
+	return func() {
+		once.Do(func() {
+			ecjRelease(key, func(st *ecjPathState) {
+				if st.writers > 0 {
+					st.writers--
+				}
+			})
+		})
+	}
+}
diff --git a/weed/storage/erasure_coding/verification.go b/weed/storage/erasure_coding/verification.go
index caf5401542..76c52a2e13 100644
--- a/weed/storage/erasure_coding/verification.go
+++ b/weed/storage/erasure_coding/verification.go
@@ -14,6 +14,11 @@ import (
 type ServerShardInventory struct {
 	Bits       ShardBits
 	QueryError error
+	// BlockSize is the shard block layout this holder reports for the volume —
+	// the one it will serve reads through. A binary predating the uniform
+	// layout drops the field off the wire and reports 0, which is how
+	// RequireAgreedBlockLayout tells such a holder from one that agrees.
+	BlockSize int64
 }
 
 // Query errors are recorded per-server and treated as zero shards rather
@@ -50,6 +55,7 @@ func VerifyShardsAcrossServers(ctx context.Context, volumeID uint32,
 					}
 					inv.Bits = inv.Bits.Set(ShardId(s.ShardId))
 				}
+				inv.BlockSize = resp.GetEcShardConfig().GetBlockSize()
 				return nil
 			})
 		if callErr != nil {
@@ -99,6 +105,39 @@ func RequireRecoverableShardSet(volumeID uint32, shardsPresent ShardBits, dataSh
 		volumeID, totalShards-len(missing), totalShards, dataShards, missing)
 }
 
+// RequireAgreedBlockLayout gates source-volume deletion on every holder that
+// answered agreeing with the layout the shards were encoded under.
+//
+// The uniform block layout lives in a `.vif` field that older volume servers
+// have never heard of: such a server parses the file, silently discards the
+// unknown field, and mounts the volume on the legacy 1GiB/1MiB striping. Its
+// reads then land at the wrong shard offsets and return wrong bytes, and
+// nothing else in the encode path notices — the shard files are the same
+// length under either layout. Asking each holder which layout it is serving is
+// the one question that separates the two, and asking it here means the answer
+// arrives while the source .dat is still on disk.
+//
+// Holders that could not be reached, or that report no shard of this volume,
+// are skipped: RequireRecoverableShardSet already covers a missing holder, and
+// one that answered nothing has promised nothing.
+func RequireAgreedBlockLayout(volumeID uint32, encodedBlockSize int64, perServer map[string]ServerShardInventory) error {
+	disagreeing := make([]string, 0, len(perServer))
+	for server, inv := range perServer {
+		if inv.QueryError != nil || inv.Bits.Count() == 0 {
+			continue
+		}
+		if inv.BlockSize != encodedBlockSize {
+			disagreeing = append(disagreeing, fmt.Sprintf("%s serves block size %d", server, inv.BlockSize))
+		}
+	}
+	if len(disagreeing) == 0 {
+		return nil
+	}
+	sort.Strings(disagreeing)
+	return fmt.Errorf("volume %d was encoded with shard block size %d but %v; upgrade every volume server to a build that understands the uniform shard block layout before encoding",
+		volumeID, encodedBlockSize, disagreeing)
+}
+
 func SummarizeShardInventory(perServer map[string]ServerShardInventory) string {
 	servers := make([]string, 0, len(perServer))
 	for s := range perServer {
@@ -137,3 +176,59 @@ func SummarizeShardInventory(perServer map[string]ServerShardInventory) string {
 	}
 	return string(b)
 }
+
+// VerifyShardsOnServer confirms one server really holds the named shards of a
+// specific (collection, volume), for callers about to delete another copy.
+//
+// Collection is checked, unlike in VerifyShardsAcrossServers: the inventory RPC
+// is keyed by volume id alone, so a server answering for volume N says nothing
+// about which collection's volume N it means. Approving a delete on the
+// strength of a different collection's shard would remove the last real copy —
+// the exact outcome the caller is trying to prevent.
+//
+// A server that cannot be queried is unknown, not confirmed, and returns an
+// error: treating an unreachable peer as proof of a surviving copy is how a
+// network blip becomes data loss.
+// CollectShardsOnServer asks one volume server which shards of the volume it
+// actually serves right now — its live inventory, as opposed to what the
+// master's possibly stale topology claims for it.
+func CollectShardsOnServer(ctx context.Context, collection string, volumeID uint32,
+	server string, dialOption grpc.DialOption) (present ShardBits, err error) {
+	err = operation.WithVolumeServerClient(false, pb.ServerAddress(server), dialOption,
+		func(client volume_server_pb.VolumeServerClient) error {
+			resp, e := client.VolumeEcShardsInfo(ctx, &volume_server_pb.VolumeEcShardsInfoRequest{
+				VolumeId: volumeID,
+			})
+			if e != nil {
+				return e
+			}
+			for _, s := range resp.EcShardInfos {
+				if s.VolumeId != volumeID || s.Collection != collection || s.ShardId >= MaxShardCount {
+					continue
+				}
+				present = present.Set(ShardId(s.ShardId))
+			}
+			return nil
+		})
+	return present, err
+}
+
+func VerifyShardsOnServer(ctx context.Context, collection string, volumeID uint32,
+	server string, shardIDs []uint32, dialOption grpc.DialOption) error {
+
+	if server == "" {
+		return fmt.Errorf("no server given to verify volume %d shard(s) %v", volumeID, shardIDs)
+	}
+
+	present, callErr := CollectShardsOnServer(ctx, collection, volumeID, server, dialOption)
+	if callErr != nil {
+		return fmt.Errorf("verify volume %d shard(s) %v on %s: %w", volumeID, shardIDs, server, callErr)
+	}
+
+	for _, sid := range shardIDs {
+		if !present.Has(ShardId(sid)) {
+			return fmt.Errorf("%s does not hold ec shard %d.%d of collection %q", server, volumeID, sid, collection)
+		}
+	}
+	return nil
+}
diff --git a/weed/storage/io_error.go b/weed/storage/io_error.go
new file mode 100644
index 0000000000..75f99bbb62
--- /dev/null
+++ b/weed/storage/io_error.go
@@ -0,0 +1,75 @@
+package storage
+
+import (
+	"errors"
+	"sync"
+	"syscall"
+
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+)
+
+const IoErrorTolerance = 3
+
+type IoErrorTracker struct {
+	lastIoError        error
+	lastIoErrorCount   int32
+	ioErrorQuarantined bool
+	lastIoErrorLock    sync.RWMutex
+}
+
+func (t *IoErrorTracker) checkReadWriteError(err error) {
+	if err == nil {
+		t.clearIoError()
+		return
+	}
+	if isStorageIoError(err) {
+		t.noteIoError(err)
+		return
+	}
+	t.clearIoError()
+}
+
+func isStorageIoError(err error) bool {
+	if errors.Is(err, syscall.EIO) {
+		return true
+	}
+	if isWindowsStorageIoError(err) {
+		return true
+	}
+	return false
+}
+
+func (t *IoErrorTracker) noteIoError(err error) {
+	t.lastIoErrorLock.Lock()
+	defer t.lastIoErrorLock.Unlock()
+	t.lastIoError = err
+	t.lastIoErrorCount++
+	stats.VolumeServerStorageIoErrorCounter.Inc()
+}
+
+func (t *IoErrorTracker) clearIoError() {
+	t.lastIoErrorLock.Lock()
+	defer t.lastIoErrorLock.Unlock()
+	t.lastIoError = nil
+	t.lastIoErrorCount = 0
+}
+
+func (t *IoErrorTracker) resetIoErrorState() {
+	t.lastIoErrorLock.Lock()
+	defer t.lastIoErrorLock.Unlock()
+	t.lastIoError = nil
+	t.lastIoErrorCount = 0
+	t.ioErrorQuarantined = false
+}
+
+func (t *IoErrorTracker) markIoQuarantined() {
+	t.lastIoErrorLock.Lock()
+	defer t.lastIoErrorLock.Unlock()
+	t.ioErrorQuarantined = true
+}
+
+func (t *IoErrorTracker) getIoErrorState() (error, int32, bool) {
+	t.lastIoErrorLock.RLock()
+	defer t.lastIoErrorLock.RUnlock()
+	return t.lastIoError, t.lastIoErrorCount, t.ioErrorQuarantined
+}
diff --git a/weed/storage/io_error_other.go b/weed/storage/io_error_other.go
new file mode 100644
index 0000000000..ed5aa013f7
--- /dev/null
+++ b/weed/storage/io_error_other.go
@@ -0,0 +1,7 @@
+//go:build !windows
+
+package storage
+
+func isWindowsStorageIoError(err error) bool {
+	return false
+}
diff --git a/weed/storage/io_error_windows.go b/weed/storage/io_error_windows.go
new file mode 100644
index 0000000000..4ebc0af56a
--- /dev/null
+++ b/weed/storage/io_error_windows.go
@@ -0,0 +1,23 @@
+//go:build windows
+
+package storage
+
+import (
+	"errors"
+	"syscall"
+)
+
+const (
+	errERROR_CRC       = syscall.Errno(23)
+	errERROR_IO_DEVICE = syscall.Errno(1117)
+)
+
+func isWindowsStorageIoError(err error) bool {
+	if errors.Is(err, errERROR_CRC) {
+		return true
+	}
+	if errors.Is(err, errERROR_IO_DEVICE) {
+		return true
+	}
+	return false
+}
diff --git a/weed/storage/needle/needle_parse_upload_alloc_test.go b/weed/storage/needle/needle_parse_upload_alloc_test.go
index 3b65c289a2..2d33ddc2d8 100644
--- a/weed/storage/needle/needle_parse_upload_alloc_test.go
+++ b/weed/storage/needle/needle_parse_upload_alloc_test.go
@@ -27,11 +27,11 @@ func TestEagerPreGrow(t *testing.T) {
 	const sizeLimit = int64(256 * 1024 * 1024)
 
 	cases := []struct {
-		name        string
-		startCap    int
-		cl          int64
-		wantMinCap  int
-		wantNoop    bool // post: cap stays at startCap
+		name       string
+		startCap   int
+		cl         int64
+		wantMinCap int
+		wantNoop   bool // post: cap stays at startCap
 	}{
 		{
 			name:       "small content-length grows exactly",
diff --git a/weed/storage/needle/needle_read.go b/weed/storage/needle/needle_read.go
index c771aadb43..860eaee3e6 100644
--- a/weed/storage/needle/needle_read.go
+++ b/weed/storage/needle/needle_read.go
@@ -39,6 +39,9 @@ func (n *Needle) DiskSize(version Version) int64 {
 
 func ReadNeedleBlob(r backend.BackendStorageFile, offset int64, size Size, version Version) (dataSlice []byte, err error) {
 
+	if size.IsDeleted() {
+		return nil, fmt.Errorf("invalid needle size %d: %w", size, ErrorSizeInvalid)
+	}
 	dataSize := GetActualSize(size, version)
 	dataSlice = make([]byte, int(dataSize))
 
@@ -224,8 +227,14 @@ func (n *Needle) ReadNeedleBody(r backend.BackendStorageFile, version Version, o
 
 func (n *Needle) ReadNeedleBodyBytes(needleBody []byte, version Version) (err error) {
 
-	if len(needleBody) <= 0 {
-		return nil
+	// n.Size comes from the on-disk header, so a corrupted header can carry a
+	// negative size or one the body cannot hold along with its tail. Deriving
+	// the tail from the version's own layout keeps the bound exact for every
+	// on-disk format.
+	tailSize := NeedleBodyLength(n.Size, version) - int64(n.Size) - int64(PaddingLength(n.Size, version))
+	if n.Size < 0 || int64(n.Size)+tailSize > int64(len(needleBody)) {
+		stats.VolumeServerHandlerCounter.WithLabelValues(stats.ErrorIndexOutOfRange).Inc()
+		return fmt.Errorf("needle %v size %d out of range for body length %d: %w", n.Id, n.Size, len(needleBody), ErrorCorrupted)
 	}
 	switch version {
 	case Version1:
diff --git a/weed/storage/needle/needle_read_test.go b/weed/storage/needle/needle_read_test.go
new file mode 100644
index 0000000000..213b4ba6ba
--- /dev/null
+++ b/weed/storage/needle/needle_read_test.go
@@ -0,0 +1,105 @@
+package needle
+
+import (
+	"bytes"
+	"errors"
+	"strings"
+	"testing"
+
+	. "github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// readNeedleBodyBytes runs ReadNeedleBodyBytes and turns a panic into a test
+// failure, so a regression reports which case broke instead of killing the run.
+func readNeedleBodyBytes(t *testing.T, n *Needle, body []byte, version Version) (err error) {
+	t.Helper()
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("ReadNeedleBodyBytes panicked for size %d, body length %d: %v", n.Size, len(body), r)
+		}
+	}()
+	return n.ReadNeedleBodyBytes(body, version)
+}
+
+// The size feeds the read buffer's length, so a negative one never reaches make().
+func TestReadNeedleBlobRejectsNegativeSize(t *testing.T) {
+	for _, version := range []Version{Version1, Version2, Version3} {
+		for _, size := range []Size{TombstoneFileSize, -100} {
+			if _, err := ReadNeedleBlob(nil, 0, size, version); !errors.Is(err, ErrorSizeInvalid) {
+				t.Fatalf("version %d size %d: expected ErrorSizeInvalid, got %v", version, size, err)
+			}
+		}
+	}
+}
+
+// A corrupted .dat header can carry a size that does not fit the body read for
+// it. Vacuum used to panic on it with "slice bounds out of range [:-1]" (#6763).
+func TestReadNeedleBodyBytesRejectsCorruptSize(t *testing.T) {
+	for version := Version1; IsSupportedVersion(version); version++ {
+		t.Run(versionString(version), func(t *testing.T) {
+			// A size of -1 is the case from #6763: its body length is still
+			// positive, so the scan reads a body and hands it over.
+			bodyLength := NeedleBodyLength(-1, version)
+			if bodyLength <= 0 {
+				t.Fatalf("expected a positive body length for size -1, got %d", bodyLength)
+			}
+
+			cases := []struct {
+				name string
+				size Size
+				body int
+			}{
+				{"size -1", -1, int(bodyLength)},
+				{"size -12", -12, 32},
+				{"size larger than body", 64, 32},
+				{"no room for the tail", 32, 32},
+				{"empty body", 0, 0},
+				{"empty body with data size", 1, 0},
+			}
+			for _, c := range cases {
+				t.Run(c.name, func(t *testing.T) {
+					n := &Needle{Size: c.size}
+					err := readNeedleBodyBytes(t, n, make([]byte, c.body), version)
+					if !errors.Is(err, ErrorCorrupted) {
+						t.Fatalf("expected an error wrapping ErrorCorrupted, got %v", err)
+					}
+				})
+			}
+		})
+	}
+}
+
+// The size guard must still accept every record the writer produces,
+// including the size-0 record a delete appends.
+func TestReadNeedleBodyBytesWrittenNeedles(t *testing.T) {
+	for version := Version1; IsSupportedVersion(version); version++ {
+		t.Run(versionString(version), func(t *testing.T) {
+			for _, data := range [][]byte{nil, []byte("hello seaweed")} {
+				written := &Needle{Id: 7, Cookie: 9, Data: data, Checksum: NewCRC(data), AppendAtNs: 42}
+				buf := new(bytes.Buffer)
+				if _, _, err := writeNeedleByVersion(version, written, 0, buf); err != nil {
+					// Some builds can read a version they cannot write; skip
+					// only that recognized case so a real writer regression
+					// still fails the test.
+					if strings.Contains(strings.ToLower(err.Error()), "unsupported version") {
+						t.Skipf("version %d is not writable in this build: %v", version, err)
+					}
+					t.Fatalf("write needle: %v", err)
+				}
+
+				n := new(Needle)
+				n.ParseNeedleHeader(buf.Bytes())
+				body := buf.Bytes()[NeedleHeaderSize:]
+				if int64(len(body)) != NeedleBodyLength(n.Size, version) {
+					t.Fatalf("body length %d, want %d", len(body), NeedleBodyLength(n.Size, version))
+				}
+				if err := readNeedleBodyBytes(t, n, body, version); err != nil {
+					t.Fatalf("read %d-byte needle: %v", len(data), err)
+				}
+				if !bytes.Equal(n.Data, data) {
+					t.Fatalf("data %q, want %q", n.Data, data)
+				}
+			}
+		})
+	}
+}
diff --git a/weed/storage/needle_map.go b/weed/storage/needle_map.go
index 3311e931cb..e13903e180 100644
--- a/weed/storage/needle_map.go
+++ b/weed/storage/needle_map.go
@@ -37,6 +37,23 @@ type NeedleMapper interface {
 	ReadIndexEntry(n int64) (key NeedleId, offset Offset, size Size, err error)
 }
 
+type batchIndexRollbacker interface {
+	truncateIndex(offset int64) error
+}
+
+// batchMapRollbacker restores the in-memory/durable needle mapping without
+// touching the index file: a rolled-back batch rewrites the index wholesale
+// via truncateIndex, so replay-correcting entries are not needed here.
+type batchMapRollbacker interface {
+	removeMapping(key NeedleId) error
+	restoreMapping(key NeedleId, offset Offset, size Size) error
+}
+
+type batchMetricRollbacker interface {
+	snapshotBatchMetrics() batchMapMetricSnapshot
+	restoreBatchMetrics(snapshot batchMapMetricSnapshot)
+}
+
 type baseNeedleMapper struct {
 	mapMetric
 
@@ -75,6 +92,17 @@ func (nm *baseNeedleMapper) Sync() error {
 	return nm.indexFile.Sync()
 }
 
+func (nm *baseNeedleMapper) truncateIndex(offset int64) error {
+	nm.indexFileAccessLock.Lock()
+	defer nm.indexFileAccessLock.Unlock()
+
+	if err := nm.indexFile.Truncate(offset); err != nil {
+		return err
+	}
+	nm.indexFileOffset = offset
+	return nil
+}
+
 func (nm *baseNeedleMapper) ReadIndexEntry(n int64) (key NeedleId, offset Offset, size Size, err error) {
 	bytes := make([]byte, NeedleMapEntrySize)
 	var readCount int
diff --git a/weed/storage/needle_map/compact_map.go b/weed/storage/needle_map/compact_map.go
index df3c86d250..7b7169064b 100644
--- a/weed/storage/needle_map/compact_map.go
+++ b/weed/storage/needle_map/compact_map.go
@@ -190,6 +190,23 @@ func (cs *CompactMapSegment) delete(key types.NeedleId) types.Size {
 	return types.Size(0)
 }
 
+// remove erases a map entry entirely, returning whether it existed.
+func (cs *CompactMapSegment) remove(key types.NeedleId) bool {
+	i, found := cs.bsearchKey(key)
+	if !found {
+		return false
+	}
+	copy(cs.list[i:], cs.list[i+1:])
+	cs.list = cs.list[:len(cs.list)-1]
+	if len(cs.list) == 0 {
+		cs.firstKey, cs.lastKey = MaxCompactKey, 0
+	} else {
+		cs.firstKey = cs.list[0].key
+		cs.lastKey = cs.list[len(cs.list)-1].key
+	}
+	return true
+}
+
 func NewCompactMap() *CompactMap {
 	return &CompactMap{
 		segments: map[Chunk]*CompactMapSegment{},
@@ -273,6 +290,20 @@ func (cm *CompactMap) Delete(key types.NeedleId) types.Size {
 	return cs.delete(key)
 }
 
+// Remove erases a map entry entirely, returning whether it existed. Unlike
+// Delete it leaves no tombstoned entry behind.
+func (cm *CompactMap) Remove(key types.NeedleId) bool {
+	cm.Lock()
+	defer cm.Unlock()
+
+	chunk := Chunk(key / SegmentChunkSize)
+	cs, ok := cm.segments[chunk]
+	if !ok {
+		return false
+	}
+	return cs.remove(key)
+}
+
 // AscendingVisit runs a function on all entries, in ascending key order. Returns any errors hit while visiting.
 func (cm *CompactMap) AscendingVisit(visit func(NeedleValue) error) error {
 	cm.RLock()
diff --git a/weed/storage/needle_map/needle_value_map.go b/weed/storage/needle_map/needle_value_map.go
index 067d6358cc..a2a258b384 100644
--- a/weed/storage/needle_map/needle_value_map.go
+++ b/weed/storage/needle_map/needle_value_map.go
@@ -7,6 +7,7 @@ import (
 type NeedleValueMap interface {
 	Set(key NeedleId, offset Offset, size Size) (oldOffset Offset, oldSize Size)
 	Delete(key NeedleId) Size
+	Remove(key NeedleId) bool
 	Get(key NeedleId) (*NeedleValue, bool)
 	AscendingVisit(visit func(NeedleValue) error) error
 }
diff --git a/weed/storage/needle_map_file_pool.go b/weed/storage/needle_map_file_pool.go
new file mode 100644
index 0000000000..e76b10d091
--- /dev/null
+++ b/weed/storage/needle_map_file_pool.go
@@ -0,0 +1,113 @@
+package storage
+
+import (
+	"os"
+	"sync"
+
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+)
+
+// Read-only volumes — cloud-tiered ones above all — outnumber writable ones by
+// orders of magnitude on a large server, and each one used to pin its .idx and
+// .sdx descriptors for the life of the process. At ~600K volumes per server
+// that alone exhausts any fd limit. Neither file is needed except while a
+// lookup is in flight, so SortedFileNeedleMap borrows them from this bounded
+// pool: an idle volume holds no descriptor at all, while a busy one keeps its
+// handles hot instead of paying an open() per needle.
+const maxPooledIndexFiles = 1024
+
+type pooledFile struct {
+	file    *os.File
+	refs    int
+	dropped bool // left the pool; close once the last borrower is done
+}
+
+type indexFilePool struct {
+	sync.Mutex
+	lru *simplelru.LRU[string, *pooledFile]
+}
+
+var pooledIndexFiles = newIndexFilePool(maxPooledIndexFiles)
+
+func newIndexFilePool(size int) *indexFilePool {
+	p := &indexFilePool{}
+	// simplelru is not thread safe on its own; every access below holds
+	// p.Mutex, and this eviction callback runs inline under it.
+	p.lru, _ = simplelru.NewLRU(size, func(_ string, f *pooledFile) {
+		f.dropped = true
+		f.closeIfUnused()
+	})
+	return p
+}
+
+// closeIfUnused closes a handle that has left the pool once no borrower is
+// still reading through it. Callers hold indexFilePool.Mutex.
+func (f *pooledFile) closeIfUnused() {
+	if f.dropped && f.refs == 0 && f.file != nil {
+		f.file.Close()
+		f.file = nil
+	}
+}
+
+// Writable and read-only handles for the same path are pooled separately so a
+// read never depends on the .idx being openable for write — a volume served off
+// a read-only mount still answers lookups.
+func poolKey(name string, writable bool) string {
+	if writable {
+		return name + "\x00rw"
+	}
+	return name
+}
+
+// borrow hands out an open handle for name, reusing the pooled one when there
+// is one. The caller must release it exactly once.
+func (p *indexFilePool) borrow(name string, writable bool) (*pooledFile, error) {
+	key := poolKey(name, writable)
+
+	p.Lock()
+	if f, found := p.lru.Get(key); found {
+		f.refs++
+		p.Unlock()
+		return f, nil
+	}
+	p.Unlock()
+
+	flag := os.O_RDONLY
+	if writable {
+		flag = os.O_RDWR
+	}
+	// Opened outside the lock: a cold open blocks on disk, and holding a
+	// process-wide mutex across it would serialize every volume's lookups.
+	file, err := backend.OpenVolumeFile(name, flag)
+	if err != nil {
+		return nil, err
+	}
+
+	p.Lock()
+	defer p.Unlock()
+	if f, found := p.lru.Get(key); found { // another borrower won the race
+		f.refs++
+		file.Close()
+		return f, nil
+	}
+	f := &pooledFile{file: file, refs: 1}
+	p.lru.Add(key, f)
+	return f, nil
+}
+
+func (p *indexFilePool) release(f *pooledFile) {
+	p.Lock()
+	defer p.Unlock()
+	f.refs--
+	f.closeIfUnused()
+}
+
+// discard forgets the pooled handles for name, so a later rename or delete of
+// that path cannot be served from a descriptor on the old inode.
+func (p *indexFilePool) discard(name string) {
+	p.Lock()
+	defer p.Unlock()
+	p.lru.Remove(poolKey(name, false))
+	p.lru.Remove(poolKey(name, true))
+}
diff --git a/weed/storage/needle_map_file_pool_test.go b/weed/storage/needle_map_file_pool_test.go
new file mode 100644
index 0000000000..c313ad467d
--- /dev/null
+++ b/weed/storage/needle_map_file_pool_test.go
@@ -0,0 +1,190 @@
+package storage
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	. "github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// openIndexFilesUnder counts the process's descriptors on .idx/.sdx files under
+// dir, reading /proc/self/fd where it exists and falling back to lsof. Returns
+// false when neither is available, so the caller can skip.
+func openIndexFilesUnder(t *testing.T, dir string) (int, bool) {
+	t.Helper()
+	resolved, err := filepath.EvalSymlinks(dir)
+	if err != nil {
+		resolved = dir
+	}
+	prefix := resolved + string(os.PathSeparator)
+
+	if entries, err := os.ReadDir("/proc/self/fd"); err == nil {
+		count := 0
+		for _, e := range entries {
+			target, err := os.Readlink(filepath.Join("/proc/self/fd", e.Name()))
+			if err != nil {
+				continue // raced with a close
+			}
+			if isIndexFileUnder(target, prefix) {
+				count++
+			}
+		}
+		return count, true
+	}
+
+	out, err := exec.Command("lsof", "-p", strconv.Itoa(os.Getpid()), "-F", "n").Output()
+	if err != nil {
+		return 0, false
+	}
+	count := 0
+	for _, line := range strings.Split(string(out), "\n") {
+		if strings.HasPrefix(line, "n") && isIndexFileUnder(line[1:], prefix) {
+			count++
+		}
+	}
+	return count, true
+}
+
+func isIndexFileUnder(target, prefix string) bool {
+	return strings.HasPrefix(target, prefix) &&
+		(strings.HasSuffix(target, ".idx") || strings.HasSuffix(target, ".sdx"))
+}
+
+// TestSortedFileNeedleMap_HoldsNoDescriptors is the regression guard for
+// issue #10937: a volume server with hundreds of thousands of read-only or
+// cloud-tiered volumes ran out of descriptors because every one of them pinned
+// its .idx and .sdx for the life of the process. An idle read-only volume must
+// hold neither.
+func TestSortedFileNeedleMap_HoldsNoDescriptors(t *testing.T) {
+	if _, ok := openIndexFilesUnder(t, t.TempDir()); !ok {
+		t.Skip("cannot enumerate open descriptors on this platform")
+	}
+
+	t.Run("readonly", func(t *testing.T) {
+		dir := t.TempDir()
+		v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+		if err != nil {
+			t.Fatalf("new volume: %v", err)
+		}
+		for i := 1; i <= 8; i++ {
+			if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false); err != nil {
+				t.Fatalf("write needle %d: %v", i, err)
+			}
+		}
+		if err := v.PersistReadOnly(true, true); err != nil {
+			t.Fatalf("persist read-only: %v", err)
+		}
+		v.Close()
+
+		v, err = NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+		if err != nil {
+			t.Fatalf("reload volume: %v", err)
+		}
+		defer v.Close()
+		nm, isSorted := v.nm.(*SortedFileNeedleMap)
+		if !isSorted {
+			t.Fatalf("read-only volume should load a SortedFileNeedleMap, got %T", v.nm)
+		}
+		assertNoIndexFds(t, dir, "after load")
+
+		// A lookup borrows a handle and hands it straight back; only the pool's
+		// bounded cache keeps it, and dropping that leaves nothing behind.
+		if _, found := nm.Get(Uint64ToNeedleId(3)); !found {
+			t.Fatal("needle 3 not found after reload")
+		}
+		pooledIndexFiles.discard(nm.dbFileName)
+		assertNoIndexFds(t, dir, "after a lookup")
+	})
+
+	t.Run("remote", func(t *testing.T) {
+		b := newLocalDirBackend(t)
+		registerTestBackend(t, b)
+		dir := t.TempDir()
+		const vid = needle.VolumeId(9)
+		tierUpVolume(t, dir, vid, b)
+
+		v := reloadVolume(t, dir, vid)
+		defer v.Close()
+		if !v.HasRemoteFile() {
+			t.Fatal("reloaded volume is not tiered to remote")
+		}
+		assertNoIndexFds(t, dir, "after load")
+	})
+}
+
+func assertNoIndexFds(t *testing.T, dir, when string) {
+	t.Helper()
+	if got, _ := openIndexFilesUnder(t, dir); got != 0 {
+		t.Fatalf("%s the volume holds %d .idx/.sdx descriptors under %s, want 0", when, got, dir)
+	}
+}
+
+// TestIndexFilePool_EvictWhileBorrowed locks in that an eviction does not pull
+// a descriptor out from under an in-flight reader.
+func TestIndexFilePool_EvictWhileBorrowed(t *testing.T) {
+	dir := t.TempDir()
+	first := filepath.Join(dir, "first")
+	second := filepath.Join(dir, "second")
+	for _, name := range []string{first, second} {
+		if err := os.WriteFile(name, []byte(filepath.Base(name)), 0644); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+
+	pool := newIndexFilePool(1)
+	borrowed, err := pool.borrow(first, false)
+	if err != nil {
+		t.Fatalf("borrow first: %v", err)
+	}
+
+	// Pushes the single pool slot over, evicting the entry still in use.
+	other, err := pool.borrow(second, false)
+	if err != nil {
+		t.Fatalf("borrow second: %v", err)
+	}
+	pool.release(other)
+
+	buf := make([]byte, len("first"))
+	if _, err := borrowed.file.ReadAt(buf, 0); err != nil {
+		t.Fatalf("read through evicted-but-borrowed handle: %v", err)
+	}
+	if string(buf) != "first" {
+		t.Fatalf("read %q, want %q", buf, "first")
+	}
+
+	pool.release(borrowed)
+	if borrowed.file != nil {
+		t.Fatal("evicted handle was not closed once the last borrower released it")
+	}
+}
+
+// TestIndexFilePool_DiscardClosesIdle covers the path Close/Destroy rely on:
+// once a volume is unmounted nothing may keep serving reads from its old inode.
+func TestIndexFilePool_DiscardClosesIdle(t *testing.T) {
+	dir := t.TempDir()
+	name := filepath.Join(dir, "idx")
+	if err := os.WriteFile(name, []byte("x"), 0644); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	pool := newIndexFilePool(4)
+	f, err := pool.borrow(name, false)
+	if err != nil {
+		t.Fatalf("borrow: %v", err)
+	}
+	pool.release(f)
+
+	pool.discard(name)
+	if f.file != nil {
+		t.Fatal("discard left the pooled handle open")
+	}
+	if pool.lru.Len() != 0 {
+		t.Fatalf("discard left %d entries in the pool", pool.lru.Len())
+	}
+}
diff --git a/weed/storage/needle_map_leveldb.go b/weed/storage/needle_map_leveldb.go
index f012f443dd..250e88e886 100644
--- a/weed/storage/needle_map_leveldb.go
+++ b/weed/storage/needle_map_leveldb.go
@@ -189,6 +189,34 @@ func (m *LevelDbNeedleMap) Put(key NeedleId, offset Offset, size Size) error {
 	return levelDbWrite(m.db, key, offset, size, watermark != 0, watermark)
 }
 
+func (m *LevelDbNeedleMap) truncateIndex(offset int64) error {
+	if err := m.baseNeedleMapper.truncateIndex(offset); err != nil {
+		return err
+	}
+	m.recordCount = uint64(offset / NeedleMapEntrySize)
+	return nil
+}
+
+func (m *LevelDbNeedleMap) removeMapping(key NeedleId) error {
+	if m.ldbTimeout > 0 {
+		if err := m.ensureLdbLoaded(); err != nil {
+			return err
+		}
+		defer m.ldbAccessLock.RUnlock()
+	}
+	return levelDbDelete(m.db, key)
+}
+
+func (m *LevelDbNeedleMap) restoreMapping(key NeedleId, offset Offset, size Size) error {
+	if m.ldbTimeout > 0 {
+		if err := m.ensureLdbLoaded(); err != nil {
+			return err
+		}
+		defer m.ldbAccessLock.RUnlock()
+	}
+	return levelDbWrite(m.db, key, offset, size, false, 0)
+}
+
 func getWatermark(db *leveldb.DB) uint64 {
 	data, err := db.Get(watermarkKey, nil)
 	if err != nil || len(data) != 8 {
@@ -368,13 +396,18 @@ func (m *LevelDbNeedleMap) DoOffsetLoading(v *Volume, indexFile *os.File, startF
 	}
 
 	err = idx.WalkIndexFile(indexFile, startFrom, func(key NeedleId, offset Offset, size Size) (e error) {
-		m.mapMetric.FileCounter++
 		m.mapMetric.MaybeSetMaxNeedleEnd(offset, size, version)
 		bytes := make([]byte, NeedleIdSize)
 		NeedleIdToBytes(bytes[0:NeedleIdSize], key)
+		validRow := !offset.IsZero() && !size.IsDeleted()
+		if validRow {
+			m.mapMetric.FileCounter++
+		}
 		// fresh loading
 		if startFrom == 0 {
-			m.mapMetric.FileByteCounter += uint64(size)
+			if validRow {
+				m.mapMetric.FileByteCounter += uint64(size)
+			}
 			e = levelDbWrite(db, key, offset, size, false, 0)
 			return e
 		}
@@ -386,24 +419,28 @@ func (m *LevelDbNeedleMap) DoOffsetLoading(v *Volume, indexFile *os.File, startF
 				return err
 			}
 			// new needle, unlikely happen
-			m.mapMetric.FileByteCounter += uint64(size)
+			if validRow {
+				m.mapMetric.FileByteCounter += uint64(size)
+			}
 			e = levelDbWrite(db, key, offset, size, false, 0)
 		} else {
 			// needle is found
 			oldSize := BytesToSize(data[OffsetSize : OffsetSize+SizeSize])
 			oldOffset := BytesToOffset(data[0:OffsetSize])
-			if !offset.IsZero() && !size.IsDeleted() {
+			if validRow {
 				// updated needle
 				m.mapMetric.FileByteCounter += uint64(size)
-				if !oldOffset.IsZero() && !oldSize.IsDeleted() {
+				if !oldOffset.IsZero() && oldSize.IsValid() {
 					m.mapMetric.DeletionCounter++
 					m.mapMetric.DeletionByteCounter += uint64(oldSize)
 				}
 				e = levelDbWrite(db, key, offset, size, false, 0)
 			} else {
 				// deleted needle
-				m.mapMetric.DeletionCounter++
-				m.mapMetric.DeletionByteCounter += uint64(oldSize)
+				if oldSize > 0 {
+					m.mapMetric.DeletionCounter++
+					m.mapMetric.DeletionByteCounter += uint64(oldSize)
+				}
 				e = levelDbDelete(db, key)
 			}
 		}
diff --git a/weed/storage/needle_map_memory.go b/weed/storage/needle_map_memory.go
index 4abb8891de..8ef9bf33b3 100644
--- a/weed/storage/needle_map_memory.go
+++ b/weed/storage/needle_map_memory.go
@@ -42,14 +42,16 @@ func doLoading(file *os.File, nm *NeedleMap, version needle.Version) (*NeedleMap
 			nm.FileCounter++
 			nm.FileByteCounter = nm.FileByteCounter + uint64(size)
 			oldOffset, oldSize := nm.m.Set(NeedleId(key), offset, size)
-			if !oldOffset.IsZero() && !oldSize.IsDeleted() {
+			if !oldOffset.IsZero() && oldSize.IsValid() {
 				nm.DeletionCounter++
 				nm.DeletionByteCounter = nm.DeletionByteCounter + uint64(oldSize)
 			}
 		} else {
 			oldSize := nm.m.Delete(NeedleId(key))
-			nm.DeletionCounter++
-			nm.DeletionByteCounter = nm.DeletionByteCounter + uint64(oldSize)
+			if oldSize > 0 {
+				nm.DeletionCounter++
+				nm.DeletionByteCounter = nm.DeletionByteCounter + uint64(oldSize)
+			}
 		}
 		return nil
 	})
@@ -71,6 +73,14 @@ func (nm *NeedleMap) Delete(key NeedleId, offset Offset) error {
 	nm.logDelete(deletedBytes)
 	return nm.appendToIndexFile(key, offset, TombstoneFileSize)
 }
+func (nm *NeedleMap) removeMapping(key NeedleId) error {
+	nm.m.Remove(NeedleId(key))
+	return nil
+}
+func (nm *NeedleMap) restoreMapping(key NeedleId, offset Offset, size Size) error {
+	nm.m.Set(NeedleId(key), offset, size)
+	return nil
+}
 func (nm *NeedleMap) Close() {
 	if nm.indexFile == nil {
 		return
@@ -118,18 +128,20 @@ func (nm *NeedleMap) DoOffsetLoading(v *Volume, indexFile *os.File, startFrom ui
 	e := idx.WalkIndexFile(indexFile, startFrom, func(key NeedleId, offset Offset, size Size) error {
 		nm.MaybeSetMaxFileKey(key)
 		nm.MaybeSetMaxNeedleEnd(offset, size, version)
-		nm.FileCounter++
 		if !offset.IsZero() && !size.IsDeleted() {
+			nm.FileCounter++
 			nm.FileByteCounter = nm.FileByteCounter + uint64(size)
 			oldOffset, oldSize := nm.m.Set(NeedleId(key), offset, size)
-			if !oldOffset.IsZero() && !oldSize.IsDeleted() {
+			if !oldOffset.IsZero() && oldSize.IsValid() {
 				nm.DeletionCounter++
 				nm.DeletionByteCounter = nm.DeletionByteCounter + uint64(oldSize)
 			}
 		} else {
 			oldSize := nm.m.Delete(NeedleId(key))
-			nm.DeletionCounter++
-			nm.DeletionByteCounter = nm.DeletionByteCounter + uint64(oldSize)
+			if oldSize > 0 {
+				nm.DeletionCounter++
+				nm.DeletionByteCounter = nm.DeletionByteCounter + uint64(oldSize)
+			}
 		}
 		return nil
 	})
diff --git a/weed/storage/needle_map_metric.go b/weed/storage/needle_map_metric.go
index e1de97c6e6..498ae49cc2 100644
--- a/weed/storage/needle_map_metric.go
+++ b/weed/storage/needle_map_metric.go
@@ -6,6 +6,7 @@ import (
 	"os"
 	"sync/atomic"
 
+	"github.com/cespare/xxhash/v2"
 	"github.com/seaweedfs/seaweedfs/weed/storage/idx"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	. "github.com/seaweedfs/seaweedfs/weed/storage/types"
@@ -26,6 +27,35 @@ type mapMetric struct {
 	MaximumNeedleEnd int64 `json:"MaxNeedleEnd"`
 }
 
+type batchMapMetricSnapshot struct {
+	deletionCounter     uint32
+	fileCounter         uint32
+	deletionByteCounter uint64
+	fileByteCounter     uint64
+	maximumFileKey      uint64
+	maximumNeedleEnd    int64
+}
+
+func (mm *mapMetric) snapshotBatchMetrics() batchMapMetricSnapshot {
+	return batchMapMetricSnapshot{
+		deletionCounter:     atomic.LoadUint32(&mm.DeletionCounter),
+		fileCounter:         atomic.LoadUint32(&mm.FileCounter),
+		deletionByteCounter: atomic.LoadUint64(&mm.DeletionByteCounter),
+		fileByteCounter:     atomic.LoadUint64(&mm.FileByteCounter),
+		maximumFileKey:      atomic.LoadUint64(&mm.MaximumFileKey),
+		maximumNeedleEnd:    atomic.LoadInt64(&mm.MaximumNeedleEnd),
+	}
+}
+
+func (mm *mapMetric) restoreBatchMetrics(snapshot batchMapMetricSnapshot) {
+	atomic.StoreUint32(&mm.DeletionCounter, snapshot.deletionCounter)
+	atomic.StoreUint32(&mm.FileCounter, snapshot.fileCounter)
+	atomic.StoreUint64(&mm.DeletionByteCounter, snapshot.deletionByteCounter)
+	atomic.StoreUint64(&mm.FileByteCounter, snapshot.fileByteCounter)
+	atomic.StoreUint64(&mm.MaximumFileKey, snapshot.maximumFileKey)
+	atomic.StoreInt64(&mm.MaximumNeedleEnd, snapshot.maximumNeedleEnd)
+}
+
 func (mm *mapMetric) logDelete(deletedByteCount Size) {
 	if mm == nil {
 		return
@@ -122,34 +152,42 @@ func (mm *mapMetric) MaxNeedleEnd() int64 {
 func needleMapMetricFromIndexFile(r *os.File, mm *mapMetric, version needle.Version) error {
 	var bf *boom.BloomFilter
 	buf := make([]byte, NeedleIdSize)
+	var liveKeyCount uint32
+	var liveKeyBytes uint64
 	err := reverseWalkIndexFile(r, func(entryCount int64) {
 		bf = boom.NewBloomFilter(uint(entryCount), 0.001)
+		// The default FNV-1 kernel leaves the last byte of a big-endian
+		// NeedleId as the final XOR, so keys in the same 256-block get
+		// correlated probe positions and false positives arrive in bursts
+		// of hundreds. xxhash diffuses the input fully and keeps the
+		// observed rate near the 0.001 target.
+		bf.SetHash(xxhash.New())
 	}, func(key NeedleId, offset Offset, size Size) error {
 
 		mm.MaybeSetMaxFileKey(key)
 		mm.MaybeSetMaxNeedleEnd(offset, size, version)
 		NeedleIdToBytes(buf, key)
-		if size.IsValid() {
-			mm.FileByteCounter += uint64(size)
+		seen := bf.TestAndAdd(buf)
+		if offset.IsZero() || size.IsDeleted() {
+			return nil
 		}
-
 		mm.FileCounter++
-		if !bf.TestAndAdd(buf) {
-			// if !size.IsValid(), then this file is deleted already
-			if !size.IsValid() {
-				mm.DeletionCounter++
-			}
-		} else {
-			// deleted file
-			mm.DeletionCounter++
-			if size.IsValid() {
-				// previously already deleted file
-				mm.DeletionByteCounter += uint64(size)
-			}
+		mm.FileByteCounter += uint64(size)
+		if !seen {
+			liveKeyCount++
+			liveKeyBytes += uint64(size)
 		}
 		return nil
 	})
-	return err
+	if err != nil {
+		return err
+	}
+	// Runtime counters tally each live-key removal: an overwrite deletes the
+	// superseded row and a tombstone deletes the live row. Replaying forward,
+	// that is (file rows) - (keys whose latest row is live).
+	mm.DeletionCounter = mm.FileCounter - liveKeyCount
+	mm.DeletionByteCounter = mm.FileByteCounter - liveKeyBytes
+	return nil
 }
 
 func newNeedleMapMetricFromIndexFile(r *os.File, version needle.Version) (mm *mapMetric, err error) {
diff --git a/weed/storage/needle_map_metric_test.go b/weed/storage/needle_map_metric_test.go
index 5dbe894067..2c3bed73b0 100644
--- a/weed/storage/needle_map_metric_test.go
+++ b/weed/storage/needle_map_metric_test.go
@@ -16,17 +16,38 @@ func TestFastLoadingNeedleMapMetrics(t *testing.T) {
 	nm := NewCompactNeedleMap(idxFile)
 
 	for i := 0; i < 10000; i++ {
-		nm.Put(Uint64ToNeedleId(uint64(i+1)), Uint32ToOffset(uint32(0)), Size(1))
+		nm.Put(Uint64ToNeedleId(uint64(i+1)), Uint32ToOffset(uint32(i+1)), Size(1))
 		if rand.Float32() < 0.2 && i > 0 {
 			nm.Delete(Uint64ToNeedleId(uint64(rand.Int63n(int64(i))+1)), Uint32ToOffset(uint32(0)))
 		}
 	}
 
-	mm, _ := newNeedleMapMetricFromIndexFile(idxFile, needle.GetCurrentVersion())
+	mm, err := newNeedleMapMetricFromIndexFile(idxFile, needle.GetCurrentVersion())
+	if err != nil {
+		t.Fatalf("newNeedleMapMetricFromIndexFile() error = %v", err)
+	}
 
 	glog.V(0).Infof("FileCount expected %d actual %d", nm.FileCount(), mm.FileCount())
 	glog.V(0).Infof("DeletedSize expected %d actual %d", nm.DeletedSize(), mm.DeletedSize())
 	glog.V(0).Infof("ContentSize expected %d actual %d", nm.ContentSize(), mm.ContentSize())
 	glog.V(0).Infof("DeletedCount expected %d actual %d", nm.DeletedCount(), mm.DeletedCount())
 	glog.V(0).Infof("MaxFileKey expected %d actual %d", nm.MaxFileKey(), mm.MaxFileKey())
+
+	if mm.FileCount() != nm.FileCount() {
+		t.Fatalf("FileCount = %d, want %d", mm.FileCount(), nm.FileCount())
+	}
+	if mm.ContentSize() != nm.ContentSize() {
+		t.Fatalf("ContentSize = %d, want %d", mm.ContentSize(), nm.ContentSize())
+	}
+	if mm.MaxFileKey() != nm.MaxFileKey() {
+		t.Fatalf("MaxFileKey = %d, want %d", mm.MaxFileKey(), nm.MaxFileKey())
+	}
+	// Bloom false positives can hide a key whose latest row is live, which
+	// only inflates the deletion counters by a small bounded amount.
+	if got, want := mm.DeletedCount(), nm.DeletedCount(); got < want || got > want+256 {
+		t.Fatalf("DeletedCount = %d, want within [%d, %d]", got, want, want+256)
+	}
+	if got, want := mm.DeletedSize(), nm.DeletedSize(); got < want || got > want+256 {
+		t.Fatalf("DeletedSize = %d, want within [%d, %d]", got, want, want+256)
+	}
 }
diff --git a/weed/storage/needle_map_sorted_file.go b/weed/storage/needle_map_sorted_file.go
index 8945dd46a6..e5de53925a 100644
--- a/weed/storage/needle_map_sorted_file.go
+++ b/weed/storage/needle_map_sorted_file.go
@@ -2,54 +2,68 @@ package storage
 
 import (
 	"fmt"
+	"io"
 	"os"
+	"sync"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/idx"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle_map"
 	. "github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
 
+// SortedFileNeedleMap backs every read-only volume, which on a tiered cluster
+// is nearly every volume. It deliberately keeps no *os.File of its own:
+// .idx and .sdx are borrowed from pooledIndexFiles per operation, so a volume
+// nobody is reading costs zero descriptors. See needle_map_file_pool.go.
 type SortedFileNeedleMap struct {
-	baseNeedleMapper
-	baseFileName string
-	dbFile       *os.File
-	dbFileSize   int64
+	mapMetric
+	baseFileName  string
+	indexFileName string
+	dbFileName    string
+	dbFileSize    int64
+
+	indexFileAccessLock sync.Mutex
+	indexFileOffset     int64
+	indexNeedsSync      bool
 }
 
 func NewSortedFileNeedleMap(indexBaseFileName string, indexFile *os.File, version needle.Version) (m *SortedFileNeedleMap, err error) {
-	m = &SortedFileNeedleMap{baseFileName: indexBaseFileName}
-	m.indexFile = indexFile
-	fileName := indexBaseFileName + ".sdx"
-	if !isSortedFileFresh(fileName, indexFile) {
-		glog.V(0).Infof("Start to Generate %s from %s", fileName, indexFile.Name())
+	m = &SortedFileNeedleMap{
+		baseFileName:  indexBaseFileName,
+		indexFileName: indexFile.Name(),
+		dbFileName:    indexBaseFileName + ".sdx",
+	}
+	if !isSortedFileFresh(m.dbFileName, indexFile) {
+		glog.V(0).Infof("Start to Generate %s from %s", m.dbFileName, indexFile.Name())
 		erasure_coding.WriteSortedFileFromIdx(indexBaseFileName, ".sdx")
-		glog.V(0).Infof("Finished Generating %s from %s", fileName, indexFile.Name())
+		glog.V(0).Infof("Finished Generating %s from %s", m.dbFileName, indexFile.Name())
 	}
-	glog.V(1).Infof("Opening %s...", fileName)
 
-	if m.dbFile, err = os.OpenFile(indexBaseFileName+".sdx", os.O_RDWR, 0); err != nil {
-		return
+	dbStat, err := os.Stat(m.dbFileName)
+	if err != nil {
+		return nil, fmt.Errorf("stat %s: %v", m.dbFileName, err)
 	}
-	dbStat, _ := m.dbFile.Stat()
 	m.dbFileSize = dbStat.Size()
 	// Seed indexFileOffset so Delete() appends tombstones to the tail of
 	// .idx instead of overwriting from offset 0 and clobbering existing
 	// records with tombstones for unrelated keys.
 	indexStat, statErr := indexFile.Stat()
 	if statErr != nil {
-		_ = m.dbFile.Close()
 		return nil, fmt.Errorf("stat %s: %v", indexFile.Name(), statErr)
 	}
 	m.indexFileOffset = indexStat.Size()
 	glog.V(1).Infof("Loading %s...", indexFile.Name())
 	mm, indexLoadError := newNeedleMapMetricFromIndexFile(indexFile, version)
 	if indexLoadError != nil {
-		_ = m.dbFile.Close()
 		return nil, indexLoadError
 	}
 	m.mapMetric = *mm
+	// Everything past the load walk goes through the pool, so hand the
+	// caller's descriptor back instead of holding it for the volume's life.
+	indexFile.Close()
 	return
 }
 
@@ -71,7 +85,13 @@ func isSortedFileFresh(dbFileName string, indexFile *os.File) bool {
 }
 
 func (m *SortedFileNeedleMap) Get(key NeedleId) (element *needle_map.NeedleValue, ok bool) {
-	offset, size, err := erasure_coding.SearchNeedleFromSortedIndex(m.dbFile, m.dbFileSize, key, nil)
+	f, err := pooledIndexFiles.borrow(m.dbFileName, false)
+	if err != nil {
+		glog.Warningf("open %s: %v", m.dbFileName, err)
+		return &needle_map.NeedleValue{Key: key}, false
+	}
+	offset, size, err := erasure_coding.SearchNeedleFromSortedIndex(f.file, m.dbFileSize, key, nil)
+	pooledIndexFiles.release(f)
 	ok = err == nil
 	return &needle_map.NeedleValue{Key: key, Offset: offset, Size: size}, ok
 
@@ -81,9 +101,23 @@ func (m *SortedFileNeedleMap) Put(key NeedleId, offset Offset, size Size) error
 	return fmt.Errorf("needle map %s.sdx is read only: %w", m.baseFileName, os.ErrInvalid)
 }
 
+func (m *SortedFileNeedleMap) removeMapping(key NeedleId) error {
+	return fmt.Errorf("needle map %s.sdx is read only: %w", m.baseFileName, os.ErrInvalid)
+}
+
+func (m *SortedFileNeedleMap) restoreMapping(key NeedleId, offset Offset, size Size) error {
+	return fmt.Errorf("needle map %s.sdx is read only: %w", m.baseFileName, os.ErrInvalid)
+}
+
 func (m *SortedFileNeedleMap) Delete(key NeedleId, offset Offset) error {
 
-	_, size, err := erasure_coding.SearchNeedleFromSortedIndex(m.dbFile, m.dbFileSize, key, nil)
+	f, err := pooledIndexFiles.borrow(m.dbFileName, true)
+	if err != nil {
+		return err
+	}
+	defer pooledIndexFiles.release(f)
+
+	_, size, err := erasure_coding.SearchNeedleFromSortedIndex(f.file, m.dbFileSize, key, nil)
 
 	if err != nil {
 		if err == erasure_coding.NotFoundError {
@@ -100,25 +134,115 @@ func (m *SortedFileNeedleMap) Delete(key NeedleId, offset Offset) error {
 	if err := m.appendToIndexFile(key, offset, TombstoneFileSize); err != nil {
 		return err
 	}
-	_, _, err = erasure_coding.SearchNeedleFromSortedIndex(m.dbFile, m.dbFileSize, key, erasure_coding.MarkNeedleDeleted)
+	_, _, err = erasure_coding.SearchNeedleFromSortedIndex(f.file, m.dbFileSize, key, erasure_coding.MarkNeedleDeleted)
 
 	return err
 }
 
+func (m *SortedFileNeedleMap) appendToIndexFile(key NeedleId, offset Offset, size Size) error {
+	f, err := pooledIndexFiles.borrow(m.indexFileName, true)
+	if err != nil {
+		return err
+	}
+	defer pooledIndexFiles.release(f)
+
+	bytes := needle_map.ToBytes(key, offset, size)
+
+	m.indexFileAccessLock.Lock()
+	defer m.indexFileAccessLock.Unlock()
+	written, err := f.file.WriteAt(bytes, m.indexFileOffset)
+	if err == nil {
+		m.indexFileOffset += int64(written)
+		m.indexNeedsSync = true
+	}
+	return err
+}
+
+// IndexFileSize answers from the offset the appends maintain rather than a
+// stat: the heartbeat asks every volume for this on every beat, and a
+// read-only volume's .idx only ever grows through appendToIndexFile.
+func (m *SortedFileNeedleMap) IndexFileSize() uint64 {
+	m.indexFileAccessLock.Lock()
+	defer m.indexFileAccessLock.Unlock()
+	return uint64(m.indexFileOffset)
+}
+
+// Sync flushes tombstones appended by Delete. A read-only volume that has never
+// been deleted from — the overwhelming majority — opens nothing here, so
+// shutting down a server holding hundreds of thousands of them costs no fsyncs.
+func (m *SortedFileNeedleMap) Sync() error {
+	m.indexFileAccessLock.Lock()
+	defer m.indexFileAccessLock.Unlock()
+	if !m.indexNeedsSync {
+		return nil
+	}
+	f, err := pooledIndexFiles.borrow(m.indexFileName, true)
+	if err != nil {
+		return err
+	}
+	defer pooledIndexFiles.release(f)
+	if err := f.file.Sync(); err != nil {
+		return err
+	}
+	m.indexNeedsSync = false
+	return nil
+}
+
+// truncateIndex drops .idx tombstones a failed batch appended. The .sdx is
+// untouched: a delete already marked there cannot be unmarked, so callers
+// treat the batch as unrecoverable before reaching this.
+func (m *SortedFileNeedleMap) truncateIndex(offset int64) error {
+	f, err := pooledIndexFiles.borrow(m.indexFileName, true)
+	if err != nil {
+		return err
+	}
+	defer pooledIndexFiles.release(f)
+
+	m.indexFileAccessLock.Lock()
+	defer m.indexFileAccessLock.Unlock()
+	if err := f.file.Truncate(offset); err != nil {
+		return err
+	}
+	m.indexFileOffset = offset
+	return nil
+}
+
+func (m *SortedFileNeedleMap) ReadIndexEntry(n int64) (key NeedleId, offset Offset, size Size, err error) {
+	var f *pooledFile
+	if f, err = pooledIndexFiles.borrow(m.indexFileName, false); err != nil {
+		return
+	}
+	defer pooledIndexFiles.release(f)
+
+	bytes := make([]byte, NeedleMapEntrySize)
+	var readCount int
+	if readCount, err = f.file.ReadAt(bytes, n*NeedleMapEntrySize); err != nil {
+		if err == io.EOF {
+			if readCount == NeedleMapEntrySize {
+				err = nil
+			}
+		}
+		if err != nil {
+			return
+		}
+	}
+	key, offset, size = idx.IdxFileEntry(bytes)
+	return
+}
+
 func (m *SortedFileNeedleMap) Close() {
 	if m == nil {
 		return
 	}
-	if m.indexFile != nil {
-		m.indexFile.Close()
-	}
-	if m.dbFile != nil {
-		m.dbFile.Close()
-	}
+	// Drop the pooled handles too: the caller may be about to rename or remove
+	// these paths, and a descriptor left behind would keep answering reads from
+	// the old inode.
+	pooledIndexFiles.discard(m.indexFileName)
+	pooledIndexFiles.discard(m.dbFileName)
 }
 
 func (m *SortedFileNeedleMap) Destroy() error {
 	m.Close()
-	os.Remove(m.indexFile.Name())
-	return os.Remove(m.baseFileName + ".sdx")
+	os.Remove(m.indexFileName)
+	return os.Remove(m.dbFileName)
 }
diff --git a/weed/storage/remote_tier_integration_test.go b/weed/storage/remote_tier_integration_test.go
index e0dc733b5c..84ca727551 100644
--- a/weed/storage/remote_tier_integration_test.go
+++ b/weed/storage/remote_tier_integration_test.go
@@ -36,6 +36,7 @@ type localDirBackend struct {
 
 	mu      sync.Mutex
 	deletes []string // history of DeleteFile keys, for assertions
+	failDel bool     // when set, DeleteFile reports an error without deleting
 }
 
 func newLocalDirBackend(t *testing.T) *localDirBackend {
@@ -52,7 +53,7 @@ func (b *localDirBackend) NewStorageFile(key string, tierInfo *volume_server_pb.
 	return &localDirBackendFile{backend: b, key: key, tierInfo: tierInfo}
 }
 
-func (b *localDirBackend) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error) (key string, size int64, err error) {
+func (b *localDirBackend) CopyFile(f *os.File, fn func(progressed int64, percentage float32) error, concurrency int) (key string, size int64, err error) {
 	key = fmt.Sprintf("obj-%d-%d", time.Now().UnixNano(), os.Getpid())
 	dst := filepath.Join(b.root, key)
 	out, err := os.Create(dst)
@@ -73,7 +74,7 @@ func (b *localDirBackend) CopyFile(f *os.File, fn func(progressed int64, percent
 	return key, written, nil
 }
 
-func (b *localDirBackend) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error) (size int64, err error) {
+func (b *localDirBackend) DownloadFile(fileName string, key string, fn func(progressed int64, percentage float32) error, concurrency int) (size int64, err error) {
 	src := filepath.Join(b.root, key)
 	in, err := os.Open(src)
 	if err != nil {
@@ -97,11 +98,20 @@ func (b *localDirBackend) DownloadFile(fileName string, key string, fn func(prog
 
 func (b *localDirBackend) DeleteFile(key string) error {
 	b.mu.Lock()
+	defer b.mu.Unlock()
 	b.deletes = append(b.deletes, key)
-	b.mu.Unlock()
+	if b.failDel {
+		return fmt.Errorf("injected remote delete failure for %s", key)
+	}
 	return os.Remove(filepath.Join(b.root, key))
 }
 
+func (b *localDirBackend) failDeletes(fail bool) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.failDel = fail
+}
+
 func (b *localDirBackend) deleteHistory() []string {
 	b.mu.Lock()
 	defer b.mu.Unlock()
@@ -186,14 +196,14 @@ func tierUpVolumeLive(t *testing.T, dir string, vid needle.VolumeId, b *localDir
 	require.NoError(t, err)
 
 	for i := 1; i <= 5; i++ {
-		_, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false)
+		_, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false)
 		require.NoError(t, err)
 	}
 
 	diskFile, ok := v.DataBackend.(*backend.DiskFile)
 	require.True(t, ok, "expected on-disk backend before tier-up")
 
-	uploadKey, size, err := b.CopyFile(diskFile.File, nil)
+	uploadKey, size, err := b.CopyFile(diskFile.File, nil, 0)
 	require.NoError(t, err)
 
 	bType, bId := backend.BackendNameToTypeId(testBackendName)
@@ -289,7 +299,7 @@ func TestRemoteTier_LiveTierUpload_StillReportsToMaster(t *testing.T) {
 	require.True(t, v.HasRemoteFile(), "a tier-uploaded volume is in remote mode even before any reload")
 	require.False(t, util.FileExists(v.FileName(".dat")), "tier-up should have removed the local .dat")
 
-	_, msg := v.ToVolumeInformationMessage()
+	_, msg := v.ToVolumeInformationMessage(nil)
 	require.NotNil(t, msg, "tier-uploaded volume must still report to master")
 	require.NotEmpty(t, msg.RemoteStorageName, "reported volume must carry its remote backend name")
 }
@@ -343,7 +353,7 @@ func TestRemoteTier_Move_KeepsRemoteObject(t *testing.T) {
 	v := reloadVolume(t, dir, vid)
 	require.True(t, v.HasRemoteFile())
 
-	require.NoError(t, v.Destroy(false, true))
+	require.NoError(t, v.Destroy(false, false, true))
 
 	require.True(t, b.objectExists(key), "Destroy(keepRemoteData=true) must not delete remote object")
 	require.Empty(t, b.deleteHistory(), "no DeleteFile call expected on a move-style destroy")
@@ -363,12 +373,40 @@ func TestRemoteTier_RealDelete_RemovesRemoteObject(t *testing.T) {
 	v := reloadVolume(t, dir, vid)
 	require.True(t, v.HasRemoteFile())
 
-	require.NoError(t, v.Destroy(false, false))
+	require.NoError(t, v.Destroy(false, false, false))
 
 	require.False(t, b.objectExists(key), "Destroy(keepRemoteData=false) must delete remote object")
 	require.Equal(t, []string{key}, b.deleteHistory())
 }
 
+// TestRemoteTier_FailedRemoteDelete_KeepsLocalVolume locks in the failure
+// ordering: a backend delete error must abort Destroy before local files are
+// removed, leaving the registered replica fully intact and retryable.
+func TestRemoteTier_FailedRemoteDelete_KeepsLocalVolume(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+
+	dir := t.TempDir()
+	const vid = needle.VolumeId(34)
+	_, key := tierUpVolume(t, dir, vid, b)
+	require.True(t, b.objectExists(key))
+
+	v := reloadVolume(t, dir, vid)
+	require.True(t, v.HasRemoteFile())
+
+	b.failDeletes(true)
+	err := v.Destroy(false, false, false)
+	require.Error(t, err, "Destroy must surface the remote delete failure")
+
+	require.True(t, util.FileExists(filepath.Join(dir, "34.idx")), "local .idx must survive a failed remote delete")
+	require.True(t, util.FileExists(filepath.Join(dir, "34.vif")), "local .vif must survive a failed remote delete")
+	require.True(t, b.objectExists(key), "remote object must survive a failed remote delete")
+
+	b.failDeletes(false)
+	require.NoError(t, v.Destroy(false, false, false), "retry must succeed once the backend recovers")
+	require.False(t, b.objectExists(key))
+}
+
 // TestRemoteTier_Vacuum_DoesNotDeleteRemote runs the compact paths against a
 // remote-tier volume and asserts the safety property: regardless of whether
 // compact succeeds, errors, or no-ops, it must not delete the cloud object.
@@ -422,7 +460,7 @@ func TestRemoteTier_ECEncodeDecode_AfterDownload(t *testing.T) {
 
 	baseFileName := filepath.Join(dir, fmt.Sprintf("%d", uint32(vid)))
 	datPath := baseFileName + ".dat"
-	_, err := b.DownloadFile(datPath, key, nil)
+	_, err := b.DownloadFile(datPath, key, nil, 0)
 	require.NoError(t, err)
 
 	require.NoError(t, erasure_coding.WriteSortedFileFromIdx(baseFileName, ".ecx"))
diff --git a/weed/storage/store.go b/weed/storage/store.go
index 22e333f5e2..d213ee6f9e 100644
--- a/weed/storage/store.go
+++ b/weed/storage/store.go
@@ -21,6 +21,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
@@ -34,7 +35,12 @@ const (
 
 type ReadOption struct {
 	// request
-	ReadDeleted     bool
+	ReadDeleted bool
+	// AttemptMetaOnly alone skips the payload only for needles larger than
+	// PagedReadLimit. Setting MustMetaOnly as well skips it at any size.
+	// A compressed needle or a chunk manifest is always read in full, because
+	// the caller needs its data. After the read, IsMetaOnly reports whether
+	// the payload was skipped.
 	AttemptMetaOnly bool
 	MustMetaOnly    bool
 	// response
@@ -56,14 +62,25 @@ type ReadOption struct {
 	ReadBufferSize int
 }
 
+// masterAddress returns the master to ask for volume and shard locations, or
+// "" while no leader is known.
+func (s *Store) masterAddress() pb.ServerAddress {
+	if s.MasterFn == nil {
+		return ""
+	}
+	return s.MasterFn()
+}
+
 /*
  * A VolumeServer contains one Store
  */
 type Store struct {
-	MasterAddress       pb.ServerAddress
+	// MasterFn reports the master the volume server currently takes as leader.
+	// The heartbeat loop owns that answer; the store only reads it.
+	MasterFn            func() pb.ServerAddress
 	grpcDialOption      grpc.DialOption
-	volumeSizeLimit     uint64      // read from the master
-	preallocate         atomic.Bool // read from the master
+	volumeSizeLimit     atomic.Uint64 // read from the master
+	preallocate         atomic.Bool   // read from the master
 	Ip                  string
 	Port                int
 	GrpcPort            int
@@ -80,8 +97,23 @@ type Store struct {
 	DeletedVolumesChan  chan *master_pb.VolumeShortInformationMessage
 	NewEcShardsChan     chan *master_pb.VolumeEcShardInformationMessage
 	DeletedEcShardsChan chan *master_pb.VolumeEcShardInformationMessage
-	isStopping          bool
+	isStopping          atomic.Bool
 	volumeReport        volumeReportState
+	// One heartbeat at a time: the report state is marked in place as the scan
+	// runs, so two overlapping scans would each forget what the other marked
+	// and name every volume it holds as departed.
+	collectHeartbeatLock sync.Mutex
+	// Collections the last heartbeat set per-collection gauges for. Those gauges
+	// are only ever set for collections still held here, so one whose last
+	// volume leaves - moved away by volume.balance, say - would keep reporting
+	// the heartbeat that saw it. Written only from the heartbeat goroutine.
+	reportedCollections   map[string]struct{}
+	reportedEcCollections map[string]struct{}
+	maxVolumeIdSeen       atomic.Uint32
+	lastSeenTopologyId    atomic.Value // string
+	vidStampReady         atomic.Bool
+	vidStampDirty         atomic.Bool
+	vidStampLock          sync.Mutex
 }
 
 func (s *Store) String() (str string) {
@@ -130,6 +162,7 @@ func NewStore(
 		diskId := uint32(i) // Track disk ID
 
 		location.ecShardNotifyHandler = func(collection string, vid needle.VolumeId, shardId erasure_coding.ShardId, ecVolume *erasure_coding.EcVolume) {
+			s.UpdateMaxVolumeIdSeen(vid)
 			si := erasure_coding.NewShardsInfo()
 			si.Set(erasure_coding.NewShardInfo(shardId, erasure_coding.ShardSize(ecVolume.ShardSize())))
 
@@ -196,6 +229,8 @@ func NewStore(
 		glog.Fatalf("failed to resolve state for volume %s: %v", id, err)
 	}
 
+	s.bootstrapMaxVolumeIdSeen()
+
 	return
 }
 
@@ -275,8 +310,12 @@ func (s *Store) findVolume(vid needle.VolumeId) *Volume {
 	}
 	return nil
 }
-func (s *Store) FindFreeLocation(filterFn func(location *DiskLocation) bool) (ret *DiskLocation) {
+func (s *Store) FindFreeLocation(filterFn func(location *DiskLocation) bool, replaceVid ...needle.VolumeId) (ret *DiskLocation) {
 	max := int32(0)
+	var replace needle.VolumeId
+	if len(replaceVid) > 0 {
+		replace = replaceVid[0]
+	}
 	for _, location := range s.Locations {
 		if filterFn != nil && !filterFn(location) {
 			continue
@@ -285,6 +324,11 @@ func (s *Store) FindFreeLocation(filterFn func(location *DiskLocation) bool) (re
 			continue
 		}
 		currentFreeCount := location.MaxVolumeCount - int32(location.VolumesLen())
+		if replace != 0 {
+			if _, found := location.FindVolume(replace); found {
+				currentFreeCount++
+			}
+		}
 		currentFreeCount *= erasure_coding.DataShardsCount
 		currentFreeCount -= int32(location.EcShardCount())
 		currentFreeCount /= erasure_coding.DataShardsCount
@@ -296,6 +340,7 @@ func (s *Store) FindFreeLocation(filterFn func(location *DiskLocation) bool) (re
 	return ret
 }
 func (s *Store) addVolume(vid needle.VolumeId, collection string, needleMapKind NeedleMapKind, replicaPlacement *super_block.ReplicaPlacement, ttl *needle.TTL, preallocate int64, ver needle.Version, memoryMapMaxSizeMb uint32, diskType DiskType, ldbTimeout int64) error {
+	s.UpdateMaxVolumeIdSeen(vid)
 	if s.findVolume(vid) != nil {
 		return fmt.Errorf("Volume Id %d already exists!", vid)
 	}
@@ -322,14 +367,17 @@ func (s *Store) addVolume(vid needle.VolumeId, collection string, needleMapKind
 			volume.diskId = diskId // Set the disk ID
 			location.SetVolume(vid, volume)
 			glog.V(0).Infof("add volume %d on disk ID %d", vid, diskId)
+			readOnly, _, readOnlyCanDelete, _ := volume.ReadOnlyReasons()
 			s.NewVolumesChan <- &master_pb.VolumeShortInformationMessage{
-				Id:               uint32(vid),
-				Collection:       collection,
-				ReplicaPlacement: uint32(replicaPlacement.Byte()),
-				Version:          uint32(volume.Version()),
-				Ttl:              ttl.ToUint32(),
-				DiskType:         string(diskType),
-				DiskId:           diskId,
+				Id:                uint32(vid),
+				Collection:        collection,
+				ReplicaPlacement:  uint32(replicaPlacement.Byte()),
+				Version:           uint32(volume.Version()),
+				Ttl:               ttl.ToUint32(),
+				DiskType:          string(diskType),
+				DiskId:            diskId,
+				ReadOnly:          readOnly,
+				ReadOnlyCanDelete: readOnlyCanDelete,
 			}
 			return nil
 		} else {
@@ -382,18 +430,20 @@ func collectStatsForOneLocation(location *DiskLocation) (stats []*VolumeInfo) {
 
 func collectStatForOneVolume(vid needle.VolumeId, v *Volume) (s *VolumeInfo) {
 
+	readOnly, _, readOnlyCanDelete, _ := v.ReadOnlyReasons()
 	s = &VolumeInfo{
 		Id:               vid,
 		Collection:       v.Collection,
 		ReplicaPlacement: v.ReplicaPlacement,
 		Version:          v.Version(),
-		ReadOnly:         v.IsReadOnly(),
+		ReadOnly:         readOnly,
 		Ttl:              v.Ttl,
 		CompactRevision:  uint32(v.CompactionRevision),
 		DiskType:         v.DiskType().String(),
 		DiskId:           v.diskId,
 	}
-	s.RemoteStorageName, s.RemoteStorageKey = v.RemoteStorageNameKey()
+	s.ReadOnlyCanDelete = readOnlyCanDelete
+	s.RemoteStorageName, _ = v.RemoteStorageNameKey()
 
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
@@ -402,8 +452,8 @@ func collectStatForOneVolume(vid needle.VolumeId, v *Volume) (s *VolumeInfo) {
 		return
 	}
 
-	s.FileCount = v.nm.FileCount()
-	s.DeleteCount = v.nm.DeletedCount()
+	s.FileCount = countAsUint32(uint64(v.nm.FileCount()))
+	s.DeleteCount = countAsUint32(uint64(v.nm.DeletedCount()))
 	s.DeletedByteCount = v.nm.DeletedSize()
 	s.Size = v.nm.ContentSize()
 	if v.DataBackend != nil {
@@ -428,13 +478,16 @@ func (s *Store) GetRack() string {
 }
 
 func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
+	s.collectHeartbeatLock.Lock()
+	defer s.collectHeartbeatLock.Unlock()
+
 	var volumeMessages []*master_pb.VolumeInformationMessage
 	// Covers every volume held, whether or not this heartbeat names it, so the
 	// master can tell whether applying what it was sent leaves it current.
 	// Volumes skipped below -- quarantined, phantom, expired -- are in neither.
 	var volumeDigest uint64
-	sendFullList, reportGeneration := s.volumeReport.begin()
-	reported := make(map[volumeReportKey]reportedVolume)
+	var quarantinedVolumes int
+	sendFullList, reportGeneration, reportPass := s.volumeReport.begin()
 	maxVolumeCounts := make(map[string]uint32)
 	// Per-disk effective max for DiskTag, captured alongside the per-type sum.
 	diskMaxByID := make(map[int]int32)
@@ -443,7 +496,10 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 	var maxFileKey NeedleId
 	collectionVolumeSize := make(map[string]int64)
 	collectionVolumeDeletedBytes := make(map[string]int64)
-	collectionVolumeReadOnlyCount := make(map[string]map[string]uint8)
+	collectionVolumeReadOnlyCount := make(map[string]map[string]int)
+	// Filled once per volume and kept only by the heartbeat that carries it, so
+	// a server with nothing to say fills the same message all the way through.
+	scratchMessage := &master_pb.VolumeInformationMessage{}
 	for diskID, location := range s.Locations {
 		if location.isDiskUnavailable.Load() {
 			continue
@@ -452,8 +508,7 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 		effectiveMaxCount := location.MaxVolumeCount
 		if location.isDiskSpaceLow.Load() {
 			usedSlots := int32(location.LocalVolumesLen())
-			ecShardCount := location.EcShardCount()
-			usedSlots += int32((ecShardCount + erasure_coding.DataShardsCount - 1) / erasure_coding.DataShardsCount)
+			usedSlots += int32(erasure_coding.VolumeSlots(int64(location.EcShardCount())))
 			effectiveMaxCount = usedSlots
 		}
 		if effectiveMaxCount < 0 {
@@ -471,7 +526,7 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 		diskFreeBytes[string(location.DiskType)] += location.diskFreeBytes.Load()
 		location.volumesLock.RLock()
 		for _, v := range location.volumes {
-			curMaxFileKey, volumeMessage := v.ToVolumeInformationMessage()
+			curMaxFileKey, volumeMessage := v.ToVolumeInformationMessage(scratchMessage)
 			if volumeMessage == nil {
 				continue
 			}
@@ -495,6 +550,7 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 						v.Id, ioCount, ioErr)
 					v.markIoQuarantined()
 				}
+				quarantinedVolumes++
 				v.noWriteLock.Lock()
 				v.noWriteOrDelete = true
 				v.noWriteLock.Unlock()
@@ -509,20 +565,9 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 			if !v.expired(volumeMessage.Size, s.GetVolumeSizeLimit()) {
 				reportHash := reportHashOf(volumeMessage)
 				volumeDigest ^= reportHash
-				reported[volumeReportKey{diskId: volumeMessage.DiskId, volumeId: volumeMessage.Id}] = reportedVolume{
-					hash: reportHash,
-					short: &master_pb.VolumeShortInformationMessage{
-						Id:               volumeMessage.Id,
-						Collection:       volumeMessage.Collection,
-						ReplicaPlacement: volumeMessage.ReplicaPlacement,
-						Version:          volumeMessage.Version,
-						Ttl:              volumeMessage.Ttl,
-						DiskType:         volumeMessage.DiskType,
-						DiskId:           volumeMessage.DiskId,
-					},
-				}
-				if sendFullList || s.volumeReport.changed(volumeMessage, reportHash) {
+				if s.volumeReport.record(volumeMessage, reportHash, reportPass) || sendFullList {
 					volumeMessages = append(volumeMessages, volumeMessage)
+					scratchMessage = &master_pb.VolumeInformationMessage{}
 				}
 			} else {
 				if v.expiredLongEnough(MAX_TTL_VOLUME_REMOVAL_DELAY) {
@@ -533,38 +578,35 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 				}
 			}
 
-			if _, exist := collectionVolumeSize[v.Collection]; !exist {
-				collectionVolumeSize[v.Collection] = 0
-				collectionVolumeDeletedBytes[v.Collection] = 0
-			}
+			// The totals are rebuilt from scratch every heartbeat, so a volume
+			// on its way out is simply not added. Subtracting it took the
+			// surviving volumes' sizes down with it, and an entry here is also
+			// what says the collection is still on this server.
 			if !shouldDeleteVolume {
 				collectionVolumeSize[v.Collection] += int64(volumeMessage.Size)
 				collectionVolumeDeletedBytes[v.Collection] += int64(volumeMessage.DeletedByteCount)
-			} else {
-				collectionVolumeSize[v.Collection] -= int64(volumeMessage.Size)
-				if collectionVolumeSize[v.Collection] <= 0 {
-					delete(collectionVolumeSize, v.Collection)
-				}
-			}
 
-			if _, exist := collectionVolumeReadOnlyCount[v.Collection]; !exist {
-				collectionVolumeReadOnlyCount[v.Collection] = map[string]uint8{
-					stats.IsReadOnly:       0,
-					stats.NoWriteOrDelete:  0,
-					stats.NoWriteCanDelete: 0,
-					stats.IsDiskSpaceLow:   0,
+				counts, exist := collectionVolumeReadOnlyCount[v.Collection]
+				if !exist {
+					counts = map[string]int{
+						stats.IsReadOnly:       0,
+						stats.NoWriteOrDelete:  0,
+						stats.NoWriteCanDelete: 0,
+						stats.IsDiskSpaceLow:   0,
+					}
+					collectionVolumeReadOnlyCount[v.Collection] = counts
 				}
-			}
-			if !shouldDeleteVolume && v.IsReadOnly() {
-				collectionVolumeReadOnlyCount[v.Collection][stats.IsReadOnly] += 1
-				if v.noWriteOrDelete {
-					collectionVolumeReadOnlyCount[v.Collection][stats.NoWriteOrDelete] += 1
-				}
-				if v.noWriteCanDelete {
-					collectionVolumeReadOnlyCount[v.Collection][stats.NoWriteCanDelete] += 1
-				}
-				if v.location.isDiskSpaceLow.Load() {
-					collectionVolumeReadOnlyCount[v.Collection][stats.IsDiskSpaceLow] += 1
+				if readOnly, noWriteOrDelete, noWriteCanDelete, diskSpaceLow := v.ReadOnlyReasons(); readOnly {
+					counts[stats.IsReadOnly] += 1
+					if noWriteOrDelete {
+						counts[stats.NoWriteOrDelete] += 1
+					}
+					if noWriteCanDelete {
+						counts[stats.NoWriteCanDelete] += 1
+					}
+					if diskSpaceLow {
+						counts[stats.IsDiskSpaceLow] += 1
+					}
 				}
 			}
 		}
@@ -574,7 +616,7 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 			// delete expired volumes.
 			location.volumesLock.Lock()
 			for _, vid := range deleteVids {
-				found, err := location.deleteVolumeById(vid, false, false)
+				found, err := location.deleteVolumeById(vid, false, false, false)
 				if err == nil {
 					if found {
 						glog.V(0).Infof("volume %d is deleted", vid)
@@ -618,16 +660,20 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 		}
 	}
 
-	// A delta says nothing through silence, so volumes gone since the last
-	// report -- a deleted collection, an expired ttl -- must be named, or the
-	// master counts them until a digest mismatch buys it a full list. A full
-	// list needs no such naming: it is already the whole truth.
-	var departedVolumes []*master_pb.VolumeShortInformationMessage
-	if !sendFullList {
-		departedVolumes = s.volumeReport.departed(reported)
+	// collectionVolumeReadOnlyCount has an entry for every collection that kept
+	// a volume through this pass, including the ones counting zero read-only
+	// volumes.
+	for col := range s.reportedCollections {
+		if _, stillHere := collectionVolumeReadOnlyCount[col]; !stillHere {
+			stats.DeleteVolumeServerCollectionMetrics(col)
+		}
+	}
+	s.reportedCollections = make(map[string]struct{}, len(collectionVolumeReadOnlyCount))
+	for col := range collectionVolumeReadOnlyCount {
+		s.reportedCollections[col] = struct{}{}
 	}
 
-	s.volumeReport.commit(reported, reportGeneration)
+	departedVolumes := s.volumeReport.commit(reportPass, reportGeneration, sendFullList)
 
 	// has_no_volumes says the server holds nothing, so it may only be derived
 	// from a full list. Deriving it from a changed-only heartbeat would make a
@@ -639,27 +685,51 @@ func (s *Store) CollectHeartbeat() *master_pb.Heartbeat {
 		hasNoVolumes = false
 	}
 
+	// The state rides along on every heartbeat, not only when it changes: the
+	// first heartbeat to a master that just took the lead is how that master
+	// learns this server is in maintenance mode.
+	var state *volume_server_pb.VolumeServerState
+	if s.State != nil {
+		state = s.State.Proto()
+	}
+
+	quarantinedEcShards := 0
+	for _, location := range s.Locations {
+		location.ecVolumesLock.RLock()
+		for _, ev := range location.ecVolumes {
+			if _, _, quarantined := ev.GetIoErrorState(); quarantined {
+				quarantinedEcShards += len(ev.Shards)
+			}
+		}
+		location.ecVolumesLock.RUnlock()
+	}
+	stats.VolumeServerIoQuarantineGauge.WithLabelValues("volume").Set(float64(quarantinedVolumes))
+	stats.VolumeServerIoQuarantineGauge.WithLabelValues("ec_shard").Set(float64(quarantinedEcShards))
+
 	return &master_pb.Heartbeat{
-		Ip:              s.Ip,
-		Port:            uint32(s.Port),
-		GrpcPort:        uint32(s.GrpcPort),
-		PublicUrl:       s.PublicUrl,
-		Id:              s.Id,
-		MaxVolumeCounts: maxVolumeCounts,
-		DiskTotalBytes:  diskTotalBytes,
-		DiskFreeBytes:   diskFreeBytes,
-		MaxFileKey:      NeedleIdToUint64(maxFileKey),
-		DataCenter:      s.dataCenter,
-		Rack:            s.rack,
-		Volumes:         heartbeatVolumes,
-		ChangedVolumes:  changedVolumes,
-		DeletedVolumes:  departedVolumes,
-		VolumeDigest:    &volumeDigest,
-		DeletedEcShards: deletedEcVolumes,
-		HasNoVolumes:    hasNoVolumes,
-		HasNoEcShards:   len(ecVolumeMessages) == 0,
-		LocationUuids:   uuidList,
-		DiskTags:        diskTags,
+		Ip:                 s.Ip,
+		Port:               uint32(s.Port),
+		GrpcPort:           uint32(s.GrpcPort),
+		PublicUrl:          s.PublicUrl,
+		Id:                 s.Id,
+		MaxVolumeCounts:    maxVolumeCounts,
+		DiskTotalBytes:     diskTotalBytes,
+		DiskFreeBytes:      diskFreeBytes,
+		MaxFileKey:         NeedleIdToUint64(maxFileKey),
+		DataCenter:         s.dataCenter,
+		Rack:               s.rack,
+		Volumes:            heartbeatVolumes,
+		ChangedVolumes:     changedVolumes,
+		DeletedVolumes:     departedVolumes,
+		VolumeDigest:       &volumeDigest,
+		DeletedEcShards:    deletedEcVolumes,
+		HasNoVolumes:       hasNoVolumes,
+		HasNoEcShards:      len(ecVolumeMessages) == 0,
+		LocationUuids:      uuidList,
+		DiskTags:           diskTags,
+		State:              state,
+		MaxVolumeIdSeen:    uint32(s.MaxVolumeIdSeen()),
+		LastSeenTopologyId: s.LastSeenTopologyId(),
 	}
 
 }
@@ -702,10 +772,13 @@ func (s *Store) deleteExpiredEcVolumes() (ecShards, deleted []*master_pb.VolumeE
 
 		// Collect ecVolume to be deleted
 		var toDeleteEvs []*erasure_coding.EcVolume
+		var ioQuarantinedEvs []*erasure_coding.EcVolume
 		location.ecVolumesLock.RLock()
 		for _, ev := range location.ecVolumes {
 			if ev.IsTimeToDestroy() {
 				toDeleteEvs = append(toDeleteEvs, ev)
+			} else if ioErr, ioCount, quarantined := ev.GetIoErrorState(); quarantined || (ioErr != nil && ioCount >= IoErrorTolerance) {
+				ioQuarantinedEvs = append(ioQuarantinedEvs, ev)
 			} else {
 				messages := ev.ToVolumeEcShardInformationMessage(uint32(diskId))
 				ecShards = append(ecShards, messages...)
@@ -727,19 +800,57 @@ func (s *Store) deleteExpiredEcVolumes() (ecShards, deleted []*master_pb.VolumeE
 			// from volumes that were already collected
 			deleted = append(deleted, messages...)
 		}
+
+		// Quarantine EC volumes on faulty media: keep them in memory (so
+		// healthz can observe the quarantine state and an operator can
+		// recover) but stop reporting them so the master re-replicates
+		// from healthy peers. Mirrors the regular volume quarantine.
+		for _, ev := range ioQuarantinedEvs {
+			ioErr, ioCount, quarantined := ev.GetIoErrorState()
+			if !quarantined {
+				ev.MarkIoQuarantined()
+				glog.Warningf("ec volume %d quarantined after %d consecutive IO errors: %v",
+					ev.VolumeId, ioCount, ioErr)
+			}
+		}
 	}
 	return
 }
 
 func (s *Store) SetStopping() {
-	s.isStopping = true
+	s.isStopping.Store(true)
 	for _, location := range s.Locations {
 		location.SetStopping()
 	}
 }
 
 func (s *Store) IsStopping() bool {
-	return s.isStopping
+	return s.isStopping.Load()
+}
+
+// HasIoQuarantine reports whether any local volume or EC shard is currently
+// quarantined due to sustained storage-media EIO. Used by /healthz so a
+// load balancer can drain a server whose underlying media is faulty.
+func (s *Store) HasIoQuarantine() bool {
+	for _, location := range s.Locations {
+		location.volumesLock.RLock()
+		for _, v := range location.volumes {
+			if _, _, quarantined := v.getIoErrorState(); quarantined {
+				location.volumesLock.RUnlock()
+				return true
+			}
+		}
+		location.volumesLock.RUnlock()
+		location.ecVolumesLock.RLock()
+		for _, ev := range location.ecVolumes {
+			if _, _, quarantined := ev.GetIoErrorState(); quarantined {
+				location.ecVolumesLock.RUnlock()
+				return true
+			}
+		}
+		location.ecVolumesLock.RUnlock()
+	}
+	return false
 }
 
 func (s *Store) LoadNewVolumes() {
@@ -760,7 +871,7 @@ func (s *Store) WriteVolumeNeedle(i needle.VolumeId, n *needle.Needle, checkCook
 			err = fmt.Errorf("volume %d is read only", i)
 			return
 		}
-		_, _, isUnchanged, err = v.writeNeedle2(n, checkCookie, fsync && !s.isStopping)
+		_, _, isUnchanged, err = v.writeNeedle2(n, checkCookie, fsync, s.isStopping.Load())
 		return
 	}
 	glog.V(0).Infoln("volume", i, "not found!")
@@ -770,7 +881,10 @@ func (s *Store) WriteVolumeNeedle(i needle.VolumeId, n *needle.Needle, checkCook
 
 func (s *Store) DeleteVolumeNeedle(i needle.VolumeId, n *needle.Needle) (Size, error) {
 	if v := s.findVolume(i); v != nil {
-		if v.noWriteOrDelete {
+		v.noWriteLock.RLock()
+		noWriteOrDelete := v.noWriteOrDelete
+		v.noWriteLock.RUnlock()
+		if noWriteOrDelete {
 			return 0, fmt.Errorf("volume %d is read only", i)
 		}
 		return v.deleteNeedle2(n)
@@ -807,15 +921,47 @@ func (s *Store) HasVolume(i needle.VolumeId) bool {
 	return v != nil
 }
 
-func (s *Store) MarkVolumeReadonly(i needle.VolumeId, persist bool) error {
+func (s *Store) MarkVolumeReadonly(i needle.VolumeId, canDelete bool, persist bool) error {
 	v := s.findVolume(i)
 	if v == nil {
 		return fmt.Errorf("volume %d not found", i)
 	}
+	// Wait for in-flight appends so a mark acked mid-write cannot race an
+	// encode that reads the index and deletes the replica the write lands on.
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
+	v.dataFileAccessLock.Lock()
+	defer v.dataFileAccessLock.Unlock()
+	if canDelete && !v.HasRemoteFile() {
+		// deletes append tombstones to .idx, which a readonly boot opened
+		// O_RDONLY; remote volumes already delete through a RDWR idx
+		if err := v.reopenIdxForWriteLocked(); err != nil {
+			return fmt.Errorf("volume %d reopen idx for write: %v", i, err)
+		}
+	}
 	v.noWriteLock.Lock()
-	v.noWriteOrDelete = true
+	prevNoWriteOrDelete := v.noWriteOrDelete
+	prevNoWriteCanDelete := v.noWriteCanDelete
+	v.noWriteOrDelete = !canDelete
+	if canDelete {
+		v.noWriteCanDelete = true
+	} else if !v.HasRemoteFile() {
+		// downgrading a canDelete mark; remote volumes keep their derived flag
+		v.noWriteCanDelete = false
+	}
 	if persist {
-		v.PersistReadOnly(true)
+		if err := v.PersistReadOnly(true, canDelete); err != nil {
+			// A pre-commit failure leaves the old .vif intact, so roll
+			// back the in-memory flags. A NotCrashDurableError means the
+			// rename already committed; keep flags aligned with the file.
+			var ndErr *volume_info.NotCrashDurableError
+			if !errors.As(err, &ndErr) {
+				v.noWriteOrDelete = prevNoWriteOrDelete
+				v.noWriteCanDelete = prevNoWriteCanDelete
+			}
+			v.noWriteLock.Unlock()
+			return fmt.Errorf("volume %d persist read-only: %w", i, err)
+		}
 	}
 	v.noWriteLock.Unlock()
 	return nil
@@ -826,6 +972,9 @@ func (s *Store) MarkVolumeWritable(i needle.VolumeId) error {
 	if v == nil {
 		return fmt.Errorf("volume %d not found", i)
 	}
+	if err := v.UnavailableError(); err != nil {
+		return fmt.Errorf("volume %d cannot be marked writable: %w", i, err)
+	}
 	// If the volume booted with .vif ReadOnly=true, .idx is opened O_RDONLY
 	// and v.nm is a SortedFileNeedleMap that rejects Put. Swap to writable
 	// form before flipping the flag so the next write doesn't race past a
@@ -834,31 +983,79 @@ func (s *Store) MarkVolumeWritable(i needle.VolumeId) error {
 		return fmt.Errorf("volume %d reopen idx for write: %v", i, err)
 	}
 	v.noWriteLock.Lock()
+	if v.ioUnavailable {
+		v.noWriteLock.Unlock()
+		return fmt.Errorf("volume %d cannot be marked writable: %w", i, v.UnavailableError())
+	}
+	prevNoWriteOrDelete := v.noWriteOrDelete
+	prevNoWriteCanDelete := v.noWriteCanDelete
 	v.noWriteOrDelete = false
-	v.PersistReadOnly(false)
+	// A remote-tiered volume keeps the delete-only mode load() derives: its
+	// .dat cannot take appends, so "writable" resolves to can-delete rather
+	// than advertising writable with no local data file.
+	v.noWriteCanDelete = v.HasRemoteFile()
+	persistErr := v.PersistReadOnly(false, false)
+	if persistErr != nil {
+		var ndErr *volume_info.NotCrashDurableError
+		if !errors.As(persistErr, &ndErr) {
+			// Pre-commit failure: the old .vif is intact, so roll back
+			// the in-memory flags and return early.
+			v.noWriteOrDelete = prevNoWriteOrDelete
+			v.noWriteCanDelete = prevNoWriteCanDelete
+			v.noWriteLock.Unlock()
+			return fmt.Errorf("volume %d persist writable: %w", i, persistErr)
+		}
+		// Post-rename durability failure: the file already holds the new
+		// mode. Wrap the error but continue with post-commit work so the
+		// volume is usable in memory even though the rename may not
+		// survive a crash.
+		persistErr = fmt.Errorf("volume %d persist writable: %w", i, persistErr)
+	}
 	v.noWriteLock.Unlock()
 	// Clear the EIO streak and the sticky quarantine flag so the next
 	// CollectHeartbeat can announce the volume again. If the disk is
 	// still bad, the next failed op will re-arm the streak.
 	v.resetIoErrorState()
-	return nil
+	return persistErr
 }
 
-func (s *Store) MountVolume(i needle.VolumeId) error {
+// MountVolume loads a volume and announces it after all optional validators
+// succeed. A validator failure unloads the volume before returning the error,
+// so an invalid newly copied replica is never announced to the master.
+func (s *Store) MountVolume(i needle.VolumeId, collection *string, validators ...func(*Volume) error) error {
+	return s.mountVolume(i, collection, validators...)
+}
+
+func (s *Store) mountVolume(i needle.VolumeId, collection *string, validators ...func(*Volume) error) error {
 	for diskId, location := range s.Locations {
-		if found := location.LoadVolume(uint32(diskId), i, s.NeedleMapKind); found == true {
+		if found := location.LoadVolume(uint32(diskId), i, s.NeedleMapKind, collection); found == true {
 			glog.V(0).Infof("mount volume %d", i)
 			v := s.findVolume(i)
 			v.diskId = uint32(diskId) // Set disk ID when mounting
-			s.NewVolumesChan <- &master_pb.VolumeShortInformationMessage{
-				Id:               uint32(v.Id),
-				Collection:       v.Collection,
-				ReplicaPlacement: uint32(v.ReplicaPlacement.Byte()),
-				Version:          uint32(v.Version()),
-				Ttl:              v.Ttl.ToUint32(),
-				DiskType:         string(v.location.DiskType),
-				DiskId:           uint32(diskId),
+			for _, validator := range validators {
+				if validator == nil {
+					continue
+				}
+				if err := validator(v); err != nil {
+					if unloadErr := location.UnloadVolume(i); unloadErr != nil {
+						return fmt.Errorf("%w; failed to unload volume %d after validation error: %v", err, i, unloadErr)
+					}
+					return err
+				}
 			}
+			readOnly, _, readOnlyCanDelete, _ := v.ReadOnlyReasons()
+			s.NewVolumesChan <- &master_pb.VolumeShortInformationMessage{
+				Id:                uint32(v.Id),
+				Collection:        v.Collection,
+				ReplicaPlacement:  uint32(v.ReplicaPlacement.Byte()),
+				Version:           uint32(v.Version()),
+				Ttl:               v.Ttl.ToUint32(),
+				DiskType:          string(v.location.DiskType),
+				DiskId:            uint32(diskId),
+				ReadOnly:          readOnly,
+				ReadOnlyCanDelete: readOnlyCanDelete,
+			}
+			s.UpdateMaxVolumeIdSeen(i)
 			return nil
 		}
 	}
@@ -967,10 +1164,13 @@ func RenameOrCopyFile(src, dst string) error {
 	return nil
 }
 
-func (s *Store) DeleteVolume(i needle.VolumeId, onlyEmpty bool, keepRemoteData bool) error {
+func (s *Store) DeleteVolume(i needle.VolumeId, onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) error {
 	// Delete every copy of the volume id across disks, not just the first match, so
 	// a stale twin (e.g. a re-attached disk; NewStore has no cross-disk duplicate
 	// guard) cannot survive a delete and re-register as the volume's content.
+	if onlyEmpty || onlyGarbage {
+		return s.deleteVolumeGuarded(i, onlyEmpty, onlyGarbage, keepRemoteData)
+	}
 	deletedAny := false
 	var errs []error
 	for _, location := range s.Locations {
@@ -987,7 +1187,7 @@ func (s *Store) DeleteVolume(i needle.VolumeId, onlyEmpty bool, keepRemoteData b
 			DiskType:         string(location.DiskType),
 			DiskId:           v.diskId,
 		}
-		err := location.DeleteVolume(i, onlyEmpty, keepRemoteData)
+		err := location.DeleteVolume(i, onlyEmpty, onlyGarbage, keepRemoteData)
 		if err == nil {
 			glog.V(0).Infof("DeleteVolume %d disk_id:%d", i, v.diskId)
 			s.DeletedVolumesChan <- &message
@@ -997,7 +1197,7 @@ func (s *Store) DeleteVolume(i needle.VolumeId, onlyEmpty bool, keepRemoteData b
 		} else if err == ErrVolumeNotEmpty {
 			// onlyEmpty: a non-empty copy aborts the delete rather than leaving a
 			// partial result across disks.
-			return fmt.Errorf("DeleteVolume %d: %v", i, err)
+			return fmt.Errorf("DeleteVolume %d: %w", i, err)
 		} else {
 			// A real failure on one disk must not be masked by another copy's
 			// success: a stale copy left on the failing disk would re-register.
@@ -1009,13 +1209,95 @@ func (s *Store) DeleteVolume(i needle.VolumeId, onlyEmpty bool, keepRemoteData b
 		return fmt.Errorf("DeleteVolume %d failed on some disks: %w", i, errors.Join(errs...))
 	}
 	if !deletedAny {
-		return fmt.Errorf("delete volume %d not found on disk", i)
+		return fmt.Errorf("delete volume %d not found on disk: %w", i, ErrVolumeNotFound)
+	}
+	return nil
+}
+
+// deleteVolumeGuarded removes a volume only when every duplicate copy passes
+// the emptiness guards. Each copy's locks are held across validation and
+// removal, so a write or mount cannot slip between the check on one copy and
+// the destroy of another and leave a partial delete.
+func (s *Store) deleteVolumeGuarded(i needle.VolumeId, onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) error {
+	var lockedLocations []*DiskLocation
+	var lockedVolumes []*Volume
+	unlockAll := func() {
+		for _, v := range lockedVolumes {
+			v.dataFileAccessLock.Unlock()
+			v.dataFileSyncLock.Unlock()
+		}
+		for _, location := range lockedLocations {
+			location.volumesLock.Unlock()
+		}
+		lockedVolumes, lockedLocations = nil, nil
+	}
+	defer unlockAll()
+	for _, location := range s.Locations {
+		location.volumesLock.Lock()
+		if v, ok := location.volumes[i]; ok {
+			v.dataFileSyncLock.Lock()
+			v.dataFileAccessLock.Lock()
+			lockedLocations = append(lockedLocations, location)
+			lockedVolumes = append(lockedVolumes, v)
+		} else {
+			location.volumesLock.Unlock()
+		}
+	}
+
+	for _, v := range lockedVolumes {
+		if err := v.checkDeletableLocked(onlyEmpty, onlyGarbage); err != nil {
+			return fmt.Errorf("DeleteVolume %d: %w", i, err)
+		}
+	}
+
+	deletedAny := false
+	var errs []error
+	var deletedMessages []*master_pb.VolumeShortInformationMessage
+	for _, location := range lockedLocations {
+		v := location.volumes[i]
+		message := &master_pb.VolumeShortInformationMessage{
+			Id:               uint32(v.Id),
+			Collection:       v.Collection,
+			ReplicaPlacement: uint32(v.ReplicaPlacement.Byte()),
+			Version:          uint32(v.Version()),
+			Ttl:              v.Ttl.ToUint32(),
+			DiskType:         string(location.DiskType),
+			DiskId:           v.diskId,
+		}
+		if err := v.destroyLocked(onlyEmpty, onlyGarbage, keepRemoteData); err != nil {
+			// A real failure on one disk must not be masked by another copy's
+			// success: a stale copy left on the failing disk would re-register.
+			glog.Errorf("DeleteVolume %d: %v", i, err)
+			errs = append(errs, err)
+			continue
+		}
+		delete(location.volumes, i)
+		glog.V(0).Infof("DeleteVolume %d disk_id:%d", i, v.diskId)
+		deletedMessages = append(deletedMessages, message)
+		deletedAny = true
+	}
+	// Send after the locks are released: a full channel would otherwise block
+	// here while the draining heartbeat loop waits on these same locks.
+	unlockAll()
+	for _, m := range deletedMessages {
+		s.DeletedVolumesChan <- m
+	}
+	if len(errs) > 0 {
+		return fmt.Errorf("DeleteVolume %d failed on some disks: %w", i, errors.Join(errs...))
+	}
+	if !deletedAny {
+		return fmt.Errorf("delete volume %d not found on disk: %w", i, ErrVolumeNotFound)
 	}
 	return nil
 }
 
 func (s *Store) ConfigureVolume(i needle.VolumeId, replication string) error {
 
+	rp, err := super_block.NewReplicaPlacementFromString(replication)
+	if err != nil {
+		return fmt.Errorf("volume %d replication %q: %v", i, replication, err)
+	}
+
 	for _, location := range s.Locations {
 		fileInfo, found := location.LocateVolume(i)
 		if !found {
@@ -1033,18 +1315,56 @@ func (s *Store) ConfigureVolume(i needle.VolumeId, replication string) error {
 		if err != nil {
 			return fmt.Errorf("volume %d failed to save vif: %v", i, err)
 		}
-		return nil
+		if v := s.GetVolume(i); v != nil {
+			return v.UpdateReplicaPlacement(rp)
+		}
+		return updateDatReplicaPlacement(filepath.Join(location.Directory, baseFileName+".dat"), i, rp)
 	}
 
 	return fmt.Errorf("volume %d not found on disk", i)
 }
 
+// updateDatReplicaPlacement rewrites the replica placement in a .dat header
+// for a volume that is not mounted; a mounted volume goes through
+// UpdateReplicaPlacement so the change lands under its data-file locks.
+func updateDatReplicaPlacement(datFileName string, vid needle.VolumeId, rp *super_block.ReplicaPlacement) error {
+	f, err := os.OpenFile(datFileName, os.O_RDWR, 0644)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil // remote-only volume: the .vif carries the placement
+		}
+		return fmt.Errorf("volume %d failed to open %s: %v", vid, datFileName, err)
+	}
+	defer f.Close()
+	datBackend := backend.NewDiskFile(f)
+	superBlock, err := super_block.ReadSuperBlock(datBackend)
+	if err != nil {
+		return fmt.Errorf("volume %d failed to parse superblock: %v", vid, err)
+	}
+	superBlock.ReplicaPlacement = rp
+	if _, err := datBackend.WriteAt(superBlock.Bytes(), 0); err != nil {
+		return fmt.Errorf("volume %d failed to write superblock: %v", vid, err)
+	}
+	if err := datBackend.Sync(); err != nil {
+		return fmt.Errorf("volume %d failed to sync superblock: %v", vid, err)
+	}
+	return nil
+}
+
 func (s *Store) SetVolumeSizeLimit(x uint64) {
-	atomic.StoreUint64(&s.volumeSizeLimit, x)
+	s.volumeSizeLimit.Store(x)
 }
 
 func (s *Store) GetVolumeSizeLimit() uint64 {
-	return atomic.LoadUint64(&s.volumeSizeLimit)
+	return s.volumeSizeLimit.Load()
+}
+
+// SetSyncBatchOption applies the durable-write batch window to every disk.
+// It runs at startup, before any volume takes a write.
+func (s *Store) SetSyncBatchOption(syncBatch SyncBatchOption) {
+	for _, location := range s.Locations {
+		location.syncBatch = syncBatch
+	}
 }
 
 func (s *Store) SetPreallocate(x bool) {
@@ -1065,12 +1385,8 @@ func (s *Store) MaybeAdjustVolumeMax() (hasChanges bool) {
 		if diskLocation.OriginalMaxVolumeCount == 0 {
 			currentMaxVolumeCount := atomic.LoadInt32(&diskLocation.MaxVolumeCount)
 			diskStatus := stats.NewDiskStatus(diskLocation.Directory)
-			var unusedSpace uint64 = 0
-			unclaimedSpaces := int64(diskStatus.Free)
-			if !s.GetPreallocate() {
-				unusedSpace = diskLocation.UnUsedSpace(volumeSizeLimit)
-				unclaimedSpaces -= int64(unusedSpace)
-			}
+			unusedSpace := diskLocation.UnUsedSpace(volumeSizeLimit)
+			unclaimedSpaces := int64(diskStatus.Free) - int64(unusedSpace)
 			volCount := diskLocation.VolumesLen()
 			ecShardCount := diskLocation.EcShardCount()
 			maxVolumeCount := int32(volCount) + int32((ecShardCount+erasure_coding.DataShardsCount-1)/erasure_coding.DataShardsCount)
diff --git a/weed/storage/store_collection_metrics_test.go b/weed/storage/store_collection_metrics_test.go
new file mode 100644
index 0000000000..e4618ca290
--- /dev/null
+++ b/weed/storage/store_collection_metrics_test.go
@@ -0,0 +1,182 @@
+package storage
+
+import (
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// fillTestVolume writes one needle and dates the volume now. A volume with no
+// content never expires, and the needle carries no append time of its own,
+// which would leave the volume dated to the epoch.
+func fillTestVolume(t *testing.T, v *Volume) {
+	t.Helper()
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(v.Id)), true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	v.lastModifiedTsSeconds = uint64(time.Now().Unix())
+}
+
+// The per-collection gauges are only ever set for collections the heartbeat
+// still finds on this server. A volume.balance that moves a collection's last
+// volume off a server used to leave its read-only count - marked read-only for
+// the move, moments before it went - standing on that server until a restart,
+// with nothing in volume.list to match it.
+func TestCollectHeartbeatClearsMetricsOfDepartedCollection(t *testing.T) {
+	stats.VolumeServerReadOnlyVolumeGauge.Reset()
+	stats.VolumeServerDiskSizeGauge.Reset()
+	t.Cleanup(stats.VolumeServerReadOnlyVolumeGauge.Reset)
+	t.Cleanup(stats.VolumeServerDiskSizeGauge.Reset)
+
+	store := newTestStore(t, 1)
+	mountTestVolume(t, store.Locations[0], 1, "pics").noWriteOrDelete = true
+
+	store.CollectHeartbeat()
+	if got := testutil.ToFloat64(stats.VolumeServerReadOnlyVolumeGauge.WithLabelValues("pics", stats.IsReadOnly)); got != 1 {
+		t.Fatalf("read-only volumes of pics = %v, want 1", got)
+	}
+
+	if err := store.UnmountVolume(1); err != nil {
+		t.Fatalf("UnmountVolume: %v", err)
+	}
+	store.CollectHeartbeat()
+
+	if n := testutil.CollectAndCount(stats.VolumeServerReadOnlyVolumeGauge); n != 0 {
+		t.Errorf("%d read-only series left after the collection left the server", n)
+	}
+	if n := testutil.CollectAndCount(stats.VolumeServerDiskSizeGauge); n != 0 {
+		t.Errorf("%d disk size series left after the collection left the server", n)
+	}
+}
+
+// A volume being deleted for expiry is already gone as far as the gauges are
+// concerned, so the heartbeat that drops the collection's last one has to take
+// its series along rather than leave them standing for another pass.
+func TestCollectHeartbeatClearsMetricsWhenTheLastVolumeExpires(t *testing.T) {
+	stats.VolumeServerReadOnlyVolumeGauge.Reset()
+	stats.VolumeServerDiskSizeGauge.Reset()
+	t.Cleanup(stats.VolumeServerReadOnlyVolumeGauge.Reset)
+	t.Cleanup(stats.VolumeServerDiskSizeGauge.Reset)
+
+	store := newTestStore(t, 1)
+	store.SetVolumeSizeLimit(30 << 30)
+	v := mountTestVolume(t, store.Locations[0], 1, "pics")
+	v.Ttl = &needle.TTL{Count: 1, Unit: needle.Minute}
+	fillTestVolume(t, v)
+
+	store.CollectHeartbeat()
+	if got := testutil.ToFloat64(stats.VolumeServerDiskSizeGauge.WithLabelValues("pics", "normal")); got == 0 {
+		t.Fatal("disk size of pics = 0, want the written needle")
+	}
+
+	v.lastModifiedTsSeconds = uint64(time.Now().Add(-time.Hour).Unix())
+	store.CollectHeartbeat()
+
+	if store.findVolume(1) != nil {
+		t.Fatal("the expired volume outlived the heartbeat")
+	}
+	if n := testutil.CollectAndCount(stats.VolumeServerReadOnlyVolumeGauge); n != 0 {
+		t.Errorf("%d read-only series left after the last volume expired", n)
+	}
+	if n := testutil.CollectAndCount(stats.VolumeServerDiskSizeGauge); n != 0 {
+		t.Errorf("%d disk size series left after the last volume expired", n)
+	}
+}
+
+// A collection that loses one volume to expiry and keeps another must report
+// what is left, not what is left minus what went.
+func TestCollectHeartbeatSizesOnlySurvivingVolumes(t *testing.T) {
+	stats.VolumeServerDiskSizeGauge.Reset()
+	t.Cleanup(stats.VolumeServerDiskSizeGauge.Reset)
+
+	store := newTestStore(t, 2)
+	store.SetVolumeSizeLimit(30 << 30)
+	// One volume per location, so the surviving one is always scanned first.
+	surviving := mountTestVolume(t, store.Locations[0], 1, "pics")
+	fillTestVolume(t, surviving)
+	expiring := mountTestVolume(t, store.Locations[1], 2, "pics")
+	expiring.Ttl = &needle.TTL{Count: 1, Unit: needle.Minute}
+	fillTestVolume(t, expiring)
+	// Both volumes carry deleted bytes, which are totalled the same way.
+	for _, v := range []*Volume{surviving, expiring} {
+		n := newRandomNeedle(uint64(v.Id) + 100)
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+			t.Fatalf("write needle: %v", err)
+		}
+		if _, err := v.deleteNeedle2(n); err != nil {
+			t.Fatalf("delete needle: %v", err)
+		}
+	}
+
+	heartbeat := store.CollectHeartbeat()
+	var survivingSize, survivingDeleted uint64
+	for _, m := range heartbeat.Volumes {
+		if m.Id == 1 {
+			survivingSize, survivingDeleted = m.Size, m.DeletedByteCount
+		}
+	}
+	if survivingSize == 0 || survivingDeleted == 0 {
+		t.Fatalf("the surviving volume reported size %d and %d deleted bytes, want both", survivingSize, survivingDeleted)
+	}
+
+	expiring.lastModifiedTsSeconds = uint64(time.Now().Add(-time.Hour).Unix())
+	store.CollectHeartbeat()
+
+	if store.findVolume(1) == nil {
+		t.Fatal("the volume without a ttl was deleted")
+	}
+	if got := testutil.ToFloat64(stats.VolumeServerDiskSizeGauge.WithLabelValues("pics", "normal")); got != float64(survivingSize) {
+		t.Errorf("disk size of pics = %v, want %d, the volume still here", got, survivingSize)
+	}
+	if got := testutil.ToFloat64(stats.VolumeServerDiskSizeGauge.WithLabelValues("pics", "deleted_bytes")); got != float64(survivingDeleted) {
+		t.Errorf("deleted bytes of pics = %v, want %d, the volume still here", got, survivingDeleted)
+	}
+}
+
+// The counts are per collection and per server, and a server holds far more
+// than 255 volumes of one collection.
+func TestCollectHeartbeatCountsPast255ReadOnlyVolumes(t *testing.T) {
+	stats.VolumeServerReadOnlyVolumeGauge.Reset()
+	t.Cleanup(stats.VolumeServerReadOnlyVolumeGauge.Reset)
+
+	store := newTestStore(t, 1)
+	const readOnlyVolumes = 300
+	for i := 1; i <= readOnlyVolumes; i++ {
+		mountTestVolume(t, store.Locations[0], needle.VolumeId(i), "pics")
+		store.findVolume(needle.VolumeId(i)).noWriteOrDelete = true
+	}
+
+	store.CollectHeartbeat()
+	if got := testutil.ToFloat64(stats.VolumeServerReadOnlyVolumeGauge.WithLabelValues("pics", stats.IsReadOnly)); got != readOnlyVolumes {
+		t.Errorf("read-only volumes of pics = %v, want %d", got, readOnlyVolumes)
+	}
+}
+
+func TestCollectErasureCodingHeartbeatClearsMetricsOfDepartedCollection(t *testing.T) {
+	stats.VolumeServerDiskSizeGauge.Reset()
+	t.Cleanup(stats.VolumeServerDiskSizeGauge.Reset)
+
+	store, _, vid, collection, plant := setupECStoreWithMixedDisks(t)
+	plant()
+	if err := store.MountEcShards(collection, vid, 0, ""); err != nil {
+		t.Fatalf("MountEcShards: %v", err)
+	}
+
+	store.CollectErasureCodingHeartbeat()
+	if got := testutil.ToFloat64(stats.VolumeServerDiskSizeGauge.WithLabelValues(collection, "ec")); got == 0 {
+		t.Fatalf("ec disk size of %s = 0, want the mounted shard's size", collection)
+	}
+
+	if err := store.UnmountEcShards(vid, erasure_coding.ShardId(0), 0); err != nil {
+		t.Fatalf("UnmountEcShards: %v", err)
+	}
+	store.CollectErasureCodingHeartbeat()
+
+	if n := testutil.CollectAndCount(stats.VolumeServerDiskSizeGauge); n != 0 {
+		t.Errorf("%d disk size series left after the collection's shards left the server", n)
+	}
+}
diff --git a/weed/storage/store_configure_volume_test.go b/weed/storage/store_configure_volume_test.go
new file mode 100644
index 0000000000..8cb4c85629
--- /dev/null
+++ b/weed/storage/store_configure_volume_test.go
@@ -0,0 +1,47 @@
+package storage
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// volume.configure must leave the live superblock, the .dat header, the
+// in-memory .vif copy and the .vif on disk all on the new placement.
+func TestConfigureVolumeUpdatesSuperblock(t *testing.T) {
+	dir := t.TempDir()
+	store := NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		[]string{dir}, []int32{10}, []util.MinFreeSpace{{}}, "", NeedleMapInMemory,
+		[]types.DiskType{types.HardDriveType}, nil, 0, stats.DefaultDiskIOProbeConfig())
+	t.Cleanup(store.Close)
+	require.NoError(t, store.AddVolume(1, "", NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+
+	require.NoError(t, store.ConfigureVolume(1, "010"))
+
+	v := store.GetVolume(1)
+	require.NotNil(t, v)
+	require.Equal(t, "010", v.ReplicaPlacement.String())
+	require.Equal(t, "010", v.GetVolumeInfo().GetReplication())
+
+	datFile, err := os.Open(v.FileName(".dat"))
+	require.NoError(t, err)
+	sb, err := super_block.ReadSuperBlock(backend.NewDiskFile(datFile))
+	require.NoError(t, err)
+	datFile.Close()
+	require.Equal(t, "010", sb.ReplicaPlacement.String())
+
+	volumeInfo, _, _, err := volume_info.MaybeLoadVolumeInfo(v.FileName(".vif"))
+	require.NoError(t, err)
+	require.Equal(t, "010", volumeInfo.GetReplication())
+
+	require.Error(t, store.ConfigureVolume(1, "bogus"))
+}
diff --git a/weed/storage/store_consolidate_index_test.go b/weed/storage/store_consolidate_index_test.go
index d5f81c452c..296a837cf3 100644
--- a/weed/storage/store_consolidate_index_test.go
+++ b/weed/storage/store_consolidate_index_test.go
@@ -86,14 +86,14 @@ func TestConsolidateVolumeIndexMovesIdxToIdxDir(t *testing.T) {
 	require.FileExists(t, dataIdx, "precondition: index co-located with the data")
 
 	store := newIdxSplitStore(t, dataDir, idxDir)
-	require.NoError(t, store.MountVolume(vid))
+	require.NoError(t, store.MountVolume(vid, nil))
 
 	// Write a needle so the relocate has real index state to preserve.
 	mounted := store.findVolume(vid)
 	require.NotNil(t, mounted)
 	n := &needle.Needle{Id: types.Uint64ToNeedleId(42), Data: []byte("payload-across-relocate")}
 	n.Checksum = needle.NewCRC(n.Data)
-	_, _, _, err = mounted.writeNeedle2(n, true, false)
+	_, _, _, err = mounted.writeNeedle2(n, true, false, false)
 	require.NoError(t, err)
 
 	require.NoError(t, store.ConsolidateVolumeIndex(vid))
@@ -122,7 +122,7 @@ func TestConsolidateVolumeIndexNoopWithoutIdxDir(t *testing.T) {
 	v.Close()
 
 	store := newIdxSplitStore(t, dataDir, dataDir) // idx dir == data dir
-	require.NoError(t, store.MountVolume(vid))
+	require.NoError(t, store.MountVolume(vid, nil))
 
 	require.NoError(t, store.ConsolidateVolumeIndex(vid))
 	require.FileExists(t, filepath.Join(dataDir, "8.idx"), "index stays put without -dir.idx")
diff --git a/weed/storage/store_delete_volume_test.go b/weed/storage/store_delete_volume_test.go
new file mode 100644
index 0000000000..52d7aa31d5
--- /dev/null
+++ b/weed/storage/store_delete_volume_test.go
@@ -0,0 +1,65 @@
+package storage
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+func TestDeleteVolumeErrorsAreInspectable(t *testing.T) {
+	store := newTestStore(t, 1)
+	mountCollectionVolume(t, store.Locations[0], 5, "")
+	n := &needle.Needle{Id: types.Uint64ToNeedleId(1), Data: []byte("keep")}
+	if _, err := store.WriteVolumeNeedle(5, n, false, false); err != nil {
+		t.Fatal(err)
+	}
+
+	err := store.DeleteVolume(5, true, false, false)
+	if !errors.Is(err, ErrVolumeNotEmpty) {
+		t.Fatalf("only-empty delete of a non-empty volume = %v, want ErrVolumeNotEmpty", err)
+	}
+	if _, found := store.Locations[0].FindVolume(5); !found {
+		t.Fatal("refused delete removed the volume")
+	}
+
+	err = store.DeleteVolume(99, false, false, false)
+	if !errors.Is(err, ErrVolumeNotFound) {
+		t.Fatalf("delete of an absent volume = %v, want ErrVolumeNotFound", err)
+	}
+
+	if err := store.DeleteVolume(5, false, false, false); err != nil {
+		t.Fatalf("forced delete: %v", err)
+	}
+}
+
+func TestDeleteVolumeOnlyGarbage(t *testing.T) {
+	store := newTestStore(t, 1)
+	mountCollectionVolume(t, store.Locations[0], 5, "")
+	n := &needle.Needle{Id: types.Uint64ToNeedleId(1), Data: []byte("keep")}
+	if _, err := store.WriteVolumeNeedle(5, n, false, false); err != nil {
+		t.Fatal(err)
+	}
+
+	// A live needle refuses, and the volume stays mounted.
+	err := store.DeleteVolume(5, false, true, false)
+	if !errors.Is(err, ErrVolumeNotEmpty) {
+		t.Fatalf("only-garbage delete of a live volume = %v, want ErrVolumeNotEmpty", err)
+	}
+	if _, found := store.Locations[0].FindVolume(5); !found {
+		t.Fatal("refused delete removed the volume")
+	}
+
+	if _, err := store.DeleteVolumeNeedle(5, n); err != nil {
+		t.Fatal(err)
+	}
+	// The shell sends both flags so a pre-upgrade server still refuses; either
+	// check passing must suffice here.
+	if err := store.DeleteVolume(5, true, true, false); err != nil {
+		t.Fatalf("delete of a fully deleted volume: %v", err)
+	}
+	if _, found := store.Locations[0].FindVolume(5); found {
+		t.Fatal("fully deleted volume survived")
+	}
+}
diff --git a/weed/storage/store_duplicate_vid_test.go b/weed/storage/store_duplicate_vid_test.go
index 160c4a9bab..740d2bab54 100644
--- a/weed/storage/store_duplicate_vid_test.go
+++ b/weed/storage/store_duplicate_vid_test.go
@@ -2,9 +2,11 @@ package storage
 
 import (
 	"testing"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/stretchr/testify/require"
 )
 
@@ -42,10 +44,87 @@ func TestDeleteVolumeRemovesAllDuplicateCopies(t *testing.T) {
 		loc.SetVolume(vid, v)
 	}
 
-	require.NoError(t, store.DeleteVolume(vid, false, false))
+	require.NoError(t, store.DeleteVolume(vid, false, false, false))
 
 	_, found0 := store.Locations[0].FindVolume(vid)
 	_, found1 := store.Locations[1].FindVolume(vid)
 	require.False(t, found0, "copy on disk 0 must be deleted")
 	require.False(t, found1, "the stale twin on disk 1 must also be deleted")
 }
+
+// A guarded delete must check every copy before destroying any: an earlier
+// garbage copy must survive when a later duplicate still holds live data.
+func TestDeleteVolumeGuardChecksAllCopiesBeforeDeleting(t *testing.T) {
+	store := newTestStore(t, 2)
+	const vid = needle.VolumeId(4244)
+
+	for _, loc := range store.Locations {
+		v, err := NewVolume(loc.Directory, loc.IdxDirectory, "", vid, NeedleMapInMemory,
+			&super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+		require.NoError(t, err)
+		loc.SetVolume(vid, v)
+	}
+
+	// Disk 0's copy is fully deleted; disk 1's twin still holds a live needle.
+	copy0, _ := store.Locations[0].FindVolume(vid)
+	copy1, _ := store.Locations[1].FindVolume(vid)
+	n := &needle.Needle{Id: types.Uint64ToNeedleId(1), Data: []byte("x")}
+	_, _, _, err := copy0.writeNeedle2(n, false, false, false)
+	require.NoError(t, err)
+	_, _, _, err = copy1.writeNeedle2(n, false, false, false)
+	require.NoError(t, err)
+	_, err = copy0.deleteNeedle2(n)
+	require.NoError(t, err)
+
+	err = store.DeleteVolume(vid, false, true, false)
+	require.ErrorIs(t, err, ErrVolumeNotEmpty)
+
+	_, found0 := store.Locations[0].FindVolume(vid)
+	_, found1 := store.Locations[1].FindVolume(vid)
+	require.True(t, found0, "the garbage copy must survive a refused delete")
+	require.True(t, found1, "the live copy must survive a refused delete")
+}
+
+// A guarded delete must serialize with writes in flight on any copy: while a
+// copy's data lock is held (a write in progress), the delete cannot start
+// destroying other copies, or a write landing between validation and removal
+// would refuse the later copy and leave a partial delete.
+func TestDeleteVolumeGuardWaitsForInFlightCopyWrite(t *testing.T) {
+	store := newTestStore(t, 2)
+	const vid = needle.VolumeId(4245)
+
+	for _, loc := range store.Locations {
+		v, err := NewVolume(loc.Directory, loc.IdxDirectory, "", vid, NeedleMapInMemory,
+			&super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+		require.NoError(t, err)
+		loc.SetVolume(vid, v)
+	}
+
+	copy1, _ := store.Locations[1].FindVolume(vid)
+	copy1.dataFileAccessLock.Lock()
+
+	done := make(chan error, 1)
+	go func() {
+		done <- store.DeleteVolume(vid, false, true, false)
+	}()
+
+	select {
+	case err := <-done:
+		t.Fatalf("guarded delete proceeded while a copy was locked for write: %v", err)
+	case <-time.After(200 * time.Millisecond):
+	}
+
+	// The write wins; the delete must see the new needle and refuse, leaving
+	// every copy intact.
+	n := &needle.Needle{Id: types.Uint64ToNeedleId(1), Data: []byte("x")}
+	_, _, _, err := copy1.doWriteRequest(n, false, false)
+	require.NoError(t, err)
+	copy1.dataFileAccessLock.Unlock()
+
+	require.ErrorIs(t, <-done, ErrVolumeNotEmpty)
+
+	_, found0 := store.Locations[0].FindVolume(vid)
+	_, found1 := store.Locations[1].FindVolume(vid)
+	require.True(t, found0, "the earlier copy must survive a refused delete")
+	require.True(t, found1, "the written copy must survive a refused delete")
+}
diff --git a/weed/storage/store_ec.go b/weed/storage/store_ec.go
index aa2bd23182..b66592f2bd 100644
--- a/weed/storage/store_ec.go
+++ b/weed/storage/store_ec.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/klauspost/reedsolomon"
+	"golang.org/x/sync/semaphore"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
@@ -33,11 +34,25 @@ var errShardNotLocal = errors.New("ec shard not on this server")
 // FindEcShardTargetLocation returns the disk that should receive a new
 // shard / index file for (collection, vid). The selection order is:
 //
+//  0. a disk that already owns one of shardIds (in-memory claim),
 //  1. a disk that already has the EC volume mounted (in-memory state),
 //  2. a disk that owns the .ecx file on disk (volume not mounted yet),
 //  3. any HDD with free space,
 //  4. any disk with free space.
 //
+// Step 0 keeps the per-server invariant that a shard id is owned by at
+// most one disk. Steps 1-4 only know the volume, and a multi-disk server
+// legitimately mounts the same vid on several disks, so the free-count
+// tie-break alone can send a re-copy of a shard the server already holds
+// (a retried ec.balance / ec.rebuild move) to a sibling disk. Both disks
+// then claim the same (vid, shard) and report it to the master from two
+// disk ids, and which claimant serves reads or survives a later
+// unmount/delete of the shard id becomes an accident of Locations order.
+// Overwriting in place is what the caller meant, so an owning disk wins
+// ahead of the space filters too — a re-copy of a shard already on that
+// disk needs no new shard slot, and a genuinely full disk fails the
+// write with ENOSPC rather than silently splitting the claim.
+//
 // Step 2 is the missing primitive that pinned subsequent shards to the
 // first-shard disk during ec.rebuild. ec.rebuild only sets CopyEcxFile=true
 // for the first shard, then relies on auto-select to land later shards on
@@ -57,26 +72,31 @@ var errShardNotLocal = errors.New("ec shard not on this server")
 // across four FindFreeLocation passes was equivalent but acquired
 // volumesLock and ecVolumesLock RLocks (via VolumesLen / EcShardCount) up
 // to four times per disk per call.
-func (s *Store) FindEcShardTargetLocation(collection string, vid needle.VolumeId, dataShardCount int) *DiskLocation {
+func (s *Store) FindEcShardTargetLocation(collection string, vid needle.VolumeId, dataShardCount int, shardIds ...erasure_coding.ShardId) *DiskLocation {
 	const (
 		tierAnyDisk = iota + 1
 		tierHDD
 		tierEcxOnDisk
 		tierMounted
+		tierOwnsShard
 	)
 
 	var (
-		best     *DiskLocation
-		bestTier int
-		bestFree int32
+		best      *DiskLocation
+		bestTier  int
+		bestOwned int
+		bestFree  int32
 	)
 	for _, loc := range s.Locations {
-		if loc.isDiskSpaceLow.Load() {
-			continue
-		}
+		owned := ownedEcShardCount(loc, vid, shardIds)
 		freeCount := ecFreeShardCount(loc, dataShardCount)
-		if freeCount <= 0 {
-			continue
+		if owned == 0 {
+			if loc.isDiskSpaceLow.Load() {
+				continue
+			}
+			if freeCount <= 0 {
+				continue
+			}
 		}
 		tier := tierAnyDisk
 		if loc.DiskType == types.HardDriveType {
@@ -88,15 +108,65 @@ func (s *Store) FindEcShardTargetLocation(collection string, vid needle.VolumeId
 		if _, mounted := loc.FindEcVolume(vid); mounted {
 			tier = tierMounted
 		}
-		if best == nil || tier > bestTier || (tier == bestTier && freeCount > bestFree) {
+		if owned > 0 {
+			tier = tierOwnsShard
+		}
+		better := best == nil || tier > bestTier
+		if !better && tier == bestTier {
+			// owned only separates disks inside tierOwnsShard; it is 0
+			// everywhere else, so this falls through to the free-count
+			// tie-break for the other tiers.
+			better = owned > bestOwned || (owned == bestOwned && freeCount > bestFree)
+		}
+		if better {
 			best = loc
 			bestTier = tier
+			bestOwned = owned
 			bestFree = freeCount
 		}
 	}
 	return best
 }
 
+// EcShardOwnerDisks returns the distinct disks that already own one of
+// shardIds for vid, in Locations order. More than one owner means the batch
+// has no single correct destination — whichever disk receives it would
+// duplicate a sibling disk's claim — so batch callers must split by owner
+// (VolumeEcShardsCopy refuses such a batch instead of guessing).
+func (s *Store) EcShardOwnerDisks(vid needle.VolumeId, shardIds []erasure_coding.ShardId) []*DiskLocation {
+	var owners []*DiskLocation
+	for _, loc := range s.Locations {
+		if ownedEcShardCount(loc, vid, shardIds) > 0 {
+			owners = append(owners, loc)
+		}
+	}
+	return owners
+}
+
+// ownedEcShardCount reports how many of shardIds this disk already claims
+// for vid, per the in-memory registration the read path and heartbeats use.
+func ownedEcShardCount(loc *DiskLocation, vid needle.VolumeId, shardIds []erasure_coding.ShardId) int {
+	if len(shardIds) == 0 {
+		return 0
+	}
+	loc.ecVolumesLock.RLock()
+	defer loc.ecVolumesLock.RUnlock()
+	ecVolume, found := loc.ecVolumes[vid]
+	if !found {
+		return 0
+	}
+	owned := 0
+	for _, shard := range ecVolume.Shards {
+		for _, shardId := range shardIds {
+			if shard.ShardId == shardId {
+				owned++
+				break
+			}
+		}
+	}
+	return owned
+}
+
 // ecFreeShardCount returns the free EC shard capacity of loc, expressed
 // in shard slots (not volume-equivalent slots). dataShardCount is the
 // data-shard count of the EC layout being placed — see
@@ -140,6 +210,9 @@ func (s *Store) CollectErasureCodingHeartbeat() *master_pb.Heartbeat {
 	for diskId, location := range s.Locations {
 		location.ecVolumesLock.RLock()
 		for _, ecShards := range location.ecVolumes {
+			if _, _, quarantined := ecShards.GetIoErrorState(); quarantined {
+				continue
+			}
 			ecShardMessages = append(ecShardMessages, ecShards.ToVolumeEcShardInformationMessage(uint32(diskId))...)
 
 			for _, ecShard := range ecShards.Shards {
@@ -153,6 +226,16 @@ func (s *Store) CollectErasureCodingHeartbeat() *master_pb.Heartbeat {
 		stats.VolumeServerDiskSizeGauge.WithLabelValues(col, "ec").Set(float64(size))
 	}
 
+	for col := range s.reportedEcCollections {
+		if _, stillHere := collectionEcShardSize[col]; !stillHere {
+			stats.VolumeServerDiskSizeGauge.DeleteLabelValues(col, "ec")
+		}
+	}
+	s.reportedEcCollections = make(map[string]struct{}, len(collectionEcShardSize))
+	for col := range collectionEcShardSize {
+		s.reportedEcCollections[col] = struct{}{}
+	}
+
 	return &master_pb.Heartbeat{
 		EcShards:      ecShardMessages,
 		HasNoEcShards: len(ecShardMessages) == 0,
@@ -221,6 +304,7 @@ func (s *Store) MountEcShards(collection string, vid needle.VolumeId, shardId er
 				DiskId:      uint32(diskId),
 				EncodeTsNs:  ecVolume.EncodeTsNs,
 			}
+			s.UpdateMaxVolumeIdSeen(vid)
 			return nil
 		}
 		if errors.Is(err, os.ErrNotExist) {
@@ -334,6 +418,49 @@ func (s *Store) FindEcVolumeWithShard(vid needle.VolumeId, shardId erasure_codin
 	return nil, nil, false
 }
 
+// EcMetadataDirs lists every directory on this server that could hold an EC
+// volume's metadata — each disk's data and index directory. Startup mirroring
+// gives each shard-bearing disk its own .ecx/.ecj/.vif, but the checksum
+// sidecar is not mirrored and a repair delivers exactly one copy, so a runtime
+// looking only at its own two directories cannot see it. Handing this list to
+// the sidecar resolution keeps one authoritative copy reachable from every
+// runtime rather than duplicating a file that is rewritten as shards are
+// repaired and generations published.
+func (s *Store) EcMetadataDirs() []string {
+	var dirs []string
+	appendDir := func(dir string) {
+		if dir == "" {
+			return
+		}
+		for _, existing := range dirs {
+			if existing == dir {
+				return
+			}
+		}
+		dirs = append(dirs, dir)
+	}
+	for _, location := range s.Locations {
+		appendDir(location.Directory)
+		appendDir(location.IdxDirectory)
+	}
+	return dirs
+}
+
+// FindAllEcVolumes returns every per-disk *EcVolume the store maps for vid. A vid
+// can mount on N disks as N distinct runtimes, and the first-match FindEcVolume
+// hides the siblings — so anything that has to reach the whole volume, rather
+// than any one runtime of it, iterates this instead. Order mirrors the
+// deterministic s.Locations order; nil when no disk holds the vid.
+func (s *Store) FindAllEcVolumes(vid needle.VolumeId) []*erasure_coding.EcVolume {
+	var evs []*erasure_coding.EcVolume
+	for _, location := range s.Locations {
+		if ev, found := location.FindEcVolume(vid); found {
+			evs = append(evs, ev)
+		}
+	}
+	return evs
+}
+
 func (s *Store) FindEcVolume(vid needle.VolumeId) (*erasure_coding.EcVolume, bool) {
 	for _, location := range s.Locations {
 		if s, found := location.FindEcVolume(vid); found {
@@ -404,12 +531,15 @@ func (s *Store) ReadEcShardNeedle(vid needle.VolumeId, n *needle.Needle, onReadS
 				glog.V(3).Infof("ReadEcShardNeedle needle id %s intervals:%+v", n.String(), intervals)
 			}
 			bytes, isDeleted, err := s.readEcShardIntervals(n.Id, localEcVolume, intervals)
-			if err != nil {
-				return 0, fmt.Errorf("ReadEcShardIntervals: %w", err)
-			}
+			// A holder reporting the needle deleted is authoritative -- deletes are
+			// never invented and never undone -- so answer that ahead of whatever
+			// error the shards it could not gather produced.
 			if isDeleted {
 				return 0, ErrorDeleted
 			}
+			if err != nil {
+				return 0, fmt.Errorf("ReadEcShardIntervals: %w", err)
+			}
 
 			err = n.ReadBytes(bytes, offset.ToActualOffset(), size, localEcVolume.Version)
 			if err != nil {
@@ -422,35 +552,74 @@ func (s *Store) ReadEcShardNeedle(vid needle.VolumeId, n *needle.Needle, onReadS
 	return 0, fmt.Errorf("ec shard %d not found", vid)
 }
 
-func (s *Store) IntervalToShardIdAndOffset(iv erasure_coding.Interval) (erasure_coding.ShardId, int64) {
-	return iv.ToShardIdAndOffset(erasure_coding.ErasureCodingLargeBlockSize, erasure_coding.ErasureCodingSmallBlockSize)
-}
+var (
+	// ecRecoverBudget bounds the interval-sized buffers EC recovery holds across
+	// all concurrent reads: a peer that is slow to fail keeps a whole fan-out of
+	// them alive for the gRPC timeout, and a burst of those walked servers into an
+	// OOM. A var so a test can narrow it alongside ecRecoverSem.
+	ecRecoverBudget int64 = 256 << 20
+	ecRecoverSem          = semaphore.NewWeighted(ecRecoverBudget)
+)
+
+// ecIntervalReadConcurrency bounds the fan-out of a single needle read. Blocks
+// that follow each other in the .dat live on different shards, so a needle
+// spanning several of them costs one round trip per block when read in sequence.
+const ecIntervalReadConcurrency = 8
 
 func (s *Store) readEcShardIntervals(needleId types.NeedleId, ecVolume *erasure_coding.EcVolume, intervals []erasure_coding.Interval) (data []byte, is_deleted bool, err error) {
 	if err = s.cachedLookupEcShardLocations(ecVolume); err != nil {
-		return nil, false, fmt.Errorf("failed to locate shard via master grpc %s: %v", s.MasterAddress, err)
+		return nil, false, fmt.Errorf("failed to locate shard via master grpc %s: %v", s.masterAddress(), err)
 	}
 
-	for i, interval := range intervals {
-		if d, isDeleted, e := s.readOneEcShardInterval(needleId, ecVolume, interval); e != nil {
-			return nil, isDeleted, e
-		} else {
-			if isDeleted {
-				is_deleted = true
-			}
-			if i == 0 {
-				data = d
-			} else {
-				data = append(data, d...)
+	var totalSize int
+	for _, interval := range intervals {
+		totalSize += int(interval.Size)
+	}
+	data = make([]byte, totalSize)
+
+	if len(intervals) <= 1 {
+		for _, interval := range intervals {
+			if is_deleted, err = s.readOneEcShardInterval(needleId, ecVolume, interval, data); err != nil {
+				return nil, is_deleted, err
 			}
 		}
+		return data, is_deleted, nil
 	}
-	return
+
+	errs := make([]error, len(intervals))
+	var deleted atomic.Bool
+	var wg sync.WaitGroup
+	sem := make(chan struct{}, ecIntervalReadConcurrency)
+	var pos int
+	for i, interval := range intervals {
+		buf := data[pos : pos+int(interval.Size)]
+		pos += int(interval.Size)
+		wg.Add(1)
+		sem <- struct{}{}
+		go func() {
+			defer wg.Done()
+			defer func() { <-sem }()
+			isDeleted, e := s.readOneEcShardInterval(needleId, ecVolume, interval, buf)
+			if isDeleted {
+				deleted.Store(true)
+			}
+			errs[i] = e
+		}()
+	}
+	wg.Wait()
+
+	is_deleted = deleted.Load()
+	for _, e := range errs {
+		if e != nil {
+			return nil, is_deleted, e
+		}
+	}
+	return data, is_deleted, nil
 }
 
-func (s *Store) readOneEcShardInterval(needleId types.NeedleId, ecVolume *erasure_coding.EcVolume, interval erasure_coding.Interval) (data []byte, is_deleted bool, err error) {
-	shardId, actualOffset := s.IntervalToShardIdAndOffset(interval)
-	data = make([]byte, interval.Size)
+// readOneEcShardInterval fills data, which must be interval.Size long.
+func (s *Store) readOneEcShardInterval(needleId types.NeedleId, ecVolume *erasure_coding.EcVolume, interval erasure_coding.Interval, data []byte) (is_deleted bool, err error) {
+	shardId, actualOffset := ecVolume.IntervalToShardIdAndOffset(interval)
 
 	// try local read
 	err = s.readLocalEcShardInterval(ecVolume, shardId, data, actualOffset)
@@ -475,6 +644,10 @@ func (s *Store) readOneEcShardInterval(needleId types.NeedleId, ecVolume *erasur
 			return
 		}
 		glog.V(0).Infof("read remote ec shard %d.%d locations: %v", ecVolume.VolumeId, shardId, err)
+		// Recovery below skips this very shard, so nothing else invalidates the
+		// location that just failed -- and a shard that has moved would otherwise
+		// be reconstructed on every read until the map's own window expires.
+		markShardLocationsStale(ecVolume)
 	}
 
 	// try reading by recovering from other shards
@@ -491,9 +664,34 @@ func forgetShardId(ecVolume *erasure_coding.EcVolume, shardId erasure_coding.Sha
 	// failed to access the source data nodes, clear it up
 	ecVolume.ShardLocationsLock.Lock()
 	delete(ecVolume.ShardLocations, shardId)
+	ecVolume.ShardLocationsStale = true
 	ecVolume.ShardLocationsLock.Unlock()
 }
 
+// markShardLocationsStale flags the cached map for a prompt re-check after a
+// read failed against one of its locations. Unlike forgetShardId it keeps the
+// entry: a direct read is worth retrying, since a dead peer fails fast.
+func markShardLocationsStale(ecVolume *erasure_coding.EcVolume) {
+	ecVolume.ShardLocationsLock.Lock()
+	ecVolume.ShardLocationsStale = true
+	ecVolume.ShardLocationsLock.Unlock()
+}
+
+// ecShardLocationsTTL is how long a cached shard map is trusted. A complete map
+// is trusted longest. One short of DataShards, or one a failed read has just
+// invalidated, is re-checked promptly: until it is, every read of the dropped
+// shard skips the direct fetch and pays for a Reed-Solomon recovery instead.
+func ecShardLocationsTTL(shardCount int, stale bool, ecCtx *erasure_coding.ECContext) time.Duration {
+	switch {
+	case stale || shardCount < ecCtx.DataShards:
+		return 11 * time.Second
+	case shardCount == ecCtx.Total():
+		return 37 * time.Minute
+	default:
+		return 7 * time.Minute
+	}
+}
+
 func (s *Store) cachedLookupEcShardLocations(ecVolume *erasure_coding.EcVolume) (err error) {
 
 	// Use the volume's own EC ratio so a custom-ratio volume (e.g. 9+3) is judged
@@ -504,26 +702,26 @@ func (s *Store) cachedLookupEcShardLocations(ecVolume *erasure_coding.EcVolume)
 		ecCtx = erasure_coding.NewDefaultECContext(ecVolume.Collection, ecVolume.VolumeId)
 	}
 
-	// Snapshot the shard map size and refresh time under the lock: recover
-	// goroutines mutate ShardLocations via forgetShardId, so an unguarded read here
-	// races with a concurrent map write.
-	ecVolume.ShardLocationsLock.RLock()
-	shardCount := len(ecVolume.ShardLocations)
-	refreshTime := ecVolume.ShardLocationsRefreshTime
-	ecVolume.ShardLocationsLock.RUnlock()
-	if shardCount < ecCtx.DataShards &&
-		refreshTime.Add(11*time.Second).After(time.Now()) ||
-		shardCount == ecCtx.Total() &&
-			refreshTime.Add(37*time.Minute).After(time.Now()) ||
-		shardCount >= ecCtx.DataShards &&
-			refreshTime.Add(7*time.Minute).After(time.Now()) {
-		// still fresh
+	// Judge the map and consume its mark in one critical section, so a mark raised
+	// from here on belongs to the next refresh rather than being cleared by this
+	// one -- the read that raised it has disproved the map this lookup is about to
+	// install. Recover goroutines mutate all three fields via forgetShardId, so an
+	// unguarded read would race a concurrent map write besides.
+	ecVolume.ShardLocationsLock.Lock()
+	stale := ecVolume.ShardLocationsStale
+	ttl := ecShardLocationsTTL(len(ecVolume.ShardLocations), stale, ecCtx)
+	fresh := ecVolume.ShardLocationsRefreshTime.Add(ttl).After(time.Now())
+	if !fresh {
+		ecVolume.ShardLocationsStale = false
+	}
+	ecVolume.ShardLocationsLock.Unlock()
+	if fresh {
 		return nil
 	}
 
 	glog.V(3).Infof("lookup and cache ec volume %d locations", ecVolume.VolumeId)
 
-	err = operation.WithMasterServerClient(context.Background(), false, s.MasterAddress, s.grpcDialOption, func(masterClient master_pb.SeaweedClient) error {
+	err = operation.WithMasterServerClient(context.Background(), false, s.masterAddress(), s.grpcDialOption, func(masterClient master_pb.SeaweedClient) error {
 		req := &master_pb.LookupEcVolumeRequest{
 			VolumeId: uint32(ecVolume.VolumeId),
 		}
@@ -548,6 +746,14 @@ func (s *Store) cachedLookupEcShardLocations(ecVolume *erasure_coding.EcVolume)
 
 		return nil
 	})
+	if err != nil {
+		// The lookup this mark was consumed for did not answer, and the refresh time
+		// is only advanced on success -- so without putting the mark back, a map a
+		// read had already disproved would be trusted for its full window again.
+		// Marking unconditionally is safe: where no mark was consumed the refresh
+		// time is stale anyway, and the next call looks up whatever the mark says.
+		markShardLocationsStale(ecVolume)
+	}
 	return
 }
 
@@ -569,8 +775,10 @@ func (s *Store) readLocalEcShardInterval(ecVolume *erasure_coding.EcVolume, shar
 
 	readBytes, err := shard.ReadAt(buf, offset)
 	if err != nil {
-		return fmt.Errorf("failed to read local EC shard %d for volume %d: %v", shardId, ecVolume.VolumeId, err)
+		ownerVolume.CheckReadWriteError(err)
+		return fmt.Errorf("failed to read local EC shard %d for volume %d: %w", shardId, ecVolume.VolumeId, err)
 	}
+	ownerVolume.CheckReadWriteError(nil)
 	if got, want := readBytes, len(buf); got != want {
 		return fmt.Errorf("expected %d bytes for local EC shard %d on volume %d, got %d", want, shardId, ecVolume.VolumeId, got)
 	}
@@ -653,70 +861,120 @@ func (s *Store) doReadRemoteEcShardInterval(sourceDataNode pb.ServerAddress, nee
 	return
 }
 
-func (s *Store) recoverOneRemoteEcShardInterval(needleId types.NeedleId, ecVolume *erasure_coding.EcVolume, shardIdToRecover erasure_coding.ShardId, buf []byte, offset int64) (n int, is_deleted bool, err error) {
-	glog.V(3).Infof("recover ec shard %d.%d from other locations", ecVolume.VolumeId, shardIdToRecover)
+// gatherEcShardIntervals collects the same interval from every shard but shardIdToRecover,
+// returning one buffer per shard and nil where the shard could not be gathered. It stops
+// once DataShards of them are in hand: reconstruction consumes no more than that.
+func (s *Store) gatherEcShardIntervals(needleId types.NeedleId, ecVolume *erasure_coding.EcVolume, ecCtx *erasure_coding.ECContext, shardIdToRecover erasure_coding.ShardId, size int, offset int64) (shardIntervals [][]byte, isDeleted bool) {
+	shardIntervals = make([][]byte, ecCtx.Total())
 
-	// Reconstruct with the volume's OWN EC ratio (loaded from its .vif), not the
-	// build default, so a custom-ratio volume (e.g. 9+3) is decoded with the matrix
-	// that actually produced its shards -- decoding it as 10+4 would corrupt the
-	// recovered bytes. In OSS the ratio is always 10+4, so this is a no-op.
-	ecCtx := ecVolume.ECContext
-	if ecCtx == nil {
-		ecCtx = erasure_coding.NewDefaultECContext(ecVolume.Collection, ecVolume.VolumeId)
-	}
-	enc, err := reedsolomon.New(ecCtx.DataShards, ecCtx.ParityShards)
-	if err != nil {
-		return 0, false, fmt.Errorf("failed to create encoder: %w", err)
+	// A shard this server already holds costs no round trip and no peer buffer,
+	// so seed those before asking peers for the rest.
+	available := 0
+	for shardId := erasure_coding.ShardId(0); int(shardId) < ecCtx.Total() && available < ecCtx.DataShards; shardId++ {
+		if shardId == shardIdToRecover {
+			continue
+		}
+		if _, _, found := s.FindEcVolumeWithShard(ecVolume.VolumeId, shardId); !found {
+			continue
+		}
+		data := make([]byte, size)
+		if localErr := s.readLocalEcShardInterval(ecVolume, shardId, data, offset); localErr != nil {
+			glog.V(3).Infof("recover: read local ec shard %d.%d: %v", ecVolume.VolumeId, shardId, localErr)
+			continue
+		}
+		shardIntervals[shardId] = data
+		available++
 	}
 
-	// Use MaxShardCount to support custom EC ratios up to 32 shards
-	bufs := make([][]byte, erasure_coding.MaxShardCount)
-
-	var wg sync.WaitGroup
-	// The recover goroutines run concurrently, so the deleted flag is collected
-	// atomically and folded into the named return after they join, rather than each
-	// goroutine writing the shared bool directly.
-	var isDeletedFlag atomic.Bool
+	var candidates []erasure_coding.ShardId
+	candidateLocations := make(map[erasure_coding.ShardId][]pb.ServerAddress)
 	ecVolume.ShardLocationsLock.RLock()
 	for shardId, locations := range ecVolume.ShardLocations {
 
-		// skip current shard or empty shard
-		if shardId == shardIdToRecover {
+		// skip the shard being recovered, one already seeded locally, or an empty shard
+		if shardId == shardIdToRecover || int(shardId) >= ecCtx.Total() || shardIntervals[shardId] != nil {
 			continue
 		}
 		if len(locations) == 0 {
 			glog.V(3).Infof("readRemoteEcShardInterval missing %d.%d from %+v", ecVolume.VolumeId, shardId, locations)
 			continue
 		}
-
-		// read from remote locations
-		wg.Add(1)
-		go func(shardId erasure_coding.ShardId, locations []pb.ServerAddress) {
-			defer wg.Done()
-			data := make([]byte, len(buf))
-			nRead, isDeleted, readErr := s.readRemoteEcShardInterval(locations, needleId, ecVolume.VolumeId, shardId, data, offset, ecVolume.EncodeTsNs)
-			if readErr != nil {
-				glog.V(3).Infof("recover: readRemoteEcShardInterval %d.%d %d bytes from %+v: %v", ecVolume.VolumeId, shardId, nRead, locations, readErr)
-				forgetShardId(ecVolume, shardId)
-			}
-			if isDeleted {
-				isDeletedFlag.Store(true)
-			}
-			if nRead == len(buf) {
-				bufs[shardId] = data
-			}
-		}(shardId, locations)
+		candidates = append(candidates, shardId)
+		candidateLocations[shardId] = locations
 	}
 	ecVolume.ShardLocationsLock.RUnlock()
 
-	wg.Wait()
-	is_deleted = isDeletedFlag.Load()
+	// The recover goroutines run concurrently, so the deleted flag is collected
+	// atomically and folded into the named return after they join, rather than each
+	// goroutine writing the shared bool directly.
+	var isDeletedFlag atomic.Bool
+
+	// Reconstruction consumes DataShards buffers, so reading every remaining shard
+	// holds a third more than that and asks a third more of peers that are, by
+	// then, already struggling. Widen only when a wave falls short.
+	for len(candidates) > 0 && available < ecCtx.DataShards {
+		wave := min(ecCtx.DataShards-available, len(candidates))
+		var wg sync.WaitGroup
+		var fetched atomic.Int64
+		for _, shardId := range candidates[:wave] {
+			locations := candidateLocations[shardId]
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				data := make([]byte, size)
+				nRead, isDeleted, readErr := s.readRemoteEcShardInterval(locations, needleId, ecVolume.VolumeId, shardId, data, offset, ecVolume.EncodeTsNs)
+				if readErr != nil {
+					glog.V(3).Infof("recover: readRemoteEcShardInterval %d.%d %d bytes from %+v: %v", ecVolume.VolumeId, shardId, nRead, locations, readErr)
+					forgetShardId(ecVolume, shardId)
+				}
+				if isDeleted {
+					isDeletedFlag.Store(true)
+				}
+				if nRead == size {
+					shardIntervals[shardId] = data
+					fetched.Add(1)
+				}
+			}()
+		}
+		wg.Wait()
+		candidates = candidates[wave:]
+		available += int(fetched.Load())
+		if isDeletedFlag.Load() {
+			// every shard of a deleted needle answers deleted, so another wave cannot help
+			break
+		}
+	}
+
+	return shardIntervals, isDeletedFlag.Load()
+}
+
+// checkEcShardRebuildable rejects a parity target. ReconstructData rebuilds data shards
+// only, so it leaves a parity slot nil and reports no error, and the caller would copy
+// that out as a zero-filled buffer and report a successful read.
+func checkEcShardRebuildable(ecVolume *erasure_coding.EcVolume, ecCtx *erasure_coding.ECContext, shardIdToRecover erasure_coding.ShardId) error {
+	if int(shardIdToRecover) >= ecCtx.DataShards {
+		return fmt.Errorf("cannot reconstruct shard %d.%d: only data shards can be rebuilt, %d of %d are parity",
+			ecVolume.VolumeId, shardIdToRecover, ecCtx.ParityShards, ecCtx.Total())
+	}
+	return nil
+}
+
+// reconstructEcShardInterval rebuilds one shard's interval in place from the others.
+func reconstructEcShardInterval(ecVolume *erasure_coding.EcVolume, ecCtx *erasure_coding.ECContext, shardIntervals [][]byte, shardIdToRecover erasure_coding.ShardId) error {
+	if err := checkEcShardRebuildable(ecVolume, ecCtx, shardIdToRecover); err != nil {
+		return err
+	}
+
+	enc, err := reedsolomon.New(ecCtx.DataShards, ecCtx.ParityShards)
+	if err != nil {
+		return fmt.Errorf("failed to create encoder: %w", err)
+	}
 
 	// Count and log available shards for diagnostics
 	availableShards := make([]erasure_coding.ShardId, 0, ecCtx.Total())
 	missingShards := make([]erasure_coding.ShardId, 0, ecCtx.ParityShards+1)
 	for shardId := 0; shardId < ecCtx.Total(); shardId++ {
-		if bufs[shardId] != nil {
+		if shardIntervals[shardId] != nil {
 			availableShards = append(availableShards, erasure_coding.ShardId(shardId))
 		} else {
 			missingShards = append(missingShards, erasure_coding.ShardId(shardId))
@@ -729,19 +987,67 @@ func (s *Store) recoverOneRemoteEcShardInterval(needleId types.NeedleId, ecVolum
 		len(missingShards), missingShards)
 
 	if len(availableShards) < ecCtx.DataShards {
-		return 0, false, fmt.Errorf("cannot recover shard %d.%d: only %d shards available %v, need at least %d (missing: %v)",
+		return fmt.Errorf("cannot recover shard %d.%d: only %d shards available %v, need at least %d (missing: %v)",
 			ecVolume.VolumeId, shardIdToRecover,
 			len(availableShards), availableShards,
 			ecCtx.DataShards, missingShards)
 	}
 
-	if err = enc.ReconstructData(bufs[:ecCtx.Total()]); err != nil {
-		return 0, false, fmt.Errorf("failed to reconstruct data for shard %d.%d with %d available shards %v: %w",
+	// Rebuild only what was asked for. ReconstructData rebuilds every missing data
+	// shard, and a gather that stopped at DataShards can leave up to ParityShards of
+	// them missing -- an interval-sized buffer and a decode each, discarded unread.
+	// The mask is Total() long, not DataShards: reedsolomon documents both lengths
+	// but indexes the short one past its end when a parity shard is absent, which
+	// here it usually is.
+	required := make([]bool, ecCtx.Total())
+	required[shardIdToRecover] = true
+	if err := enc.ReconstructSome(shardIntervals, required); err != nil {
+		return fmt.Errorf("failed to reconstruct data for shard %d.%d with %d available shards %v: %w",
 			ecVolume.VolumeId, shardIdToRecover, len(availableShards), availableShards, err)
 	}
+
+	return nil
+}
+
+func (s *Store) recoverOneRemoteEcShardInterval(needleId types.NeedleId, ecVolume *erasure_coding.EcVolume, shardIdToRecover erasure_coding.ShardId, buf []byte, offset int64) (n int, is_deleted bool, err error) {
+	glog.V(3).Infof("recover ec shard %d.%d from other locations", ecVolume.VolumeId, shardIdToRecover)
+
+	// Reconstruct with the volume's OWN EC ratio (loaded from its .vif), not the
+	// build default, so a custom-ratio volume (e.g. 9+3) is decoded with the matrix
+	// that actually produced its shards -- decoding it as 10+4 would corrupt the
+	// recovered bytes. In OSS the ratio is always 10+4, so this is a no-op.
+	ecCtx := ecVolume.ECContext
+	if ecCtx == nil {
+		ecCtx = erasure_coding.NewDefaultECContext(ecVolume.Collection, ecVolume.VolumeId)
+	}
+	// checked before the gather: a doomed target should not cost a fan-out, nor drop a
+	// sibling's location through forgetShardId on the way to failing
+	if err := checkEcShardRebuildable(ecVolume, ecCtx, shardIdToRecover); err != nil {
+		return 0, false, err
+	}
+
+	// Charge the buffers this recovery is about to hold against the budget, so a
+	// burst of them queues here rather than on the heap: DataShards gathered, plus
+	// the one the rebuild allocates for the shard it recreates.
+	weight := int64(len(buf)) * int64(ecCtx.DataShards+1)
+	if weight > ecRecoverBudget {
+		// An interval whose fan-out outgrows the whole budget takes all of it and
+		// so runs alone, rather than blocking forever on an acquire that can never
+		// succeed. The cap is then one such recovery, not a burst of them.
+		weight = ecRecoverBudget
+	}
+	if err = ecRecoverSem.Acquire(context.Background(), weight); err != nil {
+		return 0, false, err
+	}
+	defer ecRecoverSem.Release(weight)
+
+	shardIntervals, is_deleted := s.gatherEcShardIntervals(needleId, ecVolume, ecCtx, shardIdToRecover, len(buf), offset)
+	if err := reconstructEcShardInterval(ecVolume, ecCtx, shardIntervals, shardIdToRecover); err != nil {
+		return 0, is_deleted, err
+	}
 	glog.V(4).Infof("recovered ec shard %d.%d from other locations", ecVolume.VolumeId, shardIdToRecover)
 
-	copy(buf, bufs[shardIdToRecover])
+	copy(buf, shardIntervals[shardIdToRecover])
 
 	return len(buf), is_deleted, nil
 }
diff --git a/weed/storage/store_ec_delete.go b/weed/storage/store_ec_delete.go
index da20ffd529..970967cb00 100644
--- a/weed/storage/store_ec_delete.go
+++ b/weed/storage/store_ec_delete.go
@@ -52,7 +52,7 @@ func (s *Store) doDeleteNeedleFromAtLeastOneRemoteEcShards(ecVolume *erasure_cod
 		return erasure_coding.NotFoundError
 	}
 
-	primaryShardId, _ := intervals[0].ToShardIdAndOffset(erasure_coding.ErasureCodingLargeBlockSize, erasure_coding.ErasureCodingSmallBlockSize)
+	primaryShardId, _ := ecVolume.IntervalToShardIdAndOffset(intervals[0])
 
 	// Normal path: delete on exactly one node holding the primary data shard.
 	err = s.doDeleteNeedleFromRemoteEcShardServers(primaryShardId, ecVolume, needleId)
diff --git a/weed/storage/store_ec_interval_read_test.go b/weed/storage/store_ec_interval_read_test.go
new file mode 100644
index 0000000000..dedb57a335
--- /dev/null
+++ b/weed/storage/store_ec_interval_read_test.go
@@ -0,0 +1,177 @@
+package storage
+
+import (
+	"bytes"
+	"math/rand"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+// encodeAndMountEcVolume writes needles into a fresh volume, EC-encodes it
+// (uniform layout), stamps the .vif the way VolumeEcShardsGenerate does, and
+// mounts every shard on the store.
+func encodeAndMountEcVolume(t *testing.T, store *Store, vid needle.VolumeId, needles []*needle.Needle) *erasure_coding.EcVolume {
+	t.Helper()
+	dir := store.Locations[0].Directory
+
+	v, err := NewVolume(dir, dir, "", vid, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("new volume: %v", err)
+	}
+	for _, n := range needles {
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+			t.Fatalf("write needle: %v", err)
+		}
+	}
+	baseFileName := v.DataFileName()
+	v.Close()
+
+	datSize, err := os.Stat(baseFileName + ".dat")
+	if err != nil {
+		t.Fatalf("stat .dat: %v", err)
+	}
+	ecCtx := erasure_coding.NewDefaultECContext("", vid)
+	if _, err := erasure_coding.WriteEcFiles(baseFileName, ecCtx); err != nil {
+		t.Fatalf("write ec files: %v", err)
+	}
+	if err := erasure_coding.WriteSortedFileFromIdx(baseFileName, ".ecx"); err != nil {
+		t.Fatalf("write .ecx: %v", err)
+	}
+	if err := os.WriteFile(baseFileName+".ecj", nil, 0o644); err != nil {
+		t.Fatalf("write .ecj: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(baseFileName+".vif", &volume_server_pb.VolumeInfo{
+		Version:     uint32(needle.GetCurrentVersion()),
+		DatFileSize: datSize.Size(),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards:   uint32(ecCtx.DataShards),
+			ParityShards: uint32(ecCtx.ParityShards),
+			BlockSize:    ecCtx.BlockSize,
+		},
+	}); err != nil {
+		t.Fatalf("save .vif: %v", err)
+	}
+	for _, ext := range []string{".dat", ".idx"} {
+		if err := os.Remove(baseFileName + ext); err != nil {
+			t.Fatalf("remove %s: %v", ext, err)
+		}
+	}
+
+	for shardId := 0; shardId < erasure_coding.TotalShardsCount; shardId++ {
+		if err := store.MountEcShards("", vid, erasure_coding.ShardId(shardId), ""); err != nil {
+			t.Fatalf("mount shard %d: %v", shardId, err)
+		}
+	}
+	ecVolume, found := store.Locations[0].FindEcVolume(vid)
+	if !found {
+		t.Fatal("ec volume not mounted")
+	}
+	if ecVolume.ECContext.BlockSize != ecCtx.BlockSize {
+		t.Fatalf("mounted BlockSize = %d, want %d", ecVolume.ECContext.BlockSize, ecCtx.BlockSize)
+	}
+
+	// Every shard is local, so seed the location cache to keep the read off the
+	// master this test does not have.
+	ecVolume.ShardLocationsLock.Lock()
+	for shardId := 0; shardId < erasure_coding.TotalShardsCount; shardId++ {
+		ecVolume.ShardLocations[erasure_coding.ShardId(shardId)] = []pb.ServerAddress{"localhost:8080"}
+	}
+	ecVolume.ShardLocationsRefreshTime = time.Now()
+	ecVolume.ShardLocationsLock.Unlock()
+	return ecVolume
+}
+
+func randomNeedleOfSize(id uint64, size int) *needle.Needle {
+	n := new(needle.Needle)
+	n.Id = types.Uint64ToNeedleId(id)
+	n.Data = make([]byte, size)
+	rand.New(rand.NewSource(int64(id))).Read(n.Data)
+	n.Checksum = needle.NewCRC(n.Data)
+	return n
+}
+
+// A needle larger than one EC block is split over consecutive blocks, which
+// live on different shards. The intervals are read concurrently, so check they
+// still come back in order.
+func TestReadEcShardNeedleSpanningBlocks(t *testing.T) {
+	store := newTestStore(t, 1)
+	const vid = needle.VolumeId(7)
+
+	n := randomNeedleOfSize(42, 3*erasure_coding.ErasureCodingSmallBlockSize+1234)
+	ecVolume := encodeAndMountEcVolume(t, store, vid, []*needle.Needle{n})
+
+	_, _, intervals, err := ecVolume.LocateEcShardNeedle(n.Id, ecVolume.Version)
+	if err != nil {
+		t.Fatalf("locate needle: %v", err)
+	}
+	if len(intervals) < 2 {
+		t.Fatalf("needle covers %d interval(s), want it split over several", len(intervals))
+	}
+
+	got := new(needle.Needle)
+	got.Id = n.Id
+	if _, err := store.ReadEcShardNeedle(vid, got, nil); err != nil {
+		t.Fatalf("read ec needle: %v", err)
+	}
+	if !bytes.Equal(got.Data, n.Data) {
+		t.Fatalf("read back %d bytes, want the %d written", len(got.Data), len(n.Data))
+	}
+}
+
+// On a volume big enough for multi-MB blocks, the uniform layout keeps a
+// needle smaller than the block in one interval on one shard, and reads every
+// needle back intact.
+func TestReadEcShardNeedleUniformLayout(t *testing.T) {
+	store := newTestStore(t, 1)
+	const vid = needle.VolumeId(8)
+
+	// ~26MB of needles: block size becomes 3MB, so the layouts diverge and a
+	// 1MB needle would stripe across shards under the legacy layout.
+	var needles []*needle.Needle
+	for i := uint64(1); i <= 5; i++ {
+		needles = append(needles, randomNeedleOfSize(i, 4*1024*1024))
+	}
+	for i := uint64(6); i <= 11; i++ {
+		needles = append(needles, randomNeedleOfSize(i, 1024*1024))
+	}
+	ecVolume := encodeAndMountEcVolume(t, store, vid, needles)
+	if ecVolume.ECContext.BlockSize <= erasure_coding.ErasureCodingSmallBlockSize {
+		t.Fatalf("block size %d does not diverge from the legacy layout", ecVolume.ECContext.BlockSize)
+	}
+
+	// With 3MB blocks a 1MB needle sits inside one block (bar a boundary
+	// straddle), where the legacy layout would stripe it at 1MB granularity.
+	singleInterval := false
+	for _, n := range needles[5:] {
+		_, _, intervals, err := ecVolume.LocateEcShardNeedle(n.Id, ecVolume.Version)
+		if err != nil {
+			t.Fatalf("locate needle %v: %v", n.Id, err)
+		}
+		if len(intervals) == 1 {
+			singleInterval = true
+		}
+	}
+	if !singleInterval {
+		t.Fatal("no 1MB needle mapped to a single interval; uniform layout not in effect")
+	}
+
+	for _, n := range needles {
+		got := new(needle.Needle)
+		got.Id = n.Id
+		if _, err := store.ReadEcShardNeedle(vid, got, nil); err != nil {
+			t.Fatalf("read needle %v: %v", n.Id, err)
+		}
+		if !bytes.Equal(got.Data, n.Data) {
+			t.Fatalf("needle %v: read back %d bytes that do not match the %d written", n.Id, len(got.Data), len(n.Data))
+		}
+	}
+}
diff --git a/weed/storage/store_ec_journal.go b/weed/storage/store_ec_journal.go
new file mode 100644
index 0000000000..a15a429ba5
--- /dev/null
+++ b/weed/storage/store_ec_journal.go
@@ -0,0 +1,252 @@
+package storage
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+	"sync"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// ecjMergeAttempts bounds how often an unmounted merge re-reads a journal
+// that changed under it. Only a mount-delete-unmount between the read and the
+// append changes it, so one retry is nearly always enough.
+const ecjMergeAttempts = 5
+
+// ecjMergeLocks serializes merges into the same journal path, so concurrent
+// copies of one volume (a balance racing a rebuild) cannot both append the
+// same delta.
+var ecjMergeLocks = struct {
+	sync.Mutex
+	byPath map[string]*ecjPathLock
+}{byPath: make(map[string]*ecjPathLock)}
+
+type ecjPathLock struct {
+	sync.Mutex
+	refs int
+}
+
+func lockEcjPath(path string) (unlock func()) {
+	ecjMergeLocks.Lock()
+	l := ecjMergeLocks.byPath[path]
+	if l == nil {
+		l = &ecjPathLock{}
+		ecjMergeLocks.byPath[path] = l
+	}
+	l.refs++
+	ecjMergeLocks.Unlock()
+
+	l.Lock()
+	return func() {
+		l.Unlock()
+		ecjMergeLocks.Lock()
+		if l.refs--; l.refs == 0 {
+			delete(ecjMergeLocks.byPath, path)
+		}
+		ecjMergeLocks.Unlock()
+	}
+}
+
+// ecjMergeIO is the disk I/O an unmounted merge does outside every lock,
+// injectable so tests can act between the steps.
+type ecjMergeIO struct {
+	read func(path string) (ids map[types.NeedleId]struct{}, size int64, err error)
+	sync func(*erasure_coding.EcjAppend) error
+}
+
+var defaultEcjMergeIO = ecjMergeIO{
+	read: erasure_coding.ReadEcjIds,
+	sync: (*erasure_coding.EcjAppend).Sync,
+}
+
+// MergeEcJournal folds a peer's deletion ids into the local journal of EC
+// volume vid on the receiving disk, the one whose data directory is dataDir;
+// ecjPath is that journal's path in the disk's index directory. It appends
+// only the ids the journal lacks and returns how many it added.
+//
+// A mounted volume owns its journal: the merge goes through its open handle
+// and in-memory set. That is the receiving disk's own runtime for vid,
+// wherever its journal lives (it may sit in the data dir rather than
+// ecjPath's index dir), else a sibling runtime journaling into ecjPath itself:
+// disks sharing one index directory, or reconciliation mounting vid on a disk
+// that journals into another's (#9212). Otherwise ecjPath is written while
+// every disk's EC lock is held, so no mount anywhere can open it mid-append,
+// and synced after they are released.
+func (s *Store) MergeEcJournal(vid needle.VolumeId, dataDir, ecjPath string, ids map[types.NeedleId]struct{}) (int, error) {
+	return s.mergeEcJournal(vid, dataDir, ecjPath, ids, defaultEcjMergeIO)
+}
+
+func (s *Store) mergeEcJournal(vid needle.VolumeId, dataDir, ecjPath string, ids map[types.NeedleId]struct{}, mio ecjMergeIO) (int, error) {
+	unlock := lockEcjPath(ecjPath)
+	defer unlock()
+
+	var owner *DiskLocation
+	for _, loc := range s.Locations {
+		if filepath.Clean(loc.Directory) == filepath.Clean(dataDir) {
+			owner = loc
+			break
+		}
+	}
+	if owner == nil {
+		return 0, fmt.Errorf("ec volume %d: no disk at %s owns journal %s", vid, dataDir, ecjPath)
+	}
+	for attempt := 0; attempt < ecjMergeAttempts; attempt++ {
+		if added, merged, err := s.mergeIntoMountedEcJournal(owner, vid, ecjPath, ids); merged {
+			return added, err
+		}
+		// Read outside the locks: a bloated journal can take a while, and a
+		// queued mount would otherwise stall every EC read on its disk.
+		local, size, err := mio.read(ecjPath)
+		if err != nil {
+			return 0, fmt.Errorf("read %s: %w", ecjPath, err)
+		}
+		added, mounted, err := s.appendUnmountedEcJournal(owner, vid, ecjPath, local, ids, size, mio.sync)
+		if mounted || errors.Is(err, erasure_coding.ErrEcjChanged) {
+			continue
+		}
+		return added, err
+	}
+	return 0, fmt.Errorf("ec volume %d: journal %s kept changing during merge", vid, ecjPath)
+}
+
+// rLockEcVolumes read-locks every disk's EC volume map in location order. A
+// mount registers its EcVolume, and reads its journal, under its own disk's
+// write lock, so holding all of them excludes a mount on any disk. No path
+// holds two disks' EC locks at once, so the fixed order cannot deadlock.
+// Holders must not wait on disk I/O beyond a page-cache write: a queued mount
+// on any disk stalls that disk's EC reads until they let go.
+func (s *Store) rLockEcVolumes() (unlock func()) {
+	for _, loc := range s.Locations {
+		loc.ecVolumesLock.RLock()
+	}
+	return func() {
+		for _, loc := range s.Locations {
+			loc.ecVolumesLock.RUnlock()
+		}
+	}
+}
+
+// mountedEcJournal returns the runtime a merge into ecjPath on owner must go
+// through and the disk it is mounted on, or nil when there is none: owner's
+// own runtime for vid, else the first sibling's whose journal is ecjPath.
+// Callers hold rLockEcVolumes.
+func (s *Store) mountedEcJournal(owner *DiskLocation, vid needle.VolumeId, ecjPath string) (*erasure_coding.EcVolume, *DiskLocation) {
+	if ev, found := owner.ecVolumes[vid]; found {
+		return ev, owner
+	}
+	for _, loc := range s.Locations {
+		if ev, found := loc.ecVolumes[vid]; found && filepath.Clean(ev.FileName(".ecj")) == filepath.Clean(ecjPath) {
+			return ev, loc
+		}
+	}
+	return nil, nil
+}
+
+// mergeIntoMountedEcJournal merges ids through the runtime mountedEcJournal
+// picks and publishes them to the other runtimes sharing that journal.
+// merged reports whether there was one. Only the picked runtime's disk stays
+// locked across the merge's fsync, which keeps it mounted.
+func (s *Store) mergeIntoMountedEcJournal(owner *DiskLocation, vid needle.VolumeId, ecjPath string, ids map[types.NeedleId]struct{}) (added int, merged bool, err error) {
+	unlock := s.rLockEcVolumes()
+	ev, mountedOn := s.mountedEcJournal(owner, vid, ecjPath)
+	if ev == nil {
+		unlock()
+		return 0, false, nil
+	}
+	for _, loc := range s.Locations {
+		if loc != mountedOn {
+			loc.ecVolumesLock.RUnlock()
+		}
+	}
+	journalPath := ev.FileName(".ecj")
+	added, err = ev.MergeJournal(ids)
+	mountedOn.ecVolumesLock.RUnlock()
+	if err != nil {
+		return added, true, err
+	}
+	// Publish to the holders of the file the merge wrote to — the picked
+	// runtime's journal may live outside ecjPath, and a holder of a different
+	// file must not claim ids that file lacks.
+	s.withEcJournalHolders(vid, journalPath, func(holders []*erasure_coding.EcVolume) {
+		for _, h := range holders {
+			if h != ev {
+				h.PublishMergedIds(ids)
+			}
+		}
+	})
+	return added, true, nil
+}
+
+// appendUnmountedEcJournal writes the missing ids under every disk's EC lock,
+// after confirming no runtime has mounted the journal since it was read, and
+// syncs them once the locks are released: a slow fsync must not hold off
+// mounts, and the EC reads queued behind them, on every disk. A mount after
+// the write reads the new records like any others. mounted reports that a
+// runtime appeared before the write; the caller then merges through it.
+func (s *Store) appendUnmountedEcJournal(owner *DiskLocation, vid needle.VolumeId, ecjPath string, local, ids map[types.NeedleId]struct{}, size int64, sync func(*erasure_coding.EcjAppend) error) (added int, mounted bool, err error) {
+	// The append and its sync, rollback or rewrite touch ecjPath through the
+	// open handle past the disk locks writeUnmountedEcJournal holds, so they
+	// run registered as a writer: a mount compacting this journal must not
+	// swap its inode underneath them.
+	done := erasure_coding.BeginEcjWrite(ecjPath)
+	defer done()
+	pending, mounted, err := s.writeUnmountedEcJournal(owner, vid, ecjPath, local, ids, size)
+	if pending == nil {
+		return 0, mounted, err
+	}
+	defer pending.Close()
+	if err := sync(pending); err != nil {
+		var rolledBack bool
+		s.withEcJournalHolders(vid, ecjPath, func(holders []*erasure_coding.EcVolume) {
+			rolledBack = pending.RollbackUnsynced(holders)
+		})
+		if rolledBack {
+			return 0, false, err
+		}
+		// Later records follow these, so they stay: make them durable,
+		// still outside the locks.
+		resyncErr := pending.Rewrite()
+		if resyncErr == nil {
+			resyncErr = sync(pending)
+		}
+		if resyncErr != nil {
+			// Neither removable nor durable: no deleted set may claim them,
+			// so a retried merge writes and syncs them again.
+			s.withEcJournalHolders(vid, ecjPath, pending.Unpublish)
+			glog.Errorf("ec volume %d: merged records in %s may not be durable: %v; resync: %v", vid, ecjPath, err, resyncErr)
+			return 0, false, fmt.Errorf("%w; resync: %v", err, resyncErr)
+		}
+	}
+	return pending.Added, false, nil
+}
+
+func (s *Store) writeUnmountedEcJournal(owner *DiskLocation, vid needle.VolumeId, ecjPath string, local, ids map[types.NeedleId]struct{}, size int64) (pending *erasure_coding.EcjAppend, mounted bool, err error) {
+	unlock := s.rLockEcVolumes()
+	defer unlock()
+	if ev, _ := s.mountedEcJournal(owner, vid, ecjPath); ev != nil {
+		return nil, true, nil
+	}
+	pending, err = erasure_coding.WriteEcjIds(ecjPath, local, ids, size)
+	return pending, false, err
+}
+
+// withEcJournalHolders runs fn with every runtime that has mounted the journal
+// at ecjPath, for undoing an append whose fsync failed (see
+// EcjAppend.RollbackUnsynced and Unpublish). The disk locks stop new mounts
+// and the caller's path lock stops other unmounted merges; fn runs no fsync,
+// so they are held only for in-memory work and a truncate.
+func (s *Store) withEcJournalHolders(vid needle.VolumeId, ecjPath string, fn func([]*erasure_coding.EcVolume)) {
+	unlock := s.rLockEcVolumes()
+	defer unlock()
+	var holders []*erasure_coding.EcVolume
+	for _, loc := range s.Locations {
+		if ev, found := loc.ecVolumes[vid]; found && filepath.Clean(ev.FileName(".ecj")) == filepath.Clean(ecjPath) {
+			holders = append(holders, ev)
+		}
+	}
+	fn(holders)
+}
diff --git a/weed/storage/store_ec_journal_test.go b/weed/storage/store_ec_journal_test.go
new file mode 100644
index 0000000000..a406240994
--- /dev/null
+++ b/weed/storage/store_ec_journal_test.go
@@ -0,0 +1,419 @@
+package storage
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func ecjIdSet(ids ...types.NeedleId) map[types.NeedleId]struct{} {
+	s := make(map[types.NeedleId]struct{}, len(ids))
+	for _, id := range ids {
+		s[id] = struct{}{}
+	}
+	return s
+}
+
+func ecjRecords(ids ...types.NeedleId) []byte {
+	b := make([]byte, len(ids)*types.NeedleIdSize)
+	for i, id := range ids {
+		types.NeedleIdToBytes(b[i*types.NeedleIdSize:], id)
+	}
+	return b
+}
+
+func startEcJournalStore(t *testing.T, dataDir, idxDir string) *Store {
+	t.Helper()
+	return startEcJournalStoreDisks(t, idxDir, dataDir)
+}
+
+// startEcJournalStoreDisks starts a store with one disk per data dir. An
+// empty idxDir gives each disk its data dir as index dir; otherwise all disks
+// share idxDir.
+func startEcJournalStoreDisks(t *testing.T, idxDir string, dataDirs ...string) *Store {
+	t.Helper()
+	dirs := append([]string{idxDir}, dataDirs...)
+	if idxDir == "" {
+		dirs = dataDirs
+	}
+	for _, d := range dirs {
+		require.NoError(t, os.MkdirAll(d, 0o755))
+	}
+	n := len(dataDirs)
+	maxCounts := make([]int32, n)
+	minFree := make([]util.MinFreeSpace, n)
+	diskTypes := make([]types.DiskType, n)
+	for i := range dataDirs {
+		maxCounts[i] = 100
+		diskTypes[i] = types.HardDriveType
+	}
+	store := NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		dataDirs,
+		maxCounts,
+		minFree,
+		idxDir,
+		NeedleMapInMemory,
+		diskTypes,
+		nil,
+		3,
+		stats.DefaultDiskIOProbeConfig(),
+	)
+	done := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-store.NewEcShardsChan:
+			case <-store.NewVolumesChan:
+			case <-store.DeletedVolumesChan:
+			case <-store.DeletedEcShardsChan:
+			case <-store.StateUpdateChan:
+			case <-done:
+				return
+			}
+		}
+	}()
+	t.Cleanup(func() {
+		store.Close()
+		close(done)
+	})
+	return store
+}
+
+// A mounted volume whose index was found in its data directory keeps its live
+// journal there, while a shard copy targets the index directory. The merge
+// must reach the live journal and the in-memory set, not a sibling file.
+func TestMergeEcJournal_MountedVolumeJournalInDataDir(t *testing.T) {
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "data")
+	idxDir := filepath.Join(tempDir, "idx")
+	store := startEcJournalStore(t, dataDir, idxDir)
+
+	const collection = "c"
+	vid := needle.VolumeId(9)
+	writeEcShard0(t, dataDir, collection, vid)
+	dataBase := writeEcIndex(t, dataDir, collection, vid, 1)
+	require.NoError(t, store.MountEcShards(collection, vid, 0, ""))
+	ev, found := store.Locations[0].FindEcVolume(vid)
+	require.True(t, found)
+	require.Equal(t, dataBase+".ecj", ev.FileName(".ecj"))
+
+	idxJournal := erasure_coding.EcShardFileName(collection, idxDir, int(vid)) + ".ecj"
+	added, err := store.MergeEcJournal(vid, dataDir, idxJournal, ecjIdSet(1, 2))
+	require.NoError(t, err)
+	assert.Equal(t, 1, added)
+	assert.True(t, ev.IsNeedleDeleted(2))
+	assert.Equal(t, ecjRecords(1, 2), mustReadFile(t, dataBase+".ecj"))
+	assert.NoFileExists(t, idxJournal)
+}
+
+// An unmounted journal is merged on disk, and merging the same peer journal
+// again adds nothing.
+func TestMergeEcJournal_UnmountedVolumeIsIdempotent(t *testing.T) {
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "data")
+	idxDir := filepath.Join(tempDir, "idx")
+	store := startEcJournalStore(t, dataDir, idxDir)
+
+	vid := needle.VolumeId(9)
+	journal := erasure_coding.EcShardFileName("", idxDir, int(vid)) + ".ecj"
+	require.NoError(t, os.WriteFile(journal, ecjRecords(1, 2), 0o644))
+
+	for i, want := range []int{2, 0, 0} {
+		added, err := store.MergeEcJournal(vid, dataDir, journal, ecjIdSet(2, 3, 4))
+		require.NoError(t, err)
+		assert.Equal(t, want, added, "merge %d", i)
+	}
+	assert.Equal(t, ecjRecords(1, 2, 3, 4), mustReadFile(t, journal))
+
+	_, err := store.MergeEcJournal(vid, filepath.Join(tempDir, "elsewhere"), journal, ecjIdSet(1))
+	assert.Error(t, err, "a data dir that is no disk owns no journal")
+}
+
+// Disks sharing one index directory all hold the same journal path. Copying
+// shards onto a disk that has not mounted vid must still reach the sibling
+// runtime that holds that journal open, or the sibling keeps serving needles
+// the peer deleted until it remounts.
+func TestMergeEcJournal_SharedIndexDirReachesSiblingMount(t *testing.T) {
+	tempDir := t.TempDir()
+	disk0 := filepath.Join(tempDir, "d0")
+	disk1 := filepath.Join(tempDir, "d1")
+	idxDir := filepath.Join(tempDir, "idx")
+	store := startEcJournalStoreDisks(t, idxDir, disk0, disk1)
+
+	const collection = "c"
+	vid := needle.VolumeId(9)
+	writeEcShard0(t, disk0, collection, vid)
+	idxBase := writeEcIndex(t, idxDir, collection, vid, 1)
+	ev, err := store.Locations[0].LoadEcShard(collection, vid, 0)
+	require.NoError(t, err)
+	require.Equal(t, idxBase+".ecj", ev.FileName(".ecj"))
+
+	// The copy lands on disk1, whose index dir is the shared one.
+	added, err := store.MergeEcJournal(vid, disk1, idxBase+".ecj", ecjIdSet(1, 2))
+	require.NoError(t, err)
+	assert.Equal(t, 1, added)
+	assert.True(t, ev.IsNeedleDeleted(2), "the mounted sibling must see the merged id")
+	assert.Equal(t, ecjRecords(1, 2), mustReadFile(t, idxBase+".ecj"))
+}
+
+// Every runtime holding the journal open must see merged ids in memory.
+func TestMergeEcJournal_SharedJournalReachesEveryHolder(t *testing.T) {
+	tempDir := t.TempDir()
+	disk0 := filepath.Join(tempDir, "d0")
+	disk1 := filepath.Join(tempDir, "d1")
+	idxDir := filepath.Join(tempDir, "idx")
+	store := startEcJournalStoreDisks(t, idxDir, disk0, disk1)
+
+	const collection = "c"
+	vid := needle.VolumeId(9)
+	writeEcShard0(t, disk0, collection, vid)
+	writeEcShard0(t, disk1, collection, vid)
+	idxBase := writeEcIndex(t, idxDir, collection, vid, 1)
+	ev0, err := store.Locations[0].LoadEcShard(collection, vid, 0)
+	require.NoError(t, err)
+	ev1, err := store.Locations[1].LoadEcShard(collection, vid, 0)
+	require.NoError(t, err)
+	require.Equal(t, idxBase+".ecj", ev0.FileName(".ecj"))
+	require.Equal(t, idxBase+".ecj", ev1.FileName(".ecj"))
+
+	added, err := store.MergeEcJournal(vid, disk0, idxBase+".ecj", ecjIdSet(1, 2))
+	require.NoError(t, err)
+	assert.Equal(t, 1, added)
+	assert.True(t, ev0.IsNeedleDeleted(2))
+	assert.True(t, ev1.IsNeedleDeleted(2), "every journal holder must see the merged id")
+}
+
+// The picked runtime may journal to a different file than the copied one —
+// its index lives in its data directory while a sibling's lives in the index
+// directory. The ids must be published only to holders of the file they were
+// written to: the sibling's deleted set must not claim records its journal
+// lacks, or they come back after its remount.
+func TestMergeEcJournal_PublishesToActualJournalHolders(t *testing.T) {
+	tempDir := t.TempDir()
+	disk0 := filepath.Join(tempDir, "d0")
+	disk1 := filepath.Join(tempDir, "d1")
+	idxDir := filepath.Join(tempDir, "idx")
+	store := startEcJournalStoreDisks(t, idxDir, disk0, disk1)
+
+	const collection = "c"
+	vid := needle.VolumeId(9)
+	writeEcShard0(t, disk0, collection, vid)
+	writeEcShard0(t, disk1, collection, vid)
+	dataBase := writeEcIndex(t, disk0, collection, vid, 1)
+	idxBase := writeEcIndex(t, idxDir, collection, vid, 1)
+
+	ev0, err := store.Locations[0].LoadEcShard(collection, vid, 0)
+	require.NoError(t, err)
+	require.Equal(t, dataBase+".ecj", ev0.FileName(".ecj"))
+	ev1, err := store.Locations[1].LoadEcShard(collection, vid, 0)
+	require.NoError(t, err)
+	require.Equal(t, idxBase+".ecj", ev1.FileName(".ecj"))
+
+	// The copy targets the index-dir journal, but the receiving disk's runtime
+	// owns the data-dir one and the merge goes through it.
+	added, err := store.MergeEcJournal(vid, disk0, idxBase+".ecj", ecjIdSet(1, 2))
+	require.NoError(t, err)
+	assert.Equal(t, 1, added)
+	assert.Equal(t, ecjRecords(1, 2), mustReadFile(t, dataBase+".ecj"))
+	assert.Equal(t, ecjRecords(1), mustReadFile(t, idxBase+".ecj"))
+	assert.True(t, ev0.IsNeedleDeleted(2))
+	assert.False(t, ev1.IsNeedleDeleted(2), "a different journal's holder must not claim the merged id")
+}
+
+// A sibling disk can mount vid from the receiving disk's index (#9212) while
+// the merge reads the journal unlocked. The append must notice that mount and
+// go through it instead of writing behind its open handle.
+func TestMergeEcJournal_SiblingMountDuringReadIsMergedThrough(t *testing.T) {
+	tempDir := t.TempDir()
+	disk0 := filepath.Join(tempDir, "d0")
+	disk1 := filepath.Join(tempDir, "d1")
+	store := startEcJournalStoreDisks(t, "", disk0, disk1)
+
+	const collection = "c"
+	vid := needle.VolumeId(9)
+	ownerBase := writeEcIndex(t, disk0, collection, vid, 1)
+	writeEcShard0(t, disk1, collection, vid)
+
+	var sibling *erasure_coding.EcVolume
+	read := func(path string) (map[types.NeedleId]struct{}, int64, error) {
+		ids, size, err := erasure_coding.ReadEcjIds(path)
+		if sibling == nil {
+			var mountErr error
+			sibling, mountErr = store.Locations[1].loadEcShardWithIdxDir(collection, vid, 0, disk0)
+			require.NoError(t, mountErr)
+			require.Equal(t, ownerBase+".ecj", sibling.FileName(".ecj"))
+		}
+		return ids, size, err
+	}
+	mio := defaultEcjMergeIO
+	mio.read = read
+	added, err := store.mergeEcJournal(vid, disk0, ownerBase+".ecj", ecjIdSet(1, 2), mio)
+	require.NoError(t, err)
+	assert.Equal(t, 1, added)
+	require.NotNil(t, sibling)
+	assert.True(t, sibling.IsNeedleDeleted(2), "the sibling mounted mid-merge must see the merged id")
+	assert.Equal(t, ecjRecords(1, 2), mustReadFile(t, ownerBase+".ecj"))
+}
+
+// The unmounted append's fsync runs with no disk's EC lock held, so a slow
+// sync cannot hold off mounts, or the EC reads queued behind them, on every
+// disk.
+func TestMergeEcJournal_UnmountedSyncHoldsNoDiskLock(t *testing.T) {
+	tempDir := t.TempDir()
+	disk0 := filepath.Join(tempDir, "d0")
+	disk1 := filepath.Join(tempDir, "d1")
+	store := startEcJournalStoreDisks(t, "", disk0, disk1)
+
+	vid := needle.VolumeId(9)
+	journal := erasure_coding.EcShardFileName("", disk0, int(vid)) + ".ecj"
+	require.NoError(t, os.WriteFile(journal, ecjRecords(1), 0o644))
+
+	synced := false
+	mio := defaultEcjMergeIO
+	mio.sync = func(a *erasure_coding.EcjAppend) error {
+		for i, loc := range store.Locations {
+			if assert.True(t, loc.ecVolumesLock.TryLock(), "disk %d EC lock held across fsync", i) {
+				loc.ecVolumesLock.Unlock()
+			}
+		}
+		synced = true
+		return a.Sync()
+	}
+	added, err := store.mergeEcJournal(vid, disk0, journal, ecjIdSet(1, 2), mio)
+	require.NoError(t, err)
+	assert.Equal(t, 1, added)
+	assert.True(t, synced)
+	assert.Equal(t, ecjRecords(1, 2), mustReadFile(t, journal))
+}
+
+// A failed fsync removes the append when its records are still the journal's
+// tail, also through every runtime that mounted the journal since the write:
+// their deleted sets must not keep ids the journal may never have persisted,
+// and a retried merge appends them again. Once any runtime has journaled
+// after them, removing them would lose that delete, even if the runtime doing
+// the rollback cached the older length; they stay and are rewritten and
+// synced instead. If that sync fails too, the records stay but leave every
+// deleted set, so a retried merge appends and syncs them again rather than
+// trusting records never shown durable.
+func TestMergeEcJournal_FailedSync(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		mounts      int  // runtimes on disks 1.. mounting the journal mid-sync
+		journalVia  int  // 1-based runtime that journals id 3 mid-sync, 0 for none
+		resyncFails bool // the fsync after the rewrite fails too
+		wantJournal []types.NeedleId
+	}{
+		{name: "unmounted", wantJournal: []types.NeedleId{1}},
+		{name: "mounted since the write", mounts: 1, wantJournal: []types.NeedleId{1}},
+		{name: "two mounted since the write", mounts: 2, wantJournal: []types.NeedleId{1}},
+		{name: "mounted and journaled since", mounts: 1, journalVia: 1, wantJournal: []types.NeedleId{1, 2, 3}},
+		{name: "another runtime journaled since", mounts: 2, journalVia: 2, wantJournal: []types.NeedleId{1, 2, 3}},
+		{name: "resync fails", mounts: 2, journalVia: 2, resyncFails: true, wantJournal: []types.NeedleId{1, 2, 3}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			tempDir := t.TempDir()
+			disks := []string{filepath.Join(tempDir, "d0"), filepath.Join(tempDir, "d1"), filepath.Join(tempDir, "d2")}
+			store := startEcJournalStoreDisks(t, "", disks...)
+
+			const collection = "c"
+			vid := needle.VolumeId(9)
+			journal := writeEcIndex(t, disks[0], collection, vid, 1) + ".ecj"
+			for _, d := range disks[1:] {
+				writeEcShard0(t, d, collection, vid)
+			}
+
+			var holders []*erasure_coding.EcVolume
+			syncs := 0
+			mio := defaultEcjMergeIO
+			mio.sync = func(a *erasure_coding.EcjAppend) error {
+				if syncs++; syncs > 1 {
+					if tt.resyncFails {
+						return errors.New("injected resync failure")
+					}
+					return a.Sync()
+				}
+				for i := 1; i <= tt.mounts; i++ {
+					ev, err := store.Locations[i].loadEcShardWithIdxDir(collection, vid, 0, disks[0])
+					require.NoError(t, err)
+					require.True(t, ev.IsNeedleDeleted(2), "the mount loads the unsynced record")
+					holders = append(holders, ev)
+				}
+				if tt.journalVia > 0 {
+					_, err := holders[tt.journalVia-1].MergeJournal(ecjIdSet(3))
+					require.NoError(t, err)
+				}
+				return errors.New("injected fsync failure")
+			}
+			added, err := store.mergeEcJournal(vid, disks[0], journal, ecjIdSet(1, 2), mio)
+			assert.Equal(t, ecjRecords(tt.wantJournal...), mustReadFile(t, journal))
+			if tt.journalVia > 0 {
+				assert.True(t, holders[tt.journalVia-1].IsNeedleDeleted(3), "a later delete is never lost")
+			}
+			if tt.journalVia > 0 && !tt.resyncFails {
+				require.NoError(t, err, "records followed by a delete are resynced")
+				assert.Equal(t, 1, added)
+				for _, ev := range holders {
+					assert.True(t, ev.IsNeedleDeleted(2))
+				}
+				return
+			}
+			require.Error(t, err)
+			for _, ev := range holders {
+				assert.False(t, ev.IsNeedleDeleted(2), "no deleted set claims a record not shown durable")
+			}
+
+			// A retried merge appends and syncs the id again.
+			added, err = store.MergeEcJournal(vid, disks[0], journal, ecjIdSet(1, 2))
+			require.NoError(t, err)
+			assert.Equal(t, 1, added)
+			assert.Equal(t, ecjRecords(append(tt.wantJournal, 2)...), mustReadFile(t, journal))
+			if len(holders) > 0 {
+				assert.True(t, holders[0].IsNeedleDeleted(2))
+			}
+		})
+	}
+}
+
+// writeEcShard0 writes shard 0 of vid and its .vif into dataDir.
+func writeEcShard0(t *testing.T, dataDir, collection string, vid needle.VolumeId) {
+	t.Helper()
+	const datSize int64 = 1024 * 1024
+	dataBase := erasure_coding.EcShardFileName(collection, dataDir, int(vid))
+	f, err := os.Create(dataBase + erasure_coding.ToExt(0))
+	require.NoError(t, err)
+	require.NoError(t, f.Truncate(calculateExpectedShardSize(datSize, 10)))
+	require.NoError(t, f.Close())
+	require.NoError(t, volume_info.SaveVolumeInfo(dataBase+".vif", &volume_server_pb.VolumeInfo{
+		Version:       uint32(needle.Version3),
+		DatFileSize:   datSize,
+		EcShardConfig: &volume_server_pb.EcShardConfig{DataShards: 10, ParityShards: 4},
+	}))
+}
+
+// writeEcIndex writes vid's .ecx and a .ecj holding deleted into dir and
+// returns their base name.
+func writeEcIndex(t *testing.T, dir, collection string, vid needle.VolumeId, deleted ...types.NeedleId) string {
+	t.Helper()
+	base := erasure_coding.EcShardFileName(collection, dir, int(vid))
+	require.NoError(t, os.WriteFile(base+".ecx", make([]byte, types.NeedleMapEntrySize), 0o644))
+	require.NoError(t, os.WriteFile(base+".ecj", ecjRecords(deleted...), 0o644))
+	return base
+}
+
+func mustReadFile(t *testing.T, path string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	require.NoError(t, err)
+	return b
+}
diff --git a/weed/storage/store_ec_location_cache_test.go b/weed/storage/store_ec_location_cache_test.go
new file mode 100644
index 0000000000..60affb146c
--- /dev/null
+++ b/weed/storage/store_ec_location_cache_test.go
@@ -0,0 +1,330 @@
+package storage
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"os"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+)
+
+// countingMaster answers LookupEcVolume with one holder per shard and counts
+// how often it was asked.
+type countingMaster struct {
+	master_pb.UnimplementedSeaweedServer
+	lookups atomic.Int64
+	// onLookup runs inside the RPC, standing in for whatever else the volume
+	// server is doing while it waits on the master.
+	onLookup func()
+	// failLookup answers with an error instead of a shard map.
+	failLookup atomic.Bool
+}
+
+func (m *countingMaster) LookupEcVolume(_ context.Context, req *master_pb.LookupEcVolumeRequest) (*master_pb.LookupEcVolumeResponse, error) {
+	m.lookups.Add(1)
+	if m.onLookup != nil {
+		m.onLookup()
+	}
+	if m.failLookup.Load() {
+		return nil, status.Error(codes.Unavailable, "master is having a moment")
+	}
+	resp := &master_pb.LookupEcVolumeResponse{VolumeId: req.VolumeId}
+	for shardId := 0; shardId < erasure_coding.TotalShardsCount; shardId++ {
+		resp.ShardIdLocations = append(resp.ShardIdLocations, &master_pb.LookupEcVolumeResponse_EcShardIdLocation{
+			ShardId:   uint32(shardId),
+			Locations: []*master_pb.Location{{Url: "127.0.0.1:1", GrpcPort: 2}},
+		})
+	}
+	return resp, nil
+}
+
+func startCountingMaster(t *testing.T) (*countingMaster, pb.ServerAddress) {
+	t.Helper()
+	master := &countingMaster{}
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := grpc.NewServer()
+	master_pb.RegisterSeaweedServer(srv, master)
+	go srv.Serve(lis)
+	t.Cleanup(srv.Stop)
+	return master, pb.NewServerAddressWithGrpcPort("127.0.0.1:1", lis.Addr().(*net.TCPAddr).Port)
+}
+
+// rewindShardLocationsRefresh ages the cache by d so a test can reach a TTL
+// without waiting one out.
+func rewindShardLocationsRefresh(ecVolume *erasure_coding.EcVolume, d time.Duration) {
+	ecVolume.ShardLocationsLock.Lock()
+	ecVolume.ShardLocationsRefreshTime = ecVolume.ShardLocationsRefreshTime.Add(-d)
+	ecVolume.ShardLocationsLock.Unlock()
+}
+
+// A read that fails against a cached location leaves the map claiming something
+// it has just disproved, so the next lookup goes back to the master within
+// seconds rather than serving the hole for the rest of a 7-minute window.
+func TestCachedLookupEcShardLocationsRefreshesAfterAFailedRead(t *testing.T) {
+	master, masterAddr := startCountingMaster(t)
+	store := &Store{
+		MasterFn:       func() pb.ServerAddress { return masterAddr },
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+	ecVolume := &erasure_coding.EcVolume{
+		VolumeId:       7,
+		ShardLocations: make(map[erasure_coding.ShardId][]pb.ServerAddress),
+	}
+
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("first lookup: %v", err)
+	}
+	if got := master.lookups.Load(); got != 1 {
+		t.Fatalf("cold cache asked the master %d times, want 1", got)
+	}
+
+	// A map nothing has disproved is trusted for minutes, whether or not it is
+	// complete -- dropping a shard by hand is not the same as a read failing.
+	rewindShardLocationsRefresh(ecVolume, 12*time.Second)
+	ecVolume.ShardLocationsLock.Lock()
+	delete(ecVolume.ShardLocations, erasure_coding.ShardId(2))
+	ecVolume.ShardLocationsLock.Unlock()
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("second lookup: %v", err)
+	}
+	if got := master.lookups.Load(); got != 1 {
+		t.Errorf("a 12s-old map asked the master %d times, want it left alone", got)
+	}
+
+	forgetShardId(ecVolume, erasure_coding.ShardId(3))
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("lookup after a failed read: %v", err)
+	}
+	if got := master.lookups.Load(); got != 2 {
+		t.Errorf("a map disproved by a failed read asked the master %d times, want 2", got)
+	}
+
+	ecVolume.ShardLocationsLock.RLock()
+	_, restored := ecVolume.ShardLocations[erasure_coding.ShardId(3)]
+	ecVolume.ShardLocationsLock.RUnlock()
+	if !restored {
+		t.Error("shard 3 is still missing from the map after the refresh")
+	}
+}
+
+// A failed read buys one prompt re-check, not a lookup on every read that
+// follows: the refresh clears the mark and the map is trusted again.
+func TestCachedLookupEcShardLocationsSettlesAfterRefresh(t *testing.T) {
+	master, masterAddr := startCountingMaster(t)
+	store := &Store{
+		MasterFn:       func() pb.ServerAddress { return masterAddr },
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+	ecVolume := &erasure_coding.EcVolume{
+		VolumeId:       8,
+		ShardLocations: make(map[erasure_coding.ShardId][]pb.ServerAddress),
+	}
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("first lookup: %v", err)
+	}
+	rewindShardLocationsRefresh(ecVolume, 12*time.Second)
+	forgetShardId(ecVolume, erasure_coding.ShardId(3))
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("lookup after a failed read: %v", err)
+	}
+	for i := 0; i < 5; i++ {
+		if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+			t.Fatalf("settled lookup: %v", err)
+		}
+	}
+	if got := master.lookups.Load(); got != 2 {
+		t.Errorf("asked the master %d times, want 2: one cold, one after the failed read", got)
+	}
+}
+
+func TestEcShardLocationsTTL(t *testing.T) {
+	ecCtx := erasure_coding.NewDefaultECContext("", 1)
+	for _, tc := range []struct {
+		name       string
+		shardCount int
+		stale      bool
+		want       time.Duration
+	}{
+		{"complete", ecCtx.Total(), false, 37 * time.Minute},
+		{"one shard short", ecCtx.Total() - 1, false, 7 * time.Minute},
+		{"below the data shards", ecCtx.DataShards - 1, false, 11 * time.Second},
+		{"complete but disproved by a read", ecCtx.Total(), true, 11 * time.Second},
+		{"one shard short and disproved", ecCtx.Total() - 1, true, 11 * time.Second},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := ecShardLocationsTTL(tc.shardCount, tc.stale, ecCtx); got != tc.want {
+				t.Errorf("ttl = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// oneBadShardPeer serves every shard out of an EC volume's files except one,
+// standing in for a shard that has moved off the address the map still names.
+type oneBadShardPeer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	baseFileName string
+	badShard     erasure_coding.ShardId
+}
+
+func (p *oneBadShardPeer) VolumeEcShardRead(req *volume_server_pb.VolumeEcShardReadRequest, stream volume_server_pb.VolumeServer_VolumeEcShardReadServer) error {
+	if erasure_coding.ShardId(req.ShardId) == p.badShard {
+		return status.Errorf(codes.NotFound, "shard %d is not here", req.ShardId)
+	}
+	f, err := os.Open(p.baseFileName + erasure_coding.ToExt(int(req.ShardId)))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	data := make([]byte, req.Size)
+	if _, err := f.ReadAt(data, req.Offset); err != nil {
+		return err
+	}
+	return stream.Send(&volume_server_pb.VolumeEcShardReadResponse{Data: data, EncodeTsNs: req.EncodeTsNs})
+}
+
+// Recovery skips the shard whose direct read failed, so that failure is the one
+// thing that never invalidates the map. The read still succeeds off the other
+// shards, and the location it just disproved has to be re-checked anyway.
+func TestReadOneEcShardIntervalMarksTheMapAfterADirectReadFails(t *testing.T) {
+	const badShard = erasure_coding.ShardId(3)
+	baseFileName, n := writeEcVolumeFiles(t, t.TempDir(), 7)
+
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(srv, &oneBadShardPeer{baseFileName: baseFileName, badShard: badShard})
+	go srv.Serve(lis)
+	t.Cleanup(srv.Stop)
+
+	store := &Store{grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials())}
+	ecVolume := &erasure_coding.EcVolume{
+		VolumeId:       7,
+		ShardLocations: make(map[erasure_coding.ShardId][]pb.ServerAddress),
+	}
+	seedShardLocations(ecVolume, pb.NewServerAddressWithGrpcPort("127.0.0.1:1", lis.Addr().(*net.TCPAddr).Port))
+
+	interval := erasure_coding.Interval{BlockIndex: int(badShard), Size: 4096, IsLargeBlock: true}
+	got := make([]byte, interval.Size)
+	if _, err := store.readOneEcShardInterval(n.Id, ecVolume, interval, got); err != nil {
+		t.Fatalf("read interval: %v", err)
+	}
+
+	ecVolume.ShardLocationsLock.RLock()
+	stale := ecVolume.ShardLocationsStale
+	_, stillMapped := ecVolume.ShardLocations[badShard]
+	ecVolume.ShardLocationsLock.RUnlock()
+	if !stale {
+		t.Error("a failed direct read left the map trusted, so the moved shard stays hidden until the window expires")
+	}
+	if !stillMapped {
+		t.Error("shard 3 was dropped from the map; the direct read is worth retrying")
+	}
+
+	want := make([]byte, len(got))
+	f, err := os.Open(baseFileName + erasure_coding.ToExt(int(badShard)))
+	if err != nil {
+		t.Fatalf("open shard %d: %v", badShard, err)
+	}
+	defer f.Close()
+	if _, err := f.ReadAt(want, 0); err != nil {
+		t.Fatalf("read shard %d: %v", badShard, err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Error("the interval recovered from the other shards does not match the shard on disk")
+	}
+}
+
+// A read that fails while the master is answering has disproved the very map
+// that answer is about to install, so the refresh must not clear its mark.
+func TestCachedLookupEcShardLocationsKeepsAMarkRaisedDuringTheLookup(t *testing.T) {
+	master, masterAddr := startCountingMaster(t)
+	store := &Store{
+		MasterFn:       func() pb.ServerAddress { return masterAddr },
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+	ecVolume := &erasure_coding.EcVolume{
+		VolumeId:       9,
+		ShardLocations: make(map[erasure_coding.ShardId][]pb.ServerAddress),
+	}
+
+	master.onLookup = func() { markShardLocationsStale(ecVolume) }
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("first lookup: %v", err)
+	}
+	master.onLookup = nil
+
+	ecVolume.ShardLocationsLock.RLock()
+	stale := ecVolume.ShardLocationsStale
+	ecVolume.ShardLocationsLock.RUnlock()
+	if !stale {
+		t.Fatal("the refresh swallowed a mark raised while it was in flight")
+	}
+
+	// And the mark shortens the window, so the next read re-checks in seconds
+	// rather than trusting a map already disproved.
+	rewindShardLocationsRefresh(ecVolume, 12*time.Second)
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("lookup after the swallowed mark: %v", err)
+	}
+	if got := master.lookups.Load(); got != 2 {
+		t.Errorf("asked the master %d times, want 2", got)
+	}
+}
+
+// A refresh that never answered cannot be treated as one that did: the mark it
+// consumed goes back, or the map it was meant to correct is trusted for its
+// whole window on the strength of a lookup that failed.
+func TestCachedLookupEcShardLocationsKeepsTheMarkWhenTheLookupFails(t *testing.T) {
+	master, masterAddr := startCountingMaster(t)
+	store := &Store{
+		MasterFn:       func() pb.ServerAddress { return masterAddr },
+		grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+	ecVolume := &erasure_coding.EcVolume{
+		VolumeId:       10,
+		ShardLocations: make(map[erasure_coding.ShardId][]pb.ServerAddress),
+	}
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("first lookup: %v", err)
+	}
+
+	rewindShardLocationsRefresh(ecVolume, 12*time.Second)
+	markShardLocationsStale(ecVolume)
+	master.failLookup.Store(true)
+	if err := store.cachedLookupEcShardLocations(ecVolume); err == nil {
+		t.Fatal("expected the lookup to fail")
+	}
+
+	ecVolume.ShardLocationsLock.RLock()
+	stale := ecVolume.ShardLocationsStale
+	ecVolume.ShardLocationsLock.RUnlock()
+	if !stale {
+		t.Error("the failed lookup kept the mark it consumed")
+	}
+
+	master.failLookup.Store(false)
+	if err := store.cachedLookupEcShardLocations(ecVolume); err != nil {
+		t.Fatalf("retry after the failed lookup: %v", err)
+	}
+	if got := master.lookups.Load(); got != 3 {
+		t.Errorf("asked the master %d times, want 3: a failed lookup must not leave the disproved map trusted", got)
+	}
+}
diff --git a/weed/storage/store_ec_multidisk_lifecycle_test.go b/weed/storage/store_ec_multidisk_lifecycle_test.go
new file mode 100644
index 0000000000..648f351c19
--- /dev/null
+++ b/weed/storage/store_ec_multidisk_lifecycle_test.go
@@ -0,0 +1,314 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// These tests walk one EC volume through the life a multi-disk production node
+// gives it: shards spread across disks with the .ecx / .ecj / .vif sidecars on
+// only one of them, then a balance moving the sidecar disk's shards away, then
+// a restart, then a fresh shard arriving. Each transition is exercised against
+// the real Store so the invariant under test is the one production depends on:
+// every shard file on disk is either registered (visible to heartbeat and
+// reads) or still on disk untouched — never silently dropped, never deleted.
+//
+// The layout mirrors a support case: a 10+4 volume on a node with a dozen
+// disks, sidecars on the disk that ran the encode, shards scattered by
+// ec.balance. The volume id and collection are kept from the case.
+
+const (
+	lifecycleCollection = "pm-itatiaiucu-01"
+	lifecycleVolumeId   = needle.VolumeId(42561)
+	lifecycleDatSize    = int64(10 * 1024 * 1024)
+	lifecycleData       = 10
+	lifecycleParity     = 4
+)
+
+// plantLifecycleShard creates a shard file of the exact size a real encode of
+// lifecycleDatSize would produce, so size-based validation sees a consistent
+// volume rather than an artifact of the fixture.
+func plantLifecycleShard(t *testing.T, dir string, shardId int) {
+	t.Helper()
+	base := erasure_coding.EcShardFileName(lifecycleCollection, dir, int(lifecycleVolumeId))
+	f, err := os.Create(base + erasure_coding.ToExt(shardId))
+	if err != nil {
+		t.Fatalf("create shard %d in %s: %v", shardId, dir, err)
+	}
+	defer f.Close()
+	if err := f.Truncate(calculateExpectedShardSize(lifecycleDatSize, lifecycleData)); err != nil {
+		t.Fatalf("size shard %d: %v", shardId, err)
+	}
+}
+
+// plantLifecycleSidecars writes the .ecx / .ecj / .vif set on one disk. No
+// .dat is planted: on a production EC node the .dat is gone after encode, and
+// its absence is what marks the volume as distributed rather than as an
+// interrupted local encode.
+func plantLifecycleSidecars(t *testing.T, dir string) {
+	t.Helper()
+	base := erasure_coding.EcShardFileName(lifecycleCollection, dir, int(lifecycleVolumeId))
+	if err := os.WriteFile(base+".ecx", make([]byte, 20), 0o644); err != nil {
+		t.Fatalf("write .ecx: %v", err)
+	}
+	if err := os.WriteFile(base+".ecj", nil, 0o644); err != nil {
+		t.Fatalf("write .ecj: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(base+".vif", &volume_server_pb.VolumeInfo{
+		Version:     uint32(needle.Version3),
+		DatFileSize: lifecycleDatSize,
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards:   lifecycleData,
+			ParityShards: lifecycleParity,
+		},
+	}); err != nil {
+		t.Fatalf("save .vif: %v", err)
+	}
+}
+
+// newLifecycleStore starts a Store over dirs and returns it with a closer that
+// also stops the notification drainer, so a test can restart the store over
+// the same directories.
+func newLifecycleStore(t *testing.T, dirs []string) (*Store, func()) {
+	t.Helper()
+	maxCounts := make([]int32, len(dirs))
+	freeSpaces := make([]util.MinFreeSpace, len(dirs))
+	diskTypes := make([]types.DiskType, len(dirs))
+	for i := range dirs {
+		maxCounts[i] = 100
+		diskTypes[i] = types.HardDriveType
+	}
+	store := NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		dirs, maxCounts, freeSpaces, "", NeedleMapInMemory, diskTypes, nil, 3,
+		stats.DefaultDiskIOProbeConfig())
+	done := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-store.NewEcShardsChan:
+			case <-store.NewVolumesChan:
+			case <-store.DeletedVolumesChan:
+			case <-store.DeletedEcShardsChan:
+			case <-store.StateUpdateChan:
+			case <-done:
+				return
+			}
+		}
+	}()
+	return store, func() {
+		store.Close()
+		close(done)
+	}
+}
+
+// registeredShards reports which shard ids are registered on each disk, in
+// the order of store.Locations — the store's answer to "what would heartbeat
+// report", independent of what sits on disk.
+func registeredShards(store *Store) map[int][]int {
+	byDisk := make(map[int][]int)
+	for diskId, loc := range store.Locations {
+		if ecv, ok := loc.FindEcVolume(lifecycleVolumeId); ok {
+			for _, sid := range ecv.ShardIdList() {
+				byDisk[diskId] = append(byDisk[diskId], int(sid))
+			}
+		}
+	}
+	return byDisk
+}
+
+// assertRegistered fails unless the registered shard set matches want exactly,
+// disk by disk. Counts alone can pass while a reconcile associates a shard with
+// the wrong disk or loads a different shard than the file on disk; comparing the
+// actual ids per disk is what catches that. want maps disk index -> shard ids;
+// a disk absent from want must have no registered shards.
+func assertRegistered(t *testing.T, store *Store, phase string, want map[int][]int) {
+	t.Helper()
+	norm := func(m map[int][]int) map[int][]int {
+		out := map[int][]int{}
+		for d, ids := range m {
+			if len(ids) == 0 {
+				continue
+			}
+			cp := append([]int(nil), ids...)
+			sort.Ints(cp)
+			out[d] = cp
+		}
+		return out
+	}
+	got := norm(registeredShards(store))
+	exp := norm(want)
+	if !reflect.DeepEqual(got, exp) {
+		t.Fatalf("%s: registered shard set = %v, want %v; "+
+			"a shard on the wrong disk or the wrong id loaded keeps the counts right while corrupting the mapping",
+			phase, got, exp)
+	}
+}
+
+func countRegistered(store *Store) int {
+	n := 0
+	for _, ids := range registeredShards(store) {
+		n += len(ids)
+	}
+	return n
+}
+
+// shardFilesOnDisk counts this volume's shard files under dir, the ground
+// truth the registration view must never silently diverge from.
+func shardFilesOnDisk(t *testing.T, dir string) int {
+	t.Helper()
+	base := erasure_coding.EcShardFileName(lifecycleCollection, dir, int(lifecycleVolumeId))
+	n := 0
+	for i := 0; i < erasure_coding.MaxShardCount; i++ {
+		if _, err := os.Stat(base + erasure_coding.ToExt(i)); err == nil {
+			n++
+		}
+	}
+	return n
+}
+
+func TestMultiDiskLifecycle_SpreadLayout(t *testing.T) {
+	tempDir := t.TempDir()
+	dirs := []string{
+		filepath.Join(tempDir, "disk0"),
+		filepath.Join(tempDir, "disk1"),
+		filepath.Join(tempDir, "disk2"),
+	}
+	for _, d := range dirs {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// The production layout: sidecars live with the first six shards on disk0,
+	// the rest of the shards sit alone on disks 1 and 2.
+	plantLifecycleSidecars(t, dirs[0])
+	for sid := 0; sid <= 5; sid++ {
+		plantLifecycleShard(t, dirs[0], sid)
+	}
+	for sid := 6; sid <= 10; sid++ {
+		plantLifecycleShard(t, dirs[1], sid)
+	}
+	for sid := 11; sid <= 13; sid++ {
+		plantLifecycleShard(t, dirs[2], sid)
+	}
+
+	// ── Phase A: cold start over the spread layout ──
+	// Register the first store's closer immediately, reading the closeStore
+	// variable at defer time so it also covers the second store after the
+	// restart below. Without this a Fatalf in phase A/B would leak the store
+	// and its notification-drainer goroutine.
+	store, closeStore := newLifecycleStore(t, dirs)
+	defer func() { closeStore() }()
+	assertRegistered(t, store, "cold start over spread layout", map[int][]int{
+		0: {0, 1, 2, 3, 4, 5},
+		1: {6, 7, 8, 9, 10},
+		2: {11, 12, 13},
+	})
+
+	// ── Phase B: a balance moves the sidecar disk's shards away ──
+	// Unmount and remove shards 0..5 from disk0. The sidecars must stay: disks
+	// 1 and 2 still hold eight shards that read and delete through this .ecx.
+	for sid := 0; sid <= 5; sid++ {
+		if err := store.UnmountEcShards(lifecycleVolumeId, erasure_coding.ShardId(sid), 0); err != nil {
+			t.Fatalf("unmount shard %d: %v", sid, err)
+		}
+		base := erasure_coding.EcShardFileName(lifecycleCollection, dirs[0], int(lifecycleVolumeId))
+		if err := os.Remove(base + erasure_coding.ToExt(sid)); err != nil {
+			t.Fatalf("remove shard %d: %v", sid, err)
+		}
+	}
+	assertRegistered(t, store, "after balancing away the sidecar disk's shards", map[int][]int{
+		1: {6, 7, 8, 9, 10},
+		2: {11, 12, 13},
+	})
+
+	// ── Phase C: restart in that state ──
+	// disk0 now holds only sidecars; every shard is on a disk with no local
+	// .ecx. This is the steady state a balanced multi-disk node reboots in.
+	closeStore()
+	store, closeStore = newLifecycleStore(t, dirs)
+
+	assertRegistered(t, store, "restart with sidecars on a shard-less disk", map[int][]int{
+		1: {6, 7, 8, 9, 10},
+		2: {11, 12, 13},
+	})
+	if n := shardFilesOnDisk(t, dirs[1]) + shardFilesOnDisk(t, dirs[2]); n != 8 {
+		t.Fatalf("restart changed what is on disk: %d shard files, want 8 — startup must never delete distributed EC shards", n)
+	}
+
+	// ── Phase D: a fresh shard lands on a shard-only disk ──
+	// A later balance copies shard 0 to disk2. The mount must find the .ecx on
+	// disk0; failing that, the copy is unusable and the move that sent it
+	// deletes the source after a copy nothing can read.
+	plantLifecycleShard(t, dirs[2], 0)
+	if err := store.MountEcShards(lifecycleCollection, lifecycleVolumeId, 0, ""); err != nil {
+		t.Fatalf("mounting a shard delivered to a disk without local sidecars: %v", err)
+	}
+	// Shard 0 now lives on disk2 alongside 11/12/13; the mapping, not just the
+	// count, must reflect that.
+	assertRegistered(t, store, "cross-disk mount of a fresh shard", map[int][]int{
+		1: {6, 7, 8, 9, 10},
+		2: {0, 11, 12, 13},
+	})
+}
+
+// A dead disk that held the sidecars must degrade loudly but safely: the other
+// disks' shards cannot serve reads without the .ecx, so they may drop out of
+// the registered view, but their files must survive so restoring the sidecars
+// (or the disk) restores the volume. Losing one disk of fourteen shards' worth
+// of sidecars must never cost the other thirteen shards their data.
+func TestMultiDiskLifecycle_SidecarDiskLost(t *testing.T) {
+	tempDir := t.TempDir()
+	dirs := []string{
+		filepath.Join(tempDir, "disk0"),
+		filepath.Join(tempDir, "disk1"),
+		filepath.Join(tempDir, "disk2"),
+	}
+	for _, d := range dirs {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	plantLifecycleSidecars(t, dirs[0])
+	for sid := 0; sid <= 5; sid++ {
+		plantLifecycleShard(t, dirs[0], sid)
+	}
+	for sid := 6; sid <= 10; sid++ {
+		plantLifecycleShard(t, dirs[1], sid)
+	}
+	for sid := 11; sid <= 13; sid++ {
+		plantLifecycleShard(t, dirs[2], sid)
+	}
+
+	// The node comes back without disk0 — the disk with the sidecars died.
+	store, closeStore := newLifecycleStore(t, dirs[1:])
+	defer closeStore()
+
+	// Degraded visibility is acceptable and expected; silent file loss is not.
+	if n := shardFilesOnDisk(t, dirs[1]); n != 5 {
+		t.Fatalf("disk1 shard files after sidecar-disk loss: %d, want 5 untouched", n)
+	}
+	if n := shardFilesOnDisk(t, dirs[2]); n != 3 {
+		t.Fatalf("disk2 shard files after sidecar-disk loss: %d, want 3 untouched", n)
+	}
+	// The sidecar disk is gone, so no shard has a reachable .ecx: none may be
+	// registered. If a change ever registers shards without usable sidecars,
+	// this must fail rather than pass silently — a registered-but-unreadable
+	// shard is worse than an unregistered one, because the master advertises it.
+	if got := countRegistered(store); got != 0 {
+		t.Fatalf("registered view without the sidecar disk: %v, want empty "+
+			"(no shard can load without a reachable .ecx)", registeredShards(store))
+	}
+	t.Log("files intact; shards without a reachable .ecx stay unloaded, as required")
+}
diff --git a/weed/storage/store_ec_reconcile.go b/weed/storage/store_ec_reconcile.go
index 3a430bdbfa..c85778470c 100644
--- a/weed/storage/store_ec_reconcile.go
+++ b/weed/storage/store_ec_reconcile.go
@@ -3,6 +3,7 @@ package storage
 import (
 	"os"
 	"path"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -154,17 +155,13 @@ func (s *Store) indexEcxOwners() map[ecKeyForReconcile]ecxOwnerInfo {
 				continue
 			}
 			seen[scan] = true
-			entries, err := os.ReadDir(scan)
-			if err != nil {
-				continue
-			}
-			for _, entry := range entries {
+			if err := eachDirEntry(scan, func(entry os.DirEntry) bool {
 				if entry.IsDir() {
-					continue
+					return true
 				}
 				name := entry.Name()
 				if !strings.HasSuffix(name, ".ecx") {
-					continue
+					return true
 				}
 				// A 0-byte .ecx is a corrupt stub from a failed copy and
 				// not a credible owner — skip it so the scan keeps looking
@@ -175,17 +172,20 @@ func (s *Store) indexEcxOwners() map[ecKeyForReconcile]ecxOwnerInfo {
 				// shards unloaded even when a valid index exists nearby.
 				info, statErr := entry.Info()
 				if statErr != nil || info.Size() == 0 {
-					continue
+					return true
 				}
 				base := name[:len(name)-len(".ecx")]
 				collection, vid, err := parseCollectionVolumeId(base)
 				if err != nil {
-					continue
+					return true
 				}
 				key := ecKeyForReconcile{collection: collection, vid: vid}
 				if _, exists := owners[key]; !exists {
 					owners[key] = ecxOwnerInfo{location: loc, idxDir: scan}
 				}
+				return true
+			}); err != nil {
+				glog.Warningf("scan %s for .ecx owners: %v", scan, err)
 			}
 		}
 	}
@@ -243,10 +243,29 @@ func (s *Store) countEcShardsNodeWide(collection string, vid needle.VolumeId) in
 	return len(seen)
 }
 
+// hasEcVolumes reports whether any disk on this store has an EC volume loaded.
+func (s *Store) hasEcVolumes() bool {
+	for _, loc := range s.Locations {
+		loc.ecVolumesLock.RLock()
+		count := len(loc.ecVolumes)
+		loc.ecVolumesLock.RUnlock()
+		if count > 0 {
+			return true
+		}
+	}
+	return false
+}
+
 func (s *Store) pruneIncompleteEcWithSiblingDat() {
 	if len(s.Locations) < 2 {
 		return
 	}
+	// Only loaded EC volumes are ever pruned, so a store holding none has
+	// nothing to decide — and indexDatOwners below would otherwise walk every
+	// disk and key a map by every .dat on the server to answer no question.
+	if !s.hasEcVolumes() {
+		return
+	}
 
 	datOwners := s.indexDatOwners()
 	if len(datOwners) == 0 {
@@ -344,31 +363,30 @@ func (s *Store) pruneIncompleteEcWithSiblingDat() {
 func (s *Store) indexDatOwners() map[ecKeyForReconcile]datOwnerInfo {
 	owners := make(map[ecKeyForReconcile]datOwnerInfo)
 	for _, loc := range s.Locations {
-		entries, err := os.ReadDir(loc.Directory)
-		if err != nil {
-			continue
-		}
-		for _, entry := range entries {
+		if err := eachDirEntry(loc.Directory, func(entry os.DirEntry) bool {
 			if entry.IsDir() {
-				continue
+				return true
 			}
 			name := entry.Name()
 			if !strings.HasSuffix(name, ".dat") {
-				continue
+				return true
 			}
 			base := name[:len(name)-len(".dat")]
 			collection, vid, err := parseCollectionVolumeId(base)
 			if err != nil {
-				continue
+				return true
 			}
 			info, err := entry.Info()
 			if err != nil {
-				continue
+				return true
 			}
 			key := ecKeyForReconcile{collection: collection, vid: vid}
 			if _, exists := owners[key]; !exists {
 				owners[key] = datOwnerInfo{location: loc, size: info.Size()}
 			}
+			return true
+		}); err != nil {
+			glog.Warningf("scan %s for .dat owners: %v", loc.Directory, err)
 		}
 	}
 	return owners
@@ -382,38 +400,42 @@ func (s *Store) indexDatOwners() map[ecKeyForReconcile]datOwnerInfo {
 // Zero-byte shard files are ignored — loadAllEcShards already treats them
 // as cleanup-worthy noise and we want the same shape here.
 func (l *DiskLocation) collectOrphanEcShards() map[ecKeyForReconcile][]string {
-	entries, err := os.ReadDir(l.Directory)
-	if err != nil {
-		return nil
-	}
 	orphans := make(map[ecKeyForReconcile][]string)
-	for _, entry := range entries {
+	if err := eachDirEntry(l.Directory, func(entry os.DirEntry) bool {
 		if entry.IsDir() {
-			continue
+			return true
 		}
 		name := entry.Name()
 		ext := path.Ext(name)
 		if !re.MatchString(ext) {
-			continue
+			return true
 		}
 		info, err := entry.Info()
 		if err != nil || info.Size() == 0 {
-			continue
+			return true
 		}
 		shardId, err := strconv.ParseInt(ext[3:], 10, 64)
 		if err != nil || shardId < 0 || shardId > 255 {
-			continue
+			return true
 		}
 		base := name[:len(name)-len(ext)]
 		collection, vid, err := parseCollectionVolumeId(base)
 		if err != nil {
-			continue
+			return true
 		}
 		if _, loaded := l.FindEcShard(vid, erasure_coding.ShardId(shardId)); loaded {
-			continue
+			return true
 		}
 		key := ecKeyForReconcile{collection: collection, vid: vid}
 		orphans[key] = append(orphans[key], name)
+		return true
+	}); err != nil {
+		return nil
+	}
+	// os.ReadDir used to hand these back sorted; the shard lists are logged
+	// and mounted in order, so keep them so.
+	for _, shards := range orphans {
+		slices.Sort(shards)
 	}
 	return orphans
 }
diff --git a/weed/storage/store_ec_reconstruct_test.go b/weed/storage/store_ec_reconstruct_test.go
new file mode 100644
index 0000000000..f0ce6c01bd
--- /dev/null
+++ b/weed/storage/store_ec_reconstruct_test.go
@@ -0,0 +1,118 @@
+package storage
+
+import (
+	"bytes"
+	"math/rand"
+	"strings"
+	"testing"
+
+	"github.com/klauspost/reedsolomon"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// encodedInterval returns one interval's worth of every shard, Reed-Solomon encoded
+// from random data, along with the context describing the ratio.
+func encodedInterval(t *testing.T, intervalSize int) ([][]byte, *erasure_coding.ECContext) {
+	t.Helper()
+
+	ecCtx := erasure_coding.NewDefaultECContext("", 0)
+	shardIntervals := make([][]byte, ecCtx.Total())
+	r := rand.New(rand.NewSource(1))
+	for i := range shardIntervals {
+		shardIntervals[i] = make([]byte, intervalSize)
+	}
+	for i := 0; i < ecCtx.DataShards; i++ {
+		r.Read(shardIntervals[i])
+	}
+
+	enc, err := reedsolomon.New(ecCtx.DataShards, ecCtx.ParityShards)
+	if err != nil {
+		t.Fatalf("new encoder: %v", err)
+	}
+	if err := enc.Encode(shardIntervals); err != nil {
+		t.Fatalf("encode: %v", err)
+	}
+	return shardIntervals, ecCtx
+}
+
+func TestReconstructEcShardIntervalRebuildsDataShard(t *testing.T) {
+	shardIntervals, ecCtx := encodedInterval(t, 1024)
+	ecVolume := &erasure_coding.EcVolume{VolumeId: needle.VolumeId(1), ECContext: ecCtx}
+
+	const lost = erasure_coding.ShardId(3)
+	want := bytes.Clone(shardIntervals[lost])
+	shardIntervals[lost] = nil
+	// drop as many others as parity allows, so the rebuild really goes through parity
+	for i := ecCtx.Total() - ecCtx.ParityShards + 1; i < ecCtx.Total(); i++ {
+		shardIntervals[i] = nil
+	}
+
+	if err := reconstructEcShardInterval(ecVolume, ecCtx, shardIntervals, lost); err != nil {
+		t.Fatalf("reconstruct: %v", err)
+	}
+	if !bytes.Equal(shardIntervals[lost], want) {
+		t.Fatalf("rebuilt shard %d does not match the encoded bytes", lost)
+	}
+}
+
+// ReconstructData rebuilds data shards only, leaving a parity slot nil. Reporting that
+// as a success would hand the caller a zero-filled buffer as if it had been read.
+func TestReconstructEcShardIntervalRejectsParityShard(t *testing.T) {
+	shardIntervals, ecCtx := encodedInterval(t, 1024)
+	ecVolume := &erasure_coding.EcVolume{VolumeId: needle.VolumeId(1), ECContext: ecCtx}
+
+	parity := erasure_coding.ShardId(ecCtx.DataShards)
+	shardIntervals[parity] = nil
+
+	err := reconstructEcShardInterval(ecVolume, ecCtx, shardIntervals, parity)
+	if err == nil {
+		t.Fatalf("rebuilding parity shard %d reported success, buffer is %v", parity, shardIntervals[parity])
+	}
+	if !strings.Contains(err.Error(), "only data shards can be rebuilt") {
+		t.Fatalf("error %q, want it to say parity cannot be rebuilt", err)
+	}
+}
+
+func TestReconstructEcShardIntervalNeedsDataShardCount(t *testing.T) {
+	shardIntervals, ecCtx := encodedInterval(t, 1024)
+	ecVolume := &erasure_coding.EcVolume{VolumeId: needle.VolumeId(1), ECContext: ecCtx}
+
+	// one shard short of what the ratio needs
+	for i := 0; i <= ecCtx.ParityShards; i++ {
+		shardIntervals[i] = nil
+	}
+
+	err := reconstructEcShardInterval(ecVolume, ecCtx, shardIntervals, 0)
+	if err == nil || !strings.Contains(err.Error(), "need at least") {
+		t.Fatalf("error %v, want it to report too few shards", err)
+	}
+}
+
+// A gather that filled up on parity leaves several data shards missing, and only one
+// of them is the shard anybody asked for.
+func TestReconstructEcShardIntervalRebuildsOnlyTheTarget(t *testing.T) {
+	shardIntervals, ecCtx := encodedInterval(t, 1024)
+	ecVolume := &erasure_coding.EcVolume{VolumeId: needle.VolumeId(1), ECContext: ecCtx}
+
+	const lost = erasure_coding.ShardId(0)
+	want := bytes.Clone(shardIntervals[lost])
+	// exactly DataShards left in hand, ParityShards of the data shards missing
+	spare := []erasure_coding.ShardId{4, 6, 8}
+	shardIntervals[lost] = nil
+	for _, sid := range spare {
+		shardIntervals[sid] = nil
+	}
+
+	if err := reconstructEcShardInterval(ecVolume, ecCtx, shardIntervals, lost); err != nil {
+		t.Fatalf("reconstruct: %v", err)
+	}
+	if !bytes.Equal(shardIntervals[lost], want) {
+		t.Fatalf("rebuilt shard %d does not match the encoded bytes", lost)
+	}
+	for _, sid := range spare {
+		if shardIntervals[sid] != nil {
+			t.Errorf("shard %d was rebuilt too, only shard %d was asked for", sid, lost)
+		}
+	}
+}
diff --git a/weed/storage/store_ec_recover_fanout_test.go b/weed/storage/store_ec_recover_fanout_test.go
new file mode 100644
index 0000000000..0bd75286e5
--- /dev/null
+++ b/weed/storage/store_ec_recover_fanout_test.go
@@ -0,0 +1,364 @@
+package storage
+
+import (
+	"bytes"
+	"math/rand"
+	"net"
+	"os"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"golang.org/x/sync/semaphore"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/status"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+// countingEcShardPeer stands in for a peer volume server that is having a
+// transient problem: every VolumeEcShardRead is counted and then held until the
+// test releases it, so a stalled fan-out is observable while it is stalled.
+type countingEcShardPeer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	requests    atomic.Int64
+	inFlight    atomic.Int64
+	peak        atomic.Int64
+	release     chan struct{}
+	releaseOnce sync.Once
+}
+
+func (p *countingEcShardPeer) VolumeEcShardRead(req *volume_server_pb.VolumeEcShardReadRequest, stream volume_server_pb.VolumeServer_VolumeEcShardReadServer) error {
+	p.requests.Add(1)
+	inFlight := p.inFlight.Add(1)
+	for peak := p.peak.Load(); inFlight > peak; peak = p.peak.Load() {
+		if p.peak.CompareAndSwap(peak, inFlight) {
+			break
+		}
+	}
+	defer p.inFlight.Add(-1)
+	<-p.release
+	return status.Error(codes.Unavailable, "transient failure")
+}
+
+func (p *countingEcShardPeer) releaseAll() {
+	p.releaseOnce.Do(func() { close(p.release) })
+}
+
+func startCountingEcShardPeer(t *testing.T) (*countingEcShardPeer, pb.ServerAddress) {
+	t.Helper()
+	peer := &countingEcShardPeer{release: make(chan struct{})}
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(srv, peer)
+	go srv.Serve(lis)
+	t.Cleanup(func() {
+		peer.releaseAll()
+		srv.Stop()
+	})
+	return peer, pb.NewServerAddressWithGrpcPort("127.0.0.1:1", lis.Addr().(*net.TCPAddr).Port)
+}
+
+// writeEcVolumeFiles writes one needle into a volume in dir and EC-encodes it in
+// place, leaving the .ec?? / .ecx / .vif set behind.
+func writeEcVolumeFiles(t *testing.T, dir string, vid needle.VolumeId) (baseFileName string, n *needle.Needle) {
+	t.Helper()
+
+	v, err := NewVolume(dir, dir, "", vid, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("new volume: %v", err)
+	}
+	n = new(needle.Needle)
+	n.Id = types.Uint64ToNeedleId(42)
+	n.Data = make([]byte, 3*erasure_coding.ErasureCodingSmallBlockSize+1234)
+	rand.New(rand.NewSource(42)).Read(n.Data)
+	n.Checksum = needle.NewCRC(n.Data)
+	if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	baseFileName = v.DataFileName()
+	v.Close()
+
+	datSize, err := os.Stat(baseFileName + ".dat")
+	if err != nil {
+		t.Fatalf("stat .dat: %v", err)
+	}
+	ecCtx := erasure_coding.BackgroundECContext()
+	if _, err := erasure_coding.WriteEcFiles(baseFileName, ecCtx); err != nil {
+		t.Fatalf("write ec files: %v", err)
+	}
+	if err := erasure_coding.WriteSortedFileFromIdx(baseFileName, ".ecx"); err != nil {
+		t.Fatalf("write .ecx: %v", err)
+	}
+	if err := os.WriteFile(baseFileName+".ecj", nil, 0o644); err != nil {
+		t.Fatalf("write .ecj: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(baseFileName+".vif", &volume_server_pb.VolumeInfo{
+		Version:     uint32(needle.GetCurrentVersion()),
+		DatFileSize: datSize.Size(),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards:   erasure_coding.DataShardsCount,
+			ParityShards: erasure_coding.ParityShardsCount,
+			// The encode writes the uniform layout; a .vif that omitted its
+			// block size would mount these shards as legacy and read every
+			// interval at the wrong offset.
+			BlockSize: ecCtx.BlockSize,
+		},
+	}); err != nil {
+		t.Fatalf("save .vif: %v", err)
+	}
+	for _, ext := range []string{".dat", ".idx"} {
+		if err := os.Remove(baseFileName + ext); err != nil {
+			t.Fatalf("remove %s: %v", ext, err)
+		}
+	}
+	return baseFileName, n
+}
+
+// mountLocalEcVolume writes an EC volume into the store's own disk and mounts
+// every shard, so a recovery can be served entirely from local shards.
+func mountLocalEcVolume(t *testing.T, store *Store, vid needle.VolumeId) (*erasure_coding.EcVolume, *needle.Needle) {
+	t.Helper()
+	_, n := writeEcVolumeFiles(t, store.Locations[0].Directory, vid)
+	for shardId := 0; shardId < erasure_coding.TotalShardsCount; shardId++ {
+		if err := store.MountEcShards("", vid, erasure_coding.ShardId(shardId), ""); err != nil {
+			t.Fatalf("mount shard %d: %v", shardId, err)
+		}
+	}
+	ecVolume, found := store.Locations[0].FindEcVolume(vid)
+	if !found {
+		t.Fatal("ec volume not mounted")
+	}
+	return ecVolume, n
+}
+
+// seedShardLocations points every shard of the volume at one address and marks
+// the cache fresh, so a read never reaches for the master this test does not run.
+func seedShardLocations(ecVolume *erasure_coding.EcVolume, addr pb.ServerAddress) {
+	ecVolume.ShardLocationsLock.Lock()
+	for shardId := 0; shardId < erasure_coding.TotalShardsCount; shardId++ {
+		ecVolume.ShardLocations[erasure_coding.ShardId(shardId)] = []pb.ServerAddress{addr}
+	}
+	ecVolume.ShardLocationsRefreshTime = time.Now()
+	ecVolume.ShardLocationsLock.Unlock()
+}
+
+// Recovery reconstructs a shard from the shards this server already holds, so a
+// store holding the whole volume never asks a peer for one.
+func TestRecoverOneRemoteEcShardIntervalUsesLocalShards(t *testing.T) {
+	store := newTestStore(t, 1)
+	peer, addr := startCountingEcShardPeer(t)
+	ecVolume, n := mountLocalEcVolume(t, store, 7)
+	seedShardLocations(ecVolume, addr)
+
+	_, _, intervals, err := ecVolume.LocateEcShardNeedle(n.Id, ecVolume.Version)
+	if err != nil {
+		t.Fatalf("locate needle: %v", err)
+	}
+	shardIdToRecover, actualOffset := ecVolume.IntervalToShardIdAndOffset(intervals[0])
+
+	got := make([]byte, intervals[0].Size)
+	nRead, _, err := store.recoverOneRemoteEcShardInterval(n.Id, ecVolume, shardIdToRecover, got, actualOffset)
+	if err != nil {
+		t.Fatalf("recover ec shard interval: %v", err)
+	}
+	if nRead != len(got) {
+		t.Fatalf("recovered %d bytes, want %d", nRead, len(got))
+	}
+	if requests := peer.requests.Load(); requests != 0 {
+		t.Errorf("recovery asked peers for %d shard intervals, want 0 with every shard local", requests)
+	}
+
+	want := make([]byte, len(got))
+	if err := store.readLocalEcShardInterval(ecVolume, shardIdToRecover, want, actualOffset); err != nil {
+		t.Fatalf("read local ec shard %d: %v", shardIdToRecover, err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Errorf("recovered shard %d bytes differ from the shard on disk", shardIdToRecover)
+	}
+}
+
+// shardServingPeer answers VolumeEcShardRead out of an EC volume's shard files
+// and counts how many shard intervals the caller asked for.
+type shardServingPeer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	baseFileName string
+	requests     atomic.Int64
+}
+
+func (p *shardServingPeer) VolumeEcShardRead(req *volume_server_pb.VolumeEcShardReadRequest, stream volume_server_pb.VolumeServer_VolumeEcShardReadServer) error {
+	p.requests.Add(1)
+	f, err := os.Open(p.baseFileName + erasure_coding.ToExt(int(req.ShardId)))
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	data := make([]byte, req.Size)
+	if _, err := f.ReadAt(data, req.Offset); err != nil {
+		return err
+	}
+	return stream.Send(&volume_server_pb.VolumeEcShardReadResponse{Data: data, EncodeTsNs: req.EncodeTsNs})
+}
+
+// Reed-Solomon needs DataShards shards, so the fan-out stops there instead of
+// pulling every surviving shard off peers that may already be struggling.
+func TestRecoverOneRemoteEcShardIntervalFetchesOnlyWhatItNeeds(t *testing.T) {
+	baseFileName, n := writeEcVolumeFiles(t, t.TempDir(), 7)
+
+	peer := &shardServingPeer{baseFileName: baseFileName}
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(srv, peer)
+	go srv.Serve(lis)
+	t.Cleanup(srv.Stop)
+	addr := pb.NewServerAddressWithGrpcPort("127.0.0.1:1", lis.Addr().(*net.TCPAddr).Port)
+
+	store := &Store{grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials())}
+	ecVolume := &erasure_coding.EcVolume{
+		VolumeId:       7,
+		ShardLocations: make(map[erasure_coding.ShardId][]pb.ServerAddress),
+	}
+	seedShardLocations(ecVolume, addr)
+
+	const shardIdToRecover = erasure_coding.ShardId(0)
+	const offset = 0
+	got := make([]byte, 4096)
+	if _, _, err := store.recoverOneRemoteEcShardInterval(n.Id, ecVolume, shardIdToRecover, got, offset); err != nil {
+		t.Fatalf("recover ec shard interval: %v", err)
+	}
+	if requests := peer.requests.Load(); requests != int64(erasure_coding.DataShardsCount) {
+		t.Errorf("recovery asked peers for %d shard intervals, want %d", requests, erasure_coding.DataShardsCount)
+	}
+
+	want := make([]byte, len(got))
+	f, err := os.Open(baseFileName + erasure_coding.ToExt(int(shardIdToRecover)))
+	if err != nil {
+		t.Fatalf("open shard %d: %v", shardIdToRecover, err)
+	}
+	defer f.Close()
+	if _, err := f.ReadAt(want, offset); err != nil {
+		t.Fatalf("read shard %d: %v", shardIdToRecover, err)
+	}
+	if !bytes.Equal(got, want) {
+		t.Errorf("recovered shard %d bytes differ from the shard on disk", shardIdToRecover)
+	}
+}
+
+// setEcRecoverBudget narrows the process-wide recovery budget for one test.
+func setEcRecoverBudget(t *testing.T, budget int64) {
+	t.Helper()
+	oldBudget, oldSem := ecRecoverBudget, ecRecoverSem
+	ecRecoverBudget, ecRecoverSem = budget, semaphore.NewWeighted(budget)
+	t.Cleanup(func() { ecRecoverBudget, ecRecoverSem = oldBudget, oldSem })
+}
+
+// A burst of reads against a peer that has stopped answering queues on the
+// recovery budget instead of piling interval-sized buffers onto the heap.
+func TestRecoverOneRemoteEcShardIntervalBoundsInFlightBytes(t *testing.T) {
+	const intervalSize = 1 << 20
+	const readers = 8
+	const budget = 24 << 20
+
+	setEcRecoverBudget(t, budget)
+	peer, addr := startCountingEcShardPeer(t)
+
+	store := &Store{grpcDialOption: grpc.WithTransportCredentials(insecure.NewCredentials())}
+	ecVolume := &erasure_coding.EcVolume{
+		VolumeId:       7,
+		ShardLocations: make(map[erasure_coding.ShardId][]pb.ServerAddress),
+	}
+	seedShardLocations(ecVolume, addr)
+
+	var wg sync.WaitGroup
+	for i := 0; i < readers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			store.recoverOneRemoteEcShardInterval(types.Uint64ToNeedleId(42), ecVolume, 0, make([]byte, intervalSize), 0)
+		}()
+	}
+
+	// let the fan-out reach the peer and settle there
+	for deadline, settled, last := time.Now().Add(10*time.Second), 0, int64(-1); time.Now().Before(deadline) && settled < 5; {
+		time.Sleep(50 * time.Millisecond)
+		inFlight := peer.inFlight.Load()
+		if inFlight > 0 && inFlight == last {
+			settled++
+		} else {
+			settled = 0
+		}
+		last = inFlight
+	}
+
+	if peak, allowed := peer.peak.Load(), int64(budget/intervalSize); peak > allowed {
+		t.Errorf("%d shard reads of %dMB in flight at once, more than the %dMB budget allows", peak, intervalSize>>20, budget>>20)
+	}
+
+	peer.releaseAll()
+	wg.Wait()
+}
+
+// deletingEcShardPeer answers every shard read with the needle's deletion.
+type deletingEcShardPeer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+}
+
+func (p *deletingEcShardPeer) VolumeEcShardRead(req *volume_server_pb.VolumeEcShardReadRequest, stream volume_server_pb.VolumeServer_VolumeEcShardReadServer) error {
+	return stream.Send(&volume_server_pb.VolumeEcShardReadResponse{IsDeleted: true, EncodeTsNs: req.EncodeTsNs})
+}
+
+// A needle the peers report deleted reads as deleted -- a 404 -- even when too
+// few shards came back to reconstruct it.
+func TestReadEcShardNeedleAnswersDeletedWhenRecoveryFallsShort(t *testing.T) {
+	store := newTestStore(t, 1)
+	store.grpcDialOption = grpc.WithTransportCredentials(insecure.NewCredentials())
+	const vid = needle.VolumeId(7)
+	_, n := writeEcVolumeFiles(t, store.Locations[0].Directory, vid)
+
+	// Too few local shards to reconstruct, and none for the shard the needle's
+	// first interval lands on, so that interval has to recover from peers.
+	for shardId := 1; shardId <= 5; shardId++ {
+		if err := store.MountEcShards("", vid, erasure_coding.ShardId(shardId), ""); err != nil {
+			t.Fatalf("mount shard %d: %v", shardId, err)
+		}
+	}
+	ecVolume, found := store.Locations[0].FindEcVolume(vid)
+	if !found {
+		t.Fatal("ec volume not mounted")
+	}
+
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(srv, &deletingEcShardPeer{})
+	go srv.Serve(lis)
+	t.Cleanup(srv.Stop)
+
+	seedShardLocations(ecVolume, pb.NewServerAddressWithGrpcPort("127.0.0.1:1", lis.Addr().(*net.TCPAddr).Port))
+	ecVolume.ShardLocationsLock.Lock()
+	delete(ecVolume.ShardLocations, erasure_coding.ShardId(0))
+	ecVolume.ShardLocationsLock.Unlock()
+
+	got := new(needle.Needle)
+	got.Id = n.Id
+	if _, err := store.ReadEcShardNeedle(vid, got, nil); err != ErrorDeleted {
+		t.Errorf("read a deleted needle returned %v, want %v", err, ErrorDeleted)
+	}
+}
diff --git a/weed/storage/store_ec_scrub.go b/weed/storage/store_ec_scrub.go
index a1aa529228..25f2f88427 100644
--- a/weed/storage/store_ec_scrub.go
+++ b/weed/storage/store_ec_scrub.go
@@ -13,18 +13,67 @@ import (
 
 // ScrubEcVolume checks the full integrity of a EC volume, across both local and remote shards.
 // Returns a count of processed file entries, slice of found broken shards, and slice of found errors.
-func (s *Store) ScrubEcVolume(vid needle.VolumeId, forceDeletedNeedlesCheck bool) (int64, []*volume_server_pb.EcShardInfo, []error) {
+//
+// FULL reports an unreadable shard and gives up on the needle. READS additionally rebuilds the
+// interval from the surviving shards, so it reports the same broken shards but only errors on
+// needles that parity can no longer recover - which is what exercises the parity data.
+func (s *Store) ScrubEcVolume(vid needle.VolumeId, mode volume_server_pb.VolumeScrubMode, forceDeletedNeedlesCheck bool) (int64, []*volume_server_pb.EcShardInfo, []error) {
 	ecv, found := s.FindEcVolume(vid)
 	if !found {
 		return 0, nil, []error{fmt.Errorf("EC volume id %d not found", vid)}
 	}
 	if err := s.cachedLookupEcShardLocations(ecv); err != nil {
-		return 0, nil, []error{fmt.Errorf("failed to locate shard via master grpc %s: %v", s.MasterAddress, err)}
+		return 0, nil, []error{fmt.Errorf("failed to locate shard via master grpc %s: %v", s.masterAddress(), err)}
+	}
+	return s.scrubEcVolumeWalk(ecv, mode, forceDeletedNeedlesCheck)
+}
+
+// ScrubEcVolumeMerged is the merged-runtime entry point for FULL/READS. It
+// resolves the runtime matching the anchor's encode generation rather than
+// the first disk's, so the needle walk and the parity phase inspect the same
+// encode run. Skipped runtimes are reported alongside any scrub errors.
+func (s *Store) ScrubEcVolumeMerged(merged *erasure_coding.MergedEcRuntimes, mode volume_server_pb.VolumeScrubMode, forceDeletedNeedlesCheck bool) (int64, []*volume_server_pb.EcShardInfo, []error) {
+	anchor := merged.Anchor
+	expectedEncodeTs := anchor.EncodeTsNs
+
+	// Resolve the runtime matching the anchor's encode generation, not the
+	// first-match FindEcVolume — otherwise the needle walk can scan an older
+	// run while the merged view anchored on the newest.
+	var ecv *erasure_coding.EcVolume
+	if expectedEncodeTs != 0 {
+		for _, v := range s.FindAllEcVolumes(anchor.VolumeId) {
+			if v.EncodeTsNs == expectedEncodeTs {
+				ecv = v
+				break
+			}
+		}
+	}
+	if ecv == nil {
+		var found bool
+		ecv, found = s.FindEcVolume(anchor.VolumeId)
+		if !found {
+			return 0, nil, []error{fmt.Errorf("EC volume id %d not found", anchor.VolumeId)}
+		}
+	}
+	if err := s.cachedLookupEcShardLocations(ecv); err != nil {
+		return 0, nil, []error{fmt.Errorf("failed to locate shard via master grpc %s: %v", s.masterAddress(), err)}
 	}
 
+	files, shardInfos, errs := s.scrubEcVolumeWalk(ecv, mode, forceDeletedNeedlesCheck)
+	for _, sk := range merged.Skipped {
+		errs = append(errs, fmt.Errorf("%s", sk))
+	}
+	return files, shardInfos, errs
+}
+
+// scrubEcVolumeWalk is the per-needle local+remote walk shared by ScrubEcVolume
+// and ScrubEcVolumeMerged.
+func (s *Store) scrubEcVolumeWalk(ecv *erasure_coding.EcVolume, mode volume_server_pb.VolumeScrubMode, forceDeletedNeedlesCheck bool) (int64, []*volume_server_pb.EcShardInfo, []error) {
 	// full scan means verifying indexes as well
 	_, errs := ecv.ScrubIndex()
 
+	recoverUnreadable := mode == volume_server_pb.VolumeScrubMode_READS
+
 	var count int64
 	// reads for EC chunks can hit the same shard multiple times, so dedupe upon read errors
 	brokenShardsMap := map[erasure_coding.ShardId]*volume_server_pb.EcShardInfo{}
@@ -41,14 +90,14 @@ func (s *Store) ScrubEcVolume(vid needle.VolumeId, forceDeletedNeedlesCheck bool
 
 		shardIds := make([]erasure_coding.ShardId, len(intervals))
 		for i, iv := range intervals {
-			sid, _ := s.IntervalToShardIdAndOffset(iv)
+			sid, _ := ecv.IntervalToShardIdAndOffset(iv)
 			shardIds[i] = sid
 		}
 		slices.Sort(shardIds)
 
 		for i, iv := range intervals {
 			chunk := make([]byte, iv.Size)
-			shardId, offset := s.IntervalToShardIdAndOffset(iv)
+			shardId, offset := ecv.IntervalToShardIdAndOffset(iv)
 
 			// try a local shard read first...
 			if err := s.readLocalEcShardInterval(ecv, shardId, chunk, offset); err == nil {
@@ -56,27 +105,39 @@ func (s *Store) ScrubEcVolume(vid needle.VolumeId, forceDeletedNeedlesCheck bool
 				continue
 			}
 
-			// ...then remote. note we do not try to recover EC-encoded data upon read failures;
-			// we want check that shards are valid without decoding
+			// ...then remote. neither read decodes: the point is to find shards that are
+			// themselves broken, not to heal around them
 			ecv.ShardLocationsLock.RLock()
 			sourceDataNodes, ok := ecv.ShardLocations[shardId]
 			ecv.ShardLocationsLock.RUnlock()
+			readErr := errors.New("no known shard locations")
 			if ok {
-				if _, _, err := s.readRemoteEcShardInterval(sourceDataNodes, id, ecv.VolumeId, shardId, chunk, offset, ecv.EncodeTsNs); err == nil {
+				if _, _, readErr = s.readRemoteEcShardInterval(sourceDataNodes, id, ecv.VolumeId, shardId, chunk, offset, ecv.EncodeTsNs); readErr == nil {
 					data = append(data, chunk...)
 					continue
 				}
 			}
 
-			// chunk read for shard failed :(
-			errs = append(errs, fmt.Errorf("failed to read EC shard %d for needle %d on volume %d (interval %d/%d)", shardId, id, ecv.VolumeId, i+1, len(intervals)))
+			// the shard is broken whether or not the needle survives it, so report it either way
 			brokenShardsMap[shardId] = &volume_server_pb.EcShardInfo{
 				ShardId:    uint32(shardId),
 				Size:       int64(iv.Size),
 				Collection: ecv.Collection,
 				VolumeId:   uint32(ecv.VolumeId),
 			}
-			break
+
+			if !recoverUnreadable {
+				errs = append(errs, fmt.Errorf("failed to read EC shard %d for needle %d on volume %d (interval %d/%d): %v", shardId, id, ecv.VolumeId, i+1, len(intervals), readErr))
+				break
+			}
+			// A holder reporting the needle deleted is authoritative, and it answers
+			// with no bytes: the chunk stays zeroed and reaches ReadBytes as the
+			// delete-state mismatch the walk below already tolerates.
+			if _, isDeleted, err := s.recoverOneRemoteEcShardInterval(id, ecv, shardId, chunk, offset); err != nil && !isDeleted {
+				errs = append(errs, fmt.Errorf("failed to recover EC shard %d for needle %d on volume %d (interval %d/%d): %v", shardId, id, ecv.VolumeId, i+1, len(intervals), err))
+				break
+			}
+			data = append(data, chunk...)
 		}
 
 		if got, want := int64(len(data)), needle.GetActualSize(size, ecv.Version); got != want {
diff --git a/weed/storage/store_ec_scrub_reads_test.go b/weed/storage/store_ec_scrub_reads_test.go
new file mode 100644
index 0000000000..f30ff853a1
--- /dev/null
+++ b/weed/storage/store_ec_scrub_reads_test.go
@@ -0,0 +1,177 @@
+package storage
+
+import (
+	"math/rand"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+// newLocalEcVolume builds an EC volume holding one needle spread over several shards,
+// mounts every shard locally, and seeds the shard-location cache with empty location
+// lists: the cache then counts as fresh, so nothing calls the master these tests do not
+// have, and no read leaves the process. Returns the needle that was encoded.
+func newLocalEcVolume(t *testing.T, vid needle.VolumeId) (*Store, *erasure_coding.EcVolume, *needle.Needle) {
+	t.Helper()
+
+	store := newTestStore(t, 1)
+	dir := store.Locations[0].Directory
+
+	v, err := NewVolume(dir, dir, "", vid, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("new volume: %v", err)
+	}
+	n := new(needle.Needle)
+	n.Id = types.Uint64ToNeedleId(42)
+	n.Data = make([]byte, 3*erasure_coding.ErasureCodingSmallBlockSize+1234)
+	rand.New(rand.NewSource(42)).Read(n.Data)
+	n.Checksum = needle.NewCRC(n.Data)
+	if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	baseFileName := v.DataFileName()
+	v.Close()
+
+	datSize, err := os.Stat(baseFileName + ".dat")
+	if err != nil {
+		t.Fatalf("stat .dat: %v", err)
+	}
+	ecCtx := erasure_coding.BackgroundECContext()
+	if _, err := erasure_coding.WriteEcFiles(baseFileName, ecCtx); err != nil {
+		t.Fatalf("write ec files: %v", err)
+	}
+	if err := erasure_coding.WriteSortedFileFromIdx(baseFileName, ".ecx"); err != nil {
+		t.Fatalf("write .ecx: %v", err)
+	}
+	if err := os.WriteFile(baseFileName+".ecj", nil, 0o644); err != nil {
+		t.Fatalf("write .ecj: %v", err)
+	}
+	if err := volume_info.SaveVolumeInfo(baseFileName+".vif", &volume_server_pb.VolumeInfo{
+		Version:     uint32(needle.GetCurrentVersion()),
+		DatFileSize: datSize.Size(),
+		EcShardConfig: &volume_server_pb.EcShardConfig{
+			DataShards:   erasure_coding.DataShardsCount,
+			ParityShards: erasure_coding.ParityShardsCount,
+			// The encode writes the uniform layout; a .vif that omitted its
+			// block size would mount these shards as legacy and read every
+			// interval at the wrong offset.
+			BlockSize: ecCtx.BlockSize,
+		},
+	}); err != nil {
+		t.Fatalf("save .vif: %v", err)
+	}
+	for _, ext := range []string{".dat", ".idx"} {
+		if err := os.Remove(baseFileName + ext); err != nil {
+			t.Fatalf("remove %s: %v", ext, err)
+		}
+	}
+
+	for shardId := 0; shardId < erasure_coding.TotalShardsCount; shardId++ {
+		if err := store.MountEcShards("", vid, erasure_coding.ShardId(shardId), ""); err != nil {
+			t.Fatalf("mount shard %d: %v", shardId, err)
+		}
+	}
+	ecVolume, found := store.Locations[0].FindEcVolume(vid)
+	if !found {
+		t.Fatal("ec volume not mounted")
+	}
+
+	ecVolume.ShardLocationsLock.Lock()
+	for shardId := 0; shardId < erasure_coding.TotalShardsCount; shardId++ {
+		ecVolume.ShardLocations[erasure_coding.ShardId(shardId)] = []pb.ServerAddress{}
+	}
+	ecVolume.ShardLocationsRefreshTime = time.Now()
+	ecVolume.ShardLocationsLock.Unlock()
+
+	return store, ecVolume, n
+}
+
+func TestScrubEcVolumeReadsMatchesFullWhenHealthy(t *testing.T) {
+	const vid = needle.VolumeId(7)
+	store, _, _ := newLocalEcVolume(t, vid)
+
+	for _, mode := range []volume_server_pb.VolumeScrubMode{
+		volume_server_pb.VolumeScrubMode_FULL,
+		volume_server_pb.VolumeScrubMode_READS,
+	} {
+		count, brokenShards, errs := store.ScrubEcVolume(vid, mode, false)
+		if count != 1 {
+			t.Errorf("%s: scrubbed %d needles, want 1", mode, count)
+		}
+		if len(brokenShards) != 0 {
+			t.Errorf("%s: reported broken shards %v on a healthy volume", mode, brokenShards)
+		}
+		if len(errs) != 0 {
+			t.Errorf("%s: reported errors on a healthy volume: %v", mode, errs)
+		}
+	}
+}
+
+// A READS scrub rebuilds what it cannot read, but the shard it could not read is still
+// broken and must still be reported - otherwise a volume missing shards scrubs clean and
+// the operator never learns to repair it.
+func TestScrubEcVolumeReadsReportsTheShardItRebuilt(t *testing.T) {
+	const vid = needle.VolumeId(7)
+	const missingShard = erasure_coding.ShardId(0)
+
+	store, _, _ := newLocalEcVolume(t, vid)
+	if err := store.UnmountEcShards(vid, missingShard, 0); err != nil {
+		t.Fatalf("unmount shard %d: %v", missingShard, err)
+	}
+
+	// FULL gives up on the needles that lived on the missing shard...
+	_, brokenShards, errs := store.ScrubEcVolume(vid, volume_server_pb.VolumeScrubMode_FULL, false)
+	assertOnlyBrokenShard(t, "FULL", brokenShards, missingShard)
+	if len(errs) == 0 {
+		t.Fatalf("FULL reported no error for a shard it could not read")
+	}
+	if got := errs[0].Error(); !strings.Contains(got, "failed to read EC shard 0") {
+		t.Fatalf("FULL error %q, want it to name the shard it could not read", got)
+	}
+
+	// ...READS rebuilds them from the shards that are left, and still names the shard.
+	_, brokenShards, errs = store.ScrubEcVolume(vid, volume_server_pb.VolumeScrubMode_READS, false)
+	assertOnlyBrokenShard(t, "READS", brokenShards, missingShard)
+	if len(errs) != 0 {
+		t.Fatalf("READS should rebuild every needle from parity, got: %v", errs)
+	}
+}
+
+func TestScrubEcVolumeReadsErrorsWhenParityCannotCover(t *testing.T) {
+	const vid = needle.VolumeId(7)
+
+	store, _, _ := newLocalEcVolume(t, vid)
+	// one shard more than parity can cover, so nothing can be rebuilt
+	for shardId := 0; shardId <= erasure_coding.ParityShardsCount; shardId++ {
+		if err := store.UnmountEcShards(vid, erasure_coding.ShardId(shardId), 0); err != nil {
+			t.Fatalf("unmount shard %d: %v", shardId, err)
+		}
+	}
+
+	_, brokenShards, errs := store.ScrubEcVolume(vid, volume_server_pb.VolumeScrubMode_READS, false)
+	if len(brokenShards) == 0 {
+		t.Fatalf("no broken shard reported for an unrecoverable volume")
+	}
+	if len(errs) == 0 {
+		t.Fatalf("no error reported for an unrecoverable volume")
+	}
+	if got := errs[0].Error(); !strings.Contains(got, "failed to recover EC shard") {
+		t.Fatalf("error %q, want it to say the rebuild failed", got)
+	}
+}
+
+func assertOnlyBrokenShard(t *testing.T, mode string, brokenShards []*volume_server_pb.EcShardInfo, shardId erasure_coding.ShardId) {
+	t.Helper()
+	if len(brokenShards) != 1 || brokenShards[0].GetShardId() != uint32(shardId) {
+		t.Fatalf("%s reported broken shards %v, want only shard %d", mode, brokenShards, shardId)
+	}
+}
diff --git a/weed/storage/store_ec_target_location_test.go b/weed/storage/store_ec_target_location_test.go
index 9b79422975..cf88d86709 100644
--- a/weed/storage/store_ec_target_location_test.go
+++ b/weed/storage/store_ec_target_location_test.go
@@ -148,6 +148,107 @@ func TestFindEcShardTargetLocation_TightProvisioningKeepsEcxDisk(t *testing.T) {
 	}
 }
 
+// TestFindEcShardTargetLocation_PinsToTheDiskOwningTheShard covers the
+// per-server invariant that a shard id is owned by at most one disk.
+//
+// A multi-disk server legitimately mounts one vid on several disks, each
+// holding a disjoint subset of the shards, so the mounted tier ties and the
+// free-count tie-break decides — and it points at whichever disk happens to
+// be emptier, not at the disk that already has this shard. A re-copy of a
+// shard the server already holds (a retried ec.balance / ec.rebuild move)
+// then lands a second copy on the sibling disk, and both disks register the
+// same shard id.
+func TestFindEcShardTargetLocation_PinsToTheDiskOwningTheShard(t *testing.T) {
+	store := newEcTargetTestStore(t, 2)
+	collection := "grafana-loki"
+	vid := needle.VolumeId(8888)
+
+	// Disk 0 owns shards 0 and 1, disk 1 owns shard 2 — so disk 1 is the
+	// emptier of the two and wins the free-count tie-break.
+	mountEcShards(store.Locations[0], collection, vid, 0, 1)
+	mountEcShards(store.Locations[1], collection, vid, 2)
+
+	if got := store.FindEcShardTargetLocation(collection, vid, dataShardCount, 0); got != store.Locations[0] {
+		t.Errorf("a copy of shard 0 left its owning disk: got %v, want %s", got, store.Locations[0].Directory)
+	}
+	if got := store.FindEcShardTargetLocation(collection, vid, dataShardCount, 2); got != store.Locations[1] {
+		t.Errorf("a copy of shard 2 left its owning disk: got %v, want %s", got, store.Locations[1].Directory)
+	}
+
+	// A shard no disk owns yet is placed by the unchanged waterfall: both
+	// disks have it mounted, so the emptier one wins.
+	if got := store.FindEcShardTargetLocation(collection, vid, dataShardCount, 7); got != store.Locations[1] {
+		t.Errorf("placement of an unclaimed shard changed: got %v, want the emptier mounted disk", got)
+	}
+}
+
+// TestFindEcShardTargetLocation_OwningDiskWinsWhenFull pins the second half
+// of the invariant: a disk with no free shard slots still wins for a shard it
+// already owns. Re-copying that shard overwrites bytes the disk is already
+// accounted for, while the alternative — routing to a sibling — splits the
+// claim across two disks.
+func TestFindEcShardTargetLocation_OwningDiskWinsWhenFull(t *testing.T) {
+	store := newEcTargetTestStore(t, 2)
+	collection := "grafana-loki"
+	vid := needle.VolumeId(9999)
+
+	store.Locations[0].MaxVolumeCount = 1
+	mountEcShards(store.Locations[0], collection, vid, 0)
+	// Fill disk 0 past its shard-slot budget so ecFreeShardCount reports 0.
+	filler := needle.VolumeId(10000)
+	fillerShards := make([]erasure_coding.ShardId, dataShardCount)
+	for i := range fillerShards {
+		fillerShards[i] = erasure_coding.ShardId(i)
+	}
+	mountEcShards(store.Locations[0], collection, filler, fillerShards...)
+
+	if got := store.FindEcShardTargetLocation(collection, vid, dataShardCount, 0); got != store.Locations[0] {
+		t.Errorf("a copy of shard 0 left its owning disk when the disk was full: got %v", got)
+	}
+	// A shard it does not own still respects the space filter.
+	if got := store.FindEcShardTargetLocation(collection, vid, dataShardCount, 7); got != store.Locations[1] {
+		t.Errorf("an unclaimed shard should go to the disk with free slots: got %v", got)
+	}
+}
+
+// TestEcShardOwnerDisks pins the mixed-owner batch contract: a batch whose
+// requested shards are already owned by different disks reports every owner,
+// so VolumeEcShardsCopy can refuse it rather than rank the owners into one
+// destination and duplicate the loser's claim.
+func TestEcShardOwnerDisks(t *testing.T) {
+	store := newEcTargetTestStore(t, 3)
+	collection := "grafana-loki"
+	vid := needle.VolumeId(11111)
+
+	mountEcShards(store.Locations[0], collection, vid, 0, 1)
+	mountEcShards(store.Locations[1], collection, vid, 2)
+
+	if owners := store.EcShardOwnerDisks(vid, []erasure_coding.ShardId{0, 2}); len(owners) != 2 {
+		t.Errorf("a batch owned by two disks reported %d owners; the copy handler would duplicate a claim", len(owners))
+	}
+	// A batch on one disk, with or without unowned extras, has one owner.
+	if owners := store.EcShardOwnerDisks(vid, []erasure_coding.ShardId{0, 1, 7}); len(owners) != 1 || owners[0] != store.Locations[0] {
+		t.Errorf("a single-owner batch reported owners %v; want just disk 0", owners)
+	}
+	// A wholly unowned batch reports none — fresh placement stays allowed.
+	if owners := store.EcShardOwnerDisks(vid, []erasure_coding.ShardId{7, 8}); len(owners) != 0 {
+		t.Errorf("an unowned batch reported owners %v; want none", owners)
+	}
+}
+
+// mountEcShards registers an EcVolume for vid on loc claiming shardIds.
+func mountEcShards(loc *DiskLocation, collection string, vid needle.VolumeId, shardIds ...erasure_coding.ShardId) {
+	ecVolume := &erasure_coding.EcVolume{VolumeId: vid, Collection: collection}
+	for _, shardId := range shardIds {
+		ecVolume.Shards = append(ecVolume.Shards, &erasure_coding.EcVolumeShard{
+			VolumeId: vid, ShardId: shardId, Collection: collection,
+		})
+	}
+	loc.ecVolumesLock.Lock()
+	loc.ecVolumes[vid] = ecVolume
+	loc.ecVolumesLock.Unlock()
+}
+
 // newEcTargetTestStore is a leaner cousin of the helper in
 // store_load_balancing_test.go: it spins up an in-memory Store with N
 // HDD disk locations under a single t.TempDir and consumes any heartbeat
diff --git a/weed/storage/store_heartbeat_bench_test.go b/weed/storage/store_heartbeat_bench_test.go
new file mode 100644
index 0000000000..31cd22a5ce
--- /dev/null
+++ b/weed/storage/store_heartbeat_bench_test.go
@@ -0,0 +1,36 @@
+package storage
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// A volume server heartbeats every VolumePulsePeriod whether or not anything
+// moved, so this is what a server holding this many volumes allocates just to
+// stay connected.
+func benchCollectHeartbeat(b *testing.B, count int) {
+	store := newTestStore(b, 1)
+	location := store.Locations[0]
+	for i := 1; i <= count; i++ {
+		mountTestVolume(b, location, needle.VolumeId(i), "")
+	}
+	store.ResetVolumeReporting()
+	store.AcceptVolumeChanges()
+	store.CollectHeartbeat()
+
+	b.ResetTimer()
+	b.ReportAllocs()
+	for i := 0; i < b.N; i++ {
+		store.CollectHeartbeat()
+	}
+}
+
+func BenchmarkCollectHeartbeat(b *testing.B) {
+	for _, count := range []int{1000, 10000} {
+		b.Run(fmt.Sprintf("%dVolumes", count), func(b *testing.B) {
+			benchCollectHeartbeat(b, count)
+		})
+	}
+}
diff --git a/weed/storage/store_heartbeat_digest_test.go b/weed/storage/store_heartbeat_digest_test.go
index c58e9469e6..f34c2f99a5 100644
--- a/weed/storage/store_heartbeat_digest_test.go
+++ b/weed/storage/store_heartbeat_digest_test.go
@@ -3,18 +3,20 @@ package storage
 import (
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 )
 
-func mountTestVolume(t *testing.T, loc *DiskLocation, vid needle.VolumeId) {
+func mountTestVolume(t testing.TB, loc *DiskLocation, vid needle.VolumeId, collection string) *Volume {
 	t.Helper()
-	v, err := NewVolume(loc.Directory, loc.IdxDirectory, "", vid, NeedleMapInMemory,
+	v, err := NewVolume(loc.Directory, loc.IdxDirectory, collection, vid, NeedleMapInMemory,
 		&super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
 	if err != nil {
 		t.Fatal(err)
 	}
 	loc.SetVolume(vid, v)
+	return v
 }
 
 // The digest has to cover exactly the volumes the heartbeat carries. A volume
@@ -22,9 +24,9 @@ func mountTestVolume(t *testing.T, loc *DiskLocation, vid needle.VolumeId) {
 // comparison disagree forever.
 func TestCollectHeartbeatDigestsExactlyWhatItReports(t *testing.T) {
 	store := newTestStore(t, 2)
-	mountTestVolume(t, store.Locations[0], 1)
-	mountTestVolume(t, store.Locations[0], 2)
-	mountTestVolume(t, store.Locations[1], 3)
+	mountTestVolume(t, store.Locations[0], 1, "")
+	mountTestVolume(t, store.Locations[0], 2, "")
+	mountTestVolume(t, store.Locations[1], 3, "")
 
 	heartbeat := store.CollectHeartbeat()
 	if heartbeat.VolumeDigest == nil {
@@ -65,16 +67,38 @@ func TestCollectHeartbeatDigestsAnEmptyStore(t *testing.T) {
 	}
 }
 
+// The maintenance flag has to reach a master that never saw the change: a
+// leader elected while a server sits in maintenance only hears from it through
+// the regular heartbeats, so each one carries the state.
+func TestCollectHeartbeatCarriesState(t *testing.T) {
+	store := newTestStore(t, 1)
+
+	heartbeat := store.CollectHeartbeat()
+	if heartbeat.State == nil {
+		t.Fatal("heartbeat carried no state")
+	}
+	if heartbeat.State.GetMaintenance() {
+		t.Fatal("a fresh store must not report maintenance mode")
+	}
+
+	if err := store.State.Update(&volume_server_pb.VolumeServerState{Maintenance: true}); err != nil {
+		t.Fatal(err)
+	}
+	if !store.CollectHeartbeat().GetState().GetMaintenance() {
+		t.Error("heartbeat did not report maintenance mode after it was switched on")
+	}
+}
+
 func TestCollectHeartbeatDigestFollowsVolumeChanges(t *testing.T) {
 	store := newTestStore(t, 1)
-	mountTestVolume(t, store.Locations[0], 1)
+	mountTestVolume(t, store.Locations[0], 1, "")
 	first := store.CollectHeartbeat().GetVolumeDigest()
 
 	if second := store.CollectHeartbeat().GetVolumeDigest(); second != first {
 		t.Errorf("an unchanged store reported a different digest: %d then %d", first, second)
 	}
 
-	mountTestVolume(t, store.Locations[0], 2)
+	mountTestVolume(t, store.Locations[0], 2, "")
 	if grown := store.CollectHeartbeat().GetVolumeDigest(); grown == first {
 		t.Error("mounting a volume left the digest unchanged")
 	}
diff --git a/weed/storage/store_load_balancing_test.go b/weed/storage/store_load_balancing_test.go
index c4ca73178a..cc95d6a4a3 100644
--- a/weed/storage/store_load_balancing_test.go
+++ b/weed/storage/store_load_balancing_test.go
@@ -15,7 +15,7 @@ import (
 )
 
 // newTestStore creates a test store with the specified number of directories
-func newTestStore(t *testing.T, numDirs int) *Store {
+func newTestStore(t testing.TB, numDirs int) *Store {
 	tempDir := t.TempDir()
 
 	var dirs []string
diff --git a/weed/storage/store_mark_readonly_can_delete_test.go b/weed/storage/store_mark_readonly_can_delete_test.go
new file mode 100644
index 0000000000..00376df8cf
--- /dev/null
+++ b/weed/storage/store_mark_readonly_can_delete_test.go
@@ -0,0 +1,154 @@
+package storage
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// newSingleDirStore builds a single-disk store over dir, draining every notify
+// channel so mount and unmount never block.
+func newSingleDirStore(t *testing.T, dir string) *Store {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(dir, 0o755))
+	store := NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		[]string{dir}, []int32{100}, []util.MinFreeSpace{{}}, "",
+		NeedleMapInMemory, []types.DiskType{types.HardDriveType}, nil, 3,
+		stats.DefaultDiskIOProbeConfig())
+	done := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-store.NewVolumesChan:
+			case <-store.DeletedVolumesChan:
+			case <-store.NewEcShardsChan:
+			case <-store.DeletedEcShardsChan:
+			case <-store.StateUpdateChan:
+			case <-done:
+				return
+			}
+		}
+	}()
+	t.Cleanup(func() {
+		close(done)
+	})
+	return store
+}
+
+// canDelete rejects writes, keeps accepting deletes, and survives a restart.
+func TestMarkVolumeReadonlyCanDelete(t *testing.T) {
+	dir := t.TempDir()
+	store := newSingleDirStore(t, dir)
+	const vid = needle.VolumeId(11)
+	require.NoError(t, store.AddVolume(vid, "", NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+
+	n1, n2 := newRandomNeedle(1), newRandomNeedle(2)
+	_, err := store.WriteVolumeNeedle(vid, n1, true, false)
+	require.NoError(t, err)
+	_, err = store.WriteVolumeNeedle(vid, n2, true, false)
+	require.NoError(t, err)
+
+	require.NoError(t, store.MarkVolumeReadonly(vid, true, true))
+	v := store.GetVolume(vid)
+	require.True(t, v.noWriteCanDelete)
+	require.False(t, v.noWriteOrDelete)
+	require.True(t, v.IsReadOnly())
+
+	_, err = store.WriteVolumeNeedle(vid, newRandomNeedle(3), true, false)
+	require.Error(t, err, "writes must be rejected")
+	_, err = store.DeleteVolumeNeedle(vid, n1)
+	require.NoError(t, err, "deletes must still land")
+
+	store.Close()
+	store2 := newSingleDirStore(t, dir)
+	v2 := store2.GetVolume(vid)
+	require.NotNil(t, v2)
+	require.True(t, v2.noWriteCanDelete)
+	require.False(t, v2.noWriteOrDelete)
+
+	_, err = store2.WriteVolumeNeedle(vid, newRandomNeedle(4), true, false)
+	require.Error(t, err, "writes must stay rejected after restart")
+	_, err = store2.DeleteVolumeNeedle(vid, n2)
+	require.NoError(t, err, "deletes must still land after restart")
+
+	// Downgrading to plain readonly clears the canDelete flag.
+	require.NoError(t, store2.MarkVolumeReadonly(vid, false, true))
+	require.True(t, v2.noWriteOrDelete)
+	require.False(t, v2.noWriteCanDelete)
+	_, err = store2.DeleteVolumeNeedle(vid, n2)
+	require.Error(t, err, "plain readonly must reject deletes")
+
+	// -writable clears the state again.
+	require.NoError(t, store2.MarkVolumeWritable(vid))
+	require.False(t, v2.IsReadOnly())
+	_, err = store2.WriteVolumeNeedle(vid, newRandomNeedle(5), true, false)
+	require.NoError(t, err)
+	store2.Close()
+}
+
+// Upgrading a volume that booted plain persisted-readonly to canDelete must
+// reopen the O_RDONLY .idx for writing, or delete tombstones cannot append.
+func TestMarkVolumeReadonlyCanDelete_AfterReadonlyBoot(t *testing.T) {
+	dir := t.TempDir()
+	store := newSingleDirStore(t, dir)
+	const vid = needle.VolumeId(12)
+	require.NoError(t, store.AddVolume(vid, "", NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+
+	n := newRandomNeedle(1)
+	_, err := store.WriteVolumeNeedle(vid, n, true, false)
+	require.NoError(t, err)
+	require.NoError(t, store.MarkVolumeReadonly(vid, false, true))
+	store.Close()
+
+	store2 := newSingleDirStore(t, dir)
+	v := store2.GetVolume(vid)
+	require.NotNil(t, v)
+	require.True(t, v.noWriteOrDelete)
+	_, err = store2.DeleteVolumeNeedle(vid, n)
+	require.Error(t, err, "plain readonly must reject deletes")
+
+	require.NoError(t, store2.MarkVolumeReadonly(vid, true, true))
+	require.False(t, v.noWriteOrDelete)
+	require.True(t, v.noWriteCanDelete)
+	_, err = store2.DeleteVolumeNeedle(vid, n)
+	require.NoError(t, err, "deletes must land once canDelete is set")
+	store2.Close()
+}
+
+func TestMountVolumeAnnouncesReadOnlyState(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		canDelete bool
+	}{
+		{name: "plain read-only"},
+		{name: "read-only can delete", canDelete: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			store := NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+				[]string{dir}, []int32{100}, []util.MinFreeSpace{{}}, "",
+				NeedleMapInMemory, []types.DiskType{types.HardDriveType}, nil, 3,
+				stats.DefaultDiskIOProbeConfig())
+			t.Cleanup(store.Close)
+			const vid = needle.VolumeId(13)
+
+			require.NoError(t, store.AddVolume(vid, "", NeedleMapInMemory, "000", "", 0,
+				needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+			<-store.NewVolumesChan
+			require.NoError(t, store.MarkVolumeReadonly(vid, tc.canDelete, true))
+			require.NoError(t, store.UnmountVolume(vid))
+			<-store.DeletedVolumesChan
+			require.NoError(t, store.MountVolume(vid, nil))
+
+			message := <-store.NewVolumesChan
+			require.True(t, message.ReadOnly)
+			require.Equal(t, tc.canDelete, message.ReadOnlyCanDelete)
+		})
+	}
+}
diff --git a/weed/storage/store_maxvolume_preallocate_test.go b/weed/storage/store_maxvolume_preallocate_test.go
new file mode 100644
index 0000000000..64af0bdc2c
--- /dev/null
+++ b/weed/storage/store_maxvolume_preallocate_test.go
@@ -0,0 +1,33 @@
+package storage
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// A volume that was not preallocated keeps its remaining room reserved when
+// the master turns preallocation on, so it still takes a slot of the free space.
+func TestMaybeAdjustVolumeMaxReservesPlainVolumesWhilePreallocating(t *testing.T) {
+	dir := t.TempDir()
+
+	// Room for 2.5 volumes: the plain volume claims one, leaving one more slot.
+	volumeSizeLimit := uint64(float64(stats.NewDiskStatus(dir).Free) / 2.5)
+	if volumeSizeLimit == 0 {
+		t.Skip("cannot determine free disk space")
+	}
+
+	loc := &DiskLocation{Directory: dir, IdxDirectory: dir}
+	loc.volumes = make(map[needle.VolumeId]*Volume)
+	loc.SetVolume(1, &Volume{Id: 1, dir: dir, dirIdx: dir, DataBackend: &mockBackendStorageFile{}, nm: &mockNeedleMapper{}})
+	s := &Store{Locations: []*DiskLocation{loc}}
+	s.SetVolumeSizeLimit(volumeSizeLimit)
+	s.SetPreallocate(true)
+
+	s.MaybeAdjustVolumeMax()
+
+	if loc.MaxVolumeCount != 2 {
+		t.Errorf("MaxVolumeCount=%d; want 2", loc.MaxVolumeCount)
+	}
+}
diff --git a/weed/storage/store_mount_validation_test.go b/weed/storage/store_mount_validation_test.go
new file mode 100644
index 0000000000..64a7d7e9a9
--- /dev/null
+++ b/weed/storage/store_mount_validation_test.go
@@ -0,0 +1,48 @@
+package storage
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestMountVolumeValidatorAnnouncesOnlyAfterValidation(t *testing.T) {
+	dir := t.TempDir()
+	const vid = needle.VolumeId(17)
+
+	volume, err := NewVolume(dir, dir, "", vid, NeedleMapInMemory,
+		&super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	volume.Close()
+
+	store := NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		[]string{dir}, []int32{100}, []util.MinFreeSpace{{}}, "",
+		NeedleMapInMemory, []types.DiskType{types.HardDriveType}, nil, 3,
+		stats.DefaultDiskIOProbeConfig())
+	t.Cleanup(store.Close)
+
+	validationErr := errors.New("copy counts differ")
+	err = store.MountVolume(vid, nil, func(*Volume) error {
+		select {
+		case <-store.NewVolumesChan:
+			t.Fatal("volume was announced before validation completed")
+		default:
+		}
+		return validationErr
+	})
+
+	require.ErrorIs(t, err, validationErr)
+	require.Nil(t, store.GetVolume(vid))
+	select {
+	case message := <-store.NewVolumesChan:
+		t.Fatalf("volume was announced after validation failed: %+v", message)
+	default:
+	}
+}
diff --git a/weed/storage/store_status_test.go b/weed/storage/store_status_test.go
index 54558616a9..2dc24b661a 100644
--- a/weed/storage/store_status_test.go
+++ b/weed/storage/store_status_test.go
@@ -20,7 +20,7 @@ func TestCollectStatForOneVolumeModifiedAtSecond(t *testing.T) {
 	defer v.Close()
 	v.location = &DiskLocation{Directory: dir, DiskType: types.HardDriveType}
 
-	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false); err != nil {
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
 		t.Fatalf("write: %v", err)
 	}
 
diff --git a/weed/storage/store_vacuum.go b/weed/storage/store_vacuum.go
index 7d4f6dc894..f2e98d4ed4 100644
--- a/weed/storage/store_vacuum.go
+++ b/weed/storage/store_vacuum.go
@@ -7,14 +7,21 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
 
-func (s *Store) CheckCompactVolume(volumeId needle.VolumeId) (float64, error) {
+var ErrInsufficientSpace = fmt.Errorf("insufficient free space")
+
+func (s *Store) CheckCompactVolume(volumeId needle.VolumeId) (garbageRatio float64, diskSpaceLow bool, err error) {
 	if v := s.findVolume(volumeId); v != nil {
 		glog.V(3).Infof("volume %d garbage level: %f", volumeId, v.garbageLevel())
-		return v.garbageLevel(), nil
+		// diskSpaceLow only counts when it is the sole read-only cause — an
+		// operator mark or I/O quarantine still shields the volume.
+		_, noWriteOrDelete, noWriteCanDelete, isLow := v.ReadOnlyReasons()
+		return v.garbageLevel(), isLow && !noWriteOrDelete && !noWriteCanDelete, nil
 	}
-	return 0, fmt.Errorf("volume id %d is not found during check compact", volumeId)
+	return 0, false, fmt.Errorf("volume id %d is not found during check compact: %w", volumeId, ErrVolumeNotFound)
 }
 
 func (s *Store) CompactVolume(vid needle.VolumeId, preallocate int64, compactionBytePerSecond int64, progressFn ProgressFunc) error {
@@ -28,11 +35,11 @@ func (s *Store) CompactVolume(vid needle.VolumeId, preallocate int64, compaction
 			ProgressCallback:  progressFn,
 		})
 	}
-	return fmt.Errorf("volume id %d is not found during compact", vid)
+	return fmt.Errorf("volume id %d is not found during compact: %w", vid, ErrVolumeNotFound)
 }
 
 func (s *Store) CommitCompactVolume(vid needle.VolumeId) (bool, int64, error) {
-	if s.isStopping {
+	if s.isStopping.Load() {
 		return false, 0, fmt.Errorf("volume id %d skips compact because volume is stopping", vid)
 	}
 	if v := s.findVolume(vid); v != nil {
@@ -44,39 +51,103 @@ func (s *Store) CommitCompactVolume(vid needle.VolumeId) (bool, int64, error) {
 		}
 		return isReadOnly, volumeSize, err
 	}
-	return false, 0, fmt.Errorf("volume id %d is not found during commit compact", vid)
+	return false, 0, fmt.Errorf("volume id %d is not found during commit compact: %w", vid, ErrVolumeNotFound)
 }
 
 func (s *Store) CommitCleanupVolume(vid needle.VolumeId) error {
 	if v := s.findVolume(vid); v != nil {
 		return v.cleanupCompact()
 	}
-	return fmt.Errorf("volume id %d is not found during cleaning up", vid)
+	return fmt.Errorf("volume id %d is not found during cleaning up: %w", vid, ErrVolumeNotFound)
+}
+
+// compactionDiskFree reports the free bytes on the disk holding dir, and
+// compactionSameFilesystem whether two directories draw on the same pool.
+// Both are variables so a test can stand in for a full or a split disk.
+var (
+	compactionDiskFree = func(dir string) uint64 {
+		return stats.NewDiskStatus(dir).Free
+	}
+	compactionSameFilesystem = sameFilesystem
+)
+
+// compactionSpaceNeeded estimates what CompactByIndex will write for v: a new
+// .dat holding the live needles with their on-disk framing behind a superblock
+// (or preallocate, when that is larger, since the file is preallocated to it),
+// and a rebuilt index with one entry per live needle. The volume's current size
+// is the wrong yardstick: the more garbage a volume holds, the less its
+// compaction writes, and a store that filled up until its volumes went
+// read-only is exactly where the all-garbage volumes must still compact to
+// give the space back (issue #11516). Neither estimate exceeds the current file.
+func compactionSpaceNeeded(v *Volume, preallocate int64) (dataBytes, indexBytes int64) {
+	datSize, idxSize, _ := v.FileStat()
+	dataBytes, indexBytes = int64(datSize), int64(idxSize)
+
+	liveCount := int64(v.FileCount()) - int64(v.DeletedCount())
+	liveContent := int64(v.ContentSize()) - int64(v.DeletedSize())
+	// A .sdx converted back to .idx carries no deleted sizes (see
+	// garbageLevel), and counters that disagree mean the metric is off;
+	// either way the whole volume stays the estimate.
+	deletedSizeKnown := v.DeletedCount() == 0 || v.DeletedSize() > 0
+	if deletedSizeKnown && liveCount >= 0 && liveContent >= 0 {
+		// GetActualSize(0) is the framing of an empty needle; another
+		// padding unit covers the worst case for any other size.
+		perNeedle := needle.GetActualSize(0, v.Version()) + types.NeedlePaddingSize
+		// Counters rebuilt from an index file (LevelDB and sorted maps) go
+		// through a Bloom filter with a 0.1% false positive rate that can
+		// count a live needle as deleted. A few percent of headroom covers
+		// that many times over.
+		if estimate := withHeadroom(super_block.SuperBlockSize + liveContent + liveCount*perNeedle); estimate < dataBytes {
+			dataBytes = estimate
+		}
+		if estimate := withHeadroom(liveCount * types.NeedleMapEntrySize); estimate < indexBytes {
+			indexBytes = estimate
+		}
+	}
+	if preallocate > dataBytes {
+		dataBytes = preallocate
+	}
+	return dataBytes, indexBytes
+}
+
+func withHeadroom(estimate int64) int64 {
+	return estimate + estimate/16
 }
 
 func ensureCompactVolumeSpace(v *Volume, preallocate int64) error {
-	// Get current volume size for space calculation
+	dataBytes, indexBytes := compactionSpaceNeeded(v, preallocate)
 	volumeSize, indexSize, _ := v.FileStat()
-
-	// Calculate space needed for compaction:
-	// 1. Space for the new compacted volume (approximately same as current volume size)
-	// 2. Use the larger of preallocate or estimated volume size
-	estimatedCompactSize := int64(volumeSize + indexSize)
-	spaceNeeded := preallocate
-	if estimatedCompactSize > preallocate {
-		spaceNeeded = estimatedCompactSize
+	check := func(dir string, needed int64) error {
+		free := compactionDiskFree(dir)
+		if int64(free) < needed {
+			return fmt.Errorf("insufficient free space for compaction in %s: need %d bytes (data: %d, index: %d, current volume: %d, current index: %d), but only %d bytes available: %w",
+				dir, needed, dataBytes, indexBytes, volumeSize, indexSize, free, ErrInsufficientSpace)
+		}
+		glog.V(1).Infof("volume %d compaction space check in %s: data=%d, index=%d, current volume=%d, space_needed=%d, free_space=%d",
+			v.Id, dir, dataBytes, indexBytes, volumeSize, needed, free)
+		return nil
 	}
-
-	diskStatus := stats.NewDiskStatus(v.dir)
-	if int64(diskStatus.Free) < spaceNeeded {
-		return fmt.Errorf("insufficient free space for compaction: need %d bytes (volume: %d, index: %d), but only %d bytes available",
-			spaceNeeded, volumeSize, indexSize, diskStatus.Free)
+	// The new .dat lands next to the old one and the new .idx next to the old
+	// index. When the index directory is on another filesystem each disk
+	// answers for its own share; two directories on one filesystem draw on
+	// the same free space and must cover the sum.
+	if v.dirIdx == "" || v.dirIdx == v.dir {
+		return check(v.dir, dataBytes+indexBytes)
 	}
-
-	glog.V(1).Infof("volume %d compaction space check: volume=%d, index=%d, space_needed=%d, free_space=%d",
-		v.Id, volumeSize, indexSize, spaceNeeded, diskStatus.Free)
-
-	return nil
+	if !compactionSameFilesystem(v.dir, v.dirIdx) {
+		if err := check(v.dir, dataBytes); err != nil {
+			return err
+		}
+		return check(v.dirIdx, indexBytes)
+	}
+	// Same filesystem as far as the identity check can tell. The index
+	// directory is still asked for its own share, because a mount point the
+	// check cannot see (a volume mounted under one drive letter on Windows)
+	// would otherwise go unchecked.
+	if err := check(v.dir, dataBytes+indexBytes); err != nil {
+		return err
+	}
+	return check(v.dirIdx, indexBytes)
 }
 
 func (s *Store) CompactVolumeFiles(vid needle.VolumeId, collection string, location *DiskLocation, needleMapKind NeedleMapKind, ldbTimeout int64, preallocate int64, compactionBytePerSecond int64) (err error) {
@@ -113,6 +184,12 @@ func (s *Store) CompactVolumeFiles(vid needle.VolumeId, collection string, locat
 	}
 
 	if err := tempVolume.CommitCompact(); err != nil {
+		// A failed commit may have swapped only one of .dat/.idx; reconcile
+		// rolls a decided swap forward or removes orphan temp files before
+		// this volume can mount with a mismatched pair.
+		if reconcileErr := tempVolume.reconcileCompactState(); reconcileErr != nil {
+			return fmt.Errorf("commit compact volume %d: %v (reconcile failed: %v)", vid, err, reconcileErr)
+		}
 		if cleanupErr := tempVolume.cleanupCompact(); cleanupErr != nil {
 			return fmt.Errorf("commit compact volume %d: %v (cleanup failed: %v)", vid, err, cleanupErr)
 		}
diff --git a/weed/storage/store_vacuum_fs_unix.go b/weed/storage/store_vacuum_fs_unix.go
new file mode 100644
index 0000000000..1147a6a49d
--- /dev/null
+++ b/weed/storage/store_vacuum_fs_unix.go
@@ -0,0 +1,27 @@
+//go:build !windows
+
+package storage
+
+import (
+	"os"
+	"syscall"
+)
+
+// sameFilesystem reports whether two directories share one free-space pool.
+// When in doubt it says yes, which makes the space check ask for the sum.
+func sameFilesystem(a, b string) bool {
+	if a == b {
+		return true
+	}
+	sa, errA := os.Stat(a)
+	sb, errB := os.Stat(b)
+	if errA != nil || errB != nil {
+		return true
+	}
+	sta, okA := sa.Sys().(*syscall.Stat_t)
+	stb, okB := sb.Sys().(*syscall.Stat_t)
+	if !okA || !okB {
+		return true
+	}
+	return sta.Dev == stb.Dev
+}
diff --git a/weed/storage/store_vacuum_fs_windows.go b/weed/storage/store_vacuum_fs_windows.go
new file mode 100644
index 0000000000..cfbb12e72a
--- /dev/null
+++ b/weed/storage/store_vacuum_fs_windows.go
@@ -0,0 +1,48 @@
+//go:build windows
+
+package storage
+
+import (
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sys/windows"
+)
+
+// sameFilesystem reports whether two directories share one free-space pool.
+// On Windows a volume can be reached through a drive letter and through a
+// folder it is mounted on, so the path prefix says nothing; the volume GUID
+// behind each path does. When in doubt it says yes, which makes the space
+// check ask for the sum.
+func sameFilesystem(a, b string) bool {
+	if a == b {
+		return true
+	}
+	va, errA := volumeGUID(a)
+	vb, errB := volumeGUID(b)
+	if errA != nil || errB != nil {
+		return true
+	}
+	return strings.EqualFold(va, vb)
+}
+
+func volumeGUID(path string) (string, error) {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return "", err
+	}
+	p, err := windows.UTF16PtrFromString(abs)
+	if err != nil {
+		return "", err
+	}
+	mountPoint := make([]uint16, windows.MAX_LONG_PATH)
+	if err := windows.GetVolumePathName(p, &mountPoint[0], uint32(len(mountPoint))); err != nil {
+		return "", err
+	}
+	// \\?\Volume{GUID}\ is 49 characters plus the terminator.
+	guid := make([]uint16, 50)
+	if err := windows.GetVolumeNameForVolumeMountPoint(&mountPoint[0], &guid[0], uint32(len(guid))); err != nil {
+		return "", err
+	}
+	return windows.UTF16ToString(guid), nil
+}
diff --git a/weed/storage/store_vacuum_test.go b/weed/storage/store_vacuum_test.go
index ae32934611..3adc164330 100644
--- a/weed/storage/store_vacuum_test.go
+++ b/weed/storage/store_vacuum_test.go
@@ -1,51 +1,231 @@
 package storage
 
 import (
+	"errors"
+	"path/filepath"
 	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
 
-func TestSpaceCalculation(t *testing.T) {
-	// Test the space calculation logic
-	testCases := []struct {
-		name        string
-		volumeSize  uint64
-		indexSize   uint64
-		preallocate int64
-		expectedMin int64
-	}{
-		{
-			name:        "Large volume, small preallocate",
-			volumeSize:  244 * 1024 * 1024 * 1024,                          // 244GB
-			indexSize:   1024 * 1024,                                       // 1MB
-			preallocate: 1024,                                              // 1KB
-			expectedMin: int64((244*1024*1024*1024 + 1024*1024) * 11 / 10), // +10% buffer
-		},
-		{
-			name:        "Small volume, large preallocate",
-			volumeSize:  100 * 1024 * 1024,                   // 100MB
-			indexSize:   1024,                                // 1KB
-			preallocate: 1024 * 1024 * 1024,                  // 1GB
-			expectedMin: int64(1024 * 1024 * 1024 * 11 / 10), // preallocate + 10%
-		},
+// newVolumeWithGarbage writes live+deleted needles and deletes the first
+// deleted ones, so the volume carries that much garbage on disk.
+func newVolumeWithGarbage(t *testing.T, live, deleted int) *Volume {
+	t.Helper()
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("NewVolume: %v", err)
 	}
+	t.Cleanup(v.Close)
+	for i := 1; i <= live+deleted; i++ {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false); err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+	}
+	for i := 1; i <= deleted; i++ {
+		if _, err := v.deleteNeedle2(newEmptyNeedle(uint64(i))); err != nil {
+			t.Fatalf("delete needle %d: %v", i, err)
+		}
+	}
+	return v
+}
 
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			// Calculate space needed using the same logic as our fix
-			estimatedCompactSize := int64(tc.volumeSize + tc.indexSize)
-			spaceNeeded := tc.preallocate
-			if estimatedCompactSize > tc.preallocate {
-				spaceNeeded = estimatedCompactSize
-			}
-			// Add 10% safety buffer
-			spaceNeeded = spaceNeeded + (spaceNeeded / 10)
+func stubCompactionDiskFree(t *testing.T, free uint64) {
+	t.Helper()
+	prev := compactionDiskFree
+	compactionDiskFree = func(string) uint64 { return free }
+	t.Cleanup(func() { compactionDiskFree = prev })
+}
 
-			if spaceNeeded < tc.expectedMin {
-				t.Errorf("Space calculation too low: got %d, expected at least %d", spaceNeeded, tc.expectedMin)
-			}
+func TestCompactionSpaceNeeded_CountsLiveBytesNotVolumeSize(t *testing.T) {
+	v := newVolumeWithGarbage(t, 20, 2000)
+	datSize, idxSize, _ := v.FileStat()
+	liveContent := int64(v.ContentSize() - v.DeletedSize())
 
-			t.Logf("Volume size: %d bytes, Space needed: %d bytes (%.2f%% of volume size)",
-				tc.volumeSize, spaceNeeded, float64(spaceNeeded)/float64(tc.volumeSize)*100)
-		})
+	dataBytes, indexBytes := compactionSpaceNeeded(v, 0)
+
+	if dataBytes < liveContent+super_block.SuperBlockSize {
+		t.Fatalf("data estimate %d does not cover the %d live content bytes plus the superblock", dataBytes, liveContent)
+	}
+	if indexBytes < 20*types.NeedleMapEntrySize {
+		t.Fatalf("index estimate %d does not cover 20 live entries", indexBytes)
+	}
+	if dataBytes+indexBytes >= int64(datSize+idxSize) {
+		t.Fatalf("space needed %d is not below the current volume size %d: a mostly-garbage volume must not require its own size to compact", dataBytes+indexBytes, datSize+idxSize)
 	}
 }
+
+func TestCompactionSpaceNeeded_AllGarbageNeedsAlmostNothing(t *testing.T) {
+	v := newVolumeWithGarbage(t, 0, 2000)
+	datSize, _, _ := v.FileStat()
+
+	dataBytes, indexBytes := compactionSpaceNeeded(v, 0)
+
+	if needed := dataBytes + indexBytes; needed > int64(datSize)/10 {
+		t.Fatalf("an all-garbage volume of %d bytes still asks for %d bytes", datSize, needed)
+	}
+}
+
+func TestCompactionSpaceNeeded_NeverAboveCurrentVolume(t *testing.T) {
+	// Nothing deleted: the estimate may not exceed what is already on disk.
+	v := newVolumeWithGarbage(t, 200, 0)
+	datSize, idxSize, _ := v.FileStat()
+
+	dataBytes, indexBytes := compactionSpaceNeeded(v, 0)
+
+	if dataBytes > int64(datSize) || indexBytes > int64(idxSize) {
+		t.Fatalf("estimate data=%d index=%d exceeds the current files data=%d index=%d", dataBytes, indexBytes, datSize, idxSize)
+	}
+}
+
+func TestCompactionSpaceNeeded_PreallocateWinsForDataOnly(t *testing.T) {
+	// The new .dat is preallocated to this size; the rebuilt index is a
+	// separate file and still needs its own room.
+	v := newVolumeWithGarbage(t, 5, 5)
+	const preallocate = int64(1) << 30
+
+	dataBytes, indexBytes := compactionSpaceNeeded(v, preallocate)
+
+	if dataBytes != preallocate {
+		t.Fatalf("data estimate %d, want the preallocate size %d", dataBytes, preallocate)
+	}
+	if indexBytes < 5*types.NeedleMapEntrySize {
+		t.Fatalf("index estimate %d does not cover 5 live entries", indexBytes)
+	}
+}
+
+func TestEnsureCompactVolumeSpace_FullDiskWithGarbage(t *testing.T) {
+	// The disk-full case from #11516: free space is far below the volume's
+	// size, but well above what compacting its live needles will write.
+	v := newVolumeWithGarbage(t, 20, 2000)
+	datSize, idxSize, _ := v.FileStat()
+	dataBytes, indexBytes := compactionSpaceNeeded(v, 0)
+	needed := dataBytes + indexBytes
+	if uint64(needed) >= datSize+idxSize {
+		t.Fatalf("test setup: estimate %d is not below volume size %d", needed, datSize+idxSize)
+	}
+
+	stubCompactionDiskFree(t, uint64(needed))
+	if err := ensureCompactVolumeSpace(v, 0); err != nil {
+		t.Fatalf("free %d covers the estimate %d, volume is %d: unexpected %v", needed, needed, datSize+idxSize, err)
+	}
+
+	stubCompactionDiskFree(t, uint64(needed)-1)
+	err := ensureCompactVolumeSpace(v, 0)
+	if !errors.Is(err, ErrInsufficientSpace) {
+		t.Fatalf("free %d below the estimate %d: got %v, want ErrInsufficientSpace", needed-1, needed, err)
+	}
+}
+
+func TestEnsureCompactVolumeSpace_SeparateIndexDisk(t *testing.T) {
+	dataDir, idxDir := t.TempDir(), t.TempDir()
+	v, err := NewVolume(dataDir, idxDir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("NewVolume: %v", err)
+	}
+	t.Cleanup(v.Close)
+	for i := 1; i <= 50; i++ {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false); err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+	}
+	dataBytes, indexBytes := compactionSpaceNeeded(v, 0)
+
+	free := map[string]uint64{dataDir: uint64(dataBytes), idxDir: uint64(indexBytes)}
+	prevFree, prevSame := compactionDiskFree, compactionSameFilesystem
+	compactionDiskFree = func(dir string) uint64 { return free[dir] }
+	compactionSameFilesystem = func(string, string) bool { return false }
+	t.Cleanup(func() { compactionDiskFree, compactionSameFilesystem = prevFree, prevSame })
+
+	if err := ensureCompactVolumeSpace(v, 0); err != nil {
+		t.Fatalf("each disk covers its own share: unexpected %v", err)
+	}
+	// Plenty of room on the data disk cannot make up for a full index disk.
+	free[dataDir] = uint64(dataBytes) * 10
+	free[idxDir] = uint64(indexBytes) - 1
+	if err := ensureCompactVolumeSpace(v, 0); !errors.Is(err, ErrInsufficientSpace) {
+		t.Fatalf("full index disk: got %v, want ErrInsufficientSpace", err)
+	}
+
+	// Two directories on one filesystem draw on the same free space, so the
+	// data and the index estimates must be covered together.
+	compactionSameFilesystem = func(string, string) bool { return true }
+	free[dataDir] = uint64(dataBytes+indexBytes) - 1
+	free[idxDir] = uint64(dataBytes+indexBytes) - 1
+	if err := ensureCompactVolumeSpace(v, 0); !errors.Is(err, ErrInsufficientSpace) {
+		t.Fatalf("shared filesystem short of the sum: got %v, want ErrInsufficientSpace", err)
+	}
+	free[dataDir] = uint64(dataBytes + indexBytes)
+	free[idxDir] = uint64(dataBytes + indexBytes)
+	if err := ensureCompactVolumeSpace(v, 0); err != nil {
+		t.Fatalf("shared filesystem covering the sum: unexpected %v", err)
+	}
+	// A mount point the identity check cannot see: the index directory
+	// reports its own, smaller pool and must still be checked.
+	free[idxDir] = uint64(indexBytes) - 1
+	if err := ensureCompactVolumeSpace(v, 0); !errors.Is(err, ErrInsufficientSpace) {
+		t.Fatalf("index mount point short of the index: got %v, want ErrInsufficientSpace", err)
+	}
+}
+
+func TestSameFilesystem(t *testing.T) {
+	dir := t.TempDir()
+	if !sameFilesystem(dir, dir) {
+		t.Fatal("a directory is on its own filesystem")
+	}
+	if !sameFilesystem(dir, filepath.Join(dir, "missing")) {
+		t.Fatal("an unreadable path must be treated as shared, so the check asks for the sum")
+	}
+}
+
+// The estimate may not fall below the current .dat size: an all-live
+// volume's compacted copy is byte-for-byte its current one.
+func TestCompactionSpaceNeededCoversNeedleFraming(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	for i := 1; i <= 100; i++ {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false); err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+	}
+	datSize, _, _ := v.FileStat()
+
+	dataBytes, _ := compactionSpaceNeeded(v, 0)
+	if dataBytes < int64(datSize) {
+		t.Fatalf("estimate %d below .dat size %d for an all-live volume: missing per-needle framing", dataBytes, datSize)
+	}
+}
+
+// disk_space_low is only reported when low space is the sole read-only cause.
+func TestCheckCompactVolumeDiskLowSoleCauseOnly(t *testing.T) {
+	dir := t.TempDir()
+	store := newSingleDirStore(t, dir)
+	defer store.Close()
+	const vid = needle.VolumeId(7)
+	require.NoError(t, store.AddVolume(vid, "", NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+
+	_, low, err := store.CheckCompactVolume(vid)
+	require.NoError(t, err)
+	require.False(t, low)
+
+	store.Locations[0].isDiskSpaceLow.Store(true)
+	_, low, err = store.CheckCompactVolume(vid)
+	require.NoError(t, err)
+	require.True(t, low)
+
+	require.NoError(t, store.MarkVolumeReadonly(vid, false, false))
+	_, low, err = store.CheckCompactVolume(vid)
+	require.NoError(t, err)
+	require.False(t, low)
+}
diff --git a/weed/storage/store_volume_report.go b/weed/storage/store_volume_report.go
index 059e78bed0..d74ef72abd 100644
--- a/weed/storage/store_volume_report.go
+++ b/weed/storage/store_volume_report.go
@@ -2,6 +2,7 @@ package storage
 
 import (
 	"sync"
+	"unique"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 )
@@ -14,11 +15,32 @@ type volumeReportKey struct {
 	volumeId uint32
 }
 
+// reportedIdentity is what naming a departure needs beyond the volume and disk
+// ids the key already holds. Volumes share very few distinct values here — one
+// per collection, placement, version, ttl and disk type in use — so entries
+// hold a handle to a shared copy, which keeps them small enough that a server
+// with millions of volumes is not paying for identity per volume.
+//
+// The handle is what keeps the shared copy alive, and dropping the last one
+// clears the entry. Handing out the value and letting the handle go, as
+// internVolumeString warns against, would have the next volume make a second
+// copy.
+type reportedIdentity struct {
+	collection       string
+	diskType         string
+	replicaPlacement uint32
+	version          uint32
+	ttl              uint32
+}
+
 // reportedVolume is what the master was told about one volume copy: the hash
-// that detects change, and enough identity to name the volume if it departs.
+// that detects change, the heartbeat pass that last found the copy held, and
+// the identity that names the volume if it departs. The departure message
+// itself is built on the way out, since almost no volume ever leaves.
 type reportedVolume struct {
-	hash  uint64
-	short *master_pb.VolumeShortInformationMessage
+	hash     uint64
+	pass     uint64
+	identity unique.Handle[reportedIdentity]
 }
 
 // volumeReportState remembers what the master was last told about each volume,
@@ -37,7 +59,10 @@ type volumeReportState struct {
 	// fullListGeneration counts requests for the whole list, so one arriving
 	// while a heartbeat is being built is not marked satisfied by it.
 	fullListGeneration uint64
-	lastReported       map[volumeReportKey]reportedVolume
+	// pass numbers heartbeats, so one can mark the copies it finds held without
+	// building a second map of them.
+	pass         uint64
+	lastReported map[volumeReportKey]reportedVolume
 }
 
 // reset drops everything known about the master's view.
@@ -63,61 +88,101 @@ func (s *volumeReportState) requestFullList() {
 	s.fullListGeneration++
 }
 
-// begin reports whether this heartbeat must carry the whole list, and the
-// request it answers.
-func (s *volumeReportState) begin() (full bool, generation uint64) {
+// begin opens a heartbeat: whether it must carry the whole list, the request it
+// answers, and the pass number that marks the copies it finds still held.
+func (s *volumeReportState) begin() (full bool, generation uint64, pass uint64) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	return s.fullListNeeded || !s.deltasAccepted, s.fullListGeneration
+	s.pass++
+	return s.fullListNeeded || !s.deltasAccepted, s.fullListGeneration, s.pass
 }
 
-// changed reports whether the master needs telling about this volume, given
-// what it was last told.
-func (s *volumeReportState) changed(m *master_pb.VolumeInformationMessage, hash uint64) bool {
+// record marks one volume copy as held by the heartbeat being built, and reports
+// whether the master needs telling about it. It updates the entry already held
+// rather than build a second map beside it, so a server whose volumes are quiet
+// allocates nothing per volume per heartbeat.
+func (s *volumeReportState) record(m *master_pb.VolumeInformationMessage, hash uint64, pass uint64) bool {
+	key := volumeReportKey{diskId: m.DiskId, volumeId: m.Id}
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	previous, known := s.lastReported[volumeReportKey{diskId: m.DiskId, volumeId: m.Id}]
-	return !known || previous.hash != hash
-}
-
-// departed returns the volumes the master was told about that the current
-// report no longer holds on any disk. A delta heartbeat says nothing through
-// silence, so these must be named or the master keeps counting them until a
-// digest mismatch buys it a full list — long enough for a busy cluster to run
-// its free-slot accounting dry. A volume that moved disks is still held, so it
-// is not a departure.
-func (s *volumeReportState) departed(current map[volumeReportKey]reportedVolume) []*master_pb.VolumeShortInformationMessage {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if len(s.lastReported) == 0 {
-		return nil
-	}
-	liveIds := make(map[uint32]bool, len(current))
-	for key := range current {
-		liveIds[key.volumeId] = true
-	}
-	var gone []*master_pb.VolumeShortInformationMessage
-	for key, prior := range s.lastReported {
-		if _, still := current[key]; still {
-			continue
+	if previous, known := s.lastReported[key]; known {
+		changed := previous.hash != hash
+		if changed {
+			previous.identity = identityOf(m)
 		}
-		if liveIds[key.volumeId] {
-			continue
-		}
-		gone = append(gone, prior.short)
+		previous.hash, previous.pass = hash, pass
+		s.lastReported[key] = previous
+		return changed
 	}
-	return gone
+	if s.lastReported == nil {
+		s.lastReported = make(map[volumeReportKey]reportedVolume)
+	}
+	s.lastReported[key] = reportedVolume{hash: hash, pass: pass, identity: identityOf(m)}
+	return true
 }
 
-// commit records what this heartbeat told the master. Volumes absent from
-// reported are forgotten, so one that comes back is reported again.
-func (s *volumeReportState) commit(reported map[volumeReportKey]reportedVolume, generation uint64) {
+func identityOf(m *master_pb.VolumeInformationMessage) unique.Handle[reportedIdentity] {
+	return unique.Make(reportedIdentity{
+		collection:       m.Collection,
+		diskType:         m.DiskType,
+		replicaPlacement: m.ReplicaPlacement,
+		version:          m.Version,
+		ttl:              m.Ttl,
+	})
+}
+
+func (held reportedVolume) toShortInformation(key volumeReportKey) *master_pb.VolumeShortInformationMessage {
+	identity := held.identity.Value()
+	return &master_pb.VolumeShortInformationMessage{
+		Id:               key.volumeId,
+		Collection:       identity.collection,
+		ReplicaPlacement: identity.replicaPlacement,
+		Version:          identity.version,
+		Ttl:              identity.ttl,
+		DiskType:         identity.diskType,
+		DiskId:           key.diskId,
+	}
+}
+
+// commit closes the heartbeat. Copies this pass did not find are forgotten, so
+// one that comes back is reported again, and those whose volume left the server
+// altogether are returned. A delta heartbeat says nothing through silence, so
+// they must be named or the master keeps counting them until a digest mismatch
+// buys it a full list — long enough for a busy cluster to run its free-slot
+// accounting dry. A volume that moved disks is still held, so it is not a
+// departure; a full list is already the whole truth, so it names none.
+func (s *volumeReportState) commit(pass uint64, generation uint64, full bool) []*master_pb.VolumeShortInformationMessage {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	s.lastReported = reported
 	// A request that arrived while this heartbeat was being built asked about a
 	// later state than it carries, so it stands.
 	if s.fullListGeneration == generation {
 		s.fullListNeeded = false
 	}
+	var goneKeys []volumeReportKey
+	for key, prior := range s.lastReported {
+		if prior.pass != pass {
+			goneKeys = append(goneKeys, key)
+		}
+	}
+	if len(goneKeys) == 0 {
+		return nil
+	}
+	goneIds := make(map[uint32]bool, len(goneKeys))
+	for _, key := range goneKeys {
+		goneIds[key.volumeId] = true
+	}
+	for key, prior := range s.lastReported {
+		if prior.pass == pass {
+			delete(goneIds, key.volumeId)
+		}
+	}
+	var gone []*master_pb.VolumeShortInformationMessage
+	for _, key := range goneKeys {
+		if !full && goneIds[key.volumeId] {
+			gone = append(gone, s.lastReported[key].toShortInformation(key))
+		}
+		delete(s.lastReported, key)
+	}
+	return gone
 }
diff --git a/weed/storage/store_volume_report_test.go b/weed/storage/store_volume_report_test.go
index 7a5697f164..6725c33844 100644
--- a/weed/storage/store_volume_report_test.go
+++ b/weed/storage/store_volume_report_test.go
@@ -1,6 +1,7 @@
 package storage
 
 import (
+	"sync"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
@@ -11,7 +12,7 @@ func reportingStore(t *testing.T, vids ...needle.VolumeId) *Store {
 	t.Helper()
 	store := newTestStore(t, 1)
 	for _, vid := range vids {
-		mountTestVolume(t, store.Locations[0], vid)
+		mountTestVolume(t, store.Locations[0], vid, "")
 	}
 	return store
 }
@@ -72,7 +73,7 @@ func TestHeartbeatReportsOnlyWhatChanged(t *testing.T) {
 	store.AcceptVolumeChanges()
 	store.CollectHeartbeat()
 
-	mountTestVolume(t, store.Locations[0], 3)
+	mountTestVolume(t, store.Locations[0], 3, "")
 	heartbeat := store.CollectHeartbeat()
 
 	if len(heartbeat.Volumes) != 0 {
@@ -128,7 +129,7 @@ func TestRemountedVolumeIsReportedAgain(t *testing.T) {
 	store.Locations[0].UnloadVolume(needle.VolumeId(1))
 	store.CollectHeartbeat()
 
-	mountTestVolume(t, store.Locations[0], 1)
+	mountTestVolume(t, store.Locations[0], 1, "")
 	heartbeat := store.CollectHeartbeat()
 	if len(heartbeat.ChangedVolumes) != 1 {
 		t.Errorf("a remounted volume was not reported: %v", heartbeat.ChangedVolumes)
@@ -143,12 +144,12 @@ func TestFullListRequestDuringCollectionSurvives(t *testing.T) {
 	store.AcceptVolumeChanges()
 	store.CollectHeartbeat()
 
-	full, generation := store.volumeReport.begin()
+	full, generation, pass := store.volumeReport.begin()
 	if full {
 		t.Fatal("expected to be past the first full list")
 	}
 	store.RequestFullVolumeList()
-	store.volumeReport.commit(map[volumeReportKey]reportedVolume{}, generation)
+	store.volumeReport.commit(pass, generation, full)
 
 	if heartbeat := store.CollectHeartbeat(); len(heartbeat.Volumes) != 2 {
 		t.Errorf("a resend request made during collection was lost: %d volumes sent", len(heartbeat.Volumes))
@@ -200,7 +201,7 @@ func TestFullListCarriesNoDepartures(t *testing.T) {
 // the master unregister a volume the same heartbeat re-adds.
 func TestMovedVolumeIsNotADeparture(t *testing.T) {
 	store := newTestStore(t, 2)
-	mountTestVolume(t, store.Locations[0], 1)
+	mountTestVolume(t, store.Locations[0], 1, "")
 	store.ResetVolumeReporting()
 	store.AcceptVolumeChanges()
 	store.CollectHeartbeat()
@@ -223,3 +224,80 @@ func TestMovedVolumeIsNotADeparture(t *testing.T) {
 		t.Errorf("the moved volume was not reported as changed: %v", heartbeat.ChangedVolumes)
 	}
 }
+
+// The entry held for a volume is updated in place rather than rebuilt, so a
+// change to what would name it as departed has to reach the entry too.
+func TestDepartureNamesTheVolumeAsItIsNow(t *testing.T) {
+	store := reportingStore(t, 1)
+	store.ResetVolumeReporting()
+	store.AcceptVolumeChanges()
+	store.CollectHeartbeat()
+
+	v, _ := store.Locations[0].FindVolume(needle.VolumeId(1))
+	v.SuperBlock.ReplicaPlacement = &super_block.ReplicaPlacement{SameRackCount: 1}
+	store.CollectHeartbeat()
+
+	store.Locations[0].UnloadVolume(needle.VolumeId(1))
+	heartbeat := store.CollectHeartbeat()
+	if len(heartbeat.DeletedVolumes) != 1 {
+		t.Fatalf("expected volume 1 to be named as departed, got %v", heartbeat.DeletedVolumes)
+	}
+	if got := heartbeat.DeletedVolumes[0].ReplicaPlacement; got != uint32(v.ReplicaPlacement.Byte()) {
+		t.Errorf("departure named replica placement %d, want %d", got, v.ReplicaPlacement.Byte())
+	}
+}
+
+// The ticker sends one heartbeat while the response goroutine sends another, so
+// two scans can overlap. Each marks the report state in place, so an
+// unserialized pair would forget what the other marked and tell the master
+// every volume it holds had departed.
+func TestOverlappingHeartbeatsNameNoDepartures(t *testing.T) {
+	store := reportingStore(t, 1, 2, 3, 4)
+	store.ResetVolumeReporting()
+	store.AcceptVolumeChanges()
+	store.CollectHeartbeat()
+
+	var wg sync.WaitGroup
+	departed := make([]int, 8)
+	for i := range departed {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			departed[i] = len(store.CollectHeartbeat().DeletedVolumes)
+		}(i)
+	}
+	wg.Wait()
+
+	for i, count := range departed {
+		if count != 0 {
+			t.Fatalf("overlapping heartbeat %d named %d volumes as departed while all were held", i, count)
+		}
+	}
+}
+
+// The departure message is built from what the entry held, not kept ready as a
+// message per volume, so everything the master matches on has to survive the
+// round trip through the entry.
+func TestDepartureCarriesTheVolumeIdentity(t *testing.T) {
+	store := newTestStore(t, 1)
+	v := mountTestVolume(t, store.Locations[0], 7, "pictures")
+	v.SuperBlock.ReplicaPlacement = &super_block.ReplicaPlacement{SameRackCount: 1}
+	v.SuperBlock.Ttl, _ = needle.ReadTTL("5m")
+	v.diskId = 3
+	store.ResetVolumeReporting()
+	store.AcceptVolumeChanges()
+	reported := store.CollectHeartbeat().Volumes[0]
+
+	store.Locations[0].UnloadVolume(needle.VolumeId(7))
+	heartbeat := store.CollectHeartbeat()
+	if len(heartbeat.DeletedVolumes) != 1 {
+		t.Fatalf("expected volume 7 to be named as departed, got %v", heartbeat.DeletedVolumes)
+	}
+	departed := heartbeat.DeletedVolumes[0]
+	if departed.Id != reported.Id || departed.DiskId != reported.DiskId ||
+		departed.Collection != reported.Collection || departed.DiskType != reported.DiskType ||
+		departed.ReplicaPlacement != reported.ReplicaPlacement ||
+		departed.Version != reported.Version || departed.Ttl != reported.Ttl {
+		t.Errorf("departure named %v, want it to match the volume as reported %v", departed, reported)
+	}
+}
diff --git a/weed/storage/super_block/super_block_read.go.go b/weed/storage/super_block/super_block_read.go.go
index dba1cba728..3ded9e8398 100644
--- a/weed/storage/super_block/super_block_read.go.go
+++ b/weed/storage/super_block/super_block_read.go.go
@@ -2,6 +2,7 @@ package super_block
 
 import (
 	"fmt"
+	"io"
 
 	"google.golang.org/protobuf/proto"
 
@@ -15,11 +16,12 @@ import (
 func ReadSuperBlock(datBackend backend.BackendStorageFile) (superBlock SuperBlock, err error) {
 
 	header := make([]byte, SuperBlockSize)
-	if n, e := datBackend.ReadAt(header, 0); e != nil {
-		if n != SuperBlockSize {
-			err = fmt.Errorf("cannot read volume %s super block: %v", datBackend.Name(), e)
-			return
+	if n, e := datBackend.ReadAt(header, 0); n != SuperBlockSize {
+		if e == nil {
+			e = io.ErrUnexpectedEOF
 		}
+		err = fmt.Errorf("cannot read volume %s super block: %v", datBackend.Name(), e)
+		return
 	}
 
 	superBlock.Version = needle.Version(header[0])
@@ -34,10 +36,17 @@ func ReadSuperBlock(datBackend backend.BackendStorageFile) (superBlock SuperBloc
 	if superBlock.ExtraSize > 0 {
 		// read more
 		extraData := make([]byte, int(superBlock.ExtraSize))
+		if n, e := datBackend.ReadAt(extraData, SuperBlockSize); n != len(extraData) {
+			if e == nil {
+				e = io.ErrUnexpectedEOF
+			}
+			err = fmt.Errorf("cannot read volume %s super block extra: %v", datBackend.Name(), e)
+			return
+		}
 		superBlock.Extra = &master_pb.SuperBlockExtra{}
 		err = proto.Unmarshal(extraData, superBlock.Extra)
 		if err != nil {
-			err = fmt.Errorf("cannot read volume %s super block extra: %v", datBackend.Name(), err)
+			err = fmt.Errorf("cannot unmarshal volume %s super block extra: %v", datBackend.Name(), err)
 			return
 		}
 	}
diff --git a/weed/storage/super_block/super_block_test.go b/weed/storage/super_block/super_block_test.go
index b952240ae9..6dd1d268c2 100644
--- a/weed/storage/super_block/super_block_test.go
+++ b/weed/storage/super_block/super_block_test.go
@@ -1,8 +1,16 @@
 package super_block
 
 import (
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 
+	"google.golang.org/protobuf/proto"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 )
 
@@ -23,3 +31,147 @@ func TestSuperBlockReadWrite(t *testing.T) {
 	}
 
 }
+
+func TestReadSuperBlockWithExtra(t *testing.T) {
+	rp, _ := NewReplicaPlacementFromByte(byte(001))
+	ttl, _ := needle.ReadTTL("15d")
+	s := &SuperBlock{
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: rp,
+		Ttl:              ttl,
+		Extra: &master_pb.SuperBlockExtra{
+			ErasureCoding: &master_pb.SuperBlockExtra_ErasureCoding{
+				Data:      10,
+				Parity:    4,
+				VolumeIds: []uint32{1, 2, 3},
+			},
+		},
+	}
+
+	datPath := filepath.Join(t.TempDir(), "1.dat")
+	if err := os.WriteFile(datPath, s.Bytes(), 0644); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(datPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	datBackend := backend.NewDiskFile(f)
+	defer datBackend.Close()
+
+	got, err := ReadSuperBlock(datBackend)
+	if err != nil {
+		t.Fatalf("ReadSuperBlock: %v", err)
+	}
+	if got.ExtraSize != s.ExtraSize {
+		t.Errorf("ExtraSize = %d, want %d", got.ExtraSize, s.ExtraSize)
+	}
+	if !proto.Equal(got.Extra, s.Extra) {
+		t.Errorf("Extra = %v, want %v", got.Extra, s.Extra)
+	}
+}
+
+// io.ReaderAt may return io.EOF on a full read; a remote backend can pass that through.
+type eofBackendStorageFile struct {
+	backend.DiskFile
+	data []byte
+}
+
+func (f *eofBackendStorageFile) ReadAt(p []byte, off int64) (n int, err error) {
+	if off >= int64(len(f.data)) {
+		return 0, io.EOF
+	}
+	return copy(p, f.data[off:]), io.EOF
+}
+
+func TestReadSuperBlockExtraFullReadWithEOF(t *testing.T) {
+	rp, _ := NewReplicaPlacementFromByte(byte(001))
+	ttl, _ := needle.ReadTTL("15d")
+	s := &SuperBlock{
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: rp,
+		Ttl:              ttl,
+		Extra: &master_pb.SuperBlockExtra{
+			ErasureCoding: &master_pb.SuperBlockExtra_ErasureCoding{
+				Data:      10,
+				Parity:    4,
+				VolumeIds: []uint32{1, 2, 3},
+			},
+		},
+	}
+
+	got, err := ReadSuperBlock(&eofBackendStorageFile{data: s.Bytes()})
+	if err != nil {
+		t.Fatalf("ReadSuperBlock: %v", err)
+	}
+	if !proto.Equal(got.Extra, s.Extra) {
+		t.Errorf("Extra = %v, want %v", got.Extra, s.Extra)
+	}
+}
+
+func TestReadSuperBlockTruncatedExtra(t *testing.T) {
+	rp, _ := NewReplicaPlacementFromByte(byte(001))
+	ttl, _ := needle.ReadTTL("15d")
+	s := &SuperBlock{
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: rp,
+		Ttl:              ttl,
+		Extra: &master_pb.SuperBlockExtra{
+			ErasureCoding: &master_pb.SuperBlockExtra_ErasureCoding{
+				Data:      10,
+				Parity:    4,
+				VolumeIds: []uint32{1, 2, 3},
+			},
+		},
+	}
+
+	data := s.Bytes()
+	datPath := filepath.Join(t.TempDir(), "1.dat")
+	if err := os.WriteFile(datPath, data[:len(data)-1], 0644); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(datPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	datBackend := backend.NewDiskFile(f)
+	defer datBackend.Close()
+
+	_, err = ReadSuperBlock(datBackend)
+	if err == nil || !strings.Contains(err.Error(), "cannot read") {
+		t.Fatalf("expected read error for truncated extra, got %v", err)
+	}
+}
+
+// s3_backend.ReadAt clears io.EOF even when it returns fewer bytes than requested.
+type shortReadBackendStorageFile struct {
+	backend.DiskFile
+	data []byte
+}
+
+func (f *shortReadBackendStorageFile) ReadAt(p []byte, off int64) (n int, err error) {
+	return copy(p, f.data[off:]), nil
+}
+
+func TestReadSuperBlockShortReadWithoutError(t *testing.T) {
+	rp, _ := NewReplicaPlacementFromByte(byte(001))
+	ttl, _ := needle.ReadTTL("15d")
+	s := &SuperBlock{
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: rp,
+		Ttl:              ttl,
+		Extra: &master_pb.SuperBlockExtra{
+			ErasureCoding: &master_pb.SuperBlockExtra_ErasureCoding{
+				Data:      10,
+				Parity:    4,
+				VolumeIds: []uint32{1, 2, 3},
+			},
+		},
+	}
+
+	data := s.Bytes()
+	_, err := ReadSuperBlock(&shortReadBackendStorageFile{data: data[:len(data)-1]})
+	if err == nil || !strings.Contains(err.Error(), "cannot read") {
+		t.Fatalf("expected read error for short extra read, got %v", err)
+	}
+}
diff --git a/weed/storage/types/volume_disk_type.go b/weed/storage/types/volume_disk_type.go
index 3a5e140554..a28d9137b2 100644
--- a/weed/storage/types/volume_disk_type.go
+++ b/weed/storage/types/volume_disk_type.go
@@ -16,6 +16,7 @@ const (
 	HardDriveType DiskType = ""
 	HddType                = "hdd"
 	SsdType                = "ssd"
+	NvmeType               = "nvme"
 )
 
 func ToDiskType(vt string) (diskType DiskType) {
diff --git a/weed/storage/types/volume_disk_type_test.go b/weed/storage/types/volume_disk_type_test.go
new file mode 100644
index 0000000000..f53ec8230f
--- /dev/null
+++ b/weed/storage/types/volume_disk_type_test.go
@@ -0,0 +1,21 @@
+package types
+
+import "testing"
+
+// The disk IO probe keys its per-disk-type settings by ReadableString, so a
+// disk configured as "hdd" has to come back out as "hdd" and not as the empty
+// string HardDriveType is stored as.
+func TestReadableStringRoundTrip(t *testing.T) {
+	for configured, want := range map[string]string{
+		"":          HddType,
+		"hdd":       HddType,
+		"HDD":       HddType,
+		"ssd":       SsdType,
+		"nvme":      NvmeType,
+		"nvme-gen5": "nvme-gen5",
+	} {
+		if got := ToDiskType(configured).ReadableString(); got != want {
+			t.Errorf("-disk %q: got %q, want %q", configured, got, want)
+		}
+	}
+}
diff --git a/weed/storage/vid_stamp.go b/weed/storage/vid_stamp.go
new file mode 100644
index 0000000000..5e304d87f3
--- /dev/null
+++ b/weed/storage/vid_stamp.go
@@ -0,0 +1,148 @@
+package storage
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+const vidStampFileName = ".vid_stamp"
+
+type vidStamp struct {
+	MaxVolumeId uint32 `json:"maxVolumeId"`
+	TopologyId  string `json:"topologyId,omitempty"`
+}
+
+func (s *Store) MaxVolumeIdSeen() needle.VolumeId {
+	return needle.VolumeId(s.maxVolumeIdSeen.Load())
+}
+
+func (s *Store) LastSeenTopologyId() string {
+	if v := s.lastSeenTopologyId.Load(); v != nil {
+		return v.(string)
+	}
+	return ""
+}
+
+// UpdateMaxVolumeIdSeen raises the server's persisted bound and stamps every
+// volume dir when it grows. Feeds: heartbeat echoes, AllocateVolume, local
+// volume and EC shard creation.
+func (s *Store) UpdateMaxVolumeIdSeen(vid needle.VolumeId) {
+	grew := false
+	for {
+		current := s.maxVolumeIdSeen.Load()
+		if current >= uint32(vid) {
+			break
+		}
+		if s.maxVolumeIdSeen.CompareAndSwap(current, uint32(vid)) {
+			grew = true
+			break
+		}
+	}
+	if s.vidStampReady.Load() && (grew || s.vidStampDirty.Load()) {
+		s.saveVidStamps()
+	}
+}
+
+func (s *Store) UpdateLastSeenTopologyId(id string) {
+	if id == "" || (s.LastSeenTopologyId() == id && !s.vidStampDirty.Load()) {
+		return
+	}
+	s.lastSeenTopologyId.Store(id)
+	if s.vidStampReady.Load() {
+		s.saveVidStamps()
+	}
+}
+
+// bootstrapMaxVolumeIdSeen seeds the bound from persisted stamps plus the max
+// of every volume and EC shard id on disk, so a server upgraded mid-incident
+// still reports a bound covering its own holdings.
+func (s *Store) bootstrapMaxVolumeIdSeen() {
+	var maxVid needle.VolumeId
+	for _, location := range s.Locations {
+		if stamp, err := readVidStamp(location.Directory); err == nil {
+			if needle.VolumeId(stamp.MaxVolumeId) > maxVid {
+				maxVid = needle.VolumeId(stamp.MaxVolumeId)
+			}
+			if stamp.TopologyId != "" && s.LastSeenTopologyId() == "" {
+				s.lastSeenTopologyId.Store(stamp.TopologyId)
+			}
+		}
+		location.volumesLock.RLock()
+		for vid := range location.volumes {
+			if vid > maxVid {
+				maxVid = vid
+			}
+		}
+		location.volumesLock.RUnlock()
+		location.ecVolumesLock.RLock()
+		for vid := range location.ecVolumes {
+			if vid > maxVid {
+				maxVid = vid
+			}
+		}
+		location.ecVolumesLock.RUnlock()
+	}
+	s.maxVolumeIdSeen.Store(uint32(maxVid))
+	s.vidStampReady.Store(true)
+	s.saveVidStamps()
+}
+
+func (s *Store) saveVidStamps() {
+	s.vidStampLock.Lock()
+	defer s.vidStampLock.Unlock()
+	stamp, err := json.Marshal(vidStamp{
+		MaxVolumeId: s.maxVolumeIdSeen.Load(),
+		TopologyId:  s.LastSeenTopologyId(),
+	})
+	if err != nil {
+		return
+	}
+	failed := false
+	for _, location := range s.Locations {
+		if err := writeVidStamp(location.Directory, stamp); err != nil {
+			glog.Warningf("write vid stamp in %s: %v", location.Directory, err)
+			failed = true
+		}
+	}
+	s.vidStampDirty.Store(failed)
+}
+
+func readVidStamp(dir string) (*vidStamp, error) {
+	data, err := os.ReadFile(filepath.Join(dir, vidStampFileName))
+	if err != nil {
+		return nil, err
+	}
+	stamp := &vidStamp{}
+	if err := json.Unmarshal(data, stamp); err != nil {
+		return nil, err
+	}
+	return stamp, nil
+}
+
+func writeVidStamp(dir string, stamp []byte) error {
+	tmp := filepath.Join(dir, vidStampFileName+".tmp")
+	f, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(stamp); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, filepath.Join(dir, vidStampFileName)); err != nil {
+		return err
+	}
+	return util.FsyncDir(dir)
+}
diff --git a/weed/storage/vid_stamp_test.go b/weed/storage/vid_stamp_test.go
new file mode 100644
index 0000000000..59e5251bc2
--- /dev/null
+++ b/weed/storage/vid_stamp_test.go
@@ -0,0 +1,94 @@
+package storage
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func newVidStampStore(t *testing.T, dir string) *Store {
+	t.Helper()
+	return NewStore(nil, "localhost", 8080, 18080, "http://localhost:8080", "store-id",
+		[]string{dir}, []int32{100}, []util.MinFreeSpace{{}}, "",
+		NeedleMapInMemory, []types.DiskType{types.HardDriveType}, nil, 3,
+		stats.DefaultDiskIOProbeConfig())
+}
+
+func TestVidStampWrittenOnBoundIncrease(t *testing.T) {
+	dir := t.TempDir()
+	store := newVidStampStore(t, dir)
+	defer store.Close()
+
+	store.UpdateMaxVolumeIdSeen(needle.VolumeId(42))
+
+	data, err := os.ReadFile(filepath.Join(dir, vidStampFileName))
+	if err != nil {
+		t.Fatalf("read stamp: %v", err)
+	}
+	stamp, err := readVidStamp(dir)
+	if err != nil {
+		t.Fatalf("parse stamp: %v", err)
+	}
+	if stamp.MaxVolumeId != 42 {
+		t.Fatalf("stamp max = %d, want 42", stamp.MaxVolumeId)
+	}
+	if len(data) == 0 {
+		t.Fatal("empty stamp")
+	}
+}
+
+func TestVidStampSurvivesRestart(t *testing.T) {
+	dir := t.TempDir()
+
+	store := newVidStampStore(t, dir)
+	store.UpdateMaxVolumeIdSeen(needle.VolumeId(42))
+	store.UpdateLastSeenTopologyId("cluster-a")
+	store.Close()
+
+	restarted := newVidStampStore(t, dir)
+	defer restarted.Close()
+	if got := restarted.MaxVolumeIdSeen(); got != needle.VolumeId(42) {
+		t.Fatalf("restored bound = %d, want 42", got)
+	}
+	if got := restarted.LastSeenTopologyId(); got != "cluster-a" {
+		t.Fatalf("restored topology id = %q, want cluster-a", got)
+	}
+}
+
+func TestVidStampMonotonic(t *testing.T) {
+	dir := t.TempDir()
+	store := newVidStampStore(t, dir)
+	defer store.Close()
+
+	store.UpdateMaxVolumeIdSeen(needle.VolumeId(10))
+	store.UpdateMaxVolumeIdSeen(needle.VolumeId(5))
+	if got := store.MaxVolumeIdSeen(); got != needle.VolumeId(10) {
+		t.Fatalf("bound regressed to %d, want 10", got)
+	}
+}
+
+func TestVidStampBootstrapFromVolumes(t *testing.T) {
+	dir := t.TempDir()
+
+	store := newVidStampStore(t, dir)
+	if err := store.AddVolume(17, "", NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0); err != nil {
+		t.Fatalf("add volume: %v", err)
+	}
+	store.Close()
+
+	// upgrading a pre-stamp dir: volumes exist but no stamp yet
+	if err := os.Remove(filepath.Join(dir, vidStampFileName)); err != nil {
+		t.Fatalf("remove stamp: %v", err)
+	}
+
+	restarted := newVidStampStore(t, dir)
+	defer restarted.Close()
+	if got := restarted.MaxVolumeIdSeen(); got != needle.VolumeId(17) {
+		t.Fatalf("bootstrapped bound = %d, want 17", got)
+	}
+}
diff --git a/weed/storage/volume.go b/weed/storage/volume.go
index cd06c64e42..d92a930309 100644
--- a/weed/storage/volume.go
+++ b/weed/storage/volume.go
@@ -1,10 +1,12 @@
 package storage
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path"
 	"strconv"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -16,6 +18,8 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 )
@@ -31,17 +35,36 @@ type Volume struct {
 	needleMapKind      NeedleMapKind
 	noWriteOrDelete    bool // if readonly, either noWriteOrDelete or noWriteCanDelete
 	noWriteCanDelete   bool // if readonly, either noWriteOrDelete or noWriteCanDelete
+	ioUnavailable      bool
+	ioUnavailableError string
 	noWriteLock        sync.RWMutex
 	hasRemoteFile      atomic.Bool // if the volume is tiered: data lives in a remote backend
 	MemoryMapMaxSizeMb uint32
 
 	super_block.SuperBlock
 
-	dataFileAccessLock    sync.RWMutex
-	superBlockAccessLock  sync.Mutex
-	asyncRequestsChan     chan *needle.AsyncRequest
-	lastModifiedTsSeconds uint64 // unix time in seconds
-	lastAppendAtNs        uint64 // unix time in nanoseconds
+	dataFileAccessLock sync.RWMutex
+	// Serializes a data-file mutation with the sync that makes it durable:
+	// write, delete, lifecycle and compaction paths hold it for their whole
+	// critical section, while the fsync itself runs with dataFileAccessLock
+	// released so readers of this volume do not wait on it.
+	dataFileSyncLock     sync.Mutex
+	superBlockAccessLock sync.Mutex
+
+	// The batch worker exists only once the volume takes a durable write. Most
+	// never do -- read-only, remote-tiered, or written without fsync -- and a
+	// parked worker costs its goroutine stack plus a 128-slot channel, which a
+	// server holding millions of volumes cannot pay for all of them.
+	asyncWorkerLock   sync.Mutex
+	asyncRequestsChan chan *needle.AsyncRequest
+	asyncWorkerClosed bool
+
+	lastModifiedTsSeconds    uint64         // unix time in seconds
+	lastAppendAtNs           uint64         // unix time in nanoseconds
+	lastWriteAppendAtNs      uint64         // AppendAtNs of the newest write; tombstones don't move it
+	lastWriteNeedleKey       types.NeedleId // the write behind the watermark
+	lastWriteDeleted         bool           // that write was deleted, so recovery has to rescan
+	keepLastModifiedTsOnLoad bool
 
 	lastCompactIndexOffset uint64
 	lastCompactRevision    uint16
@@ -55,88 +78,16 @@ type Volume struct {
 	location         *DiskLocation
 	diskId           uint32 // ID of this volume's disk in Store.Locations array
 
-	// lastIoError is the most recent EIO from a read/write/delete; cleared
-	// on the next successful or non-EIO op. lastIoErrorCount tracks
-	// consecutive EIOs so CollectHeartbeat can require a sustained failure
-	// before unmounting the replica — protects against a transient
-	// hardware/network blip hitting multiple replicas at once and
-	// stranding the only good copy.
-	//
-	// ioErrorQuarantined is sticky: once CollectHeartbeat sees the streak
-	// cross IoErrorTolerance it sets this and never clears it on its own.
-	// A subsequent successful read clears the streak counter but must NOT
-	// un-quarantine the volume — only MarkVolumeWritable does that, after
-	// an operator has decided the disk is healthy. Without the sticky
-	// bit, one good read between heartbeats would silently put a known-
-	// bad replica back into rotation.
-	//
-	// All four fields are guarded together so the heartbeat reader sees
-	// a consistent snapshot.
-	lastIoError        error
-	lastIoErrorCount   int32
-	ioErrorQuarantined bool
-	lastIoErrorLock    sync.RWMutex
-}
-
-// noteIoError records an EIO and increments the consecutive-error
-// counter. Caller has already verified errors.Is(err, syscall.EIO).
-func (v *Volume) noteIoError(err error) {
-	v.lastIoErrorLock.Lock()
-	defer v.lastIoErrorLock.Unlock()
-	v.lastIoError = err
-	v.lastIoErrorCount++
-}
-
-// clearIoError resets the EIO streak counter only. The sticky quarantine
-// bit set by CollectHeartbeat is intentionally left alone — recovery is
-// an operator decision via MarkVolumeWritable. Called on any successful
-// op or on a non-EIO error (which still breaks the EIO streak; only
-// sustained EIOs are diagnostic of a failing volume).
-func (v *Volume) clearIoError() {
-	v.lastIoErrorLock.Lock()
-	defer v.lastIoErrorLock.Unlock()
-	v.lastIoError = nil
-	v.lastIoErrorCount = 0
-}
-
-// resetIoErrorState clears both the EIO streak and the sticky quarantine
-// flag. Used by MarkVolumeWritable to rejoin a previously-quarantined
-// replica; if the disk is still bad, the next failed op re-arms the
-// streak.
-func (v *Volume) resetIoErrorState() {
-	v.lastIoErrorLock.Lock()
-	defer v.lastIoErrorLock.Unlock()
-	v.lastIoError = nil
-	v.lastIoErrorCount = 0
-	v.ioErrorQuarantined = false
-}
-
-// markIoQuarantined sets the sticky quarantine flag. Idempotent; safe
-// to call from CollectHeartbeat each pass while the volume remains
-// quarantined.
-func (v *Volume) markIoQuarantined() {
-	v.lastIoErrorLock.Lock()
-	defer v.lastIoErrorLock.Unlock()
-	v.ioErrorQuarantined = true
-}
-
-// getIoErrorState returns the latest EIO, the consecutive-EIO count,
-// and the sticky quarantine flag as one consistent snapshot.
-func (v *Volume) getIoErrorState() (error, int32, bool) {
-	v.lastIoErrorLock.RLock()
-	defer v.lastIoErrorLock.RUnlock()
-	return v.lastIoError, v.lastIoErrorCount, v.ioErrorQuarantined
+	IoErrorTracker
 }
 
 func NewVolume(dirname string, dirIdx string, collection string, id needle.VolumeId, needleMapKind NeedleMapKind, replicaPlacement *super_block.ReplicaPlacement, ttl *needle.TTL, preallocate int64, ver needle.Version, memoryMapMaxSizeMb uint32, ldbTimeout int64) (v *Volume, e error) {
 	// if replicaPlacement is nil, the superblock will be loaded from disk
-	v = &Volume{dir: dirname, dirIdx: dirIdx, Collection: collection, Id: id, MemoryMapMaxSizeMb: memoryMapMaxSizeMb,
-		asyncRequestsChan: make(chan *needle.AsyncRequest, 128)}
+	v = &Volume{dir: dirname, dirIdx: dirIdx, Collection: collection, Id: id, MemoryMapMaxSizeMb: memoryMapMaxSizeMb}
 	v.SuperBlock = super_block.SuperBlock{ReplicaPlacement: replicaPlacement, Ttl: ttl}
 	v.needleMapKind = needleMapKind
 	v.ldbTimeout = ldbTimeout
 	e = v.load(true, true, needleMapKind, preallocate, ver)
-	v.startWorker()
 	return
 }
 
@@ -183,6 +134,8 @@ func (v *Volume) FileName(ext string) (fileName string) {
 // gone. A no-op when the index already lives in newIdxDir. A derived .ldb is
 // not moved: the reload rebuilds it in newIdxDir from the .idx.
 func (v *Volume) RelocateIndexTo(newIdxDir string) error {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 
@@ -235,6 +188,35 @@ func (v *Volume) Version() needle.Version {
 	return v.SuperBlock.Version
 }
 
+// UpdateReplicaPlacement records rp in the live volume — the in-memory .vif
+// copy and the superblock — and rewrites the .dat header when the data file
+// is local. Keeps a mounted volume consistent with the .vif the caller just
+// configured on disk, so heartbeats and later compactions report and rewrite
+// the same placement.
+func (v *Volume) UpdateReplicaPlacement(rp *super_block.ReplicaPlacement) error {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
+	v.dataFileAccessLock.Lock()
+	defer v.dataFileAccessLock.Unlock()
+	v.superBlockAccessLock.Lock()
+	defer v.superBlockAccessLock.Unlock()
+	v.volumeInfoRWLock.Lock()
+	defer v.volumeInfoRWLock.Unlock()
+
+	v.SuperBlock.ReplicaPlacement = rp
+	if v.volumeInfo != nil {
+		v.volumeInfo.Replication = rp.String()
+	}
+	diskFile, ok := v.DataBackend.(*backend.DiskFile)
+	if !ok {
+		return nil // remote-tiered: the .vif carries the placement
+	}
+	if _, err := diskFile.WriteAt(v.SuperBlock.Bytes(), 0); err != nil {
+		return fmt.Errorf("volume %d failed to write superblock: %v", v.Id, err)
+	}
+	return diskFile.Sync()
+}
+
 func (v *Volume) FileStat() (datSize uint64, idxSize uint64, modTime time.Time) {
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
@@ -251,6 +233,22 @@ func (v *Volume) FileStat() (datSize uint64, idxSize uint64, modTime time.Time)
 	return // -1 causes integer overflow and the volume to become unwritable.
 }
 
+// datAllocatedSize returns the disk space held by the .dat file, or 0 when it is unknown.
+func (v *Volume) datAllocatedSize() uint64 {
+	v.dataFileAccessLock.RLock()
+	defer v.dataFileAccessLock.RUnlock()
+
+	df, ok := v.DataBackend.(*backend.DiskFile)
+	if !ok {
+		return 0
+	}
+	fi, err := df.File.Stat()
+	if err != nil {
+		return 0
+	}
+	return allocatedSize(fi)
+}
+
 func (v *Volume) ContentSize() uint64 {
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
@@ -283,6 +281,17 @@ func (v *Volume) doIsEmpty() (bool, error) {
 	return true, nil
 }
 
+// doIsGarbage reports whether every byte ever written is already deleted —
+// the same all-garbage state vacuum measures, checked against the byte
+// counters because the count counters drift on reload.
+func (v *Volume) doIsGarbage() bool {
+	if v.nm == nil {
+		return false
+	}
+	contentSize := v.nm.ContentSize()
+	return contentSize > 0 && v.nm.DeletedSize() >= contentSize
+}
+
 func (v *Volume) DeletedSize() uint64 {
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
@@ -333,32 +342,41 @@ func (v *Volume) DiskType() types.DiskType {
 }
 
 func (v *Volume) SyncToDisk() {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
-	if v.nm != nil {
-		if err := v.nm.Sync(); err != nil {
+	// Flush with the access lock dropped so readers are not stalled by the
+	// fsync; writers and file swaps stay excluded by dataFileSyncLock.
+	nm, backend := v.nm, v.DataBackend
+	v.dataFileAccessLock.Unlock()
+	if nm != nil {
+		if err := nm.Sync(); err != nil {
 			glog.Warningf("Volume Close fail to sync volume idx %d", v.Id)
 		}
 	}
-	if v.DataBackend != nil {
-		if err := v.DataBackend.Sync(); err != nil {
+	if backend != nil {
+		if err := backend.Sync(); err != nil {
 			glog.Warningf("Volume Close fail to sync volume %d", v.Id)
 		}
 	}
+	v.dataFileAccessLock.Lock()
 }
 
 // Close cleanly shuts down this volume
 func (v *Volume) Close() {
 	// Wait for any in-progress compaction to finish and claim the flag so no
 	// new compaction can start. This must happen BEFORE acquiring
-	// dataFileAccessLock to avoid deadlocking with CommitCompact which holds
-	// the flag while waiting for the lock.
+	// dataFileSyncLock and dataFileAccessLock to avoid deadlocking with
+	// CommitCompact which holds the flag while waiting for the locks.
 	for !v.isCompactionInProgress.CompareAndSwap(false, true) {
 		time.Sleep(521 * time.Millisecond)
 		glog.Warningf("Volume Close wait for compaction %d", v.Id)
 	}
 	defer v.isCompactionInProgress.Store(false)
 
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 
@@ -374,6 +392,8 @@ func (v *Volume) Close() {
 // stale-false flag would make doDeleteRequest skip the new .dat's tombstones and
 // disable the phantom-.dat guard.
 func (v *Volume) SwapDataBackend(newBackend backend.BackendStorageFile, hasRemoteFile bool) {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 	v.swapDataBackendLocked(newBackend, hasRemoteFile)
@@ -436,6 +456,25 @@ func (v *Volume) expired(contentSize uint64, volumeSizeLimit uint64) bool {
 	return false
 }
 
+// ExpireAtSec is when this volume's data becomes garbage, counted from its last
+// write. Counting from the current time instead let every .vif rewrite -- a
+// read-only mark, a tier upload, an EC encode -- hand an already expiring volume
+// another full TTL. Zero when the volume has no TTL.
+func (v *Volume) ExpireAtSec() uint64 {
+	if v.Ttl == nil {
+		return 0
+	}
+	ttlSeconds := v.Ttl.ToSeconds()
+	if ttlSeconds == 0 {
+		return 0
+	}
+	lastWriteSec := v.lastModifiedTsSeconds
+	if lastWriteSec == 0 {
+		lastWriteSec = uint64(time.Now().Unix())
+	}
+	return lastWriteSec + ttlSeconds
+}
+
 // wait either maxDelayMinutes or 10% of ttl minutes
 func (v *Volume) expiredLongEnough(maxDelayMinutes uint32) bool {
 	if v.Ttl == nil || v.Ttl.Minutes() == 0 {
@@ -455,7 +494,6 @@ func (v *Volume) expiredLongEnough(maxDelayMinutes uint32) bool {
 func (v *Volume) collectStatus() (maxFileKey types.NeedleId, datFileSize int64, modTime time.Time, fileCount, deletedCount, deletedSize uint64, ok bool) {
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
-	glog.V(4).Infof("collectStatus volume %d", v.Id)
 
 	if v.nm == nil || v.DataBackend == nil {
 		return
@@ -472,7 +510,10 @@ func (v *Volume) collectStatus() (maxFileKey types.NeedleId, datFileSize int64,
 	return
 }
 
-func (v *Volume) ToVolumeInformationMessage() (types.NeedleId, *master_pb.VolumeInformationMessage) {
+// ToVolumeInformationMessage fills into with what the master is told about this
+// volume, allocating a message when into is nil. A heartbeat that keeps only
+// the volumes it reports fills the same message for all the rest.
+func (v *Volume) ToVolumeInformationMessage(into *master_pb.VolumeInformationMessage) (types.NeedleId, *master_pb.VolumeInformationMessage) {
 
 	maxFileKey, volumeSize, modTime, fileCount, deletedCount, deletedSize, ok := v.collectStatus()
 
@@ -485,7 +526,7 @@ func (v *Volume) ToVolumeInformationMessage() (types.NeedleId, *master_pb.Volume
 	// disk-path operation can ever succeed. Skip remote-tiered volumes, whose .dat
 	// legitimately lives in cloud storage. Only a present .dat is cached for 30s; a
 	// missing one is re-checked every heartbeat so the volume stays suppressed until
-	// the file returns. See github.com/seaweedfs/seaweedfs/issues/10004
+	// the file returns.
 	if fileCount > 0 && !v.HasRemoteFile() {
 		const diskCheckIntervalNs = 30 * int64(time.Second)
 		now := time.Now().UnixNano()
@@ -498,23 +539,24 @@ func (v *Volume) ToVolumeInformationMessage() (types.NeedleId, *master_pb.Volume
 		}
 	}
 
-	volumeInfo := &master_pb.VolumeInformationMessage{
-		Id:               uint32(v.Id),
-		Size:             uint64(volumeSize),
-		Collection:       v.Collection,
-		FileCount:        fileCount,
-		DeleteCount:      deletedCount,
-		DeletedByteCount: deletedSize,
-		ReadOnly:         v.IsReadOnly(),
-		ReplicaPlacement: uint32(v.ReplicaPlacement.Byte()),
-		Version:          uint32(v.Version()),
-		Ttl:              v.Ttl.ToUint32(),
-		CompactRevision:  uint32(v.SuperBlock.CompactionRevision),
-		ModifiedAtSecond: modTime.Unix(),
-		DiskType:         string(v.location.DiskType),
-		DiskId:           v.diskId,
+	volumeInfo := into
+	if volumeInfo == nil {
+		volumeInfo = &master_pb.VolumeInformationMessage{}
 	}
-
+	volumeInfo.Id = uint32(v.Id)
+	volumeInfo.Size = uint64(volumeSize)
+	volumeInfo.Collection = v.Collection
+	volumeInfo.FileCount = fileCount
+	volumeInfo.DeleteCount = deletedCount
+	volumeInfo.DeletedByteCount = deletedSize
+	volumeInfo.ReadOnly, _, volumeInfo.ReadOnlyCanDelete, _ = v.ReadOnlyReasons()
+	volumeInfo.ReplicaPlacement = uint32(v.ReplicaPlacement.Byte())
+	volumeInfo.Version = uint32(v.Version())
+	volumeInfo.Ttl = v.Ttl.ToUint32()
+	volumeInfo.CompactRevision = uint32(v.SuperBlock.CompactionRevision)
+	volumeInfo.ModifiedAtSecond = modTime.Unix()
+	volumeInfo.DiskType = string(v.location.DiskType)
+	volumeInfo.DiskId = v.diskId
 	volumeInfo.RemoteStorageName, volumeInfo.RemoteStorageKey = v.RemoteStorageNameKey()
 
 	return maxFileKey, volumeInfo
@@ -531,14 +573,117 @@ func (v *Volume) RemoteStorageNameKey() (storageName, storageKey string) {
 }
 
 func (v *Volume) IsReadOnly() bool {
-	v.noWriteLock.RLock()
-	defer v.noWriteLock.RUnlock()
-	return v.noWriteOrDelete || v.noWriteCanDelete || v.location.isDiskSpaceLow.Load()
+	readOnly, _, _, _ := v.ReadOnlyReasons()
+	return readOnly
 }
 
-func (v *Volume) PersistReadOnly(readOnly bool) {
-	v.volumeInfoRWLock.RLock()
-	defer v.volumeInfoRWLock.RUnlock()
+// ReadOnlyReasons reports whether the volume refuses writes and why, reading the
+// flags once so the reasons cannot disagree with the verdict.
+func (v *Volume) ReadOnlyReasons() (readOnly, noWriteOrDelete, noWriteCanDelete, diskSpaceLow bool) {
+	v.noWriteLock.RLock()
+	noWriteOrDelete, noWriteCanDelete = v.noWriteOrDelete, v.noWriteCanDelete
+	if v.ioUnavailable {
+		noWriteOrDelete = true
+	}
+	v.noWriteLock.RUnlock()
+	// The location is attached when the volume joins a disk location, which is
+	// after NewVolume hands it back.
+	diskSpaceLow = v.location != nil && v.location.isDiskSpaceLow.Load()
+	return noWriteOrDelete || noWriteCanDelete || diskSpaceLow, noWriteOrDelete, noWriteCanDelete, diskSpaceLow
+}
+
+var errVolumeUnavailable = errors.New("volume unavailable")
+
+func (v *Volume) UnavailableError() error {
+	v.noWriteLock.RLock()
+	unavailable := v.ioUnavailable
+	reason := v.ioUnavailableError
+	v.noWriteLock.RUnlock()
+	if !unavailable {
+		return nil
+	}
+	if reason == "" {
+		return fmt.Errorf("volume %d is unavailable: %w", v.Id, errVolumeUnavailable)
+	}
+	return fmt.Errorf("volume %d is unavailable: %s: %w", v.Id, reason, errVolumeUnavailable)
+}
+
+func (v *Volume) markIoUnavailable(err error) {
+	v.noWriteLock.Lock()
+	v.noWriteOrDelete = true
+	v.ioUnavailable = true
+	v.ioUnavailableError = err.Error()
+	v.noWriteLock.Unlock()
+	v.markIoQuarantined()
+
+	if persistErr := v.persistUnavailable(err.Error()); persistErr != nil {
+		glog.Warningf("volume %d: failed to persist unavailable marker: %v", v.Id, persistErr)
+	}
+	if v.volumeInfo != nil {
+		if persistErr := v.PersistReadOnly(true, false); persistErr != nil {
+			glog.Warningf("volume %d: failed to persist unavailable state: %v", v.Id, persistErr)
+		}
+	}
+	glog.Errorf("volume %d entered unavailable state after failed recovery: %v", v.Id, err)
+}
+
+// persistUnavailable records the failed-recovery state so a reload keeps the
+// volume unavailable instead of serving an unverified .dat/index pair.
+func (v *Volume) persistUnavailable(reason string) error {
+	marker := v.FileName(".unavailable")
+	f, err := os.OpenFile(marker, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return err
+	}
+	if _, err := f.WriteString(reason); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	return util.FsyncDir(v.dir)
+}
+
+// restoreUnavailable re-arms the in-memory state the .unavailable marker
+// recorded. The marker is deleted manually once the volume pair is verified.
+func (v *Volume) restoreUnavailable() {
+	reason, err := os.ReadFile(v.FileName(".unavailable"))
+	if err != nil {
+		return
+	}
+	v.noWriteLock.Lock()
+	v.noWriteOrDelete = true
+	v.ioUnavailable = true
+	v.ioUnavailableError = strings.TrimSpace(string(reason))
+	v.noWriteLock.Unlock()
+	v.markIoQuarantined()
+	glog.Warningf("volume %d is unavailable: %s", v.Id, v.ioUnavailableError)
+}
+
+func (v *Volume) PersistReadOnly(readOnly bool, canDelete bool) error {
+	v.volumeInfoRWLock.Lock()
+	defer v.volumeInfoRWLock.Unlock()
+	prevReadOnly := v.volumeInfo.ReadOnly
+	prevReadOnlyCanDelete := v.volumeInfo.ReadOnlyCanDelete
 	v.volumeInfo.ReadOnly = readOnly
-	v.SaveVolumeInfo()
+	v.volumeInfo.ReadOnlyCanDelete = readOnly && canDelete
+	if err := v.SaveVolumeInfo(); err != nil {
+		// A pre-commit failure (write/sync/close/rename) leaves the old
+		// .vif intact, so roll back in-memory state to match it. A
+		// NotCrashDurableError means the rename already committed the
+		// new mode to disk; rolling back would split in-memory state
+		// from the durable file, so keep the new state and propagate.
+		var ndErr *volume_info.NotCrashDurableError
+		if !errors.As(err, &ndErr) {
+			v.volumeInfo.ReadOnly = prevReadOnly
+			v.volumeInfo.ReadOnlyCanDelete = prevReadOnlyCanDelete
+		}
+		return fmt.Errorf("persist volume read-only state: %w", err)
+	}
+	return nil
 }
diff --git a/weed/storage/volume_allocated_unix.go b/weed/storage/volume_allocated_unix.go
new file mode 100644
index 0000000000..df267efd83
--- /dev/null
+++ b/weed/storage/volume_allocated_unix.go
@@ -0,0 +1,18 @@
+//go:build !windows
+
+package storage
+
+import (
+	"os"
+	"syscall"
+)
+
+// allocatedSize reports the bytes the filesystem holds for a file, which
+// exceeds its size when the file was preallocated with FALLOC_FL_KEEP_SIZE.
+func allocatedSize(fi os.FileInfo) uint64 {
+	st, ok := fi.Sys().(*syscall.Stat_t)
+	if !ok {
+		return 0
+	}
+	return uint64(st.Blocks) * 512
+}
diff --git a/weed/storage/volume_allocated_windows.go b/weed/storage/volume_allocated_windows.go
new file mode 100644
index 0000000000..6867c1ede9
--- /dev/null
+++ b/weed/storage/volume_allocated_windows.go
@@ -0,0 +1,10 @@
+//go:build windows
+
+package storage
+
+import "os"
+
+// allocatedSize is unknown on Windows, where volume files are never preallocated.
+func allocatedSize(fi os.FileInfo) uint64 {
+	return 0
+}
diff --git a/weed/storage/volume_async_worker_test.go b/weed/storage/volume_async_worker_test.go
new file mode 100644
index 0000000000..7b29f3e113
--- /dev/null
+++ b/weed/storage/volume_async_worker_test.go
@@ -0,0 +1,65 @@
+package storage
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/stretchr/testify/require"
+)
+
+func newWorkerTestVolume(t *testing.T) *Volume {
+	t.Helper()
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	t.Cleanup(v.Close)
+	return v
+}
+
+// A server holding millions of volumes pays for whatever every mount costs, so
+// the batch worker and its channel may not exist until a durable write needs
+// them.
+func TestMountingAVolumeStartsNoBatchWorker(t *testing.T) {
+	v := newWorkerTestVolume(t)
+	require.Nil(t, v.asyncRequestsChan, "mounting a volume started a batch worker nothing had asked for")
+
+	_, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false)
+	require.NoError(t, err)
+	require.Nil(t, v.asyncRequestsChan, "a write that did not ask for fsync started a batch worker")
+}
+
+func TestDurableWriteStartsTheBatchWorkerOnce(t *testing.T) {
+	v := newWorkerTestVolume(t)
+
+	_, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, true, false)
+	require.NoError(t, err)
+	started := v.asyncRequestsChan
+	require.NotNil(t, started, "a durable write did not start the batch worker")
+
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(2), true, true, false)
+	require.NoError(t, err)
+	require.Equal(t, started, v.asyncRequestsChan, "a second durable write replaced the worker's channel")
+}
+
+// Destroy closes the channel. A write arriving after that has to fall back to
+// the inline path rather than queue onto a worker that has gone, and that path
+// has to fail rather than crash on what Destroy left behind.
+func TestDurableWriteAfterDestroyWritesInline(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, true, false)
+	require.NoError(t, err)
+
+	require.NoError(t, v.Destroy(false, false, false))
+	require.Nil(t, v.asyncRequestsChan)
+	require.False(t, v.asyncRequestAppend(needle.NewAsyncRequest(newRandomNeedle(2), true)))
+
+	// The inline path it falls back to has to refuse the write, not dereference
+	// the needle map and backend Destroy left nil.
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(2), true, true, false)
+	require.Error(t, err)
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(3), true, false, false)
+	require.Error(t, err)
+}
diff --git a/weed/storage/volume_backup.go b/weed/storage/volume_backup.go
index d56b49878d..80377b34c9 100644
--- a/weed/storage/volume_backup.go
+++ b/weed/storage/volume_backup.go
@@ -68,6 +68,10 @@ update needle map when receiving new .dat bytes. But seems not necessary now.)
 
 func (v *Volume) IncrementalBackup(volumeServer pb.ServerAddress, grpcDialOption grpc.DialOption) error {
 
+	if err := v.UnavailableError(); err != nil {
+		return err
+	}
+
 	startFromOffset, _, _ := v.FileStat()
 	appendAtNs, err := v.findLastAppendAtNs()
 	if err != nil {
@@ -96,6 +100,9 @@ func (v *Volume) IncrementalBackup(volumeServer pb.ServerAddress, grpcDialOption
 				}
 			}
 
+			if err := v.UnavailableError(); err != nil {
+				return err
+			}
 			n, writeErr := v.DataBackend.WriteAt(resp.FileContent, writeOffset)
 			if writeErr != nil {
 				return writeErr
diff --git a/weed/storage/volume_checking.go b/weed/storage/volume_checking.go
index c758152fbf..e13dbfbbe2 100644
--- a/weed/storage/volume_checking.go
+++ b/weed/storage/volume_checking.go
@@ -1,14 +1,17 @@
 package storage
 
 import (
+	"errors"
 	"fmt"
 	"io"
 	"os"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/idx"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle_map"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/seaweedfs/seaweedfs/weed/util"
@@ -17,7 +20,7 @@ import (
 // openIndex returns a file descriptor for the volume's index, and the index size in bytes.
 func (v *Volume) openIndex() (*os.File, int64, error) {
 	idxFileName := v.FileName(".idx")
-	idxFile, err := os.OpenFile(idxFileName, os.O_RDONLY, 0644)
+	idxFile, err := backend.OpenVolumeFile(idxFileName, os.O_RDONLY)
 	if err != nil {
 		return nil, 0, fmt.Errorf("failed to open IDX file %s for volume %v: %v", idxFileName, v.Id, err)
 	}
@@ -84,21 +87,18 @@ func (v *Volume) scrubVolumeData(idxFile *os.File, idxFileSize int64) (int64, []
 		if offset.IsZero() && size.IsDeleted() {
 			return nil
 		}
+		physicalSize := types.Size(size.Raw())
 		// compute the actual size of the needle in disk, including needle header, body and alignment padding.
-		actualSize := int64(needle.GetActualSize(size, version))
-
-		// TODO: Needle.ReadData() is currently broken for deleted files, which have a types.Size < 0. Fix
-		// so deleted needles get properly scrubbed as well.
-		// TODO: idx.WalkIndexFile() returns a size -1 (and actual size of 32 bytes) for deleted needles. We
-		// want to scrub deleted needles whenever possible.
-		if size.IsDeleted() {
-			totalRead += actualSize
-			return nil
-		}
+		actualSize := int64(needle.GetActualSize(physicalSize, version))
 
 		n := needle.Needle{}
-		if err := n.ReadData(v.DataBackend, offset.ToActualOffset(), size, version); err != nil {
+		if err := n.ReadData(v.DataBackend, offset.ToActualOffset(), physicalSize, version); err != nil {
 			errs = append(errs, fmt.Errorf("failed to read needle %d on volume %d: %v", id, v.Id, err))
+		} else if n.Id != id {
+			// The data CRC does not cover the header: a damaged needle id still
+			// reads clean while every live-needle lookup on this replica keeps
+			// finding the index key here.
+			errs = append(errs, fmt.Errorf("index key %v does not match needle's Id %v on volume %d", id, n.Id, v.Id))
 		}
 
 		totalRead += actualSize
@@ -145,10 +145,28 @@ func CheckVolumeDataIntegrity(v *Volume, indexFile *os.File) (lastAppendAtNs uin
 		return 0, fmt.Errorf("verifyIndexFileIntegrity %s failed: %v", indexFile.Name(), err)
 	}
 	if indexSize == 0 {
-		return 0, nil
+		if v.noWriteOrDelete {
+			return 0, nil
+		}
+		// An empty index can hide writes a crash stranded in the .dat: the
+		// writable index loader creates the .idx before the first needle
+		// append, so a crash after that append leaves a volume whose data
+		// nothing indexes — and every check below skips an empty index. The
+		// same repair runs from the first record past the superblock; a tail
+		// it cannot explain fails the check, since an unaccounted-for .dat
+		// must not load writable either.
+		if _, _, err = repairUnindexedDatTail(v, indexFile, 0, -1); err != nil {
+			return 0, fmt.Errorf("CheckVolumeDataIntegrity %s: repair unindexed .dat tail: %v", indexFile.Name(), err)
+		}
+		if indexSize, err = verifyIndexFileIntegrity(indexFile); err != nil {
+			return 0, fmt.Errorf("verifyIndexFileIntegrity %s after re-indexing failed: %v", indexFile.Name(), err)
+		}
+		if indexSize == 0 {
+			return 0, nil
+		}
 	}
 	// The deeper-than-tail structural check (every (offset + actual size)
-	// fits inside .dat — issue #8928) lives in volume.load(): it reads
+	// fits inside .dat) lives in volume.load(): it reads
 	// MaximumNeedleEnd from the needle map after the load walk, so we don't
 	// need a redundant linear scan of the .idx here.
 
@@ -158,7 +176,7 @@ func CheckVolumeDataIntegrity(v *Volume, indexFile *os.File) (lastAppendAtNs uin
 	// puts the highest-key needle last instead of the .dat-tail needle. Picking
 	// the last file-position entry there compares a mid-file needle's tail
 	// against the full .dat size and falsely flips the volume read-only on every
-	// load (issue #9688).
+	// load.
 	tailEntryPos, err := findDatTailEntryOffset(v, indexFile, indexSize)
 	if err != nil {
 		return 0, fmt.Errorf("CheckVolumeDataIntegrity %s: %v", indexFile.Name(), err)
@@ -168,6 +186,32 @@ func CheckVolumeDataIntegrity(v *Volume, indexFile *os.File) (lastAppendAtNs uin
 		return 0, nil
 	}
 
+	// A crash between appending a needle to the .dat and appending its entry to
+	// the .idx leaves a .dat tail no index entry covers. Re-index the complete
+	// needles in it and cut an incomplete remainder before the check below,
+	// which would otherwise load the volume read-only. Only a volume that is
+	// about to load writable is repaired; a read-only one is left as it is.
+	// A repair that fails for any other reason than an unexplained tail (a
+	// read, write, truncate or sync error) fails the check, so the volume
+	// loads read-only instead of writable on a repair that may not be on disk.
+	if !v.noWriteOrDelete {
+		reindexed, _, err := repairUnindexedDatTail(v, indexFile, indexSize, tailEntryPos)
+		if err != nil {
+			if !errors.Is(err, errTailNotTorn) {
+				return 0, fmt.Errorf("CheckVolumeDataIntegrity %s: repair unindexed .dat tail: %v", indexFile.Name(), err)
+			}
+			glog.Warningf("volume %d: unindexed .dat tail not repaired: %v", v.Id, err)
+		}
+		if reindexed > 0 {
+			if indexSize, err = verifyIndexFileIntegrity(indexFile); err != nil {
+				return 0, fmt.Errorf("verifyIndexFileIntegrity %s after re-indexing failed: %v", indexFile.Name(), err)
+			}
+			if tailEntryPos, err = findDatTailEntryOffset(v, indexFile, indexSize); err != nil {
+				return 0, fmt.Errorf("CheckVolumeDataIntegrity %s: %v", indexFile.Name(), err)
+			}
+		}
+	}
+
 	if lastAppendAtNs, err = doCheckAndFixVolumeData(v, indexFile, tailEntryPos); err != nil {
 		return lastAppendAtNs, fmt.Errorf("CheckVolumeDataIntegrity %s failed: %v", indexFile.Name(), err)
 	}
@@ -217,14 +261,240 @@ func findDatTailEntryOffset(v *Volume, indexFile *os.File, indexSize int64) (int
 }
 
 // needleDiskEnd returns the byte offset just past the needle's on-disk record.
-// Deletion tombstones carry TombstoneFileSize (-1) in the .idx but are written
-// with DataSize=0, so their on-disk record is sized as 0.
 func needleDiskEnd(offset types.Offset, size types.Size, version needle.Version) int64 {
-	onDiskSize := size
-	if size.IsDeleted() {
-		onDiskSize = 0
+	return offset.ToActualOffset() + needle.GetActualSize(types.Size(size.Raw()), version)
+}
+
+// errTailNotTorn marks a .dat tail that is not the result of an interrupted
+// append; the volume keeps loading read-only.
+var errTailNotTorn = errors.New("not a torn tail")
+
+// repairUnindexedDatTail re-indexes the complete needles a crash left past the
+// last indexed needle of a local version 3 volume, cuts an incomplete
+// remainder, and returns how many needles it indexed and how many bytes it cut.
+//
+// A write appends the needle to the .dat, then its entry to the .idx, then
+// answers the client. A process killed between the first two steps leaves a
+// needle, or part of one, past the end of the needle at the highest indexed
+// offset; a crash after the very first append leaves it past an index with
+// no entry at all, which tailEntryPos < 0 marks: the walk then starts at the
+// first record past the superblock with no anchor needle and no append
+// timestamp to compare against. After a power loss the order on disk is
+// whatever the page cache
+// flushed: a complete needle can survive whose .idx entry did not, although
+// the client was answered. So a complete needle is never dropped: every
+// complete needle in the tail (its header, body, checksum, timestamp and
+// padding inside the file, its CRC valid, its append timestamp later than the
+// needle before it) gets the .idx entry the volume server would have written,
+// in .dat order; the .dat is synced first so the rows never become durable
+// ahead of the records they name, and the .idx is synced after. A size 0
+// record is indexed at size 0,
+// the same live entry the write path publishes for a write with no data. A
+// delete appends the identical record, so a recovered size 0 record can also
+// be a delete whose key then reads back as an empty object rather than
+// not-found -- the two cannot be told apart, and resurrecting an empty
+// placeholder beats a wrong tombstone, which drops an acknowledged write's
+// object entirely. Only what follows the last complete
+// needle and is itself incomplete is cut: fewer bytes than a header, a record
+// running past the end of the file, or a last record whose bytes are damaged
+// (its CRC fails or its body does not parse); the .dat is synced after the
+// cut. A record that cannot be read is not cut: a read error is returned and
+// nothing is changed.
+//
+// Nothing is changed when the tail is anything else: the .idx entry at the
+// highest offset does not describe the needle there (id, size, CRC), a record
+// inside the tail is damaged while more data follows it, a header carries id 0
+// or a negative size, append timestamps go backwards, the .dat is beyond what
+// 4-byte offsets can address, the needle version is not 3, or the .idx size is
+// not a whole number of entries. The integrity check that follows then marks
+// the volume read-only exactly as before.
+func repairUnindexedDatTail(v *Volume, indexFile *os.File, indexSize int64, tailEntryPos int64) (int, int64, error) {
+	version := v.Version()
+	if version != needle.Version3 || v.DataBackend == nil {
+		return 0, 0, nil
 	}
-	return offset.ToActualOffset() + needle.GetActualSize(onDiskSize, version)
+	datSize, _, err := v.DataBackend.GetStat()
+	if err != nil {
+		return 0, 0, fmt.Errorf("stat %s: %v", v.FileName(".dat"), err)
+	}
+	if datSize <= int64(super_block.SuperBlockSize) || datSize > int64(types.MaxPossibleVolumeSize) {
+		// past MaxPossibleVolumeSize the .idx offsets wrap: an entry's offset
+		// does not name its needle's position on its own
+		return 0, 0, nil
+	}
+	var start int64
+	var lastAppendAtNs uint64
+	if tailEntryPos < 0 {
+		// The index holds no row at all, so no entry can anchor the walk:
+		// it starts at the first record past the superblock.
+		start = int64(v.SuperBlock.BlockSize())
+	} else {
+		entry, err := readIndexEntryAtOffset(indexFile, tailEntryPos)
+		if err != nil {
+			return 0, 0, fmt.Errorf("read index entry at %d: %v", tailEntryPos, err)
+		}
+		key, offset, size := idx.IdxFileEntry(entry)
+		if offset.IsZero() {
+			return 0, 0, nil
+		}
+		start = needleDiskEnd(offset, size, version)
+		if start >= datSize {
+			// the .dat ends at the last needle (clean), or the index references
+			// bytes the .dat does not have: not a torn tail, not ours to fix
+			return 0, 0, nil
+		}
+
+		// Anchor: the needle at the highest indexed offset must be the one its
+		// entry describes, whole and with a valid CRC.
+		onDiskSize := size
+		if size.IsDeleted() {
+			onDiskSize = 0
+		}
+		anchor, err := readTailNeedle(v.DataBackend, version, offset.ToActualOffset(), onDiskSize)
+		if err != nil {
+			return 0, 0, fmt.Errorf("last indexed needle %v at %d: %v: %w", key, offset.ToActualOffset(), err, errTailNotTorn)
+		}
+		if anchor.Id != key {
+			return 0, 0, fmt.Errorf("needle at %d is id %v, its index entry says id %v: %w", offset.ToActualOffset(), anchor.Id, key, errTailNotTorn)
+		}
+		lastAppendAtNs = anchor.AppendAtNs
+	}
+	if start >= datSize {
+		// no record past the superblock: nothing to index
+		return 0, 0, nil
+	}
+	// The backend rounds its size up to the needle alignment; the walk needs
+	// the bytes that are really there.
+	fileSize := datSize
+	if st, statErr := os.Stat(v.DataBackend.Name()); statErr == nil {
+		fileSize = st.Size()
+	}
+
+	entries, cutAt, err := walkUnindexedDatTail(v.DataBackend, version, start, fileSize, lastAppendAtNs)
+	if err != nil {
+		return 0, 0, err
+	}
+	reindexed := len(entries) / types.NeedleMapEntrySize
+	if reindexed > 0 {
+		// The new .idx rows must not become durable before the .dat records
+		// they name: a power loss between the two would leave the .idx
+		// pointing past the end of the .dat.
+		if err := v.DataBackend.Sync(); err != nil {
+			return 0, 0, fmt.Errorf("sync %s before re-indexing: %v", v.FileName(".dat"), err)
+		}
+		if err := appendIndexEntries(indexFile, entries, indexSize); err != nil {
+			return 0, 0, err
+		}
+	}
+	var cut int64
+	if cutAt < fileSize {
+		if err := v.DataBackend.Truncate(cutAt); err != nil {
+			return reindexed, 0, fmt.Errorf("truncate %s to %d: %v", v.FileName(".dat"), cutAt, err)
+		}
+		if err := v.DataBackend.Sync(); err != nil {
+			return reindexed, fileSize - cutAt, fmt.Errorf("sync %s after truncating to %d: %v", v.FileName(".dat"), cutAt, err)
+		}
+		cut = fileSize - cutAt
+	}
+	glog.Warningf("volume %d: repaired the unindexed tail of %s: re-indexed %d needle(s), cut %d bytes (%d -> %d bytes)",
+		v.Id, v.FileName(".dat"), reindexed, cut, fileSize, fileSize-cut)
+	return reindexed, cut, nil
+}
+
+// indexAppender is the part of the .idx file the repair writes through.
+type indexAppender interface {
+	io.WriterAt
+	Truncate(size int64) error
+	Sync() error
+	Name() string
+}
+
+// appendIndexEntries writes entries at the end (at) of the .idx and syncs it.
+// A failed write can leave part of the entries behind, which would make the
+// next load reject the .idx as a partial entry; they are removed again.
+func appendIndexEntries(indexFile indexAppender, entries []byte, at int64) error {
+	if _, err := indexFile.WriteAt(entries, at); err != nil {
+		if truncErr := indexFile.Truncate(at); truncErr != nil {
+			return fmt.Errorf("append %d bytes to %s: %v; truncate back to %d: %v", len(entries), indexFile.Name(), err, at, truncErr)
+		}
+		return fmt.Errorf("append %d bytes to %s: %v", len(entries), indexFile.Name(), err)
+	}
+	if err := indexFile.Sync(); err != nil {
+		return fmt.Errorf("sync %s: %v", indexFile.Name(), err)
+	}
+	return nil
+}
+
+// readTailNeedle reads and verifies the whole record of a needle of the given
+// on-disk size at offset: header, body, CRC and timestamp.
+func readTailNeedle(datFile backend.BackendStorageFile, version needle.Version, at int64, size types.Size) (*needle.Needle, error) {
+	if size > 0 && size < 4 && version != needle.Version1 {
+		// a v2+ body always starts with its 4-byte data-size field; size 1-3
+		// is damaged bytes, not a record — decoding it slices out of range
+		return nil, fmt.Errorf("record at %d has size %d: %w", at, size, needle.ErrorCorrupted)
+	}
+	blob, err := needle.ReadNeedleBlob(datFile, at, size, version)
+	if err != nil {
+		return nil, err
+	}
+	n := new(needle.Needle)
+	if err := n.ReadBytes(blob, at, size, version); err != nil {
+		return nil, err
+	}
+	if size > 0 && len(n.Data) == 0 {
+		// A needle with no data is written with size 0, so a record with a
+		// body whose data size reads 0 is damaged. The CRC covers only the
+		// data, and ReadBytes does not check it for empty data.
+		return nil, fmt.Errorf("needle %v at %d has size %d but no data: %w", n.Id, at, size, needle.ErrorCorrupted)
+	}
+	return n, nil
+}
+
+// walkUnindexedDatTail walks the needles from start to fileSize and returns
+// the .idx entries of the complete ones, and the offset from which the rest is
+// an incomplete last record (fileSize when there is none). It fails with
+// errTailNotTorn when the tail is damaged in a way an interrupted append does
+// not explain.
+func walkUnindexedDatTail(datFile backend.BackendStorageFile, version needle.Version, start, fileSize int64, lastAppendAtNs uint64) ([]byte, int64, error) {
+	var entries []byte
+	at := start
+	for at < fileSize {
+		if fileSize-at < types.NeedleHeaderSize {
+			return entries, at, nil // a partial header
+		}
+		header, _, _, err := needle.ReadNeedleHeader(datFile, version, at)
+		if err != nil || header == nil {
+			return nil, 0, fmt.Errorf("read needle header at %d: %v", at, err)
+		}
+		if header.Id == 0 || header.Size < 0 {
+			return nil, 0, fmt.Errorf("record at %d has id %v size %d: %w", at, header.Id, header.Size, errTailNotTorn)
+		}
+		end := at + needle.GetActualSize(header.Size, version)
+		if end > fileSize {
+			return entries, at, nil // the last record runs past the end of the file
+		}
+		n, err := readTailNeedle(datFile, version, at, header.Size)
+		if err != nil {
+			if !errors.Is(err, needle.ErrorCorrupted) {
+				// a read error says nothing about the bytes: leave them
+				return nil, 0, fmt.Errorf("read record %v at %d: %w", header.Id, at, err)
+			}
+			if end == fileSize {
+				return entries, at, nil // the last record is damaged: it never completed
+			}
+			return nil, 0, fmt.Errorf("record %v at %d is damaged and %d bytes follow it: %v: %w", header.Id, at, fileSize-end, err, errTailNotTorn)
+		}
+		if n.AppendAtNs <= lastAppendAtNs {
+			return nil, 0, fmt.Errorf("record %v at %d was appended at %d, not after %d: %w", n.Id, at, n.AppendAtNs, lastAppendAtNs, errTailNotTorn)
+		}
+		lastAppendAtNs = n.AppendAtNs
+		// A size 0 record is a delete or an empty write; the two append the
+		// identical record, so it is indexed at size 0 the way the write path
+		// indexes an empty write.
+		entries = append(entries, needle_map.ToBytes(n.Id, types.ToOffset(at), header.Size)...)
+		at = end
+	}
+	return entries, fileSize, nil
 }
 
 func doCheckAndFixVolumeData(v *Volume, indexFile *os.File, indexOffset int64) (lastAppendAtNs uint64, err error) {
@@ -258,6 +528,197 @@ func doCheckAndFixVolumeData(v *Volume, indexFile *os.File, indexOffset int64) (
 	return lastAppendAtNs, nil
 }
 
+// recoverLastModifiedTs points the TTL clock at the newest write recorded in
+// the volume, replacing the .dat mtime the loader starts from. A delete appends
+// a tombstone and vacuum rewrites the .dat wholesale, so the mtime moves
+// without any write: every restart of a volume taking delete traffic re-armed
+// expired() for another full TTL and the volume was never reclaimed. Left on
+// the mtime when no write is recoverable.
+func (v *Volume) recoverLastModifiedTs(indexFile *os.File) {
+	if v.Ttl == nil || v.Ttl.Minutes() == 0 {
+		return
+	}
+	indexSize, err := verifyIndexFileIntegrity(indexFile)
+	if err != nil || indexSize == 0 {
+		return
+	}
+	appendAtNs, key, err := findLastWriteAppendAtNs(v, indexFile, indexSize)
+	if err != nil {
+		glog.Warningf("volume %d recover last write from %s: %v", v.Id, indexFile.Name(), err)
+		return
+	}
+	if appendAtNs == 0 {
+		return
+	}
+	v.lastModifiedTsSeconds = appendAtNs / uint64(time.Second)
+	if appendAtNs > v.lastWriteAppendAtNs {
+		v.lastWriteAppendAtNs = appendAtNs
+		v.lastWriteNeedleKey = key
+		v.lastWriteDeleted = false
+	}
+}
+
+// vacuumedLastWriteScanEntries bounds the work a vacuumed volume's recovery
+// does, where key order makes every write a candidate for the newest one. A
+// volume with more live needles than this keeps the .dat mtime: reading a
+// subset could recover a timestamp older than the newest write and expire data
+// still inside its TTL, so a scan that will not fit declines instead of
+// guessing. A variable so tests can exercise that path.
+var vacuumedLastWriteScanEntries = 1 << 16
+
+// findLastWriteAppendAtNs scans the .idx backwards for the newest write -- an
+// entry that is not a deletion tombstone -- and returns that needle's append
+// timestamp and key. The .idx and the .dat share an order, so an
+// append-ordered volume answers with the first write the scan reaches. Vacuum
+// rewrites both in key order, which tracks write order only because the master
+// issues keys increasing: an overwrite keeps its original, lower key, so a
+// vacuumed volume has to take the maximum over every write it indexes. Returns
+// 0 when the .idx holds nothing but tombstones, when a vacuumed volume holds
+// more needles than the scan budget, or for a volume older than version 3,
+// whose needles carry no append timestamp.
+func findLastWriteAppendAtNs(v *Volume, indexFile *os.File, indexSize int64) (uint64, types.NeedleId, error) {
+	version := v.Version()
+	if version != needle.Version3 {
+		return 0, 0, nil
+	}
+	scanEveryWrite := v.SuperBlock.CompactionRevision > 0
+	entryBudget := vacuumedLastWriteScanEntries
+	if scanEveryWrite && !affordableVacuumedScan(indexFile, indexSize, v.Id, v.FileName(".dat")) {
+		return 0, 0, nil
+	}
+	var lastWriteAppendAtNs uint64
+	var lastWriteKey types.NeedleId
+	dead := make(map[types.NeedleId]struct{})
+	block := make([]byte, types.NeedleMapEntrySize*idx.RowsToRead)
+	for end := indexSize; end > 0; {
+		start := max(end-int64(len(block)), 0)
+		entries := block[:end-start]
+		readCount, err := indexFile.ReadAt(entries, start)
+		if err == io.EOF && readCount == len(entries) {
+			err = nil
+		}
+		if err != nil {
+			return 0, 0, fmt.Errorf("read %s at %d: %v", indexFile.Name(), start, err)
+		}
+		for i := len(entries) - types.NeedleMapEntrySize; i >= 0; i -= types.NeedleMapEntrySize {
+			key, offset, size := idx.IdxFileEntry(entries[i : i+types.NeedleMapEntrySize])
+			// The first row a key presents is its latest state: a tombstone
+			// there retires the write rows beneath it.
+			if _, gone := dead[key]; gone {
+				continue
+			}
+			if offset.IsZero() || size.IsDeleted() {
+				dead[key] = struct{}{}
+				continue
+			}
+			needleOffset := findNeedleOffset(v.DataBackend, version, offset.ToActualOffset(), key, size)
+			if needleOffset < 0 {
+				continue
+			}
+			appendAtNs, err := readNeedleAppendAtNs(v.DataBackend, needleOffset, size)
+			if err != nil {
+				return 0, 0, err
+			}
+			if appendAtNs > lastWriteAppendAtNs {
+				lastWriteAppendAtNs = appendAtNs
+				lastWriteKey = key
+			}
+			if !scanEveryWrite {
+				return lastWriteAppendAtNs, lastWriteKey, nil
+			}
+			if entryBudget--; entryBudget == 0 {
+				glog.V(0).Infof("volume %d: more than %d needles to scan for its last write, keeping the %s mtime",
+					v.Id, vacuumedLastWriteScanEntries, v.FileName(".dat"))
+				return 0, 0, nil
+			}
+		}
+		end = start
+	}
+	return lastWriteAppendAtNs, lastWriteKey, nil
+}
+
+// affordableVacuumedScan reports whether a vacuumed volume's recovery scan fits
+// its budget. A vacuumed volume must take the maximum over every write it
+// indexes, so a volume holding more live needles than vacuumedLastWriteScanEntries
+// would spend up to two random .dat reads per needle and then give up, keeping
+// the .dat mtime anyway. Counting the live .idx entries first is one short
+// sequential pass over a small file, and it skips the scan before any .dat I/O
+// when the scan provably cannot succeed.
+func affordableVacuumedScan(indexFile *os.File, indexSize int64, volumeId needle.VolumeId, datFileName string) bool {
+	liveEntries, err := countLiveIndexEntries(indexFile, indexSize, vacuumedLastWriteScanEntries)
+	if err != nil {
+		glog.Warningf("volume %d count live entries in %s: %v", volumeId, indexFile.Name(), err)
+		return true
+	}
+	if liveEntries >= vacuumedLastWriteScanEntries {
+		glog.V(0).Infof("volume %d: more than %d needles to scan for its last write, keeping the %s mtime",
+			volumeId, vacuumedLastWriteScanEntries, datFileName)
+		return false
+	}
+	return true
+}
+
+// countLiveIndexEntries counts the .idx entries describing a live needle,
+// stopping early once the count passes limit. Tombstones and zero offsets are
+// skipped exactly as findLastWriteAppendAtNs skips them.
+func countLiveIndexEntries(indexFile *os.File, indexSize int64, limit int) (int, error) {
+	count := 0
+	block := make([]byte, types.NeedleMapEntrySize*idx.RowsToRead)
+	for start := int64(0); start < indexSize; {
+		end := start + int64(len(block))
+		if end > indexSize {
+			end = indexSize
+		}
+		entries := block[:end-start]
+		readCount, err := indexFile.ReadAt(entries, start)
+		if err == io.EOF && readCount == len(entries) {
+			err = nil
+		}
+		if err != nil {
+			return 0, fmt.Errorf("read %s at %d: %v", indexFile.Name(), start, err)
+		}
+		for i := 0; i+types.NeedleMapEntrySize <= len(entries); i += types.NeedleMapEntrySize {
+			_, offset, size := idx.IdxFileEntry(entries[i : i+types.NeedleMapEntrySize])
+			if offset.IsZero() || size.IsDeleted() {
+				continue
+			}
+			if count++; count > limit {
+				return count, nil
+			}
+		}
+		start = end
+	}
+	return count, nil
+}
+
+// findNeedleOffset returns the .dat offset holding the needle an .idx entry
+// describes, or -1 when no needle there matches it. A .dat past
+// MaxPossibleVolumeSize wraps the 4-byte offsets in its .idx, so the needle can
+// sit one volume size further in; doCheckAndFixVolumeData retries the same way.
+func findNeedleOffset(datFile backend.BackendStorageFile, version needle.Version, offset int64, key types.NeedleId, size types.Size) int64 {
+	for _, at := range []int64{offset, offset + int64(types.MaxPossibleVolumeSize)} {
+		n, _, _, err := needle.ReadNeedleHeader(datFile, version, at)
+		if err == nil && n.Id == key && n.Size == size {
+			return at
+		}
+	}
+	return -1
+}
+
+// readNeedleAppendAtNs reads the append timestamp a version 3 needle carries
+// past its checksum.
+func readNeedleAppendAtNs(datFile backend.BackendStorageFile, offset int64, size types.Size) (uint64, error) {
+	bytes := make([]byte, types.TimestampSize)
+	readCount, err := datFile.ReadAt(bytes, offset+types.NeedleHeaderSize+int64(size)+needle.NeedleChecksumSize)
+	if err == io.EOF && readCount == types.TimestampSize {
+		err = nil
+	}
+	if err != nil {
+		return 0, err
+	}
+	return util.BytesToUint64(bytes), nil
+}
+
 func verifyIndexFileIntegrity(indexFile *os.File) (indexSize int64, err error) {
 	if indexSize, err = util.GetFileSize(indexFile); err == nil {
 		if indexSize%types.NeedleMapEntrySize != 0 {
@@ -293,19 +754,13 @@ func verifyNeedleIntegrity(datFile backend.BackendStorageFile, v needle.Version,
 		return 0, ErrorSizeMismatch
 	}
 	if v == needle.Version3 {
-		bytes := make([]byte, types.TimestampSize)
-		var readCount int
-		readCount, err = datFile.ReadAt(bytes, offset+types.NeedleHeaderSize+int64(size)+needle.NeedleChecksumSize)
-		if err == io.EOF && readCount == types.TimestampSize {
-			err = nil
-		}
+		n.AppendAtNs, err = readNeedleAppendAtNs(datFile, offset, size)
 		if err == io.EOF {
 			return 0, err
 		}
 		if err != nil {
 			return 0, fmt.Errorf("verifyNeedleIntegrity check %s entry offset %d size %d: %v", datFile.Name(), offset, size, err)
 		}
-		n.AppendAtNs = util.BytesToUint64(bytes)
 		fileTailOffset := offset + needle.GetActualSize(size, v)
 		fileSize, _, err := datFile.GetStat()
 		if err != nil {
diff --git a/weed/storage/volume_checking_tail_repair_test.go b/weed/storage/volume_checking_tail_repair_test.go
new file mode 100644
index 0000000000..2bb5f8d675
--- /dev/null
+++ b/weed/storage/volume_checking_tail_repair_test.go
@@ -0,0 +1,792 @@
+package storage
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A torn tail is what a crash between the two appends of a write leaves: the
+// needle is in the .dat, its entry never reached the .idx. After a process
+// crash the client was never answered; after a power loss it may have been.
+// These tests write needles (and deletes) normally, drop the last .idx
+// entries, cut or damage the .dat as a crash would, and reload the volume
+// through the real load path.
+
+type tornOp struct {
+	id    uint64
+	del   bool
+	empty bool // a write with no data, which appends a size 0 record like a delete
+}
+
+type tornFixture struct {
+	dir     string
+	datName string
+	idxName string
+	starts  []int64 // .dat offset of each op's record
+	end     int64   // .dat size after every op
+	written map[uint64]*needle.Needle
+}
+
+func newTornTailTestVolume(t *testing.T, dir string) *Volume {
+	t.Helper()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("load volume: %v", err)
+	}
+	return v
+}
+
+// buildTornFixture runs ops against a fresh volume (each op appends one .dat
+// record and one .idx entry), closes it and drops the last unindexed entries.
+func buildTornFixture(t *testing.T, ops []tornOp, unindexed int) *tornFixture {
+	t.Helper()
+	f := &tornFixture{dir: t.TempDir(), written: map[uint64]*needle.Needle{}}
+	v := newTornTailTestVolume(t, f.dir)
+	for _, op := range ops {
+		at, _, err := v.DataBackend.GetStat()
+		if err != nil {
+			t.Fatal(err)
+		}
+		f.starts = append(f.starts, at)
+		if op.del {
+			if _, err := v.doDeleteRequest(newEmptyNeedle(op.id)); err != nil {
+				t.Fatalf("delete needle %d: %v", op.id, err)
+			}
+			continue
+		}
+		n := newRandomNeedle(op.id)
+		if op.empty {
+			n = newEmptyNeedle(op.id)
+		}
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+			t.Fatalf("write needle %d: %v", op.id, err)
+		}
+		f.written[op.id] = n
+	}
+	f.end, _, _ = v.DataBackend.GetStat()
+	f.datName, f.idxName = v.FileName(".dat"), v.FileName(".idx")
+	v.Close()
+	if unindexed > 0 {
+		if err := os.Truncate(f.idxName, fileSize(t, f.idxName)-int64(unindexed)*types.NeedleMapEntrySize); err != nil {
+			t.Fatalf("drop %d .idx entries: %v", unindexed, err)
+		}
+	}
+	return f
+}
+
+// midRecord is an offset inside the body of op i's record: past its header,
+// short of its end. A fixed offset is not: a needle with a few bytes of data
+// is a 40-byte record, which a cut at +40 leaves whole.
+func (f *tornFixture) midRecord(i int) int64 {
+	end := f.end
+	if i+1 < len(f.starts) {
+		end = f.starts[i+1]
+	}
+	return midRecordBody(f.starts[i], end)
+}
+
+func midRecordBody(start, end int64) int64 {
+	return start + types.NeedleHeaderSize + (end-start-types.NeedleHeaderSize)/2
+}
+
+func (f *tornFixture) truncateDat(t *testing.T, size int64) {
+	t.Helper()
+	if err := os.Truncate(f.datName, size); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// flipDataByte damages the data of the record at the given offset, so its
+// CRC no longer matches.
+func (f *tornFixture) flipDataByte(t *testing.T, at int64) {
+	t.Helper()
+	file, err := os.OpenFile(f.datName, os.O_RDWR, 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	b := make([]byte, 1)
+	pos := at + types.NeedleHeaderSize + 4 // past the 4-byte DataSize field
+	if _, err := file.ReadAt(b, pos); err != nil {
+		t.Fatal(err)
+	}
+	b[0] ^= 0xff
+	if _, err := file.WriteAt(b, pos); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// zeroDataSize zeroes the DataSize field and the first data byte (read as
+// the flags once DataSize is 0) of the record at the given offset: the header
+// still claims a body, the body parses as an empty needle.
+func (f *tornFixture) zeroDataSize(t *testing.T, at int64) {
+	t.Helper()
+	file, err := os.OpenFile(f.datName, os.O_RDWR, 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	if _, err := file.WriteAt(make([]byte, 5), at+types.NeedleHeaderSize); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func assertReadable(t *testing.T, v *Volume, want *needle.Needle) {
+	t.Helper()
+	got := &needle.Needle{Id: want.Id}
+	if _, err := v.readNeedle(got, nil, nil); err != nil {
+		t.Fatalf("read needle %d: %v", want.Id, err)
+	}
+	if !bytes.Equal(got.Data, want.Data) {
+		t.Fatalf("needle %d reads back different data", want.Id)
+	}
+}
+
+func assertNotReadable(t *testing.T, v *Volume, id uint64) {
+	t.Helper()
+	if _, err := v.readNeedle(&needle.Needle{Id: types.Uint64ToNeedleId(id)}, nil, nil); err == nil {
+		t.Fatalf("needle %d reads back; it should be deleted or absent", id)
+	}
+}
+
+// A recovered size 0 record indexes as a live empty needle: a delete and a
+// write with no data append the identical record, so the repair cannot tell
+// them apart and indexes the entry the write path would have written.
+func assertEmpty(t *testing.T, v *Volume, id uint64) {
+	t.Helper()
+	n := &needle.Needle{Id: types.Uint64ToNeedleId(id)}
+	if _, err := v.readNeedle(n, nil, nil); err != nil {
+		t.Fatalf("read needle %d: %v", id, err)
+	}
+	if len(n.Data) != 0 {
+		t.Fatalf("needle %d reads back %d bytes, want an empty needle", id, len(n.Data))
+	}
+}
+
+func writes(ids ...uint64) []tornOp {
+	ops := make([]tornOp, len(ids))
+	for i, id := range ids {
+		ops[i] = tornOp{id: id}
+	}
+	return ops
+}
+
+func TestVolumeLoadRepairsUnindexedDatTail(t *testing.T) {
+	cases := []struct {
+		name      string
+		ops       []tornOp
+		unindexed int
+		damage    func(t *testing.T, f *tornFixture)
+		wantSize  func(f *tornFixture) int64 // .dat size after the repair
+		reindexed int
+		readable  []uint64
+		empty     []uint64 // readable as an empty live needle
+		absent    []uint64
+	}{
+		{name: "one complete unindexed needle is re-indexed",
+			ops: writes(1, 2, 3, 4), unindexed: 1,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 1,
+			readable: []uint64{1, 2, 3, 4}},
+		{name: "two complete unindexed needles are re-indexed",
+			ops: writes(1, 2, 3, 4, 5), unindexed: 2,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 2,
+			readable: []uint64{1, 2, 3, 4, 5}},
+		{name: "an unindexed delete is re-indexed as an empty live needle",
+			ops: append(writes(1, 2, 3), tornOp{id: 2, del: true}), unindexed: 1,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 1,
+			readable: []uint64{1, 3}, empty: []uint64{2}},
+		{name: "an unindexed empty write of a live id stays an empty needle",
+			ops: append(writes(1, 2, 3), tornOp{id: 2, empty: true}), unindexed: 1,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 1,
+			readable: []uint64{1, 3}, empty: []uint64{2}},
+		{name: "a partial header is cut",
+			ops: writes(1, 2, 3, 4), unindexed: 1,
+			damage:   func(t *testing.T, f *tornFixture) { f.truncateDat(t, f.starts[3]+7) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[3] },
+			readable: []uint64{1, 2, 3}, absent: []uint64{4}},
+		{name: "a partial body is cut",
+			ops: writes(1, 2, 3, 4), unindexed: 1,
+			damage:   func(t *testing.T, f *tornFixture) { f.truncateDat(t, f.midRecord(3)) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[3] },
+			readable: []uint64{1, 2, 3}, absent: []uint64{4}},
+		{name: "a complete needle is re-indexed and the partial one after it cut",
+			ops: writes(1, 2, 3, 4, 5), unindexed: 2,
+			damage:   func(t *testing.T, f *tornFixture) { f.truncateDat(t, f.midRecord(4)) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[4] }, reindexed: 1,
+			readable: []uint64{1, 2, 3, 4}, absent: []uint64{5}},
+		{name: "a last needle with a bad CRC is cut",
+			ops: writes(1, 2, 3, 4), unindexed: 1,
+			damage:   func(t *testing.T, f *tornFixture) { f.flipDataByte(t, f.starts[3]) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[3] },
+			readable: []uint64{1, 2, 3}, absent: []uint64{4}},
+		{name: "a last needle whose data size field reads 0 is cut",
+			ops: writes(1, 2, 3, 4), unindexed: 1,
+			damage:   func(t *testing.T, f *tornFixture) { f.zeroDataSize(t, f.starts[3]) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[3] },
+			readable: []uint64{1, 2, 3}, absent: []uint64{4}},
+		{name: "an unindexed empty write of a new id stays an empty needle",
+			ops: append(writes(1, 2), tornOp{id: 3, empty: true}), unindexed: 1,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 1,
+			readable: []uint64{1, 2, 3}},
+		{name: "an unindexed empty write after a delete of the same id stays an empty needle",
+			ops: append(append(writes(1, 2), tornOp{id: 2, del: true}), tornOp{id: 2, empty: true}), unindexed: 1,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 1,
+			readable: []uint64{1, 2}},
+		{name: "an unindexed write and delete of the same id are re-indexed in order",
+			ops: append(writes(1, 2, 3), tornOp{id: 3, del: true}), unindexed: 2,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 2,
+			readable: []uint64{1, 2}, empty: []uint64{3}},
+		{name: "an unindexed empty write and its delete are re-indexed in order",
+			ops: append(writes(1, 2), tornOp{id: 3, empty: true}, tornOp{id: 3, del: true}), unindexed: 2,
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 2,
+			readable: []uint64{1, 2}, empty: []uint64{3}},
+		{name: "a partial needle after an indexed tombstone is cut",
+			ops: append(append(writes(1, 2, 3), tornOp{id: 2, del: true}), tornOp{id: 4}), unindexed: 1,
+			damage:   func(t *testing.T, f *tornFixture) { f.truncateDat(t, f.midRecord(4)) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[4] },
+			readable: []uint64{1, 3}, absent: []uint64{2, 4}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := buildTornFixture(t, tc.ops, tc.unindexed)
+			if tc.damage != nil {
+				tc.damage(t, f)
+			}
+			idxBefore := fileSize(t, f.idxName)
+
+			v := newTornTailTestVolume(t, f.dir)
+			defer v.Close()
+			if v.noWriteOrDelete || v.noWriteCanDelete {
+				t.Fatal("volume with an unindexed .dat tail loaded read-only")
+			}
+			if got, want := fileSize(t, f.datName), tc.wantSize(f); got != want {
+				t.Fatalf(".dat is %d bytes after load, want %d", got, want)
+			}
+			if got, want := fileSize(t, f.idxName), idxBefore+int64(tc.reindexed)*types.NeedleMapEntrySize; got != want {
+				t.Fatalf(".idx is %d bytes after load, want %d (%d entries re-indexed)", got, want, tc.reindexed)
+			}
+			for _, id := range tc.readable {
+				assertReadable(t, v, f.written[id])
+			}
+			for _, id := range tc.empty {
+				assertEmpty(t, v, id)
+			}
+			for _, id := range tc.absent {
+				assertNotReadable(t, v, id)
+			}
+			extra := newRandomNeedle(100)
+			if _, _, _, err := v.writeNeedle2(extra, true, false, false); err != nil {
+				t.Fatalf("write after repair: %v", err)
+			}
+			assertReadable(t, v, extra)
+			v.Close()
+
+			// the repaired volume reloads clean, and keeps what it indexed
+			v2 := newTornTailTestVolume(t, f.dir)
+			defer v2.Close()
+			if v2.noWriteOrDelete {
+				t.Fatal("repaired volume loaded read-only on the next load")
+			}
+			for _, id := range tc.readable {
+				assertReadable(t, v2, f.written[id])
+			}
+			assertReadable(t, v2, extra)
+		})
+	}
+}
+
+// An empty index can hide writes a crash stranded in the .dat: the writable
+// index loader creates the .idx before the first needle append, so a crash
+// after that append leaves a volume whose data nothing indexes. The same
+// repair runs from the first record past the superblock.
+func TestVolumeLoadRepairsTailPastEmptyIndex(t *testing.T) {
+	cases := []struct {
+		name      string
+		ops       []tornOp
+		damage    func(t *testing.T, f *tornFixture)
+		wantSize  func(f *tornFixture) int64 // .dat size after the repair
+		reindexed int
+		readable  []uint64
+		empty     []uint64
+		absent    []uint64
+	}{
+		{name: "the only write is re-indexed",
+			ops:      writes(7),
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 1,
+			readable: []uint64{7}},
+		{name: "every write is re-indexed",
+			ops:      writes(1, 2, 3),
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 3,
+			readable: []uint64{1, 2, 3}},
+		{name: "an unindexed delete is re-indexed as an empty live needle",
+			ops:      append(writes(1, 2, 3), tornOp{id: 2, del: true}),
+			wantSize: func(f *tornFixture) int64 { return f.end }, reindexed: 4,
+			readable: []uint64{1, 3}, empty: []uint64{2}},
+		{name: "a complete needle is re-indexed and the partial one after it cut",
+			ops:      writes(1, 2),
+			damage:   func(t *testing.T, f *tornFixture) { f.truncateDat(t, f.midRecord(1)) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[1] }, reindexed: 1,
+			readable: []uint64{1}, absent: []uint64{2}},
+		{name: "a last needle with a bad CRC is cut",
+			ops:      writes(1, 2),
+			damage:   func(t *testing.T, f *tornFixture) { f.flipDataByte(t, f.starts[1]) },
+			wantSize: func(f *tornFixture) int64 { return f.starts[1] }, reindexed: 1,
+			readable: []uint64{1}, absent: []uint64{2}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := buildTornFixture(t, tc.ops, len(tc.ops))
+			if tc.damage != nil {
+				tc.damage(t, f)
+			}
+
+			v := newTornTailTestVolume(t, f.dir)
+			defer v.Close()
+			if v.noWriteOrDelete || v.noWriteCanDelete {
+				t.Fatal("volume with an unindexed .dat tail loaded read-only")
+			}
+			if got, want := fileSize(t, f.datName), tc.wantSize(f); got != want {
+				t.Fatalf(".dat is %d bytes after load, want %d", got, want)
+			}
+			if got, want := fileSize(t, f.idxName), int64(tc.reindexed)*types.NeedleMapEntrySize; got != want {
+				t.Fatalf(".idx is %d bytes after load, want %d (%d entries re-indexed)", got, want, tc.reindexed)
+			}
+			for _, id := range tc.readable {
+				assertReadable(t, v, f.written[id])
+			}
+			for _, id := range tc.empty {
+				assertEmpty(t, v, id)
+			}
+			for _, id := range tc.absent {
+				assertNotReadable(t, v, id)
+			}
+			v.Close()
+
+			// the repaired volume reloads clean, and keeps what it indexed
+			v2 := newTornTailTestVolume(t, f.dir)
+			defer v2.Close()
+			if v2.noWriteOrDelete {
+				t.Fatal("repaired volume loaded read-only on the next load")
+			}
+			for _, id := range tc.readable {
+				assertReadable(t, v2, f.written[id])
+			}
+			for _, id := range tc.empty {
+				assertEmpty(t, v2, id)
+			}
+		})
+	}
+}
+
+// An .dat an interrupted append does not explain, over an index with no rows
+// at all, loads the volume read-only: the checks that would quarantine it
+// otherwise all skip an empty index.
+func TestVolumeLoadKeepsUnexplainedTailPastEmptyIndexReadOnly(t *testing.T) {
+	cases := []struct {
+		name   string
+		damage func(t *testing.T, f *tornFixture)
+	}{
+		{name: "zero bytes where the first record would be (id 0)",
+			damage: func(t *testing.T, f *tornFixture) {
+				file, err := os.OpenFile(f.datName, os.O_RDWR|os.O_APPEND, 0644)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer file.Close()
+				if _, err := file.Write(make([]byte, 64)); err != nil {
+					t.Fatal(err)
+				}
+			}},
+		{name: "a damaged record more data follows",
+			damage: func(t *testing.T, f *tornFixture) { f.flipDataByte(t, f.starts[0]) }},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := buildTornFixture(t, writes(1, 2), 2)
+			tc.damage(t, f)
+			datBefore, idxBefore := fileSize(t, f.datName), fileSize(t, f.idxName)
+
+			v := newTornTailTestVolume(t, f.dir)
+			defer v.Close()
+			if !v.noWriteOrDelete {
+				t.Fatal("volume with an unexplained tail past an empty index loaded writable")
+			}
+			if got := fileSize(t, f.datName); got != datBefore {
+				t.Fatalf(".dat changed from %d to %d bytes", datBefore, got)
+			}
+			if got := fileSize(t, f.idxName); got != idxBefore {
+				t.Fatalf(".idx changed from %d to %d bytes", idxBefore, got)
+			}
+		})
+	}
+}
+
+// Every tail an interrupted append does not explain is left exactly as it is,
+// and the volume loads read-only as before.
+func TestVolumeLoadKeepsUnexplainedTailReadOnly(t *testing.T) {
+	cases := []struct {
+		name      string
+		ops       []tornOp
+		unindexed int
+		damage    func(t *testing.T, f *tornFixture)
+	}{
+		{name: "the last indexed needle's id differs from its entry",
+			ops: writes(1, 2, 3, 4), unindexed: 1,
+			damage: func(t *testing.T, f *tornFixture) {
+				file, err := os.OpenFile(f.datName, os.O_RDWR, 0644)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer file.Close()
+				if _, err := file.WriteAt([]byte{0xff}, f.starts[2]+types.CookieSize+types.NeedleIdSize-1); err != nil {
+					t.Fatal(err)
+				}
+			}},
+		{name: "the last indexed needle fails its CRC",
+			ops: writes(1, 2, 3, 4), unindexed: 1,
+			damage: func(t *testing.T, f *tornFixture) { f.flipDataByte(t, f.starts[2]) }},
+		{name: "a zeroed data size field followed by more data",
+			ops: writes(1, 2, 3, 4, 5), unindexed: 2,
+			damage: func(t *testing.T, f *tornFixture) { f.zeroDataSize(t, f.starts[3]) }},
+		{name: "a bad CRC followed by more data",
+			ops: writes(1, 2, 3, 4, 5), unindexed: 2,
+			damage: func(t *testing.T, f *tornFixture) { f.flipDataByte(t, f.starts[3]) }},
+		{name: "zero bytes past the last needle (id 0)",
+			ops: writes(1, 2, 3),
+			damage: func(t *testing.T, f *tornFixture) {
+				file, err := os.OpenFile(f.datName, os.O_RDWR|os.O_APPEND, 0644)
+				if err != nil {
+					t.Fatal(err)
+				}
+				defer file.Close()
+				if _, err := file.Write(make([]byte, 64)); err != nil {
+					t.Fatal(err)
+				}
+			}},
+		{name: "the index ends past the data",
+			ops:    writes(1, 2, 3),
+			damage: func(t *testing.T, f *tornFixture) { f.truncateDat(t, f.end-10) }},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := buildTornFixture(t, tc.ops, tc.unindexed)
+			tc.damage(t, f)
+			datBefore, idxBefore := fileSize(t, f.datName), fileSize(t, f.idxName)
+
+			v := newTornTailTestVolume(t, f.dir)
+			defer v.Close()
+			if !v.noWriteOrDelete {
+				t.Fatal("volume with an unexplained tail loaded writable")
+			}
+			if got := fileSize(t, f.datName); got != datBefore {
+				t.Fatalf(".dat changed from %d to %d bytes", datBefore, got)
+			}
+			if got := fileSize(t, f.idxName); got != idxBefore {
+				t.Fatalf(".idx changed from %d to %d bytes", idxBefore, got)
+			}
+		})
+	}
+}
+
+func TestVolumeLoadLeavesCleanVolumeUntouched(t *testing.T) {
+	f := buildTornFixture(t, append(writes(1, 2, 3), tornOp{id: 2, del: true}), 0)
+	datBefore, idxBefore := fileSize(t, f.datName), fileSize(t, f.idxName)
+
+	v := newTornTailTestVolume(t, f.dir)
+	defer v.Close()
+	if v.noWriteOrDelete || v.noWriteCanDelete {
+		t.Fatal("clean volume loaded read-only")
+	}
+	if got := fileSize(t, f.datName); got != datBefore {
+		t.Fatalf("clean .dat changed from %d to %d bytes", datBefore, got)
+	}
+	if got := fileSize(t, f.idxName); got != idxBefore {
+		t.Fatalf("clean .idx changed from %d to %d bytes", idxBefore, got)
+	}
+	assertReadable(t, v, f.written[1])
+	assertReadable(t, v, f.written[3])
+	assertNotReadable(t, v, 2)
+}
+
+// A volume persisted read-only is not repaired: the tail stays for whoever
+// marked it.
+func TestVolumeLoadLeavesReadOnlyVolumeTailAlone(t *testing.T) {
+	dir := t.TempDir()
+	v := newTornTailTestVolume(t, dir)
+	for _, id := range []uint64{1, 2, 99} {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(id), true, false, false); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := v.PersistReadOnly(true, false); err != nil {
+		t.Fatal(err)
+	}
+	datName, idxName := v.FileName(".dat"), v.FileName(".idx")
+	v.Close()
+	if err := os.Truncate(idxName, fileSize(t, idxName)-types.NeedleMapEntrySize); err != nil {
+		t.Fatal(err)
+	}
+	datBefore, idxBefore := fileSize(t, datName), fileSize(t, idxName)
+
+	v = newTornTailTestVolume(t, dir)
+	defer v.Close()
+	if !v.noWriteOrDelete {
+		t.Fatal("volume persisted read-only loaded writable")
+	}
+	if got := fileSize(t, datName); got != datBefore {
+		t.Fatalf(".dat of a read-only volume changed from %d to %d bytes", datBefore, got)
+	}
+	if got := fileSize(t, idxName); got != idxBefore {
+		t.Fatalf(".idx of a read-only volume changed from %d to %d bytes", idxBefore, got)
+	}
+}
+
+// A canDelete volume still appends a tombstone record on every delete, so it
+// can tear a tail the same way: it is repaired and keeps taking deletes.
+func TestVolumeLoadRepairsTailOnCanDeleteVolume(t *testing.T) {
+	dir := t.TempDir()
+	v := newTornTailTestVolume(t, dir)
+	var last *needle.Needle
+	for _, id := range []uint64{1, 2, 99} {
+		last = newRandomNeedle(id)
+		if _, _, _, err := v.writeNeedle2(last, true, false, false); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := v.PersistReadOnly(true, true); err != nil {
+		t.Fatal(err)
+	}
+	idxName := v.FileName(".idx")
+	v.Close()
+	if err := os.Truncate(idxName, fileSize(t, idxName)-types.NeedleMapEntrySize); err != nil {
+		t.Fatal(err)
+	}
+
+	v = newTornTailTestVolume(t, dir)
+	defer v.Close()
+	if v.noWriteOrDelete || !v.noWriteCanDelete {
+		t.Fatal("canDelete volume with a torn tail did not load canDelete after the repair")
+	}
+	assertReadable(t, v, last)
+}
+
+// A torn record whose header advertises a positive size smaller than the
+// body's own 4-byte data-size field is damaged, not decodable — reading it
+// used to panic on the slice. As the last record it is cut, and a canDelete
+// volume keeps taking deletes after the repair.
+func TestVolumeLoadCutsDamagedSmallSizeTailOnCanDeleteVolume(t *testing.T) {
+	dir := t.TempDir()
+	v := newTornTailTestVolume(t, dir)
+	var last *needle.Needle
+	for _, id := range []uint64{1, 2, 99} {
+		last = newRandomNeedle(id)
+		if _, _, _, err := v.writeNeedle2(last, true, false, false); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := v.PersistReadOnly(true, true); err != nil {
+		t.Fatal(err)
+	}
+	datName, idxName := v.FileName(".dat"), v.FileName(".idx")
+	version := v.Version()
+	v.Close()
+	if err := os.Truncate(idxName, fileSize(t, idxName)-types.NeedleMapEntrySize); err != nil {
+		t.Fatal(err)
+	}
+	datBefore := fileSize(t, datName)
+
+	// a complete-looking record whose header claims a 2-byte body
+	damagedSize := types.Size(2)
+	record := make([]byte, needle.GetActualSize(damagedSize, version))
+	util.Uint32toBytes(record[0:types.CookieSize], 0xabcd)
+	util.Uint64toBytes(record[types.CookieSize:types.CookieSize+types.NeedleIdSize], uint64(types.Uint64ToNeedleId(7)))
+	util.Uint32toBytes(record[types.CookieSize+types.NeedleIdSize:types.NeedleHeaderSize], uint32(damagedSize))
+	dat, err := os.OpenFile(datName, os.O_WRONLY|os.O_APPEND, 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := dat.Write(record); err != nil {
+		t.Fatal(err)
+	}
+	if err := dat.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	v = newTornTailTestVolume(t, dir)
+	defer v.Close()
+	if v.noWriteOrDelete || !v.noWriteCanDelete {
+		t.Fatal("canDelete volume with a damaged-size tail did not load canDelete after the repair")
+	}
+	assertReadable(t, v, last)
+	if got := fileSize(t, datName); got != datBefore {
+		t.Fatalf("damaged tail was not cut: .dat is %d bytes, want %d", got, datBefore)
+	}
+}
+
+// An .idx that ends in a partial entry keeps the existing behaviour:
+// the volume does not load writable and neither file is changed.
+func TestVolumeLoadLeavesPartialIdxEntryAlone(t *testing.T) {
+	f := buildTornFixture(t, writes(1, 2, 3), 0)
+	idxPartial := fileSize(t, f.idxName) - types.NeedleMapEntrySize/2
+	if err := os.Truncate(f.idxName, idxPartial); err != nil {
+		t.Fatal(err)
+	}
+	datBefore := fileSize(t, f.datName)
+
+	v2, err := NewVolume(f.dir, f.dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err == nil {
+		t.Logf("partial .idx: volume loaded, noWriteOrDelete=%v", v2.noWriteOrDelete)
+		if !v2.noWriteOrDelete {
+			v2.Close()
+			t.Fatal("volume with a partial .idx entry loaded writable")
+		}
+		v2.Close()
+	} else {
+		t.Logf("partial .idx: volume not loaded: %v", err)
+	}
+	if got := fileSize(t, f.datName); got != datBefore {
+		t.Fatalf(".dat changed from %d to %d bytes", datBefore, got)
+	}
+	if got := fileSize(t, f.idxName); got != idxPartial {
+		t.Fatalf(".idx changed from %d to %d bytes", idxPartial, got)
+	}
+}
+
+// faultyDatFile fails Sync, or the read of a whole record at one offset, the
+// way a failing disk does.
+type faultyDatFile struct {
+	backend.BackendStorageFile
+	failSync      bool
+	failRecordAt  int64
+	failRecordSet bool
+}
+
+var errFaultyDisk = errors.New("input/output error")
+
+func (f *faultyDatFile) Sync() error {
+	if f.failSync {
+		return errFaultyDisk
+	}
+	return f.BackendStorageFile.Sync()
+}
+
+func (f *faultyDatFile) ReadAt(p []byte, off int64) (int, error) {
+	if f.failRecordSet && off == f.failRecordAt && len(p) > types.NeedleHeaderSize {
+		return 0, errFaultyDisk
+	}
+	return f.BackendStorageFile.ReadAt(p, off)
+}
+
+// A read error is not evidence of a torn write: the last record is kept.
+func TestWalkUnindexedDatTailKeepsRecordOnReadError(t *testing.T) {
+	f := buildTornFixture(t, writes(1, 2, 3, 4), 1)
+	file, err := os.Open(f.datName)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dat := &faultyDatFile{BackendStorageFile: backend.NewDiskFile(file), failRecordAt: f.starts[3], failRecordSet: true}
+	defer dat.Close()
+
+	records, cutAt, err := walkUnindexedDatTail(dat, needle.Version3, f.starts[3], f.end, 0)
+	if err == nil {
+		t.Fatalf("read error on the last record: walk returned %d record(s) and a cut at %d, want an error", len(records), cutAt)
+	}
+	if errors.Is(err, errTailNotTorn) {
+		t.Fatalf("read error reported as an unexplained tail: %v", err)
+	}
+	if !errors.Is(err, errFaultyDisk) {
+		t.Fatalf("walk error %v does not carry the read error", err)
+	}
+}
+
+// A repair that changed a file but could not sync it fails the integrity
+// check, so the volume loads read-only rather than writable on an unsynced
+// repair.
+func TestCheckVolumeDataIntegrityFailsOnUnsyncedRepair(t *testing.T) {
+	dir := t.TempDir()
+	v := newTornTailTestVolume(t, dir)
+	var starts []int64
+	for _, id := range []uint64{1, 2, 3, 4} {
+		at, _, _ := v.DataBackend.GetStat()
+		starts = append(starts, at)
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(id), true, false, false); err != nil {
+			t.Fatal(err)
+		}
+	}
+	end, _, _ := v.DataBackend.GetStat()
+	// persisted read-only so the load below does not repair the tail itself
+	if err := v.PersistReadOnly(true, false); err != nil {
+		t.Fatal(err)
+	}
+	datName, idxName := v.FileName(".dat"), v.FileName(".idx")
+	v.Close()
+	if err := os.Truncate(idxName, fileSize(t, idxName)-types.NeedleMapEntrySize); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Truncate(datName, midRecordBody(starts[3], end)); err != nil {
+		t.Fatal(err)
+	}
+
+	v = newTornTailTestVolume(t, dir)
+	defer v.Close()
+	v.noWriteOrDelete = false
+	v.DataBackend = &faultyDatFile{BackendStorageFile: v.DataBackend, failSync: true}
+	indexFile, err := os.OpenFile(idxName, os.O_RDWR, 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer indexFile.Close()
+
+	if _, err := CheckVolumeDataIntegrity(v, indexFile); err == nil {
+		t.Fatal("integrity check passed although the repaired .dat was not synced")
+	}
+}
+
+// partialWriteIndex accepts only the first n bytes of a write, as a full disk
+// does.
+type partialWriteIndex struct {
+	data      []byte
+	accept    int
+	truncated bool
+}
+
+func (p *partialWriteIndex) WriteAt(b []byte, off int64) (int, error) {
+	n := min(len(b), p.accept)
+	if end := int(off) + n; end > len(p.data) {
+		p.data = append(p.data, make([]byte, end-len(p.data))...)
+	}
+	copy(p.data[off:], b[:n])
+	if n < len(b) {
+		return n, errors.New("no space left on device")
+	}
+	return n, nil
+}
+
+func (p *partialWriteIndex) Truncate(size int64) error {
+	p.data = p.data[:size]
+	p.truncated = true
+	return nil
+}
+
+func (p *partialWriteIndex) Sync() error  { return nil }
+func (p *partialWriteIndex) Name() string { return "test.idx" }
+
+// A failed append leaves no partial entry behind.
+func TestAppendIndexEntriesRemovesPartialWrite(t *testing.T) {
+	idxFile := &partialWriteIndex{data: make([]byte, 2*types.NeedleMapEntrySize), accept: types.NeedleMapEntrySize + 5}
+	entries := make([]byte, 2*types.NeedleMapEntrySize)
+	if err := appendIndexEntries(idxFile, entries, 2*types.NeedleMapEntrySize); err == nil {
+		t.Fatal("a partial append reported success")
+	}
+	if got, want := len(idxFile.data), 2*types.NeedleMapEntrySize; got != want {
+		t.Fatalf(".idx is %d bytes after a failed append, want %d", got, want)
+	}
+}
diff --git a/weed/storage/volume_checking_test.go b/weed/storage/volume_checking_test.go
index c553b16219..ce1f093428 100644
--- a/weed/storage/volume_checking_test.go
+++ b/weed/storage/volume_checking_test.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"reflect"
 	"sort"
+	"strings"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
@@ -65,6 +66,16 @@ func TestScrubVolumeData(t *testing.T) {
 				fmt.Errorf("failed to read needle 45 on volume 0: EOF"),
 				fmt.Errorf("failed to read needle 46 on volume 0: EOF"),
 				fmt.Errorf("failed to read needle 48 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 20 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 31 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 25 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 11 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 33 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 45 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 18 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 29 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 35 on volume 0: EOF"),
+				fmt.Errorf("failed to read needle 46 on volume 0: EOF"),
 				fmt.Errorf("data file for volume 0 is smaller (8) than the 27 needles it contains (942856)"),
 			},
 		},
@@ -142,7 +153,7 @@ func TestScrubVolumeData_IgnoresOffset0Tombstone(t *testing.T) {
 	}
 	defer v.Close()
 
-	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false); err != nil {
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
 		t.Fatalf("write needle: %v", err)
 	}
 	if err := v.DataBackend.Sync(); err != nil {
@@ -164,18 +175,114 @@ func TestScrubVolumeData_IgnoresOffset0Tombstone(t *testing.T) {
 	}
 	f.Close()
 
-	idxFile, err := os.OpenFile(v.FileName(".idx"), os.O_RDONLY, 0644)
-	if err != nil {
-		t.Fatalf("reopen .idx: %v", err)
+	if errs := scrubVolumeErrors(t, v); len(errs) != 0 {
+		t.Fatalf("offset-0 tombstone must not flag the volume, got %v", errs)
 	}
-	defer idxFile.Close()
-	idxStat, err := idxFile.Stat()
+}
+
+func TestScrubVolumeDataChecksLocalDeletionTombstone(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
 	if err != nil {
-		t.Fatalf("stat .idx: %v", err)
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	const deletedID = uint64(1)
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(deletedID), true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	if _, err := v.doDeleteRequest(newEmptyNeedle(deletedID)); err != nil {
+		t.Fatalf("delete needle: %v", err)
+	}
+	// A later record keeps the tombstone mid-file rather than at the tail.
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(2), true, false, false); err != nil {
+		t.Fatalf("write needle after deletion: %v", err)
+	}
+	syncVolumeFiles(t, v)
+
+	tombstoneOffset := localTombstoneOffset(t, v, deletedID)
+	if errs := scrubVolumeErrors(t, v); len(errs) != 0 {
+		t.Fatalf("healthy local deletion tombstone must pass scrub, got %v", errs)
 	}
 
-	if _, errs := v.scrubVolumeData(idxFile, idxStat.Size()); len(errs) != 0 {
-		t.Fatalf("offset-0 tombstone must not flag the volume, got %v", errs)
+	corruptedID := make([]byte, types.NeedleIdSize)
+	types.NeedleIdToBytes(corruptedID, types.Uint64ToNeedleId(99))
+	if _, err := v.DataBackend.WriteAt(corruptedID, tombstoneOffset.ToActualOffset()+types.CookieSize); err != nil {
+		t.Fatalf("corrupt tombstone ID: %v", err)
+	}
+	if err := v.DataBackend.Sync(); err != nil {
+		t.Fatalf("sync corrupted .dat: %v", err)
+	}
+
+	if errs := scrubVolumeErrors(t, v); !strings.Contains(fmt.Sprint(errs), "does not match needle's Id") {
+		t.Fatalf("scrub should report the corrupted tombstone's Id, got %v", errs)
+	}
+}
+
+// A live needle whose header id is damaged still reads clean — the data CRC
+// does not cover the header — so the scrub must catch it by comparing the
+// stored id with the index key, the same check already done for tombstones.
+func TestScrubVolumeDataChecksLiveNeedleId(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	const liveID = uint64(1)
+	offset, _, _, err := v.writeNeedle2(newRandomNeedle(liveID), true, false, false)
+	if err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	syncVolumeFiles(t, v)
+
+	if errs := scrubVolumeErrors(t, v); len(errs) != 0 {
+		t.Fatalf("healthy needle must pass scrub, got %v", errs)
+	}
+
+	corruptedID := make([]byte, types.NeedleIdSize)
+	types.NeedleIdToBytes(corruptedID, types.Uint64ToNeedleId(99))
+	if _, err := v.DataBackend.WriteAt(corruptedID, int64(offset)+types.CookieSize); err != nil {
+		t.Fatalf("corrupt live needle ID: %v", err)
+	}
+	if err := v.DataBackend.Sync(); err != nil {
+		t.Fatalf("sync corrupted .dat: %v", err)
+	}
+
+	if errs := scrubVolumeErrors(t, v); !strings.Contains(fmt.Sprint(errs), "does not match needle's Id") {
+		t.Fatalf("scrub should report the corrupted live needle's Id, got %v", errs)
+	}
+}
+
+func TestScrubVolumeDataReportsTruncatedLocalDeletionTombstone(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	const deletedID = uint64(1)
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(deletedID), true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	if _, err := v.doDeleteRequest(newEmptyNeedle(deletedID)); err != nil {
+		t.Fatalf("delete needle: %v", err)
+	}
+	syncVolumeFiles(t, v)
+
+	tombstoneOffset := localTombstoneOffset(t, v, deletedID)
+	if err := v.DataBackend.Truncate(tombstoneOffset.ToActualOffset() + int64(types.NeedleHeaderSize)); err != nil {
+		t.Fatalf("truncate tombstone: %v", err)
+	}
+	if err := v.DataBackend.Sync(); err != nil {
+		t.Fatalf("sync truncated .dat: %v", err)
+	}
+
+	if errs := scrubVolumeErrors(t, v); !strings.Contains(fmt.Sprint(errs), "failed to read needle 1 on volume 1: EOF") {
+		t.Fatalf("scrub should report the truncated tombstone read, got %v", errs)
 	}
 }
 
@@ -197,7 +304,7 @@ func TestCheckVolumeDataIntegrityWithDeletionTombstone(t *testing.T) {
 
 	for i := 1; i <= 3; i++ {
 		n := newRandomNeedle(uint64(i))
-		if _, _, _, err := v.writeNeedle2(n, true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
 			t.Fatalf("write needle %d: %v", i, err)
 		}
 	}
@@ -231,7 +338,7 @@ func TestCheckVolumeDataIntegrityWithDeletionTombstone(t *testing.T) {
 	}
 }
 
-// TestCheckVolumeDataIntegritySortedIndex reproduces issue #9688: after the
+// TestCheckVolumeDataIntegritySortedIndex covers the case where the
 // .idx is rebuilt sorted by key — what weed fix and other rebuilds emitted via
 // needle_map.AscendingVisit — the last file-position entry is the highest-key
 // needle, not the needle at the .dat tail. The integrity check compared that
@@ -251,7 +358,7 @@ func TestCheckVolumeDataIntegritySortedIndex(t *testing.T) {
 	// Write keys in descending order so the highest key lands at the lowest
 	// .dat offset; the last-written needle (lowest key) sits at the tail.
 	for _, id := range []uint64{30, 20, 10} {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(id), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(id), true, false, false); err != nil {
 			t.Fatalf("write needle %d: %v", id, err)
 		}
 	}
@@ -291,7 +398,7 @@ func TestCheckVolumeDataIntegrityVerifiesDeletionTail(t *testing.T) {
 	defer v.Close()
 
 	for i := 1; i <= 3; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false); err != nil {
 			t.Fatalf("write needle %d: %v", i, err)
 		}
 	}
@@ -320,12 +427,24 @@ func TestCheckVolumeDataIntegrityVerifiesDeletionTail(t *testing.T) {
 	}
 	defer idxFile.Close()
 
+	// A read-only volume keeps its tail: the check must report it.
+	v.noWriteOrDelete = true
 	if _, err := CheckVolumeDataIntegrity(v, idxFile); err == nil {
 		t.Fatal("CheckVolumeDataIntegrity should detect bytes past a deletion-tombstone tail")
 	}
+
+	// A writable volume would have a torn needle re-indexed or cut, but 64 zero
+	// bytes are no needle (id 0): they are reported and left in place.
+	v.noWriteOrDelete = false
+	if _, err := CheckVolumeDataIntegrity(v, idxFile); err == nil {
+		t.Fatal("CheckVolumeDataIntegrity should detect zero bytes past a deletion-tombstone tail on a writable volume")
+	}
+	if got, _, _ := v.DataBackend.GetStat(); got != datSize+64 {
+		t.Fatalf(".dat is %d bytes after the check, want %d (nothing cut)", got, datSize+64)
+	}
 }
 
-// TestVolumeLoadStaysWritableWithKeySortedIndex reproduces issue #9688 end to
+// TestVolumeLoadStaysWritableWithKeySortedIndex exercises end to
 // end through the real volume load path: a volume whose .idx is sorted by key
 // (the on-disk state weed fix left behind) must reload writable, not flip to
 // read-only — and a live needle must still be readable afterward.
@@ -341,7 +460,7 @@ func TestVolumeLoadStaysWritableWithKeySortedIndex(t *testing.T) {
 	}
 	wanted := newRandomNeedle(10)
 	for _, n := range []*needle.Needle{newRandomNeedle(30), newRandomNeedle(20), wanted} {
-		if _, _, _, err := v.writeNeedle2(n, true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
 			t.Fatalf("write needle %d: %v", n.Id, err)
 		}
 	}
@@ -361,7 +480,7 @@ func TestVolumeLoadStaysWritableWithKeySortedIndex(t *testing.T) {
 	}
 	defer reloaded.Close()
 	if reloaded.noWriteOrDelete {
-		t.Fatal("volume flipped read-only after reload with a key-sorted .idx (issue #9688)")
+		t.Fatal("volume flipped read-only after reload with a key-sorted .idx")
 	}
 
 	// The surviving needle is still readable, and new writes still succeed.
@@ -369,7 +488,7 @@ func TestVolumeLoadStaysWritableWithKeySortedIndex(t *testing.T) {
 	if _, err := reloaded.readNeedle(rn, nil, nil); err != nil {
 		t.Fatalf("read surviving needle after reload: %v", err)
 	}
-	if _, _, _, err := reloaded.writeNeedle2(newRandomNeedle(40), true, false); err != nil {
+	if _, _, _, err := reloaded.writeNeedle2(newRandomNeedle(40), true, false, false); err != nil {
 		t.Fatalf("write after reload should succeed: %v", err)
 	}
 }
@@ -414,9 +533,60 @@ func rewriteIdxSortedByKey(t *testing.T, idxPath string) {
 	}
 }
 
+// localTombstoneOffset returns the .dat offset a local delete's .idx row
+// points at: the physical tombstone record.
+func localTombstoneOffset(t *testing.T, v *Volume, id uint64) types.Offset {
+	t.Helper()
+	idxFile, err := os.OpenFile(v.FileName(".idx"), os.O_RDONLY, 0644)
+	if err != nil {
+		t.Fatalf("open .idx: %v", err)
+	}
+	defer idxFile.Close()
+
+	var offset types.Offset
+	if err := idx.WalkIndexFile(idxFile, 0, func(key types.NeedleId, o types.Offset, size types.Size) error {
+		if key == types.Uint64ToNeedleId(id) && !o.IsZero() && size.IsDeleted() {
+			offset = o
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("walk .idx: %v", err)
+	}
+	if offset.IsZero() {
+		t.Fatalf("expected a local deletion tombstone for needle %d in .idx", id)
+	}
+	return offset
+}
+
+// scrubVolumeErrors runs a full scrub over the volume's current .idx.
+func scrubVolumeErrors(t *testing.T, v *Volume) []error {
+	t.Helper()
+	idxFile, err := os.OpenFile(v.FileName(".idx"), os.O_RDONLY, 0644)
+	if err != nil {
+		t.Fatalf("open .idx: %v", err)
+	}
+	defer idxFile.Close()
+	idxStat, err := idxFile.Stat()
+	if err != nil {
+		t.Fatalf("stat .idx: %v", err)
+	}
+	_, errs := v.scrubVolumeData(idxFile, idxStat.Size())
+	return errs
+}
+
+func syncVolumeFiles(t *testing.T, v *Volume) {
+	t.Helper()
+	if err := v.DataBackend.Sync(); err != nil {
+		t.Fatalf("sync .dat: %v", err)
+	}
+	if err := v.nm.Sync(); err != nil {
+		t.Fatalf("sync .idx: %v", err)
+	}
+}
+
 // TestMaxNeedleEnd ensures the needle map's MaxNeedleEnd accumulator lets
 // volume.load() detect an .idx that references bytes past the end of the .dat
-// — the deeper-than-tail corruption shape from issue #8928 that the existing
+// — the deeper-than-tail corruption shape that the existing
 // last-10-entries scan cannot see. The check is populated by the load walk
 // and read by volume.load() to flip the volume read-only.
 func TestMaxNeedleEnd(t *testing.T) {
@@ -431,7 +601,7 @@ func TestMaxNeedleEnd(t *testing.T) {
 	// A handful of healthy needles establishes a baseline .dat/.idx.
 	for i := 1; i <= 4; i++ {
 		n := newRandomNeedle(uint64(i))
-		if _, _, _, err := v.writeNeedle2(n, true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
 			t.Fatalf("write needle %d: %v", i, err)
 		}
 	}
diff --git a/weed/storage/volume_destroy_ec_vif_test.go b/weed/storage/volume_destroy_ec_vif_test.go
index c90f68301e..c51aeea883 100644
--- a/weed/storage/volume_destroy_ec_vif_test.go
+++ b/weed/storage/volume_destroy_ec_vif_test.go
@@ -22,7 +22,7 @@ func TestDestroyKeepsVifWhenEcCoexists(t *testing.T) {
 	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
 	require.NoError(t, err)
 	v.location = newTestDiskLocation(dir)
-	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false)
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false, false)
 	require.NoError(t, err)
 
 	base := VolumeFileName(dir, "", 1)
@@ -32,7 +32,7 @@ func TestDestroyKeepsVifWhenEcCoexists(t *testing.T) {
 	ecxPath := erasure_coding.EcShardFileName("", dir, 1) + ".ecx"
 	require.NoError(t, os.WriteFile(ecxPath, []byte("ec-index"), 0o644))
 
-	require.NoError(t, v.Destroy(false, false))
+	require.NoError(t, v.Destroy(false, false, false))
 
 	assertFileExist(t, false, base+".dat")
 	assertFileExist(t, false, base+".idx")
@@ -47,14 +47,14 @@ func TestDestroyRemovesVifWhenNoEc(t *testing.T) {
 	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
 	require.NoError(t, err)
 	v.location = newTestDiskLocation(dir)
-	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false)
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false, false)
 	require.NoError(t, err)
 
 	base := VolumeFileName(dir, "", 1)
 	vifPath := base + ".vif"
 	require.NoError(t, os.WriteFile(vifPath, []byte("regular-volume-info"), 0o644))
 
-	require.NoError(t, v.Destroy(false, false))
+	require.NoError(t, v.Destroy(false, false, false))
 
 	assertFileExist(t, false, base+".dat")
 	assertFileExist(t, false, base+".idx")
diff --git a/weed/storage/volume_idx_rebuild.go b/weed/storage/volume_idx_rebuild.go
new file mode 100644
index 0000000000..214a99d323
--- /dev/null
+++ b/weed/storage/volume_idx_rebuild.go
@@ -0,0 +1,98 @@
+package storage
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle_map"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// VolumeFileScanner4RebuildIdx writes one .idx row per .dat record, in .dat
+// append order, which is the shape the volume server's own writes leave behind.
+type VolumeFileScanner4RebuildIdx struct {
+	writer  *bufio.Writer
+	datSize int64
+	version needle.Version
+}
+
+func (scanner *VolumeFileScanner4RebuildIdx) VisitSuperBlock(superBlock super_block.SuperBlock) error {
+	return nil
+}
+
+func (scanner *VolumeFileScanner4RebuildIdx) ReadNeedleBody() bool {
+	return false
+}
+
+func (scanner *VolumeFileScanner4RebuildIdx) VisitNeedle(n *needle.Needle, offset int64, needleHeader, needleBody []byte) error {
+	// Stop at the first thing that is not a record: an all-zero header is
+	// unwritten space, a negative size is a corrupt header, and a record
+	// reaching past the end of .dat is a torn append. Indexing any of them
+	// fabricates rows, and io.EOF here stops the walk before it advances by a
+	// bad size -- a negative one moves the offset backwards.
+	if (n.Size == 0 && n.Id == 0) || n.Size < 0 {
+		return io.EOF
+	}
+	if needleDiskEnd(types.ToOffset(offset), n.Size, scanner.version) > scanner.datSize {
+		return io.EOF
+	}
+	size := n.Size
+	if !size.IsValid() {
+		size = types.TombstoneFileSize
+	}
+	_, err := scanner.writer.Write(needle_map.ToBytes(n.Id, types.ToOffset(offset), size))
+	return err
+}
+
+// rebuildIdxFile regenerates the volume's .idx from its .dat. The whole index
+// is derivable from the data file, so a volume whose index directory has no
+// .idx -- a -dir.idx pointed at an empty directory, or a lost index -- comes
+// back on its own instead of taking the volume server down. The rows go to a
+// temp file that is renamed in, so an interrupted rebuild leaves no partial
+// index behind.
+func (v *Volume) rebuildIdxFile() error {
+	if v.DataBackend == nil {
+		return fmt.Errorf("volume %d has no data backend", v.Id)
+	}
+
+	datSize, _, err := v.DataBackend.GetStat()
+	if err != nil {
+		return fmt.Errorf("stat %s: %w", v.FileName(".dat"), err)
+	}
+
+	idxFileName := v.FileName(".idx")
+	if err := os.MkdirAll(filepath.Dir(idxFileName), 0755); err != nil {
+		return fmt.Errorf("create idx dir for %s: %w", idxFileName, err)
+	}
+	tmpFileName := idxFileName + ".tmp"
+	tmpFile, err := os.OpenFile(tmpFileName, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return fmt.Errorf("create %s: %w", tmpFileName, err)
+	}
+	defer os.Remove(tmpFileName)
+
+	scanner := &VolumeFileScanner4RebuildIdx{writer: bufio.NewWriter(tmpFile), datSize: datSize, version: v.Version()}
+	err = ScanVolumeFileFrom(scanner.version, v.DataBackend, int64(v.SuperBlock.BlockSize()), scanner)
+	if err == nil {
+		err = scanner.writer.Flush()
+	}
+	if err == nil {
+		err = tmpFile.Sync()
+	}
+	if closeErr := tmpFile.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
+		return fmt.Errorf("rebuild %s from %s: %w", idxFileName, v.FileName(".dat"), err)
+	}
+
+	if err := os.Rename(tmpFileName, idxFileName); err != nil {
+		return fmt.Errorf("rename %s: %w", tmpFileName, err)
+	}
+	return fsyncDir(filepath.Dir(idxFileName))
+}
diff --git a/weed/storage/volume_idx_rebuild_test.go b/weed/storage/volume_idx_rebuild_test.go
new file mode 100644
index 0000000000..a71abee833
--- /dev/null
+++ b/weed/storage/volume_idx_rebuild_test.go
@@ -0,0 +1,265 @@
+package storage
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// Pointing -dir.idx at a directory with no .idx used to abort the whole volume
+// server in checkIdxFile; the index is derivable from the .dat, so it must be
+// rebuilt in place instead.
+func TestLoad_MovedIdxDirectory_RebuildsIdx(t *testing.T) {
+	root := t.TempDir()
+	dataDir := filepath.Join(root, "data")
+	oldIdxDir := filepath.Join(root, "idxA")
+	newIdxDir := filepath.Join(root, "idxB")
+	for _, dir := range []string{dataDir, oldIdxDir, newIdxDir} {
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			t.Fatalf("mkdir %s: %v", dir, err)
+		}
+	}
+
+	v, err := NewVolume(dataDir, oldIdxDir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("create volume: %v", err)
+	}
+	for id := uint64(1); id <= 3; id++ {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(id), true, false, false); err != nil {
+			t.Fatalf("seed write %d: %v", id, err)
+		}
+	}
+	if _, err := v.deleteNeedle2(newRandomNeedle(2)); err != nil {
+		t.Fatalf("seed delete: %v", err)
+	}
+	wantCount, wantDeleted := v.nm.FileCount(), v.nm.DeletedCount()
+	v.Close()
+
+	if _, err := os.Stat(filepath.Join(oldIdxDir, "1.idx")); err != nil {
+		t.Fatalf("seeded idx should live in the old idx dir: %v", err)
+	}
+
+	v2, err := NewVolume(dataDir, newIdxDir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("reload against the new idx dir: %v", err)
+	}
+	defer v2.Close()
+
+	if _, err := os.Stat(filepath.Join(newIdxDir, "1.idx")); err != nil {
+		t.Fatalf("idx not rebuilt in the new idx dir: %v", err)
+	}
+	if got := v2.nm.FileCount(); got != wantCount {
+		t.Errorf("file count = %d, want %d", got, wantCount)
+	}
+	if got := v2.nm.DeletedCount(); got != wantDeleted {
+		t.Errorf("deleted count = %d, want %d", got, wantDeleted)
+	}
+	old, err := os.ReadFile(filepath.Join(oldIdxDir, "1.idx"))
+	if err != nil {
+		t.Fatalf("read the seeded idx: %v", err)
+	}
+	rebuilt, err := os.ReadFile(filepath.Join(newIdxDir, "1.idx"))
+	if err != nil {
+		t.Fatalf("read the rebuilt idx: %v", err)
+	}
+	if !bytes.Equal(old, rebuilt) {
+		t.Errorf("rebuilt idx (%d bytes) differs from the one the server wrote (%d bytes)", len(rebuilt), len(old))
+	}
+	if v2.noWriteOrDelete {
+		t.Errorf("volume marked read-only after the rebuild")
+	}
+}
+
+// A .dat padded with zeros must not be indexed as needle 0 rows: the walk stops
+// where the records do.
+func TestRebuildIdx_StopsAtZeroPaddedDatTail(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("create volume: %v", err)
+	}
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+		t.Fatalf("seed write: %v", err)
+	}
+	v.Close()
+
+	base := VolumeFileName(dir, "", 1)
+	seeded, err := os.ReadFile(base + ".idx")
+	if err != nil {
+		t.Fatalf("read the seeded idx: %v", err)
+	}
+	datSize, err := os.Stat(base + ".dat")
+	if err != nil {
+		t.Fatalf("stat dat: %v", err)
+	}
+	if err := os.Truncate(base+".dat", datSize.Size()+4096); err != nil {
+		t.Fatalf("pad dat: %v", err)
+	}
+	if err := os.Remove(base + ".idx"); err != nil {
+		t.Fatalf("drop idx: %v", err)
+	}
+
+	v2, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	defer v2.Close()
+
+	rebuilt, err := os.ReadFile(base + ".idx")
+	if err != nil {
+		t.Fatalf("read the rebuilt idx: %v", err)
+	}
+	if !bytes.Equal(seeded, rebuilt) {
+		t.Errorf("rebuilt idx has %d bytes, want the %d the server wrote", len(rebuilt), len(seeded))
+	}
+}
+
+// A .dat whose last append was torn mid-body must not gain an index row that
+// points past the end of the file.
+func TestRebuildIdx_SkipsTruncatedDatTail(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("create volume: %v", err)
+	}
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+		t.Fatalf("seed write: %v", err)
+	}
+	base := VolumeFileName(dir, "", 1)
+	kept, err := os.ReadFile(base + ".idx")
+	if err != nil {
+		t.Fatalf("read the seeded idx: %v", err)
+	}
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(2), true, false, false); err != nil {
+		t.Fatalf("seed torn write: %v", err)
+	}
+	v.Close()
+
+	// Chop the second needle's body, leaving its header intact.
+	datSize, err := os.Stat(base + ".dat")
+	if err != nil {
+		t.Fatalf("stat dat: %v", err)
+	}
+	if err := os.Truncate(base+".dat", datSize.Size()-8); err != nil {
+		t.Fatalf("tear dat: %v", err)
+	}
+	if err := os.Remove(base + ".idx"); err != nil {
+		t.Fatalf("drop idx: %v", err)
+	}
+
+	v2, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	defer v2.Close()
+
+	rebuilt, err := os.ReadFile(base + ".idx")
+	if err != nil {
+		t.Fatalf("read the rebuilt idx: %v", err)
+	}
+	if !bytes.Equal(kept, rebuilt) {
+		t.Errorf("rebuilt idx has %d bytes, want the %d covering only the intact needle", len(rebuilt), len(kept))
+	}
+	if maxEnd := v2.nm.MaxNeedleEnd(); maxEnd > datSize.Size()-8 {
+		t.Errorf("rebuilt idx reaches %d, past the %d-byte .dat", maxEnd, datSize.Size()-8)
+	}
+}
+
+// A corrupt header carrying a negative size advances the .dat walk backwards,
+// which cycles forever between it and the record before it.
+func TestRebuildIdx_StopsAtNegativeSizeHeader(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("create volume: %v", err)
+	}
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+		t.Fatalf("seed write: %v", err)
+	}
+	base := VolumeFileName(dir, "", 1)
+	kept, err := os.ReadFile(base + ".idx")
+	if err != nil {
+		t.Fatalf("read the seeded idx: %v", err)
+	}
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(2), true, false, false); err != nil {
+		t.Fatalf("seed second write: %v", err)
+	}
+	nv, ok := v.nm.Get(2)
+	if !ok {
+		t.Fatalf("second needle missing from the index")
+	}
+	corruptAt := nv.Offset.ToActualOffset()
+	v.Close()
+
+	// Overwrite the second needle's size field with a negative int32.
+	dat, err := os.OpenFile(base+".dat", os.O_WRONLY, 0644)
+	if err != nil {
+		t.Fatalf("open dat: %v", err)
+	}
+	if _, err := dat.WriteAt([]byte{0xff, 0xff, 0xf0, 0x00}, corruptAt+types.CookieSize+types.NeedleIdSize); err != nil {
+		t.Fatalf("corrupt size field: %v", err)
+	}
+	dat.Close()
+	if err := os.Remove(base + ".idx"); err != nil {
+		t.Fatalf("drop idx: %v", err)
+	}
+
+	// Pre-fix the rebuild walked backwards from here and never terminated.
+	v2, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	defer v2.Close()
+
+	rebuilt, err := os.ReadFile(base + ".idx")
+	if err != nil {
+		t.Fatalf("read the rebuilt idx: %v", err)
+	}
+	if !bytes.Equal(kept, rebuilt) {
+		t.Errorf("rebuilt idx has %d bytes, want the %d covering only the intact needle", len(rebuilt), len(kept))
+	}
+}
+
+// A rebuild that cannot write skips just this volume; it used to call
+// glog.Fatalf and take the whole volume server down with it.
+func TestRebuildIdx_UnwritableIdxDirSkipsOnlyThisVolume(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root ignores directory permissions")
+	}
+	root := t.TempDir()
+	dataDir := filepath.Join(root, "data")
+	idxDir := filepath.Join(root, "idx")
+	for _, dir := range []string{dataDir, idxDir} {
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			t.Fatalf("mkdir %s: %v", dir, err)
+		}
+	}
+
+	v, err := NewVolume(dataDir, dataDir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("create volume: %v", err)
+	}
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+		t.Fatalf("seed write: %v", err)
+	}
+	v.Close()
+	if err := os.Remove(VolumeFileName(dataDir, "", 1) + ".idx"); err != nil {
+		t.Fatalf("drop idx: %v", err)
+	}
+	if err := os.Chmod(idxDir, 0555); err != nil {
+		t.Fatalf("seal idx dir: %v", err)
+	}
+	defer os.Chmod(idxDir, 0755)
+
+	if _, err := NewVolume(dataDir, idxDir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0); err == nil {
+		t.Errorf("expected a load error for an unwritable idx dir")
+	}
+}
diff --git a/weed/storage/volume_idx_repair_test.go b/weed/storage/volume_idx_repair_test.go
index e78f03e9b3..6b155477c5 100644
--- a/weed/storage/volume_idx_repair_test.go
+++ b/weed/storage/volume_idx_repair_test.go
@@ -1,6 +1,8 @@
 package storage
 
 import (
+	"bytes"
+	"errors"
 	"os"
 	"path/filepath"
 	"testing"
@@ -40,7 +42,7 @@ func writeTestVolume(t *testing.T, dir string, needleCount int) map[uint64]*need
 	written := make(map[uint64]*needle.Needle)
 	for i := 1; i <= needleCount; i++ {
 		n := newRandomNeedle(uint64(i))
-		if _, _, _, err := v.writeNeedle2(n, true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
 			v.Close()
 			t.Fatalf("write needle %d: %v", i, err)
 		}
@@ -219,3 +221,96 @@ func TestRepairIdxHeadTombstones_KeepsDeletedNeedlesDeleted(t *testing.T) {
 		t.Fatalf("needle 1 should have been recovered: %v", err)
 	}
 }
+
+// TestStaleIndexEntry_HealsOnWrite covers a damaged index entry that resolves
+// to a different needle: reads must miss instead of serving the wrong needle,
+// and the next write for the key must re-index it rather than be rejected as
+// a cookie conflict.
+func TestStaleIndexEntry_HealsOnWrite(t *testing.T) {
+	dir := t.TempDir()
+	written := writeTestVolume(t, dir, 5)
+
+	v := mustReload(t, dir)
+	defer v.Close()
+
+	// point key 9 at needle 2's record with a size that does not match the
+	// record, as a corrupt index entry would look
+	const staleKey = 9
+	nv, ok := v.nm.Get(types.Uint64ToNeedleId(2))
+	if !ok {
+		t.Fatal("needle 2 missing from index")
+	}
+	if err := v.nm.Put(types.Uint64ToNeedleId(staleKey), nv.Offset, nv.Size+1); err != nil {
+		t.Fatalf("plant stale index entry: %v", err)
+	}
+
+	if _, err := v.readNeedle(newEmptyNeedle(staleKey), nil, nil); err == nil {
+		t.Fatal("stale-index read served needle 2's data")
+	}
+
+	stream := newEmptyNeedle(staleKey)
+	stream.DataSize = written[2].DataSize
+	if err := v.readNeedleDataInto(stream, &ReadOption{ReadBufferSize: 1024}, &bytes.Buffer{}, 0, int64(stream.DataSize)); err != ErrorNotFound {
+		t.Fatalf("stale-index stream: want ErrorNotFound, got %v", err)
+	}
+
+	n := newRandomNeedle(staleKey)
+	n.Cookie = 0xABCD
+	if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+		t.Fatalf("write over stale index entry: %v", err)
+	}
+	if got := mustRead(t, v, staleKey); !bytes.Equal(got, n.Data) {
+		t.Fatalf("needle %d after re-index: got %d bytes, want %d", staleKey, len(got), len(n.Data))
+	}
+}
+
+// TestStaleIndexEntry_SurvivesFailedWrite checks that a stale index entry is
+// only replaced once the new record commits: a durable write rolled back by
+// a failed fsync leaves the index exactly as it found it.
+func TestStaleIndexEntry_SurvivesFailedWrite(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	existing := fixedNeedle(2, "existing")
+	if _, _, _, err := v.writeNeedle2(existing, true, true, true); err != nil {
+		t.Fatalf("write needle 2: %v", err)
+	}
+	nv, ok := v.nm.Get(existing.Id)
+	if !ok {
+		t.Fatal("needle 2 missing from index")
+	}
+
+	staleId := types.Uint64ToNeedleId(9)
+	if err := v.nm.Put(staleId, nv.Offset, nv.Size+1); err != nil {
+		t.Fatalf("plant stale index entry: %v", err)
+	}
+
+	counting.syncErr = errors.New("batch fsync failed")
+	if _, _, _, err := v.writeNeedle2(fixedNeedle(9, "replacement"), true, true, false); err == nil {
+		t.Fatal("a write whose fsync failed must not be acknowledged")
+	}
+
+	entry, ok := v.nm.Get(staleId)
+	if !ok {
+		t.Fatal("a failed write dropped the index entry it meant to replace")
+	}
+	if entry.Offset != nv.Offset || entry.Size != nv.Size+1 {
+		t.Fatalf("index entry changed under a failed write: %+v, want %+v", entry, nv)
+	}
+}
+
+// TestStaleIndexEntry_KeepsCookieConflictForSameKey checks that an entry
+// resolving to the same needle id still enforces the cookie check: only
+// cross-key corruption is dropped.
+func TestStaleIndexEntry_KeepsCookieConflictForSameKey(t *testing.T) {
+	dir := t.TempDir()
+	writeTestVolume(t, dir, 3)
+
+	v := mustReload(t, dir)
+	defer v.Close()
+
+	n := newRandomNeedle(2)
+	n.Cookie = 0xABCD
+	if _, _, _, err := v.writeNeedle2(n, true, false, false); err == nil {
+		t.Fatal("write with a foreign cookie over an existing key should be rejected")
+	}
+}
diff --git a/weed/storage/volume_info.go b/weed/storage/volume_info.go
index e993c9c58a..761489c505 100644
--- a/weed/storage/volume_info.go
+++ b/weed/storage/volume_info.go
@@ -2,6 +2,7 @@ package storage
 
 import (
 	"fmt"
+	"math"
 	"sort"
 	"sync"
 
@@ -10,23 +11,44 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 )
 
+// Held for every volume replica, so the fields are grouped by size rather than
+// by meaning: interleaved, each one-byte field rounds up to a whole word.
 type VolumeInfo struct {
-	Id                needle.VolumeId
-	Size              uint64
-	ReplicaPlacement  *super_block.ReplicaPlacement
-	Ttl               *needle.TTL
-	DiskType          string
-	DiskId            uint32
-	Collection        string
-	Version           needle.Version
-	FileCount         int
-	DeleteCount       int
-	DeletedByteCount  uint64
-	ReadOnly          bool
-	CompactRevision   uint32
-	ModifiedAtSecond  int64
+	Collection string
+	DiskType   string
+	// The backend a remote volume lives in. Not the key within it: a master
+	// decides nothing from the key and would hold one per volume, unique and so
+	// unshareable, while the server holding the volume reports it on demand.
 	RemoteStorageName string
-	RemoteStorageKey  string
+
+	ReplicaPlacement *super_block.ReplicaPlacement
+	Ttl              *needle.TTL
+
+	Size             uint64
+	DeletedByteCount uint64
+	ModifiedAtSecond int64
+
+	Id              needle.VolumeId
+	DiskId          uint32
+	CompactRevision uint32
+	// Counted in uint32: a volume is capped well below 4.29 billion needles,
+	// and two words per replica is worth more than the headroom.
+	FileCount   uint32
+	DeleteCount uint32
+
+	Version           needle.Version
+	ReadOnly          bool
+	ReadOnlyCanDelete bool
+}
+
+// countAsUint32 narrows a reported count without letting it wrap. Nothing
+// should reach the ceiling, and a count that pretends to is better pinned
+// there than turned into a small number.
+func countAsUint32(n uint64) uint32 {
+	if n > math.MaxUint32 {
+		return math.MaxUint32
+	}
+	return uint32(n)
 }
 
 func NewVolumeInfo(m *master_pb.VolumeInformationMessage) (vi VolumeInfo, err error) {
@@ -34,15 +56,15 @@ func NewVolumeInfo(m *master_pb.VolumeInformationMessage) (vi VolumeInfo, err er
 		Id:                needle.VolumeId(m.Id),
 		Size:              m.Size,
 		Collection:        internVolumeString(m.Collection),
-		FileCount:         int(m.FileCount),
-		DeleteCount:       int(m.DeleteCount),
+		FileCount:         countAsUint32(m.FileCount),
+		DeleteCount:       countAsUint32(m.DeleteCount),
 		DeletedByteCount:  m.DeletedByteCount,
 		ReadOnly:          m.ReadOnly,
+		ReadOnlyCanDelete: m.ReadOnlyCanDelete,
 		Version:           needle.Version(m.Version),
 		CompactRevision:   m.CompactRevision,
 		ModifiedAtSecond:  m.ModifiedAtSecond,
 		RemoteStorageName: internVolumeString(m.RemoteStorageName),
-		RemoteStorageKey:  m.RemoteStorageKey,
 		DiskType:          internVolumeString(m.DiskType),
 		DiskId:            m.DiskId,
 	}
@@ -57,9 +79,12 @@ func NewVolumeInfo(m *master_pb.VolumeInformationMessage) (vi VolumeInfo, err er
 
 func NewVolumeInfoFromShort(m *master_pb.VolumeShortInformationMessage) (vi VolumeInfo, err error) {
 	vi = VolumeInfo{
-		Id:         needle.VolumeId(m.Id),
-		Collection: internVolumeString(m.Collection),
-		Version:    needle.Version(m.Version),
+		Id:                needle.VolumeId(m.Id),
+		ReadOnly:          m.ReadOnly,
+		ReadOnlyCanDelete: m.ReadOnlyCanDelete,
+		Collection:        internVolumeString(m.Collection),
+		Version:           needle.Version(m.Version),
+		DiskId:            m.DiskId,
 	}
 	rp, e := super_block.NewReplicaPlacementFromByte(byte(m.ReplicaPlacement))
 	if e != nil {
@@ -119,11 +144,23 @@ func (vi VolumeInfo) String() string {
 	s := fmt.Sprintf("Id:%d, Size:%d, ReplicaPlacement:%s, Collection:%s, Version:%v, Ttl:%s, FileCount:%d, DeleteCount:%d, DeletedByteCount:%d, ReadOnly:%v, ModifiedAtSecond:%d",
 		vi.Id, vi.Size, vi.ReplicaPlacement, vi.Collection, vi.Version, vi.Ttl.String(), vi.FileCount, vi.DeleteCount, vi.DeletedByteCount, vi.ReadOnly, vi.ModifiedAtSecond)
 	if vi.IsRemote() {
-		s += fmt.Sprintf(", RemoteStorageName:%s, RemoteStorageKey:%s", vi.RemoteStorageName, vi.RemoteStorageKey)
+		s += fmt.Sprintf(", RemoteStorageName:%s", vi.RemoteStorageName)
 	}
 	return s
 }
 
+func (vi VolumeInfo) GetCollection() string {
+	return vi.Collection
+}
+
+func (vi VolumeInfo) GetVolumeId() needle.VolumeId {
+	return vi.Id
+}
+
+func (vi VolumeInfo) GetRemoteStorageName() string {
+	return vi.RemoteStorageName
+}
+
 func (vi VolumeInfo) ToVolumeInformationMessage() *master_pb.VolumeInformationMessage {
 	return &master_pb.VolumeInformationMessage{
 		Id:                uint32(vi.Id),
@@ -133,13 +170,13 @@ func (vi VolumeInfo) ToVolumeInformationMessage() *master_pb.VolumeInformationMe
 		DeleteCount:       uint64(vi.DeleteCount),
 		DeletedByteCount:  vi.DeletedByteCount,
 		ReadOnly:          vi.ReadOnly,
+		ReadOnlyCanDelete: vi.ReadOnlyCanDelete,
 		ReplicaPlacement:  uint32(vi.ReplicaPlacement.Byte()),
 		Version:           uint32(vi.Version),
 		Ttl:               vi.Ttl.ToUint32(),
 		CompactRevision:   vi.CompactRevision,
 		ModifiedAtSecond:  vi.ModifiedAtSecond,
 		RemoteStorageName: vi.RemoteStorageName,
-		RemoteStorageKey:  vi.RemoteStorageKey,
 		DiskType:          vi.DiskType,
 		DiskId:            vi.DiskId,
 	}
diff --git a/weed/storage/volume_info/volume_info.go b/weed/storage/volume_info/volume_info.go
index 78c931af62..b10be555de 100644
--- a/weed/storage/volume_info/volume_info.go
+++ b/weed/storage/volume_info/volume_info.go
@@ -3,6 +3,7 @@ package volume_info
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
@@ -68,6 +69,22 @@ func MaybeLoadVolumeInfo(fileName string) (volumeInfo *volume_server_pb.VolumeIn
 	return
 }
 
+// NotCrashDurableError indicates that the .vif file was renamed
+// successfully but the directory entry may not survive a crash. The
+// on-disk file already holds the new metadata, so callers should keep
+// in-memory state aligned with the file rather than rolling back, while
+// still propagating the durability failure to the user.
+type NotCrashDurableError struct {
+	FileName string
+	Err      error
+}
+
+func (e *NotCrashDurableError) Error() string {
+	return fmt.Sprintf("volume info %s saved but not crash-durable: %v", e.FileName, e.Err)
+}
+
+func (e *NotCrashDurableError) Unwrap() error { return e.Err }
+
 func SaveVolumeInfo(fileName string, volumeInfo *volume_server_pb.VolumeInfo) error {
 
 	if exists, _, canWrite, _, _ := util.CheckFile(fileName); exists && !canWrite {
@@ -85,8 +102,49 @@ func SaveVolumeInfo(fileName string, volumeInfo *volume_server_pb.VolumeInfo) er
 		return fmt.Errorf("failed to marshal %s: %v", fileName, marshalErr)
 	}
 
-	if err := util.WriteFile(fileName, text, 0644); err != nil {
-		return fmt.Errorf("failed to write %s: %v", fileName, err)
+	// Write atomically so a write/sync/close failure leaves the existing
+	// .vif file intact. PersistReadOnly rolls back in-memory state on
+	// error; the atomic rename guarantees the durable file still matches
+	// that rolled-back state rather than the requested mode. Use a
+	// unique temp file so concurrent saves for the same volume do not
+	// collide on a shared .tmp path.
+	f, err := os.CreateTemp(filepath.Dir(fileName), filepath.Base(fileName)+".tmp.*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp file for %s: %w", fileName, err)
+	}
+	tmpName := f.Name()
+	if _, err := f.Write(text); err != nil {
+		f.Close()
+		os.Remove(tmpName)
+		return fmt.Errorf("failed to write %s: %w", fileName, err)
+	}
+	if err := f.Chmod(0644); err != nil {
+		f.Close()
+		os.Remove(tmpName)
+		return fmt.Errorf("failed to chmod %s: %w", fileName, err)
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		os.Remove(tmpName)
+		return fmt.Errorf("failed to sync %s: %w", fileName, err)
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(tmpName)
+		return fmt.Errorf("failed to close %s: %w", fileName, err)
+	}
+	if err := os.Rename(tmpName, fileName); err != nil {
+		os.Remove(tmpName)
+		return fmt.Errorf("failed to rename %s: %w", fileName, err)
+	}
+	// The rename has committed the new metadata to the on-disk file.
+	// A directory fsync failure only risks losing the rename across a
+	// crash; the file content is already correct, so callers must not
+	// roll back in-memory state. Return NotCrashDurableError so they
+	// can distinguish this from a pre-commit failure and keep state
+	// aligned with the renamed file while still reporting the issue.
+	if err := util.FsyncDir(filepath.Dir(fileName)); err != nil {
+		glog.Warningf("fsync dir for %s: %v", fileName, err)
+		return &NotCrashDurableError{FileName: fileName, Err: err}
 	}
 
 	return nil
diff --git a/weed/storage/volume_info_counts_test.go b/weed/storage/volume_info_counts_test.go
new file mode 100644
index 0000000000..532b8aad02
--- /dev/null
+++ b/weed/storage/volume_info_counts_test.go
@@ -0,0 +1,56 @@
+package storage
+
+import (
+	"math"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+// The counts are narrowed on the way in, so a report that claims more than a
+// volume can hold must pin at the ceiling rather than wrap to a small number.
+func TestVolumeInfoCountsDoNotWrap(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		reported, want uint64
+	}{
+		{"an ordinary count", 1000, 1000},
+		{"the ceiling", math.MaxUint32, math.MaxUint32},
+		{"past the ceiling", math.MaxUint32 + 1, math.MaxUint32},
+		{"far past it", 1 << 40, math.MaxUint32},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			vi, err := NewVolumeInfo(&master_pb.VolumeInformationMessage{
+				Id: 1, Version: 3, FileCount: tc.reported, DeleteCount: tc.reported,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if uint64(vi.FileCount) != tc.want {
+				t.Errorf("file count %d, want %d", vi.FileCount, tc.want)
+			}
+			if uint64(vi.DeleteCount) != tc.want {
+				t.Errorf("delete count %d, want %d", vi.DeleteCount, tc.want)
+			}
+		})
+	}
+}
+
+// Deletions are tracked apart from the totals they come off, so a replica can
+// transiently report more deleted than it holds. Unsigned counts make that a
+// wrap rather than a negative, so it stays guarded.
+func TestVolumeInfoSurvivesMoreDeletesThanFiles(t *testing.T) {
+	vi, err := NewVolumeInfo(&master_pb.VolumeInformationMessage{
+		Id: 1, Version: 3, FileCount: 10, DeleteCount: 50,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if vi.FileCount != 10 || vi.DeleteCount != 50 {
+		t.Fatalf("counts not carried across: %d/%d", vi.FileCount, vi.DeleteCount)
+	}
+	m := vi.ToVolumeInformationMessage()
+	if m.FileCount != 10 || m.DeleteCount != 50 {
+		t.Errorf("round trip changed the counts: %d/%d", m.FileCount, m.DeleteCount)
+	}
+}
diff --git a/weed/storage/volume_info_intern_test.go b/weed/storage/volume_info_intern_test.go
index 880dc1a8bf..5ac7bf52ac 100644
--- a/weed/storage/volume_info_intern_test.go
+++ b/weed/storage/volume_info_intern_test.go
@@ -27,7 +27,6 @@ func TestRepeatedVolumeStringsAreShared(t *testing.T) {
 			Collection:        string([]byte("somecollection")),
 			DiskType:          string([]byte("ssd")),
 			RemoteStorageName: string([]byte("s3cold")),
-			RemoteStorageKey:  string([]byte("seaweed/somecollection/1.dat")),
 		}
 	}
 
@@ -48,9 +47,6 @@ func TestRepeatedVolumeStringsAreShared(t *testing.T) {
 		{"Collection", first.Collection, second.Collection, true},
 		{"DiskType", first.DiskType, second.DiskType, true},
 		{"RemoteStorageName", first.RemoteStorageName, second.RemoteStorageName, true},
-		// Unique per volume: interning it would fill the table rather than
-		// share anything.
-		{"RemoteStorageKey", first.RemoteStorageKey, second.RemoteStorageKey, false},
 	} {
 		if tc.a != tc.b {
 			t.Fatalf("%s: values differ, %q vs %q", tc.name, tc.a, tc.b)
diff --git a/weed/storage/volume_info_layout_test.go b/weed/storage/volume_info_layout_test.go
new file mode 100644
index 0000000000..6d862b96dd
--- /dev/null
+++ b/weed/storage/volume_info_layout_test.go
@@ -0,0 +1,34 @@
+package storage
+
+import (
+	"reflect"
+	"testing"
+	"unsafe"
+)
+
+// Nothing else in the package would notice if someone grouped the fields by
+// meaning again, and the padding is multiplied by every volume a master holds.
+func TestVolumeInfoHasNoInteriorPadding(t *testing.T) {
+	typ := reflect.TypeOf(VolumeInfo{})
+
+	var used, interior uintptr
+	prevEnd := uintptr(0)
+	for i := 0; i < typ.NumField(); i++ {
+		f := typ.Field(i)
+		if gap := f.Offset - prevEnd; gap > 0 {
+			t.Errorf("%d bytes of padding before %s, at offset %d: order the fields by size so they pack",
+				gap, f.Name, prevEnd)
+			interior += gap
+		}
+		used += f.Type.Size()
+		prevEnd = f.Offset + f.Type.Size()
+	}
+
+	size := unsafe.Sizeof(VolumeInfo{})
+	if tail := size - prevEnd; tail > 7 {
+		t.Errorf("%d bytes of padding at the end, more than alignment requires", tail)
+	}
+	if interior == 0 {
+		t.Logf("%d bytes of fields in a %d byte struct", used, size)
+	}
+}
diff --git a/weed/storage/volume_info_test.go b/weed/storage/volume_info_test.go
index a01e1fc9dc..6e155705c8 100644
--- a/weed/storage/volume_info_test.go
+++ b/weed/storage/volume_info_test.go
@@ -3,6 +3,7 @@ package storage
 import (
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 )
 
@@ -25,3 +26,17 @@ func TestSortVolumeInfos(t *testing.T) {
 		}
 	}
 }
+
+func TestNewVolumeInfoFromShortKeepsDiskId(t *testing.T) {
+	vi, err := NewVolumeInfoFromShort(&master_pb.VolumeShortInformationMessage{
+		Id:      7,
+		Version: 3,
+		DiskId:  3,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if vi.DiskId != 3 {
+		t.Fatalf("DiskId = %d, want 3", vi.DiskId)
+	}
+}
diff --git a/weed/storage/volume_io_error_test.go b/weed/storage/volume_io_error_test.go
index 855dfdd9c3..4d16af712d 100644
--- a/weed/storage/volume_io_error_test.go
+++ b/weed/storage/volume_io_error_test.go
@@ -22,11 +22,11 @@ func (eioBackend) ReadAt(p []byte, off int64) (int, error) { return 0, syscall.E
 func (eioBackend) WriteAt(p []byte, off int64) (int, error) {
 	return len(p), nil
 }
-func (eioBackend) Truncate(int64) error                          { return nil }
-func (eioBackend) Close() error                                  { return nil }
-func (eioBackend) GetStat() (int64, time.Time, error)            { return 0, time.Time{}, nil }
-func (eioBackend) Name() string                                  { return "eio" }
-func (eioBackend) Sync() error                                   { return nil }
+func (eioBackend) Truncate(int64) error               { return nil }
+func (eioBackend) Close() error                       { return nil }
+func (eioBackend) GetStat() (int64, time.Time, error) { return 0, time.Time{}, nil }
+func (eioBackend) Name() string                       { return "eio" }
+func (eioBackend) Sync() error                        { return nil }
 
 func TestCheckReadWriteErrorTracksConsecutiveEIO(t *testing.T) {
 	v := &Volume{}
diff --git a/weed/storage/volume_loading.go b/weed/storage/volume_loading.go
index 8bcbf4aeb8..f237d33836 100644
--- a/weed/storage/volume_loading.go
+++ b/weed/storage/volume_loading.go
@@ -63,15 +63,22 @@ func loadVolumeWithoutWorker(dirname string, dirIdx string, collection string, i
 //
 // No-op when v.nm is already a writable form.
 func (v *Volume) reopenIdxForWrite() error {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
+	return v.reopenIdxForWriteLocked()
+}
 
+// reopenIdxForWriteLocked is reopenIdxForWrite for callers already holding
+// dataFileAccessLock (MarkVolumeReadonly).
+func (v *Volume) reopenIdxForWriteLocked() error {
 	oldNm, isSorted := v.nm.(*SortedFileNeedleMap)
 	if !isSorted {
 		return nil
 	}
 
-	indexFile, err := os.OpenFile(v.FileName(".idx"), os.O_RDWR|os.O_CREATE, 0644)
+	indexFile, err := backend.OpenVolumeFile(v.FileName(".idx"), os.O_RDWR|os.O_CREATE)
 	if err != nil {
 		return fmt.Errorf("reopen %s read-write: %v", v.FileName(".idx"), err)
 	}
@@ -154,7 +161,11 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 
 	if v.volumeInfo.ReadOnly && !v.HasRemoteFile() {
 		// this covers the case where the volume is marked as read-only and has no remote file
-		v.noWriteOrDelete = true
+		if v.volumeInfo.ReadOnlyCanDelete {
+			v.noWriteCanDelete = true
+		} else {
+			v.noWriteOrDelete = true
+		}
 	}
 
 	if v.HasRemoteFile() {
@@ -168,7 +179,7 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 			return fmt.Errorf("load remote file %v: %w", v.volumeInfo, err)
 		}
 		// Set lastModifiedTsSeconds from remote file to prevent premature expiry on startup
-		if len(v.volumeInfo.GetFiles()) > 0 {
+		if len(v.volumeInfo.GetFiles()) > 0 && !v.keepLastModifiedTsOnLoad {
 			remoteFileModifiedTime := v.volumeInfo.GetFiles()[0].GetModifiedTime()
 			if remoteFileModifiedTime > 0 {
 				v.lastModifiedTsSeconds = remoteFileModifiedTime
@@ -188,13 +199,18 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 		}
 		var dataFile *os.File
 		if canWrite {
-			dataFile, err = os.OpenFile(v.FileName(".dat"), os.O_RDWR|os.O_CREATE, 0644)
+			dataFile, err = backend.OpenVolumeFile(v.FileName(".dat"), os.O_RDWR|os.O_CREATE)
 		} else {
 			glog.V(0).Infof("opening %s in READONLY mode", v.FileName(".dat"))
-			dataFile, err = os.Open(v.FileName(".dat"))
+			dataFile, err = backend.OpenVolumeFile(v.FileName(".dat"), os.O_RDONLY)
 			v.noWriteOrDelete = true
 		}
-		v.lastModifiedTsSeconds = uint64(modifiedTime.Unix())
+		if err != nil {
+			return datFileLoadError(v.FileName(".dat"), err)
+		}
+		if !v.keepLastModifiedTsOnLoad {
+			v.lastModifiedTsSeconds = uint64(modifiedTime.Unix())
+		}
 		if fileSize >= super_block.SuperBlockSize {
 			alreadyHasSuperBlock = true
 		}
@@ -208,11 +224,7 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 	}
 
 	if err != nil {
-		if !os.IsPermission(err) {
-			return fmt.Errorf("cannot load volume data %s: %v", v.FileName(".dat"), err)
-		} else {
-			return fmt.Errorf("load data file %s: %v", v.FileName(".dat"), err)
-		}
+		return datFileLoadError(v.FileName(".dat"), err)
 	}
 
 	if alreadyHasSuperBlock {
@@ -226,7 +238,7 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 		glog.V(2).Infof("readSuperBlock volume %d version %v", v.Id, v.SuperBlock.Version)
 		if v.HasRemoteFile() {
 			// maybe temporary network problem
-			glog.Errorf("readSuperBlock remote volume %d: %v", v.Id, err)
+			logRemoteSuperBlockErr(v.Id, err)
 			err = nil
 		}
 	} else {
@@ -250,7 +262,13 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 				glog.Errorf("skip remote volume %d (idx: %s): %v", v.Id, v.FileName(".idx"), err)
 				return fmt.Errorf("check volume idx file %s: %w", v.FileName(".idx"), err)
 			}
-			glog.Fatalf("check volume idx file %s: %v", v.FileName(".idx"), err)
+			// A changed -dir.idx leaves the new directory without an index.
+			// The .dat still holds every row, so rebuild rather than exit.
+			if rebuildErr := v.rebuildIdxFile(); rebuildErr != nil {
+				glog.Errorf("skip volume %d (idx: %s): %v", v.Id, v.FileName(".idx"), rebuildErr)
+				return fmt.Errorf("rebuild volume idx file %s: %w", v.FileName(".idx"), rebuildErr)
+			}
+			glog.V(0).Infof("volume %d: rebuilt %s from %s", v.Id, v.FileName(".idx"), v.FileName(".dat"))
 		}
 		// Recover rows that deletes on a tiered read-only volume overwrote at
 		// the front of .idx. Best effort: a volume that cannot be repaired is
@@ -263,12 +281,12 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 		var indexFile *os.File
 		if v.noWriteOrDelete {
 			glog.V(0).Infoln("open to read file", v.FileName(".idx"))
-			if indexFile, err = os.OpenFile(v.FileName(".idx"), os.O_RDONLY, 0644); err != nil {
+			if indexFile, err = backend.OpenVolumeFile(v.FileName(".idx"), os.O_RDONLY); err != nil {
 				return fmt.Errorf("cannot read Volume Index %s: %v", v.FileName(".idx"), err)
 			}
 		} else {
 			glog.V(1).Infoln("open to write file", v.FileName(".idx"))
-			if indexFile, err = os.OpenFile(v.FileName(".idx"), os.O_RDWR|os.O_CREATE, 0644); err != nil {
+			if indexFile, err = backend.OpenVolumeFile(v.FileName(".idx"), os.O_RDWR|os.O_CREATE); err != nil {
 				return fmt.Errorf("cannot write Volume Index %s: %v", v.FileName(".idx"), err)
 			}
 		}
@@ -283,11 +301,14 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 				v.noWriteOrDelete = true
 				glog.V(0).Infof("volumeDataIntegrityChecking failed %v", err)
 			}
+			if !v.keepLastModifiedTsOnLoad {
+				v.recoverLastModifiedTs(indexFile)
+			}
 		}
 
 		// The post-load structural check below uses the in-memory needle map
-		// to verify that no .idx entry references bytes past the end of .dat
-		// (issue #8928). The check piggybacks on MaxNeedleEnd, which the load
+		// to verify that no .idx entry references bytes past the end of .dat.
+		// The check piggybacks on MaxNeedleEnd, which the load
 		// walks below populate without a second linear scan.
 
 		// Loaders can return a typed-nil pointer with err set; assigning that
@@ -375,7 +396,7 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 		// MaximumNeedleEnd, so this is just a numeric comparison — no extra
 		// disk I/O. A violation marks the volume read-only so a corrupt
 		// .idx left over from a crashed batched write does not silently
-		// power vacuum to drop reachable data. See issue #8928. err == nil
+		// power vacuum to drop reachable data. err == nil
 		// guards against a partial-walk MaximumNeedleEnd.
 		if err == nil && !v.HasRemoteFile() && v.nm != nil && v.DataBackend != nil {
 			if datSize, _, statErr := v.DataBackend.GetStat(); statErr == nil && datSize > 0 {
@@ -388,6 +409,8 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 		}
 	}
 
+	v.restoreUnavailable()
+
 	if !hasVolumeInfoFile {
 		v.volumeInfo.Version = uint32(v.SuperBlock.Version)
 		v.volumeInfo.BytesOffset = uint32(types.OffsetSize)
@@ -404,3 +427,18 @@ func (v *Volume) load(alsoLoadIndex bool, createDatIfMissing bool, needleMapKind
 
 	return err
 }
+
+func datFileLoadError(fileName string, err error) error {
+	if os.IsPermission(err) {
+		return fmt.Errorf("load data file %s: %v", fileName, err)
+	}
+	return fmt.Errorf("cannot load volume data %s: %v", fileName, err)
+}
+
+var logRemoteSuperBlockFault = glog.Errorf
+
+func logRemoteSuperBlockErr(id needle.VolumeId, err error) {
+	if err != nil {
+		logRemoteSuperBlockFault("readSuperBlock remote volume %d: %v", id, err)
+	}
+}
diff --git a/weed/storage/volume_loading_corrupt_idx_test.go b/weed/storage/volume_loading_corrupt_idx_test.go
index ca9d02e1b7..f872ec6222 100644
--- a/weed/storage/volume_loading_corrupt_idx_test.go
+++ b/weed/storage/volume_loading_corrupt_idx_test.go
@@ -17,10 +17,12 @@ func TestLoad_CorruptIdx_NoSegfault(t *testing.T) {
 	if err != nil {
 		t.Fatalf("create volume: %v", err)
 	}
-	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false); err != nil {
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
 		t.Fatalf("seed write: %v", err)
 	}
-	v.PersistReadOnly(true) // reload goes through SortedFileNeedleMap
+	if err := v.PersistReadOnly(true, false); err != nil { // reload goes through SortedFileNeedleMap
+		t.Fatalf("persist read-only: %v", err)
+	}
 	v.Close()
 
 	// Truncate .idx to a non-aligned size so the walk rejects it.
diff --git a/weed/storage/volume_loading_open_fail_test.go b/weed/storage/volume_loading_open_fail_test.go
new file mode 100644
index 0000000000..cc8ec0d132
--- /dev/null
+++ b/weed/storage/volume_loading_open_fail_test.go
@@ -0,0 +1,35 @@
+package storage
+
+import (
+	"os"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+)
+
+// A directory occupying the .dat path fails open even as root; load must
+// return the error rather than crash inside backend.NewDiskFile.
+func TestLoad_DatOpenFail_NoNilPanic(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("create volume: %v", err)
+	}
+	v.Close()
+
+	datPath := VolumeFileName(dir, "", 1) + ".dat"
+	if err := os.Remove(datPath); err != nil {
+		t.Fatalf("remove .dat: %v", err)
+	}
+	if err := os.Mkdir(datPath, 0755); err != nil {
+		t.Fatalf("mkdir .dat: %v", err)
+	}
+
+	v2, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err == nil {
+		v2.Close()
+		t.Fatal("expected error when .dat cannot be opened, got nil")
+	}
+}
diff --git a/weed/storage/volume_mark_writable_test.go b/weed/storage/volume_mark_writable_test.go
index 3d6959de6c..e1ef499e02 100644
--- a/weed/storage/volume_mark_writable_test.go
+++ b/weed/storage/volume_mark_writable_test.go
@@ -21,13 +21,15 @@ func TestMarkVolumeWritable_ReopensPersistedReadOnly(t *testing.T) {
 		t.Fatalf("create volume: %v", err)
 	}
 
-	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false); err != nil {
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
 		t.Fatalf("initial write: %v", err)
 	}
 
 	// Persist read-only state into .vif, then simulate a server restart by
 	// closing and re-opening the volume from the same directory.
-	v.PersistReadOnly(true)
+	if err := v.PersistReadOnly(true, false); err != nil {
+		t.Fatalf("persist read-only: %v", err)
+	}
 	v.Close()
 
 	v2, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
@@ -47,7 +49,7 @@ func TestMarkVolumeWritable_ReopensPersistedReadOnly(t *testing.T) {
 	// once noWriteOrDelete is cleared. Confirm the failure mode the issue
 	// describes — flipping only the flag is not enough.
 	v2.noWriteOrDelete = false
-	_, _, _, writeErr := v2.writeNeedle2(newRandomNeedle(2), true, false)
+	_, _, _, writeErr := v2.writeNeedle2(newRandomNeedle(2), true, false, false)
 	if !errors.Is(writeErr, os.ErrInvalid) {
 		t.Fatalf("expected write through SortedFileNeedleMap to fail with os.ErrInvalid, got %v", writeErr)
 	}
@@ -61,11 +63,38 @@ func TestMarkVolumeWritable_ReopensPersistedReadOnly(t *testing.T) {
 	}
 
 	v2.noWriteOrDelete = false
-	if _, _, _, err := v2.writeNeedle2(newRandomNeedle(3), true, false); err != nil {
+	if _, _, _, err := v2.writeNeedle2(newRandomNeedle(3), true, false, false); err != nil {
 		t.Fatalf("write after reopen: %v", err)
 	}
 }
 
+// A remote-tiered volume marked writable keeps the delete-only mode load()
+// derives — the remote .dat cannot take appends, so "writable" resolves to
+// can-delete even when the mark left noWriteOrDelete without noWriteCanDelete.
+func TestMarkVolumeWritableOnATieredVolumeKeepsDeletesOnly(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+
+	v, _ := tierUpVolumeLive(t, t.TempDir(), 86, b)
+	defer v.Close()
+	// the upload-time mark as a refused MarkTieredDeletable leaves it
+	v.noWriteOrDelete = true
+	v.noWriteCanDelete = false
+
+	location := newTestLocation(10, false, 0)
+	location.SetVolume(86, v)
+	s := &Store{Locations: []*DiskLocation{location}}
+	if err := s.MarkVolumeWritable(86); err != nil {
+		t.Fatalf("mark writable: %v", err)
+	}
+
+	readOnly, orDelete, canDelete, _ := v.ReadOnlyReasons()
+	if orDelete || !canDelete || !readOnly {
+		t.Fatalf("a tiered volume resolves writable to delete-only, got readOnly=%v orDelete=%v canDelete=%v",
+			readOnly, orDelete, canDelete)
+	}
+}
+
 // reopenIdxForWrite must be a no-op when the volume already has a writable
 // needle map — otherwise repeated MarkVolumeWritable calls would churn the
 // index file handle for no reason.
diff --git a/weed/storage/volume_read.go b/weed/storage/volume_read.go
index fafdcdabd3..3112cabb15 100644
--- a/weed/storage/volume_read.go
+++ b/weed/storage/volume_read.go
@@ -22,6 +22,10 @@ func (v *Volume) readNeedle(n *needle.Needle, readOption *ReadOption, onReadSize
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
 
+	if err := v.UnavailableError(); err != nil {
+		return 0, err
+	}
+
 	if v.nm == nil {
 		glog.V(0).Infof("volume %d: needle map not loaded; read returns not-found", v.Id)
 		return -1, ErrorNotFound
@@ -35,6 +39,7 @@ func (v *Volume) readNeedle(n *needle.Needle, readOption *ReadOption, onReadSize
 	if readSize.IsDeleted() {
 		if readOption != nil && readOption.ReadDeleted && readSize != TombstoneFileSize {
 			glog.V(3).Infof("reading deleted %s", n.String())
+			stats.VolumeServerHandlerCounter.WithLabelValues(stats.ReadDeletedNeedle).Inc()
 			readSize = -readSize
 		} else {
 			return -1, ErrorDeleted
@@ -46,7 +51,9 @@ func (v *Volume) readNeedle(n *needle.Needle, readOption *ReadOption, onReadSize
 	if onReadSizeFn != nil {
 		onReadSizeFn(readSize)
 	}
-	if readOption != nil && readOption.AttemptMetaOnly && readSize > PagedReadLimit {
+	// A version 1 needle has no data size field and no metadata after its
+	// data, which ReadNeedleMeta relies on, so it is always read in full.
+	if readOption != nil && readOption.AttemptMetaOnly && v.Version() != needle.Version1 && (readOption.MustMetaOnly || readSize > PagedReadLimit) {
 		readOption.VolumeRevision = v.SuperBlock.CompactionRevision
 		err = n.ReadNeedleMeta(v.DataBackend, nv.Offset.ToActualOffset(), readSize, v.Version())
 		if err == needle.ErrorSizeMismatch && OffsetSize == 4 {
@@ -54,10 +61,17 @@ func (v *Volume) readNeedle(n *needle.Needle, readOption *ReadOption, onReadSize
 			err = n.ReadNeedleMeta(v.DataBackend, nv.Offset.ToActualOffset()+int64(MaxPossibleVolumeSize), readSize, v.Version())
 		}
 		if err != nil {
+			v.checkReadWriteError(err)
 			return 0, err
 		}
 		if !n.IsCompressed() && !n.IsChunkedManifest() {
 			readOption.IsMetaOnly = true
+			// A must-meta-only read ends here, so its success may reset the
+			// streak. For a streamed GET the meta read precedes the payload read,
+			// which reports the outcome itself.
+			if readOption.MustMetaOnly {
+				v.checkReadWriteError(nil)
+			}
 		}
 	}
 	if readOption == nil || !readOption.IsMetaOnly {
@@ -84,10 +98,22 @@ func (v *Volume) readNeedle(n *needle.Needle, readOption *ReadOption, onReadSize
 	return -1, ErrorNotFound
 }
 
+// NoteMetaOnlySuccess records a request that ended at the metadata read
+// (e.g. a HEAD or a cookie mismatch), so its success may reset the streak —
+// unlike a meta read that precedes a payload read.
+func (v *Volume) NoteMetaOnlySuccess() {
+	v.checkReadWriteError(nil)
+}
+
 // read needle at a specific offset
 func (v *Volume) readNeedleMetaAt(n *needle.Needle, offset int64, size int32) (err error) {
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
+
+	if err := v.UnavailableError(); err != nil {
+		return err
+	}
+
 	// read deleted needle meta data
 	if size < 0 {
 		size = 0
@@ -113,6 +139,12 @@ func (v *Volume) readNeedleDataInto(n *needle.Needle, readOption *ReadOption, wr
 	if readOption.HasSlowRead {
 		v.dataFileAccessLock.RLock()
 	}
+	if err := v.UnavailableError(); err != nil {
+		if readOption.HasSlowRead {
+			v.dataFileAccessLock.RUnlock()
+		}
+		return err
+	}
 	if v.nm == nil {
 		if readOption.HasSlowRead {
 			v.dataFileAccessLock.RUnlock()
@@ -147,14 +179,78 @@ func (v *Volume) readNeedleDataInto(n *needle.Needle, readOption *ReadOption, wr
 	}
 
 	buf := mem.Allocate(min(readOption.ReadBufferSize, int(size)))
-	defer mem.Free(buf)
+	// A full-needle read holds the last page back in `pending` until the CRC
+	// matches; `spare` is a second buffer swapped in so the held page is not
+	// overwritten while streaming.
+	var spare []byte
+	defer func() {
+		mem.Free(buf)
+		if spare != nil {
+			mem.Free(spare)
+		}
+	}()
+
+	// The header is not part of the streamed body, so verify the indexed
+	// offset really holds this needle before sending another needle's data.
+	// A slow read dropped the access lock after the index lookup; take it
+	// back for the probe so a compaction commit cannot swap the backend
+	// under it, and resolve the offset the way the streaming loop does.
+	probeHeader := func() error {
+		if readOption.VolumeRevision != v.SuperBlock.CompactionRevision {
+			if v.nm == nil {
+				return ErrorNotFound
+			}
+			refreshed, found := v.nm.Get(n.Id)
+			if !found || refreshed.Offset.IsZero() {
+				return ErrorNotFound
+			}
+			nv = refreshed
+			actualOffset = nv.Offset.ToActualOffset()
+			readOption.VolumeRevision = v.SuperBlock.CompactionRevision
+		}
+		header := make([]byte, NeedleHeaderSize)
+		headerCount, headerErr := v.DataBackend.ReadAt(header, actualOffset)
+		if headerErr == io.EOF && headerCount == NeedleHeaderSize {
+			headerErr = nil
+		}
+		if headerErr != nil {
+			if headerErr != io.EOF {
+				v.checkReadWriteError(headerErr)
+			}
+			return fmt.Errorf("ReadNeedleData header: %w", headerErr)
+		}
+		probe := new(needle.Needle)
+		probe.ParseNeedleHeader(header)
+		if probe.Id != n.Id && probe.Size != nv.Size {
+			glog.V(0).Infof("volume %d index entry for needle %x resolves to needle %x; reporting not-found",
+				v.Id, uint64(n.Id), uint64(probe.Id))
+			return ErrorNotFound
+		}
+		return nil
+	}
+	if readOption.HasSlowRead {
+		v.dataFileAccessLock.RLock()
+	}
+	probeErr := probeHeader()
+	if readOption.HasSlowRead {
+		v.dataFileAccessLock.RUnlock()
+	}
+	if probeErr != nil {
+		return probeErr
+	}
 
 	// read needle data
 	crc := needle.CRC(0)
+	var pending []byte
+	checkCRC := offset == 0 && size == int64(n.DataSize)
 	for x := offset; x < offset+size; x += int64(len(buf)) {
 
 		if readOption.HasSlowRead {
 			v.dataFileAccessLock.RLock()
+			if err := v.UnavailableError(); err != nil {
+				v.dataFileAccessLock.RUnlock()
+				return err
+			}
 		}
 		// possibly re-read needle offset if volume is compacted
 		if readOption.VolumeRevision != v.SuperBlock.CompactionRevision {
@@ -192,9 +288,22 @@ func (v *Volume) readNeedleDataInto(n *needle.Needle, readOption *ReadOption, wr
 		toWrite := min(count, int(offset+size-x))
 		if toWrite > 0 {
 			crc = crc.Update(buf[0:toWrite])
-			// Note: CRC validation happens after the loop completes (see below)
-			// to avoid performance overhead in the hot read path
-			if _, err = writer.Write(buf[0:toWrite]); err != nil {
+			// The CRC is known only after the last byte; hold each page until
+			// the next one is read so a bad needle is never fully written.
+			if checkCRC {
+				if pending != nil {
+					if _, err = writer.Write(pending); err != nil {
+						return fmt.Errorf("ReadNeedleData write: %w", err)
+					}
+				}
+				pending = buf[:toWrite]
+				if x+int64(len(buf)) < offset+size {
+					if spare == nil {
+						spare = mem.Allocate(len(buf))
+					}
+					buf, spare = spare, buf
+				}
+			} else if _, err = writer.Write(buf[0:toWrite]); err != nil {
 				return fmt.Errorf("ReadNeedleData write: %w", err)
 			}
 		}
@@ -209,18 +318,22 @@ func (v *Volume) readNeedleDataInto(n *needle.Needle, readOption *ReadOption, wr
 			break
 		}
 	}
-	// Whole-needle read completed without a backend error — clear any
-	// pending EIO streak. If a non-EIO failure happens later (CRC etc.)
-	// we still return that error to the caller, but the disk itself
-	// produced clean bytes.
-	v.checkReadWriteError(nil)
-	if offset == 0 && size == int64(n.DataSize) && (n.Checksum != crc && uint32(n.Checksum) != crc.Value()) {
+	if checkCRC && (n.Checksum != crc && uint32(n.Checksum) != crc.Value()) {
 		// the crc.Value() function is to be deprecated. this double checking is for backward compatibility
 		// with seaweed version using crc.Value() instead of uint32(crc), which appears in commit 056c480eb
 		// and switch appeared in version 3.09.
+		// pending is the last page and is intentionally not written.
 		stats.VolumeServerHandlerCounter.WithLabelValues(stats.ErrorCRC).Inc()
 		return fmt.Errorf("ReadNeedleData checksum %v expected %v for Needle: %v,%v", crc, n.Checksum, v.Id, n)
 	}
+	// The read succeeded only once the checksum passes; a failed needle
+	// leaves the io error streak untouched, matching the streamed path.
+	v.checkReadWriteError(nil)
+	if pending != nil {
+		if _, err = writer.Write(pending); err != nil {
+			return fmt.Errorf("ReadNeedleData write: %w", err)
+		}
+	}
 	return nil
 
 }
@@ -234,9 +347,18 @@ func min(x, y int) int {
 
 // read fills in Needle content by looking up n.Id from NeedleMapper
 func (v *Volume) ReadNeedleBlob(offset int64, size Size) ([]byte, error) {
+	// A deletion marker is not a record length; reject it before taking the lock.
+	if size.IsDeleted() {
+		return nil, fmt.Errorf("invalid needle size %d", size)
+	}
+
 	v.dataFileAccessLock.RLock()
 	defer v.dataFileAccessLock.RUnlock()
 
+	if err := v.UnavailableError(); err != nil {
+		return nil, err
+	}
+
 	blob, err := needle.ReadNeedleBlob(v.DataBackend, offset, size, v.Version())
 	v.checkReadWriteError(err)
 	return blob, err
@@ -293,7 +415,13 @@ func ScanVolumeFileFrom(version needle.Version, datBackend backend.BackendStorag
 			glog.V(0).Infof("visit needle error: %v", err)
 			return fmt.Errorf("visit needle error: %w", err)
 		}
-		offset += NeedleHeaderSize + rest
+		// A corrupt header can carry a size so negative that the record length
+		// is zero or less; the scan cannot advance past it.
+		recordSize := NeedleHeaderSize + rest
+		if recordSize <= 0 {
+			return fmt.Errorf("%s: needle header at offset %d has size %d, record length %d: %w", datBackend.Name(), offset, n.Size, recordSize, needle.ErrorCorrupted)
+		}
+		offset += recordSize
 		glog.V(4).Infof("==> new entry offset %d", offset)
 		if n, nh, rest, err = needle.ReadNeedleHeader(datBackend, version, offset); err != nil {
 			if err == io.EOF {
diff --git a/weed/storage/volume_read_all.go b/weed/storage/volume_read_all.go
index 7f58abfd7c..74e181fa2c 100644
--- a/weed/storage/volume_read_all.go
+++ b/weed/storage/volume_read_all.go
@@ -21,6 +21,9 @@ func (scanner *VolumeFileScanner4ReadAll) ReadNeedleBody() bool {
 
 func (scanner *VolumeFileScanner4ReadAll) VisitNeedle(n *needle.Needle, offset int64, needleHeader, needleBody []byte) error {
 
+	if err := scanner.V.UnavailableError(); err != nil {
+		return err
+	}
 	nv, ok := scanner.V.nm.Get(n.Id)
 	if !ok {
 		return nil
diff --git a/weed/storage/volume_read_test.go b/weed/storage/volume_read_test.go
index 45ca55e8e0..491245bc5d 100644
--- a/weed/storage/volume_read_test.go
+++ b/weed/storage/volume_read_test.go
@@ -2,8 +2,16 @@ package storage
 
 import (
 	"bytes"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
 	"testing"
+	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
@@ -59,7 +67,7 @@ func TestReadNeedMetaWithWritesAndUpdates(t *testing.T) {
 		n.Flags = 0x08
 		n.LastModified = mockLastUpdateTime
 		mockLastUpdateTime += 2000
-		offset, _, _, err := v.writeNeedle2(n, true, false)
+		offset, _, _, err := v.writeNeedle2(n, true, false, false)
 		if err != nil {
 			t.Fatalf("write needle %d: %v", i, err)
 		}
@@ -98,7 +106,7 @@ func TestReadNeedMetaWithDeletesThenWrites(t *testing.T) {
 		n.Flags = 0x08
 		n.LastModified = mockLastUpdateTime
 		mockLastUpdateTime += 2000
-		offset, _, _, err := v.writeNeedle2(n, true, false)
+		offset, _, _, err := v.writeNeedle2(n, true, false, false)
 		if err != nil {
 			t.Fatalf("write needle %d: %v", i, err)
 		}
@@ -126,3 +134,313 @@ func TestReadNeedMetaWithDeletesThenWrites(t *testing.T) {
 		expectedLastUpdateTime += 2000
 	}
 }
+
+// scanRecorder records visited offsets and fails once a scan visits more
+// records than the file holds.
+type scanRecorder struct {
+	readBody  bool
+	maxVisits int
+	offsets   []int64
+}
+
+func (s *scanRecorder) VisitSuperBlock(super_block.SuperBlock) error { return nil }
+
+func (s *scanRecorder) ReadNeedleBody() bool { return s.readBody }
+
+func (s *scanRecorder) VisitNeedle(_ *needle.Needle, offset int64, _, _ []byte) error {
+	s.offsets = append(s.offsets, offset)
+	if len(s.offsets) > s.maxVisits {
+		return fmt.Errorf("visited %d records in a file of %d, offsets %v", len(s.offsets), s.maxVisits, s.offsets)
+	}
+	return nil
+}
+
+var errDidNotReturn = errors.New("did not return in time")
+
+// runWithTimeout returns errDidNotReturn if fn does not finish within d.
+func runWithTimeout(d time.Duration, fn func() error) error {
+	done := make(chan error, 1)
+	go func() { done <- fn() }()
+	select {
+	case err := <-done:
+		return err
+	case <-time.After(d):
+		return errDidNotReturn
+	}
+}
+
+// A corrupt .dat header can make a record's length zero or negative; the scan
+// must stop there with ErrorCorrupted rather than re-read the header or step
+// back into the previous record. A negative size whose record length stays
+// positive is stepped over as before.
+func TestScanVolumeFileFrom_StopsAtRecordThatCannotAdvance(t *testing.T) {
+	cases := []struct {
+		version needle.Version
+		size    types.Size
+		stops   bool
+	}{
+		{needle.Version3, -1, false},   // record length 32
+		{needle.Version3, -36, true},   // record length 0
+		{needle.Version3, -43, true},   // record length 0
+		{needle.Version3, -44, true},   // record length -8
+		{needle.Version3, -4096, true}, // record length -4056
+		{needle.Version2, -1, false},   // record length 24
+		{needle.Version2, -28, true},   // record length 0
+		{needle.Version2, -35, true},   // record length 0
+		{needle.Version2, -36, true},   // record length -8
+	}
+	for _, tc := range cases {
+		recordLen := needle.GetActualSize(tc.size, tc.version)
+		if (recordLen <= 0) != tc.stops {
+			t.Fatalf("v%d size %d: record length %d, case expects stops=%v", tc.version, tc.size, recordLen, tc.stops)
+		}
+		for _, readBody := range []bool{false, true} {
+			t.Run(fmt.Sprintf("v%d/size%d/readBody=%v", tc.version, tc.size, readBody), func(t *testing.T) {
+				f, err := os.Create(filepath.Join(t.TempDir(), "1.dat"))
+				if err != nil {
+					t.Fatalf("create dat: %v", err)
+				}
+				dat := backend.NewDiskFile(f)
+				defer dat.Close()
+
+				first, _, _, err := newRandomNeedle(1).Append(dat, tc.version)
+				if err != nil {
+					t.Fatalf("append needle 1: %v", err)
+				}
+				corruptAt, _, err := dat.GetStat()
+				if err != nil {
+					t.Fatalf("stat dat: %v", err)
+				}
+				raw := make([]byte, max(recordLen, types.NeedleHeaderSize))
+				types.NeedleIdToBytes(raw[types.CookieSize:types.CookieSize+types.NeedleIdSize], types.Uint64ToNeedleId(99))
+				types.SizeToBytes(raw[types.CookieSize+types.NeedleIdSize:types.NeedleHeaderSize], tc.size)
+				if _, err := dat.WriteAt(raw, corruptAt); err != nil {
+					t.Fatalf("append corrupt record: %v", err)
+				}
+				second, _, _, err := newRandomNeedle(2).Append(dat, tc.version)
+				if err != nil {
+					t.Fatalf("append needle 2: %v", err)
+				}
+
+				scanner := &scanRecorder{readBody: readBody, maxVisits: 3}
+				err = runWithTimeout(10*time.Second, func() error {
+					return ScanVolumeFileFrom(tc.version, dat, 0, scanner)
+				})
+
+				want := []int64{int64(first), corruptAt, int64(second)}
+				if tc.stops {
+					want = want[:2]
+					if !errors.Is(err, needle.ErrorCorrupted) {
+						t.Errorf("scan error = %v, want one wrapping ErrorCorrupted", err)
+					}
+				} else if err != nil {
+					t.Errorf("scan error = %v, want nil", err)
+				}
+				if !reflect.DeepEqual(scanner.offsets, want) {
+					t.Errorf("visited offsets %v, want %v", scanner.offsets, want)
+				}
+			})
+		}
+	}
+}
+
+// The CRC is known only after the last byte, so a full read must keep that
+// page unwritten when the checksum mismatches; otherwise the GET has already
+// committed a corrupt body.
+func TestReadNeedleDataIntoChecksumMismatchHoldsLastPage(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	// 2048 is two pages (one buffer swap), 3000 is three, and 2500 with a
+	// buffer larger than the needle is the single Write that used to commit
+	// the whole body before the CRC check.
+	cases := []struct {
+		name string
+		size int
+		page int
+	}{
+		{"two pages", 2048, 1024},
+		{"three pages", 3000, 1024},
+		{"one buffer", 2500, 4096},
+	}
+	for i, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			data := bytes.Repeat([]byte("abcdefghij"), (tc.size+9)/10)[:tc.size]
+			n := new(needle.Needle)
+			n.Data = append([]byte(nil), data...)
+			n.Checksum = needle.NewCRC(n.Data)
+			n.Id = types.Uint64ToNeedleId(uint64(i + 1))
+			offset, _, _, err := v.writeNeedle2(n, true, false, false)
+			if err != nil {
+				t.Fatalf("write needle: %v", err)
+			}
+			nv, ok := v.nm.Get(n.Id)
+			if !ok {
+				t.Fatal("needle missing from index")
+			}
+			actual := nv.Offset.ToActualOffset()
+
+			read := func() (bytes.Buffer, error) {
+				t.Helper()
+				meta := new(needle.Needle)
+				meta.Id = n.Id
+				if err := v.readNeedleMetaAt(meta, actual, int32(nv.Size)); err != nil {
+					t.Fatalf("read meta at %d size %d: %v", actual, nv.Size, err)
+				}
+				var buf bytes.Buffer
+				err := v.readNeedleDataInto(meta, &ReadOption{ReadBufferSize: tc.page}, &buf, 0, int64(meta.DataSize))
+				return buf, err
+			}
+
+			intact, err := read()
+			if err != nil {
+				t.Fatalf("intact read: %v", err)
+			}
+			if !bytes.Equal(intact.Bytes(), data) {
+				t.Fatalf("intact read len %d, want %d", intact.Len(), len(data))
+			}
+
+			dataOff := int64(offset) + types.NeedleHeaderSize + types.DataSizeSize
+			if _, err := v.DataBackend.WriteAt([]byte{0xff}, dataOff); err != nil {
+				t.Fatalf("damage needle: %v", err)
+			}
+			damaged, err := read()
+			if err == nil || !strings.Contains(err.Error(), "checksum") {
+				t.Fatalf("damaged read: got %v, want a checksum error", err)
+			}
+			held := len(data) % tc.page
+			if held == 0 {
+				held = tc.page
+			}
+			if damaged.Len() != len(data)-held {
+				t.Fatalf("damaged read wrote %d bytes, want %d with the last page held back", damaged.Len(), len(data)-held)
+			}
+		})
+	}
+}
+
+// With MustMetaOnly set, the payload is skipped whatever the needle's size.
+// This is the option a delete uses. A chunk manifest is the exception: its
+// data is still read, because a delete needs it to find the chunks.
+func TestReadNeedleMustMetaOnly(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	plain := newRandomNeedle(1)
+	plain.Cookie = 0x1234
+	plain.Name = []byte("a.jpg")
+	plain.NameSize = uint8(len(plain.Name))
+	plain.SetHasName()
+	plainOffset, _, _, err := v.writeNeedle2(plain, true, false, false)
+	if err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	manifest := newRandomNeedle(2)
+	manifest.SetIsChunkManifest()
+	if _, _, _, err := v.writeNeedle2(manifest, true, false, false); err != nil {
+		t.Fatalf("write chunk manifest: %v", err)
+	}
+
+	read := func(id uint64, option *ReadOption) (*needle.Needle, error) {
+		n := &needle.Needle{Id: types.Uint64ToNeedleId(id)}
+		_, err := v.readNeedle(n, option, nil)
+		return n, err
+	}
+	metaOnly := func() *ReadOption { return &ReadOption{AttemptMetaOnly: true, MustMetaOnly: true} }
+
+	option := metaOnly()
+	got, err := read(1, option)
+	if err != nil {
+		t.Fatalf("metadata read: %v", err)
+	}
+	if !option.IsMetaOnly || len(got.Data) != 0 {
+		t.Errorf("metadata read: IsMetaOnly %v, %d bytes of data", option.IsMetaOnly, len(got.Data))
+	}
+	if got.Cookie != plain.Cookie || got.Size != plain.Size || got.DataSize != plain.DataSize || string(got.Name) != "a.jpg" {
+		t.Errorf("metadata read: cookie %x size %d data size %d name %q", got.Cookie, got.Size, got.DataSize, got.Name)
+	}
+
+	// With AttemptMetaOnly alone, a small needle is still read in full.
+	option = &ReadOption{AttemptMetaOnly: true}
+	if got, err = read(1, option); err != nil || option.IsMetaOnly || !bytes.Equal(got.Data, plain.Data) {
+		t.Errorf("attempted metadata read of a small needle: IsMetaOnly %v, %d bytes, %v", option.IsMetaOnly, len(got.Data), err)
+	}
+
+	option = metaOnly()
+	if got, err = read(2, option); err != nil || option.IsMetaOnly || !bytes.Equal(got.Data, manifest.Data) {
+		t.Errorf("metadata read of a chunk manifest: IsMetaOnly %v, %d bytes, %v", option.IsMetaOnly, len(got.Data), err)
+	}
+
+	// A meta-only read never looks at the payload. Corrupt the payload and
+	// check that only a full read reports the damage.
+	damaged := []byte{^plain.Data[0]}
+	if _, err := v.DataBackend.WriteAt(damaged, int64(plainOffset)+types.NeedleHeaderSize+types.DataSizeSize); err != nil {
+		t.Fatalf("damage needle: %v", err)
+	}
+	if _, err := read(1, nil); !errors.Is(err, needle.ErrorCorrupted) {
+		t.Errorf("full read of a damaged needle: %v, want %v", err, needle.ErrorCorrupted)
+	}
+	if _, err := read(1, metaOnly()); err != nil {
+		t.Errorf("metadata read of a damaged needle: %v", err)
+	}
+}
+
+// A version 1 needle has no data size field and no metadata after its data,
+// so the metadata-only reader cannot parse it. A metadata-only read of a
+// version 1 volume must fall back to a full read instead of failing.
+func TestReadNeedleMetaOnlyVersion1(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+	// New volumes are always created with the current version, so switch this
+	// one to version 1 before anything is written to it.
+	v.volumeInfo.Version = uint32(needle.Version1)
+	if v.Version() != needle.Version1 {
+		t.Fatalf("volume version %d, want %d", v.Version(), needle.Version1)
+	}
+
+	// The payload starts with bytes that would be a huge data size if the
+	// metadata-only reader took them for the version 2 data size field.
+	small := &needle.Needle{Id: 1, Cookie: 0x1234, Data: []byte("hello world")}
+	small.Checksum = needle.NewCRC(small.Data)
+	if _, _, _, err := v.writeNeedle2(small, true, false, false); err != nil {
+		t.Fatalf("write small needle: %v", err)
+	}
+	large := &needle.Needle{Id: 2, Cookie: 0x5678, Data: bytes.Repeat([]byte("hello world "), PagedReadLimit/12+1)}
+	large.Checksum = needle.NewCRC(large.Data)
+	if _, _, _, err := v.writeNeedle2(large, true, false, false); err != nil {
+		t.Fatalf("write large needle: %v", err)
+	}
+
+	for _, tc := range []struct {
+		name   string
+		want   *needle.Needle
+		option *ReadOption
+	}{
+		{"must be metadata only, small needle", small, &ReadOption{AttemptMetaOnly: true, MustMetaOnly: true}},
+		{"must be metadata only, large needle", large, &ReadOption{AttemptMetaOnly: true, MustMetaOnly: true}},
+		{"attempt metadata only, large needle", large, &ReadOption{AttemptMetaOnly: true}},
+	} {
+		got := &needle.Needle{Id: tc.want.Id}
+		if _, err := v.readNeedle(got, tc.option, nil); err != nil {
+			t.Errorf("%s: %v", tc.name, err)
+			continue
+		}
+		if tc.option.IsMetaOnly || got.Cookie != tc.want.Cookie || !bytes.Equal(got.Data, tc.want.Data) {
+			t.Errorf("%s: IsMetaOnly %v, cookie %x, %d bytes of data", tc.name, tc.option.IsMetaOnly, got.Cookie, len(got.Data))
+		}
+	}
+}
diff --git a/weed/storage/volume_remote_superblock_log_test.go b/weed/storage/volume_remote_superblock_log_test.go
new file mode 100644
index 0000000000..365241188b
--- /dev/null
+++ b/weed/storage/volume_remote_superblock_log_test.go
@@ -0,0 +1,21 @@
+package storage
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestRemoteSuperBlockLogOnlyOnError(t *testing.T) {
+	var logged int
+	old := logRemoteSuperBlockFault
+	logRemoteSuperBlockFault = func(string, ...interface{}) { logged++ }
+	defer func() { logRemoteSuperBlockFault = old }()
+	logRemoteSuperBlockErr(219, nil)
+	if logged != 0 {
+		t.Fatalf("a nil error was logged at ERROR (the \"readSuperBlock remote volume 219: <nil>\" line)")
+	}
+	logRemoteSuperBlockErr(219, errors.New("timeout")) // positive control
+	if logged != 1 {
+		t.Fatalf("a real error must still be logged, got %d", logged)
+	}
+}
diff --git a/weed/storage/volume_replica/idx_set.go b/weed/storage/volume_replica/idx_set.go
new file mode 100644
index 0000000000..c26c36ee4c
--- /dev/null
+++ b/weed/storage/volume_replica/idx_set.go
@@ -0,0 +1,145 @@
+package volume_replica
+
+import (
+	"fmt"
+	"io"
+
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle_map"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+)
+
+type replicaLiveIdx struct {
+	loc  wdclient.Location
+	live []types.NeedleId
+}
+
+// LiveNeedlesFromIndex walks a compact needle map and returns live NeedleIds
+// in key order. Deleted, invalid-size, and zero-offset rows are skipped; Size
+// is not part of the comparison since replicas can differ by MIME/flags while
+// holding the same ids.
+func LiveNeedlesFromIndex(db *needle_map.MemDb) ([]types.NeedleId, error) {
+	if db == nil {
+		return nil, fmt.Errorf("nil needle index")
+	}
+	var live []types.NeedleId
+	err := db.AscendingVisit(func(nv needle_map.NeedleValue) error {
+		if nv.Offset.IsZero() || nv.Size.IsDeleted() || !nv.Size.IsValid() {
+			return nil
+		}
+		live = append(live, nv.Key)
+		return nil
+	})
+	return live, err
+}
+
+// EqualLiveNeedleSets reports whether two live NeedleId sets match.
+func EqualLiveNeedleSets(a, b []types.NeedleId) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// RequireCapacitySource returns loc if it is in capacityLocs (FreeVolumeCount>=2).
+func RequireCapacitySource(vid needle.VolumeId, loc wdclient.Location, capacityLocs []wdclient.Location) (wdclient.Location, error) {
+	if loc.Url == "" {
+		return wdclient.Location{}, fmt.Errorf("volume %d: no encode source after idx compare", vid)
+	}
+	for _, c := range capacityLocs {
+		if c.Url == loc.Url {
+			return loc, nil
+		}
+	}
+	return wdclient.Location{}, fmt.Errorf("volume %d: selected source %s is not in the FreeVolumeCount>=2 replica set; refusing encode", vid, loc.Url)
+}
+
+// SelectSourceIfIndexesMatch copies each replica's live .idx and compares
+// NeedleId sets. A read error or a mismatch aborts. One replica skips the
+// comparison. On match, the source is prefer when listed, else the first.
+func SelectSourceIfIndexesMatch(grpcDialOption grpc.DialOption, vid needle.VolumeId, collection string, locations []wdclient.Location, prefer string, writer io.Writer) (wdclient.Location, error) {
+	if len(locations) == 0 {
+		return wdclient.Location{}, fmt.Errorf("no replicas available for volume %d", vid)
+	}
+	if len(locations) == 1 {
+		if writer != nil {
+			fmt.Fprintf(writer, "volume %d: single replica %s, skipping idx set compare\n", vid, locations[0].Url)
+		}
+		return locations[0], nil
+	}
+
+	views := make([]replicaLiveIdx, 0, len(locations))
+	for _, loc := range locations {
+		status := GetReplicaStatus(grpcDialOption, vid, loc)
+		if status.Error != nil {
+			return wdclient.Location{}, fmt.Errorf("volume %d: replica status %s: %w", vid, loc.Url, status.Error)
+		}
+		db, err := ReadReplicaIndex(grpcDialOption, vid, collection, loc.ServerAddress())
+		if err != nil {
+			return wdclient.Location{}, fmt.Errorf("volume %d: read .idx from %s: %w", vid, loc.Url, err)
+		}
+		live, err := LiveNeedlesFromIndex(db)
+		db.Close()
+		if err != nil {
+			return wdclient.Location{}, fmt.Errorf("volume %d: walk .idx from %s: %w", vid, loc.Url, err)
+		}
+		views = append(views, replicaLiveIdx{loc: loc, live: live})
+	}
+
+	return chooseSourceFromLiveNeedles(vid, views, prefer, writer)
+}
+
+func chooseSourceFromLiveNeedles(vid needle.VolumeId, views []replicaLiveIdx, prefer string, writer io.Writer) (wdclient.Location, error) {
+	if len(views) == 0 {
+		return wdclient.Location{}, fmt.Errorf("volume %d: no data-bearing replicas to encode", vid)
+	}
+
+	reference := views[0].live
+	referenceUrl := views[0].loc.Url
+	for _, view := range views[1:] {
+		if !EqualLiveNeedleSets(reference, view.live) {
+			return wdclient.Location{}, fmt.Errorf("volume %d: replica %s live NeedleId set does not match %s (%d vs %d entries); refusing encode (no union)",
+				vid, view.loc.Url, referenceUrl, len(view.live), len(reference))
+		}
+	}
+
+	if len(reference) == 0 {
+		return wdclient.Location{}, fmt.Errorf("volume %d: no data-bearing replicas to encode", vid)
+	}
+
+	if writer != nil {
+		fmt.Fprintf(writer, "volume %d: all %d data replicas are consistent (matching live idx sets, %d needles)\n",
+			vid, len(views), len(reference))
+	}
+
+	if prefer != "" {
+		for _, view := range views {
+			if view.loc.Url == prefer {
+				return view.loc, nil
+			}
+		}
+	}
+	return views[0].loc, nil
+}
+
+// ReadReplicaIndex streams a replica's .idx into an in-memory compact map.
+func ReadReplicaIndex(grpcDialOption grpc.DialOption, vid needle.VolumeId, collection string, server pb.ServerAddress) (*needle_map.MemDb, error) {
+	db := needle_map.NewMemDb()
+	if db == nil {
+		return nil, fmt.Errorf("failed to allocate in-memory needle DB")
+	}
+	if err := loadReplicaIndex(db, grpcDialOption, vid, collection, server); err != nil {
+		db.Close()
+		return nil, err
+	}
+	return db, nil
+}
diff --git a/weed/storage/volume_replica/idx_set_test.go b/weed/storage/volume_replica/idx_set_test.go
new file mode 100644
index 0000000000..01de1f9a8b
--- /dev/null
+++ b/weed/storage/volume_replica/idx_set_test.go
@@ -0,0 +1,195 @@
+package volume_replica
+
+import (
+	"bytes"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle_map"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+)
+
+func TestEqualLiveNeedleSets_SameFileCountDifferentIds(t *testing.T) {
+	a := needle_map.NewMemDb()
+	b := needle_map.NewMemDb()
+	defer a.Close()
+	defer b.Close()
+
+	// Equal cardinality, different ids — FileCount would match, live sets must not.
+	a.Set(types.NeedleId(1), types.ToOffset(8), types.Size(100))
+	a.Set(types.NeedleId(2), types.ToOffset(16), types.Size(100))
+	a.Set(types.NeedleId(3), types.ToOffset(24), types.Size(100))
+	b.Set(types.NeedleId(1), types.ToOffset(8), types.Size(100))
+	b.Set(types.NeedleId(2), types.ToOffset(16), types.Size(100))
+	b.Set(types.NeedleId(4), types.ToOffset(24), types.Size(100))
+
+	la, err := LiveNeedlesFromIndex(a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lb, err := LiveNeedlesFromIndex(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if EqualLiveNeedleSets(la, lb) {
+		t.Fatalf("equal FileCount with different ids must not match: a=%v b=%v", la, lb)
+	}
+}
+
+func TestEqualLiveNeedleSets_VacuumOffsetsIgnored(t *testing.T) {
+	a := needle_map.NewMemDb()
+	b := needle_map.NewMemDb()
+	defer a.Close()
+	defer b.Close()
+
+	a.Set(types.NeedleId(10), types.ToOffset(8), types.Size(50))
+	a.Set(types.NeedleId(11), types.ToOffset(64), types.Size(80))
+	// Vacuum rewrote the same live needles to new offsets.
+	b.Set(types.NeedleId(10), types.ToOffset(8), types.Size(50))
+	b.Set(types.NeedleId(11), types.ToOffset(200), types.Size(80))
+
+	la, err := LiveNeedlesFromIndex(a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lb, err := LiveNeedlesFromIndex(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !EqualLiveNeedleSets(la, lb) {
+		t.Fatalf("same ids with different offsets must match: a=%v b=%v", la, lb)
+	}
+}
+
+func TestEqualLiveNeedleSets_SizeMismatchIgnored(t *testing.T) {
+	a := needle_map.NewMemDb()
+	b := needle_map.NewMemDb()
+	defer a.Close()
+	defer b.Close()
+
+	a.Set(types.NeedleId(10), types.ToOffset(8), types.Size(50))
+	b.Set(types.NeedleId(10), types.ToOffset(8), types.Size(74))
+
+	la, err := LiveNeedlesFromIndex(a)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lb, err := LiveNeedlesFromIndex(b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !EqualLiveNeedleSets(la, lb) {
+		t.Fatalf("same NeedleId with different Size must match: a=%v b=%v", la, lb)
+	}
+}
+
+func TestLiveNeedlesFromIndex_SkipsDeleted(t *testing.T) {
+	db := needle_map.NewMemDb()
+	defer db.Close()
+	db.Set(types.NeedleId(1), types.ToOffset(8), types.Size(40))
+	db.Set(types.NeedleId(2), types.ToOffset(16), types.TombstoneFileSize)
+	db.Set(types.NeedleId(3), types.ToOffset(24), types.Size(0))
+
+	live, err := LiveNeedlesFromIndex(db)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(live) != 1 || live[0] != 1 {
+		t.Fatalf("live=%v, want only id=1", live)
+	}
+}
+
+func TestSelectSourceIfIndexesMatch_SingleReplica(t *testing.T) {
+	loc := wdclient.Location{Url: "127.0.0.1:8080"}
+	got, err := SelectSourceIfIndexesMatch(nil, needle.VolumeId(7), "", []wdclient.Location{loc}, "other", io.Discard)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Url != loc.Url {
+		t.Fatalf("got %+v, want %+v", got, loc)
+	}
+}
+
+func TestSelectSourceIfIndexesMatch_NoReplicas(t *testing.T) {
+	_, err := SelectSourceIfIndexesMatch(nil, needle.VolumeId(7), "", nil, "", io.Discard)
+	if err == nil {
+		t.Fatal("expected error for empty replica list")
+	}
+}
+
+func TestChooseSourceFromLiveNeedles_SuccessContainsConsistent(t *testing.T) {
+	a := wdclient.Location{Url: "127.0.0.1:8080"}
+	b := wdclient.Location{Url: "127.0.0.1:8081"}
+	live := []types.NeedleId{1, 2}
+	var buf bytes.Buffer
+	got, err := chooseSourceFromLiveNeedles(7, []replicaLiveIdx{
+		{loc: a, live: live},
+		{loc: b, live: append([]types.NeedleId(nil), live...)},
+	}, "", &buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Url != a.Url {
+		t.Fatalf("got %+v, want %+v", got, a)
+	}
+	if !strings.Contains(buf.String(), "replicas are consistent") {
+		t.Fatalf("success log %q must contain %q", buf.String(), "replicas are consistent")
+	}
+	wantLine := "volume 7: all 2 data replicas are consistent (matching live idx sets, 2 needles)"
+	if !strings.Contains(buf.String(), wantLine) {
+		t.Fatalf("success log %q must contain %q", buf.String(), wantLine)
+	}
+}
+
+func TestChooseSourceFromLiveNeedles_EmptyVsLiveRefuses(t *testing.T) {
+	a := wdclient.Location{Url: "127.0.0.1:8080"}
+	b := wdclient.Location{Url: "127.0.0.1:8081"}
+	_, err := chooseSourceFromLiveNeedles(7, []replicaLiveIdx{
+		{loc: a, live: []types.NeedleId{1}},
+		{loc: b, live: nil}, // empty / superblock stub
+	}, "", io.Discard)
+	if err == nil {
+		t.Fatal("empty live-idx vs non-empty must error, not skip")
+	}
+	if strings.Contains(err.Error(), "skipping") {
+		t.Fatalf("must refuse, not skip: %v", err)
+	}
+}
+
+func TestChooseSourceFromLiveNeedles_AllEmpty(t *testing.T) {
+	a := wdclient.Location{Url: "127.0.0.1:8080"}
+	b := wdclient.Location{Url: "127.0.0.1:8081"}
+	_, err := chooseSourceFromLiveNeedles(7, []replicaLiveIdx{
+		{loc: a, live: nil},
+		{loc: b, live: nil},
+	}, "", io.Discard)
+	if err == nil {
+		t.Fatal("all empty live-idx must error")
+	}
+	if !strings.Contains(err.Error(), "no data-bearing replicas") {
+		t.Fatalf("got %v, want no data-bearing replicas", err)
+	}
+}
+
+func TestRequireCapacitySource_ThreeLocationsSourceFromCapacity(t *testing.T) {
+	fat := wdclient.Location{Url: "fat:8080"}
+	cap1 := wdclient.Location{Url: "cap1:8080"}
+	cap2 := wdclient.Location{Url: "cap2:8080"}
+	filtered := []wdclient.Location{cap1, cap2}
+
+	got, err := RequireCapacitySource(1, cap1, filtered)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Url != cap1.Url {
+		t.Fatalf("got %+v, want capacity source %+v", got, cap1)
+	}
+
+	_, err = RequireCapacitySource(1, fat, filtered)
+	if err == nil {
+		t.Fatal("must refuse encode from first fat replica")
+	}
+}
diff --git a/weed/storage/volume_replica/replica_sync.go b/weed/storage/volume_replica/replica_sync.go
index 3997569c80..9a578ca8dd 100644
--- a/weed/storage/volume_replica/replica_sync.go
+++ b/weed/storage/volume_replica/replica_sync.go
@@ -224,15 +224,19 @@ func (rub *unionBuilder) buildUnionReplica(locations []wdclient.Location, status
 }
 
 func (rub *unionBuilder) readIndexDatabase(db *needle_map.MemDb, server pb.ServerAddress) error {
+	return loadReplicaIndex(db, rub.grpcDialOption, rub.vid, rub.collection, server)
+}
+
+func loadReplicaIndex(db *needle_map.MemDb, grpcDialOption grpc.DialOption, vid needle.VolumeId, collection string, server pb.ServerAddress) error {
 	var buf bytes.Buffer
 
-	err := operation.WithVolumeServerClient(true, server, rub.grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
+	err := operation.WithVolumeServerClient(true, server, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
 		copyFileClient, err := volumeServerClient.CopyFile(context.Background(), &volume_server_pb.CopyFileRequest{
-			VolumeId:                 uint32(rub.vid),
+			VolumeId:                 uint32(vid),
 			Ext:                      ".idx",
 			CompactionRevision:       math.MaxUint32,
 			StopOffset:               math.MaxInt64,
-			Collection:               rub.collection,
+			Collection:               collection,
 			IsEcVolume:               false,
 			IgnoreSourceFileNotFound: false,
 		})
diff --git a/weed/storage/volume_report_hash.go b/weed/storage/volume_report_hash.go
index 0b1a245434..95f125af86 100644
--- a/weed/storage/volume_report_hash.go
+++ b/weed/storage/volume_report_hash.go
@@ -29,6 +29,9 @@ func (vi VolumeInfo) ReportHash() uint64 {
 	if vi.ReadOnly {
 		buf[56] = 1
 	}
+	if vi.ReadOnlyCanDelete {
+		buf[56] |= 2
+	}
 	h := xxhash.Sum64(buf[:])
 
 	var modified [8]byte
@@ -37,7 +40,6 @@ func (vi VolumeInfo) ReportHash() uint64 {
 	h = foldReportHash(h, xxhash.Sum64String(vi.Collection))
 	h = foldReportHash(h, xxhash.Sum64String(vi.DiskType))
 	h = foldReportHash(h, xxhash.Sum64String(vi.RemoteStorageName))
-	h = foldReportHash(h, xxhash.Sum64String(vi.RemoteStorageKey))
 	return h
 }
 
diff --git a/weed/storage/volume_super_block.go b/weed/storage/volume_super_block.go
index 73203dccdc..7035d9867c 100644
--- a/weed/storage/volume_super_block.go
+++ b/weed/storage/volume_super_block.go
@@ -26,7 +26,7 @@ func (v *Volume) maybeWriteSuperBlock(ver needle.Version) error {
 		if e != nil && os.IsPermission(e) {
 			//read-only, but zero length - recreate it!
 			var dataFile *os.File
-			if dataFile, e = os.Create(v.DataBackend.Name()); e == nil {
+			if dataFile, e = backend.OpenVolumeFile(v.DataBackend.Name(), os.O_RDWR|os.O_CREATE|os.O_TRUNC); e == nil {
 				v.DataBackend = backend.NewDiskFile(dataFile)
 				if _, e = v.DataBackend.WriteAt(v.SuperBlock.Bytes(), 0); e == nil {
 					v.noWriteLock.Lock()
diff --git a/weed/storage/volume_tier.go b/weed/storage/volume_tier.go
index 1f0214b9e4..cd046fdd01 100644
--- a/weed/storage/volume_tier.go
+++ b/weed/storage/volume_tier.go
@@ -1,8 +1,8 @@
 package storage
 
 import (
+	"errors"
 	"fmt"
-	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
@@ -22,6 +22,7 @@ func (v *Volume) maybeLoadVolumeInfo() (found bool) {
 	var hasRemoteFile bool
 	v.volumeInfo, hasRemoteFile, found, err = volume_info.MaybeLoadVolumeInfo(v.FileName(".vif"))
 	v.hasRemoteFile.Store(hasRemoteFile)
+	internVolumeInfoStrings(v.volumeInfo)
 
 	if v.volumeInfo.Version == 0 {
 		v.volumeInfo.Version = uint32(needle.GetCurrentVersion())
@@ -56,6 +57,20 @@ func (v *Volume) maybeLoadVolumeInfo() (found bool) {
 
 }
 
+// internVolumeInfoStrings shares the values every volume's .vif repeats. A
+// tiered volume names its replication and its backend on every load, and the
+// decode allocates a fresh copy of each, so a server holding millions of them
+// otherwise holds millions of copies of the same handful of names. The remote
+// key is left alone: it names one volume.
+func internVolumeInfoStrings(volumeInfo *volume_server_pb.VolumeInfo) {
+	volumeInfo.Replication = internVolumeString(volumeInfo.Replication)
+	for _, remoteFile := range volumeInfo.GetFiles() {
+		remoteFile.BackendType = internVolumeString(remoteFile.BackendType)
+		remoteFile.BackendId = internVolumeString(remoteFile.BackendId)
+		remoteFile.Extension = internVolumeString(remoteFile.Extension)
+	}
+}
+
 func (v *Volume) HasRemoteFile() bool {
 	return v.hasRemoteFile.Load()
 }
@@ -66,11 +81,48 @@ func (v *Volume) HasRemoteFile() bool {
 // backend concurrently. load() must instead use loadRemoteFileLocked, since it
 // can be reached with the lock already held (CommitCompact).
 func (v *Volume) LoadRemoteFile() error {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 	return v.loadRemoteFileLocked()
 }
 
+// MarkTieredDeletable gives a volume whose data has just moved to the remote
+// tier the flags a restart gives it (load(): a tiered volume refuses writes and
+// accepts deletes). volume.tier.upload marks the volume read-only without
+// deletes before the upload; left that way, every delete until the next
+// restart is refused, the filer drops it, and the needle's bytes stay in the
+// remote object where no vacuum can find them.
+//
+// Only for a single-copy volume: the shell copies the uploaded replica's .idx
+// and .vif to the other replicas after the upload, and a tombstone written
+// before that copy would reach one replica only; a replicated volume keeps
+// refusing deletes until its next load, as before. An I/O quarantine is left
+// alone, and so is a volume past the I/O error tolerance that the next
+// heartbeat will quarantine. Otherwise the flags are the ones load() gives
+// every tiered volume.
+func (v *Volume) MarkTieredDeletable() bool {
+	if rp := v.SuperBlock.ReplicaPlacement; rp != nil && rp.GetCopyCount() > 1 {
+		return false
+	}
+	// Check the I/O state under noWriteLock: CollectHeartbeat marks the
+	// quarantine before it takes noWriteLock to refuse deletes, so either the
+	// check below sees the quarantine, or the heartbeat's refusal lands after
+	// this change and stays.
+	v.noWriteLock.Lock()
+	defer v.noWriteLock.Unlock()
+	if !v.HasRemoteFile() {
+		return false
+	}
+	if ioErr, ioCount, quarantined := v.getIoErrorState(); quarantined || (ioErr != nil && ioCount >= IoErrorTolerance) {
+		return false
+	}
+	v.noWriteOrDelete = false
+	v.noWriteCanDelete = true
+	return true
+}
+
 // loadRemoteFileLocked swaps the data backend to the remote tier object. The
 // caller must hold dataFileAccessLock or be single-threaded (load() during
 // construction or a compaction-commit reload). It marks the volume tiered in the
@@ -91,16 +143,51 @@ func (v *Volume) loadRemoteFileLocked() error {
 	return nil
 }
 
+// AttachRemoteDatFile records remoteFile, a copy of the .dat read from source,
+// in the volume's .vif and switches the data backend to it. It refuses when
+// source is no longer the volume's data backend: a compaction commit since the
+// copy replaced the .dat and the index, and the copy has the old layout. The
+// check, the .vif write and the switch happen under the data-file locks, so a
+// commit either lands before (and is seen here) or after (and refuses a tiered
+// volume).
+func (v *Volume) AttachRemoteDatFile(source backend.BackendStorageFile, remoteFile *volume_server_pb.RemoteFile) error {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
+	v.dataFileAccessLock.Lock()
+	defer v.dataFileAccessLock.Unlock()
+	if v.DataBackend != source {
+		return fmt.Errorf("volume %d data file changed during the copy (compacted or reloaded)", v.Id)
+	}
+	files := v.volumeInfo.GetFiles()
+	v.volumeInfo.Files = append(files, remoteFile)
+	if err := v.SaveVolumeInfo(); err != nil {
+		// A NotCrashDurableError means the rename committed: the .vif names
+		// the copy, so keep the entry and serve from the copy, and still
+		// report the error so the caller keeps the local .dat. Any other
+		// failure left the old .vif in place.
+		var ndErr *volume_info.NotCrashDurableError
+		if !errors.As(err, &ndErr) {
+			v.volumeInfo.Files = files
+			return fmt.Errorf("save remote file info: %w", err)
+		}
+		if loadErr := v.loadRemoteFileLocked(); loadErr != nil {
+			return fmt.Errorf("save remote file info: %w; load remote file: %v", err, loadErr)
+		}
+		return fmt.Errorf("save remote file info: %w", err)
+	}
+	return v.loadRemoteFileLocked()
+}
+
 func (v *Volume) SaveVolumeInfo() error {
 
 	tierFileName := v.FileName(".vif")
-	if v.Ttl != nil {
-		ttlSeconds := v.Ttl.ToSeconds()
-		if ttlSeconds > 0 {
-			v.volumeInfo.ExpireAtSec = uint64(time.Now().Unix()) + ttlSeconds //calculated destroy time from the ec volume was created
-		}
+	if expireAtSec := v.ExpireAtSec(); expireAtSec > 0 {
+		v.volumeInfo.ExpireAtSec = expireAtSec
 	}
 
-	return volume_info.SaveVolumeInfo(tierFileName, v.volumeInfo)
+	return saveVolumeInfoFile(tierFileName, v.volumeInfo)
 
 }
+
+// saveVolumeInfoFile writes a .vif; tests replace it to inject failures.
+var saveVolumeInfoFile = volume_info.SaveVolumeInfo
diff --git a/weed/storage/volume_tier_attach_test.go b/weed/storage/volume_tier_attach_test.go
new file mode 100644
index 0000000000..0322c591bb
--- /dev/null
+++ b/weed/storage/volume_tier_attach_test.go
@@ -0,0 +1,70 @@
+package storage
+
+import (
+	"errors"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+// When the .vif rename commits but the directory fsync fails, the saved .vif
+// names the remote copy. AttachRemoteDatFile must keep that entry (the upload
+// handler deletes a copy the volume info does not name) and serve from the
+// copy the .vif points at, while still reporting the error.
+func TestAttachRemoteDatFileKeepsACommittedVifEntry(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 86, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	defer v.Close()
+	for i := 1; i <= 5; i++ {
+		_, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false)
+		require.NoError(t, err)
+	}
+	diskFile, ok := v.DataBackend.(*backend.DiskFile)
+	require.True(t, ok)
+	key, size, err := b.CopyFile(diskFile.File, nil, 0)
+	require.NoError(t, err)
+
+	saved := saveVolumeInfoFile
+	saveVolumeInfoFile = func(fileName string, info *volume_server_pb.VolumeInfo) error {
+		if err := saved(fileName, info); err != nil {
+			return err
+		}
+		return &volume_info.NotCrashDurableError{FileName: fileName, Err: syscall.EIO}
+	}
+	defer func() { saveVolumeInfoFile = saved }()
+
+	bType, bId := backend.BackendNameToTypeId(testBackendName)
+	err = v.AttachRemoteDatFile(diskFile, &volume_server_pb.RemoteFile{
+		BackendType: bType, BackendId: bId, Key: key, FileSize: uint64(size),
+		ModifiedTime: uint64(time.Now().Unix()), Extension: ".dat",
+	})
+	var ndErr *volume_info.NotCrashDurableError
+	require.True(t, errors.As(err, &ndErr), "the fsync failure is still reported: %v", err)
+
+	onDisk, _, _, err := volume_info.MaybeLoadVolumeInfo(v.FileName(".vif"))
+	require.NoError(t, err)
+	require.Len(t, onDisk.GetFiles(), 1)
+	require.Equal(t, key, onDisk.GetFiles()[0].Key)
+	require.Len(t, v.GetVolumeInfo().GetFiles(), 1, "the in-memory entry was rolled back while the .vif names the copy")
+	require.Equal(t, key, v.GetVolumeInfo().GetFiles()[0].Key)
+	require.True(t, v.HasRemoteFile())
+	_, isDisk := v.DataBackend.(*backend.DiskFile)
+	require.False(t, isDisk, "the live backend must be the copy the .vif names")
+
+	n := &needle.Needle{Id: types.Uint64ToNeedleId(3)}
+	_, err = v.readNeedle(n, &ReadOption{}, nil)
+	require.NoError(t, err)
+}
diff --git a/weed/storage/volume_tier_deletable_test.go b/weed/storage/volume_tier_deletable_test.go
new file mode 100644
index 0000000000..e1d1af974c
--- /dev/null
+++ b/weed/storage/volume_tier_deletable_test.go
@@ -0,0 +1,123 @@
+package storage
+
+import (
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/require"
+)
+
+// MarkTieredDeletable gives a freshly tiered single-copy volume the flags a
+// restart gives it, and leaves an I/O quarantine alone.
+func TestMarkTieredDeletable(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+
+	v, _ := tierUpVolumeLive(t, t.TempDir(), 81, b)
+	defer v.Close()
+	v.noWriteOrDelete = true // as volume.tier.upload's mark leaves it
+	require.True(t, v.MarkTieredDeletable())
+	require.False(t, v.noWriteOrDelete)
+	require.True(t, v.noWriteCanDelete)
+
+	w, _ := tierUpVolumeLive(t, t.TempDir(), 82, b)
+	defer w.Close()
+	w.noWriteOrDelete = true
+	w.markIoQuarantined()
+	require.False(t, w.MarkTieredDeletable())
+	require.True(t, w.noWriteOrDelete, "an I/O quarantine is not the tier upload's to lift")
+}
+
+// MarkTieredDeletable is only for a tiered volume: a stray call on a local
+// volume must not pin it read-only-can-delete.
+func TestMarkTieredDeletableLeavesANonTieredVolume(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 86, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	defer v.Close()
+
+	require.False(t, v.MarkTieredDeletable())
+	require.False(t, v.noWriteOrDelete)
+	require.False(t, v.noWriteCanDelete)
+}
+
+// A heartbeat that quarantines the volume while MarkTieredDeletable waits for
+// noWriteLock must keep its refusal: the quarantine check and the flag change
+// happen under the same lock.
+func TestMarkTieredDeletableKeepsAConcurrentQuarantine(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+
+	v, _ := tierUpVolumeLive(t, t.TempDir(), 83, b)
+	defer v.Close()
+	v.noWriteOrDelete = true
+
+	v.noWriteLock.Lock()
+	done := make(chan bool)
+	go func() { done <- v.MarkTieredDeletable() }()
+	time.Sleep(100 * time.Millisecond) // let it reach noWriteLock
+	// What CollectHeartbeat does: mark the quarantine, then refuse writes and deletes.
+	v.markIoQuarantined()
+	v.noWriteOrDelete = true
+	v.noWriteLock.Unlock()
+
+	require.False(t, <-done, "a volume quarantined before the flags changed must not be made deletable")
+	v.noWriteLock.RLock()
+	defer v.noWriteLock.RUnlock()
+	require.True(t, v.noWriteOrDelete, "the heartbeat's refusal was overwritten")
+}
+
+// A volume past the I/O error tolerance is about to be quarantined by the next
+// heartbeat; it is not made deletable in the meantime.
+func TestMarkTieredDeletableRefusesAVolumePastIoErrorTolerance(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+
+	v, _ := tierUpVolumeLive(t, t.TempDir(), 84, b)
+	defer v.Close()
+	v.noWriteOrDelete = true
+	for i := 0; i < IoErrorTolerance; i++ {
+		v.noteIoError(syscall.EIO)
+	}
+	require.False(t, v.MarkTieredDeletable())
+	require.True(t, v.noWriteOrDelete)
+
+	v.clearIoError() // positive control: below the tolerance it is made deletable
+	require.True(t, v.MarkTieredDeletable())
+	require.False(t, v.noWriteOrDelete)
+}
+
+// DeleteVolumeNeedle reads the read-only flags under noWriteLock, so a delete
+// that races the tier upload's flag change is not a data race (run with -race).
+func TestDeleteVolumeNeedleRacesMarkTieredDeletable(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+
+	v, _ := tierUpVolumeLive(t, t.TempDir(), 85, b)
+	defer v.Close()
+	v.noWriteOrDelete = true
+	location := newTestLocation(10, false, 0)
+	location.SetVolume(85, v)
+	s := &Store{Locations: []*DiskLocation{location}}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for i := 0; i < 100; i++ {
+			v.MarkTieredDeletable()
+		}
+	}()
+	for i := 0; i < 100; i++ {
+		_, _ = s.DeleteVolumeNeedle(85, &needle.Needle{Id: types.Uint64ToNeedleId(1000)})
+	}
+	<-done
+
+	// Positive control: once deletable, a delete of a live needle goes through.
+	size, err := s.DeleteVolumeNeedle(85, &needle.Needle{Id: types.Uint64ToNeedleId(1)})
+	require.NoError(t, err)
+	require.NotZero(t, size)
+}
diff --git a/weed/storage/volume_tier_intern_test.go b/weed/storage/volume_tier_intern_test.go
new file mode 100644
index 0000000000..2533096698
--- /dev/null
+++ b/weed/storage/volume_tier_intern_test.go
@@ -0,0 +1,59 @@
+package storage
+
+import (
+	"runtime"
+	"testing"
+	"unsafe"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
+)
+
+// Every tiered volume names the same backend and replication, so a server
+// holding millions of them must end up with one copy of each. The sharing has
+// to hold across a collection: a table that lets its entries go hands the next
+// volume a second copy. The remote key names a single volume and is left alone.
+func TestVolumeInfoSharesTheStringsEveryVolumeRepeats(t *testing.T) {
+	dir := t.TempDir()
+	load := func(name, key string) *volume_server_pb.VolumeInfo {
+		t.Helper()
+		path := dir + "/" + name
+		if err := volume_info.SaveVolumeInfo(path, &volume_server_pb.VolumeInfo{
+			Version:     3,
+			Replication: "001",
+			Files: []*volume_server_pb.RemoteFile{{
+				BackendType: "s3", BackendId: "cold", Extension: ".dat", Key: key,
+			}},
+		}); err != nil {
+			t.Fatal(err)
+		}
+		loaded, _, found, err := volume_info.MaybeLoadVolumeInfo(path)
+		if err != nil || !found {
+			t.Fatalf("load %s: found=%v err=%v", name, found, err)
+		}
+		internVolumeInfoStrings(loaded)
+		return loaded
+	}
+
+	first := load("1.vif", "one")
+	runtime.GC()
+	second := load("2.vif", "two")
+
+	shared := func(what, a, b string) {
+		t.Helper()
+		if a != b {
+			t.Fatalf("%s read back as %q then %q", what, a, b)
+		}
+		if unsafe.StringData(a) != unsafe.StringData(b) {
+			t.Errorf("%s was kept twice instead of shared", what)
+		}
+	}
+	shared("replication", first.Replication, second.Replication)
+	shared("backend type", first.Files[0].BackendType, second.Files[0].BackendType)
+	shared("backend id", first.Files[0].BackendId, second.Files[0].BackendId)
+	shared("extension", first.Files[0].Extension, second.Files[0].Extension)
+
+	if first.Files[0].Key != "one" || second.Files[0].Key != "two" {
+		t.Errorf("remote keys came back as %q and %q", first.Files[0].Key, second.Files[0].Key)
+	}
+}
diff --git a/weed/storage/volume_ttl_expiry_test.go b/weed/storage/volume_ttl_expiry_test.go
new file mode 100644
index 0000000000..8ebffc1c8d
--- /dev/null
+++ b/weed/storage/volume_ttl_expiry_test.go
@@ -0,0 +1,458 @@
+package storage
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// TestVolumeTtlClockSurvivesDeletes reproduces the delete-traffic TTL bug:
+// deletes append a tombstone to the .dat, which moves the file's mtime, and
+// the loader read the TTL clock back from that mtime. A volume taking delete
+// traffic therefore had expired() re-armed for another full TTL on every
+// restart and was never reclaimed. The clock has to come from the newest
+// write instead.
+func TestVolumeTtlClockSurvivesDeletes(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+
+	// Backdate the writes on disk so the last one sits well outside the TTL,
+	// while the tombstones below leave the .dat mtime at now.
+	lastWriteNs := uint64(time.Now().Add(-2 * time.Hour).UnixNano())
+	for i := 1; i <= 3; i++ {
+		n := newRandomNeedle(uint64(i))
+		offset, _, _, err := v.writeNeedle2(n, true, false, false)
+		if err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+		backdateAppendAtNs(t, v, int64(offset), n.Size, lastWriteNs)
+	}
+	// More than one tombstone: the scan has to walk back over the whole run of
+	// them to reach a write.
+	for _, id := range []uint64{2, 3} {
+		if _, err := v.doDeleteRequest(newEmptyNeedle(id)); err != nil {
+			t.Fatalf("delete needle %d: %v", id, err)
+		}
+	}
+	contentSize := v.ContentSize()
+	v.Close()
+
+	reloaded, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	defer reloaded.Close()
+
+	if got, want := reloaded.lastModifiedTsSeconds, lastWriteNs/uint64(time.Second); got != want {
+		t.Errorf("TTL clock recovered as %d, want the last write at %d", got, want)
+	}
+	if !reloaded.expired(contentSize, 1024*1024) {
+		t.Error("a TTL volume whose last write is 2h old must be expired after a reload")
+	}
+}
+
+// TestVolumeTtlClockKeepsMtimeWithoutRecoverableWrite covers a TTL volume whose
+// needles carry no append timestamp: the loader must stay on the .dat mtime
+// rather than treat the volume as written at the epoch and drop it on sight.
+func TestVolumeTtlClockKeepsMtimeWithoutRecoverableWrite(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.Version2, 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	contentSize := v.ContentSize()
+	v.Close()
+
+	reloaded, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.Version2, 0, 0)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	defer reloaded.Close()
+
+	if reloaded.expired(contentSize, 1024*1024) {
+		t.Error("a just-written volume must not be expired after a reload")
+	}
+}
+
+// TestVolumeTtlClockAfterVacuumTakesNewestWrite covers the one layout where a
+// .dat's order does not track its write order: vacuum rewrites it by key, and
+// an overwrite keeps its original, lower key. Reading the position rather than
+// the timestamps would recover the highest-key needle's older write time and
+// expire the volume before the overwrite has lived out its TTL.
+func TestVolumeTtlClockAfterVacuumTakesNewestWrite(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+
+	// Needle 1 is overwritten last but sorts first, so vacuum leaves it at the
+	// head of the .dat with the newest timestamp of the three.
+	oldWriteNs := uint64(time.Now().Add(-2 * time.Hour).UnixNano())
+	newWriteNs := uint64(time.Now().Add(-time.Minute).UnixNano())
+	for _, w := range []struct {
+		id uint64
+		ns uint64
+	}{{2, oldWriteNs}, {3, oldWriteNs}, {1, newWriteNs}} {
+		n := newRandomNeedle(w.id)
+		offset, _, _, err := v.writeNeedle2(n, true, false, false)
+		if err != nil {
+			t.Fatalf("write needle %d: %v", w.id, err)
+		}
+		backdateAppendAtNs(t, v, int64(offset), n.Size, w.ns)
+	}
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("compact: %v", err)
+	}
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("commit compact: %v", err)
+	}
+	contentSize := v.ContentSize()
+	v.Close()
+
+	reloaded, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	defer reloaded.Close()
+
+	if got, want := reloaded.lastModifiedTsSeconds, newWriteNs/uint64(time.Second); got != want {
+		t.Errorf("TTL clock recovered as %d, want the newest write at %d", got, want)
+	}
+	if reloaded.expired(contentSize, 1024*1024) {
+		t.Error("a volume overwritten a minute ago must not be expired after a vacuum and reload")
+	}
+}
+
+// TestVolumeTtlClockDeclinesUnaffordableScan covers the budget the vacuumed
+// path runs under. Reading a subset of a key-ordered volume's writes could
+// recover a timestamp older than the newest write and expire live data, so a
+// scan that does not fit has to leave the clock on the mtime instead.
+func TestVolumeTtlClockDeclinesUnaffordableScan(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	oldWriteNs := uint64(time.Now().Add(-2 * time.Hour).UnixNano())
+	for i := 1; i <= 3; i++ {
+		n := newRandomNeedle(uint64(i))
+		offset, _, _, err := v.writeNeedle2(n, true, false, false)
+		if err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+		backdateAppendAtNs(t, v, int64(offset), n.Size, oldWriteNs)
+	}
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("compact: %v", err)
+	}
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("commit compact: %v", err)
+	}
+	contentSize := v.ContentSize()
+	v.Close()
+
+	defer func(budget int) { vacuumedLastWriteScanEntries = budget }(vacuumedLastWriteScanEntries)
+	vacuumedLastWriteScanEntries = 2
+
+	reloaded, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("reload: %v", err)
+	}
+	defer reloaded.Close()
+
+	if reloaded.lastModifiedTsSeconds == oldWriteNs/uint64(time.Second) {
+		t.Error("a scan that ran out of budget must not report a partial maximum as the last write")
+	}
+	if reloaded.expired(contentSize, 1024*1024) {
+		t.Error("declining the scan must leave the volume on its mtime, not expire it")
+	}
+}
+
+// TestVolumeTtlClockSkipsUnaffordableScanWithoutDatReads is the regression test
+// for https://github.com/seaweedfs/seaweedfs/issues/11469: a vacuumed volume
+// holding more live needles than the scan budget must decline recovery before
+// doing any .dat I/O, instead of spending up to two random reads per needle
+// and then keeping the mtime anyway.
+func TestVolumeTtlClockSkipsUnaffordableScanWithoutDatReads(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	for i := 1; i <= 5; i++ {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false); err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+	}
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("compact: %v", err)
+	}
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("commit compact: %v", err)
+	}
+	if v.SuperBlock.CompactionRevision == 0 {
+		t.Fatal("vacuum must bump CompactionRevision for this test to exercise the vacuumed path")
+	}
+
+	indexFile, err := os.Open(v.FileName(".idx"))
+	if err != nil {
+		t.Fatalf("open .idx: %v", err)
+	}
+	defer indexFile.Close()
+	indexStat, err := indexFile.Stat()
+	if err != nil {
+		t.Fatalf("stat .idx: %v", err)
+	}
+
+	var reads countingBackend
+	reads.BackendStorageFile = v.DataBackend
+	v.DataBackend = &reads
+
+	defer func(budget int) { vacuumedLastWriteScanEntries = budget }(vacuumedLastWriteScanEntries)
+	vacuumedLastWriteScanEntries = 2
+
+	appendAtNs, _, err := findLastWriteAppendAtNs(v, indexFile, indexStat.Size())
+	if err != nil {
+		t.Fatalf("recover last write: %v", err)
+	}
+	if appendAtNs != 0 {
+		t.Errorf("over-budget scan must decline with 0, got %d", appendAtNs)
+	}
+	if got := reads.readCount; got != 0 {
+		t.Errorf("over-budget scan did %d .dat reads before declining, want 0", got)
+	}
+}
+
+// TestVolumeTtlClockCarriedAcrossVacuumCommit covers the reload that ends a
+// vacuum commit: the clock must keep the last write's append time rather than
+// be re-derived, and the intervening delete's tombstone must not freshen it.
+func TestVolumeTtlClockCarriedAcrossVacuumCommit(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	lastWriteNs := uint64(time.Now().Add(-2 * time.Hour).UnixNano())
+	for i := 1; i <= 3; i++ {
+		n := newRandomNeedle(uint64(i))
+		offset, _, _, err := v.writeNeedle2(n, true, false, false)
+		if err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+		backdateAppendAtNs(t, v, int64(offset), n.Size, lastWriteNs)
+	}
+	if _, err := v.doDeleteRequest(newEmptyNeedle(2)); err != nil {
+		t.Fatalf("delete needle 2: %v", err)
+	}
+	// Where a restart's recovery would have left the clock. The delete above
+	// pushed lastAppendAtNs to ~now; the commit must not consult it.
+	v.lastModifiedTsSeconds = lastWriteNs / uint64(time.Second)
+	v.lastWriteAppendAtNs = lastWriteNs
+
+	defer func(budget int) { vacuumedLastWriteScanEntries = budget }(vacuumedLastWriteScanEntries)
+	vacuumedLastWriteScanEntries = 1
+
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("compact: %v", err)
+	}
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("commit compact: %v", err)
+	}
+	if v.SuperBlock.CompactionRevision == 0 {
+		t.Fatal("vacuum must bump CompactionRevision for this test to exercise the vacuumed path")
+	}
+
+	if got, want := v.lastModifiedTsSeconds, lastWriteNs/uint64(time.Second); got != want {
+		t.Errorf("TTL clock after commit is %d, want the last write at %d", got, want)
+	}
+	if !v.expired(v.ContentSize(), 1024*1024) {
+		t.Error("a TTL volume whose last write is 2h old must stay expired across a vacuum commit")
+	}
+}
+
+// TestVolumeTtlClockAtCommitUsesAppendTime covers a write whose client
+// supplied modified time does not match when it was appended: the commit
+// keeps the server-side append watermark the recovery scan would recompute.
+func TestVolumeTtlClockAtCommitUsesAppendTime(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	future := uint64(time.Now().Add(24 * time.Hour).Unix())
+	n := newRandomNeedle(1)
+	n.LastModified = future
+	if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	if v.lastModifiedTsSeconds < future {
+		t.Fatalf("clock %d did not follow the needle's modified time %d", v.lastModifiedTsSeconds, future)
+	}
+	appendWatermarkSec := v.lastWriteAppendAtNs / uint64(time.Second)
+
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("compact: %v", err)
+	}
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("commit compact: %v", err)
+	}
+
+	if got := v.lastModifiedTsSeconds; got != appendWatermarkSec {
+		t.Errorf("TTL clock after commit is %d, want the append watermark %d", got, appendWatermarkSec)
+	}
+}
+
+// TestVolumeTtlClockAtCommitSkipsDeletedWrite covers a vacuum commit whose
+// newest write was deleted first: the carried watermark belonged to that
+// write, so the commit has to let the reload rescan and land on the newest
+// surviving write rather than keep the volume alive on a deleted write's time.
+func TestVolumeTtlClockAtCommitSkipsDeletedWrite(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	oldWriteNs := uint64(time.Now().Add(-2 * time.Hour).UnixNano())
+	newWriteNs := uint64(time.Now().Add(-time.Hour).UnixNano())
+	for _, w := range []struct {
+		id uint64
+		ns uint64
+	}{{1, oldWriteNs}, {2, newWriteNs}} {
+		n := newRandomNeedle(w.id)
+		offset, _, _, err := v.writeNeedle2(n, true, false, false)
+		if err != nil {
+			t.Fatalf("write needle %d: %v", w.id, err)
+		}
+		backdateAppendAtNs(t, v, int64(offset), n.Size, w.ns)
+	}
+	// The delete lands inside the commit window: makeupDiff replays its
+	// tombstone into the new .idx behind the write row the copy carried.
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("compact: %v", err)
+	}
+	if _, err := v.doDeleteRequest(newEmptyNeedle(2)); err != nil {
+		t.Fatalf("delete needle 2: %v", err)
+	}
+	if !v.lastWriteDeleted {
+		t.Fatal("deleting the newest write must mark the watermark dead")
+	}
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("commit compact: %v", err)
+	}
+
+	if got, want := v.lastModifiedTsSeconds, oldWriteNs/uint64(time.Second); got != want {
+		t.Errorf("TTL clock after commit is %d, want the surviving write at %d", got, want)
+	}
+	if v.lastWriteDeleted {
+		t.Error("the reload's rescan must reseed the watermark off the surviving write")
+	}
+}
+
+// TestVolumeExpireAtSecCountsFromLastWrite guards the destroy time an EC volume
+// is reclaimed on (erasure_coding.EcVolume.IsTimeToDestroy). It was recomputed
+// as now+TTL on every .vif write, so a read-only mark, a tier upload or an EC
+// encode handed an already expiring volume another full TTL.
+func TestVolumeExpireAtSecCountsFromLastWrite(t *testing.T) {
+	dir := t.TempDir()
+	ttl, err := needle.ReadTTL("5m")
+	if err != nil {
+		t.Fatalf("read ttl: %v", err)
+	}
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, ttl, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	// A volume with nothing written yet has no last write to count from, and
+	// must not land in 1970 with its data due for destruction on sight.
+	if got := v.GetVolumeInfo().ExpireAtSec; got < uint64(time.Now().Unix()) {
+		t.Errorf("a fresh volume expires at %d, already in the past", got)
+	}
+
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	v.lastModifiedTsSeconds = uint64(time.Now().Add(-time.Hour).Unix())
+	want := v.lastModifiedTsSeconds + ttl.ToSeconds()
+
+	for i := 0; i < 2; i++ {
+		if err := v.SaveVolumeInfo(); err != nil {
+			t.Fatalf("save .vif: %v", err)
+		}
+		if got := v.GetVolumeInfo().ExpireAtSec; got != want {
+			t.Fatalf(".vif save %d put ExpireAtSec at %d, want %d counted from the last write", i, got, want)
+		}
+	}
+}
+
+func backdateAppendAtNs(t *testing.T, v *Volume, offset int64, size types.Size, appendAtNs uint64) {
+	t.Helper()
+	stamp := make([]byte, types.TimestampSize)
+	util.Uint64toBytes(stamp, appendAtNs)
+	tsOffset := offset + types.NeedleHeaderSize + int64(size) + needle.NeedleChecksumSize
+	if _, err := v.DataBackend.WriteAt(stamp, tsOffset); err != nil {
+		t.Fatalf("backdate the needle at offset %d: %v", offset, err)
+	}
+}
diff --git a/weed/storage/volume_vacuum.go b/weed/storage/volume_vacuum.go
index a1e2835ede..12b86982fc 100644
--- a/weed/storage/volume_vacuum.go
+++ b/weed/storage/volume_vacuum.go
@@ -38,6 +38,12 @@ func isSkippableNeedleReadError(err error) bool {
 		errors.Is(err, needle.ErrorCorrupted)
 }
 
+// exceedsExpectedCompactedSize reports whether the compacted .dat is short of
+// the live bytes the pre-compaction index snapshot expected.
+func exceedsExpectedCompactedSize(expectedLiveBytes uint64, dstDatSize int64) bool {
+	return expectedLiveBytes > uint64(dstDatSize)
+}
+
 type ProgressFunc func(processed int64) bool
 
 func (v *Volume) garbageLevel() float64 {
@@ -56,6 +62,14 @@ func (v *Volume) garbageLevel() float64 {
 	return float64(deletedSize) / float64(fileSize)
 }
 
+// errTieredVolumeCompact refuses a compaction of a volume whose .dat is in the
+// remote tier: the copy reads the local .dat, which tiering removes (or leaves
+// behind as a stale copy), and the reload after a commit would read the remote
+// object through the compacted index.
+func errTieredVolumeCompact(vid needle.VolumeId) error {
+	return fmt.Errorf("volume %d is tiered to remote storage, cannot compact", vid)
+}
+
 type CompactOptions struct {
 	PreallocateBytes  int64
 	MaxBytesPerSecond int64
@@ -81,6 +95,9 @@ func (v *Volume) CompactByVolumeData(opts *CompactOptions) error {
 		return nil
 	}
 	glog.V(3).Infof("Compacting volume %d ...", v.Id)
+	if v.HasRemoteFile() {
+		return errTieredVolumeCompact(v.Id)
+	}
 	//no need to lock for copy on write
 	//v.accessLock.Lock()
 	//defer v.accessLock.Unlock()
@@ -126,6 +143,9 @@ func (v *Volume) CompactByIndex(opts *CompactOptions) error {
 		return nil
 	}
 	glog.V(3).Infof("Compact2 volume %d ...", v.Id)
+	if v.HasRemoteFile() {
+		return errTieredVolumeCompact(v.Id)
+	}
 
 	if !v.isCompactionInProgress.CompareAndSwap(false, true) {
 		glog.V(0).Infof("Volume %d is already compacting2 ...", v.Id)
@@ -171,10 +191,27 @@ func (v *Volume) CommitCompact() error {
 	}
 	defer v.isCompactionInProgress.Store(false)
 
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 
 	glog.V(3).Infof("Got volume %d committing lock...", v.Id)
+	if v.HasRemoteFile() {
+		// The volume was tiered after the copy started: the reload would read
+		// the remote object through the compacted index. Drop the copy and its
+		// temporary needle map; no later vacuum of this volume would.
+		if v.tmpNm != nil {
+			v.tmpNm.Close()
+			v.tmpNm = nil
+		}
+		for _, ext := range []string{".cpd", ".cpx", ".cpldb"} {
+			if e := os.RemoveAll(v.FileName(ext)); e != nil {
+				glog.V(0).Infof("remove %s: %v", v.FileName(ext), e)
+			}
+		}
+		return errTieredVolumeCompact(v.Id)
+	}
 	if v.nm != nil {
 		v.nm.Close()
 		v.nm = nil
@@ -216,7 +253,17 @@ func (v *Volume) CommitCompact() error {
 	//time.Sleep(20 * time.Second)
 
 	glog.V(3).Infof("Loading volume %d commit file...", v.Id)
-	if e := v.load(true, false, v.needleMapKind, 0, v.Version()); e != nil {
+	// The write watermark already equals what recoverLastModifiedTs would
+	// rescan, so keep the clock instead of paying for the scan under the lock.
+	// If its write was itself deleted, the reload recovers the newest
+	// surviving write instead.
+	if v.lastWriteAppendAtNs != 0 {
+		v.lastModifiedTsSeconds = v.lastWriteAppendAtNs / uint64(time.Second)
+	}
+	v.keepLastModifiedTsOnLoad = v.lastModifiedTsSeconds != 0 && !v.lastWriteDeleted
+	e := v.load(true, false, v.needleMapKind, 0, v.Version())
+	v.keepLastModifiedTsOnLoad = false
+	if e != nil {
 		return e
 	}
 	glog.V(3).Infof("Finish committing volume %d", v.Id)
@@ -351,6 +398,8 @@ func (v *Volume) cleanupCompact() error {
 	// Serialize with CommitCompact's swap and refuse to unlink .cpd/.cpx while a
 	// .cpc marker exists: those temp files are the only inputs reconcile can roll
 	// forward to, so removing them mid-commit would strand a decided swap.
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 	if util.FileExists(v.FileName(".cpc")) {
@@ -480,7 +529,12 @@ func (v *Volume) makeupDiff(newDatFileName, newIdxFileName, oldDatFileName, oldI
 	defer func() {
 		// makeupDiff appends new needles/tombstones to the .cpx; its fsync is the
 		// durability gate that must succeed before CommitCompact writes the .cpc
-		// marker and swaps the files.
+		// marker and swaps the files. Sync the dat file once after all appends
+		// rather than per-needle — a fsync per entry scales poorly on slow disks
+		// and can exceed test timeouts with large entry counts.
+		if syncErr := dstDatBackend.Sync(); syncErr != nil && err == nil {
+			err = fmt.Errorf("sync dat %s: %v", newDatFileName, syncErr)
+		}
 		if syncErr := idx.Sync(); syncErr != nil && err == nil {
 			err = fmt.Errorf("sync idx %s: %v", newIdxFileName, syncErr)
 		}
@@ -530,10 +584,7 @@ func (v *Volume) makeupDiff(newDatFileName, newIdxFileName, oldDatFileName, oldI
 				return fmt.Errorf("ReadNeedleBlob %s key %d offset %d size %d failed: %w", oldDatFile.Name(), key, increIdxEntry.offset.ToActualOffset(), increIdxEntry.size, err)
 			}
 			dstDatBackend.Write(needleBytes)
-			if err := dstDatBackend.Sync(); err != nil {
-				return fmt.Errorf("cannot sync needle %s: %v", dstDatBackend.File.Name(), err)
-			}
-			util.Uint32toBytes(idxEntryBytes[8:12], uint32(offset/NeedlePaddingSize))
+			idxEntryBytes = needle_map.ToBytes(key, ToOffset(offset), increIdxEntry.size)
 		} else { //deleted needle
 			//fakeDelNeedle's default Data field is nil
 			fakeDelNeedle := new(needle.Needle)
@@ -674,8 +725,9 @@ func (v *Volume) copyDataBasedOnIndexFile(opts *CompactOptions) (err error) {
 
 	writeThrottler := util.NewWriteThrottler(opts.MaxBytesPerSecond)
 	var (
-		skippedNeedles   int
-		skippedDataBytes uint64
+		skippedNeedles    int
+		skippedDataBytes  uint64
+		expectedLiveBytes uint64
 	)
 	err = oldNm.AscendingVisit(func(value needle_map.NeedleValue) error {
 
@@ -715,6 +767,8 @@ func (v *Volume) copyDataBasedOnIndexFile(opts *CompactOptions) (err error) {
 			return nil
 		}
 
+		expectedLiveBytes += uint64(size)
+
 		if err = newNm.Set(n.Id, ToOffset(newOffset), n.Size); err != nil {
 			return fmt.Errorf("cannot put needle: %s", err)
 		}
@@ -735,28 +789,17 @@ func (v *Volume) copyDataBasedOnIndexFile(opts *CompactOptions) (err error) {
 		glog.Warningf("vacuum volume %d: dropped %d unreadable index entries (%d data bytes) during compaction",
 			v.Id, skippedNeedles, skippedDataBytes)
 	}
-	if v.Ttl.String() == "" && v.nm != nil {
+	if v.Ttl.String() == "" {
 		dstDatSize, _, err := dstDatBackend.GetStat()
 		if err != nil {
 			return err
 		}
-		if v.nm.ContentSize() > v.nm.DeletedSize() {
-			expectedContentSize := v.nm.ContentSize() - v.nm.DeletedSize()
-			// Skipped needles still contribute to the source-side ContentSize but
-			// were not written to the destination, so subtract them before the
-			// safety check to avoid a false positive.
-			if skippedDataBytes >= expectedContentSize {
-				expectedContentSize = 0
-			} else {
-				expectedContentSize -= skippedDataBytes
-			}
-			if expectedContentSize > uint64(dstDatSize) {
-				return fmt.Errorf("volume %s unexpected new data size: %d does not match size of content minus deleted: %d",
-					v.Id.String(), dstDatSize, expectedContentSize)
-			}
-		} else if v.nm.DeletedSize() > v.nm.ContentSize() {
-			glog.Warningf("volume %s content size: %d less deleted size: %d, new size: %d",
-				v.Id.String(), v.nm.ContentSize(), v.nm.DeletedSize(), dstDatSize)
+		// expectedLiveBytes is tallied from oldNm (the frozen snapshot this
+		// loop copied from), not the live v.nm; unreadable needles already
+		// return before the tally, so no further skipped-byte adjustment.
+		if exceedsExpectedCompactedSize(expectedLiveBytes, dstDatSize) {
+			return fmt.Errorf("volume %s unexpected new data size: %d does not match expected live content size %d from the pre-compaction snapshot",
+				v.Id.String(), dstDatSize, expectedLiveBytes)
 		}
 	}
 	err = newNm.SaveToIdx(opts.destIdxPath)
diff --git a/weed/storage/volume_vacuum_5byte_offset_test.go b/weed/storage/volume_vacuum_5byte_offset_test.go
new file mode 100644
index 0000000000..e0ab7c365b
--- /dev/null
+++ b/weed/storage/volume_vacuum_5byte_offset_test.go
@@ -0,0 +1,90 @@
+//go:build 5BytesOffset
+
+package storage
+
+import (
+	"bytes"
+	"os"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/idx"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// A write replayed by makeupDiff must record all offset bytes, including when
+// the new offset lands in a different 32 GiB range than the old one.
+func TestConcurrentWriteCrossesOffsetBoundary(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 784, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.Version3, 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer v.Close()
+	write := func(key uint64, size int) *needle.Needle {
+		n := &needle.Needle{Id: types.Uint64ToNeedleId(key), Data: bytes.Repeat([]byte("x"), size)}
+		n.Checksum = needle.NewCRC(n.Data)
+		if _, _, _, err := v.writeNeedle2(n, true, false, false); err != nil {
+			t.Fatal(err)
+		}
+		return n
+	}
+	write(1, 32)
+	if err := v.DataBackend.Truncate(64 << 30); err != nil {
+		t.Fatal(err)
+	}
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatal(err)
+	}
+	written := write(342511246, 113)
+	before := newEmptyNeedle(uint64(written.Id))
+	if _, err := v.readNeedle(before, nil, nil); err != nil || !bytes.Equal(before.Data, written.Data) {
+		t.Fatalf("read before commit: %v", err)
+	}
+	cpd, err := os.Stat(v.FileName(".cpd"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	expectedOffset := cpd.Size()
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("commit: %v", err)
+	}
+	indexFile, err := os.Open(v.FileName(".idx"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer indexFile.Close()
+	var actualOffset int64
+	if err := idx.WalkIndexFile(indexFile, 0, func(key types.NeedleId, offset types.Offset, _ types.Size) error {
+		if key == written.Id {
+			actualOffset = offset.ToActualOffset()
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	after := newEmptyNeedle(uint64(written.Id))
+	_, readErr := v.readNeedle(after, nil, nil)
+	t.Logf("stored offset=%d, correct offset=%d, excess=%d, post-commit read=%v", actualOffset, expectedOffset, actualOffset-expectedOffset, readErr)
+	if actualOffset != expectedOffset || readErr != nil || !bytes.Equal(after.Data, written.Data) {
+		physical := new(needle.Needle)
+		if err := physical.ReadData(v.DataBackend, expectedOffset, written.Size, v.Version()); err == nil && bytes.Equal(physical.Data, written.Data) {
+			t.Logf("body intact at offset %d despite the bad index entry", expectedOffset)
+		}
+		t.Fatalf("replayed write lost: stored offset=%d, want=%d, read=%v", actualOffset, expectedOffset, readErr)
+	}
+
+	if err := v.CompactByIndex(nil); err != nil {
+		t.Fatalf("second compact: %v", err)
+	}
+	if err := v.CommitCompact(); err != nil {
+		t.Fatalf("second commit: %v", err)
+	}
+	if _, err := v.readNeedle(newEmptyNeedle(uint64(written.Id)), nil, nil); err != nil {
+		t.Fatalf("needle lost after second vacuum: %v", err)
+	}
+	if _, present := v.nm.Get(written.Id); !present {
+		t.Fatal("needle missing from index after second vacuum")
+	}
+}
diff --git a/weed/storage/volume_vacuum_crash_safe_test.go b/weed/storage/volume_vacuum_crash_safe_test.go
index 5773978217..74279017a5 100644
--- a/weed/storage/volume_vacuum_crash_safe_test.go
+++ b/weed/storage/volume_vacuum_crash_safe_test.go
@@ -42,7 +42,7 @@ func TestReconcileRollForwardMarkerOnly(t *testing.T) {
 
 	const liveCount = 6
 	for i := uint64(1); i <= liveCount; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false, false); err != nil {
 			t.Fatalf("write %d: %v", i, err)
 		}
 	}
@@ -117,7 +117,7 @@ func TestReconcileRollForwardPartialRename(t *testing.T) {
 	}
 	const liveCount = 6
 	for i := uint64(1); i <= liveCount; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false, false); err != nil {
 			t.Fatalf("write %d: %v", i, err)
 		}
 	}
@@ -182,7 +182,7 @@ func TestReconcileRollBackNoMarker(t *testing.T) {
 		t.Fatalf("volume creation: %v", err)
 	}
 	for i := uint64(1); i <= 4; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false, false); err != nil {
 			t.Fatalf("write %d: %v", i, err)
 		}
 	}
@@ -228,7 +228,7 @@ func TestReconcileSkipsLoadedVolumeMidVacuum(t *testing.T) {
 		t.Fatalf("volume creation: %v", err)
 	}
 	for i := uint64(1); i <= 4; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false, false); err != nil {
 			t.Fatalf("write %d: %v", i, err)
 		}
 	}
@@ -270,7 +270,7 @@ func TestApplyCompactSwapMissingTempFilesPreservesLive(t *testing.T) {
 		t.Fatalf("volume creation: %v", err)
 	}
 	for i := uint64(1); i <= 3; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false, false); err != nil {
 			t.Fatalf("write %d: %v", i, err)
 		}
 	}
@@ -305,7 +305,7 @@ func TestDestroyRemovesCommitMarker(t *testing.T) {
 		t.Fatalf("volume creation: %v", err)
 	}
 	for i := uint64(1); i <= 3; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false, false); err != nil {
 			t.Fatalf("write %d: %v", i, err)
 		}
 	}
@@ -320,7 +320,7 @@ func TestDestroyRemovesCommitMarker(t *testing.T) {
 		}
 	}
 
-	if err := v.Destroy(false, false); err != nil {
+	if err := v.Destroy(false, false, false); err != nil {
 		t.Fatalf("destroy: %v", err)
 	}
 
diff --git a/weed/storage/volume_vacuum_test.go b/weed/storage/volume_vacuum_test.go
index 5dd990a42a..28c7f9db75 100644
--- a/weed/storage/volume_vacuum_test.go
+++ b/weed/storage/volume_vacuum_test.go
@@ -1,6 +1,9 @@
 package storage
 
 import (
+	"bytes"
+	"errors"
+	"fmt"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -102,6 +105,7 @@ func testCompactionByIndex(t *testing.T, needleMapKind NeedleMapKind) {
 	}
 	v.CommitCompact()
 	realRecordCount := v.nm.IndexFileSize() / types.NeedleMapEntrySize
+	liveRowCount := uint64(countLiveIndexRows(t, v.FileName(".idx")))
 	if needleMapKind == NeedleMapLevelDb {
 		nm := reflect.ValueOf(v.nm).Interface().(*LevelDbNeedleMap)
 		mm := nm.mapMetric
@@ -112,10 +116,10 @@ func testCompactionByIndex(t *testing.T, needleMapKind NeedleMapKind) {
 			t.Fatalf("testing watermark failed")
 		}
 	} else {
-		t.Logf("realRecordCount:%d, v.FileCount():%d mm.DeletedCount():%d", realRecordCount, v.FileCount(), v.DeletedCount())
+		t.Logf("realRecordCount:%d, liveRowCount:%d, v.FileCount():%d mm.DeletedCount():%d", realRecordCount, liveRowCount, v.FileCount(), v.DeletedCount())
 	}
-	if realRecordCount != v.FileCount() {
-		t.Fatalf("testing file count failed")
+	if liveRowCount != v.FileCount() {
+		t.Fatalf("testing file count failed: live idx rows %d, FileCount %d", liveRowCount, v.FileCount())
 	}
 
 	v.Close()
@@ -166,7 +170,7 @@ func TestCommitCompactDeletionTailKeepsWritable(t *testing.T) {
 	}
 
 	for i := uint64(1); i <= 5; i++ {
-		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false); err != nil {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(i), true, false, false); err != nil {
 			t.Fatalf("write %d: %v", i, err)
 		}
 	}
@@ -299,7 +303,7 @@ func TestCompactByIndex_DropsDanglingNeedle(t *testing.T) {
 	infos := make([]*needleInfo, goodNeedleCount)
 	for i := 1; i <= goodNeedleCount; i++ {
 		n := newRandomNeedle(uint64(i))
-		_, size, _, err := v.writeNeedle2(n, true, false)
+		_, size, _, err := v.writeNeedle2(n, true, false, false)
 		if err != nil {
 			t.Fatalf("write needle %d: %v", i, err)
 		}
@@ -367,9 +371,224 @@ func TestCompactByIndex_DropsDanglingNeedle(t *testing.T) {
 	v.Close()
 }
 
+// TestCompactByIndex_ConcurrentWriteDoesNotFailIntegrityCheck reproduces the
+// vacuum-vs-live-traffic race: a needle written to the volume after
+// CompactByIndex has already loaded its point-in-time index snapshot must not
+// trip the post-copy integrity check. CommitCompact's makeupDiff is what
+// reconciles a write landing mid-copy (see TestCommitCompactDeletionTailKeepsWritable);
+// the copy-phase check must not treat that expected case as corruption.
+func TestCompactByIndex_ConcurrentWriteDoesNotFailIntegrityCheck(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	for i := 1; i <= 8; i++ {
+		if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(i)), true, false, false); err != nil {
+			t.Fatalf("write needle %d: %v", i, err)
+		}
+	}
+
+	wroteConcurrently := false
+	opts := &CompactOptions{
+		ProgressCallback: func(processed int64) bool {
+			if !wroteConcurrently {
+				wroteConcurrently = true
+				// Simulate a client write landing on the live volume while
+				// CompactByIndex is still copying the pre-write snapshot.
+				if _, _, _, err := v.writeNeedle2(newRandomNeedle(uint64(100)), true, false, false); err != nil {
+					t.Fatalf("concurrent write: %v", err)
+				}
+			}
+			return true
+		},
+	}
+
+	if err := v.CompactByIndex(opts); err != nil {
+		t.Fatalf("CompactByIndex should tolerate a write that lands mid-copy, got: %v", err)
+	}
+}
+
+// TestCompactByVolumeData_SkipsNegativeSizeHeader covers issue #6763: a .dat
+// record whose header carries size -1 made compaction panic with "slice bounds
+// out of range [:-1]". The corrupt record must be skipped and the needles on
+// both sides of it kept.
+func TestCompactByVolumeData_SkipsNegativeSizeHeader(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+		t.Fatalf("write needle 1: %v", err)
+	}
+
+	// Size -1 still yields a positive body length, so the scan reads a body
+	// for this record and parses it.
+	datSize, _, err := v.DataBackend.GetStat()
+	if err != nil {
+		t.Fatalf("stat .dat: %v", err)
+	}
+	corrupt := make([]byte, needle.GetActualSize(-1, v.Version()))
+	types.NeedleIdToBytes(corrupt[types.CookieSize:types.CookieSize+types.NeedleIdSize], types.Uint64ToNeedleId(99))
+	types.SizeToBytes(corrupt[types.CookieSize+types.NeedleIdSize:types.NeedleHeaderSize], -1)
+	if _, err := v.DataBackend.WriteAt(corrupt, datSize); err != nil {
+		t.Fatalf("append corrupt record: %v", err)
+	}
+
+	if _, _, _, err := v.writeNeedle2(newRandomNeedle(2), true, false, false); err != nil {
+		t.Fatalf("write needle 2: %v", err)
+	}
+
+	if err := v.CompactByVolumeData(nil); err != nil {
+		t.Fatalf("CompactByVolumeData: %v", err)
+	}
+
+	cpx, err := os.Open(filepath.Join(dir, "1.cpx"))
+	if err != nil {
+		t.Fatalf("open .cpx: %v", err)
+	}
+	defer cpx.Close()
+	kept := map[types.NeedleId]bool{}
+	if err := idx.WalkIndexFile(cpx, 0, func(key types.NeedleId, _ types.Offset, size types.Size) error {
+		if size.IsValid() {
+			kept[key] = true
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("walk .cpx: %v", err)
+	}
+	for _, id := range []uint64{1, 2} {
+		if !kept[types.Uint64ToNeedleId(id)] {
+			t.Errorf("needle %d missing from the compacted index", id)
+		}
+	}
+	if kept[types.Uint64ToNeedleId(99)] {
+		t.Errorf("corrupt record 99 should not be in the compacted index")
+	}
+}
+
+// A corrupt header the scan cannot advance past must fail compaction and
+// leave the original volume untouched.
+func TestCompactByVolumeData_FailsOnHeaderThatCannotAdvance(t *testing.T) {
+	for _, size := range []types.Size{-36, -100} {
+		t.Run(fmt.Sprintf("size%d", size), func(t *testing.T) {
+			dir := t.TempDir()
+
+			v, err := NewVolume(dir, dir, "", 1, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+			if err != nil {
+				t.Fatalf("volume creation: %v", err)
+			}
+			stuck := false
+			defer func() {
+				if !stuck {
+					v.Close() // blocks until a running compaction ends
+				}
+			}()
+
+			if _, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, false, false); err != nil {
+				t.Fatalf("write needle 1: %v", err)
+			}
+			datSize, _, err := v.DataBackend.GetStat()
+			if err != nil {
+				t.Fatalf("stat .dat: %v", err)
+			}
+			corrupt := make([]byte, types.NeedleHeaderSize)
+			types.NeedleIdToBytes(corrupt[types.CookieSize:types.CookieSize+types.NeedleIdSize], types.Uint64ToNeedleId(99))
+			types.SizeToBytes(corrupt[types.CookieSize+types.NeedleIdSize:], size)
+			if _, err := v.DataBackend.WriteAt(corrupt, datSize); err != nil {
+				t.Fatalf("append corrupt header: %v", err)
+			}
+			if _, _, _, err := v.writeNeedle2(newRandomNeedle(2), true, false, false); err != nil {
+				t.Fatalf("write needle 2: %v", err)
+			}
+			datBefore, err := os.ReadFile(v.FileName(".dat"))
+			if err != nil {
+				t.Fatalf("read .dat: %v", err)
+			}
+
+			err = runWithTimeout(10*time.Second, func() error { return v.CompactByVolumeData(nil) })
+			if errors.Is(err, errDidNotReturn) {
+				stuck = true
+				t.Fatalf("CompactByVolumeData: %v", err)
+			}
+			if !errors.Is(err, needle.ErrorCorrupted) {
+				t.Fatalf("CompactByVolumeData error = %v, want one wrapping ErrorCorrupted", err)
+			}
+
+			if _, err := os.Stat(v.FileName(".cpx")); !os.IsNotExist(err) {
+				t.Errorf("failed compaction left a compacted index: %v", err)
+			}
+			datAfter, err := os.ReadFile(v.FileName(".dat"))
+			if err != nil {
+				t.Fatalf("read .dat: %v", err)
+			}
+			if !bytes.Equal(datBefore, datAfter) {
+				t.Errorf(".dat changed: %d bytes before, %d after", len(datBefore), len(datAfter))
+			}
+			for _, id := range []uint64{1, 2} {
+				n := &needle.Needle{Id: types.Uint64ToNeedleId(id)}
+				if _, err := v.readNeedle(n, &ReadOption{}, nil); err != nil {
+					t.Errorf("read needle %d from the original volume: %v", id, err)
+				}
+			}
+		})
+	}
+}
+
+// TestExceedsExpectedCompactedSize guards the copy-phase integrity check
+// against regressing into double-subtracting skipped bytes: expectedLiveBytes
+// already excludes needles dropped as unreadable (they return before being
+// added to the tally), so the check must compare it directly against the
+// compacted .dat size, with no further adjustment for skipped bytes.
+func TestExceedsExpectedCompactedSize(t *testing.T) {
+	cases := []struct {
+		name              string
+		expectedLiveBytes uint64
+		dstDatSize        int64
+		wantExceeds       bool
+	}{
+		{"destination matches expected size exactly", 100, 100, false},
+		{"destination larger than expected is fine", 100, 150, false},
+		{"destination short of expected signals data loss", 100, 90, true},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			if got := exceedsExpectedCompactedSize(c.expectedLiveBytes, c.dstDatSize); got != c.wantExceeds {
+				t.Fatalf("exceedsExpectedCompactedSize(%d, %d) = %v, want %v", c.expectedLiveBytes, c.dstDatSize, got, c.wantExceeds)
+			}
+		})
+	}
+}
+
+func countLiveIndexRows(t *testing.T, indexFileName string) int {
+	t.Helper()
+	f, err := os.Open(indexFileName)
+	if err != nil {
+		t.Fatalf("open index file %s: %v", indexFileName, err)
+	}
+	defer f.Close()
+	count := 0
+	if err := idx.WalkIndexFile(f, 0, func(key types.NeedleId, offset types.Offset, size types.Size) error {
+		if !offset.IsZero() && !size.IsDeleted() {
+			count++
+		}
+		return nil
+	}); err != nil {
+		t.Fatalf("walk index file %s: %v", indexFileName, err)
+	}
+	return count
+}
+
 func doSomeWritesDeletes(i int, v *Volume, t *testing.T, infos []*needleInfo) {
 	n := newRandomNeedle(uint64(i))
-	_, size, _, err := v.writeNeedle2(n, true, false)
+	_, size, _, err := v.writeNeedle2(n, true, false, false)
 	if err != nil {
 		t.Fatalf("write file %d: %v", i, err)
 	}
diff --git a/weed/storage/volume_vacuum_tiered_test.go b/weed/storage/volume_vacuum_tiered_test.go
new file mode 100644
index 0000000000..e39de29385
--- /dev/null
+++ b/weed/storage/volume_vacuum_tiered_test.go
@@ -0,0 +1,111 @@
+package storage
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// A tiered volume that accepted deletes has garbage, but its .dat is remote:
+// the compaction must be refused before any copy, and the store must not
+// report the volume as a vacuum candidate.
+func TestCompactRefusesTieredVolume(t *testing.T) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+	dir := t.TempDir()
+	const vid = needle.VolumeId(34)
+	v, _ := tierUpVolumeLive(t, dir, vid, b)
+	defer v.Close()
+	require.True(t, v.HasRemoteFile())
+	for i := 1; i <= 4; i++ {
+		_, err := v.deleteNeedle2(newRandomNeedle(uint64(i)))
+		require.NoError(t, err)
+	}
+	garbage := v.garbageLevel()
+	require.Greater(t, garbage, 0.0, "precondition: the deletes left garbage")
+
+	require.ErrorContains(t, v.CompactByIndex(nil), "tiered")
+	require.ErrorContains(t, v.CompactByVolumeData(nil), "tiered")
+	require.False(t, util.FileExists(v.FileName(".cpd")))
+	require.False(t, util.FileExists(v.FileName(".cpx")))
+
+	loc := &DiskLocation{Directory: dir, volumes: map[needle.VolumeId]*Volume{}}
+	loc.SetVolume(vid, v)
+	s := &Store{Locations: []*DiskLocation{loc}}
+	ratio, _, err := s.CheckCompactVolume(vid)
+	require.NoError(t, err)
+	// volume.tier.compact reads this ratio while the volume is still remote to
+	// decide whether to download and compact it; vacuum selection skips tiered
+	// volumes by their remote storage name instead.
+	require.Equal(t, garbage, ratio, "a tiered volume reports its real garbage ratio")
+}
+
+// A volume tiered while its compaction copy ran (keeping the local .dat) must
+// not commit: the reload would read the remote object, which has the old
+// layout, through the compacted index.
+func TestCommitCompactRefusesVolumeTieredDuringCopy(t *testing.T) {
+	t.Run("memory", func(t *testing.T) { testCommitCompactRefusesVolumeTieredDuringCopy(t, NeedleMapInMemory) })
+	t.Run("leveldb", func(t *testing.T) { testCommitCompactRefusesVolumeTieredDuringCopy(t, NeedleMapLevelDb) })
+}
+
+func testCommitCompactRefusesVolumeTieredDuringCopy(t *testing.T, kind NeedleMapKind) {
+	b := newLocalDirBackend(t)
+	registerTestBackend(t, b)
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 35, kind, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	defer v.Close()
+
+	written := map[uint64][]byte{}
+	for i := uint64(1); i <= 6; i++ {
+		n := newRandomNeedle(i)
+		n.Cookie = 7
+		_, _, _, err := v.writeNeedle2(n, true, false, false)
+		require.NoError(t, err)
+		written[i] = n.Data
+	}
+	for i := uint64(1); i <= 3; i++ {
+		_, err := v.deleteNeedle2(newEmptyNeedle(i))
+		require.NoError(t, err)
+	}
+	require.NoError(t, v.CompactByIndex(nil))
+	require.True(t, util.FileExists(v.FileName(".cpd")))
+	require.NotNil(t, v.tmpNm, "precondition: the copy left its temporary needle map")
+	if kind == NeedleMapLevelDb {
+		require.True(t, util.FileExists(v.FileName(".cpldb")), "precondition: the copy left its temporary LevelDB")
+	}
+
+	// tier the volume up, keeping the local .dat
+	diskFile, ok := v.DataBackend.(*backend.DiskFile)
+	require.True(t, ok)
+	key, size, err := b.CopyFile(diskFile.File, nil, 0)
+	require.NoError(t, err)
+	bType, bId := backend.BackendNameToTypeId(testBackendName)
+	v.GetVolumeInfo().Files = append(v.GetVolumeInfo().GetFiles(), &volume_server_pb.RemoteFile{
+		BackendType: bType, BackendId: bId, Key: key, FileSize: uint64(size),
+		ModifiedTime: uint64(time.Now().Unix()), Extension: ".dat",
+	})
+	require.NoError(t, v.SaveVolumeInfo())
+	require.NoError(t, v.LoadRemoteFile())
+
+	require.ErrorContains(t, v.CommitCompact(), "tiered")
+	require.False(t, util.FileExists(v.FileName(".cpd")))
+	require.False(t, util.FileExists(v.FileName(".cpx")))
+	require.False(t, util.FileExists(v.FileName(".cpldb")), "the temporary LevelDB is left on disk")
+	require.Nil(t, v.tmpNm, "the temporary needle map is kept")
+	for i := uint64(4); i <= 6; i++ {
+		got := &needle.Needle{Id: types.Uint64ToNeedleId(i), Cookie: 7}
+		_, err := v.readNeedle(got, nil, nil)
+		require.NoError(t, err, "needle %d", i)
+		require.True(t, bytes.Equal(written[i], got.Data), "needle %d data", i)
+	}
+}
diff --git a/weed/storage/volume_write.go b/weed/storage/volume_write.go
index 070d9bd811..f119425fff 100644
--- a/weed/storage/volume_write.go
+++ b/weed/storage/volume_write.go
@@ -4,8 +4,9 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io"
 	"os"
-	"syscall"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
@@ -17,27 +18,6 @@ var ErrorNotFound = errors.New("not found")
 var ErrorDeleted = errors.New("already deleted")
 var ErrorSizeMismatch = errors.New("size mismatch")
 
-// IoErrorTolerance is the number of consecutive EIOs a volume must
-// see before CollectHeartbeat treats the replica as broken. A single
-// transient error is forgiven so a brief NFS / fabric / power blip
-// affecting several replicas at once does not cascade into removal of
-// the last healthy copy.
-const IoErrorTolerance = 3
-
-func (v *Volume) checkReadWriteError(err error) {
-	if err == nil {
-		v.clearIoError()
-		return
-	}
-	if errors.Is(err, syscall.EIO) {
-		v.noteIoError(err)
-		return
-	}
-	// non-EIO error breaks the EIO streak — only sustained EIOs should
-	// be treated as a failing volume.
-	v.clearIoError()
-}
-
 // isFileUnchanged checks whether this needle to write is same as last one.
 // It requires serialized access in the same volume.
 func (v *Volume) isFileUnchanged(n *needle.Needle) bool {
@@ -66,34 +46,38 @@ var ErrVolumeNotEmpty = fmt.Errorf("volume not empty")
 // Destroy removes everything related to this volume. When keepRemoteData is
 // true the cloud-tier object backing the volume is left intact — used by
 // moves where another server is taking over the same .vif.
-func (v *Volume) Destroy(onlyEmpty bool, keepRemoteData bool) (err error) {
+func (v *Volume) Destroy(onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) (err error) {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
+	return v.destroyLocked(onlyEmpty, onlyGarbage, keepRemoteData)
+}
 
-	if onlyEmpty {
-		isEmpty, e := v.doIsEmpty()
-		if e != nil {
-			err = fmt.Errorf("failed to read isEmpty %v", e)
-			return
-		}
-		if !isEmpty {
-			err = ErrVolumeNotEmpty
-			return
-		}
+// destroyLocked is Destroy for callers already holding dataFileAccessLock,
+// e.g. a guarded multi-copy delete that pins every copy under one lock span
+// so validation and removal cannot be split by a write.
+func (v *Volume) destroyLocked(onlyEmpty bool, onlyGarbage bool, keepRemoteData bool) (err error) {
+	if err = v.checkDeletableLocked(onlyEmpty, onlyGarbage); err != nil {
+		return
 	}
 	if !v.isCompactionInProgress.CompareAndSwap(false, true) {
 		err = fmt.Errorf("volume %d is compacting", v.Id)
 		return
 	}
-	close(v.asyncRequestsChan)
-	if !keepRemoteData {
-		storageName, storageKey := v.RemoteStorageNameKey()
-		if v.HasRemoteFile() && storageName != "" && storageKey != "" {
-			if backendStorage, found := backend.BackendStorages[storageName]; found {
-				backendStorage.DeleteFile(storageKey)
+	storageName, storageKey := v.RemoteStorageNameKey()
+	if !keepRemoteData && v.HasRemoteFile() && storageName != "" && storageKey != "" {
+		if backendStorage, found := backend.BackendStorages[storageName]; found {
+			if remoteErr := backendStorage.DeleteFile(storageKey); remoteErr != nil {
+				// Stop short of local cleanup: a failed remote delete must
+				// not strand a registered replica with no local files.
+				v.isCompactionInProgress.Store(false)
+				err = fmt.Errorf("volume %d remote object %s/%s delete failed: %w", v.Id, storageName, storageKey, remoteErr)
+				return
 			}
 		}
 	}
+	v.stopWorker()
 	// A regular volume and an EC volume for the same id share <base>.vif. When
 	// EC artefacts coexist on this disk (e.g. shards distributed onto a source
 	// replica before it is deleted), keep the .vif so removing the regular
@@ -105,6 +89,27 @@ func (v *Volume) Destroy(onlyEmpty bool, keepRemoteData bool) (err error) {
 	return
 }
 
+// checkDeletableLocked enforces the guards Destroy applies before removing
+// any file: either enabled check may pass, since a volume with no live data
+// qualifies whether it reads empty or as all garbage.
+func (v *Volume) checkDeletableLocked(onlyEmpty bool, onlyGarbage bool) (err error) {
+	if !onlyEmpty && !onlyGarbage {
+		return nil
+	}
+	emptyOk := false
+	if onlyEmpty {
+		isEmpty, e := v.doIsEmpty()
+		if e != nil {
+			return fmt.Errorf("failed to read isEmpty %v", e)
+		}
+		emptyOk = isEmpty
+	}
+	if !emptyOk && !(onlyGarbage && v.doIsGarbage()) {
+		return ErrVolumeNotEmpty
+	}
+	return nil
+}
+
 // sharesVifWithEcVolume reports whether an EC volume for this volume id lives
 // on the same disk, in which case its .vif is the same file as the regular
 // volume's and must outlive the regular volume's deletion.
@@ -150,43 +155,167 @@ func removeVolumeFiles(filename string, keepVif bool) {
 	deleteAndLog("rdb")
 	// marker for damaged or incomplete volume
 	deleteAndLog("note")
+	// marker for a volume whose failed-batch recovery could not be verified
+	deleteAndLog("unavailable")
 }
 
-func (v *Volume) asyncRequestAppend(request *needle.AsyncRequest) {
-	v.asyncRequestsChan <- request
+// asyncRequestAppend queues a request for the batch worker, starting it on the
+// first one. It reports false for a destroyed volume, so the caller writes
+// inline rather than wait on a worker that will never answer.
+func (v *Volume) asyncRequestAppend(request *needle.AsyncRequest) bool {
+	requests := v.startWorker()
+	if requests == nil {
+		return false
+	}
+	requests <- request
+	return true
 }
 
-func (v *Volume) syncWrite(n *needle.Needle, checkCookie bool) (offset uint64, size Size, isUnchanged bool, err error) {
+func (v *Volume) syncWrite(n *needle.Needle, checkCookie bool, fsync bool) (offset uint64, size Size, isUnchanged bool, err error) {
 	// glog.V(4).Infof("writing needle %s", needle.NewFileIdFromNeedle(v.Id, n).String())
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 
-	return v.doWriteRequest(n, checkCookie)
+	if err := v.UnavailableError(); err != nil {
+		return 0, 0, false, err
+	}
+	if v.IsReadOnly() {
+		return 0, 0, false, fmt.Errorf("volume %d is read only", v.Id)
+	}
+
+	// A caller can still hold the volume after it was closed or destroyed, which
+	// leaves both of these nil. Refuse the write rather than dereference them.
+	if v.nm == nil || v.DataBackend == nil {
+		return 0, 0, false, fmt.Errorf("volume %d is closed", v.Id)
+	}
+
+	if !fsync {
+		return v.doWriteRequest(n, checkCookie, fsync)
+	}
+
+	end, _, statErr := v.DataBackend.GetStat()
+	if statErr != nil {
+		return 0, 0, false, fmt.Errorf("cannot read current volume position: %v", statErr)
+	}
+
+	lastAppendAtNs := v.lastAppendAtNs
+	lastWriteAppendAtNs := v.lastWriteAppendAtNs
+	lastWriteNeedleKey := v.lastWriteNeedleKey
+	lastWriteDeleted := v.lastWriteDeleted
+	lastModifiedTsSeconds := v.lastModifiedTsSeconds
+
+	offset, size, isUnchanged, err = v.appendWriteRequest(n, checkCookie, fsync)
+	if err != nil {
+		return
+	}
+	// fsync with the access lock dropped so same-volume reads do not wait on
+	// it; writers and compaction stay excluded by dataFileSyncLock. Nothing
+	// has been published yet, so no reader can capture the appended offset.
+	backend := v.DataBackend
+	v.dataFileAccessLock.Unlock()
+	syncErr := backend.Sync()
+	v.dataFileAccessLock.Lock()
+	if syncErr != nil {
+		v.checkReadWriteError(syncErr)
+		v.lastAppendAtNs = lastAppendAtNs
+		v.lastWriteAppendAtNs = lastWriteAppendAtNs
+		v.lastWriteNeedleKey = lastWriteNeedleKey
+		v.lastWriteDeleted = lastWriteDeleted
+		v.lastModifiedTsSeconds = lastModifiedTsSeconds
+		if !isUnchanged {
+			// Nothing was published, so the whole rollback is taking the
+			// unflushed append back off the .dat.
+			if te := v.DataBackend.Truncate(end); te != nil {
+				v.markIoUnavailable(fmt.Errorf("truncate %s back to %d after a failed fsync: %w",
+					v.DataBackend.Name(), end, te))
+			}
+		}
+		return 0, 0, false, syncErr
+	}
+	if !isUnchanged {
+		err = v.publishWriteRequest(n, offset, fsync)
+	}
+	// The .idx row goes down before the write is acknowledged, same as the
+	// .dat record above; the access lock is dropped for the fsync the same
+	// way, since the row is already published.
+	v.dataFileAccessLock.Unlock()
+	if idxErr := v.syncIndex(); err == nil {
+		err = idxErr
+	}
+	v.dataFileAccessLock.Lock()
+	return
 }
 
-func (v *Volume) writeNeedle2(n *needle.Needle, checkCookie bool, fsync bool) (offset uint64, size Size, isUnchanged bool, err error) {
+// syncIndex flushes the .idx, the second half of a durable write: the row is
+// already published and cannot be taken back, so a failed sync stops the
+// volume taking writes rather than acknowledge an index entry that may not
+// survive — the same split the Rust volume server makes between flush_dat
+// and flush_idx.
+func (v *Volume) syncIndex() (err error) {
+	if v.nm == nil {
+		return nil
+	}
+	if err = v.nm.Sync(); err != nil {
+		v.checkReadWriteError(err)
+		v.noWriteLock.Lock()
+		v.noWriteOrDelete = true
+		v.noWriteLock.Unlock()
+		err = fmt.Errorf("sync volume %d index: %w", v.Id, err)
+	}
+	return
+}
+
+// writeNeedle2 appends a needle. A durable write normally goes through the
+// async batch worker, which fsyncs once for the whole batch; while the server
+// is stopping the worker is winding down, so it is flushed inline instead. Both
+// paths only return once the .dat is on disk.
+func (v *Volume) writeNeedle2(n *needle.Needle, checkCookie bool, fsync bool, isStopping bool) (offset uint64, size Size, isUnchanged bool, err error) {
 	// glog.V(4).Infof("writing needle %s", needle.NewFileIdFromNeedle(v.Id, n).String())
+	if err := v.UnavailableError(); err != nil {
+		return 0, 0, false, err
+	}
+
 	if n.Ttl == needle.EMPTY_TTL && v.Ttl != needle.EMPTY_TTL {
 		n.SetHasTtl()
 		n.Ttl = v.Ttl
 	}
 
-	if !fsync {
-		return v.syncWrite(n, checkCookie)
+	if !fsync || isStopping {
+		return v.syncWrite(n, checkCookie, fsync)
 	} else {
 		asyncRequest := needle.NewAsyncRequest(n, true)
 		// using len(n.Data) here instead of n.Size before n.Size is populated in n.Append()
 		asyncRequest.ActualSize = needle.GetActualSize(Size(len(n.Data)), v.Version())
 
-		v.asyncRequestAppend(asyncRequest)
+		if !v.asyncRequestAppend(asyncRequest) {
+			return v.syncWrite(n, checkCookie, fsync)
+		}
 		offset, _, isUnchanged, err = asyncRequest.WaitComplete()
 
 		return
 	}
 }
 
-func (v *Volume) doWriteRequest(n *needle.Needle, checkCookie bool) (offset uint64, size Size, isUnchanged bool, err error) {
+func (v *Volume) doWriteRequest(n *needle.Needle, checkCookie bool, fsync bool) (offset uint64, size Size, isUnchanged bool, err error) {
+	offset, size, isUnchanged, err = v.appendWriteRequest(n, checkCookie, fsync)
+	if err != nil || isUnchanged {
+		return
+	}
+	err = v.publishWriteRequest(n, offset, fsync)
+	return
+}
+
+// appendWriteRequest is doWriteRequest through the .dat append, leaving the
+// needle-map update to publishWriteRequest.
+func (v *Volume) appendWriteRequest(n *needle.Needle, checkCookie bool, fsync bool) (offset uint64, size Size, isUnchanged bool, err error) {
 	// glog.V(4).Infof("writing needle %s", needle.NewFileIdFromNeedle(v.Id, n).String())
+	// Re-check under the write lock: the outer checks run before the needle
+	// is assembled, and VolumeMarkReadonly can land in between.
+	if v.IsReadOnly() {
+		return 0, 0, false, fmt.Errorf("volume %d is read only", v.Id)
+	}
 	if v.isFileUnchanged(n) {
 		size = Size(n.DataSize)
 		isUnchanged = true
@@ -195,22 +324,45 @@ func (v *Volume) doWriteRequest(n *needle.Needle, checkCookie bool) (offset uint
 
 	// check whether existing needle cookie matches
 	nv, ok := v.nm.Get(n.Id)
-	if ok {
+	if ok && !nv.Offset.IsZero() {
 		existingNeedle, _, _, existingNeedleReadErr := needle.ReadNeedleHeader(v.DataBackend, v.Version(), nv.Offset.ToActualOffset())
 		if existingNeedleReadErr != nil {
 			err = fmt.Errorf("reading existing needle: %w", existingNeedleReadErr)
 			return
 		}
-		if n.Cookie == 0 && !checkCookie {
-			// this is from batch deletion, and read back again when tailing a remote volume
-			// which only happens when checkCookie == false and fsync == false
-			n.Cookie = existingNeedle.Cookie
+		if existingNeedle.Id != n.Id && existingNeedle.Size != nv.Size &&
+			OffsetSize == 4 && nv.Offset.ToActualOffset() < int64(MaxPossibleVolumeSize) {
+			// a 4-byte index entry can index past the 32 GiB wrap: the low
+			// offset may hold another needle while the real record sits at
+			// the wrapped offset, where reads already retry on a mismatch
+			wrapped, _, _, wrappedErr := needle.ReadNeedleHeader(v.DataBackend, v.Version(),
+				nv.Offset.ToActualOffset()+int64(MaxPossibleVolumeSize))
+			if wrappedErr == nil {
+				existingNeedle = wrapped
+			} else if wrappedErr != io.EOF {
+				err = fmt.Errorf("reading existing needle at wrapped offset: %w", wrappedErr)
+				return
+			}
 		}
-		if existingNeedle.Cookie != n.Cookie {
-			glog.V(0).Infof("write cookie mismatch: existing %s, new %s",
-				needle.NewFileIdFromNeedle(v.Id, existingNeedle), needle.NewFileIdFromNeedle(v.Id, n))
-			err = fmt.Errorf("mismatching cookie %x", n.Cookie)
-			return
+		if existingNeedle.Id != n.Id && existingNeedle.Size != nv.Size {
+			// the entry resolves to a record that is neither the indexed key
+			// nor the indexed size, so it is stale rather than a duplicate —
+			// skip the cookie check and let the publish step overwrite it
+			// once the append commits
+			glog.V(0).Infof("volume %d index entry for %s resolves to %s; overwriting stale index entry",
+				v.Id, needle.NewFileIdFromNeedle(v.Id, n), needle.NewFileIdFromNeedle(v.Id, existingNeedle))
+		} else {
+			if n.Cookie == 0 && !checkCookie {
+				// this is from batch deletion, and read back again when tailing a remote volume
+				// which only happens when checkCookie == false and fsync == false
+				n.Cookie = existingNeedle.Cookie
+			}
+			if existingNeedle.Cookie != n.Cookie {
+				glog.V(0).Infof("write cookie mismatch: existing %s, new %s",
+					needle.NewFileIdFromNeedle(v.Id, existingNeedle), needle.NewFileIdFromNeedle(v.Id, n))
+				err = fmt.Errorf("mismatching cookie %x", n.Cookie)
+				return
+			}
 		}
 	}
 
@@ -224,12 +376,32 @@ func (v *Volume) doWriteRequest(n *needle.Needle, checkCookie bool) (offset uint
 		return
 	}
 	v.lastAppendAtNs = n.AppendAtNs
+	v.lastWriteAppendAtNs = n.AppendAtNs
+	v.lastWriteNeedleKey = n.Id
+	v.lastWriteDeleted = false
 
-	// add to needle map
+	return
+}
+
+// publishWriteRequest indexes an already-appended needle. It is split from
+// appendWriteRequest so a durable write can fsync before the mapping exists:
+// an index entry that outlives the bytes it points at loads read-only, and
+// an unpublished offset can never be captured by an in-flight read before a
+// failed sync truncates it.
+func (v *Volume) publishWriteRequest(n *needle.Needle, offset uint64, fsync bool) (err error) {
+	nv, ok := v.nm.Get(n.Id)
 	if !ok || uint64(nv.Offset.ToActualOffset()) < offset {
 		if err = v.nm.Put(n.Id, ToOffset(int64(offset)), n.Size); err != nil {
 			err = fmt.Errorf("index needle %d of volume %d at offset %d: %w", n.Id, v.Id, offset, err)
 			glog.V(0).Info(err)
+			if fsync {
+				// The record is down but nothing indexes it. Stop taking
+				// writes rather than append past it, same as the Rust
+				// volume server.
+				v.noWriteLock.Lock()
+				v.noWriteOrDelete = true
+				v.noWriteLock.Unlock()
+			}
 		}
 	}
 	if v.lastModifiedTsSeconds < n.LastModified {
@@ -240,9 +412,18 @@ func (v *Volume) doWriteRequest(n *needle.Needle, checkCookie bool) (offset uint
 
 func (v *Volume) syncDelete(n *needle.Needle) (Size, error) {
 	// glog.V(4).Infof("delete needle %s", needle.NewFileIdFromNeedle(v.Id, n).String())
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 
+	if err := v.UnavailableError(); err != nil {
+		return 0, err
+	}
+	if _, noWriteOrDelete, _, _ := v.ReadOnlyReasons(); noWriteOrDelete {
+		return 0, fmt.Errorf("volume %d is read only", v.Id)
+	}
+
 	if v.nm == nil {
 		return 0, nil
 	}
@@ -260,7 +441,9 @@ func (v *Volume) deleteNeedle2(n *needle.Needle) (Size, error) {
 		asyncRequest := needle.NewAsyncRequest(n, false)
 		asyncRequest.ActualSize = needle.GetActualSize(0, v.Version())
 
-		v.asyncRequestAppend(asyncRequest)
+		if !v.asyncRequestAppend(asyncRequest) {
+			return v.syncDelete(n)
+		}
 		_, size, _, err := asyncRequest.WaitComplete()
 
 		return Size(size), err
@@ -269,31 +452,256 @@ func (v *Volume) deleteNeedle2(n *needle.Needle) (Size, error) {
 
 func (v *Volume) doDeleteRequest(n *needle.Needle) (Size, error) {
 	glog.V(4).Infof("delete needle %s", needle.NewFileIdFromNeedle(v.Id, n).String())
-	nv, ok := v.nm.Get(n.Id)
-	// fmt.Println("key", n.Id, "volume offset", nv.Offset, "data_size", n.Size, "cached size", nv.Size)
-	if ok && !nv.Size.IsDeleted() {
-		var offset uint64
-		var err error
-		size := nv.Size
-		if !v.HasRemoteFile() {
-			n.Data = nil
-			n.UpdateAppendAtNs(v.lastAppendAtNs)
-			offset, _, _, err = n.Append(v.DataBackend, v.Version())
-			v.checkReadWriteError(err)
-			if err != nil {
-				return size, err
-			}
-		}
-		v.lastAppendAtNs = n.AppendAtNs
-		if err = v.nm.Delete(n.Id, ToOffset(int64(offset))); err != nil {
-			return size, err
-		}
+	size, offset, tombstoned, err := v.appendDeleteRequest(n)
+	if err != nil || !tombstoned {
 		return size, err
 	}
-	return 0, nil
+	if err = v.publishDeleteRequest(n, offset); err != nil {
+		return size, err
+	}
+	return size, nil
 }
 
-func (v *Volume) startWorker() {
+// appendDeleteRequest writes the tombstone record but leaves the map update
+// to publishDeleteRequest, so a batch can fsync before any deletion is
+// visible — same publication-after-sync ordering as writes.
+func (v *Volume) appendDeleteRequest(n *needle.Needle) (size Size, offset uint64, tombstoned bool, err error) {
+	nv, ok := v.nm.Get(n.Id)
+	// fmt.Println("key", n.Id, "volume offset", nv.Offset, "data_size", n.Size, "cached size", nv.Size)
+	if !ok || nv.Size.IsDeleted() {
+		return 0, 0, false, nil
+	}
+	size = nv.Size
+	if !v.HasRemoteFile() {
+		n.Data = nil
+		n.UpdateAppendAtNs(v.lastAppendAtNs)
+		offset, _, _, err = n.Append(v.DataBackend, v.Version())
+		v.checkReadWriteError(err)
+		if err != nil {
+			return size, 0, false, err
+		}
+	}
+	v.lastAppendAtNs = n.AppendAtNs
+	return size, offset, true, nil
+}
+
+func (v *Volume) publishDeleteRequest(n *needle.Needle, offset uint64) error {
+	if err := v.nm.Delete(n.Id, ToOffset(int64(offset))); err != nil {
+		return err
+	}
+	if n.Id == v.lastWriteNeedleKey {
+		v.lastWriteAppendAtNs, v.lastWriteNeedleKey = 0, 0
+		v.lastWriteDeleted = true
+	}
+	return nil
+}
+
+func (v *Volume) processBatch(currentRequests []*needle.AsyncRequest) {
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
+
+	// The batch is applied in runs of distinct needle ids: a repeated id
+	// starts a new run so its dedup, cookie and delete checks see the earlier
+	// operation's published result — the same rule as Rust's
+	// write_needles_grouped.
+	seen := make(map[NeedleId]bool, len(currentRequests))
+	start := 0
+	for i := 0; i < len(currentRequests); i++ {
+		if seen[currentRequests[i].N.Id] {
+			v.processBatchRun(currentRequests[start:i])
+			seen = make(map[NeedleId]bool, len(currentRequests)-i)
+			start = i
+		}
+		seen[currentRequests[i].N.Id] = true
+	}
+	if start < len(currentRequests) {
+		v.processBatchRun(currentRequests[start:])
+	}
+}
+
+// processBatchRun applies one run of distinct-id requests: every .dat
+// mutation is staged, the run is synced once with the access lock dropped,
+// and only then are the map changes published — in request order, and only
+// over an older offset — so a failed sync rolls back bytes no reader ever
+// resolved. A durable entry that fails to index stops the volume taking
+// writes, and the entries after it in the run are refused read only.
+func (v *Volume) processBatchRun(run []*needle.AsyncRequest) {
+	v.dataFileAccessLock.Lock()
+
+	end, e := int64(0), error(nil)
+	if unavailableErr := v.UnavailableError(); unavailableErr != nil {
+		e = unavailableErr
+	} else if v.nm == nil || v.DataBackend == nil {
+		e = fmt.Errorf("volume %d is closed", v.Id)
+	} else {
+		end, _, e = v.DataBackend.GetStat()
+	}
+	if e != nil {
+		v.dataFileAccessLock.Unlock()
+		for i := 0; i < len(run); i++ {
+			run[i].Complete(0, 0, false,
+				fmt.Errorf("cannot read current volume position: %v", e))
+		}
+		return
+	}
+
+	batchLastAppendAtNs := v.lastAppendAtNs
+	batchLastWriteAppendAtNs := v.lastWriteAppendAtNs
+	batchLastWriteNeedleKey := v.lastWriteNeedleKey
+	batchLastWriteDeleted := v.lastWriteDeleted
+	batchLastModifiedTsSeconds := v.lastModifiedTsSeconds
+
+	stagedWriteOffsets := make([]uint64, len(run))
+	stagedWriteOk := make([]bool, len(run))
+	stagedDeleteOffsets := make([]uint64, len(run))
+	stagedDeleteOk := make([]bool, len(run))
+	needIndexSync := false
+	for i := 0; i < len(run); i++ {
+		// Every queued request meets the same refusal it would get sent on
+		// its own: once a durable index update fails the volume stops taking
+		// writes, and a lone write is turned away before it appends.
+		if run[i].IsWriteRequest {
+			if unavailableErr := v.UnavailableError(); unavailableErr != nil {
+				run[i].UpdateResult(0, 0, false, unavailableErr)
+			} else if v.IsReadOnly() {
+				run[i].UpdateResult(0, 0, false, fmt.Errorf("volume %d is read only", v.Id))
+			} else {
+				offset, size, isUnchanged, err := v.appendWriteRequest(run[i].N, true, true)
+				if err == nil {
+					needIndexSync = true
+					if !isUnchanged {
+						stagedWriteOffsets[i] = offset
+						stagedWriteOk[i] = true
+					}
+				}
+				run[i].UpdateResult(offset, uint64(size), isUnchanged, err)
+			}
+		} else {
+			if unavailableErr := v.UnavailableError(); unavailableErr != nil {
+				run[i].UpdateResult(0, 0, false, unavailableErr)
+			} else if _, noWriteOrDelete, _, _ := v.ReadOnlyReasons(); noWriteOrDelete {
+				run[i].UpdateResult(0, 0, false, fmt.Errorf("volume %d is read only", v.Id))
+			} else {
+				size, offset, tombstoned, err := v.appendDeleteRequest(run[i].N)
+				if err == nil {
+					needIndexSync = true
+					if tombstoned {
+						stagedDeleteOffsets[i] = offset
+						stagedDeleteOk[i] = true
+					}
+				}
+				run[i].UpdateResult(0, uint64(size), false, err)
+			}
+		}
+	}
+
+	// The sync excludes writers and compaction via dataFileSyncLock but not
+	// readers: nothing is published yet, so dropping the access lock here
+	// lets same-volume reads proceed during the fsync.
+	backend := v.DataBackend
+	v.dataFileAccessLock.Unlock()
+	syncErr := backend.Sync()
+	v.dataFileAccessLock.Lock()
+	if syncErr != nil {
+		v.checkReadWriteError(syncErr)
+		v.lastAppendAtNs = batchLastAppendAtNs
+		v.lastWriteAppendAtNs = batchLastWriteAppendAtNs
+		v.lastWriteNeedleKey = batchLastWriteNeedleKey
+		v.lastWriteDeleted = batchLastWriteDeleted
+		v.lastModifiedTsSeconds = batchLastModifiedTsSeconds
+		batchErr := syncErr
+		// Nothing was published: truncating the run's bytes is the whole
+		// rollback, and no reader ever resolved them.
+		if te := v.DataBackend.Truncate(end); te != nil {
+			batchErr = errors.Join(syncErr,
+				fmt.Errorf("truncate %s to %d: %w", v.DataBackend.Name(), end, te))
+			v.markIoUnavailable(batchErr)
+		}
+		for i := 0; i < len(run); i++ {
+			run[i].UpdateResult(0, 0, false, batchErr)
+		}
+		v.dataFileAccessLock.Unlock()
+		for i := 0; i < len(run); i++ {
+			run[i].Submit()
+		}
+		return
+	}
+
+	refused := false
+	for i := 0; i < len(run); i++ {
+		if refused {
+			run[i].UpdateResult(0, 0, false, fmt.Errorf("volume %d is read only", v.Id))
+			continue
+		}
+		if run[i].IsWriteRequest {
+			if stagedWriteOk[i] {
+				if perr := v.publishWriteRequest(run[i].N, stagedWriteOffsets[i], true); perr != nil {
+					run[i].UpdateResult(0, 0, false, perr)
+					refused = true
+				}
+			}
+		} else if stagedDeleteOk[i] {
+			if perr := v.publishDeleteRequest(run[i].N, stagedDeleteOffsets[i]); perr != nil {
+				run[i].UpdateResult(0, 0, false, perr)
+			}
+		}
+	}
+	v.dataFileAccessLock.Unlock()
+	// One .idx sync per run, paired with the .dat sync above: the published
+	// rows cannot be rolled back, so a failed sync fails every request in the
+	// run instead of acknowledging an index entry that may not survive.
+	if needIndexSync {
+		if idxErr := v.syncIndex(); idxErr != nil {
+			for i := 0; i < len(run); i++ {
+				run[i].UpdateResult(0, 0, false, idxErr)
+			}
+		}
+	}
+	for i := 0; i < len(run); i++ {
+		run[i].Submit()
+	}
+}
+
+const (
+	syncBatchMaxBytes    = 4 * 1024 * 1024
+	syncBatchMaxRequests = 128
+)
+
+// SyncBatchOption tunes the volume's durable-write worker. Once the queue
+// drains with the batch still below MinBytes and MinRequests, the batch stays
+// open up to Wait for stragglers instead of paying an fsync per request.
+type SyncBatchOption struct {
+	MinBytes    int64
+	MinRequests int
+	Wait        time.Duration
+}
+
+var DefaultSyncBatchOption = SyncBatchOption{
+	MinBytes:    1 * 1024 * 1024,
+	MinRequests: syncBatchMaxRequests,
+	Wait:        500 * time.Microsecond,
+}
+
+// syncBatchAfter arms the batch window; a var so tests can drive it.
+var syncBatchAfter = time.After
+
+// startWorker returns the volume's batch-write channel, creating it and its
+// goroutine on first use, and nil once stopWorker has run.
+func (v *Volume) startWorker() chan *needle.AsyncRequest {
+	v.asyncWorkerLock.Lock()
+	defer v.asyncWorkerLock.Unlock()
+	if v.asyncWorkerClosed {
+		return nil
+	}
+	if v.asyncRequestsChan != nil {
+		return v.asyncRequestsChan
+	}
+	requests := make(chan *needle.AsyncRequest, syncBatchMaxRequests)
+	v.asyncRequestsChan = requests
+	syncBatch := DefaultSyncBatchOption
+	if v.location != nil {
+		syncBatch = v.location.syncBatch
+	}
 	go func() {
 		chanClosed := false
 		for {
@@ -301,15 +709,25 @@ func (v *Volume) startWorker() {
 			if chanClosed {
 				break
 			}
-			currentRequests := make([]*needle.AsyncRequest, 0, 128)
+			currentRequests := make([]*needle.AsyncRequest, 0, syncBatchMaxRequests)
 			currentBytesToWrite := int64(0)
+			var batchDeadline time.Time
+			var batchWait <-chan time.Time
 			for {
-				request, ok := <-v.asyncRequestsChan
+				var request *needle.AsyncRequest
+				queueOpen := true
+				select {
+				case request, queueOpen = <-requests:
+				case <-batchWait:
+				}
 				// volume may be closed
-				if !ok {
+				if !queueOpen {
 					chanClosed = true
 					break
 				}
+				if request == nil {
+					break
+				}
 				if MaxPossibleVolumeSize < v.ContentSize()+uint64(currentBytesToWrite+request.ActualSize) {
 					request.Complete(0, 0, false,
 						fmt.Errorf("volume size limit %d exceeded! current size is %d", MaxPossibleVolumeSize, v.ContentSize()))
@@ -318,65 +736,70 @@ func (v *Volume) startWorker() {
 				currentRequests = append(currentRequests, request)
 				currentBytesToWrite += request.ActualSize
 				// submit at most 4M bytes or 128 requests at one time to decrease request delay.
-				// it also need to break if there is no data in channel to avoid io hang.
-				if currentBytesToWrite >= 4*1024*1024 || len(currentRequests) >= 128 || len(v.asyncRequestsChan) == 0 {
+				if currentBytesToWrite >= syncBatchMaxBytes || len(currentRequests) >= syncBatchMaxRequests {
 					break
 				}
+				// a refilled queue must not outwait the armed deadline
+				if !batchDeadline.IsZero() && !time.Now().Before(batchDeadline) {
+					break
+				}
+				if len(requests) > 0 {
+					continue
+				}
+				if syncBatch.Wait <= 0 || currentBytesToWrite >= syncBatch.MinBytes || len(currentRequests) >= syncBatch.MinRequests {
+					// a drained queue flushes right away once it holds enough
+					break
+				}
+				// flushing now would sync a singleton batch; hold the window
+				// open for stragglers, armed once per batch so the added
+				// latency stays bounded by Wait
+				if batchWait == nil {
+					batchDeadline = time.Now().Add(syncBatch.Wait)
+					batchWait = syncBatchAfter(syncBatch.Wait)
+				}
 			}
 			if len(currentRequests) == 0 {
 				continue
 			}
-			v.dataFileAccessLock.Lock()
-			end, _, e := v.DataBackend.GetStat()
-			if e != nil {
-				for i := 0; i < len(currentRequests); i++ {
-					currentRequests[i].Complete(0, 0, false,
-						fmt.Errorf("cannot read current volume position: %v", e))
-				}
-				v.dataFileAccessLock.Unlock()
-				continue
-			}
-
-			for i := 0; i < len(currentRequests); i++ {
-				if currentRequests[i].IsWriteRequest {
-					offset, size, isUnchanged, err := v.doWriteRequest(currentRequests[i].N, true)
-					currentRequests[i].UpdateResult(offset, uint64(size), isUnchanged, err)
-				} else {
-					size, err := v.doDeleteRequest(currentRequests[i].N)
-					currentRequests[i].UpdateResult(0, uint64(size), false, err)
-				}
-			}
-
-			// if sync error, data is not reliable, we should mark the completed request as fail and rollback
-			if err := v.DataBackend.Sync(); err != nil {
-				// todo: this may generate dirty data or cause data inconsistent, may be weed need to panic?
-				if te := v.DataBackend.Truncate(end); te != nil {
-					glog.V(0).Infof("Failed to truncate %s back to %d with error: %v", v.DataBackend.Name(), end, te)
-				}
-				for i := 0; i < len(currentRequests); i++ {
-					if currentRequests[i].IsSucceed() {
-						currentRequests[i].UpdateResult(0, 0, false, err)
-					}
-				}
-			}
-
-			for i := 0; i < len(currentRequests); i++ {
-				currentRequests[i].Submit()
-			}
-			v.dataFileAccessLock.Unlock()
+			v.processBatch(currentRequests)
 		}
 	}()
+	return requests
+}
+
+// stopWorker closes the batch-write channel so the worker drains what is queued
+// and exits. It stays closed: a destroyed volume takes no more writes.
+func (v *Volume) stopWorker() {
+	v.asyncWorkerLock.Lock()
+	defer v.asyncWorkerLock.Unlock()
+	if v.asyncWorkerClosed {
+		return
+	}
+	v.asyncWorkerClosed = true
+	if v.asyncRequestsChan != nil {
+		close(v.asyncRequestsChan)
+		v.asyncRequestsChan = nil
+	}
 }
 
 func (v *Volume) WriteNeedleBlob(needleId NeedleId, needleBlob []byte, size Size) error {
 
+	v.dataFileSyncLock.Lock()
+	defer v.dataFileSyncLock.Unlock()
 	v.dataFileAccessLock.Lock()
 	defer v.dataFileAccessLock.Unlock()
 
+	if err := v.UnavailableError(); err != nil {
+		return err
+	}
+
 	// nm.Put on a read-only volume fails only after the blob is appended to .dat.
 	if v.IsReadOnly() {
 		return fmt.Errorf("volume %d is read only", v.Id)
 	}
+	if size.IsDeleted() {
+		return fmt.Errorf("needle %d has invalid size %d", needleId, size)
+	}
 
 	// size indexes the needle and places the v3 append timestamp, so a caller using
 	// the payload-only DataSize corrupts both, silently until the needle is read back.
@@ -388,6 +811,10 @@ func (v *Volume) WriteNeedleBlob(needleId NeedleId, needleBlob []byte, size Size
 	if blobHeader.Size != size {
 		return fmt.Errorf("needle %d size %d does not match its blob header size %d", needleId, size, blobHeader.Size)
 	}
+	// The blob is appended as is: its length must be the record this size takes in this volume's version.
+	if actualSize := needle.GetActualSize(size, v.Version()); int64(len(needleBlob)) != actualSize {
+		return fmt.Errorf("needle %d blob of %d bytes does not match the %d bytes size %d takes in a version %d volume", needleId, len(needleBlob), actualSize, size, v.Version())
+	}
 
 	if MaxPossibleVolumeSize < v.nm.ContentSize()+uint64(len(needleBlob)) {
 		return fmt.Errorf("volume size limit %d exceeded! current size is %d", MaxPossibleVolumeSize, v.nm.ContentSize())
@@ -406,6 +833,9 @@ func (v *Volume) WriteNeedleBlob(needleId NeedleId, needleBlob []byte, size Size
 			}
 		}
 	}
+	if v.IsReadOnly() {
+		return fmt.Errorf("volume %d is read only", v.Id)
+	}
 	appendAtNs := needle.GetAppendAtNs(v.lastAppendAtNs)
 	offset, err := needle.WriteNeedleBlob(v.DataBackend, needleBlob, size, appendAtNs, v.Version())
 
@@ -414,6 +844,9 @@ func (v *Volume) WriteNeedleBlob(needleId NeedleId, needleBlob []byte, size Size
 		return err
 	}
 	v.lastAppendAtNs = appendAtNs
+	v.lastWriteAppendAtNs = appendAtNs
+	v.lastWriteNeedleKey = needleId
+	v.lastWriteDeleted = false
 
 	// add to needle map
 	if err = v.nm.Put(needleId, ToOffset(int64(offset)), size); err != nil {
diff --git a/weed/storage/volume_write_fsync_test.go b/weed/storage/volume_write_fsync_test.go
new file mode 100644
index 0000000000..9e62baff83
--- /dev/null
+++ b/weed/storage/volume_write_fsync_test.go
@@ -0,0 +1,610 @@
+package storage
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/stretchr/testify/require"
+)
+
+// countingBackend counts Sync calls and can be made to fail them. It also
+// counts random reads, so recovery paths can prove they declined before
+// touching the .dat.
+type countingBackend struct {
+	backend.BackendStorageFile
+	syncCount     int
+	syncErr       error
+	syncErrOnce   bool
+	truncateErr   error
+	truncateCount int
+	readCount     int
+}
+
+func (b *countingBackend) ReadAt(p []byte, off int64) (int, error) {
+	b.readCount++
+	return b.BackendStorageFile.ReadAt(p, off)
+}
+
+func (b *countingBackend) Sync() error {
+	b.syncCount++
+	if b.syncErr != nil {
+		err := b.syncErr
+		if b.syncErrOnce {
+			b.syncErr = nil
+			b.syncErrOnce = false
+		}
+		return err
+	}
+	return b.BackendStorageFile.Sync()
+}
+
+func (b *countingBackend) Truncate(off int64) error {
+	b.truncateCount++
+	if b.truncateErr != nil {
+		return b.truncateErr
+	}
+	return b.BackendStorageFile.Truncate(off)
+}
+
+func newCountingVolume(t *testing.T) (*Volume, *countingBackend) {
+	return newCountingVolumeWithKind(t, NeedleMapInMemory)
+}
+
+func newCountingVolumeWithKind(t *testing.T, needleMapKind NeedleMapKind) (*Volume, *countingBackend) {
+	t.Helper()
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 1, needleMapKind, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	t.Cleanup(v.Close)
+	counting := &countingBackend{BackendStorageFile: v.DataBackend}
+	v.DataBackend = counting
+	return v, counting
+}
+
+func reopenCountingVolume(t *testing.T, v *Volume) *Volume {
+	t.Helper()
+	dir, dirIdx, id, needleMapKind := v.dir, v.dirIdx, v.Id, v.needleMapKind
+	v.Close()
+	reloaded, err := NewVolume(dir, dirIdx, "", id, needleMapKind,
+		&super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	require.NoError(t, err)
+	t.Cleanup(reloaded.Close)
+	return reloaded
+}
+
+// A durable write reaching a stopping server used to silently drop its fsync,
+// so the ack promised durability the .dat did not have. It now flushes inline
+// instead of queueing on the batch worker that is winding down.
+func TestWriteNeedle2FsyncsInlineWhileStopping(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	_, _, _, err := v.writeNeedle2(newRandomNeedle(1), true, true, true)
+	require.NoError(t, err, "a durable write must still be accepted while stopping")
+	require.Equal(t, 1, counting.syncCount, "the write should have been flushed inline")
+
+	// A non-durable write keeps the drain cheap: still accepted, still no fsync.
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(2), true, false, true)
+	require.NoError(t, err)
+	require.Equal(t, 1, counting.syncCount, "a write that did not ask for fsync must not pay for one")
+}
+
+func fixedNeedle(id uint64, data string) *needle.Needle {
+	n := new(needle.Needle)
+	n.Data = []byte(data)
+	n.Checksum = needle.NewCRC(n.Data)
+	n.Id = types.Uint64ToNeedleId(id)
+	return n
+}
+
+// An append we could not flush is not data to vouch for: the inline path takes
+// it back off the .dat and fails the write. The needle map has to come back
+// with it, or it would resolve to an offset past the truncated end.
+func TestWriteNeedle2TruncatesWhenInlineFsyncFails(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	kept := fixedNeedle(1, "first-copy")
+	_, _, _, err := v.writeNeedle2(kept, true, true, true)
+	require.NoError(t, err)
+	keptEntry, found := v.nm.Get(kept.Id)
+	require.True(t, found)
+	keptOffset, keptSize := keptEntry.Offset, keptEntry.Size
+	before, _, err := v.DataBackend.GetStat()
+	require.NoError(t, err)
+
+	counting.syncErr = errors.New("disk went away")
+	_, _, _, err = v.writeNeedle2(fixedNeedle(1, "second-copy"), true, true, true)
+	require.Error(t, err, "a write whose fsync failed must not be acked")
+
+	after, _, err := v.DataBackend.GetStat()
+	require.NoError(t, err)
+	require.Equal(t, before, after, "the unflushed append should have been truncated away")
+
+	now, found := v.nm.Get(kept.Id)
+	require.True(t, found, "the mapping the failed write replaced should be back")
+	require.Equal(t, keptOffset, now.Offset, "the index must not point past the truncated end")
+	require.Equal(t, keptSize, now.Size)
+
+	counting.syncErr = nil
+	readBack := new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.NoError(t, err, "the surviving needle must still be readable")
+	require.Equal(t, []byte("first-copy"), readBack.Data)
+}
+
+// Same rollback for a needle the failed write introduced: with nothing to go
+// back to, the mapping goes away rather than pointing past the end.
+func TestWriteNeedle2DropsIndexOfUnflushedNewNeedle(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	counting.syncErr = errors.New("disk went away")
+	fresh := fixedNeedle(7, "never-landed")
+	_, _, _, err := v.writeNeedle2(fresh, true, true, true)
+	require.Error(t, err)
+
+	if entry, found := v.nm.Get(fresh.Id); found {
+		require.True(t, entry.Size.IsDeleted(), "a needle that never reached the disk must not resolve")
+	}
+
+	counting.syncErr = nil
+	readBack := new(needle.Needle)
+	readBack.Id = fresh.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.Error(t, err, "reading the rolled-back needle should fail cleanly, not read past the end")
+}
+
+// The async durable path must roll back the mapper as well as the data tail
+// when its batch fsync fails. The current worker only truncates the data file,
+// so this test exposes the dangling mapping.
+func TestWriteNeedle2RollsBackBatchFsyncFailure(t *testing.T) {
+	v, counting := newCountingVolume(t)
+	initialFileCount := v.nm.FileCount()
+	initialDeletedCount := v.nm.DeletedCount()
+	initialContentSize := v.nm.ContentSize()
+	initialDeletedSize := v.nm.DeletedSize()
+	initialMaxFileKey := v.nm.MaxFileKey()
+
+	before, _, err := v.DataBackend.GetStat()
+	require.NoError(t, err)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	fresh := fixedNeedle(8, "batch-never-landed")
+	_, _, _, err = v.writeNeedle2(fresh, true, true, false)
+	require.Error(t, err, "a batch whose fsync failed must not be acknowledged")
+
+	after, _, err := v.DataBackend.GetStat()
+	require.NoError(t, err)
+	require.Equal(t, before, after, "the failed batch append should be truncated")
+
+	if entry, found := v.nm.Get(fresh.Id); found {
+		require.True(t, entry.Size.IsDeleted(), "the failed batch must not leave a live mapping")
+	}
+	require.Equal(t, initialFileCount, v.nm.FileCount())
+	require.Equal(t, initialDeletedCount, v.nm.DeletedCount())
+	require.Equal(t, initialContentSize, v.nm.ContentSize())
+	require.Equal(t, initialDeletedSize, v.nm.DeletedSize())
+	require.Equal(t, initialMaxFileKey, v.nm.MaxFileKey())
+}
+
+func TestWriteNeedle2RollsBackBatchFsyncFailureAndReloadsNewNeedle(t *testing.T) {
+	v, counting := newCountingVolume(t)
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+
+	fresh := fixedNeedle(9, "batch-never-landed")
+	_, _, _, err := v.writeNeedle2(fresh, true, true, false)
+	require.Error(t, err)
+
+	reloaded := reopenCountingVolume(t, v)
+	if entry, found := reloaded.nm.Get(fresh.Id); found {
+		require.True(t, entry.Size.IsDeleted(), "the failed batch must not reload a live mapping")
+	}
+
+	readBack := new(needle.Needle)
+	readBack.Id = fresh.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.Error(t, err, "the failed batch must not be readable after reload")
+	require.False(t, reloaded.IsReadOnly(), "a completed rollback should keep the volume healthy")
+}
+
+func TestWriteNeedle2RollsBackBatchFsyncFailureAndReloadsOverwrite(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	kept := fixedNeedle(10, "first-copy")
+	_, _, _, err := v.writeNeedle2(kept, true, true, true)
+	require.NoError(t, err)
+	keptEntry, found := v.nm.Get(kept.Id)
+	require.True(t, found)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	_, _, _, err = v.writeNeedle2(fixedNeedle(10, "second-copy"), true, true, false)
+	require.Error(t, err)
+
+	now, found := v.nm.Get(kept.Id)
+	require.True(t, found)
+	require.Equal(t, keptEntry.Offset, now.Offset)
+	require.Equal(t, keptEntry.Size, now.Size)
+
+	reloaded := reopenCountingVolume(t, v)
+	readBack := new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("first-copy"), readBack.Data)
+}
+
+func TestBatchDeleteRollsBackOnFsyncFailure(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	kept := fixedNeedle(11, "delete-me")
+	_, _, _, err := v.writeNeedle2(kept, true, true, true)
+	require.NoError(t, err)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	deleteRequest := needle.NewAsyncRequest(&needle.Needle{Id: kept.Id}, false)
+	deleteRequest.ActualSize = needle.GetActualSize(0, v.Version())
+	require.True(t, v.asyncRequestAppend(deleteRequest))
+	_, _, _, err = deleteRequest.WaitComplete()
+	require.Error(t, err)
+
+	readBack := new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.NoError(t, err, "a failed batch delete must restore the live mapping")
+	require.Equal(t, []byte("delete-me"), readBack.Data)
+
+	reloaded := reopenCountingVolume(t, v)
+	readBack = new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("delete-me"), readBack.Data)
+}
+
+func TestBatchSyncFailureEntersFailClosedWhenTruncateFails(t *testing.T) {
+	v, counting := newCountingVolume(t)
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	counting.truncateErr = errors.New("truncate failed")
+
+	fresh := fixedNeedle(12, "cannot-be-recovered")
+	_, _, _, err := v.writeNeedle2(fresh, true, true, false)
+	require.Error(t, err)
+	require.True(t, v.IsReadOnly(), "a failed recovery must make the volume unavailable")
+	require.NotNil(t, v.UnavailableError())
+
+	readBack := new(needle.Needle)
+	readBack.Id = fresh.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.Error(t, err, "an unavailable volume must reject reads")
+
+	_, _, _, err = v.writeNeedle2(fixedNeedle(13, "after-failure"), true, true, false)
+	require.Error(t, err, "an unavailable volume must reject later writes")
+	require.Equal(t, 1, counting.truncateCount)
+}
+
+func TestUnavailableVolumeCannotBeMarkedWritable(t *testing.T) {
+	dir := t.TempDir()
+	store := newIdxSplitStore(t, dir, dir)
+	const vid = needle.VolumeId(19)
+	require.NoError(t, store.AddVolume(vid, "", NeedleMapInMemory, "000", "", 0,
+		needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+
+	v := store.findVolume(vid)
+	require.NotNil(t, v)
+	v.markIoUnavailable(errors.New("batch recovery failed"))
+
+	require.Error(t, store.MarkVolumeWritable(vid), "manual writable transition must not bypass quarantine")
+	require.NotNil(t, v.UnavailableError())
+}
+
+func TestMixedBatchSyncFailureRollsBackAsOneUnit(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	overwritten := fixedNeedle(14, "keep-overwrite")
+	deleted := fixedNeedle(15, "keep-delete")
+	_, _, _, err := v.writeNeedle2(overwritten, true, true, true)
+	require.NoError(t, err)
+	_, _, _, err = v.writeNeedle2(deleted, true, true, true)
+	require.NoError(t, err)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	replacement := fixedNeedle(14, "failed-overwrite")
+	fresh := fixedNeedle(16, "failed-new")
+	deleteRequest := needle.NewAsyncRequest(&needle.Needle{Id: deleted.Id}, false)
+	requests := []*needle.AsyncRequest{
+		needle.NewAsyncRequest(replacement, true),
+		deleteRequest,
+		needle.NewAsyncRequest(fresh, true),
+	}
+	v.processBatch(requests)
+
+	for _, request := range requests {
+		_, _, _, err = request.WaitComplete()
+		require.Error(t, err, "every request in a failed batch must fail")
+	}
+
+	readBack := new(needle.Needle)
+	readBack.Id = overwritten.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("keep-overwrite"), readBack.Data)
+
+	readBack = new(needle.Needle)
+	readBack.Id = deleted.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("keep-delete"), readBack.Data)
+
+	readBack = new(needle.Needle)
+	readBack.Id = fresh.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.Error(t, err)
+
+	reloaded := reopenCountingVolume(t, v)
+	readBack = new(needle.Needle)
+	readBack.Id = overwritten.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("keep-overwrite"), readBack.Data)
+
+	readBack = new(needle.Needle)
+	readBack.Id = deleted.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("keep-delete"), readBack.Data)
+
+	readBack = new(needle.Needle)
+	readBack.Id = fresh.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.Error(t, err)
+}
+
+func TestWriteNeedle2EntersFailClosedWhenInlineRollbackFails(t *testing.T) {
+	v, counting := newCountingVolume(t)
+	counting.syncErr = errors.New("inline fsync failed")
+	counting.syncErrOnce = true
+	counting.truncateErr = errors.New("truncate failed")
+
+	_, _, _, err := v.writeNeedle2(fixedNeedle(20, "cannot-be-recovered"), true, true, true)
+	require.Error(t, err)
+	require.NotNil(t, v.UnavailableError())
+
+	readBack := new(needle.Needle)
+	readBack.Id = 20
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.Error(t, err)
+}
+
+func TestUnavailableVolumeStaysUnavailableAfterReload(t *testing.T) {
+	v, _ := newCountingVolume(t)
+	v.markIoUnavailable(errors.New("batch recovery failed"))
+
+	reloaded := reopenCountingVolume(t, v)
+	require.NotNil(t, reloaded.UnavailableError(), "the unavailable state must survive a reload")
+	require.True(t, reloaded.IsReadOnly())
+
+	_, _, quarantined := reloaded.getIoErrorState()
+	require.True(t, quarantined, "a reloaded unavailable volume must stay out of heartbeats")
+
+	readBack := new(needle.Needle)
+	readBack.Id = 1
+	_, err := reloaded.readNeedle(readBack, nil, nil)
+	require.Error(t, err)
+	_, _, _, err = reloaded.writeNeedle2(fixedNeedle(1, "after-reload"), true, true, false)
+	require.Error(t, err)
+}
+
+func TestBatchFsyncRollbackWithLevelDbMapper(t *testing.T) {
+	v, counting := newCountingVolumeWithKind(t, NeedleMapLevelDb)
+
+	kept := fixedNeedle(17, "leveldb-old")
+	_, _, _, err := v.writeNeedle2(kept, true, true, true)
+	require.NoError(t, err)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	_, _, _, err = v.writeNeedle2(fixedNeedle(17, "leveldb-new"), true, true, false)
+	require.Error(t, err)
+
+	readBack := new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("leveldb-old"), readBack.Data)
+
+	reloaded := reopenCountingVolume(t, v)
+	readBack = new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("leveldb-old"), readBack.Data)
+}
+
+func TestBatchFsyncRollbackRestoresOriginalValueAfterRepeatedNeedleId(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	kept := fixedNeedle(18, "original-value")
+	_, _, _, err := v.writeNeedle2(kept, true, true, true)
+	require.NoError(t, err)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	firstReplacement := fixedNeedle(18, "first-failed-value")
+	secondReplacement := fixedNeedle(18, "second-failed-value")
+	requests := []*needle.AsyncRequest{
+		needle.NewAsyncRequest(firstReplacement, true),
+		needle.NewAsyncRequest(secondReplacement, true),
+	}
+	v.processBatch(requests)
+
+	// A repeated needle id starts a new batch run, so the second write syncs
+	// on its own: the first run rolls back to "original-value" and the second
+	// write lands as a normal sequential overwrite.
+	_, _, _, err = requests[0].WaitComplete()
+	require.Error(t, err)
+	_, _, _, err = requests[1].WaitComplete()
+	require.NoError(t, err)
+
+	readBack := new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("second-failed-value"), readBack.Data)
+
+	reloaded := reopenCountingVolume(t, v)
+	readBack = new(needle.Needle)
+	readBack.Id = kept.Id
+	_, err = reloaded.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("second-failed-value"), readBack.Data)
+}
+
+// Rolling back a first-time write must not leave a tombstoned map entry: the
+// stale offset would make the next write to that needle fail reading a header
+// that no longer exists.
+func TestBatchRollbackLeavesNoPhantomMapping(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+	fresh := fixedNeedle(24, "batch-never-landed")
+	_, _, _, err := v.writeNeedle2(fresh, true, true, false)
+	require.Error(t, err)
+
+	_, _, _, err = v.writeNeedle2(fresh, true, true, false)
+	require.NoError(t, err, "rewriting a rolled-back needle must succeed")
+
+	readBack := new(needle.Needle)
+	readBack.Id = fresh.Id
+	_, err = v.readNeedle(readBack, nil, nil)
+	require.NoError(t, err)
+	require.Equal(t, []byte("batch-never-landed"), readBack.Data)
+}
+
+// A request that already failed on its own must still surface the batch
+// failure: keeping its earlier error would hide that nothing was persisted,
+// or that recovery itself failed.
+func TestFailedBatchMarksEveryRequestFailed(t *testing.T) {
+	v, counting := newCountingVolume(t)
+
+	kept := fixedNeedle(22, "original")
+	_, _, _, err := v.writeNeedle2(kept, true, true, true)
+	require.NoError(t, err)
+
+	counting.syncErr = errors.New("batch fsync failed")
+	counting.syncErrOnce = true
+
+	badCookie := fixedNeedle(22, "wrong-cookie")
+	badCookie.Cookie = kept.Cookie + 1
+	requests := []*needle.AsyncRequest{
+		needle.NewAsyncRequest(badCookie, true),
+		needle.NewAsyncRequest(fixedNeedle(23, "fresh"), true),
+	}
+	v.processBatch(requests)
+
+	for _, request := range requests {
+		_, _, _, err = request.WaitComplete()
+		require.ErrorContains(t, err, "batch fsync failed")
+	}
+}
+
+// failingPutMapper fails the failAt-th Put.
+type failingPutMapper struct {
+	NeedleMapper
+	puts   int
+	failAt int
+	err    error
+}
+
+func (m *failingPutMapper) Put(key types.NeedleId, offset types.Offset, size types.Size) error {
+	m.puts++
+	if m.puts == m.failAt {
+		return m.err
+	}
+	return m.NeedleMapper.Put(key, offset, size)
+}
+
+// A durable write whose index update fails stops the volume taking writes:
+// the requests after it in the same batch are refused, as a write sent on
+// its own would be, instead of indexed behind it. Entries before it stay
+// acked.
+func TestProcessBatchRefusesWritesAfterDurableIndexFailure(t *testing.T) {
+	v, _ := newCountingVolume(t)
+
+	kept := fixedNeedle(4, "kept")
+	_, _, _, err := v.writeNeedle2(kept, true, true, true)
+	require.NoError(t, err)
+
+	v.nm = &failingPutMapper{
+		NeedleMapper: v.nm,
+		failAt:       2,
+		err:          errors.New("index write failed"),
+	}
+
+	wrongCookie := fixedNeedle(4, "kept")
+	wrongCookie.Cookie = kept.Cookie + 1
+	requests := []*needle.AsyncRequest{
+		needle.NewAsyncRequest(fixedNeedle(1, "before"), true),
+		needle.NewAsyncRequest(fixedNeedle(2, "torn"), true),
+		needle.NewAsyncRequest(fixedNeedle(3, "after"), true),
+		needle.NewAsyncRequest(fixedNeedle(4, "kept"), true),
+		needle.NewAsyncRequest(wrongCookie, true),
+	}
+	v.processBatch(requests)
+
+	_, _, _, err = requests[0].WaitComplete()
+	require.NoError(t, err)
+	_, _, _, err = requests[1].WaitComplete()
+	require.Error(t, err)
+	for _, request := range requests[2:] {
+		_, _, _, err = request.WaitComplete()
+		require.ErrorContains(t, err, "read only", "refused as it would be sent on its own")
+	}
+	require.True(t, v.IsReadOnly())
+}
+
+// The quarantine is what CollectHeartbeat keys on: an unavailable volume must
+// not be announced to the master at all.
+func TestUnavailableVolumeIsSkippedInHeartbeat(t *testing.T) {
+	store := newTestStore(t, 1)
+	v := mountTestVolume(t, store.Locations[0], 1, "pics")
+	fillTestVolume(t, v)
+	v.markIoUnavailable(errors.New("batch recovery failed"))
+
+	heartbeat := store.CollectHeartbeat()
+	for _, m := range heartbeat.Volumes {
+		require.NotEqual(t, uint32(1), m.Id, "a failed-recovery volume must not be announced")
+	}
+}
+
+// The pre-stop drain exists so writes already assigned to this server land.
+// Refusing them once stopping would turn every rolling restart into client
+// write failures for the length of the drain.
+func TestStoreWriteVolumeNeedleStaysDurableWhileStopping(t *testing.T) {
+	dir := t.TempDir()
+	store := newIdxSplitStore(t, dir, dir)
+	const vid = needle.VolumeId(1)
+	require.NoError(t, store.AddVolume(vid, "", NeedleMapInMemory, "000", "", 0, needle.GetCurrentVersion(), 0, types.HardDriveType, 0))
+
+	v := store.findVolume(vid)
+	require.NotNil(t, v)
+	counting := &countingBackend{BackendStorageFile: v.DataBackend}
+	v.DataBackend = counting
+
+	store.SetStopping()
+	counting.syncCount = 0
+
+	isUnchanged, err := store.WriteVolumeNeedle(vid, newRandomNeedle(1), true, true)
+	require.NoError(t, err, "the drain must keep accepting durable writes")
+	require.False(t, isUnchanged)
+	require.Equal(t, 1, counting.syncCount, "the accepted write must actually be on disk")
+}
diff --git a/weed/storage/volume_write_test.go b/weed/storage/volume_write_test.go
index b060d67288..2fa479067b 100644
--- a/weed/storage/volume_write_test.go
+++ b/weed/storage/volume_write_test.go
@@ -1,15 +1,19 @@
 package storage
 
 import (
+	"bytes"
 	"errors"
 	"fmt"
+	"math"
 	"os"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/assert"
 
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/backend"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
@@ -29,7 +33,7 @@ func TestSearchVolumesWithDeletedNeedles(t *testing.T) {
 
 	for i := 1; i < count; i++ {
 		n := newRandomNeedle(uint64(i))
-		_, _, _, err := v.writeNeedle2(n, true, false)
+		_, _, _, err := v.writeNeedle2(n, true, false, false)
 		if err != nil {
 			t.Fatalf("write needle %d: %v", i, err)
 		}
@@ -90,7 +94,7 @@ func TestDestroyEmptyVolumeWithOnlyEmpty(t *testing.T) {
 
 	// should can Destroy empty volume with onlyEmpty
 	assertFileExist(t, true, path)
-	err = v.Destroy(true, false)
+	err = v.Destroy(true, false, false)
 	if err != nil {
 		t.Fatalf("destroy volume: %v", err)
 	}
@@ -108,7 +112,7 @@ func TestDestroyEmptyVolumeWithoutOnlyEmpty(t *testing.T) {
 
 	// should can Destroy empty volume without onlyEmpty
 	assertFileExist(t, true, path)
-	err = v.Destroy(false, false)
+	err = v.Destroy(false, false, false)
 	if err != nil {
 		t.Fatalf("destroy volume: %v", err)
 	}
@@ -126,19 +130,19 @@ func TestDestroyNonemptyVolumeWithOnlyEmpty(t *testing.T) {
 	path := v.DataBackend.Name()
 
 	// should return "volume not empty" error and do not delete file when Destroy non-empty volume
-	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false)
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false, false)
 	if err != nil {
 		t.Fatalf("write needle: %v", err)
 	}
 	assert.Equal(t, uint64(1), v.FileCount())
 
 	assertFileExist(t, true, path)
-	err = v.Destroy(true, false)
+	err = v.Destroy(true, false, false)
 	assert.EqualError(t, err, "volume not empty")
 	assertFileExist(t, true, path)
 
 	// should keep working after "volume not empty"
-	_, _, _, err = v.writeNeedle2(newRandomNeedle(2), true, false)
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(2), true, false, false)
 	if err != nil {
 		t.Fatalf("write needle: %v", err)
 	}
@@ -156,14 +160,14 @@ func TestDestroyNonemptyVolumeWithoutOnlyEmpty(t *testing.T) {
 	path := v.DataBackend.Name()
 
 	// should can Destroy non-empty volume without onlyEmpty
-	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false)
+	_, _, _, err = v.writeNeedle2(newRandomNeedle(1), true, false, false)
 	if err != nil {
 		t.Fatalf("write needle: %v", err)
 	}
 	assert.Equal(t, uint64(1), v.FileCount())
 
 	assertFileExist(t, true, path)
-	err = v.Destroy(false, false)
+	err = v.Destroy(false, false, false)
 	if err != nil {
 		t.Fatalf("destroy volume: %v", err)
 	}
@@ -179,7 +183,7 @@ func TestWriteNeedleBlobRejectedOnReadOnlyVolume(t *testing.T) {
 		t.Fatalf("volume creation: %v", err)
 	}
 	n := newRandomNeedle(1)
-	offset, _, _, err := v.writeNeedle2(n, true, false)
+	offset, _, _, err := v.writeNeedle2(n, true, false, false)
 	if err != nil {
 		t.Fatalf("write needle: %v", err)
 	}
@@ -187,7 +191,9 @@ func TestWriteNeedleBlobRejectedOnReadOnlyVolume(t *testing.T) {
 	if err != nil {
 		t.Fatalf("read needle blob: %v", err)
 	}
-	v.PersistReadOnly(true)
+	if err := v.PersistReadOnly(true, false); err != nil {
+		t.Fatalf("persist read-only: %v", err)
+	}
 	v.Close()
 
 	v, err = NewVolume(dir, dir, "", 7, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
@@ -230,7 +236,7 @@ func TestWriteNeedleBlobRejectsSizeMismatch(t *testing.T) {
 	location.SetVolume(7, v)
 
 	n := newRandomNeedle(1)
-	offset, _, _, err := v.writeNeedle2(n, true, false)
+	offset, _, _, err := v.writeNeedle2(n, true, false, false)
 	if err != nil {
 		t.Fatalf("write needle: %v", err)
 	}
@@ -256,3 +262,322 @@ func TestWriteNeedleBlobRejectsSizeMismatch(t *testing.T) {
 		t.Fatalf("write needle blob with the header size: %v", err)
 	}
 }
+
+// A negative size reaches make() in needle.ReadNeedleBlob, and the blob RPCs
+// have no recover, so one request took down the volume server.
+func TestReadNeedleBlobRejectsNegativeSize(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 7, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	n := newRandomNeedle(1)
+	offset, _, _, err := v.writeNeedle2(n, true, false, false)
+	if err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+
+	for _, size := range []types.Size{types.TombstoneFileSize, -100, math.MinInt32} {
+		t.Run(fmt.Sprintf("size %d", size), func(t *testing.T) {
+			defer func() {
+				if r := recover(); r != nil {
+					t.Errorf("ReadNeedleBlob panicked: %v", r)
+				}
+			}()
+			if _, err := v.ReadNeedleBlob(int64(offset), size); err == nil {
+				t.Error("expected ReadNeedleBlob to reject a negative size")
+			}
+		})
+	}
+
+	// Only negative sizes are rejected: size 0 is what a delete record carries.
+	for _, size := range []types.Size{0, n.Size} {
+		if _, err := v.ReadNeedleBlob(int64(offset), size); err != nil {
+			t.Errorf("ReadNeedleBlob with size %d: %v", size, err)
+		}
+	}
+}
+
+// The blob header carries the same negative size, so only the sign is wrong.
+func TestWriteNeedleBlobRejectsNegativeSize(t *testing.T) {
+	for _, size := range []types.Size{types.TombstoneFileSize, -5} {
+		t.Run(fmt.Sprintf("size %d", size), func(t *testing.T) {
+			dir := t.TempDir()
+			v, err := NewVolume(dir, dir, "", 7, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+			if err != nil {
+				t.Fatalf("volume creation: %v", err)
+			}
+			defer v.Close()
+
+			n := newRandomNeedle(1)
+			offset, _, _, err := v.writeNeedle2(n, true, false, false)
+			if err != nil {
+				t.Fatalf("write needle: %v", err)
+			}
+			blob, err := v.ReadNeedleBlob(int64(offset), n.Size)
+			if err != nil {
+				t.Fatalf("read needle blob: %v", err)
+			}
+			// Make the header agree with the size, so only the sign is wrong.
+			types.SizeToBytes(blob[types.NeedleHeaderSize-types.SizeSize:types.NeedleHeaderSize], size)
+
+			datSizeBefore, _, _ := v.DataBackend.GetStat()
+
+			if err = v.WriteNeedleBlob(types.Uint64ToNeedleId(2), blob, size); err == nil {
+				t.Error("expected WriteNeedleBlob to reject a negative size")
+			}
+
+			datSizeAfter, _, _ := v.DataBackend.GetStat()
+			if datSizeAfter != datSizeBefore {
+				t.Errorf(".dat grew from %d to %d on a rejected blob", datSizeBefore, datSizeAfter)
+			}
+			if nv, ok := v.nm.Get(types.Uint64ToNeedleId(2)); ok {
+				t.Errorf("needle 2 was indexed with size %d", nv.Size)
+			}
+		})
+	}
+}
+
+// A blob shorter or longer than its record size leaves .dat off the record grid:
+// later writes index at truncated offsets, or a scan reads the leftover bytes as
+// the next record.
+func TestWriteNeedleBlobRejectsLengthMismatch(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		mutate func(blob []byte) []byte
+	}{
+		{"one byte too long", func(blob []byte) []byte { return append(blob, 0) }},
+		{"one byte short", func(blob []byte) []byte { return blob[:len(blob)-1] }},
+		{"8 bytes too long", func(blob []byte) []byte { return append(blob, make([]byte, 8)...) }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			dir := t.TempDir()
+			v, err := NewVolume(dir, dir, "", 7, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+			if err != nil {
+				t.Fatalf("volume creation: %v", err)
+			}
+			defer v.Close()
+
+			n := newRandomNeedle(1)
+			offset, _, _, err := v.writeNeedle2(n, true, false, false)
+			if err != nil {
+				t.Fatalf("write needle: %v", err)
+			}
+			blob, err := v.ReadNeedleBlob(int64(offset), n.Size)
+			if err != nil {
+				t.Fatalf("read needle blob: %v", err)
+			}
+			datSizeBefore, _, _ := v.DataBackend.GetStat()
+
+			if err = v.WriteNeedleBlob(types.Uint64ToNeedleId(2), tc.mutate(blob), n.Size); err == nil {
+				t.Error("expected WriteNeedleBlob to reject a blob whose length does not match its size")
+			}
+
+			datSizeAfter, _, _ := v.DataBackend.GetStat()
+			if datSizeAfter != datSizeBefore {
+				t.Errorf(".dat grew from %d to %d on a rejected blob", datSizeBefore, datSizeAfter)
+			}
+
+			next := newRandomNeedle(3)
+			if _, _, _, err = v.writeNeedle2(next, true, false, false); err != nil {
+				t.Fatalf("write needle 3: %v", err)
+			}
+			got := newEmptyNeedle(3)
+			if _, err = v.readNeedle(got, nil, nil); err != nil {
+				t.Fatalf("read back needle 3: %v", err)
+			}
+			if !bytes.Equal(got.Data, next.Data) {
+				t.Error("needle 3 read back with different data")
+			}
+		})
+	}
+}
+
+// The checks must pass what the real callers send: a needle's own record and the
+// size-0 record a delete leaves.
+func TestWriteNeedleBlobRoundTrip(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 7, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	n := newRandomNeedle(1)
+	offset, _, _, err := v.writeNeedle2(n, true, false, false)
+	if err != nil {
+		t.Fatalf("write needle: %v", err)
+	}
+	blob, err := v.ReadNeedleBlob(int64(offset), n.Size)
+	if err != nil {
+		t.Fatalf("read needle blob: %v", err)
+	}
+	if err = v.WriteNeedleBlob(types.Uint64ToNeedleId(2), blob, n.Size); err != nil {
+		t.Fatalf("write needle blob: %v", err)
+	}
+	got := newEmptyNeedle(2)
+	if _, err = v.readNeedle(got, nil, nil); err != nil {
+		t.Fatalf("read back needle 2: %v", err)
+	}
+	if !bytes.Equal(got.Data, n.Data) {
+		t.Error("needle 2 read back with different data")
+	}
+
+	deleteOffset, _, _ := v.DataBackend.GetStat()
+	if _, err = v.doDeleteRequest(newEmptyNeedle(1)); err != nil {
+		t.Fatalf("delete needle 1: %v", err)
+	}
+	deleteRecord, err := v.ReadNeedleBlob(deleteOffset, 0)
+	if err != nil {
+		t.Fatalf("read delete record: %v", err)
+	}
+	if err = v.WriteNeedleBlob(types.Uint64ToNeedleId(3), deleteRecord, 0); err != nil {
+		t.Fatalf("write size-0 needle blob: %v", err)
+	}
+
+	next := newRandomNeedle(4)
+	if _, _, _, err = v.writeNeedle2(next, true, false, false); err != nil {
+		t.Fatalf("write needle 4: %v", err)
+	}
+	got = newEmptyNeedle(4)
+	if _, err = v.readNeedle(got, nil, nil); err != nil {
+		t.Fatalf("read back needle 4: %v", err)
+	}
+	if !bytes.Equal(got.Data, next.Data) {
+		t.Error("needle 4 read back with different data")
+	}
+}
+
+// A write that already assembled the needle and holds the volume write lock
+// must still refuse append once the volume is readonly — no 201/204, nothing
+// in .dat/.idx.
+func TestDoWriteRequestRefusesReadOnlyBeforeAppend(t *testing.T) {
+	dir := t.TempDir()
+	v, err := NewVolume(dir, dir, "", 21, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	seed := newRandomNeedle(1)
+	if _, _, _, err = v.writeNeedle2(seed, true, false, false); err != nil {
+		t.Fatalf("seed write: %v", err)
+	}
+	datBefore, _, err := v.DataBackend.GetStat()
+	if err != nil {
+		t.Fatalf("stat dat: %v", err)
+	}
+	idxBefore := v.nm.IndexFileSize()
+
+	n := newRandomNeedle(99)
+	v.dataFileAccessLock.Lock()
+	v.noWriteLock.Lock()
+	v.noWriteOrDelete = true
+	v.noWriteLock.Unlock()
+	_, _, isUnchanged, writeErr := v.doWriteRequest(n, true, false)
+	v.dataFileAccessLock.Unlock()
+
+	if writeErr == nil {
+		t.Fatal("expected read-only error")
+	}
+	if isUnchanged {
+		t.Fatal("read-only write must not report unchanged (HTTP 204)")
+	}
+	if _, found := v.nm.Get(n.Id); found {
+		t.Fatal("needle must not land in .idx")
+	}
+	datAfter, _, err := v.DataBackend.GetStat()
+	if err != nil {
+		t.Fatalf("stat dat after: %v", err)
+	}
+	if datAfter != datBefore {
+		t.Fatalf("dat size %d -> %d; needle must not append", datBefore, datAfter)
+	}
+	if v.nm.IndexFileSize() != idxBefore {
+		t.Fatalf("idx size changed; needle must not index")
+	}
+}
+
+type syncCountingBackend struct {
+	backend.BackendStorageFile
+	syncs atomic.Int64
+}
+
+func (b *syncCountingBackend) Sync() error {
+	b.syncs.Add(1)
+	return b.BackendStorageFile.Sync()
+}
+
+// A drained queue used to flush whatever it held, turning durable writes into
+// one fsync per request at low concurrency. With a batch window configured, a
+// straggler that lands inside the window joins the same sync.
+func TestSyncBatchDefersFlushForStragglers(t *testing.T) {
+	dir := t.TempDir()
+
+	v, err := NewVolume(dir, dir, "", 7, NeedleMapInMemory, &super_block.ReplicaPlacement{}, &needle.TTL{}, 0, needle.GetCurrentVersion(), 0, 0)
+	if err != nil {
+		t.Fatalf("volume creation: %v", err)
+	}
+	defer v.Close()
+
+	counting := &syncCountingBackend{BackendStorageFile: v.DataBackend}
+	v.DataBackend = counting
+	writeBytes := int64(needle.GetActualSize(16, v.Version()))
+	v.location = &DiskLocation{syncBatch: SyncBatchOption{
+		MinBytes:    writeBytes * 2,
+		MinRequests: syncBatchMaxRequests,
+		Wait:        time.Minute,
+	}}
+
+	armed := make(chan chan time.Time, 4)
+	prevAfter := syncBatchAfter
+	syncBatchAfter = func(time.Duration) <-chan time.Time {
+		window := make(chan time.Time, 1)
+		armed <- window
+		return window
+	}
+	defer func() { syncBatchAfter = prevAfter }()
+
+	done := make(chan error, 3)
+	writeAsync := func(id uint64) {
+		n := new(needle.Needle)
+		n.Data = make([]byte, 16)
+		n.Checksum = needle.NewCRC(n.Data)
+		n.Id = types.Uint64ToNeedleId(id)
+		_, _, _, writeErr := v.writeNeedle2(n, true, true, false)
+		done <- writeErr
+	}
+	windowFor := func(id uint64) chan time.Time {
+		go writeAsync(id)
+		window := <-armed
+		select {
+		case <-done:
+			t.Fatalf("write %d flushed while its batch window was still open", id)
+		default:
+		}
+		return window
+	}
+
+	windowFor(1)
+	// the straggler fills the batch to MinBytes, closing the window early
+	go writeAsync(2)
+	for i := 0; i < 2; i++ {
+		if writeErr := <-done; writeErr != nil {
+			t.Fatalf("write needle: %v", writeErr)
+		}
+	}
+	if syncs := counting.syncs.Load(); syncs != 1 {
+		t.Fatalf("expected both writes to share one .dat sync, got %d", syncs)
+	}
+
+	window := windowFor(3)
+	window <- time.Now()
+	if writeErr := <-done; writeErr != nil {
+		t.Fatalf("write needle: %v", writeErr)
+	}
+	if syncs := counting.syncs.Load(); syncs != 2 {
+		t.Fatalf("expected a lone write to take its own sync, got %d total", syncs)
+	}
+}
diff --git a/weed/telemetry/collector.go b/weed/telemetry/collector.go
index ea1745d68a..8cf392ee46 100644
--- a/weed/telemetry/collector.go
+++ b/weed/telemetry/collector.go
@@ -68,8 +68,9 @@ func (c *Collector) CollectAndSendAsync() {
 	}
 
 	go func() {
-		data := c.collectData()
-		c.client.SendTelemetryAsync(data)
+		if data := c.collectData(); data != nil {
+			c.client.SendTelemetryAsync(data)
+		}
 	}()
 }
 
@@ -80,7 +81,7 @@ func (c *Collector) StartPeriodicCollection(interval time.Duration) {
 		return
 	}
 
-	glog.V(0).Infof("Reporting anonymous cluster statistics to %s every %v, use -telemetry=false to opt out", c.client.url, interval)
+	glog.V(0).Infof("Reporting anonymous cluster statistics to %s every %v once %d GiB are stored, use -telemetry=false to opt out", c.client.url, interval, proto.MinDiskBytes>>30)
 
 	// Send initial telemetry after a short delay
 	go func() {
@@ -107,7 +108,9 @@ func (c *Collector) StartPeriodicCollection(interval time.Duration) {
 	}()
 }
 
-// collectData gathers telemetry data from the topology
+// collectData gathers telemetry data from the topology. It returns nil while
+// the cluster stores less than proto.MinDiskBytes, so throwaway clusters never
+// report.
 func (c *Collector) collectData() *proto.TelemetryData {
 	data := &proto.TelemetryData{
 		Version:   c.version,
@@ -131,6 +134,10 @@ func (c *Collector) collectData() *proto.TelemetryData {
 		data.BrokerCount = int32(c.countBrokers())
 	}
 
+	if data.TotalDiskBytes < proto.MinDiskBytes {
+		glog.V(2).Infof("Skipping telemetry: %d bytes stored, reporting starts at %d", data.TotalDiskBytes, proto.MinDiskBytes)
+		return nil
+	}
 	return data
 }
 
diff --git a/weed/telemetry/collector_test.go b/weed/telemetry/collector_test.go
index b7127d93f7..e4db1e3042 100644
--- a/weed/telemetry/collector_test.go
+++ b/weed/telemetry/collector_test.go
@@ -3,6 +3,7 @@ package telemetry
 import (
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/telemetry/proto"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/sequence"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
@@ -64,3 +65,23 @@ func TestCollectVolumeStatsCountsEcShards(t *testing.T) {
 		t.Errorf("Expected 4 volumes, got %d", volumeCount)
 	}
 }
+
+func TestCollectDataWaitsForMinDiskBytes(t *testing.T) {
+	topo := topology.NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+	dn := rack.GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", map[string]uint32{"": 25})
+	collector := NewCollector(nil, topo, nil)
+
+	under := &master_pb.VolumeInformationMessage{Id: 1, Size: proto.MinDiskBytes - 1, Version: uint32(needle.GetCurrentVersion())}
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{under}, dn)
+	if data := collector.collectData(); data != nil {
+		t.Fatalf("cluster under the floor reported %+v", data)
+	}
+
+	one := &master_pb.VolumeInformationMessage{Id: 2, Size: 1, Version: uint32(needle.GetCurrentVersion())}
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{under, one}, dn)
+	data := collector.collectData()
+	if data == nil || data.TotalDiskBytes != proto.MinDiskBytes {
+		t.Fatalf("cluster on the floor reported %+v", data)
+	}
+}
diff --git a/weed/topology/cluster_commands.go b/weed/topology/cluster_commands.go
index dfa3bf6cc5..a4d7527863 100644
--- a/weed/topology/cluster_commands.go
+++ b/weed/topology/cluster_commands.go
@@ -13,6 +13,9 @@ import (
 type MaxVolumeIdCommand struct {
 	MaxVolumeId needle.VolumeId `json:"maxVolumeId"`
 	TopologyId  string          `json:"topologyId"`
+	// GrowthFrozen replicates the volume-growth freeze through raft so a
+	// leader change does not silently lift it. nil means no change.
+	GrowthFrozen *bool `json:"growthFrozen,omitempty"`
 }
 
 func NewMaxVolumeIdCommand(value needle.VolumeId, topologyId string) *MaxVolumeIdCommand {
@@ -43,6 +46,12 @@ func (c *MaxVolumeIdCommand) Apply(server raft.Server) (interface{}, error) {
 			}
 		}
 	}
+	if c.GrowthFrozen != nil {
+		topo.SetGrowthFrozen(*c.GrowthFrozen)
+	}
+	if err := topo.PersistMaxVolumeId(c.MaxVolumeId); err != nil {
+		glog.Warningf("persist max volume id %d: %v", c.MaxVolumeId, err)
+	}
 	glog.V(1).Infoln("max volume id", before, "==>", topo.GetMaxVolumeId())
 
 	return nil, nil
diff --git a/weed/topology/collection.go b/weed/topology/collection.go
index c8c0841bae..254c951dc7 100644
--- a/weed/topology/collection.go
+++ b/weed/topology/collection.go
@@ -14,6 +14,7 @@ type Collection struct {
 	Name                     string
 	volumeSizeLimit          uint64
 	replicationAsMin         bool
+	maxWritableVolumes       int
 	storageType2VolumeLayout *util.ConcurrentReadMap
 }
 
@@ -40,7 +41,9 @@ func (c *Collection) GetOrCreateVolumeLayout(rp *super_block.ReplicaPlacement, t
 		keyString += string(diskType)
 	}
 	vl := c.storageType2VolumeLayout.Get(keyString, func() interface{} {
-		return NewVolumeLayout(rp, ttl, diskType, c.volumeSizeLimit, c.replicationAsMin)
+		layout := NewVolumeLayout(rp, ttl, diskType, c.volumeSizeLimit, c.replicationAsMin)
+		layout.maxWritableVolumes = c.maxWritableVolumes
+		return layout
 	})
 	return vl.(*VolumeLayout)
 }
@@ -54,7 +57,10 @@ func (c *Collection) GetVolumeLayout(rp *super_block.ReplicaPlacement, ttl *need
 		keyString += string(diskType)
 	}
 	vl, ok := c.storageType2VolumeLayout.Find(keyString)
-	return vl.(*VolumeLayout), ok
+	if !ok {
+		return nil, false
+	}
+	return vl.(*VolumeLayout), true
 }
 
 func (c *Collection) GetAllVolumeLayouts() []*VolumeLayout {
@@ -75,10 +81,10 @@ func (c *Collection) DeleteVolumeLayout(rp *super_block.ReplicaPlacement, ttl *n
 	if diskType != types.HardDriveType {
 		keyString += string(diskType)
 	}
-	if vl, found := c.GetVolumeLayout(rp, ttl, diskType); found {
-		vl.releaseLookupOwnership()
+	// Unpublish first so a racing registration re-resolves into a fresh layout.
+	if vl, found := c.storageType2VolumeLayout.Delete(keyString); found {
+		vl.(*VolumeLayout).releaseLookupOwnership()
 	}
-	c.storageType2VolumeLayout.Delete(keyString)
 }
 
 func (c *Collection) Lookup(vid needle.VolumeId) []*DataNode {
diff --git a/weed/topology/collection_layout_delete_test.go b/weed/topology/collection_layout_delete_test.go
new file mode 100644
index 0000000000..7b348e878f
--- /dev/null
+++ b/weed/topology/collection_layout_delete_test.go
@@ -0,0 +1,72 @@
+package topology
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/sequence"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+func TestGetVolumeLayoutOfAbsentKey(t *testing.T) {
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	c := NewCollection("c", 32*1024, false)
+
+	vl, found := c.GetVolumeLayout(rp, needle.EMPTY_TTL, types.HardDriveType)
+	if found || vl != nil {
+		t.Fatalf("absent layout: got (%v, %v), want (nil, false)", vl, found)
+	}
+}
+
+// Volume servers dropping the last replica of several volumes that share one
+// layout all see the layout go empty and all delete it. The losers used to
+// crash the master on a nil type assertion.
+func TestConcurrentLastReplicaRemoval(t *testing.T) {
+	const nodeCount = 8
+	ttl, _ := needle.ReadTTL("5m")
+	for round := 0; round < 500; round++ {
+		topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+		rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+
+		// A second layout keeps the collection alive, so every remover reaches
+		// the layout deletion instead of stopping at a vanished collection.
+		keeper := rack.GetOrCreateDataNode("127.0.0.1", 9000, 0, "", "", map[string]uint32{"": 100})
+		topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{{
+			Id: 999, Collection: "c", Version: uint32(needle.GetCurrentVersion()), Ttl: ttl.ToUint32(),
+		}}, keeper)
+
+		var wg sync.WaitGroup
+		start := make(chan struct{})
+		for i := 0; i < nodeCount; i++ {
+			dn := rack.GetOrCreateDataNode("127.0.0.1", 8080+i, 0, "", "", map[string]uint32{"": 100})
+			m := &master_pb.VolumeInformationMessage{
+				Id: uint32(i + 1), Collection: "c", Version: uint32(needle.GetCurrentVersion()),
+			}
+			topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{m}, dn)
+			vi, err := storage.NewVolumeInfo(m)
+			if err != nil {
+				t.Fatalf("NewVolumeInfo: %v", err)
+			}
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				<-start
+				topo.UnRegisterVolumeLayout(vi, dn)
+			}()
+		}
+		close(start)
+		wg.Wait()
+
+		c, found := topo.FindCollection("c")
+		if !found {
+			t.Fatalf("round %d: collection dropped while a layout still had volumes", round)
+		}
+		if layouts := c.GetAllVolumeLayouts(); len(layouts) != 1 {
+			t.Fatalf("round %d: got %d layouts, want only the one still holding a volume", round, len(layouts))
+		}
+	}
+}
diff --git a/weed/topology/collection_statistics_test.go b/weed/topology/collection_statistics_test.go
index b7d5f5b1cb..4c8078277e 100644
--- a/weed/topology/collection_statistics_test.go
+++ b/weed/topology/collection_statistics_test.go
@@ -117,7 +117,7 @@ func statsTopology(t *testing.T) *Topology {
 func TestCollectionStatisticsMatchesAFullListing(t *testing.T) {
 	topo := statsTopology(t)
 
-	want := referenceCollectionStatistics(topo.ToTopologyInfo())
+	want := referenceCollectionStatistics(topo.ToTopologyInfo(VolumeFilter{}))
 	got := map[string]*CollectionStatistics{}
 	for _, s := range topo.CollectionStatistics() {
 		got[s.Collection] = s
diff --git a/weed/topology/crowded_writable_test.go b/weed/topology/crowded_writable_test.go
index ba87bcb6d3..32e0a072fa 100644
--- a/weed/topology/crowded_writable_test.go
+++ b/weed/topology/crowded_writable_test.go
@@ -1,6 +1,7 @@
 package topology
 
 import (
+	"sync"
 	"testing"
 	"time"
 
@@ -73,3 +74,52 @@ func TestCrowdedCountStillMatchesWritables(t *testing.T) {
 		t.Errorf("writable=%d crowded=%d, want 1 and 1", writable, crowded)
 	}
 }
+
+// SetVolumeCrowded mutates the crowded map while GetWritableVolumeCount reads
+// it on the Assign hot path. Under RLock both could run at once and the Go
+// runtime aborts with "concurrent map read and map write". Run with -race to
+// reproduce the original bug; the write lock makes this pass.
+func TestSetVolumeCrowdedNoRaceWithGetWritableVolumeCount(t *testing.T) {
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	vl := NewVolumeLayout(rp, needle.EMPTY_TTL, types.HardDriveType, 10000, false)
+	// GetWritableVolumeCount iterates vl.writables, so give it something to
+	// read while the crowded map is being mutated.
+	vl.writables = []needle.VolumeId{1, 2, 3}
+
+	var wg sync.WaitGroup
+	stop := make(chan struct{})
+	for range 8 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+					vl.SetVolumeCrowded(needle.VolumeId(2))
+				}
+			}
+		}()
+	}
+	for range 8 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for {
+				select {
+				case <-stop:
+					return
+				default:
+					vl.GetWritableVolumeCount()
+				}
+			}
+		}()
+	}
+
+	// The race detector needs only a brief window to flag a concurrent
+	// map read/write; let the goroutines hammer the lock briefly.
+	time.Sleep(50 * time.Millisecond)
+	close(stop)
+	wg.Wait()
+}
diff --git a/weed/topology/data_center.go b/weed/topology/data_center.go
index e036621b4f..b461fb07a3 100644
--- a/weed/topology/data_center.go
+++ b/weed/topology/data_center.go
@@ -56,14 +56,14 @@ func (dc *DataCenter) ToInfo() (info DataCenterInfo) {
 	return
 }
 
-func (dc *DataCenter) ToDataCenterInfo() *master_pb.DataCenterInfo {
+func (dc *DataCenter) ToDataCenterInfo(filter VolumeFilter) *master_pb.DataCenterInfo {
 	m := &master_pb.DataCenterInfo{
 		Id:        string(dc.Id()),
 		DiskInfos: dc.diskUsages.ToDiskInfo(),
 	}
 	for _, c := range dc.Children() {
 		rack := c.(*Rack)
-		m.RackInfos = append(m.RackInfos, rack.ToRackInfo())
+		m.RackInfos = append(m.RackInfos, rack.ToRackInfo(filter))
 	}
 	return m
 }
diff --git a/weed/topology/data_node.go b/weed/topology/data_node.go
index 847d30cf84..444adf7646 100644
--- a/weed/topology/data_node.go
+++ b/weed/topology/data_node.go
@@ -23,7 +23,11 @@ type DataNode struct {
 	Counter       int   // in race condition, the previous dataNode was not dead
 	IsTerminating bool
 
-	MaintenanceMode bool
+	// maintenanceMode mirrors the volume server's own flag, reported over the
+	// heartbeat. A server in maintenance is being drained: the master places
+	// no new volumes on it and assigns no writes to the volumes it holds. Read
+	// on the assign and volume-growth paths without the node lock.
+	maintenanceMode atomic.Bool
 	// lookupDigest covers the volumes reachable through this node in the volume
 	// layouts, for comparison against what its disks actually hold.
 	lookupDigest atomic.Uint64
@@ -58,12 +62,36 @@ func (dn *DataNode) String() string {
 	return fmt.Sprintf("Node:%s, Ip:%s, Port:%d, PublicUrl:%s", dn.NodeImpl.String(), dn.Ip, dn.Port, dn.PublicUrl)
 }
 
-func (dn *DataNode) AddOrUpdateVolume(v storage.VolumeInfo) (isNew, isChangedRO bool) {
+// InMaintenanceMode reports whether the volume server asked to be left alone
+// for writes; see Topology.SetDataNodeMaintenanceMode for what that changes.
+func (dn *DataNode) InMaintenanceMode() bool {
+	return dn.maintenanceMode.Load()
+}
+
+// SetMaintenanceMode records the flag and reports whether it changed. Prefer
+// Topology.SetDataNodeMaintenanceMode, which also updates the writable lists.
+func (dn *DataNode) SetMaintenanceMode(on bool) (changed bool) {
+	return dn.maintenanceMode.Swap(on) != on
+}
+
+func (dn *DataNode) AddOrUpdateVolume(v storage.VolumeInfo) (isNew, isChangedRO, tierTransition bool) {
 	dn.Lock()
 	defer dn.Unlock()
 	return dn.doAddOrUpdateVolume(v)
 }
 
+// SetVolumeReadOnly records the read-only flag a volume server reported for
+// one of its volumes, ahead of the heartbeat that will repeat it.
+func (dn *DataNode) SetVolumeReadOnly(vid needle.VolumeId, readOnly bool) {
+	dn.Lock()
+	defer dn.Unlock()
+	for _, c := range dn.children {
+		if c.(*Disk).SetVolumeReadOnly(vid, readOnly) {
+			return
+		}
+	}
+}
+
 func (dn *DataNode) getOrCreateDisk(diskType string) *Disk {
 	c, found := dn.children[NodeId(diskType)]
 	if !found {
@@ -74,14 +102,14 @@ func (dn *DataNode) getOrCreateDisk(diskType string) *Disk {
 	return disk
 }
 
-func (dn *DataNode) doAddOrUpdateVolume(v storage.VolumeInfo) (isNew, isChanged bool) {
+func (dn *DataNode) doAddOrUpdateVolume(v storage.VolumeInfo) (isNew, isChanged, tierTransition bool) {
 	disk := dn.getOrCreateDisk(v.DiskType)
 	return disk.AddOrUpdateVolume(v)
 }
 
 // AddProvisionalVolume records a volume the master registered on its own,
 // ahead of any server report naming it. See Disk.AddProvisionalVolume.
-func (dn *DataNode) AddProvisionalVolume(v storage.VolumeInfo) (isNew, isChanged bool) {
+func (dn *DataNode) AddProvisionalVolume(v storage.VolumeInfo) (isNew, isChanged, tierTransition bool) {
 	dn.Lock()
 	defer dn.Unlock()
 	disk := dn.getOrCreateDisk(v.DiskType)
@@ -90,6 +118,14 @@ func (dn *DataNode) AddProvisionalVolume(v storage.VolumeInfo) (isNew, isChanged
 
 // UpdateVolumes detects new/deleted/changed volumes on a volume server
 // used in master to notify master clients of these changes.
+//
+// changedVolumes covers every replica the disk already held whose
+// classification the new report altered in a way clients must learn about:
+// the ReadOnly flag flipped, or IsRemote() flipped on tier transition. The
+// latter is what lets the wdclient refresh DataInRemote after the digest
+// mismatch recovery path resends a full Volumes list -- that path is the
+// only way a re-tiered replica reaches the master without a separate
+// ChangedVolumes heartbeat.
 func (dn *DataNode) UpdateVolumes(actualVolumes []storage.VolumeInfo) (newVolumes, deletedVolumes, changedVolumes []storage.VolumeInfo) {
 
 	reported := newReportedVolumes(len(actualVolumes))
@@ -133,11 +169,11 @@ func (dn *DataNode) UpdateVolumes(actualVolumes []storage.VolumeInfo) (newVolume
 		newVolumes = make([]storage.VolumeInfo, 0, addedCount)
 	}
 	for _, v := range actualVolumes {
-		isNew, isChanged := dn.doAddOrUpdateVolume(v)
+		isNew, isChanged, tierTransition := dn.doAddOrUpdateVolume(v)
 		if isNew {
 			newVolumes = append(newVolumes, v)
 		}
-		if isChanged {
+		if isChanged || tierTransition {
 			changedVolumes = append(changedVolumes, v)
 		}
 	}
@@ -219,6 +255,18 @@ func (dn *DataNode) AdjustDiskUsageBytes(diskTotalBytes, diskFreeBytes map[strin
 	}
 }
 
+// AppendVolumeIds appends the ids of this node's volumes to all, and repeats
+// the remote-tier ones on remote, without copying the volume records to read
+// them.
+func (dn *DataNode) AppendVolumeIds(all, remote, readOnly, readOnlyCanDelete []uint32) ([]uint32, []uint32, []uint32, []uint32) {
+	dn.RLock()
+	defer dn.RUnlock()
+	for _, c := range dn.children {
+		all, remote, readOnly, readOnlyCanDelete = c.(*Disk).AppendVolumeIds(all, remote, readOnly, readOnlyCanDelete)
+	}
+	return all, remote, readOnly, readOnlyCanDelete
+}
+
 func (dn *DataNode) GetVolumes() (ret []storage.VolumeInfo) {
 	dn.RLock()
 	defer dn.RUnlock()
@@ -295,12 +343,25 @@ func (dn *DataNode) GetRack() *Rack {
 	return dn.Parent().(*NodeImpl).value.(*Rack)
 }
 
+func (dn *DataNode) matchesLocation(option *VolumeGrowOption) bool {
+	if option.DataCenter != "" && dn.GetDataCenter().Id() != NodeId(option.DataCenter) {
+		return false
+	}
+	if option.Rack != "" && dn.GetRack().Id() != NodeId(option.Rack) {
+		return false
+	}
+	if option.DataNode != "" && dn.Id() != NodeId(option.DataNode) {
+		return false
+	}
+	return true
+}
+
 func (dn *DataNode) GetTopology() *Topology {
 	p := dn.Parent()
-	for p.Parent() != nil {
+	for p != nil && p.Parent() != nil {
 		p = p.Parent()
 	}
-	t := p.(*Topology)
+	t, _ := p.(*Topology)
 	return t
 }
 
@@ -351,7 +412,7 @@ func (dn *DataNode) ToInfo() (info DataNodeInfo) {
 	return
 }
 
-func (dn *DataNode) ToDataNodeInfo() *master_pb.DataNodeInfo {
+func (dn *DataNode) ToDataNodeInfo(filter VolumeFilter) *master_pb.DataNodeInfo {
 	m := &master_pb.DataNodeInfo{
 		Id: string(dn.Id()),
 		// Start from disk usage counters so empty disks are still represented
@@ -371,9 +432,21 @@ func (dn *DataNode) ToDataNodeInfo() *master_pb.DataNodeInfo {
 		diskInfo.Type = diskType
 	}
 
+	reported := make(map[string]bool)
 	for _, c := range dn.Children() {
 		disk := c.(*Disk)
-		m.DiskInfos[string(disk.Id())] = disk.ToDiskInfo()
+		reported[string(disk.Id())] = true
+		m.DiskInfos[string(disk.Id())] = disk.ToDiskInfo(filter)
+	}
+	// A zeroed usage counter with no disk child was only ever created by a
+	// capacity query, not by anything the server reported: drop it so the
+	// node does not advertise a disk type it does not have.
+	for diskType := range m.DiskInfos {
+		if !reported[diskType] {
+			if u := dn.diskUsages.getDisk(types.ToDiskType(diskType)); u != nil && u.snapshot() == (DiskUsageCounts{}) {
+				delete(m.DiskInfos, diskType)
+			}
+		}
 	}
 
 	dn.RLock()
diff --git a/weed/topology/data_node_ec_multi_disk_test.go b/weed/topology/data_node_ec_multi_disk_test.go
index 698a4d1149..cd294ca058 100644
--- a/weed/topology/data_node_ec_multi_disk_test.go
+++ b/weed/topology/data_node_ec_multi_disk_test.go
@@ -86,7 +86,7 @@ func TestEcShardsAcrossMultipleDisksOnSameNode(t *testing.T) {
 		1: {1, 4, 9},
 		3: {8, 12},
 	}
-	dnInfo := dn.ToDataNodeInfo()
+	dnInfo := dn.ToDataNodeInfo(VolumeFilter{})
 	gotPerDisk := map[uint32][]erasure_coding.ShardId{}
 	for _, diskInfo := range dnInfo.DiskInfos {
 		for _, eci := range diskInfo.EcShardInfos {
diff --git a/weed/topology/data_node_empty_disk_test.go b/weed/topology/data_node_empty_disk_test.go
index 74c7e15e3b..06c6fd6140 100644
--- a/weed/topology/data_node_empty_disk_test.go
+++ b/weed/topology/data_node_empty_disk_test.go
@@ -21,7 +21,7 @@ func TestToDataNodeInfoReportsEmptyPhysicalDisks(t *testing.T) {
 		{DiskId: 2, Type: "", MaxVolumeCount: 300}, // empty disk, never held a volume
 	})
 
-	info := dn.ToDataNodeInfo()
+	info := dn.ToDataNodeInfo(VolumeFilter{})
 	di, ok := info.DiskInfos[""]
 	if !ok {
 		t.Fatalf("missing HDD disk info")
@@ -61,7 +61,7 @@ func TestToDataNodeInfoKeepsZeroCapacityDisk(t *testing.T) {
 		{DiskId: 2, Type: "", MaxVolumeCount: 0}, // unavailable disk
 	})
 
-	di := dn.ToDataNodeInfo().DiskInfos[""]
+	di := dn.ToDataNodeInfo(VolumeFilter{}).DiskInfos[""]
 	if len(di.MaxVolumeCountByDisk) != 3 {
 		t.Fatalf("want 3 physical disks (incl the zero-capacity one), got %d", len(di.MaxVolumeCountByDisk))
 	}
@@ -81,7 +81,7 @@ func TestToDataNodeInfoFallsBackWhenNoCapacityReported(t *testing.T) {
 		{DiskId: 1},
 	})
 
-	di := dn.ToDataNodeInfo().DiskInfos[""]
+	di := dn.ToDataNodeInfo(VolumeFilter{}).DiskInfos[""]
 	if len(di.MaxVolumeCountByDisk) != 0 {
 		t.Fatalf("want no per-disk max (fallback), got %d", len(di.MaxVolumeCountByDisk))
 	}
diff --git a/weed/topology/data_node_phantom_disk_type_test.go b/weed/topology/data_node_phantom_disk_type_test.go
new file mode 100644
index 0000000000..ed82e1d9b7
--- /dev/null
+++ b/weed/topology/data_node_phantom_disk_type_test.go
@@ -0,0 +1,76 @@
+package topology
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/sequence"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// Asking whether a node has room for a disk type it does not have must not
+// make the node report that disk type. Volume growth walks every data center,
+// rack and data node with AvailableSpaceFor; before the fix that walk left an
+// empty DiskInfo (MaxVolumeCount 0) of the asked type on every node, so an
+// HDD-only server advertised an "ssd" disk and an SSD-only one an "hdd" disk.
+// Planners that read DiskInfos then took such a node for the emptiest
+// destination of that type.
+func TestCapacityQueriesDoNotCreateDiskTypes(t *testing.T) {
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dc := topo.GetOrCreateDataCenter("dc1")
+	rack := dc.GetOrCreateRack("rack1")
+	hddNode := rack.GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", map[string]uint32{"": 10})
+	hddNode.AdjustMaxVolumeCounts(map[string]uint32{"": 10})
+	ssdNode := rack.GetOrCreateDataNode("127.0.0.2", 34534, 0, "127.0.0.2", "", map[string]uint32{"ssd": 4})
+	ssdNode.AdjustMaxVolumeCounts(map[string]uint32{"ssd": 4})
+
+	hdd := &VolumeGrowOption{DiskType: types.HardDriveType}
+	ssd := &VolumeGrowOption{DiskType: types.SsdType}
+	nvme := &VolumeGrowOption{DiskType: types.ToDiskType("nvme")}
+
+	// What growing a volume of each type does: reserve a slot by walking the
+	// tree, plus the assign path's capacity checks on the topology root.
+	for _, option := range []*VolumeGrowOption{hdd, ssd, nvme} {
+		_, _ = topo.ReserveOneVolume(0, option)
+		_ = topo.AvailableSpaceFor(option)
+		_ = topo.CapacityFor(option)
+		for _, dn := range []*DataNode{hddNode, ssdNode} {
+			_ = dn.AvailableSpaceForReservation(option)
+			_ = dn.CapacityFor(option)
+		}
+	}
+
+	if got := hddNode.AvailableSpaceFor(ssd); got != 0 {
+		t.Errorf("hdd node AvailableSpaceFor(ssd) = %d, want 0", got)
+	}
+	if got := topo.CapacityFor(nvme); got != 0 {
+		t.Errorf("topology CapacityFor(nvme) = %d, want 0: no server has that disk type", got)
+	}
+	if got := topo.AvailableSpaceFor(hdd); got != 10 {
+		t.Errorf("topology AvailableSpaceFor(hdd) = %d, want 10", got)
+	}
+	if got := topo.AvailableSpaceFor(ssd); got != 4 {
+		t.Errorf("topology AvailableSpaceFor(ssd) = %d, want 4", got)
+	}
+
+	check := func(name string, dn *DataNode, want string) {
+		t.Helper()
+		info := dn.ToDataNodeInfo(VolumeFilter{})
+		if len(info.DiskInfos) != 1 {
+			keys := make([]string, 0, len(info.DiskInfos))
+			for k := range info.DiskInfos {
+				keys = append(keys, "\""+k+"\"")
+			}
+			t.Errorf("%s reports disk types %v, want only %q", name, keys, want)
+		}
+		if di := info.DiskInfos[want]; di == nil || di.MaxVolumeCount == 0 {
+			t.Errorf("%s lost its real %q disk: %+v", name, want, di)
+		}
+	}
+	check("hdd node", hddNode, "")
+	check("ssd node", ssdNode, "ssd")
+
+	// A usage entry created by a pre-fix capacity walk has no disk child: the
+	// node stops advertising it without waiting for a restart.
+	hddNode.diskUsages.getOrCreateDisk(types.SsdType)
+	check("hdd node", hddNode, "")
+}
diff --git a/weed/topology/disk.go b/weed/topology/disk.go
index 5dd250fc05..483c2f3679 100644
--- a/weed/topology/disk.go
+++ b/weed/topology/disk.go
@@ -19,7 +19,7 @@ import (
 
 type Disk struct {
 	NodeImpl
-	volumes map[needle.VolumeId]storage.VolumeInfo
+	volumes map[needle.VolumeId]*storage.VolumeInfo
 	// ecShards is nested so the same volume can retain separate entries per
 	// physical disk id. A single topology Disk represents one DiskType on a
 	// DataNode and may front multiple physical disks of that type, so EC
@@ -50,18 +50,12 @@ type Disk struct {
 // from lingering forever.
 const volumeRemovalGracePeriod = 10 * time.Second
 
-// ecShardSlots returns the number of volume slots consumed by the given
-// number of EC shards, rounded up to whole-volume equivalents.
-func ecShardSlots(ecShardCount int64) int64 {
-	return (ecShardCount + erasure_coding.DataShardsCount - 1) / erasure_coding.DataShardsCount
-}
-
 func NewDisk(diskType string) *Disk {
 	s := &Disk{}
 	s.id = NodeId(diskType)
 	s.nodeType = "Disk"
 	s.diskUsages = newDiskUsages()
-	s.volumes = make(map[needle.VolumeId]storage.VolumeInfo, 2)
+	s.volumes = make(map[needle.VolumeId]*storage.VolumeInfo, 2)
 	s.volumeAddedAt = make(map[needle.VolumeId]time.Time, 2)
 	s.ecShards = make(map[needle.VolumeId]map[types.DiskId]*erasure_coding.EcVolumeInfo, 2)
 	s.NodeImpl.value = s
@@ -98,16 +92,19 @@ func (d *DiskUsages) negative() *DiskUsages {
 }
 
 func (d *DiskUsages) ToDiskInfo() map[string]*master_pb.DiskInfo {
+	d.RLock()
+	defer d.RUnlock()
 	ret := make(map[string]*master_pb.DiskInfo)
 	for diskType, diskUsageCounts := range d.usages {
+		usage := diskUsageCounts.snapshot()
 		m := &master_pb.DiskInfo{
-			VolumeCount:       diskUsageCounts.volumeCount,
-			MaxVolumeCount:    diskUsageCounts.maxVolumeCount,
-			FreeVolumeCount:   diskUsageCounts.maxVolumeCount - (diskUsageCounts.volumeCount - diskUsageCounts.remoteVolumeCount) - ecShardSlots(diskUsageCounts.ecShardCount),
-			ActiveVolumeCount: diskUsageCounts.activeVolumeCount,
-			RemoteVolumeCount: diskUsageCounts.remoteVolumeCount,
-			DiskTotalBytes:    uint64(max(0, diskUsageCounts.diskTotalBytes)),
-			DiskFreeBytes:     uint64(max(0, diskUsageCounts.diskFreeBytes)),
+			VolumeCount:       usage.volumeCount,
+			MaxVolumeCount:    usage.maxVolumeCount,
+			FreeVolumeCount:   usage.maxVolumeCount - (usage.volumeCount - usage.remoteVolumeCount) - erasure_coding.VolumeSlots(usage.ecShardCount),
+			ActiveVolumeCount: usage.activeVolumeCount,
+			RemoteVolumeCount: usage.remoteVolumeCount,
+			DiskTotalBytes:    uint64(max(0, usage.diskTotalBytes)),
+			DiskFreeBytes:     uint64(max(0, usage.diskFreeBytes)),
 		}
 		ret[string(diskType)] = m
 	}
@@ -132,6 +129,26 @@ func (d *DiskUsages) GetMaxVolumeCount() (maxVolumeCount int64) {
 	return
 }
 
+// FreeBytes sums the space one volume server reports as still free on its
+// filesystems. reported is false as soon as a disk holding volume slots says
+// nothing -- a volume server older than the field looks that way -- since
+// leaving its space out would understate the room the server has.
+func (d *DiskUsages) FreeBytes() (freeBytes uint64, reported bool) {
+	d.RLock()
+	defer d.RUnlock()
+	for _, diskUsageCounts := range d.usages {
+		usage := diskUsageCounts.snapshot()
+		if usage.diskTotalBytes <= 0 {
+			if usage.maxVolumeCount > 0 {
+				return 0, false
+			}
+			continue
+		}
+		freeBytes += uint64(max(0, usage.diskFreeBytes))
+	}
+	return freeBytes, true
+}
+
 type DiskUsageCounts struct {
 	volumeCount       int64
 	remoteVolumeCount int64
@@ -154,8 +171,24 @@ func (a *DiskUsageCounts) addDiskUsageCounts(b *DiskUsageCounts) {
 	atomic.AddInt64(&a.diskFreeBytes, b.diskFreeBytes)
 }
 
+// snapshot reads each counter atomically, so a reader sees whole values rather
+// than ones a concurrent heartbeat is halfway through writing. They are still
+// read one at a time, so they need not all describe the same instant.
+func (a *DiskUsageCounts) snapshot() DiskUsageCounts {
+	return DiskUsageCounts{
+		volumeCount:       atomic.LoadInt64(&a.volumeCount),
+		remoteVolumeCount: atomic.LoadInt64(&a.remoteVolumeCount),
+		activeVolumeCount: atomic.LoadInt64(&a.activeVolumeCount),
+		ecShardCount:      atomic.LoadInt64(&a.ecShardCount),
+		maxVolumeCount:    atomic.LoadInt64(&a.maxVolumeCount),
+		diskTotalBytes:    atomic.LoadInt64(&a.diskTotalBytes),
+		diskFreeBytes:     atomic.LoadInt64(&a.diskFreeBytes),
+	}
+}
+
 func (a *DiskUsageCounts) FreeSpace() int64 {
-	return a.maxVolumeCount + a.remoteVolumeCount - a.volumeCount - ecShardSlots(a.ecShardCount)
+	u := a.snapshot()
+	return u.maxVolumeCount + u.remoteVolumeCount - u.volumeCount - erasure_coding.VolumeSlots(u.ecShardCount)
 }
 
 func (du *DiskUsages) getOrCreateDisk(diskType types.DiskType) *DiskUsageCounts {
@@ -170,13 +203,22 @@ func (du *DiskUsages) getOrCreateDisk(diskType types.DiskType) *DiskUsageCounts
 	return t
 }
 
+// getDisk returns the counters for diskType, or nil when none were ever
+// recorded. Read paths use it instead of getOrCreateDisk so a capacity
+// question cannot create an entry that ToDiskInfo would publish as a disk.
+func (du *DiskUsages) getDisk(diskType types.DiskType) *DiskUsageCounts {
+	du.RLock()
+	defer du.RUnlock()
+	return du.usages[diskType]
+}
+
 func (d *Disk) String() string {
 	d.RLock()
 	defer d.RUnlock()
 	return fmt.Sprintf("Disk:%s, volumes:%v, ecShards:%v", d.NodeImpl.String(), d.volumes, d.ecShards)
 }
 
-func (d *Disk) AddOrUpdateVolume(v storage.VolumeInfo) (isNew, isChanged bool) {
+func (d *Disk) AddOrUpdateVolume(v storage.VolumeInfo) (isNew, isChanged, tierTransition bool) {
 	d.Lock()
 	defer d.Unlock()
 	return d.doAddOrUpdateVolume(v, true)
@@ -185,16 +227,52 @@ func (d *Disk) AddOrUpdateVolume(v storage.VolumeInfo) (isNew, isChanged bool) {
 // AddProvisionalVolume records a volume the master registered on its own --
 // volume growth -- before any server report has named it. Until one does, the
 // volume is protected from removal by a report that raced its creation.
-func (d *Disk) AddProvisionalVolume(v storage.VolumeInfo) (isNew, isChanged bool) {
+func (d *Disk) AddProvisionalVolume(v storage.VolumeInfo) (isNew, isChanged, tierTransition bool) {
 	d.Lock()
 	defer d.Unlock()
 	return d.doAddOrUpdateVolume(v, false)
 }
 
-func (d *Disk) doAddOrUpdateVolume(v storage.VolumeInfo, fromReport bool) (isNew, isChanged bool) {
+// SetVolumeReadOnly records the read-only flag the server reported for vid,
+// keeping the report digest and the active volume count in step, and reports
+// whether the disk holds vid. It is not a volume report: a provisional volume
+// stays protected from a stale report until one names it.
+func (d *Disk) SetVolumeReadOnly(vid needle.VolumeId, readOnly bool) (found bool) {
+	d.Lock()
+	defer d.Unlock()
+	v, found := d.volumes[vid]
+	if !found || v.ReadOnly == readOnly {
+		return found
+	}
+	d.volumeDigest ^= v.ReportHash()
+	v.ReadOnly = readOnly
+	d.volumeDigest ^= v.ReportHash()
+	delta := &DiskUsageCounts{activeVolumeCount: 1}
+	if readOnly {
+		delta.activeVolumeCount = -1
+	}
+	d.UpAdjustDiskUsageDelta(types.ToDiskType(v.DiskType), delta)
+	return true
+}
+
+// doAddOrUpdateVolume returns three signals about how v was installed against
+// any existing record:
+//
+//   - isNew: no record was held before; the volume arrived.
+//   - isChanged: the ReadOnly flag flipped (the only field isChanged currently
+//     tracks). Other fields changing without ReadOnly flipping leaves this
+//     false.
+//   - tierTransition: v's IsRemote() classification differs from the previous
+//     record. The volume was already known and remains servable, but every
+//     connected client needs to refresh its replica priority -- a remote-tier
+//     replica restored locally must jump the read order, and one newly tiered
+//     to remote storage must give way. Callers that broadcast volume changes
+//     to clients must include tier-transitioned volumes alongside arrivals.
+func (d *Disk) doAddOrUpdateVolume(v storage.VolumeInfo, fromReport bool) (isNew, isChanged, tierTransition bool) {
 	deltaDiskUsage := &DiskUsageCounts{}
 	if oldV, ok := d.volumes[v.Id]; !ok {
-		d.volumes[v.Id] = v
+		stored := v
+		d.volumes[v.Id] = &stored
 		if !fromReport {
 			d.volumeAddedAt[v.Id] = time.Now()
 		}
@@ -211,7 +289,16 @@ func (d *Disk) doAddOrUpdateVolume(v storage.VolumeInfo, fromReport bool) (isNew
 		d.UpAdjustDiskUsageDelta(types.ToDiskType(v.DiskType), deltaDiskUsage)
 		isNew = true
 	} else {
-		if oldV.IsRemote() != v.IsRemote() {
+		if !fromReport && v.DiskId == 0 && oldV.DiskId != 0 {
+			// A provisional (grow-time) record carries no disk id -- the
+			// master cannot know which directory the server chose. Keep the
+			// one the server's report already named, before the digest below
+			// is computed, or the stored record would drift from what the
+			// server keeps reporting.
+			v.DiskId = oldV.DiskId
+		}
+		tierTransition = oldV.IsRemote() != v.IsRemote()
+		if tierTransition {
 			if v.IsRemote() {
 				deltaDiskUsage.remoteVolumeCount = 1
 			}
@@ -224,8 +311,8 @@ func (d *Disk) doAddOrUpdateVolume(v storage.VolumeInfo, fromReport bool) (isNew
 		if fromReport {
 			delete(d.volumeAddedAt, v.Id)
 		}
-		isChanged = d.volumes[v.Id].ReadOnly != v.ReadOnly
-		if isChanged {
+		isChanged = oldV.ReadOnly != v.ReadOnly || oldV.ReadOnlyCanDelete != v.ReadOnlyCanDelete
+		if oldV.ReadOnly != v.ReadOnly {
 			// Adjust active volume count when ReadOnly status changes
 			// Use a separate delta object to avoid affecting other metric adjustments
 			readOnlyDelta := &DiskUsageCounts{}
@@ -238,7 +325,9 @@ func (d *Disk) doAddOrUpdateVolume(v storage.VolumeInfo, fromReport bool) (isNew
 			}
 			d.UpAdjustDiskUsageDelta(types.ToDiskType(v.DiskType), readOnlyDelta)
 		}
-		d.volumes[v.Id] = v
+		// Written through the pointer the map already holds, and only after
+		// everything above has read the old value off it.
+		*oldV = v
 	}
 	return
 }
@@ -247,13 +336,35 @@ func (d *Disk) GetVolumes() []storage.VolumeInfo {
 	return d.AppendVolumes(make([]storage.VolumeInfo, 0, d.VolumeCount()))
 }
 
+// AppendVolumeIds appends the ids of the disk's volumes to all, and repeats
+// the remote-tier ones on remote. Callers that only need to name volumes use
+// this rather than AppendVolumes, which copies a whole record per volume to
+// be read for four bytes of it.
+func (d *Disk) AppendVolumeIds(all, remote, readOnly, readOnlyCanDelete []uint32) ([]uint32, []uint32, []uint32, []uint32) {
+	d.RLock()
+	defer d.RUnlock()
+	for id, v := range d.volumes {
+		all = append(all, uint32(id))
+		if v.IsRemote() {
+			remote = append(remote, uint32(id))
+		}
+		if v.ReadOnly {
+			readOnly = append(readOnly, uint32(id))
+			if v.ReadOnlyCanDelete {
+				readOnlyCanDelete = append(readOnlyCanDelete, uint32(id))
+			}
+		}
+	}
+	return all, remote, readOnly, readOnlyCanDelete
+}
+
 // AppendVolumes appends the disk's volumes to dst, so a caller gathering
 // several disks fills one slice instead of concatenating a copy per disk.
 func (d *Disk) AppendVolumes(dst []storage.VolumeInfo) []storage.VolumeInfo {
 	d.RLock()
 	defer d.RUnlock()
 	for _, v := range d.volumes {
-		dst = append(dst, v)
+		dst = append(dst, *v)
 	}
 	return dst
 }
@@ -286,7 +397,7 @@ func (d *Disk) RemoveVolumesNotIn(reported *reportedVolumes) (removed []storage.
 		if addedAt, unconfirmed := d.volumeAddedAt[vid]; unconfirmed && now.Sub(addedAt) < volumeRemovalGracePeriod {
 			continue
 		}
-		removed = append(removed, v)
+		removed = append(removed, *v)
 		delete(d.volumes, vid)
 		delete(d.volumeAddedAt, vid)
 		d.volumeDigest ^= v.ReportHash()
@@ -300,7 +411,7 @@ func (d *Disk) GetVolumesById(id needle.VolumeId) (storage.VolumeInfo, error) {
 	defer d.RUnlock()
 	vInfo, ok := d.volumes[id]
 	if ok {
-		return vInfo, nil
+		return *vInfo, nil
 	} else {
 		return storage.VolumeInfo{}, fmt.Errorf("volumeInfo not found")
 	}
@@ -368,36 +479,65 @@ func (d *Disk) FreeSpace() int64 {
 	return t.FreeSpace()
 }
 
-func (d *Disk) ToDiskInfo() *master_pb.DiskInfo {
-	diskUsage := d.diskUsages.getOrCreateDisk(types.ToDiskType(string(d.Id())))
+func (d *Disk) ToDiskInfo(filter VolumeFilter) *master_pb.DiskInfo {
+	diskUsage := d.diskUsages.getOrCreateDisk(types.ToDiskType(string(d.Id()))).snapshot()
 
-	// Get disk ID from first volume or EC shard
+	// Built under the read lock rather than from a copy as large as the
+	// messages it fed. Nothing here re-enters the topology, so the hold is safe.
+	d.RLock()
+	// Reserving room for every volume would keep what a filter set out not to
+	// build.
+	capacity := 0
+	if filter.SelectsEverything() {
+		capacity = len(d.volumes)
+	}
+	volumeInfos := make([]*master_pb.VolumeInformationMessage, 0, capacity)
 	var diskId uint32
-	volumes := d.GetVolumes()
+	var haveDiskId bool
+	for _, v := range d.volumes {
+		// Any volume names the disk, including one filtered out. The smallest
+		// rather than whichever the map yields first, so that two listings of
+		// an unchanged disk agree when it fronts several physical disks.
+		if !haveDiskId || v.DiskId < diskId {
+			diskId, haveDiskId = v.DiskId, true
+		}
+		if !filter.matches(v) {
+			continue
+		}
+		volumeInfos = append(volumeInfos, v.ToVolumeInformationMessage())
+	}
+	d.RUnlock()
+
 	ecShards := d.GetEcShards()
-	if len(volumes) > 0 {
-		diskId = volumes[0].DiskId
-	} else if len(ecShards) > 0 {
-		diskId = ecShards[0].DiskId
+	if !haveDiskId {
+		for _, ecv := range ecShards {
+			if !haveDiskId || ecv.DiskId < diskId {
+				diskId, haveDiskId = ecv.DiskId, true
+			}
+		}
 	}
 
 	m := &master_pb.DiskInfo{
 		Type:              string(d.Id()),
 		VolumeCount:       diskUsage.volumeCount,
 		MaxVolumeCount:    diskUsage.maxVolumeCount,
-		FreeVolumeCount:   diskUsage.maxVolumeCount - (diskUsage.volumeCount - diskUsage.remoteVolumeCount) - ecShardSlots(diskUsage.ecShardCount),
+		FreeVolumeCount:   diskUsage.maxVolumeCount - (diskUsage.volumeCount - diskUsage.remoteVolumeCount) - erasure_coding.VolumeSlots(diskUsage.ecShardCount),
 		ActiveVolumeCount: diskUsage.activeVolumeCount,
 		RemoteVolumeCount: diskUsage.remoteVolumeCount,
 		DiskId:            diskId,
 		DiskTotalBytes:    uint64(max(0, diskUsage.diskTotalBytes)),
 		DiskFreeBytes:     uint64(max(0, diskUsage.diskFreeBytes)),
 	}
-	m.VolumeInfos = make([]*master_pb.VolumeInformationMessage, 0, len(volumes))
-	for _, v := range volumes {
-		m.VolumeInfos = append(m.VolumeInfos, v.ToVolumeInformationMessage())
+	m.VolumeInfos = volumeInfos
+	ecCapacity := 0
+	if filter.SelectsEverything() {
+		ecCapacity = len(ecShards)
 	}
-	m.EcShardInfos = make([]*master_pb.VolumeEcShardInformationMessage, 0, len(ecShards))
+	m.EcShardInfos = make([]*master_pb.VolumeEcShardInformationMessage, 0, ecCapacity)
 	for _, ecv := range ecShards {
+		if !filter.matches(ecv) {
+			continue
+		}
 		m.EcShardInfos = append(m.EcShardInfos, ecv.ToVolumeEcShardInformationMessage())
 	}
 	return m
diff --git a/weed/topology/disk_info_test.go b/weed/topology/disk_info_test.go
new file mode 100644
index 0000000000..627807e4b5
--- /dev/null
+++ b/weed/topology/disk_info_test.go
@@ -0,0 +1,69 @@
+package topology
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+func TestDiskInfoReportsEveryVolume(t *testing.T) {
+	topo := NewTopology("diskinfo", nil, 32*1024*1024*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("10.0.0.1", 8080, 18080, "", "", map[string]uint32{"": 100})
+
+	volumes := []*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: "c", Size: 1000, FileCount: 10, Version: 3, DiskId: 2},
+		{Id: 2, Collection: "c", Size: 2000, FileCount: 20, Version: 3, DiskId: 2},
+		{Id: 3, Collection: "other", Size: 3000, FileCount: 30, Version: 3, DiskId: 2},
+	}
+	topo.SyncDataNodeRegistration(volumes, dn)
+	topo.SyncDataNodeEcShards([]*master_pb.VolumeEcShardInformationMessage{
+		{Id: 9, Collection: "c", EcIndexBits: 0x3fff, DiskId: 2},
+	}, dn)
+
+	var info *master_pb.DiskInfo
+	for _, c := range dn.Children() {
+		info = c.(*Disk).ToDiskInfo(VolumeFilter{})
+	}
+	if info == nil {
+		t.Fatal("the node reported no disk")
+	}
+	if len(info.VolumeInfos) != len(volumes) {
+		t.Fatalf("reported %d volumes, want %d", len(info.VolumeInfos), len(volumes))
+	}
+	if len(info.EcShardInfos) != 1 {
+		t.Fatalf("reported %d ec volumes, want 1", len(info.EcShardInfos))
+	}
+	if info.DiskId != 2 {
+		t.Errorf("reported disk id %d, want the one its volumes are on", info.DiskId)
+	}
+
+	bySize := map[uint32]uint64{}
+	for _, v := range info.VolumeInfos {
+		bySize[v.Id] = v.Size
+	}
+	for _, want := range volumes {
+		if got := bySize[want.Id]; got != want.Size {
+			t.Errorf("volume %d reported size %d, want %d", want.Id, got, want.Size)
+		}
+	}
+}
+
+func TestDiskInfoReportsTheDiskIdOfEcOnlyDisks(t *testing.T) {
+	topo := NewTopology("diskinfo", nil, 32*1024*1024*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("10.0.0.1", 8080, 18080, "", "", map[string]uint32{"": 100})
+	topo.SyncDataNodeEcShards([]*master_pb.VolumeEcShardInformationMessage{
+		{Id: 9, Collection: "c", EcIndexBits: 0x3fff, DiskId: 5},
+	}, dn)
+
+	for _, c := range dn.Children() {
+		info := c.(*Disk).ToDiskInfo(VolumeFilter{})
+		if len(info.VolumeInfos) != 0 {
+			t.Fatalf("expected no regular volumes, got %d", len(info.VolumeInfos))
+		}
+		if info.DiskId != 5 {
+			t.Errorf("reported disk id %d, want the one its shards are on", info.DiskId)
+		}
+	}
+}
diff --git a/weed/topology/disk_provisional_disk_id_test.go b/weed/topology/disk_provisional_disk_id_test.go
new file mode 100644
index 0000000000..e81b0b0409
--- /dev/null
+++ b/weed/topology/disk_provisional_disk_id_test.go
@@ -0,0 +1,68 @@
+package topology
+
+import (
+	"sync/atomic"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// A provisional (grow-time) registration carries no disk id; when it lands
+// after the server's own report -- the server pushes its report during the
+// AllocateVolume RPC, so either order happens -- it must not erase the disk id
+// the report recorded.
+func TestProvisionalUpdateKeepsReportedDiskId(t *testing.T) {
+	disk := NewDisk(types.HardDriveType.String())
+
+	disk.AddOrUpdateVolume(storage.VolumeInfo{Id: 1, DiskId: 2})
+	disk.AddProvisionalVolume(storage.VolumeInfo{Id: 1})
+
+	v, err := disk.GetVolumesById(1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v.DiskId != 2 {
+		t.Fatalf("DiskId = %d, want 2 (provisional update clobbered the reported value)", v.DiskId)
+	}
+
+	// A later server report naming a different disk still wins.
+	disk.AddOrUpdateVolume(storage.VolumeInfo{Id: 1, DiskId: 1})
+	if v, _ = disk.GetVolumesById(1); v.DiskId != 1 {
+		t.Fatalf("DiskId = %d, want 1 (a real report must override)", v.DiskId)
+	}
+}
+
+// A read-only mark from the server is not a volume report: it must not end the
+// grace period that keeps a just-grown volume safe from a full report collected
+// before the grow, while still keeping the digest and active count in step.
+func TestSetVolumeReadOnlyKeepsProvisionalProtection(t *testing.T) {
+	dn := NewDataNode("dn1")
+	vi := storage.VolumeInfo{Id: 1, DiskType: types.HardDriveType.String()}
+	dn.AddProvisionalVolume(vi)
+
+	dn.SetVolumeReadOnly(1, true)
+
+	readOnly := vi
+	readOnly.ReadOnly = true
+	if got, want := dn.VolumeDigest(), readOnly.ReportHash(); got != want {
+		t.Errorf("digest = %x, want %x, the hash of the volume as the server will report it", got, want)
+	}
+	if got := atomic.LoadInt64(&dn.GetDiskUsages().getOrCreateDisk(types.HardDriveType).activeVolumeCount); got != 0 {
+		t.Errorf("activeVolumeCount = %d, want 0 after the read-only mark", got)
+	}
+
+	// the stale report, collected before the grow, does not name the volume
+	if _, deleted, _ := dn.UpdateVolumes(nil); len(deleted) != 0 {
+		t.Fatalf("a report that raced the grow removed the volume: %v", deleted)
+	}
+	if v, err := dn.GetVolumesById(1); err != nil || !v.ReadOnly {
+		t.Fatalf("GetVolumesById = %+v, %v; want the volume kept, read-only", v, err)
+	}
+
+	// the server's own report confirms it, and from then on absence counts
+	dn.UpdateVolumes([]storage.VolumeInfo{readOnly})
+	if _, deleted, _ := dn.UpdateVolumes(nil); len(deleted) != 1 {
+		t.Fatalf("a report after confirmation should remove the volume, got %v", deleted)
+	}
+}
diff --git a/weed/topology/duplicate_volume_id_test.go b/weed/topology/duplicate_volume_id_test.go
new file mode 100644
index 0000000000..5fb315ea88
--- /dev/null
+++ b/weed/topology/duplicate_volume_id_test.go
@@ -0,0 +1,403 @@
+package topology
+
+import (
+	"errors"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+func isWritable(t *testing.T, topo *Topology, v storage.VolumeInfo) bool {
+	t.Helper()
+	vl := topo.FindVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, types.ToDiskType(v.DiskType))
+	for _, id := range vl.CloneWritableVolumes() {
+		if id == v.Id {
+			return true
+		}
+	}
+	return false
+}
+
+func TestDuplicateVolumeIdAcrossCollections(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	dn1 := NewDataNode("server1")
+	dn2 := NewDataNode("server2")
+
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v2})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.RegisterVolumeLayout(v2, dn2)
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	if isWritable(t, topo, v2) {
+		t.Fatal("duplicate newcomer should be quarantined out of the writable list")
+	}
+	if isWritable(t, topo, v1) {
+		t.Fatal("either copy could be the impostor; the earlier copy must be quarantined too")
+	}
+}
+
+func TestSameLayoutReplicaIsNotDuplicate(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("001")
+
+	dn1 := NewDataNode("server1")
+	dn1.Ip = "10.0.0.1"
+	dn1.Port = 8080
+	dn2 := NewDataNode("server2")
+	dn2.Ip = "10.0.0.2"
+	dn2.Port = 8080
+
+	v := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v})
+	topo.RegisterVolumeLayout(v, dn1)
+	topo.RegisterVolumeLayout(v, dn2)
+	topo.flagDuplicateVolumeId(v, dn2)
+
+	if !isWritable(t, topo, v) {
+		t.Fatal("a same-layout replica is a legitimate copy, not a duplicate")
+	}
+}
+
+func TestSameNodeVolumeMoveIsNotDuplicate(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	dn := NewDataNode("server1")
+
+	old := storage.VolumeInfo{Id: 7, Collection: "c", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	moved := storage.VolumeInfo{Id: 7, Collection: "c", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL, DiskType: "ssd"}
+	dn.UpdateVolumes([]storage.VolumeInfo{old})
+	topo.RegisterVolumeLayout(old, dn)
+
+	// the move registers the new layout before the old entry is removed
+	dn.UpdateVolumes([]storage.VolumeInfo{moved})
+	topo.RegisterVolumeLayout(moved, dn)
+	topo.flagDuplicateVolumeId(moved, dn)
+
+	if !isWritable(t, topo, moved) {
+		t.Fatal("a same-node disk move is not a duplicate")
+	}
+}
+
+func TestQuarantineReleasedWhenConflictResolves(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	dn1 := NewDataNode("server1")
+	dn2 := NewDataNode("server2")
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v2})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.RegisterVolumeLayout(v2, dn2)
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	topo.UnRegisterVolumeLayout(v2, dn2)
+
+	// Registration flags duplicates asynchronously, so a flag that was still
+	// in flight when the conflict resolved releases the surviving copy only
+	// once it settles. Wait for that release instead of reading once.
+	deadline := time.Now().Add(5 * time.Second)
+	for !isWritable(t, topo, v1) {
+		if time.Now().After(deadline) {
+			t.Fatal("the surviving copy must be released once the conflict is gone")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+func TestFailedReleasePushRestoresQuarantineMark(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	dn1 := NewDataNode("server1")
+	dn2 := NewDataNode("server2")
+
+	var pushFails atomic.Bool
+	topo.QuarantineVolumeFn = func(dn *DataNode, vid needle.VolumeId, readOnly bool) error {
+		if !readOnly && pushFails.Load() {
+			return errors.New("volume server unreachable")
+		}
+		return nil
+	}
+
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v2})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.RegisterVolumeLayout(v2, dn2)
+	// Registrations flag duplicates asynchronously; let them settle so no
+	// late mark can land after the release assertions below.
+	topo.duplicateFlagChecks.Wait()
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	// the conflict resolves while the surviving copy is unreachable: the
+	// writable push fails, so the record and the layout read-only mark must
+	// both come back instead of advertising a writable replica the server
+	// still holds read-only
+	pushFails.Store(true)
+	topo.UnRegisterVolumeLayout(v2, dn2)
+
+	if !topo.isQuarantined(dn1, v1.Id) {
+		t.Fatal("a failed writable push must keep the quarantine record for the retry")
+	}
+	if isWritable(t, topo, v1) {
+		t.Fatal("the layout must not advertise a replica the server still holds read-only")
+	}
+
+	pushFails.Store(false)
+	// An idle replica drops out of the delta reports once its stored flag
+	// matches the server's, so the release pass retries off the leader pulse
+	// rather than waiting for the volume to be reported again.
+	topo.retryPendingQuarantineReleases()
+	require.Eventually(t, func() bool {
+		return !topo.isQuarantined(dn1, v1.Id) && isWritable(t, topo, v1)
+	}, 5*time.Second, time.Millisecond, "the pending release must retry without another volume report")
+}
+
+func TestQuarantineKeptWhenReplicaUnreadable(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	dn1 := NewDataNode("server1")
+	dn2 := NewDataNode("server2")
+
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v2})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.RegisterVolumeLayout(v2, dn2)
+	topo.duplicateFlagChecks.Wait()
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	// the surviving copy drops out of its node's disk map while the lookup
+	// index still holds it; its layout key is then unknown, so the release
+	// pass must keep the mark rather than assume the conflict resolved
+	dn1.UpdateVolumes(nil)
+	topo.UnRegisterVolumeLayout(v2, dn2)
+
+	if !topo.isQuarantined(dn1, v1.Id) {
+		t.Fatal("an unreadable replica must not lose its quarantine record")
+	}
+	if isWritable(t, topo, v1) {
+		t.Fatal("a replica whose conflict cannot be ruled out must stay read-only")
+	}
+
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.duplicateFlagChecks.Wait()
+	if !isWritable(t, topo, v1) {
+		t.Fatal("once readable again and sole, the copy must be released to writable")
+	}
+}
+
+func TestStaleDuplicateReportDoesNotQuarantineSurvivor(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	dn1 := NewDataNode("server1")
+	dn2 := NewDataNode("server2")
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	topo.RegisterVolumeLayout(v1, dn1)
+
+	// dn2's copy is gone before its delayed duplicate check runs; the report
+	// still names dn2 but its layout no longer holds it.
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	if topo.isQuarantined(dn1, v1.Id) || topo.isQuarantined(dn2, v2.Id) {
+		t.Fatal("a report for a copy that is already gone must not quarantine anything")
+	}
+	if !isWritable(t, topo, v1) {
+		t.Fatal("the surviving copy must stay writable")
+	}
+}
+
+func TestQuarantineSurvivesResync(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	dn1 := NewDataNode("server1")
+	dn2 := NewDataNode("server2")
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v2})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.RegisterVolumeLayout(v2, dn2)
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	// a resync from the same server re-reports the volume as writable;
+	// the quarantine must keep it out of the writable list
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{{
+		Id: 7, Collection: "b", ReplicaPlacement: 0, Version: 3,
+	}}, dn2)
+
+	if isWritable(t, topo, v2) {
+		t.Fatal("resync must not clear the quarantine")
+	}
+}
+
+func TestQuarantineSurvivesReplicaRejoin(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("001")
+
+	dn1 := NewDataNode("server1")
+	dn1.Ip = "10.0.0.1"
+	dn1.Port = 8080
+	dn2 := NewDataNode("server2")
+	dn2.Ip = "10.0.0.2"
+	dn2.Port = 8080
+	dn3 := NewDataNode("server3")
+	dn3.Ip = "10.0.0.3"
+	dn3.Port = 8080
+
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn3.UpdateVolumes([]storage.VolumeInfo{v2})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.RegisterVolumeLayout(v1, dn2)
+	topo.RegisterVolumeLayout(v2, dn3)
+	topo.flagDuplicateVolumeId(v2, dn3)
+
+	// a replica dropped from the lookup index re-registers through the
+	// self-heal path; rebuilding location flags from reported state must
+	// not lift the quarantine on any copy
+	vl := topo.FindVolumeLayout(v1.Collection, v1.ReplicaPlacement, v1.Ttl, types.ToDiskType(v1.DiskType))
+	vl.SetVolumeUnavailable(dn1, v1.Id)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{{
+		Id: 7, Collection: "a", ReplicaPlacement: uint32(rp.Byte()), Version: 3,
+	}}, dn1)
+
+	if isWritable(t, topo, v1) {
+		t.Fatal("a re-registering replica must not clear the quarantine on the surviving copies")
+	}
+	if isWritable(t, topo, v2) {
+		t.Fatal("the conflicting copy must stay quarantined too")
+	}
+}
+
+func TestReplicationChangeIsNotDuplicate(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rpOld, _ := super_block.NewReplicaPlacementFromString("000")
+	rpNew, _ := super_block.NewReplicaPlacementFromString("001")
+
+	dn1 := NewDataNode("server1")
+	dn1.Ip = "10.0.0.1"
+	dn1.Port = 8080
+	dn2 := NewDataNode("server2")
+	dn2.Ip = "10.0.0.2"
+	dn2.Port = 8080
+
+	vOld := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rpOld, Ttl: needle.EMPTY_TTL}
+	vNew := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rpNew, Ttl: needle.EMPTY_TTL}
+
+	dn1.UpdateVolumes([]storage.VolumeInfo{vOld})
+	dn2.UpdateVolumes([]storage.VolumeInfo{vNew})
+	topo.RegisterVolumeLayout(vOld, dn1)
+	topo.RegisterVolumeLayout(vNew, dn2)
+	topo.flagDuplicateVolumeId(vNew, dn2)
+
+	if topo.isQuarantined(dn2, vNew.Id) || topo.isQuarantined(dn1, vOld.Id) {
+		t.Fatal("an rp-only layout difference is a replication change in flight, not a duplicate")
+	}
+}
+
+func TestDuplicateVolumeIdAcrossTtls(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	ttl, _ := needle.ReadTTL("3d")
+
+	dn1 := NewDataNode("server1")
+	dn1.Ip = "10.0.0.1"
+	dn1.Port = 8080
+	dn2 := NewDataNode("server2")
+	dn2.Ip = "10.0.0.2"
+	dn2.Port = 8080
+
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: ttl}
+
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v2})
+	topo.RegisterVolumeLayout(v1, dn1)
+	topo.RegisterVolumeLayout(v2, dn2)
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	if !topo.isQuarantined(dn2, v2.Id) || !topo.isQuarantined(dn1, v1.Id) {
+		t.Fatal("same collection with a different ttl is still a reused volume id")
+	}
+}
+
+func TestFailedWritablePushRetriedOnNextReport(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	var failWritable atomic.Bool
+	var writablePushes atomic.Int32
+	topo.QuarantineVolumeFn = func(dn *DataNode, vid needle.VolumeId, readOnly bool) error {
+		if !readOnly {
+			writablePushes.Add(1)
+			if failWritable.Load() {
+				return errors.New("volume server unreachable")
+			}
+		}
+		return nil
+	}
+
+	dn1 := NewDataNode("server1")
+	dn2 := NewDataNode("server2")
+	v1 := storage.VolumeInfo{Id: 7, Collection: "a", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	v2 := storage.VolumeInfo{Id: 7, Collection: "b", ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL}
+	dn1.UpdateVolumes([]storage.VolumeInfo{v1})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v2})
+	// Register on the layouts directly: RegisterVolumeLayout would spawn an
+	// async flagDuplicateVolumeId per call, and a delayed one can re-quarantine
+	// the survivor at any later point in this test.
+	topo.GetVolumeLayout(v1.Collection, v1.ReplicaPlacement, v1.Ttl, types.ToDiskType(v1.DiskType)).RegisterVolume(&v1, dn1, nil)
+	topo.GetVolumeLayout(v2.Collection, v2.ReplicaPlacement, v2.Ttl, types.ToDiskType(v2.DiskType)).RegisterVolume(&v2, dn2, nil)
+	topo.flagDuplicateVolumeId(v2, dn2)
+
+	// the conflict resolves while the survivor's writable push cannot land
+	failWritable.Store(true)
+	topo.UnRegisterVolumeLayout(v2, dn2)
+	require.Eventually(t, func() bool {
+		// The record reappears only after the failed writable push, and the
+		// restore arms it for retry in the same store - so this pair means the
+		// next report will take the retry branch rather than observing the
+		// release mid-flight.
+		return writablePushes.Load() >= 1 && topo.isQuarantined(dn1, v1.Id)
+	}, 5*time.Second, time.Millisecond, "a failed writable push must re-arm the record")
+
+	reported := v1
+	reported.ReadOnly = true
+	failWritable.Store(false)
+	topo.enforceQuarantine(dn1, reported)
+
+	require.Eventually(t, func() bool {
+		// The release clears the record and the layout mark before the remote
+		// push lands, so the count has to be part of the condition or the poll
+		// can pass before the retried push runs.
+		return !topo.isQuarantined(dn1, v1.Id) && isWritable(t, topo, v1) && writablePushes.Load() >= 2
+	}, 5*time.Second, time.Millisecond, "the next volume report must retry the release and its writable push")
+}
diff --git a/weed/topology/growth_freeze_test.go b/weed/topology/growth_freeze_test.go
new file mode 100644
index 0000000000..3b296b14df
--- /dev/null
+++ b/weed/topology/growth_freeze_test.go
@@ -0,0 +1,146 @@
+package topology
+
+import (
+	"testing"
+	"time"
+)
+
+func TestGrowthFreezeOnTopologyMismatch(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	topo.SetGrowthFreezeConfig(true, 0)
+	topo.SetTopologyId("cluster-a")
+
+	topo.CheckReportedTopologyId("cluster-a")
+	if topo.IsGrowthFrozen() {
+		t.Fatal("matching topology id should not freeze growth")
+	}
+
+	topo.CheckReportedTopologyId("")
+	topo.CheckReportedTopologyId("cluster-b")
+	if !topo.IsGrowthFrozen() {
+		t.Fatal("mismatching topology id should freeze growth")
+	}
+
+	if !topo.ResumeVolumeGrowth() {
+		t.Fatal("resume should report the frozen state")
+	}
+	if topo.IsGrowthFrozen() {
+		t.Fatal("growth should be unfrozen after resume")
+	}
+	if topo.ResumeVolumeGrowth() {
+		t.Fatal("second resume should report no frozen state")
+	}
+}
+
+func TestGrowthFreezeDisabled(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	topo.SetGrowthFreezeConfig(false, 0)
+	topo.SetTopologyId("cluster-a")
+
+	topo.CheckReportedTopologyId("cluster-b")
+	if topo.IsGrowthFrozen() {
+		t.Fatal("freeze_on_topology_mismatch=false should not freeze")
+	}
+}
+
+func TestGrowthFreezeAutoRecovery(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	topo.SetGrowthFreezeConfig(true, 50*time.Millisecond)
+	topo.SetTopologyId("cluster-a")
+
+	topo.CheckReportedTopologyId("cluster-b")
+	if !topo.IsGrowthFrozen() {
+		t.Fatal("mismatching topology id should freeze growth")
+	}
+	time.Sleep(60 * time.Millisecond)
+	if topo.IsGrowthFrozen() {
+		t.Fatal("growth should auto-resume past the recovery wait")
+	}
+}
+
+func TestCheckReportedTopologyIdBeforeTopologyIdKnown(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	topo.SetGrowthFreezeConfig(true, 0)
+
+	topo.CheckReportedTopologyId("cluster-b")
+	if topo.IsGrowthFrozen() {
+		t.Fatal("empty local topology id should not trigger the freeze")
+	}
+
+	topo.SetTopologyId("cluster-c")
+	topo.SetTopologyInitPending(false)
+	if !topo.IsGrowthFrozen() {
+		t.Fatal("a report stashed before the topology id was known should still freeze growth")
+	}
+}
+
+func TestReportedTopologyIdStashDoesNotFreezeOnMatch(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	topo.SetGrowthFreezeConfig(true, 0)
+
+	topo.CheckReportedTopologyId("cluster-a")
+	topo.SetTopologyId("cluster-a")
+	topo.SetTopologyInitPending(false)
+	if topo.IsGrowthFrozen() {
+		t.Fatal("a stashed report matching the minted id should not freeze growth")
+	}
+}
+
+func TestGrowthFreezeSurvivesMirrorRestore(t *testing.T) {
+	dir := t.TempDir()
+	file := dir + "/max_volume_id"
+
+	frozen := NewTopology("topo", nil, 128, 3, false)
+	frozen.SetGrowthFreezeConfig(true, 0)
+	frozen.SetMaxVolumeIdFile(file)
+	frozen.SetTopologyId("cluster-a")
+	frozen.CheckReportedTopologyId("cluster-b")
+	if !frozen.IsGrowthFrozen() {
+		t.Fatal("expected frozen growth")
+	}
+	if err := frozen.PersistMaxVolumeId(42); err != nil {
+		t.Fatalf("persist: %v", err)
+	}
+
+	restarted := NewTopology("topo", nil, 128, 3, false)
+	restarted.SetGrowthFreezeConfig(true, 0)
+	restarted.SetMaxVolumeIdFile(file)
+	if !restarted.IsGrowthFrozen() {
+		t.Fatal("freeze flag should survive a mirror restore")
+	}
+	if !restarted.ResumeVolumeGrowth() {
+		t.Fatal("restored freeze should be resumable")
+	}
+}
+
+func TestGrowthFreezeCommandApply(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+	topo.SetGrowthFreezeConfig(true, 0)
+
+	frozen := true
+	topo.SetGrowthFrozen(frozen)
+	if !topo.IsGrowthFrozen() {
+		t.Fatal("replicated freeze should set the flag")
+	}
+	unfrozen := false
+	topo.SetGrowthFrozen(unfrozen)
+	if topo.IsGrowthFrozen() {
+		t.Fatal("replicated unfreeze should clear the flag")
+	}
+}
+
+func TestAllocationDelay(t *testing.T) {
+	topo := NewTopology("topo", nil, 128, 3, false)
+
+	if wait := topo.allocationDelay(); wait > 0 {
+		t.Fatalf("unexpected deferral: %v", wait)
+	}
+	topo.DeferAllocation(50 * time.Millisecond)
+	if wait := topo.allocationDelay(); wait <= 0 {
+		t.Fatal("expected a positive deferral after DeferAllocation")
+	}
+	topo.DeferAllocation(-time.Second)
+	if wait := topo.allocationDelay(); wait > 0 {
+		t.Fatalf("expired deferral should not delay: %v", wait)
+	}
+}
diff --git a/weed/topology/maintenance_mode_test.go b/weed/topology/maintenance_mode_test.go
new file mode 100644
index 0000000000..596ece558f
--- /dev/null
+++ b/weed/topology/maintenance_mode_test.go
@@ -0,0 +1,331 @@
+package topology
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/sequence"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// addMaintenanceTestNode links a data node with maxVol free slots under rack.
+func addMaintenanceTestNode(rack *Rack, id string, maxVol int64) *DataNode {
+	dn := NewDataNode(id)
+	dn.Ip = id
+	rack.LinkChildNode(dn)
+	dn.getOrCreateDisk("").UpAdjustDiskUsageDelta("", &DiskUsageCounts{maxVolumeCount: maxVol})
+	return dn
+}
+
+func newMaintenanceTestTopology() (*Topology, *DataCenter) {
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dc := NewDataCenter("dc1")
+	topo.LinkChildNode(dc)
+	return topo, dc
+}
+
+func TestMaintenanceModeReportsNoFreeSlots(t *testing.T) {
+	rack := NewRack("rack1")
+	dn := addMaintenanceTestNode(rack, "server1", 10)
+	option := &VolumeGrowOption{DiskType: types.HardDriveType}
+
+	if got := dn.AvailableSpaceFor(option); got != 10 {
+		t.Fatalf("AvailableSpaceFor = %d, want 10", got)
+	}
+	if !dn.SetMaintenanceMode(true) {
+		t.Fatal("first switch should report a change")
+	}
+	if dn.SetMaintenanceMode(true) {
+		t.Fatal("repeating the same value should not report a change")
+	}
+	if !dn.InMaintenanceMode() {
+		t.Fatal("InMaintenanceMode = false after switching on")
+	}
+	if got := dn.AvailableSpaceFor(option); got != 0 {
+		t.Errorf("AvailableSpaceFor in maintenance = %d, want 0: no new volumes go to a server in maintenance", got)
+	}
+	if got := dn.AvailableSpaceForReservation(option); got != 0 {
+		t.Errorf("AvailableSpaceForReservation in maintenance = %d, want 0", got)
+	}
+	if _, ok := dn.TryReserveCapacity(types.HardDriveType, 1); ok {
+		t.Error("reserved capacity on a server in maintenance")
+	}
+	if got := rack.AvailableSpaceFor(option); got != 10 {
+		t.Errorf("rack AvailableSpaceFor = %d, want 10: the node's capacity still rolls up to its parents", got)
+	}
+
+	if !dn.SetMaintenanceMode(false) {
+		t.Fatal("switching off should report a change")
+	}
+	if got := dn.AvailableSpaceFor(option); got != 10 {
+		t.Errorf("AvailableSpaceFor after maintenance = %d, want 10", got)
+	}
+}
+
+// A server in maintenance mode is the one being evacuated, so volume growth in
+// its rack must land every replica on its siblings even when it has the most
+// free slots by far.
+func TestVolumeGrowthSkipsMaintenanceNodeInSameRack(t *testing.T) {
+	topo, dc := newMaintenanceTestTopology()
+	rack := NewRack("rack1")
+	dc.LinkChildNode(rack)
+	busy := addMaintenanceTestNode(rack, "busy", 1000)
+	busy.SetMaintenanceMode(true)
+	addMaintenanceTestNode(rack, "small1", 2)
+	addMaintenanceTestNode(rack, "small2", 2)
+
+	vg := NewDefaultVolumeGrowth()
+	rp, _ := super_block.NewReplicaPlacementFromString("001")
+	option := &VolumeGrowOption{ReplicaPlacement: rp, DiskType: types.HardDriveType}
+	for i := 0; i < 50; i++ {
+		servers, _, err := vg.findEmptySlotsForOneVolume(topo, option, false)
+		if err != nil {
+			t.Fatalf("iteration %d: %v", i, err)
+		}
+		if len(servers) != 2 {
+			t.Fatalf("iteration %d: got %d servers, want 2", i, len(servers))
+		}
+		for _, s := range servers {
+			if s.Id() == busy.Id() {
+				t.Fatalf("iteration %d: picked the server in maintenance mode", i)
+			}
+		}
+	}
+
+	// Pinning the request to the maintenance node must fail rather than
+	// create a volume there.
+	rp0, _ := super_block.NewReplicaPlacementFromString("000")
+	pinned := &VolumeGrowOption{ReplicaPlacement: rp0, DiskType: types.HardDriveType, DataNode: "busy"}
+	if _, _, err := vg.findEmptySlotsForOneVolume(topo, pinned, false); err == nil {
+		t.Fatal("a volume pinned to a server in maintenance mode must not be created")
+	}
+}
+
+// The replica on another rack is chosen by walking a random offset through the
+// rack's rolled-up free slots, which still count a node in maintenance. The walk
+// has to land on an eligible sibling every time, not fall off the end.
+func TestVolumeGrowthSkipsMaintenanceNodeInOtherRack(t *testing.T) {
+	topo, dc := newMaintenanceTestTopology()
+	rack1 := NewRack("rack1")
+	dc.LinkChildNode(rack1)
+	addMaintenanceTestNode(rack1, "r1n1", 100)
+	rack2 := NewRack("rack2")
+	dc.LinkChildNode(rack2)
+	busy := addMaintenanceTestNode(rack2, "r2busy", 1000)
+	busy.SetMaintenanceMode(true)
+	ok := addMaintenanceTestNode(rack2, "r2ok", 1)
+
+	vg := NewDefaultVolumeGrowth()
+	rp, _ := super_block.NewReplicaPlacementFromString("010")
+	option := &VolumeGrowOption{ReplicaPlacement: rp, DiskType: types.HardDriveType}
+	for i := 0; i < 50; i++ {
+		servers, _, err := vg.findEmptySlotsForOneVolume(topo, option, false)
+		if err != nil {
+			t.Fatalf("iteration %d: %v", i, err)
+		}
+		if len(servers) != 2 {
+			t.Fatalf("iteration %d: got %d servers, want 2", i, len(servers))
+		}
+		onSibling := 0
+		for _, s := range servers {
+			if s.Id() == busy.Id() {
+				t.Fatalf("iteration %d: picked the server in maintenance mode", i)
+			}
+			if s.Id() == ok.Id() {
+				onSibling++
+			}
+		}
+		if onSibling != 1 {
+			t.Fatalf("iteration %d: the other-rack replica must land on the eligible sibling, got %v", i, servers)
+		}
+	}
+}
+
+// A replica on a server in maintenance mode takes no writes, so its volume
+// leaves the writable list while the mode is on and returns once it is off.
+func TestMaintenanceModeTogglesVolumeWritability(t *testing.T) {
+	topo, dc := newMaintenanceTestTopology()
+	rack := NewRack("rack1")
+	dc.LinkChildNode(rack)
+	dn1 := addMaintenanceTestNode(rack, "dn1", 10)
+	dn2 := addMaintenanceTestNode(rack, "dn2", 10)
+
+	rp, _ := super_block.NewReplicaPlacementFromString("001")
+	shared := storage.VolumeInfo{Id: 1, Size: 100, ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL, Version: needle.GetCurrentVersion()}
+	dn1.AddOrUpdateVolume(shared)
+	dn2.AddOrUpdateVolume(shared)
+	topo.RegisterVolumeLayout(shared, dn1)
+	topo.RegisterVolumeLayout(shared, dn2)
+
+	rp0, _ := super_block.NewReplicaPlacementFromString("000")
+	alone := storage.VolumeInfo{Id: 2, Size: 100, ReplicaPlacement: rp0, Ttl: needle.EMPTY_TTL, Version: needle.GetCurrentVersion()}
+	dn2.AddOrUpdateVolume(alone)
+	topo.RegisterVolumeLayout(alone, dn2)
+
+	vlShared := topo.GetVolumeLayout("", rp, needle.EMPTY_TTL, types.HardDriveType)
+	vlAlone := topo.GetVolumeLayout("", rp0, needle.EMPTY_TTL, types.HardDriveType)
+	expectWritables := func(step string, vl *VolumeLayout, want ...needle.VolumeId) {
+		t.Helper()
+		got := vl.CloneWritableVolumes()
+		slices.Sort(got)
+		if !slices.Equal(got, want) {
+			t.Errorf("%s: writables = %v, want %v", step, got, want)
+		}
+	}
+	expectWritables("initial shared", vlShared, 1)
+	expectWritables("initial alone", vlAlone, 2)
+
+	if !topo.SetDataNodeMaintenanceMode(dn1, true) {
+		t.Fatal("switching dn1 on should report a change")
+	}
+	expectWritables("dn1 in maintenance: a volume with a replica there takes no writes", vlShared)
+	expectWritables("dn1 in maintenance: volumes elsewhere are unaffected", vlAlone, 2)
+	if locations := vlShared.Lookup(1); len(locations) != 2 {
+		t.Errorf("reads must still see every replica, got %v", locations)
+	}
+
+	if topo.SetDataNodeMaintenanceMode(dn1, true) {
+		t.Error("repeating the same state should not report a change")
+	}
+
+	if !topo.SetDataNodeMaintenanceMode(dn1, false) {
+		t.Fatal("switching dn1 off should report a change")
+	}
+	expectWritables("dn1 back: the volume is writable again", vlShared, 1)
+
+	topo.SetDataNodeMaintenanceMode(dn2, true)
+	expectWritables("dn2 in maintenance: shared", vlShared)
+	expectWritables("dn2 in maintenance: alone", vlAlone)
+}
+
+// A vacuum commit or a mark-writable that lands after the server entered
+// maintenance mode must not put the volume back on the writable list. Both
+// used to check only the replica count, and since heartbeats carry only changed
+// volumes, nothing would have taken it off again.
+func TestMaintenanceModeHoldsThroughVacuumAndMarkWritable(t *testing.T) {
+	topo, dc := newMaintenanceTestTopology()
+	rack := NewRack("rack1")
+	dc.LinkChildNode(rack)
+	dn1 := addMaintenanceTestNode(rack, "dn1", 10)
+	dn2 := addMaintenanceTestNode(rack, "dn2", 10)
+
+	rp, _ := super_block.NewReplicaPlacementFromString("001")
+	vi := storage.VolumeInfo{Id: 1, Size: 100, ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL, Version: needle.GetCurrentVersion()}
+	dn1.AddOrUpdateVolume(vi)
+	dn2.AddOrUpdateVolume(vi)
+	topo.RegisterVolumeLayout(vi, dn1)
+	topo.RegisterVolumeLayout(vi, dn2)
+	vl := topo.GetVolumeLayout("", rp, needle.EMPTY_TTL, types.HardDriveType)
+	expectWritableCount := func(step string, want int) {
+		t.Helper()
+		if got, _ := vl.GetWritableVolumeCount(); got != want {
+			t.Errorf("%s: writable count = %d, want %d", step, got, want)
+		}
+	}
+
+	// vacuum: taken off the writable list before compaction, dn1 enters
+	// maintenance meanwhile, then every replica commits
+	vl.DrainAndRemoveFromWritable(1)
+	topo.SetDataNodeMaintenanceMode(dn1, true)
+	for _, dn := range []*DataNode{dn1, dn2} {
+		if vl.SetVolumeAvailable(dn, 1, false, false, false) {
+			t.Errorf("vacuum commit on %s made the volume writable with a replica in maintenance", dn.Id())
+		}
+	}
+	expectWritableCount("after vacuum commit", 0)
+	topo.SetDataNodeMaintenanceMode(dn1, false)
+	expectWritableCount("after maintenance", 1)
+
+	// mark-writable from a vacuum worker, after dn1 entered maintenance
+	vl.SetVolumeReadOnly(dn2, 1)
+	topo.SetDataNodeMaintenanceMode(dn1, true)
+	if vl.SetVolumeWritable(dn2, 1) {
+		t.Error("mark-writable made the volume writable with a replica in maintenance")
+	}
+	expectWritableCount("after mark-writable", 0)
+	topo.SetDataNodeMaintenanceMode(dn1, false)
+	expectWritableCount("after maintenance", 1)
+}
+
+// A volume server notifies the master the moment it flips a volume between
+// read-only and writable, ahead of the heartbeat that repeats the flag. The
+// master must act on the notification, not on its heartbeat copy: mark-writable
+// takes effect at once, and a maintenance toggle landing between a mark-readonly
+// and its heartbeat must not put the volume back.
+func TestMarkReadOnlyAndWritableAheadOfHeartbeat(t *testing.T) {
+	topo, dc := newMaintenanceTestTopology()
+	rack := NewRack("rack1")
+	dc.LinkChildNode(rack)
+	dn1 := addMaintenanceTestNode(rack, "dn1", 10)
+	dn2 := addMaintenanceTestNode(rack, "dn2", 10)
+
+	rp, _ := super_block.NewReplicaPlacementFromString("001")
+	vi := storage.VolumeInfo{Id: 1, Size: 100, ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL, Version: needle.GetCurrentVersion()}
+	dn1.AddOrUpdateVolume(vi)
+	dn2.AddOrUpdateVolume(vi)
+	topo.RegisterVolumeLayout(vi, dn1)
+	topo.RegisterVolumeLayout(vi, dn2)
+	vl := topo.GetVolumeLayout("", rp, needle.EMPTY_TTL, types.HardDriveType)
+	expectWritableCount := func(step string, want int) {
+		t.Helper()
+		if got, _ := vl.GetWritableVolumeCount(); got != want {
+			t.Errorf("%s: writable count = %d, want %d", step, got, want)
+		}
+	}
+
+	// the heartbeat has reported dn2's replica read-only
+	readOnly := vi
+	readOnly.ReadOnly = true
+	dn2.AddOrUpdateVolume(readOnly)
+	vl.EnsureCorrectWritables(&readOnly)
+	expectWritableCount("heartbeat says read-only", 0)
+
+	// dn2 marks it writable and notifies, before the next heartbeat
+	if !vl.SetVolumeWritable(dn2, 1) {
+		t.Error("mark-writable from the replica's own server should take effect at once")
+	}
+	expectWritableCount("after mark-writable", 1)
+	if v, err := dn2.GetVolumesById(1); err != nil || v.ReadOnly {
+		t.Errorf("the node's record should say writable, got %+v, %v", v, err)
+	}
+
+	// dn2 marks it read-only and notifies; dn1 leaves maintenance before the
+	// heartbeat repeats the flag
+	vl.SetVolumeReadOnly(dn2, 1)
+	expectWritableCount("after mark-readonly", 0)
+	topo.SetDataNodeMaintenanceMode(dn1, true)
+	topo.SetDataNodeMaintenanceMode(dn1, false)
+	expectWritableCount("re-evaluated before the heartbeat", 0)
+}
+
+// SetDataNodeMaintenanceMode walks a snapshot of the node's volumes, so a
+// concurrent disconnect can have removed one from its layout by the time it is
+// re-evaluated. That must be a no-op, not a crash or a resurrected entry.
+func TestMaintenanceModeAfterVolumeLeftLayout(t *testing.T) {
+	topo, dc := newMaintenanceTestTopology()
+	rack := NewRack("rack1")
+	dc.LinkChildNode(rack)
+	dn := addMaintenanceTestNode(rack, "dn1", 10)
+
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	vi := storage.VolumeInfo{Id: 1, Size: 100, ReplicaPlacement: rp, Ttl: needle.EMPTY_TTL, Version: needle.GetCurrentVersion()}
+	dn.AddOrUpdateVolume(vi)
+	topo.RegisterVolumeLayout(vi, dn)
+	vl := topo.GetVolumeLayout("", rp, needle.EMPTY_TTL, types.HardDriveType)
+	vl.UnRegisterVolume(&vi, dn)
+
+	for _, on := range []bool{true, false} {
+		if !topo.SetDataNodeMaintenanceMode(dn, on) {
+			t.Fatalf("SetDataNodeMaintenanceMode(%v) should report a change", on)
+		}
+		if got, _ := vl.GetWritableVolumeCount(); got != 0 {
+			t.Errorf("maintenance %v: writable count = %d, want 0", on, got)
+		}
+		if locations := vl.Lookup(1); locations != nil {
+			t.Errorf("maintenance %v: re-evaluating a departed volume re-created its location list: %v", on, locations)
+		}
+	}
+}
diff --git a/weed/topology/max_volume_id_file_test.go b/weed/topology/max_volume_id_file_test.go
new file mode 100644
index 0000000000..bdeff5c5aa
--- /dev/null
+++ b/weed/topology/max_volume_id_file_test.go
@@ -0,0 +1,104 @@
+package topology
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+func TestMaxVolumeIdFileRestore(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "max_volume_id")
+
+	topo := NewTopology("topo", nil, 0, 5, false)
+	topo.SetMaxVolumeIdFile(file)
+	if err := topo.PersistMaxVolumeId(needle.VolumeId(41)); err != nil {
+		t.Fatalf("persist: %v", err)
+	}
+
+	restarted := NewTopology("topo", nil, 0, 5, false)
+	restarted.SetMaxVolumeIdFile(file)
+	if got := restarted.GetMaxVolumeId(); got != needle.VolumeId(41) {
+		t.Fatalf("restored max volume id = %d, want 41", got)
+	}
+}
+
+func TestMaxVolumeIdFileRestoresTopologyId(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "max_volume_id")
+
+	topo := NewTopology("topo", nil, 0, 5, false)
+	topo.SetTopologyId("cluster-a")
+	topo.SetMaxVolumeIdFile(file)
+	if err := topo.PersistMaxVolumeId(needle.VolumeId(7)); err != nil {
+		t.Fatalf("persist: %v", err)
+	}
+
+	restarted := NewTopology("topo", nil, 0, 5, false)
+	restarted.SetMaxVolumeIdFile(file)
+	if got := restarted.GetTopologyId(); got != "cluster-a" {
+		t.Fatalf("restored topology id = %q, want cluster-a", got)
+	}
+}
+
+func TestMaxVolumeIdFileRewritesOnTopologyIdChange(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "max_volume_id")
+
+	topo := NewTopology("topo", nil, 0, 5, false)
+	topo.SetMaxVolumeIdFile(file)
+	if err := topo.PersistMaxVolumeId(needle.VolumeId(7)); err != nil {
+		t.Fatalf("persist: %v", err)
+	}
+	topo.SetTopologyId("cluster-b")
+	if err := topo.PersistMaxVolumeId(needle.VolumeId(7)); err != nil {
+		t.Fatalf("persist same bound with new topology id: %v", err)
+	}
+
+	restarted := NewTopology("topo", nil, 0, 5, false)
+	restarted.SetMaxVolumeIdFile(file)
+	if got := restarted.GetTopologyId(); got != "cluster-b" {
+		t.Fatalf("restored topology id = %q, want cluster-b", got)
+	}
+}
+
+func TestMaxVolumeIdFileMonotonic(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "max_volume_id")
+
+	topo := NewTopology("topo", nil, 0, 5, false)
+	topo.SetMaxVolumeIdFile(file)
+	if err := topo.PersistMaxVolumeId(needle.VolumeId(10)); err != nil {
+		t.Fatalf("persist: %v", err)
+	}
+	if err := topo.PersistMaxVolumeId(needle.VolumeId(5)); err != nil {
+		t.Fatalf("persist lower: %v", err)
+	}
+	if got := topo.lastPersistedMaxVolumeId.Load(); got != 10 {
+		t.Fatalf("lastPersisted = %d, want 10", got)
+	}
+
+	data, err := os.ReadFile(file)
+	if err != nil {
+		t.Fatalf("read file: %v", err)
+	}
+	if len(data) == 0 {
+		t.Fatal("mirror file is empty")
+	}
+}
+
+func TestMaxVolumeIdFileCorrupt(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "max_volume_id")
+	if err := os.WriteFile(file, []byte("{not json"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	topo := NewTopology("topo", nil, 0, 5, false)
+	topo.SetMaxVolumeIdFile(file)
+	if got := topo.GetMaxVolumeId(); got != 0 {
+		t.Fatalf("corrupt file seeded bound %d, want 0", got)
+	}
+}
diff --git a/weed/topology/node.go b/weed/topology/node.go
index ebbf43946f..be642027e7 100644
--- a/weed/topology/node.go
+++ b/weed/topology/node.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/stats"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
 )
@@ -144,9 +145,12 @@ type Node interface {
 }
 
 type NodeImpl struct {
-	diskUsages   *DiskUsages
-	id           NodeId
-	parent       Node
+	diskUsages *DiskUsages
+	id         NodeId
+	// parent is an atomic pointer because unlinking runs under the rack's
+	// lock while readers (vacuum sweeps, usage propagation, String) reach
+	// it with no shared lock.
+	parent       atomic.Pointer[Node]
 	sync.RWMutex // lock children
 	children     map[NodeId]Node
 	// maxVolumeId uses atomic ops so UpAdjustMaxVolumeId (called from the
@@ -291,8 +295,8 @@ func (n *NodeImpl) IsLocked() (isTryLock bool) {
 }
 
 func (n *NodeImpl) String() string {
-	if n.parent != nil {
-		return n.parent.String() + ":" + string(n.id)
+	if parent := n.Parent(); parent != nil {
+		return parent.String() + ":" + string(n.id)
 	}
 	return string(n.id)
 }
@@ -305,26 +309,67 @@ func (n *NodeImpl) getOrCreateDisk(diskType types.DiskType) *DiskUsageCounts {
 	return n.diskUsages.getOrCreateDisk(diskType)
 }
 
+// inMaintenanceMode is true for a data node whose volume server is in
+// maintenance mode. Racks and data centers never are: their rolled-up counters
+// still include such a node, so their free-slot totals may exceed what their
+// children will actually hand out; see reserveOneVolumeInternal.
+func (n *NodeImpl) inMaintenanceMode() bool {
+	dn, ok := n.value.(*DataNode)
+	return ok && dn.InMaintenanceMode()
+}
+
+// AvailableSpaceFor is the free volume slots on this node for the option's disk
+// type. A data node in maintenance mode reports none: it is being drained, so
+// it is neither a volume-growth candidate nor reservable.
 func (n *NodeImpl) AvailableSpaceFor(option *VolumeGrowOption) int64 {
-	t := n.getOrCreateDisk(option.DiskType)
+	if n.inMaintenanceMode() {
+		return 0
+	}
+	t := n.diskUsages.getDisk(option.DiskType)
+	if t == nil {
+		return 0
+	}
 	freeVolumeSlotCount := atomic.LoadInt64(&t.maxVolumeCount) + atomic.LoadInt64(&t.remoteVolumeCount) - atomic.LoadInt64(&t.volumeCount)
-	freeVolumeSlotCount -= ecShardSlots(atomic.LoadInt64(&t.ecShardCount))
+	freeVolumeSlotCount -= erasure_coding.VolumeSlots(atomic.LoadInt64(&t.ecShardCount))
 	return freeVolumeSlotCount
 }
 
+// CapacityFor is the total registered volume slots for the option's disk type;
+// zero means no volume server has reported capacity for it yet.
+func (n *NodeImpl) CapacityFor(option *VolumeGrowOption) int64 {
+	t := n.diskUsages.getDisk(option.DiskType)
+	if t == nil {
+		return 0
+	}
+	return atomic.LoadInt64(&t.maxVolumeCount) + atomic.LoadInt64(&t.remoteVolumeCount)
+}
+
+// CapacityForAnyDisk is the total registered volume slots across every disk
+// type. CapacityFor answers zero both while a cluster is still starting and
+// when it never serves the option's medium; this tells the two apart.
+func (n *NodeImpl) CapacityForAnyDisk() (total int64) {
+	n.diskUsages.RLock()
+	defer n.diskUsages.RUnlock()
+	for _, t := range n.diskUsages.usages {
+		total += atomic.LoadInt64(&t.maxVolumeCount) + atomic.LoadInt64(&t.remoteVolumeCount)
+	}
+	return
+}
+
 // AvailableSpaceForReservation returns available space considering existing reservations
 func (n *NodeImpl) AvailableSpaceForReservation(option *VolumeGrowOption) int64 {
+	// Expire here as well: a node whose reservations fill it is filtered out
+	// before TryReserveCapacity could clean them, stranding the capacity.
+	n.capacityReservations.cleanExpiredReservations(VolumeGrowStrategy.GetReservationTimeout())
 	baseAvailable := n.AvailableSpaceFor(option)
 	reservedCount := n.capacityReservations.getReservedCount(option.DiskType)
 	return baseAvailable - reservedCount
 }
 
-// TryReserveCapacity attempts to atomically reserve capacity for volume creation
+// TryReserveCapacity attempts to atomically reserve capacity for volume creation using the configured timeout
 func (n *NodeImpl) TryReserveCapacity(diskType types.DiskType, count int64) (reservationId string, success bool) {
-	const reservationTimeout = 5 * time.Minute // TODO: make this configurable
-
 	// Clean up any expired reservations first
-	n.capacityReservations.cleanExpiredReservations(reservationTimeout)
+	n.capacityReservations.cleanExpiredReservations(VolumeGrowStrategy.GetReservationTimeout())
 
 	// Atomically check and reserve space
 	option := &VolumeGrowOption{DiskType: diskType}
@@ -348,7 +393,11 @@ func (n *NodeImpl) ReleaseReservedCapacity(reservationId string) {
 	}
 }
 func (n *NodeImpl) SetParent(node Node) {
-	n.parent = node
+	if node == nil {
+		n.parent.Store(nil)
+		return
+	}
+	n.parent.Store(&node)
 }
 
 func (n *NodeImpl) Children() (ret []Node) {
@@ -361,7 +410,10 @@ func (n *NodeImpl) Children() (ret []Node) {
 }
 
 func (n *NodeImpl) Parent() Node {
-	return n.parent
+	if parent := n.parent.Load(); parent != nil {
+		return *parent
+	}
+	return nil
 }
 
 func (n *NodeImpl) GetValue() interface{} {
@@ -380,13 +432,29 @@ func (n *NodeImpl) ReserveOneVolumeForReservation(r int64, option *VolumeGrowOpt
 func (n *NodeImpl) reserveOneVolumeInternal(r int64, option *VolumeGrowOption, useReservations bool) (assignedNode *DataNode, err error) {
 	n.RLock()
 	defer n.RUnlock()
-	for _, node := range n.children {
-		var freeSpace int64
+	freeSpaceOf := func(node Node) int64 {
 		if useReservations {
-			freeSpace = node.AvailableSpaceForReservation(option)
-		} else {
-			freeSpace = node.AvailableSpaceFor(option)
+			return node.AvailableSpaceForReservation(option)
 		}
+		return node.AvailableSpaceFor(option)
+	}
+	// The caller draws r from this node's rolled-up free slots, which still
+	// count children the walk below skips: a data node in maintenance mode
+	// reports no space, and an over-committed one reports less than zero. Fold
+	// r into the space that is actually on offer so it cannot walk off the end
+	// and fail with slots still free.
+	var eligible int64
+	for _, node := range n.children {
+		if freeSpace := freeSpaceOf(node); freeSpace > 0 {
+			eligible += freeSpace
+		}
+	}
+	if eligible <= 0 {
+		return nil, errors.New("No free volume slot found!")
+	}
+	r %= eligible
+	for _, node := range n.children {
+		freeSpace := freeSpaceOf(node)
 		// fmt.Println("r =", r, ", node =", node, ", freeSpace =", freeSpace)
 		if freeSpace <= 0 {
 			continue
@@ -424,8 +492,8 @@ func (n *NodeImpl) reserveOneVolumeInternal(r int64, option *VolumeGrowOption, u
 func (n *NodeImpl) UpAdjustDiskUsageDelta(diskType types.DiskType, diskUsage *DiskUsageCounts) { //can be negative
 	existingDisk := n.getOrCreateDisk(diskType)
 	existingDisk.addDiskUsageCounts(diskUsage)
-	if n.parent != nil {
-		n.parent.UpAdjustDiskUsageDelta(diskType, diskUsage)
+	if parent := n.Parent(); parent != nil {
+		parent.UpAdjustDiskUsageDelta(diskType, diskUsage)
 	}
 }
 func (n *NodeImpl) UpAdjustMaxVolumeId(vid needle.VolumeId) {
@@ -439,8 +507,8 @@ func (n *NodeImpl) UpAdjustMaxVolumeId(vid needle.VolumeId) {
 			break
 		}
 	}
-	if n.parent != nil {
-		n.parent.UpAdjustMaxVolumeId(vid)
+	if parent := n.Parent(); parent != nil {
+		parent.UpAdjustMaxVolumeId(vid)
 	}
 }
 func (n *NodeImpl) GetMaxVolumeId() needle.VolumeId {
diff --git a/weed/topology/rack.go b/weed/topology/rack.go
index 4facd30f6c..876122b817 100644
--- a/weed/topology/rack.go
+++ b/weed/topology/rack.go
@@ -148,14 +148,14 @@ func (r *Rack) ToInfo() (info RackInfo) {
 	return
 }
 
-func (r *Rack) ToRackInfo() *master_pb.RackInfo {
+func (r *Rack) ToRackInfo(filter VolumeFilter) *master_pb.RackInfo {
 	m := &master_pb.RackInfo{
 		Id:        string(r.Id()),
 		DiskInfos: r.diskUsages.ToDiskInfo(),
 	}
 	for _, c := range r.Children() {
 		dn := c.(*DataNode)
-		m.DataNodeInfos = append(m.DataNodeInfos, dn.ToDataNodeInfo())
+		m.DataNodeInfos = append(m.DataNodeInfos, dn.ToDataNodeInfo(filter))
 	}
 	return m
 }
diff --git a/weed/topology/store_replicate.go b/weed/topology/store_replicate.go
index f36868af87..fc7da99fb3 100644
--- a/weed/topology/store_replicate.go
+++ b/weed/topology/store_replicate.go
@@ -45,6 +45,14 @@ func ReplicatedWrite(ctx context.Context, masterFn operation.GetMasterFn, grpcDi
 		}
 	}
 
+	// with no local volume and no replica to forward to, the write would be acknowledged without being stored
+	hasLocalVolume := s.HasVolume(volumeId)
+	if !hasLocalVolume && len(remoteLocations) == 0 {
+		err = fmt.Errorf("volume %d not found on %s:%d", volumeId, s.Ip, s.Port)
+		glog.V(0).Infoln(err)
+		return
+	}
+
 	// read fsync value
 	fsync := false
 	if r.FormValue("fsync") == "true" {
@@ -60,7 +68,7 @@ func ReplicatedWrite(ctx context.Context, masterFn operation.GetMasterFn, grpcDi
 		}(time.Now())
 	}
 
-	if s.GetVolume(volumeId) != nil {
+	if hasLocalVolume {
 		start := time.Now()
 
 		inFlightGauge := stats.VolumeServerInFlightRequestsGauge.WithLabelValues(stats.WriteToLocalDisk)
@@ -97,6 +105,9 @@ func ReplicatedWrite(ctx context.Context, masterFn operation.GetMasterFn, grpcDi
 				"type": {"replicate"},
 				"ttl":  {n.Ttl.String()},
 			}
+			if fsync {
+				q.Set("fsync", "true")
+			}
 			if n.LastModified > 0 {
 				q.Set("ts", strconv.FormatUint(n.LastModified, 10))
 			}
@@ -173,7 +184,7 @@ func ReplicatedDelete(masterFn operation.GetMasterFn, grpcDialOption grpc.DialOp
 
 	var remoteLocations []operation.Location
 	if r.FormValue("type") != "replicate" {
-		remoteLocations, err = GetWritableRemoteReplications(store, grpcDialOption, volumeId, masterFn)
+		remoteLocations, err = GetRemoteReplications(store, grpcDialOption, volumeId, masterFn)
 		if err != nil {
 			glog.V(0).Infoln(err)
 			return
@@ -206,7 +217,14 @@ func ReplicatedDelete(masterFn operation.GetMasterFn, grpcDialOption grpc.DialOp
 	if replicaCount > 0 { //send to other replica locations
 		// background, not r.Context(): a client disconnect must not orphan replica deletes
 		if err = DistributedOperation(context.Background(), remoteLocations, func(ctx context.Context, location operation.Location) error {
-			return util_http.Delete("http://"+location.Url+r.URL.Path+"?type=replicate", string(jwt))
+			url, normalizeErr := util_http.GetGlobalHttpClient().NormalizeHttpScheme(location.Url + r.URL.Path + "?type=replicate")
+			if normalizeErr != nil {
+				return normalizeErr
+			}
+			if jwt != "" && (!strings.HasPrefix(url, "https://") || !util_http.GetGlobalHttpClient().IsTLSVerified()) {
+				return fmt.Errorf("refusing to forward delete authorization to %s without HTTPS", location.Url)
+			}
+			return util_http.Delete(url, string(jwt))
 		}); err != nil {
 			reason := classifyReplicationError(err)
 			stats.VolumeServerReplicationFailures.WithLabelValues(stats.ReplicationOpDelete, reason).Inc()
@@ -267,7 +285,15 @@ func DistributedOperation(ctx context.Context, locations []operation.Location, o
 	return ret.Error()
 }
 
-func GetWritableRemoteReplications(s *storage.Store, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, masterFn operation.GetMasterFn) (remoteLocations []operation.Location, err error) {
+func GetRemoteReplications(s *storage.Store, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, masterFn operation.GetMasterFn) ([]operation.Location, error) {
+	return getRemoteReplications(s, grpcDialOption, volumeId, masterFn, false)
+}
+
+func GetWritableRemoteReplications(s *storage.Store, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, masterFn operation.GetMasterFn) ([]operation.Location, error) {
+	return getRemoteReplications(s, grpcDialOption, volumeId, masterFn, true)
+}
+
+func getRemoteReplications(s *storage.Store, grpcDialOption grpc.DialOption, volumeId needle.VolumeId, masterFn operation.GetMasterFn, writableOnly bool) (remoteLocations []operation.Location, err error) {
 
 	v := s.GetVolume(volumeId)
 	if v != nil && v.ReplicaPlacement.GetCopyCount() == 1 {
@@ -275,10 +301,23 @@ func GetWritableRemoteReplications(s *storage.Store, grpcDialOption grpc.DialOpt
 	}
 
 	// not on local store, or has replications
-	lookupResult, lookupErr := operation.LookupVolumeId(masterFn, grpcDialOption, volumeId.String())
+	lookupResults, lookupErr := operation.LookupVolumeIds(masterFn, grpcDialOption, []string{volumeId.String()}, false)
+	lookupResult := lookupResults[volumeId.String()]
+	writableLocations := 0
 	if lookupErr == nil {
+		if lookupResult == nil {
+			err = fmt.Errorf("replicating lookup returned no result for %d", volumeId)
+			return
+		}
 		selfUrl := util.JoinHostPort(s.Ip, s.Port)
 		for _, location := range lookupResult.Locations {
+			if writableOnly && location.ReadOnly {
+				continue
+			}
+			if !writableOnly && location.ReadOnly && !location.ReadOnlyCanDelete {
+				continue
+			}
+			writableLocations++
 			if location.Url != selfUrl {
 				remoteLocations = append(remoteLocations, location)
 			}
@@ -291,11 +330,14 @@ func GetWritableRemoteReplications(s *storage.Store, grpcDialOption grpc.DialOpt
 	if v != nil {
 		// has one local and has remote replications
 		copyCount := v.ReplicaPlacement.GetCopyCount()
-		if len(lookupResult.Locations) < copyCount {
-			// drop the stale cache so the next write re-queries the master once it re-registers the missing replica
+		if writableLocations < copyCount {
 			operation.InvalidateVolumeIdLocationCache(volumeId.String())
-			err = fmt.Errorf("replicating operations [%d] is less than volume %d replication copy count [%d]",
-				len(lookupResult.Locations), volumeId, copyCount)
+			label := "replication"
+			if writableOnly {
+				label = "writable replication"
+			}
+			err = fmt.Errorf("%s locations [%d] is less than volume %d replication copy count [%d]",
+				label, writableLocations, volumeId, copyCount)
 		}
 	}
 
diff --git a/weed/topology/store_replicate_test.go b/weed/topology/store_replicate_test.go
index f5f96dc480..3901db744f 100644
--- a/weed/topology/store_replicate_test.go
+++ b/weed/topology/store_replicate_test.go
@@ -3,10 +3,23 @@ package topology
 import (
 	"context"
 	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
 )
 
 // TestDistributedOperationCancelsSiblingsOnFirstError verifies that once one
@@ -53,3 +66,209 @@ func TestDistributedOperationEmpty(t *testing.T) {
 		t.Fatalf("expected nil for no locations, got %v", err)
 	}
 }
+
+type mockMasterServer struct {
+	master_pb.UnimplementedSeaweedServer
+	mu        sync.Mutex
+	calls     int
+	locations []*master_pb.Location
+}
+
+func (m *mockMasterServer) LookupVolume(ctx context.Context, req *master_pb.LookupVolumeRequest) (*master_pb.LookupVolumeResponse, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.calls++
+	var vls []*master_pb.LookupVolumeResponse_VolumeIdLocation
+	for _, vid := range req.VolumeOrFileIds {
+		vl := &master_pb.LookupVolumeResponse_VolumeIdLocation{
+			VolumeOrFileId: vid,
+			Locations:      m.locations,
+		}
+		if len(m.locations) == 0 {
+			vl.Error = fmt.Sprintf("volume id %s not found", vid)
+		}
+		vls = append(vls, vl)
+	}
+	return &master_pb.LookupVolumeResponse{VolumeIdLocations: vls}, nil
+}
+
+func startMockMasterServer(t *testing.T, master *mockMasterServer) (operation.GetMasterFn, grpc.DialOption) {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	grpcServer := grpc.NewServer()
+	master_pb.RegisterSeaweedServer(grpcServer, master)
+	serveErr := make(chan error, 1)
+	go func() { serveErr <- grpcServer.Serve(lis) }()
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		if err := <-serveErr; err != nil && !errors.Is(err, grpc.ErrServerStopped) {
+			t.Errorf("mock master serve: %v", err)
+		}
+	})
+
+	grpcPort := lis.Addr().(*net.TCPAddr).Port
+	return func(_ context.Context) pb.ServerAddress {
+		return pb.NewServerAddressWithGrpcPort(fmt.Sprintf("127.0.0.1:%d", grpcPort), grpcPort)
+	}, grpc.WithTransportCredentials(insecure.NewCredentials())
+}
+
+func TestGetWritableRemoteReplicationsRefreshesReadOnlyReplicas(t *testing.T) {
+	master := &mockMasterServer{locations: []*master_pb.Location{
+		{Url: "127.0.0.1:8080"},
+		{Url: "127.0.0.2:8080"},
+	}}
+	masterFn, dialOption := startMockMasterServer(t, master)
+	store := &storage.Store{Ip: "127.0.0.1", Port: 8080}
+	volumeId := needle.VolumeId(1)
+	operation.InvalidateVolumeIdLocationCache(volumeId.String())
+
+	locations, err := GetWritableRemoteReplications(store, dialOption, volumeId, masterFn)
+	if err != nil {
+		t.Fatalf("first lookup: %v", err)
+	}
+	if len(locations) != 1 || locations[0].Url != "127.0.0.2:8080" {
+		t.Fatalf("first lookup locations = %v", locations)
+	}
+
+	master.mu.Lock()
+	master.locations = []*master_pb.Location{
+		{Url: "127.0.0.1:8080"},
+		{Url: "127.0.0.2:8080", ReadOnly: true, ReadOnlyCanDelete: true},
+	}
+	master.mu.Unlock()
+
+	locations, err = GetWritableRemoteReplications(store, dialOption, volumeId, masterFn)
+	if err != nil {
+		t.Fatalf("second lookup: %v", err)
+	}
+	if len(locations) != 0 {
+		t.Fatalf("read-only replica remained a write target: %v", locations)
+	}
+	master.mu.Lock()
+	calls := master.calls
+	master.mu.Unlock()
+	if calls != 2 {
+		t.Fatalf("master lookup calls = %d, want 2", calls)
+	}
+
+	locations, err = GetRemoteReplications(store, dialOption, volumeId, masterFn)
+	if err != nil {
+		t.Fatalf("delete lookup: %v", err)
+	}
+	if len(locations) != 1 || !locations[0].ReadOnly || !locations[0].ReadOnlyCanDelete {
+		t.Fatalf("read-only-can-delete target was dropped: %v", locations)
+	}
+}
+
+// TestReplicatedWriteForwardsFsyncToReplicas verifies that the fsync=true
+// request parameter is forwarded to replica volume servers in the fan-out
+// request, so a durable write means every replica has flushed to disk.
+func TestReplicatedWriteForwardsFsyncToReplicas(t *testing.T) {
+	replicaQueries := make(chan url.Values, 4)
+	replica := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		replicaQueries <- r.URL.Query()
+		w.WriteHeader(http.StatusCreated)
+		if _, err := w.Write([]byte(`{"size":1}`)); err != nil {
+			t.Errorf("replica write response: %v", err)
+		}
+	}))
+	defer replica.Close()
+	replicaHost := strings.TrimPrefix(replica.URL, "http://")
+
+	masterFn, dialOption := startMockMasterServer(t, &mockMasterServer{
+		locations: []*master_pb.Location{{Url: replicaHost}},
+	})
+
+	store := &storage.Store{}
+	volumeId := needle.VolumeId(1)
+
+	for _, tc := range []struct {
+		name      string
+		fsync     string
+		wantFsync bool
+	}{
+		{name: "fsync requested", fsync: "true", wantFsync: true},
+		{name: "no fsync requested", fsync: "", wantFsync: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			operation.InvalidateVolumeIdLocationCache(volumeId.String())
+
+			path := "http://127.0.0.1:8080/1,01637037d6"
+			if tc.fsync != "" {
+				path += "?fsync=" + tc.fsync
+			}
+			r := httptest.NewRequest(http.MethodPost, path, nil)
+			if err := r.ParseForm(); err != nil {
+				t.Fatal(err)
+			}
+
+			n := &needle.Needle{
+				Id:   1,
+				Data: []byte("test data"),
+				Ttl:  needle.EMPTY_TTL,
+			}
+			if _, err := ReplicatedWrite(context.Background(), masterFn, dialOption, store, volumeId, n, r, ""); err != nil {
+				t.Fatalf("ReplicatedWrite: %v", err)
+			}
+
+			select {
+			case q := <-replicaQueries:
+				got := q.Get("fsync")
+				if tc.wantFsync && got != "true" {
+					t.Errorf("expected fsync=true in replica query, got %q (query: %v)", got, q)
+				}
+				if !tc.wantFsync && got != "" {
+					t.Errorf("expected no fsync in replica query, got %q (query: %v)", got, q)
+				}
+			case <-time.After(5 * time.Second):
+				t.Fatal("replica never received the fan-out request")
+			}
+		})
+	}
+}
+
+// TestReplicatedWriteRejectsWriteWithNoTarget verifies that a write this server
+// cannot store and has no replica to forward to fails instead of being
+// acknowledged with nothing written.
+func TestReplicatedWriteRejectsWriteWithNoTarget(t *testing.T) {
+	master := &mockMasterServer{}
+	masterFn, dialOption := startMockMasterServer(t, master)
+	store := &storage.Store{Ip: "127.0.0.1", Port: 8080}
+	volumeId := needle.VolumeId(31234)
+
+	for _, tc := range []struct {
+		name      string
+		query     string
+		locations []*master_pb.Location
+	}{
+		{name: "volume unknown to the master"},
+		{name: "master lists only this server", locations: []*master_pb.Location{{Url: "127.0.0.1:8080"}}},
+		{name: "replica write for a volume not on this server", query: "?type=replicate"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			master.mu.Lock()
+			master.locations = tc.locations
+			master.mu.Unlock()
+
+			r := httptest.NewRequest(http.MethodPost, "http://127.0.0.1:8080/31234,01637037d6"+tc.query, nil)
+			if err := r.ParseForm(); err != nil {
+				t.Fatal(err)
+			}
+			n := &needle.Needle{
+				Id:   1,
+				Data: []byte("test data"),
+				Ttl:  needle.EMPTY_TTL,
+			}
+			_, err := ReplicatedWrite(context.Background(), masterFn, dialOption, store, volumeId, n, r, "")
+			if err == nil {
+				t.Fatal("ReplicatedWrite acknowledged a write that no volume stored")
+			}
+			if !strings.Contains(err.Error(), "not found") {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
diff --git a/weed/topology/topology.go b/weed/topology/topology.go
index c94765a2bf..3ceda5de78 100644
--- a/weed/topology/topology.go
+++ b/weed/topology/topology.go
@@ -6,7 +6,10 @@ import (
 	"fmt"
 	"math"
 	"math/rand/v2"
+	"os"
+	"path/filepath"
 	"slices"
+	"strings"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -47,6 +50,7 @@ type Topology struct {
 
 	volumeSizeLimit          uint64
 	replicationAsMin         bool
+	maxWritableVolumes       int
 	vacuumDisabledByOperator atomic.Bool // true when operator manually disables vacuum
 	vacuumDisabledByPlugin   atomic.Bool // true when disabled by the vacuum plugin monitor
 	adminServerConnectedFunc func() bool // optional callback to check admin server presence
@@ -81,6 +85,224 @@ type Topology struct {
 	// the same node whether or not the grpc port suffix is present.
 	dataNodeIndex     map[string]*DataNode
 	dataNodeIndexLock sync.RWMutex
+
+	maxVolumeIdFile           string
+	maxVolumeIdFileLock       sync.Mutex
+	lastPersistedMaxVolumeId  atomic.Uint32
+	lastPersistedTopologyId   atomic.Value
+	lastPersistedGrowthFrozen atomic.Bool
+
+	growthFrozen          atomic.Bool
+	growthFrozenAt        atomic.Int64
+	freezeOnMismatch      atomic.Bool
+	stateLossRecoveryWait atomic.Int64
+	allocationNotBefore   atomic.Int64
+	topologyInitPending   atomic.Bool
+
+	reportedTopologyIdsLock    sync.Mutex
+	pendingReportedTopologyIds map[string]struct{}
+
+	// quarantinedVolumeIds are (node, vid) pairs force-read-only because the
+	// vid collided across layouts. Kept separate from the reported flag so
+	// later heartbeats from the same server cannot quietly undo it.
+	quarantinedVolumeIds sync.Map
+	// quarantineLock serializes each quarantine record update with the layout
+	// mark it justifies: a release pass and a heartbeat read-only flag update
+	// each observe record and mark as one state, never a mark whose record
+	// was already deleted or a cleared mark whose record is not yet visible.
+	quarantineLock sync.Mutex
+	// quarantinePushLocks serialize the remote mark/unmark calls per replica
+	// so a push decided under an older record state cannot land on the
+	// volume server after a newer one. Keyed by replica so a slow server
+	// does not stall pushes to the others.
+	quarantinePushLocks   map[quarantinedVolume]*quarantinePushLock
+	quarantinePushLocksMu sync.Mutex
+
+	// duplicateFlagChecks tracks in-flight flagDuplicateVolumeId passes so
+	// tests can wait for the async checks a registration started.
+	duplicateFlagChecks sync.WaitGroup
+
+	// QuarantineVolumeFn pushes the quarantine onto the volume server itself
+	// (VolumeMarkReadonly/VolumeMarkWritable). nil keeps quarantine at the
+	// layout level only.
+	QuarantineVolumeFn func(dn *DataNode, vid needle.VolumeId, readOnly bool) error
+}
+
+type quarantinedVolume struct {
+	dnId NodeId
+	vid  needle.VolumeId
+}
+
+type quarantinedVolumeState struct {
+	reported bool
+	enforced bool
+	retry    bool
+}
+
+type quarantinePushLock struct {
+	sync.Mutex
+	refs int
+}
+
+func (t *Topology) isQuarantined(dn *DataNode, vid needle.VolumeId) bool {
+	_, ok := t.quarantinedVolumeIds.Load(quarantinedVolume{dn.Id(), vid})
+	return ok
+}
+
+// pushQuarantine sends the remote mark only while it still matches the
+// record: a read-only push requires the pair to exist, a writable push
+// requires it to be gone. The bool reports whether the remote call was
+// actually made, so callers can tell a skipped stale push from a failed one.
+func (t *Topology) pushQuarantine(dn *DataNode, vid needle.VolumeId, readOnly bool) (bool, error) {
+	unlock := t.lockQuarantinePush(quarantinedVolume{dn.Id(), vid})
+	defer unlock()
+	return t.sendQuarantine(dn, vid, readOnly)
+}
+
+// sendQuarantine runs the record check and remote mark; the caller holds
+// the replica's push lock.
+func (t *Topology) sendQuarantine(dn *DataNode, vid needle.VolumeId, readOnly bool) (bool, error) {
+	t.quarantineLock.Lock()
+	_, exists := t.quarantinedVolumeIds.Load(quarantinedVolume{dn.Id(), vid})
+	t.quarantineLock.Unlock()
+	if exists != readOnly {
+		return false, nil
+	}
+	return true, t.QuarantineVolumeFn(dn, vid, readOnly)
+}
+
+// releaseQuarantineWritable pushes the writable mark and re-arms the record
+// on failure, all under the replica's push lock so a queued stale push cannot
+// slip between the failure and the restore and undo the re-armed record.
+func (t *Topology) releaseQuarantineWritable(dn *DataNode, vid needle.VolumeId) {
+	unlock := t.lockQuarantinePush(quarantinedVolume{dn.Id(), vid})
+	defer unlock()
+	if _, err := t.sendQuarantine(dn, vid, false); err != nil {
+		t.restoreQuarantineRecord(dn, vid)
+	}
+}
+
+// lockQuarantinePush returns the release for q's push lock, creating the lock
+// on first use and dropping it once the last holder lets go.
+func (t *Topology) lockQuarantinePush(q quarantinedVolume) func() {
+	t.quarantinePushLocksMu.Lock()
+	if t.quarantinePushLocks == nil {
+		t.quarantinePushLocks = make(map[quarantinedVolume]*quarantinePushLock)
+	}
+	l, ok := t.quarantinePushLocks[q]
+	if !ok {
+		l = &quarantinePushLock{}
+		t.quarantinePushLocks[q] = l
+	}
+	l.refs++
+	t.quarantinePushLocksMu.Unlock()
+	l.Lock()
+	return func() {
+		t.quarantinePushLocksMu.Lock()
+		l.refs--
+		if l.refs == 0 {
+			delete(t.quarantinePushLocks, q)
+		}
+		t.quarantinePushLocksMu.Unlock()
+		l.Unlock()
+	}
+}
+
+// takeQuarantineRetryLocked disarms a pending release retry and reports
+// whether one was armed. The caller holds quarantineLock.
+func (t *Topology) takeQuarantineRetryLocked(q quarantinedVolume) bool {
+	v, ok := t.quarantinedVolumeIds.Load(q)
+	if !ok {
+		return false
+	}
+	state := v.(quarantinedVolumeState)
+	if !state.retry {
+		return false
+	}
+	state.retry = false
+	t.quarantinedVolumeIds.Store(q, state)
+	return true
+}
+
+// retryPendingQuarantineReleases re-runs the release pass for every record a
+// failed writable push re-armed. The retry in enforceQuarantine only fires
+// while a heartbeat keeps carrying the volume, and an idle replica drops out
+// of the delta reports once its stored flag matches the server's, so pending
+// retries also run off the leader pulse.
+func (t *Topology) retryPendingQuarantineReleases() {
+	vids := make(map[needle.VolumeId]struct{})
+	t.quarantineLock.Lock()
+	t.quarantinedVolumeIds.Range(func(key, _ any) bool {
+		q := key.(quarantinedVolume)
+		if t.takeQuarantineRetryLocked(q) {
+			vids[q.vid] = struct{}{}
+		}
+		return true
+	})
+	t.quarantineLock.Unlock()
+	for vid := range vids {
+		go t.releaseResolvedQuarantine(vid)
+	}
+}
+
+// enforceQuarantine keeps the latest reported read-only flag for a quarantined
+// copy so a later release restores the server's true state. The stored report
+// keeps the server's flag: quarantine lives at the layout level, and folding
+// it into the record here would make the master's volume digest permanently
+// disagree with the server's and force a full volume list on every heartbeat.
+func (t *Topology) enforceQuarantine(dn *DataNode, vi storage.VolumeInfo) storage.VolumeInfo {
+	q := quarantinedVolume{dn.Id(), vi.Id}
+	t.quarantineLock.Lock()
+	v, ok := t.quarantinedVolumeIds.Load(q)
+	if !ok {
+		t.quarantineLock.Unlock()
+		return vi
+	}
+	if t.takeQuarantineRetryLocked(q) {
+		// A failed writable push re-armed this record; hand the release pass
+		// one retry per report. Clearing it first keeps a surviving conflict
+		// on the normal enforce path afterwards.
+		t.quarantineLock.Unlock()
+		go t.releaseResolvedQuarantine(vi.Id)
+		return vi
+	}
+	state := v.(quarantinedVolumeState)
+	if !state.enforced {
+		state.reported = vi.ReadOnly
+	}
+	if t.QuarantineVolumeFn == nil || (state.enforced && vi.ReadOnly) {
+		t.quarantinedVolumeIds.Store(q, state)
+		t.quarantineLock.Unlock()
+		return vi
+	}
+	t.quarantineLock.Unlock()
+
+	// The mark never landed on the server, or the server lost it (restart,
+	// manual unquarantine); push it while the conflict stands. The call is
+	// remote, so it runs outside the lock.
+	pushed, err := t.pushQuarantine(dn, vi.Id, true)
+	if pushed && err == nil {
+		state.enforced = true
+	}
+	t.quarantineLock.Lock()
+	cur, still := t.quarantinedVolumeIds.Load(q)
+	if still {
+		latest := cur.(quarantinedVolumeState)
+		if !latest.enforced {
+			latest.reported = state.reported
+		}
+		latest.enforced = latest.enforced || state.enforced
+		t.quarantinedVolumeIds.Store(q, latest)
+		t.quarantineLock.Unlock()
+		return vi
+	}
+	t.quarantineLock.Unlock()
+	if state.enforced && !state.reported {
+		// The conflict resolved while the push was in flight; leave the
+		// server consistent with the released layout.
+		t.releaseQuarantineWritable(dn, vi.Id)
+	}
+	return vi
 }
 
 func NewTopology(id string, seq sequence.Sequencer, volumeSizeLimit uint64, pulse int, replicationAsMin bool) *Topology {
@@ -104,6 +326,7 @@ func NewTopology(id string, seq sequence.Sequencer, volumeSizeLimit uint64, puls
 
 	t.Configuration = &Configuration{}
 	t.dataNodeIndex = make(map[string]*DataNode)
+	t.quarantinePushLocks = make(map[quarantinedVolume]*quarantinePushLock)
 
 	return t
 }
@@ -162,6 +385,25 @@ func (t *Topology) unregisterDataNodeAddress(addr pb.ServerAddress, dn *DataNode
 	}
 }
 
+// FreeBytes sums what every volume server reports as free on its filesystems.
+// reported is false unless all of them answered: the one that stayed quiet may
+// be the one holding the room, and a partial sum would read as a cluster with
+// none left.
+func (t *Topology) FreeBytes() (freeBytes uint64, reported bool) {
+	for _, dcNode := range t.Children() {
+		for _, rackNode := range dcNode.Children() {
+			for _, dataNode := range rackNode.Children() {
+				nodeFreeBytes, nodeReported := dataNode.GetDiskUsages().FreeBytes()
+				if !nodeReported {
+					return 0, false
+				}
+				freeBytes += nodeFreeBytes
+			}
+		}
+	}
+	return freeBytes, true
+}
+
 func (t *Topology) IsChildLocked() (bool, error) {
 	if t.IsLocked() {
 		return true, errors.New("topology is locked")
@@ -310,16 +552,6 @@ func (t *Topology) Leader() (l pb.ServerAddress, err error) {
 		func() (l pb.ServerAddress, err error) {
 			l, err = t.MaybeLeader()
 			if err == nil && l == "" {
-				// Thread-safe check if we are the leader
-				t.RaftServerAccessLock.RLock()
-				if t.RaftServer != nil && t.RaftServer.State() == raft.Leader {
-					l = pb.ServerAddress(t.RaftServer.Name())
-				}
-				t.RaftServerAccessLock.RUnlock()
-
-				if l != "" {
-					return l, nil
-				}
 				err = leaderNotSelected
 			}
 			return l, err
@@ -337,6 +569,9 @@ func (t *Topology) MaybeLeader() (l pb.ServerAddress, err error) {
 
 	if t.RaftServer != nil {
 		l = pb.ServerAddress(t.RaftServer.Leader())
+		if l == "" && t.RaftServer.State() == raft.Leader {
+			l = pb.ServerAddress(t.RaftServer.Name())
+		}
 	} else if t.HashicorpRaft != nil {
 		l = pb.ServerAddress(t.HashicorpRaft.Leader())
 	} else {
@@ -375,9 +610,29 @@ func (t *Topology) NextVolumeId() (needle.VolumeId, error) {
 		return 0, fmt.Errorf("as leader can not read yet")
 
 	}
+	for t.topologyInitPending.Load() {
+		if !t.IsLeaderAndCanRead() {
+			return 0, fmt.Errorf("as leader can not read yet")
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	if t.IsGrowthFrozen() {
+		return 0, fmt.Errorf("volume growth is frozen after master state loss; verify the cluster inventory, then run: volume.growth.resume")
+	}
+	if wait := t.allocationDelay(); wait > 0 {
+		glog.V(0).Infof("deferring volume id allocation for %v", wait)
+		time.Sleep(wait)
+		if t.IsGrowthFrozen() {
+			return 0, fmt.Errorf("volume growth is frozen after master state loss; verify the cluster inventory, then run: volume.growth.resume")
+		}
+	}
 	vid := t.GetMaxVolumeId()
 	next := vid.Next()
 
+	if err := t.PersistMaxVolumeId(next); err != nil {
+		return 0, fmt.Errorf("persist max volume id %d: %w", next, err)
+	}
+
 	t.RaftServerAccessLock.RLock()
 	defer t.RaftServerAccessLock.RUnlock()
 
@@ -410,11 +665,16 @@ func (t *Topology) PickForWrite(requestedCount uint64, option *VolumeGrowOption,
 	if volumeLocationList == nil || volumeLocationList.Length() == 0 {
 		return "", 0, nil, shouldGrow, fmt.Errorf("%s available for collection:%s replication:%s ttl:%s", NoWritableVolumes, option.Collection, option.ReplicaPlacement.String(), option.Ttl.String())
 	}
-	// Track estimated assigned bytes to spread load between heartbeats.
-	// Use the client hint if provided, otherwise fall back to 1MB estimate.
+	// Track estimated assigned bytes to spread load between heartbeats. A flat
+	// fallback overcharges a small-file workload enough to mark near-empty
+	// volumes full, so prefer the volume's own average.
 	sizePerFile := DefaultNeedleSizeEstimate
 	if expectedDataSize > 0 {
 		sizePerFile = expectedDataSize
+	} else if vi, infoErr := volumeLocationList.Head().GetVolumesById(vid); infoErr == nil && vi.FileCount > 0 {
+		if avg := vi.Size / uint64(vi.FileCount); avg > 0 {
+			sizePerFile = avg
+		}
 	}
 	pendingBytes := min(uint64(count)*sizePerFile, uint64(math.MaxInt64))
 	if volumeLayout.RecordAssign(vid, int64(pendingBytes)) {
@@ -427,10 +687,48 @@ func (t *Topology) PickForWrite(requestedCount uint64, option *VolumeGrowOption,
 
 func (t *Topology) GetVolumeLayout(collectionName string, rp *super_block.ReplicaPlacement, ttl *needle.TTL, diskType types.DiskType) *VolumeLayout {
 	return t.collectionMap.Get(collectionName, func() interface{} {
-		return NewCollection(collectionName, t.volumeSizeLimit, t.replicationAsMin)
+		c := NewCollection(collectionName, t.volumeSizeLimit, t.replicationAsMin)
+		c.maxWritableVolumes = t.maxWritableVolumes
+		return c
 	}).(*Collection).GetOrCreateVolumeLayout(rp, ttl, diskType)
 }
 
+// SetMaxWritableVolumes caps how many writable volumes in a volume layout
+// (collection + replica placement + ttl + disk type) assignments are spread
+// over; 0 means every writable volume is a candidate. It only affects
+// collections created afterwards, so call it before serving.
+func (t *Topology) SetMaxWritableVolumes(n int) {
+	t.maxWritableVolumes = n
+}
+
+// FindVolumeLayout is the read-only counterpart of GetVolumeLayout: it returns
+// nil when the collection or its layout does not exist, instead of creating
+// one. Lets callers check a layout's state without polluting the collection
+// map with an empty collection.
+func (t *Topology) FindVolumeLayout(collectionName string, rp *super_block.ReplicaPlacement, ttl *needle.TTL, diskType types.DiskType) *VolumeLayout {
+	c, ok := t.collectionMap.Find(collectionName)
+	if !ok {
+		return nil
+	}
+	vl, ok := c.(*Collection).GetVolumeLayout(rp, ttl, diskType)
+	if !ok {
+		return nil
+	}
+	return vl
+}
+
+// DecayQuietVolumeSizes decays pending assign estimates across every layout.
+// A volume that changed reports within a pulse, so two quiet pulses mean the
+// size on record is the size there is.
+func (t *Topology) DecayQuietVolumeSizes() {
+	quietCutoff := time.Duration(2*t.pulse) * time.Second
+	for _, c := range t.collectionMap.Items() {
+		for _, vl := range c.(*Collection).GetAllVolumeLayouts() {
+			vl.DecayQuietVolumeSizes(quietCutoff)
+		}
+	}
+}
+
 // CollectionVolumeStats aggregates stats across all volume layouts and EC
 // volumes of one collection, or across every collection when collectionName is
 // empty.
@@ -503,12 +801,20 @@ func (t *Topology) DeleteCollection(collectionName string) {
 	// holds a bit in its node's lookup digest. Left in place, those bits keep
 	// the node's held and servable digests apart forever, and the master asks
 	// for the full volume list on every heartbeat from then on.
-	if collection, found := t.FindCollection(collectionName); found {
-		for _, vl := range collection.GetAllVolumeLayouts() {
-			vl.releaseLookupOwnership()
-		}
+	// Unpublish first so a racing registration re-resolves into a fresh collection.
+	collection, found := t.collectionMap.Delete(collectionName)
+	if !found {
+		return
+	}
+	var vids []needle.VolumeId
+	for _, vl := range collection.(*Collection).GetAllVolumeLayouts() {
+		vids = append(vids, vl.ListVids()...)
+		vl.releaseLookupOwnership()
+	}
+	// a vid colliding with a copy in this collection is no longer a duplicate
+	for _, vid := range vids {
+		t.releaseResolvedQuarantine(vid)
 	}
-	t.collectionMap.Delete(collectionName)
 }
 
 func (t *Topology) DeleteLayout(collectionName string, rp *super_block.ReplicaPlacement, ttl *needle.TTL, diskType types.DiskType) {
@@ -524,19 +830,257 @@ func (t *Topology) DeleteLayout(collectionName string, rp *super_block.ReplicaPl
 
 func (t *Topology) RegisterVolumeLayout(v storage.VolumeInfo, dn *DataNode) {
 	diskType := types.ToDiskType(v.DiskType)
-	vl := t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
-	vl.RegisterVolume(&v, dn)
-	vl.EnsureCorrectWritables(&v)
+	for {
+		vl := t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
+		// RegisterVolume reads the quarantine record and marks under
+		// accessLock; holding quarantineLock keeps that pair serialized with
+		// releaseResolvedQuarantine's clear-and-delete.
+		t.quarantineLock.Lock()
+		registered := vl.RegisterVolume(&v, dn, func(n *DataNode) bool {
+			return t.isQuarantined(n, v.Id)
+		})
+		t.quarantineLock.Unlock()
+		if registered {
+			vl.EnsureCorrectWritables(&v)
+			t.flagDuplicateVolumeIdAsync(v, dn)
+			return
+		}
+		// Dropped with its collection; the next lookup creates a fresh one.
+	}
+}
+
+func (t *Topology) flagDuplicateVolumeIdAsync(v storage.VolumeInfo, dn *DataNode) {
+	t.duplicateFlagChecks.Add(1)
+	go func() {
+		defer t.duplicateFlagChecks.Done()
+		t.flagDuplicateVolumeId(v, dn)
+	}()
+}
+
+// flagDuplicateVolumeId reports and quarantines v.Id when another data node
+// already serves it under a different layout key. It runs after registration
+// so a legitimate same-node move (disk type or collection change) settles
+// first and does not trip it. Every copy across the conflicting layouts is
+// quarantined: either could be the impostor, and arrival order must not
+// decide which copy stays writable.
+func (t *Topology) flagDuplicateVolumeId(v storage.VolumeInfo, dn *DataNode) {
+	// Every pass ends with a release: a conflict could resolve between the
+	// scan below and the marks, and a check finding no hits is also the retry
+	// a kept record waits for once its replica reports a readable layout.
+	defer t.releaseResolvedQuarantine(v.Id)
+	hits := t.findDuplicateVolumeLayouts(v, dn)
+	if len(hits) == 0 {
+		return
+	}
+	// This runs on a goroutine after registration, so the reporter's copy may
+	// already be unregistered (a finished move drops the losing copy). The
+	// surviving copies are then legitimate, and flagging them quarantines a
+	// healthy volume.
+	own := t.FindVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, types.ToDiskType(v.DiskType))
+	if own == nil || !own.HasDataNode(v.Id, dn) {
+		return
+	}
+	stats.MasterDuplicateVolumeIds.WithLabelValues(v.Collection, v.Id.String()).Inc()
+	var otherKeys []string
+	for _, h := range hits {
+		otherKeys = append(otherKeys, h.layoutKey())
+	}
+	glog.Errorf("duplicate volume id %d: %s reports it under %s but other data nodes also serve it under %s; marking all copies read-only", v.Id, dn.Id(), volumeLayoutKey(v.Collection, v.ReplicaPlacement, v.Ttl, types.ToDiskType(v.DiskType)), strings.Join(otherKeys, ", "))
+	quarantine := func(n *DataNode, vl *VolumeLayout) {
+		q := quarantinedVolume{n.Id(), v.Id}
+		reported := false
+		if vi, err := n.GetVolumesById(v.Id); err == nil {
+			reported = vi.ReadOnly
+		}
+		t.quarantineLock.Lock()
+		t.quarantinedVolumeIds.LoadOrStore(q, quarantinedVolumeState{reported: reported})
+		if vl != nil {
+			vl.SetVolumeQuarantined(n, v.Id)
+		}
+		t.quarantineLock.Unlock()
+		if t.QuarantineVolumeFn == nil {
+			return
+		}
+		pushed, err := t.pushQuarantine(n, v.Id, true)
+		if err != nil {
+			return
+		}
+		t.quarantineLock.Lock()
+		val, ok := t.quarantinedVolumeIds.Load(q)
+		if ok {
+			state := val.(quarantinedVolumeState)
+			state.enforced = state.enforced || pushed
+			t.quarantinedVolumeIds.Store(q, state)
+			t.quarantineLock.Unlock()
+			return
+		}
+		t.quarantineLock.Unlock()
+		if pushed && !reported {
+			// The conflict resolved while the push was in flight; leave the
+			// server consistent with the released layout.
+			t.releaseQuarantineWritable(n, v.Id)
+		}
+	}
+	quarantine(dn, own)
+	for _, h := range hits {
+		for _, n := range h.nodes {
+			quarantine(n, h.vl)
+		}
+	}
+}
+
+// releaseResolvedQuarantine lifts read-only marks once the conflicting copy
+// is gone, so a finished move does not leave the surviving copy quarantined.
+// The writable push is a remote call, so the locked pass only applies the
+// layout marks and records which replicas still need it; the pushes run
+// after the lock is dropped, a skipped push means a newer record re-armed
+// the pair so its quarantine stands, and a failed push re-adds the record
+// so a later release pass retries it.
+func (t *Topology) releaseResolvedQuarantine(vid needle.VolumeId) {
+	var writablePushes []*DataNode
+	t.quarantineLock.Lock()
+	t.quarantinedVolumeIds.Range(func(key, val any) bool {
+		q := key.(quarantinedVolume)
+		if q.vid != vid {
+			return true
+		}
+		dn, vl, vi := t.findQuarantinedVolume(q.dnId, vid)
+		if dn == nil {
+			t.quarantinedVolumeIds.Delete(key)
+			return true
+		}
+		if vi.ReplicaPlacement == nil {
+			// The replica is in the lookup index but unreadable on its node,
+			// so its layout key is unknown and the conflict cannot be ruled
+			// out; keep the mark for a later pass.
+			return true
+		}
+		if hits := t.findDuplicateVolumeLayouts(vi, dn); len(hits) > 0 {
+			return true
+		}
+		state, _ := val.(quarantinedVolumeState)
+		if state.reported {
+			dn.SetVolumeReadOnly(vid, true)
+			vl.SetReplicaReadOnlyFlag(dn, vid, true)
+		} else {
+			vl.SetVolumeWritable(dn, vid)
+			if state.enforced && t.QuarantineVolumeFn != nil {
+				writablePushes = append(writablePushes, dn)
+			}
+		}
+		t.quarantinedVolumeIds.Delete(key)
+		return true
+	})
+	t.quarantineLock.Unlock()
+	for _, dn := range writablePushes {
+		t.releaseQuarantineWritable(dn, vid)
+	}
+}
+
+// restoreQuarantineRecord re-adds a released record after a failed writable
+// push so the next volume report retries the release. An existing record keeps its
+// reported flag; the server is known read-only, so enforced and retry are set.
+// A record restored from scratch also gets its layout read-only mark back:
+// the release pass cleared it with the record, and leaving it cleared would
+// advertise a writable replica the server still holds read-only.
+func (t *Topology) restoreQuarantineRecord(dn *DataNode, vid needle.VolumeId) {
+	t.quarantineLock.Lock()
+	defer t.quarantineLock.Unlock()
+	key := quarantinedVolume{dn.Id(), vid}
+	if cur, ok := t.quarantinedVolumeIds.LoadOrStore(key, quarantinedVolumeState{enforced: true, retry: true}); ok {
+		state := cur.(quarantinedVolumeState)
+		state.enforced = true
+		state.retry = true
+		t.quarantinedVolumeIds.Store(key, state)
+		return
+	}
+	if _, vl, _ := t.findQuarantinedVolume(dn.Id(), vid); vl != nil {
+		vl.SetVolumeReadOnly(dn, vid)
+	}
+}
+
+func (t *Topology) findQuarantinedVolume(dnId NodeId, vid needle.VolumeId) (*DataNode, *VolumeLayout, storage.VolumeInfo) {
+	for _, item := range t.collectionMap.Items() {
+		for _, vl := range item.(*Collection).GetAllVolumeLayouts() {
+			for _, n := range vl.Lookup(vid) {
+				if n.Id() == dnId {
+					vi, _ := n.GetVolumesById(vid)
+					return n, vl, vi
+				}
+			}
+		}
+	}
+	return nil, nil, storage.VolumeInfo{}
+}
+
+// duplicateHit is one layout that holds v.Id on data nodes other than the
+// reporter's.
+type duplicateHit struct {
+	collection string
+	vl         *VolumeLayout
+	nodes      []*DataNode
+}
+
+func (h duplicateHit) layoutKey() string {
+	return volumeLayoutKey(h.collection, h.vl.rp, h.vl.ttl, h.vl.diskType)
+}
+
+func volumeLayoutKey(collection string, rp *super_block.ReplicaPlacement, ttl *needle.TTL, diskType types.DiskType) string {
+	return fmt.Sprintf("collection=%q rp=%s ttl=%s disk=%s", collection, rp, ttl, diskType)
+}
+
+func ttlEqual(a, b *needle.TTL) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+	return a.ToUint32() == b.ToUint32()
+}
+
+// findDuplicateVolumeLayouts reports every layout that already holds v.Id on
+// data nodes other than dn. Volume ids are global, so the same id held by two
+// nodes under two layouts means the allocator reused an id.
+func (t *Topology) findDuplicateVolumeLayouts(v storage.VolumeInfo, dn *DataNode) []duplicateHit {
+	if v.ReplicaPlacement == nil {
+		return nil
+	}
+	diskType := types.ToDiskType(v.DiskType)
+	var hits []duplicateHit
+	for _, item := range t.collectionMap.Items() {
+		c := item.(*Collection)
+		for _, vl := range c.GetAllVolumeLayouts() {
+			if c.Name == v.Collection && vl.diskType == diskType && ttlEqual(vl.ttl, v.Ttl) {
+				// The reporter's own layout, or an rp-only difference:
+				// a replication change rolls through the nodes one at a
+				// time, so the same volume legitimately reports the old
+				// and new rp while it settles.
+				continue
+			}
+			var others []*DataNode
+			for _, n := range vl.Lookup(v.Id) {
+				if n != dn {
+					others = append(others, n)
+				}
+			}
+			if len(others) > 0 {
+				hits = append(hits, duplicateHit{collection: c.Name, vl: vl, nodes: others})
+			}
+		}
+	}
+	return hits
 }
 
 func (t *Topology) UnRegisterVolumeLayout(v storage.VolumeInfo, dn *DataNode) {
 	glog.Infof("removing volume info: %+v from %v", v, dn.id)
-	if v.ReplicaPlacement.GetCopyCount() > 1 {
-		stats.MasterReplicaPlacementMismatch.WithLabelValues(v.Collection, v.Id.String()).Set(0)
-	}
+	defer t.releaseResolvedQuarantine(v.Id)
 	diskType := types.ToDiskType(v.DiskType)
 	volumeLayout := t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
 	volumeLayout.UnRegisterVolume(&v, dn)
+	// Drop the series only after the last placement is gone. Deleting while
+	// another data node still holds v would hide under-replication until the
+	// next CollectDeadNodeAndFullVolumes cycle recreates the label.
+	if v.ReplicaPlacement.GetCopyCount() > 1 && len(t.Lookup(v.Collection, v.Id)) == 0 {
+		stats.MasterReplicaPlacementMismatch.DeleteLabelValues(v.Collection, v.Id.String())
+	}
 	if volumeLayout.isEmpty() {
 		t.DeleteLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
 	}
@@ -546,6 +1090,54 @@ func (t *Topology) DataCenterExists(dcName string) bool {
 	return dcName == "" || t.GetDataCenter(dcName) != nil
 }
 
+// RackExists reports whether a rack with the id exists under dcName; an
+// empty dcName searches every data center, an empty rackName always matches.
+func (t *Topology) RackExists(dcName, rackName string) bool {
+	if rackName == "" {
+		return true
+	}
+	t.RLock()
+	defer t.RUnlock()
+	for _, c := range t.children {
+		if dcName != "" && string(c.Id()) != dcName {
+			continue
+		}
+		for _, r := range c.Children() {
+			if string(r.Id()) == rackName {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// DataNodeExists reports whether a data node with the id exists under
+// dcName/rackName; empty parents search every data center and rack, an empty
+// nodeId always matches.
+func (t *Topology) DataNodeExists(dcName, rackName, nodeId string) bool {
+	if nodeId == "" {
+		return true
+	}
+	t.RLock()
+	defer t.RUnlock()
+	for _, c := range t.children {
+		if dcName != "" && string(c.Id()) != dcName {
+			continue
+		}
+		for _, r := range c.Children() {
+			if rackName != "" && string(r.Id()) != rackName {
+				continue
+			}
+			for _, dn := range r.Children() {
+				if string(dn.Id()) == nodeId {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
+
 func (t *Topology) GetDataCenter(dcName string) (dc *DataCenter) {
 	t.RLock()
 	defer t.RUnlock()
@@ -594,7 +1186,7 @@ func (t *Topology) ListDCAndRacks() (dcs map[NodeId][]NodeId) {
 	return dcs
 }
 
-func (t *Topology) SyncDataNodeRegistration(volumes []*master_pb.VolumeInformationMessage, dn *DataNode) (newVolumes, deletedVolumes []storage.VolumeInfo) {
+func (t *Topology) SyncDataNodeRegistration(volumes []*master_pb.VolumeInformationMessage, dn *DataNode) (newVolumes, deletedVolumes, changedVolumes []storage.VolumeInfo) {
 	// convert into in memory struct storage.VolumeInfo
 	volumeInfos := make([]storage.VolumeInfo, 0, len(volumes))
 	for _, v := range volumes {
@@ -604,8 +1196,10 @@ func (t *Topology) SyncDataNodeRegistration(volumes []*master_pb.VolumeInformati
 			glog.V(0).Infof("Fail to convert joined volume information: %v", err)
 		}
 	}
+	for i := range volumeInfos {
+		volumeInfos[i] = t.enforceQuarantine(dn, volumeInfos[i])
+	}
 	// find out the delta volumes
-	var changedVolumes []storage.VolumeInfo
 	newVolumes, deletedVolumes, changedVolumes = dn.UpdateVolumes(volumeInfos)
 	for _, v := range newVolumes {
 		t.RegisterVolumeLayout(v, dn)
@@ -614,9 +1208,12 @@ func (t *Topology) SyncDataNodeRegistration(volumes []*master_pb.VolumeInformati
 		t.UnRegisterVolumeLayout(v, dn)
 	}
 	for _, v := range changedVolumes {
-		diskType := types.ToDiskType(v.DiskType)
-		vl := t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
-		vl.EnsureCorrectWritables(&v)
+		if v.ReplicaPlacement == nil {
+			continue
+		}
+		t.quarantineLock.Lock()
+		t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, types.ToDiskType(v.DiskType)).SetReplicaReadOnlyFlag(dn, v.Id, v.ReadOnly || t.isQuarantined(dn, v.Id))
+		t.quarantineLock.Unlock()
 	}
 	// Update effective sizes for all reported volumes (decay pending estimates).
 	// If decay brings a volume eagerly removed by RecordAssign back under the
@@ -635,19 +1232,31 @@ func (t *Topology) SyncDataNodeRegistration(volumes []*master_pb.VolumeInformati
 		// Without this, the volume stays visible in volume.list/admin UI yet
 		// LookupVolume returns "volume id not found".
 		if !vl.HasDataNode(v.Id, dn) {
-			// vl is already resolved above; call it directly instead of
-			// RegisterVolumeLayout, which would repeat the GetVolumeLayout lookup.
-			vl.RegisterVolume(&v, dn)
-			vl.EnsureCorrectWritables(&v)
+			for {
+				t.quarantineLock.Lock()
+				registered := vl.RegisterVolume(&v, dn, func(n *DataNode) bool {
+					return t.isQuarantined(n, v.Id)
+				})
+				t.quarantineLock.Unlock()
+				if registered {
+					break
+				}
+				// Dropped with its collection; the next lookup creates a fresh
+				// one, which the calls below must use too.
+				vl = t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
+			}
+			t.flagDuplicateVolumeIdAsync(v, dn)
 			// Volumes new to the disk map were registered above, so reaching
 			// here means only the lookup index had lost it. Clients were told
 			// it went when the node dropped out, so the repair has to tell them
 			// it is back.
 			newVolumes = append(newVolumes, v)
 		}
-		if vl.UpdateVolumeSize(v.Id, v.Size, v.CompactRevision) {
+		vl.UpdateOversizedState(&v, dn)
+		if vl.UpdateVolumeSize(v.Id, v.Size, v.CompactRevision, true) {
 			vl.AdjustActiveVolumeCountAfterRecovery(v.Id)
 		}
+		vl.EnsureCorrectWritables(&v)
 	}
 	return
 }
@@ -660,7 +1269,7 @@ func (t *Topology) IncrementalSyncDataNodeRegistration(newVolumes, deletedVolume
 			glog.V(0).Infof("NewVolumeInfoFromShort %v: %v", v, err)
 			continue
 		}
-		newVis = append(newVis, vi)
+		newVis = append(newVis, t.enforceQuarantine(dn, vi))
 	}
 	for _, v := range deletedVolumes {
 		vi, err := storage.NewVolumeInfoFromShort(v)
@@ -672,11 +1281,31 @@ func (t *Topology) IncrementalSyncDataNodeRegistration(newVolumes, deletedVolume
 	}
 	dn.DeltaUpdateVolumes(newVis, oldVis)
 
+	type layoutKey struct {
+		id               needle.VolumeId
+		collection       string
+		replicaPlacement byte
+		ttl              uint32
+		diskType         types.DiskType
+	}
+	key := func(vi storage.VolumeInfo) layoutKey {
+		return layoutKey{
+			id:               vi.Id,
+			collection:       vi.Collection,
+			replicaPlacement: vi.ReplicaPlacement.Byte(),
+			ttl:              vi.Ttl.ToUint32(),
+			diskType:         types.ToDiskType(vi.DiskType),
+		}
+	}
+	replacements := make(map[layoutKey]struct{}, len(newVis))
 	for _, vi := range newVis {
+		replacements[key(vi)] = struct{}{}
 		t.RegisterVolumeLayout(vi, dn)
 	}
-	for _, vi := range oldVis {
-		t.UnRegisterVolumeLayout(vi, dn)
+	for _, oldVi := range oldVis {
+		if _, replaced := replacements[key(oldVi)]; !replaced {
+			t.UnRegisterVolumeLayout(oldVi, dn)
+		}
 	}
 
 	return
@@ -689,7 +1318,10 @@ func (t *Topology) IncrementalSyncDataNodeRegistration(newVolumes, deletedVolume
 //
 // Most changes are a volume growing, which moves no location, so returning
 // only the arrivals keeps a busy cluster from telling every client about
-// volumes they can already reach.
+// volumes they can already reach. The arrival set also includes replicas whose
+// IsRemote() classification flipped on tier transition: the volume is still
+// servable from the same node, but every connected client has stale replica
+// priority and must be told to refresh.
 func (t *Topology) ApplyVolumeChanges(changed []*master_pb.VolumeInformationMessage, dn *DataNode) (newVolumes []storage.VolumeInfo) {
 	volumeInfos := make([]storage.VolumeInfo, 0, len(changed))
 	for _, v := range changed {
@@ -698,11 +1330,11 @@ func (t *Topology) ApplyVolumeChanges(changed []*master_pb.VolumeInformationMess
 			glog.V(0).Infof("Fail to convert changed volume information: %v", err)
 			continue
 		}
-		volumeInfos = append(volumeInfos, vi)
+		volumeInfos = append(volumeInfos, t.enforceQuarantine(dn, vi))
 	}
 
 	for _, vi := range volumeInfos {
-		isNew, _ := dn.AddOrUpdateVolume(vi)
+		isNew, isChanged, tierTransition := dn.AddOrUpdateVolume(vi)
 		if vi.ReplicaPlacement == nil {
 			if isNew {
 				newVolumes = append(newVolumes, vi)
@@ -714,16 +1346,34 @@ func (t *Topology) ApplyVolumeChanges(changed []*master_pb.VolumeInformationMess
 		// volume only that index had lost is an arrival as far as clients are
 		// concerned: they were told it went when the node dropped out.
 		becameServable := !vl.HasDataNode(vi.Id, dn)
-		if becameServable {
-			vl.RegisterVolume(&vi, dn)
+		for becameServable {
+			t.quarantineLock.Lock()
+			registered := vl.RegisterVolume(&vi, dn, func(n *DataNode) bool {
+				return t.isQuarantined(n, vi.Id)
+			})
+			t.quarantineLock.Unlock()
+			if registered {
+				break
+			}
+			// Dropped with its collection; the next lookup creates a fresh one.
+			vl = t.GetVolumeLayout(vi.Collection, vi.ReplicaPlacement, vi.Ttl, types.ToDiskType(vi.DiskType))
 		}
-		if isNew || becameServable {
+		if becameServable {
+			t.flagDuplicateVolumeIdAsync(vi, dn)
+		}
+		if isNew || becameServable || tierTransition || isChanged {
 			newVolumes = append(newVolumes, vi)
 		}
-		vl.EnsureCorrectWritables(&vi)
-		if vl.UpdateVolumeSize(vi.Id, vi.Size, vi.CompactRevision) {
+		if isChanged {
+			t.quarantineLock.Lock()
+			vl.SetReplicaReadOnlyFlag(dn, vi.Id, vi.ReadOnly || t.isQuarantined(dn, vi.Id))
+			t.quarantineLock.Unlock()
+		}
+		vl.UpdateOversizedState(&vi, dn)
+		if vl.UpdateVolumeSize(vi.Id, vi.Size, vi.CompactRevision, true) {
 			vl.AdjustActiveVolumeCountAfterRecovery(vi.Id)
 		}
+		vl.EnsureCorrectWritables(&vi)
 	}
 	return newVolumes
 }
@@ -804,3 +1454,215 @@ func (t *Topology) SetTopologyId(topologyId string) {
 		glog.Fatalf("Split-brain detected! Current TopologyId is %s, but received %s. Stopping to prevent data corruption.", t.topologyId, topologyId)
 	}
 }
+
+func (t *Topology) SetGrowthFreezeConfig(freezeOnMismatch bool, recoveryWait time.Duration) {
+	t.freezeOnMismatch.Store(freezeOnMismatch)
+	t.stateLossRecoveryWait.Store(int64(recoveryWait))
+}
+
+// CheckReportedTopologyId freezes growth when a volume server reports a
+// topology id different from this cluster's: the topology id survives raft
+// state cleanup, so a mismatch means the master's state was rebuilt (or a
+// foreign disk was cloned in).
+func (t *Topology) CheckReportedTopologyId(reported string) {
+	if reported == "" || !t.freezeOnMismatch.Load() {
+		return
+	}
+	own := t.GetTopologyId()
+	if own == "" {
+		// The local topology id is still being minted. Keep the report so a
+		// later heartbeat echo cannot erase the mismatch on the server side
+		// before the freeze check ever ran.
+		t.reportedTopologyIdsLock.Lock()
+		if t.pendingReportedTopologyIds == nil {
+			t.pendingReportedTopologyIds = make(map[string]struct{})
+		}
+		t.pendingReportedTopologyIds[reported] = struct{}{}
+		t.reportedTopologyIdsLock.Unlock()
+		return
+	}
+	if reported == own {
+		return
+	}
+	t.growthFrozenAt.Store(time.Now().UnixNano())
+	if t.growthFrozen.CompareAndSwap(false, true) {
+		stats.MasterVolumeGrowthFrozen.Set(1)
+		glog.Errorf("volume growth frozen: a volume server reports topology id %s but this cluster is %s; the master state was rebuilt. Verify the cluster inventory, then run: volume.growth.resume", reported, own)
+		t.applyGrowthFreeze(true)
+	}
+}
+
+func (t *Topology) IsGrowthFrozen() bool {
+	if !t.growthFrozen.Load() {
+		return false
+	}
+	if wait := t.stateLossRecoveryWait.Load(); wait > 0 {
+		if time.Duration(time.Now().UnixNano()-t.growthFrozenAt.Load()) > time.Duration(wait) {
+			if t.growthFrozen.CompareAndSwap(true, false) {
+				stats.MasterVolumeGrowthFrozen.Set(0)
+				glog.V(0).Infof("volume growth unfrozen after %v", time.Duration(wait))
+			}
+			return false
+		}
+	}
+	return true
+}
+
+func (t *Topology) ResumeVolumeGrowth() bool {
+	if !t.growthFrozen.CompareAndSwap(true, false) {
+		return false
+	}
+	stats.MasterVolumeGrowthFrozen.Set(0)
+	glog.V(0).Infof("volume growth resumed by operator")
+	t.applyGrowthFreeze(false)
+	return true
+}
+
+// SetGrowthFrozen applies a replicated freeze state on every master. The
+// timestamp lands before the flag so a reader can never see frozen with a
+// zero time and misjudge the auto-resume window.
+func (t *Topology) SetGrowthFrozen(frozen bool) {
+	if frozen {
+		t.growthFrozenAt.Store(time.Now().UnixNano())
+		if t.growthFrozen.CompareAndSwap(false, true) {
+			stats.MasterVolumeGrowthFrozen.Set(1)
+			glog.V(0).Infof("volume growth freeze applied from raft")
+		}
+		return
+	}
+	if t.growthFrozen.CompareAndSwap(true, false) {
+		stats.MasterVolumeGrowthFrozen.Set(0)
+	}
+}
+
+// applyGrowthFreeze replicates the freeze flag so followers keep it across a
+// leader change. No raft server (single-master test topologies) just sets it.
+func (t *Topology) applyGrowthFreeze(frozen bool) {
+	cmd := NewMaxVolumeIdCommand(t.GetMaxVolumeId(), t.GetTopologyId())
+	cmd.GrowthFrozen = &frozen
+	t.RaftServerAccessLock.RLock()
+	defer t.RaftServerAccessLock.RUnlock()
+	if t.RaftServer != nil {
+		if _, err := t.RaftServer.Do(cmd); err != nil {
+			glog.Warningf("apply growth freeze %v: %v", frozen, err)
+		}
+	} else if t.HashicorpRaft != nil {
+		if b, err := json.Marshal(cmd); err != nil {
+			glog.Warningf("marshal growth freeze %v: %v", frozen, err)
+		} else if future := t.HashicorpRaft.Apply(b, time.Second); future.Error() != nil {
+			glog.Warningf("apply growth freeze %v: %v", frozen, future.Error())
+		}
+	} else {
+		t.SetGrowthFrozen(frozen)
+	}
+}
+
+// SetTopologyInitPending gates allocation while a topology id is being
+// minted, so growth cannot slip in before the warmup window is installed.
+func (t *Topology) SetTopologyInitPending(pending bool) {
+	t.topologyInitPending.Store(pending)
+	if pending {
+		return
+	}
+	t.reportedTopologyIdsLock.Lock()
+	reported := t.pendingReportedTopologyIds
+	t.pendingReportedTopologyIds = nil
+	t.reportedTopologyIdsLock.Unlock()
+	for id := range reported {
+		t.CheckReportedTopologyId(id)
+	}
+}
+
+// DeferAllocation holds off new id allocation for d. Called when the leader
+// mints a fresh topology id: on a rebuilt master that window gives veteran
+// servers a pulse to raise the bound or trip the freeze.
+func (t *Topology) DeferAllocation(d time.Duration) {
+	t.allocationNotBefore.Store(time.Now().Add(d).UnixNano())
+}
+
+func (t *Topology) allocationDelay() time.Duration {
+	return time.Until(time.Unix(0, t.allocationNotBefore.Load()))
+}
+
+// SetMaxVolumeIdFile mirrors the allocation bound to a file outside raft, so
+// a master whose raft state is gone still restores a safe boundary. An
+// existing file seeds both the bound and the topology id.
+func (t *Topology) SetMaxVolumeIdFile(file string) {
+	t.maxVolumeIdFile = file
+	data, err := os.ReadFile(file)
+	if err != nil {
+		return
+	}
+	cmd := &MaxVolumeIdCommand{}
+	if err := json.Unmarshal(data, cmd); err != nil {
+		glog.Warningf("corrupt max volume id file %s: %v", file, err)
+		return
+	}
+	t.lastPersistedMaxVolumeId.Store(uint32(cmd.MaxVolumeId))
+	t.lastPersistedTopologyId.Store(cmd.TopologyId)
+	t.UpAdjustMaxVolumeId(cmd.MaxVolumeId)
+	if cmd.TopologyId != "" {
+		t.SetTopologyId(cmd.TopologyId)
+	}
+	if cmd.GrowthFrozen != nil {
+		t.lastPersistedGrowthFrozen.Store(*cmd.GrowthFrozen)
+		t.SetGrowthFrozen(*cmd.GrowthFrozen)
+	}
+}
+
+// PersistMaxVolumeId writes the bound to the mirror file. Called by the
+// leader before a raft apply and by both raft implementations on apply and
+// recovery, so follower mirrors stay current too.
+func (t *Topology) PersistMaxVolumeId(vid needle.VolumeId) error {
+	topoId := t.GetTopologyId()
+	frozen := t.IsGrowthFrozen()
+	mirrored := func() bool {
+		return t.lastPersistedMaxVolumeId.Load() >= uint32(vid) && t.lastPersistedTopologyId.Load() == topoId && t.lastPersistedGrowthFrozen.Load() == frozen
+	}
+	if mirrored() {
+		return nil
+	}
+	t.maxVolumeIdFileLock.Lock()
+	defer t.maxVolumeIdFileLock.Unlock()
+	if mirrored() {
+		return nil
+	}
+	if t.maxVolumeIdFile == "" {
+		t.lastPersistedMaxVolumeId.Store(uint32(vid))
+		t.lastPersistedTopologyId.Store(topoId)
+		t.lastPersistedGrowthFrozen.Store(frozen)
+		return nil
+	}
+	cmd := NewMaxVolumeIdCommand(vid, topoId)
+	cmd.GrowthFrozen = &frozen
+	b, err := json.Marshal(cmd)
+	if err != nil {
+		return err
+	}
+	tmp := t.maxVolumeIdFile + ".tmp"
+	f, err := os.OpenFile(tmp, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return err
+	}
+	if _, err := f.Write(b); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Sync(); err != nil {
+		f.Close()
+		return err
+	}
+	if err := f.Close(); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, t.maxVolumeIdFile); err != nil {
+		return err
+	}
+	if err := util.FsyncDir(filepath.Dir(t.maxVolumeIdFile)); err != nil {
+		return err
+	}
+	t.lastPersistedMaxVolumeId.Store(uint32(vid))
+	t.lastPersistedTopologyId.Store(topoId)
+	t.lastPersistedGrowthFrozen.Store(frozen)
+	return nil
+}
diff --git a/weed/topology/topology_event_handling.go b/weed/topology/topology_event_handling.go
index 8772ecb891..1793ff0e93 100644
--- a/weed/topology/topology_event_handling.go
+++ b/weed/topology/topology_event_handling.go
@@ -13,12 +13,17 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/storage"
 )
 
-func (t *Topology) StartRefreshWritableVolumes(grpcDialOption grpc.DialOption, garbageThreshold float64, concurrentVacuumLimitPerVolumeServer int, growThreshold float64, preallocate int64) {
+func (t *Topology) StartRefreshWritableVolumes(grpcDialOption grpc.DialOption, garbageThreshold float64, concurrentVacuumLimitPerVolumeServer int, concurrentVacuumLimitPerRack int, growThreshold float64, preallocate int64, vacuumInterval time.Duration, deleteEmptyAfter time.Duration) {
+	if vacuumInterval <= 0 {
+		vacuumInterval = 14 * time.Minute
+	}
 	go func() {
 		for {
 			if t.IsLeader() {
 				freshThreshHold := time.Now().Unix() - 3*t.pulse //3 times of sleep interval
 				t.CollectDeadNodeAndFullVolumes(freshThreshHold, t.volumeSizeLimit, growThreshold)
+				t.DecayQuietVolumeSizes()
+				t.retryPendingQuarantineReleases()
 			}
 			time.Sleep(time.Duration(float32(t.pulse*1e3)*(1+rand.Float32())) * time.Millisecond)
 		}
@@ -35,12 +40,12 @@ func (t *Topology) StartRefreshWritableVolumes(grpcDialOption grpc.DialOption, g
 					t.EnableVacuumByPlugin()
 				}
 				if !t.IsVacuumDisabled() {
-					t.Vacuum(grpcDialOption, garbageThreshold, concurrentVacuumLimitPerVolumeServer, 0, "", preallocate, true)
+					t.Vacuum(grpcDialOption, garbageThreshold, concurrentVacuumLimitPerVolumeServer, concurrentVacuumLimitPerRack, 0, "", preallocate, true, deleteEmptyAfter)
 				}
 			} else {
 				stats.MasterReplicaPlacementMismatch.Reset()
 			}
-			time.Sleep(14*time.Minute + time.Duration(120*rand.Float32())*time.Second)
+			time.Sleep(vacuumInterval + time.Duration(120*rand.Float32())*time.Second)
 		}
 	}(garbageThreshold)
 	go func() {
@@ -88,6 +93,25 @@ func (t *Topology) SetVolumeCrowded(volumeInfo storage.VolumeInfo) {
 	vl.SetVolumeCrowded(volumeInfo.Id)
 }
 
+// SetDataNodeMaintenanceMode records the maintenance flag a volume server
+// reported and returns whether it changed. On a change every volume the node
+// holds is re-evaluated: while the flag is on, a volume with a replica there
+// leaves the writable list, so no writes are assigned to it and the server can
+// be drained; once the flag is off the volumes are writable again. Reads are
+// untouched, and volume growth skips the node through AvailableSpaceFor.
+func (t *Topology) SetDataNodeMaintenanceMode(dn *DataNode, on bool) (changed bool) {
+	if !dn.SetMaintenanceMode(on) {
+		return false
+	}
+	glog.V(0).Infof("volume server %s maintenance mode: %v", dn.Id(), on)
+	for _, v := range dn.GetVolumes() {
+		diskType := types.ToDiskType(v.DiskType)
+		vl := t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
+		vl.EnsureCorrectWritables(&v)
+	}
+	return true
+}
+
 func (t *Topology) UnRegisterDataNode(dn *DataNode) {
 	dn.IsTerminating = true
 	for _, v := range dn.GetVolumes() {
@@ -95,6 +119,8 @@ func (t *Topology) UnRegisterDataNode(dn *DataNode) {
 		diskType := types.ToDiskType(v.DiskType)
 		vl := t.GetVolumeLayout(v.Collection, v.ReplicaPlacement, v.Ttl, diskType)
 		vl.SetVolumeUnavailable(dn, v.Id)
+		// this node may have been the conflicting copy pinning a quarantine
+		defer t.releaseResolvedQuarantine(v.Id)
 	}
 
 	// unregister ec shards when volume server disconnected
diff --git a/weed/topology/topology_info.go b/weed/topology/topology_info.go
index 1c9bfa6b99..11dc0f8556 100644
--- a/weed/topology/topology_info.go
+++ b/weed/topology/topology_info.go
@@ -87,6 +87,12 @@ func (t *Topology) ToVolumeMap() interface{} {
 	return m
 }
 
+// ToVolumeLocations snapshots every data node's volume set into a list of
+// per-node VolumeLocation messages. NewVids carries every volume; RemoteVids
+// repeats the remote-tier subset so clients can route reads to a local
+// replica first when one exists on any node. EC shards are flattened into
+// NewEcVids so each vid is reported once even when its shards live on
+// multiple disks of the same node.
 func (t *Topology) ToVolumeLocations() (volumeLocations []*master_pb.VolumeLocation) {
 	for _, c := range t.Children() {
 		dc := c.(*DataCenter)
@@ -100,11 +106,9 @@ func (t *Topology) ToVolumeLocations() (volumeLocations []*master_pb.VolumeLocat
 					DataCenter: dn.GetDataCenterId(),
 					GrpcPort:   uint32(dn.GrpcPort),
 				}
-				dnVolumes := dn.GetVolumes()
-				volumeLocation.NewVids = make([]uint32, 0, len(dnVolumes))
-				for _, v := range dnVolumes {
-					volumeLocation.NewVids = append(volumeLocation.NewVids, uint32(v.Id))
-				}
+
+				volumeLocation.NewVids, volumeLocation.RemoteVids, volumeLocation.ReadOnlyVids, volumeLocation.ReadOnlyCanDeleteVids = dn.AppendVolumeIds(nil, nil, nil, nil)
+
 				// A single EC volume's shards can live on multiple disks of
 				// one DataNode, so GetEcShards returns per-(vid,disk) entries.
 				// Dedupe so the snapshot carries each vid once.
@@ -124,14 +128,14 @@ func (t *Topology) ToVolumeLocations() (volumeLocations []*master_pb.VolumeLocat
 	return
 }
 
-func (t *Topology) ToTopologyInfo() *master_pb.TopologyInfo {
+func (t *Topology) ToTopologyInfo(filter VolumeFilter) *master_pb.TopologyInfo {
 	m := &master_pb.TopologyInfo{
 		Id:        string(t.Id()),
 		DiskInfos: t.diskUsages.ToDiskInfo(),
 	}
 	for _, c := range t.Children() {
 		dc := c.(*DataCenter)
-		m.DataCenterInfos = append(m.DataCenterInfos, dc.ToDataCenterInfo())
+		m.DataCenterInfos = append(m.DataCenterInfos, dc.ToDataCenterInfo(filter))
 	}
 	return m
 }
diff --git a/weed/topology/topology_test.go b/weed/topology/topology_test.go
index 32c3ad7e44..e761ede3c5 100644
--- a/weed/topology/topology_test.go
+++ b/weed/topology/topology_test.go
@@ -2,17 +2,19 @@ package topology
 
 import (
 	"reflect"
+	"testing"
+	"time"
 
+	"github.com/prometheus/client_golang/prometheus/testutil"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/sequence"
+	"github.com/seaweedfs/seaweedfs/weed/stats"
 	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
-
-	"testing"
 )
 
 func TestRemoveDataCenter(t *testing.T) {
@@ -88,7 +90,7 @@ func TestHandlingVolumeServerHeartbeat(t *testing.T) {
 		for k := 1; k <= volumeCount; k++ {
 			volumeMessage := &master_pb.VolumeInformationMessage{
 				Id:               uint32(k),
-				Size:             uint64(254320),
+				Size:             uint64(30000),
 				Collection:       "",
 				FileCount:        uint64(2343),
 				DeleteCount:      uint64(345),
@@ -166,6 +168,103 @@ func TestHandlingVolumeServerHeartbeat(t *testing.T) {
 
 }
 
+func TestIncrementalSyncReplacesVolumeReadOnlyState(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		fromReadOnly bool
+		toReadOnly   bool
+	}{
+		{name: "writable to read-only", toReadOnly: true},
+		{name: "read-only to writable", fromReadOnly: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+			dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+				GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", map[string]uint32{"": 25})
+			volume := func(readOnly bool) *master_pb.VolumeShortInformationMessage {
+				return &master_pb.VolumeShortInformationMessage{
+					Id: 1, Collection: "c", Version: uint32(needle.GetCurrentVersion()), ReadOnly: readOnly,
+				}
+			}
+
+			oldVolume := volume(tc.fromReadOnly)
+			topo.IncrementalSyncDataNodeRegistration([]*master_pb.VolumeShortInformationMessage{oldVolume}, nil, dn)
+			topo.IncrementalSyncDataNodeRegistration(
+				[]*master_pb.VolumeShortInformationMessage{volume(tc.toReadOnly)},
+				[]*master_pb.VolumeShortInformationMessage{oldVolume}, dn)
+
+			locations := topo.Lookup("c", needle.VolumeId(1))
+			if len(locations) != 1 || locations[0] != dn {
+				t.Fatalf("lookup locations = %v, want only %v", locations, dn)
+			}
+			stored, err := dn.GetVolumesById(needle.VolumeId(1))
+			if err != nil || stored.ReadOnly != tc.toReadOnly {
+				t.Fatalf("stored volume = %+v, err = %v, want read-only %t", stored, err, tc.toReadOnly)
+			}
+			rp, _ := super_block.NewReplicaPlacementFromString("000")
+			active, _ := topo.GetVolumeLayout("c", rp, needle.EMPTY_TTL, types.HardDriveType).GetWritableVolumeCount()
+			want := 0
+			if !tc.toReadOnly {
+				want = 1
+			}
+			if active != want {
+				t.Fatalf("writable count = %d, want %d", active, want)
+			}
+			if !dn.HasConsistentVolumeIndex() {
+				t.Fatal("replacement left the held and servable volume indexes inconsistent")
+			}
+		})
+	}
+}
+
+func TestIncrementalSyncRegistersMovedVolumeBeforeRemoval(t *testing.T) {
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", map[string]uint32{"": 25, "ssd": 25})
+	oldVolume := &master_pb.VolumeShortInformationMessage{
+		Id: 1, Collection: "c", Version: uint32(needle.GetCurrentVersion()),
+	}
+	newVolume := &master_pb.VolumeShortInformationMessage{
+		Id: 1, Collection: "c", Version: uint32(needle.GetCurrentVersion()), DiskType: "ssd",
+	}
+	topo.IncrementalSyncDataNodeRegistration([]*master_pb.VolumeShortInformationMessage{oldVolume}, nil, dn)
+
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	oldLayout := topo.GetVolumeLayout("c", rp, needle.EMPTY_TTL, types.HardDriveType)
+	newLayout := topo.GetVolumeLayout("c", rp, needle.EMPTY_TTL, types.SsdType)
+	oldLayout.accessLock.Lock()
+	done := make(chan struct{})
+	go func() {
+		topo.IncrementalSyncDataNodeRegistration(
+			[]*master_pb.VolumeShortInformationMessage{newVolume},
+			[]*master_pb.VolumeShortInformationMessage{oldVolume}, dn)
+		close(done)
+	}()
+
+	deadline := time.NewTimer(time.Second)
+	defer deadline.Stop()
+	ticker := time.NewTicker(time.Millisecond)
+	defer ticker.Stop()
+	movedBeforeRemoval := false
+	for !movedBeforeRemoval {
+		select {
+		case <-deadline.C:
+			oldLayout.accessLock.Unlock()
+			<-done
+			t.Fatal("destination layout was not registered before source removal")
+		case <-ticker.C:
+			movedBeforeRemoval = len(newLayout.Lookup(needle.VolumeId(1))) == 1
+		}
+	}
+	oldLayout.accessLock.Unlock()
+	<-done
+
+	locations := topo.Lookup("c", needle.VolumeId(1))
+	if len(locations) != 1 || locations[0] != dn {
+		t.Fatalf("lookup locations = %v, want only %v", locations, dn)
+	}
+}
+
 func TestDataNodeToDataNodeInfo_IncludeEmptyDiskFromUsage(t *testing.T) {
 	dn := NewDataNode("node-1")
 	dn.Ip = "127.0.0.1"
@@ -176,7 +275,7 @@ func TestDataNodeToDataNodeInfo_IncludeEmptyDiskFromUsage(t *testing.T) {
 	usage := dn.diskUsages.getOrCreateDisk(types.HardDriveType)
 	usage.maxVolumeCount = 8
 
-	info := dn.ToDataNodeInfo()
+	info := dn.ToDataNodeInfo(VolumeFilter{})
 	diskInfo, found := info.DiskInfos[""]
 	if !found {
 		t.Fatalf("expected default disk entry for empty node")
@@ -235,6 +334,94 @@ func TestAddRemoveVolume(t *testing.T) {
 	}
 }
 
+func TestUnRegisterVolumeLayoutClearsReplicaPlacementMismatchMetric(t *testing.T) {
+	stats.MasterReplicaPlacementMismatch.Reset()
+	t.Cleanup(stats.MasterReplicaPlacementMismatch.Reset)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+
+	dc := topo.GetOrCreateDataCenter("dc1")
+	rack := dc.GetOrCreateRack("rack1")
+	maxVolumeCounts := map[string]uint32{"": 25}
+	dn := rack.GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", maxVolumeCounts)
+
+	rp, err := super_block.NewReplicaPlacementFromString("001")
+	if err != nil {
+		t.Fatalf("NewReplicaPlacementFromString: %v", err)
+	}
+	v := storage.VolumeInfo{
+		Id:               needle.VolumeId(42),
+		Size:             100,
+		Collection:       "metrics-test",
+		ReplicaPlacement: rp,
+		Ttl:              needle.EMPTY_TTL,
+	}
+
+	dn.UpdateVolumes([]storage.VolumeInfo{v})
+	topo.RegisterVolumeLayout(v, dn)
+
+	stats.MasterReplicaPlacementMismatch.WithLabelValues(v.Collection, v.Id.String()).Set(1)
+	if n := testutil.CollectAndCount(stats.MasterReplicaPlacementMismatch); n != 1 {
+		t.Fatalf("expected 1 replica_placement_mismatch series, got %d", n)
+	}
+
+	topo.UnRegisterVolumeLayout(v, dn)
+
+	if n := testutil.CollectAndCount(stats.MasterReplicaPlacementMismatch); n != 0 {
+		t.Errorf("%d replica_placement_mismatch series left after volume left topology", n)
+	}
+}
+
+func TestUnRegisterVolumeLayoutKeepsReplicaPlacementMismatchMetricWhilePlacementsRemain(t *testing.T) {
+	stats.MasterReplicaPlacementMismatch.Reset()
+	t.Cleanup(stats.MasterReplicaPlacementMismatch.Reset)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+
+	dc := topo.GetOrCreateDataCenter("dc1")
+	rack := dc.GetOrCreateRack("rack1")
+	maxVolumeCounts := map[string]uint32{"": 25}
+	dn1 := rack.GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", maxVolumeCounts)
+	dn2 := rack.GetOrCreateDataNode("127.0.0.1", 34535, 0, "127.0.0.1", "", maxVolumeCounts)
+
+	rp, err := super_block.NewReplicaPlacementFromString("001")
+	if err != nil {
+		t.Fatalf("NewReplicaPlacementFromString: %v", err)
+	}
+	v := storage.VolumeInfo{
+		Id:               needle.VolumeId(42),
+		Size:             100,
+		Collection:       "metrics-test",
+		ReplicaPlacement: rp,
+		Ttl:              needle.EMPTY_TTL,
+	}
+
+	dn1.UpdateVolumes([]storage.VolumeInfo{v})
+	dn2.UpdateVolumes([]storage.VolumeInfo{v})
+	topo.RegisterVolumeLayout(v, dn1)
+	topo.RegisterVolumeLayout(v, dn2)
+
+	stats.MasterReplicaPlacementMismatch.WithLabelValues(v.Collection, v.Id.String()).Set(1)
+	if n := testutil.CollectAndCount(stats.MasterReplicaPlacementMismatch); n != 1 {
+		t.Fatalf("expected 1 replica_placement_mismatch series, got %d", n)
+	}
+
+	topo.UnRegisterVolumeLayout(v, dn1)
+
+	if n := testutil.CollectAndCount(stats.MasterReplicaPlacementMismatch); n != 1 {
+		t.Errorf("expected series to remain while %s still holds the volume, got %d", dn2.Id(), n)
+	}
+	if got := len(topo.Lookup(v.Collection, v.Id)); got != 1 {
+		t.Fatalf("expected 1 remaining placement, got %d", got)
+	}
+
+	topo.UnRegisterVolumeLayout(v, dn2)
+
+	if n := testutil.CollectAndCount(stats.MasterReplicaPlacementMismatch); n != 0 {
+		t.Errorf("%d replica_placement_mismatch series left after last placement left", n)
+	}
+}
+
 func TestVolumeReadOnlyStatusChange(t *testing.T) {
 	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
 
@@ -320,7 +507,7 @@ func TestVolumeReadOnlyAndRemoteStatusChange(t *testing.T) {
 	// Simultaneously change to read-only AND remote
 	v.ReadOnly = true
 	v.RemoteStorageName = "s3"
-	v.RemoteStorageKey = "key1"
+	v.RemoteStorageName = "s3.default"
 	dn.UpdateVolumes([]storage.VolumeInfo{v})
 
 	// Check counts after both changes
@@ -340,7 +527,7 @@ func TestVolumeReadOnlyAndRemoteStatusChange(t *testing.T) {
 	// Change back to local AND read-only simultaneously
 	v.ReadOnly = true
 	v.RemoteStorageName = ""
-	v.RemoteStorageKey = ""
+	v.RemoteStorageName = ""
 	dn.UpdateVolumes([]storage.VolumeInfo{v})
 
 	// Check final counts
@@ -664,7 +851,7 @@ func TestSetVolumeAvailableRepairsMissingVolume(t *testing.T) {
 	}
 
 	// The vacuum commit re-marks the volume available; it must re-register it.
-	vl.SetVolumeAvailable(dn, vid, false, false)
+	vl.SetVolumeAvailable(dn, vid, false, false, false)
 	if got := topo.Lookup("", vid); len(got) != 1 {
 		t.Fatalf("after SetVolumeAvailable: lookup %d got %v, want 1 location", vid, got)
 	}
@@ -677,3 +864,48 @@ func TestSetVolumeAvailableRepairsMissingVolume(t *testing.T) {
 		t.Fatalf("after SetVolumeAvailable: size tracking for %d not seeded", vid)
 	}
 }
+
+// A read-only change that arrives in the regular heartbeat must reach the
+// layout's per-replica flag, which the vacuum sweep consults. Registration
+// and volume.mark already set it; the heartbeat path did not.
+func TestFullHeartbeatUpdatesLayoutReadOnlyFlag(t *testing.T) {
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", map[string]uint32{"": 25})
+	report := func(readOnly bool) []*master_pb.VolumeInformationMessage {
+		return []*master_pb.VolumeInformationMessage{{
+			Id: 1, Collection: "c", Size: 1 << 20, Version: uint32(needle.GetCurrentVersion()), ReadOnly: readOnly,
+		}}
+	}
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	flag := func() bool {
+		vl := topo.GetVolumeLayout("c", rp, needle.EMPTY_TTL, types.HardDriveType)
+		vl.accessLock.RLock()
+		defer vl.accessLock.RUnlock()
+		return vl.vid2location[needle.VolumeId(1)].AnyReadOnly()
+	}
+
+	// the full list, which a server sends first and whenever the digests disagree
+	topo.SyncDataNodeRegistration(report(false), dn)
+	if flag() {
+		t.Fatal("volume registered writable is flagged read-only")
+	}
+	topo.SyncDataNodeRegistration(report(true), dn)
+	if !flag() {
+		t.Fatal("full heartbeat turned the volume read-only but the layout flag did not follow")
+	}
+	topo.SyncDataNodeRegistration(report(false), dn)
+	if flag() {
+		t.Fatal("full heartbeat turned the volume writable again but the layout flag stayed read-only")
+	}
+
+	// the changed-volumes delta, which is what a running server normally sends
+	topo.ApplyVolumeChanges(report(true), dn)
+	if !flag() {
+		t.Fatal("delta heartbeat turned the volume read-only but the layout flag did not follow")
+	}
+	topo.ApplyVolumeChanges(report(false), dn)
+	if flag() {
+		t.Fatal("delta heartbeat turned the volume writable again but the layout flag stayed read-only")
+	}
+}
diff --git a/weed/topology/topology_vacuum.go b/weed/topology/topology_vacuum.go
index 0205459d56..ea6de330f4 100644
--- a/weed/topology/topology_vacuum.go
+++ b/weed/topology/topology_vacuum.go
@@ -13,21 +13,41 @@ import (
 
 	"google.golang.org/grpc"
 
+	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 )
 
+// vacuumPhaseTimeout bounds one synchronous vacuum RPC, scaled with the
+// volume size limit, so a stalled volume server cannot hold the vacuum
+// guard forever.
+var vacuumPhaseTimeout = time.Minute
+
+func (t *Topology) vacuumRPCTimeout() time.Duration {
+	return vacuumPhaseTimeout * time.Duration(t.volumeSizeLimit/1024/1024/1000+1)
+}
+
 func (t *Topology) batchVacuumVolumeCheck(grpcDialOption grpc.DialOption, vid needle.VolumeId,
-	locationlist *VolumeLocationList, garbageThreshold float64) (*VolumeLocationList, bool) {
+	locationlist *VolumeLocationList, garbageThreshold float64, skipReadOnly bool) (*VolumeLocationList, bool) {
 	ch := make(chan int, locationlist.Length())
 	errCount := int32(0)
+	ctx, cancel := context.WithTimeout(context.Background(), t.vacuumRPCTimeout())
+	defer cancel()
 	for index, dn := range locationlist.list {
-		go func(index int, url pb.ServerAddress, vid needle.VolumeId) {
+		go func(index int, dn *DataNode, url pb.ServerAddress, vid needle.VolumeId) {
+			// A replica tiered to remote storage cannot be compacted in place,
+			// whatever its garbage ratio; volume.tier.compact reclaims it.
+			if v, lookErr := dn.GetVolumesById(vid); lookErr == nil && v.IsRemote() {
+				glog.V(1).Infof("skip vacuuming volume %d on %s: tiered to %s", vid, url, v.RemoteStorageName)
+				ch <- -1
+				return
+			}
 			err := operation.WithVolumeServerClient(false, url, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-				resp, err := volumeServerClient.VacuumVolumeCheck(context.Background(), &volume_server_pb.VacuumVolumeCheckRequest{
+				resp, err := volumeServerClient.VacuumVolumeCheck(ctx, &volume_server_pb.VacuumVolumeCheckRequest{
 					VolumeId: uint32(vid),
 				})
 				if err != nil {
@@ -35,6 +55,21 @@ func (t *Topology) batchVacuumVolumeCheck(grpcDialOption grpc.DialOption, vid ne
 					ch <- -1
 					return err
 				}
+				// A sweep skips a read-only copy unless low disk space is its
+				// only read-only cause — that is the copy compaction exists for.
+				if skipReadOnly {
+					v, lookErr := dn.GetVolumesById(vid)
+					if lookErr != nil {
+						atomic.AddInt32(&errCount, 1)
+						ch <- -1
+						return lookErr
+					}
+					if v.ReadOnly && !resp.DiskSpaceLow {
+						glog.V(0).Infof("skip vacuuming read-only volume %d on %s", vid, url)
+						ch <- -1
+						return nil
+					}
+				}
 				if resp.GarbageRatio >= garbageThreshold {
 					ch <- index
 				} else {
@@ -45,20 +80,17 @@ func (t *Topology) batchVacuumVolumeCheck(grpcDialOption grpc.DialOption, vid ne
 			if err != nil {
 				glog.V(0).Infof("Checking vacuuming %d on %s: %v", vid, url, err)
 			}
-		}(index, dn.ServerAddress(), vid)
+		}(index, dn, dn.ServerAddress(), vid)
 	}
 	vacuumLocationList := NewVolumeLocationList()
 
-	waitTimeout := time.NewTimer(time.Minute * time.Duration(t.volumeSizeLimit/1024/1024/1000+1))
-	defer waitTimeout.Stop()
-
 	for range locationlist.list {
 		select {
 		case index := <-ch:
 			if index != -1 {
 				vacuumLocationList.list = append(vacuumLocationList.list, locationlist.list[index])
 			}
-		case <-waitTimeout.C:
+		case <-ctx.Done():
 			return vacuumLocationList, false
 		}
 	}
@@ -70,11 +102,13 @@ func (t *Topology) batchVacuumVolumeCompact(grpcDialOption grpc.DialOption, vl *
 	vl.DrainAndRemoveFromWritable(vid)
 
 	ch := make(chan bool, locationlist.Length())
+	ctx, cancel := context.WithTimeout(context.Background(), 3*t.vacuumRPCTimeout())
+	defer cancel()
 	for index, dn := range locationlist.list {
 		go func(index int, url pb.ServerAddress, vid needle.VolumeId) {
 			glog.V(0).Infoln(index, "Start vacuuming", vid, "on", url)
 			err := operation.WithVolumeServerClient(true, url, grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-				stream, err := volumeServerClient.VacuumVolumeCompact(context.Background(), &volume_server_pb.VacuumVolumeCompactRequest{
+				stream, err := volumeServerClient.VacuumVolumeCompact(ctx, &volume_server_pb.VacuumVolumeCompactRequest{
 					VolumeId:    uint32(vid),
 					Preallocate: preallocate,
 				})
@@ -107,14 +141,11 @@ func (t *Topology) batchVacuumVolumeCompact(grpcDialOption grpc.DialOption, vl *
 	}
 	isVacuumSuccess := true
 
-	waitTimeout := time.NewTimer(3 * time.Minute * time.Duration(t.volumeSizeLimit/1024/1024/1000+1))
-	defer waitTimeout.Stop()
-
 	for range locationlist.list {
 		select {
 		case canCommit := <-ch:
 			isVacuumSuccess = isVacuumSuccess && canCommit
-		case <-waitTimeout.C:
+		case <-ctx.Done():
 			return false
 		}
 	}
@@ -128,7 +159,9 @@ func (t *Topology) batchVacuumVolumeCommit(grpcDialOption grpc.DialOption, vl *V
 	for _, dn := range vacuumLocationList.list {
 		glog.V(0).Infoln("Start Committing vacuum", vid, "on", dn.Url())
 		err := operation.WithVolumeServerClient(false, dn.ServerAddress(), grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-			resp, err := volumeServerClient.VacuumVolumeCommit(context.Background(), &volume_server_pb.VacuumVolumeCommitRequest{
+			ctx, cancel := context.WithTimeout(context.Background(), t.vacuumRPCTimeout())
+			defer cancel()
+			resp, err := volumeServerClient.VacuumVolumeCommit(ctx, &volume_server_pb.VacuumVolumeCommitRequest{
 				VolumeId: uint32(vid),
 			})
 			if resp != nil {
@@ -161,7 +194,9 @@ func (t *Topology) batchVacuumVolumeCommit(grpcDialOption grpc.DialOption, vl *V
 			}
 			if !isFound {
 				err := operation.WithVolumeServerClient(false, dn.ServerAddress(), grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-					resp, err := volumeServerClient.VolumeStatus(context.Background(), &volume_server_pb.VolumeStatusRequest{
+					ctx, cancel := context.WithTimeout(context.Background(), t.vacuumRPCTimeout())
+					defer cancel()
+					resp, err := volumeServerClient.VolumeStatus(ctx, &volume_server_pb.VolumeStatusRequest{
 						VolumeId: uint32(vid),
 					})
 					if resp != nil {
@@ -191,7 +226,9 @@ func (t *Topology) batchVacuumVolumeCommit(grpcDialOption grpc.DialOption, vl *V
 		vl.accessLock.Unlock()
 
 		for _, dn := range vacuumLocationList.list {
-			vl.SetVolumeAvailable(dn, vid, isReadOnly, isFullCapacity)
+			t.quarantineLock.Lock()
+			vl.SetVolumeAvailable(dn, vid, isReadOnly, isFullCapacity, t.isQuarantined(dn, vid))
+			t.quarantineLock.Unlock()
 		}
 	}
 	return isCommitSuccess
@@ -201,7 +238,9 @@ func (t *Topology) batchVacuumVolumeCleanup(grpcDialOption grpc.DialOption, vl *
 	for _, dn := range locationlist.list {
 		glog.V(0).Infoln("Start cleaning up", vid, "on", dn.Url())
 		err := operation.WithVolumeServerClient(false, dn.ServerAddress(), grpcDialOption, func(volumeServerClient volume_server_pb.VolumeServerClient) error {
-			_, err := volumeServerClient.VacuumVolumeCleanup(context.Background(), &volume_server_pb.VacuumVolumeCleanupRequest{
+			ctx, cancel := context.WithTimeout(context.Background(), t.vacuumRPCTimeout())
+			defer cancel()
+			_, err := volumeServerClient.VacuumVolumeCleanup(ctx, &volume_server_pb.VacuumVolumeCleanupRequest{
 				VolumeId: uint32(vid),
 			})
 			return err
@@ -214,7 +253,7 @@ func (t *Topology) batchVacuumVolumeCleanup(grpcDialOption grpc.DialOption, vl *
 	}
 }
 
-func (t *Topology) Vacuum(grpcDialOption grpc.DialOption, garbageThreshold float64, maxParallelVacuumPerServer int, volumeId uint32, collection string, preallocate int64, automatic bool) {
+func (t *Topology) Vacuum(grpcDialOption grpc.DialOption, garbageThreshold float64, maxParallelVacuumPerServer int, maxParallelVacuumPerRack int, volumeId uint32, collection string, preallocate int64, automatic bool, deleteEmptyAfter time.Duration) {
 
 	// if there is vacuum going on, return immediately
 	swapped := atomic.CompareAndSwapInt64(&t.vacuumLockCounter, 0, 1)
@@ -248,7 +287,7 @@ func (t *Topology) Vacuum(grpcDialOption grpc.DialOption, garbageThreshold float
 						t.vacuumOneVolumeId(grpcDialOption, volumeLayout, c, garbageThreshold, locationList, vid, preallocate, false)
 					}
 				} else {
-					t.vacuumOneVolumeLayout(grpcDialOption, volumeLayout, c, garbageThreshold, maxParallelVacuumPerServer, preallocate, automatic)
+					t.vacuumOneVolumeLayout(grpcDialOption, volumeLayout, c, garbageThreshold, maxParallelVacuumPerServer, maxParallelVacuumPerRack, preallocate, automatic, deleteEmptyAfter)
 				}
 			}
 			if automatic && t.IsVacuumDisabled() {
@@ -262,7 +301,7 @@ func (t *Topology) Vacuum(grpcDialOption grpc.DialOption, garbageThreshold float
 	}
 }
 
-func (t *Topology) vacuumOneVolumeLayout(grpcDialOption grpc.DialOption, volumeLayout *VolumeLayout, c *Collection, garbageThreshold float64, maxParallelVacuumPerServer int, preallocate int64, automatic bool) {
+func (t *Topology) vacuumOneVolumeLayout(grpcDialOption grpc.DialOption, volumeLayout *VolumeLayout, c *Collection, garbageThreshold float64, maxParallelVacuumPerServer int, maxParallelVacuumPerRack int, preallocate int64, automatic bool, deleteEmptyAfter time.Duration) {
 
 	volumeLayout.accessLock.RLock()
 	todoVolumeMap := make(map[needle.VolumeId]*VolumeLocationList)
@@ -271,55 +310,100 @@ func (t *Topology) vacuumOneVolumeLayout(grpcDialOption grpc.DialOption, volumeL
 	}
 	volumeLayout.accessLock.RUnlock()
 
-	// limiter for each volume server
+	// Empty volumes hold their slots forever: deleting them here also spares
+	// compacting bytes that are all deleted already.
+	if deleteEmptyAfter > 0 {
+		t.deleteEmptyVolumes(grpcDialOption, volumeLayout, todoVolumeMap, deleteEmptyAfter)
+	}
+
+	// limiter for each volume server, and for each rack when a rack cap is
+	// set — several volume servers can share one rack's disks and network.
+	// Rack keys are resolved once up front: a node that unregisters mid-sweep
+	// loses its parent, and a later GetRack call would panic.
 	limiter := make(map[NodeId]int)
+	rackLimiter := make(map[Node]int)
+	dnRack := make(map[*DataNode]Node)
 	var limiterLock sync.Mutex
 	for _, locationList := range todoVolumeMap {
 		for _, dn := range locationList.list {
 			if _, ok := limiter[dn.Id()]; !ok {
 				limiter[dn.Id()] = maxParallelVacuumPerServer
 			}
+			if maxParallelVacuumPerRack > 0 {
+				if _, ok := dnRack[dn]; !ok {
+					dnRack[dn] = vacuumRackKey(dn)
+				}
+				if _, ok := rackLimiter[dnRack[dn]]; !ok {
+					rackLimiter[dnRack[dn]] = maxParallelVacuumPerRack
+				}
+			}
 		}
 	}
 
 	executor := util.NewLimitedConcurrentExecutor(100)
 
 	var wg sync.WaitGroup
+	quotaFreed := make(chan struct{}, 1)
 
 	for len(todoVolumeMap) > 0 {
 		pendingVolumeMap := make(map[needle.VolumeId]*VolumeLocationList)
 		for vid, locationList := range todoVolumeMap {
-			hasEnoughQuota := true
+			// copies on the same server or rack reserve together; a volume
+			// that alone exceeds a cap waits for the whole bucket to be free
+			// instead of pending forever
+			serverNeeds := make(map[NodeId]int)
+			rackNeeds := make(map[Node]int)
 			for _, dn := range locationList.list {
-				limiterLock.Lock()
-				quota := limiter[dn.Id()]
-				limiterLock.Unlock()
-				if quota <= 0 {
+				serverNeeds[dn.Id()]++
+				if maxParallelVacuumPerRack > 0 {
+					rackNeeds[dnRack[dn]]++
+				}
+			}
+			limiterLock.Lock()
+			hasEnoughQuota := true
+			for id, need := range serverNeeds {
+				serverNeeds[id] = min(need, maxParallelVacuumPerServer)
+				if limiter[id] < serverNeeds[id] {
+					hasEnoughQuota = false
+				}
+			}
+			for id, need := range rackNeeds {
+				rackNeeds[id] = min(need, maxParallelVacuumPerRack)
+				if rackLimiter[id] < rackNeeds[id] {
 					hasEnoughQuota = false
-					break
 				}
 			}
 			if !hasEnoughQuota {
+				limiterLock.Unlock()
 				pendingVolumeMap[vid] = locationList
 				continue
 			}
 
 			// debit the quota
-			for _, dn := range locationList.list {
-				limiterLock.Lock()
-				limiter[dn.Id()]--
-				limiterLock.Unlock()
+			for id, need := range serverNeeds {
+				limiter[id] -= need
 			}
+			for id, need := range rackNeeds {
+				rackLimiter[id] -= need
+			}
+			limiterLock.Unlock()
 
 			wg.Add(1)
 			executor.Execute(func() {
 				defer wg.Done()
 				t.vacuumOneVolumeId(grpcDialOption, volumeLayout, c, garbageThreshold, locationList, vid, preallocate, true)
 				// credit the quota
-				for _, dn := range locationList.list {
-					limiterLock.Lock()
-					limiter[dn.Id()]++
-					limiterLock.Unlock()
+				limiterLock.Lock()
+				for id, need := range serverNeeds {
+					limiter[id] += need
+				}
+				for id, need := range rackNeeds {
+					rackLimiter[id] += need
+				}
+				limiterLock.Unlock()
+				select {
+				case quotaFreed <- struct{}{}:
+				default:
 				}
 			})
 			if automatic && t.IsVacuumDisabled() {
@@ -330,7 +414,10 @@ func (t *Topology) vacuumOneVolumeLayout(grpcDialOption grpc.DialOption, volumeL
 			break
 		}
 		if len(todoVolumeMap) == len(pendingVolumeMap) {
-			time.Sleep(10 * time.Second)
+			select {
+			case <-quotaFreed:
+			case <-time.After(10 * time.Second):
+			}
 		}
 		todoVolumeMap = pendingVolumeMap
 	}
@@ -339,19 +426,28 @@ func (t *Topology) vacuumOneVolumeLayout(grpcDialOption grpc.DialOption, volumeL
 
 }
 
+// vacuumRackKey identifies a data node's rack by the rack node itself, so
+// racks that share a name in different data centers still get separate
+// quotas. A node that already lost its parent falls back to itself,
+// degrading to the per-server cap.
+func vacuumRackKey(dn *DataNode) Node {
+	if rack := dn.Parent(); rack != nil {
+		return rack
+	}
+	return dn
+}
+
 // skipReadOnly is set by the background scan and all-volumes sweep, where a
-// read-only flag usually means an unhealthy disk. An explicit volumeId clears
-// it so a benignly read-only (full/oversized) volume can be reclaimed.
+// read-only flag usually means an unhealthy disk. Even then a copy that is
+// read-only because its disk is low on space stays eligible — compaction is
+// how the space comes back. An explicit volumeId clears the rule entirely.
 func (t *Topology) vacuumOneVolumeId(grpcDialOption grpc.DialOption, volumeLayout *VolumeLayout, c *Collection, garbageThreshold float64, locationList *VolumeLocationList, vid needle.VolumeId, preallocate int64, skipReadOnly bool) {
 	volumeLayout.accessLock.RLock()
 	isReadOnly := volumeLayout.vid2location[vid].AnyReadOnly()
 	isEnoughCopies := volumeLayout.enoughCopies(vid)
 	volumeLayout.accessLock.RUnlock()
 
-	if isReadOnly {
-		if skipReadOnly {
-			return
-		}
+	if isReadOnly && !skipReadOnly {
 		glog.V(0).Infof("vacuuming read-only volume %d on explicit request", vid)
 	}
 	if !isEnoughCopies {
@@ -361,7 +457,7 @@ func (t *Topology) vacuumOneVolumeId(grpcDialOption grpc.DialOption, volumeLayou
 
 	glog.V(1).Infof("check vacuum on collection:%s volume:%d", c.Name, vid)
 	if vacuumLocationList, needVacuum := t.batchVacuumVolumeCheck(
-		grpcDialOption, vid, locationList, garbageThreshold); needVacuum {
+		grpcDialOption, vid, locationList, garbageThreshold, skipReadOnly); needVacuum {
 		if t.batchVacuumVolumeCompact(grpcDialOption, volumeLayout, vid, vacuumLocationList, preallocate) {
 			t.batchVacuumVolumeCommit(grpcDialOption, volumeLayout, vid, vacuumLocationList, locationList)
 		} else {
@@ -369,3 +465,74 @@ func (t *Topology) vacuumOneVolumeId(grpcDialOption grpc.DialOption, volumeLayou
 		}
 	}
 }
+
+// deleteEmptyVolumes removes a volume whose every replica copy has stayed
+// empty and quiet for quietPeriod, the same rule volume.deleteEmpty applies
+// on demand. A copy that still holds data or was written recently keeps the
+// whole volume: deleting only the empty copies would silently cut the
+// surviving copy's replica count. Fully deleted vids leave the sweep's work
+// map; anything else falls through to the normal compaction path.
+func (t *Topology) deleteEmptyVolumes(grpcDialOption grpc.DialOption, vl *VolumeLayout, todoVolumeMap map[needle.VolumeId]*VolumeLocationList, quietPeriod time.Duration) {
+	quietSeconds := int64(quietPeriod / time.Second)
+	nowUnixSeconds := time.Now().Unix()
+	for vid, locationList := range todoVolumeMap {
+		eligible := true
+		for _, dn := range locationList.list {
+			v, err := dn.GetVolumesById(vid)
+			if err != nil || !isEmptyVolumeDeleteCandidate(v, quietSeconds, nowUnixSeconds) {
+				eligible = false
+				break
+			}
+		}
+		if !eligible {
+			continue
+		}
+		// keep the volume out of assignments for the whole delete: a heartbeat
+		// landing mid-delete must not re-add it while replicas are dropping
+		vl.MarkDeleting(vid)
+		remaining := 0
+		kept := locationList.list[:0]
+		for _, dn := range locationList.list {
+			v, err := dn.GetVolumesById(vid)
+			if err == nil {
+				onlyGarbage := v.FileCount > 0 && v.FileCount <= v.DeleteCount
+				glog.V(0).Infof("deleting empty volume %d on %s", vid, dn.ServerAddress())
+				if err = t.deleteEmptyVolume(grpcDialOption, dn, vid, onlyGarbage); err == nil {
+					t.UnRegisterVolumeLayout(v, dn)
+					continue
+				}
+			}
+			glog.Warningf("delete empty volume %d on %s: %v", vid, dn.ServerAddress(), err)
+			kept = append(kept, dn)
+			remaining++
+		}
+		vl.UnmarkDeleting(vid)
+		locationList.list = kept
+		if remaining == 0 {
+			delete(todoVolumeMap, vid)
+		}
+	}
+}
+
+func (t *Topology) deleteEmptyVolume(grpcDialOption grpc.DialOption, dn *DataNode, vid needle.VolumeId, onlyGarbage bool) error {
+	return operation.WithVolumeServerClient(false, dn.ServerAddress(), grpcDialOption, func(client volume_server_pb.VolumeServerClient) error {
+		// onlyEmpty stays set so a pre-upgrade server checks emptiness and
+		// refuses instead of deleting a volume that changed since the report.
+		ctx, cancel := context.WithTimeout(context.Background(), allocateVolumeTimeout)
+		defer cancel()
+		_, err := client.VolumeDelete(ctx, &volume_server_pb.VolumeDeleteRequest{
+			VolumeId:    uint32(vid),
+			OnlyEmpty:   true,
+			OnlyGarbage: onlyGarbage,
+		})
+		return err
+	})
+}
+
+func isEmptyVolumeDeleteCandidate(v storage.VolumeInfo, quietSeconds, nowUnixSeconds int64) bool {
+	return v.RemoteStorageName == "" &&
+		(!v.ReadOnly || v.ReadOnlyCanDelete) &&
+		(v.Size <= super_block.SuperBlockSize || v.FileCount > 0 && v.FileCount <= v.DeleteCount) &&
+		v.ModifiedAtSecond > 0 &&
+		v.ModifiedAtSecond+quietSeconds < nowUnixSeconds
+}
diff --git a/weed/topology/topology_vacuum_test.go b/weed/topology/topology_vacuum_test.go
new file mode 100644
index 0000000000..106011d594
--- /dev/null
+++ b/weed/topology/topology_vacuum_test.go
@@ -0,0 +1,762 @@
+package topology
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/sequence"
+	"github.com/seaweedfs/seaweedfs/weed/storage"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+func TestIsEmptyVolumeDeleteCandidate(t *testing.T) {
+	now := time.Now().Unix()
+	old := now - 7200
+	base := storage.VolumeInfo{
+		Size:             0,
+		ModifiedAtSecond: old,
+	}
+	for _, tc := range []struct {
+		name  string
+		v     storage.VolumeInfo
+		quiet int64
+		want  bool
+	}{
+		{"empty and quiet", base, 3600, true},
+		{"all garbage and quiet", storage.VolumeInfo{Size: 1 << 20, FileCount: 100, DeleteCount: 100, ModifiedAtSecond: old}, 3600, true},
+		{"remote-backed", storage.VolumeInfo{Size: 0, ModifiedAtSecond: old, RemoteStorageName: "s3"}, 3600, false},
+		{"read-only without delete permission", storage.VolumeInfo{Size: 0, ModifiedAtSecond: old, ReadOnly: true}, 3600, false},
+		{"read-only can delete", storage.VolumeInfo{Size: 0, ModifiedAtSecond: old, ReadOnly: true, ReadOnlyCanDelete: true}, 3600, true},
+		{"live files", storage.VolumeInfo{Size: 1 << 20, FileCount: 100, DeleteCount: 50, ModifiedAtSecond: old}, 3600, false},
+		{"no live files but oversized is fine", storage.VolumeInfo{Size: 1 << 20, FileCount: 100, DeleteCount: 100, ModifiedAtSecond: old}, 3600, true},
+		{"unreported mtime", storage.VolumeInfo{Size: 0}, 3600, false},
+		{"still quiet-recent", storage.VolumeInfo{Size: 0, ModifiedAtSecond: now - 60}, 3600, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isEmptyVolumeDeleteCandidate(tc.v, tc.quiet, now); got != tc.want {
+				t.Errorf("isEmptyVolumeDeleteCandidate() = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+type fakeVolumeDeleteServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	mu      sync.Mutex
+	deletes []*volume_server_pb.VolumeDeleteRequest
+}
+
+func (f *fakeVolumeDeleteServer) VolumeDelete(ctx context.Context, req *volume_server_pb.VolumeDeleteRequest) (*volume_server_pb.VolumeDeleteResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.deletes = append(f.deletes, req)
+	return &volume_server_pb.VolumeDeleteResponse{}, nil
+}
+
+func startFakeVolumeServer(t *testing.T, vs volume_server_pb.VolumeServerServer) (grpcPort int, dialOption grpc.DialOption) {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(srv, vs)
+	serveErr := make(chan error, 1)
+	go func() { serveErr <- srv.Serve(lis) }()
+	t.Cleanup(func() {
+		srv.Stop()
+		if err := <-serveErr; err != nil && !errors.Is(err, grpc.ErrServerStopped) {
+			t.Errorf("fake volume server: %v", err)
+		}
+	})
+	return lis.Addr().(*net.TCPAddr).Port, grpc.WithTransportCredentials(insecure.NewCredentials())
+}
+
+func TestDeleteEmptyVolumesDeletesOnlyQuietEmptyCopies(t *testing.T) {
+	fake := &fakeVolumeDeleteServer{}
+	grpcPort, dialOption := startFakeVolumeServer(t, fake)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+	dn := rack.GetOrCreateDataNode("127.0.0.1", 8080, grpcPort, "127.0.0.1", fmt.Sprintf("dn-%d", grpcPort), map[string]uint32{"": 10})
+
+	now := time.Now().Unix()
+	old := now - 7200
+	volume := func(id int, size uint64, files, deleted uint32, mtime int64) storage.VolumeInfo {
+		return storage.VolumeInfo{
+			Id:               needle.VolumeId(id),
+			Size:             size,
+			Collection:       "c",
+			FileCount:        files,
+			DeleteCount:      deleted,
+			ModifiedAtSecond: mtime,
+			Version:          needle.GetCurrentVersion(),
+			ReplicaPlacement: &super_block.ReplicaPlacement{},
+			Ttl:              needle.EMPTY_TTL,
+		}
+	}
+	quietEmpty := volume(1, 0, 0, 0, old)
+	quietGarbage := volume(2, 1<<20, 100, 100, old)
+	recentEmpty := volume(3, 0, 0, 0, now)
+	live := volume(4, 1<<20, 100, 50, old)
+
+	todo := make(map[needle.VolumeId]*VolumeLocationList)
+	dn.UpdateVolumes([]storage.VolumeInfo{quietEmpty, quietGarbage, recentEmpty, live})
+	for _, v := range []storage.VolumeInfo{quietEmpty, quietGarbage, recentEmpty, live} {
+		topo.RegisterVolumeLayout(v, dn)
+		ll := NewVolumeLocationList()
+		ll.list = append(ll.list, dn)
+		todo[v.Id] = ll
+	}
+
+	vl := topo.GetVolumeLayout("c", &super_block.ReplicaPlacement{}, needle.EMPTY_TTL, types.ToDiskType(""))
+	topo.deleteEmptyVolumes(dialOption, vl, todo, time.Hour)
+
+	if _, ok := todo[quietEmpty.Id]; ok {
+		t.Error("quiet empty volume stayed in the sweep map")
+	}
+	if _, ok := todo[quietGarbage.Id]; ok {
+		t.Error("quiet all-garbage volume stayed in the sweep map")
+	}
+	for _, v := range []storage.VolumeInfo{recentEmpty, live} {
+		if _, ok := todo[v.Id]; !ok {
+			t.Errorf("volume %d was deleted though not an empty-quiet candidate", v.Id)
+		}
+	}
+
+	fake.mu.Lock()
+	defer fake.mu.Unlock()
+	if len(fake.deletes) != 2 {
+		t.Fatalf("VolumeDelete calls = %d, want 2", len(fake.deletes))
+	}
+	got := map[uint32]*volume_server_pb.VolumeDeleteRequest{}
+	for _, d := range fake.deletes {
+		if !d.OnlyEmpty {
+			t.Errorf("VolumeDelete %d missing the onlyEmpty guard", d.VolumeId)
+		}
+		got[d.VolumeId] = d
+	}
+	if got[uint32(quietEmpty.Id)].OnlyGarbage {
+		t.Error("truly empty volume deleted with onlyGarbage")
+	}
+	if !got[uint32(quietGarbage.Id)].OnlyGarbage {
+		t.Error("all-garbage volume should carry onlyGarbage")
+	}
+}
+
+// A volume whose sibling replica holds live files is not "empty": deleting
+// the empty copy would silently cut the live copy's replica count, so the
+// whole vid is left alone.
+func TestDeleteEmptyVolumesSkipsVidWithLiveReplica(t *testing.T) {
+	fake := &fakeVolumeDeleteServer{}
+	grpcPort, dialOption := startFakeVolumeServer(t, fake)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+	emptyDn := rack.GetOrCreateDataNode("127.0.0.1", 8080, grpcPort, "127.0.0.1", "dn-empty", map[string]uint32{"": 10})
+	liveDn := rack.GetOrCreateDataNode("127.0.0.2", 8080, 1, "127.0.0.2", "dn-live", map[string]uint32{"": 10})
+
+	now := time.Now().Unix()
+	v := storage.VolumeInfo{
+		Id:               needle.VolumeId(1),
+		Size:             0,
+		Collection:       "c",
+		ModifiedAtSecond: now - 7200,
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: &super_block.ReplicaPlacement{},
+		Ttl:              needle.EMPTY_TTL,
+	}
+	live := storage.VolumeInfo{
+		Id:               v.Id,
+		Size:             1 << 20,
+		Collection:       "c",
+		FileCount:        100,
+		DeleteCount:      50,
+		ModifiedAtSecond: now - 7200,
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: &super_block.ReplicaPlacement{},
+		Ttl:              needle.EMPTY_TTL,
+	}
+	emptyDn.UpdateVolumes([]storage.VolumeInfo{v})
+	liveDn.UpdateVolumes([]storage.VolumeInfo{live})
+	topo.RegisterVolumeLayout(v, emptyDn)
+	topo.RegisterVolumeLayout(live, liveDn)
+
+	ll := NewVolumeLocationList()
+	ll.list = append(ll.list, emptyDn, liveDn)
+	todo := map[needle.VolumeId]*VolumeLocationList{v.Id: ll}
+
+	vl := topo.GetVolumeLayout("c", &super_block.ReplicaPlacement{}, needle.EMPTY_TTL, types.ToDiskType(""))
+	topo.deleteEmptyVolumes(dialOption, vl, todo, time.Hour)
+
+	if _, ok := todo[v.Id]; !ok {
+		t.Fatal("vid left the sweep map while a live replica keeps it")
+	}
+	fake.mu.Lock()
+	defer fake.mu.Unlock()
+	if len(fake.deletes) != 0 {
+		t.Fatalf("VolumeDelete calls = %d, want 0 (a live sibling keeps the whole vid)", len(fake.deletes))
+	}
+}
+
+// With every copy eligible a copy whose delete RPC fails keeps the vid in the
+// sweep map; the deleted copy is gone but the vid falls through to the normal
+// compaction path for its surviving replicas.
+func TestDeleteEmptyVolumesKeepsVidWhenCopyDeleteFails(t *testing.T) {
+	fake := &fakeVolumeDeleteServer{}
+	grpcPort, dialOption := startFakeVolumeServer(t, fake)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+	emptyDn := rack.GetOrCreateDataNode("127.0.0.1", 8080, grpcPort, "127.0.0.1", "dn-empty", map[string]uint32{"": 10})
+	deadDn := rack.GetOrCreateDataNode("127.0.0.2", 8080, 1, "127.0.0.2", "dn-dead", map[string]uint32{"": 10})
+
+	now := time.Now().Unix()
+	v := storage.VolumeInfo{
+		Id:               needle.VolumeId(1),
+		Size:             0,
+		Collection:       "c",
+		ModifiedAtSecond: now - 7200,
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: &super_block.ReplicaPlacement{},
+		Ttl:              needle.EMPTY_TTL,
+	}
+	emptyDn.UpdateVolumes([]storage.VolumeInfo{v})
+	deadDn.UpdateVolumes([]storage.VolumeInfo{v})
+	topo.RegisterVolumeLayout(v, emptyDn)
+	topo.RegisterVolumeLayout(v, deadDn)
+
+	ll := NewVolumeLocationList()
+	ll.list = append(ll.list, emptyDn, deadDn)
+	todo := map[needle.VolumeId]*VolumeLocationList{v.Id: ll}
+
+	vl := topo.GetVolumeLayout("c", &super_block.ReplicaPlacement{}, needle.EMPTY_TTL, types.ToDiskType(""))
+	topo.deleteEmptyVolumes(dialOption, vl, todo, time.Hour)
+
+	if _, ok := todo[v.Id]; !ok {
+		t.Fatal("vid left the sweep map while a replica delete failed")
+	}
+	fake.mu.Lock()
+	defer fake.mu.Unlock()
+	if len(fake.deletes) != 1 {
+		t.Fatalf("VolumeDelete calls = %d, want 1 (only the reachable copy)", len(fake.deletes))
+	}
+}
+
+type fakeVacuumServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+	mu             sync.Mutex
+	checks         map[uint32]*volume_server_pb.VacuumVolumeCheckResponse
+	committed      []uint32
+	compactErr     error
+	hang           string
+	entered        chan string
+	cancelled      chan struct{}
+	compactGate    chan struct{}
+	compactTracker *compactTracker
+}
+
+type compactTracker struct {
+	mu       sync.Mutex
+	inFlight int
+	max      int
+}
+
+func (t *compactTracker) maxInFlight() int {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.max
+}
+
+func (f *fakeVacuumServer) stall(ctx context.Context, phase string) error {
+	select {
+	case f.entered <- phase:
+	default:
+	}
+	<-ctx.Done()
+	f.mu.Lock()
+	if f.cancelled != nil {
+		select {
+		case <-f.cancelled:
+		default:
+			close(f.cancelled)
+		}
+	}
+	f.mu.Unlock()
+	return ctx.Err()
+}
+
+func (f *fakeVacuumServer) VacuumVolumeCheck(ctx context.Context, req *volume_server_pb.VacuumVolumeCheckRequest) (*volume_server_pb.VacuumVolumeCheckResponse, error) {
+	if f.hang == "check" {
+		return nil, f.stall(ctx, "check")
+	}
+	resp, ok := f.checks[req.VolumeId]
+	if !ok {
+		return nil, fmt.Errorf("volume %d not found", req.VolumeId)
+	}
+	return resp, nil
+}
+
+func (f *fakeVacuumServer) VacuumVolumeCompact(_ *volume_server_pb.VacuumVolumeCompactRequest, stream volume_server_pb.VolumeServer_VacuumVolumeCompactServer) error {
+	if f.hang == "compact" {
+		return f.stall(stream.Context(), "compact")
+	}
+	if f.compactGate != nil {
+		select {
+		case f.entered <- "compact":
+		default:
+		}
+		f.compactTracker.mu.Lock()
+		f.compactTracker.inFlight++
+		if f.compactTracker.inFlight > f.compactTracker.max {
+			f.compactTracker.max = f.compactTracker.inFlight
+		}
+		f.compactTracker.mu.Unlock()
+		defer func() {
+			f.compactTracker.mu.Lock()
+			f.compactTracker.inFlight--
+			f.compactTracker.mu.Unlock()
+		}()
+		select {
+		case <-f.compactGate:
+		case <-stream.Context().Done():
+			return stream.Context().Err()
+		}
+	}
+	return f.compactErr
+}
+
+func (f *fakeVacuumServer) VacuumVolumeCommit(ctx context.Context, req *volume_server_pb.VacuumVolumeCommitRequest) (*volume_server_pb.VacuumVolumeCommitResponse, error) {
+	if f.hang == "commit" {
+		return nil, f.stall(ctx, "commit")
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.committed = append(f.committed, req.VolumeId)
+	return &volume_server_pb.VacuumVolumeCommitResponse{IsReadOnly: true}, nil
+}
+
+func (f *fakeVacuumServer) VacuumVolumeCleanup(ctx context.Context, _ *volume_server_pb.VacuumVolumeCleanupRequest) (*volume_server_pb.VacuumVolumeCleanupResponse, error) {
+	if f.hang == "cleanup" {
+		return nil, f.stall(ctx, "cleanup")
+	}
+	return &volume_server_pb.VacuumVolumeCleanupResponse{}, nil
+}
+
+func (f *fakeVacuumServer) VolumeStatus(ctx context.Context, _ *volume_server_pb.VolumeStatusRequest) (*volume_server_pb.VolumeStatusResponse, error) {
+	if f.hang == "status" {
+		return nil, f.stall(ctx, "status")
+	}
+	return &volume_server_pb.VolumeStatusResponse{}, nil
+}
+
+// A sweep keeps a read-only replica eligible only when the volume server
+// reports disk_space_low; other read-only causes stay skipped unless the
+// request names the volume explicitly.
+func TestVacuumReadOnlyDiskLowVolume(t *testing.T) {
+	fake := &fakeVacuumServer{
+		checks: map[uint32]*volume_server_pb.VacuumVolumeCheckResponse{
+			1: {GarbageRatio: 0.9, DiskSpaceLow: true},
+			2: {GarbageRatio: 0.9},
+			3: {GarbageRatio: 0.9},
+			4: {GarbageRatio: 0.1, DiskSpaceLow: true},
+			5: {GarbageRatio: 0.9},
+		},
+	}
+	grpcPort, dialOption := startFakeVolumeServer(t, fake)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, grpcPort, "127.0.0.1", "dn", map[string]uint32{"": 10})
+
+	newVolumeInfo := func(vid needle.VolumeId, readOnly bool) storage.VolumeInfo {
+		return storage.VolumeInfo{
+			Id:               vid,
+			Size:             1 << 20,
+			Collection:       "c",
+			ReadOnly:         readOnly,
+			ModifiedAtSecond: time.Now().Unix(),
+			Version:          needle.GetCurrentVersion(),
+			ReplicaPlacement: &super_block.ReplicaPlacement{},
+			Ttl:              needle.EMPTY_TTL,
+		}
+	}
+	vl := topo.GetVolumeLayout("c", &super_block.ReplicaPlacement{}, needle.EMPTY_TTL, types.ToDiskType(""))
+	volumes := []storage.VolumeInfo{
+		newVolumeInfo(1, true),
+		newVolumeInfo(2, true),
+		newVolumeInfo(3, false),
+		newVolumeInfo(4, true),
+		newVolumeInfo(5, true),
+	}
+	dn.UpdateVolumes(volumes)
+	for _, v := range volumes {
+		topo.RegisterVolumeLayout(v, dn)
+	}
+	c := NewCollection("c", topo.volumeSizeLimit, false)
+
+	vacuum := func(vid needle.VolumeId, skipReadOnly bool) {
+		vl.accessLock.RLock()
+		ll := vl.vid2location[vid].Copy()
+		vl.accessLock.RUnlock()
+		topo.vacuumOneVolumeId(dialOption, vl, c, 0.3, ll, vid, 0, skipReadOnly)
+	}
+
+	vacuum(1, true)  // read-only but disk_low: compacted
+	vacuum(2, true)  // read-only otherwise: skipped by sweep
+	vacuum(3, true)  // writable: compacted
+	vacuum(4, true)  // disk_low but below threshold: skipped
+	vacuum(5, false) // read-only, explicit request: compacted
+
+	fake.mu.Lock()
+	defer fake.mu.Unlock()
+	want := map[uint32]bool{1: true, 3: true, 5: true}
+	got := map[uint32]bool{}
+	for _, vid := range fake.committed {
+		got[vid] = true
+	}
+	for vid := range want {
+		if !got[vid] {
+			t.Errorf("volume %d was not vacuum-committed", vid)
+		}
+	}
+	for _, vid := range fake.committed {
+		if !want[vid] {
+			t.Errorf("volume %d vacuum-committed unexpectedly", vid)
+		}
+	}
+}
+
+// A volume server that keeps a vacuum RPC pending must not hold the
+// topology-wide vacuum guard forever: the phase deadline cancels the call,
+// Vacuum returns, and the next request is not skipped.
+func TestVacuumStalledVolumeServerReleasesGuard(t *testing.T) {
+	for _, phase := range []string{"check", "compact", "commit", "status", "cleanup"} {
+		t.Run(phase, func(t *testing.T) {
+			old := vacuumPhaseTimeout
+			vacuumPhaseTimeout = 250 * time.Millisecond
+			defer func() { vacuumPhaseTimeout = old }()
+
+			hangFake := &fakeVacuumServer{
+				checks:    map[uint32]*volume_server_pb.VacuumVolumeCheckResponse{1: {GarbageRatio: 0.9}},
+				hang:      phase,
+				entered:   make(chan string, 1),
+				cancelled: make(chan struct{}),
+			}
+			if phase == "cleanup" {
+				hangFake.compactErr = errors.New("compact failed")
+			}
+			if phase == "status" {
+				hangFake.checks[1] = &volume_server_pb.VacuumVolumeCheckResponse{GarbageRatio: 0.1}
+			}
+
+			topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 1, 5, true)
+			rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+
+			var dns []*DataNode
+			if phase == "status" {
+				okFake := &fakeVacuumServer{
+					checks: map[uint32]*volume_server_pb.VacuumVolumeCheckResponse{1: {GarbageRatio: 0.9}},
+				}
+				okPort, _ := startFakeVolumeServer(t, okFake)
+				dns = append(dns, rack.GetOrCreateDataNode("127.0.0.1", 8080, okPort, "127.0.0.1", "dn-ok", map[string]uint32{"": 10}))
+			}
+			hangPort, dialOption := startFakeVolumeServer(t, hangFake)
+			dns = append(dns, rack.GetOrCreateDataNode("127.0.0.1", 8081, hangPort, "127.0.0.1", "dn-hang", map[string]uint32{"": 10}))
+
+			v := storage.VolumeInfo{
+				Id:               needle.VolumeId(1),
+				Size:             1 << 20,
+				Collection:       "c",
+				ModifiedAtSecond: time.Now().Unix(),
+				Version:          needle.GetCurrentVersion(),
+				ReplicaPlacement: &super_block.ReplicaPlacement{},
+				Ttl:              needle.EMPTY_TTL,
+			}
+			for _, dn := range dns {
+				dn.UpdateVolumes([]storage.VolumeInfo{v})
+				topo.RegisterVolumeLayout(v, dn)
+			}
+
+			done := make(chan struct{})
+			go func() {
+				topo.Vacuum(dialOption, 0.3, 1, 0, 1, "c", 0, false, 0)
+				close(done)
+			}()
+
+			select {
+			case <-hangFake.entered:
+			case <-time.After(15 * time.Second):
+				t.Fatalf("vacuum never reached the %s RPC", phase)
+			}
+			select {
+			case <-done:
+			case <-time.After(15 * time.Second):
+				t.Fatalf("vacuum did not return while the %s RPC was pending", phase)
+			}
+			select {
+			case <-hangFake.cancelled:
+			case <-time.After(15 * time.Second):
+				t.Fatalf("the %s RPC was not cancelled", phase)
+			}
+			if c := atomic.LoadInt64(&topo.vacuumLockCounter); c != 0 {
+				t.Fatalf("vacuumLockCounter = %d, want 0", c)
+			}
+		})
+	}
+}
+
+// A replica tiered to remote storage is never compacted by a vacuum, not even
+// on an explicit request with a zero threshold: its .dat is the remote object.
+// volume.tier.compact is the way to reclaim its garbage.
+func TestVacuumSkipsTieredReplica(t *testing.T) {
+	fake := &fakeVacuumServer{
+		checks: map[uint32]*volume_server_pb.VacuumVolumeCheckResponse{
+			1: {GarbageRatio: 0.9},
+			2: {GarbageRatio: 0.9},
+		},
+	}
+	grpcPort, dialOption := startFakeVolumeServer(t, fake)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, grpcPort, "127.0.0.1", "dn", map[string]uint32{"": 10})
+	newVolumeInfo := func(vid needle.VolumeId, remote string) storage.VolumeInfo {
+		return storage.VolumeInfo{
+			Id:                vid,
+			Size:              1 << 20,
+			Collection:        "c",
+			ReadOnly:          remote != "",
+			ModifiedAtSecond:  time.Now().Unix(),
+			Version:           needle.GetCurrentVersion(),
+			ReplicaPlacement:  &super_block.ReplicaPlacement{},
+			Ttl:               needle.EMPTY_TTL,
+			RemoteStorageName: remote,
+		}
+	}
+	vl := topo.GetVolumeLayout("c", &super_block.ReplicaPlacement{}, needle.EMPTY_TTL, types.ToDiskType(""))
+	volumes := []storage.VolumeInfo{newVolumeInfo(1, "s3.default"), newVolumeInfo(2, "")}
+	dn.UpdateVolumes(volumes)
+	for _, v := range volumes {
+		topo.RegisterVolumeLayout(v, dn)
+	}
+	c := NewCollection("c", topo.volumeSizeLimit, false)
+	for _, vid := range []needle.VolumeId{1, 2} {
+		vl.accessLock.RLock()
+		ll := vl.vid2location[vid].Copy()
+		vl.accessLock.RUnlock()
+		topo.vacuumOneVolumeId(dialOption, vl, c, 0, ll, vid, 0, false)
+	}
+
+	fake.mu.Lock()
+	defer fake.mu.Unlock()
+	if len(fake.committed) != 1 || fake.committed[0] != 2 {
+		t.Fatalf("committed %v, want only the local volume 2", fake.committed) // volume 2 is the positive control
+	}
+}
+
+// A rack cap bounds copies compacting in parallel inside one rack even when
+// every data node still has per-server quota left: volumes whose only copy
+// sits on different data nodes of the same rack serialize.
+func TestVacuumRackLimitSerializesVolumes(t *testing.T) {
+	tracker := &compactTracker{}
+	newFake := func(vid uint32) *fakeVacuumServer {
+		return &fakeVacuumServer{
+			checks:         map[uint32]*volume_server_pb.VacuumVolumeCheckResponse{vid: {GarbageRatio: 0.9}},
+			entered:        make(chan string, 1),
+			compactGate:    make(chan struct{}),
+			compactTracker: tracker,
+		}
+	}
+	fake1, fake2 := newFake(1), newFake(2)
+	port1, dialOption := startFakeVolumeServer(t, fake1)
+	port2, _ := startFakeVolumeServer(t, fake2)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+	dns := []*DataNode{
+		rack.GetOrCreateDataNode("127.0.0.1", 8080, port1, "127.0.0.1", "dn-1", map[string]uint32{"": 10}),
+		rack.GetOrCreateDataNode("127.0.0.1", 8081, port2, "127.0.0.1", "dn-2", map[string]uint32{"": 10}),
+	}
+	for i, dn := range dns {
+		v := storage.VolumeInfo{
+			Id:               needle.VolumeId(i + 1),
+			Size:             1 << 20,
+			Collection:       "c",
+			ModifiedAtSecond: time.Now().Unix(),
+			Version:          needle.GetCurrentVersion(),
+			ReplicaPlacement: &super_block.ReplicaPlacement{},
+			Ttl:              needle.EMPTY_TTL,
+		}
+		dn.UpdateVolumes([]storage.VolumeInfo{v})
+		topo.RegisterVolumeLayout(v, dn)
+	}
+
+	done := make(chan struct{})
+	go func() {
+		topo.Vacuum(dialOption, 0.3, 10, 1, 0, "c", 0, false, 0)
+		close(done)
+	}()
+
+	deadline := time.After(15 * time.Second)
+	var winner *fakeVacuumServer
+	for winner == nil {
+		select {
+		case <-fake1.entered:
+			winner = fake1
+		case <-fake2.entered:
+			winner = fake2
+		case <-deadline:
+			t.Fatal("no volume reached the compact phase")
+		}
+	}
+
+	// while the first compact is gated, the rack cap must keep the second
+	// volume from starting one
+	time.Sleep(300 * time.Millisecond)
+	if got := tracker.maxInFlight(); got != 1 {
+		t.Fatalf("in-flight compacts = %d, want the rack cap to hold it at 1", got)
+	}
+
+	close(fake1.compactGate)
+	close(fake2.compactGate)
+
+	select {
+	case <-done:
+	case <-time.After(15 * time.Second):
+		t.Fatal("vacuum did not finish after the gates opened")
+	}
+	for _, fake := range []*fakeVacuumServer{fake1, fake2} {
+		fake.mu.Lock()
+		n := len(fake.committed)
+		fake.mu.Unlock()
+		if n != 1 {
+			t.Fatalf("committed volumes = %d, want 1", n)
+		}
+	}
+}
+
+// Racks that share a name in different data centers are independent: a per
+// rack cap must not serialize volumes sitting in dc1/rack1 and dc2/rack1.
+func TestVacuumRackLimitScopesRacksByDataCenter(t *testing.T) {
+	tracker := &compactTracker{}
+	newFake := func(vid uint32) *fakeVacuumServer {
+		return &fakeVacuumServer{
+			checks:         map[uint32]*volume_server_pb.VacuumVolumeCheckResponse{vid: {GarbageRatio: 0.9}},
+			entered:        make(chan string, 1),
+			compactGate:    make(chan struct{}),
+			compactTracker: tracker,
+		}
+	}
+	fake1, fake2 := newFake(1), newFake(2)
+	port1, dialOption := startFakeVolumeServer(t, fake1)
+	port2, _ := startFakeVolumeServer(t, fake2)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dns := []*DataNode{
+		topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+			GetOrCreateDataNode("127.0.0.1", 8080, port1, "127.0.0.1", "dn-1", map[string]uint32{"": 10}),
+		topo.GetOrCreateDataCenter("dc2").GetOrCreateRack("rack1").
+			GetOrCreateDataNode("127.0.0.1", 8081, port2, "127.0.0.1", "dn-2", map[string]uint32{"": 10}),
+	}
+	for i, dn := range dns {
+		v := storage.VolumeInfo{
+			Id:               needle.VolumeId(i + 1),
+			Size:             1 << 20,
+			Collection:       "c",
+			ModifiedAtSecond: time.Now().Unix(),
+			Version:          needle.GetCurrentVersion(),
+			ReplicaPlacement: &super_block.ReplicaPlacement{},
+			Ttl:              needle.EMPTY_TTL,
+		}
+		dn.UpdateVolumes([]storage.VolumeInfo{v})
+		topo.RegisterVolumeLayout(v, dn)
+	}
+
+	done := make(chan struct{})
+	go func() {
+		topo.Vacuum(dialOption, 0.3, 10, 1, 0, "c", 0, false, 0)
+		close(done)
+	}()
+
+	// both volumes sit in different racks, so both compacts start while the
+	// gates stay closed
+	deadline := time.After(15 * time.Second)
+	for _, fake := range []*fakeVacuumServer{fake1, fake2} {
+		select {
+		case <-fake.entered:
+		case <-deadline:
+			t.Fatal("a volume in an independent rack never reached the compact phase")
+		}
+	}
+
+	close(fake1.compactGate)
+	close(fake2.compactGate)
+
+	select {
+	case <-done:
+	case <-time.After(15 * time.Second):
+		t.Fatal("vacuum did not finish after the gates opened")
+	}
+}
+
+// A data node that unregisters while its volume is still compacting must not
+// crash the sweep when the quota is credited back: the rack key was captured
+// before the RPCs ran.
+func TestVacuumRackLimitSurvivesUnregister(t *testing.T) {
+	fake := &fakeVacuumServer{
+		checks:         map[uint32]*volume_server_pb.VacuumVolumeCheckResponse{1: {GarbageRatio: 0.9}},
+		entered:        make(chan string, 1),
+		compactGate:    make(chan struct{}),
+		compactTracker: &compactTracker{},
+	}
+	grpcPort, dialOption := startFakeVolumeServer(t, fake)
+
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, grpcPort, "127.0.0.1", "dn-1", map[string]uint32{"": 10})
+	v := storage.VolumeInfo{
+		Id:               needle.VolumeId(1),
+		Size:             1 << 20,
+		Collection:       "c",
+		ModifiedAtSecond: time.Now().Unix(),
+		Version:          needle.GetCurrentVersion(),
+		ReplicaPlacement: &super_block.ReplicaPlacement{},
+		Ttl:              needle.EMPTY_TTL,
+	}
+	dn.UpdateVolumes([]storage.VolumeInfo{v})
+	topo.RegisterVolumeLayout(v, dn)
+
+	done := make(chan struct{})
+	go func() {
+		topo.Vacuum(dialOption, 0.3, 1, 1, 0, "c", 0, false, 0)
+		close(done)
+	}()
+
+	select {
+	case <-fake.entered:
+	case <-time.After(15 * time.Second):
+		t.Fatal("volume never reached the compact phase")
+	}
+
+	topo.UnRegisterDataNode(dn)
+	close(fake.compactGate)
+
+	select {
+	case <-done:
+	case <-time.After(15 * time.Second):
+		t.Fatal("vacuum did not finish after the data node unregistered")
+	}
+}
diff --git a/weed/topology/volume_digest_test.go b/weed/topology/volume_digest_test.go
index 70ded92c8a..a74251c80e 100644
--- a/weed/topology/volume_digest_test.go
+++ b/weed/topology/volume_digest_test.go
@@ -75,6 +75,12 @@ func TestVolumeDigestIsIndependentOfReportOrder(t *testing.T) {
 // skips is a change the master would never be told about. Enumerated from the
 // message rather than listed here, so a field added later cannot quietly fall
 // outside the digest while this still passes.
+// Fields a server reports that the master deliberately does not keep, so a
+// change to one alters nothing it holds and the digest is right not to move.
+var notRetainedByTheMaster = map[string]string{
+	"remote_storage_key": "unique per volume, and the master decides nothing from it",
+}
+
 func TestVolumeDigestTracksEveryReportedField(t *testing.T) {
 	base := digestTestVolume(1)
 	baseInfo, err := storage.NewVolumeInfo(base)
@@ -86,6 +92,7 @@ func TestVolumeDigestTracksEveryReportedField(t *testing.T) {
 	for i := 0; i < fields.Len(); i++ {
 		fd := fields.Get(i)
 		t.Run(string(fd.Name()), func(t *testing.T) {
+			why, skipped := notRetainedByTheMaster[string(fd.Name())]
 			candidates := distinctValuesFor(t, fd, base.ProtoReflect().Get(fd))
 			for _, candidate := range candidates {
 				changed := proto.Clone(base).(*master_pb.VolumeInformationMessage)
@@ -95,9 +102,15 @@ func TestVolumeDigestTracksEveryReportedField(t *testing.T) {
 					t.Fatal(err)
 				}
 				if baseInfo.ReportHash() != changedInfo.ReportHash() {
+					if skipped {
+						t.Errorf("%s moves the digest, but is listed as not retained by the master (%s)", fd.Name(), why)
+					}
 					return
 				}
 			}
+			if skipped {
+				return
+			}
 			t.Errorf("no change to %s moves the digest, so the master would never be told about one", fd.Name())
 		})
 	}
@@ -451,7 +464,7 @@ func TestMasterDigestMatchesWhatAVolumeServerReports(t *testing.T) {
 	var serverDigest uint64
 	for _, vid := range []needle.VolumeId{1, 2, 3} {
 		v, _ := loc.FindVolume(vid)
-		_, m := v.ToVolumeInformationMessage()
+		_, m := v.ToVolumeInformationMessage(nil)
 		if m == nil {
 			t.Fatalf("volume %d reported nothing", vid)
 		}
diff --git a/weed/topology/volume_filter.go b/weed/topology/volume_filter.go
new file mode 100644
index 0000000000..aafe0433d0
--- /dev/null
+++ b/weed/topology/volume_filter.go
@@ -0,0 +1,106 @@
+package topology
+
+import (
+	"errors"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
+)
+
+// VolumeFilter narrows a topology listing to the volumes a caller asked about,
+// selecting only what is listed under a disk. A nil field filters nothing, and
+// only nil does: the empty collection is a real one.
+type VolumeFilter struct {
+	Collection        *string
+	remoteStorageName *string
+	// VolumeIds selects the volumes it holds, and an empty one selects them all.
+	VolumeIds map[needle.VolumeId]struct{}
+	// nothing selects the topology alone, for a listing whose volumes travel
+	// in messages of their own.
+	nothing bool
+}
+
+// NoVolumes selects the topology and no volume in it.
+func NoVolumes() VolumeFilter {
+	return VolumeFilter{nothing: true}
+}
+
+// NewVolumeFilter reads what a VolumeList request asked for, where empty and
+// zero mean everything so a caller that forgets to narrow gets too much rather
+// than the wrong thing. The exception is topology_only, which asks for no
+// volumes at all: pairing it with a selector is refused rather than resolved,
+// since either reading would silently drop half the request.
+func NewVolumeFilter(req *master_pb.VolumeListRequest) (VolumeFilter, error) {
+	var filter VolumeFilter
+
+	if req.TopologyOnly {
+		if req.Collection != "" || len(req.VolumeIds) > 0 || req.DefaultCollectionOnly ||
+			req.RemoteStorageName != "" || req.LocalVolumeOnly {
+			return filter, errors.New("topology_only asks for no volumes, so it cannot be combined with collection, volume_ids, default_collection_only, remote_storage_name or local_volume_only")
+		}
+		filter.nothing = true
+		return filter, nil
+	}
+
+	switch {
+	case req.Collection != "":
+		collection := req.Collection
+		filter.Collection = &collection
+	case req.DefaultCollectionOnly:
+		defaultCollection := ""
+		filter.Collection = &defaultCollection
+	}
+
+	switch {
+	case req.RemoteStorageName != "":
+		filter.remoteStorageName = new(req.RemoteStorageName)
+	case req.LocalVolumeOnly:
+		filter.remoteStorageName = new("")
+	}
+
+	if len(req.VolumeIds) > 0 {
+		filter.VolumeIds = make(map[needle.VolumeId]struct{}, len(req.VolumeIds))
+		for _, volumeId := range req.VolumeIds {
+			filter.VolumeIds[needle.VolumeId(volumeId)] = struct{}{}
+		}
+	}
+	return filter, nil
+}
+
+// SelectsEverything lets a caller size its result for the whole disk up front.
+func (f VolumeFilter) SelectsEverything() bool {
+	return !f.nothing && f.Collection == nil && len(f.VolumeIds) == 0 && f.remoteStorageName == nil
+}
+
+type volumeLike interface {
+	GetCollection() string
+	GetVolumeId() needle.VolumeId
+	GetRemoteStorageName() string
+}
+
+func (f VolumeFilter) matches(vi volumeLike) bool {
+	if f.nothing {
+		return false
+	}
+	if f.Collection != nil && *f.Collection != vi.GetCollection() {
+		return false
+	}
+	if f.remoteStorageName != nil {
+		pattern, name := *f.remoteStorageName, vi.GetRemoteStorageName()
+		// the empty name is the local volumes, which only asking for the empty
+		// name selects; even * leaves them out.
+		if name == "" && pattern != "" {
+			return false
+		}
+		if !wildcard.MatchesWildcard(pattern, name) {
+			return false
+		}
+	}
+	if len(f.VolumeIds) > 0 {
+		if _, ok := f.VolumeIds[vi.GetVolumeId()]; !ok {
+			return false
+		}
+	}
+	return true
+}
diff --git a/weed/topology/volume_filter_test.go b/weed/topology/volume_filter_test.go
new file mode 100644
index 0000000000..4ae7e7e86b
--- /dev/null
+++ b/weed/topology/volume_filter_test.go
@@ -0,0 +1,406 @@
+package topology
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+func filterTestTopology(t *testing.T) *Topology {
+	t.Helper()
+	topo := NewTopology("filter", nil, 32*1024*1024*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("10.0.0.1", 8080, 18080, "", "", map[string]uint32{"": 100})
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: "", Size: 1000, Version: 3, DiskId: 2},
+		{Id: 2, Collection: "c", Size: 2000, Version: 3, DiskId: 2},
+		{Id: 3, Collection: "other", Size: 3000, Version: 3, DiskId: 2},
+	}, dn)
+	topo.SyncDataNodeEcShards([]*master_pb.VolumeEcShardInformationMessage{
+		{Id: 8, Collection: "c", EcIndexBits: 0x3fff, DiskId: 2},
+		{Id: 9, Collection: "other", EcIndexBits: 0x3fff, DiskId: 2},
+	}, dn)
+	return topo
+}
+
+// listed returns the volume and ec ids a filtered listing carries.
+func listed(info *master_pb.TopologyInfo) (volumes []uint32, ecVolumes []uint32) {
+	for _, dc := range info.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, node := range rack.DataNodeInfos {
+				for _, disk := range node.DiskInfos {
+					for _, v := range disk.VolumeInfos {
+						volumes = append(volumes, v.Id)
+					}
+					for _, ec := range disk.EcShardInfos {
+						ecVolumes = append(ecVolumes, ec.Id)
+					}
+				}
+			}
+		}
+	}
+	return
+}
+
+func equalIds(got, want []uint32) bool {
+	if len(got) != len(want) {
+		return false
+	}
+	seen := map[uint32]int{}
+	for _, id := range got {
+		seen[id]++
+	}
+	for _, id := range want {
+		seen[id]--
+	}
+	for _, n := range seen {
+		if n != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+func TestVolumeFilterSelects(t *testing.T) {
+	topo := filterTestTopology(t)
+	collection := func(name string) *string { return &name }
+	volumes := func(ids ...needle.VolumeId) map[needle.VolumeId]struct{} {
+		set := make(map[needle.VolumeId]struct{}, len(ids))
+		for _, id := range ids {
+			set[id] = struct{}{}
+		}
+		return set
+	}
+
+	for _, tc := range []struct {
+		name          string
+		filter        VolumeFilter
+		wantVolumes   []uint32
+		wantEcVolumes []uint32
+	}{
+		{"no filter takes everything", VolumeFilter{}, []uint32{1, 2, 3}, []uint32{8, 9}},
+		{"one collection", VolumeFilter{Collection: collection("c")}, []uint32{2}, []uint32{8}},
+		// Asking for it must not read as asking for everything.
+		{"the default collection", VolumeFilter{Collection: collection("")}, []uint32{1}, nil},
+		{"a collection nothing is in", VolumeFilter{Collection: collection("none")}, nil, nil},
+		{"one volume", VolumeFilter{VolumeIds: volumes(3)}, []uint32{3}, nil},
+		{"one ec volume", VolumeFilter{VolumeIds: volumes(9)}, nil, []uint32{9}},
+		{"both, agreeing", VolumeFilter{Collection: collection("other"), VolumeIds: volumes(3)}, []uint32{3}, nil},
+		{"both, disagreeing", VolumeFilter{Collection: collection("c"), VolumeIds: volumes(3)}, nil, nil},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			volumes, ecVolumes := listed(topo.ToTopologyInfo(tc.filter))
+			if !equalIds(volumes, tc.wantVolumes) {
+				t.Errorf("listed volumes %v, want %v", volumes, tc.wantVolumes)
+			}
+			if !equalIds(ecVolumes, tc.wantEcVolumes) {
+				t.Errorf("listed ec volumes %v, want %v", ecVolumes, tc.wantEcVolumes)
+			}
+		})
+	}
+}
+
+// an id nothing answers to narrows the listing rather than widening it.
+func TestVolumeFilterVolumeIds(t *testing.T) {
+	topo := filterTestTopology(t)
+
+	for _, tc := range []struct {
+		name          string
+		ids           []needle.VolumeId
+		wantVolumes   []uint32
+		wantEcVolumes []uint32
+	}{
+		// No id asked of the filter, so every volume is listed.
+		{"no id asked", nil, []uint32{1, 2, 3}, []uint32{8, 9}},
+		{"one regular volume asked", []needle.VolumeId{2}, []uint32{2}, nil},
+		{"one ec volume asked", []needle.VolumeId{8}, nil, []uint32{8}},
+		// Both kinds answer to the same set of ids.
+		{"both kinds asked", []needle.VolumeId{1, 8}, []uint32{1}, []uint32{8}},
+		{"every volume asked", []needle.VolumeId{1, 2, 3, 8, 9}, []uint32{1, 2, 3}, []uint32{8, 9}},
+		// An id nothing answers to must not read as asking for everything.
+		{"a missing id", []needle.VolumeId{7}, nil, nil},
+		{"a found and a missing id", []needle.VolumeId{2, 7}, []uint32{2}, nil},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ids := make(map[needle.VolumeId]struct{}, len(tc.ids))
+			for _, id := range tc.ids {
+				ids[id] = struct{}{}
+			}
+			volumes, ecVolumes := listed(topo.ToTopologyInfo(VolumeFilter{VolumeIds: ids}))
+			if !equalIds(volumes, tc.wantVolumes) {
+				t.Errorf("listed volumes %v, want %v", volumes, tc.wantVolumes)
+			}
+			if !equalIds(ecVolumes, tc.wantEcVolumes) {
+				t.Errorf("listed ec volumes %v, want %v", ecVolumes, tc.wantEcVolumes)
+			}
+		})
+	}
+}
+
+func TestVolumeFilterRemoteStorageNameWildcards(t *testing.T) {
+	topo := NewTopology("filter", nil, 32*1024*1024*1024, 5, false)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("10.0.0.2", 8080, 18080, "", "", map[string]uint32{"": 100})
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 11, Collection: "c", Size: 100, Version: 3, DiskId: 3, RemoteStorageName: "s3.backup"},
+		{Id: 12, Collection: "c", Size: 100, Version: 3, DiskId: 3, RemoteStorageName: "s3.archive"},
+		{Id: 13, Collection: "c", Size: 100, Version: 3, DiskId: 3, RemoteStorageName: "gcs.cold"},
+		{Id: 14, Collection: "c", Size: 100, Version: 3, DiskId: 3},
+	}, dn)
+
+	for _, tc := range []struct {
+		name string
+		f    VolumeFilter
+		want []uint32
+	}{
+		// A nil name asks for every volume, tiered or local alike.
+		{"no remote storage asked", VolumeFilter{}, []uint32{11, 12, 13, 14}},
+		{"an exact name", VolumeFilter{remoteStorageName: new("s3.backup")}, []uint32{11}},
+		{"a wildcarded storage", VolumeFilter{remoteStorageName: new("s3.*")}, []uint32{11, 12}},
+		{"a wildcarded tier", VolumeFilter{remoteStorageName: new("*.cold")}, []uint32{13}},
+		{"every tiered volume", VolumeFilter{remoteStorageName: new("*")}, []uint32{11, 12, 13}},
+		// Not a wildcard, so it matches nothing rather than everything.
+		{"a name no volume is on", VolumeFilter{remoteStorageName: new("s3.other")}, nil},
+		// The local volumes are the ones with no remote storage name.
+		{"the local ones only", VolumeFilter{remoteStorageName: new("")}, []uint32{14}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			volumes, ecVolumes := listed(topo.ToTopologyInfo(tc.f))
+			if !equalIds(volumes, tc.want) {
+				t.Errorf("listed volumes %v, want %v", volumes, tc.want)
+			}
+			if len(ecVolumes) != 0 {
+				t.Errorf("listed ec volumes %v, want none", ecVolumes)
+			}
+		})
+	}
+}
+
+// A filter never changes which disks are reported or what they say about
+// themselves.
+func TestVolumeFilterKeepsTheTopology(t *testing.T) {
+	topo := filterTestTopology(t)
+	full := topo.ToTopologyInfo(VolumeFilter{})
+	name := "c"
+	narrowed := topo.ToTopologyInfo(VolumeFilter{Collection: &name})
+
+	for _, info := range []*master_pb.TopologyInfo{full, narrowed} {
+		if len(info.DataCenterInfos) != 1 || len(info.DataCenterInfos[0].RackInfos) != 1 {
+			t.Fatalf("listing lost its topology: %v", info)
+		}
+	}
+
+	fullDisk := full.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0].DiskInfos[""]
+	narrowedDisk := narrowed.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0].DiskInfos[""]
+	if narrowedDisk == nil {
+		t.Fatal("the filtered listing dropped the disk")
+	}
+	if narrowedDisk.VolumeCount != fullDisk.VolumeCount {
+		t.Errorf("volume count %d, want the disk's own %d", narrowedDisk.VolumeCount, fullDisk.VolumeCount)
+	}
+	if narrowedDisk.MaxVolumeCount != fullDisk.MaxVolumeCount {
+		t.Errorf("max volume count %d, want %d", narrowedDisk.MaxVolumeCount, fullDisk.MaxVolumeCount)
+	}
+	if narrowedDisk.DiskId != fullDisk.DiskId {
+		t.Errorf("disk id %d, want %d", narrowedDisk.DiskId, fullDisk.DiskId)
+	}
+}
+
+// So a caller that finds nothing can tell an empty answer from a missing disk.
+func TestVolumeFilterKeepsTheDiskIdWhenNothingMatches(t *testing.T) {
+	topo := filterTestTopology(t)
+	name := "none"
+	info := topo.ToTopologyInfo(VolumeFilter{Collection: &name})
+	disk := info.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0].DiskInfos[""]
+	if len(disk.VolumeInfos) != 0 {
+		t.Fatalf("expected nothing listed, got %d volumes", len(disk.VolumeInfos))
+	}
+	if disk.DiskId != 2 {
+		t.Errorf("reported disk id %d, want the one its volumes are on", disk.DiskId)
+	}
+}
+
+func TestNewVolumeFilterReadsTheRequest(t *testing.T) {
+	collectionOf := func(f VolumeFilter) string {
+		if f.Collection == nil {
+			return "<every>"
+		}
+		return *f.Collection
+	}
+
+	for _, tc := range []struct {
+		name    string
+		request *master_pb.VolumeListRequest
+		want    string
+	}{
+		// A caller passing through its own "" is answered too much, not wrongly.
+		{"an empty request", &master_pb.VolumeListRequest{}, "<every>"},
+		{"an empty collection", &master_pb.VolumeListRequest{Collection: ""}, "<every>"},
+		{"a named collection", &master_pb.VolumeListRequest{Collection: "c"}, "c"},
+		{"the default collection", &master_pb.VolumeListRequest{DefaultCollectionOnly: true}, ""},
+		// Contradictory, so the more specific of the two wins.
+		{"both", &master_pb.VolumeListRequest{Collection: "c", DefaultCollectionOnly: true}, "c"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			filter, err := NewVolumeFilter(tc.request)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := collectionOf(filter); got != tc.want {
+				t.Errorf("selected collection %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestNewVolumeFilterReadsTheRemoteStorageRequest(t *testing.T) {
+	remoteStorageOf := func(f VolumeFilter) string {
+		if f.remoteStorageName == nil {
+			return "<every>"
+		}
+		return *f.remoteStorageName
+	}
+
+	for _, tc := range []struct {
+		name    string
+		request *master_pb.VolumeListRequest
+		want    string
+	}{
+		// A caller passing through its own "" is answered too much, not wrongly.
+		{"an empty request", &master_pb.VolumeListRequest{}, "<every>"},
+		{"an empty remote storage name", &master_pb.VolumeListRequest{RemoteStorageName: ""}, "<every>"},
+		{"a named remote storage", &master_pb.VolumeListRequest{RemoteStorageName: "s3.backup"}, "s3.backup"},
+		// A wildcard is the caller's pattern, carried across untouched.
+		{"a wildcarded storage", &master_pb.VolumeListRequest{RemoteStorageName: "*"}, "*"},
+		// The one storage (local) the empty string cannot name.
+		{"the local volumes only", &master_pb.VolumeListRequest{LocalVolumeOnly: true}, ""},
+		// Contradictory, so the more specific of the two wins.
+		{"both", &master_pb.VolumeListRequest{RemoteStorageName: "s3.backup", LocalVolumeOnly: true}, "s3.backup"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			filter, err := NewVolumeFilter(tc.request)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := remoteStorageOf(filter); got != tc.want {
+				t.Errorf("selected remote storage %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestNewVolumeFilterReadsTheVolumeIds(t *testing.T) {
+	idsOf := func(f VolumeFilter) []uint32 {
+		ids := make([]uint32, 0, len(f.VolumeIds))
+		for id := range f.VolumeIds {
+			ids = append(ids, uint32(id))
+		}
+		return ids
+	}
+
+	for _, tc := range []struct {
+		name    string
+		request *master_pb.VolumeListRequest
+		want    []uint32
+	}{
+		// No id asked of the request, so every volume is listed.
+		{"an empty request", &master_pb.VolumeListRequest{}, nil},
+		{"one id", &master_pb.VolumeListRequest{VolumeIds: []uint32{7}}, []uint32{7}},
+		{"a list of ids", &master_pb.VolumeListRequest{VolumeIds: []uint32{2, 8}}, []uint32{2, 8}},
+		// Asking twice for a volume selects it once.
+		{"duplicates", &master_pb.VolumeListRequest{VolumeIds: []uint32{2, 2}}, []uint32{2}},
+		// The list is taken literally: no volume answers to zero, so a zero in
+		// it narrows the listing rather than widening it.
+		{"a zero among the ids", &master_pb.VolumeListRequest{VolumeIds: []uint32{0}}, []uint32{0}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			filter, err := NewVolumeFilter(tc.request)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := idsOf(filter); !equalIds(got, tc.want) {
+				t.Errorf("selected volume ids %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// topology_only leaves out the ec shards too, not just the volumes; the disks
+// and their counters stay.
+func TestNewVolumeFilterReadsTopologyOnly(t *testing.T) {
+	topo := filterTestTopology(t)
+	filter, err := NewVolumeFilter(&master_pb.VolumeListRequest{TopologyOnly: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	info := topo.ToTopologyInfo(filter)
+	volumes, ecVolumes := listed(info)
+	if len(volumes) != 0 || len(ecVolumes) != 0 {
+		t.Errorf("listed volumes %v and ec volumes %v, want neither", volumes, ecVolumes)
+	}
+
+	full := topo.ToTopologyInfo(VolumeFilter{})
+	fullDisk := full.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0].DiskInfos[""]
+	disk := info.DataCenterInfos[0].RackInfos[0].DataNodeInfos[0].DiskInfos[""]
+	if disk == nil {
+		t.Fatal("the topology_only listing dropped the disk")
+	}
+	if disk.VolumeCount != fullDisk.VolumeCount || disk.MaxVolumeCount != fullDisk.MaxVolumeCount {
+		t.Errorf("disk counters %d/%d, want the full listing's %d/%d",
+			disk.VolumeCount, disk.MaxVolumeCount, fullDisk.VolumeCount, fullDisk.MaxVolumeCount)
+	}
+}
+
+// Selecting volumes in a request that asks for none is a caller bug, refused
+// rather than resolved either way in silence.
+func TestNewVolumeFilterRefusesTopologyOnlyWithSelectors(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		request *master_pb.VolumeListRequest
+	}{
+		{"a collection", &master_pb.VolumeListRequest{TopologyOnly: true, Collection: "c"}},
+		{"volume ids", &master_pb.VolumeListRequest{TopologyOnly: true, VolumeIds: []uint32{1}}},
+		{"the default collection", &master_pb.VolumeListRequest{TopologyOnly: true, DefaultCollectionOnly: true}},
+		{"a remote storage", &master_pb.VolumeListRequest{TopologyOnly: true, RemoteStorageName: "s3.backup"}},
+		{"the local volumes", &master_pb.VolumeListRequest{TopologyOnly: true, LocalVolumeOnly: true}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, err := NewVolumeFilter(tc.request); err == nil {
+				t.Error("expected the contradiction refused, got a filter")
+			}
+		})
+	}
+}
+
+// Everything a listing reads off a disk must be read under its lock, including
+// how much room to reserve, or a heartbeat writing the map races it.
+func TestVolumeFilterListsWhileVolumesChange(t *testing.T) {
+	topo := filterTestTopology(t)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("10.0.0.1", 8080, 18080, "", "", map[string]uint32{"": 100})
+
+	stop := make(chan struct{})
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		for i := 0; ; i++ {
+			select {
+			case <-stop:
+				return
+			default:
+			}
+			topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+				{Id: uint32(100 + i%50), Collection: "c", Size: 1, Version: 3, DiskId: 2},
+			}, dn)
+		}
+	}()
+
+	name := "c"
+	for i := 0; i < 200; i++ {
+		topo.ToTopologyInfo(VolumeFilter{})
+		topo.ToTopologyInfo(VolumeFilter{Collection: &name})
+	}
+	close(stop)
+	<-done
+}
diff --git a/weed/topology/volume_growth.go b/weed/topology/volume_growth.go
index c4aff30fe5..e50b6a726d 100644
--- a/weed/topology/volume_growth.go
+++ b/weed/topology/volume_growth.go
@@ -39,21 +39,32 @@ func (vg *VolumeGrowRequest) Equals(req *VolumeGrowRequest) bool {
 	return reflect.DeepEqual(vg.Option, req.Option) && vg.Count == req.Count && vg.Force == req.Force
 }
 
+const DefaultReservationTimeout = 5 * time.Minute
+
 type volumeGrowthStrategy struct {
-	Copy1Count     uint32
-	Copy2Count     uint32
-	Copy3Count     uint32
-	CopyOtherCount uint32
-	Threshold      float64
+	Copy1Count         uint32
+	Copy2Count         uint32
+	Copy3Count         uint32
+	CopyOtherCount     uint32
+	Threshold          float64
+	ReservationTimeout time.Duration
+}
+
+func (s *volumeGrowthStrategy) GetReservationTimeout() time.Duration {
+	if s != nil && s.ReservationTimeout > 0 {
+		return s.ReservationTimeout
+	}
+	return DefaultReservationTimeout
 }
 
 var (
 	VolumeGrowStrategy = volumeGrowthStrategy{
-		Copy1Count:     7,
-		Copy2Count:     6,
-		Copy3Count:     3,
-		CopyOtherCount: 1,
-		Threshold:      0.9,
+		Copy1Count:         7,
+		Copy2Count:         6,
+		Copy3Count:         3,
+		CopyOtherCount:     1,
+		Threshold:          0.9,
+		ReservationTimeout: DefaultReservationTimeout,
 	}
 )
 
diff --git a/weed/topology/volume_growth_reservation_test.go b/weed/topology/volume_growth_reservation_test.go
index f3711b2fa5..08d7952c36 100644
--- a/weed/topology/volume_growth_reservation_test.go
+++ b/weed/topology/volume_growth_reservation_test.go
@@ -293,3 +293,111 @@ func TestVolumeGrowth_ReservationTimeout(t *testing.T) {
 		t.Errorf("Expected 2 available slots after cleanup and new reservation, got %d", available)
 	}
 }
+
+func TestVolumeGrowth_ConfigurableReservationTimeout(t *testing.T) {
+	origTimeout := VolumeGrowStrategy.ReservationTimeout
+	defer func() {
+		VolumeGrowStrategy.ReservationTimeout = origTimeout
+	}()
+
+	dn := NewDataNode("server1")
+	diskType := types.HardDriveType
+
+	// Set up capacity of 5
+	diskUsage := dn.diskUsages.getOrCreateDisk(diskType)
+	diskUsage.maxVolumeCount = 5
+
+	// 1. Verify default timeout (5 minutes)
+	VolumeGrowStrategy.ReservationTimeout = 5 * time.Minute
+	resId1, ok := dn.TryReserveCapacity(diskType, 2)
+	if !ok {
+		t.Fatal("Expected reservation 1 to succeed")
+	}
+
+	// Set reservation createdAt to 4 minutes ago (not expired under 5m timeout)
+	dn.capacityReservations.Lock()
+	if r, exists := dn.capacityReservations.reservations[resId1]; exists {
+		r.createdAt = time.Now().Add(-4 * time.Minute)
+	}
+	dn.capacityReservations.Unlock()
+
+	// Available space should be 5 - 2 = 3. Trying to reserve 4 must fail.
+	_, ok = dn.TryReserveCapacity(diskType, 4)
+	if ok {
+		t.Error("Expected reservation of 4 to fail when 2 slots are still reserved")
+	}
+
+	// Set reservation createdAt to 6 minutes ago (expired under 5m timeout)
+	dn.capacityReservations.Lock()
+	if r, exists := dn.capacityReservations.reservations[resId1]; exists {
+		r.createdAt = time.Now().Add(-6 * time.Minute)
+	}
+	dn.capacityReservations.Unlock()
+
+	// Now reserving 4 should clean up the expired reservation and succeed
+	resId2, ok := dn.TryReserveCapacity(diskType, 4)
+	if !ok {
+		t.Fatal("Expected reservation of 4 to succeed after 6m expired reservation was cleaned up")
+	}
+	dn.ReleaseReservedCapacity(resId2)
+
+	// 2. Verify custom timeout (1 minute)
+	VolumeGrowStrategy.ReservationTimeout = 1 * time.Minute
+	resId3, ok := dn.TryReserveCapacity(diskType, 2)
+	if !ok {
+		t.Fatal("Expected reservation 3 to succeed")
+	}
+
+	// Set createdAt to 45 seconds ago (not expired under 1m timeout)
+	dn.capacityReservations.Lock()
+	if r, exists := dn.capacityReservations.reservations[resId3]; exists {
+		r.createdAt = time.Now().Add(-45 * time.Second)
+	}
+	dn.capacityReservations.Unlock()
+
+	_, ok = dn.TryReserveCapacity(diskType, 4)
+	if ok {
+		t.Error("Expected reservation of 4 to fail when 2 slots are reserved 45s ago with 1m timeout")
+	}
+
+	// Set createdAt to 75 seconds ago (expired under 1m timeout)
+	dn.capacityReservations.Lock()
+	if r, exists := dn.capacityReservations.reservations[resId3]; exists {
+		r.createdAt = time.Now().Add(-75 * time.Second)
+	}
+	dn.capacityReservations.Unlock()
+
+	resId4, ok := dn.TryReserveCapacity(diskType, 4)
+	if !ok {
+		t.Fatal("Expected reservation of 4 to succeed after 75s reservation expired under 1m timeout")
+	}
+	dn.ReleaseReservedCapacity(resId4)
+
+	// 3. Verify non-positive timeout fallback to 5 minutes
+	VolumeGrowStrategy.ReservationTimeout = 0
+	if VolumeGrowStrategy.GetReservationTimeout() != 5*time.Minute {
+		t.Errorf("Expected 0 timeout to fall back to 5m, got %v", VolumeGrowStrategy.GetReservationTimeout())
+	}
+	VolumeGrowStrategy.ReservationTimeout = -10 * time.Second
+	if VolumeGrowStrategy.GetReservationTimeout() != 5*time.Minute {
+		t.Errorf("Expected negative timeout to fall back to 5m, got %v", VolumeGrowStrategy.GetReservationTimeout())
+	}
+
+	// 4. Expired reservations must not strand capacity: the selection filter
+	// reads AvailableSpaceForReservation without calling TryReserveCapacity.
+	VolumeGrowStrategy.ReservationTimeout = 1 * time.Minute
+	resId5, ok := dn.TryReserveCapacity(diskType, 5)
+	if !ok {
+		t.Fatal("Expected reservation 5 to succeed")
+	}
+	dn.capacityReservations.Lock()
+	if r, exists := dn.capacityReservations.reservations[resId5]; exists {
+		r.createdAt = time.Now().Add(-2 * time.Minute)
+	}
+	dn.capacityReservations.Unlock()
+
+	option := &VolumeGrowOption{DiskType: diskType}
+	if available := dn.AvailableSpaceForReservation(option); available != 5 {
+		t.Errorf("Expected expired reservation to free capacity in AvailableSpaceForReservation, got %d", available)
+	}
+}
diff --git a/weed/topology/volume_growth_test.go b/weed/topology/volume_growth_test.go
index 11e3ba0829..da9cf5affd 100644
--- a/weed/topology/volume_growth_test.go
+++ b/weed/topology/volume_growth_test.go
@@ -116,7 +116,7 @@ func setup(topologyLayout string) *Topology {
 					}
 					if vi.ReplicaPlacement != nil {
 						vl := topo.GetVolumeLayout(vi.Collection, vi.ReplicaPlacement, needle.EMPTY_TTL, types.HardDriveType)
-						vl.RegisterVolume(&vi, server)
+						vl.RegisterVolume(&vi, server, nil)
 						vl.setVolumeWritable(vi.Id)
 					}
 					server.AddOrUpdateVolume(vi)
diff --git a/weed/topology/volume_index_digest.go b/weed/topology/volume_index_digest.go
index afb18293d3..38ca57379d 100644
--- a/weed/topology/volume_index_digest.go
+++ b/weed/topology/volume_index_digest.go
@@ -51,6 +51,7 @@ func (vl *VolumeLayout) releaseLookupOwnership() {
 		}
 	}
 	vl.vid2location = make(map[needle.VolumeId]*VolumeLocationList)
+	vl.dropped = true
 }
 
 // moveLookupOwnership transfers the digest bit for vid from the node a lookup
diff --git a/weed/topology/volume_layout.go b/weed/topology/volume_layout.go
index d6b2577570..c74fefccbc 100644
--- a/weed/topology/volume_layout.go
+++ b/weed/topology/volume_layout.go
@@ -53,19 +53,28 @@ const capacityRecoveryDelay = 30 * time.Second
 
 // mapping from volume to its locations, inverted from server to volume
 type VolumeLayout struct {
-	growRequest      atomic.Bool
-	lastGrowCount    atomic.Uint32
-	rp               *super_block.ReplicaPlacement
-	ttl              *needle.TTL
-	diskType         types.DiskType
-	vid2location     map[needle.VolumeId]*VolumeLocationList
-	writables        []needle.VolumeId // transient array of writable volume id
+	growRequest   atomic.Bool
+	lastGrowCount atomic.Uint32
+	rp            *super_block.ReplicaPlacement
+	ttl           *needle.TTL
+	diskType      types.DiskType
+	vid2location  map[needle.VolumeId]*VolumeLocationList
+	writables     []needle.VolumeId // transient array of writable volume id
+	// writableMembers mirrors writables for membership tests, which run for
+	// every volume on every heartbeat through ensureCorrectWritables.
+	writableMembers  map[needle.VolumeId]struct{}
 	crowded          map[needle.VolumeId]struct{}
 	vacuumedVolumes  map[needle.VolumeId]time.Time
+	deletingVolumes  map[needle.VolumeId]struct{}
 	volumeSizeLimit  uint64
 	replicationAsMin bool
-	accessLock       sync.RWMutex
-	sizeTracking     map[needle.VolumeId]*volumeSizeTracking
+	// maxWritableVolumes caps how many writables PickForWrite spreads over;
+	// 0 means every writable volume is a candidate.
+	maxWritableVolumes int
+	accessLock         sync.RWMutex
+	sizeTracking       map[needle.VolumeId]*volumeSizeTracking
+	// dropped: the layout went away with its collection; late registrations must re-resolve.
+	dropped bool
 }
 
 type VolumeLayoutStats struct {
@@ -84,8 +93,10 @@ func NewVolumeLayout(rp *super_block.ReplicaPlacement, ttl *needle.TTL, diskType
 		diskType:         diskType,
 		vid2location:     make(map[needle.VolumeId]*VolumeLocationList),
 		writables:        *new([]needle.VolumeId),
+		writableMembers:  make(map[needle.VolumeId]struct{}),
 		crowded:          make(map[needle.VolumeId]struct{}),
 		vacuumedVolumes:  make(map[needle.VolumeId]time.Time),
+		deletingVolumes:  make(map[needle.VolumeId]struct{}),
 		volumeSizeLimit:  volumeSizeLimit,
 		replicationAsMin: replicationAsMin,
 		sizeTracking:     make(map[needle.VolumeId]*volumeSizeTracking),
@@ -119,35 +130,43 @@ func (vl *VolumeLayout) initSizeTracking(vid needle.VolumeId, size uint64, compa
 	}
 }
 
-func (vl *VolumeLayout) RegisterVolume(v *storage.VolumeInfo, dn *DataNode) {
+// RegisterVolume records a volume location. It refuses a layout dropped with
+// its collection — the caller must re-resolve, or the bits it sets would leak.
+// Each replica's read-only flag is rebuilt from what its node last reported;
+// isQuarantined folds the master's force-read-only marks into that rebuild,
+// since reported flags deliberately exclude them. nil restores reported state
+// verbatim.
+func (vl *VolumeLayout) RegisterVolume(v *storage.VolumeInfo, dn *DataNode, isQuarantined func(*DataNode) bool) bool {
 	vl.accessLock.Lock()
 	defer vl.accessLock.Unlock()
 
-	defer vl.rememberOversizedVolume(v, dn)
+	if vl.dropped {
+		return false
+	}
 
-	moveLookupOwnership(v.Id, vl.getOrCreateLocationList(v.Id).Set(dn), dn)
+	location := vl.getOrCreateLocationList(v.Id)
+	moveLookupOwnership(v.Id, location.Set(dn), dn)
 	if !v.ReadOnly {
 		vl.initSizeTracking(v.Id, v.Size, v.CompactRevision)
 	}
-	// glog.V(4).Infof("volume %d added to %s len %d copy %d", v.Id, dn.Id(), vl.vid2location[v.Id].Length(), v.ReplicaPlacement.GetCopyCount())
-	location := vl.vid2location[v.Id]
-	for _, dn := range location.list {
-		if vInfo, err := dn.GetVolumesById(v.Id); err == nil {
-			if vInfo.ReadOnly {
-				glog.V(1).Infof("vid %d removed from writable", v.Id)
-				vl.removeFromWritable(v.Id)
-				location.SetReadOnly(dn, true)
-				return
-			}
-			location.SetReadOnly(dn, false)
-		} else {
-			glog.V(1).Infof("vid %d removed from writable", v.Id)
-			vl.removeFromWritable(v.Id)
-			location.SetReadOnly(dn, false)
-			return
-		}
+	if isQuarantined != nil && isQuarantined(dn) {
+		location.SetReadOnly(dn, true)
+		vl.removeFromWritable(v.Id)
 	}
-
+	// glog.V(4).Infof("volume %d added to %s len %d copy %d", v.Id, dn.Id(), vl.vid2location[v.Id].Length(), v.ReplicaPlacement.GetCopyCount())
+	for _, n := range location.list {
+		marked := isQuarantined != nil && isQuarantined(n)
+		vInfo, err := n.GetVolumesById(v.Id)
+		if err == nil && !vInfo.ReadOnly && !marked {
+			location.SetReadOnly(n, false)
+			continue
+		}
+		glog.V(1).Infof("vid %d removed from writable", v.Id)
+		vl.removeFromWritable(v.Id)
+		location.SetReadOnly(n, marked || (err == nil && vInfo.ReadOnly))
+		return true
+	}
+	return true
 }
 
 func (vl *VolumeLayout) rememberOversizedVolume(v *storage.VolumeInfo, dn *DataNode) {
@@ -156,6 +175,23 @@ func (vl *VolumeLayout) rememberOversizedVolume(v *storage.VolumeInfo, dn *DataN
 	}
 }
 
+// UpdateOversizedState refreshes the per-replica oversized mark from the size
+// reported by this heartbeat, and is the only writer of that mark. The delta
+// heartbeat path (ApplyVolumeChanges) and the full heartbeat path
+// (SyncDataNodeRegistration) both call it, or a volume that grew past the
+// limit would keep looking writable to ensureCorrectWritables and bounce
+// between writable and unwritable on every assign.
+//
+// Registration deliberately does not touch the mark: the incremental path
+// registers from a short heartbeat message that carries no size, so judging
+// the volume by it would clear the mark on every arrival announcement and
+// hand an oversized volume back to the writable list.
+func (vl *VolumeLayout) UpdateOversizedState(v *storage.VolumeInfo, dn *DataNode) {
+	vl.accessLock.Lock()
+	defer vl.accessLock.Unlock()
+	vl.rememberOversizedVolume(v, dn)
+}
+
 // UpdateVolumeSize is called on every heartbeat for every reported volume.
 // It decays the pending size estimate toward the reported size and updates
 // crowded state. Replicated volumes report from multiple DataNodes; decay
@@ -168,7 +204,14 @@ func (vl *VolumeLayout) rememberOversizedVolume(v *storage.VolumeInfo, dn *DataN
 // previously eagerly removed by RecordAssign back under the writable
 // threshold and this call re-added it to the writable list. The caller
 // should mirror the activeVolumeCount bookkeeping.
-func (vl *VolumeLayout) UpdateVolumeSize(vid needle.VolumeId, reportedSize uint64, compactRevision uint32) (recoveredToWritable bool) {
+//
+// fromHeartbeat marks a volume server's report. The periodic decay stands in
+// for the report a quiet volume never sends, so it passes no size of its own —
+// it reads the record under this lock, and never advances lastUpdateTime, or
+// it would swallow the next real report and strand the master on a stale size
+// no one will send again. Both callers give way to a report already handled
+// for this cycle.
+func (vl *VolumeLayout) UpdateVolumeSize(vid needle.VolumeId, reportedSize uint64, compactRevision uint32, fromHeartbeat bool) (recoveredToWritable bool) {
 	vl.accessLock.Lock()
 	defer vl.accessLock.Unlock()
 
@@ -188,6 +231,9 @@ func (vl *VolumeLayout) UpdateVolumeSize(vid needle.VolumeId, reportedSize uint6
 	now := time.Now()
 	st := vl.sizeTracking[vid]
 	if st == nil {
+		if !fromHeartbeat {
+			return false // the entry went while the decay was picking its work
+		}
 		st = &volumeSizeTracking{
 			effectiveSize:   reportedSize,
 			reportedSize:    reportedSize,
@@ -196,10 +242,21 @@ func (vl *VolumeLayout) UpdateVolumeSize(vid needle.VolumeId, reportedSize uint6
 		}
 		vl.sizeTracking[vid] = st
 	} else if now.Sub(st.lastUpdateTime) < 2*time.Second {
-		return false // duplicate replica in the same heartbeat cycle
+		// Something already decayed this volume for this cycle: another replica
+		// of the same report, or for the decay a heartbeat that arrived after
+		// the pass chose the volume. Halving twice would forget pending bytes
+		// the volume has not written yet.
+		return false
 	} else {
-		st.lastUpdateTime = now
-		st.reportedSize = reportedSize
+		if fromHeartbeat {
+			st.lastUpdateTime = now
+			st.reportedSize = reportedSize
+		} else {
+			// Take the record as it stands under this lock, not as the decay
+			// pass saw it: a heartbeat may have landed since, and replaying
+			// the older size would roll its report back.
+			reportedSize, compactRevision = st.reportedSize, st.compactRevision
+		}
 		if compactRevision != st.compactRevision {
 			// Compaction happened — size drop is real, not pending. Reset.
 			st.compactRevision = compactRevision
@@ -247,6 +304,43 @@ func (vl *VolumeLayout) UpdateVolumeSize(vid needle.VolumeId, reportedSize uint6
 	return true
 }
 
+// DecayQuietVolumeSizes re-runs the size decay for volumes whose heartbeat
+// reports have gone quiet. Only a volume whose content changed is reported,
+// and a volume held out of the writable list takes no writes, so without this
+// an inflated estimate is never decayed and the volume never returns.
+//
+// A volume the disk really did fill is skipped: UpdateVolumeSize refuses to
+// recover one whose reported size is at the limit, so walking it every pulse
+// only takes the write lock away from the heartbeats. Nothing is lost by
+// waiting — shrinking it means compaction, which changes content and is
+// therefore reported.
+func (vl *VolumeLayout) DecayQuietVolumeSizes(quietCutoff time.Duration) {
+	for _, vid := range vl.quietDecayCandidates(quietCutoff) {
+		if vl.UpdateVolumeSize(vid, 0, 0, false) {
+			vl.AdjustActiveVolumeCountAfterRecovery(vid)
+		}
+	}
+}
+
+// quietDecayCandidates names the volumes the decay has something to do for.
+// Skipping the rest is what keeps the pass off the write lock: the work is
+// what costs, not the outcome, since replaying a size that cannot move leaves
+// the record exactly as it found it.
+func (vl *VolumeLayout) quietDecayCandidates(quietCutoff time.Duration) (quiets []needle.VolumeId) {
+	now := time.Now()
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+	for vid, st := range vl.sizeTracking {
+		if now.Sub(st.lastUpdateTime) < quietCutoff {
+			continue
+		}
+		if st.effectiveSize > st.reportedSize || (!st.fullSince.IsZero() && st.reportedSize < vl.volumeSizeLimit) {
+			quiets = append(quiets, vid)
+		}
+	}
+	return quiets
+}
+
 func (vl *VolumeLayout) UnRegisterVolume(v *storage.VolumeInfo, dn *DataNode) {
 	vl.accessLock.Lock()
 	defer vl.accessLock.Unlock()
@@ -283,6 +377,22 @@ func (vl *VolumeLayout) ensureCorrectWritables(vid needle.VolumeId) {
 	isAllWritable := vl.isAllWritable(vid)
 	isOversizedVolume := vl.vid2location[vid].AnyOversized()
 	if isEnoughCopies && isAllWritable && !isOversizedVolume {
+		// A volume removed for capacity (fullSince set) must go through the
+		// heartbeat recovery path in UpdateVolumeSize, which enforces
+		// capacityRecoveryDelay. Re-adding it here would bypass the cooldown
+		// and let a just-compacted volume flip back to writable immediately.
+		if st := vl.sizeTracking[vid]; st != nil && !st.fullSince.IsZero() &&
+			time.Since(st.fullSince) < capacityRecoveryDelay {
+			return
+		}
+		// A volume already at the limit must not be restored here: the next
+		// assign's RecordAssign would remove it again. Crowded is the wrong
+		// test for that -- it starts at 90%, and a crowded volume that lost a
+		// replica would never be writable again once the replica returned,
+		// since nothing writes to it and its size can no longer fall.
+		if st := vl.sizeTracking[vid]; st != nil && st.effectiveSize >= vl.volumeSizeLimit {
+			return
+		}
 		vl.setVolumeWritable(vid)
 		return
 	}
@@ -303,9 +413,18 @@ func (vl *VolumeLayout) ensureCorrectWritables(vid needle.VolumeId) {
 	}
 }
 
+// isAllWritable reports whether every replica of vid can take writes. A write
+// lands on one replica and is forwarded to the rest, so one read-only replica,
+// or one on a server in maintenance mode, holds the whole volume out.
 func (vl *VolumeLayout) isAllWritable(vid needle.VolumeId) bool {
 	if location, ok := vl.vid2location[vid]; ok {
+		if location.AnyReadOnly() {
+			return false
+		}
 		for _, dn := range location.list {
+			if dn.InMaintenanceMode() {
+				return false
+			}
 			if v, getError := dn.GetVolumesById(vid); getError == nil {
 				if v.ReadOnly {
 					return false
@@ -446,6 +565,30 @@ func (vl *VolumeLayout) DrainAndRemoveFromWritable(vid needle.VolumeId) {
 	vl.waitForPendingDrain(context.Background(), vid)
 }
 
+// MarkDeleting pins a volume out of the writable list for the duration of a
+// sweep delete. DrainAndRemoveFromWritable alone is not enough here: unlike a
+// compaction the volume disappears, so a heartbeat landing mid-delete must not
+// re-add it and let a write reach a replica whose siblings are already gone.
+func (vl *VolumeLayout) MarkDeleting(vid needle.VolumeId) {
+	vl.accessLock.Lock()
+	vl.deletingVolumes[vid] = struct{}{}
+	vl.removeFromWritable(vid)
+	vl.accessLock.Unlock()
+	vl.waitForPendingDrain(context.Background(), vid)
+}
+
+func (vl *VolumeLayout) UnmarkDeleting(vid needle.VolumeId) {
+	vl.accessLock.Lock()
+	delete(vl.deletingVolumes, vid)
+	// Re-run the standard writable gate so a surviving volume regains
+	// assignment immediately; digest heartbeats only re-report changed
+	// volumes, so waiting on them could strand it unwritable indefinitely.
+	if !vl.vid2location[vid].AnyOversized() && vl.enoughCopies(vid) && vl.isAllWritable(vid) {
+		vl.setVolumeWritable(vid)
+	}
+	vl.accessLock.Unlock()
+}
+
 func (vl *VolumeLayout) isEmpty() bool {
 	vl.accessLock.RLock()
 	defer vl.accessLock.RUnlock()
@@ -453,12 +596,21 @@ func (vl *VolumeLayout) isEmpty() bool {
 	return len(vl.vid2location) == 0
 }
 
+func (vl *VolumeLayout) ListVids() (vids []needle.VolumeId) {
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+	for vid := range vl.vid2location {
+		vids = append(vids, vid)
+	}
+	return
+}
+
 func (vl *VolumeLayout) Lookup(vid needle.VolumeId) []*DataNode {
 	vl.accessLock.RLock()
 	defer vl.accessLock.RUnlock()
 
 	if location := vl.vid2location[vid]; location != nil {
-		return location.list
+		return append([]*DataNode(nil), location.list...)
 	}
 	return nil
 }
@@ -501,13 +653,40 @@ func (vl *VolumeLayout) PickForWrite(count uint64, option *VolumeGrowOption) (vi
 		return 0, 0, nil, true, fmt.Errorf("%s", NoWritableVolumes)
 	}
 	if option.DataCenter == "" && option.Rack == "" && option.DataNode == "" {
-		vid, locationList = vl.pickWeightedByRemaining(vl.writables)
+		writables := vl.writables
+		if vl.maxWritableVolumes > 0 && len(writables) > vl.maxWritableVolumes {
+			writables = vl.fullestWritable(writables)
+		}
+		vid, locationList = vl.pickWeightedByRemaining(writables)
 		if locationList == nil || len(locationList.list) == 0 {
 			return 0, 0, nil, false, fmt.Errorf("Strangely vid %s is on no machine!", vid.String())
 		}
 		return vid, count, locationList.Copy(), false, nil
 	}
 
+	if vl.maxWritableVolumes > 0 {
+		// The cap must hold inside the requested location, so collect every
+		// matching writable before narrowing to the fullest.
+		var matches []needle.VolumeId
+		for _, writableVolumeId := range vl.writables {
+			volumeLocationList := vl.vid2location[writableVolumeId]
+			for _, dn := range volumeLocationList.list {
+				if dn.matchesLocation(option) {
+					matches = append(matches, writableVolumeId)
+					break
+				}
+			}
+		}
+		if len(matches) == 0 {
+			return vid, count, locationList, true, fmt.Errorf("%s in DataCenter:%v Rack:%v DataNode:%v", NoWritableVolumes, option.DataCenter, option.Rack, option.DataNode)
+		}
+		if len(matches) > vl.maxWritableVolumes {
+			matches = vl.fullestWritable(matches)
+		}
+		vid, locationList = vl.weightedPick(matches)
+		return vid, count, locationList.Copy(), false, nil
+	}
+
 	// Scan from a random offset to collect up to pickSampleSize matching
 	// candidates, avoiding a full scan + allocation in the common case.
 	var sample [pickSampleSize]needle.VolumeId
@@ -517,13 +696,7 @@ func (vl *VolumeLayout) PickForWrite(count uint64, option *VolumeGrowOption) (vi
 		writableVolumeId := vl.writables[(start+i)%lenWriters]
 		volumeLocationList := vl.vid2location[writableVolumeId]
 		for _, dn := range volumeLocationList.list {
-			if option.DataCenter != "" && dn.GetDataCenter().Id() != NodeId(option.DataCenter) {
-				continue
-			}
-			if option.Rack != "" && dn.GetRack().Id() != NodeId(option.Rack) {
-				continue
-			}
-			if option.DataNode != "" && dn.Id() != NodeId(option.DataNode) {
+			if !dn.matchesLocation(option) {
 				continue
 			}
 			sample[found] = writableVolumeId
@@ -561,6 +734,35 @@ func (vl *VolumeLayout) pickWeightedByRemaining(candidates []needle.VolumeId) (n
 	return vl.weightedPick(sample[:])
 }
 
+// fullestWritable narrows candidates to the maxWritableVolumes fullest ones,
+// so assignments concentrate on the fullest writable volume instead of
+// spreading across many disks at once. The cap is expected to be small, so the
+// top-n are kept by insertion instead of sorting the whole candidate list.
+func (vl *VolumeLayout) fullestWritable(candidates []needle.VolumeId) []needle.VolumeId {
+	n := vl.maxWritableVolumes
+	top := make([]needle.VolumeId, 0, n)
+	remaining := make([]uint64, 0, n)
+	for _, vid := range candidates {
+		r := vl.remainingSize(vid)
+		i := len(top)
+		for i > 0 && (remaining[i-1] > r || (remaining[i-1] == r && top[i-1] > vid)) {
+			i--
+		}
+		if i == n {
+			continue
+		}
+		top = append(top, 0)
+		remaining = append(remaining, 0)
+		copy(top[i+1:], top[i:])
+		copy(remaining[i+1:], remaining[i:])
+		top[i], remaining[i] = vid, r
+		if len(top) > n {
+			top, remaining = top[:n], remaining[:n]
+		}
+	}
+	return top
+}
+
 func (vl *VolumeLayout) weightedPick(candidates []needle.VolumeId) (needle.VolumeId, *VolumeLocationList) {
 	if len(candidates) == 1 {
 		vid := candidates[0]
@@ -629,6 +831,45 @@ func (vl *VolumeLayout) ShouldGrowVolumes() bool {
 	return writable <= crowded
 }
 
+// WritableAvgFill returns the average fill ratio of the writable volumes and
+// how many there are. The fill of a single volume is its tracked effective
+// size over the layout's volume size limit; volumes without a size-tracking
+// entry yet (freshly created, no heartbeat size report so far) count as
+// empty. A non-empty location filter in option narrows the measure to
+// writables serving that target, so a targeted grow is not blocked or
+// triggered by fill elsewhere in the layout.
+func (vl *VolumeLayout) WritableAvgFill(option *VolumeGrowOption) (avgFill float64, writableCount int) {
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+
+	var total uint64
+	for _, vid := range vl.writables {
+		if option != nil && (option.DataCenter != "" || option.Rack != "" || option.DataNode != "") {
+			matched := false
+			if loc := vl.vid2location[vid]; loc != nil {
+				for _, dn := range loc.list {
+					if dn.matchesLocation(option) {
+						matched = true
+						break
+					}
+				}
+			}
+			if !matched {
+				continue
+			}
+		}
+		writableCount++
+		if st := vl.sizeTracking[vid]; st != nil {
+			total += st.effectiveSize
+		}
+	}
+	if writableCount == 0 || vl.volumeSizeLimit == 0 {
+		return 0, writableCount
+	}
+	avgFill = float64(total) / (float64(writableCount) * float64(vl.volumeSizeLimit))
+	return avgFill, writableCount
+}
+
 func (vl *VolumeLayout) ShouldGrowVolumesByDcAndRack(writables *[]needle.VolumeId, dcId NodeId, rackId NodeId) bool {
 	// When replication spans multiple racks (DiffRackCount > 0), a writable
 	// volume's replicas only cover some racks in a DC. It is wrong to
@@ -661,6 +902,28 @@ func (vl *VolumeLayout) ShouldGrowVolumesByDcAndRack(writables *[]needle.VolumeI
 	return true
 }
 
+// listVolumeDataCenters returns the data centers hosting at least one volume
+// of this layout, stopping once limit distinct DCs are seen (0 = no limit).
+// The walk holds accessLock and a layout can span millions of volumes, so
+// callers pass the smallest limit that answers their question and only a
+// layout truly confined to fewer DCs pays for a full walk.
+func (vl *VolumeLayout) listVolumeDataCenters(limit int) map[NodeId]struct{} {
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+	dataCenters := make(map[NodeId]struct{})
+	for _, location := range vl.vid2location {
+		for _, dn := range location.list {
+			if dcId := dn.GetDataCenterId(); dcId != "" {
+				dataCenters[NodeId(dcId)] = struct{}{}
+				if limit > 0 && len(dataCenters) >= limit {
+					return dataCenters
+				}
+			}
+		}
+	}
+	return dataCenters
+}
+
 // RackGrowPlan is one volume grow action produced by the periodic rack-aware
 // growth scan. An empty Rack means the grow is DC-wide.
 type RackGrowPlan struct {
@@ -669,8 +932,8 @@ type RackGrowPlan struct {
 	WritableVolumeCount uint32
 }
 
-// PlanRackAwareGrowth returns the grow actions needed so every location that
-// can serve writes keeps a non-crowded writable volume. stepCount is the
+// PlanRackAwareGrowth returns the grow actions needed so every data center
+// this layout lives in keeps a non-crowded writable volume. stepCount is the
 // default per-event increment.
 //
 // For rack-spanning replication (DiffRackCount > 0) a single logical volume
@@ -685,21 +948,33 @@ func (vl *VolumeLayout) PlanRackAwareGrowth(dcs map[NodeId][]NodeId, lastGrowCou
 		stepCount = c
 	}
 	growOncePerDc := vl.rp.DiffRackCount > 0
+	// Only maintain data centers already hosting this layout's volumes: a
+	// collection pinned to one DC (fs.configure -dataCenter) must not sprout
+	// volumes in every other DC, and a DC that does need this layout gets its
+	// volumes from the DC-constrained assign that first asks for them.
+	hostingDCs := vl.listVolumeDataCenters(len(dcs))
 	// Spread lastGrowCount evenly across all grow targets. Summing every rack
 	// up front keeps the divisor global, so DCs with different rack counts do
 	// not each over-grow from a per-DC divisor.
-	var rackPairs uint32
-	for _, racks := range dcs {
+	var rackPairs, dcCount uint32
+	for dcId, racks := range dcs {
+		if _, hosting := hostingDCs[dcId]; !hosting {
+			continue
+		}
+		dcCount++
 		rackPairs += uint32(len(racks))
 	}
 	for dcId, racks := range dcs {
+		if _, hosting := hostingDCs[dcId]; !hosting {
+			continue
+		}
 		if growOncePerDc {
 			if !vl.ShouldGrowVolumesByDcAndRack(&writables, dcId, "") {
 				continue
 			}
 			count := stepCount
 			if lastGrowCount > 0 {
-				count = ceilDiv(lastGrowCount, uint32(len(dcs)))
+				count = ceilDiv(lastGrowCount, dcCount)
 			}
 			plans = append(plans, RackGrowPlan{DataCenter: string(dcId), WritableVolumeCount: count})
 			continue
@@ -765,32 +1040,37 @@ func (vl *VolumeLayout) CountUnderReplicatedVolumes() int {
 }
 
 func (vl *VolumeLayout) removeFromWritable(vid needle.VolumeId) bool {
-	toDeleteIndex := -1
+	if _, ok := vl.writableMembers[vid]; !ok {
+		return false
+	}
 	for k, id := range vl.writables {
 		if id == vid {
-			toDeleteIndex = k
-			break
+			glog.V(0).Infoln("Volume", vid, "becomes unwritable")
+			vl.writables = append(vl.writables[0:k], vl.writables[k+1:]...)
+			delete(vl.writableMembers, vid)
+			return true
 		}
 	}
-	if toDeleteIndex >= 0 {
-		glog.V(0).Infoln("Volume", vid, "becomes unwritable")
-		vl.writables = append(vl.writables[0:toDeleteIndex], vl.writables[toDeleteIndex+1:]...)
-		return true
-	}
 	return false
 }
 func (vl *VolumeLayout) setVolumeWritable(vid needle.VolumeId) bool {
-	for _, v := range vl.writables {
-		if v == vid {
-			return false
-		}
+	if _, ok := vl.deletingVolumes[vid]; ok {
+		return false
+	}
+	if _, ok := vl.writableMembers[vid]; ok {
+		return false
 	}
 	glog.V(1).Infoln("Volume", vid, "becomes writable")
 	vl.writables = append(vl.writables, vid)
+	vl.writableMembers[vid] = struct{}{}
 	return true
 }
 
+// SetVolumeReadOnly and SetVolumeWritable apply what dn itself said about its
+// replica of vid. That is recorded on the node first, so isAllWritable judges
+// the volume by it now rather than by the heartbeat that has yet to repeat it.
 func (vl *VolumeLayout) SetVolumeReadOnly(dn *DataNode, vid needle.VolumeId) bool {
+	dn.SetVolumeReadOnly(vid, true)
 	vl.accessLock.Lock()
 	defer vl.accessLock.Unlock()
 
@@ -802,6 +1082,7 @@ func (vl *VolumeLayout) SetVolumeReadOnly(dn *DataNode, vid needle.VolumeId) boo
 }
 
 func (vl *VolumeLayout) SetVolumeWritable(dn *DataNode, vid needle.VolumeId) bool {
+	dn.SetVolumeReadOnly(vid, false)
 	vl.accessLock.Lock()
 	defer vl.accessLock.Unlock()
 
@@ -809,12 +1090,40 @@ func (vl *VolumeLayout) SetVolumeWritable(dn *DataNode, vid needle.VolumeId) boo
 		location.SetReadOnly(dn, false)
 	}
 
-	if vl.enoughCopies(vid) {
+	if vl.enoughCopies(vid) && vl.isAllWritable(vid) {
 		return vl.setVolumeWritable(vid)
 	}
 	return false
 }
 
+// SetVolumeQuarantined marks dn's replica read-only at the layout level only.
+// The node's stored report is left untouched so the volume digest still tracks
+// what the server reports and quarantined copies do not force endless full
+// heartbeats.
+func (vl *VolumeLayout) SetVolumeQuarantined(dn *DataNode, vid needle.VolumeId) {
+	vl.accessLock.Lock()
+	defer vl.accessLock.Unlock()
+	if location, ok := vl.vid2location[vid]; ok {
+		location.SetReadOnly(dn, true)
+	}
+	vl.removeFromWritable(vid)
+}
+
+// SetReplicaReadOnlyFlag records what dn's latest heartbeat said about its
+// replica of vid, and nothing more: the writable list is left to
+// EnsureCorrectWritables and its capacity guards. Until now the flag only moved
+// on registration and volume.mark, so a replica that went read-only, or came
+// back, while the server ran kept its stale flag until the next restart. The
+// vacuum sweep reads this flag when it decides whether to skip a volume.
+func (vl *VolumeLayout) SetReplicaReadOnlyFlag(dn *DataNode, vid needle.VolumeId, readOnly bool) {
+	vl.accessLock.Lock()
+	defer vl.accessLock.Unlock()
+
+	if location, ok := vl.vid2location[vid]; ok {
+		location.SetReadOnly(dn, readOnly)
+	}
+}
+
 func (vl *VolumeLayout) SetVolumeUnavailable(dn *DataNode, vid needle.VolumeId) bool {
 	vl.accessLock.Lock()
 	defer vl.accessLock.Unlock()
@@ -841,7 +1150,7 @@ func (vl *VolumeLayout) SetVolumeUnavailable(dn *DataNode, vid needle.VolumeId)
 	}
 	return false
 }
-func (vl *VolumeLayout) SetVolumeAvailable(dn *DataNode, vid needle.VolumeId, isReadOnly, isFullCapacity bool) (becameWritable bool) {
+func (vl *VolumeLayout) SetVolumeAvailable(dn *DataNode, vid needle.VolumeId, isReadOnly, isFullCapacity, quarantined bool) (becameWritable bool) {
 	restoreActiveVolumeCount := false
 	vl.accessLock.Lock()
 	defer func() {
@@ -855,18 +1164,26 @@ func (vl *VolumeLayout) SetVolumeAvailable(dn *DataNode, vid needle.VolumeId, is
 	if err != nil {
 		return false
 	}
+	if vl.dropped {
+		return false
+	}
 
 	// A disconnect during a long vacuum can drop the entry while the volume is
 	// still on the node; re-create it instead of dereferencing a nil location,
 	// so the commit also repairs the split.
-	moveLookupOwnership(vid, vl.getOrCreateLocationList(vid).Set(dn), dn)
+	location := vl.getOrCreateLocationList(vid)
+	moveLookupOwnership(vid, location.Set(dn), dn)
 
+	if quarantined {
+		location.SetReadOnly(dn, true)
+		return false
+	}
 	if vInfo.ReadOnly || isReadOnly || isFullCapacity {
 		return false
 	}
 	vl.initSizeTracking(vid, vInfo.Size, vInfo.CompactRevision)
 
-	if vl.enoughCopies(vid) {
+	if vl.enoughCopies(vid) && vl.isAllWritable(vid) {
 		becameWritable = vl.setVolumeWritable(vid)
 		if becameWritable {
 			if st := vl.sizeTracking[vid]; st != nil && !st.fullSince.IsZero() {
@@ -919,11 +1236,14 @@ func (vl *VolumeLayout) setVolumeCrowded(vid needle.VolumeId) {
 }
 
 func (vl *VolumeLayout) SetVolumeCrowded(vid needle.VolumeId) {
-	// since delete is guarded by accessLock.Lock(),
-	// and is always called in sequential order,
-	// RLock() should be safe enough
-	vl.accessLock.RLock()
-	defer vl.accessLock.RUnlock()
+	// setVolumeCrowded mutates the crowded map, and GetWritableVolumeCount
+	// reads it under RLock on the Assign hot path. Two concurrent RLock
+	// holders with one writing the map triggers a fatal
+	// "concurrent map read and map write". Take the write lock: this path
+	// is a low-frequency single consumer driven by the crowded-volume
+	// event loop, and every other mutation of crowded already holds Lock().
+	vl.accessLock.Lock()
+	defer vl.accessLock.Unlock()
 
 	vl.setVolumeCrowded(vid)
 }
@@ -946,12 +1266,26 @@ func (vl *VolumeLayout) ToInfo() (info VolumeLayoutInfo) {
 }
 
 func (vlc *VolumeLayoutCollection) ToVolumeGrowRequest() *master_pb.VolumeGrowRequest {
-	return &master_pb.VolumeGrowRequest{
+	vgr := &master_pb.VolumeGrowRequest{
 		Collection:  vlc.Collection,
 		Replication: vlc.VolumeLayout.rp.String(),
 		Ttl:         vlc.VolumeLayout.ttl.String(),
 		DiskType:    vlc.VolumeLayout.diskType.String(),
 	}
+	// A layout living in exactly one data center is either pinned there or on
+	// a single-DC cluster; either way unconstrained growth has no business
+	// placing its volumes elsewhere. Cross-DC replication can never
+	// legitimately live in one DC — there a single hosting DC means an
+	// outage, not a pin.
+	if vlc.VolumeLayout.rp.DiffDataCenterCount > 0 {
+		return vgr
+	}
+	if dcs := vlc.VolumeLayout.listVolumeDataCenters(2); len(dcs) == 1 {
+		for dc := range dcs {
+			vgr.DataCenter = string(dc)
+		}
+	}
+	return vgr
 }
 
 func (vl *VolumeLayout) Stats() *VolumeLayoutStats {
diff --git a/weed/topology/volume_layout_avg_fill_test.go b/weed/topology/volume_layout_avg_fill_test.go
new file mode 100644
index 0000000000..23a85512dd
--- /dev/null
+++ b/weed/topology/volume_layout_avg_fill_test.go
@@ -0,0 +1,179 @@
+package topology
+
+import (
+	"math"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+func TestWritableAvgFill(t *testing.T) {
+	// 3 writable volumes at 20%, 50%, 80% fill (sizes 2000, 5000, 8000 of
+	// limit 10000): average fill is 50%.
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":2000, "replication":"000"},
+          {"id":2, "size":5000, "replication":"000"},
+          {"id":3, "size":8000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	avgFill, writableCount := vl.WritableAvgFill(nil)
+	if writableCount != 3 {
+		t.Fatalf("expected 3 writable volumes, got %d", writableCount)
+	}
+	if math.Abs(avgFill-0.5) > 1e-9 {
+		t.Errorf("expected avg fill 0.5, got %v", avgFill)
+	}
+}
+
+func TestWritableAvgFillNoWritables(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":2000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	vl.accessLock.Lock()
+	vl.removeFromWritable(1)
+	vl.accessLock.Unlock()
+
+	avgFill, writableCount := vl.WritableAvgFill(nil)
+	if writableCount != 0 || avgFill != 0 {
+		t.Errorf("expected (0, 0) with no writables, got (%v, %d)", avgFill, writableCount)
+	}
+}
+
+// A writable volume without a size-tracking entry yet — freshly created, no
+// heartbeat size report so far — counts as empty, not as an error.
+func TestWritableAvgFillUntrackedVolumeCountsAsEmpty(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":5000, "replication":"000"},
+          {"id":2, "size":5000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	vl.accessLock.Lock()
+	delete(vl.sizeTracking, 2)
+	vl.accessLock.Unlock()
+
+	avgFill, writableCount := vl.WritableAvgFill(nil)
+	if writableCount != 2 {
+		t.Fatalf("expected 2 writable volumes, got %d", writableCount)
+	}
+	if math.Abs(avgFill-0.25) > 1e-9 {
+		t.Errorf("expected avg fill 0.25 (one of two volumes empty), got %v", avgFill)
+	}
+}
+
+func TestWritableAvgFillScopedToTarget(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":9000, "replication":"000"},
+          {"id":2, "size":9000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  },
+  "dc2":{
+    "rack2":{
+      "server2":{
+        "volumes":[
+          {"id":3, "size":1000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	avgFill, writableCount := vl.WritableAvgFill(&VolumeGrowOption{DataCenter: "dc2"})
+	if writableCount != 1 || math.Abs(avgFill-0.1) > 1e-9 {
+		t.Fatalf("expected dc2 fill (0.1, 1), got (%v, %d)", avgFill, writableCount)
+	}
+
+	// A target with no writable volumes reports none, so growth is not
+	// blocked by fill elsewhere.
+	avgFill, writableCount = vl.WritableAvgFill(&VolumeGrowOption{DataCenter: "dc2", DataNode: "missing"})
+	if writableCount != 0 || avgFill != 0 {
+		t.Fatalf("expected (0, 0) for a target with no writables, got (%v, %d)", avgFill, writableCount)
+	}
+}
+
+func TestFindVolumeLayout(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":2000, "collection":"colA", "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	topo := setupWithLimit(t, layout, 10000)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	// Existing layout is found.
+	if vl := topo.FindVolumeLayout("colA", rp, needle.EMPTY_TTL, types.HardDriveType); vl == nil {
+		t.Error("expected layout for colA to be found")
+	}
+
+	// A missing collection resolves to nil and must not be created.
+	if vl := topo.FindVolumeLayout("noSuchCollection", rp, needle.EMPTY_TTL, types.HardDriveType); vl != nil {
+		t.Error("expected nil layout for unknown collection")
+	}
+	if _, ok := topo.collectionMap.Find("noSuchCollection"); ok {
+		t.Error("FindVolumeLayout must not create the collection")
+	}
+
+	// A missing layout within an existing collection also resolves to nil.
+	rpOther, _ := super_block.NewReplicaPlacementFromString("001")
+	if vl := topo.FindVolumeLayout("colA", rpOther, needle.EMPTY_TTL, types.HardDriveType); vl != nil {
+		t.Error("expected nil layout for unused replication")
+	}
+}
diff --git a/weed/topology/volume_layout_capacity_recovery_test.go b/weed/topology/volume_layout_capacity_recovery_test.go
index cd617e17e8..686c67e4ba 100644
--- a/weed/topology/volume_layout_capacity_recovery_test.go
+++ b/weed/topology/volume_layout_capacity_recovery_test.go
@@ -46,13 +46,13 @@ func TestSetVolumeCapacityFullStampsFullSinceAndRecovers(t *testing.T) {
 
 	// No recovery before capacityRecoveryDelay.
 	advanceSizeTrackingClock(vl, 1, 3*time.Second)
-	if vl.UpdateVolumeSize(1, 4000, 0) {
+	if vl.UpdateVolumeSize(1, 4000, 0, true) {
 		t.Fatalf("recovery should not fire before capacityRecoveryDelay")
 	}
 
 	// After the delay, a smaller size restores it.
 	advanceSizeTrackingClock(vl, 1, capacityRecoveryDelay)
-	if !vl.UpdateVolumeSize(1, 4000, 0) {
+	if !vl.UpdateVolumeSize(1, 4000, 0, true) {
 		t.Fatalf("expected volume to recover to writable after shrinking")
 	}
 	vl.AdjustActiveVolumeCountAfterRecovery(1)
@@ -98,7 +98,7 @@ func TestSetVolumeAvailableRestoresActiveCountForCapacityFullVolume(t *testing.T
 	dn := vl.vid2location[1].list[0]
 	vl.accessLock.RUnlock()
 
-	if !vl.SetVolumeAvailable(dn, 1, false, false) {
+	if !vl.SetVolumeAvailable(dn, 1, false, false, false) {
 		t.Fatalf("SetVolumeAvailable should report the volume became writable")
 	}
 	if got := topo.diskUsages.usages[types.HardDriveType].activeVolumeCount; got != initialActive {
@@ -109,10 +109,224 @@ func TestSetVolumeAvailableRestoresActiveCountForCapacityFullVolume(t *testing.T
 	}
 
 	advanceSizeTrackingClock(vl, 1, capacityRecoveryDelay+time.Second)
-	if vl.UpdateVolumeSize(1, 4000, 0) {
+	if vl.UpdateVolumeSize(1, 4000, 0, true) {
 		t.Fatalf("heartbeat recovery should not fire after SetVolumeAvailable already restored the volume")
 	}
 	if got := topo.diskUsages.usages[types.HardDriveType].activeVolumeCount; got != initialActive {
 		t.Fatalf("expected activeVolumeCount to remain %d, got %d", initialActive, got)
 	}
 }
+
+// A volume marked full by pending estimates takes no writes, so no heartbeat
+// reports it again and only the periodic decay can bring it back.
+func TestDecayQuietVolumeSizesRecoversPhantomFullVolume(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":4000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	topo, vl := setupPickTest(t, layout, 10000)
+	VolumeGrowStrategy.Threshold = 0.9
+
+	initialActive := topo.diskUsages.usages[types.HardDriveType].activeVolumeCount
+	if !vl.RecordAssign(1, 20000) {
+		t.Fatalf("expected RecordAssign to remove the volume from writable")
+	}
+	vl.AdjustActiveVolumeCountForFull(1)
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected 0 writable after the pending estimate filled the volume, got %d", w)
+	}
+
+	recovered := false
+	for i := 0; i < 10 && !recovered; i++ {
+		advanceSizeTrackingClock(vl, 1, capacityRecoveryDelay+time.Second)
+		topo.DecayQuietVolumeSizes()
+		w, _ := vl.GetWritableVolumeCount()
+		recovered = w == 1
+	}
+	if !recovered {
+		t.Fatalf("the periodic decay never returned the volume to the writable list")
+	}
+	if got := topo.diskUsages.usages[types.HardDriveType].activeVolumeCount; got != initialActive {
+		t.Fatalf("expected activeVolumeCount restored to %d, got %d", initialActive, got)
+	}
+	if !vl.sizeTracking[1].fullSince.IsZero() {
+		t.Fatalf("expected fullSince cleared after recovery")
+	}
+}
+
+// The decay must not consume the replica-dedup window: a real report landing
+// right behind it carries a size no volume server will send again, since only
+// a volume whose content changed is reported at all.
+func TestDecayQuietVolumeSizesKeepsTheNextHeartbeat(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":4000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	topo, vl := setupPickTest(t, layout, 10000)
+
+	vl.RecordAssign(1, 2000)
+	advanceSizeTrackingClock(vl, 1, 30*time.Second)
+	topo.DecayQuietVolumeSizes()
+
+	vl.UpdateVolumeSize(1, 6000, 7, true)
+
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+	if got := vl.sizeTracking[1].reportedSize; got != 6000 {
+		t.Errorf("the heartbeat after a decay left reportedSize at %d, want the reported 6000", got)
+	}
+	if got := vl.sizeTracking[1].compactRevision; got != 7 {
+		t.Errorf("the heartbeat after a decay left compactRevision at %d, want the reported 7", got)
+	}
+}
+
+// The decay picks its volumes under a read lock and replays them under a write
+// one. A compaction heartbeat landing in that gap must survive, so the replay
+// takes the record as it stands rather than the size the pass set out with —
+// the arguments below stand in for that older snapshot.
+func TestDecayQuietVolumeSizesDoesNotRollBackAHeartbeat(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":9000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	vl.RecordAssign(1, 500)
+	// The heartbeat that wins the race: a compaction shrank the volume.
+	vl.UpdateVolumeSize(1, 2000, 3, true)
+	// Far enough behind that the dedup window no longer covers for the replay,
+	// which is the only case where reading the record under the lock is what
+	// saves the report.
+	advanceSizeTrackingClock(vl, 1, 3*time.Second)
+
+	vl.UpdateVolumeSize(1, 9000, 0, false)
+
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+	if got := vl.sizeTracking[1].reportedSize; got != 2000 {
+		t.Errorf("the decay rolled reportedSize back to %d, want the compacted 2000", got)
+	}
+	if got := vl.sizeTracking[1].compactRevision; got != 3 {
+		t.Errorf("the decay rolled compactRevision back to %d, want the reported 3", got)
+	}
+	if got := vl.sizeTracking[1].effectiveSize; got > 2000 {
+		t.Errorf("effectiveSize %d outgrew the compacted size the heartbeat reported", got)
+	}
+}
+
+// The decay stands in for a report that never came, so a heartbeat arriving
+// after the pass chose the volume takes its place rather than adding to it:
+// halving twice in one cycle forgets pending bytes the volume has yet to write.
+func TestDecayQuietVolumeSizesYieldsToAHeartbeatItRaced(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":4000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	vl.RecordAssign(1, 4000)
+	advanceSizeTrackingClock(vl, 1, 30*time.Second)
+
+	// The heartbeat wins the race and does the one decay this cycle owes.
+	vl.UpdateVolumeSize(1, 4000, 0, true)
+	vl.accessLock.RLock()
+	afterHeartbeat := vl.sizeTracking[1].effectiveSize
+	vl.accessLock.RUnlock()
+	if afterHeartbeat != 6000 {
+		t.Fatalf("the heartbeat left effectiveSize at %d, want 6000", afterHeartbeat)
+	}
+
+	vl.UpdateVolumeSize(1, 0, 0, false)
+
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+	if got := vl.sizeTracking[1].effectiveSize; got != afterHeartbeat {
+		t.Errorf("the decay halved again to %d, want the heartbeat's %d left alone", got, afterHeartbeat)
+	}
+}
+
+// A volume the disk really did fill can never recover through the decay, so it
+// must leave the candidate set instead of costing a write lock every pulse for
+// the rest of its life.
+func TestDecayQuietVolumeSizesSkipsAGenuinelyFullVolume(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":10000, "replication":"000"},
+          {"id":2, "size":4000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	// Volume 1 is full on disk; volume 2 only looks full to the estimate.
+	vl.SetVolumeCapacityFull(1)
+	vl.RecordAssign(2, 6000)
+	advanceSizeTrackingClock(vl, 1, 30*time.Second)
+	advanceSizeTrackingClock(vl, 2, 30*time.Second)
+
+	candidates := vl.quietDecayCandidates(10 * time.Second)
+	for _, vid := range candidates {
+		if vid == 1 {
+			t.Errorf("the decay keeps taking the write lock for volume 1, which the disk really did fill")
+		}
+	}
+	if len(candidates) != 1 || candidates[0] != 2 {
+		t.Errorf("candidates %v, want only the phantom-full volume 2", candidates)
+	}
+
+	vl.DecayQuietVolumeSizes(10 * time.Second)
+
+	vl.accessLock.RLock()
+	defer vl.accessLock.RUnlock()
+	if got := vl.sizeTracking[2].effectiveSize; got != 7000 {
+		t.Errorf("the phantom-full volume was left at %d, want it decayed to 7000", got)
+	}
+}
diff --git a/weed/topology/volume_layout_drain_test.go b/weed/topology/volume_layout_drain_test.go
index 6132b7a2c0..0199266b20 100644
--- a/weed/topology/volume_layout_drain_test.go
+++ b/weed/topology/volume_layout_drain_test.go
@@ -4,6 +4,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/storage"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
 	"github.com/seaweedfs/seaweedfs/weed/storage/types"
@@ -38,7 +39,7 @@ func TestGetPendingSize(t *testing.T) {
 	}
 
 	// UpdateVolumeSize (heartbeat) decays pending
-	vl.UpdateVolumeSize(1, 3000, 0)
+	vl.UpdateVolumeSize(1, 3000, 0, true)
 	// effective was 6000, reported 3000 → decay to 3000 + (6000-3000)/2 = 4500
 	// pending = 4500 - 3000 = 1500
 	if p := vl.GetPendingSize(1); p != 1500 {
@@ -72,7 +73,7 @@ func TestGetPendingSize_CompactionResets(t *testing.T) {
 	// Compaction happens — size drops from 5000 to 2000, revision changes.
 	// Without compaction awareness, decay would give: 2000 + (9000-2000)/2 = 5500.
 	// With compaction awareness, vid2size resets to 2000 (the real size).
-	vl.UpdateVolumeSize(1, 2000, 1) // revision 0 → 1
+	vl.UpdateVolumeSize(1, 2000, 1, true) // revision 0 → 1
 
 	if p := vl.GetPendingSize(1); p != 0 {
 		t.Errorf("expected 0 pending after compaction reset, got %d", p)
@@ -198,7 +199,7 @@ func TestDrainAndRemoveFromWritable_DecaysViaConcurrentHeartbeat(t *testing.T) {
 				st.lastUpdateTime = time.Time{} // reset to allow update
 			}
 			vl.accessLock.Unlock()
-			vl.UpdateVolumeSize(1, 1000+uint64(i+1)*1000, 0)
+			vl.UpdateVolumeSize(1, 1000+uint64(i+1)*1000, 0, true)
 		}
 	}()
 
@@ -259,3 +260,39 @@ func TestSetVolumeReadOnly_PreservesPending(t *testing.T) {
 		t.Errorf("expected 5000 pending (not drained), got %d", p)
 	}
 }
+
+// A heartbeat landing mid-delete re-evaluates writability; a marked volume
+// must stay out of the writable list until the sweep finishes with it.
+func TestMarkDeletingKeepsVolumeUnwritableAcrossHeartbeats(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":1000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	if writable, _ := vl.GetWritableVolumeCount(); writable != 1 {
+		t.Fatalf("volume not writable before mark, got %d", writable)
+	}
+
+	vl.MarkDeleting(1)
+
+	vl.EnsureCorrectWritables(&storage.VolumeInfo{Id: 1})
+	if writable, _ := vl.GetWritableVolumeCount(); writable != 0 {
+		t.Fatal("marked volume became writable again")
+	}
+
+	vl.UnmarkDeleting(1)
+	if writable, _ := vl.GetWritableVolumeCount(); writable != 1 {
+		t.Fatal("unmarked volume did not regain writability without a heartbeat")
+	}
+}
diff --git a/weed/topology/volume_layout_grow_test.go b/weed/topology/volume_layout_grow_test.go
index 83fb2d6f28..c27af5a315 100644
--- a/weed/topology/volume_layout_grow_test.go
+++ b/weed/topology/volume_layout_grow_test.go
@@ -1,6 +1,7 @@
 package topology
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
@@ -240,6 +241,116 @@ func TestPlanRackAwareGrowth_EvenDistributionAcrossUnevenDCs(t *testing.T) {
 	}
 }
 
+// A collection pinned to one data center (fs.configure -dataCenter) lives only
+// there, yet the scan used to plan growth for every data center in the
+// topology, spreading the collection's volumes across all of them. Data
+// centers hosting none of the layout's volumes are not the scan's to fill.
+func TestPlanRackAwareGrowth_SkipsDataCentersWithoutLayoutVolumes(t *testing.T) {
+	layout := `
+{
+  "dc1":{ "rack1":{ "node-a":{ "ip":"10.0.0.1", "volumes":[ {"id":1, "size":%d, "replication":"000", "collection":"pinned"} ], "limit":30 } } },
+  "dc2":{ "rack2":{ "node-b":{ "ip":"10.0.0.2", "volumes":[], "limit":30 } } },
+  "dc3":{ "rack3":{ "node-c":{ "ip":"10.0.0.3", "volumes":[], "limit":30 } } },
+  "dc4":{ "rack4":{ "node-d":{ "ip":"10.0.0.4", "volumes":[], "limit":30 } } }
+}
+`
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	topo := setupWithLimit(t, fmt.Sprintf(layout, 1000), 30000)
+	vl := topo.GetVolumeLayout("pinned", rp, needle.EMPTY_TTL, types.HardDriveType)
+	if plans := vl.PlanRackAwareGrowth(topo.ListDCAndRacks(), 0, 2); len(plans) != 0 {
+		t.Fatalf("healthy dc1 volume: expected no growth, got %+v", plans)
+	}
+
+	topo = setupWithLimit(t, fmt.Sprintf(layout, 28650), 30000)
+	vl = topo.GetVolumeLayout("pinned", rp, needle.EMPTY_TTL, types.HardDriveType)
+	plans := vl.PlanRackAwareGrowth(topo.ListDCAndRacks(), 0, 2)
+	if len(plans) != 1 {
+		t.Fatalf("crowded dc1 volume: expected 1 grow, got %d: %+v", len(plans), plans)
+	}
+	if plans[0].DataCenter != "dc1" || plans[0].Rack != "rack1" {
+		t.Errorf("expected grow pinned to dc1/rack1, got %s/%s", plans[0].DataCenter, plans[0].Rack)
+	}
+}
+
+// The lastGrowCount divisor counts only the racks the scan can actually plan
+// for; racks of skipped data centers would dilute every grow.
+func TestPlanRackAwareGrowth_DivisorCountsOnlyHostingRacks(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{ "node-a":{ "ip":"10.0.0.1", "volumes":[ {"id":1, "size":28650, "replication":"000", "collection":"pinned"} ], "limit":30 } },
+    "rack2":{ "node-b":{ "ip":"10.0.0.2", "volumes":[ {"id":2, "size":28650, "replication":"000", "collection":"pinned"} ], "limit":30 } }
+  },
+  "dc2":{
+    "rack3":{ "node-c":{ "ip":"10.0.0.3", "volumes":[], "limit":30 } },
+    "rack4":{ "node-d":{ "ip":"10.0.0.4", "volumes":[], "limit":30 } }
+  }
+}
+`
+	topo := setupWithLimit(t, layout, 30000)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	vl := topo.GetVolumeLayout("pinned", rp, needle.EMPTY_TTL, types.HardDriveType)
+
+	plans := vl.PlanRackAwareGrowth(topo.ListDCAndRacks(), 4, 2)
+	if len(plans) != 2 {
+		t.Fatalf("expected a grow per crowded dc1 rack, got %d: %+v", len(plans), plans)
+	}
+	for _, p := range plans {
+		if p.DataCenter != "dc1" {
+			t.Errorf("expected grows pinned to dc1, got %s/%s", p.DataCenter, p.Rack)
+		}
+		if p.WritableVolumeCount != 2 { // ceilDiv(4, 2 hosting racks), not ceilDiv(4, 4)
+			t.Errorf("expected per-rack count 2, got %d", p.WritableVolumeCount)
+		}
+	}
+}
+
+// The periodic must-grow and crowded growth paths build their request from
+// ToVolumeGrowRequest. For a layout living in exactly one data center the
+// request carries that DC, so those paths do not scatter a pinned collection
+// either; a layout spanning DCs keeps unconstrained growth.
+func TestToVolumeGrowRequest_SingleDataCenterLayout(t *testing.T) {
+	layout := `
+{
+  "dc1":{ "rack1":{ "node-a":{ "ip":"10.0.0.1", "volumes":[ {"id":1, "size":1000, "replication":"000", "collection":"pinned"} ], "limit":30 } } },
+  "dc2":{ "rack2":{ "node-b":{ "ip":"10.0.0.2", "volumes":[ {"id":2, "size":1000, "replication":"000", "collection":"spread"} ], "limit":30 } } },
+  "dc3":{ "rack3":{ "node-c":{ "ip":"10.0.0.3", "volumes":[ {"id":3, "size":1000, "replication":"000", "collection":"spread"} ], "limit":30 } } }
+}
+`
+	topo := setupWithLimit(t, layout, 30000)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+
+	pinned := &VolumeLayoutCollection{"pinned", topo.GetVolumeLayout("pinned", rp, needle.EMPTY_TTL, types.HardDriveType)}
+	if vgr := pinned.ToVolumeGrowRequest(); vgr.DataCenter != "dc1" {
+		t.Errorf("expected growth pinned to dc1, got %q", vgr.DataCenter)
+	}
+
+	spread := &VolumeLayoutCollection{"spread", topo.GetVolumeLayout("spread", rp, needle.EMPTY_TTL, types.HardDriveType)}
+	if vgr := spread.ToVolumeGrowRequest(); vgr.DataCenter != "" {
+		t.Errorf("expected unconstrained growth for a multi-DC layout, got %q", vgr.DataCenter)
+	}
+}
+
+// Cross-DC replication can never legitimately live in one data center: a
+// single hosting DC there means the other DCs are down, and pinning growth to
+// the survivor would encode the outage as a placement constraint.
+func TestToVolumeGrowRequest_CrossDCReplicationNeverPinned(t *testing.T) {
+	layout := `
+{
+  "dc1":{ "rack1":{ "node-a":{ "ip":"10.0.0.1", "volumes":[ {"id":1, "size":1000, "replication":"100", "collection":"c"} ], "limit":30 } } },
+  "dc2":{ "rack2":{ "node-b":{ "ip":"10.0.0.2", "volumes":[], "limit":30 } } }
+}
+`
+	topo := setupWithLimit(t, layout, 30000)
+	rp, _ := super_block.NewReplicaPlacementFromString("100")
+
+	vlc := &VolumeLayoutCollection{"c", topo.GetVolumeLayout("c", rp, needle.EMPTY_TTL, types.HardDriveType)}
+	if vgr := vlc.ToVolumeGrowRequest(); vgr.DataCenter != "" {
+		t.Errorf("expected unconstrained growth for cross-DC replication, got %q", vgr.DataCenter)
+	}
+}
+
 // Volumes packed to capacity (e.g. by fs.mergeVolumes) go crowded and then
 // unwritable, but stay in the crowded map. ShouldGrowVolumes must count only
 // writable crowded volumes, or those leftovers keep writable <= crowded true
diff --git a/weed/topology/volume_layout_max_writable_test.go b/weed/topology/volume_layout_max_writable_test.go
new file mode 100644
index 0000000000..26b718801e
--- /dev/null
+++ b/weed/topology/volume_layout_max_writable_test.go
@@ -0,0 +1,127 @@
+package topology
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+func maxWritableLayout(t *testing.T, n int) (*Topology, *DataNode, *VolumeLayout) {
+	t.Helper()
+	topo := NewTopology("mw", nil, 32*1024, 5, false)
+	topo.SetMaxWritableVolumes(n)
+	dn := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, 18080, "", "", map[string]uint32{"": 100})
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	return topo, dn, topo.GetVolumeLayout("c", rp, needle.EMPTY_TTL, types.HardDriveType)
+}
+
+// With a cap, assignments concentrate on the fullest writable volumes so at
+// most cap volumes are written in parallel.
+func TestPickForWriteCapsWritableVolumes(t *testing.T) {
+	topo, dn, vl := maxWritableLayout(t, 1)
+
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		sizeTrackingVolume(1, 30000, false),
+		sizeTrackingVolume(2, 1000, false),
+		sizeTrackingVolume(3, 500, false),
+	}, dn)
+
+	for i := 0; i < 20; i++ {
+		vid, _, _, _, err := vl.PickForWrite(1, &VolumeGrowOption{})
+		if err != nil {
+			t.Fatalf("PickForWrite: %v", err)
+		}
+		if vid != needle.VolumeId(1) {
+			t.Fatalf("picked volume %d, want the fullest writable 1", vid)
+		}
+	}
+}
+
+// Once the fullest volume leaves the writable list, the next fullest takes over.
+func TestPickForWriteCapFallsToNextWritable(t *testing.T) {
+	topo, dn, vl := maxWritableLayout(t, 1)
+
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		sizeTrackingVolume(1, 30000, false),
+		sizeTrackingVolume(2, 1000, false),
+	}, dn)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		sizeTrackingVolume(1, 30000, true),
+		sizeTrackingVolume(2, 1000, false),
+	}, dn)
+
+	vid, _, _, _, err := vl.PickForWrite(1, &VolumeGrowOption{})
+	if err != nil {
+		t.Fatalf("PickForWrite: %v", err)
+	}
+	if vid != needle.VolumeId(2) {
+		t.Fatalf("picked volume %d, want 2 after 1 went read-only", vid)
+	}
+}
+
+// A cap of two still concentrates on the two fullest writables; zero disables
+// the cap so every writable volume is a candidate.
+func TestPickForWriteCapOfTwoAndDisabled(t *testing.T) {
+	topo, dn, vl := maxWritableLayout(t, 2)
+
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		sizeTrackingVolume(1, 30000, false),
+		sizeTrackingVolume(2, 20000, false),
+		sizeTrackingVolume(3, 500, false),
+	}, dn)
+
+	// the capped candidate set is deterministic even though the pick among
+	// them is weighted-random
+	if got := vl.fullestWritable(vl.writables); !slices.Equal(got, []needle.VolumeId{1, 2}) {
+		t.Fatalf("capped candidates %v, want [1 2]", got)
+	}
+	for i := 0; i < 40; i++ {
+		vid, _, _, _, err := vl.PickForWrite(1, &VolumeGrowOption{})
+		if err != nil {
+			t.Fatalf("PickForWrite: %v", err)
+		}
+		if vid != needle.VolumeId(1) && vid != needle.VolumeId(2) {
+			t.Fatalf("capped pick reached volume %d, want one of 1,2", vid)
+		}
+	}
+
+	vl.maxWritableVolumes = 0
+	for i := 0; i < 40; i++ {
+		if _, _, _, _, err := vl.PickForWrite(1, &VolumeGrowOption{}); err != nil {
+			t.Fatalf("PickForWrite: %v", err)
+		}
+	}
+}
+
+// The cap applies inside the requested location: with cap 1, a write naming
+// dc2 must still find dc2's writable volume even though the fullest is in dc1.
+func TestPickForWriteCapWithinRequestedLocation(t *testing.T) {
+	topo := NewTopology("mw", nil, 32*1024, 5, false)
+	topo.SetMaxWritableVolumes(1)
+	dn1 := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1").
+		GetOrCreateDataNode("127.0.0.1", 8080, 18080, "", "", map[string]uint32{"": 100})
+	dn2 := topo.GetOrCreateDataCenter("dc2").GetOrCreateRack("rack2").
+		GetOrCreateDataNode("127.0.0.2", 8080, 18080, "", "", map[string]uint32{"": 100})
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	vl := topo.GetVolumeLayout("c", rp, needle.EMPTY_TTL, types.HardDriveType)
+
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		sizeTrackingVolume(1, 30000, false), // fullest, in dc1
+	}, dn1)
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		sizeTrackingVolume(2, 1000, false), // in dc2
+	}, dn2)
+
+	vid, _, _, _, err := vl.PickForWrite(1, &VolumeGrowOption{DataCenter: "dc2"})
+	if err != nil {
+		t.Fatalf("PickForWrite dc2: %v", err)
+	}
+	if vid != needle.VolumeId(2) {
+		t.Fatalf("picked volume %d, want dc2's volume 2", vid)
+	}
+}
diff --git a/weed/topology/volume_layout_oversized_heartbeat_test.go b/weed/topology/volume_layout_oversized_heartbeat_test.go
new file mode 100644
index 0000000000..efa76b89a5
--- /dev/null
+++ b/weed/topology/volume_layout_oversized_heartbeat_test.go
@@ -0,0 +1,318 @@
+package topology
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/sequence"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+)
+
+// A volume that grew past the limit keeps bouncing between writable and
+// unwritable when the oversized mark is not refreshed on heartbeat: RegisterVolume
+// sets it once, but the delta heartbeat path (ApplyVolumeChanges) never re-sets
+// it, so ensureCorrectWritables sees a stale "not oversized" mark and re-adds
+// the volume to writables on the next heartbeat, while RecordAssign removes it
+// on the next assign. UpdateOversizedState must keep the mark current.
+func TestUpdateOversizedStateKeepsOversizedVolumeUnwritable(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":4000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	// Grow the volume past the limit, as RecordAssign would see it.
+	if !vl.RecordAssign(1, 9000) {
+		t.Fatalf("RecordAssign should report the volume reached capacity")
+	}
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected 0 writable after RecordAssign, got %d", w)
+	}
+
+	// A heartbeat that reports the now-oversized volume must refresh the mark
+	// so ensureCorrectWritables does not re-add it to writables. Mirrors the
+	// heartbeat order: refresh, then decay, then correct.
+	dn := vl.vid2location[1].list[0]
+	vi, err := dn.GetVolumesById(1)
+	if err != nil {
+		t.Fatalf("GetVolumesById: %v", err)
+	}
+	oversized := vi
+	oversized.Size = 12000
+	vl.UpdateOversizedState(&oversized, dn)
+	vl.UpdateVolumeSize(1, oversized.Size, 0, true)
+	vl.EnsureCorrectWritables(&oversized)
+
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected volume to stay unwritable after heartbeat refresh, got %d writable", w)
+	}
+	if !vl.vid2location[1].AnyOversized() {
+		t.Fatalf("expected AnyOversized to be true after heartbeat refresh")
+	}
+}
+
+// A volume that shrank back under the limit must have its oversized mark
+// cleared by the heartbeat refresh, or it stays locked out of writables
+// forever.
+func TestUpdateOversizedStateClearsMarkWhenVolumeShrinks(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":4000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	dn := vl.vid2location[1].list[0]
+	vi, err := dn.GetVolumesById(1)
+	if err != nil {
+		t.Fatalf("GetVolumesById: %v", err)
+	}
+
+	// Mark oversized via a heartbeat that reports a huge size.
+	big := vi
+	big.Size = 12000
+	vl.UpdateOversizedState(&big, dn)
+	if !vl.vid2location[1].AnyOversized() {
+		t.Fatalf("expected AnyOversized after a huge report")
+	}
+
+	// A later heartbeat with a normal size clears the mark.
+	vl.UpdateOversizedState(&vi, dn)
+	if vl.vid2location[1].AnyOversized() {
+		t.Fatalf("expected AnyOversized cleared after the volume shrank")
+	}
+}
+
+// A volume removed for capacity must not be re-added to writables by
+// ensureCorrectWritables before capacityRecoveryDelay elapses, even after its
+// oversized mark is cleared by a heartbeat that reports a smaller size.
+func TestEnsureCorrectWritablesHonorsRecoveryCooldown(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":4000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	// Remove the volume for capacity, as RecordAssign would.
+	if !vl.RecordAssign(1, 9000) {
+		t.Fatalf("RecordAssign should report the volume reached capacity")
+	}
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected 0 writable after RecordAssign, got %d", w)
+	}
+
+	dn := vl.vid2location[1].list[0]
+	vi, err := dn.GetVolumesById(1)
+	if err != nil {
+		t.Fatalf("GetVolumesById: %v", err)
+	}
+
+	// Heartbeat reports the volume shrank back under the limit: the oversized
+	// mark clears and effectiveSize decays, but the volume is still within
+	// capacityRecoveryDelay.
+	vi.Size = 4000
+	vl.UpdateOversizedState(&vi, dn)
+	vl.UpdateVolumeSize(1, vi.Size, 0, true)
+	vl.EnsureCorrectWritables(&vi)
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected volume to stay unwritable during the cooldown, got %d writable", w)
+	}
+
+	// After the cooldown, a heartbeat with the shrunken size recovers it.
+	advanceSizeTrackingClock(vl, 1, capacityRecoveryDelay+time.Second)
+	if !vl.UpdateVolumeSize(1, vi.Size, 0, true) {
+		t.Fatalf("expected volume to recover to writable after the cooldown")
+	}
+	vl.EnsureCorrectWritables(&vi)
+	if w, _ := vl.GetWritableVolumeCount(); w != 1 {
+		t.Fatalf("expected volume writable after the cooldown, got %d", w)
+	}
+}
+
+// After the cooldown elapses, a volume whose effective size is still at the
+// limit must not be restored by ensureCorrectWritables: the next assign would
+// remove it again.
+func TestEnsureCorrectWritablesDoesNotRestoreVolumeStillAtLimit(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":8000, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	_, vl := setupPickTest(t, layout, 10000)
+
+	// Remove the volume for capacity, as RecordAssign would. effectiveSize
+	// lands at 13000, past the limit (10000); after the decay against a
+	// reported size of 8000 it stays at 10500, still past the limit.
+	if !vl.RecordAssign(1, 5000) {
+		t.Fatalf("RecordAssign should report the volume reached capacity")
+	}
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected 0 writable after RecordAssign, got %d", w)
+	}
+
+	dn := vl.vid2location[1].list[0]
+	vi, err := dn.GetVolumesById(1)
+	if err != nil {
+		t.Fatalf("GetVolumesById: %v", err)
+	}
+
+	// Heartbeat reports a size below the limit: the oversized mark clears,
+	// but the decay only halves the pending estimate, so effectiveSize stays
+	// past the limit and UpdateVolumeSize refuses recovery.
+	vi.Size = 8000
+	vl.UpdateOversizedState(&vi, dn)
+	vl.UpdateVolumeSize(1, vi.Size, 0, true)
+	if vl.vid2location[1].AnyOversized() {
+		t.Fatalf("expected oversized mark cleared after the shrink report")
+	}
+
+	// After the cooldown, the volume is still at the limit:
+	// ensureCorrectWritables must not override UpdateVolumeSize's refusal.
+	advanceSizeTrackingClock(vl, 1, capacityRecoveryDelay+time.Second)
+	vl.EnsureCorrectWritables(&vi)
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected volume at the limit to stay unwritable, got %d writable", w)
+	}
+}
+
+// A crowded volume is not a full one: it is above the growth threshold but
+// still has room. One that drops out of writables while a replica is away must
+// come back when the replica returns -- nothing writes to a volume that is not
+// writable, so its size can never fall on its own and the lockout would be
+// permanent.
+func TestEnsureCorrectWritablesRestoresCrowdedVolumeAfterReplicaReturns(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "ip":"10.0.0.1",
+        "volumes":[
+          {"id":1, "size":9500, "replication":"001"}
+        ],
+        "limit":10
+      },
+      "server2":{
+        "ip":"10.0.0.2",
+        "volumes":[
+          {"id":1, "size":9500, "replication":"001"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	topo := setupWithLimit(t, layout, 10000)
+	rp, _ := super_block.NewReplicaPlacementFromString("001")
+	vl := topo.GetVolumeLayout("", rp, needle.EMPTY_TTL, types.HardDriveType)
+
+	// 9500 is past the growth threshold (9000) but under the limit (10000).
+	vl.UpdateVolumeSize(1, 9500, 0, true)
+	if _, crowded := vl.crowded[1]; !crowded {
+		t.Fatalf("expected the volume to be crowded")
+	}
+	if w, _ := vl.GetWritableVolumeCount(); w != 1 {
+		t.Fatalf("a crowded volume is still writable, got %d writable", w)
+	}
+
+	dn := vl.vid2location[1].list[1]
+	vi, err := dn.GetVolumesById(1)
+	if err != nil {
+		t.Fatalf("GetVolumesById: %v", err)
+	}
+	vl.UnRegisterVolume(&vi, dn)
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected 0 writable while a replica is missing, got %d", w)
+	}
+
+	// The replica comes back on the next heartbeat.
+	topo.RegisterVolumeLayout(vi, dn)
+	advanceSizeTrackingClock(vl, 1, 5*time.Second)
+	vl.UpdateOversizedState(&vi, dn)
+	vl.UpdateVolumeSize(1, vi.Size, 0, true)
+	vl.EnsureCorrectWritables(&vi)
+	if w, _ := vl.GetWritableVolumeCount(); w != 1 {
+		t.Fatalf("expected the volume writable again, got %d", w)
+	}
+}
+
+// An incremental heartbeat announces an arrival with a short message that
+// carries no size. Registering from it must not clear the oversized mark the
+// full heartbeat set, or the volume is handed back to the writable list until
+// the next full report.
+func TestIncrementalRegistrationKeepsOversizedMark(t *testing.T) {
+	topo := NewTopology("weedfs", sequence.NewMemorySequencer(), 32*1024, 5, false)
+	dc := topo.GetOrCreateDataCenter("dc1")
+	rack := dc.GetOrCreateRack("rack1")
+	dn := rack.GetOrCreateDataNode("127.0.0.1", 34534, 0, "127.0.0.1", "", map[string]uint32{"": 25})
+
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	vl := topo.GetVolumeLayout("", rp, needle.EMPTY_TTL, types.HardDriveType)
+
+	// A full heartbeat reports the volume past the 32 KB limit.
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{{
+		Id:               1,
+		Size:             uint64(64 * 1024),
+		ReplicaPlacement: uint32(0),
+		Version:          uint32(needle.GetCurrentVersion()),
+	}}, dn)
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected the oversized volume out of writables, got %d", w)
+	}
+
+	// The same volume is announced again as an arrival.
+	topo.IncrementalSyncDataNodeRegistration([]*master_pb.VolumeShortInformationMessage{{
+		Id:               1,
+		ReplicaPlacement: uint32(0),
+		Version:          uint32(needle.GetCurrentVersion()),
+	}}, nil, dn)
+
+	if !vl.vid2location[1].AnyOversized() {
+		t.Fatalf("expected the oversized mark to survive the arrival announcement")
+	}
+	if w, _ := vl.GetWritableVolumeCount(); w != 0 {
+		t.Fatalf("expected the oversized volume to stay out of writables, got %d", w)
+	}
+}
diff --git a/weed/topology/volume_layout_pick_test.go b/weed/topology/volume_layout_pick_test.go
index ce13c6c22d..aa8cc99c1f 100644
--- a/weed/topology/volume_layout_pick_test.go
+++ b/weed/topology/volume_layout_pick_test.go
@@ -49,6 +49,9 @@ func setupWithLimit(t testing.TB, topologyLayout string, volumeSizeLimit uint64)
 						Size:    uint64(m["size"].(float64)),
 						Version: needle.GetCurrentVersion(),
 					}
+					if mVal, ok := m["fileCount"]; ok {
+						vi.FileCount = uint32(mVal.(float64))
+					}
 					if mVal, ok := m["collection"]; ok {
 						vi.Collection = mVal.(string)
 					}
@@ -58,7 +61,7 @@ func setupWithLimit(t testing.TB, topologyLayout string, volumeSizeLimit uint64)
 					}
 					if vi.ReplicaPlacement != nil {
 						vl := topo.GetVolumeLayout(vi.Collection, vi.ReplicaPlacement, needle.EMPTY_TTL, types.HardDriveType)
-						vl.RegisterVolume(&vi, server)
+						vl.RegisterVolume(&vi, server, nil)
 						vl.setVolumeWritable(vi.Id)
 					}
 					server.AddOrUpdateVolume(vi)
@@ -100,7 +103,7 @@ func TestPickForWriteWeightedDistribution(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	counts := make(map[needle.VolumeId]int)
 	option := &VolumeGrowOption{}
@@ -152,7 +155,7 @@ func TestPickForWriteWithPendingSize(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	// Add large pending to vid 1, making it effectively 9000/10000
 	vl.RecordAssign(1, 8000)
@@ -176,6 +179,80 @@ func TestPickForWriteWithPendingSize(t *testing.T) {
 	}
 }
 
+// A flat 1MB charge per hintless file id overcharges a small-file workload by
+// orders of magnitude, marking volumes full while they hold a fraction of the
+// limit.
+func TestPickForWriteEstimatesPendingSizeFromVolumeAverage(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":409600, "fileCount":100, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	topo, vl := setupPickTest(t, layout, 30*1024*1024)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	option := &VolumeGrowOption{ReplicaPlacement: rp}
+
+	pendingAfterAssign := func(expectedDataSize uint64) uint64 {
+		vl.accessLock.RLock()
+		before := vl.sizeTracking[1].effectiveSize
+		vl.accessLock.RUnlock()
+		if _, _, _, _, err := topo.PickForWrite(1, option, vl, expectedDataSize); err != nil {
+			t.Fatalf("PickForWrite: %v", err)
+		}
+		vl.accessLock.RLock()
+		defer vl.accessLock.RUnlock()
+		return vl.sizeTracking[1].effectiveSize - before
+	}
+
+	if got := pendingAfterAssign(0); got != 4096 {
+		t.Errorf("a hintless assign charged %d, want the volume's 4096-byte average", got)
+	}
+	if got := pendingAfterAssign(8192); got != 8192 {
+		t.Errorf("a hinted assign charged %d, want the 8192-byte hint to win over the average", got)
+	}
+}
+
+// A volume with no files yet has no average to draw on, so the 1MB fallback
+// still applies.
+func TestPickForWriteEstimateFallsBackWithoutHistory(t *testing.T) {
+	layout := `
+{
+  "dc1":{
+    "rack1":{
+      "server1":{
+        "volumes":[
+          {"id":1, "size":0, "replication":"000"}
+        ],
+        "limit":10
+      }
+    }
+  }
+}
+`
+	topo, vl := setupPickTest(t, layout, 30*1024*1024)
+	rp, _ := super_block.NewReplicaPlacementFromString("000")
+	option := &VolumeGrowOption{ReplicaPlacement: rp}
+
+	if _, _, _, _, err := topo.PickForWrite(1, option, vl, 0); err != nil {
+		t.Fatalf("PickForWrite: %v", err)
+	}
+	vl.accessLock.RLock()
+	pending := vl.sizeTracking[1].effectiveSize - vl.sizeTracking[1].reportedSize
+	vl.accessLock.RUnlock()
+	if pending != DefaultNeedleSizeEstimate {
+		t.Errorf("a hintless assign on an empty volume charged %d, want the %d fallback", pending, DefaultNeedleSizeEstimate)
+	}
+}
+
 func TestPickForWriteSingleWritable(t *testing.T) {
 	layout := `
 {
@@ -191,7 +268,7 @@ func TestPickForWriteSingleWritable(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	option := &VolumeGrowOption{}
 	for i := 0; i < 100; i++ {
@@ -221,7 +298,7 @@ func TestPickForWriteAllNearFull(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	option := &VolumeGrowOption{}
 	for i := 0; i < 100; i++ {
@@ -261,7 +338,7 @@ func TestPickForWriteConstrainedWeighted(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	counts := make(map[needle.VolumeId]int)
 	option := &VolumeGrowOption{DataCenter: "dc1"}
@@ -296,7 +373,7 @@ func TestRecordAssignMarksCrowded(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	// Volume at 85% — not crowded yet (threshold is 90%)
 	_, crowded := vl.GetWritableVolumeCount()
@@ -425,7 +502,7 @@ func TestUpdateVolumeSizeRecoversEagerlyRemovedVolume(t *testing.T) {
 	// *not* re-add the volume (even though effectiveSize would now be
 	// under the threshold).
 	advanceSizeTrackingClock(vl, 1, 3*time.Second) // past the 2s dedup window, but before 30s delay
-	if vl.UpdateVolumeSize(1, 4000, 0) {
+	if vl.UpdateVolumeSize(1, 4000, 0, true) {
 		t.Fatalf("recovery should not fire before capacityRecoveryDelay")
 	}
 	w, _ = vl.GetWritableVolumeCount()
@@ -437,7 +514,7 @@ func TestUpdateVolumeSizeRecoversEagerlyRemovedVolume(t *testing.T) {
 	// effectiveSize drops below the crowded threshold (9000).
 	for i := 0; i < 6; i++ {
 		advanceSizeTrackingClock(vl, 1, 10*time.Second)
-		recovered := vl.UpdateVolumeSize(1, 4000, 0)
+		recovered := vl.UpdateVolumeSize(1, 4000, 0, true)
 		if recovered {
 			vl.AdjustActiveVolumeCountAfterRecovery(1)
 			break
@@ -455,7 +532,7 @@ func TestUpdateVolumeSizeRecoversEagerlyRemovedVolume(t *testing.T) {
 	// fullSince should have been cleared so a subsequent heartbeat doesn't
 	// try to recover again.
 	advanceSizeTrackingClock(vl, 1, 60*time.Second)
-	if vl.UpdateVolumeSize(1, 4000, 0) {
+	if vl.UpdateVolumeSize(1, 4000, 0, true) {
 		t.Errorf("recovery should not re-fire after the volume is already writable")
 	}
 }
@@ -488,7 +565,7 @@ func TestUpdateVolumeSizeNoRecoveryWhenDiskStillOversized(t *testing.T) {
 	// Plenty of time elapsed — but reported stays at 10500 (over limit).
 	for i := 0; i < 5; i++ {
 		advanceSizeTrackingClock(vl, 1, 10*time.Second)
-		if vl.UpdateVolumeSize(1, 10500, 0) {
+		if vl.UpdateVolumeSize(1, 10500, 0, true) {
 			t.Fatalf("recovery must not fire when reported >= limit")
 		}
 	}
@@ -514,7 +591,7 @@ func TestHeartbeatDecaysPendingSize(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	// vid2size starts at 1000 (reported). Add 8000 pending → 9000.
 	vl.RecordAssign(1, 8000)
@@ -535,7 +612,7 @@ func TestHeartbeatDecaysPendingSize(t *testing.T) {
 	// Heartbeat: volume server reports size=3000 (some writes landed).
 	// Old effective=9000, new reported=3000 → excess=6000 → decayed to 3000.
 	// So vid2size should become 3000 + 6000/2 = 6000, not just 3000.
-	vl.UpdateVolumeSize(1, 3000, 0)
+	vl.UpdateVolumeSize(1, 3000, 0, true)
 
 	vl.accessLock.RLock()
 	if vl.sizeTracking[1].effectiveSize != 6000 {
@@ -546,7 +623,7 @@ func TestHeartbeatDecaysPendingSize(t *testing.T) {
 	// Second heartbeat: size=5000. Old effective=6000 → excess=1000 → decay to 500.
 	// vid2size should become 5000 + 1000/2 = 5500.
 	advanceCycle()
-	vl.UpdateVolumeSize(1, 5000, 0)
+	vl.UpdateVolumeSize(1, 5000, 0, true)
 
 	vl.accessLock.RLock()
 	if vl.sizeTracking[1].effectiveSize != 5500 {
@@ -557,7 +634,7 @@ func TestHeartbeatDecaysPendingSize(t *testing.T) {
 	// Third heartbeat: size=5500. Old effective=5500 → no excess.
 	// vid2size should be exactly 5500.
 	advanceCycle()
-	vl.UpdateVolumeSize(1, 5500, 0)
+	vl.UpdateVolumeSize(1, 5500, 0, true)
 
 	vl.accessLock.RLock()
 	if vl.sizeTracking[1].effectiveSize != 5500 {
@@ -621,8 +698,8 @@ func TestHeartbeatDecayDedupReplicas(t *testing.T) {
 
 	// Both replicas report size=3000. Decay should happen once: 3000 + (9000-3000)/2 = 6000.
 	// Calling UpdateVolumeSize twice simulates two replicas reporting in the same cycle.
-	vl.UpdateVolumeSize(1, 3000, 0)
-	vl.UpdateVolumeSize(1, 3000, 0) // second replica, same size — should be a no-op
+	vl.UpdateVolumeSize(1, 3000, 0, true)
+	vl.UpdateVolumeSize(1, 3000, 0, true) // second replica, same size — should be a no-op
 
 	vl.accessLock.RLock()
 	got := vl.sizeTracking[1].effectiveSize
@@ -659,7 +736,7 @@ func TestUpdateVolumeSize_DecaysEvenWhenReportedSizeUnchanged(t *testing.T) {
 
 	// First heartbeat: reported size unchanged at 1000 (writes haven't landed).
 	// Decay should still run: 1000 + (9000-1000)/2 = 5000.
-	vl.UpdateVolumeSize(1, 1000, 0)
+	vl.UpdateVolumeSize(1, 1000, 0, true)
 	if p := vl.GetPendingSize(1); p != 4000 {
 		t.Errorf("expected 4000 pending after first decay, got %d", p)
 	}
@@ -671,7 +748,7 @@ func TestUpdateVolumeSize_DecaysEvenWhenReportedSizeUnchanged(t *testing.T) {
 	vl.accessLock.Unlock()
 
 	// Second heartbeat: still 1000. Decay again: 1000 + (5000-1000)/2 = 3000.
-	vl.UpdateVolumeSize(1, 1000, 0)
+	vl.UpdateVolumeSize(1, 1000, 0, true)
 	if p := vl.GetPendingSize(1); p != 2000 {
 		t.Errorf("expected 2000 pending after second decay, got %d", p)
 	}
@@ -693,7 +770,7 @@ func TestShouldGrowVolumesByDcAndRack_WithPendingSize(t *testing.T) {
   }
 }
 `
-	_, vl := setupPickTest(t, layout,10000)
+	_, vl := setupPickTest(t, layout, 10000)
 
 	writables := vl.CloneWritableVolumes()
 	if vl.ShouldGrowVolumesByDcAndRack(&writables, "dc1", "rack1") {
@@ -707,4 +784,3 @@ func TestShouldGrowVolumesByDcAndRack_WithPendingSize(t *testing.T) {
 		t.Error("should grow after pending pushes volume past crowded threshold")
 	}
 }
-
diff --git a/weed/topology/volume_location_list.go b/weed/topology/volume_location_list.go
index 93cf76d9e7..c5b8e54f26 100644
--- a/weed/topology/volume_location_list.go
+++ b/weed/topology/volume_location_list.go
@@ -184,7 +184,7 @@ func (dnll *VolumeLocationList) Stats(vid needle.VolumeId, freshThreshHold int64
 					size = vinfo.Size - vinfo.DeletedByteCount
 				}
 				if vinfo.FileCount > vinfo.DeleteCount {
-					fileCount = vinfo.FileCount - vinfo.DeleteCount
+					fileCount = int(vinfo.FileCount - vinfo.DeleteCount)
 				}
 				return size, fileCount
 			}
diff --git a/weed/topology/volume_stream.go b/weed/topology/volume_stream.go
new file mode 100644
index 0000000000..8da28f72c2
--- /dev/null
+++ b/weed/topology/volume_stream.go
@@ -0,0 +1,137 @@
+package topology
+
+import (
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+)
+
+// StreamVolumes hands every volume the filter selects to send, in batches, so
+// that neither end holds the whole cluster to move it. Batches are built under
+// their disk's lock and handed over outside it, so a slow reader stalls the
+// stream rather than the topology.
+//
+// Only the disks `listed` names are streamed. That listing went out first, and
+// the topology is walked again here, so without it a disk registering in
+// between would have its volumes sent to a client with nowhere to put them.
+// Bounding the walk by what was already announced makes the two agree by
+// construction: a disk arriving mid-listing is in neither, and is reported by
+// the next one.
+//
+// The batches still do not share one instant. Neither did a single listing,
+// which takes each disk's lock in turn, so a volume that moves while either is
+// running can be seen twice or not at all.
+func (t *Topology) StreamVolumes(listed *master_pb.TopologyInfo, filter VolumeFilter, batchSize int, send func(*master_pb.VolumeListStreamResponse) error) error {
+	if batchSize <= 0 {
+		batchSize = defaultVolumeStreamBatch
+	}
+	announced := announcedDisks(listed)
+	for _, dcNode := range t.Children() {
+		dc := dcNode.(*DataCenter)
+		for _, rackNode := range dc.Children() {
+			rack := rackNode.(*Rack)
+			for _, dnNode := range rack.Children() {
+				dn := dnNode.(*DataNode)
+				for _, diskNode := range dn.Children() {
+					disk := diskNode.(*Disk)
+					if !announced[[4]string{string(dc.Id()), string(rack.Id()), string(dn.Id()), string(disk.Id())}] {
+						continue
+					}
+					batch := func() *master_pb.VolumeListStreamResponse {
+						return &master_pb.VolumeListStreamResponse{
+							DataCenter: string(dc.Id()),
+							Rack:       string(rack.Id()),
+							DataNode:   string(dn.Id()),
+							DiskType:   string(disk.Id()),
+						}
+					}
+					if err := disk.streamVolumes(filter, batchSize, batch, send); err != nil {
+						return err
+					}
+					if err := disk.streamEcShards(filter, batchSize, batch, send); err != nil {
+						return err
+					}
+				}
+			}
+		}
+	}
+	return nil
+}
+
+const defaultVolumeStreamBatch = 10000
+
+// announcedDisks names the disks a listing carried.
+func announcedDisks(listed *master_pb.TopologyInfo) map[[4]string]bool {
+	announced := make(map[[4]string]bool)
+	if listed == nil {
+		return announced
+	}
+	for _, dc := range listed.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, node := range rack.DataNodeInfos {
+				for diskType := range node.DiskInfos {
+					announced[[4]string{dc.Id, rack.Id, node.Id, diskType}] = true
+				}
+			}
+		}
+	}
+	return announced
+}
+
+// streamVolumes sends this disk's volumes a batch at a time. The ids are taken
+// in one pass and the messages built in later ones, so the lock is held for a
+// batch rather than for the disk, and only 4 bytes per volume are carried
+// between passes. A volume that leaves in between is simply not sent.
+func (d *Disk) streamVolumes(filter VolumeFilter, batchSize int, newBatch func() *master_pb.VolumeListStreamResponse, send func(*master_pb.VolumeListStreamResponse) error) error {
+	d.RLock()
+	ids := make([]needle.VolumeId, 0, len(d.volumes))
+	for id := range d.volumes {
+		ids = append(ids, id)
+	}
+	d.RUnlock()
+
+	for start := 0; start < len(ids); start += batchSize {
+		end := min(start+batchSize, len(ids))
+		batch := newBatch()
+
+		d.RLock()
+		for _, id := range ids[start:end] {
+			v, found := d.volumes[id]
+			if !found || !filter.matches(v) {
+				continue
+			}
+			batch.VolumeInfos = append(batch.VolumeInfos, v.ToVolumeInformationMessage())
+		}
+		d.RUnlock()
+
+		if len(batch.VolumeInfos) == 0 {
+			continue
+		}
+		if err := send(batch); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (d *Disk) streamEcShards(filter VolumeFilter, batchSize int, newBatch func() *master_pb.VolumeListStreamResponse, send func(*master_pb.VolumeListStreamResponse) error) error {
+	// GetEcShards already copies under the lock, and a cluster holds far fewer
+	// ec shards than volumes, so these only need cutting into batches.
+	shards := d.GetEcShards()
+	for start := 0; start < len(shards); start += batchSize {
+		end := min(start+batchSize, len(shards))
+		batch := newBatch()
+		for _, ecv := range shards[start:end] {
+			if !filter.matches(ecv) {
+				continue
+			}
+			batch.EcShardInfos = append(batch.EcShardInfos, ecv.ToVolumeEcShardInformationMessage())
+		}
+		if len(batch.EcShardInfos) == 0 {
+			continue
+		}
+		if err := send(batch); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/weed/topology/volume_stream_bounds_test.go b/weed/topology/volume_stream_bounds_test.go
new file mode 100644
index 0000000000..d53f5924cf
--- /dev/null
+++ b/weed/topology/volume_stream_bounds_test.go
@@ -0,0 +1,45 @@
+package topology
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+// A disk that registers after the listing went out has nowhere to go in it, so
+// its volumes must not be streamed into a client that cannot place them. It is
+// reported by the next listing instead.
+func TestStreamVolumesStaysInsideTheAnnouncedTopology(t *testing.T) {
+	topo := NewTopology("bounds", nil, 32*1024*1024*1024, 5, false)
+	rack := topo.GetOrCreateDataCenter("dc1").GetOrCreateRack("rack1")
+	known := rack.GetOrCreateDataNode("10.0.0.1", 8080, 18080, "", "", map[string]uint32{"": 100})
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 1, Collection: "c", Size: 100, Version: 3},
+		{Id: 2, Collection: "c", Size: 200, Version: 3},
+	}, known)
+
+	listed := topo.ToTopologyInfo(NoVolumes())
+
+	// The heartbeat that lands between the listing and the walk below.
+	late := rack.GetOrCreateDataNode("10.0.0.2", 8080, 18080, "", "", map[string]uint32{"": 100})
+	topo.SyncDataNodeRegistration([]*master_pb.VolumeInformationMessage{
+		{Id: 3, Collection: "c", Size: 300, Version: 3},
+	}, late)
+
+	var streamed []uint32
+	err := topo.StreamVolumes(listed, VolumeFilter{}, 10, func(b *master_pb.VolumeListStreamResponse) error {
+		if b.DataNode == string(late.Id()) {
+			t.Errorf("streamed a batch for %s, which the listing never named", b.DataNode)
+		}
+		for _, v := range b.VolumeInfos {
+			streamed = append(streamed, v.Id)
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !equalIds(streamed, []uint32{1, 2}) {
+		t.Errorf("streamed %v, want the two volumes the listing named", streamed)
+	}
+}
diff --git a/weed/topology/volume_stream_test.go b/weed/topology/volume_stream_test.go
new file mode 100644
index 0000000000..37e8e4e6f8
--- /dev/null
+++ b/weed/topology/volume_stream_test.go
@@ -0,0 +1,134 @@
+package topology
+
+import (
+	"fmt"
+	"sort"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+)
+
+func streamTestTopology(t *testing.T) *Topology {
+	t.Helper()
+	topo := NewTopology("stream", nil, 32*1024*1024*1024, 5, false)
+	for dc := 1; dc <= 2; dc++ {
+		rack := topo.GetOrCreateDataCenter(fmt.Sprintf("dc%d", dc)).GetOrCreateRack("rack1")
+		for n := 1; n <= 2; n++ {
+			dn := rack.GetOrCreateDataNode(fmt.Sprintf("10.0.%d.%d", dc, n), 8080, 18080, "", "",
+				map[string]uint32{"": 10000})
+			var volumes []*master_pb.VolumeInformationMessage
+			for i := 0; i < 250; i++ {
+				volumes = append(volumes, &master_pb.VolumeInformationMessage{
+					Id: uint32(dc*10000 + n*1000 + i), Size: uint64(i) * 100,
+					Collection: fmt.Sprintf("c%d", i%3), Version: 3, DiskId: uint32(i % 2),
+				})
+			}
+			topo.SyncDataNodeRegistration(volumes, dn)
+			topo.SyncDataNodeEcShards([]*master_pb.VolumeEcShardInformationMessage{
+				{Id: uint32(dc*100 + n), Collection: "c1", EcIndexBits: 0x3fff, DiskId: 1},
+			}, dn)
+		}
+	}
+	return topo
+}
+
+// summarise reduces a listing to what a caller reads off it, so a streamed one
+// can be held against an unstreamed one without depending on ordering.
+func summarise(info *master_pb.TopologyInfo) []string {
+	var lines []string
+	for _, dc := range info.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, node := range rack.DataNodeInfos {
+				for diskType, disk := range node.DiskInfos {
+					where := fmt.Sprintf("%s/%s/%s/%s", dc.Id, rack.Id, node.Id, diskType)
+					lines = append(lines,
+						fmt.Sprintf("%s disk id=%d max=%d count=%d", where, disk.DiskId, disk.MaxVolumeCount, disk.VolumeCount))
+					for _, v := range disk.VolumeInfos {
+						lines = append(lines, fmt.Sprintf("%s vol %d size=%d collection=%s disk=%d",
+							where, v.Id, v.Size, v.Collection, v.DiskId))
+					}
+					for _, ec := range disk.EcShardInfos {
+						lines = append(lines, fmt.Sprintf("%s ec %d collection=%s bits=%d",
+							where, ec.Id, ec.Collection, ec.EcIndexBits))
+					}
+				}
+			}
+		}
+	}
+	sort.Strings(lines)
+	return lines
+}
+
+// Every caller that moved onto the stream rebuilds the listing from a topology
+// sent without volumes plus the batches that follow. That has to come out the
+// same as the listing they used to be sent whole.
+func TestStreamedListingRebuildsToTheSameThing(t *testing.T) {
+	topo := streamTestTopology(t)
+
+	for _, batchSize := range []int{1, 7, 250, 100000} {
+		t.Run(fmt.Sprintf("batch=%d", batchSize), func(t *testing.T) {
+			rebuilt := topo.ToTopologyInfo(NoVolumes())
+			byPlace := map[[4]string]*master_pb.DiskInfo{}
+			for _, dc := range rebuilt.DataCenterInfos {
+				for _, rack := range dc.RackInfos {
+					for _, node := range rack.DataNodeInfos {
+						for diskType, disk := range node.DiskInfos {
+							byPlace[[4]string{dc.Id, rack.Id, node.Id, diskType}] = disk
+							if len(disk.VolumeInfos) != 0 || len(disk.EcShardInfos) != 0 {
+								t.Fatalf("the header listed volumes on %s", node.Id)
+							}
+						}
+					}
+				}
+			}
+
+			err := topo.StreamVolumes(rebuilt, VolumeFilter{}, batchSize, func(b *master_pb.VolumeListStreamResponse) error {
+				if batchSize < 100000 && len(b.VolumeInfos) > batchSize {
+					t.Errorf("batch carried %d volumes, more than the %d asked for", len(b.VolumeInfos), batchSize)
+				}
+				disk := byPlace[[4]string{b.DataCenter, b.Rack, b.DataNode, b.DiskType}]
+				if disk == nil {
+					t.Fatalf("batch named a disk the header did not: %s/%s", b.DataNode, b.DiskType)
+				}
+				disk.VolumeInfos = append(disk.VolumeInfos, b.VolumeInfos...)
+				disk.EcShardInfos = append(disk.EcShardInfos, b.EcShardInfos...)
+				return nil
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			want := summarise(topo.ToTopologyInfo(VolumeFilter{}))
+			got := summarise(rebuilt)
+			if len(got) != len(want) {
+				t.Fatalf("rebuilt %d lines, want %d", len(got), len(want))
+			}
+			for i := range want {
+				if got[i] != want[i] {
+					t.Fatalf("line %d:\n got %q\nwant %q", i, got[i], want[i])
+				}
+			}
+		})
+	}
+}
+
+// A filter must select the same volumes streamed as it does whole.
+func TestStreamedListingHonoursTheFilter(t *testing.T) {
+	topo := streamTestTopology(t)
+	name := "c1"
+
+	var streamed []uint32
+	err := topo.StreamVolumes(topo.ToTopologyInfo(NoVolumes()), VolumeFilter{Collection: &name}, 16, func(b *master_pb.VolumeListStreamResponse) error {
+		for _, v := range b.VolumeInfos {
+			streamed = append(streamed, v.Id)
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	whole, _ := listed(topo.ToTopologyInfo(VolumeFilter{Collection: &name}))
+	if !equalIds(streamed, whole) {
+		t.Errorf("streamed %d volumes, whole listing had %d", len(streamed), len(whole))
+	}
+}
diff --git a/weed/util/concurrent_read_map.go b/weed/util/concurrent_read_map.go
index 28b6ae0f1f..546c2551a9 100644
--- a/weed/util/concurrent_read_map.go
+++ b/weed/util/concurrent_read_map.go
@@ -53,8 +53,12 @@ func (m *ConcurrentReadMap) Items() (itemsCopy []interface{}) {
 	return itemsCopy
 }
 
-func (m *ConcurrentReadMap) Delete(key string) {
+// Delete removes the key and returns what it held, so a caller that has to
+// wind the entry down does not race another deleter for it.
+func (m *ConcurrentReadMap) Delete(key string) (interface{}, bool) {
 	m.Lock()
+	value, ok := m.items[key]
 	delete(m.items, key)
 	m.Unlock()
+	return value, ok
 }
diff --git a/weed/util/config.go b/weed/util/config.go
index 181b5efa94..533d7134f3 100644
--- a/weed/util/config.go
+++ b/weed/util/config.go
@@ -3,6 +3,7 @@ package util
 import (
 	"strings"
 	"sync"
+	"time"
 
 	"github.com/spf13/viper"
 
@@ -39,6 +40,10 @@ func LoadSecurityConfiguration() {
 }
 
 func LoadConfiguration(configFileName string, required bool) (loaded bool) {
+	// MergeInConfig mutates the shared viper that ViperProxy serializes;
+	// take the same lock so a merge cannot race a reader or SetDefault.
+	vp.Lock()
+	defer vp.Unlock()
 
 	// find a filer store
 	viper.SetConfigName(configFileName)                                   // name of config file (without extension)
@@ -72,8 +77,12 @@ func LoadConfiguration(configFileName string, required bool) (loaded bool) {
 	return true
 }
 
+// ViperProxy serializes access to the global viper. The wrapped Viper is a
+// named field, not embedded, so every method must be declared here under the
+// mutex — a promoted method would take no lock and race, e.g. GetStringMap
+// against a concurrent SetDefault during `weed server` startup.
 type ViperProxy struct {
-	*viper.Viper
+	v *viper.Viper
 	sync.Mutex
 }
 
@@ -84,42 +93,123 @@ var (
 func (vp *ViperProxy) SetDefault(key string, value interface{}) {
 	vp.Lock()
 	defer vp.Unlock()
-	vp.Viper.SetDefault(key, value)
+	vp.v.SetDefault(key, value)
+}
+
+func (vp *ViperProxy) AutomaticEnv() {
+	vp.Lock()
+	defer vp.Unlock()
+	vp.v.AutomaticEnv()
 }
 
 func (vp *ViperProxy) GetString(key string) string {
 	vp.Lock()
 	defer vp.Unlock()
-	return vp.Viper.GetString(key)
+	return vp.v.GetString(key)
 }
 
 func (vp *ViperProxy) GetBool(key string) bool {
 	vp.Lock()
 	defer vp.Unlock()
-	return vp.Viper.GetBool(key)
+	return vp.v.GetBool(key)
 }
 
 func (vp *ViperProxy) GetInt(key string) int {
 	vp.Lock()
 	defer vp.Unlock()
-	return vp.Viper.GetInt(key)
+	return vp.v.GetInt(key)
 }
 
 func (vp *ViperProxy) GetStringSlice(key string) []string {
 	vp.Lock()
 	defer vp.Unlock()
-	return vp.Viper.GetStringSlice(key)
+	// a []string value comes back uncast — the same shared subtree issue
+	// GetStringMap has, so hand the caller a copy
+	return append([]string(nil), vp.v.GetStringSlice(key)...)
+}
+
+func (vp *ViperProxy) GetStringMap(key string) map[string]interface{} {
+	vp.Lock()
+	defer vp.Unlock()
+	// viper hands back its internal subtree, so a caller iterating it after
+	// the lock is released would race the next SetDefault — copy it out.
+	return deepCopyStringMap(vp.v.GetStringMap(key))
+}
+
+func deepCopyStringMap(m map[string]interface{}) map[string]interface{} {
+	out := make(map[string]interface{}, len(m))
+	for k, v := range m {
+		out[k] = deepCopyValue(v)
+	}
+	return out
+}
+
+func deepCopyValue(v interface{}) interface{} {
+	switch nested := v.(type) {
+	case map[string]interface{}:
+		return deepCopyStringMap(nested)
+	case []interface{}:
+		out := make([]interface{}, len(nested))
+		for i, item := range nested {
+			out[i] = deepCopyValue(item)
+		}
+		return out
+	default:
+		return v
+	}
+}
+
+func (vp *ViperProxy) GetUint32(key string) uint32 {
+	vp.Lock()
+	defer vp.Unlock()
+	return vp.v.GetUint32(key)
+}
+
+func (vp *ViperProxy) GetFloat64(key string) float64 {
+	vp.Lock()
+	defer vp.Unlock()
+	return vp.v.GetFloat64(key)
+}
+
+func (vp *ViperProxy) GetDuration(key string) time.Duration {
+	vp.Lock()
+	defer vp.Unlock()
+	return vp.v.GetDuration(key)
+}
+
+func (vp *ViperProxy) Set(key string, value interface{}) {
+	vp.Lock()
+	defer vp.Unlock()
+	vp.v.Set(key, value)
+}
+
+func (vp *ViperProxy) IsSet(key string) bool {
+	vp.Lock()
+	defer vp.Unlock()
+	return vp.v.IsSet(key)
+}
+
+func (vp *ViperProxy) AllKeys() []string {
+	vp.Lock()
+	defer vp.Unlock()
+	return vp.v.AllKeys()
+}
+
+// NewViperProxy wraps a specific viper — for configuration loaded from a
+// source other than the shared instance GetViper returns.
+func NewViperProxy(v *viper.Viper) *ViperProxy {
+	return &ViperProxy{v: v}
 }
 
 func GetViper() *ViperProxy {
 	vp.Lock()
 	defer vp.Unlock()
 
-	if vp.Viper == nil {
-		vp.Viper = viper.GetViper()
-		vp.AutomaticEnv()
-		vp.SetEnvPrefix("weed")
-		vp.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	if vp.v == nil {
+		vp.v = viper.GetViper()
+		vp.v.AutomaticEnv()
+		vp.v.SetEnvPrefix("weed")
+		vp.v.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 	}
 
 	return vp
diff --git a/weed/util/config_test.go b/weed/util/config_test.go
new file mode 100644
index 0000000000..86a0cd4d07
--- /dev/null
+++ b/weed/util/config_test.go
@@ -0,0 +1,53 @@
+package util
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+)
+
+// `weed server` starts the volume server (SetDefault writers) and the master
+// (GetStringMap readers) back to back. Reads and writes must share the proxy
+// lock — a race-enabled build flags the interleaving the issue reported.
+func TestViperProxySerializesMapReadsAgainstWrites(t *testing.T) {
+	p := NewViperProxy(viper.New())
+	p.SetDefault("storage.backend.a.enabled", true)
+
+	var wg sync.WaitGroup
+	for i := 0; i < 4; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			for j := 0; j < 200; j++ {
+				p.SetDefault(fmt.Sprintf("storage.backend.d%d.enabled", j), i)
+			}
+		}(i)
+	}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		for j := 0; j < 200; j++ {
+			if got := p.GetStringMap("storage.backend"); len(got) == 0 {
+				t.Error("GetStringMap returned no keys")
+				return
+			}
+		}
+	}()
+	wg.Wait()
+
+	got := p.GetStringMap("storage.backend")
+	assert.Contains(t, got, "a")
+}
+
+// A proxy over its own viper serves the wrapped instance, for configuration
+// loaded from a source other than the shared one.
+func TestNewViperProxyWrapsGivenViper(t *testing.T) {
+	v := viper.New()
+	v.Set("x.y", "z")
+	p := NewViperProxy(v)
+	assert.Equal(t, "z", p.GetString("x.y"))
+	assert.Equal(t, map[string]interface{}{"y": "z"}, p.GetStringMap("x"))
+}
diff --git a/weed/util/constants/filer.go b/weed/util/constants/filer.go
index 725b0a490c..b8b18155b3 100644
--- a/weed/util/constants/filer.go
+++ b/weed/util/constants/filer.go
@@ -7,6 +7,10 @@ const (
 	ErrMsgOperationNotPermitted = "operation not permitted"
 	ErrMsgBadDigest             = "The Content-Md5 you specified did not match what we received."
 	ErrMsgEntryNameTooLong      = "entry name too long"
+	// Unsupported write-mode combinations; deterministic client errors.
+	ErrMsgAppendSaveInsideChunked = "append saved inside the entry to a chunked file is not supported"
+	ErrMsgAppendInlineMode        = "append to inline content with this storage mode is not supported"
+	ErrMsgOffsetWriteInline       = "offset write to inline small file is not supported yet"
 	// Suffix appended to a path, e.g. "/buckets/b/foo/bar is a file"
 	ErrMsgIsAFile = " is a file"
 	// Prefix + suffix, e.g. "existing /buckets/b/foo is a directory"
diff --git a/weed/util/error_wait_group.go b/weed/util/error_wait_group.go
new file mode 100644
index 0000000000..c76bc17aa0
--- /dev/null
+++ b/weed/util/error_wait_group.go
@@ -0,0 +1,94 @@
+package util
+
+import (
+	"errors"
+	"fmt"
+	"sync"
+)
+
+// ErrorWaitGroup implements a goroutine wait group which aggregates errors, if any.
+type ErrorWaitGroup struct {
+	maxConcurrency int
+	wg             *sync.WaitGroup
+	wgSem          chan bool
+	errors         []error
+	errorsMu       sync.Mutex
+}
+
+type ErrorWaitGroupTask func() error
+
+// ExecuteParallelTaskGroups runs tasks from each group sequentially and runs
+// independent groups with up to maxParallelization concurrency. EC balancing
+// uses one group per volume because its shard sidecar files are shared; volume
+// balancing uses one group per already-reserved volume move.
+func ExecuteParallelTaskGroups(maxParallelization int, taskGroups [][]ErrorWaitGroupTask) error {
+	ewg := NewErrorWaitGroup(maxParallelization)
+	for _, taskGroup := range taskGroups {
+		taskGroup := taskGroup
+		ewg.Add(func() error {
+			for _, task := range taskGroup {
+				if err := task(); err != nil {
+					return err
+				}
+			}
+			return nil
+		})
+	}
+	return ewg.Wait()
+}
+
+func NewErrorWaitGroup(maxConcurrency int) *ErrorWaitGroup {
+	if maxConcurrency <= 0 {
+		// no concurrency = one task at the time
+		maxConcurrency = 1
+	}
+	return &ErrorWaitGroup{
+		maxConcurrency: maxConcurrency,
+		wg:             &sync.WaitGroup{},
+		wgSem:          make(chan bool, maxConcurrency),
+	}
+}
+
+// Reset restarts an ErrorWaitGroup, keeping original settings. Errors and pending goroutines, if any, are flushed.
+func (ewg *ErrorWaitGroup) Reset() {
+	close(ewg.wgSem)
+
+	ewg.wg = &sync.WaitGroup{}
+	ewg.wgSem = make(chan bool, ewg.maxConcurrency)
+	ewg.errors = nil
+}
+
+// Add queues an ErrorWaitGroupTask to be executed as a goroutine.
+func (ewg *ErrorWaitGroup) Add(f ErrorWaitGroupTask) {
+	if ewg.maxConcurrency <= 1 {
+		// keep run order deterministic when parallelization is off
+		ewg.errors = append(ewg.errors, f())
+		return
+	}
+
+	ewg.wg.Add(1)
+	go func() {
+		ewg.wgSem <- true
+
+		err := f()
+		ewg.errorsMu.Lock()
+		ewg.errors = append(ewg.errors, err)
+		ewg.errorsMu.Unlock()
+
+		<-ewg.wgSem
+		ewg.wg.Done()
+	}()
+}
+
+// AddErrorf adds an error to an ErrorWaitGroupTask result, without queueing any goroutines.
+func (ewg *ErrorWaitGroup) AddErrorf(format string, a ...interface{}) {
+	ewg.errorsMu.Lock()
+	ewg.errors = append(ewg.errors, fmt.Errorf(format, a...))
+	ewg.errorsMu.Unlock()
+}
+
+// Wait sleeps until all ErrorWaitGroupTasks are completed, then returns errors for them.
+func (ewg *ErrorWaitGroup) Wait() error {
+	ewg.wg.Wait()
+	return errors.Join(ewg.errors...)
+}
diff --git a/weed/util/error_wait_group_test.go b/weed/util/error_wait_group_test.go
new file mode 100644
index 0000000000..8068a92a3f
--- /dev/null
+++ b/weed/util/error_wait_group_test.go
@@ -0,0 +1,94 @@
+package util
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestExecuteParallelTaskGroups(t *testing.T) {
+	firstTaskStarted := make(chan struct{})
+	firstTaskRelease := make(chan struct{})
+	secondTaskStarted := make(chan struct{})
+	secondTaskInFirstGroupStarted := make(chan struct{})
+	done := make(chan error, 1)
+
+	go func() {
+		done <- ExecuteParallelTaskGroups(2, [][]ErrorWaitGroupTask{
+			{
+				func() error {
+					close(firstTaskStarted)
+					<-firstTaskRelease
+					return nil
+				},
+				func() error {
+					close(secondTaskInFirstGroupStarted)
+					return nil
+				},
+			},
+			{
+				func() error {
+					close(secondTaskStarted)
+					return nil
+				},
+			},
+		})
+	}()
+
+	select {
+	case <-firstTaskStarted:
+	case <-time.After(time.Second):
+		t.Fatal("first task did not start")
+	}
+	select {
+	case <-secondTaskStarted:
+	case <-time.After(time.Second):
+		t.Fatal("independent task group did not start in parallel")
+	}
+	select {
+	case <-secondTaskInFirstGroupStarted:
+		t.Fatal("tasks in the same group ran in parallel")
+	default:
+	}
+
+	close(firstTaskRelease)
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Fatalf("execute parallel task groups: %v", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("parallel task groups did not finish")
+	}
+}
+
+func TestExecuteParallelTaskGroupsStopsOnlyFailedGroup(t *testing.T) {
+	expectedErr := errors.New("move failed")
+	failedGroupContinued := false
+	otherGroupRan := false
+
+	err := ExecuteParallelTaskGroups(1, [][]ErrorWaitGroupTask{
+		{
+			func() error { return expectedErr },
+			func() error {
+				failedGroupContinued = true
+				return nil
+			},
+		},
+		{
+			func() error {
+				otherGroupRan = true
+				return nil
+			},
+		},
+	})
+	if !errors.Is(err, expectedErr) {
+		t.Fatalf("expected task error, got %v", err)
+	}
+	if failedGroupContinued {
+		t.Fatal("task after a failed task in the same group ran")
+	}
+	if !otherGroupRan {
+		t.Fatal("independent task group did not run")
+	}
+}
diff --git a/weed/util/fullpath.go b/weed/util/fullpath.go
index e72341ba48..866592f95d 100644
--- a/weed/util/fullpath.go
+++ b/weed/util/fullpath.go
@@ -1,8 +1,8 @@
 package util
 
 import (
+	"math"
 	"path"
-	"path/filepath"
 	"strings"
 	"unicode/utf8"
 )
@@ -40,7 +40,7 @@ func NewFullPath(dir, name string) FullPath {
 }
 
 func (fp FullPath) DirAndName() (string, string) {
-	dir, name := filepath.Split(string(fp))
+	dir, name := path.Split(string(fp))
 	name = SanitizeUTF8Name(name)
 	if dir == "/" {
 		return dir, name
@@ -55,7 +55,7 @@ func (fp FullPath) DirAndName() (string, string) {
 // via SanitizeUTF8Name so the result is always safe to place in a proto
 // string field or HTTP URL.
 func (fp FullPath) Name() string {
-	_, name := filepath.Split(string(fp))
+	_, name := path.Split(string(fp))
 	return SanitizeUTF8Name(name)
 }
 
@@ -88,11 +88,26 @@ func (fp FullPath) Child(name string) FullPath {
 	return FullPath(dir + "/" + noPrefix)
 }
 
+// NormalizeInode folds a derived inode into the positive signed 64-bit range
+// by dropping the sign bit. Every filer store has to persist the value as-is,
+// and some of them serialize it as a signed 64-bit integer: the Elasticsearch
+// store indexes Entry.Attr.Inode as a `long`, so a value above math.MaxInt64
+// is rejected with HTTP 400 and the whole entry is lost. HashStringToLong is
+// uniform over int64, so roughly half of the derived inodes used to land above
+// that limit and failed to be written.
+//
+// Masking keeps the remaining 63 hash bits, so distinct paths still derive
+// distinct inodes; subtracting or folding into a smaller modulus would only
+// spread the same collisions more thinly.
+func NormalizeInode(inode uint64) uint64 {
+	return inode & math.MaxInt64
+}
+
 // AsInode an in-memory only inode representation
 func (fp FullPath) AsInode(unixTime int64) uint64 {
 	inode := uint64(HashStringToLong(string(fp)))
 	inode = inode + uint64(unixTime)*37
-	return inode
+	return NormalizeInode(inode)
 }
 
 // split, but skipping the root
@@ -104,7 +119,7 @@ func (fp FullPath) Split() []string {
 }
 
 func Join(names ...string) string {
-	return filepath.ToSlash(filepath.Join(names...))
+	return path.Join(names...)
 }
 
 func JoinPath(names ...string) FullPath {
diff --git a/weed/util/fullpath_test.go b/weed/util/fullpath_test.go
index af29e3d713..9082910193 100644
--- a/weed/util/fullpath_test.go
+++ b/weed/util/fullpath_test.go
@@ -1,6 +1,8 @@
 package util
 
 import (
+	"fmt"
+	"math"
 	"strings"
 	"testing"
 	"unicode/utf8"
@@ -82,3 +84,125 @@ func TestFullPathDirAndName_OnlyNameSanitized(t *testing.T) {
 		t.Fatalf("regression: dir should remain raw (%q); callers needing a clean path must use Sanitized()", dir)
 	}
 }
+
+// TestFullPathBackslashNotSeparator ensures a literal backslash in a filer
+// path component is treated as a regular character, not as a path separator.
+// Filer paths always use "/" as the separator; using filepath.Split (which
+// treats "\" as a separator on Windows) corrupts paths that contain literal
+// backslashes (#11243). path.Split is OS-independent and only splits on "/".
+func TestFullPathBackslashNotSeparator(t *testing.T) {
+	tests := []struct {
+		fullPath string
+		wantDir  string
+		wantName string
+	}{
+		// Backslash in the filename — must stay in the name, not split the path.
+		{"/test/special\\reverseslash4.jpg", "/test", "special\\reverseslash4.jpg"},
+		// Backslash in a directory component — the dir keeps it, name is after last "/".
+		{"/a\\b/c.jpg", "/a\\b", "c.jpg"},
+		// Multiple backslashes in the filename.
+		{"/dir/a\\b\\c.txt", "/dir", "a\\b\\c.txt"},
+		// Backslash at the start of the filename.
+		{"/dir/\\file.txt", "/dir", "\\file.txt"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.fullPath, func(t *testing.T) {
+			fp := FullPath(tc.fullPath)
+			dir, name := fp.DirAndName()
+			if dir != tc.wantDir {
+				t.Errorf("DirAndName dir: got %q want %q", dir, tc.wantDir)
+			}
+			if name != tc.wantName {
+				t.Errorf("DirAndName name: got %q want %q", name, tc.wantName)
+			}
+			if got := fp.Name(); got != tc.wantName {
+				t.Errorf("Name: got %q want %q", got, tc.wantName)
+			}
+		})
+	}
+}
+
+// TestFullPathSpecialCharactersInName ensures that special characters that are
+// valid in filenames (#, ?, %) are preserved by DirAndName and Name. These
+// characters must be percent-encoded by the client when constructing the HTTP
+// request URL, but once decoded by the server they are regular path bytes.
+// The "/" in the path is always a separator; special chars in a directory
+// component stay in the dir, and the last component is the name.
+func TestFullPathSpecialCharactersInName(t *testing.T) {
+	tests := []struct {
+		fullPath string
+		wantDir  string
+		wantName string
+	}{
+		// "#" in a directory component — dir keeps it, name is after last "/".
+		{"/test/special#/endhashfolder.jpg", "/test/special#", "endhashfolder.jpg"},
+		// "?" in a directory component.
+		{"/test/special?/endqfolder.jpg", "/test/special?", "endqfolder.jpg"},
+		// "%" in a directory component.
+		{"/test/special%/endpctfolder.jpg", "/test/special%", "endpctfolder.jpg"},
+		// "&" in a directory component.
+		{"/test/special&/endampfolder.jpg", "/test/special&", "endampfolder.jpg"},
+		// "=" in a directory component.
+		{"/test/special=/endeqfolder.jpg", "/test/special=", "endeqfolder.jpg"},
+		// Special chars in the filename itself (no "/" after them).
+		{"/test/hash#file.jpg", "/test", "hash#file.jpg"},
+		{"/test/q?file.jpg", "/test", "q?file.jpg"},
+		{"/test/pct%file.jpg", "/test", "pct%file.jpg"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.fullPath, func(t *testing.T) {
+			fp := FullPath(tc.fullPath)
+			dir, name := fp.DirAndName()
+			if dir != tc.wantDir {
+				t.Errorf("DirAndName dir: got %q want %q", dir, tc.wantDir)
+			}
+			if name != tc.wantName {
+				t.Errorf("DirAndName name: got %q want %q", name, tc.wantName)
+			}
+			if got := fp.Name(); got != tc.wantName {
+				t.Errorf("Name: got %q want %q", got, tc.wantName)
+			}
+		})
+	}
+}
+
+// TestJoinPreservesBackslash ensures Join does not convert backslashes to
+// forward slashes — they are regular filename characters in filer paths.
+func TestJoinPreservesBackslash(t *testing.T) {
+	got := Join("/parent", "child\\name.txt")
+	want := "/parent/child\\name.txt"
+	if got != want {
+		t.Fatalf("Join: got %q want %q", got, want)
+	}
+}
+
+// TestAsInodeFitsSignedLong asserts the derived inode stays inside the positive
+// signed 64-bit range for a batch of paths and creation times. The filer stores
+// this value verbatim and the Elasticsearch store indexes it as a `long`, so an
+// inode above math.MaxInt64 is rejected and the entry is lost. HashStringToLong
+// is uniform over int64, so about half of the paths here would have exceeded
+// the limit before NormalizeInode was introduced.
+func TestAsInodeFitsSignedLong(t *testing.T) {
+	unixTimes := []int64{0, 1, 1700000000, 2000000000}
+
+	seen := make(map[uint64]FullPath)
+	for _, unixTime := range unixTimes {
+		for i := 0; i < 2000; i++ {
+			fp := FullPath(fmt.Sprintf("/topics/.system/log/2026-10-02/entry-%d", i))
+			inode := fp.AsInode(unixTime)
+
+			if inode > math.MaxInt64 {
+				t.Fatalf("AsInode(%q, %d) = %d, above math.MaxInt64", fp, unixTime, inode)
+			}
+			if inode == 0 {
+				t.Fatalf("AsInode(%q, %d) = 0, which reads as \"unset\" to the filer", fp, unixTime)
+			}
+			// Distinct paths must still get distinct inodes: masking one bit
+			// off the hash keeps that property.
+			if other, ok := seen[inode]; ok && other != fp {
+				t.Fatalf("AsInode(%q) collided with %q on inode %d", fp, other, inode)
+			}
+			seen[inode] = fp
+		}
+	}
+}
diff --git a/weed/util/http/chunk_proxy.go b/weed/util/http/chunk_proxy.go
new file mode 100644
index 0000000000..f83130b091
--- /dev/null
+++ b/weed/util/http/chunk_proxy.go
@@ -0,0 +1,62 @@
+package http
+
+import (
+	"fmt"
+	"strings"
+	"sync"
+
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+// ProxyChunkIdParam is the query parameter a filer reads to serve one chunk
+// from the volume server holding it, for callers that cannot reach volume
+// servers directly.
+const ProxyChunkIdParam = "proxyChunkId"
+
+var (
+	filerSigningKey            security.SigningKey
+	filerSigningKeyExpires     int
+	filerReadSigningKey        security.SigningKey
+	filerReadSigningKeyExpires int
+	loadFilerJwtConfigOnce     sync.Once
+)
+
+func loadFilerJwtConfig() {
+	v := util.GetViper()
+	filerSigningKey = security.SigningKey(v.GetString("jwt.filer_signing.key"))
+	filerSigningKeyExpires = v.GetInt("jwt.filer_signing.expires_after_seconds")
+	if filerSigningKeyExpires == 0 {
+		filerSigningKeyExpires = 10
+	}
+	filerReadSigningKey = security.SigningKey(v.GetString("jwt.filer_signing.read.key"))
+	filerReadSigningKeyExpires = v.GetInt("jwt.filer_signing.read.expires_after_seconds")
+	if filerReadSigningKeyExpires == 0 {
+		filerReadSigningKeyExpires = 60
+	}
+}
+
+// JwtForFilerServer generates a JWT for the filer's HTTP API if jwt.filer_signing
+// is configured for that access level, the way filer.JwtForVolumeServer does for
+// volume servers. Empty when the key is unset, which is also when the filer
+// serves the request unsigned.
+func JwtForFilerServer(isWrite bool) string {
+	loadFilerJwtConfigOnce.Do(loadFilerJwtConfig)
+	if isWrite {
+		return string(security.GenJwtForFilerServer(filerSigningKey, filerSigningKeyExpires))
+	}
+	return string(security.GenJwtForFilerServer(filerReadSigningKey, filerReadSigningKeyExpires))
+}
+
+// ProxyChunkUrl builds the request that reads or writes one chunk through a
+// filer instead of the volume server holding it.
+func ProxyChunkUrl(filerAddress string, fileId string) string {
+	return fmt.Sprintf("http://%s/?%s=%s", filerAddress, ProxyChunkIdParam, fileId)
+}
+
+// IsProxyChunkUrl reports whether a chunk URL addresses a filer's chunk proxy
+// rather than a volume server. Such a request is authorized by the filer, which
+// attaches the volume credential itself, so the token it carries is a filer one.
+func IsProxyChunkUrl(urlString string) bool {
+	return strings.Contains(urlString, ProxyChunkIdParam+"=")
+}
diff --git a/weed/util/http/chunk_proxy_test.go b/weed/util/http/chunk_proxy_test.go
new file mode 100644
index 0000000000..498faac529
--- /dev/null
+++ b/weed/util/http/chunk_proxy_test.go
@@ -0,0 +1,74 @@
+package http
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestIsProxyChunkUrl(t *testing.T) {
+	for _, tc := range []struct {
+		urlString string
+		want      bool
+	}{
+		{ProxyChunkUrl("filer:8888", "3,01637037d6"), true},
+		{"http://filer:8888/?proxyChunkId=3,01637037d6&readDeleted=true", true},
+		{"http://volume:8080/3,01637037d6", false},
+		{"http://volume:8080/3,01637037d6?readDeleted=true", false},
+		{"", false},
+	} {
+		if got := IsProxyChunkUrl(tc.urlString); got != tc.want {
+			t.Errorf("IsProxyChunkUrl(%q) = %v, want %v", tc.urlString, got, tc.want)
+		}
+	}
+}
+
+// The credential a proxied chunk carries is a filer one, signed with the key
+// for the access level the caller is about to use.
+func TestJwtForFilerServer(t *testing.T) {
+	const (
+		writeKey = "filer-write-key"
+		readKey  = "filer-read-key"
+	)
+	v := util.GetViper()
+	v.Set("jwt.filer_signing.key", writeKey)
+	v.Set("jwt.filer_signing.read.key", readKey)
+
+	for _, tc := range []struct {
+		name     string
+		isWrite  bool
+		signedBy string
+		otherKey string
+	}{
+		{"read", false, readKey, writeKey},
+		{"write", true, writeKey, readKey},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			token := security.EncodedJwt(JwtForFilerServer(tc.isWrite))
+			claims := &security.SeaweedFilerClaims{}
+			if _, err := security.DecodeJwt(security.SigningKey(tc.signedBy), token, claims); err != nil {
+				t.Fatalf("token does not validate against the %s key: %v", tc.name, err)
+			}
+			if claims.ExpiresAt == nil {
+				t.Fatal("token never expires")
+			}
+			if _, err := security.DecodeJwt(security.SigningKey(tc.otherKey), token, &security.SeaweedFilerClaims{}); err == nil {
+				t.Fatal("token also validates against the other access level's key")
+			}
+		})
+	}
+}
+
+func TestJwtForFilerServerWithoutKeys(t *testing.T) {
+	loadFilerJwtConfigOnce.Do(func() {})
+	write, read := filerSigningKey, filerReadSigningKey
+	t.Cleanup(func() { filerSigningKey, filerReadSigningKey = write, read })
+	filerSigningKey, filerReadSigningKey = nil, nil
+
+	for _, isWrite := range []bool{false, true} {
+		if token := JwtForFilerServer(isWrite); token != "" {
+			t.Errorf("unconfigured signing key still produced %q", token)
+		}
+	}
+}
diff --git a/weed/util/http/client/http_client.go b/weed/util/http/client/http_client.go
index 305f78c310..53b39306a4 100644
--- a/weed/util/http/client/http_client.go
+++ b/weed/util/http/client/http_client.go
@@ -110,6 +110,20 @@ func (httpClient *HTTPClient) GetHttpScheme() string {
 	return "http"
 }
 
+func (httpClient *HTTPClient) IsTLSVerified() bool {
+	return httpClient.expectHttpsScheme && httpClient.Transport != nil && (httpClient.Transport.TLSClientConfig == nil || !httpClient.Transport.TLSClientConfig.InsecureSkipVerify)
+}
+
+func rejectHttpsDowngrade(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return http.ErrUseLastResponse
+	}
+	if len(via) > 0 && via[0].URL.Scheme == "https" && req.URL.Scheme != "https" {
+		return http.ErrUseLastResponse
+	}
+	return nil
+}
+
 func (httpClient *HTTPClient) NormalizeHttpScheme(rawURL string) (string, error) {
 	expectedScheme := httpClient.GetHttpScheme()
 
@@ -183,7 +197,8 @@ func NewHttpClient(clientName ClientName, opts ...HttpClientOpt) (*HTTPClient, e
 		IdleConnTimeout:       idleConnTimeout,
 	}
 	httpClient.Client = &http.Client{
-		Transport: httpClient.Transport,
+		Transport:     httpClient.Transport,
+		CheckRedirect: rejectHttpsDowngrade,
 	}
 
 	for _, opt := range opts {
@@ -301,7 +316,8 @@ func NewHttpClientWithTLS(certFile, keyFile, caFile string, insecureSkipVerify b
 		IdleConnTimeout:       idleConnTimeout,
 	}
 	httpClient.Client = &http.Client{
-		Transport: httpClient.Transport,
+		Transport:     httpClient.Transport,
+		CheckRedirect: rejectHttpsDowngrade,
 	}
 
 	for _, opt := range opts {
diff --git a/weed/util/http/http_global_client_util.go b/weed/util/http/http_global_client_util.go
index c57c0a489e..cf492230b0 100644
--- a/weed/util/http/http_global_client_util.go
+++ b/weed/util/http/http_global_client_util.go
@@ -98,11 +98,11 @@ func Post(url string, values url.Values) ([]byte, error) {
 // github.com/seaweedfs/seaweedfs/unmaintained/repeated_vacuum/repeated_vacuum.go
 // may need increasing http.Client.Timeout
 func Get(url string) ([]byte, bool, error) {
-	return GetAuthenticated(url, "")
+	return GetAuthenticated(context.Background(), url, "")
 }
 
-func GetAuthenticated(url, jwt string) ([]byte, bool, error) {
-	request, err := http.NewRequest(http.MethodGet, url, nil)
+func GetAuthenticated(ctx context.Context, url, jwt string) ([]byte, bool, error) {
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return nil, true, err
 	}
@@ -111,10 +111,19 @@ func GetAuthenticated(url, jwt string) ([]byte, bool, error) {
 
 	response, err := GetGlobalHttpClient().Do(request)
 	if err != nil {
+		if ctx.Err() == nil {
+			recordUnreachable(request.URL.Host)
+		}
 		return nil, true, err
 	}
+	recordReachable(request.URL.Host)
 	defer CloseResponse(response)
 
+	if response.StatusCode >= 400 {
+		retryable := response.StatusCode >= 500
+		return nil, retryable, StatusError(url, response)
+	}
+
 	var reader io.ReadCloser
 	switch response.Header.Get("Content-Encoding") {
 	case "gzip":
@@ -128,11 +137,10 @@ func GetAuthenticated(url, jwt string) ([]byte, bool, error) {
 	}
 
 	b, err := io.ReadAll(reader)
-	if response.StatusCode >= 400 {
-		retryable := response.StatusCode >= 500
-		return nil, retryable, fmt.Errorf("%s: %s", url, response.Status)
-	}
 	if err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return nil, false, ctxErr
+		}
 		return nil, false, err
 	}
 	return b, false, nil
@@ -327,7 +335,7 @@ func ReadUrl(ctx context.Context, fileUrl string, cipherKey []byte, isContentCom
 	defer CloseResponse(r)
 
 	if r.StatusCode >= 400 {
-		return 0, fmt.Errorf("%s: %s", fileUrl, r.Status)
+		return 0, StatusError(fileUrl, r)
 	}
 
 	var reader io.ReadCloser
@@ -392,8 +400,12 @@ func ReadUrlAsStream(ctx context.Context, fileUrl, jwt string, cipherKey []byte,
 
 	r, err := GetGlobalHttpClient().Do(req)
 	if err != nil {
+		if ctx.Err() == nil {
+			recordUnreachable(req.URL.Host)
+		}
 		return true, err
 	}
+	recordReachable(req.URL.Host)
 	defer CloseResponse(r)
 	if r.StatusCode >= 400 {
 		if r.StatusCode == http.StatusNotFound {
@@ -403,7 +415,7 @@ func ReadUrlAsStream(ctx context.Context, fileUrl, jwt string, cipherKey []byte,
 			return false, fmt.Errorf("%s: %s: %w", fileUrl, r.Status, ErrTooManyRequests)
 		}
 		retryable = r.StatusCode >= 499
-		return retryable, fmt.Errorf("%s: %s", fileUrl, r.Status)
+		return retryable, StatusError(fileUrl, r)
 	}
 
 	var reader io.ReadCloser
@@ -448,7 +460,7 @@ func ReadUrlAsStream(ctx context.Context, fileUrl, jwt string, cipherKey []byte,
 }
 
 func readEncryptedUrl(ctx context.Context, fileUrl, jwt string, cipherKey []byte, isContentCompressed bool, isFullChunk bool, offset int64, size int, fn func(data []byte)) (bool, error) {
-	encryptedData, retryable, err := GetAuthenticated(fileUrl, jwt)
+	encryptedData, retryable, err := GetAuthenticated(ctx, fileUrl, jwt)
 	if err != nil {
 		return retryable, fmt.Errorf("fetch %s: %v", fileUrl, err)
 	}
@@ -493,8 +505,9 @@ func ReadUrlAsReaderCloser(fileUrl string, jwt string, rangeHeader string) (*htt
 		return nil, nil, err
 	}
 	if r.StatusCode >= 400 {
+		err = StatusError(fileUrl, r)
 		CloseResponse(r)
-		return nil, nil, fmt.Errorf("%s: %s", fileUrl, r.Status)
+		return nil, nil, err
 	}
 
 	var reader io.ReadCloser
@@ -512,6 +525,29 @@ func ReadUrlAsReaderCloser(fileUrl string, jwt string, rangeHeader string) (*htt
 	return r, reader, nil
 }
 
+// StatusError adds the message a server writes into the body of a failed
+// request, such as a volume server CRC mismatch, to the status line.
+func StatusError(fileUrl string, r *http.Response) error {
+	var reader io.Reader = r.Body
+	if r.Header.Get("Content-Encoding") == "gzip" {
+		if gz, err := gzip.NewReader(r.Body); err == nil {
+			reader = gz
+		}
+	}
+	body, _ := io.ReadAll(io.LimitReader(reader, 1024))
+	msg := strings.TrimSpace(string(body))
+	var m struct {
+		Error string `json:"error"`
+	}
+	if json.Unmarshal(body, &m) == nil && m.Error != "" {
+		msg = m.Error
+	}
+	if msg == "" {
+		return fmt.Errorf("%s: %s", fileUrl, r.Status)
+	}
+	return fmt.Errorf("%s: %s: %s", fileUrl, r.Status, msg)
+}
+
 func CloseResponse(resp *http.Response) {
 	if resp == nil || resp.Body == nil {
 		return
@@ -544,18 +580,71 @@ func (r *CountingReader) Read(p []byte) (n int, err error) {
 	return n, err
 }
 
-func RetriedFetchChunkData(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, fileId string) (n int, err error) {
+// refreshedUrls asks for a fresh location list and reports whether it is worth
+// retrying on: a list that comes back empty, or identical to the one that just
+// failed everywhere, says the locations were never the problem.
+func refreshedUrls(ctx context.Context, refreshUrls RefreshUrlsFunc, current []string, fileId string) ([]string, bool) {
+	if refreshUrls == nil {
+		return nil, false
+	}
+	fresh := refreshUrls()
+	if len(fresh) == 0 || SameUrls(current, fresh) {
+		return nil, false
+	}
+	glog.V(0).InfofCtx(ctx, "chunk %s failed on every known location, retrying on %d fresh ones", fileId, len(fresh))
+	return fresh, true
+}
+
+// SameUrls reports whether two location lists hold the same URLs, regardless of
+// order: lookups shuffle the locations they return, so comparing positionally
+// would read a reshuffle of the very same replicas as a fresh set.
+func SameUrls(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	counts := make(map[string]int, len(a))
+	for _, url := range a {
+		counts[url]++
+	}
+	for _, url := range b {
+		if counts[url] == 0 {
+			return false
+		}
+		counts[url]--
+	}
+	return true
+}
+
+// RefreshUrlsFunc supplies a fresh location list for a chunk. The retry loops
+// call it at most once: after every location in the list failed, to retry on
+// the fresh list at once, or after a later location answered for one that
+// failed, so the next read starts from what the cluster knows now instead of
+// trying the same dead replica again. Returning nil or the same list leaves
+// the caller on the original locations.
+type RefreshUrlsFunc func() []string
+
+// RetriedFetchChunkData reads a chunk, trying every location before backing off
+// and trying them again. refreshUrls may be nil; when it is not, a pass in which
+// every location failed is treated as a stale list rather than a slow cluster,
+// and the fresh list is tried immediately instead of after the next backoff.
+// A pass that failed on one location and succeeded on another refreshes the
+// list for the reads that follow.
+func RetriedFetchChunkData(ctx context.Context, buffer []byte, urlStrings []string, cipherKey []byte, isGzipped bool, isFullChunk bool, offset int64, fileId string, refreshUrls RefreshUrlsFunc) (n int, err error) {
 
-	loadJwtConfigOnce.Do(loadJwtConfig)
 	var jwt security.EncodedJwt
-	if cfg := jwtSigningReadConfigPtr.Load(); cfg != nil && len(cfg.key) > 0 {
-		jwt = security.GenJwtForVolumeServer(cfg.key, cfg.expires, fileId)
+	if len(urlStrings) > 0 && IsProxyChunkUrl(urlStrings[0]) {
+		jwt = security.EncodedJwt(JwtForFilerServer(false))
+	} else {
+		loadJwtConfigOnce.Do(loadJwtConfig)
+		if cfg := jwtSigningReadConfigPtr.Load(); cfg != nil && len(cfg.key) > 0 {
+			jwt = security.GenJwtForVolumeServer(cfg.key, cfg.expires, fileId)
+		}
 	}
 
 	// For unencrypted, non-gzipped full chunks, use direct buffer read
 	// This avoids the 64KB intermediate buffer and callback overhead
 	if cipherKey == nil && !isGzipped && isFullChunk {
-		return retriedFetchChunkDataDirect(ctx, buffer, urlStrings, string(jwt))
+		return retriedFetchChunkDataDirect(ctx, buffer, urlStrings, string(jwt), fileId, refreshUrls)
 	}
 
 	var shouldRetry bool
@@ -568,7 +657,8 @@ func RetriedFetchChunkData(ctx context.Context, buffer []byte, urlStrings []stri
 		default:
 		}
 
-		for _, urlString := range urlStrings {
+		var failed bool
+		for _, urlString := range ReachableFirst(urlStrings) {
 			// Check for context cancellation before each volume server request
 			select {
 			case <-ctx.Done():
@@ -598,12 +688,21 @@ func RetriedFetchChunkData(ctx context.Context, buffer []byte, urlStrings []stri
 				break
 			}
 			if err != nil {
+				failed = true
 				glog.V(0).InfofCtx(ctx, "read %s failed, err: %v", urlString, err)
 			} else {
 				break
 			}
 		}
+		if err == nil && failed && refreshUrls != nil {
+			refreshUrls()
+		}
 		if err != nil && shouldRetry {
+			if fresh, ok := refreshedUrls(ctx, refreshUrls, urlStrings, fileId); ok {
+				urlStrings, refreshUrls = fresh, nil
+				continue
+			}
+			refreshUrls = nil
 			glog.V(0).InfofCtx(ctx, "retry reading in %v", waitTime)
 			// Sleep with proper context cancellation and timer cleanup
 			timer := time.NewTimer(waitTime)
@@ -626,7 +725,7 @@ func RetriedFetchChunkData(ctx context.Context, buffer []byte, urlStrings []stri
 // retriedFetchChunkDataDirect reads chunk data directly into the buffer without
 // intermediate buffering. This reduces memory copies and improves throughput
 // for large chunk reads.
-func retriedFetchChunkDataDirect(ctx context.Context, buffer []byte, urlStrings []string, jwt string) (n int, err error) {
+func retriedFetchChunkDataDirect(ctx context.Context, buffer []byte, urlStrings []string, jwt, fileId string, refreshUrls RefreshUrlsFunc) (n int, err error) {
 	var shouldRetry bool
 
 	for waitTime := time.Second; waitTime < util.RetryWaitTime; waitTime += waitTime / 2 {
@@ -636,7 +735,8 @@ func retriedFetchChunkDataDirect(ctx context.Context, buffer []byte, urlStrings
 		default:
 		}
 
-		for _, urlString := range urlStrings {
+		var failed bool
+		for _, urlString := range ReachableFirst(urlStrings) {
 			select {
 			case <-ctx.Done():
 				return 0, ctx.Err()
@@ -645,15 +745,24 @@ func retriedFetchChunkDataDirect(ctx context.Context, buffer []byte, urlStrings
 
 			n, shouldRetry, err = readUrlDirectToBuffer(ctx, AppendQueryParameter(urlString, "readDeleted", "true"), jwt, buffer)
 			if err == nil {
+				if failed && refreshUrls != nil {
+					refreshUrls()
+				}
 				return n, nil
 			}
 			if !shouldRetry {
 				break
 			}
+			failed = true
 			glog.V(0).InfofCtx(ctx, "read %s failed, err: %v", urlString, err)
 		}
 
 		if err != nil && shouldRetry {
+			if fresh, ok := refreshedUrls(ctx, refreshUrls, urlStrings, fileId); ok {
+				urlStrings, refreshUrls = fresh, nil
+				continue
+			}
+			refreshUrls = nil
 			glog.V(0).InfofCtx(ctx, "retry reading in %v", waitTime)
 			timer := time.NewTimer(waitTime)
 			select {
@@ -682,8 +791,12 @@ func readUrlDirectToBuffer(ctx context.Context, fileUrl, jwt string, buffer []by
 
 	r, err := GetGlobalHttpClient().Do(req)
 	if err != nil {
+		if ctx.Err() == nil {
+			recordUnreachable(req.URL.Host)
+		}
 		return 0, true, err
 	}
+	recordReachable(req.URL.Host)
 	defer CloseResponse(r)
 
 	if r.StatusCode >= 400 {
@@ -694,7 +807,7 @@ func readUrlDirectToBuffer(ctx context.Context, fileUrl, jwt string, buffer []by
 			return 0, false, fmt.Errorf("%s: %s: %w", fileUrl, r.Status, ErrTooManyRequests)
 		}
 		retryable = r.StatusCode >= 499
-		return 0, retryable, fmt.Errorf("%s: %s", fileUrl, r.Status)
+		return 0, retryable, StatusError(fileUrl, r)
 	}
 
 	// Read directly into the buffer without intermediate copying
diff --git a/weed/util/http/http_global_client_util_test.go b/weed/util/http/http_global_client_util_test.go
index 74b1035593..c5e5f32cc0 100644
--- a/weed/util/http/http_global_client_util_test.go
+++ b/weed/util/http/http_global_client_util_test.go
@@ -1,10 +1,13 @@
 package http
 
 import (
+	"bytes"
+	"compress/gzip"
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 )
 
 func TestAppendQueryParameter(t *testing.T) {
@@ -91,6 +94,76 @@ func TestReadUrlAsStreamReturnsGzipReaderError(t *testing.T) {
 	}
 }
 
+func TestReadErrorsCarryTheServerMessage(t *testing.T) {
+	InitGlobalHttpClient()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusInternalServerError)
+		_, _ = w.Write([]byte(`{"error":"invalid CRC for needle 2a (got 0a1b2c3d, want 4e5f6071), data on disk corrupted: needle data corrupted"}`))
+	}))
+	defer server.Close()
+
+	want := server.URL + ": 500 Internal Server Error: invalid CRC for needle 2a (got 0a1b2c3d, want 4e5f6071), data on disk corrupted: needle data corrupted"
+
+	if _, err := ReadUrl(context.Background(), server.URL, nil, false, true, 0, 0, make([]byte, 16)); err == nil || err.Error() != want {
+		t.Errorf("ReadUrl: got %v, want %q", err, want)
+	}
+	if _, err := ReadUrlAsStream(context.Background(), server.URL, "", nil, false, true, 0, 0, func(data []byte) {}); err == nil || err.Error() != want {
+		t.Errorf("ReadUrlAsStream: got %v, want %q", err, want)
+	}
+	if _, _, err := ReadUrlAsReaderCloser(server.URL, "", ""); err == nil || err.Error() != want {
+		t.Errorf("ReadUrlAsReaderCloser: got %v, want %q", err, want)
+	}
+	if _, _, err := readUrlDirectToBuffer(context.Background(), server.URL, "", make([]byte, 16)); err == nil || err.Error() != want {
+		t.Errorf("readUrlDirectToBuffer: got %v, want %q", err, want)
+	}
+	if _, _, err := GetAuthenticated(context.Background(), server.URL, ""); err == nil || err.Error() != want {
+		t.Errorf("GetAuthenticated: got %v, want %q", err, want)
+	}
+}
+
+func TestReadErrorsDecodeGzipBody(t *testing.T) {
+	InitGlobalHttpClient()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var buf bytes.Buffer
+		gz := gzip.NewWriter(&buf)
+		_, _ = gz.Write([]byte(`{"error":"invalid CRC for needle 2a"}`))
+		_ = gz.Close()
+		w.Header().Set("Content-Type", "application/json")
+		w.Header().Set("Content-Encoding", "gzip")
+		w.WriteHeader(http.StatusInternalServerError)
+		_, _ = w.Write(buf.Bytes())
+	}))
+	defer server.Close()
+
+	want := server.URL + ": 500 Internal Server Error: invalid CRC for needle 2a"
+	if _, err := ReadUrl(context.Background(), server.URL, nil, false, true, 0, 0, make([]byte, 16)); err == nil || err.Error() != want {
+		t.Errorf("ReadUrl: got %v, want %q", err, want)
+	}
+	if _, err := ReadUrlAsStream(context.Background(), server.URL, "", nil, false, true, 0, 0, func(data []byte) {}); err == nil || err.Error() != want {
+		t.Errorf("ReadUrlAsStream: got %v, want %q", err, want)
+	}
+	if _, _, err := GetAuthenticated(context.Background(), server.URL, ""); err == nil || err.Error() != want {
+		t.Errorf("GetAuthenticated: got %v, want %q", err, want)
+	}
+}
+
+func TestReadErrorWithoutBodyIsTheStatus(t *testing.T) {
+	InitGlobalHttpClient()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer server.Close()
+
+	want := server.URL + ": 500 Internal Server Error"
+	if _, err := ReadUrlAsStream(context.Background(), server.URL, "", nil, false, true, 0, 0, func(data []byte) {}); err == nil || err.Error() != want {
+		t.Errorf("got %v, want %q", err, want)
+	}
+}
+
 func TestDeleteReturnsInvalidRequestErrorBeforeAddingAuth(t *testing.T) {
 	defer func() {
 		if r := recover(); r != nil {
@@ -132,3 +205,127 @@ func TestDeleteProxiedReturnsInvalidRequestErrorBeforeAddingAuth(t *testing.T) {
 		t.Fatal("expected invalid request error")
 	}
 }
+
+// TestRetriedFetchChunkDataRetriesFreshUrlsImmediately covers the case the
+// refresh hook exists for: every location the caller knew about is gone, and
+// the data is live somewhere the caller has not heard of yet. The read must
+// land on the fresh location without first sitting through the backoff ladder.
+func TestRetriedFetchChunkDataRetriesFreshUrlsImmediately(t *testing.T) {
+	payload := []byte("chunk contents")
+	live := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write(payload)
+	}))
+	defer live.Close()
+
+	// A port nothing listens on: the address is well formed, the dial fails.
+	dead := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	deadURL := dead.URL
+	dead.Close()
+
+	refreshed := 0
+	buffer := make([]byte, len(payload))
+	start := time.Now()
+	n, err := RetriedFetchChunkData(context.Background(), buffer, []string{deadURL + "/3,abc"}, nil, false, true, 0, "3,abc",
+		func() []string {
+			refreshed++
+			return []string{live.URL + "/3,abc"}
+		})
+	elapsed := time.Since(start)
+
+	if err != nil {
+		t.Fatalf("fetch with a refreshed location: %v", err)
+	}
+	if n != len(payload) || string(buffer[:n]) != string(payload) {
+		t.Fatalf("got %q, want %q", buffer[:n], payload)
+	}
+	if refreshed != 1 {
+		t.Fatalf("refresh called %d times, want exactly 1", refreshed)
+	}
+	// The first backoff is a full second; landing well under it is the point.
+	if elapsed > 500*time.Millisecond {
+		t.Fatalf("took %v, expected the retry to skip the backoff", elapsed)
+	}
+}
+
+// TestRetriedFetchChunkDataKeepsBackoffWhenLocationsAreUnchanged makes sure a
+// refresh that returns the same list is treated as "the locations were never
+// the problem" rather than as a reason to spin.
+func TestRetriedFetchChunkDataKeepsBackoffWhenLocationsAreUnchanged(t *testing.T) {
+	dead := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	deadURL := dead.URL
+	dead.Close()
+
+	urls := []string{deadURL + "/3,abc"}
+	refreshed := 0
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+
+	buffer := make([]byte, 4)
+	_, err := RetriedFetchChunkData(ctx, buffer, urls, nil, false, true, 0, "3,abc", func() []string {
+		refreshed++
+		return urls
+	})
+	if err == nil {
+		t.Fatal("expected the fetch to fail against a dead location")
+	}
+	if refreshed != 1 {
+		t.Fatalf("refresh called %d times, want exactly 1", refreshed)
+	}
+}
+
+// TestRetriedFetchChunkDataRefreshesLocationsAfterPartialFailure covers a read
+// that fails on a cached dead replica and succeeds on the next one: the read
+// itself is fine, but the list it came from is stale and must be refreshed so
+// later reads do not start with the dead replica again. Both the direct and
+// the streaming read paths take this branch.
+func TestRetriedFetchChunkDataRefreshesLocationsAfterPartialFailure(t *testing.T) {
+	forgetUnreachable(t)
+	payload := []byte("chunk contents")
+	live := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write(payload)
+	}))
+	defer live.Close()
+	dead := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	deadURL := dead.URL
+	dead.Close()
+
+	for _, isFullChunk := range []bool{true, false} {
+		forgetUnreachable(t)
+		refreshed := 0
+		refresh := func() []string {
+			refreshed++
+			return []string{live.URL + "/3,abc"}
+		}
+		buffer := make([]byte, len(payload))
+		n, err := RetriedFetchChunkData(context.Background(), buffer, []string{deadURL + "/3,abc", live.URL + "/3,abc"}, nil, false, isFullChunk, 0, "3,abc", refresh)
+		if err != nil || string(buffer[:n]) != string(payload) {
+			t.Fatalf("fullChunk=%v: got %q, %v; want %q", isFullChunk, buffer[:n], err, payload)
+		}
+		if refreshed != 1 {
+			t.Fatalf("fullChunk=%v: refresh called %d times after a partial failure, want exactly 1", isFullChunk, refreshed)
+		}
+
+		// a read answered by the first location leaves the list alone
+		refreshed = 0
+		n, err = RetriedFetchChunkData(context.Background(), buffer, []string{live.URL + "/3,abc", deadURL + "/3,abc"}, nil, false, isFullChunk, 0, "3,abc", refresh)
+		if err != nil || string(buffer[:n]) != string(payload) {
+			t.Fatalf("fullChunk=%v: got %q, %v; want %q", isFullChunk, buffer[:n], err, payload)
+		}
+		if refreshed != 0 {
+			t.Fatalf("fullChunk=%v: refresh called %d times without a failure, want none", isFullChunk, refreshed)
+		}
+	}
+}
+
+func TestSameUrlsIgnoresOrder(t *testing.T) {
+	a := []string{"http://a:8080/3,x", "http://b:8080/3,x"}
+	if !SameUrls(a, []string{a[1], a[0]}) {
+		t.Fatal("a reshuffle of the same locations should not count as fresh")
+	}
+	if SameUrls(a, []string{a[0], "http://c:8080/3,x"}) {
+		t.Fatal("a different location should count as fresh")
+	}
+	if SameUrls(a, a[:1]) {
+		t.Fatal("a shorter list should count as fresh")
+	}
+}
diff --git a/weed/util/http/reachability.go b/weed/util/http/reachability.go
new file mode 100644
index 0000000000..ad277b3eff
--- /dev/null
+++ b/weed/util/http/reachability.go
@@ -0,0 +1,60 @@
+package http
+
+import (
+	"net/url"
+	"sync"
+	"time"
+)
+
+// unreachableRetryInterval is how long a server that failed to answer is tried
+// last before a read probes it again.
+const unreachableRetryInterval = 30 * time.Second
+
+// unreachable maps a host to when it last failed to answer a request. A dead
+// replica sits in the location list of every volume it held, so this is kept
+// per host rather than per volume.
+var unreachable sync.Map
+
+func recordUnreachable(host string) {
+	unreachable.Store(host, time.Now())
+}
+
+func recordReachable(host string) {
+	unreachable.Delete(host)
+}
+
+// ReachableFirst orders urls so that hosts which recently failed to answer
+// come last, keeping the order within each group. Once the retry interval has
+// passed, the first read to ask claims the probe and tries that host first;
+// the others keep it last until the probe settles. A read probes at most one
+// host, so a claim is always followed by an attempt and several expired hosts
+// are probed by successive reads.
+func ReachableFirst(urls []string) []string {
+	var probe, reachable, unanswered []string
+	for _, u := range urls {
+		host := hostOf(u)
+		failedAt, failed := unreachable.Load(host)
+		switch {
+		case !failed:
+			reachable = append(reachable, u)
+		case time.Since(failedAt.(time.Time)) < unreachableRetryInterval:
+			unanswered = append(unanswered, u)
+		case probe == nil && unreachable.CompareAndSwap(host, failedAt, time.Now()):
+			probe = append(probe, u)
+		default:
+			unanswered = append(unanswered, u)
+		}
+	}
+	if probe == nil && unanswered == nil {
+		return urls
+	}
+	return append(append(probe, reachable...), unanswered...)
+}
+
+func hostOf(rawUrl string) string {
+	parsed, err := url.Parse(rawUrl)
+	if err != nil {
+		return ""
+	}
+	return parsed.Host
+}
diff --git a/weed/util/http/reachability_test.go b/weed/util/http/reachability_test.go
new file mode 100644
index 0000000000..4901ede9bb
--- /dev/null
+++ b/weed/util/http/reachability_test.go
@@ -0,0 +1,112 @@
+package http
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func forgetUnreachable(t *testing.T) {
+	t.Helper()
+	forget := func() {
+		unreachable.Range(func(host, _ any) bool {
+			unreachable.Delete(host)
+			return true
+		})
+	}
+	forget()
+	t.Cleanup(forget)
+}
+
+func assertOrder(t *testing.T, got []string, want ...string) {
+	t.Helper()
+	if len(got) != len(want) {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("got %v, want %v", got, want)
+		}
+	}
+}
+
+func TestReachableFirstTriesUnansweringHostLast(t *testing.T) {
+	forgetUnreachable(t)
+	urls := []string{"http://a:8080/3,x", "http://b:8080/3,x", "http://c:8080/3,x"}
+
+	assertOrder(t, ReachableFirst(urls), urls...)
+	recordUnreachable("a:8080")
+	assertOrder(t, ReachableFirst(urls), urls[1], urls[2], urls[0])
+	recordReachable("a:8080")
+	assertOrder(t, ReachableFirst(urls), urls...)
+}
+
+func TestReachableFirstProbesOnceAfterRetryInterval(t *testing.T) {
+	forgetUnreachable(t)
+	urls := []string{"http://b:8080/3,x", "http://a:8080/3,x"}
+	unreachable.Store("a:8080", time.Now().Add(-unreachableRetryInterval))
+
+	// the first read to come by probes a, the next keeps it last until that settles
+	assertOrder(t, ReachableFirst(urls), urls[1], urls[0])
+	assertOrder(t, ReachableFirst(urls), urls...)
+	recordReachable("a:8080")
+	assertOrder(t, ReachableFirst(urls), urls...)
+}
+
+func TestReachableFirstProbesOneExpiredHostPerRead(t *testing.T) {
+	forgetUnreachable(t)
+	urls := []string{"http://a:8080/3,x", "http://b:8080/3,x", "http://c:8080/3,x"}
+	expired := time.Now().Add(-unreachableRetryInterval)
+	unreachable.Store("a:8080", expired)
+	unreachable.Store("c:8080", expired)
+
+	assertOrder(t, ReachableFirst(urls), urls[0], urls[1], urls[2])
+	assertOrder(t, ReachableFirst(urls), urls[2], urls[1], urls[0])
+	assertOrder(t, ReachableFirst(urls), urls[1], urls[0], urls[2])
+}
+
+// hangupServer accepts the connection and drops it without answering, the way
+// a replica behind a broken network does, and counts how often that happened.
+func hangupServer(t *testing.T) (*httptest.Server, *int32) {
+	t.Helper()
+	var hangups int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		atomic.AddInt32(&hangups, 1)
+		conn, _, err := w.(http.Hijacker).Hijack()
+		if err != nil {
+			t.Error(err)
+			return
+		}
+		conn.Close()
+	}))
+	t.Cleanup(srv.Close)
+	return srv, &hangups
+}
+
+func TestRetriedFetchChunkDataTriesUnansweringServerLast(t *testing.T) {
+	forgetUnreachable(t)
+	payload := []byte("chunk contents")
+	live := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Write(payload)
+	}))
+	defer live.Close()
+	hangup, hangups := hangupServer(t)
+
+	urls := []string{hangup.URL + "/3,abc", live.URL + "/3,abc"}
+	for i := 0; i < 3; i++ {
+		buffer := make([]byte, len(payload))
+		n, err := RetriedFetchChunkData(context.Background(), buffer, urls, nil, false, true, 0, "3,abc", nil)
+		if err != nil {
+			t.Fatalf("read %d: %v", i, err)
+		}
+		if string(buffer[:n]) != string(payload) {
+			t.Fatalf("read %d got %q, want %q", i, buffer[:n], payload)
+		}
+	}
+	if got := atomic.LoadInt32(hangups); got != 1 {
+		t.Fatalf("the server that hung up was tried %d times, want once", got)
+	}
+}
diff --git a/weed/util/lock_table.go b/weed/util/lock_table.go
index 65daae39c4..3869ec52fe 100644
--- a/weed/util/lock_table.go
+++ b/weed/util/lock_table.go
@@ -128,6 +128,39 @@ func (lt *LockTable[T]) AcquireLock(intention string, key T, lockType LockType)
 	return lock
 }
 
+// TryAcquireLock grants the lock only when nothing holds or waits for the
+// key; it reports false on contention instead of queueing. Callers already
+// holding other locks use it so acquisition stays deadlock-free.
+func (lt *LockTable[T]) TryAcquireLock(intention string, key T, lockType LockType) (lock *ActiveLock, acquired bool) {
+	lt.mu.Lock()
+	entry, exists := lt.locks[key]
+	if !exists {
+		entry = &LockEntry{}
+		entry.cond = sync.NewCond(&entry.mu)
+		lt.locks[key] = entry
+		lt.locksInFlight[key] = 0
+	}
+	lt.locksInFlight[key]++
+	entry.mu.Lock()
+	blocked := len(entry.waiters) > 0 || entry.activeExclusiveLockOwnerCount > 0 ||
+		(lockType == ExclusiveLock && entry.activeSharedLockOwnerCount > 0)
+	if blocked {
+		entry.mu.Unlock()
+		lt.locksInFlight[key]--
+		lt.mu.Unlock()
+		return nil, false
+	}
+	lock = lt.NewActiveLock(intention, lockType)
+	if lockType == ExclusiveLock {
+		entry.activeExclusiveLockOwnerCount++
+	} else {
+		entry.activeSharedLockOwnerCount++
+	}
+	entry.mu.Unlock()
+	lt.mu.Unlock()
+	return lock, true
+}
+
 func (lt *LockTable[T]) ReleaseLock(key T, lock *ActiveLock) {
 	lt.mu.Lock()
 	defer lt.mu.Unlock()
diff --git a/weed/util/log_buffer/flush_budget_test.go b/weed/util/log_buffer/flush_budget_test.go
index 89050b2440..06a97b03eb 100644
--- a/weed/util/log_buffer/flush_budget_test.go
+++ b/weed/util/log_buffer/flush_budget_test.go
@@ -149,9 +149,7 @@ func TestQueueFlushChargesTheSlabNotTheWindow(t *testing.T) {
 		t.Skipf("allocator returned an exact fit (%d bytes), nothing to distinguish", cap(data))
 	}
 
-	if !lb.queueFlush(&dataToFlush{data: data}) {
-		t.Fatal("queueFlush dropped the window")
-	}
+	lb.queueFlush(&dataToFlush{data: data})
 
 	lb.flushBudget.mu.Lock()
 	queued := lb.flushBudget.queued
@@ -162,31 +160,6 @@ func TestQueueFlushChargesTheSlabNotTheWindow(t *testing.T) {
 	}
 }
 
-// The window is already sealed by the time queueFlush runs, so dropping it
-// loses records the caller was told were accepted. A shutdown racing the
-// hand-off must not cost data while the queue still has room for it.
-func TestQueueFlushKeepsSealedWindowWhenQueueHasRoom(t *testing.T) {
-	stall := make(chan struct{})
-	var flushed atomic.Int64
-	lb := NewLogBuffer("shutdown-race", time.Hour, func(_ *LogBuffer, _, _ time.Time, _ []byte, _, _ int64) {
-		<-stall
-		flushed.Add(1)
-	}, nil, func() {})
-	defer func() { close(stall) }()
-
-	// Simulate a shutdown landing between the seal and the hand-off.
-	close(lb.shutdownCh)
-	lb.isStopping.Store(true)
-
-	// Stay inside the channel's capacity so room is guaranteed for every one of
-	// them; loopFlush is parked in the stalled flushFn and drains nothing.
-	for i := 0; i < flushQueueDepth; i++ {
-		if !lb.queueFlush(&dataToFlush{data: mem.Allocate(1024), seq: uint64(i)}) {
-			t.Fatalf("window %d was dropped even though the queue had room", i)
-		}
-	}
-}
-
 // The point of the budget: a stalled flush must stop producers rather than let
 // them keep handing over copies. Asserted on how many producers get through,
 // which is independent of the counter reserve maintains.
diff --git a/weed/util/log_buffer/log_buffer.go b/weed/util/log_buffer/log_buffer.go
index 279c343b69..6d71105d61 100644
--- a/weed/util/log_buffer/log_buffer.go
+++ b/weed/util/log_buffer/log_buffer.go
@@ -48,6 +48,8 @@ const flushQueueBudget = flushQueueDepth * BufferSize
 var (
 	// ErrBufferCorrupted indicates the log buffer contains corrupted data
 	ErrBufferCorrupted = fmt.Errorf("log buffer is corrupted")
+	// ErrBufferStopped indicates that shutdown has closed write admission.
+	ErrBufferStopped = fmt.Errorf("log buffer is stopping")
 )
 
 type dataToFlush struct {
@@ -189,16 +191,21 @@ type LogBuffer struct {
 	notifyFn       func()
 	// Per-subscriber notification channels for instant wake-up
 	subscribersMu sync.RWMutex
-	subscribers   map[string]chan struct{} // subscriberID -> notification channel
+	subscribers   map[string]*subscription // subscriberID -> shared notification channel
 	// Notified only when a flush lands, for readers that cannot act on an append
-	flushSubscribers map[string]chan struct{}
+	flushSubscribers map[string]*subscription
 	isStopping       *atomic.Bool
-	shutdownCh       chan struct{}  // closed by ShutdownLogBuffer to wake blocked subscribers
-	loopsDone        sync.WaitGroup // loopFlush and loopInterval signal exit
-	isAllFlushed     bool
-	flushChan        chan *dataToFlush
-	flushBudget      *flushBudget
-	flushSeq         uint64 // seal counter, assigned under the write lock
+	shutdownCh       chan struct{} // closed by ShutdownLogBuffer to wake blocked subscribers
+	// flushDroppedBytes counts bytes the flushFn gave up on during shutdown.
+	// loopFlush reads it after each window so an abandoned flush does not
+	// advance the flushed watermark or wake subscribers as if it had landed.
+	flushDroppedBytes atomic.Int64
+	loopsDone         sync.WaitGroup // loopFlush and loopInterval signal exit
+	isAllFlushed      bool
+	flushChan         chan *dataToFlush
+	flushBudget       *flushBudget
+	flushSeq          uint64     // seal counter, assigned under the write lock
+	writeMu           sync.Mutex // serializes sealing and enqueueing, including shutdown
 	// Offset range tracking for Kafka integration
 	hasOffsets bool
 	// Disk chunk cache for historical data reads
@@ -223,8 +230,8 @@ func NewLogBuffer(name string, flushInterval time.Duration, flushFn LogFlushFunc
 		flushFn:          flushFn,
 		ReadFromDiskFn:   readFromDiskFn,
 		notifyFn:         notifyFn,
-		subscribers:      make(map[string]chan struct{}),
-		flushSubscribers: make(map[string]chan struct{}),
+		subscribers:      make(map[string]*subscription),
+		flushSubscribers: make(map[string]*subscription),
 		flushChan:        make(chan *dataToFlush, flushQueueDepth),
 		isStopping:       new(atomic.Bool),
 		shutdownCh:       make(chan struct{}),
@@ -242,32 +249,59 @@ func NewLogBuffer(name string, flushInterval time.Duration, flushFn LogFlushFunc
 	return lb
 }
 
+// subscription is one notification channel and the number of readers holding
+// it. Registrations that share a subscriberID share the channel - two streams
+// of the same client, or an old one that has not noticed its replacement yet -
+// so it may only be closed once the last of them unregisters. Closing it under
+// a reader parked in awaitNotificationOrTimeoutFor makes every receive there
+// succeed instantly, spinning that reader on a full core for the rest of its
+// life.
+type subscription struct {
+	notifyChan chan struct{}
+	refCount   int
+}
+
+func registerSubscription(subscriptions map[string]*subscription, subscriberID string) chan struct{} {
+	if existing, exists := subscriptions[subscriberID]; exists {
+		existing.refCount++
+		return existing.notifyChan
+	}
+
+	// Create buffered channel (size 1) so notifications never block
+	sub := &subscription{notifyChan: make(chan struct{}, 1), refCount: 1}
+	subscriptions[subscriberID] = sub
+	return sub.notifyChan
+}
+
+func unregisterSubscription(subscriptions map[string]*subscription, subscriberID string) {
+	sub, exists := subscriptions[subscriberID]
+	if !exists {
+		return
+	}
+	sub.refCount--
+	if sub.refCount > 0 {
+		return
+	}
+	close(sub.notifyChan)
+	delete(subscriptions, subscriberID)
+}
+
 // RegisterSubscriber registers a subscriber for instant notifications when data is written
 // Returns a channel that will receive notifications (<1ms latency)
 func (logBuffer *LogBuffer) RegisterSubscriber(subscriberID string) chan struct{} {
 	logBuffer.subscribersMu.Lock()
 	defer logBuffer.subscribersMu.Unlock()
 
-	// Check if already registered
-	if existingChan, exists := logBuffer.subscribers[subscriberID]; exists {
-		return existingChan
-	}
-
-	// Create buffered channel (size 1) so notifications never block
-	notifyChan := make(chan struct{}, 1)
-	logBuffer.subscribers[subscriberID] = notifyChan
-	return notifyChan
+	return registerSubscription(logBuffer.subscribers, subscriberID)
 }
 
 // UnregisterSubscriber removes a subscriber and closes its notification channel
+// once no other registration of the same subscriberID is left holding it.
 func (logBuffer *LogBuffer) UnregisterSubscriber(subscriberID string) {
 	logBuffer.subscribersMu.Lock()
 	defer logBuffer.subscribersMu.Unlock()
 
-	if ch, exists := logBuffer.subscribers[subscriberID]; exists {
-		close(ch)
-		delete(logBuffer.subscribers, subscriberID)
-	}
+	unregisterSubscription(logBuffer.subscribers, subscriberID)
 }
 
 // RegisterFlushSubscriber registers a subscriber woken only when a flush lands.
@@ -279,23 +313,16 @@ func (logBuffer *LogBuffer) RegisterFlushSubscriber(subscriberID string) chan st
 	logBuffer.subscribersMu.Lock()
 	defer logBuffer.subscribersMu.Unlock()
 
-	if existingChan, exists := logBuffer.flushSubscribers[subscriberID]; exists {
-		return existingChan
-	}
-	notifyChan := make(chan struct{}, 1)
-	logBuffer.flushSubscribers[subscriberID] = notifyChan
-	return notifyChan
+	return registerSubscription(logBuffer.flushSubscribers, subscriberID)
 }
 
 // UnregisterFlushSubscriber removes a flush subscriber and closes its channel
+// once no other registration of the same subscriberID is left holding it.
 func (logBuffer *LogBuffer) UnregisterFlushSubscriber(subscriberID string) {
 	logBuffer.subscribersMu.Lock()
 	defer logBuffer.subscribersMu.Unlock()
 
-	if ch, exists := logBuffer.flushSubscribers[subscriberID]; exists {
-		close(ch)
-		delete(logBuffer.flushSubscribers, subscriberID)
-	}
+	unregisterSubscription(logBuffer.flushSubscribers, subscriberID)
 }
 
 // IsOffsetInMemory checks if the given offset is available in the in-memory buffer
@@ -357,9 +384,9 @@ func (logBuffer *LogBuffer) notifySubscribers() {
 		return // No subscribers, skip notification
 	}
 
-	for _, notifyChan := range logBuffer.subscribers {
+	for _, sub := range logBuffer.subscribers {
 		select {
-		case notifyChan <- struct{}{}:
+		case sub.notifyChan <- struct{}{}:
 			// Notification sent successfully
 		default:
 			// Channel full - subscriber hasn't consumed previous notification yet
@@ -373,9 +400,9 @@ func (logBuffer *LogBuffer) notifyFlushSubscribers() {
 	logBuffer.subscribersMu.RLock()
 	defer logBuffer.subscribersMu.RUnlock()
 
-	for _, notifyChan := range logBuffer.flushSubscribers {
+	for _, sub := range logBuffer.flushSubscribers {
 		select {
-		case notifyChan <- struct{}{}:
+		case sub.notifyChan <- struct{}{}:
 		default:
 		}
 	}
@@ -423,6 +450,9 @@ func (logBuffer *LogBuffer) AddLogEntryToBuffer(logEntry *filer_pb.LogEntry) err
 		logBuffer.flushBudget.waitForRoom(len(logEntry.Data))
 	}
 
+	if !logBuffer.beginWrite() {
+		return ErrBufferStopped
+	}
 	var toFlush *dataToFlush
 	var marshalErr error
 	logBuffer.Lock()
@@ -431,6 +461,7 @@ func (logBuffer *LogBuffer) AddLogEntryToBuffer(logEntry *filer_pb.LogEntry) err
 		if toFlush != nil {
 			logBuffer.queueFlush(toFlush)
 		}
+		logBuffer.writeMu.Unlock()
 		// Only notify if there was no error
 		if marshalErr == nil {
 			if logBuffer.notifyFn != nil {
@@ -550,6 +581,9 @@ func (logBuffer *LogBuffer) AddDataToBuffer(partitionKey, data []byte, processin
 		Key:              partitionKey,
 	}
 
+	if !logBuffer.beginWrite() {
+		return ErrBufferStopped
+	}
 	var toFlush *dataToFlush
 	var marshalErr error
 	logBuffer.Lock()
@@ -558,6 +592,7 @@ func (logBuffer *LogBuffer) AddDataToBuffer(partitionKey, data []byte, processin
 		if toFlush != nil {
 			logBuffer.queueFlush(toFlush)
 		}
+		logBuffer.writeMu.Unlock()
 		// Only notify if there was no error
 		if marshalErr == nil {
 			if logBuffer.notifyFn != nil {
@@ -656,25 +691,22 @@ func (logBuffer *LogBuffer) IsStopping() bool {
 	return logBuffer.isStopping.Load()
 }
 
-// ForceFlush immediately flushes the current buffer content and WAITS for completion
+// ForceFlush queues the current buffer content, then waits up to 5 seconds for completion
 // This is useful for critical topics that need immediate persistence
-// CRITICAL: This function is now SYNCHRONOUS - it blocks until the flush completes
+// Queueing itself has no timeout.
 func (logBuffer *LogBuffer) ForceFlush() {
-	if logBuffer.isStopping.Load() {
-		return // Don't flush if we're shutting down
+	if !logBuffer.beginWrite() {
+		return
 	}
-
 	logBuffer.Lock()
 	toFlush := logBuffer.copyToFlushWithCallback()
 	logBuffer.Unlock()
+	if toFlush != nil {
+		logBuffer.queueFlush(toFlush)
+	}
+	logBuffer.writeMu.Unlock()
 
 	if toFlush != nil {
-		// The live buffer was already sealed and reset by copyToFlushWithCallback,
-		// so dropping toFlush on a timeout would lose it. Block until queued,
-		// bailing out only on shutdown.
-		if !logBuffer.queueFlush(toFlush) {
-			return
-		}
 		select {
 		case <-toFlush.done:
 			// Flush completed
@@ -684,6 +716,17 @@ func (logBuffer *LogBuffer) ForceFlush() {
 	}
 }
 
+// beginWrite serializes admission and batch handoff with shutdown.
+// Callers hold writeMu until any sealed batch has been queued.
+func (logBuffer *LogBuffer) beginWrite() bool {
+	logBuffer.writeMu.Lock()
+	if logBuffer.isStopping.Load() {
+		logBuffer.writeMu.Unlock()
+		return false
+	}
+	return true
+}
+
 // ShutdownLogBuffer flushes the buffer and stops the log buffer
 func (logBuffer *LogBuffer) ShutdownLogBuffer() {
 	isAlreadyStopped := logBuffer.isStopping.Swap(true)
@@ -694,51 +737,47 @@ func (logBuffer *LogBuffer) ShutdownLogBuffer() {
 	// notice IsStopping() and exit promptly, even on an idle buffer where no
 	// flush notification would otherwise fire.
 	close(logBuffer.shutdownCh)
-	// Let go of the flush budget before sealing the last window, so a producer
-	// parked on it wakes up and the hand-off below cannot wait on a reservation.
+	// Wake oversized writers waiting for room; they will observe shutdown
+	// before appending. Already admitted writes must finish their handoff.
 	logBuffer.flushBudget.close()
+	logBuffer.writeMu.Lock()
+	defer logBuffer.writeMu.Unlock()
 	logBuffer.Lock()
 	toFlush := logBuffer.copyToFlush()
 	logBuffer.Unlock()
 	if toFlush != nil {
-		toFlush.budget = logBuffer.flushBudget.reserve(toFlush.seq, cap(toFlush.data))
-		logBuffer.flushChan <- toFlush
+		logBuffer.queueFlush(toFlush)
 	}
-	// nil is the shutdown sentinel: loopFlush drains everything queued before
-	// it and exits. The channel is never closed, so a sender racing shutdown
-	// can never panic on a closed channel.
+	// Every accepted batch is now queued, and no producer can append after
+	// this sentinel. loopFlush drains the queue before exiting.
 	logBuffer.flushChan <- nil
 }
 
+// WaitForShutdown waits for pending flushes and background loops to finish.
+// Call ShutdownLogBuffer first, after stopping producers.
+func (logBuffer *LogBuffer) WaitForShutdown() {
+	logBuffer.loopsDone.Wait()
+}
+
+// NoteFlushDropped records that the flush function abandoned n bytes instead
+// of writing them (a shutdown-bounded retry giving up). loopFlush then skips
+// the watermark advance and subscriber notifications for that window, so no
+// reader is told the bytes were flushed when they were not.
+func (logBuffer *LogBuffer) NoteFlushDropped(n int) {
+	logBuffer.flushDroppedBytes.Add(int64(n))
+}
+
 // IsAllFlushed returns true if all data in the buffer has been flushed, after calling ShutdownLogBuffer().
 func (logBuffer *LogBuffer) IsAllFlushed() bool {
 	return logBuffer.isAllFlushed
 }
 
-// queueFlush hands a sealed window to loopFlush, reserving its bytes first so
-// a producer waits for the queue to drain rather than adding another copy to
-// it. Reports false when the buffer shut down before the hand-off.
-func (logBuffer *LogBuffer) queueFlush(d *dataToFlush) bool {
-	// Charge the slab, not the window: mem.Allocate rounds up to a size class,
-	// so the bytes actually held are cap(data), and charging len would let the
-	// queue hold up to twice the ceiling.
+// queueFlush hands a sealed window to loopFlush. The caller holds writeMu
+// from before sealing until this handoff completes, so shutdown cannot pass it.
+func (logBuffer *LogBuffer) queueFlush(d *dataToFlush) {
+	// Charge the pooled slab, whose capacity may exceed the window length.
 	d.budget = logBuffer.flushBudget.reserve(d.seq, cap(d.data))
-	// The window is already sealed, so dropping it here loses records the
-	// caller was told were accepted. Take any room in the queue first, and only
-	// fall back to the shutdown escape when there is none.
-	select {
-	case logBuffer.flushChan <- d:
-		return true
-	default:
-	}
-	select {
-	case logBuffer.flushChan <- d:
-		return true
-	case <-logBuffer.shutdownCh:
-		// shutting down; loopFlush may be gone, do not park forever
-		logBuffer.flushBudget.release(d.budget)
-		return false
-	}
+	logBuffer.flushChan <- d
 }
 
 func (logBuffer *LogBuffer) loopFlush() {
@@ -748,8 +787,16 @@ func (logBuffer *LogBuffer) loopFlush() {
 			break // shutdown sentinel
 		}
 		logBuffer.flushFn(logBuffer, d.startTime, d.stopTime, d.data, d.minOffset, d.maxOffset)
+		dropped := logBuffer.flushDroppedBytes.Swap(0)
 		d.releaseMemory()
 		logBuffer.flushBudget.release(d.budget)
+		if dropped > 0 {
+			glog.Warningf("log buffer %s: shutdown flush dropped %d bytes", logBuffer.name, dropped)
+			if d.done != nil {
+				close(d.done)
+			}
+			continue
+		}
 		// local logbuffer is different from aggregate logbuffer here
 		if d.maxOffset >= 0 {
 			logBuffer.lastFlushedOffset.Store(d.maxOffset)
@@ -793,12 +840,16 @@ func (logBuffer *LogBuffer) loopInterval() {
 		case <-ticker.C:
 		}
 
+		if !logBuffer.beginWrite() {
+			return
+		}
 		logBuffer.Lock()
 		toFlush := logBuffer.copyToFlush()
 		logBuffer.Unlock()
 		if toFlush != nil {
 			logBuffer.queueFlush(toFlush)
 		}
+		logBuffer.writeMu.Unlock()
 	}
 }
 
@@ -941,6 +992,20 @@ func (logBuffer *LogBuffer) GetEarliestPosition() MessagePosition {
 	}
 }
 
+// FlushedThroughTsNs reports the timestamp through which this buffer's data
+// is durably on disk: "now" when nothing is pending a flush (a later append
+// is bumped past the head), otherwise the last flushed window's stop time.
+// Covers only entries that reached the buffer - callers stamping timestamps
+// before the append must also bound by their in-flight floor (see
+// Filer.LocalFlushedThroughTsNs).
+func (logBuffer *LogBuffer) FlushedThroughTsNs(nowNs int64) int64 {
+	flushed := logBuffer.lastFlushTsNs.Load()
+	if logBuffer.LastTsNs.Load() <= flushed {
+		return nowNs
+	}
+	return flushed
+}
+
 // GetLastFlushTsNs returns the latest flushed timestamp in Unix nanoseconds.
 // Returns 0 if nothing has been flushed yet.
 func (logBuffer *LogBuffer) GetLastFlushTsNs() int64 {
@@ -961,6 +1026,18 @@ func (logBuffer *LogBuffer) GetLastEvictedTsNs() int64 {
 	return logBuffer.lastEvictedTsNs.Load()
 }
 
+// MarkEvictedThrough treats entries at or below tsNs as evicted even though
+// nothing was rotated out yet: a merge-fed buffer is born empty while its
+// sources hold history it must not skip. Call before the first append.
+func (logBuffer *LogBuffer) MarkEvictedThrough(tsNs int64) {
+	if tsNs > logBuffer.lastEvictedTsNs.Load() {
+		logBuffer.lastEvictedTsNs.Store(tsNs)
+	}
+	if tsNs > logBuffer.lastEvictedOriginalTsNs.Load() {
+		logBuffer.lastEvictedOriginalTsNs.Store(tsNs)
+	}
+}
+
 func (logBuffer *LogBuffer) SetLastFlushTsNs(ts int64) {
 	logBuffer.lastFlushTsNs.Store(ts)
 }
diff --git a/weed/util/log_buffer/log_buffer_eviction_gate_test.go b/weed/util/log_buffer/log_buffer_eviction_gate_test.go
index 927f13952d..5997324f45 100644
--- a/weed/util/log_buffer/log_buffer_eviction_gate_test.go
+++ b/weed/util/log_buffer/log_buffer_eviction_gate_test.go
@@ -273,6 +273,46 @@ func TestEvictionGatedCursor(t *testing.T) {
 	}
 }
 
+// TestMarkEvictedThroughGatesYoungRing pins the young-ring gate: with the mark
+// set, a below-window gated cursor goes to disk before the first real eviction
+// instead of being served the earliest retained entry.
+func TestMarkEvictedThroughGatesYoungRing(t *testing.T) {
+	lb := NewLogBuffer("young-ring", time.Minute, nil, nil, nil)
+	defer lb.ShutdownLogBuffer()
+
+	seed := time.Now().Add(-time.Minute).UnixNano()
+	lb.MarkEvictedThrough(seed)
+	if got := lb.GetLastEvictedTsNs(); got != seed {
+		t.Fatalf("evicted through %v, want the mark %v", time.Unix(0, got), time.Unix(0, seed))
+	}
+	if got := lb.GetLastEvictedOriginalTsNs(); got != seed {
+		t.Fatalf("original watermark %v, want the mark %v", time.Unix(0, got), time.Unix(0, seed))
+	}
+	// A lower mark must not regress an established boundary.
+	lb.MarkEvictedThrough(seed - int64(time.Hour))
+	if got := lb.GetLastEvictedTsNs(); got != seed {
+		t.Fatalf("lower mark regressed the watermark to %v", time.Unix(0, got))
+	}
+
+	// One post-mark arrival: the ring's window starts well above the mark.
+	if err := lb.AddLogEntryToBuffer(&filer_pb.LogEntry{
+		TsNs: time.Now().UnixNano(), Data: []byte("x"), Key: []byte("k"),
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	// Below the mark: gated goes to disk, -2 keeps serving (MQ contract).
+	if _, _, _, err := lb.ReadFromBuffer(NewMessagePosition(seed-1, EvictionGatedOffset)); err != ResumeFromDiskError {
+		t.Fatalf("gated below the mark: want ResumeFromDiskError, got %v", err)
+	}
+	if buf, _, _, err := lb.ReadFromBuffer(NewMessagePosition(seed-1, -2)); err != nil || buf == nil {
+		t.Fatalf("plain sentinel below the mark: buf=%v err=%v", buf != nil, err)
+	}
+	if buf, _, _, err := lb.ReadFromBuffer(NewMessagePosition(seed, EvictionGatedOffset)); err != nil || buf == nil {
+		t.Fatalf("gated at the mark: buf=%v err=%v", buf != nil, err)
+	}
+}
+
 // TestEvictionOriginalWatermark pins the second timestamp space. The ring bumps
 // an out-of-order arrival past its head, so a bump-heavy interval (peer history
 // replay) leaves stopTimes above anything on any peer's disk; a gap gate
diff --git a/weed/util/log_buffer/log_read.go b/weed/util/log_buffer/log_read.go
index 977787cf59..afbee3e9b3 100644
--- a/weed/util/log_buffer/log_read.go
+++ b/weed/util/log_buffer/log_read.go
@@ -14,6 +14,10 @@ import (
 var (
 	ResumeError         = fmt.Errorf("resume")
 	ResumeFromDiskError = fmt.Errorf("resumeFromDisk")
+	// StopReadingError, wrapped by an eachLogDataFn's error, marks a read the
+	// callback ended on purpose - control flow, not a failure - so the loop
+	// hands it back to the caller without logging it.
+	StopReadingError = fmt.Errorf("stopReading")
 )
 
 // notificationHealthCheckInterval bounds how long an idle subscriber blocks
@@ -160,6 +164,16 @@ func (logBuffer *LogBuffer) LoopProcessLogData(readerName string, startPosition
 				continue
 			}
 
+			// Nothing readable anywhere for this cursor: a bounded subscription is
+			// done, same as the caught-up path below. Without this a bounded
+			// subscriber on a buffer that never took a write (empty since process
+			// start, ReadFromDiskFn nil) parks here forever while heartbeats keep
+			// the stream looking alive. The nil error matters: err still holds
+			// ResumeFromDiskError, which callers treat as retry-the-disk-pass.
+			if stopTsNs != 0 {
+				return lastReadPosition, true, nil
+			}
+
 			// CRITICAL: Check if client is still connected
 			if !waitForDataFn() {
 				// Client disconnected - exit cleanly
@@ -287,7 +301,9 @@ func (logBuffer *LogBuffer) LoopProcessLogData(readerName string, startPosition
 			lastReadPosition = NewMessagePosition(logEntry.TsNs, batchIndex)
 
 			if isDone, err = eachLogDataFn(logEntry); err != nil {
-				glog.Errorf("LoopProcessLogData: %s process log entry %d key:%q ts_ns:%d offset:%d size:%d: %v", readerName, batchSize+1, logEntry.Key, logEntry.TsNs, logEntry.Offset, len(logEntry.Data), err)
+				if !errors.Is(err, StopReadingError) {
+					glog.Errorf("LoopProcessLogData: %s process log entry %d key:%q ts_ns:%d offset:%d size:%d: %v", readerName, batchSize+1, logEntry.Key, logEntry.TsNs, logEntry.Offset, len(logEntry.Data), err)
+				}
 				return
 			}
 			if isDone {
@@ -560,7 +576,9 @@ func (logBuffer *LogBuffer) LoopProcessLogDataWithOffset(readerName string, star
 
 			glog.V(4).Infof("Calling eachLogDataFn for entry at offset %d, next position will be %d", logEntry.Offset, logEntry.Offset+1)
 			if isDone, err = eachLogDataFn(logEntry, logEntry.Offset); err != nil {
-				glog.Errorf("LoopProcessLogDataWithOffset: %s process log entry %d key:%q ts_ns:%d offset:%d size:%d: %v", readerName, batchSize+1, logEntry.Key, logEntry.TsNs, logEntry.Offset, len(logEntry.Data), err)
+				if !errors.Is(err, StopReadingError) {
+					glog.Errorf("LoopProcessLogDataWithOffset: %s process log entry %d key:%q ts_ns:%d offset:%d size:%d: %v", readerName, batchSize+1, logEntry.Key, logEntry.TsNs, logEntry.Offset, len(logEntry.Data), err)
+				}
 				return
 			}
 			if isDone {
diff --git a/weed/util/log_buffer/log_read_test.go b/weed/util/log_buffer/log_read_test.go
index 5acbaf80e7..980d326f71 100644
--- a/weed/util/log_buffer/log_read_test.go
+++ b/weed/util/log_buffer/log_read_test.go
@@ -3,6 +3,7 @@ package log_buffer
 import (
 	"context"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -488,6 +489,51 @@ func TestLoopProcessLogDataWithOffset_StopTime(t *testing.T) {
 	t.Logf("Loop correctly exited for past stopTsNs in %v (waitForDataFn called %d times)", elapsed, callCount)
 }
 
+// TestLoopProcessLogData_BoundedEmptyBufferTerminates: a bounded subscription
+// (stopTsNs != 0) against a buffer that has never received a write - so
+// ReadFromBuffer returns ResumeFromDiskError - with no ReadFromDiskFn must
+// terminate like the caught-up path does, not park on the notification loop
+// forever. This is the filer SubscribeMetadata configuration: both meta log
+// buffers are built with ReadFromDiskFn == nil, and a freshly restarted filer
+// that has serviced zero metadata writes wedges every UntilNs-bounded
+// subscriber while heartbeats keep the stream looking alive.
+func TestLoopProcessLogData_BoundedEmptyBufferTerminates(t *testing.T) {
+	logBuffer := NewLogBuffer("test", time.Minute, nil, nil, nil)
+	defer logBuffer.ShutdownLogBuffer()
+
+	// Client stays connected, like the filer's heartbeat-sending closure.
+	waitForDataFn := func() bool { return true }
+	eachLogEntryFn := func(logEntry *filer_pb.LogEntry) (bool, error) {
+		t.Error("no entries should be delivered from an empty buffer")
+		return false, nil
+	}
+
+	startPosition := NewMessagePosition(time.Now().Add(-time.Hour).UnixNano(), EvictionGatedOffset)
+	stopTsNs := time.Now().UnixNano()
+
+	done := make(chan struct{})
+	var isDone bool
+	var err error
+	go func() {
+		_, isDone, err = logBuffer.LoopProcessLogData("bounded-empty", startPosition, stopTsNs, waitForDataFn, eachLogEntryFn)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		if !isDone {
+			t.Errorf("expected isDone=true for a bounded read of an empty buffer, got false")
+		}
+		// A leaked ResumeFromDiskError would send the filer's outer loop into
+		// its gap machinery, which parks the bounded subscriber all over again.
+		if err != nil {
+			t.Errorf("expected err=nil for a bounded read of an empty buffer, got %v", err)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("bounded LoopProcessLogData wedged on an empty buffer instead of terminating")
+	}
+}
+
 func TestLoopProcessLogData_SlowConsumerFallsBehind(t *testing.T) {
 	flushFn := func(logBuffer *LogBuffer, startTime, stopTime time.Time, buf []byte, minOffset, maxOffset int64) {}
 	logBuffer := NewLogBuffer("test", 1*time.Minute, flushFn, nil, nil)
@@ -529,6 +575,71 @@ func TestLoopProcessLogData_SlowConsumerFallsBehind(t *testing.T) {
 	}
 }
 
+// TestLoopProcessLogData_DuplicateReaderLeaving is a regression test for issue
+// #10810: an idle metadata subscriber pinning a full core inside
+// awaitNotificationOrTimeoutFor. Two readers registered under the same name
+// share one notification channel, which happens whenever a client reconnects
+// before its previous stream noticed the disconnect. When the departing one
+// closed that channel, the surviving reader's select won on it instantly on
+// every pass, so the loop ran flat out - allocating a timer per iteration -
+// until the client went away.
+func TestLoopProcessLogData_DuplicateReaderLeaving(t *testing.T) {
+	flushFn := func(logBuffer *LogBuffer, startTime, stopTime time.Time, buf []byte, minOffset, maxOffset int64) {}
+	logBuffer := NewLogBuffer("test", 1*time.Minute, flushFn, nil, nil)
+	defer logBuffer.ShutdownLogBuffer()
+
+	const readerName = "localMeta:s3@"
+	startPosition := NewMessagePosition(time.Now().UnixNano(), -2)
+	eachLogEntryFn := func(logEntry *filer_pb.LogEntry) (bool, error) { return false, nil }
+
+	// startReader runs a reader and reports how many times it went round the
+	// loop; the loop calls waitForDataFn exactly once per pass.
+	startReader := func(iterations *atomic.Int64, stop *atomic.Bool) chan struct{} {
+		done := make(chan struct{})
+		go func() {
+			defer close(done)
+			logBuffer.LoopProcessLogData(readerName, startPosition, 0, func() bool {
+				iterations.Add(1)
+				return !stop.Load()
+			}, eachLogEntryFn)
+		}()
+		for iterations.Load() == 0 {
+			time.Sleep(time.Millisecond)
+		}
+		return done
+	}
+
+	var leavingIterations, survivorIterations atomic.Int64
+	var stopLeaving, stopSurvivor atomic.Bool
+	leavingDone := startReader(&leavingIterations, &stopLeaving)
+	survivorDone := startReader(&survivorIterations, &stopSurvivor)
+
+	stopLeaving.Store(true)
+	<-leavingDone
+
+	const observeFor = 500 * time.Millisecond
+	before := survivorIterations.Load()
+	time.Sleep(observeFor)
+	spun := survivorIterations.Load() - before
+
+	// A low iteration count only means "not spinning" if the reader was still
+	// there to spin. Had LoopProcessLogData returned when its duplicate left,
+	// spun would be 0 and the count below would pass while proving nothing.
+	select {
+	case <-survivorDone:
+		t.Fatal("surviving reader returned while its duplicate unregistered; it must keep reading")
+	default:
+	}
+
+	stopSurvivor.Store(true)
+	<-survivorDone
+
+	maxIterations := int64(observeFor/notificationHealthCheckInterval) + 1
+	if spun > maxIterations {
+		t.Errorf("surviving reader looped %d times in %v, expected at most %d (suggests busy-waiting)", spun, observeFor, maxIterations)
+	}
+}
+
 // BenchmarkLoopProcessLogDataWithOffset_EmptyBuffer benchmarks the performance
 // of the loop with an empty buffer to ensure no busy-waiting
 func BenchmarkLoopProcessLogDataWithOffset_EmptyBuffer(b *testing.B) {
diff --git a/weed/util/log_buffer/shutdown_test.go b/weed/util/log_buffer/shutdown_test.go
new file mode 100644
index 0000000000..7ce70b0fa2
--- /dev/null
+++ b/weed/util/log_buffer/shutdown_test.go
@@ -0,0 +1,112 @@
+package log_buffer
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"reflect"
+	"testing"
+	"testing/synctest"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestShutdownDrainsAcceptedRecords(t *testing.T) {
+	for _, seal := range []string{"append", "interval", "force"} {
+		t.Run(seal, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				releaseFlush := make(chan struct{})
+				var persisted bytes.Buffer
+				lb := NewLogBuffer("shutdown", time.Hour, func(_ *LogBuffer, _, _ time.Time, data []byte, _, _ int64) {
+					<-releaseFlush
+					persisted.Write(data)
+				}, nil, nil)
+
+				// Fill the queue behind a blocked persistence call, leaving one
+				// record in the current window. Each append seals its predecessor.
+				var want []string
+				appendRecord := func() {
+					value := fmt.Sprint(len(want))
+					ts := time.Now().Add(time.Duration(len(want)) * 2 * time.Hour).UnixNano()
+					if err := lb.AddDataToBuffer(nil, []byte(value), ts); err != nil {
+						t.Error(err)
+					}
+					want = append(want, value)
+				}
+				for range flushQueueDepth + 2 {
+					appendRecord()
+					synctest.Wait()
+				}
+				switch seal {
+				case "append":
+					go appendRecord()
+				case "interval":
+					time.Sleep(time.Hour)
+				case "force":
+					go lb.ForceFlush()
+				}
+				synctest.Wait()
+
+				done := make(chan struct{})
+				go func() {
+					lb.ShutdownLogBuffer()
+					lb.WaitForShutdown()
+					close(done)
+				}()
+				<-lb.shutdownCh
+				select {
+				case <-done:
+					t.Error("shutdown completed while persistence was blocked")
+				default:
+				}
+
+				close(releaseFlush)
+				<-done
+				synctest.Wait()
+				var got []string
+				for persisted.Len() > 0 {
+					size := util.BytesToUint32(persisted.Next(4))
+					var entry filer_pb.LogEntry
+					if err := entry.UnmarshalVT(persisted.Next(int(size))); err != nil {
+						t.Fatal(err)
+					}
+					got = append(got, string(entry.Data))
+				}
+				if !reflect.DeepEqual(got, want) {
+					t.Fatalf("persisted records = %v, want %v", got, want)
+				}
+			})
+		})
+	}
+}
+
+func TestShutdownRejectsNewRecords(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		lb := NewLogBuffer("stopped", time.Hour, nil, nil, nil)
+		lb.ShutdownLogBuffer()
+		for _, appendRecord := range []func() error{
+			func() error { return lb.AddDataToBuffer(nil, []byte("late data"), 0) },
+			func() error { return lb.AddLogEntryToBuffer(&filer_pb.LogEntry{Data: []byte("late entry")}) },
+		} {
+			if err := appendRecord(); !errors.Is(err, ErrBufferStopped) {
+				t.Errorf("append after shutdown = %v, want ErrBufferStopped", err)
+			}
+		}
+		lb.ForceFlush()
+		lb.WaitForShutdown()
+		if lb.pos != 0 {
+			t.Errorf("stopped buffer retained %d bytes", lb.pos)
+		}
+	})
+}
+
+func TestWaitForShutdownWithEmptyBuffer(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		lb := NewLogBuffer("empty", time.Hour, nil, nil, nil)
+		lb.ShutdownLogBuffer()
+		lb.WaitForShutdown()
+		lb.WaitForShutdown()
+	})
+}
diff --git a/weed/util/mem/slot_pool.go b/weed/util/mem/slot_pool.go
index 70f2525b3e..897034e649 100644
--- a/weed/util/mem/slot_pool.go
+++ b/weed/util/mem/slot_pool.go
@@ -39,6 +39,13 @@ func getSlotPool(size int) (*sync.Pool, bool) {
 	return pools[index], true
 }
 
+func AllocationSize(size int) int {
+	if _, found := getSlotPool(size); found {
+		return min_size << bitCount(size)
+	}
+	return size
+}
+
 func Allocate(size int) []byte {
 	if pool, found := getSlotPool(size); found {
 		slab := *pool.Get().(*[]byte)
diff --git a/weed/util/mem/slot_pool_test.go b/weed/util/mem/slot_pool_test.go
index d457a7490c..620f2da8b0 100644
--- a/weed/util/mem/slot_pool_test.go
+++ b/weed/util/mem/slot_pool_test.go
@@ -47,3 +47,12 @@ func TestBitCount(t *testing.T) {
 	}
 
 }
+
+func TestAllocationSize(t *testing.T) {
+	for _, size := range []int{0, 1, 1024, 1025, 4883, 2 << 20} {
+		buf := Allocate(size)
+		assert.Equal(t, cap(buf), AllocationSize(size))
+		Free(buf)
+	}
+	assert.Equal(t, 257<<20, AllocationSize(257<<20))
+}
diff --git a/weed/util/net_host.go b/weed/util/net_host.go
new file mode 100644
index 0000000000..aa6fd385ca
--- /dev/null
+++ b/weed/util/net_host.go
@@ -0,0 +1,79 @@
+package util
+
+import (
+	"net"
+	"strings"
+)
+
+// HostKey is the hostname/IP of an "host:port" address (or the string itself
+// when it has no port). Compared case-insensitively so worker Hello
+// "10.87.0.3:33646" matches a volume replica on "10.87.0.3:8080".
+func HostKey(addr string) string {
+	addr = strings.TrimSpace(addr)
+	if addr == "" {
+		return ""
+	}
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		return strings.ToLower(addr)
+	}
+	return strings.ToLower(host)
+}
+
+// HostKeysFromAddresses returns unique HostKey values, skipping empties.
+func HostKeysFromAddresses(addrs []string) []string {
+	seen := make(map[string]struct{}, len(addrs))
+	var out []string
+	for _, a := range addrs {
+		h := HostKey(a)
+		if h == "" {
+			continue
+		}
+		if _, ok := seen[h]; ok {
+			continue
+		}
+		seen[h] = struct{}{}
+		out = append(out, h)
+	}
+	return out
+}
+
+// AddressIsLocal reports whether addr's host is this process's machine
+// (loopback or a configured interface address). Used so an EC worker prefers
+// a replica on the same box after replica sync.
+func AddressIsLocal(addr string) bool {
+	host := HostKey(addr)
+	if host == "" {
+		return false
+	}
+	if host == "localhost" || host == "127.0.0.1" || host == "::1" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	if ip != nil && ip.IsLoopback() {
+		return true
+	}
+	ifaces, err := net.InterfaceAddrs()
+	if err != nil {
+		return false
+	}
+	for _, ia := range ifaces {
+		var got net.IP
+		switch v := ia.(type) {
+		case *net.IPNet:
+			got = v.IP
+		case *net.IPAddr:
+			got = v.IP
+		}
+		if got == nil {
+			continue
+		}
+		if strings.EqualFold(got.String(), host) {
+			return true
+		}
+		if ip != nil && got.Equal(ip) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/weed/util/net_host_test.go b/weed/util/net_host_test.go
new file mode 100644
index 0000000000..7caf30f056
--- /dev/null
+++ b/weed/util/net_host_test.go
@@ -0,0 +1,24 @@
+package util
+
+import "testing"
+
+func TestHostKeyStripsPort(t *testing.T) {
+	t.Parallel()
+	if got := HostKey("10.87.0.3:8080"); got != "10.87.0.3" {
+		t.Fatalf("HostKey replica: got %q", got)
+	}
+	if got := HostKey("10.87.0.3:33646"); got != "10.87.0.3" {
+		t.Fatalf("HostKey worker: got %q", got)
+	}
+	if HostKey("10.87.0.3:8080") != HostKey("10.87.0.3:33646") {
+		t.Fatal("worker and volume server on the same IP must share a HostKey")
+	}
+}
+
+func TestHostKeysFromAddressesDedups(t *testing.T) {
+	t.Parallel()
+	got := HostKeysFromAddresses([]string{"10.0.0.1:8080", "10.0.0.1:8081", "10.0.0.2:8080", ""})
+	if len(got) != 2 || got[0] != "10.0.0.1" || got[1] != "10.0.0.2" {
+		t.Fatalf("got %v", got)
+	}
+}
diff --git a/weed/util/retry.go b/weed/util/retry.go
index 3cee2ce1e0..6f77be9115 100644
--- a/weed/util/retry.go
+++ b/weed/util/retry.go
@@ -10,10 +10,18 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 var RetryWaitTime = 6 * time.Second
 
+// ErrLockContended marks a lock acquisition abandoned instead of waited on —
+// the caller already holds other locks and cannot queue without inverting
+// their order. The holder's write settles the contested state, so callers
+// treat it as transient and retry.
+var ErrLockContended = errors.New("a local write holds the entry lock")
+
 // transientErrorMessages are substrings of failures that a later attempt is
 // likely to get past: connection resets, timeouts, and the throttling or
 // overload replies S3 and gRPC hand back. Cloud SDKs bury the underlying net
@@ -37,6 +45,9 @@ var transientErrorMessages = []string{
 	"requesttimeout",
 	"slowdown",
 	"throttling",
+	"ratelimitexceeded",
+	"rate limit",
+	"too many requests",
 	"internalerror",
 	"resourceexhausted",
 	"unavailable",
@@ -56,6 +67,20 @@ func IsTransientErrorMessage(msg string) bool {
 	return false
 }
 
+// ServerStatus returns the status a gRPC server sent, when the error chain
+// still carries one. Unlike status.FromError it keeps the server's own message
+// instead of the whole wrapped string: callers routinely format a path the
+// client chose into their wrapper, so a classifier that matches substrings has
+// to read what the server said and not what the caller added around it.
+func ServerStatus(err error) (*status.Status, bool) {
+	var carrier interface{ GRPCStatus() *status.Status }
+	if !errors.As(err, &carrier) {
+		return nil, false
+	}
+	st := carrier.GRPCStatus()
+	return st, st != nil
+}
+
 // IsTransientError reports whether err is a network or service condition worth
 // retrying. A cancelled or expired context never is: the caller is already gone.
 func IsTransientError(err error) bool {
@@ -65,6 +90,9 @@ func IsTransientError(err error) bool {
 	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
 		return false
 	}
+	if errors.Is(err, ErrLockContended) {
+		return true
+	}
 	if errors.Is(err, io.ErrUnexpectedEOF) ||
 		errors.Is(err, syscall.ECONNRESET) || errors.Is(err, syscall.ECONNABORTED) ||
 		errors.Is(err, syscall.ECONNREFUSED) || errors.Is(err, syscall.EPIPE) ||
@@ -75,6 +103,13 @@ func IsTransientError(err error) bool {
 	if errors.As(err, &netErr) && netErr.Timeout() {
 		return true
 	}
+	if st, ok := ServerStatus(err); ok {
+		if st.Code() == codes.Canceled {
+			return strings.Contains(st.Message(), "the client connection is closing")
+		}
+		return st.Code() == codes.Unavailable || st.Code() == codes.ResourceExhausted ||
+			IsTransientErrorMessage(st.Message())
+	}
 	return IsTransientErrorMessage(err.Error())
 }
 
diff --git a/weed/util/retry_test.go b/weed/util/retry_test.go
index f96cd82369..64db256c52 100644
--- a/weed/util/retry_test.go
+++ b/weed/util/retry_test.go
@@ -9,6 +9,9 @@ import (
 	"syscall"
 	"testing"
 	"time"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 )
 
 func TestIsTransientError(t *testing.T) {
@@ -22,6 +25,10 @@ func TestIsTransientError(t *testing.T) {
 		fmt.Errorf("send: %w", syscall.ETIMEDOUT),
 		&net.DNSError{Err: "operation timed out", IsTimeout: true},
 		io.ErrUnexpectedEOF,
+		// transport teardown the peer reports as Canceled, not the caller's
+		// own context cancel; also reachable through a caller's %w wrap
+		status.Error(codes.Canceled, "grpc: the client connection is closing"),
+		fmt.Errorf("create entry /x: %w", status.Error(codes.Canceled, "grpc: the client connection is closing")),
 	}
 	for _, err := range transient {
 		if !IsTransientError(err) {
@@ -34,6 +41,8 @@ func TestIsTransientError(t *testing.T) {
 		errors.New("AccessDenied: Access Denied"),
 		errors.New("NoSuchBucket: The specified bucket does not exist"),
 		context.Canceled,
+		status.Error(codes.Canceled, context.Canceled.Error()),
+		fmt.Errorf("send: %w", status.Error(codes.Canceled, context.Canceled.Error())),
 		fmt.Errorf("write: %w", context.DeadlineExceeded),
 	}
 	for _, err := range permanent {
@@ -43,6 +52,35 @@ func TestIsTransientError(t *testing.T) {
 	}
 }
 
+// A caller that formats a path into its wrapper must not be able to hand the
+// substring matcher a word the client chose: once the chain carries the status
+// the server sent, that status is what gets classified.
+func TestIsTransientErrorPrefersServerStatus(t *testing.T) {
+	transient := []error{
+		fmt.Errorf("list %s: %w", "/buckets/b/logs", status.Error(codes.Unavailable, "filer is restarting")),
+		fmt.Errorf("list %s: %w", "/buckets/b/filer: no entry is found in filer store", status.Error(codes.Unavailable, "filer is restarting")),
+		status.Error(codes.ResourceExhausted, "too many requests"),
+		// the server's own text still counts when the code does not name the condition
+		status.Error(codes.Internal, "connection reset by peer"),
+	}
+	for _, err := range transient {
+		if !IsTransientError(err) {
+			t.Errorf("expected transient: %v", err)
+		}
+	}
+
+	permanent := []error{
+		fmt.Errorf("list %s: %w", "/buckets/transport/unavailable", status.Error(codes.PermissionDenied, "not allowed")),
+		fmt.Errorf("all filers failed, last error: %w",
+			fmt.Errorf("list %s: %w", "/buckets/slowdown/throttling", status.Error(codes.InvalidArgument, "bad prefix"))),
+	}
+	for _, err := range permanent {
+		if IsTransientError(err) {
+			t.Errorf("expected permanent: %v", err)
+		}
+	}
+}
+
 func TestIsTransientErrorMessage(t *testing.T) {
 	transient := []string{
 		"read tcp 10.0.0.1:8082->10.0.0.1:54848: i/o timeout",
@@ -51,6 +89,10 @@ func TestIsTransientErrorMessage(t *testing.T) {
 		"Connection reset by peer",
 		"dial tcp 10.0.0.1:8888: connect: no route to host",
 		"rpc error: code = Unavailable desc = the connection is unavailable",
+		// GCS per-object mutation limit on a hot file; the next attempt after a
+		// one-second backoff is under it
+		"googleapi: Error 429: The object bucket/samples.json exceeded the rate limit for object mutation operations (create, update, and delete). Please reduce your request rate. See https://cloud.google.com/storage/docs/gcs429., rateLimitExceeded",
+		"429 Too Many Requests",
 	}
 	for _, msg := range transient {
 		if !IsTransientErrorMessage(msg) {
diff --git a/weed/util/skiplist/skiplist_test.go b/weed/util/skiplist/skiplist_test.go
index b4c6405f8b..d8830b875b 100644
--- a/weed/util/skiplist/skiplist_test.go
+++ b/weed/util/skiplist/skiplist_test.go
@@ -295,10 +295,9 @@ func TestFindGreaterOrEqual(t *testing.T) {
 			}
 		} else {
 			lastNode, _ := list.GetLargestNode()
-			lastV := lastNode.GetValue()
-			// It is OK, to fail, as long as f is bigger than the last element.
-			if bytes.Compare(key, lastV) <= 0 {
-				t.Errorf("lastV: %s\n    key: %s\n\n", string(lastV), string(key))
+			// It is OK, to fail, as long as the key is bigger than the largest key.
+			if bytes.Compare(key, lastNode.Key) <= 0 {
+				t.Errorf("largest key: %s\n    key: %s\n\n", string(lastNode.Key), string(key))
 			}
 		}
 	}
diff --git a/weed/util/slice.go b/weed/util/slice.go
index 6b60beec58..978992c713 100644
--- a/weed/util/slice.go
+++ b/weed/util/slice.go
@@ -14,3 +14,23 @@ func DrainChannel[T any](ch chan T, first T) []T {
 		}
 	}
 }
+
+// ReorderToFront returns a new slice with every element present in frontMap
+// pulled to the front while keeping the relative order seen in inputSlice
+// within each partition. Items not in frontMap keep their relative order
+// behind the moved-up items. Useful for prioritizing a subset of candidates
+// (e.g. local replicas) without disturbing the shuffle order of the rest.
+func ReorderToFront[T comparable](frontMap map[T]bool, inputSlice []T) []T {
+	var prioritized []T
+	var remaining []T
+
+	for _, item := range inputSlice {
+		if frontMap[item] {
+			prioritized = append(prioritized, item)
+		} else {
+			remaining = append(remaining, item)
+		}
+	}
+
+	return append(prioritized, remaining...)
+}
diff --git a/weed/util/slice_test.go b/weed/util/slice_test.go
new file mode 100644
index 0000000000..d8338d809a
--- /dev/null
+++ b/weed/util/slice_test.go
@@ -0,0 +1,33 @@
+package util
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestReorderToFront_StringSlice(t *testing.T) {
+	localUrls := map[string]bool{
+		"http://local1": true,
+		"http://local2": true,
+	}
+
+	sameDcTargetUrls := []string{
+		"http://remote1",
+		"http://local1",
+		"http://remote2",
+		"http://local2",
+	}
+
+	expected := []string{
+		"http://local1",
+		"http://local2",
+		"http://remote1",
+		"http://remote2",
+	}
+
+	result := ReorderToFront(localUrls, sameDcTargetUrls)
+
+	if !reflect.DeepEqual(result, expected) {
+		t.Errorf("ReorderToFront failed for strings. Got: %v, Expected: %v", result, expected)
+	}
+}
diff --git a/weed/util/version/constants.go b/weed/util/version/constants.go
index f0d93b3e52..852d163e40 100644
--- a/weed/util/version/constants.go
+++ b/weed/util/version/constants.go
@@ -9,7 +9,7 @@ import (
 
 var (
 	MAJOR_VERSION  = int32(4)
-	MINOR_VERSION  = int32(41)
+	MINOR_VERSION  = int32(49)
 	VERSION_NUMBER = fmt.Sprintf("%d.%02d", MAJOR_VERSION, MINOR_VERSION)
 	VERSION        = util.SizeLimit + " " + VERSION_NUMBER
 	COMMIT         = ""
diff --git a/weed/util/volume_size.go b/weed/util/volume_size.go
new file mode 100644
index 0000000000..9ae050c078
--- /dev/null
+++ b/weed/util/volume_size.go
@@ -0,0 +1,11 @@
+package util
+
+const (
+	// DefaultVolumeSizeLimitMB is 30 GiB expressed in the MiB units used by
+	// volumeSizeLimitMB. This also aligns the default volume size with three
+	// complete 10 GiB erasure-coding data rows.
+	DefaultVolumeSizeLimitMB = 30 * KiByte
+	// MaxVolumeSizeLimitMB expresses VolumeSizeLimitGB in MiB: 30 GiB for
+	// 4-byte offsets and 8,000 GiB for 5-byte offsets.
+	MaxVolumeSizeLimitMB = VolumeSizeLimitGB * KiByte
+)
diff --git a/weed/util/wildcard/collection_filter.go b/weed/util/wildcard/collection_filter.go
new file mode 100644
index 0000000000..ad64346663
--- /dev/null
+++ b/weed/util/wildcard/collection_filter.go
@@ -0,0 +1,287 @@
+package wildcard
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// CollectionFilterMode controls how collections are interpreted during
+// detection. The two recognized sentinels short-circuit matching:
+//   - CollectionFilterAll: pool every collection together (default).
+//   - CollectionFilterEach: run detection separately per collection.
+//
+// Any other non-empty value is a comma-separated list of collection patterns.
+type CollectionFilterMode string
+
+const (
+	CollectionFilterAll  CollectionFilterMode = "ALL_COLLECTIONS"
+	CollectionFilterEach CollectionFilterMode = "EACH_COLLECTION"
+
+	// CollectionDefault is the entry that matches the empty-named collection.
+	// "_default" avoids colliding with a collection literally named "default".
+	CollectionDefault = "_default"
+)
+
+// regexMetaCharacters mark a filter entry as a regex; "*" and "?" stay wildcards.
+// "." is not one of them: a collection named "my.bucket" is a name, not a
+// pattern that would also match "my-bucket". A "." only counts as regex syntax
+// when it is quantified, as in "bucket.*".
+const regexMetaCharacters = `^$+()[]{}|\`
+
+// CollectionMatcher matches a volume collection against a collection_filter value.
+type CollectionMatcher struct {
+	filter     string
+	matchEmpty bool
+	literals   []string
+	wildcards  []string
+	regexes    []*regexp.Regexp
+}
+
+// CompileCollectionMatcher parses a collection_filter into a matcher. A nil
+// matcher accepts every collection: that is the empty filter, "*", and both
+// mode sentinels. Any other value is a comma-separated list, and a collection
+// passes when one entry matches it. An entry is a name, optionally with "*" and
+// "?" wildcards, CollectionDefault for the empty-named collection, or a regex
+// when it carries regex syntax. A regex entry must match the whole name unless
+// it anchors itself with "^" or "$", and always matches its own spelling too,
+// so a collection named "logs(2024)" stays reachable by name.
+func CompileCollectionMatcher(filter string) (*CollectionMatcher, error) {
+	trimmed := strings.TrimSpace(filter)
+	mode := CollectionFilterMode(trimmed)
+	if trimmed == "" || trimmed == "*" || mode == CollectionFilterAll || mode == CollectionFilterEach {
+		return nil, nil
+	}
+
+	matcher := &CollectionMatcher{filter: trimmed}
+	for _, entry := range splitCollectionEntries(trimmed) {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		if entry == CollectionDefault {
+			matcher.matchEmpty = true
+			continue
+		}
+		if !isRegexEntry(entry) {
+			matcher.wildcards = append(matcher.wildcards, entry)
+			continue
+		}
+		pattern := entry
+		if !strings.ContainsAny(entry, "^$") {
+			pattern = "^(?:" + entry + ")$"
+		}
+		compiled, err := regexp.Compile(pattern)
+		if err != nil {
+			return nil, fmt.Errorf("invalid collection_filter entry %q: %w", entry, err)
+		}
+		matcher.literals = append(matcher.literals, entry)
+		matcher.regexes = append(matcher.regexes, compiled)
+	}
+
+	if !matcher.matchEmpty && len(matcher.wildcards) == 0 && len(matcher.regexes) == 0 {
+		// Only a genuinely empty filter means "every collection". A value like ","
+		// is a typo, and matching everything on it would encode or delete far more
+		// than the operator asked for.
+		return nil, fmt.Errorf("collection_filter %q has no collection names", trimmed)
+	}
+	return matcher, nil
+}
+
+// splitCollectionEntries splits a filter on the commas that separate entries.
+// A comma inside a closed regex construct - a character class, a repetition
+// count, or a group - belongs to that construct. An unclosed one is a literal
+// brace or bracket in a name, so the commas after it still separate entries.
+func splitCollectionEntries(filter string) []string {
+	entries := make([]string, 0, 4)
+	start := 0
+	for i := 0; i < len(filter); i++ {
+		switch filter[i] {
+		case '\\':
+			i++
+		case '[':
+			if end := classEnd(filter, i); end > i {
+				i = end
+			}
+		case '{':
+			if end := repeatCountEnd(filter, i); end > i {
+				i = end
+			}
+		case '(':
+			if end := groupEnd(filter, i); end > i {
+				i = end
+			}
+		case ',':
+			entries = append(entries, filter[start:i])
+			start = i + 1
+		}
+	}
+	return append(entries, filter[start:])
+}
+
+// classEnd returns the index of the "]" closing the character class opened at
+// start, or -1 when it is never closed. It follows the regexp parser: a "]"
+// leading the class is a member of it, and a POSIX class such as "[:alpha:]"
+// carries a "]" of its own.
+func classEnd(filter string, start int) int {
+	i := start + 1
+	if i < len(filter) && filter[i] == '^' {
+		i++
+	}
+	if i < len(filter) && filter[i] == ']' {
+		i++
+	}
+	for ; i < len(filter); i++ {
+		switch filter[i] {
+		case '\\':
+			i++
+		case '[':
+			if end := posixClassEnd(filter, i); end > i {
+				i = end
+			}
+		case ']':
+			return i
+		}
+	}
+	return -1
+}
+
+// posixClassEnd returns the index of the "]" closing the POSIX class opened at
+// start, or -1 when start does not open one.
+func posixClassEnd(filter string, start int) int {
+	if !strings.HasPrefix(filter[start:], "[:") {
+		return -1
+	}
+	end := strings.Index(filter[start+2:], ":]")
+	if end < 0 {
+		return -1
+	}
+	return start + 2 + end + 1
+}
+
+// repeatCountEnd returns the index of the "}" closing the repetition count
+// opened at start, or -1 when what follows is not a count.
+func repeatCountEnd(filter string, start int) int {
+	for i := start + 1; i < len(filter); i++ {
+		if filter[i] == '}' {
+			return i
+		}
+		if filter[i] != ',' && (filter[i] < '0' || filter[i] > '9') {
+			return -1
+		}
+	}
+	return -1
+}
+
+// groupEnd returns the index of the ")" closing the group opened at start, or
+// -1 when it is never closed.
+func groupEnd(filter string, start int) int {
+	depth := 0
+	for i := start; i < len(filter); i++ {
+		switch filter[i] {
+		case '\\':
+			i++
+		case '[':
+			// a ")" inside a character class is a literal, not the group's end
+			if end := classEnd(filter, i); end > i {
+				i = end
+			}
+		case '(':
+			depth++
+		case ')':
+			if depth--; depth == 0 {
+				return i
+			}
+		}
+	}
+	return -1
+}
+
+// isRegexEntry reports whether an entry carries regex syntax rather than being a
+// plain collection name with optional "*" and "?" wildcards.
+func isRegexEntry(entry string) bool {
+	if strings.ContainsAny(entry, regexMetaCharacters) {
+		return true
+	}
+	for i := 0; i+1 < len(entry); i++ {
+		if entry[i] == '.' && (entry[i+1] == '*' || entry[i+1] == '?') {
+			return true
+		}
+	}
+	return false
+}
+
+// ExpandCollectionFilter resolves a collection_filter into concrete names
+// drawn from candidates — the same names CompileCollectionMatcher would
+// match — with one difference: a literal entry (no wildcard or regex syntax)
+// is returned even when absent from candidates, since a command may target a
+// collection the listing does not contain yet. CollectionDefault resolves to
+// the empty-named collection. Empty, "*", and the mode sentinels return all
+// candidates.
+func ExpandCollectionFilter(filter string, candidates []string) ([]string, error) {
+	trimmed := strings.TrimSpace(filter)
+	mode := CollectionFilterMode(trimmed)
+	if trimmed == "" || trimmed == "*" || mode == CollectionFilterAll || mode == CollectionFilterEach {
+		return candidates, nil
+	}
+	matcher, err := CompileCollectionMatcher(trimmed)
+	if err != nil {
+		return nil, err
+	}
+	seen := make(map[string]bool, len(candidates))
+	var out []string
+	add := func(name string) {
+		if !seen[name] {
+			seen[name] = true
+			out = append(out, name)
+		}
+	}
+	for _, entry := range splitCollectionEntries(trimmed) {
+		entry = strings.TrimSpace(entry)
+		if entry == CollectionDefault {
+			add("")
+		} else if !isRegexEntry(entry) && !strings.ContainsAny(entry, "*?") {
+			add(entry)
+		}
+	}
+	for _, name := range candidates {
+		if matcher.Matches(name) {
+			add(name)
+		}
+	}
+	return out, nil
+}
+
+// Matches reports whether a collection passes the filter. A nil matcher accepts everything.
+func (m *CollectionMatcher) Matches(collection string) bool {
+	if m == nil {
+		return true
+	}
+	if m.matchEmpty && collection == "" {
+		return true
+	}
+	for _, literal := range m.literals {
+		if literal == collection {
+			return true
+		}
+	}
+	for _, pattern := range m.wildcards {
+		if MatchesWildcard(pattern, collection) {
+			return true
+		}
+	}
+	for _, re := range m.regexes {
+		if re.MatchString(collection) {
+			return true
+		}
+	}
+	return false
+}
+
+// String returns the filter this matcher was compiled from.
+func (m *CollectionMatcher) String() string {
+	if m == nil {
+		return ""
+	}
+	return m.filter
+}
diff --git a/weed/util/wildcard/collection_filter_test.go b/weed/util/wildcard/collection_filter_test.go
new file mode 100644
index 0000000000..d76cb41d97
--- /dev/null
+++ b/weed/util/wildcard/collection_filter_test.go
@@ -0,0 +1,110 @@
+package wildcard
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestCompileCollectionMatcher(t *testing.T) {
+	cases := []struct {
+		filter  string
+		matches []string
+		misses  []string
+	}{
+		{filter: "", matches: []string{"", "photos"}},
+		{filter: "*", matches: []string{"", "photos"}},
+		{filter: string(CollectionFilterAll), matches: []string{"", "photos"}},
+		{filter: string(CollectionFilterEach), matches: []string{"", "photos"}},
+		{filter: "photos", matches: []string{"photos"}, misses: []string{"", "photos-backup", "myphotos"}},
+		{filter: "collection-a,collection-b", matches: []string{"collection-a", "collection-b"}, misses: []string{"collection-c"}},
+		{filter: " collection-a , collection-b ,", matches: []string{"collection-a", "collection-b"}, misses: []string{"collection-c"}},
+		{filter: "photos*,videos", matches: []string{"photos", "photos-backup", "videos"}, misses: []string{"clips"}},
+		{filter: "photo?", matches: []string{"photos"}, misses: []string{"photo", "photos-backup"}},
+		// A regex entry matches the whole name unless it anchors itself.
+		{filter: "photos|videos", matches: []string{"photos", "videos"}, misses: []string{"photos-backup"}},
+		{filter: "^photos", matches: []string{"photos", "photos-backup"}, misses: []string{"videos"}},
+		{filter: "photos-.*,videos", matches: []string{"photos-backup", "videos"}, misses: []string{"photos"}},
+		// A dot is part of a collection name unless it is quantified.
+		{filter: "my.bucket", matches: []string{"my.bucket"}, misses: []string{"my-bucket", "myxbucket"}},
+		{filter: "my.bucket,videos", matches: []string{"my.bucket", "videos"}, misses: []string{"my-bucket"}},
+		// A name made of regex syntax is still reachable by its own spelling.
+		{filter: "logs(2024)", matches: []string{"logs(2024)", "logs2024"}, misses: []string{"logs"}},
+		// Escaping reaches a name whose regex syntax does not parse on its own.
+		{filter: `logs\(2024`, matches: []string{"logs(2024"}, misses: []string{"logs2024", "logs"}},
+		// A comma inside a character class or a repetition count is not a separator.
+		{filter: "bucket[0-9]{1,3}", matches: []string{"bucket1", "bucket123"}, misses: []string{"bucket", "bucketx", "bucket1234"}},
+		{filter: "[a,b]", matches: []string{"a", "b", ","}, misses: []string{"ab", "c"}},
+		{filter: "bucket[0-9]{1,3},videos", matches: []string{"bucket7", "videos"}, misses: []string{"bucketx"}},
+		{filter: "bucket(foo,bar)", matches: []string{"bucketfoo,bar", "bucket(foo,bar)"}, misses: []string{"bucketfoo"}},
+		{filter: "logs(2024),videos", matches: []string{"logs(2024)", "logs2024", "videos"}, misses: []string{"logs"}},
+		{filter: "(a[)],b)", matches: []string{"a),b"}, misses: []string{"a", "b"}},
+		{filter: "(a[]),],b)", matches: []string{"a],b", "a),b"}, misses: []string{"a,b"}},
+		{filter: "x[[:alpha:],b]y", matches: []string{"xay", "xby", "x,y"}, misses: []string{"xy"}},
+		// A comma separates entries unless it is escaped, so a name holding one is
+		// reachable as "\(a\,b\)".
+		{filter: `\(a\,b\)`, matches: []string{"(a,b)"}, misses: []string{"(a", "b)"}},
+		// An unclosed brace is a literal in a name, so the comma after it still separates.
+		{filter: "foo{bar,videos", matches: []string{"foo{bar", "videos"}, misses: []string{"foo"}},
+		{filter: "foo{2,videos", matches: []string{"foo{2", "videos"}, misses: []string{"foo"}},
+		{filter: CollectionDefault, matches: []string{""}, misses: []string{"photos"}},
+		{filter: "photos," + CollectionDefault, matches: []string{"photos", ""}, misses: []string{"videos"}},
+	}
+
+	for _, c := range cases {
+		matcher, err := CompileCollectionMatcher(c.filter)
+		if err != nil {
+			t.Fatalf("CompileCollectionMatcher(%q): %v", c.filter, err)
+		}
+		for _, collection := range c.matches {
+			if !matcher.Matches(collection) {
+				t.Errorf("filter %q should match collection %q", c.filter, collection)
+			}
+		}
+		for _, collection := range c.misses {
+			if matcher.Matches(collection) {
+				t.Errorf("filter %q should not match collection %q", c.filter, collection)
+			}
+		}
+	}
+}
+
+func TestCompileCollectionMatcherInvalidEntry(t *testing.T) {
+	for _, filter := range []string{"photos,[invalid", ",", ", ,"} {
+		if _, err := CompileCollectionMatcher(filter); err == nil {
+			t.Errorf("filter %q should not compile", filter)
+		}
+	}
+}
+
+func TestExpandCollectionFilter(t *testing.T) {
+	listed := []string{"photos", "photos-backup", "videos"}
+	cases := []struct {
+		filter string
+		want   []string
+	}{
+		// Match-all forms return the candidates.
+		{"", listed},
+		{"*", listed},
+		{string(CollectionFilterEach), listed},
+		// A literal name passes through even when unlisted — the listing only
+		// covers collections with registered volumes.
+		{"photos", []string{"photos"}},
+		{"archived", []string{"archived"}},
+		{CollectionDefault, []string{""}},
+		{"photos," + CollectionDefault, []string{"photos", ""}},
+		// Patterns resolve only against listed names; a literal in the same
+		// list still passes through.
+		{"photos*", []string{"photos", "photos-backup"}},
+		{"photos*,archived", []string{"archived", "photos", "photos-backup"}},
+		{"^videos$", []string{"videos"}},
+	}
+	for _, c := range cases {
+		got, err := ExpandCollectionFilter(c.filter, listed)
+		if err != nil {
+			t.Fatalf("ExpandCollectionFilter(%q): %v", c.filter, err)
+		}
+		if !reflect.DeepEqual(got, c.want) {
+			t.Errorf("ExpandCollectionFilter(%q) = %v, want %v", c.filter, got, c.want)
+		}
+	}
+}
diff --git a/weed/util/wildcard/wildcard_matcher.go b/weed/util/wildcard/wildcard_matcher.go
index 0d74ffe6c4..5b2b85f6da 100644
--- a/weed/util/wildcard/wildcard_matcher.go
+++ b/weed/util/wildcard/wildcard_matcher.go
@@ -155,13 +155,15 @@ func matchWildcardString(pattern, str string) bool {
 
 	for targetIndex < len(str) {
 		switch {
-		case patternIndex < len(pattern) && (pattern[patternIndex] == '?' || pattern[patternIndex] == str[targetIndex]):
-			targetIndex++
-			patternIndex++
+		// '*' must be checked before literal equality so a '*' in the target
+		// cannot consume the pattern wildcard without a backtrack point
 		case patternIndex < len(pattern) && pattern[patternIndex] == '*':
 			lastStarIndex = patternIndex
 			lastStarMatchIndex = targetIndex
 			patternIndex++
+		case patternIndex < len(pattern) && (pattern[patternIndex] == '?' || pattern[patternIndex] == str[targetIndex]):
+			targetIndex++
+			patternIndex++
 		case lastStarIndex != -1:
 			patternIndex = lastStarIndex + 1
 			lastStarMatchIndex++
diff --git a/weed/util/wildcard/wildcard_matcher_test.go b/weed/util/wildcard/wildcard_matcher_test.go
index 26f5f43a89..d318206a38 100644
--- a/weed/util/wildcard/wildcard_matcher_test.go
+++ b/weed/util/wildcard/wildcard_matcher_test.go
@@ -27,6 +27,12 @@ func TestMatchesWildcard(t *testing.T) {
 		{"Pattern with regex special chars", "test[abc]", "test[abc]", true},
 		{"Pattern with dots", "test.txt", "test.txt", true},
 		{"Pattern with dots and wildcard", "*.txt", "test.txt", true},
+		{"Star in target at pattern star offset", "a/*", "a/*b", true},
+		{"Star in target equals pattern", "a/*", "a/*", true},
+		{"Star in target past pattern star offset", "a/*", "a/x*y", true},
+		{"Question mark matches literal star", "a/?c", "a/*c", true},
+		{"Star in target is not a wildcard", "ab*", "a*b", false},
+		{"ARN pattern with star in key", "arn:aws:s3:::bucket/finance/*", "arn:aws:s3:::bucket/finance/*star.txt", true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
diff --git a/weed/wdclient/exclusive_locks/exclusive_locker.go b/weed/wdclient/exclusive_locks/exclusive_locker.go
index e45775165b..b1cd94f8ae 100644
--- a/weed/wdclient/exclusive_locks/exclusive_locker.go
+++ b/weed/wdclient/exclusive_locks/exclusive_locker.go
@@ -61,7 +61,7 @@ func (l *ExclusiveLocker) RequestLock(clientName string) {
 
 	// retry to get the lease
 	for {
-		if err := l.masterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+		if err := l.masterClient.WithClient(context.Background(), false, func(client master_pb.SeaweedClient) error {
 			attemptCtx, cancel := context.WithTimeout(context.Background(), rpcTimeout)
 			defer cancel()
 			resp, err := client.LeaseAdminToken(attemptCtx, &master_pb.LeaseAdminTokenRequest{
@@ -118,7 +118,7 @@ func (l *ExclusiveLocker) renewLease(ctx context.Context) error {
 	if !l.isLocked.Load() {
 		return nil
 	}
-	return l.masterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	return l.masterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
 		attemptCtx, cancel := context.WithTimeout(ctx, rpcTimeout)
 		defer cancel()
 		resp, err := client.LeaseAdminToken(attemptCtx, &master_pb.LeaseAdminTokenRequest{
@@ -152,7 +152,7 @@ func (l *ExclusiveLocker) ReleaseLock() {
 
 	// single unbounded attempt: a release cut short by a deadline leaves the
 	// lock held until it expires, turning a slow unlock into a ghost lock
-	l.masterClient.WithClient(false, func(client master_pb.SeaweedClient) error {
+	l.masterClient.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
 		client.ReleaseAdminToken(ctx, &master_pb.ReleaseAdminTokenRequest{
 			PreviousToken:    prevToken,
 			PreviousLockTime: prevLockTsNs,
diff --git a/weed/wdclient/filer_client.go b/weed/wdclient/filer_client.go
index 65237fb3c6..f41cfaa7fa 100644
--- a/weed/wdclient/filer_client.go
+++ b/weed/wdclient/filer_client.go
@@ -17,6 +17,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
@@ -42,9 +43,11 @@ type filerHealth struct {
 type FilerClient struct {
 	*vidMapClient
 	filerAddresses     []pb.ServerAddress
-	filerAddressesMu   sync.RWMutex   // Protects filerAddresses and filerHealth
-	filerIndex         int32          // atomic: current filer index for round-robin
-	filerHealth        []*filerHealth // health status per filer (same order as filerAddresses)
+	filerAddressesMu   sync.RWMutex                  // Protects filerAddresses and filerHealth
+	filerIndex         int32                         // atomic: current filer index for round-robin
+	filerHealth        []*filerHealth                // health status per filer (same order as filerAddresses)
+	peerUpdates        uint64                        // pushed filer updates applied; protected by filerAddressesMu
+	deferredLeaves     map[pb.ServerAddress]struct{} // leaves suppressed while the filer was the last known; protected by filerAddressesMu
 	grpcDialOption     grpc.DialOption
 	urlPreference      UrlPreference
 	grpcTimeout        time.Duration
@@ -335,8 +338,14 @@ func (fc *FilerClient) refreshFilerList() {
 		return
 	}
 
+	generation := fc.peerUpdateGeneration()
+
 	// Query master for filers in our group
-	updates := cluster.ListExistingPeerUpdates(currentMaster, fc.grpcDialOption, fc.filerGroup, cluster.FilerType)
+	updates, err := cluster.ListExistingPeerUpdates(context.Background(), currentMaster, fc.grpcDialOption, fc.filerGroup, cluster.FilerType)
+	if err != nil {
+		glog.V(1).Infof("FilerClient: failed to list filers in group '%s': %v", fc.filerGroup, err)
+		return
+	}
 
 	if len(updates) == 0 {
 		glog.V(2).Infof("FilerClient: no filers found in group '%s'", fc.filerGroup)
@@ -358,7 +367,26 @@ func (fc *FilerClient) refreshFilerList() {
 		return
 	}
 
-	fc.applyDiscoveredFilers(discoveredFilers)
+	fc.applyDiscoverySnapshot(discoveredFilers, generation)
+}
+
+func (fc *FilerClient) peerUpdateGeneration() uint64 {
+	fc.filerAddressesMu.RLock()
+	defer fc.filerAddressesMu.RUnlock()
+	return fc.peerUpdates
+}
+
+// applyDiscoverySnapshot drops a snapshot requested before a pushed update was
+// applied: the push is newer, and the next poll reconciles anything it missed.
+func (fc *FilerClient) applyDiscoverySnapshot(discoveredFilers map[pb.ServerAddress]struct{}, generation uint64) {
+	fc.filerAddressesMu.Lock()
+	defer fc.filerAddressesMu.Unlock()
+	if fc.peerUpdates != generation {
+		glog.V(1).Infof("FilerClient: discarding discovery snapshot for group '%s' superseded by pushed updates", fc.filerGroup)
+		return
+	}
+	fc.deferredLeaves = nil
+	fc.applyDiscoveredFilersLocked(discoveredFilers)
 }
 
 // applyDiscoveredFilers treats the master snapshot as authoritative: survivors
@@ -368,7 +396,72 @@ func (fc *FilerClient) refreshFilerList() {
 func (fc *FilerClient) applyDiscoveredFilers(discoveredFilers map[pb.ServerAddress]struct{}) {
 	fc.filerAddressesMu.Lock()
 	defer fc.filerAddressesMu.Unlock()
+	fc.applyDiscoveredFilersLocked(discoveredFilers)
+}
 
+// OnPeerUpdate applies a filer join/leave pushed by the master, so the list
+// tracks a rolling restart instead of waiting for the next discovery poll. A
+// leave that would empty the list is deferred until another filer exists to
+// take over: an empty list fails every request, while a stale one still
+// recovers through the poll.
+func (fc *FilerClient) OnPeerUpdate(update *master_pb.ClusterNodeUpdate, _ time.Time) {
+	if update.NodeType != cluster.FilerType || update.Address == "" {
+		return
+	}
+	addr := pb.ServerAddress(update.Address)
+
+	fc.filerAddressesMu.Lock()
+	defer fc.filerAddressesMu.Unlock()
+
+	filers := make(map[pb.ServerAddress]struct{}, len(fc.filerAddresses)+1)
+	for _, f := range fc.filerAddresses {
+		filers[f] = struct{}{}
+	}
+
+	changed := false
+	if update.IsAdd {
+		// A rejoin cancels its deferred leave; bumping the generation keeps an
+		// in-flight snapshot that lacks the rejoined filer from pruning it.
+		if _, ok := fc.deferredLeaves[addr]; ok {
+			delete(fc.deferredLeaves, addr)
+			changed = true
+		}
+		if _, ok := filers[addr]; !ok {
+			filers[addr] = struct{}{}
+			changed = true
+		}
+	} else {
+		if _, ok := filers[addr]; ok {
+			delete(filers, addr)
+			changed = true
+			if len(filers) == 0 {
+				filers[addr] = struct{}{}
+				if fc.deferredLeaves == nil {
+					fc.deferredLeaves = make(map[pb.ServerAddress]struct{})
+				}
+				fc.deferredLeaves[addr] = struct{}{}
+			}
+		}
+	}
+
+	// A deferred leave can be honored once another filer exists to take over.
+	for gone := range fc.deferredLeaves {
+		if _, ok := filers[gone]; ok && len(filers) <= 1 {
+			continue
+		}
+		delete(filers, gone)
+		delete(fc.deferredLeaves, gone)
+		changed = true
+	}
+
+	if !changed {
+		return
+	}
+	fc.peerUpdates++
+	fc.applyDiscoveredFilersLocked(filers)
+}
+
+func (fc *FilerClient) applyDiscoveredFilersLocked(discoveredFilers map[pb.ServerAddress]struct{}) {
 	existingFilers := make(map[pb.ServerAddress]struct{}, len(fc.filerAddresses))
 	for _, f := range fc.filerAddresses {
 		existingFilers[f] = struct{}{}
@@ -468,6 +561,7 @@ func (fc *FilerClient) GetLookupFileIdFunction() LookupFileIdFunctionType {
 
 		// Build URLs with publicUrl preference, and also prefer same DC
 		var sameDcUrls, otherDcUrls []string
+		localUrls := make(map[string]bool)
 		dataCenter := fc.GetDataCenter()
 		for _, loc := range locations {
 			url := loc.PublicUrl
@@ -475,6 +569,10 @@ func (fc *FilerClient) GetLookupFileIdFunction() LookupFileIdFunctionType {
 				url = loc.Url
 			}
 			httpUrl := "http://" + url + "/" + fileId
+			glog.V(4).Infof("lookup %s => %s, data in remote storage tier: %v", fileId, url, loc.DataInRemote)
+			if !loc.DataInRemote {
+				localUrls[httpUrl] = true
+			}
 			if dataCenter != "" && dataCenter == loc.DataCenter {
 				sameDcUrls = append(sameDcUrls, httpUrl)
 			} else {
@@ -484,7 +582,13 @@ func (fc *FilerClient) GetLookupFileIdFunction() LookupFileIdFunctionType {
 		// Shuffle to distribute load across volume servers
 		rand.Shuffle(len(sameDcUrls), func(i, j int) { sameDcUrls[i], sameDcUrls[j] = sameDcUrls[j], sameDcUrls[i] })
 		rand.Shuffle(len(otherDcUrls), func(i, j int) { otherDcUrls[i], otherDcUrls[j] = otherDcUrls[j], otherDcUrls[i] })
-		// Prefer same data center
+		// Local replicas go first inside each data center, but never ahead of
+		// the data-center preference itself. Mirrors
+		// vidMap.LookupVolumeServerUrl so all client lookup paths agree.
+		if len(localUrls) > 0 {
+			sameDcUrls = util.ReorderToFront(localUrls, sameDcUrls)
+			otherDcUrls = util.ReorderToFront(localUrls, otherDcUrls)
+		}
 		fullUrls = append(sameDcUrls, otherDcUrls...)
 		return fullUrls, nil
 	}
diff --git a/weed/wdclient/filer_client_test.go b/weed/wdclient/filer_client_test.go
index 1ab8b9a879..b7c589ecc7 100644
--- a/weed/wdclient/filer_client_test.go
+++ b/weed/wdclient/filer_client_test.go
@@ -3,8 +3,11 @@ package wdclient
 import (
 	"sync/atomic"
 	"testing"
+	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/cluster"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 )
 
 func newTestFilerClient(addrs ...pb.ServerAddress) *FilerClient {
@@ -100,3 +103,176 @@ func TestApplyDiscoveredFilersNoChangeIsNoop(t *testing.T) {
 		t.Errorf("no-op refresh should not reallocate health entries")
 	}
 }
+
+func filerUpdate(addr pb.ServerAddress, isAdd bool) *master_pb.ClusterNodeUpdate {
+	return &master_pb.ClusterNodeUpdate{NodeType: cluster.FilerType, Address: string(addr), IsAdd: isAdd}
+}
+
+// A rolling restart replaces every filer within one discovery interval; the
+// pushed updates must keep the list live without waiting for the next poll.
+func TestOnPeerUpdateTracksRollingReplacement(t *testing.T) {
+	old1 := pb.ServerAddress("10.0.0.1:8888")
+	old2 := pb.ServerAddress("10.0.0.2:8888")
+	new1 := pb.ServerAddress("10.0.1.1:8888")
+	new2 := pb.ServerAddress("10.0.1.2:8888")
+
+	fc := newTestFilerClient(old1, old2)
+
+	fc.OnPeerUpdate(filerUpdate(old1, false), time.Now())
+	fc.OnPeerUpdate(filerUpdate(new1, true), time.Now())
+	fc.OnPeerUpdate(filerUpdate(old2, false), time.Now())
+	fc.OnPeerUpdate(filerUpdate(new2, true), time.Now())
+
+	got := filerAddressList(fc)
+	if len(got) != 2 || got[0] != new1 || got[1] != new2 {
+		t.Fatalf("expected [%s %s], got %v", new1, new2, got)
+	}
+}
+
+func TestOnPeerUpdateKeepsLastFiler(t *testing.T) {
+	only := pb.ServerAddress("10.0.0.1:8888")
+	fc := newTestFilerClient(only)
+
+	fc.OnPeerUpdate(filerUpdate(only, false), time.Now())
+
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != only {
+		t.Fatalf("removing the last filer must keep it, got %v", got)
+	}
+}
+
+func TestOnPeerUpdateIgnoresOtherNodeTypes(t *testing.T) {
+	a := pb.ServerAddress("10.0.0.1:8888")
+	fc := newTestFilerClient(a)
+
+	fc.OnPeerUpdate(&master_pb.ClusterNodeUpdate{NodeType: cluster.S3Type, Address: "10.0.0.9:18333", IsAdd: true}, time.Now())
+
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != a {
+		t.Fatalf("non-filer update changed the list: %v", got)
+	}
+}
+
+func TestOnPeerUpdateDuplicateAddKeepsHealth(t *testing.T) {
+	a := pb.ServerAddress("10.0.0.1:8888")
+	fc := newTestFilerClient(a)
+	atomic.StoreInt32(&fc.filerHealth[0].failureCount, 2)
+
+	fc.OnPeerUpdate(filerUpdate(a, true), time.Now())
+
+	if len(fc.filerHealth) != 1 || atomic.LoadInt32(&fc.filerHealth[0].failureCount) != 2 {
+		t.Fatalf("re-announced filer lost its health state")
+	}
+}
+
+func TestDiscoverySnapshotTakenBeforePushIsDiscarded(t *testing.T) {
+	old := pb.ServerAddress("10.0.0.1:8888")
+	joined := pb.ServerAddress("10.0.1.1:8888")
+	fc := newTestFilerClient(old)
+
+	generation := fc.peerUpdateGeneration()
+	fc.OnPeerUpdate(filerUpdate(joined, true), time.Now())
+	fc.OnPeerUpdate(filerUpdate(old, false), time.Now())
+	fc.applyDiscoverySnapshot(map[pb.ServerAddress]struct{}{old: {}}, generation)
+
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != joined {
+		t.Fatalf("stale snapshot overwrote pushed membership: %v", got)
+	}
+}
+
+func TestDiscoverySnapshotWithoutInterveningPushIsApplied(t *testing.T) {
+	old := pb.ServerAddress("10.0.0.1:8888")
+	replacement := pb.ServerAddress("10.0.1.1:8888")
+	fc := newTestFilerClient(old)
+
+	fc.applyDiscoverySnapshot(map[pb.ServerAddress]struct{}{replacement: {}}, fc.peerUpdateGeneration())
+
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != replacement {
+		t.Fatalf("expected snapshot to replace list, got %v", got)
+	}
+}
+
+// A leave suppressed to keep the last filer is deferred, then honored as soon
+// as a replacement joins, so the departed address stops being a candidate.
+func TestOnPeerUpdateDeferredLeaveFlushesOnJoin(t *testing.T) {
+	old := pb.ServerAddress("10.0.0.1:8888")
+	joined := pb.ServerAddress("10.0.1.1:8888")
+	fc := newTestFilerClient(old)
+
+	fc.OnPeerUpdate(filerUpdate(old, false), time.Now())
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != old {
+		t.Fatalf("leave of the last filer must be deferred, got %v", got)
+	}
+	if len(fc.deferredLeaves) != 1 {
+		t.Fatalf("expected the leave to be deferred, got %v", fc.deferredLeaves)
+	}
+
+	fc.OnPeerUpdate(filerUpdate(joined, true), time.Now())
+
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != joined {
+		t.Fatalf("deferred leave should flush on join, got %v", got)
+	}
+	if len(fc.deferredLeaves) != 0 {
+		t.Fatalf("deferred leaves should be empty after flush, got %v", fc.deferredLeaves)
+	}
+}
+
+// A pushed add for an already-known filer changes nothing and must not bump
+// the generation that guards an in-flight discovery snapshot.
+func TestOnPeerUpdateNoopDoesNotDiscardSnapshot(t *testing.T) {
+	old := pb.ServerAddress("10.0.0.1:8888")
+	replacement := pb.ServerAddress("10.0.1.1:8888")
+	fc := newTestFilerClient(old)
+
+	generation := fc.peerUpdateGeneration()
+	fc.OnPeerUpdate(filerUpdate(old, true), time.Now())
+	fc.applyDiscoverySnapshot(map[pb.ServerAddress]struct{}{replacement: {}}, generation)
+
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != replacement {
+		t.Fatalf("no-op push should not discard the snapshot, got %v", got)
+	}
+}
+
+func TestOnPeerUpdateRejoinCancelsDeferredLeave(t *testing.T) {
+	restarted := pb.ServerAddress("10.0.0.1:8888")
+	joined := pb.ServerAddress("10.0.1.1:8888")
+	fc := newTestFilerClient(restarted)
+
+	fc.OnPeerUpdate(filerUpdate(restarted, false), time.Now())
+	fc.OnPeerUpdate(filerUpdate(restarted, true), time.Now())
+	fc.OnPeerUpdate(filerUpdate(joined, true), time.Now())
+
+	if got := filerAddressList(fc); len(got) != 2 || got[0] != restarted || got[1] != joined {
+		t.Fatalf("rejoined filer was dropped by its stale deferred leave: %v", got)
+	}
+}
+
+func TestDiscoverySnapshotClearsDeferredLeaves(t *testing.T) {
+	departed := pb.ServerAddress("10.0.0.1:8888")
+	replacement := pb.ServerAddress("10.0.1.1:8888")
+	fc := newTestFilerClient(departed)
+
+	fc.OnPeerUpdate(filerUpdate(departed, false), time.Now())
+	fc.applyDiscoverySnapshot(map[pb.ServerAddress]struct{}{replacement: {}}, fc.peerUpdateGeneration())
+	fc.OnPeerUpdate(filerUpdate(departed, true), time.Now())
+
+	if got := filerAddressList(fc); len(got) != 2 || got[0] != replacement || got[1] != departed {
+		t.Fatalf("rejoined filer was dropped by a deferred leave the poll should have cleared: %v", got)
+	}
+}
+
+// A poll that started after a deferred leave but before the filer rejoined can
+// return a snapshot lacking the rejoined filer; the rejoin must bump the
+// generation so that snapshot is discarded.
+func TestOnPeerUpdateRejoinBumpsGeneration(t *testing.T) {
+	old := pb.ServerAddress("10.0.0.1:8888")
+	other := pb.ServerAddress("10.0.1.1:8888")
+	fc := newTestFilerClient(old)
+
+	fc.OnPeerUpdate(filerUpdate(old, false), time.Now())
+	generation := fc.peerUpdateGeneration()
+	fc.OnPeerUpdate(filerUpdate(old, true), time.Now())
+	fc.applyDiscoverySnapshot(map[pb.ServerAddress]struct{}{other: {}}, generation)
+
+	if got := filerAddressList(fc); len(got) != 1 || got[0] != old {
+		t.Fatalf("rejoined filer was pruned by an in-flight snapshot: %v", got)
+	}
+}
diff --git a/weed/wdclient/masterclient.go b/weed/wdclient/masterclient.go
index b06dffad04..5e0e0134e2 100644
--- a/weed/wdclient/masterclient.go
+++ b/weed/wdclient/masterclient.go
@@ -105,10 +105,13 @@ func (p *masterVolumeProvider) LookupVolumeIds(ctx context.Context, volumeIds []
 					var locations []Location
 					for _, masterLoc := range vidLoc.Locations {
 						loc := Location{
-							Url:        masterLoc.Url,
-							PublicUrl:  masterLoc.PublicUrl,
-							GrpcPort:   int(masterLoc.GrpcPort),
-							DataCenter: masterLoc.DataCenter,
+							Url:               masterLoc.Url,
+							PublicUrl:         masterLoc.PublicUrl,
+							GrpcPort:          int(masterLoc.GrpcPort),
+							DataCenter:        masterLoc.DataCenter,
+							DataInRemote:      masterLoc.DataInRemote,
+							ReadOnly:          masterLoc.ReadOnly,
+							ReadOnlyCanDelete: masterLoc.ReadOnlyCanDelete,
 						}
 						// Update cache with the location
 						p.masterClient.addLocation(uint32(vid), loc)
@@ -142,19 +145,81 @@ func (p *masterVolumeProvider) LookupVolumeIds(ctx context.Context, volumeIds []
 type MasterClient struct {
 	*vidMapClient // Embedded cache with shared logic
 
-	FilerGroup           string
-	clientType           string
-	clientHost           pb.ServerAddress
-	rack                 string
-	currentMaster        pb.ServerAddress
-	currentMasterLock    sync.RWMutex
-	masters              pb.ServerDiscovery
+	FilerGroup        string
+	clientType        string
+	clientHost        pb.ServerAddress
+	rack              string
+	currentMaster     pb.ServerAddress
+	lastServedMaster  pb.ServerAddress
+	currentMasterLock sync.RWMutex
+	masters           pb.ServerDiscovery
+	mastersLock       sync.Mutex
+	// refreshLock serializes SRV refreshes so an older lookup finishing
+	// second cannot overwrite a newer saved list.
+	refreshLock          sync.Mutex
 	grpcDialOption       grpc.DialOption
 	grpcTimeout          time.Duration // Timeout for gRPC calls to master
 	OnPeerUpdate         func(update *master_pb.ClusterNodeUpdate, startFrom time.Time)
 	OnPeerUpdateLock     sync.RWMutex
 	OnLockRingUpdate     func(update *master_pb.LockRingUpdate)
 	OnLockRingUpdateLock sync.RWMutex
+	OnMasterChange       func(previous, current pb.ServerAddress)
+	OnMasterChangeLock   sync.RWMutex
+
+	// streamLock publishes the stream only after its registration send, so a
+	// leave sent afterwards never races that send.
+	streamLock      sync.Mutex
+	stream          master_pb.Seaweed_KeepConnectedClient
+	leavingLockRing bool
+
+	// announceCh, when non-nil, gates the registration send that adds this
+	// client to the master's list, so a server can connect and query masters
+	// before it is ready to be routed to.
+	announceCh chan struct{}
+}
+
+// SetAnnounceCh sets a channel that must be closed before this client
+// registers itself on the master.
+func (mc *MasterClient) SetAnnounceCh(ch chan struct{}) {
+	mc.announceCh = ch
+}
+
+// ListMasters returns the configured master addresses without waiting for a
+// connection, for callers that run before KeepConnectedToMaster is connected.
+func (mc *MasterClient) ListMasters() []pb.ServerAddress {
+	mc.refreshMasters()
+	return mc.masterInstances()
+}
+
+// ListCachedMasters returns the most recently resolved master addresses
+// without a fresh SRV lookup, for callers on a deadline that cannot wait for
+// DNS.
+func (mc *MasterClient) ListCachedMasters() []pb.ServerAddress {
+	return mc.masterInstances()
+}
+
+// refreshMasters resolves the SRV record outside mastersLock so a slow DNS
+// lookup does not stall masterInstances readers; the lock only covers saving
+// the resolved list. refreshLock is held across lookup and save so
+// overlapping refreshes keep resolution order.
+func (mc *MasterClient) refreshMasters() {
+	mc.refreshLock.Lock()
+	defer mc.refreshLock.Unlock()
+	newList := mc.masters.LookupSrvInstances()
+	if newList == nil {
+		return
+	}
+	mc.mastersLock.Lock()
+	defer mc.mastersLock.Unlock()
+	mc.masters.SetInstances(newList)
+}
+
+// masterInstances returns a consistent copy of the configured masters,
+// serialized against SRV refreshes.
+func (mc *MasterClient) masterInstances() []pb.ServerAddress {
+	mc.mastersLock.Lock()
+	defer mc.mastersLock.Unlock()
+	return mc.masters.GetInstances()
 }
 
 func NewMasterClient(grpcDialOption grpc.DialOption, filerGroup string, clientType string, clientHost pb.ServerAddress, clientDataCenter string, rack string, masters pb.ServerDiscovery) *MasterClient {
@@ -189,11 +254,18 @@ func (mc *MasterClient) SetOnLockRingUpdateFn(fn func(update *master_pb.LockRing
 	mc.OnLockRingUpdateLock.Unlock()
 }
 
+func (mc *MasterClient) SetOnMasterChangeFn(fn func(previous, current pb.ServerAddress)) {
+	mc.OnMasterChangeLock.Lock()
+	mc.OnMasterChange = fn
+	mc.OnMasterChangeLock.Unlock()
+}
+
 func (mc *MasterClient) tryAllMasters(ctx context.Context) {
 	var nextHintedLeader pb.ServerAddress
 	failedMasters := make(map[pb.ServerAddress]struct{})
-	mc.masters.RefreshBySrvIfAvailable()
-	for _, master := range mc.masters.GetInstances() {
+	mc.refreshMasters()
+	masterAddrs := mc.masterInstances()
+	for _, master := range masterAddrs {
 		if _, failed := failedMasters[master]; failed {
 			continue
 		}
@@ -216,7 +288,12 @@ func (mc *MasterClient) tryAllMasters(ctx context.Context) {
 				}
 			}
 		}
-		mc.setCurrentMaster("")
+		// After a canceled disconnect the last master still answers unary
+		// queries (e.g. the metadata-log flush during filer shutdown), so
+		// only clear the serving address on an unintended disconnect.
+		if ctx.Err() == nil {
+			mc.setCurrentMaster("")
+		}
 	}
 }
 
@@ -236,18 +313,45 @@ func (mc *MasterClient) tryConnectToMaster(ctx context.Context, master pb.Server
 		}
 		glog.V(1).Infof("%s.%s masterClient gRPC stream established to %s in %v", mc.FilerGroup, mc.clientType, master, time.Since(connectStartTime))
 
-		if err = stream.Send(&master_pb.KeepConnectedRequest{
+		// The stream is usable for queries before registration, so callers
+		// blocked in GetMaster (e.g. loading a chunked filer.conf during
+		// startup) proceed while the announce gate still holds.
+		mc.setCurrentMaster(master)
+
+		if mc.announceCh != nil {
+			select {
+			case <-mc.announceCh:
+			case <-ctx.Done():
+				return ctx.Err()
+			}
+		}
+
+		mc.streamLock.Lock()
+		err = stream.Send(&master_pb.KeepConnectedRequest{
 			FilerGroup:    mc.FilerGroup,
 			DataCenter:    mc.GetDataCenter(),
 			Rack:          mc.rack,
 			ClientType:    mc.clientType,
 			ClientAddress: string(mc.clientHost),
 			Version:       version.Version(),
-		}); err != nil {
+			LeaveLockRing: mc.leavingLockRing,
+		})
+		if err == nil {
+			mc.stream = stream
+		}
+		mc.streamLock.Unlock()
+		if err != nil {
 			glog.V(0).Infof("%s.%s masterClient failed to send to %s: %v", mc.FilerGroup, mc.clientType, master, err)
 			stats.MasterClientConnectCounter.WithLabelValues(stats.FailedToSend).Inc()
 			return err
 		}
+		defer func() {
+			mc.streamLock.Lock()
+			if mc.stream == stream {
+				mc.stream = nil
+			}
+			mc.streamLock.Unlock()
+		}()
 		glog.V(1).Infof("%s.%s masterClient Connected to %v", mc.FilerGroup, mc.clientType, master)
 
 		resp, err := stream.Recv()
@@ -277,7 +381,14 @@ func (mc *MasterClient) tryConnectToMaster(ctx context.Context, master pb.Server
 			// Still need to reset cache to ensure we don't use stale data from previous master
 			mc.resetVidMap()
 		}
-		mc.setCurrentMaster(master)
+		if previous := mc.markServingMaster(master); previous != "" {
+			mc.OnMasterChangeLock.RLock()
+			if mc.OnMasterChange != nil {
+				glog.V(0).Infof("%s.%s masterClient master changed %s -> %s", mc.FilerGroup, mc.clientType, previous, master)
+				mc.OnMasterChange(previous, master)
+			}
+			mc.OnMasterChangeLock.RUnlock()
+		}
 
 		for {
 			resp, err := stream.Recv()
@@ -351,6 +462,19 @@ func (mc *MasterClient) tryConnectToMaster(ctx context.Context, master pb.Server
 	return nextHintedLeader
 }
 
+// LeaveLockRing asks the master to drop this client from the lock ring while it
+// stays connected, and keeps it out of the ring on any later reconnect.
+func (mc *MasterClient) LeaveLockRing() error {
+	mc.streamLock.Lock()
+	mc.leavingLockRing = true
+	stream := mc.stream
+	mc.streamLock.Unlock()
+	if stream == nil {
+		return nil
+	}
+	return stream.Send(&master_pb.KeepConnectedRequest{LeaveLockRing: true})
+}
+
 // addedVids indexes added ids that are also being removed. A volume moved
 // between a server's disks is reported both ways in one message, and the server
 // still has it -- acting on the removal would drop a good location, whichever
@@ -367,6 +491,12 @@ func addedVids(added, removed []uint32) map[uint32]struct{} {
 	return index
 }
 
+// updateVidMap applies a KeepConnectedResponse volume-location message to the
+// local vidMap. NewVids adds the entries; RemoteVids names the subset of them
+// backed by remote storage, which is added with DataInRemote so read paths can
+// prefer the cheap local replica. DeletedVids drops the named entry unless the
+// same message also added it back (volume moved between this server's disks).
+// EC vid changes go through the parallel addEcLocation / deleteEcLocation pair.
 func (mc *MasterClient) updateVidMap(resp *master_pb.KeepConnectedResponse) {
 	if resp.VolumeLocation.IsEmptyUrl() {
 		glog.V(0).Infof("updateVidMap ignore short heartbeat: %+v", resp)
@@ -380,9 +510,54 @@ func (mc *MasterClient) updateVidMap(resp *master_pb.KeepConnectedResponse) {
 		GrpcPort:   int(resp.VolumeLocation.GrpcPort),
 	}
 	stillOnServer := addedVids(resp.VolumeLocation.NewVids, resp.VolumeLocation.DeletedVids)
+	// RemoteVids repeats ids NewVids already carries, so the tier is settled
+	// before anything is written rather than adding each one twice.
+	var remoteVids map[uint32]struct{}
+	if len(resp.VolumeLocation.RemoteVids) > 0 {
+		remoteVids = make(map[uint32]struct{}, len(resp.VolumeLocation.RemoteVids))
+		for _, vid := range resp.VolumeLocation.RemoteVids {
+			remoteVids[vid] = struct{}{}
+		}
+	}
+	var readOnlyVids map[uint32]struct{}
+	if len(resp.VolumeLocation.ReadOnlyVids) > 0 {
+		readOnlyVids = make(map[uint32]struct{}, len(resp.VolumeLocation.ReadOnlyVids))
+		for _, vid := range resp.VolumeLocation.ReadOnlyVids {
+			readOnlyVids[vid] = struct{}{}
+		}
+	}
+	var readOnlyCanDeleteVids map[uint32]struct{}
+	if len(resp.VolumeLocation.ReadOnlyCanDeleteVids) > 0 {
+		readOnlyCanDeleteVids = make(map[uint32]struct{}, len(resp.VolumeLocation.ReadOnlyCanDeleteVids))
+		for _, vid := range resp.VolumeLocation.ReadOnlyCanDeleteVids {
+			readOnlyCanDeleteVids[vid] = struct{}{}
+		}
+	}
 	for _, newVid := range resp.VolumeLocation.NewVids {
-		glog.V(2).Infof("%s.%s: %s masterClient adds volume %d", mc.FilerGroup, mc.clientType, loc.Url, newVid)
-		mc.addLocation(newVid, loc)
+		if _, isRemote := remoteVids[newVid]; isRemote {
+			continue
+		}
+		newLoc := loc
+		if _, isReadOnly := readOnlyVids[newVid]; isReadOnly {
+			newLoc.ReadOnly = true
+		}
+		if _, canDelete := readOnlyCanDeleteVids[newVid]; canDelete {
+			newLoc.ReadOnlyCanDelete = true
+		}
+		glog.V(2).Infof("%s.%s: %s masterClient adds volume %d", mc.FilerGroup, mc.clientType, newLoc.Url, newVid)
+		mc.addLocation(newVid, newLoc)
+	}
+	for _, remoteVid := range resp.VolumeLocation.RemoteVids {
+		remoteLoc := loc
+		remoteLoc.DataInRemote = true
+		if _, isReadOnly := readOnlyVids[remoteVid]; isReadOnly {
+			remoteLoc.ReadOnly = true
+		}
+		if _, canDelete := readOnlyCanDeleteVids[remoteVid]; canDelete {
+			remoteLoc.ReadOnlyCanDelete = true
+		}
+		glog.V(2).Infof("%s.%s: %s masterClient adds remote volume %d", mc.FilerGroup, mc.clientType, remoteLoc.Url, remoteVid)
+		mc.addLocation(remoteVid, remoteLoc)
 	}
 	for _, deletedVid := range resp.VolumeLocation.DeletedVids {
 		if _, moved := stillOnServer[deletedVid]; moved {
@@ -403,22 +578,32 @@ func (mc *MasterClient) updateVidMap(resp *master_pb.KeepConnectedResponse) {
 		glog.V(2).Infof("%s.%s: %s masterClient removes ec volume %d", mc.FilerGroup, mc.clientType, loc.Url, deletedEcVid)
 		mc.deleteEcLocation(deletedEcVid, loc)
 	}
-	glog.V(1).Infof("updateVidMap(%s) %s.%s: %s volume add: %d, del: %d, add ec: %d del ec: %d",
+	glog.V(1).Infof("updateVidMap(%s) %s.%s: %s volume add local: %d, remote: %d, del: %d, add ec: %d del ec: %d",
 		resp.VolumeLocation.DataCenter, mc.FilerGroup, mc.clientType, loc.Url,
-		len(resp.VolumeLocation.NewVids), len(resp.VolumeLocation.DeletedVids),
-		len(resp.VolumeLocation.NewEcVids), len(resp.VolumeLocation.DeletedEcVids))
+		len(resp.VolumeLocation.NewVids)-len(resp.VolumeLocation.RemoteVids),
+		len(resp.VolumeLocation.RemoteVids),
+		len(resp.VolumeLocation.DeletedVids), len(resp.VolumeLocation.NewEcVids),
+		len(resp.VolumeLocation.DeletedEcVids))
 }
 
-func (mc *MasterClient) WithClient(streamingMode bool, fn func(client master_pb.SeaweedClient) error) error {
+func (mc *MasterClient) WithClient(ctx context.Context, streamingMode bool, fn func(client master_pb.SeaweedClient) error) error {
 	getMasterF := func() pb.ServerAddress {
-		return mc.GetMaster(context.Background())
+		return mc.GetMaster(ctx)
 	}
-	return mc.WithClientCustomGetMaster(getMasterF, streamingMode, fn)
+	return mc.WithClientCustomGetMaster(ctx, getMasterF, streamingMode, fn)
 }
 
-func (mc *MasterClient) WithClientCustomGetMaster(getMasterF func() pb.ServerAddress, streamingMode bool, fn func(client master_pb.SeaweedClient) error) error {
-	return util.Retry("master grpc", func() error {
-		return pb.WithMasterClient(context.Background(), streamingMode, getMasterF(), mc.grpcDialOption, false, func(client master_pb.SeaweedClient) error {
+// WithClientCustomGetMaster bounds the wait for a master leader by ctx, so a
+// caller with a deadline is not parked for the length of an election. The dial
+// still gets context.Background(): fn brings its own RPC context, so nothing
+// here can attribute a cancellation to the shared connection.
+func (mc *MasterClient) WithClientCustomGetMaster(ctx context.Context, getMasterF func() pb.ServerAddress, streamingMode bool, fn func(client master_pb.SeaweedClient) error) error {
+	return util.RetryWithBackoff(ctx, "master grpc", util.RetryWaitTime, util.IsTransientError, func() error {
+		master := getMasterF()
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		return pb.WithMasterClient(context.Background(), streamingMode, master, mc.grpcDialOption, false, func(client master_pb.SeaweedClient) error {
 			return fn(client)
 		})
 	})
@@ -436,6 +621,21 @@ func (mc *MasterClient) setCurrentMaster(master pb.ServerAddress) {
 	mc.currentMasterLock.Unlock()
 }
 
+// markServingMaster records the master now serving this client and returns
+// the previously served one when it differs. Unlike currentMaster,
+// lastServedMaster survives the disconnected gap between reconnect attempts,
+// so a leader change is still detected.
+func (mc *MasterClient) markServingMaster(master pb.ServerAddress) (previous pb.ServerAddress) {
+	mc.currentMasterLock.Lock()
+	defer mc.currentMasterLock.Unlock()
+	if mc.lastServedMaster != "" && !mc.lastServedMaster.Equals(master) {
+		previous = mc.lastServedMaster
+	}
+	mc.currentMaster = master
+	mc.lastServedMaster = master
+	return
+}
+
 // GetMaster returns the current master address, blocking until connected.
 //
 // IMPORTANT: This method blocks until KeepConnectedToMaster successfully establishes
@@ -460,14 +660,14 @@ func (mc *MasterClient) GetMaster(ctx context.Context) pb.ServerAddress {
 // See GetMaster() for important initialization contract details.
 func (mc *MasterClient) GetMasters(ctx context.Context) []pb.ServerAddress {
 	mc.WaitUntilConnected(ctx)
-	return mc.masters.GetInstances()
+	return mc.masterInstances()
 }
 
 // ListMasterSet returns a set of configured master addresses keyed by their
 // canonical http form. Unlike GetMasters this does not wait for a connection,
 // so it is safe to call from admission paths that must stay non-blocking.
 func (mc *MasterClient) ListMasterSet() map[string]struct{} {
-	addrs := mc.masters.GetInstances()
+	addrs := mc.masterInstances()
 	set := make(map[string]struct{}, len(addrs))
 	for _, a := range addrs {
 		set[a.ToHttpAddress()] = struct{}{}
@@ -531,7 +731,7 @@ func (mc *MasterClient) KeepConnectedToMaster(ctx context.Context) {
 }
 
 func (mc *MasterClient) FindLeaderFromOtherPeers(myMasterAddress pb.ServerAddress) (leader string) {
-	for _, master := range mc.masters.GetInstances() {
+	for _, master := range mc.masterInstances() {
 		if master == myMasterAddress {
 			continue
 		}
diff --git a/weed/wdclient/masterclient_announce_test.go b/weed/wdclient/masterclient_announce_test.go
new file mode 100644
index 0000000000..c467aaea81
--- /dev/null
+++ b/weed/wdclient/masterclient_announce_test.go
@@ -0,0 +1,64 @@
+package wdclient
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// A filer connects to the master before its gRPC port serves so it can query
+// masters during startup; the registration send that adds it to the master's
+// filer list must wait until it is actually serving.
+func TestAnnounceGateDelaysRegistration(t *testing.T) {
+	srv := &fakeKeepConnectedServer{requests: make(chan *master_pb.KeepConnectedRequest, 4)}
+	addr := startFakeMasterServer(t, srv)
+	mc := NewMasterClient(
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		"", "filer", "filer1:18888", "", "",
+		*pb.NewServiceDiscoveryFromMap(map[string]pb.ServerAddress{"m": addr}),
+	)
+	gate := make(chan struct{})
+	mc.SetAnnounceCh(gate)
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	go mc.KeepConnectedToMaster(ctx)
+
+	// WaitUntilConnected returns once the stream is established, before any
+	// registration: queries (e.g. loading a chunked filer.conf during
+	// startup) must not block behind the gate. Bound the wait so a
+	// regression fails fast instead of hanging the test run.
+	waitCtx, waitCancel := context.WithTimeout(ctx, 3*time.Second)
+	defer waitCancel()
+	mc.WaitUntilConnected(waitCtx)
+	if err := waitCtx.Err(); err != nil {
+		t.Fatalf("master stream not established within 3s: %v", err)
+	}
+	got := make(chan pb.ServerAddress, 1)
+	go func() { got <- mc.GetMaster(ctx) }()
+	select {
+	case m := <-got:
+		if m != addr {
+			t.Fatalf("GetMaster = %q, want %q", m, addr)
+		}
+	case <-time.After(3 * time.Second):
+		t.Fatal("GetMaster blocked behind the announce gate")
+	}
+
+	// Registration must not have been sent yet.
+	select {
+	case req := <-srv.requests:
+		t.Fatalf("client registered before the gate opened: %+v", req)
+	default:
+	}
+
+	close(gate)
+	req := nextRequest(t, srv.requests)
+	if req.ClientAddress != "filer1:18888" {
+		t.Fatalf("registration ClientAddress = %q, want filer1:18888", req.ClientAddress)
+	}
+}
diff --git a/weed/wdclient/masterclient_leave_test.go b/weed/wdclient/masterclient_leave_test.go
new file mode 100644
index 0000000000..18d5e47c93
--- /dev/null
+++ b/weed/wdclient/masterclient_leave_test.go
@@ -0,0 +1,108 @@
+package wdclient
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+type fakeKeepConnectedServer struct {
+	master_pb.UnimplementedSeaweedServer
+	requests chan *master_pb.KeepConnectedRequest
+	// closeAfterLeave ends the stream once a leave arrives, forcing a reconnect.
+	closeAfterLeave bool
+}
+
+func (s *fakeKeepConnectedServer) KeepConnected(stream master_pb.Seaweed_KeepConnectedServer) error {
+	if err := stream.Send(&master_pb.KeepConnectedResponse{VolumeLocation: &master_pb.VolumeLocation{}}); err != nil {
+		return err
+	}
+	for {
+		req, err := stream.Recv()
+		if err != nil {
+			return err
+		}
+		s.requests <- req
+		if req.LeaveLockRing && req.ClientType == "" {
+			if s.closeAfterLeave {
+				return nil
+			}
+			if err := stream.Send(&master_pb.KeepConnectedResponse{LockRingUpdate: &master_pb.LockRingUpdate{Servers: []string{"filer2:18888"}, Version: 2}}); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func nextRequest(t *testing.T, requests <-chan *master_pb.KeepConnectedRequest) *master_pb.KeepConnectedRequest {
+	t.Helper()
+	select {
+	case req := <-requests:
+		return req
+	case <-time.After(5 * time.Second):
+		t.Fatal("master received no KeepConnected message")
+		return nil
+	}
+}
+
+func startLeaveTestClient(t *testing.T, srv *fakeKeepConnectedServer, onLockRingUpdate func(*master_pb.LockRingUpdate)) *MasterClient {
+	t.Helper()
+	addr := startFakeMasterServer(t, srv)
+	mc := NewMasterClient(
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		"", "filer", "filer1:18888", "", "",
+		*pb.NewServiceDiscoveryFromMap(map[string]pb.ServerAddress{"m": addr}),
+	)
+	mc.SetOnLockRingUpdateFn(onLockRingUpdate)
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	go mc.KeepConnectedToMaster(ctx)
+	return mc
+}
+
+func TestLeaveLockRingIsSentOnTheOpenStream(t *testing.T) {
+	srv := &fakeKeepConnectedServer{requests: make(chan *master_pb.KeepConnectedRequest, 4)}
+	ringUpdates := make(chan *master_pb.LockRingUpdate, 1)
+	mc := startLeaveTestClient(t, srv, func(update *master_pb.LockRingUpdate) { ringUpdates <- update })
+
+	if first := nextRequest(t, srv.requests); first.LeaveLockRing {
+		t.Fatal("registration asked to leave the lock ring before LeaveLockRing")
+	}
+	if err := mc.LeaveLockRing(); err != nil {
+		t.Fatalf("LeaveLockRing: %v", err)
+	}
+	if leave := nextRequest(t, srv.requests); !leave.LeaveLockRing {
+		t.Fatalf("expected a leave message, got %+v", leave)
+	}
+	select {
+	case update := <-ringUpdates:
+		if update.Version != 2 {
+			t.Fatalf("unexpected ring update %+v", update)
+		}
+	case req := <-srv.requests:
+		t.Fatalf("leaving reconnected or re-registered: %+v", req)
+	case <-time.After(5 * time.Second):
+		t.Fatal("the stream stopped delivering ring updates after leaving")
+	}
+}
+
+func TestReconnectAfterLeaveStaysOutOfLockRing(t *testing.T) {
+	srv := &fakeKeepConnectedServer{requests: make(chan *master_pb.KeepConnectedRequest, 4), closeAfterLeave: true}
+	mc := startLeaveTestClient(t, srv, nil)
+
+	nextRequest(t, srv.requests)
+	if err := mc.LeaveLockRing(); err != nil {
+		t.Fatalf("LeaveLockRing: %v", err)
+	}
+	nextRequest(t, srv.requests)
+
+	reconnect := nextRequest(t, srv.requests)
+	if reconnect.ClientType != "filer" || !reconnect.LeaveLockRing {
+		t.Fatalf("reconnect registration must stay out of the lock ring, got %+v", reconnect)
+	}
+}
diff --git a/weed/wdclient/masterclient_move_test.go b/weed/wdclient/masterclient_move_test.go
index b5f70a2be2..9e77af4a13 100644
--- a/weed/wdclient/masterclient_move_test.go
+++ b/weed/wdclient/masterclient_move_test.go
@@ -39,6 +39,19 @@ func TestRemovedVolumeLosesItsLocation(t *testing.T) {
 	}
 }
 
+func TestReadOnlyVolumeUpdatesItsLocation(t *testing.T) {
+	mc := moveClient()
+	mc.updateVidMap(moveResponse([]uint32{1}, nil))
+	mc.updateVidMap(&master_pb.KeepConnectedResponse{VolumeLocation: &master_pb.VolumeLocation{
+		Url: "server:8080", PublicUrl: "server:8080", NewVids: []uint32{1}, ReadOnlyVids: []uint32{1},
+	}})
+
+	locations, found := mc.GetLocations(1)
+	if !found || len(locations) != 1 || !locations[0].ReadOnly {
+		t.Fatalf("read-only update = %v, want one read-only location", locations)
+	}
+}
+
 // Removals of other volumes in the same message must still apply.
 func TestRemovalsAlongsideAMoveStillApply(t *testing.T) {
 	mc := moveClient()
diff --git a/weed/wdclient/masterclient_test.go b/weed/wdclient/masterclient_test.go
index e19ce9e805..dc10f50e95 100644
--- a/weed/wdclient/masterclient_test.go
+++ b/weed/wdclient/masterclient_test.go
@@ -2,11 +2,14 @@ package wdclient
 
 import (
 	"context"
+	"errors"
 	"testing"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
 )
 
 // TestWaitUntilConnectedWithoutKeepConnected verifies that WaitUntilConnected
@@ -101,3 +104,105 @@ func TestMasterClientFilerGroupLogging(t *testing.T) {
 		t.Errorf("Expected clientType %s, got %s", clientType, mc.clientType)
 	}
 }
+
+// TestWithClientStopsWaitingOnCanceledContext verifies that WithClient hands the
+// caller's context to the wait for a master leader, so a caller that has already
+// given up is not parked until an election finishes.
+func TestWithClientStopsWaitingOnCanceledContext(t *testing.T) {
+	mc := NewMasterClient(grpc.EmptyDialOption{}, "test-group", "test-client", "", "", "", pb.ServerDiscovery{})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	called := false
+	start := time.Now()
+	err := mc.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+		called = true
+		return nil
+	})
+	elapsed := time.Since(start)
+
+	if !errors.Is(err, context.Canceled) {
+		t.Errorf("expected context.Canceled, got %v", err)
+	}
+	if called {
+		t.Error("callback ran without a master leader")
+	}
+	if elapsed > time.Second {
+		t.Errorf("WithClient blocked for %v with an already canceled context", elapsed)
+	}
+}
+
+// TestWithClientStopsWaitingOnDeadline verifies the same bound applies to a
+// deadline the caller set rather than an outright cancellation.
+func TestWithClientStopsWaitingOnDeadline(t *testing.T) {
+	mc := NewMasterClient(grpc.EmptyDialOption{}, "test-group", "test-client", "", "", "", pb.ServerDiscovery{})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	err := mc.WithClient(ctx, false, func(client master_pb.SeaweedClient) error {
+		return nil
+	})
+	elapsed := time.Since(start)
+
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Errorf("expected context.DeadlineExceeded, got %v", err)
+	}
+	if elapsed > time.Second {
+		t.Errorf("WithClient blocked for %v past a 100ms deadline", elapsed)
+	}
+}
+
+// TestMarkServingMaster verifies leader-change detection survives the
+// disconnected gap where currentMaster is cleared between reconnect attempts.
+func TestMarkServingMaster(t *testing.T) {
+	mc := NewMasterClient(grpc.EmptyDialOption{}, "test-group", "test-client", "", "", "", pb.ServerDiscovery{})
+
+	if prev := mc.markServingMaster("master1:9333"); prev != "" {
+		t.Fatalf("first connect should not report a change, got %q", prev)
+	}
+	if prev := mc.markServingMaster("master1:9333"); prev != "" {
+		t.Fatalf("reconnect to same master should not report a change, got %q", prev)
+	}
+
+	// Simulate the gap between stream attempts.
+	mc.setCurrentMaster("")
+	if prev := mc.markServingMaster("master2:9333"); prev != "master1:9333" {
+		t.Fatalf("leader change across disconnect not detected, got %q", prev)
+	}
+	if got := mc.getCurrentMaster(); got != "master2:9333" {
+		t.Fatalf("current master = %q", got)
+	}
+}
+
+// TestWithClientStopsBackoffOnCancel verifies that a cancellation arriving while
+// the retry is backing off cuts the backoff short rather than sleeping it out.
+func TestWithClientStopsBackoffOnCancel(t *testing.T) {
+	mc := NewMasterClient(grpc.WithTransportCredentials(insecure.NewCredentials()), "test-group", "test-client", "", "", "", pb.ServerDiscovery{})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	getMasterF := func() pb.ServerAddress { return "localhost:19333" }
+
+	attempts := 0
+	start := time.Now()
+	err := mc.WithClientCustomGetMaster(ctx, getMasterF, false, func(client master_pb.SeaweedClient) error {
+		attempts++
+		cancel()
+		return errors.New("connection reset by peer")
+	})
+	elapsed := time.Since(start)
+
+	if attempts != 1 {
+		t.Errorf("expected 1 attempt, got %d", attempts)
+	}
+	if !errors.Is(err, context.Canceled) {
+		t.Errorf("expected context.Canceled, got %v", err)
+	}
+	if elapsed > time.Second {
+		t.Errorf("WithClientCustomGetMaster slept %v after the context was canceled", elapsed)
+	}
+}
diff --git a/weed/wdclient/vid_map.go b/weed/wdclient/vid_map.go
index fdae7dfca4..944f683296 100644
--- a/weed/wdclient/vid_map.go
+++ b/weed/wdclient/vid_map.go
@@ -9,9 +9,9 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/seaweedfs/seaweedfs/weed/pb"
-
 	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 type HasLookupFileIdFunction interface {
@@ -21,10 +21,13 @@ type HasLookupFileIdFunction interface {
 type LookupFileIdFunctionType func(ctx context.Context, fileId string) (targetUrls []string, err error)
 
 type Location struct {
-	Url        string `json:"url,omitempty"`
-	PublicUrl  string `json:"publicUrl,omitempty"`
-	DataCenter string `json:"dataCenter,omitempty"`
-	GrpcPort   int    `json:"grpcPort,omitempty"`
+	Url               string `json:"url,omitempty"`
+	PublicUrl         string `json:"publicUrl,omitempty"`
+	DataCenter        string `json:"dataCenter,omitempty"`
+	GrpcPort          int    `json:"grpcPort,omitempty"`
+	DataInRemote      bool   `json:"dataInRemote,omitempty"`
+	ReadOnly          bool   `json:"readOnly,omitempty"`
+	ReadOnlyCanDelete bool   `json:"readOnlyCanDelete,omitempty"`
 }
 
 func (l Location) ServerAddress() pb.ServerAddress {
@@ -87,6 +90,10 @@ func (vc *vidMap) isSameDataCenter(loc *Location) bool {
 	return true
 }
 
+// LookupVolumeServerUrl returns the cached volume-server URLs for vid in
+// preference order: same-DC local, same-DC remote-tier, then the other data
+// centers on the same footing. Within each group the order is randomized so
+// load spreads across equivalent servers.
 func (vc *vidMap) LookupVolumeServerUrl(vid string) (serverUrls []string, err error) {
 	id, err := strconv.Atoi(vid)
 	if err != nil {
@@ -99,7 +106,15 @@ func (vc *vidMap) LookupVolumeServerUrl(vid string) (serverUrls []string, err er
 		return nil, fmt.Errorf("volume %d not found", id)
 	}
 	var sameDcServers, otherDcServers []string
+	localUrls := make(map[string]bool)
+
 	for _, loc := range locations {
+		glog.V(4).Infof("lookup %s => %s, data in remote storage tier: %v", vid, loc.Url, loc.DataInRemote)
+
+		if !loc.DataInRemote {
+			localUrls[loc.Url] = true
+		}
+
 		if vc.isSameDataCenter(&loc) {
 			sameDcServers = append(sameDcServers, loc.Url)
 		} else {
@@ -112,11 +127,20 @@ func (vc *vidMap) LookupVolumeServerUrl(vid string) (serverUrls []string, err er
 	rand.Shuffle(len(otherDcServers), func(i, j int) {
 		otherDcServers[i], otherDcServers[j] = otherDcServers[j], otherDcServers[i]
 	})
-	// Prefer same data center
+	// Local replicas go first inside each data center, but never ahead of the
+	// data-center preference itself: a remote tier is often in the same region
+	// as the local replicas, so crossing a DC boundary to avoid it can cost
+	// more than the remote read it saves.
+	if len(localUrls) > 0 {
+		sameDcServers = util.ReorderToFront(localUrls, sameDcServers)
+		otherDcServers = util.ReorderToFront(localUrls, otherDcServers)
+	}
 	serverUrls = append(sameDcServers, otherDcServers...)
 	return
 }
 
+// LookupFileId resolves a "<vid>,<cookie>" file id to a list of HTTP read
+// URLs using the same DC-then-local ordering as LookupVolumeServerUrl.
 func (vc *vidMap) LookupFileId(ctx context.Context, fileId string) (fullUrls []string, err error) {
 	parts := strings.Split(fileId, ",")
 	if len(parts) != 2 {
@@ -132,6 +156,9 @@ func (vc *vidMap) LookupFileId(ctx context.Context, fileId string) (fullUrls []s
 	return
 }
 
+// GetVidLocations returns the cached Location entries for vid as a string,
+// for callers that need richer per-server fields than raw URLs (e.g.
+// DataInRemote, PublicUrl).
 func (vc *vidMap) GetVidLocations(vid string) (locations []Location, err error) {
 	id, err := strconv.Atoi(vid)
 	if err != nil {
@@ -145,6 +172,11 @@ func (vc *vidMap) GetVidLocations(vid string) (locations []Location, err error)
 	return nil, fmt.Errorf("volume id %s not found", vid)
 }
 
+// GetLocations returns the cached Location entries for vid as a uint32.
+// When both regular and EC entries are present, whichever was learned last
+// wins so a volume that switched between regular and EC encoding stops
+// answering from the stale copy. Returns found=false when nothing remains,
+// including when only an older-generation entry would otherwise apply.
 func (vc *vidMap) GetLocations(vid uint32) (locations []Location, found bool) {
 	vc.RLock()
 	defer vc.RUnlock()
@@ -232,6 +264,14 @@ func (vc *vidMap) addEcLocation(vid uint32, location Location) {
 // replaces what an earlier one held instead of merging with it: after a reset
 // the new master is the authority, so a volume that moved must not keep
 // answering with the server it moved off. Callers must hold the write lock.
+//
+// If the URL is already present and the remote/local classification matches,
+// the entry is left untouched (same replica, same view). When the
+// classification flips -- e.g. a volume tiered to remote storage, or a
+// remote-backed replica restored locally -- the entry is rebuilt so
+// subsequent lookups pick up the new DataInRemote. The server reference key
+// only depends on the URL/grpc port, so it stays stable across the flip and
+// the refcount does not need to move.
 func (vc *vidMap) addLocationToMap(vid2Locations map[uint32]*locationsEntry, vid uint32, location Location) {
 	entry, found := vid2Locations[vid]
 	if !found || entry.generation != vc.generation {
@@ -246,8 +286,18 @@ func (vc *vidMap) addLocationToMap(vid2Locations map[uint32]*locationsEntry, vid
 		return
 	}
 
-	for _, loc := range entry.locations {
+	for i, loc := range entry.locations {
 		if loc.Url == location.Url {
+			if loc.DataInRemote == location.DataInRemote && loc.ReadOnly == location.ReadOnly && loc.ReadOnlyCanDelete == location.ReadOnlyCanDelete {
+				return
+			}
+			// A reader holds the slice GetLocations handed it after the lock
+			// was dropped, so the replacement is copied rather than written
+			// into the array underneath it.
+			updated := make([]Location, len(entry.locations))
+			copy(updated, entry.locations)
+			updated[i] = location
+			entry.locations = updated
 			return
 		}
 	}
diff --git a/weed/wdclient/vid_map_remote_transition_test.go b/weed/wdclient/vid_map_remote_transition_test.go
new file mode 100644
index 0000000000..f270b5b099
--- /dev/null
+++ b/weed/wdclient/vid_map_remote_transition_test.go
@@ -0,0 +1,122 @@
+package wdclient
+
+import (
+	"sync"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb"
+)
+
+// When the master reports a tier transition (local ↔ remote) for an existing
+// replica on the same server URL, the cached DataInRemote must update. Otherwise
+// reads keep preferring a remote-backed replica or skip a newly-restored local
+// one. The server refcount must stay stable because the server key only depends
+// on the URL/grpc port.
+func TestAddLocationUpdatesDataInRemoteOnTransition(t *testing.T) {
+	vm := newVidMap("", DefaultVidMapCacheSize)
+	vid := uint32(11)
+	server := Location{Url: "10.0.0.1:8080", DataCenter: "dc1", GrpcPort: 18080}
+
+	// First seen as local.
+	vm.addLocation(vid, server)
+	locs, found := vm.GetLocations(vid)
+	if !found || len(locs) != 1 || locs[0].DataInRemote {
+		t.Fatalf("expected single local replica, got %+v", locs)
+	}
+
+	// Same URL flips to remote.
+	tiered := server
+	tiered.DataInRemote = true
+	vm.addLocation(vid, tiered)
+
+	locs, found = vm.GetLocations(vid)
+	if !found {
+		t.Fatalf("tier transition dropped the replica")
+	}
+	if len(locs) != 1 {
+		t.Fatalf("tier transition should replace in place, got %d entries: %+v", len(locs), locs)
+	}
+	if !locs[0].DataInRemote {
+		t.Errorf("DataInRemote did not flip to remote on tier-out: %+v", locs[0])
+	}
+	if locs[0].Url != server.Url || locs[0].DataCenter != server.DataCenter {
+		t.Errorf("replaced entry lost non-DataInRemote fields: %+v", locs[0])
+	}
+	if !vm.hasVolumeServer(pb.ServerAddress(server.Url)) {
+		t.Errorf("server ref should remain stable across DataInRemote flip")
+	}
+
+	// Restored locally: same URL, DataInRemote back to false.
+	restored := server
+	vm.addLocation(vid, restored)
+
+	locs, found = vm.GetLocations(vid)
+	if !found {
+		t.Fatalf("restore transition dropped the replica")
+	}
+	if len(locs) != 1 {
+		t.Fatalf("restore should replace in place, got %d entries: %+v", len(locs), locs)
+	}
+	if locs[0].DataInRemote {
+		t.Errorf("DataInRemote did not flip back to local on restore: %+v", locs[0])
+	}
+}
+
+// LookupVolumeServerUrl must reflect the latest DataInRemote so the local-first
+// ordering picks up newly-restored local replicas on the next read.
+func TestLookupVolumeServerUrlReflectsRemoteTransition(t *testing.T) {
+	vm := newVidMap("dc1", DefaultVidMapCacheSize)
+	vid := uint32(12)
+
+	remote := Location{Url: "10.0.0.1:8080", DataCenter: "dc1", DataInRemote: true}
+	vm.addLocation(vid, remote)
+
+	urls, err := vm.LookupVolumeServerUrl("12")
+	if err != nil {
+		t.Fatalf("lookup failed: %v", err)
+	}
+	if len(urls) != 1 || urls[0] != "10.0.0.1:8080" {
+		t.Fatalf("expected only the remote replica, got %v", urls)
+	}
+
+	// Tier restored: same URL, DataInRemote=false.
+	local := Location{Url: "10.0.0.1:8080", DataCenter: "dc1"}
+	vm.addLocation(vid, local)
+
+	urls, err = vm.LookupVolumeServerUrl("12")
+	if err != nil {
+		t.Fatalf("lookup after restore failed: %v", err)
+	}
+	if len(urls) != 1 || urls[0] != "10.0.0.1:8080" {
+		t.Fatalf("expected only the restored replica, got %v", urls)
+	}
+}
+
+// A tier flip must not write into the slice a concurrent lookup is still
+// walking: GetLocations hands out the entry's own slice and the caller reads
+// it after the lock is dropped.
+func TestTierFlipDoesNotRaceWithLookup(t *testing.T) {
+	vm := newVidMap("dc1", DefaultVidMapCacheSize)
+	vid := uint32(13)
+	vm.addLocation(vid, Location{Url: "10.0.0.1:8080", DataCenter: "dc1"})
+	vm.addLocation(vid, Location{Url: "10.0.0.2:8080", DataCenter: "dc1"})
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 2000; i++ {
+			vm.addLocation(vid, Location{Url: "10.0.0.1:8080", DataCenter: "dc1", DataInRemote: i%2 == 0})
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		for i := 0; i < 2000; i++ {
+			if _, err := vm.LookupVolumeServerUrl("13"); err != nil {
+				t.Errorf("lookup failed mid-flip: %v", err)
+				return
+			}
+		}
+	}()
+	wg.Wait()
+}
diff --git a/weed/wdclient/vidmap_authoritative_test.go b/weed/wdclient/vidmap_authoritative_test.go
new file mode 100644
index 0000000000..499865b32c
--- /dev/null
+++ b/weed/wdclient/vidmap_authoritative_test.go
@@ -0,0 +1,49 @@
+package wdclient
+
+import (
+	"context"
+	"reflect"
+	"testing"
+)
+
+type authoritativeLookupProvider struct {
+	calls  int
+	result map[string][]Location
+	err    error
+}
+
+func (p *authoritativeLookupProvider) LookupVolumeIds(_ context.Context, volumeIDs []string) (map[string][]Location, error) {
+	p.calls++
+	return p.result, p.err
+}
+
+func TestAuthoritativeVolumeLookupDoesNotTrustCachedLocations(t *testing.T) {
+	provider := &authoritativeLookupProvider{result: map[string][]Location{}}
+	client := newVidMapClient(provider, "", DefaultVidMapCacheSize)
+	client.addLocation(17, Location{Url: "retired-volume:8080"})
+
+	locations, err := client.LookupVolumeIdsAuthoritative(context.Background(), []string{"17"})
+	if err != nil {
+		t.Fatalf("authoritative lookup: %v", err)
+	}
+	if provider.calls != 1 {
+		t.Fatalf("provider calls = %d, want 1", provider.calls)
+	}
+	if len(locations) != 0 {
+		t.Fatalf("authoritative lookup returned stale cache: %#v", locations)
+	}
+}
+
+func TestAuthoritativeVolumeLookupReturnsProviderResult(t *testing.T) {
+	want := map[string][]Location{"17": {{Url: "current-volume:8080"}}}
+	provider := &authoritativeLookupProvider{result: want}
+	client := newVidMapClient(provider, "", DefaultVidMapCacheSize)
+
+	got, err := client.LookupVolumeIdsAuthoritative(context.Background(), []string{"17"})
+	if err != nil {
+		t.Fatalf("authoritative lookup: %v", err)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("locations = %#v, want %#v", got, want)
+	}
+}
diff --git a/weed/wdclient/vidmap_client.go b/weed/wdclient/vidmap_client.go
index f2fc9add97..8ca713edc9 100644
--- a/weed/wdclient/vidmap_client.go
+++ b/weed/wdclient/vidmap_client.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 )
 
 // VolumeLocationProvider is the interface for looking up volume locations
@@ -51,7 +52,13 @@ func (vc *vidMapClient) GetLookupFileIdFunction() LookupFileIdFunctionType {
 	return vc.LookupFileIdWithFallback
 }
 
-// LookupFileIdWithFallback looks up a file ID, checking cache first, then using provider
+// LookupFileIdWithFallback resolves a "<vid>,<cookie>" file id to a list of
+// HTTP read URLs, using the cached vidMap when populated and falling back to
+// the provider for a fresh lookup on miss. URLs are returned in preference
+// order: same-DC local, same-DC remote-tier, then the other data centers on
+// the same footing -- mirroring the cached vidMap path so both routes agree.
+// Concurrent misses for the same vid are coalesced via the singleflight group
+// on LookupVolumeIdsWithFallback.
 func (vc *vidMapClient) LookupFileIdWithFallback(ctx context.Context, fileId string) (fullUrls []string, err error) {
 	// Try cache first
 	dataCenter := vc.vidMap.DataCenter
@@ -90,8 +97,13 @@ func (vc *vidMapClient) LookupFileIdWithFallback(ctx context.Context, fileId str
 
 	// Build HTTP URLs from locations, preferring same data center
 	var sameDcUrls, otherDcUrls []string
+	localUrls := make(map[string]bool)
 	for _, loc := range locations {
 		httpUrl := "http://" + loc.Url + "/" + fileId
+		glog.V(4).Infof("lookup %s => %s, data in remote storage tier: %v", fileId, loc.Url, loc.DataInRemote)
+		if !loc.DataInRemote {
+			localUrls[httpUrl] = true
+		}
 		if dataCenter != "" && dataCenter == loc.DataCenter {
 			sameDcUrls = append(sameDcUrls, httpUrl)
 		} else {
@@ -103,7 +115,13 @@ func (vc *vidMapClient) LookupFileIdWithFallback(ctx context.Context, fileId str
 	rand.Shuffle(len(sameDcUrls), func(i, j int) { sameDcUrls[i], sameDcUrls[j] = sameDcUrls[j], sameDcUrls[i] })
 	rand.Shuffle(len(otherDcUrls), func(i, j int) { otherDcUrls[i], otherDcUrls[j] = otherDcUrls[j], otherDcUrls[i] })
 
-	// Prefer same data center
+	// Local replicas go first inside each data center, but never ahead of the
+	// data-center preference itself. Mirrors vidMap.LookupVolumeServerUrl so
+	// all client lookup paths agree.
+	if len(localUrls) > 0 {
+		sameDcUrls = util.ReorderToFront(localUrls, sameDcUrls)
+		otherDcUrls = util.ReorderToFront(localUrls, otherDcUrls)
+	}
 	fullUrls = append(sameDcUrls, otherDcUrls...)
 	return fullUrls, nil
 }
@@ -229,6 +247,15 @@ func (vc *vidMapClient) LookupVolumeIdsWithFallback(ctx context.Context, volumeI
 	return result, errors.Join(lookupErrors...)
 }
 
+// LookupVolumeIdsAuthoritative bypasses the asynchronously maintained vid map.
+// Use it when a stale positive result is unsafe, such as before serving cache
+// payload from a Volume that the master may have retired. The provider still
+// batches all requested IDs into one lookup, returns a nil map when it got no
+// answer, and reports the volumes the master does not serve as errors.
+func (vc *vidMapClient) LookupVolumeIdsAuthoritative(ctx context.Context, volumeIds []string) (map[string][]Location, error) {
+	return vc.provider.LookupVolumeIds(ctx, volumeIds)
+}
+
 // Public methods for external access
 //
 // The vidMap itself is never replaced, so these all read the one map under its
diff --git a/weed/wdclient/vidmap_client_localfirst_test.go b/weed/wdclient/vidmap_client_localfirst_test.go
new file mode 100644
index 0000000000..931fe5e4b2
--- /dev/null
+++ b/weed/wdclient/vidmap_client_localfirst_test.go
@@ -0,0 +1,113 @@
+package wdclient
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+type testLocationProvider struct {
+	locations map[string][]Location
+}
+
+func (p *testLocationProvider) LookupVolumeIds(ctx context.Context, volumeIds []string) (map[string][]Location, error) {
+	result := make(map[string][]Location)
+	for _, vid := range volumeIds {
+		if locs, found := p.locations[vid]; found {
+			result[vid] = locs
+		}
+	}
+	return result, nil
+}
+
+// TestLookupFileIdWithFallbackLocalFirst ensures volumes whose data is still
+// local are tried before remote-tier replicas, on the provider (cache miss) path.
+func TestLookupFileIdWithFallbackLocalFirst(t *testing.T) {
+	vc := newVidMapClient(&testLocationProvider{
+		locations: map[string][]Location{
+			"5": {
+				{Url: "10.0.0.1:8080", DataInRemote: true},
+				{Url: "10.0.0.2:8080", DataInRemote: false},
+			},
+		},
+	}, "", 5)
+
+	urls, err := vc.LookupFileIdWithFallback(context.Background(), "5,abcdef0123456789")
+	if err != nil {
+		t.Fatalf("lookup failed: %v", err)
+	}
+	if len(urls) != 2 {
+		t.Fatalf("expected 2 urls, got %v", urls)
+	}
+	hasLocal, hasRemote := false, false
+	for _, u := range urls {
+		if strings.Contains(u, "10.0.0.2:8080") {
+			hasLocal = true
+		}
+		if strings.Contains(u, "10.0.0.1:8080") {
+			hasRemote = true
+		}
+	}
+	if !hasLocal {
+		t.Errorf("local replica missing from result: %v", urls)
+	}
+	if !hasRemote {
+		t.Errorf("remote replica missing from result: %v", urls)
+	}
+	if !strings.Contains(urls[0], "10.0.0.2:8080") {
+		t.Errorf("expected local replica first, got %v", urls)
+	}
+}
+
+// TestLookupFileIdWithFallbackAllRemote keeps shuffled order when every replica is remote.
+func TestLookupFileIdWithFallbackAllRemote(t *testing.T) {
+	vc := newVidMapClient(&testLocationProvider{
+		locations: map[string][]Location{
+			"6": {
+				{Url: "10.0.0.1:8080", DataInRemote: true},
+				{Url: "10.0.0.2:8080", DataInRemote: true},
+			},
+		},
+	}, "", 5)
+
+	urls, err := vc.LookupFileIdWithFallback(context.Background(), "6,abcdef0123456789")
+	if err != nil {
+		t.Fatalf("lookup failed: %v", err)
+	}
+	if len(urls) != 2 {
+		t.Fatalf("expected 2 urls, got %v", urls)
+	}
+}
+
+// TestLookupFileIdWithFallbackKeepsDataCenterFirst verifies that the local-first
+// ordering applies inside each data center and does not override the data-center
+// preference: a same-DC remote replica still beats an other-DC local one, because
+// the remote tier is usually nearer than another data center.
+func TestLookupFileIdWithFallbackKeepsDataCenterFirst(t *testing.T) {
+	vc := newVidMapClient(&testLocationProvider{
+		locations: map[string][]Location{
+			"7": {
+				{Url: "10.0.0.1:8080", DataCenter: "dc1", DataInRemote: true},
+				{Url: "10.0.0.2:8080", DataCenter: "dc1", DataInRemote: false},
+				{Url: "10.0.0.3:8080", DataCenter: "dc2", DataInRemote: false},
+				{Url: "10.0.0.4:8080", DataCenter: "dc2", DataInRemote: true},
+			},
+		},
+	}, "dc1", 5)
+
+	urls, err := vc.LookupFileIdWithFallback(context.Background(), "7,abcdef0123456789")
+	if err != nil {
+		t.Fatalf("lookup failed: %v", err)
+	}
+	if len(urls) != 4 {
+		t.Fatalf("expected 4 urls, got %v", urls)
+	}
+
+	// dc1 local, dc1 remote, dc2 local, dc2 remote.
+	want := []string{"10.0.0.2:8080", "10.0.0.1:8080", "10.0.0.3:8080", "10.0.0.4:8080"}
+	for i, host := range want {
+		if !strings.Contains(urls[i], host) {
+			t.Fatalf("position %d should be %s, got %v", i, host, urls)
+		}
+	}
+}
diff --git a/weed/weed.go b/weed/weed.go
index f83777bf54..17f6a44e18 100644
--- a/weed/weed.go
+++ b/weed/weed.go
@@ -102,6 +102,8 @@ func main() {
 				// Command execution failed - general error
 				setExitStatus(1)
 			}
+			// A command can also record a failure without returning false.
+			setExitStatus(command.CommandExitStatus())
 			exit()
 			return
 		}
@@ -200,5 +202,7 @@ func exit() {
 	for _, f := range atexitFuncs {
 		f()
 	}
+	// os.Exit below skips main's deferred flush.
+	sentry.Flush(2 * time.Second)
 	os.Exit(exitStatus)
 }
diff --git a/weed/worker/client.go b/weed/worker/client.go
index 20fcd50aac..83aa058814 100644
--- a/weed/worker/client.go
+++ b/weed/worker/client.go
@@ -12,8 +12,11 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	"github.com/seaweedfs/seaweedfs/weed/security"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
 )
 
 var (
@@ -251,6 +254,15 @@ func (c *GrpcAdminClient) handleConnect(cmd grpcCommand, s *grpcState) {
 	cmd.resp <- nil
 }
 
+// adminWorkerCredentials mints the Bearer token the admin worker gRPC service
+// requires when jwt.filer_signing.key is configured; nil when it is not.
+func adminWorkerCredentials() metadata.MD {
+	v := util.GetViper()
+	return security.GrpcAdminPeerCredentials(
+		security.SigningKey(v.GetString("jwt.filer_signing.key")),
+		v.GetInt("jwt.filer_signing.expires_after_seconds"))
+}
+
 // createConnection attempts to connect using the provided dial option
 func (c *GrpcAdminClient) createConnection() (*grpc.ClientConn, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
@@ -278,6 +290,9 @@ func (c *GrpcAdminClient) attemptConnection(s *grpcState) error {
 
 	// Create bidirectional stream
 	s.streamCtx, s.streamCancel = context.WithCancel(context.Background())
+	if md := adminWorkerCredentials(); len(md) > 0 {
+		s.streamCtx = metadata.NewOutgoingContext(s.streamCtx, md)
+	}
 	stream, err := s.client.WorkerStream(s.streamCtx)
 	glog.Infof("[session %s] Worker stream created", c.sessionID)
 	if err != nil {
diff --git a/weed/worker/tasks/balance/balance_task.go b/weed/worker/tasks/balance/balance_task.go
index 9f0c6b5312..87d78091d4 100644
--- a/weed/worker/tasks/balance/balance_task.go
+++ b/weed/worker/tasks/balance/balance_task.go
@@ -3,16 +3,13 @@ package balance
 import (
 	"context"
 	"fmt"
-	"io"
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
-	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types/base"
 	"google.golang.org/grpc"
@@ -75,83 +72,22 @@ func (t *BalanceTask) Execute(ctx context.Context, params *worker_pb.TaskParams)
 		"collection":  t.collection,
 	}).Info("Starting balance task - moving volume")
 
-	sourceServer := pb.ServerAddress(sourceNode)
-	targetServer := pb.ServerAddress(destNode)
-	volumeId := needle.VolumeId(t.volumeID)
-
-	// Step 1: Mark volume readonly
-	t.ReportProgress(10.0)
-	t.GetLogger().Info("Marking volume readonly for move")
-	if err := t.markVolumeReadonly(ctx, sourceServer, volumeId); err != nil {
-		return fmt.Errorf("failed to mark volume readonly: %w", err)
-	}
-	// Restore source writability if any subsequent step fails, so the
-	// source volume is not left permanently readonly on abort.
-	sourceMarkedReadonly := true
-	defer func() {
-		if sourceMarkedReadonly {
-			cleanupCtx, cleanupCancel := context.WithTimeout(context.Background(), 30*time.Second)
-			defer cleanupCancel()
-			if wErr := t.markVolumeWritable(cleanupCtx, sourceServer, volumeId); wErr != nil {
-				glog.Warningf("failed to restore volume %d writability on %s: %v", volumeId, sourceServer, wErr)
-			}
-		}
-	}()
-
-	// Step 2: Read source volume size before copy (for post-copy verification)
-	t.ReportProgress(15.0)
-	sourceStatus, err := t.readVolumeFileStatus(ctx, sourceServer, volumeId)
+	// The move sequence — freeze the source, copy, tail, verify the target
+	// matches the source before the destructive delete — is shared with the
+	// shell's volume.move/volume.balance commands.
+	mover := volume_move.NewMover(t.grpcDialOption)
+	err := mover.LiveMoveVolume(ctx, needle.VolumeId(t.volumeID), pb.ServerAddress(sourceNode), pb.ServerAddress(destNode), volume_move.VolumeMoveOptions{
+		IdleTimeout:     60 * time.Second,
+		IoBytePerSecond: balanceParams.IoBytePerSecond,
+		Progress: func(percent float64, stage string) {
+			t.ReportProgress(percent)
+			t.GetLogger().Info("move stage: %s", stage)
+		},
+	})
 	if err != nil {
-		return fmt.Errorf("failed to read source volume status: %w", err)
+		return fmt.Errorf("move volume %d from %s to %s: %w", t.volumeID, sourceNode, destNode, err)
 	}
 
-	// Step 3: Copy volume to destination (VolumeCopy also mounts the volume)
-	t.ReportProgress(20.0)
-	t.GetLogger().Info("Copying volume to destination")
-	lastAppendAtNs, err := t.copyVolume(ctx, sourceServer, targetServer, volumeId)
-	if err != nil {
-		return fmt.Errorf("failed to copy volume: %w", err)
-	}
-
-	// Step 4: Tail for updates
-	t.ReportProgress(70.0)
-	t.GetLogger().Info("Syncing final updates")
-	if err := t.tailVolume(ctx, sourceServer, targetServer, volumeId, lastAppendAtNs); err != nil {
-		glog.Warningf("Tail operation failed (may be normal): %v", err)
-	}
-
-	// Step 5: Verify the volume on target before deleting source.
-	// This is a critical safety check — once the source is deleted, data loss
-	// is irreversible. We verify the target has the volume with matching size.
-	t.ReportProgress(85.0)
-	t.GetLogger().Info("Verifying volume on target before deleting source")
-	targetStatus, err := t.readVolumeFileStatus(ctx, targetServer, volumeId)
-	if err != nil {
-		return fmt.Errorf("aborting: cannot verify volume %d on target %s before deleting source: %v", volumeId, targetServer, err)
-	}
-	if targetStatus.DatFileSize != sourceStatus.DatFileSize {
-		return fmt.Errorf("aborting: volume %d .dat size mismatch — source %d bytes, target %d bytes",
-			volumeId, sourceStatus.DatFileSize, targetStatus.DatFileSize)
-	}
-	if targetStatus.FileCount != sourceStatus.FileCount {
-		return fmt.Errorf("aborting: volume %d file count mismatch — source %d, target %d",
-			volumeId, sourceStatus.FileCount, targetStatus.FileCount)
-	}
-	if targetStatus.IdxFileSize != sourceStatus.IdxFileSize {
-		return fmt.Errorf("aborting: volume %d .idx size mismatch — source %d bytes, target %d bytes",
-			volumeId, sourceStatus.IdxFileSize, targetStatus.IdxFileSize)
-	}
-
-	// Step 6: Delete from source — after this, the move is committed.
-	// Clear the readonly flag so the defer doesn't try to restore writability.
-	t.ReportProgress(90.0)
-	t.GetLogger().Info("Deleting volume from source server")
-	if err := t.deleteVolume(ctx, sourceServer, volumeId); err != nil {
-		return fmt.Errorf("failed to delete volume from source: %w", err)
-	}
-	sourceMarkedReadonly = false
-
-	t.ReportProgress(100.0)
 	glog.Infof("Balance task completed successfully: volume %d moved from %s to %s",
 		t.volumeID, sourceNode, destNode)
 	return nil
@@ -197,109 +133,3 @@ func (t *BalanceTask) EstimateTime(params *worker_pb.TaskParams) time.Duration {
 func (t *BalanceTask) GetProgress() float64 {
 	return t.progress
 }
-
-// Helper methods for real balance operations
-
-// markVolumeReadonly marks the volume readonly on the source server.
-func (t *BalanceTask) markVolumeReadonly(ctx context.Context, server pb.ServerAddress, volumeId needle.VolumeId) error {
-	return operation.WithVolumeServerClient(false, server, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			_, err := client.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{
-				VolumeId: uint32(volumeId),
-			})
-			return err
-		})
-}
-
-// markVolumeWritable restores the volume to writable on the source server.
-func (t *BalanceTask) markVolumeWritable(ctx context.Context, server pb.ServerAddress, volumeId needle.VolumeId) error {
-	return operation.WithVolumeServerClient(false, server, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			_, err := client.VolumeMarkWritable(ctx, &volume_server_pb.VolumeMarkWritableRequest{
-				VolumeId: uint32(volumeId),
-			})
-			return err
-		})
-}
-
-// copyVolume copies volume from source to target server.
-func (t *BalanceTask) copyVolume(ctx context.Context, sourceServer, targetServer pb.ServerAddress, volumeId needle.VolumeId) (uint64, error) {
-	var lastAppendAtNs uint64
-
-	err := operation.WithVolumeServerClient(true, targetServer, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			stream, err := client.VolumeCopy(ctx, &volume_server_pb.VolumeCopyRequest{
-				VolumeId:       uint32(volumeId),
-				SourceDataNode: string(sourceServer),
-			})
-			if err != nil {
-				return err
-			}
-
-			for {
-				resp, recvErr := stream.Recv()
-				if recvErr != nil {
-					if recvErr == io.EOF {
-						break
-					}
-					return recvErr
-				}
-
-				if resp.LastAppendAtNs != 0 {
-					lastAppendAtNs = resp.LastAppendAtNs
-				} else {
-					// Report copy progress
-					glog.V(1).Infof("Volume %d copy progress: %s", volumeId,
-						util.BytesToHumanReadable(uint64(resp.ProcessedBytes)))
-				}
-			}
-
-			return nil
-		})
-
-	return lastAppendAtNs, err
-}
-
-// tailVolume syncs remaining updates from source to target.
-func (t *BalanceTask) tailVolume(ctx context.Context, sourceServer, targetServer pb.ServerAddress, volumeId needle.VolumeId, sinceNs uint64) error {
-	return operation.WithVolumeServerClient(true, targetServer, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			_, err := client.VolumeTailReceiver(ctx, &volume_server_pb.VolumeTailReceiverRequest{
-				VolumeId:           uint32(volumeId),
-				SinceNs:            sinceNs,
-				IdleTimeoutSeconds: 60, // 1 minute timeout
-				SourceVolumeServer: string(sourceServer),
-			})
-			return err
-		})
-}
-
-// readVolumeFileStatus reads the volume's file status (sizes, file count) from a server.
-func (t *BalanceTask) readVolumeFileStatus(ctx context.Context, server pb.ServerAddress, volumeId needle.VolumeId) (*volume_server_pb.ReadVolumeFileStatusResponse, error) {
-	var resp *volume_server_pb.ReadVolumeFileStatusResponse
-	err := operation.WithVolumeServerClient(false, server, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			var err error
-			resp, err = client.ReadVolumeFileStatus(ctx,
-				&volume_server_pb.ReadVolumeFileStatusRequest{
-					VolumeId: uint32(volumeId),
-				})
-			return err
-		})
-	return resp, err
-}
-
-// deleteVolume deletes the volume from the source server after a successful
-// move. KeepRemoteData=true prevents the source from removing the cloud-tier
-// object that the destination's freshly-copied .vif now points at.
-func (t *BalanceTask) deleteVolume(ctx context.Context, server pb.ServerAddress, volumeId needle.VolumeId) error {
-	return operation.WithVolumeServerClient(false, server, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			_, err := client.VolumeDelete(ctx, &volume_server_pb.VolumeDeleteRequest{
-				VolumeId:       uint32(volumeId),
-				OnlyEmpty:      false,
-				KeepRemoteData: true,
-			})
-			return err
-		})
-}
diff --git a/weed/worker/tasks/balance/config.go b/weed/worker/tasks/balance/config.go
index e9d2af637c..f1372f1cc3 100644
--- a/weed/worker/tasks/balance/config.go
+++ b/weed/worker/tasks/balance/config.go
@@ -14,6 +14,7 @@ type Config struct {
 	base.BaseConfig
 	ImbalanceThreshold float64 `json:"imbalance_threshold"`
 	MinServerCount     int     `json:"min_server_count"`
+	IoBytePerSecond    int64   `json:"io_byte_per_second"`
 	DataCenterFilter   string  `json:"-"` // per-detection-run, not persisted
 	RackFilter         string  `json:"-"` // per-detection-run, not persisted
 	NodeFilter         string  `json:"-"` // per-detection-run, not persisted
@@ -96,6 +97,21 @@ func GetConfigSpec() base.ConfigSpec {
 				InputType:    "number",
 				CSSClasses:   "form-control",
 			},
+			{
+				Name:         "io_byte_per_second",
+				JSONName:     "io_byte_per_second",
+				Type:         config.FieldTypeInt,
+				DefaultValue: 0,
+				MinValue:     0,
+				Required:     false,
+				DisplayName:  "Move IO Limit (bytes/sec)",
+				Description:  "Limit each volume move's copy rate",
+				HelpText:     "0 falls back to each volume server's own maintenance rate (-maintenanceBytePerSecond)",
+				Placeholder:  "0 (server maintenance rate)",
+				Unit:         config.UnitNone,
+				InputType:    "number",
+				CSSClasses:   "form-control",
+			},
 			{
 				Name:         "min_server_count",
 				JSONName:     "min_server_count",
@@ -127,6 +143,7 @@ func (c *Config) ToTaskPolicy() *worker_pb.TaskPolicy {
 			BalanceConfig: &worker_pb.BalanceTaskConfig{
 				ImbalanceThreshold: float64(c.ImbalanceThreshold),
 				MinServerCount:     int32(c.MinServerCount),
+				IoBytePerSecond:    c.IoBytePerSecond,
 			},
 		},
 	}
@@ -147,6 +164,7 @@ func (c *Config) FromTaskPolicy(policy *worker_pb.TaskPolicy) error {
 	if balanceConfig := policy.GetBalanceConfig(); balanceConfig != nil {
 		c.ImbalanceThreshold = float64(balanceConfig.ImbalanceThreshold)
 		c.MinServerCount = int(balanceConfig.MinServerCount)
+		c.IoBytePerSecond = balanceConfig.IoBytePerSecond
 	}
 
 	return nil
@@ -160,12 +178,25 @@ func LoadConfigFromPersistence(configPersistence interface{}) *Config {
 	if persistence, ok := configPersistence.(interface {
 		LoadBalanceTaskPolicy() (*worker_pb.TaskPolicy, error)
 	}); ok {
-		if policy, err := persistence.LoadBalanceTaskPolicy(); err == nil && policy != nil {
-			if err := config.FromTaskPolicy(policy); err == nil {
+		policy, err := persistence.LoadBalanceTaskPolicy()
+		switch {
+		case err != nil:
+			glog.Warningf("Could not read the persisted balance configuration, falling back to defaults: %v", err)
+		case policy == nil:
+			glog.V(1).Infof("No balance configuration persisted yet, using defaults")
+		default:
+			if err := config.FromTaskPolicy(policy); err != nil {
+				glog.Warningf("Could not apply the persisted balance configuration, falling back to defaults: %v", err)
+			} else {
 				glog.V(1).Infof("Loaded balance configuration from persistence")
 				return config
 			}
 		}
+	} else if configPersistence != nil {
+		// A store was handed in but does not expose the accessor, so the persisted
+		// settings are silently ignored - always a wiring bug, never a normal state.
+		glog.Warningf("%T cannot provide the persisted balance configuration: it has no LoadBalanceTaskPolicy() method, "+
+			"so the compiled-in defaults are used and any saved balance settings are ignored", configPersistence)
 	}
 
 	glog.V(1).Infof("Using default balance configuration")
diff --git a/weed/worker/tasks/balance/detection.go b/weed/worker/tasks/balance/detection.go
index 4ff865b4cc..d53c219fd1 100644
--- a/weed/worker/tasks/balance/detection.go
+++ b/weed/worker/tasks/balance/detection.go
@@ -113,7 +113,9 @@ func detectForDiskType(diskType string, diskMetrics []*types.VolumeHealthMetrics
 							continue
 						}
 						for diskTypeName, diskInfo := range node.DiskInfos {
-							if diskTypeName == diskType {
+							// An empty entry on a node whose real disks are of
+							// another type is not a disk of this type.
+							if diskTypeName == diskType && !topology.IsPhantomDiskTypeEntry(node, diskTypeName) {
 								serverVolumeCounts[node.Id] = 0
 								serverMaxVolumes[node.Id] += diskInfo.MaxVolumeCount
 								serverDiskTotalBytes[node.Id] += diskInfo.DiskTotalBytes
@@ -320,36 +322,23 @@ func detectForDiskType(diskType string, diskMetrics []*types.VolumeHealthMetrics
 			break
 		}
 
-		// Per-move convergence guard: mirrors weed/shell/command_volume_balance.go
-		// to prevent oscillation and destination overshoot when MaxVolumeCount
-		// values are heterogeneous. Without this guard, the greedy max→min
-		// algorithm can schedule moves that flip which server is most-utilized
-		// (source becomes min, destination becomes max), producing A→B, B→A
-		// oscillation within a single detection cycle.
-		//
-		// Check: after the move, the destination's utilization must not strictly
-		// exceed the source's utilization. If it would, no single move can
-		// improve balance — stop here. This also handles heterogeneous capacity
-		// correctly by comparing post-move utilization ratios rather than raw
-		// counts. The integer discretization is handled automatically: when
-		// counts cannot match the ideal exactly, the check still admits moves
-		// that reduce the max/min gap without flipping it.
-		maxCap := serverMaxVolumes[maxServer]
-		minCap := serverMaxVolumes[minServer]
-		if allServersHaveMaxInfo && maxCap > 0 && minCap > 0 {
-			newSrcUtil := float64(effectiveCounts[maxServer]-1) / float64(maxCap)
-			newDstUtil := float64(effectiveCounts[minServer]+1) / float64(minCap)
-			if newDstUtil > newSrcUtil {
-				if len(results) == 0 {
-					glog.Infof("BALANCE [%s]: No tasks created - no beneficial move available. After move, dest %s util would be %.1f%% vs source %s util %.1f%%",
-						diskType, minServer, newDstUtil*100, maxServer, newSrcUtil*100)
-				} else {
-					glog.Infof("BALANCE [%s]: Created %d task(s), no more beneficial moves available. After move, dest %s util would be %.1f%% vs source %s util %.1f%%",
-						diskType, len(results), minServer, newDstUtil*100, maxServer, newSrcUtil*100)
-				}
-				balanced = true
-				break
+		// Per-move convergence guard: after the move, the destination's
+		// utilization must not strictly exceed the source's. Otherwise the move
+		// just flips which server is min vs max, producing A→B, B→A oscillation.
+		// Comparing utilization ratios handles heterogeneous capacities; in
+		// raw-count mode serverUtilization returns effective counts.
+		newSrcUtil := serverUtilization(maxServer, effectiveCounts[maxServer]-1)
+		newDstUtil := serverUtilization(minServer, effectiveCounts[minServer]+1)
+		if newDstUtil > newSrcUtil {
+			if len(results) == 0 {
+				glog.Infof("BALANCE [%s]: No tasks created - no beneficial move available. After move, dest %s util would be %.1f%% vs source %s util %.1f%%",
+					diskType, minServer, newDstUtil*100, maxServer, newSrcUtil*100)
+			} else {
+				glog.Infof("BALANCE [%s]: Created %d task(s), no more beneficial moves available. After move, dest %s util would be %.1f%% vs source %s util %.1f%%",
+					diskType, len(results), minServer, newDstUtil*100, maxServer, newSrcUtil*100)
 			}
+			balanced = true
+			break
 		}
 
 		// Select a volume from the overloaded server using per-server cursor
@@ -396,11 +385,18 @@ func detectForDiskType(diskType string, diskMetrics []*types.VolumeHealthMetrics
 		// sources are unaffected, so a full server can still be drained.
 		eligibleTargets := make(map[string]int, len(serverVolumeCounts))
 		for s, c := range serverVolumeCounts {
-			if !destinationFull[s] && !destinationDiskTooFull(s, 0) {
-				eligibleTargets[s] = c
+			if destinationFull[s] || destinationDiskTooFull(s, 0) {
+				continue
 			}
+			// The score-based fallback obeys the same convergence guard: a
+			// destination that ends up more utilized than the source only
+			// relocates the imbalance instead of reducing it.
+			if serverUtilization(s, effectiveCounts[s]+1) > newSrcUtil {
+				continue
+			}
+			eligibleTargets[s] = c
 		}
-		task, destServerID := createBalanceTask(diskType, selectedVolume, clusterInfo, minServer, eligibleTargets)
+		task, destServerID := createBalanceTask(diskType, selectedVolume, clusterInfo, minServer, eligibleTargets, balanceConfig.IoBytePerSecond)
 		if task == nil {
 			glog.V(1).Infof("BALANCE [%s]: Cannot plan task for volume %d on server %s, trying next volume", diskType, selectedVolume.VolumeID, maxServer)
 			continue
@@ -438,7 +434,7 @@ func detectForDiskType(diskType string, diskMetrics []*types.VolumeHealthMetrics
 // allowedServers is the set of servers that passed DC/rack/node filtering in
 // the detection loop. When non-empty, the fallback destination planner is
 // checked against this set so that filter scope cannot leak.
-func createBalanceTask(diskType string, selectedVolume *types.VolumeHealthMetrics, clusterInfo *types.ClusterInfo, targetServer string, allowedServers map[string]int) (*types.TaskDetectionResult, string) {
+func createBalanceTask(diskType string, selectedVolume *types.VolumeHealthMetrics, clusterInfo *types.ClusterInfo, targetServer string, allowedServers map[string]int, ioBytePerSecond int64) (*types.TaskDetectionResult, string) {
 	taskID := fmt.Sprintf("balance_vol_%d_%d", selectedVolume.VolumeID, time.Now().UnixNano())
 
 	task := &types.TaskDetectionResult{
@@ -489,29 +485,6 @@ func createBalanceTask(diskType string, selectedVolume *types.VolumeHealthMetric
 			glog.Warningf("Failed to plan balance destination for volume %d: %v", selectedVolume.VolumeID, err)
 			return nil, ""
 		}
-	}
-
-	// Verify the resolved destination. If it falls outside the filtered scope
-	// or violates replica placement, fall back to the score-based planner and
-	// pick the best candidate that is actually valid.
-	if !isValidBalanceDestination(destinationPlan, allowedServers, volumeRP, replicas, selectedVolume.Server) {
-		switch {
-		case destinationPlan == nil:
-			glog.V(1).Infof("BALANCE [%s]: Planned destination for volume %d is nil, falling back",
-				diskType, selectedVolume.VolumeID)
-		case !isAllowedBalanceTarget(destinationPlan.TargetNode, allowedServers):
-			glog.V(1).Infof("BALANCE [%s]: Planned destination %s for volume %d is outside filtered scope, falling back",
-				diskType, destinationPlan.TargetNode, selectedVolume.VolumeID)
-		case volumeRP != nil && len(replicas) > 0:
-			glog.V(1).Infof("BALANCE [%s]: Destination %s violates replica placement for volume %d (rp=%03d), falling back",
-				diskType, destinationPlan.TargetNode, selectedVolume.VolumeID, selectedVolume.ExpectedReplicas)
-		}
-
-		destinationPlan, err = planBalanceDestination(clusterInfo.ActiveTopology, selectedVolume, volumeRP, replicas, allowedServers)
-		if err != nil {
-			glog.Warningf("BALANCE [%s]: Failed to plan fallback destination for volume %d: %v", diskType, selectedVolume.VolumeID, err)
-			return nil, ""
-		}
 		if !isValidBalanceDestination(destinationPlan, allowedServers, volumeRP, replicas, selectedVolume.Server) {
 			if destinationPlan == nil {
 				glog.V(1).Infof("BALANCE [%s]: Fallback destination for volume %d is nil",
@@ -522,6 +495,15 @@ func createBalanceTask(diskType string, selectedVolume *types.VolumeHealthMetric
 			}
 			return nil, ""
 		}
+	} else if !isValidBalanceDestination(destinationPlan, allowedServers, volumeRP, replicas, selectedVolume.Server) {
+		// The loop-chosen target is out of scope or already holds a replica of
+		// this volume. Skip it like shell volume.balance does instead of
+		// redirecting the move to a third server: with equally full servers the
+		// redirected move never shrinks the imbalance and ping-pongs the same
+		// volumes back on the next detection cycle.
+		glog.V(1).Infof("BALANCE [%s]: target %s is not a valid destination for volume %d, trying next volume",
+			diskType, targetServer, selectedVolume.VolumeID)
+		return nil, ""
 	}
 
 	// Find the actual disk containing the volume on the source server
@@ -566,8 +548,9 @@ func createBalanceTask(diskType string, selectedVolume *types.VolumeHealthMetric
 
 		TaskParams: &worker_pb.TaskParams_BalanceParams{
 			BalanceParams: &worker_pb.BalanceTaskParams{
-				ForceMove:      false,
-				TimeoutSeconds: 600, // 10 minutes default
+				ForceMove:       false,
+				TimeoutSeconds:  600, // 10 minutes default
+				IoBytePerSecond: ioBytePerSecond,
 			},
 		},
 	}
diff --git a/weed/worker/tasks/balance/detection_empty_disk_type_test.go b/weed/worker/tasks/balance/detection_empty_disk_type_test.go
new file mode 100644
index 0000000000..72b236d188
--- /dev/null
+++ b/weed/worker/tasks/balance/detection_empty_disk_type_test.go
@@ -0,0 +1,102 @@
+package balance
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
+	"github.com/seaweedfs/seaweedfs/weed/worker/tasks/base"
+	"github.com/seaweedfs/seaweedfs/weed/worker/types"
+)
+
+// A master that answered a capacity question for a disk type a node lacks
+// published an empty DiskInfo of that type for the node (MaxVolumeCount 0, no
+// volumes). The planner registered every such node as a candidate with zero
+// volumes, and one zero max switched the whole disk type to raw-count
+// balancing, so the empty node became the destination of every move -- which
+// the volume server then refused ("no space left hdd" / "no space left ssd").
+//
+// The entry always has DiskId 0. With real disks at id 1 (location 0
+// unavailable) it collides with nothing and must be ignored all the same.
+func TestDetection_IgnoresEmptyDiskTypeEntries(t *testing.T) {
+	for _, realDiskID := range []uint32{0, 1} {
+		t.Run(fmt.Sprintf("real disks at id %d", realDiskID), func(t *testing.T) {
+			// Raw counts and utilization disagree on purpose: by raw count hdd-3 is
+			// the most loaded, by utilization hdd-2 is.
+			servers := []serverSpec{
+				{id: "hdd-1", diskType: "hdd", diskID: realDiskID, dc: "dc1", rack: "rack1", maxVolumes: 700},
+				{id: "hdd-2", diskType: "hdd", diskID: realDiskID, dc: "dc1", rack: "rack1", maxVolumes: 700},
+				{id: "hdd-3", diskType: "hdd", diskID: realDiskID, dc: "dc1", rack: "rack1", maxVolumes: 1260},
+				{id: "ssd-1", diskType: "ssd", diskID: realDiskID, dc: "dc1", rack: "rack2", maxVolumes: 200},
+			}
+			counts := []struct {
+				server, diskType string
+				n                int
+			}{{"hdd-1", "hdd", 600}, {"hdd-2", "hdd", 695}, {"hdd-3", "hdd", 900}, {"ssd-1", "ssd", 22}}
+
+			var metrics []*types.VolumeHealthMetrics
+			vid := uint32(1)
+			for _, c := range counts {
+				metrics = append(metrics, makeVolumes(c.server, c.diskType, "dc1", "rack1", "", vid, c.n)...)
+				vid += uint32(c.n)
+			}
+
+			at := buildTopology(servers, metrics)
+			// Add what the master published: an empty entry of the other disk
+			// type on every node, DiskId 0.
+			topo := at.GetTopologyInfo()
+			for _, dc := range topo.DataCenterInfos {
+				for _, rack := range dc.RackInfos {
+					for _, node := range rack.DataNodeInfos {
+						other := "ssd"
+						if strings.HasPrefix(node.Id, "ssd-") {
+							other = "hdd"
+						}
+						node.DiskInfos[other] = &master_pb.DiskInfo{Type: other}
+					}
+				}
+			}
+			if err := at.UpdateTopology(topo); err != nil {
+				t.Fatalf("UpdateTopology: %v", err)
+			}
+			for _, s := range servers {
+				disks := at.GetNodeDisks(s.id)
+				if len(disks) != 1 || disks[0].DiskType != s.diskType || disks[0].DiskID != realDiskID {
+					var got []string
+					for _, d := range disks {
+						got = append(got, fmt.Sprintf("%q@%d", d.DiskType, d.DiskID))
+					}
+					t.Fatalf("%s disks %v, want only its real %q disk %d", s.id, got, s.diskType, realDiskID)
+				}
+			}
+
+			cfg := &Config{BaseConfig: base.BaseConfig{Enabled: true}, ImbalanceThreshold: 0.20, MinServerCount: 2}
+			tasks, _, err := Detection(metrics, &types.ClusterInfo{ActiveTopology: at}, cfg, 10)
+			if err != nil {
+				t.Fatalf("Detection failed: %v", err)
+			}
+			if len(tasks) == 0 {
+				t.Fatal("expected HDD balance tasks, got none")
+			}
+			for i, task := range tasks {
+				if task.TypedParams == nil || len(task.TypedParams.Targets) == 0 {
+					t.Fatalf("task %d (volume %d) has no target", i, task.VolumeID)
+				}
+				target := task.TypedParams.Targets[0].Node
+				if task.Server == "ssd-1" {
+					t.Errorf("task %d moves SSD volume %d from ssd-1 to %s: ssd-1 is the only server with an SSD disk", i, task.VolumeID, target)
+				}
+				if strings.HasPrefix(target, "ssd-1") {
+					t.Errorf("task %d moves HDD volume %d from %s onto ssd-1, which has no HDD disk", i, task.VolumeID, task.Server)
+				}
+				if task.Server == "hdd-3" {
+					t.Errorf("task %d picks hdd-3 (lowest utilization, 71%%) as source: balancing fell back to raw volume counts", i)
+				}
+			}
+			if tasks[0].Server != "hdd-2" {
+				t.Errorf("first source = %s, want hdd-2 (highest utilization, 99%%)", tasks[0].Server)
+			}
+		})
+	}
+}
diff --git a/weed/worker/tasks/balance/detection_test.go b/weed/worker/tasks/balance/detection_test.go
index e74add194b..ae8febcf5a 100644
--- a/weed/worker/tasks/balance/detection_test.go
+++ b/weed/worker/tasks/balance/detection_test.go
@@ -1485,3 +1485,125 @@ func TestResolveBalanceDestination_UsesEffectiveCapacity(t *testing.T) {
 		t.Errorf("unexpected target node: got %q want %q", plan.TargetNode, "dst-node")
 	}
 }
+
+// TestDetection_SkipsVolumeWhenTargetHoldsReplica reproduces issue #11839.
+// The emptiest server (node-d) already holds a replica of the lowest-ID
+// volumes on the fuller servers, so those volumes cannot legally move to it.
+// Detection must skip them and move on to volumes that can, instead of
+// redirecting the move to a third, equally full server — which ping-pongs
+// the same volumes back and forth on every detection cycle.
+func TestDetection_SkipsVolumeWhenTargetHoldsReplica(t *testing.T) {
+	servers := []serverSpec{
+		{id: "node-a", diskType: "hdd", diskID: 1, dc: "dc1", rack: "rack1", maxVolumes: 100},
+		{id: "node-b", diskType: "hdd", diskID: 2, dc: "dc1", rack: "rack1", maxVolumes: 100},
+		{id: "node-c", diskType: "hdd", diskID: 3, dc: "dc1", rack: "rack1", maxVolumes: 100},
+		{id: "node-d", diskType: "hdd", diskID: 4, dc: "dc1", rack: "rack1", maxVolumes: 100},
+	}
+
+	var metrics []*types.VolumeHealthMetrics
+	replicaMap := make(map[uint32][]types.ReplicaLocation)
+	addReplica := func(id uint32, node string) {
+		replicaMap[id] = append(replicaMap[id], types.ReplicaLocation{
+			DataCenter: "dc1", Rack: "rack1", NodeID: node,
+		})
+	}
+	// place registers a replica of volume id on server (a metric); the first
+	// placement of a volume also records its second replica on peer.
+	place := func(server, peer string, lo, hi uint32) {
+		for id := lo; id <= hi; id++ {
+			metrics = append(metrics, &types.VolumeHealthMetrics{
+				VolumeID: id, Server: server, ServerAddress: server + ":8080",
+				DiskType: "hdd", Collection: "c1", Size: 1024,
+				DataCenter: "dc1", Rack: "rack1", ExpectedReplicas: 1, // rp=001
+			})
+			if _, seen := replicaMap[id]; !seen {
+				addReplica(id, server)
+				addReplica(id, peer)
+			}
+		}
+	}
+
+	// The lowest-ID volumes on each full server already have their second
+	// replica on node-d, so node-d is never a legal target for them.
+	place("node-a", "node-d", 1, 10)
+	place("node-b", "node-d", 11, 20)
+	place("node-c", "node-d", 21, 30)
+
+	// Higher-ID volumes replicate within {a,b,c} and can move to node-d.
+	place("node-a", "node-b", 31, 55)
+	place("node-b", "node-c", 56, 70)
+	place("node-c", "node-a", 81, 105)
+	place("node-c", "node-b", 106, 120)
+	place("node-b", "node-a", 31, 55)   // second copies
+	place("node-c", "node-b", 56, 70)   // second copies
+	place("node-a", "node-c", 81, 105)  // second copies
+	place("node-b", "node-c", 106, 120) // second copies
+
+	// Per-server counts: a=60, b=65, c=65 of cap 100. node-d has no metrics of
+	// its own (it only holds the replica-map copies), so it is the clear min.
+	at := buildTopology(servers, metrics)
+	clusterInfo := &types.ClusterInfo{ActiveTopology: at, VolumeReplicaMap: replicaMap}
+
+	tasks, _, err := Detection(metrics, clusterInfo, defaultConf(), 100)
+	if err != nil {
+		t.Fatalf("Detection failed: %v", err)
+	}
+	if len(tasks) == 0 {
+		t.Fatal("expected balance tasks: 60/65/65 vs 0 is far above the imbalance threshold")
+	}
+
+	addrToNode := map[string]string{
+		"node-a:8080": "node-a", "node-b:8080": "node-b",
+		"node-c:8080": "node-c", "node-d:8080": "node-d",
+	}
+	srcOf := make(map[uint32]string)
+	dstOf := make(map[uint32]string)
+	for _, task := range tasks {
+		for _, tgt := range task.TypedParams.Targets {
+			dst := addrToNode[tgt.Node]
+			if dst != "node-d" {
+				t.Errorf("volume %d moved %s -> %s: only node-d is under-utilized", task.VolumeID, task.Server, tgt.Node)
+			}
+			dstOf[task.VolumeID] = dst
+		}
+		srcOf[task.VolumeID] = task.Server
+	}
+	assertNoDuplicateVolumes(t, tasks)
+
+	// Apply the planned moves and re-run detection: a volume already moved
+	// must never be picked again (the reported oscillation).
+	for _, m := range metrics {
+		if m.Server == srcOf[m.VolumeID] {
+			m.Server = dstOf[m.VolumeID]
+			m.ServerAddress = m.Server + ":8080"
+		}
+	}
+	for id, dst := range dstOf {
+		for i, loc := range replicaMap[id] {
+			if loc.NodeID == srcOf[id] {
+				replicaMap[id][i].NodeID = dst
+			}
+		}
+	}
+	for id, locs := range replicaMap {
+		seen := make(map[string]bool)
+		for _, loc := range locs {
+			if seen[loc.NodeID] {
+				t.Fatalf("volume %d ended with two replicas on %s", id, loc.NodeID)
+			}
+			seen[loc.NodeID] = true
+		}
+	}
+
+	at2 := buildTopology(servers, metrics)
+	clusterInfo2 := &types.ClusterInfo{ActiveTopology: at2, VolumeReplicaMap: replicaMap}
+	tasks2, _, err := Detection(metrics, clusterInfo2, defaultConf(), 100)
+	if err != nil {
+		t.Fatalf("second Detection failed: %v", err)
+	}
+	for _, task := range tasks2 {
+		if dstOf[task.VolumeID] != "" {
+			t.Errorf("volume %d moved again in the next detection cycle (%s)", task.VolumeID, task.Server)
+		}
+	}
+}
diff --git a/weed/worker/tasks/balance/plugin_handler.go b/weed/worker/tasks/balance/plugin_handler.go
index d271b0bd2f..51519e5ce7 100644
--- a/weed/worker/tasks/balance/plugin_handler.go
+++ b/weed/worker/tasks/balance/plugin_handler.go
@@ -13,9 +13,12 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/topology"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
 	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	workertypes "github.com/seaweedfs/seaweedfs/weed/worker/types"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/proto"
@@ -85,7 +88,7 @@ func (h *VolumeBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 						{
 							Name:        "collection_filter",
 							Label:       "Collection Filter",
-							Description: "Filter collections for balance detection. Use ALL_COLLECTIONS (default) to treat all volumes as one pool, EACH_COLLECTION to run detection separately per collection, or a regex pattern to match specific collections.",
+							Description: "Filter collections for balance detection. Use ALL_COLLECTIONS (default) to treat all volumes as one pool, EACH_COLLECTION to run detection separately per collection, or a comma-separated list of names, wildcards, or regex patterns.",
 							Placeholder: "ALL_COLLECTIONS",
 							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
 							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,
@@ -176,6 +179,14 @@ func (h *VolumeBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 							Required:    true,
 							MinValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 2}},
 						},
+						{
+							Name:        "io_byte_per_second",
+							Label:       "Move IO Limit (bytes/sec)",
+							Description: "Limit each volume move's copy's rate in bytes per second. 0 falls back to each volume server's own maintenance rate.",
+							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_INT64,
+							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_NUMBER,
+							MinValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0}},
+						},
 					},
 				},
 				{
@@ -211,6 +222,9 @@ func (h *VolumeBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 				"min_server_count": {
 					Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 2},
 				},
+				"io_byte_per_second": {
+					Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0},
+				},
 				"max_concurrent_moves": {
 					Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: int64(defaultMaxConcurrentMoves)},
 				},
@@ -238,6 +252,9 @@ func (h *VolumeBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 			"min_server_count": {
 				Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 2},
 			},
+			"io_byte_per_second": {
+				Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0},
+			},
 			"max_concurrent_moves": {
 				Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: int64(defaultMaxConcurrentMoves)},
 			},
@@ -299,7 +316,7 @@ func (h *VolumeBalanceHandler) Detect(
 	var results []*workertypes.TaskDetectionResult
 	var hasMore bool
 
-	if pluginworker.CollectionFilterMode(collectionFilter) == pluginworker.CollectionFilterEach {
+	if wildcard.CollectionFilterMode(collectionFilter) == wildcard.CollectionFilterEach {
 		// Group metrics by collection in a single pass (O(N) instead of O(C*N))
 		metricsByCollection := make(map[string][]*workertypes.VolumeHealthMetrics)
 		for _, m := range metrics {
@@ -488,7 +505,7 @@ func emitVolumeBalanceDetectionDecisionTrace(
 					for _, rack := range dc.RackInfos {
 						for _, node := range rack.DataNodeInfos {
 							for diskTypeName := range node.DiskInfos {
-								if diskTypeName == diskType {
+								if diskTypeName == diskType && !topology.IsPhantomDiskTypeEntry(node, diskTypeName) {
 									serverVolumeCounts[node.Id] = 0
 								}
 							}
@@ -724,7 +741,9 @@ func (h *VolumeBalanceHandler) executeSingleMove(
 		return err
 	}
 
-	execErr := h.checkMoveStillValid(execCtx, request.GetClusterContext().GetMasterGrpcAddresses(), params.VolumeId, params.Sources[0].Node, params.Targets[0].Node)
+	masterAddresses := request.GetClusterContext().GetMasterGrpcAddresses()
+	moveTopology := h.fetchMoveTopology(execCtx, masterAddresses)
+	execErr := h.checkMoveStillValid(execCtx, masterAddresses, moveTopology, params.VolumeId, params.Sources[0].Node, params.Targets[0].Node)
 	if execErr == nil {
 		execErr = task.Execute(execCtx, params)
 	}
@@ -778,7 +797,10 @@ func (h *VolumeBalanceHandler) executeSingleMove(
 // would overwrite and the source delete would then reduce to a single copy.
 // Without master addresses (older admin) the check is skipped and the move
 // relies on the task's own execution-time guards.
-func (h *VolumeBalanceHandler) checkMoveStillValid(ctx context.Context, masterAddresses []string, volumeID uint32, sourceNode, targetNode string) error {
+func (h *VolumeBalanceHandler) checkMoveStillValid(ctx context.Context, masterAddresses []string, topologyInfo *master_pb.TopologyInfo, volumeID uint32, sourceNode, targetNode string) error {
+	if err := checkMoveDiskType(topologyInfo, volumeID, sourceNode, targetNode); err != nil {
+		return err
+	}
 	if len(masterAddresses) == 0 {
 		glog.Warningf("volume balance: no master addresses in cluster context, skipping pre-move check for volume %d", volumeID)
 		return nil
@@ -790,6 +812,75 @@ func (h *VolumeBalanceHandler) checkMoveStillValid(ctx context.Context, masterAd
 	return checkMovePreconditions(locations, volumeID, sourceNode, targetNode)
 }
 
+// fetchMoveTopology returns the master's volume list topology so each move
+// can be checked for disk-type compatibility before copying. Returns nil if
+// the master cannot be reached; checks that need it are then skipped.
+func (h *VolumeBalanceHandler) fetchMoveTopology(ctx context.Context, masterAddresses []string) *master_pb.TopologyInfo {
+	for _, address := range masterAddresses {
+		resp, err := pluginworker.FetchVolumeList(ctx, address, h.grpcDialOption)
+		if err == nil && resp != nil && resp.TopologyInfo != nil {
+			return resp.TopologyInfo
+		}
+	}
+	return nil
+}
+
+// checkMoveDiskType rejects a move whose target lacks a disk matching the
+// volume's disk type on the source. Detection buckets candidates by disk
+// type, but jobs can be stale or submitted out-of-band; without this check
+// the copy is doomed to be rejected by the target after the source disk was
+// already read. Unknown pieces (volume or target missing from the topology)
+// skip the check and let the server's own rejection decide.
+func checkMoveDiskType(topologyInfo *master_pb.TopologyInfo, volumeID uint32, sourceNode, targetNode string) error {
+	if topologyInfo == nil {
+		return nil
+	}
+	sourceAddress := pb.ServerAddress(strings.TrimSpace(sourceNode))
+	targetAddress := pb.ServerAddress(strings.TrimSpace(targetNode))
+	volumeFound := false
+	volumeDiskType := ""
+	targetFound := false
+	targetDiskTypes := map[string]bool{}
+	for _, dc := range topologyInfo.DataCenterInfos {
+		for _, rack := range dc.RackInfos {
+			for _, node := range rack.DataNodeInfos {
+				// NewServerAddressFromDataNode covers older masters whose
+				// topology omits Address: the move nodes carry the grpc
+				// suffix derived from the plain node Id and GrpcPort.
+				nodeAddress := pb.NewServerAddressFromDataNode(node)
+				isSource := node.Id == sourceNode || pb.ServerAddress(node.Address).Equals(sourceAddress) || nodeAddress.Equals(sourceAddress)
+				isTarget := node.Id == targetNode || pb.ServerAddress(node.Address).Equals(targetAddress) || nodeAddress.Equals(targetAddress)
+				if isTarget {
+					targetFound = true
+					for diskType := range node.DiskInfos {
+						if topology.IsPhantomDiskTypeEntry(node, diskType) {
+							continue
+						}
+						targetDiskTypes[string(types.ToDiskType(diskType))] = true
+					}
+				}
+				if isSource && !volumeFound {
+					for diskType, diskInfo := range node.DiskInfos {
+						for _, v := range diskInfo.VolumeInfos {
+							if v.Id == volumeID {
+								volumeFound = true
+								volumeDiskType = diskType
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	if !volumeFound || !targetFound {
+		return nil
+	}
+	if !targetDiskTypes[string(types.ToDiskType(volumeDiskType))] {
+		return fmt.Errorf("target %s has no %s disk for volume %d", targetNode, volumeDiskType, volumeID)
+	}
+	return nil
+}
+
 func checkMovePreconditions(locations []string, volumeID uint32, sourceNode, targetNode string) error {
 	// Proposal nodes carry the grpc suffix (host:port.grpcPort) while the
 	// master reports plain host:port urls, so compare in http form.
@@ -927,6 +1018,7 @@ func (h *VolumeBalanceHandler) executeBatchMoves(
 	sem := make(chan struct{}, maxConcurrent)
 	results := make(chan moveResult, totalMoves)
 	masterAddresses := request.GetClusterContext().GetMasterGrpcAddresses()
+	moveTopology := h.fetchMoveTopology(batchCtx, masterAddresses)
 
 	for i, move := range moves {
 		sem <- struct{}{} // acquire slot
@@ -945,7 +1037,7 @@ func (h *VolumeBalanceHandler) executeBatchMoves(
 			})
 
 			moveParams := buildMoveTaskParams(m, bp)
-			err := h.checkMoveStillValid(batchCtx, masterAddresses, m.VolumeId, m.SourceNode, m.TargetNode)
+			err := h.checkMoveStillValid(batchCtx, masterAddresses, moveTopology, m.VolumeId, m.SourceNode, m.TargetNode)
 			if err == nil {
 				err = task.Execute(batchCtx, moveParams)
 			}
@@ -1017,11 +1109,13 @@ func (h *VolumeBalanceHandler) executeBatchMoves(
 func buildMoveTaskParams(move *worker_pb.BalanceMoveSpec, outerParams *worker_pb.BalanceTaskParams) *worker_pb.TaskParams {
 	timeoutSeconds := defaultBalanceTimeoutSeconds
 	forceMove := false
+	var ioBytePerSecond int64
 	if outerParams != nil {
 		if outerParams.TimeoutSeconds > 0 {
 			timeoutSeconds = outerParams.TimeoutSeconds
 		}
 		forceMove = outerParams.ForceMove
+		ioBytePerSecond = outerParams.IoBytePerSecond
 	}
 	return &worker_pb.TaskParams{
 		VolumeId:   move.VolumeId,
@@ -1035,8 +1129,9 @@ func buildMoveTaskParams(move *worker_pb.BalanceMoveSpec, outerParams *worker_pb
 		},
 		TaskParams: &worker_pb.TaskParams_BalanceParams{
 			BalanceParams: &worker_pb.BalanceTaskParams{
-				ForceMove:      forceMove,
-				TimeoutSeconds: timeoutSeconds,
+				ForceMove:       forceMove,
+				TimeoutSeconds:  timeoutSeconds,
+				IoBytePerSecond: ioBytePerSecond,
 			},
 		},
 	}
@@ -1068,6 +1163,12 @@ func deriveBalanceWorkerConfig(values map[string]*plugin_pb.ConfigValue) *volume
 	}
 	taskConfig.MinServerCount = minServerCount
 
+	ioBytePerSecond := pluginworker.ReadInt64Config(values, "io_byte_per_second", taskConfig.IoBytePerSecond)
+	if ioBytePerSecond < 0 {
+		ioBytePerSecond = 0
+	}
+	taskConfig.IoBytePerSecond = ioBytePerSecond
+
 	maxConcurrentMoves := pluginworker.ReadIntConfig(values, "max_concurrent_moves", defaultMaxConcurrentMoves)
 	if maxConcurrentMoves < 1 {
 		maxConcurrentMoves = 1
@@ -1277,13 +1378,19 @@ func buildBatchVolumeBalanceProposals(
 			continue
 		}
 
-		// Serialize batch params
+		// Serialize batch params. The io limit rides along from the detection
+		// results, which carry it from the task configuration.
+		var ioBytePerSecond int64
+		if p := batch[0].TypedParams.GetBalanceParams(); p != nil {
+			ioBytePerSecond = p.IoBytePerSecond
+		}
 		taskParams := &worker_pb.TaskParams{
 			TaskParams: &worker_pb.TaskParams_BalanceParams{
 				BalanceParams: &worker_pb.BalanceTaskParams{
 					TimeoutSeconds:     defaultBalanceTimeoutSeconds,
 					MaxConcurrentMoves: int32(maxConcurrentMoves),
 					Moves:              moves,
+					IoBytePerSecond:    ioBytePerSecond,
 				},
 			},
 		}
@@ -1399,6 +1506,7 @@ func decodeVolumeBalanceTaskParams(job *plugin_pb.JobSpec) (*worker_pb.TaskParam
 		timeoutSeconds = defaultBalanceTimeoutSeconds
 	}
 	forceMove := readBoolConfig(job.Parameters, "force_move", false)
+	ioBytePerSecond := pluginworker.ReadInt64Config(job.Parameters, "io_byte_per_second", 0)
 
 	if volumeID == 0 {
 		return nil, fmt.Errorf("missing volume_id in job parameters")
@@ -1428,8 +1536,9 @@ func decodeVolumeBalanceTaskParams(job *plugin_pb.JobSpec) (*worker_pb.TaskParam
 		},
 		TaskParams: &worker_pb.TaskParams_BalanceParams{
 			BalanceParams: &worker_pb.BalanceTaskParams{
-				ForceMove:      forceMove,
-				TimeoutSeconds: timeoutSeconds,
+				ForceMove:       forceMove,
+				TimeoutSeconds:  timeoutSeconds,
+				IoBytePerSecond: ioBytePerSecond,
 			},
 		},
 	}, nil
diff --git a/weed/worker/tasks/balance/plugin_handler_test.go b/weed/worker/tasks/balance/plugin_handler_test.go
index 2067623faf..123a0a2796 100644
--- a/weed/worker/tasks/balance/plugin_handler_test.go
+++ b/weed/worker/tasks/balance/plugin_handler_test.go
@@ -7,6 +7,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
 	pluginworker "github.com/seaweedfs/seaweedfs/weed/plugin/worker"
@@ -826,3 +827,106 @@ func TestCheckMovePreconditions(t *testing.T) {
 		})
 	}
 }
+
+func TestCheckMoveDiskType(t *testing.T) {
+	volumeOnDisk := func(id uint32) []*master_pb.VolumeInformationMessage {
+		return []*master_pb.VolumeInformationMessage{{Id: id}}
+	}
+	topologyWith := func(sourceDisks, targetDisks map[string]*master_pb.DiskInfo) *master_pb.TopologyInfo {
+		return &master_pb.TopologyInfo{DataCenterInfos: []*master_pb.DataCenterInfo{
+			{RackInfos: []*master_pb.RackInfo{{DataNodeInfos: []*master_pb.DataNodeInfo{
+				{Id: "10.0.0.1:8080.18080", Address: "10.0.0.1:8080", DiskInfos: sourceDisks},
+				{Id: "10.0.0.2:8080.18080", Address: "10.0.0.2:8080", DiskInfos: targetDisks},
+			}}}},
+		}}
+	}
+	oldTopologyWith := func(sourceDisks, targetDisks map[string]*master_pb.DiskInfo) *master_pb.TopologyInfo {
+		return &master_pb.TopologyInfo{DataCenterInfos: []*master_pb.DataCenterInfo{
+			{RackInfos: []*master_pb.RackInfo{{DataNodeInfos: []*master_pb.DataNodeInfo{
+				{Id: "10.0.0.1:8080", GrpcPort: 18080, DiskInfos: sourceDisks},
+				{Id: "10.0.0.2:8080", GrpcPort: 18080, DiskInfos: targetDisks},
+			}}}},
+		}}
+	}
+
+	tests := []struct {
+		name       string
+		topology   *master_pb.TopologyInfo
+		volumeID   uint32
+		sourceNode string
+		targetNode string
+		wantErr    string
+	}{
+		{
+			name: "same disk type allowed",
+			topology: topologyWith(
+				map[string]*master_pb.DiskInfo{"backup-hdd": {VolumeInfos: volumeOnDisk(5)}},
+				map[string]*master_pb.DiskInfo{"backup-hdd": {}}),
+			volumeID: 5, sourceNode: "10.0.0.1:8080.18080", targetNode: "10.0.0.2:8080.18080",
+		},
+		{
+			name: "target without matching disk type rejected",
+			topology: topologyWith(
+				map[string]*master_pb.DiskInfo{"backup-hdd": {VolumeInfos: volumeOnDisk(5)}},
+				map[string]*master_pb.DiskInfo{"ssd": {}}),
+			volumeID: 5, sourceNode: "10.0.0.1:8080.18080", targetNode: "10.0.0.2:8080.18080",
+			wantErr: "has no backup-hdd disk",
+		},
+		{
+			name: "unknown volume skips check",
+			topology: topologyWith(
+				map[string]*master_pb.DiskInfo{"backup-hdd": {}},
+				map[string]*master_pb.DiskInfo{"ssd": {}}),
+			volumeID: 7, sourceNode: "10.0.0.1:8080.18080", targetNode: "10.0.0.2:8080.18080",
+		},
+		{
+			name: "unknown target skips check",
+			topology: topologyWith(
+				map[string]*master_pb.DiskInfo{"backup-hdd": {VolumeInfos: volumeOnDisk(5)}},
+				nil),
+			volumeID: 5, sourceNode: "10.0.0.1:8080.18080", targetNode: "10.0.0.9:8080.18080",
+		},
+		{
+			name:     "nil topology skips check",
+			topology: nil,
+			volumeID: 5, sourceNode: "10.0.0.1:8080.18080", targetNode: "10.0.0.2:8080.18080",
+		},
+		{
+			name: "nodes matched by address without grpc suffix",
+			topology: topologyWith(
+				map[string]*master_pb.DiskInfo{"backup-hdd": {VolumeInfos: volumeOnDisk(5)}},
+				map[string]*master_pb.DiskInfo{"ssd": {}}),
+			volumeID: 5, sourceNode: "10.0.0.1:8080", targetNode: "10.0.0.2:8080",
+			wantErr: "has no backup-hdd disk",
+		},
+		{
+			name: "old topology nodes matched via id and grpc port",
+			topology: oldTopologyWith(
+				map[string]*master_pb.DiskInfo{"backup-hdd": {VolumeInfos: volumeOnDisk(5)}},
+				map[string]*master_pb.DiskInfo{"ssd": {}}),
+			volumeID: 5, sourceNode: "10.0.0.1:8080.18080", targetNode: "10.0.0.2:8080.18080",
+			wantErr: "has no backup-hdd disk",
+		},
+		{
+			name: "old topology allows matching disk type",
+			topology: oldTopologyWith(
+				map[string]*master_pb.DiskInfo{"backup-hdd": {VolumeInfos: volumeOnDisk(5)}},
+				map[string]*master_pb.DiskInfo{"backup-hdd": {}}),
+			volumeID: 5, sourceNode: "10.0.0.1:8080.18080", targetNode: "10.0.0.2:8080.18080",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := checkMoveDiskType(tt.topology, tt.volumeID, tt.sourceNode, tt.targetNode)
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("expected error containing %q, got %v", tt.wantErr, err)
+			}
+		})
+	}
+}
diff --git a/weed/worker/tasks/balance/replica_placement_test.go b/weed/worker/tasks/balance/replica_placement_test.go
index baa8f1eb71..9afd0af9cd 100644
--- a/weed/worker/tasks/balance/replica_placement_test.go
+++ b/weed/worker/tasks/balance/replica_placement_test.go
@@ -219,6 +219,9 @@ func TestPlanBalanceDestination_ChoosesBestValidCompositeDestination(t *testing.
 	}
 }
 
+// The score-based fallback runs when the loop-chosen target cannot be
+// resolved (here: a node absent from the topology), and must still pick a
+// destination that satisfies the volume's replica placement.
 func TestCreateBalanceTask_FallbackSelectsValidCompositeDestination(t *testing.T) {
 	servers := []serverSpec{
 		{id: "node-a", diskType: "hdd", diskID: 1, dc: "dc1", rack: "rack1"},
@@ -237,20 +240,49 @@ func TestCreateBalanceTask_FallbackSelectsValidCompositeDestination(t *testing.T
 		},
 	}
 
+	task, destination := createBalanceTask("hdd", volumes[0], clusterInfo, "node-x", map[string]int{
+		"node-b": 0,
+		"node-c": 0,
+	}, 0)
+	if task == nil {
+		t.Fatal("expected a balance task")
+	}
+	if destination != "node-c" {
+		t.Fatalf("expected fallback destination node-c, got %s", destination)
+	}
+	if len(task.TypedParams.Targets) != 1 {
+		t.Fatalf("expected 1 target, got %d", len(task.TypedParams.Targets))
+	}
+	if got := task.TypedParams.Targets[0].Node; got != "node-c:8080" {
+		t.Fatalf("expected target node-c:8080, got %s", got)
+	}
+}
+
+// A resolvable but invalid loop-chosen target (rp=011 cannot add a third
+// rack) must skip the volume rather than redirect it to another server.
+func TestCreateBalanceTask_SkipsWhenTargetViolatesPlacement(t *testing.T) {
+	servers := []serverSpec{
+		{id: "node-a", diskType: "hdd", diskID: 1, dc: "dc1", rack: "rack1"},
+		{id: "node-b", diskType: "hdd", diskID: 2, dc: "dc1", rack: "rack3"},
+		{id: "node-c", diskType: "hdd", diskID: 3, dc: "dc1", rack: "rack1"},
+	}
+	volumes := makeVolumesWith("node-a", "hdd", "dc1", "rack1", "c1", 1, 1, withReplicas(11))
+	clusterInfo := &types.ClusterInfo{
+		ActiveTopology: buildTopology(servers, volumes),
+		VolumeReplicaMap: map[uint32][]types.ReplicaLocation{
+			1: {
+				loc("dc1", "rack1", "node-a"),
+				loc("dc1", "rack1", "node-d"),
+				loc("dc1", "rack2", "node-e"),
+			},
+		},
+	}
+
 	task, destination := createBalanceTask("hdd", volumes[0], clusterInfo, "node-b", map[string]int{
 		"node-b": 0,
 		"node-c": 0,
-	})
-	if task == nil {
-		t.Fatal("expected a balance task")
-	}
-	if destination != "node-c" {
-		t.Fatalf("expected fallback destination node-c, got %s", destination)
-	}
-	if len(task.TypedParams.Targets) != 1 {
-		t.Fatalf("expected 1 target, got %d", len(task.TypedParams.Targets))
-	}
-	if got := task.TypedParams.Targets[0].Node; got != "node-c:8080" {
-		t.Fatalf("expected target node-c:8080, got %s", got)
+	}, 0)
+	if task != nil || destination != "" {
+		t.Fatalf("expected no task when the chosen target violates replica placement, got task=%v dest=%s", task != nil, destination)
 	}
 }
diff --git a/weed/worker/tasks/base/generic_components.go b/weed/worker/tasks/base/generic_components.go
index 0a41bbd76d..3a2f9c7037 100644
--- a/weed/worker/tasks/base/generic_components.go
+++ b/weed/worker/tasks/base/generic_components.go
@@ -42,6 +42,18 @@ func (d *GenericDetector) IsEnabled() bool {
 	return d.taskDef.Config.IsEnabled()
 }
 
+// SetEnabled turns detection for this task type on or off.
+//
+// The admin maintenance policy is applied to detectors through an
+// interface{ SetEnabled(bool) } type assertion (see
+// MaintenanceIntegration.configureDetectorFromPolicy). Every registered task is
+// backed by this generic detector, so without this method that assertion failed
+// for every task and the policy never reached the flag that
+// ScanWithTaskDetectors actually gates on.
+func (d *GenericDetector) SetEnabled(enabled bool) {
+	d.taskDef.Config.SetEnabled(enabled)
+}
+
 // GenericScheduler implements TaskScheduler using function-based logic
 type GenericScheduler struct {
 	taskDef *TaskDefinition
@@ -127,3 +139,22 @@ func (s *GenericScheduler) GetDefaultRepeatInterval() time.Duration {
 func (s *GenericScheduler) IsEnabled() bool {
 	return s.taskDef.Config.IsEnabled()
 }
+
+// SetEnabled turns scheduling for this task type on or off. Detector and scheduler
+// share one TaskDefinition, so this is the same flag GenericDetector.SetEnabled sets;
+// both setters exist because the maintenance integration configures the two
+// independently. See GenericDetector.SetEnabled.
+func (s *GenericScheduler) SetEnabled(enabled bool) {
+	s.taskDef.Config.SetEnabled(enabled)
+}
+
+// SetMaxConcurrent applies the policy's concurrency limit for this task type. It is
+// the value GetMaxConcurrent returns, which the maintenance queue uses to decide
+// whether another task of this type may start. Non-positive limits are ignored
+// rather than turning into the implicit default of 1.
+func (s *GenericScheduler) SetMaxConcurrent(maxConcurrent int) {
+	if maxConcurrent <= 0 {
+		return
+	}
+	s.taskDef.MaxConcurrent = maxConcurrent
+}
diff --git a/weed/worker/tasks/ec_balance/config.go b/weed/worker/tasks/ec_balance/config.go
index 16515bae47..33780cdbed 100644
--- a/weed/worker/tasks/ec_balance/config.go
+++ b/weed/worker/tasks/ec_balance/config.go
@@ -17,7 +17,8 @@ type Config struct {
 	CollectionFilter   string   `json:"collection_filter"`
 	DiskType           string   `json:"disk_type"`
 	PreferredTags      []string `json:"preferred_tags"`
-	ReplicaPlacement   string   `json:"replica_placement"` // e.g. "020"; empty falls back to the master default replication (even spread only when that default is empty or zero)
+	ReplicaPlacement   string   `json:"replica_placement"`  // e.g. "020"; empty falls back to the master default replication (even spread only when that default is empty or zero)
+	IoBytePerSecond    int64    `json:"io_byte_per_second"` // limit each shard copy's rate; 0 falls back to the volume server's maintenance rate
 	DataCenterFilter   string   `json:"-"`                  // per-detection-run, not persisted
 }
 
@@ -124,9 +125,9 @@ func GetConfigSpec() base.ConfigSpec {
 				DefaultValue: "",
 				Required:     false,
 				DisplayName:  "Collection Filter",
-				Description:  "Only balance EC shards from specific collections",
-				HelpText:     "Leave empty to balance all collections, or specify collection name/wildcard",
-				Placeholder:  "my_collection",
+				Description:  "Only balance EC shards from specific collections (comma-separated names, wildcards, or regex patterns)",
+				HelpText:     "Leave empty to balance all collections, or list the collections to balance",
+				Placeholder:  "pictures,videos",
 				InputType:    "text",
 				CSSClasses:   "form-control",
 			},
@@ -169,6 +170,21 @@ func GetConfigSpec() base.ConfigSpec {
 				InputType:    "text",
 				CSSClasses:   "form-control",
 			},
+			{
+				Name:         "io_byte_per_second",
+				JSONName:     "io_byte_per_second",
+				Type:         config.FieldTypeInt,
+				DefaultValue: 0,
+				MinValue:     0,
+				Required:     false,
+				DisplayName:  "Shard Copy IO Limit (bytes/sec)",
+				Description:  "Limit each EC shard copy's rate",
+				HelpText:     "0 falls back to each volume server's own maintenance rate (-maintenanceBytePerSecond)",
+				Placeholder:  "0 (server maintenance rate)",
+				Unit:         config.UnitNone,
+				InputType:    "number",
+				CSSClasses:   "form-control",
+			},
 		},
 	}
 }
@@ -189,6 +205,7 @@ func (c *Config) ToTaskPolicy() *worker_pb.TaskPolicy {
 				DiskType:           c.DiskType,
 				PreferredTags:      preferredTagsCopy,
 				ReplicaPlacement:   c.ReplicaPlacement,
+				IoBytePerSecond:    c.IoBytePerSecond,
 			},
 		},
 	}
@@ -211,6 +228,7 @@ func (c *Config) FromTaskPolicy(policy *worker_pb.TaskPolicy) error {
 		c.DiskType = ecbConfig.DiskType
 		c.PreferredTags = append([]string(nil), ecbConfig.PreferredTags...)
 		c.ReplicaPlacement = ecbConfig.ReplicaPlacement
+		c.IoBytePerSecond = ecbConfig.IoBytePerSecond
 	}
 
 	return nil
@@ -223,12 +241,25 @@ func LoadConfigFromPersistence(configPersistence interface{}) *Config {
 	if persistence, ok := configPersistence.(interface {
 		LoadEcBalanceTaskPolicy() (*worker_pb.TaskPolicy, error)
 	}); ok {
-		if policy, err := persistence.LoadEcBalanceTaskPolicy(); err == nil && policy != nil {
-			if err := cfg.FromTaskPolicy(policy); err == nil {
+		policy, err := persistence.LoadEcBalanceTaskPolicy()
+		switch {
+		case err != nil:
+			glog.Warningf("Could not read the persisted EC balance configuration, falling back to defaults: %v", err)
+		case policy == nil:
+			glog.V(1).Infof("No EC balance configuration persisted yet, using defaults")
+		default:
+			if err := cfg.FromTaskPolicy(policy); err != nil {
+				glog.Warningf("Could not apply the persisted EC balance configuration, falling back to defaults: %v", err)
+			} else {
 				glog.V(1).Infof("Loaded EC balance configuration from persistence")
 				return cfg
 			}
 		}
+	} else if configPersistence != nil {
+		// A store was handed in but does not expose the accessor, so the persisted
+		// settings are silently ignored - always a wiring bug, never a normal state.
+		glog.Warningf("%T cannot provide the persisted EC balance configuration: it has no LoadEcBalanceTaskPolicy() method, "+
+			"so the compiled-in defaults are used and any saved EC balance settings are ignored", configPersistence)
 	}
 
 	glog.V(1).Infof("Using default EC balance configuration")
diff --git a/weed/worker/tasks/ec_balance/dedup_safety_test.go b/weed/worker/tasks/ec_balance/dedup_safety_test.go
new file mode 100644
index 0000000000..350c238b3b
--- /dev/null
+++ b/weed/worker/tasks/ec_balance/dedup_safety_test.go
@@ -0,0 +1,128 @@
+package ec_balance
+
+import (
+	"context"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+)
+
+// The dedup phase deletes a shard it believes is duplicated elsewhere. It picks
+// its victims from the master's topology, and the topology can name a location
+// that holds nothing: a volume server answering "not found ec volume id N" for
+// a shard the master lists is the observable form of that. Deleting on the
+// strength of a phantom peer removes the only real copy.
+//
+// The move phase already refuses to work on trust — it verifies the shard
+// registered on the destination before removing the source. These tests hold
+// dedup to the same standard, because it is the more dangerous of the two: it
+// deletes without copying anything first.
+
+const (
+	dedupTestVolumeID   = uint32(42561)
+	dedupTestCollection = "pm-itatiaiucu-01"
+)
+
+func dedupParams(sourceNode, keepNode string, shardID uint32) *worker_pb.TaskParams {
+	// Dedup is signalled by source and target being the same node and disk.
+	loc := &worker_pb.TaskSource{Node: sourceNode, DiskId: 0, ShardIds: []uint32{shardID}}
+	return &worker_pb.TaskParams{
+		VolumeId:   dedupTestVolumeID,
+		Collection: dedupTestCollection,
+		Sources:    []*worker_pb.TaskSource{loc},
+		Targets:    []*worker_pb.TaskTarget{{Node: sourceNode, DiskId: 0, ShardIds: []uint32{shardID}}},
+		// The dedup branch is only reachable when EC params are present; without
+		// them the job silently takes the copy-and-move path instead.
+		TaskParams: &worker_pb.TaskParams_EcBalanceParams{
+			EcBalanceParams: &worker_pb.EcBalanceTaskParams{DedupKeepNode: keepNode},
+		},
+	}
+}
+
+func newDedupTask() *ECBalanceTask {
+	return NewECBalanceTask("dedup-test", dedupTestVolumeID, dedupTestCollection,
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+}
+
+// The failure that cost this cluster shards: the topology claims shard 0 lives
+// on two nodes, only one of them actually has it, and dedup is pointed at the
+// one that does. Nothing else in the cluster holds shard 0, so deleting it is
+// unrecoverable — and no copy was made first, because dedup never makes one.
+func TestDedupRefusesToDeleteTheOnlyRealCopy(t *testing.T) {
+	holder := startFakeEcVolumeServer(t, dedupTestVolumeID, 0)
+	// The peer the topology believes also has shard 0. Its disks are empty,
+	// exactly like a server answering "not found ec volume id".
+	phantom := startFakeEcVolumeServer(t, dedupTestVolumeID)
+
+	if !holder.has(dedupTestVolumeID, 0) {
+		t.Fatal("precondition: holder should start with shard 0")
+	}
+	if phantom.has(dedupTestVolumeID, 0) {
+		t.Fatal("precondition: phantom should hold nothing")
+	}
+
+	err := newDedupTask().Execute(context.Background(), dedupParams(holder.address(), phantom.address(), 0))
+
+	if holder.has(dedupTestVolumeID, 0) {
+		return // refused, or verified and backed off — either is safe
+	}
+	t.Fatalf("dedup deleted the only copy of shard %d.0 (deleted=%v, err=%v); "+
+		"the surviving copy was never confirmed to exist",
+		dedupTestVolumeID, holder.deletedShards(), err)
+}
+
+// A shard genuinely present on two servers is safe to thin out: one copy is
+// redundant and removing it loses nothing. Dedup has to keep working here, or
+// the guard above has simply disabled the feature.
+func TestDedupRemovesAGenuineDuplicate(t *testing.T) {
+	victim := startFakeEcVolumeServer(t, dedupTestVolumeID, 0)
+	survivor := startFakeEcVolumeServer(t, dedupTestVolumeID, 0)
+
+	if err := newDedupTask().Execute(context.Background(), dedupParams(victim.address(), survivor.address(), 0)); err != nil {
+		t.Fatalf("dedup of a real duplicate should succeed, got %v", err)
+	}
+	if victim.has(dedupTestVolumeID, 0) {
+		t.Error("dedup left the duplicate in place; capacity is not reclaimed")
+	}
+	if !survivor.has(dedupTestVolumeID, 0) {
+		t.Error("dedup removed the surviving copy instead of the duplicate")
+	}
+}
+
+// An unreachable peer is not evidence of a surviving copy. Treating a failed
+// query as "the other side has it" is how a network blip becomes data loss.
+func TestDedupRefusesWhenThePeerCannotBeQueried(t *testing.T) {
+	holder := startFakeEcVolumeServer(t, dedupTestVolumeID, 0)
+	unreachable := startFakeEcVolumeServer(t, dedupTestVolumeID, 0)
+	unreachable.stop() // peer down; its inventory is unknown, not empty
+
+	err := newDedupTask().Execute(context.Background(), dedupParams(holder.address(), unreachable.address(), 0))
+
+	if holder.has(dedupTestVolumeID, 0) {
+		return // kept the shard while the peer's state is unknown
+	}
+	t.Fatalf("dedup deleted shard %d.0 while the peer was unreachable (deleted=%v, err=%v)",
+		dedupTestVolumeID, holder.deletedShards(), err)
+}
+
+// Volume ids are allocated cluster-wide, but the inventory RPC is keyed by
+// volume id alone, so a server holding the same number for a different
+// collection answers "yes, I have that shard" to a question about this one.
+// Accepting that would delete the last real copy on the strength of an
+// unrelated volume.
+func TestDedupRefusesWhenTheKeepNodeHoldsAnotherCollection(t *testing.T) {
+	holder := startFakeEcVolumeServer(t, dedupTestVolumeID, 0)
+	// Same volume id, different collection: a plausible-looking but wrong match.
+	impostor := startFakeEcVolumeServerInCollection(t, "morro-agudo-01", dedupTestVolumeID, 0)
+
+	err := newDedupTask().Execute(context.Background(), dedupParams(holder.address(), impostor.address(), 0))
+
+	if holder.has(dedupTestVolumeID, 0) {
+		return // refused: the keep node's shard belongs to another collection
+	}
+	t.Fatalf("dedup deleted shard %d.0 after matching another collection's volume (deleted=%v, err=%v)",
+		dedupTestVolumeID, holder.deletedShards(), err)
+}
diff --git a/weed/worker/tasks/ec_balance/detection.go b/weed/worker/tasks/ec_balance/detection.go
index 6d55b23cb2..b74f2bf289 100644
--- a/weed/worker/tasks/ec_balance/detection.go
+++ b/weed/worker/tasks/ec_balance/detection.go
@@ -3,8 +3,10 @@ package ec_balance
 import (
 	"context"
 	"fmt"
+	"slices"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/admin/topology"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
@@ -48,7 +50,12 @@ func Detection(
 		return nil, false, fmt.Errorf("topology info not available")
 	}
 
-	topo, nodeCount, volumeRatio := buildBalancerTopology(topoInfo, ecConfig)
+	allowedCollections, err := wildcard.CompileCollectionMatcher(ecConfig.CollectionFilter)
+	if err != nil {
+		return nil, false, err
+	}
+
+	topo, nodeCount, volumeRatio := buildBalancerTopology(topoInfo, ecConfig, allowedCollections)
 	if nodeCount < ecConfig.MinServerCount {
 		glog.V(1).Infof("EC balance: only %d servers, need at least %d", nodeCount, ecConfig.MinServerCount)
 		return nil, false, nil
@@ -82,6 +89,9 @@ func Detection(
 		GlobalMaxMovesPerRack: 10,
 		// Balance heterogeneous-capacity racks by fractional fullness.
 		GlobalUtilizationBased: true,
+		RackTotalCapRaised: func(collection string, vid uint32, rackCap, evenCap int) {
+			glog.Warningf("EC volume %d (collection %q): rack-total-cap raised to %d shards per rack, above the even %d: the racks lack room for an even spread", vid, collection, rackCap, evenCap)
+		},
 	})
 	if len(moves) == 0 {
 		return nil, false, nil
@@ -126,8 +136,10 @@ func Detection(
 				}},
 				TaskParams: &worker_pb.TaskParams_EcBalanceParams{
 					EcBalanceParams: &worker_pb.EcBalanceTaskParams{
-						DiskType:       normalizedDiskType,
-						TimeoutSeconds: 600,
+						DiskType:        normalizedDiskType,
+						DedupKeepNode:   m.KeepNode,
+						TimeoutSeconds:  600,
+						IoBytePerSecond: ecConfig.IoBytePerSecond,
 					},
 				},
 			},
@@ -146,9 +158,8 @@ func Detection(
 // per-volume ratio lookup built from each shard's heartbeat (0,0 when unreported,
 // e.g. always in OSS) which Plan prefers over the collection ratio for mixed-ratio
 // clusters.
-func buildBalancerTopology(topoInfo *master_pb.TopologyInfo, config *Config) (*ecbalancer.Topology, int, func(collection string, vid uint32) (int, int)) {
+func buildBalancerTopology(topoInfo *master_pb.TopologyInfo, config *Config, allowedCollections *wildcard.CollectionMatcher) (*ecbalancer.Topology, int, func(collection string, vid uint32) (int, int)) {
 	topo := ecbalancer.NewTopology()
-	allowedCollections := wildcard.CompileWildcardMatchers(config.CollectionFilter)
 
 	type volRatioKey struct {
 		collection string
@@ -177,6 +188,7 @@ func buildBalancerTopology(topoInfo *master_pb.TopologyInfo, config *Config) (*e
 
 			for _, dn := range rack.DataNodeInfos {
 				freeSlots := 0
+				freeByType := make(map[string]int)    // disk type -> free EC slots
 				diskTypeOf := make(map[uint32]string) // physical disk_id -> disk type
 				diskShardCount := make(map[uint32]int)
 				fullDiskTypes := make(map[string]bool) // physically near-full, ineligible as a target
@@ -186,6 +198,9 @@ func buildBalancerTopology(topoInfo *master_pb.TopologyInfo, config *Config) (*e
 					if filterByDiskType && diskType != wantDiskType {
 						continue
 					}
+					if topology.IsPhantomDiskTypeEntry(dn, diskType) {
+						continue
+					}
 					hasMatchingDisk = true
 
 					// Don't place EC shards on a physically near-full disk, even if slot
@@ -198,6 +213,7 @@ func buildBalancerTopology(topoInfo *master_pb.TopologyInfo, config *Config) (*e
 					fs := int(diskInfo.MaxVolumeCount-diskInfo.VolumeCount)*erasure_coding.DataShardsCount - countEcShards(diskInfo.EcShardInfos)
 					if fs > 0 && !fullDiskTypes[diskType] {
 						freeSlots += fs
+						freeByType[diskType] += fs
 					}
 					// Discover physical disks from regular volumes too, so an
 					// EC-empty disk is still a candidate destination.
@@ -225,23 +241,33 @@ func buildBalancerTopology(topoInfo *master_pb.TopologyInfo, config *Config) (*e
 				// machines, not just nodes (servers on one host are one fault domain).
 				node.SetHost(pb.NewServerAddressFromDataNode(dn).ToHost())
 
-				// Spread the node's free slots only over its non-full disks, so a
-				// physically full disk type doesn't dilute the share the usable disks
-				// advertise (its own disks get 0 below). The total is preserved.
-				nonFullDiskCount := 0
+				// Spread each disk type's free slots over that type's non-full
+				// disks, so a physically full disk type doesn't dilute the share
+				// the usable disks advertise (its own disks get 0 below) and other
+				// types don't inflate it. Ceil division keeps the remainder on the
+				// first disks instead of dropping it.
+				nonFullByType := make(map[string]int)
 				for _, dt := range diskTypeOf {
 					if !fullDiskTypes[dt] {
-						nonFullDiskCount++
+						nonFullByType[dt]++
 					}
 				}
-				perDiskFree := 0
-				if nonFullDiskCount > 0 && freeSlots > 0 {
-					perDiskFree = freeSlots / nonFullDiskCount
+				var diskIDs []uint32
+				for diskID := range diskTypeOf {
+					diskIDs = append(diskIDs, diskID)
 				}
-				for diskID, diskType := range diskTypeOf {
-					diskFree := perDiskFree
-					if fullDiskTypes[diskType] {
-						diskFree = 0
+				slices.Sort(diskIDs)
+				remainingByType := make(map[string]int, len(freeByType))
+				for dt, free := range freeByType {
+					remainingByType[dt] = free
+				}
+				for _, diskID := range diskIDs {
+					diskType := diskTypeOf[diskID]
+					diskFree := 0
+					if count := nonFullByType[diskType]; !fullDiskTypes[diskType] && count > 0 {
+						diskFree = (remainingByType[diskType] + count - 1) / count
+						remainingByType[diskType] -= diskFree
+						nonFullByType[diskType]--
 					}
 					node.AddDisk(diskID, diskType, diskFree, diskShardCount[diskID])
 				}
@@ -253,7 +279,7 @@ func buildBalancerTopology(topoInfo *master_pb.TopologyInfo, config *Config) (*e
 						continue
 					}
 					for _, eci := range diskInfo.EcShardInfos {
-						if len(allowedCollections) > 0 && !wildcard.MatchesAnyWildcard(allowedCollections, eci.Collection) {
+						if !allowedCollections.Matches(eci.Collection) {
 							continue
 						}
 						node.AddShards(eci.Id, eci.Collection, eci.DiskId, erasure_coding.ShardBits(eci.EcIndexBits))
diff --git a/weed/worker/tasks/ec_balance/detection_test.go b/weed/worker/tasks/ec_balance/detection_test.go
index 0bfdec5b41..2770fdcc8a 100644
--- a/weed/worker/tasks/ec_balance/detection_test.go
+++ b/weed/worker/tasks/ec_balance/detection_test.go
@@ -8,6 +8,7 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding/ecbalancer"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 )
 
@@ -41,7 +42,7 @@ func ecTopo(node1Collection string) *master_pb.TopologyInfo {
 
 func TestBuildBalancerTopology(t *testing.T) {
 	config := NewDefaultConfig()
-	topo, nodeCount, _ := buildBalancerTopology(ecTopo("col1"), config)
+	topo, nodeCount, _ := buildBalancerTopology(ecTopo("col1"), config, nil)
 	if nodeCount != 2 {
 		t.Fatalf("nodeCount = %d, want 2", nodeCount)
 	}
@@ -77,7 +78,7 @@ func TestBuildBalancerTopologyGroupsByHost(t *testing.T) {
 		}},
 	}
 
-	topo, _, _ := buildBalancerTopology(topoInfo, NewDefaultConfig())
+	topo, _, _ := buildBalancerTopology(topoInfo, NewDefaultConfig(), nil)
 	moves := ecbalancer.Plan(topo, ecbalancer.Options{ImbalanceThreshold: 0.01})
 
 	host := func(nodeID string) string { h, _, _ := net.SplitHostPort(nodeID); return h }
@@ -99,7 +100,11 @@ func TestBuildBalancerTopologyGroupsByHost(t *testing.T) {
 func TestBuildBalancerTopologyCollectionFilter(t *testing.T) {
 	config := NewDefaultConfig()
 	config.CollectionFilter = "other" // does not match the volume's collection
-	topo, nodeCount, _ := buildBalancerTopology(ecTopo("col1"), config)
+	allowed, err := wildcard.CompileCollectionMatcher(config.CollectionFilter)
+	if err != nil {
+		t.Fatalf("CompileCollectionMatcher: %v", err)
+	}
+	topo, nodeCount, _ := buildBalancerTopology(ecTopo("col1"), config, allowed)
 	if nodeCount != 2 {
 		t.Fatalf("nodeCount = %d, want 2", nodeCount)
 	}
diff --git a/weed/worker/tasks/ec_balance/ec_balance_task.go b/weed/worker/tasks/ec_balance/ec_balance_task.go
index 5fbb404c00..206c412a0a 100644
--- a/weed/worker/tasks/ec_balance/ec_balance_task.go
+++ b/weed/worker/tasks/ec_balance/ec_balance_task.go
@@ -8,18 +8,20 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
-	"github.com/seaweedfs/seaweedfs/weed/operation"
+	"github.com/seaweedfs/seaweedfs/weed/operation/volume_move"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
-	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types/base"
 	"google.golang.org/grpc"
 )
 
 // ECBalanceTask implements a single EC shard move operation.
-// The move sequence is: copy+mount on dest → unmount on source → delete on source.
+// The move sequence — copy+mount on dest, verify the dest registered the
+// shards, then unmount+delete on the source — is shared with the shell's
+// ec.balance command via weed/operation/volume_move.
 type ECBalanceTask struct {
 	*base.BaseTask
 	volumeID       uint32
@@ -39,8 +41,7 @@ func NewECBalanceTask(id string, volumeID uint32, collection string, grpcDialOpt
 	}
 }
 
-// Execute performs the EC shard move operation using the same RPC sequence
-// as the shell ec.balance command's moveMountedShardToEcNode function.
+// Execute performs the EC shard move operation.
 func (t *ECBalanceTask) Execute(ctx context.Context, params *worker_pb.TaskParams) error {
 	if params == nil {
 		return fmt.Errorf("task parameters are required")
@@ -62,6 +63,13 @@ func (t *ECBalanceTask) Execute(ctx context.Context, params *worker_pb.TaskParam
 
 	sourceAddr := pb.ServerAddress(source.Node)
 	targetAddr := pb.ServerAddress(target.Node)
+	// Range-check before the uint8 narrowing in Uint32ToShardIds: a malformed
+	// id like 259 would otherwise alias shard 3 and copy/delete a real,
+	// unrelated shard.
+	if err := checkShardIdRange(source.ShardIds); err != nil {
+		return err
+	}
+	shardIds := erasure_coding.Uint32ToShardIds(source.ShardIds)
 
 	ecParams := params.GetEcBalanceParams()
 
@@ -74,12 +82,12 @@ func (t *ECBalanceTask) Execute(ctx context.Context, params *worker_pb.TaskParam
 
 	isDedupDelete := ecParams != nil && isDedupPhase(params)
 
-	// Guard against a same-node, cross-disk "move". copyAndMountShard skips the
-	// copy when source and target addresses match, but deleteShard is node-wide
-	// (it removes the shard from every disk on the node), so this sequence would
-	// erase the shard after never copying it. EC shards also cannot be relocated
-	// between disks of one node via these RPCs, so such a move is meaningless.
-	// Reject it rather than lose data.
+	// Guard against a same-node, cross-disk "move". The shared mover skips the
+	// copy when source and target addresses match, but the EC shard delete is
+	// node-wide (it removes the shard from every disk on the node), so this
+	// sequence would erase the shard after never copying it. EC shards also
+	// cannot be relocated between disks of one node via these RPCs, so such a
+	// move is meaningless. Reject it rather than lose data.
 	if source.Node == target.Node && source.DiskId != target.DiskId {
 		return fmt.Errorf("refusing same-node cross-disk EC shard move for volume %d shard(s) %v on %s (source disk %d, target disk %d): EC shard delete is node-wide and would erase the shard after a skipped copy",
 			params.VolumeId, source.ShardIds, source.Node, source.DiskId, target.DiskId)
@@ -88,140 +96,71 @@ func (t *ECBalanceTask) Execute(ctx context.Context, params *worker_pb.TaskParam
 	glog.Infof("EC balance: moving shard(s) %v of volume %d from %s to %s",
 		source.ShardIds, params.VolumeId, source.Node, target.Node)
 
+	mover := volume_move.NewMover(t.grpcDialOption)
+
 	// For dedup, we only unmount+delete from source (no copy needed)
 	if isDedupDelete {
-		return t.executeDedupDelete(ctx, params.VolumeId, sourceAddr, source.ShardIds)
+		// Nothing is copied first, so the shard surviving elsewhere is the
+		// only thing making this safe — and the plan asserting so is not
+		// evidence. The topology can name a location that holds nothing, and
+		// deleting on that basis removes the last copy. Confirm the keep node
+		// has it before deleting here.
+		if err := t.verifyShardsOnKeepNode(ctx, params.VolumeId, ecParams.GetDedupKeepNode(), source.ShardIds); err != nil {
+			return err
+		}
+		t.reportProgress(25.0, "Removing duplicate EC shard")
+		if err := mover.RemoveEcShards(ctx, needle.VolumeId(params.VolumeId), t.collection, sourceAddr, shardIds); err != nil {
+			return fmt.Errorf("remove duplicate shard: %w", err)
+		}
+		t.reportProgress(100.0, "Duplicate shard removed")
+		return nil
 	}
 
-	// Step 1: Copy shard to destination and mount
-	t.reportProgress(10.0, "Copying EC shard to destination")
-	if err := t.copyAndMountShard(ctx, params.VolumeId, sourceAddr, targetAddr, source.ShardIds, target.DiskId); err != nil {
-		return fmt.Errorf("copy and mount shard: %w", err)
+	move := volume_move.EcShardMove{
+		VolumeId:   needle.VolumeId(params.VolumeId),
+		Collection: params.Collection,
+		ShardIds:   shardIds,
+		Source:     sourceAddr,
+		Target:     targetAddr,
+		TargetDisk: target.DiskId,
 	}
-
-	// Step 1.5: confirm the destination actually registered the shard(s)
-	// before removing them from the source. A copy/mount RPC can return OK
-	// while the shard isn't loadable on the destination; deleting the source
-	// then would lose the shard. On a mismatch we keep the source so the
-	// scanner retries (the move is reported failed).
-	t.reportProgress(40.0, "Verifying EC shard(s) on destination")
-	if err := t.verifyShardsOnDestination(ctx, params.VolumeId, targetAddr, source.ShardIds); err != nil {
+	opts := volume_move.EcMoveOptions{
+		IoBytePerSecond: ecParams.GetIoBytePerSecond(),
+		Progress:        t.reportProgress,
+	}
+	err := mover.MoveEcShards(ctx, move, opts)
+	// A "no space left" refusal to a pinned disk convicts only that disk;
+	// retry once letting the server pick any disk on the same node. The
+	// planner's node choice stands; only the intra-node disk defers to the
+	// server's live view. When the node is truly full, the retry fails with
+	// the same error.
+	if err != nil && target.DiskId > 0 && volume_move.IsNoSpaceLeftError(err) {
+		glog.Infof("EC balance: %s disk %d has no space left; retrying with server-picked disk", target.Node, target.DiskId)
+		move.TargetDisk = 0
+		err = mover.MoveEcShards(ctx, move, opts)
+	}
+	if err != nil {
 		return err
 	}
 
-	// Step 2: Unmount shard on source
-	t.reportProgress(50.0, "Unmounting EC shard from source")
-	if err := t.unmountShard(ctx, params.VolumeId, sourceAddr, source.ShardIds); err != nil {
-		return fmt.Errorf("unmount shard on source: %w", err)
-	}
-
-	// Step 3: Delete shard from source
-	t.reportProgress(75.0, "Deleting EC shard from source")
-	if err := t.deleteShard(ctx, params.VolumeId, params.Collection, sourceAddr, source.ShardIds); err != nil {
-		return fmt.Errorf("delete shard on source: %w", err)
-	}
-
-	t.reportProgress(100.0, "EC shard move complete")
 	glog.Infof("EC balance: successfully moved shard(s) %v of volume %d from %s to %s",
 		source.ShardIds, params.VolumeId, source.Node, target.Node)
 	return nil
 }
 
-// executeDedupDelete removes a duplicate shard without copying
-func (t *ECBalanceTask) executeDedupDelete(ctx context.Context, volumeID uint32, sourceAddr pb.ServerAddress, shardIDs []uint32) error {
-	t.reportProgress(25.0, "Unmounting duplicate EC shard")
-	if err := t.unmountShard(ctx, volumeID, sourceAddr, shardIDs); err != nil {
-		return fmt.Errorf("unmount duplicate shard: %w", err)
+// verifyShardsOnKeepNode confirms the node the plan wants to keep the shard on
+// actually has every shard about to be deleted elsewhere, for this collection.
+func (t *ECBalanceTask) verifyShardsOnKeepNode(ctx context.Context, volumeID uint32, keepNode string, shardIDs []uint32) error {
+	if keepNode == "" {
+		return fmt.Errorf("refusing dedup delete of volume %d shard(s) %v: no keep node recorded, so no surviving copy can be confirmed", volumeID, shardIDs)
 	}
-
-	t.reportProgress(75.0, "Deleting duplicate EC shard")
-	if err := t.deleteShard(ctx, volumeID, t.collection, sourceAddr, shardIDs); err != nil {
-		return fmt.Errorf("delete duplicate shard: %w", err)
-	}
-
-	t.reportProgress(100.0, "Duplicate shard removed")
-	return nil
-}
-
-// copyAndMountShard copies EC shard from source to destination and mounts it
-func (t *ECBalanceTask) copyAndMountShard(ctx context.Context, volumeID uint32, sourceAddr, targetAddr pb.ServerAddress, shardIDs []uint32, destDiskID uint32) error {
-	return operation.WithVolumeServerClient(false, targetAddr, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			// Copy shard data (if source != target)
-			if sourceAddr != targetAddr {
-				_, err := client.VolumeEcShardsCopy(ctx, &volume_server_pb.VolumeEcShardsCopyRequest{
-					VolumeId:       volumeID,
-					Collection:     t.collection,
-					ShardIds:       shardIDs,
-					CopyEcxFile:    true,
-					CopyEcjFile:    true,
-					CopyVifFile:    true,
-					SourceDataNode: string(sourceAddr),
-					DiskId:         destDiskID,
-				})
-				if err != nil {
-					return fmt.Errorf("copy shard(s) %v from %s to %s: %v", shardIDs, sourceAddr, targetAddr, err)
-				}
-			}
-
-			// Mount the shard on destination
-			_, err := client.VolumeEcShardsMount(ctx, &volume_server_pb.VolumeEcShardsMountRequest{
-				VolumeId:   volumeID,
-				Collection: t.collection,
-				ShardIds:   shardIDs,
-			})
-			if err != nil {
-				return fmt.Errorf("mount shard(s) %v on %s: %v", shardIDs, targetAddr, err)
-			}
-
-			return nil
-		})
-}
-
-// unmountShard unmounts EC shards from a server
-func (t *ECBalanceTask) unmountShard(ctx context.Context, volumeID uint32, addr pb.ServerAddress, shardIDs []uint32) error {
-	return operation.WithVolumeServerClient(false, addr, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			_, err := client.VolumeEcShardsUnmount(ctx, &volume_server_pb.VolumeEcShardsUnmountRequest{
-				VolumeId: volumeID,
-				ShardIds: shardIDs,
-			})
-			return err
-		})
-}
-
-// verifyShardsOnDestination confirms targetAddr has registered every shard in
-// shardIDs for volumeID, so the caller can safely delete the source copies.
-func (t *ECBalanceTask) verifyShardsOnDestination(ctx context.Context, volumeID uint32, targetAddr pb.ServerAddress, shardIDs []uint32) error {
-	_, perServer := erasure_coding.VerifyShardsAcrossServers(ctx, volumeID, []string{string(targetAddr)}, t.grpcDialOption)
-	inv, ok := perServer[string(targetAddr)]
-	if !ok {
-		return fmt.Errorf("verify shard(s) on destination %s for volume %d: no inventory returned", targetAddr, volumeID)
-	}
-	if inv.QueryError != nil {
-		return fmt.Errorf("verify shard(s) on destination %s for volume %d: %v", targetAddr, volumeID, inv.QueryError)
-	}
-	for _, sid := range shardIDs {
-		if !inv.Bits.Has(erasure_coding.ShardId(sid)) {
-			return fmt.Errorf("destination %s missing EC shard %d.%d after copy/mount; keeping source", targetAddr, volumeID, sid)
-		}
+	if err := erasure_coding.VerifyShardsOnServer(ctx, t.collection, volumeID,
+		string(pb.ServerAddress(keepNode)), shardIDs, t.grpcDialOption); err != nil {
+		return fmt.Errorf("refusing dedup delete: %w", err)
 	}
 	return nil
 }
 
-// deleteShard deletes EC shards from a server
-func (t *ECBalanceTask) deleteShard(ctx context.Context, volumeID uint32, collection string, addr pb.ServerAddress, shardIDs []uint32) error {
-	return operation.WithVolumeServerClient(false, addr, t.grpcDialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			_, err := client.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
-				VolumeId:   volumeID,
-				Collection: collection,
-				ShardIds:   shardIDs,
-			})
-			return err
-		})
-}
-
 // Validate validates the task parameters.
 // ECBalanceTask handles exactly one source→target shard move per execution.
 func (t *ECBalanceTask) Validate(params *worker_pb.TaskParams) error {
@@ -240,10 +179,15 @@ func (t *ECBalanceTask) Validate(params *worker_pb.TaskParams) error {
 	if len(params.Targets[0].ShardIds) == 0 {
 		return fmt.Errorf("ECBalanceTask.Validate: Targets[0].ShardIds is empty")
 	}
+	if err := checkShardIdRange(params.Sources[0].ShardIds); err != nil {
+		return fmt.Errorf("ECBalanceTask.Validate: %v", err)
+	}
+	if err := checkShardIdRange(params.Targets[0].ShardIds); err != nil {
+		return fmt.Errorf("ECBalanceTask.Validate: %v", err)
+	}
 	// A same-node, cross-disk move is unsafe: the node-wide EC shard delete would
-	// erase the shard after copyAndMountShard skips the same-address copy. Such a
-	// move cannot be expressed by these RPCs anyway. Dedup (same node and disk) is
-	// allowed.
+	// erase the shard after the skipped same-address copy. Such a move cannot be
+	// expressed by these RPCs anyway. Dedup (same node and disk) is allowed.
 	if params.Sources[0].Node == params.Targets[0].Node && params.Sources[0].DiskId != params.Targets[0].DiskId {
 		return fmt.Errorf("ECBalanceTask.Validate: refusing same-node cross-disk move on %s (source disk %d, target disk %d): EC shard delete is node-wide",
 			params.Sources[0].Node, params.Sources[0].DiskId, params.Targets[0].DiskId)
@@ -272,6 +216,17 @@ func (t *ECBalanceTask) reportProgress(progress float64, stage string) {
 	glog.Infof("EC balance volume %d: [%.2f] %s", t.volumeID, progress, stage)
 }
 
+// checkShardIdRange rejects shard ids that would alias a real shard when
+// narrowed to the uint8 ShardId (e.g. 259 → 3).
+func checkShardIdRange(ids []uint32) error {
+	for _, id := range ids {
+		if id >= erasure_coding.MaxShardCount {
+			return fmt.Errorf("shard id %d out of range (max %d)", id, erasure_coding.MaxShardCount-1)
+		}
+	}
+	return nil
+}
+
 // isDedupPhase checks if this is a dedup-phase task: an unmount+delete on a
 // single location, encoded by detection as source==target on the same node AND
 // the same disk. Comparing the disk too is essential — VolumeEcShardsDelete is
diff --git a/weed/worker/tasks/ec_balance/ec_balance_task_test.go b/weed/worker/tasks/ec_balance/ec_balance_task_test.go
new file mode 100644
index 0000000000..00caa33168
--- /dev/null
+++ b/weed/worker/tasks/ec_balance/ec_balance_task_test.go
@@ -0,0 +1,58 @@
+package ec_balance
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func TestECBalanceTaskRejectsOutOfRangeShardIds(t *testing.T) {
+	// ShardId is a uint8; an unchecked id like 259 would alias shard 3 and
+	// copy/delete a real, unrelated shard.
+	params := &worker_pb.TaskParams{
+		VolumeId: 7,
+		Sources:  []*worker_pb.TaskSource{{Node: "src:8080", ShardIds: []uint32{259}}},
+		Targets:  []*worker_pb.TaskTarget{{Node: "dst:8080", ShardIds: []uint32{259}}},
+	}
+	task := NewECBalanceTask("t1", 7, "c1", nil)
+
+	if err := task.Validate(params); err == nil || !strings.Contains(err.Error(), "out of range") {
+		t.Fatalf("Validate: expected out-of-range rejection, got: %v", err)
+	}
+	if err := task.Execute(context.Background(), params); err == nil || !strings.Contains(err.Error(), "out of range") {
+		t.Fatalf("Execute: expected out-of-range rejection, got: %v", err)
+	}
+}
+
+// A refusal against the pinned disk convicts only that disk, not the node:
+// the task retries once letting the server pick a disk, and the move completes.
+func TestECBalanceTaskRetriesServerPickOnPinnedDiskRefusal(t *testing.T) {
+	source := startFakeEcVolumeServer(t, 7, 5)
+	target := startFakeEcVolumeServer(t, 7)
+	target.refuseCopyOnDisk = 2
+
+	task := NewECBalanceTask("t2", 7, "c1",
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+	params := &worker_pb.TaskParams{
+		VolumeId: 7,
+		Sources:  []*worker_pb.TaskSource{{Node: source.address(), ShardIds: []uint32{5}}},
+		Targets:  []*worker_pb.TaskTarget{{Node: target.address(), DiskId: 2, ShardIds: []uint32{5}}},
+	}
+
+	if err := task.Execute(context.Background(), params); err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	if got := target.copyDiskIds; len(got) != 2 || got[0] != 2 || got[1] != 0 {
+		t.Fatalf("expected copies to disk 2 then server-picked 0, got %v", got)
+	}
+	if source.has(7, 5) {
+		t.Fatalf("source still holds shard 5")
+	}
+	if !target.has(7, 5) {
+		t.Fatalf("target never received shard 5")
+	}
+}
diff --git a/weed/worker/tasks/ec_balance/fake_ec_volume_server_test.go b/weed/worker/tasks/ec_balance/fake_ec_volume_server_test.go
new file mode 100644
index 0000000000..b3fddd887d
--- /dev/null
+++ b/weed/worker/tasks/ec_balance/fake_ec_volume_server_test.go
@@ -0,0 +1,166 @@
+package ec_balance
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"sync"
+	"testing"
+
+	"google.golang.org/grpc"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+)
+
+// fakeEcVolumeServer is a volume server that only knows about EC shard
+// inventory. It exists so the destructive half of a balance job can be driven
+// in-process: what a real volume server has on disk is the thing the master's
+// topology can be wrong about, and being wrong about it is what makes a delete
+// unsafe. Holding that state here lets a test say "the topology claims this,
+// the disk holds that" and watch what the job does.
+type fakeEcVolumeServer struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+
+	mu sync.Mutex
+	// shards actually present on this server's disks, per volume.
+	shards map[uint32]map[uint32]bool
+	// collection the held volume belongs to. Reported back on the inventory so
+	// a caller can tell this server's volume N from another collection's N.
+	collection string
+	// deleted/unmounted record what the job asked for, so a test can assert on
+	// the request even when it was a no-op against the inventory.
+	deleted   []string
+	unmounted []string
+	// refuseCopyOnDisk, when nonzero, makes VolumeEcShardsCopy fail requests
+	// pinning that disk id with "no space left" — a full disk; a request with
+	// DiskId 0 (server picks) still succeeds.
+	refuseCopyOnDisk uint32
+	// copyDiskIds records the DiskId each copy request carried.
+	copyDiskIds []uint32
+	// grpcAddr is host:port; the code under test dials by address string.
+	grpcAddr string
+	stop     func()
+}
+
+func (f *fakeEcVolumeServer) VolumeEcShardsInfo(ctx context.Context, req *volume_server_pb.VolumeEcShardsInfoRequest) (*volume_server_pb.VolumeEcShardsInfoResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	resp := &volume_server_pb.VolumeEcShardsInfoResponse{}
+	for sid := range f.shards[req.VolumeId] {
+		resp.EcShardInfos = append(resp.EcShardInfos, &volume_server_pb.EcShardInfo{
+			VolumeId:   req.VolumeId,
+			ShardId:    sid,
+			Collection: f.collection,
+			Size:       1,
+		})
+	}
+	return resp, nil
+}
+
+// VolumeEcShardsCopy records the request's DiskId and adds the shards to this
+// server's inventory, unless the pinned disk is the configured refusing disk.
+func (f *fakeEcVolumeServer) VolumeEcShardsCopy(ctx context.Context, req *volume_server_pb.VolumeEcShardsCopyRequest) (*volume_server_pb.VolumeEcShardsCopyResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.copyDiskIds = append(f.copyDiskIds, req.DiskId)
+	if f.refuseCopyOnDisk != 0 && req.DiskId == f.refuseCopyOnDisk {
+		return nil, fmt.Errorf("disk %d: no space left", req.DiskId)
+	}
+	for _, sid := range req.ShardIds {
+		f.shards[req.VolumeId][sid] = true
+	}
+	return &volume_server_pb.VolumeEcShardsCopyResponse{}, nil
+}
+
+func (f *fakeEcVolumeServer) VolumeEcShardsMount(ctx context.Context, req *volume_server_pb.VolumeEcShardsMountRequest) (*volume_server_pb.VolumeEcShardsMountResponse, error) {
+	return &volume_server_pb.VolumeEcShardsMountResponse{}, nil
+}
+
+func (f *fakeEcVolumeServer) VolumeEcShardsDelete(ctx context.Context, req *volume_server_pb.VolumeEcShardsDeleteRequest) (*volume_server_pb.VolumeEcShardsDeleteResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, sid := range req.ShardIds {
+		f.deleted = append(f.deleted, fmt.Sprintf("%d.%d", req.VolumeId, sid))
+		delete(f.shards[req.VolumeId], sid)
+	}
+	return &volume_server_pb.VolumeEcShardsDeleteResponse{}, nil
+}
+
+func (f *fakeEcVolumeServer) VolumeEcShardsUnmount(ctx context.Context, req *volume_server_pb.VolumeEcShardsUnmountRequest) (*volume_server_pb.VolumeEcShardsUnmountResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	for _, sid := range req.ShardIds {
+		f.unmounted = append(f.unmounted, fmt.Sprintf("%d.%d", req.VolumeId, sid))
+	}
+	return &volume_server_pb.VolumeEcShardsUnmountResponse{}, nil
+}
+
+// has reports whether the shard is still on this server's disks.
+func (f *fakeEcVolumeServer) has(volumeID, shardID uint32) bool {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.shards[volumeID][shardID]
+}
+
+func (f *fakeEcVolumeServer) deletedShards() []string {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]string(nil), f.deleted...)
+}
+
+// startFakeEcVolumeServer listens on a loopback port and serves the EC subset
+// of the volume server API. present lists the shards this server really holds.
+func startFakeEcVolumeServer(t *testing.T, volumeID uint32, present ...uint32) *fakeEcVolumeServer {
+	return startFakeEcVolumeServerInCollection(t, dedupTestCollection, volumeID, present...)
+}
+
+// startFakeEcVolumeServerInCollection is the same, for a named collection, so a
+// test can stand up two servers holding the same volume id in different ones.
+func startFakeEcVolumeServerInCollection(t *testing.T, collection string, volumeID uint32, present ...uint32) *fakeEcVolumeServer {
+	t.Helper()
+
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+
+	f := &fakeEcVolumeServer{
+		shards:     map[uint32]map[uint32]bool{volumeID: {}},
+		collection: collection,
+		grpcAddr:   listener.Addr().String(),
+	}
+	for _, sid := range present {
+		f.shards[volumeID][sid] = true
+	}
+
+	server := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(server, f)
+	go func() { _ = server.Serve(listener) }()
+	f.stop = server.Stop
+	t.Cleanup(server.Stop)
+
+	return f
+}
+
+// address returns a node id in the "host:httpPort.grpcPort" form the cluster
+// uses (e.g. mg01-s3-intelistor-15:8087.18087), so ToGrpcAddress resolves to
+// this fake's listener. The http port is unused and only has to parse.
+func (f *fakeEcVolumeServer) address() string {
+	host, port, err := net.SplitHostPort(f.grpcAddr)
+	if err != nil {
+		return f.grpcAddr
+	}
+	return fmt.Sprintf("%s:1.%s", host, port)
+}
+
+// shardBitsOf is a small readability helper for asserting inventory.
+func shardBitsOf(f *fakeEcVolumeServer, volumeID uint32) erasure_coding.ShardBits {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	var b erasure_coding.ShardBits
+	for sid := range f.shards[volumeID] {
+		b = b.Set(erasure_coding.ShardId(sid))
+	}
+	return b
+}
diff --git a/weed/worker/tasks/ec_balance/multidisk_detection_test.go b/weed/worker/tasks/ec_balance/multidisk_detection_test.go
index e039787b82..37b70f6d74 100644
--- a/weed/worker/tasks/ec_balance/multidisk_detection_test.go
+++ b/weed/worker/tasks/ec_balance/multidisk_detection_test.go
@@ -8,6 +8,8 @@ import (
 	"github.com/seaweedfs/seaweedfs/weed/admin/topology"
 	"github.com/seaweedfs/seaweedfs/weed/pb/master_pb"
 	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding/ecbalancer"
+	"github.com/seaweedfs/seaweedfs/weed/util/wildcard"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 )
 
@@ -295,13 +297,13 @@ func TestBuildBalancerTopologyNormalizesHddDiskType(t *testing.T) {
 	}
 	topoInfo := buildMasterTopology("c", 100, 50, specs)
 
-	if _, n, _ := buildBalancerTopology(topoInfo, &Config{DiskType: "hdd"}); n != 2 {
+	if _, n, _ := buildBalancerTopology(topoInfo, &Config{DiskType: "hdd"}, nil); n != 2 {
 		t.Errorf("disk_type=hdd matched %d nodes on an all-HDD cluster, want 2 (hdd must map to the empty HDD key)", n)
 	}
-	if _, n, _ := buildBalancerTopology(topoInfo, &Config{DiskType: ""}); n != 2 {
+	if _, n, _ := buildBalancerTopology(topoInfo, &Config{DiskType: ""}, nil); n != 2 {
 		t.Errorf("disk_type=empty matched %d nodes, want 2 (all)", n)
 	}
-	if _, n, _ := buildBalancerTopology(topoInfo, &Config{DiskType: "ssd"}); n != 0 {
+	if _, n, _ := buildBalancerTopology(topoInfo, &Config{DiskType: "ssd"}, nil); n != 0 {
 		t.Errorf("disk_type=ssd matched %d nodes on an all-HDD cluster, want 0", n)
 	}
 }
@@ -333,3 +335,68 @@ func TestResolveReplicaPlacementFallsBackToMasterDefault(t *testing.T) {
 		})
 	}
 }
+
+// TestBuildBalancerTopologyKeepsSlotRemainder: a node whose single free EC slot
+// spans two physical disks must still offer it. Splitting the slot evenly would
+// floor each disk to zero and exclude the node despite usable capacity.
+func TestBuildBalancerTopologyKeepsSlotRemainder(t *testing.T) {
+	var all uint32
+	for i := 0; i < 14; i++ {
+		all |= 1 << uint(i)
+	}
+	// n2 has one free shard slot: (7-6)*DataShardsCount - 9 = 1, spread over
+	// disks 0 and 1. Volume 200 is collection-filtered out of balancing so only
+	// volume 100 moves.
+	n1 := &master_pb.DataNodeInfo{
+		Id: "n1",
+		DiskInfos: map[string]*master_pb.DiskInfo{"": {
+			Type:           "",
+			MaxVolumeCount: 10,
+			VolumeCount:    1,
+			EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{
+				{Id: 100, Collection: "col1", DiskId: 0, EcIndexBits: all},
+			},
+			VolumeInfos: []*master_pb.VolumeInformationMessage{{Id: 90000, DiskId: 0}},
+		}},
+	}
+	n2 := &master_pb.DataNodeInfo{
+		Id: "n2",
+		DiskInfos: map[string]*master_pb.DiskInfo{"": {
+			Type:           "",
+			MaxVolumeCount: 7,
+			VolumeCount:    6,
+			EcShardInfos: []*master_pb.VolumeEcShardInformationMessage{
+				{Id: 200, Collection: "other", DiskId: 0, EcIndexBits: 0x1F},
+				{Id: 200, Collection: "other", DiskId: 1, EcIndexBits: 0x1E0},
+			},
+			VolumeInfos: []*master_pb.VolumeInformationMessage{
+				{Id: 90001, DiskId: 0}, {Id: 90002, DiskId: 0}, {Id: 90003, DiskId: 0},
+				{Id: 90004, DiskId: 1}, {Id: 90005, DiskId: 1}, {Id: 90006, DiskId: 1},
+			},
+		}},
+	}
+	topoInfo := &master_pb.TopologyInfo{
+		DataCenterInfos: []*master_pb.DataCenterInfo{{
+			Id: "dc1",
+			RackInfos: []*master_pb.RackInfo{
+				{Id: "rack1", DataNodeInfos: []*master_pb.DataNodeInfo{n1}},
+				{Id: "rack2", DataNodeInfos: []*master_pb.DataNodeInfo{n2}},
+			},
+		}},
+	}
+	allowed, err := wildcard.CompileCollectionMatcher("col1")
+	if err != nil {
+		t.Fatalf("CompileCollectionMatcher: %v", err)
+	}
+	topo, _, _ := buildBalancerTopology(topoInfo, NewDefaultConfig(), allowed)
+	moves := ecbalancer.Plan(topo, ecbalancer.Options{ImbalanceThreshold: 0.01})
+	toN2 := 0
+	for _, m := range moves {
+		if m.VolumeID == 100 && m.TargetNode == "n2" {
+			toN2++
+		}
+	}
+	if toN2 != 1 {
+		t.Errorf("volume 100 moves to n2 = %d, want 1 (the node's one free slot divided across two disks must not floor to zero)", toN2)
+	}
+}
diff --git a/weed/worker/tasks/ec_balance/plugin_handler.go b/weed/worker/tasks/ec_balance/plugin_handler.go
index 68d97191c7..d545dc5a47 100644
--- a/weed/worker/tasks/ec_balance/plugin_handler.go
+++ b/weed/worker/tasks/ec_balance/plugin_handler.go
@@ -81,7 +81,7 @@ func (h *ECBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 						{
 							Name:        "collection_filter",
 							Label:       "Collection Filter",
-							Description: "Only balance EC shards in matching collections (wildcard supported).",
+							Description: "Only balance EC shards in matching collections. Comma-separated list of names, wildcards, or regex patterns.",
 							Placeholder: "all collections",
 							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
 							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,
@@ -149,6 +149,14 @@ func (h *ECBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 							Required:    true,
 							MinValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: ecBalanceMinServerCount}},
 						},
+						{
+							Name:        "io_byte_per_second",
+							Label:       "Shard Copy IO Limit (bytes/sec)",
+							Description: "Limit each EC shard copy's rate in bytes per second. 0 falls back to each volume server's own maintenance rate.",
+							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_INT64,
+							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_NUMBER,
+							MinValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0}},
+						},
 						{
 							Name:        "preferred_tags",
 							Label:       "Preferred Tags",
@@ -163,6 +171,7 @@ func (h *ECBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 			DefaultValues: map[string]*plugin_pb.ConfigValue{
 				"imbalance_threshold": {Kind: &plugin_pb.ConfigValue_DoubleValue{DoubleValue: 0.2}},
 				"min_server_count":    {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 3}},
+				"io_byte_per_second":  {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0}},
 				"preferred_tags":      {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""}},
 			},
 		},
@@ -181,6 +190,7 @@ func (h *ECBalanceHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 		WorkerDefaultValues: map[string]*plugin_pb.ConfigValue{
 			"imbalance_threshold": {Kind: &plugin_pb.ConfigValue_DoubleValue{DoubleValue: 0.2}},
 			"min_server_count":    {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 3}},
+			"io_byte_per_second":  {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0}},
 			"preferred_tags":      {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""}},
 		},
 	}
@@ -418,6 +428,12 @@ func deriveECBalanceWorkerConfig(values map[string]*plugin_pb.ConfigValue) *ecBa
 	}
 	taskConfig.MinServerCount = minServerCount
 
+	ioBytePerSecond := pluginworker.ReadInt64Config(values, "io_byte_per_second", taskConfig.IoBytePerSecond)
+	if ioBytePerSecond < 0 {
+		ioBytePerSecond = 0
+	}
+	taskConfig.IoBytePerSecond = ioBytePerSecond
+
 	taskConfig.PreferredTags = util.NormalizeTagList(pluginworker.ReadStringListConfig(values, "preferred_tags"))
 
 	return &ecBalanceWorkerConfig{
@@ -577,6 +593,7 @@ func decodeECBalanceTaskParams(job *plugin_pb.JobSpec) (*worker_pb.TaskParams, e
 	if targetDiskID < 0 || targetDiskID > math.MaxUint32 {
 		return nil, fmt.Errorf("decodeECBalanceTaskParams: invalid target_disk_id: %d", targetDiskID)
 	}
+	ioBytePerSecond := pluginworker.ReadInt64Config(job.Parameters, "io_byte_per_second", 0)
 
 	return &worker_pb.TaskParams{
 		TaskId:     job.JobId,
@@ -594,7 +611,8 @@ func decodeECBalanceTaskParams(job *plugin_pb.JobSpec) (*worker_pb.TaskParams, e
 		}},
 		TaskParams: &worker_pb.TaskParams_EcBalanceParams{
 			EcBalanceParams: &worker_pb.EcBalanceTaskParams{
-				TimeoutSeconds: 600,
+				TimeoutSeconds:  600,
+				IoBytePerSecond: ioBytePerSecond,
 			},
 		},
 	}, nil
diff --git a/weed/worker/tasks/erasure_coding/config.go b/weed/worker/tasks/erasure_coding/config.go
index 48371bb079..e1eba8fb03 100644
--- a/weed/worker/tasks/erasure_coding/config.go
+++ b/weed/worker/tasks/erasure_coding/config.go
@@ -12,12 +12,14 @@ import (
 // Config extends BaseConfig with erasure coding specific settings
 type Config struct {
 	base.BaseConfig
-	QuietForSeconds  int      `json:"quiet_for_seconds"`
-	FullnessRatio    float64  `json:"fullness_ratio"`
-	CollectionFilter string   `json:"collection_filter"`
-	MinSizeMB        int      `json:"min_size_mb"`
-	PreferredTags    []string `json:"preferred_tags"`
-	ReplicaPlacement string   `json:"replica_placement"` // e.g. "020"; empty falls back to the master default replication
+	QuietForSeconds   int      `json:"quiet_for_seconds"`
+	FullnessRatio     float64  `json:"fullness_ratio"`
+	CollectionFilter  string   `json:"collection_filter"`
+	MinSizeMB         int      `json:"min_size_mb"`
+	PreferredTags     []string `json:"preferred_tags"`
+	ReplicaPlacement  string   `json:"replica_placement"`   // e.g. "020"; empty falls back to the master default replication
+	StrictPlacement   bool     `json:"strict_placement"`    // fail planning instead of relaxing placement constraints
+	FreeSlotsDeadband int      `json:"free_slots_deadband"` // Place volume-slot M; |ΔfreeSlots| ≤ M×dataShards is a tie, then liveShards; 0 = strict
 }
 
 // NewDefaultConfig creates a new default erasure coding configuration
@@ -123,9 +125,9 @@ func GetConfigSpec() base.ConfigSpec {
 				DefaultValue: "",
 				Required:     false,
 				DisplayName:  "Collection Filter",
-				Description:  "Only process volumes from specific collections",
-				HelpText:     "Leave empty to process all collections, or specify collection name",
-				Placeholder:  "my_collection",
+				Description:  "Only process volumes from specific collections (comma-separated names, wildcards, or regex patterns)",
+				HelpText:     "Leave empty to process all collections, or list the collections to process",
+				Placeholder:  "pictures,videos",
 				InputType:    "text",
 				CSSClasses:   "form-control",
 			},
@@ -171,6 +173,34 @@ func GetConfigSpec() base.ConfigSpec {
 				InputType:    "text",
 				CSSClasses:   "form-control",
 			},
+			{
+				Name:         "strict_placement",
+				JSONName:     "strict_placement",
+				Type:         config.FieldTypeBool,
+				DefaultValue: false,
+				Required:     false,
+				DisplayName:  "Strict Placement",
+				Description:  "Refuse to encode a volume when the placement constraints can't be satisfied",
+				HelpText:     "When enabled, a volume is only encoded if every shard can be placed within the per-disk, anti-affinity, replica-placement and per-rack caps, so the configured resilience is preserved. When disabled (default), unsatisfiable constraints are relaxed and noted in the log",
+				InputType:    "checkbox",
+				CSSClasses:   "form-check-input",
+			},
+			{
+				Name:         "free_slots_deadband",
+				JSONName:     "free_slots_deadband",
+				Type:         config.FieldTypeInt,
+				DefaultValue: 0,
+				MinValue:     0,
+				MaxValue:     100000,
+				Required:     false,
+				DisplayName:  "Free Volume Deadband (M)",
+				Description:  "Treat |Δfree volume slots| ≤ M as a Place tie and rank by liveShards instead",
+				HelpText:     "0 (default) keeps strict freeSlots ranking. A positive M is volume slots; Place applies M × data shards (10+4 → ×10).",
+				Placeholder:  "0",
+				Unit:         config.UnitCount,
+				InputType:    "number",
+				CSSClasses:   "form-control",
+			},
 		},
 	}
 }
@@ -186,12 +216,14 @@ func (c *Config) ToTaskPolicy() *worker_pb.TaskPolicy {
 		CheckIntervalSeconds:  int32(c.ScanIntervalSeconds),
 		TaskConfig: &worker_pb.TaskPolicy_ErasureCodingConfig{
 			ErasureCodingConfig: &worker_pb.ErasureCodingTaskConfig{
-				FullnessRatio:    float64(c.FullnessRatio),
-				QuietForSeconds:  int32(c.QuietForSeconds),
-				MinVolumeSizeMb:  int32(c.MinSizeMB),
-				CollectionFilter: c.CollectionFilter,
-				PreferredTags:    preferredTagsCopy,
-				ReplicaPlacement: c.ReplicaPlacement,
+				FullnessRatio:     float64(c.FullnessRatio),
+				QuietForSeconds:   int32(c.QuietForSeconds),
+				MinVolumeSizeMb:   int32(c.MinSizeMB),
+				CollectionFilter:  c.CollectionFilter,
+				PreferredTags:     preferredTagsCopy,
+				ReplicaPlacement:  c.ReplicaPlacement,
+				StrictPlacement:   c.StrictPlacement,
+				FreeSlotsDeadband: int32(c.FreeSlotsDeadband),
 			},
 		},
 	}
@@ -216,6 +248,8 @@ func (c *Config) FromTaskPolicy(policy *worker_pb.TaskPolicy) error {
 		c.CollectionFilter = ecConfig.CollectionFilter
 		c.PreferredTags = append([]string(nil), ecConfig.PreferredTags...)
 		c.ReplicaPlacement = ecConfig.ReplicaPlacement
+		c.StrictPlacement = ecConfig.StrictPlacement
+		c.FreeSlotsDeadband = int(ecConfig.FreeSlotsDeadband)
 	}
 
 	return nil
@@ -229,12 +263,25 @@ func LoadConfigFromPersistence(configPersistence interface{}) *Config {
 	if persistence, ok := configPersistence.(interface {
 		LoadErasureCodingTaskPolicy() (*worker_pb.TaskPolicy, error)
 	}); ok {
-		if policy, err := persistence.LoadErasureCodingTaskPolicy(); err == nil && policy != nil {
-			if err := config.FromTaskPolicy(policy); err == nil {
+		policy, err := persistence.LoadErasureCodingTaskPolicy()
+		switch {
+		case err != nil:
+			glog.Warningf("Could not read the persisted erasure coding configuration, falling back to defaults: %v", err)
+		case policy == nil:
+			glog.V(1).Infof("No erasure coding configuration persisted yet, using defaults")
+		default:
+			if err := config.FromTaskPolicy(policy); err != nil {
+				glog.Warningf("Could not apply the persisted erasure coding configuration, falling back to defaults: %v", err)
+			} else {
 				glog.V(1).Infof("Loaded erasure coding configuration from persistence")
 				return config
 			}
 		}
+	} else if configPersistence != nil {
+		// A store was handed in but does not expose the accessor, so the persisted
+		// settings are silently ignored - always a wiring bug, never a normal state.
+		glog.Warningf("%T cannot provide the persisted erasure coding configuration: it has no LoadErasureCodingTaskPolicy() method, "+
+			"so the compiled-in defaults are used and any saved erasure coding settings are ignored", configPersistence)
 	}
 
 	glog.V(1).Infof("Using default erasure coding configuration")
diff --git a/weed/worker/tasks/erasure_coding/detection.go b/weed/worker/tasks/erasure_coding/detection.go
index 571fa0132c..a422964ef2 100644
--- a/weed/worker/tasks/erasure_coding/detection.go
+++ b/weed/worker/tasks/erasure_coding/detection.go
@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/admin/topology"
+	"github.com/seaweedfs/seaweedfs/weed/ec"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
@@ -68,7 +69,10 @@ func Detection(ctx context.Context, metrics []*types.VolumeHealthMetrics, cluste
 		glog.Warningf("EC Detection: replica placement data-center digit (%d) is ignored for EC; only rack/node digits are honored", replicaPlacement.DiffDataCenterCount)
 	}
 
-	allowedCollections := wildcard.CompileWildcardMatchers(ecConfig.CollectionFilter)
+	allowedCollections, err := wildcard.CompileCollectionMatcher(ecConfig.CollectionFilter)
+	if err != nil {
+		return nil, false, err
+	}
 
 	// Cluster node count for the min-node safety gate (mirrors the shell ec.encode
 	// guard that refuses to encode when nodes < parity shards, so shards cannot be
@@ -186,7 +190,7 @@ func Detection(ctx context.Context, metrics []*types.VolumeHealthMetrics, cluste
 		}
 
 		// Check collection filter if specified
-		if len(allowedCollections) > 0 && !wildcard.MatchesAnyWildcard(allowedCollections, metric.Collection) {
+		if !allowedCollections.Matches(metric.Collection) {
 			skippedCollectionFilter++
 			continue
 		}
@@ -481,9 +485,13 @@ func buildNodeAddressMap(at *topology.ActiveTopology) map[string]string {
 // in the same detection cycle see the reduced capacity. Rebuilding it per volume
 // is O(volumes × topology) and times out on large clusters.
 //
-// Encode is lenient (PlaceDurabilityFirst): it relaxes caps/anti-affinity/RP as
-// needed rather than fail, and prefers the source disk type but spills if that
-// type can't hold every shard. rp is the resolved replica placement (may be nil).
+// Encode is lenient (PlaceDurabilityFirst): it relaxes caps/anti-affinity/RP and,
+// last, the total-shards-per-rack cap as needed, failing only when no eligible
+// disk has room. ecConfig.StrictPlacement instead fails the volume's planning
+// when the constraints cannot be satisfied (PlaceStrict), so a volume is only
+// encoded while its configured resilience is preserved. The task prefers the
+// source disk type but spills if that type can't hold every shard. rp is the
+// resolved replica placement (may be nil).
 func planECDestinations(snap *ecbalancer.Topology, nodeAddresses map[string]string, metric *types.VolumeHealthMetrics, ecConfig *Config, rp *super_block.ReplicaPlacement, dataShards, parityShards int) (*topology.MultiDestinationPlan, [][]uint32, error) {
 	if snap == nil {
 		return nil, nil, fmt.Errorf("EC placement snapshot not available")
@@ -506,13 +514,18 @@ func planECDestinations(snap *ecbalancer.Topology, nodeAddresses map[string]stri
 	for i := range need {
 		need[i] = i
 	}
+	mode := ecbalancer.PlaceDurabilityFirst
+	if ecConfig.StrictPlacement {
+		mode = ecbalancer.PlaceStrict
+	}
 	res, err := snap.Place(metric.VolumeID, metric.Collection, need, ecbalancer.Constraints{
-		DiskType:         metric.DiskType,
-		DiskTypePolicy:   ecbalancer.DiskTypePrefer,
-		PreferredTags:    ecConfig.PreferredTags,
-		ReplicaPlacement: rp,
-		Ratio:            func(string) (int, int) { return dataShards, parityShards },
-	}, ecbalancer.PlaceDurabilityFirst)
+		DiskType:          metric.DiskType,
+		DiskTypePolicy:    ecbalancer.DiskTypePrefer,
+		PreferredTags:     ecConfig.PreferredTags,
+		ReplicaPlacement:  rp,
+		Ratio:             func(string) (int, int) { return dataShards, parityShards },
+		FreeSlotsDeadband: ecConfig.FreeSlotsDeadband,
+	}, mode)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -525,8 +538,8 @@ func planECDestinations(snap *ecbalancer.Topology, nodeAddresses map[string]stri
 	if len(res.Relaxed) > 0 {
 		// Encode is best-effort (PlaceDurabilityFirst): it relaxes these constraints
 		// rather than defer when the cluster can't satisfy them. Surface it so a tight
-		// replica placement isn't silently weakened; rebalancing tightens the spread.
-		glog.Warningf("EC volume %d: placed with relaxed constraints %v; replica placement not fully satisfied (rebalancing will adjust)", metric.VolumeID, res.Relaxed)
+		// replica placement or rack spread isn't silently weakened.
+		glog.Warningf("EC volume %d: placed with relaxed placement constraints %v", metric.VolumeID, res.Relaxed)
 	}
 
 	// Group the per-shard destinations into one plan per (node,disk), iterating
@@ -757,50 +770,12 @@ func cleanupOrphanSourceReplicas(ctx context.Context, clusterInfo *types.Cluster
 	return deleted, nil
 }
 
-// countExistingEcShardsForVolume returns the number of distinct EC shard IDs
-// for (volumeID, collection) present in the topology, counting only the single
-// largest encode generation. Shards are grouped by encode_ts_ns (the per-encode
-// identity from .vif), so two interrupted encode runs whose shard sets overlap
-// are never unioned into a false-complete set that would wrongly trigger the
-// orphaned-source delete. Walks every disk's EcIndexBits bitmap rather than
-// trusting len(EcShardInfos), because a single info entry can carry multiple
-// shards. Shards reporting encode_ts_ns==0 (pre-upgrade servers) form their own
-// generation bucket.
-//
-// Limitation: the heartbeat carries one encode_ts_ns per (volume, disk), so this
-// separates generations living on different disks; same-disk mixing is prevented
-// upstream by the pre-encode artifact wipe and the cross-run read guard.
+// countExistingEcShardsForVolume counts (volumeID, collection) EC shards in the
+// topology, counting only the single largest encode generation; see
+// ec.CountExistingEcShardsForVolume for the generation semantics.
 func countExistingEcShardsForVolume(activeTopology *topology.ActiveTopology, volumeID uint32, collection string) int {
 	if activeTopology == nil {
 		return 0
 	}
-	topologyInfo := activeTopology.GetTopologyInfo()
-	if topologyInfo == nil {
-		return 0
-	}
-	perGeneration := make(map[int64]erasure_coding.ShardBits)
-	for _, dc := range topologyInfo.DataCenterInfos {
-		for _, rack := range dc.RackInfos {
-			for _, node := range rack.DataNodeInfos {
-				for _, diskInfo := range node.DiskInfos {
-					for _, ecShardInfo := range diskInfo.EcShardInfos {
-						if ecShardInfo == nil {
-							continue
-						}
-						if ecShardInfo.Id != volumeID || ecShardInfo.Collection != collection {
-							continue
-						}
-						perGeneration[ecShardInfo.EncodeTsNs] |= erasure_coding.ShardBits(ecShardInfo.EcIndexBits)
-					}
-				}
-			}
-		}
-	}
-	best := 0
-	for _, bits := range perGeneration {
-		if c := bits.Count(); c > best {
-			best = c
-		}
-	}
-	return best
+	return ec.CountExistingEcShardsForVolume(activeTopology.GetTopologyInfo(), volumeID, collection)
 }
diff --git a/weed/worker/tasks/erasure_coding/detection_disk_type_test.go b/weed/worker/tasks/erasure_coding/detection_disk_type_test.go
index e1fa35da9d..8b47270c8c 100644
--- a/weed/worker/tasks/erasure_coding/detection_disk_type_test.go
+++ b/weed/worker/tasks/erasure_coding/detection_disk_type_test.go
@@ -18,7 +18,7 @@ import (
 func TestPlanECDestinationsPrefersSourceDiskType_FullCluster(t *testing.T) {
 	// 14 nodes × 2 disks per node (hdd + ssd) — enough SSD slots alone
 	// for a 10+4 layout with one-shard-per-(server,disk) diversity.
-	activeTopology := buildActiveTopology(t, erasure_coding.TotalShardsCount, []string{"hdd", "ssd"}, 100, 0)
+	activeTopology := buildActiveTopology(t, erasure_coding.TotalShardsCount, []string{"hdd", "ssd"}, 100, 0, "")
 
 	metric := &types.VolumeHealthMetrics{
 		VolumeID:   1,
@@ -53,7 +53,7 @@ func TestPlanECDestinationsPrefersSourceDiskType_FullCluster(t *testing.T) {
 func TestPlanECDestinationsSpillsToOtherDiskType_WhenPreferredScarce(t *testing.T) {
 	// Start with every node carrying both HDD and SSD, then strip SSD
 	// from all but the first node so the SSD pool is too small alone.
-	activeTopology := buildActiveTopology(t, erasure_coding.TotalShardsCount, []string{"hdd", "ssd"}, 100, 0)
+	activeTopology := buildActiveTopology(t, erasure_coding.TotalShardsCount, []string{"hdd", "ssd"}, 100, 0, "")
 	topo := activeTopology.GetTopologyInfo()
 	for _, dc := range topo.DataCenterInfos {
 		for _, rack := range dc.RackInfos {
diff --git a/weed/worker/tasks/erasure_coding/detection_strict_test.go b/weed/worker/tasks/erasure_coding/detection_strict_test.go
new file mode 100644
index 0000000000..8916c3d960
--- /dev/null
+++ b/weed/worker/tasks/erasure_coding/detection_strict_test.go
@@ -0,0 +1,54 @@
+package erasure_coding
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding/ecbalancer"
+	"github.com/seaweedfs/seaweedfs/weed/storage/super_block"
+	"github.com/seaweedfs/seaweedfs/weed/worker/types"
+	"github.com/stretchr/testify/require"
+)
+
+// StrictPlacement refuses a volume whose configured caps cannot be met,
+// rather than relaxing them: here one rack must hold all 14 shards under
+// a 2-shards-per-rack replica placement.
+func TestPlanECDestinationsStrictPlacement(t *testing.T) {
+	activeTopology := buildActiveTopology(t, 7, []string{"hdd"}, 100, 0, "")
+	metric := &types.VolumeHealthMetrics{
+		VolumeID: 1,
+		Server:   "10.0.0.1:8080",
+		Size:     100 * 1024 * 1024,
+	}
+	rp, err := super_block.NewReplicaPlacementFromString("020")
+	require.NoError(t, err)
+	nodeAddresses := buildNodeAddressMap(activeTopology)
+
+	snap := ecbalancer.FromActiveTopology(activeTopology, erasure_coding.DataShardsCount)
+	cfg := NewDefaultConfig()
+	plan, shardsPerPlan, err := planECDestinations(snap, nodeAddresses, metric, cfg, rp, erasure_coding.DataShardsCount, erasure_coding.ParityShardsCount)
+	require.NoError(t, err, "lenient placement relaxes the unsatisfiable rack cap")
+	requireAllShardsPlaced(t, plan, shardsPerPlan)
+
+	snap = ecbalancer.FromActiveTopology(activeTopology, erasure_coding.DataShardsCount)
+	cfg.StrictPlacement = true
+	_, _, err = planECDestinations(snap, nodeAddresses, metric, cfg, rp, erasure_coding.DataShardsCount, erasure_coding.ParityShardsCount)
+	require.Error(t, err, "strict placement must refuse rather than weaken the rack cap")
+}
+
+func TestStrictPlacementRoundTripsThroughTaskPolicy(t *testing.T) {
+	cfg := NewDefaultConfig()
+	cfg.StrictPlacement = true
+	cfg.FreeSlotsDeadband = 3
+
+	restored := NewDefaultConfig()
+	require.NoError(t, restored.FromTaskPolicy(cfg.ToTaskPolicy()))
+	require.True(t, restored.StrictPlacement, "strict placement must survive the persisted policy round trip")
+	require.Equal(t, 3, restored.FreeSlotsDeadband, "free_slots_deadband must survive the persisted policy round trip")
+
+	restored.StrictPlacement = false
+	restored.FreeSlotsDeadband = 0
+	require.NoError(t, restored.FromTaskPolicy(restored.ToTaskPolicy()))
+	require.False(t, restored.StrictPlacement)
+	require.Zero(t, restored.FreeSlotsDeadband)
+}
diff --git a/weed/worker/tasks/erasure_coding/detection_test.go b/weed/worker/tasks/erasure_coding/detection_test.go
index 18de939dfe..6634c41eaa 100644
--- a/weed/worker/tasks/erasure_coding/detection_test.go
+++ b/weed/worker/tasks/erasure_coding/detection_test.go
@@ -16,7 +16,7 @@ import (
 )
 
 func TestPlanECDestinationsUsesPlanner(t *testing.T) {
-	activeTopology := buildActiveTopology(t, 7, []string{"hdd", "ssd"}, 100, 0)
+	activeTopology := buildActiveTopology(t, 7, []string{"hdd", "ssd"}, 100, 0, "")
 
 	metric := &types.VolumeHealthMetrics{
 		VolumeID:   1,
@@ -207,7 +207,7 @@ func TestCountExistingEcShardsForVolume(t *testing.T) {
 }
 
 func TestDetectionContextCancellation(t *testing.T) {
-	activeTopology := buildActiveTopology(t, 5, []string{"hdd", "ssd"}, 50, 0)
+	activeTopology := buildActiveTopology(t, 5, []string{"hdd", "ssd"}, 50, 0, "")
 	clusterInfo := &types.ClusterInfo{ActiveTopology: activeTopology}
 	metrics := buildVolumeMetricsForIDs(50)
 
@@ -218,9 +218,44 @@ func TestDetectionContextCancellation(t *testing.T) {
 	require.ErrorIs(t, err, context.Canceled)
 }
 
+// The admin UI collection filter takes a list, and the two mode sentinels must
+// not be read as a collection name.
+func TestDetectionCollectionFilter(t *testing.T) {
+	for _, tc := range []struct {
+		filter string
+		want   int
+	}{
+		{filter: "", want: 3},
+		{filter: "ALL_COLLECTIONS", want: 3},
+		{filter: "collection-a", want: 3},
+		{filter: "collection-a,collection-b", want: 3},
+		{filter: " collection-b , collection-a ", want: 3},
+		{filter: "collection-*", want: 3},
+		{filter: "collection-b,collection-c", want: 0},
+		{filter: "collection-ab", want: 0},
+	} {
+		t.Run(tc.filter, func(t *testing.T) {
+			// A fresh topology per case: planned destinations reserve capacity.
+			activeTopology := buildActiveTopology(t, erasure_coding.TotalShardsCount, []string{"hdd"}, 20, 0, "collection-a")
+			clusterInfo := &types.ClusterInfo{ActiveTopology: activeTopology}
+
+			metrics := buildVolumeMetricsForIDs(3)
+			for _, metric := range metrics {
+				metric.Collection = "collection-a"
+			}
+
+			config := NewDefaultConfig()
+			config.CollectionFilter = tc.filter
+			results, _, err := Detection(context.Background(), metrics, clusterInfo, config, 0)
+			require.NoError(t, err)
+			assert.Len(t, results, tc.want)
+		})
+	}
+}
+
 func TestDetectionMaxResultsHonorsLimit(t *testing.T) {
 	// One node per shard so each shard gets its own disk (#9369).
-	activeTopology := buildActiveTopology(t, erasure_coding.TotalShardsCount, []string{"hdd"}, 20, 0)
+	activeTopology := buildActiveTopology(t, erasure_coding.TotalShardsCount, []string{"hdd"}, 20, 0, "")
 	clusterInfo := &types.ClusterInfo{ActiveTopology: activeTopology}
 	metrics := buildVolumeMetricsForIDs(3)
 
@@ -285,7 +320,7 @@ func TestPlanECDestinationsSpreadsAcrossPhysicalDisks(t *testing.T) {
 }
 
 func TestPlanECDestinationsFailsWithInsufficientCapacity(t *testing.T) {
-	activeTopology := buildActiveTopology(t, 1, []string{"hdd"}, 1, 1)
+	activeTopology := buildActiveTopology(t, 1, []string{"hdd"}, 1, 1, "")
 
 	metric := &types.VolumeHealthMetrics{
 		VolumeID:   2,
@@ -411,7 +446,7 @@ func buildVolumeMetricsForIDs(count int) []*types.VolumeHealthMetrics {
 	return metrics
 }
 
-func buildActiveTopology(t *testing.T, nodeCount int, diskTypes []string, maxVolumeCount, usedVolumeCount int64) *topology.ActiveTopology {
+func buildActiveTopology(t *testing.T, nodeCount int, diskTypes []string, maxVolumeCount, usedVolumeCount int64, collection string) *topology.ActiveTopology {
 	t.Helper()
 	activeTopology := topology.NewActiveTopology(10)
 
@@ -427,7 +462,7 @@ func buildActiveTopology(t *testing.T, nodeCount int, diskTypes []string, maxVol
 			for vid := 1; vid <= 200; vid++ {
 				volumeInfos = append(volumeInfos, &master_pb.VolumeInformationMessage{
 					Id:         uint32(vid),
-					Collection: "",
+					Collection: collection,
 					DiskId:     uint32(diskIndex),
 				})
 			}
diff --git a/weed/worker/tasks/erasure_coding/ec_task.go b/weed/worker/tasks/erasure_coding/ec_task.go
index d0372da352..b9df6e3ed3 100644
--- a/weed/worker/tasks/erasure_coding/ec_task.go
+++ b/weed/worker/tasks/erasure_coding/ec_task.go
@@ -21,6 +21,7 @@ import (
 	storagetypes "github.com/seaweedfs/seaweedfs/weed/storage/types"
 	"github.com/seaweedfs/seaweedfs/weed/storage/volume_info"
 	"github.com/seaweedfs/seaweedfs/weed/storage/volume_replica"
+	"github.com/seaweedfs/seaweedfs/weed/util"
 	"github.com/seaweedfs/seaweedfs/weed/wdclient"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types"
 	"github.com/seaweedfs/seaweedfs/weed/worker/types/base"
@@ -36,6 +37,9 @@ type ErasureCodingTask struct {
 	workDir        string
 	progress       float64
 	grpcDialOption grpc.DialOption
+	// workerAddress is weed worker -address (host:port). Not a volume URL;
+	// late-bind matches replica hostnames against HostKey(workerAddress).
+	workerAddress string
 
 	// EC parameters
 	dataShards       int32
@@ -51,6 +55,15 @@ type ErasureCodingTask struct {
 	// pre-distribute sweep. deleteOriginalVolume skips these so it does not
 	// re-delete and remove the now-EC .vif those servers share.
 	emptyReplicasDeleted map[string]bool
+
+	// expireAtSec is the source volume's TTL expiry read with the file copy;
+	// it goes into the .vif so the EC volume honors the collection's TTL.
+	expireAtSec uint64
+
+	// encodedBlockSize is the shard block layout WriteEcFiles actually encoded
+	// with, read back off the EC context. Every holder must report serving the
+	// same one before the source volume may be deleted.
+	encodedBlockSize int64
 }
 
 // NewErasureCodingTask creates a new unified EC task instance
@@ -157,11 +170,20 @@ func (t *ErasureCodingTask) Execute(ctx context.Context, params *worker_pb.TaskP
 		}
 	}()
 
-	// Step 1: Mark all replicas readonly, then reconcile them and select the most
-	// complete replica as the encode source. Encoding a stale replica and then
-	// deleting the originals would silently lose entries that exist only on another
-	// replica; SyncAndSelectBestReplica builds the union onto the best replica first
-	// (mirrors the shell ec.encode best-replica selection).
+	// Step 0: Establish start-of-task invariants before any destructive step.
+	// Verify the plan is complete and clear EC shards left by a prior
+	// interrupted encode of this volume, so the encode begins from a clean
+	// slate. Failing here returns before the source is marked readonly or
+	// copied — nothing to roll back.
+	t.ReportProgressWithStage(5.0, "Verifying preconditions and clearing stale EC state")
+	t.GetLogger().Info("Verifying preconditions and clearing stale EC state")
+	if err := t.ensureCleanEcStart(ctx); err != nil {
+		return fmt.Errorf("EC preflight failed for volume %d: %w", t.volumeID, err)
+	}
+
+	// Step 1: Mark all replicas readonly, then compare live .idx NeedleId
+	// sets. A mismatch or idx read error aborts encode and does not build a union.
+	// The encode source is late-bound only when the sets match.
 	t.ReportProgressWithStage(10.0, "Marking volume readonly")
 	t.GetLogger().Info("Marking volume readonly")
 	if err := t.markReplicasReadonly(ctx); err != nil {
@@ -197,15 +219,11 @@ func (t *ErasureCodingTask) Execute(ctx context.Context, params *worker_pb.TaskP
 		return fmt.Errorf("failed to generate EC shards: %w", err)
 	}
 
-	// Clear partial EC shards left over on destinations from a prior failed
-	// encode so distributeEcShards' ReceiveFile is not refused by the
-	// mounted-volume guard.
-	t.ReportProgressWithStage(55.0, "Clearing stale EC shards on destinations")
-	t.GetLogger().Info("Clearing stale EC shards on destinations")
-	if err := t.cleanupStaleEcShards(ctx); err != nil {
-		t.rollbackReadonly(ctx)
-		return fmt.Errorf("failed to clear stale EC shards on destinations: %w", err)
-	}
+	// Stale EC shards from a prior interrupted encode were already cleared in
+	// the Step 0 preflight, before the source was marked readonly. The admin
+	// dedupe key (erasure_coding:<vid>:<collection>) prevents a concurrent
+	// same-volume encode, so no destination can regain stale shards between
+	// the preflight and distributeEcShards below.
 
 	// Delete 0-byte stub replicas left by an interrupted encode before the new
 	// EC files land. A stub shares the <collection>_<vid>.vif path the EC
@@ -219,10 +237,18 @@ func (t *ErasureCodingTask) Execute(ctx context.Context, params *worker_pb.TaskP
 		return fmt.Errorf("failed to remove empty stub replicas: %w", err)
 	}
 
-	// Step 4: Distribute shards to destinations
+	// Step 4: Distribute shards to destinations.
+	// From here on a failure has written shards to destinations. Until verify
+	// passes we are not committed to the EC copy, so a failure must roll the
+	// attempt back — tear down the shards it distributed and restore the
+	// sources to writable — otherwise a terminally-failed encode (a
+	// single-attempt job, or the last of a retry series, which has no successor
+	// to clean up at its Step 0 preflight) strands orphan shards and a source
+	// fenced readonly.
 	t.ReportProgressWithStage(60.0, "Distributing EC shards to destinations")
 	t.GetLogger().Info("Distributing EC shards to destinations")
 	if err := t.distributeEcShards(shardFiles); err != nil {
+		t.rollbackDistribute(ctx)
 		return fmt.Errorf("failed to distribute EC shards: %w", err)
 	}
 
@@ -230,6 +256,7 @@ func (t *ErasureCodingTask) Execute(ctx context.Context, params *worker_pb.TaskP
 	t.ReportProgressWithStage(80.0, "Mounting EC shards")
 	t.GetLogger().Info("Mounting EC shards")
 	if err := t.mountEcShards(); err != nil {
+		t.rollbackDistribute(ctx)
 		return fmt.Errorf("failed to mount EC shards: %w", err)
 	}
 
@@ -238,8 +265,12 @@ func (t *ErasureCodingTask) Execute(ctx context.Context, params *worker_pb.TaskP
 	t.ReportProgressWithStage(85.0, "Verifying EC shards across destinations")
 	t.GetLogger().Info("Verifying EC shards across destinations")
 	if err := t.verifyEcShardsBeforeDelete(ctx); err != nil {
+		t.rollbackDistribute(ctx)
 		return fmt.Errorf("EC shard verification failed; refusing to delete source volume %d: %w", t.volumeID, err)
 	}
+	// Past verify the EC copy is recoverable; a Step 7 failure must NOT tear the
+	// shards down — the remaining source replicas are cleaned by the next
+	// detection's cleanupOrphanSourceReplicas instead.
 
 	// Step 7: Delete original volume
 	t.ReportProgressWithStage(90.0, "Deleting original volume")
@@ -358,29 +389,48 @@ func (t *ErasureCodingTask) markReplicasReadonly(ctx context.Context) error {
 	return nil
 }
 
-// syncAndSelectSourceReplica reconciles the volume's replicas (building the union
-// of all live entries onto the most complete one) and switches the encode source
-// to that replica, so a stale replica is never the basis of the encode.
+// syncAndSelectSourceReplica compares live .idx sets after every replica is
+// readonly. Matching sets late-bind the encode source; a mismatch or idx RPC
+// error aborts without unioning replicas.
 func (t *ErasureCodingTask) syncAndSelectSourceReplica() error {
 	locs := t.replicaLocations()
-	if len(locs) <= 1 {
-		return nil // single replica: nothing to reconcile
+	workerAddr := strings.TrimSpace(t.workerAddress)
+	if workerAddr == "" {
+		workerAddr, _ = os.Hostname()
 	}
+	prefer := lateBindSourceToWorkerHost(t.server, workerAddr, locs)
 	var buf bytes.Buffer
-	best, err := volume_replica.SyncAndSelectBestReplica(t.grpcDialOption, needle.VolumeId(t.volumeID), t.collection, locs, "", &buf)
+	best, err := volume_replica.SelectSourceIfIndexesMatch(t.grpcDialOption, needle.VolumeId(t.volumeID), t.collection, locs, prefer, &buf)
 	if out := strings.TrimSpace(buf.String()); out != "" {
-		glog.Infof("EC encode replica sync for volume %d:\n%s", t.volumeID, out)
+		glog.Infof("EC encode replica idx compare for volume %d:\n%s", t.volumeID, out)
 	}
 	if err != nil {
 		return err
 	}
 	if best.Url != "" && best.Url != t.server {
-		glog.Infof("EC encode: using best replica %s as source for volume %d (was %s)", best.Url, t.volumeID, t.server)
+		glog.Infof("EC encode: late-binding source %s for volume %d (was %s)", best.Url, t.volumeID, t.server)
 		t.server = best.Url
 	}
 	return nil
 }
 
+// lateBindSourceToWorkerHost returns the replica on the worker -address host
+// (any port), keeping current when no replica shares that host. Worker address
+// is not a volume URL. Safe to prefer after the idx gate: matching live sets
+// make every listed replica an equivalent source.
+func lateBindSourceToWorkerHost(current, workerAddress string, locs []wdclient.Location) string {
+	workerHost := util.HostKey(workerAddress)
+	if workerHost == "" {
+		return current
+	}
+	for _, l := range locs {
+		if util.HostKey(l.Url) == workerHost {
+			return l.Url
+		}
+	}
+	return current
+}
+
 // rollbackReadonly is a best-effort restore of every replica markReplicasReadonly
 // touched, used when the EC task fails before the originals are deleted. Logs but
 // does not return errors; uses a fresh context since the caller's may be cancelled.
@@ -405,33 +455,60 @@ func (t *ErasureCodingTask) rollbackReadonly(_ context.Context) {
 	}
 }
 
+// ecCopyAttempts bounds how often the pinned file pair copy restarts after a
+// concurrent compaction bumps the source's CompactionRevision mid-copy.
+const ecCopyAttempts = 3
+
 // copyVolumeFilesToWorker copies .idx and .dat files from source server to local worker.
 // The .idx is copied first, then .dat. Both copies are capped to the sizes reported by
-// ReadVolumeFileStatus. If a write lands after .idx is copied, .dat may include extra
-// data not referenced by .idx (harmless). The reverse (idx referencing data past .dat)
-// is caught by verifyDatIdxConsistency in generateEcShardsLocally.
+// ReadVolumeFileStatus and pinned to its CompactionRevision so they come from the same
+// volume generation. A concurrent vacuum bumps that revision mid-copy, so a compaction
+// failure restarts the pair under a freshly read revision.
 func (t *ErasureCodingTask) copyVolumeFilesToWorker(ctx context.Context, workDir string) (map[string]string, error) {
 	localFiles := make(map[string]string)
 
-	fileStatus, err := t.readSourceVolumeFileStatus(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read source volume file status: %w", err)
+	var copyErr error
+	for attempt := 0; attempt < ecCopyAttempts; attempt++ {
+		fileStatus, err := t.readSourceVolumeFileStatus(ctx)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read source volume file status: %w", err)
+		}
+		t.expireAtSec = fileStatus.GetExpireAtSec()
+		if t.expireAtSec == 0 {
+			// Volume servers that predate the top-level field still carry the
+			// expiry in the nested .vif once SaveVolumeInfo has stamped it.
+			t.expireAtSec = fileStatus.GetVolumeInfo().GetExpireAtSec()
+		}
+
+		t.GetLogger().WithFields(map[string]interface{}{
+			"volume_id":           t.volumeID,
+			"source":              t.server,
+			"working_dir":         workDir,
+			"compaction_revision": fileStatus.GetCompactionRevision(),
+			"dat_file_size_bytes": fileStatus.GetDatFileSize(),
+			"idx_file_size_bytes": fileStatus.GetIdxFileSize(),
+		}).Info("Starting volume file copy from source server")
+
+		if copyErr = t.copyVolumeFilePair(ctx, workDir, fileStatus, localFiles); copyErr == nil {
+			return localFiles, nil
+		}
+		if !isVolumeCompactedError(copyErr) || ctx.Err() != nil {
+			return nil, copyErr
+		}
+		glog.Warningf("volume %d on %s compacted during EC file copy, restarting with fresh file status: %v", t.volumeID, t.server, copyErr)
 	}
+	return nil, copyErr
+}
 
-	t.GetLogger().WithFields(map[string]interface{}{
-		"volume_id":           t.volumeID,
-		"source":              t.server,
-		"working_dir":         workDir,
-		"compaction_revision": fileStatus.GetCompactionRevision(),
-		"dat_file_size_bytes": fileStatus.GetDatFileSize(),
-		"idx_file_size_bytes": fileStatus.GetIdxFileSize(),
-	}).Info("Starting volume file copy from source server")
-
-	// Copy .idx file FIRST — if a write lands on the source after this copy,
-	// the .dat copy will include the new data but .idx won't reference it.
+// copyVolumeFilePair copies .idx first, then .dat, pinned to the compaction
+// revision in fileStatus. If a write lands after .idx is copied, .dat may
+// include extra data not referenced by .idx (harmless). The reverse (idx
+// referencing data past .dat) is caught by verifyDatIdxConsistency in
+// generateEcShardsLocally.
+func (t *ErasureCodingTask) copyVolumeFilePair(ctx context.Context, workDir string, fileStatus *volume_server_pb.ReadVolumeFileStatusResponse, localFiles map[string]string) error {
 	idxFile := filepath.Join(workDir, fmt.Sprintf("%d.idx", t.volumeID))
 	if err := t.copyFileFromSource(ctx, ".idx", idxFile, fileStatus.GetCompactionRevision(), fileStatus.GetIdxFileSize()); err != nil {
-		return nil, fmt.Errorf("failed to copy .idx file: %w", err)
+		return fmt.Errorf("failed to copy .idx file: %w", err)
 	}
 	localFiles["idx"] = idxFile
 
@@ -447,7 +524,7 @@ func (t *ErasureCodingTask) copyVolumeFilesToWorker(ctx context.Context, workDir
 	// Copy .dat file SECOND — guaranteed to have at least as much data as .idx references.
 	datFile := filepath.Join(workDir, fmt.Sprintf("%d.dat", t.volumeID))
 	if err := t.copyFileFromSource(ctx, ".dat", datFile, fileStatus.GetCompactionRevision(), fileStatus.GetDatFileSize()); err != nil {
-		return nil, fmt.Errorf("failed to copy .dat file: %w", err)
+		return fmt.Errorf("failed to copy .dat file: %w", err)
 	}
 	localFiles["dat"] = datFile
 
@@ -460,7 +537,13 @@ func (t *ErasureCodingTask) copyVolumeFilesToWorker(ctx context.Context, workDir
 		}).Info("Volume data file copied successfully")
 	}
 
-	return localFiles, nil
+	return nil
+}
+
+// isVolumeCompactedError matches the failure CopyFile returns when the source
+// volume's CompactionRevision moved past the pinned one mid-copy.
+func isVolumeCompactedError(err error) bool {
+	return err != nil && strings.Contains(err.Error(), "is compacted")
 }
 
 func (t *ErasureCodingTask) readSourceVolumeFileStatus(ctx context.Context) (*volume_server_pb.ReadVolumeFileStatusResponse, error) {
@@ -563,16 +646,23 @@ func (t *ErasureCodingTask) generateEcShardsLocally(localFiles map[string]string
 	}
 
 	// Generate EC shard files (.ec00 ~ .ec13)
-	ecBitrot, err := erasure_coding.WriteEcFiles(baseName, erasure_coding.BackgroundECContext())
+	ecCtx := erasure_coding.BackgroundECContext()
+	ecBitrot, err := erasure_coding.WriteEcFiles(baseName, ecCtx)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate EC shard files: %w", err)
 	}
+	// The layout the shards were actually written in, for the holder agreement
+	// check before the source is deleted.
+	t.encodedBlockSize = ecCtx.BlockSize
 	// Persist the bitrot checksum sidecar (generation 0) alongside the shards so
-	// it travels with them during distribution. Best-effort: a failed sidecar
-	// write leaves the generation unprotected rather than failing the encode.
+	// it travels with them during distribution. Protection was asked for, and
+	// this write is orders of magnitude smaller than the shards that just
+	// landed: if it fails the disk is in trouble, and continuing would delete
+	// the source replicas in exchange for a generation that is both unprotected
+	// and missing the geometry record the .vif fallback reads.
 	if erasure_coding.BitrotProtectionEnabled && ecBitrot != nil {
 		if serr := erasure_coding.SaveBitrotSidecar(erasure_coding.BitrotSidecarPath(baseName, 0), ecBitrot); serr != nil {
-			glog.Warningf("failed to write EC bitrot sidecar for %s: %v", baseName, serr)
+			return nil, fmt.Errorf("write EC bitrot sidecar for %s: %w", baseName, serr)
 		}
 	}
 
@@ -642,10 +732,12 @@ func (t *ErasureCodingTask) generateEcShardsLocally(localFiles map[string]string
 	if ecBitrot != nil && ecBitrot.EcShardConfig != nil {
 		ecShardConfig.DataShards = ecBitrot.EcShardConfig.DataShards
 		ecShardConfig.ParityShards = ecBitrot.EcShardConfig.ParityShards
+		ecShardConfig.BlockSize = ecBitrot.EcShardConfig.BlockSize
 	}
 	volumeInfo := &volume_server_pb.VolumeInfo{
 		Version:       uint32(needle.GetCurrentVersion()),
 		EcShardConfig: ecShardConfig,
+		ExpireAtSec:   t.expireAtSec,
 	}
 	// The decoder resolves the shard block layout from the encode-time .dat
 	// size; without it, decoding falls back to inferring the layout from the
@@ -655,30 +747,40 @@ func (t *ErasureCodingTask) generateEcShardsLocally(localFiles map[string]string
 	} else {
 		glog.Warningf("stat %s for .vif dat file size: %v", datFile, err)
 	}
+	// The .vif carries the shard block layout the holders will read through, so
+	// neither the write nor the inclusion below is optional: an encode that
+	// distributed shards without it would leave every reader falling back to
+	// the legacy layout, and the task deletes the source replicas afterwards.
 	if err := volume_info.SaveVolumeInfo(vifFile, volumeInfo); err != nil {
-		glog.Warningf("Failed to create .vif file: %v", err)
-	} else {
-		shardFiles["vif"] = vifFile
-		if info, err := os.Stat(vifFile); err == nil {
-			t.GetLogger().WithFields(map[string]interface{}{
-				"file_type":  "vif",
-				"file_path":  vifFile,
-				"size_bytes": info.Size(),
-			}).Info("Volume info file generated")
-		}
+		return nil, fmt.Errorf("write %s: %w", vifFile, err)
 	}
+	vifInfo, err := os.Stat(vifFile)
+	if err != nil {
+		return nil, fmt.Errorf("stat %s for distribution: %w", vifFile, err)
+	}
+	shardFiles["vif"] = vifFile
+	t.GetLogger().WithFields(map[string]interface{}{
+		"file_type":  "vif",
+		"file_path":  vifFile,
+		"size_bytes": vifInfo.Size(),
+	}).Info("Volume info file generated")
 
 	// Add the generation-0 bitrot checksum sidecar so it is distributed with
 	// the shards (DistributeEcShards only ships files present in shardFiles).
-	// Best-effort like the sidecar write above: if it is absent the holders
-	// are simply unprotected rather than failing the encode.
+	// Strict when protection is enabled and the encoder produced a manifest —
+	// the write above already failed the encode otherwise — so the holders
+	// cannot end up with shards whose checksums stayed behind on the worker.
 	ecsumFile := erasure_coding.BitrotSidecarPath(baseName, 0)
-	if info, err := os.Stat(ecsumFile); err == nil {
+	ecsumInfo, ecsumErr := os.Stat(ecsumFile)
+	if ecsumErr != nil && erasure_coding.BitrotProtectionEnabled && ecBitrot != nil {
+		return nil, fmt.Errorf("stat %s for distribution: %w", ecsumFile, ecsumErr)
+	}
+	if ecsumErr == nil {
 		shardFiles["ecsum"] = ecsumFile
 		t.GetLogger().WithFields(map[string]interface{}{
 			"file_type":  "ecsum",
 			"file_path":  ecsumFile,
-			"size_bytes": info.Size(),
+			"size_bytes": ecsumInfo.Size(),
 		}).Info("EC bitrot checksum sidecar generated")
 	}
 
@@ -748,6 +850,20 @@ func (t *ErasureCodingTask) verifyEcShardsBeforeDelete(ctx context.Context) erro
 			"per_server":   summary,
 		}).Warning("EC shard set incomplete but recoverable; proceeding with source deletion")
 	}
+
+	// Before anything irreversible: every holder that answered must report
+	// serving the layout these shards were encoded in. A holder too old to
+	// know the uniform layout mounts them as legacy and returns wrong bytes,
+	// and the source volume is the only remaining correct copy.
+	if err := erasure_coding.RequireAgreedBlockLayout(t.volumeID, t.encodedBlockSize, perServer); err != nil {
+		t.GetLogger().WithFields(map[string]interface{}{
+			"volume_id":  t.volumeID,
+			"per_server": summary,
+			"error":      err.Error(),
+		}).Error("EC holders disagree on the shard block layout — source volume will be kept")
+		return err
+	}
+
 	return nil
 }
 
@@ -917,16 +1033,98 @@ func replicasPendingDelete(replicas []string, alreadyDeleted map[string]bool) []
 	return pending
 }
 
-// cleanupStaleEcShards unmounts and deletes any EC shards still mounted on
-// destinations from a previous failed encode of this volume. Targets every
-// node we plan to write to (t.targets) plus every node detection saw EC
-// shards on (t.sources with ShardIds set), and issues the cleanup over the
-// full shard range so a stale topology snapshot — or shards landed by a
-// prior attempt that haven't heartbeated yet — cannot leave the
-// mounted-volume guard tripped during distributeEcShards. Safe by ordering:
-// runs after the source .dat is in the worker's workdir and a full local
-// shard set is generated. Per-destination errors are aggregated, not
-// short-circuited.
+// ensureCleanEcStart runs first, before any destructive step, to establish
+// the invariants a fresh encode depends on:
+//   - a target set exists: an empty or malformed plan must fail here, not
+//     after the source has been marked readonly and copied;
+//   - a source replica exists to encode from;
+//   - no EC shards from a prior interrupted encode of this volume survive on
+//     the nodes this task will touch. Leftover partial shards trip the
+//     mounted-volume guard in distributeEcShards' ReceiveFile, are loaded as
+//     orphans on the next volume-server restart, and make detection refuse the
+//     volume ("Manual intervention required"). cleanupStaleEcShards blanket-
+//     wipes this volume's EC state on every touched node regardless of shard
+//     generation (a retried attempt's shards share this job's encodeTsNs, and
+//     an interrupted distribute often leaves shards with an unreadable
+//     generation — a fenced teardown would strand both).
+//
+// Cleaning at the start (rather than just before distribute) means the encode
+// begins from a clean slate and a preflight failure leaves the source
+// untouched — there is nothing to roll back. It is safe to delete stale shards
+// this early: the source's regular replica still holds the data until the
+// post-verify delete in Step 7.
+func (t *ErasureCodingTask) ensureCleanEcStart(ctx context.Context) error {
+	if len(t.targets) == 0 {
+		return fmt.Errorf("no EC shard targets for volume %d; refusing to mark source readonly", t.volumeID)
+	}
+	// A non-empty slice is not enough: a target with an empty Node (or no
+	// assigned shards) is silently skipped by cleanupStaleEcShards and by
+	// distributeEcShards, so a plan of only such entries would pass the length
+	// check and mark the source readonly before failing. Reject any malformed
+	// target here, before the first destructive step.
+	for i, target := range t.targets {
+		if target == nil || target.Node == "" || len(target.ShardIds) == 0 {
+			return fmt.Errorf("malformed EC shard target %d for volume %d; refusing to mark source readonly", i, t.volumeID)
+		}
+	}
+	if t.server == "" && len(t.getReplicas()) == 0 {
+		return fmt.Errorf("no source replica for volume %d", t.volumeID)
+	}
+	return t.cleanupStaleEcShards(ctx)
+}
+
+// rollbackDistribute undoes a failed attempt that had already begun writing EC
+// shards to destinations but had not yet committed to the EC copy (verify not
+// passed, so the sources are intact). It tears down the shards this attempt
+// distributed and restores the sources to writable, so a terminally-failed
+// encode — a single-attempt job, or the last of a retry series — leaves no
+// orphan shards and no source stuck readonly. On a retry the next attempt's
+// Step 0 preflight would also clear the shards, but the final attempt has no
+// successor; this makes every post-distribute failure self-cleaning.
+// cleanupStaleEcShards blanket-wipes this volume's EC state regardless of shard
+// generation — necessary because an interrupted distribute leaves shards whose
+// .vif generation is unreadable, which a fenced teardown would preserve.
+// Best-effort and uses a fresh context since the caller's may already be
+// cancelled (the very failure that brought us here).
+func (t *ErasureCodingTask) rollbackDistribute(_ context.Context) {
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+	if err := t.cleanupStaleEcShards(ctx); err != nil {
+		// The teardown could not fully clear this volume's EC shards (e.g. an
+		// unreachable destination, or a shard that failed to unmount). Leave the
+		// source readonly rather than expose it for writes while stale shards
+		// linger: a writable source beside mounted stale shards would let reads
+		// and writes diverge, and orphan cleanup will not remove a writable
+		// source. The next encode's Step 0 preflight (or an operator) reconciles
+		// the state once the shards are reachable.
+		glog.Warningf("rollback: EC shard teardown incomplete for volume %d; leaving source readonly for reconciliation: %v", t.volumeID, err)
+		return
+	}
+	t.rollbackReadonly(ctx)
+}
+
+// cleanupStaleEcShards unmounts and deletes any EC shards for this volume on
+// destinations from a previous failed encode. Targets every node we plan to
+// write to (t.targets) plus every node detection saw EC shards on (t.sources
+// with ShardIds set), and issues the cleanup over the full shard range so a
+// stale topology snapshot — or shards landed by a prior attempt that haven't
+// heartbeated yet — cannot leave the mounted-volume guard tripped during
+// distributeEcShards. Called from the Step 0 preflight (ensureCleanEcStart) and
+// from rollbackDistribute.
+//
+// Teardown is UNFENCED (encodeTsNs=0 -> the server's blanket teardown), which
+// wipes every EC artifact for this volume on every disk regardless of
+// generation. A generation fence is wrong here for two reasons: (1) a retried
+// encode's prior attempt shares this job's encodeTsNs, and the server's fence
+// preserves same-or-newer, so a fenced teardown would strand it; (2) shards
+// left by an interrupted distribute often have an UNREADABLE .vif generation
+// (the sidecar never landed), which the fence also preserves. This is a
+// pre-encode / rollback wipe of a volume we are (re)encoding or abandoning, so
+// clearing all of its EC state is correct — the admin dedupe key
+// (erasure_coding:<vid>:<collection>) guarantees no concurrent newer encode of
+// this volume, and the blanket teardown's own replacement check aborts rather
+// than clobber a live newer mount. This mirrors the shell ec.encode pre-encode
+// cleanup. Per-destination errors are aggregated, not short-circuited.
 func (t *ErasureCodingTask) cleanupStaleEcShards(ctx context.Context) error {
 	nodes := make(map[string]struct{})
 	for _, source := range t.sources {
@@ -955,7 +1153,10 @@ func (t *ErasureCodingTask) cleanupStaleEcShards(ctx context.Context) error {
 			"shard_ids":   allShards,
 		}).Info("Clearing stale EC shards on destination before re-distribute")
 
-		if err := unmountAndDeleteEcShards(ctx, t.grpcDialOption, node, t.volumeID, t.collection, allShards, t.encodeTsNs); err != nil {
+		// encodeTsNs=0 selects the server's blanket (generation-independent)
+		// teardown; see erasure_coding.UnmountAndDeleteEcShards for why the
+		// fence is intentionally not used here.
+		if err := erasure_coding.UnmountAndDeleteEcShards(ctx, t.grpcDialOption, pb.ServerAddress(node), t.collection, t.volumeID, allShards, 0); err != nil {
 			cleanupErrors = append(cleanupErrors, fmt.Sprintf("%s: %v", node, err))
 			t.GetLogger().WithFields(map[string]interface{}{
 				"volume_id":   t.volumeID,
@@ -990,47 +1191,6 @@ func fullShardIdRange(dataShards, parityShards int32) []uint32 {
 	return ids
 }
 
-// unmountAndDeleteEcShards unmounts then deletes the named shards on one
-// destination. Unmount must precede delete (delete requires the shard be
-// unmounted); both RPCs are idempotent against missing shards.
-func unmountAndDeleteEcShards(
-	ctx context.Context,
-	dialOption grpc.DialOption,
-	destination string,
-	volumeID uint32,
-	collection string,
-	shardIds []uint32,
-	encodeTsNs int64,
-) error {
-	return operation.WithVolumeServerClient(false, pb.ServerAddress(destination), dialOption,
-		func(client volume_server_pb.VolumeServerClient) error {
-			// encodeTsNs fences both RPCs against a newer run on a shared node: the
-			// server skips a disk whose mounted/on-disk generation is same-or-newer.
-			// 0 (legacy/shell) leaves the unconditional unmount + blanket teardown.
-			if _, err := client.VolumeEcShardsUnmount(ctx, &volume_server_pb.VolumeEcShardsUnmountRequest{
-				VolumeId:   volumeID,
-				ShardIds:   shardIds,
-				EncodeTsNs: encodeTsNs,
-			}); err != nil {
-				return fmt.Errorf("unmount: %w", err)
-			}
-			resp, err := client.VolumeEcShardsDelete(ctx, &volume_server_pb.VolumeEcShardsDeleteRequest{
-				VolumeId:     volumeID,
-				Collection:   collection,
-				ShardIds:     shardIds,
-				FullTeardown: true,
-				EncodeTsNs:   encodeTsNs,
-			})
-			if err != nil {
-				return fmt.Errorf("delete: %w", err)
-			}
-			if !resp.GetFullTeardownDone() {
-				return fmt.Errorf("delete: %s did not perform full teardown (pre-upgrade volume server?); a stale EC generation may remain", destination)
-			}
-			return nil
-		})
-}
-
 // verifyDatIdxConsistency checks that all .idx entries reference data within the
 // .dat file. Since .dat and .idx are copied as separate network transfers, the
 // .idx may have entries from writes that landed after the .dat was copied.
diff --git a/weed/worker/tasks/erasure_coding/ec_task_copy_retry_test.go b/weed/worker/tasks/erasure_coding/ec_task_copy_retry_test.go
new file mode 100644
index 0000000000..76294f6b14
--- /dev/null
+++ b/weed/worker/tasks/erasure_coding/ec_task_copy_retry_test.go
@@ -0,0 +1,166 @@
+package erasure_coding
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"sync"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// fakeCopySource is a stub VolumeServer. Rejecting a pinned .dat copy advances
+// the compaction revision and rewrites the volume contents, so a mid-copy
+// compaction is replayed deterministically.
+type fakeCopySource struct {
+	volume_server_pb.UnimplementedVolumeServerServer
+
+	mu          sync.Mutex
+	revision    uint32
+	datBytes    []byte
+	idxBytes    []byte
+	expireAtSec uint64
+	rejectDat   int
+	failErr     error
+	statusCalls int
+	copyCalls   int
+}
+
+func (f *fakeCopySource) snapshot() (revision uint32, expireAtSec uint64, statusCalls, copyCalls int) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.revision, f.expireAtSec, f.statusCalls, f.copyCalls
+}
+
+func (f *fakeCopySource) ReadVolumeFileStatus(context.Context, *volume_server_pb.ReadVolumeFileStatusRequest) (*volume_server_pb.ReadVolumeFileStatusResponse, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.statusCalls++
+	return &volume_server_pb.ReadVolumeFileStatusResponse{
+		CompactionRevision: f.revision,
+		DatFileSize:        uint64(len(f.datBytes)),
+		IdxFileSize:        uint64(len(f.idxBytes)),
+		ExpireAtSec:        f.expireAtSec,
+	}, nil
+}
+
+func (f *fakeCopySource) CopyFile(req *volume_server_pb.CopyFileRequest, stream grpc.ServerStreamingServer[volume_server_pb.CopyFileResponse]) error {
+	f.mu.Lock()
+	f.copyCalls++
+	reject := req.GetExt() == ".dat" && f.rejectDat > 0
+	if reject {
+		f.rejectDat--
+		f.revision++
+		f.datBytes = append(f.datBytes, 0xEC)
+		f.idxBytes = append(f.idxBytes, 0xEC)
+		f.expireAtSec += 100
+	}
+	failErr := f.failErr
+	revision := f.revision
+	var content []byte
+	switch req.GetExt() {
+	case ".idx":
+		content = f.idxBytes
+	case ".dat":
+		content = f.datBytes
+	}
+	f.mu.Unlock()
+
+	if failErr != nil {
+		return failErr
+	}
+	if reject || req.GetCompactionRevision() != revision {
+		return fmt.Errorf("volume %d is compacted", req.GetVolumeId())
+	}
+	content = content[:req.GetStopOffset()]
+	for len(content) > 0 {
+		n := min(len(content), 4)
+		if err := stream.Send(&volume_server_pb.CopyFileResponse{FileContent: content[:n]}); err != nil {
+			return err
+		}
+		content = content[n:]
+	}
+	return nil
+}
+
+func startFakeCopySource(t *testing.T, src *fakeCopySource) string {
+	t.Helper()
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	grpcServer := grpc.NewServer()
+	volume_server_pb.RegisterVolumeServerServer(grpcServer, src)
+	go grpcServer.Serve(lis)
+	t.Cleanup(grpcServer.Stop)
+	// server addresses carry httpPort.grpcPort; the gRPC dialer uses the part
+	// after the dot, so report the listening port that way
+	_, port, err := net.SplitHostPort(lis.Addr().String())
+	require.NoError(t, err)
+	return "127.0.0.1:0." + port
+}
+
+func newCopyRetryTask(addr string) *ErasureCodingTask {
+	return NewErasureCodingTask("copy-retry", addr, 951, "", grpc.WithTransportCredentials(insecure.NewCredentials()))
+}
+
+func TestCopyVolumeFilesToWorkerRetriesAfterMidCopyCompaction(t *testing.T) {
+	src := &fakeCopySource{
+		revision:    7,
+		idxBytes:    []byte("idx-data-v7"),
+		datBytes:    []byte("dat-payload-v7"),
+		expireAtSec: 1000,
+		rejectDat:   1,
+	}
+	task := newCopyRetryTask(startFakeCopySource(t, src))
+
+	localFiles, err := task.copyVolumeFilesToWorker(context.Background(), t.TempDir())
+	require.NoError(t, err)
+
+	datContent, err := os.ReadFile(localFiles["dat"])
+	require.NoError(t, err)
+	require.Equal(t, []byte("dat-payload-v7\xEC"), datContent)
+	idxContent, err := os.ReadFile(localFiles["idx"])
+	require.NoError(t, err)
+	require.Equal(t, []byte("idx-data-v7\xEC"), idxContent)
+	revision, expireAtSec, statusCalls, copyCalls := src.snapshot()
+	require.Equal(t, uint32(8), revision)
+	require.Equal(t, 2, statusCalls)
+	require.Equal(t, 4, copyCalls)
+	require.Equal(t, expireAtSec, task.expireAtSec)
+}
+
+func TestCopyVolumeFilesToWorkerStopsAfterRetryLimit(t *testing.T) {
+	src := &fakeCopySource{
+		revision:  1,
+		idxBytes:  []byte("i"),
+		datBytes:  []byte("d"),
+		rejectDat: 10,
+	}
+	task := newCopyRetryTask(startFakeCopySource(t, src))
+
+	_, err := task.copyVolumeFilesToWorker(context.Background(), t.TempDir())
+	require.ErrorContains(t, err, "is compacted")
+	_, _, statusCalls, copyCalls := src.snapshot()
+	require.Equal(t, ecCopyAttempts, statusCalls)
+	require.Equal(t, 2*ecCopyAttempts, copyCalls)
+}
+
+func TestCopyVolumeFilesToWorkerReturnsNonCompactionErrors(t *testing.T) {
+	src := &fakeCopySource{
+		revision: 1,
+		idxBytes: []byte("i"),
+		datBytes: []byte("d"),
+		failErr:  fmt.Errorf("boom"),
+	}
+	task := newCopyRetryTask(startFakeCopySource(t, src))
+
+	_, err := task.copyVolumeFilesToWorker(context.Background(), t.TempDir())
+	require.ErrorContains(t, err, "boom")
+	_, _, statusCalls, copyCalls := src.snapshot()
+	require.Equal(t, 1, statusCalls)
+	require.Equal(t, 1, copyCalls)
+}
diff --git a/weed/worker/tasks/erasure_coding/ec_task_encode_files_e2e_test.go b/weed/worker/tasks/erasure_coding/ec_task_encode_files_e2e_test.go
index 66632a09b4..2a6495ea70 100644
--- a/weed/worker/tasks/erasure_coding/ec_task_encode_files_e2e_test.go
+++ b/weed/worker/tasks/erasure_coding/ec_task_encode_files_e2e_test.go
@@ -19,15 +19,10 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 )
 
-// End-to-end on two servers: a volume with a real replica on server A and a
-// 0-byte stub replica of the same id on server B (an interrupted-encode
-// leftover). After a full EC encode the cluster must end in exactly one valid
-// layout — the complete shard set split across A and B, each with .ecx/.vif —
-// and every wrong file must be gone: both regular .dat files (source deleted
-// after verify, stub swept before distribute), no shard on the wrong server,
-// and B's shared <collection>_<vid>.vif intact rather than clobbered by the
-// stub's delete.
-func TestEcEncodeLeavesRightFilesAndRemovesStubAndSource(t *testing.T) {
+// End-to-end on two servers: a real replica on A and a 0-byte stub on B
+// (interrupted-encode leftover). Empty live-idx vs non-empty must refuse
+// encode; originals stay, t.server is not rebound to the stub.
+func TestEcEncodeRefusesOnEmptyStubReplica(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
 	}
@@ -66,8 +61,8 @@ func TestEcEncodeLeavesRightFilesAndRemovesStubAndSource(t *testing.T) {
 
 	dataShards := int(erasure_coding.DataShardsCount)
 	totalShards := int(erasure_coding.DataShardsCount + erasure_coding.ParityShardsCount)
-	aShards := shardRange(0, dataShards)            // 0..DataShardsCount-1 on A
-	bShards := shardRange(dataShards, totalShards)  // parity range on B
+	aShards := shardRange(0, dataShards)           // 0..DataShardsCount-1 on A
+	bShards := shardRange(dataShards, totalShards) // parity range on B
 
 	task := NewErasureCodingTask("ec-e2e", addrA, volumeID, collection, dialOption)
 	params := &worker_pb.TaskParams{
@@ -93,39 +88,16 @@ func TestEcEncodeLeavesRightFilesAndRemovesStubAndSource(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 	defer cancel()
 
-	require.NoError(t, task.Execute(ctx, params))
+	err := task.Execute(ctx, params)
+	require.Error(t, err, "empty live-idx vs non-empty must refuse encode")
+	require.Contains(t, err.Error(), "no union")
+	require.NotEqual(t, addrB, task.server, "after gate t.server is not a stub URL")
 
 	dirA := filepath.Join(cluster.BaseDir(), "volume0")
 	dirB := filepath.Join(cluster.BaseDir(), "volume1")
 	base := fmt.Sprintf("%s_%d", collection, volumeID)
-
-	// Both original regular volumes are gone: A's source deleted after verify,
-	// B's stub swept before distribute.
-	requireAbsent(t, dirA, base+".dat")
-	requireAbsent(t, dirA, base+".idx")
-	requireAbsent(t, dirB, base+".dat")
-	requireAbsent(t, dirB, base+".idx")
-
-	// Each server holds exactly its assigned shards, plus index/info sidecars.
-	for _, id := range aShards {
-		requirePresent(t, dirA, fmt.Sprintf("%s.ec%02d", base, id))
-	}
-	for _, id := range bShards {
-		requireAbsent(t, dirA, fmt.Sprintf("%s.ec%02d", base, id))
-	}
-	requirePresent(t, dirA, base+".ecx")
-	requirePresent(t, dirA, base+".vif")
-
-	for _, id := range bShards {
-		requirePresent(t, dirB, fmt.Sprintf("%s.ec%02d", base, id))
-	}
-	for _, id := range aShards {
-		requireAbsent(t, dirB, fmt.Sprintf("%s.ec%02d", base, id))
-	}
-	requirePresent(t, dirB, base+".ecx")
-	// The shared .vif must survive on B: the stub was deleted before the EC
-	// files landed, so deleteOriginalVolume never ran removeVolumeFiles there.
-	requirePresent(t, dirB, base+".vif")
+	requirePresent(t, dirA, base+".dat")
+	requirePresent(t, dirB, base+".dat")
 }
 
 // serverAddress builds the SeaweedFS ip:httpPort.grpcPort address the worker's
diff --git a/weed/worker/tasks/erasure_coding/ec_task_idx_gate_test.go b/weed/worker/tasks/erasure_coding/ec_task_idx_gate_test.go
new file mode 100644
index 0000000000..4273b29903
--- /dev/null
+++ b/weed/worker/tasks/erasure_coding/ec_task_idx_gate_test.go
@@ -0,0 +1,279 @@
+package erasure_coding
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/volume_server/framework"
+	"github.com/seaweedfs/seaweedfs/test/volume_server/matrix"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	"github.com/seaweedfs/seaweedfs/weed/storage/erasure_coding"
+	"github.com/seaweedfs/seaweedfs/weed/storage/idx"
+	"github.com/seaweedfs/seaweedfs/weed/storage/needle"
+	"github.com/seaweedfs/seaweedfs/weed/storage/types"
+	"github.com/seaweedfs/seaweedfs/weed/storage/volume_replica"
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+func TestEcEncodeAbortsOnEqualFileCountDifferentIds(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	cluster, task, params, ctx := twoReplicaTask(t, 9610, "ec-idx-mismatch")
+	httpClient := framework.NewHTTPClient()
+	const volumeID = uint32(9610)
+
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(0), volumeID, []uint64{1, 2, 3})
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(1), volumeID, []uint64{1, 2, 4})
+
+	require.NoError(t, task.markReplicasReadonly(ctx))
+	err := task.syncAndSelectSourceReplica()
+	require.Error(t, err, "equal FileCount with different ids must abort")
+	require.Contains(t, err.Error(), "no union")
+
+	execErr := task.Execute(ctx, params)
+	require.Error(t, execErr)
+	require.Contains(t, execErr.Error(), "no union")
+	require.NotContains(t, execErr.Error(), "building union")
+
+	dirA := cluster.VolumeDiskDir(0, 0)
+	dirB := cluster.VolumeDiskDir(1, 0)
+	base := fmt.Sprintf("%s_%d", "ec-idx-mismatch", volumeID)
+	requirePresent(t, dirA, base+".dat")
+	requirePresent(t, dirB, base+".dat")
+	require.True(t, idxHasNeedle(t, filepath.Join(dirA, base+".idx"), 3))
+	require.False(t, idxHasNeedle(t, filepath.Join(dirA, base+".idx"), 4))
+	require.True(t, idxHasNeedle(t, filepath.Join(dirB, base+".idx"), 4))
+	require.False(t, idxHasNeedle(t, filepath.Join(dirB, base+".idx"), 3))
+}
+
+func TestEcEncodeAllowsVacuumOffsetMismatch(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	cluster, task, params, ctx := twoReplicaTask(t, 9611, "ec-idx-vacuum")
+	httpClient := framework.NewHTTPClient()
+	const volumeID = uint32(9611)
+
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(0), volumeID, []uint64{10, 11, 12})
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(1), volumeID, []uint64{10, 11, 12})
+
+	// Delete the first needle so vacuum packs 11/12 to new offsets on A only.
+	deletedFID := framework.NewFileID(volumeID, 10, cookieFor(10))
+	for _, url := range []string{cluster.VolumeAdminURL(0), cluster.VolumeAdminURL(1)} {
+		req, err := http.NewRequest(http.MethodDelete, url+"/"+deletedFID, nil)
+		require.NoError(t, err)
+		resp := framework.DoRequest(t, httpClient, req)
+		_ = framework.ReadAllAndClose(t, resp)
+		require.Equal(t, http.StatusAccepted, resp.StatusCode)
+	}
+
+	connA, clientA := framework.DialVolumeServer(t, cluster.VolumeGRPCAddress(0))
+	defer connA.Close()
+	compactVolumeOnce(t, clientA, volumeID)
+
+	offA := needleOffset(t, filepath.Join(cluster.VolumeDiskDir(0, 0), "ec-idx-vacuum_9611.idx"), 11)
+	offB := needleOffset(t, filepath.Join(cluster.VolumeDiskDir(1, 0), "ec-idx-vacuum_9611.idx"), 11)
+	require.NotEqual(t, offA, offB, "vacuum should rewrite offsets on one replica")
+
+	require.NoError(t, task.Execute(ctx, params))
+}
+
+func TestEcEncodeAbortsWhenIdxRpcFails(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	cluster, task, _, ctx := twoReplicaTask(t, 9612, "ec-idx-rpc")
+	httpClient := framework.NewHTTPClient()
+	const volumeID = uint32(9612)
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(0), volumeID, []uint64{1})
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(1), volumeID, []uint64{1})
+
+	require.NoError(t, task.markReplicasReadonly(ctx))
+
+	locs := []wdclient.Location{
+		{Url: serverAddress(cluster, 0)},
+		{Url: "127.0.0.1:1"},
+	}
+	_, err := volume_replica.SelectSourceIfIndexesMatch(task.grpcDialOption, needle.VolumeId(volumeID), "ec-idx-rpc", locs, "", &bytes.Buffer{})
+	require.Error(t, err)
+}
+
+func TestEcEncodeSingleReplicaAfterReadonly(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	cluster := framework.StartVolumeCluster(t, matrix.P1())
+	conn, grpcClient := framework.DialVolumeServer(t, cluster.VolumeGRPCAddress())
+	defer conn.Close()
+
+	const volumeID = uint32(9613)
+	framework.AllocateVolume(t, grpcClient, volumeID, "ec-idx-one")
+	httpClient := framework.NewHTTPClient()
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(), volumeID, []uint64{7, 8})
+
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	task := NewErasureCodingTask("ec-idx-one", cluster.VolumeServerAddress(), volumeID, "ec-idx-one", dialOption)
+	params := singleReplicaParams(cluster.VolumeServerAddress(), volumeID, "ec-idx-one", t.TempDir())
+
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	defer cancel()
+
+	require.NoError(t, task.markReplicasReadonly(ctx))
+	require.NoError(t, task.syncAndSelectSourceReplica())
+	require.NoError(t, task.Execute(ctx, params))
+}
+
+func TestHttpWriteAfterReadonlyIsNotCreated(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	cluster := framework.StartVolumeCluster(t, matrix.P1())
+	conn, grpcClient := framework.DialVolumeServer(t, cluster.VolumeGRPCAddress())
+	defer conn.Close()
+
+	const volumeID = uint32(9614)
+	framework.AllocateVolume(t, grpcClient, volumeID, "")
+	httpClient := framework.NewHTTPClient()
+	uploadNeedles(t, httpClient, cluster.VolumeAdminURL(), volumeID, []uint64{1})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	_, err := grpcClient.VolumeMarkReadonly(ctx, &volume_server_pb.VolumeMarkReadonlyRequest{VolumeId: volumeID, Persist: true})
+	require.NoError(t, err)
+
+	fid := framework.NewFileID(volumeID, 99, cookieFor(99))
+	resp := framework.UploadBytes(t, httpClient, cluster.VolumeAdminURL(), fid, []byte("must-not-land"))
+	_ = framework.ReadAllAndClose(t, resp)
+	require.NotEqual(t, http.StatusCreated, resp.StatusCode)
+	require.NotEqual(t, http.StatusNoContent, resp.StatusCode)
+
+	idxPath := filepath.Join(cluster.BaseDir(), "volume", fmt.Sprintf("%d.idx", volumeID))
+	require.False(t, idxHasNeedle(t, idxPath, 99))
+}
+
+func twoReplicaTask(t *testing.T, volumeID uint32, collection string) (*framework.MultiVolumeCluster, *ErasureCodingTask, *worker_pb.TaskParams, context.Context) {
+	t.Helper()
+	cluster := framework.StartMultiVolumeCluster(t, matrix.P1(), 2)
+	dialOption := grpc.WithTransportCredentials(insecure.NewCredentials())
+	addrA := serverAddress(cluster, 0)
+	addrB := serverAddress(cluster, 1)
+
+	connA, clientA := framework.DialVolumeServer(t, cluster.VolumeGRPCAddress(0))
+	t.Cleanup(func() { connA.Close() })
+	connB, clientB := framework.DialVolumeServer(t, cluster.VolumeGRPCAddress(1))
+	t.Cleanup(func() { connB.Close() })
+	framework.AllocateVolume(t, clientA, volumeID, collection)
+	framework.AllocateVolume(t, clientB, volumeID, collection)
+
+	dataShards := int(erasure_coding.DataShardsCount)
+	totalShards := int(erasure_coding.DataShardsCount + erasure_coding.ParityShardsCount)
+	task := NewErasureCodingTask("ec-idx-gate", addrA, volumeID, collection, dialOption)
+	params := &worker_pb.TaskParams{
+		VolumeId:   volumeID,
+		Collection: collection,
+		Sources: []*worker_pb.TaskSource{
+			{Node: addrA, VolumeId: volumeID},
+			{Node: addrB, VolumeId: volumeID},
+		},
+		Targets: []*worker_pb.TaskTarget{
+			{Node: addrA, ShardIds: shardRange(0, dataShards)},
+			{Node: addrB, ShardIds: shardRange(dataShards, totalShards)},
+		},
+		TaskParams: &worker_pb.TaskParams_ErasureCodingParams{
+			ErasureCodingParams: &worker_pb.ErasureCodingTaskParams{
+				DataShards:   erasure_coding.DataShardsCount,
+				ParityShards: erasure_coding.ParityShardsCount,
+				WorkingDir:   t.TempDir(),
+			},
+		},
+	}
+	task.sources = params.Sources
+	task.targets = params.Targets
+	ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
+	t.Cleanup(cancel)
+	return cluster, task, params, ctx
+}
+
+func singleReplicaParams(node string, volumeID uint32, collection, workDir string) *worker_pb.TaskParams {
+	totalShards := int(erasure_coding.DataShardsCount + erasure_coding.ParityShardsCount)
+	return &worker_pb.TaskParams{
+		VolumeId:   volumeID,
+		Collection: collection,
+		Sources:    []*worker_pb.TaskSource{{Node: node, VolumeId: volumeID}},
+		Targets:    []*worker_pb.TaskTarget{{Node: node, ShardIds: shardRange(0, totalShards)}},
+		TaskParams: &worker_pb.TaskParams_ErasureCodingParams{
+			ErasureCodingParams: &worker_pb.ErasureCodingTaskParams{
+				DataShards:   erasure_coding.DataShardsCount,
+				ParityShards: erasure_coding.ParityShardsCount,
+				WorkingDir:   workDir,
+			},
+		},
+	}
+}
+
+func cookieFor(id uint64) uint32 {
+	return 0xEC100000 + uint32(id)
+}
+
+func uploadNeedles(t *testing.T, client *http.Client, volumeURL string, volumeID uint32, ids []uint64) {
+	t.Helper()
+	for _, id := range ids {
+		fid := framework.NewFileID(volumeID, id, cookieFor(id))
+		resp := framework.UploadBytes(t, client, volumeURL, fid, []byte(fmt.Sprintf("payload-%d", id)))
+		_ = framework.ReadAllAndClose(t, resp)
+		require.Equal(t, http.StatusCreated, resp.StatusCode)
+	}
+}
+
+func idxHasNeedle(t *testing.T, idxPath string, id uint64) bool {
+	t.Helper()
+	f, err := os.Open(idxPath)
+	require.NoError(t, err)
+	defer f.Close()
+	want := types.NeedleId(id)
+	found := false
+	err = idx.WalkIndexFile(f, 0, func(key types.NeedleId, offset types.Offset, size types.Size) error {
+		if key == want && !offset.IsZero() && !size.IsDeleted() {
+			found = true
+		}
+		return nil
+	})
+	require.NoError(t, err)
+	return found
+}
+
+func needleOffset(t *testing.T, idxPath string, id uint64) types.Offset {
+	t.Helper()
+	f, err := os.Open(idxPath)
+	require.NoError(t, err)
+	defer f.Close()
+	want := types.NeedleId(id)
+	var off types.Offset
+	var seen bool
+	err = idx.WalkIndexFile(f, 0, func(key types.NeedleId, offset types.Offset, size types.Size) error {
+		if key == want && !offset.IsZero() && !size.IsDeleted() {
+			off = offset
+			seen = true
+		}
+		return nil
+	})
+	require.NoError(t, err)
+	require.True(t, seen, "needle %d missing in %s", id, idxPath)
+	return off
+}
diff --git a/weed/worker/tasks/erasure_coding/ec_task_julor_layout_e2e_test.go b/weed/worker/tasks/erasure_coding/ec_task_julor_layout_e2e_test.go
index f543f01344..600aac92e0 100644
--- a/weed/worker/tasks/erasure_coding/ec_task_julor_layout_e2e_test.go
+++ b/weed/worker/tasks/erasure_coding/ec_task_julor_layout_e2e_test.go
@@ -2,10 +2,7 @@ package erasure_coding
 
 import (
 	"context"
-	"fmt"
 	"net/http"
-	"os"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -19,20 +16,10 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 )
 
-// Reproduces the issue-9478 volume-13 layout end to end on a multi-server,
-// multi-disk cluster and asserts the cluster converges to exactly one valid EC
-// layout. Before the encode the volume is in the stuck state: a real .dat
-// source, a 0-byte stub replica left by an interrupted encode, and partial
-// stale EC shards from that attempt. After the worker runs (sweep stubs ->
-// clear stale shards -> distribute -> mount -> verify -> delete originals):
-//
-//   - every assigned shard is present on its target disk, with .ecx/.vif
-//     alongside it (the EC volume's info file survives even when shards land on
-//     the source's own disk);
-//   - no regular .dat/.idx remains anywhere — the source is deleted after
-//     verify, the stub was swept before distribute;
-//   - the stale shards that aren't part of the new assignment are gone.
-func TestEcEncodeJulorLayoutConverges(t *testing.T) {
+// A real .dat source plus a 0-byte stub replica left by an interrupted encode
+// and partial stale EC shards: empty live-idx vs non-empty must refuse encode
+// (no union, no skip).
+func TestEcEncodeJulorLayoutRefuses(t *testing.T) {
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
 	}
@@ -108,9 +95,9 @@ func TestEcEncodeJulorLayoutConverges(t *testing.T) {
 		VolumeId:   volumeID,
 		Collection: collection,
 		Sources: []*worker_pb.TaskSource{
-			{Node: addr(srcServer), VolumeId: volumeID},                         // real source
-			{Node: addr(stubServer), VolumeId: volumeID},                        // 0-byte stub
-			{Node: addr(srcServer), VolumeId: volumeID, ShardIds: staleShards},  // stale EC shards to clear
+			{Node: addr(srcServer), VolumeId: volumeID},                        // real source
+			{Node: addr(stubServer), VolumeId: volumeID},                       // 0-byte stub
+			{Node: addr(srcServer), VolumeId: volumeID, ShardIds: staleShards}, // stale EC shards to clear
 		},
 		Targets: targets,
 		TaskParams: &worker_pb.TaskParams_ErasureCodingParams{
@@ -122,52 +109,8 @@ func TestEcEncodeJulorLayoutConverges(t *testing.T) {
 		},
 	}
 
-	require.NoError(t, task.Execute(ctx, params))
-
-	base := fmt.Sprintf("%s_%d", collection, volumeID)
-
-	// Shards are distributed per-server; the disk within a server is auto-selected
-	// when DiskId is 0, and on a multi-disk server shards can spread to a sibling
-	// disk while the .ecx/.vif index lives on one of them (the cross-disk EC
-	// layout). So assert per server (aggregate across its disks): each server
-	// holds exactly its assigned shards, its .ecx/.vif survive on at least one
-	// disk (the info file is not stripped, even on the source's own disk), and no
-	// regular .dat/.idx remains. Stale shards 11-13 mounted on the source must be
-	// gone — they are not in S0's assignment.
-	serverShards := map[int][]uint32{
-		0: shardRange(0, 5),   // S0 (source): 0..4
-		1: shardRange(5, 10),  // S1 (stub):   5..9
-		2: shardRange(10, 14), // S2 (target): 10..13
-	}
-	allShards := map[uint32]bool{}
-	for server, want := range serverShards {
-		found := map[uint32]bool{}
-		hasEcx, hasVif := false, false
-		for d := 0; d < disksPerServer; d++ {
-			dir := cluster.VolumeDiskDir(server, d)
-			requireAbsent(t, dir, base+".dat")
-			requireAbsent(t, dir, base+".idx")
-			for id := 0; id < erasure_coding.TotalShardsCount; id++ {
-				if ecFileExists(dir, fmt.Sprintf("%s.ec%02d", base, id)) {
-					found[uint32(id)] = true
-					allShards[uint32(id)] = true
-				}
-			}
-			hasEcx = hasEcx || ecFileExists(dir, base+".ecx")
-			hasVif = hasVif || ecFileExists(dir, base+".vif")
-		}
-		gotIDs := make([]uint32, 0, len(found))
-		for id := range found {
-			gotIDs = append(gotIDs, id)
-		}
-		require.ElementsMatch(t, want, gotIDs, "server %d should hold exactly its assigned shards", server)
-		require.True(t, hasEcx, "server %d must keep its .ecx", server)
-		require.True(t, hasVif, "server %d must keep its .vif (not stripped by the original-volume delete)", server)
-	}
-	require.Len(t, allShards, erasure_coding.TotalShardsCount, "the full shard set must be present across the cluster")
-}
-
-func ecFileExists(dir, name string) bool {
-	_, err := os.Stat(filepath.Join(dir, name))
-	return err == nil
+	err = task.Execute(ctx, params)
+	require.Error(t, err, "empty live-idx vs non-empty must refuse encode")
+	require.Contains(t, err.Error(), "no union")
+	require.NotEqual(t, addr(stubServer), task.server, "after gate t.server is not a stub URL")
 }
diff --git a/weed/worker/tasks/erasure_coding/ec_task_preflight_test.go b/weed/worker/tasks/erasure_coding/ec_task_preflight_test.go
new file mode 100644
index 0000000000..4fb4a6d507
--- /dev/null
+++ b/weed/worker/tasks/erasure_coding/ec_task_preflight_test.go
@@ -0,0 +1,231 @@
+package erasure_coding
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/test/volume_server/framework"
+	"github.com/seaweedfs/seaweedfs/test/volume_server/matrix"
+	"github.com/seaweedfs/seaweedfs/weed/pb/volume_server_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// Reproduces the swtest interrupted-encode scenario at the task boundary: a
+// previous encode of this volume was cut mid-distribute, leaving partial EC
+// shards mounted on a destination. When a fresh encode task starts, its Step 0
+// preflight (ensureCleanEcStart) must clear those shards before any
+// destructive step, so distribute's ReceiveFile is not refused and no orphan
+// shards survive to confuse the volume-server loader or make detection refuse
+// the volume. The destination is named only as a target (no source row) to
+// prove the preflight reaches the full write set, not just shard-bearing
+// sources.
+func TestEnsureCleanEcStartClearsStaleShardsBeforeEncode(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	clusterHarness := framework.StartVolumeCluster(t, matrix.P1())
+	conn, grpcClient := framework.DialVolumeServer(t, clusterHarness.VolumeGRPCAddress())
+	defer conn.Close()
+
+	const (
+		volumeID   = uint32(94782)
+		collection = "ec-preflight-invariant"
+	)
+
+	framework.AllocateVolume(t, grpcClient, volumeID, collection)
+
+	httpClient := framework.NewHTTPClient()
+	fid := framework.NewFileID(volumeID, 9478200, 0x9478BEEF)
+	upResp := framework.UploadBytes(t, httpClient, clusterHarness.VolumeAdminURL(), fid,
+		[]byte("payload-for-preflight-stale-ec-cleanup"))
+	_ = framework.ReadAllAndClose(t, upResp)
+	require.Equal(t, http.StatusCreated, upResp.StatusCode)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	_, err := grpcClient.VolumeEcShardsGenerate(ctx, &volume_server_pb.VolumeEcShardsGenerateRequest{
+		VolumeId: volumeID, Collection: collection,
+	})
+	require.NoError(t, err)
+
+	// A half-finished previous distribute left a partial shard set mounted.
+	staleShards := []uint32{0, 1, 2}
+	_, err = grpcClient.VolumeEcShardsMount(ctx, &volume_server_pb.VolumeEcShardsMountRequest{
+		VolumeId: volumeID, Collection: collection,
+		ShardIds: staleShards,
+	})
+	require.NoError(t, err)
+
+	shardPath := makeTinyEcShardFile(t)
+
+	// Precondition for the reproduction: the mounted partial EC blocks a fresh
+	// ReceiveFile via the mounted-volume guard.
+	err = sendShardViaReceiveFile(ctx, grpcClient, volumeID, collection, 0, shardPath)
+	require.Error(t, err, "expected ReceiveFile to be refused while stale EC volume is mounted")
+
+	task := NewErasureCodingTask(
+		"preflight-invariant",
+		clusterHarness.VolumeServerAddress(),
+		volumeID,
+		collection,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	// Named only as a target — no source row for this node. The preflight must
+	// still clear its stale shards.
+	task.targets = []*worker_pb.TaskTarget{
+		{Node: clusterHarness.VolumeServerAddress(), VolumeId: volumeID, ShardIds: []uint32{0}},
+	}
+
+	require.NoError(t, task.ensureCleanEcStart(ctx),
+		"Step 0 preflight must clear stale EC shards at task start")
+
+	_, infoErr := grpcClient.VolumeEcShardsInfo(ctx, &volume_server_pb.VolumeEcShardsInfoRequest{VolumeId: volumeID})
+	require.Error(t, infoErr, "stale EC volume must be gone after the preflight")
+
+	require.NoError(t,
+		sendShardViaReceiveFile(ctx, grpcClient, volumeID, collection, 0, shardPath),
+		"ReceiveFile must succeed once the preflight has cleared the stale shards")
+}
+
+// A post-distribute failure that has no successor to clean up after it (a
+// single-attempt job, or the last of a retry series) must leave nothing behind:
+// rollbackDistribute tears down the shards this attempt wrote while leaving the
+// source volume intact for a future re-encode. Reproduces the swtest finding
+// that a terminally-failed encode stranded orphan shards.
+func TestRollbackDistributeClearsShardsAndKeepsSource(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	clusterHarness := framework.StartVolumeCluster(t, matrix.P1())
+	conn, grpcClient := framework.DialVolumeServer(t, clusterHarness.VolumeGRPCAddress())
+	defer conn.Close()
+
+	const (
+		volumeID   = uint32(94783)
+		collection = "ec-rollback-distribute"
+	)
+
+	framework.AllocateVolume(t, grpcClient, volumeID, collection)
+
+	httpClient := framework.NewHTTPClient()
+	fid := framework.NewFileID(volumeID, 9478300, 0x9478D00D)
+	upResp := framework.UploadBytes(t, httpClient, clusterHarness.VolumeAdminURL(), fid,
+		[]byte("payload-for-rollback-distribute"))
+	_ = framework.ReadAllAndClose(t, upResp)
+	require.Equal(t, http.StatusCreated, upResp.StatusCode)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+
+	_, err := grpcClient.VolumeEcShardsGenerate(ctx, &volume_server_pb.VolumeEcShardsGenerateRequest{
+		VolumeId: volumeID, Collection: collection,
+	})
+	require.NoError(t, err)
+	// Shards this attempt "distributed" and mounted on the destination.
+	_, err = grpcClient.VolumeEcShardsMount(ctx, &volume_server_pb.VolumeEcShardsMountRequest{
+		VolumeId: volumeID, Collection: collection,
+		ShardIds: []uint32{0, 1, 2, 3},
+	})
+	require.NoError(t, err)
+
+	task := NewErasureCodingTask(
+		"rollback-distribute",
+		clusterHarness.VolumeServerAddress(),
+		volumeID,
+		collection,
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	task.targets = []*worker_pb.TaskTarget{
+		{Node: clusterHarness.VolumeServerAddress(), VolumeId: volumeID, ShardIds: []uint32{0}},
+	}
+
+	// Simulate the failure path after distribute began.
+	task.rollbackDistribute(ctx)
+
+	_, infoErr := grpcClient.VolumeEcShardsInfo(ctx, &volume_server_pb.VolumeEcShardsInfoRequest{VolumeId: volumeID})
+	require.Error(t, infoErr, "rollback must tear down the shards this attempt distributed")
+
+	// The source normal volume must survive so a future re-encode can proceed.
+	_, statusErr := grpcClient.VolumeStatus(ctx, &volume_server_pb.VolumeStatusRequest{VolumeId: volumeID})
+	require.NoError(t, statusErr, "rollback must leave the source volume intact")
+}
+
+// A malformed plan (no targets) must be rejected by the preflight before the
+// source is marked readonly or copied, so a bad plan cannot leave the source
+// fenced readonly with nothing to show for it. Pure precondition check: no
+// cluster and no RPC.
+func TestEnsureCleanEcStartRejectsMissingTargets(t *testing.T) {
+	task := NewErasureCodingTask(
+		"preflight-no-targets",
+		"10.0.0.1:8080",
+		42,
+		"c",
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	// No targets set.
+	err := task.ensureCleanEcStart(context.Background())
+	require.Error(t, err, "preflight must reject an encode with no shard targets")
+	require.True(t, strings.Contains(err.Error(), "no EC shard targets"),
+		"error must name the missing-targets invariant, got: %v", err)
+}
+
+// A non-empty target slice whose entries are malformed (nil, empty Node, or no
+// assigned shards) must also be rejected before the source is marked readonly —
+// cleanupStaleEcShards silently skips such entries, so a length check alone
+// would let the encode proceed with nothing to distribute to.
+func TestEnsureCleanEcStartRejectsMalformedTarget(t *testing.T) {
+	cases := map[string][]*worker_pb.TaskTarget{
+		"nil target": {nil},
+		"empty node": {{Node: "", VolumeId: 42, ShardIds: []uint32{0}}},
+		"no shards":  {{Node: "10.0.0.2:8080", VolumeId: 42}},
+		"one good one bad": {
+			{Node: "10.0.0.2:8080", VolumeId: 42, ShardIds: []uint32{0}},
+			{Node: "", VolumeId: 42, ShardIds: []uint32{1}},
+		},
+	}
+	for name, targets := range cases {
+		t.Run(name, func(t *testing.T) {
+			task := NewErasureCodingTask(
+				"preflight-malformed-target",
+				"10.0.0.1:8080",
+				42,
+				"c",
+				grpc.WithTransportCredentials(insecure.NewCredentials()),
+			)
+			task.targets = targets
+			err := task.ensureCleanEcStart(context.Background())
+			require.Error(t, err, "preflight must reject a malformed target")
+			require.True(t, strings.Contains(err.Error(), "malformed EC shard target"),
+				"error must name the malformed-target invariant, got: %v", err)
+		})
+	}
+}
+
+// A plan with targets but no source replica and no assigned server must be
+// rejected before any destructive step.
+func TestEnsureCleanEcStartRejectsMissingSource(t *testing.T) {
+	task := NewErasureCodingTask(
+		"preflight-no-source",
+		"", // no assigned server
+		42,
+		"c",
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+	task.targets = []*worker_pb.TaskTarget{
+		{Node: "10.0.0.2:8080", VolumeId: 42, ShardIds: []uint32{0}},
+	}
+	// No sources and no server.
+	err := task.ensureCleanEcStart(context.Background())
+	require.Error(t, err, "preflight must reject an encode with no source replica")
+	require.True(t, strings.Contains(err.Error(), "no source replica"),
+		"error must name the missing-source invariant, got: %v", err)
+}
diff --git a/weed/worker/tasks/erasure_coding/ec_task_source_host_test.go b/weed/worker/tasks/erasure_coding/ec_task_source_host_test.go
new file mode 100644
index 0000000000..38b08487cc
--- /dev/null
+++ b/weed/worker/tasks/erasure_coding/ec_task_source_host_test.go
@@ -0,0 +1,34 @@
+package erasure_coding
+
+import (
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/wdclient"
+)
+
+func TestLateBindSourceToWorkerHostPrefersWorkerHost(t *testing.T) {
+	a := wdclient.Location{Url: "full-01:8080"}
+	b := wdclient.Location{Url: "full-02:8081"}
+	worker := "full-02:9334"
+
+	// Sources [A,B] — topology-first is A; worker on B must still copy B.
+	if got := lateBindSourceToWorkerHost(a.Url, worker, []wdclient.Location{a, b}); got != b.Url {
+		t.Fatalf("Sources [A,B] worker B: got %s want %s", got, b.Url)
+	}
+	// Invert Sources — still B.
+	if got := lateBindSourceToWorkerHost(b.Url, worker, []wdclient.Location{b, a}); got != b.Url {
+		t.Fatalf("Sources [B,A] worker B: got %s want %s", got, b.Url)
+	}
+}
+
+func TestLateBindSourceToWorkerHostNoMatchKeepsCurrent(t *testing.T) {
+	a := wdclient.Location{Url: "full-01:8080"}
+	b := wdclient.Location{Url: "full-02:8081"}
+
+	if got := lateBindSourceToWorkerHost(a.Url, "other-host:9334", []wdclient.Location{a, b}); got != a.Url {
+		t.Fatalf("no worker-host replica: got %s want %s", got, a.Url)
+	}
+	if got := lateBindSourceToWorkerHost(a.Url, "", []wdclient.Location{a, b}); got != a.Url {
+		t.Fatalf("empty worker address: got %s want %s", got, a.Url)
+	}
+}
diff --git a/weed/worker/tasks/erasure_coding/ec_task_test.go b/weed/worker/tasks/erasure_coding/ec_task_test.go
index 56dbc9d206..dc4548e95d 100644
--- a/weed/worker/tasks/erasure_coding/ec_task_test.go
+++ b/weed/worker/tasks/erasure_coding/ec_task_test.go
@@ -168,6 +168,7 @@ func TestGenerateEcShardsLocallyStampsEncodeIdentity(t *testing.T) {
 	require.Greater(t, vi.EcShardConfig.DataShards, uint32(0))
 	require.Greater(t, vi.EcShardConfig.ParityShards, uint32(0))
 	require.NotZero(t, vi.EcShardConfig.EncodeTsNs, "worker-encoded .vif must carry an encode identity")
+	require.Zero(t, vi.ExpireAtSec, "a source with no TTL must not gain an expiry")
 }
 
 // A fenced run must stamp the admin-issued generation (t.encodeTsNs) verbatim into
@@ -218,6 +219,56 @@ func TestGenerateEcShardsLocallyUsesAdminGeneration(t *testing.T) {
 	require.Equal(t, adminGeneration, vi.EcShardConfig.EncodeTsNs, "fenced run must stamp the admin generation verbatim, not a local timestamp")
 }
 
+// The worker-written .vif must carry the source volume's TTL expiry, or the EC
+// volume never becomes eligible for deletion while the shell ec.encode path does.
+func TestGenerateEcShardsLocallyCarriesExpiry(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+
+	clusterHarness := framework.StartVolumeCluster(t, matrix.P1())
+	conn, grpcClient := framework.DialVolumeServer(t, clusterHarness.VolumeGRPCAddress())
+	defer conn.Close()
+
+	const volumeID = uint32(958)
+	framework.AllocateVolumeWithTTL(t, grpcClient, volumeID, "", "10m")
+
+	httpClient := framework.NewHTTPClient()
+	fid := framework.NewFileID(volumeID, 4001, 0x6666FFFF)
+	resp := framework.UploadBytes(t, httpClient, clusterHarness.VolumeAdminURL(), fid, []byte("payload-for-ec-expiry"))
+	_ = framework.ReadAllAndClose(t, resp)
+	require.Equal(t, http.StatusCreated, resp.StatusCode)
+
+	task := NewErasureCodingTask(
+		"ec-carry-expiry",
+		clusterHarness.VolumeServerAddress(),
+		volumeID,
+		"",
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	require.NoError(t, task.markReplicasReadonly(ctx))
+
+	fileStatus, err := task.readSourceVolumeFileStatus(ctx)
+	require.NoError(t, err)
+	want := fileStatus.GetExpireAtSec()
+	require.NotZero(t, want, "a TTL'd source must report a nonzero expiry")
+
+	localFiles, err := task.copyVolumeFilesToWorker(ctx, t.TempDir())
+	require.NoError(t, err)
+
+	shardFiles, err := task.generateEcShardsLocally(localFiles, t.TempDir())
+	require.NoError(t, err)
+
+	vi, _, found, err := volume_info.MaybeLoadVolumeInfo(shardFiles["vif"])
+	require.NoError(t, err)
+	require.True(t, found)
+	require.Equal(t, want, vi.ExpireAtSec, "worker .vif must carry the source volume's TTL expiry")
+}
+
 func compactVolumeOnce(t *testing.T, grpcClient volume_server_pb.VolumeServerClient, volumeID uint32) {
 	t.Helper()
 
diff --git a/weed/worker/tasks/erasure_coding/plugin_handler.go b/weed/worker/tasks/erasure_coding/plugin_handler.go
index f62fea8209..5071529b6d 100644
--- a/weed/worker/tasks/erasure_coding/plugin_handler.go
+++ b/weed/worker/tasks/erasure_coding/plugin_handler.go
@@ -26,7 +26,9 @@ func init() {
 		Category: pluginworker.CategoryHeavy,
 		Aliases:  []string{"erasure-coding", "erasure.coding", "ec"},
 		Build: func(opts pluginworker.HandlerBuildOptions) (pluginworker.JobHandler, error) {
-			return NewErasureCodingHandler(opts.GrpcDialOption, opts.WorkingDir), nil
+			h := NewErasureCodingHandler(opts.GrpcDialOption, opts.WorkingDir)
+			h.workerAddress = strings.TrimSpace(opts.WorkerAddress)
+			return h, nil
 		},
 	})
 }
@@ -39,6 +41,7 @@ type erasureCodingWorkerConfig struct {
 type ErasureCodingHandler struct {
 	grpcDialOption grpc.DialOption
 	workingDir     string
+	workerAddress  string
 }
 
 func NewErasureCodingHandler(grpcDialOption grpc.DialOption, workingDir string) *ErasureCodingHandler {
@@ -78,7 +81,7 @@ func (h *ErasureCodingHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 						{
 							Name:        "collection_filter",
 							Label:       "Collection Filter",
-							Description: "Only detect erasure coding opportunities in this collection when set.",
+							Description: "Only erasure code volumes in matching collections. Comma-separated list of names, wildcards, or regex patterns.",
 							Placeholder: "all collections",
 							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
 							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,
@@ -95,7 +98,7 @@ func (h *ErasureCodingHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 		WorkerConfigForm: &plugin_pb.ConfigForm{
 			FormId:      "erasure-coding-worker",
 			Title:       "Erasure Coding Worker Config",
-			Description: "Worker-side detection thresholds.",
+			Description: "Worker-side detection and shard placement.",
 			Sections: []*plugin_pb.ConfigSection{
 				{
 					SectionId:   "thresholds",
@@ -130,6 +133,13 @@ func (h *ErasureCodingHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 							Required:    true,
 							MinValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 1}},
 						},
+					},
+				},
+				{
+					SectionId:   "placement",
+					Title:       "Shard Placement",
+					Description: "Where EC shards go: disk tags, replica-placement caps, Place ranking.",
+					Fields: []*plugin_pb.ConfigField{
 						{
 							Name:        "preferred_tags",
 							Label:       "Preferred Tags",
@@ -146,6 +156,22 @@ func (h *ErasureCodingHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
 							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,
 						},
+						{
+							Name:        "free_slots_deadband",
+							Label:       "Free Volume Deadband (M)",
+							Description: "Nodes whose free volume slots differ by at most M are a tie; then fewer live shards wins. Applied as M × data shards (10+4 → ×10). 0 = always pick more free slots.",
+							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_INT64,
+							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_NUMBER,
+							MinValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0}},
+							MaxValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 100000}},
+						},
+						{
+							Name:        "strict_placement",
+							Label:       "Strict Placement",
+							Description: "Fail EC planning when the placement constraints cannot be met instead of relaxing them.",
+							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_BOOL,
+							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TOGGLE,
+						},
 					},
 				},
 			},
@@ -165,6 +191,12 @@ func (h *ErasureCodingHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 				"replica_placement": {
 					Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""},
 				},
+				"strict_placement": {
+					Kind: &plugin_pb.ConfigValue_BoolValue{BoolValue: false},
+				},
+				"free_slots_deadband": {
+					Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0},
+				},
 			},
 		},
 		AdminRuntimeDefaults: &plugin_pb.AdminRuntimeDefaults{
@@ -192,6 +224,9 @@ func (h *ErasureCodingHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 			"preferred_tags": {
 				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""},
 			},
+			"free_slots_deadband": {
+				Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0},
+			},
 		},
 	}
 }
@@ -296,7 +331,10 @@ func emitErasureCodingDetectionDecisionTrace(
 
 	quietThreshold := time.Duration(taskConfig.QuietForSeconds) * time.Second
 	minSizeBytes := uint64(taskConfig.MinSizeMB) * 1024 * 1024
-	allowedCollections := wildcard.CompileWildcardMatchers(taskConfig.CollectionFilter)
+	allowedCollections, err := wildcard.CompileCollectionMatcher(taskConfig.CollectionFilter)
+	if err != nil {
+		return err
+	}
 
 	volumeGroups := make(map[uint32][]*workertypes.VolumeHealthMetrics)
 	for _, metric := range metrics {
@@ -334,7 +372,7 @@ func emitErasureCodingDetectionDecisionTrace(
 			skippedTooSmall++
 			continue
 		}
-		if len(allowedCollections) > 0 && !wildcard.MatchesAnyWildcard(allowedCollections, metric.Collection) {
+		if !allowedCollections.Matches(metric.Collection) {
 			skippedCollectionFilter++
 			continue
 		}
@@ -506,6 +544,7 @@ func (h *ErasureCodingHandler) Execute(
 		params.Collection,
 		h.grpcDialOption,
 	)
+	task.workerAddress = h.workerAddress
 	execCtx, execCancel := context.WithCancel(ctx)
 	defer execCancel()
 	task.SetProgressCallback(func(progress float64, stage string) {
@@ -621,6 +660,16 @@ func deriveErasureCodingWorkerConfig(values map[string]*plugin_pb.ConfigValue) *
 
 	taskConfig.ReplicaPlacement = strings.TrimSpace(pluginworker.ReadStringConfig(values, "replica_placement", taskConfig.ReplicaPlacement))
 
+	taskConfig.StrictPlacement = pluginworker.ReadBoolConfig(values, "strict_placement", taskConfig.StrictPlacement)
+
+	deadband := pluginworker.ReadIntConfig(values, "free_slots_deadband", taskConfig.FreeSlotsDeadband)
+	if deadband < 0 {
+		deadband = 0
+	} else if deadband > 100000 {
+		deadband = 100000
+	}
+	taskConfig.FreeSlotsDeadband = deadband
+
 	return &erasureCodingWorkerConfig{
 		TaskConfig: taskConfig,
 	}
@@ -655,8 +704,15 @@ func buildErasureCodingProposal(
 	}
 
 	sourceNode := ""
-	if len(params.Sources) > 0 {
-		sourceNode = strings.TrimSpace(params.Sources[0].Node)
+	var replicaServers []string
+	for _, s := range params.Sources {
+		if s == nil || strings.TrimSpace(s.Node) == "" || len(s.ShardIds) > 0 {
+			continue
+		}
+		replicaServers = append(replicaServers, s.Node)
+		if sourceNode == "" {
+			sourceNode = strings.TrimSpace(s.Node)
+		}
 	}
 
 	summary := fmt.Sprintf("Erasure code volume %d", result.VolumeID)
@@ -687,6 +743,9 @@ func buildErasureCodingProposal(
 			"source_server": {
 				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: sourceNode},
 			},
+			"replica_servers": {
+				Kind: &plugin_pb.ConfigValue_StringList{StringList: &plugin_pb.StringList{Values: replicaServers}},
+			},
 			"collection": {
 				Kind: &plugin_pb.ConfigValue_StringValue{StringValue: result.Collection},
 			},
diff --git a/weed/worker/tasks/erasure_coding/plugin_handler_test.go b/weed/worker/tasks/erasure_coding/plugin_handler_test.go
index 6febba84b9..71e221ce4d 100644
--- a/weed/worker/tasks/erasure_coding/plugin_handler_test.go
+++ b/weed/worker/tasks/erasure_coding/plugin_handler_test.go
@@ -128,6 +128,17 @@ func TestDeriveErasureCodingWorkerConfig(t *testing.T) {
 	if cfg.TaskConfig.MinSizeMB != 128 {
 		t.Fatalf("expected min_size_mb 128, got %d", cfg.TaskConfig.MinSizeMB)
 	}
+	if cfg.TaskConfig.FreeSlotsDeadband != 0 {
+		t.Fatalf("expected default free_slots_deadband 0, got %d", cfg.TaskConfig.FreeSlotsDeadband)
+	}
+
+	values["free_slots_deadband"] = &plugin_pb.ConfigValue{
+		Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 12},
+	}
+	cfg = deriveErasureCodingWorkerConfig(values)
+	if cfg.TaskConfig.FreeSlotsDeadband != 12 {
+		t.Fatalf("expected free_slots_deadband 12, got %d", cfg.TaskConfig.FreeSlotsDeadband)
+	}
 }
 
 func TestBuildErasureCodingProposal(t *testing.T) {
@@ -249,6 +260,51 @@ func TestEmitErasureCodingDetectionDecisionTraceNoTasks(t *testing.T) {
 	}
 }
 
+func TestErasureCodingDescriptorExposesFreeSlotsDeadband(t *testing.T) {
+	descriptor := NewErasureCodingHandler(nil, "").Descriptor()
+	if descriptor == nil || descriptor.WorkerConfigForm == nil {
+		t.Fatalf("expected worker config form in descriptor")
+	}
+	if descriptor.DescriptorVersion != 1 {
+		t.Fatalf("descriptor version = %d, want 1", descriptor.DescriptorVersion)
+	}
+	if !workerConfigFormHasField(descriptor.WorkerConfigForm, "free_slots_deadband") {
+		t.Fatal("worker config form omitted free_slots_deadband")
+	}
+	var sectionID, prev string
+	for _, section := range descriptor.WorkerConfigForm.Sections {
+		if section == nil {
+			continue
+		}
+		for _, field := range section.Fields {
+			if field != nil && field.Name == "free_slots_deadband" {
+				sectionID = section.SectionId
+				if field.Label != "Free Volume Deadband (M)" {
+					t.Fatalf("free_slots_deadband label = %q, want Free Volume Deadband (M)", field.Label)
+				}
+			}
+			if field != nil && field.Name == "replica_placement" {
+				prev = section.SectionId
+			}
+		}
+	}
+	if sectionID != "placement" {
+		t.Fatalf("free_slots_deadband section = %q, want placement", sectionID)
+	}
+	if prev != "placement" {
+		t.Fatalf("replica_placement section = %q, want placement next to free_slots_deadband", prev)
+	}
+	for _, section := range descriptor.WorkerConfigForm.Sections {
+		if section != nil && section.SectionId == "thresholds" {
+			for _, field := range section.Fields {
+				if field != nil && field.Name == "free_slots_deadband" {
+					t.Fatal("free_slots_deadband must not sit under Detection Thresholds")
+				}
+			}
+		}
+	}
+}
+
 func TestErasureCodingDescriptorOmitsLocalExecutionFields(t *testing.T) {
 	descriptor := NewErasureCodingHandler(nil, "").Descriptor()
 	if descriptor == nil || descriptor.WorkerConfigForm == nil {
diff --git a/weed/worker/tasks/iceberg/compact.go b/weed/worker/tasks/iceberg/compact.go
index a5a17b4703..7936df7d26 100644
--- a/weed/worker/tasks/iceberg/compact.go
+++ b/weed/worker/tasks/iceberg/compact.go
@@ -9,6 +9,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"path"
 	"sort"
 	"strings"
@@ -91,6 +92,9 @@ func (h *Handler) compactDataFiles(
 		return "compaction skipped: delete manifests present and apply_deletes is disabled", nil, nil
 	}
 
+	specsByID := specByID(meta)
+	schema := meta.CurrentSchema()
+
 	// Collect data file entries from data manifests
 	var allEntries []iceberg.ManifestEntry
 	for _, mf := range dataManifests {
@@ -98,36 +102,44 @@ func (h *Handler) compactDataFiles(
 		if err != nil {
 			return "", nil, fmt.Errorf("read manifest %s: %w", mf.FilePath(), err)
 		}
-		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+		entries, err := s3tables.ReadManifest(mf, manifestData, true, specsByID, schema)
 		if err != nil {
 			return "", nil, fmt.Errorf("parse manifest %s: %w", mf.FilePath(), err)
 		}
 		allEntries = append(allEntries, entries...)
 	}
 
-	specsByID := specByID(meta)
-
 	// Collect delete entries if we need to apply deletes
 	var positionDeletes map[string][]int64
 	var eqDeleteGroups []equalityDeleteGroup
 	var allDeleteEntries []iceberg.ManifestEntry
+	var dvPaths map[string]bool
 	if config.ApplyDeletes && len(deleteManifests) > 0 {
 		for _, mf := range deleteManifests {
 			manifestData, err := loadFileByIcebergPath(ctx, filerClient, bucketName, dataPath, mf.FilePath())
 			if err != nil {
 				return "", nil, fmt.Errorf("read delete manifest %s: %w", mf.FilePath(), err)
 			}
-			entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+			entries, err := s3tables.ReadManifest(mf, manifestData, true, specsByID, schema)
 			if err != nil {
 				return "", nil, fmt.Errorf("parse delete manifest %s: %w", mf.FilePath(), err)
 			}
 			allDeleteEntries = append(allDeleteEntries, entries...)
 		}
 
+		var err error
+		dvPaths, err = deletionVectorPaths(allDeleteEntries, bucketName, dataPath)
+		if err != nil {
+			return "", nil, err
+		}
+
 		// Separate position and equality deletes, filtering by partition
 		// predicate so out-of-scope deletes don't affect the merge.
 		var posDeleteEntries, eqDeleteEntries []iceberg.ManifestEntry
 		for _, entry := range allDeleteEntries {
+			if entry.DataFile().FileFormat() == iceberg.PuffinFile {
+				continue
+			}
 			if predicate != nil {
 				spec, ok := specsByID[int(entry.DataFile().SpecID())]
 				if !ok {
@@ -157,17 +169,20 @@ func (h *Handler) compactDataFiles(
 		}
 
 		if len(eqDeleteEntries) > 0 {
-			eqDeleteGroups, err = collectEqualityDeletes(ctx, filerClient, bucketName, dataPath, eqDeleteEntries, meta.CurrentSchema())
+			eqDeleteGroups, err = collectEqualityDeletes(ctx, filerClient, bucketName, dataPath, eqDeleteEntries, schema)
 			if err != nil {
 				return "", nil, fmt.Errorf("collect equality deletes: %w", err)
 			}
 		}
 	}
 
-	candidateEntries := allEntries
+	candidateEntries, err := excludeDeletionVectorFiles(allEntries, dvPaths, bucketName, dataPath)
+	if err != nil {
+		return "", nil, err
+	}
 	if predicate != nil {
-		candidateEntries = make([]iceberg.ManifestEntry, 0, len(allEntries))
-		for _, entry := range allEntries {
+		filtered := make([]iceberg.ManifestEntry, 0, len(candidateEntries))
+		for _, entry := range candidateEntries {
 			spec, ok := specsByID[int(entry.DataFile().SpecID())]
 			if !ok {
 				continue
@@ -177,9 +192,10 @@ func (h *Handler) compactDataFiles(
 				return "", nil, err
 			}
 			if match {
-				candidateEntries = append(candidateEntries, entry)
+				filtered = append(filtered, entry)
 			}
 		}
+		candidateEntries = filtered
 	}
 
 	minInputFiles, err := compactionMinInputFiles(config.MinInputFiles)
@@ -187,9 +203,11 @@ func (h *Handler) compactDataFiles(
 		return "", nil, err
 	}
 
-	// Build compaction bins: group small data files by partition.
+	// Build compaction bins: group small data files by partition, each bin's
+	// files in the order of their bounds so the merged file keeps the
+	// ordering its inputs had.
 	targetSize := compactionTargetSizeForPlan(config, rewritePlan)
-	bins := buildCompactionBins(candidateEntries, targetSize, minInputFiles)
+	bins := buildCompactionBins(candidateEntries, targetSize, minInputFiles, meta)
 	initialBinCount := len(bins)
 	bins = filterCompactionBinsByPlan(bins, config, rewritePlan)
 	if len(bins) == 0 {
@@ -199,9 +217,13 @@ func (h *Handler) compactDataFiles(
 	// Build a lookup from spec ID to PartitionSpec for per-bin manifest writing.
 	specLookup := specsByID
 
-	schema := meta.CurrentSchema()
 	version := meta.Version()
 	snapshotID := currentSnap.SnapshotID
+	// v3 row lineage: the snapshot starts at the table's next-row-id, and the
+	// merged files carry every row's _row_id and _last_updated_sequence_number
+	// (row_lineage.go).
+	lineage := hasRowLineage(version)
+	firstRowID := rowLineageFirstRowID(meta)
 
 	// Compute the snapshot ID for the commit up front so all manifest entries
 	// reference the same snapshot that will actually be committed.
@@ -268,15 +290,24 @@ func (h *Handler) compactDataFiles(
 
 		var mergedData []byte
 		var recordCount int64
+		rowGroupRows := rowsPerRowGroup(bin, config)
 		if rewritePlan != nil && rewritePlan.strategy == "sort" {
-			mergedData, recordCount, err = mergeParquetFilesSorted(ctx, filerClient, bucketName, dataPath, bin.Entries, positionDeletes, eqDeleteGroups, schema, rewritePlan)
+			mergedData, recordCount, err = mergeParquetFilesSorted(ctx, filerClient, bucketName, dataPath, bin.Entries, positionDeletes, eqDeleteGroups, schema, rewritePlan, rowGroupRows, lineage)
 		} else {
-			mergedData, recordCount, err = mergeParquetFiles(ctx, filerClient, bucketName, dataPath, bin.Entries, positionDeletes, eqDeleteGroups, schema)
+			mergedData, recordCount, err = mergeParquetFiles(ctx, filerClient, bucketName, dataPath, bin.Entries, positionDeletes, eqDeleteGroups, schema, rowGroupRows, lineage)
 		}
 		if err != nil {
 			glog.Warningf("iceberg compact: failed to merge bin %d (%d files): %v", binIdx, len(bin.Entries), err)
 			goto binDone
 		}
+		// A default-CRS geometry column declares no CRS (geometry_crs.go). A
+		// footer that cannot be rewritten leaves the file as written: valid,
+		// only labelled differently.
+		if fixed, _, crsErr := withDefaultGeometryCRSUnset(mergedData, schema); crsErr != nil {
+			glog.Warningf("iceberg compact: geometry CRS left as written in bin %d: %v", binIdx, crsErr)
+		} else {
+			mergedData = fixed
+		}
 
 		// Write merged file to filer
 		if err := ensureFilerDir(ctx, filerClient, dataDir); err != nil {
@@ -313,6 +344,28 @@ func (h *Handler) compactDataFiles(
 			}
 			writtenArtifacts = append(writtenArtifacts, artifact{dir: dataDir, fileName: mergedFileName})
 
+			// Record the column statistics readers prune files by; without
+			// them every scan has to read every compacted file.
+			if stats, statsErr := collectColumnStats(mergedData, schema); statsErr != nil {
+				glog.Warningf("iceberg compact: no column statistics for %s: %v", mergedFileName, statsErr)
+			} else {
+				stats.applyTo(dfBuilder)
+			}
+
+			// A merged file keeps its rows' row IDs, so its entry names the first
+			// materialized one instead of inheriting a fresh range at commit.
+			if lineage {
+				firstID, err := mergedFileFirstRowID(mergedData)
+				if err != nil {
+					glog.Warningf("iceberg compact: failed to read merged file lineage for bin %d: %v", binIdx, err)
+					_ = deleteFilerFile(ctx, filerClient, dataDir, mergedFileName)
+					goto binDone
+				}
+				if firstID != nil {
+					dfBuilder.FirstRowID(*firstID)
+				}
+			}
+
 			mergedDataFile := dfBuilder.Build()
 			summary.addFile(mergedDataFile)
 			newEntry := iceberg.NewManifestEntry(
@@ -459,7 +512,7 @@ func (h *Handler) compactDataFiles(
 	// Write new manifest list
 	var manifestListBuf bytes.Buffer
 	seqNum := currentSnap.SequenceNumber + 1
-	err = iceberg.WriteManifestList(version, &manifestListBuf, newSnapID, &snapshotID, &seqNum, 0, allManifests)
+	addedRows, err := writeManifestList(version, &manifestListBuf, newSnapID, &snapshotID, &seqNum, firstRowID, allManifests)
 	if err != nil {
 		return "", nil, fmt.Errorf("write compact manifest list: %w", err)
 	}
@@ -474,9 +527,9 @@ func (h *Handler) compactDataFiles(
 	manifestListLocation := absoluteIcebergPath(bucketName, dataPath, "metadata", manifestListFileName)
 	err = h.commitWithRetry(ctx, filerClient, bucketName, tablePath, state.MetadataFileName, config, func(currentMeta table.Metadata, builder *table.MetadataBuilder) error {
 		// Guard: verify table head hasn't advanced since we planned.
-		cs := currentMeta.CurrentSnapshot()
-		if cs == nil || cs.SnapshotID != snapshotID {
-			return errStalePlan
+		cs, err := checkCommitPlan(currentMeta, snapshotID, version, firstRowID)
+		if err != nil {
+			return err
 		}
 
 		newSnapshot := &table.Snapshot{
@@ -500,6 +553,7 @@ func (h *Handler) compactDataFiles(
 		if rewritePlan != nil && rewritePlan.strategy == "sort" {
 			newSnapshot.Summary.Properties["sort-fields"] = rewritePlan.summaryLabel()
 		}
+		setRowLineage(newSnapshot, version, firstRowID, addedRows)
 		if err := builder.AddSnapshot(newSnapshot); err != nil {
 			return err
 		}
@@ -526,7 +580,13 @@ func (h *Handler) compactDataFiles(
 // buildCompactionBins groups small data files by partition for bin-packing.
 // A file is "small" if it's below targetSize. A bin must have at least
 // minFiles entries to be worth compacting.
-func buildCompactionBins(entries []iceberg.ManifestEntry, targetSize int64, minFiles int) []compactionBin {
+//
+// With an order, every bin lists its files by their bounds on the ordering
+// column and an oversized partition is split into runs of consecutive files,
+// so each merged file covers one contiguous range of that column. Without one
+// the files keep manifest order and an oversized partition is packed
+// largest-first.
+func buildCompactionBins(entries []iceberg.ManifestEntry, targetSize int64, minFiles int, meta table.Metadata) []compactionBin {
 	if minFiles < 2 {
 		minFiles = 2
 	}
@@ -536,7 +596,8 @@ func buildCompactionBins(entries []iceberg.ManifestEntry, targetSize int64, minF
 	groups := make(map[string]*compactionBin)
 	for _, entry := range entries {
 		df := entry.DataFile()
-		if df.FileFormat() != iceberg.ParquetFile {
+		// DuckDB writes "parquet" lowercase.
+		if !strings.EqualFold(string(df.FileFormat()), string(iceberg.ParquetFile)) {
 			continue
 		}
 		if df.FileSizeBytes() >= targetSize {
@@ -558,14 +619,37 @@ func buildCompactionBins(entries []iceberg.ManifestEntry, targetSize int64, minF
 		bin.TotalSize += df.FileSizeBytes()
 	}
 
-	// Filter to bins with enough files, splitting oversized bins
+	// Filter to bins with enough files, splitting oversized bins. The merge
+	// order resolves per group over the files that survived the eligibility
+	// filter, so a file that can never participate (oversized, another
+	// format) cannot veto ordering for the ones that can.
 	var result []compactionBin
 	for _, bin := range groups {
 		if len(bin.Entries) < minFiles {
 			continue
 		}
+		order := resolveCompactionOrder(meta, bin.Entries)
+		order.sortEntries(bin.Entries)
 		if bin.TotalSize <= targetSize {
 			result = append(result, *bin)
+		} else if order != nil {
+			runs, leftover := splitOrderedBin(*bin, targetSize, minFiles)
+			result = append(result, runs...)
+			if order.bestEffort && len(leftover) > 0 {
+				runtBin := compactionBin{PartitionKey: bin.PartitionKey, Partition: bin.Partition, SpecID: bin.SpecID, Entries: leftover}
+				packed := splitOversizedBin(runtBin, targetSize, minFiles)
+				if len(packed) == 0 {
+					// Stragglers cannot merge even with each other; repacking
+					// the whole bin lets them pair across the ordered runs.
+					// Only replace the runs when the repack yields bins —
+					// otherwise the runs stay valid compaction work.
+					if full := splitOversizedBin(*bin, targetSize, minFiles); len(full) > 0 {
+						result = result[:len(result)-len(runs)]
+						packed = full
+					}
+				}
+				result = append(result, packed...)
+			}
 		} else {
 			result = append(result, splitOversizedBin(*bin, targetSize, minFiles)...)
 		}
@@ -680,6 +764,48 @@ func partitionKey(partition map[int]any) string {
 	return strings.Join(parts, "\x00")
 }
 
+// deletionVectorPaths names the data files a Puffin deletion-vector entry
+// covers, normalized to merge-time keys. Merging a covered file needs a
+// Puffin reader to apply the vector; without one the merge would resurrect
+// deleted rows, so the file must stay out of compaction bins.
+func deletionVectorPaths(entries []iceberg.ManifestEntry, bucketName, dataPath string) (map[string]bool, error) {
+	paths := make(map[string]bool)
+	for _, entry := range entries {
+		df := entry.DataFile()
+		if df.ContentType() != iceberg.EntryContentPosDeletes || df.FileFormat() != iceberg.PuffinFile {
+			continue
+		}
+		ref := df.ReferencedDataFile()
+		if ref == nil || *ref == "" {
+			return nil, fmt.Errorf("deletion vector %s has no referenced data file", df.FilePath())
+		}
+		normalized, err := normalizeIcebergPath(*ref, bucketName, dataPath)
+		if err != nil {
+			return nil, fmt.Errorf("resolve deletion vector source %s: %w", *ref, err)
+		}
+		paths[normalized] = true
+	}
+	return paths, nil
+}
+
+// excludeDeletionVectorFiles drops entries a deletion vector covers.
+func excludeDeletionVectorFiles(entries []iceberg.ManifestEntry, dvPaths map[string]bool, bucketName, dataPath string) ([]iceberg.ManifestEntry, error) {
+	if len(dvPaths) == 0 {
+		return entries, nil
+	}
+	kept := make([]iceberg.ManifestEntry, 0, len(entries))
+	for _, entry := range entries {
+		normalized, err := normalizeIcebergPath(entry.DataFile().FilePath(), bucketName, dataPath)
+		if err != nil {
+			return nil, fmt.Errorf("resolve data file %s: %w", entry.DataFile().FilePath(), err)
+		}
+		if !dvPaths[normalized] {
+			kept = append(kept, entry)
+		}
+	}
+	return kept, nil
+}
+
 // collectPositionDeletes reads position delete Parquet files and returns a map
 // from normalized data file path to sorted row positions that should be deleted.
 // Paths are normalized so that absolute S3 URLs and relative paths match.
@@ -691,8 +817,9 @@ func collectPositionDeletes(
 ) (map[string][]int64, error) {
 	result := make(map[string][]int64)
 	for _, entry := range deleteEntries {
-		if entry.DataFile().ContentType() != iceberg.EntryContentPosDeletes {
-			continue
+		df := entry.DataFile()
+		if df.ContentType() != iceberg.EntryContentPosDeletes || df.FileFormat() == iceberg.PuffinFile {
+			continue // Puffin is a deletion vector, not a row-level delete file
 		}
 		fileDeletes, err := readPositionDeleteFile(ctx, filerClient, bucketName, dataPath, entry.DataFile().FilePath())
 		if err != nil {
@@ -843,7 +970,7 @@ func readEqualityDeleteFile(
 	reader := parquet.NewReader(bytes.NewReader(data))
 	defer reader.Close()
 
-	colIndices, err := resolveEqualityColIndices(reader.Schema(), fieldIDs, icebergSchema)
+	colIndices, err := resolveEqualityColIndices(reader.Schema(), fieldIDs, icebergSchema, false)
 	if err != nil {
 		return nil, fmt.Errorf("resolve columns in %s: %w", filePath, err)
 	}
@@ -874,24 +1001,37 @@ func readEqualityDeleteFile(
 // buildEqualityKey builds a composite string key from specific column values
 // in a row. Each value is serialized as "kind:length:value" to avoid ambiguity
 // between types (e.g., int 123 vs string "123") and to prevent collisions from
-// values containing separator characters.
+// values containing separator characters. A negative column index is a field
+// the file lacks: the value there is null.
 func buildEqualityKey(row parquet.Row, colIndices []int) string {
 	if len(colIndices) == 1 {
-		v := row[colIndices[0]]
+		v := equalityKeyValue(row, colIndices[0])
 		s := v.String()
 		return fmt.Sprintf("%d:%d:%s", v.Kind(), len(s), s)
 	}
 	var b strings.Builder
 	for _, idx := range colIndices {
-		v := row[idx]
+		v := equalityKeyValue(row, idx)
 		s := v.String()
 		fmt.Fprintf(&b, "%d:%d:%s", v.Kind(), len(s), s)
 	}
 	return b.String()
 }
 
+func equalityKeyValue(row parquet.Row, idx int) parquet.Value {
+	if idx < 0 {
+		return parquet.NullValue()
+	}
+	return row[idx]
+}
+
 // resolveEqualityColIndices maps Iceberg field IDs to Parquet column indices.
-func resolveEqualityColIndices(pqSchema *parquet.Schema, fieldIDs []int, icebergSchema *iceberg.Schema) ([]int, error) {
+// A file carrying field ids resolves by id, so a column renamed since the
+// file was written still matches; one without ids falls back to the Iceberg
+// name. allowMissing reads a column the file lacks as null (-1 marks it in
+// the key): for data files only — an equality-delete file always carries
+// its equality columns, so a missing one stays an error there.
+func resolveEqualityColIndices(pqSchema *parquet.Schema, fieldIDs []int, icebergSchema *iceberg.Schema, allowMissing bool) ([]int, error) {
 	if len(fieldIDs) == 0 {
 		return nil, nil
 	}
@@ -900,6 +1040,14 @@ func resolveEqualityColIndices(pqSchema *parquet.Schema, fieldIDs []int, iceberg
 	for i, col := range pqSchema.Columns() {
 		colNameToIdx[strings.Join(col, ".")] = i
 	}
+	idToIdx := make(map[int]int)
+	for _, f := range pqSchema.Fields() {
+		if f.Leaf() && f.ID() > 0 {
+			if idx, ok := colNameToIdx[f.Name()]; ok {
+				idToIdx[f.ID()] = idx
+			}
+		}
+	}
 
 	indices := make([]int, len(fieldIDs))
 	for i, fid := range fieldIDs {
@@ -907,8 +1055,17 @@ func resolveEqualityColIndices(pqSchema *parquet.Schema, fieldIDs []int, iceberg
 		if !ok {
 			return nil, fmt.Errorf("field ID %d not found in iceberg schema", fid)
 		}
-		idx, ok := colNameToIdx[field.Name]
+		idx, ok := idToIdx[fid]
+		if !ok && len(idToIdx) == 0 {
+			idx, ok = colNameToIdx[field.Name]
+		}
 		if !ok {
+			// An optional column added to the table after this file was
+			// written reads as null there (-1 marks it in the key).
+			if allowMissing && !field.Required {
+				indices[i] = -1
+				continue
+			}
 			return nil, fmt.Errorf("column %q (field ID %d) not found in parquet schema", field.Name, fid)
 		}
 		indices[i] = idx
@@ -916,6 +1073,46 @@ func resolveEqualityColIndices(pqSchema *parquet.Schema, fieldIDs []int, iceberg
 	return indices, nil
 }
 
+const (
+	// Iceberg's write.parquet.row-group-size-bytes default and PyIceberg's
+	// write.parquet.row-group-limit default.
+	defaultRowGroupSizeBytes = 128 * 1024 * 1024
+	defaultRowGroupRowLimit  = 1048576
+	minRowGroupRows          = 1024
+)
+
+// rowsPerRowGroup is the most rows one row group of a compacted file holds:
+// the row limit, lowered so a row group stays near the byte size, estimated
+// from the bin's inputs' bytes per row. parquet-go's writers have no limit of
+// their own, so without one every compacted file is a single row group. The
+// floor only protects the estimate — a configured row limit always wins.
+func rowsPerRowGroup(bin compactionBin, config Config) int64 {
+	rows, sizeBytes := config.RowGroupRowLimit, config.RowGroupSizeBytes
+	explicit := rows > 0
+	if !explicit {
+		rows = defaultRowGroupRowLimit
+	}
+	if sizeBytes <= 0 {
+		sizeBytes = defaultRowGroupSizeBytes
+	}
+	var totalRows int64
+	for _, entry := range bin.Entries {
+		totalRows += entry.DataFile().Count()
+	}
+	if totalRows > 0 && bin.TotalSize > 0 {
+		bytesPerRow := max(bin.TotalSize/totalRows, 1)
+		estimated := sizeBytes / bytesPerRow
+		if !explicit {
+			estimated = max(estimated, minRowGroupRows)
+		}
+		rows = min(rows, estimated)
+	}
+	if !explicit {
+		rows = max(rows, minRowGroupRows)
+	}
+	return rows
+}
+
 // mergeParquetFiles reads multiple small Parquet files and merges them into
 // a single Parquet file, optionally filtering out rows matching position or
 // equality deletes. Files are processed one at a time to keep memory usage
@@ -928,6 +1125,88 @@ func mergeParquetFiles(
 	positionDeletes map[string][]int64,
 	eqDeleteGroups []equalityDeleteGroup,
 	icebergSchema *iceberg.Schema,
+	rowGroupRows int64,
+	lineage bool,
+) ([]byte, int64, error) {
+	// On a v1/v2 table the writer's schema is chosen before any row is
+	// written: the union of the bin's file schemas by field id, so a bin of
+	// progressively wider files merges in one pass instead of restarting
+	// (and rewriting every earlier file) on each wider one. The v3 merge
+	// keeps the first file's columns plus the lineage columns.
+	var target *parquet.Schema
+	if !lineage {
+		var err error
+		if target, err = binWriterSchema(ctx, filerClient, bucketName, dataPath, entries); err != nil {
+			return nil, 0, err
+		}
+	}
+	for attempt := 0; ; attempt++ {
+		out, rows, err := mergeParquetFilesInto(ctx, filerClient, bucketName, dataPath, entries, positionDeletes,
+			eqDeleteGroups, icebergSchema, rowGroupRows, lineage, target)
+		var wider *widerSchemaError
+		if errors.As(err, &wider) && attempt < len(entries) {
+			target = wider.schema
+			continue
+		}
+		return out, rows, err
+	}
+}
+
+// binWriterSchema is the writer schema for a v1/v2 bin-pack merge: the union
+// of the files' schemas by field id. Only each file's footer is read to learn
+// its schema; the merge then downloads each file once. Files whose schemas
+// cannot union (no field ids, nested or repeated columns, a field id or name
+// carrying different types) merge only under the old rule — every file's
+// schema equal to the first — and the bin is refused as before otherwise.
+func binWriterSchema(
+	ctx context.Context,
+	filerClient filer_pb.SeaweedFilerClient,
+	bucketName, dataPath string,
+	entries []iceberg.ManifestEntry,
+) (*parquet.Schema, error) {
+	var union schemaUnion
+	var first *parquet.Schema
+	unionable, allEqual := true, true
+	for _, entry := range entries {
+		source := entry.DataFile().FilePath()
+		schema, err := parquetSchemaByIcebergPath(ctx, filerClient, bucketName, dataPath, source)
+		if err != nil {
+			return nil, fmt.Errorf("schema of %s: %w", source, err)
+		}
+		if schema == nil {
+			return nil, fmt.Errorf("no parquet schema found in %s", source)
+		}
+		if first == nil {
+			first = schema
+		} else if !schemasEqual(first, schema) {
+			allEqual = false
+		}
+		if unionable {
+			unionable = union.fold(schema, source) == nil
+		}
+		if !unionable && !allEqual {
+			return nil, fmt.Errorf("schema mismatch in %s: cannot merge files with different schemas", source)
+		}
+	}
+	if !unionable || first == nil {
+		return nil, nil // every file spells the first file's schema
+	}
+	return union.schema(first.Name(), first), nil
+}
+
+// mergeParquetFilesInto merges with target as the writer's schema on a v1/v2
+// table (nil: the first file's).
+func mergeParquetFilesInto(
+	ctx context.Context,
+	filerClient filer_pb.SeaweedFilerClient,
+	bucketName, dataPath string,
+	entries []iceberg.ManifestEntry,
+	positionDeletes map[string][]int64,
+	eqDeleteGroups []equalityDeleteGroup,
+	icebergSchema *iceberg.Schema,
+	rowGroupRows int64,
+	lineage bool,
+	target *parquet.Schema,
 ) ([]byte, int64, error) {
 	if len(entries) == 0 {
 		return nil, 0, fmt.Errorf("no entries to merge")
@@ -951,11 +1230,58 @@ func mergeParquetFiles(
 		return nil, 0, fmt.Errorf("resolve equality columns: %w", err)
 	}
 
-	var outputBuf bytes.Buffer
-	writer := parquet.NewWriter(&outputBuf, parquetSchema)
+	// On a v3 table the output is the first file's columns plus the lineage
+	// columns (row_lineage.go).
+	outputSchema := parquetSchema
+	var layout *lineageLayout
+	if lineage {
+		if layout, err = newLineageLayout(parquetSchema); err != nil {
+			firstReader.Close()
+			return nil, 0, fmt.Errorf("schema of %s: %w", entries[0].DataFile().FilePath(), err)
+		}
+		outputSchema = layout.schema
+	} else if target != nil {
+		outputSchema = target
+	}
 
-	drainReader := func(reader *parquet.Reader, source string) (int64, error) {
-		return visitFilteredParquetRows(ctx, reader, source, bucketName, dataPath, positionDeletes, resolvedEqGroups, func(filtered []parquet.Row) error {
+	// joins is how one file enters the merge on a v1/v2 table: converted into
+	// the writer's schema when that covers it, with its equality-delete
+	// columns resolved on its own schema.
+	joins := func(reader *parquet.Reader, entry iceberg.ManifestEntry) (parquet.Conversion, []resolvedEqDeleteGroup, error) {
+		if layout != nil {
+			return nil, resolvedEqGroups, nil // a v3 merge matches files with their lineage columns set aside
+		}
+		source := entry.DataFile().FilePath()
+		conv, err := evolvedFileConversion(outputSchema, reader.Schema(), source)
+		if err != nil {
+			return nil, nil, err
+		}
+		if schemasEqual(parquetSchema, reader.Schema()) {
+			return conv, resolvedEqGroups, nil
+		}
+		groups, err := resolveEqualityDeleteGroupsForSchema(reader.Schema(), eqDeleteGroups, icebergSchema)
+		if err != nil {
+			return nil, nil, fmt.Errorf("resolve equality columns in %s: %w", source, err)
+		}
+		return conv, groups, nil
+	}
+
+	var outputBuf bytes.Buffer
+	writer := parquet.NewWriter(&outputBuf, outputSchema, parquet.MaxRowsPerRowGroup(rowGroupRows))
+
+	drainReader := func(reader *parquet.Reader, entry iceberg.ManifestEntry) (int64, error) {
+		source := entry.DataFile().FilePath()
+		conv, groups, err := joins(reader, entry)
+		if err != nil {
+			reader.Close()
+			return 0, err
+		}
+		return copyFileRows(ctx, reader, entry, layout, bucketName, dataPath, positionDeletes, groups, eqDeleteGroups, icebergSchema, func(filtered []parquet.Row) error {
+			if conv != nil {
+				if _, err := conv.Convert(filtered); err != nil {
+					return fmt.Errorf("convert rows from %s: %w", source, err)
+				}
+			}
 			if _, err := writer.WriteRows(filtered); err != nil {
 				return fmt.Errorf("write rows from %s: %w", source, err)
 			}
@@ -964,8 +1290,7 @@ func mergeParquetFiles(
 	}
 
 	// Drain the first file.
-	firstSource := entries[0].DataFile().FilePath()
-	totalRows, err := drainReader(firstReader, firstSource)
+	totalRows, err := drainReader(firstReader, entries[0])
 	if err != nil {
 		writer.Close()
 		return nil, 0, err
@@ -988,13 +1313,7 @@ func mergeParquetFiles(
 		}
 
 		reader := parquet.NewReader(bytes.NewReader(data))
-		if !schemasEqual(parquetSchema, reader.Schema()) {
-			reader.Close()
-			writer.Close()
-			return nil, 0, fmt.Errorf("schema mismatch in %s: cannot merge files with different schemas", entry.DataFile().FilePath())
-		}
-
-		rowsWritten, err := drainReader(reader, entry.DataFile().FilePath())
+		rowsWritten, err := drainReader(reader, entry)
 		if err != nil {
 			writer.Close()
 			return nil, 0, err
@@ -1026,7 +1345,7 @@ func resolveEqualityDeleteGroupsForSchema(
 
 	resolved := make([]resolvedEqDeleteGroup, 0, len(eqDeleteGroups))
 	for _, g := range eqDeleteGroups {
-		indices, err := resolveEqualityColIndices(parquetSchema, g.FieldIDs, icebergSchema)
+		indices, err := resolveEqualityColIndices(parquetSchema, g.FieldIDs, icebergSchema, true)
 		if err != nil {
 			return nil, err
 		}
@@ -1041,12 +1360,15 @@ func visitFilteredParquetRows(
 	source, bucketName, dataPath string,
 	positionDeletes map[string][]int64,
 	resolvedEqGroups []resolvedEqDeleteGroup,
-	onRows func([]parquet.Row) error,
+	onRows func(rows []parquet.Row, positions []int64) error,
 ) (int64, error) {
 	defer reader.Close()
 
 	rows := make([]parquet.Row, 256)
 	filteredRows := make([]parquet.Row, 0, len(rows))
+	// each kept row's position in the file before any delete: what a v3
+	// _row_id is inherited from
+	filteredPositions := make([]int64, 0, len(rows))
 	normalizedSource, err := normalizeIcebergPath(source, bucketName, dataPath)
 	if err != nil {
 		return 0, err
@@ -1066,6 +1388,7 @@ func visitFilteredParquetRows(
 		n, readErr := reader.ReadRows(rows)
 		if n > 0 {
 			filteredRows = filteredRows[:0]
+			filteredPositions = filteredPositions[:0]
 			for i := 0; i < n; i++ {
 				rowPos := absolutePos + int64(i)
 				for posDeleteIdx < len(posDeletes) && posDeletes[posDeleteIdx] < rowPos {
@@ -1089,10 +1412,11 @@ func visitFilteredParquetRows(
 				}
 
 				filteredRows = append(filteredRows, rows[i])
+				filteredPositions = append(filteredPositions, rowPos)
 			}
 			absolutePos += int64(n)
 			if len(filteredRows) > 0 {
-				if err := onRows(filteredRows); err != nil {
+				if err := onRows(filteredRows, filteredPositions); err != nil {
 					return totalRows, err
 				}
 				totalRows += int64(len(filteredRows))
@@ -1117,6 +1441,8 @@ func mergeParquetFilesSorted(
 	eqDeleteGroups []equalityDeleteGroup,
 	icebergSchema *iceberg.Schema,
 	rewritePlan *compactionRewritePlan,
+	rowGroupRows int64,
+	lineage bool,
 ) ([]byte, int64, error) {
 	if len(entries) == 0 {
 		return nil, 0, fmt.Errorf("no entries to merge")
@@ -1136,7 +1462,17 @@ func mergeParquetFilesSorted(
 		return nil, 0, fmt.Errorf("no parquet schema found in %s", entries[0].DataFile().FilePath())
 	}
 
-	sortingColumns, err := rewritePlan.parquetSortingColumns(parquetSchema)
+	outputSchema := parquetSchema
+	var layout *lineageLayout
+	if lineage {
+		if layout, err = newLineageLayout(parquetSchema); err != nil {
+			firstReader.Close()
+			return nil, 0, fmt.Errorf("schema of %s: %w", entries[0].DataFile().FilePath(), err)
+		}
+		outputSchema = layout.schema
+	}
+
+	sortingColumns, err := rewritePlan.parquetSortingColumns(outputSchema)
 	if err != nil {
 		firstReader.Close()
 		return nil, 0, fmt.Errorf("resolve parquet sorting columns: %w", err)
@@ -1148,19 +1484,49 @@ func mergeParquetFilesSorted(
 		return nil, 0, fmt.Errorf("resolve equality columns: %w", err)
 	}
 
-	comparator := parquetSchema.Comparator(sortingColumns...)
-	var allRows []parquet.Row
+	// Sorted rewrites stream rows through parquet-go's sorting writer rather
+	// than holding the whole bin: rows accumulate until sortBufferRows, then a
+	// sorted run is encoded into a temporary row group, and Close merges the
+	// runs into the output. The runs live in files from a buffer pool instead
+	// of on the heap, so a bin larger than memory sorts rather than failing.
+	spillDir := rewritePlan.spillDir
+	if spillDir == "" {
+		// NewFileBufferPool takes filepath.Abs of what it is given, and
+		// filepath.Abs("") is the working directory, not the temp directory.
+		spillDir = os.TempDir()
+	}
+	sortBufferRows := rewritePlan.bufferRows
+	if sortBufferRows < minSortBufferRows {
+		sortBufferRows = defaultSortBufferRows
+	}
 
-	collectRows := func(reader *parquet.Reader, source string) (int64, error) {
-		return visitFilteredParquetRows(ctx, reader, source, bucketName, dataPath, positionDeletes, resolvedEqGroups, func(filtered []parquet.Row) error {
-			for _, row := range filtered {
-				allRows = append(allRows, row.Clone())
-			}
-			return nil
+	var outputBuf bytes.Buffer
+	writer := parquet.NewSortingWriter[any](&outputBuf, sortBufferRows, outputSchema,
+		parquet.MaxRowsPerRowGroup(rowGroupRows),
+		parquet.SortingWriterConfig(
+			parquet.SortingColumns(sortingColumns...),
+			parquet.SortingBuffers(parquet.NewFileBufferPool(spillDir, "seaweedfs-iceberg-sort-*")),
+		),
+	)
+	// Closing returns the run files to the pool, which deletes them. A failure
+	// before that has to release them too, or the job leaves temp files behind.
+	closed := false
+	defer func() {
+		if !closed {
+			writer.Reset(io.Discard)
+		}
+	}()
+
+	writeRows := func(reader *parquet.Reader, entry iceberg.ManifestEntry) (int64, error) {
+		return copyFileRows(ctx, reader, entry, layout, bucketName, dataPath, positionDeletes, resolvedEqGroups, eqDeleteGroups, icebergSchema, func(filtered []parquet.Row) error {
+			// The writer's row buffer copies the values it is handed, so these
+			// rows need no cloning out of the reader's own buffer first.
+			_, writeErr := writer.WriteRows(filtered)
+			return writeErr
 		})
 	}
 
-	totalRows, err := collectRows(firstReader, entries[0].DataFile().FilePath())
+	totalRows, err := writeRows(firstReader, entries[0])
 	if err != nil {
 		return nil, 0, err
 	}
@@ -1178,33 +1544,22 @@ func mergeParquetFilesSorted(
 		}
 
 		reader := parquet.NewReader(bytes.NewReader(data))
-		if !schemasEqual(parquetSchema, reader.Schema()) {
+		if layout == nil && !schemasEqual(parquetSchema, reader.Schema()) {
 			reader.Close()
 			return nil, 0, fmt.Errorf("schema mismatch in %s: cannot merge files with different schemas", entry.DataFile().FilePath())
 		}
 
-		rowsCollected, err := collectRows(reader, entry.DataFile().FilePath())
+		rowsWritten, err := writeRows(reader, entry)
 		if err != nil {
 			return nil, 0, err
 		}
-		totalRows += rowsCollected
+		totalRows += rowsWritten
 	}
 
-	sort.SliceStable(allRows, func(i, j int) bool {
-		return comparator(allRows[i], allRows[j]) < 0
-	})
-
-	var outputBuf bytes.Buffer
-	writer := parquet.NewWriter(&outputBuf, parquetSchema)
-	if len(allRows) > 0 {
-		if _, err := writer.WriteRows(allRows); err != nil {
-			writer.Close()
-			return nil, 0, fmt.Errorf("write sorted rows: %w", err)
-		}
-	}
 	if err := writer.Close(); err != nil {
-		return nil, 0, fmt.Errorf("close writer: %w", err)
+		return nil, 0, fmt.Errorf("close sorting writer: %w", err)
 	}
+	closed = true
 
 	return outputBuf.Bytes(), totalRows, nil
 }
@@ -1219,7 +1574,8 @@ func compactRandomSuffix() string {
 	return hex.EncodeToString(b)
 }
 
-// schemasEqual compares two parquet schemas structurally.
+// schemasEqual compares two parquet schemas structurally, and their Iceberg
+// field ids wherever both carry them.
 func schemasEqual(a, b *parquet.Schema) bool {
 	if a == b {
 		return true
@@ -1227,7 +1583,32 @@ func schemasEqual(a, b *parquet.Schema) bool {
 	if a == nil || b == nil {
 		return false
 	}
-	return parquet.EqualNodes(a, b)
+	return parquet.EqualNodes(a, b) && fieldIDsAgree(a, b)
+}
+
+// fieldIDsAgree reports whether two structurally equal nodes carry the same
+// Iceberg field id at every position where both carry one. parquet-go's
+// EqualNodes ignores field ids, so a column dropped and re-added under the
+// same name and type (a new field id) looked like the old one, and a merge
+// filed the old values under the new field, or the live values under the
+// dropped one.
+func fieldIDsAgree(a, b parquet.Node) bool {
+	if a.ID() > 0 && b.ID() > 0 && a.ID() != b.ID() {
+		return false
+	}
+	if a.Leaf() || b.Leaf() {
+		return a.Leaf() == b.Leaf()
+	}
+	fa, fb := a.Fields(), b.Fields()
+	if len(fa) != len(fb) {
+		return false
+	}
+	for i := range fa {
+		if fa[i].Name() != fb[i].Name() || !fieldIDsAgree(fa[i], fb[i]) {
+			return false
+		}
+	}
+	return true
 }
 
 // ensureFilerDir ensures a directory exists in the filer.
diff --git a/weed/worker/tasks/iceberg/compact_order.go b/weed/worker/tasks/iceberg/compact_order.go
new file mode 100644
index 0000000000..ffda8acc73
--- /dev/null
+++ b/weed/worker/tasks/iceberg/compact_order.go
@@ -0,0 +1,213 @@
+package iceberg
+
+import (
+	"sort"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+)
+
+// compactionOrder names the column by whose bounds a bin's input files are
+// ordered before they are merged: the first identity field of the table's
+// sort order when it declares one, otherwise the first column every candidate
+// file carries bounds for. Rows are copied file by file, so a merged file is
+// as ordered as the sequence of its inputs.
+type compactionOrder struct {
+	fieldID    int
+	typ        iceberg.PrimitiveType
+	descending bool
+	// bestEffort marks an order inferred from column bounds rather than the
+	// table's declared sort order; runs it cannot form may still merge by
+	// size since contiguous ranges are a preference, not a requirement.
+	bestEffort bool
+}
+
+func resolveCompactionOrder(meta table.Metadata, entries []iceberg.ManifestEntry) *compactionOrder {
+	if meta == nil || meta.CurrentSchema() == nil || len(entries) == 0 {
+		return nil
+	}
+	schema := meta.CurrentSchema()
+	if sortOrder := meta.SortOrder(); !sortOrder.IsUnsorted() {
+		for _, sortField := range sortOrder.Fields() {
+			if _, ok := sortField.Transform.(iceberg.IdentityTransform); !ok {
+				continue
+			}
+			field, ok := schema.FindFieldByID(sortField.SourceID())
+			if !ok {
+				continue
+			}
+			typ, ok := field.Type.(iceberg.PrimitiveType)
+			if !ok || !orderableType(typ) {
+				continue
+			}
+			candidate := &compactionOrder{fieldID: field.ID, typ: typ, descending: sortField.Direction == table.SortDESC}
+			// The declared order only holds when every entry carries a bound
+			// for it; otherwise merging would claim sortedness it cannot
+			// verify. Fall back to inference instead of ordering by a later
+			// sort field alone.
+			if candidate.coversEntries(entries) {
+				return candidate
+			}
+			break
+		}
+	}
+	// A column only orders the merge when every entry in the group carries a
+	// bound for it. The check is scoped to the entries handed in — a bin's
+	// eligible files — so an unrelated file without bounds (oversized, a
+	// different format, or another partition) cannot disable ordering here.
+	for _, field := range schema.Fields() {
+		typ, ok := field.Type.(iceberg.PrimitiveType)
+		if !ok || !orderableType(typ) {
+			continue
+		}
+		candidate := &compactionOrder{fieldID: field.ID, typ: typ, bestEffort: true}
+		if candidate.coversEntries(entries) {
+			return candidate
+		}
+	}
+	return nil
+}
+
+// orderableType reports whether bounds of the type order files. Geometry and
+// geography bounds are corners of a box: they decode into literals that do
+// not compare, so ordering by them would sort nothing while still splitting
+// oversized bins as if the files were in order.
+func orderableType(t iceberg.PrimitiveType) bool {
+	switch t.(type) {
+	case iceberg.GeometryType, iceberg.GeographyType:
+		return false
+	}
+	return true
+}
+
+func (o *compactionOrder) coversEntries(entries []iceberg.ManifestEntry) bool {
+	for _, entry := range entries {
+		if _, ok := o.key(entry); !ok {
+			return false
+		}
+	}
+	return true
+}
+
+// key is the bound a file is ordered by: its lower bound on the column for an
+// ascending order, its upper bound for a descending one.
+func (o *compactionOrder) key(entry iceberg.ManifestEntry) (iceberg.Literal, bool) {
+	df := entry.DataFile()
+	raw := df.LowerBoundValues()[o.fieldID]
+	if o.descending {
+		raw = df.UpperBoundValues()[o.fieldID]
+	}
+	if raw == nil {
+		return nil, false
+	}
+	lit, err := iceberg.LiteralFromBytes(o.typ, raw)
+	return lit, err == nil
+}
+
+// sortEntries orders a bin's files by their key. Files without a key sort
+// after the rest, in their original order.
+func (o *compactionOrder) sortEntries(entries []iceberg.ManifestEntry) {
+	if o == nil || len(entries) < 2 {
+		return
+	}
+	type keyed struct {
+		key iceberg.Literal
+		ok  bool
+	}
+	keys := make([]keyed, len(entries))
+	idx := make([]int, len(entries))
+	for i, entry := range entries {
+		k, ok := o.key(entry)
+		keys[i], idx[i] = keyed{k, ok}, i
+	}
+	sort.SliceStable(idx, func(i, j int) bool {
+		a, b := keys[idx[i]], keys[idx[j]]
+		if a.ok != b.ok {
+			return a.ok
+		}
+		if !a.ok {
+			return false
+		}
+		c, ok := compareLiterals(a.key, b.key)
+		if o.descending {
+			c = -c
+		}
+		return ok && c < 0
+	})
+	sorted := make([]iceberg.ManifestEntry, len(entries))
+	for i, j := range idx {
+		sorted[i] = entries[j]
+	}
+	copy(entries, sorted)
+}
+
+// splitOrderedBin splits a bin whose files are in bound order into runs of
+// consecutive files that stay under targetSize, so every output covers one
+// contiguous range of the ordering column. The returned entries are the runs
+// too short to reach minFiles: the caller can still merge them by size when
+// contiguous ranges are only a preference, or leave them for a later pass
+// when order must hold.
+func splitOrderedBin(bin compactionBin, targetSize int64, minFiles int) (valid []compactionBin, leftover []iceberg.ManifestEntry) {
+	newBin := func() compactionBin {
+		return compactionBin{PartitionKey: bin.PartitionKey, Partition: bin.Partition, SpecID: bin.SpecID}
+	}
+	current := newBin()
+	flush := func() {
+		if len(current.Entries) >= minFiles {
+			valid = append(valid, current)
+		} else {
+			leftover = append(leftover, current.Entries...)
+		}
+		current = newBin()
+	}
+	for _, entry := range bin.Entries {
+		size := entry.DataFile().FileSizeBytes()
+		if current.TotalSize > 0 && current.TotalSize+size > targetSize {
+			flush()
+		}
+		current.Entries = append(current.Entries, entry)
+		current.TotalSize += size
+	}
+	flush()
+	return valid, leftover
+}
+
+// compareLiterals orders two literals of the same type; false when they are
+// not comparable.
+func compareLiterals(a, b iceberg.Literal) (int, bool) {
+	switch x := a.(type) {
+	case iceberg.TypedLiteral[bool]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[int32]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[int64]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[float32]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[float64]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[iceberg.Date]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[iceberg.Time]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[iceberg.Timestamp]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[iceberg.TimestampNano]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[string]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[[]byte]:
+		return compareTyped(x, b)
+	case iceberg.TypedLiteral[iceberg.Decimal]:
+		return compareTyped(x, b)
+	}
+	return 0, false
+}
+
+func compareTyped[T iceberg.LiteralType](a iceberg.TypedLiteral[T], b iceberg.Literal) (int, bool) {
+	bt, ok := b.(iceberg.TypedLiteral[T])
+	if !ok {
+		return 0, false
+	}
+	return a.Comparator()(a.Value(), bt.Value()), true
+}
diff --git a/weed/worker/tasks/iceberg/compact_order_test.go b/weed/worker/tasks/iceberg/compact_order_test.go
new file mode 100644
index 0000000000..1a36f7618f
--- /dev/null
+++ b/weed/worker/tasks/iceberg/compact_order_test.go
@@ -0,0 +1,421 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+
+	filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+type boundedFile struct {
+	Name         string
+	IDs          []int64
+	Lower, Upper int64
+	SizeBytes    int64
+	NoBounds     bool
+}
+
+// populateBoundedTable is populateTableWithDeleteFiles narrowed to data
+// files whose manifest entries carry bounds on the id column.
+func populateBoundedTable(t *testing.T, fs *fakeFilerServer, setup tableSetup, files []boundedFile) {
+	t.Helper()
+	populateBoundedTableSorted(t, fs, setup, files, table.UnsortedSortOrder)
+}
+
+func populateBoundedTableSorted(t *testing.T, fs *fakeFilerServer, setup tableSetup, files []boundedFile, sortOrder table.SortOrder) {
+	t.Helper()
+	schema := newTestSchema()
+	spec := *iceberg.UnpartitionedSpec
+
+	meta, err := table.NewMetadata(schema, &spec, sortOrder, "s3://"+setup.BucketName+"/"+setup.dataPath(), nil)
+	if err != nil {
+		t.Fatalf("create metadata: %v", err)
+	}
+
+	bucketPath := path.Join(s3tables.TablesPath, setup.BucketName)
+	nsPath := path.Join(bucketPath, setup.Namespace)
+	tableFilerPath := path.Join(bucketPath, setup.dataPath())
+	metaDir := path.Join(tableFilerPath, "metadata")
+	dataDir := path.Join(tableFilerPath, "data")
+	version := meta.Version()
+
+	var entries []iceberg.ManifestEntry
+	for _, f := range files {
+		rows := make([]struct {
+			ID   int64
+			Name string
+		}, len(f.IDs))
+		for i, id := range f.IDs {
+			rows[i] = struct {
+				ID   int64
+				Name string
+			}{id, fmt.Sprintf("r%d", id)}
+		}
+		data := writeTestParquetFile(t, fs, dataDir, f.Name, rows)
+		size := int64(len(data))
+		if f.SizeBytes > 0 {
+			size = f.SizeBytes
+		}
+		dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, setup.fileRef("data", f.Name),
+			iceberg.ParquetFile, map[int]any{}, nil, nil, int64(len(f.IDs)), size)
+		if err != nil {
+			t.Fatalf("build data file %s: %v", f.Name, err)
+		}
+		if !f.NoBounds {
+			lo, _ := iceberg.Int64Literal(f.Lower).MarshalBinary()
+			hi, _ := iceberg.Int64Literal(f.Upper).MarshalBinary()
+			dfb.LowerBoundValues(map[int][]byte{1: lo}).UpperBoundValues(map[int][]byte{1: hi})
+		}
+		snapID := int64(1)
+		entries = append(entries, iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build()))
+	}
+
+	var manifestBuf bytes.Buffer
+	mf, err := iceberg.WriteManifest(setup.fileRef("metadata", "data-manifest-1.avro"), &manifestBuf,
+		version, spec, schema, 1, entries)
+	if err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+	fs.putEntry(metaDir, "data-manifest-1.avro", &filer_pb.Entry{
+		Name: "data-manifest-1.avro", Content: manifestBuf.Bytes(),
+		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(manifestBuf.Len())},
+	})
+
+	var mlBuf bytes.Buffer
+	seqNum := int64(1)
+	if err := iceberg.WriteManifestList(version, &mlBuf, 1, nil, &seqNum, 0, []iceberg.ManifestFile{mf}); err != nil {
+		t.Fatalf("write manifest list: %v", err)
+	}
+	fs.putEntry(metaDir, "snap-1.avro", &filer_pb.Entry{
+		Name: "snap-1.avro", Content: mlBuf.Bytes(),
+		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(mlBuf.Len())},
+	})
+
+	snap := table.Snapshot{SnapshotID: 1, TimestampMs: time.Now().UnixMilli(),
+		ManifestList: setup.fileRef("metadata", "snap-1.avro")}
+	builder, err := table.MetadataBuilderFromBase(meta, "s3://"+setup.BucketName+"/"+setup.dataPath())
+	if err != nil {
+		t.Fatalf("metadata builder: %v", err)
+	}
+	if err := builder.AddSnapshot(&snap); err != nil {
+		t.Fatalf("add snapshot: %v", err)
+	}
+	if err := builder.SetSnapshotRef(table.MainBranch, snap.SnapshotID, table.BranchRef); err != nil {
+		t.Fatalf("set snapshot ref: %v", err)
+	}
+	meta, err = builder.Build()
+	if err != nil {
+		t.Fatalf("build metadata: %v", err)
+	}
+
+	fullMetadataJSON, _ := json.Marshal(meta)
+	xattr, _ := json.Marshal(map[string]interface{}{
+		"metadataVersion":  1,
+		"metadataLocation": setup.fileRef("metadata", "v1.metadata.json"),
+		"metadata":         map[string]interface{}{"fullMetadata": json.RawMessage(fullMetadataJSON)},
+	})
+	fs.putEntry(path.Join(s3tables.TablesPath), setup.BucketName, &filer_pb.Entry{
+		Name: setup.BucketName, IsDirectory: true,
+		Extended: map[string][]byte{s3tables.ExtendedKeyTableBucket: []byte("true")},
+	})
+	fs.putEntry(bucketPath, setup.Namespace, &filer_pb.Entry{Name: setup.Namespace, IsDirectory: true})
+	fs.putEntry(nsPath, setup.TableName, &filer_pb.Entry{
+		Name: setup.TableName, IsDirectory: true,
+		Extended: map[string][]byte{s3tables.ExtendedKeyMetadata: xattr},
+	})
+}
+
+// A bin's files are merged in the order of their bounds on the
+// ordering column, not manifest order, so a merged file is as ordered
+// as the sequence of its inputs.
+func TestCompactDataFilesKeepsInputOrderByBounds(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	// manifest order is the reverse of bound order
+	populateBoundedTable(t, fs, setup, []boundedFile{
+		{Name: "hi.parquet", IDs: []int64{3, 4}, Lower: 3, Upper: 4},
+		{Name: "lo.parquet", IDs: []int64{1, 2}, Lower: 1, Upper: 2},
+	})
+
+	handler := NewHandler(nil)
+	config := Config{TargetFileSizeBytes: 256 * 1024 * 1024, MinInputFiles: 2, MaxCommitRetries: 3}
+	if _, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil); err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+
+	df := compactedDataFile(t, client, setup)
+	ids := compactedIDs(t, client, setup, df.FilePath())
+	want := []int64{1, 2, 3, 4}
+	if fmt.Sprint(ids) != fmt.Sprint(want) {
+		t.Errorf("merged rows = %v, want %v", ids, want)
+	}
+}
+
+// An oversized partition is split into runs of consecutive files in
+// bound order, so each output covers one contiguous range.
+func TestCompactDataFilesSplitsOrderedRuns(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	// four disjoint ranges, each "4 MB": one bin, split into two runs of two
+	populateBoundedTable(t, fs, setup, []boundedFile{
+		{Name: "q4.parquet", IDs: []int64{7, 8}, Lower: 7, Upper: 8, SizeBytes: 4 << 20},
+		{Name: "q1.parquet", IDs: []int64{1, 2}, Lower: 1, Upper: 2, SizeBytes: 4 << 20},
+		{Name: "q3.parquet", IDs: []int64{5, 6}, Lower: 5, Upper: 6, SizeBytes: 4 << 20},
+		{Name: "q2.parquet", IDs: []int64{3, 4}, Lower: 3, Upper: 4, SizeBytes: 4 << 20},
+	})
+
+	handler := NewHandler(nil)
+	config := Config{TargetFileSizeBytes: 8 << 20, MinInputFiles: 2, MaxCommitRetries: 3}
+	result, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "compacted 4 files into 2") {
+		t.Fatalf("expected two ordered runs, got %q", result)
+	}
+
+	// each output must cover one contiguous range
+	state, err := loadCurrentMetadata(context.Background(), client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("loadCurrentMetadata: %v", err)
+	}
+	manifests, err := loadCurrentManifests(context.Background(), client, setup.BucketName, state.DataPath, state.Metadata)
+	if err != nil {
+		t.Fatalf("loadCurrentManifests: %v", err)
+	}
+	var ranges [][2]int64
+	for _, mf := range manifests {
+		if mf.ManifestContent() != iceberg.ManifestContentData {
+			continue
+		}
+		manifestData, err := loadFileByIcebergPath(context.Background(), client, setup.BucketName, state.DataPath, mf.FilePath())
+		if err != nil {
+			t.Fatalf("load manifest: %v", err)
+		}
+		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+		if err != nil {
+			t.Fatalf("read manifest: %v", err)
+		}
+		for _, entry := range entries {
+			if entry.Status() == iceberg.EntryStatusDELETED {
+				continue
+			}
+			lo, _ := iceberg.LiteralFromBytes(iceberg.PrimitiveTypes.Int64, entry.DataFile().LowerBoundValues()[1])
+			hi, _ := iceberg.LiteralFromBytes(iceberg.PrimitiveTypes.Int64, entry.DataFile().UpperBoundValues()[1])
+			ranges = append(ranges, [2]int64{int64(lo.(iceberg.Int64Literal)), int64(hi.(iceberg.Int64Literal))})
+		}
+	}
+	if len(ranges) != 2 {
+		t.Fatalf("expected 2 output files, got %d", len(ranges))
+	}
+	// ranges must be contiguous runs, not interleaved: {1..4} and {5..8}
+	for _, r := range ranges {
+		if r[1]-r[0] != 3 {
+			t.Errorf("output covers non-contiguous range %v", r)
+		}
+	}
+}
+
+// An oversized file without bounds can never join a merge, so it must not
+// disable bounds ordering for the files that can.
+func TestCompactDataFilesOrdersPastIneligibleFile(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	populateBoundedTable(t, fs, setup, []boundedFile{
+		{Name: "hi.parquet", IDs: []int64{3, 4}, Lower: 3, Upper: 4},
+		{Name: "lo.parquet", IDs: []int64{1, 2}, Lower: 1, Upper: 2},
+		{Name: "huge.parquet", IDs: []int64{9}, SizeBytes: 512 << 20, NoBounds: true},
+	})
+
+	handler := NewHandler(nil)
+	config := Config{TargetFileSizeBytes: 256 << 20, MinInputFiles: 2, MaxCommitRetries: 3}
+	result, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "compacted 2 files into 1") {
+		t.Fatalf("expected only the two eligible files to merge, got %q", result)
+	}
+
+	var merged iceberg.DataFile
+	for _, df := range liveDataFiles(t, client, setup) {
+		if !strings.HasSuffix(df.FilePath(), "huge.parquet") {
+			merged = df
+		}
+	}
+	ids := compactedIDs(t, client, setup, merged.FilePath())
+	want := []int64{1, 2, 3, 4}
+	if fmt.Sprint(ids) != fmt.Sprint(want) {
+		t.Errorf("merged rows = %v, want %v", ids, want)
+	}
+}
+
+// Runs too short to merge in bound order still merge by size, so files that
+// cannot form a contiguous run are not stranded for every later pass.
+func TestCompactDataFilesMergesStrandedRun(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	populateBoundedTable(t, fs, setup, []boundedFile{
+		{Name: "r1.parquet", IDs: []int64{1}, Lower: 1, Upper: 2, SizeBytes: 4 << 20},
+		{Name: "r2.parquet", IDs: []int64{3}, Lower: 3, Upper: 4, SizeBytes: 4 << 20},
+		{Name: "r3.parquet", IDs: []int64{5}, Lower: 5, Upper: 6, SizeBytes: 6 << 20},
+		{Name: "r4.parquet", IDs: []int64{7}, Lower: 7, Upper: 8, SizeBytes: 3 << 20},
+		{Name: "r5.parquet", IDs: []int64{9}, Lower: 9, Upper: 10, SizeBytes: 3 << 20},
+	})
+
+	handler := NewHandler(nil)
+	config := Config{TargetFileSizeBytes: 10 << 20, MinInputFiles: 3, MaxCommitRetries: 3}
+	result, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "compacted 3 files into 1") {
+		t.Fatalf("expected stranded files to merge by size, got %q", result)
+	}
+}
+
+// A declared sort order is preserved at the cost of compaction progress:
+// runs too short to merge are left for later passes instead of being
+// repacked out of order.
+func TestCompactDataFilesKeepsStrandedRunForSortedTable(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	sortOrder, err := table.NewSortOrder(1, []table.SortField{{
+		SourceIDs: []int{1},
+		Transform: iceberg.IdentityTransform{},
+		Direction: table.SortASC,
+		NullOrder: table.NullsFirst,
+	}})
+	if err != nil {
+		t.Fatalf("new sort order: %v", err)
+	}
+	populateBoundedTableSorted(t, fs, setup, []boundedFile{
+		{Name: "r1.parquet", IDs: []int64{1}, Lower: 1, Upper: 2, SizeBytes: 4 << 20},
+		{Name: "r2.parquet", IDs: []int64{3}, Lower: 3, Upper: 4, SizeBytes: 4 << 20},
+		{Name: "r3.parquet", IDs: []int64{5}, Lower: 5, Upper: 6, SizeBytes: 6 << 20},
+		{Name: "r4.parquet", IDs: []int64{7}, Lower: 7, Upper: 8, SizeBytes: 3 << 20},
+		{Name: "r5.parquet", IDs: []int64{9}, Lower: 9, Upper: 10, SizeBytes: 3 << 20},
+	}, sortOrder)
+
+	handler := NewHandler(nil)
+	config := Config{TargetFileSizeBytes: 10 << 20, MinInputFiles: 3, MaxCommitRetries: 3}
+	result, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "no files eligible for compaction") {
+		t.Fatalf("expected underfilled ordered runs to be kept, got %q", result)
+	}
+}
+
+// A declared sort order only applies when every file carries a bound for its
+// column; a file without one falls back to inference or unordered packing.
+func TestResolveCompactionOrderSkipsUncoveredSortField(t *testing.T) {
+	schema := newTestSchema()
+	spec := *iceberg.UnpartitionedSpec
+	sortOrder, err := table.NewSortOrder(1, []table.SortField{{
+		SourceIDs: []int{1},
+		Transform: iceberg.IdentityTransform{},
+		Direction: table.SortASC,
+		NullOrder: table.NullsFirst,
+	}})
+	if err != nil {
+		t.Fatalf("new sort order: %v", err)
+	}
+	meta, err := table.NewMetadata(schema, &spec, sortOrder, "s3://b/p", nil)
+	if err != nil {
+		t.Fatalf("create metadata: %v", err)
+	}
+
+	entry := func(name string, bounded bool) iceberg.ManifestEntry {
+		dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData,
+			"s3://b/data/"+name, iceberg.ParquetFile, map[int]any{}, nil, nil, 2, 16)
+		if err != nil {
+			t.Fatalf("build data file: %v", err)
+		}
+		if bounded {
+			lo, _ := iceberg.Int64Literal(1).MarshalBinary()
+			hi, _ := iceberg.Int64Literal(2).MarshalBinary()
+			dfb.LowerBoundValues(map[int][]byte{1: lo}).UpperBoundValues(map[int][]byte{1: hi})
+		}
+		snapID := int64(1)
+		return iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build())
+	}
+
+	if order := resolveCompactionOrder(meta, []iceberg.ManifestEntry{
+		entry("a.parquet", true), entry("b.parquet", true),
+	}); order == nil || order.bestEffort {
+		t.Fatalf("covered sort field: got %+v, want strict order", order)
+	}
+	if order := resolveCompactionOrder(meta, []iceberg.ManifestEntry{
+		entry("a.parquet", true), entry("b.parquet", false),
+	}); order != nil {
+		t.Fatalf("uncovered sort field: got %+v, want nil", order)
+	}
+}
+// A full-bin repack that produces nothing must not discard the ordered runs
+// it was meant to replace — they are still valid compaction work.
+func TestCompactDataFilesKeepsRunsWhenRepackFails(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	populateBoundedTable(t, fs, setup, []boundedFile{
+		{Name: "r1.parquet", IDs: []int64{1}, Lower: 1, Upper: 2, SizeBytes: 4 << 20},
+		{Name: "r2.parquet", IDs: []int64{3}, Lower: 3, Upper: 4, SizeBytes: 3 << 20},
+		{Name: "r3.parquet", IDs: []int64{5}, Lower: 5, Upper: 6, SizeBytes: 3 << 20},
+		{Name: "r4.parquet", IDs: []int64{7}, Lower: 7, Upper: 8, SizeBytes: 6 << 20},
+		{Name: "r5.parquet", IDs: []int64{9}, Lower: 9, Upper: 10, SizeBytes: 6 << 20},
+	})
+
+	handler := NewHandler(nil)
+	config := Config{TargetFileSizeBytes: 10 << 20, MinInputFiles: 3, MaxCommitRetries: 3}
+	result, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "compacted 3 files into 1") {
+		t.Fatalf("expected the ordered run to survive the failed repack, got %q", result)
+	}
+}
+
+// Geometry bounds have no order, so they never order a bin's files: a table
+// whose first column is a geometry is ordered by the next column with bounds.
+func TestResolveCompactionOrderSkipsGeometry(t *testing.T) {
+	schema := iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Type: iceberg.GeometryType{}, Name: "geom"},
+		iceberg.NestedField{ID: 2, Type: iceberg.PrimitiveTypes.Int64, Name: "id", Required: true})
+	meta, err := table.NewMetadata(schema, iceberg.UnpartitionedSpec, table.UnsortedSortOrder, "s3://tb/ns/geo", iceberg.Properties{"format-version": "3"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	geomField, _ := meta.CurrentSchema().FindFieldByName("geom")
+	idField, _ := meta.CurrentSchema().FindFieldByName("id")
+	snap := int64(1)
+	var entries []iceberg.ManifestEntry
+	for i, name := range []string{"a.parquet", "b.parquet", "c.parquet"} {
+		b, err := iceberg.NewDataFileBuilder(*iceberg.UnpartitionedSpec, iceberg.EntryContentData, "s3://tb/ns/geo/data/"+name, iceberg.ParquetFile, map[int]any{}, nil, nil, 1, 100)
+		if err != nil {
+			t.Fatal(err)
+		}
+		b.LowerBoundValues(map[int][]byte{geomField.ID: xyBound(float64(i), 0), idField.ID: geoLE64(int64(10 - i))})
+		b.UpperBoundValues(map[int][]byte{geomField.ID: xyBound(float64(i)+1, 1), idField.ID: geoLE64(int64(10 - i))})
+		entries = append(entries, iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snap, nil, nil, b.Build()))
+	}
+	order := resolveCompactionOrder(meta, entries)
+	if order == nil || order.fieldID != idField.ID {
+		t.Fatalf("order %+v, want the id column (field %d), not the geometry (field %d)", order, idField.ID, geomField.ID)
+	}
+	order.sortEntries(entries)
+	if first := entries[0].DataFile().FilePath(); !strings.HasSuffix(first, "c.parquet") {
+		t.Errorf("first file %s, want c.parquet (the lowest id)", first)
+	}
+}
diff --git a/weed/worker/tasks/iceberg/compact_rowgroup_test.go b/weed/worker/tasks/iceberg/compact_rowgroup_test.go
new file mode 100644
index 0000000000..1160bda1f4
--- /dev/null
+++ b/weed/worker/tasks/iceberg/compact_rowgroup_test.go
@@ -0,0 +1,97 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/parquet-go/parquet-go"
+)
+
+// Compacted files get row groups from the table's
+// write.parquet.row-group-limit instead of one row group per file.
+func TestCompactDataFilesWritesSeveralRowGroups(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+
+	type rowsT = struct {
+		ID   int64
+		Name string
+	}
+	makeRows := func(lo, hi int64) []rowsT {
+		rows := make([]rowsT, 0, hi-lo)
+		for i := lo; i < hi; i++ {
+			rows = append(rows, rowsT{i, fmt.Sprintf("r%d", i)})
+		}
+		return rows
+	}
+	populateTableWithDeleteFiles(t, fs, setup,
+		[]struct {
+			Name string
+			Rows []rowsT
+		}{
+			{"d1.parquet", makeRows(0, 1500)},
+			{"d2.parquet", makeRows(1500, 3000)},
+		},
+		nil, nil,
+	)
+
+	handler := NewHandler(nil)
+	config := Config{
+		TargetFileSizeBytes: 256 * 1024 * 1024,
+		MinInputFiles:       2,
+		MaxCommitRetries:    3,
+		RowGroupRowLimit:    2000,
+	}
+	if _, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil); err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+
+	state, err := loadCurrentMetadata(context.Background(), client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("loadCurrentMetadata: %v", err)
+	}
+	df := compactedDataFile(t, client, setup)
+	data, err := loadFileByIcebergPath(context.Background(), client, setup.BucketName, state.DataPath, df.FilePath())
+	if err != nil {
+		t.Fatalf("load compacted file: %v", err)
+	}
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatalf("open compacted file: %v", err)
+	}
+	if got := len(f.Metadata().RowGroups); got != 2 {
+		t.Errorf("row groups = %d, want 2 (3000 rows at row-group-limit 2000)", got)
+	}
+}
+
+// A configured row-group limit is a cap, not a floor: small explicit limits
+// are honored instead of being raised to the estimate floor.
+func TestRowsPerRowGroupHonorsConfiguredLimit(t *testing.T) {
+	entries := make([]iceberg.ManifestEntry, 0, 2)
+	spec := *iceberg.UnpartitionedSpec
+	for _, name := range []string{"a.parquet", "b.parquet"} {
+		dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData,
+			"s3://b/data/"+name, iceberg.ParquetFile, map[int]any{}, nil, nil, 300, 9000)
+		if err != nil {
+			t.Fatalf("build data file: %v", err)
+		}
+		snapID := int64(1)
+		entries = append(entries, iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build()))
+	}
+	bin := compactionBin{Entries: entries, TotalSize: 18000}
+
+	if got := rowsPerRowGroup(bin, Config{RowGroupRowLimit: 128}); got != 128 {
+		t.Errorf("explicit limit: rowsPerRowGroup = %d, want 128", got)
+	}
+	// 30 bytes/row, byte cap 128MB: the estimate of ~4.4M rows exceeds the 2M
+	// default, so the default holds; the floor lifts a degenerate estimate.
+	if got := rowsPerRowGroup(bin, Config{RowGroupSizeBytes: 1024}); got != minRowGroupRows {
+		t.Errorf("floored estimate: rowsPerRowGroup = %d, want %d", got, minRowGroupRows)
+	}
+	if got := rowsPerRowGroup(bin, Config{}); got != defaultRowGroupRowLimit {
+		t.Errorf("default: rowsPerRowGroup = %d, want %d", got, defaultRowGroupRowLimit)
+	}
+}
diff --git a/weed/worker/tasks/iceberg/compact_schema_test.go b/weed/worker/tasks/iceberg/compact_schema_test.go
new file mode 100644
index 0000000000..3d119037da
--- /dev/null
+++ b/weed/worker/tasks/iceberg/compact_schema_test.go
@@ -0,0 +1,644 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/parquet-go/parquet-go"
+
+	filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+// Files of one Iceberg table may spell its schema differently in Parquet:
+// a column added by schema evolution, or the same schema written REQUIRED
+// by one engine and OPTIONAL by another (PyIceberg writes REQUIRED, DuckDB
+// OPTIONAL). The bin-pack merge joins such files by Iceberg field id,
+// reading a column a file lacks as null, and refuses files whose same-name
+// columns carry different field ids (a column dropped and re-added).
+
+type narrowSchemaRow struct { // id REQUIRED id=1, name OPTIONAL id=2
+	ID   int64  `parquet:"id,id(1)"`
+	Name string `parquet:"name,id(2),optional"`
+}
+
+type wideSchemaRow struct { // plus extra OPTIONAL id=3
+	ID    int64  `parquet:"id,id(1)"`
+	Name  string `parquet:"name,id(2),optional"`
+	Extra string `parquet:"extra,id(3),optional"`
+}
+
+type reorderedSchemaRow struct { // the wide schema's columns in another order
+	Extra string `parquet:"extra,id(3),optional"`
+	ID    int64  `parquet:"id,id(1)"`
+	Name  string `parquet:"name,id(2),optional"`
+}
+
+type optionalIDSchemaRow struct { // id OPTIONAL id=1
+	ID   int64  `parquet:"id,id(1),optional"`
+	Name string `parquet:"name,id(2),optional"`
+}
+
+type readdedNameSchemaRow struct { // name re-added under field id 3
+	ID   int64  `parquet:"id,id(1)"`
+	Name string `parquet:"name,id(3),optional"`
+}
+
+type nullableExtraSchemaRow struct { // the wide schema, extra writable as null
+	ID    int64   `parquet:"id,id(1)"`
+	Name  string  `parquet:"name,id(2),optional"`
+	Extra *string `parquet:"extra,id(3),optional"`
+}
+
+func newAddedColumnSchema() *iceberg.Schema { // newTestSchema plus extra id=3
+	return iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Type: iceberg.PrimitiveTypes.Int64, Name: "id", Required: true},
+		iceberg.NestedField{ID: 2, Type: iceberg.PrimitiveTypes.String, Name: "name", Required: false},
+		iceberg.NestedField{ID: 3, Type: iceberg.PrimitiveTypes.String, Name: "extra", Required: false},
+	)
+}
+
+func schemaFileEntry(t *testing.T, path string, recordCount int64) iceberg.ManifestEntry {
+	t.Helper()
+	dfb, err := iceberg.NewDataFileBuilder(*iceberg.UnpartitionedSpec, iceberg.EntryContentData,
+		path, iceberg.ParquetFile, map[int]any{}, nil, nil, recordCount, 1024)
+	if err != nil {
+		t.Fatalf("build data file: %v", err)
+	}
+	snapID := int64(1)
+	return iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build())
+}
+
+func mergeNamedFiles(t *testing.T, client filer_pb.SeaweedFilerClient, names []string, counts map[string]int64,
+	eqGroups []equalityDeleteGroup, schema *iceberg.Schema, lineage bool) ([]byte, int64, error) {
+	t.Helper()
+	var entries []iceberg.ManifestEntry
+	for _, name := range names {
+		entries = append(entries, schemaFileEntry(t, "data/"+name, counts[name]))
+	}
+	return mergeParquetFiles(context.Background(), client, "test-bucket", "ns/tbl",
+		entries, nil, eqGroups, schema, 0, lineage)
+}
+
+// mergedValues returns the merged file's schema and each row's leaf values
+// in column order (nil for nulls).
+func mergedValues(t *testing.T, data []byte) (*parquet.Schema, [][]any) {
+	t.Helper()
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatalf("open merged: %v", err)
+	}
+	var out [][]any
+	for _, rg := range f.RowGroups() {
+		rows := rg.Rows()
+		buf := make([]parquet.Row, 16)
+		for {
+			n, err := rows.ReadRows(buf)
+			for _, r := range buf[:n] {
+				vals := make([]any, len(r))
+				for i, v := range r {
+					if v.IsNull() {
+						continue
+					}
+					if v.Kind() == parquet.Int64 {
+						vals[i] = v.Int64()
+					} else {
+						vals[i] = v.String()
+					}
+				}
+				out = append(out, vals)
+			}
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				t.Fatalf("read merged rows: %v", err)
+			}
+		}
+		rows.Close()
+	}
+	return f.Schema(), out
+}
+
+func checkMergedRows(t *testing.T, data []byte, want [][]any) *parquet.Schema {
+	t.Helper()
+	schema, got := mergedValues(t, data)
+	if len(got) != len(want) {
+		t.Fatalf("merged rows = %v, want %v", got, want)
+	}
+	for i := range want {
+		if len(got[i]) != len(want[i]) {
+			t.Fatalf("row %d = %v, want %v", i, got[i], want[i])
+		}
+		for j := range want[i] {
+			if got[i][j] != want[i][j] {
+				t.Fatalf("row %d column %d = %v, want %v (row %v)", i, j, got[i][j], want[i][j], got[i])
+			}
+		}
+	}
+	return schema
+}
+
+// A column added to the table after some files were written: the merge
+// joins the files by field id and reads the new column as null for the
+// old file's rows, whichever file leads the bin.
+func TestMergeParquetFilesAddedColumn(t *testing.T) {
+	put := func(fs *fakeFilerServer) map[string]int64 {
+		putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}, {2, "b"}, {3, "c"}})
+		putDataFileRows(t, fs, "wide.parquet", []wideSchemaRow{{4, "d", "e4"}, {5, "e", "e5"}})
+		return map[string]int64{"narrow.parquet": 3, "wide.parquet": 2}
+	}
+	checkFields := func(t *testing.T, schema *parquet.Schema) {
+		fields := schema.Fields()
+		if len(fields) != 3 {
+			t.Fatalf("merged fields = %d, want 3", len(fields))
+		}
+		names := []string{fields[0].Name(), fields[1].Name(), fields[2].Name()}
+		if names[0] != "id" || names[1] != "name" || names[2] != "extra" {
+			t.Fatalf("merged fields = %v, want [id name extra]", names)
+		}
+		if fields[2].ID() != 3 {
+			t.Fatalf("extra field id = %d, want 3", fields[2].ID())
+		}
+	}
+
+	t.Run("narrow first", func(t *testing.T) {
+		fs, client := startFakeFiler(t)
+		counts := put(fs)
+		merged, count, err := mergeNamedFiles(t, client,
+			[]string{"narrow.parquet", "wide.parquet"}, counts, nil, nil, false)
+		if err != nil {
+			t.Fatalf("mergeParquetFiles: %v", err)
+		}
+		if count != 5 {
+			t.Fatalf("merged %d rows, want 5", count)
+		}
+		checkFields(t, checkMergedRows(t, merged, [][]any{
+			{int64(1), "a", nil},
+			{int64(2), "b", nil},
+			{int64(3), "c", nil},
+			{int64(4), "d", "e4"},
+			{int64(5), "e", "e5"},
+		}))
+	})
+
+	t.Run("wide first", func(t *testing.T) {
+		fs, client := startFakeFiler(t)
+		counts := put(fs)
+		merged, count, err := mergeNamedFiles(t, client,
+			[]string{"wide.parquet", "narrow.parquet"}, counts, nil, nil, false)
+		if err != nil {
+			t.Fatalf("mergeParquetFiles: %v", err)
+		}
+		if count != 5 {
+			t.Fatalf("merged %d rows, want 5", count)
+		}
+		checkFields(t, checkMergedRows(t, merged, [][]any{
+			{int64(4), "d", "e4"},
+			{int64(5), "e", "e5"},
+			{int64(1), "a", nil},
+			{int64(2), "b", nil},
+			{int64(3), "c", nil},
+		}))
+	})
+}
+
+// The same Iceberg schema written REQUIRED by one engine and OPTIONAL by
+// another merges; the writer keeps the wider, optional, repetition.
+func TestMergeParquetFilesRequiredVsOptional(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	putDataFileRows(t, fs, "required.parquet", []narrowSchemaRow{{1, "a"}, {2, "b"}})
+	putDataFileRows(t, fs, "optional.parquet", []optionalIDSchemaRow{{3, "c"}, {4, "d"}})
+
+	merged, count, err := mergeNamedFiles(t, client,
+		[]string{"required.parquet", "optional.parquet"},
+		map[string]int64{"required.parquet": 2, "optional.parquet": 2}, nil, nil, false)
+	if err != nil {
+		t.Fatalf("mergeParquetFiles: %v", err)
+	}
+	if count != 4 {
+		t.Fatalf("merged %d rows, want 4", count)
+	}
+	schema := checkMergedRows(t, merged, [][]any{
+		{int64(1), "a"},
+		{int64(2), "b"},
+		{int64(3), "c"},
+		{int64(4), "d"},
+	})
+	if !schema.Fields()[0].Optional() {
+		t.Error("merged id column is REQUIRED, want OPTIONAL")
+	}
+}
+
+// A column dropped and re-added under the same name and type has a new
+// field id; merging its file with an old one would file the new column's
+// values under the dropped field id, so the bin is refused.
+func TestMergeParquetFilesReaddedColumn(t *testing.T) {
+	for _, names := range [][]string{
+		{"narrow.parquet", "re-added.parquet"},
+		{"re-added.parquet", "narrow.parquet"},
+	} {
+		fs, client := startFakeFiler(t)
+		putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}})
+		putDataFileRows(t, fs, "re-added.parquet", []readdedNameSchemaRow{{2, "new-2"}})
+
+		_, _, err := mergeNamedFiles(t, client, names,
+			map[string]int64{"narrow.parquet": 1, "re-added.parquet": 1}, nil, nil, false)
+		if err == nil || !strings.Contains(err.Error(), "cannot merge files with different schemas") {
+			t.Errorf("merge of %v: %v, want schema mismatch", names, err)
+		}
+	}
+}
+
+type disjointColumnsRow struct { // id id=1, extra id=3: no name
+	ID    int64  `parquet:"id,id(1)"`
+	Extra string `parquet:"extra,id(3),optional"`
+}
+
+type requiredExtraSchemaRow struct { // extra REQUIRED id=3
+	ID    int64  `parquet:"id,id(1)"`
+	Name  string `parquet:"name,id(2),optional"`
+	Extra string `parquet:"extra,id(3)"`
+}
+
+// Differences field-id matching does not cover stay refused: a rename, a
+// type change, files without field ids; and a control pair still compacts.
+func TestMergeParquetFilesSchemaRefusals(t *testing.T) {
+	type renamedSchemaRow struct {
+		ID    int64  `parquet:"id,id(1)"`
+		Other string `parquet:"other,id(2),optional"`
+	}
+	type widenedSchemaRow struct {
+		ID   int32  `parquet:"id,id(1)"`
+		Name string `parquet:"name,id(2),optional"`
+	}
+	type noIDExtraRow struct {
+		ID    int64  `parquet:"id"`
+		Name  string `parquet:"name,optional"`
+		Extra string `parquet:"extra,optional"`
+	}
+
+	cases := []struct {
+		name      string
+		writeFile func(fs *fakeFilerServer, name string)
+	}{
+		{"rename", func(fs *fakeFilerServer, name string) {
+			putDataFileRows(t, fs, name, []renamedSchemaRow{{5, "e"}})
+		}},
+		{"type change", func(fs *fakeFilerServer, name string) {
+			putDataFileRows(t, fs, name, []widenedSchemaRow{{5, "e"}})
+		}},
+		{"no field ids", func(fs *fakeFilerServer, name string) {
+			putDataFileRows(t, fs, name, []noIDExtraRow{{5, "e", "x"}})
+		}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			fs, client := startFakeFiler(t)
+			putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}})
+			tc.writeFile(fs, "other.parquet")
+
+			_, _, err := mergeNamedFiles(t, client,
+				[]string{"narrow.parquet", "other.parquet"},
+				map[string]int64{"narrow.parquet": 1, "other.parquet": 1}, nil, nil, false)
+			if err == nil || !strings.Contains(err.Error(), "cannot merge files with different schemas") {
+				t.Errorf("merge: %v, want schema mismatch", err)
+			}
+		})
+	}
+
+	t.Run("control", func(t *testing.T) {
+		fs, client := startFakeFiler(t)
+		putDataFileRows(t, fs, "a.parquet", []narrowSchemaRow{{1, "a"}})
+		putDataFileRows(t, fs, "b.parquet", []narrowSchemaRow{{2, "b"}})
+		if _, _, err := mergeNamedFiles(t, client, []string{"a.parquet", "b.parquet"},
+			map[string]int64{"a.parquet": 1, "b.parquet": 1}, nil, nil, false); err != nil {
+			t.Errorf("control merge: %v", err)
+		}
+	})
+}
+
+// An equality-delete column can sit at a different position in an older
+// file: it is resolved on each file's own schema.
+func TestMergeParquetFilesEvolvedSchemaEqualityDelete(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}, {2, "b"}, {3, "c"}})
+	putDataFileRows(t, fs, "reordered.parquet", []reorderedSchemaRow{
+		{"e4", 4, "d"}, {"e5", 5, "e"},
+	})
+
+	// An equality delete on name (field id 2) for "b" (index 1 in the
+	// narrow file) and "e" (index 2 in the reordered file).
+	type eqDeleteRow struct {
+		Name string `parquet:"name"`
+	}
+	var eqBuf bytes.Buffer
+	eqWriter := parquet.NewWriter(&eqBuf, parquet.SchemaOf(new(eqDeleteRow)))
+	for _, r := range []eqDeleteRow{{"b"}, {"e"}} {
+		if err := eqWriter.Write(&r); err != nil {
+			t.Fatalf("write eq delete: %v", err)
+		}
+	}
+	if err := eqWriter.Close(); err != nil {
+		t.Fatalf("close eq writer: %v", err)
+	}
+	fs.putEntry("/buckets/test-bucket/ns/tbl/data", "eq-del.parquet", &filer_pb.Entry{
+		Name: "eq-del.parquet", Content: eqBuf.Bytes(),
+	})
+
+	eqDfb, err := iceberg.NewDataFileBuilder(*iceberg.UnpartitionedSpec, iceberg.EntryContentEqDeletes,
+		"data/eq-del.parquet", iceberg.ParquetFile, map[int]any{}, nil, nil, 2, int64(eqBuf.Len()))
+	if err != nil {
+		t.Fatalf("build eq delete: %v", err)
+	}
+	eqDfb.EqualityFieldIDs([]int{2})
+	snapID := int64(1)
+	eqEntry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, eqDfb.Build())
+
+	eqGroups, err := collectEqualityDeletes(context.Background(), client, "test-bucket", "ns/tbl",
+		[]iceberg.ManifestEntry{eqEntry}, newTestSchema())
+	if err != nil {
+		t.Fatalf("collectEqualityDeletes: %v", err)
+	}
+
+	merged, count, err := mergeNamedFiles(t, client,
+		[]string{"narrow.parquet", "reordered.parquet"},
+		map[string]int64{"narrow.parquet": 3, "reordered.parquet": 2}, eqGroups, newTestSchema(), false)
+	if err != nil {
+		t.Fatalf("mergeParquetFiles: %v", err)
+	}
+	if count != 3 {
+		t.Fatalf("merged %d rows, want 3", count)
+	}
+	// The union schema (id, name, extra) is the writer's.
+	checkMergedRows(t, merged, [][]any{
+		{int64(1), "a", nil},
+		{int64(3), "c", nil},
+		{int64(4), "d", "e4"},
+	})
+}
+
+// File pairs where neither schema covers the other merge under the union
+// writer schema: a REQUIRED/OPTIONAL difference plus an added column, a
+// column each side lacks the other's of, and an added REQUIRED column
+// (demoted to OPTIONAL: the files without it read null).
+func TestMergeParquetFilesUnionWriterSchema(t *testing.T) {
+	t.Run("added column and repetition differ", func(t *testing.T) {
+		for _, names := range [][]string{
+			{"wide.parquet", "optional.parquet"},
+			{"optional.parquet", "wide.parquet"},
+		} {
+			fs, client := startFakeFiler(t)
+			putDataFileRows(t, fs, "wide.parquet", []wideSchemaRow{{4, "d", "e4"}, {5, "e", "e5"}})
+			putDataFileRows(t, fs, "optional.parquet", []optionalIDSchemaRow{{1, "a"}, {2, "b"}})
+
+			merged, count, err := mergeNamedFiles(t, client, names,
+				map[string]int64{"wide.parquet": 2, "optional.parquet": 2}, nil, nil, false)
+			if err != nil {
+				t.Fatalf("merge of %v: %v", names, err)
+			}
+			if count != 4 {
+				t.Fatalf("merged %d rows, want 4", count)
+			}
+			var want [][]any
+			if names[0] == "wide.parquet" {
+				want = [][]any{{int64(4), "d", "e4"}, {int64(5), "e", "e5"}, {int64(1), "a", nil}, {int64(2), "b", nil}}
+			} else {
+				want = [][]any{{int64(1), "a", nil}, {int64(2), "b", nil}, {int64(4), "d", "e4"}, {int64(5), "e", "e5"}}
+			}
+			schema := checkMergedRows(t, merged, want)
+			if !schema.Fields()[0].Optional() {
+				t.Errorf("merged id column is REQUIRED, want OPTIONAL")
+			}
+		}
+	})
+
+	t.Run("disjoint columns", func(t *testing.T) {
+		for _, names := range [][]string{
+			{"narrow.parquet", "disjoint.parquet"},
+			{"disjoint.parquet", "narrow.parquet"},
+		} {
+			fs, client := startFakeFiler(t)
+			putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}})
+			putDataFileRows(t, fs, "disjoint.parquet", []disjointColumnsRow{{5, "e"}})
+
+			merged, count, err := mergeNamedFiles(t, client, names,
+				map[string]int64{"narrow.parquet": 1, "disjoint.parquet": 1}, nil, nil, false)
+			if err != nil {
+				t.Fatalf("merge of %v: %v", names, err)
+			}
+			if count != 2 {
+				t.Fatalf("merged %d rows, want 2", count)
+			}
+			var want [][]any
+			if names[0] == "narrow.parquet" { // union (id, name, extra)
+				want = [][]any{{int64(1), "a", nil}, {int64(5), nil, "e"}}
+			} else { // union (id, extra, name)
+				want = [][]any{{int64(5), "e", nil}, {int64(1), nil, "a"}}
+			}
+			checkMergedRows(t, merged, want)
+		}
+	})
+
+	t.Run("added required column", func(t *testing.T) {
+		fs, client := startFakeFiler(t)
+		putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}})
+		putDataFileRows(t, fs, "required-extra.parquet", []requiredExtraSchemaRow{{5, "e", "x"}})
+
+		merged, count, err := mergeNamedFiles(t, client,
+			[]string{"narrow.parquet", "required-extra.parquet"},
+			map[string]int64{"narrow.parquet": 1, "required-extra.parquet": 1}, nil, nil, false)
+		if err != nil {
+			t.Fatalf("mergeParquetFiles: %v", err)
+		}
+		if count != 2 {
+			t.Fatalf("merged %d rows, want 2", count)
+		}
+		schema := checkMergedRows(t, merged, [][]any{
+			{int64(1), "a", nil},
+			{int64(5), "e", "x"},
+		})
+		if !schema.Fields()[2].Optional() {
+			t.Error("merged extra column is REQUIRED, want OPTIONAL")
+		}
+	})
+}
+
+// An equality delete naming a column added after some files were written:
+// the files that lack it read the delete key's column as null, so a real
+// key does not match their rows and a null key deletes them all.
+func TestMergeParquetFilesEqualityDeleteAddedColumn(t *testing.T) {
+	strPtr := func(s string) *string { return &s }
+	put := func(fs *fakeFilerServer) map[string]int64 {
+		putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}, {2, "b"}, {3, "c"}})
+		putDataFileRows(t, fs, "wide.parquet", []nullableExtraSchemaRow{{4, "d", strPtr("e4")}, {5, "e", nil}})
+		return map[string]int64{"narrow.parquet": 3, "wide.parquet": 2}
+	}
+	eqGroups := func(keys ...parquet.Value) []equalityDeleteGroup {
+		set := make(map[string]struct{}, len(keys))
+		for _, k := range keys {
+			set[buildEqualityKey(parquet.Row{k}, []int{0})] = struct{}{}
+		}
+		return []equalityDeleteGroup{{FieldIDs: []int{3}, Keys: set}}
+	}
+	schema := newAddedColumnSchema()
+
+	t.Run("key matches no null", func(t *testing.T) {
+		for _, names := range [][]string{
+			{"narrow.parquet", "wide.parquet"},
+			{"wide.parquet", "narrow.parquet"},
+		} {
+			fs, client := startFakeFiler(t)
+			counts := put(fs)
+			merged, count, err := mergeNamedFiles(t, client, names, counts,
+				eqGroups(parquet.ValueOf("e4")), schema, false)
+			if err != nil {
+				t.Fatalf("merge of %v: %v", names, err)
+			}
+			if count != 4 {
+				t.Fatalf("merged %d rows, want 4", count)
+			}
+			var want [][]any
+			if names[0] == "narrow.parquet" {
+				want = [][]any{{int64(1), "a", nil}, {int64(2), "b", nil}, {int64(3), "c", nil}, {int64(5), "e", nil}}
+			} else {
+				want = [][]any{{int64(5), "e", nil}, {int64(1), "a", nil}, {int64(2), "b", nil}, {int64(3), "c", nil}}
+			}
+			checkMergedRows(t, merged, want)
+		}
+	})
+
+	t.Run("null key deletes nulls", func(t *testing.T) {
+		for _, names := range [][]string{
+			{"narrow.parquet", "wide.parquet"},
+			{"wide.parquet", "narrow.parquet"},
+		} {
+			fs, client := startFakeFiler(t)
+			counts := put(fs)
+			merged, count, err := mergeNamedFiles(t, client, names, counts,
+				eqGroups(parquet.NullValue()), schema, false)
+			if err != nil {
+				t.Fatalf("merge of %v: %v", names, err)
+			}
+			if count != 1 {
+				t.Fatalf("merged %d rows, want 1", count)
+			}
+			checkMergedRows(t, merged, [][]any{{int64(4), "d", "e4"}})
+		}
+	})
+}
+
+// A column renamed after its files were written still carries its field id,
+// so an equality delete on it resolves the column by id and removes only the
+// rows it names — the old name looking absent must not turn every key null.
+func TestMergeParquetFilesEqualityDeleteRenamedColumn(t *testing.T) {
+	// The table renamed name (field id 2) to label; every file still spells
+	// the old name.
+	schema := iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Type: iceberg.PrimitiveTypes.Int64, Name: "id", Required: true},
+		iceberg.NestedField{ID: 2, Type: iceberg.PrimitiveTypes.String, Name: "label", Required: false},
+	)
+	type eqDeleteRow struct {
+		Name string `parquet:"name,id(2)"`
+	}
+
+	fs, client := startFakeFiler(t)
+	putDataFileRows(t, fs, "a.parquet", []narrowSchemaRow{{1, "a"}, {2, "b"}, {3, "c"}})
+	putDataFileRows(t, fs, "b.parquet", []narrowSchemaRow{{4, "d"}})
+
+	var eqBuf bytes.Buffer
+	eqWriter := parquet.NewWriter(&eqBuf, parquet.SchemaOf(new(eqDeleteRow)))
+	if err := eqWriter.Write(&eqDeleteRow{"b"}); err != nil {
+		t.Fatalf("write eq delete: %v", err)
+	}
+	if err := eqWriter.Close(); err != nil {
+		t.Fatalf("close eq writer: %v", err)
+	}
+	fs.putEntry("/buckets/test-bucket/ns/tbl/data", "eq-del.parquet", &filer_pb.Entry{
+		Name: "eq-del.parquet", Content: eqBuf.Bytes(),
+	})
+
+	eqDfb, err := iceberg.NewDataFileBuilder(*iceberg.UnpartitionedSpec, iceberg.EntryContentEqDeletes,
+		"data/eq-del.parquet", iceberg.ParquetFile, map[int]any{}, nil, nil, 1, int64(eqBuf.Len()))
+	if err != nil {
+		t.Fatalf("build eq delete: %v", err)
+	}
+	eqDfb.EqualityFieldIDs([]int{2})
+	snapID := int64(1)
+	eqEntry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, eqDfb.Build())
+
+	eqGroups, err := collectEqualityDeletes(context.Background(), client, "test-bucket", "ns/tbl",
+		[]iceberg.ManifestEntry{eqEntry}, schema)
+	if err != nil {
+		t.Fatalf("collectEqualityDeletes: %v", err)
+	}
+
+	merged, count, err := mergeNamedFiles(t, client,
+		[]string{"a.parquet", "b.parquet"},
+		map[string]int64{"a.parquet": 3, "b.parquet": 1}, eqGroups, schema, false)
+	if err != nil {
+		t.Fatalf("mergeParquetFiles: %v", err)
+	}
+	if count != 3 {
+		t.Fatalf("merged %d rows, want 3", count)
+	}
+	checkMergedRows(t, merged, [][]any{
+		{int64(1), "a"},
+		{int64(3), "c"},
+		{int64(4), "d"},
+	})
+}
+
+// An equality-delete file that lacks its equality column is refused rather
+// than read as null keys: the spec requires equality deletes to carry the
+// columns they name, so the missing-column fallback is for data files only.
+func TestEqualityDeleteFileMissingColumn(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	type otherRow struct {
+		Other string `parquet:"other,id(9)"`
+	}
+	var eqBuf bytes.Buffer
+	eqWriter := parquet.NewWriter(&eqBuf, parquet.SchemaOf(new(otherRow)))
+	if err := eqWriter.Write(&otherRow{"x"}); err != nil {
+		t.Fatalf("write eq delete: %v", err)
+	}
+	if err := eqWriter.Close(); err != nil {
+		t.Fatalf("close eq writer: %v", err)
+	}
+	fs.putEntry("/buckets/test-bucket/ns/tbl/data", "eq-del.parquet", &filer_pb.Entry{
+		Name: "eq-del.parquet", Content: eqBuf.Bytes(),
+	})
+
+	eqDfb, err := iceberg.NewDataFileBuilder(*iceberg.UnpartitionedSpec, iceberg.EntryContentEqDeletes,
+		"data/eq-del.parquet", iceberg.ParquetFile, map[int]any{}, nil, nil, 1, int64(eqBuf.Len()))
+	if err != nil {
+		t.Fatalf("build eq delete: %v", err)
+	}
+	eqDfb.EqualityFieldIDs([]int{2})
+	snapID := int64(1)
+	eqEntry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, eqDfb.Build())
+
+	_, err = collectEqualityDeletes(context.Background(), client, "test-bucket", "ns/tbl",
+		[]iceberg.ManifestEntry{eqEntry}, newAddedColumnSchema())
+	if err == nil {
+		t.Fatal("collectEqualityDeletes: want an error for a missing equality column")
+	}
+}
+
+// The v3 merge matches files on the first file's columns; the re-added
+// column is refused there too.
+func TestMergeParquetFilesV3ReaddedColumn(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	putDataFileRows(t, fs, "narrow.parquet", []narrowSchemaRow{{1, "a"}})
+	putDataFileRows(t, fs, "re-added.parquet", []readdedNameSchemaRow{{2, "new-2"}})
+
+	_, _, err := mergeNamedFiles(t, client,
+		[]string{"narrow.parquet", "re-added.parquet"},
+		map[string]int64{"narrow.parquet": 1, "re-added.parquet": 1}, nil, nil, true)
+	if err == nil || !strings.Contains(err.Error(), "cannot merge files with different schemas") {
+		t.Fatalf("merge: %v, want schema mismatch", err)
+	}
+}
diff --git a/weed/worker/tasks/iceberg/compact_stats.go b/weed/worker/tasks/iceberg/compact_stats.go
new file mode 100644
index 0000000000..277752c976
--- /dev/null
+++ b/weed/worker/tasks/iceberg/compact_stats.go
@@ -0,0 +1,252 @@
+package iceberg
+
+import (
+	"bytes"
+	"math"
+	"sort"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/apache/iceberg-go"
+	"github.com/parquet-go/parquet-go"
+	"github.com/parquet-go/parquet-go/format"
+)
+
+// boundTruncateLength is the default metrics mode of the Iceberg reference
+// implementation, truncate(16), applied to string and binary bounds.
+const boundTruncateLength = 16
+
+// columnStats is what a data file's manifest entry records about its columns,
+// keyed by Iceberg field id. Readers plan scans from it.
+type columnStats struct {
+	sizes, values, nulls map[int]int64
+	lower, upper         map[int][]byte
+	splitOffsets         []int64
+}
+
+func (s *columnStats) applyTo(b *iceberg.DataFileBuilder) {
+	b.ColumnSizes(s.sizes).ValueCounts(s.values).NullValueCounts(s.nulls).
+		LowerBoundValues(s.lower).UpperBoundValues(s.upper).SplitOffsets(s.splitOffsets)
+}
+
+// collectColumnStats reads back the footer of a Parquet file the compactor
+// wrote. Counts and sizes are summed over the row groups and the bounds are
+// the minimum and maximum of the row group statistics, encoded with the
+// spec's single-value serialization. A column whose bounds cannot be read
+// for every row group, or converted exactly, gets no bounds.
+func collectColumnStats(data []byte, schema *iceberg.Schema) (*columnStats, error) {
+	file, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)),
+		parquet.SkipPageIndex(true), parquet.SkipBloomFilters(true))
+	if err != nil {
+		return nil, err
+	}
+	var leaves []*parquet.Column
+	var walk func(*parquet.Column)
+	walk = func(c *parquet.Column) {
+		if c.Leaf() {
+			leaves = append(leaves, c)
+			return
+		}
+		for _, child := range c.Columns() {
+			walk(child)
+		}
+	}
+	walk(file.Root())
+
+	type bounds struct {
+		field    iceberg.NestedField
+		typ      parquet.Type
+		min, max parquet.Value
+		seen     bool
+		invalid  bool
+	}
+	stats := &columnStats{sizes: map[int]int64{}, values: map[int]int64{}, nulls: map[int]int64{},
+		lower: map[int][]byte{}, upper: map[int][]byte{}}
+	agg := map[int]*bounds{}
+	geoAgg := map[int]*geometryBounds{}
+	meta := file.Metadata()
+	for rgIdx, rg := range file.RowGroups() {
+		stats.splitOffsets = append(stats.splitOffsets, rowGroupOffset(&meta.RowGroups[rgIdx]))
+		for col, cc := range rg.ColumnChunks() {
+			field, ok := icebergFieldOf(leaves[col], schema)
+			if !ok {
+				continue
+			}
+			stats.sizes[field.ID] += meta.RowGroups[rgIdx].Columns[col].MetaData.TotalCompressedSize
+			stats.values[field.ID] += cc.NumValues()
+			b := agg[field.ID]
+			if b == nil {
+				b = &bounds{field: field, typ: leaves[col].Type()}
+				agg[field.ID] = b
+			}
+			chunk, ok := cc.(*parquet.FileColumnChunk)
+			if !ok {
+				b.invalid = true
+				geoAgg[field.ID] = &geometryBounds{invalid: true}
+				continue
+			}
+			stats.nulls[field.ID] += chunk.NullCount()
+			switch field.Type.(type) {
+			case iceberg.GeometryType:
+				// the bound comes from the row group's geospatial statistics
+				g := geoAgg[field.ID]
+				if g == nil {
+					g = &geometryBounds{}
+					geoAgg[field.ID] = g
+				}
+				g.add(meta.RowGroups[rgIdx].Columns[col].MetaData.GeospatialStatistics, chunk.NumValues(), chunk.NullCount())
+				continue
+			case iceberg.GeographyType:
+				// no bound: edges are geodesic and a box may cross the antimeridian
+				continue
+			}
+			if chunk.NullCount() == chunk.NumValues() {
+				continue // an all-null chunk constrains nothing
+			}
+			lo, hi, ok := chunk.Bounds()
+			switch {
+			case !ok:
+				b.invalid = true
+			case !b.seen:
+				b.min, b.max, b.seen = lo.Clone(), hi.Clone(), true
+			default:
+				if b.typ.Compare(lo, b.min) < 0 {
+					b.min = lo.Clone()
+				}
+				if b.typ.Compare(hi, b.max) > 0 {
+					b.max = hi.Clone()
+				}
+			}
+		}
+	}
+
+	for id, b := range agg {
+		if b.invalid || !b.seen {
+			continue
+		}
+		lo, okLo := boundLiteral(b.min, b.typ, b.field.Type)
+		hi, okHi := boundLiteral(b.max, b.typ, b.field.Type)
+		if !okLo || !okHi {
+			continue
+		}
+		lo, hi, okHi = truncateBounds(lo, hi)
+		if raw, err := lo.MarshalBinary(); err == nil {
+			stats.lower[id] = raw
+		}
+		if raw, err := hi.MarshalBinary(); err == nil && okHi {
+			stats.upper[id] = raw
+		}
+	}
+	for id, g := range geoAgg {
+		if lower, upper, ok := g.encoded(); ok {
+			stats.lower[id], stats.upper[id] = lower, upper
+		}
+	}
+	sort.Slice(stats.splitOffsets, func(i, j int) bool { return stats.splitOffsets[i] < stats.splitOffsets[j] })
+	return stats, nil
+}
+
+// icebergFieldOf finds the Iceberg field of a Parquet leaf column by the field
+// id the writer stored, or by its dotted path in a file written without ids.
+// Only primitive fields outside lists and maps carry statistics.
+func icebergFieldOf(leaf *parquet.Column, schema *iceberg.Schema) (iceberg.NestedField, bool) {
+	var field iceberg.NestedField
+	var ok bool
+	if leaf.MaxRepetitionLevel() > 0 {
+		return field, false
+	}
+	if id := leaf.ID(); id > 0 {
+		field, ok = schema.FindFieldByID(id)
+	} else {
+		field, ok = schema.FindFieldByName(strings.Join(leaf.Path(), "."))
+	}
+	if !ok {
+		return field, false
+	}
+	_, primitive := field.Type.(iceberg.PrimitiveType)
+	return field, primitive
+}
+
+// rowGroupOffset is where a row group's bytes start: the split offset readers
+// plan one task per row group from.
+func rowGroupOffset(rg *format.RowGroup) int64 {
+	if rg.FileOffset > 0 || len(rg.Columns) == 0 {
+		return rg.FileOffset
+	}
+	first := rg.Columns[0].MetaData
+	if first.DictionaryPageOffset > 0 && first.DictionaryPageOffset < first.DataPageOffset {
+		return first.DictionaryPageOffset
+	}
+	return first.DataPageOffset
+}
+
+// boundLiteral converts a Parquet statistics value into a literal of the
+// column's Iceberg type, when the conversion is exact. Other types (decimal,
+// time, uuid, fixed, timestamps not in the type's unit) get no bound.
+func boundLiteral(v parquet.Value, pt parquet.Type, t iceberg.Type) (iceberg.Literal, bool) {
+	if v.IsNull() {
+		return nil, false
+	}
+	switch t.(type) {
+	case iceberg.BooleanType:
+		return iceberg.BoolLiteral(v.Boolean()), v.Kind() == parquet.Boolean
+	case iceberg.Int32Type:
+		return iceberg.Int32Literal(v.Int32()), v.Kind() == parquet.Int32
+	case iceberg.Int64Type:
+		switch v.Kind() {
+		case parquet.Int64:
+			return iceberg.Int64Literal(v.Int64()), true
+		case parquet.Int32:
+			return iceberg.Int64Literal(int64(v.Int32())), true
+		}
+	case iceberg.Float32Type:
+		f := v.Float()
+		return iceberg.Float32Literal(f), v.Kind() == parquet.Float && !math.IsNaN(float64(f))
+	case iceberg.Float64Type:
+		f := v.Double()
+		return iceberg.Float64Literal(f), v.Kind() == parquet.Double && !math.IsNaN(f)
+	case iceberg.DateType:
+		return iceberg.DateLiteral(iceberg.Date(v.Int32())), v.Kind() == parquet.Int32
+	case iceberg.TimestampType, iceberg.TimestampTzType:
+		return iceberg.TimestampLiteral(iceberg.Timestamp(v.Int64())), v.Kind() == parquet.Int64 && timeUnit(pt) == time.Microsecond
+	case iceberg.TimestampNsType:
+		return iceberg.TimestampNsLiteral(iceberg.TimestampNano(v.Int64())), v.Kind() == parquet.Int64 && timeUnit(pt) == time.Nanosecond
+	case iceberg.StringType:
+		b := v.ByteArray()
+		return iceberg.StringLiteral(string(b)), v.Kind() == parquet.ByteArray && utf8.Valid(b)
+	case iceberg.BinaryType:
+		return iceberg.BinaryLiteral(bytes.Clone(v.ByteArray())), v.Kind() == parquet.ByteArray
+	}
+	return nil, false
+}
+
+func timeUnit(pt parquet.Type) time.Duration {
+	if pt == nil || pt.LogicalType() == nil {
+		return 0
+	}
+	if ts, ok := pt.LogicalType().Value.(*format.TimestampType); ok && ts.Unit.Value != nil {
+		return ts.Unit.Value.Duration()
+	}
+	return 0
+}
+
+// truncateBounds applies truncate(16) to string and binary bounds. A prefix is
+// still a lower bound; a shortened upper bound is not, so a value longer than
+// the limit keeps no upper bound (the reference implementation increments the
+// last character instead).
+func truncateBounds(lo, hi iceberg.Literal) (iceberg.Literal, iceberg.Literal, bool) {
+	switch l := lo.(type) {
+	case iceberg.StringLiteral:
+		if r := []rune(string(l)); len(r) > boundTruncateLength {
+			lo = iceberg.StringLiteral(string(r[:boundTruncateLength]))
+		}
+		return lo, hi, utf8.RuneCountInString(string(hi.(iceberg.StringLiteral))) <= boundTruncateLength
+	case iceberg.BinaryLiteral:
+		if len(l) > boundTruncateLength {
+			lo = l[:boundTruncateLength]
+		}
+		return lo, hi, len(hi.(iceberg.BinaryLiteral)) <= boundTruncateLength
+	}
+	return lo, hi, true
+}
diff --git a/weed/worker/tasks/iceberg/compact_stats_test.go b/weed/worker/tasks/iceberg/compact_stats_test.go
new file mode 100644
index 0000000000..b967564613
--- /dev/null
+++ b/weed/worker/tasks/iceberg/compact_stats_test.go
@@ -0,0 +1,148 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/parquet-go/parquet-go"
+
+	filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+// compactedDataFile returns the data file the current snapshot's data
+// manifest references after a compaction run.
+func compactedDataFile(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup) iceberg.DataFile {
+	t.Helper()
+	found := liveDataFiles(t, client, setup)
+	if len(found) != 1 {
+		t.Fatalf("expected 1 live data file after compaction, got %d", len(found))
+	}
+	return found[0]
+}
+
+func liveDataFiles(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup) []iceberg.DataFile {
+	t.Helper()
+	state, err := loadCurrentMetadata(context.Background(), client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("loadCurrentMetadata: %v", err)
+	}
+	manifests, err := loadCurrentManifests(context.Background(), client, setup.BucketName, state.DataPath, state.Metadata)
+	if err != nil {
+		t.Fatalf("loadCurrentManifests: %v", err)
+	}
+	var found []iceberg.DataFile
+	for _, mf := range manifests {
+		if mf.ManifestContent() != iceberg.ManifestContentData {
+			continue
+		}
+		manifestData, err := loadFileByIcebergPath(context.Background(), client, setup.BucketName, state.DataPath, mf.FilePath())
+		if err != nil {
+			t.Fatalf("load manifest: %v", err)
+		}
+		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+		if err != nil {
+			t.Fatalf("read manifest: %v", err)
+		}
+		for _, entry := range entries {
+			if entry.Status() != iceberg.EntryStatusDELETED {
+				found = append(found, entry.DataFile())
+			}
+		}
+	}
+	return found
+}
+
+func compactedFileBytes(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup, filePath string) []byte {
+	t.Helper()
+	state, err := loadCurrentMetadata(context.Background(), client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("loadCurrentMetadata: %v", err)
+	}
+	data, err := loadFileByIcebergPath(context.Background(), client, setup.BucketName, state.DataPath, filePath)
+	if err != nil {
+		t.Fatalf("load compacted file: %v", err)
+	}
+	return data
+}
+
+func compactedIDs(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup, filePath string) []int64 {
+	t.Helper()
+	data := compactedFileBytes(t, client, setup, filePath)
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatalf("open compacted file: %v", err)
+	}
+	var ids []int64
+	for _, rg := range f.RowGroups() {
+		rows := rg.Rows()
+		buf := make([]parquet.Row, 8)
+		for {
+			n, err := rows.ReadRows(buf)
+			for _, row := range buf[:n] {
+				ids = append(ids, row[0].Int64())
+			}
+			if err != nil {
+				break
+			}
+		}
+		rows.Close()
+	}
+	return ids
+}
+
+// A compacted file's manifest entry carries the column metrics readers
+// prune files by: counts, sizes, bounds and split offsets read back
+// from the file's own footer.
+func TestCompactDataFilesRecordsColumnStatistics(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	populateTableWithDeleteFiles(t, fs, setup,
+		[]struct {
+			Name string
+			Rows []struct {
+				ID   int64
+				Name string
+			}
+		}{
+			{"d1.parquet", []struct {
+				ID   int64
+				Name string
+			}{{1, "a"}, {2, "b"}}},
+			{"d2.parquet", []struct {
+				ID   int64
+				Name string
+			}{{3, "c"}}},
+		},
+		nil, nil,
+	)
+
+	handler := NewHandler(nil)
+	config := Config{TargetFileSizeBytes: 256 * 1024 * 1024, MinInputFiles: 2, MaxCommitRetries: 3}
+	if _, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil); err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+
+	df := compactedDataFile(t, client, setup)
+	if df.ValueCounts()[1] != 3 {
+		t.Errorf("value_counts[1] = %d, want 3", df.ValueCounts()[1])
+	}
+	if len(df.LowerBoundValues()) == 0 || len(df.UpperBoundValues()) == 0 {
+		t.Fatal("compacted file has no bounds")
+	}
+	lo, err := iceberg.LiteralFromBytes(iceberg.PrimitiveTypes.Int64, df.LowerBoundValues()[1])
+	if err != nil {
+		t.Fatalf("decode lower bound: %v", err)
+	}
+	hi, err := iceberg.LiteralFromBytes(iceberg.PrimitiveTypes.Int64, df.UpperBoundValues()[1])
+	if err != nil {
+		t.Fatalf("decode upper bound: %v", err)
+	}
+	if lo.(iceberg.Int64Literal) != 1 || hi.(iceberg.Int64Literal) != 3 {
+		t.Errorf("id bounds = %v..%v, want 1..3", lo, hi)
+	}
+	if len(df.SplitOffsets()) == 0 {
+		t.Error("compacted file has no split_offsets")
+	}
+}
diff --git a/weed/worker/tasks/iceberg/config.go b/weed/worker/tasks/iceberg/config.go
index 22efef049b..a2a5619ea9 100644
--- a/weed/worker/tasks/iceberg/config.go
+++ b/weed/worker/tasks/iceberg/config.go
@@ -2,8 +2,10 @@ package iceberg
 
 import (
 	"fmt"
+	"math"
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb/plugin_pb"
@@ -23,6 +25,9 @@ const (
 	defaultDeleteMaxGroupSizeMB   = 256
 	defaultDeleteMaxOutputFiles   = 8
 	defaultRewriteStrategy        = "binpack"
+	rewriteStrategyAuto           = "auto"
+	defaultSortBufferRows         = 262144
+	minSortBufferRows             = 1024
 	defaultMinManifestsToRewrite  = 5
 	minManifestsToRewrite         = 2
 	defaultOperations             = "all"
@@ -46,9 +51,67 @@ const (
 
 const bytesPerMB int64 = 1024 * 1024
 
+const msPerHour int64 = 3600 * 1000
+
+// maxOrphanOlderThanHours is the largest cutoff that still survives conversion
+// to a time.Duration. Beyond it the multiplication wraps negative, putting the
+// cutoff in the future and making every file look like an orphan.
+const maxOrphanOlderThanHours = int64(math.MaxInt64 / int64(time.Hour))
+
+// mbToBytes converts megabytes to bytes, saturating instead of overflowing.
+func mbToBytes(mb int64) int64 {
+	if mb <= 0 {
+		return 0
+	}
+	if mb > math.MaxInt64/bytesPerMB {
+		return math.MaxInt64
+	}
+	return mb * bytesPerMB
+}
+
+// addDays sums two day counts, saturating instead of overflowing. Negative
+// inputs are treated as unset.
+func addDays(a, b int64) int64 {
+	if a < 0 {
+		a = 0
+	}
+	if b < 0 {
+		b = 0
+	}
+	if a > math.MaxInt64-b {
+		return math.MaxInt64
+	}
+	return a + b
+}
+
+// daysToHours converts days to hours, saturating instead of overflowing.
+// applyThresholdDefaults clamps the result down to a usable cutoff.
+func daysToHours(days int64) int64 {
+	if days <= 0 {
+		return 0
+	}
+	if days > math.MaxInt64/24 {
+		return math.MaxInt64
+	}
+	return days * 24
+}
+
+// hoursToMs converts hours to milliseconds, saturating instead of overflowing.
+func hoursToMs(hours int64) int64 {
+	if hours <= 0 {
+		return 0
+	}
+	if hours > math.MaxInt64/msPerHour {
+		return math.MaxInt64
+	}
+	return hours * msPerHour
+}
+
 // Config holds parsed worker config values.
 type Config struct {
-	SnapshotRetentionHours      int64
+	// Milliseconds rather than hours so sub-hour retentions survive; the
+	// plugin config key stays in hours.
+	SnapshotRetentionMs         int64
 	MaxSnapshotsToKeep          int64
 	OrphanOlderThanHours        int64
 	MaxCommitRetries            int64
@@ -60,17 +123,24 @@ type Config struct {
 	DeleteMaxOutputFiles        int64
 	MinManifestsToRewrite       int64
 	Operations                  string
+	TablePropertiesOverride     bool
 	ApplyDeletes                bool
 	Where                       string
 	RewriteStrategy             string
 	SortMaxInputBytes           int64
+	SortBufferRows              int64
+	SortSpillDir                string
+	// Row groups of a compacted file, from the table's write.parquet.*
+	// properties; zero means the default.
+	RowGroupSizeBytes int64
+	RowGroupRowLimit  int64
 }
 
 // ParseConfig extracts an iceberg maintenance Config from plugin config values.
 // Values are clamped to safe minimums to prevent misconfiguration.
 func ParseConfig(values map[string]*plugin_pb.ConfigValue) Config {
 	cfg := Config{
-		SnapshotRetentionHours:      readInt64Config(values, "snapshot_retention_hours", defaultSnapshotRetentionHours),
+		SnapshotRetentionMs:         hoursToMs(readInt64Config(values, "snapshot_retention_hours", defaultSnapshotRetentionHours)),
 		MaxSnapshotsToKeep:          readInt64Config(values, "max_snapshots_to_keep", defaultMaxSnapshotsToKeep),
 		OrphanOlderThanHours:        readInt64Config(values, "orphan_older_than_hours", defaultOrphanOlderThanHours),
 		MaxCommitRetries:            readInt64Config(values, "max_commit_retries", defaultMaxCommitRetries),
@@ -82,15 +152,18 @@ func ParseConfig(values map[string]*plugin_pb.ConfigValue) Config {
 		DeleteMaxOutputFiles:        readInt64Config(values, "delete_max_output_files", defaultDeleteMaxOutputFiles),
 		MinManifestsToRewrite:       readInt64Config(values, "min_manifests_to_rewrite", defaultMinManifestsToRewrite),
 		Operations:                  readStringConfig(values, "operations", defaultOperations),
+		TablePropertiesOverride:     readBoolConfig(values, "table_properties_override", true),
 		ApplyDeletes:                readBoolConfig(values, "apply_deletes", true),
 		Where:                       strings.TrimSpace(readStringConfig(values, "where", "")),
 		RewriteStrategy:             strings.TrimSpace(strings.ToLower(readStringConfig(values, "rewrite_strategy", defaultRewriteStrategy))),
 		SortMaxInputBytes:           readSizeMBConfig(values, "sort_max_input_mb", 0),
+		SortBufferRows:              readInt64Config(values, "sort_buffer_rows", defaultSortBufferRows),
+		SortSpillDir:                strings.TrimSpace(readStringConfig(values, "sort_spill_dir", "")),
 	}
 
 	// Clamp the fields that are always defaulted by worker config parsing.
-	if cfg.SnapshotRetentionHours <= 0 {
-		cfg.SnapshotRetentionHours = defaultSnapshotRetentionHours
+	if cfg.SnapshotRetentionMs <= 0 {
+		cfg.SnapshotRetentionMs = hoursToMs(defaultSnapshotRetentionHours)
 	}
 	if cfg.MaxSnapshotsToKeep <= 0 {
 		cfg.MaxSnapshotsToKeep = defaultMaxSnapshotsToKeep
@@ -106,6 +179,9 @@ func applyThresholdDefaults(cfg Config) Config {
 	if cfg.OrphanOlderThanHours <= 0 {
 		cfg.OrphanOlderThanHours = defaultOrphanOlderThanHours
 	}
+	if cfg.OrphanOlderThanHours > maxOrphanOlderThanHours {
+		cfg.OrphanOlderThanHours = maxOrphanOlderThanHours
+	}
 	if cfg.TargetFileSizeBytes <= 0 {
 		cfg.TargetFileSizeBytes = defaultTargetFileSizeMB * 1024 * 1024
 	}
@@ -127,12 +203,17 @@ func applyThresholdDefaults(cfg Config) Config {
 	if cfg.RewriteStrategy == "" {
 		cfg.RewriteStrategy = defaultRewriteStrategy
 	}
-	if cfg.RewriteStrategy != "binpack" && cfg.RewriteStrategy != "sort" {
+	if cfg.RewriteStrategy != "binpack" && cfg.RewriteStrategy != "sort" && cfg.RewriteStrategy != rewriteStrategyAuto {
 		cfg.RewriteStrategy = defaultRewriteStrategy
 	}
 	if cfg.SortMaxInputBytes < 0 {
 		cfg.SortMaxInputBytes = 0
 	}
+	// A run smaller than this buys no memory back worth the extra runs, and
+	// the writer stops at 32K of them, so a tiny value would cap the output.
+	if cfg.SortBufferRows < minSortBufferRows {
+		cfg.SortBufferRows = defaultSortBufferRows
+	}
 	if cfg.MinManifestsToRewrite < minManifestsToRewrite {
 		cfg.MinManifestsToRewrite = minManifestsToRewrite
 	}
diff --git a/weed/worker/tasks/iceberg/delete_rewrite.go b/weed/worker/tasks/iceberg/delete_rewrite.go
index 5d8d9e9a27..3dd22ec14e 100644
--- a/weed/worker/tasks/iceberg/delete_rewrite.go
+++ b/weed/worker/tasks/iceberg/delete_rewrite.go
@@ -32,9 +32,14 @@ type deleteRewriteGroup struct {
 	TotalSize      int64
 }
 
+// positionDeleteRow is the Iceberg position-delete schema: the spec reserves
+// field ids 2147483546 (file_path) and 2147483545 (pos). file_path is
+// dictionary-encoded: PyArrow cannot decode parquet-go's default
+// DELTA_LENGTH_BYTE_ARRAY into the dictionary PyIceberg asks for, and the
+// column repeats one data file's path anyway.
 type positionDeleteRow struct {
-	FilePath string `parquet:"file_path"`
-	Pos      int64  `parquet:"pos"`
+	FilePath string `parquet:"file_path,dict,id(2147483546)"`
+	Pos      int64  `parquet:"pos,id(2147483545)"`
 }
 
 func hasEligibleDeleteRewrite(
@@ -46,7 +51,7 @@ func hasEligibleDeleteRewrite(
 	meta table.Metadata,
 	predicate *partitionPredicate,
 ) (bool, error) {
-	groups, _, err := collectDeleteRewriteGroups(ctx, filerClient, bucketName, dataPath, manifests)
+	groups, _, err := collectDeleteRewriteGroups(ctx, filerClient, bucketName, dataPath, manifests, specByID(meta), meta.CurrentSchema())
 	if err != nil {
 		return false, err
 	}
@@ -76,6 +81,8 @@ func collectDeleteRewriteGroups(
 	filerClient filer_pb.SeaweedFilerClient,
 	bucketName, dataPath string,
 	manifests []iceberg.ManifestFile,
+	specs map[int]iceberg.PartitionSpec,
+	schema *iceberg.Schema,
 ) (map[string]*deleteRewriteGroup, []iceberg.ManifestEntry, error) {
 	groups := make(map[string]*deleteRewriteGroup)
 	var allPositionEntries []iceberg.ManifestEntry
@@ -89,7 +96,7 @@ func collectDeleteRewriteGroups(
 		if err != nil {
 			return nil, nil, fmt.Errorf("read delete manifest %s: %w", mf.FilePath(), err)
 		}
-		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+		entries, err := s3tables.ReadManifest(mf, manifestData, true, specs, schema)
 		if err != nil {
 			return nil, nil, fmt.Errorf("parse delete manifest %s: %w", mf.FilePath(), err)
 		}
@@ -100,6 +107,9 @@ func collectDeleteRewriteGroups(
 			}
 
 			allPositionEntries = append(allPositionEntries, entry)
+			if entry.DataFile().FileFormat() == iceberg.PuffinFile {
+				continue
+			}
 
 			fileDeletes, err := readPositionDeleteFile(ctx, filerClient, bucketName, dataPath, entry.DataFile().FilePath())
 			if err != nil {
@@ -206,46 +216,35 @@ func writeManifestWithContent(
 	content iceberg.ManifestContent,
 ) (iceberg.ManifestFile, []byte, error) {
 	var manifestBuf bytes.Buffer
-	mf, err := iceberg.WriteManifest(filename, &manifestBuf, version, spec, schema, snapshotID, entries)
+	w, err := iceberg.NewManifestWriter(version, &manifestBuf, spec, schema, snapshotID,
+		iceberg.WithManifestWriterContent(content))
 	if err != nil {
 		return nil, nil, err
 	}
-
-	manifestBytes := manifestBuf.Bytes()
-	if content == iceberg.ManifestContentDeletes {
-		manifestBytes, err = patchManifestContentBytesToDeletes(manifestBytes)
-		if err != nil {
-			return nil, nil, err
+	for _, entry := range entries {
+		var addErr error
+		switch entry.Status() {
+		case iceberg.EntryStatusADDED:
+			addErr = w.Add(entry)
+		case iceberg.EntryStatusEXISTING:
+			addErr = w.Existing(entry)
+		case iceberg.EntryStatusDELETED:
+			addErr = w.Delete(entry)
+		default:
+			addErr = fmt.Errorf("unexpected manifest entry status: %v", entry.Status())
+		}
+		if addErr != nil {
+			return nil, nil, addErr
 		}
 	}
-
-	rebuilt := iceberg.NewManifestFile(version, filename, int64(len(manifestBytes)), int32(spec.ID()), snapshotID).
-		Content(content).
-		AddedFiles(mf.AddedDataFiles()).
-		ExistingFiles(mf.ExistingDataFiles()).
-		DeletedFiles(mf.DeletedDataFiles()).
-		AddedRows(mf.AddedRows()).
-		ExistingRows(mf.ExistingRows()).
-		DeletedRows(mf.DeletedRows()).
-		Partitions(mf.Partitions()).
-		Build()
-	return rebuilt, manifestBytes, nil
-}
-
-func patchManifestContentBytesToDeletes(manifestBytes []byte) ([]byte, error) {
-	old := append([]byte{0x0e}, []byte("content")...)
-	old = append(old, 0x08)
-	old = append(old, []byte("data")...)
-
-	new := append([]byte{0x0e}, []byte("content")...)
-	new = append(new, 0x0e)
-	new = append(new, []byte("deletes")...)
-
-	result := bytes.Replace(manifestBytes, old, new, 1)
-	if bytes.Equal(result, manifestBytes) {
-		return nil, fmt.Errorf("delete manifest content patch failed")
+	if err := w.Close(); err != nil {
+		return nil, nil, err
 	}
-	return result, nil
+	mf, err := w.ToManifestFile(filename, int64(manifestBuf.Len()))
+	if err != nil {
+		return nil, nil, err
+	}
+	return mf, manifestBuf.Bytes(), nil
 }
 
 func writePositionDeleteFile(rows []positionDeleteRow) ([]byte, error) {
@@ -262,6 +261,8 @@ func writePositionDeleteFile(rows []positionDeleteRow) ([]byte, error) {
 	return buf.Bytes(), nil
 }
 
+const skipDeleteRewriteV3 = "rewrite_position_delete_files skipped: position-delete files must not be added to a format-version 3 table"
+
 func (h *Handler) rewritePositionDeleteFiles(
 	ctx context.Context,
 	filerClient filer_pb.SeaweedFilerClient,
@@ -279,6 +280,13 @@ func (h *Handler) rewritePositionDeleteFiles(
 	if currentSnap == nil || currentSnap.ManifestList == "" {
 		return "no current snapshot", nil, nil
 	}
+	// The spec forbids adding position-delete files to a v3 table ("Position
+	// delete files must not be added to v3 tables"; v3 writes deletion
+	// vectors), and this rewrite adds new ones. Compaction still applies and
+	// removes existing position deletes.
+	if hasRowLineage(meta.Version()) {
+		return skipDeleteRewriteV3, nil, nil
+	}
 
 	manifestListData, err := loadFileByIcebergPath(ctx, filerClient, bucketName, dataPath, currentSnap.ManifestList)
 	if err != nil {
@@ -289,6 +297,9 @@ func (h *Handler) rewritePositionDeleteFiles(
 		return "", nil, fmt.Errorf("parse manifest list: %w", err)
 	}
 
+	specs := specByID(meta)
+	schema := meta.CurrentSchema()
+
 	var dataManifests []iceberg.ManifestFile
 	var allEqualityEntries []iceberg.ManifestEntry
 	for _, mf := range manifests {
@@ -300,7 +311,7 @@ func (h *Handler) rewritePositionDeleteFiles(
 			if readErr != nil {
 				return "", nil, fmt.Errorf("read delete manifest %s: %w", mf.FilePath(), readErr)
 			}
-			entries, parseErr := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+			entries, parseErr := s3tables.ReadManifest(mf, manifestData, true, specs, schema)
 			if parseErr != nil {
 				return "", nil, fmt.Errorf("parse delete manifest %s: %w", mf.FilePath(), parseErr)
 			}
@@ -312,7 +323,7 @@ func (h *Handler) rewritePositionDeleteFiles(
 		}
 	}
 
-	groupMap, allPositionEntries, err := collectDeleteRewriteGroups(ctx, filerClient, bucketName, dataPath, manifests)
+	groupMap, allPositionEntries, err := collectDeleteRewriteGroups(ctx, filerClient, bucketName, dataPath, manifests, specs, schema)
 	if err != nil {
 		return "", nil, err
 	}
@@ -542,8 +553,10 @@ func (h *Handler) rewritePositionDeleteFiles(
 		allManifests = append(allManifests, mf)
 	}
 
+	firstRowID := rowLineageFirstRowID(meta)
 	var manifestListBuf bytes.Buffer
-	if err := iceberg.WriteManifestList(version, &manifestListBuf, newSnapID, &snapshotID, &seqNum, 0, allManifests); err != nil {
+	addedRows, err := writeManifestList(version, &manifestListBuf, newSnapID, &snapshotID, &seqNum, firstRowID, allManifests)
+	if err != nil {
 		return "", nil, fmt.Errorf("write delete manifest list: %w", err)
 	}
 	manifestListName := fmt.Sprintf("snap-%d-%s.avro", newSnapID, artifactSuffix)
@@ -554,9 +567,9 @@ func (h *Handler) rewritePositionDeleteFiles(
 
 	manifestListLocation := absoluteIcebergPath(bucketName, dataPath, "metadata", manifestListName)
 	err = h.commitWithRetry(ctx, filerClient, bucketName, tablePath, state.MetadataFileName, config, func(currentMeta table.Metadata, builder *table.MetadataBuilder) error {
-		cs := currentMeta.CurrentSnapshot()
-		if cs == nil || cs.SnapshotID != snapshotID {
-			return errStalePlan
+		cs, err := checkCommitPlan(currentMeta, snapshotID, version, firstRowID)
+		if err != nil {
+			return err
 		}
 		newSnapshot := &table.Snapshot{
 			SnapshotID:       newSnapID,
@@ -575,6 +588,7 @@ func (h *Handler) rewritePositionDeleteFiles(
 				return &id
 			}(),
 		}
+		setRowLineage(newSnapshot, version, firstRowID, addedRows)
 		if err := builder.AddSnapshot(newSnapshot); err != nil {
 			return err
 		}
diff --git a/weed/worker/tasks/iceberg/delete_rewrite_schema_test.go b/weed/worker/tasks/iceberg/delete_rewrite_schema_test.go
new file mode 100644
index 0000000000..58863e8352
--- /dev/null
+++ b/weed/worker/tasks/iceberg/delete_rewrite_schema_test.go
@@ -0,0 +1,54 @@
+package iceberg
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/parquet-go/parquet-go"
+	"github.com/parquet-go/parquet-go/format"
+)
+
+// The position-delete file must carry the spec's field ids and a
+// dictionary-encoded file_path: PyIceberg reads delete files with
+// file_path as a dictionary column, which PyArrow cannot decode from
+// DELTA_LENGTH_BYTE_ARRAY, and by-id readers resolve columns by field id.
+func TestPositionDeleteFileHasFieldIDsAndDictionaryPaths(t *testing.T) {
+	rows := []positionDeleteRow{
+		{FilePath: "s3://tb/ns/tbl/data/a.parquet", Pos: 0},
+		{FilePath: "s3://tb/ns/tbl/data/a.parquet", Pos: 7},
+		{FilePath: "s3://tb/ns/tbl/data/b.parquet", Pos: 3},
+	}
+	data, err := writePositionDeleteFile(rows)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]int{"file_path": 2147483546, "pos": 2147483545}
+	for _, field := range f.Schema().Fields() {
+		if id, ok := want[field.Name()]; !ok || field.ID() != id {
+			t.Errorf("field %s id = %d, want %d", field.Name(), field.ID(), id)
+		}
+	}
+	for _, rg := range f.Metadata().RowGroups {
+		for _, col := range rg.Columns {
+			if col.MetaData.PathInSchema[0] != "file_path" {
+				continue
+			}
+			dict := false
+			for _, enc := range col.MetaData.Encoding {
+				if enc == format.DeltaLengthByteArray {
+					t.Errorf("file_path is DELTA_LENGTH_BYTE_ARRAY: %v", col.MetaData.Encoding)
+				}
+				if enc == format.RLEDictionary || enc == format.PlainDictionary {
+					dict = true
+				}
+			}
+			if !dict {
+				t.Errorf("file_path is not dictionary-encoded: %v", col.MetaData.Encoding)
+			}
+		}
+	}
+}
diff --git a/weed/worker/tasks/iceberg/deletion_vector_test.go b/weed/worker/tasks/iceberg/deletion_vector_test.go
new file mode 100644
index 0000000000..028bcaa8e1
--- /dev/null
+++ b/weed/worker/tasks/iceberg/deletion_vector_test.go
@@ -0,0 +1,375 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"path"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/parquet-go/parquet-go"
+
+	filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// A deletion-vector entry names its data file in referenced_data_file; the
+// match against candidates is on the normalized path either side takes.
+func TestDeletionVectorPathMatching(t *testing.T) {
+	spec := *iceberg.UnpartitionedSpec
+	snapID := int64(1)
+
+	newEntry := func(path, ref string) iceberg.ManifestEntry {
+		dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentPosDeletes, path,
+			iceberg.PuffinFile, map[int]any{}, nil, nil, 0, 8)
+		if err != nil {
+			t.Fatalf("build dv file: %v", err)
+		}
+		if ref != "" {
+			dfb.ReferencedDataFile(ref)
+		}
+		return iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build())
+	}
+
+	paths, err := deletionVectorPaths([]iceberg.ManifestEntry{
+		newEntry("metadata/dv.puffin", "s3://test-bucket/ns/tbl/data/f1.parquet"),
+	}, "test-bucket", "ns/tbl")
+	if err != nil {
+		t.Fatalf("deletionVectorPaths: %v", err)
+	}
+	if !paths["ns/tbl/data/f1.parquet"] {
+		t.Fatalf("dv paths = %v, want the normalized f1 path", paths)
+	}
+
+	dataEntry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+		mustDataFile(t, spec, "data/f1.parquet", 3))
+	otherEntry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+		mustDataFile(t, spec, "data/f2.parquet", 2))
+	kept, err := excludeDeletionVectorFiles([]iceberg.ManifestEntry{dataEntry, otherEntry}, paths, "test-bucket", "ns/tbl")
+	if err != nil {
+		t.Fatalf("excludeDeletionVectorFiles: %v", err)
+	}
+	if len(kept) != 1 || kept[0].DataFile().FilePath() != "data/f2.parquet" {
+		t.Fatalf("kept %d entries, want only f2", len(kept))
+	}
+}
+
+// A Puffin deletion vector is not a Parquet position-delete file: it must not
+// reach readPositionDeleteFile, and the data file it covers must stay
+// uncompacted until something applies the vector. Other files still merge and
+// ordinary Parquet position deletes still apply.
+func TestCompactDataFilesDeletionVector(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	ctx := context.Background()
+
+	setup := tableSetup{BucketName: "test-bucket", Namespace: "ns", TableName: "tbl"}
+	spec := *iceberg.UnpartitionedSpec
+	snapID := int64(1)
+
+	putDataFileRows(t, fs, "f1.parquet", []lineageDataRow{{1, "a"}, {2, "b"}})
+	putDataFileRows(t, fs, "f2.parquet", []lineageDataRow{{3, "c"}, {4, "d"}})
+	putDataFileRows(t, fs, "f3.parquet", []lineageDataRow{{5, "e"}})
+
+	dataEntries := []iceberg.ManifestEntry{
+		iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+			mustDataFile(t, spec, "data/f1.parquet", 2)),
+		iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+			mustDataFile(t, spec, "data/f2.parquet", 2)),
+		iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+			mustDataFile(t, spec, "data/f3.parquet", 1)),
+	}
+
+	// An ordinary Parquet position delete against f2's first row.
+	type posRow struct {
+		FilePath string `parquet:"file_path"`
+		Pos      int64  `parquet:"pos"`
+	}
+	var pdBuf bytes.Buffer
+	w := parquet.NewWriter(&pdBuf, parquet.SchemaOf(new(posRow)))
+	if err := w.Write(&posRow{"data/f2.parquet", 0}); err != nil {
+		t.Fatalf("write pos delete: %v", err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("close pos delete: %v", err)
+	}
+	dataDir := "/buckets/test-bucket/ns/tbl/data"
+	fs.putEntry(dataDir, "pd1.parquet", &filer_pb.Entry{Name: "pd1.parquet", Content: pdBuf.Bytes()})
+	// The vector itself is never opened, but the file should exist like a real
+	// engine's write would leave it.
+	fs.putEntry(dataDir, "dv.puffin", &filer_pb.Entry{Name: "dv.puffin", Content: []byte("puffin-bytes")})
+
+	posDF, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentPosDeletes,
+		setup.fileRef("data", "pd1.parquet"), iceberg.ParquetFile, map[int]any{}, nil, nil, 1, int64(pdBuf.Len()))
+	if err != nil {
+		t.Fatalf("build pos delete file: %v", err)
+	}
+	dvDF, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentPosDeletes,
+		setup.fileRef("data", "dv.puffin"), iceberg.PuffinFile, map[int]any{}, nil, nil, 0, 12)
+	if err != nil {
+		t.Fatalf("build dv file: %v", err)
+	}
+	dvDF.ReferencedDataFile("s3://test-bucket/ns/tbl/data/f1.parquet")
+	deleteEntries := []iceberg.ManifestEntry{
+		iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, posDF.Build()),
+		iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dvDF.Build()),
+	}
+
+	writeV3Table(t, fs, setup, dataEntries, deleteEntries, 0, 5)
+
+	handler := NewHandler(nil)
+	config := Config{
+		TargetFileSizeBytes: 4096,
+		MinInputFiles:       2,
+		ApplyDeletes:        true,
+	}
+	result, _, err := handler.compactDataFiles(ctx, client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "compacted 2 files into 1") {
+		t.Fatalf("unexpected result: %q", result)
+	}
+
+	state, err := loadCurrentMetadata(ctx, client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("loadCurrentMetadata: %v", err)
+	}
+	manifests, err := loadCurrentManifests(ctx, client, setup.BucketName, state.DataPath, state.Metadata)
+	if err != nil {
+		t.Fatalf("loadCurrentManifests: %v", err)
+	}
+
+	var dataMfs, deleteMfs []iceberg.ManifestFile
+	for _, mf := range manifests {
+		if mf.ManifestContent() == iceberg.ManifestContentData {
+			dataMfs = append(dataMfs, mf)
+		} else {
+			deleteMfs = append(deleteMfs, mf)
+		}
+	}
+	if len(deleteMfs) != 1 {
+		t.Fatalf("delete manifests carried = %d, want 1 (the vector still applies to f1)", len(deleteMfs))
+	}
+
+	var merged iceberg.DataFile
+	var f1Live bool
+	for _, mf := range dataMfs {
+		manifestData, err := loadFileByIcebergPath(ctx, client, setup.BucketName, state.DataPath, mf.FilePath())
+		if err != nil {
+			t.Fatalf("read manifest: %v", err)
+		}
+		entries, err := s3tables.ReadManifest(mf, manifestData, false, specByID(state.Metadata), state.Metadata.CurrentSchema())
+		if err != nil {
+			t.Fatalf("parse manifest: %v", err)
+		}
+		for _, e := range entries {
+			df := e.DataFile()
+			switch {
+			case e.Status() == iceberg.EntryStatusADDED:
+				merged = df
+			case e.Status() == iceberg.EntryStatusEXISTING && df.FilePath() == "data/f1.parquet":
+				f1Live = true
+			}
+		}
+	}
+	if !f1Live {
+		t.Fatal("f1 is covered by a deletion vector and must stay live")
+	}
+	if merged == nil {
+		t.Fatal("no merged file added")
+	}
+
+	mergedData, err := loadFileByIcebergPath(ctx, client, setup.BucketName, state.DataPath, merged.FilePath())
+	if err != nil {
+		t.Fatalf("read merged file: %v", err)
+	}
+	ids, _, rowIDs, _ := mergedColumns(t, mergedData)
+	if len(ids) != 2 || ids[0] != int64(4) || ids[1] != int64(5) {
+		t.Fatalf("merged ids = %v, want [4 5] (f2 minus its deleted row, f3)", ids)
+	}
+	if rowIDs[0] != int64(3) || rowIDs[1] != int64(4) {
+		t.Fatalf("merged _row_id = %v, want [3 4]", rowIDs)
+	}
+}
+
+// Detection applies the same exclusion compaction does: a table whose only
+// binable files are all covered by deletion vectors is not a candidate, while
+// unaffected files still qualify.
+func TestDetectSchedulesDeletionVector(t *testing.T) {
+	spec := *iceberg.UnpartitionedSpec
+	snapID := int64(1)
+
+	dataEntry := func(name string, count int64) iceberg.ManifestEntry {
+		return iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+			mustDataFile(t, spec, name, count))
+	}
+	dvEntry := func(t *testing.T, ref string) iceberg.ManifestEntry {
+		dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentPosDeletes,
+			"data/dv.puffin", iceberg.PuffinFile, map[int]any{}, nil, nil, 0, 12)
+		if err != nil {
+			t.Fatalf("build dv file: %v", err)
+		}
+		dfb.ReferencedDataFile(ref)
+		return iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build())
+	}
+
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(24 * 365),
+		MaxSnapshotsToKeep:  10,
+		TargetFileSizeBytes: 4096,
+		MinInputFiles:       2,
+		Operations:          "compact",
+		ApplyDeletes:        true,
+	}
+
+	t.Run("unaffected files stay eligible", func(t *testing.T) {
+		fs, client := startFakeFiler(t)
+		setup := tableSetup{BucketName: "test-bucket", Namespace: "ns", TableName: "tbl"}
+		writeV3Table(t, fs, setup,
+			[]iceberg.ManifestEntry{dataEntry("data/f1.parquet", 1), dataEntry("data/f2.parquet", 1), dataEntry("data/f3.parquet", 1)},
+			[]iceberg.ManifestEntry{dvEntry(t, "data/f1.parquet")},
+			0, 3)
+
+		tables, err := NewHandler(nil).scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
+		if err != nil {
+			t.Fatalf("scanTablesForMaintenance: %v", err)
+		}
+		if len(tables) != 1 {
+			t.Fatalf("expected 1 compaction candidate (f2+f3 still binable), got %d", len(tables))
+		}
+	})
+
+	t.Run("all binable files covered", func(t *testing.T) {
+		fs, client := startFakeFiler(t)
+		setup := tableSetup{BucketName: "test-bucket", Namespace: "ns", TableName: "tbl"}
+		writeV3Table(t, fs, setup,
+			[]iceberg.ManifestEntry{dataEntry("data/f1.parquet", 1), dataEntry("data/f2.parquet", 1)},
+			[]iceberg.ManifestEntry{dvEntry(t, "data/f1.parquet")},
+			0, 2)
+
+		tables, err := NewHandler(nil).scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
+		if err != nil {
+			t.Fatalf("scanTablesForMaintenance: %v", err)
+		}
+		if len(tables) != 0 {
+			t.Fatalf("expected no candidates (only the covered f1 and the lone f2 remain), got %d", len(tables))
+		}
+	})
+}
+
+// writeV3Table stores a format-version-3 table in the fake filer: a data
+// manifest whose entries carry no first_row_id (so readers exercise manifest
+// first_row_id inheritance), an optional delete manifest, and the manifest
+// list + snapshot that commit them at sequence number 1.
+func writeV3Table(t *testing.T, fs *fakeFilerServer, setup tableSetup,
+	dataManifestEntries, deleteManifestEntries []iceberg.ManifestEntry,
+	listFirstRowID, addedRows int64) table.Metadata {
+	t.Helper()
+
+	schema := newTestSchema()
+	spec := *iceberg.UnpartitionedSpec
+	location := "s3://" + setup.BucketName + "/" + setup.dataPath()
+
+	base, err := table.NewMetadata(schema, &spec, table.UnsortedSortOrder, location, nil)
+	if err != nil {
+		t.Fatalf("new metadata: %v", err)
+	}
+	builder, err := table.MetadataBuilderFromBase(base, location)
+	if err != nil {
+		t.Fatalf("metadata builder: %v", err)
+	}
+	if err := builder.SetFormatVersion(3); err != nil {
+		t.Fatalf("set format version: %v", err)
+	}
+	if _, err := builder.Build(); err != nil {
+		t.Fatalf("build v3 metadata: %v", err)
+	}
+
+	snapID := int64(1)
+	var manifestBuf bytes.Buffer
+	dataMf, err := iceberg.WriteManifest(setup.fileRef("metadata", "m0.avro"), &manifestBuf, 3, spec, schema, snapID, dataManifestEntries)
+	if err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.dataPath(), "metadata")
+	fs.putEntry(metaDir, "m0.avro", &filer_pb.Entry{
+		Name:    "m0.avro",
+		Content: manifestBuf.Bytes(),
+	})
+
+	manifests := []iceberg.ManifestFile{dataMf}
+	if len(deleteManifestEntries) > 0 {
+		delMf, delBytes := writeDeleteManifestForTest(
+			t, setup.fileRef("metadata", "del.avro"), 3, spec, schema, snapID, deleteManifestEntries)
+		fs.putEntry(metaDir, "del.avro", &filer_pb.Entry{
+			Name:    "del.avro",
+			Content: delBytes,
+		})
+		manifests = append(manifests, delMf)
+	}
+
+	var listBuf bytes.Buffer
+	seqNum := int64(1)
+	if err := iceberg.WriteManifestList(3, &listBuf, snapID, nil, &seqNum, listFirstRowID, manifests); err != nil {
+		t.Fatalf("write manifest list: %v", err)
+	}
+	fs.putEntry(metaDir, "snap-1.avro", &filer_pb.Entry{
+		Name:    "snap-1.avro",
+		Content: listBuf.Bytes(),
+	})
+
+	snap := table.Snapshot{
+		SnapshotID:     snapID,
+		SequenceNumber: seqNum,
+		TimestampMs:    time.Now().UnixMilli(),
+		ManifestList:   setup.fileRef("metadata", "snap-1.avro"),
+		FirstRowID:     ptrInt64(listFirstRowID),
+		AddedRows:      &addedRows,
+	}
+	if err := builder.AddSnapshot(&snap); err != nil {
+		t.Fatalf("add snapshot: %v", err)
+	}
+	if err := builder.SetSnapshotRef(table.MainBranch, snapID, table.BranchRef); err != nil {
+		t.Fatalf("set snapshot ref: %v", err)
+	}
+	meta, err := builder.Build()
+	if err != nil {
+		t.Fatalf("build metadata with snapshot: %v", err)
+	}
+
+	fullMetadataJSON, err := json.Marshal(meta)
+	if err != nil {
+		t.Fatalf("marshal metadata: %v", err)
+	}
+	internalMeta := map[string]interface{}{
+		"metadataVersion":  1,
+		"metadataLocation": setup.fileRef("metadata", "v1.metadata.json"),
+		"metadata":         map[string]interface{}{"fullMetadata": json.RawMessage(fullMetadataJSON)},
+	}
+	xattr, err := json.Marshal(internalMeta)
+	if err != nil {
+		t.Fatalf("marshal xattr: %v", err)
+	}
+	bucketPath := path.Join(s3tables.TablesPath, setup.BucketName)
+	fs.putEntry(s3tables.TablesPath, setup.BucketName, &filer_pb.Entry{
+		Name:        setup.BucketName,
+		IsDirectory: true,
+		Extended:    map[string][]byte{s3tables.ExtendedKeyTableBucket: []byte("true")},
+	})
+	fs.putEntry(bucketPath, setup.Namespace, &filer_pb.Entry{Name: setup.Namespace, IsDirectory: true})
+	fs.putEntry(path.Join(bucketPath, setup.Namespace), setup.TableName, &filer_pb.Entry{
+		Name:        setup.TableName,
+		IsDirectory: true,
+		Extended: map[string][]byte{
+			s3tables.ExtendedKeyMetadata:        xattr,
+			s3tables.ExtendedKeyMetadataVersion: metadataVersionXattr(1),
+		},
+	})
+	return meta
+}
+
+func ptrInt64(v int64) *int64 { return &v }
diff --git a/weed/worker/tasks/iceberg/detection.go b/weed/worker/tasks/iceberg/detection.go
index c06d36156d..74288613e5 100644
--- a/weed/worker/tasks/iceberg/detection.go
+++ b/weed/worker/tasks/iceberg/detection.go
@@ -1,8 +1,8 @@
 package iceberg
 
 import (
-	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"path"
 	"strings"
@@ -69,6 +69,11 @@ func (h *Handler) scanTablesForMaintenance(
 		if !wildcard.MatchesAnyWildcard(bucketMatchers, bucketName) {
 			continue
 		}
+		bucketMaintenance, err := parseMaintenanceConfiguration(bucketEntry.Extended, bucketName)
+		if err != nil {
+			glog.Warningf("iceberg maintenance: skipping bucket %s: %v", bucketName, err)
+			continue
+		}
 
 		// List namespaces within the bucket
 		bucketPath := path.Join(bucketsPath, bucketName)
@@ -123,11 +128,31 @@ func (h *Handler) scanTablesForMaintenance(
 				tablePath := path.Join(nsName, tblName)
 				state, err := parseTableMetadataEnvelope(metadataBytes, bucketName, tablePath)
 				if err != nil {
-					glog.V(2).Infof("iceberg maintenance: skipping %s/%s/%s: cannot parse iceberg metadata: %v", bucketName, nsName, tblName, err)
+					if errors.Is(err, errForeignFormat) {
+						glog.V(3).Infof("iceberg maintenance: skipping %s/%s/%s: %v", bucketName, nsName, tblName, err)
+					} else {
+						glog.V(2).Infof("iceberg maintenance: skipping %s/%s/%s: cannot parse iceberg metadata: %v", bucketName, nsName, tblName, err)
+					}
+					continue
+				}
+				if !isIcebergTableEntry(tableEntry.Extended, state.Metadata) {
+					glog.V(2).Infof("iceberg maintenance: skipping %s/%s/%s: not an iceberg table", bucketName, nsName, tblName)
 					continue
 				}
 
-				needsWork, err := h.tableNeedsMaintenance(ctx, filerClient, bucketName, tablePath, state, config, ops)
+				tableMaintenance, err := parseMaintenanceConfiguration(tableEntry.Extended, path.Join(bucketName, tablePath))
+				if err != nil {
+					glog.Warningf("iceberg maintenance: skipping %s/%s/%s: %v", bucketName, nsName, tblName, err)
+					continue
+				}
+				maintenance := mergeMaintenanceConfiguration(bucketMaintenance, tableMaintenance)
+				tableOps := filterDisabledOperations(ops, maintenance)
+				if len(tableOps) == 0 {
+					continue
+				}
+				effective := resolveTableConfig(config, state.Metadata.Properties(), maintenance)
+
+				needsWork, err := h.tableNeedsMaintenance(ctx, filerClient, bucketName, tablePath, state, effective, tableOps)
 				if err != nil {
 					glog.V(2).Infof("iceberg maintenance: skipping %s/%s/%s: cannot evaluate maintenance need: %v", bucketName, nsName, tblName, err)
 					continue
@@ -154,8 +179,8 @@ func (h *Handler) scanTablesForMaintenance(
 
 func normalizeDetectionConfig(config Config) Config {
 	config = applyThresholdDefaults(config)
-	if config.SnapshotRetentionHours <= 0 {
-		config.SnapshotRetentionHours = defaultSnapshotRetentionHours
+	if config.SnapshotRetentionMs <= 0 {
+		config.SnapshotRetentionMs = hoursToMs(defaultSnapshotRetentionHours)
 	}
 	if config.MaxSnapshotsToKeep <= 0 {
 		config.MaxSnapshotsToKeep = defaultMaxSnapshotsToKeep
@@ -283,6 +308,9 @@ func (h *Handler) tableNeedsMaintenance(
 				return true, nil
 			}
 		case "rewrite_position_delete_files":
+			if hasRowLineage(meta.Version()) {
+				continue // the rewrite would add position-delete files, which a v3 table must not get (skipDeleteRewriteV3)
+			}
 			manifests, err := getCurrentManifests()
 			if err != nil {
 				opEvalErrors = append(opEvalErrors, fmt.Sprintf("%s: %v", op, err))
@@ -412,24 +440,52 @@ func hasEligibleCompaction(
 		return false, nil
 	}
 
+	specsByID := specByID(meta)
+	schema := meta.CurrentSchema()
+
 	var allEntries []iceberg.ManifestEntry
+	var dvPaths map[string]bool
 	for _, mf := range dataManifests {
 		manifestData, err := loadFileByIcebergPath(ctx, filerClient, bucketName, dataPath, mf.FilePath())
 		if err != nil {
 			return false, fmt.Errorf("read manifest %s: %w", mf.FilePath(), err)
 		}
-		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+		entries, err := s3tables.ReadManifest(mf, manifestData, true, specsByID, schema)
 		if err != nil {
 			return false, fmt.Errorf("parse manifest %s: %w", mf.FilePath(), err)
 		}
 		allEntries = append(allEntries, entries...)
 	}
 
-	candidateEntries := allEntries
+	// Deletion vectors exist only from format version 3.
+	if hasRowLineage(meta.Version()) {
+		var deleteEntries []iceberg.ManifestEntry
+		for _, mf := range manifests {
+			if mf.ManifestContent() != iceberg.ManifestContentDeletes {
+				continue
+			}
+			manifestData, err := loadFileByIcebergPath(ctx, filerClient, bucketName, dataPath, mf.FilePath())
+			if err != nil {
+				return false, fmt.Errorf("read delete manifest %s: %w", mf.FilePath(), err)
+			}
+			entries, err := s3tables.ReadManifest(mf, manifestData, true, specsByID, schema)
+			if err != nil {
+				return false, fmt.Errorf("parse delete manifest %s: %w", mf.FilePath(), err)
+			}
+			deleteEntries = append(deleteEntries, entries...)
+		}
+		if dvPaths, err = deletionVectorPaths(deleteEntries, bucketName, dataPath); err != nil {
+			return false, err
+		}
+	}
+
+	candidateEntries, err := excludeDeletionVectorFiles(allEntries, dvPaths, bucketName, dataPath)
+	if err != nil {
+		return false, err
+	}
 	if predicate != nil {
-		specsByID := specByID(meta)
-		candidateEntries = make([]iceberg.ManifestEntry, 0, len(allEntries))
-		for _, entry := range allEntries {
+		filtered := make([]iceberg.ManifestEntry, 0, len(candidateEntries))
+		for _, entry := range candidateEntries {
 			spec, ok := specsByID[int(entry.DataFile().SpecID())]
 			if !ok {
 				continue
@@ -439,9 +495,10 @@ func hasEligibleCompaction(
 				return false, err
 			}
 			if match {
-				candidateEntries = append(candidateEntries, entry)
+				filtered = append(filtered, entry)
 			}
 		}
+		candidateEntries = filtered
 	}
 
 	rewritePlan, err := resolveCompactionRewritePlan(config, meta)
@@ -450,7 +507,7 @@ func hasEligibleCompaction(
 	}
 
 	targetSize := compactionTargetSizeForPlan(config, rewritePlan)
-	bins := buildCompactionBins(candidateEntries, targetSize, minInputFiles)
+	bins := buildCompactionBins(candidateEntries, targetSize, minInputFiles, meta)
 	bins = filterCompactionBinsByPlan(bins, config, rewritePlan)
 	return len(bins) > 0, nil
 }
@@ -469,27 +526,12 @@ func compactionMinInputFiles(minInputFiles int64) (int, error) {
 
 // needsMaintenance checks whether snapshot expiration work is needed based on
 // metadata-only thresholds.
+// It asks execution what it would do rather than reimplementing the rules:
+// expiry always requires a snapshot to be past the retention window, so a
+// table over the snapshot quota whose snapshots are all young, or all pinned by
+// refs, would otherwise be proposed for a job that can only no-op.
 func needsMaintenance(meta table.Metadata, config Config) bool {
-	snapshots := meta.Snapshots()
-	if len(snapshots) == 0 {
-		return false
-	}
-
-	// Check snapshot count
-	if int64(len(snapshots)) > config.MaxSnapshotsToKeep {
-		return true
-	}
-
-	// Check oldest snapshot age
-	retentionMs := config.SnapshotRetentionHours * 3600 * 1000
-	nowMs := time.Now().UnixMilli()
-	for _, snap := range snapshots {
-		if nowMs-snap.TimestampMs > retentionMs {
-			return true
-		}
-	}
-
-	return false
+	return len(snapshotsToExpire(meta, config, time.Now().UnixMilli())) > 0
 }
 
 // buildMaintenanceProposal creates a JobProposal for a table needing maintenance.
diff --git a/weed/worker/tasks/iceberg/exec_test.go b/weed/worker/tasks/iceberg/exec_test.go
index dbe4994b72..172e896a1e 100644
--- a/weed/worker/tasks/iceberg/exec_test.go
+++ b/weed/worker/tasks/iceberg/exec_test.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -40,6 +41,7 @@ type fakeFilerServer struct {
 	mu           sync.Mutex
 	entries      map[string]map[string]*filer_pb.Entry // dir → name → entry
 	beforeUpdate func(*fakeFilerServer, *filer_pb.UpdateEntryRequest) error
+	beforeLookup func(*fakeFilerServer, *filer_pb.LookupDirectoryEntryRequest)
 
 	// Set by enableAssign to serve AssignVolume against a fake volume server.
 	assignVolumeServer string
@@ -93,6 +95,13 @@ func (f *fakeFilerServer) listDir(dir string) []*filer_pb.Entry {
 }
 
 func (f *fakeFilerServer) LookupDirectoryEntry(_ context.Context, req *filer_pb.LookupDirectoryEntryRequest) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	f.mu.Lock()
+	beforeLookup := f.beforeLookup
+	f.mu.Unlock()
+	if beforeLookup != nil {
+		beforeLookup(f, req)
+	}
+
 	entry := f.getEntry(req.Directory, req.Name)
 	if entry == nil {
 		return nil, status.Errorf(codes.NotFound, "entry not found: %s/%s", req.Directory, req.Name)
@@ -287,6 +296,16 @@ type tableSetup struct {
 	// that created it would record the table's running totals.
 	SnapshotSummary map[string]string
 	Snapshots       []table.Snapshot
+	// Refs are branches and tags beyond main, which always points at the last
+	// snapshot.
+	Refs map[string]table.SnapshotRef
+	// Age backdates the whole table so its snapshots can sit outside a
+	// retention window.
+	Age time.Duration
+	// Schema and Spec describe the table when the default unpartitioned test
+	// table does not fit.
+	Schema *iceberg.Schema
+	Spec   *iceberg.PartitionSpec
 }
 
 func (ts tableSetup) tablePath() string {
@@ -314,7 +333,7 @@ func (ts tableSetup) fileRef(elem ...string) string {
 func populateTable(t *testing.T, fs *fakeFilerServer, setup tableSetup) table.Metadata {
 	t.Helper()
 
-	meta := buildTestMetadata(t, setup.Snapshots)
+	meta := buildTestMetadata(t, setup.Snapshots, setup.Refs, setup.Age, nil, setup.Schema, setup.Spec)
 	fullMetadataJSON, err := json.Marshal(meta)
 	if err != nil {
 		t.Fatalf("marshal metadata: %v", err)
@@ -557,10 +576,10 @@ func TestExpireSnapshotsExecution(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 0, // expire everything eligible
-		MaxSnapshotsToKeep:     1, // keep only 1
-		MaxCommitRetries:       3,
-		Operations:             "expire_snapshots",
+		SnapshotRetentionMs: hoursToMs(0), // expire everything eligible
+		MaxSnapshotsToKeep:  1,            // keep only 1
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
 	}
 
 	result, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
@@ -582,6 +601,244 @@ func TestExpireSnapshotsExecution(t *testing.T) {
 	}
 }
 
+func TestExpireSnapshotsKeepsTaggedSnapshot(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now().Add(-10 * time.Second).UnixMilli()
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "analytics",
+		TableName:  "events",
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
+			{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
+			{SnapshotID: 3, TimestampMs: now + 2, ManifestList: "metadata/snap-3.avro"},
+		},
+		Refs: map[string]table.SnapshotRef{
+			"release": {SnapshotID: 1, SnapshotRefType: table.TagRef},
+		},
+	}
+	populateTable(t, fs, setup)
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
+	}
+
+	if _, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config); err != nil {
+		t.Fatalf("expireSnapshots failed: %v", err)
+	}
+
+	state, err := loadCurrentMetadata(context.Background(), client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("reload metadata: %v", err)
+	}
+
+	remaining := map[int64]bool{}
+	for _, snap := range state.Metadata.Snapshots() {
+		remaining[snap.SnapshotID] = true
+	}
+	if !remaining[1] {
+		t.Error("tagged snapshot 1 was expired")
+	}
+	if remaining[2] {
+		t.Error("expected untagged snapshot 2 to be expired")
+	}
+
+	var tagged bool
+	for name, ref := range state.Metadata.Refs() {
+		if name == "release" {
+			tagged = true
+			if ref.SnapshotID != 1 {
+				t.Errorf("tag release points at snapshot %d, want 1", ref.SnapshotID)
+			}
+		}
+	}
+	if !tagged {
+		t.Error("tag release was dropped from the metadata")
+	}
+
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.dataPath(), "metadata")
+	if fs.getEntry(metaDir, "snap-1.avro") == nil {
+		t.Error("manifest list of the tagged snapshot was deleted")
+	}
+	if fs.getEntry(metaDir, "snap-2.avro") != nil {
+		t.Error("expected the expired snapshot's manifest list to be deleted")
+	}
+}
+
+func TestExpireSnapshotsHonorsBranchRetention(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	// The branch chain is 1 <- 2 <- 3, with main on 4. Backdating the table by
+	// Age gives every snapshot a real age; the ten-second spacing keeps them
+	// distinct and stays inside what iceberg-go accepts at build time.
+	now := time.Now().Add(-30 * time.Second).UnixMilli()
+	stepMs := int64(10 * time.Second / time.Millisecond)
+	first, second := int64(1), int64(2)
+	minKeep := 2
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "analytics",
+		TableName:  "events",
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro", SequenceNumber: 1},
+			{SnapshotID: 2, TimestampMs: now + stepMs, ManifestList: "metadata/snap-2.avro", ParentSnapshotID: &first, SequenceNumber: 2},
+			{SnapshotID: 3, TimestampMs: now + 2*stepMs, ManifestList: "metadata/snap-3.avro", ParentSnapshotID: &second, SequenceNumber: 3},
+			{SnapshotID: 4, TimestampMs: now + 3*stepMs, ManifestList: "metadata/snap-4.avro", SequenceNumber: 4},
+		},
+		Refs: map[string]table.SnapshotRef{
+			"audit": {SnapshotID: 3, SnapshotRefType: table.BranchRef, MinSnapshotsToKeep: &minKeep},
+		},
+		Age: 5 * time.Hour,
+	}
+	populateTable(t, fs, setup)
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
+	}
+
+	if _, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config); err != nil {
+		t.Fatalf("expireSnapshots failed: %v", err)
+	}
+
+	// min-snapshots-to-keep=2 reaches from the branch head back to its parent,
+	// and stops there: the grandparent is past the count and expires.
+	assertSnapshots(t, client, setup, []int64{2, 3, 4}, []int64{1})
+}
+
+func TestExpireSnapshotsHonorsBranchMaxSnapshotAge(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now().Add(-30 * time.Second).UnixMilli()
+	stepMs := int64(10 * time.Second / time.Millisecond)
+	first, second := int64(1), int64(2)
+	// Between the branch head's parent (5h20s) and its grandparent (5h30s), so
+	// the window has to reach past the head to be observable.
+	maxAgeMs := int64(5*time.Hour/time.Millisecond) + 25*1000
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "analytics",
+		TableName:  "events",
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro", SequenceNumber: 1},
+			{SnapshotID: 2, TimestampMs: now + stepMs, ManifestList: "metadata/snap-2.avro", ParentSnapshotID: &first, SequenceNumber: 2},
+			{SnapshotID: 3, TimestampMs: now + 2*stepMs, ManifestList: "metadata/snap-3.avro", ParentSnapshotID: &second, SequenceNumber: 3},
+			{SnapshotID: 4, TimestampMs: now + 3*stepMs, ManifestList: "metadata/snap-4.avro", SequenceNumber: 4},
+		},
+		Refs: map[string]table.SnapshotRef{
+			"audit": {SnapshotID: 3, SnapshotRefType: table.BranchRef, MaxSnapshotAgeMs: &maxAgeMs},
+		},
+		Age: 5 * time.Hour,
+	}
+	populateTable(t, fs, setup)
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
+	}
+
+	if _, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config); err != nil {
+		t.Fatalf("expireSnapshots failed: %v", err)
+	}
+
+	// The window reaches from the branch head back over its parent but stops
+	// short of the grandparent.
+	assertSnapshots(t, client, setup, []int64{2, 3, 4}, []int64{1})
+}
+
+// assertSnapshots reloads the table and checks exactly which snapshots survived.
+func assertSnapshots(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup, want, gone []int64) {
+	t.Helper()
+
+	state, err := loadCurrentMetadata(context.Background(), client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("reload metadata: %v", err)
+	}
+	remaining := map[int64]bool{}
+	for _, snap := range state.Metadata.Snapshots() {
+		remaining[snap.SnapshotID] = true
+	}
+	for _, id := range want {
+		if !remaining[id] {
+			t.Errorf("snapshot %d was expired, want kept", id)
+		}
+	}
+	for _, id := range gone {
+		if remaining[id] {
+			t.Errorf("snapshot %d survived, want expired", id)
+		}
+	}
+}
+
+// A tag created between planning and commit pins a snapshot the plan was going
+// to expire. The head has not moved, so only a refs check can catch it.
+func TestExpireSnapshotsRejectsPlanWhenARefAppears(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now().Add(-30 * time.Second).UnixMilli()
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "analytics",
+		TableName:  "events",
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
+			{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
+			{SnapshotID: 3, TimestampMs: now + 2, ManifestList: "metadata/snap-3.avro"},
+		},
+		Age: 200 * time.Hour,
+	}
+	populateTable(t, fs, setup)
+
+	// Re-publish the table with a tag on snapshot 1 while the commit is
+	// re-reading it, which is the window the guard closes.
+	tagged := setup
+	tagged.Refs = map[string]table.SnapshotRef{
+		"release": {SnapshotID: 1, SnapshotRefType: table.TagRef},
+	}
+	lookups := 0
+	fs.beforeLookup = func(f *fakeFilerServer, req *filer_pb.LookupDirectoryEntryRequest) {
+		if req.Name != setup.TableName {
+			return
+		}
+		lookups++
+		if lookups == 2 {
+			populateTable(t, f, tagged)
+		}
+	}
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    1,
+		Operations:          "expire_snapshots",
+	}
+
+	_, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
+	if err == nil {
+		t.Fatal("expireSnapshots() error = nil, want the plan rejected as stale")
+	}
+	if !errors.Is(err, errStalePlan) {
+		t.Fatalf("expireSnapshots() error = %v, want errStalePlan", err)
+	}
+
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.dataPath(), "metadata")
+	if fs.getEntry(metaDir, "snap-1.avro") == nil {
+		t.Error("the newly tagged snapshot's manifest list was deleted")
+	}
+}
+
 func TestExpireSnapshotsNothingToExpire(t *testing.T) {
 	fs, client := startFakeFiler(t)
 
@@ -598,9 +855,9 @@ func TestExpireSnapshotsNothingToExpire(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 24 * 365, // very long retention
-		MaxSnapshotsToKeep:     10,
-		MaxCommitRetries:       3,
+		SnapshotRetentionMs: hoursToMs(24 * 365), // very long retention
+		MaxSnapshotsToKeep:  10,
+		MaxCommitRetries:    3,
 	}
 
 	result, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
@@ -639,10 +896,10 @@ func TestMaintenanceOnExternalTableLocation(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 0,
-		MaxSnapshotsToKeep:     1,
-		MaxCommitRetries:       3,
-		Operations:             "expire_snapshots",
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
 	}
 
 	result, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
@@ -871,9 +1128,10 @@ func TestRemoveOrphansPreservesReferencedFiles(t *testing.T) {
 	}
 }
 
-// DuckDB writes manifest lists carrying no Iceberg header metadata, which
-// iceberg-go reads as v1 and then rejects every v2 manifest listed in them,
-// failing all three maintenance operations before they touch anything.
+// DuckDB writes manifest lists carrying no Iceberg header metadata. iceberg-go
+// now infers the format version from the embedded writer schema, so a stripped
+// v2 list is read as v2 and maintenance operations proceed normally. This used
+// to fail because iceberg-go fell back to v1 and rejected every v2 manifest.
 func TestMaintenanceOnManifestListWithoutFormatVersion(t *testing.T) {
 	fs, client := startFakeFiler(t)
 
@@ -929,14 +1187,14 @@ func dropManifestListFormatVersion(t *testing.T, fs *fakeFilerServer, dir, name
 		Content:    patched,
 	})
 
-	// Confirm the fixture reproduces the report: with the entry gone,
-	// iceberg-go alone falls back to v1 and mislabels the v2 manifests.
+	// Confirm the fixture: with the entry gone, iceberg-go infers v2 from
+	// the embedded writer schema (content / sequence_number are v2 fields).
 	manifests, err := iceberg.ReadManifestList(bytes.NewReader(patched))
 	if err != nil {
 		t.Fatalf("read patched manifest list: %v", err)
 	}
-	if got := manifests[0].Version(); got != 1 {
-		t.Fatalf("patched manifest list still reports v%d", got)
+	if got := manifests[0].Version(); got != 2 {
+		t.Fatalf("patched manifest list reports v%d, want v2", got)
 	}
 }
 
@@ -1239,15 +1497,16 @@ func TestDetectWithFakeFiler(t *testing.T) {
 			{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
 			{SnapshotID: 3, TimestampMs: now + 2, ManifestList: "metadata/snap-3.avro"},
 		},
+		Age: 200 * time.Hour, // past the default 7-day retention
 	}
 	populateTable(t, fs, setup)
 
 	handler := NewHandler(nil)
 
 	config := Config{
-		SnapshotRetentionHours: 0, // everything is expired
-		MaxSnapshotsToKeep:     2, // 3 > 2, needs maintenance
-		MaxCommitRetries:       3,
+		SnapshotRetentionMs: hoursToMs(0), // everything is expired
+		MaxSnapshotsToKeep:  2,            // 3 > 2, needs maintenance
+		MaxCommitRetries:    3,
 	}
 
 	tables, err := handler.scanTablesForMaintenance(
@@ -1286,6 +1545,7 @@ func TestDetectWithFilters(t *testing.T) {
 			{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
 			{SnapshotID: 3, TimestampMs: now + 2, ManifestList: "metadata/snap-3.avro"},
 		},
+		Age: 200 * time.Hour,
 	}
 	setup2 := tableSetup{
 		BucketName: "bucket-b",
@@ -1296,15 +1556,16 @@ func TestDetectWithFilters(t *testing.T) {
 			{SnapshotID: 5, TimestampMs: now + 4, ManifestList: "metadata/snap-5.avro"},
 			{SnapshotID: 6, TimestampMs: now + 5, ManifestList: "metadata/snap-6.avro"},
 		},
+		Age: 200 * time.Hour,
 	}
 	populateTable(t, fs, setup1)
 	populateTable(t, fs, setup2)
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 0,
-		MaxSnapshotsToKeep:     2,
-		MaxCommitRetries:       3,
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  2,
+		MaxCommitRetries:    3,
 	}
 
 	// Without filter: should find both
@@ -1390,11 +1651,11 @@ func TestDetectSchedulesCompactionWithoutSnapshotPressure(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 24 * 365,
-		MaxSnapshotsToKeep:     10,
-		TargetFileSizeBytes:    4096,
-		MinInputFiles:          2,
-		Operations:             "compact",
+		SnapshotRetentionMs: hoursToMs(24 * 365),
+		MaxSnapshotsToKeep:  10,
+		TargetFileSizeBytes: 4096,
+		MinInputFiles:       2,
+		Operations:          "compact",
 	}
 
 	tables, err := handler.scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
@@ -1495,11 +1756,11 @@ func TestDetectSchedulesCompactionWithDeleteManifestPresent(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 24 * 365,
-		MaxSnapshotsToKeep:     10,
-		TargetFileSizeBytes:    4096,
-		MinInputFiles:          2,
-		Operations:             "compact",
+		SnapshotRetentionMs: hoursToMs(24 * 365),
+		MaxSnapshotsToKeep:  10,
+		TargetFileSizeBytes: 4096,
+		MinInputFiles:       2,
+		Operations:          "compact",
 	}
 
 	tables, err := handler.scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
@@ -1523,6 +1784,7 @@ func TestDetectSchedulesSnapshotExpiryDespiteCompactionEvaluationError(t *testin
 			{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro", SequenceNumber: 1},
 			{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro", SequenceNumber: 2},
 		},
+		Age: 400 * 24 * time.Hour, // past the year-long retention below
 	}
 	populateTable(t, fs, setup)
 
@@ -1542,9 +1804,9 @@ func TestDetectSchedulesSnapshotExpiryDespiteCompactionEvaluationError(t *testin
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 24 * 365, // very long retention so age doesn't trigger
-		MaxSnapshotsToKeep:     1,        // 2 snapshots > 1 triggers expiry
-		Operations:             "compact,expire_snapshots",
+		SnapshotRetentionMs: hoursToMs(24 * 365), // very long retention so age doesn't trigger
+		MaxSnapshotsToKeep:  1,                   // 2 snapshots > 1 triggers expiry
+		Operations:          "compact,expire_snapshots",
 	}
 
 	tables, err := handler.scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
@@ -1580,10 +1842,10 @@ func TestDetectSchedulesManifestRewriteWithoutSnapshotPressure(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 24 * 365,
-		MaxSnapshotsToKeep:     10,
-		MinManifestsToRewrite:  5,
-		Operations:             "rewrite_manifests",
+		SnapshotRetentionMs:   hoursToMs(24 * 365),
+		MaxSnapshotsToKeep:    10,
+		MinManifestsToRewrite: 5,
+		Operations:            "rewrite_manifests",
 	}
 
 	tables, err := handler.scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
@@ -2029,10 +2291,10 @@ func TestDetectDoesNotScheduleManifestRewriteFromDeleteManifestsOnly(t *testing.
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 24 * 365,
-		MaxSnapshotsToKeep:     10,
-		MinManifestsToRewrite:  2,
-		Operations:             "rewrite_manifests",
+		SnapshotRetentionMs:   hoursToMs(24 * 365),
+		MaxSnapshotsToKeep:    10,
+		MinManifestsToRewrite: 2,
+		Operations:            "rewrite_manifests",
 	}
 
 	tables, err := handler.scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
@@ -2070,10 +2332,10 @@ func TestDetectSchedulesOrphanCleanupWithoutSnapshotPressure(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 24 * 365,
-		MaxSnapshotsToKeep:     10,
-		OrphanOlderThanHours:   72,
-		Operations:             "remove_orphans",
+		SnapshotRetentionMs:  hoursToMs(24 * 365),
+		MaxSnapshotsToKeep:   10,
+		OrphanOlderThanHours: 72,
+		Operations:           "remove_orphans",
 	}
 
 	tables, err := handler.scanTablesForMaintenance(context.Background(), client, config, "", "", "", 0)
@@ -2267,37 +2529,55 @@ func cloneEntryForTest(t *testing.T, entry *filer_pb.Entry) *filer_pb.Entry {
 }
 
 // ---------------------------------------------------------------------------
-// Avro manifest content patching for tests
+// Delete manifest writing for tests
 // ---------------------------------------------------------------------------
 
-// patchManifestContentToDeletes performs a binary patch on an Avro manifest
-// file to change the "content" metadata value from "data" to "deletes".
-// This workaround is needed because iceberg-go's WriteManifest API always
-// sets content="data" and provides no way to create delete manifests.
-// The function validates the pattern was found (bytes.Equal check) and fails
-// fast if not, so breakage from encoding changes is caught immediately.
-//
-// In Avro OCF encoding, strings are stored as zigzag-encoded length + bytes.
-// "content" (7 chars) = \x0e + "content", "data" (4 chars) = \x08 + "data",
-// "deletes" (7 chars) = \x0e + "deletes".
-func patchManifestContentToDeletes(t *testing.T, manifestBytes []byte) []byte {
+// writeDeleteManifestForTest writes a delete-content manifest for the given
+// entries and returns its ManifestFile along with the serialized bytes.
+// iceberg-go validates that delete entries only land in delete manifests, so
+// the manifest must be written with NewManifestWriter configured with
+// ManifestContentDeletes rather than WriteManifest.
+func writeDeleteManifestForTest(
+	t *testing.T,
+	manifestPath string,
+	version int,
+	spec iceberg.PartitionSpec,
+	schema *iceberg.Schema,
+	snapshotID int64,
+	entries []iceberg.ManifestEntry,
+) (iceberg.ManifestFile, []byte) {
 	t.Helper()
 
-	// Pattern: zigzag(7)="content" zigzag(4)="data"
-	old := append([]byte{0x0e}, []byte("content")...)
-	old = append(old, 0x08)
-	old = append(old, []byte("data")...)
-
-	// Replacement: zigzag(7)="content" zigzag(7)="deletes"
-	new := append([]byte{0x0e}, []byte("content")...)
-	new = append(new, 0x0e)
-	new = append(new, []byte("deletes")...)
-
-	result := bytes.Replace(manifestBytes, old, new, 1)
-	if bytes.Equal(result, manifestBytes) {
-		t.Fatal("patchManifestContentToDeletes: pattern not found in manifest bytes")
+	var buf bytes.Buffer
+	w, err := iceberg.NewManifestWriter(version, &buf, spec, schema, snapshotID,
+		iceberg.WithManifestWriterContent(iceberg.ManifestContentDeletes))
+	if err != nil {
+		t.Fatalf("create delete manifest writer: %v", err)
 	}
-	return result
+	for _, entry := range entries {
+		var addErr error
+		switch entry.Status() {
+		case iceberg.EntryStatusADDED:
+			addErr = w.Add(entry)
+		case iceberg.EntryStatusEXISTING:
+			addErr = w.Existing(entry)
+		case iceberg.EntryStatusDELETED:
+			addErr = w.Delete(entry)
+		default:
+			addErr = fmt.Errorf("unexpected manifest entry status: %v", entry.Status())
+		}
+		if addErr != nil {
+			t.Fatalf("add delete manifest entry: %v", addErr)
+		}
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("close delete manifest writer: %v", err)
+	}
+	mf, err := w.ToManifestFile(manifestPath, int64(buf.Len()))
+	if err != nil {
+		t.Fatalf("finalize delete manifest: %v", err)
+	}
+	return mf, buf.Bytes()
 }
 
 // ---------------------------------------------------------------------------
@@ -2468,25 +2748,13 @@ func populateTableWithDeleteFilesAndSortOrder(
 			posDeleteEntries = append(posDeleteEntries, iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build()))
 		}
 
-		// WriteManifest always sets content="data", so we patch the Avro
-		// metadata to "deletes" and build a ManifestFile with the right content type.
-		var posManifestBuf bytes.Buffer
 		posManifestName := "pos-delete-manifest-1.avro"
-		posManifestPath := setup.fileRef("metadata", posManifestName)
-		_, err := iceberg.WriteManifest(posManifestPath, &posManifestBuf, version, spec, schema, 1, posDeleteEntries)
-		if err != nil {
-			t.Fatalf("write pos delete manifest: %v", err)
-		}
-		patchedBytes := patchManifestContentToDeletes(t, posManifestBuf.Bytes())
+		posMf, posManifestBytes := writeDeleteManifestForTest(
+			t, setup.fileRef("metadata", posManifestName), version, spec, schema, 1, posDeleteEntries)
 		fs.putEntry(metaDir, posManifestName, &filer_pb.Entry{
-			Name: posManifestName, Content: patchedBytes,
-			Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(len(patchedBytes))},
+			Name: posManifestName, Content: posManifestBytes,
+			Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(len(posManifestBytes))},
 		})
-		posMf := iceberg.NewManifestFile(version, posManifestPath, int64(len(patchedBytes)), int32(spec.ID()), 1).
-			Content(iceberg.ManifestContentDeletes).
-			AddedFiles(int32(len(posDeleteEntries))).
-			AddedRows(int64(len(posDeleteFiles[0].Rows))).
-			Build()
 		allManifests = append(allManifests, posMf)
 	}
 
@@ -2521,23 +2789,13 @@ func populateTableWithDeleteFilesAndSortOrder(
 			eqDeleteEntries = append(eqDeleteEntries, iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build()))
 		}
 
-		var eqManifestBuf bytes.Buffer
 		eqManifestName := "eq-delete-manifest-1.avro"
-		eqManifestPath := setup.fileRef("metadata", eqManifestName)
-		_, err := iceberg.WriteManifest(eqManifestPath, &eqManifestBuf, version, spec, schema, 1, eqDeleteEntries)
-		if err != nil {
-			t.Fatalf("write eq delete manifest: %v", err)
-		}
-		patchedBytes := patchManifestContentToDeletes(t, eqManifestBuf.Bytes())
+		eqMf, eqManifestBytes := writeDeleteManifestForTest(
+			t, setup.fileRef("metadata", eqManifestName), version, spec, schema, 1, eqDeleteEntries)
 		fs.putEntry(metaDir, eqManifestName, &filer_pb.Entry{
-			Name: eqManifestName, Content: patchedBytes,
-			Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(len(patchedBytes))},
+			Name: eqManifestName, Content: eqManifestBytes,
+			Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(len(eqManifestBytes))},
 		})
-		eqMf := iceberg.NewManifestFile(version, eqManifestPath, int64(len(patchedBytes)), int32(spec.ID()), 1).
-			Content(iceberg.ManifestContentDeletes).
-			AddedFiles(int32(len(eqDeleteEntries))).
-			AddedRows(int64(len(eqDeleteFiles[0].Rows))).
-			Build()
 		allManifests = append(allManifests, eqMf)
 	}
 
@@ -2681,22 +2939,13 @@ func rewriteDeleteManifestsAsMixed(
 	manifestName := "mixed-delete-manifest-1.avro"
 	manifestPath := path.Join("metadata", manifestName)
 
-	var manifestBuf bytes.Buffer
-	_, err = iceberg.WriteManifest(manifestPath, &manifestBuf, version, spec, state.Metadata.CurrentSchema(), 1, deleteEntries)
-	if err != nil {
-		t.Fatalf("write mixed delete manifest: %v", err)
-	}
-	mixedBytes := patchManifestContentToDeletes(t, manifestBuf.Bytes())
+	mixedManifest, mixedBytes := writeDeleteManifestForTest(
+		t, manifestPath, version, spec, state.Metadata.CurrentSchema(), 1, deleteEntries)
 	fs.putEntry(metaDir, manifestName, &filer_pb.Entry{
 		Name: manifestName, Content: mixedBytes,
 		Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(len(mixedBytes))},
 	})
 
-	mixedManifest := iceberg.NewManifestFile(version, manifestPath, int64(len(mixedBytes)), int32(spec.ID()), 1).
-		Content(iceberg.ManifestContentDeletes).
-		AddedFiles(int32(len(deleteEntries))).
-		Build()
-
 	var manifestListBuf bytes.Buffer
 	seqNum := int64(1)
 	allManifests := append(dataManifests, mixedManifest)
@@ -3043,9 +3292,9 @@ func TestExpireSnapshotsMetrics(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 0,
-		MaxSnapshotsToKeep:     1,
-		MaxCommitRetries:       3,
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
 	}
 
 	_, metrics, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
@@ -3082,9 +3331,9 @@ func TestExecuteCompletionOutputValues(t *testing.T) {
 
 	handler := NewHandler(nil)
 	config := Config{
-		SnapshotRetentionHours: 0,
-		MaxSnapshotsToKeep:     1,
-		MaxCommitRetries:       3,
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
 	}
 
 	_, metrics, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
@@ -4186,3 +4435,438 @@ func TestResolveCompactionRewritePlanFallsBackForUnsupportedSortTransform(t *tes
 		t.Fatalf("expected fallback to %q for unsupported transform, got %+v", defaultRewriteStrategy, plan)
 	}
 }
+
+// A writer may percent-escape a partition directory name ("part=1" becomes
+// "part%3D1") in the file paths it records in manifests, while the S3 layer
+// decodes the key before storing it. Orphan cleanup must match the decoded
+// spelling or it deletes live data files once they pass the age window.
+func TestRemoveOrphansKeepsPercentEscapedReferences(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now().UnixMilli()
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "ns",
+		TableName:  "tbl",
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
+		},
+	}
+	meta := populateTable(t, fs, setup)
+
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "metadata")
+	dataDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "data")
+	oldTime := time.Now().Add(-200 * time.Hour).Unix()
+
+	// Rewrite the manifest so its entries carry the escaped spelling the
+	// writer recorded.
+	escapedPath := fmt.Sprintf("s3://%s/%s/data/month_collected_at_1%%3D681/f.parquet", setup.BucketName, setup.tablePath())
+	dfBuilder, err := iceberg.NewDataFileBuilder(
+		meta.PartitionSpec(),
+		iceberg.EntryContentData,
+		escapedPath,
+		iceberg.ParquetFile,
+		map[int]any{},
+		nil, nil,
+		10,
+		4096,
+	)
+	if err != nil {
+		t.Fatalf("build escaped data file: %v", err)
+	}
+	snapID := int64(1)
+	var manifestBuf bytes.Buffer
+	if _, err := iceberg.WriteManifest(
+		setup.fileRef("metadata", "manifest-1.avro"), &manifestBuf,
+		meta.Version(), meta.PartitionSpec(), meta.CurrentSchema(), snapID,
+		[]iceberg.ManifestEntry{iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfBuilder.Build())},
+	); err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+	fs.putEntry(metaDir, "manifest-1.avro", &filer_pb.Entry{
+		Name:       "manifest-1.avro",
+		Attributes: &filer_pb.FuseAttributes{Mtime: oldTime, FileSize: uint64(manifestBuf.Len())},
+		Content:    manifestBuf.Bytes(),
+	})
+
+	// The object lives at the decoded key, the same place the S3 PUT landed it.
+	fs.putEntry(dataDir, "month_collected_at_1=681", &filer_pb.Entry{
+		Name:        "month_collected_at_1=681",
+		IsDirectory: true,
+		Attributes:  &filer_pb.FuseAttributes{Mtime: oldTime},
+	})
+	partDir := path.Join(dataDir, "month_collected_at_1=681")
+	fs.putEntry(partDir, "f.parquet", &filer_pb.Entry{
+		Name:       "f.parquet",
+		Attributes: &filer_pb.FuseAttributes{Mtime: oldTime, FileSize: 4096},
+		Content:    []byte("fake-parquet-data"),
+	})
+
+	handler := NewHandler(nil)
+	config := Config{OrphanOlderThanHours: 0, MaxCommitRetries: 3}
+
+	result, _, err := handler.removeOrphans(context.Background(), client, setup.BucketName, setup.tablePath(), config)
+	if err != nil {
+		t.Fatalf("removeOrphans failed: %v", err)
+	}
+	if !strings.Contains(result, "removed 1 orphan") {
+		t.Errorf("expected only the unreferenced snap-1-data.parquet removed, got %q", result)
+	}
+	if fs.getEntry(partDir, "f.parquet") == nil {
+		t.Error("data file referenced through an escaped manifest path was deleted")
+	}
+}
+
+// The sibling of the orphan-sweep case on the read side: a manifest reference
+// carrying a percent-escaped segment must find the object the S3 layer stored
+// at the decoded key.
+func TestLookupFileByIcebergPathDecodesEscapedReference(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	dir := path.Join(s3tables.TablesPath, "bkt", "ns/tbl/data/part=1")
+	fs.putEntry(dir, "f.parquet", &filer_pb.Entry{
+		Name:    "f.parquet",
+		Content: []byte("data"),
+	})
+	literalDir := path.Join(s3tables.TablesPath, "bkt", "ns/tbl/data/part%3D2")
+	fs.putEntry(literalDir, "g.parquet", &filer_pb.Entry{
+		Name:    "g.parquet",
+		Content: []byte("data"),
+	})
+
+	entry, err := lookupFileByIcebergPath(context.Background(), client, "bkt", "ns/tbl", "s3://bkt/ns/tbl/data/part%3D1/f.parquet")
+	if err != nil {
+		t.Fatalf("escaped reference should resolve to the decoded key: %v", err)
+	}
+	if entry == nil || entry.Name != "f.parquet" {
+		t.Fatalf("resolved to wrong entry: %+v", entry)
+	}
+
+	// A file genuinely stored under an escaped name still resolves verbatim.
+	entry, err = lookupFileByIcebergPath(context.Background(), client, "bkt", "ns/tbl", "s3://bkt/ns/tbl/data/part%3D2/g.parquet")
+	if err != nil {
+		t.Fatalf("literal escaped key should resolve: %v", err)
+	}
+	if entry == nil || entry.Name != "g.parquet" {
+		t.Fatalf("resolved to wrong entry: %+v", entry)
+	}
+
+	// A real filer reports misses as filer_pb.ErrNotFound, not a gRPC NotFound
+	// status; the decoded retry must trigger on that shape too.
+	entry, err = lookupFileByIcebergPath(context.Background(), errNotFoundClient{client}, "bkt", "ns/tbl", "s3://bkt/ns/tbl/data/part%3D1/f.parquet")
+	if err != nil {
+		t.Fatalf("escaped reference should resolve under ErrNotFound misses: %v", err)
+	}
+	if entry == nil || entry.Name != "f.parquet" {
+		t.Fatalf("resolved to wrong entry: %+v", entry)
+	}
+}
+
+// errNotFoundClient converts gRPC NotFound misses into filer_pb.ErrNotFound,
+// the shape a real filer produces through filer_pb.LookupEntry.
+type errNotFoundClient struct {
+	filer_pb.SeaweedFilerClient
+}
+
+func (c errNotFoundClient) LookupDirectoryEntry(ctx context.Context, req *filer_pb.LookupDirectoryEntryRequest, opts ...grpc.CallOption) (*filer_pb.LookupDirectoryEntryResponse, error) {
+	resp, err := c.SeaweedFilerClient.LookupDirectoryEntry(ctx, req, opts...)
+	if status.Code(err) == codes.NotFound {
+		return nil, filer_pb.ErrNotFound
+	}
+	return resp, err
+}
+
+func TestExpireSnapshotsDeletesEscapedReferenceAtExistingKey(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now()
+	old := now.Add(-10 * 24 * time.Hour)
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "ns",
+		TableName:  "tbl",
+		Age:        10 * 24 * time.Hour,
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now.UnixMilli(), ManifestList: "metadata/snap-1.avro"},
+			{SnapshotID: 2, TimestampMs: now.UnixMilli() + 1, ManifestList: "metadata/snap-2.avro"},
+		},
+	}
+	meta := populateTable(t, fs, setup)
+
+	// Snapshot 1 (expired) references a file the S3 layer stored at the decoded
+	// key; snapshot 2 (kept) does not reference it.
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "metadata")
+	dataDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "data")
+
+	escapedPath := fmt.Sprintf("s3://%s/%s/data/month%%3D1/f.parquet", setup.BucketName, setup.tablePath())
+	dfBuilder, err := iceberg.NewDataFileBuilder(
+		meta.PartitionSpec(), iceberg.EntryContentData, escapedPath,
+		iceberg.ParquetFile, map[int]any{}, nil, nil, 10, 4096,
+	)
+	if err != nil {
+		t.Fatalf("build escaped data file: %v", err)
+	}
+	snapID := int64(1)
+	var manifestBuf bytes.Buffer
+	if _, err := iceberg.WriteManifest(
+		setup.fileRef("metadata", "manifest-1.avro"), &manifestBuf,
+		meta.Version(), meta.PartitionSpec(), meta.CurrentSchema(), snapID,
+		[]iceberg.ManifestEntry{iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfBuilder.Build())},
+	); err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+	fs.putEntry(metaDir, "manifest-1.avro", &filer_pb.Entry{
+		Name:       "manifest-1.avro",
+		Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: uint64(manifestBuf.Len())},
+		Content:    manifestBuf.Bytes(),
+	})
+
+	partDir := path.Join(dataDir, "month=1")
+	fs.putEntry(dataDir, "month=1", &filer_pb.Entry{
+		Name: "month=1", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix()},
+	})
+	fs.putEntry(partDir, "f.parquet", &filer_pb.Entry{
+		Name: "f.parquet", Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: 4096},
+		Content: []byte("fake-parquet-data"),
+	})
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
+	}
+
+	result, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
+	if err != nil {
+		t.Fatalf("expireSnapshots failed: %v", err)
+	}
+	t.Logf("expireSnapshots result: %s", result)
+
+	if fs.getEntry(partDir, "f.parquet") != nil {
+		t.Error("expired file at the decoded key should have been deleted")
+	}
+}
+
+// A client that escapes its own percent sign on upload leaves an object under
+// a literal %3D-containing key while the manifest spells the same reference.
+// Expiration must delete the entry that actually exists, not the decoded
+// spelling.
+func TestExpireSnapshotsDeletesLiteralPercentKey(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now()
+	old := now.Add(-10 * 24 * time.Hour)
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "ns",
+		TableName:  "tbl",
+		Age:        10 * 24 * time.Hour,
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now.UnixMilli(), ManifestList: "metadata/snap-1.avro"},
+			{SnapshotID: 2, TimestampMs: now.UnixMilli() + 1, ManifestList: "metadata/snap-2.avro"},
+		},
+	}
+	meta := populateTable(t, fs, setup)
+
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "metadata")
+	dataDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "data")
+
+	escapedPath := fmt.Sprintf("s3://%s/%s/data/month%%3D1/f.parquet", setup.BucketName, setup.tablePath())
+	dfBuilder, err := iceberg.NewDataFileBuilder(
+		meta.PartitionSpec(), iceberg.EntryContentData, escapedPath,
+		iceberg.ParquetFile, map[int]any{}, nil, nil, 10, 4096,
+	)
+	if err != nil {
+		t.Fatalf("build escaped data file: %v", err)
+	}
+	snapID := int64(1)
+	var manifestBuf bytes.Buffer
+	if _, err := iceberg.WriteManifest(
+		setup.fileRef("metadata", "manifest-1.avro"), &manifestBuf,
+		meta.Version(), meta.PartitionSpec(), meta.CurrentSchema(), snapID,
+		[]iceberg.ManifestEntry{iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfBuilder.Build())},
+	); err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+	fs.putEntry(metaDir, "manifest-1.avro", &filer_pb.Entry{
+		Name:       "manifest-1.avro",
+		Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: uint64(manifestBuf.Len())},
+		Content:    manifestBuf.Bytes(),
+	})
+
+	literalDir := path.Join(dataDir, "month%3D1")
+	fs.putEntry(dataDir, "month%3D1", &filer_pb.Entry{
+		Name: "month%3D1", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix()},
+	})
+	fs.putEntry(literalDir, "f.parquet", &filer_pb.Entry{
+		Name: "f.parquet", Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: 4096},
+		Content: []byte("fake-parquet-data"),
+	})
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
+	}
+
+	result, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config)
+	if err != nil {
+		t.Fatalf("expireSnapshots failed: %v", err)
+	}
+	t.Logf("expireSnapshots result: %s", result)
+
+	if fs.getEntry(literalDir, "f.parquet") != nil {
+		t.Error("expired file at the literal percent key should have been deleted")
+	}
+}
+
+// A client that escapes an already-escaped name writes a manifest reference
+// like month%253D1 while the object sits at month=1. The kept set must hold
+// every decoding in the chain, or the expiry pass deletes a file a live
+// snapshot still references.
+func TestExpireSnapshotsKeepsDoublyEscapedKeptReference(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now()
+	old := now.Add(-10 * 24 * time.Hour)
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "ns",
+		TableName:  "tbl",
+		Age:        10 * 24 * time.Hour,
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now.UnixMilli(), ManifestList: "metadata/snap-1.avro"},
+			{SnapshotID: 2, TimestampMs: now.UnixMilli() + 1, ManifestList: "metadata/snap-2.avro"},
+		},
+	}
+	meta := populateTable(t, fs, setup)
+
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "metadata")
+	dataDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "data")
+
+	escapedPath := fmt.Sprintf("s3://%s/%s/data/month%%253D1/f.parquet", setup.BucketName, setup.tablePath())
+	writeRefManifest := func(fileName string, snapID int64) {
+		dfBuilder, err := iceberg.NewDataFileBuilder(
+			meta.PartitionSpec(), iceberg.EntryContentData, escapedPath,
+			iceberg.ParquetFile, map[int]any{}, nil, nil, 10, 4096,
+		)
+		if err != nil {
+			t.Fatalf("build escaped data file: %v", err)
+		}
+		var manifestBuf bytes.Buffer
+		if _, err := iceberg.WriteManifest(
+			setup.fileRef("metadata", fileName), &manifestBuf,
+			meta.Version(), meta.PartitionSpec(), meta.CurrentSchema(), snapID,
+			[]iceberg.ManifestEntry{iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfBuilder.Build())},
+		); err != nil {
+			t.Fatalf("write manifest: %v", err)
+		}
+		fs.putEntry(metaDir, fileName, &filer_pb.Entry{
+			Name:       fileName,
+			Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: uint64(manifestBuf.Len())},
+			Content:    manifestBuf.Bytes(),
+		})
+	}
+	writeRefManifest("manifest-1.avro", 1)
+	writeRefManifest("manifest-2.avro", 2)
+
+	partDir := path.Join(dataDir, "month=1")
+	fs.putEntry(dataDir, "month=1", &filer_pb.Entry{
+		Name: "month=1", IsDirectory: true, Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix()},
+	})
+	fs.putEntry(partDir, "f.parquet", &filer_pb.Entry{
+		Name: "f.parquet", Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: 4096},
+		Content: []byte("fake-parquet-data"),
+	})
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
+	}
+
+	if _, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config); err != nil {
+		t.Fatalf("expireSnapshots failed: %v", err)
+	}
+
+	if fs.getEntry(partDir, "f.parquet") == nil {
+		t.Error("file referenced by the kept snapshot through a doubly-escaped path was deleted")
+	}
+}
+
+// A kept reference whose decoded spelling contains a parent segment resolves
+// to the cleaned path. The kept set must record the cleaned spelling, or the
+// expiry pass misses the protection and deletes a file a live snapshot still
+// references.
+func TestExpireSnapshotsKeepsDecodedParentReference(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	now := time.Now()
+	old := now.Add(-10 * 24 * time.Hour)
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "ns",
+		TableName:  "tbl",
+		Age:        10 * 24 * time.Hour,
+		Snapshots: []table.Snapshot{
+			{SnapshotID: 1, TimestampMs: now.UnixMilli(), ManifestList: "metadata/snap-1.avro"},
+			{SnapshotID: 2, TimestampMs: now.UnixMilli() + 1, ManifestList: "metadata/snap-2.avro"},
+		},
+	}
+	meta := populateTable(t, fs, setup)
+
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "metadata")
+	dataDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "data")
+
+	writeRefManifest := func(fileName string, snapID int64, filePath string) {
+		dfBuilder, err := iceberg.NewDataFileBuilder(
+			meta.PartitionSpec(), iceberg.EntryContentData, filePath,
+			iceberg.ParquetFile, map[int]any{}, nil, nil, 10, 4096,
+		)
+		if err != nil {
+			t.Fatalf("build data file: %v", err)
+		}
+		var manifestBuf bytes.Buffer
+		if _, err := iceberg.WriteManifest(
+			setup.fileRef("metadata", fileName), &manifestBuf,
+			meta.Version(), meta.PartitionSpec(), meta.CurrentSchema(), snapID,
+			[]iceberg.ManifestEntry{iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfBuilder.Build())},
+		); err != nil {
+			t.Fatalf("write manifest: %v", err)
+		}
+		fs.putEntry(metaDir, fileName, &filer_pb.Entry{
+			Name:       fileName,
+			Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: uint64(manifestBuf.Len())},
+			Content:    manifestBuf.Bytes(),
+		})
+	}
+	writeRefManifest("manifest-1.avro", 1, fmt.Sprintf("s3://%s/%s/data/f.parquet", setup.BucketName, setup.tablePath()))
+	writeRefManifest("manifest-2.avro", 2, fmt.Sprintf("s3://%s/%s/data/tmp/%%2e%%2e/f.parquet", setup.BucketName, setup.tablePath()))
+
+	fs.putEntry(dataDir, "f.parquet", &filer_pb.Entry{
+		Name: "f.parquet", Attributes: &filer_pb.FuseAttributes{Mtime: old.Unix(), FileSize: 4096},
+		Content: []byte("fake-parquet-data"),
+	})
+
+	handler := NewHandler(nil)
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+		MaxCommitRetries:    3,
+		Operations:          "expire_snapshots",
+	}
+
+	if _, _, err := handler.expireSnapshots(context.Background(), client, setup.BucketName, setup.tablePath(), config); err != nil {
+		t.Fatalf("expireSnapshots failed: %v", err)
+	}
+
+	if fs.getEntry(dataDir, "f.parquet") == nil {
+		t.Error("file referenced by the kept snapshot through a decoded parent segment was deleted")
+	}
+}
diff --git a/weed/worker/tasks/iceberg/filer_io.go b/weed/worker/tasks/iceberg/filer_io.go
index 7564659eb7..9c05e010d2 100644
--- a/weed/worker/tasks/iceberg/filer_io.go
+++ b/weed/worker/tasks/iceberg/filer_io.go
@@ -1,6 +1,7 @@
 package iceberg
 
 import (
+	"bytes"
 	"context"
 	"crypto/rand"
 	"encoding/hex"
@@ -8,12 +9,14 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/url"
 	"path"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 
+	"github.com/parquet-go/parquet-go"
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/operation"
@@ -147,45 +150,137 @@ func loadCurrentMetadata(ctx context.Context, client filer_pb.SeaweedFilerClient
 		return nil, fmt.Errorf("no metadata xattr on table entry %s/%s", dir, name)
 	}
 
-	return parseTableMetadataEnvelope(metadataBytes, bucketName, tablePath)
-}
-
-// loadFileByIcebergPath loads a file from the filer given an Iceberg-style path.
-// dataPath is the bucket-relative directory the table's files live in.
-func loadFileByIcebergPath(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketName, dataPath, icebergPath string) ([]byte, error) {
-	fullPath, err := icebergFilerPath(bucketName, dataPath, icebergPath)
+	state, err := parseTableMetadataEnvelope(metadataBytes, bucketName, tablePath)
 	if err != nil {
 		return nil, err
 	}
-	dir, fileName := path.Dir(fullPath), path.Base(fullPath)
+	// Refuse to rewrite an entry that only looks like an Iceberg table. Every
+	// operation here rewrites or deletes files under the table location, and a
+	// foreign format's files are unreferenced by Iceberg metadata by definition.
+	if !isIcebergTableEntry(resp.Entry.Extended, state.Metadata) {
+		return nil, fmt.Errorf("entry %s/%s is not an iceberg table", dir, name)
+	}
+	return state, nil
+}
 
-	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
-		Directory: dir,
-		Name:      fileName,
-	})
+func isFilerNotFound(err error) bool {
+	return errors.Is(err, filer_pb.ErrNotFound) || status.Code(err) == codes.NotFound
+}
+
+// resolveFilerPath returns the filer path that actually holds a referenced
+// file: the verbatim spelling first, then the percent-decoded one. Writers
+// may record a path with escaped segments while the S3 layer decoded the key
+// before storing the object.
+func resolveFilerPath(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketName, dataPath, icebergPath string) (string, error) {
+	_, fullPath, err := lookupResolvedEntry(ctx, client, bucketName, dataPath, icebergPath)
+	return fullPath, err
+}
+
+// lookupResolvedEntry returns the entry and filer path holding an
+// Iceberg-style reference under the verbatim-first rule.
+func lookupResolvedEntry(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketName, dataPath, icebergPath string) (*filer_pb.Entry, string, error) {
+	fullPath, err := icebergFilerPath(bucketName, dataPath, icebergPath)
 	if err != nil {
-		return nil, fmt.Errorf("lookup %s/%s: %w", dir, fileName, err)
+		return nil, "", err
 	}
-	if resp == nil || resp.Entry == nil {
-		return nil, fmt.Errorf("file not found: %s/%s", dir, fileName)
+	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
+		Directory: path.Dir(fullPath),
+		Name:      path.Base(fullPath),
+	})
+	if err == nil {
+		return resp.Entry, fullPath, nil
+	}
+	if !isFilerNotFound(err) {
+		return nil, "", err
+	}
+	if decoded, decErr := url.PathUnescape(icebergPath); decErr == nil && decoded != icebergPath {
+		return lookupResolvedEntry(ctx, client, bucketName, dataPath, decoded)
+	}
+	return nil, "", err
+}
+
+// addFilerPathSpellings records every filer path lookupResolvedEntry can
+// return for a reference: each successive decoding of the reference, with the
+// rest of the path left verbatim. An extra spelling only keeps a file; a
+// missing one can drop a referenced file.
+func addFilerPathSpellings(set map[string]struct{}, bucketName, dataPath, icebergPath string) {
+	for spelling := icebergPath; ; {
+		filerPath, err := icebergFilerPath(bucketName, dataPath, spelling)
+		if err != nil {
+			return
+		}
+		set[filerPath] = struct{}{}
+		decoded, err := url.PathUnescape(spelling)
+		if err != nil || decoded == spelling {
+			return
+		}
+		spelling = decoded
+	}
+}
+
+// lookupFileByIcebergPath returns the filer entry holding an Iceberg-style
+// path. dataPath is the bucket-relative directory the table's files live in.
+func lookupFileByIcebergPath(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketName, dataPath, icebergPath string) (*filer_pb.Entry, error) {
+	entry, _, err := lookupResolvedEntry(ctx, client, bucketName, dataPath, icebergPath)
+	return entry, err
+}
+
+// loadFileByIcebergPath loads a file from the filer given an Iceberg-style path.
+func loadFileByIcebergPath(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketName, dataPath, icebergPath string) ([]byte, error) {
+	entry, err := lookupFileByIcebergPath(ctx, client, bucketName, dataPath, icebergPath)
+	if err != nil {
+		return nil, err
 	}
 
-	if len(resp.Entry.Content) > 0 || len(resp.Entry.Chunks) == 0 {
-		return resp.Entry.Content, nil
+	if len(entry.Content) > 0 || len(entry.Chunks) == 0 {
+		return entry.Content, nil
 	}
 
 	initGlobalHTTPClientOnce.Do(util_http.InitGlobalHttpClient)
-	reader := filer.NewFileReader(singleFilerClient{client: client}, resp.Entry)
+	reader := filer.NewFileReader(singleFilerClient{client: client}, entry)
 	if closer, ok := reader.(io.Closer); ok {
 		defer closer.Close()
 	}
 	data, err := io.ReadAll(reader)
 	if err != nil {
-		return nil, fmt.Errorf("read chunked file %s/%s: %w", dir, fileName, err)
+		return nil, fmt.Errorf("read chunked file %s: %w", icebergPath, err)
 	}
 	return data, nil
 }
 
+// parquetSchemaByIcebergPath reads a file's parquet schema from its footer,
+// so the file's body is never fetched: a chunked file's ReadAt pulls only the
+// chunks the footer spans.
+func parquetSchemaByIcebergPath(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketName, dataPath, icebergPath string) (*parquet.Schema, error) {
+	entry, err := lookupFileByIcebergPath(ctx, client, bucketName, dataPath, icebergPath)
+	if err != nil {
+		return nil, err
+	}
+
+	var readerAt io.ReaderAt
+	size := int64(entry.GetAttributes().GetFileSize())
+	if len(entry.Content) > 0 || len(entry.Chunks) == 0 {
+		readerAt = bytes.NewReader(entry.Content)
+		size = int64(len(entry.Content))
+	} else {
+		initGlobalHTTPClientOnce.Do(util_http.InitGlobalHttpClient)
+		reader := filer.NewChunkStreamReader(singleFilerClient{client: client}, entry.Chunks)
+		defer reader.Close()
+		readerAt = reader
+		if size <= 0 {
+			if size, err = reader.Seek(0, io.SeekEnd); err != nil {
+				return nil, fmt.Errorf("size of %s: %w", icebergPath, err)
+			}
+		}
+	}
+
+	f, err := parquet.OpenFile(readerAt, size)
+	if err != nil {
+		return nil, fmt.Errorf("open parquet file %s: %w", icebergPath, err)
+	}
+	return f.Schema(), nil
+}
+
 // normalizeIcebergPath converts an Iceberg path (an S3 URL, an absolute filer
 // path, or a path relative to the table root) into a path relative to the
 // bucket root, e.g. "ns/table/metadata/snap-1.avro". Absolute references are
@@ -326,6 +421,7 @@ func uploadFilerChunks(ctx context.Context, client filer_pb.SeaweedFilerClient,
 			PublicUrl: resp.Location.PublicUrl,
 			Count:     uint64(count),
 			Auth:      security.EncodedJwt(resp.Auth),
+			Fsync:     resp.Fsync,
 		}, nil
 	}
 
@@ -438,15 +534,16 @@ func updateTableMetadataXattr(ctx context.Context, client filer_pb.SeaweedFilerC
 		return fmt.Errorf("marshal updated xattr: %w", err)
 	}
 
-	expectedVersionXattr := resp.Entry.Extended[s3tables.ExtendedKeyMetadataVersion]
+	// Assert the whole attribute set, not just the version: this rewrites the
+	// entry from the snapshot above, so a narrower precondition would delete an
+	// attribute a concurrent writer created, such as a maintenance configuration.
+	expectedExtended := s3tables.SnapshotExtended(resp.Entry.Extended)
 	resp.Entry.Extended[s3tables.ExtendedKeyMetadata] = updatedXattr
 	resp.Entry.Extended[s3tables.ExtendedKeyMetadataVersion] = metadataVersionXattr(newVersion)
 	_, err = client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{
-		Directory: parentDir,
-		Entry:     resp.Entry,
-		ExpectedExtended: map[string][]byte{
-			s3tables.ExtendedKeyMetadataVersion: expectedVersionXattr,
-		},
+		Directory:        parentDir,
+		Entry:            resp.Entry,
+		ExpectedExtended: expectedExtended,
 	})
 	if err != nil {
 		if status.Code(err) == codes.FailedPrecondition {
diff --git a/weed/worker/tasks/iceberg/foreign_format_scan_test.go b/weed/worker/tasks/iceberg/foreign_format_scan_test.go
new file mode 100644
index 0000000000..fb4cc27f1e
--- /dev/null
+++ b/weed/worker/tasks/iceberg/foreign_format_scan_test.go
@@ -0,0 +1,113 @@
+package iceberg
+
+import (
+	"context"
+	"encoding/json"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+)
+
+// seedAdapterRegisteredLanceTable builds what the Lance namespace's Iceberg REST
+// adapter leaves behind: a real Iceberg table with a placeholder schema and
+// table_type=lance, whose directory holds a Lance dataset rather than Iceberg
+// data files.
+func seedAdapterRegisteredLanceTable(t *testing.T, properties iceberg.Properties) (*s3tablestest.MemFiler, string) {
+	t.Helper()
+	const bucket, namespace, table = "vectors", "ml", "embeddings"
+
+	filer := s3tablestest.Start(t)
+	filer.Put(s3tables.TablesPath, bucket, map[string][]byte{s3tables.ExtendedKeyTableBucket: []byte("{}")})
+
+	nsMeta, err := json.Marshal(map[string]any{"namespace": []string{namespace}})
+	if err != nil {
+		t.Fatalf("marshal namespace metadata: %v", err)
+	}
+	filer.Put(s3tables.GetTableBucketPath(bucket), namespace, map[string][]byte{s3tables.ExtendedKeyMetadata: nsMeta})
+
+	full, err := json.Marshal(buildTestMetadata(t, nil, nil, 0, properties, nil, nil))
+	if err != nil {
+		t.Fatalf("marshal iceberg metadata: %v", err)
+	}
+	envelope, err := json.Marshal(map[string]any{
+		"metadataVersion":  1,
+		"metadataLocation": "s3://" + bucket + "/" + namespace + "/" + table + "/metadata/v1.metadata.json",
+		"metadata":         map[string]any{"fullMetadata": json.RawMessage(full)},
+	})
+	if err != nil {
+		t.Fatalf("marshal envelope: %v", err)
+	}
+	filer.Put(s3tables.GetNamespacePath(bucket, namespace), table,
+		map[string][]byte{s3tables.ExtendedKeyMetadata: envelope})
+
+	// The Lance dataset. Its fragments live in data/, the same directory the
+	// orphan cleaner walks, and the Iceberg metadata references none of them.
+	tablePath := s3tables.GetTablePath(bucket, namespace, table)
+	old := time.Now().Add(-30 * 24 * time.Hour)
+	filer.Put(tablePath, "data", nil)
+	filer.PutFile(path.Join(tablePath, "data"), "01111110101110001101011164cadc43919eace9c608107bd9.lance", old)
+	filer.Put(tablePath, "_versions", nil)
+	filer.PutFile(path.Join(tablePath, "_versions"), "1.manifest", old)
+	filer.Put(tablePath, "metadata", nil)
+	filer.PutFile(path.Join(tablePath, "metadata"), "v1.metadata.json", old)
+
+	return filer, path.Join(namespace, table)
+}
+
+// The hazard this guards against, stated as a test: every fragment of a Lance
+// dataset is unreferenced by the Iceberg metadata sitting beside it, so orphan
+// cleanup would delete the whole dataset.
+func TestOrphanCleanupWouldDeleteAnAdapterRegisteredLanceDataset(t *testing.T) {
+	filer, tablePath := seedAdapterRegisteredLanceTable(t, iceberg.Properties{tableTypeProperty: "lance"})
+
+	meta := buildTestMetadata(t, nil, nil, 0, iceberg.Properties{tableTypeProperty: "lance"}, nil, nil)
+	candidates, err := collectOrphanCandidates(context.Background(), filer.Client, "vectors", tablePath,
+		meta, "v1.metadata.json", defaultOrphanOlderThanHours)
+	if err != nil {
+		t.Fatalf("collect orphan candidates: %v", err)
+	}
+
+	var doomed []string
+	for _, c := range candidates {
+		doomed = append(doomed, path.Join(c.Dir, c.Entry.Name))
+	}
+	if len(doomed) == 0 {
+		t.Fatal("expected the Lance fragments to look like orphans; without that this guard is pointless")
+	}
+	for _, name := range doomed {
+		if path.Ext(name) == ".lance" {
+			return
+		}
+	}
+	t.Fatalf("expected a .lance fragment among the orphan candidates, got %v", doomed)
+}
+
+// And the guard that stops it: the scan never reaches the table.
+func TestScanSkipsAnAdapterRegisteredLanceTable(t *testing.T) {
+	handler := &Handler{}
+	config := normalizeDetectionConfig(Config{Operations: "all"})
+
+	filer, _ := seedAdapterRegisteredLanceTable(t, iceberg.Properties{tableTypeProperty: "lance"})
+	tables, err := handler.scanTablesForMaintenance(context.Background(), filer.Client, config, "", "", "", 0)
+	if err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if len(tables) != 0 {
+		t.Fatalf("scan picked up a lance table: %v", tables)
+	}
+
+	// An ordinary Iceberg table in the same shape is still scanned, so the guard
+	// is not simply skipping everything.
+	filer, _ = seedAdapterRegisteredLanceTable(t, nil)
+	tables, err = handler.scanTablesForMaintenance(context.Background(), filer.Client, config, "", "", "", 0)
+	if err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if len(tables) != 1 {
+		t.Fatalf("scan skipped an iceberg table: %v", tables)
+	}
+}
diff --git a/weed/worker/tasks/iceberg/foreign_format_test.go b/weed/worker/tasks/iceberg/foreign_format_test.go
new file mode 100644
index 0000000000..bc337f390c
--- /dev/null
+++ b/weed/worker/tasks/iceberg/foreign_format_test.go
@@ -0,0 +1,73 @@
+package iceberg
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// A Lance dataset registered through the Lance namespace's Iceberg REST adapter
+// arrives as an Iceberg table with a placeholder schema and table_type=lance,
+// and keeps its fragments under data/ where the orphan cleaner walks. Every
+// fragment is unreferenced by the Iceberg metadata, so a maintenance pass would
+// delete the dataset.
+func TestIsIcebergTableEntry(t *testing.T) {
+	cases := []struct {
+		name       string
+		extended   map[string][]byte
+		properties iceberg.Properties
+		want       bool
+	}{
+		{
+			name: "plain table",
+			want: true,
+		},
+		{
+			name:       "iceberg table_type is honoured case-insensitively",
+			properties: iceberg.Properties{tableTypeProperty: "ICEBERG"},
+			want:       true,
+		},
+		{
+			name:       "lance table registered through the iceberg adapter",
+			properties: iceberg.Properties{tableTypeProperty: "lance"},
+			want:       false,
+		},
+		{
+			name:     "view",
+			extended: map[string][]byte{s3tables.ExtendedKeyEntryType: []byte(s3tables.EntryTypeView)},
+			want:     false,
+		},
+		{
+			name:     "explicit table marker",
+			extended: map[string][]byte{s3tables.ExtendedKeyEntryType: []byte(s3tables.EntryTypeTable)},
+			want:     true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			meta := buildTestMetadata(t, nil, nil, 0, c.properties, nil, nil)
+			if got := isIcebergTableEntry(c.extended, meta); got != c.want {
+				t.Fatalf("isIcebergTableEntry() = %v, want %v", got, c.want)
+			}
+		})
+	}
+}
+
+// A table the namespace created as LANCE carries no Iceberg metadata at all.
+// Without reading the catalog's own format field the parse below just fails,
+// and the table gets skipped as though its metadata were damaged.
+func TestParseTableMetadataEnvelopeRejectsForeignFormats(t *testing.T) {
+	lance := []byte(`{"name":"vectors","namespace":"ml","format":"LANCE","metadataLocation":"s3://b/ml/vectors"}`)
+	if _, err := parseTableMetadataEnvelope(lance, "b", "ml/vectors"); !errors.Is(err, errForeignFormat) {
+		t.Fatalf("parse of a LANCE entry = %v, want errForeignFormat", err)
+	}
+
+	// An entry with no format recorded predates the field and is still Iceberg's.
+	legacy := []byte(`{"metadataVersion":1}`)
+	if _, err := parseTableMetadataEnvelope(legacy, "b", "ml/t"); err == nil || errors.Is(err, errForeignFormat) {
+		t.Fatalf("parse of a legacy entry = %v, want a plain parse failure", err)
+	}
+}
diff --git a/weed/worker/tasks/iceberg/geometry_bounds.go b/weed/worker/tasks/iceberg/geometry_bounds.go
new file mode 100644
index 0000000000..34789c7d2d
--- /dev/null
+++ b/weed/worker/tasks/iceberg/geometry_bounds.go
@@ -0,0 +1,71 @@
+package iceberg
+
+import (
+	"encoding/binary"
+	"math"
+
+	"github.com/parquet-go/parquet-go/format"
+)
+
+// geometryBounds aggregates the bound of a geometry column over the row groups
+// of a written file. The spec serializes a geometry bound as a point: the
+// lower bound is (xmin, ymin), the upper bound (xmax, ymax), each coordinate
+// an 8-byte little-endian double; z and m are optional and not written here.
+//
+// Readers skip a file whose bound does not intersect a spatial filter, so a
+// box smaller than the file's geometries returns wrong results. Any doubt
+// gives no bound:
+//   - the box is the union of the row groups' geospatial statistics, which
+//     the Parquet writer computes from every non-null value;
+//   - a row group with non-null values but no statistics (the writer omits
+//     them when a value does not parse as WKB) gives the column no bound, as
+//     does a box that is not finite or is inverted;
+//   - a row group of nulls only constrains nothing.
+type geometryBounds struct {
+	xmin, ymin, xmax, ymax float64
+	seen                   bool
+	invalid                bool
+}
+
+func (g *geometryBounds) add(gs format.GeospatialStatistics, numValues, nullCount int64) {
+	if g.invalid || numValues <= 0 || nullCount >= numValues {
+		return
+	}
+	if len(gs.GeoSpatialTypes) == 0 {
+		g.invalid = true
+		return
+	}
+	bb := gs.BBox
+	for _, v := range []float64{bb.XMin, bb.XMax, bb.YMin, bb.YMax} {
+		if math.IsNaN(v) || math.IsInf(v, 0) {
+			g.invalid = true
+			return
+		}
+	}
+	if bb.XMin > bb.XMax || bb.YMin > bb.YMax {
+		g.invalid = true
+		return
+	}
+	if !g.seen {
+		g.xmin, g.ymin, g.xmax, g.ymax, g.seen = bb.XMin, bb.YMin, bb.XMax, bb.YMax, true
+		return
+	}
+	g.xmin, g.ymin = math.Min(g.xmin, bb.XMin), math.Min(g.ymin, bb.YMin)
+	g.xmax, g.ymax = math.Max(g.xmax, bb.XMax), math.Max(g.ymax, bb.YMax)
+}
+
+// encoded returns the lower and upper bound, or false when the column gets
+// none.
+func (g *geometryBounds) encoded() (lower, upper []byte, ok bool) {
+	if g == nil || g.invalid || !g.seen {
+		return nil, nil, false
+	}
+	return encodeGeometryPoint(g.xmin, g.ymin), encodeGeometryPoint(g.xmax, g.ymax), true
+}
+
+func encodeGeometryPoint(x, y float64) []byte {
+	b := make([]byte, 16)
+	binary.LittleEndian.PutUint64(b, math.Float64bits(x))
+	binary.LittleEndian.PutUint64(b[8:], math.Float64bits(y))
+	return b
+}
diff --git a/weed/worker/tasks/iceberg/geometry_bounds_test.go b/weed/worker/tasks/iceberg/geometry_bounds_test.go
new file mode 100644
index 0000000000..dea73f4ce8
--- /dev/null
+++ b/weed/worker/tasks/iceberg/geometry_bounds_test.go
@@ -0,0 +1,215 @@
+package iceberg
+
+import (
+	"fmt"
+	"math"
+	"strings"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/parquet-go/parquet-go/format"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+)
+
+type geoBox struct{ xmin, ymin, xmax, ymax float64 }
+
+func (b geoBox) String() string {
+	return fmt.Sprintf("(%g %g, %g %g)", b.xmin, b.ymin, b.xmax, b.ymax)
+}
+
+func (b geoBox) covers(o geoBox) bool {
+	return b.xmin <= o.xmin && b.ymin <= o.ymin && b.xmax >= o.xmax && b.ymax >= o.ymax
+}
+
+// compactedGeoBounds is the geometry bound of each compacted file in the
+// current manifests (nil: none), and whether its id column has a bound, the
+// control that statistics were collected at all.
+func compactedGeoBounds(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup) (map[string]*geoBox, map[string]bool) {
+	t.Helper()
+	geo, idBounded := map[string]*geoBox{}, map[string]bool{}
+	for _, e := range currentDataEntries(t, client, setup) {
+		df := e.DataFile()
+		if !strings.Contains(df.FilePath(), "/compact-") {
+			continue
+		}
+		idBounded[df.FilePath()] = df.LowerBoundValues()[geoTestIDField] != nil
+		lo, hi := df.LowerBoundValues()[geoTestGeomField], df.UpperBoundValues()[geoTestGeomField]
+		if lo == nil && hi == nil {
+			geo[df.FilePath()] = nil
+			continue
+		}
+		x0, y0 := decodeXYBound(t, lo)
+		x1, y1 := decodeXYBound(t, hi)
+		geo[df.FilePath()] = &geoBox{x0, y0, x1, y1}
+	}
+	if len(geo) == 0 {
+		t.Fatal("no compacted file in the manifests")
+	}
+	return geo, idBounded
+}
+
+// mixedGeoFiles holds points and polygons far apart, so a bound that misses
+// any of them shows.
+func mixedGeoFiles() ([]geoFile, geoBox) {
+	files := []geoFile{
+		{Name: "pts.parquet", Rows: []geoRow{{1, wkbPoint(-3.70, 40.41)}, {2, wkbPoint(2.17, 41.38)}, {3, wkbPoint(-5.98, 37.38)}}},
+		{Name: "boxes.parquet", Rows: []geoRow{{4, wkbBox(-9.3, 42.1, -8.5, 43.4)}, {5, wkbBox(1.0, 36.0, 4.3, 39.9)}}},
+		{Name: "nulls.parquet", Rows: []geoRow{{6, nil}, {7, nil}}},
+		{Name: "mixed.parquet", Rows: []geoRow{{8, nil}, {9, wkbPoint(-1.10, 40.34)}, {10, wkbBox(-0.5, 38.9, -0.3, 39.5)}}},
+	}
+	return files, geoBox{-9.3, 36.0, 4.3, 43.4}
+}
+
+func TestCompactRecordsGeometryBounds(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "geo"}
+	files, want := mixedGeoFiles()
+	populateGeoTable(t, fs, setup, files, geoTableOptions{})
+	if result := compactGeo(t, client, setup, Config{}); !strings.Contains(result, "compacted 4 files") {
+		t.Fatalf("result %q", result)
+	}
+	geo, idBounded := compactedGeoBounds(t, client, setup)
+	for p, got := range geo {
+		if !idBounded[p] {
+			t.Errorf("%s: no id bound: statistics were not collected", p)
+		}
+		if got == nil {
+			t.Fatalf("%s: no geometry bound", p)
+		}
+		if *got != want {
+			t.Errorf("%s: geometry bound %s, want the union of every geometry %s", p, got, want)
+		}
+	}
+}
+
+// A sorted rewrite may write its output without row-group geospatial
+// statistics; the file then gets no geometry bound, never one that misses
+// a row.
+func TestCompactSortedGeometryBoundCoversEveryRow(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "geo"}
+	so, err := table.NewSortOrder(1, []table.SortField{{SourceIDs: []int{geoTestIDField}, Transform: iceberg.IdentityTransform{}, Direction: table.SortDESC, NullOrder: table.NullsFirst}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	files, want := mixedGeoFiles()
+	populateGeoTable(t, fs, setup, files, geoTableOptions{sortOrder: &so})
+	compactGeo(t, client, setup, Config{RewriteStrategy: "sort", SortBufferRows: minSortBufferRows})
+	geo, _ := compactedGeoBounds(t, client, setup)
+	for p, got := range geo {
+		if got != nil && !got.covers(want) {
+			t.Errorf("%s: geometry bound %s does not cover every geometry %s", p, got, want)
+		}
+	}
+}
+
+func TestCompactAllNullGeometryGetsNoBound(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "geo"}
+	populateGeoTable(t, fs, setup, []geoFile{
+		{Name: "a.parquet", Rows: []geoRow{{1, nil}, {2, nil}}},
+		{Name: "b.parquet", Rows: []geoRow{{3, nil}}},
+	}, geoTableOptions{})
+	compactGeo(t, client, setup, Config{})
+	geo, idBounded := compactedGeoBounds(t, client, setup)
+	for p, got := range geo {
+		if got != nil {
+			t.Errorf("%s: geometry bound %s on a column of nulls", p, got)
+		}
+		if !idBounded[p] {
+			t.Errorf("%s: no id bound: statistics were not collected", p)
+		}
+	}
+}
+
+// A value that does not parse as WKB leaves its row group without
+// geospatial statistics; the file then gets no geometry bound rather than
+// one from the other row groups that does not cover that row group.
+func TestCompactUnparseableGeometryGivesNoBound(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "geo"}
+	populateGeoTable(t, fs, setup, []geoFile{
+		{Name: "ok.parquet", Rows: []geoRow{{1, wkbPoint(10, 10)}, {2, wkbPoint(11, 11)}}},
+		{Name: "bad.parquet", Rows: []geoRow{{3, []byte("not wkb at all")}, {4, wkbPoint(-50, -50)}}},
+	}, geoTableOptions{})
+	// two rows a row group: the valid file's rows, then the other file's
+	compactGeo(t, client, setup, Config{RowGroupRowLimit: 2})
+	geo, idBounded := compactedGeoBounds(t, client, setup)
+	for p, got := range geo {
+		if got != nil {
+			t.Errorf("%s: geometry bound %s although a value did not parse", p, got)
+		}
+		if !idBounded[p] {
+			t.Errorf("%s: no id bound: statistics were not collected", p)
+		}
+	}
+}
+
+func TestCollectColumnStatsGivesGeographyNoBound(t *testing.T) {
+	data := writeGeoParquet(t, []geoRow{{1, wkbPoint(170, 10)}, {2, wkbPoint(-170, 12)}}, "")
+	geog, err := iceberg.GeographyTypeOf(iceberg.DefaultGeoCRS, "spherical")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		typ       iceberg.Type
+		wantBound bool
+	}{{iceberg.GeometryType{}, true}, {geog, false}} {
+		stats, err := collectColumnStats(data, geoTestSchema(tc.typ))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, has := stats.lower[geoTestGeomField]; has != tc.wantBound {
+			t.Errorf("%s: lower bound present %v, want %v", tc.typ, has, tc.wantBound)
+		}
+		if stats.values[geoTestGeomField] != 2 {
+			t.Errorf("%s: value count %d, want 2", tc.typ, stats.values[geoTestGeomField])
+		}
+	}
+}
+
+func TestGeometryBoundsAggregation(t *testing.T) {
+	stats := func(xmin, ymin, xmax, ymax float64) format.GeospatialStatistics {
+		return format.GeospatialStatistics{BBox: format.BoundingBox{XMin: xmin, XMax: xmax, YMin: ymin, YMax: ymax}, GeoSpatialTypes: []int32{1}}
+	}
+	type chunk struct {
+		gs            format.GeospatialStatistics
+		values, nulls int64
+	}
+	for _, tc := range []struct {
+		name   string
+		chunks []chunk
+		want   *geoBox
+	}{
+		{"one", []chunk{{stats(1, 2, 3, 4), 5, 0}}, &geoBox{1, 2, 3, 4}},
+		{"union", []chunk{{stats(1, 2, 3, 4), 5, 0}, {stats(-1, 3, 2, 9), 5, 1}}, &geoBox{-1, 2, 3, 9}},
+		{"nulls only constrain nothing", []chunk{{stats(1, 2, 3, 4), 5, 0}, {format.GeospatialStatistics{}, 4, 4}}, &geoBox{1, 2, 3, 4}},
+		{"values without statistics", []chunk{{stats(1, 2, 3, 4), 5, 0}, {format.GeospatialStatistics{}, 4, 1}}, nil},
+		{"NaN", []chunk{{stats(1, math.NaN(), 3, 4), 5, 0}}, nil},
+		{"infinity", []chunk{{stats(1, 2, math.Inf(1), 4), 5, 0}}, nil},
+		{"inverted", []chunk{{stats(3, 2, 1, 4), 5, 0}}, nil},
+		{"nothing", nil, nil},
+	} {
+		var g geometryBounds
+		for _, c := range tc.chunks {
+			g.add(c.gs, c.values, c.nulls)
+		}
+		lo, hi, ok := g.encoded()
+		if tc.want == nil {
+			if ok {
+				t.Errorf("%s: bound given, want none", tc.name)
+			}
+			continue
+		}
+		if !ok {
+			t.Errorf("%s: no bound, want %s", tc.name, tc.want)
+			continue
+		}
+		x0, y0 := decodeXYBound(t, lo)
+		x1, y1 := decodeXYBound(t, hi)
+		if got := (geoBox{x0, y0, x1, y1}); got != *tc.want {
+			t.Errorf("%s: bound %s, want %s", tc.name, got, tc.want)
+		}
+	}
+}
diff --git a/weed/worker/tasks/iceberg/geometry_crs.go b/weed/worker/tasks/iceberg/geometry_crs.go
new file mode 100644
index 0000000000..3270aef675
--- /dev/null
+++ b/weed/worker/tasks/iceberg/geometry_crs.go
@@ -0,0 +1,204 @@
+package iceberg
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"strings"
+
+	"github.com/apache/iceberg-go"
+	"github.com/parquet-go/parquet-go/deprecated"
+	"github.com/parquet-go/parquet-go/encoding/thrift"
+	"github.com/parquet-go/parquet-go/format"
+)
+
+// A GEOMETRY column whose Iceberg type has the default CRS (OGC:CRS84) is
+// written with no CRS in the Parquet logical type, as the input files from
+// most writers declare it. parquet-go spells the default out when it writes
+// such a column, even when the column it read declared none. Both mean the
+// same, but a reader may then see the file column as a different type from
+// the table column (DuckDB casts it and no longer prunes row groups by their
+// statistics). An explicit CRS is left as it is.
+//
+// The footer is changed after the file is written rather than by giving the
+// writer another column type: parquet-go refuses to convert between two
+// GEOMETRY types that both mean the default, and its sorting writer
+// converts. Only the footer's schema elements change; the data, the page
+// indexes and every offset into the file stay byte for byte.
+
+var parquetMagic = []byte("PAR1")
+
+// withDefaultGeometryCRSUnset returns data with the CRS of every GEOMETRY
+// column whose Iceberg type has the default CRS left unset in the footer, and
+// whether anything changed. A file that needs no change comes back as it was;
+// so does one whose footer cannot be read (encrypted, not Parquet), with an
+// error. A changed file is written into data's buffer when it fits, so the
+// caller uses the result in place of data.
+func withDefaultGeometryCRSUnset(data []byte, schema *iceberg.Schema) ([]byte, bool, error) {
+	if schema == nil || !hasDefaultCRSGeometry(schema) {
+		return data, false, nil
+	}
+	n := len(data)
+	if n < 12 || !bytes.Equal(data[n-4:], parquetMagic) || !bytes.Equal(data[:4], parquetMagic) {
+		return data, false, fmt.Errorf("not a plaintext parquet file")
+	}
+	footerLen := int(binary.LittleEndian.Uint32(data[n-8 : n-4]))
+	footerStart := n - 8 - footerLen
+	if footerLen <= 0 || footerStart < 4 {
+		return data, false, fmt.Errorf("footer length %d out of range", footerLen)
+	}
+	var protocol thrift.CompactProtocol
+	var md format.FileMetaData
+	if err := thrift.Unmarshal(&protocol, data[footerStart:n-8], &md); err != nil {
+		return data, false, fmt.Errorf("decode footer: %w", err)
+	}
+	changed := false
+	for i, path := range schemaElementPaths(md.Schema) {
+		el := &md.Schema[i]
+		g, ok := el.LogicalType.Value.(*format.GeometryType)
+		if !ok || g.CRS != iceberg.DefaultGeoCRS {
+			continue
+		}
+		var field iceberg.NestedField
+		if el.FieldID > 0 {
+			field, ok = schema.FindFieldByID(int(el.FieldID))
+		} else {
+			field, ok = schema.FindFieldByName(strings.Join(path, "."))
+		}
+		if !ok {
+			continue
+		}
+		if gt, isGeo := field.Type.(iceberg.GeometryType); !isGeo || gt.CRS() != iceberg.DefaultGeoCRS {
+			continue
+		}
+		el.LogicalType = format.LogicalType{Value: &format.GeometryType{}}
+		changed = true
+	}
+	if !changed {
+		return data, false, nil
+	}
+	footer, err := thrift.Marshal(&protocol, &md)
+	if err != nil {
+		return data, false, fmt.Errorf("encode footer: %w", err)
+	}
+	// The new footer is written over the old one in data's own buffer when it
+	// fits, as it does when a CRS is removed: the file is as large as a
+	// compaction target, and copying it would double the memory it takes.
+	out := data[:footerStart]
+	if cap(data) < footerStart+len(footer)+8 {
+		out = make([]byte, footerStart, footerStart+len(footer)+8)
+		copy(out, data[:footerStart])
+	}
+	out = append(out, footer...)
+	out = binary.LittleEndian.AppendUint32(out, uint32(len(footer)))
+	out = append(out, parquetMagic...)
+	return out, true, nil
+}
+
+func hasDefaultCRSGeometry(schema *iceberg.Schema) bool {
+	for _, f := range schema.Fields() {
+		if typeHasDefaultCRSGeometry(f.Type) {
+			return true
+		}
+	}
+	return false
+}
+
+// typeHasDefaultCRSGeometry reports whether the type is, or nests, a geometry
+// with the default CRS.
+func typeHasDefaultCRSGeometry(t iceberg.Type) bool {
+	switch v := t.(type) {
+	case iceberg.GeometryType:
+		return v.CRS() == iceberg.DefaultGeoCRS
+	case *iceberg.StructType:
+		for _, f := range v.FieldList {
+			if typeHasDefaultCRSGeometry(f.Type) {
+				return true
+			}
+		}
+	case *iceberg.ListType:
+		return typeHasDefaultCRSGeometry(v.Element)
+	case *iceberg.MapType:
+		return typeHasDefaultCRSGeometry(v.KeyType) || typeHasDefaultCRSGeometry(v.ValueType)
+	}
+	return false
+}
+
+// schemaElementPaths is each flattened schema element's Iceberg field path
+// from the root (the root's is empty): the footer lists the tree depth first,
+// every group followed by its num_children children. The repeated group of a
+// LIST or MAP is not an Iceberg field, so it takes its parent's path; under it
+// a list's element is named "element" and a map's two children "key" and
+// "value", as Iceberg names them, whatever the writer called them.
+func schemaElementPaths(elements []format.SchemaElement) [][]string {
+	paths := make([][]string, len(elements))
+	var walk func(i int, path []string) int
+	// children walks the n children of a group whose own path is path,
+	// naming the k-th by name(k) when name is set.
+	children := func(next, n int, path []string, name func(k int, el *format.SchemaElement) string) int {
+		for c := 0; c < n && next < len(elements); c++ {
+			child := path
+			if name != nil {
+				child = append(append([]string{}, path...), name(c, &elements[next]))
+			} else {
+				child = append(append([]string{}, path...), elements[next].Name)
+			}
+			next = walk(next, child)
+		}
+		return next
+	}
+	walk = func(i int, path []string) int {
+		if i >= len(elements) {
+			return i
+		}
+		paths[i] = path
+		el := &elements[i]
+		n := int(el.NumChildren.V)
+		if n != 1 || i+1 >= len(elements) {
+			return children(i+1, n, path, nil)
+		}
+		repeated := &elements[i+1]
+		if rt, ok := repeated.RepetitionType.Get(); !ok || rt != format.Repeated {
+			return children(i+1, n, path, nil)
+		}
+		switch {
+		case isListAnnotated(el):
+			// A repeated group of one field wraps the element, unless its
+			// name marks the legacy form where the group is the element.
+			if rn := int(repeated.NumChildren.V); rn == 1 && repeated.Name != "array" && repeated.Name != el.Name+"_tuple" {
+				paths[i+1] = path
+				return children(i+2, 1, path, func(int, *format.SchemaElement) string { return "element" })
+			}
+			return children(i+1, 1, path, func(int, *format.SchemaElement) string { return "element" })
+		case isMapAnnotated(el):
+			if int(repeated.NumChildren.V) == 2 {
+				paths[i+1] = path
+				return children(i+2, 2, path, func(k int, _ *format.SchemaElement) string {
+					if k == 0 {
+						return "key"
+					}
+					return "value"
+				})
+			}
+		}
+		return children(i+1, n, path, nil)
+	}
+	walk(0, nil)
+	return paths
+}
+
+func isListAnnotated(el *format.SchemaElement) bool {
+	if _, ok := el.LogicalType.Value.(*format.ListType); ok {
+		return true
+	}
+	ct, ok := el.ConvertedType.Get()
+	return ok && ct == deprecated.List
+}
+
+func isMapAnnotated(el *format.SchemaElement) bool {
+	if _, ok := el.LogicalType.Value.(*format.MapType); ok {
+		return true
+	}
+	ct, ok := el.ConvertedType.Get()
+	return ok && (ct == deprecated.Map || ct == deprecated.MapKeyValue)
+}
diff --git a/weed/worker/tasks/iceberg/geometry_crs_test.go b/weed/worker/tasks/iceberg/geometry_crs_test.go
new file mode 100644
index 0000000000..04a1df9102
--- /dev/null
+++ b/weed/worker/tasks/iceberg/geometry_crs_test.go
@@ -0,0 +1,251 @@
+package iceberg
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/parquet-go/parquet-go"
+	"github.com/parquet-go/parquet-go/compress/zstd"
+	"github.com/parquet-go/parquet-go/format"
+)
+
+// unsetDefaultCRS makes an input file declare the default CRS as no CRS at
+// all, as DuckDB and other writers do; parquet.Geometry("") spells it out.
+func unsetDefaultCRS(t *testing.T, data []byte) []byte {
+	t.Helper()
+	out, changed, err := withDefaultGeometryCRSUnset(data, geoTestSchema(iceberg.GeometryType{}))
+	if err != nil || !changed {
+		t.Fatalf("unset the input's default CRS: changed %v, %v", changed, err)
+	}
+	return out
+}
+
+func fiveGeoFiles() []geoFile {
+	var files []geoFile
+	for f := 0; f < 5; f++ {
+		var rows []geoRow
+		for i := 0; i < 40; i++ {
+			id := int64(f*40 + i)
+			rows = append(rows, geoRow{ID: id, Geom: wkbPoint(float64(id%20)-10, float64(id/20)-5)})
+		}
+		files = append(files, geoFile{Name: fmt.Sprintf("g%d.parquet", f), Rows: rows})
+	}
+	return files
+}
+
+// The Parquet CRS of a default-CRS geometry column survives compaction as the
+// inputs declared it: none. The control shows what parquet-go does with the
+// same schema on its own: it spells the default out.
+func TestCompactWritesDefaultCRSGeometryWithoutCRS(t *testing.T) {
+	control := unsetDefaultCRS(t, writeGeoParquet(t, []geoRow{{1, wkbPoint(1, 2)}}, ""))
+	if crs, ok := footerGeometryCRS(t, control, "geom"); !ok || crs != "" {
+		t.Fatalf("setup: an input file declares CRS %q (geometry %v), want none", crs, ok)
+	}
+	f, err := parquet.OpenFile(bytes.NewReader(control), int64(len(control)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var plain bytes.Buffer
+	w := parquet.NewWriter(&plain, f.Schema())
+	if _, err := w.WriteRows([]parquet.Row{{parquet.ByteArrayValue(wkbPoint(1, 2)).Level(0, 1, 0), parquet.Int64Value(1).Level(0, 0, 1)}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if crs, _ := footerGeometryCRS(t, plain.Bytes(), "geom"); crs != iceberg.DefaultGeoCRS {
+		t.Fatalf("control: parquet-go copied the schema with CRS %q; the fix is for %q", crs, iceberg.DefaultGeoCRS)
+	}
+
+	for _, strategy := range []string{"binpack", "sort"} {
+		t.Run(strategy, func(t *testing.T) {
+			fs, client := startFakeFiler(t)
+			setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "geo"}
+			opt := geoTableOptions{fixup: unsetDefaultCRS}
+			config := Config{}
+			if strategy == "sort" {
+				so, err := table.NewSortOrder(1, []table.SortField{{SourceIDs: []int{geoTestIDField}, Transform: iceberg.IdentityTransform{}, Direction: table.SortASC, NullOrder: table.NullsFirst}})
+				if err != nil {
+					t.Fatal(err)
+				}
+				opt.sortOrder = &so
+				config.RewriteStrategy, config.SortBufferRows = "sort", minSortBufferRows
+			}
+			files := fiveGeoFiles()
+			files[2].ParquetCRSSet = true // an input that spells the default out
+			populateGeoTable(t, fs, setup, files, opt)
+			if result := compactGeo(t, client, setup, config); !strings.Contains(result, "compacted 5 files") {
+				t.Fatalf("result %q", result)
+			}
+			for name, data := range compactedFiles(t, fs, setup) {
+				if crs, ok := footerGeometryCRS(t, data, "geom"); !ok || crs != "" {
+					t.Errorf("%s: geometry column declares CRS %q (geometry %v), want none", name, crs, ok)
+				}
+				got, err := parquet.Read[struct {
+					ID int64 `parquet:"id"`
+				}](bytes.NewReader(data), int64(len(data)))
+				if err != nil || len(got) != 200 {
+					t.Errorf("%s: the rewritten file reads %d rows, %v", name, len(got), err)
+				}
+			}
+		})
+	}
+}
+
+// An explicit CRS is not the default: it is written as the input declared it.
+func TestCompactKeepsExplicitGeometryCRS(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "geo"}
+	g, err := iceberg.GeometryTypeOf("EPSG:2913")
+	if err != nil {
+		t.Fatal(err)
+	}
+	populateGeoTable(t, fs, setup, fiveGeoFiles(), geoTableOptions{icebergType: g, parquetCRS: "EPSG:2913"})
+	compactGeo(t, client, setup, Config{})
+	for name, data := range compactedFiles(t, fs, setup) {
+		if crs, ok := footerGeometryCRS(t, data, "geom"); !ok || crs != "EPSG:2913" {
+			t.Errorf("%s: geometry CRS %q (geometry %v), want EPSG:2913", name, crs, ok)
+		}
+	}
+}
+
+// A default-CRS geometry nested in a struct is written without a CRS too.
+func TestDefaultCRSUnsetForNestedGeometry(t *testing.T) {
+	schema := parquet.NewSchema("table", parquet.Group{
+		"id":  parquet.FieldID(parquet.Compressed(parquet.Int(64), &zstd.Codec{}), 1),
+		"loc": parquet.FieldID(parquet.Group{"geom": parquet.FieldID(parquet.Optional(parquet.Geometry("")), 3)}, 2),
+	})
+	var buf bytes.Buffer
+	w := parquet.NewGenericWriter[any](&buf, schema)
+	cols := map[string]int{}
+	for i, p := range schema.Columns() {
+		cols[strings.Join(p, ".")] = i
+	}
+	row := make(parquet.Row, 2)
+	row[cols["id"]] = parquet.Int64Value(1).Level(0, 0, cols["id"])
+	row[cols["loc.geom"]] = parquet.ByteArrayValue(wkbPoint(1, 2)).Level(0, 1, cols["loc.geom"])
+	if _, err := w.WriteRows([]parquet.Row{row}); err != nil {
+		t.Fatal(err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if crs, ok := footerGeometryCRS(t, buf.Bytes(), "geom"); !ok || crs != iceberg.DefaultGeoCRS {
+		t.Fatalf("setup: the nested column declares %q (geometry %v); the control is the spelled-out default", crs, ok)
+	}
+	ice := iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Type: iceberg.PrimitiveTypes.Int64, Name: "id", Required: true},
+		iceberg.NestedField{ID: 2, Name: "loc", Type: &iceberg.StructType{FieldList: []iceberg.NestedField{{ID: 3, Name: "geom", Type: iceberg.GeometryType{}}}}})
+	out, changed, err := withDefaultGeometryCRSUnset(buf.Bytes(), ice)
+	if err != nil || !changed {
+		t.Fatalf("changed %v, %v", changed, err)
+	}
+	if crs, ok := footerGeometryCRS(t, out, "geom"); !ok || crs != "" {
+		t.Errorf("the nested geometry declares CRS %q (geometry %v), want none", crs, ok)
+	}
+	got, err := parquet.Read[struct {
+		ID int64 `parquet:"id"`
+	}](bytes.NewReader(out), int64(len(out)))
+	if err != nil || len(got) != 1 || got[0].ID != 1 {
+		t.Errorf("the rewritten file reads %v, %v", got, err)
+	}
+}
+
+// footerGeometryCRSs is the CRS of every GEOMETRY element in the footer, by
+// schema element index and name.
+func footerGeometryCRSs(t *testing.T, data []byte) map[string]string {
+	t.Helper()
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	out := map[string]string{}
+	for i, el := range f.Metadata().Schema {
+		if g, ok := el.LogicalType.Value.(*format.GeometryType); ok {
+			out[fmt.Sprintf("%d:%s", i, el.Name)] = g.CRS
+		}
+	}
+	return out
+}
+
+// A file without field ids is matched to the table by name: through the
+// LIST and MAP wrapper groups too, which Iceberg's field names leave out.
+func TestDefaultCRSUnsetWithoutFieldIDs(t *testing.T) {
+	geom := func() parquet.Node { return parquet.Optional(parquet.Geometry("")) }
+	element := func(id int, typ iceberg.Type) *iceberg.ListType {
+		return &iceberg.ListType{ElementID: id, Element: typ, ElementRequired: false}
+	}
+	cases := []struct {
+		name    string
+		parquet parquet.Group
+		iceberg []iceberg.NestedField
+	}{
+		{"top level", parquet.Group{"id": parquet.Int(64), "geom": geom()},
+			[]iceberg.NestedField{{ID: 1, Name: "id", Type: iceberg.PrimitiveTypes.Int64, Required: true}, {ID: 2, Name: "geom", Type: iceberg.GeometryType{}}}},
+		{"list", parquet.Group{"shapes": parquet.Optional(parquet.List(geom()))},
+			[]iceberg.NestedField{{ID: 1, Name: "shapes", Type: element(2, iceberg.GeometryType{})}}},
+		{"list of structs", parquet.Group{"items": parquet.Optional(parquet.List(parquet.Group{"geom": geom()}))},
+			[]iceberg.NestedField{{ID: 1, Name: "items", Type: element(2, &iceberg.StructType{FieldList: []iceberg.NestedField{{ID: 3, Name: "geom", Type: iceberg.GeometryType{}}}})}}},
+		{"map", parquet.Group{"attrs": parquet.Optional(parquet.Map(parquet.String(), geom()))},
+			[]iceberg.NestedField{{ID: 1, Name: "attrs", Type: &iceberg.MapType{KeyID: 2, KeyType: iceberg.PrimitiveTypes.String, ValueID: 3, ValueType: iceberg.GeometryType{}}}}},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var buf bytes.Buffer
+			w := parquet.NewGenericWriter[any](&buf, parquet.NewSchema("table", tc.parquet))
+			if err := w.Close(); err != nil {
+				t.Fatal(err)
+			}
+			before := footerGeometryCRSs(t, buf.Bytes())
+			if len(before) != 1 {
+				t.Fatalf("setup: geometry columns %v, want one", before)
+			}
+			for path, crs := range before {
+				if crs != iceberg.DefaultGeoCRS {
+					t.Fatalf("setup: %s declares %q; the control is the spelled-out default", path, crs)
+				}
+			}
+			out, changed, err := withDefaultGeometryCRSUnset(buf.Bytes(), iceberg.NewSchema(0, tc.iceberg...))
+			if err != nil || !changed {
+				t.Fatalf("changed %v, %v", changed, err)
+			}
+			for path, crs := range footerGeometryCRSs(t, out) {
+				if crs != "" {
+					t.Errorf("%s declares CRS %q, want none", path, crs)
+				}
+			}
+		})
+	}
+}
+
+// The footer is replaced inside the file's own buffer: a compacted file can be
+// as large as the target file size, and a copy of it would double the memory
+// the rewrite needs.
+func TestDefaultCRSUnsetReusesBuffer(t *testing.T) {
+	data := writeGeoParquet(t, []geoRow{{1, wkbPoint(1, 2)}, {2, wkbPoint(3, 4)}}, "")
+	if crs, ok := footerGeometryCRS(t, data, "geom"); !ok || crs != iceberg.DefaultGeoCRS {
+		t.Fatalf("setup: CRS %q (geometry %v); the control is the spelled-out default", crs, ok)
+	}
+	first := &data[0]
+	out, changed, err := withDefaultGeometryCRSUnset(data, geoTestSchema(iceberg.GeometryType{}))
+	if err != nil || !changed {
+		t.Fatalf("changed %v, %v", changed, err)
+	}
+	if &out[0] != first {
+		t.Errorf("the rewrite copied the file into a new buffer")
+	}
+	if crs, ok := footerGeometryCRS(t, out, "geom"); !ok || crs != "" {
+		t.Errorf("geometry declares CRS %q (geometry %v), want none", crs, ok)
+	}
+	got, err := parquet.Read[struct {
+		ID   int64  `parquet:"id"`
+		Geom []byte `parquet:"geom,optional"`
+	}](bytes.NewReader(out), int64(len(out)))
+	if err != nil || len(got) != 2 || got[1].ID != 2 || !bytes.Equal(got[1].Geom, wkbPoint(3, 4)) {
+		t.Errorf("the rewritten file reads %v, %v", got, err)
+	}
+}
diff --git a/weed/worker/tasks/iceberg/geometry_fixture_test.go b/weed/worker/tasks/iceberg/geometry_fixture_test.go
new file mode 100644
index 0000000000..3e5966f0e8
--- /dev/null
+++ b/weed/worker/tasks/iceberg/geometry_fixture_test.go
@@ -0,0 +1,360 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"math"
+	"path"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/parquet-go/parquet-go"
+	"github.com/parquet-go/parquet-go/compress/zstd"
+	"github.com/parquet-go/parquet-go/format"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// Fixtures for v3 tables with a geometry column: Parquet files with field
+// ids, ZSTD and a native GEOMETRY column, and manifests that carry the v3
+// geometry bounds of each file, as DuckDB writes them.
+
+const (
+	geoTestIDField   = 1
+	geoTestGeomField = 2
+)
+
+func wkbPoint(x, y float64) []byte {
+	b := make([]byte, 21)
+	b[0] = 1 // little endian
+	binary.LittleEndian.PutUint32(b[1:], 1)
+	binary.LittleEndian.PutUint64(b[5:], math.Float64bits(x))
+	binary.LittleEndian.PutUint64(b[13:], math.Float64bits(y))
+	return b
+}
+
+// wkbBox is the polygon of one closed ring around the box.
+func wkbBox(xmin, ymin, xmax, ymax float64) []byte {
+	ring := [][2]float64{{xmin, ymin}, {xmax, ymin}, {xmax, ymax}, {xmin, ymax}, {xmin, ymin}}
+	b := make([]byte, 0, 13+16*len(ring))
+	b = append(b, 1)
+	b = binary.LittleEndian.AppendUint32(b, 3)
+	b = binary.LittleEndian.AppendUint32(b, 1)
+	b = binary.LittleEndian.AppendUint32(b, uint32(len(ring)))
+	for _, p := range ring {
+		b = binary.LittleEndian.AppendUint64(b, math.Float64bits(p[0]))
+		b = binary.LittleEndian.AppendUint64(b, math.Float64bits(p[1]))
+	}
+	return b
+}
+
+func geoLE64(v int64) []byte {
+	b := make([]byte, 8)
+	binary.LittleEndian.PutUint64(b, uint64(v))
+	return b
+}
+
+func xyBound(x, y float64) []byte {
+	b := make([]byte, 16)
+	binary.LittleEndian.PutUint64(b, math.Float64bits(x))
+	binary.LittleEndian.PutUint64(b[8:], math.Float64bits(y))
+	return b
+}
+
+func decodeXYBound(t *testing.T, b []byte) (float64, float64) {
+	t.Helper()
+	if len(b) < 16 {
+		t.Fatalf("geometry bound of %d bytes, want 16", len(b))
+	}
+	return math.Float64frombits(binary.LittleEndian.Uint64(b)), math.Float64frombits(binary.LittleEndian.Uint64(b[8:]))
+}
+
+type geoRow struct {
+	ID   int64
+	Geom []byte // nil: a null geometry
+}
+
+type geoFile struct {
+	Name          string
+	Rows          []geoRow
+	ParquetCRSSet bool // declare the default CRS in the Parquet logical type
+}
+
+type geoTableOptions struct {
+	icebergType iceberg.Type     // the geometry column's Iceberg type (default: geometry with the default CRS)
+	parquetCRS  string           // the CRS of the Parquet GEOMETRY type
+	sortOrder   *table.SortOrder // nil: unsorted
+	properties  iceberg.Properties
+	// fixup, when set, rewrites each input file after it is written
+	fixup func(t *testing.T, data []byte) []byte
+}
+
+func geoTestSchema(geomType iceberg.Type) *iceberg.Schema {
+	return iceberg.NewSchema(0,
+		iceberg.NestedField{ID: geoTestIDField, Type: iceberg.PrimitiveTypes.Int64, Name: "id", Required: true},
+		iceberg.NestedField{ID: geoTestGeomField, Type: geomType, Name: "geom", Required: false},
+	)
+}
+
+func writeGeoParquet(t *testing.T, rows []geoRow, crs string) []byte {
+	t.Helper()
+	schema := parquet.NewSchema("table", parquet.Group{
+		"id":   parquet.FieldID(parquet.Compressed(parquet.Int(64), &zstd.Codec{}), geoTestIDField),
+		"geom": parquet.FieldID(parquet.Compressed(parquet.Optional(parquet.Geometry(crs)), &zstd.Codec{}), geoTestGeomField),
+	})
+	geomCol, idCol := -1, -1
+	for i, p := range schema.Columns() {
+		switch strings.Join(p, ".") {
+		case "geom":
+			geomCol = i
+		case "id":
+			idCol = i
+		}
+	}
+	var buf bytes.Buffer
+	w := parquet.NewGenericWriter[any](&buf, schema)
+	for _, r := range rows {
+		row := make(parquet.Row, 2)
+		if r.Geom == nil {
+			row[geomCol] = parquet.NullValue().Level(0, 0, geomCol)
+		} else {
+			row[geomCol] = parquet.ByteArrayValue(r.Geom).Level(0, 1, geomCol)
+		}
+		row[idCol] = parquet.Int64Value(r.ID).Level(0, 0, idCol)
+		if _, err := w.WriteRows([]parquet.Row{row}); err != nil {
+			t.Fatalf("write row: %v", err)
+		}
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("close writer: %v", err)
+	}
+	return buf.Bytes()
+}
+
+// footerGeoBox is the union of the file's row-group geometry boxes.
+func footerGeoBox(t *testing.T, data []byte) (xmin, ymin, xmax, ymax float64, ok bool) {
+	t.Helper()
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	xmin, ymin, xmax, ymax = math.Inf(1), math.Inf(1), math.Inf(-1), math.Inf(-1)
+	for _, rg := range f.Metadata().RowGroups {
+		for _, c := range rg.Columns {
+			if strings.Join(c.MetaData.PathInSchema, ".") != "geom" || len(c.MetaData.GeospatialStatistics.GeoSpatialTypes) == 0 {
+				continue
+			}
+			bb := c.MetaData.GeospatialStatistics.BBox
+			xmin, ymin = math.Min(xmin, bb.XMin), math.Min(ymin, bb.YMin)
+			xmax, ymax = math.Max(xmax, bb.XMax), math.Max(ymax, bb.YMax)
+			ok = true
+		}
+	}
+	return
+}
+
+// footerGeometryCRS is the CRS the file's GEOMETRY logical type declares, and
+// whether the column is GEOMETRY at all.
+func footerGeometryCRS(t *testing.T, data []byte, column string) (string, bool) {
+	t.Helper()
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	for _, el := range f.Metadata().Schema {
+		if el.Name != column {
+			continue
+		}
+		if g, ok := el.LogicalType.Value.(*format.GeometryType); ok {
+			return g.CRS, true
+		}
+		return "", false
+	}
+	t.Fatalf("no column %s in the footer", column)
+	return "", false
+}
+
+// populateGeoTable writes a v3 geometry table with one append snapshot and
+// one manifest per file.
+func populateGeoTable(t *testing.T, fs *fakeFilerServer, setup tableSetup, files []geoFile, opt geoTableOptions) table.Metadata {
+	t.Helper()
+	geomType := opt.icebergType
+	if geomType == nil {
+		geomType = iceberg.GeometryType{}
+	}
+	schema := geoTestSchema(geomType)
+	spec := *iceberg.UnpartitionedSpec
+	location := "s3://" + setup.BucketName + "/" + setup.dataPath()
+	props := iceberg.Properties{"format-version": "3"}
+	for k, v := range opt.properties {
+		props[k] = v
+	}
+	sortOrder := table.UnsortedSortOrder
+	if opt.sortOrder != nil {
+		sortOrder = *opt.sortOrder
+	}
+	meta, err := table.NewMetadata(schema, &spec, sortOrder, location, props)
+	if err != nil {
+		t.Fatalf("create metadata: %v", err)
+	}
+	bucketPath := path.Join(s3tables.TablesPath, setup.BucketName)
+	tableFilerPath := path.Join(bucketPath, setup.dataPath())
+	metaDir := path.Join(tableFilerPath, "metadata")
+	dataDir := path.Join(tableFilerPath, "data")
+	putFile := func(dir, name string, data []byte) {
+		fs.putEntry(dir, name, &filer_pb.Entry{Name: name, Content: data,
+			Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix(), FileSize: uint64(len(data))}})
+	}
+	snapID := int64(1)
+	var manifests []iceberg.ManifestFile
+	for i, f := range files {
+		crs := opt.parquetCRS
+		if f.ParquetCRSSet && crs == "" {
+			crs = iceberg.DefaultGeoCRS
+		}
+		data := writeGeoParquet(t, f.Rows, crs)
+		if opt.fixup != nil && !f.ParquetCRSSet {
+			data = opt.fixup(t, data)
+		}
+		putFile(dataDir, f.Name, data)
+		dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, setup.fileRef("data", f.Name), iceberg.ParquetFile, map[int]any{}, nil, nil, int64(len(f.Rows)), int64(len(data)))
+		if err != nil {
+			t.Fatalf("data file %s: %v", f.Name, err)
+		}
+		lo, hi := int64(math.MaxInt64), int64(math.MinInt64)
+		for _, r := range f.Rows {
+			lo, hi = min(lo, r.ID), max(hi, r.ID)
+		}
+		lower := map[int][]byte{geoTestIDField: geoLE64(lo)}
+		upper := map[int][]byte{geoTestIDField: geoLE64(hi)}
+		if xmin, ymin, xmax, ymax, ok := footerGeoBox(t, data); ok {
+			lower[geoTestGeomField], upper[geoTestGeomField] = xyBound(xmin, ymin), xyBound(xmax, ymax)
+		}
+		dfb.LowerBoundValues(lower)
+		dfb.UpperBoundValues(upper)
+		entry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build())
+		name := fmt.Sprintf("data-manifest-%d.avro", i)
+		var buf bytes.Buffer
+		mf, err := iceberg.WriteManifest(setup.fileRef("metadata", name), &buf, 3, spec, schema, snapID, []iceberg.ManifestEntry{entry})
+		if err != nil {
+			t.Fatalf("write manifest: %v", err)
+		}
+		putFile(metaDir, name, buf.Bytes())
+		manifests = append(manifests, mf)
+	}
+	var mlBuf bytes.Buffer
+	mlw, err := iceberg.NewManifestListWriterV3(&mlBuf, snapID, 1, 0, nil)
+	if err != nil {
+		t.Fatalf("manifest list writer: %v", err)
+	}
+	if err := mlw.AddManifests(manifests); err != nil {
+		t.Fatalf("add manifests: %v", err)
+	}
+	if err := mlw.Close(); err != nil {
+		t.Fatalf("close manifest list: %v", err)
+	}
+	putFile(metaDir, "snap-1.avro", mlBuf.Bytes())
+	firstRowID := int64(0)
+	addedRows := *mlw.NextRowID()
+	snap := table.Snapshot{SnapshotID: snapID, SequenceNumber: 1, TimestampMs: time.Now().UnixMilli(),
+		ManifestList: setup.fileRef("metadata", "snap-1.avro"),
+		Summary:      &table.Summary{Operation: table.OpAppend, Properties: map[string]string{}},
+		FirstRowID:   &firstRowID, AddedRows: &addedRows}
+	builder, err := table.MetadataBuilderFromBase(meta, location)
+	if err != nil {
+		t.Fatalf("metadata builder: %v", err)
+	}
+	if err := builder.AddSnapshot(&snap); err != nil {
+		t.Fatalf("add snapshot: %v", err)
+	}
+	if err := builder.SetSnapshotRef(table.MainBranch, snapID, table.BranchRef); err != nil {
+		t.Fatalf("set ref: %v", err)
+	}
+	if meta, err = builder.Build(); err != nil {
+		t.Fatalf("build metadata: %v", err)
+	}
+	full, _ := json.Marshal(meta)
+	xattr, _ := json.Marshal(map[string]interface{}{
+		"metadataVersion":  1,
+		"metadataLocation": setup.fileRef("metadata", "v1.metadata.json"),
+		"metadata":         map[string]interface{}{"fullMetadata": json.RawMessage(full)},
+	})
+	fs.putEntry(s3tables.TablesPath, setup.BucketName, &filer_pb.Entry{
+		Name: setup.BucketName, IsDirectory: true, Extended: map[string][]byte{s3tables.ExtendedKeyTableBucket: []byte("true")},
+	})
+	fs.putEntry(bucketPath, setup.Namespace, &filer_pb.Entry{Name: setup.Namespace, IsDirectory: true})
+	fs.putEntry(path.Join(bucketPath, setup.Namespace), setup.TableName, &filer_pb.Entry{
+		Name: setup.TableName, IsDirectory: true, Extended: map[string][]byte{s3tables.ExtendedKeyMetadata: xattr},
+	})
+	return meta
+}
+
+func compactGeo(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup, config Config) string {
+	t.Helper()
+	if config.TargetFileSizeBytes == 0 {
+		config.TargetFileSizeBytes = 256 * 1024 * 1024
+	}
+	if config.MinInputFiles == 0 {
+		config.MinInputFiles = 2
+	}
+	if config.MaxCommitRetries == 0 {
+		config.MaxCommitRetries = 3
+	}
+	config.ApplyDeletes = true
+	result, _, err := NewHandler(nil).compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	return result
+}
+
+// compactedFiles is every compact-*.parquet in the table's data directory.
+func compactedFiles(t *testing.T, fs *fakeFilerServer, setup tableSetup) map[string][]byte {
+	t.Helper()
+	out := map[string][]byte{}
+	for _, e := range fs.listDir(path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "data")) {
+		if strings.HasPrefix(e.Name, "compact-") {
+			out[e.Name] = e.Content
+		}
+	}
+	if len(out) == 0 {
+		t.Fatal("no compacted file")
+	}
+	return out
+}
+
+// currentDataEntries is every entry of the current snapshot's data manifests.
+func currentDataEntries(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup) []iceberg.ManifestEntry {
+	t.Helper()
+	ctx := context.Background()
+	state, err := loadCurrentMetadata(ctx, client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("loadCurrentMetadata: %v", err)
+	}
+	manifests, err := loadCurrentManifests(ctx, client, setup.BucketName, state.DataPath, state.Metadata)
+	if err != nil {
+		t.Fatalf("loadCurrentManifests: %v", err)
+	}
+	var out []iceberg.ManifestEntry
+	for _, mf := range manifests {
+		if mf.ManifestContent() != iceberg.ManifestContentData {
+			continue
+		}
+		data, err := loadFileByIcebergPath(ctx, client, setup.BucketName, state.DataPath, mf.FilePath())
+		if err != nil {
+			t.Fatalf("load manifest: %v", err)
+		}
+		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(data), true)
+		if err != nil {
+			t.Fatalf("read manifest: %v", err)
+		}
+		out = append(out, entries...)
+	}
+	return out
+}
diff --git a/weed/worker/tasks/iceberg/handler.go b/weed/worker/tasks/iceberg/handler.go
index d2bfe8850f..1923a4abfe 100644
--- a/weed/worker/tasks/iceberg/handler.go
+++ b/weed/worker/tasks/iceberg/handler.go
@@ -187,11 +187,26 @@ func (h *Handler) Descriptor() *plugin_pb.JobTypeDescriptor {
 						{
 							Name:        "rewrite_strategy",
 							Label:       "Rewrite Strategy",
-							Description: "binpack keeps the existing row order; sort rewrites each compaction bin using the Iceberg table sort order.",
+							Description: "binpack keeps the existing row order; sort rewrites each compaction bin using the Iceberg table sort order; auto sorts tables that declare one and bin-packs the rest.",
 							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
 							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,
 							Placeholder: "binpack or sort",
 						},
+						{
+							Name:        "sort_buffer_rows",
+							Label:       "Sort Buffer Rows",
+							Description: "Rows a sorted rewrite holds in memory before spilling a sorted run to disk. The writer merges at most 32K runs, so this also bounds how many rows one output file can hold.",
+							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_INT64,
+							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_NUMBER,
+							MinValue:    &plugin_pb.ConfigValue{Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: minSortBufferRows}},
+						},
+						{
+							Name:        "sort_spill_dir",
+							Label:       "Sort Spill Directory",
+							Description: "Directory holding a sorted rewrite's temporary runs. Empty uses the system temp directory.",
+							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
+							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,
+						},
 						{
 							Name:        "sort_max_input_mb",
 							Label:       "Sort Max Input (MB)",
@@ -292,6 +307,13 @@ func (h *Handler) Descriptor() *plugin_pb.JobTypeDescriptor {
 							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
 							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,
 						},
+						{
+							Name:        "table_properties_override",
+							Label:       "Table Properties Win",
+							Description: "Let a table's own Iceberg properties override these settings and its maintenance configuration. Clear to make the maintenance configuration authoritative.",
+							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_BOOL,
+							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TOGGLE,
+						},
 						{
 							Name:        "where",
 							Label:       "Where Filter",
@@ -317,14 +339,17 @@ func (h *Handler) Descriptor() *plugin_pb.JobTypeDescriptor {
 				"max_commit_retries":            {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: defaultMaxCommitRetries}},
 				"operations":                    {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: defaultOperations}},
 				"apply_deletes":                 {Kind: &plugin_pb.ConfigValue_BoolValue{BoolValue: true}},
+				"table_properties_override":     {Kind: &plugin_pb.ConfigValue_BoolValue{BoolValue: true}},
 				"rewrite_strategy":              {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: defaultRewriteStrategy}},
 				"sort_max_input_mb":             {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0}},
+				"sort_buffer_rows":              {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: defaultSortBufferRows}},
+				"sort_spill_dir":                {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""}},
 				"where":                         {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""}},
 			},
 		},
 		AdminRuntimeDefaults: &plugin_pb.AdminRuntimeDefaults{
 			Enabled:                       false, // disabled by default
-			DetectionIntervalMinutes:      60, // 1 hour
+			DetectionIntervalMinutes:      60,    // 1 hour
 			DetectionTimeoutSeconds:       300,
 			MaxJobsPerDetection:           100,
 			GlobalExecutionConcurrency:    4,
@@ -347,8 +372,11 @@ func (h *Handler) Descriptor() *plugin_pb.JobTypeDescriptor {
 			"max_commit_retries":            {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: defaultMaxCommitRetries}},
 			"operations":                    {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: defaultOperations}},
 			"apply_deletes":                 {Kind: &plugin_pb.ConfigValue_BoolValue{BoolValue: true}},
+			"table_properties_override":     {Kind: &plugin_pb.ConfigValue_BoolValue{BoolValue: true}},
 			"rewrite_strategy":              {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: defaultRewriteStrategy}},
 			"sort_max_input_mb":             {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: 0}},
+			"sort_buffer_rows":              {Kind: &plugin_pb.ConfigValue_Int64Value{Int64Value: defaultSortBufferRows}},
+			"sort_spill_dir":                {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""}},
 			"where":                         {Kind: &plugin_pb.ConfigValue_StringValue{StringValue: ""}},
 		},
 	}
@@ -519,11 +547,32 @@ func (h *Handler) Execute(ctx context.Context, request *plugin_pb.ExecuteJobRequ
 	defer conn.Close()
 	filerClient := filer_pb.NewSeaweedFilerClient(conn)
 
+	// Resolve once for the whole job: compaction commits new metadata as it
+	// runs, and a job should not change settings halfway through. Both reads
+	// fail the job rather than fall back, since without the configuration a
+	// disabled operation would run anyway, and without the properties the
+	// operations would rewrite the table to a size it did not ask for.
+	maintenance, err := loadMaintenanceConfiguration(ctx, filerClient, bucketName, tablePath)
+	if err != nil {
+		return fmt.Errorf("read maintenance configuration for %s/%s: %w", bucketName, tablePath, err)
+	}
+	ops = filterDisabledOperations(ops, maintenance)
+
+	state, err := loadCurrentMetadata(ctx, filerClient, bucketName, tablePath)
+	if err != nil {
+		return fmt.Errorf("read table properties for %s/%s: %w", bucketName, tablePath, err)
+	}
+	workerConfig = resolveTableConfig(workerConfig, state.Metadata.Properties(), maintenance)
+
 	var results []string
+	if len(ops) == 0 {
+		results = append(results, "all maintenance operations are disabled for this table")
+	}
 	var lastErr error
 	totalOps := len(ops)
 	completedOps := 0
 	allMetrics := make(map[string]int64)
+	opErrors := make(map[string]error, totalOps)
 
 	// Execute operations in canonical maintenance order as defined by
 	// parseOperations.
@@ -585,6 +634,7 @@ func (h *Handler) Execute(ctx context.Context, request *plugin_pb.ExecuteJobRequ
 		}
 
 		completedOps++
+		opErrors[op] = opErr
 		if opErr != nil {
 			glog.Warningf("iceberg maintenance %s failed for %s/%s/%s: %v", op, bucketName, namespace, tableName, opErr)
 			results = append(results, fmt.Sprintf("%s: error: %v", op, opErr))
@@ -594,6 +644,8 @@ func (h *Handler) Execute(ctx context.Context, request *plugin_pb.ExecuteJobRequ
 		}
 	}
 
+	recordJobStatus(ctx, filerClient, bucketName, tablePath, buildJobStatus(opErrors, time.Now().UTC()))
+
 	resultSummary := strings.Join(results, "; ")
 	success := lastErr == nil
 
diff --git a/weed/worker/tasks/iceberg/handler_test.go b/weed/worker/tasks/iceberg/handler_test.go
index 365949be09..3d88044ab2 100644
--- a/weed/worker/tasks/iceberg/handler_test.go
+++ b/weed/worker/tasks/iceberg/handler_test.go
@@ -3,9 +3,13 @@ package iceberg
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
+	"os"
 	"path"
+	"path/filepath"
+	"strconv"
 	"testing"
 	"time"
 
@@ -19,8 +23,8 @@ import (
 func TestParseConfig(t *testing.T) {
 	config := ParseConfig(nil)
 
-	if config.SnapshotRetentionHours != defaultSnapshotRetentionHours {
-		t.Errorf("expected SnapshotRetentionHours=%d, got %d", defaultSnapshotRetentionHours, config.SnapshotRetentionHours)
+	if config.SnapshotRetentionMs != hoursToMs(defaultSnapshotRetentionHours) {
+		t.Errorf("expected SnapshotRetentionMs=%d, got %d", hoursToMs(defaultSnapshotRetentionHours), config.SnapshotRetentionMs)
 	}
 	if config.MaxSnapshotsToKeep != defaultMaxSnapshotsToKeep {
 		t.Errorf("expected MaxSnapshotsToKeep=%d, got %d", defaultMaxSnapshotsToKeep, config.MaxSnapshotsToKeep)
@@ -115,11 +119,11 @@ func TestExtractMetadataVersion(t *testing.T) {
 
 func TestNeedsMaintenanceNoSnapshots(t *testing.T) {
 	config := Config{
-		SnapshotRetentionHours: 24,
-		MaxSnapshotsToKeep:     2,
+		SnapshotRetentionMs: hoursToMs(24),
+		MaxSnapshotsToKeep:  2,
 	}
 
-	meta := buildTestMetadata(t, nil)
+	meta := buildTestMetadata(t, nil, nil, 0, nil, nil, nil)
 	if needsMaintenance(meta, config) {
 		t.Error("expected no maintenance for table with no snapshots")
 	}
@@ -127,8 +131,8 @@ func TestNeedsMaintenanceNoSnapshots(t *testing.T) {
 
 func TestNeedsMaintenanceExceedsMaxSnapshots(t *testing.T) {
 	config := Config{
-		SnapshotRetentionHours: 24 * 365, // very long retention
-		MaxSnapshotsToKeep:     2,
+		SnapshotRetentionMs: hoursToMs(24),
+		MaxSnapshotsToKeep:  2,
 	}
 
 	now := time.Now().UnixMilli()
@@ -137,23 +141,65 @@ func TestNeedsMaintenanceExceedsMaxSnapshots(t *testing.T) {
 		{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
 		{SnapshotID: 3, TimestampMs: now + 2, ManifestList: "metadata/snap-3.avro"},
 	}
-	meta := buildTestMetadata(t, snapshots)
+	meta := buildTestMetadata(t, snapshots, nil, 48*time.Hour, nil, nil, nil)
 	if !needsMaintenance(meta, config) {
 		t.Error("expected maintenance for table exceeding max snapshots")
 	}
 }
 
+// Expiry always requires a snapshot to be past the retention window, so a table
+// over the quota whose snapshots are all young has nothing to do.
+func TestNeedsMaintenanceExceedsMaxSnapshotsWithinRetention(t *testing.T) {
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(24 * 365), // very long retention
+		MaxSnapshotsToKeep:  2,
+	}
+
+	now := time.Now().UnixMilli()
+	snapshots := []table.Snapshot{
+		{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
+		{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
+		{SnapshotID: 3, TimestampMs: now + 2, ManifestList: "metadata/snap-3.avro"},
+	}
+	if needsMaintenance(buildTestMetadata(t, snapshots, nil, 0, nil, nil, nil), config) {
+		t.Error("expected no maintenance while every snapshot is inside the retention window")
+	}
+}
+
+// Every expirable snapshot is pinned by a tag, so a job could only no-op.
+func TestNeedsMaintenanceSkipsRefPinnedSnapshots(t *testing.T) {
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  1,
+	}
+
+	now := time.Now().Add(-30 * time.Second).UnixMilli()
+	snapshots := []table.Snapshot{
+		{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
+		{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
+	}
+	refs := map[string]table.SnapshotRef{
+		"release": {SnapshotID: 1, SnapshotRefType: table.TagRef},
+	}
+	if needsMaintenance(buildTestMetadata(t, snapshots, refs, 0, nil, nil, nil), config) {
+		t.Error("expected no maintenance when the only old snapshot is tagged")
+	}
+	if !needsMaintenance(buildTestMetadata(t, snapshots, nil, 0, nil, nil, nil), config) {
+		t.Error("expected maintenance for the same table without the tag")
+	}
+}
+
 func TestNeedsMaintenanceWithinLimits(t *testing.T) {
 	config := Config{
-		SnapshotRetentionHours: 24 * 365, // very long retention
-		MaxSnapshotsToKeep:     5,
+		SnapshotRetentionMs: hoursToMs(24 * 365), // very long retention
+		MaxSnapshotsToKeep:  5,
 	}
 
 	now := time.Now().UnixMilli()
 	snapshots := []table.Snapshot{
 		{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
 	}
-	meta := buildTestMetadata(t, snapshots)
+	meta := buildTestMetadata(t, snapshots, nil, 0, nil, nil, nil)
 	if needsMaintenance(meta, config) {
 		t.Error("expected no maintenance for table within limits")
 	}
@@ -162,21 +208,38 @@ func TestNeedsMaintenanceWithinLimits(t *testing.T) {
 func TestNeedsMaintenanceOldSnapshot(t *testing.T) {
 	// Use a retention of 0 hours so that any snapshot is considered "old"
 	config := Config{
-		SnapshotRetentionHours: 0, // instant expiry
-		MaxSnapshotsToKeep:     10,
+		SnapshotRetentionMs: hoursToMs(0), // instant expiry
+		MaxSnapshotsToKeep:  1,
 	}
 
-	now := time.Now().UnixMilli()
+	now := time.Now().Add(-30 * time.Second).UnixMilli()
 	snapshots := []table.Snapshot{
-		{SnapshotID: 1, TimestampMs: now - 1, ManifestList: "metadata/snap-1.avro"},
+		{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
+		{SnapshotID: 2, TimestampMs: now + 1, ManifestList: "metadata/snap-2.avro"},
 	}
-	meta := buildTestMetadata(t, snapshots)
-	// With 0 retention, any snapshot with timestamp < now should need maintenance
+	meta := buildTestMetadata(t, snapshots, nil, 0, nil, nil, nil)
 	if !needsMaintenance(meta, config) {
 		t.Error("expected maintenance for table with expired snapshot")
 	}
 }
 
+// The current snapshot is never expirable, so a single-snapshot table has no
+// work no matter how far past retention it is.
+func TestNeedsMaintenanceSingleSnapshot(t *testing.T) {
+	config := Config{
+		SnapshotRetentionMs: hoursToMs(0),
+		MaxSnapshotsToKeep:  10,
+	}
+
+	now := time.Now().Add(-30 * time.Second).UnixMilli()
+	snapshots := []table.Snapshot{
+		{SnapshotID: 1, TimestampMs: now, ManifestList: "metadata/snap-1.avro"},
+	}
+	if needsMaintenance(buildTestMetadata(t, snapshots, nil, 0, nil, nil, nil), config) {
+		t.Error("expected no maintenance for a table with only the current snapshot")
+	}
+}
+
 func TestCapabilityAndDescriptor(t *testing.T) {
 	handler := NewHandler(nil)
 
@@ -217,7 +280,7 @@ func TestBuildMaintenanceProposal(t *testing.T) {
 		{SnapshotID: 1, TimestampMs: now},
 		{SnapshotID: 2, TimestampMs: now + 1},
 	}
-	meta := buildTestMetadata(t, snapshots)
+	meta := buildTestMetadata(t, snapshots, nil, 0, nil, nil, nil)
 
 	info := tableInfo{
 		BucketName: "my-bucket",
@@ -638,7 +701,7 @@ func TestBuildCompactionBins(t *testing.T) {
 		{path: "data/f3.parquet", size: 4096, partition: map[int]any{}},
 	})
 
-	bins := buildCompactionBins(entries, targetSize, minFiles)
+	bins := buildCompactionBins(entries, targetSize, minFiles, nil)
 	if len(bins) != 1 {
 		t.Fatalf("expected 1 bin, got %d", len(bins))
 	}
@@ -657,7 +720,7 @@ func TestBuildCompactionBinsFiltersLargeFiles(t *testing.T) {
 		{path: "data/large.parquet", size: 5000, partition: map[int]any{}},
 	})
 
-	bins := buildCompactionBins(entries, targetSize, minFiles)
+	bins := buildCompactionBins(entries, targetSize, minFiles, nil)
 	if len(bins) != 1 {
 		t.Fatalf("expected 1 bin, got %d", len(bins))
 	}
@@ -666,6 +729,42 @@ func TestBuildCompactionBinsFiltersLargeFiles(t *testing.T) {
 	}
 }
 
+// NewDataFileBuilder rejects lowercase formats, so wrap what the Avro reader passes through.
+type lowercaseFormatEntry struct {
+	iceberg.ManifestEntry
+}
+
+func (e lowercaseFormatEntry) DataFile() iceberg.DataFile {
+	return lowercaseFormatFile{e.ManifestEntry.DataFile()}
+}
+
+type lowercaseFormatFile struct {
+	iceberg.DataFile
+}
+
+func (f lowercaseFormatFile) FileFormat() iceberg.FileFormat { return "parquet" }
+
+func TestBuildCompactionBinsLowercaseParquetFormat(t *testing.T) {
+	targetSize := int64(256 * 1024 * 1024)
+	minFiles := 2
+
+	entries := makeTestEntries(t, []testEntrySpec{
+		{path: "data/f1.parquet", size: 1024, partition: map[int]any{}},
+		{path: "data/f2.parquet", size: 2048, partition: map[int]any{}},
+		{path: "data/f3.avro", size: 2048, partition: map[int]any{}, format: iceberg.AvroFile},
+	})
+	entries[0] = lowercaseFormatEntry{entries[0]}
+	entries[1] = lowercaseFormatEntry{entries[1]}
+
+	bins := buildCompactionBins(entries, targetSize, minFiles, nil)
+	if len(bins) != 1 {
+		t.Fatalf("expected 1 bin, got %d", len(bins))
+	}
+	if len(bins[0].Entries) != 2 {
+		t.Errorf("expected 2 entries (avro excluded), got %d", len(bins[0].Entries))
+	}
+}
+
 func TestBuildCompactionBinsMinFilesThreshold(t *testing.T) {
 	targetSize := int64(256 * 1024 * 1024)
 	minFiles := 5
@@ -675,7 +774,7 @@ func TestBuildCompactionBinsMinFilesThreshold(t *testing.T) {
 		{path: "data/f2.parquet", size: 2048, partition: map[int]any{}},
 	})
 
-	bins := buildCompactionBins(entries, targetSize, minFiles)
+	bins := buildCompactionBins(entries, targetSize, minFiles, nil)
 	if len(bins) != 0 {
 		t.Errorf("expected 0 bins (below min threshold), got %d", len(bins))
 	}
@@ -702,7 +801,7 @@ func TestBuildCompactionBinsMultiplePartitions(t *testing.T) {
 		{path: "data/b3.parquet", size: 4096, partition: partB, partitionSpec: &partitionSpec},
 	})
 
-	bins := buildCompactionBins(entries, targetSize, minFiles)
+	bins := buildCompactionBins(entries, targetSize, minFiles, nil)
 	if len(bins) != 2 {
 		t.Fatalf("expected 2 bins (one per partition), got %d", len(bins))
 	}
@@ -766,7 +865,8 @@ type testEntrySpec struct {
 	size          int64
 	partition     map[int]any
 	partitionSpec *iceberg.PartitionSpec
-	specID        int32 // partition spec ID; 0 uses UnpartitionedSpec
+	specID        int32              // partition spec ID; 0 uses UnpartitionedSpec
+	format        iceberg.FileFormat // empty uses ParquetFile
 }
 
 func buildTestDataFile(t *testing.T, spec testEntrySpec) iceberg.DataFile {
@@ -778,11 +878,15 @@ func buildTestDataFile(t *testing.T, spec testEntrySpec) iceberg.DataFile {
 	} else if len(spec.partition) > 0 {
 		t.Fatalf("partition spec is required for partitioned test entry %s", spec.path)
 	}
+	format := spec.format
+	if format == "" {
+		format = iceberg.ParquetFile
+	}
 	dfBuilder, err := iceberg.NewDataFileBuilder(
 		*partitionSpec,
 		iceberg.EntryContentData,
 		spec.path,
-		iceberg.ParquetFile,
+		format,
 		spec.partition,
 		nil, nil,
 		1, // recordCount (must be > 0)
@@ -873,7 +977,7 @@ func TestBuildCompactionBinsMultipleSpecs(t *testing.T) {
 		{path: "data/s1-f2.parquet", size: 2048, partition: map[int]any{}, specID: 1},
 	}, partSpecs)
 
-	bins := buildCompactionBins(entries, targetSize, minFiles)
+	bins := buildCompactionBins(entries, targetSize, minFiles, nil)
 	if len(bins) != 2 {
 		t.Fatalf("expected 2 bins (one per spec), got %d", len(bins))
 	}
@@ -907,7 +1011,7 @@ func TestBuildCompactionBinsSingleSpec(t *testing.T) {
 		{path: "data/f3.parquet", size: 4096, partition: map[int]any{}, specID: 0},
 	}, partSpecs)
 
-	bins := buildCompactionBins(entries, targetSize, minFiles)
+	bins := buildCompactionBins(entries, targetSize, minFiles, nil)
 	if len(bins) != 1 {
 		t.Fatalf("expected 1 bin, got %d", len(bins))
 	}
@@ -964,8 +1068,8 @@ func TestNormalizeDetectionConfigUsesSharedDefaults(t *testing.T) {
 	if config.OrphanOlderThanHours != defaultOrphanOlderThanHours {
 		t.Fatalf("expected OrphanOlderThanHours default, got %d", config.OrphanOlderThanHours)
 	}
-	if config.SnapshotRetentionHours != defaultSnapshotRetentionHours {
-		t.Fatalf("expected SnapshotRetentionHours default, got %d", config.SnapshotRetentionHours)
+	if config.SnapshotRetentionMs != hoursToMs(defaultSnapshotRetentionHours) {
+		t.Fatalf("expected SnapshotRetentionMs default, got %d", config.SnapshotRetentionMs)
 	}
 	if config.MaxSnapshotsToKeep != defaultMaxSnapshotsToKeep {
 		t.Fatalf("expected MaxSnapshotsToKeep default, got %d", config.MaxSnapshotsToKeep)
@@ -1199,7 +1303,7 @@ func TestMergeParquetFilesWithPositionDeletes(t *testing.T) {
 
 	merged, count, err := mergeParquetFiles(
 		context.Background(), client, "test-bucket", "ns/tbl",
-		entries, posDeletes, nil, nil,
+		entries, posDeletes, nil, nil, 0, false,
 	)
 	if err != nil {
 		t.Fatalf("mergeParquetFiles: %v", err)
@@ -1315,7 +1419,7 @@ func TestMergeParquetFilesWithEqualityDeletes(t *testing.T) {
 
 	merged, count, err := mergeParquetFiles(
 		context.Background(), client, "test-bucket", "ns/tbl",
-		entries, nil, eqGroups, schema,
+		entries, nil, eqGroups, schema, 0, false,
 	)
 	if err != nil {
 		t.Fatalf("mergeParquetFiles: %v", err)
@@ -1347,6 +1451,77 @@ func TestMergeParquetFilesWithEqualityDeletes(t *testing.T) {
 	}
 }
 
+// testdata/plain-dictionary.parquet was written by DuckDB, which labels its
+// dictionary pages with the deprecated PLAIN_DICTIONARY encoding. The merge
+// writer inherits that encoding from the input schema, and encoding those
+// pages as plain int32 indices instead of RLE collapses every row of the
+// column onto one dictionary entry.
+func TestMergeParquetFilesDictionaryEncodedInput(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	content, err := os.ReadFile(filepath.Join("testdata", "plain-dictionary.parquet"))
+	if err != nil {
+		t.Fatalf("read fixture: %v", err)
+	}
+
+	dataDir := "/buckets/test-bucket/ns/tbl/data"
+	spec := *iceberg.UnpartitionedSpec
+	var entries []iceberg.ManifestEntry
+	for _, name := range []string{"dict1.parquet", "dict2.parquet"} {
+		fs.putEntry(dataDir, name, &filer_pb.Entry{Name: name, Content: content})
+		dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, "data/"+name, iceberg.ParquetFile, map[int]any{}, nil, nil, 200, int64(len(content)))
+		if err != nil {
+			t.Fatalf("build data file: %v", err)
+		}
+		snapID := int64(1)
+		entries = append(entries, iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil, dfb.Build()))
+	}
+
+	merged, count, err := mergeParquetFiles(
+		context.Background(), client, "test-bucket", "ns/tbl",
+		entries, nil, nil, nil, 0, false,
+	)
+	if err != nil {
+		t.Fatalf("mergeParquetFiles: %v", err)
+	}
+	if count != 400 {
+		t.Fatalf("expected 400 merged rows, got %d", count)
+	}
+
+	type dictRow struct {
+		ID   int64  `parquet:"id"`
+		Name string `parquet:"name"`
+	}
+	tally := func(data []byte, what string) map[dictRow]int {
+		counts := map[dictRow]int{}
+		reader := parquet.NewReader(bytes.NewReader(data))
+		defer reader.Close()
+		for {
+			var r dictRow
+			err := reader.Read(&r)
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				t.Fatalf("read %s row: %v", what, err)
+			}
+			counts[r]++
+		}
+		return counts
+	}
+
+	source := tally(content, "fixture")
+	got := tally(merged, "merged")
+	if len(got) != len(source) {
+		t.Fatalf("expected %d distinct rows, got %d", len(source), len(got))
+	}
+	for row, n := range source {
+		if got[row] != 2*n {
+			t.Errorf("row %+v appears %d times, expected %d", row, got[row], 2*n)
+		}
+	}
+}
+
 func TestDetectNilRequest(t *testing.T) {
 	handler := NewHandler(nil)
 	err := handler.Detect(nil, nil, nil)
@@ -1367,13 +1542,23 @@ func TestExecuteNilRequest(t *testing.T) {
 // Test helpers
 // ---------------------------------------------------------------------------
 
-// buildTestMetadata creates a minimal Iceberg metadata for testing.
-// When snapshots is nil or empty, the metadata has no snapshots.
-func buildTestMetadata(t *testing.T, snapshots []table.Snapshot) table.Metadata {
+// buildTestMetadata creates a minimal Iceberg metadata for testing. When
+// snapshots is nil or empty the metadata has no snapshots; refs adds branches
+// and tags on top of the main branch, which always points at the last snapshot.
+// A positive age backdates the result, letting a test describe snapshots that
+// are genuinely past a retention window - iceberg-go refuses to add a snapshot
+// stamped more than a minute before the metadata's last-updated time, so the
+// shift has to happen after the build.
+func buildTestMetadata(t *testing.T, snapshots []table.Snapshot, refs map[string]table.SnapshotRef, age time.Duration, properties iceberg.Properties, schema *iceberg.Schema, spec *iceberg.PartitionSpec) table.Metadata {
 	t.Helper()
 
-	schema := newTestSchema()
-	meta, err := table.NewMetadata(schema, iceberg.UnpartitionedSpec, table.UnsortedSortOrder, "s3://test-bucket/test-table", nil)
+	if schema == nil {
+		schema = newTestSchema()
+	}
+	if spec == nil {
+		spec = iceberg.UnpartitionedSpec
+	}
+	meta, err := table.NewMetadata(schema, spec, table.UnsortedSortOrder, "s3://test-bucket/test-table", properties)
 	if err != nil {
 		t.Fatalf("failed to create test metadata: %v", err)
 	}
@@ -1400,11 +1585,80 @@ func buildTestMetadata(t *testing.T, snapshots []table.Snapshot) table.Metadata
 		t.Fatalf("failed to set snapshot ref: %v", err)
 	}
 
+	// The option type is unexported, so each combination is spelled out.
+	for name, ref := range refs {
+		var refErr error
+		switch {
+		case ref.MinSnapshotsToKeep != nil && ref.MaxSnapshotAgeMs != nil:
+			refErr = builder.SetSnapshotRef(name, ref.SnapshotID, ref.SnapshotRefType,
+				table.WithMinSnapshotsToKeep(*ref.MinSnapshotsToKeep), table.WithMaxSnapshotAgeMs(*ref.MaxSnapshotAgeMs))
+		case ref.MinSnapshotsToKeep != nil:
+			refErr = builder.SetSnapshotRef(name, ref.SnapshotID, ref.SnapshotRefType,
+				table.WithMinSnapshotsToKeep(*ref.MinSnapshotsToKeep))
+		case ref.MaxSnapshotAgeMs != nil:
+			refErr = builder.SetSnapshotRef(name, ref.SnapshotID, ref.SnapshotRefType,
+				table.WithMaxSnapshotAgeMs(*ref.MaxSnapshotAgeMs))
+		default:
+			refErr = builder.SetSnapshotRef(name, ref.SnapshotID, ref.SnapshotRefType)
+		}
+		if refErr != nil {
+			t.Fatalf("failed to set ref %s: %v", name, refErr)
+		}
+	}
+
 	result, err := builder.Build()
 	if err != nil {
 		t.Fatalf("failed to build metadata: %v", err)
 	}
-	return result
+	metadata := result
+	if age <= 0 {
+		return metadata
+	}
+
+	encoded, err := json.Marshal(metadata)
+	if err != nil {
+		t.Fatalf("marshal metadata: %v", err)
+	}
+
+	decoder := json.NewDecoder(bytes.NewReader(encoded))
+	decoder.UseNumber()
+	var doc map[string]any
+	if err := decoder.Decode(&doc); err != nil {
+		t.Fatalf("decode metadata: %v", err)
+	}
+
+	shiftMs := age.Milliseconds()
+	shift := func(container map[string]any, key string) {
+		raw, ok := container[key].(json.Number)
+		if !ok {
+			return
+		}
+		value, err := raw.Int64()
+		if err != nil {
+			t.Fatalf("parse %s: %v", key, err)
+		}
+		container[key] = json.Number(strconv.FormatInt(value-shiftMs, 10))
+	}
+
+	shift(doc, "last-updated-ms")
+	for _, listKey := range []string{"snapshots", "snapshot-log", "metadata-log"} {
+		entries, _ := doc[listKey].([]any)
+		for _, entry := range entries {
+			if item, ok := entry.(map[string]any); ok {
+				shift(item, "timestamp-ms")
+			}
+		}
+	}
+
+	aged, err := json.Marshal(doc)
+	if err != nil {
+		t.Fatalf("marshal aged metadata: %v", err)
+	}
+	parsed, err := table.ParseMetadataBytes(aged)
+	if err != nil {
+		t.Fatalf("parse aged metadata: %v", err)
+	}
+	return parsed
 }
 
 func newTestSchema() *iceberg.Schema {
diff --git a/weed/worker/tasks/iceberg/job_status.go b/weed/worker/tasks/iceberg/job_status.go
new file mode 100644
index 0000000000..d60b831824
--- /dev/null
+++ b/weed/worker/tasks/iceberg/job_status.go
@@ -0,0 +1,126 @@
+package iceberg
+
+import (
+	"context"
+	"encoding/json"
+	"path"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// jobStatusUpdateAttempts bounds the read-modify-write retry loop for the job
+// status attribute. Asserting the whole attribute set makes a lost race more
+// likely, so allow a couple of retries before giving up.
+const jobStatusUpdateAttempts = 3
+
+// buildJobStatus folds the operations this job ran into the AWS job types that
+// govern them. Operations that did not run are left out so a partial run does
+// not erase what an earlier one recorded.
+func buildJobStatus(opErrors map[string]error, ranAt time.Time) s3tables.MaintenanceJobStatus {
+	jobStatus := s3tables.MaintenanceJobStatus{}
+
+	for op, opErr := range opErrors {
+		jobType := maintenanceJobType(op)
+		if jobType == "" {
+			continue
+		}
+
+		value, ok := jobStatus[jobType]
+		if !ok {
+			timestamp := ranAt
+			value = &s3tables.MaintenanceJobStatusValue{
+				Status:           s3tables.MaintenanceJobStatusSuccessful,
+				LastRunTimestamp: &timestamp,
+			}
+			jobStatus[jobType] = value
+		}
+
+		// Several operations can map to one job type; one failure fails the type.
+		if opErr != nil && value.Status != s3tables.MaintenanceJobStatusFailed {
+			value.Status = s3tables.MaintenanceJobStatusFailed
+			value.FailureMessage = opErr.Error()
+		}
+	}
+
+	return jobStatus
+}
+
+// recordJobStatus merges this job's outcome into the table's stored status.
+// Status is advisory, so a lost race is logged rather than failing a job whose
+// work already committed.
+func recordJobStatus(
+	ctx context.Context,
+	client filer_pb.SeaweedFilerClient,
+	bucketName, tablePath string,
+	jobStatus s3tables.MaintenanceJobStatus,
+) {
+	if len(jobStatus) == 0 {
+		return
+	}
+
+	tableDir := path.Join(s3tables.TablesPath, bucketName, tablePath)
+	dir, name := path.Dir(tableDir), path.Base(tableDir)
+
+	for attempt := 0; attempt < jobStatusUpdateAttempts; attempt++ {
+		resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
+			Directory: dir,
+			Name:      name,
+		})
+		if err != nil {
+			glog.V(1).Infof("iceberg maintenance: cannot record job status for %s/%s: %v", bucketName, tablePath, err)
+			return
+		}
+		if resp == nil || resp.Entry == nil {
+			return
+		}
+
+		entry := resp.Entry
+		current := entry.Extended[s3tables.ExtendedKeyMaintenanceStatus]
+		// Assert every attribute, not just our own: UpdateEntry rewrites the
+		// whole entry, so a narrow assertion would let this write revert a
+		// maintenance configuration an operator just disabled.
+		expected := s3tables.SnapshotExtended(entry.Extended, s3tables.ExtendedKeyMaintenanceStatus)
+
+		merged := s3tables.MaintenanceJobStatus{}
+		if len(current) > 0 {
+			if err := json.Unmarshal(current, &merged); err != nil {
+				glog.V(1).Infof("iceberg maintenance: replacing unreadable job status on %s/%s: %v", bucketName, tablePath, err)
+				merged = s3tables.MaintenanceJobStatus{}
+			}
+		}
+		for jobType, value := range jobStatus {
+			merged[jobType] = value
+		}
+
+		data, err := json.Marshal(merged)
+		if err != nil {
+			glog.V(1).Infof("iceberg maintenance: cannot marshal job status for %s/%s: %v", bucketName, tablePath, err)
+			return
+		}
+
+		if entry.Extended == nil {
+			entry.Extended = make(map[string][]byte)
+		}
+		entry.Extended[s3tables.ExtendedKeyMaintenanceStatus] = data
+
+		_, err = client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{
+			Directory:        dir,
+			Entry:            entry,
+			ExpectedExtended: expected,
+		})
+		if err == nil {
+			return
+		}
+		if status.Code(err) != codes.FailedPrecondition {
+			glog.V(1).Infof("iceberg maintenance: cannot record job status for %s/%s: %v", bucketName, tablePath, err)
+			return
+		}
+	}
+
+	glog.V(1).Infof("iceberg maintenance: gave up recording job status for %s/%s after %d attempts", bucketName, tablePath, jobStatusUpdateAttempts)
+}
diff --git a/weed/worker/tasks/iceberg/operations.go b/weed/worker/tasks/iceberg/operations.go
index fcfa698f68..8b7bb22f24 100644
--- a/weed/worker/tasks/iceberg/operations.go
+++ b/weed/worker/tasks/iceberg/operations.go
@@ -9,6 +9,7 @@ import (
 	"math/rand/v2"
 	"path"
 	"sort"
+	"strings"
 	"time"
 
 	"github.com/apache/iceberg-go"
@@ -51,47 +52,13 @@ func (h *Handler) expireSnapshots(
 		return "no snapshots", nil, nil
 	}
 
-	// Determine which snapshots to expire
 	currentSnap := meta.CurrentSnapshot()
 	var currentSnapID int64
 	if currentSnap != nil {
 		currentSnapID = currentSnap.SnapshotID
 	}
 
-	retentionMs := config.SnapshotRetentionHours * 3600 * 1000
-	nowMs := time.Now().UnixMilli()
-
-	// Sort snapshots by timestamp descending (most recent first) so that
-	// the keep-count logic always preserves the newest snapshots.
-	sorted := make([]table.Snapshot, len(snapshots))
-	copy(sorted, snapshots)
-	sort.Slice(sorted, func(i, j int) bool {
-		return sorted[i].TimestampMs > sorted[j].TimestampMs
-	})
-
-	// Walk from newest to oldest. The current snapshot is always kept.
-	// Among the remaining, keep up to MaxSnapshotsToKeep-1 (since current
-	// counts toward the quota). Expire the rest only if they exceed the
-	// retention window; snapshots within the window are kept regardless.
-	var toExpire []int64
-	var kept int64
-	for _, snap := range sorted {
-		if snap.SnapshotID == currentSnapID {
-			kept++
-			continue
-		}
-		age := nowMs - snap.TimestampMs
-		if kept < config.MaxSnapshotsToKeep {
-			kept++
-			continue
-		}
-		if age > retentionMs {
-			toExpire = append(toExpire, snap.SnapshotID)
-		} else {
-			kept++
-		}
-	}
-
+	toExpire := snapshotsToExpire(meta, config, time.Now().UnixMilli())
 	if len(toExpire) == 0 {
 		return "no snapshots expired", nil, nil
 	}
@@ -102,7 +69,7 @@ func (h *Handler) expireSnapshots(
 		expireSet[id] = struct{}{}
 	}
 	var expiredSnaps, keptSnaps []table.Snapshot
-	for _, snap := range sorted {
+	for _, snap := range snapshots {
 		if _, ok := expireSet[snap.SnapshotID]; ok {
 			expiredSnaps = append(expiredSnaps, snap)
 		} else {
@@ -124,9 +91,7 @@ func (h *Handler) expireSnapshots(
 	// Resolve kept file paths for consistent comparison
 	keptFilerPaths := make(map[string]struct{}, len(keptFiles))
 	for f := range keptFiles {
-		if filerPath, err := icebergFilerPath(bucketName, dataPath, f); err == nil {
-			keptFilerPaths[filerPath] = struct{}{}
-		}
+		addFilerPathSpellings(keptFilerPaths, bucketName, dataPath, f)
 	}
 
 	// Use MetadataBuilder to remove snapshots and create new metadata
@@ -136,6 +101,15 @@ func (h *Handler) expireSnapshots(
 		if (cs == nil) != (currentSnapID == 0) || (cs != nil && cs.SnapshotID != currentSnapID) {
 			return errStalePlan
 		}
+		// A tag or branch created since planning can pin a snapshot this plan
+		// expires without moving the head, and RemoveSnapshots would drop that
+		// ref along with it. Re-plan instead.
+		nowProtected := protectedSnapshots(currentMeta, time.Now().UnixMilli())
+		for _, id := range toExpire {
+			if _, pinned := nowProtected[id]; pinned {
+				return errStalePlan
+			}
+		}
 		return builder.RemoveSnapshots(toExpire, false)
 	})
 	if err != nil {
@@ -143,11 +117,18 @@ func (h *Handler) expireSnapshots(
 	}
 
 	// Delete files exclusively referenced by expired snapshots (best-effort)
+	tableBase := path.Join(s3tables.TablesPath, bucketName, dataPath) + "/"
 	deletedCount := 0
 	for filePath := range expiredFiles {
-		resolved, err := icebergFilerPath(bucketName, dataPath, filePath)
+		resolved, err := resolveFilerPath(ctx, filerClient, bucketName, dataPath, filePath)
 		if err != nil {
-			glog.Warningf("iceberg maintenance: cannot resolve expired file %s: %v", filePath, err)
+			if !isFilerNotFound(err) {
+				glog.Warningf("iceberg maintenance: cannot resolve expired file %s: %v", filePath, err)
+			}
+			continue
+		}
+		if !strings.HasPrefix(resolved, tableBase) {
+			glog.Warningf("iceberg maintenance: refusing to delete %s outside table path", resolved)
 			continue
 		}
 		if _, stillReferenced := keptFilerPaths[resolved]; stillReferenced {
@@ -168,6 +149,106 @@ func (h *Handler) expireSnapshots(
 	return fmt.Sprintf("expired %d snapshot(s), deleted %d unreferenced file(s)", len(toExpire), deletedCount), metrics, nil
 }
 
+// snapshotsToExpire returns the snapshot IDs that fall outside the configured
+// retention. Detection and execution both call it so a table is only proposed
+// for expiry when the run would actually remove something.
+func snapshotsToExpire(meta table.Metadata, config Config, nowMs int64) []int64 {
+	var currentSnapID int64
+	if currentSnap := meta.CurrentSnapshot(); currentSnap != nil {
+		currentSnapID = currentSnap.SnapshotID
+	}
+	retentionMs := config.SnapshotRetentionMs
+	protected := protectedSnapshots(meta, nowMs)
+
+	// Sort snapshots by timestamp descending (most recent first) so that
+	// the keep-count logic always preserves the newest snapshots.
+	sorted := make([]table.Snapshot, len(meta.Snapshots()))
+	copy(sorted, meta.Snapshots())
+	sort.Slice(sorted, func(i, j int) bool {
+		return sorted[i].TimestampMs > sorted[j].TimestampMs
+	})
+
+	// Walk from newest to oldest. The current snapshot is always kept.
+	// Among the remaining, keep up to MaxSnapshotsToKeep-1 (since current
+	// counts toward the quota). Expire the rest only if they exceed the
+	// retention window; snapshots within the window are kept regardless.
+	var toExpire []int64
+	var kept int64
+	for _, snap := range sorted {
+		if snap.SnapshotID == currentSnapID {
+			kept++
+			continue
+		}
+		if _, isProtected := protected[snap.SnapshotID]; isProtected {
+			kept++
+			continue
+		}
+		if kept < config.MaxSnapshotsToKeep {
+			kept++
+			continue
+		}
+		if nowMs-snap.TimestampMs > retentionMs {
+			toExpire = append(toExpire, snap.SnapshotID)
+		} else {
+			kept++
+		}
+	}
+	return toExpire
+}
+
+// protectedSnapshots returns the snapshots that named refs hold in place.
+// A branch head or a tag pins its snapshot no matter how old it is, and a
+// branch may carry its own retention overrides for the ancestors behind it.
+// iceberg-go's RemoveSnapshots drops any ref whose snapshot is gone without
+// complaint, so expiring one of these would silently delete the tag and then
+// the files it pointed at.
+func protectedSnapshots(meta table.Metadata, nowMs int64) map[int64]struct{} {
+	protected := make(map[int64]struct{})
+	byID := make(map[int64]table.Snapshot)
+	for _, snap := range meta.Snapshots() {
+		byID[snap.SnapshotID] = snap
+	}
+
+	for _, ref := range meta.Refs() {
+		protected[ref.SnapshotID] = struct{}{}
+		if ref.SnapshotRefType != table.BranchRef {
+			continue
+		}
+		// Without overrides the branch keeps only its head here; the ancestors
+		// behind it stay under the worker's own retention config.
+		if ref.MinSnapshotsToKeep == nil && ref.MaxSnapshotAgeMs == nil {
+			continue
+		}
+		minToKeep := 1
+		if ref.MinSnapshotsToKeep != nil {
+			minToKeep = *ref.MinSnapshotsToKeep
+		}
+		seen := make(map[int64]struct{})
+		kept := 0
+		for id := ref.SnapshotID; ; {
+			if _, looped := seen[id]; looped {
+				break
+			}
+			seen[id] = struct{}{}
+			snap, ok := byID[id]
+			if !ok {
+				break
+			}
+			withinAge := ref.MaxSnapshotAgeMs != nil && nowMs-snap.TimestampMs <= *ref.MaxSnapshotAgeMs
+			if kept >= minToKeep && !withinAge {
+				break
+			}
+			protected[snap.SnapshotID] = struct{}{}
+			kept++
+			if snap.ParentSnapshotID == nil {
+				break
+			}
+			id = *snap.ParentSnapshotID
+		}
+	}
+	return protected
+}
+
 // collectSnapshotFiles returns all file paths (manifest lists, manifest files,
 // data files) referenced by the given snapshots. It returns an error if any
 // manifest list or manifest cannot be read/parsed, to prevent delete decisions
@@ -267,15 +348,26 @@ func collectOrphanCandidates(
 	}
 
 	referencedFiles[path.Join("metadata", metadataFileName)] = struct{}{}
+	// Table-root readers (DuckDB iceberg_scan, Hadoop tables) open this to find
+	// the current metadata; nothing in the metadata references it.
+	referencedFiles[path.Join("metadata", "version-hint.text")] = struct{}{}
 	for mle := range meta.PreviousFiles() {
 		referencedFiles[mle.MetadataFile] = struct{}{}
 	}
+	for sf := range meta.Statistics() {
+		referencedFiles[sf.StatisticsPath] = struct{}{}
+	}
+	for psf := range meta.PartitionStatistics() {
+		referencedFiles[psf.StatisticsPath] = struct{}{}
+	}
 
 	referencedFilerPaths := make(map[string]struct{}, len(referencedFiles))
 	for ref := range referencedFiles {
-		if filerPath, err := icebergFilerPath(bucketName, dataPath, ref); err == nil {
-			referencedFilerPaths[filerPath] = struct{}{}
-		}
+		// Writers percent-escape partition directory names (e.g. "a=1" stored
+		// as "a%3D1" in the manifest path), but the S3 layer decodes the key
+		// before it lands on the filer. Match every spelling the resolver can
+		// return, or a live file is counted as an orphan and deleted.
+		addFilerPathSpellings(referencedFilerPaths, bucketName, dataPath, ref)
 	}
 
 	tableBasePath := path.Join(s3tables.TablesPath, bucketName, dataPath)
@@ -367,6 +459,7 @@ func (h *Handler) rewriteManifests(
 
 	// Build a lookup from spec ID to PartitionSpec
 	specByID := specByID(meta)
+	schema := meta.CurrentSchema()
 	var carriedDataManifests []iceberg.ManifestFile
 	var manifestsRewritten int64
 
@@ -375,16 +468,17 @@ func (h *Handler) rewriteManifests(
 		if err != nil {
 			return "", nil, fmt.Errorf("read manifest %s: %w", mf.FilePath(), err)
 		}
-		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+		entries, err := s3tables.ReadManifest(mf, manifestData, true, specByID, schema)
 		if err != nil {
 			return "", nil, fmt.Errorf("parse manifest %s: %w", mf.FilePath(), err)
 		}
+		sid := mf.PartitionSpecID()
+		spec, found := specByID[int(sid)]
+		if !found {
+			return "", nil, fmt.Errorf("partition spec %d not found in table metadata", sid)
+		}
 
 		if predicate != nil {
-			spec, found := specByID[int(mf.PartitionSpecID())]
-			if !found {
-				return "", nil, fmt.Errorf("partition spec %d not found in table metadata", mf.PartitionSpecID())
-			}
 			allMatch := len(entries) > 0
 			for _, entry := range entries {
 				match, err := predicate.Matches(spec, entry.DataFile().Partition())
@@ -402,14 +496,9 @@ func (h *Handler) rewriteManifests(
 			}
 		}
 
-		sid := mf.PartitionSpecID()
 		se, ok := specMap[sid]
 		if !ok {
-			ps, found := specByID[int(sid)]
-			if !found {
-				return "", nil, fmt.Errorf("partition spec %d not found in table metadata", sid)
-			}
-			se = &specEntries{specID: sid, spec: ps}
+			se = &specEntries{specID: sid, spec: spec}
 			specMap[sid] = se
 		}
 		se.entries = append(se.entries, entries...)
@@ -424,7 +513,6 @@ func (h *Handler) rewriteManifests(
 		return "no data entries to rewrite", nil, nil
 	}
 
-	schema := meta.CurrentSchema()
 	version := meta.Version()
 	snapshotID := currentSnap.SnapshotID
 	newSnapshotID := time.Now().UnixMilli()
@@ -489,8 +577,11 @@ func (h *Handler) rewriteManifests(
 		}
 	}
 
+	// v3 row lineage (row_lineage.go): the merged manifests are assigned first_row_id from the table's next-row-id; the
+	// data files keep the first_row_id they carry, so no row is renumbered
+	firstRowID := rowLineageFirstRowID(meta)
 	var manifestListBuf bytes.Buffer
-	err = iceberg.WriteManifestList(version, &manifestListBuf, newSnapshotID, &snapshotID, &newSeqNum, 0, newManifests)
+	addedRows, err := writeManifestList(version, &manifestListBuf, newSnapshotID, &snapshotID, &newSeqNum, firstRowID, newManifests)
 	if err != nil {
 		return "", nil, fmt.Errorf("write manifest list: %w", err)
 	}
@@ -509,9 +600,9 @@ func (h *Handler) rewriteManifests(
 		// Guard: verify table head hasn't advanced since we planned.
 		// The merged manifest and manifest list were built against snapshotID;
 		// if the head moved, they reference stale state.
-		cs := currentMeta.CurrentSnapshot()
-		if cs == nil || cs.SnapshotID != snapshotID {
-			return errStalePlan
+		cs, err := checkCommitPlan(currentMeta, snapshotID, version, firstRowID)
+		if err != nil {
+			return err
 		}
 
 		newSnapshot := &table.Snapshot{
@@ -527,6 +618,7 @@ func (h *Handler) rewriteManifests(
 				return &id
 			}(),
 		}
+		setRowLineage(newSnapshot, version, firstRowID, addedRows)
 		if err := builder.AddSnapshot(newSnapshot); err != nil {
 			return err
 		}
diff --git a/weed/worker/tasks/iceberg/operations_test.go b/weed/worker/tasks/iceberg/operations_test.go
new file mode 100644
index 0000000000..14b22bc4a3
--- /dev/null
+++ b/weed/worker/tasks/iceberg/operations_test.go
@@ -0,0 +1,152 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+)
+
+// Merging manifests a foreign producer wrote used to fail for good on a
+// day-partitioned table, whichever way round the producer spelled the
+// partition union: nothing between reading an entry and writing it looks at
+// its partition, so the time.Time the Avro decoder produced is still there
+// when the manifest writer, which has no date logical type for a day
+// partition, tries to encode it.
+func TestRewriteManifestsNormalizesForeignDayPartitions(t *testing.T) {
+	for _, valueFirst := range []bool{true, false} {
+		name := "null-first partition union"
+		if valueFirst {
+			name = "value-first partition union"
+		}
+		t.Run(name, func(t *testing.T) {
+			rewriteForeignDayPartitions(t, valueFirst)
+		})
+	}
+}
+
+func rewriteForeignDayPartitions(t *testing.T, valueFirst bool) {
+	t.Helper()
+	fs, client := startFakeFiler(t)
+
+	schema := iceberg.NewSchema(0,
+		iceberg.NestedField{ID: 1, Name: "event_time", Type: iceberg.PrimitiveTypes.Timestamp, Required: true},
+	)
+	spec := iceberg.NewPartitionSpec(iceberg.PartitionField{
+		SourceIDs: []int{1}, FieldID: 1000, Name: "event_time_day", Transform: iceberg.DayTransform{},
+	})
+	setup := tableSetup{
+		BucketName: "test-bucket",
+		Namespace:  "analytics",
+		TableName:  "events",
+		Schema:     schema,
+		Spec:       &spec,
+		Snapshots: []table.Snapshot{{
+			SnapshotID:   1,
+			TimestampMs:  time.Now().UnixMilli(),
+			ManifestList: "metadata/snap-1.avro",
+		}},
+	}
+	meta := populateTable(t, fs, setup)
+
+	metaDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "metadata")
+	wantDays := make(map[string]iceberg.Date)
+	var manifests []iceberg.ManifestFile
+	for i := 0; i < 3; i++ {
+		day := iceberg.Date(20737 + i)
+		filePath := setup.fileRef("data", fmt.Sprintf("foreign-%d.parquet", i))
+		dfBuilder, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, filePath, iceberg.ParquetFile,
+			map[int]any{1000: day}, nil, nil, 1, 1)
+		if err != nil {
+			t.Fatalf("build data file %d: %v", i, err)
+		}
+		snapshotID := int64(1)
+		entry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapshotID, nil, nil, dfBuilder.Build())
+
+		manifestName := fmt.Sprintf("foreign-manifest-%d.avro", i)
+		foreignBytes, manifest := s3tablestest.ForeignPartitionManifest(t, schema, spec, entry,
+			setup.fileRef("metadata", manifestName), "date", time.Unix(int64(day)*24*60*60, 0).UTC(), valueFirst)
+		fs.putEntry(metaDir, manifestName, &filer_pb.Entry{
+			Name: manifestName, Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()}, Content: foreignBytes,
+		})
+		manifests = append(manifests, manifest)
+		wantDays[filePath] = day
+	}
+
+	var manifestList bytes.Buffer
+	seqNum := int64(1)
+	if err := iceberg.WriteManifestList(meta.Version(), &manifestList, 1, nil, &seqNum, 0, manifests); err != nil {
+		t.Fatalf("write manifest list: %v", err)
+	}
+	fs.putEntry(metaDir, "snap-1.avro", &filer_pb.Entry{
+		Name: "snap-1.avro", Attributes: &filer_pb.FuseAttributes{Mtime: time.Now().Unix()}, Content: manifestList.Bytes(),
+	})
+
+	result, _, err := NewHandler(nil).rewriteManifests(context.Background(), client, setup.BucketName, setup.tablePath(), Config{
+		MinManifestsToRewrite: 3,
+		MaxCommitRetries:      3,
+	})
+	if err != nil {
+		t.Fatalf("rewriteManifests failed for foreign day partitions: %v", err)
+	}
+	if result != "rewrote 3 manifests into 1 (3 entries)" {
+		t.Fatalf("rewriteManifests result = %q, want 3 manifests merged", result)
+	}
+
+	// The merged manifest has to carry the days the foreign manifests held.
+	// iceberg-go writes a day partition as a bare Avro int, without the date
+	// logical type, but now converts day-transform partitions to iceberg.Date
+	// on read (applyDayTransformDates), so they read back as iceberg.Date.
+	got := make(map[string]any)
+	for _, mf := range currentManifests(t, client, setup) {
+		manifestData, err := loadFileByIcebergPath(context.Background(), client, setup.BucketName, setup.tablePath(), mf.FilePath())
+		if err != nil {
+			t.Fatalf("load merged manifest %s: %v", mf.FilePath(), err)
+		}
+		entries, err := iceberg.ReadManifest(mf, bytes.NewReader(manifestData), true)
+		if err != nil {
+			t.Fatalf("parse merged manifest %s: %v", mf.FilePath(), err)
+		}
+		for _, entry := range entries {
+			got[entry.DataFile().FilePath()] = entry.DataFile().Partition()[1000]
+		}
+	}
+	if len(got) != len(wantDays) {
+		t.Fatalf("merged manifests hold %d entries, want %d", len(got), len(wantDays))
+	}
+	for filePath, day := range wantDays {
+		if got[filePath] != day {
+			t.Errorf("%s partition = %#v (%T), want %d", filePath, got[filePath], got[filePath], day)
+		}
+	}
+}
+
+// currentManifests reads the manifests of the table's current snapshot.
+func currentManifests(t *testing.T, client filer_pb.SeaweedFilerClient, setup tableSetup) []iceberg.ManifestFile {
+	t.Helper()
+	state, err := loadCurrentMetadata(context.Background(), client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("reload metadata: %v", err)
+	}
+	snapshot := state.Metadata.CurrentSnapshot()
+	if snapshot == nil {
+		t.Fatal("table has no current snapshot")
+	}
+	manifestListData, err := loadFileByIcebergPath(context.Background(), client, setup.BucketName, setup.tablePath(), snapshot.ManifestList)
+	if err != nil {
+		t.Fatalf("load manifest list: %v", err)
+	}
+	manifests, err := s3tables.ReadManifestList(manifestListData)
+	if err != nil {
+		t.Fatalf("parse manifest list: %v", err)
+	}
+	return manifests
+}
diff --git a/weed/worker/tasks/iceberg/planning_index.go b/weed/worker/tasks/iceberg/planning_index.go
index 320cafda26..885e2817e8 100644
--- a/weed/worker/tasks/iceberg/planning_index.go
+++ b/weed/worker/tasks/iceberg/planning_index.go
@@ -3,8 +3,10 @@ package iceberg
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"path"
+	"strings"
 	"time"
 
 	"github.com/apache/iceberg-go"
@@ -36,6 +38,10 @@ type planningIndexRewriteManifests struct {
 }
 
 type tableMetadataEnvelope struct {
+	// Format is the catalog's own record of what the table is. A native Lance
+	// table has no Iceberg metadata at all, so without this the parse below
+	// fails and the table is skipped as if it were corrupt.
+	Format           string `json:"format"`
 	MetadataVersion  int    `json:"metadataVersion"`
 	MetadataLocation string `json:"metadataLocation,omitempty"`
 	Metadata         *struct {
@@ -54,11 +60,37 @@ type tableState struct {
 	PlanningIndex *planningIndex
 }
 
+// tableTypeProperty is the Hive/Glue-style format marker. Catalogs that have no
+// native concept of a non-Iceberg table register one as an Iceberg table with a
+// placeholder schema and set this property instead; the Lance namespace's
+// Iceberg REST adapter writes table_type=lance.
+const tableTypeProperty = "table_type"
+
+// errForeignFormat means the catalog entry belongs to a format this worker does
+// not maintain. It is a normal outcome of scanning a mixed catalog, not damage.
+var errForeignFormat = errors.New("not an iceberg table")
+
+// isIcebergTableEntry reports whether a catalog entry is an Iceberg table this
+// worker may rewrite. Views share the entry shape, and a foreign format
+// registered through the catalog shares the location but not the file layout -
+// a Lance dataset keeps its fragments under data/, where every one of them is
+// unreferenced by the Iceberg metadata and so looks like an orphan.
+func isIcebergTableEntry(extended map[string][]byte, meta table.Metadata) bool {
+	if s3tables.EntryType(extended) != s3tables.EntryTypeTable {
+		return false
+	}
+	tableType, ok := meta.Properties()[tableTypeProperty]
+	return !ok || strings.EqualFold(tableType, "iceberg")
+}
+
 func parseTableMetadataEnvelope(metadataBytes []byte, bucketName, tablePath string) (*tableState, error) {
 	var envelope tableMetadataEnvelope
 	if err := json.Unmarshal(metadataBytes, &envelope); err != nil {
 		return nil, fmt.Errorf("parse metadata xattr: %w", err)
 	}
+	if envelope.Format != "" && envelope.Format != s3tables.FormatIceberg {
+		return nil, fmt.Errorf("%w: %s", errForeignFormat, envelope.Format)
+	}
 	if envelope.Metadata == nil || len(envelope.Metadata.FullMetadata) == 0 {
 		return nil, fmt.Errorf("no fullMetadata in table xattr")
 	}
@@ -257,12 +289,7 @@ func persistPlanningIndex(
 		return fmt.Errorf("marshal updated metadata xattr: %w", err)
 	}
 
-	expectedExtended := map[string][]byte{
-		s3tables.ExtendedKeyMetadata: existingXattr,
-	}
-	if expectedVersionXattr, ok := resp.Entry.Extended[s3tables.ExtendedKeyMetadataVersion]; ok && len(expectedVersionXattr) > 0 {
-		expectedExtended[s3tables.ExtendedKeyMetadataVersion] = expectedVersionXattr
-	}
+	expectedExtended := s3tables.SnapshotExtended(resp.Entry.Extended)
 	resp.Entry.Extended[s3tables.ExtendedKeyMetadata] = updatedXattr
 	_, err = client.UpdateEntry(ctx, &filer_pb.UpdateEntryRequest{
 		Directory:        parentDir,
diff --git a/weed/worker/tasks/iceberg/row_lineage.go b/weed/worker/tasks/iceberg/row_lineage.go
new file mode 100644
index 0000000000..f6aa85c2aa
--- /dev/null
+++ b/weed/worker/tasks/iceberg/row_lineage.go
@@ -0,0 +1,451 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"reflect"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/parquet-go/parquet-go"
+	"github.com/parquet-go/parquet-go/compress"
+	"github.com/parquet-go/parquet-go/compress/zstd"
+)
+
+// Row lineage (Iceberg v3, spec "Row Lineage" and "Snapshot Row IDs").
+//
+// Every snapshot committed to a v3 table carries first-row-id, the table's next-row-id when the commit is attempted,
+// and added-rows, the upper bound of the row IDs its manifest list assigns; committing advances next-row-id by
+// added-rows. iceberg-go refuses a v3 snapshot without them ("invalid row lineage: first-row-id is required for v3
+// snapshots"), which is what every maintenance commit on a v3 table hit. The manifest list assigns first_row_id to the
+// data manifests that have none, starting at the snapshot's first-row-id; passing 0 there (as the maintenance code did)
+// would hand rows IDs other rows already hold.
+//
+// A rewrite that moves rows into a new data file (compaction) copies each row's _row_id and
+// _last_updated_sequence_number into it: the value the file materializes, else the one inheritance gives it
+// (the input file's first_row_id plus the row's position; the input entry's data sequence number). A compacted row keeps
+// its identity, and a rewrite that modifies no row keeps its last-updated sequence number.
+
+const minFormatVersionRowLineage = 3
+
+func hasRowLineage(version int) bool { return version >= minFormatVersionRowLineage }
+
+// rowLineageFirstRowID is the first-row-id a snapshot planned on meta starts at (0 below v3, where it is unused).
+func rowLineageFirstRowID(meta table.Metadata) int64 {
+	if !hasRowLineage(meta.Version()) {
+		return 0
+	}
+	return meta.NextRowID()
+}
+
+// checkRowLineagePlan: a plan that assigned row IDs from next-row-id `planned` is stale once the table's next-row-id
+// moved, even if the head did not (a commit to another branch advances it too); the spec has first-row-id reassigned on
+// every attempt, which for a manifest list already written means planning again.
+//
+// A format-version change since planning (an upgrade to v3) is stale too: the manifests and the snapshot were built for
+// the old version.
+func checkRowLineagePlan(plannedVersion, currentVersion int, planned, current int64) error {
+	if currentVersion != plannedVersion {
+		return fmt.Errorf("%w: format version changed from %d to %d", errStalePlan, plannedVersion, currentVersion)
+	}
+	if hasRowLineage(plannedVersion) && planned != current {
+		return fmt.Errorf("%w: next-row-id moved from %d to %d", errStalePlan, planned, current)
+	}
+	return nil
+}
+
+// checkCommitPlan is what every maintenance commit re-checks against the metadata it commits onto: the head it planned
+// against, and the row-lineage state (format version, next-row-id) its manifest list was written for.
+func checkCommitPlan(currentMeta table.Metadata, snapshotID int64, version int, firstRowID int64) (*table.Snapshot, error) {
+	cs := currentMeta.CurrentSnapshot()
+	if cs == nil || cs.SnapshotID != snapshotID {
+		return nil, errStalePlan
+	}
+	if err := checkRowLineagePlan(version, currentMeta.Version(), firstRowID, rowLineageFirstRowID(currentMeta)); err != nil {
+		return nil, err
+	}
+	return cs, nil
+}
+
+// writeManifestList writes the snapshot's manifest list and returns its added-rows for a v3 table (nil below v3): the row
+// IDs the writer assigned to manifests without a first_row_id, starting at firstRowID.
+func writeManifestList(version int, out io.Writer, snapshotID int64, parentSnapshotID, sequenceNumber *int64, firstRowID int64, manifests []iceberg.ManifestFile) (*int64, error) {
+	if !hasRowLineage(version) {
+		return nil, iceberg.WriteManifestList(version, out, snapshotID, parentSnapshotID, sequenceNumber, firstRowID, manifests)
+	}
+	if sequenceNumber == nil {
+		return nil, fmt.Errorf("sequence number is required for v%d tables", version)
+	}
+	writer, err := iceberg.NewManifestListWriterV3(out, snapshotID, *sequenceNumber, firstRowID, parentSnapshotID)
+	if err != nil {
+		return nil, err
+	}
+	if err := writer.AddManifests(manifests); err != nil {
+		writer.Close()
+		return nil, err
+	}
+	if err := writer.Close(); err != nil {
+		return nil, err
+	}
+	next := writer.NextRowID()
+	if next == nil || *next < firstRowID {
+		return nil, fmt.Errorf("manifest list writer reported next-row-id %v below first-row-id %d", next, firstRowID)
+	}
+	addedRows := *next - firstRowID
+	return &addedRows, nil
+}
+
+// setRowLineage puts first-row-id and added-rows on a snapshot of a v3 table.
+func setRowLineage(snapshot *table.Snapshot, version int, firstRowID int64, addedRows *int64) {
+	if !hasRowLineage(version) || addedRows == nil {
+		return
+	}
+	first, added := firstRowID, *addedRows
+	snapshot.FirstRowID, snapshot.AddedRows = &first, &added
+}
+
+// ---------------------------------------------------------------------------------------------- compaction rows
+
+// lineageSource is what inheritance gives the rows of one input data file.
+type lineageSource struct {
+	firstRowID *int64 // the file's first_row_id; nil: its rows have no row ID to carry (a null is written)
+	dataSeq    *int64 // the data sequence number of the file's manifest entry
+}
+
+func lineageSourceOf(entry iceberg.ManifestEntry) lineageSource {
+	src := lineageSource{dataSeq: manifestEntrySeqNum(entry)}
+	if id := entry.DataFile().FirstRowID(); id != nil {
+		v := *id
+		src.firstRowID = &v
+	}
+	return src
+}
+
+// lineageKind: 1 for _row_id, 2 for _last_updated_sequence_number, 0 for a data column. A column is a lineage column by
+// its reserved field id, or by its reserved name when it has no field id; a reserved name under another field id is an
+// error (kept as data, the output would have two columns of that name).
+func lineageKind(f parquet.Field) (int, error) {
+	switch f.ID() {
+	case iceberg.RowIDFieldID:
+		return 1, nil
+	case iceberg.LastUpdatedSequenceNumberFieldID:
+		return 2, nil
+	}
+	named := 0
+	switch f.Name() {
+	case iceberg.RowIDColumnName:
+		named = 1
+	case iceberg.LastUpdatedSequenceNumberColumnName:
+		named = 2
+	}
+	if named != 0 && f.ID() != 0 {
+		return 0, fmt.Errorf("column %s has field id %d, not the reserved id of that metadata column", f.Name(), f.ID())
+	}
+	return named, nil
+}
+
+// lineageLayout is the output of a v3 compaction: the reference file's own columns in their order (any lineage columns
+// it has set aside), then _row_id and _last_updated_sequence_number, optional longs with the spec's field ids.
+type lineageLayout struct {
+	schema      *parquet.Schema
+	reference   *parquet.Schema // the schema the layout was built from (the bin's first file)
+	baseFields  []parquet.Field
+	baseOffsets []int // output leaf index of each base field's first leaf
+	baseLeaves  int
+}
+
+func newLineageLayout(reference *parquet.Schema) (*lineageLayout, error) {
+	var base []parquet.Field
+	var offsets []int
+	leaves := 0
+	for _, f := range reference.Fields() {
+		kind, err := lineageKind(f)
+		if err != nil {
+			return nil, err
+		}
+		if kind != 0 {
+			continue
+		}
+		base = append(base, f)
+		offsets = append(offsets, leaves)
+		leaves += leafCount(f)
+	}
+	// The lineage columns are compressed like the reference's data columns
+	// (not like a lineage column it already has): a leaf that declares no
+	// codec is written uncompressed, 16 bytes a row.
+	codec := lineageCodec(base)
+	lineageLeaf := func(id int) parquet.Node {
+		return parquet.FieldID(parquet.Compressed(parquet.Optional(parquet.Leaf(parquet.Int64Type)), codec), id)
+	}
+	fields := append(append([]parquet.Field{}, base...),
+		lineageField{Node: lineageLeaf(iceberg.RowIDFieldID), name: iceberg.RowIDColumnName},
+		lineageField{Node: lineageLeaf(iceberg.LastUpdatedSequenceNumberFieldID), name: iceberg.LastUpdatedSequenceNumberColumnName},
+	)
+	return &lineageLayout{
+		schema:      parquet.NewSchema(reference.Name(), &orderedGroup{Node: reference, fields: fields}),
+		reference:   reference,
+		baseFields:  base,
+		baseOffsets: offsets,
+		baseLeaves:  leaves,
+	}, nil
+}
+
+// mapperFor matches an input file to the layout: its non-lineage columns must be the reference's, in the same order
+// (what the merge required of whole schemas before); its lineage columns, if any, are read wherever they are.
+func (l *lineageLayout) mapperFor(input *parquet.Schema, src lineageSource) (*lineageMapper, error) {
+	m := &lineageMapper{rowIDLeaf: -1, seqLeaf: -1, outRowID: l.baseLeaves, outSeq: l.baseLeaves + 1, src: src}
+	next, base := 0, 0
+	for _, f := range input.Fields() {
+		n := leafCount(f)
+		kind, err := lineageKind(f)
+		if err != nil {
+			return nil, err
+		}
+		if kind != 0 {
+			if n != 1 || !f.Leaf() {
+				return nil, fmt.Errorf("lineage column %s is not a primitive", f.Name())
+			}
+			target := &m.rowIDLeaf
+			if kind == 2 {
+				target = &m.seqLeaf
+			}
+			if *target >= 0 {
+				return nil, fmt.Errorf("more than one %s column", f.Name())
+			}
+			*target = next
+			m.leafMap = append(m.leafMap, -1)
+			next++
+			continue
+		}
+		if base >= len(l.baseFields) || f.Name() != l.baseFields[base].Name() || !parquet.EqualNodes(f, l.baseFields[base]) ||
+			!fieldIDsAgree(f, l.baseFields[base]) {
+			return nil, fmt.Errorf("cannot merge files with different schemas")
+		}
+		for i := 0; i < n; i++ {
+			m.leafMap = append(m.leafMap, l.baseOffsets[base]+i)
+		}
+		next += n
+		base++
+	}
+	if base != len(l.baseFields) {
+		return nil, fmt.Errorf("cannot merge files with different schemas")
+	}
+	return m, nil
+}
+
+// lineageMapper turns one input file's rows into the layout's rows.
+type lineageMapper struct {
+	leafMap          []int // input leaf index -> output leaf index; -1 for an input lineage column
+	rowIDLeaf        int   // input leaf index of _row_id, -1 when the file has none
+	seqLeaf          int   // input leaf index of _last_updated_sequence_number, -1 when the file has none
+	outRowID, outSeq int
+	src              lineageSource
+	rows             []parquet.Row   // reused per batch: both writers copy the values they are handed
+	values           []parquet.Value // backing store of rows
+}
+
+// mapRows maps rows read at the given positions of the input file (their position before any delete applied).
+func (m *lineageMapper) mapRows(rows []parquet.Row, positions []int64) []parquet.Row {
+	need := 0
+	for _, row := range rows {
+		need += len(row) + 2
+	}
+	if cap(m.values) < need {
+		m.values = make([]parquet.Value, 0, need)
+	}
+	m.values = m.values[:0]
+	m.rows = m.rows[:0]
+	for i, row := range rows {
+		start := len(m.values)
+		mapped := m.values[start:start:cap(m.values)]
+		var rowID, seq *parquet.Value
+		for j := range row {
+			v := row[j]
+			switch c := v.Column(); {
+			case c == m.rowIDLeaf:
+				rowID = &row[j]
+			case c == m.seqLeaf:
+				seq = &row[j]
+			default:
+				mapped = append(mapped, v.Level(v.RepetitionLevel(), v.DefinitionLevel(), m.leafMap[c]))
+			}
+		}
+		var inheritedRowID *int64
+		if m.src.firstRowID != nil {
+			id := *m.src.firstRowID + positions[i]
+			inheritedRowID = &id
+		}
+		mapped = append(mapped, lineageValue(rowID, inheritedRowID, m.outRowID), lineageValue(seq, m.src.dataSeq, m.outSeq))
+		m.values = m.values[:start+len(mapped)]
+		m.rows = append(m.rows, parquet.Row(mapped))
+	}
+	return m.rows
+}
+
+// lineageValue: the value the file materializes when it is not null, else the inherited one, else a null.
+func lineageValue(materialized *parquet.Value, inherited *int64, column int) parquet.Value {
+	if materialized != nil && !materialized.IsNull() {
+		return parquet.Int64Value(materialized.Int64()).Level(0, 1, column)
+	}
+	if inherited != nil {
+		return parquet.Int64Value(*inherited).Level(0, 1, column)
+	}
+	return parquet.NullValue().Level(0, 0, column)
+}
+
+func leafCount(n parquet.Node) int {
+	if n.Leaf() {
+		return 1
+	}
+	total := 0
+	for _, f := range n.Fields() {
+		total += leafCount(f)
+	}
+	return total
+}
+
+// orderedGroup is a group node with the fields given, in that order (parquet.Group sorts its fields by name).
+type orderedGroup struct {
+	parquet.Node
+	fields []parquet.Field
+}
+
+func (g *orderedGroup) Fields() []parquet.Field { return g.fields }
+func (g *orderedGroup) Leaf() bool              { return false }
+
+// GoType: rows are written as parquet.Row, never from Go values, so the base's type is never read for these columns.
+func (g *orderedGroup) GoType() reflect.Type { return g.Node.GoType() }
+
+// lineageField names a lineage column in the layout.
+type lineageField struct {
+	parquet.Node
+	name string
+}
+
+func (f lineageField) Name() string                           { return f.name }
+func (f lineageField) Value(base reflect.Value) reflect.Value { return reflect.Value{} }
+
+// prepareLineageInput: below v3 (layout nil) the file is merged as it is, with the equality-delete columns resolved on
+// the first file. On v3 the file is mapped onto the layout, and its equality-delete columns are resolved on its own
+// schema, since a file's lineage columns may sit anywhere among its columns.
+func prepareLineageInput(layout *lineageLayout, reader *parquet.Reader, entry iceberg.ManifestEntry, firstFileEqGroups []resolvedEqDeleteGroup,
+	eqDeleteGroups []equalityDeleteGroup, icebergSchema *iceberg.Schema) (*lineageMapper, []resolvedEqDeleteGroup, error) {
+	if layout == nil {
+		return nil, firstFileEqGroups, nil
+	}
+	source := entry.DataFile().FilePath()
+	mapper, err := layout.mapperFor(reader.Schema(), lineageSourceOf(entry))
+	if err != nil {
+		return nil, nil, fmt.Errorf("schema mismatch in %s: %w", source, err)
+	}
+	if reader.Schema() == layout.reference {
+		return mapper, firstFileEqGroups, nil // resolved on this very schema already
+	}
+	eqGroups, err := resolveEqualityDeleteGroupsForSchema(reader.Schema(), eqDeleteGroups, icebergSchema)
+	if err != nil {
+		return nil, nil, fmt.Errorf("resolve equality columns in %s: %w", source, err)
+	}
+	return mapper, eqGroups, nil
+}
+
+// copyFileRows drains one input file into write: deletes filtered and, on a v3 table (layout set), mapped onto the
+// layout with each row's lineage. Both merges, bin-packed and sorted, use it.
+func copyFileRows(ctx context.Context, reader *parquet.Reader, entry iceberg.ManifestEntry, layout *lineageLayout, bucketName, dataPath string,
+	positionDeletes map[string][]int64, firstFileEqGroups []resolvedEqDeleteGroup, eqDeleteGroups []equalityDeleteGroup,
+	icebergSchema *iceberg.Schema, write func([]parquet.Row) error) (int64, error) {
+	mapper, eqGroups, err := prepareLineageInput(layout, reader, entry, firstFileEqGroups, eqDeleteGroups, icebergSchema)
+	if err != nil {
+		reader.Close()
+		return 0, err
+	}
+	return visitFilteredParquetRows(ctx, reader, entry.DataFile().FilePath(), bucketName, dataPath, positionDeletes, eqGroups, func(filtered []parquet.Row, positions []int64) error {
+		if mapper != nil {
+			filtered = mapper.mapRows(filtered, positions)
+		}
+		return write(filtered)
+	})
+}
+
+// mergedFileFirstRowID is the _row_id of the merged output's first row, or nil when the file must be committed
+// without a first_row_id: a null _row_id would inherit first_row_id+position, an id another row already holds.
+// Committed without one, the nulls take fresh ids from the table's next-row-id and materialized values still
+// override inheritance.
+func mergedFileFirstRowID(data []byte) (*int64, error) {
+	file, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		return nil, err
+	}
+	schema := file.Schema()
+	if schema == nil {
+		return nil, nil
+	}
+	leaf, ok := schema.Lookup(iceberg.RowIDColumnName)
+	if !ok {
+		return nil, nil
+	}
+	if rowIDHasNulls(file, leaf.ColumnIndex) {
+		return nil, nil
+	}
+	reader := parquet.NewReader(file)
+	defer reader.Close()
+	rows := make([]parquet.Row, 1)
+	n, err := reader.ReadRows(rows)
+	if err != nil && err != io.EOF {
+		return nil, err
+	}
+	if n == 0 {
+		return nil, nil
+	}
+	for _, v := range rows[0] {
+		if v.Column() != leaf.ColumnIndex {
+			continue
+		}
+		if v.IsNull() {
+			return nil, nil
+		}
+		id := v.Int64()
+		return &id, nil
+	}
+	return nil, nil
+}
+
+// rowIDHasNulls reports whether any row group's _row_id column chunk counts a null. A chunk whose statistics
+// cannot be read counts as having one: a first_row_id named on a hidden null is the failure this guards.
+func rowIDHasNulls(file *parquet.File, columnIndex int) bool {
+	for _, rg := range file.RowGroups() {
+		chunks := rg.ColumnChunks()
+		if columnIndex >= len(chunks) {
+			return true
+		}
+		cc, ok := chunks[columnIndex].(*parquet.FileColumnChunk)
+		if !ok || cc.NullCount() > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// lineageCodec is the codec of the first data column leaf that declares one,
+// ZSTD when none does.
+func lineageCodec(base []parquet.Field) compress.Codec {
+	for _, f := range base {
+		if c := columnCodec(f); c != nil {
+			return c
+		}
+	}
+	return &zstd.Codec{}
+}
+
+func columnCodec(n parquet.Node) compress.Codec {
+	if n.Leaf() {
+		return n.Compression()
+	}
+	for _, f := range n.Fields() {
+		if c := columnCodec(f); c != nil {
+			return c
+		}
+	}
+	return nil
+}
diff --git a/weed/worker/tasks/iceberg/row_lineage_first_id_test.go b/weed/worker/tasks/iceberg/row_lineage_first_id_test.go
new file mode 100644
index 0000000000..07d9929640
--- /dev/null
+++ b/weed/worker/tasks/iceberg/row_lineage_first_id_test.go
@@ -0,0 +1,63 @@
+package iceberg
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/parquet-go/parquet-go"
+)
+
+type lineageRow struct {
+	ID    int64  `parquet:"id"`
+	RowID *int64 `parquet:"_row_id,optional"`
+}
+
+func lineageFile(t *testing.T, ids ...*int64) []byte {
+	t.Helper()
+	var buf bytes.Buffer
+	w := parquet.NewGenericWriter[lineageRow](&buf)
+	rows := make([]lineageRow, len(ids))
+	for i, id := range ids {
+		rows[i] = lineageRow{ID: int64(i), RowID: id}
+	}
+	if _, err := w.Write(rows); err != nil {
+		t.Fatal(err)
+	}
+	if err := w.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return buf.Bytes()
+}
+
+func i64(v int64) *int64 { return &v }
+
+// A merged v3 file names its first row's id as first_row_id only when every
+// row carries a materialized id: a null row would inherit first_row_id plus
+// its position, an id another row already holds (high review of the 4.49
+// series; 4.49's own code took the first row's id whatever followed).
+func TestMergedFileFirstRowIDOnlyWithoutNullIDs(t *testing.T) {
+	cases := []struct {
+		name string
+		ids  []*int64
+		want *int64
+	}{
+		{"every row materialized", []*int64{i64(40), i64(41), i64(42)}, i64(40)},
+		{"materialized first, a null later", []*int64{i64(40), nil, i64(42)}, nil},
+		{"null first", []*int64{nil, i64(41)}, nil},
+		{"all null", []*int64{nil, nil}, nil},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			got, err := mergedFileFirstRowID(lineageFile(t, c.ids...))
+			if err != nil {
+				t.Fatal(err)
+			}
+			switch {
+			case c.want == nil && got != nil:
+				t.Fatalf("first_row_id %d, want none", *got)
+			case c.want != nil && (got == nil || *got != *c.want):
+				t.Fatalf("first_row_id %v, want %d", got, *c.want)
+			}
+		})
+	}
+}
diff --git a/weed/worker/tasks/iceberg/row_lineage_test.go b/weed/worker/tasks/iceberg/row_lineage_test.go
new file mode 100644
index 0000000000..35af667a17
--- /dev/null
+++ b/weed/worker/tasks/iceberg/row_lineage_test.go
@@ -0,0 +1,442 @@
+package iceberg
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/parquet-go/parquet-go"
+	"github.com/parquet-go/parquet-go/compress/zstd"
+	"github.com/parquet-go/parquet-go/format"
+
+	filer_pb "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+type lineageDataRow struct {
+	ID   int64  `parquet:"id"`
+	Name string `parquet:"name"`
+}
+
+func putDataFileRows[T any](t *testing.T, fs *fakeFilerServer, name string, rows []T) {
+	t.Helper()
+	var buf bytes.Buffer
+	w := parquet.NewWriter(&buf, parquet.SchemaOf(new(T)))
+	for _, r := range rows {
+		if err := w.Write(&r); err != nil {
+			t.Fatalf("write row: %v", err)
+		}
+	}
+	if err := w.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+	fs.putEntry("/buckets/test-bucket/ns/tbl/data", name, &filer_pb.Entry{
+		Name:    name,
+		Content: buf.Bytes(),
+	})
+}
+
+func lineageEntry(t *testing.T, path string, firstRowID, dataSeq, recordCount int64) iceberg.ManifestEntry {
+	t.Helper()
+	dfb, err := iceberg.NewDataFileBuilder(*iceberg.UnpartitionedSpec, iceberg.EntryContentData,
+		path, iceberg.ParquetFile, map[int]any{}, nil, nil, recordCount, 1024)
+	if err != nil {
+		t.Fatalf("build data file: %v", err)
+	}
+	snapID := int64(1)
+	return iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, &dataSeq, nil,
+		dfb.FirstRowID(firstRowID).Build())
+}
+
+// mergedColumns returns each merged row's (id, name, _row_id,
+// _last_updated_sequence_number): the two lineage columns the v3 merge
+// appends after the data columns.
+func mergedColumns(t *testing.T, data []byte) (ids, names, rowIDs, seqs []any) {
+	t.Helper()
+	f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		t.Fatalf("open merged: %v", err)
+	}
+	fields := f.Schema().Fields()
+	if len(fields) != 4 {
+		t.Fatalf("merged schema has %d fields, want 4 (id, name, _row_id, _last_updated_sequence_number)", len(fields))
+	}
+	if fields[2].Name() != iceberg.RowIDColumnName || fields[2].ID() != iceberg.RowIDFieldID {
+		t.Fatalf("field 2 = %s id %d, want %s id %d", fields[2].Name(), fields[2].ID(), iceberg.RowIDColumnName, iceberg.RowIDFieldID)
+	}
+	if fields[3].Name() != iceberg.LastUpdatedSequenceNumberColumnName || fields[3].ID() != iceberg.LastUpdatedSequenceNumberFieldID {
+		t.Fatalf("field 3 = %s id %d, want %s id %d", fields[3].Name(), fields[3].ID(), iceberg.LastUpdatedSequenceNumberColumnName, iceberg.LastUpdatedSequenceNumberFieldID)
+	}
+	for _, rg := range f.RowGroups() {
+		rows := rg.Rows()
+		buf := make([]parquet.Row, 8)
+		for {
+			n, err := rows.ReadRows(buf)
+			for _, row := range buf[:n] {
+				ids = append(ids, row[0].Int64())
+				names = append(names, row[1].String())
+				if row[2].IsNull() {
+					rowIDs = append(rowIDs, nil)
+				} else {
+					rowIDs = append(rowIDs, row[2].Int64())
+				}
+				if row[3].IsNull() {
+					seqs = append(seqs, nil)
+				} else {
+					seqs = append(seqs, row[3].Int64())
+				}
+			}
+			if err == io.EOF {
+				break
+			}
+			if err != nil {
+				t.Fatalf("read merged rows: %v", err)
+			}
+		}
+		rows.Close()
+	}
+	return
+}
+
+// On a v3 table the merged file carries every row's identity: the
+// materialized value when the input has it, else the one inheritance
+// gives it (the input file's first_row_id plus the row's position, the
+// entry's data sequence number).
+func TestMergeParquetFilesRowLineage(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	putDataFileRows(t, fs, "file1.parquet", []lineageDataRow{{1, "alice"}, {2, "bob"}, {3, "carl"}})
+	putDataFileRows(t, fs, "file2.parquet", []lineageDataRow{{4, "dave"}, {5, "eve"}})
+
+	entries := []iceberg.ManifestEntry{
+		lineageEntry(t, "data/file1.parquet", 100, 7, 3),
+		lineageEntry(t, "data/file2.parquet", 200, 9, 2),
+	}
+
+	merged, count, err := mergeParquetFiles(context.Background(), client, "test-bucket", "ns/tbl",
+		entries, nil, nil, nil, 0, true)
+	if err != nil {
+		t.Fatalf("mergeParquetFiles: %v", err)
+	}
+	if count != 5 {
+		t.Fatalf("expected 5 merged rows, got %d", count)
+	}
+
+	_, _, rowIDs, seqs := mergedColumns(t, merged)
+	wantIDs := []any{int64(100), int64(101), int64(102), int64(200), int64(201)}
+	wantSeqs := []any{int64(7), int64(7), int64(7), int64(9), int64(9)}
+	for i := range wantIDs {
+		if rowIDs[i] != wantIDs[i] {
+			t.Errorf("row %d _row_id = %v, want %v", i, rowIDs[i], wantIDs[i])
+		}
+		if seqs[i] != wantSeqs[i] {
+			t.Errorf("row %d _last_updated_sequence_number = %v, want %v", i, seqs[i], wantSeqs[i])
+		}
+	}
+}
+
+// A position delete removes a row without renumbering the survivors:
+// each kept row's _row_id is the file's first_row_id plus its position
+// before the delete.
+func TestMergeParquetFilesRowLineagePositionDelete(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	putDataFileRows(t, fs, "file1.parquet", []lineageDataRow{{1, "alice"}, {2, "bob"}, {3, "carl"}})
+
+	entries := []iceberg.ManifestEntry{lineageEntry(t, "data/file1.parquet", 100, 7, 3)}
+	posDeletes := map[string][]int64{"ns/tbl/data/file1.parquet": {1}}
+
+	merged, count, err := mergeParquetFiles(context.Background(), client, "test-bucket", "ns/tbl",
+		entries, posDeletes, nil, nil, 0, true)
+	if err != nil {
+		t.Fatalf("mergeParquetFiles: %v", err)
+	}
+	if count != 2 {
+		t.Fatalf("expected 2 merged rows, got %d", count)
+	}
+	ids, _, rowIDs, _ := mergedColumns(t, merged)
+	if ids[0] != int64(1) || ids[1] != int64(3) {
+		t.Fatalf("merged ids = %v, want [1 3]", ids)
+	}
+	if rowIDs[0] != int64(100) || rowIDs[1] != int64(102) {
+		t.Fatalf("merged _row_id = %v, want [100 102]", rowIDs)
+	}
+}
+
+// A file an engine already wrote with lineage columns materializes its
+// rows' values; merged with a plain file, each input keeps its own
+// provenance.
+func TestMergeParquetFilesRowLineageMaterialized(t *testing.T) {
+	fs, client := startFakeFiler(t)
+
+	type materializedRow struct {
+		ID     int64  `parquet:"id"`
+		Name   string `parquet:"name"`
+		RowID  int64  `parquet:"_row_id,id(2147483540)"`
+		LastUp int64  `parquet:"_last_updated_sequence_number,id(2147483539)"`
+	}
+	putDataFileRows(t, fs, "plain.parquet", []lineageDataRow{{1, "alice"}})
+	putDataFileRows(t, fs, "mats.parquet", []materializedRow{{2, "bob", 5000, 42}})
+
+	entries := []iceberg.ManifestEntry{
+		lineageEntry(t, "data/plain.parquet", 100, 7, 1),
+		lineageEntry(t, "data/mats.parquet", 200, 9, 1),
+	}
+	merged, count, err := mergeParquetFiles(context.Background(), client, "test-bucket", "ns/tbl",
+		entries, nil, nil, nil, 0, true)
+	if err != nil {
+		t.Fatalf("mergeParquetFiles: %v", err)
+	}
+	if count != 2 {
+		t.Fatalf("expected 2 merged rows, got %d", count)
+	}
+	_, _, rowIDs, seqs := mergedColumns(t, merged)
+	if rowIDs[0] != int64(100) || rowIDs[1] != int64(5000) {
+		t.Errorf("_row_id = %v, want [100 5000]", rowIDs)
+	}
+	if seqs[0] != int64(7) || seqs[1] != int64(42) {
+		t.Errorf("_last_updated_sequence_number = %v, want [7 42]", seqs)
+	}
+}
+
+// The v3 manifest list assigns first_row_id to manifests that have
+// none, starting at the snapshot's first-row-id, and reports the range
+// it assigned as the snapshot's added-rows.
+func TestWriteManifestListV3RowIDs(t *testing.T) {
+	schema := newTestSchema()
+	spec := *iceberg.UnpartitionedSpec
+	snapID := int64(12)
+	dataSeq := int64(3)
+
+	entry := iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, &dataSeq, nil,
+		mustDataFile(t, spec, "data/a.parquet", 4))
+	var manifestBuf bytes.Buffer
+	mf, err := iceberg.WriteManifest("metadata/m0.avro", &manifestBuf, 3, spec, schema, snapID,
+		[]iceberg.ManifestEntry{entry})
+	if err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+
+	var listBuf bytes.Buffer
+	parent := int64(10)
+	seqNum := int64(3)
+	addedRows, err := writeManifestList(3, &listBuf, snapID, &parent, &seqNum, 500, []iceberg.ManifestFile{mf})
+	if err != nil {
+		t.Fatalf("writeManifestList: %v", err)
+	}
+	if addedRows == nil || *addedRows != 4 {
+		t.Fatalf("addedRows = %v, want 4", addedRows)
+	}
+
+	readBack, err := iceberg.ReadManifestList(&listBuf)
+	if err != nil {
+		t.Fatalf("read manifest list: %v", err)
+	}
+	if len(readBack) != 1 || readBack[0].FirstRowID() == nil || *readBack[0].FirstRowID() != 500 {
+		t.Fatalf("manifest first_row_id = %v, want 500", readBack)
+	}
+}
+
+func mustDataFile(t *testing.T, spec iceberg.PartitionSpec, path string, recordCount int64) iceberg.DataFile {
+	t.Helper()
+	dfb, err := iceberg.NewDataFileBuilder(spec, iceberg.EntryContentData, path, iceberg.ParquetFile,
+		map[int]any{}, nil, nil, recordCount, 1024)
+	if err != nil {
+		t.Fatalf("build data file: %v", err)
+	}
+	return dfb.Build()
+}
+
+// A plan that assigned row IDs from a next-row-id the table no longer
+// has is stale, like a moved head; so is a format version that changed
+// since planning.
+func TestCheckRowLineagePlan(t *testing.T) {
+	if err := checkRowLineagePlan(3, 2, 0, 0); err == nil {
+		t.Error("version change must be stale")
+	}
+	if err := checkRowLineagePlan(3, 3, 100, 200); err == nil {
+		t.Error("moved next-row-id must be stale")
+	}
+	if err := checkRowLineagePlan(2, 2, 0, 0); err != nil {
+		t.Errorf("v2 plan is never row-lineage stale: %v", err)
+	}
+	if err := checkRowLineagePlan(3, 3, 100, 100); err != nil {
+		t.Errorf("unchanged next-row-id must not be stale: %v", err)
+	}
+}
+
+// A data column named like a lineage column under a different field id
+// refuses the bin rather than writing a doubled column.
+func TestLineageLayoutRejectsReservedNameUnderOtherID(t *testing.T) {
+	type badRow struct {
+		ID    int64 `parquet:"id"`
+		RowID int64 `parquet:"_row_id,id(7)"`
+	}
+	schema := parquet.SchemaOf(new(badRow))
+	if _, err := newLineageLayout(schema); err == nil {
+		t.Fatal("reserved name under a non-reserved field id must fail the layout")
+	}
+}
+
+// Compaction on a v3 table reads row lineage the way a reader does: the
+// entries in the stored manifest carry no first_row_id, so the ones
+// compactDataFiles merges are the inherited values (the manifest-list
+// first_row_id plus the preceding files' record counts). The merged file
+// materializes those IDs and its new entry names its own first row's.
+func TestCompactDataFilesV3RowLineageManifestRead(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	ctx := context.Background()
+
+	setup := tableSetup{BucketName: "test-bucket", Namespace: "ns", TableName: "tbl"}
+	spec := *iceberg.UnpartitionedSpec
+	snapID := int64(1)
+
+	putDataFileRows(t, fs, "f1.parquet", []lineageDataRow{{1, "a"}, {2, "b"}, {3, "c"}})
+	putDataFileRows(t, fs, "f2.parquet", []lineageDataRow{{4, "d"}, {5, "e"}})
+
+	entries := []iceberg.ManifestEntry{
+		iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+			mustDataFile(t, spec, "data/f1.parquet", 3)),
+		iceberg.NewManifestEntry(iceberg.EntryStatusADDED, &snapID, nil, nil,
+			mustDataFile(t, spec, "data/f2.parquet", 2)),
+	}
+	writeV3Table(t, fs, setup, entries, nil, 0, 5)
+
+	handler := NewHandler(nil)
+	config := Config{
+		TargetFileSizeBytes: 4096,
+		MinInputFiles:       2,
+		ApplyDeletes:        true,
+	}
+	result, _, err := handler.compactDataFiles(ctx, client, setup.BucketName, setup.tablePath(), config, nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "compacted 2 files into 1") {
+		t.Fatalf("unexpected result: %q", result)
+	}
+
+	state, err := loadCurrentMetadata(ctx, client, setup.BucketName, setup.tablePath())
+	if err != nil {
+		t.Fatalf("loadCurrentMetadata: %v", err)
+	}
+	newSnap := state.Metadata.CurrentSnapshot()
+	if newSnap == nil || newSnap.SnapshotID == snapID {
+		t.Fatalf("no new snapshot committed: %+v", newSnap)
+	}
+	if newSnap.FirstRowID == nil || *newSnap.FirstRowID != 5 {
+		t.Fatalf("new snapshot first-row-id = %v, want 5", newSnap.FirstRowID)
+	}
+
+	manifestListData, err := loadFileByIcebergPath(ctx, client, setup.BucketName, state.DataPath, newSnap.ManifestList)
+	if err != nil {
+		t.Fatalf("read new manifest list: %v", err)
+	}
+	manifests, err := s3tables.ReadManifestList(manifestListData)
+	if err != nil {
+		t.Fatalf("parse new manifest list: %v", err)
+	}
+	if len(manifests) != 1 {
+		t.Fatalf("new snapshot has %d manifests, want 1", len(manifests))
+	}
+	manifestData, err := loadFileByIcebergPath(ctx, client, setup.BucketName, state.DataPath, manifests[0].FilePath())
+	if err != nil {
+		t.Fatalf("read new manifest: %v", err)
+	}
+	newEntries, err := s3tables.ReadManifest(manifests[0], manifestData, false, specByID(state.Metadata), state.Metadata.CurrentSchema())
+	if err != nil {
+		t.Fatalf("parse new manifest: %v", err)
+	}
+
+	var merged iceberg.DataFile
+	var deletedPaths int
+	for _, e := range newEntries {
+		switch e.Status() {
+		case iceberg.EntryStatusADDED:
+			merged = e.DataFile()
+		case iceberg.EntryStatusDELETED:
+			deletedPaths++
+		}
+	}
+	if deletedPaths != 2 {
+		t.Fatalf("new manifest has %d deleted entries, want 2", deletedPaths)
+	}
+	if merged == nil {
+		t.Fatal("new manifest has no added entry")
+	}
+	if merged.FirstRowID() == nil || *merged.FirstRowID() != 0 {
+		t.Fatalf("merged entry first_row_id = %v, want 0", merged.FirstRowID())
+	}
+
+	mergedData, err := loadFileByIcebergPath(ctx, client, setup.BucketName, state.DataPath, merged.FilePath())
+	if err != nil {
+		t.Fatalf("read merged file: %v", err)
+	}
+	_, _, rowIDs, seqs := mergedColumns(t, mergedData)
+	wantRowIDs := []any{int64(0), int64(1), int64(2), int64(3), int64(4)}
+	for i, want := range wantRowIDs {
+		if rowIDs[i] != want {
+			t.Fatalf("row %d _row_id = %v, want %v", i, rowIDs[i], want)
+		}
+		if seqs[i] != int64(1) {
+			t.Fatalf("row %d _last_updated_sequence_number = %v, want 1", i, seqs[i])
+		}
+	}
+}
+
+// The lineage columns a v3 compaction adds are compressed like the data
+// columns.
+func TestCompactCompressesLineageColumns(t *testing.T) {
+	fs, client := startFakeFiler(t)
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "geo"}
+	populateGeoTable(t, fs, setup, fiveGeoFiles(), geoTableOptions{})
+	compactGeo(t, client, setup, Config{})
+	for name, data := range compactedFiles(t, fs, setup) {
+		f, err := parquet.OpenFile(bytes.NewReader(data), int64(len(data)))
+		if err != nil {
+			t.Fatal(err)
+		}
+		seen := 0
+		for _, rg := range f.Metadata().RowGroups {
+			for _, c := range rg.Columns {
+				col := strings.Join(c.MetaData.PathInSchema, ".")
+				if col != iceberg.RowIDColumnName && col != iceberg.LastUpdatedSequenceNumberColumnName {
+					continue
+				}
+				seen++
+				if c.MetaData.Codec != format.Zstd {
+					t.Errorf("%s: %s written with codec %v, want ZSTD like the data columns", name, col, c.MetaData.Codec)
+				}
+			}
+		}
+		if seen == 0 {
+			t.Errorf("%s: no lineage column", name)
+		}
+	}
+}
+
+// The lineage codec follows the data columns: an input whose own _row_id
+// comes first and is uncompressed does not leave the new lineage columns
+// uncompressed.
+func TestLineageCodecFollowsDataColumns(t *testing.T) {
+	schema := parquet.NewSchema("table", parquet.Group{
+		iceberg.RowIDColumnName: parquet.FieldID(parquet.Compressed(parquet.Optional(parquet.Int(64)), &parquet.Uncompressed), iceberg.RowIDFieldID),
+		"id":                    parquet.FieldID(parquet.Compressed(parquet.Int(64), &zstd.Codec{}), 1),
+	})
+	if first := schema.Fields()[0].Name(); first != iceberg.RowIDColumnName {
+		t.Fatalf("setup: first column %s, want %s", first, iceberg.RowIDColumnName)
+	}
+	layout, err := newLineageLayout(schema)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, f := range layout.schema.Fields() {
+		if f.Name() != iceberg.RowIDColumnName && f.Name() != iceberg.LastUpdatedSequenceNumberColumnName {
+			continue
+		}
+		if c := f.Compression(); c == nil || c.CompressionCodec() != format.Zstd {
+			t.Errorf("%s compressed with %v, want ZSTD like the data column", f.Name(), c)
+		}
+	}
+}
diff --git a/weed/worker/tasks/iceberg/schema_evolution.go b/weed/worker/tasks/iceberg/schema_evolution.go
new file mode 100644
index 0000000000..85b5647b79
--- /dev/null
+++ b/weed/worker/tasks/iceberg/schema_evolution.go
@@ -0,0 +1,184 @@
+package iceberg
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/parquet-go/parquet-go"
+)
+
+// The bin-pack merge of a v1/v2 table whose data files spell its schema
+// differently. A bin used to take the first file's Parquet schema as the
+// writer's and refuse every file whose schema was not structurally identical
+// ("cannot merge files with different schemas"). That refused:
+//   - schema evolution: a column added to the table after some files were
+//     written;
+//   - one Iceberg schema written REQUIRED by one engine and OPTIONAL by another.
+//
+// The writer's schema is now the union of the bin's files' schemas, matched
+// by Iceberg field id and computed before any row is written (schemaUnion),
+// so every file converts into it in a single pass:
+//   - the same field id carries the same name and type;
+//   - the writer's column may be optional where the file's is required, never
+//     the reverse;
+//   - a writer column the file lacks must be optional, and reads as null.
+//
+// Anything else (a rename, a type change, the same name under different field
+// ids, nested columns, no field ids) is refused as before.
+
+// flatColumnsByFieldID is the schema's columns by Iceberg field id when every
+// column is a top-level, non-repeated leaf with a field id of its own; ok is
+// false otherwise.
+func flatColumnsByFieldID(s *parquet.Schema) (map[int]parquet.Field, bool) {
+	if s == nil {
+		return nil, false
+	}
+	out := make(map[int]parquet.Field)
+	for _, f := range s.Fields() {
+		if !f.Leaf() || f.Repeated() || f.ID() <= 0 {
+			return nil, false
+		}
+		if _, dup := out[f.ID()]; dup {
+			return nil, false
+		}
+		out[f.ID()] = f
+	}
+	return out, true
+}
+
+// schemaCovers reports whether every row of a file written in source converts
+// to target without losing or inventing a value (the rules above).
+func schemaCovers(target, source *parquet.Schema) bool {
+	targetCols, ok := flatColumnsByFieldID(target)
+	if !ok {
+		return false
+	}
+	sourceCols, ok := flatColumnsByFieldID(source)
+	if !ok {
+		return false
+	}
+	for id, s := range sourceCols {
+		t, ok := targetCols[id]
+		if !ok || t.Name() != s.Name() || !parquet.EqualTypes(t.Type(), s.Type()) {
+			return false
+		}
+		if t.Required() && !s.Required() {
+			return false
+		}
+	}
+	for id, t := range targetCols {
+		if _, ok := sourceCols[id]; !ok && !t.Optional() {
+			return false
+		}
+	}
+	return true
+}
+
+// schemaUnion folds a bin's file schemas into the writer schema the merge
+// needs: every field id any file carries, in the order first seen, under the
+// name and type all of its files agree on. A column is REQUIRED only when
+// every file has it and spells it so; a file that lacks it or spells it
+// optional reads and writes nulls there. A shared field id with a different
+// name or type, or the same name under different field ids (a column dropped
+// and re-added), is a conflict the merge refuses.
+type schemaUnion struct {
+	fields []unionField
+	byID   map[int]int
+	byName map[string]int
+	folds  int
+}
+
+type unionField struct {
+	field        parquet.Field // the field as first seen
+	required     bool          // required in every file that carries it
+	presentInAll bool          // present in every file folded so far
+}
+
+func (u *schemaUnion) fold(s *parquet.Schema, path string) error {
+	cols, ok := flatColumnsByFieldID(s)
+	if !ok {
+		return fmt.Errorf("schema of %s does not key flat columns by field id", path)
+	}
+	if u.byID == nil {
+		u.byID, u.byName = make(map[int]int), make(map[string]int)
+	}
+	for _, f := range s.Fields() {
+		id, name := f.ID(), f.Name()
+		if j, ok := u.byID[id]; ok {
+			e := &u.fields[j]
+			if e.field.Name() != name || !parquet.EqualTypes(e.field.Type(), f.Type()) {
+				return fmt.Errorf("field id %d is %q in one file but %q in %s", id, e.field.Name(), name, path)
+			}
+			e.required = e.required && f.Required()
+			continue
+		}
+		if _, ok := u.byName[name]; ok {
+			return fmt.Errorf("column %q carries different field ids in %s", name, path)
+		}
+		u.byID[id], u.byName[name] = len(u.fields), id
+		// A field folded in after the first schema is absent from every
+		// file seen before it.
+		u.fields = append(u.fields, unionField{field: f, required: f.Required(), presentInAll: u.folds == 0})
+	}
+	for i := range u.fields {
+		if _, ok := cols[u.fields[i].field.ID()]; !ok {
+			u.fields[i].presentInAll = false
+		}
+	}
+	u.folds++
+	return nil
+}
+
+// schema is the union as a writer schema; name and group give the root node
+// (their Go type is never read: the merge writes parquet.Row values).
+func (u *schemaUnion) schema(name string, group parquet.Node) *parquet.Schema {
+	fields := make([]parquet.Field, len(u.fields))
+	for i, e := range u.fields {
+		fields[i] = e.field
+		if !e.field.Optional() && !(e.required && e.presentInAll) {
+			fields[i] = unionOptionalField{Node: parquet.Optional(e.field), name: e.field.Name()}
+		}
+	}
+	return parquet.NewSchema(name, &orderedGroup{Node: group, fields: fields})
+}
+
+// unionOptionalField spells a field optional in the union schema when the
+// file it came from wrote it required.
+type unionOptionalField struct {
+	parquet.Node
+	name string
+}
+
+func (f unionOptionalField) Name() string                           { return f.name }
+func (f unionOptionalField) Value(base reflect.Value) reflect.Value { return reflect.Value{} }
+
+// widerSchemaError stops a merge that met a file whose schema covers the
+// writer's: the bin is merged again with it.
+type widerSchemaError struct {
+	schema *parquet.Schema
+	path   string
+}
+
+func (e *widerSchemaError) Error() string {
+	return fmt.Sprintf("schema of %s is wider than the bin's writer schema", e.path)
+}
+
+// evolvedFileConversion is how a file of schema source joins a merge written
+// in target: nil when they are equal, a conversion when target covers it, a
+// *widerSchemaError when it covers target, else the merge's mismatch error.
+func evolvedFileConversion(target, source *parquet.Schema, path string) (parquet.Conversion, error) {
+	if schemasEqual(target, source) {
+		return nil, nil
+	}
+	if schemaCovers(target, source) {
+		conv, err := parquet.Convert(target, source)
+		if err != nil {
+			return nil, fmt.Errorf("schema of %s: %w", path, err)
+		}
+		return conv, nil
+	}
+	if schemaCovers(source, target) {
+		return nil, &widerSchemaError{schema: source, path: path}
+	}
+	return nil, fmt.Errorf("schema mismatch in %s: cannot merge files with different schemas", path)
+}
diff --git a/weed/worker/tasks/iceberg/sort_merge_test.go b/weed/worker/tasks/iceberg/sort_merge_test.go
new file mode 100644
index 0000000000..cd0e6c0832
--- /dev/null
+++ b/weed/worker/tasks/iceberg/sort_merge_test.go
@@ -0,0 +1,161 @@
+package iceberg
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/apache/iceberg-go"
+	"github.com/apache/iceberg-go/table"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// seedSortableTable creates a table sorted ascending on id whose data files are
+// deliberately out of order: ids interleave across the files and descend within
+// each one, so neither the file order nor the row order is already sorted.
+func seedSortableTable(t *testing.T, files, rowsPerFile int) (*fakeFilerServer, filer_pb.SeaweedFilerClient, tableSetup) {
+	t.Helper()
+
+	fs, client := startFakeFiler(t)
+	sortOrder, err := table.NewSortOrder(1, []table.SortField{{
+		SourceIDs: []int{1},
+		Transform: iceberg.IdentityTransform{},
+		Direction: table.SortASC,
+		NullOrder: table.NullsFirst,
+	}})
+	if err != nil {
+		t.Fatalf("new sort order: %v", err)
+	}
+
+	type dataRow = struct {
+		ID   int64
+		Name string
+	}
+	dataFiles := make([]struct {
+		Name string
+		Rows []dataRow
+	}, 0, files)
+	for f := 0; f < files; f++ {
+		rows := make([]dataRow, 0, rowsPerFile)
+		for i := 0; i < rowsPerFile; i++ {
+			id := int64((rowsPerFile-1-i)*files + f)
+			rows = append(rows, dataRow{ID: id, Name: fmt.Sprintf("row-%d", id)})
+		}
+		dataFiles = append(dataFiles, struct {
+			Name string
+			Rows []dataRow
+		}{Name: fmt.Sprintf("d%d.parquet", f), Rows: rows})
+	}
+
+	setup := tableSetup{BucketName: "tb", Namespace: "ns", TableName: "tbl"}
+	populateTableWithDeleteFilesAndSortOrder(t, fs, setup, dataFiles, nil, nil, sortOrder)
+	return fs, client, setup
+}
+
+func sortCompactionConfig(spillDir string) Config {
+	return Config{
+		TargetFileSizeBytes: 256 * 1024 * 1024,
+		MinInputFiles:       2,
+		MaxCommitRetries:    3,
+		ApplyDeletes:        true,
+		RewriteStrategy:     "sort",
+		SortBufferRows:      minSortBufferRows,
+		SortSpillDir:        spillDir,
+	}
+}
+
+// compactedFileNames lists the outputs a compaction wrote, which is empty when
+// every bin was skipped.
+func compactedFileNames(fs *fakeFilerServer, setup tableSetup) []string {
+	dataDir := path.Join(s3tables.TablesPath, setup.BucketName, setup.tablePath(), "data")
+	var names []string
+	for _, e := range fs.listDir(dataDir) {
+		if strings.HasPrefix(e.Name, "compact-") {
+			names = append(names, e.Name)
+		}
+	}
+	return names
+}
+
+// A sorted rewrite whose bin does not fit in one buffer has to spill: each
+// buffer is encoded as a sorted run and the runs are merged at close. This is
+// the case that used to hold every row of the bin in memory, so it is worth
+// proving both that the output is globally ordered and that the runs do not
+// outlive the job.
+func TestCompactDataFilesSortSpillsRunsAndCleansUp(t *testing.T) {
+	const files, rowsPerFile = 3, 1200 // 3600 rows against a 1024-row buffer
+	fs, client, setup := seedSortableTable(t, files, rowsPerFile)
+
+	spillDir := t.TempDir()
+	handler := NewHandler(nil)
+	result, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), sortCompactionConfig(spillDir), nil)
+	if err != nil {
+		t.Fatalf("compactDataFiles: %v", err)
+	}
+	if !strings.Contains(result, "using sort") {
+		t.Fatalf("expected sorted compaction result, got %q", result)
+	}
+
+	rows := readCompactedRows(t, fs, setup)
+	if len(rows) != files*rowsPerFile {
+		t.Fatalf("expected %d compacted rows, got %d", files*rowsPerFile, len(rows))
+	}
+	for i := 1; i < len(rows); i++ {
+		if rows[i-1].ID > rows[i].ID {
+			t.Fatalf("rows are not sorted by id at %d: %d then %d", i, rows[i-1].ID, rows[i].ID)
+		}
+	}
+
+	leftovers, err := os.ReadDir(spillDir)
+	if err != nil {
+		t.Fatalf("read spill dir: %v", err)
+	}
+	if len(leftovers) != 0 {
+		t.Fatalf("expected the sorted runs to be removed, found %d file(s)", len(leftovers))
+	}
+}
+
+// An empty spill directory at the end of a job cannot tell a run written to
+// disk from one held in memory. A directory that cannot hold the runs can: the
+// same data compacts with a usable one and does not with an unusable one, which
+// it would not do if the runs never reached the pool. A bin whose merge fails
+// is logged and skipped rather than failing the job, so the difference shows up
+// as a missing output file rather than an error.
+func TestCompactDataFilesSortSpillDirDecidesOutcome(t *testing.T) {
+	// Two files that together cross the 1024-row buffer, so a run is spilled.
+	const files, rowsPerFile = 2, 700
+
+	for _, tc := range []struct {
+		name         string
+		spillDir     func(t *testing.T) string
+		wantOutcomes int
+	}{
+		{
+			name:         "usable",
+			spillDir:     func(t *testing.T) string { return t.TempDir() },
+			wantOutcomes: 1,
+		},
+		{
+			name:         "unusable",
+			spillDir:     func(t *testing.T) string { return filepath.Join(t.TempDir(), "not-created") },
+			wantOutcomes: 0,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fs, client, setup := seedSortableTable(t, files, rowsPerFile)
+			handler := NewHandler(nil)
+
+			if _, _, err := handler.compactDataFiles(context.Background(), client, setup.BucketName, setup.tablePath(), sortCompactionConfig(tc.spillDir(t)), nil); err != nil {
+				t.Fatalf("compactDataFiles: %v", err)
+			}
+			if names := compactedFileNames(fs, setup); len(names) != tc.wantOutcomes {
+				t.Fatalf("expected %d compacted file(s), got %v", tc.wantOutcomes, names)
+			}
+		})
+	}
+}
diff --git a/weed/worker/tasks/iceberg/sort_strategy.go b/weed/worker/tasks/iceberg/sort_strategy.go
index 9c42fe4610..b06b5ee1e6 100644
--- a/weed/worker/tasks/iceberg/sort_strategy.go
+++ b/weed/worker/tasks/iceberg/sort_strategy.go
@@ -13,6 +13,9 @@ import (
 type compactionRewritePlan struct {
 	strategy   string
 	sortFields []compactionSortField
+	// Carried on the plan so the merge does not need the whole Config.
+	bufferRows int64
+	spillDir   string
 }
 
 type compactionSortField struct {
@@ -29,6 +32,16 @@ func resolveCompactionRewritePlan(config Config, meta table.Metadata) (*compacti
 	if strategy == defaultRewriteStrategy {
 		return &compactionRewritePlan{strategy: defaultRewriteStrategy}, nil
 	}
+	// "auto" sorts tables that declare a usable sort order and bin-packs the
+	// rest, so an unsorted table is not an error the way an explicit "sort" is.
+	if strategy == rewriteStrategyAuto {
+		sortFields, err := resolveCompactionSortFields(meta)
+		if err != nil {
+			glog.V(2).Infof("iceberg compact: auto strategy falling back to binpack: %v", err)
+			return &compactionRewritePlan{strategy: defaultRewriteStrategy}, nil
+		}
+		return newSortPlan(config, sortFields), nil
+	}
 	if strategy != "sort" {
 		return nil, fmt.Errorf("unsupported rewrite strategy %q", config.RewriteStrategy)
 	}
@@ -42,10 +55,18 @@ func resolveCompactionRewritePlan(config Config, meta table.Metadata) (*compacti
 		return nil, err
 	}
 
+	return newSortPlan(config, sortFields), nil
+}
+
+// newSortPlan pairs the resolved sort fields with the settings the sorted
+// merge needs while writing.
+func newSortPlan(config Config, sortFields []compactionSortField) *compactionRewritePlan {
 	return &compactionRewritePlan{
-		strategy:   strategy,
+		strategy:   "sort",
 		sortFields: sortFields,
-	}, nil
+		bufferRows: config.SortBufferRows,
+		spillDir:   config.SortSpillDir,
+	}
 }
 
 var errUnsupportedTableSortOrder = fmt.Errorf("unsupported table sort order")
diff --git a/weed/worker/tasks/iceberg/statistics_orphans_test.go b/weed/worker/tasks/iceberg/statistics_orphans_test.go
new file mode 100644
index 0000000000..0b4ed5c4fe
--- /dev/null
+++ b/weed/worker/tasks/iceberg/statistics_orphans_test.go
@@ -0,0 +1,79 @@
+package iceberg
+
+import (
+	"context"
+	"encoding/json"
+	"path"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go/table"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables/s3tablestest"
+)
+
+// Statistics files (Puffin, partition statistics) live under metadata/ and are
+// referenced from the table metadata's "statistics" and "partition-statistics"
+// lists, not from any snapshot's manifests. Orphan cleanup must count them as
+// referenced, or it deletes a table's statistics once they pass the window.
+func TestOrphanCleanupKeepsStatisticsFiles(t *testing.T) {
+	const bucket, namespace, tbl = "stats-bucket", "ns", "tbl"
+	tableRef := func(name string) string {
+		return "s3://" + bucket + "/" + namespace + "/" + tbl + "/metadata/" + name
+	}
+
+	base := buildTestMetadata(t, nil, nil, 0, nil, nil, nil)
+	raw, err := json.Marshal(base)
+	if err != nil {
+		t.Fatalf("marshal metadata: %v", err)
+	}
+	var doc map[string]any
+	if err := json.Unmarshal(raw, &doc); err != nil {
+		t.Fatalf("unmarshal metadata: %v", err)
+	}
+	doc["statistics"] = []any{map[string]any{
+		"snapshot-id": 1, "statistics-path": tableRef("stats-1.puffin"),
+		"file-size-in-bytes": 10, "file-footer-size-in-bytes": 5, "blob-metadata": []any{},
+	}}
+	doc["partition-statistics"] = []any{map[string]any{
+		"snapshot-id": 1, "statistics-path": tableRef("partition-stats-1.parquet"),
+		"file-size-in-bytes": 10,
+	}}
+	raw, err = json.Marshal(doc)
+	if err != nil {
+		t.Fatalf("marshal metadata with statistics: %v", err)
+	}
+	meta, err := table.ParseMetadataBytes(raw)
+	if err != nil {
+		t.Fatalf("parse metadata with statistics: %v", err)
+	}
+
+	filer := s3tablestest.Start(t)
+	tablePath := s3tables.GetTablePath(bucket, namespace, tbl)
+	metaDir := path.Join(tablePath, "metadata")
+	old := time.Now().Add(-30 * 24 * time.Hour)
+	filer.Put(tablePath, "metadata", nil)
+	filer.PutFile(metaDir, "v1.metadata.json", old)
+	filer.PutFile(metaDir, "stats-1.puffin", old)
+	filer.PutFile(metaDir, "partition-stats-1.parquet", old)
+	filer.PutFile(metaDir, "stats-0.puffin", old) // superseded: a real orphan
+	filer.PutFile(metaDir, "version-hint.text", old)
+
+	candidates, err := collectOrphanCandidates(context.Background(), filer.Client, bucket, path.Join(namespace, tbl),
+		meta, "v1.metadata.json", 1)
+	if err != nil {
+		t.Fatalf("collect orphan candidates: %v", err)
+	}
+	doomed := map[string]bool{}
+	for _, c := range candidates {
+		doomed[c.Entry.Name] = true
+	}
+	if !doomed["stats-0.puffin"] {
+		t.Fatalf("expected the unreferenced stats-0.puffin to be an orphan, got %v", doomed)
+	}
+	for _, name := range []string{"stats-1.puffin", "partition-stats-1.parquet", "v1.metadata.json", "version-hint.text"} {
+		if doomed[name] {
+			t.Errorf("%s is referenced by the table metadata and must not be an orphan", name)
+		}
+	}
+}
diff --git a/weed/worker/tasks/iceberg/table_config.go b/weed/worker/tasks/iceberg/table_config.go
new file mode 100644
index 0000000000..b4e2f5475e
--- /dev/null
+++ b/weed/worker/tasks/iceberg/table_config.go
@@ -0,0 +1,241 @@
+package iceberg
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path"
+	"strconv"
+	"strings"
+
+	"github.com/apache/iceberg-go"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+// Iceberg table properties that describe the physical layout maintenance has
+// to produce.
+const (
+	propTargetFileSize       = "write.target-file-size-bytes"
+	propDeleteTargetFileSize = "write.delete.target-file-size-bytes"
+	propRowGroupSize         = "write.parquet.row-group-size-bytes"
+	propRowGroupRowLimit     = "write.parquet.row-group-limit"
+	propMaxSnapshotAgeMs     = "history.expire.max-snapshot-age-ms"
+	propMinSnapshotsToKeep   = "history.expire.min-snapshots-to-keep"
+)
+
+// resolveTableConfig layers a table's own intent over the worker config, from
+// the maintenance configuration and from the table's Iceberg properties.
+//
+// Properties win by default: a writer targeting 512 MiB and a compactor
+// rewriting to 256 MiB would rewrite each other's output forever, and the
+// property is the signal every engine already honours. Operators who want the
+// control plane to be authoritative instead can clear
+// table_properties_override.
+func resolveTableConfig(base Config, props iceberg.Properties, maintenance s3tables.MaintenanceConfiguration) Config {
+	cfg := base
+	if base.TablePropertiesOverride {
+		cfg = applyMaintenanceConfig(cfg, maintenance)
+		cfg = applyTableProperties(cfg, props)
+	} else {
+		cfg = applyTableProperties(cfg, props)
+		cfg = applyMaintenanceConfig(cfg, maintenance)
+	}
+	return applyThresholdDefaults(cfg)
+}
+
+func applyTableProperties(cfg Config, props iceberg.Properties) Config {
+	if v, ok := propInt64(props, propTargetFileSize); ok {
+		cfg.TargetFileSizeBytes = v
+	}
+	if v, ok := propInt64(props, propDeleteTargetFileSize); ok {
+		cfg.DeleteTargetFileSizeBytes = v
+	}
+	if v, ok := propInt64(props, propRowGroupSize); ok {
+		cfg.RowGroupSizeBytes = v
+	}
+	if v, ok := propInt64(props, propRowGroupRowLimit); ok {
+		cfg.RowGroupRowLimit = v
+	}
+	if v, ok := propInt64(props, propMaxSnapshotAgeMs); ok {
+		cfg.SnapshotRetentionMs = v
+	}
+	if v, ok := propInt64(props, propMinSnapshotsToKeep); ok {
+		cfg.MaxSnapshotsToKeep = v
+	}
+	return cfg
+}
+
+func applyMaintenanceConfig(cfg Config, maintenance s3tables.MaintenanceConfiguration) Config {
+	if s := compactionSettings(maintenance); s != nil {
+		if v := settingValue(s.TargetFileSizeMB); v > 0 {
+			cfg.TargetFileSizeBytes = mbToBytes(v)
+		}
+		switch s.Strategy {
+		case s3tables.CompactionStrategyBinpack, s3tables.CompactionStrategySort, s3tables.CompactionStrategyAuto:
+			cfg.RewriteStrategy = s.Strategy
+		}
+	}
+	if s := snapshotSettings(maintenance); s != nil {
+		if v := settingValue(s.MaxSnapshotAgeHours); v > 0 {
+			cfg.SnapshotRetentionMs = hoursToMs(v)
+		}
+		if v := settingValue(s.MinSnapshotsToKeep); v > 0 {
+			cfg.MaxSnapshotsToKeep = v
+		}
+	}
+	// AWS marks a file non-current after unreferencedDays and deletes it a
+	// further nonCurrentDays later. remove_orphans deletes in one step, so the
+	// cutoff has to be the sum or the recovery window disappears.
+	if s := orphanSettings(maintenance); s != nil {
+		if days := addDays(settingValue(s.UnreferencedDays), settingValue(s.NonCurrentDays)); days > 0 {
+			cfg.OrphanOlderThanHours = daysToHours(days)
+		}
+	}
+	return cfg
+}
+
+// settingValue reads an optional maintenance setting, treating unset and
+// nonsensical values alike so the worker keeps its own configuration.
+func settingValue(v *int64) int64 {
+	if v == nil || *v < 0 {
+		return 0
+	}
+	return *v
+}
+
+func compactionSettings(maintenance s3tables.MaintenanceConfiguration) *s3tables.IcebergCompactionSettings {
+	if v := enabledSettings(maintenance, s3tables.MaintenanceTypeIcebergCompaction); v != nil {
+		return v.IcebergCompaction
+	}
+	return nil
+}
+
+func snapshotSettings(maintenance s3tables.MaintenanceConfiguration) *s3tables.IcebergSnapshotManagementSettings {
+	if v := enabledSettings(maintenance, s3tables.MaintenanceTypeIcebergSnapshotManagement); v != nil {
+		return v.IcebergSnapshotManagement
+	}
+	return nil
+}
+
+func orphanSettings(maintenance s3tables.MaintenanceConfiguration) *s3tables.IcebergUnreferencedFileRemovalSettings {
+	if v := enabledSettings(maintenance, s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval); v != nil {
+		return v.IcebergUnreferencedFileRemoval
+	}
+	return nil
+}
+
+// enabledSettings returns the settings for a maintenance type only when it is
+// switched on; a disabled type drops its operations instead of retuning them.
+func enabledSettings(maintenance s3tables.MaintenanceConfiguration, maintenanceType string) *s3tables.MaintenanceSettings {
+	value, ok := maintenance[maintenanceType]
+	if !ok || value == nil || value.Status == s3tables.MaintenanceStatusDisabled {
+		return nil
+	}
+	return value.Settings
+}
+
+var mergeMaintenanceConfiguration = s3tables.MergeMaintenanceConfiguration
+
+// maintenanceJobType maps a worker operation onto the AWS job type that governs
+// it. Manifest and delete-file rewrites have no AWS equivalent and ride along
+// with compaction, so disabling compaction stops all rewriting.
+func maintenanceJobType(op string) string {
+	switch op {
+	case "compact", "rewrite_position_delete_files", "rewrite_manifests":
+		return s3tables.MaintenanceTypeIcebergCompaction
+	case "expire_snapshots":
+		return s3tables.MaintenanceTypeIcebergSnapshotManagement
+	case "remove_orphans":
+		return s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval
+	}
+	return ""
+}
+
+// filterDisabledOperations drops the operations the maintenance configuration
+// switched off. No table property can re-enable them.
+func filterDisabledOperations(ops []string, maintenance s3tables.MaintenanceConfiguration) []string {
+	if len(maintenance) == 0 {
+		return ops
+	}
+
+	filtered := make([]string, 0, len(ops))
+	for _, op := range ops {
+		value, ok := maintenance[maintenanceJobType(op)]
+		if ok && value != nil && value.Status == s3tables.MaintenanceStatusDisabled {
+			continue
+		}
+		filtered = append(filtered, op)
+	}
+	return filtered
+}
+
+// loadMaintenanceConfiguration reads the bucket and table maintenance
+// configuration and overlays the table's on the bucket's. Detection gets both
+// from entries it already listed; execution has to look them up.
+func loadMaintenanceConfiguration(ctx context.Context, client filer_pb.SeaweedFilerClient, bucketName, tablePath string) (s3tables.MaintenanceConfiguration, error) {
+	bucketDir := path.Join(s3tables.TablesPath, bucketName)
+	tableDir := path.Join(bucketDir, tablePath)
+
+	bucket, err := lookupMaintenanceConfiguration(ctx, client, bucketDir, bucketName)
+	if err != nil {
+		return nil, err
+	}
+	table, err := lookupMaintenanceConfiguration(ctx, client, tableDir, path.Join(bucketName, tablePath))
+	if err != nil {
+		return nil, err
+	}
+	return mergeMaintenanceConfiguration(bucket, table), nil
+}
+
+func lookupMaintenanceConfiguration(ctx context.Context, client filer_pb.SeaweedFilerClient, dir, resource string) (s3tables.MaintenanceConfiguration, error) {
+	resp, err := filer_pb.LookupEntry(ctx, client, &filer_pb.LookupDirectoryEntryRequest{
+		Directory: path.Dir(dir),
+		Name:      path.Base(dir),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("look up %s: %w", resource, err)
+	}
+	if resp == nil || resp.Entry == nil {
+		return nil, nil
+	}
+	return parseMaintenanceConfiguration(resp.Entry.Extended, resource)
+}
+
+// parseMaintenanceConfiguration reads the maintenance configuration stored on a
+// filer entry. An unreadable attribute is an error rather than an empty
+// configuration: treating it as empty would run operations the operator
+// disabled.
+func parseMaintenanceConfiguration(extended map[string][]byte, resource string) (s3tables.MaintenanceConfiguration, error) {
+	data, ok := extended[s3tables.ExtendedKeyMaintenance]
+	if !ok || len(data) == 0 {
+		return nil, nil
+	}
+
+	var config s3tables.MaintenanceConfiguration
+	if err := json.Unmarshal(data, &config); err != nil {
+		return nil, fmt.Errorf("parse maintenance configuration on %s: %w", resource, err)
+	}
+	return config, nil
+}
+
+// propInt64 reads a positive integer table property. Anything unset,
+// unparseable or non-positive leaves the worker config in place so a
+// misconfigured table never stops its own maintenance.
+func propInt64(props iceberg.Properties, key string) (int64, bool) {
+	raw, ok := props[key]
+	if !ok {
+		return 0, false
+	}
+	value, err := strconv.ParseInt(strings.TrimSpace(raw), 10, 64)
+	if err != nil {
+		glog.V(1).Infof("iceberg maintenance: ignoring table property %s=%q: not an integer", key, raw)
+		return 0, false
+	}
+	if value <= 0 {
+		glog.V(1).Infof("iceberg maintenance: ignoring table property %s=%d: not positive", key, value)
+		return 0, false
+	}
+	return value, true
+}
diff --git a/weed/worker/tasks/iceberg/table_config_test.go b/weed/worker/tasks/iceberg/table_config_test.go
new file mode 100644
index 0000000000..42f6f87a32
--- /dev/null
+++ b/weed/worker/tasks/iceberg/table_config_test.go
@@ -0,0 +1,406 @@
+package iceberg
+
+import (
+	"errors"
+	"math"
+	"testing"
+	"time"
+
+	"github.com/apache/iceberg-go"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
+)
+
+func settingPtr(v int64) *int64 { return &v }
+
+func baseTestConfig() Config {
+	return applyThresholdDefaults(Config{
+		SnapshotRetentionMs:     hoursToMs(defaultSnapshotRetentionHours),
+		MaxSnapshotsToKeep:      defaultMaxSnapshotsToKeep,
+		TablePropertiesOverride: true,
+	})
+}
+
+func TestResolveTableConfigNoProperties(t *testing.T) {
+	base := baseTestConfig()
+
+	got := resolveTableConfig(base, iceberg.Properties{}, nil)
+	if got != base {
+		t.Errorf("expected config untouched, got %+v", got)
+	}
+
+	if got := resolveTableConfig(base, nil, nil); got != base {
+		t.Errorf("expected config untouched for nil properties, got %+v", got)
+	}
+}
+
+func TestResolveTableConfigPropertiesWin(t *testing.T) {
+	base := baseTestConfig()
+	got := resolveTableConfig(base, iceberg.Properties{
+		propTargetFileSize:       "536870912",
+		propDeleteTargetFileSize: "33554432",
+		propMaxSnapshotAgeMs:     "432000000",
+		propMinSnapshotsToKeep:   "1",
+	}, nil)
+
+	if got.TargetFileSizeBytes != 536870912 {
+		t.Errorf("expected TargetFileSizeBytes=536870912, got %d", got.TargetFileSizeBytes)
+	}
+	if got.DeleteTargetFileSizeBytes != 33554432 {
+		t.Errorf("expected DeleteTargetFileSizeBytes=33554432, got %d", got.DeleteTargetFileSizeBytes)
+	}
+	if got.SnapshotRetentionMs != 432000000 {
+		t.Errorf("expected SnapshotRetentionMs=432000000, got %d", got.SnapshotRetentionMs)
+	}
+	if got.MaxSnapshotsToKeep != 1 {
+		t.Errorf("expected MaxSnapshotsToKeep=1, got %d", got.MaxSnapshotsToKeep)
+	}
+}
+
+// A sub-hour retention has to survive resolution; truncating it to whole hours
+// would round down to zero and get clamped back up to the default.
+func TestResolveTableConfigSubHourRetention(t *testing.T) {
+	got := resolveTableConfig(baseTestConfig(), iceberg.Properties{propMaxSnapshotAgeMs: "1"}, nil)
+	if got.SnapshotRetentionMs != 1 {
+		t.Errorf("expected SnapshotRetentionMs=1, got %d", got.SnapshotRetentionMs)
+	}
+}
+
+func TestResolveTableConfigIgnoresUnusableValues(t *testing.T) {
+	base := baseTestConfig()
+
+	for name, value := range map[string]string{
+		"not a number": "512mb",
+		"empty":        "",
+		"zero":         "0",
+		"negative":     "-1",
+		"overflow":     "99999999999999999999",
+	} {
+		t.Run(name, func(t *testing.T) {
+			got := resolveTableConfig(base, iceberg.Properties{propTargetFileSize: value}, nil)
+			if got.TargetFileSizeBytes != base.TargetFileSizeBytes {
+				t.Errorf("expected fallback to %d, got %d", base.TargetFileSizeBytes, got.TargetFileSizeBytes)
+			}
+		})
+	}
+}
+
+func TestResolveTableConfigTrimsWhitespace(t *testing.T) {
+	got := resolveTableConfig(baseTestConfig(), iceberg.Properties{propTargetFileSize: "  536870912\n"}, nil)
+	if got.TargetFileSizeBytes != 536870912 {
+		t.Errorf("expected TargetFileSizeBytes=536870912, got %d", got.TargetFileSizeBytes)
+	}
+}
+
+func TestResolveTableConfigLeavesOtherFields(t *testing.T) {
+	base := baseTestConfig()
+	base.Operations = "compact"
+	base.Where = "day = 3"
+	base.MinInputFiles = 9
+
+	got := resolveTableConfig(base, iceberg.Properties{propTargetFileSize: "536870912"}, nil)
+	if got.Operations != "compact" || got.Where != "day = 3" || got.MinInputFiles != 9 {
+		t.Errorf("expected unrelated fields preserved, got %+v", got)
+	}
+}
+
+// An orphan cutoff large enough to overflow time.Duration would wrap negative,
+// put the cutoff in the future and make every file look like an orphan.
+func TestApplyThresholdDefaultsClampsOrphanCutoff(t *testing.T) {
+	got := applyThresholdDefaults(Config{OrphanOlderThanHours: math.MaxInt64})
+	if got.OrphanOlderThanHours != maxOrphanOlderThanHours {
+		t.Fatalf("expected the cutoff clamped to %d, got %d", maxOrphanOlderThanHours, got.OrphanOlderThanHours)
+	}
+	if cutoff := time.Duration(got.OrphanOlderThanHours) * time.Hour; cutoff <= 0 {
+		t.Errorf("expected a positive cutoff duration, got %v", cutoff)
+	}
+
+	if got := applyThresholdDefaults(Config{OrphanOlderThanHours: 72}); got.OrphanOlderThanHours != 72 {
+		t.Errorf("expected a normal cutoff untouched, got %d", got.OrphanOlderThanHours)
+	}
+}
+
+func maintenanceConfig(entries map[string]*s3tables.MaintenanceConfigurationValue) s3tables.MaintenanceConfiguration {
+	return s3tables.MaintenanceConfiguration(entries)
+}
+
+func TestResolveTableConfigAppliesMaintenanceConfig(t *testing.T) {
+	got := resolveTableConfig(baseTestConfig(), nil, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergCompaction: {
+			Status:   s3tables.MaintenanceStatusEnabled,
+			Settings: &s3tables.MaintenanceSettings{IcebergCompaction: &s3tables.IcebergCompactionSettings{TargetFileSizeMB: settingPtr(512)}},
+		},
+		s3tables.MaintenanceTypeIcebergSnapshotManagement: {
+			Status: s3tables.MaintenanceStatusEnabled,
+			Settings: &s3tables.MaintenanceSettings{IcebergSnapshotManagement: &s3tables.IcebergSnapshotManagementSettings{
+				MinSnapshotsToKeep:  settingPtr(2),
+				MaxSnapshotAgeHours: settingPtr(120),
+			}},
+		},
+	}))
+
+	if got.TargetFileSizeBytes != 512*bytesPerMB {
+		t.Errorf("expected TargetFileSizeBytes=%d, got %d", 512*bytesPerMB, got.TargetFileSizeBytes)
+	}
+	if got.MaxSnapshotsToKeep != 2 {
+		t.Errorf("expected MaxSnapshotsToKeep=2, got %d", got.MaxSnapshotsToKeep)
+	}
+	if got.SnapshotRetentionMs != hoursToMs(120) {
+		t.Errorf("expected SnapshotRetentionMs=%d, got %d", hoursToMs(120), got.SnapshotRetentionMs)
+	}
+}
+
+// The default: a table declaring its own layout beats the control plane, so a
+// writer and the compactor cannot disagree about target file size.
+func TestResolveTableConfigPropertyBeatsMaintenanceConfig(t *testing.T) {
+	maintenance := maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergCompaction: {
+			Status:   s3tables.MaintenanceStatusEnabled,
+			Settings: &s3tables.MaintenanceSettings{IcebergCompaction: &s3tables.IcebergCompactionSettings{TargetFileSizeMB: settingPtr(128)}},
+		},
+	})
+	props := iceberg.Properties{propTargetFileSize: "536870912"}
+
+	got := resolveTableConfig(baseTestConfig(), props, maintenance)
+	if got.TargetFileSizeBytes != 536870912 {
+		t.Errorf("expected the property to win with 536870912, got %d", got.TargetFileSizeBytes)
+	}
+
+	base := baseTestConfig()
+	base.TablePropertiesOverride = false
+	got = resolveTableConfig(base, props, maintenance)
+	if got.TargetFileSizeBytes != 128*bytesPerMB {
+		t.Errorf("expected the maintenance config to win with %d, got %d", 128*bytesPerMB, got.TargetFileSizeBytes)
+	}
+}
+
+// A disabled type drops its operations rather than contributing settings.
+func TestResolveTableConfigIgnoresDisabledSettings(t *testing.T) {
+	base := baseTestConfig()
+	got := resolveTableConfig(base, nil, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergCompaction: {
+			Status:   s3tables.MaintenanceStatusDisabled,
+			Settings: &s3tables.MaintenanceSettings{IcebergCompaction: &s3tables.IcebergCompactionSettings{TargetFileSizeMB: settingPtr(512)}},
+		},
+	}))
+
+	if got.TargetFileSizeBytes != base.TargetFileSizeBytes {
+		t.Errorf("expected disabled settings ignored, got %d", got.TargetFileSizeBytes)
+	}
+}
+
+func TestFilterDisabledOperations(t *testing.T) {
+	all := []string{"compact", "rewrite_position_delete_files", "expire_snapshots", "remove_orphans", "rewrite_manifests"}
+
+	if got := filterDisabledOperations(all, nil); len(got) != len(all) {
+		t.Errorf("expected no filtering without a configuration, got %v", got)
+	}
+
+	got := filterDisabledOperations(all, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergCompaction:              {Status: s3tables.MaintenanceStatusDisabled},
+		s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval: {Status: s3tables.MaintenanceStatusDisabled},
+	}))
+	want := []string{"expire_snapshots"}
+	if len(got) != len(want) || got[0] != want[0] {
+		t.Errorf("expected %v, got %v", want, got)
+	}
+
+	if got := filterDisabledOperations(all, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergCompaction: {Status: s3tables.MaintenanceStatusEnabled},
+	})); len(got) != len(all) {
+		t.Errorf("expected an enabled type to filter nothing, got %v", got)
+	}
+}
+
+func TestMergeMaintenanceConfigurationTableWins(t *testing.T) {
+	bucket := maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval: {Status: s3tables.MaintenanceStatusEnabled},
+		s3tables.MaintenanceTypeIcebergCompaction:              {Status: s3tables.MaintenanceStatusEnabled},
+	})
+	table := maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergCompaction: {Status: s3tables.MaintenanceStatusDisabled},
+	})
+
+	merged := mergeMaintenanceConfiguration(bucket, table)
+	if merged[s3tables.MaintenanceTypeIcebergCompaction].Status != s3tables.MaintenanceStatusDisabled {
+		t.Error("expected the table entry to win")
+	}
+	if merged[s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval].Status != s3tables.MaintenanceStatusEnabled {
+		t.Error("expected the bucket-only entry retained")
+	}
+
+	if got := mergeMaintenanceConfiguration(nil, table); len(got) != 1 {
+		t.Errorf("expected the table configuration passed through, got %v", got)
+	}
+	if got := mergeMaintenanceConfiguration(bucket, nil); len(got) != 2 {
+		t.Errorf("expected the bucket configuration passed through, got %v", got)
+	}
+}
+
+func TestParseMaintenanceConfiguration(t *testing.T) {
+	got, err := parseMaintenanceConfiguration(nil, "bucket")
+	if err != nil || got != nil {
+		t.Errorf("expected nil for a missing attribute, got %v (%v)", got, err)
+	}
+
+	// Unreadable must be an error, not an empty configuration: empty would run
+	// operations the operator disabled.
+	if _, err := parseMaintenanceConfiguration(map[string][]byte{s3tables.ExtendedKeyMaintenance: []byte("{")}, "bucket"); err == nil {
+		t.Error("expected an error for a malformed attribute")
+	}
+
+	data := []byte(`{"icebergCompaction":{"status":"disabled"}}`)
+	got, err = parseMaintenanceConfiguration(map[string][]byte{s3tables.ExtendedKeyMaintenance: data}, "bucket")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if got[s3tables.MaintenanceTypeIcebergCompaction].Status != s3tables.MaintenanceStatusDisabled {
+		t.Errorf("expected compaction disabled, got %v", got)
+	}
+}
+
+// unreferencedDays large enough to overflow must not land a cutoff in the future.
+func TestResolveTableConfigClampsUnreferencedDays(t *testing.T) {
+	got := resolveTableConfig(baseTestConfig(), nil, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval: {
+			Status: s3tables.MaintenanceStatusEnabled,
+			Settings: &s3tables.MaintenanceSettings{
+				IcebergUnreferencedFileRemoval: &s3tables.IcebergUnreferencedFileRemovalSettings{UnreferencedDays: settingPtr(math.MaxInt64)},
+			},
+		},
+	}))
+
+	if got.OrphanOlderThanHours != maxOrphanOlderThanHours {
+		t.Fatalf("expected the cutoff clamped to %d, got %d", maxOrphanOlderThanHours, got.OrphanOlderThanHours)
+	}
+	if cutoff := time.Duration(got.OrphanOlderThanHours) * time.Hour; cutoff <= 0 {
+		t.Errorf("expected a positive cutoff duration, got %v", cutoff)
+	}
+
+	got = resolveTableConfig(baseTestConfig(), nil, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+		s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval: {
+			Status: s3tables.MaintenanceStatusEnabled,
+			Settings: &s3tables.MaintenanceSettings{
+				IcebergUnreferencedFileRemoval: &s3tables.IcebergUnreferencedFileRemovalSettings{UnreferencedDays: settingPtr(3)},
+			},
+		},
+	}))
+	if got.OrphanOlderThanHours != 72 {
+		t.Errorf("expected 3 days to be 72 hours, got %d", got.OrphanOlderThanHours)
+	}
+}
+
+// AWS marks a file non-current after unreferencedDays and deletes it
+// nonCurrentDays later; deleting in one step has to wait for both.
+func TestResolveTableConfigAddsNonCurrentWindow(t *testing.T) {
+	orphan := func(unreferenced, nonCurrent int64) Config {
+		return resolveTableConfig(baseTestConfig(), nil, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+			s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval: {
+				Status: s3tables.MaintenanceStatusEnabled,
+				Settings: &s3tables.MaintenanceSettings{
+					IcebergUnreferencedFileRemoval: &s3tables.IcebergUnreferencedFileRemovalSettings{
+						UnreferencedDays: settingPtr(unreferenced),
+						NonCurrentDays:   settingPtr(nonCurrent),
+					},
+				},
+			},
+		}))
+	}
+
+	if got := orphan(3, 10); got.OrphanOlderThanHours != 13*24 {
+		t.Errorf("expected 3+10 days to be %d hours, got %d", 13*24, got.OrphanOlderThanHours)
+	}
+	if got := orphan(0, 10); got.OrphanOlderThanHours != 10*24 {
+		t.Errorf("expected nonCurrentDays alone to apply, got %d", got.OrphanOlderThanHours)
+	}
+	if got := orphan(math.MaxInt64, math.MaxInt64); got.OrphanOlderThanHours != maxOrphanOlderThanHours {
+		t.Errorf("expected the sum clamped, got %d", got.OrphanOlderThanHours)
+	}
+}
+
+func TestBuildJobStatus(t *testing.T) {
+	ranAt := time.Unix(1755250000, 0).UTC()
+
+	jobStatus := buildJobStatus(map[string]error{
+		"compact":          nil,
+		"expire_snapshots": nil,
+	}, ranAt)
+
+	compaction := jobStatus[s3tables.MaintenanceTypeIcebergCompaction]
+	if compaction == nil || compaction.Status != s3tables.MaintenanceJobStatusSuccessful {
+		t.Fatalf("expected compaction successful, got %+v", compaction)
+	}
+	if compaction.LastRunTimestamp == nil || !compaction.LastRunTimestamp.Equal(ranAt) {
+		t.Errorf("expected lastRunTimestamp %v, got %v", ranAt, compaction.LastRunTimestamp)
+	}
+	if _, ok := jobStatus[s3tables.MaintenanceTypeIcebergUnreferencedFileRemoval]; ok {
+		t.Error("expected an operation that did not run to be left out")
+	}
+}
+
+// Several operations share one AWS job type, so one failure fails the type.
+func TestBuildJobStatusFailureWins(t *testing.T) {
+	jobStatus := buildJobStatus(map[string]error{
+		"compact":           nil,
+		"rewrite_manifests": errors.New("commit conflict"),
+	}, time.Unix(1755250000, 0).UTC())
+
+	compaction := jobStatus[s3tables.MaintenanceTypeIcebergCompaction]
+	if compaction.Status != s3tables.MaintenanceJobStatusFailed {
+		t.Errorf("expected compaction failed, got %q", compaction.Status)
+	}
+	if compaction.FailureMessage != "commit conflict" {
+		t.Errorf("expected the failure message carried, got %q", compaction.FailureMessage)
+	}
+}
+
+func TestBuildJobStatusEmpty(t *testing.T) {
+	if got := buildJobStatus(nil, time.Now()); len(got) != 0 {
+		t.Errorf("expected an empty status, got %v", got)
+	}
+}
+
+func TestResolveTableConfigAppliesCompactionStrategy(t *testing.T) {
+	withStrategy := func(strategy string) Config {
+		return resolveTableConfig(baseTestConfig(), nil, maintenanceConfig(map[string]*s3tables.MaintenanceConfigurationValue{
+			s3tables.MaintenanceTypeIcebergCompaction: {
+				Status:   s3tables.MaintenanceStatusEnabled,
+				Settings: &s3tables.MaintenanceSettings{IcebergCompaction: &s3tables.IcebergCompactionSettings{Strategy: strategy}},
+			},
+		}))
+	}
+
+	if got := withStrategy(s3tables.CompactionStrategySort); got.RewriteStrategy != "sort" {
+		t.Errorf("expected sort, got %q", got.RewriteStrategy)
+	}
+	if got := withStrategy(s3tables.CompactionStrategyBinpack); got.RewriteStrategy != "binpack" {
+		t.Errorf("expected binpack, got %q", got.RewriteStrategy)
+	}
+
+	// "auto" is carried through so the plan can pick per table.
+	if got := withStrategy(s3tables.CompactionStrategyAuto); got.RewriteStrategy != rewriteStrategyAuto {
+		t.Errorf("expected auto preserved, got %q", got.RewriteStrategy)
+	}
+}
+
+// AWS defines auto as sorting tables that declare a sort order and bin-packing
+// the rest, so it must not collapse to the worker default.
+func TestResolveCompactionRewritePlanAuto(t *testing.T) {
+	cfg := baseTestConfig()
+	cfg.RewriteStrategy = rewriteStrategyAuto
+
+	unsorted := buildTestMetadata(t, nil, nil, 0, nil, nil, nil)
+	plan, err := resolveCompactionRewritePlan(cfg, unsorted)
+	if err != nil {
+		t.Fatalf("auto must not fail on an unsorted table: %v", err)
+	}
+	if plan.strategy != defaultRewriteStrategy {
+		t.Errorf("expected binpack for an unsorted table, got %q", plan.strategy)
+	}
+
+	// An explicit sort request on the same table is still an error, so auto is
+	// doing something the existing strategies did not.
+	cfg.RewriteStrategy = "sort"
+	if _, err := resolveCompactionRewritePlan(cfg, unsorted); err == nil {
+		t.Error("expected explicit sort to fail without a table sort order")
+	}
+}
diff --git a/weed/worker/tasks/iceberg/testdata/plain-dictionary.parquet b/weed/worker/tasks/iceberg/testdata/plain-dictionary.parquet
new file mode 100644
index 0000000000..8b8282625e
Binary files /dev/null and b/weed/worker/tasks/iceberg/testdata/plain-dictionary.parquet differ
diff --git a/weed/worker/tasks/s3_lifecycle/handler.go b/weed/worker/tasks/s3_lifecycle/handler.go
index 499520376b..50d9d4a021 100644
--- a/weed/worker/tasks/s3_lifecycle/handler.go
+++ b/weed/worker/tasks/s3_lifecycle/handler.go
@@ -7,6 +7,7 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/seaweedfs/seaweedfs/weed/credential"
 	"github.com/seaweedfs/seaweedfs/weed/glog"
 	"github.com/seaweedfs/seaweedfs/weed/pb"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
@@ -312,12 +313,12 @@ func (h *Handler) executeDailyReplay(ctx context.Context, request *plugin_pb.Exe
 			buckets = append(buckets, in.Bucket)
 		}
 	}
-	walkerListFn := dailyrun.FilerListFunc(filerClient, bucketsPath)
 	// Share the limiter with processMatches so walker + replay can't
 	// combine to burst past the cluster cap.
 	walkerDispatch := &dailyrun.WalkerDispatcher{Client: client, Limiter: limiter}
-	walker := dailyrun.WalkerFunc(func(walkCtx context.Context, view *engine.Snapshot, shardID int) error {
-		return dailyrun.WalkBuckets(walkCtx, view, shardID, buckets, walkerListFn, walkerDispatch)
+	walker := dailyrun.WalkerFunc(func(walkCtx context.Context, view *engine.Snapshot, shards []int) error {
+		return dailyrun.WalkBuckets(walkCtx, view, shards, buckets,
+			dailyrun.FilerListFunc(filerClient, bucketsPath, view), walkerDispatch)
 	})
 
 	_ = sender.SendProgress(&plugin_pb.JobProgressUpdate{
@@ -423,6 +424,7 @@ type lifecycleRPCAdapter struct {
 }
 
 func (a lifecycleRPCAdapter) LifecycleDelete(ctx context.Context, req *s3_lifecycle_pb.LifecycleDeleteRequest) (*s3_lifecycle_pb.LifecycleDeleteResponse, error) {
+	ctx, _ = credential.WithS3InternalAdminAuth(ctx)
 	return a.c.LifecycleDelete(ctx, req)
 }
 
diff --git a/weed/worker/tasks/vacuum/config.go b/weed/worker/tasks/vacuum/config.go
index 5d4469707b..e97970b657 100644
--- a/weed/worker/tasks/vacuum/config.go
+++ b/weed/worker/tasks/vacuum/config.go
@@ -73,12 +73,25 @@ func LoadConfigFromPersistence(configPersistence interface{}) *Config {
 	if persistence, ok := configPersistence.(interface {
 		LoadVacuumTaskPolicy() (*worker_pb.TaskPolicy, error)
 	}); ok {
-		if policy, err := persistence.LoadVacuumTaskPolicy(); err == nil && policy != nil {
-			if err := config.FromTaskPolicy(policy); err == nil {
+		policy, err := persistence.LoadVacuumTaskPolicy()
+		switch {
+		case err != nil:
+			glog.Warningf("Could not read the persisted vacuum configuration, falling back to defaults: %v", err)
+		case policy == nil:
+			glog.V(1).Infof("No vacuum configuration persisted yet, using defaults")
+		default:
+			if err := config.FromTaskPolicy(policy); err != nil {
+				glog.Warningf("Could not apply the persisted vacuum configuration, falling back to defaults: %v", err)
+			} else {
 				glog.V(1).Infof("Loaded vacuum configuration from persistence")
 				return config
 			}
 		}
+	} else if configPersistence != nil {
+		// A store was handed in but does not expose the accessor, so the persisted
+		// settings are silently ignored - always a wiring bug, never a normal state.
+		glog.Warningf("%T cannot provide the persisted vacuum configuration: it has no LoadVacuumTaskPolicy() method, "+
+			"so the compiled-in defaults are used and any saved vacuum settings are ignored", configPersistence)
 	}
 
 	glog.V(1).Infof("Using default vacuum configuration")
diff --git a/weed/worker/tasks/vacuum/config_persistence_test.go b/weed/worker/tasks/vacuum/config_persistence_test.go
new file mode 100644
index 0000000000..e37e35bc76
--- /dev/null
+++ b/weed/worker/tasks/vacuum/config_persistence_test.go
@@ -0,0 +1,75 @@
+package vacuum
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/worker_pb"
+)
+
+type stubVacuumStore struct {
+	policy *worker_pb.TaskPolicy
+	err    error
+}
+
+func (s *stubVacuumStore) LoadVacuumTaskPolicy() (*worker_pb.TaskPolicy, error) {
+	return s.policy, s.err
+}
+
+// wrongShapedStore is what the maintenance manager used to be handed: a non-nil value that
+// does not satisfy the accessor the loader asserts on. It has to keep falling back to the
+// defaults, but no longer silently: a fallback the operator cannot see reads as a disabled task
+// that keeps running.
+type wrongShapedStore struct{}
+
+func (wrongShapedStore) SomethingElse() {}
+
+func TestLoadConfigFromPersistenceUsesPersistedPolicy(t *testing.T) {
+	persisted := NewDefaultConfig()
+	persisted.Enabled = false
+	persisted.GarbageThreshold = 0.75
+	persisted.MaxConcurrent = 5
+
+	loaded := LoadConfigFromPersistence(&stubVacuumStore{policy: persisted.ToTaskPolicy()})
+	if loaded == nil {
+		t.Fatal("LoadConfigFromPersistence returned nil")
+	}
+	if loaded.Enabled {
+		t.Error("enabled = true, want the persisted false")
+	}
+	if loaded.GarbageThreshold != 0.75 {
+		t.Errorf("garbage threshold = %v, want the persisted 0.75", loaded.GarbageThreshold)
+	}
+	if loaded.MaxConcurrent != 5 {
+		t.Errorf("max concurrent = %d, want the persisted 5", loaded.MaxConcurrent)
+	}
+}
+
+func TestLoadConfigFromPersistenceFallsBackToDefaults(t *testing.T) {
+	defaults := NewDefaultConfig()
+
+	cases := map[string]interface{}{
+		"no store configured":     nil,
+		"store without the value": &stubVacuumStore{},
+		"store that errors":       &stubVacuumStore{err: errors.New("disk on fire")},
+		"store of the wrong type": wrongShapedStore{},
+	}
+
+	for name, store := range cases {
+		t.Run(name, func(t *testing.T) {
+			loaded := LoadConfigFromPersistence(store)
+			if loaded == nil {
+				t.Fatal("LoadConfigFromPersistence returned nil")
+			}
+			if !loaded.Enabled {
+				t.Error("enabled = false, want the compiled-in default true")
+			}
+			if loaded.GarbageThreshold != defaults.GarbageThreshold {
+				t.Errorf("garbage threshold = %v, want the default %v", loaded.GarbageThreshold, defaults.GarbageThreshold)
+			}
+			if loaded.ScanIntervalSeconds != defaults.ScanIntervalSeconds {
+				t.Errorf("scan interval = %d, want the default %d", loaded.ScanIntervalSeconds, defaults.ScanIntervalSeconds)
+			}
+		})
+	}
+}
diff --git a/weed/worker/tasks/vacuum/detection.go b/weed/worker/tasks/vacuum/detection.go
index a52cca18f6..bc5eb41d9e 100644
--- a/weed/worker/tasks/vacuum/detection.go
+++ b/weed/worker/tasks/vacuum/detection.go
@@ -109,10 +109,14 @@ func Detection(metrics []*types.VolumeHealthMetrics, clusterInfo *types.ClusterI
 }
 
 // pickPrimaryReplica returns the eligible replica with the highest garbage
-// ratio. Returns nil if no replica satisfies both gates.
+// ratio. Returns nil if no replica satisfies both gates. Replicas tiered to
+// remote storage are skipped: the volume server cannot compact them.
 func pickPrimaryReplica(replicas []*types.VolumeHealthMetrics, garbageThreshold float64, minAge time.Duration) *types.VolumeHealthMetrics {
 	var best *types.VolumeHealthMetrics
 	for _, m := range replicas {
+		if m.HasRemoteCopy {
+			continue
+		}
 		if m.GarbageRatio < garbageThreshold {
 			continue
 		}
@@ -144,7 +148,7 @@ func recordSkipReasons(replicas []*types.VolumeHealthMetrics, garbageThreshold f
 }
 
 // createVacuumTaskParams creates typed parameters for a vacuum task whose
-// Sources list contains every replica of the volume. Worker-side
+// Sources list contains every non-tiered replica of the volume. Worker-side
 // performVacuum iterates over Sources and vacuums each replica.
 func createVacuumTaskParams(task *types.TaskDetectionResult, replicas []*types.VolumeHealthMetrics, vacuumConfig *Config, clusterInfo *types.ClusterInfo) *worker_pb.TaskParams {
 	garbageThreshold := 0.3
@@ -164,6 +168,9 @@ func createVacuumTaskParams(task *types.TaskDetectionResult, replicas []*types.V
 	sources := make([]*worker_pb.TaskSource, 0, len(replicas))
 	seen := make(map[string]struct{}, len(replicas))
 	for _, m := range replicas {
+		if m.HasRemoteCopy {
+			continue
+		}
 		address, err := util.ResolveServerAddress(m.Server, clusterInfo.ActiveTopology)
 		if err != nil {
 			glog.Warningf("Failed to resolve address for server %s for vacuum task on volume %d, dropping replica: %v", m.Server, task.VolumeID, err)
diff --git a/weed/worker/tasks/vacuum/detection_tiered_test.go b/weed/worker/tasks/vacuum/detection_tiered_test.go
new file mode 100644
index 0000000000..5232b45ea9
--- /dev/null
+++ b/weed/worker/tasks/vacuum/detection_tiered_test.go
@@ -0,0 +1,25 @@
+package vacuum
+
+import (
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/worker/types"
+)
+
+func TestPickPrimaryReplicaSkipsTieredReplicas(t *testing.T) {
+	m := func(id uint32, server string, remote bool) *types.VolumeHealthMetrics {
+		return &types.VolumeHealthMetrics{VolumeID: id, Server: server, GarbageRatio: 0.9, Age: 72 * time.Hour,
+			HasRemoteCopy: remote, IsReadOnly: remote}
+	}
+	if p := pickPrimaryReplica([]*types.VolumeHealthMetrics{m(1, "a:8080", false)}, 0.3, 24*time.Hour); p == nil {
+		t.Fatal("a local volume at 90% garbage must be picked")
+	}
+	if p := pickPrimaryReplica([]*types.VolumeHealthMetrics{m(2, "a:8080", true)}, 0.3, 24*time.Hour); p != nil {
+		t.Fatalf("tiered replica of volume %d picked for vacuum", p.VolumeID)
+	}
+	p := pickPrimaryReplica([]*types.VolumeHealthMetrics{m(3, "a:8080", true), m(3, "b:8080", false)}, 0.3, 24*time.Hour)
+	if p == nil || p.Server != "b:8080" {
+		t.Fatalf("partially tiered volume should pick its local replica, got %+v", p)
+	}
+}
diff --git a/weed/worker/tasks/vacuum/plugin_handler.go b/weed/worker/tasks/vacuum/plugin_handler.go
index 849100d638..1ccd3cb7d0 100644
--- a/weed/worker/tasks/vacuum/plugin_handler.go
+++ b/weed/worker/tasks/vacuum/plugin_handler.go
@@ -85,7 +85,7 @@ func (h *VacuumHandler) Descriptor() *plugin_pb.JobTypeDescriptor {
 						{
 							Name:        "collection_filter",
 							Label:       "Collection Filter",
-							Description: "Filter collections for vacuum detection. Use ALL_COLLECTIONS (default) to treat all volumes as one pool, EACH_COLLECTION to run detection separately per collection, or a regex pattern to match specific collections.",
+							Description: "Filter collections for vacuum detection. Use ALL_COLLECTIONS (default) to treat all volumes as one pool, EACH_COLLECTION to run detection separately per collection, or a comma-separated list of names, wildcards, or regex patterns.",
 							Placeholder: "ALL_COLLECTIONS",
 							FieldType:   plugin_pb.ConfigFieldType_CONFIG_FIELD_TYPE_STRING,
 							Widget:      plugin_pb.ConfigWidget_CONFIG_WIDGET_TEXT,